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‘They do not preach that their God will rouse them a little before 
the nuts work loose. 

They do not teach that His Pity allows them to drop their job when 
they dam’-well choose. 

As in the thronged and the lighted ways, so in the dark and the 
desert they stand, 

Wary and watchful all their days that their brethren’s days may be 
long in the land.’ 

Rudyard Kipling (The Sons of Martha, 1907) 


Wo einer kommt and saget an, 

Er hat es alien recht getan, 

So bitten wir diesen lieben Herrn, 

Er woll uns solche Kunste auch lehrn 

(Whoever is able to say to us 
‘I have done everything right’, 

We beg that honest gentleman 
To show us how it is done) 


Inscription over the ‘Zwischenbau’ adjoining the Rathaus in Brandenburg-on-the-Haven 
(quoted by Prince B.H.M. von Bulow in Memoirs, 1932) 

If the honeye that the bees gather out of so manye floure of herbes ... that are growing in other 
mennis medowes... may justly be called the bees’ honeye... so maye I call it that I have... 
gathered of manye good autores... my booke. 

William Turner (quoted byA. Scott-James in The Language of the Garden: A Personal Anthology) 


By the same author: 

A.W. Cox, F.P. Lees and M.L. Ang (1990): Classification of Hazardous Locations (Rugby: Institution of Chemical Engineers) 

Elwyn Edwards and Frank P. Lees (1973): Man and Computer in Process Control (London: Institution of Chemical 
Engineers) 

Elwyn Edwards and Frank P. Lees (eds) (1974): The Human Operator in Process Control (London: Taylor & Francis) 

Frank P. Lees and M.L. Ang (1989): Safety Cases (London: Butterworths) 



Lee’s Loss Prevention in 
the Process Industries 

Hazard Identification, Assessment and Control 
Volume 1 

Third edition 

Dr. Sam Mannan, PE, CSP 

Department of Chemical Engineering, 

Texas A&M University, 

Texas, USA 



J& 

ELSEVIER 

BUTTERWORTH 

HEINEMANN 

AMSTERDAM • BOSTON • HEIDELBERG • LONDON 
NEW YORK • OXFORD • PARIS • SAN DIEGO 
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO 





Elsevier Butterworth-Heinemann 

200 Wheeler Road, Burlington, MA 01803, USA 

Linacre House, Jordan Hill, Oxford 0X2 8DP, UK 

Copyright © 2005, Elsevier Inc. All rights reserved. 

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in 
any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, 
without the prior written permission of the publisher. 

Permissions may be sought directly from Elsevier’s Science & Technology Rights 
Department in Oxford, UK: phone: (+44) 1865 843830, fax: (+44) 1865 853333, 
e-mail: permissions@elsevier.com.uk. You may also complete your request 
online via the Elsevier homepage (http://elsevier.com), by selecting “Customer 
Support” and then “Obtaining Permissions.” 

Recognizing the importance of preserving what has been written, Elsevier prints its books on 
acid-free paper whenever possible. 

Library of Congress Cataloging-in-Publication Data 

Lee’s loss prevention in the process industries. - 3rd ed. / edited by Sam Mannan. 

P- cm. 

Rev. ed. of: Loss prevention in the process industries / Frank P. Lees. 2nd ed. 1996. 

Includes bibliographical references and indexes. 

ISBN 0-7506-7555-1 (casebound, set: alk. paper) 1. Petroleum chemicals industry- 
Great Britain-Safety measures. 2. Petroleum chemicals industry-United States-Safety 
measures. I. Title: Loss prevention in the process industries. II. Mannan, Sam. III. 

Lees, Frank P. Loss Prevention in the process industries. 

TP690.6.L43 2005 
660'.2804—dc22 

2004018498 


British Library Cataloguing-in-Publication Data 

A catalogue record for this book is available from British Library 

Set ISBN: 0-7506-7555-1 
Volume 1 ISBN: 0-7506-7857-7 
Volume 2 ISBN: 0-7506-7858-5 
Volume 3 ISBN: 0-7506-7589-3 

For information on all Elsevier Butterworth-Heinemann Publications 
visit our Web site at www.books.elsevier.com 

04 05 06 07 08 09 10 10 9 8 7 6 5 4 3 2 1 


Printed in the United States of America 


Preface to Third Edition 


The first edition of this book appeared in 1980, at the end of 
a decade of rapid growth and development in loss preven¬ 
tion. In the preface to the second edition, Frank P. Lees 
wrote, “After another decade and a half the subject is more 
mature, although development continues apace. In prepar¬ 
ing this second edition it has been even more difficult than 
before to decide what to put in and what to leave out.” Frank 
Lees’ statement in 1996 rings even truer today, another 
eight years later in 2004. Industrial advances and technol¬ 
ogy changes coupled with recent events have made it 
essential to focus on new topics while keeping a complete 
grasp of all of older technologies and learnings as well. 
Safety programs today must also consider issues such as 
chemical reactivity hazards, safety instrumented systems, 
and layer of protection analysis. In the post 9-11 world, 
process safety and loss prevention must also include con¬ 
sideration of issues related to chemical security and resi¬ 
lient engineering systems. 

The history of safety regulations in the United States can 
be traced back to the year before the beginning of the 
twentieth century. The River and Harbor Act, the first 
known federal legislation relevant to safety was promul¬ 
gated in 1899. Since then, the total number of legislations 
has steadily increased. In addition to the federal govern¬ 
ment, local entities such as the state, county, and cities have 
also promulgated regulations and ordnances, which 
impose safety requirements on process facilities. Varying 
degrees of similar legislative action has also occurred in 
the rest of the world.These legislation were all promulgated 
in response to some event, demographic changes, as well as 
changes in the industry. Also, as our understanding of the 
hazards associated with industrial processes developed, 
procedures and practices were put in place to limit or elim¬ 
inate the damage. Government programs and industry 
initiatives spurred improvements in the science and tech¬ 
nology needed for the recognition of hazards and asso¬ 
ciated risks. 

Management systems have been put in place to implement 
regulations and industry practices. Government regula¬ 
tions will continue to be a significant driver for safety pro¬ 
grams. As such, one of the main objectives of these 
management systems is to ensure compliance. However, it is 
also quite clear that profitability is directly related to safety 
and loss prevention. Thus the management systems for 
safety are intricately tied into the operational management. 

The industrial revolution brought prosperity and along 
with it the use of hazardous processes and complex tech¬ 
nologies. Growing economies and global competition has led 
to more complex processes involving the use of hazardous 
chemicals, exotic chemistry, and extreme operating condi¬ 
tions. As a result, a fundamental understanding of the 
hazards and associated risks is essential. Process safety and 
risk management requires the application of the basic sci¬ 
ences and a systematic approach. Recent advances, such as 
overpressure protection alternatives and reactive chemistry 
allow safer design and operation of processes. 

In the multiple barriers concept, plants are designed 
with several layers so that an incident would require the 


failure of several systems. Another novel approach to pro¬ 
cess safety and risk management is to consider various 
actions in a descending hierarchical order. Inherently safer 
design consideration should be first in the hierarchy fol¬ 
lowed by prevention systems, mitigation, and response. 
The success of these systems is dependent on the funda¬ 
mental understanding of the process and the associated 
hazards. Chronic as well as catastrophic consequences 
resulting from toxic and flammable substances can be 
reduced and/or eliminated through appropriate design and 
operating practices. 

Managing safety is no easy task, but it makes bottom- 
line sense. There is a direct payoff in savings on a company 
workers’ compensation insurance, whose premiums are 
partly based on the number of claims paid for job injuries. 
The indirect benefits are far larger, for safe plants tend to 
be well run in general and more productive. The recipe for 
safety is remarkably consistent from industry to industry. 
It starts with sustained support of top management fol¬ 
lowed by implementation of appropriate programs and 
practices that institutionalize safety as a culture as com¬ 
pared to add-on procedures. The ingraining of safety as 
second nature in day-to-day activities requires a paradigm 
shift and can only be accomplished when safety is viewed 
as an integral and comprehensive part of any activity as 
compared to being a stand-alone or add-on activity. 

This third edition of Loss Prevention in the Process 
Industries represents a combination of appropriate revi¬ 
sions of the essential compilations put together by Frank P. 
Lees, along with several new chapters and additions on 
new areas that deserve attention and discussion. The third 
edition includes five new chapters and three new appen¬ 
dices. The five new chapters address incident investigation, 
inherently safer design, reactive chemicals, safety instru¬ 
mented systems, and chemical security. The three new 
appendices address process safety management regulation 
in the United States, risk management program regulation 
in the United States, and incident databases. 

The chapter on incident investigation provides a sum¬ 
mary of incident investigation procedures that can be used 
not only to determine causes of incidents but also provides 
a primer on capturing and integrating lessons learned from 
incident investigations into design, operations, main¬ 
tenance, and response programs. Chemical process inci¬ 
dents can be accompanied by significant consequences, 
both in terms of human life and in financial impact. Many 
major chemical process incidents are the result of a complex 
scenario involving simultaneous failures of multiple safe¬ 
guards. A robust system for incident investigation is 
usually necessary to determine and understand the causes, 
as well as implement measures to prevent a repeat event. 
This chapter is intended to provide an overview of incident 
investigation by addressing major concepts, principles, 
and characteristics of effective incident investigations of 
chemical process events. The focus is on incidents per¬ 
taining to chemical processes and their associated hazards, 
and the associated investigation techniques appropriate for 
complex systems and scenarios. This chapter is based on 



best practices for incident investigation, and those com¬ 
mon concepts (i.e., tools, techniques, definitions) included 
in root cause investigation methodologies currently in the 
public domain in use in the process industry. It is not the 
intention to provide a stand-alone investigation methodol¬ 
ogy/guideline, nor address internal or proprietary investi¬ 
gation methodologies. 

The chapter on inherently safer design addresses 
options and issues that can be considered with regard to the 
design and operation of plants. Inherently safer design is a 
philosophy that focuses on elimination of hazards or 
reduction of the magnitude of hazards rather than the 
control of hazards. Many of the concepts of inherently safer 
design have been applied by engineers in a wide variety of 
technologies for many years, without recognizing the 
common approach. In the late 1970s, in the wake of many 
large incidents in the chemical industry, Trevor Kletz 
recognized the common philosophies of hazard elimination 
and hazard reduction, gave the philosophy the name 
“inherently safer design,” and developed a specific set of 
approaches to help engineers in the chemical process 
industries to design inherently safer processes and plants. 
Trevor realized that increased expectations for safety, from 
companies, regulatory bodies, and society in general, 
combined with the increased potential damage from inci¬ 
dents in the larger plants being built to meet increased 
demand and global markets, resulted in increased com¬ 
plexity and cost for the safety systems required to satisfy 
these demands. Furthermore, while hazard control systems 
can be made highly reliable, they can never be perfect and 
will always have some failure probability. While this prob¬ 
ability can be made very small, there is always some chance 
that all safety systems will fail simultaneously and the 
result would be a large incident. Also, the hazard manage¬ 
ment systems require ongoing maintenance, as well as 
management and operator training, for the life of the plant. 
This results in ongoing costs, and the potential for future 
deterioration of the safety systems. Deteriorated systems 
will have reduced reliability, increasing the potential for a 
catastrophic accident. Trevor Kletz suggested that in many 
cases, a simpler, cheaper, and safer plant could be designed 
by focusing on the basic technology, eliminating or sig¬ 
nificantly reducing hazards, and therefore the need to 
manage them. 

The chapter on reactive chemicals provides an overview 
of this critical issue and provides guidance on management 
systems as well as experimental and theoretical methods 
for analyses of chemical reactivity hazards. Serious inci¬ 
dents arising from uncontrolled reactivity have taken place 
since the inception of the chemical industry. The human toll 
of such incidents has been staggering. In recent decades, 
greater recognition and resources have been directed 
toward preventing and mitigating such occurrences. A 
number of incidents have been so severe as to prompt reg¬ 
ulatory initiatives to force better management of reactivity. 
It is prudent for any company, organization, or other group 
to scrutinize the chemicals being handled and implement 
measures to limit the risk of a major reactive hazards event. 
A sampling of incidents that have substantially heightened 
concerns regarding reactive hazards in the general public, 
in governmental agencies, and in industry includes: 


• The 1976ICMESA incident in Seveso, Italy in which an 
uncontrolled chemical reaction generated pressure 


resulting in relief venting of a highly toxic dioxane into 
the neighboring villages and countryside. 

• The 1984 Union Carbide incident in Bhopal, India in 
which methyl isocyanate was contacted with water, 
generating highly toxic cyanide gas and leading to 
thousands of fatalities. 

• The 1994 NappTechnology incident in Lodi, Newjersey 
in which an uncontrolled reaction involving gold ore 
processing led to the deaths of five firefighters. 

• The 1999 Concept Sciences incident in Allentown, 
Pennsylvania in which an explosion arising from 
a process concentrating hydroxylamine resulted in five 
fatalities. Another event involving purified hydro¬ 
xylamine took place in a Nissin Chemical plant in 
Gunma Prefecture, Japan in 2000 and led to four 
fatalities. 

• The 2001 TotalFinaElf incident in Toulouse, France in 
which ammonium nitrate being processed for nitrogen 
fertilizers exploded leading to 30 fatalities. 

These events, as well as numerous others, have influenced 
the perception and approach to reactive hazards. 

The chapter on safety instrumented systems addresses 
systems and procedures that need to be in place with regard 
to this area of safety and instrumentation. In many pro¬ 
cesses, technical or manufacturing issues limit the engi¬ 
neer’s capability to design an inherently safer process. 
Further, there is generally a point where the required capi¬ 
tal investment is disproportional to the additional risk 
reduction provided by the process modification. In other 
words, the derived safety benefit is too low relative to the 
economic investment. When this occurs, protection layers 
or safeguards must be provided to prevent or mitigate the 
process risk. A Safety Instrumented System (SIS) is a 
protection layer, which shuts down the plant, or part of it, if 
a hazardous condition is detected. Throughout the years, 
SIS have also been known as Emergency Shutdown Sys¬ 
tems (ESD, ESS), Safety Shutdown Systems (SSD), Safety 
Interlock Systems (SIS), Safety Critical Systems (SCS), 
Safety Protection Systems (SPS), Protective Instrumented 
Systems (PIS), interlocks, and trip systems. Regardless of 
what the SIS may be called, the essential characteristic of 
the SIS is that it is composed of instruments, which detect 
that process variables are exceeding preset limits, a logic 
solver, which processes this information and makes deci¬ 
sions, and final control elements, which take necessary 
action on the process to achieve a safe state. 

The chapter on chemical security deals with this new 
and critical element of the management of a process facility 
following the events of September 11, 2001. Security man¬ 
agement is required for protecting the assets (including 
employees) of the facility, maintaining the ongoing integ¬ 
rity of the operation, and preserving value of the invest¬ 
ment. Process security and process safety have many 
parallels and make use of many common programs and 
systems for achieving their ends. Process security requires 
a management systems approach to develop a comprehen¬ 
sive security program, which shares many common ele¬ 
ments to process safety management. 

The new appendix on process safety management reg¬ 
ulation in the United States provides a summary of this 
regulatory requirement. The fourteen elements of the 
OSHA Process Safety Management (PSM) regulation (29 
CFR 1910.119) were published in the U.S. Federal Register 
on February 24,1992. The objective of the regulation is to 


prevent or minimize the consequences of catastrophic 
releases of toxic, reactive, flammable, or explosive chemi¬ 
cals. The regulation requires a comprehensive manage¬ 
ment program: a holistic approach that integrates 
technologies, procedures, and management practices. The 
process safety management regulation applies to processes 
that involve certain specified chemicals at or above 
threshold quantities, processes that involve flammable 
liquids or gases on-site in one location, in quantities of 
10,000 pounds or more (subject to few exceptions), and 
processes that involve the manufacture of explosives and 
pyrotechnics. Hydrocarbon fuels, which may be excluded if 
used solely as a fuel, are included if the fuel is part of a 
process covered by this regulation. In addition, the reg¬ 
ulation does not apply to retail facilities, oil or gas well 
drilling or servicing operations, or normally unoccupied 
remote facilities. 

The new appendix on risk management program reg¬ 
ulation in the United States provides a summary of this 
regulatory requirement administered by the U.S. Environ¬ 
mental Protection Agency. In 1996, EPA promulgated the 
regulation for Risk Management Programs for Chemical 
Accident Release Prevention (40 CFR 68). This federal reg¬ 
ulation was mandated by section 112(r) of the Clean Air Act 
Amendments of 1990. The regulation requires regulated 
facilities to develop and implement appropriate risk 
management programs to minimize the frequency and 
severity of chemical plant accidents. In keeping with 
regulatory trends, EPA required a performance-based 
approach towards compliance with the risk management 
program regulation. The EPA regulation also requires reg¬ 
ulated facilities to develop a Risk Management Plan 
(RMP). The RMP includes a description of the hazard 
assessment, prevention program, and the emergency res¬ 
ponse program. Facilities submit the RMP to the EPA 
and subsequently is made available to governmental 
agencies, the state emergency response commission, the 
local emergency planning committees, and communicated 
to the public. 

The new appendix on incident databases addresses 
compilations of incident databases that can used for 


improving safety programs, developing trends, perfor¬ 
mance measures, and metrics. Incident prevention and 
mitigation of consequences is the focus of a number of 
industry programs regulatory initiatives. As part of these 
programs and regulations, accident history data are often 
collected. There are two basic types of information. One is a 
database consisting of standardized fields of data usually 
for a large number of incidents. The second are more 
detailed reports of individual incidents. Analysis of these 
incident history databases can provide insight into incident 
prevention needs. While the analysis and conclusions 
obtained from the incident database are often limited by 
the shortcomings of the databases themselves, the fact 
remains that incident history databases are very useful and 
can be a powerful tool in focusing risk reduction efforts. 
The conclusions can be used to identify systematically the 
greatest risks to allow prioritization of efforts to improve 
process safety. At the plant level this might entail identify¬ 
ing certain processes, types of equipment, chemicals, 
operations and other factors most commonly associated 
with incidents. Databases that cover a very large number of 
facilities are likely to reveal trends and patterns that no one 
company or facility could determine from their own 
experience. Statistical knowledge of the likelihood of the 
release of certain types of chemicals could help emergency 
responders, state emergency response commissions, and 
local emergency planning committees determine the most 
likely and most serious chemical releases in their areas and 
plan appropriate chemical accident responses. Incident 
databases may also help identify technologies and prac¬ 
tices to prevent chemical accidents, or the need to develop 
them. For example, the data could indicate that inspection 
and preventive maintenance of equipment and instruments 
should become more thorough or more frequent. 


M. Sam Mannan 
College Station, 
Texas, USA 
2004 



Preface to Second Edition 


The first edition of this book appeared in 1980, at the end of 
a decade of rapid growth and development in loss preven¬ 
tion. After another decade and a half the subject is more 
mature, although development continues apace. In prepar¬ 
ing this second edition it has been even more difficult than 
before to decide what to put in and what to leave out. 

The importance of loss prevention has been underlined 
by a number of disasters. Those at San Carlos, Mexico City, 
Bhopal and Pasadena are perhaps the best known, but 
there have been several others with death tolls exceeding 
100. There have also been major incidents in related areas, 
such as those on the Piper Alpha oil platform and at the 
nuclear power stations at Three Mile Island and Chernobyl. 

Apart from the human tragedy, it has become clear that 
a major accident can seriously damage even a large inter¬ 
national company and may even threaten its existence, 
rendering it liable to severe damages and vulnerable to 
takeover. 

Accidents in the process industries have given impetus 
to the creation of regulatory controls. In the UK the Advi¬ 
sory Committee on Major Hazards made its third and final 
report in 1983. At the same time the European Community 
was developing its own controls which appeared as the EC 
Directive on Major Accident Hazards. The resulting UK 
legislation is the NIHHS Regulations 1982 and the CIMAH 
Regulations 1984. Other members of the EC have brought 
in their own legislation to implement the Directive. There 
have been corresponding developments in planning con¬ 
trols. 

An important tool for decision-making on hazards is 
hazard assessment. The application of quantitative meth¬ 
ods has played a crucial role in the development of loss 
prevention, but there has been lively debate on the proper 
application of such assessment, and particularly on the 
estimation and evaluation of the risk to the public. 

Hazard assessment involves the assessment both of the 
frequency and of the consequences of hazardous events. In 
frequency estimation progress has been made in the col¬ 
lection of data and creation of data banks and in fault tree 
synthesis and analysis, including computer aids. In con¬ 
sequence assessment there has been a high level of activity 
in developing physical models for emission, vaporization 
and gas dispersion, particularly dense gas dispersion; for 
pool fires, fireballs, jet flames and engulfing fires; for 
vapour cloud explosions; and for boiling liquid expanding 
vapour explosions (BLEVEs).Work has also been done on 
injury models for thermal radiation, explosion over¬ 
pressure and toxic concentration, on models of the density 
and other characteristics of the exposed population, and 
on shelter and escape. 

Some of these topics require experimental work on a 
large scale and involving international cooperation. Large 
scale tests have been carried out at several sites on dense 
gas dispersion and on vapour cloud fires and explosions. 
Another major cooperative research programme has been 
that of DIERS on venting of chemical reactors. 

The basic approach developed for fixed installations on 
shore has also been increasingly applied in other fields. For 


transport in the UK the Transport Hazards Report of the 
Advisory Committee on Dangerous Substances represents 
an important landmark. Another application is in the off¬ 
shore oil and gas industry, for which the report on the Piper 
Alpha disaster, the Cullen Report, constitutes a watershed. 

As elsewhere in engineering, computers are in wide¬ 
spread use in the design of process plants, where computer 
aided design (CAD) covers physical properties, flowsheet¬ 
ing, piping and instrument diagrams, unit operations and 
plant layout. There is increasing use of computers for fail¬ 
ure data retrieval and analysis, reliability and availability 
studies, fault tree synthesis and analysis and consequence 
modelling, while more elusive safety expertise is being 
captured by computer-based expert systems. 

The subject of this book is the process industries, but 
the process aspects of related industries, notably nuclear 
power and oil and gas platforms are briefly touched on. The 
process industries themselves are continually changing. In 
the last decade one of the main changes has been increased 
emphasis on products such as pharmaceuticals and agro¬ 
chemicals made by batch processes, which have their own 
particular hazards. 

All this knowledge is of little use unless it reaches the 
right people. The institutions which educate the engineers 
who will be responsible for the design and operation of 
plants handling hazardous materials have a duty to make 
their students aware of the hazards and at least to make a 
start in gaining competence in handling them. 

I would like again to thank for their encouragement the 
heads of the Department of Chemical Engineering at 
Loughborough, Professors D.C. Freshwater, BW Brooks 
and M. Streat; our Industrial Professors T.A. Kletz and 
H.A. Duxbury and Visiting Professor S.M. Richardson; my 
colleagues, past and present, in the Plant Engineering 
Group, Mr R.J. Aird, Dr P.K. Andow, Dr M.L. Ang, 
Dr PWH. Chung, Dr D.W. Edwards, Dr P. Rice and 
Dr A.G. Rushton - I owe a particular debt to the latter; the 
members of the ACMH, chaired by Professor B.H. Harvey; 
the sometime directors of Technica Ltd, Dr D.H. Slater, 
Mr P. Charsley, Dr P.J. Comer, Dr R.A. Cox, MrT. Gjerstad, 
Dr M.A.F. Pyman, Mr C.G. Ramsay, Mr M.A. Seaman and 
Dr R. Whitehouse; the members of the IChemE Loss Pre¬ 
vention Panel; the IChemE’s former Loss Prevention Offi¬ 
cer, Mr B.M. Hancock; the members of the IChemE Loss 
Prevention Study Group and of the Register of Safety Pro¬ 
fessionals; the editorial staff of the IChemE, in particular 
Mr B. Brammer; numerous members of the Health and 
Safety Executive, especially Dr A.C. Barrell, Mr J. Barton, 
Dr D.A. Carter, Mr K. Cassidy, Mr P.J. Crossthwaite, 
Dr N.W. Hurst, Dr S.F. Jagger, Dr J. McQuaid, Dr K. Moodie, 
Dr C. Nussey, Dr R.P. Pape, Dr A.F. Roberts and 
Dr N.F. Scilly; workers at the Safety and Reliability Direc¬ 
torate, particularly Dr A.T.D. Butland, Mr I. Hymes, 
Dr D.W Phillips and Dr D.M. Webber; staff at Shell 
Thornton Research Centre, including Dr D.C. Bull and 
Dr A.C. Chamberlain; staff at British Gas, including 
Dr J.D. Andrews, Dr M.J. Harris, Mr H. Hopkins, 
Dr J.M. Morgan and Dr D.J. Smith; staff at the Ministry of 


Defence, Explosives Storage and Transport Committee, 
including Mr M.A. Gould, Mr J. Henderson and Mr P. Stone; 
and colleagues who have taught on post-experience courses 
at Loughborough, in particular Dr C.D. Jones, Dr DJ. Lewis 
and Mr J. Madden; BP International and Mr R. Malpas for 
allowing me to spend a period of study leave with the com¬ 
pany in 1985-86 and Mr F.D.H. Moysen, Mr G. Hately, 
Mr M. Hough, Mr R. Fearon and others in the Central Safety 
Group and in Engineering Department; the Honourable 
Lord Cullen, my fellow Technical Assessors on the Piper 
Alpha Inquiry, Mr B. Appleton and Mr G.M. Ford and the 
Cremer and Warner team at the inquiry, in particular 
Mr G. Kenney and Mr R. Sylvester-Evans; other profes¬ 
sional colleagues Dr L J. Bellamy, Professor B. A. Buffham, 
Dr D.A. Crowl, MrT.J. Gilbert, Mr D.O. Hagon, Dr D.J. Hall, 
Mr K.M. Hill, Professor T.M. Husband, Mr M. Kneale, 
Dr VC. Marshall, Dr M.L. Preston, Dr J. Rasmussen, 
Dr J.R. Roach, Dr J.R. Taylor, Dr VM. Trbojevic, Mr H.M. 
Tweeddale, Dr G.L. Wells and Dr A.J.Wilday; my research 


colleagues Dr C.P. Murphy, Mrs J.I. Petts, Dr D.J. Sherwin, 
Mr R.M.J. Withers and Dr H. Zerkani; my research students 
Mr M. Aldersey, Mr D.C. Arulanantham, Dr A. Bunn, Dr 
M.A. Cox, Dr PA. Davies, Dr S.M. Gilbert, Mr P. Heino, Dr 
A. Hunt, Dr B.E. Kelly, Dr G.P.S. Marrs, Dr J.S. Mullhi, 
Dr J.C. Parmar, Mr B. Poblete, Dr A. Shafaghi and Dr A.J. 
Trenchard as well as colleagues’ research students Mr E.J. 
Broomfield, Mr R. Goodwin, Mr M.J. Jefferson, Dr F.D. 
Larkin, Mr S.A. McCoy, Dr K. Plamping, Mr J. Soutter, Dr P. 
Thorpe and Mr S.J. Wakeman; the office staff of the 
Department, Mrs E.M. Barradell, Mr D.M. Blake, Miss H.J. 
Bryers and Miss Y. Kosar; the staff of the University 
Library, in particular Miss S.F. Pilkington; and my wife 
Elizabeth, whose contribution has been many-faceted and 
in scale with this book. 

Frank P. Lees 
Loughborough, 

1994 


Preface to First Edition 


Within the past ten or fifteen years the chemical and pet¬ 
roleum industries have undergone considerable changes. 
Process conditions such as pressure and temperature have 
become more severe. The concentration of stored energy 
has increased. Plants have grown in size and are often sin¬ 
gle-stream. Storage has been reduced and interlinking with 
other plants has increased. The response of the process is 
often faster. The plant contains very large items of equip¬ 
ment. The scale of possible fire, explosion or toxic release 
has grown and so has the area which might be affected by 
such events, especially outside the works boundary. 

These factors have greatly increased the potential for 
loss both in human and in economic terms. This is clear 
both from the increasing concern of the industry and its 
insurers and from the historical loss statistics. 

The industry has always paid much attention to safety 
and has a relatively good record. But with the growing scale 
and complexity involved in modern plants the danger of 
serious large-scale incidents has been a source of increas¬ 
ing concern and the adequacy of existing procedures has 
been subjected to an increasingly critical examination. 

Developments in other related areas have also had an 
influence. During the period considered there has been 
growing public concern about the various forms of pollu¬ 
tion, including gaseous and liquid effluents and solid 
wastes and noise. 

It is against this background that the loss prevention 
approach has developed. It is characteristic of this 
approach that it is primarily concerned with the problems 
caused by the depth of technology involved in modern 
processes and that it adopts essentially an engineering 
approach to them. As far as possible both the hazards and 
the protection are evaluated quantitatively. 

The clear recognition by senior management of the 
importance of the loss prevention problem has been crucial 
to these developments. Progress has been made because 
management has been prepared to assign to this work 
many senior and capable personnel and to allocate the other 
resources necessary. 

The management system is fundamental to loss preven¬ 
tion. This involves a clear management structure with well 
defined line and advisory responsibilities staffed by com¬ 
petent people. It requires the use of appropriate procedures, 
codes of practice and standards in the design and operation 
of plant. It provides for the identification, evaluation and 
reduction of hazards through all stages of a project from 
research to operation. It includes planning for emergencies. 

The development of loss prevention can be clearly traced 
through the literature. In 1960 the Institution of Chemical 
Engineers held the first of a periodic series of symposia on 
Chemical Process Hazards with Special Reference to Plant 
Design. The Dow Chemical Company published its Process 
Safety Manual in 1964. The American Institute of Chemical 
Engineers started in 1967 an annual series of symposia on 
Loss Prevention. The European Federation of Chemical 
Engineers’ symposium on Major Loss Prevention m the 
Process Industries at Newcastle in 1971 and the Federation’s 
symposium on Loss Prevention and Safety Promotion in the 


Process Industries (Buschmann, 1974) at Delft are further 
milestones. 

Another indicator is the creation in 1973 by the Institu¬ 
tion of Chemical Engineers Engineering Practice Commit¬ 
tee of a Loss Prevention Panel under the chairmanship of 
MrT.A. Kantyka. 

In the United Kingdom the Health and Safety at Work etc. 
Act 1974 has given further impetus to loss prevention. The 
philosophy of the Robens Report (1972), which is embodied 
in the Act, is that of self-regulation by industry. It is the 
responsibility of industry to take all reasonable measures 
to assure safety. This philosophy is particularly appro¬ 
priate to complex technological systems and the Act pro¬ 
vides a flexible framework for the development of the loss 
prevention approach. 

The disaster at Flixborough in 1974 has proved a turning 
point. This event has led to a much more widespread and 
intense concern with the loss prevention problem. It has 
also caused the government to set up in 1975 an Advisory 
Committee on Major Hazards. This committee has made 
far-reaching recommendations for the identification and 
control of major hazard installations. 

It will be apparent that loss prevention differs somewhat 
from safety as traditionally conceived in the process 
industries. The essential difference is the much greater 
engineering content in loss prevention. 

This is illustrated by the relative effectiveness of 
inspection in different processes. In fairly simple plants 
much can be done to improve safety by visual inspection. 
This approach is not adequate, however, for the more tech¬ 
nological aspects of complex processes. 

For the reasons given above loss prevention is currently 
a somewhat fashionable subject. It is as well to emphasize, 
therefore, that much of it is not new, but has been devel¬ 
oped over many years by engineers whose patient work in 
an often apparently unrewarding but vital field is the 
mark of true professionalism. 

It is appropriate to emphasize, moreover, that accidents 
arising from relatively mundane situations and activities 
are still responsible for many more deaths and injuries than 
those due to advanced technology. 

Nevertheless, loss prevention has developed in response 
to the growth of a new problem, the hazard of high tech¬ 
nology processes, and it does have a distinctive approach 
and some novel techniques. Particularly characteristic are 
the emphasis on matching the management system to the 
depth of technology in the installation, the techniques 
developed for identifying hazards, the principle and meth¬ 
ods of quantifying hazards, the application of reliability 
assessment, the practice of planning for emergencies and 
the critique of traditional practices or existing codes, 
standards or regulations where these are outdated by 
technological change. 

There is an enormous, indeed intimidating, literature on 
safety and loss prevention. In addition to the symposia 
already referred to, mention may be made of the Handbook 
of Safety and Accident Prevention in Chemical Operations by 
Fawcett and Wood (1965); the Handbook of Industrial Loss 


Prevention by the Factory Mutual Engineering Corporation 
(1967); and the Industrial Safety Handbook by Handley 
(1969, 1977). These publications, which are by multiple 
authors, are invaluable source material. 

There is a need, however, in the author’s view for a 
balanced and integrated textbook on loss prevention in the 
process industries which presents the basic elements of the 
subject, which covers the recent period of intense develop¬ 
ment and which gives a reasonably comprehensive biblio¬ 
graphy. The present book is an attempt to meet this need. 

The book is based on lectures given to undergraduate 
and postgraduate students at Loughborough over a per¬ 
iod of years and the author gladly acknowledges their 
contribution. 

Loss prevention is a wide and rapidly developing field 
and is therefore not an easy subject for a book. Never¬ 
theless, it is precisely for these reasons that the engineer 
needs the assistance of a textbook and that the attempt has 
been considered justified. 

The structure of the book is as follows. Chapter 1 deals 
with the background to the historical development of loss 
prevention, the problem of large, single-stream plants, and 
the differences between loss prevention and conventional 
safety, and between loss prevention and total loss control; 
Chapter 2 with hazard, accident and loss, including histor¬ 
ical statistics; Chapter 3 with the legislation and legal 
background; Chapter 4 with the control of major hazards; 
Chapter 5 with economic and insurance aspects; Chapter 6 
with management systems, including management struc¬ 
ture, competent persons, systems and procedures, stan¬ 
dards and codes of practice, documentation and auditing 
arrangements; Chapter 7 with reliability engineering, 
including its application in the process industries; Chapter 8 
with the spectrum of techniques for identifying hazards 
from research through to operation; Chapter 9 with the 
assessment of hazards, including the question of accep¬ 
table risk; Chapter 10 with the siting and layout of plant; 
Chapter 11 with process design, including application of 
principles such as limitation of inventory, consideration of 
known hazards associated with chemical reactors, unit 
processes, unit operations and equipments, operating con¬ 
ditions, utilities, particular chemicals and particular pro¬ 
cesses and plants, and checking of operational deviations; 
Chapter 12 with pressure system design, including prop¬ 
erties of materials, design of pressure vessels and pipe¬ 
work, pressure vessel standards and codes, equipment 
such as heat exchangers, fired heaters and rotating 
machinery, pressure relief and blowdown arrangements, 
and failure in pressure systems; Chapter 13 with design of 
instrumentation and control systems, including regular 
instrumentation, process computers and protective sys¬ 
tems; Chapter 14 with human factors in process control, 
process operators, computer aids and human error; Chap¬ 
ter 15 with loss of containment and dispersion of material; 
Chapter 16 with fire, flammability characteristics, ignition 
sources, flames and particular types of process fire, effects 
of fire and fire prevention, protection and control; 
Chapter 17 with explosion, explosives, explosion energy, 
particular types of process explosion such as confined 
explosions, unconfined vapour cloud explosions and dust 
explosions, effects of explosion and explosion prevention, 
protection and relief; Chapter 18 with toxicity of chemicals, 
toxic release and effects of toxic release; Chapter 19 with 
commissioning and inspection of plant; Chapter 20 with 
plant operation; Chapter 21 with plant maintenance and 


modification; Chapter 22 with storage; Chapter 23 with 
transport, particularly by road, rail and pipeline; 
Chapter 24 with emergency planning both for works and 
transport emergencies; Chapter 25 with various aspects of 
personal safety such as occupational health and industrial 
hygiene, dust and radiation hazards, machinery and elec¬ 
trical hazards, protective clothing and equipment, and 
rescue and first aid; Chapter 26 with accident research; 
Chapter 27 with feedback of information and learning from 
accidents; Chapter 28 with safety systems, including the 
roles of safety managers and safety committees and repre¬ 
sentatives. There are appendices on Flixborough, Seveso, 
case histories, standards and codes, institutional publica¬ 
tions, information sources, laboratories and pilot plants, 
pollution and noise, failure and event data, Canvey, model 
licence conditions for certain hazardous plants, and units 
and unit coversions. 

Many of the matters dealt with, such as pressure vessels 
or process control, are major subject areas in their own 
right. It is stressed, therefore, that the treatment given is 
strictly limited to loss prevention aspects. The emphasis is 
on deviations and faults which may give rise to loss. 

In engineering in general and in loss prevention in par¬ 
ticular there is a conflict between the demand for a state¬ 
ment of basic principles and that for detailed instructions. 
In general, the first of these approaches has been adopted, 
but the latter is extremely important in safety, and a con¬ 
siderable amount of detailed material is given and refer¬ 
ences are provided to further material. 

The book is intended as a contribution to the academic 
education of professional chemical and other engineers. 
Both educational and professional institutions have long 
recognized the importance of education in safety. But until 
recently the rather qualitative, and indeed often exhorta- 
tory, nature of the subject frequently seemed to present 
difficulties in teaching at degree level. The recent quanti¬ 
tative development of the subject goes far towards remov¬ 
ing these objections and to integrating it more closely with 
other topics such as engineering design. 

In other words, loss prevention is capable of development 
as a subject presenting intellectual challenge. This is all to 
the good, but a note of caution is appropriate. It remains 
true that safety and loss prevention depend primarily on 
the hard and usually unglamorous work of engineers with 
a strong sense of responsibility, and it is important that 
this central fact should not be obscured. 

For this reason the book does not attempt to select parti¬ 
cular topics merely because a quantitative treatment is 
possible or to give such a treatment as an academic exer¬ 
cise. The subject is too important for such an approach. 
Rather the aim has been to give a balanced treatment of the 
different aspects and a lead in to further reading. 

It is also hoped that the book will be useful to practising 
engineers in providing an orientation and entry to unfa¬ 
miliar areas. It is emphasized, however, that in this subject 
above all others, the specialized texts should be consulted 
for detailed design work. 

Certain topics which are often associated with loss pre¬ 
vention, for example included in loss prevention symposia, 
have not been treated in detail. These include, for example, 
pollution and noise. The book does not attempt to deal in 
detail with total loss control, but a brief account of this is 
given. 

The treatment of loss prevention given is based mainly 
on the chemical, petrochemical and petroleum industries, 



but much of it is relevant to other process industries, such 
as electrical power generation (conventional and nuclear), 
iron and steel, gas, cement, glass, paper and food. 

The book is written from the viewpoint of the United 
Kingdom and, where differences exist within the UK, of 
England. This point is relevant mainly to legislation. 

Reference is made to a large number of procedures and 
techniques. These do not all have the same status. Some are 
well established and perhaps incorporated in standards or 
codes of practice. Others are more tentative. As far as pos¬ 
sible the attempt has been made to give some indication of 
the extent to which particular items are generally accepted. 

There are probably also some instances where there is a 
degree of contradiction between two approaches given. In 
particular, this may occur where one is based on engineer¬ 
ing principles and the other on relatively arbitrary rules-of- 
thumb. 

The book does not attempt to follow standards and codes 
of practice in drawing a distinction between the words 
should, shall and must in recommending particular prac¬ 
tices and generally uses only the former. The distinction is 
important, however, in standards and codes of practice and 
it is described in Appendix 4 a . 

An explanation of some of the terms used is in order at 
this point. Unfortunately there is at present no accepted 
terminology in this field. In general, the problems con¬ 
sidered are those of loss, either of life or property. The term 
hazard is used to describe the object or situation which 
constitutes the threat of such loss. The consequences which 
might occur if the threat is realized are the hazard potential. 
Associated with the hazard there is a risk, which is the 
probability of the loss occurring. Such a risk is expressed 
as a probability or as a. frequency. Probability is expressed as 
a number in the range 0 to 1 and is dimensionless; fre¬ 
quency is expressed in terms of events per unit time, or 
sometimes in other units such as events per cycle or per 
occasion. Rate is also used as an alternative to frequency 
and has the same units. 

The analysis of hazards involves qualitative hazard 
identification and quantitative hazard assessment. The lat¬ 
ter term is used to describe both the assessment of hazard 
potential and of risk. The assessment of risk only is 
described as risk assessment. 

In accident statistics the term Fatal Accident Frequency 
Rate (FAFR) has some currency. The last two terms are 
tautologous and the quantity is here referred to as Fatal 
Accident Rate (FAR). 

Further treatments of terminology in this field are given 
by BS 4200: 1967, by Green and Bourne (1962), by the 
Council for Science and Society (1977) and by Harvey 
(1979b). 

Notation is defined for the particular chapter at the point 
where the symbols first occur. In general, a consistent 
notation is used, but well established equations from stan¬ 
dards, codes and elsewhere are usually given in the original 
notation. A consolidated list of the notation is given at the 
end of chapters in which a large number of symbols is used. 

The units used are in principle SI, but the exceptions are 
fairly numerous. These exceptions are dimensional equa¬ 
tions, equations in standards and codes, and other equa¬ 
tions and data given by other workers where conversion has 
seemed undesirable for some reason. In cases of conversion 

“Appendices 4, 5 and 12 in the first edition correspond to Appen¬ 
dices 27,28 and 30, respectively, in this second edition. 


from a round number it is often not clear what degree 
of rounding off is appropriate. In cases of description of 
particular situations it appears pedantic to make the 
conversion where a writer has referred, for example, to a 
1 inch pipe. 

Notes on some of the units used are given in Appendix 
12 a . For convenience a unit conversion table is included in 
this appendix. Numerical values given by other authors are 
generally quoted without change and numerical values 
arising from conversion of the units of data given by other 
authors are sometimes quoted with an additional sig¬ 
nificant figure in order to avoid excessive rounding of 
values. 

Some cost data are quoted in the book. These are given in 
pounds or US dollars for the year quoted. 

A particular feature of the book is a fairly extensive 
bibliography of some 5000 references. These references are 
consolidated at the end of the book rather than at the end of 
chapters, because many items are referred to in a number of 
chapters. Lists of selected references on particular topics 
are given in table form in the relevant chapters. 

Certain institutions, however, have a rather large number 
of publications which it is more convenient to treat in a 
different manner. These are tabulated in Appendices 4 a and 
5 a , which contain some 2000 references. There is a cross- 
reference to the institution in the main reference list. 

In many cases institutions and other organizations are 
referred to by their initials. In all cases the first reference in 
the book gives the full title of the organization. The initials 
may also be looked up in the Author Index, which gives the 
full title. 

A reference is normally given by quoting the author and, 
in brackets, the date, e.g. Kletz (1971). Publications by the 
same author in the same year are denoted by letters of the 
alphabet a, b, c, etc., e.g. Allen (1977a), while publications 
by authors of the same surname and in the same year are 
indicated for convenience by an asterisk against the year in 
the list of references. In addition, the author’s initials are 
given in the main text in cases where there may still be 
ambiguity. Where a date has not been determined this is 
indicated as n.d. 

In the case of institutional publications listed in Appen¬ 
dices 4 a and 5 a the reference is given by quoting the insti¬ 
tution and, in brackets, the date, the publication series, e.g. 
HSE (1965 HSW Bklt 34) or the item number, e.g. IChemE 
(1971 Item 7). For institutional publications with a named 
author the reference is generally given by quoting the 
author and, in brackets, the initials of the institution, the 
date and the publication series or item number, e.g. Eames 
(UKAEA1965 Item 4). 

The field of loss prevention is currently subject to very 
rapid change. In particular, there is a continuous evolution 
of standards and codes of practice and legislation. It is 
important, therefore, that the reader should make any 
necessary checks on changes which may have occurred. 

I would like to thank for their encouragement in this 
project Professor D.C. Freshwater and the publishers, and 
to acknowledge the work of many authors which I have used 
directly or indirectly, particularly that of Dr J.H. Burgoyne 
and of Professor T.A. Kletz. I have learned much from my 
colleagues on the Loss Prevention Panel of the Institution 
of Chemical Engineers, in particular MrT.A. Kantyka and 
Mr F. Hearfield, and on the Advisory Committee on Major 
Hazards, especially the chairman Professor B.H. Harvey, 
the secretary Mr H.E. Lewis, my fellow group chairmen 


Professor F.R. Farmer and Professor J.L.M. Morrison and 
the members of Group 2, Mr K. Briscoe, Dr J.H. Burgoyne, 
Mr E J. Challis, Mr S. Hope, Mr M. A. McTaggart, Professor 
J.F. Richardson, Mr J.R.H. Schenkel, Mr R. Sheath and 
Mr M.J. Turner, and also from my university colleagues 
Dr P.K. Andow, Mr R.J. Aird and Dr D.J. Sherwin and 
students Dr S.N. Anyakora, Dr B. Bellingham, Mr C.A. 
Marpegan and Dr G. A. Martin-Solis. I am much indebted to 
Professor T.A. Kletz for his criticisms and suggestions on 
the text. My thanks are due also to the Institution of Plant 
Engineers, which has supported plant engineering activ¬ 
ities at Loughborough, to the Leverhulme Trust which 
awarded a Research Fellowship to study Loss Prevention in 


the Process Industries and to the Science Research Council, 
which has supported some of my own work in this area. 
I have received invaluable help with the references from 
Mrs C.M. Lincoln, Mrs W. Davison, Mrs P. Graham, 
Mr R. Rhodes and Mrs M. A. Rowlatt, with the typing from 
Mrs E.M. Barradell, Mrs P. Jackson and, in particular, 
Mrs J. Astley, and with the production from Mr R.L. Pearson 
and MrT. Mould. As always in these matters the responsi¬ 
bility for the final text is mine alone. 

Frank P. Lees 
Loughborough, 
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Terminology 


Attention is drawn to the availability in the literature of a 
number of glossaries and other aids to terminology. Some 


Notation 


In each chapter a given symbol is defined at the point where 
it is first introduced. The definition may be repeated if there 
has been a significant gap since it was last used. The defi¬ 
nitions are summarized in the notation given at the end of 
the chapter. The notation is global to the chapter unless 
redefined for a section. Similarly, it is global to a section 
unless redefined for a subsection and global to a subsection 


British Standard glossaries are given in Appendix 27 and 
other glossaries are listed in Table 1.1. 


unless redefined for a set of equations or a single equation. 
Where appropriate, the units are given, otherwise a con¬ 
sistent system of units should be used, SI being the pre¬ 
ferred system. Generally the units of constants are not 
given; where this is the case it should not be assumed that 
a constant is dimensionless. 


Use of References 


The main list of references is given in the section entitled 
References, towards the end of the book. There are three 
other locations where references are to be found. These are 
Appendix 27 on standards and codes; Appendix 28 on 
institutional publications; and in the section entitled Loss 
Prevention Bulletin which follows the References. 

The basic method of referencing an author is by surname 
and date, e.g. Beranek (1960).Where there would otherwise 
be ambiguity, or where there are numerous references to the 
same surname, e.g. Jones, the first author’s initials are 
included, e.g. A. Jones (1984). Further guidance on names is 
given at the head of the section References. 

References in Appendices 27 and 28 are by institution or 
author. Some items in these appendices have a code number 
assigned by the institution itself, e.g. API (1990 Publ. 421), 
but where such a code number is lacking, use is generally 
made of an item number separated from the date by a slash, 
e.g. IChemE (1971/13). Thus typical entries are 


API Std 2000:1992 a standard, found in Appendix 
27 under American Petroleum 
Institute 

API (1990 Publ. 421) an institutional publication, found 

in Appendix 28 under American 
Petroleum Institute 

HSE (1990 HS(G) 51) an institutional publication, found 

in Appendix 28 under Health 


and Safety Executive, Guidance 
Booklets, HS(G) series 

Coward and Jones an institutional publication, found 
(1952 BM Bull. 503) in Appendix 28 under Bureau of 
Mines, Bulletins 

Institutional acronyms are given in the section Acronyms 
which precedes the Author Index. 

There are several points of detail which require mention 
concerning Appendix 28. (1) The first part of the appendix 
contains publications of a number of institutions and the 
second part those of the Nuclear Regulatory Commission. 
(2) The Fire Protection Association publications include a 
number of series which are collected in the Compendium of 
Fire Safety Data (CFSD). A typical reference to this is FPA 
(1989 CFSD FS 6011). (3) The entries for the Health and 
Safety Executive are quite extensive and care may be nee¬ 
ded in locating the relevant series. (4) The publications of 
the Safety and Reliability Directorate appear under the UK 
Atomic Energy Authority, Safety and Reliability Directo¬ 
rate. A typical reference is Ramskill and Hunt (1987 SRD 
R354). These publications are immediately preceded by the 
publications of other bodies related to the UKAEA, such as 
the Health and Safety Branch, the Systems Reliability 
Service and the National Centre for Systems Reliability. 

References to authors in the IChemE Loss Prevention 
Bulletin are in the style Eddershaw (1989 LPB 88), which 
refers to issue 88 of the bulletin. 
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1/2 INTRODUCTION 


Over the last three decades there has developed in the 
process industries a distinctive approach to hazards and 
failures that cause loss of life and property. This approach is 
commonly called loss prevention. It involves putting much 
greater emphasis on technological measures to control 
hazards and on trying to get things right the first time. An 
understanding of loss prevention requires some apprecia¬ 
tion of its historical development against a background of 
heightened public awareness of safety, and environmental 
problems, of its relation to traditional safety and also to a 
number of other developments. Selected references on 
safety and loss prevention (SLP) are given inTable 1.1. 

1.1 Management Leadership 

By the mid-1960s, it was becoming increasingly clear that 
there were considerable differences in the performance of 
companies in terms of occupational safety. These dis¬ 
parities could be attributed only to differences in manage¬ 
ment. There appeared at this time a number of reports on 
safety in chemical plants arising from studies by the British 
chemical industry of the safety performance in the US 
industry, where certain US companies appeared to have 
achieved an impressive record. These reports included 
Safety and Management by the Association of British 
Chemical Manufacturers (ABCM) (1964,3), Safe and Sound 
and Safely Audits by the British Chemical Industry Safety 
Council (BCISC) (1969, 9; 1973, 12). The companies con¬ 
cerned attributed their success entirely to good manage¬ 
ment and this theme was reflected in the reports. 

1.2 Industrial Safety and Loss Trends 

About 1970, it became increasingly recognized that there 
was a worldwide trend for losses, due to incidents, to rise 
more rapidly than gross national product (GNP). 

This may be illustrated by the situation in the United 
Kingdom. The first half of this century saw a falling trend in 
personal incidents in British factories, but about 1960, this 
fall bottomed out. Over the next decade, very little progress 
was made; in fact there was some regression. Figure 1.1 
shows the number of fatal incidents and the total number of 
incidents in factories over the period 1961-74. The Robens 
Committee on Health and Safety at Work, commenting on 
these trends in 1972, suggested that part of the reason was 
perhaps the increasingly complex technology employed by 
industry (Robens, 1972). 

Another important index is that of fire loss. The 
estimated fire damage loss in factories and elsewhere in 
the United Kingdom for the period 1964-74 is shown 
in Figure 1.2. 

1.3 Safety and Environment Concerns 

There was also at this time growing public awareness and 
concern regarding the threat to people and to the environ¬ 
ment from industrial activities, particularly those in 
which the process industries are engaged. Taking the 
United Kingdom as an illustration, the massive vapour 
cloud explosion at Flixborough in 1974 highlighted the 
problem of major hazards. This led to the setting up of the 
Advisory Committee on Major Hazards (ACMH) that sat 
from 1975 to 1983, and to the introduction of legislation 
to control major hazard installations. Likewise, there was a 
continuous flow of legislation to tighten up both on emissions 


Table 1.1 Selected references on safety and 
loss prevention 


General safety 

ABCM (n.d./l, 1964/3); AlChE (see Appendix 28); Creber 
(n.d.); IChemE (see Appendix 28); IOSHIC (Information 
Sheet 15); NSC (n.d./2,4,6,7,1992/11); RoSPA (IS/72, IS/ 
106); Ramazzini (1713); Blake (1943); Rust and Ebert (1947); 
Plumbe (1953); Guggeref a/. (1954); Guelich (1956); Harvey 
and Murray (1958); Armistead (1959); Coates (1960); 
Thackara etal. (1960); ILO (1961,1972); Meyer and Church 
(1961); AIA (1962); Devauchelle and Ney (1962); Ducommun 
(1962); Shearon (1962); Kirk and Othmer (1963-, 1978-, 
1991-); Simonds and Grimaldi (1963); Gilbert (1964); 
Vervalin (1964a, 1973a, 1976c, 1981a,b, 1983); G.T. Austin 
(1965a); Christian (1965); H.H. Fawcett (1965a, 1981,1982a, 
1985); H.H. Fawcett and Wood (1965,1982); Gagliardi 
(1965); Gilmore (1965); Gimbel (1965a); Gordon (1965); Kac 
and Strizak (1965); Voigtlander (1965); Emerick (1967); 
FMEC (1967); McPherson (1967); Sands and Bulkley 
(1967);Tarrants (1967); Badger (1968); J.E. Browning (1968); 
CBI (1968); Fowler and Spiegelman (1968); Leeah (1968-); 
Packman (1968); Berry (1969,1977); Everett (1969); 
Handley (1969,1977); Klaassen (1969,1971,1979); 

Maas (1969); Northcott (1969); Freddy (1969); Davidson 
(1970,1974); Hearfield (1970,1974,1976); D.L. Katz (1970); 
MCA (1970-/18); Queener (1970); N.T. Freeman and 
Pickbourne (1971); ILO (1971-72); Kletz (1971,1975a,c,e, 
1976a,c,e,f, 1977f, 1978b, 1979c,e,k, 1980k, 1981c, 1983c,f, 
1984b,g,j, 1984 LPB 59,1985a, 1986g, 1987i, 1988J, 1990d, 
1991k, 1994 LPB 120); Rodgers (1971); Tye and Ullyet (1971); 
Hammer (1972); R.Y. Levine (1972b); SCI (1972); Burns 
(1973); CAPITB (1973/1,1975 Information Paper 16); Holder 
(1973); Kinnersly (1973); Kirven and Handke (1973); 
Ludwig (1973a,b); Orloff (1973); Society of the Plastics 
Industry (1973); Widner (1973); C.A.J. Young (1973); 
Buschmann (1974); Critchfield (1974); Kantyka (1974a,b); 
Lees (1974a,b, 1980); Malasky (1974); D. TUrner (1974); 
Anon. (19751); Barber (1975); Boyes (1975); D. Farmer 
(1975); Gardner and Taylor (1975); HSE (1975 HSW Booklet 
35); Institute of Fuel (1975); D. Petersen (1975,1982a, 1984, 
1988a,b, 1989); TUC (1975,1978,1986); Bean (1976a,b); 

D.B. Brown (1976); Koetsier (1976); Marti (1976); VC. 
Marshall (1976d, 1990d); Singleton (1976b); Arscott and 
Armstrong (1977); Atherley (1977b,c, 1978); Barbieri etal. 
(1977); Blohm (1977); IP (1977); J. Jones (1977); Leuchter 
(1977); Lugenheim (1977); McCrindle (1977,1981); 
Nicolaescu (1977); Rogojina (1977); Sisman and Gheorgiu 
(1977); Wakabayashi (1977); Webster (1977); Allianz 
Versicherung (1978); M.E. Green (1978,1979); Napier (1978, 
1980); Anon. (1979d); BASF (1979); Birkhahn and Wallis 
(1979); Hagenkotter (1979); Kerr (LPB 251979); R. King and 
Magid (1979); Menzies and Strong (1979); Peine (1979); 
Schaeffer (1979); Schierwater (1979); H. Clarke (1980); 
Heinrich etal. (1980); Krishman and Ganesh (1980); Kumar 
etal. (1980); Spiegelman (1980); Srinivasan etal. (1980); 
Wells (1980); Chowdhury (1981); McCrindle (1981); Teja 
(1981); AGA (1982/7); Laitinen (1982); Ormsby (1982,1990); 
Carter (LPB 501983); W.B. Howard (1983,1984,1985,1989); 
Parmeggiani (1983); Preece (1983); Ridley (1983-); Sinnott 
(1983);Tailby (LPB 501983); Warner (LPB 501983); Carson 
and Jones (1984); A.D. Little (1984); Ross (1984); Setters 
(1984); Zanetti (1984a); Burgoyne (1985b, 1986b); EFCE 
(LPB 661985); Gagliardi (1985); Hildebrand (1985); 
McKechnie (1985); Munson (1985); Nordic Liaison 
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Committee (1985 NKA/LIT(85)3); Packer (1985); Pilarski 
(1985); APCA (1986); T.O. Gibson (1986); Grollier-Baron 
(1986); Joschek (1986,1987); Lihou (1986); DnV (1987 RP 
C201); Romer (1987); Scheid (1987); Hoyos and Zimolong 
(1988); Kharbanda and Stallworthy (1988); Carson and 
Mumford (1989); Hoovpr et al. (1989); Crawley (1990 LPB 
91); Hastings (1990); Jochum (1990); Koh (1990); Krishnaiah 
etal. (1990); H.C.D. Phillips (1990); Renshaw (1990); 
Dupont, Theodore and Reynolds (1991); Fades (1991); 

L. Hunt (1991); McQuaid (1991); Rasmussen (1991); Whiston 
(1991); Pasman et al. (1992); Andrews (1993); Fisk and 
Howes (1993); Cullen (1994); Donald and Canter (1994); 

M. Richardson (1994) 

Total loss control 

BSC (n.d./6,7); Heinrich (1959); Bird (1966,1974); Bird and 
Germain (1966,1985); Gilmore (1970); Goforth (1970); J.Tye 
(1970); J.A. Fletcher and Douglas (1971); Webster (1974, 
1976); Anon. (1975 LPB 4, p. 1); Hearfield (1975); D.G. King 
(1975); F.E. Davis (1976); Ling (1976,1979); D.H. Farmer 
(1978); Planer (1979); Heinrich, Petersen and Roos (1980); 
Dave (1987) 

Safety, health and environment 

Berkey, Dowd and Jones (1993); Hawskley (1993b); Walk (1993) 

Company policies 

Aalbersberg (1991); Auger (1993); Whiston (1993) 

Responsible care 

CIA (RC51, RC52,1990 RC23,1992 RC53); Belanger (1990); 
Kavasmaneck (1990); Whiston (1991); Jacob (1992) 


Organizational initiatives 

IChemE: Hancock (1983); Street, Evans and Hancock 
(1984) 

SRD: Clifton (1983 LPB 52) 

CEFIC: Jourdan (1990) 

CCPS: CCPS (1985); Carmody (1988,1989,1990a, b); 

R. A. Freeman (1990); K. A. Friedman (1990); Schreiber (1990) 
EPSC: Anon. (1992 LPB 103); Anon. (1993 LPB 111); EPSC 
(1993); Anon. (1994 LPB 115); Hancock (1994 LPB 120) 
IPSE: Macoksley (1993a) 

Organization guides 

NSC (1974); ILO (1989,1991); OECD (1992) 

Contractors 
Kletz (1991m) 

Terminology 

IP (Oil Data Sht 3); Harvey (1979b); Burgoyne (1980); 
Berthold and Loeffler (1981); VC. Marshall (1981a,b, 1990c); 
A.E. Green (1982); Kletz (1983c, 1984c); IChemE (1985/78, 
1992/98); ACDS (1991) BS (Appendix 27 Glossaries) 

Bibliographies 

Commonwealth Department of Productivity (1979); Lees 
(1980);Vervalin (1981a,b); Lees and Ang (1989a) 

Critiques 

Wallick (1972); Commoner (1973); L.N. Davis (1979,1984); 
Hewlett (1982) 

Other related fields 

Pugsley (1966); Ingles (1980; civil engineering); Thurston 
(1980; aviation); Garrick and Caplan (1982); V.M. Thomas 
(1982); Grigoriu (1984; structural engineering) 




Figure 1.1 (a) Fatalities and (b) total accidents in 
factories in the UK, 1961-74 (Courtesy of the Health and 
Safety Executive) 

from industrial installations and on exposure of workers 
to noxious substances at those installations. 

Similarly, in the United States, the Bhopal incident as well 
as other highly publicized tragedies (Flixborough, 1974; 
Seveso, 1976; Three Mile Island, 1979; Cubato, February 
1984; Mexico City, November 1984; Houston, 1989) caused 
widespread public concerns about major incidents in US 
chemical plants that might disastrously affect the public. 
Not only was the public’s confidence in the chemical indus¬ 
try shaken, but also the chemical industry itself questioned 
whether its provisions for protection against major acci¬ 
dental releases were adequate. The recognition of the 
chemical industry’s need for technical advances led to a 
number of initiatives. For example, in 1985, the Chemical 
Manufacturers Association (CM A - now known as the ACC, 
the American Chemistry Council) published its guidelines 
on Process Safety Management and the American Institute 
of Chemical Engineers (AIChE) created the Center for 
Chemical Process Safety (CCPS) with significant financial 
support by industry. Over the next several years, many other 
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Figure 1.2 


centers such as the National Institute for Chemical Safety, 
the National Environmental Law Center and the Mary Kay 
O’Connor Process Safety Center also came into existence. 
During this same period, the United States Environmental 
Protection Agency (USEPA) and the Occupational Safety 
and Health Administration (OSHA) of the United States 
Department of Labor started several technical initiatives 
aimed at gathering information about major accident risks. 

It is against this background, therefore, that the particular 
problems of the process industries should be viewed. The 
chemical, oil and petrochemical industries handle hazardous 
substances and have always had to devote considerable effort 
to safety. This effort is directed both to the safe design and 
operation of the installations and to the personal safety of the 
people who work on them. However, there was a growing 
appreciation in these industries that the technological 
dimension of safety was becoming more important. 

1.4 Loss Prevention-1 

The 1960s saw the start of developments that have resulted 
in great changes in the chemical, oil and petrochemical 
industries. A number of factors were involved in these 
changes. Process operating conditions such as pressure and 
temperature became more severe. The energy stored in the 
process increased and represented a greater hazard. Prob¬ 
lems in areas such as materials of construction and process 
control became more taxing. At the same time, plants grew 
in size, typically by a factor of about 10, and were often single 
stream. As a result they contained huge items of equipment, 
such as compressors and distillation columns. Storage, both 
of raw materials and products and of intermediates, was 
drastically reduced.There was a high degree of interlinking 
with other plants through the exchange of by-products. 

The operation of such plants is relatively difficult. 
Whereas previously chemical plants were small and could 
be started up and shut-down with comparative ease, the 
start-up and shut-down of a large, single-stream plant on an 
integrated site is a much more complex and expensive 
matter. These factors resulted in an increased potential for 
loss - both human and economic. Such loss may occur in 
various ways. The most obvious is the major incident, 
usually arising from loss of containment and taking the 
form of a serious fire, explosion or toxic release. But loss 
due to such situations as delays in commissioning and 
downtime in operating is also important. 


The chemical and oil industries have always paid much 
attention to safety and have a relatively good record in this 
respect. In the United Kingdom, for example, the fatal acci¬ 
dent rate for the chemical industry has been about equal 
to that for industry generally, which in view of the nature 
of the industry may be regarded as reasonable. These are high 
technology industries and there has always been a strong 
technological elementin their approachtosafety.However, the 
increasing scale and technology of modern plants caused the 
chemical industry to re-examine its approach to the problem 
of safety and loss. If the historical development of this con¬ 
cern in the United Kingdom is considered, there are several 
problem areas that can be seen, in retrospect, to have given 
particular impetus to the development of loss prevention. 

One of these is the problem of operating a process under 
extreme conditions and close to the limits of safety. This is 
usually possible only through the provision of relatively 
sophisticated instrumentation. About the mid-1960s, sev¬ 
eral such systems were developed. One of the most sophis¬ 
ticated, influential and well documented was the high 
integrity protective system developed by R.M. Stewart 
(1971) for the ethylene oxide process. About the same time 
many difficulties were being experienced in the commis¬ 
sioning and operation of large, single-stream plants, such as 
ethylene and ammonia plants, involving quite severe 
financial loss. On the design side, too, there was a major 
problem in getting value for money in expenditure aimed at 
improving safety and reducing loss. It was increasingly 
apparent that a more cost-effective approach was needed. 

These developments did not take place in isolation. The 
social context was changing also and other themes, notably 
pollution, including effluent and waste disposal and noise, 
were becoming of increasing concern to the public and the 
government. In consequence, the industry was obliged to 
examine the effects of its operations on the public outside the 
factory fence and, in particular, to analyse more carefully 
the possible hazards and to reduce emissions and noise. 
Another matter of concern was the increasing quantities of 
chemicals transported around the country by road, rail and 
pipeline. The industry had to take steps to show that these 
operations were conducted with due regard to safety. In sum, 
by the 1970s, these problems became a major preoccupation 
of senior management. Management’s recognition of the 
problems and its willingness to assign to their solution many 
senior and capable people as well as other resources has been 
fundamental in the development of loss prevention. 
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Table 1.2 Some milestones in the development of loss prevention 


1960 First UK IChemE symposium on Chemical Process Hazards with Special Reference to Plant Design 

1966 Dow Chemical Company’s Process Safety Manual 

1967 First AIChE symposium on Loss Prevention 

1968 First ICI Safety Newsletter; American Insurance Association Hazard Survey of the Chemical and Allied Industries 

1971 European Federation of Chemical Engineering symposium on Major Loss Prevention in the Process Industries 

1972 UK - Report of Robens Committee on Safety and Health at Work 

1973 UK — IChemE Loss Prevention Panel, information exchange scheme and, in 1975, Loss Prevention Bulletin 

1974 UK - HSWA1974; First International Symposium on Loss Prevention and Safety Promotion in the Process 
Industries; Rasmussen Report; Flixborough disaster 

1975 UK - Flixborough Report 

1976 First Report of ACMH; Seveso incident 

1978 First Canvey Report; San Carlos disaster 

1979 Second Report of ACMH; Three Mile Island incident 

1981 Norwegian Guidelines for Safety Evaluation of Platform Conceptual Design 

1982 EC Directive on Control of Industrial Major Accident Hazards 

1984 Third Report of ACMH; Control of Industrial Accident Hazards Regulations 1984; Bhopal disaster; Mexico City 
disaster 

1985 AIChE establishes the CCPS 

1986 Russia - Chernobyl disaster; USA, California - Risk Management and Prevention Program; USA, New Jersey - 
Toxic Catastrophe Prevention Act 

1988 Piper Alpha disaster 

1990 UK - Piper Alpha Report; USA - ^January - API Recommended Practice 750 (Management of Process 
Hazards); »July - OSHA Process Safety Management Proposed Rule; •October - CMA Responsible Care 
Code of Management Practices; •November - Clean Air Act Amendments of 1990; Formation of the 
US Chemical Safety Board 

1992 Offshore Safety Act 1992; Offshore Installations (Safety Cases) Regulations 1992 

1995 USA - Risk Management Program regulation promulgated by USEPA; Texas A&M University established 
the Mary Kay O’Connor Process Safety Center 


The existence of expertise in related areas has been of 
great value. In the United Kingdom, the UK Atomic Energy 
Authority (UKAEA), initially through its Health and Safety 
Branch and then through its Safety and Reliability 
Directorate (SRD) was able to advise on reliability assess¬ 
ment. Industry adopted UKAEA techniques in the assess¬ 
ment of major hazards and of protective instrumentation 
and data on failure rates. Many firms in the industry now 
have their own reliability engineers. 

The historical development of loss prevention is illustrated 
by some of the milestones listed in Table 1.2. The impact of 
events has been different in different countries. Within the 
industry, loss prevention emerged as a theme of technical 
meetings which indicated an increasingly sophisticated 
technological approach. The Institution of Chemical Engi¬ 
neers (IChemE) established a Loss Prevention Panel which 
operates an information exchange scheme and publishes the 
Loss Prevention Bulletin .This growing industrial activity was 
matched in the regulatory sphere. The Robens Committee 
(1972) emphasized the need for an approach to industrial 
safety that is more adapted to modem technology, and 
recommended self-regulation by industry as opposed to 
regulation from outside. This philosophy is embodied in the 
Health and Safety at Work etc. Act 1974 (HSWA), which 
provides the framework for such an approach. However, the 
Act does more than this. It lays a definite statutory require¬ 
ment on industry to assess its hazards and demonstrate the 
effectiveness of its safety systems. It is enforced by the Health 
and Safety Executive (HSE). The General Duty Clause 
requirements under US regulations enforced by OSHA and 
USEPA have been interpreted similarly. 

The disastrous explosion at Flixborough in 1974 has 
proved a watershed. Taken in conjunction with the Act, it 


has greatly raised the level of concern for SLP in the 
industries affected. It also led, as mentioned, to the setting 
up of the ACMH. The incident at Seveso in 1976 has been 
equally influential. It had a profound impact in Continental 
Europe and was the stimulus for the development of the 
EC Directive on Control of Industrial Major Accident Hazards 
in 1982. Further disasters such as those at San Carlos, Bhopal 
and Mexico City have reinforced these developments. 


1.5 Large Single-stream Plants 

For some decades up to about 1980, there was a strong trend 
for the size of plants to increase. The problems associated 
with large, single-stream plants are a major reason for the 
development of loss prevention. These problems are now 
considered in more detail in order to illustrate some of the 
factors underlying its growth. Selected references on large, 
single-stream plants are given in Table 1.3. 

The increase in the size of plant in the period in question 
for two principal chemicals is shown in Figure 1.3, which 
gives the size of the largest ethylene and ammonia plants 
built by a major contractor and the year in which they came 
on stream. Thus, whereas in 1962 an ethylene plant with a 
capacity in excess of 100,000 ton/year was exceptional, by 
1969 this had become the minimum size ordered, whilst 
the newest UK plant, the No. 5 Unit of Imperial Chemical 
Industries (ICI), had a capacity of 450,000 ton/year. 
Although briefly the largest single-stream naphtha cracker 
in the world, it was soon overtaken by other plants of 
500,000 ton/year capacity or more. Similar trends occurred 
in ammonia plants. 

This increase in plant size took place in a rapidly 
expanding market. Thus, the growth in world demand for 
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Table 1.3 Selected references on large, single-stream 
plants 


Frank and Lambrix (1966); Quigley (1966); Anon. (1967d); 
Davidson (1967); Holroyd (1967); R.L. Miller (1967); 

H.S. Robinson (1967a); Axelrod etal. (1968); Deschnere/a/. 
(1968); Mapstone (1968); Mayo (1968); S.P. Rose (1968); 
Lofthouse (1969); Chase (1970); Dailey (1970); W.E. Tucker 
and Cline (1970,1971); Coulter and Morello (1971,1972); 
Flatten (1971); Walley and Robinson (1972); Knight (1973); 
Ball and Steward (1974); Huettner (1974); Woodhouse et al. 
(1974); Anon. (1975j); Baba and Kennedy (1976); Ball and 
Pearson (1976); Pilz and van Herck (1976); Ennis and Lesur 
(1977); Holland and Watson (1977); J.C. Davis (1978); 
Froment (1979); Hammock (1979); Anon. (1984nn); Remer 
and Chai (1990); Brennan (1992); Garnett and Patience 
(1993) 
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Figure 1.3 Capacity of ethylene and ammonia plants, 
1940-68 (after Axelrod, Daze and Wickham, 1968) 
(Courtesy of the American Institute of Chemical Engineers) 


ethylene was given as follows (Walley and Robinson, 1972): 


1965 8.5 megatonnes/year 

1970 20 megatonnes/year 

1975 (estimated) 39 megatonnes/year 


The basic cause of the increase in size was concern for 
capital cost. Up to the early 1950s, the chemical industry 
did not give minimization of capital cost particular priority. 
But with the move to naphtha feedstocks and the growth 
of petrochemicals, capital came to represent a much more 
significant cost than before compared with other costs 
such as raw materials and labour. 

The relationship between size and capital cost is given by 
the well-known equation: 

[1.5.1] 


where C is the capital cost of the plant, Pits design output, 
k is a constant, and n is the scale-up index. The value of n is 
often about 0.6—0.7 so that if design output is doubled, the 
capital cost increases by only 50- 60 %. There are also some 
savings on operating costs, particularly in terms of the 
thermal economy and labour. 

Most calculations of the savings obtainable by building 
big showed the savings tohe large; therefore, it was difficult 
in a competitive industry to avoid doing so, despite the 
recognized risks. The world price tended to be set by the 
larger plants, so that smaller plants became obsolete. 
Although calculations showed savings from large plants, 
there was considerable variation in the size of these savings, 
depending on the assumptions made. One figure given was 
a reduction in the cost of ethylene to about 50% in going 
from a 150,000 to a 450,000 ton/year plant (Holroyd, 1967); 
another calculation gave a reduction to about 80% in going 
from a 200,000 to a 400,000 ton/year plant (Lofthouse, 
1969). 

The calculation depends on many factors and is complex. 
This is particularly so for ethylene, which is only one of a 
number of products from an ethylene plant. The values of 
the propylene and butadiene produced were each about as 
great as that of the ethylene. Much therefore depended on 
whether these and other by-products could be sold at full or 
only at fuel value. A typical calculation of the effect of plant 
size and co-product credit on the economics of an ethylene 
plant at that time is shown in Table 1.4. 

Another important factor for an ethylene plant is the 
acquisition of load. The best situation is where the ethylene 
is taken away by gas pipeline. The alternative of sea trans¬ 
port, which involves liquefaction, is more expensive and 
may well cancel the cost advantage of a large plant. How¬ 
ever, ethylene pipelines are difficult to justify except where 
there is a long-term contract, and it is not easy to create an 
ethylene grid into which other users can tap. 

The economics of a large plant are also badly affected 
if it fails to reach full output immediately, either on 
account of commissioning difficulties or of lack of demand. 
A typical calculation of the effect of plant size, lateness 
and underloading on ammonia plant economics is shown 
inTable 1.5. 

Despite these problems, the general assessment around, 
say, 1966 was that the building of large plants was justified. 
However, there continued to be a lively debate as to whether 
the expected economies of scale were realizable. Several 
difficulties became apparent. The economies of scale 
depend very largely on the retention of the single-stream 
philosophy. This gives economies not only in the cost of 
the equipment itself but of the associated pipework, heat 
exchangers, instrumentation, civil engineering etc. 
These are largely lost if there is resort to duplication. 
However, in some cases, the equipment appeared to be 
nearing the limits of size. This had long been so for the 
furnaces on an ethylene plant, which typically had mul¬ 
tiple furnaces with outputs of about 30,000 ton/year. 
The main compressor was very large - that on ICI’s No. 5 
plant being 35,000 h.p. The main distillation column was 
also very big and had to be fabricated on site. 

At large sizes, the value of the scale-up index n is subject 
to some modification. A common value of n for ethylene 
plants was 0.65 (Lofthouse, 1969). However, as already 
mentioned, the cracking section of the plant, which 
accounts for about 30 % of the capital cost, offers little scope 
for scale-up economies. Other items, such as compressors, 


C = kP n 
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distillation columns and heat exchangers, may be near their 
limits and may have a higher index. Some facilities such as 
storage and effluent control may even have an index greater 
than 1.0. Thus, it was suggested (Walley and Robinson, 
1972) that a more realistic actual value of n is 0.9. 

Storage is a serious problem with large plants. For the size 
of plant described, storage, whether of raw materials or 
products, is extremely expensive and has to be kept to a 

The reliability of large plants was often unsatisfactory, 
there being a number of reasons for this. Compact layout 
made maintenance more difficult and increased the vul¬ 
nerability to fire. Arrangements aimed at thermal economy 
increased the degree of interdependence in the plant. 
Economies were made in capital cost in areas such as 
materials of construction and duplication of equipment. 
As Holroyd (1967) comments: 


Faulty welding has resulted in leaky high pressure piping 
systems and there has been little improvement as regards 
jackets, dinners, and footballs left in equipment despite 
the much more serious effect this sort of thing has in high 
cost, high capacity single plant units. There have been 
many examples of faulty equipment - faulty fabrication 
of interchangers, improper assembly of compressors and 
high-pressure reactors which have failed under test. 
Complete shut-down of the plant due to failure of a simple 
piece of equipment, such as a pump of established design, 
and of negligible cost in itself, has been a frequent 
experience. Faulty supervision and human error in 
operation has shown up in not following the proper 
sequence of actions in emergencies, inadvertent tripping 
out of machines, failure to isolate equipment under 
maintenance and carelessness in checking instruments 
and with regard to such matters as water treatment. 


Table 1.4 Effects of plant size and co-product credit on 
ethylene plant economics (after Walley and Robinson, 
1972) 


Plant size (ton/year) 
Plant capital (£m.) 
Working capital (£m.) 
Capital charge 
(£/ton ethylene) 
Fixed costs 
Feedstock 

Fuel, utilities, catalysts 

Co-product credit 
(£/ton ethylene) 
Ethylene cost (£/ton) 
Co-product credit 
(£/ton ethylene) 
Ethylene cost (£/ton) 


200,000 300,000 
25.0 33.0 

2.0 2.9 

33.5 29.8 

9.3 7.7 

30.5 30.5 

8.6 8.6 

81.9 76.6 

34.2 34.2 

47.7 42.4 

34.2 29.1 

47.7 47.5 


400,000 500,000 
40.0 47.0 

3.8 4.6 

27.5 25.9 

6.8 6.2 

30.5 30.5 

8.6 8.6 

73.4 71.2 

34.2 34.2 

39.2 37.0 

26.6 25.1 

46.8 46.1 


As a result of such factors, there were many cases of dif¬ 
ficulties and delays in commissioning and operation of such 
plants throughout the world. A breakdown of the causes of 
such problems in ammonia plants is given inTable 1.6. 

Large plants also have some undesirable features from 
the safety point of view. Particularly significant is the scale 
of the inventory. The amount of material in the main dis¬ 
tillation column of a large ethylene plant exceeds that for¬ 
merly contained in the storage vessels of smaller plants. 

Problems of pollution and noise, including flares and 
pressure relief, also appear to increase in severity rather 
rapidly for large plant sizes. Some more specific faults on 
ammonia plants have been quoted (Holroyd, 1967). One of 
these, migration of silica under the more severe operating 
conditions, is a matter of advanced technology. Most of the 
others are more mundane. 

It is not surprising, therefore, that the trend to large-scale 
plants was criticized and the economies of scale questioned. 
The debate was particularly lively over the period 1967-72. 
Even at the start of the debate, the large, single-stream plant 


Table 1.5 Effects of plant size, lateness and underloading on ammonia plant economics (after Holroyd, 1967) 


Plant 

Output patter 
(% design capacity) 


DCF return 



No delay (%) 

6-month delay (%) 

12-month delay (%) 

3 x 333 t/day 
suitably purchased 

Year 1 onwards 100 
Yearl 60 

2 80 

3 onwards 100 

4 

- 

= 

1 x 1000 t/day 

Year 1 onwards 100 

Yearl 60 

26 

23 

21 


2 80 

3 onwards 100 

Yearl 30 

16 

14 

13 


2 80 

3 90 

4 onwards 100 

Yearl 30 

12 

10 

9 


2 70 

3 onwards 90 

7 

6 

5 
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Table 1.6 Causes of commissioning and operating 
problems in ammonia plants (after Holroyd, 1967) 


Faults 

M.W.Kellogg 
experience (%) 

ICI experience 
(%) 

Design 

10 

10 

Erection 

20 

16 

Equipment 

40 

61 

Operating 

30 

13 


had its defenders (Holroyd, 1967; Lofthouse, 1969).The cost 
sensitivity and other problems of large plants were admit¬ 
ted. It was also conceded that the economies of scale were 
not as great as initial estimates suggested. But these factors 
were not considered sufficient to negate the economies of 
large plants or to make the return to small ones appear 
attractive. 

It was agreed that part of the problem was that the 
increase in size of plants had been accompanied by a drive 
to reduce capital costs which may have been taken too far: 

This drive took many other forms besides increase of 
scale. It tended to lead to elimination of duplicates of even 
minor items of plant, to economies which sometimes 
proved to be false economies in the provision of services 
such as steam and power, to extreme sophistication in 
energy recovery which sometimes added so much to the 
complexity of the plants as to make them difficult to run, 
and to the concentration of the plant within very much 
smaller areas which increased their vulnerability to fire 
and also complicated maintenance. (Lofthouse, 1969) 
Moreover, it was reasonable to claim that the industry had 
already learnt much from the troubles of the first generation 
of large plants and that it would be able to avoid many of 
these in the future. 

In effect, the argument was that failures in large plants 
were not primarily due to the size of items of equipment, the 
single-stream arrangement or the use of high technology It 
was conceded, however, and indeed emphasized, that the 
penalties of failures on large, single-stream plants are very 
great and that it is essential for their success to put maxi¬ 
mum effort into ensuring high reliability and good opera¬ 
tion. Particular emphasis was laid on the effectiveness of 
the operation and maintenance in large plants. Here the 
main factor is the quality of personnel at all levels: man¬ 
agement, process operators and maintenance crews. Close 
supervision and rigorous inspection have an important 
part to play, but are no substitute for well-educated and 
well-trained people. 

The large, single-stream plant offers substantial rewards 
for success, but this does not come easily. It can be achieved 
only by first class management and engineering in design 
and operation. The large plant places a premium on these 
factors and is thus a means by which a firm that possesses 
them gains a competitive advantage. 

The growth in the size of plants has now slowed appreci¬ 
ably. The typical size of a new ethylene plant in 1978 was 
about 500,000 ton/year. This is still typical for a new plant 
worldwide. A plant for 700,000 ton/year still ranks among 
the largest plants (Mahoney, 1990). There is no marked 
trend to yet larger plants, but equally there is little sign of 


reversion to smaller ones. However, consequent to wide¬ 
spread interest in inherent safety and security concerns, 
process intensification and miniaturization are starting to 
receive some renewed interest. The results of this renewed 
interest are yet to be seen. 

1.6 Loss Prevention-2 

The area of concern and the type of approach which goes by 
the name of loss prevention is a development of safety work. 
But it is a response to a changing situation and need, and it 
has certain particular characteristics and emphases. The 
essential problem which loss prevention addresses is the 
scale, depth and pace of technology. In fact, control of such 
hazards is possible only through effective management. 
The primary emphasis in loss prevention is, therefore, on 
the management system. This has always been true, of 
course, with regard to safety. But high technology systems 
are particularly demanding in terms of formal management 
organization, competent persons, systems and procedures, 
and standards and codes of practice. On top of all of this, 
there is a growing realization that safety performance is 
quite often influenced by the safety culture of the company. 
The 2003 Columbia shuttle disaster and the following 
investigation report brings to light some of NASA’s safety 
culture issues that may have doomed Columbia as well as 
Challenger. 

According to Mannan (2003a), perhaps we should pay 
more attention to safety culture. One school of thought is 
that safety culture even though a very important issue is not 
a specific problem of process safety or loss prevention. 
However, it seems there is a special set of problems that go 
along with extreme events and the associated risks. Before 
the event there is great confidence that such a thing could 
never happen. Afterward there is denial and no cultural 
change occurs. This may be true of NASA as well as some 
process companies as well. What are the attributes of a good 
safety culture? How do organizations accomplish a good 
safety culture and maintain it over the life of the organiza¬ 
tion? How can the safety culture survive through changing 
leaderships, turnovers, budget pressures, early retirements 
and other changes? How can we get organizations that do 
not have a good safety culture make the necessary changes 
to move towards a good safety culture? These are questions 
that should be answered. 

Mannan (2003a) goes on to describe the investigation of 
one incident where everyone involved felt that they had 
done everything they were supposed to do and the incident 
was just something that was beyond anyone’s control. In 
fact, a fewpeople in the organization even claimed that if the 
same set of circumstances were to happen again, the same 
incident would occur again, possibly with the same 
consequences. Now, that is a safety culture that needs major 
overhaul. 

Mannan (2003b) states that there are a number of attrib¬ 
utes of a good safety culture. It is quite difficult to iden¬ 
tify objective characteristics of a good safety culture. 
However, some known characteristics include: 

(1) Commitment AND involvement of the highest level 
personnel. 

(2) Open communication at all levels of the organization. 

(3) Everyone’s responsibilities and accountabilities 
regarding safety is clearly defined and understood. 

(4) Safety is second nature. 
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(5) Zero tolerance for disregard of management systems, 
procedures and technology. 

(6) Information systems allow all parties access to design, 
operational and maintenance data. 

As part of a multi-layered approach for a good safety cul¬ 
ture, organizations use analysis of trends to spot problems. 
Trend analysis should be focused on leading as well as 
trailing indicators. A trailing indicator is a downstream 
measurement of the outcomes of safety and health efforts. 
These indicators reflect successes or failures of the system 
to manage hazards. Examples of trailing indicators include 
fatalities, injuries and incidents. A leading indicator is an 
upstream measure that characterizes the level of success in 
managing safety systems; measurement of activities 
towards risk reduction prior to occurrence of incidents. 
While every effort should be made to measure and track 
trailing indicators, relying on the trailing indicators to 
assess safety performance is self-defeating. Thus, it is very 
important to measure and track leading indicators, particu¬ 
larly for high-risk activities such as space flight. Leading 
indicators, however, are more difficult to define and meas¬ 
ure and vary according to the activity and the mission of 
the organization. Examples of leading indicators might 
include: 

(1) the level of near-miss reporting; 

(2) effectiveness of incident investigation and corrective 
action; 

(3) management of change; 

(4) emphasis on inherently safer design; 

(5) effective application of risk assessments; 

(6) level of deferred maintenance; 

(7) Level of repetitive maintenance; 

(8) Number and severity of faults detectedby inspection, 
testing and audits; 

(9) Number and nature of unresolved safety issues; 

(10) Participation in continuing education and symposia; 

(11) Employee morale, level of expertise. 

The method of approach is also somewhat different. 
When systems are small scale and relatively non-hazardous 
and change slowly over the years, they are able to evolve by 
trial and error. This is often simply not possible with mod¬ 
ern systems, where the pace of change is too fast and the 
penalties of failure are too great. It becomes necessary to 
apply forethought to try to ensure that the system is right 
the first time. In a related area, the widespread application 
of human factors to large man-machine systems has been 
motivated by very similar considerations. A major hazard 
in a modern process plant usually materializes due to loss of 
containment .The three big maj or hazards are fire, explosion 
and toxic release. 

Thus, loss prevention is characterized by 

(1) an emphasis on management and management sys¬ 
tems, particularly for technology; 

(2) a concern with hazards arising from technology; 

(3) aconcernwithmajorhazards; 

(4) a concern for integrity of containment; 

(5) a systems rather than a trial-and-error approach. 

Some other features that are characteristic of loss preven¬ 
tion are the use of 


(6) techniques for identification of hazards; 

(7) a quantitative approach to hazards; 

(8) quantitative assessment of hazards and their evalu¬ 
ation against risk criteria; 

(9) techniques of reliability engineering; 

(10) the principle of independence in critical assessments 
and inspections; 

(11) planning for emergencies; 

(12) incident investigation; 

together with 

(13) a critique of traditional practices or existing regula¬ 
tions, standards or codes where these appear outdated 
by technological change. 

The identification of hazards is obviously important, since 
the battle is often half won if the hazard is recognized. 
A number of new and effective techniques have been devel¬ 
oped for identifying hazards at different stages of a project. 
These include hazard indices, chemicals screening, hazard 
and operability studies, and plant safety audits. 

Basic to loss prevention is a quantitative approach, which 
seeks to make a quantitative assessment, however elemen¬ 
tary. This has many parallels with the early development of 
operational research. This quantitative approach is embod¬ 
ied in the use of quantitative risk assessment (QRA). The 
assessment produces numerical values of the risk involved. 
These risks are then evaluated against risk criteria. How¬ 
ever, the production of numerical risk values is not the only, 
or even the most important, aspect. A QRA necessarily 
involves a thorough examination of the design and opera¬ 
tion of the system. It lays bare the underlying assumptions 
and the conditions that must be met for success, and usually 
reveals possible alternative approaches. It is therefore an aid 
to decision-making on risk, the value of which goes far 
beyond the risk numbers obtained. 

Reliability engineering is now a well-developed dis¬ 
cipline. Loss prevention makes extensive use of the tech¬ 
niques of reliability engineering. It also uses other types of 
probabilistic calculation that are not usually included in 
conventional treatments of reliability, such as probabilities 
of weather conditions or effectiveness of evacuation. Cer¬ 
tain aspects of a system may be particularly critical and 
may require an independent check. Examples are indepen¬ 
dent assessment of the reliability of protective systems, 
independent audit of plant safety and independent inspec¬ 
tion of pressure vessels. 

Planning for emergencies is a prominent feature of loss 
prevention work. This includes both works and transport 
emergencies. 

Investigation of incidents plays an important part in loss 
prevention. Frequently there is some aspect of technology 
involved. But the recurring theme is the responsibility of 
management. While a good safety culture varies according 
to the mission and activities of the organization, one of the 
attributes of a good safety culture that is a‘must’ is ‘learning 
from incidents’. There is no excuse when ‘lessons learned’ 
from incidents are ignored or not implemented, particularly 
‘lessons learned’ from incidents that have occurred in one’s 
own organization or incidents that are widely publicized. 

The loss prevention approach takes a critical view 
of existing regulations, standards, rules or traditional 
practices where these appear to be outdated by chang¬ 
ing technology. Illustrations are criticisms of incident 
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reporting requirements and of requirements for protection 
of pressure vessels. These developments taken as a whole 
do constitute a new approach and it is this which charac¬ 
terizes loss prevention. 

It might perhaps be inferred from the foregoing that the 
problems which have received special emphasis in loss 
prevention are regarded somehow as more important than 
the aspects, particularly personal incidents, with which 
traditionally safety work in the process industries has been 
largely concerned. Nothing could be further from the truth. 
It cannot be too strongly emphasized that mundane inci¬ 
dents are responsible for many more injuries than and as 
many deaths as those arising from high technology. 

1.7 Total Loss Control 

It is now necessary to consider some other developments 
that have contributed to the modern approach to SLP. The 
first of these is total loss control. The basic concept under¬ 
lying total loss control is that loss due to personal incident 
and injury is only the tip of the iceberg of the full loss aris¬ 
ing from incidents. It follows that attention should be paid, 
and controls applied, to all losses. Early work in this area is 
described in Industrial Accident Prevention (Heinrich, 1959) 
and by Bird (1966). Accounts are given in Total Loss Control 
(G. A. Fletcher and Douglas, 1971) and Practical Loss Control 
Leadership (Bird and Germain, 1985). 

Total loss control, like loss prevention, is concerned with 
losses associated with hazards and incidents or other inci¬ 
dents. It is not concerned with losses that do not have a 
hazard element. It may be seen, therefore, as an extension of 
the activity of the safety manager. The attraction of such a 
change of emphasis is that the safety manager becomes 
involved in a major cost area that is of concern to other 
managers and thus increases his influence, with con¬ 
sequent benefit to safety. 

The ratio between different types of incidents is a key 
concept in loss control. Early work on this was done by 
Heinrich (1959), who gave the following ratio for the dif¬ 
ferent types of incidents: 

Major or lost time injury/Minor injury/No injury 

= 1:29:300 


These ratios are frequently shown in the form of the inci¬ 
dent pyramid illustrated in Figure 1.4. 

The numbers of incidents on which the above ratios were 
based were evidently fairly limited. Later studies have been 
done involving much larger numbers. Bird and Germain 



Figure 1.4 The accident pyramid (after Bird and 
Germain, 1966) 


(1985) report a study of some 1.75 million incidents from 297 
cooperating organizations in which the ratio was: 

Disabling injury/Minor injury/Property damage/No injury 
or damage = 1:10:30:600 

Tye and Pearson (HSE, 1991b) give the results of an 
investigation of almost 1 million incidents: 

Disabling injury/Minor injury/First-aid injury/Property 
damage/No injury or damage = 1:3:50:80:400 

The incident definitions and ratios tend to vary between 
different studies, butthe relationship between the different 
kinds of event is usually consistent in a given study. 

In another study, The Costs of Accidents at Work 
(HSE, 1993a), an investigation was made of incidents at a 
creamery, a construction site, a transport company, a hos¬ 
pital and an oil platform. For the oil platform, the most 
relevant here, the ratios obtained were as follows (the values 
given in parentheses being those for all the studies except 
the construction site): 

Over 3-day injury/Minor injury/Non-injury incident 
" = 1:4(7): 126(189). 

Another ratio quoted by Heinrich is the ratio of uninsured to 
insured costs of incidents, which he gives as about 4:1. 
However, J. A. Fletcher and Douglas (1971) report studies in 
which this ratio ranges from 2.3 to 101 and suggest that it is 
necessary to investigate this in any particular work places. 

In another recent study in the United States, Mannan et al. 
(2001) reported the statistics on 34,527 incidents for 1998 in 
all of United States. According to this study, the incidents 
were distributed in the following ratio: 

Fatalities/Serious injury/Minor injury/No injuries 
= 1:7:44:300. 

In the same study mentioned above, Mannan et al. (2001) 
concluded that the underlying causes for incidents are 
usually the same regardless of which part of the pyramid 
the incident falls in. In other words, an incident that causes 
no injury and is classified in the lower part of the pyramid 
could easily have been classified in the top part of the pyr¬ 
amid. Consider, for example, a gas release that occurs when 
the wind speed and wind direction are such that the gas 
disperses before it can encounter an ignition source. The 
incident would then be classified as a near-miss falling in 
the lower part of the incident pyramid. But, now consider 
the same gas release that occurs when the wind speed and 
wind direction are such that the gas encounters a nearby 
ignition source. The situation could be more aggravated if 
nearby workers are knocked down or thrown against con¬ 
crete walls or equipment. The event could likely lead to 
injuries or fatalities. Thus, it seems that the same learning 
could be developed and captured into the procedures and 
training by analysing and investigating the near-miss. 
Thus, the broader the incident definition, the more statisti¬ 
cally sound the lessons from the incident analysis. In fact, it 
would seem that as safety programmes mature, the incident 
definition should be expanded to include not only near- 
misses but also other leading indicators as well. 

An illustration, given by Fletcher and Douglas, of a typi¬ 
cal situation in a medium sized factory is shown inTable 1.7 
The actual numbers of disabling and minor injury incidents 
were as indicated, while the number of property damage 
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Table 1.7 Losses in a medium sized factory (after J.A. Fletcher and Douglas, 1971) (Courtesy of Associated 
Business Programmes Ltd) 


Type of incident 

No. of uninsured 
per year 

Cost per accident (US$) 

Total incidents cost (US$) 

Disabling injury 

71 

52 

3,692 

Minor injury 

10,122 

3.86 

39,032 

Property damage (est.) 

35,500 

34.67 

1,230,794 

Total 



1,273,518 


incidents was computed from the number of disabling inci¬ 
dents using Bird’s ratio of 500. In this case, the insured costs 
were the workmen’s compensation costs of US$208,300, 
while, as shown, the uninsured costs were US$1,273,518, of 
which the major part was property damage costs. The ratio 
of uninsured to insured costs was about 6.1. 

The relative importance of the damage costs is enough to 
justify paying attention to damage incidents. But there is 
the further point that assessment of such costs is straight¬ 
forward compared with the assessment of injury costs, 
which frequently involves some rather dubious assump¬ 
tions. The policy suggested, therefore, is one of monitoring 
not only injury incidents but also damage incidents. For this 
it is necessary to have damage control centres that give 
general information on damage incidents in much the same 
way as first-aid points and medical centres generate infor¬ 
mation on injury incidents. The existing maintenance sys¬ 
tem can normally be adapted for this purpose. As an 
illustration of the application of such a policy, J.A. Fletcher 
and Douglas (1971) describe a study on the reporting of 
damage incidents by crane drivers. In the 3 years prior to the 
institution of the policy, the number of damage incidents 
reported was rather less than 25 per year. During the 
10 years after its institution, some 1643 incidents per year 
were reported. Reporting was enforced with an average of 
nine warnings and three work suspensions per year. 
Although many incidents were of a minor nature, many 
others revealed the need for prompt action to avert a more 
serious incident. 

Total loss control areas are listed as: (1) business inter¬ 
ruption, (2) injury, (3) property damage, (4) fire, (5) security, 
(6) health hygiene, (7) pollution and (8) product liability. 
Each of these areas is treated as follows: 

(1) identification - of possible loss producing situations; 

(2) measurement - of such losses; 

(3) selection — of methods to minimize loss; 

(4) implementation - of methods within the capability of 
the organization. 

The application of total loss control in the chemical 
industry has been described by Webster (1974), Hearfield 
(1975) and Ling (1976,1979). 

In the company described by Hearfield, incidents repor¬ 
ted in 1 year on a particular plant cost about £25,000, 
including consequential losses. It was estimated that if all 
the unreported incidents had been included, this figure 
might have been double. A total loss control programme was 
instituted, which revealed that the estimated loss in the 
works was about £350,000. One source of loss on the plant 
was associated with steam condensate systems. Following 
an incident involving condensate, a full plant investigation 
of the use of condensate and demineralized water was 
undertaken. A 20% deficiency in the demineralized water 


balance was reported. It was found that the orifice plate was 
completely missing from one of the water flowmeters. The 
investigation was extended to the works. Expenditure of 
£40,000 was incurred on pipework and instrumentation 
modification. In the first year of operation, savings of 
£130,000 were made due to reduced consumption of demin¬ 
eralized water, and capital expenditure of £200,000 on 
new demineralization plant was deferred. 

1.8 Quality Assurance 

Another development that shapes the modern approach to 
SLP is quality assurance and total quality management 
(TQM). Methods of ensuring that a product meets the 
required quality standards are the province of quality con¬ 
trol and quality assurance. The first of these terms in par¬ 
ticular tends to be used with different meanings. 

Quality control of products has long been standard prac¬ 
tice in a range of industries, from those manufacturing cars 
to those making ice cream. In many cases, the emphasis in 
such quality control has traditionally been on inspection of 
the product. 

The creation of systems to ensure that the product meets 
the required standards is the role of quality assurance. These 
systems are applied not only to the intermediate and final 
products made within the company but also to the inputs, 
raw materials and products purchased from outside, since 
unless these meet their specifications, it may be impossible 
for the company to meet its own quality standards. 

The 1980s have seen a strong movement in industry 
worldwide to adopt quality assurance systems and to seek 
accreditation to a recognized standard. The international 
standard is ISO 9000 and the corresponding British Stand¬ 
ard is BS 5750:1987:Quality Systems. As just indicated, a 
move by one firm to seek accreditation creates a chain reac¬ 
tion that obliges its suppliers to do likewise. Adoption of 
quality assurance involves the creation, and documentation, 
of a set of systems designed to ensure quality outputs from 
all the activities of the company. 

1.9 Total Quality Management 

A related, but not identical, development is TQM. The con¬ 
cept underlying TQM is that the problem of failures and 
their effects has an influence on company performance that 
is far greater than is generally appreciated, defining failure 
in a broad way. TQM has its origins in quality control on 
production lines. It has spread to industry generally, 
including the process industries. 

Most accounts of TQM highlight the role played by a 
number of individuals who have been influential in its 
development. Some principal texts are Quality is Free 
(Crosby, 1979), Quality Control Handbook (Juran, 1979), 
Quality Planning and Analysis (Juran and Gryna, 1980), 
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Quality, Productivity and Competitive Position (Deming, 
1982) and Out of the Crisis (Deming, 1986). An overview, 
including an account of the different schools, is given in 
Total Quality Management (Oakland, 1989). 

TheTQM approach has been pioneered in Japan, particu¬ 
larly in the motor industry. Accounts of the Japanese 
approach are given by Ishikawa Kaoru (1976,1985),Taguchi 
(1979,1981) and Singo Shigeo (1986). 

In many countries, industry is well advanced with the 
adoption of TQM concepts. Worldwide this typically 
involves implementation of the requirements of ISO 9000. 
Guidance on this process is given in ISO 9000 (P.L. Johnson, 
1993). In the United Kingdom, the relevant standard to 
which organizations are accredited is BS 5750 :1987. Guid¬ 
ance is given in Implementing BS 5750 (Holmes, 1991). A 
guide to the associated audit is Quality Management System 
Audit(CA. Moore, 1992). 

As stated earlier, the basic concept of TQM is that failures 
of various kinds have effects which are much more wide¬ 
spread, damaging and costly than has been generally 
appreciated. Failures have effects both internal and exter¬ 
nal to the company. The internal effects experienced by the 
company include loss of production, waste of materials, 
damage to equipment and inefficient use of manpower. The 
external effects experienced by the customer include the 
same features. Failures undermine the competitiveness of 
both parties. 

The starting point in tackling this problem is to review the 
product that is required and the system that is to produce it. 
The requirement for the product is ‘fitness for purpose’. In 
determining fitness for purpose, it is necessary to consider 
both the effectiveness of the product while it is operating 
and its reliability of operation. In order to achieve fitness for 
purpose, it is necessary to ensure that the design of the prod¬ 
uct is suitable and that the product made conforms to that 
design.These are two separate aspects and success depends 
on getting them both right. It is of little use to make a product 
that conforms well with the design if the design is defective, 
or to make a product that has a good design but which is pro¬ 
duced in such a way that it does not conform to that design. 

Given a product that is well designed, it is necessary to 
consider the system that will deliver conformability to the 
design. Traditionally, industry has placed much emphasis 
on an approach to quality control based on inspection. The 
approach taken inTQM is radically different. The attempt to 
inspect quality into an inherently defective production 
process is regarded as ineffective. Instead, the emphasis 
is on prevention. The basic question asked therefore, is 
whether the production process is actually capable of 
producing to the quality required. In many cases it has 
been concluded that it was not. Attempts were being made 
to deal with the situation by intensifying the inspection 
effort, attempts that were largely futile. 

The spirit of the TQM approach has been summarized in 
Right First Time (F. Price, 1985) as: 

(1) CanwemakeitOK? 

(2) Are we making it OK? 

(3) Have we made it OK? 

(4) Could we make it better? 

TheTQM approach seeks to root out failures in all aspects 
of the company’s operation, not just failures of equipment 
but also in all aspects of the company’s operation, including 
systems, documentation, communications, purchasing and 


maintenance. TQM is therefore concerned with both prod¬ 
ucts and activities. In assessing the quality of a product or 
activity, it seeks to identify the ‘customers’and to make sure 
that their requirements are properly defined and met. An 
important technique for reducing failures is the involve¬ 
ment of the workforce, who are encouraged to not allow 
failures to persist but to report them and make proposals for 
their elimination. 

The prime responsibility forTQM lies with management, 
and management leadership is essential to its success. It is 
management that is responsible for the necessary features 
such as organization, personnel, systems, design, planning 
and training. All employees are involved, however, in deal¬ 
ing with failure. An important part of TQM, therefore, is the 
involvement and motivation of the workforce. The quality 
circles (QCs) developed in Japan are an example of this. 
Another aspect of TQM is the ‘just-in-time’ (JIT) approach 
developed in Japan, notably in the motor industry. Each 
section of the production line operates with little or no 
inventory of input components, but takes them as required 
from the upstream supplier. This system requires an intol¬ 
erance of failure, with rapid detection and rectification. 

One way of expressing this intolerance is to adopt ‘zero 
defects’ as the performance standard, as advocated by 
Crosby (1979). In the variant of TQM given by Crosby, the 
overall approach adopted is summarized as: 


Definition Conformance to requirements 

System Prevention 

Performance standard Zero defects 

Measurement Price of non-conformance 


It will be apparent that, insofar as the process industries 
are concerned, this emphasis on, and intolerance of, fail¬ 
ures constitutes an approach very close to that of loss 
prevention. 

Accounts of the relationship between quality manage¬ 
ment and management of safety, health and environment 
have been given by Berkey, Dowd and Jones (1993), Rooney, 
Smith and Arendt (1993) and Olsen (1994). 


1.10 Risk Management 

Another related development is that of risk management. 
Any industrial project involves risk. But some of the 
developments described above, such as the increase in the 
technological dimension and the growth of public concern 
over safety and pollution, have tended to introduce 
further dimensions of unpredictability. Risk management 
addresses these latter risks and provides a means of 
assessing and managing them along with the normal 
commercial risks. 

Accounts of risk management are given in Managing 
Risks (Grose, 1987), Risk Management (Jardine Insurance 
Brokers Ltd, 1988), Managing Risk (Bannister, 1989), Risk 
Assessment and Risk Management for the Chemical Process 
Industry (Greenberg and Cramer, 1991) and Reliability, Safety 
and Risk Management (S.J. Cox and Tait, 1991), and by 
Tbrney (1990a,b) and Frohlich and Rosen (1992b). 

The variety of risks and the vulnerability of a business 
to these risks is now such that they need to be managed 
explicitly. Individual risks are recognized byline managers, 
but are frequently not fully addressed by them. There is a 





NTRODUCTION 1/13 


tendency to defer consideration and to take too optimistic a 
view. In any case, the individual line manager sees only part 
of the picture. It is for such reasons that risk management 
has emerged as a discipline in its own right. A systematic 
review of hazards is now normal practice in the manage¬ 
ment of projects in the process industries. A complementary 
system for the review of the totality of risks (commercial, 
legal and technological) is increasingly common. 


1.11 Safety-critical Systems 

Another concept that is gaining increasing prominence 
is that of safety-critical systems. These are the systems 
critical to the safe operation of some larger system, whether 
this be a nuclear power station or a vehicle. In a modern 
aircraft, particularly of the fly-by-wire type, the computer 
system is safety critical. An account of safety critical sys¬ 
tems is given by P. A. Bennett (1991a,b). 


1.12 Environment 

Another major concern of the process industries is the pro¬ 
tection of the environment. Developments in environmental 
protection (EP) have run in parallel with those in SLP. These 
two aspects of process plant design and operation have 
much in common. In recent years, there has been a trend to 
assign to the same person responsibilities for both. There 
are also some situations where there is a potential conflict 
between the two. The environment, and pollution of the 
environment, are considered in Appendix 11. 


1.13 Professional Institutions and Bodies 

The professional engineering institutions have responded 
to the problems described above with a number of 
initiatives. 


1.14 Responsible Care 

In a number of countries, the chemical industry has 
responded to safety, health and environmental concerns 
with the Responsible Care initiative, which was devel¬ 
oped in the early 1980s by the Canadian Chemical Pro¬ 
ducers Association and was then taken up in 1988 in 
the United States by the ACC, in 1989 in the United 
Kingdom by the Chemical Industries Association (CIA), 
and elsewhere. 

Companies participating in Responsible Care commit 
themselves to achieving certain standards in terms of 
safety, health and environment. Guidance is given in 
Responsible Care (CIA, 1992 RC53) and Responsible Care 
Management Systems (CIA, 1992 RC51). An account of the 
development of Responsible Care is given by Jacob (1992). 
The Canadian perspective is described by Buzzelli (1990) 
and Creedy(1990). 

As stated earlier, in 1973, the IChemE created a Loss Pre¬ 
vention Panel. The Institution itself publishes a range of 
monographs and books on SLP and the panel publishes the 
Loss Prevention Bulletin and a range of aids for teaching 
and training. 


In 1985, the AlChE formed the CCPS. The Centre pub¬ 
lishes a series of guidelines on SLP issues. 

At the European level, the European Process Safety 
Centre (EPSC) was set up in 1992 to disseminate informa¬ 
tion on safety matters, including legislation, research 
and development, and education and training (EPSC, 1993). 

The work of these and other bodies is described in 
Chapter 27. Much of the material referred to in this book 
derives from these sources. 


1.15 Academic and Research Activities 

Over the years, academic and research activities aimed at 
process SLP have ebbed and flowed. However, lately these 
activities are becoming more formalized. Engineering 
departments in various universities throughout the world 
have begun to realize the importance of the subject and the 
significant role they can play in educating the students 
and the solution of industry problems through funda¬ 
mental research. Many universities in the United States, 
United Kingdom, elsewhere in Europe, Japan, Korea, and 
other countries now offer specialized courses, certificate 
programmes, and degree programmes on process SLP. 
In some universities, for example Texas A&M University 
and University of South Carolina, process safety courses 
instead of being optional electives are now part of the 
required core curriculum. University professors and 
researchers are also dedicating extensive efforts towards 
research topics on process SLP. With regard to academic 
and research activities, the Mary Kay O’Connor Process 
Safety Center at Texas A&M University is a classic example 
of a comprehensive academic and research programme 
dedicated to education, research and service activities on 
process SLP. 


1.16 Overview 

The modern approach to the avoidance of injury and loss 
in the process industries is the outcome of the various 
developments just described. Central to this approach is 
leadership by management, starting with senior manage¬ 
ment, and creation of a safety culture that provides 
the appropriate environment for reduction of incidents and 
improvement of safety performance. Such leadership 
and safety culture are indispensable conditions for suc¬ 
cess. They are not, however, sufficient conditions. Man¬ 
agement must also identify the right objectives. The 
contribution of total loss control, quality assurance and 
TQM is to identify as key management objectives the 
elimination of failures of all kinds and the conduct of 
activities so that they are satisfactory to those affected by 
them. These disciplines provide in QCs a tool for meeting 
these objectives. 

As far as the process industries are concerned, it is the 
contribution of loss prevention to handle the technological 
dimension and to provide methods by which failure is elimi¬ 
nated. In the modern approach to SLP, these themes come 
together. The ends are the safety of personnel and the avoid¬ 
ance of loss. The means to achieve both these aims is leader¬ 
ship by management, informed by an understanding of the 
technology and directed to elimination of failures of all kinds. 
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A rational approach to loss prevention must be based 
on an understanding of the nature of incidents and of the 
types of loss that actually occur. Therefore, in this chapter, 
first the nature of the incident process is considered 
and then the incident and loss statistics are reviewed to 
give an indication of the problem. Selected references 
on incident and loss experience are given in Table 2.1. 
In addition, many other tables of data are given in other 
chapters. Cross-references to some of these tables are given 
inTable 2.2. 


2.1 The Incident Process 

There are certain themes that recur in the investigation of 
incidents and which reveal much about the incident process. 
First, although in some reporting schemes the investigator 
is required to determine the cause of the incident, it fre¬ 
quently appears meaningless to assign a single cause as 
the incident has arisen from a particular combination of 
circumstances. Second, it is often found that the incident 
has been preceded by other incidents that have been 
‘near-misses’. These are cases where most but not all of the 
conditions for the incident were met. A third characteristic 
of incidents is that when the critical event has occurred, 
there are wide variations in the consequences. In one 
case there may be no injury or damage, while in another 
case that is similar in most respects, there is some key 
circumstance that results in severe loss of life or property. 
These and other features of incidents are discussed 
in Man-Made Disasters (B.A. Turner, 1978). It is in the 
nature of disasters that they tend to occur only as the 
result of the combination of a number of events and to 
have a long incubation period before such a conjunction 

It is helpful to model the incident process in order 
to understand more clearly the factors that contribute 
to incidents and the steps that can be taken to avoid them. 
One type of model, discussed by Houston (1971), is the 
classical one developed by lawyers and insurers that 
focuses attention on the ‘proximate cause’. It is recognized 
that many factors contribute to an incident, but for 


Table 2.1 Selected references on incident and 
loss experience 


Natural and man-made hazards, disasters 

Thygerson (1972,1977); Walker (1973); G.F. White (1974); 
Bignell etal. (1977); Miinchener Ruck (1978); B.A. Turner 
(1978); ASCE (1979/9); Ferrara (1979); Whittow (1980); 
Perry (1981); Rossi etal. (1983); Simkim and Fiske (1983); 
Perrow (1984);Wijkman andTimberlake (1984); McWhirter 
(1985); Cairns (1986); Sir R. Jackson (1986); E.A. Bryant 
(1991); Guinness Publishing Co. (1991); K. Smith (1992); 

R. Smith (1992); Arnold (1993) 

Process hazards, incidents 
Matheson(1960);Vervalin (1964a, 1973a); BCISC (1968/7); 
Fowler andSpiegelman(1968);WH.Doyle(1969);Spiegelman 
(1969,1980); Chemical Industries Association (CIA) (1970/3); 
Cornett andjones (1970); Rasbash (1970b); Houston (1971); 
H.D.Taylor and Redpath (1971,1972); R.L. Browning (1973); 
Walker (1973); Fire Protection Associa- tion (FPA) (1974b, 
1976); AFC (1975); N. McWhirter (1976); J.R. Nash (1976); 


Mclntire (1977); AIA (1979); Harvey (1979); Carson and 
Mumford (1979); Ferrara (1979); R. King and Magid (1979); 
Kletz and Turner (1979); Lees (1980); Pastorini etal. (1980); 
Mance (1984); Manuele (1984 LPB 58); Hawkins (1985); 

D. McWhirter (1985); APCA (1986); Kletz (1986b); 

VC. Marshall (1986a, 1988c); Garrison (1988a, b); Instone 
(1989); Mahoney (1990); Anon. (1991 LPB 99, p. 1); 
O’Donovan (1991 LPB 99); K.N. Palmer (1991 LPB 99); 
Guinness Publishing Co. (1991); Marsh and McLennan 
(1992); Pastorini etal. (1992); Bisio (1993); O’Shima (1993); 
Crooks (1994 LPB 115) 

Incident models 

Surry (1969b); Houston (1971); Macdonald (1972); Haddon 
(1973a, b); WG. Johnson (1973a,b, 1980); de Jong (1980); 
Rasmussen (1982b, 1983); Haastrup (1983); Benner (1984); 
A.R. Hale and Glendon (1987); Wells etal. (1991); Bond (1994 
LPB 120) 

Incident ranking 

Keller etal. (1990); Keller and Wilson (1991) 

Annual or periodic reports, statistical summaries 

AGA (Appendix 28 Pipeline Incident Reports); American 
Petroleum Institute (API; Appendix 28 Annual 
Summaries); BIA (annual report); BRE (annual statistics, 
Appendix 28 UK Fire and Loss Statistics); FPA (annual 
report); HM Chief Inspector of Explosives (annual report); 
HM Chief Inspector of Factories (HMCIF; annual report, 
annual analysis of accidents); HM Senior Electrical 
Inspector of Factories (annual report); M&M Protection 
Consultants (periodic); National Transportation Safety 
Board (NTSB; Appendix 28); NSC (n.d./l); ABCM 
(1930- 64/2); MCA (1962-/1-4,1971-/20,1975-/23); 
BCISC (1965—/4); Chemical Industry Safety and Health 
Council (CISHC) (1975-/5); CONCAWE (1977 9/77,1992 4/ 
92); HSC (1977); Health and Safety Executive (HSE) (1977d, 
1986c, 1992b); ILO(1992) 

Fire 

BRE (annual statistics); FPA (annual report, 1974,1976, 
1991); W.H. Doyle (1969); Spiegelman (1969,1980); 

H.D. Taylor and Redpath (1971,1972); FRS (1972 Fire 
Research Note 920); P. Nash (1972b); Vervalin (1963a, 1972c, 
1973a, 1974a, 1975c, 1976b, 1977,1978a,b, 1986b); Duff 
(1975); Redpath (1976); Rutstein (1979a,b); Rutstein and 
Clarke (1979); Banks and Rardin (1982); Norstrom (1982a); 
Gebhardt (1984); Uehara and Hasegawa (1986); Mahoney 
(1990); Home Office (1992) 

Explosion 

Eggleston (1967); Doyle (1969); Spiegelman (1969,1980); 
Duff (1975); Davenport (1977b, 1981b); Norstrom (1982b); 
Uehara and Hasegawa (1986); Vervalin (1986b); Mahoney 
(1990); Lenoir and Davenport (1993) 

Refineries 

Anon. (1970a); McFatter (1972); W.L. Nelson (1974); Mclntire 
(1977); Mahoney (1990) 

Ammonia plants 

Holroyd (1967); Axelrod etal. (1968); Sawyer etal. (1972); 
G.P. Williams and Sawyer (1974); G.P. Williams (1978); 

G.P. Williams and Hoehing (1983); G.P.Williams etal. (1987) 

Educational institutions 

Bowes (1985) 
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Table 2.2 


Cross-references to other incident and 


Major fires 

Major condensed phase 
explosions 
Major vapour cloud 
explosions (VCEs) 

Major boiling liquid expanding 
vapour explosions (BLEVEs) 
Major missile incidents 
Major dust explosions 
Major toxic releases 

Case histories 
Failure data 


Section 16.38 
Table 17.24; Appendix 1 

Section 17.28; Table 17.30 

Section 17.29; Table 17.37 

Section 17.34; Table 17.49 
Section 17.43; Table 17.63 
Section 18.27; 

Tables 18.30,18.31 
Appendix 1 
Appendix 14 


practical, and particularly for legal, purposes, a principal 
cause is identified. This approach has a number of defects: 
there is no objective criterion for distinguishing the prin¬ 
cipal cause; the relationships between causes are not 
explained; and there is no way of knowing if the cause list 
is complete. 

There is need for incident models that bring out with 
greater clarity the common pattern in incidents. Some 
models of the incident process that may behelpf ul in incident 
investigation and prevention are givenbelow, with emphasis 
on the management and engineering aspects. Further 
incident models are discussed in Chapters 26-28 and 
incident investigation procedures are given in Chapter 31. 
However, irrespective of the incident model used for incident 
investigation, it is essential that investigations result in the 
identification of root causes, and recommendations are 
identified and implemented that target root causes. For 
example, take the case of a guillotine rupture of a gas pipe¬ 
line caused by a construction crew. The subsequent gas 
release accumulates for an extended period of time and ulti¬ 
mately is ignited resulting in an explosion and fire causing 
multiple fatalities, injuries and extensive loss of property. 
For the investigation to focus on just how the rupture was 
caused defeats the purpose of incident investigation com¬ 
pletely. In other words, dramatically different answers are 
obtained when the incident investigation tries to answer any 
one the following questions: 

(1) Why did the rupture occur? OR 

(2) Why did the explosion and fire occur? OR 

(3) Why did the people die or get hurt? 

An investigation trying to answer the first question will 
quite clearly identify flaws with the construction and dig¬ 
ging procedures and may well come up with recommenda¬ 
tions aimed at correcting those deficiencies. However, that 
does not answer the question of why did the explosion and 
fire occur. An investigation that tries to answer this second 
question assumes that irrespective of pipeline operating 
procedures, how should pipeline systems be designed and 
operated so that the probability of explosions and fires are 
minimized to the lowest extent possible. Thus, recommen¬ 
dations resulting from such an investigation would identify 
flaws in the design and operation of the pipeline sys¬ 
tem. Issues such as engineered systems capable of shut¬ 
ting the flow of gas in a reasonably short period of time 
would be addressed in answering this second question. 



Injury or 
damage 


Figure 2.1 Houston model of the accident process 
(after Houston, 1977) 


An investigation that tries to answer the third question opens 
up a lot of additional issues that are also very important. Not 
only is the design and operation of the pipeline system 
analysed, but also issues such as emergency response and 
evacuation of the affected area would be addressed. After all 
it is a very relevant question to ask that irrespective of the 
causes of the rupture and accumulation of the gas, was not 
there any way to evacuate the personnel or respond to their 
plight in order to reduce or eliminate the casualties. 

2.1.1 The Houston model 

The model given by Houston (1971,1977) is shown sche¬ 
matically in Figure 2.1. Three input factors are necessary 
for the incident to occur: (1) target, (2) driving force and 
(3) trigger. Principal driving forces are energy and toxins. 
The target has a threshold intensity 9 below which the 
driving force has no effect. The trigger also has a threshold 
level 9' below which it does not operate. 

The development of the incident is determined by a 
number of parameters. The contact probability p is the 
probability that all the necessary input factors are present. 
The contact efficiency e defines the fraction of the driving 
force that actually reaches the target, and the contact effec¬ 
tiveness n is the ratio of damage done to the target under the 
actual conditions to that done under standard conditions. 
The contact time t is the duration of the process. 

The model indicates a number of ways in which the 
probability or severity of the incident may be reduced. One 
of the input factors (target, driving force or trigger) may he 
removed. The contact probability may be minimized by 
preventive action. The contact efficiency and contact effec¬ 
tiveness may he reduced by adaptive reaction. 

Work by Haddon (1973a,b) emphasizes prevention of 
incidents by control of the energy. His list of energy control 
strategies is given inTable 2.3. Failure of one or more of these 
modes of control is a normal feature of an incident and hence 
of incident models. 

2.1.2 The fault tree model 

A simple fault tree model of an incident is given in 
Figure 2.2. An initiating event occurs which constitutes a 
potential incident, but often only if some enabling event 
occurs, or has already occurred. This part of the tree is the 
‘demand’ tree, since it puts a demand on the protective 
features. The potential incident is realized only if prevention 
by protec-tive equipment and human action fails. An inci¬ 
dent occurs that develops into a more severe incident only if 
mitigation fails. 

A somewhat similar model has been proposed by 
Wells et cd. (1992). 
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Table 2.3 Some energy control strategies (after 
Haddon, 1973a) 


(1) To prevent the initial marshalling of the form of 
energy 

(2) To reduce the amount of energy marshalled 

(3) To prevent the release of energy 

(4) To modify the rate or spatial distribution of release of 
energy from its source 

(5) To separate in space or time the energy being 
released from the susceptible structure 

(6) To separate the energy being released from the 
susceptible structure by interposition of a material 
barrier 

(7) To modify the contact surface, subsurface, or basic 
structure which can be impacted 

(8) To strengthen the living or non-living structure 
which might be damaged by energy transfer 

(9) To move rapidly in detection and evaluation of 
damage and to counter its continuation and 
extension 

(10) All those measures which fall between the 
emergency period following the damaging energy 
exchange and the final stabilization of the process 
(including intermediate and long-term reparative 
rehabilitative measures) 


2.1.3 The MORT model 

A more complex fault tree model is that used in the man¬ 
agement oversight and risk tree (MORT) developed by 
WG Johnson (1980) and shown in Figure 2.3.This tree is the 
basis of a complete safety system, which is described fur¬ 
ther in Chapter 28. 

2.1.4 The Rasmussen model 

Incident models that show the role of human error have been 
developed by Rasmussen (1982a,b). Figure 2.4 shows such a 
model. The role of human error in causing incidents is con¬ 
sidered in more detail in Chapter 14. 

2.1.5 The ACSNI model 

Figure 2.5 shows a model proposed by the Advisory Com¬ 
mittee on the Safety of Nuclear Installations (ACSNI, 1991). 
The model provides a general framework that can be used 
to identify latent failures that are likely to lead to critical 
errors. 

2.1.6 The Bellamy and Geyer model 

A model that emphasizes the broader, socio-technical back¬ 
ground to incidents has been developed by Geyer and 
Bellamy (1991) as shown in Figure 2.6. Figure 2.6(a) gives 
the generic model and Figure 2.6(b) shows the application of 
the model to a refinery incident. 

2.1.7 The Kletz model 

Another approach is that taken by Kletz (1988h), who has 
developed a model oriented to incident investigation. The 
model is based essentially on the sequence of decisions and 
actions that lead up to an incident, and shows against each 
step the recommendations arising from the investigation. 
An example is shown in Figure 2.7, which refers to an inci¬ 
dent involving a small fire on a pump. 
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DEMAND TREE 

Figure 2.2 Fault tree model of the accident process 


2.2 Standard Industrial Classification 

Statistics of injuries and damage in the United Kingdom are 
generally classified according to the Standard Industrial 
Classification 1980 (SIC 80). In this classification, the 
classes relevant here are: Class 1 Energy and water indus¬ 
tries; Class 2 Extraction of minerals and ores other than 
fuels, manufacture of metals, mineral products and chemi¬ 
cals; Class 3 Metal goods, engineering and vehicles indus¬ 
tries; and Class 4 Other manufacturing industries. The 
mineral oil processing industry falls into Class 1, Subclass 
14, and the chemical industry in Class 2, Subclass 25. 

In the United States as well, incident and damage statis¬ 
tics are compiled by SIC codes. However, the difference with 
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Figure 2.3 MORT model of the accident process (W.G. Johnson, 1980). The letter A-H refer to further subtrees. 
LTA, less than adequate (Courtesy of Marcel Dekker) 


United Kingdom is that in the United States, the statistics 
are compiled by different agencies each of which has dif¬ 
ferent incident definitions and incident taxonomy. A vast 
amount of data is available in these incident databases and 
statistics; however, the user must be careful and experi¬ 
enced in dealing with the respective anomalies and inac¬ 
curacies of each one of these databases. More details of the 
advantages and problems associated with these databases 
are discussed in the next section. 

2.3 Injury Statistics 

2.3.1 United States of America 

In the United States, many federal agencies gather infor¬ 
mation about the chemical industry. Under statutory man¬ 
date, the agencies gather data on releases of chemicals, and 


on injuries, illnesses and fatalities caused by chemicals. 
These federal databases, some of which have received 
information for over three decades, may provide the infor¬ 
mation needed to develop trends of chemical-related inci¬ 
dents. However, despite the magnitude of data available, 
chemical industry stakeholders cannot answer the ques¬ 
tion,‘How do we assess the status of chemical safety in the 
United States?’ In 1995, the US Environmental Protection 
Agency (EPA) stated in its Users Guide to Federal Accidental 
Release Databases, ‘The existence of many different (and 
often incompatible) federal databases makes it difficult to 
develop a national picture of the problem of accidental 
releases’. EPA also determined that federal databases do not 
provide comparable data sets. This has inhibited data 
interpretation, comparative analysis and cross agency use 
of accident data. 
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ANATOMY OF AN ACCIDENT 



Figure 2.4 Rasmussen model of the accident process (Rasmussen, 1982b) (Reproduced by permission from 
High Risk Safety Technology by A.E. Green, copyright John Wiley) 
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PERSONAL 


ORGANIZATIONAL 



Figure 2.5 ACSNI model of the accident process (ACSNI, 1991) (Courtesy of HM Stationery Office) 


Six US federal databases provide information about 
incidents and incident statistics related to chemical safety 
at fixed facilities.They are: 

National Response Center’s (NRC) Incident Reporting 
Information System (IRIS) 

Covered Universe IRIS contains data on reported releases 
from fixed facilities, marine/offshore facilities, pipelines 
and transportation vehicles. Many federal statutes require 
reporting of releases to the NRC. Oil spills are reported 
under: 

(1) Section 311(b) of the Federal Water Pollution Control 
Act of 1973; 

(2) Section 306(a) of the Outer Shelf Lands Act Amend¬ 
ments of 1978; and 

(3) Section 18(b) of the Deepwater Ports Act of 1974. 
Chemical spills are reported under: 

(1) Section 302 of the Comprehensive Environmental 
Response, Compensation, and Liability Act (CERCLA) 
of 1980; 

(2) Section 304 of the Emergency Planning and Commu¬ 
nity Right-to-Know Act of 1986; and 

(3) Federal Hazardous Materials Transportations Laws. 

Pipeline spills are reported under the Hazardous Liquid 
Pipeline Safety Act. 

Air releases are reported under: 

(1) Clean Air Act; 

(2) Toxic Substances Control Act; 


(3) Federal Hazardous MaterialsTransportations Law and 

(4) Resource Conservation and Recovery Act. 


Collection Method This database is primarily used for 
emergency response notification and is operated 24 h a day, 
7 days a week. The initial notification of a release is usually 
by telephone. These reports are comprised of primarily 
short answer questions. 

Principal Data Elements The database contains data on 
oil, chemical, biological and etiological discharges into the 
environment anywhere in the United States or its territories. 
The NRC collects information nationally on reports of 
hazardous material releases, as well as releases of hazard¬ 
ous substances and oil from fixed facility and transporta¬ 
tion incidents. Two files, INCRPTand MATRPT, compose 
the IRIS database. The INCRPT file contains information 
about the location of the release, the company owner of the 
facility (when it applies), a short description of the incident, 
and the information related to the consequences (affected 
medium, fatalities, injuries, evacuations, cost of damages) 
of the incident. No information regarding the released sub¬ 
stance is reported in this file. The MATRPT file contains the 
information related to the chemical substance(s) involved in 
the incident (name of the substance, CHRIS code, and 
quantity and phase of the released chemical). 

Strengths NRC handles approximately 300,000 telephone 
calls each year, of which approximately 25,000 are unique 
incidents. Coverage of such a large number of incidents 
provides the potential for statistical analysis to capture 
meaningful trends. 

Weaknesses While reporting to the NRC is required by a 
number of statutes, it also receives numerous ‘complaints’ 
from the public. In addition, practice drills for emergency 
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LEVEL 



Passing valve due to poor design 


Impact 


Mitigation 


Inadequate knowledge of supervisors 
regarding hazards. Inadequate checking 
of isolation 

I 

Possibility of sludge/scale build-up not 
communicated to operators. Procedures not 
discussed by higher management. No valve 
position indicators or means of checking 
pipeline pressure. No detailed procedures or 
safety instructions to follow 



3 


(a) (b) 

Figure 2.6 Bellamy and Geyer model of the accident process: (a) generic model; (b) model applied to a refinery 
incident (Geyer and Bellamy, 1991) (Courtesy of the Health and Safety Executive) 


releases are captured in the database. The NRC also collects 
in the same database non-chemical-related events such as 
railroad crossing accidents. Also, both actual and potential 
releases may be reported to IRIS. Many of the reported 
incidents are spills of fuel from motor vehicles, small 
spills of low hazard materials such as lubricating oil 
and oil sheens on water with unknown sources, 
quantities and effects. Because this system contains initial 
reports, the information is preliminary and many times 


inaccurate or incomplete. There is also duplicate reporting 
of incidents. The completeness and accuracy of chemical 
names depend on the knowledge level of the person report¬ 
ing the incident. 

EPA’s Risk Management Program (RMP) Rule’s 
5-year Accident History Database 

Covered Universe RMP-covered facilities that have re¬ 
leased a listed substance, which is stored above a threshold 
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Figure 2.7 Kletz model of the accident process 
(Kletz, 1988h) (Courtesy of Butterworths) 


quantity and results in fatalities, injuries, or significant 
environmental or property damage are required to report 
5-year accident histories. 

Collection Method 5 -year Accident History Report. 
Principal Data Elements It contains information on RMP- 
covered facilities that meet the reporting criteria listed in 
the ‘Covered Universe’. The facility must provide EPA with 
the following information: 

(1) date, time and approximate duration of the release; 

(2) chemical(s) released; 

(3) estimated quantity released in pounds; 

(4) type of release event and its source; 

(5) weather conditions, if known; 

(6) on-site impacts; 

(7) known off-site impacts; 

(8) initiating event and contributing factors if known; 

(9) whether off-site responders were notified if 
known; and 

(10) operational or process changes that resulted from 
investigation of the release. 

Strengths The reporting is from a well-defined universe of 
facilities and it allows statistical treatment of the frequency 
of releases per facility or process unit that is not available 
from other systems. The reports do address such items as 
the causes and consequences of the release and steps taken 
to prevent or mitigate future incidents. Future data from 
EPA’s 5-year Accident History Database may provide more 
information to be able to determine statistically significant 
trends and the effects of implementing EPA’s RMP Rule and 
Occupational Safety and Health Administration (OSHA)’s 
Process Safety Management (PSM) Standard of Highly 


Hazardous Chemicals, which were promulgated to improve 
safety in the chemical industry. 

Weaknesses The database is limited to RMP-covered 
facilities that have experienced an incident with a con¬ 
sequence involving a listed chemical stored above its 
threshold quantity. The reporting criteria excludes a large 
number of incidents. As a result, only 1900 releases are 
reported from about 14,500 facilities for the 5-year period. 
Of the 1900 releases, only 1500 were required to be reported, 
because 400 of the incidents were without consequences. 
The RMP data is currently only available in 5-year cycles 
beginning in 1994. By limiting reporting to cases with con¬ 
sequences, a great deal of information is lost about releases 
without consequences. Releases without consequences 
or near misses provide valuable information on how to pre¬ 
vent incidents and the ability to predict possible con¬ 
sequences. There may be corrections and revisions to 
RMP* Info at any time through submission by a facility of a 
corrected RMP. It is critical in performing analysis to report 
the date of last revision and any notable modifications to 
the data. 


EPA’s Accidental Release Information Program (ARIP) 
Database 

Covered Universe Facilities were asked by EPA to provide 
information to the ARIP database if the facility reported an 
incident to EPA’s Emergency Response Notification System 
and the release event met one or more of the following 
criteria: 

(1) the release resulted in a death or injury; 

(2) the release involved 1000 pounds or more of a hazard¬ 
ous substance with a reportable quantity of 1,10 or 
100 pounds, or the release involved 10,000 pounds or 
more of a hazardous substance with a reportable 
quantity of 1000 to 5000 pounds; 

(3) the release was the fourteenth release in a 12-month 
period; or 

(4) The release involved an extremely hazardous sub¬ 
stance from Section 302 of Emergency Planning and 
Community Right-to-KnowAct. 

EPA was authorized to gather this information under: 

(5) section 3007(a) of the Resource Conservation and 
Recovery Act; 

(6) sectionl04(b)(l) and (e) of CERCLA; 

(7) section 308(a) of the Clean Water Act; and 

(8) section 114 of the amended Clean Air Act. 

Collection Method Facilities were requested to complete a 
questionnaire with 23 questions. 

Principal Data Elements The ARIP database was devel¬ 
oped by EPA in 1986 to determine the causes of accidental 
chemical releases, to identify the steps that could be taken 
by industrial facilities to prevent releases, and to outline 
industry prevention practices. The facilities were asked to 
provide information about the facility, the listed chemical, 
the circumstances and causes of the incident, the acci¬ 
dental release prevention practices and technologies in 
place prior to the event, and any additions or changes 
made to these technologies and practices as a result of the 
event. The questionnaire focuses on several areas of acci¬ 
dent prevention including hazard assessments, training, 
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emergency response, public notification procedures, miti¬ 
gation techniques, and prevention equipment and controls. 
Strengths ARIP is one of the larger collections of incidents 
with details concerning causes, consequences, operating 
mode and corrective actions. ARIP has collected over 4800 
release records since its inception. The data are considered 
accurate because the data are provided directly by facilities 
several months after the release when most information 
should be known. This system provides detailed informa¬ 
tion about causes and prevention practices not available in 
most other systems. 

Weaknesses This programme is discontinued. No trends 
with time can be gathered. The chemicals reported are the 
ones reported to EPA under existing statutes and regula¬ 
tions, which tends to exclude gasoline, methane, ethane, 
propane and other chemicals some of which are included in 
the EPA 5-year Accident History database. In September 
1993, EPA took steps to streamline the database by 
including only releases with significant off-site con¬ 
sequences, such as casualties, evacuations, sheltering- 
in-place or any other necessary precautions taken by 
individuals off-site as a result of a release. In addition, the 
questionnaire for the database has been revised over time 
so that some information was added and other information 
was deleted. Thus, analysis on some data fields cannot be 
performed on the entire database. In addition, the short 
description of the accident is not contained in the database 
and must be analysed in the hard copy of the ques¬ 
tionnaire. The collection of ARIP data was dependent on 
the sometimes uneven collection efforts of the EPA 
regions; therefore, the data does not truly represent the 
geographical distribution of releases, nor does it reflect 
release trends over time. 

Bureau of Labor Statistics’ (BLS) Databases for 
the US Occupational Safety and Health 
Administration (OSHA) 

Covered Universe All OSHA-covered facilities. 

Collection Method Surveys. 

Principal Data Elements The BLS database is a compre¬ 
hensive statistical system covering work-related deaths, 
injuries and illnesses in private industry. Work-related 
fatalities are counted and profiled more accurately in a 
separate BLS table, Census of Fatal Occupational Injuries. 
Survey information on non-fatal incidents involving days 
away from work profiles: 

(1) occupation and other demographics (e.g. age and gen¬ 
der) of workers sustaining such injuries and illnesses; 

(2) the nature of these disabling conditions and how they 
occurred; and 

(3) the resulting time away from work. 


Strengths These statistics are based on an annual sam¬ 
pling of about 250,000 companies in the United States. 
There is very good detail for chemicals and industries 
involved in accidents, from a statistical sample, not individ¬ 
ual incidents. The data have been collected and reported on 
in a consistent manner since 1992. Thus, trends from 1992 
can be determined and compared with injury rates. 
Weaknesses Chemical incidents are only identified for 
cases with days away from work. Also, the survey was 
redesigned between 1987 and 1992; thus, statistical analy¬ 
sis is limited for the years prior to 1992. 


U.S. Centers for Disease Control and Prevention’s (CDC) 
Wide-ranging On-line Data for Epidemiological Reporting 
(WONDER) 

Covered Universe All fatalities in the United States. 
Collection Method Death certificates as recorded by 
physicians. 

Principal Data Elements This database provides the 
numbers of fatalities and their associated causes. 

Strengths The WONDER database is useful for the pur¬ 
pose of determining overall trends in fatalities due to 
chemicals. The database allows sorting by codes that 
describe a class of chemicals or a type of event. It also allows 
sorting by the age of the deceased. This feature was used to 
eliminate victims under 20 years of age as it is unlikely these 
were industrial accidents. Unlike most other databases, a 
physician, who is presumably not biased when determining 
the cause of death, codes the data.The data is available since 
1979 that provides a long and statistically significant trend. 
Weaknesses The scope of incidents in WONDER is very 
broad and contains incidents such as a teenager huffing 
butane which resulted in a fatal incident, and incidents 
involving consumer products in residences. The data is not 
related to specific incidents. Public access to WONDER is 
limited. Thus, it is not possible to eliminate selected types of 
incidents. Data can only be gathered by presenting queries 
by the numbe of fatalities due to a certain cause in a given 
year by age group. 

U.S. Department of Health and Human Services’ 

Agency for Toxic Substances and Disease Registry’s 
(ATSDR) Hazardous Substances Emergency Events 
Surveillance (HSEES) Database 

Covered Universe Sixteen state health departments cur¬ 
rently have cooperative agreements with ATSDR to partici¬ 
pate in HSEES.The state health departments report an'event’ 
if it meets the HSEES definition, which is ‘any release(s) or 
threatened release(s) of at least one hazardous substance’. 
A substance is considered hazardous if it might reasonably 
be expected to cause adverse human health effects. Releases 
of petroleum products are excluded from this system. 
Collection Method Data are entered by participating state 
health departments into a weh-based application that 
enables ATSDR to instantly access data for analysis. 
Principal Data Elements Data collected on incidents for 
this database include the following: 

(1) time, date and day of the week; 

(2) geographical location within the facility where the 
event occurred; 

(3) event type (fixed-facility or transportation-related 
event); 

(4) factors contributing to the release; 

(5) environmental sampling and follow-up health 
activities; 

(6) specific information on injured persons: age, sex, type 
and extent of injuries, distance from spill, population 
group (employee, general public, responder, student) 
and type of protective equipment used; 

(7) information about decontaminations, evacuation or 
shelter-in-place; 

(8) land use and population information to estimate the 
number of persons at home or work who were poten¬ 
tially exposed; and 

(9) whether a contingency plan was followed and which 
plan was used. 
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Strengths ATSDR has a proactive approach to incident 
collection that facilitates more complete and accurate 
reporting. 

Weaknesses ATSDR’s HSEES programme only covers 16 
states, which vary, and excludes petroleum products. The 
public does not have access to the data; ATSDR provides 
summary reports of the data. 

In the United Kingdom, incident statistics are available in 
the Annual Report of HMCIF, or its current equivalent, and 
the annual and Safety Statistics. The former also gives 

occasional detailed studies for particular industrial 
sectors. 

2.3.2 United Kingdom 

In the United Kingdom, the definition of a major injury 
changed with the introduction of the Reporting of Injuries, 
Diseases and Dangerous Occurrences Regulations 1985 
(RIDDOR).The Health and Safety Statistics 1990-91 (HSE, 
1992b) show that in 1990-91 there were 572 fatalities 
reported under RIDDOR, of which 346 were to employees, 

87 to the self-employed and 139 to members of the public. 
The fatal injury incidence rate for employees was 1.6 per 
100,000 workers. 

Major injuries to employees in 1990-91 reported under 
RIDDOR were 19,896 and the incidence rate was 89.9 per 
100,000 workers. 

For the manufacturing industry (SIC 2 -4), fatalities were 

88 in 1990-91 and averaged 100 in the 5-year period 
between 1986-87 and 1990-91 and the fatal injury inci¬ 
dence rate was 1.8 per 100,000 workers. 

Fatal and major injuries in the oil and chemical industries 
in the period 1981—85, inclusive, are shown inTable 2.4. For 
1990-91, the Health and Safety Statistics 1990-91 show 
that in the oil and chemical industries, the incidents to 
employees were as shown inTable 2.5. 


The comparative incidence of fatalities in some princi¬ 
pal industries and jobs in the United Kingdom is given in 
Table 2.6. The table shows that there is a wide variation 
between industries. It also shows a downward trend. The 
fatal accident rate of the chemical industry is approxi¬ 
mately the same as that for all manufacturing industry. 
The injury statistics can be dramatically changed, however, 
by a single major disaster. Inthe process industries, the worst 
disastersincel945 was theVCEatFlixboroughinl974, which 
killed 28 people. Offshore in the British sector of the North 
Sea, the Piper Alpha disaster resulted in 167 deaths. The 
comparative incidence of fatalities in some leading indus¬ 
trial countries, mainly in 1983, is given inTable 2.7. 


2.4 Major Disasters 

It is appropriate at this point briefly to consider major dis¬ 
asters. A list of the worst disasters in certain principal 
categories, both for the world as a whole and for the United 
Kingdom, is given inTable 2.8. 

Those that are of primary concern in the present context 
are fire, explosion and toxic release. Both of the worst fires 
listed occurred in theatres. The explosion at Halifax which 
killed 1963 people was that of a ship carrying explosives. 
The Chilwell explosion, in which 134 people died, was in an 
explosives factory. The toxic gas release at Bhopal, where 
the death toll was some 2500, was an escape of methyliso- 
cyanate from a storage tank. 

There are available a number of accounts of disasters, 
both natural and man-made, and these are summarized in 
Table 2.9. Disasters (Walker, 1973), DarkestHours (Q.R. Nash, 
1976), Man-Made Disasters (B. A. Turner, 1978), The Disaster 
File: The 1970s (Ferrara, 1979), Disasters (Whittow, 1980) 
and Catastrophes and Disasters (R. Smith, 1992) all contain 
large numbers of disaster case histories, including those 


Table 2.4 Fatal and major incidents in chemical and petroleum factories in the UK 1981-85 (Cox, Lees and Ang, 
1990) (Courtesy of Institution of Chemical Engineers) 


A Period 1981 85: number of fatal (F) and major (M) injuries 

1981 

1982 

1983 

1984 

1985 

Total 

F 

M 

F 

M 

F 

M 

F M 

F 

M 

F 

M 

Chemicals 8 

321 

6 

344 

10 

374 

5 370 

5 

390 

34 

1799 

Mineral oil processing 3 

28 

3 

36 

1 

29 

1 24 

1 

24 

9 

141 

Total 11 

349 

9 

380 

11 

403 

6 394 

6 

414 

43 

1940 


B Period 1981—85: incidence rates of fatal and major injuries 


Incidence per Iff employees 



1981 

1982 

1983 

1984 

1985 

Chemicals 

89.4 

100.3 

115.2 

112.7 

117.2 

Mineral oil processing 

108.4 

154.2 

136.4 

130.2 

139.7 

C 1984 

Industry 

No. of employees 

Fatalities 

Major injuries 

Fatal and major injuries per Iff 

Chemicals 

360,000 

5 

349 

98.4 


Other chemical processes 

38,200 

1 

38 

102.1 


Mineral oil processing 

18,200 

1 

14 

82.4 



Sources: Health and Safety Executive (1986c); HM Chief Inspector of Factories (1986a). 
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from the process industries. Rail incidents in the British 
Isles are described in Red for Danger (Rolt, 1982) and inci¬ 
dents in the process industries are described in Chemical 
Industry Hazards (V.C. Marshall, 1987). 

2.5 Major Process Hazards 

The major hazards with which the chemical industry is 
concerned are fire, explosion and toxic release. Of these 
three, fire is the most common but, as shown later, explosion 
is particularly significant in terms of fatalities and loss. 
As already mentioned, in the United Kingdom, the explo¬ 
sion at Flixborough killed 28 people, while offshore 167 
men died in the explosion and fire on the Piper Alpha oil 
platform. Toxic release has perhaps the greatest potential to 
kill a large number of people. Large toxic releases are 
very rare but, as Bhopal indicates, the death toll can be very 
high.There have been no major toxic release disasters in the 
United Kingdom. 

The problem of avoiding major hazards is essentially that 
of avoiding loss of containment. This includes not only pre¬ 
venting an escape of materials from leaks, etc., but also 
avoidance of an explosion inside the plant vessels and pipe¬ 
work. Some factors that determine the scale of thehazard are: 


(1) the inventory; 

(2) the energy factor; 

(3) the time factor; 


Table 2.5 Fatal and major injuries in the oil and chemical 
industries in the UK 1981-85 (after HSE, 1992b) 


Industry 

Type of incident 


Fatal Non-fatal 
major 

Over 

3 days 

All reportable 

Mineral oil 

0 33 

147 

180 

processing 

Chemicals 

5 503 

3427 

3935 


(4) the intensity-distance relations; 

(5) the exposure factor and 

(6) the intensity-damage and intensity-injury relation¬ 
ships. 


These factors are described below. 

2.5.1 The inventory 

The most fundamental factor that determines the scale of the 
hazard is the inventory of the hazardous material. The larger 
the inventory of material, the greater the potential loss. 
As plants have grown in size and output, so inventory in 
process and in storage has grown. In the early days of this 
growth, there was perhaps insufficient appreciation of 
the increase in the magnitude of the hazard. There is now, 
however, much wider recognition of the importance of 
inventory. At the same time, it is important to emphasize 
that inventory is not the only factor which determines the 
scale of the hazard. 

2.5.2 The energy factor 

For an inventory of hazardous material to explode inside the 
plant or to disperse in the form of a flammable or toxic 
vapour cloud, there must be energy. In most cases this 
energy is stored in the material itself as the energy either of 
chemical reaction or of material state. 

In particular, a material which is held as a liquid above its 
normal boiling point at high pressure and temperature, in 
other words superheated, contains large quantities of 
physical energy, which cause a large proportion of it to 
vaporize by instantaneous flash-off and to disperse if 
there is loss of containment. On the other hand, a material 
that is held as a refrigerated liquid at atmospheric pres¬ 
sure contains much less physical energy and does not 
vaporize to anything like the same extent if containment is 
lost. In this case, the energy necessary for vaporization 
has to be supplied by the ground and the air, which is a 
relatively slow process. Similarly, the hazard presented by 
an ultratoxic material depends very largely on whether 
there is energy available for its dispersion. There is a 


Table 2.6 Annual risk and fatal accident rate (FAR) in different industries and jobs in the UK 


Industry or activity 

1974-78 

1987-90 


Annual rishf ,b 

FAR e - d 

Annual risff^ 0 

FAR h 

Deep sea fishing 

280 

140 

84 

42 

Offshore oil and gas 

165 

82 

125 

62 

Coal mining 

21 

10.5 

14.5 

7.3 

Railways 

18 

9 

9.6 

4.8 

Construction 

15 

7.5 

10 

5 

Agriculture 

11 

5.5 

7.4 

3.7 

Chemical and allied industries 

8.5 

4.3 

2.4 

1.2 

Premises covered by Factories Act 

_ 

_ 

8 e 

4 

All manufacturing industry 

- 


2.3 f 

1.2 

Vehicle manufacture 

1.5 

0.75 

1.2 

0.6 

Clothing manufacture 

0.5 

0.25 

0.09 

0.05 


a Annual risk is given as probability of death in 10 5 years. 
b Health and Safety Executive, quoted in the Royal Society (1992). 
c Fatal accident rate is defined as probability of death in 10 8 h of exposure. 

d Some values from Kletz (1992b), evidently obtained from annual risk; remainder obtained in like manner by author. 
e British Medical Association (1987). 
f HSE (1988c). 
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Table 2.7 Fatal incidents in manufacturing industry in 
different countries 



Fatality rate 

Deaths per 1000 
man-years h,c 

Deaths per 100,000 
workers per year A 

Argentina 

0.020 


Austria 

0.142 


Belgium 

0.140(1979) 


Canada 

0.080 

14(1971-74) 

Czechoslovakia 

0.061 


Eire 


9(1971-75) 

France 

0.068(1982) 

11 (1971-74) 

Germany (FRG) 

0.120 (1982) 

17(1971-75) 

Germany (GDR) 

0.030 


Italy 


8(1971-73) 

Japan 

0.010 

5 (1971-75) 

The Netherlands 

0.009 

4(1971-73) 

Norway 

0.050 


Poland 

0.066(1984) 


Spain 

0.109 


Switzerland 

0.080 


UK 

0.020 

4(1971-75) 

USA 

0.022 

7 (1971-74) 


a The basis of the calculation differs somewhat between countries and 
the original references should be consulted for further details. 
b International Labour Office (1985b). 
c For 1983 unless otherwise stated. 

d HSE (1977d). Described in Chemical Industry Hazards (VC. Marshall, 
1987). 

hazard, for example, if an ultratoxic substance is produced 
as a by-product in a chemical reactor in which a runaway 
exothermic reaction may occur. But if there is no such 
source of energy, the hazard is much less. 

The energy requirement is thus another fundamental 
feature. Unless it is taken into account in the calculation, the 
scenarios considered may be not merely unlikely, but 
literally physically impossible. 

2.5.3 The time factor 

Another fundamental factor is the development of the 
hazard in time. The time factor affects both the rate of 
release and the warning time. 

The nature and scale of the hazard is often determined by 
the rate of release rather than by the inventory. Thus, it is 
the rate of release which determines the size of a flammable 
gas cloud formed from a jet of flashing hydrocarbon liquid, 
such as occurred at Flixborough. Similarly, the hazard pre¬ 
sented by an escape of toxic gas depends on the rate of 
release. There is a considerable difference in the concentra¬ 
tions attained between an instantaneous and a continuous 
release of toxic gas. 

The warning time available to take emergency counter¬ 
measures and reduce the number of people exposed is also 
very important. An explosion gives a warning time that is 
usually measured only in seconds and may be zero, whereas 
a toxic release gives a warning that is often measured in 
minutes. 

2.5.4 The intensity-distance relationship 

An important characteristic of the hazard is the distance 
over which it may cause injury and/or damage. In general, 


fire has the shortest potential range, then explosion and 
then toxic release, but this statement needs considerable 
qualification. The range of a fireball is appreciable and the 
range of a fire or explosion from a vapour cloud is much 
extended if the cloud drifts away from its source. 

It is possible to derive from the simpler physical models 
for different hazards analytical expressions that give the 
variation of the intensity of the physical effect (thermal 
radiation, overpressure, toxic concentration) with distance. 
For some models the variation follows approximately the 
inverse square law. This aspect is discussed in Chapter 9. 

With regard to the exposure of the public to process 
hazards, it is of interest to know the distance at which 
there might be a significant number of fatalities or injuries 
and the maximum distance at which any fatality or 
injury might occur. Estimates of the distance necessary to 
reduce the risk of fire and explosion to members of the public 
to a level that is assumed to be not unacceptable, based on 
criteria such as thermal radiation from fire and over¬ 
pressure from explosion, are generally of the order of 250- 
500 m for a major plant handling hydrocarbons, but may be 
less or more. Estimates of the distance necessary to reduce 
the risk from toxic release tend to be somewhat greater. 

The maximum distance at which there might conceivably 
be fatalities or injuries cannot be determined with any great 
accuracy. The explosion effect that can occur at the greatest 
distance is the shattering of glass - this has happened at 
distances of up to 20 miles from a very large explosion. But 
in such cases the energy of the glass fragments is low and 
very rarely causes injury. Similarly, cases of injury from 
toxic gas at large distances, say over 10 miles, are rare but 
are reported to have occurred. 

The effects of fire, explosion and toxic release are dis¬ 
cussed further in Chapters 16-18. Although a potential 
effect of a hazard is often expressed as a function of dis¬ 
tance, it is the area covered by the effect that determines the 
number of people at risk. 

2.5.5 The exposure factor 

A factor that can greatly mitigate the potential effects of 
an incident is the reduction of exposure of the people who 
are in the affected area. This reduction of exposure may 
be due to features that apply before the hazard develops, or 
to emergency measures that are taken after the hazard 
is recognized. 

The principal mitigating features are shelter and escape. 
Escape may be by personal initiative or by preplanned 
evacuation. It should not be assumed that emergency meas¬ 
ures are synonymous with evacuation. A combination of 
evacuation, shelter-in-place as well as other measures may 
be taken based on the event as well as preplanning evalua¬ 
tions. For releases of flammable substances, evacuation of 
non-emergency personnel is always beneficial and leads to 
reduction of casualties. On the other hand, for toxic releases, 
the emergency instructions may be to evacuate the area but 
are more likely to be to stay indoors and seal the house. 
Emergency measures may be of great value in reducing the 
toll of casualties from a major incident. 

For an explosion that gives no advance warning, there is 
no time for emergency measures such as evacuation. This 
does not mean, however, that evacuation has no role to play 
as far as fire and explosion are concerned. On the contrary, 
although the initial event may be sudden, there are fre¬ 
quently further fire and explosion hazards. Evacuation may 
then be applicable. 
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Table 2.8 Some of the worst non-industrial and industrial disasters worldwide and in the UK (Material from Guinness 
Book of Records, copyright © reproduced by permission of the publishers) 

Event 


Date 


A Worst world disasters 

Earthquake 

Near East and East Mediterranean 

1201 

1,100,000 

Volcanic eruption 

Tambora Sumbawa, Indonesia 

1815 

92,000 

Landslide 

Kansu Province, China 

1920 

180,000 

Avalanche 

Yungay, Juascaran, Peru 

1970 

«18,000 

Circular storm 

Ganges Delta Islands, Bangladesh 

1970 

1,000,000 

Tornado 

Shaturia, Bangladesh 

1989 

sal,300 

Flood 

Hwang-Ho river, China 

1887 

900,000 

Lightning 

Hut in Chinamasa Krael nr Umtali, Zimbabwe (single bolt) 

1975 

21 


London fog, UK (excess deaths) 

1951 

2,850 

Panic 

Chungking (Zhong qing), air raid shelter, China 

1941 

»4,000 

Dam burst 

Manchu River Dam, Morvi, Gujarat, India 

1979 

«5,000 

Fire (single building) 

The Theatre, Canton, China 

1845 

1,670 

Explosion 

Halifax, Nova Scotia, Canada 

1917 

1,963 

Mining 

Hankeiko Colliery, China (coal dust explosion) 

1942 

1,572 

Industrial 

Union Carbide methylisocyanate plant, Bhopal, India 

1984 

~2,500 

Offshore platform 

Piper Alpha, North Sea 

1988 

167 

Nuclear reactor 

Chernobyl Reactor No. 4 

1986 

31 a 

Aircraft 

KLM-Pan Am, Boeing 747 crash, Tenerife 

1977 

583 

Marine (single ship) 

Wilhelm Gustloff, German liner torpedoed off 

Danzig by Soviet submarine S-13 

1945 

~7,700 

Rail 

Bagmati River, Bihar, India 

1981 

>800 

Road 

Petrol tanker explosion inside SalangTunnel, Afghanistan 

1982 

asl.100 

Atomic bomb 

Hiroshima, Japan 

1945 

141,000 

Conventional bombing 

Tokyo, Japan 

1945 

^140,000 

B UK 

Earthquake 

London earthquake, Christ’s Hospital, Newgate 

1580 

2 

Landslide 

Pantglas coal tip No. 7, Aberfan, Mid-Glamorgan 

1966 

144 

Avalanche 

Lewes, East Sussex 

1836 

8 

Circular storm 

‘The Channel Storm’ 

1703 

<8,000 

Tornado 

Tay Bridge collapsed under impact of two tornadic vortices 

1879 

75 

Flood 

Severn Estuary 

1606 

<2,000 

Smog 

London fog (excess deaths) 

1951 

2,850 

Panic 

Victoria Hall, Sunderland 

1883 

183 

Dam burst 

Bradfield Reservoir, Dale Dyke, near Sheffield 
(embankment burst) 

1864 

250 

Fire (single building) 

Theatre Royal, Exeter 

1887 

188 

Explosion 

Chilwell, Nottinghamshire (explosives factory) 

1918 

134 

Mining 

Universal Colliery, Senghenydd, Mid-Glamorgan 

1913 

439 

Offshore platform 

Piper Alpha, North Sea 

1988 

167 

Nuclear reactor 

Windscale (now Sellafield), Cumbria (cancer deaths) 

1957 

b 

Marine (single ship) 

HMS Royal George, off Spithead 

1782 

«800 

Rail 

Triple collision, Quintinshill, Dumfries 

1915 

227 

Road 

Coach crash, River Dibb, near Grassington, 

North Yorkshire 

1975 

33 

Conventional bombing 

London, 10-1 May 

1941 

1,436 


a The Guinness Book of Records states: ‘Thirty one was the official Soviet total of immediate deaths. On 25 April 1991 Vlad imir Shovkoshitny 
stated in the Ukrainian Parliament that 7000 “clean-up” workers had already died from radiation. The estimate for the eventual death toll has 
been put as high as 75,000 by Dr Robert Gale, a US bone transplant specialist’. 

b The Guinness Book of Records states: ‘There were no deaths as a direct result of the fire, but the number of cancer deaths which might be 
attributed to it was estimated by the National Radiological Protection Board in 1989 to be 100’. 


Measures that can be taken to mitigate exposure are 
discussed in Chapter 24. 

2.5.6 The intensity-damage and intensity-injury 
relationships 

The range of the hazard depends also on the relationships 
between the intensity of the physical effect and the 


proportion of people who suffer injury at that level of the 
effect. The annular zone within which injury occurs is 
determined by the spread of the injury distribution. If the 
spread is small, the injury zone will be relatively narrow, 
while if it is large, the zone may extend much further out. 
Similar considerations apply to damage. This aspect is 
discussed further in Chapter 9. 
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Table 2.9 Coverage of some books on disasters 

Bignell, Peters 

Ferrara 

R. Smith 

Thygerson 

Walker 

Whittoui 

and Pym (1977) 

(1979) 

(1993) 

(1977) 

(1973) 

(1980) 

Natural hazards 

Subterranean stress: 

Earthquakes 

X 

X 

X 

X 

X 

Volcanoes 

X 

X 

X 


X 

Tsunamis 


X 

X 


X 

Surface instability: 

Landslides and avalanches X 


X 

X 

X 

X 

Ground surface collapse 





X 

Weather: 

Wind, storm 

X 

X 



X 

Tornadoes 

X 

X 



X 

Hurricanes 


X 

X 


X 

Floods (river, sea) 

X 

X 

X 

X 

X 

Fires (forest, grass) 

X 

X 

X 



Man-made hazards 

Structures: 

Buildings X 


X 


X 




X 


X 


Bridges X 

Building fires X 

X 

X 

X 

X 

X 

Gas explosions 

Industrial: 

X 

X 


X 


Mines 

X 

X 


X 


Fire 

X 

X 


X 


Explosion 

X 

X 


X 


Transport: 

Air X 

X 

X 


X 


Rail X 

X 

X 


X 


Road 

X 

X 

X 

X 


Sea X 

X 

X 


X 



2.6 Fire Loss Statistics 

The loss statistics of interest are primarily those for fire 
loss. In the United Kingdom, principal sources of statistics 
on such losses are the Home Office, the FPA, the Loss Pre¬ 
vention Council and theinsurancecompanies.Theseorgani- 
zations produce annual statistics for fire losses. Loss due to 
explosions is generally included in that for fire loss. There 
are no regular loss statistics on toxic release, since this is a 
rare event and usually causes minimal damage to property. 

Fire loss data are given in Fire Statistics United Kingdom 
1990 (Home Office, 1992), in FPA Large Fire Analysis 
for 1989 (FPA, 1991) and in Insurance Statistics 1987-91 
(Association of British Insurers (ABI), 1992). 

The Home Office data show that in 1990 fire brigades 
were called to some 467,000 fires, of which 108,000 were in 
buildings. The FPA defines a large loss fire as one involving 
a loss of £50,000 or more. In 1990 there were 739 such fires, 
with a total cost of £282 million and an average cost of £0.382 
million. In the chemical and allied industries, in 1990, there 
were eight large loss fires, with a total cost of £5.24 million 
and an average cost of £0.656 million. There were no large 
loss fires in the coal and petroleum industries class. 

A more detailed analysis of fires in the chemical and 
petroleum industries given by the FPA in 1974 is shown in 
Tables 2.10 and 2.11, the former giving analysis by number 
and cost and the latter by number and occupancy, by place of 
origin, by ignition source, by material first ignited and by 


time of day. There are a number of significant points in the 
tables. The chemical industry had the largest number of 
fires, but the oil industry the most expensive. The origin of 
the fires is predominantly in storage and in leakages. The 
sources of ignition are fairly evenly spread. There is only one 
fire attributed to static electricity and two to arson. But in 3 5 
cases, that is, 44%, the ignition source was unknown. The 
material phase first ignited also shows a balanced spread, 
with the solid phase actually being predominant. There is no 
marked trend in the time of day of the fires, although the 
number is somewhat higher during the day shift. 

Further analyses of fire statistics have been given by 
H.D. Taylor and Redpath (1971), the FPA (1976) and 
Redpath (1976). In particular, these sources present additional 
data of the type given in Tables 2.10 and 2.11. These data are a 
usefulgeneralpointer.Theyconstitute,however,arathersmall 
sample. Moreover, they are not necessarily representative of 
the type of fire or explosion that constitutes a major disaster. 

Work on the occurrence of fires in industrial buildings 
has been described by Rutstein and Clarke (1979) and 
Rutstein (1979b). The probability of fire was found to 
increase with the size of building according to the equation: 

P = aBI [2.6.1] 

where B is the f loorspace (m z ) and P is the probability of fire 
per year, and a and c are constants. For production buildings 
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inmanufacturingindustrygenerally(SICClasses3-19),the 
values of the constants a and c were 0.0 017 and 0.53, and in the 
chemical and allied industries (SIC 4), they were 0.0069 and 
0.60, respectively. (These SIC numbers refer to the Standard 
Industrial Classification at the time.) The probability of fire 


Table 2.10 Large fires in the chemical and petroleum 
industries in Great Britain, 1963- 75: number and cost 
(FPA, 1974; Redpath, 1976) 


Year 

No. of fires 

Cost (£m.) 

1963 

44 

2.3 

1964 

43 

2.9 

1965 

40 

3.0 

1966 

43 

2.5 

1967 

51 

4.4 

1968 

53 

3.1 

1969 

44 

3.2 

1970 

67 

6.2 

1971 

65 

6.2 

1972 

66 

3.5 

1973 

80 

12 

1974 

45 

43 

1975 

46 

6.6 


a The chemical and petroleum industries are taken as Standard 
Industrial Classification Order 4 (Coal and petroleum products) and 
5 (Chemical and allied industries). 


in a 1500 m 2 production building was thus 0.083 for manu¬ 
facturing industry and 0.21 for the chemical industry. 

An analysis of some 2000 large loss claims at Cigna 
Insurance has been given by Instone (1989) and is 
summarized inTable 2.12. 

A study of the contribution of human factors to failures of 
pipework and in-line equipment by Bellamy, Geyer and 
Astley (1989) contains a large amount of information char¬ 
acterizing releases, as shown in Table 2.13. As with fatal 
injuries so with fire losses, a single incident may dominate 
the process industries’ loss for a particular year. In the 
United, the Flixborough disaster constituted a significant 
proportion of the fire loss in 1974, whilst the Piper Alpha 
disaster dominated that for 1988. Fire losses are considered 
further in Chapter 5. 


2.7 Fire and Explosion 

So far no distinction has been made between fire and 
explosion losses. The latter are normally included in the 
overall fire statistics. In fact it is explosions that cause the 
most serious losses. This is illustrated by Table 2.14, which 
shows losses in the chemical industry insured by the 
Factory Insurance Association (FIA) of the United States 
(W.H. Doyle, 1969). Some two-thirds of the loss is attribut¬ 
able to explosions. The nature of these explosions is shown 
inTable 2.15. Over three-quarters of the explosions involve 
combustion or explosive materials. 


Table 2.11 Large fires in the chemical and petroleum industries in Great Britain, 1971-73 (Fire Protection Association, 
1974b) 


A Number and cost by occupancy 


Occupancy 

£10,000- 

£39,000 

£40,000- 

£99,000 

No. of fires 
£100,000- 
£249,000 

>£250,000 

Total 

Total cost 
(fin.) 

Average cost 
(fin.) 

Chemicals 

1 

12 

13 

7 

33 

7.215 

0.219 

Oil and tar 

0 

1 

2 

6 

9 

6.225 

0.692 

Paint and varnish 

1 

2 

2 

1 

6 

0.738 

0.123 

Fertilizer 

1 

1 

2 

1 

5 

0.625 

0.125 

Agricultural products 

0 

0 

3 

0 

3 

0.525 

0.175 

Plastics 

1 

1 

0 

0 

2 

0.051 

0.025 

Others 

2 

7 

1 

1 

11 

0.823 

0.075 

Total 

6 

24 

23 

16 

69 

16.202 

0.235 


B Place of origin 


No. of fires 


Storage: 

Warehouse or open site 21 

Ta nk 12 

Leakage: 

From fractured pipe 15 

From leaking coupling, flange or seal 6 

From electrical equipment 6 

Unspecified 2 

Reactor or mixer 4 

Steam drier 2 

Spray booth 1 

Cooling tower 1 

Unreported 9 

Total 79 
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Table 2.11 (continued) 

C Ignition source 

No. of fires 

Hot surfaces 



8 

Burner flames 



8 

Electrical equipment 



6 

Spontaneous ignition 



6 

Friction heat and sparks 



6 

Flame cutting 



4 

Children with matches 



3 

Malicious ignition 



2 

Static electricity 



1 

Unknown 



35 

Total 



79 

D Material first ignited 

No. of fires 

Classification by phase 




Gas 



10 

Vapour 



16 

Liquid 



20 

Solid 



23 

Unknown 



10 

Total 



79 

Classification by material 




Hydrocarbons: 




Gas 



3 

Liquid/vapour 



18 

Solid 



2 

Other organics, etc.: 




Liquid/vapour 



16 

Solid 



7 

Cellulosic solids 



6 

(timber, paper, cardboard, fireboard) 



Hydrogen 



7 

Steel 



2 

Sulfur 



1 

Unknown 



17 

Total 



79 

E Time of day 

Time of day 

No. of fires 

Time of day 

No. of fires 

24.00-1.00 h 

4 

12.00-13.00 h 

1 

(midnight) 




1.00-2.00 

0 

13.00-14.00 

3 

2.00-3.00 

4 

14.00-15.00 

2 

3.00-4.00 

2 

15.00-16.00 

5 

4.00-5.00 

3 

16.00-17.00 

3 

5.00-6.00 

2 

17.00-18.00 

6 

6.00-7.00 

1 

18.00-19.00 

5 

7.00-8.00 

4 

19.00-20.00 

2 

8.00-9.00 

3 

20.00-21.00 

5 

9.00-10.00 

3 

21.00-22.00 

3 

10.00-11.00 

3 

22.00-23.00 

0 

1.00-12.00 

3 

23.00-24.00 

2 



(midnight) 
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Table 2.12 Large losses in the process industries insured 


by Cigna Insurance (after Instone, 1989) (Courtesy of 
Cigna Insurance) 

Proportion (%) 


A Operations type 

Refinery complex 48 

Petrochemicals 20 

General properties 10 

Storage terminals 8 

Onshore production plants 7 

Jetty installations 3 

Offshore production plant 2 

Coal mines 2 

Total 100 

B Plant type 

Storage tanks and pipelines 23 

Refineries 22 

Oil/gas production 13 

Off-sites 10 

Monomers and polymers 6 

Petrochemicals 6 

Fertilizers 5 

Coal products 3 

Gas processing 3 

Refinery feedstock and 3 

products 

Acids, glycols, etc. 3 

Aromatics 2 

Alcohols, ketones, etc. 1 

Paraffins 0 

Total 100 

C Process unit type 

Furnace or heater 10 

Pipework 9 

Storage tank - unspecified 7 

Drilling rig 5 

Pump 5 

Compressor 5 

Boiler 5 

Heat exchanger 4 

Cone roof tank 4 

Distillation column 3 

Warehouse 3 

Process vessel 3 

Floating roof tank 3 

Electrical substation 3 

Reactor 3 

Reformer 2 

Conveyor belt 2 

Riser pipe 2 

Jetty or buoy 2 

Gas turbine generator <2 

Control room <2 

Hopper <2 

Transformer <2 


Flare; furnace stack; relief system (2); air cooler; centrifuge; 
filter; extruder; drier; refrigeration circuit; cooling tower; 
incinerator; electric motor; meters; instrument analyser; 
valve; crane; American Petroleum Institute (API) separator 
(2); hydrogen; loading arm - vessels; loading arm - road 
vehicles; road tanker; hose; laboratory; 
office; computer <1 


D Plant status 

Normal operations 50 

Plant start-up 15 

Plant under maintenance 10 

Filling tanks or vessels 6 

Well drilling 5 

Plant in shut- down state 3 

Process upset 2 

Emptying tanks or vessels 2 

Construction <2 

Well workover <2 

Plant shutting down <1 

Ship berthing/sailing <1 

Plant commissioning <1 

Blending operation <1 

Well logging <1 

E Loss type 

Fire 33 

Explosion 12 

Explosion and fire 10 

Wind, storm and flood 10 

Well blowout 5 

Mechanical 5 

Ship impact 5 

Contamination 4 

Machinery breakdown 4 

Product loss 3 

Electric cable fire 3 

Construction defect; collapse; subsidence/collapse; 
earthquake; impact; implosion; floating roof sunk; pool 
fire; vapour fire; vapour cloud explosion; 
theft <1 

F Cause of loss 

Operator error 17 

Wind, storm and flood 16 

Pipe/weld failure 7 

Thbe failure 7 

Machinery breakdown 7 

Electrical short-circuit 4 

Valve leak 4 

Pipe flange leak 4 

Instrumentation failure 4 

Vehicle/digger impact 3 

Corrosion 3 

Seal failure 3 

Lightning <2 

Anchor/hull damage to jetty <2 

Power failure <2 

Storage tank overflow <2 

Tank vent blocked <2 

Pressure increase <2 

Sabotage <2 

Burst vessel <2 

Compressor leak <2 

Runaway reaction <2 

Lost well circulation fluid <2 


Modification/design error; erosion; feedstock; 
process vessel overflow; flare carryover; water 
hammer; insufficient air purge; lubrication 
failure; instrument air failure; pyrophoric iron 
sulfide; gauge broken open; corroded electrical 
contacts; flame impingement; fire water leak; 
malicious damage <1 
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G Material ignited 

Refinery feedstock and products 41 

Petrochemicals 31 

Gas processing 13 

Acids, glycols, additives 6 

Monomers and polymers 3 

Alcohols, ketones, ethers; aromatics; <1 

paraffins; fertilisers; coal products 

H Source of ignition 

Material not ignited 35 

Furnace 12 

Hot surface 12 

Autoignition 7 

Electrical arcing 3 

Operator error3 

Other electrical apparatus 3 

Welding 3 

Friction <3 

Static electricity <3 

Pyrophoric matter; spontaneous combustion; matches; 
spark; electric motor; boiler; flare; explosive device; 
vehicle; lightning; spread of fire; hot 
embers <2 


Table 2.13 Characteristics of releases in study of failure 
of pipework and in-line equipment (Bellamy, Geyer and 
Astley, 1989) (Courtesy of the Health and Safety 
Executive) 


No. of incidents 


A Location type 

Chemical plant 278 

Refinery 96 

Factory 187 

Storage depot 47 

Tank yard 28 

Fuel station 15 

Other 38 

Unknown 232 

Total 921 

B Site status 

Normal operations 343 

Storage 103 

Loading/unloading 33 

Maintenance 146 

Modification 8 

Contractor work 18 

Testing 5 

Unknown 128 

Other 40 

Start-up 42 

Shut-down 18 

Total 884 

C Materials released 

Ammonia 54 

Hydrocarbons (unspecified) 54 

Chlorine 50 

Hydrogen 37 

Benzene 33 

Crude oil 28 


Steam 25 

Natural gas 24 

Propane 20 

Butane 18 

Fueloil 18 

Hydrochloric acid 16 

Sulfuric acid 16 

Ethylene 16 

Hydrogen sulfide 14 

Water 13 

Nitrogen 13 

Oxygen 13 

Vinyl chloride 12 

LPG 12 

Styrene 11 

Naphtha petroleum 10 

Total 507 

D Material phase 

Liquid 393 

Gas 260 

Vapour 13 

Solid 9 

Liquid gas/vapour 120 

Solid gas/vapour 3 

Total 798 

E Unignited material dispersion 
Flammable 127 

Toxicl 23 

Flammable/toxic 47 

Corrosive 97 

Irritant 1 

Unignited gas 96 

Vapour cloud 180 

Liquid 212 

Spill 186 

Jet/spurt 8 

Spray 10 

Total 1087 

F Fire or explosion event 
Firel 45 

Flash fire 11 

Pool fire 4 

Jet fire 1 

Fireball 7 

BLEVE 4 

Explosion 63 

Explosion followed by fire 77 

Explosion followed by flash fire 2 

Total 314 


Note: BLEVE, boiling liquid expanding vapour explosion. 


Further analyses of fires and explosions, treated sepa¬ 
rately, have been made by Norstrom (1982a), as shown in 
Tables 2.16 and 2.17. 

The problem of large fires or explosions in vapour clouds 
is considered in Chapter 17. The data given in Table 17.33 
by VC. Marshall (1976a), in which the incidents are 
ranked in terms of the amount of vapour released, suggest 
that the large releases often result in explosions rather 
than fires. 
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Table 2.14 Large losses in the chemical industry insured by the Factory Insurance Association: fire, explosion and 
other loss (after W.H. Doyle, 1969) (Courtesy of the American Institute of Chemical Engineers) 

Year 


Fires 


Explosions 


Other 


Total 

No. 

Loss(%) 

No. 

Loss(%) 

No. 

Loss(%) 

No. 

Loss{%) 

1964 

3 

1.6 

6 

13.4 

1 

0.4 

10 

15.4 

1965 

4 

1.9 

8 

8.7 

0 

0 

12 

10.6 

1966 

7 

9.2 

6 

9.9 

1 

0.6 

14 

19.7 

1967 

8 

5.9 

12 

22.4 

2 

1.1 

22 

29.4 

1968 

13 

11.6 

12 

13.3 

0 

0 

25 

24.9 

Total 

35 

30.2 

44 

67.7 

4 

2.1 

83 

100.0 


Table 2.15 Large losses in the chemical industry insured 
by the Factory Insurance Association: types of explosion 
(W.H. Doyle, 1969) (Courtesy of the American Institute of 
Chemical Engineers) 



No. 

Loss(%) 

Combustion: 

In equipment 

13 

10.5 

Outside equipment, in building 

8 

24.4 

In open 

1 

3.3 

Subtotal 

22 

38.2 

Reaction: 

Explosive liquid or solid 

12 

16.8 

Runaway reaction 

4 

6.5 

Subtotal 

16 

23.3 

Metal failure: 

Corrosion 

1 

1.4 

Overheating 

3 

4.1 

Accidental overpressure 

2 

1.0 

Subtotal 

6 

6.5 

Total 

44 

68.0 


2.8 Causes of Loss 

There are almost as many analyses of the causes of loss as 
there are investigators. Unfortunately, there is no accepted 
taxonomy, so that it is often difficult to reconcile different 
analyses. Two typical breakdowns of the causes of loss are 
given in Table 2.18 (WH. Doyle, 1969) and in Table 2.19 
(American Insurance Association (AIA), 1979), the latter 
being an up-date of an earlier table (Spiegelman, 1969). 
Doyle emphasizes the importance of poor maintenance, 
followed by poor design and layout of equipment and 
inadequate knowledge of the properties of chemicals. 
Spiegelman (1969) gives, in addition to the table referred to, 
a fairly detailed breakdown of the factors considered under 
each heading. His category of equipment failures evidently 
has a large element of poor maintenance. 

Further information on causes of loss is provided by the 
data of Norstrom (1982a) given in Tables 2.16 and 2.17. 


2.9 Down-time Losses 

The losses considered so far are insured losses arising from 
fire and explosion. Another important, but often uninsured, 


Table 2.16 Large fires in the chemical and allied 
industries insured by Industrial Risk Insurers (Norstrom, 
1982a) (Courtesy of the American Institute of Chemical 
Engineers) 



Proportion (%) 

A Cause 

Flammable liquid or gas 
(release, overflow) 

17.8 

Overheating, hot surfaces, etc. 

15.6 

Pipe or fitting failure 

11.1 

Electrical breakdown 

11.1 

Cutting and welding 

11.1 

Arson 

4.4 

Others 

28.7 

B Location 

Enclosed processor 
manufacturing buildings 

42.2 

Outdoor structures 

33.3 

Warehouses 

6.7 

Others 

17.8 

C Occupancy 

Mixing / blending 

8.9 

Storage 

8.9 

Distillation 

6.7 

Control/computer rooms 

6.7 

Chemical reaction, batch 

4.4 

Chemical reaction, continuous 

4.4 

Heating 

4.4 

Drying 

4.4 

Others 

51.2 

D Contributing factors 

Sprinkler or water spray lacking 

35.6 

Human element 

15.6 

Presence of flammable liquids 

11.1 

Rupture of vessel or equipment 

8.9 

Excessive residue 

8.9 

Production bottleneck 

6.7 

Sprinkler or water spray 
inadequate or impaired 

6.7 

E Area protection 

Protected building or structure 

26.7 

Unprotected building or structure 

62.2 

Outside building or structure 

11.1 
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Table 2.17 Large explosions in the chemical and allied 
industries insured by Industrial Risk insurers (Norstrom, 
1982a) (Courtesy of the American Institute of Chemical 
Engineers) 


Proportion (%) 

A Cause 


Chemical reaction uncontrolled 

20.0 

Chemical reaction accidental 

15.0 

Combustion explosion in equipment 

13.3 

Unconfined vapour cloud 

10.0 

Overpressure 

8.3 

Decomposition 

5.0 

Combustion sparks 

5.0 

Pressure vessel failure 

3.3 

Improper operation 

3.3 

Others 

16.8 

B Location 


Enclosed process or manufacturing 

46.7 

buildings 


Outdoor structures 

31.7 

Yard 

6.7 

Tank farm 

3.3 

Boiler house 

3.3 

Others 

8.3 

C Occupancy 


Chemical reaction process, batch 

26.7 

Storage tank 

10.0 

Boiler 

8.3 

Chemical reaction process, continuous 

6.7 

Compressor 

5.0 

Evaporation 

3.3 

Recovery 

3.3 

Transfer 

3.3 

Liquefaction 

3.3 

Others 

25.1 

D Contributing factors 


Rupture of equipment 

26.7 

Human element 

18.3 

Improper procedures 

18.3 

Faulty design 

11.7 

Vapour-laden atmosphere 

11.7 

Congestion 

11.7 

Flammable liquids 

8.3 

Long replacement time 

6.7 

Inadequate venting 

6.7 

Inadequate combustion controls 

5.0 

Inadequate explosion relief 

5.0 

E Area protection 


Protected building or structure 

43.3 

Unprotected building or structure 

36.7 

Outside building or structure 

20.0 


loss arises from plant shut-down and down-time. Once 
again there are many different analyses of shut-down 
and down-time, and its causes on different types of plant. 
Three sets of statistics on shut-down and down-time are 
given in Tables 2.20—2.22 for a refinery (McFatter, 1972), in 
Tables 2.23 and 2.24 for another refinery (Anon., 1970b), and 
in Tables 2.25—2.28 (G.P. Williams, Hoehing and Byington 


Table 2.18 Large losses in the chemical industry insured 
by the Factory Insurance Association: causes of loss 
(W.H. Doyle, 1969) (Courtesy of the American Institute of 
Chemical Engineers) 



No. 

Loss (%) 

Incomplete knowledge of the 

6 

11.2 

properties of a specific chemical 

Incomplete knowledge of the 

6 

3.5 

chemical system or process 

Poor design or layout of equipment 

13 

20.5 

Maintenance failure 

14 

31.0 

Operator error 

5 

6.9 

Total 

44 

73.1 


Table 2.19 Hazard factors for 465 fires and explosions 
in the chemical industry 1960- 77 (American Insurance 
Association, 1979) 


No. of times Proportion 
assigned (%) 


Equipment failure 

223 

29.2 

Operational failure 

160 

20.9 

Inadequate material evaluation 

120 

15.7 

Chemical process problems 

83 

10.9 

Material movement problems 

69 

9.0 

Ineffective loss prevention 

47 

6.2 

programme 

Plant site problems 

27 

3.5 

Inadequate plant layout 

18 

2.4 

Structures not in conformity 

17 

2.2 

with use requirements 

Total 

764 

100.0 

1987). In addition, data on down 

-time causes i 

in ammonia 


plants were given earlier in Table 1.5. 

McFatter’s data in Tables 2.20—2.22 are for a single refin¬ 
ery consisting of seven units over a 10 -year period. During 
this time, the overall availability of all the units was 9 6.4 %. 
In other words, the units were down for scheduled or 
unscheduled shut-down 3.6% of the time. But in addition 
there were some 122 failures that were significant in that 
they resulted in 1313 equivalent days of lost production, 
although they did not cause shut-down.The large number of 
unscheduled shut-downs in 1967 was due to a major hydro¬ 
carbon line leak and fire, which resulted in complete shut¬ 
down of the refinery. 

The importance of compressors, furnaces and heat 
exchangers is clear from Table 2.22. Other data given by 
McFatter show a rising trend of equivalent days lost due to 
failures. He comments that this is due to large increases in 
throughput, reduction in sparage of critical items, for 
example, compressors and pumps, and lack of opportunity 
to take items, for example, furnaces, off for maintenance. 
The data for another refinery given in Tables 2.23 and 2.24 
show an essentially similar picture; as do the data given by 
Mclntire (1977a,b). Surveys of ammonia plant shut-downs 
have been published by Sawyer, Williams and Clegg (1972), 
G.P. Williams and Sawyer (1974), G.P. Williams (1978), 
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Table 2.20 Shut-downs in a refinery a (after McFatter, 
1972) (Courtesy of the American Institute of Chemical 
Engineers) 


Year 

Scheduled 

Unscheduled 

1961 

1 

1 

1962 

4 

1 

1963 

3 

1 

1964 

3 

1 

1965 

4 

1 

1966 

1 

0 

1967 

3 

10 

1968 

2 

3 

1969 

4 

1 

1970 

2 

5 

a There are seven units 

in the refinery. 


Table 2.21 Causes of non-scheduled shut-downs in a 
refinery (after McFatter, 1972) (Courtesy of the American 

Institute of Chemical Engineers) 


% 

Line leaks and fires 


28 

Line leaks 


28 

Process 


12 

Utilities 


20 

Miscellaneous 


12 

Total 


100 

Table 2.22 Causes of significant non-shut-down failures 
in a refinery (after McFatter, 1972) (Courtesy of the 
American Institute of Chemical Engineers) 

% 

Compressors 


30 

Furnaces 


18 

Exchangers 


17 

Towers 


5 

Process 


18 

Process integration 


7 

Miscellaneous 


5 

Total 


100 


Table 2.23 Causes of down-time in a refinery (after Anon. 
1970b) 


% 

Scheduled maintenance 

71.6 

Process problems 

15.6 

Problems in other linked plants 

7.6 

Utility problems 

5.2 

Total 

100 


G.P. Williams and Hoehing (1983) and G.P. Williams, 
Hoehing and Byington (1987). The 1987 survey covers 136 
plants, divided into three groups: (1) large-tonnage, single¬ 
stream, centrifugal compressor type plants, worldwide in 


Table 2.24 Significant equipment failures in a refinery 
(after Anon., 1970b) 



No. 

All failures 

Pumps and compressors 

35 

33.9 

Furnaces 

14 

13.6 

Piping 

11 

10.7 

Towers and reactors 

9 

8.8 

Exchangers 

7 

6.8 

Utilities 

23 

22.3 

Other 

4 

3.9 

Total 

103 

100 


North America, Europe and the rest of the world; (2) small 
plants, usually with multiple parallel streams of recipro¬ 
cating compressors and (3) partial oxidation plants. The 
general nature of the shut-downs and down-time is shown 
in Table 2.25. Part of the down-time is due to non-plant 
problems (gas curtailment and market problems) and part 
is due to plant problems. 

The service factor is the availability net of non-plant 
problems. The contributions to shut-downs and down-time 
are given in Table 2.26 in terms of plant area and type of 
equipment and in Table 2.27 in terms of individual items of 
equipment. Table 2.28 gives data on fires in the plants. 


2.10 Trend of Injuries 

The long-term trend of injury rates in the process industry 
is downwards. The trend in United Kingdom may be seen in 
Table 2.6, which shows that between 1970-74 and 1987-90, 
the fatal accident rate for the chemical and allied industries 
fell from 4.3 to 1.2. However, as Table 2.4 shows, the actual 
number of fatalities in this industry is small. Consequently, 
one large incident would have a significant effect on the 
figures, even if its effect was absorbed over quite a long 
period such as 10 years. 

Evidence is available that the efforts devoted to safety 
and loss prevention by some companies have borne fruit. 
Figure 2.8 (Hawksley, 1984) shows the trend of the fatal 
accident rate in ICI over the period 1960-82. The data 
represent the 5-year moving average. They show that 
particular success was achieved in reducing the fatal inci¬ 
dents associated with the process risks, the reduction factor 
being about 15. The success achieved by certain US compa¬ 
nies in reducing the lost time injury rate (LTIR) is illustrated 
in Figure 2.9 (Brian, 1988). The LTIR is the percentage of 
workers in the organization who, in a given year, suffer an 
injury so severe that it causes the worker to lose some work 
days. In one case the reduction factor is 280. 

The trend in multiple fatality incidents has been 
studied by Keller and Wilson (1991), who obtained the 
results given in Table 2.29. The table shows a broadly stable 
situation. 


2.11 Trend of Losses 

There have been a number of studies addressing the ques¬ 
tion of whether the number of major incidents in the che¬ 
mical and oil industries is increasing. Early work on these 
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Table 2.25 Shut-down and down-time in ammonia plants (after G.P. Williams, Hoehing and Byington, 1987) 
(Courtesy of the American Institute of Chemical Engineers) 


Large tonnage plants Reciprocating Partial 



North 

America 

Europe 

Rest of 
world 

Total 

piums 

UAiuiuiun piunis 

A Down-time and availability 

Total down-time (days/plant-year) 

71.1 

48.6 

84.5 

70.1 

60.2 

71.3 

Unavoidable down-time (days/plant-year): 

Feedstock curtailment 

0.8 

0.6 

20.0 

7.6 

11.2 

0.5 

Inventory control 

45.4 

8.7 

15.2 

25.2 

20.8 

9.7 

Other 

0.9 

2.0 

4.2 

2.3 

3.4 

19.1 

Total 

47.1 

11.2 

39.4 

35.1 

35.4 

29.3 

Net avoidable (days/plant-year) 

24.1 

37.4 

45.2 

35.0 

24.7 

41.9 

Service factor (%) 

92.4 

89.4 

87.7 

89.4 

92.5 

87.5 

B Turnarounds 

Time between turnarounds (days) 

21.7 

33.2 

33.7 

30 

30.8 

21.2 

Actual frequency (months) 

24 

20.5 

13.5 

18 

17 

16 

Desired frequency (months) 

23.5 

25 

14.4 

20.6 

16 

12 

C Classification of shut-downs 

Avoidable shut-downs (shut-downs/ 
plant-year): 

Instrument failure 

1.2 

1.4 

1.9 

1.5 

0.8 

1.9 

Equipment failure 

3.2 

3.5 

5.5 

4.1 

10.7 

8.0 

Turnarounds 

0.5 

0.4 

0.7 

0.5 

0.5 

0.7 

Other 

0.7 

0.4 

1.0 

0.8 

1.1 

1.8 

Total 

5.6 

5.8 

9.1 

6.9 

13.1 

12.3 

Unavoidable shut-downs (shut-downs/ 
plant-year): 

Feedstock curtailment 

0.14 

0.08 

0.74 

0.34 

0.31 

0.41 

Inventory control 

0.34 

0.07 

0.23 

0.23 

0.29 

0.48 

Electrical failure 

0.36 

0.17 

1.37 

0.67 

2.31 

2.45 

Other 

0.27 

0.11 

0.19 

0.20 

0.46 

3.14 

Total 

1.11 

0.43 

2.53 

1.44 

3.37 

6.48 

Total shut-downs (shut-downs/plant-year) 

6.7 

6.3 

11.6 

8.3 

16.5 

18.8 

D Classification of down-time 

Avoidable shut-downs (days/plant-year): 

Instrument failure 

1.1 

1.4 


1.2 

0.4 

2.0 

Equipment failure 

11.4 

20.8 

20.3 

16.7 

9.1 

20.0 

Turnarounds 

10.5 

14.6 

20.8 

15.2 

14.0 

16.0 

Other 

1.0 

0.7 

2.9 

1.6 

1.4 

4.0 

Total 

24.1 

37.4 

45.2 

35.0 

24.7 

41.9 

Unavoidable shut-downs (days/plant-year): 

Feedstock curtailment 

0.8 

0.6 

20.0 

7.6 

11.2 

0.5 

Inventory control 

45.4 

8.7 

15.2 

25.2 

20.8 

9.7 

Electrical failure 

0.2 

0.5 

1.7 

0.8 

2.1 

3.1 

Other 

0.7 

1.4 

2.5 

1.5 

1.4 

16.0 

Total 

47.1 

11.2 

39.4 

35.1 

35.4 

29.3 

Total down-time (days/plant-year) 

71.1 

48.6 

84.5 

70.1 

60.2 

71.3 


lines was done by VC. Marshall (1975c) and Kletz and 
Turner (1979). The insurers Marsh and McLennan (M&M) 
publish periodically a list of the 100 largest losses in the 
chemical and oil industries worldwide over a running 


30-year period (e.g. Garrison, 1988b; Mahoney, 1990; Marsh 
and McLennan, 1992). The 1987 edition contains the analy¬ 
sis shown in Table 2.30. This indicates a trend that is rising 
up to 1986. 
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Table 2.26 Major equipment failures causing shut-down and down-time in ammonia plant s 3 (after G.P. Williams, 
Hoehing and Byington, 1987) (Courtesy of the American Institute of Chemical Engineers) 




Large tonnage plants 


Reciprocating 

plants 

Partial 

oxidation plants 


North 

America 

Europe 

Rest of 

Total 

A Equipment failures causing shut-downs by plant; 

Primary reforming 3.0 (0.70) 3.0 (0.52) 

4.8(0.68) 

3.7(0.65) 

1.1 (0.50) 


Secondary reforming (including 

1.3 (0.14) 

5.4(0.24) 

1.3(0.13) 

2.3(0.16) 

0.8(0.10) 

- 

waste heat boilers) 

Purification 

1.1 (0.44) 

1.9(0.39) 

1.9(0.68) 

1.6(0.51) 

1.6(0.59) 

4.3(1.74) 

Synloop 

1.3 (0.48) 

2.2(0.34) 

1.1 (0.36) 

1.5(0.40) 

0.8(0.52) 

3.7(0.60) 

Compression 

3.5 (1.20) 

3.1 (0.91) 

6.1 (2.32) 

4.3(1.52) 

1.7(7.71) 

3.3 (1.45) 

Miscellaneous 

1.3 (0.24) 

5.2(1.10) 

5.2 (1.36) 

3.7(0.86) 

3.1 (1.23) 

8.7 (4.21) 

Total 

11.4(3.21) 

20.8(3.51) 

20.3(5.53) 

17.0(4.10) 

9.1 (10.65) 

19.9(8.00) 

B Equipment failures by type of equipment 

Reformer piping 2.3 (0.48) 1.5 (0.27) 

4.1(0.45) 

2.8(0.42) 

0.8(0.32) 


Other piping 

0.6(0.22) 

2.0(0.48) 

1.1(0.43) 

1.1 (0.36) 

0.8(0.49) 

3.3(0.81) 

Valves 

0.4(0.22) 

0.2(0.33) 

0.7(0.53) 

0.4(0.36) 

0.4(0.35) 

0.9(0.57) 

Compression: 

Centrifugal 

2.6(1.02) 

2.8(0.60) 

5.1 (1.20) 

3.5 (0.98) 

0.1 (0.17) 

1.1 (0.38) 

Reciprocating 

- 

- 

- 

- 

1.7(7.65) 

1.0(0.02) 

Pumps and drives 

0.1 (0.10) 

0.4(0.10) 

0.3 (0.19) 

0.3(0.13) 

0.1 (0.10) 

0.3 (0.33) 

Exchangers 

3.3(0.66) 

5.8(0.91) 

6.1(1.17) 

4.9(0.91) 

2.9(1.13) 

4.0 (1.19) 

Vessels 

0.7(0.10) 

6.1 (0.24) 

1.3(0.13) 

2.3(0.15) 

1.7(0.23) 

5.2(2.93) 

Miscellaneous 

1.5(0.31) 

1.8(0.58) 

1.8(1.40) 

1.7(0.79) 

0.6(0.21) 

4.2(1.8) 

Total 

11.4(3.21) 

20.8(3.51) 

20.3(5.50) 

17.0(4.10) 

9.1 (10.65) 

19.9(8.00) 


a Shut-down in shut-downs/plant-year; down-time in days/plant-year, in parentheses. 


Table 2.27 Equipment and other failures in ammonia plants (Courtesy of the American Institute of Chemical Engineers f 
(after G.P. Williams, Hoehing and Byington, 1987) 


North America Europe Rest of world Total 

DT SD DT SD DT SD DT SD 


A Equipment failures 

Primary reforming: 
Tube-riser-pig 
Transfer header 
Convection section 
ID—FD fan 
Miscellaneous 
Total 

Secondary reforming: 
Primary waste heat boiler 
Secondary waste heat boiler 
Secondary reformer 
Miscellaneous 
Total 

Purification: 

Exchangers 
Pumps and drives 
Piping and valves 
Vessels 

Miscellaneous 

Total 


1.99 0.44 1.25 

0.32 0.04 0.45 

0.40 0.07 0.38 

0.18 0.12 0.75 

0.12 0.03 0.21 

3.01 0.70 3.04 


0.74 0.06 1.76 

0.35 0.06 0.41 

0.20 0.01 3.05 

0.00 0.01 0.14 

1.29 0.14 5.36 


0.41 0.18 0.28 

0.06 0.07 0.25 

0.27 0.14 0.08 

0.36 0.04 1.24 

0.01 0.01 0.05 

1.11 0.44 1.90 


0.24 2.82 0.35 

0.04 1.25 0.10 

0.05 0.12 0.03 

0.15 0.45 0.14 

0.04 0.20 0.06 

0.52 4.84 0.68 


0.12 0.17 0.01 

0.05 0.16 0.05 

0.06 0.88 0.13 

0.01 0.04 0.08 

0.24 1.25 0.27 


0.07 1.04 0.26 

0.05 0.05 0.05 

0.12 0.59 0.29 

0.13 0.18 0.05 

0.02 0.04 0.03 

0.39 1.90 0.68 


2.10 0.36 

0.68 0.06 

0.30 0.05 

0.42 0.13 

0.17 0.04 

3.67 0.65 


0.80 0.06 

0.30 0.05 

1.17 0.07 

0.05 0.03 

2.32 0.21 


0.60 0.18 

0.11 0.06 

0.34 0.19 

0.52 0.07 

0.03 0.02 

1.59 0.51 













HAZARD, INCIDENT AND LOSS 2/25 


Table 2.27 (continued) 

Feed compressor: 

Driver 

Compressor 

Miscellaneous 

Total 

Air compressor: 

Driver 

Compressor 

Miscellaneous 

Total 

Syngas compressor: 

Driver 

Compressor 

Miscellaneous 

Total 

Syngas circulator: 

Driver 

Compressor 

Miscellaneous 

Total 

Refrigeration compressor: 

Driver 

Compressor 

Miscellaneous 

Total 

Synloop and refrigeration: 

Exchangers 

Piping and valves 

Vessels 

Miscellaneous 

Total 

Miscellaneous equipment: 
Auxiliary boiler 
Piping and valves 
Exchangers 
Vessels 

Pumps and drives 

Miscellaneous 

Total 

Grand total 

B Electrical, instrument 

Electrical: 

External 

Internal 

Total 

Instruments: 

Feed compressor 

Air compressor 

Syngas compressor 

Refrigeration compressor 

Miscellaneous 

Total 


0.03 0.02 0.00 

0.03 0.01 0.01 

0.00 0.01 0.16 

0.06 0.04 0.17 


0.25 0.09 0.14 

0.44 0.15 0.14 

0.11 0.07 0.04 

0.80 0.31 0.32 


0.50 0.21 0.33 

0.73 0.25 1.38 

0.26 0.19 0.62 

1.49 0.65 2.33 


0.01 0.01 0.00 

0.00 0.01 0.00 

0.00 0.00 0.00 

0.01 0.02 0.00 


0.14 0.05 0.01 

0.33 0.09 0.07 

0.66 0.04 0.17 

1.13 0.18 0.25 


0.72 0.24 0.26 

0.39 0.20 1.51 

0.07 0.03 0.40 

0.10 0.01 0.00 

1.28 0.48 2.17 


0.48 0.02 0.31 

0.27 0.10 0.63 

0.17 0.02 2.59 

0.06 0.01 1.40 

0.08 0.04 0.17 

0.20 0.05 0.12 

1.26 0.24 5.22 

11.44 3.20 20.76 

. other shut-down causes 

0.18 0.36 0.53 

0.49 0.22 0.19 

0.67 0.58 0.72 


0.03 0.04 0.00 

0.14 0.19 0.08 

0.17 0.33 0.76 

0.07 0.09 0.10 

0.64 0.51 0.47 

1.05 1.16 1.41 


0.00 0.00 0.00 

0.01 0.02 0.03 

0.02 0.02 0.01 

0.03 0.04 0.04 


0.05 0.61 0.02 

0.07 0.69 0.13 

0.09 0.37 0.24 

0.21 1.67 0.39 


0.07 0.76 0.16 

0.22 2.01 0.58 

0.28 0.93 0.83 

0.57 3.70 1.57 


0.00 0.00 0.00 

0.00 0.01 0.02 

0.00 0.01 0.01 

0.00 0.02 0.03 


0.02 0.37 0.09 

0.01 0.17 0.04 

0.07 0.09 0.16 

0.10 0.63 0.29 


0.09 0.81 0.15 

0.24 0.30 0.19 

0.01 0.01 0.02 

0.00 0.00 0.00 

0.34 1.12 0.36 


0.03 0.45 0.07 

0.44 0.90 0.49 

0.51 3.31 0.59 

0.04 0.19 0.04 

0.05 0.23 0.14 

0.03 0.08 0.03 

1.10 5.16 1.36 

3.50 20.33 5.67 


0.17 1.70 1.37 

0.20 1.70 0.35 

0.37 3.40 1.72 


0.00 0.02 0.02 

0.15 0.06 0.20 

0.47 0.37 0.68 

0.10 0.06 0.18 

0.70 0.60 0.79 

1.42 1.11 1.87 


0.01 0.01 

0.02 0.02 

0.05 0.01 

0.08 0.04 


0.35 0.05 

0.45 0.12 

0.18 0.14 

0.99 0.31 


0.55 0.16 

1.35 0.36 

0.59 0.44 

2.49 0.96 


0.00 0.00 

0.00 0.01 

0.00 0.00 

0.01 0.02 


0.19 0.06 

0.21 0.05 

0.33 0.09 

0.73 0.20 


0.63 0.17 

0.65 0.21 

0.13 0.02 

0.04 0.00 

1.45 0.40 


0.43 0.04 

0.59 0.33 

1.91 0.35 

0.45 0.03 

0.16 0.08 

0.14 0.04 

3.66 0.86 

16.99 4.16 


0.81 0.67 

0.84 0.26 

1.65 0.93 


0.02 0.02 

0.10 0.18 

0.39 0.49 

0.07 0.12 

0.58 0.66 

1.16 1.48 
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Table 2.27 (continued) 

Other: 

Strikes 0.00 

Weather 0.66 

Operator error 0.01 

Catalyst 0.12 

Miscellaneous: avoidable 0.24 

Miscellaneous: unavoidable 0.05 

Total 1.17 

Feedstock/market curtailment 
Feedstock curtailment 0.80 

Inventory control 45.37 

Total 46.17 


0.00 

0.18 

0.18 

0.12 

0.03 

0.34 


0.14 

0.34 

0.48 


1.35 0.05 

0.04 0.03 

0.12 0.21 

0.23 0.02 

0.16 0.09 

0.03 0.01 

1.93 0.41 


0.55 0.08 

8.69 0.07 

9.24 0.15 


0.10 0.01 

1.19 0.05 

0.08 0.13 

0.42 0.08 

0.40 0.38 

1.24 0.13 

3.43 0.78 


19.97 0.74 

15.16 0.23 

35.13 0.97 


0.38 0.02 

0.69 0.10 

0.10 0.17 

0.25 0.08 

0.28 0.17 

0.47 0.18 

2.17 0.71 


7.56 0.34 

25.21 0.23 

32.77 0.57 


Grand total 


49.06 3.07 


13.30 2.35 43.07 


5.34 37.75 


3.69 


a DT, down-time (days/plant-year); ID—FD, induced draft-forced draft; SD, shut-downs (shut-downs/plant-year). 


Table 2.28 Fires in ammonia plants (after G.P. Williams, 
Hoehing and Byington, 1987) (Courtesy of the American 
Institute of Chemical Engineers) 



1973- 

-76 1977- 

-81 1981-85 

A No. of plant fires 

No. of plants having no fires 

2 

22 

41 

No. of plants having fires 

27 

74 

95 

No. of fires 

125 

257 

520 

Frequency of fires 

11.1 

14.6 

12.2 

(fires/month) 

B Classification of fires (%) 

Flange 36 

32 

31 

Valve packing 

8 

4 

8 

Oil leaks 

20 

29 

19 

Transfer header 

7 

- 

1 

Piping 

10 

9 

11 

Electrical 

2 

3 

3 

Miscellaneous 

17 

23 

27 



Figure 2.8 Trend of the fatal accident rate in id, 
1960-82 (Hawksley, 1984). The number of fatal accidents 
is given as the number in 1(f working hours or the 
number in 1000 men in a working lifetime expressed as 
a 5-year moving average 



Calendar year 


Figure 2.9 Trend of lost-time injury rate in some US companies, Chemical Manufactures Association 1974-85 
(Brain, 1988) (Courtesy of the Institution of Chemical Engineers) 












HAZARD, INCIDENT AND LOSS 2/27 


Table 2.29 Trend in the number of major incidents in UK, Europe and worldwide (after Keller and Wilson, 1991) 

No. of fatalities 1970-79 1980-87 1970-87 

Europe Worldwide Europe Worldwide UK Europe Worldwide 


A Number of incidents 

5-10 12 53 

10-100 10 45 

100-10 2 2 3 

10 2 -10 3 0 0 

B Frequency of incidents (incidents/year) 

5-10 1.2 5.3 

10-100 1.0 4.5 

100-10 2 0.2 0.3 

10 2 -10 3 0 0 


6 40 
5 30 
0 2 
0 1 


0.75 5.0 

0.63 3.8 

0 0.25 

0 0.13 


3 18 93 

2 15 75 

0 2 5 

0 0 1 


Table 2.30 The 100 largest losses in the chemical and oil 
industries worldwide (after Marsh and MacLennan, 1987) 


Period 

No. of losses 

Average loss 

1957-66 

15 

28.5 

1967-76 

29 

38.2 

1977-86 

56 

36.6 


A further review of loss trends is that given by Crook 
(1994, LPB115). He comments that the M&M data suggests 
that until 1989 losses were doubling each decade. He gives 
further data from a study drawing on the Lloyds Weekly 
Casualty Reports (LWCRs). The frequency for the incidents 
that he considers, has risen from some 28/year in 1971 to 
some 103/year in 1991. 

A particular type of incident that has received indi¬ 
vidual attention is the VCE, formerly generally referred 
to as unconfined vapour cloud explosion (UVCE). In 
the United Kingdom, the VCE at Flixborough resulted 
in a heightened awareness. A study at that time by 
V.C. Marshall (1975c) showedthatthe number of VCEs world¬ 
wide was indeed on an apparently increasing trend. 
Similarly, in his book on VCEs, Gugan (1979) stated: ‘The 
trends in frequency proportion of incidents producing blast 
and fatalities in UVCEs are all upwards’. This trend appears 
now to have been arrested. Industrial Risk Insurers (IRI) 
publish a periodic survey of VCE incidents. The number of 
VCEs obtained from this survey is given in Table 2.31. 

2.12 Case Histories 

The generalized statistics may be supplemented by indivi¬ 
dual case histories. These are treated in Appendix 1, which 
describes the various sources and gives specific case 
histories. The sources include: the incident reports of the 
HSE and the National Transportation Safety Board (NTSB); 


Table 2.31 Trend in number of vapour cloud explosions 
worldwide (after Lenoir and Davenport, 1992) 


Period 

No. of VCEs 

1930-34 

0 

1935-39 

1 

1940-44 

1 

1945-49 

2 

1950-54 

5 

1955-59 

8 

1960-64 

11 

1965-69 

12 

1970-74 

20 

1975-79 

22 

1980-84 

8 

1985-89 

15 

1990-July 1991 

7 


the collections of the Manufacturing Chemists Association 
(MCA) and the American Petroleum Institute (API); the 
periodic reviews of insurers, such as the 100 Large Losses 
(Marsh and McLennan); the NFPA Quarterly of the National 
Fire Protection Association (NFPA), the Chemical Safety 
Summaryoithe Chemical Industry Safety and Health Council 
(CISHC) and its successor, the Chemical Industries Associa¬ 
tion (CIA), and the Loss Prevention Bulletin of the Institution 
of Chemical Engineers (IChemE), all of which publish case 
histories. 

Accounts of major incidents are given in: Appendices 
2-6 on Flixborough, Seveso, Mexico City Bhopal and 
Pasadena, respectively; Appendix 16 on San Carlos; 
Appendix 19 on Piper Alpha; and Appendices 21 and 22 on 
Three Mile Island and Chernobyl. 
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3/2 LEGISLATION AND LAW 


It is the object of this chapter to give a brief account of 
the principal legislation and of the legal background rel¬ 
evant to safety and loss prevention. The account is largely 
restricted to the situation in the United States. Previous 
editions of this handbook detailed UK law. The develop¬ 
ment of legislation on health and safety in the United States 
may also be followed through the references given in 
Table A1.4 in Appendix 1. In particular, attention is drawn 
to the problems of toxic chemicals in the workplace, of pollu¬ 
tion and of transport; of litigation; and to the resulting 
legislation. 

In general, it is probably fair to say that legislation has 
been tougher in the United Kingdom in some areas and in 
the United States in others, and also that the rate at which 
controls have been tightened has often been different in the 
two countries. It is worth emphasizing also that in these 
areas it is not sufficient merely to pass legislation - it is 
necessary to enforce it. There has been, in both countries, a 
considerable tightening of methods of enforcement. 

3.1 US Legislation 

In thel970s, there occurred in the United States, avery rapid 
development of public awareness of problems of health and 
safety, and of environmental problems, and acorresponding 
growth in the creation of controls in this area. In the United 
States, both State and Federal Governments are sources of 
legislation. In recent years the involvement of the Federal 
Government in health and safety legislation has greatly 
increased. 

Major categories of safety legislation impacting the pro¬ 
cess industry can be categorized as follows: 


(1) occupational health and safety, 

(2) environment, 

(3) toxic substances, 

(4) accidental releases and 

(5) transport 


References on major safety issues are detailed below: 


Occupational Safety and Health Act 1970 
OSHA (2001, 2098, 2253, 2254, 1988); Hodgson (1971); 
S. Ross (1971,1972b); Vervalin (1971-, 1972b,d); Nilsen 
(1972a); L.J.White (1972,1973b, 1974); Anon. (1973d,e); 
Ludwig (1973a,b); Anon. (1974h); Peck (1974); Stender 
(1974); Hopf (1975); D. Petersen (1975); Corn (1976); 
Anon. (1977m); Demery (1977); Moran (1979); Ladou 
(1981); ACGIH (1990/50); A. Foster and Burd (1993) 
Occupational Safely and Health Administration (OSHA) 

J. Shaw (1978, 1979); R.D. Morgan (1979); Cahan (1982b); 
H.Bradford(1986b);Spiegelman(1987);AGA(1990/14); 
Burk (1990); Seymour (1992); Donnelly (1994) 
Environmental Protection Agency (EPA) 

J. Shaw (1978); Porter (1988); K.A. Friedman (1989a,b); 
Stephan and Atcheson (1989); Matthiessen (1994); 
Rosenthal and Lewis (1994) 

National Standards 

van Atta (1982); W.J. Bradford (1985); M.F. Henry (1985); 

R.K. Johnson (1985) 

Process Safety Management 

OSHA (1992); Rosenthal and Lewis (1994) 


Emergency Planning and Community Right-to-Know Act 
1986(EPCRA) 

Makris (1988); Bowman (1989); Bisio (1992b) 
NewJerseyToxic Catastrophe Prevention Act1986(TCPA) 
Florio (1987); Somerville (1990) 

Clean Air Act (CAA) 

E.B. Harrison (1978b); Siegel et al. (1979); G.A. Brown, 
Cramer and Samela (1988); Zahodiakin (1990); 
Matthiessen (1992); Kaiser (1993) 

Resource Conservation and Recovery Act (RCRA) 

Glaubinger (1979); Sobel (1979); Basta (1981c); H.H. Fawcett 
(1982b); Hoppe (1982) 

Superfund 

J. S. Shaw (1980b); Resen (1984); Casler (1985); Sidley and 

Austin (1987); Habicht (1988); Nott (1988); Bowman 
(1989); Hirschorn and Oldenburg (1989); Melamed 
(1989); Rhein (1989); Bisio (1992a) 

SARA 

K. A. Friedman (1989a,b); Anon. (1990k); ACGIH (1990/50); 

Curran and Kizior (1992); Ffflo and Keyworth (1992); 
Heinold (1992); Keyworth, smith and Archer (1992) 
Chipperfield (1979); Cussell (1979); Malle (1979); Otter 
(1979); Furlong (1991) 

Occupational Safety History 

Occupational safety did not begin with the passage of the 
Occupational Safety and Health Act of 1970. The ill 
effects of the environment on the worker have been 
known for thousands of years. Unfortunately, just 
because the hazards are known does not mean that they 
have been corrected. Some significant events in occu¬ 
pational safety in the United States include: 

(a) 1812, the Embargo of the War of 1812 spurred the 
development of the New England textile industry 
and the founding of factory mutual companies. 
These early insurance companies inspected pro¬ 
perties for hazards and suggested loss control and 
prevention methods in order to secure low rates 
for their policyholders. 

(b) 1864,The Pennsylvania Mine Safety Act (PMSA) 
was passed into law. 

(c) 1864, North America’s first accident insurance 
policy was issued. 

(d) 1867, the state of Massachusetts instituted the 
first government-sponsored factory inspection 
programme. 

(e) 1877, the state of Massachusetts passed a law 
requiring guarding for dangerous machinery, and 
took authority for enforcement of factory inspec¬ 
tion programmes. 

(f) 1878, the first recorded call by a labour organiza¬ 
tion for a federal occupational safety and health 
law is heard. 

(g) 1896, an association to prevent fires and write 
codes and standards, the National Fire Protection 
Association (NFPA), was founded. 

(h) 1902, the state of Maryland passed the first work¬ 
ers’ compensation law. 

(i) 1904, the first attempt by a state government to 
force employers to compensate their employees for 
on-the-job injuries was overturned when the 
Supreme Court declared Maryland’s workers’ 
compensation law to be unconstitutional. 
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(j) 1911, the American Society of Mechanical Engi¬ 
neers (ASME) was founded. A professional, 
technical organization responsible for develop¬ 
ing safety codes for boilers and elevators. 

(k) 1911, the American Society of Safety Engineers 
(ASSE) was founded. The ASSE was dedicated to 
the development of accident prevention tech¬ 
niques, and to the advancement of safety engi¬ 
neering as a profession. 

(l) 1912, a group of engineers representing insurance 
companies, industry and government met in 
Milwaukee to exchange data on accident preven¬ 
tion. The organization formed at this meeting 
was to become the National Safety Council (NSC). 
(Today, the NSC carries on major safety cam¬ 
paigns for the general public, as well as assists 
industry in the development of safety promotion 
programmes.) 

(m) 1915, by this time, 30 states passed workers’ com¬ 
pensation laws. 

(n) 1916, the Supreme Court upheld the constitu¬ 
tionality of state workers’ compensation laws. 

(o) 1918, the American Standards Association was 
founded. Responsible for the development of 
many voluntary safety standards, some of which 
are referenced into laws, today, it is now called the 
American National Standards Institute (ANSI). 

(p) 1936, Frances Perkins, Secretary of Labor, called 
for a federal occupational safety and health law. 
This action came 58 years after organized labor’s 
first recorded request for a law of this nature. 

(q) 1936, the Walsh-Healey (Public Contracts) Act 
passed. This law required that all federal con¬ 
tracts be fulfilled in a healthful and safe working 
environment. 

(r) 1948, all states (48 at the time) now had workers’ 
compensation laws. 

(s) 1952, Coal Mine Safety Act (CMSA) was passed 
into law. 

(t) 1960, specific safety standards were promulgated 
for the Walsh-Healey Act. 

(u) 1966, the Metal and Nonmetallic Mines Safety Act 
(MNMSA) was passed. 

(v) 1966, the US Department of Transportation 
(DOT) and its sections, the National Highway 
Traffic Safety Administration (NHTSA) and the 
National Transportation Safety Board (NTSB), 
were established. 

(w) 1968, President Lyndon Johnson called for a fed¬ 
eral occupational safety and health law. 

(x) 1969, the Construction Safety Act (CSA) was 
passed. 

(y) 1970, President Richard Nixon signed into law the 
Occupational Safety and Health Act, thus creat¬ 
ing the OSHA administration and the National 
Institute for Occupational Safety and Health 
(NIOSH). 

(z) 1992, The Process Safety Management rule was 
adopted by OSHA. 


3.2 US Regulatory Agencies 

The OSHA was created by the Occupational Safety and 
Health Act of 1970 and has responsibility for enforcing that 
Act. OSHA comes under the Secretary of Labor and is 


headed by an Assistant Secretary of Labor. Its activities 
include the adoption of standards and making of rules, the 
inspection of workplaces and the investigation of accidents. 

The EPA, created by the National Environmental Policy 
Act (NEPA) 1969, is responsible for environmental legisla¬ 
tion, including that on air pollution, water pollution and 
hazardous wastes. The areas of responsibility between 
the OSHA and the EPA are not clearcut. Although the 
OSHA is concerned with the workplace and the EPA with 
the environment, there are some areas where both agencies 
are involved. One of these is accidental releases and another 
is toxic substances, as described below. The relation 
between the two agencies is discussed by Spiegelman 
(1987) and Burk (1990). 

Mining and mineral processing (such as Alumina refin¬ 
eries and lime processing) are the responsibility of the Mine 
Safety and Health Administration (MSH A). 

Offshore production safety is the responsibility of the 
Mineral Management Service (MMS), which took over from 
the original US Coast Guard duties in the mid-1980s. How¬ 
ever, the Coast Guard now has responsibility for deep water 
facilities, in addition to its traditional role of marine safety. 

Pharmaceutical safety comes under the watchful eye of 
the Food and Drug Administration (FDA). 

Pipeline safety, rail transport safety, and motor carrier 
safety issues are the responsibility of the Department of 
Transportation. 

3.3 Codes and Standards 

Standards are documented agreements containing tech¬ 
nical specifications or other precise criteria to be used as 
rules, guidelines or definitions of characteristics, to ensure 
that materials, products, processes and services are fit for 
their purpose (ISO). Standards may be met on a voluntary 
basis unless and until they are incorporated into govern¬ 
ment regulations. 

Codes, on the other hand, are legal requirements, which 
are incorporated in the US Code of Federal Regulations or 
the equivalent State or local code document. Hence, Code 
and regulation are synonymous, but standards may or may 
not be regulations. Laws are passed by government bodies, 
such as Congress. Then Government agencies (such as 
OSHA and EPA) are authorized to create regulations, which 
are eventually codified in the US Code of Federal Regula¬ 
tions. Announcement of new regulations or changes to 
existing regulations must be published in the US Federal 
Register. 

Many industrial standards are incorporated directly by 
reference. For example, the OSHA flammable liquid code, 
29CFR(106), directly references the ASME standard on 
pressure vessels. Unfortunately, this direct reference can 
cause some confusion, specifically on which edition of the 
ASME standard the government code is actually referenc¬ 
ing. Since OSHA originally adopted the NFPA 30 standard 
flammable liquids in 1972, the ASME section VIII pressure 
vessel code existing at that specific instance in time was 
incorporated into law. Even though many updates to the 
ASME code were made over time, the older edition of the 
ASME code was a requirement whereas the updates in later 
editions are voluntary recommendations. OSHA eventually 
updated their regulations by publishing an announcement 
in the Federal Register. 

There are many examples where older standards are 
still the referenced edition in regulatory codes. For example, 
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the OSHA regulation on gas turbine facilities 29CFR 
1910.110(b)(20) directly references the 1970 version of NFPA 
37 (standard for the installation and use of stationary com¬ 
bustion engines and gas turbines), even though the latest 
update of this particular NFPA standard is 1998. 

Both State and Federal legislation make use of national 
standards and recommended practices. In particular, stand¬ 
ards such as those of the ANSI and the National Fire 
Codes of the NFPA are widely quoted in legislation. MMS 
frequently updates its references to American Petroleum 
Institute standards through announcements in the US 
Federal Register. 


3.4 Occupational Safety and Health Act 1970 

The Occupational Safety and Health Act 1970 (OSHA) is the 
framework Act. It provides that the Secretary of Labor 
should promulgate safety standards, inspect workplaces 
and assess penalties. There is a separate commission called 
the Occupational Safety and Health Commission, which 
deals with violations of the OSHA. The OSHA has some 
similarity with the HSWA1974 in the United Kingdom, in 
that it is essentially an enabling measure which is super¬ 
imposed on existing health and safety legislation, lays 
duties on employers and employees to comply with stand¬ 
ards and regulations, and has provisions for inspection and 
enforcement. 

However, there is one most important difference between 
UK and US regulatory concepts. OSHA regulations do not 
override any other equivalent federal safety regulation. 

Regulations are issued under the Act by OSHA. The 
initial standards promulgated under the Act were pub¬ 
lished in the Federal Register 29 May 1971. The OSHA also 
established the NIOSH to develop and establish recom¬ 
mended occupational safety and health standards. 

The Act places the onus for compliance with the law pri¬ 
marily on the employer. This applies even in cases where 
employees are not working according to instructions that 
have been issued to them to provide for their safety. An 
employer has the right to seek a variance from a standard, 
and may file a petition challenging the validity of a standard. 

Accounts of the Act are given by Anon. (1971c), Hodgson 
(1971), Nilsen (1972a), L J.'White (1973b) and Corn (1976). 

3.5 US Environmental Legislation 

Of the issues, which have assumed an increasingly high 
profile in the last two decades, pollution attained an early 
prominence and has given rise to a large volume of legisla¬ 
tion. Legislation of particular importance in this field 
includes: the Water Quality Act 1965, the NEPA 1969, the 
CAA1970, the Federal Environmental Pollution Control Act 
1970, the Federal Water Pollution Control Act (FWPCA) 
1972, the Safe Drinking Water Act, 1974 and the Noise 
Control Act 1972. 

The NEPA 1969 created the EPA. 

The CAA 1970 gives the EPA power to adopt and enforce 
air pollution standards. The EPA has promulgated air 
quality standards that set the maximum concentrations for 
various gaseous pollutants. There have been amendments 
to the CAA in 1977,1981 and 1990. Accounts of air pollution 
legislation are given by Vervalin (1972d), Zarytkiewicz 
(1975), Halley (1977), Lipton and Lynch (1987), G. A. Brown, 
Cramer and Samela (1988), Veselind, Peirce and Weiner 
(1990) and Asante-Duah (1993). 


The FWPCA 1972 gives the EPA power to adopt and 
enforce water pollution standards. The EPA has promul¬ 
gated effluent quality standards and guidelines that set 
the maximum concentrations for all liquid pollutants. 
Accounts of water pollution legislation are given by 
Weisberg (1973), L.J. White (1974), Veselind, Peirce and 
Weiner (1990) and Asante-Duah (1993). 

Hazardous wastes are regulated by the RCR A1976. There 
are rules governing the storage of such wastes in storage 
tanks, including underground storage tanks. The Act is 
administered by the EPA. 

The Comprehensive Environmental Response, Compen¬ 
sation and Liability Act 1980 (CERCLA, or Superfund) 
strengthens the regulation of hazardous wastes by the EPA. 
It creates controls on hazardous waste sites and enforces 
clean-up of existing and abandoned sites. It seeks to iden¬ 
tify potentially responsible persons (PRPs) and, where 
such parties are not found, it supervises a clean-up paid 
for from the Superfund. The Act has to be renewed periodi¬ 
cally. The Superfund Amendments and Reauthorization 
Act 1986 (SARA) renews the Superfund. The part of the 
Act known as SARA Title III extends its application to 
accidental releases, as described below. Accounts of haz¬ 
ardous waste legislation and of Superfund are given by 
Caruana (1986), Edelman (1987), Melamed (1989), Veselind, 
Peirce and Weiner (1990) and Asante-Duah (1993). 

The development of legislation on pollution may be fol¬ 
lowed through the references given in Table A1.4. These 
references show the evolution of the air and water quality 
standards and of their application.The NEPA 1969 imposes 
a duty on Federal agencies to obtain from a developer an 
environmental impact statement (EIS) before they take any 
action that affects the environment, such as granting a 
permit. A number of other Acts also include a requirement 
for an EIS. A regulation of the President’s Commission on 
Environmental Quality (CEQ) made in 1978 defines 
requirements for an EIS. Permits may be required from a 
number of agencies at federal, state and local level. Envi¬ 
ronmental legislation in the United States is described fur¬ 
ther in Appendix 11. 


3.6 US Toxic Substances Legislation 

The Toxic Substances Control Act 1976 (TSCA) is a frame¬ 
work Act .which creates a comprehensive system of controls 
over toxic substances. It empowers the EPA to regulate the 
manufacture, processing, distribution, use and disposal 
of existing and new chemicals in order to avoid unreason¬ 
able risk to health or the environment and to delay or ban 
manufacture or marketing. It provides for the creation of 
an inventory of existing chemicals and for notification 
by a manufacturer of a new chemical or of new uses for 
a chemical. There are requirements for the toxicity testing 
of chemicals and for Premanufacture Notices (PMNs). 
The EPA has an Office of Toxic Substances (OTS) 
dealing with the Act. Accounts of the Act are given by Ricci 
(1976c), C.W. Smith (1977) and A.S.West (1979,1982,1986, 
1993b). 

Section 313 of SARA Title III also deals with toxic sub¬ 
stances, but essentially in relation to high level emissions. 
It requires the EPA to compile a toxic chemical inventory 
database, the Toxic Release Inventory (TRI). Section 313 
is discussed by Bowman (1989). The control of toxic 
substances in the workplace and in the atmosphere is also 
covered by the OSHA 1970 and by pollution legislation. 
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The development of legislation on toxic substances in the 
workplace and in the atmosphere may be followed through 
the references given inTable A1.4. The case of vinyl chloride 
is of particular interest. 

3.7 US Accidental Chemical Release Legislation 

The accidents at Flixborough, at Seveso and, above all, at 
Bhopal, and the development of major hazard controls in 
Europe led in the second half of the 1980s to US legislation 
on accidental releases. Accidental releases are covered by 
the EPCRA 1986. This is Title III of the SARA 1986. It is 
commonly known as S AR ATitle III and was signed into law 
in 1988. It contains four main parts; 


(1) emergency planning, 

(2) emergency notification, 

(3) community right-to-know and 

(4) toxic chemicals inventory. 


The Act is enforced by the EPA. An account of the EPA’s 
chemical accident release prevention programme is given 
by Matthiesen (1994). 

Controls on accidental releases have also been introduced 
by the OSHA in the form of a rule for the Process Safety 
Management of Highly Hazardous Chemicals. This intro¬ 
duces a requirement for a process safety management sys¬ 
tem to identify, evaluate and control such hazards. An 
account of OSHA’s process safety management rule is given 
by Donnelly (1994). 

Individual states have also brought in their own legisla¬ 
tion. The New Jersey TCPA1985 creates a requirement for a 
risk management programme for facilities handling certain 
toxic chemicals above a given inventory. The California 
Hazardous Materials Planning Program is based on a codi¬ 
fication of four laws within the California Health and Safety 
Program. 


Accounts of legislation on hazardous chemicals with 
potential impact off site are given by Brooks et al. (1988) 
and Horner (1989). 

3.8 US Transport Legislation 

Another major concern in the United States in recent years 
has been the problem of the transport of hazardous 
materials, and this has given rise to a large volume of legis¬ 
lation. Some principal items of legislation (considered fur¬ 
ther in Chapter 23) in the field include 

(1) Rivers and Harbors Act 1899 

(2) Explosives Transportation Acts 1908,1909 and 1921 

(3) Tank Vessels Act 1936 

(4) Natural Gas Act 1938 

(5) Federal Aviation Act 1958 

(6) Natural Gas Pipeline Safety Act 1968 

(7) Dangerous Cargo Act 1970 

(8) Hazardous MaterialsTransportation Act 1970 

(9) Coastal Zone Management Act 1972 

(10) Ports and Waterways Safety Act 1972 


3.9 Regulatory Support 

Legislation that is based on good industrial practice and is 
developed by consultation with industry is likely to gain 
greater respect and consent than that which is imposed. 
Actions by individuals who have little respect for some 
particular piece of legislation are a common source of ethi¬ 
cal dilemmas for others. 

The professionalism of the regulators is another 
important aspect. Aprompt, authoritative and constructive 
response may often avert the adoption of poor practice 
or a short cut. The regulatory body can contribute 
further by responding positively when a company is open 
with it about a violation or other misdemeanor that has 
occurred. 
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Foreword by Jerry Havens 

I am honored to have the opportunity to update Professor 
Lees’discussion of Major Hazards. Had the events of 9/11 not 
occurred, there would be little that I could add, but there is 
today a new dimension to the problem of major hazards. For 
fifty years now, we have been wrestling, sometimes not 
effectively enough, with problems of human error - since 
9/11 we are forced to consider malicious acts as well. 

I cannot improve on Lees’ definition of a major hazard - as 
being of low probability of realization combined with the 
likelihood of very great harm if realized. Although this 
definition may he virtually useless in the eyes of the law, 
hence most regulatory uses, I think Lees had in mind the 
public, and the public will ultimately decide the accept¬ 
ability of activities it considers major hazards. Although 
benefits accrue to all effective loss prevention activities, 
major or not, prevention of the realization of major hazards 
will, I believe, become increasingly important in maintain¬ 
ing industry’s reputation as a good, and safe, neighbour. 

Lees is primarily interested here in major technological 
hazards, but he skillfully compares them with natural 
hazards with which the public is more familiar. He points 
out that technological hazards can rival natural hazards in 
severity, as some incidents that have occurred in the twen¬ 
tieth century suggest. Despite significant efforts made to 
improve public safety, the general public is sadly unin¬ 
formed about the extent of misery that can accompany 
major accidental releases of hazardous materials - perhaps 
best exemplified by the Bhopal and Chernobyl disasters. 
I have been surprised to find in my teaching experience that 
few chemical engineering students today know anything 
about Bhopal - excepting Indian students. 

As Lees suggests, the problem of major hazards requires 
an essential understanding of, and respect for, the most 
basic desires of our society. If the methods adopted for 
dealing with these problems do not address the larger 
desires of society, failure is likely. He hits the nail on the head 
when he says, ‘Policy decisions would be so much easier if a 
purely quantitative analysis were enough or nearly so.’ 

The suggestion that ‘people select certain risks for 
attention to defend their preferred lifestyles and as a foren¬ 
sic resource to place blame on other groups’ is provocative 
and sobering. And, his comment that ‘While one school of 
thought argues that the prevention of incidents requires 
strict discipline and the attribution of blame for error, the 
other holds that incidents arising from human error are 
conditioned by the work situation and that the rectification 
of defects in that situation requires the free flow of infor¬ 
mation which is inhibited by a blame culture’ is all the more 
sobering in view of the current controversies surrounding 
the withholding post-9/11 in the United States of Risk 
Management Plans and other ‘sensitive’ information from 
the parties for which it was designed - for fear that it will be 
used with malice. 

Lees’ book summarizes the technical/scientific tools that 
are available for application to the management of major 
hazards - to define the consequences of scenarios which 
must be considered, and to define and minimize the like¬ 
lihood of those scenarios being realized. There remain some 
areas that are worthy of continued research, to ‘sharpen the 
pencil’, and a continued commitment to research and devel¬ 
opment of loss-prevention management methods is essen¬ 
tial . However, it is my belief that the major hazards problems 
society faces are less a problem of insufficient information 


about those hazards and more a problem of insufficient 
application of the tools that we have in hand. 

With this foreword, I have decided that Lees’ discussion is 
best left unaltered and unexpanded. To my mind, excepting 
the growing emergence of a global terrorist threat, there has 
been little that has occurred since he wrote these words that 
change the dimensions of the problem of major hazards or 
the methods that are available for their management. 

Some of the installations operated by the chemical 
industry constitute major hazards. In the early days of the 
industry, there were some major disasters, particularly 
ammonium nitrate explosions, involving hundreds of 
fatalities. The period 1950—80, however, was relatively free 
of such disasters, but since then there have been several 
accidents with death tolls of over 100, of which Bhopal was 
by far the worst. 

Process operations are one of a number of activities that 
are of concern to communities and governments. In parti¬ 
cular, high technology, which sometimes brings unforeseen 
hazards, causes some unease. Inevitably, therefore, the 
evolution of hazard control policy for the chemical industry 
must be influenced by developments in public policy for the 
control of hazards generally. 

One area of activity that attracts hazard controls is 
transport. The evolution of hazard controls on the railways 
is very instructive and has many lessons for the chemical 
industry, while air transport illustrates the controls 
developed for an industry in which high technology is 
particularly important. Another area of activity closer to 
the process industries where there has long been a well- 
developed hazard control policy is the nuclear industry. 
This has often been suggested, therefore, as a model for the 
control of hazards in the process industries. Other models 
include the hazard control systems used in mines, in the 
explosives industry and in the pharmaceuticals industry. 

Selected references on hazard control are given in 
Table 4.1. 

4.1 Superstar Technologies 

Within the last two decades, there has been a growing 
awareness of the problems associated with industrial 
growth and technological development. This has mani¬ 
fested itself in debate and conflict on such topics as 

(1) environment (amenities, countryside, pollution, waste 
disposal, noise); 

(2) resources (oil, metals); 

(3) transport (road building, road accidents, aircraft cra¬ 
shes, tanker shipwrecks); 

(4) buildings and structures (high rise flats, bridges); 

(5) oil and chemical industry (pollution, noxious release, 
noise); 

(6) nuclear power (major accidents, low-level release, 
waste disposal); 

(7) toxic substances (drug and food additive side effects, 
materials at work). 

It is also increasingly recognized that these problems have 
certain common features and that there is a generic problem 
in the assessment and control of technological develop¬ 
ments. The question is considered in Superstar Technol¬ 
ogies (Council for Science and Society, 1976) and the 
following discussion draws on this work. 
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Table 4.1 Selected references on hazard control 


Major projects 

Sage (1977); NAE (1986); RWG. Morris and Hough (1987) 

Catastrophic failures 

Bignell et ol. (1977); B. A. Turner (1978); Michaelis (1986) 

Disaster technology 

Manning (1976); Cuny (1983); Comfort (1988) 

Hazard control policy 

Bock (1965); N. Kaplan (1965); NAE (1970); Greenberg 
(1972); Goldsmith (1973); Bettman (1974); Brodeur (1974); 
S.S. Epstein and Grudy (1974); Schillmoeller (1974); 
Chicken (1975); Council for Science and Society (1976,1977); 

F. Warner (1976); Hodgkins (1977); IBC (1978/2); Wearne 
(1979); Collingridge (1980); Gusman etal. (1980); Lagadec 
(1982); Nilsson (1983a); Anon. (1984b); Beveridge and 
Waite (1985); Weinberg (1985); D. Williams (1985); Kaufman 
etal. (1986); Kharbanda and Stallworthy (1986b); Ostrom 
(1986); Solomon (1987); Majone (1989); Carnino etal. (1990); 
Funtowicz and Ravetz (1992); The Royal Society (1992) 
Safety cases: Mellit (1995) (London Underground) 

Interest groups 

Stewart (1958); Moodie and Studdert-Kennedy (1970); 

G. K. Roberts (1970); Wootton (1970); Olson (1971); Wraith 
and Lamb (1971) 

Particular hazards 

Aircraft: Wheatcroft (1964); Lowell (1967); Pardoe (1968); 
W. Tye (1970); Warren (1977) 

Drugs: Sjorstrom (1972) 

Explosives: L. Allen (1977a) 

Motorcars: Nader (1965); Plowden (1971) 

Railways: Rolt (1982) 

Ships: Cabinet Office (1967) 

Hazard assessment 

Fussell et al. (1974); AEC (1975); Council for Science and 
Society (1977) 

Critiques: Brooks (1972); Weinberg (1972a, b); Mazur 
(1973); Hafele (1974); The Royal Society (1992) 

Warning of disasters 

Lees (1982b); The Fellowship of Engineering (1991a,b); 

J.B. Cook (1991); Cullen (1991); Derrington (1991); Hambly 
(1991); Sampson (1991); Street (1991) 

Planning 

Chalk (1973); Dundee Department of Town and Regional 
Planning (1979); B.D. Clark etal. (1981); IBC (1981/17); 

Petts and Eduljee (1994) 

Planning inquiries: Sieghart (1979); Barker (1984); 

Kemp et al. (1984); R.W. King (1984) 

Environment 

Nicholson (1970); WHO (1972); NAS/NRC (1975); Burton 
etal. (1978); Kates (1978); Conway (1982); Petts and Eduljee 
(1994) 

Cost-benefit, risk-benefit analysis 

NAE (1972); Putnam (1980); The Royal Society (1992) 

Science and society 

von Helmholtz (1895); Steffens (1931); Huff (1954); Cardwell 
(1957); D. de S. Price (1963); Weinberg (1963,1967,1985); 


Hagstrom (1965); N. Kaplan (1965); Commoner (1966); 
Greenberg (1967); Nicholson (1967,1970); Hersch (1968); Crowe 
(1969); Arendt (1970); Ravetz (1971,1974a); Rawls (1971); 
Schrader-Frechette (1984a,b); The Royal Society (1992) 

Engineer’s, scientist’s responsibility (see also Table 3.1): 
Gilpin and Wright (1964); Hagstrom (1965); O.K. Price 
(1965); Ferkiss (1969); Mayo (1970); Nader (1971); Ravetz 
(1971); Lederberg (1972); Feinberg (1974); Primack and von 
Hippel (1974); Edsall (1975); Fishbein and Ajzen (1975) 


The existence of a problem is due to the combination of a 
number of factors. Human artefacts are now often large and 
complex. Society also is complex, interdependent and vul¬ 
nerable. Technological developments are often rapid and of 
large scale, and economic pressures militate against exten¬ 
sive testing. Devices are scaled up by extrapolation into 
untested areas and there is no opportunity for gradual evo¬ 
lution and learning by trial and error. 

At the same time, some of the former moderating influ¬ 
ences have grown weaker. The complexity of projects invol¬ 
ving numerous teams dilutes individual responsibility 
There are many new specialisms which tend not to have the 
same ethos as the older professions. In some of the more 
important areas the project is so specialized that the organi¬ 
zation concerned has a virtual monopoly of the experts 
available. The combination of the variety and depth of 
technology increases the difficulty of monitoring by gov¬ 
ernment inspectors. 

The degree of acquiescence by the public in technological 
development has changed considerably in recent years.The 
increased militancy of interest groups from trade unions to 
neighbourhood associations shows that people are not pre¬ 
pared to put up with the hazards and nuisances which were 
tolerated in the past. 

Part of the problem is that high technology projects tend 
to be vulnerable to failures of all kinds. There is only one 
way in which they can go right, but many in which they can 
go wrong. In reliability terms, they are series systems in 
which all the elements must work if the system is to be a 
success. There is a particular problem in identifying all 
the ways in which the system may fail. Another aspect of 
the problem is the question of unforeseen dangerous side 
effects, of which there havebeennumerousexamples.These 
include the side effects of drugs and of industrial materials 
such as asbestos and vinyl chloride. 

Occasionally a disaster occurs which is sufficiently dra¬ 
matic to result in action. Some major technological disasters 
in the United Kingdom in recent years have been the crashes 
of the Comet aircraft, the release of radioactive material 
fromWindscale, the side effects of the drug Thalidomide, 
the defects in the Ronan Point high rise flats, the oil pollu¬ 
tion from theTorrey Canyon tanker, the failures of box gir¬ 
der bridges, the collapse of structures built in high alumina 
cement, the vapour cloud explosion at Flixborough, the 
sinking of the Herald of Free Enterprise, the fire at the 
Kings Cross Underground station, the rail crash at Clapham 
Junction and the explosion and fire on the Piper Alpha oil 
platform. Some of these have led to improvements of safety 
procedures (e.g. Windscale), and some to the abandonment 
of the technology (e.g. Ronan Point). All parties, including 
the public, the professions and the government tend to react 
more strongly to such disasters than they do to smaller scale 
failures, even where these are very frequent. 
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It is possible to identify a number of factors that allow 
high technology projects to develop to the point where a 
disaster can result. At the intellectual level there is the dif¬ 
ficulty of trying to foresee the potential problems and of 
judging where knowledge is inadequate or experiment is 
required. It is necessary, but not easy, to keep abreast of the 
technical literature and to maintain contact with experts in 
other fields. In the moral sphere there are the difficulties of 
maintaining a conscientious approach to the frequently 
tedious requirements of safety and of speaking out when 
doubts arise on safety features. The problem has an organi¬ 
zational aspect in that it tends to require a strong person¬ 
ality to run a major project, but such a person is frequently 
intolerant of criticism. As a consequence, colleagues are 
discouraged from dissenting. 

Studies of major failures in man-made systems have been 
described in Catastrophic Failures by Bignell, Peters and 
Pym (1977) and Man-Made Disasters by B.A. Turner (1978), 
and by Wearne (1979). 


4.2 Hazard Monitoring 

The Council for Science and Society argues for the creation 
of mechanisms by which the community can monitor and 
control hazards. Monitoring is likely to be effective only if it 
is generally accepted as a necessary and constructive 
activity that not only protects society but also contributes 
to the project. There is an analogy here with the role of ‘Her 
Majesty’s Loyal Opposition’ in Parliament. 

The project needs to be monitored at all stages: concep¬ 
tion, decision and operation. At the conceptual stage, the 
need is to discover the problems, the hazards and the dis- 
benefits. There should be testing of the basic assumptions, 
speculative reviews of hazards and study of various sce¬ 
narios. The debate should involve the public as well as the 
experts. Argument continues in the decision stage, but now 
centres on detailed proposals and designs of the project. 
Here the discussion is mainly between the project team and 
the other agencies involved. At the operational stage, the 
emphasis changes to enforcement of operational require¬ 
ments and monitoring of operating hazards. 

Monitoring should be carried out both within the organi¬ 
zation itself and through external agencies and fora. 
Internal monitoring may be conducted by internal but 
independent functions, such as a pressure vessel inspection 
section, and by consultants. External monitoring takes 
place through the activity of interest groups and govern¬ 
ment agencies. An interest group requires a forum in which 
to operate; typical fora are courts of law, public inquiries 
and the news media. 

Monitoring by government agencies has a crucial role, 
but again there are certain difficulties. Despite the resour¬ 
ces of government, it is not easy for a government agency to 
deploy the full range of up-to-date expertise which ideally it 
should possess. Like any other activity, monitoring may 
become routine, and complacency may set in. The agency 
must expect to be subject to the internal politics of the civil 
service machine. Government itself is not infrequently 
involved in some way in the projects that require to be 
monitored. 

There are certain relatively detached institutions, such as 
universities and the professional bodies, which contain 
expertise and which have a role to play in the monitoring 
process. It does not follow, however, that they should 


necessarily themselves be monitors. Their function is 
rather to provide a source of independent expertise. 

An explicit attempt needs to be made to enhance the 
effectiveness of the individual as a monitor. One important 
measure is to increase the backing that professional stand¬ 
ards can give to the individual. Another is to afford pro¬ 
tection to the individual who ‘blows the whistle’ on a hazard 
or an abuse. 

The process of communal decision-making also places an 
obligation on those who claim to speak on behalf of the 
community to be well informed and responsible in their 
arguments. 

4.3 Risk Issues 

High technology projects involve risks. These risks raise a 
number of issues including: 

(1) risk perception; 

(2) risk criteria; 

(3) risk management; 

(4) risk estimation. 

There is a growing literature on risk issues, which includes 
How Safe is Safe? (Koshland, 1974), Of Acceptable Risk 
(Lowrance, 1976), The Acceptability of Risks (Council for 
Science and Society, 1977), An Anatomy of Risk (Rowe, 
1977), Society, Technology and Risk Assessment (Conrad, 

1980) , Societal Risk Assessment (Schwing and Albers, 1980), 
Science, Technology and the Human Prospect (Starr and 
Ritterbush, 1980),TechnobgicalRisk(Dierkes, Edwards and 
Coppock, 1980), Acceptable Risk (Fischhof et al., 1981), The 
Assessment and Perception of Risk (F. Warner and Slater, 

1981) , Dealing with Risk (R.F. Griffiths, 1981), Risk in the 
Technological Society (Hohenemser and Kasperson, 1982), 
Major Technological Risk (Lagadec, 1982), Technological Risk 
(Lind, 1982) and Risk in Society (Jouhar, 1984). 

The Health and Safety Executive (HSE) has published 
The Tolerability of Risks from Nuclear Power Stations (HSE, 
1988c), Risk Criteria for Land Use Planning in the Vicinity of 
Major Hazard Installations (HSE, 1989e) and Quantified Risk 
Assessment: Its Input to Decision Making (HSE, 1989c). 

A review of risk issues is given in Risk: Analysis, Percep¬ 
tion and Management (Royal Society, 1992; the RSSG 
Report) which provides the framework for the following 
discussion. 

The treatment of this topic here is necessarily brief and is 
limited to an account of some of the principal themes. 
A further discussion of risk and in particular of risk criteria 
for hazard control is given in Chapter 9. 

4.4 Risk Perception 

Work on risk perception shows that people tend not to think 
in terms of an abstract concept of risk, but rather to evaluate 
the characteristics of a hazard and to perceive risk in a 
multi-dimensional way. The idea that risk is an inherent 
property of the hazard has been criticized by Watson (1981) 
as the ‘phlogiston theory of risk’. Various authors have 
attempted to define risk. One such attempt is that of Vlek 
and Keren (1991), who have given 10 different definitions. 

4.4.1 Acceptable risk 

This question of risk is often treated in the same way as 
that of ‘acceptable risk’, although the latter term is itself 
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contentious, raising as it does the question: Acceptable to 
whom? Nevertheless, the term ‘acceptable risk’ has been 
widely used to describe this generic problem. A discussion 
of the problem has been given in The Acceptability of Risks 
by the Council for Science and Society (1977). Some of 
the considerations affecting judgements about risks given 
by Lowrance (1976) are shown inTable 4.2. 

The Council for Science and Society takes up the argu¬ 
ment advanced by earlier workers that the distinction 
between risks that are assumed voluntarily and those that 
are borne involuntarily is a crucial one. In general, people 
are prepared to tolerate higher levels of risk for hazards to 
which they expose themselves voluntarily. The risk to which 
a member of the public is exposed from an industrial activ¬ 
ity is an involuntary one. It is a common view that the risk to 
which an employee is exposed from this activity is in some 
degree voluntarily assumed. Thus, the Council’s report 
states: 

Some hazards are accepted voluntarily, even when the 
risk is high. At one extreme we may say that the risk is 
‘embraced’ when it is an integral part of the challenge in a 

hazardous sport, such as pot-holing or motor-racing- 

The personal attitude is different in emergencies, where 
the risk may be said to be ‘defied’ in the course of a response 
to a call for help. Rescue operations are the prime example of 
such hazards. In them, the balance of costs and benefits may 
be very different from that which prevails in ordinary life, 
as we can see from the lengths to which kind-hearted people 
will go in retrieving lost or trapped animals.... 

When a serious hazard is encountered involuntarily, 
acceptance may extend only to a much lower level of risk 
than otherwise. When, in addition, the sufferer feels impo¬ 
tent in the face of danger, tolerance is further reduced. 
Accidents in trains seem peculiarly unacceptable, perhaps 
more so than accidents in aeroplanes, where rightly or 
wrongly the passengers are generally considered to have 
taken the risk on themselves for the sake of the extra benefit 
of the time saved. In underground tube-trains, only absolute 
safety seems to be good enough; perhaps the enclosed 
environment exerts a strong psychological influence. The 
stark terror of impotence in the face of impending destruc¬ 
tion is an important part of the evaluation of such risks. For 
a strong contrast, we notice how the illusion of control by a 
driver in a private motor car who is under the influence of 
alcohol makes very high risk levels acceptable to him. 


Table 4.2 Some considerations affecting judgements 
on safety (after Lowrance, 1976) 


Risk assumed voluntarily/Risk borne involuntarily 
Effect immediate/Effect delayed 
No alternative available/Many alternatives available 
Risk known with certainty/Risk not known 
Exposure is an essential/Exposure is a luxury 
Encountered occupationally/Encountered 
non-occupationally 
Common hazard/'Dread’ hazard 

Affects average people/Affects especially sensitive people 
Will be used as intended/Likely to be misused 
Consequences reversible/Consequences irreversible 


Source: Reproduced with permission fromW.W Lowrance, Of Accep¬ 
table Risk. Copyright © 1976, William Kaufman Inc., Los Altos, CA 
94022. All rights reserved. 


Perhaps the most difficult class of hazards for judge¬ 
ments of acceptability are those called ‘major hazards’. 
These are defined by a low probability of realization, com¬ 
bined with the likelihood of very great harm if the hazard is 
realized. In this case, the intuitions derived from ordinary 
experience provide little help in conceiving the hazard; and 
the experts themselves may well disagree even over the 
probabilities. When harm is liable to be inflicted on people 
who have neither any conceivable power to avert it, nor any 
responsibility for its occurrence, the judgement of the 
‘acceptability’of the risk is at its most difficult. 

This variety of perceptions may well be a cause of irrita¬ 
tion to the expert on risk assessment. Policy decisions 
would be so much easier if a purely quantitative analysis 
were enough or nearly so. The subj ective perceptions of risk 
can have enormous political importance, possibly to the 
extent of distorting priorities in programmes for coping 
with the real risks that society encounters. (This problem is 
most noticeable in medicine.) There is occasionally a temp¬ 
tation on the part of the expert in technological risks to 
throw in a couple of extra orders of magnitude of restriction 
of unacceptable hazards and then perhaps be annoyed when 
even this does not render them acceptable to critics. 

In the last analysis, the Council continues, there is only 
one sort of risk ‘that is truly ‘‘acceptable” in the ethical 
sense: the risk that is judged worthwhile (in some estima¬ 
tion of costs and benefits), and is incurred by a deliberate 
choice made by its potential victims in preference to feasible 
alternatives’. The important question, therefore, is ‘under 
what conditions, if any, is someone in society entitled to 
impose a risk on someone else on behalf of a supposed ben¬ 
efit to yet others?’ 

The Council concludes that it is not practical to give the 
individual an absolute veto over any development which 
may be a hazard to him or her. The public interest must also 
be considered. This does not necessarily mean, however, 
that it is sufficient to leave the judgement on the accept¬ 
ability of risk to the organization concerned or to govern¬ 
ment. The Council cites a number of cases in which it 
considers that control by government inspection agencies 
has not achieved the proper balance of risk. It suggests: 

Rather than continuing to demand an answer to the 
question whether a risk is fair in itself, we should redirect 
our attention to the ways that risks come about and are 
controlled. That is, we should focus on the procedures by 
which the decisions are taken on the creation or persis¬ 
tence of risks, and ask whether these procedures are fair. 
The Council advocates that decisions on projects 
involving hazards should be openly arrived at and that 
those affected should be able to participate in the decision 
through the medium of public inquiries and other 
similar fora. 

The report contains a number of appendices that deal 
with risk in aircraft (D.V. Warren, 1977), in nuclear radiation 
(Burhop, 1977), with explosives (R.L. Allen, 1977a), at 
Flixborough (R.L. Allen, 1977b), with asbestos (Woolf, 
1977) and with the use of mathematics in risk assessment 
(Ravetz, 1977b). Many of these are discussed further in 
later chapters. 


4.4.2 Acceptable vs tolerable risk 

The account of the acceptability of risk in the RSSG Report 
describes some of the approaches taken to the problem of 
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acceptable risk and the distinction between acceptable and 
tolerable risk. 

Fischhoff et al. (1981) suggest that there are three main 
methods used to resolve risk questions. These are profes¬ 
sional judgements by experts, formal cost-benefit ana¬ 
lyses and methods based on comparisons with the risks 
accepted from existing hazards. The authors suggest that 
the relevant factors are whether a method is: comprehen¬ 
sive, logically consistent; practical, open to evaluation, poli¬ 
tically acceptable, compatible with existing institutions, 
conducive to society’s learning about risk and whether 
it improves decision-making in the long run. Fischhoff 
et al. use these seven criteria to evaluate the approaches 
described. 

The concept of acceptable risk came in for criticism from 
Sir Frank Layfield, chairman of the Sizewell B Inquiry. 
He argued that the concept understates the seriousness of 
the problem and that the term ‘tolerable risk’ is preferable. 
He expressed the view that the opinions of the public should 
underlie the evaluation of risk, although he saw no practical 
way in which they could reliably be so used. TheTolerability 
of Risk from Nuclear Power Stations, produced following 
this inquiry (HSE, 1988b) gives the following definition: 

Tolerability does not mean ‘acceptability’. It refers to the 
willingness to live with a risk to secure certain benefits 
and in the confidence that it is being properly controlled. 
To tolerate a risk means that we do not regard it as negli¬ 
gible or something we might ignore, but rather as some¬ 
thing we need to keep under review and reduce still 
further if and as we can. 


4.4.3 Actual vs perceived risk 

One aspect of the risk debate concerns the relationship 
between objective, or statistical, risk and subjective, or 
perceived, risk. One line of inquiry draws a distinction 
between actual and perceived risks, and seeks to investigate 
the extent to which perceived risks differ from actual ones. 
The opposing school of thought holds that such a distinc¬ 
tion is misconceived. 

The attempt to assess the risks arising from a hazard 
involves a number of areas of considerable difficulty. The 
RSSG Report highlights two of these: (1) consequences and 
(2) uncertainty. 

Scenarios for the realization of a hazard generally involve 
a whole range of consequences. There may be injuries, 
which may be fatal or non-fatal, prompt or delayed. There 
may be environmental damage where the effects may 
appear promptly or only after a delay. In other words, the 
consequences are multi-dimensional. 

The assessment of the risk is subject to uncertainty. Tra¬ 
ditionally, uncertainty has been discussed in terms of 
probability, but this does not exhaust the matter. In the tax¬ 
onomy of ignorance given by Smithson (1989), probability is 
one aspect along with others such as incompleteness and 
distortion. Even the concept of probability has different 
meanings, four conventional interpretations being the 
classical, frequency, logical and Bayesian. 

One type of uncertainty that arises in risk assessments 
concerns the values to be assigned to the parameters. 
A more fundamental uncertainty arises over the complete¬ 
ness and correctness of the structure of the analysis. There 
are both parametric and systemic uncertainties - or as 
C.H. Green, Tunstall and Fordham (1991) put it ‘What 


you know you don’t know’ and ‘What you don’t know you 
don’t know’. 

Expert risk assessments do not provide an unambiguous 
and reproducible measure of risk. The validity of the 
assessment depends very largely on its pedigree, but this 
can be mixed, with highly expert and less expert elements, 
such that the latter may well be the weak link. A study by 
Lathrop and Linnerooth (1983) found widely differing 
assumptions underlying three separate studies of the same 
proposed facility in the United States. Considerations of this 
kind undermine the assumption that it is possible to deter¬ 
mine an objective measure of ‘risk’ that can then be used as a 
basis forjudging perceptions of risk. 

4.4.4 Psychological issues 

One of the main fields of study in psychology is sense per¬ 
ception and the methodology for this is one starting point 
for investigating risk perception. In such a work, an inves¬ 
tigation is made of the extent to which the subject’s percep¬ 
tion of objective stimuli corresponds with reality. The 
difficulty in applying these methods to risk perception is 
that risk is not an objective property. 

There are, however, several specific topics bearing on 
risk where progress has been made using the psychological 
approach. The RSSG Report describes three such areas: 
(1) estimation of fatality, (2) characterization of hazards and 
(3) differences between individual and group perceptions. 

Lichtenstein et al. (1978) investigated the estimation by 
laymen of the annual number of fatalities in the United 
States from 40 different hazards. The estimates made by the 
laymen showed two biases. One was that they overestimated 
the number of deaths due to infrequent causes such as tor¬ 
nadoes, but underestimated those due to frequent causes 
such as diabetes. The other was that the infrequent events 
for which overestimates were highest tended to be those of 
which laymen have a vivid picture and which are salient in 
their memory. The authors term this the ‘availability heur¬ 
istic’. The correspondencebetweenthelay estimates and the 
statistical data were better in respect of rank ordering than 
in respect of the absolute number of deaths. The conclusion 
drawn in the Report from this and other work is that indi¬ 
viduals are quite capable of making well-founded judge¬ 
ments of the relative magnitude of expected fatalities. 

A study of the perception of the qualitative character¬ 
istics of hazards was made by Slovic, Fischhoff and 
Lichtenstein (1980). In this study, respondents were asked to 
rate 90 hazards in respect of 18 qualitative characteristics. 
The latter were then reduced to three dominant factors of 
which the first two were ‘dread risk’ and ‘unknown risk’. 
Dread has to do with features such as whether the hazard is 
uncontrollable and exposure to it involuntary, unknow- 
ability has to do with features such as whether the hazard is 
a familiar one and whether its effects are immediate or 
delayed. The results obtained are shown in Figure 4.1. The 
third factor was the number of people exposed to the 
hazard. The findings of this and subsequent studies have 
also shown that respondents tend not to be satisfied with 
existing trade-offs between risks and benefits and to desire 
stricter regulation of hazards. 

An individual’s perception of risk is likely to be affected 
by his personality but also by his membership of a group. 
A number of studies have been done of the effect of mem¬ 
bership of groups differentiated by culture, gender or age. 
Work on groups also includes investigation of the attitudes 
of individuals within groups with different stances on a 
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Figure 4.1 Perception of different hazards: ‘dread risk’ vs ‘unknown risk (Stovic, Fischhoff and Lichtenstein, 

1980): locations of 90 hazards on factor 1 (dread risk) and factor 2 (unknown risk) of the three-dimensional space derived 
from the interrelationships among 18 risk characteristics. Factor 3 (not shown) reflects the number of people exposed to 
the hazard and the degree of one’s personal exposure (Courtesy of Plenum Press) 
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particular issue such as pro- and anti-nuclear groups. 
One finding of this work is that individuals in the two 
groups had rather similar attitudes to particular undesir¬ 
able characteristics such as increased centralization of 
power or imposition of involuntary risk, but differed rather 
in the extent to which they perceived these characteristics 
as applying to nuclear power. 

Another finding of work in this area is that an attitude 
which favours a technology is often accompanied by 
a desire that it be more closely regulated and, therefore, that 
a call for stricter regulation is not necessarily evidence 
of hostility. 

4.4.5 Social science issues 

A starting point for the social sciences is that there is every 
reason to expect that a person’s attitude to hazards is related 
to his overall system of values and beliefs and that it is 
affected by broad social factors. Three insights of social 
science which bear on risk issues described in the RSSG 
Report are (1) cultural theory, (2) social amplification and 
(3) social framing. 

Cultural theory, developed by Douglas (1966,1982,1985, 
1990,1992), holds that attitudes such as that to risks vary 
systematically with cultural bias. The cultural bias of an 
individual depends partly on the extent to which he is part 
of a bounded group (‘group’) and partly on social interac¬ 
tions which are conducted according to rules rather than 
negotiated (‘grid’). Four principal biases are recognized: 
hierarchists (high grid/high group), egalitarians (low grid/ 
high group), fatalists (high grid/low group) and individu¬ 
alists (low grid/low group). The Report describes these dif¬ 
ferent types as follows: 

The argument goes that individualists see risk and 
opportunity as going hand-in-hand; fatalists do not 
knowingly take risks but accept what is in store for them; 
hierarchists are willing to set acceptable risks at high 
levels so long as decisions are made by experts or in other 
socially approved ways; but egalitarians accentuate the 
risks of technological development and economic growth 
so as to defend their own way of life and attribute blame to 
those who hold to other cosmologies. 

It continues: 

The implications of this approach for risk assessment 
and perception are revolutionary. It implies that people 
select certain risks for attention to defend their preferred 
lifestyles and as a forensic resource to place blame on 
other groups. That is, what societies choose to call risky is 
largely determined by social and cultural factors. If the 
cultural theory is accepted, no ‘single metric’ for risk 
analysis can be developed on which the different cultural 
biases can find common ground. Studies point to a divide 
between egalitarians, who are anti-risk, and others. 

The concept of social amplification is that risk percep¬ 
tions are amplified or attenuated by social processes. This 
occurs because the knowledge of risk that the individual 
possesses is largely second-hand. It was suggested by 
Kasperson et al. (1988) that the transformations that occur 
as the risk signal passes through social ‘amplification sta¬ 
tions’ such as expert groups, mass media, government 
agencies and politicians may be predictable. 

‘Social framing’ or ‘expert framing’ is the term used to 
describe the fact that the risk assessments made by expert 
groups tend to involve a set of implicit assumptions. These 


assumptions have been the subject of a series of studies by 
Wynne (1982,1989,1992). One area where the expert group 
typically makes implicit assumptions is the social and 
institutional framework within which the risks are to be 
managed. Another area where implicit assumptions are 
common relates to operations. Discussing the problem of 
pesticide safety, Wynne (1992) comments that expert fram¬ 
ing involved the assumptions that 

... pesticides manufacture process conditions never 
varied so as to produce dioxin or other toxic con¬ 
taminants of the main product stream; drums of herbic¬ 
ide always arrived at the point of use with full 
instructions intact and intelligible; in spite of the incon¬ 
venience farmers and other users would comply with the 
stated conditions, such as correct solvents, proper spray 
nozzles, pressure valves and other equipment, correct 
weather conditions, and full protective gear. As a model 
of the ‘real’ social world and thus of the typical risk sys¬ 
tem, this was utterly naive and incredible however good 
the laboratory science. 


4.4.6 Risk communication 

Another area of study is that of risk communication. Here 
the RSSG Report addresses four principal topics: (1) risk 
communication as a discipline, (2) conceptual approaches, 
(3) applications and (4) trust. 

Risk communication occurs at national and company 
levels. At the latter level a company needs to communicate 
about risks both with its employees and with the public. In 
particular, risk communication is an essential part of 
emergency planning. More recently, legislative require¬ 
ments for the provision of information to the public have 
been introduced. Risk communication atthe national level is 
seen most clearly when opposition arises to developments 
such as hazardous installations or waste disposal sites. 

Risk communication in such a context is now recognized 
as a discipline, but its study is not well advanced. However, 
the need for a professional approach is clear. The Report 
comments that ‘One should no more release an untested 
communication than an untested product.’ It distinguishes 
four conceptual approaches to risk communication. One 
treats it within a technological framework in which there is 
one-way communication from the expert to the non-expert. 
The second emphasizes the need for a two-way dialogue. 
The third deals with the social and institutional context 
within which communication occurs and the actions, or 
inaction, as well as the words of the organizations involved. 
The fourth views risk communication as an aspect of the 
general political process. 

Atthe level of applications, some of the attempts made to 
provide reassurance by comparison of the risks of the 
activity in question with other, more familiar risks come in 
for criticism. It is suggested by Covello, Sandman and Slovic 
(1988) that if such attempts are made, they need to take into 
account the work described above on the principal qualita¬ 
tive dimensions by which people characterize hazards. 

Another aspect of applications is the layman’s mental 
model and the effect which this has on his response to 
risk communication. Using as a baseline an expert model, 
the layman’s model can be studied, and concepts which 
are erroneous or entirely absent identified. The attempt 
can then be made to clear away factual misunderstandings 
at least. 
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The credence placed in a communication about risk 
depends crucially on the trust reposed in the communicator. 
Wynne (1980,1982) has argued that differences over tech¬ 
nological risk reduce in part to different views of the 
relationships between the effective risks and the trust¬ 
worthiness of the risk management institutions. People 
tend to trust an individual who they feel is open with, and 
courteous to, them, is willing to admit problems, does not 
talk above their heads and whom they see as one of their 
own kind. 

Trust in a company depends on many factors and may be 
put at risk in a number of ways. Its general reputation may 
be undermined by persistent practice or by particular inci¬ 
dents. Distrust of the political process may rub off on the 
regulatory body. Risk assessment involves the treatment of 
uncertainties and mishandling can result in loss of trust. 

4.5 Risk Management 

‘Risk management’ is the term generally used to cover the 
whole process of identifying and assessing risks and set¬ 
ting goals and creating and operating systems for their 
control. An important input to risk management is risk 
assessment. Indeed the two terms are sometimes treated 
as synonymous. Generally, however, risk management 
is accorded a broader meaning to cover both a wider range of 
risks and a more complete set of activities. 

The hazards with which risk management is concerned 
include, in general, those from natural events and man¬ 
made systems that give rise to a range of physical, financial, 
legal and social risks. The main concern here is with the 
risks from technological systems. 

Risk management is practised at government as well as 
company level and, indeed, many of the important issues in 
risk management have to do with the design of the institu¬ 
tions required for public risk management and with the 
associated risk evaluation. 

4.5.1 Public risk management 

Ultimately it is up to the government to decide which 
activities can be allowed and which must he banned and 
how any disbenefits from the former are handled. Thus, the 


government is involved in risk management, but the extent 
to, and manner in, which it should be is a matter of debate. 

Many activities involve external ‘costs’ that are imposed 
on other parties. These externalities include danger and 
environmental pollution. A market solution is to require the 
party responsible to pay these costs. In the case of pollution, 
this is the principle of ‘polluter pays’. Another market 
approach is the use of insurance to pool risks. However, 
there are a number of difficulties in these approaches. The 
party responsible may not be readily identifiable and may 
have limited resources.This is illustrated by the difficulties 
in enforcing clean-up of hazardous waste sites. 

Insurance also has it problems. Insurers may be reluc¬ 
tant to provide cover for perils that are poorly defined 
such as pollution. Even where insurance is available, there 
are recognized problems. Adverse selection occurs where 
parties know their own risks better than the insurers and 
insure only the high risks. Moral hazard occurs where 
the possession of insurance lessens the incentive to reduce 
the risk. 

Public risk management is subject to two types of error. 
One is the prohibition of an activity or product that may be 
harmless; the other is failure to prohibit an activity or pro¬ 
duct which is harmful. By analogy with the terms applied to 
hypotheses, these two errors are termed Type I and Type II 
errors, respectively AType II error can lead to public outcry, 
whereas a Type I error, which may involve foregoing great 
economic benefit, is unlikely to do so. 

Risk management is practised not only at national level 
but at the supranational and local government levels also. 

The RSSG Report identifies nine types of institutional 
‘player’, as shown in Table 4.3. It describes the implications 
as follows: 

As soon as more than one organization enters the risk 
management scene, different priorities and preoccupa¬ 
tions must be resolved through bargaining. Problems of 
deadlock, jurisdictional tensions, ordering ofpreferences 
and varying levels of preference intensity become more 
acute. The policy ‘packaging’ processes involved in trad¬ 
ing preferences, particularly in multilevel bargaining 
situations such as those involved in EC decision-making, 


Table 4.3 Some types of player in institutional risk management (The Royal Society, 1992) (Courtesy of 
The Royal Society) 


Territorial 

level 


Institutional type 


Core executive 
bodies 

Independent 
public bodies 

Private or 
independent bodies 

Supranational 

Example: EC 

Example: EC 

Example: 


commission 

Court of Justice 

Greenpeace 

National 

Example: 

Example: 

Example: 


national 

national courts 

National 


Parliaments and 

and independent 

Associations of 


ministerial 

departments 

regulatory bodies, 
like the NR A a 

Insurers 

Subnational 

Example: 

Example: 

Example: 


state or local 

independent 

local firms and 


governments 

regional/local 
statutory bodies 

activists 


National Rivers Authority. 
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may result in outcomes that do not match the preferences 
of any of the negotiating parties. 

Many of the public bodies such as advisory committees 
concerned with risk management have an advisory rather 
than an executive role. In this they are analogous to a staff 
function in a company. 

The RSSG Report identifies the following four modes of 
operation available in public risk management: (1) infor¬ 
mation, (2) resources, (3) legislation and (4) direct action. 
Information is of particular importance in relation to emer¬ 
gency warnings of impending natural hazards, although 
the problem of liability for false alarms is a severe one. 
Where resources are required and unavailable elsewhere, 
the state may provide them, as in the clean-up of hazardous 
waste sites. Direct action, by police or other agencies, is 
largely limited to emergencies. 

The approach taken may rely on prevention or on mitiga¬ 
tion. For a major hazard at a fixed installation, this typically 
means either preventing an incident or providing an ade¬ 
quate distance between the plant and the public offsite. 
However, the applications of the two approaches are much 
wider. Mitigation, for example, may include financial com¬ 
pensation. 

4.5.2 Risk management rules 

Some of the dimensions of risk management systems have 
been studied by Ostrom (1986), as described in the RSSG 
Report. Table 4.4 shows six such dimensions and their 
characteristic trends. 

The boundary rules determine the parties allowed to 
participate in the risk management process. The decision 
process within the regulatory body typically involves the 
internal experts, consulting with approved expert groups; 
it is not readily accessible to other parties and becomes less 


so at supranational level. The boundaries are a matter of 
debate.They are challenged, for example, by interest groups 
seeking to participate. 

The scope rules determine the type of decision that the 
risk management body can take. Typical choices are fact¬ 
finding vs blame attribution, national vs international 
measures in sea and air transport, integrated pollution 
control vs control of particular vectors. 

The position rules determine the hierarchy and relation¬ 
ships of the decision points in the risk management struc¬ 
ture, including the power of appointment and dismissal. 
Thus, in the United Kingdom, many regulatory bodies are 
independent with direct accountability to Parliament, and 
Ministers are readily able to dismiss them. 

The information rules determine access to information. 
This has many aspects. The risk management system needs 
to be able to obtain information, such as the location of major 
hazard installations or sources of pollution, which it can 
obtain only by specific legislation. The public needs infor¬ 
mation on the hazards to which it is exposed and on what to 
do in an emergency. In this case, the information may be 
made available on a ‘right-to-know’ or a ‘need-to-know’ 
basis. Again, legislation is required to ensure this informa¬ 
tion is made available. 

The authority and procedural rules determine the 
mode of decision-making, its timing and the evidence 
admissible. Typical choices, or emphases, are adversarial vs 
inquisitorial procedures, anticipatory action vs incident 
investigation, and qualitative vs quantitative assessments. 

The preference-merging rules determine the process by 
which the individual inputs contribute to the collective 
decision. Two principal rules are unanimity and majority 
voting. Both are exemplified in the decision-making pro¬ 
cesses of the European Community (EC). 


Table 4.4 Some dimensions of, and putative trends in, risk management (Royal Society, 1992; after Ostrom, 1986) 
(Courtesy of de Gruyter Verlag and The Royal Society) 


Rule type 

Explication 

Range of key types 

Characteristic trends 

Boundary 

Who is counted 
as a player? 

Technocratic/ 

participative 

More 

participation 

Scope 

What is managed 
and what can be 
decided? 

Broad/narrow 

Extension of 
scope 

Position 

What is the 
hierarchy of 
players? 

Single 

organization/ 

multi-organization 

More multi-organizations 

Information 

Who is entitled 
to know what 
from whom? 

Open/closed 

More open 

Authority and 
procedure 

Under what 
conditions must 
decisions be made? 

Formal/informal 

More formal 

Preference 

merging 

How are 

individual 

preferences 

aggregated into 

collective 

decisions? 

Consensus 

(integration)/ 

conflict 

(aggregation) 

More conflict 






MAJOR HAZARD CONTROL 4/11 


4.5.3 Risk management issues 

The RSSG Report identifies, but does not attempt to resolve, 
seven areas of debate in risk management. These issues are: 
(1) anticipation, (2) liability and blame, (3) quantitative risk 
assessment (QRA), (4) institutional design, (5) risk reduc¬ 
tion costs, (6) participation and (7) regulatory goals. They 
are summarized in Table 4.5. For each issue, the Report pre¬ 
sents both sides of the argument, but with caveats that the 
issues are not usually so starkly posed, that opposing views 
are not necessarily irreconcilable and that one of the two 
viewpoints may be much more accepted than the other. The 
anticipation issue concerns the relative priorities to be given 
to prevention and to mitigation.The term‘anticipation’has a 
rather wide meaning and covers different aspects, depend¬ 
ing on the context. For accidents, anticipation has to do with 
the management systems which assure effective hazard 
control. For pollution, it has to do with caution in not 


permitting activities or products the effects of which are not 
fully known. Two complementary arguments are advanced 
against anticipation. One is that it is not totally effective, so 
that the alternative (resilience) is necessary anyway; the 
other is that emphasis on anticipation reduces the moti¬ 
vation and resources needed to promote resilience. 

The liability and blame issue concerns the desirability or 
otherwise of attributing blame where investigation of an 
incident indicates that someone has made an error. One 
school of thought argues that the prevention of incidents 
requires strict discipline and the attribution of blame for 
error, whilst the other holds that incidents arising from 
human error are conditioned by the work situation and that 
the rectification of defects in that situation requires the free 
flow of information which is inhibited by a blame culture. 

Studies are quoted to the effect that such information 
flow is essential to the efficient functioning of complex 


Table 4.5 Some issues in risk management (Royal Society, 1992) (Courtesy of The Royal Society) 


Doctrine 

Justificatory argument 

Counter-docirine 

Justificatory 

argument 

Anticipationism 

Apply causal knowledge 
of system failure to 
ex ante actions for better 
risk management 

Resilienism 

Complex system 
failures not 
predictable in 
advance and 
anticipation makes 
things worse 

Absolutionism 

A'no-fault’ approach 
to blame avoids 
distortion of 
information and 
helps learning 

Blamism 

Trageted blame 
gives strong 
incentives for 
taking care on the 
part of key 
decision-makers 

Quantificationism 

Quantification 

promotes 

understanding and 
rationality, exposes 
special pleading 

Qualitativism 

Proper weight 
needs to be given 
to the inherently 
unquantifiable 
factors in risk 
management 

Designism 

Apply the 
accumulated 
knowledge 
available for 
institutional design 

Design 

agnosticism 

There is no secure 
knowledge base 
or real market for 
institutional design 

Complementarism 

Safety and other 
goals go hand in 
hand under good 
management 

Trade-offism 

Safety must be 
explicitly traded 
off against 
other goals 

Narrow 

participationism 

Discussion is most 
effective when 
confined to expert 
participants 

Board 

participationism 

Broader 

discussion, better 
tests assumptions 
and avoids errors 

Outcome 

specificationism 

The regulatory 
process should 
concentrate on 
specifying 
structures or 
products 

Process 

specificationism 

The regulatory 
process should 
concentrate on 
specifying 
institutional 
processes 






4/12 MAJOR HAZARD CONTROL 


organizations (Laporte, 1982; K.H. Roberts, 1989; 
K.H. Roberts and Gargano, 1989). Mention is made of the 
explicit adoption of a no-blame policy by Shell International 
(1988). 

The argument concerning blame also extends to the cor¬ 
porate level. In 1990, a suit was brought against P&O Ferries 
for corporate manslaughter in respect of the sinking of the 
Herald of Free Enterprise. This case collapsed, but it may 
well indicate a trend. 

The QRA issue concerns the contribution of QRA to 
decision-making about risks. Supporters of QRA advance it 
as an aid to, though not the sole determinant of, rational 
decision-making and argue that it is an effective means of 
understanding complex technological systems, and also 
natural hazards, and that there is no real alternative method 
of ordering priorities. The opponents’ critique develops two 
main themes. One is that QRA contains value judgements 
that are not made explicit. The other is that QRA is beset by 
uncertainty, which extends not just to values of the para¬ 
meters but to the whole structure and completeness of the 
assessment. The more radical argue that QRA is liable to 
mislead and is positively harmful. 

The institutional design issue concerns the feasibility of 
designing institutions for risk management and the extent 
to which good practice in this area can be defined. Changes 
in risk management systems are typically among the prin¬ 
cipal recommendations of accident inquiries. Those who 
believe good practice can be articulated refer to the safety 
management systems and safety culture in major com¬ 
panies such as those in the oil and chemical industries. 
Sceptics point to wide differences of practice, or even con¬ 
tradictory practices, which they perceive to yield similar 
outcomes, such as the blame and no-blame cultures men¬ 
tioned earlier. 

The risk reduction cost issue concerns the cost of risk 
reduction and trade-offs of risk against other goals. One 
view is that reduction of risks incurs additional costs and 
that there has to be a trade-off between risk reduction and 
other goals. The types of risk cover a wide spectrum, 
including both safety and environmental risks. The oppos¬ 
ing viewpoint is essentially that good practice in respect of 
risks is generally profitable also, but the arguments that 
support this appear to differ, depending on the type of risk 
considered. In safety, the argument is that the good man¬ 
agement that ensures high safety also delivers high profits. 
In terms of the environment, the argument relies rather on 
examples where the move to more environmentally friendly 
products appears not to have disadvantaged the company. 

The participation issue concerns the extent of participa¬ 
tion appropriate in risk management. The general proposal 
for wider participation embraces a number of different 
types of participant and does so for different reasons. Thus, 
it is suggested that human factors experts should partici¬ 
pate more in engineering projects to avert the problems 
which otherwise are liable to arise. Participation by lay 
groups is held to force consideration of wider issues and to 
improve the quality of the decision-making in large tech¬ 
nological proj ects. Another argument for the involvement of 
the latter is to improve public accountability and to broaden 
the base of those committed to the project. Others are more 
sceptical and fear that the process is liable to result in less 
rational decisions and to dispersion of responsibility. 

The regulatory goals issue concerns the emphasis to be 
placed on outputs and on process in respect of risks. The 
engineering, and regulatory, culture tends to concentrate on 


outputs in the form of physical products or systems. These 
are typically designed with safety margins which are 
implicitly based on doing what is ‘practical’ and ‘reasonable’. 
Critics argue that the risks of these outputs are subject to 
such uncertainty that this approach is inadequate, and call 
for more emphasis on process by the application of quality 
management concepts. 

As stated earlier, whilst it is convenient for purposes of 
exposition to present these viewpoints as thesis and 
antithesis, there is on all these issues a spectrum of views, 
and in many cases a synthesis can be envisioned. 

4.5.4 Cost-benefit analysis 

The RSSG Report contains an appendix on cost-benefit 
analysis in relation to risks by Marin (1992), with particular 
emphasis on risks to people. The application of cost -benefit 
analysis to such risks is based on the principle of reducing 
the risks until the marginal cost equals the marginal ben¬ 
efit. In order to do this, costs and benefits have to be 
expressed in the same units, which means in money terms. 

The first requirement is therefore to devise methods of 
estimating the ‘value of a statistical life’ or for short, the 
‘value of a life’. Marin describes both the wide variety of 
approaches that have been used and the perceived ethical 
problems. The process of putting a price on life is apt to 
appear cold-blooded or even unethical. In practice, the allo¬ 
cation of scarce resources demands ordering of priorities. 
Administrative decisions are constantly being made in 
which a value is placed on life, if not explicitly then implic¬ 
itly. Thus, at present, society mainly leaves this problem 
in the hands of special groups. 

There are certain approaches to the determination of the 
value of a life that have not proved fruitful. One is to base the 
assessment on the individual’s earning power, the ‘human 
capital’ approach. This implies that those who cannot work, 
for whatever reason, are without value and are unethical. 
It is also incompatible with the normal approach in cost - 
benefit analysis, which is to ascertain what the course of 
action proposed is worth to the person(s) affected. On the 
other hand, it is also not helpful to ask an individual what 
sum he would be prepared to pay in exchange for his life. 
This sum may be regarded as infinity. 

A more fruitful approach is to consider small increments 
of risk and then determine what people will pay to eliminate 
these. Two main methods are available to make this deter¬ 
mination. One is to ask people, the other is to observe their 
behaviour. Typical studies make comparisons of choices 
such as those between modes of transport or between jobs of 
different degrees of safety. 

Marin quotes two UK studies which both put the value 
of a life at £3 million at 1990 values, one based on 
fatal accident rates in different occupations (Marin and 
Psacharopoulos, 1982) and the other on willingness to pay 
for improved safety (Qones-Lee, Hammerton and Philips, 
1985). For comparison, the estimate given based on the 
human capital approach is about £235,000. 

It is also possible to consider large increments of risk, in 
particular those that are at the threshold where they are 
not acceptable to the individual, whatever the financial 
compensation. This aspect is not well developed, but it is 
relevant to situations such as those which occur in nuclear 
accidents where people may be asked to do work in condi¬ 
tions where the levels of radiation are high. 

Modes of fatality, non-fatal injury and age pose further 
problems in determining the value of a life. 
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4.6 Hazard Control Policy 

It is appropriate at this point to consider some of the ele¬ 
ments that go to make up a hazard control policy. An account 
of this has been given in Hazard Control Policy in Britain 
(Chicken, 1975). The legislation referred to is that current 
atthetime.Chickenconsidersfivefieldsthatillustratehazard 
control policy. These are (1) road transport, (2) air transport, 

(3) factories, (4) nuclear power and (5) air pollution. These 
fields represent very different hazard control situations. 

His argument runs as follows. In road transport, hazard 
control is mainly by legislation aimed at general improve¬ 
ment. Research is conducted by the Road Research Labora¬ 
tory (RRL), manufacturers are encouraged to improve 
design standards, road construction takes account of safety 
knowledge and compulsory testing of vehicles is required. 

Air transport, by contrast, is controlled not only by leg¬ 
islation (Civil Aviation Act 1971) but by a strict system of 
licensing operated by the Civil Aviation Authority (CAA). 
Aircraft are technologically much more complex and give 
rise to hazards that provoke much greater public outcry. The 
hazards are subjected to quantitative assessment and are 
reduced to a minimal level by sophisticated technology. 

Control of factories is carried out through legislation 
(Factories Act 1961) which is enforced by a rather thinly 
spread inspectorate. The level of technology, the degree of 
hazard and the sophistication in control vary widely. 

Nuclear power is again controlled not only by legislation 
(Nuclear Installations Act 1965) but by a strict licensing 
system operated by a well-staffed Nuclear Installations 
Inspectorate. Again, nuclear reactors are technologically 
complex and constitute major hazards, and full hazard 
assessment and control is carried out. 

Control of air pollution by legislation (Alkali etc. 
Works Regulation Act 1906, Clean Air Acts 1956 and 1968) 
is enforced again by a somewhat thinly spread Alkali Inspec¬ 
torate. 

Thus, arrangements for hazard control for factories and 
for air pollution are rather similar, but they are very differ¬ 
ent from those for air transport and nuclear power, which 
are also similar. The situation in road transport does not 
constitute a hazard control arrangement in the same sense. 

It is apparent that there are wide differences in the 
voluntary component in these policies. In general, this is 
greatest where a large number of units are involved, where 
the controls were first applied to an established activity, 
where other regulatory bodies such as local authorities are 
involved and where there are strong interest groups. 

Thus, the controls are most stringent in air transport and 
nuclear power, where the number of units or operators is 
small, the activity is a relatively new technology, there is 
strong central government involvement and interest groups 
opposing regulation are absent. It is relevant to note also 
that these are the two high technology activities considered. 

The elements of hazard control policy are (1) identifica¬ 
tion, (2) legislation and control arrangements, (3) research, 

(4) consultative arrangements and (5) priorities in resource 
allocation. 

Hazard control policy appears to develop in response 
to (1) demands for improved control, (2) developments 
in hazard reduction; (3) defects in existing policies and 
(4) developments abroad. Study of the way in which hazard 
control policy evolves indicates that the initiating role of 
political parties and Parliament is relatively small and that 
it is most directly influenced by the Civil Service in the 


departments primarily involved, with the various inspec¬ 
torates playing a leading role.When major developments are 
being considered, extensive use is made of independent 
specialist committees, such as the Edwards Committee on 
Air Transport or the Robens Committee on Health and 
Safety at Work. It is largely through these committees that 
the interest groups are able to influence policy 

Interest groups have an important role to play in the 
development of hazard control policy The study of interest 
groups is a well-established aspect of social science (e.g. 
Moodie and Studdert-Kennedy, 1970; G.K. Roberts, 1970; 
Wootton, 1970). Wootton classifies interest groups as eco¬ 
nomic (e.g. Confederation of British Industry (CBI)), inte¬ 
grative (e.g. Institution of Chemical Engineers) or cultural 
(e.g. National Trust), and as first, second or third order, 
depending on whether they operate at local, regional or 
national level. This role is well illustrated by the proceed¬ 
ings of the Robens Committee, whose report contains much 
material from such organizations. 

It is suggested by Chicken (1975) that the most influential 
interest groups are the economic (e.g. industrial) and inte¬ 
grative (e.g. professional) groups that operate at national 
level.While this is no doubt true in terms of detailed positive 
recommendations, the effect of agitation by local groups 
and of news media campaigns by groups at all levels on the 
general spirit in which policy-makers approach their task 
should not be underestimated. 

The broad conclusions of this study remain valid. 


4.7 Nuclear Hazard Control 

Hazard control is well established in nuclear energy, which 
is an obvious model for control of chemical industry 
hazards. It is helpful, therefore, to consider briefly the 
arrangements in the nuclear industry A short account of 
nuclear energy is given in Appendix 20 and the treatment 
here is confined to hazard control policy for the industry. 

One of the principal features of the control of nuclear 
hazards is the role played by hazard assessment. Many of 
the hazard assessment techniques used in the process 
industries were developed in the nuclear industry. Nuclear 
hazard assessment is one of the topics discussed in 
Appendix 20. 

Selected references on nuclear hazard control are given in 
Table 4.6. 

4.7.1 Nuclear plant licensing 

The early work on nuclear energy in the United Kingdom 
was for military purposes and was controlled by the Min¬ 
istry of Supply, but in 1954, the UK Atomic Energy Author¬ 
ity (UKAEA) was established and began to operate nuclear 
power reactors at Calder Hall. Although these were again 
primarily for defence, they confirmed the feasibility of 
nuclear power. In 1958, the Central Electricity Generating 
Board (CEGB) was created and became the main operator of 
nuclear power reactors. These two operators were later 
joined by two others, the South of Scotland Electricity 
Board (SSEB) and British Nuclear Fuels Ltd (BNFL). 

The responsibility for the control of nuclear power reac¬ 
tors was shared between the UKAEA and the Nuclear 
Installations Inspectorate (Nil). The Atomic Energy Act 
1954, which established the UKAEA, gave the latter 
responsibility for the safety of its own reactors. Reasons for 
this rather unusual arrangement include the facts that the 
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Table 4.6 Selected references on nuclear hazard 
control (see also Table A20.1) 


Nuclear hazard assessment and control 

NRC (Appendix 28 Regulation); F.R. Farmer (1967a,b, 
1969a,b, 1970,1971); Dale and Harrison (1971); F.R. Farmer 
and Gilby (1971); Kirk and Taylor (1971); Weinberg (1972b); 
Gronow and Gausden (1973); EPA (1974); Karam and 
Morgan (1974); AEC (1975); Chicken (1975); Freudenthal 
(1976); Rust and Weaver (1976); Fussell and Burdick (1977); 
HM Chief Inspector of Nuclear Installations (1977); HSE 
(1977c, 1992d); NRC (1977a-c); Fremlin (1978,1983); Hig- 
son (1978); R.J. Parker (1978); E.E. Lewis (1979); I.K.G. Wil¬ 
liams (1979);Windscale Local Liaison Committee (1979); 
Bradbury (1980); Fells (1980,1981); Joksimovic and Vesely 
(1980); Pentraeth (1980); Strong and Menzies (1980); 
Charlesworth etal. (1981); D. Pearce (1981); Sagan (1981); 
Schrader-Frechette (1981); Chicken (1982); Openshaw 
(1982); Amendola (1983a,b); R.F. Griffiths (1984b); C.Tayler 
(1985f); UKAEA and BNFL (1985); Lester (1986); TUC 
(1987); Andrews (1988); Solomon and Kastenberg (1988); 
Ballard (1989); Carnino etal. (1990); Wu and Apostolakis 
(1992) 

Debate, critics, public relations 

Weil (n.d.); Hedgpath (1965); Bryerton (1970); Novick 
(1970); R. Lewis (1972); Metzger (1972); Dunster (1973); 
Gofman and Tamplin (1973); Cochran (1974); Ebbin and 
Kasper (1974); Kendall and Moglewer (1974); Kendall (1975); 
Lovins (1975,1977); Primack (1975); J. Hill (1976,1979b); 
Patterson (1976,1988); Brookles (1977); Hayes (1977); 
Icerman (1977); Puiseaux (1977); Breach (1978); Foley and 
van Buren (1978); Grossman (1980); Nickel (1980); Sweet 
(1980); Dunster (1981); Hewlett (1982); B.L. Cohen (1983, 
1989); Canned and Chudleigh (1984); T. Hall (1986); 

McGill (1987); VC. Marshall (1988b); Aubrey (1991); 

Slovic et al. (1991) 


initial purpose of the UKAEA was to produce nuclear 
weapons and that the UKAEA had virtually all the experts. 
The coincidence of the occurrence in 1957 of the Windscale 
incident and of the creation in 1958 of the CEGB, which was 
to operate nuclear power reactors for civil use, led the Fleck 
Committee, which investigated the former, to recommend a 
separate nuclear inspectorate. The Nuclear Installations 
(Licensing and Insurance) Act 1959 created the Nil and also 
laid down that reactors other than those of the UKAEA 
must be insured to cover all claims which might arise from 
the release of radioactivity. The situation that developed 
was one in which the UK AEAwas responsible for the safety 
of its own reactors, with the Nil controlling other nuclear 
reactors through a licensing system. 

The nuclear licence that the operator of a nuclear power 
reactor is required to obtain represents a very stringent 
system of control. The licensee must furnish design and 
operating documents that effectively cover all aspects of the 
design and operation of the reactor. A Nuclear Safety Com¬ 
mittee must be created to advise the licensee and the names 
and qualifications of the persons nominated submitted to 
the Minister for approval. Individuals must also be nomi¬ 
nated as Competent Persons to execute particular tasks. 

Licensing is not a once-for-all affair but an on-going pro¬ 
cedure. The first stage in the granting of a licence is simply 
the permission, in principle, to use a particular piece of land 


for a nuclear power reactor. Subsequent stages result in the 
granting of permission to build and to operate. Inevitably 
the licensee will wish to make changes in design features, 
operating procedures and nominated personnel, and these 
must then be agreed with the licensing authority. 

This licensing system has some characteristic features 
that are important in relation to hazard control. It is flexible 
and adaptable to change and avoids the disadvantages of 
general and often irrelevant regulations, but it is highly 
detailed and involves considerable effort in making chan¬ 
ges. And it makes heavy demands on manpower both for the 
licensee and the controlling authority. It also inevitably 
tends to shift some of the responsibility from the operator to 
the inspectorate. It is a highly effective but resource inten¬ 
sive system. 

The particular approach taken to the control of nuclear 
hazards reflects the uncertainties in the early days of 
nuclear energy, say the mid-1950s, about the hazards of this 
very high technology industry. It is debatable how applic¬ 
able this approach is to other hazards. 

4.7.2 Nuclear plant siting 

In the United Kingdom, the sites that might be used in a 
power network vary by a factor of 10 at most in population 
density. Hazard assessments for nuclear plants are accurate 
only within a similar factor. Thus, reactors cannot be mat¬ 
ched to sites with any precision. In effect, the design must be 
to a standard which, it may be argued, then permits com¬ 
plete freedom of siting. 

Hazard assessments have been presented by F.R. Farmer 
(1967a,b, 1971) to support the relaxation of the historical 
restrictions requiring remote siting and to permit siting 
nearer urban areas. However, it is not government policy to 
allow this degree of freedom in siting nuclear plants. The 
siting of nuclear reactors in or near large centres of popula¬ 
tion is not permitted. A major determinant of this policy is 
the difficulty of devising effective emergency counter¬ 
measures to the hazards of a radioactive release. 

An account of UK siting policy is given by Gronow and 
Gausden (1973). 

4.7.3 Nuclear safety case 

An important feature of the nuclear licensing system is the 
safety case. The nuclear safety case is broadly similar, 
mutatis mutandis, to the process safety case described 
below. 

The safety issues to be addressed are outlined in Nuclear 
Safety. Safety Assessment Principles for Nuclear Reactors 
(HSE, 1979d) and, for pressurized water reactors, in PWR 
(HSE, 1979e). 

Quantification of the risks has long been a feature of the 
nuclear safety case. The evaluation of these risks is 
addressed in The Tolerability of Risks from Nuclear Power 
Stations (HSE, 1988c). 

4.8 Process Hazard Control: Background 

The growth of major industrial hazards, especially those 
associated with the process industries, and the means 
of controlling them, was one of the main concerns of 
the Robens Committee. The subsequent Health and 
Safety at Work etc. Act 1974 (HSWA) provides a much 
improved framework for control. Even before this, aDepart- 
ment of the Environment (DoE) circular DoE 72/1 had drawn 
attention to the need to take account of major hazards in 
planning. 
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The disaster at Flixborough in 1974 caused a great surge 
of public concern over such hazards and represents a 
watershed as far as process industry hazards are con¬ 
cerned. Following Flixborough, the Health and Safety 
Commission took certain steps to improve control of major 
hazard installations. A Major Hazards Unit was set up 
within the HSE and an Advisory Committee on Major 
Hazards (ACMH) was appointed. Within the Major Hazards 
Unit, a Risk Appraisal Group (RAG) was formed to give 
advice to local planning authorities (LPAs) on planning 
applications for major hazard installations. The super¬ 
vision of these installations by the Factory Inspectorate was 
intensified. These arrangements were interim measures 
taken pending the recommendations of the committee. 

Selected references on major hazard control in the process 
industries are given in Table 4.7. 


Table 4.7 Selected references on major hazard 
control in the chemical industry 


Harvey (1976,1979b, 1984); Solomon (1976); Fairley and 
Mosteller (1977); Lees (1977b, 1980d, 1982c); Locke (1977); 
Napier (1977b); Schenkel (1977); Wakabayashi (1977); 
AERA (1978 Harwell Environmental Seminar 1,1979 
Harwell Environmental Seminar 2); Cremer and Warner 
(1978);Yaroch (1978); Schoch (1979); Beveridge (LPB 31 
1980); Levitt (1980); Kunreuther etal. (1981); Barrell and 
Scott (1982); F.R. Farmer (1982); Helsby etal. (1982); 
Kunreuther and Ley (1982); Labour Inspectorate (1982); 
Lagadec (1982); VC. Marshall (1982b, 1982 LPB 46,1985, 
1987,1988c, 1989c, 1990d); Pantony and Smith (1982); 
Ramsay etal. (1982); Pape (LPB 511983); Anon. 

(1984b,m,w); Crossthwaite (1984,1986); Hawksley (1984); 
Kunreuther (1984); DJ. Lewis (1984f); Anon. (1985h); 
Barrel (1985,1990,1992); Beveridge and White (1985); 

K.R. Davies (1985); Dewis (1985a); ILO (1985a, 1989,1991); 
R. King (1985); C. Martin (1985); Merriman (1985); Moysen 
(1985); Otway and Peltu (1985); Wang (1985); Anon. (1986z); 
Air Pollution Control Association (1986); J.C. Consultancy 
Ltd (1986); Raman, Stephens and Haddad (1986); Slater 
et al. (1986); Pate-Cornell (1987); Ripple (1987); J.G. Collier 
(1988); HMCIF (1988b); Withers (1988); Challis (1989); 
Machida (1990); van Mynen (1990); Renshaw (1990); 
Shortreed (1990); Zimmerman (1990); Keller and Wilson 
(1991); Crawley etal. (1992); A.J.Williams (1992); 

Donegani and Jones (1993); Rimington (1993); Rosenthal 
(1993); CEC (1994) 

Natural gas, liquefied natural gas (LNG) 

US Congress, OTA (1977); Cofield (1978); DoEn (1978); UN 
(1978); Sutcliffe (1980); Kunreuther et al. (1981) 

Community involvement, citizen groups, public 
relations (see also Table 9.1) 

Chopey (1967b); F.C. Price (1974b); Sutcliffe (1980); 
Rodgers (1987); Buzelli (1990); Delbridge (1990); Poje 
(1990); Grollier-Baron (1992c); Marsili.Volloni and Zaponi 
(1992); Renn (1992); The Royal Society (1992) 


Planning 

DoE (1972 Circular 1/72,1980 Circular 22/80,1983,1984a-c, 
1984 Circular 22/84); Anon. (1975h); Harvey (1976,1979b, 
1984); Salter and Thomas (1981); Anon. (1984w); 
Crossthwaite (1984,1986); IBC (1984/57); Pape (1984); 


Petts (1984a,c, 1985a,b, 1987,1988a, b, 1989,1992); Milburn 
and Cameron (1992); C. Miller and Flicker (1993) 

Planning inquiries: Sieghart (1979); Barker (1984); Wang 
and Parker (1984); Petts (1985a,b); Petts etal. (1986) 
Mossmorran: Barrell (1988b); Sellers (1988) 

Safety cases 

Cassidy (1987,1988a-c, 1989,1990); R. Clark (1987); Dyson 
(1987); Eberlein (1987); Hawksley (1987); Orrell and Cryan 
(1987); CIA, Chlorine Users Group (1989); R. Clark etal. 
(1989); FMA (1989); Fullam (1989); Lees and Ang (1989b); 
Pape (1989); Petts (1989); Singleton (1989); IBC (1995/115); 
Fullam (1995); Myers (1995) 

Safety cases and environment: Cassidy (1990) 

Offshore (seeTable A18.1) 

USA 

Brooks etal. (1988); Keffer (1991) 

Germany 

Kirsch (1979); Nagel etal. (1979); Anon. (1980w); Kremer 
(1981); Land Nordrhein-Westfalen (1981); Schleifenbaum 
(1981);Wohlleben and Vahrenholt (1981); Braubach (1982); 
Pilz (1982,1987,1989) 

The Netherlands 

Meppelder (1977); van de Putte and Meppelder (1980); van 
de Putte (1981,1983); Versteeg (1988); Husmann and Ens 
(1989); Oh and Husm a nn (1988); Oh and Albers (1989); Ale 
(1991,1992); Bottelsburgh (1995) 


4.9 Process Hazard Control: Advisory Committee 
on Major Hazards 

The ACMH under the chairmanship of Professor B.H. Harvey, 
a former Deputy Director-General of the HSE, was set up 
soon after Flixborough in 1974.The terms of reference of the 
committee were: 

To identify types of installations (excluding nuclear 
installations) which have the potential to present major 
hazards to employees or to the public or the environment, 
and to advise on measures of control, appropriate 
to the nature and degree of hazard, over the establish¬ 
ment, siting, layout, design, operation, maintenance and 
development of such installations, as well as over all 
development, both industrial and non-industrial, in the 
vicinity of such installations. 

The work of the Committee, which ended in 1983, is descri¬ 
bed in the three Reports of the ACMH (Harvey, 1976,1979b, 
1984). Some of the main themes of these reports are given in 
Table 4.8. The first task of the Committee was to define, or 
rather identify, major hazards. It concluded that, with few 
exceptions, a major hazard arises only if there is a release 
from containment. The hazard that then arises is a release 
that is flammable, toxic or both. A flammable release may 
give rise to a jet or pool fire or a fireball, or the vapour cloud 
may burn as a flash fire, or it may give a vapour cloud 
explosion. 

Although there is little in the three reports on numerical 
risk criteria, the discussion on identification of major 
hazards in the First Report does contain the following 
statement: 

Since we cannot achieve or expect to achieve no risk of 
failure in any of the areas discussed, we feel bound to put 
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Table 4.8 Some principal themes in the reports of 
the Advisory Committee on Major Hazards 


First Report 1976 

Identification of major hazards 
Notification of major hazard installations 
Review of types of regulatory control 
Control of major hazards by self-regulation 
Monitoring of control by the HSE 
Management of major hazards 
Prevention of loss of containment 
Design and operation of pressure systems 
Limitation of hazardous inventory 
Limitation of exposure 
Planning controls for major hazards 

Second Report 1979 

Notification of major hazard installations 
Comparison of theoretical potential and historical 
experience 

Bounds on consequences of major releases 
Unconfined vapour cloud explosions 
Limitation of exposure of workforce 
Design and location of control rooms 
Planning controls for major hazards 
Research on major hazards 
Model licence conditions 

Third Report 1984 

Discussion of risk 

Role of quantitative assessment 

Inherently safer design 

High reliability plant 

Monitoring of warning events 

Separation of major hazards and public 

Information to the public 

Emergency planning 

Planning controls for major hazards 

Education of engineers and scientists 

Research on major hazards 


forward some quantitative objective. If, for instance, 
such tentative conclusions indicated with reasonable 
confidence that in a particular plant a serious accident 
was unlikely to occur more often than once in 10000 years 
(or - to put it another way - alinlOOOO chance in any one 
year), this might perhaps be regarded as just on the bor¬ 
derline of acceptability, bearing in mind the known 
background of risks faced every day by the general 
public. 

The first step in the control of major hazards was clearly 
that they should be notified, and an outline notification 
scheme was presented in the First Report. The principle 
adopted was notification of hazardous substances above a 
certain level of inventory. It was recognized that inventory is 
by no means the only factor that determines the hazard, but 
it was nevertheless adopted as the basis because it is simple 
to administer. Other characteristics of the materials were to 
some extent taken into account by the pragmatic approach 
of specifying different inventories for the principal hazard¬ 
ous materials. 

At this basic level of inventory, only notification was 
proposed, but it was envisaged that for a level of inventory 
10 times the notification level, a hazard survey would be 


required and that the HSE would also have the further 
power to call for a detailed assessment if it judged this 
necessary. The Committee held strongly to the view that it 
should set priorities and should confine its proposals to 
major hazards. It was appreciated that the various cut-offs 
were to some degree arbitrary. 

The Committee strongly endorsed the principle of self¬ 
regulation by industry that it considered particularly 
appropriate to major hazard plants with their high level of 
technology. Self-regulation is a constant theme in the 
reports. The arrangements proposed for the control of major 
hazards are therefore intended to be part of a continuum of 
controls for all types of hazard under the HSWA and to avoid 
introducing a discontinuity specifically for major hazards. 
On the other hand, it was clear that the community expects 
not only that such hazards should be under control but also 
that they should be seen to be so. Consequently, the view 
was taken that some form of monitoring by the HSE was 
necessary. 

The First Report also began consideration of the mea¬ 
sures necessary to prevent major accidents, against the 
background of Flixborough. Here the factor on which the 
Committee placed most emphasis was the management. 
Unless the management is competent to operate a major 
hazard plant, other measures are likely to be rendered inef¬ 
fective. 

The Flixborough explosion occurred because the plant 
held a very large inventory of flammable material that on 
release would undergo partial flashing to form a vapour 
cloud. The report takes up the theme of the need to limit 
such hazardous inventories. Given that the plant does con¬ 
tain an inventory of such material, it must he the aim of 
management to avoid loss of containment. 

The design and operation of pressure systems is therefore 
of particular importance. Here the report places emphasis 
on pressure systems, including pipes, valves, pumps, etc., 
as well as pressure vessels and on operation as well as 
design. 

The Committee held strongly to the view that planning 
powers even for developments involving major hazards 
should continue to reside with the LPA. There are many 
factors besides safety which affect the planning decision 
and which need to be taken into account in arriving at a 
balanced decision and only the LPA is able to do this. 

The Committee also identified the problems in planning 
control over major hazards. These largely centre around 
the definition of ‘development’ in the Town and Country 
Planning Act 1971 (TCPA). The preferred solution was to 
amend the Act, but the implications of a change in definition 
were very far-reaching, and alternative though less satis¬ 
factory proposals were also made. A major difficulty in 
planning identified in the report is that of the compensation 
due if planning permission already granted is revoked. The 
sums involved can be very large. 

The Second Report gave revised proposals for notifica¬ 
tion. This revision took into account the problem of ultra¬ 
toxic materials, which had been highlighted by the Seveso 
disaster. Various models of regulatory control were con¬ 
sidered, including those for the nuclear industry, mines and 
pharmaceuticals. The possibility of a licensing scheme 
similar to that applied to nuclear installations was given 
particular consideration but, in the event, the Committee 
decided against licensing. 

Much of the work described in the report is concerned 
with comparison of theoretical estimates of major hazard 
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scenarios with historical experience and with putting some 
bounds to the effects to be expected from major releases. 
The problem is that, for some hazards, taking the most 
pessimistic scenarios and models yields theoretical esti¬ 
mates of casualties that are very high and barely credible 
in the light of the historical record. Work on this aspect 
included collection of incident data and development of a 
mortality index relating the number of fatalities to the 
quantity released historically. Work was also done to set 
some bounds on the range of certain specific hazards which 
it seemed might have lethal effects at rather far distances, 
such as vapour cloud explosions and glass breakage. The 
Flixborough disaster was a vapour cloud explosion, and the 
report goes into some detail on the technical aspects of such 
explosions and on methods of estimating their effects. 

The influence of Flixborough is also seen in the propo¬ 
sals in the report on the design and location of control rooms 
for major hazard plants. It became apparent in considering 
control rooms that this problem is part of the wider question 
of the limitation of exposure of the workforce. The report 
gives detailed recommendations for limitation of exposure 
both by location of the work base and by control of access to 
the high hazard zone. 

The vapour cloud explosion problem highlighted the fact 
that many major hazard phenomena were imperfectly 
understood. Another important problem area was that of 
heavy gas dispersion. The Committee therefore gave 
encouragement to research on these topics. 

Background studies to the reports are described by 
V.C. Marshall (1976a,c, 1977b, 1978,1980d, 1982d, 1987). 

The Second Report gives as an appendix a set of model 
licence conditions for a possible licensing scheme for major 
hazard plants. Although the Committee did not in fact opt 
for licensing, it retained the model licence conditions and 
proposed that these be used as a kind of code of practice for 
such plants. These model licence conditions are given in 
Appendix 24. 

TheThird Report opens with a discussion of risk. It does 
not give any specific numerical criteria, but states certain 
principles which may assist in deriving such criteria. The 
report brings together the overall system of hazard control 
proposed by the Committee. The essential elements are 
identification, avoidance and mitigation of the hazard and 
planning for it. In the context of hazard identification, it 
gives a discussion of the historical development of quanti¬ 
tative hazard assessment in the process industries and of its 
role in major hazard control. 

The report gives support to the avoidance of hazard by 
inherently safer design, a generalization of the earlier 
theme of limitation of inventory. 

It also discusses the measures necessary to ensure high 
plant reliability. Another aspect of avoidance is the mon¬ 
itoring of and learning from warnings, specifically the 
application of hazard warning concepts. 

Measures to mitigate consequences which are discussed 
in the report are separation distances between the hazard 
and the public and emergency planning. The committee 
broadly endorsed methods then being devised by the HSE 
for the control over development at major hazard sites aimed 
at stabilizing and, where practical, reducing the population 
at risk. 

The Committee took the view that, although a major 
hazard plant should be designed to high standards, it is 
nevertheless prudent to seek to have some separation 
between the plant and the public as a further line of defence. 


This may be regarded as the extension to the public of the 
principle of limitation of exposure applied earlier to the 
workforce. 

Both the Second and Third Reports re-echo the basic 
proposals on planning outlined in the First Report. The 
Third Report calls again for research on major hazards and 
also for education on major hazards for the engineers and 
scientists who are likely to have responsibility for major 
hazard plants. 

4.10 Process Hazard Control: Major Hazards 
Arrangements 

The first legislative initiative in response to the ACMH’s 
recommendations was proposals for the Hazardous Instal¬ 
lations (Notification and Survey) Regulations 1978. These 
draft regulations contained requirements for the notifica¬ 
tion of installations holding a specified inventory of listed 
hazardous materials and for a hazard survey for installa¬ 
tions containing 10 times the notifiable level. 

These legislative proposals were overtaken by the EC 
Directive on the Major-Accident Hazards of Certain Indus¬ 
trial Activities 1982 (82/501/EEC) (the Major Accident 
Hazards Directive) and were never implemented. They were 
replaced by two sets of regulations, the Notification of 
Installations Handling Hazardous Substances Regulations 
1982 (NIHHS) and the Control of Industrial Major Accident 
Hazards Regulations 1984 (CIMAH). 

4.10.1 NIHHS Regulations 1982 

The NIHHS Regulations implement a notification scheme 
based on the ACMH proposals and similar to that of the 
original Hazardous Installations Regulations proposals. 
They are confined essentially to notification and do not 
contain requirements for a hazard survey, which is now 
covered by the CIMAH Regulations. The NIHHS Regula¬ 
tions provide for the notification of the installations which 
the authorities in Britain wish to see notified and provide 
the basis for planning controls over these installations. The 
schedule of hazardous installations is given in Table 4.9. 
A critique of inventory levels for substances covered by the 
NIHHS Regulations is given by D.C. Wilson (1980). 

4.10.2 CIMAH Regulations 1984 

The CIMAH Regulations are confined to those require¬ 
ments necessary to implement the EC Directive. The 
industrial activities covered by the regulations are defined 
in terms of processes and of storage involving specified 
hazardous materials. 

The EC Major Accident Hazards Directive 1982 has been 
amended twice, in 1987 (87/216/EEC) and in 1988 (88/610/ 
EEC). The first amendment, prompted by the disastrous 
toxic release at Bhopal, made a revision of some of the 
threshold inventories. The second, following the pollution 
of the Rhine by chemicals from the Sandoz warehouse fire, 
modified the controls on storage. These amendments of the 
Directive were implemented by amendments to the CIMAH 
Regulations in 1988 and 1990. 

The regulations apply to defined industrial activities 
(Regulation 2). There are certain activities to which the 
regulations do not apply, notably defence, explosives and 
nuclear installations (Regulation 3). Two levels of activity 
are defined. For the first level, the requirements are to take 
the precautions necessary to prevent a major accident and to 
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Table 4.9 Notification of Installations Handling 
Hazardous Substances Regulations 1982: Schedule 1: 
notifiable inventories 


PART I Named substances 

substance 

Notifiable quantity 
(tonne) 

Liquefied petroleum gas, such as 
commercial propane and 
commercial butane, and any 
mixtures thereof held at a 
pressure greater than 

1.4 bar absolute 

25 

Liquefied petroleum gas, 
such as commercial propane 
and commercial butane, and 
any mixture thereof held under 
refrigeration at a pressure of 

1.4 bar absolute or less 

50 

Phosgene 

2 

Chlorine 

10 

Hydrogen fluoride 

10 

Sulfur trioxide 

15 

Acrylonitrile 

20 

Hydrogen cyanide 

20 

Carbon disulfide 

20 

Sulfur dioxide 

20 

Bromine 

40 

Ammonia (anhydrous or as 
solution containing more than 

50% by weight of ammonia) 

100 

Hydrogen 

2 

Ethylene oxide 

5 

Propylene oxide 

5 

tert- Butyl peroxyacetate 

5 

tert- Butyl peroxyisobutyrate 

5 

ferf-peroxymaleate 

5 

tert- Butyl peroxisopropyl carbonate 

5 

Dibenzylperoxydicarbonate 

5 

2,2-bis(/«y/-Butylperoxy)butane 

5 

l,l-bis(fey/-Butylperoxy)cyclohexane 

5 

Di-see-butylperoxydicarbonate 

5 

2,2 -Dihydroperoxy propane 

5 

Di-w-propylperoxydicarbonate 

5 

Methylethyl ketone peroxide 

5 

Sodium chlorate 

25 


Cellulose nitrate other than: 50 

(a) cellulose nitrate to which the 
Explosives Act 1875 applies or 

(b) solutions of cellulose nitrate 
where the nitrogen content of the 
cellulose nitrate does not exceed 
12.3% by weight and the solution 
contains not more than 55 parts of 
cellulose nitrate per 100 parts by 
weight of solution 

Ammonium nitrate and mixtures 500 

of ammonium nitrate where the 
nitrogen content derived from the 
ammonium nitrate exceeds 28% 
of the mixture by weight other than: 

(a) mixtures to which the Explosives 
Act 1875 applies, or (b) ammonium 
nitrate based products manufactured 
chemically for use as fertilizer which 
comply with Council Directive 
80/876/EEC 

Aqueous solutions containing more 500 

than 90 parts by weight of 
ammonium nitrate per 100 parts 
by weight of solution 

Liquid oxygen 500 


PART II Classes of substance not specifically named 
in Part I 


Class of substance Notifiable quantity 

(tonnes) 


1. Gas or any mixture of gases 
which is flammable in air and 
is held in the installation as 

a gas 

2. A substance or any mixture of 
substances which is flammable 
in air and is normally held in the 
installation above its boiling 
point (measured at 1 bar 
absolute) as a liquid or as a 
mixture of liquid and gas at 

a pressure of more than 1.4 bar 
absolute 

3. A liquefied gas or any mixture 
of liquefied gases, which is 
flammable in air, has a boiling 
point of less than 0°C 
(measured at 1 bar absolute) 
and is normally held in the 
installation under refrigeration 
or cooling at a pressure of 

1.4 bar absolute or less 


15 


25 

being the total 
quantity of 
substances above 
the boilding points 
whether held 
singly or in 
mixtures 


50 

being the total 
quantity of sub¬ 
stances having 
boiling points 
below 0°C 
whether held 
singly or in 
mixtures 


4. A liquid or any mixture of liquids 10,000 
not included in items 1 to 3 
above, which has a flashpoint of 
less than 21°C 
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limit the consequences and generally to demonstrate safe 
operation (Regulation 4) and to report any major accident 
which does occur (Regulation 5). For the higher level of 
activity (defined in Regulation 6), more extensive require¬ 
ments apply (Regulations 7-12). These include the 
requirements to submit a safety report (Regulation 7), to 
update the safety report (Regulation 8), to provide on 
request additional information (Regulation 9), to prepare an 
on-site emergency plan (Regulation 10) and to provide 
information to the public (Regulation 12). The local author¬ 
ity is required to prepare an off-site emergency plan (Reg¬ 
ulation 11). 

The initial directive made a distinction between storage 
associated with a process and isolated storage. In accord¬ 
ance with the directive, the CIMAH Regulations 1984 gave 
separate lists of inventories for the application of the reg¬ 
ulations for isolated storage (Schedule 2) and other storage 
(Schedule 3). The 1990 revision again gives lists of inven¬ 
tories as Schedules 2 and 3, but the type of storage to which 
Schedule 2 applies has been broadened to include certain 
process-associated storage. Schedule 2 gives two sets of 
inventories. Inventories at either level attract Regulation 4, 
but only an inventory in the higher level attracts Regula¬ 
tions 7-12. 

An outline of the regulations is given in Table 4.10 and 
details of Regulations 4,6,7 and 8 are shown in Table 4.11. 
Tables 4.12-4.17 give details of Schedules 1-4, 6 and 8, 
respectively. Schedule 1 gives the indicative criteria for the 
application of Regulations 2 and 4. Schedule 3 gives the list 
of substances, with associated inventories, for the applica¬ 
tion of Regulations 7-12. As just described, Schedule 2 
gives two lists of inventories, both attracting Regulation 4, 
but only the higher level attracting Regulations 7-12. 
Schedule 4 lists the types of industrial installation other 
than isolated storage which come within Regulation 2. 
Schedule 6 gives the information to be included in the 
safety report (Regulation 7) and Schedule 8 that to be given 
to the public (Regulation 12). 

Guidance on the CIMAH Regulations is given in A Guide 
to the Control of Industrial Major Accident Hazards Regula¬ 
tions 1984 (HSE, 1990 HS(R) 21 rev.). A decision tree for the 
application of the regulations is shown in Figure 4.2. 

The requirements for the safety report are discussed 
below, those for emergency planning, both on-site and off¬ 
site, in Chapter 24 and those for provision of information to 
the public in Section 4.11. 

An account of the CIMAH arrangements has been given 
by Cassidy and Pantony (1988). The sites covered are clas¬ 
sified as large inventory top tier sites (LITTSs), holding 
large inventories of flammable and/or toxic materials, and 
small inventory top tier sites (SITTSs), holding smaller 
quantities of more toxic substances. 

They state that in the United Kingdom there are over 170 0 
NIHHS sites and ‘several hundred’ CIMAH sites. 


4.10.3 CIMAH safety case 

A central feature of the regulations is the safety report, 
commonly called the ‘safety case’. Two aspects of particular 
interest are the requirements concerning the management 
system and the quantification of the hazards. With regard 
to the former, Schedule 6 of the original CIMAH Regula¬ 
tions 1984 requires that the report provide information 
on the management system and specifically on the staffing 
arrangements, including: for certain responsibilities, the 


Table 4.10 Control of Industrial Major Accident 
Hazards Regulations 1984: outline of regulations? 


Regulation 2 
Regulation 3 
Regulation 4 
Regulation 5 
Regulation 6 

Regulation 7 
Regulation 8 
Regulation 9 

Regulation 10 
Regulation 11 

Regulation 12 
Regulation 13 

Regulation 14 
Regulation 15 


Schedule 1 
Schedule 2 

Schedule 3 
Schedule 4 
Schedule 5 


Schedule 6 
Schedule 7 
Schedule 8 


Interpretation 

Application of these Regulations 
Demonstration of safe operation 
Notification of major accidents 
Industrial activities to which 
Regulations 7-12 apply 
Reports on industrial activities 
Updating of reports under Regulation 7 
Requirement of further information to 
be sent to the Executive 
Preparation of on-site emergency plan by 
the manufacturer 

Preparation of off-site emergency plan by 
the local authority 
Information to the public 
Disclosure of information notified 
under these Regulations 
Enforcement 

Charge by the local authority for off-site 
emergency plan 

Indicative criteria 

Storage other than of substances listed 
in Schedule 3 associated with an instal¬ 
lation referred to in Schedule 4 
List of substances for the application of 
Regulations 7-12 
Industrial installations within the 
meaning of Regulation 2(1) 

Information to be supplied to the 
Commission of the European 
Communities by the Member States 
pursuant to Regulation 5(2) 
Information to be included in a report 
under Regulation 7(1) 

Preliminary information to be sent to 
the Executive under Regulation 7(3) 
Items of information to be communi¬ 
cated to the public in the application of 
Regulation 12 


“This table and the following seven tables incorporate the 1990 
amendments to the regulations. 


names of the persons assigned; the arrangements for safe 
operation; and the arrangements for training. The wording 
of the 1990 Regulations is identical. However, the Guide to 
the latter (HSE, 1990 HS(R) 21 rev.) is much more explicit on 
the matters to be covered and is in effect a description of 
good practice in respect of a safety management system. 
When the regulations were brought in, it was a matter of 
some concern to know the extent to which the HSE would 
require QRA. The guidance to the original regulations 
(HSE, 1985 HS(R) 21) stated: 


Whilst it may be possible for manufacturers to write a 
safety case in qualitative terms, HSE may well find it 
easier to accept conclusions that are supported by quan¬ 
titative arguments. A quantitative assessment is also a 
convenient way of limiting the scope of the safety case by 
demonstrating either that an adverse event has a very 
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Table 4.11 Control of Industrial Major Accident Hazards 
Regulations 1984: Regulations 4, 6, 7 and 8 


Regulation 4 Demonstration of safe operation 

(1) This Regulation shall apply to: 

(a) An industrial activity to which subparagraph 
Regulation 2(1) applies and in which a substance 
which satisfies any of the criteria laid down 

in Schedule 1 is involved or is liable to be 
involved; and 

(b) An industrial activity to which subparagraph 
(b) of that definition applies and in which there is 
involved, or liable to be involved - 

(i) For a substance specified in column 1 of 
Part I of Schedule 2, a quantity of that 
substance which is equal to or more than the 
quantity specified in the entry for that 
substance in column 2 of that Part. 

(ii) For substances and preparations falling 
within a category or categories specified in 
an entry in column 1 of part II of Schedule 2, 
a total quantity of such substances and 
preparations in the category or categories in 
that entry which is equal to or more than the 
quantity for that entry specified in column 

2 of the Part. 

(2) A manufacturer who has control of an industrial 
activity to which this Regulation applies shall at any 
time provide evidence including documents to show 
that he has: 

(a) Identified the major accident hazards; and 

(b) Taken adequate steps to: 

(i) Prevent such major accidents and to limit 
their consequences to persons and the 
environment, and 

(ii) Provide persons working on the site with 
the information, training and equipment 
necessary to ensure their safety. 

Regulation 6 Industrial activities to which 

Regulations 7 to 12 apply 

(1) Regulations 7 to 12 shall apply to: 

(a) An industrial activity to which subparagraph 

(a) of the definition of industrial activity in 
Regulation 2(1) applies and in which there is in¬ 
volved , or liable to be involved, a substance listed in 
column 1 of S chedule 3 in a quantity which is equal 
to or more than the quantity specified in the entry 
forthatsubstanceincolumn2ofthatSchedule;and 

(b) An industrial activity to which subparagraph 

(b) of that definition applies and in which there is 
involved, or liable to be involved — 

(i) For a substance specified in column 1 of 
Part I of Schedule 2, a quantity of that 
substance which is equal to or more than the 
quantity specified in the entry for that 
substance in column 3 of that Part; 

(ii) For substances and preparations falling 
within a caegory or cateories specified in an 
entry in column 1 of Part II of Schedule 2, a 
total quantity of such substances and pre¬ 
parations in the category or categories in 
that entry which is equal to or more than the 
quantity for that entry specified in column 

3 of that Part. 


(2) For the purposes of Regulations 7 to 11: 

(a) A'new industrial activity’ means an industrial 
activity which — 

(i) Was commended after the date of the 
coming into operation of this Regulation, or 

(ii) If commenced before that date, is an indus- 
rial activity in which there has been since 
that date a modification which would be 
likely to have important implications for 
major accident hazards, and that activity 
shall be deemed to have been commenced on 
the date on which the change was made; 

(b) an ‘existing industrial activity’ means an 
indusrial activity which is not a new industrial 
activity. 

Regulation 7 Report on industrial activities 

Regulation 7(1) gives the requirement for the submission 
of a written safety report, 7(2) and 7(3) deal with new 
activities and existing activities, respectively, and 7(4) wih 
exemptions granted by the HSE. 

Regulation 8 Updating of reports under 
Regulation 7 

(1) Where a manufacturer has made a report in 
accordance with Regulation 7(1), he shall not make any 
modification to the industrial activity to which that 
report relates which could materially affect the 
particulars in that report, unless he has made a 
further report to take account of those changes and 
has sent a copy of that report to the Executive at least 
3 months before making those changes or before such 
shorter time as the Executive may agree in writing. 

(2) Where a manufacturer has made a report in accor¬ 
dance with Regulation 7(1), paragraph (1) of this 
Regulation or this paragraph, and that industrial 
activity is continuing, the manufacturer shall within 
three years of the date of the last such report, make a 
further report which shall have regard in particular to 
new technical knowledge which materially affects the 
particulars in the previous report relating to safety 
and development in this knowledge of hazard assess¬ 
ment, and shall within one month, or in such longer 
time as the Executive may agree, send a copy of the 
report to the Executive. 

(3) A certificate of exemption issued under Regulation 
7(4), shall apply to reports or declarations made under 
this Regulation as it applies to reports made under 
Regulation 7(1). 


remote probability of occurring or that a particular con¬ 
sequence is relatively minor (p. 34) 

The 1990 Guide states that 

The nature and extent of the consequence assessment 
needed depends upon the magnitude of the hazard, its 
likelihood of occurrence and, most importantly, the need 
to describe the adequacy of the prevention, control and 
mitigatory measures. 

It later continues 

In many cases explicit quantification of the conseq¬ 
uences of a major accident combined with relatively 
broad, but justifiable, qualitative predictions about the 
likelihood of occurrence will be sufficient to enable both 
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Table 4.12 Control of Industrial Major Accident Hazards 
Regulations 1984: Schedule 1: indicative criteria 


Regulations 2(1) and 4(1) 

(a) Very toxic substances: 

—Substances which correspond to the first line of the 
table below, 

— Substances which correspond to the second line of 
the table below and which, owing to their physical 
and chemical properties, are capable of producing 
major accident hazards similar to those caused by 
the substance mentioned in the first line. 


LD 50 (oral)® 

LD 50 (cutaneous)* 21 

lc 50 (3) 

(mg/kg body 

(mg/kg body 

(mg/1 

weight) 

weight) 

inhalation) 

1 LD 50 < 5 

LD 5O <10 

LC 5O <0.1 

2 5 < LD 50 < 25 

10 < LD 50 < 50 

0.1 < LC 50 < 0.5 


(1) LD 50 oral in rats. 

(2) LD 50 cutaneous in rats or rabbits. 

(3) LC 50 by inhalation (4 h) in rats. 


(b) Other toxic substances: 

The substances showing the following values of actue 
toxicity and having physical and chemical properties 
capable of producing major accident hazards. 


LD 50 (oral) (1) 

LD 50 (cutaneous)* 21 

lc 50 (3) 

(mg/kg body 

(mg/kg body 

(mg/1 

weight) 

weight) 

inhalation) 

25 < LD 50 < 200 

50 < LD 50 < 400 

0.5 < LC 50 < 2 





(1) LD 50 oral in rats. 

(2) LD 50 cutaneous in rats or rabbits. 

(3) LC 50 by inhalation (4 h) in rats. 


(c) Flammable substances: 

(i) Flammable gases; 

Substances which in the gaseous state at normal 
pressure and mixed with air become flammable 
and the boiling point of which at normal pres¬ 
sure is 20°C or below; 

(ii) Highly flammable liquids; 

Substances which have a flash point lower than 
21°C and the boiling point of which at normal 
pressure is above 20°C; 

(iii) Flammable liquids; 

Substances which have a flash point lower than 
55°C and which remain liquid under pressure, 
where particular processing conditions, such as 
high pressure and high temperature, may create 
major accident hazards. 

(d) Explosive substances: 

Substances which may explode under the effect of 
flame or which are more sensitive to shocks or friction 
than dinitrobenzene. 

(e) Oxidizing substances: 

Substances which give rise to highly exothermic 
reaction when in contact with other substances, 
particularly flammable substances. 


the manufacturer and HSE to judge whether the precau¬ 
tionary measures are adequate. However, there will he 
some activities involving highly hazardous and difficult 
to control processes, e.g. the oxidation of ethylene to 
produce ethylene oxide, where it may be necessary for 
the manufacturer to be more precise about the frequency 
of the various events which could lead to a major 
accident... (p.65) 


4.11 Process Hazard Control: Planning 

Some appreciation of the planning system is necessary for 
the understanding of overall arrangements for the control of 
major hazards. The treatment given here is limited to pro¬ 
viding this essential background. Fuller accounts are given 
by Petts (1984b,c, 1985a,b, 1988a,b, 1989,1992). Legislation 
relevant to planning and major hazards is discussed in 
Chapter 3. 

4.11.1 Planning system 

The essential function of planning is the control of land use. 
This control may be used to prevent incompatible uses of 
adjacent pieces of land, but such control is much easier to 
exercise before development has taken place than after it. 
The control of land use is effected through the structure 
plans of the counties, which set the overall framework, and 
through the local plans of the LPAs, which deal in specific 
developments. New developments are required to relate to 
these plans. Structure and local plans are essentially 
instruments for forward planning. Difficulties can arise 
when the problem is one not of a greenfield development but 
of an existing installation. 

An example of positive forward planning to accom¬ 
modate hazardous activities is the National Planning 
Guidelines issued in 1977 by the Scottish Development 
Department. The guidelines give detailed advice on the 
incorporation of such activities in local plans. 

The main responsibility for planning lies with the LPA. 
In arriving at a planning decision on an industrial activity, 
the LPA has to take into account a large number of factors, 
including employment, safety and amenity. The LPA is 
publicly accountable both through the elected members on 
the local planning committee and through the procedures 
allowing for individual representations which it is required 
to follow. 

Planning control has been exercised through the powers 
embodied in the TCPA. In general, this allows new devel¬ 
opment to be controlled by withholding planning permis¬ 
sion or by attaching planning conditions.There is provision 
for a voluntary agreement between the developer and the 
LPA. There are limited powers to revoke or discontinue 
planning permission which has been granted. 

The TCPA 1971 gives an LPA certain powers to control 
‘development’ but these are circumscribed by the definition 
of ‘development’ in the Act and on the subsequent inter¬ 
pretation of this in the courts. The term development is 
defined as ‘the carrying out of building, engineering, 
mining or other operations, in, on, over or under land or the 
making of any material change in the use of land’. However, 
while planning powers exist for the control of the general 
type of use, they do not extend to the control of particular 
uses within the general type. 

Since the definition of ‘development’ is so wide, it has 
been necessary in order not to overload the planning system 
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Table 4.13 Control of Industrial Major Accident Hazards 
Regulations 1984: Schedule 2: storage other than of 
substances listed in Schedule 3 associated with an 
installation referred to in Schedule 4 


Regulations 2(1), 4(1) and 6(1) 

This Schedule applies to storage of dangerous 
substances and/or preparations at any place, 
installation, premises, building, or area of land, 
isolated or within an establishment, being a site used for 
the purpose of storage, except where that storage is 
associated with an installation covered by Schedule 4 
and where the substances in question appear in 
Schedule 3. 

The quantities set out below in Parts I and II relate to 
each store or group of stores belonging to the same 
manufacturer where the distance between the 
stores is not sufficient to avoid, in foreseeable 
circumstances, any aggravation of major accident 
hazards. These quantities apply in any case to each 
group of stores belonging to the same manufacturer 
where the distance between the stores is less 
than 500 m. 

The quantities to be considered are the maximum 
quantities which are, or are liable to be, in storage at any 
one time. 


Methyl bromide 

20 

200 

(Bromomethane) 

Methylisocyanate 

0.15 (150 kg) 

0.15 (150 kg) 

Oxygen 

200 

2,000 

Phosgene 

0.75 (750 kg) 

0.75 (750 kg) 

(carbonyl chloride) 
Propylene oxide 

5 

50 

Sodium chlorate 

25 

250 

Sulfur dioxide 

25 

250 

Sulfur trioxide 

15 

100 

Tetraethyl lead or 

5 

50 

tetramethyl lead 
Toluene 

10 

100 

di-isocyanate (TDI) 



ate where the nitrogen content derived from the ammonium nitrate 




where the concentration of; 

ammonium nitrate is > 

90% by weight. 


b This applies to straight ammonium nitrate fertilizers which comply 
with Council Directive 8/876/EEC (OJ No. L250, 23.9.80, p. 7) ‘on the 
approximation of laws of the Member States relating to straight 
ammonium nitrate fertilizers of high nitrogen content’ and to com¬ 
pound fertilizers where the nitrogen content derived from the ammo¬ 
nium nitrate is > 28% by weight (a compound fertilizer contains 
ammonium nitrate together with phosphate and/or potash). 


Part I Named substances 

Where a substance (or a group of substances) listed in Part I 
also falls within a category of Part II, the quantities set out 
in Part I shall be used. 


Substances or groups 
of substances 
(Column 1) 

Quantities (tonnes) 

For application 
of Regulation 4 
(Column 2) 

For application 
of Regulations 
7-12 
(Column 3) 

Acetylene 

5 

50 

Acrolein 

20 

200 

(2-propenal) 

Acrylonitrile 

20 

200 

Ammonia 

50 

500 

Ammonium nitrate 1 2 3 * 

350 

2,500 

Ammonium nitrate 

1,250 

10,000 

in the form of 
fertilizers' 5 

Bromine 

50 

500 

Carbon disulfide 

20 

200 

Chlorine 

10 

75 

Diphenylmethane 

20 

200 

di-isocyanate (MDi) 

Ethylene dibromide 

5 

50 

(1,2 - dibromoethane) 

Ethylene oxide 

5 

50 

Formaldehyde 

5 

50 

(concentration >90%) 

Hydrogen 

5 

50 

Hydrogen chloride 

25 

250 

(liquefied gas) 

Hydrogen cyanide 

5 

20 

Hydrogen fluoride 

5 

50 

Hydrogen sulfide 

5 

50 


Part II Categories of substances and preparations 
not specifically named in Part I 

The quantities of different substances and preparations 
of the same category are cumulative. Where there 
is more than one category specified in the same entry, 
the quantities of all substances and preparations 
of the specified categories in that entry shall be 
summed up. 


Categories of 
substances and 
preparations 
(Column 1) 


Quantities (tonnes) 

For application For application 
of Regulation 4 of Regulations 
(Column 2) 7-12 

(Column 3) 


(1) Substances and 5 

preparations that 

are classified as 
‘very toxic’ 

(2) Substances and 10 

preparations that 

are classified as 
‘very toxic’,‘toxic’, 3 
‘oxidizing’ or 
‘explosive’ 

(3) Gaseous 50 

substances 

and preparations 
including those 
in liquefied form, 
which are gaseous 
at normal 
pressure and 
which are 
classified as 
‘highly flammable’ 15 


20 

200 


20 
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(4) Substances and 5,000 50,000 

preparations 
(excluding gaseous 
substances and 
preparations covered 
under item 3 above) 
which are classified 
as ‘highly flammable’ 
or ‘extremely 
flammable’ 0 


a Where the substances and preparations are in a state which gives 
them properties capable of producing a major accident hazard. 
b This includes flammable gases as defiend in paragraph c(i) of 
Schedule 1. 

c This includes highly flammable liquids as defined in paragraph 
(c)(ii) of Schedule 1. 

Substances and preparations shall be assigned categories in accord¬ 
ance with the classification provided for by Regulation 5 of the Clas¬ 
sification, Packaging and Labelling of Dangerous Substances 
Regulations 1984 (SI 1984/1244, amended by SI 1986/1922, SI 1988/ 
766, SI 1989/2208 and SI 1990/1255) whether or not the substance or 
preparation is required to be classified for the purposes of those 
Regulations, or, in the case of a pesticide approved under the Food and 
Environment Protection Act 1985 (c.48), in accordance with the clas¬ 
sification assigned to it by that approval. 


Table 4.14 Control of Industrial Major Accident Hazards 
Regulations 1984: Schedule 3: list of substances for the 
application of Regulations 7-12 

The quantities set out below relate to each installation or 
group of installations belonging to the same manufacturer 
where the distance between the installations is not sufficient to 
avoid, in foreseeable circumstances, any aggravation of major 
accident hazards. These quantities apply in any case to each 
group of installations belonging to the same manufacturer 
where the distance between the installations is less than 500 m. 


Substance Quantity (for applications 

(Column 1) of Regulations 7 —12) 

(Column 2) 


Group 1 Toxic substances 
(quanmv <1 tonne) 3 

(kg) 


Arsine 10 

Methyl isocyanate 150 b 

Parathion 100 

Phosgene 750 C 

2,3,7,8 -Tetrachlorodibenzo- 1 

p-dioxin (TCDD) 


Group 2 Toxic substances 


(quantity > 1 tonnef 

(tonne) 

Acetone cyanohydrin 200 

Acrolein 200 

Acrylonitrile 200 

Allyl alcohol 200 

Allylamine 200 

Ammonia 500 

Bromine 500 

Carbon disulfide 200 

Chlorine 25 e 

Ethylene dibromide 50 

Ethyleneimine 50 


Formaldehyde 50 

(concentration >90%) 

Hydrogen chloride 250 

(liquefied gas) 

Hydrogn cyanide 20 

Hydrogen fluoride 50 

Hydrogen sulphide 50 

Methyl bromide 200 

Nitrogen oxides 50 

Propyleneimine 50 

Sulfur dioxide 250 f 

Tetraethyl lead 50 

Tetramethyl lead 50 

Group 3 Highly reactive substances a 

(tonne) 

Acetylene 50 

Ammonium nitrate® 2,500 

Ammonium nitrate in 5,000 

the form of fertilizers' 1 
Ethylene oxide 50 

Hydrogen 50 

Oxygen (liquid) 2,000 

Propylene oxide 50 

Sodium chlorate 250 

Group 4 Explosive substances a 

(tonne) 

Cellulose nitrate 100 

(containing > 12.6% nitrogen) 

Lead azide 50 

Mercury fulminate 10 

Nitroglycerine 10 

Pentaerythritol tetranitrate 50 

Picric acid 50 

2,4,6 -Trinitrotoluene 50 

Group 5 Flammable substances b 

(tonne) 

Flammable substances as 200 

defined in Schedule 1, 
paragraph c(i) 

Flammable substances as 50,000 

defined in Schedule 1, 
paragraph c(ii) 

Flammable substances as 200 

defined in Schedule 1, 
paragraph c(iii) 


a Selection from complete list for this group. 

b Reduced from inventory of 1 tonne in original CIMAH Regula- 

c Reduced from inventory of 20 tonne in original CIMAH Regula¬ 
tions 1984. 

d Complete list for this group. 

e Reduced from inventory of 50 tonne in original CIMAH Regula- 

£ Reduced from inventory of 1000 tonne in original CIMAH Regula¬ 
tions 1984. 

nitrate where the nitrogen content derived from the ammonium nitrate 
is >28% by weight and aqueous solutions of ammonium nitrate 

h This applies to ammonium nitrate fertilizers which comply with 
Council Directive 80/876/EEC and to compound fertilizers where the 
nitrogen content derived from the ammonium nitrate is >28% by 
weight (a compound fertilizer contains ammonium nitrate together 
with phosphate and/or potash). 
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Table 4.15 Control of Industrial Major Accident Hazards 
Regulations 1984: Schedule 4: industrial installations 
within the meaning of Regulation 2(1) 

(1) Installations for the production, processing or 
treatment of organic or inorganic chemicals using 
for this purpose, amongst others: 

- Alkylation 

— Animation by ammonolysis 

- Carbonylation 
— Condensation 

- Dehydrogenation 

- Esterification 

- Halogenation and manufacture of halogens 
— Hydrogenation 

- Hydrolysis 

- Oxidation 

— Polymerization 
— Sulfonation 

- Desulfurization, manufacture and transformation 
of 

sulfur-containing compounds 

- Nitration and manufacture of nitrogen-containing 
compounds 

- Manufacture of phosphorus-containing compounds 

- Formulation of pesticides and of pharmaceutical 
products 

- Distillation 

- Extraction 
— Solvation 
— Mixing. 

(2) Installations for distillation, refining or other 
processing of petroleum or petroleum products. 

(3) Installations for the total or partial disposal of solid 
or liquid substances by incineration or chemical 
decomposition. 

(4) Installations for the production, processing or treat¬ 
ment of energy gases, for example, LPG, LNG, SNG. 

(5) Installations for the dry distillation of coal or lignite. 

(6) Installations for the production of metals or non- 
metals by a wet process or by means of electrical 
energy. 


Table 4.16 Control of Industrial Major Accident Hazards 
Regulations 1984: Schedule 6: information to be included 
in a report under Regulation 7(1) 


(1) The report required under Regulation 7(1) shall 
contain the following information. 

(2) Information relating to every dangerous substance 
involved in the activity in a relevant quantity as 
listed in Schedule 2 column 3 or Schedule 3, namely: 

(a) the name of the dangerous substance as given in 
Schedule 2 or 3 or, for a dangerous substance 
included in either of those Schedules under a 
general designation, the name corresponding 

to the chemical formula of the dangerous 
substance; 

(b) a general description of the analytical methods 
available to the manufacturer for determining 
the presence of the dangerous substance, or 
references to such methods in the scientific 
literature; 

(c) a brief description of the hazards which may be 
created by the dangerous substance; 


(d) the degree of purity of the dangerous substance, 
and the names of the main impurities and their 
percentages. 

(3) Information relating to the installation, namely: 

(a) a map of the site and its surrounding area to a 
scale large enough to show any features that may 
he significant in the assessment of the hazard or 
risk associated with the site; 

(b) a scale plan of the size showing the locations and 
quantities of all significant inventories of the 
dangerous substance; 

(c) a description of the processes or storage invol¬ 
ving the dangerous substance and an indication 
of the conditions under which it is normally held; 

(d) the maximum number of persons likely to be 
present on site; 

(e) information about the nature of the land use and 
the size and distribution of the population in the 
vicinity of the industrial activity to which the 
report relates. 

(4) Information relating to the management system for 
controlling the industrial activity, namely: 

(a) the staffing arrangements for controlling the 
industrial activity with the name of the person 
responsible for safety on the site and the names 
of those who are authorized to set emergency 
procedures in motion and to inform outside 
authorities; 

(b) the arrangements made to ensure that the means 
provided for the safe operation of the industrial 
activity are properly designed, constructed, 
tested, operated, inspected and maintained; 

(c) the arrangements for training of persons work¬ 
ing on the site. 

(5) Information relating to the potential major accidents, 
namely: 

(a) a description of the potential sources of a major 
accident and the conditions or events which could 
be significant in bringing one about; 

(b) a diagram of any plant in which the industrial 
activity is carried on, sufficient to show the 
features which are significant as regards the 
potential for a major accident or its prevention 
or control; 

(c) a description of the measures taken to prevent, 
control or minimize the consequences of any 
major accident; 

(d) information about the emergency procedures 
laid down for dealing with a major accident 
occurring at the site; 

(e) information about prevailing meteorological 
conditions in the vicinity of the site; 

(f) an estimate of the number of people on site who 
may be exposed to the hazards considered in the 
report. 

(6) In the case of the storage of substances and prepara¬ 
tions to which Part II of Schedule 2 applies, para¬ 
graphs 2(a), (h) and (d) and 5(b) of this Schedule shall 
apply so far as is appropriate. 


to grant certain general permissions. Under the Town and 
Country Planning General Development Order (GDO) 1977, 
a number of changes of land use are classed as ‘permitted’ 
developments, which do not require planning permission. 
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Table 4.17 Control of Industrial Major Accident Hazards 
Regulations 1984: Schedule 8: items of information to 
be communicated to the public in the application of 
Regulations 2 and 12 


Regulations 2(1) and 12(1) 

(1) Name of manufacturer and address of site. 

(2) Identification, by position held, of person giving the 
information. 

(3) Confirmation that the site is subject to these 
Regulations and that the report referred to in 
Regulation 7(1) or at least the information required 
by Regulation 7(3) has been submitted to the 
Executive. 

(4) An explanation in simple terms of the activity 
undertaken on the site. 

(5) The common names, or in the case of storage covered 
by Part II of Schedule 2 the generic names or the 
general danger classification, of the substances and 
preparations involved on site which could give rise to 
a major accident, with an indication of their principal 
dangerous characteristics. 

(6) General information relating to the nature of the 
major accident hazards, including their potential 
effects on the population and the environment. 

(7) Adequate information on how the population 
concerned will be warned and kept informed in the 
event of an accident. 

(8) Adequate information on the actions the population 
concerned should take and on the behaviour they 
should adopt in the event of an accident. 

(9) Confirmation that the manufacturer is required to 
make adequate arrangements on site, including 
liaison with the emergency services, to deal with 
accidents and to minimize their effects. 

(10) A reference to the off-site emergency plan drawn up 
to cope with any off-site effects from an accident. 
This shall include advice to cooperate with any 
instructions or requests from the emergency services 
at the time of an accident. 

(11) Details of where further relevant information can be 
obtained, subject to the requirements of confidenti¬ 
ality laid down in national legislation. 


Further, under the Town and Country Planning (Use 
Classes) Order (UCO) 1972, changes within a particular 
Use Class are permitted development. The definition of a 
Use Class, however, is very broad, for example, light indus¬ 
try. A change of use of a piece of land or a building is not 
classed as development unless it constitutes both a ‘material 
change’ and a change from one Use Class to another. 

For large developments it is usual to seek planning per¬ 
mission in two stages: ‘outline’ permission and then ‘detail’ 
permission. This allows the developer to ascertain that it 
has permission before incurring costs of development. 
Outline planning permission is full planning permission. 
Permission is granted subject to ‘reserved matters’, which 
cover such aspects as building design, plant design, land¬ 
scaping and access. These are the only matters which the 
LPA is subsequently entitled to consider. 

In granting outline planning permission, the LPA may 
stipulate planning conditions. This is an important power, 
but the conditions must be reasonable and the use of such 


conditions to deal with matters which are properly the con¬ 
cern of the HSE is discouraged. 

A developer which has been refused planning permission 
or had permission granted subject to planning conditions 
may appeal to the Secretary of State for the Environment. 
Alternatively, where the land has become incapable of rea¬ 
sonably beneficial use, it may serve on the LPA a purchase 

Planning permission may be revoked before it has been 
implemented or discontinued for an existing installation or it 
maybe modified, but in such cases the LPA may beliable to pay 
compensation. The sums involved in such compensation 
can be very large and are a strong deterrent to revocation. 

The Secretary of State has powers to approve all structure 
and certain local plans, to consider appeals against plan¬ 
ning decisions, to call in a planning application for his own 
consideration and to confirm or reject revocations, mod¬ 
ifications and discontinuances of planning permission. 

This remains the general framework under the TCPA 
(1990). 

4.11.2 Planning and major hazards 

The problem of developments involving major hazards was 
recognized well before the Flixborough disaster. In 1972, the 
DoE issued the first of a number of circulars to LPAs on 
hazardous installations. This circular, DoE 72/1, gave a list 
of hazardous inventories for which it was recommended 
that the LPA should seek advice. Some of the DoE circulars 
are listed in Table 4.18. 

Following Flixborough, the HSE experienced an incre¬ 
ased number of inquiries from LPAs concerning develop¬ 
ments involving hazardous installations and set up a RAG 
to give advice in response to these queries. In 1974, the 
ACMH was set up with a membership which included 
planners. Planning was one of the principal topics con¬ 
sidered by the Committee which made a number of recom¬ 
mendations in this area. 

Decisions on planning for major hazard installations as 
for other developments are taken by the LPA. The alter¬ 
native that the decision might be made by the HSE was 
considered at some length by the ACMH but rejected. The 
case for leaving the decision with the LPA was made in the 
committee’s First Report in the following terms: 

It might be argued that the siting of potentially hazar¬ 
dous installations should be controlled by the Health and 
Safety Executive as part of their application of compre¬ 
hensive safety controls in general, but we hold very 
firmly to the view that siting of all industrial develop¬ 
ments should remain a matter for planning authorities to 
determine since the safety implications, however impor¬ 
tant, cannot be divorced from other planning con¬ 
siderations (paragraph 72) 

In its Second and Third Reports, the Committee recognized 
that this opinion was not universally shared, but reaffirmed 


When a planning application is being considered a 
balanced view should be taken of all aspects including 
social and economic factors and not just health and 
safety. Our view is that the HSE ought to provide a clear 
assessment of the risks associated with the development 
and to ensure that plant standards are appropriate for 
those risks. The decision on whether or not to grant 
planning permission for an installation which meets 
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Figure 4.2 Control of Industrial Major Accident Hazards Regulations 1990: decision tree for application of the 
regulations (Courtesy of HM Stationery Office) 
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Table 4.18 Department of the Environment Circulars 
relevant to planning and major hazards 


Circular 


DoE 1/72 

Development involving the use or 

(WO 3/72) 

storage in bulk of hazardous materi¬ 
als 

DoE 71/73 

Publicity for planning applications, 
appeals 

and other proposals for development 

DoE 4/79 

Memorandum on structure and local 
plans 

DoE 22/80 

Development control - policy and 

(WO 40/80) 

practice 

DoE 26/82 

Hazardous substances 

DoE 9/84 

Planning controls over hazardous 

(WO 17/84) 

development 

DoE 22/84 

Memorandum on structure and local 
plans 

DoE 1/85 

The use of conditions in planning 
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operations 
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Environmental assessment 


health and safety criteria should however rest with the 
local authority who, on behalf of the local community, 
attempts to come to a balanced decision, having taken all 
the factors into consideration. In some cases where an 
installation is of wider regional or national significance, 
the final decision may be taken by central govern¬ 
ment (Third Report, paragraph 111) 

On siting policy, the committee stated: 

The overall objective should always he to reduce the 
number of people at risk, and in the case of people who 
unavoidably remain at risk, to reduce the likelihood and 
the extent of harm if loss of control or containment 
occurs (Third Report, paragraph 109) 

The Committee distinguished between several different 
development situations involving major hazards: 

(1) initial introduction of hazards to ‘greenfield’ sites; 

(2) initial introduction of hazards to existing installations; 

(3) intensification of hazards at existing installations; 

(4) proposed development in the vicinity of hazardous 
installations; 

(5) existing development in the vicinity of hazardous 
installations. 

In the Committee’s view, the existing planning system was 
well able to handle the initial introduction of hazards to a 
greenfield site. They recommended that the LPA should 
impose a standard planning condition prohibiting without 
specific consent the introduction onto a site of notifiable 
hazards. 

The problems of the initial introduction of a hazard or of 
intensification of an existing hazard were recognized as 
more difficult. The ideal solution would have been to amend 
the definition of ‘development’ in theTCPA, but this was a 
fundamental change which in the short term at least the DoE 
was unable to accept. An alternative approach to the initial 
introduction of hazard which the Committee recommended 


in default of amendment of the TCPA was to amend the 
GDO and UCO, the former to exclude from permitted 
development modifications which have the effect of creating 
a notifiable installation, and the latter to omit notifiable 
activities altogether from the Use Classes. These proposals 
did not, however, solve the problem of the intensification of 
an existing hazard. 

With regard to development in the vicinity of a hazardous 
installation, the Committee endorsed the aim of first stabi¬ 
lizing and then reducing the number of people exposed to 
the hazard. It recommended that, for proposed develop¬ 
ment, the LPA should consult the HSE. It also drew attention 
to the power of the LPA to enter into a voluntary agreement 
with the owners of land to restrict the use to which the 
land is put. 

The Committee recognized that, in a limited number 
of cases, the LPA might consider it necessary to revoke 
or discontinue planning permission and recommended 
that the government review its discretionary powers to 
make payments to local authorities to meet compensation 
liabilities. 

With regard to existing development, the Committee 
stated: 

The HSE is also frequently asked to comment on propo¬ 
sals to develop or redevelop land in the neighbourhood of 
an existing hazardous undertaking where there may be 
other land users who are closer and possibly incompa¬ 
tible. In these cases the HSE tell us that it takes the view, 
which we fully endorse, that the existence of intervening 
development should not in any way affect the advice that 
it gives about the possible effects of that activity on pro¬ 
posed developments which may appear to be less at 
risk than the existing ones. In other words the exist¬ 
ing situation should never be regarded as providing 
grounds for failing to draw attention to the implications 
for development at a greater distance (Second Report, 
paragraph 108) 

The ACMH emphasized the importance of LPAs having 
available adequate information on which to reach its deci¬ 
sion and on the need for the authority to consult the HSE on 
developments involving hazardous installations and on the 
necessity for the HSE’s advice to be in a form appropriate to 
a planning authority which is not expert in major hazards. 

Following the work of the ACMH, legislative changes 
have been made to the planning arrangements, as described 
below. In parallel with these legislative developments have 
gone administrative changes. The HSE has upgraded its 
capabilities to provide advice to LPAs. The ability of the 
HSE to provide advice has been much enhanced by the 
creation of the Major Hazards Assessment Unit (MHAU), 
while the local Factory Inspectorate, who have always had 
the prime responsibility for the control of hazardous 
installations, has been reorganized so that offices dealing 
with the process industries have inspectors who specialize 
in those industries. The problem of major hazards has 
proved a troublesome one for LPAs. Major hazards involve 
both high technology and difficult issues of risk. Most local 
planners have had little training on major hazards matters. 

4.11.3 Planning reforms 

A number of changes have been made to the planning sys¬ 
tem to deal with the problem of major hazards. The first step 
is to ensure that the LPA knows of the existence of hazar¬ 
dous installations in its area. This is effected by the NIHHS 
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Regulations 1982 and the CIMAH Regulations, originally 
1984 and now1990. Consultation by the LPAwiththeHSE is 
now mandatory for any new hazardous development and 
recommended for other development. 

Under the Town and Country Planning General Develop¬ 
ment (Amendment) Order 1983, development of new 
hazardous installations and development at an existing 
notifiable site involving athree-fold increase in inventory is 
excluded from the general permissions of the GDO, while 
under the Town and Country Planning Use Classes 
(Amendment) Order 1983, uses involving notifiable inven¬ 
tories are excluded from the provisions of the UCO. The 
notification referred to here is that applicable under the 
NIHHS Regulations 1982. 

The Housing and Planning Act 1986 creates a require¬ 
ment for a written consent from the LPA for a new notifiable 
inventory. This consent is separate from planning permis¬ 
sion. The effect of this written consent procedure is to 
obviate for such inventories the difficulties of redefining 
development under planning legislation, to freeze existing 
hazards at their notified level and to remove liability for 
compensation. 

The Town and Country Planning (Assessment of Envi¬ 
ronmental Effects) Regulations 1988 require that an envi¬ 
ronmental impact assessment be submitted to the LPA 
along with the planning application. 

The loophole associated with the concept of development 
is closed by the provisions of the Planning (Hazardous 
Substances) Act 1990 and the Planning (Hazardous Sub¬ 
stances) Regulations 1992. The Act requires that the pre¬ 
sence of a hazardous substance needs the consent of the 
Hazardous Substance Authority, or LPA. 

The Planning and Compensation Act 1991 strengthens 
the function of the local plan as a means of planning for 
major hazard installations. 


4.11.4 HSE consultation and advice 

As stated above, the policy of the HSE is to stabilize and then 
reduce the number of people at risk from a hazardous 
installation. The HSE implements this policy primarily 
through its advice to LPAs. An early account of the HSE’s 
approach was given as an appendix in the Third Report of 
the ACMH. It is reproduced here in Appendix 25. A later 
description has been given by Pape (1984). 

The vast majority of planning decisions are concerned 
not with development on industrial sites, but with develop¬ 
ment in the vicinity of such sites. The HSE issues to LPAs 
guidelines on the size of ‘consultation zones’ around these 
sites and asks to be consulted on developments within these 
zones. Consultation with the HSE is not appropriate for 
minor planning applications. Guidance on the type of 
application for which consultation is required is given in 
DoE Circular 9/84. 

Initially, the HSE set a general consultation distance of 
2 km around a hazardous site. This proved to be excessive 
and the HSE has since refined its assessment methods and 
now specifies consultation distances which are related to 
the particular hazard. In particular, it has developed model 
approaches for two base cases, liquefied petroleum gas 
and chlorine which have been described by Crossthwaite 
(1984) and Pape and Nussey (1985), respectively. These 
model cases are considered in more detail in Chapter 9. 
Here consideration is limited to the consultation distances 
and advice which result from them. 


The HSE distinguishes three types of development: A, B 
and S (special). Type A developments are those where con¬ 
trol may well be appropriate. They are situations where 
people would be present most of the time or where large 
numbers might be present quite often and the people are not 
highly protected. Examples are housing, markets, large 
shops, transport termini and sports stadia. Type B devel¬ 
opments are those where the risk would not normally be 
great enough to warrant control. This includes situations 
where individuals may be present regularly but not full time 
even though the total number of people is not necessarily 
small, and situations where people might be readily incor¬ 
porated into an emergency plan and where they are 
not particularly vulnerable to the hazard. Examples are 
relatively low density factories or warehouses, small office 
buildings, small shops, sport fields and roads. Type S is 
intended to cover developments which are significantly 
more vulnerable than type A. Examples are hospitals, old 
people’s homes and schools. 

The replies from the HSE following consultation by the 
LPA are generally in terms of the risk categories given in 
DoE 9/84: ‘negligible’, ‘marginal’ and ‘substantial’. Negli¬ 
gible risk means that the HSE assessment of the con¬ 
sequences of realization of the hazard is that it is unlikely, if 
not inconceivable, that people in the development would be 
killed, and that if someone was killed, this would be a'freak’ 
effect. Marginal risk means that the probability of people 
being affected by a major release is remote, that in such a 
case they might be seriously affected but that death is unli¬ 
kely. Safety reasons would not in themselves justify a refu¬ 
sal of planning permission, but might justifiably be among 
those contributing to it. Substantial risk means that people 
might be seriously injured by a major release. The risk could 
in itself justify refusal of planning permission and safety 
should be a major factor in the decision. If there were other 
factors strongly favouring granting permission, the HSE 
would suggest that the LPA should hear a more detailed 
explanation of its assessment. In quantitative terms, negli¬ 
gible risk means an individual risk of less than the ‘trivial’ 
level of 10 _6 /year, marginal risk an individual risk of about 
the trivial level and low societal risk, and substantial risk is 
an individual risk above the trivial level and more sub¬ 
stantial societal risk. 

Table 4.19 shows the HSE guidelines on consultation 
zones for LPG storage installations. The table gives gui¬ 
dance not only on the consultation zone but also on zones 
within this. Section A of Table 4.19 gives the distances to the 
zone boundaries for different tank sizes and Section B the 
risk categories for these zones. 

The effectiveness of advice from the HSE to the LPAs 
has been studied by Petts (1987). An account of the use 
of hazard assessment by the HSE in relation to its advice 
to planning authorities is described by Pantony and 
Smith (1982). 

4.11.5 Emergency planning 

There is a statutory requirement for counties and equi¬ 
valent authorities to undertake emergency planning for 
civil defence, and the tendency has been to extend these 
arrangements to cover process site and transport emer¬ 
gencies. The extent of emergency planning undertaken has 
been variable. Some authorities whose areas contain major 
chemical complexes have long had comprehensive emer¬ 
gency plans, while others have not. The CIMAH Regula¬ 
tions 1984 require such authorities to have emergency 
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Table 4.19 HSE guidelines on consultation and related zones and risk categories for LPG storage (after 

Crossthwaite, 1984) 

A Distances to zon< 

e boundaries 





Zone 




Tank size (tonnes) 



6-10 

11-15 

16-25 

26-40 41-80 

81-120 

121-300 

Consultation zone 

150 

175 

250 

300 400 

500 

600 

Middle zone 

125 

150 

200 

250 300 

400 

500 

Inner zone 

50 

50 

50 

75 100 

125 

150 

B Risk categories in zones 

Development type 




Zone 





Inner 


Middle 


Consultation 

A 


Substantial 


Assessment 3 


Negligible 

B 


Negligible 


Negligible 


Negligible 

S(i) 


Assessment 


Assessment 


Negligible 

S(ii) 


Substantial 


Assessment 


Assessment 


plans for installations notifiable under CIMAH (though not 
under NIHHS). Off-site emergency plans are considered in 
Chapter 24. 

4.11.6 Information to public 

The CIMAH Regulations 1984 contain a requirement 
that the public be given information about the hazards to 
which they are exposed and the action which they should 
take in an emergency. The choice of body to be responsible 
for informing the public proved a difficult one. The 
arrangements decided on are as follows. It is intended that 
the body which informs the public is the local authority. 
The manufacturer is required to try to reach with the local 
council an agreement on the information to be provided 
and then to furnish this to the council, which then issues it 
to the public. If, however, an agreement cannot be reached, 
the manufacturer is responsible for informing the public 
directly. 

The information provided must include a statement 
that the activity is notifiable under the CIMAH Regulations 
and has been notified to the HSE and information on the 
nature of the hazard (e.g. fire, explosion or toxic release) 
and on the safety measures and actions to take in the event 
of an accident. 

4.11.7 Public inquiries 

A planning application may become the subject of a public 
inquiry. This may occur if the developer is refused planning 
permission and appeals or if the application is called in by 
the Secretary of State. In some cases, this call-in may be at 
the behest of the HSE. 

It is only relatively rarely that a planning application for a 
process plant becomes the subject of a formal planning or 
public inquiry Nevertheless, there have been a number of 
public inquiries on such developments. They include 


(1) the Mossmorran Inquiry (1977), dealing with propo¬ 
sals by Shell and Esso to build a natural gas liquids 
plant and ethylene cracker (McGill, 1982); 


(2) the Canvey Inquiries (1980 and 1982) into United Refi¬ 
neries’ permission for a new refinery and British Gas 
operation of a methane terminal (Petts, 1985a); 

(3) the Pheasant Wood Inquiry (1980) into housing devel¬ 
opment near an ICI chlorine and phosgene plant (Petts, 
1985b). 

These inquiries have shown a trend towards the increasing 
use of hazard assessment. They have also brought out some 
of the problems in the use of an adversarial forum for the 
discussion of technical matters. 

A discussion of the problems posed by public inquiries 
with special reference to the use of hazard assessment and 
to the presentation of expert evidence has been given by 
Petts, Withers and Lees (1986). 

Experience at inquiries indicates that the use of hazard 
assessments has been fraught with difficulties, hut that 
many of these relate to obscurity, incompleteness and 
inconsistency in the assessments. Another difficult area is 
the public perception of risk. 

The adversarial approach used in inquiries poses 
another problem. Many engineers feel it to be a poor way of 
arriving at the truth in scientific and engineering matters as 
well as being unfamiliar and intimidating. The Flixhorough 
Inquiry gave rise to some debate on this question (e.g. 
Mecklenburgh, 1977a; R. King, 1990). It is considered fur¬ 
ther in relation to accident inquiries in Chapter 27. 

The study by Petts,Withers and Lees (1986) suggests that 
many of the problems of inquiries into hazardous installa¬ 
tions can be greatly mitigated if certain practical steps are 
taken. The adversarial approach is supported as the least 
imperfect means of arriving at the truth on technical mat¬ 
ters and of allowing public participation, hut the use is 
encouraged of informal meetings between parties before 
and during the inquiry. 

The problems experienced over hazard assessment are 
regarded as capable of mitigation, provided that the defi¬ 
ciencies of hazard assessments in past inquiries are reme¬ 
died, and provided that the necessary information is 
available to all the parties and on a suitable schedule. The 
means proposed is that for any installation to which the 
NIHHS or CIMAH Regulations apply and which goes to a 
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planning inquiry, a form of open safety case should be made 
available by industry. 

Although public perception of risk at inquiries remains a 
continuing problem, there is evidence that much of it is 
related to deficiencies in the hazard assessments and also to 
the existence of risks which assessment shows to be rather 
high. A fuller account of public inquiries is given in 
Appendix 26. 

4.11.8 Planner’s viewpoint 

The viewpoint of the LPA is given in Major Hazard Installa¬ 
tions: Planning and Assessment (Petts, 1984b) and Major 
Hazard Installations: Planning Implications and Problems 
(Petts, 1984c). 

Certain LPAs have been conscious from an early date 
of the need to provide for major hazard installations in 
their area. Accounts of the measures taken following 
Flixborough by Halton Borough Council have been given 
by Brough (1981) and Payne (1981). 

4.12 Process Hazard Control: European Community 

The arrangements for the control of major hazards in the EC 
and in certain other European countries are now briefly 
reviewed. Comparative accounts are given in Risk Assess¬ 
ment for Hazardous Installations Q.C. Consultancy Ltd, 
1986), and by Beveridge and Waite (1985) and Milburn and 
Cameron (1992). 

4.12.1 European Community 

Controls over major hazards in the EC are established 
by Directive 82/501/EEC, the Major Accident Hazards 
Directive, amended by 87/216/EEC and 88/610/EEC, as 
described in Section 4.10. The Directive contains require¬ 
ments for notification of installations, for a safety report 
and for emergency planning. 

A critique of the inventory levels set for particular 
hazardous substances is given by VC. Marshall (1982b). 

A fundamental revision of the major hazard arrange¬ 
ments is in prospect, as outlined in Proposal for a Council 
Directive on the Control of Major-Accident Hazards Involv¬ 
ing Dangerous Substances (COMAH) (Commission of the 
European Communities, 1994). Features emphasized in the 
document are land use planning, management and human 
factors, and the safety report. It proposes requirements on: 
land use planning, the safety management system, a major 
accident prevention plan (MAPP) and inspection. It is pro¬ 
posed that the safety report should include management 
systems, should be harmonized in style and should be 
available to the public, subject to certain safeguards. 

4.12.2 Germany 

In Germany, basic safety requirements are embodied in a 
number of measures which include the Industrial Code 
1869-1978, the Imperial Insurance Code 1911, the rules for 
Prevention of Accidents to Man and theTechnical Means of 
Work Act 1968. Selected legislation relevant to major 
hazards in Germany is given inTable 4.20. 

The Federal Emission Control Act 1974 (FECA) (Bunde- 
simmissionsschutzgesetz) is the basic legislation on envi¬ 
ronmental protection and on major hazards. It creates a 
system of licensing for installations liable to cause ‘harmful 
effects’ to the environment or ‘considerable disadvantages’ 
to the public. 

These terms are vague and give rise to difficulties of 
interpretation. More specific requirements are given in the 


Ordinance on Installations Subject to Licensing 1975 
(ISLO), which lists 58 types of installation with a hazard 
potential sufficient to attract licensing. 

Control of major hazards is effected, still under the FECA, 
through the Hazardous Incident Ordinance 1980 (HIO) 
( Stb’rfallverordnung ). The ordinance gives lists of processes 
and chemicals. The licensing requirements apply to instal¬ 
lations which carry out these processes and use these 
chemicals. 

Exemption from the HIO is allowed if the inventory of the 
hazardous substance is very small. The levels of inventory 
below which exemption is given are specified in the First 
General Administrative Regulation 1981 to the ordinance. 

The HIO requires the preparation of a safety analysis. 
The requirements for this are specified in greater detail in 
the Second General Administrative Regulation 1982. The 
information supplied must be such as to allow the regul¬ 
atory authority to assess adequately the compliance by the 
operator with its safety obligations. Where this involves 
calculations, the documentation must show that these have 
been done. There is no stated requirement for QRA. 

An account of the legislation is given by Stahl (1988) and 
an industrial viewpoint is given by Pilz (1982,1987,1989). 


4.12.3 France 

In France, safety legislation is based on the Imperial Decree 
of 1810, which has been subject to amending Laws in 1917, 
1932 and 1961.This legislation was extensively modified in 
the Law of 19 July 1976 on Registered Works for Environ¬ 
ment Protection (Installations Classes) and the associated 
Decree of 10 September 1977. Under this legislation, a dis¬ 
tinction is made between authorized and declared installa¬ 
tions. Installations subject to authorization, which is 
effectively licensing, are defined by inventory of hazardous 
chemicals. 

A safety study is required for an authorized instal¬ 
lation. The study must include a justification of the mea¬ 
sures taken to reduce the probability of realization of 
the hazard and its effects. No requirement is stated for a 
probabilistic risk assessment. The coverage of these 
arrangements is wide. There are some 50,000 authorized 


Table 4.20 Selected legislation relevant to major 
hazards in Germany 


Substances at Work Act 1939 
Technical Means of Work Act 1968 
Explosives Act 1976 
Chemicals Act 1980 
Federal Emission Control Act 
(Bundesimmissionsschutzgesetz ) 1974 
Fourth Ordinance for the Implementation of the Federal 
Emission Control Law: 

Ordinance on Installations Subject to Licensing 1975 
Ordinance on Principles of Licensing Procedure 1977 
Twelfth Ordinance for the Implementation of the 
Federal Emission Control Law: Hazardous Incident 
Ordinance 1908 

First General Administrative Regulation on the Hazardous 
Incident Ordinance 1981 

Second General Administrative Regulation on the 
Hazardous Incident Ordinance 1982 
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installations and the number of declared installations is 
presumably greater still. 

4.12.4 The Netherlands 

In the Netherlands there are separate systems for the 
assurance of safety of employees at the workplace and of the 
public. The first is the responsibility of the Ministry of 
Social Affairs, and specifically the Labour Inspectorate, 
and the second that of the Ministry of the Environment. This 
division is reflected in the requirements for two safety 
reports, an occupational safety report and an external 
safety report. 

Safety legislation in the workplace is based on the 
employee safety law of 1934. The Statute of 23 November 
1977 creates a requirement for hazardous installations to 
submit a safety report. This occupational safety report 
statute is the basic legislation on major hazards at the 
workplace. Accounts of the safety report have been given by 
Meppelder (1977), van de Putte and Meppelder (1980), van 
de Putte (1981, 1983), Husmann and Ens (1989), Oh and 
Albers (1989) and Bothelsburgh (1995). 

The installations for which a safety report is required are 
defined not by inventory but on a ‘threshold value’, which is 
defined as the quantity of material which would present a 
serious danger to human life at a distance of over 100 m from 
the point of release. There is a specified method of calculat¬ 
ing this value. 

The report must contain an assessment of the hazards in 
the form of a specified fire and explosion index and a toxi¬ 
city index, derived from the Dow Index method.With regard 
to QR A, the account given by van de Putte (1981) indicates a 
view that quantification of probabilities and consequences 
is desirable, but so is a recognition of the difficulties in the 
current state of the art. Husmann and Ens (1989) state that a 
quantitative study involving risk assessment should be 
performed where novel technology is used. 

The external safety report is the concern of the Ministry 
of the Environment. It deals with the effects of major 
hazards outside the factory. Accounts are given by Versteeg 
(1988) and Ale (1991,1992). 

The Ministry of the Environment is deeply involved in 
QRA. It was one of the sponsors of the Rijnmond Report on 
hazardous installations in the Rijnmond. It has sponsored 
the development of the computer-based SAFETI package 
byTechnica (see Ale andWhitehouse, 1986). 


4.13 Process Hazard Control: USA 

The arrangements for the control of major hazards in the 
United States are now briefly described. Overviews are 
given by Brooks etal. (1988) and Horner (1989). US legisla¬ 
tion on safety has been outlined in Chapter 3. The account 
given here is confined to accidental releases, which include 
major hazards. 


4.13.1 Plant siting 

The development of these controls needs to be seen against 
the background of the growing problems experienced in the 
siting of new hazardous installations since the late 1970s. 

A case in point at this time was the siting of LNG facil¬ 
ities, as described in the Transportation of Liquefied Nat¬ 
ural Gas by the Office of Technology Assessment (OTA) of 
the US Congress (1977). The Federal Power Commission 
(FPC) was the lead agency in determining whether an indi¬ 


vidual LNG project should be allowed. It was the practice of 
the FPC to make decisions on siting on a case-by-case basis. 
The OTA identified several problems in this approach. The 
FPC was a regulatory rather than apolicy-making body and 
there was no national siting policy to which it could refer. 
The criteria on which the FPC made its decisions on siting 
were not known to the industry, since no guidelines were 
issued.There had been pressure from the state legal author¬ 
ities and from industry for the issue of uniform siting 
criteria. In some cases the FPA had made its approval 
contingent on the receipt of state and local approval, so that 
the criteria that the industry had to satisfy had become even 
more obscure. 

There were several areas of overlapping jurisdiction.The 
Office of Pipeline Safety Operations (OPSO) was involved 
through the Natural Gas Pipeline Safety Act 1968, although 
there appeared to be a statutory provision against OPSO 
standards prescribing the location of LNG facilities. In the 
past, the two agencies had clashed directly on the standards 
required. The FPC required a temporary shut-down on an 
LNG facility which OPSO had inspected and approved. The 
US Coast Guard (USCG) was also involved through the 
Coastal Zone Management Act 1972. This Act required an 
applicant for a Federal licence or permit for an activity in a 
coastal zone of a state to certify the project to be consistent 
with the state’s programme. 

Siting was also affected by other legislation.The National 
Environmental Policy Act 1969 required an environmental 
impact statement. 

4.13.2 Accidental releases 

The US legislation that covers major hazards is framed in 
terms of accidental releases. It has been decisively influ¬ 
enced by releases at home and abroad, and particularly by 
the toxic gas disaster at Bhopal. 

The principal Federal legislation is the Emergency Plan¬ 
ning and Community Right-to-Know Act 1986 (EPCRA), 
which is Title III of the Superfund Amendments and Reau¬ 
thorization Act 1986 (SARA), generally known as SARA 
Title III, and is enforced by the Environmental Protection 
Agency (EPA). Other relevant federal legislation is the 
Occupational Health and Safety Administration (OSHA) 
rule for Process Safety Management of Highly Hazardous 
Chemicals 1990. There are also the state laws in New Jersey 
and California. One focus of concern is the control of high 
toxic hazard materials (HTHMs). 

4.13.3 SARA Title III 

SARATitle III is the Federal legislation that creates controls 
on accidental releases of hazardous substances. The legis¬ 
lation followed soon after Bhopal. Accounts are given by 
Brooks et al. (1988), Bowman (1989), Horner (1989), Burk 
(1990) and Fillo and Key worth (1992). SARATitle III has 
four main parts dealing with emergency planning, emer¬ 
gency notification, community right-to-know and toxic 
chemicals inventory. 

For each state the governor appoints an Emergency 
Response Commission (ERC) that in turn designates local 
emergency planning committees charged with the pre¬ 
paration of an emergency plan. The facilities that attract 
such an emergency plan are those containing certain che¬ 
micals above specified inventory levels. These chemicals 
and inventories are given in the List of Extremely Hazard¬ 
ous Substances and Their Threshold Planning Quantities 
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(TPQ) developed by the EPA. Management is required to 
provide any information needed by the local emergency 
planning committee to implement the emergency plan. The 
wording has deliberately been left broad enough for the 
local emergency planning committee to request a QRA 
(Florio, 1987). 

The emergency notification arrangements require the 
management of the facility to report immediately to the local 
planning committee any accidental release and the area 
likely to be affected. 

With regard to the right-to-know requirements, for any 
hazardous chemical that attracts the requirement for a 
Material Safety Data Sheet (MSDS) under the OSHA1970, 
the facility has to submit either the data sheets or a list of the 
chemicals to the local emergency planning committee, the 
state ERC and the responsible fire department. The facility 
must also submit to the same three bodies information on 
the hazardous inventory. 

Section 313 contains the requirement to submit informa¬ 
tion on the ‘toxic chemical release emission inventory’, or 
Toxic Release Inventory (TRI), on the Toxic Chemical 
Release Form. The data required in this form are concerned 
primarily with passage of toxic chemicals into the envi¬ 
ronment. For each chemical, a mass balance and the quan¬ 
tity emitted annually is required. 

The subjects of the principal sections of SARA Title III 
may be summarized as follows: Section 301, state ERC; 
Section 302, notification requirements; Section 304, acci¬ 
dental release reporting; Section 305, study of safety cap¬ 
abilities; Sections 311 and 312, information for the public; 
and Section 313, toxic emissions. 

4.13.4 Special Emphasis Program 

In 1986, OSHA initiated a Special Emphasis Program for 
installations with large inventories of hazardous chemicals. 
The purpose of the programme was to ensure that such 
facilities were subject to a systems safety inspection 
(Hanson, 1986). The systems safety inspection emphasizes 
four main areas: risk management, hazard identification 
and assessment, process design and control, and emer¬ 
gency planning. 

4.13.5 Process Safety Management Rule 

The OSHA has further extended its controls to prevent 
accidental releases with the rule for Process Safety Man¬ 
agement of Highly Hazardous Chemicals (the Process 
Safety Management Rule). The governing document (Fed¬ 
eral Register 1990 July 17,29 CFRPart 1901) refers to major 
accidents such as Flixborough, Seveso and Bhopal, and to 
EC controls on major hazard installations in the ‘Seveso’ 
Directive and to the need to strengthen such controls in the 
United States, which otherwise largely rely on the OSHA 
1970 and on standards. As its name implies, the Process 
Safety Management rule places particular emphasis on 


management. The rule covers hazard identification, evalu¬ 
ation and control. 


4.13.6 New Jersey Toxic Catastrophe Prevention Act 

The New Jersey Toxic Catastrophe Prevention Act 1985 
(TCPA) is also addressed to the identification, evaluation 
and control of hazards for facilities handling extraord¬ 
inarily hazardous substances (EHSs), there being 11 such 
chemicals on the initial list. It creates a requirement for a 
risk management plan (RMP). The RMP covers risk man¬ 
agement, safety review, risk assessment and emergency 
planning. 

4.13.7 California Hazardous Materials Planning Program 

The California Hazardous Materials Planning Program 
draws together four complementary laws that are codified 
in chapter 6.95 of the state Health and Safety Code. 
It requires a facility handling more than a specified mini¬ 
mum inventory of a hazardous material to establish a ‘busi¬ 
ness plan for emergency response’, giving details of the 
inventory and the emergency plan. The programme 
requires a business that handles a defined ‘acutely hazard¬ 
ous material’ to register with the administrative authority. If 
a business is notified by the authority that a Risk Manage¬ 
ment and Prevention Program (RMPP) is required, it must 
then prepare one. 

4.13.8 Regulatory agencies 

As just described, both the EPA and the OSHA are involved 
in the regulation of accidental releases, primarily in the case 
of the former through SARA Title III and of the latter 
through the OSHA 1970 and, more recently, the Process 
Safety Management Rule. The division of responsibility 
between the two agencies is not clear-cut. The Jeffreys 
Amendment of 1990 defined roles for OSHA and EPA 
in preventing accidental releases. OSHA was directed to 
bring in the regulation on Process Safety Management of 
Highly Hazardous Chemicals and EPA to bring in a regu¬ 
lation on accidental releases that would complement 
the OSHA requirements and would focus on community 
issues. 


4.13.9 Voluntary initiatives 

Mention should also be made of some of the voluntary 
initiatives that have been taken in the United States in this 
area. Since 1985, the Chemical Manufacturers Association 
(CMA) has recommended to its members the Community 
Awareness and Emergency Response (CAER) programme. 
This voluntary programme deals particularly with emer¬ 
gency planning. The creation in 1985 of the Center for Che¬ 
mical Process Safety (CCPS) of the AlChE, described in 
Chapter 1, is another such initiative. 




Economics and 
Insurance 


Contents 

5.1 Economics of Loss Prevention 5/2 

5.2 Cost of Losses 5/2 

5.3 Cost of Prevention 5/4 

5.4 Level of Loss Prevention Expenditure 5/5 

5.5 Insurance of Process Plant 5/7 

5.6 Property Insurance 5/11 

5.7 Business Interruption Insurance 5/16 

5.8 Other Insurance Aspects 5/17 

5.9 Notation 5/19 



5/2 ECONOMICS AND INSURANCE 


5.1 Economics of Loss Prevention 

Loss prevention is concerned with the avoidance both of 
personal injury and of economic loss. In both spheres there 
is an economic balance to be struck. But there are also quite 
difficult problems in making the economic assessments. 
There is no doubt, however, about the economic importance 
of loss prevention. Some costs arise through failure to take 
proper loss prevention measures; others are incurred 
through uninformed and unnecessarily expensive meas¬ 
ures. Both types of cost are numerous and can involve 
major items. The financial viability of a project is often 
determined by loss prevention factors. 

In today’s environment, many loss prevention measures 
that were optional in the past are now mandated by gov¬ 
ernment regulation. Others are voluntarily provided in 
some countries as they have become ‘industry practice’. 
Still others are provided due to court rulings in liability 
cases. In the above situations, traditional cost benefit 
analysis studies may not be relevant. 

Selected references on process economics and on eco¬ 
nomics of loss prevention are given in Table 5.1. 

5.2 Cost of Losses 

The result of not taking adequate loss prevention measures 
is to give rise to losses and costs such as those of: (1) acci¬ 
dents, (2) damage, (3) plant design delays, (4) plant 
commissioning delays, (5) plant downtime, restricted out¬ 
put, (6) equipment repairs, (7) loss of markets, (8) public 
reaction and (9) insurance. A rational approach to loss 
prevention requires some understanding of the economic 
importance of these factors and of the means of estimating 
them. 

Unless otherwise stated, the cost figures given below are 
those for the year referred to. The cost in real terms may be 
obtained by correcting the values given using the appro¬ 
priate inflation index. There may be no single index which 
is totally applicable, but in some cases the retail price index 
(RPI) and in others a plant cost index may be the most suit¬ 
able. There is also the further complication of exchange rate 
conversion. 

5.2.1 National level 

It is convenient to consider first the cost of these losses at 
national level in the United States. Estimates may be based 
on information on the following: (1) accident statistics, 
(2) fire loss statistics, (3) insurance statistics, (4) main¬ 
tenance and downtime statistics and (5) major accidents. 

Accident statistics are fairly readily available from the 
US Department of Labor, Bureau of Labor Statistics and 
from the National Safety Council in the United States for 
injuries and from the National Fire Protection Association 
(NFPA) for fires in the USA (Table 5.2). Accident statistics 
in the United Kingdom can be obtained from the Annual 
Report of HM Chief Inspector of Factories and the annual 
Health and Safety Statistics. By making certain assump¬ 
tions, the national resource cost, or cost to the nation, of 
these accidents may be estimated. 

The total number of fatal accidents as listed above for 
2001 in the United States is 5270. Of this total, there were 
599 fatalities in manufacturing facilities, and, of these, 

7.2 % or 43 were due to fire or explosion incidents. 

In the United Kingdom, statistics for fires are published 
by the Home Office in the annual Fire Statistics United 


Table 5.1 Selected references on process economics 
and economics of loss prevention 


Peters (1948); Perry (1954); Aries and Newton (1955); 
Schweyer (1955); Happel (1958); Vilbrandt and Dryden 
(1959); Baumann (1964); Foord (1967-68); ICI (1968); Peters 
and Timmerhaus (1968); Raiffa (1968); Rudd and Watson 
(1968); IChemE (1969/48); IProdE and ICWA (1971); 

D.H. Allen (1968,1972 IChemE/52,1975,1988,1990 
IChemE/85); H. Gibson and Jackson (1972); Coward 
(1973 FRS Fire Research Note, 1982); Holland et al. (1974); 
L.M. Rose (1976); Windebank (1976); R. King and Magid 
(1979); de la Mare (1982); Kurtz (1984); C. Tayler (1984b); 
T.E. Powell (1985); S.E. Dale (1987); Drangeid (1989); 
Garrett (1989) 

Costs 

NRC (Appendix 28 Cost Estimation); Chemical 
Engineering (1958-, 1963,1978c, 1979a); Anon. (1963); 
Weinberger (1963); Dow Chemical Co. (1964,1966 a,b, 1976, 
1980,1987,1994b); Anon. (1965b); Roth (1965); Dybdal 
(1966); J.T. Gallagher (1967); Guthrie (1968,1969,1970, 
1971,1974); Mendel (1968); Chase (1970); Liptak (1970); 
Alonso (1971); Frost (1971); S.P Marshall and Brandt (1971, 
1974); Popper (1971); Pitkin (1972); W.L. Nelson (1976); 
Pikulik and Diaz (1977); Hasselbarth (1977); Baltzell (1978); 
R. Kern (1978b); Kohn (1978a); Bridgewater (1979); C.A. 
Miller (1979); Vatavuk and Neveril (1980-); Barrett (1981); 
Cran (1981); Desai (1981); L.D. Epstein (1981); Mulet etal. 
(1981); Humphreys and Katell (1981); Corripio et al. 

(1982 a,b); S.R. Hall etal. (1982); Lonsdale and Mundy 
(1982); Mcintyre (1982); de la Mare (1982); Matley (1982); 
Purohit (1983); Vogel and Martin (1983—); K.E. Lunde 
(1984);T.J.Ward (1984); Anon. (1985j); AIChE (1985/82); 
F.D. Clark and Lorenzoni (1985); Klumpar and Slavsky 
(1985 a-c); A. Rose (1985); H.W Russell (1985); Anon. 

(1987 f,y); IChemE (1988/82); Kletz (1988g); March 
(1989); Samid (1990); Kerridge (1992); Lindley and Floyd 
(1993); Rodriguez and Coronel (1992); Ulrich (1992); 
Garnett and Patience (1993); Plavsic (1993); Gerrard (1994) 

Loss statistics 

BIA (periodic); BRE (periodic, see Appendix 28); FRS 
(periodic, see Appendix 28); HM Chief Inspector of 
Factories (annual); Ministry of Technology (1969); Munich 
Re (1991-2001); NFPA (1991-2001) 

Costs of accidents 

Badger (1968); Beddoe (1969); Calabresi (1970); Mealey 
(1970); Robens (1972); Sinclair (1972); Munich Re (1991); 
HSE (1993 HS(G) 96); Anon. (1994 LPB116); N.V Davies 
and Teasdale (1994); Marsh Large Loss (1979-2002); 
Badger (2002) Large-Loss Fires in 200L, National Safety 
Council Facts and Statistics (2001,2002) 

Costs of plant unreliability, downtime 

Ministry of Technology (1969); Jenkins et al. (1971);Tucker 
and Cline (1971); C.F. King and Rudd (1972); D.H. Allen 
(1973); J. A. Richardson and Templeton (1973); de la Mare 
(1975,1976); Reynolds (1976); Sancaktar (1983) 

Costs of prevention 

FRS (1973 Fire Research Note 982); Pratt (1974); Amson 
(1976); Windebank (1976); C.W. Smith (1977); Amson and 
Goodier (1978); Ricci (1978c); Anon. (1982b) 
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Level of loss prevention expenditure 

Redington (1965); Sinclair (1972); Melinek (1974 BRE CP 
88/74); Kramer (1974); S.B. Gibson (1976d); Kletz (1976d, 
1980a, 1980-, 1981f, 1988g); Anon. (1981u); Witter (1982); 
Berenblut and Whitehouse (1988);Wakeling (1988); Hirano 
(1990a) 

Decision aids: G.H. Mitchell (1972); R.E. Hanna (1979) 
Expenditure decisions: Oakland (1982) 

Inherently safer plants 

Kletz (1984d); D.W. Edwards and Lawrence (1993); Rushton 
etal. (1994); Inherent Safety Workshop (CCPS Annual 
Meeting, 10 October 2002) 


Table 5.2 Estimated national resource cost of accidents 
in the United States in 2001 excluding World Trade 
Center figures 


Cast®) 

Fatalities and industrial accidents 

132,100 

Industrial accidents 3 

978 

Under-reporting 

5,200 

Non-reportable accidents 

1,500 

Total 

139,778 


a Property damage only, from NFPA. 


Kingdom and by the Fire Protection Association (FPA). The 
FPA defines a large fire as one costing £50,000 or more and 
the Home Office uses this definition. The Fire Statistics 
United Kingdom 1990 (Home Office, 1992) gives the annual 
loss due to large fires over the 4-year period 1986-89 as 
some £290 million. 

The FPA Large Fire Analysis 1989 (FPA, 1991) gives the 
number of large loss fires as 739, with an average loss of 
£0.382 million, making a total loss of £282 million. In the 
chemical and allied industries there were eight such fires, 
with an average loss of £0.656 million, making a total loss 
of £5.2 million, which was 1.9% of the total. 

The NFPA report of Large-Loss Fires (NFPA, 2002), 
reports the total number of fires as 1,734,500 with an esti¬ 
mated loss of $44,023 billion. NFPA considers a large loss 
as one resulting in more than $5 million damage. There 
were 36 large loss fires in excess of $5 million (measured in 
1992 dollars) for 2001 and 20 in excess of $10 million. Total 
estimated property damage from the 20 largest losses 
excluding the World Trade Center (WTC) incident was $762 
million. Three of the largest 20 losses involved oil refin¬ 
eries. 

In previous editions of this guide, the expenditure on 
insurance was used as a measure of the cost of incidents. 
With the continued growth of multinational corporations, 
the globalization of the world economy and the emergence 
of supermajors in the energy business, insurance costs can 
no longer be used to effectively estimate the cost of inci¬ 
dents. A large number of events no longer are reported to 
insurers and the costs of these are absorbed fully by the 
corporation. 


Table 5.3 Property damage and business interruption 
losses worldwide, 1985-89 (after Munich Re, 1991) 


No. of losses Loss (US$ million) 

Unindexed Indexed 


Material damage losses 

1985 198 457 571 

1986 149 184 204 

1987 135 877 947 

1988 121 671 698 

1989 115 1,336 1,350 

Business interruption losses 

1985 53 146 178 

1986 22 71 85 

1987 31 304 349 

1988 31 284 309 

1989 56 1,862 1,937 


Within the refining industry, Solomon Associates con¬ 
duct annual surveys of member company facilities that 
analyse numerous costs and other factors as a means of 
comparing refineries in geographic market areas. The 
Solomon ratings provide an indirect measure of the cost of 
incidents as they impact maintenance costs and on-stream 
factors. 

Data on worldwide fire and explosion losses have been 
given in Losses in the Oil, Petrochemical and Chemical 
Industries by Munich Re (1991). The property damage and 
business interruption losses worldwide in the Munich Re 
data base for the years 1985-89 are given in Table 5.3. 

A more recent study,' 'The 100 Largest Losses 1972-2001! 
Large Property Damage Losses in the Hydrocarbon-Chemi¬ 
cal Industries’, 20th Edition, James C. Coco, editor, was 
published by Marsh Inc., a leading insurance broker. 
According to this study, the 100 largest losses in the 
hydrocarbon and chemical process industries during the 
30-year period covered cost $10.8 billion in property 
damage for an average of $108 million per incident. In a 
separate section covering large losses to offshore facilities, 
the Marsh study listed 15 incidents that occurred between 
1987 and 2001. The total property damage loss for these 
incidents was $3.81 billion or an average $254 million 
per incident. All loss amounts in this study were adjusted 
for inflation to reflect US dollars as of 2002 and include 
only the cost of direct property damage and debris removal. 
The greater concentration of assets and the greater like¬ 
lihood of total loss at offshore installations accounts for the 
substantially higher average loss compared with the land- 
based facility losses. 

Even at the international level, large losses such as those 
of the Piper Alpha oil platform in 1988 and of Pasadena in 
1989 have a major impact on the cost of losses in a given 
year. This is even more true at the national level. This needs 
to be taken into account if annual average figures for peri¬ 
ods when no such loss occurs are not to be misleading. 

Public reaction to incidents involves the industry in 
additional costs. A major disaster such as Flixborough may 
result in legislation or other measures which affect costs 
throughout the industry. This may occur even if the dis¬ 
aster is in another country. Seveso had a marked influence 
in Europe and Bhopal worldwide, not least in the United 
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States, the base of the parent company. In other cases the 
reaction is at local level. Intermediate cases occur when 
public reaction causes changes in the practice of a particu¬ 
lar branch of the industry. The costs due to public reaction 
have been discussed in general terms by S.B. Gibson 
(1976d), but the estimation of such costs is very much a 
matter of judgement. 

Further information relevant to the cost of losses is given in 
Appendix 1. This appendix lists, in Table A1.4, numerous 
cases of fires and explosions which resulted in property 
damage and or business interruption. Also listed inTable A1.4 
are numerous instances where, for reasons of hazard and/or 
pollution, a company has either ceased production at an 
existing plant or has not proceeded, or has not been allowed to 
proceed, with a planned development of production. Such 
cases often involve, of course, heavy financial losses. 


5.2.2 Company and works level 

If now the methods of determining these costs are con¬ 
sidered at the level of the individual company or works, 
estimates may again be based on the same types of infor¬ 
mation as before: (1) accident statistics, (2) fire loss statis¬ 
tics, (3) insurance statistics, (4) maintenance and downtime 
statistics and (5) major accidents. There are some impor¬ 
tant differences, however, between company and national 
level. The two principal points are that the company gen¬ 
erally has access to higher quality information than is 
available at national level. The other is that the company is 
much more vulnerable to a single major incident. 

An illustration of the cost of accidents at company level 
has been given in a Dupont study referred to by McKee of 
Conoco at the Piper Alpha Inquiry as evidence that safety 
is good business (1990). Worldwide, in 1985 Conoco had 39 
lost work-day cases. On the basis of the industry average, 
the expected value was 372, so that 333 cases, and their 
associated costs, were avoided. This was equivalent to a 
saving of some $6.2 million at the time. 

Accident costs for injuries at work was reported by the 
National Safety Council as costing US economy $132.1 bil¬ 
lion in 2001 from 10,700 injuries per day and 15 fatalities. 
Off the job injuries cost the economy an additional $184 
billion. The Costs of Accidents at Work by the HSE (1993a) 
describes a set of five case studies of accident ratios, on the 
lines described in Chapter 1, and gives corresponding cost 
estimates. 

Company level fire loss statistics may be used, but the 
effect of a possible single large loss fire needs to be borne 
in mind. 

For companies that purchase insurance with relatively 
low deductible or self-retention layers, insurance costs may 
be viewed. The insurance costs incurred by the company 
are as another measure of the cost of losses.Where relevant, 
insurance costs need to he considered both in terms of the 
rates which are currently quoted and of those which might 
be obtained by the adoption of further loss prevention 
measures, if any. Actual insurance rates are no longer 
available, and will need to be obtained from company data 
and from insurer’s quotations. The extent to which reduced 
rates may be obtained which give credit for loss prevention 
measures is considered below. 

Costs which the company is especially well placed to 
assess are those of commissioning delays, downtime and 
maintenance in its own plants. Delays in design or com¬ 
missioning related to plant safety tend to arise mainly from 


failure to recognize serious hazards sufficiently early. 
The influence of plant lateness on profitability is a well- 
developed topic in process economics and methods are 
available to estimate it. Estimates of the effect of plant 
lateness on ammonia plant economics are given inTable 1.5. 

Plant unavailability, or downtime, may or may not incur 
serious cost penalties, depending on whether there is a 
ready market for the products. Similar considerations 
apply to partial unavailability or limited output. Moreover, 
the penalties of unavailability are not necessarily linear. It 
is quite possible to live permanently with a degree of 
undesirable downtime, but a single protracted stoppage 
may be catastrophic in terms of loss of profits and markets. 
Methods of estimating both the mean and spread of plant 
availabilities are described in Chapter 7. 

The effect of downtime on plant profitability is another 
standard topic in process economics (e.g. D.H. Allen, 1973). 
A theoretical study, which considers the effect of down¬ 
time, and in particular the point in the plant life when this 
occurs, has been made by J.A. Richardson and Templeton 
(1973). A case study of the effect of downtime on the profit¬ 
ability of an actual petrochemical plant has been described 
by Jenkins, Ottley and Packer (1971). 

Data on equipment failures are available as generic fail¬ 
ure data given in the literature or as data obtained from the 
works; similarly for equipment repair times and costs. 
Often the works accounting system can yield much valu¬ 
able information in this area (R.P. Reynolds, 1976). It is then 
a relatively straightforward matter to estimate the direct 
costs of repairing failures. 

If an incident occurs at a works, public reaction must be 
expected and is likely to give rise to expenditure. The costs 
outlined are not all mutually exclusive categories. For 
example, property damage costs as determined by a total 
loss control programme also appear as equipment repair 
costs, but the costs have been listed in this way to illustrate 
the different approaches which may be made to their 
assessment. 


5.3 Cost of Prevention 

Some of the areas in which costs tend to be incurred to 
prevent loss are: (1) management effort, (2) research effort, 
(3) design effort, (4) process route, (5) operational con¬ 
straints, (6) plant siting, (7) plant layout and construction, 
(8) plant equipment (safety margins, materials, duplica¬ 
tion), (9) process instrumentation (trip systems), (10) fire 
protection, (11) inspection effort and (12) emergency plan¬ 
ning. Since all aspects of a project have safety implications, 
any such list is somewhat arbitrary. Others are given in the 
literature (e.g. Pratt, 1974). The areas listed are those in 
which additional costs attributable to loss prevention are 
particularly likely to occur. 

Loss prevention requires considerable additional effort 
in management generally (see Chapters 1, 6, 20 and 21), 
hazard identification (Chapter 8), process and pressure 
system design (Chapters 11 and 12), plant inspection 
(Chapter 19), emergency planning (Chapter 24) and 
research (Chapter 27). 

Considerations of safety may well determine the process 
route, that is, the basic chemical reactions, and define the 
operating limits for the process parameters, for example, 
pressure, temperature, concentration (see Chapter 11). 
Obviously these factors are of fundamental importance to the 
economics of the process. Process economics are also greatly 
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affected by plant siting and layout (see Chapter 10). The site 
which is otherwise most attractive may be ruled out on safety 
grounds. A layout which requires large separation distances 
may be expensive in land and pipework. 

The various safety factors which are incorporated in the 
plant design greatly increase costs. These include design 
with thicker vessel walls, use of more costly materials of 
construction, selection of more expensive equipments and 
duplication of items (see Chapter 12). Additional instru¬ 
mentation such as trip systems (see Chapter 13) and addi¬ 
tional fire protection and fire fighting equipment (Chapters 
10 and 16) constitute further costs.While expenditure in all 
these areas is unavoidable, it is the aim of loss prevention to 
get value for money in this expenditure. 

There are available some global estimates for expenditure 
attributable to safety and loss prevention, and also to envir¬ 
onmental protection. Kletz (1988g) quotes three sets of esti¬ 
mates. One estimate for safety and environmental costs for 
plant in the United Kingdom given by a Chemical Industries 
Association (CIA) source is 12-15% of total investment. A 
second estimate derives from his own survey of 10ICI plants, 
which showed that on average 10-15 % of the capital cost was 
spent on safety measures over and above the irreducible 
minimum necessary for a workable plant; items such as relief 
valves are regarded as basic equipment and are not included in 
this figure. Another 5% was spent on pollution control. The 
proportions spent varied widely between plants; in one case 
the expenditure on safety was 50% of capital cost. The third 
estimate is that of aUS source to the effect that during the1990s 
in the hydrocarbon processing industry (HPI) some 60 - 75 % 
of capital was spent on safety and environmental compliance 
issues due to the EPA Clean Air Act, the OSHA 1910.119 PSM 
Regulation, and other federal and state-related initiatives. A 
sum equal to 9 % of capital is spent on health and safety, though 
a large part of this is on revenue items. 


5.4 Level of Loss Prevention Expenditure 

5.4.1 General considerations 

The effect of different levels of expenditure on safety is 
shown in general terms in Figure 5.1 (Kletz, 1986d). The 


expenditure shown refers to that required over and above 
that necessary for a workable plant. At the left-hand 
end of the graph, expenditure on safety is also good busi¬ 
ness, but as the expenditure is increased the returns 
diminish and lead eventually to the company going out 
of business. 

The loss prevention approach has altered considerably 
the terms of the long-standing debate on the optimum level 
of safety expenditure. An essential element in this 
approach is the quantitative assessment of hazard. This in 
turn makes it necessary to take a view of the levels of risk 
which are unacceptable and which must be removed by 
expenditure. Moreover, quantification also provides the 
information on which can be based rational decisions on the 
cost-effectiveness of additional expenditure in reducing 
the risk to human life. 

The question of safety expenditure then largely revolves 
around the decisions on these primary and secondary cri¬ 
teria, the levels of unacceptable risk and the expenditure to 
save a life. Both criteria can be compared with those used 
explicitly or implicitly in other industries and activities. 
The question of acceptable risk and risk criteria is con¬ 
sidered in more detail in Chapters 4 and 9. 

In fact, the area of choice in safety expenditure in the 
chemical industry is not as wide as sometimes appears 
from general discussions of optimum levels of expenditure. 
The standards of safety which are already obligatory are 
high and have tended to rise. Since in the chemical industry 
safety is both relatively good and relatively expensive to 
improve, the high minimum standard may well tend to 
become the norm. This is not unreasonable provided, but 
only provided, that additional expenditure is incurred 
where it is cost-effective in terms of human life. 

It can be misleading to assume that increased safety 
necessarily involves increased expenditure. It is undoubt¬ 
edly true that safety expenditure which is based on reac¬ 
tion to incidents can be very expensive. But it is general 
experience that good practice usually costs no more than 
bad and gives both improvements in safety and reductions 
in costs. The reason is that high levels of safety require high 
quality management and management systems, and that 



Figure 5.1 Effects of increasing expenditure on safety and loss prevention (Kletz, 1986d) (Courtesy of the 
Institution of Chemical Engineers) 
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if the company has these, it also has the capability to 
achieve its other goals. 

Thus, given good loss prevention practice, large 
improvements in safety can be achieved relative to poor 
practice at no additional cost. That said, there are within 
the context of good practice some additional costs which 
are attributable only to safety and which must be borne. 

Anotheraspectofsafety expenditureisthe estimation ofthe 
effect which additional expenditure already incurred has 
had in improving safety.This is considered in Chapter 27. 

5.4.2 Decision aids 

The various techniques of economic analysis such as net 
present value (NPV) and discounted Cash Flow (DCF) may 
also be used in support of assessment of the economic level 
of loss prevention expenditure (D.H. Allen, 1973; C.S. Park, 
2002). Engineering economic analysis tools are also avail¬ 
able on the internet at http://www.eng.auburn.edu/~park/ 
cee2.html; http://www.eng-tips.com; http://www.isr.umd. 
edu/~austin/ence202.d/economics.html and other sites. 
The difficulties lie principally in assessing the savings. 

Some decisions on the level of loss prevention expendi¬ 
ture are amenable to treatment by other formal decision¬ 
making techniques, in particular decision analysis. Cur¬ 
rent techniques and models for economic decision analysis 
can be found in Contemporary Engineering Economics by 
C.S. Park (2002) and Capital Investment Analysis for 
Engineering and Management by J.R. Canada et al. (1995). 

Accounts of decision analysis are given by G.H. Mitchell 
(1972) and Hastings and Mellow (1978). In a typical decision 
analysis there is a set of possible outcomes, or states of 
nature, and a set of possible options for action, or decisions. 
The aim is to choose the decision(s) which maximize the 
gain, or utility, or minimize the loss, or regret. A common 
form of the problem is that there is a possibility of obtaining 
better information, which will improve the decision but will 
itself involve a cost. 

The application of this technique to loss prevention has 
been illustrated by R.C. Hanna (1979). The problem con¬ 
sidered is the appropriate level of fire protection for a pro¬ 
cess unit handling liquefied petroleum gas (LPG). Three 
states of nature are considered - Si no fire; S 2 , a small fire 
and S 3 , a maj or fire incident - in a given year. There are also 
three decisions: d\, no fire protection; d 2 , fireproofing and 
sprinklers; and d 3 , fireproofing, sprinklers and surveil¬ 
lance and control instrumentation. There is the option to do 
a hazard survey which should provide improved informa¬ 
tion on which to make the decision. The three outcomes of 
the survey, or indicators, I1—I3 correspond to recommen¬ 
dations to implement decisions d\—d 3 , respectively. 

The data required for the analysis are shown in Table 5.4. 
Sections A and B give, respectively, the estimates made of 
the costs of preventive measures and of probabilities P(Sj) 
of no fire, a small fire and a major fire, the latter being based 
on historical data. Section C gives the estimated loss costs, 
prevention costs and total costs. The loss costs are calcu¬ 
lated using the relationship: 

D(d,)=^P(S y )CW,S ; ) [5.4.1] 


where C is the loss cost for a particular state of nature and 
level of protection (US$k/year) and D is the loss cost for a 


Table 5.4 Decision analysis for level of fire prevention 
expenditure (after R.C. Hanna, 1979) 


A Prevention 


CostM* (US$) 


d l 0 

d 2 25,000 

d 3 100,000 


B State of nature probabilities 


States of nature 


Si S 2 S 3 


P(Sj) 0.93 0.05 0.02 


C Loss costs, prevention costs and total costs 
(without survey) 


Loss cost 


Annual 


Present Prevention 

Total 
cost, r 
(US$k) 

C 

(US$k/ 

year) 

Si S 2 

S 3 

D 

(US$k/ 

year) 

Total 

(US$k) (US$k) 

d 3 0 100 

1,000 

25 

156.5 0 

156.5 

d 2 0 50 

200 

6.5 

40.7 25 

65.7 

d 3 0 10 

50 

1.5 

9.4 100 

109.4 

D Probabilities of survey correctness 




States of nature 




Si 

s 2 

S 3 

P(/i|Sj) 


0.80 

0.05 

0.03 

Pih\Sj) 


0.15 

0.85 

0.07 

msj) 


0.05 

0.10 

0.90 

Total 


1.00 

1.00 

1.00 


E Branch probabilities 

Survey branches 

m 



0.747 



p(h) 



0.183 



p(h) 



0.070 



State of nature branches 




States of nature 





Si 

S 2 

S 3 

Total 

P(Sj 

Id 

0.996 

0.003 

0.001 

1.000 

P(Sj 

h) 

0.760 

0.232 

0.008 

1.000 

PiSj 

h) 

0.669 

0.072 

0.259 

1.000 
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F Loss costs, prevention costs and total costs 
(with survey) 

Loss cost 


Annual, D Present value Prevention Total cost 


h di 1.3 8.14 

d 2 0.35 2.19 

d 3 0.08 0.5 

1 2 d, 31.2 195.28 

<k 13.2 82.62 

d 3 2.72 17.02 

1 3 d, 266.2 1666.15 

d 2 55.4 346.75 

d 3 13.67 85.56 


0 8.14 

25 27.19 

100 100.5 

0 195.28 

25 107.62 

100 117.02 

0 1666.15 

25 371.75 

100 185.56 


The present values of the loss cost and the total cost may 
then be recalculated using Equations 5.4.2 and 5.4.3. The 
results are shown in Section F of Table 5.4. The analysis 
is also illustrated in the decision tree diagram shown in 
Figure 5.2. 

The expected cost of the decision is then given by the 
relationship: 

FT = [5.4.7] 

where E* is the loss cost (with survey) (US$k). The value of 
BT is US$38.76. This contrasts with the earlier value of 
US$65.7k. The difference of US$26.94k is a measure of the 
value of the survey. 


particular level of protection for all states of nature (US$k/ 
year). 

The annual loss cost is converted to a capital sum, the 
present value, in order to put it on the same basis as the 
prevention cost. Assuming a 20-year project life and 15% 
cost of capital the conversion is 

D* = 6.2590 [5.4.2] 

where D* is the present value of the loss cost (US$k). The 
total cost is then 

T* = M* + D* [5.4.3] 

where M* is the prevention cost (US$k) and 7* is the total 
cost (US$k). 

It is possible to make a decision on the basis of the infor¬ 
mation in Section C. The minimum value in the total cost, or 
expected cost of the decision, is that which corresponds to 
decision d 2 and is US$65.7k. 

Alternatively, the decision may be deferred until more 
information has been obtained by conducting the hazard 
survey. In this case it is necessary to estimate also the 
probability that the survey will correspond with reality 
Section D of Table 5.4 gives the estimates made for the 
conditional probabilities P(4/S ; ) of the survey recommen¬ 
dations given the states of nature. The probabilities P{ 4) of 
the survey recommendations and the conditional prob¬ 
abilities P\ 5,|4) of the states of nature given the survey 
recommendations must also be calculated as shown in 
Section E. The relationships used are: 

P(4)=£P(4|Sy)P($) [5A4] 


P(mi = ^2Pm)P(Sj)/P(Ik) [5.4.5] 

Equation 5.5 3 is a form of Bayes’ theorem, which is descri¬ 
bed in Chapter 7. 

Then, using the probabilities given in Section E of 
Table 5.4, the loss cost may be recalculated using the 
relationship: 


[5.4.6] 


5.4.3 Major hazards 

While it is generally true in the process industries that 
good practice costs no more than bad, in the case of major 
hazards it is often necessary to incur expenditure on safety 
which is not self-financing. This is illustrated by the fol¬ 
lowing simple calculation given by Lowe (1980). Consider 
an installation on which an incident causing US$10 million 
damage is estimated to occur once in Hr years so that 
the average annual loss is US$1000. Expenditure to 
reduce the frequency of the event to once in 10 5 years would 
yield a saving of US$900/year. This would justify only 
about US$2000 capital plus US$200/year operating costs. 
It is highly unlikely that a 10-fold reduction in incident 
frequency could be obtained for this expenditure. For 
major hazards, therefore, some decisions on the level of 
expenditure are influenced rather by risk criteria for such 
hazards. 

5.5 Insurance of Process Plant 

Insurance has always been based on the principle of soli¬ 
darity, and the more balanced, or homogeneous, the risk 
structure is within a community of insureds, the better this 
principle works. When the insurer wants to fit a risk into his 
portfolio, he checks it against ‘his’ other risks with regard 
to quality and homogeneity. An on-site inspection often 
provides important information for this purpose. Claims 
analyses and research into the cause of losses show quite 
clearly that with today’s complex production and monitor¬ 
ing processes, risk and safety depend less on technology 
than on management systems and the risk and safety 
awareness of the individual employees. In other words, 
they depend on the way a company deals with risks: on its 
safety culture. 

The insurer cannot be expected to pass judgement on 
the safety culture of individual companies as such. His 
only responsibility is to set up communities of insureds. 
However, this involves evening out recognizable inhomo¬ 
geneity either through selection, or the pricing and design 
of cover, or by supporting the insureds’ risk management 
efforts. 

Assessing individual industrial risks requires more than 
experience and technical know-how; it also requires special 
tools for the systematic appraisal of the factors relevant to 
safety and risk. 

There are a number of ways in which questions of insur¬ 
ance impinge on safety and loss prevention. It is the busi¬ 
ness of the insurer to carry out assessments of risk in order 
to set premium rates. The insurer is also increasingly 


D(I k , di) = C{di, Sj)P{Sj 14 ) 
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Indicator node Decision nodes State-of-nature nodes 



Figure 5.2 Decision tree for level of fire prevention 
expenditure (after R.C. Hanna, 1979) (Courtesy of 
Hydrocarbon Processing) 


concerned with the management of risk and with the 
effectiveness of loss prevention measures. The economics 
and the design of the process operated by the insured are 
affected by insurance factors. 

The company operating a hazardous plant must either 
itself bear the whole financial risk or seek outside insur¬ 
ance for this risk. The decision is an important but difficult 
one and it needs to be related to the overall approach 
taken by the company to loss prevention. Insurance prac¬ 
tices vary, of course, from country to country and it is 


essentially the practice in the United Kingdom which is 
described here. 

The insurance scene is constantly changing. There may 
be some restriction on insurance capabilities where there 
are novel risks or bad loss experience, but the market is 
usually able to adapt. The insurance which is of principal 
interest here is essentially fire insurance, which effectively 
covers fire and explosion risks. 

5.5.1 The insurance process 

The basic principle of insurance is to spread the risk so 
that losses incurred by the few are borne by the many. 
For industrial fire insurance this is done by a combination 
of risk sharing called ‘quota share’ co-insurance and 
re-insurance. In a quota-share arrangement, co-insurance, 
the insurers take direct responsibility for providing a speci¬ 
fied proportion of the cover. The prime responsibility 
for assessing the risk is taken by a leading company. In 
re-insurance the primary insurers and co-insurers lay 
off their risk with other insurers. For a large risk the 
re-insurers may themselves re-insure further. The 
re-insurance business is an international one. 

The extent of an individual insurer’s participation is 
usually determined not by the full sum insured but by a loss 
measure such as the probable maximum loss (PML) or 
estimated maximum loss (EML), as described below. The 
underwriter determines his share of the insurance as a 
proportion of the PML; he usually does this using his 
company’s table of PML limits. He may exercise his dis¬ 
cretion to reduce this share, if he has doubts about either 
the magnitude or the probability of the PML. On this basis 
the underwriter writes his ‘net line.’ This net line may then 
be augmented if re-insurance facilities are brought into 
play, so that the gross acceptance notified to the buyer may 
be several times the net line. 

The procedure adopted by the insurer in response to an 
insurance inquiry is to do a breakdown of insurance values 
by site and by installation, and to obtain a report from the 
insurance surveyor. Inspection is a normal preliminary to 
insurance. In general, the industry operates on the princi¬ 
ple of ‘no insurance without inspection.’ Frequently, how¬ 
ever, insurers will accept reports or an inspection or survey 
conducted by an insurance broker or an engineering con¬ 
sultant retained by the insurer or the broker. 

5.5.2 Insurance policies 

In the past an insurance policy covered a named peril for a 
specified period. The perils may be standard or special 
perils. Some of the types of insurance available in a multi- 
line policy in the United States are given by Spiegelman 
(1987): (1) public liability, (2) product liability, (3) workers’ 
compensation, (4) motor vehicle, (5) business interruption, 
(6) professional liability, (7) boiler and machinery and 
(8) property damage. 

More recently, insurers have provided policies covering 
‘all risks of direct physical loss’ except for perils or events 
specifically excluded by the policy language. 

The principal peril relevant here is fire. Industrial fire 
insurance almost invariably includes fire, explosion and 
lightning, and may include, depending on the geographical 
location, windstorm, flood and earthquake. The effects of 
fire include both property damage and business inter¬ 
ruption. Insurance may be limited to the first or may 
cover both. 
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For property insurance, the sum assured may cover 
either the current value or the replacement cost. 

5.5.3 Loss measures 

The insurance policy may provide cover for the full sum at 
risk, hut, as just described, insurers generally find it con¬ 
venient to work in terms of a more limited sum. There are 
various measures which are used, notably normal maxi¬ 
mum loss (NML), PML and EML, but the definitions of the 
terms tend to vary. These terms are discussed further 
below. 

5.5.4 Insurance surveyors 

It is the function of the insurance surveyor to provide the 
insurer with a report on the risk to be insured. Insurance 
surveyors are employees of the insurance companies or 
insurance brokers, and, in the United Kingdom, are typi¬ 
cally experienced people, but are not necessarily qualified 
engineers. Insurance surveyors have wide experience 
in risk assessment and there is considerable consensus on 
the critical features and on good and bad practice in loss 
prevention. 

5.5.5 Insurance surveyor's report 

The insurance surveyor’s report includes an assessment of 
the loss measure used such as the PML and serves as a 
guide to the underwriter in setting the premium. The report 
involves assessing the fire load and fire risk on a plant and 
then making allowance for protective features. 

5.5.6 Tariff and non-tariff systems 

The traditional approach to setting premium rates for 
industrial fire damage risks has been classification by 
trade or occupation. Classifications run to as many as 
300 trades. For many trades there is a detailed tariff 
which consists of a basic rate together with increments 
or decrements for factors which increase or decrease the 
risk, respectively. However, for some trades there is no 
tariff. 

Investment income potential is a major driver of insur¬ 
ance capacity and pricing. The business of insurance 
entails a significant time delay between premium collec¬ 
tion and payment of losses. Insurance companies invest 
these funds, which they hold in a fiduciary capacity. 
When certain economic conditions such as high interest 
rates or a steadily rising stock market increase investment 
income, insurers attempt to obtain more money to invest by 
increasing their business by means of rate reductions or 
more liberal policy terms. Trade professionals refer to 
this condition as a ‘soft market’ for insurance. 

The opposite happens when investment-market condi¬ 
tions provide less income on fiduciary funds. The result is a 
‘hard market’ as underwriters raise premiums to offset 
falling investment income. 

In the United States, strict regulation of insurance by 
individual states prevailed from 1945 through the early 
1960s as a consequence of a decision by the US Supreme 
Court. During the regulated era, insurance associations 
developed various rating schedules. Among these sched¬ 
ules were the ‘Schedule for Petroleum Properties’ and the 
‘Schedule for Rating Petrochemical Plants,’ which applied 
to the process industries. These two schedules were last 
revised in the early 1960s and gradually fell out of use over 
the following 10—20 years. 


Inherent deficiencies in these schedules lead to 
their demise. First and most important, the schedules 
took no account of the potential for investment income. 
Second, adjustment of rates to reflect recent loss experi¬ 
ence was cumbersome and not done often enough to 
keep schedule-derived rates commensurate with loss pay¬ 
ments. Third, as technology changed much about the way 
process plants were designed, built, operated and pro¬ 
tected, many rating criteria used in the schedules no longer 
reflected the degree of risk. In particular, there has never 
been a tariff for the chemical industry. Instead, in 
this industry the premium rates are set according to a scale 
of relative risk as assessed by the insurance surveyor’s 
report. 

5.5.7 Fire insurance in the United Kingdom 

Throughout the 1960s there was a history of growing fire 
loss in many trades in the United Kingdom. Many of these 
fires were in industries where fire losses have always been 
high. Insurers dealt with this by applying to each trade 
appropriate premium weighting factors. This approach was 
presumably adopted in the belief that the problem was a 
temporary one. In the event this proved not to be the case so 
that by the end of the decade the weighing factors in use 
ranged as high as 7.5. This suggested that the rating struc¬ 
ture was no longer an appropriate one. 

5.5.8 Business interruption insurance 

Business interruption (BI) insurance covers the con¬ 
sequential loss from an insured peril that interrupts or 
diminishes production. Following a waiting period stated 
in the policy, BI insurance covers lost profit and continuing 
or non-avoidable expenses during the time required to 
restore production. The BI insurance policy may provide 
for a monetary deductible in lieu of or in addition to the 
waiting period. Because the coverage related to the time 
production is impaired, BI insurance is sometimes referred 
to as ‘time-element’ insurance. 

The advent of large, single-train process plants increased 
exposure to BI loss and demand for BI insurance. For 
example, if production depends on the availability of one 
very large gas compressor that requires an 18-month lead 
time to replace, a relatively moderate property loss can 
result in a large BI loss. Today, BI losses frequently exceed 
the associated property damage (PD) loss. Until about the 
1960s much fire insurance was virtually synonymous with 
PD insurance. There then came into prominence another 
type of insurance - consequential loss or BI insurance. The 
need for this is due mainly to the very heavy losses which 
can occur if a large, single-stream plant is out of action for 
more than a short period. The costs of losses due to, and of 
insurance for, BI now tend to exceed several times those of 
damage. 

5.5.9 Large, single-train plants 

As described in Chapter 1, the 1960s saw the growth of the 
large, single-train plant. This has presented many prob¬ 
lems to insurers. In considering the problems posed by 
such plants, it is necessary to distinguish between average 
and maximum losses and between property and business 
interruption losses. There does not appear to be much evi¬ 
dence that for property the average losses are any worse 
than for other plants, but for BI the situation is probably 
different, although it is difficult to assess, because BI 
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insurance is largely limited to such plants. The PML is 
much greater, of course, on such plants for both property 
and BI insurance. 

Large plants pose several problems to insurers. One is 
the magnitude of the PML for both property and BI. 
Another is the high premium rates required to provide 
cover for BI. Another is the difficulty of assessing the ade¬ 
quacy of the management and of the technology. 

Insurers have been virtually unanimous in expressing 
their dislike of large plant risks and in suggesting to the 
industry that it may have gone too far in putting its eggs in 
one basket. On the other hand, whilst the early generations 
of large plants gave rise to many problems, it is arguable 
that the management and technology of such plants are 
now better understood, not least due to the development of 
loss prevention. 

Some perspective on this is also provided by the fact that 
many of the worst losses in the 1960s were on medium¬ 
sized, medium-technology plants. Neil (1971) suggests that 
this may have been due partly to the diversion of manage¬ 
ment resources to the large plants. 

5.5.10 Insurance market 

The insurance market is an international one and the 
insurance of a large plant will normally be spread with 
insurance companies around the world. Just as business is 
subject to the business cycle, so the insurance industry is 
subject to the insurance cycle. This is described by 
Norstrom (1982b). Expansion of capacity in the insurance 
industry creates competitive forces which drive premium 
rates down and reduce profitability, thus causing a con¬ 
traction of capacity. At some times the business and insur¬ 
ance cycles come together. This was the case, for example, 
during the period 1977-81 in the United States. 

When investment income is high, rates are high and loss 
experience is good, the insurance industry is more profit¬ 
able and capacity expands, whilst when investment income 
falls, rates fall and losses are heavy, profitability and 
capacity fall. The insurance market is in a continuous state 
of change and adaptation to new risks. The development of 
seepage and pollution insurance is an example of the 
growth of insurance capacity in a new area. The industry 
has also been able to create capacity to cover very large loss 
potentials, as described below. 

5.5.11 Loss experience 

As just indicated, the loss experience of the insurance 
industry is variable and this has an impact both on capacity 
and on premium rates. 

In the United Kingdom, the late 1960s and the 1970s saw 
loss on an increasingly serious scale in the chemical 
industry, which up to this time had had a good record. The 
experience of the insurance companies was therefore not a 
happy one. In general, in fire insurance, premium income 
did not cover losses sustained and administrative costs, so 
that underwriting was in deficit, although insurance com¬ 
panies benefited from investment income. The insurance 
market is very competitive and in too many cases business 
was taken at rates which later experience showed to have 
been unrealistic. 

Likewise in the United States the insurance industry 
experienced large losses around 1967 with the vapour 
cloud explosion at Lake Charles in 1967 and other major 
incidents. The period 1974-76 also saw heavy losses. This 


trend culminated in the late 1980s with vapour cloud 
explosion losses at Pampa, Texas (1987), Norco, Louisiana 
(1988) and Pasadena,Texas (1989). 

5.5.12 Insurance capacity 

The capacity of the insurance market is usually given in 
terms of the extent of cover which can be obtained for a 
single potential loss. As just described, this capacity fluc¬ 
tuates. Although generally the market is able to provide 
insurance even for very large loss potentials, there is some 
degree of restriction. 

In 1971, the capacity of the worldwide insurance market 
was described by Neil (1971) as quite limited. He estimated 
that the theoretical capacity was about £30 million per 
loss, but also stated that it was difficult to obtain insurance 
for a PML exceeding £6 million for property damage or 
£10 million for PD and BI combined. This was certainly not 
sufficient for complete insurance cover on a large ethylene 
plant. This limitation of the market was evidently a con¬ 
sequence of the adverse experience in industrial fire 
insurance in the 1960s and the 1970s. 

The vapour cloud explosion at Flixborough had an 
influence on the insurance market. Some insurers recog¬ 
nized the possibility of such an explosion, either by allow¬ 
ing for it in their assessment of PML or by buying specific 
re-insurance. A loss of US$100 million from damage and BI 
due to a major vapour cloud explosion was considered 
within the realm of possibility. 

A later estimate of insurance market capacity by Neil 
(1978) put the capacity for PML at about £40 million for 
companies with a good loss record and good reputation for 
management and design. After 1975 the bulk of oil and 
petrochemical risks owned by oil companies and to be 
insured on the London market was directed to Interna¬ 
tional Oil Insurers (IOI), a body set up by the leading Brit¬ 
ish insurers, including Lloyds, to underwrite such 
business. The capacity of IOI was estimated by Neil (1978) 
as about US$15 million on a PML basis. 

Redmond (1990) describes the capacity available 
through the Oil Insurance Limited (OIL) mutual together 
with the London Master Energy Line Slip, which is a facil¬ 
ity whereby many insurers commit their capacity auto¬ 
matically. However, disasters such as Piper Alpha, 
Pasadena and the Exxon Valdez have caused reduction of 
capacity for periods of time called ‘hard markets.’A similar 
hard market condition developed after the terrorist attacks 
of 11 September 2001. Market capacity decreased dramati¬ 
cally and has only recently started to improve. Worldwide 
capacity is now in excess of one billion US dollars for 
certain risks. 


5.5.13 Insurance restrictions 

In periods when the capacity of the insurance market is 
restricted, there may be pressure on the insured to bear 
part of the risk. There are various ways in which this may be 
effected. The restrictions may take the form of exclusions, 
limited coverage for particular activities, or the application 
of deductibles. If deductibles, or excesses, are applied, the 
insured company itself is required to meet a fixed degree 
of loss. Typically, for property damage this is a cash 
sum, whilst for BI it is typically a waiting period stated in 
hours or days before insurance coverage applies a number 
of days of downtime. Alternatively, the operating company 
may insure itself. Either the company with the risk carries 
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that risk itself, or it is insured by a subsidiary insurance 
company. 

5.5.14 Self-insurance 

A company may often choose not to seek full insurance 
cover but to bear some or all of the losses itself. Indeed, the 
demands placed on the world insurance market by the 
chemical industry have tended to leave companies with lit¬ 
tle choice but to carry some of the risk themselves. Policy on 
the purchase of insurance is a complex matter and depends 
very much on the circumstances of the individual firm, so 
that only a few general points are made here. Perhaps the 
most obvious and important is that the scale of potential 
loss is such that it would be severely damaging to even the 
largest firm, so that some degree of outside insurance is 
advisable. 

Insurers usually emphasize that it is not reasonable that 
industry should seek to place only selected risks while 
withholding from the insurers the ‘bread-and-butter’ busi¬ 
ness. A healthy insurance industry cannot tolerate such 
adverse selection; the former alone cannot sustain a healthy 
insurance industry. On the other hand, the industry does 
expect to receive credit for high standards of management 
and technology and for loss prevention measures, and its 
decision to purchase insurance may be influenced by its 
confidence in the assessment made of these by the insurers. 


5.5.15 Vapour cloud explosions 

A significant proportion of the loss potential on process 
plants is attributable to vapour cloud explosions. 
Alexander (1990a) quotes his own estimate made in about 
1980 that this proportion was in the range 5-10%. A 
method for the assessment of the EML due to a vapour 
cloud explosion has been developed by the IOI (1985 based 
upon a TNT equivalency calculation). A discussion of 
insurance with special reference to vapour cloud explo¬ 
sions is given by Davenport (1987). These original vapour 
cloud loss estimate methodologies have been modified over 
the years to allow the calculated overpressure diameters to 
encompass sufficient plant value to match historical loss 
events. The results have been less than desirable since a 
point source explosion overpredicts blast loads close to the 
epicentre and underpredicts blast loads in the far field. 
Extensive research has been conducted during the past 15 
years to analyse vapour cloud explosions of various purity 
and mixture materials to determine what factors influence 
the energy released in an explosion. Congestion and con¬ 
finement and ignition energy and location, are among the 
more critical variables. The impulse or time element factor 
of the produced pressure wave is also a critical element that 
influences damage levels. Insurers are just beginning to 
incorporate this science into their loss estimating models. 

The Marsh study (February, 2003) showed that of the 10 
largest on-shore losses in the hydrocarbon-chemical pro¬ 
cess industries from 1972 to 2001, vapour cloud explosions 
were the primary damage-causing mechanism in five of 
the incidents. Each of these losses exceeded $262 million 
in property damage alone, measured in constant 2002 
US dollars. 


5.5.16 Major disasters 

Disasters such as Piper Alpha in 1988 and Pasadena in 1989 
have a significant impact on the insurance world. 


The losses incurred in these two accidents have been 
discussed by Redmond (1990). Piper Alpha was not simply 
a single oil platform, but the centre of an oilfield, with 
pipelines coming onto it from other platforms and from 
satellite fields. The interim estimates of loss given are: for 
physical damage, US$680 million; BI, US$275 million; 
fatalities and injuries, US$160 million; removal of wreck¬ 
age, US$100 million and other items, US$155 million. 
These items total US$1370 million. The interim estimates 
for the loss at Pasadena quoted by Redmond are very simi¬ 
lar, about US$1400 million, divided almost equally 
between property damage and BI. The HSE (1993a) has 
estimated the loss due to Piper Alpha as amounting to 
some £2 billion, including about £750 million in direct 
insured losses. 


5.6 Property Insurance 

There are a variety of factors which are taken into account 
by insurance surveyors to assess property damage risk for 
the purpose of premium rating. Some of the features which 
are frequently mentioned by insurers are: (1) size of plant, 
(2) novelty of technology, (3) process materials (flammable 
liquids at high pressures and temperatures), (4) process 
features and controls, (5) plant layout, (6) building design, 
(7) fire protection of structures, (8) fire fighting arrange¬ 
ments, (9) management of hazards and (10) natural perils 
such as earthquakes, floods and hurricanes. 


5.6.1 Loss measures 

As already mentioned, a number of measures of loss are 
utilized, but different meanings are attached to the terms 
used. Alexander (1990a) utilizes the following terms: aver¬ 
age loss; NML, or PML; EML, or possible maximum loss 
and maximum credible loss (MCL), or maximum foresee¬ 
able loss. The average loss is self-explanatory. NML is the 
maximum loss which would be expected if all protective 
functions work, EML is the maximum loss if one critical 
item of protection does not work, and MCL is the maximum 
loss in circumstances where a number of critical items of 
protection do not work or where a catastrophic event occurs 
which is just credible. He gives the following approximate 
frequencies: 

NML > 10 _3 /year 

EML 10 -4 - 10 _3 /year 

MCL 10 _s - 10 _4 /year 

5.6.2 Risk profiles 

The estimates just given for the frequency of the various 
levels of loss are general ones. It is also possible, and 
instructive, to construct the loss profile for a particular 
plant. The construction and use of such profiles is dis¬ 
cussed by Alexander (1990a). The method which he 
describes is the use of what may be termed a fre¬ 
quency-loss (FL) plot. This plot has similarities with the 
frequency-number (FN) plot for major accidents descri¬ 
bed in Chapter 9 but, since the loss levels plotted on it 
are simply the single values of NML, EML and MCL, the 
frequency is an absolute rather than a cumulative one. 

Figure 5.3 illustrates profiles for two hypothetical 
plants. For plant (A), a well-protected plant, the frequency 
of the EML is much less than that of the NML and the 
frequency for the MCL much less again, but for plant (B), 
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Loss as fraction of value in bands 


Figure 5.3 Frequency - loss profiles of two hypothetical 
process plants (Alexander, 1990a) (Courtesy of the 
Institution of Chemical Engineers) 


an unprotected plant, the EML has the same frequency as 
the NML. 

It is also possible to construct FL curves for the industry 
as a whole. In this case the use of a cumulative frequency is 
more appropriate. Such curves might be constructed from 
the data published periodically by insurers (e.g. Norstrom, 
1982b; Munich Re, 1991; Marsh and McLennan, 1992). 


5.6.3 Risk assessment methods 

Insurance assessors use a variety of methods to assess the 
risk and to arrive at a premium rating. These methods 
include the use of checklists, of various types of hazard 
index, and of formal premium rating plans. The last two 
are closely related. Increasingly, such hazard indices and 
premium rating plans emphasize management aspects. 
A number of specific management audit methods have 
been developed. 


5.6.4 Checklists 

The insurance surveyor tends particularly to use check¬ 
lists of features to be assessed. A series of such checklists is 
given by Spiegelman (1969). Later versions of such check¬ 
lists are given by Norstrom (1982b) and Spiegelman (1987), 
the latter in the context of gas plants; the two checklists are 
similar and may be summarized as shown in Table 5.5. 
The original checklists are much more detailed. Further 
checklists are given by Ashe (1971) and Ackroyd (1974). 


5.6.5 Hazard indices 

From such checklists there have evolved a number of hazard 
indices and premium rating plans. The best known hazard 
index is probably the Dow Index, given in the so-called 
Dow Guide, which has gone through a number of versions. 
The most recent is the Dow Fire and Explosion Index Hazard 
Classification Guide (AIChE, 1994). Another hazard index is 
the Mond Index, which is an adaptation of the Dow Index 
(D.J. Lewis, 1979). A third index is the instantaneous frac¬ 
tional annual loss (IFAL). This index was specifically 
developed for the insurance industry at the Insurance 
Technical Bureau (Munday et al., 1980). These three indices 
are described further in Chapter 8. 


Table 5.5 Headings of a checklist for insurance 
assessment of a chemical plant (after Norstrom, 1982b; 
Spiegelman, 1987) 

Plant siting 
Plant layout 

Buildings and structures 

Process materials 

Chemical process 

Materials movement and storage 

Operations 

Equipment (design, testing and maintenance) 

Loss prevention programme 


5.6.6 Premium rating plans 

Premium rating plans have evolved over the years to 
incorporate many other risk management factors than 
previously considered (Tables 5.6 and 5.7). The plans are no 
longer used to develop a premium rate for insurance, but 
rather are used to judge the quality of a risk. With this 
information, the underwriter can determine if he wishes to 
participate in an insurance programme, at what level he will 
participate and how much of the risk he is willing to take. 

An example of a current risk assessment scheme is pro¬ 
vided in Table 5.6. 

Another scheme which is relevant to premium rating for 
damage insurance is the Dow Index (AIChE, 1994). The 
scheme involves the determination of the Fire and Explo¬ 
sion Index (F&EI) and then of the Maximum Probable 
Property Damage (MPPD).The Dow F&EI, including deter¬ 
mination of the MPPD, is considered in detail in Chapter 8. 

5.6.7 Technical services 

In the early 1970s, the British insurance industry recog¬ 
nized the need for technological back-up and supported 
the formation of the Insurance Technical Bureau (ITB) 
(Chilver, 1973). The IFAL method, mentioned above and 
described in Chapter 8, was developed by the ITB. The ITB 
was subsequently dissolved and technical support is now 
provided by in-house engineers or outside consultancies. 

5.6.8 Management audits 

The increasing emphasis on management is reflected in the 
use of audit methods which concentrate particularly on 
management. Redmond (1984) gives a checklist by which 
the management may be assessed. A more detailed dis¬ 
cussion of the assessment of management for insurance 
purposes is given by Instone (1990) and in the Swiss Re 
publication entitled ‘Safety Culture - a reflection of risk 
awareness’ (2003). In this publication, Swiss Re describes 
additional tools they have developed for assessing man¬ 
agement systems as they relate to loss prevention. Their 
initial effort was a development of an assessment process 
called Safety Management Audit in the Process Industries 
(SM API). This has since been supplemented by their Safety 
Awareness Program (SAP) and Change Management Audit 
Program (ChangeMAP) which are aimed at assessing 
‘Liveware’ systems. 

5.6.9 Estimation of EML 

Some of the problems of assessing the EML are discussed 
by Redmond (1984). In general, this assessment is 
relatively easy for indoor plant with subdivisions each of 
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Table 5.6 Outline of a risk assessment scheme for property damage insurance on large capital value plants 
(Drewitt, 1975) 


Rating factor 

L factor Normal maximum loss 

C factor Inherent hazard classification 

HSF factor Hardware (H), software (S), Fire fighting facilities (F) 


L factor 

Normal 

(%) 

^20 

33i 

50 

66 § 

> 66 | 

If the % a 


(£m.) 


d final NMLs give different L values an average may be taken, m. denotes million. 


C factor 

Low risk plants 
Medium risk plants 
Relatively high risk plants 
High risk plants 


C factor 
1-3 
4-6 
7-9 
10-12 


C factor parameters: 

1. Nature of raw materials 


2. Nature of products 

3. Process type 


4. Heat content 


5. Reaction temperature 


6. Reaction pressure 


7. Corrosion and erosion hazards 


0 Non-flammables 

1 Flammable solids, heavy flammable liquids or vapours, dusts at ambient 
conditions 

2 Light flammable liquids, hydrogen, combustible gases, naphtha, petrol 

3 LPG-type materials or other flashing liquids (any substance which is 
flashing above 5%) materials in use above their ignition point 

As (1) above 

Rather difficult to define but must range from the innocuous mixing of solids 
and liquids under ambient conditions to oxidation reactions, reactions carried 
out at high temperatures and pressures, reactions involving the use of acetylene 
above 20 psi, reactions involving the use of explosive materials, special hazards 
ancillary to the main process, for example, catalyst preparation, catalyst 
changing or equipment cleaning 

In considering any plant, cognizance must be taken of the inherent heat content. 
This involves consideration of heats of combustion of the raw materials and 
products (hydrocarbons have heats of combustion about 10,000 tcal/t, while 
most other organic materials are below this value), heat of reaction or heat of 
polymerization. Associated with these considerations should also be the 
quantity effect. If we are dealing with large stocks and inventories, then the 
total heat content potential in the event of an incident must affect the plant 
hazard rating. The highest of these should be used as the assessment factor. The 
extent to which inventories of flammable materials within process areas are 
in excess of actual practical requirements must be taken into account in 
assessing the hazard in relationship to the minimum unavoidable risk 
0 Atmospheric temperature 

1 Up to 100°C or above flash point of materials involved 

2 In range 100-250°C or above boiling point of materials involved 

3 Above 250°C or above autoignition point of materials involved 
0 Atmospheric pressure 

1 Vacuum or up to 5 at pressure 

2 Up to 100 at pressure 

3 Above 100 at pressure 

On a well-designed plant due consideration will have been given to the corrosive 
and erosive nature of the materials being handled. However, it is accepted that 
corrosive fluids are difficult to contain and that leakages due to corrosion, 
particularly at moving parts, do occur. Similarly, the erosive nature of moving 
fluids and particles is well known 
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Table 5.6 (continued) 
8. Domino effect 


HSF factor 

H factor parameters: 
1. Location 


2. Construction 


3. Separation 


4. Ventilation 


5. Instrumentation 

6. Process valves and lines 


7. Cooling 

8. Electrics 

9. Emergency supplies 

10. Flammable waste disposal 

S factor parameters: 

1. Management attitude 

2. Housekeeping 

3. Maintenance 

4. Plant operating instructions 


This factor is included to take account of the hazard that can occur if leakage of a 
hazardous material can lead to the escalation of the incident, for example, a small 
leak which fires and damages by flame impingement at larger pipe or vessel with 
subsequent spillage of a large inventory or hazardous material 


Is the plant well sited in relation to dwelling houses, other industries, office 
blocks, warehouses, other plants, etc.? Is the site well drained? Are soil 
characteristics suitable for plant requirements? 

Is the plant well designed and constructed with adequate safety and contingency 
factors? Are the materials of construction suitable for the duties involved? Are 
girders protected with fire resisting cement? Are vessels, particularly up to 20 ft 
from ground level, protected with fire resisting cement? 

Is adequate spacing available between sections of the plant (minimum 20 m) and 
between items of equipment within the sections of the plant? Are control rooms 
well sited so that adequate protection is afforded in the event of an incident? Are 
storage tanks sited away from operating plant? Are storage tanks adequately 
bunded? Are plants suitably provided with dykes to retain any inadvertent 
spillage of hazardous material? 

Is the plant well ventilated? Are machines operating inside buildings or out in the 
open? Are compressors housed in ‘Dutch barn’ type structures? Can an 
inadvertent leak of gas or liquid disperse easily? Are buildings equipped with 
adequate fire break walls and these fitted with adequate fire doors? Are buildings 
fitted, where necessary, with explosion relief panels to deal with explosions that 
may arise from leakage of combustible gases, liquids or dusts? 

Is the plant adequately instrumented? Are the instruments kept in A1 condition? 
Are there sufficient trips and alarms to deal with all the eventualities on the plant 
(see also S factor parameters, item (4), and F factor parameters, item (10)) 

Are there sufficient valves and lines to eliminate the possibility of contamination 
through common-pipe usage? Are there adequate facilities for washing out pipes 
andvalves?Isitpossibletodivertinventoriesofhazardousmaterialstoothervessels 
or to portable containers in the event of an incident ? (see also F factor parameters, 
item (9).) Are there dumping and blowdown facilities available so that inventories of 
hazardous materials can be safely dispersed in the event of an incident? 

Is there sufficient reserve in the cooling system to deal with happenings outside 
the normal run of events? Are there adequate facilities to deal with a total cooling 
water failure? 

Are the electrics well designed and installed to conform with present-day 
thoughts of area classification? Are there adequate facilities to deal with a 
complete failure of electricity supply? Are the electric cables adequately protected 
against fire damage? Are alternative cable runs installed? 

Are there sufficient supplies of nitrogen and inert gases to deal with all blanketing 
and purging problems? Is there an adequate supply of compressed air and 
instrument air? Is there an emergency power supply? 

Are full facilities available for dealing with the safe disposal of all flammable 
wastes? 

What is the management attitude to safety? Are expenditure proposals 
sympathetically received and treated? Does management take an active interest in 
the organization and running of safety committees? Does management make a 
regular inspection of plants to ensure that safety standards are being maintained? 
Is the plant clean and truly free from debris, pieces of pipe, paper, plastic bags, 
wood, etc.? 

Is the plant well maintained? Is it free from leakage of steam, water and hazardous 
fluids? Is maintenance conducted in a clean and orderly manner? 

Are plant operating instructions written in a clear and concise manner? Are they 
available to all operators? Are they kept up to date and revised at regular 
intervals? Are they obeyed? Are automatic safety devices tested on a regular 
schedule and with programmed monitoring on display? Have emergency 
instructions been written to deal with plant abnormalities? 
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Table 5.6 (continued) 

5. Use of permit-to -work system 

6. Reporting of accidents 


7. Labour 

8. Personnel training in plant 
operation 

9. Personnel training in safety 

10. Frequency of technical 
audits 


Is the permit-to-work system clearly defined and rigidly followed? (Consider 
competence of issuing authority) 

Are all accidents (and near misses) reported accurately and in detail? Are these 
reports circulated to those in authority? Are they effective in reducing accidents in 
the future? Are the lessons learned from accidents brought to the attention of new 
starters on the plants? (Accidents should be considered as abnormal occurrences 
and it should not be assumed that injury always results) 

What is the quality of plant labour? What is the attitude of plant labour to work, 
discipline and safety? Is there a high turnover of labour? 

Are operators well trained in plant operation and tested before given a position of 
responsibility? Do they have frequent refresher courses? 

Is there adequate training in plant safety? Are regular Works Safety Meetings 
called? 

Are technical audits of plant safety conducted at frequent intervals by an outside 


F factor parameters: 

1. Works facilities 

2. Municipal fire brigade 

3. Water supplies 

4. First aid extinguishers 

5. Fixed protection 

6. Automatic fire alarms 

7. Communications 

8. Training of first aid fire 
fighters 

9. Remote isolation valves 

10. Testing of protective 
devices 


Is there a works fire brigade? Is there a full-time Chief Fire Officer? Are adequate 
fire fighting machines available on site? Are adequate stocks of foam-forming 
compounds retained on site? 

Is there good liaison with the local municipal fire brigade? How long does it take 
the municipal brigade to reach the site? Do the works and municipal brigades 
carry out combined exercises on site? 

Is there adequate water supply on site for fire fighting purposes? Is it a separate 
system or can supplies be tapped off for process use? 

Is the plant well provided with first aid extinguishers? Are plant personnel 
familiar with the use of the extinguishers? 

Is the plant provided with fixed fire protection equipment appropriate to the work, 
for example, a sprinkler system, a steam fire curtain, a water curtain, fixed 
monitors? 

Are adequate fire alarms installed throughout the plant? Are adequate gas leak 
detectors installed throughout the plant? 

Are communications good between the plant and the shift manager and between 
the plant and the fire services so that incidents can be reported with the minimum 
of delay? 

Are there adequate first aid fire fighters on site? Are they well trained in dealing 
with the type of incident that might be expected on their plant? Are they familiar 
with the protective devices installed? Do they have frequent refresher courses? 

Is the plant well provided with remote isolation valves so that large inventories of 
hazardous materials can be isolated in the event of inadvertent leakage, say due to 
a fractured pipe? 

Are the protective devices installed on the plant tested at regular intervals 
according to an agreed schedule? 


If the % and final NMLs give different L values, an average may be taken, m. denotes million. 


which is provided with fire protection. It is more difficult to 
determine for outdoor plant, where there are no such phy¬ 
sical barriers. Modes of escalation which must be taken into 
account include, in particular, running liquid fires and 
vapour cloud explosions. 

Improvements in vapour cloud explosion EML loss esti¬ 
mating techniques have been made during the 1990s, but 
these have not been adopted by all insurers. This has led to 
inconsistencies between the various insurers vapour cloud 
EML assessments for the same plant location. Work is 
ongoing to develop a consensus methodology which uti¬ 
lizes state of the art vapour cloud analysis techniques. 


5.6.10 Risk assessment approaches 

There are variations of practice in the methods used to 
determine the premium rating. As indicated, some insurers 
have developed formal quantitative methods. Others con¬ 
sider that such quantitative methods offer little advantage 
over qualitative approaches. This is the view argued by 
Hallam (1990). 

By the 1980s the setting of insurance premiums had 
become much more market-driven and rating-schedule or 
similar analytical approaches fell by the wayside. The 
potential for an insurer to earn investment income on 
fiduciary funds became the key factor in determining the 
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Table 5.7 Illustrative examples for premium rating 
plans for damage insurance for large capital value plants 
(Drewitt, 1975) 



Example 1 

Example 2 

Total insured value 

£15 m. 

£30 m. 

NML 

20% and £3 n 

l. 66.67% and £20 m. 

L factor 

1.5 

4.5 

C factor 

7 

8 

Basic premium rate R 

3.38%o a 

6.21%o 

HSF factor 

36 

27 

HSF discount 

18% 

-9% (loading) 

Discounted 

2.78%o 

6.77%o 

premium rate 
Discounted annual 

£41,700 p.a. 

£203,100 p.a. 

premium 




a %o = rate per £1000 insured. 


state of the insurance market. Brokers gradually gained 
control over large insurance placements, parcelling out 
small shares of the total sum insured to individual insurers. 
Insurers continued to consider a prospective insured’s loss 
record and the industry’s loss record over the previous 5 - or 
10-year period as well as the state of the prospective 
insured’s hazard-control efforts and results as documented 
in survey reports. However, supply and demand forces were 
paramount. By the mid-1990s no single insurer had so 
large a share of worldwide insurance capacity that it could 
enforce pricing by analytical means such as a rating 
schedule. 


5.7 Business Interruption Insurance 

The need for BI insurance did not really arise until the 
mid-1960s, when the first large, single-train plants began 
to make their appearance. At about the same time, large 
onshore and offshore oil and gas production fields (North 
Sea and Alaska North Slope) came on-stream and pre¬ 
sented very large cash flow loss potentials for the opera¬ 
tors. It then became apparent that consequential losses 
could be as costly as, or more costly than, property damage 
losses. The problem of BI insurance is a difficult one. The 
viability of such insurance depends on the charging of 
realistic premiums, on the evolution of effective assess¬ 
ment methods and on the progress made in the reduction of 
loss. Accounts of BI insurance are given by Neil (1971), 
Cloughton (1981) and di Gesso (1989). 

5.7.1 Large, single-train plants 

As just indicated, the advent of the large, single-train plant 
changed the relationship between property damage and BI 
insurance. The consequential losses which may occur with 
such plants apply not only to the plant itself, but also to the 
suppliers of the plant’s inputs and the customers for its 
outputs. The nature and vulnerabilities of such plants have 
been discussed in Chapter 1. 

5.7.2 Minor incidents 

Serious BI can be caused by incidents in which the property 
damage is relatively minor. Typical incidents which may 
involve only minor damage but which can cause BI for 
a number of weeks include damage to control rooms, 


instrument cables, or individual items of equipment, 
especially large compressors, reactors and fractionation 
towers. Examples cited are a flash fire resulting from an 
escape of flashing hydrocarbon liquid and causing damage 
to instrument cables, and damage to a large gas compressor 
causing a large section of plant to be shut-down. In oil and 
gas production operations, the temporary loss of critical 
pipeline transportation systems, as well as support utility 
systems, can have significant BI consequences. 

5.7.3 BI insurance 

The initial approach to BI loss was to assess it as a propor¬ 
tion of damage loss. There is in fact only a weak connection 
between the two, the BI loss depending rather on the extent 
to which the loss interrupts a complex business chain. 
Moreover, the relative magnitude of the two losses has 
changed dramatically. Whereas BI loss was at first eval¬ 
uated as a fraction of damage loss, it is now commonly 
estimated at several times damage loss. 

Thus BI insurance merits separate treatment. Basically, 
the insurance provides cover for a fixed period and against 
an insured peril, and relates to the margin between expected 
sales income and variable costs on loss of sales suffered due 
to the interruption at the insured’s plant and, if extended, 
interruption at suppliers’ and customers’ plants. It also 
covers increased working costs incurred in attempts to 
minimize loss of margin. 

BI insurance is for a specified maximum indemnity 
period. Typical periods are 12 or 18 months. There is a ten¬ 
dency for insurers to require the insured to bear, as an 
excess, the losses sustained over some initial period such as 
5,10 or 20 days. Insurance may be extended to cover also 
the contingent liability for losses due to incidents at sup¬ 
plier and customer plants. The cover generally applies 
provided the losses are due to damage from a peril for 
which the insured’s plant is covered. 

5.7.4 BI survey 

When BI insurance is to be underwritten, the nature and 
scope of the insurance survey or inspection is modified 
accordingly. It is normal to carry out a damage survey as a 
basis for damage insurance. It is appropriate to conduct an 
interruption survey for the purposes of BI insurance. This 
type of survey is, however, rather less well developed. 

An interruption survey may extend the assessment of a 
plant to include features additional to those covered in the 
damage survey. The factors listed by Neil (1971) are given in 
Table 5.8 The main object of the interruption survey is 
normally the assessment of EML/PML on the BI. Survey 
for BI should not be a one-time exercise, but should be repe¬ 
ated at intervals to ensure that the information is up to date. 

Further aspects of BI surveys have been described by 
Cloughton (1981). Essentially, the problem is that of recov¬ 
ery from the event causing the interruption. People are one 
of the most significant resources in enabling the recovery 
to take place. A resourceful purchasing manager is parti¬ 
cularly important. Another vital factor is preservation of 
information on all aspects of the business, from design 
drawings to customer lists. 

In assessing the vulnerability of a single-train operation, 
Cloughton somewhat discounts in the UK context problems 
of availability of services and of fuels, but emphasizes 
weak points in single-train operation. In particular, he 
highlights vulnerability to loss of particular pieces of 
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Table 5.8 Some aspects of an interruption survey 

(after Neil, 1971) (Courtesy of the Institution of Chemical 

Engineers) 

1. Whether the process is single- or multi-train, batch or 
continuous, innovatory or proven 

2. Process dependency on a major, unspared equipment 
item requiring a long lead time to replace 

3. Theprotectionofessentialservices,routingofcables,etc. 

4. Dependency on a key unit and the extent to which 
spares or standby facilities are available, and the time- 
scale involved in achieving replacement or repair 

5. The size of buffer stocks, over and above the minimum 
necessary to cover shut-down for planned 
maintenance, and the possibility of alternative sources 
of supply to keep downstream plants in operation 

6. If the plant is a replacement, whether existing plants 
and production will remain available as insurance 
against teething troubles and whether there will be an 
excess of capacity overdemand in the short and long term 

7. Whether the use of a computer is to control or maximize 
efficiency of the plant 


equipment. Here he draws a distinction between a sole 
supplier and a unique source. A company may choose to 
buy from a single supplier, hut there may nevertheless be 
other potential suppliers in the marketplace. In some cases, 
however, there is a unique source which for some reason 
may be unable to supply promptly. 

Vulnerability to interruption depends not only on fea¬ 
tures of the production process but also potential loss of 
stocks in the same incident. Another relevant aspect is the 
expected profile of the recovery over time. This may be a 
short total interruption followed by a gradual recovery. Or 
it may be a partial interruption with production and sales 
partially maintained but at increased cost. 

Generally speaking, the existence or lack of inventory of 
intermediate or finished products will not significantly 
affect BI analysis. Inventory costs money to finance and 
management is not likely to maintain more inventory than 
that which is necessary to sustain normal operations. If a 
particular weakness is revealed, such as high exposure to 
loss of a particular piece of equipment, the solution is not 
necessarily more insurance. It may make more sense to 
remedy the exposure. 

5.7.5 Estimation of EML 

It will be apparent that the assessment of the EML for BI is 
not straightforward. It involves first determining the 
downtime of the plant, or sections of it, and then converting 
this loss of production to loss of financial contribution to 
fixed costs and profit. This last step may be particularly 
problematic. The assessment of EML for BI is discussed by 
di Gesso (1989), who gives an illustrative example. 

5.7.6 Property damage and BI 

The worldwide data from Munich Re (1991) quoted above 
show that over the five-year period 1985-89 for property 
material damage the annual average number of incidents 
was 144 and the average annual loss US$754 million. The 
corresponding figures for BI are annual number of inci¬ 
dents 39 and annual loss US$572 million. 

At the level of the individual plant, some examples of 
claims for property damage and BI have been given by 


Table 5.9 Examples of claims for property damage 
and BI (after di Gesso, 1989) 


Case a Property 

damage 
(US$m.) 

Downtime 

(months) 

Business interruption 
(US$m.) 

1 

2 

22 

2 4 

- 

32 

3 9 

10 

200 


a See text. 


di Gesso (1989) (Table 5.9). He quotes the following three 
cases. Case 1, in 1981, involved a tower which failed during a 
hydrostatic test with water at a temperature of 10° C rather 
than at 20°C as recommended. In Case 2, also in 1981, a com¬ 
pressor trip led to a furnace tube burst and damage to a com¬ 
mon stack. In Case 3, in 1984, a fire in a cable trench damaged 
a control room. The losses sustained are given inTable 5.9. 

5.7.7 BI Insurance Capacity 

During the 1960s, it rapidly became apparent, however, 
that the premiums asked for this class of business had been 
set at an unrealistically low level. There were some very 
large claims and some insurers sustained heavy losses. The 
nature of the problem can be seen from the fact that Neil 
(1971) estimated the total BI insurance premium income at 
£35 million. Such a sum could easily he swallowed up by 
one or two disasters. And in fact, as already mentioned, his 
estimate of the combined damage and BI insurance 
obtainable in practice was £10 million per loss. 

As already described, since then the market has adapted 
and has been able, for example, to cover the large BI risks of 
offshore oil platforms. For Piper Alpha, one estimate of the 
BI loss, given above, is US$275 million. 

Because of the greater uncertainty in assessing BI loss 
exposure as opposed to PD loss exposure, many insurers 
will not underwrite BI unless the insured also purchases 
insurance for PD. Such insurers view an insured’s attempt 
to purchase insurance for BI along as a form of adverse 
selection. 

5.8 Other Insurance Aspects 

5.8.1 Insurance credit 

The extent to which insurers should encourage and give 
credit for good practice in general and for loss prevention 
measures is a long-standing question. Insurers have always 
been very much involved in measures against fire. The first 
organized fire brigades in the United Kingdom were run by 
the insurance companies. In the nineteenth century, the 
Fire Offices Committee was formed and set standards for 
fire construction, alarms, sprinklers, etc., which have been 
widely applied. In 1946, the Joint Fire Research Organiza¬ 
tion (JFRO) was set up jointly by the Fire Offices Commit¬ 
tee and the government and this was followed in 1947 by the 
formation of the FPA. 

Insurers usually emphasize that they prefer to keep both 
risks and premiums down. Buyers of insurance are equally 
keen to hold premiums down and seek credit for loss pre¬ 
vention measures. This is well illustrated by the growth of 
the Factory Mutual Insurance Corporation, which is one of 
the largest fire insurance groups in the United States and 
which originated from a group of manufacturers who were 
dissatisfied with the credit which existing insurers were 








5/18 ECONOMICS AND INSURANCE 


prepared to allow for such measures and who therefore 
formed their own insurance co-operative. The loss preven¬ 
tion measures which constitute the Factory Mutual System 
are described in the Handbook of Industrial Loss Prevention 
(Factory Mutual Engineering Corporation (FMEC), 1967). 
There is one particular protective measure on which 
insurers have placed considerable emphasis and for which 
they have given generous credit in premium ratings. This is 
the use of sprinklers. The effectiveness of sprinklers is well 
proven across a wide range of fire risks, including hotels, 
schools, offices, factories and warehouses. The premium 
recognition given to this particular protective measure 
appears, however, somewhat exaggerated relative to other 
measures as far as concerns the process industries. These 
industries have developed a whole range of loss prevention 
measures and an expectation that they should receive 
credit for them appears reasonable. 

Clearly a precondition for a system of premium rating 
which allows such credits is the possession by the insurer 
of a method of risk assessment which it is confident gives a 
reliable discrimination between risks. In fact, for a period 
in the 1970s, the trend was rather towards a reduction of 
differentials. The range of risks in chemical plants is wide. 
The insurance industry was reluctant, however, to reduce 
the minimum premium for low risk plants. In consequence, 
the chemical industry, whose loss experience up to the 
1960s had been relatively good, put pressure on insurers to 
reduce premium rates on the more hazardous plants. The 
result was an excessive narrowing of the rating scale 
between the lowest and highest risks. The extent to which 
the chemical industry does now receive credit for loss pre¬ 
vention measures in the form of reductions in premium 
rating appears variable. The success of ICI in obtaining 
reduced insurance premiums for damage cover is illustra¬ 
ted in Figure 5.4 (Hawksley, 1984). 

5.8.2 Insurance in design 

The degree to which reduction of insurance costs is a 
design objective is discussed by Alexander (1990a), who 
suggests that it is not a major aim. The factors governing 
the safety and loss prevention features of the design, he 
argues, are, in order: (1) the attitude of the planning and 
licensing authorities, (2) the policy of the company, (3) the 
BI assessment, (4) the acceptability as an insurance risk 
and (5) the cost of insurance. 



Figure 5.4 Relative insurance premium rate 
(1970= 100) for material damage cover for ICI United 
Kingdom (Hawksley, 1984) 


He considers the example of the layout of a large petro¬ 
chemical plant. One design option might be a more gener¬ 
ous layout. For this an increase in capital cost of 10% would 
be a reasonable estimate. Assuming the need for a real 
return of 15% on this additional capital, the annual cost 
would be 1.5% of the total replacement cost. Yet the pre¬ 
mium rate for the insurance might well he no more than 
0.5% of this latter cost. This example suggests that it is not 
economic to seek to reduce the insurance costs by addi¬ 
tional capital expenditure. 

5.8.3 Insurers’ advice 

The experience of the insurer is available to the operating 
company. There are several forms which advice from the 
insurer may take. Spiegelman (1987) emphasizes that the 
primary and only real function of the insurance surveyor is 
to make a report to the underwriter. Although it is often 
assumed that he is also there to offer a free consulting ser¬ 
vice, this is a misconception. However, as described by 
Redmond (1984), an insurance survey report generally 
contains recommendations for improvements. Hallam 
(1990) enumerates some of the recommendations typically 
made in such reports. In addition an insurer may also offer 
a separate consulting service. Thus, a large proportion of 
the major insurers offer inspections in respect of OSHA 
compliance. 

It is constantly emphasized by insurance surveyors that 
the surveyor should be called in at the design stage, when 
modifications can be done relatively easily. 

5.8.4 Loss adjusters 

When an incident involving loss has occurred, it is the job 
of the loss adjuster to assess the financial value of that loss. 
The loss adjuster is usually employed by a firm specializing 
in this business and is independent of the insurer and 
insured. The report of the loss adjuster is primarily a 
financial rather than a technical document. 

5.8.5 Loss data and analysis 

The insurance industry is uniquely placed to provide infor- 
mationon loss and is in fact aprime source of loss data .This is 
illustrated by the large proportion of the loss data given in 
Chapter 2 which derives from insurance sources. Data sour¬ 
ces include the annual report of bodies such as the Associa¬ 
tion of British Insurers and the Loss Prevention Council in 
the United Kingdom, the corresponding bodies in other 
countries, the periodic reports Large Property Damage Los¬ 
ses in the Hydrocarbon-Chemical Industries: A Thirty Year 
Review (Marsh and McClennan, 1992), earlier versions being 
those by Garrison (1988b) and Mahoney (1990), as well as 
occasional publications such as Losses in the Oil, Petrochem¬ 
ical and Chemical Industries (Munich Re, 1991). Insurers are 
also well placed to assess the significant sources of loss in the 
process industries. This has already been discussed in gen¬ 
eral terms in Chapter 2, but brief reference may be made here 
to the features particularly mentioned by insurers. Explo¬ 
sions are identified by WH. Doyle (1969) as the main type of 
loss in the chemical industry. Many of his data have already 
been given in Chapter 2. Weldon (1971) singles out as the pre¬ 
dominant initiating factors deviation from standard oper¬ 
ating procedures and failure to perform proper main¬ 
tenance. Almost invariably, insurers emphasize that most 
losses are caused by common hazards rather than by high 
technology. 
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5.9 Notation 

C loss cost for a particular state of nature and level of 

protection (US$k/year) 
d decision 

D loss cost for a particular level of production for all 

states of nature (US$k/year) 
loss cost (present value) (without survey) (US$k) 
loss cost (with survey) (US$k) 
counter for decisions 
/ outcome or indicator 


j counter for of states of nature 

k counter for outcomes 

M * prevention cost (US$k) 

P probability 

S state of nature 

7* total cost (US$k) 

Subscript 
min minimum 
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6/2 MANAGEMENT AND MANAGEMENT SYSTEMS 


The preceding chapters have indicated the nature of and the 
background to the problem of safety and loss prevention 
(SLP). The starting point for its solution is the management 
and the management system. 

The importance of effective management systems has 
been stressed in a number of reports on safety in the che¬ 
mical industry, including Safety and Management by the 
Association of British Chemical Manufacturers (ABCMs) 
(1964/3), in Safe and Sound and Safety Audits by the British 
Chemical Industry Safety Council (BCISC) (1969/9,1973/12). 
It was the main lesson drawn from the Flixborough dis¬ 
aster and is the principal theme of the three reports of the 
Advisory Committee on Major Hazards (ACMH) (Harvey, 
1976, 1976b, 1984). The Cullen Report on the Piper Alpha 
disaster (Cullen, 1990) has a similar emphasis. Accounts of 
process safety management (PSM) include Safety Manage¬ 
ment (D. Petersen, 1988b) and Techniques of Safety Manage¬ 
ment (D. Petersen, 1989). 

Management systems help ensure long-term sustain¬ 
ability of effective safety health and environmental perfor¬ 
mance. Competent people drive performance. And effective 
management systems drive sustainability. The importance 
of having both strong people and well- documented effective 
management systems cannot be overemphasized. 

The importance of management has long been recog¬ 
nized by the Health and Safety Executive (HSE), which has 
produced a series of publications on safety management 
and on its regulation, including Success and Failure in Acci¬ 
dent Prevention (HSE, 1976d), Managing Safety (HSE, 
1981d), Monitoring Safely (HSE, 1985c), Effective Policies for 
Health and Safety (HSE, 1986a), Successful Health and Safety 
Management (HSE, 1991b) and The Costs of Accidents at 
Work (HSE, 1993a). 

Other relevant publications include The Management of 
Health and Safely (Industrial Society, 1988), Developing a 
Safety Culture by the Confederation of British Industry 
(CBI, 1990), Guidelines for Implementing Process Safety 
Management Systems (Center for Chemical Process Safety 
(CCPS) 1994). 

Management is also well represented in the publications 
of the CCPS, which are described in Section 6.28 of this 
chapter and Responsible Care Program sponsored by the 
American Chemistry Council. 

The management system is in part specific to the par¬ 
ticular process and should be matched to it. This is a point 
emphasized in the Code of Practice for Particular Chemicals 
with Major Hazards: Chlorine issued by the BCISC (1975/1). 

Many treatments of safety and management touch on 
virtually the whole range of subjects dealt within this book. 
It is convenient here, however, to limit consideration of the 
management system to the specific management topics 
outlined below. The present chapter is structured in the fol¬ 
lowing way. Sections 6.1-6.3 start by laying emphasis on: 

(1) management attitude; 

(2) management leadership; 

(3) management organization. 

Sections 6.4-6.11 describe elements of the management 
system for major hazard installations and in large part 
reflect the work of the ACMH. These are: 

(4) competent people; 

(5) systems and procedures; 

(6) project safety reviews; 


(7) management of change; 

(8) standards and codes of practice; 

(9) pressure systems; 

(10) documentation; 

(11) audit systems; 

(12) independent checks; 

(13) major hazards. 

The next part of the chapter describes the management 
system in more detail and reflects the impact of develop¬ 
ments in management generally on the management of SLP. 
It is introduced by Sections 6.14 and 6.15 on: 

(14) quality management; 

(15) safety management. 

Sections 6.16-6.20 draw on the accounts of management 
systems in works on safety management such as Safety 
Management (D. Petersen, 1988b) and Successful Health and 
Safety Management (HSE, 1991b). The elements of the man¬ 
agement system described are: 

(16) policy; 

(17) organization; 

(18) planning; 

(19) measurement; 

(20) control; 

(21) audit. 

Sections 6.22—6.25 deal with four additional topics: 

(22) process knowledge; 

(23) safety strategies; 

(24) human factors; 

(25) contractors. 

Sections 6.26-6.28 treat: 

(26) safety management systems; 

(27) process safety management; 

(28) CCPS management guidelines. 

Section 6.29 covers: 

(29) regulatory control; 

and Section 6.30 covers the HSE management audit 
system: 

(30) STATAS. 

Treatments of the management system typically cover a 
number of topics, which in this book are dealt with else¬ 
where. These include hazard identification and assessment 
(HAZ) (Chapters 8 and 9), process design (Chapter 11), 
human factors and training (Chapter 14) and the safety 
system (Chapter 28). 

Selected references on management and organization of 
SLP are given in Table 6.1. 

6.1 Management Attitude 

Safety and loss prevention in an organization stand or fall 
by the attitude of senior management. This fact is simply 
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Table 6.1 Selected references on management and 
organization of safety and loss prevention 


ABCM (n.d./l, 1964/3); NRC (Appendix 28 Management 
and Management Systems); Guelich (1956); Argyris (1957); 
Black (1958); Christian (1960); Simmonds and Grimaldi 
(1963); Tver (1964); H.H. Fawcett and Wood (1965,1982); 
Pope and Cresswell (1965); BIM (1966,1990); Herzberg 
(1966); Likert (1967); CBI (1968,1974,1990); Leeah (1968); 
Porter and Lawler (1968); BCISC (1969/9,10,1973/12,13); 
Handley (1969,1977); Gilmore (1970); N.T. Freeman and 
Pickbourne (1971); Hoffinan (1971); Lloyd and Roberts 
(1971); R.L. Miller and Howard (1971); D. Petersen (1971, 
1980,1984,1988a,b, 1989); Sachere (1971); D. Williams 
(1971); D.J. Smith (1972,1981,1985,1991); Gardner (1973); 
W.G. Johnson (1973a, 1977,1980); Kramers and Meijnen 
(1974); D. Farmer (1975); Harvey (1976,1979b, 1984); Hope 
(1976); Arscott and Armstrong (1977); Briscoe and Nertney 
(1977); Luck (1977); Hawthorne (1978); Nertney (1978); 
Challis (1979); Kletz (19791,1982d, 1984g, 1988c,e); Anon. 
(1980e); Findlay and Kuhlman (1980); Chissick and 
Derricott (1981); HSE (1981d, 1981 OP 3,1991 HS(G) 65, 
1985c, 1986a); Laporte (1982); London (1982); Ormsby 
(1982,1990); BG (1984 Communication 1233,1986 
Communication 1304); Anthony (1985); Livingston-Booth 
etal. (1985);Tweeddale (1985,1990); C. Mill (1986); 
Kharbanda and Stallworthy (1986b); Winkler (1986); 
Boyen etal. (1987); Kemp (1987); Sulzer-Azaroff (1987); 
ACGIH (1988/17,1990/45,47,1992/81); Brian (1988); Coke 
(1988); Hawksley (1988); W.B. Howard (1988); ILO (1988, 
1991); Industrial Society (1988); Knowlton (1988,1990); 
Luck and Howe (1988); Rasmussen (1988); Shell Int. (1988); 
Tombs (1988); Watson and Oakes (1988); Weise (1988); 
Whalley and Lihou (1988); Bond (1989a); CONCAWE (1989 
4/89); Institute of Materials (1989 PR 1001,1992 PR 1002); 
Ognedal (1989); Oh and Albers (1989); K.H. Roberts (1989); 
K.H. Roberts and Gargano (1989); Schreiber and Sweeny 
(1989); Verhagen (1989); Belanger (1990); Burk and Smith 
(1990); P.C. Campbell (1990); Emerson (1990); Frohlich 
(1990); van Kernel etal. (1990); Krause etal. (1990); Lihou 
(1990a, 1992 LPB103); McKee (1990); Perry (1990); Rowe 
(1990); Toth (1990); Turney (1990a,h); Wade (1990); Anon. 
(1991a); Anon. (1991 LPB 98); Hurst (1991); IAEA (1991); 

B.ATurner (1991); Argent et al. (1992); Bird (1992 LPB 103); 
Bleeze (1992); Burge and Scott (1992); Engineering Council 
(1992,1993); HSE, APAU (1992); J. King (1992); McKeever 
and Lawrenson (1992); NSC (1992/11); A.J. Smith et al. 
(1992); Ball and Proctor (1993 LPB 111); Hoskins and Worm 
(1993); IMechE (1993/160); Nawar and Samsudin (1993); 
Pahlow and Dendy (1993); Ramsey et al. (1993); Sanders 
(1993b);Tosic (1993);Walker et al. (1993); Ward (1993); 
Westerberg (1993) 

CCPS Guidelines 

Schreiber (1991); Sweeney (1992) 

IChemE Guide 

Cloke (1988) 

Total quality management 

Ishikawa Kaoru (1976,1985); Crosby (1979,1984,1986); 
Juran (1979);Taguchi (1979,1981); Juran and Gryna (1980); 
Deming (1982,1986); Laporte (1982); Feigenbaum (1983); 

F. Price (1985); DTI (1986); Singo Shigeo (1986); Shell Int. 
(1988); Baguley (1989,1990); Bond (1989b, 1990a); Hodge 


and Whiston (1989); Oakland (1989,1993); K.H. Roberts 
(1989); K.H. Roberts and Gargano (1989);Taguchi, Elsayed 
and Hsiang (1989); Whiston and Eddershaw (1989); Cairns 
and Garrett (1990); Institute of Materials (1990 PR 1004); 
Knox (1990); Choppin (1991,1993); Klein (1991a,b); 

D.J. Smith and Edge (1991); Turney (1991); Zairi (1991); 

C. A. Moore (1992); Schreurs etal. (1992); Abbott (1993); 
ASME (1993/205); Woodruff (1993) BS (Appendix 27 
Quality Assurance, Total Quality Management) 

Quality assurance, ISO 9000, BS 5750 

ASME (Appendix 27); ISO (Appendix 27,1987 ISO 9000); 
IMechE (1982/65,66,1990/122); ASCE (1985/22); IChemE 
(1986/124,1988/133); Allen and Nixon (1987 SRD R455); ICI 
(1987); Atkinson (1988a); Weismantel (1990); CIA (1991 
CE6); Holmes (1991); Fouhy etal. (1992); Graham (1992); 
Hockman and Erdman (1993); PL. Johnson (1993); Love 
(1993); Owen and Maidment (1993); Weightman (1993); 
Mancine (1994) BS (Appendix 27 Quality Assurance), 

BS Handbook 22:1990, BS PD series 

Safety management systems 

Cullen (1990); Stricoff (1990); D.J. Griffiths (1993); 

EPSC (1994) 

Process safety management 

API (1990 RP 750); Early (1991); Hawks and Merian (1991); 
Mallett (1992); Barrish (1993); Bisio (1993); Drake and 
Thurston (1993); Migihon etal. (1993); Lohry (1994) 

Management of change 

Sankaran (1993); Anon. (1994 LPB 119, p. 17) 

Risk management 

R.N. Hugh (1976); J.Q. Wilson (1980); Wynne (1980,1982, 
1989,1992); Rica etal. (1984);Wildavsky (1985); Ostrom 
(1986); Pitblado (1986); Caputo (1987); Grose (1987); 
Kleindorfer and Kunreuther (1987); Jardine Insurance 
Brokers (1988); Bannister (1989); Hubert and Pages (1989); 
Weick (1989); O’Riordan (1990); Page (1990); Rowe (1990); 
Roy (1990); Shortreed (1990);Turney (1990a,b); S.J. Cox and 
Tait (1991); Greenberg and Cramer (1991); C.Wells (1991); 
Bergman et al. (1992); Frohlich and Rosen (1992b); 

D. J. Parker and Handmer (1992); Clagett etal. (1993); 

P.L. Johnson (1993); Purdy and Waselewski (1994) 

CCPA Code of manufacturing practice 

Creedy (1990) 

Contractors 

Sachere (1971); Cullen (1990); Bisio (1991b); Kletz (1991m); 
Webb (1993); Whitaker (1993) 

Research models 

J. Powell and Canter (1984); Dunford (1990 LPB 93); HSE 
(1992 CRR 33, 34,38); Hurst etal. (1992); J.C.Williams and 
Hurst (1992); van Steen and Koehorst (1993) 

STATAS 

Ratcliffe (1993,1993 LPB 112, LPB 113, LPB 114) 


stated, but it is difficult to overemphasize and it has far- 
reaching implications. 

6.1.1 Safety culture 

It is the duty of senior management to ensure that this 
attitude to SLP is realized throughout the company by the 
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creation of a safety culture in which the company’s way of 
doing things is also the safe way of doing things. It is not 
easy to create a proper attitude to safety. The most effective 
approach appears to be to treat safety as a matter of pro¬ 
fessionalism. This fits particularly well with the develop¬ 
ment of loss prevention with its more technical and 
quantitative approach. The discipline required to create and 
maintain a safety culture brings benefits not only to safety 
but also to the other aspects of the operation of the company. 
At this point the culture becomes self-reinforcing. 

6.1.2 Will to safety 

There is a danger that the emphasis in loss prevention on 
technological aspects of hazards and their control may 
obscure a very simple truth that in many cases an accident 
occurs because the will to avoid it was lacking. This theme 
has been developed by WB. Howard (1983,1984), who has 
given a number of telling examples of accidents where the 
essential cause was a conscious decision to take a particular 
course of action. Among the accidents cited are instances 
where an operator: was put in charge of equipment for 
which he had no training; omitted to check trip systems thus 
allowing them to degrade; chose to bypass trips and alarms 
to obtain increased production; and failed to provide a 
necessary trip on a temporary filling system. He also 
instances the installation of the temporary bypass pipe 
at Flixborough. Direction of attention to the role of con¬ 
scious decisions in accidents is a necessary corrective. The 
specific techniques associated with loss prevention are 
necessary, but they are not sufficiently alone. It is crucial 
that there also exists the will to safe design, operation and 
maintenance. 

6.2 Management Commitment and Leadership 

The creation and maintenance of a safety culture requires 
strong commitment and leadership by senior management. 
This means that the attitude of senior management must be 
demonstrated in practical ways so that all concerned are 
convinced of its commitment. Without management com¬ 
mitment and leadership of management, SLP programs are 
doomed to fail. An account of some of the ways in which 
management commitment and leadership is demonstrated 
was given by McKee (1990) of Conoco, part of Dupont, in 
evidence to the Piper Alpha Inquiry. They include giving 
safety a high profile, giving managers safety objectives, 
backing managers who give priority to safety in their deci¬ 
sions, operating an active audit system and responding to 
deficiencies and incidents. 

Safety is given a high profile in a number of ways. This is 
achieved by the measures just mentioned and also by put¬ 
ting it as the first item on the agenda of the appropriate 
meetings and making sure that personnel are aware of 
management’s actions both in initiation of, and in response 
to, safety matters. McKee states: 

I keep the safety priority in front of the organization on a 

daily basis, mainly through my close interest in safety 

reporting and my continuous ‘drumbeat’ about the safety 

priority. 

Managers are given specific safety objectives and are 
assessed on their performance in achieving them. These 
objectives cover both personal safety and major hazards. 
But whereas the former may be monitored in terms of per¬ 
sonal accident statistics, the latter are realized so rarely that 


event statistics are not the appropriate measure and adher¬ 
ence to systems and procedures is a better one. In McKee’s 
words: 6 ‘He is accountable not only for what is achieved but 
also for how it is attempted’. 

One of the situations most revealing of senior manage¬ 
ment’s real attitude to safety is its response to a manager’s 
decision in a specific case not to act in a way which he con¬ 
siders unsafe even though there is an immediate financial 
penalty. As McKee puts it: 

I have to do my part in helping people instinctively feel 
comfortable about the boundaries within which they 
make everyday decisions. In Conoco, we all try to let 
safety be the number one influence on every decision or 
action. 

With regard to audits, McKee states: 

I receive safety audit reports and react to them if required 
by raising the issues involved directly with the depart¬ 
mental director involved. I conduct my own informal 
audits on my frequent visits to our installations. I par¬ 
ticipate in the London safety action committee and I 
specifically discuss the audit system in general with 
managers and employees alike. 

Another principle is the prompt correction of defi¬ 
ciencies. A deficiency should not be allowed to persist, it 
should be corrected. But in addition the correction should 
be prompt and any delay explicitly justified. 

Closely related to this is the investigation of, and response 
to, incidents. An incident should be investigated and the 
lessons drawn. But, in addition, the involvement of senior 
management should be explicitly demonstrated. McKee 
states that he receives a daily report on safety from his safety 
manager, who is the only manager to report daily to him. If an 
incident occurs, the manager informs him immediately: ‘He 
interrupts whatever I am doing to do so, and that would apply 
whether or not I happened to be with the Minister for Energy 
or the Dupont chairman at the time.’ In sum, in McKee’s 
words: The fastest way to fail in our company is to do 
something unsafe, illegal or environmentally unsound. 

The attitude and leadership of senior management, then, 
are vital, but they are not in themselves sufficient. Appro¬ 
priate organization, competent people and effective sys¬ 
tems are equally necessary. 

6.3 Management Organization 

The discharge of senior management’s duty to exercise due 
care for the safety of its employees, of other people on the 
site and of the public requires that it create a rather com¬ 
prehensive and formal system and that it be active in creat¬ 
ing, operating, maintaining, auditing and adapting the 
system. It is necessary to define clearly the management 
structure. The distinction between the line, or executive, 
functions and the staff, or advisory, functions is a crucial 
one and is a well-established aspect of good management 
practice, but it is particularly important in SLP. Responsi¬ 
bility needs to be assigned unambiguously.There should be 
a job description for each of the jobs shown in the manage¬ 
ment structure. Once a job is defined, it is possible to select a 
competent person to fill it. 

These are essential steps, but they are not sufficient 
alone. There are other aspects to which it is necessary to pay 
attention if the organization is to be fully supportive of the 
efforts of individuals. 




MANAGEMENT AND MANAGEMENT SYSTEMS 6/5 


One important matter is arrangements to ensure that 
there is cover available for key jobs. The importance of this 
point was underlined by the Flixborough disaster. Such 
cover involves both short-term standby measures and long¬ 
term career planning. 

A more subtle point concerns discrepancies between 
function and seniority. This has frequently arisen, for 
example, in relation to the safety officer, who in many cases 
has lacked the authority to carry out his functions with full 
effectiveness. It is necessary to consider the possibility of 
such problems and to take appropriate steps. 

6.4 Competent People 

In addition to strong management systems, the design, 
operation and maintenance of hazardous processes 
requires competent people. Here it is necessary to try to 
define carefully what is required. The question is particu¬ 
larly important in respect of the technical executive man¬ 
agement which has prime responsibility for the process. 
The statement of the management structure and the job 
description is a necessary first step, but does not in itself 
take the matter very far. 

It is generally common ground that academic qualifica¬ 
tions, practical training, recent relevant experience and 
personal qualities are all important. The educational 
requirement raises questions both of level and content. As 
far as the former is concerned, the greatest need is for 
breadth of technological understanding. The person con¬ 
cerned should have his own area of expertise, but should 
also be able to appreciate what he does not know and where 
he needs help from others. In the United Kingdom, a first 
degree or equivalent in engineering or science is commonly 
held to be some assurance of such a broad technological 
education, although it may not be the only route. 

With regard to the most suitable content, this may depend 
on the process. Much emphasis was placed following the 
Flixborough disaster on maintaining the integrity of the 
plant, which favours chemical or mechanical engineering. 
In some cases, on the other hand, it may be as important to 
maintain the integrity of the process, which points to 
chemistry. Each case should be treated on its merits. 

As far as training and experience are concerned, dis¬ 
tinctions may be made between design and operation and 
between different processes. Experience in design does not 
necessarily fit someone for operation nor does experience in 
operation of a chlorine cellroom necessarily make him suit¬ 
able to operate an ethylene cracker. It is necessary that the 
experience be not only relevant but also recent. This is par¬ 
ticularly important in processes with a large content of 
complex and rapidly changing technology. On the other 
hand, these requirements should not be interpreted so 
restrictively that career development is hindered. 

Personal qualities are equally important, particularly in 
relation to operation of major hazard plants. Effectiveness 
in this job is in large part a question of such qualities as 
temperament. Particular emphasis is placed on the opera¬ 
tion of plants, especially major hazard plants. Here recent 
relevant experience and personal qualities are particularly 
important. 

6.5 Systems and Procedures 

It is fundamental that responsibility for SLP should be 
shared by all concerned in the proj ect. It cannot be delegated 


to a separate safety function. This does not mean, however, 
that reliance should be placed simply on individual compe¬ 
tence and conscientiousness. It is essential to support 
the competent people with appropriate systems of work. 
Experience indicates that effective systems require quite a 
high degree of formality. 

The purpose of these systems of work is to ensure a per¬ 
sonal and collective discipline, to exploit the experience 
gained by the organization, and to provide checks to mini¬ 
mize problems and errors.The framework of such systems is 
typically a set of standing orders or instructions which lay 
down requirements for the conduct of particular activities 
at the different stages of the project from research and 
development through to operation. 

Some key systems are those which are concerned with 

(1) Management leadership, commitment and accountability, 

(2) Risk analysis, assessment and management, (3) Facil¬ 
ities design and construction, (4) Process and facilities 
information and documentation, (5) Operation of plant 
(normal, emergency), (6) Control of access to plant, (7) Con¬ 
trol of plant maintenance (permits-to-work), (8) Manage¬ 
ment of change, (9) Inspection and maintenance of plant 
equipment, (10) Emergency preparedness (9) Third party 
services and (11) Incident reporting. All these systems are 
considered in detail in other chapters. 

It is important that the various activities be properly 
phased and matched to the project stages. Thus, for exam¬ 
ple, hazard identification should be undertaken at a stage 
early enough to identify any serious hazards which might 
threaten the viability of the whole project, but such an 
investigation can be on a relatively coarse scale. As design 
progresses, other more detailed hazard identification pro¬ 
cedures are required. 

There is, in principle, no limit to the number of systems 
which may be devised, but the aim is to have the optimum 
number which leaves no serious gaps and yet avoids 
confusion due to overlapping. Inevitably, formal systems 
sometimes appear tedious or unnecessary. They need 
to be well thought out so as to minimize this reaction. 
But experience shows that large proportions of incidents 
occur due to lack of proper procedures or to non-observance 
of them. 


6.6 Project Safety Reviews 

The management system should include a formal system of 
project safety reviews for the identification of hazards, 
evaluation of risk and an assessment of the adequacy of 
controls.The system of reviews should be comprehensive in 
that it covers all aspects of the project and does so over the 
whole life cycle. 

A typical set of project safety reviews is (1) Inherent 
safety/health/environment review (2) HAZard and OPer- 
ability (HAZOP) Review, (3) Detailed design review, 
(4) Construction review, (5) Pre-commissioning review and 
(6) Post-commissioning review. Project safety reviews are 
considered in Chapter 8. 

6.7 Management of Change 

A large project is subject throughout its life cycle to 
numerous changes, or modifications. It is necessary to have 
systems which will manage these changes satisfactorily. In 
particular, it is necessary to keep control of modifications, 
which may occur in design or operation. 
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These modifications may be to the process or the plant. 
Either way, modification control systems are required to 
detect intent to modify, to refer the modification to the 
appropriate function for checking, to record a modification 
authorized, to inform others of the modification and to 
follow up any implications such as a need for training. 
Modifications may be proposed during the design of a new 
plant or for existing plant. The latter also embraces major 
plant extensions. Different modification control systems 
are required for the design and operation stages. Manage¬ 
ment of change and control of modifications is discussed in 
Chapters 11 and 21. 

6.8 Standards and Codes of Practice 

An important aspect of the procedures is the use of stand¬ 
ards and codes of practice, both external and internal. 
These are referred to extensively throughout this book and 
it is difficult to overemphasize their importance. They 
represent a distillation of industry’s experience and are not 
to be disregarded lightly. 

Although the majority of standards and codes relate to 
design, there are also many which are concerned with 
operation. 

6.9 Pressure Systems 

Central to SLP is the problem of loss of containment. The 
management system for the design and operation of pres¬ 
sure systems is therefore of crucial importance. Major fail¬ 
ure of a properly designed, fabricated, constructed, tested, 
inspected and operated pressure vessel is very rare. But 
failures do occur in pressure systems. They tend to be fail¬ 
ures of other pressure system components such as pipework 
and fittings, pumps and heat exchangers or failures due to 
maloperation of the system. The management systems for 
the control and monitoring of a pressure system should be in 
two parts, covering the two broad areas of design and 
operation and administered by two separate authorities. 

The design authority should be responsible for systems 
for control of design, fabrication, testing and inspection, 
and the operating authority for those for control of com¬ 
missioning, operation, maintenance and modification. The 
design authority should define the parameters within 
which the system is to operate, should specify the design 
codes, should execute the actual design, should identify and 
assess hazards, should specify standards for fabrication, 
construction and testing of the systems and should pre¬ 
scribe the documentation required on all these aspects. It 
should also ensure the inspection of the plant during fabri¬ 
cation and construction. This inspection may he done by the 
design authority itself or by an external body such as an 
insurance company or an engineering inspection agency. 
The inspection should be done to the specified standards 
and should be recorded in the prescribed way. 

The operating authority should prepare written operat¬ 
ing instructions based on the method of operation envi¬ 
saged in the design, the design parameters and the hazard 
studies, and covering both normal and abnormal condi¬ 
tions. It should also create a system for the control of modi¬ 
fications in order to ensure the integrity both of the plant 
and of the process. The system should distinguish between 
proposed modifications that might affect the integrity of 
the plant and routine maintenance, and should require that 
the former be referred back to the design authority for 


checking. Similarly, the system should identify proposed 
modifications of operating procedures that go beyond 
established practice and might affect the integrity of the 
process, and should require that these also be referred back 
for checking by the design authority. 

The operating authority should also provide a code for 
the regular inspection of the pressure system. There should 
be documentation on each component giving its unique 
identification, location, engineering description, operating 
conditions, inspection interval and maintenance record. 
Inspection intervals for each class of equipment should be 
specified and rules stated for the alteration of inspection 
intervals. The code should ensure that the inspection 
authority is independent of the operating authority. 

6.10 Documentation 

A project in the chemical industry involves a large amount 
of documentation. A list of some principal items is given in 
Table 6.2. 

Some of the material is general documentation on com¬ 
pany systems and on standards and codes, but most is spe¬ 
cific to the particular process and plant. As the list given 
indicates, a large project requires a considerable amount of 
documentation. The table shows essentially the basic ele¬ 
ments of the documentation. Selected items may be put 
together to form manuals for various purposes. Typical 
manuals are the Design Manual, the Plant Manual and the 
Operating Manual. 

6.11 Audit System 

It is essential that there is a mechanism to monitor the sys¬ 
tem as a whole and to make sure that it is working correctly 
and is not falling into decay; in other words, an audit sys¬ 
tem. Audit differs from control. In control, the outputs of a 
system are measured and corrections made as necessary. 
Audit examines the control system itself to check that it 
is still fit for purpose. It takes place over a much longer 
timescale. 

The need for audit may vary It may be fairly clear without 
the need for an audit whether certain systems or procedures 
are working properly. But for others audit is required.Thus, 
for example, an audit of a permit-to-work system is gen¬ 
erally necessary to prevent it from degenerating. The audit 
system may include a specific instruction that the plant 
manager should each week examine a sample of the permits 
issued. The essential point is that the approach adopted is 
not simply to exhort the plant manager to monitor the per¬ 
mit system but to build the instructions to do an audit into 
the system. 

The audit function is considered further in Section 6.21. 
The essential point to make at this stage is the need for an 
audit system. 

6.12 Independent Checks 

The principle of independent checks is extremely important 
in ensuring reliability. It is already widely practiced in 
relation to pressure vessel inspection. Other areas where 
use is already made of independent checks are audits of 
management systems, hazard assessment of the plant as a 
whole and reliability assessment of protective instru¬ 
mentation. 

It is not essential, in order to ensure independence, to go 
to an outside organization. An independent function can 
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Table 6.2 Some principal items of documentation in a large chemical plant project 


Subject area 

Documentation 

Systems 

Documents on company systems (e.g., see Section 6.5) 

Standards and codes, 
legal requirements 

National standards and codes applicable to the design. In-house standards and codes 
applicable to the design, including guidance on situations where national standards 
and codes do not apply 

Legal requirements, statutory approvals 

Organization 

Organization chart of personnel 

Job descriptions and duties of personnel, including: 

(a) Process operators 

(b) Maintenance personnel 

(c) Supervisory staff 

Process design 

Description and history of process 

Design basis for plant including economics, output, yield, availability, storage, siting, 
pollution, loss prevention aspects 

Design data for process, including: 

(a) Process reactions and reaction kinetics, including possible reactions under 
abnormal conditions 

(b) Physical and chemical properties of materials including flammable, explosive 
and toxic features 

(c) Specifications for raw materials, products, by-products and effluents 

(d) Data relevant to selection of materials of construction 

(e) Data from pilot plant 

Process flowsheet giving main items of equipment, quantities of materials and 
services, inventories and operating conditions 

Process flow diagram giving all items of equipment, flow rates and other 
operating conditions 

Process design data sheets for items of equipment giving design basis, operating 
conditions, characterizing parameters, safety factors, equipment dimensions 
Inventories of hazardous materials in process and in storage 

Safety relief device contingency basis 

Sources of information (people, literature) 

Some of this documentation is usually collected together in a Design Manual 

Plant layout 

Site and plant layout diagrams 

Site and plant pipework drawings 

Equipment and pipework identification schemes 

Documents on hazardous area classification, means of escape, site vehicle routing 

Mechanical design 

Mechanical job specifications, design data sheets and general arrangement, detail and 
layout drawings, parts lists for items of equipment 

Piping job specifications, piping and instrument diagrams, piping plan, elevation and 
isometric drawings, piping stress and piping support documents, piping parts lists 
Documentation on pressure relief, blowdown and flare systems 

Services design 

Job specifications, including arrangements for loss of services covering electricity, 
steam, cooling water, process water, instrument air, process air, nitrogen and any 
other service required 

Electrical, civil, structural 
design 

Job specifications, general arrangement, detail and layout drawings, and materials or 
parts lists as appropriate 

Plant buildings 

Design basis for control room and other buildings 

Documents on siting, layout, construction and explosion resistance, ventilation, fire 
limitation, explosion relief as appropriate 

Control and instrumentation 

Design basis for process control 

Cause and effect diagrams for all protective systems 

Instrument job specifications, piping and instrument diagrams, instrument design 
datasheets 

Documents on alarm, trip and interlock systems 
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Table 6.2 (continued) 

Effluents, waste disposal, 

Environmental Permits including their basis 

Effluent, waste disposal and noise specifications and requirements of 
regulatory agencies 

Pollution, waste disposal and noise surveys of plant 

Fire protection 

Design basis for fire protection system 

Documents on fire protection system, including fire water supply 

Plant operation 

Works and plant safety rules 

Chemical data sheets 

Operating instructions, including instructions on: 

(a) Normal operation, including all sequential operations 

(b) Normal start-up and shut-down, including variations dependent on length of 
shut-down 

(c) Start-up on new plant 

(d) Shut-down under abnormal or emergency conditions 

(e) Trip systems 

Sampling instructions, including location and identification of sample points, 
sampling frequency, sampling method, safety precautions 

Instructions on dealing with leaks and spillages 

Instructions for reporting incidents 

Operating documents, including process operator’s log, plant manager’s log, storage 
logs, standard calculations of efficiency, costs, etc. 

Some of this documentation and some documentation from other sections, for example, 
process design, are usually collected together in a Plant Manual and/or Operating 
Manual 

Training 

Documents for process operator training (e.g., see Table 14.10) 

Documents for safety training (e.g., see Table 28.5) 

Safety equipment 

Documents on safety equipment covering for installed equipment: 

(a) Equipment location guide 

(b) Equipment inspection schedules 

(c) Equipment use manual 

(d) Equipment maintenance manual and for equipment in stock 

(e) Equipment stock control 

(f) Instructions on equipment issue 

Hazard identification and 
assessment 

Records from pilot operation, of work on screening of chemicals or reactions, of hazard 
and operability studies, of hazard assessments, of safety audits 

Checklists of all kinds (e.g., see Table 8.4) 

Security 

Lists of permanent personnel and of temporary personnel, e.g., construction personnel 
Security passes 

Plant maintenance 

Documents on plant maintenance, including: 

(a) Code for maintenance and modifications with supporting documents (permits to 
work, clearance certificates, modifications forms, etc.) 

(b) Equipment identification and location guide 

(c) Equipment inspection and lubrication schedules 

(d) Equipment maintenance manuals and instructions 

(e) Instructions on lubricants, gaskets, valve packings, pump seals 

(f) Maintenance stock requirements 

(g) Maintenance stock control 

(h) Standard repair times 

(i) Equipment turnaround schedules 

Plant inspection 

Code for inspection of pressure systems 

Records of equipment, including identification, location, engineering description, 
operating conditions, inspection intervals and maintenance history Records of 
non-destructive or condition monitoring tests 

Emergency planning 

Environmental control 

Documents on emergency planning (e.g., see Chapter 24) 

Environmental standards (e.g., OESs) 

Sampling schedules 
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exist within the organization - but it must be genuinely 
independent. In fact, many organizations do rely on outside 
bodies, such as insurers for the inspection of pressure ves¬ 
sels or consultants for hazard assessments of plants. 

Another independent check is furnished by the Factory 
Inspectorate. The most important function which the 
Inspectorate performs is to provide a further independent 
audit of the management and management system. It is 
emphasized, however, in accordance with the principle of 
self-regulation, that it is the responsibility of management 
to audit itself and that it should not rely on the Inspectorate 
to do this. 


6.13 Major Hazards 

The principles just outlined apply with special force to the 
management of major hazard installations. But there are 
also some particular considerations which need to be borne 
in mind in dealing with major hazards. These have been 
discussed by Challis (1979). What Challis particularly 
emphasizes is the combination on major hazard plants of 
high technology and people. If such plant is to be operated 
safely, it is necessary that there be strong leadership by 
management. The level of management which is particu¬ 
larly crucial is the first level of executive technical man¬ 
agement. 

The people who operate and maintain the plant cannot 
always be expected to have a full appreciation of all aspects 
of the complex technology involved. It is the responsibility 
of the manager on such a plant to address this problem. The 
workforce needs to have an understanding of the process 
and the plant, of the hazards involved and of the actions 
required. It should be well trained. It should be provided 
with clear instructions, both for normal operation and for 
emergencies. The manager on such an installation needs to 
be ‘out and about’rather than in the office. There should be a 
strong executive atmosphere and discipline on the plant. 

6.14 Quality Management 

Increasingly, SLP is subject to the influence of quality 
assurance (QA) and total quality management (TQM). An 
account of these was given in Chapter 1. 

6.14.1 Quality assurance 

As described in Chapter 1, there is a strong trend for com¬ 
panies to adopt QA throughout their operations and to seek 
accreditation. In the United Kingdom, this means accredi¬ 
tation to BS 5750:1987. Since QA covers inputs to the com¬ 
pany’s activities, this requires that subcontractors and 
suppliers also address QA. 

QA affects all aspects of a company’s activities and it will 
not generally be introduced solely as a means of improving 
SLP. But given that it is introduced, it will have an impact on 
the latter. Some SLP activities to which QA has been applied 
include, in particular, HAZOP (hazard and operability) 
studies and quantitative risk assessment and the work of 
consultants. 

6.14.2 Total quality management 

Essentially similar considerations apply to TQM. This also 
is unlikely to be introduced for the sole purpose of SLP, but 
if adopted it will have an impact. It is of interest that the 
Piper Alpha Inquiry was invited to recommend that TQM 
be adopted by offshore operators as a means of improving 


safety, butthat the Cullen Report( Cullen, 1990) did not do so, 
considering that although this might be so, the implications 
of a requirement forTQM went far beyond safety. 

The concept underlying loss prevention is that the pro¬ 
blem of failures and their effects has an influence on com¬ 
pany performance which goes far beyond safety of 
personnel. Essentially the same concept underlies theTQM 
approach. ThusTQM and SLP have much in common. 

There is some tendency for those involved with TQM to 
treat SLP as a subset of TQM. Insofar as TQM covers the 
whole range of a company’s activities whereas SLP deals 
with one aspect, this view might be held to have some force. 
Against this, SLP has developed within its own field the 
basic principle of TQM and has evolved a highly successful 
approach of some depth and sophistication. This evolution 
may be expected to continue within the context of TQM. 

The degree of sophistication of SLP in the process 
industries is well illustrated by developments in the nuclear 
power industry. A glance through the publications of the 
Nuclear Regulatory Commission (NRC) given in Appendix 28 
shows clearly the efforts made to foresee and forestall 
failures. Accounts of the application of TQM in the chemical 
industry have been given Whiston and Eddershaw (1989) 
and by Whiston (1991). A description of the application of 
TQM to HAZOP studies has been given by Turney (1991). 

6.15 Safety Management 

An account is now given of some principles of a PSM system. 
Figure 6.1 illustrates the key elements and structure of a 
safety management system (SMS) as given in Successful 
Health and Safety Management (HSE, 1991b). 

The elements described here are similar, except that 
measurement and control are considered as separate ele¬ 
ments, whilst review is treated as an aspect of control. The 
structure considered here is therefore: 

(1) policy; 

(2) organization; 

(3) planning; 

(4) measurement; 

(5) control; 

(6) audit. 

Some of the insets and appendices given in the 
HSE publication in support of the above topics are listed in 
Table 6.3. 

6.16 Policy 

Policy on safety should aim to set appropriate goals and 
objectives, to organize and plan to achieve these objectives 
in a cost-effective way, and to ensure by systems of meas¬ 
urement and control and of audit that the plan is imple¬ 
mented. The safety policy should be integrated with the 
other policies of the business, with the aim of achieving high 
standards of performance across the whole range of the 
activities undertaken. It should be the goal of safety policy 
to ensure that activities take place in a controlled manner 
and to eliminate deficiencies and failures which result in 
undesired events, some of which escalate to cause damage 
and/or injury. Safety policy should take full recognition of 
the importance of human resources and human factors, in 
other words of the people, the job they do and the organiza¬ 
tion within which they work, as shown in Figure 6.2. 
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Figure 6.1 Key elements of health and safety management (HSE, 1991b) (Courtesy of HM Stationery Office) 


Table 6.3 Insets and appendices given in Successful 
Health and Safety Management (HSE, 1991b) 


Inset 

1. Accident ratio studies 

2. Human factors in industrial safety 

3. The impact of effective health and safety policies on 
business thinking 

4. Performance standards 

5. Supervision 

6. Examples of statements of health and safety 
philosophy 

7. An outline for statements of health and safety policy 

8. Training for health and safety 

9. Role and functions of health and safety advisers 

10. A framework for setting performance standards 

11. Controlling health risks 

12. Assessing the relative importance of health and 
safety risks 

13. ‘So far as is reasonably practicable’, ‘So far as is 
practicable’ and ‘Best practicable means’ 

14. Inspection 

15. Key data to be covered in accident, ill health and 
incident reports 

16. Effective health and safety audits 

Appendix 

1. Terminology 

2. Organizing for health and safety 

3. Minimum objectives for performance standards 

4. Accident incidence and frequency rates 


6.17 Organization 

Organization for safety is considered by the HSE under the 
following headings: 


(1) control; 

(2) cooperation; 

(3) communication; 

(4) competence. 


6.17.1 Control 

The safety goal is to ensure that activities take place in a 
controlled, and therefore safe, manner. This means put¬ 
ting in place systems of control. Such a control system is 
analogous to the typical feedback control system used in 
process control. The variable to be controlled is identified, 
the variable is measured, the measured value is compared 
with a desired value, and if necessary control action is 
taken to effect correction. Furthermore, there may be a 
system of nested control loops, with the higher loops 
controlling higher level functions and operating on longer 
timescales. 

Measurement is an essential function in any control sys¬ 
tem. It is necessary to decide first what specific variables 
need to be regulated in order to bring the system as a whole 
under a satisfactory degree of control and then to decide 
whether for a given variable it is practical to measure it 
directly or whether it is necessary to infer it from some other 
measurement. Given that the variable can be measured, it is 
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Figure 6.2 Human factors in industrial safety (HSE, 1991b) (Courtesy of HM Stationery Office) 


necessary to decide what value is acceptable, by establish¬ 
ing a desired value or performance standard. 

In the control systems considered here, the control func¬ 
tion is exercised by people. It is therefore essential to define 
responsibilities. There is normally a hierarchy of respon¬ 
sibilities down through the successive levels of line manage¬ 
ment. It is then necessary to establish accountability for 
the discharge of responsibility at each level. Accountability 
may be reinforced by making it part of the job description, 
using it as an indicator of individual performance, and 
identifying lapses. 

Motivation is crucial to good performance. The most 
effective motivation is the existence of a safety culture that 
provides strong reinforcement. Training which enhances 
understanding and motivation also has an important 
contribution. 

Supervision provides guidance, example and discipline, 
and furnishes the external element that complements the 
internal motivation. 


6.17.2 Cooperation 

A safety culture necessarily involves the cooperation of the 
whole workforce. Specific measures have to be taken to 
obtain this. A system of safety committees and safety 
representatives, such as is required by UK legislation, is one 
means whereby such involvement can take place. This sys¬ 
tem alone, however, does not generally yield the degree of 
cooperation obtained by aTQM culture in which the people 
at all levels are encouraged to identify and correct defi¬ 
ciencies and failures, by participation in safety circles 
(analogous to quality circles) and like methods. 


6.17.3 Communication 

Effective operation of the control systems described 
involves large flows of information. The forms of commu¬ 
nication distinguished by the HSE are: (1) information 
inputs, (2) internal information flows, (3) visible behaviour, 
(4) written communications, (5) face-to-face discussion 
and (6) information outputs. The operation of a SMS actu¬ 
ally requires a considerable input of information into the 
organization. 

Good communication within the organization is critical. 
Effective communication uses three complementary modes: 
visible behaviour, written communications and face-to-face 
discussion. Management needs to demonstrate leadership 
that is visible to all. Written communications are the prin¬ 
cipal means of transmitting information. The information 
needs of the recipients differ, however, and such commu¬ 
nication is most effective if tailored to those needs. Face- 
to-face contact provides feedback and allows personal 
contribution. 


6.17.4 Competence 

The competence of personnel, particularly those in key 
positions, is crucial. Some of the relevant factors were dis¬ 
cussed in Section 6.4. It is necessary, therefore, to identify 
those jobs where competence is particularly important and 
to define what is required for each job. In some cases, the 
competence needed is a broad managerial one; in others it is 
a specialism. Competence depends partly on education and 
training, and partly on experience. Once the competence 
required is defined, it is possible to try to match the person 
to the job. 
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In some cases, the appointment of a ‘competent person’ 
is a legislative requirement. A supply of competent people 
is generally assured by a combination of career progres¬ 
sion within the company and external recruitment. For both 
sources, definition of the relevant competence is required. 

Individual competence is not the sole issue, however; there 
is also an organizational aspect. It is necessary to ensure 
that for any critical post there is cover if the individual 
currently filling it is out of action. 


6.18 Planning 

Planning of the SMS involves: 

(1) setting goals and objectives; 

(2) defining control systems; 

(3) setting performance standards. 

6.18.1 Goals and objectives 

Broad safety goals need to be translated into specific 
objectives. The objectives which it is practical to set are 
essentially determined by the variables which can be 
measured. 


6.18.2 Control systems 

In management theory, a distinction is commonly made 
between the following three stages of an activity to which 
controls maybe applied: (1) input, (2) process and (3) output. 
Again, on the analogy of process control, the first two may 
be likened to open loop control in that the required output is 
obtained if the process gain remains constant and the input 
is maintained at an appropriate value. Alternatively, the 
output can be measured, and closed loop (or feedback) 
control applied. The application of controls to all three 
stages therefore involves a degree of redundancy. As 
redundancy enhances reliability, this is a desirable feature. 

The systems required for hazards include systems for 
(1) hazard identification, (2) evaluation of risk and (3) an 
assessment of the adequacy of hazard controls. 

6.18.3 Performance standards 

Once objectives have been defined, suitable measurements, 
or metrics, have been selected and control systems based on 
those devised, the performance standards which these 
control systems should meet can be set. The performance 
standards should cover inputs, process and outputs. Some 
of the performance standards required are identified by 
the HSE as follows: (1) For inputs: (a) physical resources, 
(b) human resources and (c) information. (2) For process, or 
work activities: (a) control, cooperation, communication 
and competence; (b) premises, (c) plant and substances, 
(d) procedures and (e) people. (3) For outputs: (a) products 
and services, (b) by-products and (c) information. 

Performance standards should be set for the systems 
for hazard identification, hazard assessment and hazard 
control just mentioned. 


6.19 Measurement 

The account just given brings out the crucial role played by 
measurement. Effective systems of control can be devised 
only if suitable measures, or metrics, can be found. The 
problem is addressed in the HSE publications mentioned at 
the start of this chapter. 


6.19.1 Accident pyramid 

It is helpful to begin by revisiting the accident pyramid 
described in Chapter 1. What this shows is that for every 
serious or disabling injury incident there are a number of 
minor injury incidents; that for every minor injury incident 
there are a number of damage only incidents; and that for 
every damage only incident there are a number of incidents 
with no visible inj ury or damage. It follows that if incidents 
at this latter, and lowest, level can be kept under control, the 
incidence of the former will be much reduced. This is true, 
although there can be some practical problems. Since such 
incidents have no visible effect, it is not easy either to define 
them or to persuade people that they should be reported. 
The accident pyramid is the centrepiece of the study in 
The Costs of Accidents at Work (HSE, 1993a), which gives 
five case studies, including one of an offshore oil platform. 

6.19.2 Frequent and rare events 

There are various definitions of accidents. One of the best 
known is the lost time accident (LTA). Statistics of such 
accidents can be compiled and monitored. If the accidents 
are occurring with a sufficiently high frequency, the acci¬ 
dent statistics provide a suitable measure of performance. 
Some definitions of accidents and the monitoring of acci¬ 
dent statistics are discussed in Chapters 26 and 27. 

The goal of the SMS, however, is to eliminate accidents. 
The greater the success achieved, the less useful become the 
statistics of the more serious types of accident. This is seen 
most clearly in respect of major hazards, since the realiza¬ 
tion of a major hazard is a rare event in any company. The 
fact that there has been no such accident is a poor indicator 
of the company’s performance in the control of major 
hazards. In dealing with major hazards, the aim is to reduce 
the already low probability of a realization. Thus, the per¬ 
formance of the system in this regard has to be judged rather 
in terms of its effectiveness in operating and maintaining 
safety systems. This points to the need to measure inputs. 

It is pertinent to ask, however, whether performance in 
respect of accidents for which meaningful statistics are 
available correlates with performance in respect of major 
hazards. The answer appears to be that it does. Although 
realizations of major hazards occur too infrequently for 
their statistics to be a practical measure of the performance 
of an individual manager, except perhaps at the highest 
level, over a period statistics of major accidents and near- 
misses may be compiled for a company and are then a meas¬ 
ure of its performance. This point has been discussed by 
Brian (1988). A correlation does exist between the level of 
minor accidents and that of major accidents. The common 
factor is people, their attitude and discipline. 

The upshot of this is that for control systems for frequent 
events there is a need to measure both inputs and outputs, 
whereas for rare events the only option is to measure inputs. 

6.19.3 Proactive monitoring 

Timing then to specific measures, some items which may 
be made the subject of proactive monitoring include 
(1) achievement of objectives, (2) adherence to systems and 
procedures, (3) conduct of auditing, (4) state of plant and 
equipment and (5) state of documentation. 

A manager, for example, will be concerned with personal 
safety and may have responsibility for one or more major 
hazards. He will have objectives which have been set.There 
will be various systems and procedures to which he is 
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required to adhere. He needs to audit the performance of his 
subordinates in achieving their objectives and adhering to 
systems and procedures. 

The state of plant and equipment is monitored by 
inspection. This is a feature on which monitoring has tra¬ 
ditionally concentrated. The state of the associated docu¬ 
mentation can also be very revealing. 

If there are noxious substances in the plant environment, 
reduction of the levels of these should bean objective. In this 
case, there is something physical to measure and monitor. 

6.19.4 Reactive measures 

Some items which may be made the subject of reactive 
monitoring include (1) injuries, (2) damage, (3) other losses, 
(4) incidents and (5) workplace deteriorations. 

6.20 Control 

The purpose of the measurement activities just described is 
to provide the basis for control actions to correct deviations 
and for review of the performance of the system. 

6.20.1 Control and action 

If a deviation is detected, control action is required to correct 
it. In some cases, the corrective action needed is obvious 
and it can then be taken. In other cases, it is necessary to 
carryout an investigation.The purpose of the investigation 
is to discover not a single ‘cause’ but the total situation 
which has given rise to the deviation and the corrective 
action, or actions, required to prevent it. 

6.20.2 Review 

The other aspect of the control system is the review of per¬ 
formance to ensure that the performance standards are 
being met. Review is continuous and is performed by line 
management. These features make it a control rather than 
an auditing activity. 

6.21 Audit 

The whole management system just described needs to be 
examined periodically to ensure that its goals and objec¬ 
tives remain appropriate and that the control systems to 
achieve these objectives are working. This is the function of 
the audit system. Continuing the analogy of process control, 
the audit system constitutes a set of outer, higher level loops 
around the control systems. 

The purpose of an audit is to detect degradations and 
defects in a management system. This may be the manage¬ 
ment system of the company as a whole, a subsidiary com¬ 
pany, a works or a plant. An audit is performed by competent 
people who are independent of the organization being 
audited. It may be carried out by an individual or a team. It is 
a task requiring its own particular skills. 

A full audit of the management system will address the 
complete set of activities just described: policy, organiza¬ 
tion, planning, measurement and control. It is more usual to 
conduct audits with a more limited scope. Two approaches 
may be taken. One is to examine a specific function such as 
maintenance or fire protection; this is sometimes termed the 
vertical approach.The other is to examine a specific level of 
activity such as planning; this is the horizontal approach. 

At plant level, there will typically be apost-commissioning 
audit followed by audits at a fixed interval. Where the 
installation is owned by a partnership but operated by a 


single company, as is typical of many offshore oil platforms, 
the other partners will usually require audits. 

It is not easy to perform an effective audit. That this is so 
was brought out at the Piper Alpha Inquiry. One of the cru¬ 
cial systems of work on the platform was the permit-to - work 
system. The installation had been subject to a number of 
audits, but critical defects in the permit system had not been 
picked up. Yet, in less than 2 h of evidence from the wit¬ 
ness who was describing the system, these defects were 
laid bare. 

Audits are discussed further in Chapters 8 and 28. 

6.21.1 Proprietary systems 

There exist proprietary audit systems which may be used 
within a company to promote SLP. One of the best known is 
the International Safety Rating System (ISRS) (Bird and 
Germain, 1985). This system is described in Chapter 28. 

A critique of packaged audit systems is given by 
D. Petersen (1989). Essentially the criticism is that in such 
systems the items on which the rating is based tend to be 
arbitrary and do not accord well with items identified in 
other studies as being crucial to safety performance. 


6.22 Process Knowledge 

Knowledge of its processes and plants is one of the prime 
assets of a company, but the management of this asset often 
appears to be relatively neglected. 

6.22.1 Organizational memory 

In safety, the problem of knowledge management manifests 
itself most obviously in the repetition of similar incidents, 
which suggests defects in the collective memory. It is a 
matter of experience that incidents continue to occur 
despite the fact that similar, even virtually identical, inci¬ 
dents have occurred before, were fully investigated and 
reported, and should in principle be known to the profes¬ 
sion. The collective memory of the profession is deficient. 
Likewise, at company level, incidents are repeated even 
though in the past there has been full knowledge of the 
problem in the company. 

This phenomenon has been discussed and illustrated by 
Kletz (1980g). One particularly telling case which he quotes 
is where two similar accidents occurred within a couple of 
hundred metres, one in 1948 and one in 1968, though in this 
case in areas which were under separate management. 

6.22.2 Awareness 

The first requirement in process safety knowledge is simply 
awareness of hazards. Familiarity with a large number of 
case histories is one of the most effective ways of acquiring 
this awareness. Consideration should be given to any 
additional measures required to promote awareness in 
personnel entering into new responsibilities or undertaking 
new tasks. 

6.22.3 Understanding 

Knowledge is held within the organization in a variety of 
forms, including systems and procedures, in-house stan¬ 
dards and codes, design manuals and other forms of codi¬ 
fications of practice. In sum, these generally represent an 
enormous store of knowledge. Such traditional forms are 
now supplemented by computer programs and databases, 
and in some cases by expert systems. 



6/14 MANAGEMENT AND MANAGEMENT SYSTEMS 


In almost all cases, these forms constitute abstractions 
from the original raw data. As necessarily happens when 
this is performed, some important features of these data 
disappear. The immediacy of the individual accident case 
history is lost. The reason why a code contains a particular 
recommendation is no longer clear. Information is lost in the 
process of abstraction. The promotion of understanding of 
the reasons for particular features in codes enhances their 
effectiveness. 

6.22.4 Issues 

In the course of a design, there arise a large number of 
issues, some of which are of considerable importance. 
Issues may also arise at other stages of the life cycle of the 
plant. These issues need to be managed. There are two 
problems. One is to ensure that when the issue first arises 
it is satisfactorily handled. An important aspect of this is 
ensuring that the right people participate in its resolution. 
The other problem is to be able to retrieve information about 
the issue at a later date, so that the reasons underlying the 
decisions taken can be understood. It is not uncommon for 
a plant to have design features, the purposes or limitations 
of which are not fully understood. 

6.22.5 Operating procedures 

Design of a plant proceeds on assumptions about the way in 
which it is to be operated, which may or may not be made 
fully explicit. Most incidents that occur are related in some 
way to plant operation or maintenance. Any mismatch 
between the design and operation of the plant is to be 
avoided. 

6.22.6 Knowledge base 

The safe design and operation of process plants requires an 
effective knowledge base within the company. This knowl¬ 
edge base has some similarities to a living organism. Much 
attention is devoted to databases. The knowledge base is at 
least as important. Among other things, it determines the 
effectiveness of the utilization of the databases. 

The knowledge base takes various forms. These include 
in-house standards, codes and manuals, as already described. 
But above all it consists of the expertise of individuals. 

The maintenance of the knowledge base depends on a 
certain critical level of activity within the company, and 
within its individual functions. If this is not sustained, the 
knowledge base can decay quite rapidly. This is a particular 
danger if the company goes through a bad patch. 

Certain forms of knowledge can be documented, as 
described. Expertise derived from experience is more dif¬ 
ficult to capture, although there is increasing interest in 
methods of doing so. 

6.22.7 Knowledge utilization 

There are factors which favour the maintenance, and 
enhancement, of the knowledge base. The most effective 
way to maintain it is to utilize it. In effect, it is a case of ‘use 
it or lose it’. 

A crucial factor, therefore, is a safety culture in which 
people are motivated and have occasion to draw on the 
knowledgebase. 

A safety culture as such is not enough, however. Specific 
steps need to be taken to make the necessary knowledge 
available by an inflow of information into the organization 
from publications and personal interchange, by converting 


information to transparent and utilizable forms, by facili¬ 
tating access and by dissemination. Such arrangements 
will permit a company of moderate size to maintain a 
knowledge base which would otherwise be available only to 
a much larger organization. 

6.22.8 Incident investigation 

An important aspect of this activity is learning. It is usual 
in accounts of safety management to assign a prominent 
place to incident investigation. The point has already been 
made that incidents tend to repeat themselves. In many 
cases, investigation of the incident reveals little that is 
genuinely new. Nevertheless, the emphasis on incident 
investigation is not misplaced. It has a significant role in 
educating and motivating people and in keeping alive the 
knowledgebase. 

6.23 Safety Strategies 

For a given hazard, it is necessary to devise a suitable safety 
strategy. The strategy should fit the particular hazard, but 
there are certain principles which can be stated. At the 
most general level, the basic elements of a hazard control 
strategy are: 

(1) elimination; 

(2) control 

(a) reduction of frequency, 

% (b) reduction of consequence; 

(3) mitigation. 


If practical, the hazard should be completely eliminated. 
Otherwise, it should be controlled by reducing both the 
frequency and consequence of realization of the immediate 
event. Other measures to mitigate the effect of this event 
should be taken as practical. In process plants, the event of 
particular concern tends to be loss of containment. The 
strategy will then be built in large part around measures to 
reduce the frequency of such emission and to reduce the 
quantity released. 

There is frequently a choice of measures which may be 
taken to ensure safe operation. It is good practice, therefore, 
to define a ‘basis of safety’ and then to ensure that the 
necessary measures are taken. The basis of safety approach 
has found particular application in relation to the safety of 
chemical reactors. Another concept is that of the ‘design 
basis accident’. In some cases, it is not practical to have a 
design which will withstand all eventualities. Instead, a 
level of accident is defined which the plant is designed to 
withstand.The safety strategy is particularly important for 
major hazards. 

6.24 Human Factors 

The increasing emphasis on management is accompanied 
by a growing recognition of the importance of human fac¬ 
tors. The human element in incidents is illustrated in the 
numerous case histories described by Kletz in Learning 
from Accidents in Industry (Kletz, 1988h), What Went Wrong? 
(Kletz, 1988n), Improving Chemical Engineering Practices 
(Kletz, 1990d), An Engineer’s View of Human Error (Kletz, 
1991e), and numerous other publications. The essential 
message is that attribution of such incidents to human error 
is not an appropriate response and that it is more con¬ 
structive to treat them as arising from the work situation, 
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which is the responsibility of management. Human factors 
is the subject of a number of HSE publications, including 
Deadly Maintenance (HSE, 1985b), Dangerous Maintenance 
(HSE, 1987a) and Human Factors in Industrial Safely (HSE, 
1989b). Human factors are treated in Chapter 14. 

6.25 Contractors 

A particular problem is posed by contractors. In some sec¬ 
tions of the process industries, contractors constitute a 
large proportion of the workforce. They carry out not only 
construction work, but also specialist engineering and, in 
some cases, serve as process operators or maintenance 
personnel. These contractors have to conform to the systems 
and procedures of the company. They must therefore be 
trained in these and then subject to a discipline that ensures 
that they comply with them. 

Contractors constitute a high proportion, typically some 
70%, of the workforce in the UK sector of the North Sea. The 
problems associated with this surfaced at the inquiry into 
the Piper Alpha disaster, where the gas release which led to 
the explosion occurred from the site of a pressure safety 
valve. The valve had been removed and it was held that the 
flange assembly had not been made leak-tight. The man 
leading the two-man specialist team overhauling the valve 
was on his first tour as a supervisor and was not fully 
familiar with the permit-to-work system operated on that 
particular platform. 

Good practice requires that a company apply to con¬ 
tractors the same philosophy as it applies to its own per¬ 
sonnel. This should cover all aspects, including safety 
culture, training, discipline and audits. There are certain 
steps which a company can take to ensure that the work of 
contractors is satisfactory. One is to specify the standards to 
be met and to enforce adherence to them as part of a QA 
system. Another is to be prepared to pay a price which is 
realist ic and not to drive it down below the point at which the 
contractor is able to deliver the quality required; in some 
cases this means not accepting the lowest bid. 

6.26 Safety Management Systems 

The system that delivers the approach to process SLP 
described above is in effect an SMS. A requirement for a 
formalSMShasbeen introduced in UK legislation following 
the Piper Alpha disaster. The inquiry into the disaster was 
urged to strengthen the management of safety by requiring 
offshore operators to adopt TQM, but such a recommenda¬ 
tion would have had implications which go far beyond 
safety. The Cullen Report (Cullen, 1990) recommended 
instead that for offshore installations the safety case should 
include a formal SMS and this requirement is embodied in 
the Offshore Installations (Safety Case) Regulations 1992. 
The corresponding regulations for onshore major hazard 
plants, the Control of Industrial Major Accident Hazards 
(CIMAH) Regulations 1984, contained no such require- 
ment.The Cullen Report states that inter aliathe SMS should 
cover the elements listed in Table 6.4. 

An account of industrial practice in safety management 
is given in Safety Management Systems by the European 
Process Safety Centre (EPSC) (1994). The ten components of 
a typical management system are: 

(1) A charter defining the system’s purpose, responsible 
resources and time expectations, (2) The rationale of why 
the system’s purpose is important, its expected outcome, 


Table 6.4 Elements of the safety management system 
listed in the Cullen Report (Cullen, 1990) 


Organizational structure 

Management personnel 

Training for operations and emergencies 

Safety assessment 

Design procedures 

Procedures for operations, maintenance, modifications 
and emergencies 

Management of safety by contractors in respect of 
their work 

The involvement of the workforce (operators and 
contractors) in safety 

Accident and incident reporting, investigation and follow-up 
Monitoring and auditing of the operation of the system 
Systematic reappraisal of the system in the light of 
experience of the operator and industry 


and how the output will be used, (3) The scope, clearly 
defining boundaries, constraints, specifications of input/ 
output, resources required and excluded areas, (4) An 
administrator, defined as a single function or individual 
responsible for ensuring that the system is effective and 
provides continuity over time, (5) Tools/procedures/ 
resources/schedules, the documentation of what when, how 
and by whom tasks must be done, including scheduling and 
measuring or results and periodic assessment of compe¬ 
tency of resources, (6) Communications of results and plans 
to whom, by whom, how often, by what method, (7) Mana¬ 
gement sponsor to facilitate, monitor, recognize, provide 
commitment and sustainability, (8) Verification, which 
includes a measurement process to determine if desired 
results are being achieved and communicated to customers, 
sponsor, and members of the system, (9) A continuous 
improvement mechanism to facilitate improvements over 
time and (10) A document defining how the system works. 

6.27 Process Safety Management 

6.27.1 OSHA PSM Rule 

In the United States, certain hazardous chemicals attract 
the statutory requirement for a PSM system, introduced by 
the Occupational Safety andHealth Administration (OSHA) 
Rule Process Safety Management of Highly Hazardous 
Chemicals (Federal Register 29 CFR 1910.119). An account is 
given by Ozog and Stickles (1992). 

The PSM system rule specifies national performance 
standards in 14 elements: (1) employee participation, 

(2) process safety information, (3) process hazard analysis, 
(4) operating procedures, (5) training, (6) contractors, 
(7) pre-start-up safety review, (8) mechanical integrity, 
(9) hot work permit, (10) management of change, (11) inci¬ 
dent investigation, (12) emergency planning and response, 
(13) compliance audits and (14) trade secrets. 

6.27.2 EPA Risk Management Program 

In addition to the PSM system given in the OSHA Rule, there 
are several other American systems. One is the EPA Risk 
Management Program, the components of which are as 
follows: (1) hazard assessment, (2) prevention programme, 

(3) emergency response programme and (4) risk management 
plan. The prevention programme covers: (1) management 
system, (2) process hazard analysis, (3) process safety 
information, (4) standard operating procedures, (5) training, 
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(6) maintenance of mechanical integrity, (7) pre-start-up 
review, (8) management of change, (9) safety audits and 
(10) accident investigation. 

6.27.3 API RP 750 

Another process safety system is that given in API RP 750: 
1990 Management of Process Hazards. The elements of the 
American Petroleum Institute (API) system are (1) process 
safety information, (2) process hazards analysis, (3) man¬ 
agement of change, (4) operating procedures, (5) safe work 
practices, (6) training, (7) assurance of the quality and 
mechanical integrity of critical equipment, (8) pre-start-up 
safety review, (9) emergency response and control, 
(10) investigation of process-related incidents and (11) audit 
of process hazards management system. 

6.27.4 The ACC system 

The process safety system developed by the American 
Chemistry Council (ACC) has four main parts: (1) manage¬ 
ment leadership in process safety, (2) process safety man¬ 
agement of technology, (3) process safety management of 
facilities and (4) managing personnel for safety. Detailed 
elements are given under each of these headings. 

6.27.5 CCPS system 

Finally, there is the management system of the CCPS, which 
is described in Section 6.28. 


6.28 CCPS Management Guidelines 

The CCPS has published several sets of guidance on man¬ 
agement. The first of these was A Challenge to Commitment 
(CCPS, 1985) addressed to senior management in the 
industry. There have since followed a number of guidelines 
on management systems, as described below. 

6.28.1 Guidelines for Technical Management of 
Chemical Process Safety 

The Guidelines for Technical Management of Chemical Pro¬ 
cess Safety (the Technical Management Guidelines) by the 
CCPS (1989/7) give a comprehensive treatment of the man¬ 
agement of SLP. An account of these Guidelines is given by 
Schreiber (1991). The main headings of the Guidelines may 
be summarized as follows: 

(1) overview; 

(2) management and management systems; 

(3) goals and objectives; 

(4) process knowledge and documentation; 

(5) process safety reviews; 

(6) process risk management; 

(7) management of change; 

(8) process and equipment integrity; 

(9) human factors; 

(10) training and performance; 

(11) incident investigation; 

(12) company standards, codes and regulations; 

(13) audits and corrective action; 

(14) enhancement of process safety knowledge. 

The Guidelines are concerned with PSM. Process safety 
is defined as ‘the operation of facilities that handle, use, 
process, or store hazardous materials in a manner free 
from episodic or catastrophic incidents’ and PSM as ‘the 
application of management systems to the identification, 


understanding, and control of process hazards to prevent 
process-related injuries and accidents’. A distinction is 
drawn between process and personal safety, the scope of the 
work being confined to the former. The starting point is the 
recognition that ‘major accidents could not be prevented by 
technology-oriented solutions alone’. 

The Guidelines identify 12 key elements of process safety, 
each of which is broken down into a number of components. 
These are shown in Table 6.5, together with the location in 
this book where they are treated. Management leadership is 
emphasized. Management systems and management of 
process safety are treated in terms of the functions of 
(1) planning, (2) organization, (3) implementation and 
(4) control. Each of these functions operates are three levels: 
(1) strategic, (2) managerial and (3) task. The format of 
planning, organization, implementation and control (POIC) 
is applied to the other elements of the system. 

Accountability needs to be: planned so that the general 
goals are converted into specific objectives owned, or 
sponsored, by individuals; organized so that roles are 
defined, lines of authority are established and formal sys¬ 
tems specified; implemented by demonstration of compli¬ 
ance to senior management and controlled by performance 
measurement and audit. 

Process knowledge and documentation provides the 
basis for much of the safety programme. Examples are 
given of topics on which documentation is required such as 
chemical data and Material Safety Data Sheets (MSDSs), 
process definition, process and equipment design, and 
protective systems. 

Process safety review procedures are required for capital 
projects, whether for new or existing plants, extensions or 
acquisitions.Thereviewprocedure described is afive-stage 
one: (1) conceptual engineering, (2) basic engineering, 
(3) detail design, (4) equipment procurement and construc¬ 
tion and (5) commissioning. A comparison is given of hazard 
identification, or review, procedures such as hazard and 
operability studies, failure modes and effects analysis and 
fault trees, and of their role in the review process. Examples 
are given of topics covered in different types of process 
safety review such as the design stage, review or commis¬ 
sioning review. 

Process risk management involves a process of hazard 
identification, risk analysis, risk reduction, residual risk 
management and emergency planning. An account is given 
of the ranking of risks and of risk acceptability. The point 
is made that the analysis may reveal that the risks of the 
project may be simply too great to be acceptable. 

Management of change requires that mechanisms be in 
place to recognize and handle changes in the process, the 
plant or the organization.The features which prompt changes 
to the process or the plant and the effect of personnel changes 
on the organization are described. 

Process and equipment integrity is assured by measures 
which include: reliability engineering; materials selection; 
fabrication and inspection procedures; installation proce¬ 
dures; preventive maintenance; inspection and testing, of 
process, hardware and software; maintenance procedures; 
alarm and instrument management; and demolition pro¬ 
cedures. 

Human factors need to be taken into account in: the 
operator-process and operator-equipment interfaces; the 
choice between administrative control (procedures) and 
hardware controls (interlocks); and the assessment of 
human error. 
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Table 6.5 Elements and components of CCPS Technical Management Guidelines (CCPS, 1989/7) 



Chapter 1 

1, Accountability: Objectives and Goals 

Continuity of operations 

Continuity of systems (resources and funding) 

Continuity of organizations 

Company expectations (vision or master plan) 

Quality process 

Control of exceptions 

Alternative methods (performance vs specification) 

Management accessibility 

Communications 

6 

2. Process Knowledge and Documentation 

Process definition and design criteria 

Process and equipment design 

Company memory 

Documentation of risk management decisions 

Protective systems 

Normal and upset conditions 

Chemical and occupational health hazards 

3. Capital Project Review and Design Procedures b 

Appropriation request procedures 

Risk assessment for investment purposes 

Hazards review (including worst credible cases) 

Siting (relative to risk management) 

Plot plan 

Process design and review procedures 

Project management procedures 

4. Process Risk Management 

Hazard identification 

Risk assessment of existing operations 

Reduction of risk 

Residual risk management (in-plant emergency response and mitigation) 

Process management during emergencies 

Encouraging client and supplier companies to adopt similar risk 
management practices 

Selection of businesses with acceptable risks 

5. Management of Change 

Change of technology 

Change of facility 

Organizational changes that may have an impact on process safety 

Variance procedures 

Temporary changes 

Permanent changes 

6. Process and Equipment Integrity 

Reliability engineering 

Materials of construction 

Fabrication and inspection procedures 

Installation procedures 

Preventive maintenance 

Process, hardware and systems inspections and testing 
(pre-start-up safety review) 

7. Human Factors 

Human error assessment 

Operator-process and operator-equipment interface 

Administrative controls vs hardware 

6,11 

13 

11,20 

18, 25 

6,8,11 

10 

10 

5,6,8,9 

20,24 

20,40 

6,11,21 

11,12 

7 

12 

12 

19 

7,21 

19 

14 

8. Training and Performance 

Definition of skills and knowledge 

Training programs (e.g., new employees, contractors, technical employees) 

Design of operating and maintenance procedures 

14,20, 21,28 
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Table 6.5 (continued) 

Initial qualification assessment 
Ongoing performance and refresher training 
Instructor programme 
Records management 

9. Incident Investigation 
Major incidents 
Near-miss reporting 
Follow-up and resolution 
Communication 
Incident reporting 

Third-party participation, as needed 

10. Standards, Codes and Laws 

Internal standards, guidelines, and practices 
(past history, flexible performance standards, 
amendments and upgrades) 

External standards, guidelines and practices 

11. Audits and Corrective Actions 

Process safety audits and compliance reviews 
Resolutions and close-out procedures 

12. Enhancement of Process Safety Knowledge 
Internal and external research 
Improved predictive systems 

Process safety reference library 

a Chapter in this book in which this topic is principally addressed. 
b For new or existing plants, expansions, and acquisitions. 


Training is necessary to provide both knowledge and 
motivation. Some principal topics requiring training are 
listed, including operating and maintenance procedures. 
The approach to training is described, including definition 
of the knowledge and skills required, assessmentbefore and 
after training and keeping of training records. 

Incident investigation should be approached in terms of 
failure of the management system rather than of human 
error. An account is given of the incident investigation pro¬ 
cess, including: preparation; team selection; recording, 
reporting and analysis; follow-up and resolution and dis¬ 
semination of results. 

Company standards, codes and regulations provide a 
framework of requirements and guidance. Use is made of 
both external and in-house codes. The principal US codes 
relevant to the process industries are outlined. A plan is 
given for the repositories of external codes and regulations 
within a company. 

Audits are required to show the company whether its 
systems and procedures and its practices are adequate and 
are being adhered to, so that corrective action can be taken 
if they are not. The reasons for establishing an audit pro¬ 
gramme are described. They include the raising of safety 
awareness, acceleration of the development of safety control 
systems, improvement of safety performance and optimi¬ 
zation of safety resources. A particular type of audit is the 
compliance review, which is carried out to ensure that the 
company is meeting the legal requirements. 

Enhancement of process safety knowledge is an ongoing 
activity and involves the utilization of a range of resources, 
some of which are enumerated. The direction in which 
this work may progress is outlined by Sweeney (1992). 
The emphasis is on the development of measures of 
performance. 


11,12, App. 27 


6,8 


27 


6.28.2 Plant Guidelines for Technical Management of 
Chemical Process Safety 

The Plant Guidelines for Technical Management of Chemical 
Process Safety (the Plant Technical Management Guidelines) 
by the CCPS (1992/11) have the same basic structure as the 
Technical Guidelines, but emphasize concrete examples. 

These are principally given in the appendices, the titles of 
which are listed in Table 6.6. 


6.28.3 Guidelines for Implementing Process Safety 
Management Systems 

The implementation of a PSM system is covered in Guide¬ 
lines for Implementing Process Safety Management Systems 
(CCPS 1994/13). The elements of the system are those 
given in the Technical Management Guidelines and shown 
in Table 6.5. The treatment of implementation is under 
the headings: (1) management commitment, (2) definition of 
goals, (3) evaluation of the present status, (4) development of 
a plan, (5) development of specific PSM systems, (6) imple¬ 
mentation of the system, (7) measurement and monitoring 
of system installation and (8) expansion beyond the original 
scope. The guidelines describe a case study. 

6.28.4 Guidelines for Auditing Process Safety 
Management Systems 

The auditing of a PSM system is dealt with in Guidelines for 
Auditing Process Safety Management Systems (CCPS 1993/12). 
These guidelines cover topics closely aligned to, but not 
identical with, the 12 elements of the CCPS PSM system, the 
headings being: (1) management of PSM systems audits, 
(2) audit techniques, (3) accountability and responsibility, 
(4) process safety knowledge, (5) project safety reviews, 
(6) management of change, (7) process equipment integrity, 
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Table 6.6 Appendices of CCPS Plant Management Guidelines (CCPS, 1992/11) 


2A Characteristics of a management system 
3A Example of the management of process hazards 
4A Example of typical Material Safety Data Sheet 
4B Lead questions (hazardous conditions) 

4C Example of process definition/design criteria contents 

4D Example of typical protective systems/equipment data 

4E Example of components included in process knowledge and documentation 

5A Plant example of organization of process hazard review for appropriation requests 

5B Plant example of plant procedures: ‘Description of hazard review program for appropriation requests’ 

5C Example of plant procedures for appropriation request information and approvals 

5D Plant example of ‘Standard practice for process reviews’ 

6A Plant example of hazard identification 
6B Plant X’ risk analysis of operations 
6C Plant Y’ risk analysis of operations 
6D Example of process management in emergencies 
7A Management of change policy 

7B Guidelines for review of plant changes or modifications 

7C Control of change - safety management practices 

7D Control of changes 

7E Example of change of process technology 

7G Example of safety assessment form for plant modification work 

7H Safety guidelines variance request 

71 Permanent change considerations 

7J Examples of jumpers/bypass logging 

8A Example of plant management system for materials of construction (MOC) 

8B Example of test and field inspection equipment and procedures 
8C Example of field inspection and testing of process safety systems 
8D Example of a hot work permit 

8E Example of criteria for test and inspection of safety relief devices 
8F Example of management system for critical and unique safety features 

8G Table of contents from Chemical Manufacturers Association Fixed Equipment Inspection Guide 
10A Example of operator process safety training programme 
10B Example of maintenance training program for process safety 
IOC Example of operations technical staff training programme 
10D Example of maintenance training implementation 
10E Example of instructional standards 

10F Example of refresher training course frequencies 

11A Example of extraordinary event notification, investigation and reporting 

11B Example of plant follow-up procedures for accident or incident investigation recommendations 

11C Plant example of unplanned incidents causal factors analysis 

11D Example of plant accident or incident reporting procedures 

12A Example of operational safety standards guidelines 

12B Example of critical operating parameters: interpretation guidelines 

12C Example of manufacturing standards 

12D Example of hazardous systems (existing system) 

13 A Protocol for estimating progress in implementation of CCPS Guidelines for Technical Management of 
Chemical Process Safety 

13B ‘Key questions’ for the elements of process hazards management 

13C Example of process safety audit 

13D Example of safety and property protection procedures 

14A Professional industry organizations offering process safety enhancement 

14B Center for Chemical Process Safety Guidelines and conferences 

14C Examples of subj ects covered in process safety libraries 


(8) process risk management, (9) incident investigation, 
(10) human factors, (11) training and performance and 
(12) emergency response planning. 


6.29 Regulatory Control 

The crucial role of the management and management sys¬ 
tem in SLP means that it is, or should be, of prime concern 


to the regulatory body. The organization and activities of 
that body should reflect this. 

6.29.1 Evolution of policy 

The HSE has for a long time placed emphasis on the 
crucial role of management, but its approach has naturally 
undergone a process of evolution. The process has been 
described by Bleeze (1992).This evolution is documented in 
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the series of publications on management already referred 
to: Managing Safety (HSE, 1981d), Monitoring Safety (HSE, 
1985c), Effective Policies for Health and Safety (HSE, 1986a) 
and Successful Health and Safety Management (USE, 1991b). 

6.29.2 Inspection vs. audit 

In the United Kingdom, as elsewhere, the traditional 
approach to enforcement has been by inspection. This is 
reflected in the title of the arm of the HSE which operates at 
works level, the Factory Inspectorate. 

This approach is increasingly being supplanted by the 
auditing of the management and management systems.The 
features which are of interest to the regulator are now those 
such as the arrangements for the identification and assess¬ 
ment of hazards, for the proof testing of protective systems 
or for the investigation of incidents. 

The deficiencies of an approach to regulation based on 
inspection were highlighted by the Cullen Report on the 
Piper Alpha disaster and the report recommended a change 
in the regulatory regime away from one based on inspection 
and towards one based on audit of the SMS (Cullen, 1990). 

6.29.3 Accident Prevention Advisory Unit 

In order to provide assistance to inspectors in the assess¬ 
ment of management and management systems, the HSE 
has created the Accident Prevention Advisory Unit (APAU). 
Much of the HSE work described above derives from 
this unit. 


(3) construction/installation; 

(4) normal operation; 

(5) maintenance; 

(6) natural causes; 

(7) domino; 

(8) sabotage; 

(9) unknown. 

There are 12 categories of direct cause: 

(1) corrosion; 

(2) erosion; 

(3) external load; 

(4) impact; 

(5) overpressure; 

(6) vibration; 

(7) temperature (high, low); 

(8) wrong equipment; 

(9) defective equipment; 

(10) human error; 

(11) other; 

(12) unknown. 

There are four preventive mechanism categories. Two relate 
to equipment: 

(1) hazard identification and assessment (HAZ); 

(2) routine checking and testing (ROUT). 


6.29.4 Management assessment 

As described above, the HSE has given guidance on good 
practice in the management of process safety. It may be 
assumed to apply much the same criteria in the assessments 
which it undertakes. It is also active in the evaluation of 
research models of management effectiveness, including as 
proprietary systems. An account of one such study has been 
given by J.C. Williams and Hurst (1992). Against this back¬ 
ground, the HSE has been developing a method for auditing 
a SMS. This is now described. 


and two to people: 

(1) human factors review (HF); 

(2) task checking (TCHECK). 

The influencing factors which bear on the failures are 
represented by a socio-technical model. The structure of 
this model is shown in the socio-technical pyramid given in 
Figure 2.6(a). The model has six levels as follows: 


6.30 STATAS 

The HSE is well advanced with the development of a meth¬ 
odology for the audit of SMSs.The method goes by the name 
of Structured Audit Technique for the Assessment of Safety 
Management Systems (STATAS) and is described by 
Ratcliffe (1993, LPB 112,113,114) and Hurst and Ratcliffe 
(1994). The starting point is a field study of failures in 
vessels and pipework (Bellamy, Geyer and Astley, 1989; 
Geyer etal., 1990; Geyer andBellamy, 1991; Hurst et al., 1991). 
An account of the study and of the pipework failure data is 
given in Chapter 12, whilst the human error aspects are 
considered in Chapter 14. 

From this study a loss of containment model has been 
derived. The pipework failures are classified on three 
dimensions: 

(1) origin of failure (basic or underlying cause); 

(2) direct (immediate) cause; 

(3) recovery (preventive) mechanism. 

The origins of failure are divided into nine categories: 

(1) design; 

(2) manufacture/assembly; 


Level 

5 System climate 
4 Organization and management 
3 Communication and feedback 
2 Operator reliability 
1 Engineering reliability 
0 Loss of containment and mitigation 

Some influencing factors at Level 5 are background, leg¬ 
islation, regulation and resources; at Level 4, policies, 
management structure, formal systems, assigned respon¬ 
sibilities, performance criteria and emergency response 
organization; at Level 3, job descriptions, written pro¬ 
cedures, performance evaluation, safety audits, incident 
reporting and follow-up, and meetings; at Level 2, design, 
procedures, competence, manning and shifts; at Level 1 
plant layout and equipment design. 

In STATAS, these models are combined with an audit 
scheme. The five phases of the plant life cycle are: 

(1) design (DBS); 

(2) manufacture (MANF); 

(3) construction (CON); 

(4) operation (OP); 

(5) maintenance (MAINT). 
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Figure 6.3 Arrangement of question cell sets for audit of topic MAINT/ROU is STATAS (Ratcliffe, 1993 LPB 114) 


Since there are four recovery, or preventive, categories, 
there are in principle 20 combinations of plant phase and 
preventive category. The field study showed, however, that 
the great majority of failures are associated with just eight 
combinations. These eight cover 83% of vessel failures, the 
proportion recoverable being assessed as 87%; the corre¬ 
sponding figures for pipework are 84% and 92 % .The eight 
combinations are 

(1) DES/HAZ; 

(2) CON/TCHECK; 

(3) MAINT/ROUT; 

(4) MAINT/HF; 

(5) MAINT/TCHECK; 

(6) OP/HAZ; 

(7) OP/HF; 

(8) OP/TCHECK. 


Then, for each combination, an audit question set is 
devised. The themes of the questions are 

(1) structures, systems and procedures, 

(2) standards and criteria, 

(3) mitigation of pressures, 

(4) availability and use of resources. 

Each question set contains some 40-80 questions. The 
questions are grouped in cells containing between 2 and 10 
questions which explore a particular topic. 

The conduct of the audit aims to take samples ‘horizon¬ 
tally’ and ‘vertically’ through the system, concentrating 
mainly on Levels 1—4.The method is illustrated in Figure 6.3, 
which shows the arrangement of question cell sets for the 
topic MAINT/ROUT. Work on the question sets links with 
that of Wells, Hurst and co-workers described in Chapter 8. 
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7/2 RELIABILITY ENGINEERING 


Loss prevention is in large part the application of prob¬ 
abilistic methods to the problems of failure in the process 
industries. The discipline which is concerned with the 
probabilistic treatment of failure in systems in general is 
reliability engineering. This chapter gives an account of 
reliability engineering and of some reliability techniques. 

Selected references on reliability engineering are given in 
Table 7.1. There are numerous books on the subject. These 
include Reliability Theory and Practice (Bazovsky, 1961), 
Reliability Principles and Practices (Calabro, 1962), Reliability: 
Management, Methods and Mathematics (Lloyd and Lipow, 
1962), System Reliability Engineering (Sandler, 1963), Reli¬ 
ability Engineering (von Alven, 1964), Reliability Engineering 


Table 7.1 Selected references on reliability engineering 


IEC (Std 1078); NRC (Appendix 28 Reliability Engineering); 
UKAEA (Appendix 28); US Armed Forces (Appendix 27 
MIL Standards, Handbooks); Fry (1928); Feller (1951); Siegel 
(1956); Bazovsky (1960,1961); Chorofas (1960); Hosford 
(1960); Parzen (1960); Reza (1961); Blackett (1962); Calabro 
(1962); D.R. Cox (1962); Lloyd and Lipow (1962); Machol 
and Grey (1962); Savage (1962a,b, 1971); Pieruschka (1963); 
Sandler (1963); Zelen (1963); von Alven (1964); Myers et al. 
(1964); N.H. Roberts (1964); Barlow and Proschan (1965, 
1975); P.L. Meyer (1965); I. Miller and Freund (1965a); 

A.E. Green and Bourne (1966 UKAEA AHSB(S) R117, 
1972); Nathan (1966); Vance (1966); Hahn and Shapiro 
(1967); Haugen (1968); Hofmann (1968); Ireson (1968); 
Polovko (1968); Shooman (1968a); Gnedenko et al. (1969); 
A.E. Green (1969-70,1971SRS/GR/2,1972,1973,1974a,b, 
1976,1982b, 1983); IEE (1969 Conference Publication 60); 

C. S. Smith (1969); Thomason (1969); Tribus (1969); 
Breipohl (1970); Bourne (1970,1971 UKAEA SRS/GR/4, 
1972,1975 NCSR R7,1982); Kozlov and Ush a kov (1970); 

R. LeWis (1970); Rau (1970);Truscott (1970); Barnes (1971 
SRD Rl); Buffham et al (1971); R.A. Howard (1971); Jenkins 
and Youle (1971); Amstadter (1972); Caplen (1972); A.D.S. 
Carter (1972,1973,1976,1979,1980,1983,1986); D.R. Cox 
and Miller (1972); Cunningham and Cox (1972); Ross (1972); 

D. J. Smith (1972,1981,1985a, 1991); Bompas-Smith (1973); 
Henley and Williams (1973); Kletz (1973b, 19791); Locks 
(1973); Reinschke (1973); Schneeweiss (1973); D.J. Smith 
and Babb (1973); Apostolakis (1974); de Finetti (1974); 
J.R.'Ihylor (1974b, 1975b, 1976b, 1979); Mann et al. (1974); 
AEC (1975); H.M. Wagner (1975); Henley and Lynn (1976); 
Moss (1976 NCSR R12); C.O. Smith (1976); Lievens (1976); 
D.J. Bennett (1977); Dunster (1977); F.R. Farmer (1977a); 
Kapur and Lamherson (1977); Keller (1977); Mosteller 
(1977); C. Singh and Billinton (1977); Sorenson and Besuner 
(1977); Halpern (1978); Hastings and Mellow (1978); Rodin 
(1978); Richards (1980); Sinha and Kale (1980); Court (1981); 
Dhillon and Singh (1981); J.W. Foster (1981); Nieuwhof (1981, 
1984,1985a,c, 1986); O’Connor (1981,1984); Sherif (1981); 
Durr (1982); S.T. Parkinson (1982); Amendola and Melis 
(1983); Billinton and Hossain (1983); Hutchinson (1983); 
MoD (1983); Sayles (1983); Frankel (1984); K.A.P. Brown 
(1985); Serra and Barlow (1986); Ballard (1987); M.G. Singh 
etal. (1987);Veevers (1989/90); Misra (1992,1994); F.R. Nash 
(1993); Andrews and Moss (1993); Sherwin and Bossche 
(1993); BS 5760:1981- 

Terminology 

US Armed Forces (MIL-STD-721B, MIL-STD-781B); IEC 
(1969); BS 5760: Part 0:1986 


Background mathematics, statistical distributions 

Fry (1928); Clopper and Pearson (1934); Kendall (1948, 
1970); Arkin and Colton (1950); Hald (1952a,b); Burr (1953); 
Meehl (1954); K. Pearson and Hartley (1954); Moroney 
(1956); K. Pearson and Hartley (1956); Siegel (1956); Beers 
(1957); Kendall and Stewart (1958-); Bowker and 
Lieberman (1959); Pantony (1961); Raiffa and Schlaifer 
(1961); Reichman (1961); D.B. Owen (1962); Savage (1962a,b, 
1964); Kron (1963); Abromowitz and Stegun (1964); 

E.L. Grant (1964); N.L Johnson and Leone (1964); Kyburg 
and Smokier (1964); Lindley and Miller (1964); Lindley 
(1965); P.L. Meyer (1965); Papoulis (1965); Conway etal. 
(1967); Yamane (1967); Beyer (1968,1978,1984); Winkler 
(1968,1981); Aitcheson and Brown (1969); N.L. Johnson and 
Katz (1969); O’Brien (1969); Schmitt (1969); Woodcock and 
Barnes (1970 AHSB(S) R179); J.R. King (1971); Barks (1972); 
FRS (1972 Fire Research Note 909); Bolz and Tuve (1973); 
Lomnicki (1973); Hastings and Peacock (1974); Lehman 
(1975); Lmstone and Turoff (1975); Patel et al. (1976); 
Worledge (1976 SRD R68); Beck and Arnold (1977); Parry 
etal. (1977 SRD R80,1979 SRD R129); BRE (1978 CP8/78); 
Paradine and Rivett (1980); Govil and Agarwala 
(1982,1983a,b); Nelson and Rasmuson (1982); Patel and 
Read (1982); Sherif (1982a); Ichikawa (1983,1984a,b, 1986); 
Moran (1984); A.T. White (1984); Kececioglu and Dingjun 
(1985) 

Error function approximation: Karlsson and Bjerle (1980); 
Ernst (1992) 

Log normal distribution, error factor 

Chambers etal. (n.d.); Finney (1941,1971); Gaddum (1945); 
Brownlee (1949); Day (1949); Aitcheson and Brown (1969); 
AEC (1975); Kline (1984); Siu and Apostolakis (1985); 
Murty and Verma (1986); Savoie (1988) 

Weibull distribution 

Weibull (1951); Hastings (1967-68); R.A Mitchell (1967); 
L.S. Nelson (1967); Shooman (1968a); Truscott (1970); 
Steiger (1971); Hinds etal. (1977); Kapur and Lamherson 
(1977); O’Connor (1977); Sherwin and Lees (1980); Guida 
(1985); Kekecioglu and Jacks (1985); PW. Hale (1987); Lihou 
and Spence (1988) 

Extreme value theory, distribution 

R.A. Fisher and Tippett (1928); Cramer (1946); Gumbel 
(1958); B. Epstein (1960); Lloyd and Lipow (1962); Wiesner 
(1964); Ramachandran (FRS 1972 Fire Research Notes 910, 
929,943; 1973 Fire Research Note 991); Singpurwalla (1972); 
Bompas-Smith (1973); Mann et al. (1974); C.W. Anderson 
(1976); E.M. Roberts (1979); Perry (1981); Schueller (1982); 
R.L. Smith (1986); Surman et al. (1987) 

Bayesian methods 

Savage (1962b); Lindley (1965); Schmitt (1968);Weir (1968); 
Brand (1980); Colombo and Saracco (1983); Kaplan (1983); 
Puccini (1983); Yuan (1987); Hauptmans and Homke (1989) 

Early failure, burn-in 

R. Ward (1972); de la Mare and Ball (1981); Jensen (1982); 
Jensen and Petersen (1982); Mowbray (1991) 

Wearout failure 

Newby (1986); Mowbray (1991) 

Repair times 

Sandier (1963); AEC (1975); Kline (1984) 
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Dependent failure 

NRC (Appendix 28 Common Cause Failure ); Apostolakis 
(1975,1976); J.R. Taylor (1976a); Heising and Luciani (1977); 
Edwards and Watson (1979 SRD R146); P. Martin (1980); 
A.M. Smith and Watson (1980); Watson (1980); Heising 
(1983); M.G.K. Evans etal. (1984); Plate (1984); Games etal. 
(1985); Crellin etal. (1986);Teichman (1986); Yun and Bai 
(1986); G.T. Edwards (1987a,b); Johnston (1987a,b); Yuan 
(1987); Ballard (1988); Andrews and Moss (1993) 

Markov methods 

Kemeny and Snell (1960); Sandier (1963); Shooman (1968); 
R. A. Howard (1971); Plate (1984); J.N.P Gray (1985); 
Andrews and Moss (1993) 

Monte Carlo methods 

Metropolis and Ulam (1949); NBS (1951); Kahn (1957); 
Hammersley and Handscomb (1964); Shreider (1964); 
Tayyabkhan and Richardson (1965); Muth (1967); Rudd 
and Watson (1968); Shooman (1968a); Schmitt (1969); Ang 
and Tang (1974-75); Sobol (1974); AEC (1975); Lanore and 
Kalli (1977); EPRI (1981b); Rubinstein (1981); E.E. Lewis 
and Tu Zhuguo (1986); Soon Chang et al. (1986) 

Physics of failure 

Kao (1965); Shooman (1968a); Birnbaum and Saunders 
(1969); Yost and Hall (1976) 

Catastrophe theory 

Zeeman (1972,1977); Hilton (1976); Poston and Stewart 
(1978); Saunders (1980); Gilmore (1981) 

Rare events 

Selvidge (1972) 

Reliability specification, apportionment 

US Armed Forces (MIL-S- 38130); von Alven (1964); Petkar 
(1980); Sledge (1982); MoD (1983); EEMUA (1986 
Publication 148); Andersen and Neri (1990) 

Equipment testing 

US Armed Forces (MIL-STD-781A, MIL-STD-810); 
Kececlioglu and Jacks (1985); PW. Hale (1986); Irwing 
(1986); Lydersen and Rausand (1987); BS 5760: Part 10: 
1993, BS DD 57:1978 

Reliability growth modelling 

US Armed Forces (MIL-HDBK-189, MIL-STD-1635); 
Madansky and Peisakoff (1960); Duane (1962); Kamins and 
Gross (1967); Codier (1968); R.C.F. Hill (1977); Sheppard 
(1983,1985); Catchpole et al. (1984); Halliday and Devereux 
(1984); BS 5760: Part 6:1991 

Proportional hazards modelling 

D.R. Cox (1972); Kalbfleisch and Prentice (1980); Prentice 
etal. (1981); Andersen (1982); Lawless (1982); Bendell 
(1985); CJ. Dale (1985); Wightman and Bendell (1986) 

Expert opinion 

NRC (Appendix 28 Expert Judgement)-, Thurstone (1927, 
1931); Wherry (1938); Kendall (1948,1955,1970); Guilford 
(1954); Khan (1957); B. Brown (1964); C. Peterson and Miller 
(1964); Pontecorvo (1965); Schmid (1966); C.R. Peterson 
and Beach (1967);Torgerson (1967); Winkler (1968,1981, 
1986); Alpert and Raiffa (1969); B. Brown etal. (1969); 
Dalkey (1969); Keats (1971); Pill (1971); Klee (1972); 

L.L. Philipson (1974a); Tversky and Kahneman (1974); 
Lmstone and Turoff (1975); Spetzler and Stahl von Holstein 


(1975); Nachmias (1976,1992); Lichtenstein et al. (1977); 
Saaty (1977,1980,1982); Winkler and Murphy (1978); 
Apostolakis etal. (1980); Hunns (1980,1982); Apostolakis 
(1982,1985a,b, 1988,1990); Mosleh and Apostolakis (1982, 

1985.1986) ; Uppuluri (1983); Martz (1984); Mosleh etal. 
(1987,1988); Shields etal. (1987); Clarotti and Lindley 
(1988); Goossens etal. (1989); NRC (1989); van Steen etal. 
(1989); Svenson (1989); Wheeler et al. (1989); Meyer and 
Booker (1990); van Steen (1992). 

Interviewing: Khan (1957); Oppenheim (1966); Gorden 
(1969) 

Applications: Minarick and Kukielka (1982); Pickard et al. 
(1983); Swain and Guttman (1983); Cottrell etal. (1984); 
Embrey etal. (1984); IEEE (1984 Standard 500);Veneziano 
et al. (1984); Minarik et al. (1985); NRC, Steam Explosion 
Review Group (1985); Benjamin etal. (1986); EPRI (1986); 
Hannaman et al. (1986); Siu and Apostolakis (1982,1985, 
1986); Mosley, Bier and Apostolakis (1987); Wheeler et al. 
(1989) 

Complex systems, large systems 

Drenick (1960); Kron (1963); Htun (1965); Shooman 
(1968a); Nelson etal. (1970); Batts (1971); Colombo (1973); 

C. Singh (1974); NCSR (1975 NCSR R6); Blin etal. (1977); 
Hunns (1977); M.J. Harris and Rowe (1980); Kontoleon 
(1982); Laviron etal. (1982);Windebank (1982); Pickup 
(1983); Laviron (1985,1986); Laviron and Heising (1985) 

Special topics 

J.A. Baker (1963); Buzacott etal. (1967); D.B. Brown (1971); 
Koen and Carnino (1974); Kontoleon and Kontoleon (1974); 
Bourne (1975 NCSR R7); Buzacott (1976); N.D. Cox (1976); 
Astolfi and Elbaz (1977); G.O. Davies (1977); Mosteller 
(1977); Parry and Worledge (1977 SRD R95); Colombo et al. 
(1978); Parry (1979 SRD R143); Kontoleon (1980,1981); Plate 
(1980); Hohenbichler and Rackwitz (1981); Moieni etal. 
(1981); Nicolescu and Weber (1981); J.H. Powell (1981); 
Sharma (1981); Gopalan and Natesan (1982); Govil and 
Agarwal (1982,1983a,b); Husseiny etal. (1982); Misra and 
Gadani (1982); Brooks (1983); Hirschman etal. (1983); 
Ichikawa (1983); J.W.H. Price (1983); Sayles (1983); Walker 
(1983); Bendell and Ansell (1984); Connors (1984); Aven 
(1985,1986); Jain and Gopal (1985); Reiser (1985a,b); Witt 
(1985); Gopalan andVenkateswarlu (1986a,b); Gupta etal. 
(1986); Pickles (1986); Dorre (1987); Knezevich (1987); 
Limnios (1987); McCormick (1987); D.B. Parkinson (1987); 
Rushdi (1987); Walls and Bendell (1987) 

Stand by systems 

Signoret etal. (1983);Vaurio (1985) 

Quality assurance, control ( see also Table 6.1) 

NRC (Appendix 28 Quality Assurance)', US Air Force (n.d.); 
US Armed Forces (Appendix 27); Calabro (1962); C.S. Smith 
(1969); Thomason (1969); F. Nixon (1971); Schmitt and 
Wellein (1980); Kolff and Mertens (1984); A. Smith (1991) 

Mechanical reliability 

ASME (Appendix 28,1975/129,1977/17,1981/18,1982/161, 
1983/9,1990 PVP193,1993 DE 55); NRC (Appendix 28 
Failures); Haviland (1964); IMechE (1970/3,1974/10, 
1975/16,1984/79,1988/105,1994/172); A.D.S. Carter (1972, 

1973.1976.1979.1980.1983.1986) ; API (1973-, Refinery 
Inspection Guide); Bompas-Smith (1973); Barnes (1973 
SRSD/GR/12); Fames and Fothergill (1973 (SRS/GR/13); 
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Hensley (1973 SRS/GR/1); Pronikov (1973); D. Scott and 
Smith (1975); P. Martin (1976a,b); C.O. Smith (1976); Yost 
and Hall (1976); Kapur and Lamberson (1977); Venton 
(1977,1980); Moss (1980); Sherwin and Lees (1980); 

Martin etal. (1983); ASCE (1985/23); Parkhouse (1987); 
Davidson (1988) 

Failure data analysis 

NRC (Appendix 28 Failure Data Analysis)', Shaw (n.d.); 
Weibull (1951); Carhart (1953); Karassik (1959); 

L.G. Johnson (1964); Hastings (1967-68); R. A. Mitchell 
(1967); L.S. Nelson (1967); Kivenson (1971); Fercho and 
Ringer (1972); Bompas-Smith (1973); Jardine and Kirkham 
(1973); Ryerson (1973); Whitaker (1973a, b); J.C. Moore 
(1974); Nino (1974); de la Mare (1976); Moss (1976 NCSR R12, 
1977 NCSR 11); Aird (1977a, 1978); Berg (1977); Blanks 
(1977); Hinds etal. (1977); Kapur and Lamberson (1977); 
O’Connor (1977); Sherwin (1978,1983); Hastings and 
Jardine (1979); Sherwin and Lees (1980); Stokoe etal. (1981); 
Crellin and Smith (1982); Colombo and Jaarsma (1983); 
Harries etal. (1983); Puccini (1983); Bendell and Walls 
(1985); Nieuwhof (1985b); Lamerse and Bosnian (1985); 
Walls and Bendell (1985); Coit etal. (1986); Crellin etal. 
(1986); Schiffman (1986); Vaurio (1986); Bendell (1987); 
Andrews and Moss (1993) 

Bath tubcurve: Carhart (1953); A.D.S. Carter (1973); Talbot 
(1977); Aird (1978);Veevers (1989/90); Mowbray (1991) 

Availability 

H. Smith and Grace (1961); Gibbons (1962); Sandler (1963); 
R.E. Jackson etal. (1965); H.L Gray and Lewis (1967); 

WN. Smith (1968); Jenkins (1969); Sherry (1969-70); 
Buzacott (1970a,b); Dailey (1970); Henley (1971); Jenkins etal. 
(1971); Konoki (1971); Kuist and Fife (1971); Roth and Fiedler 
(1971); Cason (1972); McFatter (1972); G.H. Mitchell (1972); 
Ufford (1972); Gaddy and Culbertson (1973); Kardos and 
Vondran (1973); Locks (1973);Yaro (1973); Inon metal. (1974); 
Kafarov etal. (1974); Kardos etal. (1974—); Rosen and Henley 
(1974); Sawyer and Williams (1974); Walsham (1974); Cowan 
(1975); G.D.M. Pearson (1975,1977); Vondran and Kardos 
(1975); NCSR(1976NCSR R8); Apostolakis and Bansal (1976, 
1977); D.H. Allen and Pearson (1976); Caceres and Henley 
(1976); Cowan etal. (1976); Holmes (1976); Platz (1976,1977); 
Allen and Coker (1977); Blin etal. (1977); Cherry etal. (1977); 
D.H. G.O. Davies (1977); Henley and Hoshino (1977); Siddons 
(1977); Coker (1978); Parry and Worledge (1978 SRD R113); 
Ong and Henley (1979); Apostolakis and Chu (1980); 
Leblanc etal. (1980); J.W. Foster (1981); M.J. Phillips (1981); 
Heising (1983); Nieuwhof (1983b); Piccinnini and Anatra 
(1983); Sherwin (1984); Brouwers (1986); Brouwers etal. 
(1987); Evans (1987NCSR/GR/68);Watanabe (1987); 
Fairclough (1988); Odi and Karimi (1988); E.S. Lee and 
Reklaitis (1989); Dougan and Reilly (1993); Sherwin and 
Bossche (1993) 

Maintenance 

NRC (Appendix 28 Maintenance, Maintenance Personnel 
Reliability Model)', US Armed Forces (MIL-HDBK-472, 
MIL-STD-470, MIL-STD-471); J.C. Moore (1960,1966, 
1974); Bartholemew (1963); Dean (1963); J.E. Miller and 
Blood (1963); Goldman and Slattery (1964); Nathan (1966); 
Newborough (1967); Woodman (1967); Blanchard and 
Lowery (1969); IMechE (1969/2,1973/6,1975/16,17, 
1994/174); Armitage (1970); Geraerds (1970); Jardine 
(1970a, 1973a, 1976); Kelly and Harris (1971); D.J. Smith 


(1972,1981,1985a, 1991); Gradon (1973); Hastings (1973); 
D.J. Smith and Babb (1973); Trotter (1973); Clifton (1974); 
Priel (1974); Reynolds (1974); Corder (1976); Husband (1976); 
Andre (1977); Johns and Sadlowski (1977); Kapur and 
Lamberson (1977); de la Mare (1979 NCSR 21); Sherwin and 
Lees (1980); J.W. Foster (1981); Barry and Hudson (1983); 
G.T. Edwards (1983); MoD (1983); Sherwin (1983); van 
Aken et al. (1984); Backert and Rippin (1985); Kelly (1986); 
L.C. Thomas (1986); Henry (1990,1993a,b); Factory Mutual 
Int. (1991a); Rao (1992); Andrews and Moss (1993); Whetton 
(1993) 

Life cycle costing: Sherif (1982b); Lees (1983); 
Jambulingam and Jardine (1986) 

Reliability-centred maintenance: US Armed Forces 
(MIL-HDBK-472); Nail and Nair (1965); Nowlan and Heap 
(1978); Jambulingam and Jardine (1986); Anderson and 
Neri (1990); Moubray (1991); Sandtory (1991) 

Spares holdings: G.H. Mitchell (1972); Messinger and 
Shooman (1976) 

Computer system, software reliability (see also 
Table 13.3) 

NRC (Appendix 28 Computer Software Reliability); Aiken 
(1958); Anon. (1960b); Naur (1966); Floyd (1967); London 
(1968); Manna and Pnueli (1969); Bauer (1975a,b); Goos 
(1975); Poole (1975);Tsichritzis (1975a,b); Fagan (1976); 
Meyers (1976); Shooman (1976,1983); J.L. Peterson (1977); 
R.B. Anderson (1979); Boulton and Kittler (1979); Daniels 
(1979 NCSR 17,1983,1986,1987); Daniels and Hughes (1979 
NCSR 16); Glass (1979); Kopetz (1979); Cho (1980); 
Longbottom (1980); Dempster et al. (1981); Kersken and 
Ehrenberger (1981); J. Peterson (1981); Dunn and Ullman 
(1982); McGettrick (1982); Becker (1983); Gubitz (1983); 
Leveson and Harvey (1983); Leveson and Stolzy (1983); 
Lord (1983); Bennett (1984,1991a,b, 1993); Dunn (1984); 
Goldsack (1985); IEE (1985,1989); Quirk (1985); Backhouse 
(1986); CEC (1986); Helps (1986); C.B. Jones (1986); Leveson 
(1986,1987); O. Anderson etal. (1987);T. Anderson (1987); 
Baber (1987); Barry (1987); C. Dale (1987); Dale etal. (1987 
NCSR/GR/65); Ehrenburger (1987); Hennell (1987); 
Humphreys (1987); IEC (1987/1,1991SC65AWG9); 
Littlewood (1987a,b); Macro and Buxton (1987); MoD (1987, 
1989b,c); Musa etal. (1987); National Computer Centre 
(1987,1989); Nordic Council of Ministers (1987); Pyle (1987, 
1991,1993); Schagen (1987); Schagen and Sallih (1987); 
Schulmeyer and MacManus (1987); Voges (1987); 
Heilbrunner (1988); IChemE (1988/132); E. Johnson (1988); 
Redmill (1988,1989); Humphrey (1989); Lasher (1989); 
Littlewood (1989); McDermid (1989a,b, 1991,1993); Sennett 
(1989); Somervffle (1989); D.J. Smith and Wood (1989); 

R. Clarke (1989-90); Bishop (1990); DTI (1990); 
Frederickson and Beckman (1990); C.B. Jones and Shaw 
(1990); C. Morgan (1990); Rook (1990,1991); Schulmeyer 
(1990); P. Bennett (1991); Facey (1991); Fergus etal. (1991); 
P.A.V Hall (1991); Hunns and Wainwright (1991); IEE (1991, 
1991 Coll. Dig. 91/3,1992); Ince (1991a, b); L. Jones (1991); 
Littlewood and Miller (1991); Paula and Roberts (1991); 
Rook (1991); Shrivastava (1991); A. Smith (1991); J.T. Webb 
(1991); Woodward (1991); Chudleigh and Catmar (1992); 
Wichmann (1992); Bologna (1993); Cluley (1993); Danielsen 
(1993); Drake and Thurston (1993); Ehrenberger (1993); 
Fink et al. (1993); Johnston (1993); Malcolm (1993); 

Rata (1993); Redmill and Anderson (1993); Rowland 
(1993); Walton (1993); P. Woods (1993) BS (Appendix 27 
Computers) 
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Nuclear systems (see alsoTables 9.1 and A20.1) 

NRC (Appendix 28); UKAEA (Appendix 28); Siddall (1959); 
Eames (1966); F.R. Farmer (1967a,b, 1969a, b, 1971,1977a); 
Hensley (1968); A.E. Green (1969-70,1972,1973,1974a, b, 
1976); Bourne (1970); A.E. Green and Bourne (1972); Ablitt 
(1975); Carnino (1976); Eames etal. (1976); Rudolph (1977); 
Schmitt and Wellein (1980); Welsh and Lundberg (1980); 
Bowers etal. (1981); Ballard (1989) 

Analysis of faults and abnormal occurrences: J.C. Moore 
(1960,1966,1974); R.L. Scott (1971); J.R. Taylor (1974a, 
1975c); AEC (1975); NBA (1977) 

Electrical power systems 

Sherry (1969-70); Billinton (1970); Billinton et al. (1973); 
Wakeman and Laughton (1976); Siddons (1977); C. Singh 
and Billinton (1977); Sherif (1982c); Snaith (1982); Billinton 
and Allan (1983); Yip et at. (1984); Allan et al. (1986); 
Systems Engineering Comm. (1986) 

Process industry systems 

Rudd (1962); Rudd and Watson (1968); Weisman (1968); 
Browning (1969a-c, 1970,1973); Buffham and Freshwater 
(1969); Freshwater and Buffham (1969); Bently and Reid 
(1970); Cornett and Jones (1970); Lenz (1970); Loftus (1970); 
Pan (1970); H.LWilliams and Russell (1970); Buffham etal. 
(1971); Patterson and Clark (1971); C.F. King and Rudd 
(1972); Low and Noltingk (1972); D.H. Allen (1973); N.D. Cox 
(1973); Eames (1973 UKAEA SRS/GR/12); Eames and 
Fothergill (1973 SRS/GR/13); Hensley (1973 UKAEA 
SRS/GR/1);Whitaker (1973a,b); S.B. Gibson (1974,1976c); 
D.R.Wood etal. (1974); Henley and Gandhi (1975); Anon. 
(1976 LPB11, p. 18; LPB12, p. 17); Birbara (1976); Campbell 
and Gaddy (1976); Lees (1976b, 1977a); Sayers (1976); 
Bennett (1977); Berg (1977); J.H. Bowen (1977); Cannon 
(1977); Cerda and Napier (1977); Craker and Mobbs (1977); 
Doering and Gaddy (1977); McLntire (1977); R.W Nelson 
(1977); Coltharp etal. (1978); Senior (1978); Doig and 
Reinten (1979); Isaszegi and Timar (1979); Kumamoto and 
Henley (1979); Mundo (1979); Aird (1980,1981,1984); 
Burton (1980); M.J. Harris and Rowe (1980); Leblanc etal. 
(1980); Sherwin and Lees (1980); Temple (1980); Butterfield 
(1981); Craker (1981); Dransfield and Lowe (1981); Keller 
and Stipho (1981); Stokoe etal. (1981); Sturrock (1981); 
Bradbury (1982); Corran and Witt (1982); Piccinnini and 
Anatra (1983); Sherwin (1983); Bosman (1985); Jebens 
(1986); Churchley (1987); Keey (1987); Fairclough (1988); 
Khadke etal. (1989); Beckman (1992b) 

Other industries and systems 

Burgess (1974); F.H. Thomas (1977); Blockley (1980); 
Kinkead (1982);Tregelles and Worthington (1982); Yao 
(1985); Harr (1987) 


for Electronic Systems (Myers et al., 1964), Mathematical 
Theory of Reliability (Barlow and Proschan, 1965), Probabil¬ 
istic Reliability: An Engineering Approach (Shooman, 1968a), 
Probabilistic Systems Analysis (Breipohl, 1970), Mechanical 
Reliability (A.D.S. Carter, 1972; 2nd edn, 1986), Reliability 
Technology (A.E. Green and Bourne, 1972), Reliability, Main¬ 
tainability and Availability Assessment (Locks, 1973), Reli¬ 
ability Engineering in Design (Kapur and Lamberson, 1977), 
Engineering Reliability (Dhillon and Singh, 1981), Practical 
Reliability Engineering (O’Connor, 1981; 2nd edn, 1984), 
Reliability and Maintainability in Perspective (D.J. Smith, 


1988) Reliability, Maintainability and Risk (D.J. Smith, 1991), 
Reliability Analysis and Prediction (Misra, 1992), Reliability 
and Risk (Andrews and Moss, 1993), The Reliability Avail¬ 
ability and Productiveness of Systems (Sherwin and Bossche, 

1993) andNewTrends in System Reliability Evaluation (Misra, 

1994) . It is intended that the material given in this chapter be 
supplemented by this literature. 

7.1 Development of Reliability Engineering 

Some of the earliest developments in reliability engineering 
occurred during the Second World War. The Germans had 
problems with the reliability of the V-l missile (Bazovsky, 
1961).The project team leader, Lusser, has described how the 
first approach taken to the problem was based on the argu¬ 
ment that a chain is no stronger than its weakest link. This 
concentrated attention on the small number of low reliability 
components. But this approach was not successful. It was 
then pointed out by a mathematician, Pieruschka, that the 
probability of success p in a system in which all the compo¬ 
nents must work if the system is to work is the product of the 
individual probabilities of success pi. 

p=i[pi [7.i.i] 

This drew attention to the need to improve the reliability 
of the many medium reliability components. This app¬ 
roach was much more successful in improving missile reli¬ 
ability. Equation 7.1.1 is known as Lusser’s product law of 
reliabilities. 

On the other side of the Channel, Blackett (1962) was 
drawing attention to the significance of Equation 7.1.1 to 
military operations in general: 

In the simplest case of air attack on a ship, the four main 

probabilities are (1) the chance of a sighting, (2) the chance 

the aircraft gets in an attack, (3) the chance of a hit on a 

ship, and (4) the chance that the hit causes the ship to sink. 

This work was the beginning of operational research. 

The US armed forces also had serious reliability pro¬ 
blems, particularly with vacuum tubes used in electronic 
equipment. Studies of electronic equipment reliability at 
the end of the War showed some startling situations 
(Shooman, 1968a). In the Navy the number of vacuum tubes 
in a destroyer had risen from 60 in 1937 to 3200 in 1952. A 
study conducted during manoeuvres revealed that equip¬ 
ment was operational only 30% of the time. An Army 
study showed that equipment was broken down between 
two-thirds and three-quarters of the time. The Air Force 
found that over a 5-year period, maintenance and repair 
costs of equipment exceeded the initial cost by a factor of 
10. It was also discovered that for every vacuum tube in 
use there was one held as spare and seven in transit, and 
that one electronics technician was needed for every 
250 vacuum tubes. These studies illustrate well the typical 
problems in reliability engineering, which is concerned not 
only with reliability but also with availability, maintenance 
and so on. 

From these early beginnings the study of reliability has 
become a fully developed discipline. It has received par¬ 
ticular impetus from the reliability requirements in the 
fields of defence and aerospace, and electronics and com¬ 
puters. Perhaps the most spectacular example is the moon- 
shots, which depended crucially on reliability technology. 
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One of the main fields of application of reliability engi¬ 
neering has been in electronic equipment. Such equipment 
typically has a large number of components. Initially, the 
reliability of electronic equipment was much less than that 
of mechanical equipment. But the application of reliability 
engineering to electronic equipment has now made it gen¬ 
erally as reliable. 

Another area in which reliability engineering has been 
widely used is nuclear energy. Methods have had to be 
developed to assess the hazards of nuclear reactors and to 
design instrument trip systems to shut them down safely. 

In the United Kingdom, work on reliability of nuclear 
reactors has been done by the UK Atomic Energy Authority 
(UKAEA), originally through its Health and Safety Branch 
and subsequently through the Safety and Reliability 
Directorate (SRD), which runs the National Centre for Sys¬ 
tems Reliability (NCSR) and the Systems Reliability Ser¬ 
vice (SRS). The latter operates a consultancy service on 
industrial reliability problems and a failure data bank. 

The development of reliability engineering and of loss 
prevention in the chemical and petroleum industries has 
been described in Chapter 1. 

7.2 Reliability Engineering in the Process Industries 

7.2.1 Applicability of reliability techniques 

It is entirely right that the process industries should seek to 
apply the techniques and obtain the benefits of reliability 
engineering. But it is important to recognize that reliability 
engineering as a discipline has grown up outside these 
industries. It is to he expected, therefore, that the tech¬ 
niques will need to be adapted to and developed for the 
problems of the process industries. A similar adaptation 
was necessary in order to apply control engineering to 
process problems. The process industries are particularly 
concerned with mechanical equipment reliability. This is 
proving a rather more intractable problem. 

7.2.2 Reliability assessment and improvement 

Reliability engineering involves an iterative process of 
reliability assessment and improvement, and the relation¬ 
ship between these two aspects is important. Work on the 
reliability of a system necessarily involves assessment of 
that reliability. In some cases the assessment shows that the 
system is sufficiently reliable. In other cases the reliability 
is found to be inadequate, but the assessment work reveals 
ways in which the reliability can be improved. It is gen¬ 
erally agreed that the value of reliability assessment lies 
not in the figure obtained for system reliability, but in the 
discovery of the ways in which reliability can be improved. 

The reliability engineer, however, cannot wait until his 
fellow engineers have solved all their reliability problems. 
It is his job to identify the areas where improvements are 
essential for success. But for the rest, he is obliged to 
accept, as given, the levels of reliability currently being 
achieved. This is not the case, however, with other engi¬ 
neers. It is they who are in a position to reduce the number 
of failures. They too should use reliability techniques. But 
it would be disastrous if they were to take the existing level 
of reliability as unalterable. 

7.2.3 Reliability and other probabilistic methods 

Loss prevention makes use of a wide range of probabilistic 
methods. A large proportion of these are reliability tech¬ 
niques as conventionally defined, but in addition, use is 


made of other probabilities. In particular, there is con¬ 
siderable emphasis in loss prevention on the assessment of 
the consequences of failures, taking into account factors 
such as numbers of people exposed, weather conditions, etc. 

7.2.4 Reliability and quality control 

There is a close link between reliability and quality control 
of equipment. But the two are not identical and the dis¬ 
tinction between them is important. An equipment is likely 
to be unreliable unless there is good quality control over its 
manufacture. In general, quality control is a necessary 
condition for reliability. It is not, however, a sufficient con¬ 
dition. Deficiencies in specification, design or application 
are also causes of unreliability. A badly designed equip¬ 
ment may be manufactured with good quality control, but it 
will remain unreliable. This aspect is discussed in more 
detail by F. Nixon (1971). 

7.2.5 Reliability standards 

The principal British Standards dealing with reliability are 
BS 4778:1979 Quality Vocabulary, for terminology, and BS 
5760:1981 Reliability of Systems, Equipment and Compo¬ 
nents. BS 4200:1967 Guide on the Reliability of Electronic 
Equipment and Parts Used Therein, which dealt both with 
terminology and other matters, is now withdrawn. 

The constituent parts of BS 5760 are Part 0:1986 Intro¬ 
ductory Guide to Reliability, Part 1:1985 Guide to Reliability 
and Maintainability Programme Management, Part 2:1981 
Guide to the Assessment of Reliability, Part 3:1982 Guide to 
Reliability Practices: Examples, Part 4:1986 Guide to Speci¬ 
fication Clauses Relating to the Achievement and Devel¬ 
opment of Reliability in New and Existing Items, Part 5:1991 
Guide to Failure Modes, Effects and Criticality Analysis 
(FMEA and FMECA), Part 6:1991 Guide to Programmes for 
Reliability Growth, Part 7:1991 Guide to Fault Tree Analysis, 
Part 9: 1991 Guide to the Block Diagram Technique, and 
Part 10:1993 Guide to Reliability Testing. 

Another widely quoted set of standards is the US Armed 
Services MIL standards, and handbooks. Terminology is 
given in MIL-STD-721B and MIL-STD-781B. Standards 
dealing with reliability include MIL-STD-756 Reliability 
Prediction, MIL-STD-781A Reliability Tests: Exponential 
Distribution, MIL-STD-7810 Reliability Design Qualifica¬ 
tion and Production Acceptance Tests, MIL-STD-785 
Requirements for Reliability Program, and MIL-STD-1635 
Reliability GrowthTheory, and handbooks MIL-HDBK-189 
Reliability Growth Management and MIL-HDBK-217 Reli¬ 
ability Prediction of Electronic Equipment. Maintainabil¬ 
ity is covered in MIL-STD-470 Maintainability Program 
Requirements, MIL-STD-471 Maintainability Demonstra¬ 
tion and MIL-HDBK- 472 Maintainability Prediction. 

7.3 Definition of Reliability 

Definitions of reliability are given in various British Stand¬ 
ards dealing with terminology on quality and reliability. 
BS 4778: Part 1:1987 defines reliability as 
The ability of an item to perform a required function 
under stated conditions for a stated period of time. 

This supersedes the definition given in BS 4200: Part 2: 
1974, which has now been withdrawn. Further, essentially 
similar, definitions are given in BS 4778: Section 3.1:1991 
and BS 4778: Section 3.2:1991. BS 4778: Section 3.1:1991 
states that in definitions relating to reliability, the word 
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‘time’ may be replaced by ‘distance’, ‘cycles’, or other 
quantities or units, as appropriate. 

An alternative definition of reliability is: ‘The prob¬ 
ability that an item will perform a required function under 
stated conditions for a stated period of time’. This definition 
brings out several important points about reliability: (1) it 
is a probability, (2) it is a function of time, (3) it is a function 
of defined conditions and (4) it is a function of the definition 
of failure. 

Some definitions of failure are: (1) failure in operation, 
(2) failure to operate on demand, (3) operation before 
demand and (4) operation after demand to cease.The first of 
these definitions is applicable to an equipment which 
operates continuously, while the other definitions are 
applicable to one which operates on demand. 


7.4 Meanings of Probability 

It may appear intuitively obvious what is meant by prob¬ 
ability, but the word, in fact, has several meanings. More¬ 
over, the distinctions are of some practical importance. 
They are relevant, for example, to the question of the rela¬ 
tive weight that should be attached to field data and to other 
information available to individuals. 


7.4.1 Equal likelihood 

One definition of probability derives from the principle of 
equal likelihood. If a situation has n equally likely and 
mutually exclusive outcomes, and if nA of these outcomes 
are event A, then the probability P ( A ) of event A is: 

m =^ [7.4.i] 

This probability can be calculated a priori and without 
doing experiments. 

The example usually given is the throw of an unbiased 
die, which has six equally likely outcomes: the probability 
of throwing a one is 1/6. Another example is the withdrawal 
of a ball from a bag containing four white balls and two red 
ones: the probability of withdrawing a red one is 1/3. The 
principle of equal likelihood applies to the second case also, 
because, although the likelihood of withdrawing a red ball 
and a white one are unequal, the likelihood of withdrawing 
any individual ball is equal. 

This definition of probability is often of limited useful¬ 
ness in engineering because of the difficulty of defining 
situations with equally likely and mutually exclusive out¬ 
comes. 


7.4.2 Relative frequency 

The second definition of probability is based on the concept 
of relative frequency. If an experiment is performed n times 
and if the event A occurs on nA of these occasions, then the 
probability P(A) of event A is: 

P(A)=hm^ [7.4.2] 

This probability can only be determined by experiment. 
This definition of reliability is the one that is most widely 
used in engineering. In particular, it is this definition 
that is implied in the estimation of probability from field 
failure data. 


7.4.3 Personal probability 

A third definition of probability is degree of belief. It is the 
numerical measure of the belief which a person has that the 
event will occur. Often this corresponds to the relative fre¬ 
quency of the event. But this is not always so, for several 
reasons. One is that the relative frequency data available to 
the individual may be limited or nonexistent. Another is 
that even if he has such data, he may have other information 
which causes him to think that the data are not the whole 
truth. There are many possible reasons for this. The indi¬ 
vidual may doubt the applicability of the data to the case 
under consideration, or he may have information which 
suggests that the situation has changed since these data 
were collected. 

It is entirely legitimate to take into account such personal 
probabilities: 

Personal probability was cast into disrespect during the 
nineteenth century when science was believed to be 
absolute truth, because, with this definition the results 
will depend upon the person solving the problem. How¬ 
ever, this objection to subjectivity has recently been 
countered quite effectively by Savage, Janes and other 
physical scientists. (Breipohl, 1970, p. 6) 

There are several branches of probability theory which 
attempt to accommodate personal probability. These 
include ranking techniques (e.g., Siegel, 1956), which give 
the numerical encoding of judgements on the probability of 
ranking of items, and Bayesian methods (e.g., Breipohl, 
1970), which allow probabilities to be modified in the light 
of additional information. 

Further discussions of personal probability are given by 
Savage (1962) and by Tribus (1969). 


7.5 Some Probability Relationships 

It is appropriate to give, at this point, a brief treatment of 
some basic probability relationships. These are important 
in the present context not only because they are the basis of 
reliability expressions, but also because they are needed 
for work in areas such as fault trees. 

7.5.1 Sets and Boolean algebra 

Some set theory definitions, operations and laws are given 
in Table 7.2 and some of these are illustrated by the Venn 
diagrams given in Figure 7.1. 

The union and intersection of sets may be written, 
respectively, in the notation 


C = A\jB [7.5.1] 

C = AnB [7.5.2] 

or in the notation 

C = A + B [7.5.3] 

and 

C = AB = AB [7.5.4] 


It is mainly the latter notation that is used here. 
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Table 7.2 Some set theory definitions, operations 
and laws 


Definitions: 

Null set 0 0 is a set with no elements 

Sample space set S S is the set containing all 

the elements in the sample 
space 


Attention is drawn in particular to the distributive and 
absorption laws, which differ somewhat from their appar¬ 
ent analogues in normal algebra. Set theory and Boolean 
algebra are described in standard texts (e.g., Reza, 1961; 
Shooman, 1968a; Breipohl, 1970). Probability and set 
theory are closely related, because the outcomes of a situa¬ 
tion constitute, in effect, a set. 


Subsets 

AcB 

BdA 

ACB 


Equality 
A = B 


Operations: 
Union of sets 
C=1UB 
also writen 
C=A+B 


a is an element of A 

A is a subset of B 
B contains A 
A is a subset of B or 
is equal to B 


A has the same 
elements as B 
A has no elements 


7.5.2 Probability of unions 

The probability of an event X which occurs if any of the 
events A,- occur and is thus the union of those events is: 

P(X)=p(jjA,j [7.5.5] 

If there are two events: 

P(X) = P(Ai) + P(A 2 ) - P(AiA 2 ) [7.5.6] 

If there are three events: 


C contains all the elements of P ( X ) = P(Ai) + P(A 2 ) + P(A 3 ) - P(AiA 2 ) 

- P(AiA 3 ) - P(A 2 A 3 ) + P(A]A 2 A 3 ) [7.5.7J: 


Intersection of sets 
C=AnP 
also written 
C=AB or A B 
C=A andP 
Disjoint sets (mutually 
exclusive sets) 
C=AnP=0 
Difference of sets 
C=A—B 
Complement of a set 
A'=S —A 


C contains only the elements 
common to A and B 


C contains all the elements 
of A which are not 
elements of B 

A' contains all the elements 
of S which are not 
elements of A 


If there are n events: 

P(X) = P(Aj) +P(A 2 ) + ■.. + P(A m ) - P(AiA 2 ) - P(A x A 3 ) 

- P(A„-\A n ) +P(A 1 A 2 A 3 ) +P(A 1 A 2 A i ) 

+ ■ ■ • +P(A„. 2 A„. 1 A n ) ■ ■ • (— 1)” _1 P(AiA 2 ■ ■ - A.) 

[7.5.8] 

If the events are mutually exclusive, Equation 7.5.5 
simplifies to: 

P(X) = £P(A,-) [7.5.9] 


Commutative laws 
A+B=P+A 
AB=BA 
Associative laws 
(A+B) + C 
=A + (B + Q 
=A+B+C 
(AB)C = A(BQ = ABC 
Distributive laws 
A(B + C)=AB+AC 
A -T BC = (A B)(A C) 
Absorption laws 
A + A=A 
AA=A 

Dualization (de Morgan’s) 
laws 

(A+B)'=A'B' 
(AB)'=A' + B' 


a Use may also be made of the notation A to signify ‘not A.’ 


In general: 

p(jjA,) <p£p(A,) 


[7.5.10] 


For events not mutually exclusive but of low probability the 
error in using Equation 7.5.9 instead of Equation 7.5.5 is 
small. Equation 7.5.9 is sometimes called the low prob¬ 
ability, or rare event, approximation. The estimate of prob¬ 
ability given by Equation 7.5.9 errs on the high side and 
hence is conservative in calculating failure probabilities, 
but is not conservative in calculating success probabilities 
or reliabilities. 


7.5.3 Joint and marginal probability 

So far the events considered are the outcomes of a single 
experiment. Consideration is now given to events which are 
the outcome of several subexperiments. 
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Figure 7.1 Some set theory definitions, operations and laws: (a) union of sets, A + B: (b) intersection of sets, AB; 
(c) disjoint sets; (d) difference of sets, A - B; (e) complement of a set; (f) distributive law, A(B+ C)=AB+AC; 

(g) distributive law, (A + B)(A + C)=A + BC; (h) dualization law (A+B) = A'B’; (i) dualization law (AB)' = A’ + B' 


The probability of an event X which occurs only if all the 
n events A it occur and is thus the intersection of these 
events is: 

P(X) = P(A X ■A n )=P (f) A, j [7.5.11] 

P(A 1 ■ ■ ■ A„) is the joint probability of the event. 

The probability of an event X which occurs if any of the 
mutually exclusive and exhaustive n events A, in one sub¬ 
experiment occurs and the event B in a second subexperi¬ 
ment occurs is: 

P(X) = P^j4-sj [7.5.12] 

[7.5.13] 


7.5.4 Conditional probability 

The probability of an event X which occurs if the event A 
occurs in one subexperiment and the event B occurs in a 
second subexperiment where the event A depends on the 
event 5 is: 

P(X) = P(AB) = P(A | B)P(B) j7.5.15] 

P(A | B) is the conditional probability of A, given B. 

The probability obtained in Equation 7.5.15 is a joint 
probability. Marginal probabilities may also be obtained 
from conditional probabilities: 

P(X) = P(B ) = P(B | Ai)P(Ai) |7.5.16] 

7.5.5 Independence and conditional independence 

If events A and B are independent: 

P(AB) = P(A | B)P(B) = P(A)P(B) |7.5.1if 


= P(B) 


[7.5.14] which is equivalent to 


event. P(A\B)=P(A) 


P(B ) is the marginal probability of the i 


[ 7 . 5 . 18 ] 
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The probability of an event X, which occurs only if all n Then . integration of Equation 7.6.2 the reliability R(t) is 
events Ai occur is given by Equation 7.5.11. If all n events t 

are independent: R(t) = expf-J z(t) Atj = exp[-H(t)] [7.6.4] 


P(X) = P(A j • • • A.) = fj P{Ai) 17.5.19] 

Two events A and B are conditionally dependent if their 
relationship with a third event C is: 

P(AB | C) = P(A | C)P(B | C) {7.5.20] 


R(t) is also called the ‘reliability function’. 


7.6.2 Failure density and failure distribution functions 

The overall failure rate, or failure rate expressed ; 
function of the original number of equipments,//) is: 


^ m) 

n> n dl d t 


[7-6.5] 


Conditional independence does not imply independence. 


7.5.6 Bayes’ theorem 

The relationship given in Equation 7.5.15 is a form of Bayes’ 
theorem. This theorem is extremely important in prob¬ 
ability work. It appears in various forms, some of which are: 

P{AB) = P(A | B)P(B) = P(B | A)P{A) {7.5.21] 


p{A\B)m 


P(AB) 

pm' 


P(B | A)P{A) 


[7.5.22] 


On rewriting the denominator as a marginal probability, 
and A as A k 


P(A k | B) = 


P(B\A k )P(A k ) 

TliP(.B\Ai)P(Ai) 


[7.5.23] 


where P(A k \ B ) is the posterior probability, P(B \ A k ) is the 
likelihood, and P(A k ) is the prior probability. 

Further treatment of Bayes’ theorem is given in 
Section 7.14. 


7.6 Some Reliability Relationships 

7.6.1 Reliability function and hazard rate 

If n equipments operate without replacement, then after 
time t the numbers which have survived and failed are n s (t) 
and n f (t), respectively, and the probability of survival, or 
reliability, R(t) is: 

R(t)=l-'3M [7.6.1] 

The instantaneous failure rate, or failure rate expressed as 
a function of the number of equipments surviving, z(t) is: 


z(t) = 


< %(/) 

n - h, At 


JL d r(t) d[lnf?(/)] 

R(t )' df df 


[7.6.2] 


//) is also called the ‘failure density function’. 

The complement of the reliability, or the unreliability, 
Q(t) is: 

Q(f) = l-7?(f) [7.6.6] 

Q(f) is also called the ‘failure distribution function’ and is 
then commonly written as F\t). 

The failure density function and failure distribution 
function are often referred to, respectively, as the ‘failure 
density’ or the ‘density function’ and the ‘failure distribu¬ 
tion’, the ‘distribution function’ or the ‘cumulative distribu¬ 
tion function’. 


7.6.3 Relationships between basic functions 

The following relationships can readily be derived from 
Equations 7.6.1-7.6.6 and are particularly useful: 


m m 
i-o(o i-^co 

[7.6.7a: 

[7.6.7b; 

m=j°°f(t)dt 

[7.6.8] 

Q(t)=F(t) = J f{t) At 

[7.6.9] 

7.6.4 Exponential distribution 

An important special case is that i: 
z(f) is constant: 

n which the hazard rate 

z(t)=X 

[7.6.10] 

Then, 


R(t) = exp (-Xt) 
f(t) = 2exp(—2f) 

Q(t) = 1 - exp (-Xt) 

■-e-irr 

[7.6.12; 

[7.6.13] 


These four quantities are shown in Figure 7.2. 

In Figure 7.2, the vertical axes for the reliability R(t) and 
the unreliability Q{t) have the range 0 to 1, but those for the 
hazard rate z(t) and the failure density function /(f) are 
proportional to X. At low values of It 


z(t) is also called the ‘hazard rate’, or just the ‘failure rate’. 
The cumulative hazard function H(t) is: 


H{t) = j\{t) At 


[7.6.3] 


R(t) =1-2f Xt < 1 |7.6.14] 

Q(t) =Xt Xt < 1 [7.6.15] 

Equation 7.6.14 is useful in obtaining accuracy in numerical 
computation of high values of the reliability R{t). Equation 
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Figure 7.2 The exponential distribution: (a) hazard-rate; (b) failure density; (c) reliability; (d) unreliability 


7.6.15 is useful in making simple computations of the 
unreliability Q(f). This latter point is further discussed 
below. 

The assumption of constant hazard rate is that normally 
made in the absence of other information. This is therefore a 
special case of particular importance. 

The failure distribution with constant hazard rate is 
called the ‘exponential distribution’ or, more accurately but 
less commonly, the ‘negative exponential distribution’. It is 
also referred to as the ‘random failure distribution’, 
although in most cases it is a moot point whether the fail¬ 
ures are appropriately called random. 

7.6.5 Probability and event rate 

The relationship between unreliability and hazard rate 
represented by Equation 7.6.13, or more generally the rela¬ 
tionship between the probability P(t) and the event rate f 

P(f) = l-exp(-Cf) [7.6.16] 

is an important one. It is frequently necessary in reliability 
work to calculate a probability from a rate, or vice versa, 
and it is this equation which then applies. 

7.6.6 Unreliability and failure rate 

There is sometimes confusion between unreliability Q(f) 
and failure rate X. This confusion arises because, given cer¬ 
tain assumptions, the two are numerically identical. This 
occurs if in Equation 7.6.15 time t is equal to unity.Then, 

Q(t)=X A <1 [7.6.17] 

Thus, for example, if a device has a failure rate A = 0.01 
faults/year, then the unreliability over a year is also 
numerically 0.01. Error occurs, however, if Equation 7.6.15 
is used outside its range of applicability. 

7.6.7 Bathtub curve 

In general, the failure behaviour of an equipment exhibits 
three stages: initially during commissioning the rate is 
high, then it declines during normal operation, and finally 
it rises again as deterioration sets in. For many equipments, 
particularly electronic equipments, the rate has been found 
to form a bathtub curve, as shown in Figure 7.3(a) (e.g., 
Carhart, 1953). This curve has three regimes: (1) early fail¬ 
ure, (2) constant failure and (3) wear-out failure. 

Early failure, or infant mortality, is usually due to such 
factors as defective equipment, incorrect installation, etc. 
It also tends to reflect the learning curve of the equipment 
user. Constant failure, or so-called ‘random failure’, is often 
caused by random fluctuations of load which exceed the 
design strength of the equipment. A constant failure 



Figure 7.3 The bathtub curve: (a) hazard rate; (b) failure 
density 


characteristic is also shown by an equipment which has a 
number of components that individually exhibit different 
failure distributions. Wear-out failure is self-explanatory. 
The corresponding curve for the failure density function is 
shown in Figure 7.3(b). The bathtub curve is widely quoted 
in the reliability literature, but it should be emphasized that 
its applicability to all types of equipment, particularly 
mechanical equipment, is not established. There are, in 
fact, good theoretical reasons for treating it with reserve 
(A.D.S. Carter, 1973). This aspect is considered in more 
detail below. 

It is often said that human mortality follows a bathtub 
curve. This implies that there are higher death rates in 
infancy and old age with a lower, nearly constant, death rate 
in between. However, Aird (1978) has shown that for 
humans the infant mortality period is followed immedi¬ 
ately by the onset of the wear-out period, so that there is 
effectively no constant failure period. 


7.6.8 Mean life 

The mean life m is defined as the first moment of the failure 
density function 
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”=f' /d ' 

[7.6.18] 

Alternatively, from Equations 7.6.5 and 7.6.18 



jF.6.19a] 

= -m?+j°° R M 

[7.6.19b] 

Since 


W = 0 


provided that 


Hm ( tR) =0 


then 


"-r** 

[7.6.20] 

Alternatively, use may be made of the relationships 
between the moments ft and the Laplace transform g(s) of a 
functiong(f): 

£W)l = g( s ) = J 8(t) exp (-st) d t 

[7.6.21] 

Hence: 


= (-1)’ J o ?g(t) exp (-st) d t 

[7.6.22] 

and 



17.6.23a 


17.6.23b 

Applying these relationships to the present ca 
stituting dR/dt forg(t) in Equation 7.6.23a, 

ise by sub- 

-(♦V™) -«u 

17.6.24] 

For the exponential distribution 


m =s . jf tX exp( —Xt) d t 

[7.6.25a] 

1 

[7.6.25b] 


Other terms used in addition to ‘mean life’ are the mean time 
between failures (MTBF), the mean time to failure (MTTF) 
and the mean time to first failure (MTTFF). These times are 
sometimes used interchangeably, but they are not identical. 

The most widely used is probably MTBF. MTBF has 
meaning only when applied to a population of components, 
equipments or systems in which there is repair. It is the 
total operating time of the items divided by the total num¬ 
ber of failures. It is also the mean of the failure distribution, 
regardless of its form. 


MTTF is applied to items without repair and is the mean 
of the distribution of times to failure. MTTFF is applied to 
items with repair and is the mean of the distribution of 
times to first failure. 

MTTF and MTTFF are applied particularly to systems. 
For an ^-component parallel system with an exponential 
failure distribution of the individual components and 
without repair, 

MTTF=^i {7.6.26] 

and for an n- component parallel system with repair 

MTTFF = ~ ]P |7.6.27] 

where X is the failure rate of equipment, and is the repair 
rate of equipment Repair rates are discussed in Section 7.10. 
If the repair rate n is zero, Equation 7.6.27 reduces to 
Equation 7.6.26. 

Formal definitions of MTBF and MTTF are given in BS 
4200: Part 2:1967. For repairable systems use is also made 
of mean time to repair (MTTR). A more detailed discussion 
of these quantities is given by Myers et al. (1964). 

7.6.9 Expected value 

Use is frequently made in reliability engineering of the 
concept of the expected value. The expected value of a dis¬ 
tribution is its mean value. The use of the expected value 
concept allows convenient manipulation, as the following 
treatment demonstrates. (A treatment of expected value is 
given by Breipohl (1970)). For a variable t, the expected 
value, or mean value, is: 


m = E[t) 

[7.6.28] 

The variance is: 


<r*=-;i|[f-m) 2 ] 

[7.6.29] 

The variance may then be expressed ii 
alternative forms: 

n the following 

a 2 =E[1 2 -2mt + m 2 \ 

[7.6.30] 

^E[i 2 ]-2mE[t] + m 2 

[7.6.31] 

= E[f] -2m 2 + m 2 

[7.6.32] 

= E[I?] — m 2 

[7.6.33] 

= E[f]-E[tf 

[7.6.34] 


7.7 Failure Distributions 

There are several statistical distributions which are fun¬ 
damental in work on reliability. Important discrete dis¬ 
tributions are: 

(1) binomial distribution; 

(2) multinomial distribution; 

(3) Poisson distribution. 

Important continuous distributions are: 

(1) exponential distribution; 

(2) normal distribution; 
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(3) log-normal distribution; 

(4) Weibull distribution; 

(5) rectangular distribution; 

(6) gamma distribution; 

(7) Pareto distribution; 

(8) extreme value distribution. 

Some properties of these distributions are given inTable 7.3 
and in Figures 7.4 and 7.5. 

The distributions are best regarded as statistical 
distributions and the independent variable t as a general¬ 
ized variable, although in the present context the primary 
interest in many of these distributions is as failure 
distributions, with time as the independent variable. 
The distribution function is given as Erather than Q, but 
the two are identical. 

Accounts of the properties of statistical distributions are 
given in most texts on reliability engineering and in the 
Center for Chemical Process Safety (CCPS) QRA Guide¬ 
lines (1989/5). Additional treatments for particular dis¬ 
tributions are mentioned below. A rather comprehensive 
summary of the principal distributions is given by 
Hastings and Peacock (1974). 

7.7.1 Binomial distribution 

The binomial distribution is applicable to situations where 
a series of discrete trials is conducted and each trial can 
have two outcomes. In reliability work these outcomes 
are usually success and failure. If the probabilities of 
success and failure are p and q, respectively, and if there 
are n trials, then: 

(^ +] [7.7.1] 


CD-i^isi I” 2 ' 

The rth term in the expansion in Equation 7.7.1 is the 
probability P(r) of r events: 

P(r) = W“' [7.7.3] 

P(r) is the probability density. 

A useful expression is the probability P (0 < k < r) of r or 
less than r events: 


[7.7.4] 


m <k<r) is the probability distribution. 

Another useful expression is the probability P(r<k<n) 
of r or more than r events: 

P{r<k<n)= E [7-7.5] 

The coefficients in the expansion in Equation 7.7.3, or 
terms of (”), may be obtained from Pascal’s triangle 


0 0 1 

1 0,1 11 

2 0,1,2 12 1 

3 0,1,2,3 1 3 3 1 

4 0,1, 2,3,4 1 4 6 4 1 


A number in the triangle is obtained by summing the two 
numbers directly above it to the left and the right. 

The mean of the binomial distribution is np and the 
variance is npq. The binomial distribution approximates to 
the normal distribution for large values of n and does so 
most rapidly for p = q = 0.5. The approximation holds for 
p< 0.5 and np > 5 or for p> 0.5 and nq > 5. In terms of n and 
p the mean and variance of the normal distribution are np 
and np(l—p), respectively. The binomial distribution 
approximates to the Poisson distribution for p < 0.05 and 
n > 20. In terms of n and p, the mean of the Poisson dis¬ 
tribution is np. 

7.7.2 Multinomial distribution 

The multinomial distribution is applicable to situations 
where a series of trials is conducted and each trial can have 
more than two outcomes. If the total number of trials is n, 
the number of outcomes is k, the probabilities of the out¬ 
comes are p it and the number of times each outcome occurs 
is then: 

/(»l, »2, • • •, «i) = »! n^j [7.7.6] 

/(«i, n 2 ,..., n k ) is the probability density. 

7.7.3 Poisson distribution 

The Poisson distribution is applicable to situations where 
an event can occur at any point in time. If the mean number 
of events over a time period is n so that in terms of the 
binomial distribution n = np, then: 

exp( -m) exp(/i) = exp( -/i) ^ ^ [7.7.7a] 

= exp( ~n) + F + + -^ 

[7.7.7b] 

bb 1 [7.7.7c; 

The rth term in the expansion in Equation 7.7.7 is the 
probability P(r) of r events: 

P(r)=ex p(-n)£ [7.7.8] 

P(r) is the probability density. 

A useful expression is the probability P (0 < k < r) of r or 
less than r events: 

P(Q<k<r)=exp(-„)'£~ [7.7.9] 

P (0 < k < r) is the probability distribution. 




Table 7.3 Some properties of failure distributions 


Distribution 

Failure density 
function f(t) 

Mean 

™ = JZ ft*)# 

Median 
= t where 
jt ao f(r)dr = 0.5 

Mode 
= t where 

Finance 

° a =n,( # -») 2 /(o * 

Exponential 

A exp (—At) 

1 

I 

I 1 * 2 

0 

1 

F 

Normal 


- 

- 

- 


Log-normal 

‘I- '] 


exp(m*) 

exp(w* - a 2 ) 

exp(2w* + < r 2 )[exp(ff 2 ) - 1] 

Welbull (two- 
parameter) 

pfty- 1 r (ty l 

An) exp [-yj 

4 + ?) 

n( ln2) W 

( l\ 1/IS 

I 1 -. , v8>l 

(A pJ p< i 


Rectangular 

1 

b 

b 

a + 2 

b 

a + 2 

- 

b 2 

12 

Gamma 

bT(a) (b) exp (~b) 

ba 


b{a- 1), a> 1 

Va 

Pareto 

at-W 

a^l’ a>1 

2V« 

0 


Extreme value 

^ exp (^) eXP [“ eXP (y £ )] 

a + bT'(l) b 

a+ Mnln2 

- 

iV 

6 


a No simple expression is available. 

b r'(l) = - 0.57721 is the first derivative of the gamma function. 
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Figure 7.4 Some failure distributions -1: (a) exponential distinction; (b) normal distribution; (c) log-normal 
distribution; (d) Weibull distribution 


The relationship between the binomial and Poisson dis¬ 
tributions may be seen by noting that the relation between 
the mean event rates for the distributions is: 

p = np [7.7.10] 

and writing the binomial distribution in the form: 

■ ©*• ( 1 -3” "=E| ex P(-^) [7-7.11] 

A derivation of the Poisson distribution from Markov 
models is given below. 


7.7.4 Exponential distribution 

For the exponential distribution, the characteristics hazard 
rate z, failure density /, reliability R and failure distribu¬ 
tion F have been derived above, and are: 


S {7.7.12] 

/ ;.exp(-;j) J7.7.13] 

7f = exp(-Af) {7.7.14] 

F »1 — exp(~/i) {7.7.15] 


for the range 0 < t < 00 . These quantities are shown in Fig¬ 
ure 7.4(a). The distribution is characterized by a single 
parameter, the hazard rate X. 
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Figure 7.5 Some failure distributions-2: (a) rectangular distribution; (b) gamma distribution; (c) Pareto distribution; 
(d) extreme value distribution 


The exponential distribution, which has a constant 
hazard rate, is the distribution usually applied to data in the 
absence of other information and is the most widely used in 
reliability work. 

7.7.5 Normal distribution 

For the normal distribution the characteristics are: 
exp[-(f - m) 2 /2<7 2 1 

2 =- k --—J7.7.16] 

exp |-(t — m) 2 /2c 2 J df 


1 

expLrf] 

[7.7.17JI 

cr{2n) l/2 ' 

6XP [ 2(7 2 J 

’*(2s f* 


J7.7.18] 


for the range -oo < t < oc. These quantities are shown in 
Figure 7.4(b). 

The failure density / is the quantity most commonly 
used to define the normal distribution. It may be noted that 
Equations 7.7.16 and 7.7.18 describing the other quantities 
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are readily derived from Equations 7.6.7a and 7.6.8, respec¬ 
tively. 

The distribution has two parameters, the mean m and 
the standard deviation a. It is the natural distribution 
which is used to characterize data that lie about a mean 
value and deviate from it by absolute amounts. The normal 
distribution is widely used in reliability engineering, par¬ 
ticularly to fit certain types of failure such as those due to 
wear out and to fit repair times. 

7.7.6 Log-normal distribution 


By suitable choice of the shape factor /J the Weibull 
distribution may be made to equal or approximate other 
distributions: 


l/fexp{-[ln(f) - w*] z /2o- 2 } 

[7.7.19] 

has the characteristics: 


exp{-[ln(f) — *8*} z /2t7 2 } df 

B o , 


f -«(2 „)■«“»{-' ‘I* '} 

[7.7.20] 


[7.7.26] 

[7.7.27] 

'}* 

[7.7.21] 


[7.7.28] 

for the range 0 < t < oo. These quantities are 
Figure 7.4(c). 

shown in 

This is related to the previous form by: 


The distribution has two parameters, m* and 

a. It is the 


[7.7.29] 

natural distribution to use when deviations from the model 

a = ry 


value are by factors, proportions or percentages rather 
than by absolute values as in the normal distribution. 

The log-normal distribution has a number of uses in 
reliability work. It is used to fit certain types of failure such 
as fatigue failures and to fit repair times. It is also used to 
describe the range of possible hazard rates of equipment 
where there is uncertainty about these. In this case the 
independent variable is the hazard rate z (=A for the expo¬ 
nential distribution) rather than time: 

fM =_1_ 


7? = CXP ( W+ 1 


[7.7.23] 

[7.7.24] 

[7.7.25] 


K^)i 

*-“ p H i r)’] 

for the range y<t<oc. These quantities are shown in 
Figure 7.4(d) for values of the parameter /? = 0.5,1.0 and 3.0. 

The distribution given is the three-parameter one with 
the characteristic life»/, the shape factor /? and the location 
parameter y. If the latter is set to zero, the two-parameter 
distribution is obtained. 

The significance of the shape factor fS is: 


A third from (Shooman, 1968a) has the characteristics: 
z=kr [7.7.30] 

/ = kr exp [7.7.31] 

~ kr+1 ) [7-7.32] 

This is related to the first form given by: 

[7.7.33] 

m = P - 1 [7.7.34] 

The Weibull distribution is frequently used in reliability 
work to fit failure data, because it is flexible enough to 
handle decreasing, constant and increasing failure rates. 
This use of the Weibull distribution is considered in more 
detail below. 

The properties of theWeibull distribution are described in 
the original paper by Weibull (1951) and in standard 
texts (e.g., Bompas-Smith, 1973; Kapur and Lamberson, 
1977). 


/?<! 

J>1 


hazard rate decreasing; 
hazard rate constant; 
hazard rate increasing. 


*=« + Z,-l I 7 ' 7 ' 351 

f = \ [7.7.36; 

R= a+b-t |7.7. 3 S1 

for the range a<t<a + b. These quantities are shown in 
Figure 7.5(a). 

The distribution is also called the ‘uniform distribution’ 
and has two parameters, the location parameter a and the 
scaling factor b. 
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The rectangular distribution is used in reliability work 
mainly to give random variables a uniform distribu¬ 
tion across a specified interval. It is used, for example, in 
Monte Carlo simulation work. Computers generate pseudo¬ 
random numbers with a rectangular distribution. Random 
numbers with other distributions can be obtained from 
these, using the inverse cumulative distribution, where 
available, and other techniques. 


7.7.11 Pareto distribution 

For the Pareto distribution the characteristics are: 

z=- t [7.7.47] 

/ = ar' a+1 > [7.7.48] 

R = r° §7.7.49] 


7.7.9 Gamma distribution 

For the gamma distribution the characteristics are: 


t“ 1 exp(-f/6) 
ft° t"- 1 exp(— t/b) df 

[7.7.38] 


[7.7.39] 


[7.7.40] 

for the range 0 < t < oo, with 


r(«) = J f a-1 exp(-f)df 

[7.7.41] 

or, if a is an integer, 



for the range l<f<oo. These quantities are shown in 
Figure 7.5(c). The distribution has a single parameter, the 
shape factor a. 

The Pareto distribution is commonly used in reliability 
work in discrete form to describe the distribution of the 
numbers of failures in different modes. In this case the 
independent variable is the failure mode. 


7.7.12 Extreme value distribution 

For the extreme value distribution the characteristics are: 


z= l exp (!ir) 

[7.7.50] 

/s ^ exp (^) exp h xp (^)] 

[7.7.51] 

R = exp[-exp|^r—jl 

[7.7.52] 


r(«) = (a-1)1 §7.7.42] 

The quantities given in Equations 7.7.38—7.7.40 are shown 
in Figure 7.5(b) for values of the parameter a = 0.5 and 2.0. 

The distribution has two parameters, the shape factor a 
and the scaling factor b. 

The gamma distribution is another distribution used in 
reliability work to fit failure data, because it is sufficiently 
flexible to deal with decreasing, constant and increasing 
failure rates, but the Weibull distribution is more gener¬ 
ally used. 

7.7.10 Beta distribution 

Use is also sometimes made in reliability engineering of the 
beta distribution. The properties of the beta distribution 
are given by Hastings and Peacock (1974). Its character- 


1 B{v, w) 

x"-\l - xf- 1 
B(v, w) 


dx 


[7.7.43] 

[7.7.44] 


for the range -oo < f < oc. These quantities are shown in 
Figure 7.5(d). 

Equations 7.7.50-7.7.52 are for the distribution of the 
smallest extreme. For the distribution of the largest 
extreme the sign of t should be reversed. 

The distribution has two parameters, the location para¬ 
meter a and the scaling factor b. 

The extreme value distribution is used in reliability 
work to investigate extreme, and therefore very rare, values 
of phenomena. 


7.7.13 Hyperexponential distribution 

Another distribution which is sometimes used in reliability 
engineering is the hyperexponential distribution. This is 
described by Jardine (1970). Its characteristics are 


2X{a 2 + (1 - a 2 ) exp[—2(1 - 2a)U}} 

* <r + (1 — <r) exp[—2(1 — 2o)Xt\ 
fm 2cr 2 Aexp[-2o-J.f] 

+ 2A(1 - (T 2 ) exp[-2(l - a)lt] 

F = 1 — a exp[-2o It] + (1 — a) exp[-2(l 


[7.7.53] 

[7.7.54] 
■ a)U] [7.7.55] 


B(v, w ) m i tT\ 1 - _1 d u J7.7.45] 


for t> 0 and 0<c<0.5. The distribution has two para¬ 
meters, X and cr, the former being the mean arrival rate of 
failures. 

The hyperexponential distribution is suitable for the case 
where the times to failure are either very short or very long. 


for the range 0 > x > 1. The distribution has two para¬ 
meters, v (>0) and w (>0).The beta function is related to the 
gamma function: 

T(v)x(w) = B(v, w)Y(v + w) |7.7.46] 

for positive values of v and w. 


7.7.14 Error function 

A mathematical function which occurs both in some of the 
distributions described and also in other topics treated 
here is the error function. Accounts of the error function 
are given in standard mathematical texts (e.g., Jensen and 
Jeffreys, 1963; Paradine and Rivett, 1980). 
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The error function erf is defined as: 

erf M exp( ““ Z ) d “ I 7 ' 7 ' 56 ] 

The term (2/n 1/2 ) is a normalizing factor such as to yield 
erf(x) -1 [7.7.57] 

The error function complement erfc is defined as 
erfc(.r) 1 — erf(jc) [7.7.58] 

erfc ( x )=^2 J x exp(-« 2 )d« [7.7.59] 

The integral which constitutes the error function is similar 
in form to those which occur in the distribution function of 
the normal distribution and in the log-normal distribu¬ 
tion, as comparison of Equation 7.7.56 with Equations 7.7.18 
and 7.7.21 shows. A similar integral also occurs in the 
definition of the probit ^described in Chapter 9. 

Furthermore, in passive gas dispersion, the gas con¬ 
centrations follow a normal, or Gaussian, distribution so that 
the models used for such dispersion are often referred to as 
‘Gaussianmodels’.Thesemodelsaredescribed in Chapter 15. 

7.7.15 Error function approximations 

The error function may be looked up in the tables given 
in standard texts on statistics, but it is convenient for 
computation to have it in analytical function form. A 
review of approximations of the error function has been 
given by Karlsson and Bjerle (1980). Two desirable proper¬ 
ties of an expression for the error function are that it should 
represent the function with acceptable accuracy and should 
he capable of being inverted. 

Karlsson and Bjerle give the following approximate 
expression of their own for the error function: 

erf(*) = «~sin[sin(#)] 0 < x < 1 [7.7.60a] 

•sin(^ 3 ) 1 < x < 2 [7.7.60b] 

St! 2 < * < 00 [7.7.60c; 

They also give the following approximation for the error 
function inverse 


For a series system the reliability R is the product of the 


reliabilities 7?,- of the components: 

/? = R, [7.8.1] 

This follows directly from Equation 7.5.19. 

For the exponential distribution, if the failure rates of the 
components are constants A,-, 

Ri = exp {-Xi) [7.8.2] 

and hence 

R = exp( -lit) = exp ^ A,/j [7.8.3] 

If the overall failure rate of the system is a constant X, 

R = exp(-/tf) [7.8.4] 

and hence 

[7.8.5] 

7.8.2 Parallel systems 


A parallel system is one which fails to operate only if all its 
components fail to operate. Again it is not implied that the 
components are necessarily laid out physically in a parallel 
configuration. For a parallel system, the unreliability Q is 
the product of the unreliabilities Q,- of the components: 

Q=f[Q, [7.8.6] 


Again this follows directly from Equation 7.5.19. The reli¬ 
ability R of the system is: 

iNa~nCL-.fi-) [7-8.7] 

Since parallel configurations incorporate redundancy, they 
are also referred to as ‘parallel redundant systems’. For the 
exponential distribution, Equation 7.8.2 applies, and hence: 


erT 1 (y)i| 


= [sin- 1 (y)] 3 / 2 


0<y <0.84 [7.7.61a] 

0.84 <y< 0.995 

[7.7.61b] 


7.8 Reliability of Some Standard Systems 

The reliability of some standard systems is now con¬ 
sidered. It is assumed that the exponential failure dis¬ 
tribution applies, unless otherwise stated. 


r = i -n [ i - ex P( -m 


If the overall failure rate of the system is a constant l, Equa¬ 
tion 7.8.4 is applicable. In this case there is no simple general 
relationship between the system and component failure 
rates. But, if the component failure rates are all the same, 


[7.8.9] 


7.8.1 Series systems 

A series system is one which operates only if all its com¬ 
ponents operate. It is not implied that the components are 
necessarily laid out physically in series configuration. 


If the failure rates are different, then for two components 


1 _ i 1 _ 1 


[7.8.10] 
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for three components 


1 _ 1 1 1 1 1 1 

X X\ X2 as Xi + X2 X\ + X3 X2 + X3 

1 

X\ + X2 4- X3 


[7.8.11] 


1 _ 


Gi + h + + 0 

Gi + ^2 h + ^3 Ki-1 + hn) 


^1 + ^2 + ^3 ^1 + ^2 + A4 

3 


ST 5 


[7.8.12] 


stand by mode, and there is perfect switchover. For this 
case, the Poisson distribution can be used. Thus, for such a 
stand by system, the failure rate is X, the number of failures 
which the system can withstand is r, and the system reli¬ 
ability R is 


R{ 0 <k<r) = exp( -Xt) 


f-t M ' 


[7.8.18a] 


= exp(-Af) 



[7.8.18b] 


As an illustration, consider the reliability of a stand by 
system with one component operating and one on stand by, 
so that the system can survive one failure. Then 

7? = exp(-Af)(l + Af) (7.8.19] 


7.8.3 r-out-of-n parallel systems 

For a system which has n components in parallel and oper¬ 
ates as long as r components survive, the binomial dis¬ 
tribution is applicable. Thus for an rout-of-w system the 
reliability R is obtained from the component reliability R x : 

R(r<k<n) R k x (?- k (7.8.13] 

As an illustration, consider the reliability of a 2-out-of-4 
system. Expanding 

{Rx + Qx) n = 1 (7.8.14] 

for the terms between n and r to get the individual terms of 
Equation 7.8.13 gives 

Probability of 0 failures = R^ 

Probability of 1 failure = 4 R%Q X 
Probability of 2 failures = 6/?f(^ 

The coefficients of the terms maybe obtained from Pascal’s 
triangle. The system survives provided no more than two 
failures occur, and hence 

R = R$ + 4R 3 x Q x + 6R 2 x Q? [7.8.15] 

An r-out-of-w system reduces in the limiting cases to a 
series or a parallel system. If all the components must 
operate for the system to survive, it becomes a series system 

R = R n x (7.8.16] 

whilst if it is sufficient for one component to operate for the 
system to survive, it becomes a parallel system 

Q = Q n x (7.8.17] 

7.8.4 Stand by systems 

The simplest stand by system is one in which there is one 
component operating and one or more on stand by, all 
components have the same failure rate in the operational 
mode, the stand by components have zero failure rate in the 


It is relatively easy in this case to take into account imper¬ 
fect switchover. If the reliability of switchover is i? sw , the 
system reliability!? is: 

R = exp( -Xt) (1 + R sw Xt) {7.8.20] 

Stand by systems may be more complex than this simple 
case in a number of ways. The stand by component may be 
different from the component normally operating and may 
have a different failure rate in the operational mode. It may 
also have a finite failure rate in the stand by mode, and there 
may be imperfect switchover. 


7.8.5 Systems with repair 

If it is possible to carry out repair on a system, a much 
higher reliability can be achieved. The repair time which is 
used here is the total time from initial failure to final repair, 
and therefore includes any time required for detection of 
the failure and organization of the repair. Obviously, the 
determination of the reliability of systems with repair 
requires data on repair times as well as failure rates. 

Repair times, like failure times, may fit various dis¬ 
tributions. It is sometimes assumed that the repair time is a 
constant t, but a more common assumption is that the 
repair times x T have an exponential distribution with con¬ 
stant repair rate pt: 

fr{tr) = nexp(-ntr) {7.8.21] 

For the exponential distribution the mean repair time m r is 



Equations 7.8.21 and 7.8.22 are analogous to Equations 
7.6.12 and 7.6.25b for failure times and mean life. A more 
detailed discussion of repair times is given below. 

The reliability of some standard systems with repair is 
now considered. It is assumed that the exponential repair 
time distribution applies, unless otherwise stated. In par¬ 
ticular, this assumption is made in the Markov models 
described below. 
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7.8.6 Parallel systems with repair 

For a system which has n components in parallel, and which 
survives provided that at least one component operates, 
and for which the failure and repair rates are 1 and pi, 
respectively, expressions for the reliability R can be derived 
using Markov models, as described below. For a parallel 
system with two components it can be shown that the 
reliability/? is: 

R = — 1 — [(3A + n + n) exp(rif) - (3A + pi + r 2 ) exp(r 2 f)] 
n-r 2 

[7.8.23] 

n> ^ m -(3X + pi) ± [(32 +■ ptf - 87.Y /2 [y 8 24] 

7.8.7 Stand by systems with repair 

For a stand by system with two components in which there 
is one component operating and one is on stand by, both 
components have the same failure rate in the operational 
mode, the stand by component has zero failure rate in the 
stand by mode, the switchover is perfect, and there is 
repair, it can be shown using Markov models that the reli¬ 
ability/? is: 

R = 1 [(21 + pi + n) exp(rif) 

— (2 l-\-pi + r 2 ) exp(r' 2 f)] [7.8.25] 

r ^ = -(2x +l 4±m+rf-4*T . [7 . a26] 

7.8.8 Constant repair time 

As just described, the usual assumption for repair times is 
a constant repair rate pi, which implies a distribution of 
repair times. An alternative assumption is a single constant 
repair time t. 

For a parallel system of n components with repair, the 
probability of the system being in the ‘as new’ condition and 
then suffering an initial failure a given number of times, is 
given by the Poisson distribution: 

exp( -nit) |l + nit + H-j =1 [7.8.27] 

The probability of the system failing completely after an 
initial failure and before repair to the as-new condition is: 

Q(t§ w fl - exp( -It j]” -1 It < 1 [7.8.28] 

Then the probability of the system suffering one initial 
failure followed by system failure is: 

P(t) = exp(-nlt)nltQ(x) [7.8.29] 

The probabilities of the system suffering high numbers of 
initial failures followed by system failure may be obtained 


in a similar manner. Hence, it can be shown that the relia¬ 
bility of the system is: 

R = mp(-l't) {7.8.30] 

M = nlQ( t) It < 1 {7.8.31] 

7.8.9 Mean life 

Some methods of determining the mean life have been out¬ 
lined in Section 7.6. The Markov methods described below 
are a further powerful method for obtaining the mean life 
and also the variance. The expressions for the mean life of 
some standard systems, assuming the exponential dis¬ 
tribution, are shown inTable 7.4. For systems without repair 
the expressions allow for different failure rates for each 
equipment, but for systems with repair they assume the 
same failure rate. Some expressions for the mean life 
assuming the Weibull distribution are given by Shooman 
(1968a). 

7.9 Reliability of Complex Systems 

7.9.1 System reliability analysis 

The reliability analysis of systems is carried out first to 
obtain an assessment of system reliability and to identify 
critical features, and then to achieve necessary improve¬ 
ments. A full analysis is likely to require considerable 
effort. It is important, therefore, to identify those sub¬ 
systems which particularly affect the overall system reli¬ 
ability. In other words, the direction of effort is assisted by 
a sensitivity analysis. If the reliability of a particular sub¬ 
system does not greatly affect that of the system, it is not 
necessary to analyse it in great detail. 

Reliability calculations require data not only on failure 
rates but also on repair times. The sensitivity of the system 
reliability determines the accuracy required in the data 
in a given case. In some instances it is necessary to obtain 
a rather accurate estimate from field data. In others 
an engineering estimate made without any field data 
may be quite sufficient. The matching of the data to the 
application is an important element in the art of the 
reliability engineer. 

There are a number of methods which can be used to 
analyse more complex systems and to decompose them into 
their subsystems. These techniques may be illustrated by 
reference to Figure 7.6. Figure 7.6(a) illustrates a system 
consisting of two intermediate storage tanks and three 
pumps. Figure 7.6(b) shows the three pumps all in parallel, 
with complete interchangeability between them. Figure 
7.6(c) shows two separate streams, with one tank and one 
pump in each, and with the third pump available to either 
stream. The system is defined as successful provided 
flow is maintained by pumping with at least one pump 
from one tank. 

7.9.2 Reliability graphs 

The structure of a system may be represented in terms of 
simple reliability graphs. Each branch of the graph repre¬ 
sents a component. Some examples are given in Figure 7.7. 
Figure 7.7(a) shows the reliability graph for three compo¬ 
nents in series, and Figure 7.7(b) shows that for three com¬ 
ponents in parallel. Figure 7.7(c) shows the reliability graph 






7/22 RELIABILITY ENGINEERING 


Table 7.4 Mean life for some standard systems assuming exponential failure distribution 

System 

Failure rates 

Mean life 


Series 

Same 

nk 



Different 

ECT 


Parallel 

Same 

i 



Different 

£ + ? + '"' 





Xl + X 3 kn-x + Xn) 



J 1 

UL 1 1 ^ 



\/ll + Xi + 2.3 + 2.2 + X4 Xn-2 + Ki -1 + in/ 




fa—1) 1 

Stand by 

Same 

I 



Different 

5(3 


r-out-of-M 

Same 



Parallel with repair (n repairmen) 

Same 

1 ^ (1 + ii/xy 

■i-gg i + 1 


Stand by with repair (n repairmen) 

Same 

1V' n 

1 r M y 


-(i + 1))! W 


a The mean life for this case may be obtained by applying the binomial expansion and using Equation 7.6.20. 


for two components in parallel, in series with three com¬ 
ponents in parallel, which corresponds to the storage tank 
pump system shown in Figure 7.6(a), assuming the con¬ 
figuration given in Figure 7.6(b). The system reliability 
may then be determined by computing the reliability of the 
subsystems and then that of the system itself. Reliability 
graphs are discussed in more detail by Shooman (1968a). 

7.9.3 Logic flow diagrams 

The most widely used method of graphical representation 
is the logic flow diagram, also called the ‘logic sequence 
diagram’ or simply the ‘logic diagram’. Figure 7.8 shows a 
logic flow diagram for the storage tank pump system with 
the configuration shown in Figure 7.6(b). In this case the 
top event considered is a success, but in other cases it may 
be a failure. Some typical applications of logic flow dia¬ 
grams are given in Table 7.5. Logic flow diagrams can be 
used for systems of considerable complexity. Further 
examples of logic flow diagrams are given by A.E. Green 
and Bourne (1972). 

One of the most widely used types of logic flow diagram 
is the fault tree. Fault trees are discussed in Chapter 9. An 
important development in the area of fault trees is kinetic 


tree theory, which has been developed by Vesely and 
co-workers (e.g., Vesely, 1969, 1970b; Vesely and Narum, 
1970) and which permits the determination of system 
characteristics such as reliability and availability in time- 
varying systems. 

7.9.4 Event space method 

The event space method involves making a comprehensive 
list of all the possible states of the system and determining 
which of these events correspond to success. The events E ; , 
so listed are mutually exclusive and system reliability R is: 

R = [7.9.1] 

Table 7.6 gives an event space analysis for a storage tank 
pump system having the configuration shown in Fig¬ 
ure 7.6(b). The events which constitute failure are events 
7, 17-19 and 26-32; all other events represent success. 
Further examples of the event space method are given 
by Shooman (1968a) and Buffham, Freshwater and 
Lees (1971). 
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Storage 

tanks Pumps 



Figure 7.6 A system to illustrate methods of analysing 
complex systems: (a) storage tank pump system; 

(b) system with three pumps in parallel; (c) system with 
separate streams, but with a common spare pump 




<i>0> 

(c) 

Figure 7.7 Reliability graphs: (a) fora three-component 
series system; (b) for a three-component parallel system; 
(c) for a storage tank pump system (configuration as in 
Figure 7.6(b)) 


7.9.5 Tree diagrams 

Another graphical representation is the tree diagram. 
Figure 7.9 shows such a diagram for a storage tank pump 
system having the configuration given in Figure 7.6(c). The 
diagrams can be used for simple cases, but rapidly become 


rather cumbersome as systems become more complex. 
Further examples of tree diagrams are given by von Alven 
(1964) and Breipohl (1970). 

7.9.6 Path tracing and tie sets 

The path tracing method consists of tracing through the 
system the paths which constitute success. These paths are 
known in graph theory as ‘tie sets’. System reliability is 
obtained from the minimum tie sets T,-. These sets of events 
are not mutually exclusive and the system reliability is 
given by: 

7.9.7 Path breaks and cut sets 

An alternative approach is to determine the sets of events 
which break all the paths and thus ensure failure. These 
sets are known in graph theory as ‘cut sets’. System 
unreliability is obtained from the minimum cut sets C,. 
Again these sets of events are not mutually exclusive and 
the system reliability is given by: 



If the event space method is applied to a storage tank pump 
system having the configuration shown in Figure 7.6(c) 
rather than that given in Figure 7.6(b), so that paths ad and 
be are not permissible, then the complete cut sets corre¬ 
spond to events 7,17-19,22, 24 and 26-32, and are: 


ab, abc, ab d, abe, ade, be e, ede, 
bede, a ede, abde, abc e, abed, abede 

However, a cut set which contains within itself a smaller cut 
set is not a minimum. The minimum cut sets are: 

ab, ade, bee, ede 

Minimum cut sets are important in fault tree work and are 
considered further in Chapter 9. 

7.9.8 System decomposition 

It is often possible to simplify the analysis of a system by 
selecting a key component which makes it possible to 
decompose the system into subsystems. In such a case, one 
approach is the use of Bayes’ theorem. This theorem is 
considered in more detail in Section 7.14. Here it is suffi¬ 
cient to note that the theorem may be written in the form: 

P(A) = P(A | B)P(B) + P(A | B)P(B) [7.9.4] 

Thus the reliability R( S) of the system is related to the 
reliability i?(X) of the key component as follows: 

R(S) = R (S | X)P(X) + R (S | X)Q(X) [7.9.5] 

For a storage tank pump system having the configuration 
shown in Figure 7.6(c) the system unreliability Q is: 

Q = QaQbRe + QacQbdQe 


[7.9.6] 
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Figure 7.8 Logic flow diagram for storage tank pump system (configuration as in Figure 7.6(b)) 


Table 7.5 Some typical applications of logic flow 
diagrams 


Event investigated 

Type of diagram 


Hazardous occurrences 
Trip system operation 
Plant availability 

Failure diagram (fault tree) 
Success diagram 

Success diagram 

with 



R ac =R a R c 


[7.9.7a] 

Rbd = RbRd 


[7.9.7b] 


The transitions in the system may be in the forward 
direction only, that is, from state 0 to state 1, then from state 
1 to state 2, etc., or they may be in both forward and back¬ 
ward directions, that is, from state 0 to state 1 and from state 
1 to state 0, etc. Also, the transitions may be between adja¬ 
cent states only or between non-adjacent states. 

The transition rates are defined by the states chosen. It is 
generally desirable to choose the states so that the transition 
rates correspond to quantities which are known, such as 
failure and repair rates. The transition rate of a Markov 
model is a constant. The transition rates may include allow- 
anceforimperfectswitchover.Thusatransitionratemaybea 
functionofbothafailure rate andaprobability of switchover. 

Some examples of Markov models are given below. 


Further examples of system decomposition using Bayes’ 
theorem are given by Buffham etal. (1971). 


7.10 Markov Models 

A Markov model is a model of the probabilities of different 
states of a system as a function of time. It therefore has two 
variables, state and time. There are thus four possible types 
of model, since each of these variables may be either dis¬ 
crete or continuous. Accounts of Markov models are given 
by Sandler (1963), Shooman (1968a) and R.A. Howard 
(1971). In particular, Sandler (1963) gives solutions of 
numerous standard cases in reliability and availability. It is 
the discrete-state, continuous-time model which is most 
widely used in reliability work. 

The state of a system can generally be defined in a 
number of ways. Thus for a two-equipment system with 
equipments 1 and 2, one set of states is as follows: 
no equipments failed, one equipment (either 1 or 2) failed, 
both equipments failed. Another set of states is as follows: 
no equipments failed, equipment 1 failed, equipment 2 
failed, both equipments failed. 


7.10.1 Discrete-state, continuous-time models 

If a system has n + 1 possible states and transition is 
between adjacent states in the forward direction only with 
transition rates X k ^ 1:k between states k -1 and k and X k _ k +i 
between states k and k + 1, the probability Pbft+A.t) of 
being in state k at time t+At is: 

Pk(t-\-At) = Xk-\),AtPk-i(t) +Pk(t) — Xk)t+\AtPk{t) 

|7.10.1] 


But 


lim r/w+A/) -pm = d p k (t) 

a<->o[ At J df 
Hence 


[7.10.2] 


= P k (t) = Vi,*P*-i(0 - |7.1Q.3] 
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Table 7.6 Event space of a storage tank pump system (see Figure 7.6) 

1 

abcde 

11 

abcde 

20 

abcde 

27 

abcde 

2 

abcde 

12 

abcde 

21 

abcde 

28 

abcde 

3 

abcde 

13 

abcde 

22 

abcde 

29 

abcde 

4 

abcde 





30 

abcde 

5 

abcde 

14 

abcde 

23 

abcde 

31 

abcde 

6 

abcde 

15 

abcde 

24 

abcde 





16 

abcde 

25 

abcde 

32 

abcde 

7 

abcde 







8 

abcde 

17 

abcde 

26 

abcde 



9 

abcde 

18 

abcde 





10 

abcde 

19 

abcde 






Initial conditions are commonly: 

P 0 (0) = 1; P k { 0)=0 0 <k<n [7.10.4] 


The inverse of the matrix, [si — A] -1 , has as its numerator 
the matrix of cofactors of [si - A] and as its denominator 
the determinant of [si - A]. Thus: 


As an illustration, consider a system with three states 0,1 
and 2 and transition rates Xoi and X 12 - The Markov equa¬ 
tions are: 


P 0 (t) = AoiPoW [7.10.5a] 

= *oifl>(0 - hsPlit) [7.10.5b] 

P 2 (t) = X i 2 Pi(f) {!?. 10.5c] 

Assume the initial conditions given in Equation 7.10.4.Then, 
rewriting Equations 7.10.5a—c and 7.10.4 in matrix form: 

P(f) = AP(f) [7.10.6] 

where 

P —Aoi 0 01 

A = Aoi -Xu 0 [7.10.7] 

[ 0 X u Oj 


r s(s+ Xu) o o 1 

s/loi 5(s + /loi) 0 

r. *i-i _ L ^(s + Aoi) (s+ Aoi)(s + Xu) J 

[s " J " s(s + ioi)(5 + Ai 2 ) 

[7.10.12a] 


S + Xoi 

(s + Aoi)(s + /.12) 
_s(s + J«)(® +■ ^1%) 


_vMx 

s(s + Xu) 


Then multiplying out Equation 7.10.10 using Equation 
7.10.12b: 





Equations 7.10.6-7.10.8 may be solved analytically by tak¬ 
ing Laplace transforms, inverting the matrix, and then 
inverting the transforms. Thus, taking Laplace transforms 
of Equation 7.10.6: 

sP - P(0) = AP [7.10.9] 

Hence 

P si-A : P(0) [7.10. UV 


Po(s) = 

m = 


(s + Aqi)(s + Xu) 


W s(s + a 01 )(s+A 12 ) 
and inverting these transforms gives 


[7.10.13a] 

[7.10.13b] 

[7.10.13c] 


P 0 (t) = exp(-Aoif) [7.10.14a] 

p i(t) = [exp(-Aoif) - exp(-/li 2 f)] [7.10.14b] 

P 2 (t) = 1 i-^-[Ai 2 exp(-i 0 iO - Aoiexp(-Ai 2 f)] 

[7.10.14c] 


But 

rs+Aoi 0 01 

[si — A] m I — Xoi s + Xu 0 
L 0 -X 12 s J 


This example illustrates a number of practical points about 
Markov models: 


[7.10.11] pj The sum of the terms on the right-hand side of all the 
original model equations is zero. 
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Figure 7.9 Tree diagram for storage tank pump system (configuration as in Figure 7.6(c)): S, system success; 
F, system failure 
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(2) The sum of the probabilities P(t) is unity and the sum 
of their transforms P(s) is 1/s. 

(3) The initial conditions are frequently P 0 (0) = 1 and 
P k ( 0) = 0 (0 < k < »), and in this case only the first 
column of the matrix [si - A] “ 1 is of interest. 

(4) If there are no transitions back from the last state, the 
equation for this may be omitted and the probability 
calculated at the end from the other probabilities; this 
isparticularly useful in third-andfourth-ordermodels. 


7.10.2 Poisson process 

If in Equation 7.10.3 the transition rate from one state to the 
next is a constant X , the Markov equations are: 


p 0 (f) = -XPo(t) 

[7.10.15a] 

Px(f)=APoW-^i« 

[7.10.15b] 

P„(t) = XP {n . 1) (t)-XP n (t) 

[7.8.15c] 

Assume the initial conditions given i: 
Then the solution is: 

n Equation 7.10.4. 

P 0 (f) = exp(—4) 

[7.10.16a] 

Pi(f) = exp(-4)4 

[7.10.16b] 

P„(t) = exp(-Af) 

[7.10.16c] 


This is a Poisson process. 


7.10.3 Two-equipment systems 

If a system consists of two components then, whatever its 
configuration, one formulation of the states in which it 
can be is as follows: no equipments failed, equipment 1 
failed, equipment 2 failed and both equipments failed. Let 
P 0 (4 P\(t), P 2 (t) and P 3 (f) be, respectively, the probabilities 
of: no failures, failure of component 1, failure of 
component 2, and failure of both components. In addition, 
let 4, X2, X 3 and 4 be, respectively, the transition rates 
from: states 0 to 1,0 to 2,1 to 3 and 2 to 3. Then the Markov 


equations are: 

P 0 (t) = -(X 1 + X 2 )P 0 (t) [7.10.17a] 

Pi(f) = 4P«(0 - X 3 Pi(t) [7.10.17b] 

P 2 (f) = X 2 P 0 (t) - XJ> 2 {t) [7.10.17c] 

P 3 (t ) = 4sPx(f) + XJ> 2 {t) [7.10.17d] 

Assume the initial conditions given in Equation 7.10.4. 
Then the solution is: 

P 0 {t) = exp[-(4 + X 2 )t ] [7.10.18a] 


| = Al + ^ k {exp(-2 3 f) - exp[-(2i + X 2 )t]} 

[7.10.18b] 

= ll + 4-i 4 '{ exp (-^> - exp [-(^ + *0*]} 

[7.10.18c] 
[7.10.18d] 


Thus far no particular configuration has been assumed. 
The following cases can be treated to obtain the system 
reliability R(t): 

(1) Series system, failure rates of two equipments identical: 
X 1 = X 2 =X 

R(t) = P 0 (f) = exp(-24) [7.10.19] 

(2) Series system, failure rates of two equipments different: 

R(t) = P 0 (t) = exp[-(4 + X 2 )t\ [7.10.20] 

(3) Parallel system, failure rates of two equipments identical: 
Aj = X 2 = A3 = 4 = X 

R(t) =P 0 (t) +Pi{t) +P 2 (t) 

= 2exp {-Xt) - exp(—2 Xt) [7.10.21] 

(4) Parallel system, failure rates of two equipments different: 

4 = 4=4 4 = 4 = 4 

R(t) =P 0 (t) +Pi(t) +P 2 (t) 

= exp(-At) + exp(— X't) - exp[— (X + Xl)t] [7.10.22] 

(5) Parallel system, failure rates of two equipments oper¬ 
ating together identical, but failure rate of one equipment 
surviving different: 

Ai = X 2 = X; X 3 = Xi = X 
R(t) =P 0 (t) +P l (t) +P 2 (t) 

- * „,;2;. e xp(-;.'f) -A'ex P (-2A/)] [7.10.23] 

(6) Stand by system, failure rates of two equipments 
identical in operating mode, no failure in stand by mode 
and no switchover failure: 

X 1 = X 3 = 1; A 2 = A 4 = 0 
R(t) =P 0 (t) +P 1 (t) 

In this case the expression for Pi( t) is indeterminate since the 
denominator is zero, but applying de 1’Hopital’s rule of dif¬ 
ferentiating both numerator and denominator by 4 gives 

R(t) = exp(—Af)(l + Xt) [7.10.24] 

This example illustrates the versatility of the method. 

7.10.4 Single-equipment systems with repair 

In the system considered so far the transitions have all been 
unidirectional towards some failed state. In fact, in most 
systems there is repair. The transition rate in the reverse 
direction is the repair rate. 

It is normally assumed in Markov models that there is a 
constant repair rate n , and hence an exponential distribu¬ 
tion of repair times t r , as given in Equation 7.8.21. If a sys¬ 
tem comprises a single equipment with repair, there are two 
possible states it can take. Let P 0 (t) and Pi(f) be the prob¬ 
abilities of being operational and failed, respectively, and 
let X and n be the failure and repair rates, respectively. The 
Markov equations are: 

P 0 (t) = -XP 0 (t)+nPi(t) 
b{^XP a (t)-uPi(t) 


P 3 (t) = l-[P 0 (t)+P 1 (t)+P 2 (t)] 


[7.10.25a] 

[7.10.25b] 
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Assume the initial conditions given in Equation 7.10.4. 
Then the solution is: 

W) = + j^exp[-(A + n)t\ [7.10.26a] 

p i(t) = ./ + — j^exp [-(X + n)t\ [7.10.26b] 

Since there is now transition in both directions, P 0 [t) 
represents the system availabilityM(f) 

A {t) = +j^op[-(X + fi)t] [710.27] 

Thus the availability is, in general, a function of time. But 
is it usually the steady state availability A(oo) which is of 
most interest: 

A(oo)= [7.10.28] 

7.10.5 Reliability and availability formulations 

The availabilityM(f) introduced in the previous section is the 
probability that the system will be in the operational state. 
This is not the same as the reliability R[t), which is 
the probability that the system will not leave the operational 
state. The difference lies in the fact that, in determining 
availability, transition back by repair from the 
non-operationalstateispermitted.Theavailabilityforagiven 
system is always greater than or equal to the reliability: 

A{t) > R(t) [7.10.29] 

Different Markov models are required for reliability and 
availability. For reliability, repair transition from the states 
constituting failure is not permissible, although repair 
transition from other states is. For availability, repair tran¬ 
sition from all states is permitted. 

For an r-out-of-« system, in which the states up to and 
including the (n - r )th state give survival, reliability is 
obtained from the Markov model as: 


may be omitted in the formulation and determined at the end 
of the calculation from the other state probabilities. This is 
particularly useful in the analytical solution or manual cal¬ 
culation of third- and fourth-order models. 

7.10.6 Repair rates 

The repair rate used in Markov models for systems with 
more than one equipment needs to be carefully specified. 
There are two aspects to consider. One is the repair transi¬ 
tion rate in systems with n equipments from states in which 
there is more than one failure. This transition rate will 
normally lie somewhere in the range n to n/i. The other 
aspect is the increase in repair transition rate for a single 
equipment from n to which may be obtained by allocat¬ 
ing additional effort. 

These repair transition rates are often considered in 
terms of the number of repairmen, it being assumed that 
the normal case is one repairman for one equipment. Thus 
for systems with n equipments and with states with multi¬ 
ple failures the repair transition rate in the fully failed state 
may be npi. This is often called then ‘ n repairmen case’. But 
the number of repairmen may also affect the repair transi¬ 
tion rate for a single equipment £,u. Thus Sandler (1963) 
frequently uses { = 1.5 where two repairmen are available 
to work on one equipment. 

As an illustration, consider a system which consists of 
two equipments with identical failure rates. Then there are 
three possible states: no equipments failed, one equipment 
failed and both equipments failed. Let P 0 [t), Pi(f) and P 2 (f) 
be the probabilities of no, one and two failures, respectively, 
and let X be the failure rate and n the basic repair rate. If 
repair resources allow the repair of only one equipment at a 
time, that is, the one repairman case, then: 

P 0 (f) = -2XP 0 [t) + nP x ( t ) [7.10.32a] 

Pi(f) = 2 XP 0 [t) - (X + n)Pi(f) + nP 2 (t) [7.10.32b] 

P 2 (t) = XP^t) - ixP 2 (t) [7.10.32c] 

Assume the initial conditions given in Equation 7.10.4. 
Then the system availability, defined as having both 
equipments operating, can be shown to be: 


m = gp,(f) 


[7.10.30] 


A(oo) =Pq(oo) = 


A 2 

2X 2 + 2Xn + n 2 


[7.10.33] 


Availability is obtained as 

A[t) ='£ j P i [t) [7.10.31] 

when the states 0 to n — r again constitute survival. But the 
formulation of the equations for the various states is dif¬ 
ferent in the two types of model. For the reliability for¬ 
mulation, the repair transition rates in equations n — r +1 

A state which it is possible to enter but not to leave is an 
absorbing state. If there is a single absorbing state, the steady 
state probability of being in that state is unity. The reliability 
formulations of Markov models have an absorbing state, but 
availability formulations do not. If the last state of a Markov 
model is an absorbing state, so that there is no interaction of 
this state and the preceding states, the last state probability 


If, on the other hand, the repair resources allow the repair 
of two equipments simultaneously, that is, the two repair¬ 
men case, then: 

P 0 (f) = -2XP 0 (t) + AiPi(f) [7.10.34a] 

Pi(t) = 2XP 0 (t) ~[X + /x)Pi(f) + 2 nP 2 (t) [7.10.34b] 

p 2 (t) = XPi(t) - 2nP 2 (t) [7.10.34c] 

and, assuming the same initial conditions and definition of 
availability, 


A(oo) I* 


A 2 

[XI nf 


A 2 

X 2 + 2 Xji A fi 2 


[7.10.35] 


It may be noted that there is a difference between the num¬ 
ber of repairmen that can usefully be used, depending 
on whether it is reliability or availability which is being 
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calculated. In a system with n equipments which fails when 
n — r +1 equipments have failed, it is possible to use n 
repairmen to maximize availability, but only n — r repair¬ 
men to maximize reliability. 

7.10.7 Mean life 

Markov models offer a powerful method of obtaining 
the mean life and the variance of the distribution of 
complex systems. This is discussed in more detail by 
Sandler (1963). 


7.10.8 Discrete-state, discrete-time models 

The discrete-state, discrete-time Markov model is also 
useful in some applications. If a system has a number of 
possible states and transition occurs between these states 
over a given time interval, then the vectors of state prob¬ 
abilities before and after the transition P(0) and P(l) are 
related by the equation: 

P(l) = AP(0) [7.10.36 

where A is the matrix of transition probabilities. Then it can 
be shown that, as the number of transitions tends to infinity: 

P(oo)A = P(oc) [7.10.37 

The final state probabilities are independent of the initial 
state probabilities. In addition, 

l [7.10.38; 

The final states of the system may be obtained by solution 
of Equations 7.10.37 and 7.10.38. 

An account of discrete-state, discrete-time Markov mod¬ 
els is given by Sandler (1963). An application involving a 
discrete-state, discrete-time Markov model is given in 
Section 7.13. 


7.11 Joint Density Functions 

An alternative to Markov models is the use of the joint 
density function approach. The joint density function 
method is convenient where a failure distribution other 
than the exponential distribution has to be handled. It is 
also useful where the failure rate changes depending on the 
failures which have already occurred. The joint density 
function method is discussed by Lloyd and Lipow (1962) 
and Shooman (1968a). 

If a system consists of two subsystems and if the second 
subsystem takes over the system function when the first 
fails at time x, then the joint density function of the system 
<K t, t) is 

<j>{x,t)=f 1 {x)f 2 {t\x) [7.11.1] 

where /l(t) is a density function, and f 2 (t | x) is a conditional 
density function. The associated marginal density func¬ 
tion^/) is: 

f{t)= j™ 4>{x,t)dr [7.11.2] 

7.11.1 Parallel systems with variable failure rates 

If a system consists of two equipments in parallel and both 
equipments have the same failure rate X 1 when both are 


operating but have a different failure rate X 2 after the first 
equipment has failed, then the density functions are: 


h(t) = 2Aiexp(-2Aif) §711.3] 

h(t | t) = X 2 exp[-H 2 (f -1| 0 < x < t [7.11.4a] 

= 0 x >t f.11.4b] 

The joint density function is: 

4>{x,t) =h{x)f 2 {t\x) |7115] 

and the marginal density function is: 

/(f) = J 22iexp(— 22ir)il 2 exp[-/l 2 (f - t)] dr jjf.ll.6a] 

= [exp(-A 2 f) - exp(-2Hif)] j7.ll.6b] 

The reliability is 

R(t) = l~ j*f[t)&t [7.11.7a] 


= g ^ 6XP( ~ ht) ~ h 6XP( ~ 2ht)] P 1L7b] 

7.11.2 Stand by systems with variable failure rates 

If a system consists of two equipments, one operating and 
one on stand by, with perfect switchover, and if the failure 
rates of the operating and the stand by equipments are 4 
and X 2 , respectively, then the density functions are: 


M%) m h exp(—H it) 

17.11.8] 

f 2 (t\x) = X 2 exp[-X 2 (t-x)\ 0 < t < f 

•i x >t 

[7.11.9a 

[7.11.9b] 

and hence 


fit) -exp(-%f| 

[7.11.10] 

R(t) = 2 \ Ml exp(—H 2 f) - X 2 exp(-Hif)] 

[7.11.11] 

7.12 Monte Carlo Simulation 



Many practical problems cannot be solved by any of the 
analytical methods described and are only soluble by 
simulation. The principal method used is Monte Carlo 
simulation. Accounts of Monte Carlo simulation include 
that given in Method of Statistical Testing. Monte Carlo 
Method (Shreider, 1964) and that by Shooman (1968a). 


7.12.1 Simulation method 

The application of Monte Carlo simulation to the determi¬ 
nation of the reliability and/or availability of complex sys¬ 
tems proceeds broadly as follows. 

The system configuration, the failure and repair char¬ 
acteristics of the components, and the time period of inter¬ 
est are specified. The time period is divided into small 
increments. The first trial is then carried out covering the 
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time period specified. At the first time increment the 
probability of failure of the first equipment is calculated. 
This probability is compared with a random number in the 
range 0 to 1 generated from a uniform distribution: if the 
random number is less than or equal to the failure prob¬ 
ability the equipment fails, otherwise it survives. The state 
of all the equipments is computed in like manner. The 
situation is then reviewed to determine the overall state of 
the system. If failures have occurred, there may be various 
changes in the system, such as initiation of repair of failed 
equipments, alteration in failure rates of more highly 
loaded surviving equipments, etc. The system behaviour at 
the second time increment is then computed and the pro¬ 
cess is continued until the specified time period is com¬ 
plete. This whole calculation constitutes only a single trial. 

The result of this trial is that the system either has or has 
not met its reliability/availability objective. It is then 
necessary to carry out further trials to obtain the full 
simulation. The ratio of successful trials to total trials 
asymptotically approaches a constant value and this is the 
required system reliability/availability result. The equip¬ 
ment characteristics such as failure and repair rates 
obtained in the series of simulation trials naturally also 
approach asymptotically the values originally specified. 

7.12.2 Illustrative example 

As an illustration, consider the determination of the reli¬ 
ability of a single equipment over a specified period of time, 
assuming the exponential failure distribution. This simple 
case is chosen for illustration because there is also an ana¬ 
lytical solution which is given by Equation 7.6.11. Let the 
time period to be considered be 10 months and let the fail¬ 
ure rate X be 0.5 faults/year. Then, in Equation 7.6.11, 

X = 0.5 faults/year 
f=10 months = 0.83 year 
Hence 
R = 0.66 

Now consider the alternative solution using Monte Carlo 
simulation. The time period is divided into suitable incre¬ 
ments, which in this case are shown as 1 month. The prob¬ 
ability of failure q in one time increment 8t is then 
calculated as: 

-q = Xdt 

= 0.5 x 0.0833 
= 0.0417 


The Monte Carlo simulation is then carried out using a set 
of random numbers. A suitable series of random numbers, 
which in this case have been generated by a computer and 
are therefore strictly pseudo-random numbers, is given in 
Table 7.7. The first trial is carried out as follows. For the first 
month the probability of failure q (= 0.0417) is compared 
with the random number v. The occurrence of survival or 
failure is determined as follows: 

v > q survival; 
v < q failure. 

Thus, taking the random numbers from the first line of the 
table, in the first month, since v = 0.0417, the equipment 
survives. The same process is repeated for each of the 
remaining 9 months. Since in all cases v > q, the equip¬ 
ment survives the whole 10-month period. This completes 
the first trial, in which the equipment has survived. 

Further trials are then carried out on the same lines. The 
second, fourth and sixth lines of the random number table 
contain values of the random number v which are less than 
q; these are shown underlined in Table 7.7. In the second, 
fourth and sixth trials, therefore, the equipment fails, but 
in all the other trials it survives. The trials which constitute 
survival and failure may then be tabulated as shown in 
Table 7.8, assigning 1 to a survival and 0 to a failure. 

The reliability of the equipment is then determined as 
the ratio of the number of trials in which the equipment 
survives to the total number of trials. In this example the 
ratio is 0.7. Since only 10 trials have been done, the reli¬ 
ability can be calculated only to one place of decimal. This 
value of the reliability compares with the value of 0.66 cal¬ 
culated earlier from the analytical relationship. 


7.12.3 Applications of the method 

As an illustration of the sort of problem to which Monte 
Carlo methods are applicable consider the olefins plant 
system shown in Figure 7.10. The system consists of four 
cracking furnaces in parallel followed by a compressor and 
then by a separation train. The furnaces have the char¬ 
acteristics shown in Table 7.9. The failure rate of the com¬ 
pressor is 0.3 faults/year and that of the separation train is 
3 faults/year. The repair characteristics of the equipment 
are given in Table 7.10. The furnace repair team is able to 
work on only one furnace at a time, but there is no other 
restriction on the repair work. The information required 
from the simulation might be, say: (1) the probability of 
achieving full availability, (2) the mean availability 


Table 7.7 A series of random numbers 


Random numbers 


0.7710 0.7818 

0.4129 0.4574 

0.2598 0.7481 

0.7649 0.0135 

0.5064 0.9879 

0.1873 0.7806 

0.6358 0.8761 

0.8050 0.1336 

0.7730 0.7877 

0.7430 0.4476 


0.7517 0.4740 

0.0284 0.0538 

0.1507 0.1707 

0.1968 0.0592 

0.3699 0.3285 

0.9981 0.9630 

0.5345 0.3221 

0.5572 0.1402 

0.7693 0.5267 

0.9991 0.9659 


0.0782 0.2032 

0.0677 0.9217 

0.6685 0.4742 

0.5838 0.9701 

0.6416 0.8936 

0.7952 0.1043 

0.1226 0.8365 

0.8269 0.7000 

0.2364 0.6778 

0.8040 0.1307 


0.5159 0.2664 

0.9214 0.2330 

0.8289 0.7054 

0.5664 0.6681 

0.5872 0.4803 

0.4693 0.8766 

0.9158 0.9662 

0.7549 0.2335 

0.9397 0.5379 

0.5484 0.1139 


0.9556 0.3355 

0.1053 0.5345 

0.7725 0.2862 

0.9104 0.4500 

0.5972 0.2603 

0.0359 0.3265 

0.5547 0.6329 

0.6067 0.5389 

0.7701 0.7789 

0.7478 0.4622 
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Table 7.8 Monte Carlo simulation example: survival or 
failure of equipment in trials 1-10 


Trial 


2 

3 

4 

5 

6 

7 

8 
9 

10 


Survival/failure 


0 


Table 7.10 Monte Carlo simulation example: repair 
characteristics of the equipment 



Repair time 
(days) 

Proportion of occasions 

Furnace 

20 

0.7 


30 

0.2 


40 

0.1 

Compressor 

10 

0.8 


30 

0.2 

Separation 

10 

0.7 

train 

20 

0.3 



Figure 7.10 Olefins plant system 


Table 7.9 Monte Carlo simulation example: character¬ 
istics of the furnaces 


Time since start-up (days) 

Proportion of furnaces failing 

0-50 

0.08 

50-100 

0.05 

100-200 

0.05 

200-300 

0.10 

300-400 

0.10 


achieved, (3) the range of availabilities and the corre¬ 
sponding probabilities, over a period of 90 days. 

7.12.4 Features of the method 

It will be apparent from this example that it is necessary to 
resort to Monte Carlo simulation on account of the complex¬ 
ity not so much of the system configuration, which is in fact 
rather simple, but rather of that of the failure and repair data 
and other rules and constraints. A single simulation is cap- 
ableofgivinganumberofresults.Thusintheexamplequoted 
the results required were, in effect, the system reliability, its 
mean availability and its availability density function. 

The failure data are frequently provided in the form of a 
failure histogram. The quantity which is required in the 
simulation for comparison with the random number is the 
probability of failure q. If the fraction failing over one time 



Figure 7.11 Failure data histogram 


Thus consider the failure histogram shown in Figure 7.11. 
The probabilities of failure for the 4 days obtained from 
Equation 7.12.1 are 0.2,0.25,0.5 and 1.0. 

It is often convenient to perform one set of trials, exam¬ 
ine the results and then perform further sets. If this is done, 
however, it is necessary that the subsequent sets should not 
start with the same random number as the first set, other¬ 
wise the effect is simply to repeat that set continuously. 


7.12.5 Number of trials 

The Monte Carlo method is extremely powerful, but it does 
have one serious drawback with regard to the number of 
trials required to obtain an accurate result, especially 
where the probability investigated is high. The number of 
trials required to achieve a given confidence level on the 
probability cannot, in general, be calculated. An approxi¬ 
mate estimate of the number of trials can be obtained, 
however, if certain simplifying assumptions are made. The 
following method of estimation has been described by 
Shooman (1968a). 

In determining the value of a single probability, such as a 
reliability, the simulation may be regarded as a series of n 
trials which have a binomial distribution with a true prob¬ 
ability of success p and of failure q. The binomial distribu¬ 
tion approaches the normal distribution for p > 0.5 and 
nq > 5. The point estimate of the probability of failure q is 
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given by n f ln, where n f is the number of failures recorded in 
n trials. Then the fractional error e between the estimated 
and true probabilities of failure is: 

g = nf}n-q If7.i2.21 

9 

If n and <7 are the expected number of failures and the 
expected standard deviation, then for a (1 - a) confidence 

P{ —ya <n.f — n<ya) = 1 — a :|J7.12.3] 

where y is the number of standard deviations correspond¬ 
ing to that level. In terms of the parameters n, p and q of the 
binomial distribution: 

p = nq J7.12.4] 

a = (npq) 1 ' 2 f7.12,5] 

Then 

P[=y(npq) 1/2 <n f -n q < y(np Q ) 1/2 | * 1 - « [7.12 6] 

P[-y(p/nq) 1/2 < e < y(p/nqf 2 ] = 1 - a J7.12.7] 

Thus at the 95% confidence level, for which y = 2: 

«>200 {p/nqf ,2 % |7.12.8] 

The very large number of trials required for a system with 
very high reliability can be seen by considering the number 
required to give an error of ^5% at a 95% confidence level 
(see Table 7.11). Thus, despite the undoubted power of the 
Monte Carlo method, it remains attractive to use and 
develop analytical techniques wherever possible. A further 
discussion of the number of trials required in Monte Carlo 
simulation is given by Shreider (1964). 

Monte Carlo simulation also has other applications in 
reliability work. Its use to generate hazard rates from dis¬ 
tributions of hazard rates is described in Chapter 9 in con¬ 
nection with fault tree work. 

7.13 Availability 

7.13.1 System availability analysis 

The availability analysis of systems, like reliability analy¬ 
sis, has as its objectives: (1) to assess system availability 
and to identify critical aspects; and (2) to effect the required 
improvements. 

It is usually necessary to consider a number of availability 
characteristics. For process plants these are likely to include: 
(1) the probability of obtaining nominal output and down¬ 
time, (2) the probability of obtaining other outputs and 


down-times and (3) the probability of infrequent but very 
long down-times. Long outages are particularly important. 
It is usually appropriate to deal separately with these. Thus, 
for example, the frequency of a long outage of lyear might be 
about 10 “ /year. It is not very meaningful to express this as 
an additional loss of mean availability of 0.04 days/year. 

A full analysis may well involve much effort. Therefore it 
is important to identify those subsystems which have a 
particularly strong influence on the overall system avail¬ 
ability. Those subsystems which do not greatly affect sys¬ 
tem availability can be treated in less detail. 

There are two main types of availability data which may 
be used. Sometimes data on the availability of whole sub¬ 
systems can be obtained. In other cases it is necessary to 
calculate system availability from failure rate and repair 
time data. In either case it is important that the accuracy of 
the data be matched to the sensitivity of the system avail¬ 
ability to errors in the data. 

As far as possible data on the availability of a pro¬ 
cess unit should describe the performance of that unit 
independent of other units. Down-time of the unit due to 
unavailability of other units or to other extraneous 
causes should not be included. 

Particular attention should be paid to the availability of 
process raw materials and services. It is also often neces¬ 
sary to consider the availability of other plants which 
receive from the plant under consideration outputs such as 
by-products, electricity or steam. 

There are a number of methods available for the analysis 
of more complex systems, and some of these are described 
below. 


7.13.2 The availability function 

In general, availabilityA(f) is a function of time. It may be 
expressed in terms of the up-time u(t) and down-time d(t)\ 


A(t) = 


u{t) 

u(t)+d(t) 


The unavailability V(t) is 

V(t) = l-A(t) 
d(t) 


[7.13.1] 

[7.13.2] 

[7.13.3] 


The point availability A(t) can be integrated over the time 
period T to give the mean availability over that period: 


A(T)=±j\(t)dt 17.13.4] 

Often, however, it is the long-term, or steady-state, avail¬ 
ability A(oc) which is of most interest: 


Table 7.11 Monte Carlo simulation: number of trials 
required in example to give an error of f5% at a 95% 
confidence level 


%) = 


«(°°) 

w(oo) +d(oo) 


[7.13.5] 


Probability of success 

No. of trials required 

0.9 

14,400 

0.99 

158,400 

0.999 

1,598,400 


The long-term availability may also be expressed in terms 
of the mean up-time w u and the mean down-time »z d : 

m |7 ' ia6] 
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For a single equipment or system with exponential failure 
and repair distributions, failure rate A and repair rate p: 



1 

m A = - 
P 


Then, from Equations 7.13.6-7.13.9: 

1 

1 + Anir 

m 1 ^ Amt Amt < 1 


[7.13.7] 

[7.13.8] 

[7.13.9] 

[7.13.10a] 

[7.13.10b] 

[7.13.10c] 


This result was given earlier in Equation 7.10.28, and the 
long-term unavailability is: 


v(oo) m 


A 

A + p 
Amt 

1 + Anit 


= Amt Anit < 1 


[7.13.11a] 

[7.13.11b] 

[7.13.11c] 


7.13.3 The repair time density function 

It is appropriate at this point to consider the distribution of 
repair times. The mean repair time m r is defined as the first 
moment of the repair time density function/ r (4): 

m r ,- f X LJt(tt) Alt f.13.12] 

So far, the repair time distribution which has been con¬ 
sidered is the exponential. For this distribution the repair 

time density function/ r (f r ) is 

Mf) = pexp(-ptt) [7.13.13; 

The repair time distribution function F r (t r ) is: 

F r (t r ) j Mtr)dlr [7.13.14a] 

-1 —exp( . [7.13.14b] 

The mean repair time is: 

Wr«jf f r/ uexp(— fitr) df r [7.13.15a] 

•A [7.13.15b] 


For the normal distribution: 


® )= ^(-Tr) 1713161 

where the mean repair time is m r . 

For the log-normal distribution: 


[7.13.17] 


7.13.4 The down-time density function 

For a single equipment the repair time and the down-time 
are the same. For a system it is more usual to speak of the 
down-time. 

So far the down-time used in the expressions for avail¬ 
ability has been the mean down-time m A . But, just as there 
is a repair time distribution, so there is a down-time dis¬ 
tribution. It is possible to define a down-time density 
function f A (d) and distribution function F A (d). 

Particularly important are long down-times. In the 
down-time distribution shown in Figure 7.12, the tail in the 
distribution is due to infrequent, but long, outages. 

7.13.5 The throughput density function 

So far it has been assumed that either an item is available or it 
is not. In fact, however, in the process industries many items 
may exhibit a range of throughputs.This partial availability 
can be expressed by a throughput density function/ w ( tv). 

Typical throughput data from a process unit given 
by G.D.M. Pearson (1975) are shown in Table 7.12 and plotted 
in Figure 7.13. These data constitute a throughput density 
function. Similarly, the throughput of a whole plant can be 
expressed as a throughput density function. 



Figure 7. 12 Down-time distribution showing a tail 
corresponding to infrequent, but long, outages 


Table 7.12 Throughput capabilities of a process unit 
(G.D.M. Pearson, 1975) (Courtesy of the University of 
Nottingham) 


Throughput capability 
(fraction of normal throughput) 

Probability 

0 

0.035 

0.025 

0.015 

0.050 

0.005 

0.800 

0.001 

0.850 

0.002 

0.900 

0.005 

0.925 

0.007 

0.950 

0.010 

0.975 

0.020 

1.000 

0.900 


Repair time data often fit a log-normal distribution. 
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Figure 7.13 Throughput density for a process unit 
(G.D.M. Pearson, 1975) (Reproduced by permission of 
the University of Nottingham) 


7.13.6 Markov models 

The derivation of expressions for availability from Markov 
models has been described briefly above. This method is 
now considered in more detail. 

It is normally assumed in such models that the repair 
time distribution is exponential with constant repair rate p. 
Usually it is the long-term availability which is of interest. 
In this case the Markov equations become steady-state 
equations. Thus, for example, Equation 7.10.25 becomes 
0=-iP o + /^i [7.13.18a] 

but Equation 7.10.25b becomes 

[7.13.18b] 

Equations 7.13.18a,b then yield equation [7.10.28] directly. 

The definition of availability used depends on the con¬ 
figuration of the system. Considering systems with n 
equipments, for a series system only the first state P 0 con¬ 
stitutes survival: 

-A(oo) = P 0 [7.13.19] 

For a parallel system only the last state represents failure: 
71 (oc) [7.13.20] 

For an r-out-of-n system the states up to and including the 
(n - r)th state give survival: 

A(oo) = ^Pi [7.13.21] 

Long-term availabilities for some standard systems 

assuming exponential failure and repair time distributions 
are given in Table 7.13. The availabilities are defined by 
Equations 7.13.19—7.13.21. The repairman assumption is 
that each repairman repairs one equipment, so that the 
repair transition rates between states are limited by the 
number of repairmen. 

Another important and general case is that in which 
there are n equipments but only m repairmen. If there are k 
equipments down then, at steady state: 

0 = (n - k + \))J\ ■ - [(» - k)X + kp]P k 
+ (k + T)ixPk+\ k<.m 


Table 7.13 Long-term availabilities for some standard 
systems assuming exponential failure and repair time 
distributions 


System 

No. of 

No. of 

Availability 


components repairmen 









X + p 

Series 






2/ 2 + 2 Xp + p 2 


Series 

2 

2 

p 2 



(l + pf- , 

Series 


1 

(p/xt 





Series 



p” 



(7. + p)” 

Parallel 

2 

1 

p 2 + 2 Xp 



2A 2 + 22.fi + fi 2 


Parallel 

2 

2 

jU 2 22.fi 



X 2 + 2 Xp + p 2 


Parallel 

n 

1 

1 „- 1 - 7 



YUiViWiXf 

r-out-of-« 

n 

n 


Stand by 

2 

1 

p 2 + Xp 



2? -f- 2fi -f- fi 2 


Stand by 


2 

2fi 2 + 22fi 



A 2 H~ 22 fi -h 2fi 2 

Stand by 

n 

x 

1 i 



Ho ww 

Stand by 

n 

n 

1 Eto wm/xr 


0 = (n - k + T)XPk-i - \(n - k)X + mp]Pk 
+ mpP k+1 k>m 

[7.13.22b] 

1 

.13 

[7.13.22c] 

Equations 7.13.22a-chave the solution: 


Po= (n - k) \k \‘ pk+ ^ (n - k)\m\^ (rn) 

T 

[7.13.23a] 


[7.13.23b] 

= (n-k)\rn\ pm (rn) P ° k ~ m 

}7.13.23c] 


X 


[7.13.22a] 


p = - 


[7.13.24] 
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The long-term availability of an r-out-of-« system with m 
repairmen is given by: 

A{ oo) • 17.13.25; 

using Equations 7.13.23a—c. 

These and numerous other cases are treated in more 
detail by Sandler (1963). 

7.13.7 Logic flow diagrams 

Logic flow diagrams are often used to represent system 
availability.Thus the logic flow diagram shown in Figure 7.8 
for the storage tank pump system with the configuration 
given in Figure 7.6(b) is in fact an availability diagram. In 
order to use the logic flow diagram method it is necessary to 
represent the plant flow diagram in logical form. It is neces¬ 
sary, therefore, to convert the plant flow diagram into a net¬ 
work of relatively simple blocks such as series or parallel 

The plant availability determined using a logic flow 
diagram may be the mean availability or the availability 
density function. Usually the calculation is limited to the 
former. There are two main methods of determining the 
mean availability of the plant. In many cases the avail¬ 
ability data are the mean availabilities of the units which 
constitute the plant. Typical units might be a tank-pump 
system, a complete distillation column or a set of cen¬ 
trifuges. The mean unavailability of a unit is effectively a 
fractional dead time or probability of being unavailable. 
Then the mean availability of the plant may be calculated 
from the mean unavailabilities of these units. 

In other cases the availability data obtainable are the 
failure rates and repair times of the equipments which 
constitute the units. Typical equipments are a pump, a heat 
exchanger or a drier. The mean unavailability, or fractional 
dead time, of an equipment may be calculated from the 
failure rate and repair time data using Equation 7.13.10. The 
fractional dead time of the unit may be calculated from 
those of the constituent equipments. Then the mean 
unavailability of the plant may again be calculated from 
the unavailabilities of the units. The mean repair time of 
the plant may be determined by calculating the failure rate 
and the mean unavailability. 

It is also possible, however, to express the unit avail¬ 
abilities as throughput density functions, and in this case 
the plant availability is also a throughput density function. 
This may be obtained from the logic flow diagram by Monte 
Carlo simulation in a manner similar to that used in fault 
tree evaluation, as described in Chapter 9. 

7.13.8 Throughput capability method 

There is an alternative method, which allows the system 
availabilities to be expressed as throughput densities and 
still avoid the use of simulation (G.D.M. Pearson, 1975). The 
method involves converting the system into a series system 
and determining successively the limiting throughputs. 

As an illustration, consider the distillation plant system 
flow diagram given by Pearson and shown in Figure 7.14(a). 
The corresponding availability block diagram is given in 
Figure 7.14(b). The path (11) affects the operation of paths 
(2,6,7,9) and (1, 5) and therefore takes the position shown, 
while side paths (13) and (14) affect the operation of the 
main forward path and are therefore shown there. The main 


forward path is also affected by the single supplies of elec¬ 
tricity, high pressure steam and cooling water. The units 
(1-2) can be reduced to an equivalent but simplified block 
diagram, as shown in Figure 7.14(c). This is a complex 
subsystem, which cannot be resolved into simple series or 
parallel systems. 

The throughput capability of the system is evaluated by 
series and parallel state enumeration techniques. The 
series enumeration technique is as follows. All the stages of 
the system, that is, the units or the subsystems, are treated 
together as a series system. The throughput levels of the 
system are considered in turn, starting at zero throughput 
and rising to full throughput. At each level there is a stage 
which has the lowest throughput capability and limits the 
system throughput capability; this is the ‘bottleneck’ stage. 
The probability that the system has this throughput is 
determined by the probability that this bottleneck stage is 
in this state. The throughput capability of the bottleneck 
stage is then increased to its next discrete level. A new 
bottleneck stage is then identified and the procedure is 
repeated. Table 7.14 shows the throughput capabilities for a 
system of 10 identical process units with throughput cap¬ 
abilities as given in Table 7.13. The corresponding plot of 
system throughput capabilities is illustrated in Figure 7.15. 
This is the throughput density function of the system. The 
mean throughput capability of a single unit is 0.943 and 
that of the system is 0.557. 

The parallel path enumeration technique is as follows. 
Only two stages of the system are considered at a time. The 
throughput density function of this subsystem is obtained 
by summing the discrete throughput capabilities of the two 
stages and multiplying the corresponding probabilities. If 
in the original system there are more than two stages in 
parallel, this subsystem and the next parallel stage are then 
considered and the procedure repeated. 

Further details of the throughput capability method, 
including the application of the state enumeration technique 
to complex subsystems, are given by G.D.M. Pearson (1975). 

7.13.9 Flowsheeting and simulation methods 

Flowsheeting methods and, in particular, computer flow¬ 
sheeting programs, may also be used to determine plant 
availability.The use of this approach has been described by 
Holmes (1976). 

7.13.10 Storage 

Plant availability is affected by storage, which introduces 
flexibility, and may allow units upstream or downstream of 
a failed unit to continue in operation for a time. Methods 
of determining the effect of storage on plant availability 
have been discussed by Holmes (1976) and by Henley and 
Hoshino (1977). 

There are two main classes of storage tank: (1) raw 
material and product storage tanks, and (2) intermediate 
storage tanks. Storage tanks are provided for various rea¬ 
sons, some of which have nothing to do with plant avail¬ 
ability. Raw material and product storage tanks are used to 
smooth deliveries and collections and to blend materials. 
Intermediate storage tanks are also used to smooth fluc¬ 
tuations and to blend intermediates. 

As an illustration, consider the simplest system with 
intermediate storage capacity of an upstream unit, an 
intermediate storage tank and a downstream unit. This 
system and its operating policies have been investigated by 
Henley and Hoshino (1977). 



7/36 RELIABILITY ENGINEERING 



Distillation 

column 


Q 


□ 



Figure 7.14 Distillation plant system (G.D.M. Pearson, 1975): (a) flow diagram of system; (b) availability block 
diagram of system; (c) equivalent block diagram of units 1-2. ES, electricty supply; HPS, high pressure 
steam; CW, cooling water (Reproduced by permission of the University of Nottingham) 
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Table 7.14 Throughput capabilities of a process system 
(G.D.M. Pearson, 1975) (Courtesy of the University of 
Nottingham) 


Throughput capability 
(fraction of normal throughput) 

Probability 

0 

0.300 

0.025 

0.102 

0.050 

0.031 

0.800 

0.006 

0.850 

0.012 

0.900 

0.029 

0.925 

0.038 

0.950 

0.050 

0.975 

0.086 

1.000 

0.349 



Figure 7.15 Throughput density for a process system 
(G.D.M. Pearson, 1975) (Reproduced by permission of the 
University of Nottingham) 


Some basic operating policies are: (1) to keep the tank 
filled if possible, (2) to keep the tank empty if possible, (3) to 
keep the tank half full if possible and (4) to allow the tank 
level to fluctuate. The appropriate operating policy 
depends on the objectives to be achieved by the use of the 
storage. It is convenient to consider initially only the 
improvement of plant availability. 

The policy necessary to maximize plant availability 
depends on the relative maximum capacities and failure 
rates of the upstream and downstream units. If the capac¬ 
ities and failure rates are equal, the appropriate policy is to 
run with the tank half full, emptying and filling during 
unit failures. If the capacity of the upstream unit is higher 
but its failure rate is also higher, the appropriate policy is to 
run with the tank full, filling during normal operation or 
downstream unit failure. If the capacity of the downstream 
unit is higher, but its failure rate is also higher, the appro¬ 
priate policy is to run with the tank empty, emptying dur¬ 
ing normal operation or upstream unit failure. A general 
principle underlying these policies is that unit production 
is not interrupted merely in order to fill or empty the tank. 

It may be necessary, however, to adopt other policies 
which have objectives other than improvement of plant 
availability. Thus, if the shut-down of the downstream unit 
is relatively hazardous or difficult or if the output of the 
upstream unit needs to be blended, the policy adopted 
may be to run with the tank full. On the other hand, if the 


Table 7.15 Plant availability example: unit throughput 
capabilities 



Throughput 
capability ( m 3 /h) 

Probability 

Upstream unit 

0 

0.02 


95 

0.03 


100 

0.95 

Downstream unit 

0 

0.04 


90 

0.06 


100 

0.90 


shut-down of the upstream unit is relatively hazardous or 
difficult, the policy adopted may be to run with the tank 
empty. 

For certain defined cases, a relatively simple treatment is 
possible. One such case, described by Henley and Hoshino 
(1977), is that of an upstream unit with excess capacity. It is 
assumed that the time required to fill the tank using this 
excess capacity is much less than the mean time to failure of 
the upstream unit and that the operating policy is to keep the 
tank full. Then it can be shown that the following relation¬ 
ships apply: 

[7.13.26] 

1 + A u Wr„ 1 j 

Fst = kV s [7.13.27] 

k = exp(-T e /m m ) [7.13.28] 


fe[A»/(l + *»«ru)] 
st i -^ww/a+vw™)] 


[7.13.29] 


where m TU is the mean repair time of the upstream unit, T e is 
the time required to empty the tank, F s is the unavail¬ 
ability of the upstream unit, F st is the unavailability of 
the upstream unit + the tank, /l st is the failure rate of the 
upstream unit + the tank, and ^ is the failure rate of 
the upstream unit. 

A fuller treatment of this and other cases is given by 
Henley and Hoshino (1977). 

The problem of the effect of storage has also been treated 
byCoker(1978),whohasextendedthethroughputcapability 
method of Pearson to take account of storage. The system 
considered is anupstreamunit, anintermediate storage tank 
and a downstream unit. The states of the storage are defined 
as discrete levels of storage, or hold-ups. These states are 
then determined using a discrete-state, discrete-time 
steady-state Markov model, as described in Section 7.10. 

As an illustration of the method, consider the system 
given by Coker in which the throughput capabilities of 
the upstream and downstream units are as shown in 
Table 7.15 and in which the tank capacity is 15 m 3 . Then 
the probability of a net inflow of 100 m 3 into the tank is 
0.95 x 0.04 = 0.038. The probabilities of the other net 
inflows may be calculated in a similar manner. It should be 
noted that a zero net inflow is obtained both for a flow of 
0 m 3 /h in both units and for one of 100 m 3 /h in both units. 
The probability distribution of net inflow is then as shown 
inTable7.16. 

Now assume that the states of the tank are defined as 
hold-ups of 0, 5,10 and 15 m 3 . The transition probabilities, 
which are the elements of the matrix A in Equation 7.10.37, 
are determined by considering the possible changes in tank 
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Table 7.16 Plant availability example: 
probability of net inflow 

Net inflow into tank (m 3 /h) 

Probability 

100 

0.0380 

95 

0.0012 

10 

0.0570 

5 

0.0018 

0 

0.8558 

-5 

0.0270 

-90 

0.0012 

-100 

0.0180 


hold-up and the net flow differences which can produce 
such changes, and then summing the probabilities of these 
net flows. Thus for a hold-up ‘change’ of 0 to 0 m 3 the 
net flows which can cause this change are 0, -5, —90 and 
-100 m 3 /h. Then the transition probability between an 
initial hold-up state of 0 m 3 and a final state of 0 m 3 is: 

0.8558 + 0.027 + 0.0012 + 0.018 = 0.902 


Table 7.17 Plant a vailability exam¬ 
ple: probabilities of tank holdup 


Tank holdup (m 3 ) 

Probability 

0 

0.1722 

5 

0.0363 

10 

0.1826 

15 

0.6089 

Table 7.18 Plant a vailability example: system 
throughput capabilities calculated in the example 

Throughput capability of 
system (m 3 /h) 

Probability 

0 

0.0433 

5 

0.0007 

10 

0.0035 

15 

0.0167 

90 

0.0588 

95 

0.0046 

100 

0.8774 


The other transition probabilities may be calculated in a 
similar manner. The transition matrix is then: 

'0.9020 0.0018 0.0570 0.0392' 

0.0462 0.8558 0.0018 0.0962 
0.0192 0.0270 0.8558 0.0980 
0.0192 0 0.0270 0.9538_ 

Then application of Equation 7.10.37 gives the probabilities 
of tank hold-up listed in Table 7.17. 

Thethroughputcapabilityofthesystemisnowcalculated. 
A throughput capability of 10 m 3 /h occurs when the 
throughput capabilities of the upstream and downstream 
units are 0 m 3 and 90 or 100 m 3 , respectively.The probability 
of a system throughput capability of 10 m 3 /h is: 

0.02 x 0.1826 x (0.06 + 0.90) = 0.0035 


Then: 


P(A|B)i® 


P(B\A)P(A) 

P(B | A)P{A) + P(B | A)P{A) 


[7.14.3] 


In this equation the term P(A) is known as the prior prob¬ 
ability, P(A | B) as the posterior probability and P(B \ A) as 
the likelihood. 

Equation 7.14.3 may also be reformulated to accom¬ 
modate multiple outcomes. If the event A has n outcomes 


P(Aj\B) = 


P(B | Aj)P(Aj) 
T,liP(B\Aj)P(Ai) 


[7.14.4] 


7.14.2 Hypothesis formulation 

Equation 7.14.3 may also be written in terms of a hypothesis 
H and an event E, which serves to confirm or deny the 
hypothesis: 


The other throughput capabilities may be calculated in ; 
similar manner. The result obtained is given in Table 7.18. 


P(H\E) = 


P(E | H)P(H) 

P(E | H)P(H) + P(E | H)P{H) 


[7.14.5] 


7.14 Bayes’ Theorem 

It frequently occurs in reliability engineering that there is a 
need to test a hypothesis or to revise an estimate in the light 
of additional information. A powerful tool for handling 
such problems is Bayes’ theorem. Accounts of Bayes’ theo¬ 
rem include those given in Introduction to Probability and 
Statistics from a Bayesian Viewpoint (Lindley, 1965), and 
those by Savage (1962a), Brand (1980) and Kaplan (1983). 
Its use in expert systems is discussed by Michie (1979). 

7.14.1 Basic formulation 

A basic formulation of Bayes’ theorem is as follows. Con¬ 
sider the probability of the joint event AB. If the event A has 
two outcomes A and A: 


7.14.3 Continuous formulation 

There is also a continuous formulation of Bayes’ theorem in 
terms of distributions. If X is a random variable, its density 
function may be written as fjfx). Then a formulation of 
Bayes’ theorem in terms of such distributions is: 

(7.116] 

But 

fx(x) = p fx\Y(x\y)fr(y) Ay [7.14.7] 


P{AB) = P(A | B)P(B) 
= P(B | A)P[A) 


[7.14.1] 

[7.14.2] 


fv\xiy\x) = 


fotr(*|jy)/r(y) 

fZ 0 fx\Y(x\y)f Y (y)dy 
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7.14.4 Failure rate estimation 

A common problem in reliability work is the estimation of a 
failure rate and the revision of this estimate as more infor¬ 
mation becomes available. A typical situation might be that 
the initial estimate is one obtained from the literature 
which it is desired to revise in the light of works data. 

If the failure rate is considered as a random variable, its 
density function may be written as/A(2). The field data are 

assumed to be available as times to failure 4. t„. Then 

from Equation 7.14.8, for the first time to failure 4- 


/a|ti(^ 14) = 


/ti|a(4W/aW 

H,/ti|a(4W/a(X)cU 


[7.14.9] 


At this stage the formulation is a general one. Its applica¬ 
tion may be illustrated by considering the common case of 
the revision of an initial estimate of the failure rate in the 
exponential distribution. In the terminology used here the 
exponential distribution itself may be written in terms of 
the random variable T: 


fr(t) = Aexp(-Af) t>0 
mO t< 0 


[7.14.10a] 

[7.14.10b] 


If A is now considered to be a random variable, to be esti¬ 
mated on the basis of observed values of T, the exponential 
distribution just given may be rewritten as 

= 2exp(-Af) t> 0 [7.14.11a] 

f<0 [7.14.11b] 

Since the failure rate is to be treated as a random variable, it 
is necessary to specify the form of the distribution which it 
follows. The distribution assumed is again the exponential 
distribution, so that 


f A (X) = nexp(-nX) f.14.12] 

where n is the parameter of this distribution. Its dimen¬ 
sions are time, or lifetime, being the inverse of those of X. 
Then, from Equations 7.14.9,7.14.11 and 7.14.12 


/a|7i(^ 11! *9 


X exp( —Xti) n exp( - nX) 
J^°(Aexp(-24)/iexp(-/rA) d2 


[7.14.13] 


which yields 


f\\Ti[X 14) = X(fi + 4 f exp [-(fi + h)X] X>0 

[7.14.14a] 

= 0 A<0 

[7.14.14b] 


By extension to further times to failure 4,..., 4, it can be 
shown that 


/a|71 |4,-. •,4 ) 

= n\ {* + t^ *) exp [~ + S ^ f- 14 - 15 ] 

From this density function the mean value is determined in 
the usual way, the quantity obtained being the estimate A of 
the mean: 


The required result is thus: 


h + E”=,4 


[7.14.17] 


The estimate t of the mean life, or MTBF, is obtained as the 
inverse of that of the failure rate: 


f = *L±J2=i*i [7.14.18] 

This equation shows that for the case of the exponential 
distribution the estimate of the mean life is the average of 
the prior estimate and of the observed values times to 
failure. 

As an illustration, consider the case where there is for an 
equipment a prior estimate n of the time to failure of 8 
months which is to be revised in the light of four further 
measurements (n = 4) of the times to failure of 17, 13, 18 
and 12 (4 to 4)- Then from Equation 7.14.18 the estimated 
values are: 


. 8+(17+13 +18+12) 

4+1 

it 13.6 months 
A = 0.074 failures/month 

7.15 Renewal Theory 

Another technique for the analysis of repairable systems is 
renewal theory. Accounts of renewal theory are given in 
Renewal Theory (D.R. Cox, 1962) and by Shooman (1968a) 
and G.H. Mitchell (1972). 

Renewal theory is illustrated here by considering the 
case of a single component system with instantaneous 
replacement of the component when it fails by another 
component. The theory is developed initially for the case 
where each replacement may be by a component with dif¬ 
ferent failure characteristics. 

Let system failures occur at time intervals 4, 4. 

f„.Then the system operating time t„ to n renewals is: 

t b = 4 + 4 + • ■ ■ + 4 |7.15.1] 

The density function/ T „(f) of r„ is obtained by convolution 

of the individual density functions/i(/),/ 2 (f), • • .,/„(f).This 
is handled most easily in the Laplace domain. Then taking 
Laplace transforms, the convolution becomes: 

Ms)=fi(s)-f 2 (s)---fn(s) [7.15.2] 

For simplicity, consideration is now limited to the case 
where replacement is by identical components. Then 
Equation 7.15.2 becomes: 

Ms) = [f(s)] n 17.15.3] 

The probability that the «th renewal occurs before or at 
time t is given by the distribution function: 

F m (t)= J‘ut)dt 


A = J ™14.4) AX 


[7.14.16] 


[7.15.4] 
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The mean, or expected, value of the time for n renewals is: 

E[x n } = J°° tf rn (t) it 17.15.5] 

The probability of the number N of renewals occurring 
exactly at time/is: 

P(N = n) = F,„(t) - F m+1 (t) |7.15.6] 

The mean, or expected, value of N renewals in time t is: 

E[N\ = f2n p ( N = n ) 

From Equations 7.15.6 and 7.15.7 

i(f)] 

Expanding the terms in Equation 7.15.8, it canbe shown that: 

m = fif-W [7.15.9] 

The application of these relationships may be illustrated by 
considering the case where the components have an expo¬ 
nential failure distribution with constant failure rate 1, so 
that the density function is: 

f(t) = Xexp(-Xt) [7.15.10] 


and from Equation 7.15.5 the mean value 
E[xl] = tXexp(-Xt) At [7.15.17] 

r 1/1 [7.15.18] 

Furthermore, the probability given in Equation 7.15.6 may 
be written, by using Equation 7.15.4, as: 

P(N = n) = J f„(t) df - jT /™ +1 (f) df [7.15.19] 

Substituting Equation 7.15.13 in this equation yields 

P(N = n) = J^X ^ ^ _ xfj At 

- j X^-exp(-Xt)dt [7.15.20] 

which can be shown to reduce to 

P(N = n) = exp( -Xt) [7.15.21] 

Again, for the case of the first renewal (« = 1) 

P(N = 1) » Xt exp(-lf) [7.15.22] 

and 

= !>„(/) [7.15.23] 


[7.15.7] 


[7.15.8] 


Taking Laplace transforms 


But, using Equation 7.15.4 and then taking Laplace trans- 


[71511] P*)J& 


[7.15.24] 


and then substituting Equation 7.15.11 into Equation 7.15.3 
yields 


Us) = J [7.15.12] 

Inverting back into the time domain gives: 

ut) =l^y I exp ( -lf ) [7.15.13] 

This equation is the Erlangian operating time density 
function. 

The distribution function of Equation 7.15.4 may be 
integrated using the expression for the density function 
given in Equation 7.15.13. For example, for the first renewal 
(n = 1 ) 


From Equation 7.15.3 


F m (s) => 


[/(*)]" 


Then 


j?pv( S )]=~|>£sr 


-^i/W+/(*)* + •'-3 
i As) 
sl-f(s) 


Substituting from Equation 7.15.11: 


[7.15.25] 


[7.15.26] 

[7.15.27] 

[7.15.28] 


/ T i(f) m lexp(-Af) 

Hence the distribution function is: 

[7.15.14] 

F xl (t) = j\m p[-(Af)]df 

[7.15.15] 

• 1 — exp( -Xt) 

[7.15.16] 


|7 - 15 - 291 

= 1/s 2 [7.15.30] 

Inverting into the time domain: 

E[N] = Xt 


[7.15.31] 
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7.16 Replacement Models 

One of the principal decisions in the maintenance of plant is 
whether to replace an equipment. Support for such deci¬ 
sions is provided by replacement theory. Treatments of 
replacement are given by Dean (1963), Hastings (1970), 
Jardine (1970a,b) and Mitchell (1972). 

Some reasons for replacing an equipment are that: (1) it 
has failed, (2) it is about to fail, (3) it has deteriorated and 
(4) an improved version has become available. 

In most replacement models the quantity sought is the 
overall economic optimum. Some models treat the problem 
solely in terms of the equipment, whilst others take into 
account the effects on the process either of outright failure 
or of deterioration of the equipment. Another distinction is 
between models which allow for the time to effect the 
replacement and those which do not. 

A somewhat different model is required where the case 
considered is that exemplified by the lightbulb replace¬ 
ment problem. Here the cost of the actual replacement 
actions is high and has a significant influence on the 
result. This type is known as a ‘group replacement model’. 
Treatments are given by Bartholemew (1963) and Naik and 
Nair (1965). 

Other cases to be considered include replacement as 
opportunity arises, possibly during a major shut-down, 
and replacement of an equipment which cannot be repaired 
to the ‘as new’ condition. 

In general, for simple items which are used in large 
numbers, what is required is straightforward rules, while 
for more complex individual equipment a more detailed 
analysis may be justified. 

If the time-scale over which replacement occurs extends 
over a number of years, it may be necessary to allow for the 
change in the value of money using a technique such as net 
present value. 

A common type of replacement model is that which con¬ 
siders only the equipment and determines the optimum 
trade-off between capital cost and operating cost. It is 
necessarily assumed that the latter increases with time, 
since if it does not, the best policy is to run the equipment 
until it fails. A replacement model of this type has been 
given by G.H. Mitchell (1972) and is as follows: 

C=fc5+ijf/(f)d/ [7.181] 

where C is the average annual cost of operation, C c is the 
capital cost of the equipment, /(/) is the rate of expendi¬ 
ture on maintenance, t is time, and S is the scrap value of 
the equipment. As just stated, f(f) is taken to increase 
with time t. Then it can be shown by differentiating 
Equation 7.16.1 that the average annual cost is a mini¬ 
mum when 

f m dt=c [7 - 16 - 2] 

Thus the equipment should be replaced when the current 
maintenance cost becomes equal to the average annual cost 
to date. 

Further replacement models are given by Jardine (1970a) 
who treats the cases of failure replacement + preventive 
replacement, where the latter is (1) fixed-term and (2) based 
on equipment age. 


7.17 Models of Failure: Strength load Interaction 

7.17.1 Strength and load 

Failure occurs when the load on a component exceeds the 
strength or, more generally, when the duty exceeds the 
capability. There are various factors which may cause 
the load to be higher, or the strength lower, than expected. 
Factors which increase stress include: internal residual 
stresses and stress raisers; reductions of cross-sectional 
area due to size variations in manufacture, wear and cor¬ 
rosion; and applications of the component different from 
that for which it was designed. Factors which reduce 
strength include quality variations in manufacture, 
defects, fatigue and creep. 

7.17.2 Safety factor and safety margin 

The traditional method of allowing for factors which 
increase stress or reduce strength is the use of a safety 
factor. The approach has been to define the safety factor as 
the ratio of the mean of the strength to that of the load, both 
mean values being assumed constant. This is a determin¬ 
istic approach, and increasingly it is being superseded by a 
probabilistic approach which allows for the variability of 
both strength and load. This does not mean, however, that 
concepts of the safety factor, and the associated safety 
margin, are abandoned, but merely that they are redefined, 
as described below. 

7.17.3 Deterministic approach: mean of strength and load 

Traditional safety factors are shown in Figure 7.16. The 
design safety margin (the difference between the design 
strength and the design stress) and the design safety factor 
(the ratio of the design strength and the design stress) are 
normally substantial. However, by the time account is 
taken of the margin of ignorance, which is the sum of the 
increases in stress and the decreases in strength, the actual 
safety margin and safety factor are greatly reduced. 




=B^\yc\\Ti ='l/y/ 


Stress 

A Assumed static strength 

B Design working stress 

C Factors increasing stress: internal residual stresses, 
stress raisers, size variations in manufacture, wear, 
corrosion 

D Factors reducing strength: quality variations in 
manufacture, defects, fatigue, creep 
Design safety margin = A — B 
Margin of ignorance = C + D 
Actual safety margin = A — (B + C+D) = E 
Design safety factor = A/B 
Actual safety factor = A/(B + C + D) 

Figure 7.16 Design and actual safety factors and 

margins 
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This reduction in the design safety factor is important. 
The actual safety factor is often much less than might be 
supposed and the potential causes of reduction in the 
safety factor need to be given close attention. As stated 
earlier, this approach is based essentially on the means of 
the strength and of the load. 


7.17.4 Probabilistic approach: variability of 
strength and load 

The weakness of the approach just described is that it does 
not take into account the variability of the strength and of the 
load. A more realistic representation of failure is shown in 
Figure 7.17. Both the strength and the load can be expressed 
as density functions characterized by a mean and a spread. 
Failure occurs when the tails of the distributions overlap and 
create an area where the load exceeds the strength. 


7.17.5 Interference theory 

The effect of this interaction between load and strength can 
be quantified using interference theory. Accounts of inter¬ 
ference theory are given by Lloyd and Lipow (1962) and 
von Alven (1964). In this subsection an account is given of 
the basic theory. A failure model based on the interference 
approach is given in Section 7.17. 

The basic approach may be illustrated by considering the 
case where the variabilities of the load and the strength can 
each be represented by a normal distribution. Then the joint 
density function g(z) for the load to exceed the strength is: 

g(z) = j a f{x)f(x - z) d* dz [7.17.1; 


z = *-y [!7,17Jf 

where f(x) is the density function of the load x, fly) is the 
density function of the strength y (= x — z), and z is the 
difference between x andy. 

A safety parameter may be defined as: 

<t> = S/L ;j7.17.3] 



Figure 7.17 Effect of variability of strength and load on 
failure (A.D.S. Carter, 1973) (Reproduced by permission of 
the Institution of Mechanical Engineers) 


where L is the load, S is the strength, and 4> is the safety 
parameter. The variability of the load and the strength may 
be written as: 


[7.17.4] 

[7.17.5] 


S — my - Hydy 

Since the load has a normal distribution, its density func- 
_ (x - m x ) 1 fef# cl 


Similarly, the density function of strength is 

0 - %) 2 1 


m 


exp - 


2of 


[7.17.7] 


o>(2<r 

From Equations 7.17.1,7.17.6 and 7.17.7, it can be shown that: 

(z + vriy m x f\ 


8(z) = 


[2vt(of + of] 1 


2 exp - 


2(of + of) 


[7.17.8] 


and standard deviation 
o 2 = ( o 2 + of)V 2 


G(z)= jf°g(z)dz 

which may be integrated to give 

“ = (o| + of) 1/2 


[7.17.13] 

[7.17.14] 


m x = 1; <s x = o y = 0.4; n x = ny = 2; <j> = 1.25 
From Equations 7.17.3-7.17.5, 
m y = 3.05 

and from Equation 7.17.13 
a = 3.6 
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Then evaluating the distribution function in Equation 
7.17.12 using statistical tables for the integral of the dis¬ 
tribution function of the normal distribution between 3.6 
and oo, the value is found to be of the order of 0.0001, indi¬ 
cating that the load may be expected to exceed the strength 
once in every 10,000 loadings. 

7.17.6 Carter’s rough loading model 

A theory of failure based on the overlap of the strength and 
load distributions has been developed by A.D.S. Carter 
(1973). The approach is illustrated in Figure 7.17 and is 
broadly as follows. 

Initially, a component has a strength s 0 but this gradu¬ 
ally deteriorates so that by the fth application of load the 
strength is reduced to s 0 - As,-. The probability (Pi) of 
obtaining a component with initial strength lying between 
Sq and So + ds is; 

Pi = S(s 0 ) ds ptl7.15] 

The probability (P 2 ) of encountering a load which is less 
thanso-Asiis: 

p 2 - I* M L(s) ds jji.17.16] 

Then the probability (P 3 ) of encountering a load which is 
less than the current strength of the component the 
initial strength of which is s 0 in any of the n applications of 


P3= t\£ 


[7.17.17] 


And the probability (P4) of obtaining a component of initial 
strength s 0 and of encountering a load which over n appli¬ 
cations is always less than its strength: 

ft = S(s 0 ) ds fj j*‘ ' L(s) ds [7.17.18 

Then the reliability of the component is: 

m = J™ S(s) n [ L(s) ds] ds [7.17.19] 


The decrements of strength As,- may be expressed in terms 
of a constant scaling factor <7 and a shaping factor f(i): 

A si = of(i) [7.17.20] 

m=(i-l)P [7.17.21] 

where p < 1 gives a fatigue-type curve; p = 1 gives a corro¬ 
sion deterioration-type curve; and p > 1 gives an erosion/ 
wear-type curve. 

The hazard rate z is then obtained from the relationship: 


z(n) ~ - 


1 d R(n) 
R(n) At 


[7.17.22] 


If preferred, n may be replaced by kt to give the reliability 
as a function of time. 

The quantities in Equation 7.17.19 are not normally 
known, but the theory can be used to explore the implica¬ 
tions of making various assumptions. In Carter’s work this 
was done by expressing S(s) and L(s) as Weibull distribu¬ 
tions with the shape factor /? given a value of 3.44 to 
approximate normal distributions. Various values of the 
means S and L and standard deviations <x s and a L of the 
strength and load distributions were investigated. Three 
regimes were distinguished 

at < A s smooth loading 

at = a s medium loading 

at » o s rough loading 

The following quantities were defined: 

S/L safety factor 

at/os roughness of loading 

S-L f *. 

7 - 7 -— 777 ^ safety margin 

(al + alf 2 

This definition of safety margin is different from that con¬ 
ventionally used, as described above. 

Some examples of hazard rate curves obtained by Carter 
are shown in Figure 7.18. The values of a s and at were cho¬ 
sen to give a safety margin of six standard deviations and 
the scaling factor a was chosen to give As 10 o = 2.333. These 
results throw considerable doubt on the applicability of the 
bathtub curve to mechanical components. 



curve 1 S — L = 1.0 p = 0.2 medium loading 

curve 2 S-L= 1.0 p = 1.0 medium loading 

curve 3 S — L = 1.333 p = 0.2 smooth loading 

curve 4 S-L= 1.666 p = 0.2 rough loading 

curve 5 S - L = 1.666 p = 3.0 rough loading 

Figure 7.18 Effect of mean and spread of strength and 
load on hazard rate (A.D.S. Carter, 1973) (Reproduced by 
permission of the Institution of Mechanical Engineers) 














7/44 RELIABILITY ENGINEERING 


7.18 Models of Failure: Some Other Models 

7.18.1 Bathtub curve revisited 

As already indicated, the original bathtub curve concept 
has come in for a good deal of criticism. Frequently it 
appears that it is honoured more in the breach than the 
observance. The rough loading theory of Carter gives one 
indication why this should be so. 

A modern critique of the concept is that by Moubray 
(1991), who gives instead the failure patterns shown in 
Figure 7.19. Moubray states that studies on civil aircraft 
have shown the following distribution of patterns of failure 
in terms of the curves in Figure 7.19: 

A 4% D 7% 

B 2% E 14% 

C 5% F 68% 

Discussion of these features is taken up again in Section 7.19. 

7.18.2 Lightbulb curve 

Systems with large numbers of components often tend to 
exhibit a constant hazard rate. This is readily understood 
intuitively in terms of a smoothing out of particular hazard 
rate characteristics of individual components. 

The phenomenon is well illustrated by the so-called 
‘lightbulb curve’ shown in Figure 7.20. If a building is pro¬ 
vided with new lightbulbs throughout, then assuming that 
these fail by wearout with a normal distribution and that the 
failed bulbs are replaced each day, the number of failures 
recorded per day will be as shown in the figure. The dotted 


curves (a)-(e) show the numbers actually failing, and the 
horizontal ull line shows the constant numberof failures per 
daytowhichthesystemistending.Eachsuccessivecurvehas 
a smaller modal value and higher spread than the previous 
one. Eventually the number of failures recorded per day will 
become constant. If the lighting systemof the building taken 
as a whole is considered as a series system, then when 
the number of bulb failures has become constant, the system 
hazard rate is also constant, so that the system itself appears 
to have an exponential failure distribution, although its 
components have a normal failure distribution. 


7.18.3 Drenick’s theorem 

A theoretical demonstration that systems with many com¬ 
ponents tend to have a constant hazard rate is given by 
Drenick’s theorem (Drenick, 1960). A modified version of 
this theorem has been given by Shooman (1968a). For an 
^-component series system, from Equation (7.6.4): 

In R[t) = - Efl,'(f)«4 E jf «(0 dt 17-18.r 

Assume that the hazard rates for small values of t can be 
expressed as 

Zi = Oi + b t r J7.18.2] 

the value of m being the highest found for the n compo¬ 
nents. Then 




B 


C 




Figure 7. 19 Some patterns of equipment hazard rate, including and additional to the bathtub curve (Moubray, 1991) 
(Courtesy of Butterworth-Heinemann) 
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Figure 7.20 The lightbulb curve 


In R{x)m^t-k^ 

i“|> 
k =(^li bi 

T = lt 

Assuming that as n —»oo, I —* oo, and that k is bounded, 
then as n —> oo 

In R(z) = -t [7.18.7] 

and hence 

R(t) = exp {-It) [7.18.8] 

The theorem assumes that the system has a series struc¬ 
ture. If the system contains parallel paths, the treatment is 
pessimistic. In practice, there are many systems which are 
well fitted by the theorem, but also many which are not. 
The equation 

*=!>/(» + 1)2 

is bounded, provided at least one z,{0) ^ 0. Its rate of con¬ 
vergence depends, however, on the number of components 
for which z t { 0) = 0. If these are numerous, the convergence 
is slow. 

The implications of this theorem are considered in more 
detail by Shooman (1968a). 


7.19 Failure Behaviour and Regimes 

7.19.1 Failure regimes 

The measures which can be taken to reduce failure depend 
very largely on the failure regime of the equipment. The 
three regimes are: (1) decreasing hazard rate (2) constant 
hazard rate and (3) increasing hazard rate. The bathtub 
curve illustrates these three regimes but, as indicated, 
this model is honoured as much in the breach as in the 


observance. However, this does not alter the fact that the 
failure regime must be one or other of those just listed. 

The failure regime of an equipment may be identified 
using the methods described in Section 7.20. In particular, 
the failure data may be fitted to the Weibull distribution. 
The relationship between the failure regime and the 
Weibull shape factor p is: 

P < 1 decreasing hazard rate (early failure); 

P = 1 constant hazard rate (constant failure); 

P > 1 increasing hazard rate (wearout failure). 

7.19.2 Catastrophic failure vs tolerance failure 

Some failures occur suddenly, whilst others develop much 
more gradually. In early work the two types were often 
called ‘catastrophic failure’ and ‘tolerance failure’. These 
terms were not well chosen. There is no implication that a 
catastrophic failure has any consequences wider than the 
failure itself. Nor is there any implication that catastrophic 
failures occur early in life or tolerance failures late in life. 

Tolerance failures are associated with the interaction 
between the component and the system. Catastrophic fail¬ 
ures have a greater tendency to occur independently of the 
system. 

7.19.3 Bimodal failure distributions 

Analysis of failure data not infrequently yields a failure 
density function with two distinct peaks, indicating a 
bimodal distribution. Such a density function may he 
written as 

m=Pfi(t) + (l-p)f 2 (t) (7.19.1] 

where p is a weighting factor. As described below, early 
failure can give rise to a bimodal failure distribution. 

7.19.4 Wearout failure 

Two principal types of failure are wearout failure and early 
failure. These are now considered in more detail. The dis¬ 
cussion here is limited to failure itself and discussion of the 
determination of the type of failure by data analysis and of 
maintenance policies appropriate to the types of failure is 
deferred to later sections. 

Failure by wearout is one of the principal failure regimes 
of industrial equipment. Some of the causes of wearout are: 
(1) fatigue, (2) wear, (3) corrosion and (4) erosion. It is often 
associated with contact with process materials. 


[7.18.3] 

[7.18.4] 

[7.18.5] 

[7.18.6] 
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Wearout failure is a common experience with everyday 
objects such as clothes and tools. It is natural, therefore, 
that there should be carried over from this a preconception 
that it is the dominant mode in industrial equipment but, as 
just indicated, this can be misleading. 

In the results quoted in Section 7.18 for failures in civil 
aircraft, only some 6 % are classified as in some way involv¬ 
ing wearout (patterns A and B). In the process industries 
the overall operating environment is probably conducive to 
a higher proportion of wearout failures, but how much 
higher is uncertain. 


7.19.5 Early failure 

Another of the principal failure regimes of industrial 
equipment is early failure. Although initially perceived as 
failure due essentially to premature failure of weak com¬ 
ponents, there is now better understanding that there is 
more to early failure than this, and that it can be the domi¬ 
nant mode. In particular, it is now appreciated that early 
failure in the sense of a decreasing hazard rate is a phe¬ 
nomenon which is not confined to new equipment but is 
often exhibited by old equipment. The proportion of early 
failure in the results for civil aircraft quoted in Section 7.18 
is 68% (patternF). 

Causes of early failure may be grouped under three 
headings: (1) those which result in failure of newly 
commissioned equipment, (2) those which result in failure 
of equipment which has been operating for some time and 
(3) those associated with start-up and shut-down stresses, 
whether on new or old equipment. Among the former causes, 
in design and commissioning, are: (1) incorrect design 
specification, (2) incorrect design, (3) incorrect user speci¬ 
fication and selection, (4) incorrect manufacture, (5) incor¬ 
rect installation and (6) incorrect commissioning and 
initial operation. 

Causes of early failure in equipment with a longer oper¬ 
ating history, centre on the quality of the maintenance and 
include: (1) incorrect fault identification, (2) incorrect 
repair technique, (3) incorrect replacement parts, (4) incor¬ 
rect reassembly and alignment, (5) dirty working condi¬ 
tions and (6) disturbance to other parts of the equipment. 
The effect of such failings is that the equipment is not fully 
restored to the ‘as new’ condition after repair or overhaul. 
Underlying these causes of early failure due to main¬ 
tenance are two more fundamental causes. One is the con¬ 
duct of unnecessary preventive maintenance (PM). The 
other is inadequate training and/or discipline of main¬ 
tenance personnel. 

The third group of causes of early failure is the mechani¬ 
cal and thermal stresses associated with plant start-up and 
shut-down. 

Evidence of early failure in process equipment was found 
in a study by Berg (1977) who investigated some 600 cen¬ 
trifugal and air vacuum pumps and some 200 bottom run-off 
valves and found values of the shape parameter /J ranging 
from 0.735 to 1.072. Aird (1977b) obtained values of P as 
low as 0.5 for some mechanical equipment in process plants. 

In a further study Sherwin and Lees (1980) found early 
failure to be prevalent in both process plant equipment and 
hospital autoclaves. The process plant investigation was 
done in two stages. In the first stage failure data were col¬ 
lected and analysed and the maintenance tasks were 
observed. Recommendations were then made for improve¬ 
ment to the conduct of maintenance. In the second stage, 


2 years later, further data collection and analysis was car¬ 
ried out. The items of plant equipment studied were: 
(1) acid pumps, (2) water pumps, (3) vacuum pumps, 
(4) agitators, (5) screw conveyers, (6) filters, (7) fans, (8) heat 
exchangers, (9) evaporator flash vessels, (10) other tanks 
and vessels, (11) pipes and ducts and (12) other items. The 
failure modes were classified as: (1) blockages, (2) leaks, 
(3) drives, (4) electrical, (5) holes and breaks, (6) instru¬ 
ments, (7) valves and (8) other faults. The authors found 
that with few exceptions the failures could be character¬ 
ized as early failures with p values less than unity. In the 
first stage, values of P obtained on six types of equipment 
ranged from 0.61 to 1.07, whilst P values for five failure 
modes of the acid pumps ranged from 0.48 to 0.76 with the 
overall value for the eight failure modes being 0.63. As 
stated, the maintenance work was also observed. The 
research revealed many of the problems of maintenance 
work listed above, such as incorrect use of consumables, 
use of incorrect parts, failure to realign correctly and fail¬ 
ure to adjust clearances correctly, as well as working in 
dirty conditions. Above all, it pointed to a lack of training. 
Recommendations were made to rectify these short¬ 
comings, in particular proposals on training, and these 
were acted on. Analysis of the failure data from the second 
stage found that of the 12 types of equipment, 8 showed 
improvements in MTBF and 3 deteriorations in MTBF, with 
one type classed as N/A (not applicable). The MTBFs of the 
acid, water and vacuum pumps, for example, were 
increased from 47.5 to 108 days, from 75.8 to 382 and from 
57.3 to 117, respectively, and that of the agitators from 910 to 
4641 days. 

The hospital study was on autoclaves used for steriliza¬ 
tion, which were breaking down at an unacceptable fre¬ 
quency. The study yielded results remarkably similar to 
those onthe process plant. Again early failure (P < l)wasthe 
dominant regime. Recommendations were made and acted 
on, particularly with respect to training, and the overall 
failure rate was reduced from 0.065 to 0.014 failures/cycle. 

These studies indicate that as a result of early failure the 
overall failure rate of the equipment is higher than it need 
be and often never settles down to the lower constant failure 
rate which might be regarded as the more ‘normal’ condi¬ 
tion. The concept of ‘maintenance induced’ failure has long 
been familiar to plant engineers. The investigations 
described give it statistical support. 


7.19.6 Burn-in 

In the foregoing discussion wearout and early failure 
have been viewed as failure regimes. It is also of inter¬ 
est to develop models of failure in these regimes. An 
account of such modelling is given in Burn-In (Jensen 
and Petersen, 1982). 

The starting point is the observation that analysis of 
failure data for components often gives a bimodal dis¬ 
tribution, such that the failure density function exhibits 
two distinct peaks: the first for ‘freak’ failures and the 
second for the main failures. An example is the work of 
Herr, Baker and Fox (1968) on the failure of electronic 
components. 

Jensen and Petersen have developed a model for the freak 
failures which is based on two assumptions: (1) the strength 
of all components deteriorates with time and (2) the 
strength of weak components deteriorates faster. The more 
rapid deterioration of the weaker components results in a 
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sharper separation between the peaks of the two failure 
distributions. 

The foregoing refers to components in isolation. Another 
concept developed by Jensen and Petersen is that once 
incorporated in a system, the susceptibility to failure of 
some of the components maybe drastically increased.They 
term this phenomenon ‘infant mortality’ and treat it as 
distinct from freak failures. In their terminology, the early 
failures are made up of the two separate sets of failures 
(freak and infant mortality). It follows that there is poten¬ 
tial for a failure distribution which is not just bimodal but 
trimodal. 

The implications of such concepts of early failure for 
burn-in policies are discussed in Section 7.25. 

7.20 Failure Data Analysis 

Guidance on current performance in equipment reliability 
and on measures which may be taken to improve it can be 
obtained from the analysis of failure data. 

7.20.1 Need for failure data 

The application of reliability techniques creates a demand 
for data on equipment failure and repair time, on other 
failure-related events and on human error. These data may 
be obtained from the literature, from data banks or within 
the works. Usually it is possible to obtain approximate data 
fairly readily, but the determination of accurate data tends 
to involve much more effort. It is wasteful, therefore, to seek 
for greater accuracy in the data than the problem warrants. 

The accuracy required in the data varies considerably 
between different types of reliability calculation and even 
between different parts of the same calculation. In general, 
where the reliability problem has a structure, as in a com¬ 
parison of a simple equipment with a parallel or stand by 
system or in a fault tree analysis, less accurate data may 
often be used, at least in some parts of the calculation. Thus 
in a fault tree study, for example, some branches of the tree 
may be sensitive to the failure rates used, whilst others may 
not be. On the other hand, where the problem is a straight 
comparison, as between the failure rates of two instru¬ 
ments, the accuracy required is clearly greater. 

Often, for the solution of the reliability problem to be 
clear it is sufficient to know that the failure rate lies 
between certain broad limits. In such cases it may be suf¬ 
ficient to rely on expert judgement or on relatively crude 
failure data rather than on accurate data. 

7.20.2 Types of failure data 

The failure information required for reliability work 
includes not only data on (1) overall failure rates, but also 
data on (2) failure rates in individual modes, (3) variation 
of failure rates with time and (4) repair times. 

Failure modes can be classified in several ways. Some 
important categories of failure mode are (1) condition, (2) 
performance, (3) safety and (4) detection. In the failure 
classification based on condition, a failure mode is exem¬ 
plified by a faulty seal on a pump or by a defective gearbox 
on an agitator. It is the failure classification which is nor¬ 
mally used in maintenance. In the classification by perfor¬ 
mance, illustrations of failure are inability of a heat 
exchanger to achieve the required heat transfer or of a 
pump to give the specified head. The safety classification 
divides failure into fail-safe and fail-to-danger in the con¬ 
text of the process. The detection classification makes a 


distinction between revealed and unrevealed failure. These 
different categories of failure mode are particularly 
important in instruments and are discussed further in 
Chapter 13. 

Generally, information on the variation of failure rate with 
time is not available and therefore is not used much in ordin¬ 
ary reliability work, but it is important in relation to main¬ 
tenance problems. It is also necessary to have information on 
human error rates. This aspect is discussed in Chapter 14. 

Other information required relates to other events which 
have a bearing on failure. Typical examples are the prob¬ 
ability of a worker being nearby when an explosion occurs 
in an equipment, the distance travelled by a vapour cloud 
before it finds a source of ignition and the time taken for the 
fire services to reach the scene of a tanker crash. 

For availability studies the type of data used varies. In 
some cases the availability is determined from the failure 
rates and repair times of the basic equipment. In other 
cases data on the availability of blocks of plant are used. 

Failure rates may be expressed in terms of several para¬ 
meters. The parameter most commonly used is time, but it 
may be appropriate to distinguish between operating time 
and non-operating time, and other measures such as the 
number of cycles or the number of demands are appropriate 
in some cases. In this connection it should be emphasized 
that it is often not known which is the important measure in 
a particular case. Thus misleading results may be obtained 
if a particular failure is expressed as failures/year when 
failures/cycle would be more appropriate. 

7.20.3 Failure data sources, data collection and 
data banks 

The sources of failure data are essentially external sources 
such as the literature and data banks. Alternatively, data 
may be collected within the works. Often it is the works 
which is the most dependable source of applicable data, and 
in this case it is necessary to have some form of data col¬ 
lection system. In other cases, particularly for rare events, 
it will be necessary to make use of the external sources. 

The acquisition of data from these various sources is not 
straightforward. The data are of use only if they are of the 
right type, originate from a dependable source and apply to 
the case in hand. These and other issues related to failure 
data are discussed in Appendix 14. 

7.20.4 Fundamentals of failure data analysis 

Analysis of failure data should begin with consideration of 
the fundamental qualitative factors. One of these factors is 
the appropriateness of lumping together, as a homogenous 
set, equipments which may differ in design, manufacture, 
system function and process environment. Another factor is 
the parameter by which the failure rate is to bemeasured. As 
mentioned, this is usually time, but in some cases another 
measure such as the number of cycles is more suitable. 

The qualitative analysis which can be done depends on the 
information available. Some items which canbe calculated are: 

(1) overall failure rates; 

(2) failure rates in individual modes; 

(3) confidence limits and bounds on failure rates; 

(4) failure distributions; 

(5) repair time distributions. 

Frequently, the only information available is the total 
number of failures and the total operating time of 
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the equipments, and the analysis is restricted to cal¬ 
culation of the overall failure rate and corresponding 
mean life. 


Then for the failure-terminated test it can be shown that the 
ratio fimi/m has a % 2 distribution. For a two-sided con¬ 
fidence interval at a confidence level (1 — a) 


7.20.5 Failure rates in individual modes 

If the failure modes and their relative frequency are 
available, they are often analysed in the form of a histo¬ 
gram, as shown in Figure 7.21. In many cases there are a few 
failure modes which have a high relative frequency fol¬ 
lowed by a larger number of low frequency modes. This is 
generally referred to as a ‘Pareto-type distribution’ of fail¬ 
ure modes. 

It is the failure rates in the individual modes which are 
the data primarily required for fault tree analysis and for 
improvement of equipment performance by design and by 
maintenance. 

7.20.6 Confidence limits on failure frequency and mean life 

The confidence which can be placed in the estimate of the 
mean life depends on the number of failures recorded. If 
this number is small, it may be useful to determine the 
confidence limits. For the estimate of the mean life in the 
exponential distribution, the confidence limit may be 
determined using the / 2 distribution. 

It is necessary to distinguish between the case where the 
end of the test period T coincides with the final failure n and 
that where it does not. In the latter case it is conservative to 
assume that a further failure was just due to occur when the 
test was terminated. 


For the failure-terminated tes 
estimate of the mean life is 

t with replacement, the 

T 

*»i = - 

[7.20.1] 

and the degrees of freedom/are 


fi = 2» 

[7.20.2] 

whilst for the time-terminated tes 


T 

M2 ~n + 1 

[7.20.3] 

and 


h = 2(h +1) 

[7.20.4] 


-P^Xl-0/2):/l ^ ' 1 " a |7-20.5] 

Then the lower limit L and the upper limit U of the ratio 

if?) = {7.20.6] 

' m X*/2:/l 

and 

u(™) = — I 7 - 20 - 7 ! 

m = m iwS {7.20.8] 

For the time-terminated test it can be shown that: 



and 


U(~) = 2 [7.20.10] 

VW *1 -(a/2):/! 

again with m defined by Equation 7.20.8. 

Values of the percentage points of the x 2 distribution 
may be obtained from standard tables (e.g., Yamane, 1967, 
p. 879). It should be noted that some tables give the a. per¬ 
centage points and others the (1 - oi) percentage points. 
A graph showing the confidence limits on m/m according 
to Equations 7.20.9 and 7.20.10 is given in Figure 7.22. 

As an illustration, consider the situation in which 5 fail¬ 
ures have been recorded on 10 pumps over a period of half a 
year, with the final failure occurring before the end of the 
observation period, and in which it is required to estimate 
the confidence limits within which the ratio m/m lies at a 
90% confidence level.Then 

n = 5 failures 



From Equation 7.20.8 


, _ 0.5 x 10 
m 5 




From Equations 7.20.2 and 7.20.4 


fi = 10 


/2 = 12 


For a 90% confidence level, a=0.1. From tables of per¬ 
centage points of the j( 2 distribution 


*2/2*2 = Xo.05:12 = 21-0 

Xl-(a/ 2 ):/l = Zo.95:10 = 3-94 


Figure 7.21 Failure modes of an equipment 
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Ratio of true to estimated mean life, m/m 



Figure 7.22 Two-sided confidence limits for the ratio of true to estimated mean life m/m vs number of failure n in a 
time-terminated test with an exponential failure distribution (Buffham, Freshwater and Lees, 1971) (Reproduced by 
permission of the Institution of Chemical Engineers) 


Then from Equations 7.20.9 and 7.20.10, the lower and 
upper confidence limits on the ratio m/m are: 

and 




L(m) = 0.476 year 
U(m) = 2.54 year 

In some cases no failures are observed. Nevertheless, it is 
still possible to make an estimate of the lower limit of the 
ratio m!m. For a one-sided confidence limit at a confidence 
level (1 - a): 


Alternatively, the confidence limits may be obtained from 
Figure 7.22. Then 


[7.20.11] 
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/ z =2 [7.20.13] 

Za:2 = 4.61 

Then from Equation 7.20.11 the lower confidence limit on 
the ratio m/m is 



and that on the mean life is L(m) = 4.34 years. 

Further accounts of confidence limits on failure data 
are given by Bazovsky (1961) and A.E. Green and Bourne 
(1972). 

There is often a quite wide spread in failure rates 
reported by various sources. The variability of failure rates 
may be described by a log-normal distribution. Since 
this distribution has two parameters, it is determined by 
the end-points of a suitably defined range. This method of 
describing failure data was extensively used in the 
7?asw«ssewi?e/)or/(AEC,1975).Theuseoftheselog-nonnal 
distributions in fault trees in this study is discussed in 
Chapter 9. 


7.20.7 Confidence limits on failure probability 

The treatment just given refers to failure frequencies. It 
may also be necessary to determine the confidence limits 
on failure probabilities. A treatment of this problem is 
given by von Alven (1964). The approach taken in this 
case is the use of the binomial theorem. Use may be made 
of the binomial theorem itself or of charts constructed 
from it. 


Such a plot is given in Figure 7.23, which shows, for the 
case where there are S successes in A trials, the 95% con¬ 
fidence limits as a function of the ratio S/N, or success 
probability. As an illustration, consider the case where 
there are 16 successes in 20 trials. Then the estimated value 
of the probability of success is 0.8 and the upper and lower 
confidence limit values are 0.98 and 0.6. The failure prob¬ 
abilities are the complements of these values. 


7.20.8 Fitting of failure distributions: graphical methods 

Information on the variation of a failure rate with time, that 
is, the failure distribution, can lead to its reduction through 
improvement in design and maintenance. The data 
required for the determination of the failure distribution 
are the individual times to failure of the equipment. 

The procedure is to convert the data to a set of values of 
the failure distribution F(t) vs times to failure t, and to plot 
the latter against that function of F\t) on a scale which cor¬ 
responds to the distribution to be fitted. 

For the exponential distribution: 


F(t) = 1 - exp(-/lf) 

[7.20.14] 

and hence 


^7 ln [l-I(t| 

[7.20.15] 

Thus a plot of 1/[1 - F\t)] on a log scale v 
gives a straight line. 

sf on a linear scale 

For the Weibull distribution: 


ln(f- 7 )=Iln{ln[ T -^]| + ln )? 

[7.20.16] 



Figure 7.23 Two-sided 95% confidence limits for the success probability S/N vs number of trials N (Clopper and 
Pearson, 1934) 
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For these common distributions special graph papers are 
available which allow F(t)vst to be plotted directly Figures 
7.24-7.27 illustrate such graphs for the exponential, the nor¬ 
mal and the Weibull distributions (two cases), respectively. 

The determination of the failure distribution F(t) from 
the experimental data is not entirely straightforward, 
however, and requires further discussion. 

7.20.9 Fitting of failure distributions: ranking 

If a test is considered in which n equipments operate with¬ 
out replacement and all fail during the test and if «/f) 
equipments have failed at time t, then intuitively the failure 
distribution is simply the proportion which have failed: 



But the matter is not quite so simple.While Equation 7.20.17 
holds for the n items tested, it is not the best estimate if 
these items tested are a sample from a large population. In 
this case a better estimate is the expected value: 

F(t) = ^ [7.20.18] 


An alternative approach is the use of ranking. This involves 
calculating the order number rrij of the 7th failure. The fol¬ 
lowing ranking expressions are used: 


.Fmean = mean rank [7.20.19] 

F med = median rank [7.20.20] 

n + 0.4 1 J 


It is usual to calculate the failure distribution F\t) as either 
the mean rank F mean or the median rank F med . The use 
of ranking is essential when the number of items n under 
test is small. The mean is commonly taken as a repre¬ 
sentative descriptor of a sample from a distribution. In the 
case of a highly skewed distribution, however, a better 
description may be the median. A discussion of the differ¬ 
ence between mean rank and median rank and of the choice 
between them is given by Kapur and Lamberson (1977). 
Illustrative examples involving the use of the mean rank 
and median rank of a set of failure data are given in Tables 
7.19-7.22. 



Figure 7.24 Fitting of failure distributions using special graph paper: exponential distribution (data from Table 7.19) 
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7.20.10 Fitting of failure distributions: exponential 
distribution 

The data in Table 7.19 correspond to an exponential failure 
distribution and are plotted in Figure 7.24. The estimator 
for the parameter failure rate X in this distribution is given 
by the point at which the cumulative percentage failure has 
the value 63.2; the value of X is then read off as the age at 
failure at this point, which in this case is 550 days. 


7.20.11 Fitting of failure distributions: normal distribution 

The data in Table 7.20 correspond to a normal failure dis¬ 
tribution and are plotted in Figure 7.25. The estimator for 
the parameter mean life m is given by the point at which the 
cumulative percentage failure has a value of 50; the value of 
m is read off as the age at failure at this point. The estimator 
for the standard deviation a is given by the interval 
between the cumulative percentage failures of 50 and 84; 
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Figure 7.26 Fitting of failure distributions using special graph paper: Weibull distributions (data from Table 7.21) 
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Figure 7.27 Fitting of failure distribution using special graph paper: Weibull distributions (data from Table 7.23) 


the value of a is read off as the interval between the ages at 
failure at these two points. 


7.20.12 Fitting of failure distributions: Weibull distribution 

The data in Table 7.21 correspond to a Weibull distribution 
with /? = 1 and are plotted in Figure 7.26/The estimator for the 
characteristic life »/ is given by the point at which 
the cumulative percentage failure is 63.2; the value of r] is 


read off as the age at failure at this point. The shape para¬ 
meter P is obtained by constructing a line through the 
‘estimation rsquo; point and perpendicular to the line 
through the experimental points and reading off the value of 
P on the special scale. 

The mean of the distribution may be obtained as follows. 
The value of the cumulative probability is read off from 
the construction line just described. Then the mean of the dis¬ 
tribution is obtained by entering the vertical scale at this 














































































































































RELIABILITY ENGINEERING 7/55 


Table 7.19 Failure data from a failure-terminated test 
and derived ranked cumulative failure distribution - 1 


Failure 

No. 1 2 3 4 5 

Operating 
time (days) 

Cumulative failure 
distribution (mean rank, F mean ) 

1 

40 

0.091 

2 

98 

0.182 

3 

165 

0.273 

4 

235 

0.364 

5 

312 

0.455 

6 

428 

0.545 

7 

547 

0.636 

8 

720 

0.727 

9 

925 

0.818 

10 

340 

0.909 




value of Pfu going to the data line and reading off on the 
horizontal scale. 

Also shown in Figure 7.26 are the 90% confidence limits, 
which are obtained in the following manner. Use is made of 
the appropriate percentage ranks for the particular sample 
size. A table of such ranks is given in Appendix VIII of 
Kapur and Lamberson (1977). The values of the median 
rank, the 5% rank and the 95% rank for a sample size of 
n = 5 are given inTable 7.22. These values have been used to 
plot the confidence limits shown. 

7.20.13 Fitting of failure distributions: censored data 

It frequently happens that items are withdrawn from test 
before they have failed. The test is then a censored one. 
Such a test has both failures and survivals. The mean order 
number m ,• is calculated as 

mj = mj..i + Am [7.20.21] 


Table 7.20 Failure data from a failure-terminated test and 
derived ranked cumulative failure distribution - 2 


Failure 

No. 3 

Operating 
time (years) 

Cumulative failure 
distribution (mean rank, F mem ) 

1 

1.69 

0.091 

2 

2.11 

0.182 

3 

2.42 

0.273 

4 

2.73 

0.364 

5 

3.05 

0.455 

6 

3.20 

0.545 

7 

3.44 

0.636 

8 

3.76 

0.727 

9 

4.02 

0.818 

10 

4.37 

0.909 




Table 7.21 Failure data from a failure-terminated test and 
derived ranked cumulative failure distribution - 3 


Failure 

No. 3 

Operating 
time (days) 

Cumulative failure 
distribution (median rank, F mei ) 

1 

400 

0.130 

2 

1050 

0.314 

3 

1900 

0.500 

4 

2800 

0.686 

5 

5000 

0.871 




Table 7.22 The median rank, 5% rank and 95% rank for 
sample size n= 5 used to plot the confidence limits in 
Figure 7.26 


Failure No. Median rank 5% rank 95% rank 


1 12.95 

2 31.38 

3 50.00 

4 68.62 

5 87.06 


1.02 45.07 

7.64 65.74 

18.93 81.08 

34.26 92.36 

54.93 98.98 


m 0 = 0 and m 1 = 1 if the sequence begins with a failure. The 
mean order number increment Am, which is only recalcu¬ 
lated for a failure following a survival, is 

[7.20.22] 

where x is the number of items before the;th failure. 

An illustrative example of the determination of mean 
and median ranks of a set of censored failure data is given 
inTable 7.23. The data inTable 7.23 can be fitted by a Weibull 
distribution and are plotted in Figure 7.27. The character¬ 
istic life ri and the shape parameter /? are obtained in the 
same way as in the previous example. 

Further discussions of ranking are given by 
L.G. Johnson (1964) and Bompas-Smith (1973). 

7.20.14 Fitting of failure distributions: observation window 

These methods are appropriate for test situations, such as 
the testing of new equipments by the manufacturer. In this 
case, the equipments are known to be in the new condition 
at the start of the test. 

In the process industries the position is often rather 
different. Frequently the test situation is that working 
equipments are observed through a test ‘window’, as 
shown in Figure 7.28 (Aird, 1977b). In this case the 
equipments are not in the ‘as new’ condition when the 
test is started. There appears to be no entirely satisfac¬ 
tory method of dealing with this case at present. The 
difficulty arises in the handling of the period before the 
first failure of such equipment. It is possible either to 
neglect this period or to treat it as a time to failure, but 
neither approach is accurate. The error in the parameters 
thus estimated increases as the ratio of the observation 
window to mean life decreases. 

7.20.15 Fitting of failure distributions: parameter 
estimation 

Failure data in the form of times to failure or hazard rates 
may also be fitted to failure distributions by parameter 
estimation methods. Three principal methods are (1) least 
squares, (2) moments and (3) maximum likelihood. These 
methods are considered for the exponential distribution 

z{t) m X 


[7.20.23] 
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Table 7.23 

Failure data from a time-terminated censored test and derived ranked cumulative failure distribution 

Event No? 

Operating 
time (days) 

No. left 

Increment 

Mean 
order No. 

Cumulativefailure 
distribution 
(mean rank, F meim ) 

Cumulativefailure 
distribution 
(median rank, F mei ) 

IF 

300 

14 

1 

1 

0.063 

0.045 

2F 

360 

13 

1 

2 

0.125 

0.110 

3F 

400 

12 

1 

3 

0.188 

0.175 

4W 

420 

11 

— 




5F 

440 

10 

1.083 

4.083 

0.255 

0.246 

6F 

480 

9 

1.083 

5.166 

0.323 

0.316 

7W 

490 

8 

- 

- 

- 

- 

8F 

500 

7 

1.204 

6.370 

0.398 

0.394 

9F 

540 

6 

1.204 

7.574 

0.473 

0.472 

10F 

570 

5 

1.204 

8.778 

0.549 

0.551 


a F, failure; W, withdrawal; original no. 15. 





Figure 7.28 Observation of failures in an operational 
system (after Arid, 1977b): x, failure 


Table 7.24 Failure data from a failure-terminated test and 
derived hazard rates and failure densities 


Failure No? Operating 
time (days) 

Time Hazard 

interval. At rate, z 
(days) (xlO 2 ) 

Failure 
density, f 
(xlO 2 ) 

1 

40 

40 

0.250 

0.25 

2 

98 

58 

0.192 

0.172 

3 

165 

67 

0.187 

0.149 

4 

235 

70 

0.204 

0.143 

5 

312 

77 

0.216 

0.130 

6 

428 

116 

0.172 

0.086 

7 

547 

119 

0.210 

0.084 

8 

720 

173 

0.193 

0.058 

9 

925 

205 

0.244 

0.049 

10 

1340 

415 

0.241 

0.024 


a Original no. —10. 


and the Weibull distribution 

2(f) = kr [7.20.24] 

The least squares method may be applied in various ways. 
It is often used to fit data in the form of hazard rates. The 
hazard rate z(f) and the failure density/(f) over each time 
interval Af between failures are: 


2(f) 


n s At 

1 

nAt 


[7.20.25] 

[7.20.26] 


where 2 and z c are the observed and calculated hazard rates. 
Then if 


#«/(%, •••,<%) 

the parameters a,- are given by the equations: 

[7.20.28] 

^ = 0 

0fll 

[7.20.29a] 

?= 0 

dap 

[7.20.29b] 


where n and « s (f) are, respectively, the initial number of 
equipments and the number of equipments surviving. 
An illustrative example of the determination of hazard rate 
and failure density of a set of failure data is given in 
Table 7.24. 

In the least squares method the error e is defined as: 


A simple relationship for the hazard rate is: 
z = a + b(t-t) [7.20.30] 

where f is the mean time to failure. From Equation 7.20.27 

«= jyzi-[a+ b (ti-m 2 


’=£(*-* ) 2 


[7.20.27] 


[7.20.31] 
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Then from Equation 7.20.28 

a= l ^Tzi [7.20.32] 

b = [E(4- - t )*] j - * ) 2 ] [7-20.33] 

For the exponential distribution the parameters in Equa¬ 
tion 7.20.30 are 

a = X 
b = 0 

For the Weibull distribution, from Equation 7.20.27 
e=Y^{Zi-k1?) 2 [7.20.34] 

k =(ib z i t r s j/(ib t i mS j [ 7 - 2 °- 35 ] 

m is obtained from the implicit equation: 

In ti - J2 btf In 4 = 0 [7.20.36] 

The moments method is used to fit data in the form of times 
to failure. The moments of the data m k are: 



[7.20.42a] 


[7.20.42b] 

The maximum likelihood method is also used to fit data in 
the form of times to failure. The likelihood function L is 
defined as: 



S=/(4;ft, • ■ •, ft) •/(f 2 ;ft,• ■ ■,ft) • ■ -/(4>;ft,• 

[7.20.43] 

where / is the density function. Then the maximum like¬ 
lihood estimate is obtained by maximizing L or £=ln L 
with respect to the parameters ft 

s=° 

[7.20.44a] 

p=0 

0ft 

[7.20.44b] 

p=0 

3 ft 

[7.20.44c] 


The moments of the distribution ft ai 
.ft - / t k f(t)dt 


For the exponential distribution: 
[7.20.38] z, = J I J / iexp(-A4) 


H k = m k 

For the exponential distribution: 
ft m J tX exp(-/U) d/sS = »*i 
For the Weibull distribution: 

ft = jf °° Hr exp df [7.20.41a; 

m and k are obtained from the implicit equations 


[7.20.39] £ = ln L = n\n X - X^U 

Then from Equations 7.20.44 and 7.20.46: 


"fflCt "Sis 

For the Weibull distribution: 

L^^expf-^) 


[7.20.44d] 

[7.20.45] 

[7.20.46] 

[7.20.47] 

[7.20.48] 

[7.20.49] 
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C = nlnk + m±lnt i - n ^ l ±t^ 

Then from Equations 7.20.44 and 7.20.50: 
_ n(m +1) 

“ELiC 1 


[(S r ‘'"‘)/(S r ‘)]-(^) 


7.20.17 Proportional hazards modelling 

Another technique useful in failure data analysis is pro¬ 
portional hazards modelling. This is a method of deter- 
[7.20.50] mining the relative effects of influencing factors on the 
failure rate. Proportional hazards modelling was proposed 
by D.R. Cox (1972), who suggested that it might have 
application to data in the fields of medicine and reliability 
engineering. Its initial development was in the latter. 
r7 9n c-, i Accounts are given in The Statistical Analysis of Failure 
‘ Time Data (Kalbfleisch and Prentice, 1980) and Statistical 
Models and Methods for Lifetime Data (Lawless, 1982). The 
application of the method to reliability engineering is 
described by Bendell (1985) and Dale (1985). 

The basic relationship in proportional hazards model¬ 
ling is: 



[7.20.51b] ^ exp ^ ^ 


[7.20.56] 


Once the parameters of the distribution have been esti¬ 
mated by one of the methods described, an assessment can 
be made of the goodness of fit. A common approach is to use 
the x 2 distribution. 

7.20.16 Generation of failure distributions 

It is sometimes necessary for purposes such as the testing 
of failure analysis schemes to generate sets of times to 
failure obtained from particular distributions. This is nor¬ 
mally done by rearranging the equation of the failure dis¬ 
tribution F{t) to give the time to failure t as a function of the 
probability, and then generating the set of times to failure 
by replacing the probability by a set of random numbers v 
in the range 0 to 1 from the uniform distribution. 

For the exponential distribution, from Equation 7.7.14 


t = — ^ln(l — v) [7.20.52a] 

or, since v and (1 - v) are both uniform distributions with 
the same range, 


f=-^lnv [7.20.52b] 

For the normal distribution, with zero mean and unit vari¬ 
ance from Equation 7.7.18, the following approximation 
may be used: 

'=ii”[(ir) 1/2 -(£ v -')-l] [7 - 20 - 53] 

It is normally sufficient to take n = 12, in which case 


HE*- 6 


[7.20.54] 


For the Weibull distribution, from Equation 7.7.25 

t = ri(-lnv) 1/f +y [7.20.55] 

The generation of failure distributions is described in more 
detail by Hastings and Peacock (1974). 


where z(f) is the hazard rate, z,- the ith influencing variable, 
or explanatory factor, z 0 (/) the baseline hazard function, 
and ^ the coefficient of z,-. 

Thus the action of the explanatory factors on the hazard 
rate is, in this model, assumed to be multiplicative, in con¬ 
trast to the more common correlation models, in which it is 
taken to be additive. A multiplicative effect appears more 
realistic. The baseline hazard rate zo(/) is, in principle, 
distribution free. 

Examples of the application of proportional hazards 
modelling are given by Dale (1985). 


7.20.18 Time-varying failure data 

The foregoing treatment is based on the assumption that 
the failure distribution and its parameters do not vary with 
time. Some guidance on the effect of variation of the failure 
rate with time is available from work by Blanks (1977). He 
shows that significant error occurs where failure rates are 
estimated from exposure periods which are very much less 
than the representative life, which for the log-normal dis¬ 
tribution is the median life and for the Weibull distribution 
the characteristic life. 

This is illustrated in Figure 7.29, which shows that 
for the Weibull distribution the product (Failure rate x 



Figure 7.29 Variation of failure rate with observation 
time, in terms of the Weibull distribution (Blanks, 1977) 
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Characteristic life) diverges significantly from unity for 
low values of the time/characteristic life ratio. 

7.20.19 Combination of failure data 

A common situation is that some failure data are available, 
typically from the literature, whilst further data have been 
obtained within the company. A method is needed for 
combining these two sets of data to produce a single value 
for the failure rate. In this case use may be made of Bayes’ 
theorem, as described in Section 7.14. The problem is also 
discussed by the Center for Chemical Process Safety 
(CCPS, 1989/1). 

7.20.20 Role of failure data analysis 

Failure data analysis can be a powerful tool for improve¬ 
ment in reliability and in maintenance. It is most effective if 
used as one prong of an integrated approach. It also has 
certain limitations. For work on reliability, as opposed to 
maintenance, the acquisition of data is clearly essential. 

For maintenance, at the most elementary level collection 
and analysis of failure data can highlight which equip¬ 
ments have high failure rates and the most frequent failure 
modes of such equipment. At a more sophisticated level, 
determination of failure distributions can identify the 
failure regime and can point to particular types of remedial 
action or maintenance policy. 

Such an analysis is more effective if it is combined with 
other methods. In the study by Sherwin and Lees (1980) 
described above, the authors emphasize the value of com¬ 
bining failure data analysis and observation of the main¬ 
tenance task. They state that this combination is more 
powerful than either method on its own. 

Failure data analysis has it limitations, however. Aworks 
commonly contains a large number of equipments, each 
with a number, often a large number, of failure modes. The 
collection and analysis of failure data for these is a serious 
undertaking. Furthermore, failure data analysis is effec¬ 
tively a form of epidemiology, and is thus subject to criti¬ 
cisms which are directed at the latter, namely that it is a 
method which comes into play only after failures, and pos¬ 
sibly harm, have occurred. 

An alternative approach which seeks to get things right 
first time is that of reliability-centred maintenance (RCM). 
This is described below. Here it is sufficient to note its cri¬ 
tique of failure data analysis. Failure data analysis appears 
to be of most value in application to significant items of 
equipment with a few dominant failure modes and perhaps 
also to lesser items present in large numbers. 

7.20.21 Repair times 

Information on repair times is also required in reliability 
work. Repair time data are sometimes difficult to obtain 
accurately as there is a tendency for nominal repair times to 
he recorded, particularly when tasks are of short duration. 
It is frequently found that repair times fit a log-normal 
distribution. 


7.21 Reliability in Design 

An outline is now given of the design and development of an 
equipment which is to have high reliability. It draws largely 
on accounts of the practice of suppliers and users in high 
technology industries such as defence and aerospace where 
the users have stringent reliability requirements. 


7.21.1 Design process 

An overview of the design process for mechanical systems 
with specific reference to reliability has been given by 
A.D.S. Carter (1986). He distinguishes three broad stages: 
(1) the formulation of objectives, (2) the conventional design 
process and (3) the development process. 

7.21.2 Manufacturer ± user relationship 

Before considering the three stages of the design process, it 
is relevant to recognize that the relationship between the 
manufacturer and the user can have a strong influence on 
the reliability requirements. In some cases, such as 
defence, there may be a single manufacturer and single 
user who work closely together to define the requirements. 
At the other extreme there is a market in which there are 
several manufacturers and numerous users. The users 
may be imprecise about their requirements so that the 
manufacturers must take their own view about what is 
needed. 

In principle, a user should be seeking to minimize the life 
cycle costs. In practice, he may well not do this, but may 
concentrate on some less global objective such as mini¬ 
mization of the combined capital and operating costs of the 
equipment, or even of the capital cost alone. 

The interests of the manufacturer and user do not 
necessarily coincide. However, in principle, both parties 
have an interest in the formulation of the reliability goals 
and specification. 

7.21.3 Reliability targets 

The reliability requirement is formulated in the first 
instance as a set of broad targets. In addition to the normal 
design considerations targets for reliability, these will 
include availability and maintainability. The priority accor¬ 
ded to reliability proper, theminimizationof outright failure, 
will depend on the consequences of failure, and inparticular 
on the extent to which the item is safety critical. The targets 
should ideally include the minimization of life cycle cost, but 
the extent to which the manufacturer does this will depend 
on the information about use available to him and on com¬ 
mercial judgement. 

7.21.4 Reliability prediction 

System design and development need to be supported by a 
continuous process of reliability prediction. This can be 
significant activity in its own right, and consideration of 
this is deferred to the next section. 

7.21.5 Reliability feasibility study 

Before embarking on detailed specification and design, it is 
usual to carry out a feasibility study. The purpose of this is 
to confirm that the proposed design is capable of meeting 
the reliability goals. 

7.21.6 Reliability specification 

Once established, the reliability targets need to be con¬ 
verted into reliability specifications. There will he a reli¬ 
ability specification for the system as a whole and further 
specifications for its component parts. The specification 
process involves sharper definition of features, such as the 
precise performance requirements for the system, the lim¬ 
its of the conditions and loads which it is required to with¬ 
stand and the maintenance requirements and the criteria 
for success in meeting these various requirements. An 
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account of the practicalities of reliability specification is 
given by Calabro (1962). 

7.21.7 Conventional design 

Within his overall account of reliability in design, Carter 
(1986) gives adetaileddescription of the conventional design 
process. The potential system failures should be identified 
and evaluated. For safety-critical features, techniques such 
as fail-safe behaviour or redundancy may be appropriate. 

In most cases it is possible to make use of an existing 
design, either unchanged or with relatively minor modi¬ 
fication. In this case information should be sought on its 
reliability in the field under the conditions of interest. 

If a new design is indicated, care should be taken to avoid 
known generic causes of unreliability. These include fea¬ 
tures which constitute stress raisers, promote corrosion, 
result in poor connections, allow rupture of pipes, hoses and 
wires, and so on. The design should be suitable for the 
environment in which it is to be used. The components 
should be compatible with each other. A.D.S. Carter gives 
checklists covering this aspect. Efforts should be made to 
obtain information on the field reliability of similar designs. 

The design should adhere to some basic principles. It 
should be kept simple. And it should be adequately con¬ 
servative. 

Care should be taken that ‘improvements’ to an existing 
or proposed design, whether arising from activities such as 
value engineering or otherwise, do not in fact result in an 
unwarranted decrease in reliability. 

The maintainability of the system should be considered 
as well as its reliability. 

The components and subsystems used in the design 
should be fully specified, and there should be inspection 
and test procedures for them. 

Prior to entry into service the system may be subject to 
handling, packing, transport and storage, which may cause 
damage or deterioration, and attention should be paid to this 
aspect. 

Aquantitative evaluationshouldbemade of the reliability 
of the system, as much for the sake of stimulating a critical 
review as for the determination of a numerical value. 

7.21.8 Mechanical design 

Traditional mechanical design of equipment is based on 
deterministic methods. It is also possible, however, to take a 
probabilistic approach using concepts such as those of 
interference theory. A.D.S. Carter (1986) gives illustrations 
of the application of this latter approach to problems of 
stress-rupture phenomena and of fatigue. 

7.21.9 Design reviews 

The design function should have a formal procedure for the 
review of the reliability of the systems and equipment 
under design. This procedure should cover not just the 
design stage proper but also the testing and development 
stages, and follow-up at each stage. 


7.21.10 Problem identification 

The design reviews should make use of the various tech¬ 
niques for problem identification, such as critical exami¬ 
nation, checklists, failure modes and effects analysis 
(FMEA), fault tree analysis, and so on. These methods are 
described in Chapter 8 and are therefore not discussed 
further here. 


7.22 Reliability Prediction 

As just indicated, design for reliability requires the sup¬ 
porting activity of reliability prediction. Reliability pre¬ 
diction is not simply the estimation of numerical values of 
reliability using suitable models. The term is used to cover 
the various and much wider range of activities running 
through the design and development stages, and possibly 
beyond. Reliability prediction is carried out through this 
life cycle as a guide to action. Accounts of reliability 
prediction include those given by von Alven (1964) and 
D.J. Smith (1985a). 


7.22.1 Stages of reliability prediction 

Reliability prediction passes through three broad stages, 
generally characterized as (1) pre-design, (2) interim and 
(3) final reliability prediction. 


7.22.2 Pre-design reliability prediction 

The pre-design reliability prediction has to be performed 
with limited information and involves in particular the 
feasibility evaluation and the reliability apportionment. 

7.22.3 Reliability feasibility study 

One of the first reliability prediction activities is the fea¬ 
sibility study. A pre-design estimate is made of the system 
reliability and is compared with the specification. This 
indicates whether or not the proposed design is at least 
within hailing distance of meeting the specification. If it is 
not, possible responses are modification to the design, or to 
the specification, or to both. Even if the reliability predic¬ 
tion indicates that the design will meet the specification, it 
is good practice to explore alternatives. The next step is to 
set reliability specifications for the subsystems. 

7.22.4 Reliability apportionment 

The fundamental reliability specification is that for the 
system as a whole. However, in order to achieve this it is 
necessary to decompose the system into subsystems and to 
determine the reliability specifications for the constituent 
parts. This is known as ‘reliability apportionment’, or 
‘reliability allocation’. 

There are a number of models which may be used to 
apportion the reliability targets among the parts, as 
described by Anderson and Neri (1990). A model for the 
case where the parts, or subsystems, are similar is: 

R x = R 1/n |7.22.1] 

where n is the number of subsystems, R x the reliability of 
the system, and R x the reliability of a single subsystem. For 
the case where the subsystems are different one model is: 

R x = R Wi |7.22.2] 



where Q is a parameter representing the complexity of the 
*th subsystem and is the weighting factor for that sub¬ 
system. 
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7.22.5 Interim reliability prediction 

Once the design is under way, reliability prediction is used 
in support. As is usual in design, the process is iterative 
and involves various trade-offs. 

7.22.6 Final reliability prediction 

The final reliability prediction is made as part of the overall 
specification of the product. This prediction also serves as 
a measure of the success of the design process. There may 
be complications in producing a single final reliability 
prediction. The product may come in several versions and, 
over time, may be subject to modification. 

7.23 Reliability Growth, Testing and Demonstration 

In the achievement of reliability, design for reliability 
and reliability prediction need to be complemented by a 
programme of reliability testing and demonstration. In 
large part, reliability prediction and testing are directed to 
the growth in the reliability of the equipment Reliability 
growth is therefore conveniently considered along with 
testing. 

7.23.1 Reliability testing 

In reliability testing a distinction is made between 

(1) reliability development and demonstration testing, 

(2) qualification and acceptance testing and (3) operational 
testing. 

Reliability development and demonstration testing is 
performed to determine (1) whether the design needs 
improvement, (2) to identify modifications which might 
lead to improvement and (3) to verify that the modifications 
made have led to improvement. 

In high technology activities it is generally required that 
a design be accepted as qualified for the intended applica¬ 
tion. An example is the seismic qualification of equipment 
for nuclear plants. Similarly, there may be a requirement 
that the design be qualified with respect to reliability. This 
is the purpose of qualification testing. 

Acceptance testing is concerned with the quality of 
manufacture of the equipment. 

Operational testing provides information on the opera¬ 
tion of the equipment, as verification of the design and 
feedback of information on performance for future use by 
the designers. This type of testing is less likely to be subject 
to the continuous process of modification that is char¬ 
acteristic of development testing. 

Reliability testing is governed by a formal programme 
involving subcontractors as well as the lead manufacturer. 
The programme covers the stages of (1) design concept, 
(2) production prototype and (3) production testing. It is 
generally subject to frequent modification. 

Further treatment of acceptance testing is deferred to 
later in the text in order to consider reliability growth. 

7.23.2 Reliability growth 

If the reliability development programme is effective, it 
should result in an increase in the reliability of the equipment. 
Experience with different products shows that the process of 
reliability growth has certain characteristic features. 
Accounts of reliability growth are given by Lloyd and Lipow 
(1962) and D.J. Smith (1985a). A relevant standard is BS 5760: 
Part 6:1991 Guide to Programs for Reliability Growth. 

The situation considered is the development phase of an 
equipment in which the manufacturer conducts field tests 


involving a continuous process of feedback of information on 
reliability performance and modification of the equipment to 
improve this reliability by reducing design-related failures. 

Various models have been developed for reliability 
growth. Such models may be used to extrapolate in time to 
the point when the failure rate of an equipment under 
development should reach the specified value. They may 
also be used to make estimates of development times. 

7.23.3 Duane method 

A widely quoted method for the analysis of reliability 
growth during field testing has been given by Duane (1962). 
Further discussions of the method are given by Codier 
(1968), R.C.F. Hill (1977) and D.J. Smith (1985a). Duane 
found that a log-log plot of cumulative failure rate vs 
cumulative testing time tended to give a straight line. 
Codier (1968) modified this plot, replacing cumulative 
failure rate by cumulative MTBF, as shown in Figure 7.30. A 
straight line on this plot may be expressed as: 

MTBF tx T p.23.1] 

The current MTBF is given by: 


where the subscripts cum and cur indicate the cumulative 
and current values. Values of a tend to lie in the range 
0.1-0.65. 

The use of cumulative time in the Duane plot means that 
at long testing times changes in the reliability growth tend 
to be smoothed out and are difficult to discern. 

7.23.4 Reliability acceptance testing 

The decision of whether to accept or reject items on reli¬ 
ability grounds needs to be governed by a formal system of 
acceptance testing. Accounts of acceptance testing are 
given in texts on quality control (e.g., Burr, 1953; Moroney, 
1956; E.L Grant, 1964). Treatments in the context of reli¬ 
ability engineering are given by von Alven (1964), Breipohl 
(1970) and D.J. Smith (1985a). 



Figure 7.30 Reliability growth plots: after Duane 
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Acceptance testing is generally conducted by reference 
to an operating characteristic (OC) curve. For the case 
where such testing is performed by taking a sample of 
items from a production batch, the operating curve may be 
constructed from the binomial distribution: 

P = E(a)^”- 4 17-23.3] 

where c is the allowable number of defective items in a 
sample of size n, p and q are the proportions in the batch of 
good and defective items, respectively (p + q = 1) and 
P is the probability of acceptance. The OC curve is a plot of 
Pvs q for given values of n and c. Atypical OC curve of this 
kind is shown in Figure 7.31(a). 

In using a sample as the basis of acceptance, both pro¬ 
ducer and consumer accept a certain risk. The producer’s 
risk is the probability that the batch is acceptable but fails 
the test, whilst the consumer’s risk is the probability that 
the batch is unacceptable but passes the test. 

The usual procedure is to set values for the acceptable 
quality level (AQL) and the lot tolerance per-cent defective 
(LTPD) which are entered on the OC curve as shown in 




Figure 7.31 Acceptance testing schemes: (a) operating 
characteristic curve for sinle sample plan; (b) operating 
limits for sequential sampling plan 


Figure 7.31(a). The AQL is the batch, or lot, quality (q value) 
for which the probability of acceptance has some (high) 
specified value. The complement of this probability is the 
producer’s risk (a). A typical value of the AQL is 95%, giv¬ 
ing a producer’s risk of 5 % (a = 0.05). Likewise, the LTPD is 
the lot quality (q value) for which the probability of accept¬ 
ance has some (low) specified value. This probability is the 
consumer’s risk (/?). A typical value of LTPD is 10 %, giving 
a consumer’s risk of 10% (/? = 0.1). 

As just described, this scheme refers to the sampling of a 
single batch and provides lot quality protection (LQP). If 
the batch is then to be mixed with other batches, this degree 
of protection may not be necessary. An alternative scheme 
may be used which offers average quality protection (AQP). 

An approach to acceptance testing for the case where the 
acceptance criterion is the failure rate of the equipment, 
which is based on the Poisson distribution, is described by 
Smith. 

The binomial scheme just described involves single 
sampling. Another approach is the use of sequential sam¬ 
pling in which a series of tests is conducted, the decision 
after each test being (1) accept, (2) continue testing or (2) 
reject. This approach is illustrated in Figure 7.31(b). 

An important issue in the design of an acceptance testing 
scheme is the degree of discrimination which it provides. 
This is discussed by Smith. 

7.24 Maintainability 

Accounts of reliability engineering generally include as a 
third theme, in addition to those of reliability and avail¬ 
ability, that of maintainability. Maintainability is treated in 
the main reliability engineering texts cited here and in 
particular in Maintainability (Goldman and Slattery, 1964) 
and Reliability, Maintainability and Availability Assessment 
(Locks, 1973), and by von Alven (1964) and D.J. Smith 
(1985a). 

The cost of maintaining equipment is a recurring theme 
in reliability work and was one of the original motivations 
for it. Although estimates vary, they are generally in 
agreement that the cost is high. Accounts of maintain¬ 
ability generally treat it as a property of the equipment. 
‘Maintainability’ is therefore not synonymous with main¬ 
tenance effectiveness, which includes other aspects such 
as organization and training. 

7.24.1 Maintainability measures 

The principal measures of maintainability of an equipment 
are its failure rate and repair time. Attention tends to centre 
mainly on the repair time, but the overall cost is also 
strongly influenced by the frequency at which repair is 
necessary. 

The overall repair time is usually decomposed into sev¬ 
eral parts, a typical division being (1) active repair time, 
(2) logistics time and (3) administrative time. Essentially, 
logistics time is that spent waiting for spare parts, and 
administrative time is the balance of time spent on the 
repair which is not required for either active repair or 
logistics. 

7.24.2 Maintainability principles 

Some basic principles of maintainability are: (1) provision 
of good access; (2) minimization of the complexity of the 
task, tools and test equipment; (3) provision of good main¬ 
tenance manuals; (4) clear criteria for recognition of faults 
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or marginal performance; and (5) optimization of the diag¬ 
nosis and repair task. 

The latter typically involves (1) preparation, (2) mal¬ 
function verification, (3) fault location, (4) fault isolation, 
(5) disassembly, (6) part procurement, (7) part interchange, 
(8) reassembly, (9) alignment and (10) checkout. 

In many cases an approach based on simple checks to 
identify the malfunctioning module and replacement of 
that module is an appropriate strategy. 

7.24.3 Maintainability prediction 

Methods have been developed for the prediction of main¬ 
tainability as measured by the repair time. The basic 
approach is to synthesize estimates of the repair time from 
a data hank of times for element of the repair task. 
Von Alven (1964) describes a number of data collections 
developed for this purpose. One is the ASB-4 system. 
Another system is that developed by the American Insti¬ 
tute for Research (AIR). 

7.24.4 Maintainability testing and demonstration 

Major clients such as the armed services require the sup¬ 
plier to demonstrate maintainability as well as reliability. 
MIL-STD-471 Maintainability Demonstration states 
requirements for the US Armed Services, and is widely 
quoted. 

Maintainability is generally demonstrated by conduct¬ 
ing a series of tests. In the typical test a defined main¬ 
tenance task is undertaken and measurements are made of 
the times taken to perform it. A plot is made of the prob¬ 
ability of passing the test vs the MTTR (mean time to 
repair) which is then evaluated against a predefined cri¬ 
terion. 

Comparability between tests depends crucially on 
holding constant the various factors which are known to 
exert a strong influence. These are listed by D.J. Smith 
(1985a) as (1) method of selecting the demonstration 
task, (2) tools and test equipment available, (3) PM given 
to test system, (4) maintenance documentation, (5) envi¬ 
ronment during test and (6) skill level and training of 
test subject. 

7.25 Maintenance Activities and Policies 

The maintenance analysis of a system has as its objective 
the identification of failure situations and the formulation 
of appropriate maintenance policies. 

The theory of maintenance is a well-developed aspect of 
reliability engineering. Accounts are given in Maintain¬ 
ability (Goldman and Slattery, 1964), Maintainability, Princi¬ 
ples and. Practice (Blanchard and Lowery, 1969), 
Maintenance, Replacement and Reliability (Jardine, 1973) and 
Maintainability Engineering (D.J. Smith and Babb, 1973). 

The management of maintenance is described in Modern 
Maintenance (J.E. Miller and Blood, 1963), Effective Main¬ 
tenance Organisation (Newbrough, 1967), Maintenance 
Engineering and Organisation (Gradon, 1973), Principles of 
Planned Maintenance (Clifton, 1974), Systematic Main¬ 
tenance Organisation (Priel, 1974), Maintenance Manage¬ 
ment Techniques (Corder, 1976), and Maintenance 
Management and Terotechnobgy (Husband, 1976). 

The maintenance of plant to reduce failures and stop¬ 
pages is discussed below. Some wider aspects of the main¬ 
tenance function and of the information which it generates 
are described in Chapter 21. 


7.25.1 Maintenance activities 

Some maintenance activities which are carried out on pro¬ 
cess plants have traditionally been: 

(1) production assistance - adjusting machine settings; 

(2) servicing - replacement of consumables, including 
lubrication; 

(3) running maintenance - running repairs with little 
interruption to production; 

(4) shut-down maintenance - scheduled repair or over¬ 
haul with interruption to production; 

(5) breakdown maintenance - unscheduled repair with 
interruption to production. 

7.25.2 Failure regimes 

Before considering maintenance policies, it is pertinent 
to consider briefly the issue of failure regimes. The 
measures which can be taken to reduce failure depend 
very largely on the failure regime of the equipment. 
As already discussed, the three regimes are: (1) early 
failure, (2) constant or random, failure and (3) wearout 
failure. 

If the failure regime is established to be wearout failure, 
this points to a maintenance policy based on fixed interval 
replacement. 

In many cases the equipment appears to be in the 
random failure regime. If the failures of the equipment 
are truly random, then there is little purpose in carrying 
out scheduled maintenance, because by definition the 
equipment is just as likely to fail afterwards as before. 
This is a fundamental point which it is difficult to over¬ 
emphasize. 

On the other hand, failure of an equipment is rarely 
truly random. If an equipment appears to be in the con¬ 
stant failure regime, it is usually worth probing further. 
Often the apparent constant failure characteristic is due 
to the non-constant failure characteristics of the large 
number of components of which it is constituted. This 
effect has been discussed in Section 7.18. Thus if the 
failures of components rather than those of the whole 
equipment are analysed, non-constant failure regimes 
may be revealed, although in many cases the number of 
failures of each component may be so small that analysis 
is difficult. 

If the failure regime is established to be early failure, the 
choice of maintenance policy is again complex. In for¬ 
mulating a policy, account should be taken of the various 
factors which contribute to early failure, as described in 
Section 7.19. One of these may be failure induced by unnec¬ 
essary scheduled maintenance. 

7.25.3 Repair, reconditioning and replacement 

Another preliminary matter is the issue of repair, recondi¬ 
tioning and replacement. If an equipment is found to have 
deteriorated to a point where its condition or performance 
is unsatisfactory, it is sometimes replaced, but is more often 
repaired or reconditioned with the aim of restoring it to the 
‘as new’ condition. 

Often this is not achieved. Failure to make full restora¬ 
tion can be serious. A policy where this tends to be the 
outcome can result in a higher overall level of faults on 
the plant. It is essential, therefore, that for equipments 
with fine tolerances the requirements for repair or recon¬ 
ditioning he properly specified. There should be a written 
specification for the task. The specification not only 
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should quote the original design information such as a 
drawing number but also should give the permissible wear 
tolerances. 

It should be borne in mind that maintenance personnel 
deal with a wide range of equipment. On some of this 
equipment tolerances may not be particularly critical. It is 
important that they do not transfer the rough-and-ready 
methods which may be adequate there to equipment which 
requires more careful treatment. 

Certain equipment designs allow for the rectification of a 
fault by simply removing a defective module from the 
equipment and replacing it with a new one. This is then 
generally the best action. 

7.25.4 Maintenance policies 

Some policies for maintenance are: 

(1) scheduled maintenance: 

(a) inspection; 

(b) minor adjustment; 

(c) replacement; 

(2) on- condition maintenance; 

(3) opportunity maintenance; 

(4) breakdown maintenance. 

Maintenance policies can be classed as either PM or 
breakdown maintenance. All the policies except the last 
may be regarded as forms of PM. 

7.25.5 Planned maintenance 

In general, it is desirable that maintenance tasks be plan¬ 
ned rather than undertaken ad hoc. The term ‘planned 
maintenance’ is widely used and refers to any maintenance 
which is planned. It includes some breakdown maintenance 
where the latter can be planned in advance. 

7.25.6 Scheduled maintenance 

A subset of PM policies is that comprising the variations on 
scheduled maintenance. There are several forms of sched¬ 
uled maintenance, the distinction between them being the 
actions prescribed in advance. These may be (1) inspection, 
(2) adjustment or (3) replacement; the term‘adjustment’cov¬ 
ering virtually any action beyond inspection but short of 
replacement. 

If the policy is scheduled inspection and no problem is 
found, no further action is taken. However, if the inspection 
indicates that further action is required, it is taken, 
whether it be adjustment or replacement. Likewise, sched¬ 
uled adjustment generally includes inspection and may 
involve replacement if the inspection so indicates. 

7.25.7 Scheduled replacement 

If it is established that an item exhibits wearout failure, it is 
possible in principle to determine the failure distribution and 
to adopt a policy of scheduled replacement based on this. If 
the parameters of the distribution are known, the probability 
of failure prior to replacement which is tolerable can be 
specified and the time interval for replacement read off from 
the failure distribution function, as shown in Figure 7.32. 

Alternatively, the failure distribution may be assumed. 
In this case a common assumption is that the failure dis¬ 
tribution is normal. This assumption together with knowl¬ 
edge of the value of the mean life and a further assumption 
about the variance allows an estimate to be made of the 
replacement interval. If the mean life to wearout is m and 



Figure 7.32 Determination of the scheduled of 
replacement interval from the failure distribution 


the corresponding standard deviation is a, then the main¬ 
tenance policy is to replace at a time m 0 where 

m 0 = m-ko |7.25.1] 

As a rule-of-thumb the value of a is often taken as 

<s = 0.1 m J7.25.2] 

A typical value of k is 6, so that Equation 7.25.1 becomes 

mo = 0.4m [7.25.3] 

Thus, for example, bearings are commonly replaced at a 
proportion of their mean life, the so-called ‘BIO life’. 

7.25.8 On-condition maintenance 

An alternative to scheduled maintenance is on-condition or 
condition-based maintenance. On-condition maintenance 
(OCM) involves periodic inspection, and to this extent 
resembles scheduled inspection. Insofar as a difference can 
be drawn, the distinguishing features of OCM is that it 
tends to draw on the many powerful techniques now avail¬ 
able for condition monitoring and, when deterioration is 
detected, to involve prediction of the expected time to fail¬ 
ure. OCM has the advantage of averting failures by early 
action if inspection detects deterioration and of avoiding 
unnecessary maintenance if inspection reveals no deterio¬ 
ration. 

An account of OCM is given by Moubray (1991). The 
essential conditions for its practice are there is awell-def ined 
potential failure (PF) condition and that it is feasible to con¬ 
struct a dependable PF curve. In a PF diagram the fractional 
margin of acceptable performance (from 1 to 0) is plotted 
against time. This PF curve can then be used to predict the 
time of occurrence of total loss of margin, or failure.The time 
between first detection of PF and actual failure is the PF 
interval. For OCM to be practical, the PF curve must be rea¬ 
sonably reproducible. An inspection interval can then be 
chosen which is less than the PF interval. The time available 
for action to be taken is the difference between the PF and 
inspection intervals, or the net PF interval. 

Moubray (1991) also gives an appendix containing brief 
summaries of the various condition monitoring techniques 
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and their applications. A further account of these tech¬ 
niques is given in Chapter 19. 

OCM is a feasible policy only if an appropriate inspection 
or monitoring technique is available, but the development 
of new techniques is continually widening the scope of 
items which can be inspected for deterioration. However, 
since inspection incurs cost, there is an optimum degree of 
inspection. Optimal inspection policies are dealt with in 
standard texts on maintenance. 

7.25.9 Opportunity maintenance 

For equipments which are normally inaccessible, break¬ 
downs or stoppages provide the occasion to practice 
‘opportunity maintenance’. This consists of doing PM work 
as and when the item becomes available. 

Thus, for example, it is often normal practice that when a 
pump is opened up a check is made on alignment, bearings, 
seals and cooling water flow, but this check may be 
extended to other features such as the casing and the small 
bore connections. 

7.25.10 Burn-in 

As described above, one of the causes of early failure in a 
system with a large number of new components can be the 
presence of a proportion of weak components. An account 
of methods for dealing with this problem is given in Burn- 
In (Jensen and Petersen, 1982). These methods might be 
regarded as another type of maintenance policy. Jensen and 
Petersen describe a methodology for dealing with this kind 
of early failure problem by burn-in. Interest centres in large 
part on the prediction of the burn-in period required. 

7.25.11 Selection of maintenance policies 

There are considerable differences in the maintenance poli¬ 
cies which may be followed on process plant. At one extreme 
the policy may be one of breakdown maintenance only, 
whilst at the other the policy may be one of extensive PM. 

The terminology used for maintenance policies is 
defined in BS 3811: 1984 Glossary of Maintenance Terms 
Used in Terotechnology. An account of maintenance policies 
is given in Maintenance Aspects of Terotechnology. 1, Plan¬ 
ned Maintenance (Department of Industry (Dol), 1975/4). 
A decision tree illustrating the relationships between the 
various forms of maintenance is given in Figure 7.33. 

Over the years, maintenance policies have been subject 
to change, even fashions. Moubray (1991) distinguishes 
three stages. The first stage is that of breakdown main¬ 
tenance, characterized by plant which was relatively sim¬ 
ple, which was designed with large safety margins and 
which was usually not safety-critical. The second stage is 
that of PM, in response to pressures for longer equipment 
life, high availability and lower costs.The third stage is that 
of RCM, in response to intensification of the same pressure, 
as well as those of safety health and environment. 

At one time PM was very much in vogue. It was often 
taken to uneconomic lengths and, in consequence, the 
fashion faded. Most present policies in the process indus¬ 
tries are a mix of preventive and breakdown maintenance. 

If maintenance policies are considered from the safety 
and loss prevention viewpoint, it is apparent that it is 
desirable to forestall breakdown as far as possible and that 
it is prudent to identify critical equipments and to carry out 
appropriate inspection and PM on them. 

Process plants tend to run for long periods between 
scheduled shut-downs, or turnarounds. There are many 


equipments, however, which are not accessible for main¬ 
tenance except at shut-down. Thus the shut-down is 
extremely important from the maintenance viewpoint. 
In particular, the shut-down allows an opportunity for the 
maintenance of plant utilities. 

7.25.12 Maintenance information 

The formulation of maintenance policies and the monitoring 
of maintenance activities require that there be a suitable 
maintenance information system. The maintenance infor¬ 
mation system has as its main purpose the provision of data 
on which to base maintenance decision-making, but it also 
has the further important function of feeding back infor¬ 
mation on failure to the design department and information 
on failure and repair to the reliability engineering section. 

Some information which is relevant to maintenance includes 
identification and quantification of (1) failures responsible for 
hazardous conditions, (2) failures responsible for plant down¬ 
time and (3) failures responsible for direct repair costs. 

7.25.13 Maintenance effectiveness 

Measurement and monitoring of the effectiveness of the 
maintenance system is necessary, but is often not straight¬ 
forward. Maintenance costs break down into direct costs 
and indirect costs. The direct costs are (1) materials and 

(2) labour. Some indirect costs are those due to (1) plant 
unavailability, (2) loss of plant throughput, (3) loss of plant 
efficiency and (4) spares holdings. The overall effect of poor 
maintenance may result in a degree of disruption, the cost 
of which can exceeds the apparent sum of these factors. 

These considerations are the basis of approaches to 
maintenance which concentrate on the three ‘top tens’, 
these being the top ten items which contribute most in each 
of the three categories: (1) direct cost, (2) indirect cost and 

(3) troublesomeness. 

7.25.14 Maintenance indices 

It is common practice to evaluate maintenance perfor¬ 
mance in terms of ratios, or indices. Such indices typically 
measure (1) relative maintenance cost, (2) proportion of PM, 
(3) plant availability, (4) breakdown rate, (5) breakdown 
repair time and (6) breakdown cost. Normalizing factors 
used include (1) plant capital cost, (2) plant operating cost, 
(3) maintenance man-hours and (4) number of breakdowns. 


_ Total cost of maintenance 
Total capital cost of plant 
Total cost of maintenance 
Total cost of plant operation 
_ Total man-hours of preventive maintenance 
Total man-hours on all maintenance 
Plant up-time 

Plant up-time + Plant down-time 
Plant up-time 
Number of breakdowns 
Plant down- time _ 

" Number of breakdowns 


Index 7 


Cost of breakdowns 
Number of breakdowns 
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Figure 7.33 Decision tree illustrating the relationship between the various forms of maintenance (Department of 
Industry, 1975/4). Terminology used is from BS 3811: 1974 


Such indices can be useful tools, but they may also imply 
unwarranted assumptions. Index 3, for example, appears to 
assume that PM is always a good thing, which is not 
necessarily the case. 

A maintenance index may be evaluated by reference 
either to some absolute criterion value or to the historical 
trend. Both approaches have their uses. 

7.26 Reliability-centred Maintenance 

An approach to maintenance which is finding increasing 
acceptance is RCM. RCM is not a specific maintenance 


policy such as scheduled replacement or OCM, but an 
integrated method by which to select such policies. 
Accounts of this approach to maintenance are given in 
Reliability-Centred Maintenance (Anderson and Neri, 1990) 
and Reliability-Centred Maintenance (Moubray, 1991) and by 
Nowlan and Heap (1978), Sandtory and Rausand (1991) and 
Pradhan (1993). 

RCM developed within the civil aircraft industry. In 
1974, the Department of Defense commissioned a report 
on maintenance practice in that industry, published 
as Reliability-centred Maintenance (Nowlan and Heap, 
1978). 
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The elements of RCM may be considered under the 
following headings: (1) functions, (2) function failures, 
(3) failures modes, (4) failure effects, (5) failure con¬ 
sequences, (6) preventive tasks and (7) default actions.This 
description suggests that RCM may be regarded as being 
based on a form of FMEA. This is broadly true, but it takes 
an approach to FMEA which places particular emphasis on 
function, function failure and prevention. 

As described in the next chapter, FMEA is one of the 
prime tools of hazard identification used in safety and loss 
prevention work. Here it is sufficient to note that its grow¬ 
ing use in maintenance is a major influence for the 
integration of safety and loss prevention (SLP) and main¬ 
tenance. 


7.26.1 Functions, functional failures and 
performance standards 

Taking these elements in turn, RCM starts by establishing 
the functions of the equipment. The equipment will have 
some primary function which is its raison d’etre, but in 
addition it will generally have secondary functions. Thus, 
for example, a pump has the primary function of raising the 
pressure of the liquid, but it also has the secondary func¬ 
tion of containing it. Satisfactory performance with respect 
to safety, health and environment may be treated as other 
secondary functions. 

Increasingly, equipment comes with various kinds of 
protective device which serve to protect one or other of 
these functions. Protective devices are used to maintain the 
primary function by means such as bringing in standby 
equipment when the main equipment fails or to provide 
protection in relation to secondary functions such as safety 
or environment. For each function and each protective 
device there is a performance standard. 


7.26.2 Failure modes and causes 

It is necessary to identify the failure modes of the equip¬ 
ment. In general, failure modes may be described in terms 
of failure of performance or failure of condition. In RCM the 
former is the failure of function just described and it is 
the latter which is the failure mode. For example, if a 
pump becomes incapable of pumping the design flow of 
liquid, this might be expressed as a failure of pumping 
capability or a failure due to impeller wear. It is the failure 
of condition, the impeller wear, which is treated as the fail¬ 
ure mode. 

In the analysis of the failure modes it is important to 
uncover the root causes. Typical root causes include incor¬ 
rect lubrication or maloperation. In the case of the pump 
impeller wear, the root cause might be cavitation due to 
partial blockages in the suction line. 


7.26.3 Failure effects and consequences 

The failure effects describe what happens when the failure 
occurs. They include the symptoms of failure and the effects 
on the process, on other equipment, safety and the environ¬ 
ment. These failure effects are evaluated in order to assess 
the failure consequences. Here four types of consequence are 
distinguished: (1) hidden failure consequences, (2) safety 
and environmental consequences, (3) operational con¬ 
sequences and (4) non-operational consequences. 

The term‘hidden failure’ is that generally used in RCM to 
denote the unrevealed failure of protective devices. Most pro¬ 


tective devices tend to fail without signalling the fact. In such 
cases the device then remains in the failed state until the fail¬ 
ure is revealed either because the device is checked or because 
a demand occurs against which the device no longer provides 
protection. In other words, protective devices with this char- 
acteristicarenotfail-safe.Thetreatmentofunrevealedfailure 
of protective devices is discussed in Chapter 13. 

A hidden failure means that there is a risk of a demand 
occurring against which there is no protection, and hence 
of what in RCM is called ‘multiple failure’. 

The safety and environmental, operational and non- 
operational consequences are largely self-explanatory. The 
latter covers any damage to the equipment 

7.26.4 Preventive tasks and default actions 

The next step is to determine for each failure mode in turn 
whether a PM task exists which can eliminate or ameliorate 
the failure. For main equipment the approach followed 
is essentially that already described of establishing the 
failure characteristic (e.g., early failure, wearout failure) 
and identifying a corresponding appropriate preventive 
task. Consideration is also given to the appropriateness of 
OCM. For protective equipment, where the aim is to maintain 
an adequate availability, the main preventive action is to 
reduce the failure rate. The alternative measure is to alter the 
inspection interval, which counts as a default action. 

In the RCM context, whether or not a preventive task is 
appropriate depends first on its technical feasibility and 
then on its worthwhileness. A task is undertaken only if it 
is feasible and worthwhile. 

It is not appropriate to try to deal with every failure mode 
by a PM task. Where such a solution is not available, a 
default action is taken. Principal default actions are 
(1) redesign, (2) periodic inspection and (3) no action. 

The typical account of RCM describes a rather for¬ 
malized system with decision flow diagrams, FMEA work¬ 
sheets, and so on. Commonly used abbreviations are: 
F, failure; FF, function failure; FM, failure mode; H, hidden 
failure; S, safety; E, environment; 0, operation. 

7.26.5 Illustrative example 

The application of RCM to the process industries is illus¬ 
trated by an example given by Pradhan (1993). The author 
deals with the use of RCM on a set of main reactor charge 
pumps handling vinyl chloride monomer (VCM) on a poly¬ 
vinyl chloride (PVC) plant. Aims included the improvement 
of the pump system reliability and avoidance of the need 
for breakdown maintenance, and the prevention of VCM 
leaks and fires. He gives sample functions and failure 
analysis tables akin to those produced in FMEA, discusses 
in particular the hidden failure of protective devices, 
and describes the outcomes of the study in terms of the 
preventive tasks and default actions. 

7.27 Life Cycle Costing 

The concept of life cycle costing (LCC) is that ownership of 
an asset involves not only capital but also other costs, and 
that the aim should be to minimize these costs over the life 
cycle of the asset. An account of LCC in the context of pro¬ 
cess plants is given by Lees (1983d). 

7.27.1 Management of life cycle costing 

The practice of LCC is likely to be effective only if fully sup - 
ported by management, whose attitude is crucial. Frequently 
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the issue which will reveal management’s attitude will be the 
trade-off between higher initial cost and overall LCC. The 
role of management is to establish the policy of LCC and to set 
up formal systems to ensure that the policy is followed. 

There are also other ways in which management can 
promote LCC. One is the rotation of personnel between the 
plant and the design function, so that plant experience is 
fed hack into design. Failure to achieve such feedback, by 
this or other means, can be very costly. 

There are a number of other activities to which LCC is 
related. They include (1) reliability and maintainability 
engineering, (2) value engineering and (3) process economics. 
It is unlikely that the practice of LCC will flourish unless 
the organizationhas a sufficient level of activity in such areas. 

A practical policy for LCC needs to define clearly the 
items to which it is to be applied and needs to avoid exces¬ 
sive complication. 


7.27.2 Applicability of life cycle costing 

LCC is most readily applied to an asset which is ‘free¬ 
standing’, that is, one whose failure does not cause sig¬ 
nificant disruption. In this case the optimization of the life 
cycle cost is essentially a trade-off between the higher 
capital cost of an equipment with superior performance, 
including reliability, and the direct costs of inferior per¬ 
formance, including unreliability. Whatever the case with 
other equipment, and a truly free-standing equipment is 
perhaps not as common as might appear at first sight, that 
used in process plant does not fall into this category. 

LCCissubjecttothelawofdiminishingretums.Apolicyfor 
LCC therefore needs to include some sort of stopping rule. The 
returns are likely to be greatest for two types of equipment: 
(1) major items and (2) minor items used in large numbers. 

7.27.3 Decision process for life cycle costing 

It is not uncommon in the acquisition of an asset that the 
decision is made by the wrong person at the wrong time 
on the basis of inadequate information, or even that it is 
made essentially by default. For LCC the decision process 
covers the stages of (1) specification, (2) design and (3) pro¬ 
curement. 

Often the key decisions are those taken early in the project. 
Thereafter, many of the options which have the strongest 
influence ontheLCC areforeclosed.That said, theimportance 
of the procurement stage should not be underestimated. 


7.27.4 Factors contributing to life cycle cost 

Some of the factors which contribute to LCC are: for the 
equipment, (1) capital cost, (2) maintenance cost and (3) equip¬ 
ment life; and, for the plant, (1) plant availability, (2) plant 
instantaneous throughput, (3) plant efficiency and (4) plant 
flexibility Safety, health, environment and other factors act as 
constraints which may have a strong influence on the LCC. 

Often the main elements from this list are (1) capital cost, 
(2) maintenance cost and (3) plant availability. 


7.27.5 Information for life cycle costing 

The practice of LCC requires information on inter alia 
(1) failure rate, (2) repair time and (3) plant unavailability. 

It is possible to construct a long list of information which 
in principle bears on LCC. However, not all this information 
is readily observable, at least without excessive cost. If the 
is considered in terms of the two 


attributes of importance and observability, the policy 
adopted might well be the following: 


Observability 
High Low 


Importance High Y ? 

Low ? N 


whereY indicates that the information is sought, N that it is 
not sought and ? that the case is considered on its merits. 

7.27.6 Essential and optional equipment functions 

The functions of equipment divide into the essential and 
the desirable. Examples of essential functions include 
containment by materials of construction, material trans¬ 
fer by pumps and compressors, control by instruments and 
computers, protection by protective devices and thermal 
insulation by lagging. Other functions may be less 
essential, even optional. Examples are equipment for heat 
recovery or improved process yield. 

The computation of LCC in these two cases is different. 
Where the function is essential, the decision is concerned 
with the alternative ways of providing the function, 
but where it is optional the decision is rather whether to 
provide it at all. The latter decision may well he more self- 
contained and easier to make. 

7.27.7 Euipment functions involving availability 

A further distinction to be made is that between those 
decisions which involve plant availability and those which 
do not. The effect of an equipment on plant availability is 
often quite difficult to assess. Intermediate storage is pro¬ 
vided to improve plant availability, but its effectiveness is a 
function of the storage operating policy adopted. Stand by 
equipment is provided to cut in when the main equipment 
fails, but its reliability in responding to this demand 
depends largely on management factors. 

A further complication arises when the plant is not oper¬ 
ating at full capacity and its availability is at a discount. It is 
difficult to generalize about this situation, but one point is 
worthmaking. Itcanbeofvalueto demonstrate that theplant 
can operate dependably at high availability, even if not cur¬ 
rently required to do so, since this means that it is known 
that when demand picks up it can be met from the existing 
plant, thus allowing expenditure on a further plant to be 
deferred. 

7.27.8 Equipment quality vs system configuration 

It often occurs that a particular function can be provided by 
a single equipment or by several equipments in some- 
suitable configuration. For a given level of reliability, the 
single equipment will need to be of higher quality. There 
is therefore a choice to be made between a single, high 
quality item and several items which could be of lower quality. 

In making this decision, use may be made of simple 
models of system reliability and availability such as those 
given above, particularly in Sections 7.8 and 7.13. If the case 
is considered of a single equipment vs two parallel redun¬ 
dant equipments, the reliability of the single item needs to 
be very high to match that of a parallel system of two items 
of moderate reliability. 
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7.27.9 Assessment of equipment quality 

The ability to assess the quality of equipment is clearly 
crucial to the practice of LCC. Some factors relevant to the 
assessment are (1) user experience, (2) vendor reputation, 
(3) design status (new, established), (4) capital cost, 
(5) material of construction and (6) engineering principles. 
Engineering principles include (1) the number of sub¬ 
systems and components, (2) electronic vs mechanical 
subsystems, (3) moving parts and (4) stressing of parts. 
Also relevant are any quality assurance arrangements 
which exist between the vendor and the user. 

7.28 Notation 

Sections 7.1-7.13 

a constant; parameter in rectangular, gamma, 

Pareto and extreme value distributions 
A eventA 

A(t) availability 

A matrices defined by Equations 7.10.6 and 7.10.36 

b constant; parameter in rectangular, gamma 

and extreme value distributions 
B event B 

C event C; minimum cut set 

d(t) down-time 

E event E 

f{t) failure density function 

f A (d) down-time density function 

/ r (f r ) repair time density function 

f w (w) throughput density function 

/i(f),/ 2 (f) failure density function of subsystem 
F[t) failure distribution function 

F d (d) down-time distribution function 

F T {t T ) repair time distribution function 

g(s) Laplace transform of g(t) 

H(t) cumulative hazard function 

I identity matrix 

k counter; state counter; parameter in Weihull 

distribution (alternative form); parameters 
defined by Equations 7.13.28 and 7.18.5 
m mean life; parameter in Weibull distribution 

(alternative form); mean of normal distribution; 
number of repairmen 

m location parameter in log-normal distribution 

m A mean down-time 

wii t'th moment (experimental) 

m r mean repair time; mean of normal distribution 

of repair times 

w r * location parameter in log-normal distribution 

of repair times 

m Ta mean repair time of upstream unit 

m n mean up-time 

m z * parameter in log-normal distribution of hazard 

rates 

n counter; number of items; number of states; 

number or trials; number of repairmen; number 
of applications of load 
n f (t) number of items failed 

«,• number of times outcome i occurs 

n s (t) number of items surviving 

p probability; probability of success 

P probability; probability of success 

P(|) conditional probability 

P k probability of being in state k 


P vector of probabilities 

q probability of failure 

Q(t) probability of failure, unreliability, failure 

distribution function 
r counter 

rpr 2 equation roots defined by Equations 7.8.24 
and 7.8.26 

R(t) probability of success or survival, reliability, 
reliability function 
R sw probability of switchover 

R z reliability of component 

s Laplace operator 

t time; failure time 

t r repair time 

T time period; minimum tie set 

T e time to empty tank 

u{t) up-time 

V(t) unavailability 

F s unavailability of upstream unit 

F st unavailability of upstream unit + tank 

w throughput 

z(f) hazard rate 

£() Laplace transform 

a parameter in Weibull distribution (alternative 

form); confidence level parameter 
P shape factor in Weibull distribution 

y location parameter in Weibull distribution; 

number of standard deviations 
T gamma function 

C event rate 

i\ characteristic life in Weibull distribution 

A failure rate; transition rate 

X failure rate 

4t failure rate of upstream unit + tank 

Au failure rate of upstream unit 

p moment; mean number of events; repair rate 

gi *th moment (theoretical) 

{ repair rate enhancement factor 

p parameter defined by Equation 7.13.24 

a standard deviation of normal distribution; 

shape factor in log-normal distribution 
<t l standard deviation of loading 

<7 r standard deviation of repair times; shape para¬ 

meter in log-normal distribution of repair 

a s standard deviation of strength 

<r z parameter in log-normal distribution of 

hazard rates 

t time; repair time; parameter defined by Equa¬ 

tion 7.18.6 

<j>( r, t) joint density function 

Superscripts 

Laplace transform 
A estimated value 


Section 7.14 

E event 

/ti(/i) density function of fi 
/ti|a (h | X ) density function of 4 | X 
fx(x) density function of x 
fx\y(x\y) density function of x \ y 
fy(y) density function ofy 
fy\Ay I x ) density function of y \ x 
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f\(X) density function of A 

f\\n(A | 4) density function of A \ h 
H hypothesis 

n number of failures 

t time 

4 specific value of 7\ (time to failure) 

Ti random variable (time to failure) 

x specific value of X 

X random variable 

y specific value of Y 

Y random variable 

A specific value of A (failure rate) 

A random variable (failure rate) 

H parameter in distribution of A 

Superscript 

estimated value 


Section 7.15 

E( ) expected value 

fi density function of component/ 

/„„ density function of xn 

F m distribution of function of xn 

n counter for renewals 

N number of renewals 

P probability 

s Laplace operator 

t time 

k time to failure of component i 

Superscript 

— Laplace transform 


Section 7.16 

C average annualized cost of operation 

C c capital cost of equipment 

f(n) rate of expenditure on maintenance 

/(f) rate of expenditure on maintenance 

n number of years equipment is to be in use 

S scrap value of equipment 

t time equipment is to be in use 


Section 7.17 
Subsection 7.17.5 

f(x) density function of load x 

f(y) density function of strength y 

g(z) density function of z 

G(z) distribution function of z 

L load 

m x mean value of load x 

m y mean value of strength^ 

m z mean value of z 

n x constant in Equation 7.17.4 

n y constant in Equation 7.17.5 

S strength 

u parameter defined by Equation 7.17.13 

v parameter defined by Equation 7.17.14 

* load 

y strength 

z difference between load and strength 


a x standard deviation of load x 

a y standard deviation of strength y 

<t z standard deviation of z 

<p safety parameter 

Subsection 7.17.6 
f(i) shaping factor 

L load 

n number of applications of load 

p parameter defining shaping factor in Equation 

7.17.21 

R(n) probability of survival after n applications of load 

5 stress (or strength) 

So initial strength 

A Si decrement of strength 

S strength 

z(t ) hazard rate 

a scaling factor 


Section 7.18 

a , b constants 

H( t) cumulative hazard function 

k parameter in Weibull distribution (alternative 

form) 

m parameter in Weibull distribution (alternative 

form) 

R(t) probability of success or survival, reliability 

A parameter defined by Equation 7.18.4 

t parameter defined by Equation 7.18.6 


Section 7.19 

f(t) density function 

/i(f),/ 2 (f) constituent density functions 
p weighting factor 

Section 7.20 

Subsection 7.20.6 
f degrees of freedom 

/n/2 degrees of freedom 

LQ lower limit 

m mean life 

n number of trials 

N number of trials 

S number of successes 

T period of test 

UQ upper limit 

a confidence parameter 

X 2 chi square distribution 

Superscript 

estimated value 

Subsection 7.20.8 
as Sections 7.1-7.13 plus 
E mea n mean rank 

E med median rank 

mean order number 
m 0 replacement time 

Am mean order number increment 

n number of items 

n/1) number of items failed 

x number of items before jth failure 
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Subsection 7.20.11 
as Sections 7.1-7.13 plus 
a parameter 

a,- parameters 

b parameter 

L likelihood function 

t time to failure 

z c calculated hazard rate 

&th moment of distribution 
C logarithm of likelihood function (= In L) 

Subsection 7.20.16 
as Sections 7.1-7.13 plus 
v random number 

Subsection 7.20.17 
z(f) hazard rate 

z,- zth influencing variable, or explanatory factor 

z o (0 baseline hazard function 

ft coefficient of z,- 


Section 7.22 

as Sections 7.1-7.13 plus 

Q parameter representing complexity of tth sub 

system 

Wi weighting factor for zth subsystem 


Section 7.23 


Subsection 7.23.3 
T period of test 

a index 


Subscripts 

cum cumulative 

cur current 


Subsection 7.23.4 

c allowable number of defects 

n number of items in sample 

p proportion of good items 

P probability of acceptance 

q proportion of defective items 


Section 7.25 
k constant 

m mean life of component 

m 0 replacement time of component 

a standard deviation of life of component 
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8/2 HAZARD IDENTIFICATION 


The identification of areas of vulnerability and of specific 
hazards is of fundamental importance in loss prevention. 
Once these have been identified, the battle is more than half 
won. Such identification is not a simple matter, however. In 
many ways, it has become more difficult as the depth of 
technology has increased. Loss prevention tends, increas¬ 
ingly, to depend on the management system and it is not 
always easy to discover the weaknesses in this. The physi¬ 
cal hazards also no longer lie on the surface, accessible to 
simple visual inspection. On the other hand, there is now 
available a whole battery of hazard identification methods 
which may be used to solve these problems. Selected refer¬ 
ences on hazard identification are given in Table 8.1. 

Different methods are required at different stages of a 
project. Table 8.2 lists some of these stages and the corre¬ 
sponding hazard identification techniques. The list is 
illustrative and, in particular, a technique quoted for one 
stage may also be applicable to another stage. There is no 
single ideal system of hazard identification procedures. 
The most appropriate system varies to some extent with the 
type of industry and process. Thus, for example, a firm 
involved in the batch manufacture of a large number of 
organic chemicals is likely to be much more interested in 
techniques of screening and testing chemicals and reac¬ 
tions than one operating ethylene plants. 

The choice of hazard identification technique also 
depends on the purpose for which the study is done. For the 
identification of hazards and operating problems on a 
plant, a hazard and operability (HAZOP) study is suitable, 
while for the identification of sources of release for a hazard 
assessment, it is necessary to carry out a specific review of 
such sources. It is only sensible in hazard identification to 
make use of past experience. The use of standards and 
codes, of course, helps to avoid hazards of which people 
may not even be aware. 

Many of the hazard identification techniques used, how¬ 
ever, are concerned with situations, which have some 
element of novelty. Methods for screening and testing are 
used to detect hazardous runaways and decompositions 
in new chemicals and reactions. HAZOP studies are used 
to identify how often familiar hazards may be specifically 
realized in a new plant. 

8.1 Safety Audits 

One of the first systematic methods of hazard identifica¬ 
tion used in the chemical industry was the safety audit. 
Audits of various types are a normal management tool and 
are of considerable importance in safety. 

An early account of safety audits in the United Kingdom 
was the BCISC report SafeandSound(1969/9), which drew on 
the experience of the US chemical industry, where the safety 
audit was established as a prime means of ensuring safety. 
A full description of such an audit is given in the BCISC’s 
Safety Audits (1973/12). A safety audit subjects every area of 
the organization’s activity to a systematic critical examina¬ 
tion. It aims, like other audits, to reveal the strengths and 
weaknesses and the areas of vulnerability. It is carried out by 
professionals and results in a formal report and action plan. 

Safety Audits draws a distinction between a safety audit 
and a safety survey, which is a detailed examination of a 
narrow field such as specific procedures or a particular 
plant; safety inspection, which is a scheduled inspection 
of a unit carried out by the unit’s own personnel; safety 
tour, which is an unscheduled tour of a unit carried out by 


Table 8.1 Selected references on hazard identification 


Albisser and Silver (1960,1964); W.H. Richardson (1962, 
1963); Carpenter (1964); Coulter (1965); Dow Chemical Co. 
(1966a,b, 1976,1994); Fowler and Spegelman (1968); Leeah 
(1968—);British Chemical Industry Safety Council (BCISC) 
(1969/9,10,1973/12,13); N.T. Freeman andPickbourne (1971); 
Voigtsberger (1973); DOT, CG (1974a-d); D.W. Jones (1975); 
Harvey (1976,1979); Heron (1976); Gelburd (1977); 

W.G. Johnson (1980); L. Kaplan (1981b); Gorbell (1982); 
Husman and van de Putte (1982); Kletz and Lawley (1982); 
Engineering Council (1983); W.B. Howard (1983,1984); 
Kletz (1983d, 1984i, 1984 LPB 59,1985e, 1986d, 1992b); 
Solomon (1983 LPB 52,1984 LPB 54); Anon. (1984 LPB 60, 
p. 40); Embling (1986); CCPS (1985); Hoffmann (1985); 
Hoffmann and Maser (1985); van Horn (1985); Ducsherer 
and Molzala (1986); Flothmann and Mjaavatten (1986); 
Parry (1986 SRD R379); Pikaar et al. (1986); Pitblado 
(1986); Vervalin (1986b); Ozog and Bendixen (1987); Waite 
et al. (1988); Andreasen and Rasmussen (1990); Galagher 
and Tweeddale (1990,1992);Tweeddale (1990a-c); Ahmed 
and Khan (1992); Argent et al. (1992); Kavianian et al. 
(1992); Pontiggia (1992); Sharkey etal. (1992);Toola (1992); 
Sankaran (1983); Knowlton (1993); Taylor (1993 LPB 112); 
Vincoli (1993) 

CCPS Hazard Evaluation Guidelines 

Witter (1992) 

Physical and chemical properties (see also Tables 
11 . 1 , 11 . 18 , 16 . 1 , 16 . 3 , 17 . 3 , 17 . 62 , 18 . 1 ) 

National Institute for Occupational Safety and Health 
(NIOSH) (Crit. Doc. series, 1990/18); Nuckolls (1929); 
Mellan (1950,1957,1977); MCA (1952-SD series, 1972/21); 
NSC (1952—, Safety Data Sheets); DECHEMA (1953-); Sax 
(1957—, 1981,1986); Kirk and Othmer (1963-, 1978-, 

1991-); Marsden (1963); Shabica (1963); D.T. Smith (1965a); 
Anon. (1966- 67); CGA (1966/1); G.D. Muir (1971-); Bahme 
(1972); FPA (1972- Meidl (1972); Bretherick (1974,1975, 
1976,1987a,b, 1990); DOT, CG (1974a,b); Int. Tech. Inf. Inst. 
(Japan) (1975); DoE and Chemical Society (1976); Shieler 
and Pauze (1976); Redeker and Schebsdat (1977); Sittig 
(1979); Weiss (1981); Anon. (1985p); Sax and Lewis (1986); 
Reale and Young (1987); A. Allen (1988); Walsh (1988); 
National Fire Protection Association (NFPA) (1991/27); 
Carson and Mumford (1994) 

Safety evaluation of chemicals 

Cumberland and Hebden (1975); Brannegan (1985); 
A.S.West (1986,1993a,b); Kohlbrand (1990) 

Reactivity, instability, explosibility 

ASTM (STP 394,1975); Lothrop and Handrick (1949); 
Boynton etal. (1959); Steele and Duggan (1959); van Dolah 
(1961,1965,1969a); Mackenzie (1962,1974); van Dolah etal. 
(1963); Shabica (1963); Wilcox and Bromley (1963); Cruise 
(1964); J.R. Marshall (1964); G.T. Austin (1965b); 

Gam (1965); Snyder (1965,1982); Platt and Ford (1966); 
Sykes (1966); Prugh (1967); Silver (1967); Wankel (1967); 
Adams (1968); Lindeijer (1968); Roburn (1968); Settles 
(1968); Woodworth (1968); Brinkley (1969); Lindeijer and 
Pasman (1969); Spiegelman (1969); Flynn and Rossow 
(1970a); Stull (1970,1973,1976,1977); Bersier etal. (1971); 
Gordon and McBride (1971,1976); VJ. Clancey (1972a, 
1974b); Coffee (1972,1973,1982a); Rollet and Bouzis (1972); 
Blazek (1973); Daniels (1973); E.J. Davis and Ake (1973); 
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Dehn (1973); Sheldon and Kochi (1973); Treweekef et al. 
(1973); Bowes (1974b); Carver et al. (1974); Groothuizen etal. 
(1974); A.J. Owen and von Zahn (1974); Porter (1974); 
Wendlandt (1974); Berthold etal. (1975); Burleson etal. 
(1975); Denn (1975); Keattch and Dollimore (1975); 
O’Driscoll (1975b); O’Neill (1975); Berthold and Loffler 
(1976); Brasie (1976a); Janin (1976); Lemke (1976); 
Riethmann etal. (1976); Grewer (1977); Pesata etal. (1977); 
Townsend (1977); Noronha and Juba (1980); G.F.P. Harris 
etal. (1981); Verhoeff (1981,1983a,b); Hoffmann (1985); 
Hoffmann and Maser (1985); Bretherick (1987a, 1990); 
Hofelich and Thomas (1989); Kohlbrand (1990); Merrifield 
and Roberts (1991); NFPA (1991NFPA 49,325M, 491M); 
T.A. Roberts and Royle (1991); Frurip (1992); H.E. Fisher 
and Goetz (1993); Siwek and Cesana (1993); Fierz (1994); 
Wang, van Kiang and Merkl (1994) 

Combustible solids, thermal explosion: (see a/soTable 
16.28): Groothuizen et al. (1977); Beever (1981); Beever and 
Thorne (1981): Bishop (1981); Boddington etal. (1981); 
Bowes (1981); E.J. Davis etal. (1981); N. Gibson and Harper 
(1981b); Napier and Vlatis (1981); D.W. Smith (1982); Grewer 
(1987a,b); Cardillo (1988); de Faveri, Zonato etal. (1989); 
Fierz and Zwahlen (1989); Kotoyori (1989a); Tharmalingam 
(1989b); Liang and Tanaka (1990) 

Test methods: VJ. Clancey (n.d.); A.K. Gupta (1949); Rapean 
etal. (1959); Koenen etal. (1961); Snyder (1965,1982); Coffee 
(1969,1972,1973,1976,1982); MoD (1972); Connor (1974); 
Seaton etal. (1974); Berthold etal. (1975); Berthold and 
Loffler (1976); Eigenmann (1976); Janin (1976); Lemke 
(1976);Treweek etal. (1976); May (1978); Anon. (LPB 30 
1979, p. 159); Dahn (1980); Myers (1980); Seyler (1980); D.W 
Smith etal. (1980); Storey (1980,1981); ABPI (1981,1989); de 
Groot and Hupkens van der Elst (1981); Short et al. (1981); 
Townsend (1981); Mohan etal. (1982); Duch etal. (1982); 
Daugherty (1983); Pickard (1983); Fenlon (1984,1987); 

C.A. Davies etal. (1985); Kohlbrand (1985,1987a,b, 1989, 
1990); Yoshida etal. (1985); Cutler (1986); UN (1986,1988, 
1990); Craven (1987); Cronin and Nolan (1987a,b); Grewer 
(1987a,b); Mellor etal. (1987); Snee (1987); Ducros and 
Sanner (1988); Health and Safety Executive (HSE) (1988 
CRR 5); Mellor et al. (1988); Thomson and Zahn-Ullmann 
(1988); Boddington etal. (1989); Frurip etal. (1989); 
Hasegawa et al. (1989); Seaton and Harrison (1990); Uehara 
and Kitamura (1990); Ando etal. (1991); Cardillo and 
Cattaneo (1991); Cardillo and Nebuloni (1991); H.G. Fisher 
and Goetz (1991); Townsend andValder (1993); Whitmore 
and Wilberforce (1993); Kossoy etal. (1994); Mores etal. 
(1994); Wan etal. (1994);Whitmore (1994) 

Classification of materials: ACDS (1991); Merrifield and 
Roberts (1991); T. A. Roberts and Royle (1991); UN (1991); 
Hofelich, Power and Frurip (1994) 

Process chemical reactions 
Schierwater (1971); Grewer (1974,1975,1976,1991); 
Berthold and Loffler (1976); Eigenmann (1976,1977); Janin 
(1976); Regenass (1976); Schleich (1976); Schofield (1976); 
Schildknecht (1977); Stull (1977); Husain and Hamilcar 
(1978); Dehaven (1979); Hub et al. (1979); Holzer et al. (1980); 
Noronha etal. (1980); D.W Smith (1982,1984); Hoffmann 
and Maser (1985); Zeller (1985); Grewer and Klais (1988); 

B. Rasmussen (1988); Verhoeff (1988); Gygax (1989,1990); 
Palazzi and Ferraiolo (1989); Barton and Rogers (1993); 
Gustin (1993); Landau and Cutro (1993); S. Schwartz (1993); 
Stoessel (1993); Cardillo (1994) 

Test methods: Snyder (1965,1982); Hub (1975,1976, 

1977a—c, 1980,1981); Berthold and Loffler (1976); 


Eigenmann (1976); Regenass (1976); Noronha etal. (1979); 
Grewer and Klais (1980,1988); Hakl (1980,1981); Noronha 
and Juba (1980); Townsend andTou (1980); Verhoeff and 
Janswoude (1980); Brogli etal. (1981); Dollimore (1981); 
Grewer (1981,1987a,b); Wilberforce (1982,1984); Fierz etal. 
(1983,1984); Giger et al. (1983); Grewer and Duch (1983); 
de Haven (1983); Klais and Grewer (1983); Coates (1984a,b); 
N. Gibson (1984); Verhoeff and Heemskerk (1984); Hub and 
Jones (1986); Ottaway (1986); Spence et al. (1986); 
Wendlandt (1986); T.K. Wright and Rogers (1986); Kirch 
etal. (1987);T.K.Wright and Butterworth (1987); Spence 
and Noronha (1988); Chaineaux and Dunnin (1989); Dixon- 
Jackson (1989); Fauske etal. (1989); Hofelich (1989); Hoppe 
and Grob (1989); Kohlbrand (1989); Kotoyori (1989b); Mix 
(1989); Rogers (1989a); Steele and Nolan (1989); Duswalt 
(1991); Vilchez and Casal (1991); Hoppe (1992); Lambert 
etal. (1992); Landau and Williams (1992); J. Singh and Boey 
(1992); Snee and Hare (1992,1994); Suter et al. (1992); 
Cardillo et al. (1993); Gustin (1993); Snee et al. (1993); Steele 
etal. (1993) CCPS program: A.S.West (1993a) 

Laboratories, pilot plants (see also Table A7.2) 

Fleming (1958); Gernand (1965); Gorman etal. (1965); 
Hudson (1967); Perciful and Edwards (1967); Katzen 
(1968); Anon. (1969a); Conn (1971); Katell (1973); Dollimore 
(1981); Hoffmann (1985); van Horn (1985); Kohlbrand 
(1985); Brummnel (1989) 

Hazard indices 

Pratt (1965); Stull (1970,1973,1977); DOT, CG (1974a,b); 
D.E. Miller (1976); C.J. Jones (1978); Pitt (1982); Embling 
(1986); Kletz (1988f); de Graaf (1989); Lapp (1990); NFPA 
(1991 NFPA 49); Kavianian et al. (1992) 

Dow Index, Dow Guide: Dow Chemical Co. (1964,1966a,b, 
1976,1980,1987,1994); van Gaalen (1974); Scheffler (1994) 
Mond Index: D.J. Lewis (1979,1980b, 1989b); Doran and 
Greig (1984 LPB 55); ICI (1985); Tyler (1985) 

Instantaneous Fractional Annual Loss (IFAL) Index: 

J. Singh and Munday (1979); Munday etal. (1980); LTB (1981); 
Menashe and Berenblut (1981); Berenblut and Menashe 
(1982);Whitehouse (1985); Berenblut and Whitehouse(1988) 
FIRST: Mudan (1989c) 

Insurance assessments 

Dow Chemical Co. (1964,1966a,b, 1976,1980,1987,1994); 
Fowler and Spiegelman (1968); Spiegelman (1969); Neil 
(1971); Drewitt (1975) 

Ranking methods, rapid ranking 

Mumford and Lihou (LPB 591984); Gillett (1985); Keey 
(1991); G. Stevens and Stickles (1992) 

Process safety reviews, hazard studies 

R. W. Henry (1979); Wells (1981); Anthony (1985); IMechE 
(1985/88); Oh and Husmann (1986); Vogler (1986); van 
Mynen (1990); Turney (1990a,b, 1991); Desjardin etal. 
(1991); Grossman and Fromm (1991); Wells et al. (1991); 

Burk (1992); Kolodji (1993); Heetveld (1993); R. James and 
Wells (1994);Wells etal. (1994) 

HAZOP studies 

Binsted (1960); Birchall (1960); Elliott and Owen (1968); 
Kletz (1972a, 1983d, 19841,1985e,i, 1986d, 1988b, 1992b); 

S. B. Gibson (1974,1976a,b); ICI (1974); Lawley (1974a,b); 
Cowie (1976); Henderson and Kletz (1976); Knowlton (1976, 
1979,1981,1989,1992); Lock (1976); Chemical Industries 
Association (CIA) (1988 RC18); CISHC (1977/6); Rushford 
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(1977); Himmelblau (1978); Sachs (1978); Ministry of Social 
Affairs (1979a); A.F. Johnston, McQuaid and Games (1980); 
Lihou (1980a,b, 1990b, 1985 LPB 66); Wells (1980); 
Merriman (1982 LPB 48); Scott (LPB 481982); Anon. (LPB 
491983, p. 1); IBC (1983/42,1984/53); Illidge (1983 LPB 53); 
Lowe and Solomon (1983); Sinnott (1983); Solomon (1983 
LPB 52,1984 LPB 54); Bendixen and O’Neill (1984); 
Piccinnini and Levy (1984); Ozog (1985); Shafaghi and 
Gibson (1985); Flothmann and Mjaavatten (1986); Suokas 
(1986); Qureshi (1988); ILO (1989); Anon. (1991 LPB 98, 
p. 1); R.A. Freeman (1991); W.J. Kelly (1991); Black and 
Ponton (1992); Deshotel and Goyal (1992); Hendershot 
(1992); Isalski etal. (1992); Kavianian etal. (1992); 

G.C. Stevens and Humphreys (1992); D. Jones (1992); 
McCluer and Whittle (1992); Mitchell (1992 LPB 105); 

D. Scott and Crawley (1992); G.C. Stevens etal. (1992);Wells 
and Phang (1992); Willis (1992 LPB 108); Charsley and 
Brown (1993); Fully (1993); Sweeney (1993); Taylor (1993 
LPB 112) CCPS Guidelines: Witter (1992) 

Safety audits, including management audits, 
plant audits 

MCA (SG-20); Stapleton (1963); J.U. Parker (1967,1973); 
Whitehorn and Brown (1967,1973); BCISC (1969/9,10,1973/ 
12,13); D. Williams (1971); Harvey (1976,1979b); Kletz etal. 
(1977); R. King and Magid (1979); Kletz (1977h, 19811); 
Anon. (LPB 601984); Conrad (1984); Scheid (1987); Anon. 
(1988 LPB 79, p. 25); Atallah and Guzman (1988); Luck and 
Howe (1988); Madhavan and Kirsten (1988a,b); Madhavan 
and Landry (1988); Monk (1988); Camp (1989); Stallworthy 
(1989); Kase and Wiese (1990); Scheimann (1990);Tweeddale 
(1990a, 1993d, 1994,1994 LPB 117); I.G.Wallace (1990); 

NSW Government (1991); L.W. Ross (1991); Galagher and 
Tweeddale (1992); Ozog and Stickles (1992); D. Scott and 
Crawley (1992); Lockwood (1993); Ozog (1993); Sankaran 
(1993); Hurst and Ratcliffe (1994); Hurst etal. (1994) 

Failure modes and effects analysis (FMEA, also failure 
modes, effects and criticality analysis, FMECA) 

IEC (Std 812); US Armed Forces (MIL-STD-1629); Recht 
(1966b); Ostrander (1971); C.F. King and Rudd (1972); 
Jordan (1972); Taylor (1973,1974c, 1975a); Himmelblau 
(1978); Lambert (1978a); Aldwinkle and Slater (1983); 
Flothmann and Mjaavatten (1986); Rooney etal. (1988); 
Arendt and Lorenzo (1991); Kavianian, Rao and Brown 
(1992); D. Scott and Crawley (1992); Andrews and Moss 
(1993); Goyal (1993); Vincoli (1993); BS 5760: Part 5:1991 

‘What if?’ method 

Burk (1992); Zoller and Esping (1993) 

Fault trees, event trees and cause consequence 
diagrams (see Table 9.1) 

Sneak path analysis 

E. J. Hill and Bose (1975); Dore (1991); Hahn etal. (1991); 
Whetton (1993) 

HAZCHECK 

Wells and Phang (1992 LPB 105) 

Hazard analysis 

Kletz (1971,1972a, 1973a, 1976d, 1983d, 1984b, 1986d, 
1992b); S.B. Gibson (1976a, 1977a); Illidge (1983 LPB 53) 
Computer HAZOP (CHAZOP) programs 
Technica Ltd (1988); Andow (1991); Malagoli etal. (1992); 
Willis (1992 LPB 102); Burns and Pitblado (1993); 


Broomfield and Chung (1994); Chung and Broomfield 
(1994); Dyadem Ltd. (2001); Lihou Technical (2002) 

Operator task analysis 

Annett et al. (1971); Duncan (1974); Duncan and Gray 
(1975a); Duncan and Shepherd (1975a,b) 

Emergency planning 

Duff and Husband (1974) 

Contractor hazard analysis 

Whitaker (1993) 

Pre-acquisition audits 

Lloyds Register of Shipping (1992) 

Quality assurance, completeness of identification 
J.R. Taylor (1979,1992); VTT (1985/1,1988 Research Report 
516); Rouhianen (1990) 

Selection of method 

CCPS (1989/7); Pontiggia (1992) 


an outsider such as the works manager or a safety repre¬ 
sentative; and safety sampling, which is a specific appli¬ 
cation of a safety inspection/tour designed to measure 
accident potential. 

A safety audit examines and assesses in detail the stand¬ 
ards of all facets of a particular activity. It extends from 
complex technical operations and emergency procedures 
to clearance certificates, job descriptions, housekeeping 
and attitudes. It involves labour relations since people are 
asked about their training, their understanding of works 
policy and whether they think they are making their con¬ 
tribution in the right way. 

An audit might cover a company-wide problem or a total 
works situation (say, its emergency procedures or effluent 
systems) or simply a single plant activity. 

At any level an audit is carried out thoroughly by a team 
made up of people immediately concerned, assisted by 
experts in various fields and experienced people not con¬ 
nected with the area of audit, to ensure that a fresh and 
unbiased look is injected into the inspection process. 
Safety audits thus cover the following main areas: 

(1) site level 

(a) management system; 

(b) specific technical features; 

(2) plant level 

(a) management system. 

The audit has five main elements; 

(1) identification of possible hazards; 

(2) assessment of potential consequences of realization of 
these hazards: 

(3) selection of measures to minimize frequency and/or 
consequences of realization; 

(4) implementation of these measures within the organi¬ 
zation; 

(5) monitoring of the changes. 

The audit is conducted in a fairly formal way, using a 
checklist, although experience-based approaches are used 
with appropriate protocols. Table 8.3, taken from Safety 
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Table 8.2 Hazard identification techniques appropriate to different project stages 

Project stage 

Hazard identification technique 

All stages 

Management and safety system audits 

Checklists 

Feedback from workforce 

Research and development 

Screening and testing for 

Chemicals (toxicity, reactivity, explosibility) 

Reactions (explosibility) 

Impurities 

Pilot plant 

Pre-design 

Hazard indices 

Insurance assessments 

Hazard studies (coarse scale) 

Design 

Process design checks 

Unit processes 

Unit operations 

Plant equipments 

Pressure systems 

Instrument systems 

Hazard and operability studies (fine scale) 

Safety Integrity Level Studies (SIL, SIS) and Level of Protection 
Chemical Interaction Matrix 

Failure modes and effects analysis 

Fault trees and event trees 

Hazard analysis 

Risk & Reliability assessments 

Operator task analysis and operating instructions 

Commissioning 

Checks against design, inspection, examination, testing 

Non-destructive testing, condition monitoring 

Pre-Startup Safety Review 

Plant safety audits 

Emergency planning 

Operation 

Inspection, testing 

Non-destructive testing, condition monitoring, corrosion 

Plant safety audits 


Audits , gives a list of activities and activity standards. 
These standards can be used as the basis of a numerical 
rating scheme. If a safety audit is conducted, it is essential 
that the management act on it. This does not necessarily 
mean that every recommendation must be implemented, 
but there should be a reasoned response. 

Safety audits are an important part of the activity of the 
safety function. In addition to identifying hazards, they 
play a major role in educating personnel at all levels. These 
aspects are discussed in more detail in Chapter 28. Safety 
audits of the organization and management system at site 
and at plant level are considered below. 

Another form of audit is the insurance survey. Insurance 
surveys have been described in Chapter 5. Although the 
insurer is not able to go down to the lower levels of detail, 
his contribution is valuable in that it represents an inde¬ 
pendent assessment. 


8.2 Management System Audits 

The management system is crucial to loss prevention and 
it is essential that this system itself be monitored. 
The management system, and its auditing, have been 
described in Chapter 6. Management audit is so important, 


however, that a brief, summary account is in order at 
this point. 

The management system may be audited in several 
ways. These include (1) self-checking procedures, (2) inter¬ 
nal audit and (3) external audit. An illustration of a specific 
check built into the system is a formal requirement that a 
plant manager audit a proportion of the permits-to-work 
each week. 

The safety audits described above include an internal 
audit of the overall system. In particular, there are checks on: 

(1) overall management attitude, policies, systems and 
procedures, personnel selection; 

(2) plant level management, attitude, systems, training 
and feedback; 

(3) incident reporting, investigation and statistics. 

External audit may be carried out by an outside body such 
as a firm of consultants. 

There are now available a number of audit systems, 
including proprietary systems. Some of these yield 
quantitative factors applicable in quantitative risk 
assessment (QRA). Accounts of audit systems are given 
in Chapters 6,9 and 28. 






Table 8.3 Activity standards for safety audits (British Chemical Industry Safety Council, 1973/12) 


Activity Poor Fair Good E: llent 

A Organization and administration 


1 Statement of policy, 
responsibilities 
assigned 


2 Safe operating 
procedures (SOPs) 


3 Employee selection and 
placement 


4 Emergency and 
disaster control plans 


5 Direct management 
involvement 


6 Plant safety rules 


No statement of loss control 

A general understanding of 

Loss control policy and 

In addition to ‘good’, loss 

policy. Responsibility and 

loss control, 

responsibilities written and 

control policy is reviewed 

accountability not assigned 

responsibilities and 
accountability, but not 
written 

distributed to supervisors 

annually and is posted. 
Responsibility and 
accountability is 
emphasized in supervisory 
performance evaluations 

No written SOPs 

Written SOPs for some, but 
not all, hazardous 
operations 

Written SOPs for all 
hazardous operations 

All hazardous operations 
covered by a procedure, 
posted at the job location, 
with an annual documented 
review to determined 
adequacy 

Only pre-employment 

In addition, an aptitude test 

In addition to ‘fair’, new 

In addition to ‘good’, when 

physical examination given 

is administered to new 
employees 

employees’ past safety 
record is considered in their 
employment 

employees are considered 
for promotion, their safety 
attitude and record is 
considered 

No plan or procedures 

Verbal understanding on 
emergency procedures 

Written plan outlining the 
minimum requirements 

All types of emergency 
covered with written 
procedures. 

Responsibilities are 
defined with back-up 
personnel provisions 

No measurable activity 

Follow-up on accident 
problems 

In addition to ‘fair’, 
management reviews all 
injury and property 
damage reports and holds 
supervision accountable for 
verifying firm corrective 
measures 

In addition to ‘good’, 
reviews all investigation 
reports. Loss control 
problems are treated as 
other operational problems 
in staff meeting 

No written rule 

Plant safety rules have 
been developed and posted 

Plant safety rules are 
incorporated in the plant 
work rules 

In addition, plant work 
rules are firmly enforced 
and updated at least 
annually 






B Industrial hazard control 


1 Housekeeping storage 
of materials, etc. 


2 Machine guarding 


3 General area guarding 


4 Maintenance of 
equipment, guards, 
handtools, etc. 


5 Material handling - 
hand and mechanized 


6 Personal protective 
equipment - adequacy 


Housekeeping is generally 
poor. Raw materials, items 
being processed and 
finished materials are 
poorly stored 

Little attempt is made to 
control hazardous points on 
machinery 


Little attempt is made to 
control such hazards as: 
unprotected floor openings, 
slippery or defective floors, 
stairway surfaces, 
inadequate illumination, etc. 

No systematic programme 
of maintaining guards, 
handtools, controls and 
other safety features of 
equipment, etc. 


Little attempt is made to 
minimize possibility of 
injury from the handling of 
materials 


Proper equipment not 
provided or is not adequate 
for specific hazards 


Housekeeping is fair. Some 
attempts to adequately 
store materials are 
being made 


Housekeeping and storage 
of materials are orderly. 
Heavy and bulky objects 
well stored out of aisles, etc. 


Housekeeping and storage 
of materials are ideally 
controlled 


Partial but inadequate or 
ineffective attempts at 
control are in evidence 


Partial but inadequate 
attempts to control these 
hazards are evidenced 


Partial but inadequate or 
ineffective maintenance 


Partial but inadequate or 
ineffective attempts at 
control are in evidence 


Partial but inadequate or 
ineffective provision, 
distribution and use of 
personal protective 
equipment 


There is evidence of control 
which meets applicable 
Federal and State 
requirements, but 
improvement may still 
be made 

There is evidence of control 
which meets applicable 
Federal and State 
requirements - but further 
improvement may still 
be made 

Maintenance programme 
for equipment and safety 
features is adequate. 
Electrical handtools are 
tested and inspected before 
issuance, and on a routine 
basis 


Loads are limited as to size 
and shape for handling by 
hand, and mechanization is 
provided for heavy or bulky 
loads 


Proper equipment is 
provided. Equipment 
identified for special 
hazards, distribution of 
equipment is controlled by 
supervisor. Employee is 
required to use protective 
equipment 


Machine hazards are 
effectively controlled to the 
extentthatinjuryisunlikely. 
Safety of operator is given 
prime consideration attime 
of process design 

These hazards are 
effectively controlled to the 
extent that injury is 
unlikely 


In addition to ‘good’, a 
preventive maintenance 
system is programmed for 
hazardous equipment and 
devices. Safety reports 
filed and safety department 
consulted when abnormal 
conditions are found 

In addition to controls for 
both hand and mechanized 
handling, adequate 
measures prevail to prevent 
conflict between other 
workers and material being 
moved 

Equipment provided 
complies with standards. 
Close control maintained by 
supervision. Use of safety 
equipment recognized as 
an employment 
requirement. Injury record 
bears this out 
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Activity 

Poor 

Fair 

Good 

Excellent 

C Fire control and industrial hygiene 

1 Chemical hazard 
control references 

No knowledge or use of 
reference data 

Data available and used by 
foremen when needed 

In addition to ‘fair’, 
additional standards have 
been requested when 
necessary 

Data posted and followed 
where needed. Additional 
standards have been 
promulgated, reviewed 
with employees involved 
and posted 

2 Flammable and 
explosive materials 
control 

Storage facilities do not 
meet fire regulations. 
Containers do not carry 
name of contents. Approved 
dispensing equipment not 
used. Excessive quantities 
permitted in 
manufacturing areas 

Some storage facilities 
meet minimum fire 
regulations. Most 
containers carry name of 
contents. Some approved 
dispensing equipment 

Storage facilities meet 
minimum fire regulations. 
Most containers carry 
name of contents. Approved 
equipment is generally 
used. Supply at work area is 
limited to one day 
requirement. Containers 
are kept in approved 
storage cabinets 

In addition to ‘good’, storage 
facilities exceed the 
minimum fire regulations 
and containers are always 
labelled. A strong policy is 
in evidence relative to the 
control of the handling, 
storage and use of 
flammable materials 

3 Ventilation - fumes, 
smoke and dust control 

Ventilation rates are below 
industrial hygiene 
standards in areas where 
there is an industrial 
hygiene exposure 

Ventilation rates in 
exposure areas meet 
minimum standards 

In addition to ‘fair’, 
ventilation rates are 
periodically measured, 
recorded and maintained at 
approved levels 

In addition to ‘good’, 
equipment is properly 
selected and maintained 
close to maximum 
efficiency 

4 Skin contamination 
control 

Little attempt at control or 
elimination of skin 
irritation exposures 

Partial but incomplete 
programme for protecting 
workers. First-aid reports 
on skin problems are 
followed up on an 
individual basis for 
determination of cause 

The majority of workmen 
instructed concerning 
skin-irritating materials. 
Workmen provided with 
approved personal 
protective equipment or 
devices. Use of this 
equipment is enforced 

All workmen informed 
about skin-irritating 
materials. Workmen in all 
cases provided with 
approved personal 
protective equipment or 
devices. Use of proper 
equipment enforced and 


facilities available for 
maintenance. Workers are 
encouraged to wash skin 
frequently. Injury record 
indicates good control 






Fire control measures 

s Do not meet minimum 

Meet minimur 


insurance or municipal 

requirements 


requirements 



6 Waste - trash Control measures; 

collection and disposal, inadequate 

air/water pollution 


Some controls exist for 
disposal of harmful wastes 
or trash. Controls exist but 
are ineffective in methods 
or procedures of collection 
and disposal. Further study 
is necessary 


D Supervisory participation, motivation and training 


1 Line supervisor safety 
training 


2 Indoctrination of new 
employees 


3 Job hazard analysis 


4 Training for 
specialized operations 
(fork trucks, grinding, 
press brakes, punch 
presses, solvent 
handling, etc.) 

5 Internal self-inspection 


6 Safety promotion and 
publicity 


All supervisors have not 
received basic safety 
training 


No programme covering the 
health and safety job 
requirements 

No written programme 


Inadequate training given 
for specialized operations 


No written programme to 
identify and evaluate 
hazardous practices and/or 
conditions 


Bulletin boards and posters 
are considered the primary 
means for safety promotion 


All shop supervisors have 
received some safety 
training 


Verbal only 


Job hazard analysis (JHA) 
programme being 
implemented on some jobs 


An occasional training 
programme given for 
specialized operations 


Plant relies on outside 
sources, i.e. Insurance 
Safety Engineer, and 
assumes each supervisor 
inspects his area 

Additional safety displays, 
demonstrations films are 
used infrequently 


In addition to ‘fair’, 
additional fire hoses and/or 
extinguishers are provided. 
Welding permits issued. 
Extinguishers on all 
welding carts 

Most waste disposal 
problems have been 
identified and control 
programmes instituted. 
There is room for further 
improvement 


In addition to ‘good’, a fire 
crew is organized and 
trained in emergency 
procedures and in the use of 
fire fighting equipment 


Waste disposal hazards are 
effectively controlled. Air/ 
water pollution potential is 
minimal 


All supervisors participate 
in division safety training 
session a minimum of twice 
a year 

A written handout to assist 
in indoctrination 


JHA conducted on majority 
of operations 


Safety training is given for 
all specialized operations 
on a regular basis and 
retraining given 
periodically to review 
correct procedures 

A written programme 
outlining inspection 
guidelines, 

responsibilities, frequency 
and follow-up is in effect 


Safety displays and 
demonstrations are used on 
a regular basis 


In addition, specialized 
sessions conducted on 
specific problems 


A formal indoctrination 
programme to orientate 
new employees is in effect 

In addition, job hazard 
analyses performed on a 
regular basis and safety 
procedures written and 
posted for all operation 

In addition to ‘good’, an 
evaluation is performed 
annually to determine 
training needs 


Inspection programme is 
measured by results, i.e. 
reduction in accidents and 
costs. Inspection results 
are followed up by top 
management 

Special display cabinets, 
windows, etc., are provided. 
Displays are used regularly 
and are keyed to special 
themes 





Table 8.3 (continued) 


Activity 

Poor 

Fair 

Good 

Excellent 

7 Employee—supervisor 
safety contact and 
communication 

Little or no attempt made by 
supervisor to discuss 
safety with employees 

Infrequent safety 
discussions between 
supervisor and employees 

Supervisors regularly 
cover safety when 
reviewing work practices 
with individual employees 

In addition to items covered 
under ‘good’, supervisors 
make good use of the shop 
safety plan and regularly 
review job safety 
requirements with each 
worker. They contact at 
least one employee daily to 
discuss safe job 
performance 

E Accident investigation, statistics and reporting procedures 

1 Accident investigation 
by line personnel 

No accident investigation 
made by line supervision 

Line supervision makes 
investigations of only 
medical injuries 

Line supervision trained 
and makes complete and 
effective investigations of 
all accidents; the cause is 
determined; corrective 
measures initiated 
immediately with a 
completion date firmly 
established 

In addition to items covered 
under ‘good’, investigation 
is made of every accident 
within 24 h of occurrence. 
Reports are reviewed by the 
department manager and 
plant manager 

2 Accident cause and 
injury location analysis 
and statistics 

No analysis of disabling 
and medical cases to 
identify prevalent causes of 
accidents and location 
where they occur 

Effective analysis by both 
cause and location 
maintained on medical and 
first-aid cases 

In addition to effective 
accident analysis, results 
are used to pinpoint 
accident causes so accident 
prevention objectives can 
be established 

Accident causes and 
injuries are graphically 
illustrated to develop the 
trends and evaluate 
performance. Management 
is kept informed on status 

3 Investigation of 
property damage 

No programme 

Verbal requirement or 
general practice to inquire 
about property damage 
accidents 

Written requirement that 
all property damage 
accidents of US$50 and 
more will be investigated 

In addition, management 
requires a vigorous 
investigation effort on all 
property damage accidents 

4 Proper reporting of 
accidents and contact 
with carrier 

Accident reporting 
procedures are inadequate 

Accidents are correctly 
reported on a timely basis 

In addition to ‘fair’, accident 
records are maintained for 
analysis purposes 

In addition to ‘good’, there is 
a close liaison with the 
insurance carrier 
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TheHSEisalso concerned with auditing the management 
system. Indeed, it is fair to say that this is its most important 
function. When visiting a factory, an Inspector is very 
much concerned with the way the system works in practice. 
Audit by the HSE is another aspect discussed in Chapter 6. 


8.3 Checklists 

One of the most simplistic tools of hazard identification 
is the checklist. Like a standard or a code of practice, a 
checklist is a means of passing on lessons learned from 
experience. It is impossible to envisage high standards 
in hazard control unless this experience is effectively uti¬ 
lized. The checklist is one of the main tools available to 
assist in this. 

Checklists are applicable to management systems in 
general and to a proj ect throughout all its stages. Obviously 
the checklist must be appropriate to the stage of the project, 
starting with checklists of basic materials properties 
and process features, continuing on to checklists for 
detailed design and terminating with operations audit 
checklists. 

There are a large number of checklists given in the 
literature - indeed a paper on practical engineering is 
quite likely to include a checklist. Selected references on 
checklists are given in Table 8.4, but these are only a tiny 
fraction of those available. A number of checklists are given 
in the present volume. These are collated in the index. A 
checklist should be used for just one purpose only - as a 
final check that nothing has been neglected. Also, it is more 

Table 8.4 Selected references on checklists 


Dow Chemical Co. (1964,1966a,b, 1976,1980,1987,1994); 
Hettig (1966); Yelland (1966); J.U. Parker (1967,1973); 
Fowler and Spiegelman (1968); Freddy (1969); MCA 
(1970/18); Klaassen (1971); R.L. Miller and Howard (1971); 
Whitehorn and Brown (1973); Balemans etal. (1974); 
Eberlein (1974); Kline etal. (1974); Henderson and Kletz 
(1976); Wells et al. (1976,1977); Webb (1977); J.C. Rose etal. 
(1978); Wells (1980); Gorbell (1982); Flothmann and 
Mjaavatten (1986); Vervalin (1986b); Gordon and Moscone 
(1988); Wells etal. (1990); Kongso (1992); D. Scott and 
Crawley (1992); Oliver (1993); Anon. (1994 LPB120, p. 13) 
Insurance: Fowler and Spiegelman (1968); Spiegelman 
(1969); Ashe (1971); Neil (1971); Drewitt (1975) 

Management systems: BCISC (1973/12,13) 

Physical and chemical properties: Dow Chemical Co. (1964, 
1966a, b, 1976,1980,1987,1994); Spiegelman (1969); Wells 
(1980) 

Audits: Eley (1992) 

HAZCHECK: Wells (1980); Wells et al. (1991) 

Plant siting: Dow Chemical Co. (1964,1966a,b, 1976,1980, 

1987.1994) ; Spiegelman (1969); Balemans etal. (1974) 

Plant layout: McGarry (1958); Dow Chemical Co. (1964, 
1966a,b, 1976,1980,1987,1994); Fowler and Spiegelman 
(1968); Spiegelman (1969); Balemans etal. (1974); Drewitt 
(1975); Wells (1980); Gorbell (1982); D. Scott and Crawley 
(1992) 

Ventilation systems: BOHS (1987 TG7); HSE (1990 HS(G) 54) 
Process design: Dow Chemical Co. (1964,1966a,b, 1976, 

1980.1987.1994) ; Spiegelman (1969);Wells etal. (1976); 
W.G. Johnson (1980); Well (1980); Gorbell (1982); D. Scott 
and Crawley (1992) 


Operating parameters and deviations: Wells et al. (1976); 
Wells (1980); Gorbell (1982); Trask (1990) 

Documentation: Wells et al. (1976); J.C. Rose et al. (1978); 
Wells (1980) 

Statutory approvals: J.C. Rose etal. (1978) 

Chemical reactors: Gorbell (1982) 

Dust-handling plant: Anon. (1990 LPB 95, p. 7) 

Utilities: Gorbell (1982) 

Pressure systems design: Spiegelman (1969); Gorbell (1982); 
D. Scott and Crawley (1992) 

Pressure relief: Gorbell (1982) 

Instrumentation: Gorbell (1982) 

Human factors, human error: SRD, Human Factors in 
Reliability Group (1985 SRD R347); HSE (1989 HS(G) 48); 
Brazendale (1990 SRD 510) 

Training: FPA (1974/23) 

Fire and fire protection: Dow Chemical Co. (1964,1966a,b, 

1976,1980,1987,1994); FPA (1965/3,1974/23); Wells (1980); 
Gorbell (1982); D. Scott and Crawley (1992) 

Plant commissioning: Matley (1969); Buyers (1972); 

J.D. Baker (1974); Mackey (1974); Turnbull et al. (1974); 
Unwin etal. (1974); L. Pearso (1977a,b); J.C. Ros eetal. (1978); 
Wells (1980); D. Scott and Crawley (1992) 

Plant start-up and shut-down: Wells (1980); D. Scott and 
Crawley (1992) 

Plant operation: D. Scott and Crawley (1992) 

Plant maintenance: D. Scott and Crawley (1992) 
Demolition: Stuart (1974) 

Plant modifications: Henderson and Kletz (1976); Wells 
(1980); Anon. (1994 LPB 120, p. 13) 

Storage: Dow Chemical Co. (1964,1966a,b, 1976,1980,1987, 
1994); Spiegelman (1969); Balemans etal. (1974); Drewitt 
(1975); Jager and Haferkam (1992) 

Transport: Spiegelman (1969) 

Personal safely: Gorbell (1982) 

Pilot plants: Carson and Mumford (1989 LPB 89) 

Incident investigation: M.E. Lynch (1967,1973) 


effective if the questions cannot be answered by a simple ‘yes’ 
or ‘no’ but require some thought in formulating an answer. 

Checklists are effective only if they are used. There is 
often a tendency for them to be left to gather dust on the 
shelf. This is perhaps part of the reason for the develop¬ 
ment of other techniques such as HAZOP studies, as 
described below. 


8.4 Materials Properties 

8.4.1 Physical and chemical properties 

It is obviously necessary to have comprehensive informa¬ 
tion on all the chemicals in the process: raw materials, 
intermediates and final products. A list of some important 
physical and chemical properties of any chemical is given 
in Table 8.5. The significance of most of the items in the list 
is self-evident. 

Compilations of properties of hazardous substances are 
typically found in accompanying Material Safety Data 
Sheets (MSDSs). Other sources include those by the NFPA 
(NFPA 704) and the NIOSH. 

Corrosivity, flammability, toxicity and radioactivity are 
considered in more detail in Chapters 12, 16, 18 and 25, 
respectively. Reactivity, instability and explosibility and 
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Table 8.5 Some important physical and chemical properties of a chemical 


General 

properties 

Molecular structure 

Freezing point Vapour pressure, boiling point 

Critical pressure, temperature, volume 

Vapour density, specific heat, viscosity, thermal conductivity 
Liquid density, specific heat, viscosity, thermal conductivity 
Latent heats of vaporization and fusion 

Dielectric constant, electrical conductivity 

Flammability 

Flammability limits 

Flash point 

Autoignition temperature 

Minimum ignition energy 

Maximum experimental safe gap 

Self-heating 

Corrosion 

Corrosiveness to materials of construction 

Incompatibility with particular materials 

Polymerization, 

decomposition 

Polymerization characteristics 

Decomposition, hydrolysis characteristics 

Impurities 

Impurities in: 
raw material 
plant material 

Mutual solubilities with water 

Reaction, 

explosion 

Heats of formation, combustion, decomposition 

Energy hazard potential 

Thermal stability 

Impact sensitivity 

Toxicity 

Threshold limit values, emergency exposure limits 

Lethal concentration LC 50 , lethal dose LD 50 

Exposure effects (inhalation, ingestion, skin and eye contact) 
Long-term low exposure effects 

Warning levels (smell) 

Radioactivity 

Radiation survey 
a-particle, /?-, y- ray exposures 


process chemical reactions are dealt with in the following 
sections. 


8.4.2 Materials safety data sheets 

Information on the physical and chemical properties 
of chemicals and on the associated hazards and the 
appropriate precautions cast in standard format is avail¬ 
able in the form of MSDSs. 

Safety data sheet compilations are prepared by various 
organizations and are available on the Internet. 

An EC Directive (91/155/EEC) lays down the contents of 
a safety data sheet. In the United Kingdom, this is imple¬ 
mented by the Chemical Hazard Information and Packag¬ 
ing (CHIP) Regulations. HSE guidance: Safety Data Sheets 
for Substances and Preparations Dangerousfor Supply (1993) 
has been amended on a regular basis since its inception and 
further guidance is available in The EC Safely Data Sheet 
Directive by CONCAWE (1992 92/55). 

The Directive requires that the contents of a safety data 
sheet cover: 


(1) identification of the substance/preparation and 
company; 

(2) composition/information on ingredients; 


(3) hazards identification; 

(4) first-aid measures; 

(5) firefighting measures; 

(6) accidental release measures; 

(7) handling and storage; 

(8) exposure controls/personal protection; 

(9) physical and chemical properties; 

(10) stability and reactivity; 

(11) toxicological information; 

(12) ecological information; 

(13) disposal considerations; 

(14) transport information; 

(15) regulatory information; 

(16) other information. 

Both the guides mentioned give detailed guidance on the 
material to be included under each of these heads. It is 
the responsibility of the supplier of a chemical to supply the 
safety data sheet. 

8.4.3 Impurities 

Impurities, foreseen or unforeseen, can have serious 
adverse effects on many aspects of process operation, 
including safety and loss prevention. These effects are 
discussed in more detail in Chapter 11. Here consideration 





HAZARD IDENTIFICATION 8/13 


is confined to the identification of possible problems with 
impurities. 

There is no established methodology of identifying 
impurities which may arise in the process, that is compar¬ 
able with that for checking the reactivity of a chemical. 
Reliance usually has to be placed on the literature and on 
experience. As discussed below, however, indication of pos¬ 
sible impurities and of their adverse effects is one of the 
particularly valuable features of a pilot plant. 

8.5 Pilot Plants 

Scale-up from laboratory to full-size plant has always 
been a difficult problem in the chemical industry. Indeed 
it is this problem which in large part is responsible for 
the profession of chemical engineering. An important tool 
for tackling the problem is the pilot plant. In the words 
of L.H. Baekeland, the philosophy of the pilot plant is: 
‘Make your mistakes on a small scale and your profits on a 
large scale’. 

There are many reasons beside safety for using a pilot 
plant. They include the determination of the most economic 
design and operating parameters, the production of prod¬ 
uct for evaluation and trial marketing. Nevertheless, safety 
considerations constitute a substantial part of the case for 
the pilot plant. 

A pilot plant is used principally to assist in the scale-up 
of the process design rather than the mechanical design, 
for example, reaction conditions rather than pump specifi¬ 
cations. 

Some types of information relevant to safety which a 
pilot plant may yield include: 


(1) operating conditions (e.g. pressure, temperature); 

(2) design parameters (e.g. reaction rates, heat transfer 
coefficients); 

(3) reactor problems; 

(4) unit operations problems; 

(5) materials handling problems (e.g. foaming, solids 
handling, catalyst handling); 

(6) decomposition; 

(7) impurities; 

(8) corrosion; 

(9) fouling; 

(10) analytical problems; 

(11) operating problems; 

(12) working environment problems (e.g. toxics); 

(13) effluent and waste disposal problems. 


Impurities can cause many problems, and a pilot plant is 
one of the most effective means of identifying these. There 
may be impurities in the feedstock which give unexpected 
effects. Impurities may arise through side reactions, 
decomposition or polymerization. Leaks into the system 
may bring in other impurities such as pump lubricant and 
seal fluids or heat transfer media, including water. Air 
and water from other sources are common impurities or 
sources of impurity. Impurities which in a one-pass process 
might not be significant can build up if there is recycle. The 
product may be contaminated with any of these impurities. 
Impurities may cause fouling, blockages, etc. Some 
impurities can explode or catalyse explosive reactions. 
Problems may arise in effluent disposal due to impurities. 
Operation of a pilot plant offers a high probability of 


detecting impurities problems. Similarly, a pilot plant often 
reveals corrosion problems. These are frequently asso¬ 
ciated not with the main materials and bulk chemicals, but 
with minor components such as gaskets and diaphragms 
or with impurities in the bulk chemicals. 

If a pilot plant is used, it is essential, of course, that due 
attention be paid to safety in its design and operation. This 
rather different aspect is dealt with in Appendix 10. 


8.6 Hazard Indices 

There are a number of hazard indices which have been 
developed for various purposes. Mention has already been 
made at the level of the material processed of indices of 
energy hazard potential. There are other indices which are 
applicable to the process and plant as a whole. Some prin¬ 
cipal indices of process and plant hazard are the Dow 
Index, the Mond Index and the IFAL Index. Another tech¬ 
nique of ranking hazards is that of rapid ranking. 


8.6.1 Dow's Index 

The Dow Guide was originally published in 1964 and has 
gone through seven editions (Dow Chemical Company, 
1964, 1966a; AlChE, 1973, 40; Dow Chemical Company, 
1976,1980; AlChE, 1987,1994). Descriptions of the first and 
third editions have been given by Pratt (1965) and van 
Gaalen (1974), respectively. 

The original purpose of theDowFire and Explosion Index 
(F&EI) was to serve as a guide to the selection of fire pro¬ 
tection methods. The index in the first edition was a modi¬ 
fication of the Factory Mutual Chemical Occupancy 
Classification guide. In the first three editions, the methods 
of determining the index were developed and refined. 
Changes in the fourth edition were that the index was sim¬ 
plified and that two new features were introduced, the 
maximum probable property damage (MPPD) and a Toxi¬ 
city Index. The fifth edition changes included a new 
framework for making the risk evaluation, improvements in 
the method of calculating the index and several new fea¬ 
tures, including Loss Control Credits and Maximum Prob¬ 
able Days Outage (MPDO), and omission of the Toxicity 
Index. In the sixth edition, a risk analysis package, includ¬ 
ing business interruption (BI) and a toxicity penalty to 
reflect emergency responses, was introduced. The seventh 
edition up-dates the sixth edition with respect to codes and 
to good practice, but includes no major conceptual changes. 

The following account gives an overview of method. The 
figures are from the Guide , but the tables are summaries 
only. The account is intended to provide an understanding 
of the Dow Guide, but the guide itself should be consulted 
for determination of the index and, in particular, for fuller 
explanations, qualifications and illustrative examples. 

The overall structure of the method is shown in 
Figure 8.1. The procedure is to calculate the F & El and to 
use this to determine fire protection measures and, in 
combination with a Damage Factor, to derive the base 
MPPD. This is then used, in combination with the loss con¬ 
trol credits, to determine the actual MPPD, the MPDO and 
the BI loss. 

The procedure may be summarized as follows. The 
basic information required for the F & El is the plot plan and 
flow sheet of the plant. For the economic losses, it is also 
necessary to know the value of the plant per unit area, or the 
‘capital density’, and the monthly value of production. 
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Figure 8.1 Dow Fire and Explosion Index: procedure for calculating the Fire and Explosion Index and other 
quantities (Courtesy of the American Institute of Chemical Engineers) 
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The plant is first broken down into process units. A 
process unit is an item of process equipment such as a 
reactor, distillation column, absorption column, compressor, 
pump, furnace, storage tank, etc. The process units are then 
identified which could have the most serious impact on the 
process area. The factors which identify a pertinent process 
unit include the inventory, chemical energy potential, 
operating conditions, capital density, loss history and 
potential for BI. Where equipment is arranged to give a 
single train, the decision on whether to treat the whole train 
or just a single vessel as a process unit is determined by the 
type of process. It is also necessary to make a judgement on 
the most appropriate stage of plant operation for the deter¬ 
mination of the F&EI. 

The F&EI is then determined for the process units. 
It should not normally be necessary to determine the 
F&EI for more than three or four process units in a single 
process area. 

The F&EI assumes a minimum inventory of 5000 lb or 
600 USgal of flammable, combustible or reactive material. 
If the inventory is less than this, the risk will generally be 
overstated. 

The F&EI is calculated as follows. First a material factor 
(MF) is obtained. Then two penalty factors (Fj and F 2 ), one 
for general process hazards (GPHs) and one for special 
process hazards (SPHs), respectively, are determined, and 
the process unit hazards factor (PUHF) (F 3 ), which is the 
product of these, is calculated. The product of the MF and 
PUHF is the F&EI. The assessment form used to calculate 
the index is shown in Figure 8.2. 

The MF is a measure of the potential energy release from 
the material. It is obtained by considering the flammability 
and reactivity of the material and has a value in the range 
1—40. Values of the MF for some 216 materials are given 
in Appendix A of the Dow Guide and values for selected 
chemicals are given in Table 8.6. For materials not listed, 
the procedure used to determine the MF is summarized 
in Table 8.7. Use is made of the NFPA fire rating N F and 
reactivity rating Mr. Detailed guidance on the calculation 
of the MF using the procedure in the table is given in the 
Dow Guide. 

The base MF is a measure of the hazard of the material at 
ambient temperature and pressure. If these are not the 
conditions applying, the base MF needs to be adjusted. The 
correction for temperature is shown in Table 8.8. Pressure is 
taken into account through the SPH. The Dow Guide also 
gives a method for the determination of the MF for a mixture. 

The penalty factors applicable for GPHs and for SPHs 
are given inTables 8.9 and 8.10 and Figure 8.3, respectively. 
The GPH factor (/,) is the sum of all the GPH penalties, and 
the SPH factor (Fj) is the sum of all the SPH penalties. The 
PUHF factor (F 3 ) is the product of the GPH and SPH 
factors: 

F 3 = F 1 xF 2 [8.6.1] 

TheF&EIisthe product oftheMFandthePUHF: 

FEI = F 3 xMF [8.6.2] 

The F&EI is of importance in its own right as a guide to the 
fire and explosion hazard. 

The degree of hazard implied by the F&EI is shown by 
the relationships given in Table 8.11. The further use of the 
F&EI to undertake a process risk analysis, covering property 


damage and BI, is then as follows. The F&EI is used by 
itself to obtain the exposure radius (ER) and hence the area 
of exposure. The value of the area of exposure (VAE) is 
obtained from the area of exposure and the capital density, 
as described below. The F&EI and the PUHF are used in 
combination to obtain the damage factor (DF). The base 
MPPD is then obtained as the product of the VAE and the 
damage factor. 

The exposure radius is a linear function of the F&EI, 
being 0 and 168 at values of the F&EI of 0 and 200, respec¬ 
tively. In other words: 

ER = 0.84 x FEI [8.6.3] 

The value of the area of exposure is obtained as follows. 
The original value (OV) is obtained as the product of 
the area of exposure and the original capital density. The 
replacement value (RV) is then a function of the OV and 
the escalation factor (EF): 

RV = 0.82 x OV x EF [8.6.4] 

where 0.82 is an allowance for the cost of items which will 
not require replacement. The Dow Guide gives detailed 
guidance on the appropriate costs to use. 

The damage factor is a function of the F&EI and the 
PUHF, as shown in Figure 8.4. 

Then, 

Base MPPD = VAE x DF [8.6.5] 

A credit factor (CF) is then obtained as the product of three 
individual loss control credit factors (Ci—C3). The product 
of the base MPPD and the credit factor is the actual MPPD. 
The MPDO is a function of the actual MPPD. The BI is then 
obtained from the MPDO and the value of production per 
month (VPM). The credit factor is: 

CF = C, x C 2 x Ci [8.6.6] 

The three loss control credit factors q~C 3 are each the 
product of a set of individual loss control credits. The ran¬ 
ges of these credit items are given in Table 8.12. Detailed 
guidance on the precise value of each credit within the 
range in Table 8.11 is given in the Dow Guide. Then 

Actual MPPD = CF x Base MPPD [8.6.7] 

The MPDO is a function of the actual MPPD as shown in 
Figure 8.5. It is intended that judgement be exercised in 
selecting the line to he used in this figure. The upper and 
lower lines correspond to the cases where there are factors 
which would increase or reduce the period of interruption, 
respectively, and the central line corresponds to the case 
where neither of these applies. The BI is: 


BI = 0.7 x pp x VPM [8.6.8] 

where 0.7 is a factor which represents fixed costs plus 
profits, and 30 converts the number of days to months. 
The Dow Guide describes a risk analysis package which 
comprises: the simplified block flow sheet; the plot plan 
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FIRE & EXPLOSION INDEX 


AREA I COUNTRY 


LOCATION 1 PATS-- 

sire 


PROCESS UNIT 

P " EP *" D " Y : 

AWHOVto BY: (S«qMrinlandant) 

BUILDING 

REVIEWED BY: 

REVEWEO BY: CTachnotogy Cantar) 

REVIEWED BY: (Sataty A Loaa Pravartion) 

MATERIALS m process untt 

STATE OF OPERATION 

_ DEMON _ STARTUP _ NORMAL OPERATION _SHUTDOWN 

BASIC MATERIAL(S) FOR MATERIAL FACTOR J 

MATERIAL FACTOR (See Table 1« Appendices A or B) Noe requirements when unit temperature over 140 °F (60 °C) 


1. General Process Hazards 

Penalty Fac¬ 
tor Range 

Penalty Fac¬ 
tor Used(i) 

Base Factor. 

1.00 

1.00 

A Exothermic Chemical Reactions 

0.30 to 1.25 


B. Endothermic Processes 

0.20 to 0.40 


C. Material Handling and Transfer 

0.25 to 1.05 


D. Enclosed or Indoor Process Units 

0.25 to 0.90 


E. Access 

0.20 to 0.35 


F Drainage and Spill Control gal or cu.m. 

0.25 to 0.50 


General Process Hazards Factor (F,). 


2. Special Process Hazards 



Base Factor. 

1.00 

1.00 

A Toxic Material(s) 

0.20 to 0.80 


B. Sub-Atmospheric Pressure (< 500 mm Hg) 

0.50 


C. Operation In or Near Flammable Range Inerted Not Inerted 



1. Tank Farms Storage Flammable Liquids 

0.50 


2. Process Upset or Purge Failure 

0.30 


3. Always in Flammable Range 

0.80 


D. Dust Explosion (See Table 3) 

0.25 to 2.00 


E. Pressure (See Figure 2) Operating Pressure_psig or kPa gauge 

Relief Setting psig or kPa gauqe 



F. Low Temperature 

0.20 to 0.30 


G. Quantity of Flammable/Unstable Material: Quantity_lb or kg 

Hr. = BTU/lb or kcal/kg 



1. Liquids or Gases in Process (See Figure 3) 



2. Liquids or Gases in Storage (See Figure 4) 



3. Combusttole Solids in Storage. Dust in Process (See Figure 5) 



H. Corrosion and Erosion 

0.10 to 075 


1. Leakage - Joints and Packing 

0.10 to 1.50 


J. Use of Fired Equipment (See Figure 6) 



K. Hot Oil Heat Exchange System (See Table 5) 

0.15 to 1.15 


L. Rotating Equipment 

0.50 


Special Process Hazards Factor 

(F2) . 



Process Unit Hazards Factor (Ft 

x F2) - F 3 ... . 



Fire and Explosion Index (F3 x 

MF - F&EI) . 




(i) For no penalty use 0.00. 


Figure 8.2 Dow Fire and Explosion Index: assessment form for Fire and Explosion Index and other quantities 
(Courtesy of the American Institute of Chemical Engineers), (Figure and table references are to the Dow Guide) 
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Table 8.6 Dow Fire and Explosion Index: material factors for selected chemicals (Dow Chemical Company, 1994) 
(Courtesy of the Dow Chemical Company) 


Heat of combustion 3 NFPA classification Reactivity, Nr Material factor, MF 


Health, N h Fire.Np 


Acetone 

12,300 

1 

3 

0 

16 

Acetylene 

20,700 

0 

4 

3 

29 

Acrylonitrile 

13,700 

4 

3 

2 

24 

Ammonia 

8,000 

3 

1 

0 

4 

Ammonium nitrate 

12,400 b 

0 

0 

3 

29 

Benzene 

17,300 

2 

3 

0 

16 

Benzylperoxide 

12,000 

1 

3 

4 

40 

1,3-Butadiene 

19,200 

2 

4 

2 

24 

Butane 

19,700 

1 

4 

0 

21 

f-Butylhydroperoxide 

11,900 

1 

4 

4 

40 

Carbon disulfide 

6,100 

3 

4 

0 

21 

Carbon monoxide 

4,300 

3 

4 

0 

21 

Chlorine 

0 

4 

0 

0 

1 

Cyclohexane 

18,700 

1 

3 

0 

16 

Diesel fuel 

18,700 

0 

2 

0 

10 

Diethyl ether 

14,500 

2 

4 

1 

21 

Ethane 

20,400 

1 

4 

0 

21 

Ethylene 

20,800 

1 

4 

2 

24 

Ethylene dichloride 

4,600 

2 

3 

0 

16 

Ethylene oxide 

11,700 

3 

4 

3 

29 

Hydrogen 

51,600 

0 

4 

0 

21 

Kerosene 

18,700 

0 

2 

0 

10 

Methane 

21,500 

1 

4 

0 

21 

Methyl ethyl ketone 

13,500 

1 

3 

0 

16 

Naphtha (VM&P, regular) 

18,000 

1 

3 

0 

16 

Propane 

19,900 

1 

4 

0 

21 

Propylene 

19,700 

1 

4 

1 

21 

Styrene 

17,400 

2 

3 

2 

24 

Toluene 

17,400 

2 

3 

0 

16 

Vinyl acetate 

9,700 

2 

3 

2 

24 

Vinyl chloride 

8,000 

2 

4 

2 

24 


a This is the net heat of combustion, which is the value obtained when the water formed is considered to be in the vapour state. 
b Heat of combustion H c is equivalent to six times the heat of decomposition H d . 


showing areas of exposure, emergency isolation valves, 
and fire and gas detection equipment; the F&EI forms 
completed for the highest F&EI, the highest actual MPPD 
and the highest MPDO and BI; a risk analysis summary for 
the plant, based on the process units analyses as shown in 
Figure 8.2; and BI data. It recommends that each site 
maintain such a package for each of its plants. 

The Dow Guide contains in Appendix C a set of basic 
preventive and protective features for fire protection. It 
states that many of the features should be provided regard¬ 
less of the size of the F&EI, and that where they are not the 
hazard exposure will be greater than the F&EI indicates. 
These features are listed and discussed in Chapter 16. 

There appears, in the successive editions, to be more 
emphasis on the use of the F&EI itself for risk management 
purposes and perhaps rather less on its use for the selection 
of fire protection measures. The Dow Guide also gives in 
Appendix D an extensive loss prevention checklist. 

The current edition of the guide gives the correlations in 
terms of both graphical and equation form. The equations 
necessary for the determination of the F&EI are quoted 
here, but not those for MPPD, etc., for which the Guide 
should be consulted. 


*The account given in this subsection is based on the 
seventh edition by permission of the Dow Chemical 
Company. The company accepts no liability for results of 
actions following the use of the Guide. 


8.6.2 Mond Index 

The Mond Fire, Explosion and Toxicity Index is an exten¬ 
sion of the Dow Index. The index was developed at the 
Mond Division of ICI and the original version was described 
by D.J. Lewis (1979). 

The principal modifications to the Dow method made in 
the Mond Index are: 


(1) to enable a wider range of processes and storage 
installations to be studied; 

(2) to cover the processing of chemicals which are recog¬ 
nized as having explosive properties; 

(3) to offset difficulties raised by high heat of combustion 
per unit mass of hydrogen and to enable distinctions to 
be made between processes where a given fuel is reac¬ 
ted with different reactants; 
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Table 8.7 Dow Fire and Explosion Index: Material Factor determination guide (Courtesy of the American Institute 
of Chemical Engineers) 

Liquids & gases flammability 

NFPA 325M or 49 



Reactivity o 

r instability 




Nr=0 

Nr 

mg Nr 

= 2 Nr = 3 

Nr = 4 

Non- combustible 15 

N f = 0 

1 

14 

24 

29 

40 

FP >200°F(> $.°C) 

N f = 1 

4 

14 

24 

29 

40 

FP > 100°F( > -. °°C) < 200°F(<93.3°C) 

N f = 2 

10 

14 

24 

29 

40 

FP >73°F(>22.8°C) < 0 ^ °°°'F) 
or FP < 73°F(<.°°C) & 

BP > 100°F(>37.8°C) 

N f =3 

16 

16 

24 

29 

40 

FP < 73°F(<.°°C) & BP < 0 ^ 

N f =4 

21 

21 

24 

29 

40 

Combustible dust or mist c 

St-1 (A st <200 bar m/s) 


16 

16 

24 

29 

40 

St-2 (K st = 201-300 bar m/s) 


21 

21 

24 

29 

40 

St-3 (K st > 300 bar m/s) 


24 

24 

24 

29 

40 

Combustible solids 

Dense > 40 mm thick d 

N f = 1 

4 

14 

24 

29 

40 

Open < 40 mm thick 4 5 6 

N f = 2 

10 

14 

24 

29 

40 

Foam, fibre, powder, etc/ 

N f =3 

16 

16 

24 

29 

40 


FP = Flash point, closed cup; BP=boiling point at standard temperatures and pressure (STP). 
b Will not burn in air when exposed to a temperature of 1500°F (816°C) for a period of 5 min. 

c K st values are for a 161 or larger closed test vessel with strong ignition source. See NFPA 68 .Guide for Venting of Deflagrations. 
d Includes wood — 2 in. nominal thickness, magnesium ingots, tight stacks of solids and tight rolls of paper or plastic film. Example: 
SARANWRAP®. 

e Includes coarse granular material such as plastic pellets, rack storage, wood pallets and non-dusting ground material such as polystyrene. 
f Includes rubber goods such as tyres and boots. Styrofoam® brand plastic foam and fine material such as METHOCEL® cellulose ethers in 
dust/leak-free packages. 

Note: A'V ratings can be found in NFPA 704. 


Table 8.8 Dow Fire and Explosion Index: material factor temperature adjustment a (Courtesy of the American 
Institute of Chemical Engineers) 


A> St N r 


(a) 

Enter Np (St for dusts) and Nr 




(b) 

If temperature less than 140°F (60°C), go to (e) 




(c) 

If temperature above flash point or if 
temperature greater than 140°F (60°C), enter 1 
under N F 




(d) 

If temperature above exotherm start or 
autoignition, enter 1 under Nr 








(e) 

Add each column but enter 4 where total is 5 





(f) Using (e) and Table 8.7 determine Material Factor (MF) and enter on F&EI Form and Manufacturing Unit Risk 
Analysis Summary 

a 140°F (60°C) can be reached in storage due to layering and solar heat. 


(4) to include a number of additional special process type of 
hazard considerations that have been shown by a study 
of incidents to affect the level of hazard signifcantly; 

(5) to allow aspects of toxicity to be included in the 

assessment; 


(6) to include a range of offsetting factors for good 
design of plant and control/safety instrumen¬ 
tation systems to enable realistic hazard levels to be 
assessed for plant units under varying levels of safety 
features; 
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Table 8.9 Dow Fire and Explosion Index: penalties for 
General Process Hazards (Courtesy of the American 
Institute of Chemical Engineers) 


A Exothermic chemical reactions 


For reactions taking place in a reactor: 

(1) Mild exotherms, e.g. hydrogenation, hydrolysis, 
isomerization, sulfonation and neutralization, 
penalty = 0.30 

(2) Moderate exotherms, e.g. alkylation, esterification, 
oxidation,* polymerization, condensation, addition 
reactions, penalty = 0.50 

(3) Critical-to-control exotherms, e.g. halogenation, 
penalty=1.00 

(4) Particularly sensitive exotherms, e.g. nitration, 
penalty =1.25 


B Endothermic processes 


(1) Endothermic process taking place in a reactor, 
penalty = 0.2 

(2) Endothermic process taking place in a reactor where 
energy source is provided by combustion of solid, 
liquid or gaseous fuel, e.g. calcination, direct- fired 
pyrolysis, penalty = 0.4 


C Material handling and transfer 

For hazard of fire involving process unit during handling, 
transfer and warehousing of materials: 

(1) Loading and unloading of Class I flammable liquids or 
liquefied petroleum gas (LPG)-type materials where 
transfer lines are connected and disconnected, 
penalty = 0.50 

(2) Processes where introduction of air during manual 
addition may create a flammable mixture or reactivity 
hazard, e.g. centrifuges, batch reactions or batch 
mixing, penalty = 0.50 

(3) Warehousing and yard storage: 

(a) Flammable liquids or gases Nf = 3 or 4, c 
penalty = 0.85 

(b) Combustible solids Nf = 3, penalty = 0.65 

(c) Combustible solids Nf = 2, penalty = 0.40 

(d) Combustible liquids (closed cup flash 
point > 100°F (37.8°C) and <140°F (60°C), 
penalty = 0.25 

If any of (a)—(d) are stored on racks without in-rack 
sprinklers, add 0.20 to penalty 


D Enclosed or indoor process units 

For enclosed area, defined as any roofed area with three or 
more sides or an area enclosed by roofless structure with 
walls on all sides: 

(1) Dust filters or collectors in an enclosed area, 
penalty = 0.50 

(2) Process in which flammable liquids are handled above 
flash point in an enclosed area, penalty = 0.30; for 
quantities in excess of 10 M lb., penalty = 0.45 

(3) Process in which LPG or flammable liquids are 

handled above boiling point in an enclosed area, 
penalty = 0.60; for quantities in excess of 10,000 lb 
(4536 kg), penalty = 0.90 


If properly designed mechanical ventilation is installed, 
reduce penalties in (1) and (3) above by 50% 

E Access 

For inadequate access' 5 

(1) Process area > 10,000 ft * 1 2 (925 m 2 ) with inadequate 
access, penalty = 0.35 

(2) Warehouse > 25,000 ft 2 (2312 m 2 ) with inadequate 
access, penalty = 0.35 

F Drainage and spill control 


For a flammable material in a process unit with a flash 
point <140°F or being processed above its flash point: 

(1) Diking which exposes all equipment within dike to 
potential fire, penalty = 0.50 

(2) Flat area around process unit which allows spills to 
spread, exposing large areas to potential fire, 
penalty = 0.50 

(3) Diking around process unit which surrounds three 
sides of the area and directs spills to an impounding 
basin or non-exposing drainage trench, no penalty 
provided: 

(a) Slope to basin or trench is at least 2 % for earthen 
surfaces or 1% for hard surfaces 

(b) Distance to equipment from nearest edge of 
trench or basin is at least 50 ft (15 m). This 
distance can be reduced if a firewall is installed 

(c) The impounding basin must have a capacity at 
least equal to the combined volume of flammable 
liquid and fire water 6 

(4) Basin or trench which exposes utility lines or does not 
meet distance requirements, penalty = 0.5 

oxidizing agents such as chlorates, nitric acid, hypochlorous acids 
and salts, etc., increase penalty to 1.00. 

b When the acid is a strong reacting material, increase penalty to 0.75. 
c This includes drums, cylinders and aerosol cans. 
d For access to be adequate, there should be access from at least two 
sides. At least one of these should be a roadway. A monitor nozzle, 
which would remain easily accessible and operational during a fire 
could be considered a second access. Strong consideration should be 
given to this penalty for process units in an enclosed area. 
e This volume is the sum of volume of the flammable liquid, which for 
process and storage facilities is 100% of the capacity of the unit’s 
largest tank +10% of the capacity of the next largest tank, and of the 
volume of a 30 min flow of firewater. 


(7) to indicate how the results of using the method can be 
applied logically in the design of plants having a 
greater degree of ‘inherent safety’. 

The Mond Index was developed from the 1973 version of 
the Dow Index and the comparisons between the two given 
here relate to that version. Since then, there have been 
a number of developments in the Dow Index itself, in 
particular, the introduction of the loss control credit factors. 

The Mond method involves making an initial assess¬ 
ment of hazard in a manner similar to that used in the Dow 
Index, but taking into account additional hazard con¬ 
siderations. The potential hazard is expressed in terms of 
the initial value of a set of indices for fire, explosion and 
toxicity. A hazard factor review is then carried out to 
see if there is scope to reduce the hazard by making 
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Table 8.10 Dow Fire and Explosion Index: penalties for 
Special Process Hazards (Courtesy of the American 
Institute of Chemical Engineers) 


A Toxic materials 

Penalty of 0.2 x A/ h is applied for a process involving toxic 
materials 3 * 

B Subatmospheric pressure* 5 


Penalty of 0.5 is applied for processes in which air inleak 
could create a hazard and which operate at an absolute 
pressure < 500 mmHg c 


C Operation in or near flammable range 

For processes where air might enter the system and form a 

flammable mixture: 

(1) Tank storage of N F = 3 or 4 flammable liquids where 
air can be breathed into the tank during pump-out or 
sudden cooling of the tank, penalty = 0.50 

For open vent or non-inert gas padded operating 
pressure-vacuum relief system, penalty = 0.50 
Storage of combustible liquids above closed cup flash 
point, penalty = 0.50 

No penalty is applied if an inerted, closed vapour 
recovery system is used and its air-tightness is assured 

(2) Process equipment or process storage tanks which 
could be in or near the flammable range only in the 
event of instrument or equipment failure, d 
penalty = 0.30 

(3) Processes or operations which are by nature always in 
or near the flammable range either because purging is 
not practical or because it was elected not to purge, 
penalty = 0.8 


D Dust explosion 6 


For any process unit involving dust handling operations 
such as transferring, blending, grinding, bagging, etc. 


Particle size f (mm) Tyler mesh size Penalty 


175+ 60-80 0.25 

150-175 80-100 0.50 

100-150 100-150 0.75 

75-100 150-200 1.25 

<75 >200 2.00 


E Relief pressure 

For a process operating at a pressure above atmospheric, a 
penalty is applied which is a function of the operating 
pressure. Two pressure ranges are considered. For 
operating pressures in the range 0-1000 psig, the penalty 
is obtained using Figure 8.3(a) * 1 2 in the manner descri bed 
below. For pressures above 1000 psig, the penalt y is 


Pressure (psig) Penalty 


1000 0.86 

1500 0.92 

2000 0.96 

2500 0.98 

3000-10,000 1.0 

>10,000 1.5 


For the lower pressure range, the curve shown in 
Figure 8.3(a) 1 gives an initial penalty which is applicable for 
flammable and combustible liquids with flash point <140 ° F 
(60 °C). For other materials, the initial penalty given by the 
curve is adjusted by a material adjustment factor as follows: 

(1) Highly viscous materials,* 1 multiply penalty by 0.7 

(2) Compressed gases used alone or flammable liquids 
pressurized with any gas above 15 psig, multiply 
penalty by 1.2 

(3) Liquefied flammable gases, 1 multiply penalty by 1.3 
The actual penalty is obtained as follows. First 
determine from Figure 8.3(a) 1 the penalties associated 
with the operating pressure and with the set pressure of 
the relief device. Divide the operating pressure penalty 
by the set pressure penalty to obtain the final pressure 
penalty adjustment factor. Nowmultiply the operating 
pressure by the material adjustment factor given in 

(1) - (3) above and then by the final pressure penalty 
adjustment factor to obtain the final pressure penalty. 
Example: 

Vessel design pressure = 150 psig 
Normal operating pressure = 100 psig; initial penalty = 
0.31 (from Figure 8.3(a) 1 ) 

Rupture disc set pressure = 125 psig; initial penalty = 

0.34 (from Figure 8.3(a) 1 ) 

Process with viscous material; penalty adjustment = 0.70 
Adjusted initial penalty = 0.7 x 0.31 =0.22 
Actual penalty = 0.22 x (0.31/0.34) = 0.20 

F Low temperature 

For a process for which it has not been shown that there 
is no possibility of temperatures below the transition 
temperature due to normal or abnormal operating 
conditions: 

(1) Process utilizing carbon steel and operated at or below 
the ductile/brittle transition temperature, 1 
penalty = 0.30 

(2) Process utilizing materials other than carbon steel 
where the operating temperature is at or below the 
transition temperature, penalty = 0.20 


G Quantity of flammable and unstable material 


A process involving flammable or unstable materials is 
classed as either: 

(1) Liquids or gases in process; 

(2) Liquids or gases in storage; 

(3) Combustible solids in storage or dust encountered in 
process 

and a single penalty is applied based on the material 
selected for the MF as follows: 

The penalty is a function of the quantity of material which 
it is estimated might be released within 10 min. 

For case (3) above, this quantity is used directly, whilst for 
cases (1) and (2) above, it is used in the form of the potential 
heat release. 

Liquids or gases in process 
This category applies to: 

(a) Flammable liquids and those combustible liquids with 
flash point <140°F (60°C) 

(b) Flammable gases 
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(c) Liquefied flammable gases 

(d) Combustible liquids with closed cup flash points 
>140°F (60°C) 

(e) Reactive materials, regardless of flammability 
The penalty is a function of the potential heat release, 
which is the product of the quantity of material which it is 
estimated might be released within 10 min k and of the heat 
quantity H c (BTU/lb), * 1 * as given in Figure 8.3(b) 1 . 

Liquids or gases in storage 

This category applies to liquids or gases in storage and thus 
outside the process area. The penalty is a function of the 
potential heat release, which is the product of the quantity of 
material in storage 1 ” andoffT c n as given in Figure 8.3(c) 1 . 0 
Combustible solids in storage or dust encountered in process 
This category applies to combustible solids in storage and 
to dust in a process unit. The penalty is a function of the 
quantity of materiaP as given in Figure 8.3(d) 1 . 

H Corrosion and erosion 0 


For a corrosion rate, defined as the sum of the external and 

internal corrosion rates: 

(1) Corrosion rate < 0.5 mil/year (0.127 mm/year) with 
risk of pitting or local corrosion, penalty = 0.10 

(2) Corrosion rate > 0.5 mil/year (0.127 mm/year) and 
<1 mm/year, penalty = 0.20 

(3) Corrosion rate >1 mil/year (0.254 mm/year), 
penalty = 0.50 

(4) Risk of stress corrosion cracking developing, 
penalty = 0.75 

(5) Lining required to prevent corrosion, r penalty = 0.20 


I Leakage joints and packing 

(1) Pump and gland seals are likely to give some leakages 
of a minor nature, penalty = 0.10 

(2) Process known to give regular leakage problems at 
pumps, compressors and flange joints, penalty = 0.30 

(3) Process in which thermal and pressure cycling occurs, 
penalty = 0.3 

(4) Process material penetrating in nature or an abrasive 
slurry which causes intermittent problems of sealing, 
and process utilizing a rotating shaft seal or packing, 
penalty = 0.40 

(5) Process with sight glasses, bellows assemblies or 
expansion joints, penalty =1.50 


J Use of fired equipment 


For a process unit which is in the vicinity of a fired heater or 
which is itself a fired heater, a penalty is applied which is a 
function of the distance from the air intake of the fired 
heater to a probable leak point as given in Figure 8.3(e) 1 . 
The two curves A-l and A-2 are applied as follows, where 
the material referred to is the material of the MF: 

Curve A-l is used for: 

(a) A process unit in which the material could be released 
above its flash point; 

(b) A process unit in which the material is a combustible 
Curve A-2 is used for: 

(a) a process unit in which the material could be released 
above its boiling point; 


Note-. If the material is below its flash point, the only 
situation which attracts a penalty is where the fired heater 
itself is the process unit being evaluated. In this case, the 
distance from the possible leak source is zero and even if 
the material is below its flash point, a penalty of 1.0 is 
applied. 


K Hot oil exchange system 

The penalty in this section is not applied: 

(1) If the hot oil exchange system is the process unit being 
evaluated; 

(2) If the hot oil is non-combustible or, if combustible, is 
always used below its flash point. 


Otherwise, for a process unit utilizing a hot oil exchange 
system in which the heat exchange fluid is combustible: 


Quantity s 
(US gal) 

(m 3 ) 

Penalty 
oil >flash 
point 

Oil >flash 
point 

<5000 

<18.9 

0.15 

0.25 

5000-10,000 

18.9-37.9 

0.30 

0.45 

10,000-25,000 

37.9-94.6 

0.50 

0.75 

>25,000 

>94.6 

0.75 

1.15 


Note-. (1) It is recommended that the F&EI also be 
determined for the hot oil system itself, including the 
process tank, pumps and distribution/retum piping, but 
not the storage tank. (2) If a fired hot oil heat exchange 
system is actually located in the area of the process unit, the 
penalty in Section J applies. 


L Rotating equipment 1 


Penalty of 0.5 is applied for a process unit, which utilizes, or is 

(1) A compressor in excess of 600 hp; 

(2) A pump in excess of 75 hp; 

(3) Agitators and circulating pumps in which failure 
could produce a process exotherm;” 

(4) Other large, high speed rotating equipment with a 
significant loss history, e.g. centrifuge 


a For mixtures, the highest N H value of the individual componen 
should be used. 

b If the penalty is applied, the penalty specified in Section C or E 
should not be duplicated or repeated. 

c The main process units in this category are most stripping opera¬ 
tions, some compressor operations and a few distillation operations. 
d For a process unit which relies on inert purge to keep it out of the 
flammable range, penalty = 0.30.This penalty also applies to padded 
barges or tank cars. (Note: no penalty is applied here if the penalty in 
Section B has already been taken). 

e Penalties should be applied unless it has been shown by testing that 
no dust explosion hazard exists. 

f The particle size to be used is the 10% particle size, i.e, that at which 
90% of the dust is coarser and 10% finer. 

* If the dust is handled in an inert gas, the penalty should be halved, 
and asphalts. 

1 This includes all other flammable materials stored above their boil¬ 
ing point. 

‘ If no data are available, a 50°F (10°C) transition temperature should 
be assumed. 

k This figure should be based on the user’s own judgement but, as a 
guide, experience shows that a reasonable estimate is the larger of 
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the quantity of material (1) in the process unit or (2) in the largest 
connected unit, disregarding any connected unit which can be 
isolated by an emergency isolation valve; 

1 For most materials, H c is the heat of combustion, but for unstable 
materials (N r > 2), it is six times the heat of decomposition or the heat 
of combustion, whichever is larger. 

m In the case of portable drums, the relevant quantity is the total 
quantity in all the drums, and in the case where two or more vessels 
are in a common dike which would not drain adequately into an 
impounding basin, it is the quantity in all the vessels. 

” See footnote 1. 

0 If there is more than one class of material, the total heat release 
should be utilized in conjunction with the highest curve applicable to 
any of the individual materials. 

p For unstable materials (Nr > 2), the quantity which should be used 
is the actual mass multiplied by six and the curve to be used is curve A. 
q The Guide gives guidance on situations where corrosion or erosion is 
likely. 

r This penalty does not apply if the lining is simply to prevent 
discolouration of the product. 

8 This quantity is defined as follows. It is the lesser of (1) a 15-min spill 
caused by a break in the lines servicing the process unit or (2) the oil 
inventory within the active circulating hot oil system, where the por¬ 
tion of the exchange system classed as storage is not included unless it 
is connected much of the time to the process unit. 

* Formulae have not been developed for all types and sizes of rotating 
equipment, but there is evidence that equipments above a certain size 
are liable to contribute to an incident. 

u Where the exotherm is due to lack of cooling from interrupted mix¬ 
ing or circulation of coolant or to interrupted and resumed mixing. 


design changes, and intermediate values of the indices are 
determined. Offsetting factors for preventive and protec¬ 
tive features are applied and the final values of the indices, 
or offset indices, are calculated. 

In outline, the method of determining the Mond Index is 
as follows. The plant is divided into units, the demarcation 
between units being based on the feasibility of locating a 
separating barrier (open space, wall or floor) between the 
unit and its neighbours. 

The material factor is determined as in the Dow method, 
but in addition, special material hazard factors are intro¬ 
duced. Again as in the Dow method, use is made of factors 
for GPHs and SPHs although the particular factors are 
different. A quantity factor, based on the inventory of 
material, and layout hazard factors are also introduced. 
There are also factors for toxicity hazard. The features 
taken into account in these factors are shown in Table 8.13. 
The indices calculated are: 

(1) overall index; 

(2) fire load index; 

(3) unit toxicity index; 

(4) maj or toxicity incident index; 

(5) explosion index; 

(6) aerial explosion index; 

(7) overall risk rating. 

The degree of hazard associated with these indices is 
shown in Table 8.14. 

The overall risk rating is then evaluated. If further 
action is judged appropriate, a hazard review is carried out 
to determine the scope for design modifications. Some 
examples of changes, which might be considered are given 
in Table 8.15. If design changes are made, the indices are 
recalculated. 

The offsetting features shown in Table 8.16 are then 
brought into account. Some of these are preventive, 


reducing the frequency of incidents, and some are mitigat¬ 
ing, reducing the consequences. Using the corresponding 
offsetting factors, final values of the indices are calculated. 

The features to be taken into account in calculating the 
various factors are specified in detail in the Technical 
Manual, which contains a wealth of practical information, 
particularly in respect of the offsetting features. 

As already mentioned, the plant is divided into indivi¬ 
dual units on the basis of the feasibility of creating sepa¬ 
rating barriers and one of the factors taken into account in 
the index is plant layout. The use of the method to assist in 
layout design is an important application. It is considered 
in more detail in Chapter 10. 

8.6.3 IFAL Index 

The IFAL index is a separate index developed by the Insur¬ 
ance Technical Bureau primarily for insurance assessment 
purposes. Accounts have been given by J. Singh and 
Munday (1979), Munday etal. (1980) and H.B. Whitehouse 
(1985). Calculation of the index is described in the IFAL p 
FactorWorkbook (InsuranceTechnical Bureau, 1981). 

The index was developed in order to provide a means of 
assessment that was more scientifically based and satis¬ 
factory than the historical loss record, which tends to be 
subject to chance fluctuations. An outline flow chart of the 
method is shown in Figure 8.6. 

The method involves dividing the plant into blocks and 
examining each major item of process equipment in turn to 
assess its contribution to the index. The main hazards 
which contribute to the index are 

(1) pool fires; 

(2) vapour fires; 

(3) unconfined vapour cloud explosions; 

(4) confined vapour cloud explosions; 

(5) internal explosions. 

For hazards (2)—(5), emission frequency and hole size 
distributions are used, and for each case, emission, igni¬ 
tion, fire and explosion are modelled and the damage 
effects are estimated. 

The IFAL Index is the product of the process factor p and 
of two modifying factors, the engineering factor e and the 
management factor m. For a process engineered and man¬ 
aged to ‘standard good practice’, the last two factors are 
unity and the IFAL Index equals the p factor. 

In contrast to the Dow and Mond Index methods, the 
IFAL Index method is too complex for manual calculation 
and is carried out using a computer program. 

Table 8.17 shows some results obtained using the IFAL 
method. Section A gives some relative p factors for 100,000 
te/year petrochemical plants, and Section B gives the 
relative contribution of the five hazards to losses on an 
ethylbenzene plant. 

8.6.4 Dow Chemical Exposure Index 

As stated earlier, the main Dow Index contained at one time 
a Toxicity Index. Dow now uses a separate Chemical 
Exposure Index (CEI). An account of this index is given in 
Dow’s Chemical Exposure Index Guide (AIChE 1994/39) (the 
Dow CEI Guide). 

The CEI is a measure of the relative acute toxicity risk. It 
is used for initial process hazard analysis (PHA), in the 
calculation of its Distribution Ranking Index (DRI) and in 
emergency response planning. 
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Figure 8.3 Continued 
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Figure 8.3 Dow Fire and Explosion Index: penalties for special process hazards 1994: (a) penalty for pressure of 
flammable and combustible liquids; (b) penalty for potential heat release for liquids or gases in process; (c) penalty for 
potential heat release for liquids or gases in storage; (d) penalty for quantity of combustible solids in storage/dust in 
process; (e) penalty for location of fired equipment (Courtesy of the American Institute of Chemical Engineers) 


Table 8.11 Dow Fire and Explosion Index: degree of 
hazard 


F&E index range Degree of hazard 



4th edition 

5—7th editions a 

1-50 

1-60 

Light 

51-81 

61-96 

Moderate 

82-107 

97-127 

Intermediate 

108-133 

128-158 

Heavy 

>134 

>159 

Severe 


a Increase in range is due to new contribution factors and a correction 
for penalties in three contributing factor charts. 


The information needed for the calculation of the CEI is: 
the physical and chemical properties of the material; a 
simplified process flow sheet, showing vessels and major 
pipework with inventories; and an accurate plot plan of the 
plant and the surrounding area. 

It is also necessary to have toxicity limits in the form of 
the American Industrial Hygiene Association (AIHA) 
Emergency Response Planning Guidelines (ERPGs) for 
the material. There are three levels of ERPG (ERPG-1, 
ERPG-2 and ERPG-3), which are essentially the maximum 
airborne concentrations below which it is believed 
that nearly all individuals could be exposed without 
experiencing some defined effect, the effects being: 
for level 1, experience of something more than 
a mild transient health effect or odour; for level 2, 
serious or irreversible health effects; and for level 3, 
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Material Factor 


Figure 8.4 Dow Fire and Explosion Index: damage factor (Courtesy of the American Institute of Chemical Engineers) 


Table 8.12 Dow Fire and Explosion Index: loss control credit factor (Dow Chemical Company, 1994) (Courtesy of 
the Dow Chemical Company) 


A Process control (Ci) 

(a) Emergency power 

0.98 

(f) Inert gas 

0.94-0.96 

(b) Cooling 

0.97-0.99 

(g) Operating procedures 

0.91-0.99 

(c) Explosion control 

0.84-0.98 

(h) Reactive chemical review 

0.91-0.98 

(d) Emergency shut-down 

0.96-0.99 

(i) Other process hazard analysis 

0.91-0.98 

(e) Computer control 

0.93-0.99 



B Material isolation (C 2 ) 

(a) Remote control valve 

0.96-0.98 

(c) Drainage 

0.91-0.97 

(b) Dump/blowdown 

0.96-0.98 

(d) Interlock 

0.98 

C Fire protection (C 3 ) 

(a) Leak detection 

0.94-0.98 

(f) Water curtains 

0.97-0.98 

(b) Structural steel 

0.95-0.98 

(g) Foam 

0.92-0.97 

(c) Water supply 

0.94-0.97 

(h) Hand extinguishers/monitors 

0.93-0.98 

(d) Special systems 

0.91 

(i) Cable protection 

0.94-0.98 

(e) Sprinkler systems 

0.74-0.97 




life-threatening effects. ERPGs are considered further in 
Chapter 18. 

The procedure for the calculation of the CEI is to deter¬ 
mine (1) the release scenarios, (2) the ERPG-2, (3) the 
airborne quantities, (4) the CEI and (5) the hazard distance. 
The CEI is based on the scenario giving the largest air¬ 
borne quantity (AQ). 

The Dow CEI Guide gives a set of rules for defining 
release scenarios and of equations for estimating the AQ 
based on gas or liquid flow from vessels and pipes, liquid 
flash-off, and pool formation and evaporation. These, in 


effect, constitute a release model, description of which is 
deferred to Chapter 15. 

The CEI is then calculated from the relationship: 

/ an \ 1/2 

cei = 655 - 1 (er^2) W 

where AQ is the airborne quantity (kg/s) and ERPG-2 is 
the relevant toxic limit (mg/m 3 ). If the calculated value of 
the CEI is greater than 1000, the CEI is set equal to 1000. 
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Table 8.13 Mond Index: hazard factors (after 
D.J. Lewis, 1979f 


A Special material hazards 


Oxidizing materials 

Reacts with water to produce a combustible gas 

Mixing and dispersion characteristics 

Subject to spontaneous heating 

Subject to rapid spontaneous polymerization 

Ignition sensitivity 

Subject to explosive decomposition 

Condensed phase properties 

Other 


B General process hazards 

Handling and physical changes only 
Single continuous reactions 
Single batch reactions 

Multiplicity of reactions or different process operations 
carried out in same equipment 
Material transfer 
Transportable containers 

C Special process hazards 

Low pressure (below 15 psia) 

High pressure 
Low temperature: 

1: Carbon steel +10°C to -10°C 
2: Carbon steel below -10°C 
3: Other materials 
High temperature: 

1: Flammability 
2: Construction materials 
Corrosion and erosion 
Joint and packing leakages 
Vibration, load cycling, etc. 

Processes or reactions difficult to control 
Operation in or near flammable range 
Greater than average explosion hazard 
Dust or mist hazard 
High strength oxidants 
Process ignition sensitivity 
Electrostatic hazards 


D Layout hazards 

Structure design 
Domino effect 
Below ground 
Surface drainage 
Other 


E Toxicity hazards 

TLV value 
Material form 
Short exposure risk 
Skin absorption 
Physical factors 


“This table lists the hazard factors but not the associated 
numerical values. See Technical Manual (D.J. Lewis, 1979) for full 
details. 


The hazard distance is then determined as: 

/ ad \V 2 

hd = 6551 (er&) [ 8 - ai °] 

where HD is the hazard distance (m) and ERPG is anyone of 
three ERPG toxic limits (mg/m 3 ). If the calculated value of 
HD is greater than 10,000 m, HD is set equal to 10,000 m. 
There is thus a set of three HD values corresponding to the 
three levels of ERPG. 

The Dow CEI Guide contains tabulations of relevant 
physical properties and ERPG values. It also gives CEI 
values for releases of different chemicals from a 2 in. hole 
together with worked examples. It provides a containment 
and mitigation checklist. 

8.6.5 Mortality index 

Another index which should be mentioned here is the 
Mortality Index proposed by V.C. Marshall (1977b). This 
is an index of the lethality of materials with major hazard 
potential, and is defined as the number of deaths per 
tonne of material involved. The index is discussed in 
Chapters 16-18. 

8.7 Hazard Studies 

There are now a number of methods that have been 
developed for the identification of hazards. A brief over¬ 
view of these is given in this section, and a more detailed 
account of each method is then presented in the succeeding 
sections. 

Overviews of hazard identification methods are available 
from numerous sources. Two primary information sources 
are the Chemical Industries Association (CIA) HAZOP: 
Guide to Best Practice (CIA, 1999) and Guidelines for Hazard 
Evaluation Procedures (AIChE/CCPS, 1992,2nd edition). 

Some of the methods described are complete methods. 
Methods in this category are What If? analysis, Pre¬ 
liminary Hazard Analysis (PHA), screening analysis tech¬ 
niques, HAZOP studies, and FMECA. Of these, PHA and 
screening analysis are designed for use at an early stage in 
the design. 

Other methods, such as event tree, fault tree analysis, 
sneak analysis, computer control and human error analysis 
(known as CHAZOP), are specialist techniques used to 
complement or support more comprehensive methods. 
Scenario development and consequence analysis are part 
of hazard identification, but are also major features in 
hazard assessment. 

The process safety system described in Subsection 8.7.12 
combines a number of these techniques in an integrated 
system. Other aspects considered are the choice of method, 
the filtering and follow-up of the study results and formal 
safety review systems. 

8.7.1 What if? analysis 

An early method of hazard identification is to review the 
design by asking a series of questions beginning with What 
If? The method is a team exercise and typically makes use 
of pre-determined questions, but otherwise tends not to be 
highly structured. An account is given in Section 8.8. 

8.7.2 Event tree and fault tree analysis 

Event trees and fault trees are logic diagrams used to 
represent, respectively, the effects of an event and the 
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Figure 8.5 Dow Fire and Explosion Index: maximum probable days outage. The MPPD is given as the actual MPPD 
in 10 12 US$, 1986 basis. To update to 1993 basis, multiply by 359.9/318.4= 1.130 (based on Chemical Engineering 
Plant Cost Index) (Courtesy of the American Institute of Chemical Engineers) 


contributory causes of an event. Accounts of event tree and 
fault tree analysis are given in Section 8.9 and Chapter 9. 

8.7.3 Preliminary hazard analysis 

‘Preliminary hazard analysis’ is a term normally used to 
describe a qualitative technique for identifying hazards 
relatively early in the design process. It is to be dis¬ 
tinguished from the detailed hazard analysis, which 
employs a quantitative risk ranking technique. An account 
of PHA is given in Section 8.10. 

8.7.4 Screening analysis techniques 

A method of identifying hazards early in the design is 
through a screening analysis of anticipated hazards such 
as fire, explosion, reactivity, toxicity, etc. An account of 
screening techniques is given in Section 8.11. 

8.7.5 Hazard and operability study 

A method widely used by the process industries for the 
identification of hazards at, or close to, the engineering line 
diagram (ELD) stage is the HAZOP study. This technique is 
a development from critical examination. It is a team exer¬ 
cise, which involves examining the design intent in the 
light of guidewords. The technique has itself been subject 
to numerous variations. 

For the process industries, the HAZOP study might 
fairly be described as the jewel in the crown of hazard 
identification methods. An account of the HAZOP study is 
given in Section 8.12. 

8.7.6 Failure modes, effects and criticality analysis 
Another method of hazard identification is the FMECA. It 
involves the analysis of the failure modes of an entity, their 
causes, effects, and associated criticality of the failure. An 
account of the FMECA technique is given in Section 8.13. 


8.7.7 Sneak analysis techniques 

There are a number of ways in which a hazard can ‘sneak’ 
into a complex electromechanical system. Sneak analysis is 
essentially a set of techniques for dealing with the various 
types of sneak. It is a complementary rather than a com¬ 
prehensive method. An account of sneak analysis is given 
in Section 8.14. 

8.7.8 Computer control and human error analysis 

The conventional HAZOP study was developed for plants 
in which the control system was based on analogue 
controllers. It is not itself oriented to failures associated 
with computer control systems. CHAZOP has been devel¬ 
oped to augment the process HAZOP in this respect. An 
account of CHAZOP is given in Section 8.15. 

8.7.9 Human error analysis 

It is well established that human actions play a large role in 
accidents. Human error analysis is used to take this aspect 
into account. As a hazard identification technique, human 
error analysis is qualitative, although a similar term is also 
sometimes used to describe a quantitative method. An 
account of human error analysis is given in Section 8.16. 

8.7.10 Consequence analysis and modelling 

Examination of different scenarios of plant disturbance 
and loss of containment is a central activity in hazard 
identification. The scenarios may relate to the events before 
release or to events involved in escalation after release. 
Hazard identification, therefore, includes methods of devel¬ 
oping and structuring scenarios. Accounts of scenario 
development are given in Sections 8.17 and 8.19. 

8.7.11 Process safety system 

Hazard identification and hazard assessment are a part of 
the safety management system developed by the American 
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Table 8.14 Mond Index: evaluation of index (after D.J. 
Lewis, 1979) 


A Overall index D 


Range Overall degree of hazard 


0-20 

20-40 

40-60 

60-75 

75-90 

90-115 

115-150 

150-200 

>200 


Mild 

light 

Moderate 

Moderately heavy 

Extreme 

Very extreme 

Potentially catastrophic 
Highly catastrophic 

B Fire load index F 



Fire load 
(10 3 BTU/ft 2 ) 

Expected fire 
duration 

(h) 

Category 

Comments 

0-50 

0.25-05 

light 


50-100 

0.5-1 

Low 

Dwellings 

100-200 

1-2 

Moderate 

Factories 

200-400 

2-4 

High 

Factories 

400-1000 

4-10 

Very high 

Maximum for 
occupied 
buildings 

1000-2000 

10-20 

Intensive 

Rubber 

warehouses 

2000-5000 

20-50 

Extreme 


5000-10000 

50-100 

Very extreme 



C Explosion indices 


Internal unit explosion Aerial explosion Category 

index, E index, A range 


0-1 0-10 Light 

1-2.5 10-30 Low 

2.5-4 30-100 Moderate 

4-6 100-500 High 

>6 >500 Very high 


D Toxicity indices 


Unit toxicity Major toxicity Category 

index, U incident index, C 

range range 


0-1 0-20 Light 

1-3 20-50 Low 

3-6 50-200 Moderate 

6-10 200-500 High 

>10 >500 Very high 


E Overall risk factor R 


0-20 

20-100 

100-500 

500-1100 

1100-2500 

2500-12,500 

12,500-65,000 

>65 000 


Mild 

Moderate 
High (Group 1) 
High (Group 2) 
Very high 
Extreme 
Very extreme 


Table 8.15 Mond Index: some examples of potentially 
beneficial design changes (after D.J. Lewis, 1979) 


1. Changes to process whereby the key material is 
diluted by an inert at all times and so reducing the 
material factor 

2. Use of effective stabilizer in all parts of the unit where 
polymerization hazards can exist 

3. Alteration in process conditions (i.e. pressure, 
temperature or mixture composition) to avoid Special 
Material Hazards such as explosive decomposition, 
gaseous detonation (e.g. acetylene), condensed phase 
behaviour, etc. 

4. Separation of unit into two or more units of reduced 
capacity or into units carrying out separate stages 
when such smaller units can be effectively separated 
from each other 

5. Elimination of heated two phase storages 

6. Elimination of multiple reactions within the same 
equipment 

7. Replacement of removable connection systems by 
fixed fully closed pipework 

8. Avoidance of use of open or semi-open equipment 

9. Operation under less arduous pressure conditions 
(either vacuum or high pressure) 

10. Selection of less arduous temperature conditions 
(avoidance of low temperature and high temperature 
operational hazards) 

11. Use of materials of construction having reduced 
corrosion potential for vessels, pipework and fittings 

12. Reduction in numbers of joint and packing leakage 
points and use of superior joint and packing designs 
and materials 

13. Changes in design to reduce vibration or thermal 
cycling effects (e.g. elimination of bellows) 

14. Adoption of more effective and safe control systems 
for the process 

15. Change in operation to take conditions further away 
from flammable range 

16. Use of some inert diluents where high strength 
oxidants are involved (i.e. oxygen enriched air in 
place of oxygen) 

17. Selection of equipment requiring a smaller inventory 
of the key material in the unit 

18. Changes to eliminate as much high level or below 
ground storage of flammable materials within the unit 
plan area as possible 

19. Separation of as much storage capacity from process 
operations as possible 

20. Placement of specific items behind blast or fire 
resistant walls 

21. Addition of effective second containment walls to 
storage units 

22. Changes to unit ventilation requirements 


Petroleum Institute (API RP 750) and later evolved into the 
process safety management system enacted by USDOL 
OSHA (1992). An account of the hazard identification 
segments of the system is given in Section 8.19. 

8.7.12 Choice of method 

The number of techniques available for hazard identifica¬ 
tion is large and is still growing. Each has its own field of 
application. One relevant distinction is between methods 
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Table 8.16 Mond Index: offsetting factors (after D.J. 
Lewis, 1979f 


A Containment system 

Pressure vessels 

Non-pressure vertical storage tanks 
Transfer pipelines 

Additional containment vessels, sleeves and bund walls 
Leakage detection systems and response 
Disposal of relief, vented or dumped material 

B Process control 


Alarm systems 
Emergency power supplies 
Process cooling systems 
Inert gas systems 
Hazard study activities 
Safety shut-down systems 
Computer control 

Explosion and incorrect reaction protection 
Operating instructions 
Plant supervision 

C Safety attitude 


Management involvement in safety 
Safety training 

Maintenance and safety procedures 

D Fire protection 

Structural fire protection 

Fire walls, barriers and equivalent devices 

Equipment fire protection 

E Material isolation 


Valve systems 
Ventilation 


F Fire fighting 

Fire alarms 

Hand fire extinguishers 
Water supply 

Installed sprinkler, water spray or monitor systems 

Foam and inerting installations 

Fire brigade attendance 

Site cooperation in firefighting 

Smoke ventilators 


a This table lists the offsetting factors but not the associated numerical 
values. S eeTechnicalManual (D.J. Lewis, 1979) for full details. 


which are comprehensive and those which are not but 
which supplement the former. Another is between methods 
for use early and late in the design. A third is in the type of 
problem to which a method is best suited. Guidance on 
choice of method is given in Section 8.20. 


8.7.13 Ranking and hazard resolution 

Further aspects of hazard identification are the filtering or 
ranking of the hazard identified to determine those on 
which action is prioritized, and the recording and follow-up 


resolution of these actions. An account of filtering and fol¬ 
low-up is given in Section 8.21. 

8.7.14 Safety review systems 

The arrangements for hazard identification need to be em¬ 
bodied in a formal system, which ensures that the necessary 
studies are done and which covers the life cycle of the plant. 
An account of safety review systems is given in Section 8.22. 

8.8 What If? Analysis 

The What If? method involves asking a series of questions 
beginning with this phrase as a means of identifying 
hazards. Apart from checklists,What If? analysis is possi¬ 
bly the oldest method of hazard identification. The method 
is to ask questions such as, 

What if the pump stops? 

What if the temperature sensor fails? 

The questions posed need not necessarily all start with 
What If?; other phrases may be used. 

The method involves review of the whole design by a 
team using questions of this type, often using a list of 
pre-determined questions. A checklist for use in What If? 
analysis is given by Burk (1992) and is shown in Table 8.18 
Table 8.19 gives an example of the results from aWhat If? 
study reported by Kavianian, Rao and Brown (1992). 

8.9 Event Tree and Fault Tree Analysis 

The event tree and fault tree methods may be used either 
qualitatively or quantitatively. The concept of the fault tree 
was introduced in Chapter 7 and a fuller treatment of both 
event trees and fault trees, including their application to 
quantitative assessment, is given in Chapter 9. Here it is 
sufficient to draw attention to the value of tree methods, 
particularly fault trees, in hazard identification. 

An event tree involves the development of the con¬ 
sequences (outcomes) of an event. The overall approach 
is similar to that adopted in FMEA, which is described below. 

A fault tree involves the development of the contributing 
causes of an undesirable event, often a hazard. The pos¬ 
sibility of this event must be foreseen before the fault tree 
can be constructed. What the fault tree helps to reveal are 
the possible causes of the hazard, some of which may not 
have been foreseen. 

Fault trees are used extensively in hazard assessment, 
but they are also of great value in hazard identification. In 
many cases, it is sufficient to be able to identify the fault 
paths and the base events, which can give rise to the top 
event, it being unnecessary to quantify the frequency of 
occurrence of these events. 

In an FMEA or an event tree, the approach is ‘bottom up’, 
while in a fault tree, it is ‘top down’ (deductive). The 
HAZOP method involves both approaches, starting with 
the deviations and tracing down to the causes and up to the 
consequences. 

8.10 Preliminary Hazard Analysis 

PHA is a method for the identification of hazards at an 
early stage in the design process. Accounts of PHA are 
given in the CCPS Hazard Evaluation Guidelines and by 
Kavianian, Rao and Brown (1992). PHA is a requirement of 
the MILSTD- 882D Standard Practice for System Safety. 
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Figure 8.6 IFAL Index: procedure for calculating p factor contributions (Munday et at., 1980) 


Since the early identification of hazards is of prime 
importance, many companies have some sort of technique 
for this purpose, a portion of which are called PHA; the use 
of the term tends to be fairly loose. 

The CCPS Guidelines state that PHA is intended for use 
only in the preliminary stage of plant development, in cases 
where past experience provides little insight into the 
potential hazards, as with a new process. The information 
required for the study is the design criteria, the material 
and equipment specification, and so on. The Guidelines list 
the entities examined for hazards as: (1) raw materials, 
intermediates and final products; (2) plant equipment; 
(3) facilities; (4) safety equipment; (5) interfaces between 
system components; (6) operating environment and 
(7) operations (maintenance, testing, etc.). 

The results from a PHA are illustrated in Table 8.20 
(Kavianian, Rao and Brown, 1992). 


8.11 Screening Analysis Techniques 

One of the principal methods of identifying process hazards 
is the HAZOP study. Before describing this, however, it is 


appropriate to consider first the method developed for use 
in conjunction with, but earlier than the HAZOP. 

The screen analysis is done at an early stage in the 
design where there is a block layout of plant items. The 
objective is to determine whether there are problems in 
areas such as data on the chemicals, information about the 
hazards, basic features of the process design, or layout and 
siting of the plant. 

There are a number of advantages to be gained from 
conducting screening prior to the HAZOP study itself. 
It assists in the identification of those hazards and 
other problems which are quite basic and which are 
therefore capable, in principle, of being identified at this 
earlier stage. It reveals deficiencies in the design informa¬ 
tion. And it exposes hazards due to interactions between the 
plant and other plants or the environment, at which 
the HAZOP study is less effective. These features contribute 
to removing potential delays on the critical path of the 
project. 

The conduct of a screening analysis involves com¬ 
pilation of two lists: (1) a database of hazards and nui¬ 
sance properties of the material and (2) a list of potential 
hazards, nuisances and other matters of concern. The study 

































HAZARD IDENTIFICATION 8/31 


Table 8.17 IFAL Index: value of index and relative 
contributions of hazards (after Munday et a!., 1980) 


A Relative values of p factor for some 
100,000 te/year plants 



Plant 


P 

Acetic acid 


1.7 

Ethanol 


2.4 

Ethyl benzene 


1.1 

Ethylene oxide 


2.1 

Isopropanol 


1.6 

Styrene (1) 


1.9 

Styrene (2) 


1.0 

Vinyl chloride monomer 


3.3 

B Relative contribution of hazards on 
ethylbenzene plant 

an 


Event 

Contribution 

(%) 

Pool fires 

20 


Vapour fires 

30 


Unconfined vapour cloud explosions 

50 


Confined vapour cloud explosions 

0 


Internal explosions 

0 



therefore covers, albeit in a different way from a HAZOP 
study, the two essential features of the design intent: (1) 
materials and (2) equipment and activities. 

Use is made of a list of suitable guidewords. Guidewords 
may be generated by considering: 

(1) energy sources; 

(2) chemical interactions; 

(3) environment. 

Each of these headings may be broken down further. A 
suitable energy set is a list of the main forms of energy. 

(1) People 

(2) Materials 

(3) Equipment. 

The study results in a set of work assignments to follow¬ 
up the queries raised. As an illustration, the block layout 
might show a storage tank containing flammable liquids. 
The application of the guideword ‘fire’ to this tank might 
raise a number of queries. Amongst those that may be con¬ 
sidered are (1) frequency of fire, (2) detection of fire, (3) 
access for firefighting, (4) method of firefighting, (5) source 
and disposal of fire water, (6) use of alternative firefighting 
agents, (7) nature of combustion products, (8) effects of 
radiant heat and (9) need for a disaster plan. 

8.12 Hazard and Operability Studies 

The HAZOP study is carried out when the ELD (piping and 
instrument diagram) of the plant becomes available. 
Accounts of HAZOP studies are given in the CIA HAZOP: 
Guide to Best Practice (CIA 1999), in HAZOP and Hazan 
(Kletz, 1983d, 1986d, 1992b), Guidelines for Hazard Evalu¬ 
ation Procedures (CCPS, 1985/1,1992/9) (the CCPS Hazard 


Evaluation Guidelines) and A Manual of Hazard and Oper¬ 
ability Studies (Knowlton, 1992), and by Kletz (1972a), S.B. 
Gibson (1974, 1976b,e), Lawley (1974a,b) and Kavianian, 
Rao and Brown (1992). 

The following description is based on those given in the 
CIA HAZOP: Guide to Best Practice and by Lawley (1974b). 
The study is carried out by a multi-disciplinary team, 
which reviews the process to discover potential hazards 
and operability problems using a guideword approach. It is 
essentially an application of the technique of critical 
examination. 

The basis of such a study may, in principle, be a process 
flow diagram (PFD), piping and instrument diagram 
(P&ID) or other information, which reveals the design 
intent. The basis of a HAZOP study is generally the ELD 
(P&ID) supplemented, as appropriate, by other informa¬ 
tion such as operating instructions, MSDSs, details of 
metallurgy, process control information, etc. 

The HAZOP study technique is not a substitute for good 
design. There is something fundamentally wrong if the 
application of the method consistently reveals too many 
basic design faults. 

8.12.1 Origins of HAZOP studies 

The origins of HAZOP studies were in ICI in the 1960s. As 
with many techniques, there is more than one source which 
can lay claim to have been influential in its development. 
Accounts of the development of HAZOP have been given by 
Kletz(1986d)andintheChemeticsMaw«a/(Knowlton,1992). 

The techniques, which eventually grew into HAZOP, 
developed at a time when the applications of method study, 
including critical examination, were being explored. 
Accounts of work in the Heavy Organic Chemicals Division 
of ICI (Binsted, 1960) and in the Mond Division (Elliott and 
Owen, 1968) describe the development of HAZOP in terms 
of critical examination. 

8.12.2 Principle of HAZOP studies 

The basic concept of the HAZOP study is to take a full 
description of the process and to question every part of it to 
discover what deviations from the intention of the design can 
occur and what the causes and consequences of these devia¬ 
tions may be. This is done systematically by applying suit¬ 
able guidewords. Thus important features of the study are: 

(1) design intent; 

(2) deviations from intent; 

(3) causes of deviations; 

(4) consequences 

(a) hazards, 

(b) operating difficulties. 

8.12.3 Design intent and entities examined 

The design intent is examined in respect of the following 
entities: 

(1) material; 

(2) activity; 

(3) equipment; 

(4) source; 

(5) destination. 

In some applications, other relevant entities are: 

(6) time; 

(7) space. 
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Table 8.18 What if method?: checklist for simplified process hazard analysis (Burk, 1992) (Courtesy of the American 
Institute of Chemical Engineers) 


Storage of raw materials, products, intermediates 

Storage tanks Design separation, Inerting, Materials of construction 


Dikes 

Emergency valves 

Inspections 

Procedures 

Specifications 

Limitations 

Materials handling 

Pumps 

Conveyors, Mills 

Procedures 

Capacity, Drainage 

Remote control-hazardous materials 

Flash arresters, Relief devices 

Contamination prevention, Analysis 

Chemical, Physical, Quality, Stability 

Temperature,Time, Quantity 

Relief, Reverse rotation. Identification of materials of construction 

Explosion relief, Fire protection, Support 

Stop devices, Coasting, Guards 

Spills, Leaks, Decontamination 


Piping Rating, Codes, Cross-connections, Materials of construction 

Process equipment, facilities and procedures 

Procedures Start-up, Normal, Shut-down, Emergency 


Conformance 

Loss of utilities 

Vessels 

Identification 

Relief devices 

Review of incidents 

Inspections, Tests 

Hazards 

Electrical 

Process 

Operating ranges 

Job audits, Shortcuts, Suggestions 

Electricity, Heating, Coolant air, Inerts, Agitators 

Design, Materials, Codes, Access, Materials of construction 

Vessels, Piping, Switches, Valves 

Reactors, Exchangers, Glassware 

Plant, Company, Industry 

Vessels, Relief devices, Corrosion 

Hang-fires, Runaways 

Area classification, Conformance, Purging 

Description,Test authorizations 

Temperature, Pressure, Flows, Ratios, Concentrations, Densities, Levels, 
Time, Sequence 

Ignition sources 

Peroxides, Acetylides, Friction, Fouling, Compressors, Static electricity, 

Compatibility 

Safety margins 

Personnel protection 

Protection 

Ventilation 

Exposures 

Utilities 

Hazards manual 

Environment 

Controls and emergency devices 

Controls 

Calibration, Inspection 

Alarms 

Interlocks 

Relief devices 

Emergencies 

Process isolation 

Instruments 

Waste disposal 

Hatches 

Vents 

Characteristics 

Sampling facilities 

Sampling points 

Procedures 

Samples 

Analysis 

Maintenance 

Decontamination 

Vessel openings 

Procedures 

Valves, Heaters 

Heating media, Lubricants, Flushes, Packings 

Cooling, Contamination 

Barricades, Personal, Shower, Escape aids, 

General, Local, Air intakes, Rate 

Other processes, Public environment 

Isolation: Air,Water, Inerts, Steam 

Toxicity, Flammability, Reactivity, Corrosion, Symptoms, First aid 

Sampling,Vapours, Dusts, Noise, Radiation 

Ranges, Redundancy, Fail-safe 

Frequency, Adequacy 

Adequacy, Limits, Fire, Fumes 

Tests, Bypass procedures 

Adequacy, Vent size, Discharge, Drain, Support 

Dump, Drown, Inhibit, Dilute 

Block valves, Fire-safe valves, Purging 

Air quality, Time lag, Reset windup, Materials of construction 

Flame traps, Reactions, Exposures, Solids 

Discharge, Dispersion, Radiation, Mists 

Sludges, Residues, Fouling materials 

Accessibility, Ventilation, Valving 

Pluggage, Purging 

Containers, Storage, Disposal 

Procedures, Records, Feedback 

Solutions, Equipment, Procedures 

Size, Obstructions, Access 

Vessel entry, Welding, Lockout 
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Table 8.18 (continued) 



Fire protection 

Fixed protection 

Extinguishers 

Fire walls 

Drainage 

Emergency response 

Fire areas, Water demands, Distribution system, Sprinklers, Deluge, 
Monitors, Inspection,Testing, Procedures, Adequacy 

Type, Location, Training 

Adequacy, Condition, Doors, Ducts 

Slope, Drain rate 

Fire brigades, Staffing, Training equipment 

Table 8.19 What if? method: results for a high pressure/low density polyethylene plant (Kavianian, Rao and 

Brown, 1992) 

What if 

Consequence/hazard 

Recommendations 

Coolant pump to reactor 
fails 

Runaway condition in reactor 
explosion/fatality 

• Provide accurate temperature monitoring in reactor 

• Employ backup pump/high temperature alarm 

• Relieve reactor pressure in reactor through automatic 
control to stop reactions 

• Provide automatic shut off of ethylene flow 

Coolant temperature to 
jacket is high 

Eventual runaway condition in 
reactor 

• Provide adequate temperature control on coolant line 

• Use heat exchanger flow control to adjust inlet 
temperature 

Runaway condition in 
reactor 

Explosion; fire/fatality 

• Provide adequate temperature control on coolant line 

• Use heat exchanger flow control to adjust inlet 
temperature 

• Install rupture disk/relief valve to relieve pressure to 
stop reactions 

• Emergency shut-down procedure 

Recycle gas compressor 1 or 

2 fails 

None likely 

• Provide spare compressor or shut-down procedure 

Melt pump fails 

High level in reactor causing 
more polymerization: 
runaway reaction eventually 
exceeds design pressure 

• Provide level and flow control schemes to activate 
spare pump or shut the flow of monomer 

• Shut-down procedure if no spare pump 

Leak at suction or 
discharge of compressors 

Fire; explosion 

• Use monitoring devices to ensure no flammable gas 
is released 

Ethylene leaks out of 
process lines 

Fire; explosion 

• Provide adequate flammable gas monitoring devices 

Monomer/initiator ratio out 
of control 

Eventual runaway reaction 
causing fire and explosion 

• Provide flow control on the initiator and 
monomer lines 


8.12.4 Guidewords 

To each of these above entities, there is applied a basic 
set of guidewords. These guidewords and their meanings 


NO or NOT 

MORE 

LESS 

AS WELL AS 
PART OF 
REVERSE 
OTHER THAN 


Negation of intention 
Quantitative increase 
Quantitative decrease 
Qualitative increase 
Qualitative decrease 
Logical opposite of intention 
Complete substitution 


The application of these guidewords is illustrated by 
some of the examples discussed below. It is usually possible 


to apply all the guidewords intelligibly to activities 
and, with the possible exception of REVERSE, to 
substances. 

In applying the guidewords to time, the following 
aspects may he relevant: duration, frequency, absolute time 
and sequence. The guidewords MORE and LESS are 
applicable for duration or frequency, while the guidewords 
SOONER and LATER may he more applicable than 
OTHER THAN for absolute time or sequence. 

Similarly, in applying the guidewords to space, or 
place, the following aspects may be relevant: position, 
source and destination. The guidewords HIGHER or 
LOWER may be more applicable than MORE or LESS for 
elevation, while the guideword WHERE ELSE may be more 
applicable than OTHER THAN for position, source or 
destination. 
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Table 8.20 Preliminary hazard analysis (Kavianian, Rao and Brown 1992) 


Hazard 

Cause 

Major effects 

Corrective/preventive measures 

Damage to feed 
reactor tubes 

Feed compressor failure (no 
endothermic reactions in 
reactor) 

Capital loss, down-time 

Damage to the furnace coils 
due to high temperature 

• Provide spare compressor with 
automatic switch-off control 

• Develop emergency response 
system 

Explosion, fire 

Pressure build-up in the 
reactor due to plug in transfer 

Violent reaction of H 2 to 
acetylene converter with air 
in presence of ignition source 

Fatalities, injuries 

Potential for injuries and 
fatalities due to fire or 
explosion 

• Provide pressure relief valve on 
the reactor tubes 

• Provide warning system for 
pressure fluctuations (high- 
pressure alarm) 

• Provide auxiliary lines with 
automatic switch off 

• Provide warning system 
(hydrogen analyser) 

• Eliminate all sources of ignition 
near hydrogen gas storage area 

• Develop emergency fire response 

• Automatically shut off the H 2 feed 

• Provide firefighting equipment 

Flammable gas 
release 

Ethane storage tank ruptures 

Potential for injuries and 
fatalities due to fire or 
explosion 

• Provide warning control system 
(pressure control) 

• Minimize on-site storage 

• Develop procedure for tank 
inspection 

• Develop emergency response 
system 

• Provide gas monitoring system 

Flammable gas 
release 

CH 4 storage tank (line) leak/ 
rupture (fuel for the furnace) 

Potential for injuries and 
fatalities due to fire or 
explosion 

• Provide warning system 

• Minimize on-site storage 

• Develop procedure for tank 
inspection 

• Develop emergency response 
system 

• Provide gas monitoring system 

Flammable gas 
release 

Radiant tube rupture in the 
furnace 

Potential for injuries and 
fatalities due to fire 

• Improve reactor materials of 
construction 

• Monitor design vs operating 
reactor temperature 

• Provide temperature control 
instrument 

Employee 
exposure to 
benzene 
(carcinogen) 

Leak in knock-out pots or 
during handling benzene 

Chronic health hazard 

• Install warning signs in the area 

• Provide appropriate PPE 

• Develop safety procedures for 
handling and cleanup 

• Monitor concentration of benzene 
in area to meetTLV requirements 

Fire/explosion in 

acetylene 

converter 

Runaway reaction 
(exothermic) 

Fatality, injury, or loss of 
capital 

• Install temperature control on 
converter 

• Install pressure relief on reactor 
responding to temperature control 

Flammable 

atmosphere 

Leak in transfer lines 

Fire/explosion 

• Install combustible gas meter in 
sensitive areas 

• Provide adequate firefighting 
equipment 

• Provide for emergency shut-down 

• Educate and train personnel on 
emergency procedures 
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Some additional guidewords include 

STARTING 

STOPPING 

CONTROLLING 

ISOLATION 

INGRESS 

ESCAPE 

DECONTAMINATION 


8.12.5 Illustrative example: reactor transfer system 

The following example is given, which serves to illustrate 
both the basic examination principle and the detailed use of 
the guidewords. The flow sheet of a reactor system shows 
that raw material streams A and B are transferred by pump 
to the reactor, where they react to give product C.The flow 
of B should not exceed that of A, otherwise an explosion 
may occur. The flow sheet thus shows an intention to 
TRANSFER A to the reactor at the design flow. Applying the 
first guideword NO, NOTor DONT to this intention gives: 

DON’T TRANSFER A 


This is a deviation from intent. Some causes might be that 
the supply tank is empty, that the pipe is fractured or that 
an isolation valve is closed. A consequence might be an 
explosion due to an excess of B. Thus, the examination has 
discovered a hazard. The study is continued using further 
guidewords such as MORE, LESS, etc. 

The application of the guidewords may be illustrated by 
the example already described: TRANSFER A. The guide- 
words may be applicable to either the word TRANSFER or 
to the word A. Thus, for this case, the meanings might 
include the following: 


NO or NOT 
MORE 

LESS 

AS WELL AS 

PART OF 

REVERSE 
OTHER THAN 


No flow of A 

Flow of A greater than design flow 

Flow of A less than design flow intent 
Transfer of some component other than 
A Occurrence some operation event 
additional to TRANSFER 
Failure to transfer all components of A 
Failure to achieve all that is implied 
by TRANSFER 

Flow of A in direction opposite to 
design direction 

Transfer of some material other than A 
Occurrence of some operation event 
other than TRANSFER 


Closely associated with these are checks on (1) informa¬ 
tion still lacking, (2) particular equipments, (3) supplier 
information, (4) plant phases (start-up, shut-down) and 

(5) maintenance procedures, and on entities to be protected 
such as (1) persons working on the unit, (2) others on the 
site, (3) the public, (4) the plant and (5) the environment. 

A multi-disciplinary team is used to conduct the H AZOP 
study. The team should contain people from design and 
from operations who can cover the main relevant dis¬ 
ciplines, who are senior enough to make on-the-spot deci¬ 
sions and who personally attend all the meetings, but the 
team size should be kept fairly small. 

A good deal of preparation is needed prior to the H AZOP 
study. This includes (1) deciding on the type of study 
required, (2) acquisition of the information, (3) validation 
of the information, (4) conversion of the information to 
suitable form, (5) planning of the study sequence and 

(6) arrangement of the schedule of meetings. The detailed 
sequence of an examination is illustrated in Figure 8.7. 

There are a number of factors, which are important for 
the success of the method. The study should have a clearly 
defined objective. The study leader (facilitator) should be 
experienced in the analysis technique hut not necessarily 
in the particular process. The role of the study leader is 
crucial and the study leader must be adequately trained. 
The preparative work should be done carefully so that all 
the necessary documents are to hand and are accurate and 
up-to-date. 

The study uses a formal, even mechanistic, approach 
and the questions raised may in some cases appear unreal¬ 
istic or trivial. It is important to emphasize, however, that 
the approach is intended as an aid to the imagination of the 
team in visualizing deviations and their causes and con¬ 
sequences. The effectiveness of the technique depends 
very much on the spirit in which it is done. 

More complete and detailed discussions of the organiza¬ 
tional aspects of HAZOP studies are given in the CIA Guide. 

8.12.7 Parametric method 

As so far described, the focus of a HAZOP study is on the 
design intent. There is also a ‘parametric method’, distin¬ 
guishable from the classic form, which concentrates on the 
deviations from design conditions. 

This approach was originally developed in ICI Mond 
Division in response to the need to carry out a large number 
of HAZOP studies on existing plants. The method uses a 
hazard guide sheet. An early version of this guide sheet 
was reproduced in the first edition of this book, a later 
version from ICI is shown in Figure 8.8. 


8.12.6 Organization and conduct of HAZOP studies 

The stages in the conduct of a HAZOP study are: 

(1) Definition of objectives and study scope; 

(2) Selection of multi-disciplined team; 

(3) Preparation; 

(4) Conduct/facilitate; 

(5) Record/document study; 

(6) Preparation of HAZOP study report. 

In general, the objectives of a HAZOP study as originally 
defined are to check the design intent and the operating 
procedures/conditions in order to identify hazards and 
operability problems, to which, increasingly, are added 
environmental issues. 


8.12.8 Illustrative example: continuous plant 
As an illustration of a HAZOP study of a continuous pro¬ 
cess, consider the example given by Lawley (1974b). The 
proposed design is shown in Figure 8.9. 

The process description is: 

An alkene/alkane fraction containing small amounts of 
suspended water is continuously pumped from hulk 
intermediate storage via a half-mile pipeline section into 
a buffer/settling tank .Residual water is settled out prior 
to passing via a feed/product heat exchanger and pre¬ 
heater to the reactor section. The water, which has an 
adverse effect on the dimerization reaction, is run off 
manually from the settling tank at intervals. Residence 
time in the reaction section must be held within closely 
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defined limits to ensure adequate conversion of the 
alkene and to avoid excessive formation of polymer. 

A summary of the results of a study for the first line sec¬ 
tion from the intermediate storage up to the buffer/settling 
tank is given in Table 8.21. A further table showing the 
results for the second line section is given in Lawley’s paper. 

For a continuous plant, the study should include the 
operability of the plant during commissioning and during 
regular start-up and shut-down. There are generally a 
number of operations, which are carried out only during 
these periods. 

8.12.9 Time in HAZOP studies: sequences/batch 
processes 

The HAZOP technique is applicable both to batch pro¬ 
cesses and to sequential operations on continuous plants 
such as start-up, shut-down and emergency shut-down. 


This introduces time as an additional factor to be taken into 
account. An adaptation of the set of guidewords applicable 
to time has been given in Section 8.12.4. 

For batch and sequential operations, the following clas¬ 
sification of activities are considered: 

(1) make ready; 

(2) key; 

(3) put away. 

‘Key’ is the activity which progresses the process, ‘make 
ready’ is the activity needed to prepare for the key activity, 
and ‘put away’ is the activity needed on completion of the 
key activity. 

8.12.10 Illustrative example: batch plant 

For a batch plant, the working documents comprise not 
only the flow diagram but also the operating procedures. 
Several documents may be needed to cover the latter, such 














HAZARD IDENTIFICATION 8/37 



as tables giving the operating sequences, bar charts 
showing the states of equipment during the cycle and flow 
charts indicating the operator’s movements. 

As an illustration of a HAZOP study of a batch plant, 
consider the following example. The design is shown in a 
simplified diagram in Figure 8.10. The plant consists of two 
measure vessels, four reaction vessels, a condenser, an 
absorption tower with its circulation system and a Nutsche 
filter with its filtrate receiver. 

The development of the study depends on the kind of 
sequence to be followed. In this case it is possible to follow a 
sequence derived from the flow diagram or one derived from 
the operating instructions. Assuming that the latter is used, 
an instruction part way through the sequence might be: 

Instruction 23 Charge 100 1 of material C from drum 
to the general purpose vessel using the 
air ejector. 

Such an instruction is quite adequate for operational pur¬ 
poses, but it is too complex for the generation of deviations 
in the study, and needs to be broken down into the part 
dealing with the air ejector and that dealing with the liquid 
transfer. Thus the leader may ask a member of the team to 
describe the purpose of the air ejector, which might be sta¬ 
ted as: ‘Remove some air from measure vessel’. The guide- 
words may then be applied to the statement. 


A summary of the results of a study of this batch plant for 
the operation ‘Remove some air from measure vessel’ is 
given in Table 8.22. 

8.12.11 Illustrative example: proprietary equipment 

As an illustration of a study of proprietary equipment, 
consider a sterilization autoclave design example given in 
Figure 8.11. The process description is: 

Sterilization of stillage-loaded materials is achieved by 
treatment with steam humidified sterilizing gas in a 
jacketed autoclave chamber under specified conditions. 
Two entries are provided to the chamber - from the sterile 
and from the non-sterile working areas of the facility. 
Steam is admitted to the chamber via a letdown system 
and sterilizing gas via a vaporizer. The chamber may be 
evacuated via a cooler either directly to drain or via a luted 
sealed catchpot to a vent stack. Filtered atmospheric air 
may be admitted via a non-return valve. A relief valve is 
fitted to the chamber, which exhausts to the vent stack and 
may be by-passed by opening a vent valve if it is required 
to dump the contents to stack.Water is circulated through 
the jacket and heated indirectly by means of steam. 

Once the autoclave is charged and the doors closed, 
automatic sequence control takes over and programmes 
the process as shown in Figure 8.12. The machine itself 
checks the progress of the process cycle, monitoring the 
status of the chamber and auxiliaries. Certain checks [see 






















































































8/38 HAZARD IDENTIFICATION 



Figure 8.9 Hazard and operability studies: feed section of proposed alkene dimerization plant (Lawiey, 1974b) 
(Courtesy of the American Institute of Chemical Engineers) 


Figure 8.12: Autochecks] control progress in association 
with timers. 

For an equipment of this kind, it is also possible to produce 
a flow process chart for the different operations of the cycle. 
A chart for the operation ‘Charging autoclave’ is shown in 
Figure 8.13. 

The development of this study again depends on the 
choice of sequence to be followed. In this case there are a 
number of possible sequences that might be followed. Three 
of these are the flow diagram, the sequence diagram (dot 
chart) and the flow process chart shown in Figures 8.11-8.13, 
respectively; 

A summary of the results of a study of this equipment for 
the operation ‘Humidify autoclave chamber’ derived from 
the flow diagram is given in Table 8.23. 

8.12.12 Space and interactions in HAZOP 
studies: hybrid studies 

In their classic form, HAZOP studies are essentially con¬ 
cerned with conditions inside the plant, including loss of 
containment from it. They do not address, however, any 
interaction in space between the plant and other plants 
nearby or the environment. 

A technique for dealing with such problems is a hybrid 
approach, utilizing both creative checklists and guide- 
words. The method involves nominating a ‘top event’, which 
is then examined to identify its causes, using both a 
checklist of potential causes and guidewords. 

8.12.13 Critical examination and HAZOP studies 

As stated at the outset, HAZOP studies developed from the 
technique of critical examination. In some applications it 


may be useful to revert to the latter. A critical examination 
may be carried out by examining the design intent in 
respect of material, activities, equipment, source and des¬ 
tination. 

The classic guidewords of critical examination may 
include: 

WHAT The design intent 

HOW Method and resources: materials, activities, 
equipments 

WHEN Time aspects: sequence, frequency, duration, 
absolute time 

WHERE Space aspects: relative location, sources and 
destinations, dimensions, absolute location 
WHO Persons or controls: person, skills, organization, 
control system 


8.12.14 Control systems in HAZOP studies 

The HAZOP study methodology was developed originally 
for plants operating under the control of analogue con¬ 
trollers. The methodology may be adapted to the examina¬ 
tion of a plant operated through Distributive Control 
System (DCS). 

8.12.15 Electrical systems in HAZOP studies 

The treatment of electronic control and interlock systems 
and electrical distribution systems in a HAZOP is described 
by Mitchell (1992 LPB105). 

The headings used in his account for electronic control 
and interlock systems are: current, voltage, temperature, 
contamination, high current protection, instruments, 























Table 8.21 Hazard and operability studies: results for feed section of proposed alkene dimerization plant from intermediate storage to buffer/settling tank (Lawiey, 
1974b) (Courtesy of the American Institute of Chemical Engineers) 


Guide word Deviation 

NONE No flow 


MORE OF More flow 


More pressure 


More temperature 


Possible causes 


Consequences 


Action required 


(1) No hydrocarbon available 
at intermediate storage 


(2) J1 pump fails (motor fault, 
loss of drive, impeller 
corroded away, etc.) 

(3) Line blockage, isolation 
closed in error, or LCV 
fails shut 

(4) Line fracture 


Loss of feed to reaction section 
and reduced output. Polymer 
formed in heat exchanger 
under no flow conditions 
As for (1) 


As for (1) 

J1 pump overheats 
As for (1) 

Hydrocarbon discharged into 
area adjacent to public highway 


(a) Ensure good communications with 
intermediate storage operator. 

(b) Install low level alarm on settling 
tank LIC 

Covered by (b) 


Covered by (b) 

(c) Install kick-back on J1 pumps 

(d) Check design of J1 pump strainers 
Covered by (b) 

(e) Institute regular patrolling and 
inspection of transfer line 


(5) LCV fails open or LCV 
bypass open in error 


(6) Isolation valve closed in 
error or LCV closes, with 
J1 pump running 


(7) Thermal expansion in an 
isolated valved section 
due to fire or strong 
sunlight 

(8) High intermediate storage 
temperature 


Settling tank overfills 


Incomplete separation of water 
phase in tank, leading to 
problems on reaction section 
Transfer line subjected to full 
pump delivery or surge 
pressure 


Line fracture or flange leak 


Higher pressure in transfer line 
and settling tank 


(f) Install high level alarm on LIC and 
check sizing relief opposite liquid 
overfilling 

(g) Institute locking off procedure for 
LCV bypass when not in use 

(h) Extend J2 pump suction line to 12 in. 
above tank base 


(j) Covered by (c) except when kick- 
back blocked or isolated. Check line, 
FQ and flange ratings, and reduce 
stroking speed of LCV if necessary. 
Install a PG upstream of LCV and an 
independent PG on settling tank 

(k) Install thermal expansion relief on 
valved section (relief discharge route 
to be decided later in study) 

(l) Check whether there is adequate 
warning of high temperature at 
intermediate storage. If not, install 





Table 8.21 (continued) 


Guideword 

Deviation 

Possible causes 

Consequences 

Action required 

LESS OF 

Less flow 

(9) 

Leaking flange or valved 
stub not blanked and 
leaking 

Material loss adjacent to public 
highway 

Covered by (e) and the checks in (j) 


Less temperature 

(10) 

Winter conditions 

Water sump and drain line 
freeze up 

(m) 

Lag water sump down to drain valve, 
and steam trace drain valve and drain 
line downstream 

PART OF 

High water 
concentration in 
stream 

(11) 

High water level in 
intermediate 
storage tank 

Water sump fills up more 
quickly. Increased chance of 
water phase passing to 
reaction section 

(n) 

Arrange for frequent draining off of 
water from intermediate storage tank. 
Install high interface level alarm 
on sump 


High 

concentration of 
lower alkanes or 
alkenes in stream 

(12) 

Disturbance on 
distillation columns 
upstream of intermediate 
storage 

Higher system pressure 

(o) 

Check that design of settling tank and 
associated pipework, including relief 
valve sizing, will cope with sudden 
ingress of more volatile hydrocarbons 

MORETHAN 

Organic acids 
present 

(13) 

As for (12) 

Increased rate of corrosion of 
tank base, sump and drain line 

(P) 

Check suitability of materials of 
construction 

OTHER 

Maintenance 

(14) 

Equipment failure, 
flange leak, etc. 

Line cannot be completely 
drained or purged 

(q) 

Install low point drain and N 2 purge 
point downstream of LCV Also N 2 vent 
on settling tank 
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Figure 8.10 Hazard and operability studies: batch plant (simplified diagram) (Chemical Industry Safety and Health 
Council, 1977/3) 


Table 8.22 Hazard and operability studies: results for batch plant for operation ‘Remove some air from measure 
vessel’ (Chemical Industry Safety and Health Council, 1977/3) 


Deviations 

Causes 

Consequences 

DON’T REMOVE AIR 

No air supply "i 

Faulty ejector > 

Value shut J 

Process inconvenience but no 
hazard 

REMOVE MORE AIR 

Completely evacuate measure vessel 

Can vessel stand full vacuum? 

REMOVE LESS AIR 

Insufficient suck to transfer contents 
of drum 

Process inconvenience but no 
hazard 

AS WELL AS REMOVE AIR 

REMOVE PART OF AIR 

Pull droplets of material C or other 
materials from drums or vessels 1 or 4 
along exhaust line 

Remove oxygen or nitrogen only: not 
possible 

Fire hazard? 

Static hazard? 

Corrosion hazard? 

Blocked flame trap? 

Will material be a hazard after 
leaving the flame trap? Where 
does it go? 

REVERSE REMOVAL OF AIR 

If line form air ejector is blocked, 
compressed air will flow into measure 
vessel 

Overpressure vessel? 

Blow air into drums and spray out 
contents? 

Put air into vessels 1 or 4? 

OTHER THAN REMOVE AIR 

Put air ejector on when measure 
vessel full 

Spray contents along line and out 
through flame trap. Similar 
hazards to AS WELL AS 
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Figure 8.11 Hazard and operability studies: autoclave arrangement (Chemical Industry Safety and Health 
Council, 1977/3) 


sampling, corrosion, services failure, maintenance, abnor¬ 
mal operations, spares, static electricity and safety. A short 
checklist is given under each heading. Where appropriate, 
as with current and voltage, guidewords such as NO, 
REDUCED, INCREASED, etc., are used. A basically simi¬ 
lar list is used for electrical distribution systems. 


8.12.16 Additional parameters and guidewords 

Wider application of the HAZOP approach, to systems such 
as materials handling systems, has led to the creation of 
further lists of parameters and guidewords such as the one 
shown in Table 8.24, derived from the work byTweeddale 
(1993e). 
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Figure 8.12 Hazard and operability studies: sequence diagram (dot chart) for autoclave arrangement 
(Chemical Industry Safety and Health Council, 1977/3) 


8.12.17 Timing of HAZOP studies 

The timing of a HAZOP study is an important issue. The 
disadvantages of an early study are that some of the infor¬ 
mation necessary to its effective conduct is not available 
and that there is a greater risk of design changes being 
made to the detriment of operability and/or safety. The 
advantages are that it is easier to incorporate in the design 
any changes arising out of the study and, in particular, to 
achieve an inherently safer design. 

Conversely, the disadvantages of a late study are that the 
design response options will have been rendered more dif¬ 
ficult and expensive to implement, or sometimes foreclosed 
altogether, and consequently there is a stronger tendency 
to solve safety problems by ‘add-on’ measures. 

8.12.18 Documentation for hazard studies 

As the design progresses, the documentation produced, 
including the process and plant diagrams becomes firmer 
and more detailed. 

The most primitive document is a block diagram of the 
whole process, in which each block represents some opera¬ 
tion, possibly a whole plant. Addition of flow quantities and 


utility usages to this diagram turns it into a quantities 
flowsheet. 

Next come, for each of the blocks in the block diagram, the 
various versions of the PFD, these typically being 
concept, preliminary and final versions. The PFD shows the 
main items of equipment, utilities and effluents, and control 
loops. 

As the design firms up, the ELD is produced, show¬ 
ing the in-line items, the materials of construction, the 
equipment sizings, the line specifications and sizings, the 
equipment and line code numbers, and more details of 
instrumentation and control loops, as well as of pipework 
features such as drains and lutes. 

An ELD with full information on the instrumentation 
constitutes the P&ID. 

The firm ELD or P&ID is the preferred diagram for a 
HAZOP study, but in some cases it may be necessary to 
initiate the study at some earlier stage. For a continuous 
process, the minimum documentation required is the 
ELD and the outline operating procedures. For a batch 
process, these need to be augmented by the operating 
sequence. 
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Figure 8.13 Hazard and operability studies: flow process 
chart for autoclave arrangement for operation ‘Charging 
autoclave’ (Chemical Industry Safety and Health Council, 
1977/3) 


8.12.19 Personnel involved in HAZOP studies 

As stated earlier, a multi-disciplinary team performs the 
HAZOP. The team is normally composed of personnel 
responsible for design, commissioning and operation, but 
the detailed composition varies both between companies 
and with the type of project within a given company. 

A typical team might comprise the study leader (facili¬ 
tator), the project engineer, a process engineer, an instru¬ 
ment engineer and the commissioning manager. Other 
personnel who are often included, depending on the nature 
of the project, are a chemist, a civil engineer, an electrical 
engineer, a materials technologist, an operations super¬ 
visor, an equipment supplier’s representative, and so on. 

The technical team members provide the technical input 
in response to the guidewords. They are also able to amplify 
the information about the plant design given in the plant 


diagrams, operating instructions, etc. They may receive 
work assignments arising from the meetings and, as indi¬ 
cated below, one of their numbers may be appointed to act 
as the follow-up coordinator. 

8.12.20 Leadership of HAZOP studies: the Facilitator 

The role of the study leader is to act as a facilitator to bring 
to bear the expert knowledge of the technical team mem¬ 
bers in a structured interaction. It is not his role to identify 
hazards and operability problems, but rather to ensure that 
such identification takes place. 

The study leader should be someone not directly 
involved in the design, but with skills as a HAZOP leader. 
The effectiveness of a HAZOP study is highly dependent 
on the skill of the study leader. Trained and experienced 
leaders are crucial. 

The study leader is responsible for the definition of 
the project HAZOP; for the preparation of the meetings 
to be held; for arranging the schedules of meetings, and 
hence their timing and pacing; for assembling an appro¬ 
priate team and ensuring that they understand their 
role, and receive training if necessary; for the provision 
to each study meeting of the necessary documents and 
other information; for the conduct and recording of the 
meetings; and for follow-up of matters raised during the 
meetings. 

At the definition stage, the study leader should ensure 
that there is a satisfactory liaison with the client such that 
the latter will follow-up the results emerging from the 
study. 

In the preparation stage, the study leader should review 
the extent to which the plant under consideration is similar 
to one already studied and how this should affect the study 
to be conducted. In many cases, the design is not a com¬ 
pletely new one but constitutes a modification of an exist¬ 
ing design. The study leader will then define the features, 
which are novel — raw materials, plant equipment, materi¬ 
als of construction, environmental conditions, etc. - and 
decide whether examination of certain parts can be omitted 
as unproductive. He should also ensure as part of the prepa¬ 
ration that the necessary information is available and is 
correct. 

The most elusive skill of the study leader lies in the con¬ 
duct of the HAZOP meeting itself. One essential require¬ 
ment is to ensure that the examination neither becomes too 
superficial nor gets bogged down in detail so that it identi¬ 
fies all the hazards but within a reasonable time-scale. 
Another is to manage the personal interactions between the 
team members, to obtain balanced contributions and to 
minimize the effect on individuals when the design is sub¬ 
ject to criticism. These requirements are easily stated but 
constitute a significant skill. 

8.12.21 Follow-up of hazard studies 

The output of a HAZOP study is a set of queries concerning 
the design. There needs to be a formal arrangement to 
ensure that these are followed up. One method of doing this 
is to arrange that at each meeting every question raised is 
assigned to a specific individual to follow up and, in addi¬ 
tion, to appoint a follow-up coordinator, preferably a mem¬ 
ber of the study team, to ensure that this is done. A common 
practice is to assign to this role a person with line respon¬ 
sibility such as the project manager. 

Follow-up is one of the prime functions of computer 
packages developed to assist HAZOP. 
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Table 8.23 Hazard and operability studies: results for autoclave arrangement for operation ‘Humidify autoclave 
chamber’ (Chemical Industry Safety and Health Council, 1977/3) 


Deviations 

Causes 


Consequences 

DON’T HUMIDIFY 

Valve B not open ■x 

LD valve closed 

Steam line choked 1 

Vent valve open i 

All steam to vaporizer 

Line fractured J 

1 

Hazard to product - sterilizing gas not 
effective dry 

MORE HUMIDIFY 

Too much steam - 
LD valve failed open 

Too high steam 
pressure/temperature 


Could chamber be overpressured? 

Is relief valve sized for full bore ingress 
of steam to chamber? 

Is product temperature/pressure sensitive? 
Effect of high temperature and pressure on 
sealing components of autoclaves, e.g. 
door seals? 

LESS HUMIDIFY 

Too little steam, too low steam 
pressure/temperature 

Is condensation on product deleterious? 

AS WELL AS HUMIDIFY 

Contaminants in steam, e.g. C0 2 , 
condensation, air, rust, etc. 

Effect on product? 


Sterilizing gas (valve A passing) 

Air (valve C passing) 

Waste gas by evacuation. Gas into plant 
atmosphere - is second isolation valve 
required? 

Reduces effectiveness of humidification 


Contaminants from vent stack 
(vent valve passing) 

Might induce gases from other autoclaves 


Plant atmosphere (door seals 
leaking) 

Vacuum pump fails 

No hazard at this stage, but could be leak at 
sterilizing stage 

Contaminants from drain enter autoclave 

PART OF HUMIDIFY 

Steam in but loss of vacuum pump 
(or valve D closes) 

Vacuum, but no steam in 

Chamber will be partly pressurized. Load 
very wet, temperature too high. Chamber 
partly filled with water. Cycle will continue 
and sterilizing gas may not enter due to 
back pressure 

Cycle will continue; if lack of humidity is not 
detected and action taken, load will not be 
sterile 

REVERSE HUMIDIFY 

Vacuum drying 


No steam in, as above 

OTHER THAN HUMIDIFY 

Sterilize by omission of 
humidifying step 


Cycle will continue - load will not be sterile 
(as above) 


8.12.22 Computer aids for HAZOP studies 

There are a number of computer programs available to 
assist in the housekeeping aspects of HAZOP studies. 
These are covered in Chapter 29. These programs are dis¬ 
tinct from codes, which perform hazard identification by 
emulating HAZOP studies. Developments in this area are 
described in Chapter 30. 

8.12.23 Experience and further development of 
HAZOP studies 

The HAZOP study has been found to be an effective tech¬ 
nique for discovering potential hazards and operating diffi¬ 
culties at the design stage. Reductions of at least an order of 
magnitude in the number of hazards and problems 
encountered in operation due to such studies have been 
claimed. 

The technique has become firmly established in the 
process industries, in small as well as large companies, as a 


prime, or the prime, method of hazard identification. In 
those companies where the method is used, HAZOP studies 
have tended to become an appreciable proportion of the 
design effort. 

The account of the technique given above has followed 
the original emphasis on the deviations of process vari¬ 
ables. Application of the technique has led to its extension 
particularly to the various activities of operation and main¬ 
tenance, which are the source of many other deviations. 

Not surprisingly, the widespread use of the technique 
has also led to the development of local variants and to 
adaptations to the needs of the particular companies using 
it. The HAZOP study technique has also been extended to 
cover other concerns such as the environment. In some 
cases, the same study is used to cover, on the one hand, 
safety and operability and, on the other, environment. 
Some HAZOP studies given in the literature are listed in 
Table 8.25. 
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Table 8.24 Hazard and operability studies: some additional parameters and guidewords (after Tweedaie, 1993e) 


Process variables 

Flow 

High; low; reverse; two-phase; leak 


Level 

High; low 


Temperature 

High; low 


Pressure 

High; low; vacuun 


Load 

High; low 


Viscosity 

High; low 


Quality 

Concentration/proportion; impurities; cross-contamination, side 
reactions; particle size; viscosity; water content; inspection and 

Plant states 

Commissioning 

Statutory approvals; compliance checking; sequence of steps; 


and start-up 

supervision, training 


Shut-down 

Isolation; purging; cleaning 


Breakdown 

Fail-safe response; loss of utilities; emergency procedures 

Production 

Throughput 

Efficiency 

Sources of unreliability/unavaliability; bottlenecks 

Materials of 
construction 


Corrosion; erosion; wear; chilling; compatibility; sparking 

Plant layout 

Access 

Operation; maintenance; escape; emergency response 



(For housekeeping, work in progress, escape) Cramped; wasted 


Electrical safety 

Hazardous area classification; electrostatic discharge and earthing: 
lightning protection 

Utilities 


Air; nitrogen; steam; electrical power; water: process, hot/cold, 
demineralized, drinking: drainage 

Machinery 

Machinery 

Overload; malfunction; foreign body; rotation: fast, slow; jamming/ 
seizing; frictional overheating; mechanical failure/fracture; impact; 
valve blockage: mechanical, low temperature; interlocks 


Assembly 

Component missing, extra, or wrong; assembly sequence wrong; 
screwed wrong: (too tight, too loose): crossed/contaminated thread; 
shielding 


Incompatibility 

Tools and equipment material: foreign objects 

Materials handling 

Speed 

Fast; slow; unbalanced 


Packaging 

Filling (over, under); damage (external, internal); poor sealing: legal 
requirements; labelling 


Physical damage 

Impact; dropping; vibration 


Stoppages 

Breakage; blockage; jamming; loss of feed; loss of packaging; advance 
warning; rectification 


Direction 

Upwards; downwards: to one side; reverse 


Spillage 

Spillage: into product, into other materials. Spillage: outside 
equipment, outside plant 


Location 

Wrong: vertical, horizontal; orientation 

Stockholding 

Stockholding 

Failed stock rotation: poor storage (water, vermin); storage of 

consumables (spares, tools, paints/solvents); storage of raw materials 

Hazards 

Fire and explosion 

Prevention; detection; separation; protection; control 


Toxicity 

Acute; long-term; ventilation; control 


Ignition 

Friction: impact: static electricity; degraded electricals; failed 
earthing; mechanical sparling: misalignment; high temperature; 
dropped objects 


Environment 

Housekeeping; dust, spillage, scrap/residues: humidity high, low; 
ventilation failure 


Environmental control 

Effluents: gaseous, liquid, solid; noise; monitoring 

Targets 

Severity 

Quantity exposed; protection and adequacy; venting; personnel 
escape: unplanned exposure: dust, maintenance, protection 
malfunction, propagation via duct 


Operator injury 

Heavy lifting; repetitive motion; exposure: dust, fume, heat; falling, 
slipping, tripping 

Reactions 

Reaction rate 

Fast; slow 

Control and 

Control 

Sensor and display location; response speed; interlocks 

protection 

Protection 

Response speed; element common with control loop: sensor, valve, 
operator; remote actuation; venting; testing 


Safety equipment 

Personal equipment; showers 

Sequences 

Timing 

Duration/dwell; rate of approach; sequence; start too early, late: stop too 
early, late 

Testing 

Testing 

Raw materials; products; equipment; protective instrumentation: 
alarms, interlocks, trips; protective equipment 
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Table 8.25 Selected hazard and operability studies 

Author(s) Subject of study 


Lawley (1974b) 
Lawley (1976) 
CIHSC (1977/3) 


Rushford (1977) 

Austin and Jeffreys (1979) 
Sinnott (1983) 

Piccinini and Levy (1984) 
Kletz (1985e) 

Ozog (1985) 

Flothmann and 
Mjaavatten (1986) 
Kavianian, Rao and 
Brown (1992) 


Knowlton (1992) 


Feed section of olefme 
dimerization plant 
Ethylene oxide feed system 
for batch reactors 
Reactor transfer system; feed 
section of olefine 
dimerization plant; batch 
plant; autoclave 
Section of cracker unit 
Reactor section 
Reactor section of nitric acid 
plant 

Ethylene oxide reactor 
system 

Liquid propane cross¬ 
country pipeline 
Flammable liquid 
storage tank 

Refrigerated liquid ammonia 
storage 

High pressure/low density 
polyethylene plant; metal 
organic chemical vapour 
deposition process 
Reactor transfer system; 
batch plant; autoclave; 
interstage cooler; 
emergency shut-down and 
blowdown system; gas 
supply and oil storage 
system (hybrid study) 


8.12.24 Activities in HAZOP studies 

It is of interest to know the actual activities that are under¬ 
taken in a HAZOP study, particularly for the development 
of the HAZOP technique, including computer-aided activ¬ 
ities (Thble 8.26). 

Figure 8.14 gives a flow chart for a typical study. A large 
proportion of the protocol consisted, in addition to selection 
of the item of plant and the parameter deviation for study, 
of the following activities: 

(1) generation of possible causes and consequences of 
initial deviation; 

(2) explanation of features of process material or plant item; 

(3) estimation of quantitative aspects of plant dynamics, 
plant reliability and availability, hazard and risk; 

(4) checks on features of design and operation and of 
potential HAZOP problems, including detectability of 
deviations/faults and final consequence hazards and 
methods for starting, controlling and stopping the 
operation; 

(5) specification of any action to be taken. 


The activity of generating causes and consequences trig¬ 
gered by the application of the guideword to the parameter 
was relatively unsystematic. The team explored fault paths 
as they occurred to individuals. 


Explanation of features of process materials or plant 
items emerged as a significant activity. Generally, in a 
design there are (1) features that are ambiguous, (2) features 
that have to be modified and (3) features that have char¬ 
acteristics, which have not been considered. These features 
may require further explanation for several reasons: (1) the 
information may be documented but it is more convenient 
to retrieve it by verbal explanation, for example, philoso¬ 
phy of the design calculation; (2) the information is, or 
should be, part of the design, but it is not yet documented, 
for example, intended operating procedure; (3) the infor¬ 
mation is generated by the HAZOP team during the study. 
Some topics on which explanations were given are shown in 
Table 8.27, Section C. 

Another significant activity was estimation of quantita¬ 
tive or semi-quantitative aspects of plant dynamics, plant 
reliability and availability, and hazard and risk. Some fea¬ 
tures on which estimates were made are given in Table 8.27, 
Section D. 

The central activity was checks on features of design 
and operation and on hazards and operability problems. 
Some of these checks are listed in Table 8.27. The checks 
given are limited to those arising directly or indirectly from 
use of the guidewords, which were not instantly dismissed. 
An important class of check was those on the detectability 
of deviations/faults. A large proportion of operability prob¬ 
lems are problems of deviation/fault detection. Some of the 
checks of this type are listed in Table 8.27, Section E. 

Most of the hazards listed in Table 8.27 are intermediate 
events rather than final consequences. Table 8.27, Section F, 
gives some of the principal final consequences of ultimate 
interest in the study. 

Some of the hazards considered would be identified only 
if two deviations/faults were to occur simultaneously. 
Some of the decisions made on such simultaneous devia¬ 
tions/faults are given in Table 8.27, Section G. In four out of 
the five cases shown in the table, the probability of simul¬ 
taneous occurrence was assessed as negligible. In the fifth 
case, one of the faults is failure of a low flow alarm system. 
This type of failure could occur well before the low flow 
deviation but remain unrevealed so that the probability of 
‘simultaneous’ deviations/faults could be much higher in 
this case unless the instrument was proof tested. The prob¬ 
lem of unrevealed failure was evidently recognized by the 
team in assessing this risk as not negligible. 

The analysis revealed several problems of design 
communication. Some of these are shown in Table 8.27, 
Section H. 

8.12.25 Filtering in HAZOP studies 

The account given so far of HAZOP studies has empha¬ 
sized primarily the generation of deviations. But HAZOP is 
not in fact a pure identification technique. A significant 
part of the activity in a HAZOP is concerned with the fil¬ 
tering of the deviations identified. It is not the function of 
the HAZOP team to carry out ‘instant design’. But it is a 
proper function to carry out a coarse filtering process on 
the deviations generated in order to prevent the design 
systems being swamped with insignificant items. The 
contribution of experienced people is probably at least as 
much in filtering as in generation. 

8.12.26 Quality assurance 

A survey of HAZOP studies conducted as part of the 
safety case for oil platforms in the North Sea has been 
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Table 8.26 Hazard and operability studies: activities in a study a (Roach and Lees, 1981) 

A Features of design and operation 

Alarm dynamic response 

Distillation column 

Gas, Vapour lock (2) 

Plant and pipework 

Alarm setting 

high level 

Hammerblow 

configuration: 

Flow measurement - full 

Effluent system 

Inert gas blanketing of heat 

Potential alternative 

bore flow in pipe 

operation 

transfer surface 

pipework 

Interlocks (3) 

Lute maintenance 

Layering 

configuration 

Potential correction 

Pipe function and flow 

Liquid slugs, surges (2) 

Pipework configuration 

Pressure deviation - effect 

Pump maximum flow 

Pressure surges (2) 

relative to intended flow 

on distillation column 

Pump operation 

Reaction forces 

Equipment capacity, 

controllers 

Reverse flow hazard 

Siphon (3) 

underdesign: 

Temperature measurement - 

Valve and bypass 

Suction due to high 

Condenser 

full immersion of probe 

Sequential operations: 

downflow 

Distillation column trays 

Trip dynamic response 

Charging of acid and 

Suckback 

Pipe (6) 

Trip setting 


Vortexing 

Pressure relief valve 

Pressure equipment: 

Additives: 

Heat effects: 

Vent 

Pressure relief 

Operation instructions 

Heat of mixing (3) 

Equipment overdesign: 

Pressure vessel design 

Pipework 

Impurities: 


assumptions 

Pump interlocks 

Effluents 

Valve (2) 

Pump delivery pipework 

Pressure system register: 

Process water 

Plant turndown (2) 

rating for high pump 

Hazardous pipelines (3) 

Product 

Materials of construction: 

suction pressure 

Pipe acting as vent 

Leaks: 

Corrosion (2) 

Rating of vessel as a 

Vent 

to environment 

High temperature 

pressure vessel 

Maintenance, 

within heat exchanger (4) 

Low temperature effect on 


maintainability: 

through Valve (3) 

lined pipe 

Automatic vs manual 

Column repacking 

Lutes 

Low temperature 

changeover 

Equipment removal 

Maloperation: 

embrittlement 

Configuration and layout 

Pressurized 

Pumping of fluid from one 

Product discolouration 

Kickback 

equipment (2) 

pump back through another 


Maintenance error—pump 


Material deposits 

Frost protection (5) 

wrongly piped up 

B Hazards and operability 

Sample points: 

Heat conservation 

Operating instructions 

problems 

Access (2) 

Personnel protection (4) 

Overdesign 

Air ingress (3) 

Air ingress 

Equipment features and 

Pressure relief valve 

Blockage (6) 

Liquid circulation 

facilities: 

(positive displacement 

Freezing (2) 

Pressurized system 


pump) 

Icing 

Wrong location 

Analysis point (5) 

Replacement error - pump 

Polymerization 

Sabotage 

Break tank 

of twice design capacity 

Chemical reaction 

Static electricity (2) 

Bund 

installed 

Decomposition 

Trip action effects 

Disengagement space 

Valves: 

Effluents 

Utilities failure: 

Drain point (2) 

Action on air failure 

Impurities 

Cooling water (3) 

Droplet knockout facilities 

Valve and bypass: 

Vented materials, fate of 

Electrical power 

Drying facilities 

Interlock 

Erosion 

Instrument air 

Gas balancing 

Operating instructions 

Explosion 

Nitrogen 

Isolation (4) 

Valve lock open 

Explosive impurities 

Vacuum: 

Lute (4) 

Valve selection — isolation 

External fire 

Absorption of soluble 

NPSH 

valve vs instrument valve 

Flammable atmosphere 


Purging facilities (2) 

Valve trim size 

Fluid flow phenomena: 

Collapse of pipe lining 

Self-draining: 

Power supply 

Boiling (2) 

Valves: 

Consenser fall 

Earthing, electrical 


Heating up of fluid trapped 

Pipe fall (3) 

continuity 

Erosion 

between two closed valves 

Restrictor orifice, effect of 

Plant layout: 

Flashing 

Installed or replaced wrong 

Siphon breaker (2) 

Access (3) 

Flooding: 

way round 

Slip plate facilities 

Floor levels, relative to 

Condenser 

Leaks 

Spool piece (3) 

operations 

Distillation column (2) 

Water ingress (2) 

Venting facilities (3) 


Gas absorption column 


Warming 

Manholes 

Frothing 



Overflows 

Gas breakthrough 


Instrumentation and control: 

Operating instructions: 

Gas evolution from 


Alarms on pumps 

Additives 

liquid (2) 



a The categories listed are not all mutually exclusive, and a small proportion of checks are listed under more than one entry. 
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Figure 8.14 Hazard and operability studies: sequence of activities in a study (Roach and Lees, 1981) (Courtesy 
of the Institution of Chemical Engineers) 
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Table 8.27 Hazard and operability studies: checks made 
in a study a (Roach and Lees, 1981) (Courtesy of the 
Institution of Chemical Engineers) 


A Check words applicable to deviation of process 

variables 


NO, NOT 

Negation of intention 

MORE 

Quantitative increase 

LESS 

Quantitative decrease 

AS WELL AS 

Qualitative increase 

PART OF 

Qualitative decrease 

REVERSE 

Logical opposite of intention 

OTHER THAN 

Complete substitution 

B Other check words 

STARTING 

ISOLATION 


ESCAPE 

STOPPING 

DECONTAMINATION 

CONTROLLING 

INGRESS 

C Some topics on which explanations are given 

Flowsheet discrepancies 

Instrumentation, control and 

Function of a unit: 

protection 

Drain/flushing point 

Conventional control system 

Valve 

configuration, logic and 

Modes of operation of unit 

behaviour (3) 

Design capacity/overdesign 

Computer control 

of unit 

configuration logic and 

Materials of construction 

behaviour (3) 

Lagging 

Manual control loops 

Physical characteristics 

Trip vs alarm setting 

of process materials: 

Trip or pressure relief setting 

Miscibility 

Quality standards: 

Solubility 

Products 

Chemical characteristics/ 

Effluents (2) 

reactions of process 

Potential deviation: 

materials: 


Decomposition 

Failure effects: 

Additives, functions of 

Flow meter failure 

Impurities, fate of pressures 

Pump corrosion 

and pressure drops: 

Pump start failure 

Gravity vs pumped 

Pump valve configuration 

flows (2) 

errors 

Units atmospheric 

Failure data: 

pressure 


System arrangements: 


Bypasses (2) 

Company practices: 

Gas balancing 

Lagging 

Inserting/purging 

Overpressure protection 

Isolation 

Statutory requirements 

Lutes 

Break tank 

Purging (2) 


Sampling (2) 


Venting 


D Some features on which estimates are made 


Fraction of time spent by unit in different operational modes 
Magnitude of deviations (4) 

Steady-state gain relating consequences 
Time for deviation/fault to give rise to consequences (3) 
and cause deviations 
Time for deviation/fault to be detected (2) 

Performance of plant unit in face of deviation 
Failure rate: 

Utilities (2) 


Fractional dead time (3) 

Degree of hazard/inoperability (4) 

Frequency/probability of hazard/inoperability (8) 


E Checks on detectability of deviations/faults and of 
correct operation 


Deviations!faults checked for detectability 
Flooding 

Process variable deviations: Utility failures: 


High flow (2) 

Cooling water (2) 

Low flow 

Refrigeration set 

Reverse flow (2) 


High level (4) 

Instrument failure 

Low level (3) 

Pump failure (2) 

High pressure 

Valve fails open 

Low pressure (2) 

Valve misdirected shut (2) 

High temperature 

Valve installation errors on 

Low temperature 


Contamination (3) 

Lute problems 

Additive deviations 

Flow at pumps and valves 

Blockages: 

checked for detectability 

Blockages (3) 

Pumps 

Freezing (3) 

Valves 

F Principal final and intermediate consequences of 

deviations/faults 


Overpressure (5) 

Effluent (flow normally exists): 

Underpressure, vacuum 

Contamination (3) 

collapse (2) 

High flow 

Overtemperature (3) 

High temperature 

Undertemperature (2) 

pH deviation (2) 

Corrosion (5) 

Effluent, (occasional venting 

Explosive mixture, 

flow occurs) (3): 

confined 


Explosion, confined 

High flow (2) 

Equipment damage 

Forced shut-down: 

Overflow (liquids) (11) 

Manual 

Boilover 

Automatic trip (2) 

Escape (gases) 

Equipment failure 

Escape (liquids) 

Personnel injury (6) 

Product contamination (4) 



G Decisions on simultaneous deviations/faults 


One of two pump motors down for maintenance AND 
electrical supply phased - no action 
Process upset AND cooling water failure - no action 
Steam flow high AND cooling water failure - no action 
Pump failure AND low flow alarm failure - further 
investigation 

Deviation in pH AND deviation in chemical decomposition 
with consequent possibility of SO2 generation - no action 


H Uncommunicated features, ambiguities and 
variations in the design 


Uncommunicated design features 
Uncommunicated design changes 
Ambiguity about vessel design pressure 
Equipment designed for throughputs other than flow 
sheet one 

Potential variations in methods of plant operation not 


a Numbers in parentheses indicate the number of times an item occurs 
in the protocol. If no number is given, an item occurs once. Entries 
followed by a colon are headings, not specific items. 
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described by Rushton et al. (1994). The survey covered the 
context, policy, practical aspects and quality assurance of 
HAZOP. 

A more detailed account of possible approaches to the 
quality assurance of HAZOP is given in a further report by 
Rushton (1995). 

Quality assurance is discussed further in Sections 
8.27-8.29. 

8.12.27 Limitations of HAZOP studies 

The HAZOP technique has been widely adopted and is the 
centrepiece of the hazard identification system in many 
companies. It does, however, have some limitations. 

These limitations are of two kinds. The first type arises 
from the assumptions underlying the method and is an 
intended limitation of scope. In its original form, the 
method assumes that the design has been carried out in 
accordance with the appropriate codes. Thus, for example, 
it is assumed that the design caters for the pressures at 
normal operating conditions and intended relief condi¬ 
tions. It is then the function of HAZOP to identify pressure 
deviations which may not have been foreseen. 

The other type of limitation is that which is not intended, 
or desirable, but is simply inherent in the method. HAZOP 
is not, for example, particularly well suited to deal with 
spatial features associated with plant layout and their 
resultant effects. 

8.12.28 Variants of HAZOP studies 

There are a large number of variants on the original HAZOP 
study. Many, perhaps most, companies have adapted the 
technique to their own needs. Many of these adaptations 
extend the method in respect of non-normal operation or of 
other activities such as maintenance, or to take account of 
other concerns such as environmental effects. Another type 
of variant is the application of thebasic technique of HAZOP 
to systems other than process vessels and pipework. Some of 
these aredescribedinSection8.12.29.Inthisregarditshould 
be remembered that HAZOP itself was an application of 
method study, and it may often be better to step back to this 
origin and then forward again from there rather than to try to 
apply HAZOP perse. 

8.12.29 Other applications of HAZOP methodology 

The methodology of HAZOP, or its parent critical examina¬ 
tion, has been applied to a number of other situations, many 
of which are of interest in the process industries. These 
include (1) plant modification, (2) plant commissioning, 
(3) plant maintenance, (4) emergency shut-down and emer¬ 
gency systems, (5) mechanical handling, (6) tanker loading 
and unloading, (7) works traffic, (8) construction and demo¬ 
lition and (9) buildings and building services. 


8.13 Failure Modes, Effects and Criticality Analysis 

Another method of hazard identification is FMEA and its 
extension FMECA. 

Accounts of FMEA and of FMECA are given in the CCPS 
Hazard Evaluation Guidelines (1985/1,1992/9) and by Recht 
(1966b), J.R. Taylor (1973, 1974c, 1975a), Himmelblau 
(1978), Lambert (1978a), A.E. Green (1983), Flothmann and 
Mjaavatten (1986), Moubray (1991), Kavianian, Rao and 
Brown (1992), D. Scott and Crawley (1992) and Goyal (1993). 
A relevant code is BS 5760, which is described below. 


FMEA involves reviewing systems to discover the mode 
of failure, which may occur, and the effects of each failure 
mode. The technique is oriented towards equipment rather 
than process parameters. Table 8.28 shows a set of typical 
results from an FMEA study on a process plant given by 
Recht (1966b). 

8.13.1 BS 5760 

Guidance on FMEA is given in BS 5760 Reliability of Sys¬ 
tems, Equipment and Components, Part 5:1991 Guide to 
Failure Modes, Effects and Criticality Analysis (FMEA and 
FMECA). BS 5760: Part 5: 1991 deals with the purposes, 
principles, procedure and applications of FMEA, with its 
limitations and its relationship to other methods of hazard 
identification, and gives examples. 

FMECA is an enhancement of FMEA in which a criti¬ 
cality analysis is performed. Criticality is a function of the 
severity of the effect and the frequency with which it is 
expected to occur. The criticality analysis involves assign¬ 
ing to each failure mode a frequency and to each failure 
effect a severity. 

The purpose of an FMEA is to identify the failures which 
have undesired effects on system operation. Its objectives 
include: (1) identification of each failure mode, of the 
sequence of events associated with it and of its causes and 
effects; (2) a classification of each failure mode by relevant 
characteristics, including detectability, diagnosability, 
testability, item replaceability, compensating and operat¬ 
ing provisions; and, for FMECA, (3) an assessment of the 
criticality of each failure mode. 

The standard lists the information required for an 
FMEA, under the headings: (1) system structure; (2) system 
initiation, operation, control and maintenance; (3) system 
environment; (4) system modelling; (5) system software; 
(6) system boundary; (7) system functional structure; 
(8) system functional structure representation; (9) block 
diagrams and (10) failure significance and compensating 
provisions. 

Core information on the items studied is the (1) name, 
(2) function, (3) identification, (4) failure modes, (5) failure 
causes, (6) failure effects on system, (7) failure detection 
methods, (8) compensating provisions, (9) severity of 
effects and (10) comments. 

The main documentation used in an FMEA is the func¬ 
tional diagram. Use may also be made of reliability block 
diagrams. 

The identification of the failure modes, causes and 
effects is assisted by the preparation of a list of the expec¬ 
ted failure modes in the light of (1) the use of the system, 

(2) the element involved, (3) the mode of operation, (4) the 
operation specification, (5) the time constraints and (6) the 
environment. 

The failure modes may be described at two levels: gen¬ 
eric failure modes and specific failure modes. The standard 
gives as an example a set of generic failure modes: (1) fail¬ 
ure during operation, (2) failure to operate at a prescribed 
time, (3) failure to cease operation at a prescribed time and 
(4) premature operation. As examples of specific failure 
modes, the standard gives: (1) cracked/fractured, (2) dis¬ 
torted, (3) undersized, and so on. 

The failure causes associated with each mode should be 
identified. BS 5760 gives a checklist of potential failure 
causes under the headings: (1) specification, (2) design, 

(3) manufacture, (4) installation, (5) operation, (6) main¬ 
tenance, (7) environment and (8) uncontrollable forces. 



Table 8.28 Failure modes and effects analysis: result for a process plant (after Recht, 1966b; Himmelblau, 1978) 


Component 

Failure or 

Effects on other 

Effects on whole system 

Hazard Failure frequency 

Detection methods 

Compensating provisions and 



error mode 

system components 


class a 


remarks 

I 





12 3 4 



> 

Pressure relief 

Jammed open 

Increased operation of 

Loss of hot water; 

1 Reasonably 

Observe at pressure- 

Shut off water supply, reseat 

> 

ID 

valve 


temperature sensing 

greater cold water 

probable 

relief valve 

or replace relief valve 

O 



controller, and gas flow, 

input, and greater gas 




o 



due to hot water loss 

consumption 






Jammed 



1 Probable 

Manual testing 

Unless combined with other 

z 


closed 





component failure, this 

— 







failure has no consequence 

I! 

Gas valve 

Jammed open 

Burner continues to 

Water temperature and 

3 Reasonably 

Water at faucet too 

Open hot water faucet to 

> 



operate. Pressure-relief 

pressure increase. 

probable 

hot. Pressure-relief 

relieve pressure. Shut off gas 

H 



valve opens 

Water —> steam 


valve open 

supply. Pressure-relief valve 

O 






(observation) 

compensates 

z 


Jammed 

Burner ceases to 

System fails to produce 

1 Remote 

Observe at output 




closed 

operate 

hot water 


(water temperature 








too low) 



Temperature 

Fails to 

Controller gas valve, 

Water temperature too 

3 Remote 

Observe at output 

Pressure-relief valve 


measuring and 

react to 

burner continue to 

high. Water —> steam 


(faucet) 

compensates. Open hot water 


comparing 

temperature 

functionin’. Pressure- 




faucet to relieve pressure. 


device 

rise above 

relief valve opens 




Shut off gas supply 



preset level 







Temperature 

Fails to react 

Controller, gas valve, 

Water temperature too 

1 Remote 

Observe at output 



measuring and 

to 

burner continue to 

low 


faucets 



comparing 

temperature 

function off 






device 

drop below 
preset level 







Flue 

Blocked 

Incomplete combustion 

Inefficiency. 

4 Remote 

Possibly smell 

No compensation built in. 




at burner 

Production of toxic 


products of 
incomplete 
combustion 

Shut-down system 


Pressure-relief 

Jammed 

Burner continues to 

Increased pressure 

4 Probable 

Manual testing of 

Open hot water faucet. Shut 


valve and gas 

closed 

operate, pressure 

cannot bleed at relief 


relief valve 

off gas supply. 


valve 

Jammed open 

increases 

valve. 

Water —► steam 

Reasonably 

Observe water 

Pressure might be able to 





If pressure cannot back 

probable 

output 

back into cold water supply, 





up cold water inlet, 



providing pressure in supply 





system may rupture 



is not greater than failure 





violently 

Reasonably 

Temperature too 

pressure of system 






probable 

high 




a 1, Negligible effects; 2, marginal effects; 3, critical effects; 4, catastrophic effects. 
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The failure effects involve changes in the operation, 
function or status of the system and these should be iden¬ 
tified by the analysis. Failure effects can be classified as 
local or as end effects. Local effects refer to the con¬ 
sequences at the level of the element under consideration 
and end effects to those at the highest level of the system. 

Where FMEA is to be applied within a hierarchical 
structure, it is preferable to restrict it to two levels only and 
to perform separate analyses at the different levels. The 
failure effects identified at one level may be used as the 
failure modes of the next level up, and so on. 

BS 5760: Part 5:1991 contains in Appendix B a number 
of tables illustrating the results of FMECAs conducted on 
various types of system. They include analysis of a sub¬ 
system of a motor generator set and of the fire protection 
system of an electric locomotive. Taking the latter as being 
most representative of process applications, the table 
is headed by a declaration that the system considered is 
the fire protection system and that its function is to detect 
and extinguish a fire within the locomotive. The columns 
of the table are headed as follows: (1) item, (2) item 
failure mode, (3) failure cause, (4) block function descrip¬ 
tion, (5) functional failure mode, (6) effect on subsystem 
outputs, (7) effect on system reliability, (8) effect on system 
safety, (9) preventive action (design), (10) preventive action 
(quality assurance), (11) comment, (12) severity and (13) 
failure rate. Item failure mode is exemplified by ‘failed to 
open circuit conditions’, and functional failure mode by 
‘detection of false fire’. 

FMEA is an efficient method of analysing elements 
which can cause failure of the whole, or of a large part, of a 
system. It works best where the failure logic is essentially a 
series one. It is much less suitable where complex logic is 
required to describe system failure. 

FMEA is an inductive method. A complementary deduc¬ 
tive method is provided by fault tree analysis, which is the 
more suitable where analysis of complex failure logic is 
required. 

BS 5760: Part 5:1991 states that FMEA can be a labor¬ 
ious and inefficient process unless judiciously applied. The 
uses to which the results are to he put should be defined. 
FMEA should not be included in specifications indis¬ 
criminately. 

8.13.2 Application of FMEA 

The range of applications of FMEA is very wide. At one end 
of the spectrum, A.E. Green (1983) has applied it to a 
pneumatic differential pressure transmitter, whilst at the 
other, Aldwinkle and Slater (1983) have described its 
application to a liquefied natural gas terminal. Table 8.29 
lists some of the FMEA studies given in the literature. 

8.14 Sneak Analysis 

In contrast to general methods such as HAZOP and 
FMECA, there are also niche methods. One of these is 
sneak analysis. Accounts of sneak analysis are given by 
EJ. Hill and Bose (1975), J.R. Taylor (1979, 1992), Rankin 
(1984), Dore (1991), Hahn et at. (1991), Hokstad, Aro and 
Taylor (1991) and Whetton (1993b). 

Sneak analysis originated in sneak circuit analysis (SC A), 
a method of identifying design errors in electronic circuits 
(E.J. Hill and Bose, 1975). The technique was developed 
within a particular company and was slow to spread. An 
earlyuseintheprocessindustrywasintheworkofJ.R.Taylor 


Table 8.29 Failure modes and effects analysis: selected 
studies 


Author(s) 

Subject of study 

Recht (1966b) 

Hot water system 

C.F. King and Rudd 

Heavy water recovery plant 

(1972) 

Eames (1973 

Nuclear instrumentation 

UKAEASRS/GR/ 

12) Lambert 
(1978a) 

Aldwinkle and 

Liquified natural gas terminal 

Slater (1983) 

A.E. Green (1983) 

Pneumatic differential pressure 
transmitter 

Flothmann and 

Refrigerated liquid ammonia 

Mjaavatten (1986) 

storage 

BS 5760: Part 5:1991 

Fire protection system of an 
electric locomotive; subsystem 
of a motor generator set 

Kavianian, Rao and 

Metal organic chemical vapour 

Brown (1992) 

deposition process 


(1979) on sneak path analysis. A lead in encouraging the 
wider use of sneak analysis has been taken by the European 
Space Agency (ESA), as described by Dore (1991). 

A review of sneak analysis is given by Whetton (1993b), 
who gives as a rough definition: A sneak is an undesired 
condition which occurs as a consequence of a design error, 
sometimes, but not necessarily, in conjunction with a 
failure’. 

In sneak analysis generally, four recognized categories 
of sneak have emerged: (1) path, (2) indication, (3) label 
and (4) timing. Whetton refers to the following categories, 
which have developed from process work: (1) flow, (2) indi¬ 
cation, (3) energy, (4) procedure, (5) reaction and (6) label. 

8.14.1 Types of sneak 

The different types of sneak which can occur are discussed 
by Whetton, with examples. 

Sneak flow 

Sneak flow is unintended flow from a source to a target. An 
example is the case where two vessels containing liquids, 
one at higher pressure than the other, are connected to a 
common drain header. If the bottom outlet valves on both 
vessels are open at the same time, liquid can flow from the 
higher to the lower pressure vessel. 

Sneak indication 

A sneak indication is one which is incorrect or ambiguous. 
An example is the power-operated relief valve (PORV) at 
Three Mile Island, where there was displayed an indication 
of ‘Valve position’ which was in fact the signal to, rather 
than the actual position of, the valve. 

Sneak label 

Likewise, a sneak label is one which is incorrect or 
ambiguous. 

Sneak energy 

Sneak energy is the unintended presence or absence of 
energy. An example is the energy release attendant on the 
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restart of agitation in a reactor where the agitator has been 
temporarily switched off. 

Sneak reaction 

Sneak reaction is an unintended reaction. Examples are a 
side reaction in a reactor and an undesired reaction 
between a fluid and a material of construction. 

Sneak procedure or sequence 

A sneak procedure or sequence is the occurrence of events 
in an unintended or conflicting order. 

8.14.2 Sneak analysis methods 

Whetton distinguishes three basic methods of sneak ana¬ 
lysis: (1) topological, (2) path and (3) clue. 

The original sneak analysis method was based on decom¬ 
posing electrical circuits into standard subnetworks. 
According to Whetton, the method has proved difficult to 
adapt to process plants in that successful application 
depends on the ability of the analyst to cast process phe¬ 
nomena in the form of electrical analogues. 

Sneak path analysis, developed byJ.R.Taylor (1979,1992), 
is the investigation of unintended flow between a source and 
a target. It is performed in a systematic manner by decom¬ 
posing the P&ID into functionally independent sections 
and identifying sources and targets, source-target pairs 
and paths between sources and targets. One method of 
doing this is the use of coloured markers to trace the various 
paths, sometimes known as the ‘rainbow’ technique. 

The clue method involves the use of a structured check¬ 
list. It is applicable to all types of sneak and examines each 
type by means of a question set. 

8.14.3 Sneak-augmented HAZOP 

Sneak analysis may be used as an enhancement of HAZOP. 
The techniques used are the path and clue methods. 
Whetton gives a detailed procedure for the conduct of a 
sneak-augmented HAZOP. All drawings used should be ‘as 
built’. Information on labels should cover the as-built con¬ 
dition. Essentially, the sneak analysis aspect of the pro¬ 
cedure involves an examination of the various types of 
sneak against the appropriate clue list. Among the other 
points made are the following: 

Sneak flow 

Examine all paths including utilities and drains, sewers 
and vents 

Examine, in turn, all plant states such as normal operation, 
start-up, shut-down, etc. 

Examine for each valve in turn the effect of unintended 
deviation in valve state. 

Sneak indications 

Examine each instrument 

Examine control room, including humble lamps. 

Sneak labels 

Examine consistency of labels against as-built drawings 
Examine consistency of labels on instruments. 

Sneak procedures 

Examine all procedures, including start-up, shut-down, 
etc., and maintenance. 

Sneak energy 

Examine, in turn, for all plant states, including start-up, 
shut-down, etc., and maintenance. 


8.15 Computer HAZOP 

The HAZOP study method just described was developed 
for plants in which predominantly the control system was 
based on analogue controllers. The advent of computer 
control has created the need for some method, which 
addresses the specific problems of this form of control. 

In recent years, process engineers have increasingly 
chosen to use Programmable Logic Controllers (PLCs), 
DCSs and computers for process control. While these sys¬ 
tems provide flexibility and close control of the process, 
they introduce an additional mode of failure to the plant. 
Modern HAZOP techniques including CHAZOP are used 
to consider such systems. This is quite distinct from 
computer-aiding of HAZOP. 

An early expression of concern was that by Kletz (1982g), 
who highlights the human problem associated with com¬ 
puter control. The HSE has identified this as a topic 
requiring attention. One outcome has been its work on 
programmable electronic systems, leading to the HSE PES 
Guide, which deals with the reliability of the computer 
system itself, but the concern is wider than this, as descri¬ 
bed by P.G. Jones (1991). 

8.15.1 Checklist and guideword methods 

A method for CHAZOP that has the same general approach 
as conventional HAZOP has been described by Andow 
(1991). Like HAZOP, it is intended to be carried out by a 
multi-disciplinary team following a systematic methodol¬ 
ogy and using standard guidewords and questions. 

Andow describes a two-part study format, comprising a 
preliminary study and then the main study. The purpose 
of the preliminary study is to identify critical features early 
in the design. The study covers (1) system architecture, 
(2) safety-related features, (3) system failure and (4) utili¬ 
ties failure. In the full study, attention is directed to 
(1) the computer-system environment, (2) input/output 
signals and (3) complex control schemes. 

Study of the computer system environment involves 
examination of the machine itself and of cabinet, crates, 
etc.; control, input/output cards; communication links; 
operator consoles; power supplies; watchdog timers; and 
other utilities. It uses questions to establish design intent 
and then a question set to investigate failures: 

(1) Does it matter? 

(2) Will the operator know? 

(3) What should he do? 

The input/output signals are studied following rather 
more closely the HAZOP format, with examination of items 
such as the signal using guidewords such as LOW, HIGH, 
INVARIANT, DRIFTING and BAD followed up with the 
failure question set just quoted. Another item examined is 
the actuator. 

Complex control schemes are examined using a list of 
potential weak points and corresponding problems: 

Control tuning Initialization and windup 

Points of operator access Set-points, cascades that may be 
made or broken 

Interaction with other schemes Start-up, normal opera¬ 

tion, shut-down; synchroniza¬ 
tion and timing issues; expected 
or required operator actions 
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The approach described by Burns and Pitblado (1993) 
also follows that of HAZOP; it applies to features, such as 
signal or information, guidewords such as NO, MORE, 
LESS and WRONG. 

8.15.2 Task analysis method 

A quite different approach is that described by Broomfield 
and Chung (Broomfield and Chung, 1994; Chung and 
Broomfield, 1994). The methodology developed by these 
authors is based on an analysis of some 300 incidents in 
two organizations - one a process industry and one an 
avionics company. As an example of a process industry 
incident, they quote the premature start of a control 
sequence due to inadequate specification of the precondi¬ 
tions for initiation. 

The underlying premise of the method is that most 
incidents are the result of deficiencies in the software- 
hardware interface. The authors state that attempts to 
conduct separate analyses of the hardware and the soft¬ 
ware in order to simplify the task, actually complicates it. 

This interface is represented by four concentric func¬ 
tional levels. Each level is associated with certain system 
components. Each component has a defined task. Starting 
at the periphery and working in to the centre, these are as 
follows: 


Functional level 

Component 

Task 

Intervention 

Utility 

Intervention 


Operator 

Intervention 

Input/output 

Sensor 

Input 


Human input 
device 

Input 


Actuator 

Output 


Display 

Output 

Communication 

Communication 

link 

Communication 

Control and 

Computer 

Control and 

processing 


processing 


There is for each task a guideword and question set. Those 
for the intervention task are shown in Table 8.30 


8.16 Human Error Analysis 

An important source of hazards and losses is maloperation 
of the plant, and other forms of operator error. There are a 
number of methods for addressing this problem. One of 
these is the HAZOP study which, as just described, utilizes 
aids such as the sequence diagram to discover potential for 
maloperation. Other methods which may be mentioned 
here are task analysis and action error analysis (AEA). The 
problem of human error is, however, very complex. It is 
considered in more detail in Chapter 14. 

8.16.1 Task analysis 

Task analysis is a technique, which was originally devel¬ 
oped as a training tool. As applied to the process operator, it 
involves breaking down the task of running the plant into 
separate operations carried out according to a plan. The 
objective is to discover potential difficulties, and hence 
errors, in executing the individual operations or the overall 
plan. A detailed account is given in Chapter 14. 

Clearly such task analysis also ranks as a hazard identi¬ 
fication technique. Task analysis has been applied to pro¬ 
cess plants with good results, but is not in widespread use. 


It may also be noted in passing that the writing of operating 
instructions constitutes a less formalized type of task 
analysis, and may likewise serve to identify hazards. 

8.16.2 Action error analysis 

Another technique of identifying operating errors is AEA, 
developed by J.R. Taylor (1979). This is a method of analys¬ 
ing the operating procedures to discover possible errors in 
carrying them out. 

The actions to be carried out on the process interface are 
listed in turn, each action being followed by its effects on 
the plant, so that a sequence is obtained of the form: 

Action - Effect on plant - Action - Effect on plant ... 

The actions are interventions on the plant such as pushing 
buttons, moving valves, etc. 

The errors handled in the method are shown in 
Table 8.31. The effects of possible errors are then 
examined using guidewords for action. The main guide- 
words are: 


TOO EARLY 
TOO LATE 
TOO MUCH 
TOO LITTLE 
TOO LONG 
TOO SHORT 
WRONG DIRECTION 
ON WRONG OBJECT 
WRONG ACTION 

In analysing the effects of an error, an important 
consideration is whether the effect can be observed and 
corrected. 

It is necessary to limit the scope of the analysis. Con¬ 
sideration of actions on wrong objects may be confined to 
those, which are physically or psychologically close to the 
correct object. The number of wrong actions to be con¬ 
sidered has to be kept small. 

Multiple errors are considered only to a limited extent. 
Thus, in a large operating procedure, it would normally be 
practical to take into account only single initial errors, but 
in a few cases it may be possible to use heuristic rules to 
identify double errors, a factor which H is worthwhile to 
explore. For example, one error may result in material being 
left in a vessel, while a second error may result in an acci¬ 
dent arising from this. 

The technique of AEA appears to have been quite widely 
used in Nordic countries, but much less so elsewhere. 

8.17 Scenario Development 

8.17.1 Release scenarios 

The methods just described are concerned with HAZOP 
problems, which occur on most plants. A rather different 
question is the identification of potential sources of major 
release of hazardous materials, which may pose a risk to the 
workforce and/or the plant, and in unfavourable circum¬ 
stances may even affect the public. 

Information on release sources is required for hazard 
assessment and for emergency planning. In order to iden¬ 
tify such sources, it is necessary to carry out a review. 
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Table 8.30 Computer hazop: task considerations and attributes for task ‘intervention’ (Chung and Broomfield, 1994) 

Task Task consideration 

Task attributes 

Questions 

Incidents 

Intervention Specification 

Definition 

Objective 

Options 

Input/outputs 
Timing/control 



Association 

Implementation 

Tasks 

Devices 

Selection 

Installation 

Testing 

Maintenance 

Environment 

Utilities 



Fail safe/protection 

Failure detection 
Interlocks 

Trips 

Recovery procedure 



Failure modes 

Not initialized 

Incorrectly executed 

Not terminated 




Table 8.31 Action error analysis: errors handled 
(J.R. Taylor, 1979) 


Cessation of a procedure 

Excessive delay in carrying out an action or omission of 
an action 

Premature execution of an action — timing error 

Premature execution of an action - preconditions not 
fulfilled 

Execution on wrong object of action 

Single extraneous action 

In making a decision explicitly included in a procedure, 
taking the wrong alternative 

In making an adjustment or an instrument reading, 
making an error outside tolerance limits 


In principle, virtually all elements of the pressure system 
(vessels, pumps, pipework) are points at which a release may 
occur. Table 8.32 gives a list of some of these release sources. 
A more detailed checklist of release sources is given in the 
CCPS QRA Guidelines (1989/5). The identification of release 
sources in a hazard assessment is illustrated by the studies 
given in the Rijnmond Report described in Appendix 8. 

The role of the HAZOP study in identifying such sour¬ 
ces merits mention. A HAZOP study starts from the 
assumption that the plant is basically well designed 
mechanically and concentrates primarily on process para¬ 
meter deviations. The type of release which a HAZOP 
study might identify would be overfilling of a tank as a 
result of maloperation, or brittle fracture of a pipe due to 
contact with cold liquefied gas, but the study is not nor¬ 
mally concerned with mechanical failures which occur 
while the process parameters are within their design 
range. The points on the plant at which a release may occur 
can generally be identified by the release source review. 


Table 8.32 Some sources of release on a plant 

Pipework: 

Pipe rupture 
Pipe flanges 
Valves 
Hoses 

Compressors 
Pumps 
Agitators 
Vessels and tanks: 

Vessel/tank rupture 
Vessel/tank overfilling 
Reactors 
Drain points 
Sample points 
Drains 

Relief devices: 

Pressure relief valves 
Bursting discs 

Flares 

Operational release 
Maintenance release 


What the HAZOP study does is to identify specific credible 
realizations of release from these points. For a potential 
release, it is necessary not only to identify a source but also 
to decide on the nature of the release, which could occur. 
The tendency is to assume that the fluid released is at its 
design conditions. A HAZOP study may reveal that this is 
not so. For example, materials may be released from a 
storage tank as a result of a chemical reaction in the tank, 
which causes the liquid to heat up considerably above its 
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storage temperature, and hence when released to give a 
much larger fraction of vapour. 

8.17.2 Escalation scenarios 

The identification process should not stop at the point 
where a release occurs, but in principle should be continued 
to embrace the consequences of the release and the failures 
and other events, which may allow these consequences to 
escalate. In practice, this aspect is usually treated as part 
of the hazard assessment. Whilst this is a reasonable 
approach, there is a danger that, unless the identification 
of the escalation modes is treated with a thoroughness 
matching that applied to the identification of the release 
modes, features which permit escalation and against 
which measures might be taken will be missed. The identi¬ 
fication of the modes of escalation appears to be a rather 
neglected topic. 

8.18 Consequence Modelling 

For major hazard plants, it is common practice, following 
the development of the scenarios just described, to carry 
out some degree of quantitative modelling of the conse¬ 
quences. Such consequence modelling is described in more 
detail in the next chapter. Here it is sufficient to note its 
effect in giving a much better understanding of the likely 
development of the release and its potential for the identi¬ 
fication both of hazards and of mitigatory measures. 

8.19 Process Safety Review System 

It is convenient at this point to consider under the heading 
of process safety reviews the family of techniques for 
hazard identification, hazard assessment, audit and acci¬ 
dent investigation developed by Wells and co-workers. 

8.19.1 General incident scenario 

The next element is a method of defining incident scenarios, 
which is a necessary part of both hazard assessment 
and accident investigation. An account of this is given by 
Wells (1992) et al. The general incident scenario (GIS) 
described by these authors is a structure intended to be 
applicable to any incident. 

The logic of an incident is also represented by the gen¬ 
eral incident structure shown in Figure 8.15. The GIS 
may be used for hazard identification, PHA or incident 
investigation. 

8.19.2 Preliminary safety analysis 

The GIS provides the basis for a set of techniques for PSA. 
Accounts of PSA are given by Wells, Wardman and Whetton 
(1993) and Wells, Phang and Wardman (1994). The PSA 
methods described are: 

(1) concept safety review (CSR); 

(2) concept hazard analysis (CHA); 

(3) critical examination (CE); 

(4) preliminary consequence analysis (PCA); 

(5) preliminary hazard analysis (PHA). 

These methods are now considered in turn, based on the 
account by Wells, Wardman and Whetton (1993). 

8.19.3 Concept safety review (CSR) 

The CSR is carried out as early as practical, possibly dur¬ 
ing the process development stage. Features of the CSR are 


review of the process and the alternatives, the safety, health 
and environment (SHE) information requirements, any 
previous incidents within the company and elsewhere, 
movement of raw materials and products, and organiza¬ 
tional aspects. 

8.19.4 Concept hazard analysis (CHA) 

The CHA is an examination of the hazards of the process 
and is commenced as soon as the preliminary PFD 
becomes available. A checklist of keywords for a CHA is 
given in Table 8.33. Wells, Wardman and Whetton (1993) 
distinguish between a hazard and a hazardous condition. 
The former is purely qualitative, but the latter has a quan¬ 
titative element. For example, a hazardous material con¬ 
stitutes a hazard. 

The hazardous condition is determined by the quantity of 
the material. The CHA is akin to a coarse hazard study. 

8.19.5 Critical examination (CE) 

The CE of system safety is in large part a critical exami¬ 
nation of the inherent safety of the system, and is therefore 
different from the critical examination involved in con¬ 
ventional H AZOP. The CE examines how the proposal is to 
be achieved and, in particular, (1) the materials, (2) the 
method and (3) the equipment. It also examines any dan¬ 
gerous condition and its cause. A checklist of keywords for 
the CE is shown in Table 8.34. 

8.19.6 Preliminary consequence analysis (PCA) 

The PCA, which may be started when the preliminary PED 
becomes available, is a hazard assessment kept at a fairly 
simple level. The main hazardous events considered are: (1) 
fire; (2) explosion, including missiles and (3) toxic release. 
The analysis covers the effects on the environment as well 
as on humans. 

The analysis seeks to identify worst-case scenarios, to 
establish whether these could have impact outside the site 
and to define the types of emergency which might arise. 
The results from a PCA are illustrated in Table 8.35. 

8.19.7 Preliminary hazard analysis (PHA) 

The PHA is an analysis, which centres on the dangerous 
disturbance entry in the GIS. It involves estimating the 
frequency/probability of certain events and thus, in con¬ 
trast to some other PHAs described in Section 8.10, it is a 
simplified form of conventional hazard analysis. 

The results of a PHA are presented in tabular form, the 
core of which is the events: 

(1) significant event to be prevented; 

(2) failure to recover the situation; 

(3) dangerous disturbance; 

(4) inadequate emergency control or action; 

(5) hazardous disturbances; 

together with expansions at both ends, into causes of the 
set of hazardous disturbances and into escalation of the 
significant event. For each event, an estimate is given of 
the frequency/probability. 

8.19.8 Short-cut risk assessment (SCRAM) 

The SCRAM is essentially an extension of the PHA. It is 
described by Allum and Wells (1993). The SCRAM gen¬ 
erates a set of significant events to be prevented, or top 
events, each of which is described in a risk evaluation 
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Figure 8.15 Process safety review system: general incident structure (Wells et al., 1992) (Courtesy of the 
Institution of Chemical Engineers) 


sheet, which is essentially the tabulation of the PHA as just 
outlined. The risk assessment is developed using: 

(1) target risk; 

(2) severity categories; 

(3) priority categories. 

The target risk (TR) is defined as: 

TRei + S [8.19.1] 

where L is the exponent of likelihood as measured by fre¬ 
quency, and S is the severity category (described below). 

The likelihood L is thus a negative number. If the fre¬ 
quency of the event is 10 -2 , the likelihood has the value —2. 


The severity is the severity category number, which lies in 
the range 1 -5. The authors give guidance on the estimation 
of event frequencies. This includes the adjustments to be 
made where the case under consideration is judged to depart 
from the average condition, as shown in Table 8.36. The 
target risk is taken as acceptable only if it is zero or less. 

The severity categories are shown in Table 8.37. The 
severity category assigned to a given incident scenario is 
based on the highest level indicated by the entries in the 
category. The categories ‘catastrophic’ and ‘severe’ relate 
to very rare events, with a frequency of less than, say, 
10 -5 /year. The severity categories are not to be interpreted 
as implying that an event in a lower category is less serious 
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Table 8.33 Process safety review system: concept hazard analysis - checklist of keywords (Wells, Wardman 
and Whetton, 1993) 


Keywords 

Undesired event 

Consequences /problems 

Flammables 

Ignition 

Fire 

Explosion 

Release on rupture 

Release by discharge 

Entry of vessels 

Handling 

Ignition 

Fire: flash, torch, pool 

Chemical explosion 

Physical explosion 

Vapour cloud explosion 

Electrical explosion 

Chemicals 

Toxicity 

Corrosion 

Release on rupture 

Release by discharge 

Entry of vessels 

Absorption, inhalation, ingestion 
Contamination of environment 

Disposal, incineration, storage, landfill 

Pollutants 

Emissions 

Effluents 

Waste 

Handling 

Fugitive emissions 

Periodic emissions, washings 
Emergency emissions 

Asphyxia 

Acidity, alkalinity, exposure effects 
Separation or accumulation after discharge 

Health hazards 

Human contact with chemicals 
Human contact with heat or cold 

Noise 

Illumination 

Radiation 

Effects of toxicity, biological activity 

Effects of fire, contact with hot bodies, cold 
surfaces 

Effects of exceeding acceptable noise levels 
Effect of glare, mist, fog, contrast, smoke 
Effect of radioactive materials 

External threats 

Accidental impact, vibration 

Act of God, natural causes 

Abnormal environmental extreme 
External interference, loosening 

Drop, fail 

Theft, hooliganism 

Force majeure, sabotage 

External energetic events 

External toxic events 

External contamination 

Corrosion, erosion 

Harm, damage and removal of equipment 
Harm, damage and death of personnel 
Release of material 

Adverse discharge 

Loss of supply 

Loss of services 

Item breaks on impact 

Reactions 

Unintended reactions 

Difficulties with intended reactions 
Presence of dangerous (toxic) 
substances 

Products of combustion 

Corrosion, etc. 

Release of material 

Dangerous disturbances 

Release of reaction energy 

Defective materials 

Thermodynamic hazards 
Overpressure 

Underpressure 

Over-temperature 

Under-temperature 

Overpressure 

Underpressure 

Over-temperature 

Under-temperature 

Overheating 

Overcooling 

Fluid jet effects 

Rupture of equipment 

Impulse blows 

Weakening of materials of construction 
Failure or damage of equipment 

Abnormal opening to 
atmosphere 

Inadequate mechanical integrity 

Corrosion, erosion 

Wrong status of equipment, valves, 
emergency relief, etc. 

Release of material 

Change in planned or emergency discharge 

Mechanical hazards 

Structural hazards 

Collapse, drop 

Overload/stress/tension 

Mechanical energy/inertia 

Mechanical weakness 

Loss of structural integrity 

Rupture of equipment, change in material 
properties 

Failure of equipment or structure, transient 
effects, forces 

Impulse blows, fragility, vibration 

Failure of structure, collapse, object dropped 

Electrical hazards 

Charge, current, magnetism 

High voltage 

Explosion, spark, shock, heat transfer, 
ionization 

Shock to personnel 
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Table 8.33 (continued) 

Keywords 

Undesired event 

Consequences!problems 

Equipment problems 

Dangerous disturbances or 

■ incidentRelease of material 


initiators 

Off-specification material 

Mode of operation 

Any notable disturbances ( 

)r Release of material 

Start-up 

incident initiators 

Common cause failures 

Shut-down 

Loss of supply 

Off-specification material 

Maintenance 

Loss of services 


Abnormal 



Emergency 




Table 8.34 Process safety review system: critical 
examination - checklist of keywords (Wells, Wardman 
and Whetton, 1993) (Courtesy of Butterworth-Heinemann) 


Keyword Examples of use 

Eliminate Eliminate by a completely different method or 
part of a method 

Eliminate certain chemicals, change the route, 
use a lean technology 

Eliminate additives, solvents, heat exchange 
mediums, additives 

Change the equipment or processing method 
Eliminate leakage points; use a weld not a 
bolted fitting, etc. 

Eliminate a prime mover or heat exchange or 
agitator 

Eliminate a separation stage or step 

Eliminate intermediate storage 

Eliminate an installed spare 

Eliminate manual handling 

Eliminate sneak paths, openings to atmosphere 

Eliminate waste 

Eliminate entry into vessels or disconnection 
Eliminate products that are harmful in use 
Eliminate an ignition source, particularly 
permanent flame 

Avoid Avoid extremes of operating conditions 

Avoid operating in a flammable atmosphere 
Avoid possible layering of materials, 
inadequate mixing 

Avoid flashing liquids, particularly in 
extensive heat exchanger networks 
Avoid production of large quantities of 
dangerous intermediates 
Avoid unwanted reactions within and outside 
reactors 

Avoid operating near extremes of materials of 
construction 

Avoid operating conditions leading to rapid 
deterioration of plant 

Avoid maintenance on demand and in short 
time periods 

Avoid items of plant readily toppled by 
explosions 

Avoid stage, step or activity by doing 
something as well as or instead of 

Modify Modify any topics above 

Modify batch operation to continuous 
operation, or vice versa 


Prevent Prevent emissions and exposure by 

totally enclosed processes and 
handling systems 

Prevent exposure by use of remote control 

Increase Increase heat transfer and separation 

efficiency or capacity 
Increase conversion in reactions 


Reduce Reduce inventory; less storage, hold-up, 
smaller size of equipment, less piping 
Reduce amount of energy in system 
Reduce pressure and temperature above 
ambient 

Reduce emissions and exposure by improved 
containment, piped vapour return, covers, 
condensation of return, use of reactive 
liquids, wetting dust 
Reduce frequency of opening, improve 
ventilation, change dilution or mixing 
Reduce size of possible openings to 
atmosphere 

Segregate Segregate by distance, barriers, duration and 
time of day 

Segregate plant items to avoid certain 
common-mode failures 
Segregate fragile items from roads, etc. 

Isolate Isolate plant by shut-down systems, 
emergency isolation valves 

Improve Improve plant integrity, reliability and 
availability 

Improve control or computer control; use user- 
friendly controls 
Improve response 

Improve quality of engineering, construction, 
manufacture and assembly 


than one in a higher category. The categorization is for use 
solely as a practical design tool. 

The priority categories are a function of the likelihood 
values and the severity categories. They are: 

None No action 

A Immediate attention needed 

B Further study probably required 

C Further study may be necessary 
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Table 8.35 Process safety review system: results from a preliminary consequence analysis (Wells, Wardman and 
Whetton, 1993) 

What if undesired event? 

FR/PR 

GA 

Failure to mitigate 

PR L 

S P 

Consequences 

Significant release of material: 
catastrophic failure of 
methanator circuit 

1(T 3 

And 

Countermeasures for a 
release fail: insufficient 
time for response 

1 3 

1 

Release causes hazardous 
condition: cloud of 
flammable material 

Ignition of flammable mixture: 
ignition and torch fire 

0.5 

And 

Countermeasures fail to 
control fire: fire too great 
to be put out immediately 

1 4 

3 B 

Escalation by torch fire 

Escalation by fire: further 
spread of fire to pipe rack 

0.2 

And 

Countermeasures fail to 
control fire: fire brigade 
fails to put out fire 
(no barrier) 

0.5 5 


Escalation by further 
release of material 

Ignition of flammable mixture: 
ignition and pool fire 

1.0 

And 

Countermeasures fail to 
control fire: fire brigade 
fails to put out fire 

0.2 6 

3 C 

Escalation by pool fire, 
generating possible 
explosion with missiles 

Escalation by explosion: 
missiles land on C plant 

0.2 

And 

Countermeasures for a 
release fail 

1 6 

4 C 

Escalation by further release 
of flammable material 
Aromatics washed into 


Note: GA, gate; FR, frequency; L, likelihood; P, priority; PR, probability; S, severity. 


Table 8.36 Process safety review system: short-cut risk 
assessment - adjustments to frequency estimates to allow 
for non-average conditions (Allum and Wells, 1993) 
(Courtesy of the Institution of Chemical Engineers) 


Determine whether the plant conditions represent; 

(a) Average duty or appropriatebaselinefailure rate data 

(b) Excellent case conditions in which the internal 
duty is clean and maintenance performance is 
good on a well-established plant 

(c) Worst-case conditions in which the duty is severe 
or maintenance performance poor or the plant is of 
novel technology or various combinations of 
similar effects 

Adjust the likelihood of failure in average duties as 

follows; 

(a) In the worst case, multiply by 10 

(b) In an average case, multiply by 1 

(c) In an excellent case, multiply by 0.5 

Modify the ineffectiveness probabilities of control and 

mitigation: 

(a) If a protective system is in the failed state, P= 1. 

(b) In the worst case, increase values as follows: 

0.01-► 0.1; 0.1 —♦ 0.5; 0.5 ->0.9 

(c) In an average case, do not adjust probabilities 

(d) In an excellent case, reduce values as follows: 

0.001 (no change); 0.01-0.005; 0.1-0.05; 0.5-0.1 


The prioritization of risk is 


Severity category Value of risk 



-2 

-i 

0 

1 

1 

None 

None 

None 

C 

2 

None 

None 

C 

B 

3 

None 

C/B 

A/B 


4 

C 

B/C 

B 

A 

5 

B 

B/C 

A 

A 


The SCRA provides guidance on priorities to be addres¬ 
sed in the design. It also provides an indication as to whe¬ 
ther more detailed QRA is appropriate. 

8.19.9 Goal-oriented failure analysis (GOFA) 

The GOFA technique is another based on the CIS check¬ 
lists. An account is given by Reeves, Wells and Linken 
(1989). The method is described as a combination of fault 
tree analysis and checklists. The example given by the 
authors is loss of containment, the causes of which are 
traced through the checklist structure. 

8.19.10 Socio-technical systems analysis 

A socio-technical systems analysis is used to examine the 
preconditions for failure. An account is given by Wells, 
Phang and Wardman (1994). These authors describe the 
procedure and give the primary checklist. The main head¬ 
ings of this list are: 

(1) system climate; 

(2) communication and information systems; 

(3) working environment; 

(4) organization and management; 

(5) management control; 

(6) operator performance; 

(7) external systems; 

(8) procedures and practice; 

(9) site and plant facilities; 

(10) equipment integrity. 

They also give the subsidiary checklist for external 
systems. 

8.19.11 Illustrative example: methanator system 

Some of the techniques which constitute the process safety 
review system just described have been illustrated by 
Wells and co-workers using the methanator system shown in 
Figure 8.16. Treatments which include examples involving 
the methanator system are given by Wells et al. (1992), Wells, 
Wardman andWhetton (1993) and Allum and Wells (1993). 
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Table 8.37 Process safety review system: short-cut risk 
assessment - severity categories (Allum and Wells, 1993) 
(Courtesy of the Institution of Chemical Engineers) 


Catastrophic consequences: Seventy 5 
Catastrophic damage and severe clean-up costs 
On-site: loss of normal occupancy > 3 months 
Off-site: loss of normal occupancy > 1 month 
Severe national pressure to shut-down 
Three or more fatalities of plant personnel 
Fatality of member of public or at least five injuries 
Damage to Site of Special Scientific Interest or historic 
building 

Severe permanent or long-term environmental damage in a 
significant area of land 
Acceptable frequency 0.00001 per year 

Severe consequences: Severity 4 
Severe damage and major clean-up 
Major effect on business with loss of occupancy up to 
3 months 

Possible damage to public property 
Single fatality or injuries to more than five plant personnel 
A 1-in-10 chance of a public fatality 
Short-term environmental damage over a significant area 
of land 

Severe media reaction 
Acceptable frequency 0.0001 per year 

Major consequences: Severity 3 
Major damage and minor clean-up 
Minor effect on business but no loss of building occupancy 
Injuries to a maximum of five plant personnel with a l-in-10 
chance of fatality 
Some hospitalization of public 

Short-term environmental damage to water, land, flora or 
fauna 

Considerable media reaction 
Acceptable frequency 0.001 per year 

Appreciable consequences: Severity 2 
Appreciable damage to plant 
No effect on business 

Reportable near miss incident under CIM AH a 
Injury to plant personnel 
Minor annoyance to public 
Acceptable frequency 0.01 per year 

Minor consequences I near miss: Severity 1 

Near-miss incident with significant quantity released 

Minor damage to plant 

No effect on business 

Possible injury to plant personnel 

No effect on public, possible smell 

Acceptable frequency 0.1 per year 

a Control of Industrial Major Accident Hazards Regulations 1984. 


The methanator is a reactor, the feed to which contains 
H 2 97%, oxides of carbon 2% and methane 1%, and in 
which the oxides of carbon are converted to methane in a 
reaction which is exothermic. On occasion, the oxides of 


carbon in the feed can rise to 10-15%. In the examples 
quoted, the two dangerous disturbances explored for the 
reactor are overtemperature and overpressure. 

The results of a concept hazard analysis for the system 
are shown in Table 8.38, those of a critical examination in 
Table 8.39 and those of a PHA in Table 8.40, as given by 
Wells, Wardman and Whetton (1993). The latter leads in to 
the risk evaluation sheet, given by Wells etal. (1992), shown 
in Table 8.41. 


8.20 Choice of Method 

A variety of methods of hazard identification applicable at 
the different stages of the project have been described. An 
overview of these methods is given in Table 8.2. In many 
cases, the aspect of hazard identification covered by a par¬ 
ticular method is self-evident, but in others it is not. Some 
methods are alternatives or are complementary. Table 8.42 
lists some of the principal methods as a guide to selection. 
The table gives the prime purpose(s) of each method. With 
regard to checklists, the applications shown in the table are 
limited, but some of the other methods such as HAZOP 
may also make use of a checklist specific to that method. 

8.21 Filtering and Follow-up 

Although it is convenient for purposes of exposition to 
treat hazard identification and assessment separately, the 
two are often interwoven. A process of filtering of the 
hazards takes place. Two forms of filtering, which occur 
with many of the identification methods described, may, be 
mentioned.The first involves discarding a hazard, which is 
considered to be unrealizable. 

In the second form of filtering, a hazard is discarded if it is 
considered not to be sufficiently important. A measure of the 
need for action on an identified hazard which is widely used, 
albeit often not explicitly, is theproduct of the magnitude and 
frequency of the event. It is this criterion, which underlies 
the method of ranking described in Section 8.19.9. It is also 
used in task analysis as a stopping rule to decide how far to 
carry the process of subdivision of the task. 

Filtering is an important feature of a HAZOP study. 
In such a study, a filtering process occurs whereby the 
hazards identified are assessed on the spot and only a pro¬ 
portion is passed on for further assessment. 

Once a hazard has been identified and accepted, as worth 
further consideration, it is necessary to decide what to do 
about it. Figure 8.17 indicates four principal outcomes of 
the identification process. In many cases, once the problem 
has been identified, the solution is obvious or is known 
from experience. In many others it is taken care of by codes 
of practice. In a small proportion of cases, it may be appro¬ 
priate to carry out a hazard analysis. 

8.22 Safety Review Systems 

Formal systems for the conduct of safety reviews appro¬ 
priate to the stages of the project are now widespread in the 
process industries. These systems go by different names. 

8.22.1 Hazard study systems 

The system used in Mond Division of ICI has been descri¬ 
bed by several authors (N.C. Harris, 1975; S.B. Gibson, 
1976a; Hawksley, 1984) and is shown in Figure 8.18 and 
Table 8.43. The system involves six hazard studies. 






Figure 8.16 Process safety review system: illustrative example - simplified piping and instrument diagram of a methanator system (Wells et at., 1992) 
(Courtesy of the Institution of Chemical Engineers) 
























































Table 8.38 Process safety review system: methanator system - results of a concept hazard analysis (extract) (Wells, Wardman and Whetton, 1993) 


Ref. No 

Keyword 

Dangerous disturbance 

Consequences 

Suggested safeguards 

Comments/action 

1 

Flammables 

Release on rupture 

Release may self-ignite torch fire. 
Escalation to pipe rack likely. 

Missile could affect C plant 

Segregation by distance. 
Depressure or steam purge 

Study best way of reducing 
damage 

2 

Flammables 

Release on emergency discharge 

Release at safe height: possible 
ignition and fire 

Segregation by distance 

Check possible radiation levels 

3 

Flammables 

Normal discharge to sewer 

Chemical explosion in sewer 

Vent sewer with standpipes 

Check other plants for incidents 


Reaction 

Exothermic runaway reaction 
in methanator 

High level of oxides of carbon 
cause runaway with rupture and 
possible physical explosion 

More robust design of absorber. 
Trip methanator on high 
temperature. Alarms on 
temperature and C0 2 high 

Check action if trip fails 

5 

Reaction 

Air in combustion vessels 

Combustion in vessels. Causes 
chemical explosion 

Purge plant before start-up. 
Ensure catalyst covered by 

N 2 as replaced 

Get more information on catalyst 

6 

Reaction 

Inadequate reaction 

Catalyst failure 

Low temperature feed 
Methanator bypassed 

Off-specification H 2 to 
downstream plant. This can 

chemical explosion 

Alarm on high C0 2 outlet. Vent 
if off-specification and shut¬ 
down compressor. Ensure 
methanator warm enough to 
start-up. Connect methanator 
trip to compressor trip 

Design heat exchanger 
circuit to preheat 
methanator 

7 

Pollutants 

Effluent to sewer 

Water with high sodium salts 

Sewer to effluent treatment 

Check effect on current treatment 

8 

Pollutants 

Effluent caused by firewater 

Fire-water will flood. River 


Check other sewers in area 

9 

Pollutants 

Noise 

Noise in compressor area 

Building would cause 
explosion hazard 

Operators to wear 

protection in danger area 

10 

11 

Overpressure 

Overtemperature 

Overpressure in hydrogen plant 

Overtemperature in methanator 

High pressure caused by 
inadequate release of excess 
gas to fuel gas or blockage 
or incorrect valve status 
causes explosion 

Runaway reaction (see above) 

Two relief valves in circuit. 

High pressure alarm 

Flare may be needed on fuel 
gas if demand low 

12 

Overtemperature 

Overtemperature in compressor 

Excess recycle of hydrogen 
around compressor can result 
in physical explosion 

High temperature alarm 
on loop 

Evaluate as no safeguard 
provided 

13 

Mechanical 
hazard: overload 

Overload of compressor 

Stress in compressor caused by 
two phase feed due to liquid 
blowby from KO Pot can result in 
physical explosion 

Trip on high level in KO Pot. 

Level alarm in KO Pot 

Explosion unlikely but note 
compressor may be 
damaged 

14 

Abnormal opening 

Vibration at compressor 

Loosening of flange gives 
release. Possible torch fire 

Vibration probe 


15 

Abnormal opening 

Spurious relief 

Loss of material to safe point. 

Could ignite as minor torch fire 


Consider need for lock open 
valve after RVs or bursting 
disc before RVs 
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Table 8.39 Process safety review system: methanator system - results of a critical examination (Wells, Wardman and 
Whetton, 1993) 

DESIGN INTENT: A fixed-bed catalytic reactor, operating at 20 bar, 400°C inlet, 450°C outlet, converts the small amounts 
of oxides of carbon (maximum 2 %) in a stream of hydrogen into a hydrogen product stream containing 10 ppm maximum 
of oxides of carbon 

Query proposal 

Response 

Generate alternatives 

Comments 

Recommendations 

Why remove 
oxides of 
carbon? 

Oxides of carbon affect 
downstream catalyst 
on aromatics plant 

Eliminate methanator 
here and install on 
aromatics plant only 

No real saving on risk 
overall 

Reject or change 
downstream catalyst 

Why this 
process? 

No addition of further 
materials 

Alter by using 
pressure-swing 
adsorption system 
upstream 

Lower yield of hydrogen Review for plant 
but cheaper plant after next 

Why at 400°C? 

Optimized design for 
this catalyst 

Alter the catalyst or 
use a larger size of bed 

No safety advantage 

Rejec, 

Dangerous 

condition 

Cause 

Modification!control 

Comments 

Recommendations 

Reactor runaway Failure of absorption 
due to excess system 

oxides of 
carbon in feed 
leading to 
reactor 

Increase capacity of 
absorption unit using 
an absorption train 

Isolate the methanator by 
shut-down system 

Expensive but robust 
solution 

Requires the diversion 
of upstream flow 
from methanator by 
shut-down system 

Evaluate using 
quantitative risk 
analysis 

Install bypass and 
vent off-specification 
material 

Catastrophic 
failure of 

Overtemperature due 
to reactor runaway 

Improve metallurgy of 
reactor to withstand 

Long-term effort 
required 

Review later 

circuit 


during upset condition 
Increasing cooling of 
reactor by external 
quench 

Weakness in circuit may Consider under 
well not be the reactor preliminary hazard 

analysis 


Hazard Study I is the first formal study, carried out at the 
proj ect exploration stage. Its purpose is to ensure that there 
is full understanding of the materials involved in the pro¬ 
cess and their potential interactions, and also the con¬ 
straints on the project due to the particular site, not only in 
terms of safety but also in terms of environmental factors, 
including pollution and noise. This type of study was 
referred to above as a ‘coarse hazard study’. 

Hazard Study II is performed using the PFDs. Each sec¬ 
tion such as reaction, distillation, etc., is studied in turn 
and potential hazardous events such as fire, explosion, etc., 
are identified. At this stage it is often possible to eliminate 
such a hazard by means of design changes or to protect 
against it by the use of protective systems. In some instan¬ 
ces, it may be necessary to study an event further. In this 
case, use may be made of fault tree analysis, with the 
hazardous event as the top event in the tree. 

Hazard Study III is the H AZOP study, which has already 
been described. 

Hazard Study IV involves a review of the actions gener¬ 
ated in Hazard Studies I—III by the plant or commissioning 
manager, who also ensures that operating procedures, safe 
systems of work and emergency procedures are available. 


Hazard Study V is the plant inspection carried out to 
ensure that the plant complies with the legal requirements 
on such matters as access and escape, guarding, emergency 
equipment, etc. 

Hazard Study VI is undertaken during the commissioning 
and early operation of the plant and involves a review of 
changes made to the plant and its operating procedures, and 
ofanydifferencesbetweendesignintentandactualoperation. 

Once in operation, the plant is subject to further audits, 
but these fall outside the system as described. 

8.22.2 Project safety review system 

Abroadly similar system is the project safety review system 
operated by BP. The reviews conducted in this system are: 

(1) pre-project review; 

(2) design proposal review; 

(3) detailed design review; 

(4) construction review; 

(5) pre-commissioning review; 

(6) post-commissioning review. 

The two sets of safety review systems described above 
typify those in use. 










Table 8.40 


' safety review system: methanator system - preliminary hazard analysis (Wells, Wardman and Whetton, 1993) 


PROJECT: TOMHID REFERENCE: GLW Priority 

PLANT: HYDROGEN LOCATION: SHEFFIELD - x 

UNIT: METHANATOR SECTION EQUIPMENT: METHANATOR/PREHEAT c > 


FUNCTION: Fixed bed reactor converting oxides of carbon to hydrogen 


S L 


S L 


Consequences of escalation 
Failure to prevent further escalation 

Consequences of significant event 
Failure to mitigate or avoid escalation 


Fire escalates to pipe rack and C plant 
Failure to avoid domino due to lack of time and 
ineffective firefighting 
Torch fire on section of plant 
Failure to avoid ignition: self-ignites as hot 
and release not attenuated in 15 min 


Significant event to be prevented Release through overtemperature E-4 

Failure to recover the situation Operator fails to stop all plant flows * 


Plant in danger: dangerous disturbance 
Inadequate emergency control or action 

Hazardous disturbance 
Inadequate control or action 
Immediate causes 

Hazardous disturbance 
Inadequate control or action 


Immediate causes 

Hazardous disturbance 
Inadequate control or action 

Immediate causes 


Overtemperature in reactor 

Failure of operator to stop flow to methanator 

Failure of shut-down system 

High temperature in reactor 

Operator fails to reduce trend onTAH 

High inlet temperature (slow propagation) 

Operator fails to reduce trend on C0 2 alarm 
orTAH 

High C0 2 in stream from absorber 

Operator fails to reduce trend on C0 2 alarm 
orTAH or PAH 

Impurities in feed: sneak path down 
start-up line 


0.1 


0.2 
0.1 
E—1 

0.8 

E—1 

0.1 
E—2 


Release through overpressure E-5 

Operator action to depressure 0.1 

Overpressure in reactor E—4 

Pressure relief system fails 0.01 

High pressure in section E—2 

0.01 

Downstream blockage E—4 

(clean duty) 

PRC closed 

Fuel gas overpressure 0.01 

Lack of demand for product E-0 

PRC closed 0.01 

Fuel gas overpressure 0.01 

Off-specification product E-0 


Recommendations/comments/actions: 

1. Public not affected by domino escalation. 

2. Business damage would be extensive if spread to 
complex. 

*The operator can increase the probability of a 
release by wrong action and special supervision 
is required on any methanator problem. 


1. Do not depressurize on high temperature unless sure of 
no flow through methanator. 

2. Operator alert by several alarms. NewTAH in 
and out. 

3. Check if start-up line needed if heat exchange circuit 
modified. 

4. Alter outlet location of start-up line. Add PAH and TR. 
Double block and bleed. 

5. Check catalyst activation. 

6. Improve absorber design to enhance reliability. 


1. Operator also alerted by PAH. 

2. Two relief valves in system and hydrogen is 
exceptionally free-flowing. 

3. Add RV-1 and depressuring valve: locate before 
methanator. 
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Table 8.41 Process safety review system: methanator system - risk evaluation sheet (Wells et a!., 1992) (Courtesy of 

the Institution of Chemical Engineers) 





PSA: RISK EVALUATION SHEET 

DATE: 11.7.92 

PAGE: D1 of 2 




PROJECT: TOMHID 

REFERENCE: GLW 


PRIORITY 


PLANT: HYDROGEN 

LOCATION: SHEFFIELD 




UNIT: METHANATOR SECTION 

EQUIPMENT: METHANATOR/PREHEAT 


C 


FUNCTION: Fixed bed reactor converting oxides of carbon to hydrogen 


S L S L 


CONSEQUENCES OF ESCALATION 

Fire escalates to pipe rack and C plant 


4 E—6 a 4 7 


FAILURE TO PREVENT FURTHER 

Failure to avoid domino due to lack of time 


0.01 0.01 


ESCALATION 

and ineffective firefighting 




CONSEQUENCES OF SIGNIFICANT 

Torch fire on section of plant 


3 E-4 3 E-E 


EVENT 





FAILURE TO MITIGATE OR AVOID 

Failure to avoid ignition: self-ignites as 


3 1 


ESCALATION 

hot AND release not attenuated in 15 min 




SIGNIFICANT EVENT TO BE 

Release through overtemperature 

E—4 

Release through 

E—5 

PREVENTED 



overpressure 


FAILURE TO RECOVER THE 

Operator fails to stop all plant flows 

* 

Operator action to 

0.1 

SITUATION 



depressure fails 


PLANT IN DANGER: 

Overtemperature in reactor 

E-3 

Overpressure in 

E-4 

DANGEROUS DISTURBANCE 



reactor 


INADEQUATE EMERGENCY CONTROL 

Failure of operator to stop flow to 

0.1 

Pressure relief 

0.01 

OR ACTION 

Methanator 

Failure of shut-down system 

0.2 

system fails 


HAZARDOUS DISTURBANCE 

High temperature in reactor 

0.1 

High pressure in section 

E-2 

INADEQUATE CONTROL OR ACTION 

Operator fails to reduce trend onTAH 

1 



IMMEDIATE CAUSES 

High inlet temperature 

E—1 

Downstream blockage 

E-4 




(clean duty) 


HAZARDOUS DISTURBANCE 

INADEQUATE CONTROL OR 

Operator fails to reduce trend on C0 2 

0.8 

PRC closed 

0.01 

ACTION 

alarm orTAH 


Fuel gas overpressure 

0.01 

IMMEDIATE CAUSES 

High C0 2 in stream from absorber 

E—1 

Lack of demand for 

E—0 



product 


HAZARDOUS DISTURBANCE 

INADEQUATE CONTROL OR ACTION 

Operator fails to reduce trend on 

0.1 

PRC closed 

0.01 


C0 2 alarm orTAH or PAH 


Fuel gas overpressure 

0.01 

IMMEDIATE CAUSES 

Impurities in feed: sneak path 
down start-up line 

E—2 

Offspec product 

E—0 

RECOMMENDATIONS/COMMENTS/ 

1. Do not depressurize on high temperature 


1. Operator also alerted 


ACTIONS: 

unless sure of no flow through Methanator 


by PAH. 


1. Public not affected by domino 

2. Operator alert by several alarms. 


2. Two relief valves in 


escalation. 

NewTAHin and out 


system and hydrogen 
is exceptionally free- 
flowing 


2. Business damage would be extensive 

3. Check if start-up line needed if heat exchange 

3. Add RV-1 and 


if spread to complex 

circuit modified. 


depressuring 



4. Alter outlet location of start-up kne. Add PAH 


valve : locatebefore 



and TR. Double block and bleed 


Methanator 


*The operator can increase the probability 

5. Check catalyst activation 




of a release by wrong action and special 

6. Improve absorber design to enhance reliability 



supervision is is required on any 

Methanator problem 



E—2 = 10“ 2 



a E-n = l<r”. 











Table 8.42 Application of some techniques for hazard identification s 


Purpose 


Checklist Safety Scenario Hazard Hazard Coarse Hazop 

review development* indices ranking hazard 

methods studf 


Failure Human Fault Event Consequence 


modes, error tree tree modelling 

effects and analysis' 1 analysis analysis 



Hazard 

analysis 


Identification of. 

Deviations from good practice Y Y 

Hazards Y Y Y 

Hazards liable to threaten project Y 

viability 

Hazards with potential for large 
property damage loss 
Hazards requiring priority 

Worst-case accidents Y 

Initiating events 
Pre-release accident path 
Measures to reduce probability of 
enabling condition, frequency of 
initiating event 

Post-release escalation paths and 
outcomes 

Measures to reduce frequency of 
consequences 

Measures to mitigate effects of 
consequences 



Y Y 

Y Y 

Y Y 


Y 

Y Y 
Y 


a The table is oriented towards hazard identification techniques for loss of containment events. It does not include hazard identification techniques the purpose of which is obvious, such as reaction 
screening or commissioning inspections. 
b Also techniques such as ‘What if ?’ method. 
c Also techniques such as preliminary problems analysis (PPA). 
d Also techniques such as action error analysis (AEA). 

e Also techniques such as common mode failure analysis and cause- consequence analysis (CCA). 
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Methods of Methods of 

identifying hazards assessing hazards 



analysis 

(hazan) 


Figure 8.17 Process of hazard identification and assessment (Klet, 1983d) (Courtesy of the Institution of Chemical 
Engineers) 
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Design and 
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c 
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Figure 8.18 System of hazard studies (after S.B. Gibson, 1976a; lllidge and Wolstenholme, 1979) (Reproduced by 
permission of the Institution of Chemical Engineers) 


8.23 Hazard Ranking Methods 

There are available a number of hazard ranking methods 
for assigning priorities among hazards. Accounts include 
those of Gillett (1985), Ashmore and Sharma (1988), Rooney, 
Turner and Arendt (1988), Casada, Kirkman and Paula 
(1990), Eraser, Bussey andjohnston (1990) and Keey (1991). 

8.23.1 Rapid ranking 

Typical of these methods is that of rapid ranking described 
by Gillett (1985). The basis of the method is a trade-off 
between the consequence and the frequency of the event 
considered. The more serious the consequence, the lower 
the frequency, which is tolerable for the event. In principle, 
therefore, the criterion for action may be taken, as a first 
approximation, as some threshold level of the product of 
consequence and frequency. 

The rapid ranking method actually utilizes a mixture of 
quantitative and qualitative measures. The cost of damage 
to the plant and the frequency of occurrence are expressed 
quantitatively and the other consequences qualitatively. 

In the method, five hazard categories are defined. 
Table 8.44 defines the hazard categories in terms of the con¬ 
sequences. In determining the features of a particular 
hazard for comparison with the entries in the table, it is 
intended that the damage costs be estimated and that the 


other entries be obtained from expert judgement. The table 
also gives both relative guide frequencies and typical 
absolute frequencies for each hazard category. 

For a particular hazard, a hazard category is obtained on 
the basis of the consequences. If different consequences yield 
different hazard categories, judgement must be exercised. 
The estimated frequencies derived from historical data are 
then compared with the absolute guide frequencies given in 
Table 8.44 and a hazard ranking obtained usingTable 8.45. 

Examples of the technique are given by Mumford and 
Lihou (1984 LPB 59). As an illustrative example, consider the 
hazard of fire in a pipe trench. In a particular application, it 
is estimated that a pipe trench fire will cause on average 
£10,000, damage and the following estimates are made of the 
frequency of the two hazards - (1) a fire without operator 
fatality and (2) a fire with a chance of an operator fatality: 

Frequency of pipe trench fires without operator 
fatality = 0.5/year 

Frequency of pipe trench fires with 1 in 10 chance of 
operator fatality = 1.5 x 10 -2 /year 

Hazard 1, with an estimated damage cost of £10,000, is 
given by Table 8.44 as hazard category 2 and therefore has 
guide frequency of 10 _1 /year. The expected frequency is 
5 x 10 _1 /yearandthusexceedstheguidevaluebyafactorof5. 
















8/70 HAZARD IDENTIFICATION 


Table 8.43 Rapid ranking of hazards: hazard categories (Gillet, 1985) (Courtesy of Process Engineering) 

Area at risk 

Description 



Hazard category 



1 

2 

3 

4 

5 

Plant 

Damage 

Minor 

<£2000 

Appreciable 

<£20,000 

Major 

<£200,000 

Severe 

<£2m 

Total destruction 
>£2m 


Effect on 
personnel 

Minor 

injuries 

Injuries 

1 in 10 
chance of a 
fatality 

Fatality 

Multiple 

fatalities 

Works 

Damage 



Minor 

Appreciable 

Severe 

Business 

Business 

None 

None 

Minor 

Severe 

Total loss 
of business 

Public 

Damage 




Appreciable 

Severe 


Effects on 
people 

(smells) 

Minor 

hospitalization 

1 in 10 change 
of public 
fatality 

Fatality 


Reaction 

N °mild 

Minor 

local outcry 

Considerable 

national press 
reaction 

Severe local 
and considerable 
national press 
reaction 

Severe national 
(pressure to 
stop business) 

Relative guide 
frequency of occurrence 

- 

1 

10" 1 

10" 2 

hr 3 

10" 4 

Typical 3 judgmental 
values for a 

plant/small works (years) 

- 

1 

1/10 

1/100 

1/1000 

1/10 4 


3 These typical comparative figures are given for illustration and should not be taken as applicable to all situations or taken to indicate absolute 
levels of acceptability. 


From Table 8.45, the hazard ranking is A. Hazard 2, with 
the same damage cost but a 1 in 10 chance of fatality, is 
hazard category 3 and therefore has a guide frequency of 
10 -z /year. The estimated frequency is 1.5 x 10 _1 /year and 
thus exceeds the guide value by a factor of 1.5. The hazard 
ranking is again A, but only just. Action is indicated in 
both cases. 

8.24 Hazard Warning Analysis 

In some cases, analyses are carried out to identify the les¬ 
ser events, which may serve as precursors to, or warnings 
of, more serious events. Such analyses clearly rank as 
hazard identification techniques. One such method is the 
technique of hazard warning analysis described by Lees 
(1982b). Like fault tree analysis, on which it is based, this 
technique may be used to obtain quantitative results. It is 
therefore described in the next chapter. 

8.25 Plant Safety Audits 

The conduct of some form of plant safety review is a normal 
part of plant commissioning. Traditionally this is a joint 
inspection by the plant manager and the plant safety off icer 
and is concerned mainly with checking that the company 
complies with the legal and company safety requirements. 
Attention is directed to features such as: access and means 
of escape; walkways, stairs and floors; and firefighting and 
protective equipment. 


There has developed from this, however, the more 
comprehensive plant safety audit. There is no uniform 
system for such audits. The BCISC publications Safe and 
Sound (1969/9) and Safety Audits (1973/12) give informa¬ 
tion on several systems. D. Williams (1971) gives a detailed 
des-cription of one system, including a comparison of one 
of the audits from Safe and Sound with a later audit by 
the same company, which illustrates the evolution of the 
method. 

The general approach is on the following lines. The plant 
safety audit is conducted by a small, interdisciplinary team 
which is not connected with the plant. The members may 
come from the same works or from other works. The team 
may be led by a quite senior manager. The audit is carried 
out first during the plant commissioning, but is also repe¬ 
ated later at intervals. Typical intervals are a year after 
initial start-up and every 5 years thereafter. 

The topics covered by the audit are illustrated by the 
checklists given in Tables 8.46 and 8.47. The former gives 
topics listed in Safety Audits. The latter is a checklist for 
both audits and surveys given by Williams. As already 
emphasized, it is essential that management act on any 
audit made. 

8.26 Other Methods 

8.26.1 Feedback from workforce 

It is the responsibility of the management to create systems 
and attitudes which lead to the effective identification of 
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Table 8.44 Rapid ranking of hazards: hazard ranking (Gillett, 1985) (Courtesy of Process Engineering) 


Hazard category Expected frequency compared with guide frequency 



Smaller (—) 

Same ( ) 

Greater (-\-) 

Uncertain (U) 

1 

D 

D 

D/C at team’s discretion 

D/C at team’s discretion 

2 

D 

Normally C, but if upper 
end of frequency/ 
potential raised to B at 
team’s discretion 

Equally damaging hazard 
as those below, A, 
but if lower 

end of frequency/potential 
could be lowered to B at 
team’s discretion 

B Frequency estimate 
should not be difficult 
at this category; may 
be a lack of fundamental 
knowledge which 
requires research 

3 

C 

B 

A Major hazard 

A/B at team’s discretion. 
Such potential should be 
better understood 

4 & 5 

B/C at team’s 
discretion 

B, but can be raised to 

A at team’s discretion 

A Major hazard 

A Such potential should 
be better understood 


Table 8.45 Checklist for a plant safety audit (after British Chemical Industry Safety Council, 1973/12) 


(1) Statutory requirements in the area under consideration 

(2) Methods of process operation. Hazards of the materials involved and of the technology in use 

(3) Material handling 

(4) Tools, machinery, maintenance equipment 

(5) Permit-to-work system, schedules for regular inspection of emergency equipment 

(6) Personal protective equipment, its condition, care and suitability 

(7) Plant tidiness, condition of floors, stairs, walkways, cleanliness of toilets and washing facilities, environmental 
factors, waste disposal 

(8) Fire prevention and protection, alarm systems, emergency exits, flammable material storage 

(9) Unsafe practices 

(10) Arrangements for treating injuries, condition of safety showers, eye- and hand-wash cabinets, resuscitation 
equipment 

(11) Involvement of employees in safety activities, their knowledge of the safety organization, attitudes, condition of 
displays and notices 


Also 

Electrostatic hazards 

Alarms and trip systems and testing 

Pressure vessels and relief valve inspections 

Cable protection 

Radiation hazards 

Operation and maintenance of internal and external transport 

Occupational health and hygiene standards 

Electrical equipment maintenance 

Major emergency arrangements 

New projects and processes 

Adherence to codes of practice (of internal or external origin) 

Equipment faults 
Labelling of products 

Adherence to approved work and operational procedures 

Training procedures/programmes and their effectiveness 

Adequacy of safety procedures in office, administrative and ancillary buildings 

Methods of communication and their success 

Receipt, storage and transportation of chemicals and other materials 

Extensions/alterations to existing production and storage facilities 

Pollution/environmental control methods 

Liaison with outside contractors 

Safety standards in research, development and laboratory work 
Consideration of safety and loss prevention at the design stage 
Security arrangements covering the storage and issue of harmful substances 
Safety advisory service to customers, covering products, their handling and use 
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Table 8.46 Checklist for a plant safety audit or survey (D. Williams, 1971) (Courtesy of the Institution of Chemical 
Engineers) 


Buildings and surroundings : 

(1) Are emergency exits adequate and accessible? 

(2) Is lighting adequate for operations, walking, material handling? 

(3) Is firefighting equipment adequate and accessible? 

(4) Are aisles large enough? Marked? Clear? 

(5) Is floor free of tripping or slipping hazards? 

(6) Are floor loads within safe working loads? Are safe loading limits posted where necessary? 

(7) Is general ventilation sufficient? 

(8) Are stairs and platforms free of tripping hazards? Equipped with necessary guard rails? 

(9) Are there any openings in fire walls? Are fire doors operable? 

(10) Are hazardous areas provided with adequate explosion venting? 

(11) Does building electrical service appear adequate? Does visual inspection reveal any maintenance problems? 

(12) Is building trim (window sash, doors, rain gutters, fire escapes, etc.) in safe condition? 

(13) Are lifts regularly inspected and adequately maintained between inspections? Are safe lifts loads posted? 
Adhered to? 

(14) Are building approaches (outside steps, platforms, paths, etc.) in a safe condition? 

(15) Are safety signs adequate and in good condition? 

Equipment 

(1) Are danger points adequately guarded? Rotating parts? Pinch or nip points? Belts? Cutting edges? Hot surfaces? 
Open flames? 

(2) Are operating controls positioned for safe use? 

(3) Is there room for the operator to work safely? 

(4) Are valves, switches, instruments, and other operating controls clearly identified? Are pilot lights working? 

(5) Are safety alarms properly identified and tested regularly? 

(6) Do automatic controls fail safe? (Can a hazardous condition be created by the failure of automatic controls?) 

(7) Do wiring and piping appear to be in good condition and adequate for intended use? 

(8) Is equipment rated and inspected for the service in which it is used? (Area engineers to provide list of pressure 
equipment rating.) 

(9) If process presents corrosion problems, is equipment inspected regularly to anticipate and prevent failure in service? 

(10) Are pressure relief devices adequately sized and accessible for inspection? 

(11) Are overflow lines and breather vents adequate and clear? Equipped with flame arresters, liquid seals where 
needed? Do overflows and vents discharge at a safe location? 

(12) Does equipment conform to grounding policy? Are grounds tested regularly? (Area supervisor to specify frequency 
of test.) 

(13) Are drop lights and extension cords in good condition? Meet electrical standards? 

(14) Are hand tools, portable tools and ladders inspected regularly? Are they proper for the intended use? In good 
condition? 

(15) Can equipment be made safe for routine maintenance work? Electric lockouts? Lines blanked? Sufficient safe 
working area for mechanics? Adequate room and facilities for rescue? 

Process: 

(1) Is process safe under normal conditions? 

(a) Are toxic vapours normally present? Are safeguards adequate? 

(b) Are flammable vapours normally present? Are vapours confined? Are sources of ignition controlled? 

(c) Are operators or other employees normally exposed to toxic, corrosive or hot liquids? Is protective equipment 
properly stored, maintained and used? Are special physical examinations of employees conducted as 
recommended by the medical department? 

(d) Are sampling procedures safe? 

(e) Are safe storage conditions provided for hazardous raw materials and intermediates? 

(2) Are abnormal conditions provided for? 

(a) Loss of utilities: Electricity - agitation, circulation, controls and instruments, light. Steam - heating, vacuum, 
pumps, steam snuffers. Air - instruments, pumps.Water - cooling, quenching. Gas - inert and illuminating. 

(b) Mechanical failures. 

(c) Operator errors - what can happen? 

(d) Are emergency venting facilities adequate? Inspected? 

(e) What sources of ignition may develop in this process? Are they guarded against? 

(f) Can a fire be controlled in this process? 

(g) Are operators or other employees unnecessarily exposed to serious injury in event of probable fire, explosion, 
large spills or mechanical failures? 
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Table 8.46 (continued) 

(h) Are operators protected from probable leaks of steam, toxic or corrosive chemicals? 

(i) Is quantity of exposed flammable or toxic liquids in populated areas kept to an absolute minimum consistent with 
production requirements? 

(j) Is process subject to abnormal reactions? 

ARE THERE ANY HAZARDS, WHICH WE HAVE NOT GUARDED AGAINST AND FROM WHICH OUR ONLY 
PROTECTION IS THE LAW OF CHANCE? 

Operating instructions'. 

(1) Are operating instructions available in a written, legible, easily identified form? 

(2) Are they up to date? 

(3) Is there a procedure for keeping them up to date? 

(4) Are they reviewed regularly with each employee? 

(5) Are they accessible to operators for reference? 

(6) Do the operating instructions spell out hazards of job and how to avoid them? 

(7) Do operating instructions provide definite procedures for emergency situations where required? 

(8) Is operator’s performance checked regularly by supervision? 

(9) Is there an effective system for notifying operators of non-standard conditions? 

(10) Are operators permitted to take unauthorized short cuts in operations without reprimand? 

(11) Are operators working in isolated locations checked regularly by supervision or the guard force? 

(12) Do department supervisors know immediate first aid treatment required for exposure to toxic chemicals used in 
their departments? 


Table 8.47 System of hazard studies (after N.C. Harris, 1975; S.B. Gibson, 1976a; Hawksley, 1984) 


Study 

Project phase 


I 

Exploratory 

Carried out at inception of project. Review of hazards of materials and 
process, of effluent and environmental problems and of site 

II 

Definition, preliminary 
design 

Completed before sanction is sought. Examination of process 
flowsheets and assessment of ability of design to meet specifications 

III 

Detailed design 

Takes place about time plant is sanctioned. Critical examination of 
hazards and operability of plant using Piping and instrument 
diagram, operating instructions, maintenance procedures, etc. 

IV 

Construction 

Takes place during later stages of construction and early stages of 
commissioning. Review to ensure provisions of previous studies 
have been implemented 

V 

Commissioning 

Carried out before initial start-up. Inspection to ensure safety 
systems are installed and operate as intended 

VI 

Operation 

Carried out within a year of handover to operating team. Review of 
plant modifications, operating instructions, documentation 


hazards, but it is the responsibility of everyone involved in 
the design and operation of the process to play his role in 
identifying and reporting any hazard of which he becomes 
aware. 

This aspect has already been considered in the context 
of total loss control in Chapter 1 and of the safety system 
in Chapter 6, and is discussed again in Chapters 11 and 28. 


8.26.2 Process design checks 

There is an enormous amount of experience on the hazards 
associated with unit processes, unit operations, plant 
equipment, pressure systems, instrumentation, etc., and it 
is essential that this be utilized. It is not enough, therefore, 
to rely only on generalized methods of hazard identifica¬ 
tion. Full use needs to be made of what is already known. 
This may be done by methods such as the use of checklists 


for such processes, operations, etc. This aspect is discussed 
in more detail in Chapter 11. 


8.26.3 Plant equipment checks 

There are numerous types of check which are carried out on 
the plant equipment at various stages in the project. There 
are checks done before and during plant commissioning, 
including testing in manufacturers’ works, checking the 
correct installation of the equipment, testing in situ, etc. 
There is a whole range of inspection and examination 
techniques, including non-destructive testing and condi¬ 
tion monitoring, which are applied both during commis¬ 
sioning and in operation. Many items are checked or tested 
on a scheduled basis. While the results of some tests are 
unambiguous, others require careful interpretation and the 
application of sophisticated inspection standards. 
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8.26.4 Emergency planning 

If a works contains hazardous plant, it is essential to plan 
for possible emergency situations. The first step in emer¬ 
gency planning is identification of those hazards, which 
are sufficiently serious to warrant such planning. Such a 
study is not necessarily an exercise separate from the other 
hazard identification procedures, but it does emphasize 
particular aspects, especially the development and scale of 
the emergency, the effects inside and outside the works 
boundary, the parties involved in dealing with the situa¬ 
tion, etc. Emergency planning is treated in Chapter 24. 

8.27 Quality Assurance 

The quality of the hazard identification system should be 
assured by a suitable system of quality assurance. 
Normally this will be part of an accredited system covering 
the quality assurance of all aspects of company opera¬ 
tion. Principles of quality assurance are discussed in 
Chapters 1 and 6 are therefore not repeated here, but it is 
appropriate to consider some aspects which apply to hazard 
identification. 

There should be a formal system for hazard identifica¬ 
tion. For each stage of a project, a set of hazard identifica¬ 
tion techniques should be selected. The system should then 
ensure that these techniques are used. 

Quality assurance may be based on inputs and process 
and/or outputs. It is generally prudent to utilize both. 
Inputs and process for hazard identification include: the 
qualifications, training, experience and plant knowledge 
of the team performing the task; the methods of hazard 
identification used and their suitability; the project docu¬ 
mentation available, its comprehensiveness and accuracy; 
and the time available for the task. 

Outputs include the whole range of information gener¬ 
ated by the team. They are therefore not confined just to 
items such as release scenarios or deviations with asso¬ 
ciated causes and consequences, but extend also to the 
statements of scope, the report on the analysis and the 
follow-up measures. 

Quality assurance of hazard identification requires 
documentation both of the hazard identification system 
and of the hazard identification activities conducted in a 
particular project. It should leave an audit trail which 
can be followed later if necessary. 

8.28 Quality Assurance: Completeness 

The quality of hazard identification virtually parallels the 
completeness of identification. It is of interest, therefore, 
to consider attempts made to assess the completeness of 
hazard identification. Some identified hazards are dis¬ 
carded as unrealizable. In discarding such hazards, 
discrimination is exercised. It is desirable to have some 
measure of this also. 

A study of completeness and discrimination in hazard 
identification has been made byJ.R. Taylor (1979; 1981LPB 
46). It is possible to specify a list of hazards which is 
complete. According to Taylor, process plant hazards are 
covered by the following list: fires, explosions, toxic 
releases, asphyxiations, drownings, and mechanical impact 
and cutting accidents. However, the price paid for com¬ 
pleteness is a list so general that it is of little practical use. 
As soon as the list is developed into more specific 
categories, the degree of completeness is liable to decrease. 


8.28.1 Criteria of completeness 

The following criteria of completeness are defined: 

Criterion Definition 

1 Md/Aftot 

2 C&WKu 

3 (DfoWMfeki 

4 N rl /N i6 

where c is a measure of consequence, / is the frequency of 
occurrence, and N is the number of hazards and where 
subscripts refer to the following: 

id identified 

chi identified in a case history list 

m identified by method m 

rl realizable 

tot total existing 

Criterion 1 is the simple measure of completeness. Criterion 2 
is a more practical criterion, which measures completeness 
obtained by a particular method in relation to hazards, 
which are ascertainable as having occurred historically.This 
requires the use of a large list of case histories. 

Some hazards are expressly excluded from consideration 
in order to reduce the work involved. This is the case where 
a cut-off is applied to exclude combinations of hazards of 
order higher than 1 or 2. Criterion 3 is intended for use in 
such situations. 

Some hazard identification methods possess internal 
completeness. They treat a specific class of hazard, which 
is logically complete. This is the case with a FMEA, where 
the set of failure modes is complete. Sources of incom¬ 
pleteness in such a method are errors in using the method 
or hazards, which lie outside the scope of the method. 

Criterion 4 is a measure of discrimination. A hazard 
which has been identified may actually not be realizable, as 
may be demonstrated by further analysis. 

There is a degree of conflict in the attempt to achieve both 
completeness and discrimination, particularly in indus¬ 
trial work where the time available for analysis is limited. 

8.28.2 Studies of completeness 

Taylor has extended this work to encompass a comparative 
study of the completeness of hazard identification on par¬ 
ticular plants. The investigation covered four full-scale 
risk analysis projects plus a research study on a batch dis¬ 
tillation plant. 

In the batch plant study, various hazard identification 
techniques were applied successively. Starting with the 
HAZOP method, using a supporting checklist, the number 
of hazards identified was 30. A further two were identified 
by making some use of fault trees to explore causes and of 
consequence diagrams to explore consequences. Applica¬ 
tion of AEA then identified a further 82 hazards. Inspec¬ 
tion of the actual plant using checklists identified a further 
10 hazards. This gives a total of 124 hazards identified. A 
further three hazards were identified from disturbances 
during commissioning, making a total of 127. 

The completeness of hazard identification was checked 
against a generic fault tree based on case histories. A fur¬ 
ther two hazards were identified using the tree. On this 
basis, therefore, the completeness of hazard identification 
obtained using the HAZOP, AEA and inspection was 97 %. 
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Taylor also describes evaluation of completeness using 
manually and automatically constructed fault trees. For the 
former, he quotes a completeness of 80% as typical for 
analysis of a piping diagram, but states that the degree of 
completeness is much less for sequential operations and 
operating problems. For the latter, work was still in pro¬ 
gress, but he quotes a completeness at the time of writing 
of some 94%. 

The HAZOP method used in the study was based on 
vessels rather than lines and appears not to have been a 
version adapted for sequential operations, so that, as the 
author states, the results do not do justice to the HAZOP 
method. 

8.29 Quality Assurance: QUASA 

A formal method for quality assessment assurance of safety 
analyses (QUASA) has been developed by Rouhiainen 
(1990).The method covers both qualitative and quantitative 
aspects, but with emphasis on hazard identification, and 
it is therefore appropriate to consider it at this point. 

8.29.1 Safety analysis 

The content of safety analysis is considered in terms of four 
main elements: (1) hazard identification, (2) QRA (3) reme¬ 
dial measures and (4) resources. 

The quality assessment examines fitness for purpose. 
The purposes of safety analysis considered include: 
assessment of risks in relation to plant siting; identifica¬ 
tion, elimination or reduction, and control of hazards in 
design of a new plant; and the same for an existing plant. 

Safety analysis has potential deficiencies which it is 
the function of quality assessment to uncover. Some of 
these deficiencies are listed by Rouhiainen, as shown in 
Table 8.48. 

8.29.2 QUASA 

QUASA is based on quality theory. In accordance with this 
theory, methods for the assessment of the quality of a 
safety analysis may be based essentially on inputs and 
process and/or on outputs. The features assessed in 
QUASA are given in Table 8.49. As stated earlier, they 
include not just the immediate results of the hazard identi¬ 
fication and risk assessment, but other features such as the 
statements of scope, the report on the analysis and the 
follow-up measures. The emphasis in the method is thus on 
outputs, broadly defined. 

A core feature of the method is the assessment of the 
quality of the hazard identification and the QRA. Here con¬ 
sideration is confined to hazard identification, the treat¬ 
ment of the QRA in the method being deferred to the next 
chapter. The quality assessment in QUASA may be made 
by a single assessor or by a group of assessors. 

8.29.3 Assessment models 

Rouhiainen gives the following model of the accident 
process: 

Hazard —> Exposure —> Consequences 

with contributory factors influencing each stage. Two types 
of contributory factors are distinguished: determining 
factors and deviations. Essentially, determining factors are 
those governing the design of the system, and deviations 
are excursions in its operation. 


Table 8.48 Some potential deficiencies in a safety 
analysis (Rouhiainen, 1990) 


Phase of analysis 

Examples of possible deficiencies 

System definition 

Correlation between the plant and 
its descriptions not checked 
Important parts of the production 
system not included in the 
analysis 

Important production situations 
not taken into account 

Hazard identification 

Important hazard types omitted 
Methods used do not cover all 
hazards 

Accident modelling 

Important accident chains not 
modelled 

Important contributing factors 
omitted 

Estimation of accident 
frequencies 

The data used inaccurate 

Incorrect subjective 
judgements used 

Accuracy of the results not 
evaluated 

Estimation of accident 
consequences 

Simplifications made incorrect 
Model used not suitable to the 
situation studied 

Risk estimation 

More reliable toxicity data might 
be available 

Emergency provisions 
overestimated or 
underestimated 

Documentation 

Description of the object 
inadequate 

Initial assumptions not presented 

Measures after the 
analyses 

Measures presented not 
implemented 

No plan for updating the analysis 


For the assessment of a safety analysis, use is made of 
the further model shown in Figure 8.19, which gives an 
overview of limitations and deficiencies of the safety ana¬ 
lysis process, cast in the form of a cause-consequence 
diagram. 

8.29.4 Assessment checklist 

The QUASA method is based on the checklist shown in 
Table 8.49. The checklist covers the various stages of the 
safety analysis, its preparation and initiation, conduct, 
reporting and follow-up. It draws on the method given in 
ISO 9002:1987 for the assessment of the quality assurance 
system of a subcontractor. 

8.29.5 Assessment measures 

Assessment of quality involves a comparison of actual 
performance against some performance standard. Perfor¬ 
mance standards for some parts of the safety analysis 
are difficult to define. This is true particularly for hazard 
identification, since the complete list of hazards is not 
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Table 8.49 Checklist for quality assessment of a safety 
analysis (Rouhiainen, 1990) 


(1) Preparation of the analysis 

(a) Selection of the object 

(b) Restriction and definition of the object 

(c) Definition of the goals 

(d) Organization of the safety analysis 

(2) Initiating the safety analysis 

(3) Selection of methods and performance of the analysis 

(a) Identification of hazards 

(i) General aspects 

(ii) Equipment 

(iii) Processes and materials 

(iv) Organization of the obj ect 

(v) Human activities 

(b) Modelling of accidents 

(c) Estimation of accident frequencies 

(d) Estimation of consequences 

(i) Calculation of consequences 

(ii) Emergency preparedness 

(e) Estimation of risk 

(f) Planning of remedial measures 

(4) Report of the safety analysis 

(a) Description of the object 

(b) Description of the analysis 

(c) Results of the analysis 

(d) Description of the proposed measures 

(5) Measures after the analysis 

(a) Measures to be taken in the obj ect under analysis 

(b) Information about analysis results 

(c) Plans for reviewing and updating the analysis 

(d) Follow-up 


known. The approach taken in QUAS A is to use a number of 
complementary methods of generating data alternative to 
that yielded by the original safety analysis with which the 
latter can then be compared. Some methods of generating 
such information for assessment of the hazard identifica¬ 
tion outputs include: 

(1) parallel analysis 

(a) complete, 

(b) partial; 

(2) comparison with operating experience; 

(3) comparison with incident case histories. 

Parallel analysis involves repeating the analysis using 
another analyst, either completely or in part. Full repeat 
analyses are time consuming and are rarely undertaken 
except in benchmark exercises, but sampling of the prob¬ 
lem and partial analysis are more common. 

A comparison may be made between the hazards identified 
in the safety analysis and incidents drawn from the operating 
experience of the plant. Since these cannot be expected to 
give the full range of potential incidents, particularly for 
rare events, a further comparison may be made by drawing 
on incident case histories for plants with similar features. 

The safety analysis identifies deficiencies which in a 
proportion of cases will lead to incidents, but does not 
predict incidents as such. The same applies to the quality 
assessment of the safety analysis.The quality assessment, 
therefore, has to proceed by making a judgement as to which 


deficiencies have caused a particular incident. This then 
establishes the link between deficiencies and incidents. 

8.29.6 Safety analysis performance 

Thus, in general, there will be a number of deficiencies 
identified in the safety analysis, which may be compared 
with two other sets of identified deficiencies: those found 
by the quality assessor(s) and those inferred from inci¬ 
dents. There is no guarantee that these three sets comprise 
the total universe of deficiencies, but nevertheless the 
comparison gives a useful indicator of quality. 

8.29.7 Assessor performance 

Two indices of assessor performance are used which apply 
when there is more than one assessor. If a group of asses¬ 
sors is used, it is possible to compare the performance of 
the individual assessors. An interassessor reliability for a 
given assessor is defined as the ratio of the number of 
deficiencies identified by that assessor to the total number 
identified by all the assessors. The other index used is that 
of validity. This is defined as the ratio of the number of 
incidents illustrating deficiencies in the analysis identified 
by a given assessor to the total number identified by all the 

reliability and a low score in validity means that a large 
proportion of the deficiencies identified are not significant 
causes of incidents. 

8.29.8 Assessment studies 

Four quality assessment studies were conducted and used 
to improve the checklist. The studies covered: (1) a pulp 
manufacturing process; (2) a chlorine liquefaction plant; 
(3) an liquefied petroleum gas storage and distribution 
system and (4) the First Canvey Report. All the studies 
involved quality assessment of the safety analysis as a 
whole, but in the first three the emphasis was on the quality 
of hazard identification, whilst in the fourth it was on the 
quality of the quantitative risk analysis. 

In the original safety analysis of the pulp manufacturing 
process, the hazard identification methods used had been 
potential problem analysis (PPA), HAZOP and AEA. The 
PPA identified 30 hazards. The HAZOP identified over 150 
hazards and gave 120 proposals for improvement. The AEA 
identified 25 opportunities for human error and gave 22 
improvements. 

In the quality assessment of this safety analysis, assess¬ 
ments were made by three assessors. The total number of 
deficiencies identified by the three assessors was as 
follows: system definition, 11; hazard identification, 
24; accident modelling, 1; estimation of accident frequencies, 
1; estimation of accident consequences, 3; risk estimation, 
3; documentation, 9; and follow-up measures, 5. Assessor 
A found 36 deficiencies, assessor B found 17 of these same 
deficiencies and 13 new ones, assessor C found 20 of the 
deficiencies found by A and B and 8 new ones. 

As far as concerns the checklist, out of the 138 questions, 
70 were useful in revealing deficiencies in the safety ana¬ 
lysis. Of these, 45 led to identification of deficiencies by one 
assessor, 28 to identification by two assessors and only 2 to 
identification by all three assessors. 

The performance both of the safety analysis and of the 
quality assessors was checked against data obtained on 
operating experience on the plant. From these data, the 
assessors identified some 280 trivial incidents, which 
they classified under five headings, and 112 non-trivial 
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Figure 8.19 Some potential limitations and deficiencies in a safety analysis (Rouhiainen, 1990) 
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Table 8.50 Identification of factors contributing to incidents by safety analysts and by quality assurance assessors: 
study of 117 incidents (after Rouhiainen, 1990) 


Identified in 
safety analysis 

Not identified i i 

Identified by at least 
one assessor 

n safety analysis 

Not identified 
by any assessor 

Total 

Physical subsystem 

49 

63 

15 

127 

Environmental subsystem 

7 

4 

2 

13 

Human subsystem 

4 

5 

0 

9 

Managerial subsystem 

2 

10 

1 

13 

Total 

62 

82 

18 

162 

N 

44 

59 

14 

117 


Table 8.51 Some principal deficiencies in the First Canvey Report identified in two quality assessments (Rouhiainen, 
1990) 


Author ■ a 


Definition of the object 

- Definition of the area not clear 

- No definition of the residual regions 

- Employees and minor accidents excluded 

Definition of the goals 

- No definition of the concept ‘major interaction’ 

- No definition of the types of hazards excluded 

- No criteria for choosing the accidents modelled 

- Cut-off criteria for risks which can be excluded 
not presented 

Organization of the risk analysis and methods used 

- Background of the team members not presented 

- Knowledge and experience of the team not 
presented 

- Incident statistics of the plants not used 

Identification of hazards 

- Hazard identification not systematic 

- Not all factors affecting event-chains considered 

- Hazards caused outside the area not studied 

- Not all materials taken into account 
Estimation of accident frequencies 

- Not all assumptions and simplifications 
presented 

- Reference for the data used not presented 

- Statistical data used may in some cases be 
incorrect 

- Effect of speed limit overestimated 


Estimation of consequences 

- Not all principles and limitations of the models 
used presented 

- Estimation based only on average amounts of 
materials 

- The effect of the changes in the source term not 
estimated 

Estimation of risks 

- Not all assumptions, simplifications and 
calculations presented 


(Analysis... 1980) 


— Geographical limits should be applied only to fixed 
installations 

— Minor events ignored 

— Office and factory workers excluded 


- The analysis could have gone further 


- Comparison with accident statistics should have 
been made 

- Reference presents two hazards overlooked 

- Smaller initiating events not considered 

- The same deficiency noted 

- Not all toxic chemicals included in the report 

- Assumptions and calculations 
criticized 

- Noted that this prevents assessment of the data 

- Reference presents examples of incorrect failure 
frequencies 

- Noted as a source of inaccuracy 

- Basis of subjective judgements incorrect 

- Frequencies overestimated 

- Calculation methods not presented in enough detail 

- Reference presents many mistakes in the 
assumptions, simplifications and methods 


- Many mistakes presented 

- Some serious arithmetic errors noted 
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Table 8.51 (continued) 

- Cryogenic commission of LNG b tankers excluded 

- Risk estimated only for some regions 

- Not all aspects concerning emergency planning 
studied 

Report of the risk analysis 

- Some characteristics of the analysis object not 
described 

- Accuracy of the results not presented 


- The same deficiency noted 

- Avoiding action of people not taken into account 


- The same deficiency noted 

- Results not presented in enough detail 

- No logical basis for selecting the remedies 

- No guidance for the future 

- The total impact of the hazards not estimated 


a Author, single assessor; (Analysis, 1980), other critiques. 
b Liquefied natural gas. 

incidents, giving a total number of 117 different incidents in 
all. Of these 117 incidents, 73 had not been identified in the 
safety analysis. 

Rouhiainen (1990) gives evaluations of the interassessor 
reliability and of the validity. The interassessor reliabilities 
were 58%, 53% and 49%. With regard to validity, of the 
117 incidents, 59 illustrated deficiencies identified by at 
least one assessor and 30 deficiencies identified by all three 
assessors. 

The number of factors considered to have contributed to 
these 117 incidents is given in Table 8.50. 

The physical subsystem covered failures and malfunc¬ 
tions, structural defects, leaks within and from the system, 
pipe blockage and conveyor jamming, and process dis¬ 
turbances. The environmental subsystem covered envi¬ 
ronmental factors, weather and impurities. 

Further aspects of the incidents identified were also ana¬ 
lysed. Of the total 177 incidents, the effects on personnel 
safety were found to be as follows: leak of hazardous sub¬ 
stance, 12; another immediate accident hazard, 5; hazard 
with a parallel failure, 19; increase in probability of hazard, 
25; and no direct effect on safety, 56. The effects on plant 
operation were as follows: shut-down of whole plant, 8; 
shut-down of part of plant, 53; operating disturbance, 40; 
decrease in quality of pulp, 4; extra work only, 8; and no effect 
on production, 4. The account given by Rouhiainen (1990) 
of the other two plant studies follows this broad pattern. 

After the second study, the checklist was revised. The 
aim of the revisions was to repair omissions, overlaps and 
obscurities and variability in level of detail. 

The study of the Canvey Report was concerned with the 
quality of the QRA rather than with hazard identification. 
The checklist was applied by a single assessor and the 
deficiencies identified, which are shown in Table 8.51 were 
compared with those given in other critiques of the report, 
including the Second Canvey Report. 

8.30 Notation 

Section 8.6 

AQ airborne quantity (kg/s) 

BI Business interruption loss 

C Loss control credit factor 


CEI Chemical exposure index 

CF Credit factor 

DF Damage factor 

EF Escalation factor 

EPRG toxic limit (mg/m 3 ) 

ER Exposure radius 

F, GPH factor 

F 2 SPH factor 

F 3 PUHF factor 

F&EI Fire and explosion index 

GPH General process hazard 

HD Hazard distance (m) 

MF Material factor 

MPDO Maximum probable days outage 

MPPD Maximum probable property damage 

OV Original value 

PUHF Process unit hazards factor 

RV Replacement value 

SPH Special process hazard 

VAE Value of the area exposed 

VPM Value of production per month 


Section 8.19 

L Exponent of likelihood (where latter is expressed 

as a frequency) 

S severity category 

TR target risk 


Section 8.28 

c measure of consequence 

/ frequency of occurrence 

N number of hazards 


Subscripts 

chi identified in a large case history list 
id identified 

m identified by method m 

rl realizable 

tot total existing 
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9/2 HAZARD ASSESSMENT 


In the previous chapter, an account was given of the 
process of identifying hazards, of the methods available 
and of the follow-up. For the great majority of hazards 
the action to be taken is clear once the hazard is known. 
There are, however, some hazards that require further 
assessment. Originally, such hazard assessment was 
undertaken in order to assist in making engineering 
decisions in the ‘grey’ areas where further investigation 
is needed in order to decide on the most cost-effective 
measures. This is still the prime purpose of hazard 
assessment, but increasingly in recent years, this activity 
has been enlarged to deal with major hazards which are 
realized only very rarely but which present a threat to 
the public. 

The aims and nature of these two activities are some¬ 
what different. The terminology used to describe them 
also differs. In the United Kingdom, the practitioners of 
the first type of hazard assessment have tended to call 
it ‘hazard analysis’ (HAZAN). The second type is often 
called ‘probabilistic risk analysis’ (PRA), a term which 
came into use in the US nuclear industry, or simply ‘risk 
analysis’. 

Hazard assessment is introduced here, therefore, with 
an account of how it has developed historically. The use of 
hazard analysis as an aid to engineering decision-making 
is then described. As this account shows, the methods used 
in hazard analysis are often relatively simple. 

Risk assessment is a more complex undertaking, as 
the account given indicates. The starting point is the 
identification of the hazards and definition of the hazard 
scenarios to be considered. For each hazard, the frequency 
and consequences are then estimated. The estimation of 
frequency may require the use of fault trees, event trees 
and/or cause-consequence diagrams. The estimation of 
the consequences involves the study of a sequence of 
events. Usually this is an emission of hazardous material 
which gives rise to certain physical effects. The estimation 
of these effects involves the use of a wide range of hazard 
models. 

Some hazard assessments terminate at this point. If a full 
risk assessment giving risks to the public is required, 
however, it is necessary also to have models that define the 
characteristics of the population at risk, in order to allow 
for factors such as shelter and escape, which modify 
exposure to the physical effects, and then to estimate the 
proportion of people who suffer injury. 

There are a number of forms in which the results of a 
risk assessment may he presented. It is desirable that 
information be presented on the degree of confidence in 
the results of the risk assessment. This is important both 
because there are inherent uncertainties in risk assess¬ 
ment and because the methodology is still developing. 
Although the numerical estimates produced by a quanti¬ 
tative hazard assessment may not be the most important 
outputs, it is necessary to have risk criteria by which to 
evaluate them. 

Model hazard assessments for major hazards have been 
carried out by the Health and Safety Executive (HSE) to 
assist in land-use planning and by the Chemical Industries 
Association (CIA) to assist in emergency planning and in 
preparation of a safety case. The impact of a hazard on the 
surrounding area may be estimated using a hazard impact 
model. 

A full risk assessment is a major undertaking. Various 
simplified techniques have been developed, involving a 


greater or lesser degree of approximation. These range from 
short-cut versions of the normal method to very simple 
and approximate methods. A major accident is usually 
preceded by a number of lesser events which may serve as 
warnings. The hazard warning structure may be analysed 
and used to enhance confidence that the hazard is under 
control. 

A number of major risk assessments have been carried 
out, notably the two Carney Reports and the Rijnmond 
Report. These are described in Appendices 7 and 8, 
respectively. Selected references on hazard assessment are 
given in Table 9.1. 

Table 9.1 Selected references on hazard assessment 


NRC (Appendix 28 Probabilistic Risk Assessment)-, Green 
and Bourne (1965 UKAEA AHSB(S) R91.1966 UKAEA 
AHSB(S) R117.1972); Recht (1965); F.R. Farmer (1967b, 
1969a, 1971,1975,1981); Hensley (1967 UKAEA AHSB(S) 
R136,1968); Buchanan and Hutton (1968); Fowler and 
Spiegelman (1968); A.E. Green (1968,1969 UKAEA 
AHSB(S) R172,1969-70,1970,1972,1973,1974a,b, 1976, 
1982,1983); R.L. Browning (1969a-c, 1970,1973,1980); 
O’Sell and Bird (1969); Benjamin and Cornell (1970); MCA 
(1970/18); Fine (1971,1973); Houston (1971); Kletz (1971, 
1972a, 1973a, 1974c, 1976d, 1977a, b,e,f, 1978a, 19791, m, 
1981d, 1983e,h,i, 1984b,h,j); Malloy (1971); R.M. Stewart 
(1971); J.R. Taylor (1973,1974b,d, 1975a,b, 1976b, 1994); 
Apostolakis (1974,1975,1978,1981,1986,1991); G.D. Bell 
and Beattie (1974); Bulloch (1974); DOT, CG (1974a-d); 

S.B. Gibson (1974,1974b); Hoffm a n (1974); Krasner (1974); 
Lawley (1974a,b, 1976,1980); AEC (1975); Burgoyne (1975); 
Eisenberg, Lynch and Breeding (1975); Erdmann etal. 
(1975,1977); D.O. Cooper and Davidson (1976); Critchley 
(1976); Kastenburg, McKone and Okrent (1976); M.J. Katz 
(1976); Sather (1976); Erdmann etal. (1977); Gangadharan 
and Brown (1977); Ravetz (1977b); Sacks and Liberty 
(1977); US Army Material and Development and Readiness 
Command (1977); US Congress, OTA (1977); Anon. (1978g); 
Cremer and Warner (1978); HSE (1978b, 1981a); Kumamoto 
and Henley (1978); Albaugh etal. (1979); Hanna (1979); 

R. King and Magid (1979); VC. Marshall (1979a, 1980b, 
1982a,b); Mumford and Lihou (1979a-c); Riso National 
Laboratory (1979/1); Anon. (1980m); Apostolakis, Garribba 
and Volta (1980); Bjordal (1980); Burke and Weiss (1980); 
Coiner, Cox and Sylvester-Evans (1980); Garribba and Ovi 
(1980); Jager (1980,1983); Lawley (1980); Lees (1980b,c, 
1981b, 1982c); Opschoor and Hoftijzer (1980); Abramson 
(1981a,b); Apostolakis and Kaplan (1981); EPA (1981, 
1987a); R.F. Griffiths (1981a,b, 1989,1991a); Henley and 
Kumamoto (1981,1985,1992); Kaplan and Garrick (1981); 
Napier (1981); D.W. Pearce (1981); Slater, Ramsay and Cox 
(1981); J.M.T. Thompson (1981); W.A. Thompson (1981); 

F. Warner (1981h); Chatwin (1982a,b); CONCAWE (1982 
10/82,1984,1988 88/56); Covello, Menkes and Nehnevajsa 
(1982); L.A. Cox (1982); R.A. Cox (1982a,b, 1986,1987, 
1989a, 1990); R.A. Cox and Comer (1982); N.C. Harris 
(1982); Helmers and Schaller (1982); IBC (1982/38,1989/77, 
1991/85,86,1992/95,1993/103); Kaiser (1982c, 1993); 

S. Kaplan (1982b); NRC (1982a); Rijnmond Public Authority 
(1982); Sancaktar (1982,1983); R.F. White (1982); Barren, 
Daniels and Hagon (1983); Borse (1983a-c); Cardinale, 
Grille and Messina (1983); A.P. Cox and Pasman (1983); 
Coxon and Gilbert (1983); Daniels and Holden (1983); 
Eddershaw (1983 LPB 52); R.A. Freeman (1983,1985,1989); 
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IMechE (1983); Joschek (1983); Lans and Bjordal (1983); 
Lathrop and Linerooth (1983); S. Levine, Joksimovic and 
Stetson (1983); Mancini and Volta (1983); Opschoor and 
Schecker (1983); The Royal Society (1983,1992); Considine 
(1984 SRD R310); Frankel (1984); Hawksley (1984,1989); 
Lowe (1984); T. Redmond (1984); Waller and Covello (1984); 
Cullingford, Shah and Gittus (1985); Holden (1985,1989); 
Nieuwhof (1985c); Olkkola etal. (1986); Rasbash (1986a); 
J.R. Taylor et al. (1986); Apostolakis and Moieni (1987); 
Boykin and Kazarians (1987); Guymer, Kaiser and 
Mckelvey (1987); Kanury (1987); Ozog and Bendixen 
(1987); Heising (1987); Pate-Cornell (1987); J.R. Thomson 
(1987); Andrews (1988); Burns (1988); CPD (1988,1992a,b); 
Emerson, Pitblado and Sharif (1988); Nelms (1988); 

Suokas (1988); Waite, Shillito and Sylvester-Evans (1988); 
Wakeling (1988); Withers (1988); J.L Woodward and 
Silvestro (1988); Andow (1989); Bourdeau and Green 
(1989); FEMA (1989); Geary (1989); R.F. Griffiths (1989); 
Holden (1989 SRD R504); HSC (1989); ILO (1989); van Loo 
and Opschoor (1989); Prugh (1989); L.E.J. Roberts (1989); 
Rouhianen and Suokas (1989); Suokas and Kakko (1989); 
B. Rasmussen and Smith-Hansen (1989); Suokas and 
Rouhianen (1989); Anon. (1990h); Arendt (1990); 
Castleman (1990); Edmondson (1990); Fraser, Bussey and 
Johastone (1990); French, Olsen and Peloquin (1990a,b); 
Hirano (1990b); Pitblado, Williams and Slater (1990); 
Schaller (1990); Smith (1990 LPB 93); Turney (1990a,b); 
Bowonder, Arvind and Myake (1991); A. Fisher (1991); 
Greenberg and Cramer (1991); Hurst (1991); S. Brown (1991); 
Basta (1992); CIA (1992 SRD RCS4, RC55, RC56); S.J. Cox 
(1992); Fryer and Mackenzie (1992); Goodner (1992); 
Heinold (1992); IAEA (1992); Papazoglou etal. (1992); 
Peacock and White (1992); J.R. Taylor (1992); Tweeddale 
(1992,1993a,c);Twisdale etal. (1992); Ziegler (1992); 
Claggett et al. (1993); Frank, Giffin and Hendershot (1993); 
Goldsmith and Schubach (1993); Melchers and Stewart 
(1993); Rimington (1993); M.W.Wright, Bellamy and Cox 
(1993); Christen, Bohnenblust and Seitz (1994); Eastwood 
(1994); Melville (1994); Pitblado (1994b); Rosenthal and 
Lewis (1994) 

Terminology: Higson (1981); F.Warner (1981b);VC. Marshall 
(1981a,b, 1982c); A.E. Green (1982a); R. Mitchell (1982); 
Rasbash (1982b); D. Jones (1992); Hotson (1994 LPB 120) 
ISGRA: ISGRA (1982,1985); Holden, Lowe and Opschoor 
(1985); Clerinx (1986) 

CONCAWE: Hope (1983) 

CCPS: Goldthwaite etal. (1987); R.A. Freeman (1990) 

Incident scenarios 

Wells etal. (1992) 

Hazard assessment priorities, preliminary 
hazard assessment 

Harrington etal. (1986); Holloway (1989); Keey (1991); 
Bergmann (1993); Allum and Wells (1993); Ganger and 
Bearrow (1993); Wells, Wardman and Whetton (1993) 

Event data (see Table A14.1) 

Fault trees 

IEC (Std 1205); NRC (Appendix 28 Fault Tree Analysis); 
Esary and Proschan (1963); Boeing Company (1965); Feutz 
and Waldeck (1965); Haasl (1965); Mearns (1965); Michels 
(1965); Recht (1966c); W.Q. Smith and Lien (1968); Crosetti 
and Bruce (1970); Mieze (1970); Vesely (1970a,b, 1977b, 
1983); Crosetti (1971), Houston (1971); NTSB (1971); 


R.M. Stewart (1971,1974a,b); Bennetts (1972,1975); Fussell 
and Vesely (1972); Andow (1973,1976,1980,1981,1989); 
Barlow and Chatterjee (1973); Fussell (1973a,b, 
1975,1976,1978b); Henley and Williams (1973); Fussell, 
Henry and Marshall (1971); R.A. Evans (1974,1975); 
Fussell, Powers and Bennetts (1974); Lawley (1974a,b, 
1980); Malasky (1974); Phibbs and Kumamoto (1974); 
Powers and Tompkins (1974a,b, 1976); AEC (1975); Andow 
and Lees (1975); Barlow, Fussell and Singpurwalla (1975); 
Esary and Ziehms (1975); Lambert (1975,1976,1977,1978b); 
R.L. Browning (1975,1976,1979,1980); Nieuwhof (1975); 
Caceres and Henley (1976); Carnino (1976); Lambert and 
Yadigaroglu (1976); Y.T. Lee and Apostolakis (1976); Powers 
and Lapp (1976); Salem, Apostolakis and Okrent (1975a,b, 
1977); Apostolakis and Lee (1977); Brock (1977 NCSR R14); 
Burdick et al. (1977); Doering and Gaddy (1977); 
Gangadharan, Rao and Sundarajan (1977); Garriba etal. 
(1977); Kolodner (1977b); Lambert and Gilman (1977a,b); 
Lapp and Powers (1977a, 1979); Martin-Soils, Andow and 
Lees (1977); Mingle, Chawla and Person (1977); NBA (1977); 
G.D.M. Pearson (1977);Vaillant (1977); Astolfi, Contini and 
van den Muyzenberg (1978); Astolfi et al. (1978); Chamow 
(1978); Himmelblau (1978); J.R. Taylor (1976c, 1978b, 1979, 
1982); D.M. Brown and Ball (1980); Dasarathy and Yang 
(1980); Hauptmanns (1980,1986); Piccinini etal. (1980); Pilz 
(1980a,b); D.J. Allen 1981); Prugh (1981,1982,1992a); Welsh 
and Lundberg (1980); Arendt and Fussel (1981); Henley 
and Kumamoto (1981,1985,1992); Kumamoto, Inoue and 
Henley (1981); Vesely etal. (1981); Kletz and Lawley (1982); 
Schreiber (1982); Alesso (1983,1985); Hauptmanns and 
Yllera (1983); Johnston and Matthews (1983 SRD) R245); 
Bendixen and O’Neill (1984) Doelp etal. (1984); J.M. Morgan 
and Andrews (1984); Shafaghi, Andow and Lees (1984a,b); 
Slater (1984); Zipf (1984); Alesso, Prasinos and Smith 
(1985); Andrews and Morgan (1985,1986); Bendixen, Dale 
and O’Neill (1985); BG (1985 Communication 1242); 
Camarinopoulos and Yllera (1985); Jiang Mingxiang 
(1985); Keey and Smith (1984); Laviron and Heising (1985); 
WS. Lee etal. (1985); J.M. Morgan (1985);Yampolsky, Adam 
and Karahalios (1985); Flothmann and Mjaavatten (1986); 
Harron (1986); Page and Perry (1986); Ruan Keqiang 
(1986); Vervalin (1986b); R.P. Hughes (1987a); Jeong, Chang 
and Kim (1987); Limnios (1987b); Kohda and Henley (1988); 
Kohda, Henley and Inoue (1989); Kumar, Chidambaram 
and Gopalan (1989); Singer (1990); Aldersey, Lees and 
Rushton (1991); H. James, Harris and Hall (1992); 
Kavianian, Rho and Brown (1992); Minton and Johnson 
(1992); Andrews and Moss (1993); Bueker et al. (1993); 

D.A. Lee and Browne (1993); Vincoli (1993); ANSI 
Y32.14-1973; BS 5760: Part 7:1991 

Graph theory, graphical methods: Karnopp and Rosenberg 
(1968); Harary, Norman and Cartwright (1975); Biggs, 
Lloyd and Wilson (1976); Carre (1979); Chachra, Ghare and 
Moore (1979); Umeda et al. (1979,1980); Boffey (1981); 
Temperley (1981); Khoda and Henley (1988) 

Kinetic tree theory: Vesely (1969,1970b); Vesely and Narum 
(1970); Vesely and Goldberg (1977a,b) 

GO methodology: R.L. Williams (1977) 

Fault free synthesis (see also Table 30.1) 

Lapp-Powers method: Henley and Kumamoto (1977); 
Lapp and Powers (1977a, 1979); Locks (1979,1980); Powers 
(1977); Shaeiwitz, Lapp and Powers (1977); Lambert (1979); 
Yellman (1979); Cummings, Lapp and Powers (1983); 
Ulerich and Powers (1988) 
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Event trees 

NRC (Appendix 28 Event Trees)-, von Alven (1964); 

N.C. Rasmussen (1974); AEC (1975); Andow (1976); Vesely 
(1977b); HSE (1978b); Worledge (1979 SRD R128); Welsh and 
Lundberg (1980); Kaplan (1982a); Schreiber (1982); Slater 
(1984); Limnios and Jeannette (1987); Melo, Lima and 
Oliviera (1987); Aldersey, Lees and Rushton (1991); 

H. James, Harris and Hall (1992); Piccinini, Scarrone and 
Ciarambino (1994) 

Cause—consequence diagrams 

D.S. Nielsen (1971,1974,1975); R. A Evans (1974); J.R. Taylor 
(1974c,d, 1975a, 1976c, 1978a); D.S. Nielsen, Platz and Runge 
(1975); J.R. Taylor and Hollo (1977a,b); Himmelblau (1978) 

Dependent failures 

Epler (1969); Fleming (1974); AEC (1975); R. A. Evans (1975); 
Apostolakis (1975); Fleming and Hannaman (1976); 

J.R. Taylor (1976a); NEA (1977); Vesely (1977a); D.P. Wagner, 
Cate and Fussell (1977); D.P. Wagner and Fussell (1977); 
Fussell (1978a); Edwards and Watson (1979 SRD R146); 
Welsh and Lundberg (1980); Bourne etal. (1981 SRD R196); 
Johnston and Crackett (1985 SRD R383); Crackett (1986 
SRD R411); B.D. Johnston (1987a,b); Humphreys (1987); 

R.P. Hughes (1987h); Humphreys and Johnson (1987 SRD 
R418); B.R. Martin and Wright (1987); G.T. Edwards (1988); 
Mosleh etal. (1988); Attwood (1991); Andrews and Moss (1993) 

Escalation, domino effects 

Labath and Amendola (1989); Bagster and Pitblado (1991); 
Four Elements Ltd (1991); Purdy, Pitblado and Bagster 
(1992); Latha, Gautam and Raghavan (1992); Stilly and 
Crowther (1992); Pettit, Schumacher and Seeley (1993) 

Expert judgement (see Table 7.1) 

Rare events 

Pressure vessel failure (see Table 12.1) 

External threats 

NRC (Appendix 28 External Hazards) 

Aircraft crashes: Chelapati, Kennedy and Wall (1972); 
Marriott (1987); Phillips (1987 SRD R435) 

Weather: Eagleman, Muirhead and Williams (1975); 
Eagleman (1983); Page and Lebens (1986); Peters and 
Hansel (1992) 

Earthquakes (see Table A15.1) 

Floods: McCullough (1968) 

Hurricanes: L.R. Russell and Schueller (1974) 

Landslides: Zaruba and Mend (1982) 

Tornadoes: Twisdale etal. (1978); Peters and Hansel 
(1992);Rutchef eta/. (1992) 

Management systems 

Barrell and Thomas (1982); R.A. Cox and Comer (1982); 
Powell and Canter (1984); Pitblado, Williams and Slater 
(1990); Burge and Scott (1992); J.C.Williams and Hurst 
(1992); A.J. Smith (1992); Bellamy, Wright and Hurst (1993) 
Human factors (see also Table 14.11) 

Howland (1980); Ingles (1980); Welsh and Lundberg (1980); 
Spangler (1982); Rasmussen and Pedersen (1983); Melchers 
(1984); Ramsden (1985); Bellamy, Kirwan and Cox (1986); 
Bellamy and Geyer (1988); Delboy, Dubnansky and 
Lapp (1991); Banks and Wells (1992); Bridges, Kirkman 
and Lorenzo (1992); Yukimachi, Nagasaka and Sasou 
(1992); Zimolong (1992); Cameron (1993); Nawar and 
Samsudin (1993) 


Hazard models (see also Tables in Chapters 15-18) 

Longinow etal. (1973); Dunn (1974); AD Little Inc. (1974a); 
Benedict (1978); Cremer and Warner (1978); HSE (1978b, 
1981a); R.A. Cox etal. (1980); Rijnmond Public Authority 
(1982); Bello and Romano (1983a); Crocker and Napier 
(1988a,b); Chhiba, Apostolakis and Okrent (1991); 
Pietersen (1990); Bagster (1993); Geeta.Tripathi and 
Narasimhan (1993); Mallet (1993); K.E. Petersen (1994) 
Hazard model systems 
Harding, Parnarouskis and Potts (1978); Jager, 
Diedershagen and Kiihnreich (1989); FEMA (1989); 
Pitblado and Nalpanis (1989); Raj (1991); 

Papazoglou etal. (1992) 

CPD, TNO: Opschoor (1979); CPD (1992a,b) 

DYLAM: Nivolianitou, Amendola and Reina (1986); Labath 
and Amendola (1989) 

RISKAT: Pape and Nussey (1985,1989); Hurst, Nussey 
and Pape (1989); Nussey, Mercer and Clay (1990); Nussey, 
Pantony and Smallwood (1992,1993) 

SAFETI: Pitblado and Nalpanis (1989); Pitblado, Shaw and 
Stevens (1990) 

Vulnerability model: DOT, CG (1974a—d); Raj and Kalelkar 
(1974); Eisenberg, Lynch and Breeding (1975); Enviro 
Control Inc. (1976,1977); Rausch, Tsao and Rowley (1977); 
Rowley and Rausch (1977); Rausch,Tsao and Rowley (1977); 
Rausch, Eisenberg and Lynch (1977);Tsao and Perry (1979); 
USCG (1979); Parnarouskis, Perry and Articola (1980); 
Perry and Articola (1980); Dodge etal. (1983) 

WHAZAN: Technica (1985); World Bank, Office of 
Environmental and Science Affairs (1985) 

QRA Toolkit: Technica (1991) 

Population characteristics, exposure 
NRC (Appendix 28 Population Distribution)', Robinson and 
Converse (1966); F.R. Farmer (1967b); AtheyTell andjanes 
(1973); AEC (1975); Eisenberg, Lynch and Breeding (1975); 
Hewitt (1976); Chartered Institute of Building Services 
(1977b); Fitzpatrick and Goddard (1977); HSE (1978b); 
Hushon and Ghovanlou (1980); OPCS (1980,1981a-c); Rhind 
(1983); CSO (1985); Schewe and Carvitti (1986); Petts,Withers 
and Lees (1987); van Loo and Opschoor (1989); ACDS (1991) 
Mitigation of exposure 
NRC (Appendix 28 Mitigation Systems) 

Evacuation: NRC (Appendix 28 Evacuation)', Hans and Sell 
(1974);Westbrook (1974); Solomon, Rubin and Okrent (1976); 
HSE (1978b); Urbanik et al. (1980); A.F.C. Wallace (1980); 
Sorensen (1987); Duclos, Binder and Rieter (1989); 

G.O. Rogers and Sorensen (1989); P.J. Harrison and Bellamy 
(1989/90) 

Shelter (see Table 15.10) 

Other measures: Tsuchiya etal. (1990) 

Injury relations 

Lees (1980b); Bourdeau and Green (1989); CPD (1992b); 
CCPS (1994/15) 

Probit methods: R.A. Fisher and Yates (1957); Finney (1971); 
Eisenberg, Lynch and Breeding (1975); HSE (1978b, 1981a); 
Lees (1980b); Paradine and Rivett (1980); CPD (1988, 

1992a,b); Emerson, Pitblado and Sharifi (1988); MacFarlane 
and Ewing (1990); VC. Marshall (1989b); J. Singh and 
McBride (1990); R.F. Griffiths (1991b); deWeger, Pietersen 
and Reuzel (1991); Opschoor, van Lao and Pasman (1992) 

Presentation of results 

Rothschild (1993) 
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Frequency number (FN) tables, curves: F.R. Farmer 
(1967b); Provinciate Waterstaat Groningen (1979); 

R.F. Griffiths (1981e); Okrent (1981); Rijnmond Public 
Authority (1982); Hagon (1983,1984,1986);Vervauin (1986b); 
Ormsby and Le (1988); J.L. Woodward and Silvestro (1988); 
Saccomano, Shortreed and Mehta (1990); ACDS (1991); 
Pietersen and van het Veld (1992); Prugh (1992c) 

Uncertainty, confidence and sensitivity 

AEC (1975); Jacobsen (1980); Parry and Winter (1980 SRD 
R190); Amendola (1983b); Nussey (1983); Olivi (1983); Unwin 
(1984 SRD R301); Siu and Apostolakis (1985); Crick, Morrey 
and Hill (1986); Garlick (1987 SRD R443); Baybutt (1989); 

I. Cook and Unwin (1989); Goosens, Cooke and van Steen 
(1989); S.R. Hanna, Chang and Strimaitis (1990); ACDS 
(1991); Chhiba, Apostolakis and Okrent (1991); S.R. Hanna, 
Strimaitis and Chang (1991b); Amendola, Contini and 
Ziomas (1992a,b); Kortner (1992); vanWees and Mercx (1992); 
Shevenell and Hoffman (1993); Quelch and Cameron (1994) 
Error propagation: Barry (1978); Karlsson and Bjerle (1980); 
Park and Himmelblau (1980); Chang, Park and Kim (1985); 
Keey and Smith (1984); Asbjornsen (1986); Dohnal etal. 
(1992); Melchers (1993a); Quelch and Cameron (1993) 

Evaluation of results (see also Table 9.36) 

Harvey (1979b, 1984); Kastenberg and Solomon (1985); 

R.F. Griffiths (1989); HSE (1989c); Casada, Kirkman and 
Paula (1990); Lapp (1990) 

Quality assurance of hazard assessment 

J. R. Taylor (1979); Welsh and Debenham (1986); Rouhiainen 
(1990); Pitblado (1994a) 

Validation of hazard assessments 

A. Taylor (1979,1981); Jenssen (1993); R.F. Evans (1994); 
Nussey (1994) 

Follow-up, outcome of hazard assessments 

HSE (1978b, 1981a); Rijnmond Public Anthority (1982); 
Baybutt (1983,1986); J.R. Taylor (1984); Arendt (1986); 
Vestergaard and Rasmussen (1988); Desaedeleer et al. 
(1989); Cullen (1990); Schaller (1990); Kakko,Virtanen and 
Lautkaski (1992);Tweedale (1993b) 

Hazard assessment in decision-making 

HSE (1983e, 1989c); Kelly and Hemming (1983); Harbison 
and Kelly (1985); Blokker (1986) 

Hazard assessment and emergency planning 

Burns (1988); J. Singh and McBride (1990);Tavel, Maraven 
and Taylor (1989); Essery (1991) 

Hazard impact model 

Poblete, Lees and Simpson (1984); Lees, Poblete and 
Simpson (1986); Lees (1987) 

Hazard warning 

Warning events analysis: J.H. Bowen (1978); Page (1979); 
W.G. Johnson (1980); Slater and Cox (1984); van Kernel, 
Connelly and Haas (1990) 

Hazard warning structure: 

Lees (1982b, 1983b, 1985); Keey (1986a,b); Lake (1986); 
Pitblado and Lake (1986,1987); E. Smith and 
Harris (1990) 

Planning (see also Table 4.1) 

Batstone and Tomi (1980); Brough (1981); Pantony and 
Smith (1982) 


HSE 

Harvey (1976,1979b, 1984); HSE (1978b, 1981a, 1989c,e); 
Barrell (1980); Barrell and Thomas (1982); Pantony and 
Smith (1982); ACDS (1991) 

Offshore 

Borse (1979); Pyman and Gjerstad (1983); Vinnem (1983); 
Cullen (1990) 

Civil and structural engineering 

Blockley (1980); Ingles (1980); Melchers (1984) 

Hazard assessment applications and case histories 

McGillivray (1963a, b); Kletz (1971,1972a); Ybarrando, 
Solbrig and Isbin (1972 AlChE/119); Siccama (1973); 
Lawley (1974a, b, 1976,1980); N.C. Rasmussen (1974); AEC 
(1975); Dicken (1975); J.R. Campbell and Gaddy (1976); 
Moser, Moel and Heckard (1976); Sellers (1976,1988); Shell 
UK Exploration and Production (1976); Lundquist and 
Laufke (1977); D.S. Nielsen (1977); D.S. Nielsen, Plate and 
Kongso (1977); Okrent (1977); Rashash (1977b); HSE 
(1978b,d, 1981a); Blokker et al. (1980); Joschek et al. (1980); 
de Ruiter and van Lookeren Campagne (1980); van der 
Schaaf and Opschoor (1980); Sutcliffe (1980); vanVliet etal. 
(1980); Helmeste and Phillips (1981); Considine, Grint and 
Holden (1982); Huberich (1982); Piccinini etal. (1982); 
Solberg and Skramstad (1982); Belo and Romano (1983b); 
Bergmann and Riegel (1983); Considine (1983,1986); Jager 
(1983); D.A. Jones (1983); D.S. Nielsen and Platz (1983); 
White (1983 SRD R273); Arendt etal. (1984); O’Mara and 
Burns (1984); Prijatel (1984); L.B. Grant (1985); Arendt 
(1986); Arendt, Casada and Rooney (1986); Bly thing 
(1986); Gebhart and Caldwell (1986); D.A. Jones and 
Fearnehough (1986); Labath etal. (1986); Rochina (1986); 
Shea and Jelinek (1986); Al-Abdullally, Al-Shuwaib and 
Gupta (1987); Page (1987) R.A. Cox (1989b); Crossthwaite, 
Fitzpatrick and Hurst (1988); Ormsby and Le (1988); 
Rooney,Turner and Arendt (1988); Sellers and Picciolo 
(1988); J.L.Woodward and Silvestro (1988); Anon. (1989 
LPB 96, p.19); Cassidy (1989,1990); CIA, Chlorine Sector 
Group (1989); M.M. Grant (1989); Klug (1989); Kumar, 
Chidambaram and Gopalan (1989); Grint and Purdy (1990); 
Schaller (1990); Shei and Conradi (1990); M.P Singh (1990); 
Tweeddale and Woods (1990); ACDS (1991); S. Brown (1991); 
Duong (1991); R.J. Clarke and Nicholson (1992); Myers, 
Mudan and Hachrnuth (1992); Sorenson, Carnes and 
Rogers (1992); Goyal (1993,1993 LPB 1123); Mant (1993) 
ISPRA Benchmark Studies: CEC (EUR 13386 EN, EUR 
13597 EN); Amendola (1983a,b); Amendola, Contini and 
Ziomas (1992a,b) 

Safety cases: Lees and Ang (1989b); Wiedeman (1992); 

R.F. Evans (1994) 

Guide assessments, including safety case 

BCGA (1984); Crossthwaite (1984,1986); Pape and Nussey 
(1985); CIA Chlorine Sector Gp (1986,1989); Clay et al. 
(1988); LPGITA (1988); FMA (1989); Lees and Ang (1989b) 


9.1 Background 

An understanding of the way in which hazard assessment 
has developed historically is important in appreciating its 
present role. Hazard analysis was developed in the 1960s 
as part of the response to the problems that stimulated the 
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development of loss prevention in general, as described in 
Chapter 1. 

One problem area was the availability of large, single 
stream chemical plants. Application of the techniques of 
reliability engineering was one of the measures taken to 
correct this. Closely related was the problem of high hazard 
plants. Several major protective systems were imple¬ 
mented. These were designed using fault trees and instru¬ 
ment failure data, and risk criteria were devised to evaluate 
them. Another matter of concern was the increasing quan¬ 
tity of chemicals being transported around the country by 
road, rail and pipeline. Assessments were made of these 
operations. 

The industry was initially assisted in the use of reli¬ 
ability engineering by the UK Atomic Energy Authority 
(UKAEA), but soon began to develop its own approach. One 
innovation introduced was the use of the hazard and oper¬ 
ability study as a means of identifying hazards. This tech¬ 
nique was developed by the chemical industry. The 
industry also developed a rather distinctive approach to 
hazard assessment. It was clear that in order to improve 
plant reliability and safety it was necessary to modify the 
plant designs, by using more reliable equipment and/or 
configurations and by incorporating additional protective 
devices. There was a severe problem, however, in selecting 
from the large number of measures which might be taken, 
those which were most cost-effective. 

In many cases, once a hazard had been identified, it was 
clear what action should he taken, but there were some¬ 
times ‘grey’ areas where the decision was not clear-cut. This 
is the problem which hazard analysis addresses. Typically, 
the use of hazard analysis involves estimating the fre¬ 
quency of realization of the hazard without and with some 
protective measure, and then evaluating the results using 
an appropriate criterion. The frequency of the hazard is 
usually estimated directly from data for that event, but it 
sometimes has to be synthesized from a fault tree using 
data for events lower down the tree. 

The spirit in which the early hazard analysis was devel¬ 
oped was to use quantitative methods but to keep it simple. 
Fault trees were used, but they were usually nothing like as 
complex as those developed for nuclear plants. Often the 
calculations were almost of a ‘back of the envelope’ type. In 
this, the approach had much in common with that of early 
operational research. Some examples of such hazard 
analysis are given in the next section. They are estimates 
made in support of engineering decision-making. 

9.2 Hazard Analysis 

Hazard analysis is now a well-established method for 
aiding engineering decision-making. An account is given 
in Hazop and Hazan: Notes on the Identification and Assess- 
ment of Hazards (Kletz, 1983d, 1986d, 1992b). The activity 
of hazard analysis may best be described in terms of illus¬ 
trative examples. A collection of such examples has been 
given by Kletz (1971). Before giving these examples, 
however, it is necessary to describe the risk criterion used 
in them. 

9.2.1 Fatal Accident Rate criterion 

A risk criterion is required for the evaluation of the esti¬ 
mates made in hazard analysis. The criterion which was 
developed in the original work and which is still in almost 
exclusive use is the Fatal Accident Rate (FAR). The FAR is 


defined as the number of fatalities per 10 s exposed hours. 
The meaning of the FAR may perhaps be best understood 
by saying that if the actual FAR is, say, 4, and if 1000 men go 
into a chemical works at the age of 20 years, then at the age 
of 60 years 996 men will leave the works alive. At the time 
when it was developed as a criterion, the actual FAR for the 
UK chemical industry was about 3.5. 

The way in which the FAR is applied is then as follows. 
The total FAR is divided into 10 parts. Five of these are 
allocated for everyday hazards such as falling downstairs 
or having a spanner dropped on the head. The other five 
parts are allocated to technological hazards specific to the 
plant on which the employee works. It is assumed that there 
are no more than five of these on a given plant. This then 
gives one part available for each technological hazard on 
that plant. Thus if, for example, the actual overall FAR of 3.5 
is also taken as the overall target value which is not to be 
exceeded, the target FAR for a single, specific technological 
hazard will be 0.35. 

The FAR was originally called the Fatal Accident 
Frequency Rate (FAFR), but since this is tautologous, the 
term Fatal Accident Rate (FAR) is preferred. The FAR 
criterion is discussed further in Section 9.21. 

9.2.2 Pipeline fracture 

A hazard identified on one particular plant was contact of 
refrigerated liquefied gas with a mild steel pipeline, lead¬ 
ing to brittle fracture. One method of avoiding this hazard 
was to use stainless steel, which would be very expensive. 
A much cheaper method was to use a trip system to prevent 
the cold gas from contacting the line. The use of hazard 
analysis to tackle this problem is described by Kletz (1971) 
as follows: 

Using data on the reliability of the various components of 
the trip system and assuming the operator will ignore 
the initial alarm system on one occasion out of four, the 
‘fractional dead time’ of the whole system (that is, 
the fraction of time it is not operating) was calculated. 
This depends on the frequency with which the trips are 
tested. The ‘demand rate’ on the system, the number of 
times per year it is called on to operate, was estimated 
from previous experience. 

The failure rate of the whole system was then estimated 
as once in 10,000 years or once in 2500 years for the whole 
plant which contained four similar systems. 

It was assumed that one tenth of the occasions on which 
the cold gas reached mild steel would result in a leak, an 
explosion and a fatality - almost certainly an overestimate. 
A fatality will then occur once in 25,000 years giving an 
FAFR of 0.45. It was therefore agreed that the control sys¬ 
tem was satisfactory and it was not necessary to replace the 
mild steel by stainless steel. 

It might be argued that the latter course is preferable as it 
is 100% safe, the FAFR is zero. Had we done this, the cost of 
reducing the hazard rate to zero would have been equivalent 
to £150,000,000 per life saved. 

This example illustrates many of the characteristic fea¬ 
tures of hazard analysis. The aim of the analysis is to select 
a measure to deal with a hazard. An estimate is made of the 
frequency of realization of the hazard, based on a simple 
calculation using field data. The estimate made is some¬ 
what conservative. The result is evaluated using the FAFR 
criterion, this criterion not being applied slavishly but with 
regard to the uncertainty in the estimate. A further check 
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is done on the value of a life implied by the decision 
alternatives. 

9.2.3 Crankcase explosions 

Another example is the problem of possible crankcase 
explosions in a building housing 25 compressors. Data 
obtained from a survey showed that there was one explo¬ 
sion per 500 machine-years. In order to achieve an FAR of 
0.35 the proportion of explosions causing fatalities would 
not have had to exceed 1 in 1650. As there were normally 
several men in the building, the risk was clearly too high. 
The risk had to be reduced; the method actually used being 
to fit a suitable relief valve. 

9.2.4 Hazardous area classification 

A third example relates to hazardous area classification. 
Flameproof or intrinsically safe electrical equipment is 
required in Division 1 areas in which flammable gas or 
vapour is likely to be present under normal operating con¬ 
ditions. Totally enclosed ‘non-sparking’ equipment may be 
used in Division 2 areas, in which flammable gas or vapour 
is likely to be present under abnormal conditions. It is more 
economic to use this latter type of equipment and it is 
therefore desirable to apply the Division 1 classification only 
to those areas where it is really necessary. Records indicate 
that Division 2 motors develop a fault that causes them to 
spark or overheat at a rate of once per 100 years. Observation 
indicates that the probability of a man being within 10 ft 
(3 m) of a given motor in a plant area is 1 in 20. If it is assumed 
that anyone within this distance is killed when an explosion 
occurs, that on half the occasions when a flammable atmos¬ 
phere occurs there is no explosion because diffusion into the 
equipment is slow and short-lived concentrations of gas/ 
vapour can be ignored and that there are 100 motors on the 
plant, then an area may be classed as Division 2 if it has a 
flammable mixture for less than 10 h/year.This is the figure 
that corresponds to an FAR of 0.35. 

9.3 Risk Assessment 

The hazards considered in hazard analysis as just des¬ 
cribed are typically accidents with the potential to cause 
one or two fatalities. By contrast, quantitative risk assess¬ 
ment (QRA), also known as probabilistic risk assessment 
(PRA) or probabilistic safety assessment (PSA), usually 
deals with major hazards that could cause a high death toll. 

A full risk assessment involves the estimation of the fre¬ 
quency and consequences of a range of hazard scenarios and 
of individual and societal risk. This is a major undertaking. 
An outline of the classical procedure of risk assessment is 
given in Figure 9.1. The diagram shows the principal ele¬ 
ments and the broad structure, but there are variations and 
there is a degree of iterations, which is not shown. A risk 
assessment should be undertaken only if the purpose of the 
study has been well defined. If this is not done, it is unlikely 
that full value will be derived from the results obtained. 

Identification of the hazards is the essential first step. 
The quality of the assessment depends crucially on the 
comprehensiveness of the hazard identification. Techniques 
of hazard identification have been discussed in Chapter 8. 
The method most relevant to risk assessment is the review 
of release sources. It is also necessary to identify the 
vulnerable targets, both persons and property. 

A scenario is then developed for each potential release. 
The scenario defines the nature of the release and thus 
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Figure 9.1 The risk assessment process 


determines the subsequent chain of consequences. Since 
there is an infinite number of potential releases, it is 
necessary to arrange them in a limited number of groups of 
broadly similar nature. Some factors affecting the sce¬ 
narios include the hole size and the duration, which 
may depend on any emergency shut-off. This procedure 
gives the source terms. 

For each release scenario, a set of consequence chains 
is developed showing the escalation of the event. The dif¬ 
ferent chains arise from the influence of conditions that 
affect the development of the event, such as the wind 
direction and velocity and stability conditions and, for 
flammables, the ignition sources. A typical consequence 
chain is shown in Figure 9.2. The dotted line in the figure 
represents the widening of the confidence bounds as the 
successive events become more remote from the initial 
release. 
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Figure 9.2 A consequence chain 

Table 9.2 Typical sequences of events in a risk 
assessment 


A Flammable release 


Emission 

Vaporization (if liquid) 

Air entrainment 
Gas dispersion 
Ignition 

Flash fire or vapour cloud explosion 

B Toxic release 


Emission 
Vaporization 
Air entrainment 
Gas dispersion 


The set of consequence chains is conveniently represented 
in the form of an event tree. Each of the branches of the 
event tree represents a single consequence chain. The out¬ 
comes are generally defined as events such as flash fire, 
vapour cloud explosion or toxic cloud. It is then necessary to 
identify any features that may mitigate the effects of these 
events on people or property. Factors that modify the expo¬ 
sure of the people include shelter, escape and evacuation. 

In order to estimate injury or damage, it is necessary to 
model the sequence of events leading up to each outcome. 
Two typical chains of events are shown in Table 9.2, one for a 
flammable release and the other for a toxic release. Physical 
models are required which describe each stage in the 
sequence. Using these hazard models for the successive 
stages of the chain, the intensity of the physical effect is 
estimated. 

The effect of a given outcome event on persons or 
property is estimated from the intensity of the harmful 
physical effect. These effects include: 

(1) thermal radiation; 

(2) explosion 

(a) overpressure, 

(b) impulse; 

(3) toxic concentration 

(a) dosage, 

(b) concentration-time function. 

The risk of injury is determined using injury relations 
that give the probability of a defined degree of injury as a 
function of the intensity of the physical effect. Similar 


procedures apply to property damage. Some hazard 
assessments are terminated at this point. The conse¬ 
quences are evaluated. 

In other cases, an estimate is made of the frequencies of 
some or all of the outcomes. This involves first the estima¬ 
tion of the frequency of the release scenario. It may be 
possible to do this directly from failure data or it may be 
necessary to synthesize a value using fault tree methods. 
Then, using the event tree framework, an estimate is made 
of the probability of the various events constituting the 
branch points in the event tree and hence the frequencies of 
the outcomes. Other hazard assessments are terminated at 
this stage. The frequencies of the various consequences are 
evaluated. 

Alternatively, the assessment is continued to provide a 
full risk assessment yielding individual and societal risks. 
Societal risk is expressed as a set of points representing 
increasingly serious events and relating the numbers of 
persons affected to the frequencies of the events. Estima¬ 
tion of societal risk involves determining the population at 
risk. The results of the assessment may be presented in a 
number of different forms such as risk contours on a map of 
the site or tables or graphs of individual and societal risks. 
Each stage of the assessment is attended by uncertainty. It 
is necessary, therefore, to provide measures of this uncer¬ 
tainty. Thus, the frequency of an outcome may be expressed 
as a frequency distribution or range of values rather than 
as a single figure. Finally, the results so obtained are evalu¬ 
ated using risk criteria. 

The foregoing account is a simplified one. In particular, the 
information from a particular stage may lead to modification 
of the design and an iteration in which the results from that 
stage are recalculated. As indicated, the hazard assessment 
may be terminated short of a full risk assessment following 
assessment of the consequences. The consequences may be 
judged tolerably low for any foreseeable frequency. 

In the scheme outlined, the estimation of the frequencies 
is deferred until a relatively late stage. An alternative 
approach is to perform this stage rather earlier. The hazard 
assessment may also be terminated following assessment 
of the frequencies. The frequencies may be judged tolerably 
low for any foreseeable consequences. 

The individual aspects of QRA are discussed in more 
detail in the following sections. 

There are differences of view on the value of such risk 
assessments. Some criticisms are directed to the basic 
philosophy underlying the methodology, others to the 
evaluation of the risk estimates generated. An account of 
the debate on risk assessment is given in Section 9.28. 
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Table 9.3 Principal contents of NRC PRA Procedures 
Guide (Nuclear Regulatory Commission, 1982a) 


1. Introduction 

2. PRA organization 

3. Accident-sequence definition and system modelling 

4. Human reliability analysis 

5. Database development 

6. Accident-sequence quantification 

7. Physical processes of core melt accidents 

8. Radionuclide release and transport 

9. Environmental transport and consequence analysis 

10. Analysis of external events 

11. Seismic, fire and flood risk analyses 

12. Uncertainty and sensitivity analysis 

13. Development and interpretation of results 

Appendices, including: 

C S ources indexes for availability andriskdata 
D Issues in dispersion and deposition calculations 
E Evacuation and sheltering 
F Liquid pathway consequence analysis 


9.3.1 NRC PRA Procedures Guide 
Initially, guidance on the conduct of risk assessments had 
to be sought mainly in published studies such as the two 
Convey Reports, the Rijnmond Report and the Rasmussen 
Report. More formal guidance appeared in the PRA Pro¬ 
cedures Guide of the Nuclear Regulatory Commission 
(NRC, 1982). The coverage of the PRA Procedures Guide is 
indicated by the list of contents given in Table 9.3. 


9.3.2 IAEA PSA Procedures Guide 

A more recent nuclear industry guide is Procedures for 
Conducting Probabilistic Safety Assessment of Nuclear Power 
Plant by the International Atomic Energy Agency (IAEA, 
1992). This guide is particularly strong on the development 
of accident scenarios. 


9.3.3 CONCAWE Guide 

Outline guidance for the process industries was published 
in Methodologies for Hazard Analysis and Risk Assess¬ 
ment in the Petroleum Refining and Storage Industry by 
CONCAWE (198210/82). 


9.3.4 CCPS QRA Guidelines 

A much more detailed QRA guide is given in Guidelines 
for Chemical Process Quantitative Risk Analysis by the 
Center for Chemical Process Safety (CCPS, 1989/5) (the 
CCPS QRA Guidelines). The. principal contents of the CCPS 
Guidelines are shown in Table 9.4 together with the location 
in this book where they are treated. 

The Guidelines are oriented to the QRA practitioner. 
Discussion of the various consequence models and fre¬ 
quency estimation techniques typically has the following 
structure: (1) background (purpose, philosophy/ technology, 
application), (2) description (description of technique, 
theoretical foundation, input requirements and availabil¬ 
ity, outputs, simplified approaches), (3) sample problem 
and (4) discussion (strengths and weaknesses, identification 
and treatment of errors, utility, resources needed, available 
computer codes). 


9.3.5 QRA in safety cases 

In the United Kingdom, one of the principal applications of 
QRA in the process industries is in the safety case. An 
account of safety cases and, in particular, of the extent to 
which QRA is required is given in Chapter 4. 

9.3.6 QRA and decision-making 

A review by the HSE of the role of QRA in decision¬ 
making is given in Quantified Risk Assessment: Its Input to 
Decision-making (HSE, 1989c). The document is part of the 
HSE’s response to the Layfidd Report (Layfield, 1987) on 
Sizewell B, which called for studies both of the tolerability 
of risk from nuclear power stations and of the relationship 
of safety standards in the nuclear industry to those in other 
industries. It deals with the second of these topics, the first 
being treated in TheTolerability of Risks from Nuclear Power 
Stations (HSE, 1988c). 

The study considers some 16 cases of the use of QRA. 
They include: in the process industries, the Convey Reports 
(HSE, 1978b, 1981a), the St Fergus to Moss Morran pipeline 
(HSE, 1978a), the Moss Morran/Braefoot Bay develop¬ 
ment (HSE, 1983e), housing development near an ammo¬ 
nium nitrate plant in the Goole-Hook plan, major retail 
development near a chemical plant at Ellesmere Port, a 
harbour with a liquefied petroleum gas (LPG) shipping 
risk, an explosives wharf, a sulfonation reactor and a plas¬ 
tics injection moulding machine; in the nuclear industry, 
the Heysham/Torness AGR and Sizewell B; in civil engi¬ 
neering, Ronan Point and the RiverThames Flood Defence 
scheme; in mining, Markham Colliery and, in the United 
States, Sunshine Mine; and in rail transport, automatic 
level crossings. In all cases, except apparently Sunshine 
Mine, the QRA was used as an input to decision-making. 
Details of these cases are given in Appendix 2 of the study. 

There is, in general, considerable variation between one 
QRA and another. One cause of variation is the nature of 
the problem addressed. This may be, for example, a single 
machine, a whole plant or even a complex of plants. Another 
cause is the degree of conservatism in the estimates made. 
Furthermore, QRA is subject to quite large margins of 
error. The study makes the point that a QRA does not 
necessarily have to be a complex exercise. In some cases, a 
relatively simple QRA suffices. 

In the cases considered, the main forms in which the 
risks were presented are individual fatal risk and societal 
fatal risk, the latter in the form of frequency—number (FN) 
curves. The study emphasizes the need to distinguish 
between the different bases on which FN curves are con¬ 
structed. An FN curve may be based on (1) historical data, 
(2) design requirements or (3) predicted values. These three 
bases are quite different, and this needs to be borne in mind 
when using the curves derived. 

The two latter types are illustrated by considering two 
FN curves produced for Sizewell B. One curve, by Harbison 
and Kelly (1985), is based on design requirements implied 
in the safety assessment principles of the Nuclear Instal¬ 
lations Inspectorate (Nil). The other curve, produced by the 
Central Electricity Generating Board (CEGB) (G.N. Kelly 
and Hemming, 1983) represents the predictions arising 
from the actual design. Another difference in the basis of 
FN curves is the fatalities on which the curve is based, 
which may be confined to immediate deaths or may also 
include delayed deaths. 

The study gives a review of risk criteria, dealing in par¬ 
ticular with the HSE criterion for a major civil nuclear 





9/10 HAZARD ASSESSMENT 


Table 9.4 Principal contents of CCPS QRA Guidelines (Centre for Chemical Process Safety 1989/5) 


Chapter/section* 


1. 

Chemical process quantitative risk analysis 

8,9 

2. 

Consequence analysis 

15-18 

3. 

Event probability and failure frequency analysis 

9 

4. 

Measurement, calculation and presentation of risk estimates 

9 

5. 

Creation of a CPQRA b database 

Appendix 14 

6. 

Special topics and other techniques 



Domino effects 

9.14 


Unavailability analysis of protective systems 

13 


Reliability analysis of programmable electronic systems 

13 


Other techniques 

mainly 7—9 

7. 

CPQRA application examples 

- 

8. 

Case studies 

- 

9. 

Future developments 

passim 

Appendices 


A 

Loss-of-containment causes in the chemical industry 

15 

B 

Training programs 

14,28 

C 

Sample outline CPQRA results 

9.19 

D 

Minimal cut set analysis 

7,9.5 

E 

Approximation methods for quantifying fault trees 

9.5 

F 

Probability distributions, parameters, and terminology 

7 

G 

Statistical distributions available for use as failure rate models 

7 

H 

Errors from assuming that time-related equipment failure rates are constant 

7 

I 

Data reduction techniques: distribution identification and testing methods 

7 

J 

Procedures for combining available generic data and plant-specific data 

7 


a Chapter or section of this book in which the topic is principally addressed. 
b Chemical process quantitative risk analysis. 


accident and the Advisory Committee on Major Hazards 
(ACMH) criterion for a major accident. The HSE nuclear cri¬ 
terion may be summarized as the requirement that an 
uncontrolled release from any of a family of reactors nation¬ 
wide capable of giving doses of 100 mSv at 3 km, which pes¬ 
simistically might cause eventual deaths of about 100 people, 
should be no more frequent than 10 _4 /year and the 
ACMH major hazard criterion that a major accident such as 
Flixborough, involving say >10 deaths, should occur 
nationwide with a frequency no greater than 10 _4 /year. 

In Appendix 1, the study lists some 42 factors that seem 
important in judging the tolerability of risk, under the four 
headings of: (1) the hazard, the consequential risk and the 
consequential benefits, (2) the nature of the assessment, 

(3) the factors of importance to those generating the risk, to 
government or to regulators, and (4) public attitudes. 

Although the results of a QRA are typically expressed in 
terms of deaths or of casualties, appropriately defined, 
there are generally other consequences that need to be 
considered. The study lists (1) the write-off of the plant, 
(2) the impact on the surrounding area, (3) the anxiety factor, 

(4) consequential detriments and (5) the ‘What if?’ factor. 
The write-off of a plant such as occurred at Three Mile 
Island or Chernobyl is costly in itself and harms the 
whole industry. The impact on the surrounding area can 
be severe, especially where land is rendered radioactive, 
and there may be consequent detrimental outcomes such as 
the increased number of miscarriages that took place after 
Seveso. The occurrence of a major accident may lead to 
concern arising from asking ‘What if an even larger scale 
one were to occur?’ 

For the cases described, the study reviews the nature of 
the decision to be made, the risk estimates yielded by the 


QRAs and the decisions taken. Many of the decisions con¬ 
cerned the granting of planning permission. Others related 
to the safety of particular equipment or civil engineering 
designs. Two, Canvey and Sizewell, were much more com¬ 
plex than might appear. Canvey started from a planning 
application for a new plant but grew into an examination of 
the risks from an existing complex. Sizewell inevitably 
became a generic inquiry into the case for nuclear power in 
general and the pressurized water reactor (PWR) design in 
particular. 

The study tabulates the QRA estimates of individual risk 
and gives for the societal risk estimates a FN curve in which 
the curves differ widely. For example, the frequency of 
> 10 deaths varies from 10 _1 /year for the historical data for 
flats of the Ronan Point type to somewhat over 10 _7 /year 
for the implied design requirements of Sizewell B, with 
most cases clustering between about 10 -3 and 10“ 4 /year. 

The decision outcomes, as a decision proper or advice on 
a decision, include: granting of planning permission to a 
new development, without or with improvements (e.g. 
St Fergus to Moss Morran pipeline; Moss Morran Braefoot 
Bay development, harbour with LPG shipping, explosives 
wharf); requirement to make improvements to existing 
situation (e.g. Canvey); acceptance of a design (sulfonation 
reactor); and rejection of a design (e.g. Ronan Point). 

Principal conclusions of the study are as follows. 
First, QRA is an element that cannot be ignored in 
decision-making about risk since it is the only discipline 
capable, however imperfectly, of enabling a number to be 
applied and comparisons of a sort to be made, other than of 
a purely qualitative kind. This said, the numerical element 
must be viewed with great caution and treated as only one 
parameter in an essentially judgmental exercise. Moreover, 
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since any judgement upon risk is distributional, risk being 
caused to some as an outcome of the activity of others, it is 
therefore essentially political in the widest sense of the 
word. Second, QRA illuminates some important compo¬ 
nents of a safety assessment but needs to be supplemented 
by other approaches particularly in the areas of manage¬ 
ment and human factors. Third, the fact that other factors 
need to be taken into account does not detract from the 
value of QRA as a decision input. Fourth, it is not legitimate 
to ‘read across’ QRA-derived risk figures from one hazard¬ 
ous situation to another. It follows that it is not possible to 
specify a universal upper limit for all societal risks. Fifth, it 
needs to be borne in mind that, although QRA sometimes 
gives predictions of very severe accidents, such accidents 
do occur, as instanced by events such as Mexico City, Bhopal 
and Piper Alpha. 

9.4 Event Data 

The methods that are used to estimate the frequency of an 
event depend somewhat on the nature of the event. The aim 
is usually to base the estimate on historical experience, but 
the precise way in which this is done varies. 

In the simplest case, there may be available frequency data 
that apply directly to the event in question. This is likely to 
be the case if the event of interest is one that does sometimes 
occur, for example, the failure of a single item of equipment 
such as a pipeline fracture or pump leak. In other cases it 
may not be possible to obtain such direct data. This tends to 
be the case for complex systems and/or systems with multi¬ 
ple layers of protection. Thus the frequency of failure of a 
nuclear power reactor is a case in point. The presence of the 
protective systems has the effect both of rendering each 
system more or less unique and of reducing the frequency of 
system failure to a very low value. For both these reasons 
historical data on failure frequency are lacking. The fre¬ 
quency therefore has to be synthesized using a fault tree. 
Again historical data are used, but in this case the data are 
for the base events in the tree and so are used indirectly 

The choice of method for the estimation of frequency 
depends on the hazard under consideration. This is illus¬ 
trated very clearly in the different methodologies used in 
the Canvey Reports and the Rasmussen Report. In the for¬ 
mer, the typical events of interest were emissions from 
vessels, pipelines and pumps. For these events historical 
frequency data exist and were used. In the latter study, 
however, the events of interest were accidents on nuclear 
power plants. Historical data for the frequency of these 
events did not exist and estimates had to be synthesized. 
Thus, whereas the Canvey Reports contain very few fault 
trees, the Rasmussen Report has an appendix several cen¬ 
timetres thick and full of fault trees. 

Aparticularly difficult problem is posed by the estimation 
of the frequency of a rare event where this is not amenable to 
synthetic methods. A typical example is the outright failure 
of a high quality pressure vessel. In many cases the estimates 
required are probabilities rather than frequencies. In the 
following, most of the comments made about frequency 
apply also to probability. Similarly, it is convenient to refer 
to failure frequency, but the account given applies in most 
instances to the frequency of other events. 

There are a number of sources of historical data that can 
be used to obtain a frequency estimate. They include the 
literature, the works and data banks. The data which are 
often most easily obtained are the total number of events 


over a given time period. These do not in themselves give an 
event rate. To determine the event rate it is necessary to 
know the total number of items to which the data apply. It 
can be quite difficult to determine this inventory 

Given that these data are available, frequency is typically 
estimated by dividing the total number of events by the 
total number of equipment-years. The assumption under¬ 
lying this procedure is that a constant event rate, or the 
exponential distribution, applies. 

Where failure data are concerned, it is often necessary to 
have information not only on the overall frequency of fail¬ 
ure but also on the composition of this frequency in terms 
of the individual failure modes. In hazards work the fail-to- 
danger mode is usually required. 

The estimation of the frequency from historical data is in 
some cases straightforward, but in others not. Areas of 
difficulty include 

(1) inapplicability of data; 

(2) sparseness of data; 

(3) status of data. 

The first point that has to be ascertained is whether the 
data available are applicable to the case in hand. There are 
various reasons why they may not be. The data may apply 
to equipment and/or conditions that are out of date. There 
may be significant differences between the equipment and/ 
or its situation. 

The design and environment in which equipment is used 
have a major influence on its failure rate. High failure rates 
can occur if equipment is highly rated or used in the wrong 
application. Operating practices affect the failure rate. 
Above all, failure rates can vary widely, depending on the 
maintenance regime. 

In some instances, it is possible to identify specific ways 
in which the situation to which the data apply differs from 
that under consideration. A not uncommon case is in which 
a particular failure mode is known to be much less frequent 
or even inapplicable. For example, pipeline failures due to 
corrosion have been much reduced by the use of cathodic 
protection. Similarly, changes to the design of rail tank cars 
for hazardous materials in the United States have reduced 
the probability of impact damage. It is, in principle, legiti¬ 
mate to adjust an estimate based on historical failure data to 
allow for changed conditions, although this should be done 
with care. 

Another common problem is that the data available are 
sparse. As described in Chapter 7, methods exist which 
allow estimates to be made of the confidence bounds on 
such data, but the bounds may be wide, and in any case 
uncertainty in the basic data complicates the assessment. 

Usually the frequency data used come from a number of 
different sources and have varying statuses. Data statuses 
include 

(1) historical data 

(a) numerous, 

(b) sparse; 

(2) synthesized values; 

(3) expert judgements 

(a) amenable to improvement, 

(b) unamenable to improvement.x 

If it is not practical to obtain direct data on the frequency 
of an event, it is often possible to obtain a value indirectly 



9/12 HAZARD ASSESSMENT 


by synthesis using tree methods. The most commonly used 
method is the fault tree, but the event tree can also be used. 

A fault tree is typically used to estimate the frequency 
where the failure is such that the system or situation which 
gives rise to it is sufficiently complex as to render it rela¬ 
tively unique. In such a case historical failure data will not 
be available. One important feature that tends to render a 
system unique is the use of protective systems. Fault tree 
methods are described in Section 9.5. 

Events that present a threat to the public are also rela¬ 
tively rare and unique, and again it may be necessary to 
resort to synthesis to obtain a value for the frequency. Such 
an event is the outcome of a chain of events following a 
release. The frequency may be obtained using an event tree. 
Event tree methods are described in Section 9.6. 

In some cases historical data are not obtainable. In this 
case an approach that is increasingly used is that of expert 
judgement. Expert judgement methods are described in 
Section 9.9. 

9.5 Fault Trees 

A fault tree is used to develop the causes of an event. It 
starts with the event of interest, the top event, such as a 
hazardous event or equipment failure, and is developed 
from the top-down. 

Accounts of fault trees are given in Reliability and Fault 
Tree Analysis (Barlow, Fussell and Singpurwalla, 1975), 
Fault Tree Handbook (Vesely et al., 1981), Engineering Reli¬ 
ability (Dhillon and Singh, 1981), Reliability Engineering and 
Risk Assessment (Henley and Kumamoto, 1981), Designing 
for Reliability and Safety Control (Henley and Kumamoto, 
1985) and Probabilistic Risk Assessment, Reliability Engi¬ 
neering, Design and Analysis (Henley and Kumamoto, 
1992), and by Vesely (1969, 1970a,b), Vesely and Narum 
(1970), Fussell (1973a, 1975, 1976, 1978b), Lawley (1974b, 
1980), Lapp and Powers (1977a, 1979), Vesely and Goldberg 
(1977b) and Kletz and Lawley (1982). 

The fault tree is both a qualitative and a quantitative 
technique. Qualitatively it is used to identify the individual 
paths that led to the top event, while quantitatively it is 
used to estimate the frequency or probability of that event. 

The identification of hazards is usually carried out using 
a method such as a hazard and operability (hazop) study. 
This may then throw up cases, generally small in number, 
where a more detailed study is required, and fault tree 
analysis is one of the methods that may then be used. 

Fault tree analysis is also used for large systems where 
high reliability is required and where the design is to 
incorporate many layers of protection, such as in nuclear 
reactor systems. 

With regard to the estimation of the frequency of events, 
the first choice is generally to base an estimate on historical 
data, and to turn to fault tree analysis only where data are 
lacking and an estimate has to be obtained synthetically. 

9.5.1 Fault tree analysis 

The original concept of fault tree analysis was developed 
at the Bell Telephone Laboratories in work on the safety 
evaluation of the Minuteman Launch Control System in the 
early 1960s, and wider interest in the technique is usually 
dated from a symposium in 1965 in which workers from 
that company (e.g. Mearns) and from the Boeing Company 
(e.g. Haasl, Feutz, Waldeck) described their work on fault 
trees (Boeing Company, 1965). 


Developments in the methodology have been in the 
synthesis of the tree, the analysis of the tree to produce 
minimum cut sets for the top event, and in the evaluation of 
the frequency or probability of the top event.There have also 
been developments related to trees with special features, 
including repair, secondary failures, time features, etc. 

A general account of fault tree methods has been given 
by Fussell (1976). He sees fault tree analysis as being of 
major value in 

(1) directing the analyst to ferret out failures deductively; 

(2) pointing out the aspects of the system important in 
respect of the failure of interest; 

(3) providing a graphical aid giving visibility to those in 
system management who are removed from system 
design changes; 

(4) providing options for qualitative or quantitative 
system reliability analysis; 

(5) allowing the analyst to concentrate on one particular 
system failure at a time; 

(6) providing the analyst with genuine insight into system 
behaviour. 

He also draws attention to some of the difficulties in fault 
tree work. Fault tree analysis is a sophisticated form of 
reliability assessment and it requires considerable time 
and effort by skilled analysts. Although it is the best tool 
available for a comprehensive analysis, it is not foolproof 
and, in particular, it does not of itself assure detection of all 
failures, especially common cause failures (CCFs). 

9.5.2 Basic fault tree concepts 

A logic tree for systembehaviour may be oriented to success 
or failure. A fault tree is of the latter type, being a tree in 
which an undesired or fault event is considered and its cau¬ 
ses are developed. Adistinction is made between a failure of 
and a fault in a component. A fault is an incorrect state that 
may be due to a failure of that component or may be induced 
by some outside inf luence.Thus fault is a wider concept than 
failure. All failures are faults, but not all faults are failures. 

A component of a fault tree has one of two binary states: 
essentially it is either in the correct state or in a fault state. 
In other words, the continuous spectrum of states from 
total integrity to total failure is reduced to just two states. 
The component state that constitutes a fault is essentially 
that state which induces the fault that is being developed. 

As a logic tree, a fault tree is a representation of the sets 
of states of the system that are consistent with the top event 
at a particular point in time. In practice, a fault tree is gen¬ 
erally used to represent a system state that has developed 
over a finite period of time, however short. This point is 
relevant to the application of Boolean algebra. Strictly, the 
implication of the use of B oolean algebra is that the states of 
the system are contemporaneous. 

Faults may be classed as primary faults, secondary faults 
or command faults. A primary fault is one that occurs when 
the component is experiencing conditions for which it is 
designed, or qualified. A secondary fault is one that occurs 
when the component is experiencing conditions for which it 
is unqualified. A command fault involves the proper opera¬ 
tion of the component at the wrong time or in the wrong place. 

A distinction is made between failure mechanism, fail¬ 
ure mode and failure effect. The failure mechanism is the 
cause of the failure in a particular mode and the failure 
effect is the effect of such failure. For example, failure of a 



HAZARD ASSESSMENT 9/13 


light switch may occur as follows: 

Failure mode - high contact resistance 

Failure mechanism - corrosion 

Failure effect — switch fails to make contact 

Some components are passive and others active. Items 
such as vessels and pipes are passive, whilst those such 
as valves and pumps are active. A passive component is 
a transmitter or recipient in the fault propagation 
process, an active one can be an initiator. In broad terms, 
the failure rate of a passive component is commonly two or 
three orders of magnitude less than that of an active com¬ 
ponent. 

There is a distinction to be made between the occurrence 
of a fault and the existence of a fault. Interest may centre on 
the frequency with which or probability that a fault occurs, 
that is, on the unreliability, or on the probability that at 
any given moment the system is in a fault state, that is, on 
the unavailability. The distinction between reliability and 
availability was discussed in detail in Chapter 7. 

The simplest case is the determination of the reliability 
of a non-repairable system. This is sometimes known as the 
‘mission problem’: the system is sent on a mission in which 
components that fail are not repaired. The obvious example 
is space missions, but there are cases in the process indus¬ 
tries that may approximate to this, such as remote pumping 
stations or offshore subsea modules. The availability of a 
non-repairable system may also be determined, but the 
long-term availability, which is usually the quantity of 
interest, tends to zero. 

Generally, however, process systems are repairable 
systems, and for these both reliability and availability may 
be of interest. If concern centres on the frequency of 


realization of a hazard, it is the reliability that is relevant. If, 
on the other hand, the concern is with the fractional down¬ 
time of some equipment, it is the availability that is required. 

A fault tree may be analysed to obtain the minimum cut 
sets, or minimum sets of events that can cause the top event 
to occur. Discussion of minimum cut sets is deferred to 
Section 9.5.8, but it is necessary to mention them at this 
point since some reference to them in relation to fault tree 
construction is unavoidable. 

9.5.3 Fault tree elements and symbols 

The basic elements of a fault tree may be classified as (1) the 
top event, (2) primary events, (3) intermediate events and 
(4) logic gates. 

The symbols most widely used in process industry fault 
trees are shown in Table 9.5. The British Standard sy mbols 
are given in BS logic 5760 Reliability of Systems, Equipment 
and Components, Part 7:1991 Guide to Fault Tree Analysis. 
For the most part the symbols shown in Table 9.5 corre¬ 
spond to those in the Standard, but in several cases the 
symbols in the table are the Standard’s alternative rather 
than preferred symbols. 

The top event is normally some undesired event. Typical 
top events are flammable or toxic releases, fires, explosion 
and failures of various kinds. 

Primary events are events that are not developed further. 
One type of primary event is a basic event, which is an 
event that requires no further development. Another is 
an undeveloped event, which is an event that could be 
developed, but has not been. One common reason for not 
developing an event is that its causes lie outside the system 
boundary. The symbol for such an undeveloped event is a 
diamond and this type is therefore often called a ‘diamond 
event’. A third type of primary event is a conditioning 
event, which specifies conditions applicable to a logic gate. 


Table 9.5 Fault tree event and logic symbols 
A Events 

Symbol 


6 

<e> 



-CD 

6 


Primary, or base, event - basic fault event requiring no further development 


Undeveloped, or diamond, event — fault event which has not been further 
developed 


Intermediate event - fault event which occurs due to antecedent causes acting 
through a logic gate 


Conditioning event - specific condition which applies to a logic gate (used 
mainly with PRIORITY, AND and INHIBITgates) 

External, or house, event - event which is normally expected to occur a 
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Table 9.5 (continued) 

B Logic gates, etc. 

Symbol Alternative 

symbol 


0 

0 


AND gate - output exists only if all inputs exist 


OR gate - output exists if one or more inputs exists 



6 


A 


PRIORITY AND gate - output exists if all inputs occur in a specific sequence 
(specified by conditioning event to right of gate) 


EXCLUSIVE OR gate - output exists if one, and only one, input exists 



VOTING gate - output exists if there exist r-out-of-n inputs b 


TRANSFER IN — symbol indicating that the tree is developed further at the 
corresponding TRANSFER OUT symbol 


TRANSFER OUT -symbol indicating that the portion of the tree below the 
symbol is to be attached to the main tree at the correspondingTRANSER IN 
symbol 


“This is the definition given by Vesely etal. (1981). Other authors such as Henley and Kumamoto (1981) use this symbol for an event which i 
b See Chapter 13. 


A fourth type of event is an external event, which is an 
event that is normally expected to occur. 

Intermediate events are the events in the tree between the 
top event and the primary events at the bottom of the tree. 

Logic gates define the logic relating the inputs to the 
outputs. The two principal gates are the AND gate and 
the OR gate. The output of an AND gate exists only if all the 


inputs exist. The output of an OR gate exists provided at 
least one of the inputs exists. The probability relations 
associated with these two gates are shown in Table 9.6, 
Section A. Other gates are the EXCLUSIVE OR gate, the 
PRIORITY AND gate and the INHIBIT gate. The output of 
an EXCLUSIVE OR gate exists if one, and only one, input 
exists. The output of a PRIORITY AND gate exists if the 
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Table 9.6 Probability and frequency relations for fault tree logic gates (output A; inputs B and C) 

A Basic probability relations 3 

Logic symbol Reliability graph Boolean algebra relation Probability relations 


A = BC P(A) = P(B)P(C) 


A = B + C P(A) = P(B) + P(C) - P(B)P(C) 


B Relations involving frequencies and/or probabilities 3 


Gate 

Inputs 

Outputs 

OR 

Pp OR P c 

Pa=Pb + Pc~ PbPc « Pb + Pc 


F P , OR F c 

f a =f b +f c 


Fp OR P c 

Not permitted 

AND 

Pp AND P c 

Pa =PpPc 


Fp AND F c 

Not permitted; reformulate 


f b and p c 

Fa = FbPc 


a F, frequency; P, probability. 


^ — 

B C 

6 <o 


inputs occur in the sequence specified by the associated 
conditioning event. The output of an INHIBITgate exists if 
the (single) input exists in the presence of the associated 
conditioning event. There are also symbols for TRANSFER 
IN and TRANSFER OUT, which allow a large fault tree to 
be drawn as a set of smaller trees. 


9.5.4 AND gates 

One of the two principal logic gates in a fault tree is 
the AND gate. AND gates are used to represent a number 
of different situations and therefore require further 
explanation. The following typical situations can be 
distinguished; 

(1) output exists given an input and fault on a protective 
action; 

(2) output exists given an input and fault on a protective 
device; 

(3) output exists given faults on two devices operating in 
parallel; 

(4) output exists given faults on two devices, one operat¬ 
ing and one on standby. 

In constructing the fault tree the differences between 
these systems present no problem, hut difficulties arise at 
the evaluation stage. 

As already described, the probability p 0 that the output 
of a two-input AND gate exists, given that the probabilities 
of the inputs are p 1 and p 2 , is 


The occurrence of events may be expressed quantita¬ 
tively in terms of frequency or of probability. Failure 
of equipment is normally expressed as a frequency and 
failure of a protective action or device as a probability 
A protective device is normally subject to unrevealed 
failure and needs therefore to be given a periodic proof test. 
Data for the failure of such a device maybe available either as 
probability of failure on demand, or as frequency of failure. 
As described in Chapter 13, it can be shown that, subject to 
certain assumptions, the relationship between the two is 

p = Ai v /2 [9.5.2] 

where/) is the probability of failure, A is the failure rate and 
t p is the proof test interval. 

Then for aType 1 situation the frequency Ao of a fault is 
Ao = Ap [9.5.3] 

where p is the probability of failure of the protective action, 
A is the frequency of the input event and A 0 is the frequency 
of the output event. 

For aType 2 situation, Equation 9.5.3 is again applicable, 
with the probability/) of failure of protective action in this 
case being obtained from Equation 9.5.2. 

The evaluation of a Type 3 situation is less straight¬ 
forward. For this, use maybe made of the appropriate parallel 
system model derived from either the Markov or j oint density 
function methods, described in Chapter 7. These give the 
probability of the output event given the frequency of the 
input events.Where applicable, the rare event approximation 
maybe used to convert from probability to frequency: 


[9.5.1] 


A=p/t 


[9.5.4] 
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Similarly, for a Type 4 situation use may be made of the 
appropriate standby system model. 

9.5.5 Fault tree construction 

The construction of a fault tree appears a relatively simple 
exercise, but it is not always as straightforward as it 
seems and there are a number of pitfalls. Guidance on good 
practice in fault tree construction is given in the Fault Tree 
Handbook. Other accounts include that in the CCPS QRA 
Guidelines, and those by Lawley (1974b, 1980), Fussell 
(1976) and Doelp et al. (1984). 

An essential preliminary to construction of the fault 
tree is definition and understanding of the system. Both the 
system itself and its bounds need to be clearly defined. 
Information on the system is generally available in the form 
of functional diagrams such as piping and instrument 
diagrams and more detailed instrumentation and electrical 
diagrams. There will also be other information required on 
the equipment and its operation, and on the environment. 
The quality of the final tree depends crucially on a good 
understanding of the system, and time spent on this stage 
is well repaid. 

It is emphasized by Fussell (1976) that the system 
boundary conditions should not be confused with the 
physical bounds of the system. The system boundary condi¬ 
tions define the situation for which the fault tree is to be 
constructed. An important system boundary condition is 
the top event. The initial system configuration constitutes 
additional boundary conditions. This configuration should 
represent the system in the unfailed state. Where a compo¬ 
nent has more than one operational state, an initial condi¬ 
tion needs to be specified for that component. Furthermore, 
there may be fault events declared to exist and other fault 
events not to be considered, these being termed by Fussell 
the ‘existing system boundary conditions’ and the ‘not- 
allowed system boundary conditions’, respectively. 

Fault trees for process plants fall into two main groups, 
distinguished by the top event considered. The first group 
comprises those trees where the top event is a fault within 
the plant, including faults that can result in a release or an 
internal explosion. In the second group, the top event is a 
hazardous event outside the plant, essentially fires and 
explosions. 

If the top event of the fault tree is an equipment failure, it 
is necessary to decide whether it is the reliability, avail¬ 
ability, or both, which is of interest. Closely related to this is 
the extent to which the components in the system are to be 
treated as non-repairable or repairable. 

As already described, the principal elements in fault 
trees are the top event, primary events and intermediate 
events, and the AND and OR gates. The Handbook gives five 
basic rules for fault tree construction: 


Ground Rule 1 Write the statements that are 

entered in the event boxes as 
faults; state precisely what the 
fault is and when it occurs. 

Ground Rule 2 If the answer to the question, 

‘Can this fault consist of a 
component failure?’ is ‘Yes’, 
classify the event as a ‘state-of- 
component fault’. If the answer is 
‘No’, classify the event as a‘state- 
of-system fault’. 


No Miracles Rule If the normal functioning of a 

component propagates a fault 
sequence, then it is assumed 
that the component functions 
normally. 

Complete-the-Gate Rule All inputs to a particular gate 
should be completely defined 
before further analysis of any 
one of them is undertaken. 

No Gate-to-Gate Rule Gate inputs should be properly 
defined fault events, and gates 
should not be directly connected 
to other gates. 

Each event in the tree, whether a top, intermediate or 
primary event, should be carefully defined. Failure to 
observe a proper discipline in the definition of events can 
lead to confusion and an incorrect tree. 

The identifiers assigned to events are also important. If a 
single event is given two identifiers, the fault tree itself maybe 
correct, if slightly confusing, but in the minimum cut sets the 
event will appear as two separate events, which is incorrect. 

For a process system, the top event will normally be a 
failure mode of an equipment. The immediate causes will 
be the failure mechanisms for that particular failure. These 
in turn constitute the failure modes of the contributing 
subsystems, and so on. 

The procedure followed in constructing the fault tree 
needs to ensure that the tree is consistent. Two types of 
consistency may be distinguished: series consistency 
within one branch and parallel consistency between two or 
more branches. Account needs also to be taken of events 
that are certain to occur and those that are impossible. 

The development of a fault tree is a creative process. It 
involves identification of failure effects, modes and 
mechanisms. Although it is often regarded primarily as a 
means of quantifying hazardous events, which it is, the 
fault tree is of equal importance as a means of hazard 
identification. It follows also that fault trees created by 
different analysts will tend to differ. The differences may 
be due to style, judgement and/or omissions and errors. 

It is generally desirable that a fault tree has a well-defined 
structure. In many cases such a structure arises naturally. It 
is common to create a ‘demand tree’, which shows the propa¬ 
gation of the faults in the absence of protective systems, and 
then to add branches, representing protection by instru¬ 
mentation and by the process operator, which are connected 
by AND gates at points in the demand tree. An example of 
a fault tree constructed in this way has been given in 
Figure 2.2. Essentially the same fault tree may be drawn 
in several different ways, depending particularly on the 
location of certain events that appear under AND gates. 

9.5.6 Dependence 

A fundamental assumption in work on reliability generally 
and on fault trees in particular, is that the events con¬ 
sidered are independent, unless stated otherwise. Formally, 
the events are assumed to be statistically independent, or 
‘s-independent’. In practice, there are many types of situa¬ 
tion where events are not completely independent. In fault 
tree work this problem was originally known as ‘common 
mode failure’ (CMF), then as ‘common cause failure’, and 
now more usually as ‘dependent failure’. 

The problem is particularly acute in systems, such as 
nuclear reactor systems, where a very high degree of 
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reliability is sought. The method of achieving this is 
through the use of protective systems incorporating a 
high degree of redundancy. On paper, the assessed reli¬ 
abilities of such systems are very high. But there has 
been a nagging worry that this protection may be defeated 
by the phenomenon of dependent failure, which may 
take many and subtle forms. Concern with dependent fail¬ 
ure is therefore high in work on fault trees for nuclear 
reactors. 

Dependent failure takes various forms. In most cases 
it requires that there be a common susceptibility in the 
component concerned. Some situations which can cause 
dependent failure include: (1) a common utility; (2) a com¬ 
mon defect in manufacture; (3) a common defect in appli¬ 
cation; common exposure to (4) a degrading factor, (5) an 
external influence, or (6) a hazardous event; (7) inap¬ 
propriate operation and (8) inappropriate maintenance. 

Perhaps the most obvious dependency is supply from a 
common utility such as electric power or instrument air. 
Equipment may suffer common defects either due to 
manufacture or to specification and application. Common 
degrading factors are vibration, corrosion, dust, humidity 
and extremes of weather and temperature. External influ¬ 
ences include such events as vehicle impacts or earthquakes. 
An event such as a fire or explosion may disable a number of 
equipments. Equipment may suffer abuse from operators 
or may be maintained incorrectly. It will be clear that in 
such cases redundancy may be an inadequate defence. 

Generally, a common location is a factor in interpreting 
this fairly broadly. But it is by no means essential. In par¬ 
ticular, incorrect actions by a maintenance fitter can dis¬ 
able similar equipments even though the separation 
between the items is appreciable. 

A type of dependent failure that is important in the pre¬ 
sent context is that resulting from a process accident. A 
large proportion of equipments, including protective and 
fire fighting systems, may be susceptible to a major fire or 
explosion, just at the time when they are required. 

There is some evidence that dependent failure is asso¬ 
ciated particularly with components where the fault is 
unrevealed. Thus a study of nuclear reactor accident 
reports by J.R. Taylor (1978b) showed that of the dependent 
failures considered only one was not associated with a 
standby or intermittently operated system. 

Not all dependent failures involve redundant equipment. 
Another significant type of dependent failure is the over¬ 
load that can occur when one equipment fails and throws a 
higher load on another operating equipment. Failures 
caused by domino effects, and escalation faults generally, 
may also be regarded as dependent failures. 

Dependent failure, then, is a crucial problem in high 
reliability systems. A more detailed account is therefore 
given in Section 9.8. Here further discussion is confined to 
fault tree aspects. 

Dependent failure can be taken into account in a fault tree 
only if the potential for it is first recognized. Given that this 
potential has been identified, there are two ways of repre¬ 
senting it in the tree. One is to continue to enter each fault 
separately as it occurs in the tree, but ensuring that each 
such entry is assigned the same identifier, so that the mini¬ 
mum cut sets are determined correctly. The other approach 
is to enter the effect as a single fault under an AND gate 
higher up the tree. A further measure that may be taken 
to identify dependent failure is to examine the minimum 
cut sets for common susceptibilities or common locations. 


9.5.7 Illustrative example: instrument air receiver system 

As an illustration of fault tree analysis, consider the system 
shown in Figure 9.3(a). The vessel is an air receiver for an 
instrument air supply system. Air is let down from the 
receiver to the supply through a pressure reducing valve. 
The pressure in the receiver is controlled by a pneumatic 
control loop that starts up an air compressor when the 
receiver pressure falls below a certain value. The instru¬ 
ment air supply to the control loop is taken from the 
instrument air supply described, and if the pressure in the 
supply system falls below a certain value this too causes 
the control loop to start up the compressor. There is a pres¬ 
sure relief valve on the receiver. There is also a pressure 
relief valve (not shown) on the instrument air supply sys¬ 
tem. The design intent is that the pressure relief valve on the 
air receiver is sized to discharge the full throughput of the 
compressor and is set to open at a pressure below the danger 
level and that the pressure reducing valve is sized to pass the 
full throughput of the compressor if the instrument air 
pressure downstream falls to a very low value. One of the 
main causes of failure in the system is likely to be dirt. 

The top event considered is the explosion of the air 
receiver due to overpressure. A fault tree for the top event of 
‘Receiver explosion’ is shown in Figure 9.3(b). 

One fault event occurs in two places - ‘Pressure reducing 
valve partially or completely seized shut or blocked’. This is 
drawn as a subtree. One primary failure event appears at 
several points in the tree - ‘Dirt’. As shown, this is treated 
in the tree as separate primary failures for the pressure 
reducing valve and the pressure relief valve. 

Two of the events in the tree are mutually exclusive. 
These are ‘Instrument air system pressure abnormally 
high’ and ‘Instrument air pressure abnormally low’. These 
events are denoted by B and B*, respectively. 

The analysis of this fault tree to obtain the minimum cut 
sets and the probability of occurrence of the top event is 
described below. 


9.5.8 Minimum cut sets 

A fault tree may be analysed to obtain the minimum cut 
sets. A cut set is a set of primary events that is of basic or 
undeveloped faults, which can give rise to the top event. A 
minimum cut set is one that does not contain within itself 
another cut set. The complete set of minimum cut sets is the 
set of principal fault modes for the top event. 

The minimum cut sets may be determined by the appli¬ 
cation of Boolean algebra. The procedure may be illustrated 
by reference to the fault tree shown in Figure 9.3(b). This 
may be represented in Boolean form as: 

T=(A + B + C + D)(B* + F)(G + H +1) [9.5.5] 

Then substituting 

B* = C + D + E 

and noting that: BB* = 0 

CC = C; DD = D 

AC, CD, CE, CF c C 

AD, DC,DE,DF c D 
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T=(AE + AF + BF + C + D)-(G + H + I) [9.5.6a] 
• [A • (E + F) +BF + C + D] -(G + H + I) [9.5.6b] 

and thus the minimum cut sets are: 

AEG A E H A E I 

AFG A F H A F I 

BEG BFH BFI 

CG CH Cl 

DG DH DI 

A simplified fault tree that corresponds to Equation 9.5.6b 
is shown in Figure 9.3(c). 


Since fault trees for industrial systems are often large, 
it is necessary to have systematic methods of determin¬ 
ing the minimum cut sets. Such a method is that 
described hy Fussell (1976). As an illustration of this 
method, consider the motor system which is described hy 
this author and which is shown in Figure 9.4(a). The top 
event considered is the overheating of the motor. The 
fault tree for this event is shown in Figure 9.4(b). The 
structure of the tree is: 


Gate 

Gate type 

No. of inputs 

Input code 

No. 

A 

OR 

2 

1 

B 

B 

AND 

2 

C 

2 

C 

OR 

2 

4 

3 


0 “ 




(a) 



Figure 9.3 continued 




















Figure 9.3 Instrument air receiver system: flow diagram and fault trees for the explosion of an air receiver: (a) instrument air receiver system; (b) fault tree for top event 
‘Receiver explodes’; (c) equivalent but simplified fault tree for top event ‘Receiver explodes’ 
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(b) 


Figure 9.4 Motor system: system diagram and fault tree 
for overheating of the motor (Fussell, 1976): (a) motor 
system; and (b) fault tree for top event ‘Motor overheats’ 
(Courtesy of the Sijthoff and Noordhoff International 
Publishing Company) 


The procedure is based on successive elimination of the 
gates. The analysis starts with a matrix containing the first 
gate, gate A, in the top left-hand corner: 


A is an OR gate and is replaced by its inputs listed 
vertically: 


B 


B is an AND gate and is replaced by its inputs listed 
horizontally: 


C 2 


C is an OR gate and is replaced by its inputs listed 
vertically: 


4 2 


3 2 


It should be noted that when C is replaced by 4 and 3, the 
event 2, which is linked to C by an AND gate, is listed with 
both events 4 and 3. The minimum cut sets are then: 

(1); (4,2); (3,2) 

There are now a large number of methods available for 
the determination of the minimum cut sets of a fault tree. 
Methods include those described by Vesely (1969,1970b), 
Gangadharan, Rao and Sundararajan (1977), Zipf (1984) 
and Camarinopoulos and Yllera (1985). 

There are also a number of computer codes for minimum 
cut set determination. One of the most commonly used is 
the code set PREP and KITT. Another widely used mini¬ 
mum cut set code is FTAP. 

9.5.9 Coherence of tree 

The structure of a fault tree is either coherent or non¬ 
coherent. The property of coherence has been developed by 
Esary and Proschan (1963) as follows. 

They define a structure function 0(x) such that it has 
three properties. 

Property 1: 


#(*) > Hy) * > y 9.5 7: 

Property 2: 

0(x)=l x 1 [9.5.8] 

Property 3: 

0M=O x = 0 


[9.5.9] 
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where x is the vector [x lt x 2 ,.. .,x„] and y the vector 
[yi, y&- ■ - ,yn ]■ For each component i, has the value 1 if 
the component is functioning and 0 if it is failed; x > y 
signifies Xi >y,- for all i. A structure that has such a struc¬ 
ture function is coherent or monotonic. In plain language, 
this means that: 


(1) Property 1 If sufficient components are functioning 
for the system to be functioning, the functioning of an 
additional component will not cause the system to fail; 
and if sufficient components are failed for the system 
to be failed, the failure of an additional com-ponent 
will not cause the system to function. 

(2) Property 2 If all the components are functioning, the 
system is functioning. 

(3) Property 3 If all the components are failed, the system 
is failed. 

Coherence is of interest to reliability engineers because, 
given the property of coherence, it is possible to derive a 
number of useful relationships for bounds on the behav¬ 
iour of large systems. 

For fault trees the property of coherence depends 
partly on the logic gates and partly on the events. A fault 
tree structure which consists exclusively of AND and 
OR gates is generally coherent, but one which includes 
other types of gate may not be. Thus the presence of 
an EXCLUSIVE OR gate can render a structure non¬ 
coherent. For example for a two-input EXCLUSIVE OR 
gate, if one input fault to the gate exists, the output fault 
exists, but if a second input fault occurs, the output fault 
disappears. 

However, coherence is also affected by the nature of the 
events. A structure that contains a secondary failure is 
generally non-coherent. As already described, a secondary 
failure is one that occurs because the component is over¬ 
stressed. This component is not necessarily restored by 
restoration of the other components. 

An EXCLUSIVE OR gate was used in the classic nitric 
acid cooler problem considered by Lapp and Powers (1977a, 
1979), which has been the subject of comment by Locks 
(1979) and others. A review of non-coherent structure and 
its bearing on fault tree work has been given by Johnston 
and Matthews (1983 SRD R245). 


9.5.10 Fault trees and digraphs 

A fault tree is one type of model of the propagation of faults 
in a process plant. The construction of the tree may be aided 
by the use of other models of fault propagation. A widely 
used method of constructing fault trees is to develop first 
a directed graph, or digraph, representing the fault pro¬ 
pagation in the plant. A single digraph may be used to 
construct a number of fault trees, depending on the top 
events selected. Accounts of the use of digraphs for fault 
tree construction include those by Lambert (1975), Lapp 
and Powers (1977a, 1979), Chamow (1978), Andrews and 
Morgan (1986) and Kohda and Henley (1988). 


9.5.11 Fault tree evaluation 

A fault tree is a graphical representation of the fault paths 
and logic of a system and is of value as such. There are, 
however, a number of methods of fault tree evaluation that 


greatly enhance its utility. These methods are both quali¬ 
tative and quantitative. 

Qualitative evaluation is largely based on the deter¬ 
mination of the minimum cut sets. The minimum cut sets 
and methods for their determination have been described 
in Section 9.5.8. One form of qualitative evaluation 
that is particularly useful is the determination of the 
importance of the primary events. This is described in 
Section 9.5.12. 

Quantitative evaluation of a fault tree requires that 
numbers be put to the frequency or probability of the 
primary events. Given these quantitative data, there are 
several options for the evaluation of the frequency or 
probability of the top event. 

Three methods of evaluation are considered here. These 
are the use of (1) the minimum cut sets, (2) the gate-by-gate 
method and (3) Monte Carlo simulation. 

In the first of these methods, the probability of the 
top event may be evaluated from the probabilities of the 
minimum cut sets C,- 

P(T)=p(yq) [9.5.1BJ 

The events are not mutually exclusive and, therefore, 
strictly 

P(T) = P(Ci) + P(C 2 ) + • • • + P(C„) - P(Ci)P(C 2 ) 

-P(Ci)P(C 3 )-P(C„_i)P(C„) 

+ P(Ci)P(C2)P(C 3 ) +P(Ci)P(C 2 )P(C 4 ) 

+ ---+P(C„_ 2 )P(C b _ 1 )P(C k ) 

+ "'+Hr’fp(Q) P&si] 

But usually it is sufficient to use the low probability, or 
rare event, approximation 

P(T) = £p(G) [9.5.12] 

Equation 9.5.12 always gives a higher probability than 
Equation 9.5.11 and thus for failure oriented logic it is 
conservative. 

As an illustration, consider the evaluation of the prob¬ 
ability of the top event in the fault tree for the instrument 
air receiver system as given in Figure 9.3(c). The minimum 
cut sets have been listed above. Assume that 

P A = 10“ 5 P D = 2 x 10 -3 P G = 10 -3 

P B = 3 x Hr 5 Pe = HU 3 Pa = 8x 10“ 3 

P c = 2 x 10 -3 P F = 5 x 10 -4 Pi = 2 x 10" 3 

Then, for the first minimum cut set AEG, 

P(C,) =P a PrP g 

» 1(T 5 x 1(T 3 x 1(T 3 
»IQ” 11 
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and so on for the other 14 cut sets. Alternatively, from 
Equation 9.5.12, 

P( T) = J2P( Q) = [P a (Pe + P f )+P b P f + P c + P d ] 

x(P G + P n +Pi) 

:fc [10- 5 (10“ 3 + 5 X 10“ 4 ) 

+ (3 x HT 5 x 5 x HT 4 ) 

+ (2 x 10 -3 + 2 x 10 -3 )] 
x (1(T 3 + 8 x HT 3 + 2 x 1(T 3 ) 

.= 4.4 x 1(T 5 

This form of the minimum cut set method is applicable 
where the occurrence of the primary events can be char¬ 
acterized by simple probabilities. More commonly the 
occurrence of these events is characterized by a mix of fre¬ 
quencies and probabilities. Furthermore, it may be neces¬ 
sary to take into account repair of components. An account 
of an approximate method of handling systems in which 
event rates are expressed as frequencies and which involve 
repair is given in Section 9.5.15. 

The second method is to work up the tree gate-by-gate 
from the bottom calculating the frequency or probability of 
the output event of each gate from those of the input events. 
The procedure is straightforward except where there occur 
at the gate, some input faults which are expressed in terms 
of frequency rather than probability. 

The output-input relations which are permitted and 
those that are not are given for a two-input gate inTable 9.6, 
Section B. The main problem arises where the two inputs to 
an AND gate both have the dimensions of frequency. The 
output from the gate must also have the dimension of 
frequency. It is not permissible to multiply the two fre¬ 
quencies together. 

The handling of an AND gate where the two inputs both 
have the dimension of frequency is discussed in Section 
9.5.4. Two main situations occur: one is where both the 
components whose faults are the inputs to the gate are 
operating, and the other is where one component is oper¬ 
ating and the other is on standby. As indicated in the Sec¬ 
tion 9.5.4, both situations can be handled by the use of 
suitable models derived from Markov modelling. 

Use may also be made of the alternative model given in 
Equations 7.8.28-7.8.31, which in effect utilizes a repair 
time to convert one of the frequencies to a fractional 
downtime, or probability. 

Accounts of the gate-by-gate method are given in the 
CCPS QRA Guidelines and by Doelp etal. (1984). The meth¬ 
od is illustrated in the fault trees given by Lawley (1974b, 
1980), one of which is described in Section 9.5.14. 

There are advantages and disadvantages to both the 
gate-by-gate and minimum cut set methods. The former is 
the method traditionally used in manual evaluation of 
trees. It gives an evaluation of all the intermediate events as 
well as of the top event, which can be valuable. On the other 
hand, it tends to be error prone and becomes tedious for 

The third method is the use of Monte Carlo simulation. 
The basic principle of this method has been described in 
Chapter 7. Its application to fault tree evaluation involves 
a series of trials. In a given trial each primary event either 


does or does not occur, the occurrence being determined by 
sampling, where the values returned by the sampling are, 
on average, in accordance with the frequency or probability 
data supplied.The outcome of each trial is the occurrence or 
non-occurrence of the top event. Provided a sufficient 
number of trials are used, the frequency or probability of 
the top event is then given by the proportion of trials in 
which it occurs. An account of the use of this method for 
fault tree evaluation has been given by Hauptmanns and 
Yllera (1983). 

The use of Monte Carlo simulation is virtually unavoid¬ 
able if the primary events are characterized by a range of 
values of probability, or frequency. The probability of a 
failure may be given not by a point probability value but by 
a probability density function. Obviously if the prob¬ 
abilities of the other events are expressed as density func¬ 
tions, then the probability of the top event must be 
expressed as a density function also. 

A given Monte Carlo trial generates a set of probabilities 
for the primary failure events. The probability of the top 
event may then be evaluated by an analytical method, such 
as the minimum cut set method. The result of the series of 
trials is a probability density function for the top event. The 
principle of the method is illustrated in Figure 9.5. Monte 
Carlo simulation was used extensively for fault tree evalu¬ 
ation in the Rasmussen Report. 

9.5.12 Importance of events 

Since the number of primary events that, either serially or 
in combination, can cause the top event to occur can be 
large, it is very desirable to have means of assessing their 
relative significance. Primary events have the property 
of ‘importance’. There are a number of measures of 
importance. Some of these rely solely on structural con¬ 
siderations, while others are based on probabilities. In 
other words, there are both qualitative and quantitative 
measures. 

A simple approach to structural importance may be 
illustrated by the following minimum cut sets of events 
given in Section 9.5.8: (1); (4,2); (3,2). 

The order of importance is then: events in one-event 
minimum cuts, events common to two-event minimum cut 
sets, events in two-event minimum cut sets, and so on. 
Thus, in the example given, the order of importance is: 

2 

3,4 

There are a number of quantitative measures of impor¬ 
tance that may be calculated if frequency or probability 
data are available. These include the Birnbaum criterion, 
which is the incremental reduction in the probability of the 
top event where the probability of the primary event is 
reduced incrementally, and the Vesely-Fussell criterion, 
which is theprobability that acut set containing theprimary 
event has occurred given that the top event has occurred. 

Formal methods of determining importance have been 
given by Lambert and Oilman (1977a,b), who have devel¬ 
oped the computer code IMPORTANCE for such analysis. 

9.5.13 Illustrative example: pressure tank system 

As another illustration, consider the fault tree for the 
pressure tank system described by Vesely et al. (1981). 
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Figure 9.5 Fault tree illustrating the principle of probabilities expressed in the form of density functions and of 
evaluation by Monte Carlo simulation, X, Failure frequency; a , failure probability; p, probability of given value ofX or p, 


This system is shown in Figure 9.6. The authors describe 
the system as follows: 


The function of the control system is to regulate the opera¬ 
tion of the pump. The latter pumps fluid from an infi¬ 
nitely large reservoir into the tank. We shall assume 
that it takes 60 seconds to pressurize the tank. The 
pressure switch has contacts that are closed when the 
tank is empty. When the threshold pressure has been 
reached, the pressure switch contacts open, removing 
power from the pump, causing the pump motor to 
cease operation. The tank is fitted with an outlet valve 
that drains the entire tank in a negligible time; the 
outlet valve, however, is not a pressure relief valve. 
When the tank is empty, the pressure switch contacts 
close and the cycle is repeated. 

Initially the system is considered to be in its dormant mode: 
switch SI contact open, relay K1 contacts open, and 
relay K2 contacts open: i.e., the control system is de¬ 
energized. In this de-energized state the contacts of 
the timer relay are closed. We will also assume that the 
tank is empty and the pressure switch contacts are 
therefore closed. 

System operation is started by momentarily depressing 
switch SI. This applies power to the coil of relay Kl, 
thus closing relay Kl contacts. Relay Kl is now elec¬ 
trically self-latched. The closure of relay Kl contacts 
allows power to be applied to the coil of relay K2, 
whose contacts close to start up the pump motor. 


The timer relay has been provided to allow emergency shut¬ 
down in the event that the pressure switch fails closed. 
Initially the timer relay contacts are closed and the 
timer relay coil is de-energized. Power is applied to the 
timer coil as soon as relay Kl contacts are closed. This 
starts a clock in the timer. If the clock registers 
60 seconds of continuous power application to the 
timer relay coil, the timer relay contacts open (and 
latch in that position), breaking the circuit to the Kl 
relay coil (previously latch closed) and thus producing 
system shutdown. In normal operation, when the 
pressure switch contacts open (and consequently 
relay K2 contacts open), the timer resets to 0 seconds. 

The top event considered is ‘Rupture of pressure tank 
after the start of pumping’. The fault tree developed by 
Vesely et al. for this event is shown in Figure 9.7. The 
detailed development of this fault tree is described by 
Vesely et al. and need not be given here, but the following 
points may be noted. 

If the undeveloped events are disregarded, this fault tree 
reduces to that indicated by the events E1-E5, Kl, K2, R, S, 
SI and T shown in Figure 9.7. The top event El and the 
intermediate events E2—E5 in this tree are: 

El pressure tank rupture 
E2 excessive pressure to tank 
E3 current to K2 relay coil for too long 
E4 circuit B carries current for too long 
E5 current to Kl relay coil for too long 
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Figure 9.6 Pressure tank system: system diagram (Vesely et at., 1981) 


E2 is equivalent to K2 relay contacts closed for too long, and 
E5 to timer relay contacts failing to open when pressure 
switch contacts have been closed for too long. The cut sets 
for the top event of this fault tree may be obtained by 
applying Boolean algebra. Starting with the top event El: 

E1 = T + E2 

= T+(K2 + E3) 

= T + K2+(S-E4) 

= T + K2 + S • (SI + E5) 

= T + K2 + (S • SI) + (S • E5) 

= T + K2+(S-S1)+S-(K1 + R) 

= T + K2 + (S ■ SI) + (S • Kl) + (S • R) 

There are therefore five minimal cut sets: T, K2, (S-Sl), 
(S-Kl)and(S-R). 

Analysis of the tree at this stage gives qualitative 
information about the design of the system. The pressure 
tank system has in effect a single protective device, the 
timer relay, which protects against failure of the pressure 
switch. This is reflected in the fault tree which has a 
single AND gate. 

With regard to the qualitative importance of the events, 
K2 and T both occur in single event cut sets, but K2 is an 
active failure and T a passive one, and hence K2 ranks 
higher than T. Events S, SI, Kl and R each occur in two- 
event cut sets, but of these S occurs in all three cut sets, 


whereas the other three faults each occur only in one cut set 
and hence S ranks higher than the other three, which all 
rank equally. The order of importance is thus: K2; T; S; and 
SI, Kl and R. 

The failure probabilities given by Vesely etal. are: 


Component 

Symbol 

Failure probability 

Pressure 

T 

5 x 1(T 6 

Relay K2 

K2 

3 x 10“ 5 

Pressure 

S 

1 x 1(T 4 

Relay Kl 

Kl 

3 x 1(T 5 

Timer relay 

R 

lxl(T 4 

Switch SI 

SI 

3 x 1(T 5 


Then the probabilities of the minimum cut sets are: 
P(T) = 5 x 1(T 6 
P(K2) = 3 x 10“ 5 

P(S ■ Kl) = 1 x 10“ 4 x 3 x lCr® = 3 x 1(T 9 

P(S ■ R) = 1 x 10“ 4 x 1 x 10“ 4 = 1 x 10" 8 

P(S ■ SI) = 1 x 10- 4 x 3 x 1(T 6 = 3 x 10“ 9 

and the probability of the top event is the sum of these 

P(E1) = 3.5 x 1CT 5 
























HAZARD ASSESSMENT 9/25 



Figure 9.7 Pressure tank system: fault tree for rupture of pressure tank (after Vesely et al., 1981; Henley and 
Kumamoto, 1981) 
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The contribution of these minimum cut sets to the 
top event is a measure of their quantitative importance, 
and is: 


Cutset 

Importance (%) 

T 

14 

K2 

86 

Other 

<0.1 


9.5.14 Illustrative example: crystallizer system 

As a third illustrative example, consider the proposed 
crystallization plant system described by Lawley (1974b). 
This system is shown in Figure 9.8. The problem is to esti¬ 
mate the expected frequency of emission of the toxic and 
corrosive crystallizer slurry via the stack to the atmos¬ 
phere. There are two ways in which this can occur - by 
discharge at about atmospheric pressure or by discharge at 
high pressure — but only the former is considered here. If 
the stack base and luted drain are properly designed for the 
flow from the three reactors, a discharge of slurry at only a 
few pounds per square inch pressure would normally pass 
via the pressure control valve (PCV) header or the relief 
header to the stack and hence to the drain. If a blockage 
occurs in the stack or the drain, the discharge from 
the crystallizer will result in a build-up of liquid in the 
stack and eventually to entrainment of the slurry to the 
atmosphere. 

The top event considered is ‘Low pressure discharge of 
slurry to the atmosphere’. The fault tree developed by the 


author for this event is shown in Figure 9.9. The tree is 
constructed by working from the top-down, but it is 
convenient here to explain it from the bottom-up. The level 
in No. 1 crystallizer can rise only if the outflow to No. 2 
crystallizer is restricted. This can occur in three ways: 

(1) Discharge line choked with slurry; frequency esti¬ 
mated from plant experience of similar materials, 
5 occasions/year. 

(2) Crystallizer level control valve (LCV) on discharge line 
shut or misdirected shut; frequency estimated from 
literature data, 0.5 occasions/year. 

(3) Manual isolation valve on discharge line shut in error; 
frequency estimated from general plant experience, 
0.1 occasions/year. 

Thus the estimated frequency of restricted outflow is 
5.6 occasions/year. The level will continue to rise only if: 

(1) The operator fails to take action opposite a rising level 
signal; frequency estimated 4% of occasions. 

(2) The level meter fails dangerous; failure rate estimated 
2 failures/year, downtime 4 h/failure, dead time 2x4= 
8 h/year, fractional dead time 8/8760 « 0.1% of time. 

The slurry will only overflow into the PCV header and 
thence to the stack if 

(1) The operator fails to take action opposite a high-level 
alarm signal; frequency estimated 3% of occasions. 

(2) The high level alarm fails dangerous; fractional dead 
time estimated 1.25% of time. 



Figure 9.8 Proposed crystallization plant: flow diagram (Lawley, 1974b) CW, cold water; HI, high; HW, hot water; 

LA, Level alarm; LO, low; LRC, level recorder controller; PCV, pressure control valve; PG, pressure gauge; PI, pressure 
indicator; PRC, pressure recorder controller (Courtesy of the American Institute of Chemical Engineers) 
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Figure 9.9 Proposed crystallization plant: fault tree for low pressure discharge of crystallizer slurry 
to stack and entrapment to atmosphere (Lawley, 1974b) (Courtesy of the American Institute of 
Chemical Engineers) 


This fractional dead time calculation is as follows. 
The failure rate of the high level alarm (excluding the 
meter) is estimated as 0.2 failures/year and the proof test 
interval is 6 weeks. Thus the fractional dead time is: 


x 0.2 x -= 1.15 xlO- 
= 1.15% 


The fractional dead time of the meter has already 
been given as 0.1%. Thus the fractional dead time of 
the level meter and the high level alarm together is 1.25%. 

If the slurry overflows, it is assumed that it continues to 
pass to the stack for up to 2 h maximum and thus for 1 h/ 
occasion, on average. 

Similarly, the level in No. 2 crystallizer can rise only if the 
outflow to No. 3 crystallizer is restricted. The treatment is 
identical to that for No. 1 crystallizer. 
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The level in No. 3 crystallizer can rise only if the outflow 
is restricted. This can occur in four ways: 

(1) Discharge line or centrifuge feed line blocked; fre¬ 
quency estimated from plant experience of similar 
materials, 0.2 occasions/year. 

(2) Failure of online circulation pump followed by failure 
to commission standby circulation pump in time; fre¬ 
quency estimated, 0.1 occasion/year. 

(3) The operator fails to reduce the feed to the reaction 
section when there are problems on the centrifuges; 
frequency estimated 0.2 occasions/year. 

(4) Manual isolation valve on discharge line shut in error; 
frequency estimated 0.1 occasion/year. 

Thus the estimated frequency of restricted outflow is 
0.6 occasions/year. 

Since No. 1 crystallizer has restricted outflow on 
5.6 occasions/year and overflow on 9.7 x 10 -3 occasions/ 
year, No. 3 crystallizer, which has restricted outflow on 
0.6 occasions/year, will have overflow on: 

^ x 9.7 x 10 -3 = 1 x 10 -3 occasions/year 
5.6 

Thus the low pressure discharge of slurry from one of 
the crystallizers reaches the stack via the PCV header on 


For the primary events: 

h < Xit non-repairable and repairable components 

[9.5.13] 

ai < Xit non-repairable components [9.5.14a] 

m n [9.5.14b] 

Oi < X(ti repairable components [9.5.15] 

where, for component i, a.i and Oi are the availability and 
unavailability, r { and r f the reliability and unreliability, and 
is the failure rate and x is the restoration time. For the 
minimum cut sets: 


i* = |> [9-5.16] 

[9.5.17]' 

R k = J o f k (t')dt> [9.5.18] 

A* [9.5.19] 


And for the top event 


2 x 9.7 x 10 3 +1 x 10 3 = 20.4 x 10 3 occasions/year 

Noxious discharge from the top of the stack occurs only if 
the stack base or drain is blocked. It is estimated that 
blockage will occur on 2 occasions/year. The stack drain is 
checked for blockage once per day so that, on average, a 
blockage would be unrevealed for 12 h. Allowing 6 h for 
clearing the blockage gives a mean downtime for the drain 
of 18 h/occasion. Then the low pressure discharge of 
slurry to atmosphere is 

2 x 20.4 x 10 “ 3 = 8 ' 9 x 10 ” 5 occasions/year 

This is a fairly typical illustration of an industrial fault 
tree analysis. Some additional examples related to protec¬ 
tive systems are given in Chapter 13. 


At ~ii Ak 

A 


[9.5.20] 

[9.5.21] 

[9.5.22] 


where, A is the unavailability,/the failure density function, 
R the unreliability, A the failure rate, the number of 
primary events in minimum cut set k, and A the number of 
crucial minimum cut sets; subscripts k and t refer to the 
minimum cut set and top event, respectively. For importance: 


*■-(£*)/* 


[9.5.23] 


9.5.15 Repairable systems 

The treatment given so far has not taken into account 
the repair of failed components. For lack of exact solu¬ 
tions, approximate treatments have been developed which 
give the upper bounds on reliability and availability. 
A method of determining the reliability and availability 
for the top event that is based on this approach and that is 
suitable for manual calculation has been described by 
Fussell (1975). 

The method is based on the crucial minimum cut sets, or 
collection of minimum cut sets that can be taken as 
adequately representing for quantitative evaluations the 
top event fault logic. It utilizes the rare event approxima¬ 
tion, the principal condition being 0.1 < XJ, where X it is the 
failure rate of component i. The account given here is con¬ 
fined to the presentation of the results obtained by Fussell; 
full derivations are given by that author. 


where, for event i, /, a is the importance with respect to 
availability and I iT is the importance with respect to reli¬ 
ability, and m.i is the number of minimum cut sets containing 


9.5.16 Illustrative example: pump set system 

As a fourth illustrative example, consider the use of the 
relationships just given to determine the reliability of a 
pump set, consisting of two streams, each with a pump and 
a control valve (CV). 

The basic components, their failure rates and restoration 
times, and hence their unavailabilities, obtained from 
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Equation 9.5.15, are: 


Component 

Component 

Failure rate, 

\ (year -1 ) 

Restoration time, Tj 
hours (years) 

Unavailability, a,- 

Power supply 

1 

0.08 

1 

l.lxlOr 4 

8.8 x 10T 6 

Pump 1 

2 

2 

6 

6.8 x KT 4 

1.36 x 10~ 3 

Pump 2 

3 

2 

6 

6.8 x Iff 4 

1.36 x lOr 3 

Control valve 1 

4 

0.02 

3 

3.4 x Iff 4 

6.8 x lOr 6 

Control valve 2 

5 

0.02 

3 

3.4 x Iff 4 

6.8 x KT 6 


The minimum cut sets are: 


Minimum cut set no. 

Component failure no. 

2 

2,5 

3 

2,3 

4 

3,4 

5 

4,5 


Then from Equations 9.5.16 and 9.5.17: 


ft - ■ fliAi/fli - - 7.i • - 0.08 

fz = 7.2^5 + 75^2 = 2.86 x 10 -5 
fs = 72^3 + 73«2 = 5.44 x 10 -3 
fi s= 7304 + 7/1^3 = 2.86 x 10 -5 
/s = XiOc, + 75«4 = 2.72 x 10 -7 

From Equation 9.5.18 for a time period of one year 
(f = l), Rk=fkt is numerically equal to /*. Then, from 
Equation 9.5.21, 

R t < 0.085 

9.5.17 Phased mission systems 

In some cases the system passes through more than one 
phase of operation. Such a system is referred to as a ‘phased 
mission system’. Typically, phased mission systems occur 
where the same equipment is used at different times in 
different configurations for different tasks. 

Certain emergency core cooling systems (ECCSs) in US 
nuclear reactors are phased mission systems. After a loss- 
of-coolant accident (LOCA) the ECCS may have to go through 
the phases of (1) initial core cooling, (2) suppression pool 
cooling, and (3) residual heat removal (Burdick etal., 1977). 
Similarly, on certain liquefied natural gas (LNG) installa¬ 
tions the same equipment is used in different modes for 
normal operation and peak load operation. 

In effect, therefore, the top event of the fault tree for a 
phased mission system is the output of an OR gate, the 
inputs to which are the top events of the several phases of 
the mission. This particular OR gate differs, however, from 
the conventional type in that its inputs are separated in time. 

Although a phased mission system can be treated by 
constructing fault trees for the separate phases, there are 
certain problems which arise at the boundaries. Such a 
treatment is not conservative. 

For non-repairable systems only, Esary and Ziehms 
(1975) have developed a transformation that converts the 


fault tree under the special type of OR gate just mentioned 
to a conventional fault tree. This transformation is not 
applicable, however, to repairable systems. 

9.5.18 Protective systems 

A large proportion of fault tree applications are for protec¬ 
tive systems. The determination of the characteristics of 
systems of this type is therefore of particular interest. A 
treatment of this problem has been given by Kumamoto, 
Inoue and Henley (1981). The method given treats the system 
as a whole rather than the individual protective devices. 

The states of the system are: 0, operational; 1, under a 
normal trip; 2, under a spurious trip; and 3, subject to 
destructive hazard. The system may then be described by 
the following equations: 


cooi(f) =7oi(^>0) + j 

1 «)[«io(«) + V2o(u)] d u 

[9.5.25] 

ffi>02(0 =/o2(f,0) + j 

f fo2{t,u)[vio{u) + v 20 {u)\ 6u 

[9.5.26] 

(O03(t) =/o3(f,0) + j 

( fo2(t, «)[tho(«) + V20 («)] dw 

[9.5.27] 

with 



1 1 

II II 

I 1 


[9.5.28] 

[9.5.29] 


where: F 0j {t, u) is the probability at time t that the system is 
in state; given that it entered state 0 at time u\f 0 ft, u) is the 
time differential of F oj (t, u); Vj 0 (t) is the transition rate, or 
intensity, at time t from state; to state 0; w 0] {t) is the transi¬ 
tion rate, or intensity, at time t from state 0 to state;; r n is the 
restoration time after a normal trip; and t s is the restoration 
time after a spurious trip.Thenthe expected numbers of the 
transition events are as follows: 



1 a> 0 i(«)d« 

[9.5.30] 


( aio 2 (u) d u 

[9.5.31] 

N b=j 

1 Q)03 («) d u 

[9.5.32] 


where Nh is the number of realized destructive hazards, 
N n is the number of normal trips and N s is the number of 
spurious trips. 

Equations 9.5.25-9.5.27 are solved by numerical inte¬ 
gration. The authors have written a code, PROTECT, 
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for this purpose. An application of this method, using 
PROTECT, has been described by Kumar, Chidambaram 
and Gopalan (1989). 

9.5.19 Fault tree applications 

Reviews of work on fault trees have been given by Arendt 
and Fussell (1981) and W.S. Lee et al. (1985). Accounts of 
industrial application of fault trees include those of Caceres 
and Henley (1976), Lihou (1980a,b), Pilz (1980a), Prugh 
(1981, 1982, 1992a) and Schreiber (1982). Some fault tree 
applications described in the literature are listed inTable 9.7. 


In constructing an event tree, the normal convention 
is to use binary rather than multiple splits. For example, 
consider the representation of a release for which the 
immediate outcomes are that (a) the vapour cloud is ignited 
at the point of release, (b) it drifts towards housing and (c) it 
drifts away from housing, where the probabilities /> a , p b 
and/> c of these three outcomes are 0.2,0.2 and 0.6, respec¬ 
tively Figure 9.10 shows two ways of representing this 
situation, but it is Figure 9.10(b) that is the preferred form. 
It should be noted that in this case the probability p 2 is 
obtained from 


9.6 Event Trees 

An event tree is used to develop the consequences of an 
event. It starts with a particular initial event such as a 
power failure or pipe rupture and is developed from the 
bottom-up. The event tree is both a qualitative and a quan¬ 
titative technique. Qualitatively it is used to identify the 
individual outcomes of the initial event, while quantita¬ 
tively it is used to estimate the frequency or probability of 
each outcome. 

An event tree is constructed by defining an initial event 
and the possible consequences that flow from this. The 
initial event is usually placed on the left and branches are 
drawn to the right, each branch representing a different 
sequence of events and terminating in an outcome. The 
main elements of the tree are event definitions and branch 
points, or logic vertices. The initial event is usually 
expressed as a frequency (events/year) and the subsequent 
splits as probabilities (events/demand), so that the final 
outcomes are expressed also as frequencies (events/year). 

Each branch of the event tree represents a particular sce- 
nario.The tree is a means of estimating the frequency of the 
outcome for that scenario. It is used in conjunction with a set 
of hazard models for the determination of the physical con¬ 
sequences of that scenario. For example, for a flammable 
release, a typical series of models might be those for emis¬ 
sion, gas dispersion, ignition, explosion and explosion 


Table 9.7 Some fault trees for process industry systems 


System Reference 


p2 — Pb/ (1 Pa) [9.6.1] 

In certain cases one event tree can be reduced to another, 
equivalent event tree. Examples of such reduction have 
been given by Schreiber (1982). 

Figures 9.11-9.13 show event trees for the response of an 
operator to a nuclear reactor transient, a loss of grid power 
supply and a release of LPG, respectively. In the plant power 
supply system analysed in the event tree in Figure 9.12, 
power is supplied to a plant from the National Grid, but in 
the event of grid loss a standby generator is started up to 
supply power. The problem is to estimate the frequency of 
loss of power to the plant. In the event of diesel failure, a 
backup power supply is brought in. It is assumed in the 
example that the frequency of grid loss is 1 x 10 -1 events/ 
year, that the probability of diesel failure is 2.1 x 10 -2 fail¬ 
ures/ demand, made up of 2 x 10“ 2 failures/demand for 
start-up and 1 x 10 -3 failures/demand for running for the 
required period, and that the backup power supply failure 
probability is 1 x 10 -2 failures/demand. The event tree 
shows that the frequency of works power loss is 2.1 x 10 -5 
events/year. 

Figure 9.13 shows an event tree analysis of a release of 
LPG near a detergent alkylate plant (DAP). The possibil¬ 
ities for the development of the release are then as follows. 
The release may ignite and, if it does, it will either explode 
or give a fireball. If it does not ignite, it may be borne by the 
wind towards the DAP and may then ignite and explode at 
the DAP. Alternatively, the cloud may drift in some other 
direction. The estimates are: 

Frequency of large LPG release 1 = 68 x 10 _6 /year 
Probability of ignition/>i= 0.9 


Ethylene oxide plant trip system 
Pressure tank system 

Crystallization plant 
Reactor system 

Nitric acid cooler 


Sulfur trioxide reactor 
Liquid propane pipeline system 
Motor system 
Distillation column system 
Power distribution network 

Storage tank system 
Butane vaporizer system 


R.M. Stewar (1971) 
Fussell (1973a,b); 
Yeselyetal. (1981) 
Lawley (1974b) 

Powers and Tompkins 
(1974a) 

Lapp and Powers 
(1977a, 1979); 

Shaewitz, Lapp and 
Powers (1977) 

Lambert (1977) 

Lawley (1980) 
Yeselyetal. (1981) 

Kletz and Lawley (1982) 
Cummings, Lapp and 
Powers (1983) 

Ozog (1985) 

Andrews and Morgan 
(1986) 


Probability of explosion given ignition p 2 = 0.1 
Probability of wind to DAP p 3 = 0.4 
Probability of ignition and explosion at DAP/> 4 = 0.9 
Then the probabilities of the outcomes are: 

Probability of hydrogen fluoride (HF) release (independent 
of wind direction) p 5 =pip 2 = 0.9 x 0.1=0.09 

Probability of fireball p 6 =p 1 x (1 -p 2 ) = 0.9 x 0.9 = 0.81 

Probability of HF release drifting north-east p 7 = (1 -pj) 
xp3 xpi= 0.1 x 0.4 x 0.9 =0.036 

Probability of drifting cloud pio=Ps+Ps = (1-A) 

x \p3 x (1 -pd + (1—/> 3 )] = 0.1 x (0.4 x 0.1 +0.6) = 0.064 

The outcome frequencies are then obtained by multiply¬ 
ing the initial event frequency by these outcome frequen¬ 
cies. Thus 
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OUTCOME 

Cloud ignites 

P a = 0.2 


Cloud drifts to housing 

P b = 0.2 

B 


Cloud drifts away from housing 

P c = 0.6 

r. 


(a) 


Cloud ignites 
P, = 0.2 


Cloud drifts 
(1 - P,) = 0.8 


lb) 


OUTCOME 


Cloud drifts to housing 
P 2 = 0.25 

- B 


Cloud drifts away from housing 
(1 - P 2 ) = 0.75 


Figure 9.10 Construction of an event tree: (a) multiple splits; (b) binary splits 


Frequency of HFrelease (independent of wind direction) 
4= 0.09 x 68 x 10“ 6 = 6.1 x 10“ 6 /year 
and so on. 

The outcome probabilities should sum to unity and the 
outcome frequencies to that of the initial event. 

This last example also illustrates the need for care in 
the definition and interpretation of events. Outcome C is 
an HF release drifting north-east, but this is not the only 
outcome where this occurs. It occurs implicitly also in 
outcome A, so that the frequency of such a release is that 
of outcome C plus a contribution from that of outcome A. 

Event trees are used particularly, but not exclusively, to 
analyse failures of utilities and outcomes of releases from 
plants. Other event trees are given in the literature (e.g. von 
Alven, 1964; N.C. Rasmussen, 1974; AFC, 1975; HSE, 1978b, 
1981a; Cross, 1982; Rijnmond Public Authority, 1982). 


9.7 Cause Consequence Diagrams 

A third technique that incorporates features both of the 
fault tree and of the event tree is the cause-consequence 
diagram. The cause-consequence diagram has been 
developed by D.S. Nielsen (1971, 1974, 1975) and by J.R. 
Taylor (1974d, 1978a). 


A cause-consequence diagram is constructed by defin¬ 
ing a critical event and then developing the causes and 
consequences of this event. The forward development has 
the features of an event or a decision tree and the backward 
development those of a fault tree. The main elements of the 
diagram are therefore event and conditions definitions and 
logic gates and vertices. 

Some cause-consequence diagram symbols are given in 
Table 9.8. The logic symbols include both gates, which 
describe the relations between cause events, and vertices, 
which describe the relations between consequences. The 
event and condition symbols describe the type of event or 
condition. The symbols given are those that have been used 
by Nielsen and by Taylor. 

The main logic gates are the AND gate and the OR gate. 
There are corresponding logic vertices in the form of the 
AND vertex and the OR vertex. 

The EITHER/OR vertex, or decision box, is also very 
useful. It is utilized in particular to determine the effect of 
an event or condition on the paths that the system takes. If, 
as is often the case, the ‘No’ output from the decision box is 
the result of an abnormal condition, then the fault tree for 
this condition is developed. Thus fault trees occur on the 
diagram not only for the critical event but also for abnormal 
conditions throughout the diagram. 
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Accident 

Initiating 

Operator 

notices 

transient 

occurring 

Operator has 
time to react 
to terminate 
transient 

Operator 

correctly 

identifies 

transient 

Operator 
carries out 
procedure 
correctly 

Sequence 

No. 

Consequence 


-R1 Recovery 




No Progression 

Figure 9.11 Event tree for response of operator to nuclear reactor transient (Welsh and Lundberg, 1980) 
(Courtesy of Elsevier Science Publishers) 


Some important features of the cause-consequence dia¬ 
gram are its ability to handle alternative consequence 
paths and time delay and time order. 

Examples of the use of cause-consequence diagrams 
in hazard assessment have been given by Nielsen and by 
Taylor. As an illustration consider the example of the surge 
tank system shown in Figure 9.14(a), which is adapted 
from a similar example by J.R. Taylor (1978a). The problem 
is to develop the diagram for the critical event of ‘Flow 
controller fails’. The cause-consequence diagram is shown 
in Figure 9.14(b). 

The cause-consequence diagram may also be used for 
quantitative assessment. 

9.8 Dependent Failures 

In the design of systems for reliability, use is made of 
redundancy and diversity of subsystems and components. 
In principle, the use of redundancy allows very high relia¬ 
bility to be obtained. The condition for this, however, is that 
the failures that occur are independent. If this is not so, 
then the design intent is defeated and the reliability may be 
less, sometimes dramatically less. In other words, the phe¬ 
nomenon of dependent failure tends to set a limit on the 
reliability that can be achieved. It is therefore a major con¬ 
cern for designers of high reliability systems. 

Work on dependent failures has been described in A Study 
of Common Mode Failures (Edwards and Watson, 1979 SRD 
R146) and on defences against it in Defences Against Com¬ 
mon Mode Failures in Redundancy Systems (Bourne et al. 
1981 SRD R196) and SRD Dependent Failure Procedures 
Guide (Humphreys and Johnston, 1987 SRD R418). 


The terminology used in the field has changed somewhat 
over the years. Initially, the term generally used was ‘com¬ 
mon mode failure’ (CMF).The term‘common cause failure’ 
(CCF) then gained currency. Some debate arose as to the 
difference between the two. The term ‘dependent failure’ 
(DF) is now preferred. A set of definitions is given by 
Humphreys and Johnston. They define dependent failure as 
‘the failure of a set of events, the probability of which 
cannot be expressed as the simple product of the uncon¬ 
ditional failure probabilities of the individual events’. 
They treat CMF as a subset of CCF in which the failures are 
in the same mode and due to the same cause. They also 
refer to and include a fourth category, cascade failures or 
propagating failures. 

9.8.1 Occurrence 

Dependent failures are liable to occur in all sorts of ways. 
One of the most obvious is loss of a utility, such as failure of 
the power supply and hence simultaneous loss of power to 
all the instruments in a particular system. Another readily 
envisaged type of dependent failure is that due to some 
influence from the external environment. This may be 
freezing due to cold weather, or shock caused by an earth¬ 
quake. 

There are other causes of dependent failure which are 
less readily appreciated but which are just as important. 
One of these is human error, specifically systematic error. 
A systematic error in maintenance or testing may disable a 
complete system of redundant devices. 

In general, a particular component will be potentially 
subject to a number of types of dependent failure. Typical 
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Figure 9.12 Event tree loss of grid power supply (after Andow, 1976) 


dependencies are manufacture, maintenance and external 
events. Another form of dependent failure is damage 
caused by the accident event itself. 

9.8.2 Significance 

The significance of dependent failures is readily appre¬ 
ciated. There is a limit to the degree of reliability that can be 
achieved in a system by the use of single items of high 
reliability. For high system reliability it is necessary to 
exploit redundancy and diversity. In the absence of depen¬ 
dent failures, very high system reliabilities can be achieved 
by these means. The effect of dependent failures, however, 
is to set a limit to the increase in reliability that is obtain¬ 
able in practice. 

One type of system where this is important is protective, 
or trip, systems. High reliability protective systems tend to 
utilize more than one channel, typical configurations being 
% systems and % voting systems. Dependent failures can 
cause a significant increase in the probability of failure on 
demand for such systems. 

Another type of system where the effect of dependent 
failures is significant is standby systems. There can be an 
appreciable increase in the probability of failure on demand 
due to dependent failures. One type of standby equipment 
where this effect has been repeatedly demonstrated is 
standby diesel generator sets for emergency power supply, 
where reliabilities have frequently fallen well below those 
estimated neglecting dependent failures. 


9.8.3 Classification 

A classification of causes of CMFs has been given by 
Edwards and Watson (1979 SRD R146) and is shown in 
Figure 9.15. Engineering failures are classed as those of 
design (ED), which is subdivided into functional defi¬ 
ciencies (EDF) and realization (EDR), and those of con¬ 
struction (EC), subdivided into manufacturing faults 
(ECM) and installation and commissioning faults (ECI). 
Operations failures are classed as procedural (OP), 
subdivided into maintenance and test (OPM) and operation 
(OPO), and environmental (OE), subdivided into normal 
extremes (OEN) and energetic events (OEE). Each of these 
classes is broken down into further detailed categories. 

9.8.4 Failure data 

Edwards and Watson review the data available on CMFs. 
Most of these data relate to aircraft systems and to nuclear 
reactor systems in the United States, France, Germany and 
the United Kingdom. 

Data on abnormal occurrences in US nuclear power 
plants are available in the form of Licensee Event Reports 
(LERs). Two reactor systems for which high reliability is 
required are the automatic protective system (APS) and the 
emergency core cooling system (ECCS). The authors ana¬ 
lyse the reports to identify CMFs. 

CMF also figures prominently in the Rasmussen Report 
(AEC, 1975). This report contains (in Appendix III) CMFs 
identified in various data sources on reactor incidents and 
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Figure 9. 13 Event tree for release of LPG (after HSE, 1981a) 


operation. Analysis of the data in the Rasmussen Report 
shows that of a total of 303 faults some 32 were CMFs. The 
causes of these CMFs include EDR (12 faults), OPM 
(6 faults) and OEN (5 faults). 

Further discussions of data on dependent failures are 
given by Humphreys (1987) and G.T. Edwards (1988). 

9.8.5 Beta factor 

A quantitative measure of the prevalence of depend¬ 
ent failure is the ratio /? of the dependent failures to 
the total failures, introduced by Fleming (1974). It is 
defined as: 


X = h + h [9-8.2] 

where X is the overall failure rate, X 6 is the rate of dependent 
failure, and X\ is the rate of independent failure. 

The beta factor may be used to quantify the contribution 
of dependent failures to overall system failure. Edwards 
and Watson have analysed the data and derived values of 
the beta factor for a number of subsystems and compo¬ 
nents. Particularly important are protective systems with 
redundancy. For such redundant systems typical values of 
the beta factor are 0.05 to 0.25. 

Another important item is diesel generator sets for emer¬ 
gency power supply. In their study the authors identified 24 
nuclear power plants that yielded usable data. For the diesel 
generators in these plants there were 67 failures recorded 
over a period of 238 operating years. There were six depend¬ 
ent failures over a period of 118 operating years. Each 


diesel generator was broken down into eight subsystems. 
The overall subsystem failure rate was therefore 0.035 fail¬ 
ures/year (67/(8 x 238)) and the dependent failure rate 
0.0064(6/(8 x 118)). The resultant value of is 0.18 (0.0064/ 
0.035). 

A further study of beta factors has been described by 
Humphreys (1987). 

9.8.6 Protective systems 

The type of system for which dependent failures are of 
particular concern is protective systems with a high degree 
of redundancy. The characteristics of such systems have 
been discussed by Bourne et al. (1981 SRD R196). The 
authors recognize five basic types of configuration for such 
systems: (1) a single channel, (2) a redundant system, (3) a 
partly diverse system, (4) a fully diverse system and (5) two 
diverse systems. 

Thus, considering the measurement channels for a trip 
system, the authors give as an example of a redundant 
system a system with n identical redundant channels and 
m/n majority voting. As examples of partly diverse and 
fully diverse systems they give systems with two parallel 
channels, in which the channels are partly diverse and 
fully diverse, respectively. Two diverse systems are exem¬ 
plified by a system with two complete subsystems in par¬ 
allel, each of which is a half-identical redundant channel 
subsystem. 

Bourne et al. gave the following approximate ranges for 
the probability of failure of these configurations, based on 
a typical proof test interval of 1—3 months: 

Single channel > 0.5 to 5 x 10“ 3 

Redundant system 5 x 10 -2 to 5 x 10 -4 
Partly diverse system 10 -2 to 5 x 10 -s 
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Table 9.8 Cause-consequence diagram logic and event 
symbols (after D.S. Nielsen, 1974; J.R. Taylor (1974d)) 
(Courtesy of the Danish Atomic Energy Commission) 


Logic symbol 

Meaning of symbols 

, t 

AND gate 

OR gate 

i 

, i 


l vertex 

Mutually exclusive OR vertex (used 
, after time delays) 



EITHER/OR vertex, decision box 

No 1 Yes 


1 | 1 


f > 10 

Condition vertex 

No | Yes 


1 1 


Event and condition symbols 

9 

Basic condition 

M 

1 

! Initiating event (may be critical 

event) 


Event 


> Significant consequence 

( ; 
i 

) Condition 

I'-H 

Fixed time delay 

17 

Variable time delay 


Fully diverse system 10 3 to 5x10 5 
Two diverse systems 5 x 10 _s to < 10 -6 

The probabilities of failure of the systems therefore show 
considerable overlap. 

9.8.7 Modelling for redundancy 

A number of methods have been developed for the model¬ 
ling of dependent failures in redundant systems. Accounts 
of such modelling are given by Edwards and Watson 
(1979 SRD R146), G.T. Edwards (1987a,b) and Humphreys 
and Johnston (1987 SRD R418). The methods include the 
beta factor method, the multiple Greek letter method, the 
binomial failure rate method and the Marshall-Olkin 
method. An account of these and other methods is given by 
Humphreys and Johnston. 

One of the most widely used is the beta factor method. 
This has a single parameter /1. Some of the other methods 
have several parameters. The use of a single parameter has 
the merit that only one parameter needs to be estimated 
from the data, but the corresponding limitation that it can¬ 
not, in principle, model the data as accurately as a multiple 
parameter method. 

9.8.8 Beta factor method 

As just stated, one of the most widely used models of 
dependent failure is the beta factor method of Fleming 
(1974). The beta factor was defined in Section 9.8.5. For a 
single component the overall failure rate may be written in 
terms of the beta factor as: 


X — X; + Xi 

[9.8.3] 

Then, writing 



[9.8.4] 

Xi = pX 

[9.8.5] 

Gives 


a = (i - p)x + px 

[9.8.6] 


The simplest system to which CCF is applicable is the 
two-component parallel redundant system shown in 
Figure 9.16(a). The failure rate for a single component is X. 
Then, applying the beta method and separating out the 
contributions of independent and CCFs, gives the system 
shown in Figure 9.16(b). The system now consists of a 
two-component parallel subsystem in series with a single 
component subsystem. The failure rate for the system X s is 
then given by the relation: 

4 = (T/a-m+ivv-m + fiX [aa71 

The fault trees for the two cases are given in Figures 9.16(c) 
and (d), respectively. 

Models such as the beta model are applied particularly to 
protective systems. For such a system consisting of multi¬ 
ple redundant items in parallel, which is normally not 
operational but which is required to operate when a 
demand is placed on it, the probability of failure is equal to 
its unavailability, or fractional dead time. Since the prob¬ 
ability of failure increases with time and since for such a 
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Figure 9.14 Surge tank system and cause-consequence diagram for overfilling of a surge tank (after J.R. Taylor, 
1978a): (a) surge tank system; (b) cause-consequence diagram of the surge tank system for the critical event ‘Flow 
controller fails’ (Courtesy of the Danish Atomic Energy Commission) 
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Figure 9.15 Classification of common mode failures (Courtesy of the UKAEA Safety and Reliability Directorate) 
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Figure 9.16 Representation of dependent failure: (a) a two-component parallel system; (b) the two-component parallel 
system distinguishing between independent and common cause failures; (c) fault tree for system (a); (d) fault tree for system (b) 


system the failure will normally be unrevealed, it is neces¬ 
sary to perform a proof test at some fixed interval. 

The application of the beta model may be illustrated as fol¬ 
lows. It is shown in Chapter 13 that, subject to certain condi¬ 
tions, the fractional dead time for a single channel system is 
4 >=\t p I 2 and that for a system of two parallel redundant 
channels it is 0 = (At p ) 2/3 /3, where <t> is the fractional dead 
time and r p the proof test interval. The corresponding 
expression for the latter case in terms of the beta factor is: 


The use of the beta factor method requires that a suitable 
value of /} be known. As stated earlier, typical values for 
redundant systems are 0.05 to 0.25. 


9.8.9 Geometric method 

Another method of handling CCF is the geometric method. 
This utilizes the upper and lower bounds of failure of the 
system. The lower bound 4 of the system failure rate is that 
assuming that there are no failures due to a CCF, and the 
upper bound 4 is that assuming that all failures are due to 
the common cause. The system failure rate 4 is 

4 = (2? x 4) V( ” +1) [9-8.9] 


where n is an index. The value of n is a function of the 
diversity of the components in the system and its value 
usually lies in the range 1-4. 


9.8.10 Partial beta factor method 

The partial beta factor method is not actually a separate 
method but rather a method of obtaining a more accurate 
value of the beta factor. The method is described by 
Humphreys and Johnston (1987 SRD R418). The authors 
suggest that a practical limit of the beta factor in a redun¬ 
dant subsystem is about 2 x 10 -2 and that in a diverse 
subsystem is about 10 -3 . They take the latter as the lower 
limit for a subsystem for which very high reliability is 
required and in which all defences are exploited. 

The beta factor is decomposed into a set of partial beta 
factors, each of which corresponds to a particular defence. 
Thebeta factor is computed as the product of the partial beta 
factors. The procedure is as follows. For each partial beta 
factor, a minimum value /? pm is assigned. The product of the 
minimum values is 10 _3 .Then for each partial beta factor the 
user assigns an actual value /J pa .The maximum in each case 
is unity, so that if this maximum is assigned in every 
instance, the product of these values is unity. Thus, in gen¬ 
eral, the beta value computed from the partial beta values 
will lie between 10~ 3 and 1.0. 
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The authors give a proforma for the determination of 
the beta factor from the partial beta factors, in which 
account is taken both of the causes of, and defences against, 
dependent failures. A further discussion of the partial beta 
factor method is given by B.D. Johnston (1987a,b). 

9.8.11 Multiple Greek letter method 

The beta factor method does not distinguish between dif¬ 
ferent levels of redundancy in a subsystem. This deficiency 
is overcome in the multiple Greek letter method, in which a 
separate Greek letter is introduced for each component 
after the first. Thus for a four-component system one would 
use the letters /?, y and 5, where P is the conditional prob¬ 
ability that a cause of component failure will be shared by 
one or more components, y is the conditional probability 
that the cause of component failure which is shared by one 
or more components will be shared by two or more compo¬ 
nents, and 8 is the conditional probability that the cause of 
component failure which is shared by two or more compo¬ 
nents will be shared by all components. It should be noted 
that the definition of P used here differs from that in the 
conventional beta factor method. 

Humphreys and Johnston (1987 SRD R418) state that 
typical values of p, y and 8 are 0.1, 0.76 and 0.82, and that 
system failure probabilities computed by this method 
typically differ from those obtained by the conventional 
beta factor method by a factor of about 1.5. 

9.8.12 Binomial failure rate method 

In the binomial failure rate model developed by Vesely 
(1977a) and modified by Attwood (1991), multiple depend¬ 
ent failures in a redundant subsystem are treated as being 
either probabilistic (binomial) or deterministic (global) in 
nature. In this model, the external event is referred to as a 
‘shock’. Shocks are divided into non-lethal and lethal, the 
former being those which have a certain probability of 
causing subsystem failure and the latter being those which 
are certain to do so: 

X = A s j + p[x -f- w [9.8.10] 

where p is the conditional probability that the external 
event will cause subsystem failure, X is the overall failure 
rate of the subsystem, A si is the overall failure rate of the 
subsystem for independent failures, n is the occurrence 
rate of non-lethal shocks, and co is the occurrence rate of 
lethal shocks. 

9.8.13 Revealed and unrevealed failure models 

In the account given so far the emphasis has been on 
dependent failures in protective systems where failures are 
unrevealed when they occur and are detected only by proof 
testing. The probability of failure is a function of the failure 
rate and of the proof test interval. 

In most plant systems, however, where an equipment is 
required to perform some active function on a continuous 
basis, failures are detected by the fact that this function is 
no longer being performed. In this case the failures are 
revealed. The probability of being in a failure state is a 
function of the failure rate and of the repair time, taking 
this as the total time for detection and repair. An example of 
a system in which failures are revealed is two pumps each of 
50% capacity operating in parallel. 

The models for the probability of failure in systems with 
revealed failures and in systems with unrevealed failures 


are different. Treatments are given in Chapters 7 and 13, 
respectively. Standby systems are an intermediate case. In 
the standby mode the failures are unrevealed, whilst in the 
operating mode they are revealed. 

9.8.14 Diversity and its modelling 

Diversity is recognized as one of the principal defences 
against dependent failures. A system with diversity is 
much less vulnerable to many of the events that can cause 
dependent failures in redundant systems. The modelling of 
diversity is, however, much less well developed than that of 
redundancy, and it is therefore less easy to obtain quanti¬ 
tative results for subsystems embodying diversity. 

9.8.15 Fault tree analysis 

One of the principal tools for the analysis of high reliability 
systems is fault tree analysis. The type of system to which 
fault tree analysis is typically applied is one in which 
undesirable events are protected against by the use of con¬ 
trol loops and trip systems. In systems where very high 
reliability is required, use is generally made of redundancy 
in some of the trip systems. The benefit of redundancy may 
be negated if there is dependency between failures. 

In fault tree analysis, dependent failures may be handled 
in two different ways. One is to construct the tree as nor¬ 
mal, without explicit regard to dependency, but to flag each 
group of base events where a dependency exists and to deal 
with this dependency at the cut set stage. The alternative 
approach is to represent the dependent failure part of the 
subsystem failure as an explicit failure in its own right. 

The two approaches are illustrated in Figure 9.17, which 
shows a fault tree for a system in which a measurement is 
made using a half-redundant system. The top event X is the 
failure of the measurement function. In Figure 9.17(a), the 
events A and B are defined as failure of measurement chan¬ 
nel 1 and failure of channel 2, respectively. These failures 
include both independent and dependent failure contribu¬ 
tions. If the dependency of A and B were to be dealt with at 
the cut set stage, the events would be flagged in some way. 

In Figure 9.17(b), the failure that causes failure of the two 
channels, that is, the dependent failures, is isolated as 
event C. The events A and B are now redefined as, respec¬ 
tively, the failures of channels 1 and 2, excluding the 
dependent failure contribution. In this tree, the event C is 
shown accompanying both event A and event B. In the 
alternative, but equivalent, configuration shown in 
Figure 9.17(c), event C is separated out and shown only once. 

Computer codes for the analysis of dependent failures 
have been described by Humphreys and Johnston (1987 
SRD R418) and by B.D. Johnston (1987a,b). An account of 
these codes is given in Chapter 29. 

9.8.16 Effect on reliability 

The effect of dependent failures is seen most markedly in 
protective systems with a high degree of redundancy, 
where it can dominate. This may be illustrated by con¬ 
sidering the half-redundant protective system described 
earlier. The expression for the fractional dead time cp 
of such a system is Equation 9.8.8. Typical values of the 
parameters are given by Humphreys and Johnston 
(1987 SRD R418) as follows: X = 1(T 6 failures/h; x p = 10 3 h; 
and p = 0.1. The fractional dead time is then: 

<p = 0.27 xl0“ 6 + 0.5 xl0“ 4 
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Figure 9.17 Treatment of dependent failures in fault tree analysis: (a) tree with events A and B treated as independent 
events; (b) tree with events A and B treated as dependent on event C; (c) alternative form of tree in (b) 


where the first term is the contribution of the system 
for independent failures and the second that for 
dependent failures. The dominant contribution is that of 
the dependent failures. 

The impact of dependent failures can be even greater. In 
the example just given the redundancy was minimal. Sys¬ 
tems with higher degrees of redundancy are relatively even 
more vulnerable to dependent failures. One early study, by 
Epler (1969), stated that dependent failures might be 
dominant by a factor as high as 10 5 . 

9.8.17 Benchmark study 

A benchmark study of CCF is described in Common- 
cause Failure Reliability Benchmark Exercise (Gohnston 
and Crackett, 1985 SRD R383). The study is one of a 


series of benchmark exercises conducted by the Com¬ 
mission of the European Communities (CEC) and organ¬ 
ized by JRC-Ispra. A summary of this study is given by 
Humphreys and Johnston (1987 SRD R418). The situation 
investigated was dependent failures on the feedwater 
system of a PWR under emergency conditions. Of the ten 
teams whose studies are listed, five used the multiple 
Greek letter method and four the Marshall-Olkin method. 
The system is characterized by redundancy rather than 
diversity, and for this situation agreement was rea¬ 
sonably good. The three most structured presentations 
estimated the probability of failure as lying in the range 
10 -4 to 5 x lO -5 . The treatment of the rather limited 
amount of diversity in the system exhibited greater 
discrepancies. 
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9.8.18 Cascade failures 

Cascade failures occur when a fault propagates through the 
plant and induces further failures. The conditions created 
by the fault may include abnormal process conditions, 
equipment overload, loss of potential correction on control 
loops, activation of trip systems and actions by the opera¬ 
tor in response. The cascade failure problem appears to 
have received relatively little attention. 

9.8.19 Defences 

The defences available against dependent failures are 
described by Edwards and Watson (1981SRD R146) and are 
further developed by Bourne et al. (1981 SRD R196) and 
Humphreys and Johnston (1987 SRD R418). The headings of 
the list given by Edwards and Watson are: 

1.0 Design 

1.1 Administration 

1.2 Functional diversity 

1.3 Equipment diversity 

1.4 Fail-safe design 

1.5 Redundancy and voting logic 

1.6 Protection and segregation 

1.7 Proven design and standardization 

1.8 Equipment derating and simplicity 

1.9 Operational interfaces 

1.10 Quality control 

1.11 Design review 
2.0 Operation 

2.1 Administration 

2.2 Maintenance procedures 

2.3 Proof testing 

2.4 Operating procedures 

2.5 Reliability performance monitoring 
3.0 Reliability assessment 

Detailed accounts of the elements of each of these 
defences are given by the three sets of authors quoted. 
Bourne et al. (1981 SRD R196) describe an overall defence 
strategy in terms of (1) general strategy, (2) management 
aspects and (3) technical aspects. The general strategy 
should be based on good administrative controls of both 
design and operations. There should be a specification for 
the reliability requirements of the system with particular 
reference to dependent failures (DFs).The design should be 
subject to reviews of dependent failures at appropriate 
stages. There should be an independent assessment of 
reliability in which dependent failures are considered. 
During the operational life of the plant, the continued 
effectiveness of the defences against dependent failures 
should be periodically reviewed. 

Management should ensure that there is awareness of 
the problem of dependent failures among all personnel who 
have a contribution to make in minimizing it, and should 
give a lead. It should make defence against dependent fail¬ 
ures an explicit objective in both design and operations 
stages. It should make it clear where the need for such 
defence imposes requirements additional to those of the 
regular standards and codes. It should assure the neces¬ 
sary reviews and independent assessment. 

Technical aspects cover a wide range of measures. 
Probably the most effective is functional diversity, which 
is generally used only at system level. This defence may 
be enhanced by equipment diversity. Within subsystems 
fail-safe design may be exploited. Other measures 


are: redundancy and voting logic; protection and segregation; 
proven design and standardization; and equipment derating 
and simplicity. These design measures need to be com¬ 
plemented by adequate systems and procedures for defence 
during operations. 

Bourne etal. suggest the following priorities. As the most 
significant contributors to dependent failures are errors in 
design and in maintenance and testing, the first priority 
should be the management of the design process and of 
design and operational tasks in relation to dependent fail¬ 
ures. Of the technical measures, fail-safe characteristics 
offer the greatest potential for reliability enhancement. 
Next come measures to minimize human error at the inter¬ 
faces of tasks such as maintenance and testing. 

The defences most commonly applied are protection and 
segregation. Protection guards against influences from the 
external environment and segregation can be effective 
against most causes of dependent failure. Both have a con¬ 
tribution to make, but it is not a predominant one. The 
authors state that other design defences considered 
(redundancy and voting, proven design and standardiza¬ 
tion, derating and simplicity) are of less significance, but 
have a role to play. 

9.9 Expert Judgement 

It is sometimes difficult to obtain data on event frequency 
or probability. In such cases, a possible solution is the use of 
expert judgement to obtain the required estimates. This 
approach has been used particularly to obtain estimates for 
human error rates (HERs), where it is especially difficult to 
obtain field data, and for equipment failure rates, but it also 
has other applications. 

An account of expert judgement is given in Eliciting and 
Analysing Expert Judgement: A Practical Guide (M.A. Meyer 
and Booker, 1990). A review of five areas of application of 
expert judgement methods is given by Mosleh, Bier and 
Apostolakis (1987). Further guidance on knowledge repre¬ 
sentation and elicitation is available in the literature on 
expert systems, though there the emphasis is generally 
more on expert rules rather than on quantification. Expert 
systems are discussed in Chapter 30. 

9.9.1 Scope 

Some purposes for which expert judgement has been used 
are given by M.A. Meyer and Booker (1990) as: 

(1) to provide estimates on new, rare, complex or otherwise 
poorly understood phenomena; 

(2) to forecast future events; 

(3) to integrate or interpret existing data; 

(4) to learn an expert’s problem-solving processes or a 
group’s decision-making processes; 

(5) to determine what is currently known, what is not 
known, and what is worth learning in a field of 
knowledge. 

A study in which expert judgement has been used for all 
these purposes in the context of the NUREG-1150 project is 
Analysis of Core Damage Frequency from Internal Events: 
Expertfudgement Elicitation by Wheeler et al. (1989). 

9.9.2 Expert problem-solving 

In solving a problem the tasks which an expert has to 
perform are essentially to (1) understand the question, 
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(2) retrieve the relevant information, (3) make a judgement 
and (4) formulate and report an answer. 

It is to be expected that the results of an expert judge¬ 
ment exercise will be affected by bias. One form of bias is 
that arising from the elicitation process and from the 
expert’s involvement with the project. Another form is a 
discrepancy between the expert’s knowledge and some sort 
of norm. These two forms of bias are sometimes termed 
‘motivational bias’ and ‘cognitive bias’, respectively. 

Some forms of motivational bias are social pressure, 
misinterpretation or misrepresentation by the interviewer, 
and overoptimism by the expert. Forms of cognitive bias 
include inconsistency, anchoring, availability and under¬ 
estimation of uncertainty. Anchoring is failure to make 
sufficient adjustment to an initial opinion in the light of 
further evidence. Availability is the difference in ease of 
retrieval of different types of information, infrequent cata¬ 
strophic events being more readily retrieved than more 
frequent mundane ones. 

The handling of bias is not well developed, but there are 
certain measures that can be taken. The elicitation process 
can be planned so as to minimize it. The expert can be made 
aware of the potential for bias. The elicitation process can be 
monitored for bias and, if necessary, adjustments made to 
counter it.The results can be analysed for the effect of bias. 

9.9.3 Formulation of questions 

The elicitation process involves asking the expert a num¬ 
ber of questions. The quality of the results obtained 
depends in large part on the formulation of these questions. 
This involves defining the objectives of the project, select¬ 
ing the general question areas and formulating the specific 
questions. Closely related to this is the selection of the 
experts who are to try to answer the questions. These may 
be in-house and/or external experts. Different options exist 
on the extent to which the experts are involved in the 
selection of the question areas and the formulation of the 
questions. 

The questions are then refined hy structuring them. 
Some aims of the refinement process are: to focus attention 
on what is required and to minimize misinterpretation; to 
present the question in a form that is assimilable by the 
expert; and to make the question acceptable to him. Some 
ways in which questions may be refined include decom¬ 
position, phrasing and use of representational aids such as 
diagrams. 

There are certain circumstances in which the involve¬ 
ment of external experts in question refinement is critical. 
These are given by M.A. Meyer and Booker (1990) as those 
where the purpose is to capture the experts’ problem¬ 
solving process, where there is evidence that the experts 
may not accept the questions, and where outside reviewers 
are likely to be concerned about bias in the questions. 

9.9.4 Selection of experts 

A basic distinction in the selection of the experts is 
between applications where the output is to be the experts’ 
answers and those where the output is to be insight into the 
experts’ problem-solving process. In most cases, it is 
the experts’ answers that are of interest. In order to select 
an expert it is necessary to have some idea of what is to he 
regarded as constituting expertise. Two types of expertise 
are distinguished. One is the expert’s experience in the 
domain, or substantive expertise. The other, or normative, 
expertise is his knowledge of the response mode, or form in 


which he is to be asked to give his answers, for example, 
as probabilities, odds or rankings. Both types of expertise 
are needed for satisfactory results. For certain projects, 
the credibility of the expert in the world at large may be a 
factor. 

It is normally advisable to use multiple and diverse 
experts. Diversity of experts guards against the excessive 
influence of a single individual, and is particularly effec¬ 
tive in face-to-face meetings. The number of experts is 
typically five to nine, the lower figure being about the 
minimum needed to obtain diversity and the upper one 
about the maximum that can be readily handled. 

The diversity of expertise achieved depends on the 
selection of experts from the expert population; this is 
essentially a sampling problem. It is necessary to guard 
against overrepresentation of any particular tendency. 

The success of the exercise depends on the motivation as 
well as the selection of the experts, and measures should be 
taken to motivate those participating. 

9.9.5 Elicitation methods and planning 

In designing the elicitation it is necessary to consider (1) the 
elicitation method, (2) the response mode and dispersion 
measures, (3) the aggregation of response, (4) the problem¬ 
solving process and (5) the documentation. 

There are three principal methods of elicitation: the 
individual interview, the interactive group and the 
response of experts operating in isolation (the Delphi 
method). Each method has its advantages and dis¬ 
advantages. The individual interview is the main method 
for obtaining detailed responses and insight into the 
expert’s problem-solving process, but does not give inter¬ 
action between experts and is time-consuming. The 
interactive group is claimed to give more accurate respon¬ 
ses and to generate more ideas, but it can suffer from group 
bias. The Delphi method is freer from group bias. It can be 
framed so as to offer some insight into problem-solving or 
interaction. 

Some response modes which may be used are: single 
probability values; odds ratios; sets of probability values, 
effectively a probability distribution; location on a con¬ 
tinuous scale; location on a discrete scale, with ranking or 
rating; paired comparisons; and revisions of estimates.The 
expert may provide an indication of the uncertainty in the 
response in the form of a dispersion measures such as a 
range, or standard deviation. 

Methods available for eliciting the expert’s problem¬ 
solving process include verbal protocol, verbal probe and 
the ethnographic method. The first requires the expert to 
think aloud, the second is the questioning of the expert 
about his prohlem-solving process immediately after he 
has given his answer and the third involves transposing 
the expert’s answers into questions, which draw from the 
expert elaboration of his answers. The use of verbal proto¬ 
col avoids interviewer bias but is liable to disturb the 
expert’s skilled problem-solving behaviour. 

The answers given by a group of experts are likely to 
differ and need to be aggregated in order to obtain an 
overall response. This may be done by the experts them¬ 
selves or by a mathematical technique. 

The documentation required from the exercise should be 
specified. It may record the answers only, the answers and 
the problem-solving process or something intermediate 
such as the answers with a short explanation of the under¬ 
lying reasoning. 
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The planning of the elicitation includes the logistics of 
involving the experts, the structuring of the elicitation 
process, the precautions against bias and the specification 
of the documentation to guide and record the elicitation. 
There will normally need to be some training and practice, 
probably with pilot testing, prior to the main elicitation 
exercise. 

9.9.6 Analysis of responses 

The data obtained from the elicitation normally consist of 

(1) answers to questions and (2) ancillary information. The 
latter is essentially information about (1) the experts and 

(2) the expertise. 

The data obtained should be examined for two features 
in particular. One is the degree of detail, or granularity. 
Variations in the level of granularity can adversely affect 
the results. It is desirable in principle to operate in the 
analysis with a single level of granularity. There is, how¬ 
ever, a loss of information in passing from the particular to 
the general and this may act as a constraint. 

The other feature is conditionality. Answers are condi¬ 
tioned by the path by which they have been reached and it is 
desirable to make this explicit. Meyer and Booker comment 
that: ‘Two experts could arrive at exactly the same final 
answer but for very different reasons, or two experts could 
arrive at different answers for exactly the same reasons’. 

The analysis of the data is facilitated if they can be con¬ 
verted to quantitative form. There are a number of methods 
of doing this. One approach is to convert qualitative 
descriptors into values on some kind of scale. Another is to 
merge separate categories into a small number of broader 
ones. Another is the combination of quantitative data using 
weighting. 

The data may be analysed to obtain relationships 
between different answers, between different ancillary 
variables and/or between answers and ancillary variables. 
One major aspect of such analysis is that concerned with 
lack of independence between experts’ answers, or corre¬ 
lation, and with bias in these answers. There are various 
factors which experts may have in common, such as shared 
training, similar work experience and exposure to the same 
data sources. The biases that may be present include moti¬ 
vational and cognitive bias, as described earlier. 

Another aspect of data analysis is the modelling of the 
experts’ answers in terms of the ancillary data on the 
expert and his expertise. 

A third aspect of the analysis is the application of 
aggregation methods to combine the answers of a number 
of experts into a single value or distribution of values. One 
particular application of aggregation occurs where there is 
a decision-maker and a single expert. The elements in this 
situation are the decision-maker’s prior estimate, his choice 
of the expert, the aggregation of the prior estimate with the 
expert’s information, and the inference. There are several 
quite different potential outcomes. Thus, the decision¬ 
maker may consider both items of information as valid and 
combine them, he may prefer one or the other or he may 
decide to adopt a range of values. Another situation occurs 
where there is a decision-maker and n experts. The poten¬ 
tial outcomes are similar, but it is more likely that the 
decision-maker will not simply prefer his own prior. 

A fourth aspect of the analysis is the handling of uncer¬ 
tainties in the data. Some sources of uncertainty are 
definitions, errors associated with small samples, non¬ 
sampling errors such as missing data, and deficiencies in 


scientific and modelling techniques. Methods are available 
which assist in the measurement, modelling and control of 
such uncertainties. 

The purpose of the analysis is to reach conclusions by 
making inferences from the responses and analysis of 
these responses.What an expert judgement exercise does is 
to sample the world of experts and their expert knowledge. 
It does not sample the real world and the conclusions 
drawn may or may not represent the true state of nature. 
The validity of these conclusions depends very much 
on the quality of expert knowledge about the domain in 
question. 

Critiques of expert judgement refer to the subjective 
nature of such judgement. The validity of subjective jud¬ 
gement is considered in more detail in Chapter 7. 

9.9.7 Interviews 

One of the main techniques of elicitation used in expert 
judgement work is the individual interview. There is a 
large literature on interview and questionnaire techniques. 
Guidance on interviewing is given by Kahn (1957), by 
Oppenheim (1966) and by Gorden (1987) and also in texts 
on expert systems. 

9.9.8 Delphi method 

Another of the principal techniques of expert judgement is 
the Delphi method. As already described, this method 
involves the use of multiple experts operating in isolation. 
This method is described in The Delphi Method (B. Brown, 
1964), and by Linstone and Turoff (1975) and Dalkey (1969). 
The Delphi method was used for the estimation of failure 
rates in IEEE Standard 500:1984, which gives an appendix 
on the procedure used. 

9.9.9 Ranking and scaling 

Work on ranking and scaling of expert judgement has been 
described byThurstone (1927,1931) and by Kendall (1948, 
1955,1970). An account of scaling methods has been given 
in Theory and Method of Scaling (Torgerson, 1967). 

In general, the overall approach in expert judgement 
work is first to rank the items. From this ranking the items 
are then located on a numerical scale. If absolute values are 
known for some of the items on the scale, these may be used 
to calibrate the scale and thus obtain absolute values for the 
other items. 

A distinction is made between psychological and prob¬ 
ability scales. The responses from the judges lie on a psy¬ 
chological scale and have to be converted to a probability 
scale. The theory underlying the conversion of rankings to 
locations on the psychological scale is complex, but essen¬ 
tially, it is based on the concept that the responses for a 
particular item exhibit a Gaussian distribution about some 
point on the scale. Then if two items are located close toge¬ 
ther, there will be an overlap between the two distributions 
and hence a higher frequency of disagreement between 
judges, while if they are located far apart there will be little 
or no overlap between distributions and little or no dis¬ 
agreement between judges. The key result obtained by 
Thurstone is that 

g k _j ss x kj [9.9.1] 

where gk-j is the mean separation on the scale between 
item j and item k, and x kj is the unit normal deviation 
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corresponding to the probability that k will be ranked 
above;'. This is the basis for the conversion of the rankings 
of the bench of judges into locations on the psychological 
scale. 

9.9.10 Method of paired comparisons 

A major difficulty in asking an expert to rank a number of 
items is that his preferences may not lie on a linear scale. If 
the interviewer insists on a simple ranking, the responses 
may be forced into too rigid a framework. This problem can 
be mitigated by asking the expert to express preferences 
between pairs of items only. This is the basis of the method 
of paired comparisons. 

The method of paired comparisons was proposed by 
Thurstone (1927) and developed by Kendall (1948, 1955, 
1970). Further accounts of the method are given by Guilford 
(1954), Keats (1971) and Hunns (1980,1982). 

In the method of paired comparisons, a bench of m judges 
is asked to rank a set of n items. The response of a single 
judge is considered first. For each item pair, say A and B, the 
judge is asked to express a preference. A preference for A 
over B is denoted by A —*■ B or B <— A. An n x n matrix of 
responses is produced, as shown in the following illus¬ 
trative example given by Kendall (1970): 

ABODE F 
A - 1 1 0 1 1 

B 0 - 0 I 1 0 

C 0 1 - 1 1 1 

D 1 0 0 - 0 0 

E 0 0 0 1 - 1 

F 0 1 0 1 0 - 

The diagonals are blocked out. An entry 1 in column Y, row 
X signifies X —> Yand is therefore accompanied by the entry 
0 in column X, rowY. In this example, A —► B, A —►C and 
A <— D. This nxn matrix provides the basic data from a 
single judge. 

The responses of a judge often exhibit some degree of 
inconsistency. This is seen in its simplest form where a set 
of three pairs, or triad, is inconsistent, or circular. For 
example, the responses F -»G —> H -> Fare inconsistent. 

In making paired comparisons, on n items a judge takes 
n(n— 1)/2 decisions. The maximum number of circular 
triads is (« 3 -«)/24 if n is odd and (n 3 -An)/2A if n is even. 
The minimum number is zero. A coefficient of consistency 
f for a single judge may then be defined 

|*l- 24 d/(n 3 -n) n odd [9.9.2a] 

» 1 - 2Ad/{n 3 - An) n even [9.9.2b] 

where d is the observed number of circular triads. This may 
be obtained from the 

d = ^{n-l)(2n-l)-^f [9.9.3] 


The measure of agreement between the bench of judges 
is the coefficient of agreement u: 


8j| 

m(m - !)«(«-1>1 


[9.9.4] 


where £ is the sum of agreements between pairs of judges. 
The maximum possible value of u is 1. The minimum 
possible value is not-1 but-1/m for m odd and-l/(m-l) for 


9.9.11 Saaty’s method 

One method for paired comparisons is that of Saaty (1977, 
1980). His method is part of a methodology described in his 
book The Analytic Hierarchy Process (AHP) (Saaty, 1980). 
The problem is cast in hierarchical form and the paired 
comparison technique is then used at the successive levels 
of the hierarchy. 

The following scheme is used in making the paired 
comparisons: 


Number 

Description 

1 

The two items are of equal importance or 
equally likely 

3 

A slight favouring of the first item over the 
second 

5 

A strong favouring of the first item over the 
second 

7 

A demonstrated dominance of the first over 
the second 

9 

An absolute affirmation of the first over the 
second 


Values 2,4,6, 8 are used where the comparison is assessed 
as a case intermediate between the above descriptions. The 
comparsions are expressed as the number 1, for no pre¬ 
ference, or the fractions 1/3, 1/5,1/7, and 1/9 for positive 
preferences. Thus, for example, and entry 1/3 means that 
there is a slight preference for the second item over the first. 

The expert proceeds by making all the possible com¬ 
parisons and recording them in a nxn matrix with Is 
down the diagonal and the comparisons in the upper tri¬ 
angular portion of the matrix. The reciprocals of the 
entries in the upper triangular portion are entered in the 
lower triangular portion. The relative weights of the n 
items are then obtained. These weights are the normalized 
eigenvectors of the principal eigenvalue of the matrix. 

An index of consistency is obtained based on the devia¬ 
tion of the principal eigenvalue from the theoretical eigen¬ 
value of a perfectly consistent matrix. If the consistency 
ratio is greater than 0.10, inconsistency is indicated. 

As an illustration of Saaty’s method, consider the 
example given by M.A. Meyer and Booker (1990). It is 
required to rank the following meteorological conditions 
in respect of the likelihood that they will cause a loss of 
off-site power to a plant: 


where 0;, is the sum of entries in row i. 

The number of triads may also be analysed, as described 
by Kendall, using the chi-square distribution to determine 
the probability that the responses are random and could 
have arisen by chance. 


(1) flash flooding at plant site with 0.5 to 2 in. of water; 

(2) flash flooding with 2 to 4 in.; 

(3) flash flooding with more than 4 in.; 

(4) direct hit of lightning on power lines; 

(5) direct hit by tornado; 
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(6) winds between 20 and 40 mph; 

(7) winds higher than 40 mph. 

The expert makes the following judgements: 


1 V 

s 2.... 

....1/3 

2 vs 3.... 

....1/2 

1 V 

s 3.... 

....1/4 

2 vs 4.... 

....1/3 

1 V 

s 4.... 

....1/5 

2 vs 5.... 

....1/3 

1 V 

s 5.... 

....1/5 

2 vs 6.... 

....1/2 

1 V 

s 6.... 

....1/3 

2 vs 7.... 

....1/3 

1 V 

s 7_ 

....1/4 



3 v 

s 4.... 

....1/2 

4 vs 5.... 

....1/3 

3 v 

s 5 — 

....1/2 

4 vs 6.... 

....1/5 

3 v 

s 6.... 

....1 

4 vs 7.... 

....1/4 

3 v 

s 7.... 

....1/2 



5 v 

s 6.... 

....5 

6 vs 7.... 

....1/2 

5 v 

s 7.... 

....4 




and produces the following matrix: 



1 

2 

3 

4 

5 

6 

7 

1 

1 

1/3 

1/4 

1/5 

1/5 

1/3 

1/4 

2 

3 

1 

1/2 

1/3 

1/3 

1/2 

1/3 

3 

4 

2 

1 

1/2 

1/2 

1 

12 

4 

5 

3 

2 

1 

1/3 

1/5 

1/4 

5 

5 

3 

2 

3 


5 

4 

6 

3 

2 

1 

5 

1/5 

1 

1/2 

7 

4 

3 

2 

4 

1/4 

2 

1 


Eigenvalue analysis of this matrix gives the principal 
eigenvalue as 8.001. The weights for the seven items are 
obtained by normalizing the seven terms in the corres¬ 
ponding eigenvector. For this example the respective 
weights of the seven items are: 0.03,0.06,0.11,0.11,0.35,0.15 
and 0.19. 

However, the consistency check gives a value of 0.13, 
indicating a degree of inconsistency. Examination of the 
initial judgements shows that the inconsistencies include 
the following: 1 vs 4is the same as lvs 5; 2 vs 4 same as 2 vs 5; 
3 vs 4 same as 3 vs 5; 6 vs 4 same as 6 vs 5 and 7 vs 4 same 
as 7 vs 5. These judgements imply that 4 and 5 are the 
same, but 4 vs 5 is given as 1/3. Furthermore they imply that 
6 < 7, but the judgements 4 vs 6 and 4 vs 7 imply that 6 > 7. 
There may be other inconsistencies, but these three are 
major. The following corrections are made: 


These weights are to be interpreted solely as indi¬ 
cating the relative ranking. Thus the items judged most 
likely to cause loss of power are 4 and 5, whilst that judged 
least likely to do so is item 1. The weights must not be used 
to draw quantitative conclusions. It is not correct to 
infer that item 7 (weight 0.15) is five times as likely as 
item 1(0.03). 

Saaty’s method has the advantages that it is easily used 
by an expert and that it monitors consistency. It is used 
primarily where the overall problem can be formulated to 
have a hierarchical structure. It has been widely used in 
decision analysis. 

Many problems, however, are not readily cast in hier¬ 
archical form. Moreover, the forcing of a problem into such 
form is contrary to a philosophy of letting the data suggest 
the methods of analysis and the models to be used. 


9.9.12 Hunns’ method 

A method for paired comparisons that allows items to be 
not only ranked but also scaled has been given by Hunns 
(1980, 1982). In order to calibrate the scale in terms 
of probability it is necessary to know the relationship 
between the scale units and the relative probability. 
Hunns suggests that there is evidence that this is a loga¬ 
rithmic one. Some support for the existence of a 
logarithmic scale has been given by Pontecorvo (1965) in 
a study involving comparison of expert judgements on 
repair times with field data. The relation may be expres¬ 
sed as: 


logio P% = h + hS x [9.9.5] 

where P is the relative probability of an item, S the scale 
value of the item, and k 2 are constants and the subscript x 
refers to item x. 

Taking one scale unit to correspond to a ratio r of prob¬ 
abilities the following relations then apply: 


- JSi-S 1) 
Pi 

= y (S,-Si) 
Pi 

rp u i 

“Ul 


rpi rn-S) 

Uj 


[9.9.6] 

[9-9-n 

[9.9.8] 


[9.9.9] 


Comparison Correction Objective 


and 


4- 

4- 


: 5 
; 6 


To make 4 and 5 the same 
To match 5 vs 6 
To match 5 vs 7 


k 1 = \og w (P 1 r-^) 
= logio r 


[9.9.10] 

[9.9.11] 


This now gives a consistency ratio of 0.06, which is much 
more acceptable, and yields the following revised weights: 
0.03,0.07,0.11,0.28,0.28,0.08 and 0.15. 


where subscripts 1 and u are to lower and upper. 

If absolute probability values are known for two items on 
the scale, Equations 9.9.6-9.9.11 may be used to obtain 
absolute values for the others. 
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The application of Hunns’ method is now described 
using the illustrative example given by him. A bench of 20 
judges is asked to rank four items A, B, C and D. The results 
obtained are recorded in the raw frequency matrix Fj which 
for this example is as follows: 


A 


C D 


A - 6 
B 14 - 
C 13 8 
D 9 0 


7 

12 


6 


The entries give the number of judges out of 20 
expressing the preference in question. An entry n in 
column Y, row X signifies that n judges prefer X to Y. 
Thus in this example all 20 judges prefer B to D. The 
entries on the diagonal are left blank. For an entry n in the 
upper triangular portion of the matrix there is an entry 
20 —n in the corresponding location in the lower trian¬ 
gular portion. 

Next the probability matrix P is obtained by dividing the 
entries in the F matrix by 20 and thus normalizing them: 


A 


C D 


A 

B 0.70 

C 0.65 

D 0.45 

E 1.80 


0.30 0.35 0.55 

0.60 1.0 

0.40 - 0.70 

0 0.30 

0.70 1.25 2.25 


The entries in each column are then summed as shown in 
the bottom additional row. 

The transformation matrix X is then obtained as follows. 
The order of the columns is rearranged in the numerical 
order of the values of E in the P matrix, starting with the 
highest value. The entries in the X matrix are obtained by 
replacing the probability values from the P matrix by the 
values of the unit normal deviates. Thus for each entry 
value Pthe probability P' is obtained as follows: 

P' = P p< 0.5 

= P — 0.5 P>0.5 

From the value of P' the unit normal deviate is then 
determined. For this use is made of a table of the cumulative 
normal distribution function (e.g. A.E. Green and Bourne, 
1972, p. 554). Thus for the entry in column A, row B in the 
P matrix, which has the value 0.70, the value of P' is 0.20 
(=0.70 - 0.50) and that of the unit normal deviate is 0.53. 
The X matrix is: 


D A 


C B 


A 0.13 

B ? 0.53 

C 0.53 0.38 

D - -0.13 


-0.38 -0.53 

0.25 


-0.53 ? 


The query signs occur where the judges were unanimous, 
namely in preferring B to D. 


The column difference matrix Z is then obtained by 
taking the differences between entries in the adjacent 
columns of the X matrix: 


D-A 


A 0.13 

B ? 

C 0.15 

D 0.13 

E jn 0.14 


A-C C-B 


0.38 0.15 

0.28 0.25 

0.38 0.25 

0.40 ? 

0.36 0.22 


The entries in each column are then averaged as shown 
in the bottom additional row. These latter entries are the 
scale values that are used to locate the items on the ranking 
scale. 

The range of the scale in this example, as given by the bot¬ 
tom additional row of the Z matrix, is 0.72 (= 0.14 + 0.36 + 
0.22). Item D has the lowest preference rating and is at the 
bottom of the scale and item B is at the top of the scale. 
The intervals between D and A, A and C, and C and C 
are, respectively, 0.14,0.36 and 0.22. 

This psychological scale may then be calibrated as a 
relative probability scale, as described above, and if the 
necessary absolute probability values are available for 
some of the items, absolute probabilities for the others 
may be calculated as described above. In performing this 
conversion, it is necessary to ensure that the upper limit 
of the scale is unity and to set some lower limit. For the 
latter Hunns uses a value of 10 -6 . Hunns describes an 
application of his method but does not claim it to be well 
tested. It is, however, one of the methods referred to in the 
literature. 


9.9.13 Applications 

The use of expert judgement is now a well-established 
approach. A critical review of some principal applications 
has been given by Mosleh, Bier and Apostolakis (1987). 
Five types of application are reviewed. 

The first is the assessment of component failure rates 
and other reliability parameters. Examples of the esti¬ 
mation of failure rates considered are those in the 
Rasmussen Report (AEC 1975), in IEEE Standard 500: 
1984, and in the Seabrook Station PRA (Pickard, Lowe and 
Garrick, 1983). 

The second type is the assessment of seismic hazard 
rates as exemplified in the studies by the Electrical Power 
Research Institute (EPRI, 1986) and Veneziano, Cornell and 
O’Hara (1984). 

The third type is the assessment of nuclear reactor 
containment phenomenology as instanced by the work of 
the Steam Explosion Review Group of the NRC (1985 
NUREG/CR1116) and the Surry Station PRA by Benjamin 
etal. (1986). 

The fourth type is modelling for the assessment of 
HERs. Examples considered here are: the approach descri¬ 
bed in the Handbook of Human Reliability Analysis (Swain 
and Guttman, 1983); the human cognitive reliability (HCR) 
model of Hannaman et al. (1986); the SLIM-MAUD method 
of estimating HERs of Embrey (1984); and, again, the 
Seabrook Station PRA. 

The fifth type is studies of precursor events, which have 
been carried out by Minarick and co-workers (Minarick 
and Kukielka, 1982; Cottrell, Minarick etal, 1984; Minarick 
etal., 1985). 
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These applications covered cases with a wide range of 
characteristics, including the following: 

(1) cases involving single, as well as multiple, experts; 

(2) cases involving structured group processes as well as 
unstructured ones; 

(3) cases with a wide range of substantive problem areas; 

(4) cases with and without availability of relevant empiri¬ 
cal data; 

(5) cases of varying degrees of complexity; 

(6) cases involving varying degrees of mathematical 
sophistication in the aggregation of responses; 

Some of the conclusions of the study are as follows. (1) An 
improvement in the quality of the results may often be 
obtained by decomposition of the problem into a set of more 
elementary problems. (2) Where experts are used to make 
estimates without the aid of formal methods, they tend to 
produce under- or overestimates and to underestimate the 
degree of uncertainty in these estimates. (3) Two effective 
techniques for reducing overconfidence are calibration 
training of the experts and exercises in which the experts 
are required to identify contrary evidence. (4) A structured 
group meeting tends to give better performance than an 
unstructured one. (5) Aggregation of multiple opinions 
tends to yield a more accurate result than the opinion of a 
single expert. (6) For aggregation of the opinions of multi¬ 
ple experts, mathematical methods of aggregation are to be 
preferred to behavioural methods of reaching a consensus. 

Decomposition is identified as an effective strategy. The 
approach suggested by the authors is to enlist the experts 
in the decomposition process. 

The use of multiple experts as opposed to a single expert 
is well established. But the methods of combining the 
responses of multiple experts need more development. 
Combination by an unstructured group does not give 
accurate results. On the other hand, the highly structured 
group used in the Delphi method seems cumbersome. The 
authors suggest the multiple team approach used by EPRI 
in the seismic hazard work. 

9.9.14 Failure rates 

As just described, one of the principal applications of 
expert judgement has been the estimation of failure and 
event rates. Experience in applications of this sort has been 
discussed by Apostolakis (1986). He distinguishes three 
general situations in which judgement is very prominent. 
These are where: (1) the probability distribution is devel¬ 
oped solely from non-statistical knowledge, for example, 
human error distributions; (2) the advice of experts 
is incorporated, for example, generic failure rates in the 
Rasmussen Report and fragility curves in seismic work; 
and (3) the statistical evidence if available but subject to 
different interpretations. The author discusses some of the 
detailed features of the generic failure rate estimates in 
the Rasmussen Report and IEEE Standard 500:1984. 

Expert judgement may also be used in the utilization of 
such generic data. A common situation is in which plant 
data are available to supplement the generic data and it is 
then necessary to aggregate them. This may be done using 
Bayes’ theorem. The generic data constitute the prior 
information that is adjusted using the plant data to obtain 
the posterior distribution. 

Apostolakis draws attention to the fact that in some 
cases of failure rate estimation when this Bayesian 


approach is used, it is found that the posterior distribution 
lies in the tail region of the prior distribution on the high 
side, indicating bias in the prior distribution. He suggests 
that this points to the need to broaden the prior distribu¬ 
tion, but acknowledges that this is a matter of debate (e.g. 
Apostolakis, 1982,1985a; Martz, 1984). 

9.10 Rare Events and External Threats 

One of the most difficult problems in event frequency esti¬ 
mation is that of rare events. Such events come under the 
following headings: 

(1) equipment failure; 

(2) external events 

(a) natural, 

(b) man-made. 

Usually it is necessary to take into account rare events only 
where the potential consequences may be very serious. The 
rare event problem is therefore essentially associated with 
major hazards. 

9.10.1 Equipment failure 

The failure rate of equipment is usually estimated from 
historical data. The difficulty in using this approach is that 
for rare events such data are sparse. This may render it 
necessary to resort to making an alternative estimate based 
on engineering principles. 

It is not uncommon that the historical record appears to 
show there to be some cases of the event of interest, but that 
it is judged that many, or even all, of these do not apply to 
the particular situation of interest. Discarding of failures 
that are considered inapplicable reduces the data set 
further. 

In the process, and nuclear, industries the rare event that 
has received most attention is almost certainly pressure 
vessel failure.The historical record shows only a handful of 
failures and some of these have been judged inapplicable 
for vessels designed to and operated at high standards. 

Statistics exist which allow an estimate to he made of the 
failure rate of a device even if the data are limited to just a 
few, or even one, failure. The confidence limits, however, are 
a function of the number of failures, and if there are only 
one or two of these the bounds are wide. It is also possible to 
make an estimate of the failure rate, or rather its upper 
bound, even if there have been no failures, based on the 
number of failure-free years of the equipment. For a rare 
but high hazard event, however, it is generally necessary to 
accumulate a rather large number of years without failure 
before the failure rate estimate begins to approach an 
acceptable value, and often the number of equipment-years 
recorded is insufficient. Similarly, statistics exist which 
allow estimates to be made of failure probability on demand 
for a device, both with and without recorded failures. The 
appropriate statistics are given in Chapter 7. 

If a statistical approach is considered inappropriate, it is 
necessary to resort to an attempt to make an estimate based 
on engineering principles. For example, for a pressure ves¬ 
sel use is made of estimates based on fracture mechanics 
and inspection considerations. 

A prime example of equipment failure as a rare event is 
the failure of the nuclear reactor pressure vessel considered 
at the Sizewell inquiry, which is described in Appendix 26. 
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9.10.2 Natural hazards 

There are various natural hazards that pose a threat to 
plant. Some of these are listed in Table 9.9. The relative 
importance of a particular natural hazard varies between 
different countries and between different locations within 
a country. 

For some natural hazards, particularly those due to 
weather, there are historical records that for certain sites at 
least may allow a frequency estimate to be made. Others such 
as those involving surface instability tend to be one-off 
events that are not amenable to prediction. A third class are 
those involving subterranean stress where the probability of 
the event may increase over time until the stress is relieved 
and where the prediction techniques are still developing. 

Information on recurring natural hazards is generally of 
two kinds. The hazard may be a discrete event that either 
occurs or does not occur and in this case, the data required 
are the frequency of occurrence. For such events the usual 
default assumption is that occurrence is random and that 
the data fit a Poisson distribution. 

The other situation is where the hazard is an event that 
has associated with it a variable that has a range of values. 
In this case, the data required are the maximum values of 
the variable. For example, for wave hazard the required 
data are maximum wave heights. Data of this latter kind 
may relate either to maxima of events occurring at random 
or, where a number of such events always occur within a 
year, to annual maxima. 

The statistical treatment of natural hazards is given in 
Statistics of Extremes (Gumbel, 1958). Descriptions are 
available of the application of such statistics to various 
natural hazards such as floods, hurricanes, waves and 
earthquakes. Further treatments are given by Perry (1981) 
and Schueller (1982). 

In considering such natural phenomena the point of 
interest is to know the probability that a given value x of the 
variable, say wind speed or wave height, will be equalled or 
exceeded - this is the ‘exceedance probability’. If the event 
occurs at random, then for an event rate X and time period t 
the number of trials v in which exceedance may occur is 

ti = Xt [9.10.1] 

If the event is the annual event for which the variable is the 
annual maximum, the number of trials 9 equals the number 
of years in the time period t. 

Table 9.9 Some natural hazards which pose a threat 
to plant 

Subterranean stress: 

Earthquakes 
Volcanoes 
Tsunamis 
Surface instability: 

Landslides and avalanches 
Ground surface collapse 
Weather: 

Wind, storm 

Tornadoes 

Hurricanes 

Floods 

Fires 


Considering first a general treatment, define P{x) as the 
distribution of the probability that exceedance does not 
occur and p as the probability that in a single trial it does 
occur. Then, 


P=l-P(x) 

[9.10.2] 

Furthermore, 


q l~P 

[9.10.3] 

^mP(x) 

[9.10.4] 

where q is the complement of p. The probability W(v) of 
exceedance in v trials is 

W(v) - 1 -<f 

[9.10.5] 

The mean number of trials v at which exceedance occurs is 

9 = 1 IP 

[9.10.6] 

From Equations 9.10.3,9.10.5 and 9.10.6: 


W(v) = l-{l-l/v) v 

[9.10.7] 

= 1 — exp(— v/v) 1/v =p « <j> 

[9.10.8] 


A return period T\x) may be defined as the mean time 
between exceedances, so that 


T = v 

Then, from Equations [9.10.8] and [9.10.9] 

W(v) = 1 - exp(-y/T) 1/T « 0 [9.10.10] 

v/T v/T «0 9.10.11] 

Equation 9.10.10 is independent of the form of the dis¬ 
tribution P(x). 

Turning now to the assignment of a specific distribution 
to the event of interest, Gumbel gives a number of dis¬ 
tributions, but that most commonly referred to as the 
‘Gumbel distribution’ is as follows. For P(x ) he gives 

P(x) = exp{-exp[—oc(* — «)]} [9.10.12] 

where u is a location parameter and a is a scale parameter. 
This is the distribution of the probability that exceedance 
does not occur. The distribution of the probability that 
exceedance does occur is 

F(x) = 1 - exp{-exp[-a(z - «)]} [9.10.13] 

It should be noted that Gumbel uses F[x) for the distribu¬ 
tion which is here denoted by P{x). Since exceedance is akin 
to failure, F(x) has been reserved here for the complement 
of P(x) so that it is akin to the failure distribution functions 
given in Chapter 7. 

Equation 9.10.13 is a form of the extreme value distribu¬ 
tion that is described in Chapter 7. This distribution is 
the appropriate one to use for extreme values of a variable 
that follows the exponential distribution. 
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Observed values of the variable of interest maybe plotted 
on special extreme value distribution graph paper, or 
‘Gumbel paper’. The vertical axis is a linear scale for 
the values of the variable. The horizontal axis is the prob¬ 
ability scale. The observed values are first ordered in 
ascending order of magnitude. The ranks are then deter¬ 
mined from 

r = m/{n + V) [9.10.14] 

where m is the order number, n the number of readings, and 
r the rank. The rank r is then equivalent to P(x). 

As an illustrative example, consider the determination of 
the distribution parameters for the wind gust data given in 
Table 9.10, where the data are already ordered and the rank 
calculated. The data are shown plotted in Figure 9.18. From 
this graph, at the 0.10 and 0.99 probability points (equival¬ 
ent to P(x)) the values x of the wind speeds are 51 and 
95 knots, respectively. Then the parameters u and a are 
57.9 and 0.124, respectively. 

The return period T of a particular wind speed is 
obtained as the reciprocal of F(x) (= 1— P(x)). Consider the 
return period of a wind speed of 95 knots. Since for this 
wind speed P(x ) = 0.99, the probability of exceedance .F(x) 
is 0.01 and the wind speed has a return period of 100 years. 
This value is extrapolated from 23 data points in which the 
maximum observed wind speed is 81 knots and is about the 
limit of extrapolation. 

If Gumbel paper is not available, the horizontal scale 
may be constructed using the reduced variate ym. 
-4n(-lnP(x)), as shown in Figure 9.18. 


Table 9.10 Annual maximum wind gust velocities at 
Cardington 1932-54 (after Perry, 1981) (Courtesy 
of George Allen & Unwin) 


Order no. (m) 

Highest gust 
(knots) 


Rank (r) 

1 

48 

1953 

0.042 

2 

51 

1950 

0.083 

3 

52 

1941 

0.125 

4 

53 

1951 

0.167 

5 

54 

1952 

0.208 

6 

55 

1937 

0.250 

7 

55 

1939 

0.292 

8 

56 

1942 

0.333 

9 

57 

1933 

0.375 

10 

58 

1949 

0.417 

11 

59 

1948 

0.458 

12 

60 

1945 

0.500 

13 

62 

1940 

0.542 

14 

63 

1934 

0.583 

15 

63 

1944 

0.625 

16 

66 

1954 

0.667 

17 

68 

1943 

0.708 

18 

68 

1946 

0.750 

19 

71 

1932 

0.792 

20 

72 

1936 

0.833 

21 

75 

1938 

0.875 

22 

77 

1935 

0.917 

23 

81 

1947 

0.958 


9.10.3 Man-made hazards 

Man-made hazards also pose a threat to plant. Some of 
these are listed in Table 9.11. The estimation of the fre¬ 
quency of events of this type is usually based on the use of 
historical data together with detailed consideration of the 
application of the data to the plant in question. 

For example, an estimate of the frequency of aircraft crash 
on a plant would be made by using general data on aircraft 
crash frequency in combination with information for the 
particular location about such factors as aircraft flight 
paths at any nearby airport, deviations from such paths, etc. 

9.11 Human Factors and Human Error 

Human error and, more generally, human factors is a wide 
and complex topic and the treatment here is limited to 
the bare essentials necessary for a balanced treatment 
of hazard assessment. A more detailed account is given in 
Chapter 14. The account given there includes details of 
available techniques. The discussion in this section tries 
to set these techniques in the context of hazard assessment. 

9.11.1 Human error in hazard assessment 

Analyses of failures in technological systems generally 
conclude that in the vast majority of cases human error has 
played a predominant role. Insofar as any failure can be 
attributed to some form of human failing, human error in 
its broadest sense becomes, by definition, the basic cause of 
failures. An exception to this can occur in the case where a 
risk has been assessed and, after evaluation, accepted, but 
where the hazard nevertheless materializes, as statistically 
it must in a proportion of instances. 

It is well appreciated by hazard analysts that it is neces¬ 
sary to take human error into account in hazard assessment 
work. The problem has been how to achieve this. As with 
other aspects of hazard assessment, there are two main 
motivations for investigating human error. One is to reduce 
it by identifying defects in the human factors environment 
and effecting improvements. The other is to obtain the data 
required to be able to quantify the human aspects of the 
assessment. 

The implications of these two motivations for the hazard 
assessment as a whole are different. The purpose of hazard 
assessment is to assist decision-making. There is a danger 
that the second approach will furnish data for quantifica¬ 
tion, but that it may be relatively ineffective in indicating 
improvements in the human factors area. 

It is fair to say that interest in human error in the process 
industries has been driven by the perceived need to address 
human error in hazard assessment, and in particular to 
obtain the human error data required for quantification. 

9.11.2 Human error in operation 

Historically, in hazard assessment most attention has been 
focused on human error in process operation. In the opera¬ 
tion of a plant, human error may contribute to an incident 
either as an initiating or enabling cause or as a failure to 
achieve some form of prevention or mitigation. 

Much of the early work on human error was concerned 
with estimating error rates in relatively well-defined activ¬ 
ities such as detecting a signal, pressing a button or opening 
a valve. Work then moved on to human error in executing 
a whole task using a relatively well-defined plan. Both 
activities and plans may be relevant to either causation or 
prevention of an incident. 
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Figure 9.18 Annual maximum gust velocities given in Table 9.10 plotted on extreme probability (Gumbel) paper 
(after Perry, 1981) 


Table 9.11 Some man-made hazards that pose a 
threat to plant 


Dam bursts 
Vehicle crashes 
Aircraft crashes 
Fires 

Explosions 


One method was to break a task down into its constituent 
elements, to collect data on the probability of error in the 
performance of these elements and to store these data in a 
human error data bank. This approach, however, tends to do 
less than justice to the operator’s information processing 


and decision-making which are generally critical to the 
performance of the task. An alternative method, therefore, 
is to treat the task as a whole and to collect data on the 
probability of error in the performance of the task. 

Both approaches make allowance for the influence of 
the work situation in which the task is performed by 
identifying performance shaping factors. The application 
of such factors requires the development for each factor of 
a measure of the strength of the factor and a relationship 
between the factor and the probability of error. 

The most widely quoted method is theTHERP technique 
developed by Swain and Guttman (1983). This technique 
makes widespread use of estimates of the probability of 
error in individual actions. A method that gives error esti¬ 
mates for whole tasks is the SLIM technique described by 








HAZARD ASSESSMENT 9/51 


Embrey (1983a,b). These and other methods are described 
in Chapter 14. 

Human error often occurs in the development of a branch 
of a fault tree. The typical application of the methods just 
described is to obtain an estimate of the probability of 
failure, or error, for use at this point. 

Another application of these methods is in the develop¬ 
ment of the branches of an event tree. Again the methods 
described have been used to estimate the probability of 
error at the branch points of an event tree. In particular, 
interest has centred on the prevention by the operator of 
escalation of the incident. The operator action event tree 
(OAET) is a particular form of event tree in which the 
branch points are defined in terms of failure of operator 
action. 

As so far described, the assessment of operator error 
occurs within essentially predefined structures such as 
fault trees and event trees. In some cases, the situation is 
more complex. One such case is where the operator makes 
some fundamental error in assessing the situation and 
performs a series of actions, which may be quite complex, 
and which cause an incident. This is probably the most 
difficult case to handle and only limited progress has been 
made. One area where there has been some progress is in 
respect of communication errors, as described below. 

Another case is where the operator is, in principle, able to 
prevent an incident but only by making a correct assess¬ 
ment of the situation and performing a series of actions, 
which may be quite complex and may involve initiative. 
This situation is sometimes dealt with by making a global 
estimate of the probability of no effective action. The 
probability is usually taken as a function that decreases 
quite strongly with time. 

9.11.3 Human error in maintenance 

Human error in maintenance has received rather less 
attention, although there is growing interest in it. Some 
maintenance errors result in an incident during plant 
operation. Insofar as the operations function has overall 
responsibility for safe operation, these may generally be 
regarded as operational failures. Other maintenance errors 
lead to an incident while the plant is shut-down. Main¬ 
tenance errors are also an influencing factor on the failure 
rate of plant equipment. 

9.11.4 Human error in communication 

Analysis of incidents shows that an important contribution 
comes from errors of communication. It is fair to say that so 
far this work has contributed more to defining good prac- 

human error. 

9.12 Management Aspects 

The prime determinant of the control over a hazard is the 
quality of management. The influence of management is all 
pervasive. In other words, it is a powerful cause of failure 
and has many of the features of a common cause. It is 
clearly desirable, therefore, to take the quality of manage¬ 
ment into account in any hazard assessment. 

The first point to be made is that if the quality of 
management falls below a certain level, then there is 
generally little point in doing a hazard assessment at all. 
Hazard assessment should be able to start from the 
assumption that management meets at least some mini¬ 
mum standard of quality, particularly for major hazard 


installations. If this is not so, the effort would be better 
employed in remedying the defects than in estimating the 
probable results of those defects. 

A second important point is that the use of management 
quality as an explicit input in a hazard assessment is a 
sensitive issue. This is so whether the assessment is being 
conducted by analysts within the organization concerned 
or by an outside body. 

In general, the realization of a hazard involves the 
occurrence of an initial event followed by escalation of that 
event. Management influences both the frequency of the 
initial event and the effectiveness of measures taken to 
prevent its escalation. 

9.12.1 Quantification of management influence 

The attempt to make allowance for the effect of manage¬ 
ment quality involves both devising a measure of quality 
and a model for the impact of that quality on event fre¬ 
quency and escalation. Discussions of allowance for man¬ 
agement quality in hazard assessment has been given by 
R.A. Cox and Comer (1982), Pitblado.Willliams and Slater 
(1990) and J.C.Williams and Hurst (1992). 

Some limited progress has been made in this area. Aspects 
of the quality of management are considered in Chapter 6. 
Indices of quality may be devised for this specific purpose 
or, alternatively, use may be made of other indices such as 
the International Safety Rating System (ISRS). 

The most straightforward application of such indices is 
to failure rates. Generic equipment failure rates may be 
regarded as being derived from organizations with 
‘average’quality management. These base failure rates may 
be adjusted according to the assessment made of manage¬ 
ment quality. 

9.12.2 MANAGER model 

The MANAGER model developed by DnV Technica and 
described by Pitblado, Williams and Slater (1990) exem¬ 
plifies this approach. 

A review was conducted of systems that might be 
adapted to provide modifiers for generic failure data to 
take into account management factors (MFs). Systems 
reviewed included the ISRS (Bird and Germain, 1985), 
the Management Oversight and Risk Tree (MORT) (W.G. 
Johnson, 1980) and the Technique for Human Error Rate 
Prediction (THERP) (Swain and Gutmann, 1983). The first 
two are described in Chapter 28 and the last in Chapter 14. 
It was concluded that ISRS would be relatively slow and 
costly to use and that it would not fit well with QRA, and 
that the strength of MORT is in accident investigation 
and that of THERP is in assessing the human error contri¬ 
bution in fault tree analysis. A requirement was defined for 
a modification of risk (MOR) method that would be simpler 
to use than human reliability assessment. 

The properties that such a method should have were 
identified as the following. It should: (1) be based on a 
review of the role of safety management in actual accident 
causation, (2) address all areas shown to be important in 
accident causation, including human factors, (3) confirm 
that widely accepted management principles are suitably 
embedded in all key elements of the safety management 
system and (4) provide both a qualitative overview of 
safety management and an indication of quantitative 
modification to generic failure rates. 

MANAGER is based on a questionnaire that utilizes 
the concept of performance shaping factors, which are 




9/52 HAZARD ASSESSMENT 


described in Chapter 14. The four most significant for this 
purpose were identified as (1) resources (manning, instru¬ 
mentation), (2) system norms (incident reporting, safety 
policy, training), (3) communications (information flow, 
written documentation) and (4) pressures (stress, bore¬ 
dom). The questions are structured to conform with loss 
prevention principles as well as with these human factors 
influences. The questionnaire is structured into 12 broad 
topics, as shown in Table 9.12. 

The responses to the questionnaire are scored as the 
proportion P which are rated as industry average (Pa), bet¬ 
ter than average (P G ) or worse than average (P B ) Use is 
made of a triangular diagram with these three proportions 
P A , P G and P B at its corners. Values of a MF are located on 
the triangular diagram. A completely average plant (P A = 1) 
has a value of MF = 1. This same value of the MF is also 
obtained by a plant with only good and bad responses 
(P A = 0) at P G = 0.74 and P B = 0.26. A completely good plant 
has MF = 0.1 and for a completely bad plant MF = 100. In 
some 30 plant audits, values of MF ranged from 0.5 to 8.0. 

The MF may then be used in QRA as a modifier for gen¬ 
eric failure rates: 


Pest = MF x P gen [9.12.1] 

where F est is the modified failure frequency and P gen is the 
generic failure frequency. 

A case study of the application of MANAGER has been 
described by J.C. Williams and Hurst (1992). A comparative 
investigation was made of two technically similar major 
hazard sites. The comparison was between the number 
of incidents reported under the RIDDOR regulations and 
the computed MF. The numbers of RIDDOR incidents per 
1000 employees over the periods April 1986-March 1987, 
April 1987 -March 1988 and January-March 1991 were 8.7, 
7.3 and 5.9 for companyA and 12.5,10.3 and 8.0 for company 
B. The computed MFs were 0.9 for company A and 1.7 for 
company B. Thus at site B the occupational incident rate 
was almost twice that at site A, and likewise the risk at site 
B as given by the MF was nearly twice that at site A. QRA 
showed that an individual risk of 10 _5 /year occurred at 
site B at a distance of 400 m but at site A at 290 m. Further 
studies would be required to confirm the generality of the 
correlation. 

As the study just described indicates, MANAGER may 
also be used for audit purposes. 


Table 9.12 Twelve topic areas of MANAGER question¬ 
naire (after Pitblado, Williams and Slater, 1990) 


1. Written procedures 

2. Incident and accident reporting 

3. Safety policy 

4. Formal safety studies 

5. Organization factors 

6. Maintenance 

7. Emergency resources and procedures 

8. Training 

9. Management of change 

10. Control room instrumentation and alarms 

11. Other human factors influences 

12. Fire protection systems 


9.12.3 STATAS model 

Another model that is relevant here is STATAS. This has 
been developed for the purposes of audit. However, just as 
MANAGER may also be applied to audit, so STATAS has a 
potential use in making allowance for MFs in QRA. It is 
described in Chapter 6. 

9.13 Hazard Models 

The estimation of the physical effects of a particular 
release scenario involves the use of a series of hazard, or 
consequence, models. Some of the models required are 
shown inTable 9.13. Most of the entries are straightforward, 


Table 9.13 Some principal hazard models 


Emission 

Holes: 

Gas flow 
Liquid flow 
Two-phase flow 
Vessel rupture 
Pipeline rupture 
Vents 

Relief valves 
Vaporization 
Flashing liquids 
On land: 

Spreading liquid 
Volatile liquid 
Cryogenic liquid 
On sea: 

Spreading of immiscible liquid 
Mixing of miscible liquid 
Volatile liquid 
Cryogenic liquid 
Air entrainment 
(for each emission situation) 

Source term 
Gas cloud dispersion 
Neutral density clouds 
Heavy gas clouds 
Buoyant gas clouds 
Plumes 

Neutral plumes 
Heavy gas plumes 
Buoyant plumes 
Jets 

Momentum jets 
Fires 
Pool fires 
Fireballs 
Flash fires 
Jet flames 
Engulfing fires 
Explosions 

Physical explosions of plant 

Combustion explosions inside plant 

Vapour cloud explosions 

Explosions in buildings 

Boiling liquid expanding vapour explosions 
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but the references to air entrainment and source term 
require some further explanation. 

The models for emission allow an estimate to be made of 
the amount of material that is released or the rate at which it 
is released, but they do not in themselves necessarily give 
any information on the extent to which the emission entrains 
and mixes with the air. Dispersion models can be sensitive 
to the amount of air that mixes with the initial emission. 
It is necessary, therefore, to make some estimate of this. 

The emission constitutes the source term for the disper¬ 
sion models. A real emission does not usually correspond 
exactly to idealized source terms such as pure instanta¬ 
neous or continuous sources, and a source term has to be 
selected which represents the situation as closely as 
possible but is suitable as input to the dispersion model. 

Consequence models are described mainly in Chapters 
15-17. 


9.14 Domino Effects 

Another aspect that needs to be taken into account in 
hazard assessment is the possibility of knock-on or 
‘domino’ effects, leading to escalation. An event at one unit 
may be the cause of a further event at another unit, and so on. 

The possibility of domino effects was one of the princi¬ 
pal concerns that led to the hazard assessment of the com¬ 
plex of installations at Canvey, which was the subject of the 
two Canvey Reports described in Appendix 7. 

The incident at Feyzin in 1968 (Case History A38) in 
which a fire on one storage sphere led to a series of fires and 
explosions involving other spheres illustrates the danger. 
Other subsequent incidents in which a domino effect has 
played an important role include Mexico City in 1985, 
Pasadena in 1988 and Piper Alpha in 1988. These incidents 
are described in Appendices 4,6 and 19, respectively. 

A method of handling potential domino effects in hazard 
assessment has been described by Bagster and Pitblado 
(1991). Table 9.14 shows a matrix of interactions between the 
process areas of two different operators obtained from the 
Canvey Report and quoted by these authors. A domino 
event may be treated either as an increase in the con¬ 
sequences of the event at the initiating unit, or as an 
increase in the frequency of events at the victim unit. The 
method described in this work adopts the latter approach. 

Five events are included in the treatment: pool fire, 
explosion, boiling liquid expanding vapour explosion 
(BLEVE) giving rise to a fragment, jet fire and delayed 
explosion of a vapour cloud. The escalation is described in 
terms of a loss of containment at the victim unit. The 


Table 9.14 Matrix of potential interactions of process 
area explosions for two installations at Canvey: frequency 
of massive release of LPG per Iff years (Bagster and 
Pitblado, 1991) (Courtesy of the Institution of Chemical 
Engineers) 


Explosion at 

Fire spreading to LPG 


storage at 



Occidental 

URL 

Occidental process area 

0.12 

0.075 

URL process area 

0.09 

0.065 


LPG, liquefied petroleum gas; URL, United Refineries Ltd. 


following relation is used to describe loss of containment at 
unit; due to an event at the initiating unit i: 



wherep\ oc j ; i is the probability of loss of containment at unit 
j due to an event at unit i, r is the distance of unit; from unit 
i, and ni m; i is the maximum distance at which the event at 
unit i can cause damage. 

The basic relation for the frequency of loss of contain¬ 
ment at the unit; due to an event at unit i is 

Floo-,i;i = Pk ^cat;i 

+Fjeak* rm t jfrnPm-,i M mi J [9.14.2] 

m =4 / 

with 

Afy = Mu m 1 [9.14.3] 

where F cat;i is the frequency of a catastrophic failure at unit i, 
Fieak ; i is the frequency of a leak failure at unit i, F ioc .j ; i is the 
frequency of loss of containment at unit; due to an event at 
unit i, M m; i is the factor for mitigation of the event at unit ; due 
to its directionality, y>ioc;; ; i;m is the probability of loss of con¬ 
tainment at unit; due to an event at unit i of type m, P m;i is 
the probability that the event at unit i is an event of type m 
and PI, is the probability of ignition following failure at unit 
i. The five events are pool fire (PF; m = 1), explosion (EX; 
m = 2), BLEVE fragment (BF;w = 3), jet fire (JF; m = 4) and 
delayed explosion (DEX; m = 5). The same probability of 
ignition is used for both types of failure and for all types of 
event. 

In addition to this escalation of the primary event at unit 
i into a secondary event at unit;, the method also takes into 
account escalation of the latter into a tertiary event at unit k. 
In order to do this, it is necessapr to make some assumption 
about the probability distribution of the failures induced at 
unit ;. The assumption made is that the distribution 
between catastrophic failures and leak failures at unit; is 
the same as that at unit i. The relation for the probability of 
loss of containment at unit k due to an event at unit;', itself 
due to an event at unit i, is then 


Ploc-Mi = PlflocJ-,i Y^Plo C ,k,r,mPm-,iM m .,j 
+ (1 -</>;) 



[9.14.4] 


[9.14.5] 

[9.14.6] 


where M m .j is the factor for mitigation of the event at unit; 
due to its directionality, Pioc;kj;i the probability of loss of 
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containment at unit k due to an event at unit;', itself due to 
an event at unit i, pi OC ;kj;m is the probability of loss of con¬ 
tainment at unit k due to an event at unit; of type m, P m ;j is 
the probability that the event at unit; is of type m, Plj is the 
probability of ignition following failure at unit;, and <fo, is 
the probability that the failure at unit; is catastrophic. 

It is also necessary to take into account the fact that the 
damage zone of the event at unit; may be partially or totally 
within the damage zone of the event at unit i, or vice versa. 
This is taken into account by utilizing for each type of event 
a correction factor S m . This correction factor is applied to 
the frequency of loss of containment at unit; for an event at 
unit i of type m. In effect, this is a correction to allow for 
overlap of the damage zones and thus to avoid double 
counting of the damage. 

The three situations that are possible if overlap occurs 
are shown in Figure 9.19. An overlap factor q m is defined 
which has the values 


dm »l! 

damage zone of event i lies entirely within 
that of event; 

q m = 1/2 

damage zones of event i and; partially 
overlap 

«- = o 

damage zone of event; lies entirely within 
that of event i 


The overlap correction factor S m is then 


S m m. 


TLi p mM m q m 

ELt PmMm 


[9.14.7] 


where M m is the probability of mitigation of an event at unit 
j of type m, P m is the probability that the event at unit; is an 
event of type m and q m is the overlap factor for an event at 
unit; of type m. 

The authors give the following illustrative example. 
They investigate the domino effects for two alternative 
layouts of a plant consisting of four items — an atmospheric 
storage tank, two storage spheres and a compressor. In one 
configuration the items are laid out in a square and in the 
other they are in a line. Details of the units are given in 
Table 9.15, Section A. The frequencies of loss of contain¬ 
ment for three levels of escalation in the square layout case 
are shown in Table 9.15, Section B, and the corresponding 
first-order domino matrix in Section C. The results given in 
the domino matrix show, for example, that for unit 1 the 
base failure frequency of 6 x 10 _6 /year is augmented by 
0.893 x 10 _6 /year due to domino effects. 


9.15 Hazard Model Systems 

There are a number of hazard model collections and com¬ 
plete hazard assessment systems. These include: 

(1) the vulnerability model; 

(2) the ‘ Yellow Book’] 

(3) plant layout model; 

(4) SAFETI system; 

(5) WHAZAN system. 


These are now described in turn. 


9.15.1 Vulnerability model system 

One major hazard assessment system is the vulnerability 
model (VM), later renamed the population vulnerability 
model (PVM), developed under contract for the US Coast 
Guard to investigate the possible effects of hazardous 
material spills. The basic VM is described by Eisenberg, 
Lynch and Breeding (1975) in a report entitled Vulnerability 
Model: A Simulation System for Assessing Damage Resulting 
from Marine Spills. Specific models developed in support of 
the VM are given by Raj and Kalelkar (1974). The second 
stage of the development of the VM is described by Rausch, 
Eisenberg and Lynch (1977) and the third stage by Rausch, 
Tsao and Rowley (1977). Modifications to the VM are 
described by Tsao and Perry (1979) and by Perry and 
Articola (1980) and a users’ guide is given by Rowley 
and Rausch (1977). The VM and its applications have been 
reviewed by Parnarouskis, Perry and Articola (1980). 

The VM is a consequence assessment system. It consists 
of a set of hazard models and injury/damage relations 
which are used in conjunction with meteorological and 
population data for a given site to assess the effects of 
specified releases of hazardous materials. The overall 
structure of the VM is shown in Figure 9.20. Within this 
structure, there are a number of decision trees for the 
selection of the scenarios and the corresponding hazard 
models. The decision tree for the behaviour of the cargo on 
release is shown in Figure 9.21. The information required 
by and obtained from the model is shown in Table 9.16. 
Figure 9.22 illustrates the simulation of a vapour cloud 
from a marine spill. 

Some of the principal elements in the VM are shown in 
Table 9.17. As the table indicates, the VM is a prime source 
both of hazard models and of injury relations for both 
flammable and toxic releases. Many of these are considered 
in later chapters. 


Primary event Secondary event 



<7m = 1 q m ='A q = 0 

Figure 9.19 Relationship between primary and secondary events in a domino incident (Bagster and Pitblado, 1991) 
(Courtesy of the Institution of Chemical Engineers) 
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Table 9.15 Illustrative example of potential interactions for four plant items on a single site (after Bagster and 
Pitblado, 1991) (Courtesy of the Institution of Chemical Engineers) 


A Data 


Plant item number 

1 

2 

3 

4 

Plant type 

Atmospheric storage tank 

Sphere 

Sphere 

Compressor 

Toxic? 

No 

No 

No 

No 

FC kt (per million years) 

1.0 

1.0 

1.0 

50 

P'leak (per million years) 

5.0 

1.0 

1.0 

100 

Probability ignition, PI 

0.1 

0.2 

0.2 

0.1 

Probability of pool fire, P pf 

0.3 

0.25 

0.25 

0.1 

Probability of explosion, P EX 

0.2 

0.25 

0.25 

0.1 

Probability of BLEVE, fragments, p bi 

0 

0.1 

0.1 

0 

Probability of jet fire, Pj P 

0.05 

0.2 

0.2 

0.1 

Probability of delayed explosion, P D ex 

0.1 

0.1 

0.1 

0.05 

Mitigation factor for BLEVE fragments, M m bf 

0 

0.005 

0.005 

0.05 

Mitigation factor for jet, Afj F 

0.01 

0.01 

0.01 

0.05 

Mitigation factor for drift of explosion, M D ex 

0.005 

0.005 

0.005 

0.05 

Pool fire range, r pi (m) 

25 

20 

15 

25 

Explosion range, r EX (m) 

30 

40 

25 

30 

Fragment range, r B f (m) 

0 

1.0 

1.0 

0 

Jet fire range, r JF (m) 

10 

20 

25 

20 

Delayed explosion range, r D EX (m) 

50 

50 

35 

50 


B Loss of containment frequencies: square configuration 


Primary events 


Primary loss of containment frequency 






1 


6 


3 


2 


4 


150 


First-order knock-ons 


Additional loss of containment frequency 


Item 




1 


0.89 


2 


0.48 


3 


0.36 


4 


0.11 


Second-order knock-ons 


Additional loss of containment frequency 


Item 




1 


2.8E-02 a 


2 


7.8E-03 


3 


8.1E-03 


4 


2.2E-02 


Third-order knock-ons 


Additional loss of containment frequency 


Item 




1 


6.3E-04 


2 


2.6E-04 


3 


1.9E-04 


4 


4.7E-04 


(Coordinates (m): 1(0,0), 2(10,0), 3(0,10), 4(10,10)) 




a E -n = 10-” 




C First-order domino matrix square configuration 

Causing unit 


Victim unit 



1 

2 3 

4 

1 

6 

0.021 0.015 

0.026 

2 

0.061 

2 0.019 

0.038 

3 

0.070 

0.024 2 

0.051 

4 

0.762 

0.432 0.326 

150 

First-order domino frequency 

0.893 a 

0.477 0.360 

0.115 

(column sum minus major diagonal entry) 





Coordinates of units (m): 1(0,0), 2(10,0), 3(0,10), 4(10,10) 
a 0.061 +0.070 + 0.762. 
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The injury relations in the VM, given in the form of probit 
equations, have proved of particular interest, owing to the 
paucity of information on this aspect. The VM studies did 
pioneering work in defining the form of the causative factor 
and in deriving constants for the probit equations. Inevi¬ 
tably, some of these require modification in the light of 
more recent work. Table 9.18 lists some of the original probit 
equations in the model. In the later work, revisions and 
additions were made to the probits for toxic gases, as 
described in Chapter 18. 

The principal application of the VM is consequence 
assessment for planning purposes. It is used to estimate 
for a particular site the effects of hazardous releases, to 
determine whether particular releases would cause 
casualties, and to give a hazard ranking. The VM is also 
used to compare the hazards of specified releases at dif¬ 
ferent sites. For example, comparisons have been made of 
the relative hazards of LNG terminals at Point Conception 
and Oxnard in California. 

9.15.2 ‘YellowBook' models 

A major collection of hazard models is given in Methods 
for the Calculation of the Physical Effects Resulting 
from Release of Hazardous Material by the Committee 
for the Prevention of Disasters (CPD, 1992a) in the 
Netherlands. The report is published by the Dutch Labour 
Inspectorate and the work was done by Toegepast- 
Natuurwetenschappelijk Onderzoek (TNO). It is usually 
referred to as the ‘yellow Book’. The principal contents of 
the Yellow Book are shown in Table 9.19. 


9.15.3 Plant layout models 

A set of hazard models for use in plant layout has been 
given in Process Plant Layout (Mecklenburgh, 1985). These 
models are listed in Table 9.20. 



Figure 9.20 Vulnerability model: structure of the model 
(Parnarouskis, Perry and Articola, 1980) 


9.15.4 SAFETI computer code 

Another major collection of hazard models is that in the 
SAFETI computer code for risk assessment developed 
by Technica. The hazard models used, as described by 
Pitblado and Nalpanis (1989), are as follows. For gas 
dispersion, four regimes are recognized. These are 

(1) turbulent jet dispersion, (2) hydrid dispersion with 
both turbulent jet and dense gas behaviour, (3) dense gas 
cloud, and (4) passive dispersion. The dense gas dispersion 
model used is that of R.A. Cox and Carpenter (1980). 

The other models cover: (1) vaporization from a pool 
using the model of O.G. Sutton (1953) or, for liquids with 
boiling points below ambient, that of Drake and Reid 
(1975); (2) vapour cloud explosion using the TNO correla¬ 
tion model by Opschoor (1979); (3) fireball, or BLEVE, 
based on the model of Moorhouse and Pritchard (1982); 
(4) pool fire, using an in-house model; and (5) jet flame, 
using the TNO free jet model to obtain the jet length com¬ 
bined with the American Petroleum Institute (API) model 
for thermal radiation. There is no flash fire model as such; it 
is assumed that the fire is co-terminus with the cloud and 
in determining injury a small additional increment is 
added to this contour to allow for the thermal radiation 
close to the cloud. Probit equations are used for injury and 
damage effects. 

9.15.5 WHAZAN computer code 

A set of hazard models is the core of another computer code 
WHAZAN developed by Technica for the World Bank. The 
package is described in Manual of Industrial Hazard 
Assessment Techniques (World Bank, 1985). This system 
allows the user to explore interactively the consequences of 
a set of release scenarios. The frequency of occurrence of 
the scenarios is not estimated and the hazard models are 
relatively simple. The package is not intended for prob¬ 
abilistic risk assessment. 

The models used are given in Table 9.21 and a typical 
event tree which the user can explore using WHAZAN is 
illustrated in Figure 9.23.These relate to the initial version 
of the program. WHAZAN is therefore a much simpler 
package than SAFETI. It is described further in Chapter 29. 

9.16 Population Characteristics 

Information on the characteristics of the exposed popula¬ 
tion is frequently required in a hazard assessment. The 
people exposed consist of two groups, those working on 
the site and those living and/or working in the area 
around the site. 

It is usually a straightforward matter to obtain the 
necessary information on the on-site workforce, but this is 
not so for the off-site population. Here the data required 
include 

(1) population density; 

(2) population composition; 

(3) population changes by time of day; 

(4) vulnerable population; 

(5) population outdoors. 

For estimation of societal risk information is required on 
all these items, but even for estimation of individual risk 
only it is still necessary to have data on the vulnerable 
population and the population outdoors. 
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DEFINITION OF 
SPILL EVENT 



Release of gas directly Release of gas from 

or from the water surface a floating pool 


Figure 9.21 Vulnerability model: decision tree for behaviour of cargo on release (Eisenberg, Lynch and Breeding, 1975) 


The accuracy of estimation of the density and other 
characteristics of the population should broadly match that 
of the other stages of the hazard assessment. Avery refined 
estimate of the population characteristics will often not be 
justified. On the other hand, it should he borne in mind that 
some of the factors that characterize the population are not 
independent. Thus the number of people at home during 
the day is less than at night, but the proportion of vulner¬ 
able people is greater. 

A method for the determination of the population char¬ 
acteristics for Britain has been given by Petts, Withers and 
Lees (1987). The method is intended primarily for use in 
estimating the societal risk of fatalities for sets of scenarios 
where typically in a large proportion of cases the fatal 
effects may not extend sufficiently far for more approxi¬ 
mate methods of estimating population density to give 
sufficient accuracy. 

9.16.1 Population density 

Estimates of off-site population density have been made in 
the two Convey Reports and in the Rijnmond Report. The 
Convey Reports are mainly concerned with the off-site 


population, but the Rijnmond Report gives estimates of the 
on-site population density. For the on-site population, data 
on the number of workers at each site were obtained and the 
numbers present during the working day A d and at other 
times A n were determined. Then assuming three-shift, 
7-day working, the number of manshifts worked per week 
is 5 A d + 16 A n , and assuming that each employee has « h 
weeks off for holidays and sickness, etc., and therefore 
works (52 - w h ) weeks per year, the average number A s of 
employees on site is 


A s = ((5A d + 16A n ) x 52)/(5 x (52 - n h )) [9.16.1] 

The average number on site in the daytime for the six sites 
in this study was found to be 200 persons/km 2 . The site 
area used in this computation appears from the map of the 
area to be filled with process plant and storage and does not 
contain much open space. 

For the off-site population in the First Convey Report the 
general approach is to define the built-up areas on the map 
and to use for these areas a uniform population density of 
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Table 9.16 Vulnerability model: outline of information 
required by and obtained from the model (after Perry and 
Articola, 1980) 


A Information required 

Characteristics of the cargo (e.g. chemical composition, 
size of tank, temperature of cargo) 

Size and location of the rupture 
Characteristics of the spill environment (e.g. marine 
characteristics and weather conditions) 
Geographical location of the spill 
Location and characteristics of the vulnerable resource 
(people and property) in the vicinity of the spill 


B Information obtained 


Size and characteristics of the spill 
Disposition of the hazardous materials (e.g. mixing, 
sinking, dilution, vaporization, diffusion, dispersion) 
Concentrations and hazardous effects of spilled material as 
a function of position and time (e.g. toxic concentration 
and dose, thermal intensity and dose, overpressure) 
Number of people killed and injured and amount and value 
of property damage 


4000 person/km 2 . The population profile was obtained in 
some cases up to 32 km from the hazard source. In some of 
the studies in the report, however, there are variations. In 
Appendix 3, use is made of population densities of 5000 
and 100 persons/km 2 for urban and rural areas, respec¬ 
tively. In Appendix 14, use is made of census data on the 
number of people in 100 m squares. In the Second Convey 
Report it is this latter method that is used. 

The Rijnmond Report also makes use of census data on 
the number of people in grid squares, in this case 500 m 
squares. This grid covered an area of some 75 km 2 . Uniform 
population densities were assumed outside the grid. 

The method for the estimation of the population density 
for British conditions given by Petts, Withers and Lees is as 
follows. Use is made of national census population data. In 
Britain, there is a full census every decade, the then most 
recent being in 1971 and 1981. The 1981 Census (OPCS, 
1981a) is available as is the official user guide (OPCS, 
1981b) and a further guide (Rhind, 1983). Other useful 
documents are the 1981 Labour Force Survey (OPCS, 1981c) 
and the Annual Abstract of Statistics (CSO, 1985). The 
basic small geographical unit for the census is the enu¬ 
meration district (ED), which is an area of land defined in 
terms of the number of households representing a suitable 
census workload. The average population of an ED in 
England and Wales is about 500 in urban areas and 150 in 
rural areas. The local geography of the census in Scotland 
is slightly different in that EDs are built up from the Post 
Office postcode areas. The main small unit statistical out¬ 
put from the census is the small area statistics (SAS), which 
are supplied by the Census Office on magnetic tape, on 
microfilm or as paper copy There are delays of several years 
in the publication of some census data. Naturally, the data 
become out of date, and this needs to be borne in mind. 

The estimation of the population density off site requires 
the use of Ordnance Survey maps. Four principal map sizes 
relevant here are the 1:25,000, 1:10,000, 1:2500 and 
1:1250 scale series. The 1:10,000 scale is that normally 
used by local authorities. It is also the size on which the 


census EDs are recorded and maps showing the boundaries 
of the EDs are available from the Census Office as paper 
copies of microfilmed 1:10,000 scale maps. The 1: 2500 
and 1:1250 scale maps can be useful in locating more 
accurately the boundaries between EDs; unfortunately the 
whole country is not covered by these series. These maps 
give the most detailed record of buildings. In the 1:10,000 
and 1: 25,000 series there is some loss of detail and accu¬ 
racy with respect to buildings. 

The method that gives the most accurate results for 
population density is the use of the census data. This 
should therefore be used where it is practical to do so. There 
may, however, be reasons for not using census data for the 
whole area of interest. One is that it can be time-consuming. 
Another is that the census may have become out of date. 

In these circumstances, a rapid estimate of population 
may be made using a map to identify the built-up areas and 
assuming population densities of 4000 persons/km 2 for 
large built-up areas, 100 persons/km 2 for other inhabited 
areas, and zero population for uninhabited areas. 

For more accurate work, a more detailed approach is 
necessary. It is recommended by Petts, Withers and Lees 
that three zones be defined around the hazard source, 
delimited by distances of 400 and 1000 m. For the outer 
zone (>1000 m) the rapid estimation method should be 
used. For the intermediate zone (400-1000 m) the map 
should be used to identify three types of residential area 
and the uninhabited area. These three types of residential 
development are: dense, usually in-town, terraced housing 
(and high-rise flats); semi-detached housing, usually sub¬ 
urban; and sparse, detached housing. Population densities 
of 15,000, 10,000 and 1000 persons/km 2 , respectively, 
should be used. 

For the inner zone (<400 m) the population should be 
estimated from census ED data. It is recommended, how¬ 
ever, that for this inner zone this estimate should be 
checked against visual inspection and local inquiry. The 
radius of the inner zone was originally set at 250 m, but 
site inspection indicated that this may be too short a dis¬ 
tance for acceptable accuracy. The distance of 400 m is 
therefore preferred as the boundary of the inner zone. This 
method for the estimation of the density of the population 
around a hazard source is summarized in Table 9.22. 

It is necessary to define the point from which the circles 
defining these zones are drawn. There appears at present to 
be some difference of practice. In some cases this point is 
taken to be the plant itself, in others the site boundary. The 
former makes more sense for a plant at a specific point, but 
the latter allows for relocation of the plant within the site 
boundary. 

The accuracy of the method described for the estimation 
of the population density in the middle zone was checked 
against the 1981 Census data for three hazardous sites. The 
average difference in the estimates of the numbers of peo¬ 
ple was 14%, one estimate being low and two high. 

The use of the census data is not entirely straightforward. 
The approach used by the authors was first to identify 
the codes of the required EDs from 1:10,000 scale maps 
provided by the Census Office and then to obtain the ED 
data by interrogating the Census computer data bank. 

There are in existence several computer programs that 
process population data. These use data on the numbers of 
people in each 100 m square. This information was pro¬ 
vided in the 1971 Census, but is not available in the 1981 
Census. 
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Geographic cell (location of 
cell resources at cell centre) 



• For flammable vapours, simulation stops when 
ignition occurs, and fire or explosion damage 
to each cell is computed at that time 

• Ignition occurs if cell contains ignition source 
and concentration is above lower flammable limit 

Figure 9.22 Vulnerability model; simulation of vapour release from a marine spill (Parnarouskis, Perry and 
Articola, 1980) 


The basic case for the off-site population is the nighttime 
population. It is this that is given by the census data and by 
the method just described. An approximate estimate of the 
number of people over the whole 24 h is 80—85% of this 
value. However, the probability of some hazards may be a 
function of time of day and it then becomes necessary to 
estimate population by time of day also. The daytime 


population may be estimated more accurately, as described 
below. 

Attention is drawn by Petts, Lees and Withers to the fact 
that errors in drawing the boundaries between areas of 
different population densities can easily lead to errors 
which are as great or greater than those which are due to 
errors in estimating those densities. 
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Table 9.17 Vulnerability model (VM): some principal 
elements of the model 


A Reports onVM 


Eisenberg, Lynch and Breeding (1975) 
Raj and Kalelkar (1974) 

Rausch, Eisenberg and Lynch (1977) 
Rausch, Tsao and Rowley (1977) 

Thao and Perry (1979) 

Perry and Articola (1980) 

Rowley and Rausch (1977) 

ELB 

RK 

REL 

RTR 

TP 

PA 

RR 

B Elements of VM 


Reference! 
page number 

Overview 

ELB 

Computer programs 

ELB; REL, 211; 

TP, 30 

Emission and vaporization 

Overview 

ELB, xi, xii 

Spreading of liquid on land 

Spreading of liquid on water or 

ELB, 20; RK, 19, 

other liquids 

85,113,139,228, 
232, 234,235 

Mixing and dilution of soluble 

ELB, 21; RK, 29, 

liquid in water 

115,228,236 

Boiling and sinking of heavy 

ELB, 22; RK, 

liquid in water 

171,237 

Gas/vapour dispersion 

Overview 

ELB, xi, 23 

Instantaneous release (puff) 

ELB, 33; RTR, 16 

Continuous release (plume) 

ELB, 33; RTR, 15 

Model selection 

ELB, 195 

Dispersion coefficients 

ELB, 42 

High concentration sources 

ELB, 185 

Area sources 

RK, 55 

Plume width 

RK, 57 

Meandering plume 

ELB, 42 

Fire 

Overview 

ELB, xi.xiv, 
xviii, 92 

Ignition, ignition sources 

ELB, xiii, 49,207; 
REL, 35 

Flammable cloud size 

ELB, 211 

Flash fire 

ELB, 59; REL, 31; 
RTR, 13; TP, 17 

Pool fire 

ELB, xiv, 66 

Flame dimensions 

ELB, xiv; RK, 63, 

65,230,231; 

RTR, 12 

Thermal radiation 

ELB, xiv 

View factor 

ELB, xiv 

Burning time 

ELB, xiv 

Fireball 

RTR, 5 

Jet flame 

RK, 64,231 

Thermal radiation View factor 

Structure ignition 

REL, 49 

Secondary fires 

REL, 5 


Toxic combustion products REL, 91,114 


Explosion 
Overview 
Explosion energy 
Explosion 

Toxic release 
Overview 

Infiltration 
Dosage: outdoor 
dosage 

indoor dosage 
Injury and damage 
relations 
Injury outdoors 
Fire 

Explosion 
Toxic gas 
Injury indoors 
Fire 

Explosion 
Toxic gas 
Damage 

Structure ignition 
Fire 

Explosion 
Confined explosion 
Gas toxicity 
Overview 

Acrolein 

Acrylonitrile 

Ammonia 

Carbon monoxide 
Carbon tetrachloride 

Chlorine 

Hydrogen chloride 

Hydrogen cyanide 
Hydrogen fluoride 

Hydrogen sulfide 
Methane, propane 
Methyl bromide 

Phosgene 

Propylene oxide 
Sulfur dioxide 
Toluene 

Hazard assessment 
Overview 
Double counting 
Case histories 


ELB, xi 
ELB, 221 

ELB, xiii, xviii, 49, 
90, 229; RTR, 18 


ELB, xi, xii, 
xviii, 49 
REL, 137 
TP, 5 

TP, 6 


ELB, xi;TP, 12 
ELB, xi 
TP, 6 
REL, 137 
REL, 202 
REL, 163 
REL, 137 
ELB, 252 
ELB, 251 
ELB, xi 
ELB, xi, 247; 

RTR, 23 
ELB, 226 


ELB, xvii, 83; 

REL, 73 
REL, 76,88; PA, 
C-2, C-3 
PA, C-2, C-3 
ELB, 257; PA, 

C-2, C-4 
REL, 114 
REL, 81,88; PA, 
C-2, C-5 

ELB, xviii, 83,257; 

PA, C-2, C-5 
REL, 83,88; PA, 
C-2, C-6 
PA, C-2, C-6 
RTR, 33; PA, C-2, 
C-7 

PA, C-2, C-7 
REL, 78 

REL, 84,89; PA, 

REL 2 86,89; PA, 
C-2, C-9 
PA, C-2, C-9 
PA, C-2, C-10 
PA, C-2, C-ll 


ELB, 325 
ELB, 137,269 









Table 9.18 Vulnerability model(VM) some probit equations in the original model (Eisenberg, Lynch and Breeding, 1975) 


Phenomenon and, type 
of injury or damage 

Causative 

variable 

Probit equation 
parameters 

Per cent 
affected 


Data from which the probit equation 
was derived 


ki 

k 2 

Value of 
variable 

Per cent 
affected 

Value of 
variable 

Per cent 
affected 

Value of 
variable 

Fire: 










Burn deaths from flash fire 

t e lt /3 / 10 4 

-14.9 

2.56 

1 

1099 

50 

2417 

99 

7008 





1 

1073 

50 

2264 

99 

6546 





1 

1000 

50 

2210 

99 

6149 

Burn deaths from pool burning 

tf l3 l 10 4 

-14.9 

2.56 

1 

1099 

50 

2417 

99 

7008 






1073 

50 

2264 

99 

6546 





1 

1000 

50 

2210 

99 

6149 

Explosion: 










Deaths from lung haemorrhage 

P° 

-77.1 

6.91 


1.00 x 10 5 

50 

1.41 x 10 5 

99 

2.00 x 10 s 





10 

1.20 x 10 5 

90 

1.76 x 10 5 



Eardrum ruptures 

P° 

-15.6 

1.93 

1 

16.5 x 10 3 

50 

43.5 x 10 3 







10 

19.3 x 10 3 

90 

84.3 x 10 3 



Deaths from impact 

J 

-46.1 

4.82 

0 

18.0 x 10 3 

31 

37.3 x 10 3 

96 

49.7 x 10 3 





8 

28.6 x 10 3 

63 

45.2 x 10 3 

100 

60.7 x 10 3 

Injuries from impact 

J 

-39.1 

4.45 

1 

13 x 10 3 

90 

28 x 10 3 







50 

20 x 10 3 





Injuries from flying fragments 

J 

-27.1 

4.26 

1 

1024 

50 

1877 

99 

3071 

Structural damage 

P° 

-23.8 

2.92 


6.2 x 10 3 

99 

34.5 x 10 3 







50 

20.7 x 10 3 





Glass breakage 

P° 

-18.1 

2.79 

1 

1700 

90 

6200 



Toxic release: 










Chlorine deaths 

sc 2 - 75 r 

-17.1 

1.69 

3 

14.1 x 10 4 

50 

34.05 x 10 4 

97 

105.8 x 10 4 





3 

17.0 x 10 4 

50 

47.0 x 10 4 

97 

129.4 x 10 4 





3 

21.5 x 10 4 

50 

64.7 x 10 4 



Chlorine injuries 

c 

-2.40 

2.90 

1 

6 

50 

13 







25 

10 

90 

20 



Ammonia deaths 

ec 2 - 75 t 

-30.57 

1.385 

3 

37.3 

50 

74.6 

99 

411.8 





3 

90.9 

50 

204.6 

99 

334.4 





3 

44.6 

50 

148.6 




4 = effective time duration (s) 

/ e = effective radiation intensity (W/m 2 ) 
t = time duration of pool burning (s) 

/ = radiation intensity from pool burning (W/m 2 ) 


p° = peak overpressure (N/m 2 ) 
/= impulse (Ns/m 2 ) 

C = concentration (ppm) 

T = time interval (min) 
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Table 9.19 CPD models: principal contents of Yellow 
Book and Green Book (Committee for the Prevention of 
Disasters, 1992a,b) 


A Physical effects (Yellow Book) 
Outflow 

Turbulent free jet 
Spray release 
Evaporation 
Heat radiation 
Dispersion 

Vapour cloud explosion 
Consequences of rupture of vessels 

B Damage effects (Green Book) 


Table 9.21 WHAZAN: principal models (Technica, 1985) 


Emission 

Liquid 

Gas 

Two-phase 

Behaviour on release 
Spreading liquid 
Jet 

Flashing liquid 

Dispersion 
Heavy gas 
Neutral density gas 
Buoyant plume 


Fauske—Cude model 


Cox and Carpenter model 
Pasquill-Gifford model 
Briggs model 


Damage caused by heat radiation 
Consequences of explosion effects on structures 
Consequences of explosion effects on humans 
Survey study of the products which can be released 
during a fire 

Damage caused by acute intoxication 

Protection against toxic substances by remaining indoors 

Population data 


Fire 

Pool fire 
Jet fire 
Fireball 
Flash fire 
Fire damage 

Explosion 
Explosion damage 


ModifiedAPI model 
API model 

Gas dispersion model 


DSM model 


Toxic release 


Gas dispersion model + probit 
equations 


Table 9.20 Plant layout models: principal models (after 
Mecklenburgh, 1985) 


1. Introduction 

2. Instantaneous release of gas or vapour 

2.1 Size of cloud 

2.2 Dispersion of cloud to lower flammability limit 

2.3 Explosion overpressure 

2.4 Fireball size 

2.5 Dispersion of toxic cloud 

3. Steady leak of gas or vapour 

3.1 Leakage rates 

3.2 Dispersion of jet to lower flammability limit 

3.3 Size of jet flame 

3.4 Dispersion of toxic plume 

4. Loss of liquid 

4.1 Leakage rate, pool size and evaporation rate 

4.2 Pool and tank fires 

5. Fire damage and protection 

6. Implications for plant layout 

6.1 Risk criteria 

6.2 On-site and off-site effects 

7. Blast effects 

7.1 Human and building tolerances 

7.2 Plant components 

7.3 Control rooms 

8. Hazardous area classification 

8.1 Small continuous release of gas or vapour in the 
open 

8.2 Small release of liquid in the open 

8.3 Small continuous release of gas or vapour in a 
building 

8.4 Small release of liquid in a building 


9.16.2 Population composition 

In order to obtain a more detailed picture of the population 
it is necessary to define the population composition. This is 
relevant to the probability that an individual is at his home 
base, that he is a member of a more vulnerable population 
and/or that he is outdoors. 

Information on population categories is available in 
the 1981 Labour Force Survey (OPCS, 1981c) as shown in 
Table 9.23. From these data Petts, Withers and Lees 
have derived the population composition model given in 
Table 9.24. 

In order to use this population composition model it is 
necessary to define the times of day. The set of times of day 
used by the authors is shown in Table 9.25, Section A.These 
are to be used with the population categories at home by 
time of day given in Table 9.25, Section B. 

9.16.3 Population change by time of day 

Using the definitions of population composition and of 
times of day just given, estimates may be made of the 
population changes by time of day. The estimates based on 
the data given in Table 9.25, Sections A and B, are given in 
Section C of the table. It was found that for random sections 
of the Canvey and Rijnmond populations, the proportions 
of the nighttime population who were at home during the 
day were 42% and 46%, respectively. 

9.16.4 Vulnerable population 

Some members of the population are likely to be more 
vulnerable to the hazard than others and it may be neces¬ 
sary to take this into account. In general, it is children, old 
people and infirm people who tend to be most vulnerable, 
and the proportion of vulnerable people may be estimated 
as a first approximation by determining the proportion 
in these categories. However, vulnerability must be a 
function of the particular hazard. For example, children 













1. Release rate 


(2a) A, C, R. Release 
duration — emergency 
shut-off successful 

(2b) B, D, P. Release 
duration - emergency 
shut-off unsuccessful 


(3a) G, J, K, M. Pool fire (4) W, X, Y, Z. Input 
size, thermal radiation to event tree for 
- given ignition flammable vapour 

cloud 

(3b) L, N. Pool 
evaporation - 
given no ignition 


Figure 9.23 WHAZAN: event trees for the models (after Technica, 1985): (a) tree for flammable gas 
for toxic gas release 


for flammable 


(ic liquid release; (c) 
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Table 9.22 Methodology for estimation of density of population around a hazard source (after Petts, Lees and Withers, 


1987) (Courtesy of Elsevier Science Publishers) 

Distance from hazard source (m) 

Method 

Population density (persons/km 2 ) 

<400 

Use of Census data 

From enumeration district data 

400-1000 

Use of Ordnance 

Survey maps 

Dense terrace housing: 15,000 
Semi-detached housing: 10,000 
Sparse detached housing: 1000 
Uninhabited areas: 0 

>1000 

Use of Ordnance 

Survey maps 

Built-up areas: 4000 

Other inhabited areas: 100 
Uninhabited areas: 0 


Table 9.23 Population categories and composition based 1981 Labour Force Survey (after Petts, Lees and Withers, 
1987) (Courtesy of Elsevier Science Publishers) 



Number (thousands) 

No. per household 

Adults in full-time employment 

16,595 

0.85 

Adults in part-time employment 

4,042 

0.21 

Self-employed 

2,164 

0.11 

Unemployed 

2,447 

0.13 

Housewives 

7,092 

0.36 

Children: 0—4 years 

3,222 

0.17 

Children: school age 

8,753 

0.45 

Students 

1,415 

0.07 

Retired 

6,266 

0.32 

Others (including permanently sick and disabled) 

1,100 

0.06 

Total 

53,096 

2.73 

Total no. of households 

9,442 



may actually recover better from some burns than adults, 
and persons with respiratory disease are likely to be more 
susceptible to irritant toxic gas, but not necessarily to 
thermal radiation. 

As a first approximation, therefore, the population may 
be divided into two broad groups: (1) adults of working age 
and older children and (2) young children and old people. 
The first group is some 75% and the second some 25% of 
the population. In general, the latter is the more vulnerable 
group, although for some hazards it may be necessary to 
have a more specific definition. In this case, the proportion 
of vulnerable people may be assessed in relation to the 
particular hazard considered using the population compo¬ 
sition model given in Table 9.24. 

Mention may be made here of estimates of the proportion 
of vulnerable people given by other workers. Table 9.26 
shows some estimates made by Hewitt (1976) for the pro¬ 
portion of people vulnerable to a toxic irritant gas such as 
chlorine. 

9.16.5 Population outdoors 

Very little information was found by Petts, Withers and Lees 
on the proportion of the population which is outdoors at dif¬ 
ferent times of the day. In the Rijnmond Report, 
the proportion of people indoors was taken in the 
context of toxic gas hazard as 99%, allowing for the factthat 
some people would seek shelter from this hazard indoors. 


The population location model derived by the authors is 
shown in Table 9.27. It was assumed that the regular and 
vulnerable groups spend 1 and 1/2 h/day outdoors, respec¬ 
tively, that the proportion of the total population outdoors 
at night (18.30-08.00 h) is 1%, and that those outdoors are 
drawn exclusively from the regular population. Then the 
time outdoors and the proportions outdoors by day, by 
night and overall may be calculated for the regular, vul¬ 
nerable and total populations. A partial cross-check on the 
model or, more specifically, a crosscheck on the lower bound 
of the proportion of the population outdoors, was obtained 
from wartime data on V-2 rocket bomb casualties. 


9.17 Modification of Exposure 

The characteristics of the population at risk may need to be 
modified to take account of changes in the exposure of the 
population that occur if there is warning of the hazard. 
There are a number of ways in which an individual who 
becomes aware of a hazard may modify his exposure. He 
may seek shelter indoors or he may try to distance himself 
from the hazard, either by individual escape or by partici¬ 
pating in an organized evacuation. 

While these are the principal actions, they are by no means 
the only ones. There are others that are more specific to the 
hazard concerned. For example, an individual may seek 
shelter from the thermal radiation of a fireball behind some 
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Table 9.24 Population composition model (after Petts, Lees and Withers, 1987) (Courtesy of Elsevier Science 
Publishers) 

A Unemployment 5% 


No. per household 

Proportion (%) 

1. Adults in full time employment: 

(a) at work (including self-employed) 

0.89 

32.9 

(b) sick, on holiday, working from home 

0.10 

3.7 

2. Adults in part time employment: 

(a) at work 

0.21 

7.7 

(b) sick, on holiday 

0.02 

0.7 

3. Unemployed 

0.07 

2.6 

4. Homekeepers 

0.35 

12.9 

5. Children of school age: 

(a) at school 

0.31 

11.4 

(b) sick, on holiday 

0.14 

5.2 

6. Students: 

(a) at college 

0.04 

1.5 

(b) sick at home, on vacation 

0.03 

1.1 

7. Children under school age 

0.17 

6.3 

8. Retired 

0.32 

11.8 

9. Others (including permanently sick and disabled) 

0.06 

2.2 

Total 

2.71 

100.0 

B Unemployment 10% 


No. per household 

Proportion (%) 

1. Adults in full time employment: 

(a) at work (including self-employed) 

0.84 

31.0 

(b) sick, on holiday, working from home 

0.10 

3.7 

2. Adults in part time employment: 

(a) at work 

0.19 

7.0 

(b) sick, on holiday 

0.02 

0.7 

3. Unemployed 

0.14 

5.2 

4. Homekeepers 

0.35 

12.9 

5. Children of school age: 

(a) at school 

0.31 

11.4 

(b) sick, on holiday 

0.14 

5.2 

6. Students: 

(a) at college 

0.04 

1.5 

(b) sick at home, on vacation 

0.03 

1.1 

7. Children under school age 

0.17 

6.3 

8. Retired 

0.32 

11.8 

9. Others (including permanently sick and disabled) 

0.06 

2.2 

Total 

2.71 

100.0 


structure. Or he may try to reduce his vulnerability to 
the blast from an explosion by adopting a different body 
posture. 

Some aspects of modification of exposure by escape and 
evacuation are considered here. Other aspects such as 
modification by shelter are treated in the chapters on par¬ 
ticular hazards. Organized evacuation as part of emer¬ 
gency planning is discussed in Chapter 24. 

9.17.1 Reaction 

The most basic feature bearing on modification of exposure 
is the response time of humans. 

Estimates of human response time in emergencies 
have been made by the British Compressed Gases 


Association (BCGA, 1984) in relation to response to 
ignition of clothing in an oxygen-enhanced atmosphere. 
Work on human factors (e.g. Denison and Tonkins, 1967) is 
quoted, to the effect that the time taken by humans to 
respond to an unexpected situation varies between 5 and 
20s. The BCGA obtain from this the following response 
model: 

(1) 5 % of the population (i.e. babies and disabled 
persons) are incapable of any reaction 

(2) 95% of the population are capable of reaction, of 
whom it is assumed: 80% can react within 15 s, 25% 
can react within 10 s, 10% can react within 7.5 s. 

It is taken that none of the population can react within 5 s. 
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Table 9.25 Population composition at home by time of 
day (after Petts, Lees and Withers, 1987) (Courtesy of 
Elsevier Science Publishers) 


A Time - of- day categories 


Time of day Duration 


(h) (%) 


School day 08.00-16.00 8 33 

Workday 08.00-18.30 10.5 44 

Night 18.30-08.00 13.5 56 


B Population categories at home 


Categories 


School day 1(b), 2(b), 3,4(b), 5(b), 6(b), 7-9 

Work day All except 1(a) 

Night All 


C Proportion of population at home 


Proportion at home (%) 



Unemployment 5 % 

Unemployment 10% 

School day 

46.5 

49.1 

Work day 

67.2 

69.0 

Night 

100.0 

100.0 


9.17.2 Escape 

A systematic treatment of individual escape is difficult. 
The principal case where this has been attempted is for 
escape from toxic gas by walking out of the cloud. The 
treatment of this problem given in the First Canvey Report 
is described in Appendix 7. 

9.17.3 Evacuation 

Organized evacuation is more readily analysed. A simple 
model for evacuation is: 

<£(/) = ! t<ti [9.17.1a] 

= </>(oo)+fl - <£(oo)]exp[—A(t - f d )] t > t A [9.17.1b] 

where t A is the time lag before any evacuation starts, X is a 
constant, 4>(t) is the fraction of population which has not 
evacuated at time t, and </>(oo) is the fraction of population 
which does not evacuate at all. The constant X is related to 
the evacuation half-life h/2 as: 

X = 0.693/f V2 [9.17 J] 

This model has been used by Solomon, Rubin and Okrent 
(1976) to allow for the effect of evacuation in hazard 
assessments of large toxic releases. Most other workers 
appear to have used a similar model. 

A study of evacuation effectiveness in actual emergencies 
has been made by Hans and Sell (1974), who give details 
of evacuation from transportation, hurricane and flood 
emergencies. The transportation emergencies include the 
incidents shown in Table 9.28. The overall conclusion of 
these investigators is that behaviour in such emergencies is 
less irrational and more effective than is often supposed. 


Table 9.26 Vulnerable members of population (after 
Hewitt, 1976) 


No. per1000people 


Children: 

<6 months 8 

<12 months 8 

12 months-5 years 75 

5-9 years 82 

Old people (>70 years) 85 

People with chronic heart trouble 5 

People with respiratory diseases 9 

People with restricted mobility 4 

Blind people 2 

Healthy youngsters and adults 722 


The data presented in this work were analysed in the 
Rasmussen Report (AEC, 1975). The evacuation speed and 
time for each type of incident were found to be correlated by 
the equations: 

tm kd n [9.17.31 

t^d/v [9.17.4] 


where d is the evacuation distance (mile), t is the evacuation 
time (h), v is the evacuation speed (mile/h), k is a constant 
and n is an index. 

The type of incident that is most relevant in the present 
context appears to be the transportation emergency. For 
such incidents 

|.h 0.3d 1 ' 02 [9.17-f 


The evacuation speeds were found to fit a log-normal 
distribution with the density function 


[9.17.6] 


where m* and a are parameters in the log-normal dis¬ 
tribution. 

For transportation incidents m* = 0.20 and cr = 1.64 and 
hence the modal and mean values of v are 0.08 and 4.7 mile/h, 
respectively. 

There have been a number of more recent major evacua¬ 
tions. One of the largest was at Mississauga,Toronto, where 
a leaking chlorine rail tank car led to the evacuation of some 
223,000 people (Case History A97). Another large evacua¬ 
tion took place at Bhopal, but in this case there was no 
chance of averting a major disaster. Bhopal is described in 
Appendix 5. At Chernobyl, after a delay in deciding to 
evacuate, some 40,000 people were evacuated in about 2 h. 
Chernobyl is described in Appendix 22. 

The value of evacuation in modifying exposure was 
investigated in the First Canvey Report, as described in 
Appendix 7. Opportunity to evacuate depends on the 
hazard and on the way in which the incident develops. 
Although some hazards, such as a single, unexpected 
explosion may give little warning, in other cases there may 
be a substantial degree of warning. One example is an 
initial explosion in a works followed by a fire that may lead 
to further explosions and fires. Another is derailment of a 
rail tank car with the possibility of fireballs and toxic 
release. In both such cases evacuation may be beneficial. 
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Table 9.27 Population outdoor exposure model (after Petts, Lees and Withers, 1987) (Courtesy of Elsevier Science 
Publishers) 


Population 

Time outdoors (h/week) 



Proportion outdoors ( 

%) 

Day 

Night 

Overall 

Day 

Night 

Overall 

Regular 0.81 

0.19 

1.0 

7.70 

1.33 

4.17 

Vulnerable 0.5 

0 

0.5 

4.8 

0 

2.08 

Total 0.74 

0.14 

0.88 

7.05 

1.0 

3.67 

Table 9.28 Evacuation in some major transport emergencies (after Hans and Sell, 1974) 


Date Location 

Incident 

Number 

evacuated 

evacuated 

Evacuation 

distance 

Evacuation 

period 

(h) 

1965 Baton Rouge, LA 

Chlorine barge, 
no chlorine escape 

150,000 

8 

30 

2 

1969 Glendora, MI a 

Vinyl chloride escape 
from rail tankers 

35,000 

1200 

20 

4 

1972 Louisville, KY 

Chlorine barge, 
no chlorine escape 

4,000 

0.35 

1 

3 

1973 Morgan City, LA 

Chlorine barge, 
no chlorine escape 

3,000 

1.8 

2 

4 

a The Glendora incident is described i 

in Case History A43. 






9.17.4 Incident control 

Avoidance of casualties also has another aspect. Besides 
getting people who are exposed out of the danger zone, it is 
often necessary also to keep others from entering the dan¬ 
ger zone. In particular, an incident may tend to attract 
spectators who thereby put themselves at risk. In 1947, 
ammonium nitrate explosions aboard the Grandcamp and 
the High Flyer in the harbour in Texas City killed 552 
people (Case History A16). The explosion on the Grandcamp 
killed everyone in the dock, many of whom were spectators. 
Spectators also constituted a large proportion of the death 
toll of more than 150 at Caracas in 1982, when burning oil 
from a storage tank on fire at the top of a hill flowed down 
into a crowd below (Case History A102). 

9.18 Injury Relations 

The estimation of the injury or damage caused by a physi¬ 
cal effect such as heat radiation intensity, overpressure or 
toxic concentration requires the use of injury or damage 
relations. 

The normal method of formulating such relations is in 
three stages. The first is the determination of the causative 
(or injury or damage) factor which best correlates the data. 
The second is the determination of the probability distribu¬ 
tion for this factor. The third is the conversion of this dis¬ 
tribution into the more convenient form of a probit equation. 

These steps are now described. In the account given 
reference is primarily to injury rather than damage rela¬ 
tions, but the principles are the same for the latter. Injury 
and damage relations may be expressed in forms other than 
probit equations and these also are briefly mentioned. 

9.18.1 Injury factors 

The starting point for the derivation of an injury relation is 
a set of data giving the probability of a specified degree of 



Figure 9.24 Determination of the form of the injury factor 


injury as a function of some physical effect. Some typical 
physical effects are: 

Fire Thermal radiation intensity I 


Explosion Overpressure p° 

Impulse / 

Toxic gas Concentration C 

Dosage Ct 

where t is time. 


The probability of injury may or may not correlate 
directly with the physical effect. In some cases the corre¬ 
lation is with some power or time function of the effect. For 
example, probability of eardrum rupture does correlate 
with explosion overpressure p°, but probability of burn 
death correlates with the radiation intensity time function 
m. The first step, therefore, is to determine the appro¬ 
priate injury factor. It may be helpful to plot a graph of the 
form shown in Figure 9.24. 
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9.18.2 Injury distributions 

Next it is necessary to determine the probability distribu¬ 
tion of the injury factor. The distribution usually con¬ 
sidered first is the log-normal distribution. The fit of 
the data to this distribution may be tested by plotting 
on log-probability paper. A plot of this type is shown in 
Figure 9.25. 

The reason that data on probability of injury tend to give 
a log-normal distribution is that this distribution fits the 
case where the population contains a proportion of indi¬ 
viduals who are unusually resistant. For example, the dis¬ 
tribution is widely used to correlate the toxicity of an 
insecticide, where the dosage required to kill off the last 
few individuals is relatively high. 

9.18.3 Probit equations 

The injury distribution just described gives the informa¬ 
tion required on the probability of injury as a function of the 
injury factor. It is possible, however, to carry out a trans¬ 
formation that casts it in the more convenient form of a 
probit equation. An account of the probit method is given 
in Probit Analysis (Finney, 1971). One of the first major 
applications of the method to hazard assessment in the 
process industries was in the VM of Eisenberg, Lynch and 
Breeding (1975). The probit Y is an alternative way of 
expressing the probability Pof injury. It is defined by the 
relation: 


1 r Y -% 

P = —^ / exp(— m 2 /2) d u [9.18.1] 

(2tt) J-oc 

The probit is a random variable with a mean 5 and variance 1. 
The probability range (0-1) is generally replaced in 
probit work by a percentage (range 0-100). The relation¬ 
ship between percentages and probits is shown in Table 
9.29 and in Figure 9.26. 

It is shown below that for an injury factor x which fits the 
log-normal distribution the probit equation has the form: 

Y = h + k 2 In* [9.18.2] 

A typical probit transformation is illustrated in Figure 9.27. 
The sigmoidal curve of the log-normal distribution is 
transformed into the straight line of the probit. This makes 
it easier both to correlate the data in the first place and then 
to use the correlation. 



The derivation of an equation of the general type given in 
Equation 9.18.2 is conveniently shown by considering first 
a normal distribution. The density function/is 


(* - » 0 2 1 
" IP j 


[9.18.3] 


The distribution function Pis 

F = J* f{x) dx [9.18.4] 

But the distribution function F is the same as the prob¬ 
ability P of injury, so that entering Equation 9.18.3 in 
Equation 9.18.4 gives: 



Then equating Equation 9.18.5 with Equation 9.18.1 gives 
u={x-m)o [9.18.6] 

and 

Y- $mm [9.18JJ: 

Hence 


Y = (5 - m/a) + (1 /a)x [9.18.8] 

mk[ + k! 2 x [9.18.9] 


Similarly, for the log-normal distribution: 

Y = k! + k 2 lnx [9.18.10] 

h = 5 -m*/a [9.18.11a] 

k 2 = 1/a [9.18.11b] 

Equation 9.18.10 is the usual form of the probit equation. 

The derivation of a probit equation from a set of data 
giving the probability of a specified injury as a function of 
the injury factor may be illustrated using the following 
data for eardrum rupture due to overpressure given by 
Eisenberg, Lynch and Breeding: 


Percentage 

affected 

Probit 

Peak overpressure 
(N/m z ) 

1 

2.67 

16.5 x 10 3 

10 

3.72 

19.3 x 10 3 

50 

5.00 

43.5 x 10 3 

90 

6.28 

84.3 x 10 3 


The corresponding probit equation given by these 
authors is 


Y — —15.6 + 1.93 In p° 


[9.18.12] 
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Table 9.29 Transformation of percentages to probits (Finney 1971) (Courtesy of Cambridge University Press) 

% 

0 

1 

2 

3 

4 

5 

6 

7 

8 

9 

0 

_ 

2.67 

2.95 

3.12 

3.25 

3.36 

3.45 

3.52 

3.59 

3.66 

10 

3.72 

3.77 

3.82 

3.87 

3.92 

3.96 

4.01 

4.05 

4.08 

4.12 

20 

4.16 

4.19 

4.23 

4.26 

4.29 

4.33 

4.36 

4.39 

4.42 

4.45 

30 

4.48 

4.50 

4.53 

4.56 

4.59 

4.61 

4.64 

4.67 

4.69 

4.72 

40 

4.75 

4.77 

4.80 

4.82 

4.85 

4.87 

4.90 

4.92 

4.95 

4.97 

50 

5.00 

5.03 

5.05 

5.08 

5.10 

5.13 

5.15 

5.18 

5.20 

5.23 

60 

5.25 

5.28 

5.31 

5.33 

5.36 

5.39 

5.41 

5.44 

5.47 

5.50 

70 

5.52 

5.55 

5.58 

5.61 

5.64 

5.67 

5.71 

5.74 

5.77 

5.81 

80 

5.84 

5.88 

5.92 

5.95 

5.99 

6.04 

6.08 

6.13 

6.18 

6.23 

90 

6.28 

6.34 

6.41 

6.48 

6.55 

6.64 

6.75 

6.88 

7.05 

7.33 


0.0 

0.1 

0.2 

0.3 

0.4 

0.5 

0.6 

0.7 

0.8 

0.9 

99 

7.33 

7.37 

7.41 

7.46 

7.51 

7.58 

7.65 

7.75 

7.88 

8.09 



Figure 9.26 Relationship between percentages and 
probits (Finney, 1971) (Courtesy of Cambridge 
University Press) 



Figure 9.27 Effect of the probit transformation (Finney, 
1971). The figure illustrates a typical experiment on the 
toxicity of an insecticide. The logarithm of the lethal dose 
fits a normal distribution. The figure shows the distribution 
function and the corresponding probit function (Courtesy of 
Cambridge University Press) 


Probit equations for some major hazards given by 
Eisenberg, Lynch and Breeding are shown inTable 9.18. The 
derivation of these equations is discussed in more detail in 
Chapters 16-18. 

It is emphasized that the probit equations given in 
Table 9.18 were early examples and were avowedly tentative 
and approximate, as will be clear from their derivations. 
They were developed essentially for use in the VM. Some 
have been superseded by improved equations. They are 
given here primarily as an illustration of the general form 
of injury factors and probit equations. 

Probit equations were used in the Convey Reports and 
the Rijnmond Report and have been widely used in many 
hazard assessments since then. 

With respect to probit equations, there are several points 
that need to be borne in mind. First, any injury or damage 
correlation is only as good as the original data. Second, a 
check should be made that the data do actually fit the dis¬ 
tribution implied, generally the log-normal distribution. 
Third, it is desirable to allow for the fact that data for 
probabilities in the middle of the probability range are 


likely to be more accurate than those for probabilities at the 
extremes of the range. 

9.18.4 Probit equations: data weighting 
Taking up this latter point, it is the case that given data for 
probabilities P near the centre of the range (say P= 0.5) and 
at an extreme of the range (say P= 0.01 or 0.99) obtained 
from samples of the same size, the level of confidence will 
be higher in the former. Or, to put the matter another way, 
for the same level of confidence it is necessary to have a 
larger sample size at an extreme of the range than near the 
centre. 

This problem arises particularly in laboratory work on 
the toxicity of, say, pesticides. It has been addressed by 
Fisher and Yates (1957), who give a set of weighting coeffi¬ 
cients for use in probit analysis. Table 9.30, Section A, gives a 
set of weighting coefficients interpolated from their values. 

Atechnique described by Gilbert, Lees and Stilly (1994a) 
which is convenient in dealing with a set of data points and 
which gives an essentially similar weighting is to multiply 
each point by the weighting factor shown in Section B of 
Table 9.30. The point is discussed further in Chapter 18. 
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Table 9.30 Weighting factors for construction of probit 
equations 


A Weighting coefficient (after R.A. Fisher and 
Yates, 1957) 


Probability (%) a 

Probit 


Weighting 

coefficient 

1 

2.7 


0.072 

5 

3.4 


0.224 

10 

3.7 


0.342 

20 

4.2 


0.490 

30 

4.5 


0.575 

40 

4.7 


0.621 

50 

5.0 


0.637 

B Number of entries (after Gilbert, Lees and 

Scilly, 1994a) 




Probability range (%) 


No. of times in which 



point is 

; entered 

40-60 


6 


30-40; 60-70 


5 


20-30; 70-80 


4 


10-20; 80-90 


3 


5-10; 90-95 


2 


<5; >95 


0 


a The weighting coefficient for; 
be obtained from that for 100 -. 

a percentage 

x greater 

than 50% may 


9.18.5 Other relations 

Not all correlations of injury and damage are in terms 
of probability distributions and probit equations. In 
particular, certain effects of explosions are often correlated 
in other ways. Among these effects are damage to plant and 
buildings, injury due to building collapse and damage and 
injury due to missiles. The treatment of explosion effects is 
described in Chapter 17. 

9.18.6 Multiple injury and double counting 

It is appropriate at this point to draw attention to some of 
the problems associated with multiple injury and double 
counting of injuries. 

A treatment of double counting is given in the Green 
Book, (CPD, 1992b), which identifies three basic types 
of double counting. In double counting of the first type, 
a single injury mechanism due to a single event creates 
victims with several, successively more severe, degrees of 
injury. Aproblem arises where the number of victims with a 
lower degree of injury is also included in the number with 
the higher degree(s) of injury. The correct procedure is to 
subtract the number of victims with the higher degree(s) of 
injury from the number with the lower degree of injury. 

In double counting of the second type, several injury 
mechanisms due to a single event create victims with the 
same degree of injury. The problem here is that a proportion 
of victims are injured by more than one of these mecha¬ 
nisms and that, mathematically, it is incorrect to obtain the 
probabilities of injury by simply summing the probabilities 
for each mechanism. The correct procedure mathematically 
is to utilize the expressions for the probability of a joint 
event, as given by Equations 7.5.5—7.5.8. 

In double counting of the third type, several events, 
occurring in succession, each theoretically injure to a given 


degree the same person, whereas in reality the first event 
produces such injury that any subsequent event has no 
additional injurious effect. In this case, the correct pro¬ 
cedure mathematically is to subtract the number of persons 
suffering this degree of injury after the first event from the 
population at risk for subsequent events. 

This approach to the avoidance of double counting is 
essentially a mathematical one. It is valid for double 
counting of the first type and also for double counting of 
the second and third types where the degree of injury con¬ 
cerned is fatal injury. However, for degrees of injury that are 
less than fatal it fails for the second and third types to make 
sufficient allowance for physiological as opposed to math¬ 
ematical factors. 

As far as physiological factors are concerned, it is diffi¬ 
cult to generalize. Each case needs to be considered on its 
merits. It might be thought that from a physiological rather 
than a mathematical viewpoint the overall probability of a 
given degree of injury from more than one event capable of 
causing that degree of injury might be greater, rather than 
less, than the sum of the individual probabilities, and also 
that there might be escalation to a more severe degree of 
injury, but this may not always be so. 

Thus, on the one hand there is some evidence from 
battle casualties that the physiological effect of fragment 
wounds is not necessarily proportional to the number of 
fragments involved. On the other hand, the severity of burn 
wounds increases with the proportion of the body surface 
that is affected. A further discussion of combined injuries 
is given by R.K. Jones (1971). 

9.18.7 Overview 

It is peculiarly difficult to obtain injury relations for 
humans, since the normal method of establishing a corre¬ 
lation, that is direct experimentation, is ruled out. The 
approaches taken have often been opportunistic, seeking 
data wherever it may be found. For example, the correlation 
for burn injury that has long held the field is based on data 
on injuries caused by the atomic bombs at Hiroshima and 
Nagasaki. Not surprisingly, the derivation and use of injury 
relations has been subject to some criticism. Critiques 
include those of VC. Marshall (1989b),Turner and Fairhurst 
(1989 HSE SIR 21) and R.F. Griffiths (1991b). 

A general criticism is the relatively high uncertainty in 
injury relations. This is inherent in the problem and there is 
not very much that can be done about it. The degree of 
uncertainty may be quantified if it is possible to determine 
confidence bounds, but often it is not obvious how this is to 
be done. It may well be possible to give bounds for, say, the 
concentrations of a toxic gas which are lethal to a particular 
animal species, but these data have then to be extrapolated 
to humans, an operation which involves a good deal of 
judgement. 

Another criticism concerns extrapolation from the 
region of 50% probability to those of 5% and or even 1%. 
Here there are two distinct problems. One is the confidence 
that can be placed in the slope of the probit relation on 
which such extrapolation is based. The other is the pos¬ 
sibility that at low values of the physical effect the injury 
mechanisms that come into play may be qualitatively dif¬ 
ferent. Since the level of physical effect which applies to the 
5% or 1% probabilities is relatively low and thus applies to 
the far field, the area affected is large and differences in the 
value of the effect for these probability levels can have a 
significant impact on the estimate of the number injured. 
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Although in principle a similar problem of extrapolation 
exists for the region of 95% or 99% probability, in practice 
this is of less importance, because these probability values 
apply in the near field where the area affected is relatively 
small and because in consequence the difference in num¬ 
bers of injured between estimated values of, say, 90% and 
95% is not great. 

9.19 Presentation of Results 

There are a number of different outputs that may be 
obtained from a hazard assessment. These outputs may be, 
and often are, in the form of risk estimates, but other out¬ 
puts may also be used. The results are sometimes presented 
in terms of the distance at which the hazard will cause 
a defined effect. Such a hazard range may be based on 
a worst-case scenario or on some less serious scenario. In 
the latter case there is an implied cut-off for the frequency 
of the event. 

Alternatively, the results are presented in terms of risk. 
One form of risk is the frequency of a defined effect. In this 
case, no explicit computation is made of harm to people. If 
the risk to people is determined, the exercise becomes a full 
risk assessment. The risk may be expressed in terms of 
fatalities only, or of fatalities and injuries. 

The risk of damage to property may also be determined, 
although such assessment appears to be less common as 
an end in itself than as a means of estimating the risk to 
people. 

9.19.1 Types of risk to people 

As just described, the results presented from a risk 
assessment may be confined to risk of death or may 
embrace risk of injury. Relying on the concept of a more or 
less fixed ratio of injuries to fatalities, the engineer may 
well consider that a risk profile of the plant formulated in 
terms of fatalities is usually sufficient as an aid to decision¬ 
making. As described below, however, risk of injury is also 
taken into account. In particular, the HSE are interested 
in the risk of receiving a ‘dangerous dose’. This dose trans¬ 
lates into different risks of death for vulnerable and non- 
vulnerable people. 

9.19.2 Forms of presentation 

There are a number of ways in which the results of a risk 
assessment may be presented. Some of the forms of pre¬ 
sentation are shown in Table 9.31. For a fixed installation 
the risk will relate to some event that might occur on the 
site in question. The risk is generally measured from a 
particular point within the site. In some cases, the risk may 
he presented simply as the frequency of a defined event, 
usually a major accident, at the installation. 

For individual risk to the workforce, the usual form is 
either an annual risk or the FAR. There is a straight con¬ 
version between the two. It is not usual to derive for the 
workforce any form of collective risk equivalent to the 
societal risk for the public described below. 

The forms of presentation for risk to the public are more 
varied. For land-use planning, contours and transects (plan 
and elevation, respectively) may be given. These contours 
and transects may represent the frequency of a given 
intensity of a physical effect, or alternatively the frequency 
of individual fatality, or individual risk. Such contours and 
transects may relate to a single hazard or to the combined 
results of several hazards. 


Table 9.31 Forms of presentation of results of a risk 
assessment 


A Risk of workforce 


Annual risk 

Fatal accident rate (FAR) 

B Risk to public 

Physical effects 

Contours on site map 
Transects on site map 
Individual risk 

Contours on site map 
Transects on site map 
Annual risk at fixed location 
Societal risk 
FN table 
FN curve 

Equivalent annual fatalities 

Note: Risk may be risk of fatality or injury, or other risk such as that of 
HSE dangerous dose. 

Individual risk to members of the public may be pre¬ 
sented as a function of distance from the site, but is more 
usually given as the average risk to groups at different 
locations around the site. 

The main form in which societal risk is presented is as 
a relation between incidents that cause some number N 
or more fatalities and the frequency F of such incidents. 
These data may be given in tabular form, but are also 
often plotted as a FN curve. The basic FN data may be 
integrated to obtain a value for the equivalent annual 
fatalities. One use of this statistic is to compare the risks of 
different activities, for example coal mining vs nuclear 
energy. It is generally regarded as less appropriate for a 
hazard on a particular site, since it lumps together small 
incidents with relatively high frequency and large incidents 
with relatively low frequency. However, for such a hazard it 
is of some value in assessing the relative contribution of 
high frequency and low frequency events to the overall risk. 

9.19.3 Risk contours and transects 

The use of risk contours and transects is illustrated in 
Figures 9.28 and 9.29. Figure 9.28 gives overpressure risk 
contours for a natural gas liquids (NGL) plant and refrig¬ 
eration facility. Figure 9.29 gives a risk transect for 
interaction between a vapour cloud from a pipeline and 
the public. 

9.19.4 FN tables and curves 

Table 9.32 shows some results of the risk assessment 
given in the First Convey Report. Figure 9.30 shows the 
corresponding FN curve. This was one of the first FN 
curves published for the process industries. Also shown in 
Figure 9.30 are other curves given in the two Convey 
Reports. 

Figure 9.31 shows a set of FN curves given by the HSE for 
accidents, in the chemical and petrochemical industries, in 
the United Kingdom and worldwide. 

If the FN relation is a straight line, it may be written as: 
fN* = r = Constant [9.19.1] 

where/is the frequency, N\s the number of fatalities, r is 
a constant and a is an index. 








9/72 HAZARD ASSESSMENT 



Figure 9.28 Risk contours for a NGL plant and refrigeration facility (Ramsay, Sylvester-Evans and English, 1982) 
(Courtesy of the Institution of Chemical Engineers) 



North 


Distance from pipeline (m) 


South 


Figure 9.29 Risk transect for interaction between a vapour cloud from a pipeline and the public (Ramsay, 
Sylvester-Evans and English, 1982) (Courtesy of the Institution of Chemical Engineers) 


9.19.5 Risk aversion in FN curves 

Generally, society is more averse to a single very large 
accident than to a number of small ones. Such risk aversion 
has been discussed in Chapter 4. In simple terms, risk 
aversion exists if society regards a single accident with 


100 fatalities as in some sense worse than 100 accidents 
with a single fatality each. 

Risk aversion is seen most clearly in FN curves, where 
the slope of the curve indicates the degree of risk aversion. 
If the FN relation is in fact a straight line, its slope 
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Table 9.32 Assessed risks for some principal hazards given in the First Canvey Report (before proposed 
modifications (after Lees, 1982b) Courtesy of the Institution of Chemical Engineers) 


Hazard, 


Frequencies of 
initiating event 
(10 -6 /year) 


Frequenceis (10 6 /year) for number of offsite casualties exceeding 
0 10 1500 3000 4500 6000 12,000 18,000 


Oil overtopping of bund by 1000 

process explosion 3 
LPG ship collision 6640 

LNG ship collision remote 50 

from jetty 

LNG jetty incident 2000 

Ammonia storage sphere 100 

spontaneous failure 
HF release 3 200 

Ammonium nitrate storage 85 

explosion 


6490 

45 

1830 


30 168 144 


LNG, liquefied natural gas; LPG, liquefied petroleum gas. 
a Occidental. 



Number of casualties, N 

Figure 9.30 FN curve for some principal hazards given in the First Canvey Report, (Hagon, 1984) (Reproduced by 
permission of the Institution of Chemical Engineers) 
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Number of people harmed, N 

Figure 9.31 Some FN curves for accidents in the chemical and petrochemical industries, in the United Kingdom 
and worldwide (HSE, 1989e) (Courtesy of the HM Stationery Office) 


is directly related to the parameter a, which is therefore 
known as the ‘risk aversion index’. 

9.19.6 Characteristics of FN curves 

In order to make full use of the information given in FN 
curves and also to avoid certain misunderstandings that 
have arisen in their use, it is necessary to consider some of 
the characteristics of such curves. Accounts of FN curves 
include those given by R.F. Griffiths (1981e), the Royal 
Society Study Group (1983) and Hagon (1984). 

As already stated, the normal FN curve is a plot of 
the frequency F of N or more events. Use has been made, 
however, particularly in early work, of alternative forms. 
The best known of these is the Farmer curve (F.R. Farmer, 
1967b). This is a risk criterion curve and description of it is 


deferred until Section 9.21. However, it is appropriate to 
consider here the characteristics of the curve itself, that is 
whether the curve represents actual risk or a risk criterion. 
In a curve of this type, the consequence quantity plotted 
against frequency is not a cumulative quantity. There has 
been some confusion as to what this quantity should he. 
Accounts are given by R.F. Griffiths (1981e) and D.C. Cox 
and Bayhutt (1982). The interpretation of Farmer himself is 
that it is a range of consequences, or a consequence inter¬ 
val, as shown in Figure 9.32. However, this type of curve is 
now rarely used. 

Accounts of the relations underlying FN curves include 
those by R.F. Griffiths (1981e), D.C. Cox and Baybutt (1982) 
and Hagon (1984). The following treatment is based on the 
work of the latter. 
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Curies of 131 I 

Figure 9.32 Interpretation of the Farmer curve (R.F. Griffiths, 1981e) (Courtesy of Manchester University Press) 


From Equation 9.19.1, the following relations may be 
stated for cumulative frequency F: 

F« = J2f [9.19.2a] 


= r ^2 (l/AT) [9.19.2b] 


Defining 

S ^’ a ) = E(W a ) [9.19.3] 

Ff = rS(N, a) [9.19.4] 

= r[S(N 2 , a) - S(Ni - 1, a)] [9.19.5] 

Values of S(N, a) computed for ranges of values of iVand a 
are shown in Figure 9.33. 

The total annual fatalities D may be obtained in a similar 


manner: 

D? = J2fN [9.19.6a] 

= r5(W“- 1 ) [9.19.6b] 

= rS(N, a - 1) [9.19.7] 

= r[S(N 2 , a - 1) - S(Ni - 1, a - 1)] [9.19.8] 


If / is treated as a continuous function of N, the following 
relations apply: 

FfttJ / 6N [9.19.9] 

D i=J i /Wd/V [9.19.10] 

The relations for these integrations are shown inTable 9.33. 
The relations change at a = 2. The values based on the 
assumption that N is continuous are not accurate for N less 
than approximately 30. 

The application of these equations to a set of FN curves 
given in an actual risk assessment has also been described 
by Hagon. Figure 9.34 shows the FN curves concerned 
which are for the ammonia storage sphere in the Rijnmond 
Report. 

Also shown in Figure 9.34 is a dotted line that corre¬ 
sponds to 
a = 2 

Ff = 10“ 3 

Then for r taking some large value of N, say 5000, 
r = F?/S(N, a) 

From Figure 9.30, for N— 5000 
S(5000, 2) m 1.65 

fm 10 _3 /1.65 = 0.61 x 10" 3 

Then the cumulative frequency of accidents and expected 
annual fatalities may be estimated. Values of these 
quantities derived from (1) the exact relations and (2) the 
approximate relations given in Table 9.33 are shown in 
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N 

Figure 9.33 Values of parameter S(N, a) (Hagon, 1984) (Courtesy of the Institution of Chemical Engineers) 


Table 9.33 Approximate relations for cumulative frequencies and expected annual fatalities (Hagon, 1984). 
These relations approximate to the exact relations (Equations (9.19.3)-(9.19.6)) if N> 30 and limits are taken 
as N 2 + 0.5, N 1 - 0.5 (Courtesy of the Institution of Chemical Engineers) 


Aversion index 



Cumulative frequency 


Total deaths /year 


(F)% 
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(D)% 
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Figure 9.34 FN curves for an ammonia storage sphere given in the Rijnmond Report (Hagon, 1984) (Courtesy of the 
Institution of Chemical Engineers) 


Table 9.34 Cumulative frequencies and expected annual 
fatalities for an ammonia storage sphere (after Hagon, 
1984) (Courtesy of the Institution of Chemical Engineers) 



Approximate 
relation (per year) 

Exact 

relation (per year) 

F 30 

1.8 x 10“ 4 

2.2 x 10“ 3 

£300 

1.8 x 10“ 5 

2.2 x 10“ 5 

Dl° 

3.5 x 1(T 3 

2.4 x 10“ 3 

£3000 

4.8 x 10“ 3 

5.2 x 1IT 3 


Table 9.34. These equations are considered further in 
Section 9.21 in relation to risk criteria. 

9.20 Confidence in Results 

The results of a hazard assessment are subject to uncer¬ 
tainty and it is necessary therefore to be able to estimate 
the extent of this uncertainty. Discussions of uncertainty 
in hazard assessment include those by Nussey (1983), 
Goosens, Cooke and van Steen (1989) and Chhibber, 
Apostolakis and Okrent (1991). 


9.20.1 Sources of uncertainty 

Sources of uncertainty in a hazard assessment may be 
classified under the following broad headings: 

(1) scenarios for initial event; 

(2) scenarios for escalation; 

(3) event frequency, probability; 

(4) models for physical events; 

(5) models for injury; 

(6) models for mitigation. 

These sources of uncertainty are amplified in Table 9.35. 
An account of sources of uncertainty with special reference 
to toxic release has been given by Nussey (1983). 

9.20.2 Characterization of uncertainty 

Uncertainty may attach to a single event or to a chain of 
events. The approach taken to the characterization of 
uncertainty depends on the complexity of the problem. 
The conventional analytical approach to uncertainty in 
the frequency, or probability, of a single event is to utilize 
not a point value but a distribution of values. A distribution 
that is widely utilized is the log-normal distribution, 
described below. 
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Table 9.35 Some sources of uncertainty in hazard 
assessment 


A Scenarios for initial event 


Some uncertainties in the scenarios for the initial event, 
and thus the source term are: 

Release sources and, for each source 
Size 

Orientation 
Flash, rainout 
Initial air entrainment 
Duration 


B Scenarios for escalation 


Pool vaporization 
Gas dispersion 
Ignition 
Jet flames 
Pool fires 
Fireballs 

Flowing, burning liquid 

BLEVEs 

Missiles 

Failure of emergency shut-down 
Failure of fire protection system 
Structural collapse 

C Event frequency, probability 


Failure frequency 
Leak frequency 
Ignition probability 
Explosion probability 

D Models for physical events 


Flash fires 
Pool fires 
Fireballs 
Jet flames 
BLEVEs 
Missiles 


E Models for injury 


Heat radiation 
Explosion effects 
Direct blast effects 
Housing collapse 
Missiles 
Toxic effects 


F Models for mitigation 

Human behaviour 

Escape 

Shelter 


Continuing with an analytical approach, the propaga¬ 
tion of uncertainty is handled by utilizing relationships for 
the combination of distributions, principally relations for 
the sum and product of distributions. The result obtained is 
a distribution of the frequency, or probability, of the event 
of interest. 


If the problem is too complex for analytical solution, use 
may be made of techniques such as Monte Carlo simulation 
to obtain frequencies and probabilities. Again a frequency, 
or probability, distribution is obtained. The Monte Carlo 
method was de scribed in Chapter 7. 

Moving on to uncertainty in the models, for physical 
effects, injury and mitigation, the analytical approach is 
to derive relations for the sensitivity of the results to 
changes in the models. One method is to determine the 
first derivative of the output of the model to its inputs, in 
other words the gains. Another is to express the para¬ 
meters of the model as distributions rather than point 
values. A formal method of investigating the sensitivity 
of results to the parameters of physical models and 
injury relations is the hazard impact model, described in 
Section 9.23. 

If again the problem is too complex to be handled analy¬ 
tically, the sensitivity of the results to the models may be 
investigated by Monte Carlo simulation or other methods. 
Again the parameters in the model may be given in the form 
of distributions. 

The characterization of uncertainty in the scenarios is 
less well developed. One approach is to utilize expert 
judgement, as described below. 

9.20.3 Log-normal distribution and error factor 

A distribution which is widely used to characterize the 
spread of values of a variable is the log-normal distribu¬ 
tion. The properties of the log-normal distribution were 
described in Chapter 7. 

This distribution is used in particular for event fre¬ 
quency X and probability p. For a failure rate X, the 
log-normal distribution may be written as 

where m* is the location parameter and a the shape para¬ 
meter. 

The distribution is also frequently characterized in 
terms of the median A m ed and the shape parameter a. The 
median A me a of the distribution is 

Amed = expw* [9.20.2a] 

m = ln/Ved [9.20.2b] 

The mean A mn is 

2 m „ = exp (m* + (T 2 / 2 ) [9-20.3] 

where subscripts med and mn indicate the median and 
mean, respectively. 

An important property of the log-normal distribution is 
its associated error factor. For lower and upper confidence 
bounds X\ and Xu, respectively, the median is related to 
the bounds by the error factor <p: 


Xmed = <Ml 

[9.20.4a] 

= iu /<t> 

[9.20.4b] 

Hence 


2med = (XlXuf 2 

[9.20.5] 
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The relation between the spread parameter a and the 
error factor <p is 

a = \ruj>/k [9.20.6] 

where k is a constant. The values of k for 90% and 95% 
of values that lie within the range are 1.64 and 1.96, 
respectively. 

These equations have been written for further reference 
in terms of event frequency X but they could equally well be 
written in terms of any variable x. In particular, they are 
also applicable to event probability p, and are so utilized 
below. 

9.20.4 Propagation of uncertainty 

A broad outline of approaches to the propagation of uncer¬ 
tainty was given above. An account is given here of the 
propagation of uncertainty in event rates. 

Since a combination of events is considered, it is more 
appropriate to work in terms of probability p rather than 
frequency X. For a variable p 3 , which is the product of two 
independent variables p 3 and p 2 so that 

p3=pipz [9.20.7] 

it can be shown that if variables pi and p 2 are log-normally 
distributed, the distribution of p 3 is also log-normal and 
the relations between the location parameters and the 
variances are 

ml = m\ + m\ [9.20.8] 

of = erf + of [9.20.9] 

where subscripts 1-3 indicated events 1-3, respectively. 
Then it follows from Equations 9.20.2, 9.20.3, 9.20.8 and 
9.20.9 that the median and mean of p 3 are given by: 

/>3,med=/>l,medX/> 2 ,med [9-20.10] 

P 3 ,nm=Pl,mnXp2,n>n [9.20.11] 

The propagation of uncertainty in a fault tree is considered 
in Section 9.20.7. 

9.20.5 Scenarios 

The basis of a hazard assessment is a set of scenarios. Both 
the completeness and the realism of these scenarios are 
subject to uncertainty. 

Usually in hazard assessment the scenarios relate to loss 
of containment. There are then two sets of scenarios to be 
considered. The first set relates to the release itself. The 
second set relates to the escalation. Both release and esca¬ 
lation scenarios are subject to uncertainty. 

In principle, completeness of the release scenarios maybe 
achieved by considering release from each item of equip¬ 
ment. For this purpose, certain categories of equipment 
may he lumped together. On the other hand, it is necessary 
to consider not just a single size of release, but also a size 
distribution. There is, however, a further uncertainty con¬ 
cerning the geometry of the release. The material will not 
necessarily come out as, say, a free jet, but may issue at 


a downwards angle and hit the ground or may impinge on 
other equipment. 

Completeness of the escalation scenarios is probably 
a more difficult problem. Much attention has been focused 
on the release and dispersion of flammable or toxic gas 
clouds. The generation of scenarios for such a hazard has 
not proved particularly difficult. However, the concentra¬ 
tion on this rather stereotyped situation has perhaps 
masked the problem of defining the escalation in other, 
more varied, cases. Such a situation is exemplified by an 
offshore module. 

Uncertainty concerning scenarios shades over into 
uncertainty concerning models, as described below. 


9.20.6 Event rate 

For an event rate, a frequency or probability, uncertainty 
may be taken into account by treating the event rate as a 
random variable with a distribution of values. This 
approach was used in the Rasmussen Report and since then 
has been widely adopted. In this study, data for both failure 
frequencies and probabilities were correlated using the 
log-normal distribution, as described in Section 9.20.3. 

The procedure adopted was to consider for each equip¬ 
ment the available data on failure frequency or probability 
and to determine by expert judgement the lower and upper 
bounds for the range of values covering 90% of cases. The 
tables of failure data quote the lower and upper bounds, the 
median and the error factor. 


9.20.7 Fault trees 

It is also necessary to be able to obtain the probability dis¬ 
tribution of the frequency of an event that has been syn¬ 
thesized using a fault tree. Where a measure of the 
uncertainty in the frequency estimate is made in a risk 
assessment, this is generally done numerically using 
Monte Carlo simulation. The frequencies of the base events 
in the tree are expressed in terms of probability distribu¬ 
tions of frequency, such as the log-normal distribution as 
just described. Each simulation trial generates a set of fre¬ 
quencies for the base events. These are combined according 
to the tree structure to obtain a frequency of the top event. 
The result of a series of such trials is the probability den¬ 
sity function for the top event. The principle of the method 
is illustrated in Figure 9.5. 

Analytical treatments of the propagation of uncertainty 
through the logic gates of a fault tree are also available for 
certain defined cases. This approach is illustrated here by 
the work of Keey and Smith (1984). The problem considered 
is the combination at OR and AND gates of inputs which 
are normally distributed. Taking first an OR gate, consider 
two inputs whose frequencies take randomvalues X 3 and X 2 
with corresponding mean values Xi and X 2 and standard 
deviations o 1 and <t 2 - The frequency X of the output from the 
OR gate is 


A- X\ ■+• /./. [9.20.12] 

and the corresponding mean frequency X is 


X = X 1 + X 2 [9.20.13] 
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But mean values can be expressed as 
Then Equation 9.20.13 can be rewritten a: 

expected values. 

MM=E[Xi]+E[X 2 ] 

[9.20.14] 

The variance of the output becomes 



[9.20.15] 

Then, from the properties of expected values. 


[9.20.16] 

+E[2X 1 X 2 ]+E[X%\ 

[9.20.17] 

Also 


(£[*])*=? = I?+ 2JA + 3J 

[9.20.18] 

From Equations 9.20.15 and 9.20.17 


jg|s|« E[l\ + of] +E[lj + of] + Uih 

[9.20.19] 

Substitution of Equations 9.20.18 and 9.20.19 into Equa¬ 
tion 9.20.15 gives 

a 2 m (II + of) + (X .2 + of) - (Hi + h) 

[9.20.20] 

(°i + °l) 1/2 

[9.20.21] 

A measure of spread of the frequency is 
variation C: 

the coefficient of 

C, = <7,//, 

[9.20.22] 

The coefficient of variation of the output 

is 

C = <t/I^(o 2 1 +4) 1/2 /(X. 1 + X 2 ) 

[9.20.23] 

One limiting case is where the two inputs have the same 
mean value (Ao = Ai = X. 2 ) and the same standard deviation 
(tr 0 = ci = a 2 ). Then 

C=(2^) 1 '' 2 /2lo = 2 1 '' 2 <ro/2l 0 

[9.20.24] 

C=Q/2V 2 

[9.20.25] 

Another limiting case is which one input becomes single 
valued (cy=0) and very small (Ai < X 2 ): 

C = (<rl) 1/2 /|Ji + X 2 ) = C2/I2 

[9.20.26] 

C=Cz 

[9.20.27] 

Hence the output coefficient of variation has the range: 

(l/2 1 / 2 )min(Ci, Ci) <T<|iaf(T 0 , <F) 

[9.20.28] 


Equation 9.20.18 shows that for an OR gate the coefficient 
of variation of the output is less than the larger of the 
coefficients of variation of the inputs, and that in this sense 
this gate reduces the uncertainty in the input data. 

For an AND gate with an input of frequency /.j and 
another input of probability p 2 , with corresponding stand¬ 
ard deviations oi and s 2 , respectively, the frequency X of the 
output is 

'$m /.\p2 [9.20.29] 

The corresponding mean frequency X is related to the 
mean frequency X\ and probability p 2 of the inputs: 

[9.20.30] 

Then 

E[X 2 ] = E[Xlt%] [9.20.31a] 

= E[xl]-E[pl] 9.20.31b] 

*&+»?)$+4) [9-20.31c] 

Also 

= I 2 = l{pl [9.20.32] 

Then, from Equation 9.20.15, the standard deviation of the 
output a is 

(r 2 = (ll + of) (pl + 4)~ IIP | [9.20.33] 

a=(44 + l\4 + 4p%) 112 [9.20.34] 

The output coefficient of variation is then 

+ 1\4 + <4Pl) V2 /l 2 j>2 [9.20.35] 

Noting that 

Ck = s 2 /p 2 [9.20.36] 

Equation 9.20.35 can be recast in terms of the input coeffi¬ 
cients of variation 

C = (C? + Cf + CfCf) 1/2 [9.20.37] 

One limiting case is where both input coefficients have the 
same value (Co = Ci = C2) 

C = Cb(2 + Cp) 1 / 2 [9.20.38] 

Another limiting case is in which one input coefficient 
becomes very small. Hence the output coefficient of varia¬ 
tion has the range 

CmK'V f [9.20.39] 

Cm = max(Ci, C 2 ) 


[9.20.40] 
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Relation 9.20.39 shows that for an AND gate the coeffi¬ 
cient of variation of the output is more than the larger 
of the coefficients of variation of the inputs, and that 
in this sense this gate increases the uncertainty in the 
input data. 

These results show that strictly in terms of error propa¬ 
gation for a sizeable fault tree a large number of initiating 
events may produce an outcome for which the uncertainty 
is relatively low, while a large number of mitigating or pro¬ 
tective features may produce one for which the uncertainty 
is relatively high. 


9.20.8 Event trees 

An event tree consists of a series of binary splits. Each 
branch of the tree constitutes a separate escalation sce¬ 
nario. Uncertainty attaches both to the set of escalation 
scenarios and then, assuming that the set is correct, to the 
probability of each branch. The question of uncertainty in 
the escalation scenarios was discussed in Section 9.20.5. 
The probability distribution for the occurrence of a given 
branch may be obtained from probability distributions for 
each of the branch points. 


9.20.9 Scenarios, models and parameters 

The uncertainty in models has been discussed by 
Chhibber, Apostolakis and Okrent (1991), in the context of 
modelling of the fate of chemicals in the environment, parti¬ 
cularly in geohydrochemical systems. They consider espe¬ 
cially the following areas of uncertainty: (1) completeness 
of scenarios, (2) completeness of chains of consequences, 

(3) validity of individual models and (4) parameters in these 
models, with particular reference to expert judgement. 

The formulation of scenarios by experts has been the 
subject of study. The Reactor Risk Reference Document of 
the Nuclear Regulatory Commission (NRC) (1989 NUREG- 
1150) gives an account of the expert treatment of scenarios 
in terms of ‘issues’ and levels’ for a nuclear incident. 
The issues concern the scenarios that are credible. The 
levels represent different sets of assumptions about these 
scenarios. 

Likewise, the models, whether for physical phenomena 
or for injury, may be based on a wide variety of assumptions 
and may thus be very disparate. Up to a certain point, vari¬ 
ation may be handled by assigning different values to the 
parameters in the model, but beyond this point the model 
can be stretched no more, and a different model has to be 
used. There can be a thin dividing line between models and 
parameters. 

Similarly, the value assigned to a parameter may depend 
on the model used. Awell-known case is particle diameter, 
which may be characterized in different ways, depending 
on the situation being modelled. The relationships between 
models are a problem area. The models are not necessarily 
exclusive, exhaustive or independent. 


9.20.10 Physical models 

In general, the question of uncertainty in the models of 
physical phenomena is a relatively neglected one. Whereas 
treatments are available for uncertainty in event data 
and fault trees, there is no real equivalent for models. The 
problem is considered here first in terms of certain general 
principles. The role of expert judgement in selecting mod¬ 
els is then described. 


It is possible to identify certain features of models that 
bear on the degree of uncertainty. Models may be 

(1) theoretical; 

(2) empirical; 

(3) semi-empirical. 

They may also be 

(1) deterministic; 

(2) probabilistic. 

The characteristics of these different types of model are 
well known. A theoretical model may have the weakness 
that it fails to take into account some relevant phenomenon. 
It may contain parameters to which it is difficult to assign 
accurate values or which it is impractical to quantify at all. 
The weakness of an empirical model may be that it has a 
limited, and poorly defined, range of applicability. A semi- 
empirical model, incorporating some combination of theory 
and experiment, may go some way to overcoming these 
weaknesses. Alternatively, a straight theoretical model 
may be validated by experiments. 

A comprehensive model incorporates knowledge of the 
relevant regimes, the ranges of these regimes, and, in each 
regime, the mechanisms and the values of the parameters. 
Some factors that bear on the confidence that can be placed 
in a model include: 

(1) theoretical basis; 

(2) experimental validation; 

(3) range of applicability; 

(4) variety of tests; 

(5) origin of model; 

(6) life of, and interest in, model; 

(7) number and convergence of competing models. 

Confidence in a model must be greater if it has a theoretical 
basis. Equally, experimental validation increases con¬ 
fidence. It is, however, the quality of these two factors that 
matters. It is not uncommon that a theoretical model with 
some experimental support later proves inadequate. 

The range of applicability is therefore important. 
Greater confidence can be placed in a model that covers a 
wide range and has been tested over this range. Testing 
using a variety of methods also increases confidence. 

In assessing quality, the origin of the model is a cru¬ 
cial factor. Notwithstanding the challenge to conven¬ 
tional thinking that sometimes occurs from a previously 
unknown author, confidence is clearly greater if the work¬ 
ers) concerned are well established. 

Where there is a single model, confidence should in 
principle increase with time. This will be true, however, 
only if there is some interest in the model so that the pas¬ 
sage of time does actually result in activities which provide 
some degree of support for it. 

A more encouraging situation is where there are a num¬ 
ber of competing models that over a period of time yield 
results which converge. Whilst this by no means gives a 
guarantee of correctness, it does nevertheless build con¬ 
fidence. 

These points are illustrated by the history of the devel¬ 
opment of models for heavy gas dispersion. In the early 
days, the models used for gas dispersion were neutral den¬ 
sity models. These had both a strong theoretical basis and 
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extensive experimental support. They originated largely 
from the Meteorological Office and had a good scientific 
pedigree. It was shown by experiment, however, that the 
behaviour of a heavy gas cloud is quite different from that 
of a neutral density gas. It has some of the characteristics of 
the flow of a liquid, but differs in that air is entrained at the 
top and the edge of the cloud.This led to the development of 
a number of models for heavy gas dispersion. 

Estimates of the travel distance of a flammable cloud 
were given in an early study, Transportation of Liquefied 
Natural Gas by the Office of Technology Assessment (OTA) 
of the US Congress (1977). The following estimates were 
quoted for the maximum downwind distance for a cloud 
from a 25,000 m 3 instantaneous spill of LNG onto water in a 
5 mile/h wind for dilution to 5% concentration: 


Travel distance (miles) 

Source 

0.75 

Federal Power Commission 

1.2 a 

Science Applications Inc. 

5.2 

American Petroleum Institute 

16.3 

US Coast Guard 

25.2-50.3 

US Bureau of Mines 


a 37,500 m 3 release in a 6.7 mile/h wind. 


The figures illustrate the wide spread given by the differ¬ 
ent early models. As the field has become more mature, this 
wide spread has disappeared. There are now available 
heavy gas dispersion models that have emerged from a 
large field of competitive models and for which there is 
experimental underpinning from both large-scale field 
trials and wind tunnel tests. 

9.20.11 Injury relations 

Many of the same general considerations that apply to 
physical models apply also to injury relations, but in addi¬ 
tion the latter have some characteristics of their own. In 
general, an injury relation is obtained either from labora¬ 
tory work on animals or from incident data affecting 
humans. In the former case, confidence limits are usually 
given for the results. Uncertainty arises, however, con¬ 
cerning the applicability of the results to man. If the data 
relate to an incident, there may be uncertainty concerning 
both the physical phenomenon and the exposure of humans 
to it. It is difficult to provide confidence limits. The uncer¬ 
tainty tends to be greatest at the two extremes of very low 
and very high probability of the injury effect and least at 
the 50% probability level. Often the injury relations are 
expressed as probit equations. The remarks just made 
apply equally to these. 

9.20.12 Expert judgement 

The choice of models to be used is normally made by a sin¬ 
gle expert. One of the main methods available to assess the 
uncertainty in the models is that of expert judgement, 
using a panel of experts. 

Several studies of expert judgement in assessment of 
models have been made. One is the NRC study already 
mentioned (NUREG-1150). 

Another is the work of Goossens, Cooke and van Steen 
(1989). This addresses uncertainty in the relative likelihood 
of different phenomena and in the values of parameters. 
The areas of application include failure rates, physical 
models and injury effects. 


Models are developed by a domain expert. The uncer¬ 
tainty in the models may be assessed by a normative 
expert, whose expertise resides in such assessment. 

One way of quantifying the uncertainty in a model is the 
error factor method. The error factor was described in 
Section 9.20.3. Consider a deterministic reference model 
(DRM) that yields some variable T. Then using an error 
factor E, T may be written as 

T = ET mM [9.20.41] 

where T DEM is the value of given by the DRM. The error 
factor is external to the model. It may be updated whilst the 
model remains unchanged. This error factor approach has 
been applied by Siu and Apostolakis (1985) in the context 
of fire growth in a building. It is described further by 
Chhibber, Apostolakis and Okrent (1991). 

It can occur that experimental data become available that 
might be used to modify a model. In principle, such updat¬ 
ing may be effected using Bayesian methods, but this may 
not be straightforward. In order to apply the Bayesian 
approach it is necessary to formulate a likelihood function 
and for a complex model it may not be easy to do this. In this 
case, one approach may be to use expert judgement meth¬ 
ods to formulate a suitable likelihood function. 

9.20.13 Results 

The results of a hazard assessment should in principle 
include not only the best estimate of the risk but also a 
measure of the uncertainty that attaches to this estimate. 
There are, however, problems associated with providing 
such measures of uncertainty. These include: the difficul¬ 
ties of principle in assigning uncertainty, particularly to 
models; the effort required to compute the measures, which 
may be comparable with that of making the basic estimate; 
and an inability to make effective use of this additional 
information in decision-making. 

9.21 Risk Criteria 

In order to evaluate a risk assessment it is necessary to 
have appropriate risk criteria. Some of the more philo¬ 
sophical aspects of risk are considered in Chapter 4. 
The treatment here is confined to a consideration of some 
of the principles that should underlie the choice of risk 
criteria and of some of the types of criterion, systems 
and numerical criterion values used or proposed. Accounts 
of risk criteria include those given in Dealing with Risk 
(R.F. Griffiths, 1981c), Risk Assessment. A Report of a Royal 
Society Study Group (Royal Society Study Group, 1983) (the 
RSSG Report), the Third Report of the Advisory Committee 
on Major Hazards (Harvey, 1984), The Tolerability of Risk 
from Nuclear Power Stations (HSE, 1988c) and Risk Criteria 
for Land-use Planning in the Vicinity of Major Industrial 
Hazards (HSE, 1989c). Selected references on risk criteria 
are given in Table 9.36. 

9.21.1 Royal Society Study Group 

The RSSG Report sets out some possible quantitative 
guidelines for risk. It prefaces these by a number of quali¬ 
fications. The risks considered are primarily risks of death, 
but in addition some suggestions are also made for criteria 
for non-fatal risks. 

The RSSG define an upper bound of risk above which 
the risk is ‘unacceptable in essentially all circumstances’, 
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Table 9.36 Selected references on toleration of risk 
and risk criteria 


Grosser et al. (1964); Sowby (1964,1965); Crowe (1969); 
Starr (1969,1970,1972,1985); Kletz (1971,1976d, 1977c, 
1980a,b, 1980—, 1981d,f,k,m, 1982e, 1983d,g); R.M. Stewart 
(1971); NAE (1972); Robens (1972); Sinclair (1972); Sinclair, 
Marstrand and Newick (1972a,b);Tudor-Hart (1972); 
Weinberg (1972a); Siccama (1973); Baldewicz (1974); Brook 
(1974); Hirschleifer, Bergstrom and Rappaport (1974); 
Koshland (1974); Lawless (1974); Sather (1974,1976); AEC 
(1975); Chicken (1975); Linnerooth (1975); Otway (1975); 

R. Wilson (1975); Ash, Baverstock and Vennart (1976); 

J.H. Bowen (1976); Gibson (1976a,c,d,f, 1977a, b); 

C.H. Green and Brown (1976/77,1978,1980a,b); H a mmond 
and Adelman (1976); Harvey (1976,1979b, 1984); 
Kastenburg, McKone and Okrent (1976); Lowrance (1976); 
Slovic, Fischoff and Lichtenstein (1976,1981,1982); 
Solomon, Rubin and Okrent (1976); Starr, Rudman and 
Whipple (1976); Council for Science and Society (1977); 
F.R. Farmer (1977b); Glaser (1977); Mcginty and Atherley 
(1977); McLean (1977a, 1982); Mark and Stewart (1977); 
Rowe (1977); Adcock (1978); Boe (1978); Critchley (1978); 
HSC (1978c); HSE (1978b, 1981a); Rothschild (1978); 
Torodahl (1978); Dunster and Vinck (1979); C.H. Green 
(1979); Nelkin and Poliak (1979); Atallah (1980,1981b-e); 
Brett-Crowther (1980a); Conrad (1980); Dierkes, Edwards 
and Coppock (1980); Dowie and Lefrere (1980): Giarini 
(1980); Goodin (1980); R.F. Griffiths (1980); Houston (1980); 
Risk Research Committee (1980); Schwing and Albers 
(1980); Starr and Ritterbush (1980); F. Warner (1980, 
1981a,b); Weaver (1980); Zuckerman (1980); Berg and 
Maillie (1981); AN. Cohen (1981); Cotgrove (1981); Fischhoff 
et al. (1981); Harvey (1981); Hildyard (1981); T.R. Lee (1981); 
McLoughlin (1981); Okrent (1981); Payne (1981); F. Warner 
and Slater (1981); von Winterfeldt, John and Borcherding 
(1981); Wu-Chien and Apostolakis (1981); Hohenemser and 
Kaspersen (1982); Lagadec (1982); Lind (1982); Kinchin 
(1982); Macgill (1982); WW. May (1982); O’Riordan (1982); 
Otway and Thomas (1982); Covello et al. (1983); Giannini 
and Galluzzo (1983); The Royal Society (1983,1992); 
Covello (1984); Jouhar (1984); Pierson (1984); Sass (1986); 
BMA (1987); Ashmore and Shama (1988); Corbett (1988 
LPB 82); Cumo and Naviglio (1989); H.J.S. Petersen (1989); 
Smithson (1989); V.C. Marshall (1991a); Vlek and Keren 
(1991); Alder and Ashurst (1992); Engineering Council 
(1992); Philey (1992a); Council (1993); Irish (1993); 
Melchers (1993b); Melchers and Steward (1993); Song, 
Black and Dunne (1993) 

Risk perception 

Douglas (1966,1982,1985,1987,1990,1992); Ashby (1997); 
ICRP (1977a,b); Fischhoff et al. (1978); C.H. Green and Brown 
(1978); Lichtenstein etal. (1978); Ravets (1979); Slovic, 
Fischhoff and Lichtenstein (1980); M. Thompson (1980); 
Wynne (1980,1982,1989,1992); Fischhoff et al. (1981); 

Helms (1981); Watson (1981); Cotgrove (1982); Douglas and 
Wildavsky (1982a,b); Otway and Winterfeldt (1982); 
Fischhoff and Macgregor (1983); E.J. Johnson andTeversky 
(1984); Slovic, Lichtenstein and Fischhoff (1984); 

J.G.U. Adams (1985); Pidgeon, Blockley and Turner (1986); 
Slovic (1986); B.B. Johnson and Covello (1987); R.Wilson and 
Crouch (1987); Rip (1988); Wildavsky (1988); J. Brown (1989); 
Sharlin (1989); M. Thompson, Ellis and Wildavskay (1990); 
Beder (1991); C.H. Green,Tunstall and Fordham (1991); Slovic, 
Flynn and Layman (1991); Krimsky and Goldring (1992) 


Risk communication 

MCA (n.d./17); Wynne (1980,1982,1992); Dewhurst (1986); 
Plough and Krimsky (1987); Corbett (1988); Covello and 
Allen (1988); Covello, Sandman and Slovic (1988); 
Kasperson etal. (1988); Hadden (1989a,b); F.R. Johnson and 
Fisher (1989); NRC (1989); Otway and Wynne (1989); Siegel 
(1989); Bord and O’Connor (1990); Handmer and Penning- 
Rowsell (1990); Covello (1991); A. Fisher (1991); Kasperson 
and Stallen (1991); B.B. Johnson (1992); AIHA (1983/28) 

Natural and man-made hazards 

Macdonald (1972); Blume (1978); Burton, Kates and White 
(1978); M.G. Cooper (1985); C.H. Green,Tunstall and 
Fordham (1991) 

Aircraft: North (1949); M. Hill (1971); Warren (1977) 
Buildings: Flint (1981); Holdgate (1981) 

Chemicals: McLean (1979,1981) 

Chronic hazards: Travis et al. (1987); J.B. Cox (1989) 
Flooding (Dutch dikes): van Danzig (1960);Turkenburg 
(1974); Harvey (1976) 

Foodstuffs: McLean (1977b) 

Leisure: J. Wilkinson (1981) 

Medical: Roach (1970); Leach (1972); H. Miller (1973); 
Pochin (1975,1981a,b) 

Nuclear radiation: Burhop (1977); Pochin (1983) 

Roads: Reynolds (1956); Dawson (1967); Hayzelden (1968); 
A.D. Little (1968); Jones-Lee (1969);Thedie and Abraham 
(1969) 

Major hazards 

Harvey (1976,1979b, 1984); S.B. Gibson (1978); Lowe (1980); 
Helsby and White (1985) 

Nuclear industry 

F.R. Farmer (1979b, 1971); AEC (1975); Weinberg (1976); 

Orr (1977); Pochin (1983); HSC (1978c); J. Hill (1981); 

W. L. Wilkinson (1981); Okrent and Baldewicz (1982); 

T.R. Lee, Brown and Henderson (1984); Franklin (1985); 
C.Tayler (1985f); Gunning (1987); HSE (1988c) 

Conventional energy sources 

Orr (1977); HSC (1978c); HSE (1978/4,1980 RP11); 

AN. Cohen and Pritchard (1980); S. Russell and Ferguson 
(1980); Ferguson (1981,1982); Inhaber (1981a,b); K. Thomas 
(1981); Dunster (1982); IAEA (1984); Fremlin (1985) 

Fire, explosion 

Melinek (1972 FRS Fire Research Note 950,1973 FRS Fire 
Research Note 978,1974 BRE CP 88/74); North (1973 FRS 
Fire Research Note 981); Coward (FRS 1973 Fire Research 
Note 982) 

Chemical industry 

F.R. Farmer (1971); Kletz (1971,1972a, 1977a,f, 1980a,b, 
1981a); Bulloch (1974); S.B. Gibson (1976a,c,d,f, 1977a,b); 
Harvey (1976); HSE (1978b, 1981a); de Heer, Kortlandt 
and Hansen (1980); Livingstone (1979); N.C. Harris 
(1982,1986) 

Gas terminals 

Keeney (1980); Kunreuther, Linnerooth and Starnes (1981) 

Offshore (see Table A18.1) 

Environment 

Sewell (1971); Programmes Analysis Unit (1972); 

Ashby (1976); Barker (1977); Fischoff et al. (1978); Kletz 
(1981b) 
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Fatality rates 

Pochin (1973); Fryer and Griffiths (1978 SRD R110,1979 
SRD R149); Grist (1978 SRD R125) Anon. (1980n); C. Wright 
(1986) 

Risk criteria 

NRC (Appendix 28 Risk Criteria, Safety Goals)-, Kletz (n.d.b, 
1971,1977a, b, 1980a,b); Provinciate Waterstaat Groningen 
(1979); S.B. Gibson (1981); Lees (1980a); Lowe (1980); 
Rasbash (1980b, 1985); R.F. Griffiths (1981b—d); Petkar 
(1981); D.C. Cox and Baybutt (1982); Matthews (1982); 
Okrent and Baldewicz (1982); Hagon (1984); Holden (1984); 
Helsby and White (1985); Ministry of Housing (1985); 

R. Wilson and Crouch (1987); Directorate General for 
Environ. Prot. (1988-89); NSW Govt (1990); ACDS (1991); 
Cameron and Corran (1993) 

Fatal accident rate (FAR): Kletz (1971,1978a); B.J. Wilson 
and Myers (1979); A.F.C. Wallace (1980); Harrod (1981); 
Lees (1981b) 

Value of a life: Hayzelden (1968); Schelling (1968); FRS 
(1972 Fire Research Note 950,1973 Fire Research Note 978, 
982); Melinek (1974); Linnerooth (1975); Jones-Lee (1976, 
1982,1989); Mooney (1977); BRE (1978 CP52/78); Marin 
and Psacharoploulos (1982); Slovic et al. (1984); Jones-Lee, 
Hammerton and Philips (1985); Kletz (1985c); Moore and 
Viscusi (1988); A. Fisher, Chestnut and Violette (1989); 
Nawar and Salter (1993) 

USE criteria: D. A. Jones (1989); HSE (1988c, 1989c) 
Delayed fatalities: R.F Griffiths (1994a) 

Ring of igniters: Fallows (1982) 

Cost benefit analysis 

Jones-Lee (1969,1976,1982,1989); Marin and 
Psacharopoulos (1982); May (1982); Jones-Lee, Hammerton 
and Philips (1985); Fleishman andHogh (1989); Marin (1992) 


except perhaps for activities entered into voluntarily or in 
wartime. It also defines a lower bound below which risks 
may ‘legitimately be regarded as trivial by the decision- 
maker’. Between these two bounds there lies a region in 
which the risk needs to be assessed and all reasonably 
practicable steps taken to reduce it. This is referred to 
here as the ‘three-region approach’, as opposed to the point 
value, approach. 

The RSSG suggest that most people regard as insignifi¬ 
cant a risk of death below about 10 _6 /year. This therefore 
constitutes a lower bound. For the upper bound the RSSG 
state that few would dissent from the proposition that 
imposing a continuing risk of 10 _2 /year is unacceptable. 
The position is less clear with regard to a risk of 10“ 3 / 
year. For males only, those between 1 and 20 years of age 
have an annual risk of death markedly less than this. 
Therefore pre-existing levels of risk are more likely to 
cause death than a new imposed risk. The RSSG argue that 
an imposed risk of 10 _3 /year can therefore hardly be called 
totally unacceptable provided that the individual is 
aware of the situation. The RSSG finally take this value of 
10 -3 /year as the upper bound. The central region contained 
within these bounds is therefore that where the risk lies 
between 10“ 6 /year and 10 _3 /year. It is in this region that the 
concept of reducing risk ‘as far as reasonably practicable’ 
applies. As indicated, the upper bound of 10 _3 /year is evi¬ 
dently associated with situations in which there is a degree 
of voluntary acceptance. 


The risk criteria described are those that may be used by 
the decision-maker, particularly the central decision¬ 
maker in government. The categorization of a risk as 
insignificant does not necessarily imply that it will be 
perceived as such by those affected, but relates rather to the 
action that the decision-maker should require. 

9.21.2 Advisory Committee on Major Hazards 

In its First Report (Harvey, 1976), the ACMH made the 
statement 

If, for instance, such tentative conclusions indicated with 
reasonable confidence that in a particular plant a serious 
accident was unlikely to occur more often than once in 
10,000 years (or - to put it another way - a 1 in 10,000 
chance in one year), this might perhaps be regarded as 
just on the borderline of acceptability... 

Insofar as the committee was set up following the 
Flixborough disaster, in which 28 people were killed, itmay 
be assumed to have had in mind a similar accident, say one 
involving 30 fatalities. The above statement has been taken 
by a number of parties as a starting point for the develop¬ 
ment of criteria for societal risk. Otherwise, however, the 
ACMH proposed little by way of quantitative risk criteria. 
It did, however, in its Third Report (Harvey, 1984) state a 
number of principles, including the following: 

1 The risk from a major hazard to an individual 
employee or member of the public should not be sig¬ 
nificant when compared with other risks to which a 
person is exposed in everyday life. 

2 The risk from any major hazard should, whenever 
reasonably practicable, be reduced. 

3 Where there is a risk from a major hazard, additional 
hazardous development should not add significantly 
to the existing risk. 

4 If the possible harm from an incident is high, the risk 
that the incident might actually happen should be 
made very low indeed. 


9.21.3 HSE nuclear installations risk criteria 
The HSE have published two documents outlining their 
approach to the development of risk criteria. The first of 
these is The Tolerability of Risk from Nuclear Power Stations 
(HSE, 1988c). This document gives the following treatment 
of risk of death to workers and to members of the public. 
A distinction is made between risk from normal operation, 
due essentially to radiation dose, and risk from a nuclear 
accident. 

At nuclear installations the actual risk to workers from 
the average levels of radiation dose lies between about 
10 _4 /year and 2.5 x 10 _4 /year. A very small number of 
workers are exposed to a risk some ten times greater. The 
figure of 2.5 x 10 _4 /year happens to correspond to the risk 
to workers in heavy manufacturing and mineral extraction 
and that of 10~ 4 /year to the average for manufacturing 
industry. The HSE conclude that, broadly, the limit of tol¬ 
erable risk to a worker is 10 _4 /year. 

On the basis that the risk to a member of the public 
should be at least an order of magnitude lower than that to a 
worker, the limit of tolerable risk to a member of the public 
is taken as 10 _4 /year. The risk to a member of the public 
that might be regarded as acceptable, as opposed to toler¬ 
able, is then taken 10 _6 /year. This appears to be a level at 
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which in general a risk causes little concern. It happens to 
be approximately the risk of being electrocuted at home 
and one hundredth of the risk of dying in a traffic accident. 

The actual risk to a member of the public from normal 
operation of a nuclear installation is well below 10“ 5 /year 
and that from a nuclear accident at an installation designed 
to Nuclear Installation Inspectorate (Nil) principles is 
about 10 _6 /year. The risk to a member of the public from 
both causes is assessed as 10 _6 /year for most people in the 
vicinity of the installation, but for a small number it is 
about 10 _5 /year and for a very few it may exceed this. 

The document does not give a criterion for societal risk in 
terms of FN curves or the equivalent. Instead, it takes as a 
measure of societal risk three scenarios: (1) a limiting 
design basis accident, (2) an uncontrolled release and (3) an 
uncontrolled release large enough to produce doses of 
100 mSv within 3 km. It suggests that the limit of tolerable 
risk of a considerable uncontrolled release anywhere in the 
United Kingdom might be about 10 _4 /year. The assessed 
risk quoted for such a release is in fact 10 _6 /year. 


9.21.4 The ALARP principle 

The HSE nuclear risk document also deals with the ques¬ 
tion of reducing the risk to a level that is as low as reason¬ 
ably practicable (ALARP). The reduction of risk in 
accordance with the ALARP principle is a basic require¬ 
ment of the Health and Safety at Work etc. Act 1974. 

The ALARP principle is illustrated in Figure 9.35. There 
is some level, above which the risk is intolerable. Above this 
level, the risk cannot be justified on any grounds and must 


be reduced. There is another level below which the risk is 
negligible and no action is required, not even demonstra¬ 
tion that the ALARP principle has been applied. Between 
these two levels lies the region in which there is a require¬ 
ment to apply the ALARP principle. 


9.21.5 HSE land-use planning risk criteria 

The other HSE publication on risk criteria is Risk Criteria 
for Land-use Planning in the Vicinity of Major Industrial 
Hazards (HSE, 1989c). The risk criteria described in this 
document are strictly for land-use planning of new devel¬ 
opments around major hazard installations. They are not 
intended to be used for (1) siting of a new major hazard 
installation, (2) new activities on an existing site or (3) an 
existing major hazard installationandexistingdevelopment. 

As described in Chapter 4, the basic approach to land-use 
planning adopted by the HSE is to divide the area around a 
hazardous installation into three zones. In the top zone risk 
is a major factor, in the bottom zone it is treated as insig¬ 
nificant and in the middle zone it is a consideration and 
further assessment is indicated. 

The risk criteria given are largely determined by the use 
to which they are put in land-use planning and differ from 
the conventional criteria, which tend to be for risk of death. 
Instead the HSE have developed the concept of a ‘dangerous 
dose’. This dangerous dose is effectively an injurious load 
imposed by some physical phenomenon such as thermal 
radiation, explosion overpressure or toxic concentration. 
The dangerous dose is that which will result in the death 
of a small proportion of the exposed population. It is 



Figure 9.35 The ALARP principle (HSE, 1988c) (Courtesy of HM Stationery Office. Copyright All rights reserved) 
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assumed that the risk to a vulnerable person is an order of 
magnitude greater than that to the average person. 

For the exposed population as a whole, the HSE take as 
the upper bound for the risk of a dangerous dose or worse 
10 _5 /year and as the lower bound 10 _6 /year. This implies 
that these figures are also approximately the risk of death 
for vulnerable people. For the case where the exposed 
population contains a high proportion of vulnerable people 
the lower bound is taken instead as 0.33 x lCT 6 /year. The 
upper bound risk is about one-tenth of the risk of death in a 
road traffic accident. The lower bound risk is about ten 
times the risk of death from lightning. 

With regard to societal risk, the HSE rehearse the prob¬ 
lems of risk aversion and of FN curves. Instead they elect to 
use a'judgmental approach’, in which qualitative factors are 
more prominent. The starting point is the individual risk. 
The element of societal risk is taken into account by 
applying a harsher judgement to larger developments in the 
middle zone. These risk criteria are intended to be used in 
conjunction with a risk assessment based on the ‘cautious 
best estimate’ approach. 

The application of these criteria to various types of 
development, which is given in the document, is described 
in Chapter 4. 

9.21.6 Factors restricting choice of individual risk criteria 

A difficulty in the selection of risk criteria is that the choice 
of criteria is liable to appear arbitrary. The description just 
given of some systems of risk criteria hints at the fact that 
when account is taken of the various relevant factors, the 
scope for arbitrary choice is quite severely restricted. This 
aspect is now explored in more detail. 

Considering risk of death, the average risk to a worker in 
manufacturing industry is about 3 x 10 _s /year. On the 
assumption that a new plant should be three times safer 
than the current average, the risk criterion for a worker on 
a new plant might be taken as lCT 5 /year. 

It is reasonable to assume that the risk to a worker on a 
potentially affected plant other than the plant under con¬ 
sideration should be less than that to a worker on the latter, 
and an order of magnitude reduction is often used. On this 
assumption, the risk criterion for a worker on another plant 
would be 10“ 6 /year. 

Adopting the usual assumption that the risk to a member 
of the public should be less than that to a worker, the figure 
of 3 x 10“ 5 /year might also be taken as an upper bound for 
a member of the public. The risk of being killed by light¬ 
ning, which is l(T 7 /year, is often taken as one that causes 
little concern. On this basis, the lower bound for risk to a 
member of the public might be taken as 10 _6 /year. 

A further factor that needs to be taken into account is the 
risk from a complex of plants. It is assumed that where 
there is such a complex the risk is increased by a factor of 3. 

Then, taking into account (1) new vs existing plants and 
(2) single plants vs a complex of plants, the risks obtained 
for a member of the public are as follows: 


Single plant 

Complex 

New plant Existing plant 

Newplant Existing plant 

10 _6 /year 3 x 10 _6 /year 

10 _s /year 3 x 10 _5 /year 


The highest and lowest risks here correspond exactly to the 
upper and lower bounds given above. 


The foregoing account is given not primarily to suggest a 
further set of risk criteria, although the values given do not 
differ greatly from criteria often proposed, but rather to 
illustrate the fact that by the time account is taken of the 
relevant factors, the scope for arbitrary choice narrows 
appreciably. 

9.21.7 FN curve criteria of societal risk 

Given that a formal risk criterion is used at all for societal 
risk, the criterion most commonly used is the FN curve. 
The basic characteristics of FN curves were described in 
Section 9.19. The account given here is concerned with the 
parameters to be used in a risk criterion curve. 

Like other forms of risk criterion, the FN curve may be 
cast in the form of a single criterion curve or of two criteria 
curves dividing the space into three regions - where risk is 
unacceptable, where it is negligible and where it requires 
further assessment. The latter approach corresponds to 
application to societal risk of the ALARP principle and is 
much to be preferred. 

The characteristics of a FN relation are most easily 
appreciated by considering an FN line. The two defining 
parameters of such a line are the frequency of a single 
fatality accident, or intercept on the Faxis, and the slope 
of the line. A characterization of FN curves, whether for 
actual risks or as risk criteria, has been given by Hagon 
(1984). 

9.21.8 Farmer curve 

Before considering the more usual type of FN curve, it is 
appropriate to refer to the risk criterion curve given by 
F.R. Farmer (1967b), which pioneered this form of criterion. 
Figure 9.36 shows the Farmer curve. 

As explained in Section 9.19, the quantity plotted on the 
ordinate of this curve is accident intervals rather than 
accidents equal to or greater than the defined size. 

The argument supporting this criterion (as developed in 
1967) is roughly on the following lines. A release of a few 
thousand curies of 131 I constitutes an accident that could 
cause fatalities and would probably provoke public outcry. 
Programmes of reactor installation in several countries 



Figure 9.36 Accident scale- frequency criterion for 
nuclear power reactors (the Farmer curve) (after 
F.R. Farmer, 1967b) (Courtesy of the British Nuclear 
Energy Society) 
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will accumulate about 100 reactor-years operation before 
the turn of the century The risk of one such event during 
this period is probably the limit of acceptability. This 
therefore gives one point on the graph, at the frequency of 
10 -3 accidents per reactor year. The slope of the main 
part of the graph, for large accidents, is —1.5 (on the 
log-log plot). This slope implies that if the severity of an 
event increases by two orders of magnitude, its frequency 
decreases by three orders of magnitude. This represents a 
weighting to reduce the probability of large-scale accidents 
that may he expected to give rise to severe public reaction. 
The curve on the graph in the smaller accident region 
represents a reduction in the frequency of small incidents, 
since numerous small incidents are also likely to cause 
public concern. 

9.21.9 Criteria expressing risk aversion 

Reference has already been made to risk aversion in respect 
of societal risk. The Farmer curve just described is an early 
illustration of such risk aversion. As mentioned above, a 
measure of risk aversion is the parameter a defined in 
Equation 9.19.1.This quantity is known as the ‘risk aversion 
index’. Considering a FN line on a log-log plot, if the slope 
of the line is —x the risk aversion index a is 1 + x. A number 
of authors have discussed the appropriate value of this 
index, including Okrent (1981), D.C. Cox and Baybutt (1982) 
and Hagon (1984). 

It is argued by Okrent that it is unlikely that society 
demands a value of a > 1.5, that one of a = 2 is certainly 
excessive and that even one of a = 1.2 may not be of general 
applicability. On the other hand, as described below, Hagon 
has shown that at values of a of less than 2 the contribution 
of large accidents to the average risk tends to become rela¬ 
tively large, or even predominant. 

9.21.10 Groningen FN curve risk criterion 

An early societal risk criterion utilizing FN curves was that 
promulgated by the Provinciale Waterstaat Groningen 


(PWG, 1979), the ‘Groningen criterion’. The Groningen 
criterion is illustrated in Figure 9.37. There are three zones 
and two bounding curves. In one zone the risk is unac¬ 
ceptable, in one it is acceptable and in one further assess¬ 
ment is required. For accidents with, on average, more than 
one fatality (N > 1) the slope of the two bounding curves 
corresponds to a degree of risk aversion in which the con¬ 
sequence is raised to the power 2 (N 2 ). 

Some further characteristics of the Groningen criterion 
have been given by Hagon (1984), using his relations given 
in Section 9.19. For the upper curve over the range N= 1 to 
!V=1000 

Fi = 10“ 2 
Piooo = HP 8 

The risk aversion is therefore given by 

FN 2 = Constant 
a= 3 

Beyond N= 1000 the curve is vertical so that a = oo. For the 
lower curve over the range N =1 to N= 10 

F] = 10“ 6 
Flo = 10- 8 

with the same degree of risk aversion. Beyond N= 10, the 
curve is again vertical. 

9.21.11 Hagon FN curve risk criteria 

Hagon has used his FN curve relations to describe the 
characteristics of several well known FN curves. His treat¬ 
ment of the Groningen criterion has just been described. 
For those given in the Second Canvey Report, shown in 



Number of equivalent fatalities, N 


Figure 9.37 Groningen FN curve risk criterion (Hagon, 1984; after PWG, 1979) (Courtesy of the Institution of Chemical 
Engineers) 
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Figure 9.30 which gives a curve approximating to a straight 
line, for events up to N > 1000 he obtains: 

Fio = 10 _3 /year 
Fiooo = 2 x 10 _4 /year 
a = 1.35 

This is a low degree of risk aversion. 

For the ammonia storage sphere in the Rijnmond Report , 
the FN curves for which are shown in Figure 9.34, Hagon 
sets a bounding line characterized by Fi=l(T 3 /year and 
a=2. He then obtains: 

Ff = 2.2 x 10- 3 
F|q° = 2.2 x 1(T 5 

F 30 = 2.4 x 10“ 3 
F 3000 = 5.2 x 10“ 3 

This indicates that large accidents are a significant con¬ 
tributor to the average risk of death. 

Hagon takes as a prime determinant of the risk aversion 
index a the parameter F$f, which is the frequency of all 
accidents between one with N fatalities and one with the 
maximum number M of fatalities. Figure 9.23 shows that 
Fff increases only slowly with N, provided that a > 1.5. 

Hagon takes as another determinant of a the parameter 
F. From Figure 9.33 the increase of F with N is slow, pro¬ 
vided that a >2. 


With regard to the choice of Fjjf, Hagon takes as his 
starting point the Flixborough disaster, in which 28 men 
died. If there are assumed to be nationwide in the United 
Kingdom some 500 installations capable of giving an event 
such as Flixborough, and if such an event should occur no 
more often than once in 100 years, then for a single instal¬ 
lation: 

/•',!' m&m 1 -= 2 x Hf/year 

N 500x 100 /y 

The number of fatalities at Flixborough was 28. He takes 
the range of fatalities for a major hazard as 30-300, and 
thus sets F|q° = 2 x 10 _5 /year. He sets a = 2, and obtains 
for single fatality accidents and for total deaths due to the 
major hazard risk: 

Fi = 6.5 x 10 _4 /year 
F 300 = 4.1 x 10 _3 /year 

9.21.12 Dutch risk criteria 

Two more recent sets of risk criteria are the Dutch criteria 
and the Advisory Committee on Dangerous Substances 
(ACDS) FN curve. Provisional risk criteria according 
to Dutch law are quoted by Ale (1991). They are shown in 
Figure 9.38 


9.21.13 ACDS FN curve 

The ACDS Transport Hazards Report (1991) also gives 
a FN curve, shown in Figure 9.39. Arguments in 
support of the curve are given in detail in Appendix 6 of 
the report. 



Number of prompt fatalities, N 


Figure 9.38 Some risk criteria for the Netherlands (after Ale, 1991; Pasman, Duxbury and Bjordahl, 1992) (Courtesy of 
Elsevier Science Publishers) 
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Number of fatalities, N 


Figure 9.39 ACDS FN curve risk criterion (after Advisory Committee on Dangerous 


3, 1991) 


9.21.14 Need for criteria in hazard assessment 

In the method of hazard assessment described by Kletz 
(1971) he effectively recognizes four situations in respect of 
the probability of an event leading to a hazard: 

(1) The probability of the event is low. 

(2) The probability of the event can be made low by appli¬ 
cation of a standard or code of practice. 

(3) The probability of the event can be made low by the 
application of measures that can be shown by a simple 
risk analysis to be of equivalent safety to the normal 
standard or code of practice. 

(4) The probability of the event must be assessed quanti¬ 
tatively and must be reduced to conform to the risk 
criteria by measures indicated by the analysis. For a 
straightforward case use is make of a simple risk ana¬ 
lysis while for a more complex one it is necessary to 
resort to a more detailed method such as fault tree 
analysis. 

Risk criteria are needed mainly for the fourth case. The 
second and third cases are considered first. 

9.21.15 Standards and codes 

If the probability of the event that may lead to realization of 
the hazard is not intrinsically low, nevertheless it may often 
be reduced to a low level by the use of an appropriate stand¬ 
ard or code of practice. 

An example given by Kletz is that there is some probability 
of overpressure in a pressure vessel, but the use of pressure 
relief valves as specified in standards and codes for pressure 


vessels reduces this probability to a low level. Another 
example is that electrical equipment has some probability of 
acting as a source of ignition, but the application of codes 
for hazardous area classification and equipment safe¬ 
guarding results in a low value of this probability. 

The main caveat to be made here is that where major 
hazards are concerned it should not be assumed that the 
use of the standards and codes is sufficient. 

9.21.16 Equivalent risk 

It is sometimes not appropriate, or even possible, to use a 
standard or code. In this case it may be possible to devise an 
alternative method that can be shown to have a degree of 
safety at least equivalent to the standard or code. A simple 
risk analysis is carried out to demonstrate this. The analy¬ 
sis by Kletz (1974a) of the use of trips instead of pressure 
relief valves described in Chapter 13 is a case in point. 

9.21.17 Individual and average risk 

Before considering the evaluation of the more complex 
analyses mentioned using suitable risk criteria, there are 
some further preliminary points to be made. 

In considering risk, it is necessary to distinguish 
between the average risk run by a group of people, whether 
employees or public, and the higher risk that may be run by 
some individuals within the group. Thus some employees 
may be exposed to a higher risk because the plant on which 
they work is more hazardous and some members of the 
public may be exposed to a higher risk because they live 
nearer the works. There is fairly general agreement that 
there should be a limit to the risk run by any individual. 
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Thus it is not sufficient to achieve a low average risk; it is 
necessary also to reduce to a minimal level the risk to the 
most exposed individual. In other words the risk to that 
person should not be ‘lost’ by combining it with the risk to a 
larger group most of whom are much less exposed. 

9.21.18 Death and injury 

Most treatments of risk deal primarily with the risk of 
death. This may appear somewhat arbitrary, but there 
is justification for this approach. Data on fatalities are 
recorded and are relatively straightforward. For other 
levels of injury, however, there can be problems. Often the 
data are not available, but even if they are, there tend to be 
difficulties in interpreting them. Moreover, for any given 
activity in industry there tends to be a relationship 
between fatalities and other injuries. The work of Heinrich 
(1959) on this ratio has been described in Chapter 1. 

Measures that reduce deaths from a particular hazard 
tend to reduce injuries in proportion and it is this reduction 
that is important. The use of death rate as the main prac¬ 
tical criterion does not therefore imply any disregard of the 
personal tragedy arising from serious injury. 

Several indices of industrial injury risk are used in the 
literature. The lost time accident rate is expressed as the 
number of accidents per 10 5 exposed hours; this period 
corresponds approximately to a working lifetime. Fatal 
accidents are much less frequent and in order to avoid 
inconveniently small numbers the FAR is defined as the 
number of deaths per 10 8 exposed hours; this roughly cor¬ 
responds to the number of deaths over a working lifetime of 
1000 persons. Another index that is useful in relation to 
general fatality risks is the death rate per annum. 

It should be recognized, however, that the use of fatality 
risk is not universally accepted as the most appropriate 
approach, and there is considerable literature on the subject. 
Some hazards are particularly likely to give rise to delayed, as 
opposed to prompt, deaths or to serious injury. A release of 
radioactivity from a nuclear reactor may have the potential 
to cause many deaths that are predominantly delayed. 

9.21.19 Engineering feasibility 

There is obviously a limit to the degree of plant reliability 
that can be achieved even by the best engineering practice 
and, equally important, to the degree of confidence that can 
be placed in estimates of that reliability. 

A figure frequently quoted for the reliability to which 
plants can be engineered is a hazard rate for a major acci¬ 
dent of 1CT 5 events/year. This is the figure given by 
J.H. Bowen (1976) from a nuclear industry perspective. The 
reason that it is difficult to achieve lower hazard rates is 
that at this level the risk begins to be affected by rather 
improbable failures and by dependent failures. 

In this respect, a distinction may be made between a risk 
which is assessed as 10 _5 /year as a single figure and a one 
which is also assessed as 10~ 5 /year but as the product of two 
separate risks of 10 _2 /year and 10 _3 /year; insofar as the 
two latter values represent figures that are known to be 
achievable in engineering terms, the second of the two risks 
of 10 _5 /year maybe considered to be a more robust estimate. 

9.21.20 Value of a life 

One criterion for evaluating measures available to reduce 
risk is the value of a life. A general discussion of this 
concept, and its difficulties, has been given in Chapter 4. 


The account here is confined to an overview of the principal 
approaches and of the values that emerge from them. 

The cost of accidents and the cost-effectiveness of safety 
measures were major concerns of the Robens Committee 
(Robens, 1972). The Robens Report itself attempted to assess 
the cost of industrial accidents to the nation. The committee 
also supported work by Sinclair, Marstrand and Newick 
(1972a,b) on the cost-effectiveness of approaches to indus¬ 
trial safety. The problem is an important one and there is a 
large literature on the subject (e.g. National Academy of 
Engineering, 1972). 

Some of the methods that can be used to estimate the 
value of a life have been reviewed by Melinek (1974 BRE 
CP88/74) and Kletz (1976d). The following account is based 
on their work and the figures quoted from it are taken 
unchanged and reflect the value of money at that time. 
The methods that they describe may be summarized as 
(1) future production, (2) administrative decisions, (3) con¬ 
sumer preference, (4) court awards and (5) life assurance. 

Thus one method of assessing the value of a life is to 
calculate the future production or services which an indi¬ 
vidual may be expected to give to the community. Avariant 
of this is to estimate future earnings, although these are not 
synonymous with the value of the work done. Most esti¬ 
mates of the value of future production lie in the range 
£10,000-£100,000. The Road Research Laboratory has 
given an estimate of £15,000 (R.F.F. Dawson, 1967). 

There are many administrative decisions made by 
government that effectively set a particular value on life. 
Mellinek quotes: 

Worker safety £15,000-£20 million 

Consumer safety £0-£20 million 

Medical care up to £20,000 

Similarly Kletz quotes: 

Agriculture £2000 

Steel handling £200,000 

Pharmaceuticals £5 million 

The value set in medical work seems to be particularly low. 
Leach (1972) has shown that lives can be saved for very 
small expenditures: 

Lung X-ray machines for older smokers £400 

Cervical cancer screening £1400 

Artificial kidney £9500 

Another approach is based on consideration of consumer 
preference. The following illustration is given by Melinek 
for the implicit valuation put on his own life by a pedestrian 
who crosses the road on the surface instead of using the 
safer subway: 

Probability of being killed 
crossing a road 
Extra time taken by using 
subway 

Value which people put on 
own time 

Value of a life 


~ £0.25/h 
0.25 x0.004 
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The value that people put on their own time is taken from 
transport studies. The value of a life as obtained from more 
extensive studies by the FRS is, as described by Melinek, 
about £50,000. 

The damages which courts award for death or injury 
often include a sum for the reduction of life expectancy and 
are thus another means of estimating the value of a life. It 
has also been suggested that the value of a life may be 
determined from the sums covered by life assurance. 

There are quite serious objections to some of these 
approaches. In the case of the valuation of life in terms of 
the value of the person’s future production, the reductio ad 
absurdam is that this criterion puts a zero value on the life 
of a retired person. Society, however, is prepared to pay to 
preserve that life. Consumer preference seeks an objective 
basis in what people actually do, but hardly appears to 
reflect the way they actually think. Court awards set a 
notoriously low value on life expectancy and are thus a poor 
guide. Life assurance is taken out to protect dependants or 
as an investment and is not intended to compensate for 
death.The values implied in administrative decisions show 
a very wide spread and again are far from satisfactory as a 
guide. 

A rather different, and more relevant, approach is 
described by Kletz (1976d). This is to consider the cost of 
achieving the risk target that he uses for process plants. 
He estimates this cost as equivalent to about £1 million per 
life and suggests that in general this is a reasonable 
figure to take as the value of a life. A valuation less than 
£100,000 would hardly be acceptable, while one more than 
£10 million would seem extravagant. 

The value of a life criterion is applied as follows: 


Rock climbing b 4 x 10 5 

Car driving 0 17 x 10“ 5 

Smoking (20 cigarettes/day) b 500 x 10 -6 

Involuntary risk 

Meteorite d 6 x 10 -11 

Transport of petrol and 0.2 x 10 -7 

chemicals (UK) 

Aircraft crash (UK) a 0.2 x 10~ 7 

Explosion of pressure 0.5 x 10 -7 

vessel (USA) d 

Lightning (UK) e 1 x 10 -7 


Fatality rate 
(deaths/person-year) 

Flooding of dikes (The 

1 x 10“ 7 

Netherlands) 7 


Release from nuclear power 

1 x 10“ 7 

station (at 1 km) (UK) 


Fire g 

150 x 10“ 7 

Run over by vehicle (UK) 

600 x 10“ 7 

Leukaemia 3 

800 x 10“ 7 


a S.B. Gibson (1976c); b Pochin (1975); c Roach (1970); d Wall (1976); 
e Bulloch (1974); f Turkenburg (1974); * Melinek (1974 BRE CP 88/74). 


The validity of such comparisons has been discussed in 
Chapter 4. 

9.21.22 Computation of risk 

The risk of an individual may be formulated in simple 
terms as: 


[9.21.1] 




[9.21.2] 


where c is the annual cost of eliminating the hazard 
(£/year), h is the hazard rate (deaths/year) and v is the value 
of a life (£/death avoided). Thus, for example, if in a given 
case a particular hazard is assessed as presenting a hazard 
rate of 10~ 4 deaths/year, if the value of a life is taken as 
£1 million and if £1 million capital expenditure is equiva¬ 
lent to £200,000/year recurrent expenditure, then the 
application of the criterion indicates that it is appropriate to 
spend up to £20/year to eliminate the hazard. 

9.21.21 Comparisons of process and other risks 

Whereas the risk to which a member of the public is 
exposed from a hazardous installation is an involuntary 
one, it is generally considered that to some degree at least, 
an employee accepts voluntarily the risk associated with 
work on the plant. 

Writers on hazard analysis such as Kletz (1971) and 
S.B. Gibson (1976a) have compared the risks to employees 
on process plant with other risks accepted voluntarily or 
borne involuntarily. Following Kletz (1976d) some data on 
voluntary and involuntary risk are 


Fatality rate 
(deaths / person-year) 

Voluntary risk 

Taking a contraceptive pill 3 2 x 10 -5 

Playing football b 4 x 10 _s 


where f t is the frequency of accident type i, r is the indivi¬ 
dual risk of death, is the number of deaths for accident 
type i, n is the number of types of accidents and A the total 
number of persons at risk. 

The calculation is concerned with the risk to the indi¬ 
vidual. All accidents that might have a significant effect on 
this individual risk should be taken into account. The 
estimate should not be distorted by inclusion of numbers of 
people who have a significantly lower exposure. 

Often the relationship for individual risk is more com¬ 
plex than Equation 9.21.2. The ACDS Transport Hazards 
Report (1991) contains a number of examples of the more 
complex formulations necessary in certain cases. 

9.21.23 Application of risk criteria 

The foregoing treatment has outlined some approaches 
to the setting of individual and societal risk criteria. 
An account is now given of some of the practicalities of 
engineering design utilizing these and other criteria. 

The treatment for risk to employees essentially follows 
the systems developed by Kletz (1971) and S.B. Gibson 
(1976a). Their approach is based on the use of hazard ana¬ 
lysis and of the FAR criterion, as described in Section 9.2. 
For, say, an overall FAR of 3.5 the target value for a given 
plant hazard is 0.35, or one-tenth of the overall value. If 
some particular jobs on a process are more subject to this 
hazard than others, then the FAR is applied to the more 
hazardous ones; it is not averaged over all the jobs. Thus 
no one is exposed to a risk higher than the target value. 
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This primary criterion of maximum risk must normally be 
met and any expenditure required to meet it must be 
incurred. 

It is not necessarily enough, however, to meet the FAR 
criterion. It still remains to determine whether all that is 
‘reasonably practicable’ has been done to ensure safety. For 
this, use is made as a secondary criterion of the concept of 
the value of a life. The value of a life criterion is applied to 
evaluate additional expenditure aimed at eliminating 
hazards and reducing risk. 

Various figures have been given for the value of a life for 
use in this context. As described in Section 9.21.20, the 
value suggested for the chemical industry by Kletz when 
he wrote in the mid-1970s was £1 million. Publications in 
the recent past, say 1990, have quoted for a wider range of 
activities a value of about £3 million. 

This approach represents the practical application of the 
ALARP principle. 

9.21.24 Safety improvement 

It is often suggested that it would be unfortunate if the 
adoption of particular risk criteria was to lead to the situa¬ 
tion where there ceased to be any improvement in safety 
standards. In fact the system described, based on the FAR, 
does tend towards a continuous improvement in safety 
standards provided the system is universally applied, 
that factors other than the plant design, particularly the 
standard of management, do not deteriorate and that the 
target FAR used is the moving average for the industry. For, 
while it is then not accepted that any plant have an FAR 
worse than the current average, some will have one which is 
better, so that the average will gradually improve. More¬ 
over, the use of the value of a life as a secondary criterion 
injects a further degree of improvement. There is therefore 
a ratchet effect that tends to raise standards. 

9.21.25 Allocation of resources 

The problem of expenditure on safety measures is one of 
allocation of resources and of cost-effectiveness. As 
already indicated, the administrative decisions made by 
government and industry imply a wide range of valuations 
of human life. 

Some of the examples quoted do at least prompt the 
question whether the chemical industry perhaps spends 
too much on safety. This may be so, but the hazards of the 
chemical industry tend to provoke a strong reaction and it 
is doubtful if much relaxation would be tolerated. This is 
doubly so following disasters such as that at Bhopal. 

Moreover, it is probably of value to the community as a 
whole to have an industry that despite the high intrinsic 
hazards of its materials and processes is able to pioneer 
methods of improving control of hazards and to achieve 
high levels of safety. 

Nevertheless, the allocation of resources to safety is a 
legitimate subject for public debate. The chemical industry 
can only try to respond responsibly to this. 


9.22 Guide Assessments 

The arrangements for the control of major hazards in the 
United Kingdom were described in Chapter 4. It was men¬ 
tioned there that in order to give advice to local planning 
authorities the HSE has developed assessment methods for 
LPG and for chlorine installations. 


An outline approach to assessment for emergency 
planning for a chlorine release has been given by the UK 
Chlorine Producers under the auspices of the CIA.The CIA 
has also issued a Control of Industrial Major Accident 
Hazards (CIMAH) guide for ammonia. Other CIMAH 
guides include those on LPG by the Liquefied Petroleum 
Gas Industry Technical Association (LPGITA), on liquid 
oxygen by the British Compressed Gases Association 
(BCGA) and on ammonium nitrate by the Fertilizer Manu¬ 
facturers Association (FMA). These guide assessments are 
now described in turn. Some of the features mentioned 
draw on material described in Chapters 15-18. 

9.22.1 HSE LPG methodology 

The HSE methodology for the hazard assessment of LPG 
has been described by Crossthwaite (1984, 1986) and its 
further development has been described by Clay et al. 
(1988). It is embodied in the program RISKAT. The assess¬ 
ment has been carried out as part of the work done by HSE 
on their advice to local planning authorities on consultation 
distances. The overall approach taken is that described in 
the Third Report of the ACMH that states: 

It seems reasonable to aim for a separation which gives 
almost complete protection for lesser but more probable 
accidents and worthwhile protection for major but less 
probable accidents. 

In applying this principle the HSE has judged that 
releases due to pipework failure fall in the first category 
and fireballs and vapour cloud explosions (VCEs) fall in 
the second. 

The events considered by Crossthwaite (1984) are 
shown in Table 9.37. For thermal radiation from a fireball, 
the effects of different levels of received radiation are 
taken to be: 

kj/m 2 

50% fatalities 700 

Blistering of exposed skin 200 

Blistering of skin (threshold) 100 

and of explosion overpressure: 

psi 

5% fatalities 5 

Injury due to flying glass 1 

Injury but very unlikely to be serious 0.7 

The distances at which and the areas over which these 
levels of effect are estimated to occur for the more serious 
accidents such as a release of 100 te of LPG are shown in 
Table 9.38. 

The guidelines on consultation distances issued by the 
HSE on the basis of such assessments are described in 
Chapter 4. 

9.22.2 HSE chlorine methodology 

The HSE methodology for the hazard assessment of 
chlorine has been described by Pape and Nussey (1985). 
It is embodied in the program Risk Assessment Tool 
(RAT), now RISKAT. The type of installation considered 
is shown in Figure 9.40. The listing of hazard scenarios 
given is shown in Table 9.39. These releases were developed 
as shown in Figure 9.41 and the consequences analysed as 
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Table 9.37 HSE guide assessment on LPG installations: hazardous events (after Crossthwaite, 1984) 


Event 

Consequences 

Likelihood 

Small flange leak 

Local effects only. No off-site hazard 

Considerable number each year 

Severe pipe leak 
(guillotine rupture) 

If ignition occurs on site, then off-site 
consequences unlikely to be serious. 

If ignition occurs off site, a flash fire 
would injure persons in and near the cloud 

Average of about 1/year in UK 

BLEVE 

High levels of thermal radiation at substantial 
distances from point of release 

Two incidents known to have occurred in UK 

Vessel rupture 

Flash fire: persons within the 
(quasi-instantaneous) cloud likely to be killed. 
Explosion: this will have serious effects at 
substantial distances from release 

No history in UK 


Table 9.38 HSE guide assessment on LPG installations: 
physical effects from a 100 te release of propane (after 
Crossthwaite, 1984) 


A Fireball from a 

BLEVE 


Thermal 


Distance from 

Area of land 

radiation 


installation 

(hectacres) 

(kj/m 2 ) 


(m) 


(Fireball radius) 


107 

3.6 

700 


200 

12.6 

200 


380 

45 

100 


530 

88 

B Explosion of a 

vapour cloud 


Overpressure 

Distance from installation 

Area of land 

(psi) 

(m) 


(hectacres) 

5 

176 


9.7 

1 

513 


83 

0.7 

675 


143 

shown in Figure 9.42. Some of the principal assumptions 

used in the analysis a 

re given in Table 9.40. 



The hazard scenarios to be considered were simplified 
by reducing the pipe failures to two cases: guillotine frac¬ 
ture with both ends open, and a split equivalent to a hole of 
half the pipe size. Each release was expressed as a vapour 
flow rate. It was assumed that small releases from pipes 
would vaporize completely. The justification for this was 
that for unbunded releases the SPILL computer code for 
vaporization predicts that the vaporization rate quickly 
reaches the release rate. 

For convenience, large instantaneous releases were 
treated as pseudo-continuous. A rule of thumb was used that 
a release over 10 te is equivalent to a continuous release of 
1.5 times the actual release with a duration of 10 min, and that 
smaller releases have an effective duration of 5 min. The 
heavy gas dispersion was modelled using the CRUNCH com¬ 
puter code for dispersion of a continuous release of heavy gas. 

The results for the base case studied are shown in 
Table 9.41. They show that very close to the plant the prin¬ 
cipal risks are from gasket failures, pipe splits, coupling/ 
hose failures and releases from the vaporizer unit. At 200 m, 
it is the last three that are the main risks, while at 300 m and 


beyond the risk of major vessel failures becomes dominant, 
with a contribution from uncontrolled gasket failures and 
pipe splits. A large proportion of the risk beyond 200 m 
occurs with Pasquill category F weather. 

The assessment includes a sensitivity analysis on the 
following features: 

(1) plant size; 

(2) vessel failure rate; 

(3) gasket size; 

(4) proportion of time outdoors; 

(5) ventilation rate; 

(6) evacuation time; 

(7) gas toxicity. 

A plant larger than the base case was studied. The 
increase in risk was roughly proportional to the change in 
the numbers of components. A 10-fold increase in the vessel 
failure rate had a strong effect on the risks in the far field, 
doubling the range of the 10 _7 /year risk. The effect of 
reducing gasket thickness was to cut release rates by a 
factor of 4 and to reduce risks at short ranges. The propor¬ 
tion of time spent outdoors was varied from 0 to 100 %. Zero 
time outdoors gave results little different from the base 
case, while 100% time outdoors increased the risk by 
a factor of 2 at intermediate distances. Ventilation rate 
increases by factors of 4 in weather category D and 2 in 
category Fresulted in risks at intermediate distances which 
were 2 or 3 times the base case, while decreases of the rate to 
0.5 in D/2.4 weather and a halving of the rate in F weather 
gave reductions in the risk of up to 4 at intermediate dis¬ 
tances. The effect of increasing to 60 min the time taken to 
evacuate the building after passage of the cloud was to 
increase the risk at intermediate distances by a factor of 
about 2.5. For gas toxicity several relations were investi¬ 
gated. The use of a toxicity estimate by ten Berge and van 
Heemst instead of the Dicken value had a dramatic effect on 
risks, reducing the range of the 10 _7 /year risk from 750 to 
300 m. In addition to the results given in Table 9.41 the 
results were also presented in the form of risk contours on 
a typical site plan and of a FN curve. 

9.22.3 UKCP chlorine emergency planning guidelines 

Guidelines for chlorine emergency planning are given in 
General Guidance on Emergency Planning with the CIMAH 
Regulations for Chlorine Installations by the UK Chlorine 
Producers (UKCP) (CIA, 1986) (the UKCP Chlorine Guide); 
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Figure 9.40 HSE guide assessment on chlorine installations: typical installation (after Pape and Nussey, 1985) 
(Courtesy of the Institution of Chemical Engineers) 


an extract (CIA, 1989) is given in Lees and Ang (1989b). 
Although the guidelines are intended primarily for emer¬ 
gency planning, it is explicitly stated that the methods 
given may also be helpful in producing a safety case. 

The type of installation considered isshown in Figure 9.43. 
Typical equipment and inventories at the installation and 
the process activities are shown in Table 9.42, Sections A 
and B, respectively. The steps in the hazard assessment are 
given in Section C of the table. A list of typical incidents to 
assist in hazard identification is given in Section D. The 
summary of possible incidents given in the guide and the 
interpretation of the terminology are given in Table 9.43, 
Sections A and B, respectively. 

The guide gives, in addition, methods of estimating the 
emission rate andgas dispersion, using for the latter overlays 
that canbe placed on a map of the site, and data on gas toxicity 


9.22.4 CIA ammonia CIMAH guidelines 

The CIMAH Safety Case: Ammonia by the CIA (1988 PA9) 
(the CIA Ammonia Guide) gives guidance for that sub¬ 
stance. The main body of the CIA Ammonia Guide is largely 
concerned with the safety report itself. It says relatively 
little about the frequency of events, but it gives in Chapter 5 
a set of release scenarios for different storage conditions 
and some guide to toxic concentration estimates. 

The guide contains a detailed table (15 pages) of causes 
of release. It gives five main release scenarios as follows: 
Scenario 1, release of liquid from a hole in pressurized 
storage; Scenario 2, release of liquid from a hole in refri¬ 
gerated storage; Scenario 3, release of vapour from a relief 
valve; Scenario 4, failure of a refrigerated bunded storage 
tank; and Scenario 5, a spill of refrigerated liquid ammonia 
onto water. For the first two continuous releases, two flows 
(10 and 40 kg/s) are considered, and for the relief valve a 
flow of 6 kg/s is considered. In the fourth scenario, two 
subscenarios are considered: (1) a failure near the top of the 
tank and (2) a failure near the bottom; in the latter case a 
flash evaporation of 5 te is estimated. In the fifth scenario 


the evaporation rate is taken as 50 kg/s during the 2 min of 
the spill. Results are given without and with allowance for 
plume rise. The guide gives estimates of the ground level 
concentration of ammonia for the five scenarios, including 
the results given here in Table 9.44. 

9.22.5 LPGITA LPG CIMAH guidelines 

Guidance for LPG is given in A guide to the writing of LPG 
safety reports by the LPGITA (1988 GN1) (the LPGITA LPG 
Guide). 

The LPGITA LPG Guide deals in the main body largely 
with the safety report. It has relatively little on the fre¬ 
quency of events, but it gives in Appendix 2, a set of graphs 
based on simplified hazard models for propane, butane 
and LPG. 

These models appear broadly similar to those given in 
the Second Convey Report and by Considine and Grint 
(1985) and the graphs are similar in form to those given by 
Grint (1989). The graphical correlations cover gas flow and 
two-phase flow from holes, distance to the LFL, mass of gas 
in cloud formed, distance to given levels of thermal radia¬ 
tion from a fireball, length of a jet flame and distance to 
given levels of thermal radiation from such a flame and 
distance to given overpressures from a vapour cloud 
explosion. There are also tables listing the injury effects at 
these levels of thermal radiation and overpressure. 

9.22.6 BCGA liquid oxygen CIMAH guidelines 

A method for estimating the Offsite Risks from Bulk Storage 
of Liquid Oxygen ( LOX ), by the British Compressed Gases 
Association (BCGA, 1984) (the BCGA Guide), gives guid¬ 
ance for that substance. The hazard of liquid oxygen is 
quite different from that for conventional flammables or 
toxics. Essentially it is the hazard due to enhancement of 
flammability in an oxygen-enriched atmosphere. This 
effect is discussed in Chapter 16. 

The BGCA Guide deals with (1) the consequences of 
oxygen enrichment, (2) the chance of being injured, (3) the 
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Table 9.39 HSE guide assessment on 

chlorine installations: hazard scenariosf (after Pape and Nussey, 1985) 

(Courtesy of the Institution of Chemical Engineers) 




Item 

Event' 

Release 

Duration d 

Frequency 

Comments 



(kg/s) 

(min) 

(failures x 10 b /year) 

Storage vessels; 

Burst 

50° 

10 

1 

Over bund, 

only 1 live at once; 
typical stock 20 te 





pseudo-plume 


Burst 

25 c 

10 

1 

Into bund, 
pseudo-plume 


50 mm hole, L 

25 c 

10 

1.6 

Pseudo-plume 


50 mm hole, G 

6.4 

20 

2.4 

2 x flash 


25 mm hole, L 

19 

8.8 

3.2 



25 mm hole, G 

1.6 

30 

4.8 

2 x flash 


13 mm hole, L 

5 

30 

4 



13 mm hole, G 

0.25 

30 

6 



6 mm hole, L 

1.3 

30 

16 



6 mm hole, G 

0.06 

30 

24 


Tanker vessels 

Neglect: only on 

site 2 % of time, so probability of failure on i 

site much less than for static tanks 

Other vessels 





None on site 

Pipelines, guillotine 

AIL (10 m) 

1 

5(C) 

0.6 

Tanker EFVC h works, 

fractures 


9 

20 

0.006 

live 2% of time 

Tanker EFVC fails, 
failure 10 x BlL/m e 


B1L (40 m) 

4 

5(C) 

12 b 

Normally live, limited 






to 4 kg/s by orifice plate 



4 

20 

0.12 > 



C1G (20 m) 

1 

20 

6 J 

Normally live 


DIG (20 m) 

1.25 

20 

0.3 

Live as AlL f 


E1G 

1.25 

20 

0.15 

Live 0.1%; 10 x failure rate 

Pipe splits 

AIL 

5 

20 

6 

EFVC on tanker not 
actuated 


B1L 

4 

5(C) 

120 



C1G 

0.25 

20 

60 



DIG 

0.25 

20 

3 



E1G 

0.25 

20 

1.5 


Gaskets, equivalent 9 

AIL 

2.4 

20 

17 

17 joints, live 2% of time, 
failure 10 x normal rate 

diameter holes, 3 mm 
thick, 






1 of circumference 

B1L 

2 

5(C) 

220 > 

47 joints (3 below RSOV 





J 

so ‘uncontrollable’) 



2 

20 (U) 

15 



C1G 

0.13 

20 

60 

12 joints 


DIG 

0.13 

20 

9 

9 joints, live as AIL 


E1G 

0.13 

20 

1.3 

26 joints 

Transfer coupling/ 
hose 

FC1 

1 

5(C) 

150 

50 operations® 



9 

20 

1.5 

EFVC fails 


FC2 

1.25 

20 

150 

50 operations® 

Other vaporizer 

Failure leads to 
liquid from 

4 

5(C) 

100 



B1L 

4 

20(U) 

1 



s, due account is taken of the possibilities for forward and back flow, and the differences between normally live and 


a In deducing source te: 

b L, liquid; G, gas. 
c Equivalent continuous release. 

d C, controlled by remotely operated shut-off valve (RSOV); U, RSOV fails or absent. 

e Pipe used intermittently. Failure rate assumed to be lOx that of normal pipeline, then multiplied by fractional us 
f Pipe live when AIL is live. 
g 50 operations per annum. 
h EFVC, excess flow valve cut off. 
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dispersion of oxygen vapour and (4) the probability of the 
failure event and gives (5) examples of release and their range 
of hazard. It contains appendices on (1) the effect of oxygen 
enrichment on the burning characteristics of cloth materials, 
(2) the potential for low temperature and wind chill to cause 


injury, (3) the factors affecting the number of casualties, 

(4) the principles for validation of storage tank design and 

(5) release rate calculations and dispersion estimates. 

The Guide treats three representative scenarios: (1) rel¬ 
ease of liquid from a hole in a 2 in. pipe, (2) release of liquid 



Figure 9.41 HSE guide assessment on chlorine installations: releases (after Pape and Nussey, 1985) (Courtesy of the 
Institution of Chemical Engineers) 


Release case {concentration, duration) 


Weather category, windspeed 


D/6.7 

I 


— Wind direction 


I-Dependence via ACH r, 


Initially indoors 

•Fatal' Safe 


Initially outdoors 


I-^ 

'Fatal' Escape 

outdoors indoors 


i n 

-'Fatal' inooors Safe indoors 


Figure 9.42 HSE guide assessment on chlorine installations: consequences of release (after Pape and Nussey, 1985) 
(Courtesy of the Institution of Chemical Engineers) 























HAZARD ASSESSMENT 9/97 


Table 9.40 HSE guide assessment on chlorine 
installations: key assumptions (after Pape and Nussey, 
1985) (Courtesy of the Institution of Chemical Engineers) 

A Failure frequency 3 

Vessels b 

Frequency of near instantaneous release of whole 
contents = 2 x 10 _6 /year 


Frequency lesser releases = 6 x 10 5 /year partitioned 
follows: 


Equivalent hole diameter (mm) 

Frequency 

50 

4 x 10 _6 /year 

25 

8 

13 

10 

6 

40 


and 


Gas space 60%, liquid space 40% 

Pipework 

Frequency of guillotine fracture on 25 mm pipework^, 

0.3 x 10 -6 years 

Frequency of lesser releases (equivalent to 13 mm hole) = 
0.3 x 10 -5 years 

Gaskets 6 

Frequency of failure for 0.6 mm thick gaskets = 3 x 10 _6 /year 
Frequency of failure for 3 mm thick gaskets = 5 x 10 _6 /year 

Tankers 

Probability of failure of coupling/hose = 3 x 10 _6 /operation 
Probability of failure of excess flow valve = 0.01/demand 
Frequency of failure of tanker vessels same as vessels given 
above, but with allowance made for time on site 


B Release duration 


Vessels 

For lesser releases duration is 30 min or time taken to 
release all the contents, whichever is less d 

Pipework 

For automatic shut-off duration 6 = 1 min 
For remote manual shut-off duration 6 = 5 min 
For local manual shut-off duration = 20 min 


C Release rate 


Vessels 

For vessel bursts over bund, 100% of release vaporizes 
For vessel bursts directed into bund, 50% vaporizes 

Pipeline 

For pipeline release, 100% vaporizes 
For two-phase flashing flow from pipeline guillotine 
fracture in a 25 mm internal diameter pipe with flow driven 
by chlorine vapour pressure, flow rate = 4 kg/s 
For single-phase liquid flow from tanker coupling 
failure in 25 mm pipe driven by padding pressure, flow 
rate = 9 kg/s 

For single-phase liquid flow from pipework in 13 mm hole 
in pipe, flow rate = 4 kg/s 

D Release dilution 


For releases from pressurized containment initial release is 
diluted by a factor of 10 


E Weather conditions 

Pasquill category! wind speed (m/s) 

Probability 

D/2.4 

0.30 

D/4.3 

0.24 

D/6.7 

0.29 

F/2.4 

0.17 

F Gas dispersion 


Gas dispersion calculated using CRUNCH heavy gas 
dispersion model. Concentrations within the plume 
predicted by this model are assumed to be Gaussian, 
concentrations outside the plume are not considered. 
During the time of passage of the plume, the concentration 
at a particular location is assumed to be uniform for the 
duration of the release 


G Modification of exposure 


Probability of being initially outdoors = 0.1 Pasquill D 
V 0.01 F 

For person initially outdoors, probability of escape indoors 
after receiving significant dose: 


Concentration outdoors (ppm) Probability of escape indoors 


>1000 0 

570-1000 0.2 

140-570 0.8 

<140 1 


Evacuation occurs 30 min after arrival of cloud, or later if 
cloud persists more than 30 min 


H Effect of shelter 


Concentrations indoors calculated using a single 
exponential stage model with following values for the 
product of the ventilation rate constant A and the mixing 
efficiency factor k f : 


Pasquill category!wind speed (m/s) £A(h *) 


D/2.4 0.7 

D/4.3 1.0 

D/6.7 1.5 

F/2.4 0.5 


I Gas toxicity 

Significant exposure is C 167 t> 20,000, equivalent to the 
Dicken‘fata! dose 

Threshold of significant dose is 140 ppm for 5 min 


a Failure rates arebased on aggregated data from various sources modi¬ 
fied by judgement. Rates used are for sudden failures, that is leaks which 
can develop into major failures before preventive action can be taken. 
b Vessel failure includes events up to and including the first flange on 
any nozzle or penetration. 

c Gasket failure means loss of one section between two adjacent bolts. 
It should be checked whether the gasket internal diameter equals that 
of the pipeline. Actual frequency may depend on inspection and 
replacement practices. 

d For leaks in gas space, the available contents for 50 and 25 mm holes 
are 2 x the flash fraction and, for smaller holes, the flash fraction. 
e Fractional dead time of automatic or remote shut-off is 0.01. Such a 
failure places a demand on the manual shut-off leading to a release 
duration of 20 min. 

f These values are based on data modified by judgement and make 
some allowance for the possibility of a few windows being open. 
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Table 9.41 HSE guide assessment on 
Institution of Chemical Engineers) 

chlorine installations: risks (after Pape and Nussey, 1985) (Courtery of the 

Rate 

(kg/s) 

Duration 

(min) 

Frequency 

(xl0 6 /year) 

Distance (m) 


Risks (xl0 6 /year) 


50 

100 

200 

300 

500 

750 

1000 

1500 

50 

10 

1 

0.29 

0.23 

0.17 

0.13 

0.08 

0.04 

0.01 

0 




(23) 

(24) 

(26) 

(29) 

(39) 

(57) 

(94) 


22 

10 

5 

1.29 

0.99 

0.68 

0.46 

0.18 

0.06 

0.02 

0 




(24) 

(25) 

(30) 

(38) 

(62) 

(95) 

(92) 


6.4 

20 

2 

0.5 

0.35 

0.18 

0.08 

0.02 

0 

0 

0 




(26) 

(30) 

(42) 

(59) 

(94) 




5 

30 

4 

0.82 

0.56 

0.28 

0.11 

0.03 

0 

0 

0 




(27) 

(31) 

(44) 

(63) 

(93) 




1.25 

20 

156 

23.8 

9 

1.46 

0.04 

0 

0 

0 

0 




(34) 

(52) 

(93) 

(8) 





4 

5 

232 

44.6 

22.4 

4.33 

0.13 

0 

0 

0 

0 




(29) 

(42) 

(89) 

(22) 





5 

20 

7 

1.44 

0.98 

0.43 

0.17 

0.04 

0 

0 

0 




(27) 

(31) 

(48) 

(69) 

(94) 




0.2 

20 

141 

3.04 

0.04 

0 

0 

0 

0 

0 

0 




(94) 

(8) 







2.4 

20 

17 

3.09 

1.73 

0.42 

0.14 

0 

0 

0 

0 




(30) 

(40) 

(72) 

(93) 





2 

5 

220 

33.05 

7.36 

0.15 

0.04 

0 

0 

0 

0 




(36) 

(86) 

(19) 

(23) 





1 

5 

150 

13.64 

1.36 

0.03 

0 

0 

0 

0 

0 




(49) 

(82) 

(20) 






9 

20 

1 

0.33 

0.24 

0.14 

0.07 

0.01 

0 

0 

0 




(26) 

(29) 

(36) 

(48) 

(94) 




1.4 

30 

20 

3.38 

1.55 

0.26 

0.08 

0 

0 

0 

0 




(33) 

(46) 

(94) 

(92) 





2 

20 

15 

2.63 

1.37 

0.23 

0.09 

0 

0 

0 

0 




(31) 

(43) 

(94) 

(93) 





Total 



131.5 

48.1 

8.8 

1.6 

0.4 

0.1 

0 

0 




(35) 

(51) 

(76) 

(53) 

(66) 

(80) 




Note: The values in parentheses show the percentage contributions to risk levels due to accidents in stable weather conditions. 


from a hole in a 6 in. pipe into a bund and (3) failure of a 13 5 te 
storage vessel. It gives for different air entrainment factors 
estimates of the distances to specified oxygen concentra- 

In determining the effect of enhanced oxygen con¬ 
centration, the BCGA Guide assumes that clothing fires are 
the only type of fire that would increase casualties. It con¬ 
centrates largely on the potential for persons who are 
smoking or using matches to ignite their clothing, the 
source of fuel closest to them. 


9.22.7 FMA ammonium nitrate CIMAH guidelines 

Guidance for ammonium nitrate is given in Safety Case 
for Ammonium Nitrate Required by Regulation 7 of CIMAH 
by the Fertilizer Manufacturers Association (the FMA 
Ammonium Nitrate Guide) (1989); an extract (FMA, 1989) 
is given in Lees and Ang (1989b). The FMA Ammonium 


Nitrate Guide is mainly concerned with the safety report 
and, in particular, with the properties of ammonium nitrate. 

The Guide discusses the hazard of explosion of ammonium 
nitrate and considers the consequences of deflagration of a 
stack of 300 te of ammonium nitrate. It obtains for such an 
explosion a trinitrotoluene (TNT) equivalent of 41 te, based 
on an ammonium nitrate TNT equivalent of 55% and a 
maximum explosion efficiency of 25 %, and hence at 600 m 
a scaled distance of 175 m. It reproduces the ACMH corre¬ 
lation for the overpressure from a TNT explosion (Harvey, 
1979b) and utilizes this correlation to determine that for 
this explosion an overpressure of 1 psi occurs at 600 m. 

9.23 Hazard Impact Model 

The impact of a hazard on the surrounding area may be 
modelled analytically by making certain simplifying 
assumptions. The hazard impact model so derived may be 
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Clj liquid 
Cl 2 gas 

Pressure relief 


Figure 9.43 UKCP guide on emergency planning for chlorine installations: typical installation (after Chemical Industries 
Association, Chlorine Sector Group, 1989) 


Table 9.42 UKCP guidance on emergency planning for chlorine installations: typical installation (after Chemical 
Industries Association, Chlorine Sector Group, 1989) 


A Typical equipment and inventories 


Equipment 

Pressure (bar g) 

Normal 

Design 


Quantity 

Stock tanks 

7 

13 

20-200 te 

2 x 35 te, typically 

Expanse tanks 

0 

13 

10% of stock tank 

1 x 5 te, typically 

Vaporizers 

3 

14 

0.2-2 te/h 

1, typically 

Scrubbers 

Pressurized 



1 

Air compressors 

9 

11 

- 

1 

Piping: 





Gas 

2-9 



<20 m 

Liquid 

9 ASA 1501 in. diam 



<20 m 

Vent 

13 



<20 m 

Valves 

Primary — globe 


1 in. Table D 

<20 


Isolation - ball 


1 in. ASA 150 

<20 

‘Flexibles’ (liquid/vent) 

2-9 

25 

1 in. ASA 150 

<10 m 


B Process activities 


Air compression 

Pressurization of tanker for offloading 
Pressurization of storage tanks for chlorine transfer 
Vaporization of chlorine 

Controlled venting of tanker and storage tanks after transfer or for maintenance 
Pressure relief 

Possible interaction between the chlorine and its point of application 

C Steps in hazard assessment 

Examination of piping and instrument diagram 
Systematic identification and listing of hazards 
Assessment of credible size of leak 
Definition of operating pressure 
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Table 9.42 (continued) 

Assessment of extent of vaporization 

Estimation of extent of gas concentrations at different locations 
Estimation of potential duration of leak 

D List of typical incidents 3 


1. Loss of containment of chlorine from pipework 

(a) Corrosion due to freeze/thaw conditions (particularly under lagging) 

(b) Pipe flange leaks (e.g. expansion of trapped liquid) 

(c) Flange gasket failure (due to incorrect gasket material) 

(d) Leak from pipework (e.g. spool fabricated/fitted to wrong specification, section of pipework not subject to 
routine inspection) 

2. Loss of containment from the offloading installation 

(a) Leaks from flexibles (e.g. pinhole on weld) 

(b) Damage to filling/discharge connection due to transport container movement (e.g. collision) 

(c) Liquid chlorine ingress into vent/compressed air systems/absorption systems overloaded 

3. Incidents involving bulk storage and relief systems 

(a) Contamination of stock tank contents (e.g. water ingress/incomplete drying out procedure) 

(b) Leaks from valves (incorrect valve specification) 

(c) Leaks from relief system/expanse vessel (valve maloperation, water ingress, etc.) 

(d) Total loss of containment from bulk storage needs to be considered in each case to estimate the likelihood of this 
event. In particular, the systems and procedures used in the operation and maintenance of the plant must be 
carefully reviewed 

4. Loss of containment from the system supplying chlorine to the point of application 

(a) Internal chlorine iron fires (e.g. vaporizers) 

(b) Nitrogen trichloride explosion (e.g. drains from vaporizer) 

(c) Interaction in the chlorine delivery pipework, backflow of water/reagents 

a These examples are of typical incidents but do not cover all possibilities, particularly those associated with site specific features. 


used for various purposes, including estimating the num¬ 
ber of injured and assessing the error in the estimates. 

9.23.1 Approximate model 

An approximate model that may be used to estimate the 
number of people who suffer injury is 

J§ = [9.23.1] 

where dp is the population density (persons/m 2 ), A/ is the 
total number of injured and r 50 is the radius (metres) at 
which the probability of injury is 50%. 

In this model, the assumption is made that the number of 
people inside the circle of radius >-50 who escape injury is 
equal to the number outside the circle who suffer injury 
It is also assumed that the population density is uniform. 
The use of the radius r 50 has some justification apart 
from computational convenience in that, although injury 
relations are usually subject to much uncertainty, the uncer¬ 
tainty tends to be least at the 50 % injury level. 

It can readily be appreciated that the degree of error in 
this approximate model depends on the relation between the 
distance and the probability of injury. Three possible cases 
are illustrated in Figure 9.44. In case (a), the transition from 
a probability of injury of unity to one of zero is very gradual, 
in case (b) more sharp, and in case (c) immediate. The error 
in the estimate reduces to zero for this latter case. 

If the population density is not uniform, the approximate 
model given by Equation 9.23.1 cannot itself be used, but 
use may still be made of the radius r 50 in conjunction with 
the site population density to obtain an approximate esti¬ 
mate of the number of injured, although in this case the 


number of injured inside the circle who escape injury and 
the numbers outside who suffer injury may not balance. As 
before the error in the estimate reduces to zero for case (c). 

It has been shown, however, by Poblete, Lees and 
Simpson (1984) and Lees, Poblete and Simpson (1986) that 
it is possible to derive an alternative, more accurate model. 


9.23.2 Intensity of physical effect 

Some principal physical effects are: 

Fire 

Thermal radiation I 

Thermal radiation dose It 

Thermal radiation-time function /(/, t) 

Explosion 

Overpressure p° 

Impulse I p 

Toxicrdea.se 

Concentration C 

Dose Ct 

Concentration-time function /(C, t) 

It is assumed in the model that the intensity of the physical 
effect decays with distance according to an inverse power 
law. Hence: 

to = [9-23.2] 

where k w is the intensity constant, n„ the intensity index 
and w the intensity 

The normalized intensity i is obtained by dividing the 
actual intensity w by the value w 0 of the intensity at the 






Table 9.43 UCKP guidance on emergency planning for chlorine installations: hazard scenarios? (after Chemical Industries Association, Chlorine Sector Group, 1989) 


Event Event likelihood Pressure (bar g) Hole size (diameter) (mm) Consequence Downwind Distance 

Leak rate (kg/s) affected (m) 


Liquid Gas Neutral D5 m/s Inversion .F2m/s 







140 ppm 

15 ppm 

140 ppm 

15 ppm 

Valves 

■> 








Leak from a packed gland 

Leak on a bolted tongue and 

Quite likely 1 

7 <2 

0.1 NF b 


- 

200 

130 

400 

groove flange 

Porosity in the value body or Bonnet 
Leak from flange (hole in 1.6 mm gasket) 

J 



0.01 




100 

Piping 

Small leak from liquid flange 




0.8 NF 

200 

600 

400 

1100 

(1.6 mm gasket) 

Small hole in liquid pipework wall 
(corrosion/erosion / defect) 

Small hole in gas pipework 

Likely j 

• 7 5 


0.05 


150 

100 

300 

Hole in pipework due to corrosion/ 

Unlikely 

7 sustained 12 

3.5 NF 

— 

400 

1300 

800 

>1500 

erosion/defect. A full segment of 

1.6 mm gasket expelled between 
adjacent bolts 









Expansion of trapped liquid 

Unlikely 

7 reducing 12 

1.2 

- 

200 

700 

500 

1400 

between closed valves 

(full segment of 1.6 mm gasket 

expelled between adjacent bolts) 









Hole in gas pipework (e.g. flange leak) 

Likely 

7 sustained 12 

- 

0.3 

100 

400 

200 

700 

Storage 

T&G flange leak on liquid branch 

Likely } 

7 reducing slowly <2 

0.1 NF 



200 

130 

400 

Flange leak on gas branch 




0.01 

- 

- 

- 

100 

Small leak from liquid branch 

Unlikely }■ 

7 reducing slowly 5 

0.8 NF 


200 

600 

400 

1100 

Small leak from gas branch 




0.05 

- 

150 

100 

300 

Transfer equipment 

Flexible hose 

Very likely 

Pinhole 

0.01 





100 


Likely 

2 

0.1 

- 

- 

200 

130 

400 


B Interpretation of the qualitative frequency terms 


Extremely unlikely 

<10' 

“ 6 /year 

Very unlikely 

10“ 6 

-10 5 /year 

Unlikely 

lo- 5 

- 10 _4 /year 

Quite unlikely 

10“ 4 

- HTVyear 

Somewhat unlikely 

10“ 3 

-10“ z /year 

Fairly probable 

10“ z 

-10 _1 /year 

Probable 

>10' 

_1 /year 


“This table is appendix IV of the original document. The table is by way of example only. 
b NF, non-flashing flow. 
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Table 9.44 

Ground level concentrations (ppm) for scenarios 1-5 in 

the CIA Ammonia Guide (CIA, 1988 PA49) 

Scenario 


D5 




F2 

500 m 

1000 m 

2000 m 

500 m 

1000 m 

2000 m 

1:10 kg/s 

500-1000 


50-100 

1000-5000 


200-600 

40 kg/s 

600-4000 


150-300 

3000—10 4 


1000-3000 

2 

200-500 


20-50 

500-1000 


100-200 

3 

150-250 

80-150 

30-70 

50-100 

200-300 

250-350 (no plume rise) 


40-80 

40-80 

20-40 

0 

0 

10-20 (plume rise) 

4(b) 

300-500 

200-400 

100-200 

200-300 

400-600 

600-800 (no plume rise) 


50-100 

60-120 

30-60 

0 

0 

10-20 (plume rise) 


Same order of magnitude a: 

s Scenario 1 





distance r 0 , which is termed the ‘radius of the physical 
effect’, and which is discussed further below. Hence: 


$=w/w 0 r = r 

[9.23.3a] 

|(=1 r = r 0 

[9.23.3b] 

9.23.3 Injury factor 

Some principal injury factors are 


Fire 7 4 / 3 1 

Explosion p° 

l 


Toxic release C 

Ct 

(ft 


It is assumed in the model that the injury factor 
function of the intensity. 

is a power 

Hence: 


n = k vw uT’- 

[9.23.4] 

where/:,,*, is the first injury factor constant, n vw is 
factor power index and v the injury factor. 
Combining Equations 9.23.2 and 9.23.4 gives 

the injury 

t a h/r" 

[9.23.5] 

with 


h = hmKr 

[9.23.6] 

n = n w n„ 

[9.23.7] 


where k v is the second injury factor constant and n is the 
injury factor decay index. 

The normalized injury factor x is obtained by dividing 
the actual injury factor v by the value v 0 of the injury factor 
at the distance r 0 : 

x = v/v a 1#4p§*' [9.23.8a] 

x=l r = r n [9.23.8b] 

9.23.4 Probability of injury 

The relationship between the injury factor and the 
probability of injury is assumed to be the log-normal 
distribution: 



where P is the probability of injury, m.% is the normalized 
location parameter of the distribution, and a is the spread 
parameter of the distribution. 

An alternative way of expressing this relation is in the 
form of a probit equation: 

Y —ha + ha lnx [9.23.10] 

k nl = 5 -WJa [9.23.11a] 

k n2 = 1/(7 [9.23.11b] 

The relation between the probability and the probit is 
given by Equation 9.18.1. 

The probit equation given by Equation 9.23.10 is in nor¬ 
malized form. The unnormalized equation is 


Y = k i +feint; [9.23.12] 

h = 5 [9.23.13a] 

k 2 = 1/(7 [9.23.13b] 

The two forms are related through two location parameters 

m* n = m\-n In d [9.23.14a] 

v = exp(m* - w*) [9.23.14b] 


9.23.5 Distances r 0 and r 50 

The intensity of the physical effect and the injury factor are 
scaled in relation to the distance r 0 . In principle, r 0 is 
intended to represent the radius of the physical effect, 
where this is a meaningful concept as with, say, a fireball, 
and hence the radius at which the probability of injury is 
unity. The choice of r 0 is, however, unrestricted. It is 
recommended that it be chosen so as to give a probability of 
injury close to unity. 

Then the normalized injury factor decays with distance 
according to the relation 




[9.23.9] 


= r 0 


[9.23.15a] 

[9.23.15b] 
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ol-- 

(c) Distance 

Figure 9.44 Some hypothetical relations between distance and probability of injury 


The distance r 50 has been defined as the radius at which the 
probability of injury is 50% (P=0.5). The normalized 
injury factor * 50 at this distance is then: 

*50 = (*o/*5o) M [9.23.16] 

Also, putting x =* 5 o and Y= 5 (P= 0.5) in Equation 9.23.10, 
gives 

*50 = exp(m*) [9.23.17] 

Hence from Equations 9.23.16 and 9.23.17 

*50 = *o/*5o Z [9.23.18a] 

= *o/exp(m*/«) [9.23.18b] 

9.23.6 Number of injured 

It is assumed that the density <2p of the population around 
the hazard source is uniform. This assumption can be 
relaxed in certain specific ways as described below. The 
number A of people injured is: 

Ar’i = f 2nd p P{r)r6r [9.23.19] 


It can be shown that the solution of Equation 9.23.19 is 


Ni = nr^dpcji [9.23.20] 

With 


(f> = exp(2 u 2 /*? 2 ) [9.23.21] 


where tj) is the correction factor for variance and decay 
Equation 9.23.20 together with Equation 9.23.21 con¬ 
stitutes the hazard impact model derived by Lees, Poblete 
and Simpson. 


9.23.7 Practical decay relations 

An important feature of the model is the assumption that 
the intensity of the physical effect decays according to an 
inverse power law. It has been shown by Poblete, Lees and 
Simpson (1984) and Lees, Poblete and Simpson (1986) that 
a number of the simpler hazard models give such a decay 
relation. There are others, however, particularly some gas 
cloud models, which do not. 

The question of the decay of the physical effect is con¬ 
sidered in more detail in Section 9.25. 
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Table 9.45 Hazard impact model sensitivity coefficients 
(after Lees, 1987) (Courtesy of Elsevier Science 
Publishers) 


(Wi/Nfi/fidp/d,,) = 1 
(Wi/Ni)/(dk w /k K ) = 2 /n w 

(WilNi)l(dn w ln v ) = -(2 /n) \nk v + (2 /n)m* u - 4a 2 /n 2 
Zk„/k„) = 2/n 

(dNi/Ni)/(dn vw /n vw ) = -(2/n) lnk vw + (2 /n)m* u - 4 o 2 /n 2 
(i Wi/Ni)/(dml/m* u ) = -2 m*Jn 
(SNi/Ni) / (do / a) = 4 <?/n 2 


9.23.8 Sensitivity estimates 

It has been shown by Lees (1987) that there canbe derived from 
Equation 9.23.20 a set of sensitivity coefficients which can be 
used to determine the effect of errors in the various physical 
models and injury relations utilized on the estimate of the 
number of injured given by that model. The parameters of 
interest are: dp, k w , n w , k vw , n vw , rr£ and a. The normalized 
partial derivatives, or sensitivity coefficients, of A/ with 
respect to these parameters are given inTable 9.45. 


9.23.9 Applications of model 

The hazard impact model presented in Equation 9.23.20 is 
more accurate than that given in Equation 9.23.1 and, if the 
assumptions hold exactly, the results given by the model 
are exact, but in most practical cases there is likely to be a 
degree of approximation in the assumptions and hence in 
the results. 

One application of the model is to make a rapid estimate 
of the number of injured. The model may be used to make a 
quick, ranging estimate, usually prior to a more detailed 
assessment. The use of the model is straightforward, but 
there are two common situations where some modification 
is necessary. These are for population density and direc¬ 
tional effects. 

In many cases the population density is not uniform. Two 
specific deviations can readily be taken into account. One is 
the case where there is a different population density, per¬ 
haps zero, up to some distance r w from the hazard source. If 
this is such that the probability of injury up to this point is 
virtually unity, it is straightforward to calculate the num¬ 
ber of injured inside the circle radius r m and to adjust the 
value of Ni accordingly. The other case is where there are 
different population densities in different sectors around 
the hazard source. Again it is straightforward to adjust the 
value of Ni. Combination of these two cases can also be 
handled and, taken together, these adjustments extend 
appreciably the scope of the model. 

Some physical phenomena are directional and affect not 
a circular area around the hazard source but an area that is 
a sector with its apex at the source. The most important 
case here is a gas cloud. 

Directional effects can be handled by the model by con¬ 
sidering only the sector affected and, where necessary, divid¬ 
ing it into a sufficient number of subsectors such that the 
conditions along any arc in a subsector are essentially uniform. 

Another, and perhaps more significant, application of 
the model is to determine the effect of errors in the physical 
models and injury relations on the estimate of the number 
of injured. This may be of value not only in the conduct of 
hazard assessments but also in the identification for 
research purposes of areas where improved models and 


correlations would, or would not, give significant improve¬ 
ments in the accuracy of the assessment. 

9.24 Simplified assessment methods 

A full hazard assessment is a major exercise. It is useful, 
therefore, to haveshort-cutmethods.Theshort-cutmethods 
described may be used to obtain an approximate estimate 
with economy of effort. The use of such a method may 
improve understanding of the hazards and may highlight 
unexpected features. But short-cut methods have their 
limitations. By definition they tend to be based on general¬ 
ized relations and thus are much less effective in revealing 
critical features and assumptions in a specific design. 

A study of simplified methods of hazard assessment has 
been described by R. A. Cox and Comer (1982).The study was 
commissioned following the Rijnmond Report. The aim of the 
work was to devise a method of hazard assessment that would 
yield risk contours, FN curves and individual and group risks. 
It was accepted that such a method would not be able to give 
individual risk for employees, since the degree of detail 
required to do this was not consistent with the simplicity 
sought.The method was required toyieldintermediateas well 
as final results to permit checking and to improve confidence 
in the latter. Two methods were devised and compared: 

(1) Simplified classical method. 

(2) Parametric correlation method. 

These are now described in turn. 

9.24.1 Short-cut classical method 

The short-cut classical method (SCM) is a simplified form 
of the full classical method in which individual failure 
scenarios are defined and estimates are made of their fre¬ 
quency and consequences. 

The SCM approach involves three stages: failure case 
selection and frequency estimation; application of con¬ 
sequence submodels; and summarization of risks. 

Crucial to the method is the selection of the failure cases. 
The original intent was to pick a set of representative cases. 
But it was concluded that it is necessary to start from the 
full set of failure cases. These cases are then reduced to a 
more limited set of equivalent discrete failures (EDFs). One 
method is to cluster together ‘similar’ failures, another is to 
compare each case with a standard EDF (SEDF). It was the 
latter approach that was adopted. 

A standard EDF (SEDF) is defined by standard physical 
consequences such as the distance travelled by a vapour 
cloud in standard weather conditions. An SEDF list was 
created, giving for each EDF the distances for defined 
intensities of the relevant physical effects such as toxic 
concentration. For each EDF the consequences are deter¬ 
mined by a once-and-for-all assessment. Then, in applying 
the method to a particular plant the actual EDF for a par¬ 
ticular failure case is equated to one of the standard EDFs 
using consequence submodels. This is the only use of these 
submodels in the method. 

Some of the principal elements in the method are shown 
inTable 9.46. Section A of the table lists the data schedules 
required to define the failure cases. They are schedules of 
the plant units, of the items on the plant and of the con¬ 
nections between items. Section B shows the six main 
categories of release considered, and section C gives the 
consequence submodels used. Figure 9.45 is a flow diagram 
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Table 9.46 Some elements of the short-cut classical 
methods (SCM) of hazard assessment (after R.A. Cox and 
Comer, 1982) (Courtesy of the Institution of Chemical 
Engineers) 


A Schedule of item interconnections 


Each item to item connection defined by: 

Identification of items of either end of pipe 
Pipe diameter 

Location of connection at either end of pipe - in vapour 
Space or below liquid level 

Presence of particular types of valving along pipe 
(excess flow, non-return and shut-off valves) 

B Schedule of items 


For each plant item: 

Item identification 

Materials and inventory contained 

Temperature and pressure 

The item location is specific by the item identification 
that identifies the plant unit on which the item is 
located 


C Schedule of plant units 

For each plant unit: 

Set of parameters to define failure frequencies Location 
coordinates 


of the algorithm for pipe failure and Figure 9.46 one for 
application of the method to an actual plant. 

Up to this point the analysis is independent of the envi¬ 
ronment. Factors defining this environment, such as 
the weather, ignition sources, etc., are now brought in. 
The effect of introducing these factors is to alter not con¬ 
sequences, but the frequencies for each standard. From this 
information on the frequency and consequences of each 
standard EDFat the particular plant it is possible to obtain 
estimates of risk. The frequencies of the various physical 
outcomes, the areas affected and the number of casualties 
are determined, and risk estimates made in the usual way. 

9.24.2 Parametric correlation method 

The alternative method considered was the parametric corre- 
lationmethod(PCM). Withthismethodtherearetwoprincipal 
features that must be specified: the form of the correlation 
function and the method of determining its parameters. 

One approach to selecting the form of the correlation 
function is to run a large number of full hazard assess¬ 
ments and derive a correlation function from these. 
Another is to use expert judgement to select suitable func¬ 
tional forms. The correlation function should be carefully 
chosen to give an appropriate number of parameters. There 
is a potential problem of escalation of the number of para¬ 
meters required. 

A possible form of correlation function might be: 

R{d ) = ^ [1 + COS^Mnax)] [9.24.1] 

where d is the distance from the unit, R is the risk and the 
subscript max indicates the maximum at which any risk 
exists. 


The correlation function given in Equation 9.24.1 has 
two parameters, R( 0) and rfmax- Its characteristics are 
shown in Figure 9.47. Since R(0) is the risk at the unit itself, 
it is in effect a measure of frequency, while d max is a meas¬ 
ure of consequences. Thus the two parameters are inde¬ 
pendent. This correlation function therefore has the 
attraction of simplicity. 

9.24.3 Comparison of methods 

The two candidate methods were then compared both with 
the full classical method and with each other. The full 
method used in the Rijnmond study was considered to be 
accurate in most cases to within one order of magnitude in 
each direction, but in some cases only to within two orders 
of magnitude. The SCM approach was not expected to be 
appreciably less accurate. Insofar as a multiparameter 
PCM approach would be derived from full analyses, it too 
should have a similar accuracy, but it would have less 
transparency than the SCM. A two-parameter PCM would 
probably be appreciably less accurate. 

With regard to cost, the capital cost of the SCM and two- 
parameter PCM were assessed as comparable and that of 
a multiparameter PCM as about double. On the other 
hand, the operating costs of the two-parameter PCM were 
estimated as half those of the SCM, with the multi¬ 
parameter PCM costs lying in between. 

9.24.4 Hazard impact model 

The hazard impact model may be used as a short-cut 
method for hazard assessment.The method depends on the 
availability of decay and injury relations and on certain 
simplifying assumptions. The use of the model for this 
application is described in Section 9.23. 

9.25 Decay Relations 

Several of the methods described make use of decay rela¬ 
tions. These may be generic relations intended to be 
applicable to any hazard with suitable choice of parameters 
or they may be specific to a particular hazard. 

For the simpler hazard models decay may often be 
derived analytically, while for the more complex models 
embodied in computer codes it is necessary to obtain and 
then correlate numerical results. Similarly, correlations 
may be derived from experimental data. 

9.25.1 Generic decay relations 

Several decay relations have been given in the literature. 
They include: Equation 9.24.1, used by R.A. Cox and Comer 
(1982) for the parametric correlation model; Equation 
9.23.20 used by Lees, Poblete and Simpson (1986) for the 
hazard impact model; and Equation 9.14.1, used by Bagster 
and Pitblado (1991) for the domino effect model. 

9.25.2 Decay relations for specific hazards 

Decay relations can be obtained from the simpler hazard mod¬ 
els for fire, explosion and toxic release, asdescribed by Poblete, 
Lees and Simpson (1984) andLees, Poblete and Simpson (1986). 
The intensity of heat radiation from a fireball is: 

F = E/4nr 2 [9.25.1] 

where E is the heat radiated (kW), F is the heat radiated on 
the target (kW/m 2 ), and r is the distance (m) from the centre 
of the fireball to the target. Similar equations apply to other 
types of fire, such as pool fires and flares. 
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Figure 9.45 Flow diagram of algorithm for pipe failure in short-cut classical method (SCM) (R.A. Cox and Comer, 
1982) (Courtesy of the Institution of Chemical Engineers) 
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Figure 9.46 Flow diagram of algorithm for analysis of an installation in short-cut classical method (SCM) (R.A. Cox 
and Comer, 1982) (Courtesy of the Institution of Chemical Engineers) 


The peak overpressure and impulse from the explosion 


of a high explosive ai 

-e functions of scaled distance: 

p° =f(z) 

[9.25.2] 

k =m 

[9.25.3] 

with 


z = r/WW 

[9.25.4] 


where I p is the impulse (N s/m), p° is the peak incident over¬ 
pressure (N/m 2 ),W is the mass of explosive (kg) and* is the 
scaled distance (m/kg 1/3 ).The function in Equation 9.25.2 is 
usually provided in graphical form, such as the curves given 
by WE. Baker et al. (1983). However, over a limited over¬ 
pressure range it can be represented by the relation 

p° = l/r ni 


[9.25.5] 
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Figure 9.47 Characteristics of the decay function R(d) used in the parametric correlation method (R.A. Cox and 
Comer, 1982) (Courtesy of the Institution of Chemical Engineers 


where «i is an index. The Baker curves correspond over the 
overpressure range 1.0-0.1 bar to decay indices of 1.7 and 
0.9 for peak overpressure and impulse, respectively. 

For VCEs there is no established model. Some theoretical 
models give a decay index of approximately unity. On the 
other hand, the decay curve established for the Flixborough 
explosion gives over the overpressure range 1.0-0.1 a decay 
index of 1.7. 

Decay indices for dispersion of neutral density gas may 
be derived from the Sutton equations. For an instantaneous 
release the concentration at ground level on the centre line 
of the cloud and at cloud centre is 


2 Q* 


where C is the diffusion parameter (» n/2 ), n is the diffusion 
index, Q* is the mass released (kg), t is the time (s), u is the 
wind velocity (m/s) and x is the concentration (kg/m 3 ). For 
neutral conditions, n= 0.25: 


x 1 A 2 ' 6 


[9.25.6b] 


P .,- y 

“ n C 2 u(utf~' 

Setting n = 0.25: 
Aid °c wt* 


For a continuous release the concentration at ground level 
on the centre line of the cloud is 


[9.25.8a] 


where Q is the mass rate of release (kg/s) setting n = 0.25: 


X tx l/* 1 ' 75 [9.25.8b] 

The total integrated dosage is obtained by assuming that 
the continuous release lasts for some finite time. Then the 
total integrated dosage is: 


Aid oc l/* 1-75 [9.25.9] 

Models of heavy gas dispersion tend to be too complex to 
permit the analytical derivation of general decay indices, 
although an index may sometimes he derived for particular 
cases. Some decay indices for some principal hazards are 
given in Table 9.47. 

The decay index for the physical effect can be combined 
with the power index for the injury factor to give an overall 
decay index for injury, as described the discussion of the 
hazard impact model in Section 9.23. 

Another decay relation used is: 

»mkM n2 [9.25.10] 

where Mis mass released (kg), n 2 is a decay index, r is the 
distance for some physical effect (m) and k is a constant. 

Equation 9.25.10 has been used to correlate results from 
numerical computations or empirical data. In particular, it 
has been used to give a correlation for the decay of the 
concentration of a flammable gas cloud to its lower flam¬ 
mability limit (LFL) or some fraction of this. For example, it 
was used in the Second Canvey Report to correlate distance 
to 0.5 LFL. 


9.26 Hazard Warning 

The use of hazard assessment of the kind so far described 
to provide assurance that a hazard is under control has 
certain weaknesses. One is the problem of credibility. The 
most difficult situation arises where there is a major 
hazard. Industry may attempt to argue qualitatively and 
then to demonstrate quantitatively that although in the 
most unfavourable circumstances the hazard has the 
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Table 9.47 

Decay indices for some principal hazards 




Hazard 

Model 

Physical effect 

Intensity 

Decay index 

Fire 

Fireball, pool fire 

Thermal radiation 

I 

2 

Explosion 

TNT 

Peak overpressure 
Impulse 

P° 

I v 

1.7 s 

0.9 a 


VCE (Flixborough) 

Peak overpressure 

P° 

1.7 b 


VCE (models) 

Peak overpressure 

P° 

1.0° 

Toxic release 

Neutral density gas: 

Concentration 

C 

2.6 


instantaneous release 

Dosage 

Ct 

1.75 


Neutral density gas: 

Concentration 

c 

1.75 


continuous release 

Dosage 

ct 

1.75 


Heavy gas: 
instantaneous release 

Concentration 

c 

1.4* 


Heavy gas: 
continuous release 

Concentration 

c 

1.7 f 


a Over the range 1.0-0.1 bar (W.E. Baker etal., 1983). 
b Over the range 1.0- 0.1 bar (Sadee, Samuels and O’Brien, 1976-77). 

'Model of Wiekema (1980). 
d Model of Ebert and Becker (1982). 

e Specific example of 200 te ammonia release using DENZ computer code (Fryer and Kaiser, 1979 SRD R152). 
1 Specific example of 23.9 kg/s chlorine release using CRUNCH computer code (Jagger, 1983 SRD R229). 


potential to kill a large number of people, the probability 
that the hazard will be realized during the lifetime of the 
plant is very low. Frequently such arguments do not satisfy 
the objectors, who tend to concentrate exclusively on the 
hazard potential and to emphasize that the major accident 
could occur out of the blue at any time. 

Another weakness is that when the plant comes to be 
operated, usually relatively little use is made of the infor¬ 
mation generated during the design, particularly the fault 
trees, for the control of hazards and the analysis of acci¬ 
dents and failures. These problems may be tackled using 
the concept of hazard warning structure described by Lees 
(1982b, 1983b, 1985). This is now outlined. 


9.26.1 Hazard warning structure 

If the structure of a major accident is analysed by con¬ 
structing a fault tree, it is generally found that this event 
occurs as a result of a minor accident and of failure of a 
mitigating feature that is normally effective in preventing 
such escalation. In turn the minor accident may occur only 
if there is a lesser accident and failure of a second mitigat¬ 
ing feature. Typically, there is a series of events that result 
in a major accident only if all the mitigating features fail. 
Generally, therefore, there are many more lesser accidents 
than major accidents. This high ratio of lesser to major 
accidents is the concept underlying the accident pyramid 
discussed in Chapter 1 and shown in Figure 1.4. 

The major accident is likely therefore to be preceded by a 
number of lesser events, some of which may be regarded as 
‘near misses’. Thus the time order of the events is also 
important. The exploitation of the time order of major and 
lesser accidents underlies the concept of learning from near 
misses. 

These ideas are well understood.What does not appear to 
have been sufficiently appreciated and exploited is the 
potential for using these concepts in conjunction with a 
formal analysis of accident structure such as the fault tree. 
A hazard possesses a characteristic warning structure. The 


hazard warning structure may be laid bare by casting the 
fault tree for the hazard in a particular way. 

9.26.2 Hazard warning tree 

A typical hazard warning tree is shown in Figure 9.48. An 
event at level 1, which has a frequency 4, escalates into a level 
2 event only if there is failure of a level 1 mitigating feature, 
which has a probability pi. Similarly, the level 2 event with 
frequency 4 escalates into a level 3 event with frequency 4 
only if there is failure of the level 2 mitigating feature with 
probability p 2 . The probabilities p\ and p 2 are attentuation 
fractions associated with the mitigating features. 

A simple illustration is a release from a large refrigerated 
atmospheric storage tank holding toxic liquefied gas 
towards a housing estate as shown in Figure 9.49. In this 
case, the first level event might be defined as a release of 
unspecified size that might have a number of possible 
causes. The first level feature might then be the size of 
release, since only a proportion of such releases would be 
large ones. Further mitigating features at higher levels in 
the tree would be the wind direction, the stability condi¬ 
tion, the population exposure and the injury relations. 

9.26.3 Events before and after release 

For a major hazard the critical event is usually loss of con¬ 
tainment, and consideration here is directed mainly to this. 

Generally in hazard assessment the frequency of the 
critical event is estimated either directly from failure data 
or else the structure of the events leading up to the release is 
analysed and the frequency obtained indirectly using a 
fault tree, while the structure of the events following the 
release and the frequency of particular outcomes is deter¬ 
mined using an event tree. For a particular outcome the 
event tree can then be recast in the form of a fault tree. In 
some cases, therefore, there are available, in principle, both 
pre-release and post-release fault trees, whilst in other 
cases only the latter are available. 

Even where it is not normally considered necessary to 
construct a pre-release fault tree in order to estimate release 
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Figure 9.48 A hazard warning tree (Lees, 1983b) 
(Courtesy of the Institution of Chemical Engineers) 


frequency, it may nevertheless by worth doing so for the 
purpose of analysing hazard warning structure. If both 
pre- and post-release fault trees are available, the two trees 
may be consolidated to form a single fault tree. 

The concept of hazard warning was originally described 
primarily in terms of the critical event and the post-release 
tree, using the illustrative example of the release of refri¬ 
gerated toxic liquefied gas as just described. The reason for 
this was simple. After the release the event/mitigating feature 
pairs are readily defined. They are features such as leak size, 
wind direction, stability condition, and so on. The hazard 
warning analysis is therefore relatively straightforward. 

However, the application of hazard warning analysis to 
the situation prior to release is equally valid and may 
actually be of more value, since it deals with the features 
over which management has some control. Management 
can do little about the weather, but it can do something 
about plant design and operation. Pre-release analysis 
may therefore be more valuable, but it is usually more 
difficult. 


9.26.4 Events, mitigating features and attenuation factors 

The essential feature of a hazard warning analysis is that 
an event above the lowest level is defined as the outcome of 
a lower level event and of failure of a mitigating feature.The 
quality of the analysis depends largely on this first stage in 
which events, or in effect event/mitigating feature pairs, 
are defined. 

In defining an event the object should be to give a defi¬ 
nition that corresponds to an observable, and recordable, 
event. This is an essential condition both for the use of 
historical event data in conventional hazard assessment 


and for the use of event data from the operating plant. The 
definition of an event implies that of the associated miti¬ 
gating feature. The term ‘mitigating feature’ is interpreted 
very broadly. For example, hole size for a noxious release is 
a mitigating feature on the basis that only a proportion of 
holes are large ones. 

As in constructing a fault tree, with a hazard warning 
tree it is important that events be defined in such a way as to 
make the tree comprehensive and to guard against omis¬ 
sions. Such robustness of event definition may be achieved 
by working, at least in the first instance and at higher levels 
of the tree, in terms of generic failure modes rather than 
specific causes. For example, blockage may represent a 
generic mode of which solids deposition, freezing, crystal¬ 
lization and polymerization are specific causes. This 
approach is a safeguard against omissions insofar as it is 
much less probable that a generic mode will be overlooked 
than a specific, and perhaps low probability, cause. 

Some events and mitigating features are under the 
influence of management, while others are not. Broadly 
speaking, management has relatively good control up to the 
point where loss of containment occurs, but much less 
thereafter. Management decides the hardware and soft¬ 
ware protection that is to be provided. The former includes 
both passive protection such as plant layout and active 
protection such as trip systems, while the latter covers a 
range of measures such as formal systems and procedures 
and training. Management is also able to influence 
the occurrence of initiating events. Once emission has 
occurred, the features that come into play are those such as 
weather conditions and exposure of people, factors over 
which management has little or no control. 

Another important distinction is between predictable 
and unpredictable event rates and attenuation factors. It is 
much more difficult to make quantitative estimates for 
some event/mitigating feature pairs than for others. 

Since there is a potential ambiguity it is necessary to 
define the sense in which ‘attenuation’ and associated 
terms are used here. The frequency of a lower level event 
is divided by the attenuation, or attenuation factor, 
associated with the mitigating feature in order to obtain 
the frequency of the higher level event. The attenuation is 
therefore greater than unity. The attenuation fraction, 
which is the probability of failure of the mitigating fea¬ 
ture, is the reciprocal of the attenuation factor and is less 
than unity. 

A hazard has a high or low warning structure depending 
on the total attenuation between the major accident and 
the lowest level of event that can serve as a warning. For 
a hazard to be classed as ‘high warning’, which is the 
desirable case, the total attenuation should ideally be 
several orders of magnitude. Generally, this means that 
the attenuation attributable to a single feature should be 
an order or magnitude or more. Attentuations of 2 or 3 are 
of limited value, although not completely worthless. For¬ 
tunately, for many hazards there are mitigating features 
that do tend to be associated with quite large attenuations. 
For example, the proportion of large leaks to total leaks, 
the probability of explosion rather than fire, the prob¬ 
ability of particular meteorological conditions may each be 
quite low. If a mitigating feature represents a significant 
barrier to escalation and if it is one over which manage¬ 
ment has some control, it is important that it be identified 
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Figure 9.49 Hazard warning tree for large multiple fatality accident due to large release of toxic liquefied gas: 

(a) storage tank with built-up area distant and in one sector only; (b) hazard warning tree (Lees, 1982b) (Courtesy 
of the Institution of Chemical Engineers) 
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and that measures be taken to maintain or even improve its 
effectiveness. 

Hazard warning is best viewed not so much as a property 
inherent in an installation but rather as one conferred on it 
by the observer. The property of hazard warning is con¬ 
ferred partly by recognition of features capable of giving 
warning and partly by the creation of such features. The 
principal means of creating a warning feature are, in the 
pre-release phase, the use of monitoring and inspection in 
some form and, in the post-release phase, the use of 
separation distances. 

9.26.5 Post-release analysis 

The starting point for the post-release analysis is the criti¬ 
cal event, which is here taken as a loss of containment. In 
constructing the post-release tree, it is generally con¬ 
venient to include as a mitigating feature the size of release, 
even though this could be regarded strictly as part of the 
pre-release tree, provided that double counting is avoided 
in the final assessment. The justification for this practice is 
that leak size is nearly always an important mitigating 
feature with a high attenuation factor, and that inclusion in 
the post-release tree ensures that it is taken into account 
even if no pre-release tree is developed. 

Some principal mitigating features in a post-release tree 
are given in Table 9.48. The list is illustrative rather than 
exhaustive, and is self-explanatory. A post-release hazard 
warning analysis of the St Fergus to Moss Morran pipeline 
has been given by Lees (1985). A hazard assessment for 
this pipeline has been made by the HSE, as described in 
Chapter 23. 

The hazard considered in the HSE report is a release of 
NGL from the pipeline, resulting in interactions with 
housing and hospitals. For this hazard there is a single base 
event that has 11 potential bad outcomes. The base event is a 
release of NGL from the pipeline. The pipeline is 220 km 
long. The frequency of the base event is: 

Frequency of release of NGL = 2.32 x 10 _4 /km-year 

#=220 x 2.32 x 10 -4 = 5.1 x 10“ 2 /years 

The bad outcomes are interactions with housing at eight 
locations and with hospitals at three locations. The fre¬ 
quencies of these bad outcomes are: 


Location 

Frequency (10 6 
interactions / year) 

Location 

Frequency (10 6 
interactions/year) 

1 

2.5 

7 

1.0 

2 

2.0 

8 

1.2 

3 

3.3 

9 

1.0 

4 

4.0 

10 

1.3 

5 

1.5 

11 

1.4 

6 

2.8 



Total 



22.0 


The frequency of all bad outcomes is 22 x 10 6 /year. The 
overall attenuation factor for all bad outcomes is: 

Overall attenuation factor = (5.1 xl0 _z )/(22 x 10 -6 )= 2300 

The individual attenuation factors that make up this over¬ 
all attenuation factor may be derived from the report as 
follows. For each location there is an estimated length of 


pipeline that is capable of giving rise to an interaction. The 
total length for all locations is 32.5 km. Hence: 

Attenuation factor for location = 220/32.5 = 6.8 

There is no interaction for ruptures with hole sizes up to 
20 mm, but there can be interactions for ruptures with hole 
sizes in the range 20—80 mm. The estimated frequencies 
for these two cases are: 

Frequency of rupture with hole size up to 20 mm 
= 2.0 x 10 _4 /km-year 

Frequency of rupture with hole size 20-80 mm 
=2.2 x 10 _s /km-year 

and hence 

Attenuation factor for leak size = (2.0 x 10 -4 + 2.2 
x 10 _s )/(2.2 x 10 -5 ) = 10.1 

Interaction can occur only if the wind direction allows. The 
probability of such wind direction, weighted in accordance 
with the interaction frequencies, is 0.240. Hence: 

Attenuation factor for wind direction = 1/0.240 = 4.2 

Also, interaction can occur only if the stability condition 
allows. Interactions are possible at all locations for Pasquill 


Table 9.48 Some mitigating features for post-release 
hazard warning 

Size of leak 

Employee exposure: workforce location 
Distance to population 
Direction of population 
Density of population 

Population exposure: siting 
Distance to population 
Direction of population 
Density of population 

Modification of exposure (employees and public): 

Time of day 
Escape, evacuation 
Shelter 

Protective clothing 

Meteorology: 

Wind direction 
Wind speed 
Stability category 

Nature and intensity of failure 
Nature and size of equipment failure: 

Size of hole 
Size of inventory 
Flammable cloud behaviour 

Ignition: 

Probability 
Time delay 

Explosion: 

Probability 

Directionality 
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stability category Fand at eight locations for category E, 
giving for the latter a weighting factor of 0.72 based on the 
length of line at each location over which interaction can 
occur. The probabilities of categories E and Fare 0.06 and 
0.08, respectively. Hence: 

Attenuation factor for stability conditions = l/[(0.06 
x 0.72)+ 0.08] =8.1 

The overall attenuation factor from these four separate 
attenuation factors is 2300, which agrees with the figure 
derived earlier. In this case, therefore the overall attenua¬ 
tion factor is a very large one. 

9.26.6 Pre-release analysis 

It is generally much more difficult to carry out a pre-release 
analysis and the methods for doing this are not well devel¬ 
oped. As before, the approach involves the definition of 
mitigating features. Some principal mitigating features are 
shown in Table 9.49. These features are rather less straight¬ 
forward and require some explanation. The pre-release tree 
may be envisaged as consisting of the main potential 
hazard tree which has as its top event the hazard, namely a 
leak, which will be realized unless protection acts to pre¬ 
vent it, and as having grafted onto it two branches, one of 
hardware protection and one of software protection. These 
two latter modes of protection are effected by protective 
devices such as pressure relief valves, trips and interlocks 
and by the process operator, respectively. Within the 
potential hazard tree there are two main mitigating fea¬ 
tures. These are inspection and procedures. Inspection is 
the means of detecting and correcting mechanical failures. 
Procedures are the means of preventing human error. Both 
types of failure can constitute initiating events. The con¬ 
struction of a pre-release tree requires a degree of inven¬ 
tiveness. There is wide scope for creative definition of 
mitigating features. A pre-release hazard warning analysis 
of a hydrocarbon sweetening plant has been described by 
Lees (1985). The analysis is based on an account given by 
Kletz (1972a) of the use in the design of the plant of several 
trip systems to protect against the hazard of explosion. 

The plant consists of a reactor that is fed with both 
hydrocarbon and air. The air is supplied from an air receiver, 
which is fed by an air compressor. There is a pressure relief 
valve on the air receiver and a non-return valve between 
the air receiver and the reactor. An explosion is assumed to 
occur if an explosive mixture develops, since an ignition 


Table 9.49 Some release modes and mitigating 
features for pre-release hazard warning 


A Release modes 


Pressure envelope failure: 

Equipment defect 
External threat 

Maintenance/modification activity 
Process parameter deviation 

B Mitigating features 

Leak size 
Protective devices 
Operator action 
Inspection procedures 


source is assumed always to be present. An explosive 
mixture can occur if an air pocket develops and the feed is 
above its flashpoint or if backflow occurs from the reactor 
into the air receiver, which is at a temperature above the 
flashpoint. The combination of an air pocket and of a feed 
above its flashpoint can result from a high feed temperature, 
which is a common cause for both these conditions, or from 
other causes. The fault tree for the system is given by Kletz in 
his paper. 

The hazard warning tree derived by Lees from this fault 
tree is shown in Figure 9.50.The release mode in this case is 
a process parameter deviation. The initiating and enabling 
events are: 

(1) relief valves fails open; 

(2) compressor fault; 

(3) mixer fault; 

(4) supply fault; 

(5) instrument fault; 

(6) operator error. 

The protective device failures are: 

(1) non-return valve fails; 

(2) high temperature trip fails; 

(3) air pocket trip fails. 

The procedure failures are 

(1) purging procedure fails; 

(2) flash point control procedure fails. 

The mitigating features of protective devices and of pro¬ 
cedures are underlined in Figure 9.50. Events that might be 
reduced in frequency by mitigating features such as 
inspection (equipment failures) and procedures (operator 
errors) are shown with broken underlining. This indicates 
points at which additional mitigating features might in some 
cases be created to give reduced frequency of occurrence and 
increased warning if these are judged desirable. 

This hazard warning tree shows that there is one miti¬ 
gating feature, the non-return valve and the high tempera¬ 
ture trip, on the first and second branches, respectively, but 
two mitigating features, the air pocket trip and the flash¬ 
point control procedure, on the third branch. In the event, it 
was decided to accept low flashpoint feeds as well, so that 
with this policy there was then one mitigating feature on 
the third branch also. 

In general, the process operator appears both as a source 
of initiating events and as a form of protection. In the tree 
considered the protection afforded by the operator is lim¬ 
ited to formal checking procedures. In principle, the 
operator might also intervene to effect protection at other 
points. For example, he may act as a further layer of pro¬ 
tection against high feed temperature. However, for the 
operator to be able to give protection against a condition he 
must be able to observe or at least infer it. Observability is 
one of the principal aspects of operability, which in turn is 
one of the two main concerns of hazard and operability 
(hazop) studies. 

Another illustrative example of pre-release analysis is 
shown in Figure 9.51 for the hazard of rupture of a batch 
reactor due to reaction runaway. Figure 9.51 (a) gives the 
master tree and Figures 9.51(b) and 9.51(c) show the sub¬ 
sidiary trees. The reactor is one for which only a proportion 
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Figure 9.50 Hazard warning tree for explosion in hydrocarbon sweetening plant (Lees, 1985) (Courtesy of the 
Institution of Chemical Engineers) 


of batches are prone to reaction runaway, which gives an 
additional mitigating feature. 

Of particular interest in this tree is the fact that two of the 
initiating events may also cause failure of a mitigating 
feature. Thus loss of agitation is not only an initiating event 
but also prevents the use of shortstop, since without agita¬ 
tion distribution of the shortstop is poor. Similarly, if there 
is a single temperature measuring instrument both for the 
control loop and for display to the operator, failure of this 
instrument is not only an initiating event hut may also 
cause a failure of operator intervention. 

In the first example of pre-release analysis given above, 
the problem was of the type to which fault tree analysis is 
typically applied. There is abasic hazard and trip, and other 
protective systems are used to guard against it.The problem 
in the second example possesses a somewhat similar struc¬ 
ture. It is also possible to apply hazard warning analysis to 


less explicitly structured problems, but the investigator 
must then impart much of the structure himself. 

Of particular importance is loss of containment from the 
plant. Figure 9.52 gives an outline hazard warning tree for a 
major release of flammables from a plant, referred to as 
Plant EB. Figure 9.52(a) gives the master tree and Figures 
9.52(b)-9.52(g) show the subsidiary trees. For example, for 
vessel corrosion (Figure 9.52(b)), the initiating event is 
vessel deterioration. Only if the mitigating feature of 
inspection fails does this escalate into a vessel leak. In turn, 
only in a proportion of cases will the leak be a major one, so 
that hole size is another mitigating feature. 

For pipework rupture by maintenance or modification 
(Figure 9.52(c)), the initiating event is non-adherence to 
procedures anywhere in the works. Only in a proportion 
of cases will this lead to a leak, which gives a mitigating 
feature. Furthermore, only in a proportion of cases will 
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Figure 9.51 Hazard warning tree for reaction runaway in a batch reactor, (a) Master tree, and subsidiary trees for 
(b) failure of operator intervention; (c) failure of cooling 


such a leak occur on Plant X, as opposed to elsewhere in 
the works, which gives a further mitigating feature. 
Finally, only in a proportion of cases will the leak be a 
major one, so that again hole size is another mitigating 
feature. 


The other subsidiary trees for vehicle impact, missile 
impact and fire on the same plant and on another plant 
shown (Figures 9.52(d) -9.52(g)) follow the same principles. 
In some of the trees not all the branches are fully developed. 
In this example, therefore, the lowest level warnings even 
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Figure 9.51 continued 


include events that occur elsewhere on the works. It is quite 
legitimate to include these as warnings if they are indica¬ 
tors, for example, of non-adherence to procedures. 
The example illustrates the fact that it is up to the analyst to 
impose the hazard warning structure on the problem. 

Another illustrative example of a similar type is that 
shown in Figure 9.53 for the hazard of failure of a materials 
testing system. Such failure may lead to a major leak from a 
pipework component. The initiating event is receipt of an 
unsuitable component. The materials testing system allows 
through only a proportion of defective components and 
acts as a mitigating feature. Only in a proportion of cases 
will the leak be a major one, which is a further mitigating 
feature. The failure of the mitigating feature of detection 
can occur as a result of failure of the detection procedure, 
but less obviously it can also be a result of failure to select 
the component for inspection in the first place. 

9.26.7 Failure of warning 

It is of interest to be able to estimate the probability that 
there may be a failure of hazard warning. 

For a top event T of frequency 4 which is caused on a 
proportion p of occasions by a base event B of frequency X 2 : 

Hi = pxh [9.26.1] 

Over a given time interval t the probability P T (f) that the 
top event will occur is: 

[9.26.2] 


The probability P r (f) that the top event will not occur is: 
P T (t) = exp(-Hit) [9.26.3] 

The probability P B (t,k) that the base event will occur 
exactly k times is: 

P B (t, k) = exp(-4f)M^ [9.26.4] 

The probability P B (t, k<n) that the base event will occur 
no more than n times is: 

P B (t, k < n) = exp( -X 2 t) (X 2 t) k /k\ [9.26.5] 


The probability P B {t, k<ri) that the top event will occur 
given that the base event occurs no more than n times is: 

P T (t,k <n) = exp(—40 J2p(k)(X 2 tf/M [9.26.6] 


where 

p(k) = '£(-iy~ 1 (jy [9.26.7\ 

Then the probability W(t, k > n) that there will be a failure 
of hazard warning, in other words that the top event will 
occur and that the number of base events will be no more 


P T (t) = 1 - exp(-Hif) 
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than n when the top event occurs so that there will not be n 
clear warnings, is: 

W(t, k>n)= P T (k < n) [9.26.8] 

The ratio of the probability P T of the top event to the 
hazard warning index JFis the hazard warning ratio and it 
gives a measure of the degree of warning available. 

As an illustrative example, Lees considers the case 
shown in Figure 9.54(a), for which: 

% = 0.001/year 
fa = 0.5/year 
p = 0.002 

Then for a time period t =10 years and n = 2 
P T (t) = 0.01 


W(t,k>f?) — 0.0004 


Pitblado and Lake (1987) have derived an expression 
equivalent to Equation 9.26.8 and have explored the 
numerical implications using Lees’ example. Their results 
are plotted in Figure 9.54 (b). They show that the value of 
the hazard warning ratio is lower in the early years and that 
it is reduced if the number of warnings specified is exces¬ 
sive, but that otherwise a worthwhile degree of warning is 
obtained. 


9.26.8 High and low warning hazards 

For many hazards the expected number of warnings is 
large, but for some it is not. The intention behind hazard 
warning analysis is to exploit the warnings, but analysis is 
not wasted if it reveals a low warning hazard. It is impor¬ 
tant to be aware of such a hazard, because it is unforgiving 
and needs special care. 



Figure 9.52 continued 


















9/118 HAZARD ASSESSMENT 



(e) 


Figure 9.52 continued 
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Figure 9.52 continued 


The degree of warning may be defined as follows (Lees, 
1983b): 


Degree of warning 

Attenuation factor 

Zero 

1 

Low 

10 

Medium 

100 

High 

1000 


An example of a low warning hazard was given in the First 
Canvey Report, where an ammonium nitrate explosion was 
identified as a hazard which, if it occurred at all, would 
cause casualties. 


9.27 Computer Aids 

Hazard assessment is an active field for the development of 
computer aids. Computer aiding has been applied to the 
following: 


(1) fault tree analysis; 

(2) fault tree synthesis; 

(3) hazard models; 

(4) hazard model systems; 

(5) risk assessment. 


These developments are described in Chapter 29. Also 
important in hazard assessment are computer data banks, 
which are described in Appendix 14. 
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Figure 9.52 Hazard warning tree for major release of flammables from a pressure system, (a) Master tree, and 
subsidiary trees for (b) vessel rupture by corrosion, (c) pipework rupture by maintenance/modification, (d) vessel/ 
pipework rupture by vehicle impact, (e) vessel/pipework rupture by missile impact, (f) vessel/pipework rupture by a fire 
on same plant; and (g) vessel/pipework rupture by fire on another plant, EB, ethyl benzene 


9.28 Risk Assessment Debate 

Almost from their inception, both the philosophy and 
methodologies of risk assessment have attracted criti¬ 
cism. The whole status of risk assessment as a scientific 
activity has been questioned by Weinberg (1972a,b). He 
argues that the assessed risks for very rare events are 
likely always to be derived by a process involving much 
subjective judgement and intractable for peer review and, 
therefore, to be subject to much uncertainty. In effect, it is 
possible to pose the problem in scientific terms, but the 
answer that can be given is not based on science but 
‘trans-science’. He quotes a major nuclear reactor accident 
as an example of this type of problem. He argues further 
that, insofar as in this area truth may be unattainable, the 
search should be rather for wisdom and that laymen have 
a correspondingly larger part to play in making the deci¬ 
sion. Other critiques of risk assessment as applied to 
nuclear hazards include those by Hanauer and Morris 
(1971) and Critchley (1976). 

Criticisms of specific techniques were also not slow to 
appear. Much of the initial work on the use of fault trees was 
done in the aerospace industry. The effectiveness of fault 
tree estimates in this work has been criticized by Bryan 
(1976), who was in charge of reliability assessment during 
testing of the Apollo Service Propulsion System (or SPS 
engine). He states: 

This optimism was soon dispelled by hundreds of cases 

of unexpected test and operational failures and thou¬ 
sands of system malfunctions. Many of the failures and 


malfunctions modes had either been previously analysed 
and seemed to be noncredible events or had come as a 
complete surprise which previous analyses had not 
identified at all. By the early 1960s, it had become appar¬ 
ent that the traditional method of identifying potential 
failure events and assigning historical probabilities of 
occurrence to these events... had consistently led to 
overly optimistic conclusions. Consequently, the failure 
rates were consistently underestimated. 

Further discussion of experience in reliability assessment 
of the SPS engine is given by the Union of Concerned Sci¬ 
entists (1977). 

The debate on the Rasmussen Report, described in 
Appendix 23, was in large part concerned with the validity 
of risk assessment. The use of risk assessment in the pro¬ 
cess industries has also had its critics, including Bjordal 
(1980), Pilz (1980a,b), Joschek (1983) and Lowe (1984). This 
criticism comes from experienced practitioners and is 
directed not at the use of quantitative methods hut rather at 
what is considered to be their misuse. 

It is argued by Lowe that hazard analysis and risk ana¬ 
lysis are quite different activities. Whereas the former is 
action oriented, being undertaken to assist in making 
engineering decisions, the latter is information oriented, 
yielding little except very uncertain risk estimates. At first 
sight it appears that risk estimates, even if approximate, 
should be of value in assisting decisions in the public 
domain. Where most of the other factors, however, are 
unquantifiable, quantification of a single factor may actu¬ 
ally be a hindrance by putting undue weight on and creat- 
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Figure 9.53 Hazard warning tree for major leak by piping component due to failure of materials inspection 


ing excessive debate about that factor. He concludes: 

In my view risk analysis of the type considered here is to 
safety what the merry-go-round is to transport. We can 
spend a lot of time and money on it, only to go round in 
circles without really getting anywhere. 

Bjordal’s criticism is directed particularly to risk assess¬ 
ments that concentrate exclusively on fatalities. He draws 
attention to the wide variety of other factors that may concern 
the public, ranging from pollution to anxiety. He emphasizes 
the importance of defining beforehand the use to which the 
results are to be put, and cites one case where the point which 
the public were most anxious to have answered was not 
the risks as usually assessed, but the question: ‘Is it more 
dangerous to live along the fjord than before?’ 

Pilz describes the many difficulties in the way of 
obtaining a meaningful risk assessment for a process 
plant. The value of the assessment is crucially dependent 
on the insight the analyst has regarding the system. 
Failure rates are usually assumed to be constant over 
time, but may well not be so. Failure data are often 
lacking and are strongly affected by the differences in 
aggressiveness of the chemicals handled and in operat¬ 
ing and maintenance practices. Fault tree methods are 
based on classifying states that are essentially a con¬ 
tinuum as discrete states of failure or success. Human 
error plays a critical role. It is necessary to consider not 
simply the steady-state operating condition but also 
other conditions such as start-up, shut-down, etc. He 
concludes that it is a virtually hopeless task to obtain a 
risk assessment that is meaningful in terms of the uses 


for which it is usually advocated and quotes the wide 
confidence bounds given by the authors of the Nuclear 
Reactor Risk Study in Germany. 

In Pilz’s view, fault tree analysis can nevertheless play a 
useful role. It is a valid technique for comparing different 
protective systems. It should he used to check different 
safety concepts and to discover weak points, but it should 
not be made to bear the burden of risk assessment. He 
points out that in Germany a risk assessment is not done 
for every nuclear reactor, and that indeed the Reactor Risk 
Study dismisses this as impossible. What is done is to study 
a number of typical plants and to determine the average 
risk from these. 

The debate on risk assessment is reflected in the two 
guides Methodologies for Hazard Analysis and Risk Assess¬ 
ment in the Petroleum Refining and Storage Industry 
(CONCAWE, 198210/82) and Risk Analysis in the Process 
Industries by the International Study Group on Risk 
Assessment (ISGRA, 1985; Pitblado, 1994b). Both publica¬ 
tions give guidance on the methodologies of hazard analy¬ 
sis and risk assessment. Neither recommend the universal 
use of risk assessment. The CONCAWE guide emphasizes 
the uncertainties inherent in risk assessment. The ISGRA 
guide explicitly states: ‘Whilst a large number of compa¬ 
nies have found benefit from the use of quantified risk 
analysis, it must be recognised that others in the process 
industries have not found it necessary’. 

One aspect of quantification which has attracted less 
criticism is the modelling of consequences. Certainly there 
are many comments on the wide disparities in the results 
from different models of particular physical phenomena, 
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Figure 9.54 Effectiveness of hazard warning (after Pitblado and Lake, 1987); (a) simple hazard warning tree; 

(b) probability of failure of warning (Courtesy of the Institution of Chemical Engineers), Note: In these authors’ notation 
P T is the probability of the top event, or hazard realization; 1/1/ is the probability of failure of hazard warning and is thus 
equivalent to Lees' \N 


but there is also perhaps a feeling that there is good pros¬ 
pect of resolving these differences in due course and that 
the models are already becoming sufficiently accurate to 
give useful results. 

9.29 Overview 

There are three principal reasons why hazard assessment 
may be undertaken: 

(1) engineering decisions; 

(2) public acceptance; 

(3) regulatory requirements. 

There are important differences between these three 
situations. The first two are voluntary, while the third is 


imposed. The first is in-company, while the last two are in 
the public domain. 

Hazard assessment is undertaken by industry as an aid 
to decision-making. It assists in identifying the significant 
hazard, in choosing cost-effective countermeasures, and in 
bringing out the underlying assumptions and the condi¬ 
tions that must be met if the hazard is to be controlled. 
There is little dispute over its value for these purposes. 
Applied in this way hazard assessment has the aspect of 
hazard analysis (HAZAN). 

Debate centres on the value of hazard assessment in the 
form of probabilistic risk assessment. Here the common 
features of risk assessments in respect of consequence 
modelling appear to have obscured the fact that there are 
major differences between assessments in the treatment of 
frequency estimation. 
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Assessments tend to vary in nature according to the 
system studied. As already pointed out, the Canvey Reports 
contain little in the way of fault trees, whereas the 
Rasmussen Report contains large numbers. 

For a process plant it is possible to conduct a risk 
assessment that is based on a release source review and 
uses generic failure data.This overcomes many of the prob¬ 
lems associated with completeness of hazard identification 
and with hazard assessment using fault tree methods. On 
the other hand, the information obtained from such a study 
is of limited use. Essentially what it reveals is the risks to be 
expected if the plant is designed and operated to some 
average standard. A study of this kind appears relevant 
primarily to decisions about the siting of and development 
around a major hazard. 

A risk assessment for a process plant which starts from a 
release source review but also includes extensive hazard 
identification and assessment studies on the particular 
plant using methods such as hazop and fault trees and uti¬ 
lizing, as far as possible, plant specific data is another 
matter. Such a study involves much more work, but it also 
yields much more information and is of much greater 
assistance in engineering decision-making. It is convenient 
to refer to these two types of risk assessment as ‘generic’ 
and ‘specific’ assessments, respectively. 

The use of risk assessments in the public domain arises 
from the demand that the operator of a major hazard plant 
should demonstrate that the hazards on its plant are under 
control. In making this demand, it seems probable that the 
public is seeking assurance in respect both of the magni¬ 
tude of the hazard and of the risk of its realization. What 
the public gains from a generic assessment is a general 
picture of the hazard and the associated risks, the latter 
based on the assumption that the plant standards are 
average. 

The value to the public of a specific risk assessment is 
rather different. In this case what the public gains is the 
assurance that the company has made a detailed study of 
the hazards of its plant and that, as a result, the standards 


should not be below average. The difference between gen¬ 
eric and specific risk assessments, therefore, lies less in the 
assessment of the consequences than in that of the fre¬ 
quency. 

A full risk assessment of a major hazard plant is a sub¬ 
stantial undertaking. Much of the effort, however, lies in 
the assembly of data and models and is in some degree 
transferable to other assessments. Moreover, computer aids 
are now available which besides carrying out the actual 
calculations, also provide a framework and set of default 
data and models. 

Some aspects of risk assessment, therefore, may become 
virtually routine, but care is needed in identifying those 
features for which in a given case a relatively routine 
treatment may be appropriate and those that require 
detailed study. The aim should be to free the engineer to 
concentrate on the latter. It is such detailed studies that are 
most likely to yield useful results. 

A risk assessment should be realistic rather than conser¬ 
vative. In engineering design, it is not uncommon for a num¬ 
ber of safety factors to be introduced at the various stages. 
This approach is not suitable in risk assessment. The use of 
excessively conservative assumptions leads to overly pessi¬ 
mistic and unrealistic risk estimates that are of little value 
for decision-making. The assessed risks should be ‘best esti¬ 
mates’. The decision-makers can then treat these results with 
whatever degree of conservatism they think appropriate. 

Risk assessment has undergone substantial develop¬ 
ment in recent years and the pace of change is still rapid. 
The methodology is still only barely adequate for the tasks 
often required of it. This should be borne in mind when 
evaluating the assessed risks. 

The numerical risk results are only one of the outputs 
from a risk assessment. Equally important, and perhaps 
more so, are the other findings such as the identification 
and ranking of hazards, the identification and assessment 
of engineering measures to avoid, protect against and 
mitigate hazards, and an appreciation of the conditions 
necessary to keep hazards well controlled. 
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10.1 Plant Siting 

Safety is a prime consideration in plant siting. Other 
important factors include: access to raw materials and to 
markets; availability of land, labour and cooling water; 
means of effluent disposal; interlinking with other plants; 
and government policies, including planning permission 
and investment incentives. It is only safety aspects which 
are considered here. 

As far as safety of the public is concerned, the most 
important feature of siting is the distance between the site 
and built-up areas. Sites range from rural to urban, with 
population densities varying from virtually zero to high. 
Separation between a hazard and the public is beneficial in 
mitigating the effects of a major accident. An area of low 
population density around the site will help to reduce 
casualties. In the ideal case, the works is surrounded by 
fields or waste land forming a complete cordon sanitaire. In 
many situations, however, it is unattractive to ‘sterilize’ a 
large amount of land in this way, particularly in an urban 
area, where land is generally at a premium. 

The physical effects of a major accident tend to decay 
quite rapidly with distance. Models for fire give an inverse 
square law decay, as do many of the simpler models for 
explosion and toxic release, though other explosion and 
toxic release models give different decay relations, some 
with less rapid decay. Decay laws were discussed in Chap¬ 
ter 9 and further treatments are given in Chapters 15-17. 

Information on the potential effects of a major accident 
on the surrounding area is one of the main results obtained 
from a hazard assessment and such an assessment is of 
assistance in making decisions on plant siting. 

Siting is not a substitute for high standards of design and 
operation of the plant. It should never he forgotten that the 
people most at risk are the people on site, and standards 
should be such as to safeguard this workforce. It is some¬ 
times argued in fact that standards should be sufficiently 
high so that separation between site and public is not 
necessary. Such standards, however, are essentially a form 
of active protection, which depends crucially on the quality 
of management. In most countries, including the United 
Kingdom, the view is taken that it is prudent nevertheless 
to have a degree of separation.The provision of a separation 
distance is a form of passive protection which provides a 
further mitigating factor and which is relatively robust in 
the event of deterioration in the plant management. 

In terms of hazard warning, separation tends to create a 
hazard, which will give more warnings and which is 
therefore less unforgiving. 

Topography is another relevant feature. It is desirable to 
avoid terrain where hazardous fluids, whether liquids or 
dense gases, can flow down into populated areas. Another 
consideration to be taken into account is contamination of 
water courses by liquid spills. 

In selecting a site, allowance should be made for site 
emergencies. One factor is the availability of emergency 
utilities such as electrical power and water. Another is the 
availability and experience of outside emergency services, 
particularly the fire service. A third is access for these 
services. 

A discussion of siting for high toxic hazard materials 
(HTHMs) is given in the CCPS HTHM Storage Guidelines 
(1988/2). Siting policy for major hazard plants in the United 
Kingdom was discussed in Chapter 4. Selected references 
on plant siting are given in Table 10.1. 


Table 10.1 Selected references on plant siting 


NRC (Appendix 28: Siting); Cremer (1945); Mohlman 
(1950); Bierwert and Krone (1955); Greenhut (1956); von 
Allmen (1960); J. A. Gray (1960); Anon. (1964b); Risinger 
(1964i); Liston (1965); Fryer (1966); Farmer (1967a,b, 
1969a,b); R. Reed (1967); Fowler and Spiegelman (1968); 
Kaltenecker (1968); G.D. Bell (1970); Otway and Erdmann 
(1970); Speir (1970); Tucker and Cline (1970);Yocom, Collins 
and Bowne (1971); Gronow and Gausden (1973); Balemans 
etal. (1974); Cross and Simons (1975); Roskffl (1976); 
Weismantel (1977); Cremer and Warner (1978); Slater (1979); 
Dalai (1980); Kletz (1980h); Granger (1981); Considine, 
Grint and Holden (1982); Lovett, Swiggett and Cobb (1982); 
Ramsay, Sylvester-Evans and English (1982); Landphair 
and Motloch (1985) 


10.2 Plant Layout 

Plant layout is a crucial factor in the economics and safety 
of process plant. Some of the ways in which plant layout 
contributes to safety and loss prevention (SLP) are: 

(1) segregation of different risks; 

(2) minimization of vulnerable pipework; 

(3) containment of accidents; 

(4) limitation of exposure; 

(5) efficient and safe construction; 

(6) efficient and safe operation; 

(7) efficient and safe maintenance; 

(8) safe control room design; 

(9) emergency control facilities; 

(10) fire fighting facilities; 

(11) access for emergency services; 

(12) security. 

Plant layout can have a large impact on plant economics. 
Additional space tends to increase safety, but is expensive 
in terms of land and also in additional pipework and oper¬ 
ating costs. Space needs to be provided where it is neces¬ 
sary for safety, but not wasted. 

The topics considered under the heading of ‘plant layout’ 
are traditionally rather wide ranging. Many of these sub¬ 
jects are treated here in separate chapters and only a brief 
treatment is given in this one. This applies in particular to 
such topics as hazard assessment, emission and disper¬ 
sion, fire and fire protection, explosion and explosion pro¬ 
tection, storage and emergency planning. 

A general guide to the subject is given in Process Plant 
Layout (Mecklenburgh, 1985). This is based on the work of 
an Institution of Chemical Engineers (IChemE) work¬ 
ing party and expands an earlier guide Plant Layout 
(Mecklenburgh, 1973).The treatment of hazard assessment 
in particular is much expanded in this later volume. The 
loss prevention aspects of plant layout have also been 
considered specifically by Mecklenburgh (1976). 

Other work on plant layout, and in particular SLP, 
includes that of: Armistead (1959), R. Kern (1977a-f, 
1978a-f) and Brausbacher and Hunt (1993), on general 
aspects and spacing recommendations; Simpson (1971) and 
R.B. Robertson (1974a, 1976b), on fire protection; Fowler and 
Spiegelman (1968), the Manufacturing Chemists Associa¬ 
tion (MCA, 1970/18); Balemans et al. (1974) and Drewitt 
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(1975), on checklists; and Madden (1993), on synthesis 
techniques. 

Plant layout is one of the principal aspects treated in 
various versions of the Dow Guide by the Dow Chemical 
Company (1994b). It is also dealt with in the Engineering 
Design Guidelines of the Center for Chemical Process Safety 
(CCPS, 1993/13). There are also a large number of codes 
relevant to plant layout, and particularly separation dis¬ 
tances and area classification. These are described below. 

The treatment given here for the most part follows that of 
Mecklenburgh, except where otherwise indicated. It is 
appropriate to repeat here, his caution that the practice 
described should be regarded only as typical and that it may 
need to bemodifiedinthelightoflocalconditions, legislation 
and established safe practices. In particular, the account 
given generally assumes a‘green-field’ site, and some com¬ 
promise is normally necessary for an existing site. 

Selected references on plant layout are given inTable 10.2. 


10.3 Layout Generation 

10.3.1 Factory layout 

For factories generally there are a number of different 
principles on which plant layoutmaybebased(Muther, 1961). 

Table 10.2 Selected references on plant layout 


Cremer (1945); Mallick and Gaudreau (1951); Shubin and 
Madeheim (1951); Muther (1955,1961,1973); McGarry (1958); 
Armistead (1959); R. Reed (1961,1967); EEUA (1962 
Document 12,1973 Hndbook 7); J.M. Moore (1962); ABCM 
(1964/3); Dow Chemical Co. (1964,1966a,b, 1976,1980,1987, 
1994); Duggan (1964a); Jenett (1964c); Landy (1964a-c); 
Risinger (1964i); R. Wilson (1964b); Liston (1965,1982); IP 
(1980 Eur. MCSP Pt 2,1981 MCSP Pt 3,1987 MCSP Pt 9,1990 
MCSP Pt 15); R. Kern (1966,1977 series, 1978b): 

M.W. Kellogg Co. (1967); BCISC (1968/7); Fowler and 
Spiegelman (1968); Kaltenecker (1968); House (1969); 
Proctor (1969); British Cryogenics Council (1970); 

J.R. Hughes (1970); ICI/RoSPA (1970IS/74); Kaess (1970); 
Sachs (1970); Tucker and Cline (1970); Bush and Wells (1971, 
1972); Simpson (1971); Guill (1973); Mecklenburgh (1973, 
1976,1982,1985); Pemberton (1974); R.B. Robertson 
(1974a,b, 1976a,b); Unwin, Robins and Page (1974); Falconer 
and Drury (1975); Beddows (1976); Harvey (1976,1979b); 
Spitzgo (1976); Rigby (1977); Kaura (1980b); Kletz (1980h, 
1987c); FY. Anderson (1982); O’Shea (1982); Goodfellowand 
Berry (1986); Brandt etal. (1992); Meissner and Shelton 
(1992); Bausbacher and Hunt (1993); Madden (1993); 

Briggs (1994) ANSI A, A10, A37 and D series, BS 5930:1981 

Layout techniques 

Mecklenburgh (1973,1976,1985); Sproesser (1981); Nolan 
and Bradley (1987); Madden, Pulford and Shadbolt (1990); 
Madden (1993). 

Virtual reality: IEE (1992 College Digest 92/93) 

Civil engineering, including foundations 

ASCE (Appendix 27, 28); Urquhart (1959); Biggs (1964); 
ASTM (1967); MacNeish (1968); Benjamin and Cornell (1970); 
Tomlinson (1980); Carmichael (1982); M. Schwartz 
(1982a—c, 1983a—e, 1984); Pathak and Rattan (1985); 
Blenkinsop (1992); BS (Appendix 27 Civil Engineering, 
Construction), BS 6031:1981, BS 8004:1986, BS COP 2010: 
1970—, BS COP 2012:1974- 


Equipment weights: El-Rifai (1979) 

Hazardous area classification (see Table 16.2) 
Materials handling 

Woodley (1964); Smego (1966); R. Reed (1969); Department 
of Employment and Productivity (1970); Brook (1971); DTI 
(1974); Pemberton (1974); Sussams (1977); Chemical 
Engineering (1978b) 

In-works transport, roads 

HSE (1973 TON 44); Mecklenburgh (1973,1985); HSE (1985 
IND(G) 22 (L); 1992 GS 9) 

Separation distances 

C. W.J. Bradley (n.d., 1985); Armistead (1959); Dow Chemical 
Co. (1964,1966a, 1976,1980,1987,1994); Scharle (1965); 
HomeOffice (1968/1,1971/2,1973/4); Masso and Rudd (1968); 
Goller (1970); J.R. Hughes (1970); ICI/RoSPA (1970 IS/74); 
Laska (1970); Simpson (1971); OIA (1972 Publication 631); 
HSE (1973 HSW Booklet 30); Mecklenburgh (1973,1976, 
1985); Unwin, Robins and Page (1974); Butragueno and 
Costello (1978); IP (1980 Eur. MCSP R 2,1981 MCSP R 3, 
1987 MCSP R 9); API (1981 Refinery Inspection Guide 
Chapter 13,1990 Std 620,1993 Std 650); Nolan and Bradley 
(1987); D.J. Lewis (1989b); Martinsen, Johnsen and Millsap 
(1989); NFPA (1989 NFPA 50A, 50B, 1992 NFPA 58,59); 
IRI (1991,1992); LPGLTA (1991-LPG Code) 

Control rooms 

Bradford and Culbertson (1967); Burns (1967); Prescott 
(1967); Schmidt (1971); E. Edwards and Lees (1973); 
Mecklenburgh (1973,1976,1985); VC. Marshall (1974, 
1976a,c,d); Kletz (1975e); Anon. (1976 LPB11, p. 16); 

Gugan (1976); Harvey (1976,1979b); Langeveld (1976); 
Anon. (1977 LPB 16, p. 24); Balemans and van de Putte 
(1977); CIA (1979); Cannalire et al. (1993) 

Emergency shelters 
Johnston (1968); Lynskey (1985) 

Indoor plants 

R. Kern (1978a); Munson (1980) 

Storage 

FPA (1964/1); IP (1980 Eur. MCSP R 2,1981 MCSP R 3,1987 
MCSP R 9); Home Office (1968/1,1971/2,1973/4); 

J.R. Hughes (1970); ICI/RoSPA (1970 IS/74); HSE (1973 HSW 
Booklet 30); Wirth (1975); Hrycek (1978); D.W. Johnson and 
Welker (1978); Aarts and Morrison (1981); NFPA (1986 
NFPA 43C, 1989 NFPA 50A, 50B, 1990 NFPA 43A, 50,59A, 
1992 NFPA 58,59,1993 NFPA 43B); LPGITA (1991LPG 
Code 1R1) 

Fire prevention and protection 

FPA (CFSD FPDG 2); IRI (1964/5); BCISC (1968/7); IP (1980 
Eur. MCSP R 2,1981 MCSP R 3,1987 MCSP R 9,1993 MCSP 
R19); Home Office (1974- Manual of Firemanship); 

J.R. Hughes (1970); ICI/RoSPA (1970 IS/ 74); Simpson 
(1971); Mecklenburgh (1973,1976,1985); R.B. Robertson 
(1974a,b, 1976a, b); Klootwijk (1976); Kaura (1980a) 

J.D. Brown and Shannon (1963a,b); Seppa (1964); ICE 
(1969); Mecklenburgh (1973,1976,1985); Klootwijk (1976); 
Anon. (1978 LPB 19, p. 10); Elton (1980); Gallagher (1980); 

D. Stephenson (1981b); Easterbrook and Gagliardi (1984); 
Mason and Arnold (1984); Chieu and Foster (1993); Crawley 
(1993 LPB 111); BS 8005:1987- 
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Barge mounted and ocean-borne plants 

Birkeland etal. (1979); Charpentier (1979); Glaser, 

Kramer and Causey (1979); J.L. Howard and Andersen 
(1979); Jackson (1979); Jansson et al. (1979); Shimpo (1979); 
Ricci (1981); H.R. James (1982); de Vilder (1982) 

Plant identification 

NFPA (1990 NFPA 901); API (1993 RP1109); BS (Appendix 
27 Identification of Equipment), BS 1710:1984, BS 5378: 
1980- 

Hazard assessment 

Mecklenburgh (1982,1985) 


Thus, in light engineering, use is made of layouts in which 
the material fabricated remains in a fixed position and 
others in which a particular process or function is per¬ 
formed at a fixed point. 


10.3.2 Flow principle 

For process plants, however, the most appropriate method is 
generally to lay the plant out so that the material flow follows 
the process flow diagram. Thisistheprocess flow principle. 
This arrangement minimizes the transfer of materials, 
which is desirable both for economics and safety. It is 
difficult to overemphasize the importance of efficient 
materials handling. It has been estimated by the Department 
of Trade and Industry (DTI, 1974) that about a quarter of the 
production costs of manufacturing industry generally are 
for materials handling - an activity which in itself is totally 
unproductive. 

Likewise, long runs of pipework with vulnerable fea¬ 
tures are an undesirable addition to the hazards of the 
plant. There are features which can lead to the layout 
sequence diverging from the process sequence. They relate 
particularly to: requirements for gravity flow; equipment 
needing specially strong foundations; access for con¬ 
struction, commissioning, operation and maintenance; 
future extension; operator protection; escape and fire 
fighting; containment of accidents; and environmental 
impact. 


10.3.3 Correlation and compatibility 

There are certain other layout approaches which are used 
for factory layouts generally and which merit mention. 
Correlation and compatibility techniques are used for the 
elimination of layout arrangements which are incompatible 
or impossible, and also for the preliminary formulation of 
compatible arrangements. 

In the correlation chart method, for example, the proce¬ 
dure is as follows. The constraints and objectives are listed. 
The floor space is subdivided into a grid and for each item 
the grid divisions which violate the constraints are deleted. 
The permissible layouts are then determined. There is a 
corresponding algebraic method. 

Proximity and sequencing techniques are available for 
the determination of the costs of material transfer with 
different layouts. 

These general factory layout techniques are described 
in more detail by Mecklenburgh (1973), but he states that 
they appear to have found little application in process plant 
layout. 


10.3.4 Process plant layout 

As with design generally, the design of a process plant lay¬ 
out involves first synthesis and then analysis. Despite its 
importance, there is relatively little written on the genera¬ 
tion of the layout. An indication of some of the principles 
which guide the designer has been given by Madden (1993). 
He describes a structured approach to the generation of the 
layout which has four stages: (1) three-dimensional (3D) 
model, (2) flow, (3) relationships and (4) groups. 

10.3.5 Three-dimensional model 

The first step is to produce a 3D model of the space occu¬ 
pied by each item of equipment. This 3D envelope should 
include space for (1) operations access, (2) maintenance 
access and (3) piping connections. The effect of allowing for 
these aspects is generally to increase several-fold the 
volume of the envelope. 

10.3.6 Flow 

The concept of ‘flow’ as used by Madden has two meanings: 

(1) progression of materials towards a higher degree of 
completion, and (2) mass flows of process or utility mate¬ 
rials. Often the two coincide, but where there is a feature 
such as a recycle the relationship is less straightforward. 

10.3.7 Relationships 

A relationship exists between two items when they share 
some common factor. Relationships may be identified by 
considering the plant from the viewpoint of each discipline 
in turn. Broad classes of relationship are (1) process, 

(2) operations, (3) mechanical, (4) electrical, (5) structural 
and (6) safety. 

Process relationships are exemplified by: direct flow 
diagram connectivity between items; gravity flow; 
hydraulics and net positive suction head (NPSH) require¬ 
ments; and heat interchange and conservation. Operations 
relationships include multiple items with similar features, 
for example batch reactors and centrifuges. Examples of 
mechanical relationships are the space needed between 
items for piping and transmission or isolation of vibra¬ 
tions. Electrical relationships may be associated with elec¬ 
trical area classification and with high voltage or power 
features. Structural features include the grouping together 
of heavy items and the location of heavy items on good 
ground. Some safety features are separation between 
potential leak sources and ignition sources and the provi¬ 
sion of a sterile area such as that around a flare. 

10.3.8 Groups 

From the relationships identified it is then necessary to 
select those which are to be given priority. It is then possible 
to arrange the items into groups. It is found by experience 
that a group size of about seven items is the largest which a 
layout designer can readily handle; above this number the 
arrangement of items within the group becomes exces¬ 
sively complex. A typical group is a distillation column 
group consisting of the column itself and its associated 
heat exchangers, etc. 

10.3.9 Segregation 

A relationship of particular importance in plant layout is 
that between a hazard and a potential target of that hazard. 
The minimization of the risk to the target is effected by 
segregating the hazard from the target. The requirement 
for segregation therefore places constraints on the layout. 
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10.4 Layout Techniques and Aids 

There are a number of methods available for layout design. 
These are generally more applicable to the analysis rather 
than the synthesis of layouts, but some have elements of 
both. They include: 

(1) classification, rating and ranking; 

(2) critical examination; 

(3) hazard assessment; 

(4) economic optimization. 

There are also various aids, including: 

(5) visualization aids; 

(6) computer aids. 

10.4.1 Classification, rating and ranking 

There are several methods of classification, rating and 
ranking which are used in layout design. The main techni¬ 
ques are those used for the classification of (1) hazardous 
areas, (2) storage, (3) fire fighting facilities and (4) access 
zones, together with methods based on hazard indices. 

Hazardous area classification is aimed at the exclusion of 
ignition sources from the vicinity of potential leak sources 
and involves the definition of zones in which control of 
ignition sources is exercised to differing degrees. It is 
described in Section 10.12 and Chapter 16. 

Storage classification is based on the classification of the 
liquids stored. Accounts are given in Section 10.10 and 
Chapter 22. 

Closely related is classification based on fire fighting 
requirements, since this is applicable particularly to stor¬ 
age. 

Restriction of access may be required near major hazard 
plants or commercially sensitive processes. Areas are 
therefore classified by the need to control access. 

10.4.2 Critical examination 

Critical examination, which is part of the technique of 
method study (Currie, 1960), may be applied to plant layout. 
This application has been described by Elliott and Owen 
(1968). In critical examination of plant layout, typical 
questions asked are: Where is the plant equipment placed? 
Why is it placed there? Where else could it go? 

The technique therefore starts with and involves analy¬ 
sis of a proposed layout, but insofar as other possible 
solutions are suggested, it may be regarded also as a 
method for the generation of alternatives which can then be 
evaluated. 

As already mentioned in Chapter 8, the working docu¬ 
ment in an early hazard study is a plant layout diagram, 
and to this extent such a hazard study may be regarded as a 
form of critical examination of layout. 

10.4.3 Hazard assessment 

Hazard assessment of plant layout is practised both in 
respect of major hazards which affect the whole site, and of 
lesser hazards, notably leaks and their escalation. The tra¬ 
ditional method of dealing with the latter has been the use 
of minimum safe separation distances, but there has been 
an increasing trend to supplement the latter with hazard 
assessment. An account of hazard assessment is given 
in Chapter 9 and its role in plant layout is discussed in 
Sections 10.5 and 10.13. 


10.4.4 Economic optimization 

The process of layout development generates alternative 
candidate layouts and economic optimization is a principal 
method of selection from among these. The points at which 
such economic optimization is performed are described in 
Section 10.5. Some factors which are of importance for the 
cost of a plant layout include foundations, structures, pip¬ 
ing and pipetracks, and pumps and power consumption. 

10.4.5 Visualization aids 

There are various methods of representing the plant to 
assist in layout design. These include drawings, cutouts, 
block models and piping models. Cutouts are a two- 
dimensional (2D) layout aid consisting of sheets of paper, 
cardboard or plastic which represent items in plan, whe¬ 
ther whole plots or items of equipment, and are overlaid on 
the site or plot plan, as the case may be. The other main 
physical aids are 3D. Block models are very simple models 
made from wood blocks or the like which show the main 
items of equipment and are used to develop plot and floor 
plans and elevations. Piping models include the pipework, 
are more elaborate, and can constitute up to 0.5% of the 
total installed plant cost. They are useful as an aid to: 
doing layout drawings; determining piping layout and 
avoiding pipe fouls; positioning valves, instruments, etc.; 
checking access for operation and maintenance; planning 
construction and executing it; and operator training. 

10.4.6 Computer aids 

Plant layout is one of the areas in which computer aided 
design (CAD) methods are now widely used. One type of 
code gives visualization of the layout. This may take a 
number of forms. One is a 2D layout visualization equiva¬ 
lent to cutouts. Another is a 3D visualization equivalent to 
either a block model or a piping model, but much more 
powerful. The visualization packages available have 
become very sophisticated and it is possible in effect for the 
user to sit at the display and take a ‘walk’ through the plant. 
A recent development is enhancement by the use of the 
techniques of virtual reality. Typically, such CAD pack¬ 
ages not only give 3D display but hold a large amount of 
information about the plant such as the coordinates of the 
main items and branches, the piping routes, the materials 
list, etc. 

A particular application of 3D visualization codes is as 
input to other computer programs such as computational 
fluid dynamics codes for explosion simulation. The 3D 
layout required for the latter is provided by the 3D visual¬ 
ization code, which then forms the front end of the total 
package. 

Another type of code tackles the synthesis of layouts. 
The general approach is to define a priority sequence for 
locating items of equipment inside a block and then for the 
location of the block. The pipework is then added and cos¬ 
ted. Such a method has been described by Shocair (1978). 

A third type of code deals with the analysis of layouts to 
obtain an economic optimum. Typical factors taken into 
account in such programs include the costs of piping, space 
and buildings. A program of this type has been described 
by Gunn (1970). 

The extent to which computer aids are used in the design 
of plant layout is not great, but some visualization packages 
are very powerful and are likely to find increasing appli¬ 
cation. Computer techniques for plant layout are described 
in more detail in Chapter 29. 
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10.5 Layout Planning and Development 

10.5.1 Layout activities and stages 

Plant layout is usually divided into the following activities: 

(1) site layout; 

(2) plot layout; 

(3) equipment layout. 

The layout developed typically goes through three 
stages: 

(1) Stage One layout; 

(2) Stage Two layout; 

(3) Final layout. 

The sequence of layout development described by 
Mecklenburgh is: 

(1) Stage One plot layout; 

(2) Stage One site layout; 

(3) Stage Two site layout; 

(4) StageTwo plot layout. 

Typical stages in the development of a plant layout are 
given in Table 10.3. The Stage Two and Final Stage design 
network is shown in simplified form in Figure 10.1. The 
process of layout development makes considerable use of 


Table 10.3 Typical stages in the development 
of a plant layout (after Mecklenburgh, 1985) 
(Courtesy of the Institution of Chemical Engineers) 


A 

Stage One plot layout 

1 

Initial plot data 

2 

First plot layout 

3 

Elevation 

4 

Plot plan 

5 

Plot buildings 

6 

Second plot plan 

7 

Hazard assessment of plot layout 

8 

Layout of piping and other connections 

9 

Critical examination of plot layout 

B 

Stage One site layout 

10 

Initial site data 

11 

First site layout 

12 

Hazard assessment of site layout 

13 

Site layout optimization 

14 

Critical examination of site layout 

15 

Site selection 

C 

StageTwo site layout 

16 

StageTwo site data 

17 

StageTwo site layout 

D 

StageTwo plot layout 

18 

StageTwo plot layout data 

19 

StageTwo plot layout 


guidelines for separation distances. These are described in 
Section 10.11 

Stage One is the preliminary layout, also known as the 
conceptual, definition, proposal or front end layout. In this 
stage consideration is given to the various factors which are 
important in the layout, which may threaten the viability of 
the project if they are not satisfactorily resolved and which 
are relevant to site selection. 

10.5.2 Stage One plot layout 

In the Stage One plot layout, the information available 
should include preliminary flow sheets showing the major 
items of equipment and major pipework, with an indication 
of equipment elevations, and process engineering designs 
for the equipment. The plot layouts are then developed fol¬ 
lowing the process flow principle and using guidance on 
preliminary separation distances. The plot size generally 
recommended is 100 mx 200 m with plots separated from 
each other by roads 15 m wide. 

For each plot layout the elevation and plan are further 
developed. The proposed elevation layouts are subjected to a 
review such as critical examination which generates 
alternatives, and these alternatives are costed. Similarly, 
alternative plan layouts are generated accommodating the 
main items of equipment, pipework, buildings and cable runs, 
and are reviewed to ensure that they meet the principal 
constraints. These include construction, operation, mainte¬ 
nance, safety, environment and effluents. The plan layouts 
are then costed. The justification for the use of buildings is 
examined.The civil engineering aspects are then considered, 
including foundations and support and access structures. 

The outcome of this process for each plot is a set of 
candidate layouts. These are then presented for view as 
layout models in block model or computer graphics form. 
The different disciplines can then be invited to comment. 
These plot layouts are then costed again and a short list is 
selected, preferably of one. 

The plot layouts are then subjected to hazard assess¬ 
ment. This assessment is concerned largely with the smal¬ 
ler, more frequent leaks which may occur and with sources 
of ignition for such leaks. The process of hazardous area 
classification is also performed. Hazard assessment and 
hazardous area classification are described in Sections 
10.12 and 10.13. 

Studies are carried out to firm up on piping and piping 
routes and on electrical mains routes. Finally, each plot 
layout is subjected to a critical examination, typically 
using a model and following a checklist. 

10.5.3 Stage One site layout 

The Stage One plot layouts provide the information neces¬ 
sary for the Stage One site layout. These include the size 
and shape of each plot, the desirable separation distances, 
the access requirements and traffic characteristics. The 
flow of materials and utilities on the site are represented in 
the form of site flowsheets. 

the process plots hut also storage and terminals, utilities, 
process and control buildings, non-process buildings and 
car parks, and the road and rail systems. The flow principle is 
again followed in laying out the plots, but may need to be 
modified to meet constraints. Guidance is available on 
separation distances for this preliminary site layout. 

Hazard assessment is then performed on the site layout 
with particular reference to escalation of incidents and to 
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Figure 10.1 Simplified Stage Two and Final Stage design network (Mecklenburgh, 1985). ELD (Courtesy of the 
Institution of Chemical Engineers) engineering line diagram 


vulnerable features such as service buildings and build¬ 
ings just over the site boundary. 

If alternative site layouts have been generated, they are 
then costed and the most economic identified. The site lay¬ 
out is then subjected to a critical examination. If there is a 
choice of site, the selection is made at this point. 

10.5.4 Stage Two site layout 

Stage Two layout is the secondary, intermediate or sanction 
layout. As the latter term implies, it is carried out to provide 
a layout which is sufficiently detailed for sanction purposes. 
It starts with the site layout and then proceeds to the layout. 

At this stage information on the specific characteristics 
of the site is brought to bear, such as the legal requirements, 
the soil and drainage, the meteorological conditions, the 
environs, the environmental aspects and the services. Site 
standards are set for building lines and finishes, service 
corridors, pipetracks and roads. 

Stage Two layout involves reworking the Stage One site 
layout in more detail and for the specific site, and repeating 
the hazard assessment, economic optimization and critical 
examination. 

Features of the specific site which may well influence 
this stage are: planning matters; environmental aspects; 
neighbouring plants, which may constitute hazards and/or 
targets; other targets such as public buildings; and road, 
rail and service access points. 

At this stage, there should be full consultation with the 
various regulatory authorities, insurers and emergency 
services, including the police and fire services. 

A final site plan is drawn up in the form of drawings and 
models, both physical and computer-based ones, showing 


in particular the layout oftheplots within the site, the main 
buildings and roads, railways, service corridors, pipe- 
tracks and drainage. 

10.5.5 Stage Two plot layout 

There then follows the Stage Two plot layout. The informa¬ 
tion available for this phase includes (1) standards, (2) site 
data, (3) Stage Two site layout, (4) process engineering 
design and (5) Stage One plot layout. The standards include 
international and national standards and codes of practice, 
company standards and contractor standards. The process 
engineering design data include the flowsheets, flow dia¬ 
grams, equipment lists and drawings, process design data 
sheets and pipework line lists. 

TheStageTwo plot layout involves reworking in more detail 
and subject to the site constraints the plot plans and layouts 
and repeating the hazard assessment, piping layout and 
critical examination. The reworking of the plot layout, 
which occurs at node 7 in Figure 10.1, is a critical phase, 
requiring good coordination between the various disciplines. 

10.6 Site Layout Features 

10.6.1 Site constraints and standards 

Once a site has been selected the next step is to establish 
the site constraints and standards. The constraints include: 

(1) topography and geology; 

(2) weather; 

(3) environment; 

(4) transport; 

(5) services; 

(6) legal constraints. 
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Topographical and geological features are those such 
as the lie of the land and its load-bearing capabilities. 
Weather includes temperatures, wind conditions, solar 
radiation, and thunderstorms. Environment covers people, 
activities and builidings in the vicinity. Services are power, 
water and effluents. Legal constraints include planning 
and building, effluent and pollution, traffic, fire and other 
safety laws, bylaws and regulations. 

Site standards should also be established covering such 
matters as: 

(1) separation distances; 

(2) building lines; 

(3) building construction, finish; 

(4) road dimensions; 

(5) service corridors; 

(6) pipebridges. 

Road dimensions include width, radius and gradient. 

10.6.2 Site services 

The site central services such as the boiler house, power sta¬ 
tion, switch station, pumping stations, etc., should be placed 
in suitable locations. This means that they should not be put 
out of action by such events as fire or flood and, if possible, 
not by other accidents such as explosion, and that they 
should not constitute sources of ignition for flammables. 

Electrical substations, pumping stations, etc., should be 
located in areas where non-flameproof equipment can be 
used, except where they are an integral part of the plant. 

Factors in siting the boiler house are that it should not 
constitute a source of ignition, that emissions from the 
stack should not give rise to nuisance and that there should 
be ready access for fuel supplies. 

10.6.3 Use of buildings 

Some or part of the plants may need to be located inside a 
building, but the use of abuilding is always expensive and it 
can create hazards and needs to be justified. Typically, a 
building is used where the process, the plant, the materials 
processed and/or the associated activities are sensitive to 
exposure. Thus the process may need a stable environment 
not subject to extremes of heat or cold or it may need to be 
sterile. The plant may contain vulnerable items such as 
high-speed or precision machinery. The process material 
may need to be protected against contamination or damage, 
including rain. The activities which the operators have to 
undertake may be delicate or skilled, or simply very fre¬ 
quent. Thus, a building may be used to encourage more 
frequent inspection of the plant. Similarly, there may be 
maintenance activities which are delicate or skilled or 
simply frequent. In some cases where there are high eleva¬ 
tions, an indoor structure may be, or may feel, safer. The 
need to satisfy customers of the product and to keep 
unsightly plant out of view are other reasons. Examples of 
the use of buildings are the housing of batch reactors, cen¬ 
trifuges and analysis instruments. 

Since ventilation in a building is generally less than that 
outdoors, a leak of flammable or toxic material tends to 
disperse more slowly and a hazardous concentration is 
more likely to build up. Moreover, if an explosion of a 
flammable gas or dust occurs the overpressure generated 
tends to be much higher. These are major disadvantages of 
the use of a building. 


10.6.4 Location of buildings 

Buildings which are the work base for a number of people 
should be located so as to limit their exposure to hazards. 

Analytical laboratories should be in a safe area, but 
otherwise as close as possible to the plants served. So 
should workshops and general stores. The latter also 
require ready access for stores materials. 

Administration buildings should be situated in a safe 
area on the public side of the security point. The main office 
block should always be near the main entrance and other 
administration buildings should be near this entrance if 
possible. Other buildings, such as medical centres, can¬ 
teens, etc., should also be in a safe area and the latter should 
have ready access for food supplies. 

All buildings should be upwind of plants which may give 
rise to objectionable features. 

Water drift from cooling towers can restrict visibility and 
cause corrosion or ice formation on plants or transport 
routes, and towers should be sited to minimize this. Another 
problem is recycling of air from the discharge of one tower to 
the suction of another, which is countered by placing towers 
cross-wise to the prevailing wind. The entrainment of 
effluents from stacks and of corrosive vapours from plants 
into the cooling towers should be avoided, as should the 
siting of buildings near the tower intakes. The positioning 
of natural draught cooling towers should also take into 
account resonance caused by wind between the towers. The 
problem of air recirculation should also be borne in mind in 
siting air-cooled heat exchangers. 

10.6.5 Limitation of exposure 

An aspect of segregation which is of particular importance is 
the limitation of exposure of people to the hazards. The mea¬ 
sures required to effect such limitation are location of 
the workbase outside, and control of entry to the high 
hazard zone. The contribution of plant layout to limitation 
of exposure, therefore, lies largely in work-base location. 
Limitation of exposure is considered more fully in Chapter 20. 

10.6.6 Segregation 

Although a layout which is economical in respect of land, 
piping and transport is in general desirable, in process 
plants it is usually necessary to provide some additional 
space and to practise a degree of segregation. The site lay¬ 
out should aim to contain an accident at source, to prevent 
escalation and avoid hazarding vulnerable targets. A block 
layout is appropriate with each plot containing similar and 
compatible types of hazard and with different types 
segregated in separate plots. 

10.6.7 Fire containment 

The site layout should contribute to the containment of any 
fire which may occur and to combating the fire. 

Features of the site layout relevant to fire hazard are 
illustrated in Figures 10.2 and 10.3 (Simpson, 1971). Figure 
10.2 shows a compact layout, which minimizes land usage 
and pipework, for a petrochemical plant consisting of a 
major process with several stages and a number of sub¬ 
sidiary processes. There are two main process areas 
and at right angles to these is an area with a row of fired 
heaters, and associated reactors, steam boilers and a stack. 

This layout has several weaknesses. The lack of fire¬ 
breaks in the main process blocks would allow a fire to 
propagate right along these, particularly if the wind is 
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Figure 10.2 Compact block layout system in the process area of a petrochemical plant with 4.5 m roads (Simpson, 
1971) (Courtesy of the Institution of Chemical Engineers) 



Figure 10.3 Block layout system in the process area of a petrochemical plant with 6 m roads (Simpson, 1971) 
(Courtesy of the Institution of Chemical Engineers) 


blowing along them, which, on the site considered it does 
for 13% of the year. There is entry to the plant area from the 
6 m roads from opposite corners, which allows for all wind 
directions. But the only access for vehicles to the process 
plots is the 4.5 m roads. In the case of a major fire, appli¬ 
ances might well get trapped by an escalation of the fire. 
The 4.5 m roads give a total clearance of about 10 m after 
allowance for equipment being set back from the road, but 


this is barely adequate as a firebreak. The layout is also 
likely to cause difficulties in maintenance work. 

The alternative layout shown in Figure 10.3 avoids these 
problems. The process areas are divided by firebreaks. 
There are more entry points on the site and dead ends are 
eliminated. The roads are 6 m wide with an effective clear¬ 
ance of 15 m. The crane access areas provide additional 
clearances for the fired heaters. 
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Other aspects of fire protection are described in Section 
10.15 and Chapter 16. 

10.6.8 Effluents 

The site layout must accommodate the systems for handling 
the effluents - gaseous, liquid and solid - and stormwater 
and fire water. The effluent systems are considered in Sec¬ 
tion 10.16 and the drain system in Section 10.17. 

10.6.9 Transport 

It is a prime aim of plant layout to minimize the distances 
travelled by materials. This is generally achieved by fol¬ 
lowing the flow principle, modified as necessary to mini¬ 
mize hazards. 

Access is required to plots for transport of materials and 
equipment, maintenance operations and emergencies. 
Works roads should be laid out to provide this to plant plots, 
ideally on all four sides. Roads should be suitable for 
the largest vehicles which may have to use them in respect 
of width, radius, gradient, bridges and pipe-bridges. 
Recommended dimensions for works roads are given by 
Mecklenburgh (1973). Road widths of 10 m and 7.5 m are sug¬ 
gested for works’ main and side roads, respectively. Standard 
road signs should be used. A road width of 7.5 m with the 
addition of free space and/or a pipe trench on the verges may 
be used to give a separation distance of 15 mbetween units. 

There are various types of traffic in a works, including 
materials, fuel, wastes, stores, food and personnel. These 
traffic flows should be estimated and their routes planned. 
Incompatible types of traffic should be segregated as far as 
possible. 

Road and rail traffic should not go through process areas 
except to its destination and even then should not violate 
hazardous area classifications. In this connection, it should 
be borne in mind that some countries still use open firebox 
engines. Railway lines should not cross the main entrance 
and should not box plants in. There should be as few rail¬ 
way crossings, crossroads, right angle bends, dead ends, 
etc., as possible. 

There should be adequate road tanker parking and rail 
tanker sidings at the unloading and loading terminals, so 
that vehicles can wait their turn at the loading gantry or 
weighbridge without causing congestion at entrances, or on 
works or public roads. 

Pedestrian pathways should be provided alongside roads 
where there are many people and much traffic. Bridges may 
need to be provided at busy intersections. Car and bus 
parks and access roads to these should be situated in a safe 
area and outside security points. The park for nightshift 
workers should be observable by the gatekeeper. There 
should be gates sited so that the effect of shift change on 
outside traffic is minimized. 

10.6.10 Emergencies 

There should be an emergency plan for the site. This is 
discussed in detail in Chapter 24. Here consideration is 
limited to aspects of layout relevant to emergencies. 

The first step in emergency planning is to study the 
scenarios of the potential hazards and of their develop¬ 
ment. Plant layout diagrams are essential for such stu¬ 
dies. Emergency arrangements should include an 
emergency control centre. This should be a specially 
designated and signed room in a safe area, accessible 
from the public roads and with space around it for emer¬ 
gency service vehicles. 


Assembly points should also be designated and signed 
in safe areas at least 100 m from the plants. In some cases, it 
may be appropriate to build refuge rooms as assembly 
points. A control room should not be used either as the 
emergency control centre or as a refuge room. 

The maintenance of road access to all points in the site is 
important in an emergency. The site should have a road 
round the periphery with access to the public roads at least 
at two points. The vulnerability of the works road system to 
blockage should be as low as possible. Data on typical fire 
services appliance dimensions and weights are given hy 
Mecklenburgh (1985). For several of these the turning circle 
exceeds 15 m. 

Arrangements should be made to safeguard supplies of 
services such as electricity, water and steam to plants in an 
emergency. Power cables are particularly vulnerable to fire 
and, if possible, important equipment should be provided 
with alternative supplies run through the plant by separate 
routes. 

10.6.11 Security 

The site should be provided with a boundary fence and all 
entrances shouldhaveagatehouse.Thenumberof entrances 
should be kept to a minimum. If construction work is going 
on in part of the works, this building site should have its 
ownboundary fence and a separate entrance and gatehouse. 
If the works boundary fence is used as part of this enclo¬ 
sure, movement between the building site and the works 
should be through an entrance with its own gatehouse. 

10.7 Plot Layout Considerations 

Some considerations which bear upon plot layout are: 

(1) process considerations; 

(2) economic considerations; 

(3) construction; 

(4) operations; 

(5) maintenance; 

(6) hazards; 

(7) fire fighting; 

10.7.1 Process considerations 

Process considerations include some of the relationships 
already mentioned, such as gravity flow and availability of 
head for pump suctions, control valves and reflux returns. 
Under this heading come also limitations of pressure drop 
in pipes and heat exchangers and across control valves and 
of temperature drop in pipes, the provision of straight runs 
for orifice meters, the length of instrument transmission 
lines and arrangements for manual operations such as 
dosing with additives, sampling, etc. 

10.7.2 Economic considerations 

As already mentioned, some features which have a particu¬ 
larly strong influence on costs are foundations, structures, 
piping and electrical cabling. This creates the incentive 
to locate items on the ground, to group items so that they 
can share a foundation or a structure, and to keep pipe and 
cable runs to a minimum. 

10.7.3 Construction 

Additional requirements are imposed by the needs of con¬ 
struction and maintenance. The installation of large and 



PLANT SITING AND LAYOUT 10/11 


heavy plant items requires space and perhaps access for 
cranes. Such items tend to have long delivery times and may 
arrive late; the layout may need to take this into account. 

Construction work may require an area in which the 
construction materials and items can be laid out. On large, 
single-stream plants major items can often be fabricated 
only on site. There needs to be access to move large items 
into place on the plant. If the plot is close to the site 
boundary, it should be checked that there will be space 
available for cranes and other lifting gear. 

10.7.4 Operation 

Access and operability are important to plant operation. 
Mention has already been made of the development of the 
3D envelope of the main items of equipment to allow for 
operation. Hazop studies, described in Chapter 8, may be 
used to highlight operating difficulties in the layout. 

The routine activities performed by the operator should 
be studied with a view to providing the shortest and most 
direct routes from the control room to items requiring most 
frequent attention. Clear routes should be allowed for the 
operator, avoiding kerbs and other awkward level changes. 

General access ways should be 0.7 m and 1.2 m wide for 
one and two persons, respectively. Routes should be able to 
carry the maximum load, which often occurs during 
maintenance. 

Stairways rather than ladders should be provided for 
main access, the latter being reserved for escape routes on 
outside structures and access to isolated points which are 
only visited infrequently. Recommended dimensions for 
stairways are an angle of 35-40° and overall width of 1 m 
with railings 0.85 m high and clearances 2.1 m. The height 
of single flights without a landing should not exceed 4.5 m. 
No workplace should be more than 45 m from an exit. 

Ladders should be positioned so that the person using it 
faces the structure and does not look into space. A ladder 
should not be attached to supports for hot pipes, since 
forces can be transmitted which can distort the ladder. 
Recommended dimensions for ladders are given by appro¬ 
priate codes. 

If plant items require operation or maintenance at eleva¬ 
ted levels, platforms should be provided. The levels are 
defined as 3.5 m above grade for vessels, 2 m above grade 
for instruments or 2 m above another platform. Platform 
floors are normally not less than 3 m apart. Headroom 
under vessels, pipes, cable racks, etc., should be 2.25 m 
minimum, reducing to 2.1 m vertically over stairways. 

Good lighting on the plant is important, particularly on 
access routes, near hazards and for instrument reading. 

Operations involving manipulation of an equipment 
while observing an indicator should be considered so that 
the layout permits this. Similarly, it is helpful when opera¬ 
ting controls to start or stop equipment to be able to see or 
hear that the equipment has responded to the signal. 

Hand valves need good access, particularly large valves 
which may require considerable physical effort to turn. 
Valves which have to be operated in an emergency should 
be situated so that access is not prevented by the accident 
through fire or other occurrences. For emergency isolation, 
however, it may be preferable to install remotely operated 
isolation valves, as described in Chapter 12. 

Batch equipment such as batch reactors, centrifuges, 
filters and driers, tends to require more manual operation, 
so that particular attention should be paid to layout for 
such items. 


Insulation is sometimes required on pipework to protect 
operating and maintenance personnel rather than for pro¬ 
cess reasons. 

10.7.5 Maintenance 

Plant items from which the internals need to be removed for 
maintenance should have the necessary space and lifting 
arrangements. Examples are tube bundles from heat 
exchangers, agitators from stirred vessels and spent cata¬ 
lyst from reactors. 

10.7.6 Hazards 

The hazards on the plant should be identified and allowed 
for in the plot layout. This is discussed in other sections, 
but some general comments may be made at this stage. 

Plot layout can make a large contribution to safety. It 
should be designed and checked with an intent to reducing 
the magnitude and frequency of the hazards and assisting 
preventive measures. The principle of segregation of 
hazards applies also to plot layout. 

Hazardous areas should be defined. They should not 
extend beyond the plot boundaries or to railway lines. It is 
economic to minimize the extent of hazardous areas and to 
group together in them items which give the same hazard 
classification. 

Plants which may leak flammables should generally be 
built in the open or, if necessary, in a structure with a roof 
but no walls. If a closed building cannot be avoided, it 
should have explosion relief panels in the walls or roof with 
relief venting to a safe area. Open air construction venti¬ 
lates plants and disperses flammables but, as already 
indicated, scenarios of leakage and dispersion should be 
investigated for the plant concerned. 

Fire spread in buildings should be limited by design, as 
should fire spread on open structures. Sprinklers and other 
protective systems should be provided as appropriate. A 
more detailed consideration of fire hazards and precautions 
is given in Chapter 16. 

Plants which may leak toxics should also generally be 
built in the open air. The hazardous concentrations for 
toxics are much lower than those for flammables, however, 
and it cannot be assumed that an open structure is always 
sufficiently ventilated. Awind of at least 8 km/h is needed 
to disperse most toxic vapours safely before they reach the 
next plant. Some toxic plants, however, require a building 
and in some cases there has to be isolation of the toxic area 
through the use of connecting rooms in which clothing is 
changed. 

Ventilation is necessary for buildings housing plants 
processing flammables or toxics. Air inlets should be sited 
so that they do not draw in contaminated air. The relative 
position of air inlets and outlets should be such that short 
circuiting does not occur. Exhaust air may need to be 
treated before discharge by scrubbing or filtering. 

Plants which are liable to leak liquids should stand on 
impervious ground with suitable slopes to drain spillages 
away. The equipment should be on raised areas which slope 
down to valleys and to an appropriate collecting point. 
Suitable slopes are about 1 in 40 to 1 in 60.Valleys should not 
coincide with walkways, and kerbs may be needed to keep 
liquid off these. The collecting points should be away from 
equipment so that this is less exposed to any fire in the 
liquid collected. The amount of liquid which may collect 
should be estimated and the collecting point should be 
designed to take away this amount. The heat generated if 
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the liquid catches fire should be determined and vulnerable 
items relocated if necessary. 

The use of pervious ground, such as pebbles, to absorb 
leaks of flammable liquids should be avoided. Such liquid 
may remain on the water table and may be brought up 
again by water from fire fighting. Other hazards which 
are prevalent mainly outside the United Kingdom include 
earthquakes and severe thunderstorms. These require 
special measures. 

Personal safety should not be overlooked in the plot lay¬ 
out. Measures should be taken to minimize injury due to 
trips and falls, bumping of the head, exposure to drips of 
noxious substances and contact with very hot or cold sur¬ 
faces. Where such hazards exist, they generally present a 
threat not just on occasion but for the whole time. 

10.7.7 Firefighting 

Access is essential for fire fighting. This is provided by the 
suggested plot size of 100 mx200 m with approaches pre¬ 
ferably on all four sides and by spacing between plots and 
buildings of 15 m. 

Fire water should be available from hydrants on a main 
between the road and the plant. Hydrant points should be 
positioned so that any fire on the plot can be reached by the 
hoses. Hydrant spacings of 48,65 and 95 m are suitable for 
high, medium and low risk plots, respectively. Plants over 
18 m high should be provided with dry riser mains and 
those over 60 m high or of high risk should be equipped 
with wet riser mains. The inlets on the ground floor to dry 
riser mains and the outlets on all floors to both types of 
main should be accessible. 

Pipes for fire water supply should be protected against 
explosion damage. Isolation valves should be provided to 
prevent loss of fire water from damaged lines and, if these 
valves are above ground level, they should be protected by 
concrete blast barriers. 

Fire extinguishers of the appropriate type and fire blan¬ 
kets should be placed at strategic points. There should be at 
least two extinguishers at each point. Some extinguishers 
should be located on escape or access routes, so that a per¬ 
son who decides to fight the fire using the extinguisher has 
a route behind him for escape. The location of other fire 
fighting equipment such as sprinklers and foam sprays is a 
matter for experts. 

Fire equipment should be located so that it is not likely to 
be disabled by the accident itself. It should be accessible 
and should be conspicuously marked. The main switchgear 
and emergency controls should have good access, pre¬ 
ferably on an escape route, so that the operator does not 
have to risk his life to effect shut-down. 

There are numerous legal requirements concerning fire, 
fire construction and fire fighting. There should be full 
consultation on this at an early stage with the works safety 
officer and with other parties, such as the local authority 
services, the Factory Inspectorate and the insurers. 

10.7.8 Escape 

A minimum of two escape routes should be provided for 
any workspace, except where the fire risk is very small, and 
the two routes should be genuine alternatives. No work¬ 
place should be more than 12-45 m, depending on the 
degree of risk, from an exit, and a dead end should not 
exceed 8 m. 

Escape routes across open mesh areas should have solid 
flooring. Escape stairways should be in straight flights. 


They should preferably be put on the outside of buildings. 
Fixed ladders may be used for escape from structures if the 
number of people does not exceed 10. Doors on escape 
routes should be limited to hinged or sliding types and 
hinged doors should open in the direction of escape. 
Handrails should be provided on escape routes across flat 
roofs. Escape routes should be signposted, if there is any 
danger of confusion, as in large buildings. They should be 
at least 0.7 m and preferably 1.2 m wide to allow the passage 
of 40 persons per minute on the flat and 20 persons per 
minute down stairways. Good lighting should be provided 
on escape routes and arrangements made to ensure a power 
supply in an emergency. The escape times of personnel 
should be estimated, paying particular attention to people 
on tall items such as distillation columns or cranes. Bridges 
between columns may be used. 


10.8 Equipment Layout 

10.8.1 General considerations 

Furnaces and fired heaters are very important. Furnace 
location is governed by a number of factors, including the 
location of other furnaces, the use of common facilities such 
as stacks, the minimization of the length of transfer lines, 
the disposal of the gaseous and liquid effluents, the 
potential of the furnace as an ignition source and the fire 
fighting arrangements. Furnaces should be sited at least 
15 m away from plant which could leak flammables. 

No trenches or pits which might hold flammables should 
extend under a furnace, and connections with underground 
drains should be sealed over an area 12 m from the furnace 
wall. The working area of the furnace should be provided 
with ventilation, particularly where high temperatures and 
high sulfur fuels are involved. 

On wall-fired furnaces there should be an escape route at 
least 1 m wide at each end and on top-fired furnaces there 
should also be an escape route at each end, one of which 
should be a stairway. The provision of peepholes and obser¬ 
vation doors should be kept to a minimum. Access to these 
may be by fixed ladder for heights less than 4 m above 
ground, but platforms should be provided for greater heights. 

Incinerators and burning areas for waste disposal 
should be treated as fired equipment. Waste in burning 
areas should be lit by remote ignition and, if it is an explo¬ 
sion hazard, blast walls should be provided. 

Chemical reactors in which a violent reaction can occur, 
may need to be segregated by firebreaks or even enclosed 
behind blast walls. 

Heat exchangers should have connecting pipework kept 
to a minimum, consistent with provision of pipe lengths 
and bends to allow for pipe stresses and with access for 
maintenance. 

Equipments which have to be opened for cleaning, emp¬ 
tying, charging, etc., may need ventilation. 

Driers in which volatile materials are driven off solids 
will generally need ventilation of the drying area and 
probably of the drier itself. If the materials are noxious, 
defraying booths may be necessary. 

Dust-handling equipment such as driers, cyclones and 
ducts may constitute an explosion hazard, but tends to be 
rather weak. It should be separated from other plant by a 
wall and vented. Vents should be short and should go 
through the roof. Some equipment such as cyclones are 
often placed outside the building and this is preferable to 
ducting a vent to the outside. Vents should pass to a safe 
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area. Mills are relatively strong and are not usually pro¬ 
vided with explosion relief. Dust should be transferred 
through chokes to prevent the transmission of fire or 
explosion. Surfaces which might collect dust should be 
kept to a minimum. Dust hazards are considered further in 
Chapter 17. 

Pumps handling liquids which are hot (> 60°C) should 
be separated from those handling liquids which are 
flammable and volatile (boiling point < 40°C) or from com¬ 
pressors handling flammable gases. In the open, separa¬ 
tion may be effected by a spacing of at least 7.5 m and in a 
pump room by a vapour-tight wall. 

Hazards associated with particular plant equipment are 
also considered in Chapter 11. 

10.8.2 Corrosive materials 

If the process materials are corrosive, this aspect should be 
taken into account in the plant layout. The layout of plants 
for corrosive materials is discussed in Safety and Manage¬ 
ment by the Association of British Chemical Manufacturers 
(ABCM, 1964/3). 

Corrosive materials are responsible for an appreciable 
proportion of accidents on chemical plants and of damage 
done to the plant. The presence of corrosive materials cre¬ 
ates two particular hazards: (1) corrosion of materials of 
construction, and (2) contact of persons with corrosive 
materials. On a plant handling corrosive chemicals, the 
materials of construction should be chosen with particular 
care, should be protected by regular painting and should be 
checked by regular inspection. 

Some features of plant layout which are particularly 
important in relation to corrosive chemicals are founda¬ 
tions, floors, walkways, staging, stairs, handrails, drains, 
ventilation. 

Foundations of both buildings and machines, especially 
those constructed in concrete, may be attacked by leakage of 
corrosive materials, including leakage from drains. If 
the corrosion is expected to be mild, it may be allowed for 
by the use of additional thickness of concrete, but if it may 
be more severe, other measures are necessary. These include 
the use of corrosion resistant asphalt, bricks and plastics. 

Floors should be sloped so that spillages are drained 
away from vulnerable equipment and from walkways and 
traffic lanes. The latter should generally be laid across the 
direction of fall and should, as far as possible, be at the high 
points of the slopes. 

Severe corrosion of steel stanchions can occur between a 
concrete subfloor and a brick floor surface, and this possi¬ 
bility should be considered. 

Pipe flanges which may drip corrosive substances 
should not be located over walkways. There should be 
guardrails around vessels or pits containing corrosive 
liquids. The floors and walkways should be of the ‘non- 
skid’ type. 

Staging should not be located over an open vessel which 
may emit corrosive vapours. 

Staircases and handrails should be designed to minimize 
corrosion. Stairheads should be located at the high points of 
sloping floors. Handrails tend to corrode internally and 
may collapse suddenly. They should be made of a suitable 
material. Aluminium is suitable, if it is not corroded by the 
atmosphere of the plant. Metal protectors of the vapour 
type are also available. These are put inside the pipe 
and the ends sealed. Alternatively, solid rails can be used. 
The rails should be protected against external corrosion 


by regular painting or other means. Regular inspection 
and maintenance is particularly important for staging, 
staircases and handrails on plants containing corrosive 
materials. 

Drains should he designed to handle the corrosive mate¬ 
rials, and mixtures of materials, which may be discharged 
into them. 

Ventilation should he provided and maintained as 
appropriate. This requires as a minimum the circulation of 
fresh air. It may also involve local exhaust ventilation. 

10.9 Pipework Layout 

In general, it is desirable both for economic and safety rea¬ 
sons to keep the pipe runs to a minimum. Additional pipe¬ 
work costs more both in capital and operation, the latter 
through factors such as heat loss/gain and pumping costs. 
It is also an extra hazard not only from the pipe itself but 
more particularly from the joints and fittings. 

The application of the flow principle is effective in mini¬ 
mizing pipe runs, but it is also necessary to practise seg¬ 
regation and this will sometimes lead to an unavoidable 
increase in the length of pipe runs. The design, therefore, 
involves a compromise between these two factors. 

Piping for fluids servicing a number of points may be in 
the form of a ring main, which permits supply to most 
points, even if part of the main is disabled. Ring mains are 
used for steam, cooling water, process water, fire water, 
process air, instrument air, nitrogen and even chlorine. 

Services such as steam and water mains and electricity 
and telephone cables should generally be run alongside the 
road and should not pass through plant or service areas. 

Pipes may be buried, run at ground level, run on sup¬ 
ports or laid in an open pipe trench. Open pipe trenches 
may be used where there is no risk of accumulation of 
flammable vapours, of the material freezing or of flooding. 

Water mains should he buried below the frost line or to a 
minimum depth of 0.75 m to avoid freezing. If they run 
under roads or concreted areas, they should be laid in ducts 
or solidly encased in concrete. 

Steam mains may be laid on the surface on sleepers. They 
should he run on the outside edge of the pipeway to allow 
the expansion loops to have the greatest width and to 
facilitate nesting of the loops. Steam mains may also be run 
in open pipe trenches. 

Electrical power and telephone cables should be run in 
sand-filled trenches covered by concrete tiles or a coloured 
concrete mix. If possible, the cables should be run at the 
high point of paving leaving room for draw boxes. If use is 
made of underground piping and cabling, it should be put 
in position at the same time as the foundation work is being 
done. Alternatively, cables can be run overhead. Overhead 
cables are less affected by spillages and are easier to 
extend, but may require fire protection. 

Electrical lines can give rise to fields of sufficient inten¬ 
sity to cause local overheating of adjacent metalwork or to 
induce static electricity in plant nearby, and this should be 
taken into account in positioning them. Pipes which are hot 
or carry solvents should be laid as far as possible from 
electrical cables. 

Piping may be run as a double layer, but triple layers 
should be avoided. Double layer piping should be run with 
servicelinesontheupperandprocesslinesonthelowerdeck. 

Piping may require a continuous slope to permit com¬ 
plete drainage for process, corrosion or safety reasons; 
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other pipes should not be sloped. Sloped lines should be 
supported on extensions of the steel structure. The slope 
arrangement should not create a low point from which 
liquid cannot be drained. 

Overhead clearances below the underside of the pipe, 
flange, lagging or support should have the following mini¬ 
mum values: 

Above roads and areas with access for crane 7 m 
Plant areas where truck access is required 4 m 

Plant areas in general 3 m 

Above access floors and walkways within 
buildings 2.25 m 

Above railway lines (from top of rail) 4.6 m 

Pipe flanges should be positioned so as to minimize the 
hazards from small leaks and drips. Flanges on pipework 
crossing roads on pipebridges should be avoided. Pipe- 
bridges over roads should be as few as possible. Every 
precaution should be taken to prevent damage from vehi¬ 
cles, particularly cranes and forklift trucks. 

Attention should be paid to the compatibility of adjacent 
pipework, the cardinal principle being to avoid loss of con¬ 
tainment of hazardous materials. Thus, it is undesirable, 
for example, to put a pipe carrying corrosive material above 
one carrying flammables or toxics at high pressure. 

Emergency isolation valves should be used to allow flows 
of flammable materials to be shut off. Valves may be manu¬ 
ally or power operated and controls for the latter may be 
sited locally or remotely. The use of such valves is described 
in more detail in Chapter 12. 

If a manual valve is used for isolation, it should be 
mounted in an accessible position. Emergency operation of 
valves from ladders should be avoided. If the valve is hori¬ 
zontally mounted and its spindle is more than 2.1 m above 
the operating level, a chain wheel should be provided. A 
valve should not be mounted in the inverted position, since 
solids may deposit in the gland and cause seizure. 

Discharges from pressure relief valves and bursting 
discs are normally piped away in a closed system. In par¬ 
ticular, a closed system is necessary for hydrocarbon 
vapours with a molecular weight greater than 60, flam¬ 
mable liquids and toxic vapours and liquids. Pressure relief 
and flare systems are considered more fully in Chapter 12. 

Liquid drains from drainage should also be taken to a 
safe point. Liquids which are not flammable or toxic may be 
discharged to grade. 

Sample points should be 1 m above the floor and not at 
eye level. 

Flexible piping should be kept to a minimum. Where such 
piping is used on vehicles, use may be made of devices 
which shut off flow if the vehicle moves away. 

Instruments incorporating glass tubing, such as sight 
glasses and rotameters, are a source of weakness. In some 
cases the policy is adopted of avoiding the use of such 
devices altogether. If this type of instrument is used, how¬ 
ever, it should be enclosed in a transparent protective case. 

The layout for piping and cabling should allow for future 
plant expansion. An allowance for 30% additional pipe¬ 
work is typical. Full documentation should be kept on all 
piping and cabling. 


book, storage is dealt with separately in Chapter 22, and 
only those features which are directly relevant to the layout 
of the plant as a whole are dealt with at this point. 

The principal kinds of storage are bulk storage of 
fluids, bulk storage of solids and warehouse storage. 
The storage of main interest in the present context is sto¬ 
rage of fluids, particularly flammable fluids. The types 
of storage include: 

(1) liquid at atmospheric pressure and temperature; 

(2) liquefied gas under pressure and at atmospheric tem¬ 
perature (pressure storage); 

(3) liquefied gas at atmospheric pressure and at low tem¬ 
perature (refrigerated storage); 

(4) gas under pressure. 

There are also intermediate types such as semi¬ 
refrigerated storage. 

For liquid storage it is common to segregate the liquids 
stored according to their class. The current classifi¬ 
cation, given in the Refining Safety Code of the Institute of 
Petroleum(IP,1981MCSPPart3)andusedinBS5908:1990,is 


Class I Liquids with flashpoint below 21°C 

Class II (1) Liquids with flashpoint from 21°C up to and 
including 55°C, handled below flashpoint 
Class II (2) Liquids with flashpoint from 21°C up to and 
including 55°C, handled at or above flash¬ 
point 

Class III (1) Liquids with flashpoint above 55°C up to and 
including 100°C, handled below flashpoint 
Class III (2) Liquids with flashpoint above 55°C up to and 
including 100°C, handled at or above flash¬ 
point 

An earlier classification, given in the former BS CP 3013: 
1974, was as follows: 

Class A Liquids with flashpoint below 22.8°C (73°F) 

Class B Liquids with flashpoint between 22.8 and 66°C (73 
and 150°F) 

Class C Liquid with flashpoint above 66°C (150°F) 

The classification given in the National Fire Protection 
Association’s (NFPA 321: 1987) Basic Classification of 
Flammable and Combustible Liquids is: 


Class I Liquids with flashpoint below 37.8°C (100°F) 

Class IA Liquids with flashpoint below 22.8°C (73°F) 
and boiling point below 37.8°C (100°F) 

Class IB Liquids with flashpoint below 22.8°C (73°F) 
and boiling point at or above 37.8°C (100°F) 
Class 1C Liquids with flashpoint at or above 22.8°C 
(73°F) and below 37.8°C (100°F) 

Class II Liquids with flashpoint at or above 37.8°C 
(100°F) and below 60°C (140°F) 

Class III Liquids with flashpoint at or above 60°C 
(140-F) 

Class IIIA Liquids with flashpoint at or above 60°C 
(140°F) and below 93.4°C (200°F) 

Class IIIB Liquids with flashpoint at or above 93.4°C 
(200°F) 


10.10 Storage Layout 

Treatments of plant layout frequently cover all aspects 
of storage, including bunding, venting, etc. In this 


NFPA 321 distinguishes between flammable and com¬ 
bustible liquids. It defines a flammable liquid as one having 
a flashpoint below 37.8°C (100°F) and having a vapour 
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pressure not exceeding 40 psia at 37.8°C (100°F), and a 
combustible liquid as one having a flashpoint at/or above 
37.8°C (100°F). 

Quantities in storage are almost invariably much greater 
than those in process. Typical orders of magnitude for a 
large plant are several hundred tonnes in process and ten 
thousand tonnes in storage. 

Storage is usually built in the open, since this is cheaper 
and allows dispersion of leaks. The site chosen should have 
good load-bearing characteristics, since tanks or vessels 
full of liquid represent a very heavy load. The design of 
foundations for storage tanks is a specialist matter. 

The storage site should be such that the contour of the 
ground does not allow flammable liquid or heavy vapour to 
collect in a depression or to flow down to an area where it 
may find an ignition source. The prevailing wind should be 
considered in relation to the spread of flammables to igni¬ 
tion sources or of toxics to the site boundary. 

Storage should be segregated from process. A fire or 
explosion in thelatter may put at risk the very large inventory 
in storage, and a small fire in storage, which is otherwise 
easily dealt with, may jeopardize the process. The storage 
area should be placed on one or at most on two sides of the 
process and well away from it. This gives segregation and 
allows room for expansion of the process and/or the storage. 
The separation distance between process and storage has 
been discussed above. It should not be less than 15 m. 

It is also necessary to keep terminals away from the pro¬ 
cess, since they are sources of accidents. A suitable layout 
is therefore to interpose the storage between the process 
and the terminals. The separation distance between storage 
and terminals should be not less than 15 m. 

The storage tanks should be arranged in groups. The 
grouping should be such as to allow common bunding, if 
bunds are appropriate, and common fire fighting equip¬ 
ment for each group. There should be access on all four 
sides of each bund area and roads should be linked to 
minimize the effect if one road is cut off during a fire. 

It is not essential that there be only one storage area, one 
unloading terminal or one loading terminal.There may well 
be several, depending on the materials and process, and the 
principle of segregation. The raw material unloading and 
the product loading terminals should be separate. Nor¬ 
mally, both should be at the site boundary near the 
entrance. If the materials are hazardous or noxious, how¬ 
ever, the terminal should not be near the entrance, although 
it may be near the site boundary, provided it does not affect 
a neighbour’s installation. 


10.11 Separation Distances 

Plant layout is largely constrained by the need to observe 
minimum separation distances. For hazards, there are 
basically three approaches to determining a suitable 
separation distance. The first and most traditional one is to 
use standard distances developed by the industry. The 
second is to apply a ranking method to decide the separa¬ 
tion required. The third is to estimate a suitable separation 
based on an engineering calculation for the particular case. 
Not all separation distances relate to hazards. Construc¬ 
tion, access and maintenance are other relevant factors. 
The first two methods of determining separation distances 
are considered in this section, and the third is considered in 
Section 10.14. 


10.11.1 Types of separation 

The types of separation which need to be taken into con¬ 
sideration are illustrated by the set of tables of separation 
distances given by Mecklenburgh (1985) and include: 

(1) site areas and sizes; 

(2) preliminary spacing for equipment 

(a) spacing between equipment, 

(b) access requirements at equipment, 

(c) minimum clearances at equipment; 

(3) preliminary spacings for storage layout 

(a) tank farms, 

(b) petroleum products, 

(c) liquefied flammable gas, 

(d) liquid oxygen; 

(4) preliminary distances for electrical area classification; 

(5) size of storage piles. 

Further types of separation used by D.J. Lewis (1980b) 
are given in Section 10.11.4. 

10.11.2 Standard distances 

There are a large number of standards, codes of practice and 
other publications which give minimum safe separation 
distances. The guidance available relates mainly to separa¬ 
tion distances for storage, either of petroleum products, of 
flammable liquids, of liquefied petroleum gas (LPG) or of 
liquefied flammable gas (LFG). 

Recommendations for separation distances are given in: 
for petroleum products, The Storage of Flammable Liquids 
in Fixed Tanks Exceeding 10,000 m 3 Total Capacity (HSE, 
1991 HS(G) 52), the Refining Safety Code (IP, 1981MCSP Pt 3), 
the American Petroleum Institute (API) standards API Std 
620:1990 and API Std 650:1988 and NFPA 30:1990 Flam¬ 
mable and Combustible Liquids Code; for LPG, in The Storage 
of LPG at Fixed Installations by the HSE (1987 HS(G) 34), 
Liquefied Petroleum Gasby the IP (1987MCSP Pt 9), the Code 
of Practice, Part 1, Installation and Maintenance of Fixed 
Bulk LPG Storage at Consumers’Premises by the Liquefied 
Petroleum Gas Industry Technical Association (LPGITA) 
(1991 LPG Code 1 Pt 1), API Std 2510:1989 and 2510A: 1989 
and NFPA 58:1989 Storage and Handling of Liquefied Petro¬ 
leum Gases; and for LFG, the ICI Liquefied Flammable 
Gases, Storage and Handling Code (the ICI LFG Code) (ICI/ 
RoSPA 1970IS/74). Another relevant code is BS 5908:1990 
Fire Precautions in the Chemical and Allied Industries. 
Separation distances are also given in many of the NFPA 
codes. 

Further guidance on separation distances and clear¬ 
ances is given by Armistead (1959), House (1969), the Oil 
Insurance Association (OIA) (1972/6), Backhurst and 
Harker (1973), Mecklenburgh (1973,1985), Kaura (1980b), 
EV. Anderson (1982) and Industrial Risk Insurers (IRI) 
(1991,1992). 

Separation distances are specified in the Fire and 
Explosion Index. Hazard Classification Guide (the Dow 
Guide) (Dow Chemical Company, 1976) as a function of the 
Fire and Explosion Index (F&EI) and the maximum 
probable property damage (MPPD). These do not appear 
as such in the current edition of the Guide (Dow 
Chemical Company, 1994b), which is described in Chapter 
8. Some tables of separation distances for storage of 
flammable liquids, for LPG and for LFG are reproduced in 
Chapter 22. 
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Separation distances for process units are usually given 
as the distances between two units or as the distance 
between a single unit and an ignition source. It is normal to 
quote distances between the edges of units and not centre to 
centre. There is generally little explanation given of the 
basis of the separation distances recommended. 

The separation distances for liquids which have a lower 
vapour pressure, including the bulk of petroleum products 
and flammable liquids, tend to be less than those for liquids 
which have a high vapour pressure and so flash off readily, 
such as LPG and LFG. It is frequently stated that for LPG 
a smaller separation distance may be allowed if there is 
provision of adequate radiation walls and/or water drench 
systems. 

There is naturally some tendency for separation dis¬ 
tances to be reproduced from one publication to another. In 
general, however, there are differences between the various 
codes and guidelines, so that the overall situation is rather 
confused. This problem has been discussed by Simpson 
(1971). 

Typical separation distances for preliminary site layouts 
are given by Mecklenburgh (1985). The table of spacings 
which he gives is shown in Table 10.4. Some interunit and 
interequipment separation distances given by IRI (1991, 
1992) are shown in Table 10.5. 

10.11.3 Rating and ranking methods 

An alternative to the use of standard separation distances 
is the utilization of some form of rating or ranking method. 
The most widely applied method of this kind is that used in 
hazardous area classification. This method ranks items by 
their leak potential. An outline of the method is given in 
Section 10.12. Another such method is the Mond Index, 
which is now described. 

10.11.4 Mond Index 

The Mond Index is one of the hazard indices described in 
Chapter 8. A particular application of this index is the 
determination of separation distances as described by 
D.J. Lewis (1980b, 1989b). In the Mond Index method two 
values are calculated for the overall risk rating (ORR), 
those before and after allowance is made for offsetting fac¬ 
tors. It is the latter rating R 2 which is used in applying the 
technique to plant layout. The ORR assigns categories 
ranging from mild to very extreme. 

(1) Flare spacing should be based on heat intensity with a 
minimum space of 60 m from equipment containing 
hydrocarbons. 

(2) The minimum spacings can be down to one-quarter 
these typical spacings when properly assessed. 

The objectives of layout are: to minimize risk to person¬ 
nel; to minimize escalation, both within the plant and to 
adjacent plants; to ensure adequate access for fire fighting 
and rescue; and to allow flexibility in combining together 
units of similar hazard potential. 

Lewis enumerates the basic concepts underlying the 
initial layout. In addition to general layout principles, he 
includes several applications of the ORR. Control and other 
occupied buildings should be adjacent to low or medium 
risk units, the latter being acceptable only if a low risk unit 
is not available and if the R 2 value is just inside the medium 
risk band. Units with the highest value of the aerial explo¬ 
sion index A 2 should not be located near to the plant 


boundary but should be separated by areas occupied by 
low risk activities and with low population densities (up to 
25 person/acre). Major pipebridges with medium to high R 2 
should be located to reduce their vulnerability to incidents 
from tall process units and from transport accidents aris¬ 
ing from normal vehicle traffic. 

Units separately assessed can he combined into a single 
unit, providing that the hazards are compatible and the 
risks similar, the potential direct and consequential losses 
do not become excessive and the reassessed R 2 value is 
acceptable. 

The initial layout is based on a nominal interunit spacing 
of 10 m. It includes pipebridges and vehicle routes. The 
nominal interunit distances are then replaced by those 
established by engineering considerations, including the 
use of guidance on minimum separation distances and of 
the ORR. 

Lewis states that the minimum separation distances 
given in the relevant codes are absolute minimum distances 
and are not necessarily good practice for new installations. 
Some situations for which separation distances are required 
are given by Lewis as follows: 

(1) distances between a unit of a particular degree of 

hazard and 

(a) another unit of the same degree, 

(b) another unit of lower or higher degree; 

(2) distances between a process unit and 

(a) a storage unit, 

(b) the bund of a storage unit; 

(3) distances between adjacent storage units containing 

materials of different flammability; 

(4) distances between a unit and 

(a) occupied buildings, 

(b) potential ignition sources, 

(c) a plant boundary, 

(d) the works boundary. 

For units, the relevant distance for the determination of 
separation is taken as that between the nearest wall, 
structural frame or free-standing equipment of the two 

Separation distances for pipebridges receive particular 
attention. For a pipebridge between two units, the separa¬ 
tion distance is between one side of the pipebridge and the 
adjacent unit. The distance should not include the plan area 
occupied by the pipebridge itself, but it is not normally 
necessary to provide two separation distances, one on each 
side of the pipebridge. A pipebridge which itself has sig¬ 
nificant potential for a hazardous release should not be 
located alongside a unit without a separation distance 
unless assessment shows that the hazard level of the com¬ 
bination of unit and pipebridge is acceptable. If it is not, 
there should he a separation between the pipebridge and all 
units, using the pipebridge separation distances given. 

The spacings for storage units given in the initial treat¬ 
ment (D.J. Lewis, 1980b) were subsequently revised 
(D.J. Lewis, 1989b). The principal changes are considerable 
increases in separation distances for the extreme and very 
extreme values of R 2 , exclusion of units which have poten¬ 
tial for ‘frothover’ or for ‘boilover’ in a fire, and restriction 
to units which are on level ground. 

The recommendations for separation distances for pro¬ 
cess units are shown in Table 10.6 and those for storage 
units in Tables 10.7 and 10.8. D.J. Lewis (1989b) gives further 
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Table 10.4 Preliminary areas and spacings for site layout (Mecklenburgh, 1985) (Courtesy of the Institution of 
Chemical Engineers) 


Administration 

10 m * 1 2 

per administration employee 

Workshop 

20 m 2 

per workshop employee 

Laboratory 

20 m 2 

per laboratory employee 

Canteen 

lm 2 

per dining space 


3.5 m 2 

per place including kitchen and store 

Medical centre 

0.1-0.15 m 2 

per employee depending 

Minimum 

10 m 2 

on complexity of service 

Fire-station (housing one fire, one 

500 m 2 

per site 

crash, one foam, one generator 
and one security vehicle) 

Garage (including maintenance) 

100 m 2 

per vehicle 

Main perimeter roads 

10 m 

wide 

Primary access roads 

6m 

wide 

Secondary access roads 

3.5 m 

wide 

Pump access roads 

3.0 m 

wide 

Pathways 

1.2 m 

wide up to 10 people/min 


2.0 m 

wide over 10 people/min 

Stairways 

1.0 m 

(e.g. near offices, canteens, bus stops) 
wide including stringers 

Landings (in direction of stairway) 

1.0 m 

wide including stringers 

Platforms 

1.0 m 

wide including stringers 

Road turning circles 


radius equal to width of road 

(90° turn and T-junctions) 

Minimum railway curve 

56 m 

inside curve radius 

Cooling towers per tower 

0.04 m z /kW 

mechanical draught 


to 0.08 m 2 /kW 

natural draught 

Boiler (excluding house) 

0.002 m 3 /kW 

(Height = 4 x Side) 




30 NA 
8 NA NA 
8 8 8 
8 30 15 

8 15 NM 

30 60 30 

8 8 8 
30 30 30 

30 30 30 

30 30 30 

60 30 30 

CP 60 30 

CP 60 30 

60 30 30 

CP 60 30 

60 60 60 
30 NA NA 
NM NM NA 
15 30 NM 

15 30 NM 

CP 30 NM 



8 NA 
30 15 NA 

60 60 60 
8 30 30 

30 60 30 

75 60 75 

60 60 60 
60 60 60 
75 75 75 

60 60 60 
60 60 60 
75 60 60 

60 60 60 
NA 30 NA 
NA NMNA 
60 60 60 
60 60 60 
30 60 60 



45 NA 
45 30 7.5 

60 60 30 

60 60 30 

60 60 30 

CP 75 30 
CP 60 30 
60 60 30 

CP 60 30 
45 60 30 

60 NA 15 
45 NM 15 
60 60 30 

60 60 30 

CP 45 30 



CP 60 60 CP CP 

15 7.5 5 60 60 NM 

CP 60 60 CP CP 60 CP 

NA NANA CP CP NA CP 
15 15 15 60 60 15 60 

15 15 15 NM NM 15 NM 

30 7.5 5 CP CP 5 CP 

15 7.5 5 CP CP 5 CP 

CP 45 60 CP CP 30 CP 



NA 15 15 2 2 

CP 60 50 CP CP 30 


NA, not applicable since no measureable distance can be determined; NM, no minimum spacing established - use engineering judgement; 
CP, reference must be made to relevant Codes of Practice but see section C.6 of the original reference. 
a See also section C.6 for minimum clearances. 

Notes: 

(1) Flare spacing should be based on heat intensity with a minimum space of 60 m from equipment containing hydrocarbons. 

(2) The minimum spacings can be down to one-quarter these typical spacings when properly assessed. 
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potential for fire and vessel explosion. Spacings for items with potential for vapour cloud explosion should be obtained by 

other means 
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recommendations for dealing with storage units with 
frothover or boilover potential and with units located on 
sloping ground. 

10.11.5 Hazard models 

Another approach to the determination of separation dis¬ 
tances is to use hazard models to determine the separation 
distance at which the concentration from a vapour escape 


or the thermal radiation from a fire fall to an acceptable 
level. This is the other side of the coin to hazard assessment 
of a proposed layout. Early accounts of the use of hazard 
models to determine separation distances include those of 
Hearfleld (1970) and Simpson (1971). 

Two principal factors considered as determining separa¬ 
tion are (1) heat from burning liquid and (2) ignition of a 
vapour escape. 
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Table 10.6 Separation distances for process units: spacings between process units and other features obtained 
using the Mond Index (D.J. Lewis, 1980b) (Courtesy of the American Institute of Chemical Engineers) 


A Minimum spacings between one process unit A and another process unit B (m) 


Overall risk 
rating R, of 
process unit A 




Overall risk rating R 2 of process unit B 



Mild 

Low 

Medium 

s High 

Very high 

Extreme 

Very extreme 

Mild 

0 

6 

9 

12 

17 

20 

30 



6 

8 

10 

15 

20 

25 

40 


Medium 

9 

10 

15 

18 

25 

30 

50 


High 

12 

15 

18 

20 

30 

40 

60 


Very high 

17 

20 

25 

30 

40 

50 

80 


Extreme 

20 

25 

30 

40 

50 

65 

100 


Very extreme 

30 

40 

50 

60 

80 

100 

150 


B Minimum spacings between 

a process 

unit and another feature (m) 



Overall risk 




Feature 




rating R 2 of 

















storage unit 

Works 

Plant 

Control 

Offices, 

Electrical 

Electrical 

Process 

Forced 


boundary 

boundary 

room 

amenity, 

switchgear, 

power 

furnaces 

draught 



works mai 


buildings, 

instrument 

lines and 

and similar 

cooling 



road. 


workshops. 

houses 

transformers 

ignition 

towers 



works mai 


laboratories, 



sources 




railway 


etc. 





Mild 

20 

15 

9 

12 

5 

0 

7 

10 

Low 

27 

20 

10 

15 

10 

5 

12 

17 

Medium 

35 

27 

15 

20 

15 

10 

17 

25 

High 

50 

35 

18 

27 

20 

15 

25 

30 

Very high 

70 

50 

25 

40 

25 

20 

30 

35 

Extreme 

120 

75 

30 

60 

30 

25 

40 

40 

Very extreme 

200 

100 

50 

75 

40 

30 

60 

50 


Permissible heat fluxes are discussed by Simpson, who 
distinguishes three levels of heat flux: 12.5 kW/m 2 (4000 
BHU/ft 2 h), 4.7 kW/m 2 (1500 BTU/ft 2 h) and 1.6 kW/m 2 
(500 BTU/ft 2 h). The first value is the limit given in the 
Building Regulations 1965 and is suggested as a suitable 
limit for buildings such as control rooms or workshops; the 
second is the threshold of pain after a short time and is 
suggested as the limit for workers out on the plant who 
must continue doing essential tasks; and the third is the 
level of minor discomfort and is suggested as the limit for 
people in adjoining areas. A more detailed discussion of 
thermal radiation criteria is given in Chapter 16. 

Simpson also considers separation distances based on 
the dilution of a vapour leak to a concentration below the 
lower flammability limit. The estimates are based on cal¬ 
culations of leak emission flows, pool vaporization rate and 
vapour cloud dispersion, as described in Chapter 15. One 
problem which he discusses is the separation between sto¬ 
rage and an ignition source for petroleum spirit and other 
flammable liquids of similar volatility. For this case, he 
concludes that in most instances a separation distance of 
15 m is adequate. 

Another problem is the separation distance between a 
petrochemical unit and an ignition source. The typical 
scenarios which he discusses give separation distances as 
high as 88 m, this being for a necked-off branch on a C 2 
fractionator. 


A further discussion of the basis for separation distances 
has been given by R.B. Robertson (1976b). 

The principle of the use of hazard models to set separa¬ 
tion distances is now recognized in codes. Liquefied Petro¬ 
leum Gas (IP, 1987 MCSP Part 9) gives separation distances 
for liquid storage units based on hazard models, as descri¬ 
bed in Section 10.14. 


10.11.6 Liquefied flammable gas 

A separation distance of 15 m frequently occurs in codes 
for the storage of petroleum products, excluding LPG. 
For LPG and LFG, the separation distances are generally 
greater. Thus in the ICI LFG Code the separation dis¬ 
tances recommended between a storage and an ignition 
source are, for ethylene, 60 m for pressure storage and 
90 m for refrigerated storage, and for C 3 compounds, 45 
m for both types of storage. The general approach there 
taken is that there is significant risk of failure for a 
refrigerated storage but negligible risk for a pressure 
storage vessel. 

Separation distances are also implied in the ICI Electrical 
Installations in Flammable Atmospheres Code (the ICI Elec¬ 
trical Installations Code) (ICI/RoSPA 1972IS/91) in that the 
code gives guidance on the radius of the electrical area 
classification zone from potential leak points. For a pump 
with a mechanical seal containing a flammable liquid with 
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Table 10.7 Separation distances for process units: spacings between storage units and process units or other storage 
units obtained using the Mond Index (D.J. Lewis, 1989b) (Courtesy of the Norwegian Society of Chartered Engineers) 


A Minimum spacings between a storage unit and a process unit: spacing to tank wall (m) 


Overall risk rating 

R 2 of storage unit 




Overall risk rating R 2 of process um 



Mild 

Low 

Medium High 

Very high 

Extreme 

Very extreme 

Mild 

3 

7 

10 

13 

18 

23 

38 

Low 

6 

9 

12 

17 

23 

30 

50 

Moderate 

9 

12 

17 

21 

31 

44 

66 

High 

12 

17 

21 

28 

43 

56 

84 

Very high 

17 

23 

31 

43 

56 

72 

110 

Extreme 

23 

30 

44 

56 

72 

97 

145 

Very extreme 

38 

50 

66 

84 

110 

145 

197 

B Minimum spacings between a storage u: 

nit and a process 

unit: spacing 

to bund wall (m) 

Overall risk rating 




Overall risk rating R 2 of process um 



R 2 of storage unit 
















Mild 

Low 

Medium High 

Very high 

Extreme 

Very extreme 

Mild 

2 

4 

5 

7 

9 

10 

15 

Low 

3 

5 

6 

8 

10 

13 

20 

Moderate 

4 

6 

8 

9 

13 

16 

26 

High 

6 

8 

9 

12 

16 

22 

33 

Very high 

8 

10 

13 

16 

22 

28 

45 

Extreme 

10 

13 

16 

22 

28 

36 

58 

Very extreme 

15 

20 

26 

33 

45 

58 

90 


C Spacings between two storage units: spacing between one tank wall and the other tank wall (m) 


Overall risk rating Overall risk rating R 2 of storage unitB 

R 2 of storage unit A - 



Mild 

Low 

Medium 

High 

Very high 

Extreme 

Very extreme 

Mild 

5 

7 

10 

13 

18 

25 

43 


7 

10 

13 

19 

26 

36 

55 

Moderate 

10 

13 

19 

26 

36 

56 

80 

High 

13 

19 

26 

36 

56 

72 

110 

Very high 

18 

26 

36 

56 

72 

97 

145 

Extreme 

25 

36 

56 

72 

97 

130 

185 

Very extreme 

43 

60 

80 

110 

145 

185 

225 


a flashpoint below 32°C the radius of Zone 2 depends on the 
liquid temperature as follows: 


Liquid temperature (°C) 

Radius of Zone 2 (m) 

<100 

6 

100-200 

20 

>200 

30 


10.12 Hazardous Area Classification 

Plant layout has a major role to play in preventing the 
ignition of any flammable release which may occur. 
This aspect of layout is known as ‘area classification’. One 
principal type of ignition source is electric motors, and 
area classification has its origins in the need to specify 
motors with different degrees of safeguard against igni¬ 
tion. As such, the practice was known as ‘electrical area 
classification’ and was usually performed by electrical 


engineers. The extension of this practice to cover the 
exclusion of all sources of ignitions is known as ‘hazardous 
area classification’ and is generally performed by chemical 
engineers. 

Hazardous area classification is dealt with in BS 5345: 
1977 Code of Practice for the Selection, Installation and 
Maintenance of Electrical Apparatus for Use in Potentially 
Explosive Atmospheres (Other than Mining Applications or 
Explosive Processing and Manufacture), and in a number of 
industry codes, including the Area Classification Code for 
Petroleum Installations (IP, 1990 MCSP Pt 15). 

The process of hazardous area classification involves 
assigning areas of the site to one of four categories. 
The international definition of these by the International 
Electrotechnical Commission (IEC), given in BS 5345: 
1977, is: 

Zone 0 A zone in which a flammable atmosphere is 
continuously present or present for long 
periods. 
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Table 10.8 . 

Separation distances for process units: spacings between storage units and other features obtained 

using the Mond Index (D.J. Lewis, 1989b) (Courtesy of the Norwegian Society of Chartered Engineers) 

A Spacings between a 

storage unit and another feature: spacing tc 

> tank wall (m) 


Overall risk 
rating R 2 of 
storage unit 




Feature a 



Works 

Plant 

Control 

Offices, amenity, Process furnaces. 

Flare stacks. 

boundary 

boundary, 


buildings, 

other ground 

of tip height H m 



works main road, 


workshops. 

level ignition 

aboveground? 



works main railway 


laboratories, etc. sources, electrical 







switchgear, 
instrument houses 


Mild 

20 

15 

7 

12 

10 

1.2577+6 


27 

20 

12 

16 

15 

1.2577+10 

Moderate 

35 

25 

20 

24 

22 

1.2577+15 

High 

55 

41 

28 

36 

33 

1.2577 + 22 

Very High 

81 

70 

41 

58 

52 

1.2577 + 35 

Extreme 

125 

95 

53 

72 

66 

1.2577 + 45 

Very extreme 

175 

130 

75 

100 

90 

1.2577 + 60 

B Spacings between a 

storage unit and another feature: spacing tc 

> bund wall (m) 


Overall risk 
rating R 2 of 
storage unit 




Feature a 



Works 

Plant boundary, 

Control 

Offices, 

Process furnaces, 

Flare stacks, 

boundary 

works main 


amenity, 

other ground 

of tip height 



road, works 


buildings, 

level ignition 

77 m above ground 1 



main railway 


workshops, 

sources, electrical 






laboratories, etc. 

switchgear, 
instrument houses 


Mild 

15 

10 

5 

8 

7 

77+6 


20 

12 

6 

11 

10 

77+8 

Moderate 

25 

15 

7 

13 

12 

77+10 

High 

38 

22 

9 

20 

18 

77+16 

Very High 

46 

29 

12 

25 

23 

77+20 

Extreme 

54 

36 

15 

30 

26 

77+23 

Very extreme 

65 

45 

20 

40 

32 

77+28 


a In the case of a buried tank, the tank wall distance is measured to the position on the plan of the tank wall or other items not more than 10 m 
below ground level. 

b In the case of a flare stack, the distances is a function of the flare stack tip height H, as shown in the last column. 


Zone 1 A zone in which a flammable atmosphere is likely 
to occur for short period in normal operation. 
Zone 2 A zone in which a flammable atmosphere is not 
likely to occur in normal operation and if it 
occurs only exist for a short time. 

A non-hazardous area is an area not classified as Zone 0,1 or 
2. In the United Kingdom, this classification system 
replaces an earliersystembasedonthreeDivisions:0,land2. 

In the United States of America, hazardous area classi¬ 
fication is covered in Article 500 of NPFA 70:1993 National 
Electrical Code and in API RP 500: 1991 Recommen¬ 
ded Practice for Classification of Locations for Electrical 
Installations at Petroleum Facilities. 

The purpose of hazardous area classification is to 
minimize the probability of ignition of small leaks. It is 
not concerned with massive releases, which are very rare. 
This distinction is a necessary one, but the difference can 
sometimes be blurred. Mecklenburgh instances a pump 
seal which, if it leaks, will generally give a rather small 
release, but which may on occasion give a leak greater 
than that from the rupture of a small pipe. Because the 


leaks considered are small and because small flammable 
releases burn rather than explode, it is fire rather than 
explosion with which hazardous area classification is 
concerned. 

Since it is difficult to specify leaks fully in terms of size, 
frequency and duration, the following grades of leak are 
defined: 

(1) Continuous grade: release is continuous or nearly so. 

(2) Primary grade: release is likely to happen regularly or 
at random times during normal operation. 

(3) Secondary grade: release is unlikely to happen in 
normal operation and in any event will be of limited 
duration. 

Broadly speaking, continuous, primary and secondary 
grade releases equate to Zones 0,1 and 2, respectively. 

Hazardous area classification proceeds by identifying 
the sources of hazard, or potential leak points, and the 
sources of ignition.Typical leak points include flanges, seals, 
sample points and temporary connections; typical ignition 
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sources include electric motors, burners and furnaces, 
engines and vehicles. 

There are three main strategies available for the control 
of ignition sources: prevention, separation and protection. 
The approach to hazardous area classification based on 
these strategies is broadly as follows. First, the potential 
leak sources are identified. The characteristics of the leak 
are defined, for start-up, shut-down and emergency condi¬ 
tions as well as normal operation, and the grade of leak 
assigned. For each leak point, consideration is given to 
reducing or eliminating any leak. Guidance on separation 
distances is then used to determine the area around the leak 
source from which ignition sources should be excluded. 
Next the ignition sources near the leak point are identified. 
For each ignition source in turn, consideration is given to 
the possibility that it can be eliminated or moved. Where 
this is not applicable, the zone is specified and appropriate 
protection of the ignition source is determined. For elec¬ 
trical equipment this means specifying the type of safe¬ 
guarding appropriate to the zone. 

A check may be made on the separation distances used 
and on the degree of protection required by modelling 
the dispersion of the leak. Consideration should also he 
given to the effect of any pool fire arising from flam¬ 
mable liquid released at the leak point. In some instances 
this may require an increase in the separation distance or 
the use of protection measures such as insulation or 
water sprays. 

The control of ignition sources reduces the risk of injury 
to personnel and the risk of property damage. The extent to 
which the plant design is modified for reasons of hazar¬ 
dous area classification is governed for personal injury by 
the usual risk criteria and considerations of what is rea¬ 
sonably practicable, and for property damage by economic 
considerations. In cases where property damage is the 
issue, it may he preferable to accept a certain risk rather 
than to undertake unduly expensive countermeasures. 

The outcome of this exercise for all the ignition sources 
identified is the definition of the zones in three dimensions 
for the whole plant. Drawings are produced showing these 
zones in plan and elevation, both for individual items of 
equipment and for the plant as a whole. A typical plan 
drawing is illustrated in Figure 10.4. 

Hazardous area classification provides the basis for the 
control of ignition sources both in design and in operation. 
A further discussion of hazardous area classification is 
given in Chapter 16. 

10.13 Hazard Assessment 

In the methodology for plant layout described by Meck- 
lenburgh (1985), hazard assessment is used at several 
points in the development of the layout. In each case, the 
procedure is essentially an iterative one in which hazards 
are identified and assessed, modifications are made to the 
design and the hazards are reassessed. The nature of the 
hazard assessment will vary depending on whether it is 
done in support of site location, site layout. Stage One plot 
layout or Stage Two plot layout. 

Hazard assessment in support of site location is essen¬ 
tially some form of quantitative risk assessment. 

Hazard assessment for site layout concentrates on major 
events. It provides guidance on the separation distances 
required to minimize fire, explosion and toxic effects and on 
the location of features such as utilities and office buildings. 


Hazard assessment for plot layout deals with lesser 
events and with avoidance of the escalation of such events. 
It is used as part of the hazardous area classification pro¬ 
cess and it provides guidance on separation distances to 
prevent fire spread and for control building location. 

At the plot layout level, hazard assessment is concer¬ 
ned mainly with flammable releases. It is not usually pos¬ 
sible at this level to do much about explosions and toxic 
releases. 


10.14 Hazard Models 

10.14.1 Early models 

An account has already been given of the early work of 
Simpson (1971) on the use of models for plant layout 
purposes. The hazard models described by him include 
models for two-phase flow and for vapour dispersion 
and criteria for thermal radiation, as described in 
Section 10.11. 

10.14.2 Mecklenburgh system 

A set of hazard models specifically for use in plant layout 
has been given by Mecklenburgh (1985). A summary of the 
models in this hazard model system is given in Table 10.9. 
Some of the individual models are described in Chapters 15, 
16 and 17. Although the modelling of some of the phenom¬ 
ena has undergone further development, this hazard model 
system remains one of the most comprehensive available 
for its purpose. 

10.14.3 IP system 

Another, more limited, set of hazard models for plant layout 
is that given in Liquefied Petroleum Gas (IP, 1987 MCSP Pt 
9). The models cover: 

(1) emission; 

(a) pressurized liquid, 

(b) refrigerated liquid, 

(2) pool fire; 

(3) jet flame. 

The models include view factors for thermal radiation from 
cylinders at a range of angles to the vertical and of posi¬ 
tions of the target. The requirements for separation dis¬ 
tances between storage units are based on thermal 
radiation flux criteria. These are given in Chapter 22. The 
code gives worked examples. 

10.14.4 Injury and damage criteria 

Criteria for injury and damage, principally the latter, are 
given by Mecklenburgh aspartofhis hazard model system. 

For the heat flux from a flame or fire the tolerable inten¬ 
sities are given as follows: 


Heat flux (kW/m 2 ) 

Drenched storage tanks 

38 

Special buildings 

25 

Normal buildings 

14 

Vegetation 

12 

Escape routes 

6 

Personnel in emergencies 

3 

Plastic cables 

2 

Stationary personnel 

1.5 
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Table 10.9 Hazard assessment in support of plant 
layout: Mecklenburgh hazard model system 


Table 

No. 3 


B1 Source term: instantaneous release from storage 
of flashing liquid (catastrophic failure of vessel) 
Flash fraction 

Mass in, and volume of, vapour cloud 
B2 Dispersion of flammable vapour from 
instantaneous release 
Distance to lower flammability limit (LFL) 

B3 Explosion of flammable vapour cloud from 
instantaneous release 
Explosion overpressure 
Damage (as function of overpressure) 

B4 Fireball of flammable vapour cloud from 
instantaneous release 

Fireball diameter, duration, thermal radiation 
B5 Dispersion of toxic vapour from instantaneous 
release Peak concentration, time of passage 
Distance to safe concentration, outdoors and 
indoors 

B6 Source term: continuous release of fluid 

(a) Gas (subsonic) 

(b) Gas (sonic) 

(c) Flashing liquid (not choked) 

(d) Flashing liquid (choked) 

B7 Dispersion of flammable vapour jet 
Jet length, diameter (to LFL) 

B8 Jet flame from flammable vapour jet 
Flame length, diameter 
Flame temperature, surface heat flux, distance 
to given heat flux 

B9 Dispersion of toxic vapour plume 

Distance to given concentration 
Distance to safe concentration, outdoors and 
indoors 

BIO Growth of, and evaporation from, a pool 
Pool diameter Evaporation rate 
Bll Pool or tank fire 

Flame height 

Regression rate, surface heat flux 
View factor 

B12 Effect of heat flux on targets 
Tolerable heat fluxes 
B13 Risk criteria 

Individual risk to employees (as a range) 
Individual risk to public (as a range) 

Multiple fatality accident 
B14 Explosion overpressure 

Damage (as function of overpressure) 

(see also B3) 

B15 Dispersion of flammable vapour from small 

continuous release 

Jet dispersion: distance to given concentration, 
to LFL (see B7) 

Passive dispersion: distance to given 
concentration (see B9) 

Jet flame: distance to given heat flux (see B8) 

B16 Evaporation and dispersion from small liquid pool 

Distance to given concentration 
B17 Dispersion of flammable vapour from small 
continuous release in a building 


Jet dispersion: distance to given concentration 
Passive dispersion: distance to given 
concentration 

Jet flame: distance to given heat flux (see B8) 

B18 Evaporation and dispersion from small liquid 
pool in a building 
Evaporation rate 

Mean space concentration Other parameters for 
(a) horizontal air flow and (b) vertical air flow 

a In Mecklenburgh (1985). 

For a fireball, the safe dose isgivenas/fe 2/3 <47, where I is 
the heat flux (kW/m 2 ) and t B is the duration of the fireball (s). 

For the peak incident overpressure from an explosion 
the limits which should not be exceeded are given as follows: 


Peak incident 
overpressure (bar) 

Schools 

0.02 

Housing 

0.04 

Public roads 

0.05 

Offices 

0.07 

Shatter-resistant 

0.10 

windows 


Site roads, utilities 

0.20 

Hazardous plants 

0.30-0.40 

Protected control room 

0.7 


10.14.5 Illustrative example 

Mecklenburgh illustrates the application of his hazard 
models by giving for each a scenario and worked example, 
and for some of the outdoor cases he combines these into an 
assessment of the effects on-site and off-site. For this latter 
assessment he considers a set of scenarios which may be 
summarized as follows: 

(1) instantaneous release of flashing liquid from storage 
tank: 

(a) flammable liquid giving rise to unignited vapour 
cloud, or fireball or vapour cloud explosion, 

(b) toxic liquid giving rise to toxic gas cloud, in open 
and around building; 

(2) residual liquid in tank: 

(a) flammable liquid giving rise to unignited vapour 
cloud, pool fire, 

(b) toxic liquid giving rise to toxic gas cloud; 

(3) liquid pool from 10 cm leak in tank base following 
instantaneous release: 

(a) flammable liquid giving rise to unignited vapour 
cloud, or pool fire, 

(b) toxic liquid giving rise to toxic gas cloud; 

(4) Continuous release of pressurized liquid from 2.5 cm 
hole: 

(a) flammable fluid giving rise to passively disper¬ 
sing unignited vapour cloud, or jet fire, 

(b) toxic fluid giving rise to passively dispersing 
toxic gas cloud; 

(5) continuous release of pressurized liquid from 10 cm 
hole: 

(a) flammable fluid giving rise to passively disper¬ 
sing unignited vapour cloud, or jet fire, 

(b) toxic fluid giving rise to passively dispersing 
toxic gas cloud. 
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The overall results are summarized in Table 10.10. These 
results are discussed by Mecklenburgh in relation to both 
on-site and off-site effects and to the countermeasures 
which might be taken. 


10.15 Fire Protection 

Plant layout can make a major contribution to the fire pro¬ 
tection of the plant. This has a number of aspects. 

Plant layout for fire protection is covered in BS 5908: 
1990 Fire Precautions in the Chemical and Allied Industries. 
Also relevant are BS 5306:1976 Fire Extinguishing Instal¬ 
lations and Equipment on Premises, particularly Part 1 on 
fire hydrants, and BS 5041: 1987 Fire Hydrant Systems 
Equipment. An important earlier code, BS CP 3013: 1974 
Fire Precautions in Chemical Plant, is now withdrawn. The 
coverage of BS 5908: 1990 is indicated by the list of 


contents given inTable 10.11. Accounts of the fire protection 
aspects of plant layout include those hy Simpson (1971), 
Hearfleld (1970) and Kaura (1980a). 

Some aspects of plant layout for fire protection may he 
classed as passive and others as active measures. The 
former include (1) separation of hazards and targets, 
(2) measures to prevent fire spread and (3) provision of 
access for fire fighting; the latter include provision of 
(4) fire water and (5) fire protection systems. The segre¬ 
gation of hazards and targets and the containment of fire 
are important aspects of site layout and are considered in 
Section 10.6. The provision and location of fire water 
hydrants and fire protection equipment are prominent 
features of plot layout and are discussed in Section 10.7. 
This section deals primarily with access, fire water and 
fire protection equipment. Fire protection is discussed 
further in Chapter 16. 


Table 10.10 Hazard assessment in support of plant layout: illustrative example (after Mecklenburgh, 1985) (Courtesy 
of the Institution of Chemical Engineers) 


A Off-site effects summary of distances (m) 



All built-up 

100m built-up, 
then country 

All country 

1(a) Instantaneous release 




LFL 

341 

363 

377 

Fireball, safe dose 

463 

463 

463 

Blast, schools 

500 

500 

500 

housing 

290 

290 

290 

roads 

240 

240 

240 

Safe toxic, open 

941 

1034 

1048 

Safe toxic, building 

35 

- 

54 

1(b) Open tank after instantaneous release 



LFL 

At tank 


At tank 

Fire, 1.5 kW/m 2 

17 

17 

17 

Safe toxic 

Near tank 

- 

Near tank 

1(c) Unconfined pool from 10 cm leak after instantaneous release 


Fire, 1.5 kW/m 

83 


83 

Pool radius (fire) 

9 

— 

9 

LFL 

37 

- 

41 

Safe toxic 

67 

_ 

96 

Pool radius (evap.) 

33 

- 

33 (concrete) 

22.5 cm steady release under pressure 




LFL (no jet) 

16(28) 

- 

16(38) 

Fire, 1.5 kW/m2 

43 

— 

43 

Safe toxic (no jet) 

60(72) 

- 

68(92) 

310 cm steady release underpressure 




LFL (no jet) 

62(159) 

62(172) 

62(200) 

Fire, 1.5 kW/m 2 

172 

172 

172 

Safe toxic in open (no jet) 

290(403) 

324(461) 

324(489) 

Safe toxic in building (no jet) 

87(126) 

87(131) 

87(159) 

B On-site effects summary of distances (m) 

1(a) Instantaneous release 




LFL 

341 



Fireball, safe dose 

463 



Fireball radius 

73 



Blast-resistant control rooms 

50 



Hazardous plants 

60- 

-75 


Shatter-resistant windows 

150 
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Table 10.10 (continued) 


Offices 

Safe toxic in buildings 
Safe toxic in open 

1 (b, c) After instantaneous release 


LFL 

Pool radius (fire) 

Fire, drenched tanks 
Special buildings 
Normal buildings 
Vegetation 
Escape routes 
Personnel in emergencies 
Plastic cables 

Stationary personnel (1.5 kW/m2) 

Safe toxic limit 

Pool radius (evaporation) 

2 and 3 Steady releases under pressure 

LFL (no jet) 

Fire, drenched tanks 

Special buildings 

Normal buildings 

Vegetation 

Escape routes 

Personnel in emergencies 

Plastic cables 

Stationary personnel 

Safe toxic limit in open (no jet) 

Safe toxic limit in building (no jet) 


180 

35 

941 


Open Unconfmedpool 

tank (m) from 10 cm leak (m) 

Close 37 

9 

8 30 

9 33 

10 39 

10 41 

12 50 

14 62 

15 73 

17 83 

3 67 

33 


2.5 cm 10 cm 

16(28) 63(159) 

29 116 

30 120 

32 128 

32 128 

35 140 

39 156 

41 164 

43 172 

60(72) 290(403) 

60(72) 87(126) 


LFL, lower flammability limit 

Note: Values in brackets are for the case where the release does not take the form of a jet. 


Table 10.11 Principal contents of BS 5908: 1990 


1. General 

2. Legal background 

3. Principles of initiation, spread and extinction of fire 

4. Site selection and layout 

5. Buildings and structures 

6. Storage and movement of materials 

7. Design of process plant 

8. Operation of process plant 

9. Maintenance of process plant 

10. Fire prevention 

11. Fire defence 

12. Works fire brigades 

13. Classification of fires and selection of extinguishing 

media 

14. Fixed fire extinguishing systems 

15. Portable and transportable appliances 

16. Organization of emergency procedures 


There are numerous legal requirements concerning fire, 
fire construction and fire fighting. There should be full 
consultation at an early stage with the works safety officer 
and with other parties such as the local authority services, 
the Health and Safety Executive (HSE) and the insurers. 


10.15.1 Fire fighting access 

Access is essential for fire fighting. Some basic principles 
are that it should be possible to get fire fighting equipment 
sufficiently close to the site of the fire and that there should 
be access from more than one side. Access should be pro¬ 
vided within 18 to 45 m of a hazard and there should be 
water supplies and hard standing at these access points. 

The site should have a peripheral road connected at not 
less than two points with the public road system. It may be 
necessary to provide a waiting area for fire fighting vehi¬ 
cles near each main gate. Site roads should be arranged to 
allow approach to a major fire from two directions. Major 
process or storage units should be accessible from at least 
two sides. Access is assisted by a plot size ofl00mx200m 
with approaches preferably on all four sides and by spacing 
between plots and buildings of 15 m. 

Access for fire fighting vehicles should be over firm 
ground, should have sufficient road and gate widths, 
should give adequate clearance heights and should allow 
for the necessary turning and manoeuvring. The vehicles 
requiring access may include heavy bulk foam or carbon 
dioxide carriers. 

10.15.2 Firewater 

In a fire, water is required for extinguishing the fire, for 
cooling tanks and vessels and for foam blanketing systems. 
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The quantities of water required can be large, both in terms 
of the instantaneous values involved and of the duration for 
which they may be needed. In some fires water sprinkler 
systems have been required to operate for several days. 

The design of a fire water system requires the determi¬ 
nation of the maximum fire water flow which the system 
should deliver. Some order of magnitude figures are given 
in the Refining Safety Code (IP, 1981 MCSP Pt 3). This 
states that for a major process fire the fire water flows 
required might be of the order of 750-1500 m 3 /h. The 
code also quotes for a major fire on a 50 m diameter stor¬ 
age tank a fire water flow of 830 m 3 /h for the application 
of foam to the burning tank and for the cooling of the 
adjacent tanks. R.B. Robertson (1974a) refers to investi¬ 
gation of the fire water actually used in major process 
plant fires and quotes water flows in the range of 
900-2700 m 3 /h. 

It is also necessary to specify the length of time for 
which such fire water flows should be sustained. This 
specification also may be obtained using the design basis 
fire approach. Typically this length of time is recommended 
to be 2—3 hours. Robertson states that study of time taken 
to control fires points to a duration of 2 hours. 

The fire water requirement may be based on the specifi¬ 
cation of a design basis fire. Kaura (1980a) suggests that 
this might be two simultaneous fires, one on a major pro¬ 
cess unit and the other at the storage tanks. The IP Refining 
Safely Code states, on the other hand, that it is usual to 
assume that there will be only one major fire at a time. The 
practical difference between these approaches depends on 
how generous an allowance is made for the single fire. 

The fire water main may be fed from the public water 
supply, but for large works the public supply may well not 
be adequate to provide the quantities of water required. 
Additional water supplies may be drawn be the fire bri¬ 
gades from rivers, canals, reservoirs or static tanks, but 
such sources should be near enough to allow suction to be 
obtained directly, since reliance on relay s is likely to involve 
undue delay. Cooling water should not be used, because loss 
of cooling on other plants is itself a hazard. Where the 
public supply is to be used, this should be done in accor¬ 
dance with BS 6700: 1987. The water and fire authorities 
should be consulted about fire water supplies. 

Water supplies for water sprays and sprinklers may be 
provided in the form of elevated static water tanks. Atypi¬ 
cal capacity might be such as to supply water for 1 hour. 
Pumps should be provided to replenish the supplies. 

Fire water should be available from hydrants adjacent to 
the fire hazards on a ring main running alongside the road 
and located between the road and the plant. The main 
should preferably be buried under ground. The installation 
shouldbe generally in accordance with BS 5306:1976-and 
fire water hydrants with BS 750:1984 and BS 5306: Part 1: 
1976. The main should take the form of a ring main encir¬ 
cling the plant, with cross-connections and with isolation 
valves to allow shut-off if a section of the main is damaged. 

Hydrant intervals should be 45 m for high risk areas but 
may be up to 100 m for low risk ones. The distance between 
the hydrant, the plant structure or storage area should be 
not less than 18 m and may be up to 45 m. The hydrants 
should be provided with a hard standing and with signs in 
accordance with BS 5499: Part 1: 1990. The signs should 
indicate the quantity of water available. 

Rising mains should be installed in a building or struc¬ 
ture on any floor exceeding 18 m above ground level. Dry 


rising mains are suitable for heights up to 60 m, but above 
this height a wet main may be preferable. The inlets on the 
ground floor to dry riser mains and the outlets on all floors 
to both types of main should be accessible. 

Fire water for sprinkler and water spray systems should 
be in accordance with BS 5908. 

Pipes for fire water supply should be protected against 
explosion damage. Isolation valves should be provided to 
prevent loss of fire water from damaged lines and, if these 
valves are above ground level, they should be protected by 
concrete blast barriers. The fire water is normally pumped 
through the main by fixed fire pumps. There should he at 
least two full capacity pumps with separate power sup¬ 
plies. Cabling for electric pumps should not run through 
high risk areas or, if this is unavoidable, it should be pro¬ 
tected. The location of the pumps is usually determined by 
that of the source of supply, but they should not be in a high 
risk area. The fire pumps should be housed to protect them 
from the weather. In a fire, mobile pumps may sometimes 
be used to boost the fire main pressure, though their prin¬ 
cipal use is to supply fire hoses from the main or other 
sources. 

10.15.3 Fire protection equipment 

The other aspects of fire protection of plant, including fire 
containment by layout, gas, smoke and fire detection, pas¬ 
sive fire protection such as fire insulation, and active fire 
protection such as the use of fixed, mobile and portable fire 
fighting equipment, are considered in Chapter 16. 

It is appropriate to mention here, however, the provision 
of certain minimal equipment which is generally treated as 
an aspect of plant layout. Fire extinguishers of the appro¬ 
priate type and fire blankets should be placed at strategic 
points on the plant. There should be at least two extin¬ 
guishers at each point. Some extinguishers should be 
located on escape or access routes, so that a person who 
decides to fight the fire using the extinguisher has a route 
behind him for escape. 

Fire equipment should be located so that it is not likely to 
be disabled by the accident itself, should be accessible and 
should be conspicuously marked. The main switchgear and 
emergency controls should have good access, preferably on 
an escape route, so that the operator does not have to risk 
his life to effect shut-down. 

10.16 Effluents 

General arrangements for dealing with effluents are dis¬ 
cussed by Mecklenburgh (1973,1985). Pollution of any kind 
is a sensitive issue and attracts a growing degree of public 
control. There should be the fullest consultation with the 
local and water authorities and the Inspectorate of Pollu¬ 
tion in all matters concerned with effluents. 

Hazard identification methods should be used to identify 
situations which may give rise to acute pollution incidents 
and measures similar to those used to control other hazards 
should be used to ensure that this type of hazard also is 
under control. 

10.16.1 Liquid effluents 

Liquid effluents include soil, domestic and process efflu¬ 
ents, and cooling, storm and fire water. Harmless aqueous 
effluents and clean stormwater may be run away in open 
sewers, but obnoxious effluents require a closed sewer. One 
arrangement is to have three separate systems: an open 



0/28 PLANT SITING AND LAYOUT 


sewer system for clean stormwater and two closed sewer 
systems, one for domestic sewage and one for aqueous 
effluent from the plant and for contaminated stormwater. 

There are a number of hazards associated with liquid 
effluent disposal systems such as drains and sewers. One 
is the generation of a noxious gas by the mixing of 
incompatible chemicals. Another hazard is that a flam¬ 
mable gas may flow through the drains, become distri¬ 
buted around the plant and then find a source of ignition. 
This can give rise to a quite violent explosion, or even 
detonation. A flammable liquid which is immiscible with 
water flowing through the drains constitutes another 
hazard. Again it may become distributed around the plant 
and find an ignition source. If the liquid is already on fire, 
its entry into the drains may cause the fire to be distributed 
around the plant. 

Other problems with sewers include overloading, block¬ 
age and back flow, each of which can be hazardous. Over¬ 
loading or blockage can result in a liquid fire being 
floated across to other parts of the site. Some case histor¬ 
ies of problems in sewers are given by Anon. (1978 LPB 
19, p. 10). 

There are also environmental factors to consider. It is 
necessary to avoid the discharge of untreated contami¬ 
nated liquid. 

As stated above, process effluents, essentially aqueous, 
and contaminated stormwater are collected in a common 
sewer. The liquids discharged to this sewer should be clo¬ 
sely controlled. If different effluents are to be mixed 
together, it should be checked that this can be done safely 
Chemical works effluents are quite prone, for example, to 
generate obnoxious gases. 

Water-immiscible flammable liquids should not be 
allowed to enter the sewers, where they create the hazard of 
fire or explosion. In particular, open sewers with solvent 
floating on the water may transmit fires over long dis¬ 
tances. There should be arrangements to prevent the entry 
of such liquids into the sewers. Runoff from the plant area 
should be routed to interceptors located at the edge of the 
fire risk area. In order to avoid overloading, use is made of 
primary interceptors to effect a preliminary separation. 
Measures may need to be taken to prevent sedimentation 
in, and freezing of, the interceptors. 

It may be necessary to take measures to avoid flooding on 
process and storage plots. There is need for care to avoid the 
flooding by effluents of vulnerablepoints such as pump pits. 
Flooding of bunds can cause the tanks inside to float. Efflu¬ 
ents should not be permitted to run off plant areas onto 
adjacent sites, or vice versa. If the site slopes or contains a 
natural water course, additional precautions are needed. 

The traditional sewer is the gravity flow type. This 
should have a gradient and be self-cleaning. Sewer boxes 
should be used as interconnections with a liquid seal to 
prevent the transmission of gases and vapours and reduce 
the hazard of fire/explosion. Where noxious vapours might 
collect, the sewer box lids should be closed, sealed and 
vented to a safe place. A suitable point is above grade 3 m, 
horizontally 4.5 m from platforms and 12 m from furnaces 
walls. The routing of sewers should be parallel to the road 
system. They can go under the road, but for preference 
should be alongside it. 

Sewers are considered in more detail in Section 10.17. 
The sewer system should be settled at an early stage. It is 
usually not practical to increase the capacity once the 
plant is built. 


10.16.2 Gaseous effluents 

Gaseous effluents should be burned or discharged from a 
tall stack so that the fumes are not obnoxious to the site or 
the public. The local Industrial Pollution Inspector is able to 
advise on suitable stack heights and should be consulted. It 
is also necessary to check whether a high stack constitutes 
an aerial hazard and needs to be fitted with warning lights. 

Flare stacks are a particular problem, because they 
radiate intense heat and can be very noisy. Quite a large 
area of ground beneath a flare stack is unusable and is 
effectively ‘sterilized’. A flare stack may have to be rele¬ 
gated to a distant site. A further discussion of flare stacks is 
given in Chapter 12. 

Thebehaviourof airborne emissions of all types should be 
carefully considered. Although the prevailing wind is the 
main factor, other possible troublesome wind conditions 
should be taken into account. The effect of other weather 
conditions, such as inversions should also be considered. 

10.16.3 Solid wastes 

Solid waste should preferably be transferred directly from 
the process to transport. If intermediate storage is un¬ 
avoidable, care should be taken that it does not constitute a 
hazard or a nuisance. If combustible solid and solvent 
wastes are burnt, the incinerator should be convenient to 
the process. 

10.17 Drain Systems 

The main plant sewers are of particular importance and 
merit further description. As already stated, it is common 
to have an open clean stormwater sewer and a closed con¬ 
taminated stormwater sewer. These sewers also carry fire 
water runoff during fire fighting. 

Accounts of sewer systems include those by J.D. Brown 
and Shannon (1963a,b), Seppa (1964), DAlessandro and 
Cobb (1976a) and Anon. (1978 LPB 19, p. 10). These systems 
are also considered by Mecklenburgh (1973,1985). Storm¬ 
water systems are discussed by Elton (1980), W.E. Gallagher 
(1980) and G.S. Mason and Arnold (1984). 

10.17.1 Clean stormwater system 

Clean stormwater is usually collected in an open sewer. The 
discharge may be to water courses or the sea, or to a holding 
pond. On large sites it is generally not practical to dis¬ 
charge it to the public system, due to overload of the latter. 

10.17.2 Contaminated stormwater system 

The contaminated stormwater system consists of the con¬ 
taminated stormwater sewers together with an impound¬ 
ing basin to hold the contaminated water prior to treatment 
and discharge. The design of the impounding basin is dis¬ 
cussed by Elton (1980) and W.E. Gallagher (1980) and that 
of the contaminated stormwater sewers themselves by 
G.S. Mason and Arnold (1984). 

First it is necessary to determine the catchment area, or 
watershed, from which the stormwater will flow onto the 
plant site. The next step is to characterize the rainfall. 
A suitable starting point is a rainfall atlas such as the 
Rainfall Frequency Atlas in the United States of America. 
The available data may be used to make an estimate of the 
maximum 24 hour rainfall. For some locations information 
is available from which the recurrence interval of particu¬ 
lar levels of 24 hour rainfall may be determined. 
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A gravity flow stormwater system allows nearly immis¬ 
cible liquids such as chlorinated hydrocarbons to accumu¬ 
late and to contaminate water passing through until they are 
gradually dissolved. It may also allow a light, nearly immis¬ 
cible flammable liquid to float on the top of the water and pass 
through unless liquid seals are installed to prevent this. 

The alternative type of system is the fully flooded sys¬ 
tem. The system is flooded by a dam at the entrance to the 
collection sump. As water enters, the sewer becomes fully 
flooded. The catchbasins and manholes used in this case 
are of the dry-box type. A fully flooded system prevents the 
passage of flammable vapours and of burning liquids. 
There is no accumulation of nearly immiscible liquids and 
thus no contamination of the stormwater by such liquids. 

A flooded stormwater system may not be justified if the 
liquids handled on the plant are not flammable. Such a 
system may be impractical in a location sufficiently dusty 
to cause clogging. 

The selection of the materials of construction for a fully 
flooded system is important and is considered by the 
authors.Theseneedtowithstandbothcorrosionand thermal 
shock. They also discuss the conversion of a gravity flow 
system to fully flooded system and give cost comparisons. 

10.17.3 Firewater disposal 

There should be arrangements for the disposal of fire 
water, but it is expensive to provide sewers for the very 
large quantities of water involved, and different views have 
been expressed on the necessity for this (e.g. Simpson, 
1971; Mecklenburgh, 1976). A practical compromise is to 
design the sewers to take at any rate the initial ‘first aid’ fire 
fighting water (R.B. Robertson, 1974a). 

There are also different estimates given of the quantities 
of fire water likely to be involved. Mecklenburgh (1985) 
states that the allowance for fire water is about five times 
the volume allowed for the stormwater. Presumably this 
refers to UK conditions. A different ratio may well apply in 
other parts of the world. 

Consideration should be given to the fire water flow in all 
sections of the sewer system. The main trunk sewer usually 
receives water from a relatively large watershed, but branch 
sewers may well be prone to overloading from large fire 
water usage on particular parts of the site. 

In view of the large quantities of fire water which can be 
generated, it may well not be practical to design the sewers 
for these flows, and other methods of disposal may be 
needed.These include measures to pump it away or to run it 
off onto other land. 

10.18 Blast-Resistant Structures 

It is sometimes necessary in the design of structures such 
as plant and buildings to allow for the effect of shocks 
from explosions and/or earthquakes. In both these cases, 
there is a strong probabilistic element in the design in that it 
is not possible to define the precise load to which the plant 
structure may be subjected. The starting point is therefore 
the definition of the design load in terms of the relation 
between the magnitude of the load and the frequency of 
occurrence. 

The full design of shock-resistant structures is beyond 
the scope of this book, but some limited comments are 
made here. Further accounts of explosion-resistant struc¬ 
tures are given in Chapter 17 and of earthquake-resistant 
structures in Appendix 15. 


10.19 Control Buildings 

Until the mid-1970s, there were few generally accepted 
principles, and many variations in practice, in the design of 
control buildings. Frequently the control buildings con¬ 
structed were rather vulnerable, being in or close to the 
plant and built of brick with large picture windows. 

10.19.1 Flixborough 

The Flixborough disaster, in which 18 of the 28 deaths 
occurred in the control building, caused the Court of Inquiry 
to call for a fundamental reassessment of practice in this area. 

The control building at Flixborough has been described 
by V.C. Marshall (1976a). It was constructed with a rein¬ 
forced concrete frame, brick panels and considerable win¬ 
dow area. It was 2y2 storeys high in its middle section, the 
1 V2 storeys over the control room consisting of a half-storey 
cable duct and a full-storey electrical switchgear room. The 
control room was part of a complex of buildings some 160 m 
long, which also housed managers’ offices, a model room, 
the control laboratory, an amenities building and a pro¬ 
duction block. 

This building complex was 100 m from the assumed 
epicentre of the explosion and was subjected to an esti¬ 
mated overpressure of 0.7 bar. The complex lay with its long 
axis at right angles to the direction of the blast. It was 
completely demolished by the blast and at the control room 
the roof fell in. The occupants of the control room were 
presumably killed mainly by the collapse of the roof, but 
some had been severely injured by window glass or wired 
glass from the internal doors. It took mine rescue teams 
19 days to complete the recovery of the bodies. 

The main office block, which was a 3-storey building, 
again constructed with a reinforced concrete frame, brick 
panels and windows, was only 40 m from the assumed 
epicentre and was also totally demolished. 

The implications of the Flixborough disaster for control 
building location and design have been discussed by 
VC. Marshall (1974,1976a,c,d) and by Kletz (1975e). 

10.19.2 Building function 

The control building should protect its occupants against 
the hazards of fire, explosion and toxic release. Much the 
most common hazard is fire, and this should receive par¬ 
ticular attention. 

There are several reasons for seeking to make control 
buildingssafer.Oneistoreducetoaminimumleveltheriskto 
whichoperatorsandotherpersonnelareexposed.Anotheris 
to allow control to be maintained in the early stages of an 
incident and so reduce the probability of escalation into a 
disaster. Athird is to protect plant records, including those of 
the period immediately before an accident. 

It is sometimes suggested that another aim should be to 
equalize the risks to those inside and outside. Since those 
outside tend to be less at risk in an explosion, this means in 
effect reducing the risk to those inside.This objective is not 
self-evident, however. The philosophy of risk described 
earlier is that no one should be subjected to more than a 
specified risk, not that the risk should be equal for all. In 
any event, before designing a control room, it is necessary 
to be clear as to what the objectives are. 

10.19.3 ACMH recommendations 

Control building location and design is one of the topics 
raised by the Court of Inquiry on the Flixborough disaster 
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and considered in the First and Second Reports of the 
Advisory Committee on Major Hazards (ACMH) (Harvey 
1976, 1979b). The recommendations of the committee 
are that control rooms which may be subject to explo¬ 
sion should not be built in brick with large picture win¬ 
dows, but in reinforced concrete with small, protected 
windows. 


10.19.4 Control facilities 

There is a tendency for control rooms to become part of a 
complex of facilities, as the buildings at Flixborough illus¬ 
trate. As a result, more people are exposed to hazard than is 
necessary and/or the buildings must be of more elaborate 
and expensive construction. Some of the additional rooms 
often associated with the control room include computer 
room, locker room, mess room, toilets, supervisors’offices, 
analytical laboratories, test rooms, instrument workshops, 
electrical relay and switchgear rooms. 

The proper policy is to build a secure control room 
in which the functions performed are limited to those 
essential for the control of the plant and to remove all other 
functions to a distance where a less elaborate construction 
is permissible. The essential functions which are required 
in the control room are those of process control. There are 
other types of control which are required for the operation 
of the plant, such as analytical control and management 
control, but they need not be exercised from the control 
room. Thus other facilities such as analytical laboratories, 
amenities rooms, etc., should be located separately from the 
control room. 

The control room should not be used as a centre to 
control emergencies. There should be a separate emer¬ 
gency control centre, as described in Chapter 24. The 
control room should also not be used as an emergency 
assembly point or refuge room. 


10.19.5 Location 

The ability of a control building to give protection against 
a hazard such as an explosion depends not only on 
its design but also on its location. The siting of a 
control building can, therefore, be as important as its 
construction. 

It is good practice to lay plant out in blocks with a stand¬ 
ard separation distance. The control building should be 
situated on the edge of the plant to allow an escape route. 
Recommended minimum distances between the plant 
and the control building tend to lie in the range 20-30 m. 
If hazard studies indicate, however, that the standard 
separation distance may not be adequate, the distance 
between the control building and the plant should, of 
course, be increased. 

The control building should not be so near the plant 
that its occupants are at once put at risk by a serious leak 
of flammable, toxic or corrosive materials. On the other 
hand, increasing the distance from the process may make 
the operators less willing to get out on the plant. Man¬ 
agers are generally opposed to control rooms which are 
too remote. This is important, because active patrolling by 
the operator is one of the main safeguards against plant 
failures. 

A control building should not be sited in a hazardous 
area as defined in BS 5345: 1977- Further guidance on 
location of the control building is given below. 


10.19.6 Basic principles 

Arising from the experience of Flixborough, V.C. Marshall 
(1976a) has suggested certain principles for control build¬ 
ing design which may be summarized as follows: 

(1) The control room should contain only the essential 
process control functions. 

(2) There should be only one storey above ground. 

(3) There should be only the roof above the operator’s 
head. The roof should not carry machinery or cabling. 

(4) The building should have cellars built to withstand 
earthshock and to exclude process leaks and should 
have ventilation from an uncontaminated intake. 

(5) The building should be oriented to present minimum 
area to probable centres of explosion. 

(6) There should be no structures which can fall on the 
building. 

(7) Windows should be minimal or non-existent and glass 
in internal doors should be avoided. 

(8) Construction should be strong enough to avoid spalling 
of the concrete, but it is acceptable that, if necessary, the 
building be written off after a major explosion. 

10.20 Toxics Protection 

Another hazard against which protection may be required 
is that posed by a release of toxic gas. In general, ordinary 
buildings off site and even on site can afford an appreciable 
degree of protection against a transient toxic gas release, 
but for certain functions enhanced protection is required. It 
is also necessary to ensure that the protection potentially 
available is not defeated. Buildings of particular interest 
here are (1) the control building, (2) the emergency control 
centre and (3) any temporary refuges. 

10.20.1 Control room 

The design of a control room for protection against toxic 
release is discussed in the Cl AControlBuilding Guide (CIA, 
1979). The design should start by identifying the release 
scenarios against which protection is required and by 
making some quantitative assessment of the dispersion of 
the gas. If persons outside exposed to the gas release would 
be incapacitated or unable to escape, protection is needed. 
The time for which protection is needed should also be 
defined. This will normally be governed by the time 
required to shut the plant down or the time needed to con¬ 
trol the emergency. 

The control building should be located at the edge of the 
plant, and its siting should take into account both fire/ 
explosion and toxic gas hazards. There should be at least 
two escape routes, which should be chosen bearing in mind 
that they may need to be used by partially incapacitated 
people and by rescue teams wearing heavy breathing appa¬ 
ratus. They should be free from obstructions and well lit. 

The construction of the building should be gas-tight. 
This means, among other things, that windows should be 
non-opening and that door and window frames should be 
designed and maintained to minimize entry of gas. There 
should be no more than two doors, each with an air lock and 
each gas-tight. The wedging open of these doors should not 
be tolerated. 

The occupants of the control building should be pro¬ 
vided with a supply of air sufficient for the time for which 
protection is required. Generally, it will be necessary to 
shut off the normal ventilation and the control building will 
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then lose any overpressure and may become contaminated. 
Self-contained breathing apparatus should be provided for 
each occupant. 

In some cases, it may be possible to supply air from a 
source sufficiently far from the control building that the air 
from it is clean. The air supply should maintain within 
the building a positive pressure of 0.5—1.0 in. water gauge, 
which requires 2 to 15 air changes per hour, depending on 
building size, construction and gas-tightness. 

There are various ways in which toxic gas may enter such 
a building. One is via service trenches and cellars. These 
should be avoided, but if used should incorporate sealed 
barriers and should be subject to a permit-to-work system. 
Another mode of entry is via instrument air lines and 
appropriate precautions should be taken. Instrument sam¬ 
ple lines should not bring toxic process fluids into the 
control building. 

Where available, gas detectors should be used to give 
warning of a toxic gas escape by activating an alarm in the 
control room, where there should be means of activating the 
toxic gas alarm. There should be in the control room an 
indication of wind direction. 

It may be possible to provide protection to the control 
building using a water spray system. The gas detector sig¬ 
nal may be used to activate such a water spray and to shut 
off the normal ventilation air. 

The control building should have a priority communica¬ 
tion link, other than the normal telephone system, to the 
emergency control centre. 

Appropriate breathing apparatus or respirators should 
be provided in the control building to assist the escape of 
any persons who have to be evacuated in the emergency. 

10.20.2 Emergency control centre 

Protection of the emergency control centre from a toxic 
release will normally be in large part by location. It is 
necessary for the emergency controllers to gain access to 
the centre at the start of the emergency and it is undesirable 
that they should have to pass through a toxic gas cloud. 
Nevertheless, it may need to be designed to afford protec¬ 
tion against toxic gas, in which case the points just made in 
relation to the control building are pertinent. 

10.20.3 Refuges 

A temporary refuge, or haven, has the quite different 
function of providing temporary shelter for personnel. The 
design of such havens is described in the Vapor Release 
Mitigation Guidelines (CCPS, 1988/3). The Guidelines dis¬ 
tinguish between temporary and permanent havens, or 
more effective temporary havens. Virtually any weather- 
tight building should suffice as a temporary haven. Per¬ 
sonnel in such a haven should be notified to leave the 
building when the toxic gas cloud has passed. There should 
be arrangements for them to be rescued, if necessary, by 
well-equipped teams. It would also seem necessary that 
there be means whereby the emergency controllers know 
the location of personnel needing rescue. 

For permanent havens, the CCPS Guidelines refer to the 
arrangements for control buildings as described in the CIA 
Control Building Guide. They also give a method of esti¬ 
mating the capacity of a haven. The conditions in the haven 
should not exceed the following limits: minimum oxygen 
concentration 18%; maximum carbon dioxide concentra¬ 
tion 3 %; maximum temperature 33°C; and maximum 100 % 
relative humidity (RH). 


10.21 Modular Plants 

During the late 1950s and early 1960s, there was introduced 
a type of plant consisting of a number of modules and 
mounted on skids which could be transported by road from 
the fabrication to the operating site. The processes were 
straightforward and the plants were simple and cheap. 
From these early skid-mounted plants, there has developed 
a whole range of modular and barge-mounted plants, some 
of which are large and complex. 

Accounts of modular plants have been given by Glaser, 
Kramer and Causey (1979), Zambon and Hull (1982), Glaser 
and Kramer (1983), Hulme and La Trobe-Bateman (1983), 
Kliewer (1983), Clement (1989), Hesler (1990) and Shelley 
(1990), and accounts of barge-mounted plants have been 
given by Birkeland et al. (1979), Charpentier (1979), 
J.L. Howard and Andersen (1979), R.G. Jackson (1979), 
Jansson et al. (1979), Shimpo (1979), Ricci (1981), Bolt and 
Arzymanow (1982), deVilder (1982) and Glaser and Kramer 
(1983). Both types of plant are treated by Mecklenburgh 
(1985). 


10.21.1 Skid-mounted plants 

The early skid-mounted plants were typically natural gas 
processing plants and pipeline compressor stations moun¬ 
ted on skids. The plants had a quite small number of mod¬ 
ules of limited dimensions. They were transported by truck 
from the fabrication works to the operating site. The plants 
were simple and were equipped to shut-down if an operat¬ 
ing problem arose. The plant operator typically lived in a 
house close by. These plants were designed for a relatively 
short life and had low capital and running costs. A 
description of such skid-mounted plants is given by 
Kliewer (1983). 


10.21.2 Modular plants 

The late 1970s saw a significant extension of the scale and 
complexity of modular plants. Such plants were seen as 
offering benefits where site construction was unusually 
difficult, particularly on remote sites. Factors favouring 
modular plants include problems associated with (1) access 
difficulties, (2) severe weather and (3) the labour force. 

Advantages of modular construction are those associated 
with (1) access for equipment suppliers, (2) work in sheltered 
conditions and (3) availability of a skilled workforce. 
Arising from these are (4) easier construction and testing, 
(5) improved quality assurance and (6) shorter project time- 
scale. Construction of the plant at a dedicated fabrication site 
minimizes access difficulties for equipment suppliers, and 
allows the work to be done under cover and by a skilled 
workforce. Main items of equipment, pipework, supports, 
instrumentation and cabling can be installed and tested 
under essentially factory conditions. The project timetable 
can be shorter, both because work on foundations and on 
plant construction can proceed in parallel and because 
construction can be done in more favourable conditions. 

Disadvantages of modular construction include those 
associated with (1) engineering design, (2) modifications, 
(3) steelwork and (4) transport. Modular construction 
necessitates high quality and more expensive engineering 
design. It is relatively unforgiving of modifications, which 
can therefore be disruptive and expensive. There are addi¬ 
tional costs for steelwork but, because steel is relatively 
cheap, these may be modest. There are additional transport 
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costs which vary depending on the site and the plant, and 
which can be considerable. 

Modular construction requires its own design approach. 
It is not effective to design a plant by conventional methods 
and then divide it into modules. It is necessary to design for 
a modular layout from the start. It is also necessary to 
accept that the main features affecting layout have to be 
frozen earlier than is often the case is normal design. 

Plants have been constructed with some 200 modules and 
with modules stacked as high as 50 m.With regard to module 
dimensions and weight, in one proj ect described by Kliewer 
(1983) the maximum module dimensions were set at 6.7 m 
wide x 4.0 m high x 30.5 m long. The weight limit was 
125 ton, though most modules did not exceed 50 ton. Shelley 
(1990) describes rubber-track crawlers and trailers with up 
to 360 wheels capable of transporting 3000-4000 ton and 
cranes with lifting capacity of 5000 ton. 

Advocates of modular design typically claim savings on 
project cost and time. Accounts of cost benefits include 
those of Kliewer (1983) and Shelley (1990). Broadly, capital 
costs are less, but design, steelwork and transportation 
cost more. Shelley quotes construction times shortened by 
up to 50% and capital cost savings of up to 20%. 

Progress in modular construction has been reviewed by 
Shelley (1990). The image of modular plants has tended to 
be that of skid-mounted plants and plants shipped to 
remote locations. Modularization has generally been con¬ 
sidered only for remote locations where the weather is 
hostile or skilled labour unavailable. The author discerns a 
trend towards increasing use of modular construction for 
regular projects, arising from its advantages of cutting 
capital costs and shortening construction times. Another 
stereotype which is somewhat outdated is that modular 
plants necessarily involve a cramped layout. 

10.21.3 Barge-mounted plants 

A particular type of modular plant is that mounted on a 
barge or other vessel. The development of such plants has 
received impetus from the need for shipyards to diversify 
Features of the operating site which favour the use of a 
barge-mounted plant include: a seaboard inaccessible from 
the hinterland; a navigable, if shallow, river; or a delta 
unsuitable for land traffic. 

A plant transported by sea may, in fact, be truly barge 
mounted or it may be self-floating. In the latter case it is 
effectively a sea-going object in its own right, must be fully 
seaworthy and must meet the requirements of the classifi¬ 
cation societies. The direct costs of transport of a barge- 
mounted plant may well be modest, but those of providing 
the stiff framing for, and the measures to counter stresses 
developed in, a sea voyage can be appreciable. A barge- 
mounted plant is a sea-going object so that it must he sea¬ 
worthy and must meet the classification society specifica¬ 
tions, which can be expensive. 

One solution is to use a vessel designed specifically for 
the transport of modular plants. The Wijsmuller semi- 
submersible heavy lift vessel Super Servant, described by de 
Vilder (1982) is of this type. This is a development from the 
semi-submersible barges which have been in use for some 
decades, either unpowered or with auxiliary propulsion only 

The options for installation at the operating site have 
been discussed by Charpentier (1979), who lists four. One is 
a barge floating at sea or anchored. This means, in effect, a 
factory ship with its own propulsion and mooring systems. 
Another is a barge which floats but is moored along a quay, 


accessible from the sea on one side and from the land on the 
other. A third is a barge grounded on a dredged bed in a 
shelter site, possessing connections similar to those in the 
previous case but not subject to water movement. The 
fourth option is a barge grounded on a foundation sill and 
protected by some form of dike or dam. 

The use of prestressed concrete hulls for barge-mounted 
plants has been described by Birkeland et al. (1979). They 
outline three options for installation at the operating site: 
a self-floating plant may be permanently floating or perma¬ 
nently grounded; a plant delivered by a barge is off-loaded 
and floated into position and then permanently grounded. 

Reviews of projects on barge-mounted plants include 
those by Charpentier (1979) and Ricci (1981). Birkeland et al. 
(1979) describe several barge-mounted projects. They 
include a self-floating LPG refrigeration and storage barge, 
the Ardjuna Sakti, sited near Jakarta and permanently 
floating. Charpentier (1979) describes a number of projects 
involving barge-mounted plants. They include a refinery, a 
natural gas liquefaction plant, an ammonia plant and a 
methanol plant. 

The design of a barge-mounted liquefied natural gas 
(LNG) liquefaction and storage plant, the marine LNG 
system (MLS), has been described by J.L. Howard and 
Andersen (1979); the project was intended for the Pars gas 
field off Kangan, Iran, but was interrupted by political 
factors. The authors give details of the process flow dia¬ 
gram, the LNG storage spheres and the fire protection and 
emergency shut-down systems. The design was done 
according to the requirements of the International Mar¬ 
itime Consultative Organization (IMCO) gas carrier codes. 
The installation was of the dredged basin type. 

In the 1970s, the conversion of LNG to methanol prior to 
transport appeared to be a potentially attractive way of 
transporting energy on long hauls, and studies of barge- 
mounted plants for such conversion were carried out 
(R.G. Jackson, 1979). One application envisaged for such 
units was the exploitation for smaller, shorter life fields. 

A somewhat similar motivation underlies the use of 
barge-mounted plants to process gas from fields for which a 
pipeline would be uneconomic and at which the gas would 
therefore be flared (Jansson et al., 1979). These fields may 
include subsea completions where there is no production 
platform. The main design described is for an ammonia 
plant with the platform-a flat, broad barge moored at a 
single point mooring, but variations include barge- 
mounted urea, methanol, natural gas liquids (NGL) and 
LNG plants and beaching of the plant. 

Ricci (1981) gives an account of a barge-mounted low 
density polyethylene (LDPE) plant for Bahia Blanca, 
Argentina. This plant was transported by the heavy lift 
semi-submersible described by de Vilder (1982) and refer¬ 
red to above. This author describes in detail the planning of 
the voyage in respect of the wind and acceleration forces 
and of the mechanical stresses to which the load would be 
subjected. 

An account of a barge-mounted pulp plant installed in 
the upper reaches of the Amazon in Brazil using the 
industrial platform system has been given by Shimpo 
(1979). The site was one with no roads and accessible only 
by plane. There were two platforms, one for the pulp plant 
and one for the power plant. The platforms had to be 
designed for structural strength whilst being towed and 
during operation. Platform construction posed various 
difficulties. It proved impossible to set up a longitudinal 
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Figure 10.5 Modular two-unit reactor train (Hester, 1990) (Courtesy of the American Institute of Chemical 
Engineers 


bulkhead and there were few straight transverse bulk¬ 
heads. There were many large irregular openings in the 
main deck, especially close to the side. At the site the design 
was for the platform to be set on piles. There were problems 
arising from unbalanced soil strength and uneven live load 
on the platform. The project yielded much information on 
motions and stresses during the voyage and at the site. 


10.21.4 Modular design 

It is possible to adopt a modular approach to the design of 
plant, even if modular construction is not intended. An 
account of such modular design is given by Hesler (1990). 
A modular approach not only saves on design costs but 
also allows the design to be optimized and defects elimi¬ 
nated and, by offering equipment suppliers repeat runs, 
reduces equipment costs and procurement times. For 
some types of plant the normal design consists of repli¬ 
cated modules. 

One type of plant for which modular design is often 
appropriate is a batch reactor system. Such plant generally 
consists of a number of similar reactor trains. Furthermore, 
these trains are frequently required to have the flexibility 
to permit changes in the raw materials used and products 


made and a modular design is able to accommodate such 
modifications. Typical units in such plant are reactors, col¬ 
umns, quench tanks, crystallizers, liquid-solid separators, 
and driers. Figure 10.5 illustrates the two-unit reactor train 
described by Hesler. Another example given by this author 
is the ICIFM-21 membrane chlorine cell. 


10.21.5 Offshore modules 

Another application of modular construction is on offshore 
oil and gas production platforms. The production deck of 
such a platform will typically consist of some four modules 
which are lifted whole onto the platform. The lifting capa¬ 
city of the floating cranes used is now in fact such that a 
whole deck can be installed in one lift. 


10.22 Notation 

Section 10.14 

I heat flux (kW/m 2 ) 
t B duration of fireball (s) 
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11/2 PROCESS DESIGN 


11.1 The Design Process 

Process design designates the Chemical Engineering devel¬ 
opment aspects of a process plant. This is augmented by the 
classical related engineering disciplines: Mechanical, Elec¬ 
trical, Civil along with others, which provide constraints as 
to the availability and feasibility of industrial equipment, 
electrical hazards and siting issues covered in Chapter 10. 
Clearly, issues such as single or multiple trains; equip¬ 
ment topological aspects (layout); industrial availability of 
machinery; heat exchangers and process towers and 
reactors; influence and interact with the process design. 

The design of a large process plant, or plant modification 
or extension is a complex activity involving engineers of 
many disciplines. The design process normally involves 
engineering organizations and expertise other than the 
operating company. This aspect is considered in Section 
11.2, Conceptual Design, or in the current parlance of the 
industry front-end engineering. 

The project evolves under the influence of: research and 
development, which define the technical possibilities and 
constraints; safety, health and environmental studies, 
which lead to further constraints; economic studies, which 
indicate the productions costs and sales returns together 
with their sensitivity to the various factors; and the finan¬ 
cial approvals, which allow the project to proceed. The 
political, social and environmental issues at the location 
must be recognized. An overall risk of the plant to the 
community must be developed and agreed with the appro¬ 
priate local, state and federal authorities before further 
process design can proceed. This will largely comply with 
regulations and avoid a Bhopal-type catastrophe. The 
infrastructure available will dictate whether the design is 


a self-supporting grassroots or an integrated facility. 
Of course, the additional constraint of the limited space and 
congestion affect the design of offshore facilities. 

The decisions made in the early stages, particularly 
concerning the process route, the plant capacity and their 
locations, are crucial. Thereafter, many options are fore¬ 
closed such that further fundamental changes are difficult, 
if not simply impractical. 

From the safety and loss prevention (SLP) viewpoint 
it is essential to get the process fundamentally right 
from the start, as illustrated above. The design should 
be to eliminate hazard rather than devise measures to 
control it. This aspect is discussed in Section 11.3, 
Detailed Design, and also in Section 11.6, Inherently Safer 
Design. 

The safety of the plant is determined primarily by the 
quality of the basic design rather than by the addition of 
special safety features. It is necessary, however, to incor¬ 
porate specific systematic safety checks throughout the 
design process at each level, generally termed hazard 
identification and assessment studies. 


11.1.1 Process risk management strategies 

Risk has been defined as a measure of economic loss or 
human injury in terms of both the incident likelihood and 
the magnitude of the loss or injury (CCPS, 1989). Thus, any 
effort to reduce the risk arising from the operation of 
a chemical processing facility can be directed toward 
reducing the likelihood of incidents (incident frequency), 
reducing the magnitude of the loss or injury should an 
incident occur (incident consequences), or some combina¬ 
tion of both. In general, the strategy for reducing risk, 


Table 11.1 Examples of process risk management strategies 


Risk 

management 

strategy 

category 

Example 

Comments 

1. Inherent 

An atmospheric pressure reaction using non¬ 
volatile solvents which is incapable of generating 
any pressure in the event of a runaway reaction 

There is no potential for overpressure of the 
reactor because of the chemistry and physical 
properties of the materials 

2. Passive 

A reaction capable of generating 150 psig 
pressure in case of a runaway, done in a 

250 psig reaction 

The reactor can contain the runaway reaction. 
However, 150 psig pressure is generated and the 
reactor could fail due to a defect, corrosion, 
physical damage or other cause 

3. Active 

A reaction capable of generating 150 psig reactor 
with a 5 psig high pressure interlock to stop 
reactant feeds and a properly sized 15 psig 
rupture disc discharging to an effluent treatment 
system 

The interlock could fail to stop the reaction in 
time, and the rupture disk could be plugged or 
improperly installed, resulting in reactor failure 
in case of a runaway reaction. The effluent 
treatment system could fail to prevent a 
hazardous release 

4. Procedural 

The same reactor described in example 3 above, 
but without the 5 psig high pressure interlock. 
Instead, the operator is instructed to monitor the 
reactor pressure and stop the reactant feeds if the 
pressure exceeds 5 psig 

There is a potential for human error, the operator 
failing to monitor the reactor pressure, or failing 
to stop the reactant feeds to stop the reactant 
feeds in time to prevent a runaway reaction 


Note: These examples refer only to the categorization of the risk management strategy with respect to the hazard of high pressure due to a 
runaway reaction.The processes described may involve trade-offs with other risks arising from other hazards. For example, the non-volatile 
solvent in the first example may be extremely toxic, and the solvent in the remaining examples may be water. Decisions on process design must be 
based on a thorough evaluation of all the hazards involved. 
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whether directed toward reducing frequency or con¬ 
sequence of potential accidents, falls into one of the 
following categories (Table 11.1): 

(1) Inherent, or Intrinsic - Eliminating the hazard by 
using materials and process conditions that are non- 
hazardous (e.g. substituting water for a flammable 
solvent). 

(2) Passive — Eliminating or minimizing the hazard by 
process and equipment design features that do not 
eliminate the hazard, but do reduce either the 
frequency or consequence of realization of the hazard 
without the need for any device to function actively 
(e.g. the use of higher pressure-rated equipment). 

(3) Active - Using controls, safety interlocks and 
emergency shut-down systems to detect potentially 
hazardous process deviations and take corrective 
action. These are commonly referred to as engineering 
controls. 

(4) Procedural - Using operating procedures, admin¬ 
istrative checks, emergency response and other 
management approaches to prevent incidents, or to 
minimize the effects of an incident. These are 
commonly referred to as administrative controls. 

Risk control strategies in the first two categories, inherent 
and passive, are more reliable and robust because they 
depend on the physical and chemical properties of the 
system rather than the successful operation of instrument, 
devices and procedures. Inherent and passive strategies 
are not the same and are often confused. A truly inher¬ 
ently safer process will completely eliminate the hazard 
(Kletz, 1991a). 

The design experience and know-how of the organiza¬ 
tion may be generalized in terms of its knowledge of the 
characteristics of particular chemicals,unit operations and 
unit processes and so on. Full use should be made of this 
information both for process design and for hazard identi¬ 
fication. 

Accounts of process design are given in Applied Process 
Design for Chemical and Petrochemical Plants (Ludwig, 
1964—), Equipment Design Handbook for Refineries and 
Chemical Plants (Evans, 1971), Applied Chemical Process 
Design (Aerstin and Street, 1978), Introduction to Chemical 
Process Technology (van den Berg and Dejong, 1980), 
Chemical Process Synthesis and Engineering Design 
(Kumar, 1981), Process Analysis and Design for Chemical 
Engineers (Resnick, 1981) Process Design for Reliable 
Operation (Lieberman, 1983), Introduction to Material 
and Energy Balances (Reklaitis, 1983), Scaleup of Chemical 
Processes (Bisio and Kabel, 1985) Chemical process Compu¬ 
tations (Raman, 1985), The Art of Chemical Process Design 
(Wells and Rose, 1986), Process Modelling (Dean, 1987), 
Conceptual Design of Chemical Processes (Douglas, 1988), 
Foundations of Computer Aided Process Operations 
(Reklaitis and Spriggs, 1988), Chemical Process Equipment 
(Walas, 1990) and Dimensional Analysis and Scaleup in 
Chemical Engineering (Zlokarnik, 1991). 

Economic aspects of process design are treated in A 
Guide to Chemical Engineering Process Design and 
Economics (Ulrich, 1984), Economic Evaluation of Projects 
(D.H. Allen, 1988) and A Guide to Capital Cost Estimating 
(IChemE, 1982a,b). 

Case studies of process design include Process Design 
Case Studies (R.Scott and McLeod, 1991) and the Institution 


of Chemical Engineers (IChemE) model design projects 
described byjeffreys (1961), Austin and Jeffreys (1979) and 
Ray and Johnston (1990). 

Treatment of the SLP aspects of process design is given 
in Hazard Survey of the Chemical and Allied Industries 
(Fowler and Spiegelman, 1968), Flowsheeting for Safety 
(Wells, Seagrave and Whiteway, 1976), Industrial Hazard 
and Safety Handbook (R. King and Magid, 1979), Safety in 
Process Plant Design (Wells, 1980), Chemical Process Safely 
(Crowl and Louvar, 1990), Safety in the Process Industries 
(R. King, 1990), Safety at Work (Ridley, 1994) and Austin 
(1965a, 1982a), Hudson (1965) and Fitt (1976a). 

Selected references on chemical reactors, unit processes, 
unit operations and equipments, extreme operating condi¬ 
tions, utilities, particular chemicals, particular processes 
and plants, ammonia, urea and ammonium nitrate plants, 
and liquefied petroleum and natural gases (LPG and LNG) 
are given in further tables in this chapter. 

11.1.2 Design stages 

Some important stages of the design of a process plant are: 

(1) research and development - pilot plant; 

(2) process design; 

(a) selected process flowsheet, 

(b) detailed process design-simulation, 

(3) front-end conceptual engineering; 

(a) Process development unit (new design), 

(4) Engineering design and equipment specification - 
selection. 

The current execution technique in virtually all organi¬ 
zations is not to have the discrete stages indicated which are 
designated silos, but to have engineering interaction at the 
earliest process stages to avoid subsequent pitfalls. 

The design of a plant is an interactive and iterative pro¬ 
cess. Modifications are made as more information becomes 
available, as constraints or opportunities are recognized, 
and as the situation changes. 

It is necessary to pay close attention to the scheduling 
and co-ordination of the project, which is a project man¬ 
agement function to provide the guidelines required. 

11.1.3 Design information 

Process design can be properly done and executed only 
with adequate and correct design data. This should include 


(1) the physical and chemical properties of the chemicals; 

(2) the reaction characteristics, including mechanism, 
kinetics and thermal data for all likely reactions; 

(3) fire, explosion and toxic hazards; 

(4) the effect of trace impurities which may have a major 
impact on metallurgy. 

Particularly relevant for safety and loss prevention are 
material safety data sheets (MSDSs). These data are legally 
required and must be available for operating plants. 

The data used in the design must be consistent 
throughout the design team. It is necessary, therefore, to 
devote some effort to the provision and documentation 
of these data. 

Beside special proprietary data, processes data are 
available on line from suppliers such as ASPEN. 
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11.1.4 Design standards and codes 

The standards and codes which are to be used in the design 
should be specified from the start. Standards and codes 
give design requirements and guidance. They constitute 
both an aid to the designer and a means of communicating 
design requirements to other parties, with certain con¬ 
tractual implications. They embody the lessons which 
industry has learned from past incidents and are therefore 
a store of experience which the designer should draw on. 

Consistency should be maintained both in the initial 
choice of standards and codes and in their subsequent 
use. A particular code or set of codes embodies a particular 
design philosophy. It is not good practice to use an indis¬ 
criminate mix of codes or to use a different code for a par¬ 
ticular problem simply because its requirements are less 
onerous. This can cause difficulties not only at the design 
stage but also later in plant operation and maintenance 
when confusion may arise as to the design philosophy. 

There is often some degree of overlap in the topics 
covered by different codes. Consideration should be given 
to areas where codes may conflict or where there may be 
gaps which are not covered. 

AnaccountofstandardsandcodesisgiveninAppendix27. 

11.1.5 Design experience 

It is useful to consider the forms in which process design 
experience and know-how are available. The information 
may relate to: 

(1) chemical reactors; 

(2) unit processes; 

(3) unit operations and equipment; 

(4) operating conditions; 

(5) utilities; 

(6) particular chemicals; 

(7) particular processes and plants. 

Thus, much information is available on: the character¬ 
istics of chemical reactors, including reactor protection; 
unit processes, such as oxidation; unit operations, such as 
distillation; operating conditions, such as high pressures 
and low temperature; utilities, such as electricity, steam 
and nitrogen; on particular chemicals such as ethylene or 
chlorine; and particular processes and plants, such as air 
and ammonia plants. 

In particular, information is available in the form of 
national standards and codes of practice, in-house stand¬ 
ards, procedures and reports and checklists. This docu¬ 
mentation is the principal means whereby experience won 
at considerable expense of money, effort and sometimes life 
is made available for design of new plants. This information 
should be used in design, and in the reviews of the design. 

11.1.6 Design communication and documentation 

It is essential in the design process that there be effective 
communication. Much of this communication is done on an 
individual basis or in design committees. The most impor¬ 
tant channel of communication, however, is the docu¬ 
mentation. Details of this have been given in Chapter 6 
and are not repeated here. Of particular importance are 
the process flow sheet, the process flow diagram and 
the engineering line diagram. Examples of the two latter 
are shown in Figures 11.1 and 11.2. 

One item of information which is often required for 
SLP work and which has frequently not been shown on 
flow diagrams is the inventory of the principal vessels. 


It is desirable that flow diagrams show the normal and 
maximum design inventories. 

Of particular importance are the process flow diagram, 
process heat and mass balances, and the engineering flow 
sheets (piping and instrument diagram, P&ID). Typical 
examples are shown in Figure 11.1 process flow diagram 
and Figure 11.2 P&ID. 

11.1.7 Design changes 

At a critical point in the design, a freeze is instituted to 
complete the design effectively. Inevitably, changes occur 
subsequently, usually due to external factors which must 
be accommodated. A management of change (MOC) pro¬ 
cedure is instituted to ensure all aspects of the change are 
properly reviewed, accredited and authorized, and com¬ 
municated to all parties involved. This is also required for 
construction and commissioning activities. The control of 
plant changes or modifications is considered in Chapter 21. 

11.1.8 Overdesign 

Overdesign in engineering is often equivalent to the incor¬ 
poration of an extra factor of safety, but this is by no means 
always so. In some cases such overdesign can reduce safety. 
There is an inherent tendency to overdesign in a project as 
the various individuals in the chain introduce factors of 
safety. In this context overdesign is taken to cover the pur¬ 
chasing as well as the design decisions. What matters is the 
item which is finally installed. 

This is illustrated by two common items of process 
equipment, pumps and control valves. If a pump is required 
which has a certain characteristics relating to flow and 
pressure and if the pump installed is capable of a higher 
flow or pressure, this may introduce a hazard insofar as the 
rest of the plant is not designed for these conditions. Simi¬ 
larly, control valves are almost always oversized. If reliance 
has been placed on a valve of a certain size to limit flow to a 
maximum value and a larger valve is provided, a hazardous 
situation may result. 

11.1.9 Design error propagation 

It is sometimes appropriate to check the error associated 
with a design calculation, particularly if this has important 
safety aspects. If a calculated variable z is a function of two 
other variables x andy, 

*-/(*.>•) PUJJ 

then the calculated value of z will have an error S z which 
results from the errors 8x and 5y in x and y respectively. 
There are two errors which are of interest. The maximum 


Hshib 1 

A more realistic estimate is the probable error 

Further information is given in standard texts (e.g. Jenson 
and Jeffreys, 1963). A discussion of error propagation is 
given by Park and Himmelblau (1980). 




Figure 11.1 Process flow diagram of a benzene plant (Wells, Seagrave and Whiteway, 1976) (Courtesy of the Institution of Chemical Engineers) 





























































Figure 11.2 continued 
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Figure 11.2 Part of engineering line diagram of a benzene plant (Wells, Seagrave and Whiteway, 1976) (Courtesy of the 
Institution of Chemical Engineers) 
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11.1.10 Computer-aided design 

Modern process design involves considerable use of 
computer-aided design (CAD) techniques, particularly for 
flowsheeting, equipment design, plant layout, piping and 
instrument diagrams. Other applications continue to be 
developed. In particular, extensions of computer design are 
developing in the area of information flow in plants, leading 
to automatic hazard identification, fault tree analysis and 
reliability assessment. 

In the design context, computer systems constitute a 
powerful tool not only for design but also for information 
storage and retrieval, and thus for communication. Here 
their effectiveness depends on the database. The design of 
databases which can be used by all members of the team 
and which can be quickly but securely updated is another 
area of development. 

A fuller treatment of CAD is given in Chapter 29 and 
treatment of more advanced CAD developments is given in 
Chapter 30. 


11.2 Conceptual Front End Design 

At the conceptual design stage the process concept is 
developed, its implications are explored and potential 
problems are identified. Design in general and conceptual 
design in particular is generally regarded as an art. Much 
work is going on, however, to put it on a more systematic 
basis. Early work is described in Strategy of Process Design 
(Rudd and Watson, 1968). A systematic approach is stated in 
The Conceptual Design of Chemical Processes (J.M. Douglas, 
1988). A further discussion of fundamental developments 
is given in Chapter 30. 

In most cases, the process is an established one, so that 
the conceptual design stage may be quite short. The nature 
of this stage is best appreciated, however, by considering 
the conceptual design of a new process. Elements of the 
process and plant considered in conceptual design are: 

(1) process materials; 

(2) chemical reaction; 

(3) overall process; 

(4) effluents; 

(5) storage; 

(6) transport; 

(7) utilities; 

(8) siting and layout. 

The topics addressed in the conceptual design are 
principally: 

(9) process design; 

(10) mechanical design; 

(11) pressure relief, blow down, venting, disposal and 
drains; 

(12) control and instrumentation; 

(13) plant construction and commissioning; 

(14) plant operation; 

(15) plant maintenance; 

(16) health and safety; 

(17) environment; 

(18) costing. 

The plant turn-down capability must be defined and the 
potential problems for each piece of equipment identified. 


The philosophy underlying the conceptual design 
should be that of inherently safer design, which is appli¬ 
cable to virtually all aspects. Likewise, in regard to the 
environment, there should be a philosophy of inherently 
cleaner design. 

The process materials include the raw materials, or 
feedstocks, the intermediates, and the products and also 
catalysts, additives and so on. Data are assembled on the 
physical and chemical properties, on the flammability and 
the health and toxicity, including material safety data 
sheets, and any special hazards of, or processing problems 
associated with, the materials. The composition of the raw 
materials is considered, including impurities which they 
may contain. The main chemical reaction of the process is 
reviewed with several aims in view. These are to ensure that 
the information available is adequate and that the reaction 
is sufficiently well understood; to identify the problems 
and hazards associated with the reaction; to define the 
reaction sequence and conditions; to examine the effect of 
the reaction stage on the later processing stages; to explore 
the possibility of alternatives and to determine the basis of 
safety of the reaction. 

Processes which are likely to be particularly hazardous 
with respect to the reaction include those involving: highly 
reactive substances, such as those with a triple carbon 
bond; a high exotherm; unstable substances; thermally 
sensitive substances; substances sensitive to impurities, 
such as air, water, rust or oil and high pressure and/or high 
temperature. 

The other stages of the process are reviewed in a similar 
way. Here the aims are: to ensure that there is sufficient 
design information available; to identify the problems and 
hazards associated with particular process conditions, 
unit operations and equipments; to define the operating 
conditions of the equipment; to explore alternatives and to 
determine the basis of safety of the equipment. 

Some features of process conditions which may point to 
problems or hazards include: operation close to a phase 
change (boiling, condensation, freezing); operating condi¬ 
tions which give on release a flashing liquid and extreme 
requirements for exclusion of air or water, for leak tightness 
or for cleanliness. Corresponding features for equipment 
include: use of novel equipment; requirement for special 
materials of construction; pumping of difficult fluids; and 
unusual pressure relief requirements. 

The gaseous and liquid effluents and solid wastes gen¬ 
erated by the process are reviewed with a view to: reducing 
or eliminating them; rendering them less noxious and more 
easy to dispose of; to explore process alternatives which 
may be beneficial in this regard; and to decide on their 
handling and disposal. 

A review is made of the requirements for storage of raw 
materials, intermediates and products. Storage is always a 
large contributor to costs and often to the hazards of the 
installation. Here the aims are: to define an operating phi¬ 
losophy for the plant in respect of storage and to match the 
storage provided to this; to determine the type of storage to 
be used for each material and the conditions under which it 
is to be stored and to decide in outline the siting and layout 
of the storage. The thrust should be to eliminate storage by 
the use of a ‘just-in-time’ approach. 

The methods of transport of the raw materials and prod¬ 
ucts are reviewed in order: to define material flows for 
delivery and shipping which match the process and storage 
requirements; to explore the implications of the different 
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modes of transport available; to select the mix of transport 
modes which best meets the governing factors; and to 
decide in outline the siting and layout of terminals and 
pipelines. Factors which need to be taken into account 
include the volume of materials transported, the hazards of 
these materials and of the modes of transport, the probable 
life and growth of the transport requirement, the effects of 
traffic on the environment outside the site, and the traffic 
flows and handling within the site. The review of storage 
and transport generally involves interactions particularly 
between these two but also with the process. 

The utilities for the process are reviewed in order: to 
define the requirements not simply in terms of the nominal 
quantities but also of the quality and dependability of the 
supply; to identify any problems and hazards, including 
implications for existing plants; to explore alternatives; 
to determine the method of supply for each utility and to 
decide in outline on siting and layout. On the basis of the 
foregoing information, decisions may then be made con¬ 
cerning the siting and layout. An account has been given in 
Chapter 10 of the principles applicable at the conceptual 
design stage. 

In the foregoing the conceptual design has been treated 
in terms of the process and the plant. In the following it 
is considered essentially in relation to the design dis¬ 
ciplines. The first of these is process design. Some account 
of this has already been given above. In essence, process 
design at this stage involves consideration of the process 
and plant from a number of different viewpoints: the pro¬ 
cess flow sheet and process conditions; the unit processes 
and the unit operations and equipments. Two of the princi¬ 
pal aims at this stage should be the minimization of 
hazards by inherently safer design and the minimization 
of effluents by inherently cleaner design. Regard should 
also be given to the location where the plant is to be built. 
Features such as the nature of the available workforce or 
the access for transport of plant equipment may be rele¬ 
vant. In some cases such factors may point to a more robust 
design. 

The reliability and availability aspects of the plant need 
to be given some thought at this stage. Different philoso¬ 
phies may be adopted. Options are to accept loss of a func¬ 
tion for a period or to minimize its downtime by use of a 
single high reliability unit or to use several units, with 
parallel redundancy or stand-by configurations. For some 
types of plant a single-stream philosophy is the norm. Even 
with such plants, however, there are certain types of units, 
such as furnaces, which are commonly multiple and others 
for which stand-by configurations are widely used. 

The process designer is rarely a completely free agent. 

but even where this is not the case there tend to be 
numerous constraints. There is commonly within the 
company itself a preference for established technology 
and an aversion to innovation and the risk perceived to 
be associated with it. Generally, there are requirements 
imposed by outside parties. A licensor of a process usually 
imposes certain requirements which are a condition of the 
guarantees provided. Likewise, an equipment vendor 
generally makes his guarantees conditional on require¬ 
ments such as use of certain ancillary equipment or 
of alarm and trip instrumentation. An insurer often has 
preferred arrangements for fire protection. Acceptance of 
various constraints may be a condition for raising the 
necessary finance. 


Mechanical design at this stage is fairly limited, but 
consideration is given to materials of construction and to 
the principal vessels and other items of equipment. 

The arrangements for pressure relief, blowdown and 
venting, for relief and vent disposal, and for drains are also 
addressed at this stage. These generally have a number of 
significant implications which it pays to explore at the 
conceptual stage, because changes later in the design tend 
to be either disruptive and costly or simply not possible. 
Thus, a decision to contain rather than to relieve a high 
pressure may entail a stronger vessel, but such vessels have 
to be ordered early. A decision to dispose of a relief flow by 
venting or flaring may require a sterile area which needs to 
be incorporated early in the layout. 

Control and instrument system design is concerned at 
this stage with the philosophy in respect of allocation of 
function between the human operator and automatic sys¬ 
tems and of the means of providing the latter. The process 
may be reviewed to assess unsteady-state features, includ¬ 
ing the dynamics of continuous processes, the sequential 
operation of batch processes, and start-up and shut-down, 
and to identify any particular control and instrument pro¬ 
blems, including difficult measurements. 

The conceptual design stage also covers consideration of 
the construction and commissioning, operation and main¬ 
tenance of the plant. Construction creates requirements for 
space on site, for additional traffic and for lifting equip¬ 
ment, and may affect existing plants. Commissioning also 
may effect existing plants as the new plant is tied in and 
manned. The operation of the plant too has implications for 
other linked plants and for storage requirements. 

The start-up and shut-down of the plant are considered 
at the conceptual design stage. Start-up involves taking the 
plant through a series of discrete stages. In general, some of 
these stages can be held indefinitely, whilst others are 
essentially transient, with no choice but to proceed to the 
next stage or revert to an earlier one. These stages need to 
be defined and holding states identified. Likewise, normal 
shut-down may be effected in a series of discrete stages and 
these need to be defined. It is also prudent to identify 
holding states, or fail-back positions, short of shut-down, 
to which the operator can move if abnormal conditions 
develop, thus taking pressure off him and making the 
plant more friendly. Definition of emergency shut-down is 
necessary since it is liable to involve abnormally high flows 
which have to be catered for. 

The plant needs to be reviewed in respect of health, 
safety and environmental factors. Each of these aspects 
needs to be assessed using a formal method to identify the 
problems. Health factors may affect features such as the 
degree of leak-tightness required, the use of buildings and 
the need for particular operating practices. 

The factors related to safety are discussed throughout 
this text and are not rehearsed here, but one particular 
aspect merits mention at this point. This is the major 
hazard potential of the plant, which needs to be addressed 
at the conceptual design stage.This evaluation is necessary 
because the information gained has a bearing on many 
fundamental aspects of the design. Methods of hazard 
identification and assessment appropriate to the con¬ 
ceptual design stage have been described in Chapters 8 and 
9. Relevant techniques include the various preliminary 
hazard study and hazard ranking methods. The formal 
requirement for the use of such methods as part of the 
management system has been discussed in Chapter 6. 
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The approach to environmental aspects is essentially 
similar, with a formal requirement for the assessment of 
the major environmental impact potential using specified 
methods. There are now regulatory requirements for a 
safety case for major hazard installations and for an 
environmental impact statement for certain developments, 
as described in Chapters 3 and 4. 

The conceptual design includes, as part of an overall 
economic assessment, an estimate of the costs of the vari¬ 
ous elements described. 

11.3 Detailed Engineering 

The detailed design stage involves the detailed process and 
mechanical design together with detailed design from a 
large number of supporting disciplines. The treatment 
given here is confined to a broad outline, with particular 
reference to features bearing on SLP. 

Elements of the detailed design of the process and plant 
include: 

(1) process design; 

(2) mechanical design; 

(3) storage; 

(4) transport; 

(5) utilities; 

(6) layout; 

(7) pressure relief, venting and disposal; 

(8) control and instrumentation; 

(9) fire protection; 

(10) explosion protection; 

(11) toxic emission protection; 

(12) personnel protection; 

(13) plant failures; 

(14) plant operation; 

(15) plant maintenance; 

(16) plant reliability, availability and maintainability; 

(17) equipment specification, selection and procurement; 

(18) health and safety; 

(19) environment. 

Central to the process design is the chemical reactor. The 
design should minimize the probability of a hazardous 
excursion and provide means for dealing with one should it 

The process design should take full account of 
the experience available, both within the company and 
elsewhere, in respect of the unit processes, the unit 
operations and equipments, the operating conditions, the 
utilities, the particular chemicals and the particular pro¬ 
cesses and plants, as described in Sections 11.7—11.12, 
respectively 

The process design sets the operating conditions 
throughout the process for normal operation and defines 
the envelope of conditions within which the process can 
operate safely. This information governs the mechanical 
design. Consideration should be given in the process 
design to the various operational deviations which may 
occur and to the impurities which may be present, as 
described in Sections 11.13 and 11.14, respectively. 

In the mechanical design, the materials of construc¬ 
tion need to be compatible with the process materials 
not only at flow sheet conditions, but within the whole 
envelope of operating conditions, and compatible also 
with each other. Attention needs to be paid to impurities 


which may cause greatly increased corrosion. Considera¬ 
tion has to be given also to erosion. Major piping vessel 
codes have been rewritten and emphasis placed on low 
temperature design to avoid catastrophic low temperature 
material failure. 

The design should ensure effective containment of the 
process fluids within the pressure system of vessels, pipe¬ 
work and rotating machinery. Piping design accounts for 
50 % of the reported loss of containment incidents. Detailed 
attention needs to be given to pipework, pipework joints 
and pipework supports, and to the numerous features 
which can cause damage, including vibration, thermal 
expansion and contraction, shut-in fluids, water hammer 
and external events. Likewise, weak points on rotating 
machinery such as pump seals require consideration. 

In addition to avoidance of loss of containment, it is also 
necessary to design to minimize much smaller but con¬ 
tinuous leaks, known as fugitive emissions. These are con¬ 
sidered in Chapter 15. 

There often arise situations where there is a trade-off to 
be made between flexibility and complexity. It may be 
possible to design manifolds which allow a more flexible 
use of certain items of equipment but at the price of a con¬ 
siderable increase in complexity of the pipework. Often 
complexity may be too high a price to pay for the additional 
flexibility The mechanical design of the plant is dealt with 
in Chapter 12. 

Features of the design of storage are the choice between 
pressure and refrigerated storage for liquefied gases, the 
specification of the design pressure and temperature, the 
venting and the operating and fire relief arrangements, 
the fire protection, the bunding or drain-off arrangements, 
and other aspects of storage layout. 

For the loading and unloading terminals for the trans¬ 
port of raw materials and products, features are the fluid 
transfer arrangements, the fire protection, the emergency 
isolation, the control of ignition sources, including pre¬ 
cautions against static electricity and hazardous area 
classification, and other aspects of terminal layout. Non¬ 
return or check valves must always be used at any connec¬ 
tion between a utility and the process, often removable 
isolation spools are also provided. 

Location of vent stacks, furnaces and boilers should take 
into account the prevailing wind. Seismic design is parti¬ 
cularly relevant in storage tank areas. 

Plant layout is considered in Chapter 10. Features which 
merit mention here are: the provision of separation to 
minimize both ignition of flammable leaks and the 
effects of fire and explosion, and hence domino effects; 
the control of ignition sources through hazardous 
area classification; the provision of a suitable drainage 
system; and the labelling of equipment to ensure positive 
identification in plant operation and maintenance; as well 
as the aspects of the layout of storage and terminals already 
mentioned. 

The arrangements for venting, pressure relief and 
blowdown are a significant feature and have a pervasive 
influence on the overall design. It is normally necessary to 
cater: for venting from the process, either continuously or 
periodically; for pressure relief for operational conditions; 
and for pressure relief for fire conditions. Features are: the 
relief scenarios; the location, setting and capacity of 
relief devices; the selection of these devices; the relief col¬ 
lection system; the choice between relief to atmosphere or to 
a disposal system; and the selection of the disposal system. 
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It is also necessary to cater for the relief and blowdown 
which occurs during emergency shut-down. Venting and 
pressure relief are treated in Chapters 12 and 15. 

Aspects of the control and instrumentation system 
which are particularly relevant here are the provision of: 
protective systems in the form of trips and interlocks; a fire 
and gas detection system; and an emergency shut-down 
system. Control and instrumentation are considered in 
Chapter 13. 

The fire protection system will generally rely on a com¬ 
bination of passive features such as layout and fire insula¬ 
tion and active ones such as fire and gas detection, 
emergency blowdown, and fire fighting and equipment 
cooling systems using water spray, foam and other meas¬ 
ures. Fire and fire protection are discussed in Chapter 16; 
layout aspects are treated in Chapter 10. 

Protection may also be required against explosion of 
flammable vapours or dusts within the plant or inside 
buildings. Explosions and explosion protection are 
considered in Chapter 17; layout aspects are treated in 
Chapter 10. 

If the substances handled are particularly toxic, it may 
well be necessary to design for an enhanced degree of 
protection against them. The first line of defence is a 
more leak-tight plant. Dilution and removal of any leaks 
which occur is assisted if the plant is located in the open, 
but if it is in a building ventilation may be necessary. 
Toxic releases and occupational health are dealt with in 
Chapters 18 and 25; fugitive emissions are considered 
in Chapter 15. 

Personnel protection should not be neglected. Aspects 
include: access to equipment, particularly hand valves; 
layout to minimize contact with corrosive substances; 
guarding of moving machinery; insulation and other 
measures to prevent contact with hot surfaces; and safe¬ 
guards to prevent injury due to the operation of fire extin¬ 
guishing systems. Chapters 10,16 and 25 in particular deal 
with such topics. 

The design should cater for the requirements of plant 
operation, discussed in Chapter 20. The requirement 
to isolate items of equipment or sections of the plant 
should be studied and features such as high frequency of 
isolation or need for positive isolation identified and, where 
appropriate, measures taken or facilities provided. Thus 
flexibility may be built into the pipework to assist the 
insertion of slip plates, or isolation facilities, such as a 
spectacle plate or double block and bleed valves, may be 
provided. 

The requirements for plant start-up, normal shut-down 
and emergency shut-down should be studied and facilities 
provided as necessary. 

Facilities need to be available to dispose of any material 
which is off specification, contaminated, or otherwise 
unsatisfactory, which may be produced in the course of 
plant operation, whether in the plant itself or in storage. 
Inspection is practised on a range of plant equipment 
and using a variety of techniques, and for some of these 
it may be necessary to provide facilities, even if this 
amounts to no more than suitable access. Likewise, facil¬ 
ities may be required for various types of test on equip¬ 
ment. Plant inspection and testing are considered in 
Chapter 19. 

For plant maintenance reference has already been made 
to isolation arrangements. Maintenance often involves 
emptying the plant of fluids and suitable vents and drains 


need to be provided for this purpose. It may also be neces¬ 
sary to clean the inside of the plant, and this too may 
require particular facilities. Plant maintenance is dis¬ 
cussed in Chapter 21. Plant lock-out tag procedures must be 
in place to meet legislative requirements for the Occupa¬ 
tional Safety and Health Laws. 

The failures that may occur on the plant should be con¬ 
sidered. The items of plant equipment should be identified 
which are particularly vulnerable to frequent failure 
and/or failure of which could have serious consequences. 
For plant systems failures, ‘Hazop’, ‘what if, or check list 
techniques should be used. A technique particularly 
suitable for investigation of potential equipment failures is 
failure modes and effects analysis (FMEA). 

Consideration should be given to hazardous passages of 
fluid through isolation, which include leaks through valves 
which are not leak-tight and opening of bypasses around 
equipment. 

The effect on the plant of failure of utilities such as 
electrical power or cooling water should be reviewed. The 
need for emergency back-up supplies should be considered, 
as described earlier. 

The effect of abnormal conditions and of start-up, nor¬ 
mal shut-down and emergency shut-down on plant under 
design on other linked plants should receive attention. 
Links exist by virtue of the transfer of materials between 
the plants or common use of a utility. Likewise, the effect on 
the plant in question of such conditions on other plants 
should be considered. 

For critical functions the reliability and availability 
required should be specified. Steps can then be taken to 
ensure that the specification is met by the elimination of 
causes of failure, the use of single, high reliability items, or 
the use of suitable configurations of multiple items, such as 
installed spares. This approach should also be applied to 
the utilities, including the emergency back-up supplies. 

The specification, selection and procurement of equip¬ 
ment should receive its share of attention. The equipment 
specification should match the design of the plant into 
which it is to be incorporated. The initial specification may 
be defective in neglecting some important aspect. Alter¬ 
natively, it may be unnecessarily restrictive. It may well pay 
to discuss the specification with other parties to the design 
and with the prospective manufacturer. In selecting the 
equipment, the experience of the manufacturer in supply¬ 
ing equipment for similar duties should be taken into 
account. It should be borne in mind, however, that whilst a 
manufacturer supplies a range of equipments which are 
suitable for a generic duty, he cannot be expected to know 
about special features or requirements which may exist on 
the plant in question. 

The detailed design needs to be subjected to review in 
respect of health, safety and environment. The design 
assessments made of these and other aspects are now 
considered. 


11.4 Design Assessments 

As the design progresses, it is subject to various assess¬ 
ments, which draw on a number of specific techniques. 
Those considered here are: (1) critical examination, (2) value 
engineering assessment, (3) energy efficiency assessment, 
(4) reliability and availability assessment, (5) hazard iden¬ 
tification and assessment, (6) occupational health assess¬ 
ment and (7) environmental assessment. 
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11.4.1 Critical examination 

Critical examination, which is a structured method for 
asking basic questions about the plant, is an effective 
method for fundamental review, exposing assumptions 
and generating alternative options. There are in effect a 
family of techniques which have grown out of critical 
examination. One is hazop, which is directed to hazard 
identification, as described in Chapter 8. Another is value 
engineering, which is now considered; construction man¬ 
agement; inspection and documentation. 

Value engineering utilizes the techniques of reliability 
engineering and hazard identification such as Pareto analy¬ 
sis and FMEA. A large value engineering study may take 
approximately 300-400 h, a medium one 100-300 h and a 
small one 20-100 h. Others include value improving prac¬ 
tices (VIPs), which are now considered. 

11.4.2 Value improving practices 

VIPs are formal structured practices applied to the front- 
end stages of any project to improve profitability above that 
attained through good engineering and project manage¬ 
ment practices. VIPs are also intended to challenge existing 
project and design premises to ensure the most robust and 
profitable facility results. Often, design deficiencies are 
revealed in these workshops and better alternates identi¬ 
fied. Well-recognized VIPs include: 

(1) classes of facility quality; 

(2) technology selection; 

(3) process simplification; 

(4) constructability; 

(5) customization of standards and specifications; 

(6) predictive maintenance; 

(7) process reliability simulation; 

(8) value engineering; 

(9) design to capacity; 

(10) energy optimization; 

(11) waste minimization; 

(12) Three-dimensioanl-CAD. 

All VIPs include key components that ensure that the 
design will result in a safe and predictably operable facility 
Moreover, the practices all focus on identifying safe, tech¬ 
nically viable and economically attractive improvements. 
To accomplish this, improvements are identified, analysed 
and recommended by multidiscipline expert teams com¬ 
posed project team members and experts from outside the 
project team. Experience has proven that including subject 
matter experts from the operating company involved, the 
engineering contractor and key technology licensors pro¬ 
duce the best overall results. Experince has also shown that 
three of the VIPs are the most rigorous and consistently 
produce greater value improvements. They are the process 
simplification VIP, the constructability VIP, and the value 
engineering VIP. 

11.4.3 The value methodology 

The process simplification VIP and the value engineering 
VIP require the use of the value methodology. This meth¬ 
odology has been used extensively throughout industry 
since the 1940s and is supported by the Society of 
American Value Engineers (SAVE) International (see SAVE 
at http://www.value-eng.org). This methodology is now 
used worldwide and is an integral part of many major pro¬ 
ject plans in industry and government today. 


The value methodology follows an established set of 
procedures that include: (1) pre-study planning and infor¬ 
mation gathering, (2) information analysis, (3) function 
identification and analysis, (4) identification of creative 
alternatives for key functions via brainstorming, (5) evalu¬ 
ation of selected alternatives, (6) development of selected 
alternatives to estimate costs, benefits, risks and other 
impacts to the project, (7) recommendation of the best 
alternatives, (8) implementation or approved recommenda¬ 
tions by the project team and (9) post-study follow-up. 

The value methodology differs from simple brainstorm¬ 
ing session and simple cost-cutting exercises by empha¬ 
sizing function analysis based on health, safety and 
environmental (HSE) requirements, required construction, 
operations and maintenance needs, project and market 
schedule constraints, all expected facility uses and oper¬ 
ating conditions, and consideration of life-cycle costs and 
not just installed costs. 

11.4.4 Function analysis 

A function is the intent or purpose that the equipment, 
product or process is expected to perform best described 
using an active verb and a measurable noun. In the function 
analysis phase, each function is depicted in graphical 
intuitive-logic format known as a function analysis system 
technique (FAST) diagram. For example, one of a dis¬ 
tillation column’s functions could be to ‘separate volatile 
compounds’. Another function might be ‘separate final 
product.’ Functions are obtained by confirming what the 
process system or equipment component must do or how it 
must perform under steady-state and non-steady-state 
conditions. 

Once the functions of the design and project are identi¬ 
fied in a collaborative team environment, alternatives for 
each function are sought in an open creative environment 
via various brainstorming techniques. These alternatives 
are then evaluated by the team. If they are found to offer 
higher overall value than the current design, they are 
recommended for further engineering analysis. If the 
analysis confirms that the life-cycle benefits outweigh 
the risks, then the change becomes a permanent part of the 
design or facility. 

11.4.5 The process simplification VIP 

The process simplification VIP consistently yields the 
greatest value improvements of the VIPs. It is a formal, 
rigorous process to search for opportunities to eliminate or 
combine process and utility system steps or equipment 
ultimately resulting in the reduction of investment and 
operating costs. The focus is the reduction of installed 
costs and critical path schedule while balancing these 
value improvements with expected facility operability, 
flexibility and overall life-cycle costs. The so-called 
value improvements that compromise safe operations or 
required environmental performance are not accepted 
or recommended from these formal studies. Critical 
analysis of each recommended improvement is required 
by the project team to verify that the risks associated 
with the recommended change are well understood and 
manageable. 

Process simplification is executed in a formal workshop 
with an experienced facilitator. It insures that low- or zero- 
value functions or equipment included in the project scope 
are challenged to be the highest value possible for the 
project. Removal of these low- or zero-value functions from 
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the project scope, if possible, will most likely yield sig¬ 
nificant economic improvements to the overall project. 

Process simplification results in reduced capital costs 
(CAPEX), improved critical-path schedule, reduced pro¬ 
cess inventory, increased yields, reduced operating and 
maintenance costs (OPEX), increased productivity, incre¬ 
mental capacity gains, reduced utility and support systems 
requirements and reduced waste generations. It also pro¬ 
vides a means for integrating overall plant wide systems 
when applied at the block level in addition to the unit level. 

11.4.6 The constructability VIP 

The constructability VIP is the facilitated systematic 
implementation of the latest engineering, procurement and 
construction concepts and lessons learned consistent with 
the facility’s operations and maintenance requirements to 
enhance construction safety, scope, cost, schedule and 
quality. This VIP involves planning, design, procurement, 
fabrication and installation to achieve the best overall 
project safety record, lowest installed costs and the 
shortest reasonable schedule. Constructability helps 
account for construction options and requirements during 
design, thus reducing re-work and delay in the construc¬ 
tion and start-up schedules. 

11.5 Licensors, Vendors and Contractors 

The description of the design process which has just been 
given is based essentially on that which takes place in an 
operating company which is designing its own plant. The 
ultimate responsibility for the safe design and operation of 
plant lies with the operating company and the owner. It 
should take the appropriate steps to ensure that the pro¬ 
cesses designed and the equipment supplied by the other 
parties are safe. 

Some design responsibility resides, however, with 
other parties. These may be (1) licensor, (2) vendor and 
(3) contractor. A treatment of licensing is given in Licen¬ 
sing Technology and Patents (V Parker, 1991). Contractual 
arrangements are the subject of the series Model Form of 
Conditions of Contractfor Process Plants in three volumes - 
(1) subcontracts, (2) lump sum contract and (3) reimburs¬ 
able contracts - by the IChemE (1992a-c) (the ‘Yellow 
Book’, ‘Red Book’ and ‘Green Book’, respectively) with a 
guide by D. Wright (1993) (the ‘Purple Book’). 

If the process has been bought under licence, then the 
licensor has some design responsibility. The extent of this 
depends on how much information the licensor releases as a 
result of the licence agreement. Normally the licensor is 
responsible for the basic process flowsheet, but he may also 
specify some detailed process design and safety features. It 
is important to ensure that the division of responsibilities is 
specified in the licence and that adequate information and 
documentation are made available. 

There is a responsibility on the vendor to supply equip¬ 
ment which is safe. The equipment should conform to spe¬ 
cified standards and codes and it should have adequate 
documentation such as fabrication records or operating 
instructions. The purchaser is responsible for specifying 
standards and codes to be used, for ensuring that the 
equipment delivered is that specified and for seeing that it 
is used as intended. If changes are required to a licensed 
process or to equipment, consideration should be given 
as to whether these constitute modifications on which 
consultation is required. 


The responsibilities of the contractor depend on whether 
he is responsible for the whole process and engineering 
design on a turnkey basis or whether he is acting as an 
extension of the client’s own organization and is thus 
undertaking detailed engineering only. In the first case the 
responsibility of the contractor is obvious, but even in the 
second he retains a residual responsibility Again it is 
important for the contract to state clearly the division of 
responsibility. If the design responsibility lies primarily 
with the contractor, he should subject the design to safety 
checks using methods of hazard identification and assess¬ 
ment, as already described. 

It may happen in some cases that the client proposes a 
feature which the contractor considers unsafe. If agreement 
cannot be reached, the contractor should not undertake this 
feature. Another point of difficulty can arise if the client 
wishes to make a modification. The contractor should make 
all reasonable checks that the modification does not intro¬ 
duce a hazard. 

11.6 Inherently Safer Design 

The best way of dealing with a hazard is to remove it com¬ 
pletely. The provision of means to control a hazard is very 
much the second best solution. This has been succinctly 
stated by Trevor Kletz as ‘What you don’t have, can’t leak’. 
This, of course, immediately eliminates fire and explosive 
hazards. A corollary to this is the importance of limiting 
inventory of hazardous materials, which is one of the 
lessons learned in the Flixborough disaster. This principle 
has been incorporated in the systematic application of 
inherent safety. 

The terminology ‘inherently safer design’ is ‘intrinsi¬ 
cally safer design’ which is associated with electrical power 
and control issues. The comparative term safer is used since 
no operating plant is absolutely or totally ‘safe’. 

11.6.1 Limitation of inventory 

One of the principal ways in which a process may be made 
inherently safer is to limit the inventory of hazardous 
material. The scale of the Flixborough disaster was due to 
the fact that the holdup of flammable liquid at high pres¬ 
sure and temperature in the reactors was large. The inven¬ 
tory in the five reactors and one after-reactor operating at 
the time of the explosions was about 120 te.The Flixborough 
Report recommended that consideration be given to 
reducing the inventories on process plants. 

It is a normal objective in design to minimize the volume 
of process vessels, as this saves on the cost both of the ves¬ 
sels themselves and of the supporting structures. But the 
reduction of holdup, though recognized as a generally 
desirable aim from the safety viewpoint, had not been par¬ 
ticularly emphasized as an explicit aim in safe design. 

This situation has been changing, largely as a result of 
Flixborough. The Second Report of the ACMH (Harvey, 
1979b) states that limitation of inventory should be a spe¬ 
cific design objective. The philosophy of limitation of 
inventory has been memorably captured by the motto of 
Kletz (1978c): ‘What you don’t have, can’t leak’. It is better to 
have only a small inventory of hazardous material than a 
large one which can be rendered relatively safe only by 
highly engineered safety systems. In other words, it is 
better to keep a lamb than a caged lion. 

Process inventories have been increasing proportion¬ 
ally to plant capacities based on fixed holdup time rules. 
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This has usually been based on pneumatic and direct 
controlled instrumentation with limited response times. 
Currently with electronic instrumentation, smart control 
valves and transmitters, DCS- and PC-integrated systems 
these rules no longer apply. This results in adequate con¬ 
trollability with much smaller inventories. 

The advent of very large process plants has resulted in 
massive overhead distillation accumulators which require 
isolation safety systems as well. In many cases, the accu¬ 
mulators can be eliminated by providing judiciously 
reduced inventory in the wells of the overhead condensers. 
This principle has been utilized on a number of recent plant 
designs. 

11.6.2 Some basic principles 

Some basic principles of inherently safer design Kletz 
(1984a-m, 1991b) are: 

(1) intensification; 

(2) substitution; 

(3) attenuation; 

(4) simplicity; 

(5) operability; 

(6) fail-safe design; 

(7) second chance design. 

A plant which embodies these principles is described by 
Kletz (1989c, 1990f) as a ‘friendly plant’. Some features of 
friendly plants are given in Table 11.2. 

These basic principles have been distilled down to the 
following systemized approaches (CCPS, 1996 ‘Gold Book’): 

(1) minimize; 

(2) substitute; 

(3) moderate; 

(4) simplify. 

Approaches to the design of inherently safer processes and 
plants have been grouped into four major strategies by 
IChemE and IPSG (1995) and Kletz (1984a-m, 1991b); and 
CCPS (1996 ‘Gold Book’ 1993a). 

11.6.3 Intensification 

A principal route to limitation of inventory is intensifica¬ 
tion of the process. This means carrying out the reaction or 
unit operation in question in a smaller volume. Process 
intensification is applicable to a wide range of chemical 
engineering operations, including reactors, mass transfer 
operations such as distillation and gas absorption, and to 
heat exchange, as described below. 

11.6.4 Substitution 

Another principle of wide applicability is that of substitu¬ 
tion, in which a hazardous feature is replaced by a less 
hazardous one. Applications described below include sub¬ 
stitution in the main process reaction and in heat transfer 
media. 

11.6.5 Attenuation 

A third principle, that of attenuation, involves the use 
of less hazardous process conditions. Examples of its 
application are given below. What constitutes a less hazar¬ 
dous process condition, however, is not always obvious. 
The problem is a multidimensional one. This aspect 
is described below in the context of the hazards of 
compromise. 


11.6.6 Selection of process 

The starting point for inherently safer design is the selec¬ 
tion of the process with a view to eliminating particularly 
hazardous chemicals and/or to operating under less 
hazardous conditions. Some examples of selection of 
inherently safer processes are given by Kletz. In dyestuffs 
production use is no longer made of benzidene and certain 
other intermediates because they are carcinogenic. 

In the production of KA, a mixture of cyclohexanone 
and cyclohexanol, used in the manufacture of nylon, two 
routes are available. One is by air oxidation of cyclohexane, 
the process used at Flixborough. The other involves 
the hydrogenation of phenol, which occurs in the vapour 
phase and is less hazardous. That the choice of route 
cannot be considered in isolation, however, is illustrated 
by the fact that the usual process for the production 
of phenol involves oxidation of cumene, a process 
generally regarded as at least as hazardous as cyclohexane 
oxidation. 

The compounds 4,4-diphenylmethane diisocyanate 
(MDI) and toluene diisocyanate (TDI) are made using 
phosgene as an intermediate, which is highly toxic. Efforts 
have been made to devise an alternative, but these have not 
been entirely successful. However, manufacturers using 
the original route have been able to reduce drastically the 
amount of phosgene stored, or even to eliminate phosgene 
storage completely by passing the gas direct from the 
production to the consumer unit. 

Generation and immediate consumption, rather than 
storage, of the intermediate methylisocyanate (MIC) is one 
of the proposals made for inherently safer design of the 
process used at Bhopal. Other manufacturers are known to 
make use of much smaller storages of the intermediate. 

11.6.7 Hazards of compromise 

It is as well at this point to draw attention to the fact 
that, as far as operating conditions are concerned, a com¬ 
promise solution may turn out to be the most hazardous. 
The hazard may be relatively low for a process with a large 
inventory but operating at low pressure and temperature 
such that if an escape occurs only a small amount of mate¬ 
rial will flash off. At the other extreme a process operating 
at high temperature and pressure may present only a low 
hazard, because the use of these operating conditions 
allows the inventory to be kept low. The compromise solu¬ 
tion of moderate inventory at moderate pressure 
and temperature may actually be the most hazardous, if 
the conditions are such that on release a large fraction 
of the material will flash off and the inventory is such that 
the quantity escaping is likely to be large. In cyclohexane 
reactors, the reaction product still contained approxi¬ 
mately 94% of unreacted cyclohexane. The holdup in the 
reactors and the circulation of unreacted material were 
both large. 

Limitation of inventory in the reactor is illustrated by the 
evolution of the processes for the manufacture of nitrogly¬ 
cerine, which has been described by N.A.R. Bell (1971). The 
first stage of development was a batch process with a 
holdup of about 1000 kg. The second was a continuous 
process with a 200-300 kg inventory. The third, the NAB 
process, is again continuous, with reaction taking place in a 
nozzle and with a holdup of only about 5 kg. 

Another example of inherently safer design of a reactor is 
the development of an alternative design of adipic acid 
reactor as described by Hearfield (1980a). The original 
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Table 11.2 Some features of friendly plants (Kletz, 1990f) (Courtesy of Elsevier Publishing Company) 


Characteristic 


Friendliness 

Hostility 

1. 

Intensification 

Distillation 

Higee 

Conventional 



Heat transfer 

Miniaturize 

Conventional 



Nitroglycerine manufacture 

NAB process 

Batch process 



Intermediate storage 

Small or nil 

Large 



Reaction 

Vapour phase 

Liquid phase 




Tubular reactor 

Pot reactor 

2. 

Substitution 

Heat transfer media 

Non-flammable 

Flammable 



Solvents 

Non-flammable 

Flammable 



Chlorine manufacture 

Membrane cells 

Mercury and 





asbestos cells 



Carbaryl production 

Israeli process 

Bhopal process 

3. 

Attenuation 

Liquefied gases 

Refrigerated 

Under Pressure 



Explosive powders 

Slurried 

Dry 



Runaway reactants 

Diluted 

Neat 



Any material 

Vapour 

Liquid 

4. 

Simpler design 


Hazards avoided 

Hazards controlled by 


with fewer leakage 
points or 



added equipment 


opportunities for error 


Single stream 

Multi-stream with 





many cross-overs 




Dedicated plant 

Multi-purpose plant 




One big plant 

Many small plants 



Spares 

Uninstalled 

Installed 

5. 

No knock-on effects 


Open construction 

Closed buildings 




Firebreaks 

No firebreaks 



Tank roof 

Weak seam 

Strong seam 



Horizontal cylinder 

Pointing away from 

Pointing at other 




other equipment 

equipment 

6. 

Incorrect assembly 
impossible 

Compressor valves 

Non-interchangeable 

Interchangeable 



Device for adding 

Cannot point upstream 

Can point upstream 



water to oil 



7. 

Status clear 


Rising spindle valve or 

Non-rising spindle 




ball valve with fixed 
handle 

valve 




Spectacle plate 3 

Slip plate 

8. 

Tolerant of maloperation 


Continuous plant 

Batch plant 


or poor maintenance 


Spiral wound gasket 

CAF gasket 




Expansion loop 

Bellows 




Fixed pipe 

Hose 




Articulated arm 

Hose 

9. 

Low leak rate 


Spiral wound gasket 

CAF gasket 




TUbular reactor 

Pot reactor 




Vapour phase reactor 

Liquid phase reactor 

10. 

Easier to control 

Response to change 

Flat 

Steep 



Negative temperature 

Processes in which rise 

Most processes 



coefficient 

in T produces reaction 
stopper 





Most nuclear reactors 

Chernobyl reactor 



Slow response 

AGR 

PWR 



Less dependent 

AGR, FBR, HTGR 

PWR 



on added-on 

Safety systems 

PIUS 
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Table 11.2 continued 

Characteristic 


Friendliness 

Hostility 

11. Software 

Errors easy to detect and correct 
Training and instructions 
Gaskets, nuts, bolts, etc. 

Some PES 

Some 

Few types stocked 

Some PES 

Most 

Many types stocked 

12. Other industries 

Continuous movement 13 
Helicopters with two rotors 
Chloroform dispenser 

Rotating engine 
Cannot touch 

Reverse connection 
possible 

Reciprocating engine 
Can touch 

Reverse connection 
impossible 

13. Analogies 

Marble on saucer 

Boiled egg 

Lamb 

Bungalow 

Tricycle 

Concave up 

Pointed end up, 
hard-boiled, 
medieval egg-cup 

Lion 

Staircase 

Bicycle 

Convex up 

Blunt end up, 
soft-boiled, 
standard egg-cup 


a A spectacle plate is easier to fit (in rigid piping) and easier to find. 

b In practice reciprocating internal combustion engines are not less friendly than rotating engines, though one might expect that equipment 
which continually starts and stops would be less reliable. 

AGR, advanced gas-cooled reactor; CAF, compressed asbestos fibre; HTGR, high temperature gas reactor; FBR, fast breeder reactor; 
PES, programmable electronic system; PIUS, process inherent ultimate safety reactor; PWR, pressurized water reactor. 


design and the design finally adopted in 1980 are shown in 
Figure 11.3. In the latter the inventory is reduced and many 
of the sources of leaks - the agitator, pump, external cooler 
and connecting pipework - are eliminated. 

11.6.8 Plate heat exchangers 

Another application of process intensification is the use of 
plate heat exchangers, as described by C. Butcher (1992c). 
Plate heat exchanger technology is developing rapidly and 
exchangers are available for a much wider range of appli¬ 
cations than previously. For example, the pressure range 
has been extended from about 80 to 100 bar. 

The potential of plate heat exchangers goes beyond con¬ 
ventional heat transfer applications. One concept is the use 
of plate heat exchangers coated with catalyst as methane 
reformers. It is estimated that a plate heat exchanger 
reformer with capacity sufficient for a 1000 te/day metha¬ 
nol plant would be about 4 m 3 ; this contrasts with conven¬ 
tional reformers which are about 20 m high. 

11.6.9 Combination of unit operations 

Another form of intensification is the conduct of several 
unit operations in one equipment. Kletz (1992c) cites the 
example of a design in which the operations of drying, heat 
exchange and granulation are combined. 

11.6.10 Applications of substitution 

Some applications of substitution in the main reaction of 
the process have been described by S.E. Dale (1987). One is 
the process for acrylonitrile, which was originally manu¬ 
factured from acetylene and hydrogen cyanide, both 
hazardous chemicals, but is now made from propylene, 
ammonia and air, all less hazardous. Another example is 
the production of ethylene glycol from ethylene rather than 
from ethylene oxide, another hazardous material. These are 
good examples of inherently safer design, even though they 
have been made for essentially economic reasons. Further 




Figure 11.3 Alternative designs of adipic acid reactors 
(Hearfield, 1980a): (a) original design with external cooling; 
(b) evolved design with internal cooling (Courtesy of the 
Institution of Chemical Engineers) 
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illustrations of the substitution of less hazardous reactions 
have been given by R.L. Rogers and Hallam (1991). One case 
quoted is the manufacture of the synthetic nitrocarbamate 
shown in Figure 11.4(a). One of the routes considered 
involved the preparation and isolation of the nitrobenzoyl 
chloride intermediate shown in Figure 11.4(b). Experience 
indicated that this was likely to be thermally unstable. 
Further work identified a route in which the nitration is 
effected at a later stage. Another example involves the oxi¬ 
dation of a substituted acetophenone to a carboxylic acid. 
The reaction shown in Figure 11.4(c) involves hydrogen 
peroxide. This was replaced by that shown in Figure 11.4(d) 
with air and a catalyst. 

11.6.11 Applications of attenuation 
S.E. Dale (1987) has also described some applications of 
attenuation. He cites a number of processes which now 
operate at lower pressures, often due to improvements in 
the catalysts. Processes which he mentions include metha¬ 
nol synthesis, polyethylene and polypropylene processes, 
and the Oxo process. 

Another process which he quotes is the production of 
butyl lithium, which is pyrophoric and thus liable to ignite 
when exposed to air. This hazard is minimized by produ¬ 
cing the butyl lithium in dilute solution. 



(d) 

0 0 
II Catalyst /p-\ II 

x-ttJJV- c-ch 3 + 0 2 --X— \CJ)>-c-OH 

Figure 11.4 Some reaction routes of varying degree of 
hazard (R.L. Rogers and Hallam, 1991): (a) substituted 
nitrocarbamide; (b) nitrobenzoyl chloride intermediate; 

(c) oxidation of a substituted acetophenone to a carboxylic 
acid using hydrogen peroxide; and (d) oxidation of the 
substituted acetophenone to the carboxylic acid using 
air and catalyst (Courtesy of the Institution of Chemical 
Engineers) 


11.6.12 Design of unit operations 

Distillation units may contain appreciable inventories of 
hazardous materials. The quantities held up in a large 
modern unit are of the same order as those previously held 
in storage on smaller plants. Substantial reductions in the 
inventory in distillation units by better design have been 
demonstrated. 

Column inventory may be reduced by the use of low 
holdup internals. The estimate given by Kletz (1975c) of the 
holdup per theoretical plate is: 

Conventional trays (sieve, valve, etc.) 40-100 mm liquid 
Packing 30-70 mm liquid 

Film trays 10-20 mm liquid 


Holdup in the column base may be reduced by the use of 
a narrow bottom section. Thermosiphon reboilers have a 
lower inventory than kettle reboilers. It may be possible to 
eliminate intermediate storages. 

Original and revised designs of a distillation unit 
for separation of LPG described by Kletz are shown in 
Figure 11.5. The inventories in the two designs are: 



Original inventory (te) 

Revised inventory (te) 


Working 

Maximum 

Working Maximum 

Plant 

85 

150 

50 80 

Storage 

425 

850 

- 


In addition to reductions of inventory due to the use of low 
holdup packing and of a narrow column base, the revised 
design achieves even larger reductions by the eliminating 
intermediate storages. The reflux pump suction is taken 
from the condenser and the reflux drum is omitted. So also 
are the raw materials and product buffer storage. 

Heat exchangers also offer scope for reduction of inven¬ 
tory. In the revised distillation unit design just described 
the fluids in the condenser were reversed so that the 
LPG and refrigerant are on the shell and tube sides, 
respectively This has the effect of reducing the inventory of 
coolant and the total flammable inventory. A table of sur¬ 
face compactness of heat exchangers as a guide to inven¬ 
tories is given by Kletz. 

11.6.13 Selection of heat transfer media 

The refrigeration systems on olefins plants contain large 
inventories of flammables such as ethylene and propylene. 
Ammonia is apossiblesubstitute, but in viewof the toxic risk 
seems no safer. A viable alternative refrigerant, however, 
would make a real contribution to inventory reduction. Some 
alternativerefrigerantshavebeendiscussedbyJacob(1991a). 

Large inventories of flammables occur in heat transfer 
systems. For example, in an ethylene oxide plant using 
kerosene boiling under pressure as the heat transfer 
medium this may well constitute a greater hazard than the 
ethylene oxide mixture, which is very closely controlled. 
Use has been made of steam as an alternative, inherently 
safer heat transfer fluid. 

Many alternative heat transfer fluid have been designed 
for specific temperature ranges and a high degree of safety 
in flammability or in some cases completely non-flammable 
(see Chapter 7 (CCPS, 1993b)). 
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Figure 11.5 Alternative designs of LPG distillation unit 
(Kletz, 1984d): (a) original design with high inventory; 

(b) revised design with low inventory (Courtesy of the 
Institution of Chemical Engineers) 


storage. Considering the storage alone, for a liquefied 
gas refrigerated storage is safer than pressure storage. 
Large storages of such gases tend to be refrigerated. On the 
other hand, if the fluid is required as a gas and it is neces¬ 
sary to provide vaporizers and other equipment, it is the 
whole system which then needs to be considered and in this 
case refrigerated storage may be assessed as no safer. 
Pressure and refrigerated storage are considered further in 
Chapter 22. 

The issue of centralized vs distributed smaller storage 
systems, such as chlorine, is highly controversial, depend¬ 
ent on a number of factors in the plant environment, engi¬ 
neering judgement, etc. and cannot be pontificated. 

11.6.15 Major hazard storages 

An account of the reductions in hazardous storage inven¬ 
tories at one’s works in the context of the CIMAH Regu¬ 
lations has been given by Orrell and Cryan (1987). 
The principal hazardous chemicals involved were ethylene 
oxide, propylene oxide and sulfur trioxide. Disregarding 
the former, the use of which was discontinued on that 
site, the reductions achieved between 1980 and 1987 were as 
follows: 




Inventory (te) 



1980 

1987 

1987 


Process 

Storage 

Process 

Storage 

CIMAH 

level 

Propylene 

oxide 

51 

246 

<0.2 

<50 

50 

Sulfur 

trioxide 

<0.5 

75 

<0.2 

<50 

75 


11.6.14 Design of storage 

In general, storage capacity is of great assistance to plant 
management in the operation of the plant, but this has to be 
balanced against the cost and the hazard of storage. Appli¬ 
cation of inherently safer design to storage may involve: 

(1) elimination of intermediate storage; 

(2) reduction in storage inventory; 

(3) storage under less hazardous conditions. 

If the plant producing an intermediate can be located near 
the consumer plant, it may be possible to eliminate inter¬ 
mediate storage altogether. Mention has already been made 
of the elimination of intermediate storage of phosgene in 
the manufacture of MDI and TDI. 

Even if it is not practical to eliminate storage it may be 
possible to reduce it. Kletz quotes the case of a company 
which used to hold several thousand tonnes of chlorine, but 
found it was in fact able to operate with only a few hundred 
tonnes. 

A third approach is to store the material in a safer form. 
Examples given by Kletz include the storage and transport 
of acetylene in acetone, of organic peroxides as solutions 
and of hydrogen in the form of ammonia which is ‘cracked’ 
when the hydrogen is required. 

The issue of inherently safer storage conditions arises 
most often, however, in relation to pressure and refrigerated 


11.6.16 Toxic storages 

Following the Bhopal incident, many companies reviewed 
their inventories of toxic chemicals and achieved appreci¬ 
able reductions. An account of one such exercise has been 
given by Wade (1987), who cites five examples of major 
reductions of inventory. 

In one case, a large acrylonitrile plant, the purification 
section had a shorter time interval between scheduled shut¬ 
downs than the reaction section, and intermediate storage 
was used to allow the reaction section to continue running 
whilst the purification section was shut down. Practice was 
changed so that the reaction section ran at a lower, but safe, 
throughput whilst the purification section was down and 
until the latter had run the storage down again, thus 
effecting a large reduction in the average intermediate stor¬ 
age inventory. 

In the second case, by-product hydrogen cyanide from a 
large acrylonitrile plant was sent to storage before being 
distributed to satellite plants. The intermediate storage was 
eliminated, the hydrogen cyanide being passed direct to 
the user plants. Elimination of the storage created 
some problems of composition control and of flow smooth¬ 
ing as user plants started up and shut-down, but these 
were met. 

A third case involved the elimination of chlorine hori¬ 
zontal storage bullets and their replacement with smaller 
storage containers. In the fourth case, changes were made 
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to the practice of using as storage rail tank cars hooked up 
to the plant. One approach was to work more closely with 
the supplier to ensure that deliveries were made when 
needed. The other was to work with the railway company 
to locate areas where such tank cars could be held with 
minimal public exposure. 

The fifth case, described earlier, involved the transfer of 
the first stage of a multi-step reaction process to the reac¬ 
tant supplier, thus giving more benign reactants for the 
remainder of the reaction sequence. 

11.6.17 On-site production 

Another way of eliminating a storage inventory is on-site 
production of the chemical. There are now available skid- 
mounted phosgene plants with a capacity of 2—15 te/day 
which can be installed at the user’s work and obviate the 
need for phosgene storage. On-site production has the fur¬ 
ther advantage of eliminating the need to transport the 
chemical produced, although it does of course involve 
transport of the raw materials. On-site production of 
hydrogen is commonly employed. 

11.6.18 Design against overpressure 

Virtually all pumps installed in process plants are speci¬ 
fied such that a future full-sized impeller can be installed in 
the future. In the majority of cases with centrifugal pumps 
this has no or a minor safety implication. 

Control valve sizing is an industry-wide problem due to 
the cumulative effects of each discipline safety factor 
which result in a valve two to three times oversize. The 
valve exhibits poor controllability due to the low valve lift 
and the bath-tub stopper effect. The valve suppliers 
exacerbate the problem by providing the next size larger 
valve. Only careful surveillance of each process step will 
eliminate the problem. Oversize pressure relief valves are 
the safety implication. 

11.6.19 Design for containment 

Another aspect of inherently safer design is the prevention 
and reduction of loss of containment of the more hazardous 
materials. Three typical leak situations are illustrated in 
Figure 11.6. Figure 11.6(a) shows a leak of liquid petrol at 
high pressure but atmospheric temperature. For this case 
the fraction flashing off and the amount of vapour formed 
are small. Figure 11.6(b) shows a leak of propane gas at high 
pressure and temperature. The mass flow is much smaller 
but all the material is in gaseous form. The release may well 
be rapidly dispersed below its lower flammability limit by 
the momentum of the escaping jet. Figure 11.6(c) shows a 
leak of liquid petrol at high pressure and temperature. This 
is the most hazardous of the three cases. The fluid is a 
superheated liquid so that the mass flow is high and the 
flash fraction, and thus the vapour cloud formed, are large. 
It is therefore this third case which should receive particular 
attention. Utilizing excess flow valves can limit the risk. 

Each leak situation must be analysed for its characteriza- 
tionforformingaflammableliquidpoolorapotential vapour 
cloud explosion. The size of the leaks must be empirically 
assessed. It should be noted that leakage of an LPG, LNG or 
intermediate material can result in refrigeratioin of the 
metal to a low temperature resulting in a brittle fracture. 

11.6.20 Simplicity in design 

A fundamental principle of inherently safer design is sim¬ 
plicity. Many actual plant designs are extremely complex. 



Leak rate about 180 t/h liquid. 
Very little vapour. 

Explosion very unlikely. 


\l/ 



May be dispersed by jet mixing. 
Explosion possible but 
unlikely. 


Leak rate about 180 t/h liquid 

vapour and spray. 

Explosion much more likely. 


Figure 11.6 Some typical leak situations (Kletz, 1984d): 
(a) petrol at 7 bar and 10°C; (b) propane gas at 7 bar and 
100° C; (c) petrol at 7 bar and 100° C (Courtesy of the 
Institution of Chemical Engineers) 


That shown in Figure 11.7 is used by Kletz (1984d) to illus¬ 
trate the problem of complexity. Aspects of simpler design 
instanced by Kletz include: 


(1) design for full overpressure; 

(2) design modification to avoid instrumentation; 

(3) use of resistant materials of construction; 

(4) use of simple alternatives to instrumentation. 


Where a vessel may be subject to overpressure, the simplest 
solution may be to design it to withstand this overpressure. 
Most commonly, a pressure relief system is employed. The 
environmental and regulation issues must be addressed as 
well as the design. 

Sometimes instrumentation is provided to overcome a 
problem for which the alternative solution is a design 
change. Kletz gives as an example a liquid phase oxidation 
plant. The oxidizing air was fed to the plant mixed with the 
hydrocarbon recycle and instrumentation was provided to 
keep the mixture outside the flammable range. An alter¬ 
native design was to add the air directly to the liquid so that 
a flammable mixture could not form. 

Another reason for installing instrumentation may be to 
prevent attack on materials of construction. Use of more 
resistant materials may avoid the need for the instruments. 
Whether this is the best solution depends on the particular 
case. A contrary example is given in Chapter 9, where 
hazard assessment showed that use of a trip was preferable 
to constructing a pipe in special steel. 
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Figure 11.7 A complex plant design involving instrumentation (Kletz, 1984d) (Courtesy of the Institution of Chemical 
Engineers) 


High integrity protective systems (HIPSs) are widely 
used to improve the safety (by orders of magnitude) and 
increasing the plant reliability (see Chapter 13). 

11.6.21 Flexibility of plant 

Flexibility is a valuable feature on a plant, but it can be 
taken too far. Not only can the interconnections needed to 
give such flexibility become very complex and costly but 
also they introduce further potential sources of leaks and 
human errors. General multiple single trains are employed 
rather than complex crossovers. 

11.6.22 Modification chains 

Another source of complexity is the modification chain: an 
initial modification is made which leads to others. This is a 
problem not only in design, but perhaps even more on 
existing plant, where a single ad, hoc modification can lead 
to a whole series. 

A simple modification chain is shown in Figure 11.8. 
The manhole cover in Figure 11.8(a) is not leak-tight 
and traces of flammable vapour escape into the plant. In 
order to reduce the probability that they will ignite or be 
inhaled, a vent 4 m high is fitted to the cover, as shown in 
Figure 11.8(h). In turn, as shown in Figures 11.8(c-e), 
a flame trap is fitted because the gas leaving the vent might 
be ignited by lightning, an access platform is provided to 
allow regular cleaning of the flame trap, and handrails and 
toe boards are fitted because it is realized that the platform 
is now a ‘place of work’. 

A more complex example is the system for transfer of 
slurry under pressure between the two vessels shown in 






(cl Flame trap added Id) Access platform added 


£■ 



lel Handrails and toe-boards added 


Figure 11.8 A modification chain for a manhole cover 
(Kletz, 1984d): (a) manhole cover; (b) addition of vent; 
(c) addition of flame trap; (d) addition of platform; 

(e) addition of handrail and toe boards (Courtesy of the 
Institution of Chemical Engineers) 
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Figure 11.9. Figure 11.9(a) shows the original design with a 
single transfer line and arrangements to blow the line with 
steam to clear the line of chokes and to clean it. The plant 
was the first version to be continuous, earlier plants being 
batch. In order to avoid downtime due to blockages in the 
transfer line, a second transfer line, Figure 11.9(b), was 
added. The relief and blow-down review revealed that 
the two transfer lines could be operated simultaneously 
and that in this situation the downstream vessels would 
require twice the relief capacity. In order to avoid this, the 
valves on the two lines were interlocked, Figure 11.9(c).This 
created two more dead legs in each line so it was necessary 
to add four more steam connections to allow steam flush¬ 
ing, Figure 11.9(d). It was then realized that in order to be 
sure that the stand-by line was ready for use it was neces¬ 
sary to keep steam flowing through it.The transfer line was 
protected against the pressure of the process but not 
against that of the steam. Whereas it was considered 
acceptable not to provide relief for occasional use of steam, 
it was necessary to do so for steam continuously in the line, 
and so a pressure relief valve was fitted to the steam line, 
Figure 11.9(e). 

11.6.23 Process operability 

Some processes are inherently more operable than others. 
This aspect should be borne in mind in the selection of the 
process. In particular, a process which has no ‘fallback’ 
positions and which in the extreme case presents the 
operator with a stark choice of continuing to run at a given 
set of conditions or of shutting down completely is not easy 
to operate. The operability of process and plant is one of the 
two main aspects which are examined in hazop studies. 

11.6.24 Fail-safe design 

The concept of fail-safe design is well established in the 
process industries. It refers to the design of equipment such 
as control and solenoid valves so that in the event of failure 
of a utility such as electricity or instrument air the plant 
moves to a safe state. 

The decision of whether a valve should be open or closed 
on utility failure is made in the light of the consequences for 
the process. The fail-safe position, assuming there is one, is 
then determined. Thus pneumatic control valves, for 
example, are available as ‘air-to-open’ or ‘air-to-close’; the 
former close and the latter open on air failure. 

Current electronic components do not have identified 
fail-safe positions. See HSE 1987a-d Programmable 
Electronic Systems for random and systemic failures which 
are not fail-safe. 

The principle of fail-safe design may be extended to 
include the action of whole control loops. This aspect is 
considered in Chapter 13. 

11.6.25 Second chance design 

Another relevant concept is that of ‘second chance design’. 
This means the provision of a second line of defence to 
guard against an initial hazard or failure. Some features 
which are prominent in second chance design are: 

(1) plant layout; 

(2) pressure system design; 

(3) materials of construction; 

(4) isolation arrangements; 

(5) alarms and trips; 

(6) operating and maintenance procedures. 


Second chance design is illustrated by: many of the normal 
features of plant layout such as bunding and drainaway 
arrangements; many normal features of pressure systems 
such as the installation on pressure vessels of pressure 
relief and blow-down systems and on pumps of double 
mechanical seals with monitoring of the pressure sealing 
system; the use of materials of construction which can 
withstand deviations from normal operating conditions 
such as a slug of low temperature liquid; the provision of 
arrangements for isolation if there is loss of containment; 
the use of alarms which warn of, and trips which take 
action against, hazardous conditions; and adherence to 
operating and maintenance procedures which reduce the 
probability of the hazard, such as purging again after a 
delay in lighting a furnace. 

It will be apparent from these examples that second 
chance design is a rather general concept, embracing both 
preventive and mitigating features, but is a very valu¬ 
able one. 

11.6.26 Layers of protection 

A newer concept, analogous to the previous paragraph on 
second change design, is layers of protection. This tech¬ 
nique was introduced by Drake and Thurston in 1992 and is 
now widely adopted and included in safety codes such as 
ISA 84.01. The basic idea is illustrated plainly in the onion 
skin Figure 11.10 which is self-explanatory.This inner most 
layer is the process design, basic control systems (BPCS), 
critical alarms, automatic actions such as the safety inter¬ 
lock systems (SIS), emergency shut-down (ESD); physical 
protection, dikes, and emergency responses, both plant- 
and community-wide. This provides the multiple safety 
layers present to provide protection from a hazardous inci¬ 
dent. Each safety layer must be independent, specific, 
dependable and auditable, providing an order of magnitude 
protection over the previous layer. Further detailed infor¬ 
mation is available in CCPS Guidelines for Safe Automation 
of Chemical Processes. This approach has been touted to be 
highly effective and has resulted in a significant reduction 
of incidents. 

11.6.27 Single large vs multiple small systems 

A question which occurs in the context of inherently safer 
design is whether it is preferable from this aspect to have a 
single large unit, plant or storage, or several smaller ones. 
Generally it is economically attractive to choose the single 
large unit. Many consider that this is usually the best 
choice for safety also. If several small units are built, the 
number of weak points such as pumps, flanges, etc., 
increases roughly in proportion to the number of units, and 
the management effort is more thinly spread. If a single 
large unit is built, the number of weak points is much 
reduced and the management can concentrate on this unit. 
For both these reasons the frequency of incidents with a 
single large unit should be less than with several smaller 
ones. The argument for the single large unit is thus, in part, 
that if one puts all one’s eggs in one basket, one can afford a 
good basket. The drawback is that the scale of any incident 
which does occur is likely to be larger with the single unit. 
There is probably no general solution to this problem. Each 
case should be considered on its merits. 

11.6.28 Limitation of exposure 

A rather different aspect of inherently safer design is the 
limitation of exposure of personnel.This is another concept 
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(c ) Step 1. Interlocked 
isolation valves added. 
0 Interlock-only one 
valve can be open 



!■. 




Figure 11.9 A modification chain for a slurry transfer system (Kletz, 1984d): (a) slurry transfer system; (b) addition of 
second transfer line; (c) addition of interlock between values on two transfer lines; (d) addition of extra steam connections; 
(e) addition of pressure relief value on stream line (Courtesy of the Institution of Chemical Engineers) 
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Figure 11.10 Typical layers of protection in modern 
chemical plant (CCPS, 1993) 


which received impetus from the Flixborough incident, in 
which 18 of the 28 deaths occurred in the control room. The 
question was asked whether so many people really needed 
to be exposed to the hazard in this way. Limitation of 
exposure of personnel may be achieved by location of the 
workbase and by control of access to the high hazard zones. 
These aspects are considered in Chapters 10 and 20. This 
subject is covered in detail with a quantitative analysis in 
the CCPS Guidelines for Evaluating Process Plant Buildings 
for External Explosion and Fires (CCPS, 1996). 


11.6.29 Inhibiting factors 

Progress in the realization of inherently safer designs has 
not been as rapid as its advocates would wish. Some rea¬ 
sons for this have been examined by Kletz (1991h, 1992c) 
and Mansfield and Cassidy (1994). 

The arguments advanced by Kletz have application parti¬ 
cularly where an inherently safer alternative design involves 
a significant degree of innovation, which affects only a part 
of the whole plant and where the scale of production is large. 
Since, in general, technical and economic risk is increased by 
novel features, opponents will argue that a large project is 
being put at risk for relatively small gain. 

Essentially, part of the problem is that a single project is 
being made to bear the ‘cost’ of an innovation which has the 
potential eventually to make a significant contribution to 
the reduction of costs and enhancement of safety over a 
range of processes operated by the company. 

Another feature of the problem is that once plant design 
is under way, there is often not sufficient time to accom¬ 
modate such innovation, and there is pressure to follow 
the previous design. This aspect has been addressed by 
Malpas (1983), who argues that whilst the design of the 
next plant is in progress thought should be given to the 
improvements which have been identified, which it is not 
practical to incorporate in the design but which, with fore¬ 
thought, could be implemented in‘the plant after next’. 

The problem of furthering innovation is exacerbated, 
moreover, by the move towards business-centred rather 
than functional organization of companies. However, as 
Mansfield and Cassidy (1994) point out, inherently safer 
design is not necessarily radical but may involve incre¬ 
mental change. Among the reasons which they give for lack 
of progress are lack of awareness, lack of a recognized tool 
and failure to build the practice into company procedures. 
Moreover, even where what is in question is a radical 
change, the proposed process may be such as to constitute a 
minimal risk. 

11.6.30 HSE initiatives 

The Health and Safety Executive (HSE) now has an explicit 
policy of encouraging the application of inherently safer 
design concepts. Its philosophy and activity in this area 
have been described by Barrell (1988a) and P. Jones (1992). 
The work described by Mansfield and Cassidy (1994) is one 
aspect of this programme. 

11.6.31 Inherently safer design methodology 

The work of Mansfield and Cassidy is aimed at furthering 
the practice of inherently safer design by the development 
of suitable tools. The authors argue that there is need for 
a technique which will do for inherently safer design 
what hazop has done for hazard identification. Such a tool 
needs to address particularly the conceptual design stage. 
Concept design is generally done quite rapidly. The 
tendency is that thereafter the basic concept does not 
undergo any great change. 

These authors suggest four broad categories of tool for 
inherently safer design: (1) brainstorming with a degree of 
structure, (2) a more highly structured hazop-style exam¬ 
ination of flow sheets and process diagrams, (3) examina¬ 
tion, using checklists, of the plant layout and (4) indices of 
inherent safety 

11.6.32 Inherently safer design index 

The development of an index for inherently safer design 
has been described by D.W. Edwards and Lawrence (1993). 
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This index is intended for use early in the design, at the 
stage of process selection. The authors list a number of 
variables relevant to inherent safety, including: properties 
of the chemicals such as corrosiveness, flammability, 
explosibility and toxicity; operating conditions such as 
pressure and temperature; reaction conditions such as 
phase, rate, heat release, yield and side reactions; and 
effluents and wastes. At this early stage information on 
inventory, for example, is lacking and has to be represented 
by surrogates such as yield. The method involves assigning 
scores to the individual parameters. These are then used to 
compute a chemical score, a process score and an overall 
inherent safety index. A low value of this index means 
a high degree of inherent safety. The inherent safety index 
is obtained from the sum of the scores of the individual 
process stages. Hence the index penalizes processes with 
a large number of stages. 

Edwards and Lawrence state that one of their aims is to 
test the hypothesis that inherently safer design means 
cheaper plants, and give as an illustrative example of a 
comparison of six routes to methylmethacrylate in respect 
of: (1) the estimated costs and (2) the inherent safety index. 
Perhaps the most salient point from this single example is 
the benefit of a smaller number of stages. They also refer to 
work on comparison of the index with expert rankings. 

The Dow Fire and Explosion Index - Hazard Classifica¬ 
tion Guide which has been available for over 20 years, now 
in the eighth edition, provides also quantitative results 
based on the same issues previously described. 


11.6.33 Miniaturized and distributed plants 

In a speculative treatment, Benson and Ponton (1993) sug¬ 
gest that one future trend may well be towards distributed 
manufacture of chemicals using miniaturized plants at the 
users’ sites. Such an approach chimes with demands for 
plants which are environmental friendly and deliver their 
products on a‘just-in-time’ basis. 

Development on these lines requires that the plants be 
fully automated and highly reliable. The authors envisage 
plants that operate at moderate pressure and temperature, 
are self-cleaning and are sealed for life. There is also an 
implication that there is no insuperable effluent problem. 

Benson and Ponton list a number of types of equipment 
which have been the subject of much development in recent 
years but which have not realized their full potential 
because they come into their own in small scale rather 
than large scale production. Table 11.3 contrasts some of the 
characteristics of distributed plants and large scale plants. 

11.7 Unit Processes 

11.7.1 Chemical industry 

The chemical and petrochemical industries are described 
in The Petroleum Chemicals Industry (Goldstein and 
Waddams, 1967), The Petrochemical Industry (Hahn and 
Williams, 1970), Structure of the Chemical Processing 
Industries (Wei, Fraser and Swartzlander, 1978), The 
Chemical Industry (Sharp and West, 1982), Shreve’s Chemi¬ 
cal Process Industries (G.T. Austin, 1984), The Chemical 


Table 11.3 Some characteristics of miniaturized and of large scale plants (Benson and Ponton, 1993) (Courtesy of the 


Institution of Chemical Engineers) 

Distributed plants 

Large site plants 

Feedstocks: 

Readily available at the customer’s site (e.g. air, methane, 
water, electricity) 

Safe to transport (e.g. C0 2 , salt, lime, most solids) 

Available from other processes on the site 
(e.g. chlorine) 

Dangerous to transport (e.g. ethylene oxide) 

Processes: 

That build new molecules from simple feedstocks 
(e.g. phosgene) 

Catalytic processes (e.g. ammonia from methane) 

Low pressure and temperature (e.g. bioprocesses) 

Stand-alone processes (e.g. air liquefaction) 

Physical change processes (e.g. formulation, shredding) 

That involve cracking complex molecules to low 
molecular weight products (e.g. oil refining, 
olefins from naphtha) 

Low specificity, multi-product processes 

High temperature or pressure (e.g. polyethylene) 
Highly integrated processes 

Customer products: 

Considered to be dangerous to transport 
(e.g. phosgene, bromine) 

Production state matches customer requirement, 
but would require change for transport 
(e.g. molten polymer, liquefied gases, many powders) 

Produced and required in dilute state, but normally 
concentrated for transport (e.g. aqueous HF) 

Involving a hazardous processing step 
(e.g. highly exothermic reaction) 

Waste products: 

Suitable, after treatment, for returning to the immediate 
environment (e.g. oxygen, water) 

May be reacted with other customer waste to produce benign 
products (e.g. chlorine, caustic) 

Biodegradable waste (e.g. from biological processes) 

Requiring controlled thermal oxidation 
(e.g. tars, chlorinated wastes) 

Treatment requires other plants on the site 
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Industry (Heaton, 1985-), Handbook of Chemicals Produc¬ 
tion Processes (Meyers, 1986a) and Petrochemicals (Spitz, 
1988). Further references are given in Section 11.11. 

Accounts of the European chemical industry are given in 
the following: France, E. Johnson (1989c) and Redman etal. 
(1991); Germany, E. Johnson etal. (1990); Italy, Redman etal. 
(1990) and the Netherlands, Redman and Smith (1991). 

11.7.2 Principal processes 

Descriptions of unit processes and of their thermo¬ 
dynamics and kinetics are given in Unit Processes in 
Organic Synthesis (Groggins, 1952), Industrial Chemicals 
(Faith, Keyes and Clark, 1965), Chemical Process Indus¬ 
tries (Shreve, 1967), Organic Chemicals Manufacturing 
Hazards (Goldfarb et al., 1981), Shreve’s Chemical Process 
Industries (G.T. Austin, 1984), Survey of Industrial Chemi¬ 
stry (Chenier, 1986) and Introduction to Industrial Chemistry 
(H.L. White, 1986). Further information is given in other 
standard texts, including encyclopaedias such as those by 
Kirk and Othmer (1963-, 1978-, 1991-) and Ullman 
(1969—, 1985—). Selected references on unit processes and 
their hazards are given in Table 11.4. 

Unit processes are listed by Fowler and Spiegelman 
(1968) as follows: acylation, alkaline fusion, alkylation, 
animation, aromatization, calcination, carboxylation, caust- 
icization, combustion, condensation, coupling, cracking, 
diazotization, double decomposition, electrolysis, ester¬ 
ification, fermentation, halogenation, hydration, hydro¬ 
forming, hydrogenation, hydrolysis, ion exchange, 
isomerization, neutralization, nitration, oxidation/reduc- 
tion, polymerization, pyrolysis and sulfonation. The unit 
processes which are generally more hazardous are given 
by Fowler and Spiegelman as alkylation, animation, 
aromatization, combustion, condensation, diazotization, 
halogenation, hydrogenation, nitration, oxidation and 
polymerization. The unit processes considered here by 
way of illustration are (1) oxidation, (2) hydrogenation, 

(3) chlorination and (4) nitration. 

A particular unit process tends to have certain 
characteristic features. These often relate to: 

(1) reactant and product; 

(2) reactor phase; 

(3) main reaction 

(a) thermodynamic equilibrium, 

(b) heat of reaction, 

(c) velocity constant, 

(d) activation energy; 

(4) side reactions; 

(5) materials of construction. 


Table 11.4 Selected references on unit processes 
and their hazards 


Groggins (1952); Kirk and Othmer (1963-, 1978-, 1991-); 
Faith, Keyes and Clark (1965); Goldstein and Waddams 
(1967); Shreve (1967); Considine (1974); NFPA 
(1991NFPA 491M) 

Biotechnology, food processing 

Tong (1978); Frommer and Kramer (1989); Palazzi etal. 
(1989); Jowitt (1980) 


Alkylation 

B. Scott (1992) 

Carbonylation 

Goldfarb etal. (1981) 

Chlorine production 

Eichelberger, Smura and Bergenn (1961); Pennell (1963); 
Chlorine Institute (1981CPP, Pamphlet 67,1986 Pamphlet 
1); Sommers (1965); Schwab and Doyle (1967); Bunge 
and Honigh (1969); Elliott (1969); J.L. Wood (1969); 

Kuhn (1971); Stephens and Livingston (1973); 

C. Jackson and Kelham (1984); Means and Beck (1984); 
Coulter (1986); C. Jackson (1986); Wall (1986); I.F. White 
etal. (1986) 

Chlorination 

Groggins (1952); Daniel (1973); Goldfarb etal. (1981) 

Electrochemical 

Dotson (1978); AlChE (1981/76,1983/80); Fleischmann and 
Overstall (1983); Fletcher (1984) 

Hydrogenation 

Groggins (1952); Augustine (1965); Gant (1978); Rylander 
(1985); Klais (1987) 

Nitration 

Groggins (1952); Albright (1966b,e,g); Dubar and Calzia 
(1968); Albright and Hanson (1969,1976); Fritz (1969); 
Ventrone (1969); N.A.R. Bell (1971); Biasutti and Camera 
(1974); Biasutti (1976,1979); EW. Evans, Meyer and 
Oppliger (1977) 

Oxidation 

Burgoyne and Kapur (1952); Groggins (1952); Burgoyne 
and Cox (1953); Sittig (1961-, 1962); Salooja (1964a); 
Shtern (1964); Emanuel (1965); Papenfuss (1965); 
Zeelenberg and de Bruijn (1965); Berezin, Denisov and 
Emmanuel (1966); Albright (1967b,e); Farkas (1970); 
Prengle and Barona (1970); Haberle (1971); Pickles (1971); 
Talmage (1971); Alexander (1974,1990a,b); Dumas and 
Bulani (1974); Gugan (1974b); Hucknall (1974); Dragoset 
(1976); Nemes 

etal. (1976); Saunby and Kiff (1976); R. Davies (1979); 

Cans (1979); Weismantel and Ricci (1979); Hobbs (1980); 
Lyons (1980); Goldfarb et al. (1981); Crescitelli et al. (1982); 
Krzyrztoforski etal. (1986); Snee and Griffiths (1989); 
Franz and Sheldon (1991); Memedlyaev, Glikin and 
Tyulpinov (1992) 

Oxychlorination 

Quant etal. (1963); Illidge and Wolstenholme (1978); 
Goldfarb etal. (1981) 

Oxyhydrochlorination 

Illidge and Wolstenholme (1978); McNaughton (1983) 

Oxo synthesis 

Weber and Falbe (1970) 

Plasma processing 

Szekely and Apelian (1984) 

Polymerization 

Goldfarb etal. (1981) 
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11.7.3 Oxidation 

The oxidation reactions considered here are those of an 
organic compound with molecular oxygen. Some principal 
industrial oxidation reactions include: 

Vapour phase 

Ethylene —> ethylene oxide 
Propylene —> acrylic acid 
Methanol —> formaldehyde 
Naphthalene —> phthalic anhydride 
Benzene, butenes —> maleic anhydride 

Liquid phase 

Acetaldehyde —> acetic acid 
Butane —► acetic acid and related products 
/-Butane —► f-butyl hydroperoxide 
(and hence propylene oxide) 

Cumene —> cumene hydroperoxide 
(and hence phenol, acetone) 

Cyclohexane —> cyclohexanone and cyclohexanol 
(and hence adipic acid and caprolactam) 
Ethylbenzene —> ethylbenzene hydroperoxide 
(and hence propylene oxide) 

Naphtha —* acetic acid 
Toluene —> benzoic acid (and hence phenol) 
p -Xylene —»terephthalic acid 
p -Xylene —* monomethylterephthalate 
Higher hydrocarbons —> primary hydroperoxides 
(and hence primary alcohols, aldehydes and acids) 
Higher hydrocarbons —* secondary hydroperoxides 
(and hence secondary alcohols and ketones) 

The reactions are generally exothermic and sometimes 
highly so. There is frequently, therefore, a problem of heat 
removal and of temperature control. 

Oxidation reactions tend not to be limited by thermo¬ 
dynamic equilibrium. There can be problems, however, of 
the reaction of complete combustion and of side reactions 
to unwanted by-products. Frequently, it is necessary to 
employ catalysts and to use only moderate temperatures 
in order to avoid these undesired reactions. 

The heat generated in such oxidation processes may 
considerably exceed the theoretical heat of reaction. Thus 
the heat of oxidation of napthalene to phthalic anhydride 
is about 5460 BTU/lb of naphthalene, but for some reactor 
conditions it is reckoned that the occurrence of the com¬ 
plete combustion reaction can raise the effective heat of 
reaction to 10,000 BTU/lb of naphthalene-fed. 

Vapour phase oxidations are carried out in various types 
of reactor, such as a reactor vessel with catalyst on a tray, 
a tubular packed bed reactor or a fluidized bed reactor. 
Tubular and fluidized bed reactors are suitable if the 
heat release is large. Thus, the oxidation of napthalene to 
phthalic anhydride is highly exothermic. Initially, this 
reaction was carried out in a tubular reactor, but is now 
usually done in a fluidized bed. 

In vapour phase oxidation the reactor feed is generally 
kept outside the flammable range. This requires the use of 
well designed and highly reliable trip systems. The use of a 
high integrity protective system to maintain the ethylene 
and oxygen feeds in the ethylene oxide process on the 
ethylene-rich side has been described by R.M. Stewart 
(1971) and is considered in more detail in Chapter 13. 

Another approach to the control of the feed composition 
has been outlined by Pickles (1971), who describes a meth¬ 
od used in the production of formaldehyde by oxidation of 


methanol. The methanol-air feed is obtained by bubbling 
air through the methanol vaporizer. The feed is maintained 
on the methanol-rich side, mainly by ensuring that the tem¬ 
perature of the methanol in the vaporizer is sufficiently high. 

The hazard of a flammable mixture is much less if the 
burning velocity is low, which it is near the flammability 
limits. In the methanol-air system the burning velocity is 
low not only at the upper flammability limit but also some 
way inside it. In the system described by Pickles this fact is 
exploited. 

If the risk of ignition is judged sufficiently low, the reac¬ 
tion may be carried out within the flammable limits. 
R. Davies (1979) cites benzene and propylene oxidation as 
two processes which have been operated in this way. 

Liquid phase oxidations are typically carried out in tank 
reactors at a pressure in the range 10-50 bar and a tem¬ 
perature in the range 100-200°C. Air is bubbled into the 
reactor by a sparge pipe. 

One of the main liquid phase processes is the oxidation 
of cyclohexane to cyclohexanone and cylcohexanol. This 
was the process at Flixborough. It has been described in 
The Oxidation of Cyclohexane (Berezin, Denison and 
Emmanuel, 1966) and by Haberle (1971). In this process, 
which is carried out industrially at pressures in the range 
10-25 bar and temperatures in the range 140-170°C, the 
conversion per pass has to be kept to a few per cent in order 
to minimize undesirable side reactions. Therefore, heat 
removal is fairly simple. The principal hazard is the large 
amount of cyclohexane liquid which is held in and circu¬ 
lated around the reactors. 

The air inlet line can be a hazard in a liquid phase oxi¬ 
dation process. It is known that in the manufacture of KA, 
a mixture of cyclohexanone and cyclohexanol, by air oxi¬ 
dation of cyclohexane a blackened product is occasionally 
made. The conditions under which this ‘black KA’ is pro¬ 
duced are always those of start-up. The cause is that liquid 
from the reactor flows back up the line, stays there until 
the plant is started up and then catches fire when the air 
flow resumes. The temperatures reached are sufficient to 
melt through the air pipe. There is a hazard, therefore, that 
the reactor contents may escape through this line. The 
phenomenon has been discussed by Alexander (1974). 

The hazards of oxidation processes have been reviewed 
by R. Davies (1979). He describes the transition in liquid 
phase oxidations from batch reactors to large-scale con¬ 
tinuous reactors. This growth was accompanied by an 
increasing number of incidents. 

Davies identifies three principal hazards of oxidation 
processes, in the liquid or vapour phase: flammable release, 
internal ignition and unstable or reactive substances. The 
majority of liquid phase oxidation processes require a large 
inventory held at a temperature above the boiling point. 
This creates the potential for a large release of flashing 
flammable liquid. Moreover, the operating conditions are 
quite difficult, which increases the risk that such a release 
will occur. 

A second hazard of liquid phase oxidations is internal 
ignition. This can occur if for any reason the concentration 
of oxygen builds up in the vapour space. Such build-up may 
happen if the dispersion of the air in the liquid is poor or if 
the oxygen is not immediately absorbed and reacted. In some 
processes a flammable mixture can occur where recycle 
offgas is mixed with the air prior to inj ection into the liquid. 

Vapour phase oxidation processes have a low inventory 
of process fluids, but a flammable release hazard may still 
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exist where there is a large inventory of flammable heat 
transfer fluid. Single-pass, atmospheric processes may be 
protected against internal ignition by explosion venting, 
but this is more difficult to do where the process is at higher 
pressure or involves recycle. 

The products of oxidation processes tend to contain 
unstable substances, which in some cases can constitute a 
severe hazard. These include cumene hydroperoxide and 
ethylene oxide. Another is acetaldehyde, though this is more 
readily controlled. Davies gives a detailed account of the 
characteristics of, and precautions against, these substances. 

Davies identifies four oxidation processes which have 
been responsible for a relatively large number of incidents. 
They are the liquid phase oxidations of cyclohexane 
and cumene, the vapour phase oxidations of ethylene and 
naphthalene or o-xylene. He gives a list of incidents and 
identifies several factors which have contributed to such 
incidents. One is the use of a series of liquid phase reactors 
in cascade with insufficient attention paid to the inter¬ 
connecting pipework. Another is modifications which are 
intended to increase yield or to improve thermal economy 
but which also increase inventory and complexity. A third 
is deficiencies of various kinds in the trip systems. 

An account of the continuing problem of liquid phase 
oxidation processes has been given by Alexander (1990b,c). 
The loss potential in an oxidation process can be large and 
the margin between a minor and a major incident small. He 
deals in particular with internal ignition. Such incidents 
are relatively frequent, but tend not to be reported. 

The author suggests that most internal ignitions are due 
to a common cause and puts forward the following 
hypothesis. Oxidizable material is exposed to air at a tem¬ 
perature high enough to initiate liquid phase oxidation. 
Poor dispersion of the air allows a high concentration of 
oxygen to build up close to the liquid-air interface and a 
flammable mixture forms. Free radicals from the oxidation 
reaction in the liquid phase evaporate into the flammable 
mixture near the interface and ignite it. He cites the work 
of Sokolik (1960) in support of the ability of free radicals 
to ignite a flammable mixture well below the auto¬ 
ignition temperature. Alexander argues that this proposed 
mechanism is consistent with the wide variety of condi¬ 
tions in which ignitions occur. He refers also to other pro¬ 
posed mechanisms of ignition, including deposits of 
peroxides, of pyrophoric materials, and of catalyst, and 
friction between metal surfaces. Alexander describes some 
of the situations in which internal ignitions occur, and 
gives explanations based on his hypothesis. These situa¬ 
tions involve the formation of a flammable mixture, 
followed by ignition by free radicals from the liquid, pres¬ 
ent as bulk liquid or as liquid droplets. One is backflow of 
liquid into the air feed line. This can occur if the air flow is 
shut off but the isolation is not good enough to prevent the 
pressure of the air in the pipe in the reactor falling below 
that of the liquid. It can occur if the air flow is interrupted 
momentarily. If the air temperature is above the critical 
value, burning will occur. This may result only in a very hot 
pipe, but can cause pipe failure followed by release of the 
reactor contents. If under very unfavourable circumstances 
a flammable mixture occurs along a sufficient length of the 
air pipe, there is potential for detonation. 

Another situation with potential for internal ignition 
occurs where there is a recycle of fuel-rich offgas back into 
the air pipe, designed so that under normal operation the gas 
mixture downstream of the mixing point is also fuel-rich. 


If there is an upset, the mixture may enter the flammable 
range. Another such situation is where a temporary liquid 
diversion is made to flush out blockages in the air line. 

Alexander also describes precautions which can be 
taken. One is the design of the air line, which should he 
such that liquid is not likely to be held up if there is an 
interruption of the air flow. The line should not rise up 
through the bottom of the vessel. Nor should it enter 
through the top, since a leak from the pipe in the vapour 
space could give a flammable mixture there. The preferred 
configuration is for the air line to come down from a height, 
slope gently down to the vessel and then enter its side. 
Another precaution is positive isolation of the air line by a 
doubleblock and bleed valve arrangement. Another is the use 
of cool air. Other precautions relate to recycle gas, liquid 
diversion, offgas analysis and explosion containment. 

11.7.4 Hydrogenation 

The hydrogenation reactions considered here are those of 
an organic compound with molecular hydrogen in the pres¬ 
ence of a catalyst. Some principal hydrogenation reactions 
include: 

Vapour phase 

Carbon monoxide —> methanol 
Olefins —> paraffins 
Liquid phase 
Coal -> oil 

The thermodynamic equilibrium in hydrogenation reactions 
is almost invariably such that the yield falls as tempera¬ 
ture rises and therefore the reaction temperature is a com¬ 
promise between high reaction yield and high reaction rate. 

Hydrogenation reactions are generally exothermic. 
The reaction usually occurs only on the catalyst, so that 
the local surface temperature can be very high. This may 
result in undesirable side reactions and catalyst deteriora¬ 
tion, and may have implications for reactor materials of 
construction and for control. 

The activation energy of hydrogenation reactions is 
normally low. For most hydrogenation reactions an increase 
in temperature of 50°C or more is required to double the 
reaction rate. There are few for which an increase of 10°C is 
sufficient to do this. 

Vapour phase hydrogenations are carried out typically 
in the pressure range from atmospheric to several hundred 
bar and in the temperature range 100-400°C. Most cata¬ 
lysts used in hydrogenations are also capable of promoting 
oxidation. Also catalysts can be rendered more pyrophoric 
by the adsorption of hydrogen. Hydrogenation involves the 
hazards of the use of hydrogen under pressure. These are 
considered elsewhere, but particularly in Section 11.9. 

11.7.5 Chlorination 

The chlorination reactions considered here are those of an 
organic compound with molecular chlorine. Some principal 
industrial chlorination reactions include: 

Vapour phase 

Methanol —* chloromethanes 
Liquid phase 

Ethylene —> ethylene dichloride 

Chlorination reactions have many similarities with 
oxidation reactions. They tend not to be limited by 
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thermodynamic equilibrium, but there can be problems of 
the reaction of complete chlorination and of side reactions 
to unwanted by-products. 

Again the reactions are generally exothermic and often 
highly so, with the result that there tends to be a problem of 
heat removal and temperature control. For the substitution 
reaction 

RH + C1 2 -» RC1 + HCI 

the heat of reaction is about 24,000 kcal/kmol of chlorine. 

The vapour phase reaction of chlorine with paraffinic 
hydrocarbons is apt to become too violent and it may be 
necessary to take measures to prevent this. These include 
limiting the proportion of chlorine or admitting it in stages 
and using diluents such as nitrogen or recycle gases. 

Vapour phase reactors are typically empty vessels or 
packed beds. Chlorine, like oxygen, forms flammable mix¬ 
tures with organic compounds. Thus, for example, the fol¬ 
lowing flammability limits have been quoted for methane: 



Oxygen 

Chlorine 

Lower flammability limit (%) 

5.2 

5.6 

Upper flammability limit (%) 

60.5 

70.0 


Further details are given by Daniel (1973). 

The reactor feed in vapour phase chlorinations is kept 
outside the flammable range. Liquid phase reactions are 
frequently carried out by blowing the chlorine and organic 
reactants into liquid product in a tank reactor. 

11.7.6 Nitration 

The nitration reactions considered here are those of an 
organic compound with a nitrating agent such as nitric acid 
or mixed acid. Mixed acid is nitric acid admixed with a 
dehydrating acid such as sulfuric acid. Nitration accidents 
are among not only the most frequent but also the most 
destructive in the chemical industry. The processes for the 
manufacture of nitroglycerine (NG) and trinitrotoluene 
(TNT) are particularly sensitive. 

The typical nitration is a batch process carried out in the 
liquid phase and it is this which is discussed first. Nitric 
acid is not only a nitrating agent but also an oxidizing 
agent. The nitration and the oxidation reactions both con¬ 
stitute a hazard. Nitric acid is itself a hazardous chemical, 
since it is not only a corrosive substance but also a strong 
oxidant. As indicated, it may react explosively with some 
organic liquids. 

Both the nitration reaction itself and the oxidation reac¬ 
tion are strongly exothermic. Since nitration mixtures are 
often very sensitive and liable to explode, unless conditions 
are closely controlled, this strong heat generation is a pro¬ 
blem. The heat evolved in a nitration reaction includes 
not only the heat of nitration but also the heat of dilution. 
Thus the heat of nitration of benzene is 761 BTU/lb, but 
under certain conditions the heat released by reaction and 
dilution is 895 BTU/lb. 

Nitration reactions may constitute a hazard due to a 
reaction exotherm or a sensitive product. In some incidents 
the phenomena appear not to have been recorded pre¬ 
viously, but in others the hazard was known in general 
terms, but its full implications have not been appreciated. 


There have been a number of explosions in nitration reac¬ 
tors which have subsequently been shown to have been due 
to the fact that the temperature of the reaction was too close 
to that at which a runaway reaction could start. The tem¬ 
perature differences between the main reaction and the 
runaway reactions have been typically of the order of 
10-50°C. Similarly, explosions have occurred due to the 
sensitivity of the product of the nitration. Some nitro com¬ 
pounds have a quite low decomposition temperature, in the 
range 100-150°C, and are thus relatively hazardous. 
Information is available on this aspect (e.g. T.L. Davis, 
1943; Kirk and Othmer, 1963-, 1978-, 1991-). 

Rapid autocatalytic decompositions or ‘fume-offs’ of 
nitration products sometimes occur. Often they do not 
involve an explosion, but are nevertheless quite violent. 
Factors which have contributed to explosions due to run¬ 
away reactions or sensitive materials have included lack of 
knowledge and lack of appreciation of the need for parti¬ 
cular precautions and for a wide margin of safety. 

Nitrations are frequently carried out in stirred batch 
reactors. This type of reactor has certain characteristic 
hazards. These include the charging of reactants in incor¬ 
rect quantities or sequence and the accumulation of 
unmixed reactants which react violently when the agitator 
is switched on. 

Another hazard in nitration reactions is the ingress of 
water. The addition of water to the nitration mixture may 
result in a large release of heat which causes an explosion 
either directly or by initiating some other effect. 

Whereas the other unit processes considered above are 
carried out in plants dedicated to that single process, nitra¬ 
tions are frequently performed in plants which make a num¬ 
ber of products on a campaign basis. This method 
of manufacture introduces some additional opportunities 
for error. 

Since nitration often presents problems both in respect 
of runaway exotherms and heat-sensitive products, it is 
especially important to have full information about the 
reaction and the products, particularly for a new reaction. 
Many of the problems of nitration are alleviated by the use 
of a continuous nitration process. The nitration is carried 
out in several vessels, each of which has a smaller holdup 
and time-invariant operating conditions. Many stages such 
as charging and discharging, precooling and preheating 
are eliminated, as are some items of equipment such as 
pumps. The process is more readily adaptable to automatic 
control. There is less human intervention and thus both less 
human error and less exposure of personnel. The evolution 
of nitroglycerine manufacture from a process using a batch 
reactor to a continuous process carried out in a nozzle has 
already been described. 

Nitration is also carried out in the vapour phase. 
A further discussion of safety in nitration processes is 
given by Biasutti and Camera (1974). An accident in a 
nitration process is described in Case History B22. 

11.8 Unit Operations and Equipments 

Unit operations include: mixing, dispersion; distillation, 
gas absorption, liquid-liquid extraction; leaching, ion 
exchange; precipitation, crystallization; centrifugation, fil¬ 
tration, sedimentation; classification, screening, sieving; 
crushing, grinding; compacting, granulation, pelletizing; 
gas cleaning; heat transfer; and drying and dehydration. 
A further listing is given by Fowler and Spiegelman (1968). 






PROCESS DESIGN 11/29 


Characteristic types of equipment are associated with 
these different operations. Accounts of unit operations are 
given in Chemical Engineering (Coulson and Richardson, 
1955-, 1977-), Unit Operations of Chemical Engineering 
(McCabe and Smith, 1967), Handbook of Separation Tech¬ 
niques for Chemical Engineers (Schweitzer, 1979), Principles 
of Unit Operations (Foust et at., 1980), Chemical Engineers 
Handbook (Perry and Green, 1984) and Handbook of 
Separation Processes (Rousseau, 1987) and by McCabe, 
Smith and Harriott (1985). 

The unit operations and equipments considered here by 
way of illustration are: (1) mixers, (2) centrifuges, (3) driers, 
(4) distillation columns and (5) activated carbon adsorbers. 
All five feature in the CCPS Engineering Design Guidelines 
(1993/13) and the first three are the subject of IChemE 
guides. 

There is a large group of unit operations in which dusts 
are handled with the associated hazard of dust explosion. 
This includes driers, as described below. Further treatment 
of this and other operations involving dusts is given in 
Chapter 17. 

Other equipments such as fired heaters, heat exchangers, 
pumps and compressors are treated in Chapter 12 as parts of 
the pressure system. Selected references on unit operations 
and equipments and their hazards are given in Table 11.5. 


Table 11.5 Selected references on unit operations and 
equipments and their hazards 


API (1979/1); McCabe, Smith and Harriott (1985); 

Elvers et at. (1988); CCPS (1993/13) 

Adsorbers 

Chapman and Field (1979); Anon. (1986 LPB 69, p. 257); 
CCPS (1993/13) 

Agitation, mixing 

Garrison (1981); Schofield (1982,1983); Harnby, Edwards 
and Nienow (1985); Kneale (1985 LPB 62); Sandier and 
Luckiewicz (1987); Ulbrecht and Patterson (1985) 
Autoclaves 
HSE (1990 PM 73) 

Centrifuges 

Thrush and Honeychurch (1969); E.B. Price (1970); 

P. Peterson and Cutler (1973); Butterwick (1976); Funke 
(1976); Simon (1976); O’Shea (1983); Lindley (1985,1987); 
IChemE (1987); Bange and Osman (1993); BS 767:1983 

Conveyors 

Anon. (1977i); Ewart Chainbelt Co. Ltd (1977); Conveyor 

Equipment Manufacturers Association (1979); BS 490: 

1975-BS 2890:1989 

Crushing and grinding equipment 

Anon. (1962b); Stern (1962); K.N. Palmer (1973a); 

Anon. (1979 LPB 26, p. 48); Moir (1984) 

Distillation 

Guerreri (1969); McLaren and Upchurch (1970); Frank 
(1977); R.G. Hill (1977); Shah (1978); G.F.P. Harris, Harrison 
and Macdermott (1981); Nisenfeld and Seeman (1981); 
Anon. (1983s, 1987g); L.M. Rose (1985); M.E. Harrison 
and France (1989); Strofer and Nickel (1989); Hower and 
Kister (1991); Love (1992) 


Sloan 0-967); Keey (1973,1978); K.N. Palmer (1973a); Glatt 
(1977); Reay (1977); Grafton (1983); van’t Land (1984); 
Walsh (1984); N. Gibson, Harper and Rogers (1985); 
Schacke and Falcke (1986); IChemE (1989/134); Abbott 
(1990); Papagiannes (1992) 

Dust-handling plant 

Merrill and Velentine (1942); Sargent (1969); K.N. Palmer 
(1973a); Schafer (1973b); Batel (1976); Horzella (1978); 
IChemE (1978/116,1992/32); M.N. Kraus (1979a,b); Anon. 
(1981b); Bartknecht (1981a, 1989); M.A. Maxwell (1981); 

P. Swift (1984); D.M. Muir (1985); Mody and Jackhete (1988); 
Eggerstadt, Zievers and Zievers (1993); Opila (1993); 

VDI2263:1990- 
Electrostatic coating 
Luderer (1987) 

Electrostatic precipitators 

H.J. White (1963); H.E. Rose and Wood (1966); Hanson 
and Wilke (1969); K.N. Palmer (1973a); Schneider et al. 
(1975a,b); Bump (1977); Frenkel (1978); Lewandowski 
(1978); Oglesby and Nichous (1978); Bohm (1982); 

Coleman (1984); Jaasund (1987) 

Evaporating ovens 

HSE (1974 HSW Booklet 46,1981 HS(G) 16) 

Gas absorption 

Astarita, Savage and Bisio (1983) 

Heat treatment baths 

HSE (1971 HSW Booklet 27,1975 SHW 849); FPA (1974 S8) 

Oil—water separators 
Chambers (1978) 

Polymer processing 
Sullivan (1989) 

Solids handling 

Mechanical Handling Engineers Association (1962); 
Weisselberg (1967); Notman, Gerrard and de la Mare (1981); 
IChemE (1985/126); Grossel (1988) 

Pneumatic conveying 

EEUA (1963 Handbook 15); M.N. Kraus (1965,1966a,b, 
1986); Gluck (1968); D. Smith (1970); Stoess (1970); 

K.N. Palmer (1973a); Weston (1974a); Gerchow (1975); 
Caldwell (1976); Barker (1981); O.A. Williams (1983); 
Maunder (1985); D. Mills (1990); Dahn (1993) 

Spray driers 

Belcher, Smith and Cook (1963); Sloan (1967); Masters 
(1972,1979); N. Gibson and Schofield (1977); Christiansen 
(1978); Long (1978); Bartknecht (1981a) 

Vaporizers 

G.T.Wright (1961); W.H. Doyle (1972a); E.R. Peterson and 
Maddox (1986); R.A. Smith (1987) 

Vapour liquid separators 

Gerunda (1981); Purarelli (1982); Wu (1984); Tsai (1985) 

Water treatment 

Gilwood (1963); Boby and Solt (1965); Arden (1968); 

Seels (1973); Webb (1974); Betz Laboratories Inc. (1976); 
D.R. Smith (1976); Rue (1977) 

Ancillary equipment 

Anon. (1978 LPB 24, p. 167); API (1980/2); Klein (1993) 
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11.8.1 Mixers 

Mixers present a variety of hazards. An account of hazards 
of, and precautions for, mixers is given in the Guide to 
Safety in Mixing (Schofield, 1982) (the IChemE Mixer 
Guide). The body of the Mixer Guide is in the form of a 
checklist of hazards and precautions under the headings: 
(1) equipment, (2) operations, (3) substances and (4) plant. 

The equipment should be suitable for its purpose. Dead 
spaces where reactions may occur or material may solidify 
should be avoided. The mixer body may be subjected to 
pressure or vacuum and to fatigue due to any vibration. It 
may experience out-of-balance loads such as the dropping 
in or the shifting of the charge. It should be capable of 
withstanding these different effects. 

The rotating parts may experience inertia loads on start¬ 
up and out-of-balance loads during operation. Loads may be 
imposed due to high liquid viscosity or high powder shear 
resistance. Other hazards include entry of foreign material 
such as tramp metal and contact between the impeller and 
the body of the vessel due to bending of the shaft. There is a 
critical speed for an impeller. It should normally not be run 
between 70 and 100% of this critical speed. 

There are various features that may constitute weak 
points on a mixer. They include closures, sight glasses, instru¬ 
ments, sample points on the body, and bearings and seals 
on the agitator. The moving parts and the charge may pre¬ 
sent a hazard to personnel. The moving parts may include 
the mixer body or other features such as counterbalanced 
closures. Other hazards include unguarded impellers, 
splashing or even ejected material, or ejected objects. 

Failure of utilities can cause problems for mixers. Some 
failures include loss of electrical power to the agitator, loss 
of cooling, loss of inerting and loss of exhaust ventilation. 
If there is loss of agitation, reactions may occur or material 
may solidify. Another hazard of failure of electrical power 
is unexpected restart of the mixer. It should be arranged 
that the mixer does not restart automatically following 
restitution of power after a power failure. Measures should 
also be taken to prevent other inadvertent start-up of 
the mixer. 

Mixers sometimes handle flammable materials. Sources 
of ignition characteristic of mixers are hot surfaces, fric¬ 
tion and impact, and static electricity. Hot surfaces include 
electric motor casings, drive components, bearings and 
lamps. Friction and impact can occur due to breakage of 
rotating parts, entry of foreign material or contact between 
the impeller and the vessel. Friction may also occur due 
to bearings or seals running dry. Static electricity may be 
generated during the loading or during mixing of liquids 
or powders. A principal precaution against ignition is 
inerting. 

The plant layout should provide good access to the mixer 
for operation and maintenance and should cater for fore¬ 
seeable leaks and spillages. Operational hazards include: 
overfilling, leading to overpressure or spillage; under¬ 
filling, leading to splashing or, if the mixer is nearly empty, 
mechanical damage; and overmixing, leading to thicken¬ 
ing, overheating or overreaction of the mixture. 

The Mixer Guide describes some of the principal types of 
mixer such as the rotating shape (double cone), orbiting 
screw, ‘U’ trough, high speed rotor, Muller, top entry 
agitator (stirred tank), agitated bead mill (attrition), change 
can, planetary, heavy paste (Z-blade), internal (Banbury), 
roll mills and mixer/extruder types, and gives a matrix of 
mixer types vs relevant hazards. 


Two precautions which find widespread use on mixers 
are fixed guards and interlocks. Fixed guards include 
annular covers around agitators and bars to prevent entry 
of a limb into a running nip. These are complemented by 
non-manual methods of loading and discharging such as 
chutes and feed belts. 

Interlocks are used to prevent a mixer from being started 
up or approached unless it is in a safe condition. One 
application is to ensure that the cover is closed, another to 
ensure that the agitator is properly centred in the body and 
another to prevent access either to the agitator shaft or to 
the mixer body while it is moving. The Mixer Guide gives 
a number of examples. 

A further treatment of mixers is given in the CCPS 
Engineering Design Guidelines. 

11.8.2 Centrifuges 

Centrifuges likewise present a variety of hazards. 
The hazards of, and the precautions for, centrifuges are 
considered in the User Guide for the Safe Operation of 
Centrifuges with Particular Reference to Hazardous Atmos¬ 
pheres (Butterwick, 1976) and the later publication User 
Guide for the Safe Operation of Centrifuges (Lindley, 1987) 
(the IChemE Centrifuge Guide). 

Centrifuges often handle volatile flammable liquids and, 
unless special precautions are taken, are almost certain to 
contain a flammable mixture at some stage in the opera¬ 
tional cycle. The probability of ignition of the flammable 
mixture is quite high. Main sources of ignition are 
mechanical friction, hot surfaces and static electricity. A 
centrifuge rotates at high speed and a mechanical fault, 
leading to a spark, or a hot surface, can cause ignition. 

The movement of the slurry in an operating centrifuge 
favours the generation of static electricity, particularly if the 
liquid has a high resistivity. Alternatively, if the centrifuge is 
stopped and open, a static electricity hazard may occur from 
an operator who has too high an insulation path to earth. 

There is also a mechanical hazard from the high kinetic 
energy of the rotating centrifuge bowl. The main causes of 
mechanical failure are basket imbalance, incorrect assem¬ 
bly, corrosion and bearing failure. 

Since centrifuge operations involve frequent opening 
of the centrifuge, there is with some substances a toxic 
hazard. This may be an immediate, acute hazard or a long¬ 
term cumulative one. 

If there is an explosion hazard in a centrifuge, it should 
be blanketed with inert gas, usually nitrogen. The main¬ 
tenance of an inert atmosphere should be monitored. 
The three monitoring systems commonly used are based 
on measurement of: (1) flow of inert gas into centrifuge, 
(2) pressure of gas in centrifuge and (3) oxygen concentra¬ 
tion of gas in centrifuge. The most suitable system depends 
on the degree of hazard. But the system based on the meas¬ 
urement of oxygen concentration, which is the variable of 
direct interest, is the most positive and should be used for 
high risk situations. 

If there is a toxic hazard, the centrifuge system should be 
enclosed as far as practicable. Local exhaust ventilation 
should be provided. Alternatively, it is possible to extract 
from the casing and operate under a negative pressure, 
provided that the liquid is not flammable. Other measures 
which may be required include provision of a forced air 
supply or of breathing equipment for the operator. 

Centrifuges are treated further in the CCPS Engineering 
Design Guidelines. 
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11.8.3 Driers 

The principal hazards presented by driers are those of fire 
and explosion. These hazards and the corresponding pre¬ 
cautions are discussed in Prevention of Fires and Explosions 
in Dryers (Abbott, 1990) (the IChemE Drier Guide). This is 
the second edition of, and thus supersedes, the User Guide 
to Fire and Explosion Hazards in the Drying of Particulate 
Materials (Reay, 1977). 

The Drier Guide states that each year in the United 
Kingdom driers are responsible for 30 fires and one explo¬ 
sion serious enough to be attended by the local fire brigade. 
A detailed account of the self-heating of combustible mate¬ 
rials is given in Chapter 16 and of combustibility and 
explosibility of dusts and of dust fires and explosions and 
dust explosion venting in Chapter 17, and the treatment 
given here is correspondingly limited. 

Differences between the first and second editions of the 
Drier Guide are in large part accounted for by the up-dating 
of the methods for explosibility testing and for explosion 
suppression and venting. The identification of hazards in 
powders which are to be dried is described in Chapter 8. 
The Drier Guide assumes that the materials processed are 
essentially materials which may be combustible but are not 
either explosive or liable to decomposition. The following 
discussion is concerned with such combustible materials. 

With regard to the oxygen concentration to prevent 
ignition, the Drier Guide states that if the published values 
are unacceptably low for efficient plant operation, the 
minimum oxygen concentration to support combustion 
should be established by tests performed using the modi¬ 
fied vertical tube apparatus described by Field (1982). 

There are three forms in which a combustible material 
being processed in a drier may be ignited: (1) dust cloud, 
(2) dust layer and (3) bulk dust. 

A dust cloud of explosible concentration will normally 
occur only in driers where the material is dispersed such 
as in a fluidized bed drier or a spray drier. In other types 
of driers such as tray and band driers there should be no 
dispersed dust, provided the air velocity is kept suffi¬ 
ciently low. If there is a dust cloud, it will almost certainly 
be within the explosible range. The dust cloud may be 
ignited by an ignition source. Alternatively, ignition may 
occur if the cloud is raised above its minimum ignition 
temperature. 

Dust may also form in layers inside the drier. A dust layer 
may be ignited by an ignition source. Alternatively ignition 
by self-heating may occur if the dust layer is exposed to 
an ambient temperature above its minimum ambient tem¬ 
perature for self-ignition. 

Ignition may also occur in the bulk dust, for which there 
is a separate minimum ignition temperature. Since the 
heat loss from the bulk material is less than from a layer, 
this minimum ignition temperature is lower than that for 
a dust layer. 

A dust explosion may be prevented by the use of inerting. 
The concentration of inert gas should be such as to reduce 
the oxygen concentration below the minimum oxygen con¬ 
centration required to support combustion. 

Dust properties relevant to drier design, therefore, 
include in particular the minimum ignition temperature of 
the dust cloud, the minimum ambient temperature of igni¬ 
tion of a dust layer, the minimum ignition temperature for 
the hulk dust and the minimum oxygen concentration to 
support combustion. The minimum ignition energy of the 
dust cloud is also relevant. The design of dust explosion 


venting systems utilizes information on the dust K st class. 
Particle size is a strong determinant of these properties. 
Account should also be taken of the fact that if the dust 
contains any significant amount of flammable liquid, there 
is a hybrid mixture, with enhanced explosibility. 

Many of the regular ignition sources apply to driers. 
These include hot work, hot surfaces, electrical equipment, 
and friction and impact. A direct heating system may give 
rise to hot particles which can act as an ignition source and 
precautions are taken against this. Air for combustion 
should be drawn from a source free of dust. Avoidance of 
dust in this air should be a factor taken into account when 
considering recirculation of air from the drier. Burners 
should be cleaned regularly and operated so as to give 
complete combustion. Erratic operation and flame blow-off 
should be remedied without delay. Before entering the 
drier, the hot gases should be passed through a 3 mm mesh 
to screen out hot particles. The mesh should be able to 
withstand the high temperatures and should be cleaned 
regularly. A direct heating system should not be used to 
evaporate flammable vapours. 

Precautionsagainstexplosionmaybebasedonprevention 
or protection. The main preventive measure given in the 
Drier Guide is inerting. The guide gives three main pro¬ 
tective measures: venting, suppression and containment. 

On the basis of the hazard evaluation a basis of safety 
should be chosen. The Drier Guide states that one measure 
is sufficient. If inerting is used, there should be continuous 
on-line monitoring of the oxygen concentration. With some 
driers there is a facility to recirculate part of the exhaust air 
to improve thermal efficiency. The gas entering the drier 
will then have a higher concentration of water vapour and, 
if it is direct fired, a higher concentration of carbon dioxide 
also. This provides a degree of inerting and such driers are 
described as ‘self-inertizing’. 

The Drier Guide gives a detailed discussion of the appli¬ 
cation of explosion suppression and explosion venting 
methods to driers. It also discusses the applicability of 
explosion containment, including pressure shock contain¬ 
ment, to which it adopts a cautious approach. It points out, 
however, that containment may well be a practical option 
for a vacuum drier, where the initial pressure is much lower. 

Measures which protect against a dust explosion, 
whether explosion suppression, venting or containment, 
do not necessarily offer protection against a sudden 
decomposition of the material, with a massive evolution of 
gas. Measures should also be taken to prevent the spread of 
dust fire or explosion to other parts of the plant. The pro¬ 
cess should be specified so as to minimize the hazard. 
The inlet air temperature is a particularly important vari¬ 
able and the Drier Guide discusses in detail the relevant 
factors and safety margins for different types of drier. 

There are various items of equipment which are common 
to drying plants. They include heating systems, feed 
systems, dust conveying and recovery systems, and prod¬ 
uct storage vessels. Dust recovery systems include 
cyclones, filters, electrostatic precipitators, and scrubbers 
and washers. 

The heating system should be designed in accordance 
with the codes for gas or oil fired heaters, as the case may 
be. It should have the appropriate instrumentation, 
including alarms, trips and interlocks. 

Protection should be provided against explosion of a 
fuel-air mixture in the firing space. Suitable relief should 
be provided against such an explosion, unless the drier is 
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designed for an explosible dust and is thus already pro¬ 
vided with a dust explosion relief which can serve both 
purposes; where such a dust explosion relief exists, it will 
generally be adequate for the flammable gas explosion. 

Self-heating of material passing hot from a drier to prod¬ 
uct storage is a hazard. The maximum safe temperature 
for discharge to storage may be determined for many 
situations from thermal ignition theory in combination 
with empirical tests. Measures to reduce the risk of self¬ 
heating include limitation of the size of storage vessel and 
monitoring of the temperature of the material in the vessel. 

The operation and maintenance of driers also have cer¬ 
tain common features. The Drier Guide discusses the 
operational aspects under the headings of pre-start-up 
checks, start-up, normal operation, normal shut-down and 
emergency shut-down. The guide gives what amount to 
checklists for pre-start-up checks and maintenance. 

The Drier Guide describes some of the principal types of 
driers such as spray driers, pneumatic conveying driers, 
fluidized bed driers, rotary driers, band driers, batch atmos- 
pheric tray driers, batchvacuum driers and trough driers. For 
each type of drier it discusses the principle of operation, 
hazards, ignition sources, preventive and protective meas¬ 
ures, process specification, equipment specification, and 
operation and maintenance. The CCPS Engineering Design 
Guidelines provide a further treatment of driers. 

11.8.4 Distillation columns 

Distillation columns present a hazard in that they contain 
large inventories of flammable boiling liquid, usually 
under pressure. There are a number of situations which 
may lead to loss of containment of this liquid. 

The conditions of operation of the equipment associated 
with the distillation column, particularly the reboiler and 
bottoms pump, are severe, so that failure is more probable. 

The reduction of hazard in distillation columns by the 
limitation of inventory has been discussed above. A dis¬ 
tillation column has a large input of heat at the reboiler and 
a large output at the condenser. If cooling at the condenser 
is lost, the column may suffer overpressure. It is necessary 
to protect against this by higher pressure design, relief 
valves or HIPS. On the other hand, loss of steam at the 
reboiler can cause underpressure in the column. On 
columns operating at or near atmospheric pressure, full 
vacuum design, vacuum breakers or inert gas injection is 
needed for protection. Depostition of flammable materials 
on packing surfaces has led to many fires on opening of 
distillation column for maintenance. 

Another hazard is overpressure due to heat radiation 
from fire. Again pressure relief devices are required to 
provide protection. 

The protection of distillation columns is one of the 
topics treated in detail in codes for pressure relief such as 
API RP 521. Likewise, it is one of the principal applications 
of trip systems. 

Another quite different hazard in a distillation column is 
the ingress of water. The rapid expansion of the water as it 
flashes to steam can create very damaging overpressures. 

11.8.5 Activated carbon adsorbers 

Experience with activated carbon adsorbers indicates 
that they are another potentially troublesome operation. 
An account of this type of adsorber is given in the CCPS 
Engineering Design Guidelines. 


Activated carbon adsorbers are prone to fires in the 
adsorbent bed. This is so particularly where the substance 
being adsorbed is an oxidizable organic such as an alde¬ 
hyde, ketone or organic acid. Fires are especially likely to 
occur during a shut-down. 

Countermeasures evolved to minimize the risk of fire 
include: paying attention to adsorbent purity; maintaining 
the moisture content of the adsorbent; operating at less 
than 25% of the lower flammability limit; and avoiding 
dead spots. The adsorbers should be located outdoors and 
provided with pressure relief and fire protection. 

Among the measures used to prevent fire during a shut¬ 
down are maintenance of a gas flow 75% of normal, use of 
water or steam spray to keep the bed moist, inerting of the 
bed and removal of the bed. 

The Guidelines give a checklist of precautions for 
activated carbon adsorbers. 

11.9 Operating Conditions 

Operation at extremes of pressure and temperature has 
its own characteristic problems and hazards. Extreme 
conditions may occur at: (1) high pressure, (2) low pressure, 
(3) high temperature and (4) low temperature. 

Some general characteristics of these operating 
conditions are described below, together with some of the 
associated literature. In relation to extreme operating 
conditions in general, mention may be made of Chemical 
Engineering under Extreme Conditions (IChemE, 1965/40) 
and of the series Safely in Air and Ammonia Plants 
(1960-69/17-26), Operating Practices in Air and Ammonia 
Plants (1961—62/27—28) and Ammonia Plant Safety and 
Related Facilities (1970-94/31-53) by the American Insti¬ 
tute of Chemical Engineers (AIChE). 

A newer development in extreme operating conditions is 
the use of plasma processing. Selected references on 
extreme operating conditions and their hazards are given 
in Table 11.6. 

11.9.1 High pressure 

The range of pressures handled in high pressure technol¬ 
ogy is wide. Three broad ranges of pressure may be dis¬ 
tinguished: (1) pressures up to about 250 bar, (2) pressures 
of several thousand bar, and (3) pressures greater 
than 8000 bar. Most process plants operate at pressures 
below 250 bar, but certain processes such as high pressure 
polyethylene plants operate at pressures up to about 
3000 bar. Ultra-high pressures begin at a pressure of about 
8000 bar, which is the probable limit of the simple elastic 
cylinder and at which it becomes necessary to use other 
types of construction such as wire-wound vessels. It is 
therefore important to minimize leaks by eliminating 
potential sources such as flanges, vents, bonnet seals, etc. 

In general, pressure vessels in process design are not 
designed for explosive over pressures such as deflagration 
or detonation with certain exceptions (acetylene). Defla¬ 
gration can produce over pressure of a factor of 9-10 
whereas detonations can lead to a factor 40 or higher. 
Detonations are not expected in pressure vessels and rarely 
in pipelines. Appropriate arrestors should be provided for 
this condition (CCPS, 2000). 

Normal high pressure plant is dealt with in numerous 
standard texts. Mention may be made here of Theory and 
Design of Modern Pressure Vessels (Harvey, 1974) and Pres¬ 
sure Component Construction (Harvey, 1980). 
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Table 11.6 Selected references on extreme operating 
conditions and their hazards 


IChemE (1965/40); Zabetakis (1965); Pilborough 
(1971,1989) 

High pressure 

ASME (Appendix 28 PressureVessels and Piping, PVP192, 
1982/154,1986 PVP 110,1987 PVP 125,1988 PVP 148, 

1989 PVP 165); ASTM (STP 374,1982 STP 755); Tongue 
(1934); Newitt (1940); Comings (1956); Stevenston (1959); 
AIChE (1960-69/3-12,1961-62/13,14,1967/71, 

1970- 94/17-38,1973/62,1974/63,1978/64); SCI (1962); 
EWWilson (1962); E.L. Clark (1963); Bett and Burns (1967); 
Buchter (1967); Weale (1967); Albright, van Munster and 
Forman (1968); Manning and Labrow (1971); Munday 
(1971a); Karl (1973);Witschakowski (1974); Sykes and 
Brown (1975); Gilbert and Eagle (1977); IMechE (1977/39); 
Spain and Paauwe (1977); Vodar and Marteau (1980); 
Homan, MacCrone and Whalley (1983); Boyer (1984); 
Livingstone (1984); Sherman and Stadtmuller (1987); 
Prugh, Howard and Windsor (1993) 

High temperature 

ASME (Appendix 28 Materials, Pressure Vessels and Piping, 
1975/71,1979/137,1982/156,1983/164,1984/172, 

1989 PVP 163); I.E. Campbell (1956); Goldberger (1966); 
Kamptner, Krause and Schilken (1966b); I.E. Campbell and 
Sherwood (1967); Clause (1969); Albrecht and Seifert 
(1970); ASME (1971/65); IChemE (1971/50,1975/62); Zeis 
and Lancaster (1974); AIChE (1986/84) 

Low pressure, vacuum 

Avery (1961); Davy (1951); EEUA (1961 Handbook 11); 
Pirani and Yarwood (1961); Steinherz (1962); Spinks (1963); 
van Atta (1967); Roth (1967,1990); Dennis and Heppel 
(1968); Carpenter (1970); Mangnall (1971); AIChE (1972/74); 
O’Hanlon (1980); Ryans and Croll (1981); Patton (1983); 

R.V. Parker (1984); Ryans (1984); Ryans and Roper (1986); 
EEMUA (1987 Publ. 152); IChemE (1987/130); Sandier 
and Luckiewicz (1987); N.S. Harris (1989); Wutz, Adam 
and Walcher (1989); Eckles and Benz (1992); R.E. Sanders 
(1993b) 

Low temperature 

ASME (Appendix 28 Materials, Pressure Vessels and 
Piping, 1980/49; 1984/195); British Cryogenics Council 
(n.d., 1970,1975); M. Davies (1949); Ruhemann (1949); 
Anon. (1960e); J.D. Jackson (1961); Burgoyne (1965b); 
Krolikowski (1965); Barron (1966—); AIChE (1968/72, 
1972/74,1982/77,1986/83); Codlin (1968); Harton (1968); 
Ligi (1969); IChemE (1970/49,1972/53,1975/ 59); 

VC. Williams (1970); Haselden (1971); R.W. Miller and 
Caserta (1971); Edeskuty and Williamson (1983); 
Springmann (1985); CGA (1987 P-12) 

Supercritical conditions 

Korner (1985); Penninger et al. (1985); Randhava and 
Calderone (1985); McHugh and Krukonis (1986) 


Plant for higher pressure is a more specialized technol¬ 
ogy. It is treated in The Design and Construction of High 
Pressure Chemical Plant (Tongue, 1934), The Design of High 
Pressure Plant and Properties of Fluids at High Pressure 
(Newitt, 1940), High Pressure Technology (Comings, 1956), 


Apparate undArmaturen der Chemischen Hochdrucktechnik 
(Buchter, 1967), High Pressure Engineering (Manning and 
Labrow, 1971), High Pressure Technology (Spain and Paauwe, 
1977), High Pressure in Science and Technology (Vodar and 
Marteau, 1980) and Experimental Techniques in High Pres¬ 
sure Research (Sherman and Stadtmuller, 1987), and by 
Homan, Maccrone and Whalley (1983). 

Further accounts of high pressure technology and its 
hazards are given by Stevenston (1959), Munday (1971a), 
Sykes and Brown (1975), B.G. Cox and Saville (1975), Boyer 
(1984), Livingstone (1984) and Prugh, Howard and Windsor 
(1993). 

The relevant standard for high pressure plant is BS 
5500:1976 Unfired Fusion Welded Pressure Vessels. There 
is no UK standard for very high pressure plant. 

High pressures are usually associated with high and/or 
low temperatures. 

The use of high pressure greatly increases the amount of 
energy available in the plant. Whereas in an atmospheric 
plant stored energy is mainly chemical, in a high pressure 
plant there is, in addition, the energy of compressed 
permanent gases and of fluids kept in the liquid state only 
by the pressure. 

Since the economies of scale apply very strongly to 
compression, the number of compressors used is generally 
small. Often there is a single compressor for a particular 
duty. The machines themselves are large and their tech¬ 
nology is complex. 

Although high pressures in themselves do not pose seri¬ 
ous problems in materials of construction, the use of high 
temperatures, low temperatures or aggressive materials 
does. Thus, the problem is to obtain the material strength 
required by high pressure operation despite these factors. 

With high pressure operation, the problem of leaks 
becomes much more serious. The amount of fluid which can 
leak out through a given hole is greater on account of the 
pressure difference. Moreover, the fluid may be a liquid 
which flashes off as the pressure is reduced. 

11.9.2 Low pressure 

The degrees of vacuum handled in low pressure or vacuum 
technology span many orders of magnitude. In the present 
context, it is relatively low vacuum from 760 torr (atmos¬ 
pheric pressure) to 1 torr and medium vacuum from 1-10 -3 
torr which are the ranges of prime interest. 

Normal vacuum technology is treated in Industrial High 
Vacuum (Davy, 1951), Principles of Vacuum Technology 
(Pirani and Yarwood, 1961), Vacuum Technology (Spinks, 
1963), Vacuum Science and Engineering (van Atta, 1967), 
Vacuum Sealing Techniques (Roth, 1967), Vacuum System 
Design (Dennis and Heppel, 1968), A User’s Guide to Vacuum 
Technology (O’Hanlon, 1980), Process Vacuum System 
Design and Operation (Ryans and Roper, 1986), Modern 
Vacuum Practice (N.S. Harris, 1989), Theory and Practice 
of Vacuum Technology (Wutz, Adam and Walcher, 1989) and 
Vacuum Technology (Roth, 1990). Low pressures are not in 
general as hazardous as the other extreme operating con¬ 
ditions. But a hazard which does exist in low pressure plant 
handling flammables is the ingress of air, with consequent 
formation of a flammable mixture. 

A major part of vacuum technology is concerned with 
detecting and preventing leaks. The techniques developed 
in this field may be relevant, therefore, to plants under 
positive pressure, particularly those handling very toxic 
materials. 
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11.9.3 High temperature 

The literature on high temperature technology is relatively 
diffuse and deals mainly with particular types of plant 
(e.g. ammonia plants), or particular types of equipment 
(e.g. fired heaters). Mention may be made, however, of High 
Temperature Materials and Technology (I.E. Campbell and 
Sherwood, 1967). 

As already mentioned, the use of high temperatures in 
combination with high pressures greatly increases the 
amount of energy stored in the plant. The heat required to 
obtain a high temperature is often provided by fired heat¬ 
ers. These have a number of hazards, including explosions 
in the firing space and rupture of the tubes carrying the 
process fluid. 

There are severe problems with materials of construction 
in high temperature plants. The main problem is that of creep 
at high temperatures. But there are other problems also, such 
as hydrogen embrittlement. The use of high temperatures 
implies that the plant is put under thermal stresses, parti¬ 
cularly during start-up and shutdown. It is essential to take 
these stresses fully into account in the design. 

It is equally necessary to operate the plant with regard to 
the temperature effects. Its life can be much shortened by 
excursions inside the high creep range or by transients 
which cause high thermal stresses. Relatively low cyclical 
temperatures such as in driers, and absorbers when 
regenerating, can lead to greatly reduced service life. 

11.9.4 Low temperature - cryogenics 

The temperatures handled in low temperature technology 
are those below 0°C. There is a somewhat distinct technol¬ 
ogy dealing with ultra-low temperatures below 20 K, but 
this is not of prime interest in the present context. 

Normal low temperature technology is dealt with in The 
Physical Principles of Gas Liquefaction and LowTemperature 
Rectification (M. Davies, 1949), The Separation of Gases 
(Ruhemann, 1949), Cryogenic Systems (Barron, 1966-), 
Cryogenic Fundamentals (Haselden, 1971) and Liquid Cryo- 
gens (Edeskuty and Williamson, 1983). Mention should 
also be made of the Cryogenic Safety Manual by the British 
Cryogenic Council (BCC, 1970). 

Low temperature plants contain large amounts of fluids 
kept in the liquid state only by pressure and temperature. If 
for any reason it is not possible to keep the plant cold, then 
the liquids will begin to vaporize. 

Impurities in the fluids in low temperature plant are 
liable to come out of solution as solids. This is particularly 
likely to happen if parts of the plant are allowed to boil dry 
Deposited solids may be the cause not only of blockage but 
also, in some cases, of explosion. It is necessary, therefore, 
to ensure that the fluids entering a low temperature plant 
are thoroughly purified. 

Careful attention must be paid to the establishment and 
compliance with the vessel operating parameters. In most 
cases low temperatures are the result of advertent or inad¬ 
vertent depressurization of light hydrocarbon materials, 
which greatly reduces the hazard. Care must be taken 
on repressurization to allow the materials to reach a safe 
temperature. 

A severe materials of construction problem in low 
temperature plants is low temperature embrittlement. 
The materials requirements, however, are well understood. 
The main difficulties arise from aspects such as installa¬ 
tion of incorrect materials or flow of low temperature fluids 
into sections of the plant constructed in mild steel. 


In low temperature as in high temperature operations 
the plant is subject to thermal stresses, especially during 
start-up and shut-down. These stresses need to be allowed 
for and, as far as possible, avoided. 

The insulation on low temperature plant frequently 
takes the form of a cold box. It is not easy to gain access to 
equipment inside the cold box. It is important, therefore, 
for the equipment to be as reliable and the fluids processed 
as pure as possible. 

In low temperature plant the temperature approaches 
used in the heat exchangers are very close, say 3°C. This is 
done to achieve maximum thermodynamic efficiency, since 
any inefficiency is paid for directly in the power required 
for compression. The use of such close temperature 
approaches is another reason for avoidance of fouling by 
keeping the fluids free of impurities. 

The scale of operation in low temperature technology 
can be very large. In particular, the largest storages of 
hazardous liquids, both flammables and toxics, tend to be 
refrigerated storages. 

11.10 Utilities 

The process plant is dependent on its utilities. These 
include in particular: 

(1) electricity 

(a) general, 

(b) uninterrupted power supplies, 

(c) electrical heating; 

(2) fuels; 

(3) steam; 

(4) compressed air 

(a) plant air, 

(b) instrument air, 

(c) process air, 

(d) breathing air, 

(5) inert gas; 

(6) water 

(a) cooling water, 

(b) process water, 

(c) hot water, 

(d) firewater; 

(7) heat transfer media 

(a) hot fluids, 

(b) refrigerants. 

There may also be other special services on particular 
plants. Selected references on utilities are given in 
Table 11.7. 

Important features of a utility are its: (1) security, 
(2) quality, (3) economy, (4) safety and (5) environmental 
effects. 

One of the main causes of failure of supply of a utility is 
loss of part of the generating capacity followed by rapid 
overload of the rest, leading to total loss. In order to avoid 
this, measures may be taken to effect load shedding at the 
less essential points of consumption. Specific application of 
this principle is discussed below for electricity and steam. 

It is often attractive to use a ring main layout to dis¬ 
tribute a service. This allows the supply to a given point to 
be provided from either side and thus increases reliability. 
It is necessary, however, to give careful consideration to the 
flows which can occur in ring mains, particularly those 
handling steam. 
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Table 11.7 Selected references on utilities and their 
hazards 


NRC (Appendix 28 Utilities); D.T. Smith (1965c, 1982); 
Butikofer (1974); Monroe (1970);W.B. Thomas (1981); API 
(1981/4); Kletz (1988m); Broughton (1993) 

Electricity 

American Oil Company (n.d./5); BG (Appendix 27 
Electrical ); EEUA (Doc. 37D, 1964 Doc. 17); HSE (HSW 
Booklet 31,1970 HSW Booklet 24,1985 OP 10,1991 GS 47); 
ICI (n.d.b); IEEE (Appendix 27); IEE (1966 Conference 
Publ. 16,1971 Conference Publ. 74,93,1974 Conference 
Publ. 108,110,1975 Conference Publ. 134,1977 Conference 
Publ. 148,1982 Conference Publ. 281,1988 Conference 
Publ. 296,1992 Conference Publ. 361); MCA (SG-8); NRC 
(Appendix 28 Power Supply)', RoSPA (IS/73); Swann (1959); 
Abbey (1964); Jenett (1964a); Silverman (1964a-d); 
Tenneco Oil Company (1964a); R.Y. Levine (1965a); 

D.T. Smith (1965c, 1982); Edison Electric Institute (1966); 
Chopey (1967a); Kerkofs (1967); EPA (1968/6,1974/25); 
House (1968a); Kullerd (1968); Haigh (1969); Hoorman 
(1969); R.H. Lee (1969); J.C. Moore (1969); Vaccaro (1969); 
Nailen (1970a, 1973a-c, 1974,1975); Tucker and Cline 
(1970,1971); Yuen (1970); Yurkanin and Claussen (1970); 
A.H. Moore and Elonka (1971); API (1982 Refinery 
Inspection Guide Ch. 14,1991RP 540,2003); Consumers 
Association (1972); Jolls and Reidinger (1972); Stover 
(1972); Anon. (1973i); Butler (1973); Huey (1973); Imhof 
(1973); IEEE (1973,1975a,b); Mattson (1974); Needle (1974); 
Lammartino (1975); Crom (1977); Fink and Beaty (1978); 
Margolis (1978); Morrison (1978); Roe (1978); Bos and 
Williams (1979); T. Brown and Cadick (1979—); Mueller 
(1980); Macpherson (1981); Wildi (1981); Cohn (1983); 

A. Jackson (1984); Nicholls (1984); Peate (1984); Goodchild 
(1985); Hobson and Day (1985); Fordham Cooper (1986); 
Sandier and Luckiewicz (1987); EEMUA (1988 Publ. 133); 
Kletz (1988m); UL (1988 UL1012); Bro and Levy (1990); 
Anon. (1991LPB102, p. 21; 1991LPB102, p. 23; 1992 LPB 
108, p. 28; 1994 LPB 118, p. 15); Kowalczyk (1992); 

J.A. McLean (1992); Broughton (1993); McLean (1993 LPB 
110); NFPA (1993 NFPA 70,496) ANSI (Appendix 27), 
ANSI C series, ANSI C2-1993 BS (Appendix 27 Electrical !), 
BS CP 1003:1964-, BS CP 1013:1965, BS PD 2379:1982 
Emergency generators 

NRC (Appendix 28 Diesel Generators ); HSE (1985 PM 53); 
Kletz (1988m); NFPA (1989 NFPA 110A, 1993 NFPA 110, 111) 

Uninterruptible power supply 

Cullen (1990); UL (1991 UL 1778) 

Electrical pipe tracing 

Butz (1966); Ando and Othmer (1970); Ando and 

Kawahara (1976) 

Electrical area classification 

BASEEFA (n.d./l, SFA 3004,3006,3009,3012); MCA 
(SG-19); IEE (1962 Conference Publ. 3,1971 Conference Publ. 
74,1975 Conference Publ. 134,1982 Conference Publ. 218, 
1988 Conference Publ. 296,1992 Conference Publ. 361); 

API (1973 RP 500B, 1982 RP 500A, 1984RP 500 C, 1991 RP 
500); IP (1990 MCSP Pt 15,1991 MCSP Pt 1); J.R. Hughes 
(1970); ICI/ RoSPA (1970 IS/74,1972 IS/91); EEUA (1973 Doc. 
47D); LPGITA (1991LPG Code 1 Pt 1); NFPA (1993 NFPA 70, 
496); ANSI (Appendix 27), BS (Appendix 27), BS 4683: 
1871—, BS 5345:1977-, BS 5501:1977- 
Gas (see Table 11.10) 


Steam, condensate, feedwater 

American Oil Company (n.d./6); Lyle (1947); NRC (Appendix 
28 Steam Supply); EEUA (1962 Handbook 8); Monroe (1970); 
Buffington (1973); IMechE (1974/12,13,1981/58,1984/76, 
1987/9 6,98,90/124); Anon. (1976 LPB 11, p. 5); Danekind 
(1976,1979); Pitts and Gowan (1977); Reid and Renshaw 
(1977); Gambhir, Heil and Schuelke (1978); Bos and Williams 
(1979); J.K. Clark ckson(1980); 

Ward, Labine and Redfield (1980); Pybus (1981); Blackwell 
(1982b); Andrade, Gates andMcCarthy (1983); ASME 
(1983/193); Freedman (1983); Monroe (1983a); J.F. Peterson 
and Mann (1985);T.J. Kelly (1986); Plummer (1986); 

A. Atkinson (1988); Heaton and Handley (1988); Gunn and 
Morton (1989); National Fuel Efficiency Service (1989); 

Istre (1992); Babcock and Wilcox (1993); Broughton (1993); 
C. Butcher (1993b); Ganapathy (1993); Spirax-Sarco (1993); 
Hahn (1994); BS 759:1984-, BS 1113:1992 
Cooling water 

American Oil Company (n.d./l); Partridge and Paulson 
(1963); M. Brooke (1970); Gazzi and Pasero (1970); 
Troscinski and Watson (1970); Silverstern and Curtis (1971); 
Klen and Grier (1978); Krisher (1978); Ward, Lee and 
Freymark (1978); Conger (1979); Veazey (1979); J.W. Lee 
(1980a,b); Burger (1982,1983); Holiday (1982); WJ. Scott 
(1982); D.T. Smith (1982b); G.B. Hill (1983); Willa and 
Campbell (1983); IChemE (1987/131); Reidenbach (1988); 
Ellis (1990); G. Parkinson and Basta (1991); NFPA (1992 
NFPA 214); Broughton (1993) 

Process water 

Holiday (1982) 

Drinking water 
BS 6700:1987 
Compressed air 

American Oil Company (n.d./2); Weiner (1966); La Cerda 
(1968); A.G. Paterson (1969); McAllister (1970,1973); ISA 
(1975 S7.3,1984 RP 7.7); Allan (1986); Johnston (1990); 
Broughton (1993); O’Dell (1993) 

Instrument air 

Nielsen, Platz and Kongso (1977); Broughton (1993) 

Inert gas 

Hotchkiss and Weber (1953); P.A.F. White and Smith (1962); 
Funk (1963); Husa (1964); Sittig (1966); Penland (1967); 
Rosenberg (1968); H.A. Price and McAllister (1970); Loeb 
(1974); Anon. (1976 LPB 7, p. 11); Simon (1976); Kletz (1980f); 
Mehra (1982); Metzger etal. (1985); Hardenburger (1992); 
Broughton (1993) 

Refrigeration 

ASHRAE (Appendix 27,28, n.d./2,1972,1992 ASHRAE15, 
34);Tanzer (1963); Ballou, Lyons andTacquard (1967); 
Spencer (1967); Zaffi (1967); Kaiser, Salhi and Pocini (1978); 
Mehra (1978,1979a-c, 1982); Marsh and Olivo (1979); 

O.K. Miller (1979); Baggio and Saintherant (1980); 

Sibley (1983); Jacob (1991a); R.W. James (1994) 

Heat transfer media 

Geiringer (1962); Seifert, Jackson and Sech (1972); Frikken, 
Rosenberg and Steinmeyer (1975); Anon. (1978i); Sheehan 
(1986); Dotiwala (1991); CCPS (1993/13) 

Water treatment 

Bellew (1978); Day (1978); Gasper (1978); Setaro (1980); 
WB. Thomas (1980); Saffell (1992) 
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Since service pipes and trunking pass through the plant, 
they are vulnerable to damage from accidents. The routing 
of services should be planned so as to minimize such 
damage. 

In particular, cabling for control instruments and other 
key services should be routed as safely as possible. For 
critical control functions requiring replication, the cables 
should go by different routes. A severe accident may well 
cause damage to certain key services. There may be 
serious consequences if there is loss of electrical power to 
machines or control instrumentation, of cooling water or of 
fire water. 

11.10.1 IChemE Utilities Guide 

A treatment of the principal utilities is given in Process 
Utility Systems (Broughton, 1993) (The IChemE Utilities 
Guide). The Utilities Guide deals with the following topics: 

(I) efficient use of utilities, (2) fuel, (3) compressed air, 
(4) inert gases, (5) thermal fluid systems, (6) water prepa¬ 
ration, (7) the boiler house, (8) steam distribution, (9) elec¬ 
tricity use and distribution, (10) air and water cooling, 

(II) refrigeration, (12) fire protection system, (13) building 
services, and (14) pipework and safety. 

The Guide starts by outlining five broad principles of 
general applicability to process utilities. One is the need for 
critical examination of all aspects, both the requirements 
and the means of meeting them, with full exploration of 
alternatives. Another is integration of utilities not just 
with individual plants but across the site. The third is the 
appropriate sizing and location of the utilities units. The 
fourth is the use of modern, efficient systems. And the fifth, 
the need for performance targets and monitoring. 

11.10.2 Electricity 

Electricity is used for a number of different purposes on 
process plants. These include: (1) machinery, (2) heating 
and (3) instrumentation. The use of electricity in factories 
is governed by the Electricity at Work Regulations 1989, 
which supersede the former Electricity (Factories Act) 
Special Regulations 1908 and 1944. 

UK standards on electrical equipment include: BS 2771: 
1986- Electrical Equipment for Industrial Machines, 
replacing BS CP 1015:1967; BS 4683:1971- Specification 
of Electrical Apparatus for Use in Explosive Atmospheres; 
BS 5345:1977- Code of Practice for the Selection, Instal¬ 
lation and Maintenance of Electrical Apparatus for Use in 
Potentially Explosive Atmospheres (other than Mining 
Applications or Explosive Processing or Manufacture); BS 
5501:1977- Electrical Apparatus for Potentially Explosive 
Atmospheres, replacing BS CP 1003; and BS 7430: 1991 
Code of Practice for Earthing, replacing BS CP 1013:1965. 
Relevant UK codes of practice include the IP Electrical 
Safety Code (1991 MCSP Pt 1) and the IP Area Classifica¬ 
tion Code for Petroleum Installations (1990 MCSP Pt 15). 
The ICI Electrical Installations in Flammable Atmospheres 
Code (ICI/RoSPA, 1972IS/91) has also been widely quoted 
in the safety and loss prevention literature. 

Relevant US codes are: NFPA 70: 1993 National Elec¬ 
trical Code; API RP 540:1991 Recommended Practice for 
Electrical Installations in Petroleum Processing Plants; 
and API RP 500:1991 Recommended Practice for Classifi¬ 
cation of Locations for Electrical Installations at Petroleum 
Facilities, replacing API RP 500A, 500B and 500C. 

Safety aspects of electricity and electrical equipment are 
dealt with in Electrical Safety (Swann, 1959), Electrical Safety 


Engineering (Fordham Cooper, 1986) and Hazard of Elec¬ 
tricity by theAmerican Oil Company (Amoco) (Amoco/5). 

Electrical power in a chemical works may be provided 
from the National Grid or from a power station within the 
works. Since steam is also required, a large works usually 
has its own power station. There are frequently mutual 
back-up arrangements between the Grid and the works 
station. 

On some processes loss of electrical power for machinery 
can be serious. This applies particularly where materials 
may solidify in the plant, liquefied gases may warm up and 
vaporize, and refractories may cool and collapse. It may be 
necessary in such situations to provide a stand-by power 
supply. This may be done by setting up mutual back-up 
arrangements, by providing stand-by generators, or by 
installing engine-driven equipment and/or batteries. 

Fluctuations of power supply in the form of voltage dips 
and outages can also occur and cause motors to cut out, 
which may result in process upsets. Time delay relays are 
available which can be used to overcome brief fluctuations. 

It is particularly important to ensure the removal of heat 
from the process, as heat exchange depends primarily on 
the continued operation of pumps, both those for the pro¬ 
cess fluid and those for the cooling water. The fans of air¬ 
cooled heat exchangers are also dependent on electrical 
power. The fans on fired heaters are important. Loss of 
power on these fans can lead to the formation of a flam¬ 
mable atmosphere. 

In order to maintain power supply to essential equip¬ 
ment when partial loss of generating capacity occurs, 
it may be necessary to practice load shedding on other 
equipment. Load may be shed automatically, using load 
shedding relays which detect deterioration of the supply 
frequency and operate to shed the load according to a pre¬ 
arranged sequence. 

Where electric motors are used to drive pumps, it is not 
uncommon for sudden overloads to occur on a pump and for 
the motor overload protection to cut the motor out. This 
situation tends to occur particularly during a transient 
condition such as the loss of one pump in a set. In con¬ 
sequence, the reliability of the redundant pumps is not 
always as good as theoretical reliability predictions sug¬ 
gest. It is necessary, therefore, to give careful consideration 
to possible causes of pump overload. 

Electrical apparatus is a potential source of ignition. It is 
essential, therefore, to have a system of electrical area 
classification and to use appropriate equipment in each 
zone. This is a most important aspect and it is considered in 
Chapters 10,16 and 22 in relation to plant layout, fire and 
storage, respectively. 

Stray electrical currents may also be a problem. They can 
cause corrosion and can act as sources of ignition. The 
power supplies to instruments as well as to machinery 
should be such as not to constitute a source of ignition. 


11.10.3 Electricity: uninterrupted power supplies 

Instrumentation requires a power supply of high quality 
Voltage fluctuations, for example, can cause upsets to pro¬ 
cess computers and programmable electronic systems and 
to some instrumentation. It is often necessary to provide 
for such equipment an uninterrupted power supply (UPS), 
also frequently called an ‘uninterruptible power supply’. 
These terms are used to describe a supply which possesses 
both high reliability and high quality in the sense that it 
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does not have interruptions even for a few milliseconds. 
Designs of UPS system are described in the IChemE Guide. 

The UPS may utilize rotating or static equipment. One 
method of providing a UPS is a motor-alternator set with 
diesel engine back-up, other components of the system 
being an electromagnetic clutch and a flywheel. In normal 
operation, the alternator is driven by the motor. On mains 
failure the diesel engine starts and the clutch engages, 
connecting the engine to the alternator, additional energy 
being supplied by the flywheel until the engine is up to full 
power. 

An alternative method of providing a UPS is a static 
system using batteries. In one arrangement, the AC supply 
passes to the load via a rectifier and an inverter, with the 
batteries connected between these two. This design is 
intended to ensure that in normal operation the batteries 
are kept charged and that on mains failure the batteries 
maintain the supply. A further discussion of UPSs is given 
in the CCPS Safe Automation Guidelines (1993/14). 

11.10.4 Electricity: electrical heating 

Electricity may also be used for electrical heating, or elec¬ 
troheat. Although the efficiency of electrical heating is 
limited by thermodynamics, this factor may be more than 
offset by the ability of electroheat systems to deliver heat 
with greater flexibility and precision. Types of electrical 
heating include immersion heating, resistance heating of 
pipes, induction heating of vessel walls, and the various 
forms of surface heating using jackets, mantles, panels, 
tapes, etc. An account is given in the IChemE Guide. Elec¬ 
trical heating is also used instead of a fired heater in 
smaller heat transfer fluid systems. 


11.10.5 Fuels 

Process units use both gaseous fuels such as LPG and 
liquid fuels in the form of fuel oil. Fuel gas is often available 
as part of an integrated process, as in a refinery, but it is 
proper to treat it as a utility. Atypical fuel gas supply sys¬ 
tem is illustrated in Figure 11.11, which shows supplies 
taken from a primary process source, a secondary source 
and an LPG vaporizer. 

Fuel oil is used in burners on the process, in boilers and 
in fired heaters. The heavier fuel oils are cheaper but are 
viscous and require heated storage and preheaters so that 
for smaller systems it is often more economic to use light 
fuel oils. 

11.10.6 Steam 

Steam is used for: (1) machinery, (2) heating, (3) process, 
(4) purging and inerting and (5) snuffing. Steam may pro¬ 
vide motive power in steam turbines and also in ejectors. 
It is extensively used for heating. It may be injected directly 
into the process as in operations such as steam stripping. 
It is a principal fluid used for purging and cleaning opera¬ 
tions. It is used as a means of snuffing out the flame in fired 
heaters. 

The main source of steam is usually the works power 
station, but there may be process sources such as waste 
heat boilers or chemical reactors. On smaller works steam 
may be supplied by boilers. 

Steam systems are described in The Efficient Use of 
Steam (Lyle, 1947), Industrial Boilers (Gunn and Horton, 
1989) and Steam, Its Generation and Use (Babcock and 
Wilcox, 1993). Hazards are reviewed in Hazards of Steam by 
the American Oil Company (Amoco/6). 



Figure 11.11 Schematic diagram of a composite gaseous fuel supply system (Broughton, 1993). FIC, flow indicator 
controller; L/C, level indicator controller; PIC, pressure indicator controller (Courtesy of the Institution of Chemical 
Engineers) 
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An overview of the boiler house on a process plant site is 
given in the IChemE Guide, which describes the common 
types of boilers and burners and the ancillary plant 
required, and gives a checklist for boiler selection. 

Boilers are either shell boilers or water-tube boilers. In 
fire-tube boilers, the water is in the shell, the hot gases are 
burned in a combustion chamber inside the shell and then 
pass through the fire tubes, giving up more of their heat. 
In one arrangement, the boiler is set in brickwork, the 
Lancashire and Cornish boilers being early workhorses of 
this type with single and double internal flues, respectively 
The economic boiler, by contrast, is self-contained. Pack¬ 
age fire-tube boilers are widely used. Electrical boilers are 
of two types. One is heated by an immersion element akin to 
that used in domestic systems. The electrode boiler is 
heated by passage of current directly through the water 
between immersed electrodes. Both types come as package 
units. Finally, water-tube boilers are available in a variety 
of designs and in sizes from package units to the large-field 
assembled units used in power stations. 

All boilers, including waste heat boilers, require feed 
water treated to prevent scaling. The feed water and boiler 
water qualities required for different steam pressures are 
listed in the IChemE Guide. Boiler feed water treatment is 
an important aspect of boiler operation. The reliability of 
the feedwater treatment plant, including the feedwater 
pumps, is therefore an issue. 

The quantities of steam needed for purging can be large. 
It is necessary, therefore, to provide for this requirement, 
otherwise there may be a tendency to use insufficient steam 
in purging operations. 

As with electrical power, it may be necessary to practice 
load shedding to protect the supply of steam to essential 
equipment on loss of part of the generating capacity. 

Where there is a set of boilers and some are lost, the 
resultant demand on the remaining boilers is liable to cause 
fan overload and loss of these boilers also. A limit control 
system may be used to prevent such overload. 

Loss of steam can normally be tolerated and it is not 
usual to have a stand-by steam supply. The steam system 
has some capacity, however, and can usually supply steam 
for a period. For more critical units, the period can be pro¬ 
longed if steam to other units is cut off. 

It is appropriate, however, to consider the effect on a unit 
if the heating steam is lost. The resultant cooling may lead 
to condensation of vapours and to underpressure of the 
unit, and it may be necessary to provide nitrogen injection 
to counteract this. 

Steam from the main boilers, and any waste heat boilers, 
is distributed to user plants, by a distribution system which 
may provide steam at low, intermediate and high pressure, 
pressure being let down at let-down stations. 

A serious hazard in steam systems is water hammer. 
A slug of condensate which has collected in the main may 
be flung by the steam against the pipework with a very 
destructive effect. 

Steam distribution systems should be designed to effect 
efficient drainage of condensate. This means that: the lines 
should be sloped; drainage points should placed at suitable 
locations and provided with drain pockets so that the con¬ 
densate collects and does not skim over the top of the drain 
point; and efficient steam traps should be installed for 
take-off of the condensate. 

Guidance on steam traps is given in Steam and Steam 
Trappingby Spirax-Sarco Ltd (1993). Further treatments of 


the design and operation of steam distribution systems, 
with particular reference to the avoidance of condensate 
hammer, are given in Chapters 12 and 20, respectively. 

Erosion is a common feature in steam systems. Steam can 
be a surprisingly erosive fluid, especially if it is wet. 

Leaking steam can cause a build-up of static electricity 
and can thus constitute a source of ignition. This possibil¬ 
ity should be considered where leaks of flammable vapours 
may also be present. 

Air may be present in a steam system on start-up and 
manual vents located at high points should be provided to 
allow it to be removed. The IChemE Guide suggests this 
should be the limit of the problem. 

In some cases, as discussed by Plummer (1986), the pres¬ 
ence of air and other gases in steam does cause operating 
problems and needs to be addressed. There are various 
sources of air or other gas in plant. Air dissolved in the 
boiler feedwater may not be completely removed by 
deaeration. Chemical reactions in the boiler, such as the 
release of carbon dioxide from bicarbonates, can generate 
gas. Air may be drawn into spaces where steam is conden¬ 
sing at a pressure below atmospheric. 

These permanent gases can then create problems. Tem¬ 
perature control is often based on pressure control and if, 
due to the presence of gas, the relation between pressure 
and temperature departs from the value corresponding to 
the steam tables, control is upset. Heat transfer across heat 
exchange surfaces may deteriorate due to blanketing of 
these surfaces by gas. Corrosion may be promoted by the 
presence of oxygen or carbon dioxide. 

Unwanted gas may be removed by suitable venting. Vent 
valves are available which operate on temperature, opening 
when the temperature is below saturation and seating when 
saturation temperature is reached. Points where such 
valves may be located are at the boiler, at remote ends of 
lines, upstream of isolation valves and on heat exchangers. 

11.10.7 Compressed air: plant air 

Compressed air is required on process plants as plant air 
for general applications, instrument air, breathing air and 
process air. General applications include purging and 
driving pneumatic tools. 

Typically plant air is filtered, compressed to 6-7 barg 
and then cooled in a heat exchanger with condensation of 
water, but is not dried. The air enters an air receiver which 
supplies the service stations on the compressed air main. 
Compressed air, therefore, should be free of solid matter but 
contains some oil and is saturated with water. 

The demand for plant air is subject to large fluctuations 
and the supply shouldbe able to cope with such peaks, but it is 
not generally necessary to install stand-by compressors. 

11.10.8 Compressed air: instrument air 

The requirements for instrument air are somewhat differ¬ 
ent. Instrument air needs to be dry and its supply reliable. 
It is important that the instrument air be of good quality 
and, in particular, that it be free from solids, oil and water. 
Dirty, oily or wet air is liable to cause instrument error and 
failure. It follows that it is not good practice to use ordinary 
plant air for instrumentation. 

The IChemE Guide states that instrument air should be 
free of solids, oil, corrosive substances and noxious gases. 
The solids content should be less than 0.1 g/N/m 3 
with particle sizes less than 3 pm. With regard to dryness, 
the Guide quotes the requirement for a dewpoint of -40°C 
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frequently suggested for UK sites, but adds that this can 
reduce the flexibility of vendor packages and proposes that 
for temperate climates such as those of central and south¬ 
ern Europe a dewpoint 10°C below the minimum ambient 
temperature suffices.The compressors used for instrument 
air should be of the oil-free type. 

Instrument air is typically supplied at about 7 barg from 
an air receiver. The Guide states that a pressure of 4 barg is 
the minimum for satisfactory operation of the instru¬ 
mentation and that it should not be allowed to fall below 
this. The supply needs to be adequate to cope with fluctua¬ 
tions. The Guide gives typical air consumption figures for 
instrumentation. 

In most applications, the instrument air supply 
should have high reliability, which will normally mean the 
provision of stand-by equipment, separate power sources, 
and so on. 

Avoidance of contamination, discussed in Section 
11.10.18, is particularly important for instrument air. Con¬ 
nection of another system to the instrument air system 
creates the possibility of such contamination. It was con¬ 
tamination of the instrument air which initiated the train of 
events at Three Mile Island, as described in Appendix 21. 

11.10.9 Compressed air: breathing air 

If the extent of use of air-supplied breathing apparatus 
justifies it, a dedicated supply of air may be provided for 
breathing. This is considered in Chapter 25. 

11.10.10 Compressed air: process air 

Many processes use air as a raw material. Such air is 
usually obtained by compression of atmospheric air. Gen¬ 
erally loss of process air is not critical and special measures 
are usually not required to ensure security of supply. 

Air drawn by the process air compressors necessarily 
comes from some point in the works. There may be a degree 
of contamination due to leaks from plants, and in some cases 
the impurities may have an adverse effect on the process. 

Hazards can arise from the build-up of oil from the com¬ 
pressors in the process air lines. Hazards are reviewed in 
Hazards of Air by the American Oil Company (Amoco/2). 

11.10.11 Inert gas 

The inert gases used in the process industries are mainly 
nitrogen and carbon dioxide. Alternatively, flue gas from an 
inert gas generator may be used. The inert gas principally 
considered here is nitrogen. This is described in Nitrogen 
for Industry (Sittig, 1966) and in the IChemE Guide. 

Nitrogen is used for a large number of purposes. These 
include: (1) inerting, (2) process, (3) purging and (4) pres¬ 
surizing. One main use of nitrogen is inerting. Inert 
atmospheres are often required in processes such as poly¬ 
merization, catalyst preparation and drier regeneration, 
and in plant such as centrifuges and storage tanks. Storage 
tank atmospheres are frequently inerted with nitrogen. 

Nitrogen has a number of process uses. In particular, 
it may be used to dilute the concentration of a reactant such 
as oxygen in an oxidation process. In high pressure pro¬ 
cesses the use of nitrogen permits the use of such pressures 
while limiting the partial pressure of oxygen. 

Another use of nitrogen is as a purge gas. Purging of 
equipment is discussed in Chapters 16,20 and 21 in relation 
to fire protection, plant operation and maintenance, 
respectively. Where purging is carried out to prevent entry 
of flammable gases into equipment which may spark, 


nitrogen is not always the most suitable gas to use. Often 
air is both cheaper and safer. The choice of purge gas for 
such applications is considered further in Chapter 16. 

There are certain situations which can lead to the plant 
being underpressured so that it may collapse inwards. This 
may be countered by nitrogen injection. Another applica¬ 
tion of pressurizing is the use of nitrogen pressure to 
transfer liquids in order to avoid having to pump them. 

The quality of the nitrogen required depends on the 
application. The IChemE Guide distinguishes between gen¬ 
eral purging (GP) nitrogen and high purity inert medium 
(HPIM) nitrogen. Supplies of nitrogen may be obtained from 
gas cylinders or ammonia dissociation; from an inert gas 
generator in which nitrogen is obtained from combustion of 
air and removal of other products of combustion; from air 
separation by pressure swing adsorption (PSA); from air 
separation by permeation through a membrane; from bulk 
gas or liquid storage or gas pipeline; or from a low tem¬ 
perature air separation plant on site. Cylinders are economic 
only for very small quantities and a low temperature air 
separation plant only for very large ones. 

The choice of nitrogen supply method is discussed in the 
Guide. It is essentially a function of the purity and scale. 
A breakpoint occurs at a demand of about 300 Nm 3 /h. 
Broadly, the Guide indicates that the demands below this 
can be met using a liquid nitrogen storage/vaporizer sys¬ 
tem and those above using a low temperature separation 
plant, with PSA and membrane methods an option for 
smaller demands of GP nitrogen. Thus, in contrast to the 
other services nitrogen is not always generated on site. 
Instead, it may be brought in and held in storage. In this 
case, it is essential to have a sufficient supply. 

The Flixborough Inquiry revealed that the nitrogen 
required for inerting on the plant was sometimes in short 
supply and that as a result routine procedures were inter¬ 
rupted. The Flixborough Report drew attention to the 
importance of ensuring an adequate supply of nitrogen 
when plant safety is dependent on it. 

11.10.12 Water: cooling water 

Cooling water in the process industries is provided using 
one of three basic systems. One is the ‘once-through’ sys¬ 
tem, which is self-explanatory. The other two involve 
recirculation, either in an open system in which the water is 
cooled in cooling towers, or in a closed system in which it 
is cooled in heat exchangers using another fluid. The use of 
cooling towers is the normal method except where the site 
is such as to allow the once-through use of river or seawater. 

Other cooling facilities may be provided by air-cooled 
heat exchangers, which depend on electric fans for air 
circulation. 

Since it is essential to assure removal of heat from 
the process, the security of the cooling water supply is 
important. This may be achieved by making sure that the 
power supply is secure, by providing stand-by pumping 
arrangements and/or by the use of head tanks. 

It is not good practice to use cooling water as fire water, 
as this may result in the loss of ability to ensure essential 
heat removal from process units. The cooling water system 
should be operated so that corrosion of process equipment 
by cooling water is kept to a minimum. 

11.10.13 Water: process water 

Water is an important raw material for many processes. It is 
usually taken from the public water supply or from company 
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sources such as reservoirs and springs. Generally, loss of 
process water is not serious and a stand-by supply is usually 
not necessary. High security may be needed, however, for the 
boiler feedwater supply. The water purity required depends 
upon the process. In some cases, special purification plant 
may be needed. Such purification is necessary in particular 
for boiler feedwater. It is not good practice to draw the 
process water from the cooling water system. 

Hazards are reviewed in Hazard of Water by the American 
Oil Company (Amoco/1). 

11.10.14 Water: hot water 

A supply of hot water may be required for washing down 
plants. If this is generated by direct mixing of water and 
steam, a specially designed mixing nozzle system should 
be used which shuts off on loss of cold water. The water 
temperature should be controlled at a temperature which 
will not injure personnel using it. A water temperature 
exceeding 57°C can give first degree burns. 

11.10.15 Water: firewater 

The provision of fire water is treated in Chapters 10 and 16 
in relation to plant layout and fire protection, respectively. 

11.10.16 Heat transfer media: hot fluids 

In addition to steam and cooling water, use may be made of 
other heat transfer fluids (HTFs) for heating or cooling. HTF, 
or thermal fluid, systems are used to supply heat to process 
fluids at temperatures up to about 300°C. Such HTF systems 
exhibit a number of problems which need to he addressed if 
they are to operate satisfactorily. Accounts are given in the 
IChemE Guide and the CCPS Engineering Design Guidelines ; 
both devote a complete chapter to these systems. 

The HTFs used are mainly mineral oils, synthetic aro¬ 
matics, diphenyl-diphenyl oxide mixtures and silicones. 
Examples of mineral oils are BP’sTranscal 65; of synthetic 
aromatics, Dew’s Dowtherm Q and BP’s Transcal SA; of 
diphenyl—diphenyl oxide mixtures, Dow’s Dowtherm A 
and ICI’sThermex; and of silicone, Dow’s Syltherm 800. 

An HTF generally has a boiling point in the range 
260-340°C, a maximum fluid temperature of 350°C and a 
vapour pressure at the operating temperature of 1-2 barg. 
Many are subject to autoignition on escape to atmosphere. 

Since the fluid circulates continuously, it is subject to 
degradation, minimization of which is an important feature 
of the design and operation of HTF systems. 

A typical HTF system consists of a heater, heat exchan¬ 
gers to transfer heat to the process fluid(s), a storage reser¬ 
voir and an expanse tank. The storage vessel may double as 
a discharge vessel or there may be a separate discharge 
vessel. There may be an emergency cooler. Flow diagrams of 
HTF systems are given in the IChemE Guide and the CCPS 
Guidelines. 

The heat input is provided by a heater, except for smaller 
units where electrical heating is used. It follows that an 
HTF system is subject to the various problems of fired 
heaters and that the precautions applicable to fired heaters 
in general, described in Chapter 12, are required for those 
in HTF systems. They include on the heater tubes trips on 
high temperature and low flow. 

In contrast to most fired heaters, the fluid in an HTF sys¬ 
tem is recirculated. The conditions created by this combi¬ 
nation of fired heating and recirculation are severe and 
fluid degradation is characteristic of HTF systems. One 
consequence can be coking and plugging of the heater tubes. 


Heat transfer fluids tend to be ‘searching’ and HTF plants 
have a history of leaks, particularly at flanges. Ignition 
occurs where the leaking fluid is above its autognition 
temperature. Another problem due to leaks is saturation of 
the lagging, resulting in lagging fires. 

Pressure relief valves on HTF systems have not always 
been well located, so that fluid has been discharged and has 
then found a source of ignition. Experience also shows that 
both out-leak of the HFT and in-leak of another fluid may 
occur. Precautions include the installation of a low level trip 
and a high level alarm on the expanse tank. 

The need for security of supply of the hot fluid varies. A 
reliable system may be necessary, for example, in an appli¬ 
cation where heat is required to prevent a process fluid 
going solid in the plant. 

11.10.17 Heat transfer media: refrigerants 

Refrigerants are used to cool process fluids to temperatures 
lower than those achievable using cooling water. Accounts of 
refrigeration are given in th e ASHRAE Refrigeration Hand¬ 
book by the American Society of Heating, Refrigerating and 
Air-conditioning Engineers (ASHRAE, 1990/3). Other rele¬ 
vant ASHRAE publications are the ASHRAE Thermo¬ 
dynamic Properties of Refrigerants (ASHRAE/2) and the 
ASHRAE Handbook of Fundamentals (ASHRAE, 1993/7). 

Basic methods of obtaining refrigeration are Joule— 
Thomson expansion, work expansion, evaporation refrig¬ 
eration and absorption refrigeration. Joule-Thomson and 
work expansion may be used within the process to effect 
direct cooling of process fluids. Evaporation and absorp¬ 
tion refrigeration sets are used to provide indirect cooling. 

A variety of refrigerants are available, including: 
ammonia (R717); carbon dioxide; ethylene (R170), ethane 
(R1150), propylene (R1270) and propane (R290); and 
chlorofluorohydrocarbons (CFCs) such as dichlorodi- 
fluoromethane (R12) and chlordifluoromethane (R22). 
In selecting a refrigerant it is necessary to consider the 
general properties, the safety features and the environ¬ 
mental features. 

Relevant general properties are the normal boiling point 
and refrigerant service temperature, the latent heat and the 
coefficient of performance (COP). Safety features include 
flammability and toxicity, in conjunction with the inven¬ 
tory required. The main environmental feature is the ozone 
depletion potential. 

The replacement of materials with noxious properties 
such as ammonia (toxic) and ethylene (flammable) with 
non-toxic, non-flammable CFCs has been arrested by the 
environmental harm which the latter cause. The production 
and use of CFCs is restricted by the Montreal Protocols. 
New refrigerants to replace CFCs comprise an active area of 
development. 

In some applications it may be necessary to consider 
other properties of the refrigerant, such as its interaction 
with the process fluid in the event of a pinhole leak. 

A summary of general and environmental properties of 
refrigerants is given in the IChemE Guide and more 
detailed information in the ASHRAE handbooks. These 
publications also deal with refrigeration cycles and with 
package refrigeration sets. 

Use is sometimes made in the process industries of 
systems in which a refrigerated heat transfer fluid is cir¬ 
culated between a refrigeration set and the process. A 
typical refrigerated fluid used in such applications is 
ethylene glycol. 
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11.10.18 Contamination hazards 

Many of the services described are fluids. Hazards can 
arise from contamination of process materials by service 
fluids or contamination of service fluids by process 
materials. The contamination may occur through pipes and 
valves or by leakage in equipment. 

Accidental entry of water, including steam, into the plant 
can have serious consequences. The water may vaporize, 
giving a large increase in pressure, or it may cause an 
oil-water ‘slopover’. It may react violently with the process 
materials, it may ruin catalysts or adsorbents, it may give 
rise to very rapid corrosion and it may freeze and cause 
blockages. With accidental air ingress the main hazard is 
the formation of a flammable mixture. 

In order to prevent unwanted entry of water and air into 
the plant through the pipework, it is necessary to provide 
positive isolation. This may require the use of double block 
and bleed valves rather than single valves. There need to be 
equally effective measures to prevent operational errors. 

Contamination can also occur due to leakage of equip¬ 
ment. In particular, steam vaporizers and reboilers 
often develop pinhole leaks. If the consequences of such a 
leak might be serious, consideration should be given to the 
use of an alternative means of heating such as a heat 
transfer fluid. 

The entry of process materials into lines carrying service 
fluids can have equally serious results. Toxic materials may 
enter the water supply, flammable vapours may pass into 
the air lines, or air may get into the nitrogen supply. In all 
these cases the hazard is obvious. It is essential, therefore, 
to check whether flow reversals into the service fluids 
could occur which might create a hazardous situation and 
to take any appropriate measures. 

There is a particular obligation to ensure that the public 
water supply is not contaminated. If water is drawn from 
this for process use, positive means such as a break tank 
should be provided to prevent backflow and possible 
contamination. 

11.11 Particular Chemicals 

Accounts of the properties, manufacture and use of 
chemicals are given in the Kirk-Othmer Encyclopaedia of 
Chemical Technology (Kirk and Othmer, 1963-, 1978-, 
1991-) and in Ullmann’s Encyclopaedia of Chemical Techno¬ 
logy (Ullmann, 1969-, 1985-). Selected references on parti¬ 
cular chemicals and their hazards are given inlhble 11.8. 

The number of chemicals used in the process industries 
is very large. The few principal chemicals considered here 
are selected because they are important in their own right 
and because they illustrate the type of factors which have to 
be taken into account. The chemicals are: 

(1) hydrocarbons; 

(2) acetylene; 

(3) acrylonitrile; 

(4) ammonia; 

(5) chlorine; 

(6) ethylene dichloride; 

(7) ethylene oxide; 

(8) hydrogen; 

(9) hydrogen fluoride; 

(10) oxygen; 

(11) phosgene; 

(12) vinyl chloride. 


Table 11.8 Selected references on particular 
chemicals and their hazards 


Notes: (a) The former Manufacturing Chemists 
Association (MCA) SD series, given in the first edition of 
this book, is not included. (b)The FPA Compendium of 
Fire Safety Data, vol.4, H series is denoted by the H number, 
(c) Company materials safety data sheets are now a much 
improved source of detailed information. 

General 

Cloyd and Murphy (1965); DOT, CG (1974a,b); Goldfarb 
etal. (1981); Chissick etal. (1984); Keith and Walters (1985-); 
H.H. Fawcett (1988); Spitz (1988); Agam (1994) 

Air sensitive compounds 

Shriver (1969) 

Acetaldehyde 

Gemmill (1961a); Jira, Blau and Grimm (1976); Goldfarb 
etal. (1981); FPA (1986 H29) 

Acetic acid 

Claydon (1967); Ellwood (1969a); Schwerdtel (1970); Lowry 
and Aguilo (1974); Goldfarb etal. (1981); Aquilo etal. (1983); 
FPA (1988 H120) 

Acetylene 

Reppe (1952); Penny (1956); H. Watts (1956); Sargent (1957); 
Chemical Engineering Staff (1960); S.A. Miller and Penny 
(1960); S.A. Miller (1964); Hardie (1965); Mayes and Yallop 
(1965); Kamptner, Krause and Schilken (1966a); Stobaugh 
(1966a);Tedeschi etal. (1967); Zieger (1969); CGA (1970 
G-1.3,1990 G-l.l, SB-4); Schmidt (1971); Carver, Smith 
and Webster (1972); Sutherland andWegert (1973); Holman, 
Rokstad and Solbakken (1976-); NIOSH (1976 Crit. Doc. 76- 
195); Stork, Hanisian and Bac (1976); Anon. (1978a); 
Manyik (1978); Tedeschi (1982); P.J.T. Morris (1983); Passler 
etal. (1985); FPA (1987 H6); Ashmore (1988 LPB 88); Hort 
and Taylor (1991); Conrad, Dietlen and Schendler (1992) 

Acetylenic alcohol 

Lorentz (1967,1973) 

Acids and alkalis 

Anon. (1977 LPB 16, p. 3) 

Acrylic acid 

FPA (1986 H95); Levy (1987) 

Acrylic monomers 

Kirch et al. (1988) 

Acrylonitrile 

Guccione (1965a); S.G.M. Clark and Camirand (1971); 
Dalin, Kolchin and Serebryakov (1971); Caporali (1972); 
Pujado, Vora and Krueding (1977); CIA (1978 PAH); 

CIHSC (1978/4); NIOSH (1978 Crit. Doc. 78-116); 

Langveldt (1985); FPA (1986 H51); Brazdil (1991) 

Air (see Table 11.10) 

Alcohols 

Courty etal. (1984); FPA (1986 H2) 

Aluminium alkyls 

Heck and Johnson (1962); Governale, Ruhlin and 
Silvus (1965); Albright (1967f); Schmit etal. (1978) 
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Ammonia (see alsoTables 11.11,18.1,18.2, 22.1 
and 23.1) 

American Oil Company. (n.d./9); Slack and James (1973); 
NIOSH (1974 Crit. Doc. 74-136); CIA (1975/8,11, PA1,1988 
PA9,1990 RC3); Blanken (1978); HSE (1978b, 1981a); 
Strelzoff (1981); CGA (1984 G-2,1989 G-2.1,TB-2); 
Bakemeier et al. (1985); FPA (1987 HIS); Kletz (1988a) 

Ammonium nitrate (see alsoTable 11.11) 

American Oil Company. (n.d./9); Burns et al. (1953 BM RI 
5476); Sykes, Johnson and Hainer (1963); van Dolah et al. 
(1966 BM RI 6773); Watchorn (1966); HSE (1978b, 1981a); 
Keleti (1985); Zapp (1985); FPA (1987 H33); FMA (1989); 
NFPA (1990 NFC 490); ACDS (1991); Miyake and Ogawa 
(1992); Weston (1992) 

Ammonium perchlorate 
Bond (1990 LPB 93) 

Aniline 

HSE (TON 10,1979 EH 4); Cans (1976b); FPA (1986 H80) 

HSE(1975 TON 6,1990 EH11) 

Asbestos (see Tables 18.1 and 25.1) 

Benzene 

Stobaugh (1965a); Remirez (1968b); Ockerbloom (1972); 
Hancock (1975); NIOSH (1976 Crit. Doc. 137); Kohn (1978c); 
Cheremisinoff and Morresi (1979); CIA (1980 PAS); Malow 
(1980); HSE (1982 TR4); FPA (1986 HIS) 

Bischloromethyl ether 
Ress (1982) 

Bitumen 

Swindells, Nolan and Pratt (1986); IP (1990 MCSP Pt 11) 

Bromine 

Jolles (1966); FPA (1986 H61); CIA (1989 RC4) 

Butadiene 

D. A. Scott (1940); Stobaugh (1967a); FPA (1987 H63); 

Glass (1987) 

Calcium hypochlorite 

VJ. Clancey (1975b,c, 1975/76,1987); Uehara, Uematsu and 
Saito (1978); FPA (1987 H46) 

Caprolactam 
H.F. Steward (1974) 

Carbon dioxide 
CGA (1984 G-6,1985 G-6.2) 

Carbon disulfide 

Thacker (1970); NIOSH (1977 Crit. Doc. 77-152); 

HSE (1981SHW 932,TR3); FPA (1986 H43) 

Carbon monoxide 

HSE (HSW Booklet 29); NIOSH (1972 Crit. Doc. 73 -110); 
Anon. (1975a); Ribovitch, Murphy and Watson (1977); 

FPA (1987 H57); CGA (1989 P-13) 

Chlorine (see alsoTables 18.1,18.2, 22.1 and 23.1) 
Chlorine Institute (Appendix 27, 28,1971BIBLL, 1986 
Pamphlet 1); DoEm (Det. Booklet 10); HSE (HSW Booklet 
37,1978b); Brian,Vivian and Habib (1962); Johnsen and 
Yahnke (1962,1973); Payne (1964); Brian,Vivian and Piazza 
(1966); de Nora and Gallone (1968); WW. Lawrence and 
Cook (1970); Sconce (1972); Statesir (1973); BCISC (1975/1); 


NIOSH (1976 Crit. Doc. 76-110); H.E. Schwarz (1976); CIA 
(1980/10,1986 PA 48); Meinhardt (1981); HSE (1986 HS(G) 
28); Schmittinger (1986); FPA (1987 H39); J.L. Woodward 
and Silvestro (1988); CIA, Chlorine Sector Group (1989); 
Gustin (1989a); Klug (1989); Somerville (1990); Anon. (1991 
LPB 98, p. 25); Curlin, Bommaraja and Hansson (1991) 
Nitrogen trichloride: Chlorine Institute (1975 MIR-2) 
Chlorine dioxide 
Cowley (1993 LPB 113) 

Chloromethanes 

Akiyama, Hisamoto and Mochizuki (1981); FPA (1986 H68) 

Cryogenic gases 

Blakey (1981); Williamson and Edeskuty (1984) 

Cyanuric chloride 
Anon. (1979 LPB 25, p. 19) 

Cyclohexane 

Haines (1962); Dufau et al (1964); Stobaugh (1965b); 
Berezin, Denisov and Emmanuel (1966); Alagy etal. (1968); 
Ishimoto, Sasano and Kawamura (1968); Craig (1970); 
Taverna and Chiti (1970); Alagy, Trambouze and van 
Landeghem (1974); Dragoset (1976); McCorkle (1980); 
Ciborowski and Krysztoforski (1981); FPA (1986 H25); 
Krysztoforski etal. (1986); Krysztoforski etal. (1992) 

Diethyl ether 

Redeker and Schebsdat (1977) 

Dimethylsulfate 

Anon. (1979 LPB 25, p. 24) 

Dimethylsulfoxide (DMSO) 

Gostelow (1983); Hall (1993 LPB 114) 

Dimethylterephthalate (DMT) 

Ueda (1980) 

Ethyl acetate 
Bond (1994 LPB 119) 

Ethylene 

Stobaugh (1966c); WW. Lawrence and Cook (1967); 

S. A. Miller (1969); Strelzoff (1970); Fiumara and Cardillo 
(1976); MITI (1976); Ribovitch, Murphy and Watson (1977); 
Kniel,Winter and Chung-HuTsai (1980); Kniel,Winter and 
Stork (1980); Pike (1981);Tayler (1984a); C. Britton, Taylor 
and Wobser (1986); FPA (1987 H17); Glass (1987); Granton 
and Roger (1987) 

Ethylene cyanide 

Berthold and Loffler (1983) 

Ethylene dichloride 

CIA (1975 PA13); CISHC (1975/1); VL. Stevens (1979); 
McNaughton (1983); FPA (1986 H77); Rossberg etal. (1986) 

Ethylene oxide 

Burgoyne and Burden (1948,1949); Burden and Burgoyne 
(1949); Burgoyne and Cox (1953); Burgoyne, Bett and Muir 
(I960); Burgoyne, Bett and Lee (1967); Troyan and Levine 
(1968); Ray, Spinek and Stobaugh (1970); CISHC (1975/2); 
de Maglie (1976); Cans and Ozero (1976); S.C. Johnson 
(1976); Kiguchi, Kumazawa and Nakai (1976); NIOSH 
(1978 Crit. Doc. 77-200); CIA (1979 RC14); Kuhn (1979, 
1980b); Cause etal. (1980); Pesetsky and Best (1980); 
Pesetsky, Cawse and Vyn (1980); Chen and Faeth (1981b); 
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Ozero and Procelli (1984); FPA (1987 H79); Rebsdat and 
Mayer (1987); Kletz (1988m); de Groot and Heemskerk 
(1989); Siwek and Rosenberg (1989); Britton (1990b); 
Brockwell (1990); Grumbles (1990); June and Dye (1990); 
Conrad, Diellen and Schendler (1992); Ondrey (1992) 

Fluorine 

McGuffy, Paluzelle and Muldrew (1962) 

Formaldehyde 

NIOSH (1976 Crit. Doc. 77-126); HSE (1981TR2); CIA (1983 
PA21); Clary, Gibson and Waritz (1983); Dunn etal. (1983); 
FPA (1986 H54) 

Formic acid 

Aguido and Horlenko (1980); Czaikowski and Bayne (1980); 
Anon. (1984 LPB 56, p. 24); FPA (1986 H86) 

Grignard reagents 

Rakita, Aultman and Stapleton (1990) 

Halogenated hydrocarbons 

Santon and Wrightson (1989) 

Hydrocarbons 

WHO (EHC20);Wade (1963); Stobaugh (1966b); A. Brown 
(1964); Burgoyne (1965b); ICI/RoSPA (1970IS/74); Binns 
(1978); Boesinger, Nielsen and Albright (1980); Maisel 
(1980); IP (1991 PUB 60,61); API (1983/6) 

Hydrogen 

American Oil Company (n.d./9); Cronan (1960a); 

G.R. James (1960); Labine (1960); G.J. Lewis (1961); Vander 
Arend (1961); Zabetakis and Burgess (BM1961RI5707); 
Zabetakis, Furno and Perlee (BM 1963 RI 6309); R.B. Scott, 
Denton and Nicholls (1964); Reiff (1965); Scharle (1965); 
Stoll (1965); Voogd and Tielrooy (1967); Chopey (1972); CGA 
(1974 G-5,1985 P-6,1990 G-5.3); Anon. (1977 LPB 15, p. 2); 
Anon. (1978 LPB 21, p. 85); K.E. Cox and Williamson (1977); 
Bassett and Natarajan (1980); W.N. Smith and Santangelo 
(1980); Donakowski (1981); Mandelik and Newsome (1981); 
Angus (1984); Mahmood etal. (1984); J.D. Martin (1984); 
Shields, Udengaard and Berzins (1984); FPA (1986 H20); 
Haussinger, Lohmuller and Watson (1989); NFPA (1989 
NFPA 50A, SOB); Johansen, Raghuraman and Hackett 
(1992); Ondrey, Hoffmann and Moore (1992) 

Hydrogen chloride, hydrochloric acid 

BCISC (1975/2); CIA (1975 PA12); HSE (1981BPM 5); 

FPA (1987 H41) 

Hydrogen cyanide 

Koberstein (1973); NIOSH (1976 Crit. Doc. 77-108); 

HSE (1983 SHW 385); FPA (1986 H94) 

Hydrogen fluoride 

Muehlberger (1928); Simons (1931); K.M. Hill and Knott 
(1960); NIOSH (1976 Crit. Doc. 76-143); HSE (1978b, 1980 
BPM 4); Gall (1980); CIA (1987 PAM); Aigueperse etal. 
(1988); G. Parkinson (1990); van Zele and Diener (1990); 
Diener (1991) 

Hydrogen peroxide 

HSE (SIR 19); Schumb, Satterfield and Wentworth (1955); 
Shell Chemical Corp. (1959); Rawsthorne and Williams 
(1961); Monger ef al. (1964); G.A. Campbell and Rutledge 
(1972); Berthold and Loffler (1980); FPA (1987 H3); 
Mackenzie (1990,1991) 


Hydrogen sulfide 

NIOSH (1977 Crit. Doc. 77-158); API (1981RP 55); CGA 
(1981G-12); Maclachlan (1985); FPA (1986 H78) 

Insecticides, pesticides 

Presidents Advisory Committee (1963); Brooks (1974) 

Iron sulfide 

Anon. (1976 LPB 12, p.l) 

Isocyanates 

OSHA (OSHA 2248); Corbett (1963); HSE (1975 TON 41, 
1983 MS 8,1984 EH 16); British Rubber Manufacturers 
Association (1977); NIOSH (1978 Crit. Doc. 78-215); 
Chironna and Voelpel (1983); FPA (1986 H5); CIA 
(1989 RC29) 

Isopropyl nitrate 

Beeley, Griffiths and Gray (1980) 

Lead (see alsoTable 18.1) 

HSE (TON 16); DoE (1974 Poll. Paper 2); NIOSH 
(1978 Crit. Doc. 78-158); IP (1985) 

Lead additives 

Associated Octel Company (Appendix 28, n.d./l); 

HSE (1978b) 

LNG (see Table 11.13) 

LPG (see Table 11.12) 

Maleic anhydride 

Trivedi and Culbertson (1982) 

Mercury 

HSE (1975 TON 21,1977 ED 17); DoE (1976 Poll. Paper 10); 
McAuliffe (1977); D. Taylor (1978); Okouchi and 
Sasaki (1984) 

Methanol 

Ferris (1974); Kugler and Steffgen (1980); Sherwin (1981); 
D.L. King, Ushiba and Whyte (1982); Chang (1983); 

EPA (1986 H42); Fielder et al. (1990) 

Methylmethacrylate 

EPA (1986 H67); Porcelli and Juran (1986) 

Molten salts 

HSE (1971HSW Booklet 27); C.B. Allen and Janz (1980) 

Monomethylamine nitrate 

Miron (1980) 

Naphthalene 

Stobaugh (1966d); EPA (1987 H69) 

NGL 

Collins, Chen and Elliott (1985) 

Nitric acid 

Bingham (1966); van Dolah (1969a); Mandelik and Thrner 
(1977); Bolme and Morton (1980); Calmon (1980); Marvin, 
Leray and Roudier (1980); Ohrui, Ohkubo and Imai (1980); 
Keleti (1985); EPA (1987 H23) 

Nitrogen 

CGA (1980 P-9,1985 G-10.1); Anon. (1984 LPB 59, p. 30); 
Bond (1985 LPB 63); Hempseed (1991 LPB 97) 
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Nitrogen oxides 

NIOSH (1976 Crit. Doc. 76-149); Ribovitch, Murphy and 
Watson (1977); Bretherick (1989 LPB 86); Currie 
(1989LPB88) 

Nitrotoluenes 

G. F.P. Harris, Harrison and Macdermott (1981) 

Organic nitrates 

Reboch (1976) 

Organic peroxides 

ASTM (STP 394); D. A. Scott (1940); National Board of Fire 
Underwriters (1956); Armitage and Strauss (1964); 
Castrantas, Banerjee and Noller (1965); Fine and Gray 
(1967); Bowes (1968); Hupkens van der Elst (1969); Swern 
(1970-); A.G. Davies (1972); Donaldson (1973); Home Office 
(1974/5); Interox Chemicals Ltd (1975); Wagle et d. (1978); 
de Groot, Groothuizen and Verhoeff (1980); de Groot and 
Hupkens van der Elst (1981); McCloskey (1989); Britton 
(1990b);T.A. Roberts, Merrifleld and Tharmalingham 
(1990);Tognotti and Petarca (1992) 

Organic phosphorus compounds 
MacDonald (1960) 

Oxidizing substances 

Uehara and Nakajima (1985) 

Oxygen (see alsoTable 11.10) 

CGA (1980 G-4.4,1983 P-14, SB-2,1985 G-4.1,1987 G4, 
1988 G-4.3); NASA (1972-); HSE (1977a); Newton (1979); 

A. H. Taylor (1981); D. A. Jones (1983); EPA (1987 H12); 
Kirschner (1991) 

Perchlorates 
Schumacher (1960) 

Perchloric acid 

Graf (1967); FPA (1987 H53) 

Peroxidizable compounds 

H. L. Jackson etd. (1970) 

Pharmaceuticals 

Dickson and Teather (1982); Handley (1985) 

Phenol 

Richmann (1964); Stobaugh (1966e); Fleming, Lambrix 
and Nixon (1976); Gelbein and Nislick (1978); HSE (1984 
SHW 29) 

Phosgene 

CISHC (1975/3); NIOSH (1976 Crit. Doc. 76-137); Hardy 
(1982); Alspach and Bianchi (1984); Anon. (1986q); FPA 
(1988 H105); Somerville (1990); Schneider and Diller (1991) 

Phosphorus 

Lemay and Metcalfe (1964); FPA (1987 H19) 

Phosphoric acid 

Blumrich, Koening and Schwehr (1978) 

Phosphorous compounds, chlorides 

Anon. (1976 LPB 12, p. 11); Anon. (1977 LPB 13, p. 21); 

HSE (1994 TR30) 

Phthalic anhydride 

B. Shaw (1961); Ellwood (1969b); J.J. Graham (1970); 
Schwab and Doyle (1970); G.F.P. Harris and Macdermott 
(1980); FPA (1988 H130) 


Polychlorinated biphenyls (PCBs) 

Hutzinger (1974); Higuchi (1976); George etd. (1988); Derks 
(1991); Sundin (1991) 

Polymers, including inhibitors 

Mark etd. (1989); Redman (1991); Levy (1993); 

Vasile and Seymour (1993) 

PVC: BCISC (1974/14); Nass (1976);Terwiesch (1976); Sittig 
(1978); HSE (1979 BPM 3); Nass and Heiberger (1986) 

Propargyl bromide 

Coffee and Wheeler (1967) 

Propylene 

Haines (1963); Stobaugh (1967b); Strelzoff (1970); 

Hancock (1973); FPA (1986 H75); Glass (1987); 

C. Butcher (1989b) 

Propylene oxide 

Jefferson Chemical Company (1963); Stobaugh etd. (1973); 
Simmrock (1978); Kuhn (1979,1980b); FPA (1986 H88) 

Silane, silane chlorides 

Britton (1990a) 

Sodium 

Bulmer (1972); Zinsstag (1973); Parida, Rao and 
Mitragotri (1985); FPA (1987 H4) 

Sodium borohydride 

Duggan, Johnson and Rogers (1994) 

Sodium chlorate 

V.J. Clancey (1975b,c); Anon. (1980r); HSE (1985 CS 3); 

FPA (1987 H7) 

Solvents 

Ceilings and Luxon (1982); de Renzo (1986) 

Styrene 

Stobaugh (1965c); HSE (1981TR1); Short and 

Bolton (1985); FPA (1986 H44); Anon. (1987 LPB 78, p. 23); 

Ayers (1988 LPB 84) 

Sulfur 

J.R. Donovan (1962); Palm (1972); Chao (1980); Parnell 
(1981); FPA (1986 H14) 

Sulfur dioxide, sulfur trioxide 

B.O. Davies and Royce (1961); NIOSH (1977 Crit. Doc. 74-11); 
CGA (1988 G-3) 

Sulfuric acid 

Biames (1982) 

Terephthalic acid (TPA) 

Derbyshire (1960); FPA (1991H165) 

f-Butylhydr operoxide (TBHP) 

Verhoeff (1981) 

Toluene 

Stobaugh (1966f); Hancock (1982); FPA (1986 Hll); HSE 
(1989 TR20) 

Trichloroethylene 

Institut National de Securite (1967); Tsuda (1970); HSE 
(1973 TON 17,1985 EH 5); FPA (1990 H157) 
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Vinyl acetate 

Reis (1966); Remirez (1968a); Stobaugh, Allen and 
van Sternbergh (1972); R.D. Brown and Bennett (1978); 
NIOSH (1978 Crit. Doc. 78-205); Goldfarb et al. (1981); 
Douglas, von Bramer and Jenkins (1982); Ehrler and 
Juran (1982); FPA (1986 H36) 

Vinyl chloride (see alsoTable 18.1) 

Gomi (1964); Buckley (1966); Albright (1967d,g); 

Arne (1967); Keane, Stobaugh and Townsend (1973); 
NIOSH (1974 Crit. Doc. 78-205); Z.G. Bell et al. (1975); 

CIA (1975/8,1978 PA15,1978/9); Reich (1976); Vervalin 
(1976a); Wimer (1976); Mukerji (1977); Sittig (1978); 
Mcpherson, Starks and Fryar (1979); Goldfarb etal. (1981); 
Cowfer and Magistro (1983); FPA (1990 H20) 

Xylene 

Stobaugh (1966g); Atkins (1970); Hancock (1982); FPA 
(1986 H76); HSE (1992 TR26) 

Other chemicals 

Bond (1987); L.E. Brown, Johnson and Martinsen (1987); 
Fitzer et al. (1988); Midgley (1989) 

Deterioration of chemicals 

Crowl and Louvar (1990); Kletz (1992a) 


The emission and dispersion characteristics of materials 
are treated in Chapter 15 and flammability, explosibility 
and toxicity in Chapters 16-18, whilst storage, transport 
and emergency planning are treated in Chapters 22-24, 
respectively. 

The accounts of particular chemicals given in the table 
are based mainly on the codes of practice and other guid¬ 
ance documents of the Chemical Industries Association 
(CIA) and the HSE. An overview of some principal topics 
covered in these publications is given inTable 11.9. Storage is 
dealt with in all the publications to some degree and 
in several it is the main content. It is convenient, if some¬ 
what arbitrary, to cover it separately in Chapter 22. The 
treatment of the individual chemicals given here is intended 
to highlight their characteristic features; it is not a detailed 
summary of the codes and guidance. For LPG, there are 
codes issued by the Liquefied Petroleum Gas Association 
(LPGA) in the United Kingdom and the National Fire 
Protection Association (NFPA) in the United States. 

Toxic limits are given in Occupational Exposure Limits 
(HSE, 1994 a,b EH 40/94). The normal limit is the long-term 
time-weighted average (TWA), but the limit given is in 
some cases the maximum exposure limit or the short-term 
exposure limit (STEL). Alternatively, the substance may be 
classed as an asphyxiant. The HSE has also given guidance 
on toxicity in relation to major hazards for several of the 
materials, namely acrylonitrile, ammonia, chlorine and 
hydrogen fluoride, as described in Chapter 18. 

One topic treated in most of the publications mentioned 
is pressure relief and relief of thermal expansion of liquids. 
Overall, the treatments are broadly similar, but contain 
differences of detail, the reasons for which are not always 
clear. In the treatments given below some mention is made 
of such reliefs, but only to highlight certain points parti¬ 
cular to the chemical in question. An account of pressure 
relief and thermal relief for chlorine systems, which con¬ 
tains many typical features, is given in Chapter 12. 


Guidance on safety cases under the Control of Industrial 
Major Accident Hazards Regulations 1984 (CIMAH) and on 
quantitative risk assessment is available, from different 
sources, for several of the materials, as described in Chap¬ 
ter 9. These include LPG, ammonia, chlorine and oxygen. 

11.11.1 Hydrocarbons, LPG and LNG 

Some of the principal hydrocarbons processed in the petro¬ 
chemical industry are as follows: 


Normal boiling point (°C) 

Methane 

-161.4 

Ethane 

-88.6 

Propane 

-42.2 

ra-Butane 

-0.6 

Ethylene 

-103.9 

Propylene 

-47.7 


Methane is the main component of natural gas, which 
in liquefied form is known as liquefied natural gas 
(LNG). Propane and butane are referred to as liquefied 
petroleum gas (LPG). LNG and LPG are treated more fully 
in Section 11.12. 

The hydrocarbons listed above are all gases at normal 
temperature and pressure, but can all be liquefied with a 
greater or lesser degree of difficulty. All are handled 
industrially in the liquid phase by the use of low tempera¬ 
tures, high pressures or both. 

In many cases these materials are held not only under 
pressure but also at the high temperatures necessary for 
processing. The handling of hydrocarbons in this way 
means that if containment is lost, dispersion may be quite 
rapid. In particular, a material held under pressure and 
above its normal boiling point will flash off when let down 
to atmospheric pressure. 

The use of extremes of temperature, both high and low, 
creates difficulties in materials of construction. Some of 
these are discussed in Chapter 12. In particular, there are 
problems of brittle fracture at low temperature and of creep 
at high temperature. The use of low temperatures also 
means that there is continual heat in-leak into the plant, 
which can become a problem if there is an interruption to 
processing or if insulation is lost. The hydrocarbons are 
flammable and can therefore give rise to the hazards both of 
fire and of explosion. 

In addition to their use in the process industries, several 
of these hydrocarbons are widely used as fuels. In parti¬ 
cular, propane and butane enjoy widespread use as fuels in 
the form of LPG supplied from self-contained storage 
installations. Natural gas, which is mainly methane, is 
transmitted by high pressure pipeline to the public dis¬ 
tribution system for industrial and domestic users. It is 
also transported and stored as LNG. Natural gas liquids 
(NGLs), which are mainly ethane, propane and butane, are 
also transported by pipeline. Again there are hazards of 
fire and explosion associated with these materials. Fire and 
explosion hazards of hydrocarbons are considered in detail 
in Chapters 16 and 17, respectively. 

11.11.2 Acetylene 

Accounts of acetylene are given in Acetylene - Its Proper¬ 
ties, Manufacture and Use (S.A. Miller, 1964), Acetylene 
Manufacture and Uses (Hardie, 1965), Acetylene by the 
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Table 11.9 Some topics covered in certain Codes of Practice, and guidance for particular chemicals a 


Acrylonitrile Ammonia 

Chlorine Ethylene Ethylene 
dichloride oxide 

Hydrogen 

fluoride 

Phosgene 

Vinyl 

chloride 

Physical properties 

2,19 

5 

34 

14,15 

7,28 

15,16 

5 

App. I, II 

Flammability 

2 

5 



7 


6 

2 

Toxicity, health effects 

2 

5,6 

36 


8,11 

2 

8 

2 

Special properties’ 1 


17 



7,8,10 


6,18 

7 

Phase change: boiling, 




7 


9 


11 

condensation 









Plant design: 

3 




12 

4 


2 

Siting and layout 

4 

6 

1 

3 

12 

4 

3,10 

5 

Ignition sources 

4,7 

13 


8 

9 



5,13 

Ventilation 


13 


8 




3,13,14 

Materials of construction 

5 

7,12 

35 

3 

13 

3 

12,13 

3 

Material transfer, pumping 

5 

11 

20, 22 

8 

14 

10 

9,18 

12 

Pipework, pipelines 

5 

11 

5 

5 

13 

6 

9,13,14 

8 

Valves 

6 


8 

6 


7 

14 

9 

Heat exchange 





15 


13 


Instrumentation 

8 








Backflow prevention 





14 




Pressure relief and vents 

6 


7,28 

6 

13 

7 

9,12,19 

8,10,13 

Explosion relief 




6 




11,14 

Disposal of vented 



27 

8 


10 

9,20 


material, absorbers 









and scrubbers 









Disposal of contaminated 

6,15 




25 


11, 21 

15 

liquids, drains 









Vaporizers 



23 


17 




Plant operation: 

10 

15,17 

30 

11 

21 

11 

21 

16 

Protective clothing 

3,9,11 




22 




Isolation 

12 



7 


9 


11 

Maintenance 

11 


30 


23 


22 


Emergency planning 

16 

21 

31 

13 

24 

13 

4,23 

20 

and procedures: 









Protective equipment 

9 


29 

13 


13 

23 

20 

Emergency equipment 

17 


29 

13 


13 


20 

Leaks and spillages 

15 


29 

12 

25 

12 

27 

18 

Fire 

16 



12 

24 



19 

First aid 

13,22 


33 


11 

14,19 

28 



a The publications referred to are as follows: acrylonitrile (CIA, 1978 PAH); ammonia (HSE, 1986 HS(G) 30); chlorine (HSE, 1986 HS(G) 28); 
ethylene dichloride (CIA, 1975 PA13); ethylene oxide (CIA, 1992 RC14); hydrogen fluoride (CIA, 1978 PA14); phosgene (CIA, 1975 CPP5); vinyl 
chloride (Cl A, 1978 PA15). The numbers in the body of the table refer to the page numbers of these publications. Storage is considered separately 
in Chapter 22. 

b Special properties: ammonia (oxygen); chlorine (nitrogen trichloride); ethylene oxide (decomposition, polymerization); phosgene 
(decomposition in water, reaction with lubricating oils); vinyl chloride (polyperoxides). 


Compressed. Gas Association (CGA, 1990 G-l) and Acetylene 
Transmission for Chemical Synthesis (CGA, 1970 G-1.3) and 
by Sargent (1957), S.A. Miller and Penny (1960), Schmidt 
(1971), Manyik (1978), P.J.T. Morris (1983), Passler et al. 
(1985) and Hort and Taylor (1991). 

Codes for the handling of acetylene in the United King¬ 
dom are issued by the British Compressed Gases Associa¬ 
tion (BCGA, 1986 CP 5, 1986 CP 6), the successor to the 
British Acetylene Association. 

Acetylene is produced from calcium carbide or by the 
cracking or oxidation of hydrocarbons. Acetylene is highly 
reactive due to its triple carbon-carbon bond and was for 
many years the basis of a whole branch of the chemical 
industry, including in particular products derived from 
the intermediate tetrachloroethane, and of vinyl chloride. 


Acetylene chemistry has always been particularly strong 
in Germany. Thus, in 1958 the production of calcium car¬ 
bide in West Germany, East Germany, the United States and 
the United Kingdom was 979,000, 815,000, 805,000 and 
145,000 ton, respectively. Since the 1960s acetylene has 
been largely replaced by ethylene as the raw material for 
these products. Production peaked in the United States in 
1960 at 480,000 ton/year and in Germany in the 1970s at 
350,000 ton/year. New processes have been developed for 
the manufacture of acetylene, but these have not arrested 
its decline. However, there is some evidence that this decline 
has slowed, partly because acetylene has always been the 
main route for some chemicals such as 1,4-butanediol and 
special vinyl esters, and partly because in Europe the 
relative cost of oil to natural gas feedstock rose. 
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In the United Kingdom, acetylene was brought under the 
provisions of the Explosives Act 1875 by an Order in 
Council in 1897. For pressures exceeding 24 psig the 
installation came under the control of the Explosives 
Inspectorate. The legal requirements associated with this 
regime are described in The Law Relating to Petroleum 
Mixtures, Acetylene, Calcium Carbide, etc. (H. Watts, 1956). 
Legislation on acetylene is discussed in Chapter 3. 

Acetylene is a gas. It is a flammable and explosively 
unstable material. For occupational exposure it is classed 
as an asphyxiant. Acetylene undergoes explosive decom¬ 
position at any pressure and temperature and even without 
the presence of oxygen. Acetylene decomposition may be 
initiated by shock, temperature or reactive substances. The 
decomposition may range from a harmless puff of flame to 
a violent explosion. 

In particular, acetylene reacts violently with substances 
such as chlorine. Thus in the production of vinyl chloride by 
the reaction of acetylene with hydrogen chloride, where the 
latter is produced by burning hydrogen and chlorine, it is 
essential to ensure that there is no free chlorine in the 
hydrogen chloride. On the other hand, acetylene and 
chlorine are bubbled into liquid tetrachloroethane in the 
process for the manufacture of the latter product. 

The explosion hazard with pure acetylene is most severe 
in pipelines. Here a deflagration may travel down a pipe 
until it becomes a detonation, which is much more destruc¬ 
tive. This is a well-known effect in pipeline explosions, but 
acetylene presents a particularly severe problem in this 
regard. Further information on acetylene decomposition 
in equipment and pipelines is given by Schmidt (1971) and 
by Carver, Smith and Webster (1972). Despite this hazard, 
long-distance acetylene pipelines have been developed 
in Germany. Precautions against explosions include the 
earthing of pipes against static electricity and the use of 
flame arresters. There are no long-distance acetylene pipe¬ 
lines in the United Kingdom. 

The usual material of construction for plant handling 
acetylene is mild steel. It is necessary in such plant to 
eliminate copper and brass, which can give rise to the for¬ 
mation of the highly explosive compound copper acetylide. 

In some processes, traces of acetylene may be present in 
the effluent gases. These gases are sometimes cooled to 
condense out other components. In such cases, considera¬ 
tion should be given to the possibility of forming solid 
acetylene. Although the literature suggests that pure solid 
acetylene is not hazardous, this may not be the case if the 
material is impure. 

Bulk acetylene is stored in gasholders. Holders with a 
capacity of 1000 m 3 have been used in the United Kingdom. 
Acetylene is stored and distributed in cylinders containing 
acetone and is widely used in this form, particularly for 
oxyacetylene welding. 

11.11.3 Acrylonitrile 

A relevant code for acrylonitrile is the Codes of Practice for 
Chemicals with Major Hazards: Acrylonitrile (the Acrylotni- 
trile Code) by the CIA (1978). Accounts are also given in 
Acrylonitrile (Dalin, Kolchin and Serebryakov, 1971) and by 
Langvardt (1985) and Brazdil (1991). 

Acrylonitrile is a liquid with a normal boiling point of 
77°C. It has moderate solubility in water. It is flammable, 
the flammable range being 3-17% and the flashpoint 
—1°C. It is toxic and has a long-term maximum exposure 
limit of 2 ppm. 


Acrylonitrile is liable to polymerize and thus in storage 
needs to be stabilized. Stabilizers used are methyl ether of 
hydroquinone (MEHQ), ammonia and water. 

Materials of construction for acrylonitrile plants are 
carbon steel, and for polymerization plants stainless steel. 
Copper and its alloys should not be used, since they cause 
contamination which inhibits subsequent polymerization. 

Pumps used for transfer may be of the centrifugal or 
positive displacement types. For centrifugal pumps located 
outdoors a single mechanical seal is usually adequate, 
but indoors consideration should be given to double 
mechanical seals. At normal pumping rates of about 3 m/s 
the generation of static electricity by acrylonitrile should 
be minimal, but plant handling this chemical should be 
earthed. 

In relief systems for acrylonitrile, consideration should 
be given to possible condensation in the relief line. 

11.11.4 Ammonia 

There is no single code of practice applicable to ammonia, 
but there are several codes covering particular aspects. 
These include Storage of Anhydrous Ammonia under 
Pressure in the United Kingdom (HSE, 1986a-c HS(G) 30), 
Anhydrous Ammonia - Guidance for the Large Scale 
Storage, Full Refrigerated, in the United Kingdom (CIA, 1993 
RC40) and Code of Practice for the Safe Handling and 
Transport of Anhydrous Ammonia by Rail (CIA, 1975 PA1). 
Accounts are also given in Ammonia (Slack and James, 
1973) and by Bakemeier etal. (1985) and Czuppon, Knez and 
Rounes (1992). 

Ammonia is produced by the reaction of hydrogen and 
nitrogen in converters at high pressure, as described in 
Section 11.12. Much of the largest use is for fertilizers, in the 
form of ammonium sulfate and ammonium nitrate and in 
anhydrous liquid form. It is used to make nitric acid and, in 
part via this, a range of plastics and fibres such as nylon, 
urea-formaldehyde resins, urethane, acrylonitrile and 
melamine. It is also used in the manufacture of explosives, 
hydrazine, amines, amides, nitriles and dyestuff intermedi¬ 
ates and of urea, sodium cyanide and sodium carbonate. 

Ammonia has a normal boiling point of —33.4°C and 
is therefore a gas. The vapour pressure at 20°C is 8.6 bar. 
It is frequently handled as a liquefied gas, either under 
pressure or refrigerated. Pressurized liquefied ammonia 
gives on release a flashing liquid. 

Ammonia is flammable, but not readily so. The flamm¬ 
ability range is 15—28%. The minimum ignition energy, 
however, is 100 mj, which is high. The flammability and 
explosibility of ammonia is discussed by Ivletz (1988a). The 
incident at Jonova (Case History A124) illustrates the 
flammability of ammonia. 

Ammonia is a toxic irritant. Its long-term occupational 
exposure standard is 25 ppm. A concentration of about 
1700 ppm can be fatal for a half-hour exposure. Its odour is 
detectable by most people at about 5 ppm. 

After a large release of chlorine, a release of ammonia is 
potentially one of the worst toxic hazards from the common 
bulk chemicals in the chemical industry. 

Ammonia is fully miscible with water. This creates the 
hazard that if there is water in a vessel containing ammonia 
vapour, the latter may dissolve, so that a vacuum is formed 
and the vessel collapses inwards. 

Materials of construction for ammonia depend on the 
operating temperature. While mild steel may be used at 
ambient temperatures, special steels are necessary at low 
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temperatures to avoid embrittlement. Materials for ammo¬ 
nia processes are discussed in Section 11.12. 

Ammonia is corrosive even in trace amounts to copper, 
zinc, silver and many of their alloys. It is necessary, there¬ 
fore, in handling ammonia to avoid the use of valves and 
other fittings which contain these metals. Under certain 
conditions ammonia can react with mercury to form 
explosive compounds (Comings, 1956): 

‘Under pressure, mercury forms a compound with 
ammonia consisting of several molecules of ammonia per 
atom of mercury. This compound is apparently not 
explosive. However, as the pressure is lowered, the ratio of 
ammonia to mercury decreases and a compound similar 
to a fulminate is formed. This has been known to detonate 
and is a serious hazard. The hazard is greatest when a 
system containing mercury and ammonia is being 
depressured.’ 

Impurities in liquid anhydrous ammonia, such as air or 
carbon dioxide, can cause stress corrosion cracking of mild 
steel. This is largely inhibited, however, if the ammonia 
contains 0.2% water and this water content is therefore 
specified for some applications. This aspect is considered 
further in Chapters 22 and 23. 

The production, storage and transport of ammonia 
are considered in Section 11.12, and Chapters 22 and 23, 
respectively, the toxic release hazard is discussed in 
Chapter 18 and emergency planning in Chapter 24. 

11.11.5 Chlorine 

Chlorine is treated in Chlorine (Sconce, 1972) and it is the 
subject of Safety Advice for Bulk Chlorine Installations (HSE, 
1986a-c HS(G) 28). This code is based on an earlier CIA 
code and is the code now listed by the CIA; the earlier 
code Codes of Practice for Chemicals with Major Hazards: 
Chlorine (the Chlorine Code) by its predecessor, the British 
Chemical Industry Safety Council, (BCISC, 1975/1) is no 
longer listed. Further information is given in the Chlorine 
Manual (Chlorine Institute, 1986 Pamphlet 1). Accounts are 
also given by Schmittinger (1986) and Curlin, Bommaraju 
and Hansson (1991). 

Chlorine is produced by the electrolysis of brine in mer¬ 
cury or diaphragm cells, with the co-products sodium 
hydroxide and hydrogen. It is used mainly for the manu¬ 
facture of a wide range of organic and inorganic chlorine 
compounds and for the chlorination of water and for 
bleaching. Some principal organic compounds are chlorin¬ 
ated paraffins such as methyl chloride, methylene chlo¬ 
ride, chloroform and carbon tetrachloride from methane 
and hexachlorobutadiene and hexachloropentadiene from 
butane and pentane, respectively. The main single organic 
chloride product is ethylene dichloride which is obtained 
by chlorination of ethylene and is used mainly to make 
vinyl chloride. Chlorination of ethylene also gives tri¬ 
chloroethylene and perchloroethylene. Products obtained 
via chlorination of propylene include propylene oxide, 
propylene glycol, carbon tetrachloride, glycerine and 
epoxy resins and synthetic rubber. Aromatic products of 
chlorination include monochlorobenzene, dichlorobenzene 
and hexachlorobenzene. 

Chlorine has a normal boiling point of -34°C and is 
therefore a gas. The vapour pressure at 20°C is 6.7 bar. 
It has a very low solubility in water. Chlorine is frequently 
handled as a liquefied gas under pressure. In this condi¬ 
tion liquefied chlorine gives on release a flashing liquid. 


Chlorine is not flammable in air, but is itself an oxidant. 
Chlorine is a toxic irritant. Its long-term occupational 
exposure standard is 0.5 ppm. 

A large chlorine release is potentially one of the most 
severe hazards from a common bulk chemical presented by 
the chemical industry. As an oxidant chlorine is in many 
ways comparable with oxygen. Organic compounds may 
have flammability limits in chlorine rather similar to those 
which they have in oxygen. Reactions between organic 
compounds and chlorine are generally highly exothermic 
and tend to go to complete chlorination, often with some 
violence. 

Chlorine also forms flammable mixtures with hydrogen. 
This is important in chlorine production, where both gases 
are evolved from the electrolysis cells. Hydrogen and 
chlorine may also be reacted together to produce hydrogen 
chloride. 

Usually, liquid chlorine contains the impurity nitrogen 
trichloride, which decomposes explosively. Therefore, it is 
necessary when handling chlorine to prevent the accumu¬ 
lation of this substance. For example, a chlorine vaporizer 
should not be allowed to boil dry so that the nitrogen 
trichloride is concentrated and may explode. 

Mild steel is a suitable material of construction for use 
with chlorine unless the water content or temperature ren¬ 
ders it unsuitable. Wet chlorine corrodes mild steel rapidly. 
Mild steel should only be used if the chlorine is dry. For wet 
chlorine gas, ebonite-lined mild steel is commonly used. 

There are both low and high temperature limitations 
on the use of mild steel with chlorine. Special steels 
are required at low temperatures to avoid embrittlement. 
At high temperatures, mild steel burns in chlorine and 
again special materials have to be used. Chlorine attacks 
mild steel significantly above 200°C and rapidly above 
230°C. In order to prevent reaction, it is normal to limit the 
operating temperatures with mild steel. The Chlorine Code 
quotes a limit of 120°C. 

The design of pressure systems for handling chlorine 
incorporates a number of special features. Many of these 
are generally applicable to the handling of a very toxic 
substance. They are discussed in Chapter 12. In view of the 
toxicity of chlorine, it is not appropriate to vent large 
quantities to atmosphere. Plants producing chlorine there¬ 
fore require emergency gas absorption facilities. Chlorine 
from pressure relief devices should go to an expanse tank or 
to gas absorption plant. 

Storage and transport of chlorine are treated in 
Chapters 22 and 23, respectively, the toxic release hazard in 
Chapter 18, and emergency planning in Chapter 24. 

11.11.6 Ethylene dichloride 

A relevant code for ethylene dichloride, or 1,2-dichloro- 
ethane, is the Code of Practice for Chemicals with Major 
Hazards: Ethylene Dichloride (CIA, 1975 PA13). Accounts are 
also given by VL. Stevens (1979) and Rossberg et al. (1986). 

Ethylene dichloride is made by the liquid phase chlo¬ 
rination of ethylene. It is used principally for the manu¬ 
facture of vinyl chloride by cracking the ethylene 
dichloride to vinyl chloride and hydrogen chloride. Usually, 
the latter is then reacted in an oxychlorination process to 
produce more vinyl chloride. 

Ethylene dichloride is a liquid with a normal boiling 
point of 84.4°C. It has a low solubility in water. Ethylene 
dichloride is flammable, the flammable range being 6-16%. 
The flash point is 13°C (closed cup) or 18°C (open cup). 
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Ethylene dichloride is toxic. It has a long-term 
maximum exposure limit of 5 ppm and carries the ‘Skin’ 
notation. Concentrations of about 3% can produce nausea, 
drowsiness and stupor. It is detectable by odour at a con¬ 
centration of 50-100 ppm. The decomposition products of 
ethylene dichloride in a fire include hydrogen chloride, 
which is toxic. 

Plant handling ethylene dichloride is usually con¬ 
structed in mild steel. Mild steel is suitable for dry ethylene 
dichloride and also for wet saturated ethylene dichloride 
below 50°C, provided the aqueous phase is alkaline. But at 
temperatures above 80°C wet ethylene dichloride under¬ 
goes hydrolysis, forms acid and rapidly corrodes mild steel. 
Transfer of ethylene dichloride may be effected by pump¬ 
ing or inert gas padding. 

11.11.7 Ethylene oxide 

Ethylene oxide is the subject of the Guidelines for Bulk 
Handling of Ethylene Oxide (CIA, 1992 RC14) (the CIA 
Ethylene Oxide Guidelines), the earlier Code of Practice for 
Chemicals with Major Hazards: Ethylene Oxide by the Che¬ 
mical Industry Safety and Health Council (CIHSC, 1975/1) 
(the Ethylene Oxide Code) is no longer listed. Accounts are 
also given by Cause et al. (1980), Ozero and Procelli (1984), 
Rebsdat and Mayer (1987), Ondrey (1992) and Siwek and 
Rosenberg (1993). 

Ethylene oxide is produced by the vapour phase oxida¬ 
tion of ethylene. There are various processes; some use air 
and some use oxygen, but otherwise the processes are 
broadly similar. It is used primarily for the production of 
ethylene glycol, which in turn is used in roughly equal 
proportions as antifreeze and for production of polyesters. 
Other products obtained via ethylene oxide are ethano- 
lamines, glycol ethers and surfactants. 

Ethylene oxide is a toxic, flammable and explosively 
unstable material. Therefore it exhibits a rather unusual 
combination of hazards. The properties of ethylene oxide 
have been the subject of a series of investigations by 
Burgoyne and co-workers (e.g. Burgoyne and Burden 1948, 
1949; Burden and Burgoyne, 1949; Burgoyne, Bett and 
Muir, 1960). 

Ethylene oxide has a normal boiling point of 10.5°C. 
At atmospheric pressure it may therefore be a gas or a 
liquid, depending on the temperature, and in handling 
it may be treated as a liquefied gas. At higher ambient 
temperatures, a liquid leak undergoes a degree of flashing 
to vapour. This feature of a normal boiling point close to 
ambient temperature tends to increase the hazard. 

Ethylene oxide is fully miscible with water. In contrast 
to other flammables such as hydrocarbons, therefore, 
liquid spills can readily be diluted with water to reduce 
the hazard of fire. 

The lower flammability limit of ethylene oxide is 3%. 
There is no upper flammability limit as normally con¬ 
ceived, since at high concentrations up to pure ethylene 
oxide combustion is replaced by explosive decomposition. 
The flashpoint (open cup) is -17.8°C. The autoignition 
temperature in air is 429°C. 

Ethylene oxide is toxic and has a long-term maximum 
exposure limit of 5 ppm. The odour of pure ethylene oxide is 
not detectable by many people below about 700 ppm, and 
whilst impurities present in the industrial material reduce 
the odour threshold considerably, odour is not a reliable 
guide to its presence, and artificial means are necessary. 
Ethylene oxide liquid or aqueous solution affect the skin. 


Ethylene oxide vapour decomposes explosively even in 
the absence of air, if ignited or heated above about 560°C. 
The liquid is stable to decomposition. 

Liquid ethylene oxide is very susceptible to polymeri¬ 
zation. This may be initiated at ambient temperatures by 
acids, bases and anhydrous chlorides of iron and of some 
other metals. Also, iron rust is a moderate initiator, so that 
equipment should be substantially rust free. At around 
100°C purely thermal initiation starts, and once this 
happens iron becomes a promoter. The polymerization is 
highly exothermic and can result in explosive decomposi¬ 
tion. Slow polymerization can also occur, producing a solid 
polymer which does not decompose explosively. 

Mild steel and stainless steel are used as materials of 
construction for plant handling ethylene oxide, but mild 
steel must be rust free. The internal surfaces of plant 
equipment for handling ethylene oxide should be carefully 
prepared before use and free from foreign matter which 
could cause slow polymerization such as welding slag, rust 
and debris. Cleaning may be by shot blasting or by chemical 
means. If shot blasting is used, it must be possible to 
remove the dust and debris created; otherwise chemical 
methods must be used. The stages of acid cleaning are: 
(1) degreasing, (2) acid pickling, using hydrochloric acid 
for mild steel and citric acid for stainless steel and (3) for 
mild steel, atmospheric passivation. 

Flanged joints should have stainless steel, spiral wound, 
polytetrafluoroethene (PTFE) filled joint rings or trapped 
Fluon rings. Natural rubber joint rings should not be used. 
Compressed asbestos fibre (CAF) is suitable for use only 
below 25°C and is therefore not generally recommended. 
Joints should be kept to a minimum consistent with 
enabling lines to be opened for polymer clearance. 

In order to avoid polymerization, pipework for handling 
liquid ethylene oxide should be laid out so that it can he 
completely drained during a shut-down. There should he 
facilities for blowing through with nitrogen. Lines of less 
than 25 mm (1 in) bore should not be used. Pipework should 
be designed to minimize the trapping of ethylene oxide 
between closed valves or in stagnant pockets. Relief is not 
normally required on in-plant pipework, but each case 
should be considered individually. 

Ethylene oxide liquid has a high electrical conductivity, 
of the order of 10 6 pS/m (1 S = l/n _1 ). Since experience 
shows that buildup of electrostatic charge does not occur in 
a liquid with a conductivity greater than 300 pS /m, it is not 
necessary to take the usual precautions against the static 
electricity hazard, such as limitation of pipeline velocities 
and avoidance of splash filling. However, in order to 
maintain consistency with practice for flammable liquids 
generally, transport containers should be earthed during 
loading and discharge. 

Transfer of liquid ethylene oxide may be by gravity, 
inert gas padding or pumping. For small quantities it 
may be preferable to use the first two methods. If a pump 
is used, it is essential for there to be no conditions which 
can cause an abnormal temperature rise. This require¬ 
ment can be met by the use of a recycle system from the 
pump delivery to the suction when the pump is operat¬ 
ing, with cooling of the recycle. The recycle system 
should be sized to handle all the heat which can be gen¬ 
erated by the pump when operating against a closed 
delivery. If the recycle is to the suction tank, the latter 
acts as a thermal reservoir. If dead-heading can occur, 
the pump should be fitted with a high temperature trip, 
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which should shut the pump down if the temperature 
reaches 10°C above normal. 

An in-line centrifugal pump with mechanical seals is the 
preferred type. It should be fitted with a single seal with a 
restrictor brush or a double seal flushed with water, which 
should be analysed regularly to detect leaks. A canned 
pump should not be used. If a reciprocating pump has to he 
used, it should be fitted with a double diaphragm seal with 
suitable sealant and rupture indication. 

Refrigerant fluids used for direct heat exchange with 
ethylene oxide should not react with it and should not con¬ 
tain polymerization initiators. 

Vaporizers for liquid ethylene oxide should he designed 
as once-through systems so as to prevent the accumula¬ 
tion of hazardous residues. The heating medium should 
be such as to keep the temperature well below that of 
decomposition. Direct flame or electrical heating should 
not be used. 

Measures are required to prevent contamination of 
ethylene oxide in storage by backflow from consumer 
plants, by contamination of inert gas supplies or by flow 
from the loading terminal. Protection against backflow 
from the plant should be effected by means of two separate 
trip systems, the first based on the pressure difference 
between the ethylene oxide storage outlet and the supply 
line to the consumer plant and the second on that between 
the supply line and the inlet of the plant. 

Prevention of contamination of the supply of inert gas, 
typically nitrogen, is ideally effected by the use of separate 
supplies for storage and process. The measures necessary 
where the supply is common are detailed in the Ethylene 
Oxide Guidelines. 

Ethylene oxide should be stored separately from other 
flammable liquids. Terminals for loading and unloading 
ethylene oxide should also be segregated. Storage and 
transport of ethylene oxide are considered in Chapters 22 
and 23, respectively, the toxic release hazard in Chapter 18 
and emergency planning in Chapter 24. 

11.11.8 Hydrogen 

Hydrogen is the subject of the codes NPFA 50A: 1989 Gas¬ 
eous Hydrogen Systems at Consumer Sites and NFPA SOB: 
1989 Liquefied Hydrogen Systems at Consumer Sites and 
of Hydrogen by the CGA (1974 G-3). Accounts are also 
given in Hydrogen (K.E. Cox and Williamson, 1977-) 
and Hydrogen (WN. Smith and Santangelo, 1980) and by 
Donakowski (1981), Mandelik and Newsome (1981), 
J.D. Martin (1984), Haussinger, Lohmuller and Watson 
(1989) and Johansen, Raghuraman and Hackett (1992). 

Hydrogen is produced by steam reforming or partial 
oxidation of hydrocarbons or from a hydrogen-rich stream 
from a low temperature section of a petroleum plant or a 
coke oven plant or from a chlorine cellroom. It is used in 
many large-scale processes, notably in ammonia synthesis, 
refinery hydrogenation processes, and methanol synthesis, 
and in hydrogenation of coal and hydrogasification of 
coal to synthetic natural gas (SNG). It is also used in: 
hydroformylation of olefins, the Oxo synthesis; organic 
hydrogenations; and hydrogenation of fats and oils. 

Hydrogen has a normal boiling point of -252.5°C and is 
therefore a gas. Hydrogen has a wide flammable range of 
4—75%, a low minimum ignition energy of about 0.019 mj 
and a high burning velocity. It is therefore easily ignited 
and burns rapidly. For occupational exposure hydrogen is 
classed as an asphyxiant. 


In consequence of its flammability, hydrogen presents an 
explosion hazard and it is necessary to take suitable pre¬ 
cautions. As far as the hazard of an open air explosion is 
concerned, hydrogen gas has a low density and tends to rise 
and dissipate rapidly unless it is very cold. Nevertheless, 
vapour cloud explosions of hydrogen have occurred. They 
are discussed in more detail in Chapter 17. 

Hydrogen gas may burn in air, but hydrogen flames have 
lowheat radiation, aboutone-tenththatofpropane, and tend, 
therefore, to be less hazardous. The gap through which a 
hydrogen flame can travel is much smaller than with most 
other gases. It is therefore more difficult to make electric 
motors sufficiently flameproof for operation in atmos¬ 
pheres which may contain a flammable hydrogen- 
air mixture. 

Hydrogen at elevated pressures and temperatures 
attacks mild steel severely, causing hydrogen decarburiza¬ 
tion and embrittlement, and it is necessary, therefore, to 
use special alloy steels in hydrogen service. 

Leakage of hydrogen constitutes a problem. The pres¬ 
sures in plant handling hydrogen are commonly high and 
the gas diffuses readily through small holes. Hydrogen 
exhibits a reverse Joule-Thomson effect, so that leaking 
gas heats up and may ignite. Since the flame is non-lumi- 
nous, it may not be visible. An operator may walk unawares 
into a hydrogen leak flame. 

Hydrogen can also diffuse through solid metal. It can 
pass, for example, into a thermocouple pocket and thence 
through the connecting leads into the control room. Where 
this risk exists, therefore, it is good practice to arrange 
the connections so that there is no flow path for the 
hydrogen. 

Liquid hydrogen is used in certain special applications, 
notably aerospace work. This is effectively a separate 
technology. It is described in Handbook for Liquid Hydrogen 
Handling Equipment (AT). Little Inc., 1960), and by Cassut, 
Madocks and Sawyer (1964), Stoll (1965) and Scharle 
(1965). 

11.11.9 Hydrogen fluoride 

A relevant code for hydrogen fluoride is Guide to Safe 
Practice in the Use and Handling of Hydrogen Fluoride (CIA, 
1978 PAM) (the CIA Hydrogen Fluoride Guide). Accounts 
are also given by Gall (1980) and Aigueperse etal. (1988). 

Hydrogen fluoride is used industrially both as anhy¬ 
drous hydrogen fluoride and as solution of hydrogen 
fluoride in water; the Guide recommends that the term 
‘hydrofluoric acid’ be reserved for the latter. It is the former, 
anhydrous hydrogen fluoride, which is of interest here. 

Hydrogen fluoride is produced by the reaction of sulfuric 
acid on fluorspar in a rotary furnace. There are a number of 
processes, broadly similar but with variations, involving 
mainly pre-heaters, pre-reactors and recycle. The main uses 
are for the manufacture of fluorocarbons and of aluminium 
fluoride and synthetic cryolite used in the aluminium 
industry. It is also used in refinery processes. 

Anhydrous hydrogen fluoride has a normal boiling point 
of 19.5°C. At atmospheric pressure, it may therefore be a gas 
or a liquid, depending on the temperature and in handling 
it is conventionally treated as a liquefied gas. At higher 
ambient temperatures, a liquid leak undergoes a degree of 
flashing to vapour. 

Hydrogen fluoride is fully miscible with water. This cre¬ 
ates the hazard that if there is water in a vessel containing 
hydrogen fluoride vapour, the latter may dissolve, so that 
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a vacuum is formed and the vessel collapses inwards; the 
like hazard with ammonia has already been mentioned. 

Hydrogen fluoride is toxic. It has a short-term occupa¬ 
tional exposure standard of 3 ppm (as fluorine). It is 
detectable by odour at about 2-3 ppm, but reliance should 
not be placed on this. Aqueous solutions of hydrogen 
fluoride, anhydrous hydrogen fluoride liquid or, to a lesser 
extent vapour, affect the skin and eyes. 

Hydrogen fluoride is highly corrosive, but its corrosivity 
depends on the water content. Mild steel is resistant to 
corrosion down to concentrations in water of about 70% 
hydrogen fluoride. Plant for the manufacture of hydrogen 
fluoride is largely made of mild steel, but is designed to 
allow for the foreseeable presence of water. Mild steel is also 
the material used for the storage and transport of anhydrous 
hydrogen fluoride. Mild steel becomes decreasingly suitable 
as the temperature increases. The Guide states that the 
upper limit is usually given as 50—65°C and recommends 
that this be observed. Silica and silica-containing materials, 
including metal slags, are attacked by hydrogen fluoride 
and welds should be such as to avoid slag inclusions. 

Special process conditions, such as those that occur in 
the manufacture of hydrogen fluoride, may require the use 
of other materials of construction. The Guide gives a list of 
other materials which may be used for hydrogen fluoride. 
Pipework for hydrogen fluoride should have flanged or 
butt-welded joints. The range of materials which can be 
used for joint rings is narrow and measures are needed to 
ensure that only suitable materials are used. 

Transfer of liquid hydrogen fluoride may be by gas pad¬ 
ding or pumping. If pumping is used, measures are needed 
to prevent cavitation and leaks. A pump with double dia¬ 
phragm or a canned pump may be used. Padding gas is 
usually dry air or nitrogen. Unless it is from a source which 
is inherently dry, the gas should be monitored for water 
content. The gas supply should have its own pressure con¬ 
trol and pressure relief systems, and should not be subject 
to contamination by hydrogen fluoride. 

Avent system is required to handle both normal process 
and emergency vent flows. The vent gases should pass to a 
gas absorption system. Water is generally used for absorp¬ 
tion, with neutralization by lime slurry. 

Methods of relief disposal mentioned in the Guide 
include: returning the relief flow back to a suitable point in 
the process, which in hydrogen fluoride production is often 
possible; the use of an expanse tank; and the use of a gas 
absorption system. 

Since with hydrogen fluoride a pressure relief valve is 
liable to become corroded, the primary relief device used is 
a platinum bursting disc. A further relief device may be 
located after the disc to control the relief flow. The design of 
the relief system ducting should allow for the erosive effect 
of high velocity hydrogen fluoride gas on mild steel. 

Storage and transport of hydrogen fluoride are consid¬ 
ered in Chapters 22 and 23, respectively, the toxic release 
hazard in Chapter 18 and emergency planning in Chapter 24. 


11.11.10 Oxygen 

Relevant codes for oxygen are Bulk Liquid Oxygen at 
Production Plants (BCGA, 1990 Code 20) and Bulk Liquid 
Oxygen at Users’Premises (BCGA, 1992 Code 19). Oxygen is 
the subject of NFPA 50: 1990 Bulk Oxygen Systems at 
Consumer Sites. Accounts are also given by A.H. Taylor 
(1981) and Kirschner (1991). 


Oxygen is produced by the liquefaction and separation 
of air. It is used in bulk quantities in iron and steel making 
and in chemical processes. It is also used in oxyacetylene 
welding. 

Oxygen is the constituent in the air which supports 
combustion of fuels and other materials, and in the pure 
form it supports combustion even more effectively. Com¬ 
bustible materials of all kinds, ranging from hydrocarbons 
in chemical reactors to workmen’s clothing, undergo com¬ 
bustion much more readily in oxygen-enriched air or in 
pure oxygen. The enhancement of flammability in oxygen- 
enriched atmospheres is described in Chapter 16. 

Oxygen has a normal boiling point of -183°C (90.2 K) 
and is therefore a gas. It is frequently handled as a liquefied 
gas under pressure. In this condition liquefied oxygen 
gives on release a flashing liquid. 

Oxygen is odourless and therefore gives no indication of 
its presence. Short exposure to air with some degree of 
oxygen enrichment does not appear to be harmful. Oxygen 
is used in breathing apparatus. The main hazard of an 
oxygen-enriched atmosphere is the enhancement of 
flammability. 

The effect of a large release of oxygen would be to 
increase the combustibility of materials in the oxygen 
cloud. Such materials might include not only people’s 
clothing but even steel equipment on the plant, since steel 
will burn in oxygen. A possible source of ignition in such 
circumstances might be a lagging fire. There appears, 
however, to be no recorded case of any such incident. 

Air separation plants are discussed in Section 11.12. 

11.11.11 Phosgene 

A relevant code for phosgene is Code of Practice for Chemi¬ 
cals with Major Hazards: Phosgene (CIHSC, 1975/3) (the CIA 
Phosgene Code), but this code is no longer listed by the CIA. 
Accounts are also given by Hardy (1982) and Schneider and 
Diller (1991). 

Phosgene is manufactured by passing carbon monoxide 
and chlorine over activated carbon. It is used mainly to 
make isocyanates, particularly toluene diisocyanate. It is 
also used for chloroformic esters, urea azo dyes, carbonate 
esters and Friedel Crafts acylations. There are available 
small tonnage phosgene plants which may be installed at a 
user’s site and which avoid the need to transport and store 
large quantities of the material. 

Phosgene has a normal boiling point of 8.2°C. It is not 
flammable. It is highly toxic and has a long-term occupa¬ 
tional exposure standard of 0.02 ppm, which is a five-fold 
downwards revision from the previous value of 1 ppm and 
is very low indeed. 

In contact with water phosgene undergoes slow decom¬ 
position to hydrochloric acid and carbon dioxide. It is 
essential, therefore, to keep plant handling phosgene dry in 
order to prevent such decomposition. Phosgene also reacts 
with most lubricating oils to form a black sludge. 

For dry phosgene, carbon steel has proved a satisfactory 
material of construction, for both vessels and pipework. 
Where other substances are also present, it may be neces¬ 
sary to use other materials. The Code cautions against the 
use of non-metallic materials for pipework. 

The Code gives detailed requirements for the design of 
storage vessels for liquid phosgene. Process vessels hand¬ 
ling more than one tonne of liquid phosgene in normal 
operation should be designed to a standard similar to that 
for storage vessels. 
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For the pipework on a phosgene plant seamless tubes are 
preferred to seam-welded ones. The pipework should take 
into account both the maximum and minimum tempera¬ 
tures which may occur. Stress relieving heat treatment may 
be required. The pipework arrangement should have a good 
degree of natural flexibility, but bellows should not be 
used. Joints should preferably be welded, but otherwise 
flanged. Butt-welded joints should be radiographed. Com¬ 
pressed asbestos fibre gaskets have been used satisfactorily. 

Liquid phosgene may be transferred by pumping or inert 
padding gas. For pumping, glandless pumps should be 
used. These are suitable for phosgene concentrations down 
to 5% and for lower concentrations also. Particular atten¬ 
tion should be paid to avoidance of cavitation and provision 
of sufficient net positive suction head (NPSH). 

Due to its high solubility in liquid phosgene, nitrogen 
may be unsuitable as a padding gas. Any gas used should 
be dry, with a dewpoint less than — 30°C. Measures should 
be taken to prevent contamination of the padding gas sup¬ 
ply, preferably by the use of a supply exclusive to the 
phosgene plant. 

Reciprocating compressors are used to compress phos¬ 
gene vapour, but it is necessary to take special measures to 
prevent contact between phosgene and lubricating oil. Use is 
also made in phosgene systems of fans and vacuum pumps. 

Relief disposal should be to an expanse tank or to a gas 
absorption system, but not to atmosphere. 

A phosgene plant should normally have two separate gas 
absorption systems, one to handle process vents and one 
for emergency reliefs. The former should be designed for 
flows with high concentrations of inerts but low con¬ 
centrations of phosgene and the latter for flows with higher 
concentrations of phosgene. The use of a dedicated 
absorption system for relief flows guards against corrosion 
and blockage of the relief lines by materials vented from the 
process. The phosgene content of gas leaving the gas 
absorption system should be monitored. 

With regard to relief devices, pressure relief valves and 
carbon bursting discs both have some disadvantages for 
phosgene duties, but either is suitable with good design. A 
bursting disc alone risks imposing a sudden high load on 
the gas absorption system. An acceptable arrangement is a 
bursting disc followed by a pressure relief valve with an 
alarm on the intermediate space to detect disc failure. 

For pipelines an alternative relief device is an expansion 
bottle. These bottles are fitted to the top of the pipeline at 
regular intervals and each is isolated from it by a bursting 
disc. There should bean alarm on the bottle space to detect 
disc failure. 

The use of water or steam in direct heat exchange with 
phosgene should be avoided due to the possibility that 
water will leak into the phosgene stream. 

Liquid phosgene may be stored under pressure or refrig¬ 
erated. The Code states that plant for handling and storage of 
phosgene should be kept simple, even if this means storing 
liquid phosgene under pressure, that storage vessels for 
liquid phosgene should be pressure vessels and that the 
contents of a pressure storage vessel should be kept below 
8°C in order to reduce the risk of overloading the gas absorp¬ 
tion system due to flash-off if pressure has to be reduced. 

11.11.12 Vinyl chloride 

Vinyl chloride (VC), or vinyl chloride monomer (VCM), is 
the subject of Precautions against Fire and Explosion: Vinyl 
Chloride (CIA, 1978 PA15) (the CIA Vinyl Chloride Guide). 


The toxicity of vinyl chloride is treated in Vinyl Chloride: 
Toxic Hazards and Precautions (HSE, 1992 a-d EH 63). 
Accounts are also given in Vinyl Chloride and PVC Manu¬ 
facture (Sittig, 1978) and by Cowfer and Magistro (1983). 

Vinyl chloride was originally produced by the gas phase 
reaction of acetylene and hydrogen chloride. It is now made 
almost entirely by the cracking of ethylene dichloride and 
oxychlorination of ethylene. These two processes are 
generally operated in combination, with the hydrogen 
chloride from the cracking of ethylene dichloride being 
reacted with air or oxygen in the oxychlorination process 
to produce more vinyl chloride. Vinyl chloride is poly¬ 
merized to polyvinyl chloride (PVC) and also used to make 
copolymers. 

Vinyl chloride has a normal boiling point of —13.9°C. It is 
frequently handled as a liquefied gas under pressure. In 
this condition, liquefied vinyl chloride gives on release a 
flashing liquid. Vinyl chloride is flammable, the flammable 
range being 3.6—33%. 

Vinyl chloride is toxic and has a long-term maximum 
exposure limit of 7 ppm. The toxicity of vinyl chloride was 
not fully appreciated until the mid-1970s. The discovery of 
its toxicity, and in particular its carcinogenic properties, 
presented the industry with a problem which, although 
quite different in nature, was of the same order of magni¬ 
tude as that caused by the vapour cloud explosion at Flix- 
borough.The decomposition products of vinyl chloride in a 
fire include hydrogen chloride and phosgene, which are 
both toxic, particularly the latter. As its full title indicates, 
the Vinyl Chloride Guide deals with the fire and explosion 
but not the toxic hazards of vinyl chloride. 

In the handling of vinyl chloride, it is necessary to ensure 
that air is excluded. Air can cause the formation of vinyl 
chloride polyperoxides, which appear as a yellow oil or 
rubbery solid and which detonate on mild impact. Oxygen 
also catalyses the polymerization of vinyl chloride. Vinyl 
chloride can be stored unstabilized if air is excluded, but 
addition of inhibitor should be considered if this cannot be 
assured. On the other hand, in the absence of other sub¬ 
stances, water in vinyl chloride does not constitute any 
special hazard, although it may cause contamination of the 
product with rust. 

Change of phase, either condensation or boiling, of vinyl 
chloride can be hazardous. One hazard is a sudden pressure 
rise, another concentration of impurities and a third poly¬ 
merization. The Code details measures for safeguarding 
against these hazards. 

Materials of construction for vinyl chloride plants are 
mild steel and for polymerization plants stainless steel. 
Other materials which may be used where other substances 
are present in addition are described in the Code. Joints on 
pipework should be welded or flanged. 

Liquid vinyl chloride may be transferred by pumping 
or inert padding gas. Pumps with fine clearances 
should be avoided as these can give trouble due to poly¬ 
merization. Particular attention should be paid to avoid¬ 
ance of cavitation and provision of sufficient NPSH and to 
the pump seals. For padding, the gas normally used is 
nitrogen. 

Compressors used for the compression of vinyl chloride 
vapour should be such as to ensure exclusion of air. 

Relief flows may be sent to a gas absorption system, a 
flare or an atmospheric vent, if permitted. Both combustion 
at a flare and combustion following accidental ignition of a 
vent generate hydrogen chloride, which is toxic. 
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A suitable relief device for vinyl chloride is a bursting 
disc followed by a pressure relief valve, or possibly a sec¬ 
ond bursting disc. The design should allow for the possibil¬ 
ity of polymerization in the pipework leading to the relief 
device and at the device itself. 

Plant handling vinyl chloride should preferably be 
located outdoors, but where it has to be indoors with the 
attendant hazard of an indoor release of flammable mate¬ 
rial, consideration should be given to requirements for 
ventilation and explosion relief of the building. 

Storage of vinyl chloride may be in pressure or refri¬ 
gerated storage. 

11.11.13 Some other chemicals 

Some other leading inorganic chemicals are covered in Bro¬ 
mine and Its Compounds (Qolles, 1966) and Nitric Acid and 
Fertiliser Nitrates (Keleti, 1985). Accounts of some principal 
organic chemicals include Propylene Oxide (Jefferson Che¬ 
mical Company, 1963), Propylene and its Industrial Deriva¬ 
tives (Hancock, 1973), Benzene and its Industrial Derivatives 
(Hancock, 1975), Benzene (Cheremisinoff and Morresi, 
1979), Toluene, the Xylenes and their Industrial Derivatives 
(Hancock, 1982), Maleic Anhydride (Trivedi and Culbertson, 
1982), mil Formaldehyde (Clary, Gibson andWaritz, 1983). 

Polymers are treated in Encyclopaedia of PVC (Nass, 
1976—), Vinyl Chloride and PVC Manufacture (Sittig, 1978), 
Encyclopaedia of PVC (Nass and Heiberger, 1986), Encyclo¬ 
paedia of Polymer Science and Engineering (Mark etal, 1989) 
anAHandbook of Polyolefins (Vasileand Seymour, 1993). 

11.12 Particular Processes and Plants 

The chemical and petrochemical industries operate a great 
variety of processes and plants, many of them highly 
interconnected. There are certain processes and plant 
which have particular hazards, which feature prominently 
in the safety and loss prevention literature and which are 
appropriate to consider here. These are: 

(1) air and oxygen plants; 

(2) ammonia plants; 

(3) ammonium nitrate plants; 

(4) methanol plants; 

(5) olefins plants; 

(6) LPG and LNG installations; 

(7) petroleum refineries and gas processing plants. 

Descriptions of the first three types of plants and 
the associated hazards and precautionary measures are 
given in Operating Practices in Air and Ammonia Plants 
(1961-62/27-28), in the series Safety in Air and Ammonia 
Plants (1960—69/17—26) and Ammonia Plant Safety and 
Related Facilities (1970-1994/31-52), in Survey of Operating 
Practices in Thirty-one Ammonium Nitrate Plants (AIChE, 
n.d./15), and in Safe Operation of Ammonia and Ammonium 
Nitrate Plants by the American Oil Company (Amoco/9). 

Selected references on particular processes and plants 
and their hazards are given in Table 11.10 and selected 
references on ammonia, urea and ammonium nitrate plants 
and their hazards are given in Table 11.11. 

11.12.1 Air separation plants 

In addition to the references just given, there are accounts 
of air separation plants by Newton (1979), A.H.Taylor (1981) 
and Kirschner (1991). 


Air separation plants can produce both oxygen and 
nitrogen. Each of these products may be in either gaseous 
or liquid form. Large amounts of oxygen are used in the 
chemical industry in oxidation processes and in the steel 
industry in both the blast furnace and steel-making pro¬ 
cesses. Nitrogen is used in large quantities as a synthesis 
gas and for gas washing, inerting and purging. 

An air separation plant is an integral part of an ammonia 
plant where the hydrogen for the synthesis gas is obtained 
from a hydrogen-rich stream or by partial oxidation of 
hydrocarbons. Hydrogen from partial oxidation or from 
processes such as coke ovens, catalytic reformers or elec¬ 
trolysis plants is purified by washing in liquid nitrogen, 
which removes hydrocarbons and carbon monoxide. 
Nitrogen is then added to the hydrogen to form synthesis 
gas. The oxygen and nitrogen for these processes are 
obtained from an air separation plant. 

Air separation is carried out by compression, liquefac¬ 
tion and distillation of air. If the products are gases near 
ambient temperature, the refrigeration required is small 
and is principally to cover heat inefficiencies and losses, 
but if they are liquids, there is a much larger refrigeration 
requirement. This refrigeration is produced by compress¬ 
ing the air and then expanding it through a valve, using the 
Joule—Thomson effect, or in an expansion engine. The 
plant is contained in an insulated cold box. 

Low pressure plants operate in the approximate 
pressure range 5—10 bar and intermediate pressure range 
10-45 bar. The temperatures are low with nitrogen being 
separated at about -190°C. 

There are two main hazards in an air separation plant. 
These are that: (1) liquid oxygen reacts with any combus¬ 
tible material with explosive violence and (2) hydrocarbons 
may accumulate in the liquid oxygen and give an explosive 
reaction. Combustible materials with which liquid oxygen 
may react violently include wood, lubricating oils, greases 
and graphite. 

Impurities which may enter the plant and accumulate in 
the liquid oxygen in the distillation column reboiler include 
methane, ethane, ethylene and acetylene. These hydro¬ 
carbons have a very low solubility in oxygen and therefore 
tend to precipitate out as solids. The solubility of acetylene 
in liquid oxygen, for example, is only 7 ppm. The solid 
hydrocarbons are then liable to react explosively with the 
oxygen. If nitrogen oxides, especially nitric oxides, are 
present, they catalyse this reaction. 

Precautions which are necessary in liquid air plants, 
therefore, include the elimination of combustibles, both 
in the construction and operation of the plant, use of clean 
air and purification of this air, avoidance of build-up of 
contaminants in the liquid oxygen and safe disposal of the 
liquid oxygen. 

In order to eliminate the combustible materials, equip¬ 
ment is degreased before installation. Grease and graphite 
materials are not used for pipe joints and gaskets contain¬ 
ing graphite are not used for pipe flanges. Every effort is 
made to ensure that items such as wood, clothing or rags 
are not left inside the plant. Measures are taken to reduce 
the risk of hydrocarbon lubricating oils being carried into 
the low temperature section from the main compressors. 
Non-flammable lubricants are used for applications such as 
liquid oxygen pump seals. 

Air is taken from an area which is not contaminated 
by hydrocarbons or nitrogen oxides. Methods of purifying 
the air in the air intake include catalytic combustion of 
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Table 11.10 Selected references on particular 
processes and plants and their hazards 


Chemical processes 

Groggins (1952); Santini (1961); Kirk and Othmer 
(1963—, 19781991 ■-); Faith, Keyes and Clark (1965); 

Gait (1967); Goldstein and Waddams (1967); Long (1967); 
Shreve (1967); Hahn and Williams (1970); Kuhn (1971); 
Considine (1974); Hobson and Pohl (1975); Lowenheim 
and Moran (1975); British Petroleum Company (1977); 
Financial Times (1979); Wei, Eraser and Swartzlander 
(1978); E.R. Kane (1979); Benn Publications Ltd (1980); 

G.T. Austin (1984); Meyers (1986a) 

Air and oxygen plants 

American Oil Company (n.d./9); Anon. (1960d); AlChE 
(1960-69/3-12,1961-62/13,14); C.P. Anderson (1960); 
Rotzler et al. (1960); Gardner (1961); Matthews (1961); 

G.T. Wright (1961); Brink (1962); Lang (1962,1965); 

T.R. McMurray (1962); Ball (1963,1964,1965,1966a,b, 
1968a); Guccione (1963); Matthews and Owen (1963); 
Rendos (1963,1964,1967); Calvert (1967); Eschenbrenner, 
Thielsch and Clark (1968); van der Ende (1969);Tanne 
(1970); NASA (1972-); Booth (1973); Goller (1974); LAir 
liquide (1976); Honti (1976); Springman (1977); Newton 
(1979); Wolff, Eyre and Grenier (1979); C. Butcher (1989c); 
CGA (1989 P- 8); NFPA (1990 NFPA 50); Dunrobbin, Werley 
and Hansel (1991); Kirschner (1991); Shelley (1991) 
Impurities: Bollen (1960); Coleman (1961,1962); Karwat 
(1961a,b, 1963); Kerry and Hugffl (1961); Ball (1962,1965, 
1966b); M.H. Jones and Sefton (1962); Schilly (1962); 
Hofmaier (1963); Parks and Hinkle (1963); McDonnell, 
Glass and Daues (1967) 

Petrochemical plants, olefins plants 

OIA (Loss Inf. Bull. 1, Publ. 301,1972 Loss Inf. Bull. 2,1974 
Publ. 101); Hydrocarbon Processing (1963-); Prescott 
(1966); Stobaugh (1966c, 1967a,b, 1988); R.F. Phillips 
(1967); Feldman and Grossel (1968); Lofthouse (1969); 

J.F. Tucker (1969); Loftus (1970); Sugai (1970); de Blieck, 
Cijfer and Jungerhans (1971); Silsby and Ockerbloom (1971); 
Gambro, Muenz and Abrahams (1972);Wilkson and 
Dengler (1972); Dewitt etal. (1974); Stork, Abrahams and 
Rhoe (1974); Zdonik, Bassler and Hallee (1974); Barlow 
(1975); Fuge and Sohns (1976); Barker, Kletz and Knight 
(1977); Hydrocarbon Processing (1977,1981,1985,1987b, 
1991b, 1993c); Barnwell (1979); Maples and Adler (1978); 
Boyett (1979); Geihsler (1979); Picciotti (1978,1980); 
Wilkinson (1979); Burchell (1980); Bockmann, 
Ingebrigtsen and Hakstad (1981); Ahearne (1982); 
Albright, Crynes and Corcoran (1983); Ng, Eng and Zack 
(1983); Walter (1983); Zack and Skamser (1983); Zdonik and 
Meilun (1983); Eng and Barnes (1984); Gfflett (1984); Kister 
and Townsend (1984); Maddock (1984); R.V Parker (1984); 
C.Tayler (1984a); API (1985 Std 2508); van Camp etal. 
(1985); Wett (1985); Anon. (1986o); List (1986); Redman 
(1986b); Short (1986); Kister and Hower (1987); Plehiers, 
Reyniers and Froment (1990);Wiedeman (1992); Olivo 
(1994a,b); Shelley (1994) 

Gas, gas plants, including industrial utilization 

AGA (Appendix 28); BG (Appendix 27,28,1978 Comm. 
1110,1989 Comm. 1404); IGasE (Appendix 28, n.d./6,1978 
IGE/TM/2,1985 IGE/TM/2A); Gas Council (1960); Kintz 
and Hill (1960 BM Bull. 588);Tiratsoo (1967); D.S.Wilson 
(1969); Anon. (19721); Bresler and Ireland (1972); Crossland 


(1972); Hart, Baker and Williams (1972); Thornton, Ward 
and Erickson (1972); BP Ltd (1973); J.A. Gray (1973); Jockel 
andTriebskorn (1973); Wall (1973); Walters (1973); Anon. 
(1974c); Medici (1974); API (1975 RP 50); Hydrocarbon 
Processing (1975,1984a, 1986b, 1988b, 1990b, 1992b); 
Franzen and Goeke (1976); IChemE (1976/65); Sharpe 
(1976); Detman (1977); Caldwell, Eifers and Fankhanel 
(1978); Pritchard, Guy and Connor (1978); UN (1978); 

J.A. Gray (1980); Meyers (1984); Reren (1987); Melvin 
(1988); NFPA (1992 NFPA 54,1992/32) 

Coal-based plants 

Hoffman (1978); O’Hara et al. (1978); J.P. Leonard and 
Frank (1979); Pitt and Mfflward (1979); C.L. Reed and 
Kuhre (1979); IBC (1981/12); J.M. Evans and Verden (1982); 
Merrick (1983); Norton (1984) 

Methanol plants 

Royal and Nimmo (1969); AlChE (1970/73); Hedley, 

Powers and Stobaugh (1970); Killer and Marschner (1970); 
Mehta and Ross (1970); Prescott (1971); Pettman and 
Humphreys (1975); Supp (1981);Wade etal. (1981); 

Meinhold and Laading (1983); Kobayashi, Kobayashi 
and Coombs (1986) 

Oil, oil refineries 

API (Appendix 27, 28,1983 Publ. 999); ASME (Appendix 
28 Hydrocarbon Processing ); HSE (Appendix 28 Oil 
Industry ); IP (Appendix 27, 28, Oil Data Sheets,TP series, 
1968-/1,1980 Eur. MCSP, 1981MCSP Pt 3,1984/2); 

OIA (see Appendix 28); Shell International Petroleum Co. 
(1933-);WL. Nelson (1958); Hydrocarbon Processing 
(1962-, 1984b, 1986c, 1988c, 1990c, 1992); J.R. Hughes 
(1967,1970); Adelman (1972); Anon. (1975m); J.A. Price 
(1962); Vervalin (1964a, 1973a); Crowe and Marysiuk (1965); 
Albright (1966a,c); Forry and Schrage (1966); Bland and 
Davidson (1967); Good (1967); Dosher (1970); Hobson and 
Pohl (1975); Verde, Moreno and Riccardi (1977); Cantrell 
(1982); M. Sherwood (1982); Shell (1983); Gary and 
Handwerk (1984); IBC (1985/62,1993/105); Loubet (1986); 
Meyers (1986b) 

Polyethylene plants 

Albright (1966d,f, 1967a,c); Foreman (1972); AlChE (1973/ 
62,1974/63,1978/64); Fitzpatrick (1973,1974); Guill (1973); 
Hatfield (1973); Marzais (1973); O’Hara and Poole (1973); 
O’Neal, Elwonger and Hughes (1973); Royalty and Woosley 
(1973); Ziefle (1973); Afzal and Livingstone (1974); Mauck 
and Tomita (1974); R.F. Murphy (1974); Prentice, Smith 
and Virtue (1974);Traversari and Beni (1974); Watson (1974); 
Beret, Muhle and Villamil (1978); Olivier and Scheuber 
(1978); H.S. Robinson (1978); Sandner (1978); Siegel (1978); 
Yasuhara, Kita and Hiki (1978); Chriswell (1983); 

Redman (1991) 


hydrocarbons and adsorption of hydrocarbons and nitro¬ 
gen oxides. 

Build-up of contaminants in the liquid oxygen is mini¬ 
mized by the avoidance of pockets where liquid oxygen 
accumulates, by running oxygen reboiler tube plates 
always flooded and by continuous blowdown of liquid 
oxygen into an auxiliary vaporizer. 

If the air supply becomes contaminated, it may be 
necessary to stop air supply to the plant. Under these con¬ 
ditions heat leaks into the plant and causes liquid oxygen to 
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Table 11.11 Selected references on ammonia, 
urea and ammonium nitrate plants and their hazards 


Ammonia plants 

American Oil Company (n.d./9); Anon. (1959b), 1960d); 
Harding (1959); AlChE (1960-69/3-12,1961-62,13,14, 
1964/15,1970-77/17-38); Bresler and James (1965); 
Guccione (1965b); Wrotnowski (1965); B. Powell (1967); 
Badger (1968); Eschenbrenner,Thielsch and Clark (1968); 
Finneran, Sweeney and Hutchinson (1968); Quartulli, 
Fleming and Finneran (1968); Vancini (1971); Finneran, 
Buividas and Walen (1972); Sawyer, Williams and Clegg 
(1972); K. Wright (1973); J.F. Anderson (1974); Sawyer and 
Williams (1974); Webb (1974); Atwood (1976); Butzert (1976); 
Hess (1976); Ostroot (1976a); Partridge (1976); Wheeler 
(1976); K.A. Carter etoL (1977); Gilbert and Eagle (1977); 
R.W. James (1977); Livingstone (1977,1989); Akitsune, 
Takahashi and Jejuna (1978); Attwood, Lombard and 
Merriam (1978); Banks (1978); Gadsby and Livingstone 
(1978); Hager, Long and Hempenstall (1978); Kusha (1978); 
Nakano (1978);Wakabayashi (1978); G.P. Williams (1978); 
Bishop and Mudahar (1979); Czuppon and Buividas (1979); 
Farinola and Langana (1979); Ricci (1979b); Archambault, 
Baldini and Train (1980); Butwell, Kubek and Sigmund 
(1980); Colby, White andNotwick (1980); Handley (1980); 
Kokemor (1980); Setoyama,Wadar and Funakoshi (1980); 
Swanson (1980); Buividas (1981); Moon, Mundy and Rich 
(1981); Saviano, Lagana and Bisi (1981); C.P.P. Singh and 
Saraf (1981); Strelzoff (1981); Hodgson (1982); A. Nielsen 
etd. (1982); Reddy and Husan (1982); Anon. (1983q); 
Livingstone and Pinto (1983); G.P. Williams and Hoehing 
(1983); Atwood (1984); Facer and Rich (1984); Kolffand 
Mertens (1984); Prijatel (1984); Rohlflng (1984); Grotz, 
Gosnell and Grisolia (1985); Ruziska etal. (1985); Erskine 
(1986); Song (1986); Josefson (1987); Madhavan and Sathe 
(1987); W.K.Taylor and Pinto (1987); G.B.Williams, Hoehing 
and Byington (1987); Epps (1988); Madhavan and Kirsten 
(1988,1989); Madhavan and Landry (1988); Mall (1988); 
Kershaw and Cullen (1989); Short (1989); Armitage etal. 
(1992); Czuppon, Knez and Rounes (1992) 

Converters 

W.D. Clark and Mantle (1967); Eschenbrenner and 
Wagner (1972); Appl, Feind and Liebe (1976); Casey (1976); 
Kusha and Lloyd (1976); W.D. Clark (1977); Dye (1977); 

J.A. Lawrence (1977); Patterson (1977); R.L. Thompson and 
Brooks (1977); Wahl and Neeb (1977); B.R. Phillips (1979); 
Rao.Wiltzen and Jacobs (1986); Karkhanis and van Moorsel 
(1987); Mack and Shultz (1987); Shimagaki etal. (1987); 
Veazey and Winget (1989) 

Catalysts 

A. Nielsen (1964); Comley (1968); D.W. Allen (1969); 
Cromeans and Knight (1969); J.W Marshall (1969); Delong 
(1971); Fleming and Cromeans (1971); Scharle, Salot and 
Hardy (1971); Cromeans and Fleming (1972,1976); K. Wright 
and Haney (1972); Salot (1973); R.L. Thompson (1973); 

PW Young and Clark (1973); Bridger (1976); Collard (1976); 
Lundberg (1979); Dybkjaer etal. (1980); Prince and Odinga 
(1986); Mukheriee et al. (1988) 

Reformers 

Francis (1964); Adams (1967); Pennington (1968); Kobrin 
(1969,1978); Bongiorno, Connor and Walton (1970); 
Ballantyne (1972); Salot (1972,1975); Lombard and 
Culberson (1973); Fuchs (1974); Demarest (1975); Fuchs and 


Rubinstein (1975); E.R. Johnson (1975,1977); Leyel (1975); 
Sterling and Moon (1975); MacMfflan (1976);Tendolkar, 
Sitaraman and Ponnuswamy (1976); Blackburn (1977); 
Hundtofte (1978);Thuillier and Pons (1978); Hasaballa 
(1981); Connaughton and Clark (1984); Ennis and Le Blanc 
(1984); G.M. Lawrence (1984); Roney and Persson (1984); 
Schlichtharle (1984); Scherf and Novacek (1985); Schuchart 
and Schlichtharle (1985); Gupton, Stal and Stockwell 
(1986); McCoy, Dillenback andTraux (1986); Vick (1987); 
Orbons (1988); Cromarty (1992) 

Materials of construction 

Speed (1966); W.D. Clark and Mantle (1967); Dial (1968); 
G.R. James (1968); A. Nielsen (1971); Hutchings et al. (1972); 
van der Horst (1972); Atkins, Fyfe and Rankin (1974); Zeis 
(1975); Appl and Feind (1976);Tendolkar, Sitaraman and 
Ponnuswamy (1976); W.D. Clark and Cracknell (1977); 
Jordan and Rohlflng (1979); Moniz (1985); Barkley (1986); 
Krishr (1986); Shibasaki etal. (1987); van Grieken (1989); 
Vilkus and Severin (1989) 

Pipework 

Coats (1967); Chaffee (1970); Appl (1975); Luddeke (1975); 
Mitcalf (1975); Wicher (1975); Janssen (1976); Osman and 
Ruziska (1976); Hakansson (1977); Isbell (1977); Pebworth 
(1977); Batterham (1985); El Ganainy (1985); G.M. 
Lawrence (1986); Legendre and Solomon (1986); Prescott, 
Blommaeth and Grisolia (1986); Sotebier and Rail (1986); 
Schwarz and Spahn (1988); Veazey and Winget (1989); 
Nightingale (1990) 

Compressors 

Deminski and Hunter (1962); Penrod (1962); Deminski 
(1964a,b); Morain (1964); Ball (1965); Wrotnowski (1965); 
Hile (1967); Stafford (1971); Kusha (1977);Tipler (1979); 
Verduijn (1979); A.G. Smith etal. (1985); Fromm and Rail 
(1987a); G.R. Thomas (1987); Whiteside (1987); Kumar and 
Grewal (1988); J.B. Smith and Paulson (1989); Bergenthal, 
Fromm and Liebe (1990); Iliadis (1990); Leingang and 
Vick (1992) 

Other equipments 

Linton and Brink (1967); Roney and Acree (1973); 

WD. Clark (1976a); Edmondson (1977); Rail and Fromm 
(1986); Karkhanis and van Moorsel (1987); Cagnolatti 
(1988); Mukherjee, Ghosh and Chatterjee (1992) 

Control and instrumentation 

Daigre and Nieman (1974); van Eijk (1975); Pebworth and 

Wickes (1975); Prijatel (1984) 

Spillages 

Kalelkar and Cece (1974); Feind (1975); O’Driscoll (1975a); 
Raj etal. (1975);W.D. Clark (1976b) 

Urea plants 

Reynolds and Trimarke (1962); Croysdale, Samuels and 
Wagner (1965); Walton (1965,1966,1967); J.F. Anderson 
(1967); Mavrovic (1974); Dooyeweerd (1975); W.D. Clark and 
Dunmore (1976); Otsuka, Inoue and Jojima (1976); Bress 
and Packbier (1977); Cabrini and Cusmai (1977); Jojima 
(1980); Khadra (1980); P.C. Campbell (1981); Luetzow (1989) 
Ammonium nitrate plants 

American Oil Company (n.d./9); Commentz et al. (1921); 
Cronan (1960c); AlChE (1966/16); van Dolah etal. (1966 BM 
RI6773); Huijgen and Perbal (1969); Hansen and Berthold 
(1972); Perbal (1983); FMA (1989); NFPA (1993 NFPA 490) 
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evaporate and contaminants to concentrate. There is 
therefore a certain time period after which hazardous con¬ 
centrations of contaminants may accumulate. Thus there 
need to be arrangements for the discharge of the plant 
liquids. 

Contaminants which accumulate in the plant may be 
removed by regular cleaning. This involves heating up the 
plant with warm air, which vaporizes the contaminants. 
The accumulation of contaminants is reduced if the insu¬ 
lation is efficient. The cold box is kept at a positive pressure 
by air, so that water vapour does not enter and freeze in the 
insulation, thus making it less effective. The air used has to 
be free of hydrocarbons. 

The small bore instrument and sampling pipework inside 
the cold box is vulnerable to fracture when insulation is 
being put in. A suitable precaution is to do this work with 
the lines under a low nitrogen pressure so that a fracture can 
be detected by a fall in pressure. A further hazard is the 
twisting of the tubing when work is being done on tubing 
which extends through the cold box wall. The likelihood of 
this may be reduced by the use of back-up wrenches. 

Materials of construction used in air separation plants 
include aluminium, copper and stainless steel. Mild steel 
is not used in applications where it may undergo low 
temperature embrittlement or may oxidize as a result of 
a liquid oxygen leak. This applies to its use not only in 
vessels and pipework but in supports also. 

Tarmacadam road surfaces are avoided in areas where 
liquid oxygen may spill. Oily or greasy clothing is also 
avoided. 

11.12.2 Ammonia plants 

Treatments of ammonia and ammonia plants have been 
referenced in Section 11.11. Additional accounts of ammo¬ 
nia manufacture are given in Technology and Manufacture of 
Ammonia (Strelzoff, 1981) and by Bakemeier et al. (1985) 
and Czuppon, Knez and Rounes (1992). 

Large tonnages of ammonia are used directly in liquid 
form as a fertilizer and as a chemical raw material for the 
production of other fertilizers such as ammonium sulfate, 
ammonium nitrate and ammonium phosphate, of explo¬ 
sives such as ammonium nitrate, of inorganic chemicals 
such as nitric acid and hydrogen cyanide and of organic 
chemicals such as acrylonitrile. Other uses are described in 
Section 11.11. The basic ammonia synthesis reaction is: 

N 2 + 3H 2 -► 2NH 3 

There are a number of processes for ammonia synthesis. 
The differences between these are partly in the source 
of hydrogen and partly in the operating conditions and 
synthesis converter design. 

As already described, hydrogen is generally produced 
by steam reforming of natural gas or naphtha or partial 
oxidation of fuel oil or from a hydrogen-rich stream from 
the low temperature separation section of a petroleum or 
coke oven plant, or from a chlorine cell-room. Nitrogen is 
normally obtained either from an air separation plant or 
from air which has been burned to remove the oxygen. 
Some 75- 80% of ammonia production worldwide uses 
steam reforming and of this some 65-70% is based on a 
natural gas feedstock. 

In the steam reforming of natural gas, the principal pro¬ 
cess steps are feedstock purification, primary and second¬ 
ary reforming, shift conversion, carbon dioxide removal, 


synthesis gas purification, synthesis gas compression, 
ammonia synthesis and recovery 

Following purification, the natural gas is reacted with 
steam in a primary reformer, which consists of a tubular 
reactor placed vertically in the furnace and packed with 
nickel catalyst. The reaction, which takes place in the 
temperature range approximately 700-800°C, is strongly 
endothermic, requires a substantial heat input and pro¬ 
duces a mixture of hydrogen, carbon dioxide and carbon 
monoxide: 

2CH4 + 3H 2 0 -> 7H 2 + C0 2 + CO 

Air is injected into this gas as it enters the secondary 
reformer, which is an internally insulated vessel filled with 
nickel catalyst operating at a temperature above 1100°C. 
Combustion of the air provides the heat for completion of 
the reaction and nitrogen to form the synthesis mixture. 
The air flow is adjusted to give this correct synthesis gas 
composition. The gas is then passed through a shift con¬ 
verter to assist the reaction of steam and carbon monoxide 
to hydrogen and carbon dioxide: 

H 2 0 + CO —> H 2 + C0 2 

Carbon dioxide and carbon monoxide are removed from the 
gas by various purification processes. The synthesis gas 
then passes to the compression section. 

In the ICILCA process a variation is introduced in which 
the primary reformer can be greatly reduced in size or even 
eliminated by waste heat reforming, in which part of the 
reforming is carried out in a reforming heat exchanger 
utilizing waste heat from the secondary reformer. 

In partial oxidation, a similar hydrocarbon feed and 
oxygen from an air separation plant are preheated sepa¬ 
rately and reacted in non-catalytic gas generators at a tem¬ 
perature above 1100°C. The reaction is: 

2CH4 + 0 2 —> 4H 2 + 2CO 

The gas is cooled, followed by the shift reaction and puri¬ 
fied of carbon dioxide and carbon monoxide by processes 
similar to those used in steam reforming. It is then cooled 
and washed with liquid nitrogen to remove traces of impu¬ 
rities. The gas is then adjusted in composition by addition 
of further nitrogen and passes to the compressors. 

If the hydrogen is the off-gas from a refinery reformer, 
it is purified, dried and then washed with liquid nitrogen. 
After adjustment of the gas composition by further 
nitrogen addition, this synthesis gas enters the com¬ 
pressors. 

The synthesis gas is then compressed. Whereas recipro¬ 
cating compressors were a feature of earlier ammonia 
plants, on modern plants centrifugal compressors are 
used for compression of the synthesis gas. They are usually 
driven by steam turbines. 

Following compression, the synthesis gas enters the 
ammonia converters, which on large plants are multiple- 
bed.There are a variety of designs which differ in respect of 
the flow pattern, the method of temperature control and the 
reaction heat recovery. The reaction takes place on an iron 
catalyst, is exothermic and gives a conversion of about 
25%. The ammonia formed is condensed out by cooling the 
exit gases, which are recycled to the converter. 
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The ammonia synthesis is one of the classic high pres¬ 
sure processes, but the pressure at which ammonia con¬ 
verters operate has tended to fall. In plants designed before 
the mid-1960s synthesis converters operated at pressures 
up to about 340 bar (5000 psi), but the operating pressure 
in large plants is now of the order of 150 bar (2200 psi). 

Up to about 1960, ammonia plants were of relatively low 
capacity operating at high pressures obtained using 
reciprocating machines. The early 1960s saw the introduc¬ 
tion of the Kellogg single-stream ammonia plant using 
centrifugal compression and with an output of 544 t/day. 
This involved a step change in the scale and technology of 
ammonia plants and was one of the first examples of the 
large, single-stream plant. By the 1970s single-stream 
ammonia plants with a capacity of 1500 t/day were becom¬ 
ing common. 

The hazards which are encountered in an ammonia plant 
depend somewhat on the process. But they include those of 
the chemicals (ammonia and hydrogen), of the operating 
conditions (high pressure, high temperature and low 
temperature), and of the pressure system components 
(furnaces and compressors). 

The hazards of and the precautions necessary with 
ammonia and hydrogen were considered in Section 11.11. 
Those associated with extreme operating conditions were 
discussed in Section 11.9 and those associated with pres¬ 
sure systems are dealt with in Chapter 12. 

11.12.3 Ammonium nitrate plants 

Ammonium nitrate is the subject of NFPA 490:1986 Stor¬ 
age of Ammonium Nitrate. Accounts of ammonium nitrate 
plants are given by Zapp (1985) and Weston (1992). 

Ammonium nitrate is used in large quantities as an 
agricultural fertilizer. It is also used as an explosive. Some 
of the worst disasters in the chemical industry have been 
ammonium nitrate explosions. These include the explosion 
at Oppau in 1921, which killed 561 people, and that in Texas 
City in 1947, in which 522 died. Further details are given in 
Case Histories A5 and A16, respectively. 

Despite these occurrences, ammonium nitrate is widely 
used. It is manufactured by neutralizing nitric acid with 
ammonia. The nitric acid is made by oxidation of anhy¬ 
drous ammonia by air on a platinum-rhodium gauze cata¬ 
lyst. The reaction gases are cooled and absorbed in water to 
give about 56—60% nitric acid. The temperature of the 
ammonia entering this converter needs to be kept above 
60°C in order to prevent liquid ammonia reaching the gauze 
and generating high temperatures, which may cause an 
explosion. The chloride content of the water entering the 
absorber has to be kept low to prevent formation of hydro¬ 
chloric acid, and thus aqua regia, which is highly corrosive 
to stainless steel, and to avoid the catalysis by chloride of 
thermal decomposition of ammonium nitrate. Nitric acid is 
extremely corrosive and may react explosively with carbo¬ 
naceous materials, so leaks require to be repaired promptly 

The nitric acid is neutralized with ammonia vapour. 
The reaction is exothermic and the heat liberated vaporizes 
water to produce 83-86% ammonium nitrate solution. 
Solutions of higher concentrations may be produced by 
further vaporization of water in evaporators. Concentrated 
ammonium nitrate solutions are blended with ammonia, 
additional water or urea as required to give ammonium 
nitrate-ammonia solutions. Alternatively, solid ammonium 
nitrate is produced by spray drying in a prilling tower or by 
concentrating to dry ness and spraying the molten nitrate. 


It is necessary to control closely the temperatures in 
ammonium nitrate neutralizers and evaporators. Although 
pure ammonium nitrate does not decompose rapidly below 
200°C, impurities can cause a significant reduction in the 
decomposition temperature. The temperature in the neu¬ 
tralizers and evaporators is therefore generally kept below 
135°C. In operating this plant, it is important not to produce 
dry ammonium nitrate, which can become hazardous if 
then heated further. 

Limitation of impurities is equally essential, since they 
increase the tendency of the ammonium nitrate to decom¬ 
pose. Impurities which sensitize decomposition include 
copper and zinc as well as nitric acid and chlorides. Solid 
ammonium nitrate is very hygroscopic and tends to cake 
into a large mass whichis difficult to handle. This is overcome 
by the use of a surface coating such as diatomaceous earth. 

Addition of carbonaceous materials to ammonium 
nitrate can turn it into a blasting agent. It is necessary, 
therefore, to keep materials such as hydrocarbons away 
from ammonium nitrate. The sensitizing effect of hydro¬ 
carbon surface coatings used to prevent caking is partly 
responsible for some of the worst explosions which have 
occurred in the past. Other serious accidents have occurred 
from the former use of explosives to loosen caked ammo¬ 
nium nitrate, as at Oppau. This is no longer done. 

The extent to which ammonium nitrate should he 
regarded as a high explosive was for some time a matter of 
debate. The matter was brought to a head when NFPA 490 
was first adopted in 1963. A distinction was drawn between 
fertilizer grade and explosive grade ammonium nitrate, the 
latter containing some 1% of organic material. In effect, the 
former was treated in the code as not being a high explosive 
(W.H. Doyle, 1980). Furthermore, under certain circum¬ 
stances ammonium nitrate exposed to fire can explode. 
For some time, the conditions necessary for an explosion 
were not well defined. Accounts of work on both these pro¬ 
blems have been given by van Dolah (1966 BM RI6903) and 
van Dolah et al. (1966 BM RI 6743,1966 BM RI 6773). 

If ammonium nitrate is heated to about 200°C, it begins 
to decompose and give off heat. This temperature may be 
lower if there are impurities present. Up to about 260°C 
the reaction is well behaved, but about this temperature 
decomposition becomes much more rapid. In a fire ammo¬ 
nium nitrate burns freely and does not explode. Thus over 
one three-year period records showed that 13 freight cars 
containing ammonium nitrate had burnt without explo¬ 
sion. Similarly, there have been several fires which have 
destroyed without explosion some five million pounds of 
ammonium nitrate stored in warehouses. But an explosion 
may occur if there is substantial confinement, so that high 
temperature and pressure can develop. The risk may he 
minimized by providing adequate spacing and ventilation 
in storages. 

There are certain precautions which should be taken in 
the storage, transport and handling of ammonium nitrate. 
For aqueous solutions, the hazard is mainly that of eva¬ 
poration of water to give a more concentrated solution. 
Precautions include limits on the strength of solutions 
stored and facilities for water addition. For bagged solids, 
the precautions required include spacing and ventilation, 
elimination of explosives and oxidizing materials, and 
avoidance of heat and ignition. In both cases, there should 
be prompt clearing up of spills. 

Ammonium nitrate fires should be fought by the appli¬ 
cation of large volumes of water. Steam should not be used 
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on an ammonium nitrate fire. The nitrate itself can supply 
enough oxygen, so that steam does not smother the fire, but 
only increases the temperature and the degree of hazard. 
Water sprinklers, fog nozzles and fire extinguishants such 
as foam or dry powder tend to be ineffective. In contrast 
to the situation with other fires in confined spaces, it may 
be advisable with ammonium nitrate fires to provide 
ventilation, so as to the reduce the chance of pressure and 
temperature build-up. 

11.12.4 Methanol plants 

Accounts of methanol production processes are given by 
Wade et al. (1981) and Fielder et al. (1990). Methanol is 
used in the production of a large range of organic chemi¬ 
cals, notably formaldehyde, methyl-f-butyl ether (MTBF), 
acetic acid, methyl methacrylate (MM) and dimethyl 
terephthalate. It is also finding use as a fuel, for which it 
has considerable potential. The basic methanol synthesis 
reactions are: 

CO + 2H 2 —> CH 3 OH 
C0 2 + 3H 2 —> CH3OH + H 2 0 

There are a number of processes for methanol synthesis. 
All are based on the conversion of hydrogen, carbon 
monoxide and carbon dioxide to methanol in the presence 
of a catalyst. The main differences lie in the source of 
hydrogen and in the catalyst and operating pressure of the 
synthesis stage. 

Sources of hydrogen were discussed above in the context 
of ammonia synthesis. For methanol, hydrogen is obtained 
mainly from natural gas, petroleum residues and naphtha. 
In 1980, some 70% of methanol production worldwide was 
based on steam reforming of natural gas. 

The principal reactions occurring in steam reforming are 
for methane: 

CH4 + H 2 0 - CO + 3H 2 
and for heavy hydrocarbons 
C«H(2„ +2 ) + {n — 1)H 2 —> ndU 
and the water gas shift reaction 
CO + H 2 0 - H 2 + C0 2 

The reaction is strongly endothermic, requires a sub¬ 
stantial heat input and produces a mixture of hydrogen, 
carbon monoxide and carbon dioxide. 

Steam reforming gives a hydrogen content higher than 
that required for the methanol reaction and processes differ 
in the way this feature is handled. In some, the hydrogen is 
burned whilst in others, an addition of carbon dioxide is 
made. The synthesis gas is then compressed by centrifugal 
compressors. 

At the synthesis stage, the pressure required depends 
on the activity of the catalyst used and these are the main 
sources of difference between processes. Three pressure 
ranges are distinguished: low pressure (50-100 bar), 
medium pressure (100-250 bar) and high pressure 
(250-350 bar). 

Up to the mid-1960s, methanol processes utilized rela¬ 
tively high pressures of the order of 350 bar obtained using 
reciprocating compressors. In 1966, ICI began operation of 
a low pressure methanol plant operating at 50 bar with 


an output of 400 t/day using all-rotating compression 
equipment. This plant set the pattern for subsequent 
developments. By 1980, a typical methanol plant was a 
single-stream plant, operating in the low-medium pres¬ 
sure range, using all-rotating compression equipment and 
with an output of 1000—2000 t/day. 

11.12.5 Olefins plants 

An account of olefins production processes is given in 
Ethylene (Kniel, Winter and Storck, 1980) and by Kniel, 
Winter and Chung-HuTsai (1980), Pike (1981) and Granton 
and Roger (1987). Olefins plants produce not only ethylene 
but other major co-products, including propylene and 
butadiene, and are the key units of a petrochemical works. 

The main hazard on an olefins plant is that of the flam¬ 
mable hydrocarbons. This hazard is simply stated, but has 
many aspects. The hydrocarbons are processed under 
pressure at both low and high temperatures, which increase 
the risk both of loss of containment and of formation of a 
vapour cloud which may cause a fire or explosion. 

Many aspects of olefins plants are discussed in Chapters 
10, 12, 20 and 22, which deal with plant layout, pressure 
system design, plant operation and storage, respectively. 
A review of the evolution of safety aspects of olefins 
plants has been given by Barker, Kletz and Knight (1977), 
who consider in particular the following aspects: (1) plant 
layout, (2) plant equipment, (3) pressure relief and (4) leak 
control. The authors discuss these features in relation to 
differences of practice on ICI’s successive olefins plants, 
particularly the then most recent plants, Nos 4 and 5. In the 
account given below, ‘policy’ refers to thinking described 
as ‘current’ in the paper by Barker, Kletz and Knight. 

On plant layout the policy is to space units so that an 
expected leak does not find a source of ignition (rather than 
to use rules-of-thumb), to increase the number of fire breaks 
and to put more equipment at grade level, where it is more 
accessible to inspection and to fire fighting. 

Electrical and instrument cables are vulnerable to flash 
fires and damage to cabling can cause extensive downtime. 
Whereas on No. 4 plant no special attention was paid to this 
aspect, on No. 5 plant in high risk areas cables are run 
in asbestos/galvanized steel troughs on the cable racks. 
Policy is to develop preformed reinforced concrete troughs. 

Defects in the drainage systems of early olefins plants 
were that insufficient care was taken in siting low points 
and gullies and that drains did not have sufficient capacity 
to carry away fire water. These deficiencies were rectified 
on the No. 5 plant, in which the high and low points and the 
drains are located so as to avoid pools of liquid under 
equipment and the drains are sized to take the quantities of 
water used to cool major vessels in and near a fire area. The 
plant, however, has conventional luted drains and some 
drains from roads and pebbled areas do not pass through 
the oil-water separator. The policy is to use fully flooded 
drains with no vapour space in which explosion can occur 
and with no lutes which can choke, to make extensive use of 
paving, and to take all drainage from roads and pebbled 
areas to the oil-water separator. 

With regard to process equipment, the early olefins 
plants had multiple reciprocating or spared centrifugal 
compressors. Current plants have single unspared 
machines. This requires the highest standard of design 
and operation. But it is very effective in reducing leaks. 

Another area where leaks can occur is on cold pump 
glands. The use of O-rings and the elimination of routine 
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pump changeovers have greatly reduced such leaks. Leak¬ 
age has been further reduced by the use of brazed alumi¬ 
nium plate fin heat exchangers instead of tubular heat 
exchangers on cold duties. It is necessary, however, to pro¬ 
vide these finned tube exchangers with special protection 
against fire damage. 

Developments in pressure relief include the reduction of 
the total amount of material to be released, reduction of the 
probability that hydrocarbons will be discharged to the 
atmosphere unburnt and improvements in the safety of 
unburnt discharges. 

Measures which can be taken to reduce discharge to the 
flare system include the more extensive use of trip systems 
and of higher design pressures for vessels such as low 
pressure catchpots. 

The No. 5 plant has two separate flare systems, and this 
practice would be repeated. One system is for wet streams 
and the other for cold, dry streams. Process gas can be 
dumped to either flare or via a process gas transfer system 
to the fuel gas system or to other flare systems. 

Various measures have been developed to reduce and 
control leaks. Both plants No. 4 and 5 have a leak detection 
system using Sieger detectors. There is a total of 140 detec¬ 
tors on the two units. Both plants are also provided with a 
steam curtain to dilute any vapour cloud which may escape 
from the plant. Extensive use is made of emergency isola¬ 
tion valves. The valves on No. 5 plant have been individu¬ 
ally listed and justified by Kletz (1975b). 

The possibility of hydrocarbons entering steam or con¬ 
densate systems is investigated and potential routes are 
classed as high or low risk. On high risk routes the risk is 
either eliminated completely or at least is reduced. Thus a 
tubular heat exchanger is high risk if it may be subjected to 
conditions such as low temperature, high pressure, vibra¬ 
tion or intermittent use. If, for example, a steam-heated heat 
exchanger might reach subzero temperatures during plant 
upsets, the practice would be to fit the steam supply with a 
check valve and the condensate system with a trip valve 
closed as appropriate by low level and/or low temperature. 

The authors list the following safety reviews which are 
made on olefins plants: (1) piping and instrument diagram, 
(2) electrical distribution, (3) relief and blow-down, (4) lay¬ 
out, (5) paving and drainage, (6) cable routing and protec¬ 
tion, (7) means of escape from structures and buildings, 
(8) fire fighting and (9) fire protection. 

The foregoing is a necessarily brief summary of the 
hazards of olefins plants and of some of the measures 
developed to deal with them. Many of the aspects men¬ 
tioned are considered in more detail in other chapters. 

A further account of loss prevention in an ethylene plant 
has been given by Olivo (1994a). 

11.12.6 LPG and LNG installations 

Propane and butane are stored in liquid form as LPG. They 
play an important part in the oil and chemical industries, 
which have large LPG storages. 

LPG is treated in An Introduction to Liquefied Petroleum 
Gas by the LPG Industry Technical Association (LPGITA, 
n.d.) and are the subject of a set of codes of practice, notably 
Installation and Maintenance of Fixed Bulk LPG Storage at 
Consumer Premises (LPGITA, 1991 LPG Code pt 1); the 
LPGITA is now renamed the Liquefied Petroleum Gas 
Association (LPGA). LPG is also covered in Storage of LPG 
at Fixed Installations (HSE, 1987a-d HS(G) 34) and in the 
Liquefied Petroleum Gas Safety Code (IP, 1987 MCSP Pt 9). 


It is the subject of NFPA 58:1989 Storage and Handling of 
Liquefied Petroleum Gases (also published as th e Liquefied 
Petroleum Gases Handbook) and NFPA 59:1989 Storage and 
Handling of Liquefied Petroleum Gases at Utility Plants. 
Further accounts of LPG are given by Selim (1981) and 
S.M. Thompson (1990). 

LPG is widely used as a fuel in general manufacturing 
industry, which therefore has a large number of LPG 
storage installations of various sizes. In general, these 
industries are not as well versed in the hazards of 
flammable materials as the chemical industry. 

Natural gas, which is mainly methane, has replaced coal 
gas as the gas supplied to industrial and domestic users by 
British Gas. Most of the gas is obtained from the North Sea, 
but some is imported as LNG. In contrast to LPG, the 
number of LNG installations is very small, but the quan¬ 
tities stored are large. There is sophisticated management 
of the hazard. 

LNG is the subject of NFPA 59A: 1990 Production, 
Storage and Handling of Liquefied Natural Gas and of LNG 
Materials and Fluids by the National Bureau of Standards 
(NBS, 1978), Liquefied Energy Gases Safety by the General 
Accounting Office (GAO, 1978), Liquefied Natural Gas: 
Safety, Siting and Policy Concerns (US Senate, 1978) and 
Liquefied Gas Handling Principles on Ships and in Terminals 
(McGuire and White, 1986). Further accounts of LNG are 
given by Boesinger, Nielsen and Albright (1980) and 
Hammer et al. (1991). Selected references on LPG and on 
LNG and their hazards are given in Tables 11.12 and 11.13 
respectively 

LPG and LNG installations present the hazards of fire 
and explosion. In view of the scale involved, the siting of a 
large LNG installation is a major planning matter, which is 
likely to involve a public inquiry. 

LNG is shipped to the storage terminals by specially 
designed vessels. The shipping of LNG involves the hazard 
that LNG may be spilled on the sea, may evaporate rapidly 
and may give a vapour cloud fire or explosion. This hazard 
has been a matter of much concern and has been the subject 
of considerable investigation. It is considered further in 
Chapters 16 and 17. 

Storages of LPG and LNG are among the installations 
which have been of particular concern in relation to inter¬ 
actions between hazardous plants. Thus, for example, 
LPG storages, if poorly sited, are a possible threat to 
nuclear reactors and LNG storages may be hazarded by 
other plants. The British Gas LNG terminal at Canvey was 
one of the installations investigated in the Canvey Report, 
which is described in Appendix 7. 

Closely related are synthetic fuels, or synfuels, including 
SNG. An account is given in Handbook of Synfuels Tech¬ 
nology (Meyers, 1984). 

11.12.7 Petroleum refineries and gas processing plants 

Petroleum refining and gas processing involve the hand¬ 
ling of hydrocarbons in very large quantities. This industry 
has faced many of the classic problems in SLP and has 
contributed much to their solutions. 

Accounts of petroleum refining include The Petroleum 
Handbook (Shell International Petroleum Company, 1933-), 
Modern Petroleum Technology (Hobson and Pohl, 1975), 
Our Industry Petroleum (British Petroleum Company, 1977), 
Petroleum Refining Technology and Economics (Gary and 
Handwerk, 1984) and Handbook of Petroleum Refining 
Processes (Meyers, 1986b). 
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Table 11.12 Selected references on LPG and its hazards 


IGasE (n.d./5); LPGFTA (Appendix 27; n.d., 1974/1,1991 
Code Pt 1); Bray (1964); FPA (1964/1); van Fossan (1965); 
Eckhart (1969); Andrews (1970); Home Office (1971/2, 
1973/4); T.H. Taylor (1971); HSE (1973 HSW Booklet 30); 
A.F. Williams and Lorn (1974); Heng-Joo Ng and Robinson 
(1976); Skillern (1976); Wesson (1976); Jensen (1978); 
Rasbash (1978/79); Steinkirchner (1978); Anon. (1979c); 
Craig and White (1980); Hogan, Ermak and Koopman 
(1981); C. Jones and Sands (1981); Luks and Kohn (1981a); 
Selim (1981); BG (1983 BGC/PS/ DAT24); Desteese and 
Rhoads (1983); Chowdhury (1984); Moodie, Billinge and 
Cutler (1985); Rammah (1985); Jenkins and Martin (1983); 
UL (1985 UL144,1986 UL 21); Avgerinos (1987); IP (1987 
MCSP Pt 9); API (1989 Std 2510, Publ. 2510); Dunne and 
Higgins (1989); Pantony and Fullam (1989); B.M. Lee 
(1989); Vermeiren (1989); S.M. Thompson (1990); NFPA 
(1992 NFPA 58, 59) 

Storage 

ICI/RoSPA (1970IS/74); Lafave and Wilson (1983); Fuvel 
and Claude (1986); Lagron, Boulanger and Luyten (1986); 
Blomquist (1988); Droste and Mallon (1989); ILO (1989) 

Transport 

Sea: Gosden, Smith and Elkington (1982); Lyon, Pyman 
and Slater (1982); Lakey and Thomas (1983); Buret, Hervo 
and Tessier (1985); Chauvin and Bonjour (1985); 

Pakleppa (1991) 

Projects, installations, operations 

Borseth, Huse and Olsen (1980); Shtayieh etal. (1982); 
Bonnafous and Divine (1986); Branchereau and Bonjour 
(1986); Bendani (1989); Pangestu (1991) 

Fire protection (see alsoTables 16.2 and 22.1) 

J.M. Wright and Fryer (1982); Fullam (1987); S. Stephenson 
and Coward (1987); API (1989 Publ. 2510A); B.M. Lee 
(1989); NFPA (1992/31) 

Hazard assessment and control 

SAI (1974); van der Schaaf and Opschoor (1980); Romano, 
Dosi and Bello (1983); Wicks (1983); Crossthwaite (1986); 
Crocker and Napier (1988a); Droste and Mallon (1989) 


Gas processing is treated in Gas Encyclopaedia 
(LAir liquide, 1976), Handbook of Industrial Gas Utilization 
(Pritchard, Guy and Connor, 1978) and Natural Gas (Melvin, 
1988). 

Reference to petroleum refining and gas processing is 
made throughout this book. 

11.13 Operational Deviations 

An important aspect of process design is consideration of 
possible deviations of operating parameters from their 
design values. Some of these deviations are listed in 
Table 11.14. A further list of deviations is given in the check¬ 
list for hazard and operability (hazop) studies shown in 
Figure 8.24. 

The causes of deviation of a process variable are mostly 
specific to that variable, but there are some general causes 
of deviation. One is the deterioration or failure of equip¬ 
ment. Another is the maloperation of the control system, 
including in this the process operator. 


Table 11.13 Selected references on LNG and its hazards 


Abadie (1966); Gram (1968); IGU (1968-); PC. Johnson 
(1968); Stark and Washie (1968); Bloebaum and Lewis 
(1969); Barren (1970); Cribb and Hildrew (1970); Haselden 
(1970,1971); Potter and Bouch (1970); R. Shepherd (1970); 
IGasE (1971IGE/SR/11); AGA (1973);Thorogood, Davey 
and Hendry (1973); Wall (1973,1975); AGA (1974/18,1979/5, 
1981/6,1984/10,1986/11); Battison (1974); AD. Little (1974c); 
Lorn (1974); Sarkes and Mann (1974); ASCE (1976/6); 
Peebles (1977); Proes (1977); US Congress, OTA (1977); 
Whitlock (1977); P.J. Anderson and Daniels (1978); Ediger 
(1978); HSE (1978b); US Senate (1978); Arnoni (1979); 
Yamanouchi and Nagasawa (1979); Ait Laoussine (1980); 
Atallah (1982,1983); Faridany (1982); Geist (1985); 

Gilbert etal. (1985); Rideout etal. (1985); Leray, Petit and 
Paradowski (1986a,b); McGuire and White (1986); Anon. 
(1987r); Melvin (1988); H a mmer etal (1991) 

Physical and chemical properties 

Gonzalez etal. (1968); Klosek and McKinley (1968); 
Huebler, Eakin and Lee (1970); Nakanishi and Reid (1971); 
Luks and Kohn (1981b); FPA (1987 CFSD H30) 

Materials of construction 

Burkinshaw (1968); Duffy and Dainora (1968); Lake, 
DeMorey and Eiber (1968); Cordea, Frisby and 
Kampschaefer (1972); ASTM (1975 STP 579); Khenat and 
Hasni (1977); NBS, Cryogenics Division (1978); Leeper 
(1980); Charleux and Huther (1983); Duffaut (1983); Krause 
(1986); Minoda etal. (1986); Ohsaki etal. (1986);Vercamer, 
Sauve and Lootvoet (1987) 

Instrumentation 

Blanchard (1975); Blanchard and Sherburne (1985); 
Broomhead (1986); Flesch and Dourche (1986); 

Saiga etal. (1991) 

Heat exchangers 

Merte and Clark (1964); Gaumer etal. (1972); O’Neill and 
Terbot (1972);Tarakad, Durr and Hunt (1987) 

Process machinery 

Bourguet (1968); Linhart (1970); Schlatter and Noel (1972); 
L.R. Smith (1972); Guguen and Cherifl (1974); Kato (1977) 

Storage 

IGasE (n.d./2—4);Tutton (1965); E.L. Smith (1966); 

Closner (1968,1970); Ward and Egan (1969); Berge (1970); 
G.H. Gibson and Walters (1970); Hashemi and Wesson 
(1971); Geist and Chatterjee (1972); Gondouin and Murat 
(1972); Kiimper (1972); Lusk and Dorney (1972); Mansillon 
(1972); US Congress (1973); Schuller, Murphy and Glasser 
(1974); K.A. Smith and Germeles (1974); Stone, Hill and 
Needels (1974); Walters, Dean and Carne (1974); Ferguson 
(1975); Bellus etal. (1977); Fujita and Raj (1977); 
Haddenhorst and Lorenzen (1977); Ishimasa and Umemura 
(1977); US Congress, OTA (1977); Dinapoli (1978); HSE 
(1978b, 1981a); Bakke and Andersen (1982); Beevers (1982); 
Brumshagen (1982); van Hoof and Ofrenchk (1982); 
Yamakawa (1982); Zick and LaFave (1982); Boulanger and 
Luyten (1983a,b); Cheyrezy (1983); Closner and Wesson 
(1983); Collins etal. (1983); Lafave and Wilson (1983); 
de la Reguera etal. (1983); Steel, Faridany and Ffooks 
(1983); Steimer (1983); Capdevielle and Goy (1985); 
Fluggen, Niissbaumer and Reuter (1985); Huther, Zehri and 
Anslot (1985); Marchaj (1985); Speidel (1985); Vater (1985); 
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Crawford, Durr and Handman (1986); Lagron, Boulanger 
and Luyten (1986); Leray, Petit and Paradowski (1986a,b); 
Acketts (1987); Bomhard (1987); Morrison (1987); Beese, 
Trollux and Jean (1989); Itoyama etal. (1989); A.L. Marshall 
(1989); NFPA (1990 NFPA 59A); Meratla (1990); Carre and 
Bre (1991); Neville and White (1991); Chen-Hwa Chiu and 
Murray (1992) 

Rollover: J.S. Timer (1965); Hashemi and Wesson (1971); 
Chatterjee and Geist (1972); Maher and van Gelder 
(1972a,b); Sarsten (1972); Drake, Geist and Smith (1973); 
Germeles (1975a,b); K. A. Smith et al. (1975); Drake (1976); 
Takao and Narusawa (1980); Nakano etal. (1983);Takao and 
Suzuki (1983); Lechat and Caudron (1987); Benazzouz and 
Lasnami (1989); Marcel (1991) 

Transport 

Dyer (1969); A.E. Gibson and Pitkin (1972); Gondouin and 
Murat (1972); US Congress, OTA (1977); HSE (1978b, 1981b) 
Road: Eifel (1968); Stahl (1968); Montet, Przydrozny and 
Inquimbert (1977) 

Rail: Eifel (1968); Backhaus and Jannsen (1974) 

Waterway: Kober and Martin (1972); Backhaus and Jannsen 
(1974); Backhaus (1982) 

Pipelines: C.J. Gibson (1968); Gineste and Lecomte (1970); 
Hoover (1970); Ivantzov, Livshits and Rozhdestvensky 
(1970); Katz and Hashemi (1971); Dimentberg (1972); 
Ivantzov (1972); Walker, Coulter and Norrie (1972); Dumay 
(1982); Backhaus (1983); vanTuyen and Regnaud (1983); 
Fostering and Becker (1987) 

Sea: Tutton (1965); Pilloy and Richard (1968); Ward and 
Hildrew (1968a); F.S. Atkinson (1970); Filstead and Rook 
(1970); Guilhem and Richard (1970); Rook and Filstead 
(1970); Gilles (1972); Kober and Martin (1972); Booz-Allen 
Applied Research Inc. (1973); H.D. Williams (1973); Soesan 
and Ffooks (1973); Hansen and Vedeler (1974); R.C. Hill 
(1974); Kniel (1974); AGA (1975/24); D.S. Allan, Brown and 
Athens (1975); Corkhill (1975); Eisenberg, Lynch and 
Breeding (1975); J.P. Johnson and Jamison (1975); Authen, 
Skramstad and Nylund (1976); Prew (1976); Department 
of Commerce, Maritime Administration (1977); DOT, 

CG (1977a); Eke and Gibson (1977); Ffooks (1977); Findlater 
and Prew (1977); Mathiesen etal. (1977); Schwendtner 
(1977); US Congress, OTA (1977); Vrancken and 
McHugh (1977); HSE (1978b, 1981a); Glasfeld (1980); 

F.S. Harris (1980); Bockenhauer (1980,1981,1985,1987); 
Shumaker (1980); Bourguet (1981); Angas (1982,1985); 
Armand (1982); Beevers (1982); Benoit (1982); Bojrkman 
(1982); Brumshagen (1982); Edinberg etal. (1982); Hillberg 
(1982); Holdsworth (1982,1983,1985); Lyon, Pyman and 
Slater (1982); Mabileau (1982); Mankabady (1982); Masaitis 
and Tornay (1982); van Mater et al. (1982); PR. Mitchell 
(1982); Nagamotoe/a/. (1982); Nassopoules (1982); Peck and 
Jean (1982); Riou and Zermati (1982);Veliotis (1982); Aprea 
(1983); Berger (1983); Fujitani etal. (1983); Huther and 
Benoit (1983); Jean and Lootvoet (1983); Lakey and Thomas 
(1983); Murata etal. (1983); Nagamoto etal. (1983); van 
Tassel (1983);Vogth-Eriksen (1983); B. White and Cooke 
(1983); Aldwinckle and McLean (1985); Fujitani etal. 
(1985); Jean and Bourgeois (1985); Jenkin, Singleton and 
Woodward (1985); Latreille (1985); Tanaka and Umekawa 
(1985); Bakke (1986a); Betille and Lebreton (1986); J. 
Bradley (1986); J. A. Carter (1986); Itoyama et al. (1986); 
Lootvoet (1986); McLean and Cripps (1986); Ogawa etal. 
(1986); Ogiwara etal. (1986); Olschlager (1986); Rowek and 
Cook (1986); Schrader and Mowinckel (1986); Ackerman 


and Hutmacher (1987); Flesch and Lootvoet (1987); Huther, 
Anslot and Zehri (1987); Fujitani etal. (1987); Ferguson, 
McLean and Sakai (1989); Fujitani, Okumura and Ando 
(1989,1991); Jean, Lootvoet and Bennett (1989); Meratla 
(1990); Claude and Etienne (1991); Itoyama etal. (1991); 
Mathiesen etal. (1991); Ogiwara etal. (1991); Pakleppa 
(1991); Tornay, Gilmore and Feskos (1991); Wayne, 
Bockenhauer and Gray (1991) 

Shipping statistics: J.R. Evans (1987); Kolb and 
Boltzer (1987) 

Ships engines: Engesser etal. (1987); Grone and 
Pedersen (1987);Terashima etal. (1987) 

Ship-shore transfer: Whitmore and Gray (1987) 

Training 

Blogg (1987); Karim etal. (1987) 

Projects, installations, operations 

Guccione (1964); Filstead (1965); IGasE (1965 Comm. 696); 
Culbertson and Horn (1968); Engler (1968); PC. Johnson 
(1968); R.T. Miller (1968); Naeve (1968); Pierot (1968); 
Rerolle (1968); Stanfffl (1968); Ward and Hildrew (1968b); 
Bourguet, Garnaud and Grenier (1970); Gineste and 
Lecomte (1970); Laur (1970); Asselineau etal. (1972); Berge 
and Poll (1972); Bourguet (1972); C. Gibson (1973); Eke, 
Graham and Malyn (1974); Horn etal. (1974); Jenkins, 
Frieseman and Prew (1974); Purvin,Withington and Smith 
(1974); Anon. (1976c,e); Dolle and Gilbourne (1976); Daniels 
and Anderson (1977); Khenat and Hasni (1977); Ploum 
(1977); Seurath, Hostache and Gros (1978); Anspach, 
Baseler and Glasfeld (1979); Kime, Boylston and van Dyke 
(1980); Rust and Gratton (1980); KW. Edwards etal. (1982); 
Zermati (1982); Chauvin and Bonjour (1985); McKinney 
and Oerlemans (1985); Setters, Luck and Pantony (1985); 
de Sola (1985); Branchereau and Bonjour (1986); Colonna, 
Lecomte and Caudron (1986); Craker, Scott and Dutton 
(1986); Leray, Petit and Paradowski (1986); White-Stevens 
and Elliott (1986); Benazzouz and Albou (1987);Tarakad, 
Durr and Hunt (1987); Vik and Kjersem (1987); Bendani 
(1989); Dassonville and Lechat (1989) 

Safety and environmental aspects 

Copp (1971); Kober and Martin (1972); Mansfflon (1972); 
Napier (1972); J. Davis (1973); PJ. Anderson and Bodle 
(1974); FPC (1974); Stone, Hills andNeedels (1974); Walters, 
Dean and Came (1974); F.H.Warren etal. (1974); California 
State Legislature (1976,1977); von Ludwig (1975); 

EW. Murray, Jaquette and King (1976); FERC (1977); 
Comptroller General (1978); General Accounting Office 
(1978); US Senate (1978); L.N. Davis (1979); Ahern (1980); 
R.A. Cox etal. (1980); McGuire (1980); Rust and Gratton 
(1980); Atallah (1982,1983); Kotcharian and Simon (1982); 
Navaz (1987) 

Leaks and spillages 

R.O. Parker and Spata (1968); Humbert-Basset and Montet 
(1972); AGA (1974); Battelle Columbus Laboratories (1974); 
Fay and Lewis (1975); H.H.West, Brown and Welker (1975); 
Neff, Meroney and Cermak (1976); R.A. Cox and Roe (1977); 
HSE (1978b, 1981a) 

Marine spillages: Burgess, Biordi and Murphy (1970 BM 
S4105); Burgess, Murphy and Zabetakis (1970 BM RI7448); 
Enger and Hartman (1972a,b); Kneebone and Prew (1974); 
Raj and Kalelkar (1974); Eisenberg, Lynch and Breeding 
(1975); Germeles and Drake (1975); Havens (1977,1978); 

US Congress, OTA (1977); HSE (1978b, 1981a) 
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Fires (see Tables 16.1 and 16.2) 

Fire protection (see also Tables 16.2 and 22.1) 
van Dyke and Kawaller (1980); Rudnicki and vander Wall 
(1980); H.H. West, Pfenning and Brown (1980); Sonley 
(1982); S. Stephenson and Coward (1987); B.M. Lee (1989); 
NFPA (1990 NFPA 59A) 

Inerting: Johannessen (1987); Oellrich (1987); 

Tepper (1987) 

Hazard assessment and control 
F.H. Atkinson (1970); Nassikas (1970); Brubaker, Koerner 
and Mathura (1972); Burgess, Biordi and Murphy (1972); 
Crouch and Hillyer (1972); Mansillon (1972); Fay (1973); 
McKinley (1973); R.C. Hill (1974); Horner (1974); Horner and 
Ecosystems Inc. (1974); Raj and Kalelkar (1974); SAI (1974); 
Allan, Brown and Athens (1975); Eisenberg, Lynch and 
Breeding (1975); Fedor, Parsons and de Coutinho (1975); 
Graft and McGrath (1975a,b, 1976); DOT, CG (1976,1977b); 
van Horn and Wilson (1976); California Assembly (1977); 
California Energy Resources Conservation and 
Development Communication (1977); R. A. Cox and Roe 
(1977); DOT, OPSO (1977a); Fairley (1977); FPC, Bureau of 
Natural Gas (1977); Kopecek (1977); Mathiesen etal. (1977); 
John J. McMullen Associates Inc. (1977); Resource Planning 
Associates (1977); Snellink (1977); Socio-economic Systems 
(1977); US Congress, OTA (1977); Wesson and Associates 
Inc. (1977); BGC (1978); California Control Communication 
(1978); FERA (1978); HSE (1978b, 1981a); Nikodem (1978, 
1980); Philipson (1978a,b, 1980); Rigard andVadot (1979); 
R.A. Cox etal. (1980); Feely etal. (1980); Lautkaski and 
Fieandt (1980); Summer et al. (1980); Kunreuther and 
Lathrop (1981); Lyon, Pyman and Slater (1982); Roopchand 
(1983); Solberg and Skramstad (1982); Valckenauers (1983); 
Wicks (1983); Dale and Croce (1985); D.A. Jones (1985); 
Sellers, Luck and Pantony (1985); Valk and Sylvester-Evans 
(1985); Setters and Luck (1986); Schrader and Mowinckel 
(1986); Zehri etal. (1986); Navaz (1987) 


The effects of deviations and the measures which may be 
taken to prevent them are also specific. But there are cer¬ 
tain devices which are generally provided to give protec¬ 
tion against extreme deviations, particularly of pressure 
and temperature. These are considered in the discussion of 
pressure systems and of control systems in Chapters 12 and 
13, respectively. A further discussion of operating devia¬ 
tions is given by Wells, Seagrave and Whiteway (1976). 

When a plant has been designed, it should be checked 
by some method such as a hazop study, as described in 
Chapter 8. Again this technique is based on consideration 
of operational deviations. 

11.13.1 Pressure deviations 

Pressure deviations can occur as a result of: changes 
in action of pumping equipment (e.g. failure of a pump 
or compressor), changes in flow (e.g. closure of a valve or 
pump outlet), changes of heat input (e.g. heat from sun or 
fire), changes in heat output (e.g. loss of condenser cooling), 
contacting of materials (e.g. hot oil and water), thermal 
expansion and contraction (e.g. liquid density changes 
in a pipeline), and chemical reaction and explosion (e.g. 
runaway reaction). 

Effects of pressure deviations include overpressure and 
underpressure of equipment and changes of temperature, 
flow and level. Measures should be taken as appropriate to 
reduce the pressure deviations. In addition, it is essential to 
provide protective devices which prevent overpressure and 
underpressure. 

11.13.2 Temperature deviations 

Some causes of temperature deviations are: changes in 
heat input (e.g. loss of fuel), changes in heat output (e.g. loss 
of cooling), changes in heat transfer (e.g. fouling of heat 
exchangers), generation of heat (e.g. runaway reaction), 
changes of flow (e.g. flow to a reactor), changes of pressure 
(e.g. pressure reduction causing liquid flashing), thermal 
lags (e.g. lags in heat exchangers), hot spots (e.g. machin¬ 
ery in distress). 


Table 11.14 Some deviations of operating parameters from design conditions (after Wells, Seagrave and 
Whiteway, 1976) (Courtesy of the Institution of Chemical Engineers) 


Process variables 
Pressure system 
Chemical reactions 

Material characteristics 

Impurities 
Localized effects 

Time aspects 
Process disturbances 

Constructional defects 
Loss of containment 


Pressure, temperature, flow, 
level, concentration 

Mechanical stress, loading, expansion, contraction, cycling effects, vibration, cavitation, 
resonance, hammer; corrosion, erosion, fouling 
Reactions in reactors: nature and rate of main reactions and side reactions Catalyst 
behaviour reaction, regeneration, poisoning, fouling, disintegration 
Unintended reactions elsewhere: explosion, heating, polymerization, corrosion 
Vapour density; liquid density, viscosity; melting point, boiling point; latent heat; phase 
change; critical point effects; solids physical state, particle size, water content 
Contaminants; corrosion products; air; water 

Mixing effects, maldistribution; adhesion, separation, vapour lock, surging, siphoning, 
vortex generation, sedimentation, fouling, blockage, hot spots 
Contact time, control lags, sequential order 

Operating point changes, changes in linked plants, start-up, shut-down, utilities failure, 
equipment failure, control disturbance, operator disturbance, blockage, leakage, 
climatic effect, fire 

Plant not complete, not aligned, not level, not supported, not clean, not leak-tight; materials 
of construction incorrect or defective 
Leakage, spillage 
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Temperature deviations in reactors can occur as a result 
of errors in the charging sequence, delays in initiating agi¬ 
tation, feed flow or temperature variations, maldistribution 
of reactants, development of catalyst hot spots, loss of 
cooling and fouling of heat transfer surfaces. 

Effects of temperature deviations include overtemper¬ 
ature and undertemperature of equipment, changes of 
pressure and flow, and runaway reactions. The appropriate 
measures should be taken to reduce the deviations. In 
particular, attention should be paid to the heat input and 
output from the plant and to the control of reactors. 

11.13.3 Flow deviations 

Flow deviations may be too high, too low, zero, reverse or 
fluctuating. Changes in flow are generally the result of 
pressure changes and should be considered in conjunction 
with these. 

Some causes of no flow are lack of feed material, lack of 
pressure difference, vapour effects and equipment failures. 
Vapour effects which can cause loss of flow include vapour 
locks and gassing up of pumps. Equipment failures 
include the stoppage of pumping equipment, the fracture 
of equipment resulting in leakage, and the blockage of 
equipment. 

Blockage may occur in a number of ways. Items may be 
left in the plant after construction and maintenance work. 
Deposits may build up from liquid impurities, from solid 
particles, from corrosion or erosion products. The fluid 
may polymerize or solidify. Cessation of flow for other 
reasons can cause solidification or polymerization in a heat 
exchanger. Low ambient temperatures increase the risk of 
freezing, particularly of liquids which are solids under 
ambient conditions. 

Equipment which is prone to blockage includes pipes, 
heat exchangers, packed beds and filters. Control valves 
may block or jam shut. 

Reverse flow occurs if there is a reversal of the pressure 
differential. It should therefore be considered in conjunc¬ 
tion with pressure changes. Failure of pumping equipment 
is a main cause of reverse flow. 

Flow deviation can cause deviations of pressure, tem¬ 
perature and level. It can result in materials entering the 
wrong parts of the plant, can cause erosion, cavitation and 
hammer blow, and can result in pump overload and trip. 

Complete stoppage of flow may cause disturbances to 
other parts of the plant. Restart after temporary interrup¬ 
tion of flow can be hazardous also, as in the case of the 
extinction of a flame followed by a resumption of flow of 
unignited fuel. 

The manipulation of fluid flows is the principal means 
by which control is exercised. There are many hazards 
which can arise if there is a loss of control. A particularly 
serious one occurs if it is no longer possible to effect 
necessary heat removal. Low flow may be as hazardous as 
zero flow, if the deviation is not sufficient to activate the 
protective devices. 

Leakage flow may cause contamination between process 
streams or emission to the atmosphere. Contamination 
may result in blockages, corrosion, phase changes, chemi¬ 
cal reaction and explosion. Water is the most common sub¬ 
stance used in process plants and can give rise to all of 
these effects. It may enter other streams through pinholes 
or other tube failures, or through leaking shut-off valves. 

The measures required to reduce flow deviations depend 
on the specific cause, but include attention to the reliability 


of pumping equipment, the provision of adequate storage 
and the elimination of blockages and of phenomena which 
have a similar effect. 

Arrangements should be made for the easy removal of 
blockages at points where these are reasonably foreseeable. 
Provision should be made for cleaning pipes and heat 
exchangers by such methods as rodding out, chemical 
cleaning and burning of carbon deposits. Surfaces 
of packed beds may be protected from blinding by putting a 
filter layer such as ceramic packing on top. It may 
be necessary to install bypasses on equipments which 
are liable to blockage, but these may introduce their 
own hazards, which should be considered. Where fluids 
may freeze, it may be necessary to provide trace steam or 
electrical heating to prevent this. 

11.13.4 Level deviations 

Levels may be too high, too low, zero or fluctuating. 
Changes in level result from flow changes and should be 
considered in conjunction with these. Level deviations 
often occur as a result of changes in the flow in or out of a 
vessel. These may be controlled changes which result in 
overfilling or emptying of the vessel, or they may be caused 
by failure of equipment, such as the off-take pump, by 
vapour effects such as gassing up of that pump, or by 
blockages. 

Changes in the pressure above the liquid, such as loss of 
vacuum, also affect the level. Some of the other causes of 
level deviations are surging, foaming and thermal expan¬ 
sion, siphoning and blown lutes. Excessive agitation or 
vibration of the vessel can also cause level deviations. 

The measurement of liquid level is often difficult if there 
are solids, two liquid phases or foam, or if inerts, water or 
sediment accumulate. If the level is too high, liquid may 
overflow, the vessel may be overpressured or the weight of 
the system may become excessive. Where there is a gas flow 
through the vessel, a high level may cause liquid entrain¬ 
ment. If the level is zero, the outlet liquid flow is lost. Loss of 
liquid level can also result in breakthrough of high pressure 
gas to a part of the plant which is not designed for it. Mea¬ 
sures to reduce level deviations depend on the specific case. 
In particular, attention should be given to the problems of 
level measurement. 

It is not always the aim to eliminate level deviations 
completely. For some vessels, such as a chemical reactor, the 
level should normally be held constant, but other vessels 
are specifically used as surge vessels to smooth fluc¬ 
tuations of flow between units. Such vessels can fulfil 
their function only if the level in them does vary. They 
are usually provided with a low gain control loop which 
permits this. 

In the case of level, control of the upper level limit may be 
achieved without resort to automatic controls by the simple 
and reliable device of an overflow pipe, and this should 
always be considered. 

In addition to the levels in the main vessels, those in other 
equipments should be considered. These include levels in 
heat exchangers and on distillation trays. 

11.13.5 Inhomogeneities and accumulations 

There are many ways in which inhomogeneities of condi¬ 
tions and accumulations of material can arise. Poor mixing 
in reactors or other equipment can result in: side reactions 
and reaction runaway; hot spots, overheating and thermal 
degradation; and fouling. The accumulation of substances 




11/64 PROCESS DESIGN 


which are relatively innocuous at high dilution but which 
when concentrated in some way, such as by vaporization 
with an insufficient bleed-off or by recycling of material, 
may present a hazard. Material which is held up in the 
system in a dead leg or elsewhere, for an abnormally long 
time may undergo degradation and become hazardous. 

11.13.6 Control disturbances 

The control system, including the process operator, may be 
a cause of operating deviations. One cause of this is errors, 
faults or lags in measurement. A level measurement based 
on liquid head may be in error due to frothing. The reading 
of a flow measuring instrument may be plausible, but the 
instrument may nevertheless have failed. There may he 
appreciable lags in the measurement of temperature. 

Deviations may also be caused by the action of the 
automatic control system. The unsteady-state character¬ 
istics of the process such as the nature of the disturbances 
and of the time lags, the presence of dead time and loop 
interactions, and a requirement to operate at different 
throughputs, may make control inherently difficult. As 
a result, controller settings are sometimes inadequate. 
Other deviations may be introduced by the actions of the 
process operator, either through the control system or in 
other ways. 

It is important for the process design to provide suffi¬ 
cient potential correction for control. If a variable is to be 
controlled, then there must be other variables which can be 
manipulated in order to achieve that control. This may seem 
obvious, but it is often not appreciated in practice. If, for 
example, a cement kiln is operated at maximum air flow, it 
is not possible to have close control of the outlet gas oxygen 
content by means of the air flow, since this requires that it 
be possible both to increase and decrease that flow. 

11.14 Impurities 

In the foregoing section frequent reference has been made 
to impurities. These merit some attention in their own 
right. The problem has been considered by Grollier-Baron 
(1992a,b), who gives a number of examples of incidents 
due to impurities, involving mainly explosion or corrosion. 
The use of nitrogen from ammonia cracking to inert a 
storage tank containing ethylene oxide led to decomposi¬ 
tion of the latter due to traces of ammonia in the nitrogen. 
The presence of traces of acetylene in air passing over 
bronze fittings resulted in the formation of cuprous acet- 
ylide which then exploded. In a storage facility, replace¬ 
ment of demineralized water used in a heat exchanger for 
cooling acrolein with water from another source combined 
with a small leak in the exchanger allowed mineral ions to 
enter the acrolein, which polymerized exothermically so 
that the tank exploded. In catalytic crackers and methane 
reformers, unsaturated hydrocarbons and NCX are pro¬ 
duced and when cooled to low temperature can form com¬ 
pounds, some of which are explosive. Mercury present 
in some natural gas condenses in the aluminium heat 
exchangers of the liquefaction units and forms an amal¬ 
gam which corrodes the exchangers. Explosions can occur 
due to the accumulation of nitrogen trichloride in chlorine 
vaporizers. 

Grollier-Baron outlines a formal approach to dealing 
with the problem of impurities based essentially on the 
following measures: (1) identification of the species present 
in trace quantities, (2) review of the fate of these species, 


(3) review of the hazards posed by the species, (4) formula¬ 
tion of corrective measures and (5) review to ensure that 
these countermeasures do not themselves create new 
hazards. 

Identification involves consideration of the trace species 
in the raw materials, those created in the process and those 
which could be introduced accidentally. It also requires 
a review of the sensitivity of the raw materials, inter¬ 
mediates and products to these species. It cannot be 
assumed that the composition of the raw materials will 
necessarily remain constant with respect to trace species. 
There are many factors which may give rise to a change in 
composition of a raw material, ranging from minor chan¬ 
ges in natural or quarried products or in inputs or process 
at the supplier plant to a complete change of supplier or of 
process. 

There are a number of ways in which impurities may be 
formed in the process, including by side reactions and by 
corrosion. Impurities may also be introduced accidentally. 
One significant source is leaks. Another is deposits left 
behind in equipment or following maintenance. 

It is desirable to have a material balance on, and to know 
the fate of, any impurities which may be significant. 
The hazard caused by impurities is increased by accumu¬ 
lation. This accumulation occurs because the impurity 
has some property different from that of the fluid in which 
it is present. Hydrogen from corrosion processes is light 
and may collect at the top of a tank or in a vent system. 
Nitrogen trichloride is less volatile than chlorine and can 
build up in a chlorine vaporizer. A difference in relative 
volatility can cause a compound to build up to quite a high 
concentration on the tray of a distillation column. Accu¬ 
mulation may also occur due to special circumstances. Cold 
weather can cause trace quantities to freeze out and cause 
blockages or worse. 

Further treatment of contaminants is given by Tagoe and 
Ramharry (1993). 


11.15 CCPS Engineering Design Guidelines 

11.15.1 Guidelines for Engineering Design for 
Process Safety 

Process design is one of the principal topics covered in the 
Guidelines for Engineering Design for Process Safety (CCPS, 
1993/13) (the CCPS Engineering Design Guidelines). 
The scope of the Engineering Design Guidelines is, however, 
much broader. Table 11.15 gives the principal topics covered 
together with the location in this book where they are 
treated. 

As far as process design is concerned, the Guidelines 
deal in particular with: (1) inherently safer design, (2) pro¬ 
cess equipment, (3) utilities, (4) heat transfer fluids, 
(5) effluent disposal and (6) documentation. The treatment 
of inherently safer design is organized around the themes 
of: (1) intensification, (2) substitution, (3) attenuation, 
(4) limitation of effects and (5) simplification and error 
tolerance, and includes an inherent safety checklist. 
The general approach is broadly similar to that taken in 
Section 11.6. 

The items of process equipment treated in the Guidelines 
are: (1) chemical reactors, (2) columns, (3) heat exchangers, 
(4) furnaces and boilers, (5) filters, (6) centrifuges, (7) pro¬ 
cess vessels, (8) gas/liquid separators, (9) driers, (10) solids 
handling equipment, (11) pumps and compressors, 
(12) vacuum equipment and (13) activated carbon adsorbers. 
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Table 11.15 Some principal topics treated in the 
CCPS Engineering Design Guidelines and their 
treatment in this text 


Topics 

Chapter* 

1. 

Overview 


2. 

Inherently safer plant 

11 

3. 

Plant design 

10,11 

4. 

Equipment design 

11,12,22 

5. 

Material selection 

12 

6. 

Piping systems 

12 

7. 

Heat transfer fluid systems 

11 

8. 

Thermal insulation 

12 

9. 

Process monitoring and control 

13,14 

10. 

Documentation 

6,11 

11. 

Sources of ignition 

10,16 

12. 

Electrical system hazards 

10,11,16, 25 

13. 

Deflagration and detonation 
flame arresters 

17 

14. 

Pressure relief systems 

12,15,17 

15. 

Effluent disposal systems 

10,11,17 

16. 

Fire protection 

10,16 

17. 

Explosion protection 

17 


a Chapter in this book in which this topic is principally addressed. 


The Guidelines give a table showing the common causes 
of loss of containment for different types of process equip¬ 
ment. They also include checklists for safe operation of 
fired equipment and activated carbon adsorbers. The 
treatment covers all the main utilities, with particular 
attention to reliability of electrical power supplies, and 
includes a checklist of possible utility failures and equip¬ 
ment liable to be affected. 

The account of heat transfer fluid systems describes the 
fluids available and their applications, discusses the rela¬ 
tive merits of steam, liquid and vapour-liquid systems, 
outlines the system design considerations and describes 
the system components, and considers the safety issues. 

With regard to effluent disposal, the systems considered 
are: (1) flares, (2) blowdown systems, (3) incineration systems 
and (4) vapour control systems. The treatment does not 
extend to disposal of materials discharged in reactor venting. 

The section on documentation covers: (1) design docu¬ 
mentation, (2) operations documentation, (3) maintenance 
documentation and (4) record keeping. 
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Process materials are normally contained within a 
pressure system. The main problem in loss prevention is the 
avoidance of loss of containment from this system. Thus, 
the First Report of the ACMH (Harvey, 1976) states: 
‘Containment is the very essence of the problem of control 
of dangerous materials, and therefore we regard the integ¬ 
rity of pressure systems as of the highest importance’ 
(paragraph 64). 

The report continues: ‘Scrutiny of incidents suggests 
that the outright failure of properly designed, constructed, 
operated and maintained pressure vessels is rare, perhaps 
because of the lessons learned over many years from 
steam boiler practice. It is pipework, valves, pumps, etc., 
which are vulnerable and much more prone to failure’ 
(paragraph 65). 

Some of the principal features of pressure systems are 
briefly discussed in this chapter. It cannot be too strongly 
emphasized, however, that the discussion is limited to the 
background information necessary for the appreciation of 
the problems which occur in loss prevention and that 
many of the topics touched on, such as materials of con¬ 
struction, pressure vessels, piping, process machinery and 
overpressure protection, are complex matters which 
require specialist knowledge. The operation of pressure 
systems is at least as important as their design. This is 
considered in Chapter 6 on management systems and in 
Chapter 20 on plant operation. Selected references on 
pressure systems and components are given in Table 12.1 
and on materials of construction for and corrosion in pres¬ 
sure systems in Table 12.2. 


Table 12.1 Selected references on pressure systems 
and components 


ASME (Appendix 27 General and Safety Standards, 1987- 
Code for Pressure Piping B31,1992, Boiler and Pressure 
Vessel Code; Appendix 28 Pressure Vessels and Piping ); 
Associated Offices Technical Committee (n.d.); British 
Gas (Appendix 27 PressureVessels)', IMechE (Appendix 28, 
1970/3,1975/16,18,1976/27,1977/33,1979/50,1981/57,1991/ 
130,1993/148); Lloyds Register of Shipping (n.d.); NRC 
(Appendix 28 Containment, Equipment Qualification, 
Pressure Systems, Pressure Vessels)', NSC (Safe Practice 
Pamphlet 68); Welding Inst. (Appendix 28,1972/20); den 
Hartog (1952,1956); Chuse (1954-); D.A.R. Clark (1956); 
Timoshenko and Young (1956); Manning (1957,1960,1978); 
Arnold (1959); Brownell and Young (1959); AIChE 
(1960-69/3-12,1967/71,1970-94/17-38,1973/62,1974/ 
13,1978/14); MacCary (1960a,b); Hughson (1961d, 1969); 
Begg (1963—64); Maynard (1963); Faupel (1964); Jenett 
(1964b); Voelker (1964); Blick (1965); IP (1980 Eur. MCSP 
Pt 2,1981 MCSP Pt 3,1987 MCSP Pt 7,1993 MCSP Pt 13); 
Johns (1965); MacDermod (1965,1982); Norden (1965); 
Thielsch (1965); Kemper et al. (1966-67); API (1967- 
Refinery Inspection Guide, 1992 RP 510, Publ. 910); Bickell 
and Ruiz (1967); Canavan (1967); Canham (1967); Spence 
and Carlson (1967—68); Titze (1967); Eschenbrenner, 
Honigsberg and Impagliazzo (1968); Strelzoff and Pan 
(1968); Strelzoff, Pan and Miller (1968);T.E. Taylor 
(1968-69); Witkin (1968); Anon. (1969f); Fowler (1969); 
McCabe and Hickey (1969); McLeod (1969); Nichols (1969, 
1976b, 1979a,b, 1980,1983,1987); Warwick (1969); 

J.S. Clarke (1970); Le Coff (1970); Franzel (1970); Gill (1970); 
Hearfield (1970); Kemp (1970); Losasso (1970); MacFarland 


(1970,1974); Pugh (1970); Dall’Ora (1971); F.L Evans (1971); 
Markovitz (1971,1977); J.R. Palmer (1971); Pilborough (1971, 
1989); Toogood (1972); Whenray (1972); Ford et al. (1973); 
Guill (1973); Jaeger (1973,1975); Karl (1973); Timoshenko 
and Gere (1973); Dimoplon (1974); L. Evans (1974); 
Fitzpatrick (1974); Harvey (1974,1980); M.R. Johnson et al. 
(1974); Stokes, Holly and Mayer (1974); Anon. (1975c,g,l); 
Berglund (1975,1978); B.G. Cox and Saville (1975); ICI/ 
RoSPA (1975IS/107); Koike (1975a-c, 1978a-c); 
Mazzoncini (1975,1978); Roark and Young (1975); van 
Rossen (1975); Steffen (1975,1978); Anon. (1976); 
Bhattacharyya (1976); Dickenson (1976); Logan (1976); 
Warburton (1976); Bacon and Stephen (1977); Gilbert and 
Eagle (1977); Heyman (1977); HSC (1977/1); Mahajan 
(1977b); Pludek (1977); Shigley (1977); Anon. (1978c); 
Baumeister (1978); Chambard (1978); Megyesy (1978,1983); 
Strawson (1978); Witkin and Mraz (1978); Blevins (1979); 
Heinze (1979); Koenig (1979); Mraz and Nisbett (1979); 
Puzak and Loss (1979); Unrug (1979); Vreedenburgh (1979); 
Widera and Logan (1979); D.J.D. White and Well (1979); 
Buhrow (1980); Facer (1980); Gerlach (1980); HSE (1980a,b 
EM 7); Kletz (1980i, 1984i,k); Wells and White (1980); Zeis 
and Eschenbrenner (1980); Azbel and Cheremisinoff (1981); 
Burr (1981); R. Cook and Guha (1981); Moy (1981); Collier, 
Davies and Game (1982); W Marshall et al. (1982); Polak 
(1982); Smolen and Mase (1982); IAEA (1983); Rosaler and 
Rice (1983); Wicks (1983 LPB 53); Boyer (1984); Chuse and 
Eber (1984); Hurst (1984); Jawad and Farr (1984); Murray 
(1984); Arnold, Mueller and Ross (1986); Bednar (1986); 
Escoe (1986,1992); J.P. Gupta (1986); Kutz (1986); Rogerson 
(1986); Yokell (1986); S.J. Brown (1987); Grosshandler 
(1987a,b); Kirkpatrick (1987); Kohan (1987); D.R. Moss 
(1987); Prugh (1987b); Sandler and Luckiewicz (1987); 
Coleman (1989 LPB 85);Trbojevic and Gjerstad (1989); 

K.P. Singh (1990); Factory Mutual Int. (1991b); LPGITA 
(1991LPG Code 1 Pt 1); Snow (1991); EEMUA (1992 Publ. 
162); HSE (1992 GS 4); Kassatly (1992); Batra et al. (1993); 
Chuse and Carson (1993); E.H. Smith (1993); Norton, 
Pilkington and Carr (1994); Pilkington, Platt and Norton 
(1994); Spence and Tooth (1994) 

ANSI B series, BS (Appendix 27 Pressure and OtherVessels, 
PD series), BS 5500:1991, VDI2224:1988 
Prestressed concrete pressure vessels: IOCI (1968) 
Composites, FRP 

ASME (PVP115,1977/131,1987 PVP121,1990 PVP196, 
1992 Boiler and Pressure Vessel Code Pt X, 1992 AMD 150); 
ASTM (1975 580,1976 503,1986 D4012,1988 D4097,1991 
D3517); Puckett (1976); IMechE (1977/35,1984/77,1990/116, 
118); I.R. Miller (1979); Fasano and Eberhart (1980); 
IChemE (1980/119); Weatherhead (1980); Anon. 

(1986 LPB 70, p. 7); BG (1986 BGC/PS/ PL2); Institute of 
Materials (1986 B366); Maddison (1987 LPB 76); HSE 
(1991a,b PM 75); Britt (1993) 

Foundations, structures 

Brownell (1963); Deghetto and Long (1966); Pridgen and 
Garcia (1967); Tang (1968); A. A. Brown (1969,1971,1973, 
1974); Czerniak (1969); G.B. Moody (1969,1972); Youness 
(1970); Eichmann (1971); Molnar (1971); Arya, Drewyer and 
Pincus (1975,1977); Mahajan (1975,1977a); Raynesford 
(1975); K.P. Singh (1976); Simiu and Scanlon (1978); Faber 
and Alsop (1979); Faber and Johnson (1979); Moy (1981); 
Cowan (1982); Mosley and Bungey (1982); M. Schwartz 
(1982a-c, 1983a-e, 1984); Kong et al. (1983); HSE 
(1991a,b GS 49) 
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BS (Appendix 27 Civil Engineering), BS CP 2012:1974-, BS 
8004:1986 

Boilers 

American Oil Co. (n.d./IO); Institute of Fuel (1963); Csathy 
(1967); FMEC (1967); van Loosen (1968); Attebery (1970); 
Impagliazzo and Murphy (1970); OIA (1971 Publ. 502); 
Horsier and Lucas (1972); API (1974 Refinery Inspection 
Guide Ch. 8); Vodsedalek and Bielak (1977); BRE (1978 
CP59/78); Wilcox (1978); Needle (1979); A. Gibson (1980); 
W.S. Robertson (1981); Andrade, Gates and McCarthy 
(1983); Wilcox and Baker (1986); Harmsworth (1987); HSE 
(1987a-d PM 60,1989a-f PM 5); Kauffman (1987); Hewett 
(1988); Kingshott (1988); Prescott, Podhorsky and 
Blommaert (1988); Gunn and Horton (1989); NFPA (1989 
NFPA 85H); Kakac (1991); Anon (1992a); ASME (1984/174, 
1988/201,1992 Boiler and Pressure Vessel Inspection 
Code); Colannino (1993); Ganapathy (1994) 

BS (Appendix 27 Boilers), BS 759:1984-, BS 1113:1992 
Waste heat boilers, process heaters 
Csathy (1967,1981); Streich and Feeley (1972); Gupton and 
Kreisher (1973); Din (1975);T. Gibson (1975); Hinchley 
(1975,1977,1979a,b);W.P. Knight (1978); O’Sullivan, 
McChesney and Pollock (1978); Ozmore (1978); Salot (1978, 
1982); Subramanyam, Pandian and Ganapathy (1979); 
Fuchs and Blanken (1986); Pariag,Welch and Kerns (1986); 
Sitaraman, Santoso and Sathe (1988) 

Heat exchangers 

ASME (Appendix 28 Heat Transfer, 1990 PVP194); NRC 
(Appendix 28 Steam Generators)-, D.Q. Kern (1950,1966); 
Drake and Carp (1960); Rubin (1960,1961,1980); Bohlken 
(1961); D.S. Morton (1962); E.M. Cook (1964); Fraas and 
Ozosik (1965); Gilmour (1965,1967); P.R. Owen (1965); API 
(1967 Refinery Inspection Guide Ch. 7,1982 Std 660,1992 
Std 661); R.B. Moore (1967); Y.N. Chen (1968); Gainsboro 
(1968); Hargis (1968); Small (1968); A. A. Thompson (1969); 
Lord, Minton and Slusser (1970a,b); Thongren (1970); 
EEMUA (1971 Publ. 135); Stuhlbarg (1971); D.Q. Kern and 
Kraus (1972); Kniille (1972); Simpson (1972);Taborek etal. 
(1972a,b); Barrington (1973,1978); Doyle and Benkly 
(1973); Filers and Small (1973); J. A. Moore (1973); Song and 
Unruh (1974); P.M.M. Brown and France (1975); Char 
(1975b); Grossman (1975); Osman (1975); Piehl (1975); 
Anon. (1976 LPB10, p. 1); Fanaritis and Bevevino (1976); 
G.W. Schwarz (1976); Blevins (1977); Cabrini and Cusmai 
(1977); R. Brown (1978); Ganapathy (1978,1992,1994); Glass 
(1978); Sueyama and Takami (1978); Rubin and Gainsboro 
(1979); Standiford (1979); Subramanyam etal. (1979); 
Needle (1979);Triggs (1979); WJ. Baker (1980); Butterworth 
(1980,1992); Devore, Vago and Picozzi (1980); Greene (1980); 
Gutterman (1980); Landrum and Watson (1980); Lufti, 
El-Migharbil and Hasaballah (1980); Malone (1980); 
Saunders (1980); Scaccia andTheoclitus (1980); 
Vukadinovic (1980); Kakac, Bergler and Mayinger (1981); 
Lopinto (1982); Schlunder (1982); TEM A (1982 B78.1); 
Wassom (1982); K. Bell (1983); Cizmar (1983); Crane and 
Gregg (1983); Mehra (1983); Shipes (1983); Yokell (1983); 
Knudsen (1984); Anon. (1985m); Rail and Spaehn (1985); 
J.P. Gupta (1986); Nieh and Zengyan (1986); R.G. Thomas 
(1986): Crittenden, Kolaczkowski and Hout (1987); Sandier 
and Luckiewicz (1987);Tammani (1987); Weaver (1987); 
Zakauskas, Ulinskas and Katinas (1988); Fraas (1989); 
Bott (1990); Mir and Siddiqui (1990); Crisi (1992); Love 
(1992); lian, Kawaji and Chan (1993) 

BS (Appendix 27 Heat Exchangers), BS 3274:1960 


Pipework 

ASME (Appendix 27,1987- Code for Pressure Piping B31, 
1992 Boiler and Pressure Vessel Code; Appendix 28 
Pressure Vessels and Piping)-, British Cryogenics Council 
(n.d); IGasE (Appendix 28, n.d./7,1967/8,1976/10); NRC 
(Appendix 28 Pipework, Pipe Whip)-, M.W. Kellogg Co. 
(1956); G.N. Smith (1959); Bagnard (1960); R. Kern (1960, 
1966,1969,1971,1972a,b, 1974-, 1975b,c); Hilker (1962); 
Littleton (1962); Stubenrauch (1962); Whalen (1962); EEUA 
(1963 Handbook 18,1965 Doc. 23., 1968 Handbook 23); 
Rase (1963); Francois (1964); Ingels and Powers (1964); 
Jenett (1964c); Masek (1964b, 1968); Surdi and Romaine 
(1964); Chapman and Holland (1965-); W.H. Doyle (1965); 
Thielsch (1965); Canham (1966,1981); Judson (1966); Kiven 
(1966); Lancaster and Hoyt (1966); Koch (1966); Mallinson 
(1966a,b);W.C. Turner (1966); Cherrington and Ciuffreda 
(1967); R.C. King and Cracker (1967); Avery and Valentine 
(1968); Prescott (1968); Simpson (1968,1969); Ward 
(1968); C.E. Wright (1968); L. Wright (1968); Yoder (1968); 
Anon. (1969c); Meador and Shah (1969); Aslam (1970); 

G.B. Moody (1970); Phelps (1970); Wills (1970); F.L. Evans 
(1971); Simmon (1972); Benson (1973); FPA (1973/21); Guffl 
(1973); O’Neal, Elwongerand Hughes (1973); Royalty and 
Woosley (1973); Holmes (1973); Styer and Weir (1973); 
Weaver (1973); API (1974 Refinery Inspection Guide Ch. 11); 
Mauck and Tomita (1974); WW. Russell (1974); Ruziska and 
Worley (1974); Char (1975a, 1979); Lancaster (1976); 
Pothanikat (1976); Wachel and Bates (1976); D.W. Moody 
(1977); Surtees and Rooney (1977); Getz (1978); G.R. Kent 
(1978a); R. Kern (1978e); Constance (1979); J.D. Dawson 
(1979); Dilworth (1979); Lazzeri (1979); Marks (1979); Peng 
(1979); Stevens and littlewood (1979); API (1980 Std 
605,1994 Bull. 6F2); Bedson (1980); Facer (1980); 

G. Montgomery (1980); Anon. (1981v); R.J. Cook (1981); 

D. Stephenson (1981a); Chlorine Institute (1982 Publ. 60); 
Hooper (1982); Kannappan (1982); Kentish (1982a,b); Rao 
(1982); Gardner (1983); Hills (1983); Anon. (1984n); 
Mikasinovic and Marcucci (1984); de Nevers (1984a); 
Broyles (1985); Hodge (1985); IGasE (1985IGE/TD/12); 
IMechE (1985/86,89,1989/112,1993/158,159); Hansen 
(1986); Hanson (1986); Helguero (1986); Prescott, 
Blommaert and Grisalia (1986); Sotebier and Rail (1986); 
G.Parkinson (1987); Sandier and Luckiewicz (1987); 

P.R. Smith and van Laan (1987); Towndrow (1987 LPB 73); 
Anon. (1988p); J. K Rogers (1988); Droste and Mallon 
(1989); Geyer etal. (1990); Hancock (1990a,b); Coker 
(1991a,b); Couch (1991); Hurst etal. (1991); Hartman 
(1993); Sixsmith (1993), Sadler and Matusz (1994) 

ANSI B18 series; BS (Appendix 27 Pipework) 

Reaction forces: F.J. Moody (1969,1973); 

Stikvoort (1986); Hansen (1991) 

Coaxial pipes, jacketed pipes: Anon. (1977 LPB 13, p. 17); 
Anon. (1977 LPB 18, p. 2); Stubblefield (1993) 

Plastic-lined pipes: J.R. Ward (1968); Chasis (1976); 

Spencer (1978); Anon. (1981s); Castro (1982); 

Carroll (1985); M.E. Jones (1990); Jeglic and 
lindley (1992,1994) 

Glass-lined pipes: Cowley, Dent and Morris (1978) 

Plastic pipes: British Gas (1985 Comm. 1277); 

AGA (1989/12) 

Gaskets: Rothman (1973); Stevens-Guille and Crago (1975); 
ASTM (1977 620); G.R. Kent (1978b); Payne (1980); Granek 
and Heckenkampf (1981); Payne and Bazergui (1981); 

API (1982 Std 601); G. Parkinson (1986); B. Singh (1991); 
ASME (1992 B16.2); Childs (1992); Crowley (1993) 



12/4 PRESSURE SYSTEM DESIGN 


Bellows, expansion joints: Anon. (1975 LPB 5, p. 19); 
Kobatake etal. (1975); British Gas (1977 TIN1); Engineering 
Appliances Ltd (1977); ASME (1981/147,1984/175,1989 
PVP168); Jetta, Brown and Pamidi (1981); McCulloch 
(1981); PE. Smith (1983); C. Taylor (1985); Smith (1988 LPB 
83); D.J. Peterson (1991), BS 6129:1981 
Hoses: C.W. Evans (1974) 

Filters: Uberoi (1992); Artus (1976); Anon. (1977 LPB 13, 
p. 5); Anon. (1977 LPB 15, p. 35); Carriker (1979) 
Sightglasses, rotameters: Anon. (1988 LPB 80, p. 19) 
Thermowells: Masek (1964a, 1972,1978) 

Pipeline transients, water hammer 

NRC (Appendix 28 Water Hammer)', ASME (1933/21, 
1961/22,1984 ASME A112.26M, 1984/183); Thomson 
(1951); Lewitt (1952); Lupton (1953); Parmakian (1955); 
Marchal and Due (1959); Worster (1959); Hayashi and 
Ransford (1960); Karplus (1961); Harding (1964,1965-66); 
Streeter (1964); Pearsall (1965-66); Fabic (1967); Streeter 
and Wylie (1967); Pickford (1969); Casto (1973); Ludwig and 
Ruijterman (1974); Anon. (1975 LPB 0, p. 6); Anon. (1975 
LPB 1, p. 7); J. A. Fox (1977); Waiters (1979); Mukaddam 
(1982); Collier (1983); R. King (1983); Kremers (1983); 

K. Austin (1984); Crawford and Santos (1986); D. Clarke 
(1988a,b); Swierzawski and Griffith (1990); Kletz (1994 
LPB 115) 

Pipe tracing, steam tracing, steam traps 

Bower and Petersen (1963); Eland (1966); House (1968b); 
Northcroft and Barber (1968); Bertram, Desai and Interess 
(1972); Mathur (1973); Anon. (1974a); Monroe (1975, 

1976a-c, 1985); Cronenwett (1976); Mikasinovic and 
Dautovich (1977); Beatty and Kruger (1978); McWhorter 
(1978); Kohli (1979); Anon. (1981v); Blackwell (1982a, b); 
Lonsdale and Mundy (1982); Russo, Haydel and Epton 
(1984); HSE (1988 SIR 5); Haas (1990); David (1991); 

Kenny (1991,1992); Lam and Sandberg (1992); Mackay 
(1992); O’Dell (1992); Radle (1992); C. Butcher (1993b); 
Morran (1993) 

Insulation 

British Gas (GBE/DAT30); Hughson (1961b); EEUA (1963 
Handbk 12); Lawson (1964); Mathay and MacKnight (1966); 
WC. TUrner (1966,1974); Hoffman (1967); House (1968b); 
Isaacs (1968); Ellis (1969); Malloy (1969); Marks and Holton 
(1974); ASTM (1975 581,1980 718,1983 789,1984 826,1985 
880); Paros (1976); M.R. Harrison and Pelanne (1977); 

M.R. Harrison (1979); Webber (1979); Lang, Moorhouse and 
Paul (1980); McChesney and McChesney (1981,1982); 

WC.TUrner and Malloy (1981); Nagl (1982); Schroder (1982); 
Kletz (1984m); Laxton (1985); Sandier and Luckiewicz 
(1987); Irwin (1991a,b); McMarlin and Gerrish (1992); 
Reddi (1992); Sloane (1992); Britton and Clem (1991); 
Gamboa (1993) 

BS (Appendix 27 Insulation) 

Valves (see also Table 13.2) 

British Gas (Appendix 27 Valves)', NRC (Appendix 28 
Valves)', Holmberg (1960); F.C. Price (1961); Antrim (1963); 
Calef (1964); Liptak (1964); Burger and Hoogendam (1965); 
Ciancia and Steymann (1965); Holmes and Ramaswami 
(1966); API (1974 Refinery Inspection Guide Ch. 11,1984 
Std 526,1988 Std 599,1989 Spec. 6A, Std 608,1990 Std 598, 
1991 Spec. 6D, Std 600); Boger (1969); Canon (1969); 
Driskell (1969,1983); Glickman and Hehn (1969); Simon 
and Whelan (1970); Brodgesell (1971); Chemical 


Engineering (1971); Lawson and Denkowski (1971); Lovett 
(1971); Templeton (1971); British Valve Manufacturers 
Association (1972); G.W Brown (1974); F.L. Evans (1974b); 
R. Kern (1975a); Wicher (1975); Wier (1975); Anon. (1976 
LPB 10, p. 3); Bertrem (1976); Hays and Berggren (1976); 
Pikulik (1976); Babbidge, Partridge and dAngelo (1977); 
Karcher and Ball (1977); Clayton and Johnson (1978); 
Constance (1979); Farley (1979); IMechE (1979/51,1980/54, 
1989/114,1993/161,1994/168); Anon. (1980 LPB 31, p. 17); 
Kaplan (1981a); Whitaker (1981); D.T. Cook (1982); Anon. 
(1984 LPB 59, p. 28); Ball and Howarth (1984); Stacey 
(1984); C.Tayler (1984c); Wallbridge and Gates (1984); 
Chowdhury (1985a); Greene etal. (1985b); Merrifleld (1985); 
Pittman (1985); ASME (1986 PVP 109,1989 PVP 180); Bond 
(1986 LPB 69); Merrick (1986); Anon. (1987n); Latty (1987); 
Morley and Heasman (1987); Warring (1987); Anon. 
(1988p); Hunter (1988); T.M. Rogers (1988); Royce (1988b); 
Pinnington (1989); McGuinness (1990); Whitehouse (1990); 
Newby and Forth (1991); Hotchkiss (1991); Miles (1991); 
Ridey (1991); Zappe (1991); Anon. (1992 LPB 103, p. 25); 
Beasely (1992); Grumstrup (1992); Dana (1993); Fruci 
(1993); Graczyk and Hannon (1993); Kroupa (1993); 

T. Robinson (1993); J.B. Wright (1993); Hingoraney (1994); 
Peters (1994) 

BS (Appendix 27 Valves) 

Pressure regulators and reducers, restriction orifices: 

Fadel (1987); Liptak (1987); Baumann (1992); 

Khandelwal (1994) 

Non-return valves and devices, blackflow protection: 
Malleck (1969); Fitt (1974); Nicholson (1974); Kletz (1976b); 
Cherry (1980); Emery (1983); K Austin (1984);Thorley 
(1984); Fluid Controls Institute (1985);Tomfohrde (1985); 
Anon. (1986 LPB 87, p. 1); Ellis and Mualla (1986); Anon. 
(1987b); Anon. (1988 LPB 83, p.9); Zappe (1991); Englund, 
Mallory and Grinwis (1992); Anon. (1993 LPB 111, p. 25) 
Emergency isolation valves: Roney and Acree (1973); Kletz 
(1975b); Tomfohrde (1985); C. Butcher (1991b) 

Excess flow valves: Anon. (1977 LPB 14, p. 15); Anon. (1977 
LPB 18, p. 22); R.A. Freeman and Shaw (1988) 

Fire safe valves: J.B. Wright (1981); Cory and Riccioli (1985); 
API (1993 Std 589,607,1994 Spec. 6FA) 

Fluidic valves: J. Grant and Marshall (1976,1977) 

Lutes, seals 

Anon. (1989 LPB 87, p. 1); Anon. (1992 LPB 104, p. 27) 

Joining 

Manning (1960); Hamm (1964); Matley (1965); Graves 
(1966); Canham and Hagerman (1970); Isaacs and 
Setterlund (1971); Vosshrinck (1973); Briscoe (1976); Cloudt 
(1978); Girin (1978); Pengelly (1978); Strawson (1978); 
ASME (1979- Code for Pressure Piping, 1988 B16.6,1989 
PVP 158); Stippick (1979); M.G. Murray (1980b); Anon. 
(1981 LPB 38, p. 23); Institute of Materials (1981B349); 
Zelnick (1981); G. Thompson (1994) 

ANSI B18 series, BS (Appendix 27 Pipework) 

Welding (see also Table 25.1) 

AGA (Appendix 28); AWS (Appendix 27,28); ASTM (STP 
11,494); British Gas (Appendix 27); HSE (HSW Bklt 38); 
IMetall (Item/1); Welding Institute (Appendix 28);Voelcker 
(1964,1965,1973); ASME (1968/64,1984/ 93,1989 PVP 173, 
1992 Boiler and Pressure Vessel Code Pt DQ); Maukonen 
and Vest (1973); Assini (1974); Houldcroft (1975); Schofield 
(1975); API (1978 Refinery Inspection Guide App., 1982 
RP 942,1988 Std 1104); Cary (1979); M.M. Schwartz (1979); 
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A.C. Davies (1984); Faltus (1985); J.E. Jones and Olsen 
(1986); D. Smith (1986); Hicks (1987); NFPA (1989 51B); 

W. Lucas (1991); Stippick (1992) 

BS (Appendix 27 Welding) 

Equipment identification 

D.F. Allen (1976); API (1993 RP1109) ANSI A13.1-1981, BS 
(Appendix 27 Identification of Equipment), BS 1710:1984 

Mechanical failure (see also Table 7.1) 

SMRE (Engineering Metallurgy 4,6);Thielsch (1965, 
1968); Stokoe, Potts and Marron (1969); Weeks and Hodges 
(1969-70); Anon. (1970a); IMechE (1970/3,1984/79,1988/ 
105,1994/172); Loescher (1971); Pilborough (1971,1989); 
Streich and Feeley (1972); Collins and Monak (1973); 
Colangelo and Heiser (1974); R.W. Wilson (1974); Lancaster 
(1975); Melville and Forster (1975); Hutchings (1976); Kletz 
(1980i, 1984k); Mischiatti and Ripamonti (1985); S.J. Brown 
(1987); Nishida (1991); Chapman and Lloyd (1992) 

Pressure vessel failure, failure rates 
Kellerman (1966); Kellerman and Seipel (1967); Phillips 
and Warwick (1968 UKAEA AHSB(S) R162); Slopianka 
and Mieze (1968); Butler (1974); Engel (1974); T. A. Smith 
and Warwick (1974,1978,1981SRD R203); Boesebeck 
(1975); Bush (1975); Solomon, Okrent and Kastenberg 
(1975a,b);W. Marshall etal. (1976); Boesebeck and Homke 
(1977); Cottrell (1977); H.M. Thomas (1977); Arulanantham 
and Lees (1981); Harrop (1982 SRD R217); W. Marshall 
(1982); W. Marshall etal. (1982); Smith (1986 SRD R314,1987 
SRD R353); Kavianian, Rao and Brown (1990); Davenport 
(1991); Hurst (1991); Medhekar, Bley and Gekler (1993); 
Ardillon and Bouchacourt (1994); Crombie and Green 
(1994); Hurst, Davies etal. (1994) 

Pipework failure 

Janzen (n.d.); Gibbons and Hackney (1964); British 
Gas (1978 Comm. 1103); AGA (1981/34,35,1983/38); 

K.E. Petersen (1982,1983); Cannon and Lewis 
(1987 NCSR/GR/71); Bellamy, Geyer and Astley (1989); 
Hancock (1990a,b); Geyer et al. (1990); Geyer and Bellamy 
(1991); Hurst etal. (1991); Medhekar, Bley and Gekler (1993); 
Hurst, Davies etal. (1994): Strutt, Allsop and Ouchet (1994); 
G. Thompson (1994) 


12.1 Pressure Systems 

Any system in which the pressure departs at all signifi¬ 
cantly from atmospheric, and which is therefore of rigid 
construction, needs to be considered as a pressure system. 
In the United Kingdom, pressure systems are covered by 
the Pressure Systems and Transportable Gas Containers 
Regulations 1989 (the Pressure Systems Regulations). For 
fixed plant the associated code is COP 37 Safety of Pressure 
Systems (HSE, 1990). 

The definition of a ‘pressure system’ under the Pressure 
Systems Regulations is given in Regulation 2 and is: ‘(a) a 
system comprising one or more pressure vessels of rigid 
construction, any associated pipework and protective 
devices; (b) the pipework with protective devices to which a 
transportable gas container is, or is intended to be, con¬ 
nected; or (c) a pipeline and its protective devices; which 
contains or is liable to contain a relevant fluid, but does not 
include a transportable gas container’. 

Regulation 2 defines ‘relevant fluid’ as: ‘(a) steam; (b) any 
fluid or mixture of fluids which is at a greater pressure than 


Table 12.2 Selected references on materials of 
construction for and corrosion in pressure systems 

Materials science 

ASTM (Appendix 27, STP 289,325,1970 STP 466,1981STP 
736,1983 STP 806,814); Institute of Materials (Appendix 
28, B345); Godfrey (1959); Guy (1959,1976); Jastrzebski 
(1959); Dieter (1961); W Johnson and Meller (1962); 
Grossman and Bain (1964);Tweeddale (1964); Hull (1966); 
Prince (1966); Cottrell (1967); Honeycombe (1967); Spencer 
(1968); Gillam (1969); Gregory (1970);Timoshenko and 
Goodier (1970); vanVlack (1970); IMechE (1971/4); 
Chadwick (1972); Gabe (1972); Benham and Warnock (1973); 
J.D. Campbell (1973); C.T. Lynch (1974); Popov (1976); 
Summitt and Sliker (1980); Crane and Charles (1984); Wulpi 
(1985) ANSI Z178 series 

Process plant materials 

ASME (Appendix 27,1992 Boiler and Pressure Vessel Code 
Pt II; Appendix 28 Materials, Pressure Vessel and Piping, 
1986 PVP 111); ASTM (Appendix 28, STP 15C); EEMUA 
(Appendix 28); NRC (Appendix 28 Materials of 
Construction)', DECHEMA (1953-); Greathouse and Wessel 
(1954); Aldrich (1960c); McConnell and Brady (1960); 
Norden (1960a,c); Rumford (1960); Chelius (1962); 
Chemical Engineering (1962-, 1970-, 1980,1984); Heckler 
etal. (1962); Wyma (1962); Brauweiler (1963); Gleekman 
(1963,1970); Kane and Horst (1963); J.F. Mason (1963); 
Samans (1963,1966); E.M. Sherwood (1963);Tracy (1963); 
Bulow (1964); Fenner (1964,1967,1968,1970); Hughson and 
Labine (1964); Jaffee (1964); Juniere and Sigwalt (1964); 
Klouman (1964); Kuli (1964); Lancaster (1964,1969,1970, 
1971); Renshaw (1964); Funk (1965); GANelson (1965); 
Anon. (1966a); Carmichael etal. (1966); Halbig (1966); 
IChemE (1966/42,1978/71); C.M. Parker (1966); Petsinger 
and Marsh (1966); Speed (1966); Duhl (1967); Mara (1967); 
Sheets, O’Hara and Snyder (1967); Dukes and Schwarting 
(1968); R. Miller (1968); Leonard (1969); Schweitzer (1969); 
Skaudahl and Zebroski (1969); Anon. (1970c); Benzer 
(1970); Briton, Declerck and Vorhis (1970); Desenby (1970); 
Fontana (1970); Gregory (1970); Gulya and Marshall (1970); 
C.A. Robertson (1970,1972); Skabo (1970);Tarlas (1970); 
Tatar (1970); Tucker and Cline (1970,1971); Zolin (1970); 
Anon. (1971b); IMechE (1971/4,1982/63,1989/107,1992/ 
139); F.E. Lawrence (1973); Smithells (1973); Tesmen (1973); 
L. Evans (1974); W. Lee (1974); McDowell (1974); Hughson 
(1976); Kerr (1976); McCandless and Ingram (1976); Mack 
(1976); Menzies (1976); Wyatt (1976); Bonner (1977); Grafen, 
Gerischer and Gramberg (1977); Anon (1978 LPB 23, 
p. 136); Brady and Clauser (1978); Cangi (1978); Chambard 
(1978); Hornbostel (1978); RE. Moore (1979); Schillmoller 
(1979); Weiner and Rogers (1979); Ashby and Jones (1980); 
Bro and Pfflsbury (1980); Gallagher (1980); Gramberg, 
Gunther and Grafon (1980); Greene (1980); Hagel and 
Miska (1980); Nichols (1980);Tvrdy etal. (1980); Beer and 
Johnstone (1981); WW. Marshall (1981); Pollock (1981-); 
Weismantel (1981); Schiefer and Pape (1982); Crook and 
Asphahani (1983); Gackenbach (1983); Martino (1983); 
Murali (1983); Shuker (1983); Baker-Counsell (1984a); 
Fensom and Clark (1984); Horner (1984); Bayer and 
Khandros (1985); Kirby (1985b); Asphahani (1986); 
Declerck and Patarcity (1986); R. King (1986); Cornish 
(1987); Sandier and Luckiewicz (1987); M. TUrner (1987); 
Dean (1989); Setter-kind (1991); Kane (1992); Pollock (1992); 
Puyear (1992) ANSI H series: BS (Appendix 27 Concrete, 
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Steels and Tubes, Test Methods), BS EN series Stainless 
steel: ASTM (STP 369,1952 DS 5,1965 DS 5-SI, 1969 
DS 5-S2,1982 STP 756); Hughson (1961b); Luce and 
Peacock (1962,1963); Bates (1963); Edstrom and Ljungberg 
(1964,1965); Scharfstein (1964); Krisher (1965); McDowell 
(1965); Merrick and Mantell (1965); Keating (1968); 

Long (1968); Husen and Samans (1969); Kies, Franson and 
Coad (1970); Knoth, Lasko and Matejka (1970);Vandelinder 
(1970); Gaugh (1972,1976); Pitcher et al. (1976); British Gas 
(1977 TIN2); Peckner and Bernstein (1977); Fowle (1978); 
Anon. (1979 LPB 28, p. 118); Davison and Miska (1979); 
Sedricks (1979);Truman and Haigh (1980); R. Brown (1981); 
R. Cook and Guha (1981); J.D. Redmond and Miska (1982, 
1983); J.B. Wright (1982); Martenson and Supko (1983); 

J.R. Fletcher (1984); P. Marshall (1984); Schillmoller and 
Althoff (1984); J.D. Redmond (1986); Smith (1987 SRD 
R353); Institute of Materials (1988 B426); Henderson, King 
and Stone (1990); Avery (1991); Debold (1991); Warde (1991); 
Underwood (1992);Whitcraft (1992) 

Titanium: R.S. Sheppard and Gegner (1965); Cotton (1970); 
Feige and Kane (1970); C.P. Williams (1970); W.D. Clark and 
Dunmore (1976); Covington, Shutz and Franson (1978); 
Seagle and Bannon (1982) 

Clad materials: Beckwith (1987); Lednicky and Lindley 
(1991); Lerman and Carrabotta (1991); Henthorn and 
Lednicky (1992); B. Singh (1993) 

Plastics including fibre reinforced plastics: Norden (1960c); 
P. Morgan (1961); Costello, Rhodes and Yovino (1965); 
Parkyn (1970); Parratt (1972); Catherall (1977); 
Cheremisinoff and Cheremisinoff (1978); Fasano and 
Eberhart (1980); N.J. Kraus (1980); McBride (1980); Piggott 
(1980); Puyear and Conlisk (1980); Rolston (1980); Margus 
(1982); Baines (1984); Dibbo (1984); Watt and Perov (1985); 
Rubin (1990); M. Schwartz (1991); M.A. Clark (1992); 
Goldsmith (1992b); Currieo (1993); W. A. Miller (1993) 
Timber: Desch (1981); T. Smith (1987) 

Glass: Lofberg (1965); Rawson (1980); Anon. (1981 LPB 41, 
p. 1; 1981 LPB 42, p. 11; 1982 LPB 44, p. 35); Bucsko (1983); 
Hoult (1983); Lerman and Carrabotta (1991) 

Paints: Charlton (1963); British Gas (1983 BGC/PS/ 
DAT12); Baker-Counsell (1985a); Foscante (1990) 

High temperature materials 

ASME (Appendix 28 Materials, Pressure Vessels and Piping, 
1975/71,1979/137,1982/156,1983/164,1984/172,1989 PVP 
163); ASTM (Appendix 28, DS series); IMechE (Appendix 
28, EGF and ESIS series); Institute of Materials (Appendix 
28); Schley (1960); E.W. Ross and McHenry (1963); R. Miller 
(1968); Gaugh (1976); Mack (1976); Hasselman and Heller 
(1980); IMechE (1983/71,1987/95,1988/104); Gooch et al. 
(1983); Skelton (1983,1987); Marriott et al. (1988) 

Low temperature materials 

ASTM (STP 47,63,78,158, DS 22); E.W Johnson (1960); 

R.J. Johnson (I960); Rote and Proctor (1960); Vanderbeck 
(1960); Zenner (1960); Hwoschinsky (1962); Hurlich (1963); 
C.M. Parker and Sullivan (1963); R.W. Campbell (1967); 
Wigley (1979); IMechE (1982/60); R.P. Reed and Clark 
(1983); British Gas (1990 TIN26) 

Materials for particular applications 

Acids: Falcke and Lorentz (1985); Ireland (1985) 

Ammonia: W.L Ball (1968b); Inkofer (1969); Rohleder 
(1969); Kobrin and Kopecki (1978); van Grieken (1979); 
Ishimaru and Takegawa (1980); Prescott and Badger 
(1980); Prescott (1982); El Ganainy (1985) 


Chlorine: Dukes and Schwarting (1968); BCISC (1975/1); 
Horowitz (1981); Chlorine Institute (1982 Pmphlt 60,1985 
Pmphlt 6,1986 Pmphlt 1); Hamminck and Westen (1986); 
Royce (1988b) 

Hydrogen: C.M.Cooper (1965,1972a); API (1967 Publ. 940, 
1971 Publ. 942,1975 Publ. 945,1978 Publ. 956,1990 Publ. 
941); GANelson (1965,1966); Molstad and Gunther (1967); 
Gorman (1962); Cracknell (1976); Bonner (1977); C.C. Clark 
(1978);Treseder (1981); ASME (1982/88); Webb and Gupta 
(1984) 

Hydrogen sulfide: Sivalls (1985); Schwinn and 
Streisselberger (1993) 

Oxygen: Lowrie (1987) 

Materials control, identification 

W.D. Clark and Sutton (1974); Duff (1976); Ostrofsky 

(1980-); Baker-Counsell (1985d) 

Corrosion 

ASTM (STP 179, 567,1972 STP 516,1974 STP 534, 558); 
CONCAWE (23/70); Institute of Materials (Appendix 28); 
NRC (Appendix 28 Corrosion); Uhlig (1951); Greathouse 
and Wessel (1954); Chlorine Institute (1956 Publ. 18); 
Fontana (1957,1986); Jelinek (1958-); J.E. Dawson (1960a); 
U.R. Evans (1960); Gladis (1960); Norden (1960b);Wachter 
(1960); Hughson (1963); J.D. Jackson (1961); Brooke (1962); 
Draley (1962); Swandby (1962);Tracy (1962a,b); Bergstrom 
and Ladd (1963); Charlton (1963); Fochtmann, Langion and 
Howard (1963); Hinst (1963); Krebs (1963); Wilder (1963); 
Wilten (1963,1965); Ashbaugh (1965a); Menzies etal. 
(1965); Sorell (1965,1968,1970); E.H. Anderson (1966); 
Bates (1966); A.S. Cooper and McConomy (1966);T. A. Lees 
(1966); Sculley (1966); Canavan (1967); Dingman (1967); 
Falck-Muus (1967); Iverson (1968); Rabald (1968); D. 
Stewart and Kulloch (1968); Landrum (1969,1970); Maylor 
(1969); Schweitzer (1969,1976,1989); J.M. Brooke (1970); 
Dunlop (1970); Fenner (1970); Husen and Samans (1970); 
Thornton (1970); Diamaui (1971); Henthorne (1971-); 

Hoar (1971); Lochmann (1971); Anon. (1972h); Bonar (1972); 
C.M. Cooper (1972b); P.O. Thomas (1972); Cantwell and 
Bryant (1973); IChemE (1973/54); Lux (1973); McDowell 
(1973); J. A. Richardson and Templeton (1973); F.L Evans 
(1974a); G. A. Nelson (1974); Rodgers (1974); Dol (1975); Appl 
and Feind (1976); Dragoset (1976); Lancaster (1976); Shreir 
(1976); Berger (1977,1982); Brautigam (1977); Chadwick 
and Jamie (1977); Hawk (1977); Pludek (1977); Cangi (1978); 
Edeleanu (1978); Fontana and Greene (1978); Fryer (1978); 
Layton (1978); Leach (1978); Ueda etal. (1978); Chase (1979); 
Schumacher (1979); Sedriks (1979); Braunton (1980); 

J.M. West (1980); Danilov (1981); Rozenfeld (1981); 

A.E. Wallace and Webb (1981); Ailor (1982); McIntyre (1982); 
Mallinson (1982); Parkins (1982); Bernie (1983); Stafford 
and Whittle (1983); Cihal (1984); Elliot (1984); NACE (1984); 
Baker-Counsell (1985b); Holmes (1985); Kyte (1985); Pelosi 
and Cappabianca (1985); R. Stevens (1985);Twigg (1985); 
Anon. (1986f); Dillon (1986); AGA (1987/48,49,1988/51); 
Anon. (1987z); DECHEMA (1987-); R.W. Green (1987); 
Kofstad (1988); Munn (1988); Royce (1988a); Sathe and 
O’Connor (1988); M. Turner (1988,1989a, b, 1990a-c); 
Avery (1991a); R.D. Kane (1991); Wilhelm (1991); Priest 
(1992); R.D. Kane et al. (1993) 

Erosion: Thiruvengadam (1966); ASTM (1979 STP 664); 
Craig (1985) 

External corrosion: Hughson (1961c); Figg (1979); SCI 
(1979); Anon. (1984 LPB 56, p. 1); Dorsey (1984); Batterham 
(1985); Liss (1987); Pollack and Steeley (1990) 
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Corrosion of steel in concrete: ASTM (1977 629,1980 713, 
1984 818) 

Concrete: Figg (1979,1983); Sheppard (1984); Closner 
(1987a) 

Materials and corrosion problems 

Field (1963); D.T. Williams (1963); Gleekman (1964); 

C.F. Lewis (1964); Heckler (1969); Capel and van der Horst 
(1970); Krystow (1971); Schwab (1971); J.L Cook (1972); 

R. Lee (1972); Rollins (1972); Spangler (1972); Butwell, 
Hawkes and Mago (1973); W.D. Clark and George (1973); 
Kussmaul and Kregeloh (1973); Lancaster (1973); Anon. 
(1975 LPB 6, p. 1); R.J. Parker (1975); Anon. (1976 LPB 9, 
p. 26); R.P. Lee (1976a,b, 1977a,b); Livsey and Junejo (1976); 
Anon. (1977 LPB 15, p. 23); B. Turner (1977); Anon. (1978 
LPB 24, p. 172); Bognar, Peters and Schatzmayr (1978); 
Schmeal, MacNab and Rhodes (1978); K. Brown (1982); 
Hare (1982); Quraidis (1982); R.W. Clarke and Connaughton 
(1984); Sheilan and Smith (1984); WL. Sheppard (1984); 

R. Stevens (1985); Anon. (1986f); Kolff (1986); A. Atkinson 
(1988); Schofield (1988); Schofield and King (1988); 
Cantwell (1989 LPB 89); Nightingale (1989a,b, 1990); 
Anon. (1990 LPB 92, p. 11); linstroth (1991) 

Fracture, fracture mechanics 

ASME (Appendix 28 Applied Mechanics, Materials, 
Pressure Vessels and Piping, 1975/72); ASTM (Appendix 27); 
IMechE (Appendix 28 EGF, ESIS series); Institute of 
Materials (Appendix 28); NRC (Appendix 28 Crack Growth, 
Fatigue, Fracture Mechanics)-, A. A. Griffith (1920-21); 
Neuber (1937); Westergaard (1939); Sneddon (1946,1973); 
Irwin (1948,1957,1958,1962,1968); Dryden, Rhode and 
Kuhn (1952); E.R. Parker (1957); Dugdale (1960,1968); 

A.A.Wells (1961,1969); Bilby, Cottrell and Swinden (1963); 
Paris and Erdogan (1963); Hahn and Rosenfleld (1965,1967, 
1968); R.E. Johnson (1965); Paris and Sih (1965); Burdekin 
and Stone (1966); Pratt (1966); Sih (1966,1973a,b); Irwin 
etal. (1967);Tetelman and McEvily (1967); Liebowitz (1968); 
Rice (1968a,b, 1976); Sneddon and Lowengrub (1969); 
Pellini (1971); ASTM (1972 STP 513,514,1974 STP 556,559, 
560); Battelle Columbus Labs (1972); Begley and Landes 
(1972); Bravenec (1972); Bucci et al. (1972); Eftis and 
Liebowitz (1972); Heald, Spink and Worthington (1972); 
Formby, Kirby and Ratcliffe (1973); Irvine (1973 SRD 
R21,1974 SRD R26,1977 SRD R48); Kiefner et al. (1973); 
Kihara and Ikeda (1973); Knott (1973); Nichols (1973);Tada, 
Paris and Irwin (1973); Broek (1974); Fearnehough (1974); 
Harvey (1974); Hood (1974); J.N. Robinson and Tetelman 
(1974); Shannon (1974a,b); Tanaka (1974); Cartwright and 
Rooke (1975); Crossley and Ripling (1975); Dumm and 
Fortmann (1975); Gibbons, Andrews and Clarke (1975); 
MacCary (1975); Pook (1975a,b, 1977,1979); Underwood 
(1975); Dragoset (1976); Erdogan (1976); Rooke and 
Cartwright (1976); Eftis, Subramanian and Liebowitz 
(1977); Engineering Sciences Data Unit (1977);T.G.F. Gray 
(1977); Knowles,Tweedle and van der Post (1977); Rolfe and 
Barsom (1977,1987); Sorenson and Besuner (1977); Stanley 
(1977); H.M. Thomas (1977,1981); AGA (1978/28,1988/50, 
1991/72,76,1992/79,84,85); Chell (1978); Hudson and 
Seward (1978); Paris etal. (1978);Vosikovsky and Cooke 
(1978); Cesari and Hellen (1979); R.P. Harrison, Loosemore 
and Milne (1979); Nichols (1979a); AP. Parker (1979,1981); 
Suzuki,Takahashi and Saito (1979); CEC (1980 EUR 6371 
EN); HSE (1980 EM 4, EM 5); G.O. Johnson (1980); O’Neil 
(1980); Ponton (1980); Wiberg (1980); R.P. Harrison and 


Milne (1981); Kastmretal. (1981); Lorio and Crespi (1981); 
Shih, German and Kumar (1981); Ziebs etal. (1981); Johnston 
(1982); Ainsworth and Goodall (1983);Temple (1983,1985); 
Haines (1983); Tomkins (1983); Arimochi etal. (1984); Ewalds 
and Gielisse (1984); Ichikawa (1984c, 1985,1987); Imai et al. 
(1984);Latzkoe/a/. (1984); Lidiard (1984); SaldanhaPeres and 
Rogerson(1984); Funderburg(1985); Milne et al. (1986, 
1988a,b); IMechE (1987/95); Jutla(1987);Thomson (1987); 
J.K.W. Davies (1989b); HSE (1989 Nuclear Installations 12); 
Tomkins, Lidbury and Harrop (1989); Schulz and Braun 
(1992); Medhekar, Bley and Gekler (1993) 

Fatigue 

ASME (Appendix 28Materials, 1981/11,84,1984/92,94); 
ASTM (STP 91,237,1972/ 513,514,1973 STP 520,1974 STP 
556,559,560); IMechE (Appendix 28EGF, ESIS series, 
1975/15,1977/40); NRC (Appendix 28 Crack Growth, Fatigue, 
Fracture Mechanics)-, Dryden, Rhode and Kuhn (1952); 
Kooistra and Lemcoe (1962); Yao and Munse (1962); 

Manson (1966); Avery (1972b); Tomkins (1973); Harvey 
(1974); Frost, Marsh and Pook (1975); Pook (1975a,b, 1977); 
WJ. Harris (1976); Duggan and Byrne (1977); Linhart 
andJelinek(1977);Bongers,DiolsandLinssen(1978); 
Cowley and Wylde (1978); Michelini (1978); Klesnil and 
Lukas (1980); Skelton (1983,1987); Larsson (1984); 

Younas and Sheikh (1987); Fromm, Liebe and Siegel (1988); 
J.KW. Davies (1989) 

Ageing 

NRC (Appendix 28 Ageing) 

Embrittlement, brittle fracture 
E.R. Parker (1957); Biggs (1960); Tipper (1962); Ladd 
(1966); WD. Clark and Mantle (1967);W.J. Hall etal. (1967); 
Sorell and Zeis (1967); Harnby (1968); Madayag (1969); 
Boyd (1970); Karinen (1971); Moisio (1972); Anon. (19741); 
ASTM (1974 STP 543,1984 STP 844); Afzal and Livingston 
(1974); Harvey (1974); Lamberton and Vaughan (1974); 
Lonsdale (1975);Watanabe and Murakami (1981); Murza, 
Centner and McMahon (1981); B.J. Shaw (1981); AGA 
(1983/38); Merrick and Ciuffreda (1983); Maxey etal. 
(1985); Wilkie (1985a); Snyder (1988); API (1990 Publ. 920); 
Burke and Moore (1990) 

Stress corrosion cracking 

ASTM (STP 64,264,397,1967 STP 425,1972 STP 518, 

1976 STP 610,1979 STP 665); Copson and Cheng (1957); 
Hughson (1961a); Loginow and Phelps (1962); Wilten 
(1962); Ashbaugh (1965b, 1970);Truman and Kirkby (1965); 
Logan (1966); Anon. (1972J); van der Horst (1972); 
Hutchings etal. (1972); Phelps (1972,1974); Collins and 
Monack (1973); Creamer (1974); Harvey (1974); Zeis (1975); 
Zeis and Paul (1975); van Grieken (1976,1979); Harvey 
(1976); HSE (1976 TON 53/2); Arup (1977); W.D. Clark and 
Cracknell (1977); Anon. (1979 LPB 28, p. 104); Karpenko 
and Vasilenko (1979); Cracknell (1980); Ishemaru and 
Takegawa (1980); Macintyre (1980);Takemura, Shibasaki 
and Kawai (1981); Gossett (1982); Anon. (1983r); AGA 
(1984/40,1988/56,1990/68,70,1991/71,1992/87,88); 
Blanken (1984); L. Lunde (1984); Orbons and Huurdeman 
(1985); Lemoine etal. (1986); Loginow (1986); Schillmoller 
(1986); L. Lunde and Nyborg (1987,1989,1990); Stephens 
and Vidalin (1988); Anon. (1989 LPB 89, p. 27); 
Bockenhauer (1989); Byrne, Moir and Williams (1989); 
Parkins (1989); Appl etal. (1990); Selva and Heuser 
(1990); Conley, Angelsen and Williams (1991); Crawley 
(1992 LPB 104) 
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ASME (Appendix 28 Materials , 1981/84,1984/92,94,1988 
PVP 35,151) ASTM (STP 26, 37,107,325,391); Institute of 
Materials (Appendix 28); Finnie and Heller (1959); Anon. 
(1969e); Lochmann (1972); Harvey (1974); IMechE (1974/7, 
1975/15,1977/36,1978/47,1994/162); HSE (1977 TON 53/3); 
Imoto,Terada and Maid (1982); Konoki, Shionohara and 
Shibata (1982); Ashby and Brown (1983); Tomkins (1983); 
H.E. Evans (1984); Kawai et al. (1984); Larsson (1984); 
Anon. (1986e) 

Hydrogen corrosion 

Anon. (1962d); Cooper (1965,1972a); McDowell and 
Milligan (1965); McDowell (1967); Ciuffreda and 
Hopkinson (1968); Ciuffreda and Greene (1972); AGA (1974/ 
19); Harvey (1974); K.L. Moore and Bird (1965); Bonner 
(1977); AW. Thompson (1978); Truax (1978); Tvrdy et al. 
(1981);Timmins (1983,1984); Webb and Gupta (1984); 
Genet and Perdrix (1987) 

Liquid metal attack 

British Gas (1982 TIN16) 

Zinc embrittlement 

Ball (1975a,b, 1976); Cottrell and Swann (1975a,b, 1976); 
Harvey (1976); HSE (1976 TON 53/1,1977 PM 13); Anon. 
(1979 LPB 29, p. 149); Anon. (1979 LPB 30, p. 175); British 
Gas (1983 BGC/PS/DAT11); SETE Consultants and 
Services Ltd (1984 LPB 55) 

Tribology, wear 

ASTM (STP 30, 567,1969 STP 446); Burwell (1957-58); 
Norden (1960a); MacGregor (1964); Furey (1969); Summers- 
Smith (1969); M.C. Shaw (1971); Avery (1972a); M.J. Neale 
(1973); Hailing (1975); IMechE (1975/17,22,1977/45,1980/ 
53,1994/167); Engel (1976); PR. Williams (1976); ASME 
(1977/74,1979/80,1980/10,1981/87,1983/91,1985/96); 
Fenton (1977); Schumacher (1977); Sorenson and Besuner 
(1977); Sayles and Macpherson (1980); Suh and Saka 
(1980); Szeri (1980); Buckley (1981); Briscoe (1982) 


0.5 bar above atmospheric pressure, and which fluid or 
mixture of fluids is - (i) a gas, or (ii) a liquid which would 
have a vapour pressure greater than 0.5 bar above atmo¬ 
spheric pressure when in equilibrium with its vapour at 
either the actual temperature of the liquid or 17.5°C; or (c) a 
gas dissolved under pressure in a solvent contained in a 
porous substance at ambient temperature and which could 
be released from the solvent without application of heat’. 

Regulation 4 deals with the design, construction, repair 
and modification of pressure systems. Regulations 5—13 
cover essentially operation, inspection and maintenance. 
Regulation 7 requires there to be safe operating limits. 
Regulation 5 requires marking of equipment, Regulation 8 
a written scheme of examination, Regulation 9 examina¬ 
tion in accordance with this scheme and Regulation 13 the 
keeping of records. Regulation 11 covers operation and 
Regulation 12 maintenance, whilst Regulation 10 deals 
with action in the case of imminent danger. 

Requirements for the provision of protective devices 
are contained in Regulation 4 and also in Regulations 
14 and 15. This aspect is discussed in more detail in 
Section 12.12. 


12.2 Pressure System Components 

The main components of pressure systems have been 
described by Dickenson (1976). They are: 

(1) pressure vessels (reactors, distillation columns, stor¬ 
age drums and vessels); 

(2) piping system components (pipes, bends, tees, redu¬ 
cers, flanges, valves, nozzles, nipples); 

(3) means of adding, controlling or removing heat (fired 
heaters, reboilers, vaporizers, condensers, coolers, 
heat exchangers generally); 

(4) means of increasing, controlling or reducing pressure 
(pumps, compressors, fans, letdown turbines, control 
valves); 

(5) means of adding or removing fluids or solids to or from 
theprocesssystem(pumps, compressors, dump valves); 

(6) measurement and control devices and systems 
(instrumentation); 

(7) utilities and services (electricity, steam, water, air). 

Item (7) was considered in Chapter 11 and item (6) is 
described in Chapter 13. The other items are dealt with in 
the following sections. 

12.3 Steels and Their Properties 

The main material of construction used in pressure sys¬ 
tems is steel and it is necessary to consider some of the 
properties of steel which are particularly important in 
relation to pressure systems and which are the basis of 
pressure systems standards and codes of practice. 

Steels and other materials are discussed in Selecting 
Materials for Chemical and Process Plant (L. Evans, 1974), 
Handbook of Materials Science (C.T. Lynch, 1974-), Materi¬ 
als Handbook (Brady and Clauser, 1978), Construction 
Materials (Hornbostel, 1978), Materials for Low Tempera¬ 
ture Use (Wigley, 1979), Mechanics of Materials (Beer and 
Johnstone, 1981), Physical Properties of Materials for Engi¬ 
neers (Pollock, 1981-) and Selection and Use of Engineering 
Materials (Crane and Charles, 1984). 

Accounts of the general properties of steels in relation to 
their use in pressure vessels are given in Theory and Design 
of Modern Pressure Vessels (Harvey, 1974), Pressure Compo¬ 
nent Construction (Harvey, 1980) and Pressure Vessel Sys¬ 
tems (Kohan, 1987). The main steels used in process plant 
and their relation to the standards and codes are described 
by L. Evans (1974). 

12.3.1 Stress, strain and elasticity 

If a specimen test bar of a material is subjected to a tensile 
load in a tensile testing machine, stress is induced in the 
material and strain occurs. 



where a 0 is the original cross-sectional area, / is the force 
and a is the stress. The strain, or fractional elongation, is: 



where e is the strain, l 0 is the original length and 8 is the 
elongation. 
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The typical load-extension, or stress-strain, diagram 
obtained for many metals, including mild steel, is shown in 
Figure 12.1. At low loads the material is elastic, returning to 
its original dimensions when the stress is removed, and the 
strain is proportional to the stress: 

[12.3.3] 

where E is the elastic modulus. Equation 12.3.3 is Hooke’s 
law and the constant E is Young’s modulus. 

As the load increases, there is a change in material 
behaviour indicated by points A and B in Figure 12.1. 
The proportionality limit at A is the stress beyond which 
the strain is no longer proportional to the stress. The elastic 
limit at B is the stress beyond which the material no 
longer returns to its original dimensions, but undergoes 
some permanent deformation. For mild steel and many 
other materials the proportionality and elastic limits coin¬ 
cide, hut for some, such as rolled aluminium, they are 
separate. 


12.3.2 Yield and tensile strengths 

The yield point C, which is close to points A and B, is the 
stress at which there occurs a marked increase in strain 
without an increase in stress. For many engineering appli¬ 
cations it is not acceptable that the material should yield. 
The yield point represents the limit of strength in such 
applications. 

As the load increases further, there is continued exten¬ 
sion until point D is reached at which fracture occurs. The 
stress at fracture is the ultimate tensile stress, or strength: 



where/ u is the force at ultimate tensile stress and i u is the 
ultimate tensile strength. 

The ultimate tensile strength given in Equation 12.3.4 is 
the engineering value based on the original cross-sectional 
area of the specimen. In fact, there is a reduction of this 
area prior to rupture so that the true tensile strength is: 


[12.3.5] 


where a is the actual cross-sectional area and r u t is the true 
ultimate tensile strength. The ultimate tensile stress 
represents the limit of strength in applications where 
yielding is acceptable, but rupture is not. 



steel 


12.3.3 Ductility 

Another important property of a material is its ductility, or 
its ability to undergo deformation. Ductility may be 
expressed as fractional elongation: 

<4 = ^ [12.3.6] 

or fractional reduction in area 

da= fl °“ ar [12.3.7] 

where a r is the cross-sectional area at rupture, d a is the 
fractional reduction in area at rupture, d e is the fractional 
elongation and l r is the length at rupture. 

Ductility is a very desirable property in a steel and is 
important for design and for fabrication. In pressure ves¬ 
sels, features such as joints, openings and nozzles create 
additional load stresses which may not be fully allowed for 
in the design. Ductility permits local yielding so that the 
stress is adjusted. Similarly, ductility allows material to 
undergo fabrication operations, such as rolling, forging, 
drawing and extruding, without fracturing. 

12.3.4 Toughness and impact strength 

A further property which is important in a material is its 
toughness, or ability to resist impact. Toughness is mea¬ 
sured by the energy absorbed in stressing to fracture, 
which is the area under the stress-strain curve, and thus 
the modulus of toughness is given by the area: 

T=J Q a de jl2.3.8] 

where e r is the strain at rupture and T is the toughness. 
A material which has both high tensile strength and high 
ductility has high toughness. Toughness is another prop¬ 
erty which is very desirable in a steel, and loss of tough¬ 
ness, or embrittlement, is a serious defect. 

12.3.5 Low temperature strength 

At low temperatures, mild and other steels tend to suffer a 
loss of toughness as shown in Figure 12.2. For mild steel the 
ductile/brittle transition occurs at about 0°C; the precise 
transition temperature depends on the type and quality of 
the steel. An account of brittle fracture is given in The Brittle 
Fracture of Steel (Biggs, 1960). Since much process plant 
operates at low temperatures, such embrittlement is impor¬ 
tant. Low temperature embrittlement has been the cause of 
many failures, and is discussed further in Section 12.27. 

12.3.6 High temperature strength 

At high temperatures, the strength of many materials, 
including mild steel, tends to decrease, as illustrated in 
Figure 12.3. The yield point falls and becomes less pro¬ 
nounced, and the ultimate tensile strength also falls. 
Moreover, a further factor begins to limit strength at high 
temperature. This is creep. 

12.3.7 Creep strength 

Creep is an extension which occurs in metals, including 
mild steel, at high temperatures under constant load over 

= 1 112.3.9] 
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where 4 is the time at stress and temperature conditions i 
and t r i is the creep life at stress and temperature conditions 
i. Similarly, for strain at different stresses and tempera¬ 
tures the condition is given by the ‘strain fraction’ rule: 

Ej-1 [12.3.10} 

where is the strain at stress and temperature conditions 
i, and e ri is the strain for rupture at stress and temperature 
conditions i. 

Use is also made of the following equation which utilizes 
the geometric mean of these two approaches: 

§(! |f- w 



Figure 12.2 Typical impact strength diagram for 
mild steel 



Figure 12.3 Typical load-extension diagram at high 
temperatures for mild steel 


a period of time. Accounts of creep are given in Perspectives 
in Creep Fracture (Ashby and Brown, 1983) and Mechanisms 
of Creep Fracture (H.E. Evans, 1984). 

The typical results of a creep test on mild steel carried 
out in a tensile testing machine at constant load and con¬ 
stant temperature are illustrated in Figure 12.4. There is a 
short primary phase (1) when the creep rate is fairly rapid, a 
long secondary phase (2) when it is approximately con¬ 
stant, and a short tertiary phase (3) when it accelerates to 
rupture. 

The typical variation of creep rate with loading and 
temperature is illustrated by Figure 12.5. The creep 
strength of a material at a particular temperature is usually 
expressed either as the stress for 1% extension in 100,000 h 
or as the stress for rupture in 100,000 h. The former is nor¬ 
mally taken as not less than two-thirds of the latter. 

Frequently, a steel is subjected to a number of different 
temperatures and/or stresses. For such cases, it is common 
practice to calculate the fraction of creep life used up as 
follows. For time at different stresses and temperatures, 
the condition for exhaustion of the creep life is given by 
the ‘life fraction’ rule: it is emphasized that Equations 
12.3.9-12.3.11 are approximate. The applicability of these 
equations is discussed in more detail by Harvey. 

Since high temperatures are common in process plant, 
creep is very important. It is considered again in Section 12.27. 




Figure 12.5 Typical variation of creep rate with loading 
and temperature for mild steel 
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12.3.8 Fatigue strength 

Many ductile metals, including mild steel, can under cer¬ 
tain conditions suffer fatigue failure at a stress well below 
the ultimate tensile strength if subjected to repeated cycles 
of stress. Accounts of fatigue are given in Fatigue and. 
Fracture of Metals (Dryden, Rhode and Kuhn, 1952), Fatigue 
of Metallic Materials (Klesnil and Lukas, 1980), The 
Mechanics of Fatigue and Fracture (A.R Parker, 1981), Fati¬ 
gue at High Temperatures (Skelton, 1983) and High Tem¬ 
perature Fatigue (Skelton, 1987). 

Whether fatigue failure occurs depends on the magni¬ 
tude of the stress range which is applied and on the 
number of repetitions of the stress. The relationship 
between these two factors is shown in Figure 12.6, which 
illustrates the results of a typical fatigue test on mild steel. 
Fatigue testing is usually done using the reversed bending 
test, in which a load is applied at the end of a cantilever 
test specimen which is then rotated at constant speed, so 
that the full reverse bending stresses are created each 
revolution. The data from such tests may be plotted as 
maximum stress or as stress range. The stress range is the 
fundamental parameter, but the maximum stress is often 
plotted. 

The curve given in Figure 12.6 has two distinct regimes. 
In the first region, to the left of the break point, failure 
occurs at decreasing stresses but increasing number of 
cycles, while in the second region to its right there is a 
stress level below which failure does not occur irrespective 
of the number of cycles. This stress level is the fatigue limit, 
or endurance limit, and is an important property. For most 
steels at room temperature a good estimate of the fatigue 
limit may be obtained from the ultimate tensile stress using 
the relation: 

oe = <ka u [12.3.12] 

where a E is the fatigue limit and cr u is the ultimate tensile 
stress. The fatigue limit for steels other than high strength 
steels is generally 40-55% of the ultimate tensile strength. 

The number of cycles at which the fatigue limit occurs at 
room temperatures is of the order of 10 6 -10 7 . It is often 
convenient, therefore, to take the fracture stress at 10 8 
cycles as the practical limit. 



Figure 12.6 Typical fatigue test for mild steel 


Although it is high cycle fatigue which has been most 
studied, low cycle fatigue is also important. This occurs at 
higher stresses and smaller number of cycles and corre¬ 
sponds to the first region in Figure 12.6. In this region, if the 
data are expressed as stress there is usually considerable 
scatter, but the scatter is reduced if the data are expressed 
as strain. A strain is often multiplied by one-half of the 
elastic modulus to give a pseudo-stress amplitude. Low 
cycle fatigue is generally considered to cover the region 
below 10 s cycles. 

It can be shown for many metals, including mild steel at 
room temperature, that the relation between the stress 
amplitude and the number of cycles N at fatigue failure can 
be described approximately by the equation: 



This equation covers the range of both low cycle and high 
cycle fatigue. It may be used to calculate a fatigue life curve. 
A fatigue design curve may then be obtained using suitable 
factors of safety. Typical factors of safety are 2 on stress 
amplitude or 20 on the number of cycles, whichever is the 
more conservative. 

A steel is generally subjected to a number of cycles at a 
number of different stresses. At each stress the fraction of 
life used up is given by the cycle ratio n/N. The condition 
for fatigue failure is given by the ‘cycle ratio’ rule: 

= 1 I 12 - 3 - 14 ! 

where n is the actual number of cycles and Mis the number 
of cycles at fatigue failure. It is emphasized that Equation 
12.3.14 is approximate. 

There are a number of other factors which also affect 
fatigue strength. They include (1) temperature, (2) corro¬ 
sion and (3) surface condition. In the range from room 
temperature up to about 350°C many steels, including mild 
steel, show no loss of fatigue strength. In fact there is often 
a slight gain. But at higher temperatures fatigue strength 
begins to decrease. At higher temperatures still, creep 
becomes a significant factor. Reduction of fatigue strength 
by corrosion may be the result of surface roughening or of 
reduction of cross-sectional area. More serious is true corro¬ 
sion fatigue, in which deterioration is due to the interaction 
of fatigue and corrosion. 

The general effect of corrosion fatigue is to reduce the 
fatigue strength. With corrosion fatigue there is generally 
no definite fatigue limit. Corrosion fatigue tends to he 
worse if oxygen is present. Oxygen normally reduces the 
low cycle fatigue strength. Whether the fatigue limit is 
reduced depends on the surface condition. A reduction in 
fatigue strength due to oxygen tends to occur if very sharp 
cracks are present. 

Fatigue strength is, in general, greatly reduced if there 
are cracks or similar surface defects. A high stress con¬ 
centration occurs at the extremities of the crack and the 
crack grows a finite amount each cycle. The growth of fati¬ 
gue cracks is the subject of fracture mechanics, which is 
considered in Section 12.28. 

Another important factor in fatigue is the temperature 
changes which occur and which cause thermal stress 
fatigue. This is an effect quite separate from that of 
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temperature on fatigue strength. Thermal changes are a 
source of cycling and tend to be difficult to predict, but are 
often appreciable. If the thermal stress is large, it may cause 
the metal to deform. This deformation results in a more 
favourable stress distribution, and to this extent thermal 
stress is self-correcting, but there may also be some crack¬ 
ing. Cracks arising during thermal stress may grow as a 
result of mechanical stress. 

An index of susceptibility to thermal stress is given by 
the thermal shock parameter 


<£ = — 12.3.15; 

where k is the thermal conductivity, a is the coefficient of 
thermal expansion, and <j> is the thermal shock parameter. 

The higher the thermal shock parameter, the more sus¬ 
ceptible the metal is to thermal stress. The thermal shock 
parameter of mild steel is less than that of austenitic stain¬ 
less steel by a factor of about 3 at room temperature. The 
difference decreases with temperature, but there is still a 
factor of about 2 at 350°C. 

Mechanical and thermal stresses arising from the 
operation of process machinery, from pressure changes and 
from temperature changes are normal in process plant. 
Fatigue due to these stresses is one of the most common 
causes of failure and is very important. A further discus¬ 
sion is given in Section 12.27. 

12.3.9 Types of steel 

The main types of steel which are used in process plant are: 
(1) carbon steel, including mild steel, (2) low alloy steel and 
(3) stainless steel, including ferritic and austenitic types. 
Of prime importance is the temperature at which the steel 
begins to undergo creep. At room temperature, the strength 
of the steel is limited by the yield and/or tensile strengths. 
As the operating temperature increases, however, the creep 
strength becomes the limiting factor. Thus, the operating 
temperatures may be divided into (1) temperatures below 
the creep range and (2) temperatures above the creep range. 
The basis of design is different for these two cases. 

The approximate threshold temperatures at which onset 
of creep occurs are: 

Mild steel 400°C 

Low alloy steel 500°C 

Austenitic stainless steel 600°C 


The change with temperature in the limiting strengths of 
these three types of steel is shown in Figure 12.7.The shape 
of the curve is broadly similar for all three types. 

12.3.10 Carbon steel 

Carbon steels are generally defined as those containing 
iron, carbon and manganese. Most steels have a carbon 
content of 0.1-0.9% carbon and 0.5-2.0% manganese. 

The most common type of carbon steel is low carbon, or 
mild, steel with a carbon content up to 0.25%. Mild steel is 
described in the following subsection. High carbon steels 
are those with a carbon content above this figure, up to 
about 0.9%. 

Steels containing more than 0.3% carbon are difficult 
to weld. High carbon steel is produced mainly as bar and 



Figure 12.7 Typical yield stress and creep rupture stress 
curves for mild, low alloy and austenitic steels. (L. Evans, 
1974) (Courtesy of Business Books) 


forgings for uses such as shafts, bolts, etc. These steels 
require heat treatment by way of quenching and tempering 
to give their optimum properties. 

12.3.11 Mild steel 

Mild steel is low carbon steel with, as just stated, a carbon 
content less than 0.25%. It is the cheapest and commonest 
form of steel. The properties of mild steel may be illustrated 
by the room temperature properties given in BS 4360:1990 
for plate to grade 43EE: 

Tensile strength 430/580N/mm 2 

Yield strength 265 N/mm 2 

Elongation 20% 

where the yield strength applies to thicknesses in the range 
16—40 mm and the elongation applies over 200 mm. Mild 
steel is ductile and weldable, but it has certain limitations 
which are related to: 

(1) corrosion resistance; 

(2) strength at 

(a) room temperature, 

(b) high temperature, 

(c) low temperature. 

There are many chemicals which corrode mild steel. 
Examples are dilute acids, such as sulfuric, nitric and 
hydrochloric acids, and chemicals containing water, such 
as wet chlorine. 

For pressure vessels, it is often attractive to use a mate¬ 
rial which has a higher strength than mild steel and so to 
have a thinner walled vessel. Low alloy steel is generally 
used instead of mild steel in such applications. 

At high temperatures, above about 400°C, mild steel suf¬ 
fers quite severe creep and it becomes necessary to use other 
steels. At low temperatures, below about 10°C, the ductility 
of mild steel falls off sharply, and brittle fracture can occur, 
as described above. Again, other steels have to be used. 

Mild steel can be modified by the incorporation of small 
amounts of alloying elements. Additionof up to 0.1% niobium 
can increase yield strength and low temperature ductility. 
Addition of up to 1.5% manganese can give substantial 
increases inyieldstrength such as from 230 to 400 N/mm 2 . 




PRESSURE SYSTEM DESIGN 12/13 


12.3.12 Low alloy steel 

The low alloy steels which are important in process plant 
are mainly those which have a carbon content less than 
0.2% and contain a total <12% alloying elements (Ni, Cr, 
Mo,V, B,WorCu). 

Many low alloy steels are given a heat treatment of nor¬ 
malizing and tempering by the manufacturer, but there is 
an increasing tendency to a quenching and tempering 
treatment. Low alloy steels are all weldable, but for some 
steels pre- or post-weld heat treatment is necessary in order 
to avoid weld zone cracking. 

Some principal low alloy steels are: 

0.5 Mo 12 CrMoVW 

1.25 CrMo 0.25 Cr 0.25 Mo 1.5 Ni 

2.25 CrMo 

Some significant advantages of low alloy steels over mild 
steel are: 

(1) yield strength; 

(2) high temperature properties 

(a) creep strength, 

(b) oxidation resistance, 

(c) hydrogen resistance; 

(3) low temperature ductility. 

The improvement inyield strength and in creep strengthis 
illustrated in Figure 12.7. Yield strength is the main design 
parameter used in advanced codes for pressure vessels and 
the gain in yield strength is valuable. Low alloy steels make it 
possible to have thinner walled pressure vessels. Low alloy 
steels such as 0.5 Mo, 1.25 CrMo, 2.25 CrMo and 12 CrMoVW 
are used for their creep properties in applications such as 
steam boilers and refinery crackers and reformers. The 
upper temperature limit for low alloy steels is about 600°C. 

Oxidation resistance is another important property of 
low alloy steels. The principal alloying element which 
imparts oxidation resistance is chromium. Low alloy steels 
also offer greater resistance to hydrogen attack in such 
operations as cracking and reforming. Mild steel ceases 
to be suitable above 250°C, 0.5 Mo steel can used up to 
about 350°C, while 2.25 CrMo steel can go up to about 
550—600°C. Apart from resistance to oxidation and 
hydrogen attack, low alloy steels do not offer much greater 
resistance to corrosion than does mild steel. 

An increase in low temperature ductility down to —50°C 
can be obtained by addition of 1.5 Ni to 0.25 Cr 0.25 Mo steel. 
This is a most valuable modification, since low tempera¬ 
ture embrittlement is a serious problem. Nickel is the main 
alloying element used to give low temperature ductility. 

12.3.13 Stainless steel 

The main alloying elements in high alloy steels are chro¬ 
mium and nickel. A stainless steel is one which contains 
11% or more of chromium. The chromium forms an oxide 
film giving a passive surface, rendering it generally 
more resistant to corrosion than that on the lower alloy or 
carbon steels. 

Accounts of stainless steels are given in Handbook of 
Stainless Steels (Peckner and Bernstein, 1977), Corrosion of 
Stainless Steels (Sedriks, 1979), Austenitic Stainless Steels 
(P. Marshall, 1984) and High Temperature Alloys (Marriott 
et al., 1988) and by Redmond and Miska (1982), J.R. Fletcher 
(1984), Henderson, King and Stone (1990), and Warde (1991). 


The review by Redmond and Miska (1982) covers: the 
role of the alloying elements; the classes of stainless steel; 
their corrosion resistance; their physical and mechanical 
properties; and their fabrication. It also gives numerous 
tables listing the American Iron and Steel Institute (AISI) 
types and Unified Numbering System (UNS) numbers for 
the different classes of stainless steel. 

The principal alloying elements in stainless steel are 
chromium, nickel and molybdenum. Each has a number of 
effects, and mention is made here of only a few. As already 
stated, chromium gives a passive oxide layer which 
increases the corrosion resistance. It also promotes the 
formation of the ferrite phase. Nickel, by contrast, promotes 
the formation of the austenite phase and enhances tough¬ 
ness, ductility and weldability. It also increases resistance 
to strong acids. A principal function of molybdenum is to 
enhance the resistance of the stainless steel to pitting and 
crevice corrosion. 

Broadly, stainless steels have four main advantages: 
(1) higher corrosion resistance, (2) higher resistance to heat, 
(3) higher creep and stress rupture resistance and (4) higher 
strength at ambient and intermediate temperatures. 

For a long time the development of stainless steels was 
hampered by the presence of carbon and nitrogen, which 
can have deleterious effects, but the use of techniques 
such as argon-oxygen decarburization (AOD), vacuum- 
oxygen decarburization (VOD) and vacuum induction 
melting (VIM), which allow the production of steels with 
very low carbon and nitrogen contents, has largely obvia¬ 
ted these difficulties. 

Redmond and Miska distinguish five classes of stainless 
steel: (1) austenitic, (2) ferritic, (3) duplex, (4) martensitic, 
and (5) precipitation hardening. The last two classes are 
considered later in this subsection and the first three in the 
next three subsections. Heat treatment is essentially con¬ 
fined to the martensitic and precipitation hardening clas¬ 
ses of stainless steel. 

The AISI has defined standard types of stainless steel 
and these steels are commonly described in terms of the 
AISI types. Also widely used is the UNS of the American 
Society for Testing and Materials (ASTM). Relevant British 
Standards are BS1449: Part 2:1983 for stainless steel plate 
and BS 3605:1973 for austenitic stainless steel pipe. 

The stainless steels are dominated by austenitic stain¬ 
less steels in the AISI 300 series and ferritic steels in the 
400 series. The latter series is not confined, however, to 
steels of the ferritic class, but also includes some in other 
classes such as martensitic and superduplexes. 

Martensitic stainless steels generally contain 11-18% 
chromium but little or no nickel, and have a structure which 
can be transformed by suitable cooling from austenite at 
high temperature to martensite at room temperature. They 
include a low carbon subclass and a high carbon one, the 
division occurring at a carbon content of about 0.15%. 
Martensitic steels, given suitable heat treatment, can have 
very high strength and hardness. They have a ductile- 
brittle transition temperature which is usually close to 
room temperature. A general purpose low carbon marten¬ 
sitic steel is type 410. Martensitic steels are used for such 
items as bolts, shafts and bearings. 

Precipitation-hardening (PH) stainless steels contain 
both chromium and nickel, and other alloying elements 
such as copper or aluminium, which impart the precipita¬ 
tion hardening property, allowing the steel to he hardened 
to high strength for use in such applications as gears. 
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12.3.14 Austenitic stainless steel 

The basic austenitic stainless steel may be regarded as con¬ 
taining 18% chromium and 8% nickel, but there is a whole 
family of such steels with variations about these values. 
These steels are described in Chromium Nickel Austenitic 
Steels by Keating (1968) and Redmond and Miska (1982). 

The workhorse austenitic steels include AISI types 304, 
304L, 316, 316L, 321 and 347. The suffix L denotes low car¬ 
bon. As already mentioned, austenitic steels are covered in 
BS1449: Part 2:1983 and BS 3605:1973. 

Type 304 is a 19/10 (19 Cr 10 Ni) steel. It contains the 
minimum amount of alloying elements to give a stable 
austenitic structure under all fabrication conditions. Type 
304L has a lower carbon content than type 304 and is used 
for applications involving the welding of plate thicker than 
about 6.5 mm in order to avoid intergranular corrosion, or 
weld decay. 

Type 316 is a 17/12 steel with 2.5 Mo addition to improve 
resistance to reducing conditions such as brine and dilute 
sulfuric acid. Type 316L has a lower carbon content than 
type 316 and is used in applications where the heat input 
during fabrication will exceed the incubation period of 
the 316 grade, such as the welding of plate thicker than 
about 10 mm. 

Type 321 is an 18/10 steel with titanium addition to pre¬ 
vent intergranular corrosion. Type 347 is an 18/11 steel with 
niobium addition to improve welding properties. 

Standard austenitic stainless steels are subject to 
chloride-induced stress corrosion cracking, although cer¬ 
tain types exist such as 904L and, particularly 825, which 
are resistant. 

More highly alloyed austenitic stainless steels include 
the HyResist 317LM and 94L steels, with enhanced corro¬ 
sion resistance, and the HyProof 3126L and 317L steels with 
higher proof strength. 

The absence of ferrite means that austenitic stainless 
steels do not have a ductile-brittle transition temperature. 


12.3.15 Ferritic stainless steel 

Ferritic stainless steels contain chromium but little or no 
nickel. The class may be subdivided into two main sub¬ 
classes: those with 11% Cr and those with 17% Cr. Ferritic 
stainless steels can be rendered brittle by even quite low 
contents of carbon and nitrogen (say 0.1% C + N), and for a 
long time this inhibited their use, but in manufacture this 
problem has been largely obviated by the techniques of 
AOD,VOD and VIM mentioned above. 

The workhorse ferritic stainless steels include AISI 
types 409,430,434 and 444. Type 409 has 11% Cr and type 
43017% Cr. 

The welding of ferritic steels poses a problem in that 
carbon or nitrogen pick-up can have serious effects. In the 
11% Cr steels an improvement in weldability, and also an 
extension of the size of section which can be produced, has 
been achieved with the use of the SCR 12 type, which is so 
balanced that some austenite forms above about 800°C, 
which is beneficial both in welding and rolling. 

Ferritic, and also martensitic, stainless steels are 
immune to chloride-induced stress corrosion cracking but 
are susceptible to sulfide-induced stress corrosion crack¬ 
ing. Ferritic stainless steels have a ductile-brittle transi¬ 
tion temperature. There are also superferritic stainless 
steels with a high alloy content, which imparts enhanced 
resistance to pitting corrosion and crevice corrosion. 


12.3.16 Duplex stainless steel 

Duplex stainless steels contain both ferrite and austenite, 
in approximately equal amounts. Their properties reflect 
the fact that they contain both phases. The presence of 
ferrite means that duplex stainless steels have a ductile- 
brittle transition temperature. 

The duplexes differ from standard austenitic stainless 
steels in that they have higher resistance to stress corrosion 
cracking and higher yield strength. They differ from the 
ferritic stainless steels in having higher low temperature 
toughness and in being more weldable. Some types of 
duplex stainless steels are ‘lean duplex’, 22/5 and 25 Cr. 

For some time the use of duplex stainless steels was 
inhibited by fabrication difficulties. The addition of nitrogen 
substantially eased these constraints and reduced the need 
for post-weld heat treatment to restore corrosion resistance. 

Recent years have seen the introduction of a new breed 
of duplex, the superduplex stainless steels. Standard 
duplexes have limited resistance to pitting and crevice 
corrosion. The superduplexes include Ferralium 255, Zeron 
100 and Uranus 52N +. They are not yet widely used but 
are starting to find application offshore.They are described 
by Warde (1991). 

12.3.17 Low temperature steel 

For low temperature applications use is made of alloy steels or 
aluminium alloys. Two principal applications are in storage 
tanks and in liquefied gas carriers. Some of the materials 
used are illustrated by the following list taken from the IMO 
International Gas Carrier Code (1983 IMO 782): 


Minimum Chemical composition 

design and heat treatment 

temperature 
(°C) 

Impact test 
temperature 

(°C) 

-60 

1.5% nickel steel, normalized 

-65 

-65 

2.25% nickel steel, normalized 
or normalized and tempered 

-70 

-90 

3.5% nickel steel, normalized 
or normalized and tempered 

-95 

-105 

5% nickel steel, normalized 
or normalized and tempered 

-110 

-165 

9% nickel steel, double 
normalized and tempered or 
quenched and tempered 

-196 

-165 

Austenitic steels such as types 
304, 304L, 316,316L, 321 
and 347 solution treated 

-196 

-165 

Aluminium alloys such as 

Not 


type 5083 annealed 

required 

-165 

Austenitic Fe-Ni alloys 

Not 


(36% nickel), heat 
treatment as agreed 

required 


The qualifications on the use of these materials are given in 
the code. 


12.3.18 Heat treatment of steel 

There are a number of processes to which steel may 
be subjected in order to obtain a better microstructure 
and enhanced mechanical and corrosion properties. 
An account oriented to pressure vessels is given by Kohan 
(1987). 
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Critical temperature and transformation range 
A basic concept in heat treatment of steel is that of the 
critical temperature at which a transformation occurs 
in the steel. Actually changes occur over a range of 
temperature (the transformation range). There are separate 
transformation ranges for heating and for cooling. 

Quenching 

Quenching is rapid cooling of the steel by immersion in a 
medium such as oil or water. 

Hardening 

Hardening is the heating and quenching of the steel to 
produce an increase in hardness. 

Normalizing 

Normalizing involves heating the steel to about 100°F 
(38°C) above its critical temperature and cooling in still air 
to room temperature. 

Annealing 

Annealing involves heating and controlled cooling of the 
steel in order to refine its structure, modify its properties 
and/or remove stresses. There is a variety of annealing 
processes. Full annealing involves heating above the 
critical temperature and then slow cooling. 

Tempering 

Tempering is an operation performed after hardening of 
the steel, and involves heating to a temperature below the 
critical value and then cooling. 

Stress relief heat treatment 

Stress relief heat treatment involves uniform heating of all 
or part of a component to a temperature sufficient to relieve 
the major part of the residual stresses and then uniform 
cooling. 

Post-weld heat treatment 

Post-weld heat treatment (PWHT) refers to any heat treat¬ 
ment carried out following welding. 

12.3.19 Steel coding systems 

There are a number of systems for the coding of types of steel. 
These include British, European and American systems. 

BS 5500: 1991 for pressure vessels refers to BS 

1501-1504 and BS 3059 and BS 3601-3605. These stand¬ 
ards designate steels by type and grade, for example, 224 
grade 490. Another relevant standard is BS 4360: 1990 
Weldable Structural Steels. This refers to grades, for exam¬ 
ple, 50EE. The 1990 edition gives cross-referencing to 
nomenclature used in earlier editions of this standard. The 
standards also use the following classification of steels: 

Grade 

M0 Carbon steels 

Ml Carbon and carbon manganese steels 

M2-M10 Low alloy steels 

High alloy steels 

Details are given in Appendix H of BS 5500. 

Currently, in the United Kingdom, transition is taking 
place to the European system. This is described in BS EN 
10027 Designation Systems for Steel, this and BS 10028 Flat 
Products Made of Steels for Pressure Purposes give cross- 
referencing. 


For the United States, the ASTM has established a uni¬ 
fied numbering system (UNS) and issues standards for 
steel, for example, ASTM A-515/A515M-90. ASME utilizes 
these standards adding the prefix S, for example, SA-515. 
Principal steels for process plant are given in the ASME 
Boiler and Pressure Vessel Code, Section II: 1990 Materials 
Specifications. Reference has already been made to the 
AISI system, particularly in relation to stainless steels. A 
further discussion of steel coding is given by Pilborough 
(1989). 


12.4 Pressure Vessel Design 

Pressure vessels are subject to a variety of loads and other 
conditions which stress them and, in certain cases, may 
cause serious failure. 

Accounts of pressure vessel design are given in Pressure 
Vessels (Chuse, 1954-), Pressure Vessel Design and Analysis 
(Bickell and Ruiz, 1967), The Stress Analysis of Pressure 
Vessels and Pressure Vessel Components (Gill, 1970), Theory 
and Design of Modern Pressure Vessels (Harvey, 1974), Pres¬ 
sure Component Construction (Harvey, 1980), Chemical and 
Process Equipment Design'. Vessel Design and Selection 
(Azbel and Cheremisinoff, 1981), Pressure Vessels (Chuse 
and Eber, 1984), Pressure Vessel Design Handbook (Bednar, 

1986) , Mechanical Design of Process Systems (Escoe, 1986), 
Fundamentals of Pressure Vessel and Heat Exchanger Tech¬ 
nology (J.P. Gupta, 1986), Pressure Vessel Systems (Kohan, 

1987) , Pressure Vessel Design Manual (D.R. Moss, 1987), 
Pressure Vessels (Chuse and Carson, 1993) and Pressure 
Vessel Design (Spence and Tooth, 1994). 

In general, structures are subject to two types of loading: 

(1) static loading and (2) dynamic loading. For pressure 
vessels this loading is normally due to pressure. The load 
caused by the pressure creates stresses in the vessel. There 
may also be other stresses, which include (1) residual stress, 

(2) local stress and (3) thermal stress. 


12.4.1 Design basis 

The basis of the design of pressure vessels is the use of 
appropriate formulae for vessel dimensions in conjunction 
with suitable values of design strength. In determining the 
strength of materials, a basic distinction is drawn between 
(1) temperatures below the creep range and (2) tempera¬ 
tures inside the creep range. 

For temperatures below the creep range two important 
properties are (1) tensile strength, R; and (2) yield strength, 
E. Different design methods may use these properties as 
measured at room temperature (generally 20°C) or at the 
operating temperature (f° C). Use has been made, therefore, 
of all the four properties: 


(1) tensile strength at room temperature, R 2 o, 

(2) tensile strength at operating temperature, R t , 

(3) yield strength at room temperature, E 2 o, 

(4) yield strength at operating temperature, E t . 

For temperatures inside the creep range, two further 
important properties are (1) stress for 1% extension in 
100,000 h at the operating temperature, S c and (2) stress for 
rupture in 100,000 h at the operating temperature, S r .These 
material strengths are divided by a factor of safety to 
obtain the design strengths for use in the design. 
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12.4.2 Static pressure loading 

Pressure vessels may often be treated as thin-walled cylin¬ 
ders or spheres. For a thin-walled cylinder, a simple force 
balance gives the longitudinal stress: 

pm 2 = a\t2nr {12.4.1] 

°l=% (12.4.2] 

where p is the pressure, r is the radius of the vessel, t is the 
wall thickness, and a\ is the longitudinal stress. The cir¬ 
cumferential, or hoop, stress is: 


[12.4.3] 


where a 2 is the circumferential stress. 

Similarly, for a sphere the longitudinal and circumfer- 


ffi 


[12.4.4] 


Other methods are required for thick-walled vessels. 


12.4.3 Dilation 

If the pressure vessel is subject to stress, it exhibits dila¬ 
tion, or radial growth. For an element which is subject to 
tensile stress in two perpendicular directions, the strain in 
one direction depends not only on the stress in this direc¬ 
tion but also on that in the perpendicular direction and is a 
function of Poisson’s ratio pi: 


e\ 


[12.4.5] 


tm 

E 


[12.4.6] 


where e 1 is the longitudinal strain, e 2 the circumferential 
strain and E is the elastic modulus. 

The dilation, or radial growth, of a cylindrical pressure 
vessel may be determined by integrating the hoop strain in 
the wall from an axis through the centre of rotation and 
parallel to a radius. If the coordinates of a point in the wall 
are r, 0, the dilation 6 is: 


rn/2 

5 = / «2 r cos 0 d0 

5 = e 2 r 

Then from Equation 12.4.6 


[12.4.7a] 

[12.4.7b] 


12.4.4 Dynamic pressure loading 

The behaviour of a material such as mild steel under 
dynamic loading differs considerably from its behaviour 
under static loading. The shape of the stress-strain dia¬ 
gram alters with the rate of loading. At very high strain rates 
(say de/d/=300 s _1 ) the yield point more than doubles. 
There are also large increases in the ultimate tensile 
strength and elongation. In consequence of this character¬ 
istic, the loads which can be applied to the material without 
permanent deformation or rupture are considerably greater 
with dynamic loading than with static loading. 

12.4.5 Residual stress 

The basic design equations for pressure vessels assume that 
the stresses are caused only by external loads. They do not 
take into account residual stresses resulting from fabrication 
and construction processes such as heat treatment, weld 
shrinkage or casting cooling. These stresses are of great 
importance in brittle materials. They are usually rather less 
significant in ductile materials, which tend to yield and 
relieve the stress, but they can contribute to fatigue failure. 

Moreover, in thick sections residual stresses can combine 
with load stresses to create a three-dimensional stress pat¬ 
tern which restricts the redistribution of the localized 
stresses by yielding. This is the reason why stress relieving 
is particularly important for thick vessels. 

12.4.6 Local stress 

Another assumption of the basic design equations is that 
there is continuity of stress. The localized stresses in a 
region where there is a discontinuity are therefore greater 
than those predicted. These localized stresses are more 
important in brittle than in ductile materials, but again 
they are significant for fatigue failure. 

12.4.7 Thermal stress 

Most materials undergo expansion if their temperature is 
raised and contraction if it is lowered. If an unrestrained 
body is subjected to non-uniform heating, the different parts 
experience different degrees of strain and these differential 
strains give rise to corresponding stresses. Such stresses do 
not develop if the body is heated up uniformly. If the body is 
restrained, however, stress is developed even though the 
heating is uniform. There are, therefore two basic causes of 
thermal stress, non-uniform temperature and restraint. 

With a ductile material, thermal stresses do not on first 
apphcationcausefailurebyrupture,becausethematerial tends 
to yield and relieve the stress, but their repeated application can 
cause fatigue failure. In addition, the deflection or distortion 
due to normal stresses can render equipment unserviceable. 

For a body which is restrained in one dimension only, the 
thermal stress a is 

<t = -EaAT [12.4.1JJ 


and from Equations 12.4.2 and 12.4.3 


where A T is the temperature difference and a is the coeffi¬ 
cient of thermal expansion. The product Ea is the thermal 
stress modulus. The minus sign indicates that the body is in 
compression. For a body restrained in two dimensions 


<5 


P_t 

2 tE 


( 2-/0 


[12.4.9] 


EaAT 


(1 — 


[12.4.12] 


Similarly, for a spherical vessel the dilation is 


and for one restrained in three dimensions 


[12.4.10] 


EaAT 


(1 - 2/i) 


[12.4.13] 
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Pressure vessel conditions mainly correspond to two- 
dimensional constraint. 

Non-uniform temperature distribution may be either 
steady or unsteady state. The thermal stresses caused by 
thermal gradients in a long thin-walled cylinder or pipe 
may be shown to be as follows. For a steady state, linear 
temperature gradient through the pipe wall the stress on 
the inside of the pipe is: 


Ecu AT 


n* ^fjjig 


[12.4.14] 


For a transient in which a hot fluid is suddenly contacted 
with the pipe wall, which previously was at a uniform 
temperature, the initial stress is: 


EaAT 




[12.4.15] 


12.4.8 Design construction features 

There are numerous design features which tend to create 
local stresses. These include: 

(1) discontinuities: 

(a) vessel ends, 

(b) changes of cross-section, 

(c) changes of thickness; 

(2) joints: 

(a) bolted joints, 

(b) welded joints; 

(3) bimetallic joints; 

(4) holes and openings; 

(5) flanges; 

(6) nozzles and connections; 

(7) bolt seating and tightening; 

(8) supports and lugs. 


The use of GRP for storage tanks is discussed in 
Chapter 22. 

12.5 Joining, Fastening and Welding 

There are two main methods by which materials may be 
joined: (1) mechanical fastening and (2) physical bonding. 
For pressure systems the main fastening methods are riv¬ 
eting and bolts and nuts, while the methods of bonding are 
soldering and brazing and fusion welding. Although rivet¬ 
ing was used as a method of joining in older pressure ves¬ 
sels, some of which are still in use, the modern method of 
joining is by fusion welding. Fastening by bolts and nuts, 
however, is a widely used method of joining, particularly on 
flanged joints. Flanged joints are used mainly in pipework 
and are considered in Section 12.7. 

Soldering and brazing are methods of bonding in which 
the joint is made by introducing molten metal between the 
two parts to be joined without deliberate fusion of the par¬ 
ent metal. With fusion welding, by contrast, the parts of the 
parent metal adjacent to the joint are brought to molten 
temperature and caused to fuse together, generally with the 
addition of molten filler material. Fusion welding is the 
principal method of making permanent joints in pressure 
vessels and pipework. 

An account of methods of joining, fastening and welding 
is given by Pilborough (1971,1989). 

12.5.1 Fusion welding 

In fusion welding, the parts to be welded are heated so that 
theyaremoltenalongthelineofthejoint,andthengenerallya 
filler rod, also raised to molten temperature, is brought over 
the joint. This forms a pool of molten metal which is made to 
run along the joint and fuse the two parts together so that 
when they cool and solidify a homogeneous joint is made. 

Some of themain methods of fusion welding described are: 


The minimization of the local stresses caused by these 
stress raisers is a major aspect of pressure vessel design. 
Some of the principal methods of minimizing local stresses 
are as follows. Discontinuities are made as gradual as pos¬ 
sible and sudden discontinuities are avoided. Weld defects 
such as overfill are kept to a minimum. Holes are spaced 
relative to each other so as not to cause serious weakening. 
The same applies to the spacing of nozzles and other con¬ 
nections. Flanges and nozzles are reinforced so as to mini¬ 
mize stress. The reinforcement relies on good design rather 
than on massive addition of metal. Self-adjusting nut seats 
are provided for bolts which have to be tightened on sloping 
surfaces. Thermal stresses at supports are reduced by 
measures to allow heat to flow between the vessel and the 
support, and so avoid large temperature gradients. 

12.4.9 Vessels in composite materials 

Pressure vessels may also be constructed in composite 
materials, notably glass-reinforced plastic (GRP), or fibre- 
reinforced plastic (FRP).The main use of GRP in the process 
industries is for atmospheric, or near-atmospheric, storage 
tanks, butvesselscanbebuilttowithstandhigher pressures. 

Accounts of the use of composite materials are given in 
Glass Reinforced Plastic (Parkyn, 1970), Fibre Reinforced 
Materials Technology (Parratt, 1972), Fibre Reinforcement 
(Catherall, 1977), FRP Technology (Weatherhead, 1980), 
Materials and the Designer (Cornish, 1987), Composite 
Materials Handbook (M. Schwartz, 1991) and by Puckett 
(1976), I.R. Miller (1979) and Britt (1993). 


(1) oxyacetylene welding; 

(2) metallic arc welding; 

(3) inert gas shielded welding: 

(a) argon arc welding, 

(b) C0 2 gas shielded welding, 

(c) pulsed arc welding; 

(4) electrical resistance welding: 

(a) spot welding, 

(b) seam welding, 

(c) projection welding, 

(d) butt welding, 

(e) flash welding. 

Oxyacetylene welding is cheap and is widely used. It is 
suitable where high quality welds are not required and 
where corrosion is not a serious problem. In oxyacetylene 
welding heat is generated by combustion of acetylene in 
oxygen using a blowtorch and the weld is made using a fil¬ 
ler rod. The flame should be kept as nearly neutral as pos¬ 
sible. Excess acetylene tends to cause carburization of the 
weld, leading to lower corrosion resistance and possibly 
embrittlement, while excess oxygen generally gives an 
oxidized and porous weld. 

Metallic arc welding is perhaps the most commonly used 
method. It is suitable for welding a wide range of plate 
thicknesses, from thin plate up to plate many centimetres 
thick, and a wide range of materials including stainless 
steel. In metallic arc welding, an electrode of the same 
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metal as the work is used and an arc is struck between the 
two. The heat of the arc melts both the tip of the electrode 
and the parent metal beneath it, and metal drops across 
the arc from this electrode to the parent metal. Both a.c. 
and d.c. are used, the former being cheaper, but the latter 
being more suitable for some high quality work and for 
stainless steel. 

Inert gas shielded welding is widely used to obtain a high 
quality weld. In the United Kingdom, the inert gas used is 
generally argon and the method is also known as ‘argon arc 
welding’. Helium is normally used in the United States.The 
two main methods used are tungsten inert gas (TIG) and 
metal inert gas (MIG) welding. In the TIG technique, an 
arc is struck between the tungsten electrode and the work 
in an inert atmosphere. Filler is added as necessary in the 
form of abare wire. In the MIG process, the arc is struck and 
a bare wire filler and inert gas are fed in through a feeder 
gun or head. 

An alternative gas used in inert gas shielded welding is 
C0 2 , which is much cheaper than argon. C0 2 gas shielded 
welding tends to be used for high quality work on ferrous 
metals and argon shielded welding for high quality work on 
stainless steel and on other materials. 

The quality of the weld in MIG welding is affected by the 
mode of transfer of the molten metal to the work. The most 
desirable mode is spray transfer, in which the metal passes 
from the wire to the weld pool as small drops, but there 
occur also dip transfer, in which metal is deposited when 
the wire is dipped in the pool and which causes irregularity, 
and globular transfer, in which large drops are released. 
Spray transfer is favoured by high current, but the latter 
tends to burn through on thin material and a compromise is 
necessary 

Pulsed arc welding overcomes this problem and gives 
spray transfer without burn-through by using a high 
pulsed current to effect transfer, while maintaining a rela¬ 
tively low mean welding current. 

There are a number of electrical resistance welding pro¬ 
cesses in which an electric current is passed through the 
work to be joined; the material is heated and rendered mol¬ 
ten by the electrical resistance at the joint and is thus 
welded together. 

In spot welding, the points to be joined are clamped 
together between two shaped electrodes. A heavy surge of 
current is passed between these electrodes and welds the 
work together by a small spot. 

In seam welding, a series of spot welds is produced by a 
pulsed current from a rotating disc electrode. This method 
does not give a completely continuous weld. There is some 
tendency, therefore, for seam welds to leak and to entrap 
materials and corrode. 

In projection welding, projections are raised on the 
parts to be joined, the parts are pressed together between 
the electrodes and the projections are fused by the weld 
current. 

In butt welding, special projections are not used. The 
parts are pressed together between the electrodes and 
the adjoining surfaces are fused by the welding current. 
The adjoining faces in butt welding should be flat and 
parallel. In flash, or flash-hutt, welding the parts are again 
pressed together between electrodes, a current is passed 
which causes the slight roughnesses of finish to melt and 
flash-off, the parts are pressed closer and more flashing 
occurs and, at the right moment, further pressure is 
applied, the parts fuse together and the current is switched 


off. Butt welding is used to join smaller components and 
flash welding large ones. 

The terminology used in arc welding in the United States 
is described in the account by J.E. Jones and Olson (1986). 
They classify arc welding processes by type of shielding 
and by whether or not the electrode is consumed; they dis¬ 
tinguish the following principal types: 


Method 

Shielding 

Electrode 

type 

Usual 

thickness 

(in.) 

1. Shielded- 

Flux plus 

Solid wire, 

0.25-4 

metal arc 

coating; some 

coated with 


welding 

generated gas 

flux 


(SMAW) 




2. Submerged 

Granulated 

Solid wire, 

0.1-2 

arc welding 

flux 

maybe 


(SAW) 


copper flashed 


3. Gas-metal 

Inert gas or 

Solid wire, 

0.05-2 

arc welding 

gas mixture 

maybe 


(GMAW) 


copper flashed 


4. Fluxed-core 

Flux and/or 

Hollow 

0.05-1.5 

arc welding 

gas; may be 

electrode with 


(FCAW) 

self-shielding 

core of 




metal powder 


5. Gas-tungsten Inert gas or 

Solid tungsten 

0.05-0.4 

arc welding 

gas mixture 

wire, water or 


(GTAW) 


air cooled 


6. Plasma arc 

Inert gas or 

Solid tungsten 

0.04-0.24 

welding 

gas mixture 

wire, water 


(PAW) 


cooled 



In the first four of these methods the electrode is con¬ 
sumed, whilst in the last two it is not. The authors give 
details of the materials for which the different methods are 
suitable and of typical applications. 

The American Welding Society (AWS) issues standards 
for most of these methods, with individual standards 
covering the arc welding of different materials such as 
carbon steel, stainless steel, etc. Thus, for example, 
AWS B2.1.001—90, B2.1.002—90 and B2.1.008-90, and 
B2.1004-90 cover welding of carbon steel by the SMAW, 
GTAW and GMAW methods, whilst B2.1.0013-91 and 
B2.1.005-90 cover welding of austenitic stainless steel by 
the SMAW and GMAW methods, respectively. 

The qualifications of welders, the inspection of welds 
and defects in welds are considered in Chapter 19. 

12.6 Pressure Vessel Standards and Codes 

The design, fabrication and construction of pressure ves¬ 
sels is a subject which is particularly well covered by stan¬ 
dards and codes of practice. Pressure vessel codes fall into 
two main types. The first type is the conventional codes, the 
second the so-called ‘advanced codes’. The differences 
between the two types of code are considered below. 

In the United Kingdom, the main pressure vessel codes 
until 1976 were BS 1500:1958 Fusion Welded Pressure Ves¬ 
sels for General Purposes and BS 1515:1965 Fusion Welded 
Pressure Vessels for Use in the Chemical, Petroleum and Allied 
Industries. BS 1500 was a conventional code and BS 1515 
was an advanced code. In 1976, both these codes were 
superseded by a new pressure vessel code BS 5500. 
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The current version of this code is BS 5500:1991 Specifi¬ 
cation for Unfired Fusion Welded Pressure Vessels. 

The corresponding US code is the ASME Boiler and Pres¬ 
sure Vessel Code: 1992; this is described in Subsection 12.6.5. 

Another code is ISO R831:1968 Recommendations for Sta¬ 
tionary Boilers, which is applicable to pressure vessels also. 

There is an EC Directive 77/767/EEC on pressure vessels. 

12.6.1 Conventional and advanced codes 

The maximum design stresses allowed in a code either are 
tabulated in the code or are calculated from materials 
properties using factors of safety given in the code. The 
difference between the conventional and the advanced 
codes lies mainly in the design stress considered. These 
differences may be illustrated by considering on the one 
hand BS 1500:1958 and ASME SectionVIII, Division 1, and 
on the other BS 1515:1965 and ASME Division 2. 

At temperatures below the creep range the conventional 
codes BS 1500:1958 and ASME Division 1 use as the design 
stress the tensile strength divided by a factor of safety, 
which is 4 in both codes, whilst the advanced codes BS 
1515: 1965 and ASME Division 2 use the yield stress at 
design temperature divided by a factor of safety, which in 
BS 1515:1965 is 1.5. This different design criterion favours 
the use of steel with high yield strength such as low alloy 
steels. The use of low alloy steels makes possible the design 
of thinner walled pressure vessels. 

At temperatures within the creep range the design stress 
used is the creep strength, again in conjunction with a sui¬ 
table factor of safety. The difference between the two types 
of code may be seen in the comparisons of design strengths 
given in the earlier BS codes by L. Evans (1974) and in the 
ASME code by Pilborough (1989). For a particular material 
at a particular temperature, the maximum permissible 
design strength is the lowest strength obtained by dividing 
the specified properties by the specified factor of safety. For 
BS 1500 and BS 1515 Evans gives the design strengths in 
terms of the material tensile strengths R 2 o, and R t , the yield 
strengths E 20 and E t and the creep strengths S r and S c (as 
defined in Section 12.4), and an appropriate factor of safety. 


BS 1500:1958 ^ ^ 

BS 1515:1965 ^ 


The comparison given by Pilborough (1989) for the two 
divisions of the ASME code and also for ISO R831 may be 
summarized as follows. For each code the design strength is 
the lowest of: 


ASME Section 
VIII Division 1 


R20 Rf E 2 q 
~T T L6 


Et_ Sr_ Sc 

1.6 1.25 1 


ASME Section 
VIII Division 2 


ISO R831 


Rt E, S c 

3 L5 L5 

R,_ Ef_ Sr_ Sc 

2.7 1.5 1.5 1 


The design strengths laid down in BS 5500:1991 and the 
ASME code are given below. 


12.6.2 Pressure vessel classification 

BS 5500:1991 gives a classification of pressure vessels. An 
earlier classification was given in BS 1500:1958. The latter 


classified pressure vessels as Class I, II or III. For a Class I 
vessel the requirements include full radiography of the 
main seam welds, while Classes II and III have less strin¬ 
gent requirements. A Class I vessel also requires PWHT for 
stress relief. 

BS 5500:1991 places pressure vessels in three construc¬ 
tion categories. For a Category 1 vessel full non-destructive 
testing of the main seam welds is required, while for Cate¬ 
gories 2 and 3 the requirements are limited to spot non¬ 
destructive testing and visual examination, respectively. 
The PWHT requirements are related to steel type and 
thickness rather than to vessel category. 

12.6.3 BS 5500 

The coverage of BS 5500: 1991 Specification for Unfired 
Fusion Welded Pressure Vessels is indicated by the list of 
contents given in Table 12.3. The standard applies to the 
design, construction, inspection, testing and certification 
of pressure vessels. It does not cover certain defined types 

Table 12.3 Principal contents of BS 5500: 1991 

1. General 

1.1 Scope 

1.2 Interpretation 

1.3 Definitions 

1.4 Responsibilities 

1.5 Information and requirements to be agreed and 
documented 

2. Materials 

2.1 Selection of materials 

2.2 Materials for low temperature applications 

2.3 Carbon, carbon manganese and alloy steels 

3. Design 

3.1 General 

3.2 Application 

3.3 Corrosion, erosion and protection 

3.4 Construction categories and design stresses 

3.5 Vessels under internal pressure 

3.6 Vessels under external pressure 

3.7 Supports, attachment and internal structures 

3.8 Bolted flanged connections 

3.9 Flat heat exchanger tubesheets 

3.10 Design of welds 

3.11 Jacket construction 

3.12 Manholes and inspection openings 

3.13 Protective devices 

for excessive pressure or vacuum 

4. Manufacture and workmanship 

4.1 General aspects of construction 

4.2 Cutting, forming and tolerances 

4.3 Welded joints 

4.4 Heat treatment 

4.5 Surface finish 

5. Inspection and testing 

5.1 General 

5.2 Approval testing of fusion welding procedures 

5.3 Welder and operator approval 

5.4 Production control test plates 

5.5 Destructive testing 

5.6 Non-destructive testing 

5.7 Acceptance criteria for weld defects revealed by 
visual examination and non-destructive testing 

5.8 Pressure tests 




2/20 PRESSURE SYSTEM DESIGN 


Also various appendices including: 

B Recommendations for cylindrical, spherical and 
conical shells under combined loadings, including 
wind and earthquakes. 

C Recommendations for the assessment of vessels 
subject to fatigue. 

D Requirements for ferritic steels in bands MO -ME 
inclusive for vessels required to operate below 0°C 

E Recommendations for welded connections of pressure 
Vessels. 

G Recommendations for methods of calculation of 
stresses from local lads, thermal gradients, etc. 

H Recommendations for post-weld heat treatment of 
dissimilar ferritic steel joints. 

J Recommendations for pressure relief protective 
Devices. 

K Requirements for the derivation of material nominal 
design strengths for construction Category 1 and 2 
vessels. 

U Guidance on use of fracture mechanics analysis. 


of vessel, which may be summarized as atmospheric stor¬ 
age tanks, vessels for very high pressure (e.g. strip wound 
compound vessels), vessels in which the stresses are less 
than 10% of the permitted design stress, vessels for spe¬ 
cific applications covered by other British Standards and 
pressure vessels used in transport. 

Specific recognition is given in the standard to the 
Inspecting Authority, which acts on behalf of the pur¬ 
chaser, and the Regulating Authority, which enforces the 
laws and regulations in the country concerned. 

With respect to materials of construction the standard 
allows the use either of materials specified in British 
Standards or of other materials, provided these meet spe¬ 
cifications agreed between the manufacturer and the user 
for certain specified properties as tested by specified 
methods listed in the standard. The latter should cover as a 
minimum the manufacturing process, compositional limits 
for all constituents, deoxidation practice, heat treatment 
and appropriate mechanical properties. 

BS 5500: 1991 lists in its table 2.3 and appendix K the 
other standards which it uses for the design strength of 
steels. These include BS 1501-1504, BS 3059 and BS 
3601-3605. It gives in tables 2.3(a)—(j) extensive tabula¬ 
tions of design strengths from these standards. 

The basis for the determination of design strengths in the 
standards just listed is described in appendix K of BS 5500. 
A distinction is made between (1) the time-independent 
design strength and (2) the time-dependent design 
strength, in the creep region. For the former, distinctions 
are made between materials with and without specified 
elevated temperature properties and between carbon, 
carbon manganese and low alloy steels and austenitic 
stainless steels. Thus, for the time-independent strength, 
relations are given for the following four cases: 

(1) carbon, carbon manganese and low alloy steels 

(a) materials with specified elevated temperature 
properties, 

(b) materials without specified elevated temp¬ 
erature properties; 

(2) austenitic stainless steels 

(a) materials with specified elevated temperature 
properties, 


(b) materials without specified elevated temp¬ 
erature properties. 

The nominal design strength/is taken as the lesser of the 
nominal design strength/ e corresponding to the short-time 
tensile strength characteristics and the nominal design 
strength/ F corresponding to the creep characteristics. The 
material strengths used are as follows. R m is the minimum 
tensile strength at room temperature. R e is the minimum 
yield strength at room temperature. Where a standard spe¬ 
cifies minimum strength values of f? eL or R p 0 2 , these values 
are taken as corresponding to R e . R em corresponds to R eL , 
or Ep.o.2 a temperature T. S R; is the mean stress required to 
produce rupture at time t at temperature T. The relations 
given in appendix K of the standard for the determination 
of the nominal design strength / are shown in Table 12.4. 
The design strength for a typical steel, BS 1501 26B, in 
plate form up to a thickness of 32 mm, which has a mini¬ 
mum tensile strength of 402 N/mm 2 , is given in Table 12.5. 

The equations given in the standard for minimum shell 
thickness for pressure loading only are as follows: 


Cylinder: 


pDi 

W-P 

[12.6.1a] 

, A 

2f+p 

[12.6.1b] 

Sphere: 


A 

4/-1.2 p 

[12.6.2] 

•S pD ° 

4/ + 0.8/) 

[12.6.3] 


where A is the internal diameter of the shell, D a is the 
external diameter of the shell, e is the minimum thickness 
of the shell, / is the nominal design stress, and p is the 
design pressure. The dimensions do not include corrosion 
allowances. 

The standard gives guidance on the design pressures 
and temperatures to be used. For the maximum design 
pressure it states that the design pressure, or the pressure 
to be used in the equations for the purposes of calculation, 
should not be less than: 

(a) the pressure which will exist in the vessel when the 
pressure relieving device starts to relieve, or the set 
pressure of the pressure relieving device, whichever is 
the higher (see Appendix J of standard); 

(b) the maximum pressure which canbe attained in service 
where this pressure is not limited by a relieving device. 

The static head should be taken into account. 

For the minimum design pressure, the standard recom¬ 
mends that vessels subject to vacuum should be designed to 
a full negative pressure of 1 bar. 

The maximum design temperature should not be less the 
actual metal temperature expected in service, allowing 
adequate margin for uncertainties in predicting this tem¬ 
perature. An appropriate design lifetime should be agreed 
between purchaser and manufacturer. No vessel designed 
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Table 12.4 Design strengths given in BS 5500: 1991 

Material 

Regime 

Temperature range (°C) 

Design strength lowest of 

Carbon, carbon manganese 
and low alloy steels 

Time-independent 2 

<50 

*- 5 « 

R m 

235 



>150 b 

*=¥ 

R m 
° f 2.35 

Austenitic stainless steel 

Time-independent 

<50 


R m 

235 



>150 b 

( *e(r) d 

Rm 
° r 2.35 

Both types of steel 

Time-dependent 


t JSfc 

^ 1.3 



a Values given for time-independent nominal design strengths are for material with specified elevated temperature values. 
b For temperatures between 50 and 150°C values are interpolated. 
c For materials without specified elevated temperature values, value is R^nl 1.6. 
d For materials without specified elevated temperature values, values is l?e(T)/l-45. 

' See detailed notes in Appendix K of the standard. 


Table 12.5 Design strengths (f, N/mm 2 ) for steel 224, 490 Ml (A and B) for plates up to 40 mm thick, as given in BS 
5500: 1991 (Courtesy of the British Standards Institution) 


fl„(N/mm 2 ) R e (N/mm 2 ) 

Thickness (mm) Design temperatures (°C) not exceeding 

50 100 150 200 ... 480 

Design lifetime (h) 

490 325 

3-16 

208 

192 

177 

160 

42 

100,000 

315 

40 

208 

190 

173 

158 

38 

150,000 

305 

63 

204 

187 

171 

156 

34 

200,000 

281 

100 

187 

176 

164 

153 

34 

250,000 

250 

150 

167 

162 

157 

150 




on this basis should remain in service beyond the agreed 
lifetime without a review as specified in the standard. 

The minimum design temperature, which is used to 
assess the suitability of the material to resist brittle frac¬ 
ture, should be the lowest metal temperature expected in 
service. In the case of components with external thermal 
insulation, this temperature is that of the contents of the 
vessel under the appropriate loading conditions, whilst in 
the uninsulated case the minimum temperature is a matter 
for agreement. 

Some of the topics on which the standard gives guidance 
are (1) local stresses, (2) low temperature properties, 
(3) corrosion and (4) fatigue. The calculation of local stres¬ 
ses is covered rather comprehensively in the standard, 
which gives a large number of charts for particular cases. 

The standard deals in appendix D with the suitability 
of steels in bands M0-M4 for low temperature service, 
below 0°C. A design reference temperature #R is defined 
such that 

0r < 0d + 0 S + 6 C + 0h [12.6.4] 

where 0 D is the minimum design temperature (°C), and 0 R 
is the design reference temperature (°C), and 0s, 0c and 0 h 
are temperature adjustments. 0 C is an adjustment which 


depends on the construction category and has the values 
0, -10 and -20°C for Category 1, 2 and 3 vessels, respec¬ 
tively. 0 H is an adjustment in applications where all plates 
incorporating subassemblies undergo PWHT before they 
are butt welded together, but the main seams do not sub¬ 
sequently undergo PWHT. In these applications 0 H is 
+15°C. 0 S is an adjustment depending on the calculated 
membrane stress which has the value 0°C when this stress 
is equal to or exceeds 2//3, +10° C when the stress is equal 
to or exceeds 50 N/mm 2 but does not exceed 27/3; and 
+50°C when the stress does not exceed 50 N/mm. In the 
latter case, the membrane stress should take into account 
internal and external pressure, static head and self¬ 
weight. 

Where the calculated membrane stress can vary 
with the minimum design temperature, for example in 
autorefrigeration during depressurization, the standard 
requires that the coincident values of 0 D and 0 S be eval¬ 
uated, where appropriate, allowing for the possibility of 
repressurization whilst still cold, and gives detailed 
guidance. 

The standard gives graphs showing the per¬ 
missible design reference temperature/reference thick¬ 
ness/material impact test temperature relationships for 
(1) as-welded and (2) PWMTcomponents. 
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Guidance on corrosion given in the standard is fairly 
general. It is recommended that the possible forms of cor¬ 
rosion such as chemical attack, rusting, erosion and high 
temperature oxidation be reviewed, that particular atten¬ 
tion be paid to impurities and to fluid velocities, and that 
where doubt exists corrosion tests be done. If corrosion is 
expected to be negligible, no corrosion allowance is 
required, but where this is not the case, the recommended 
minimum allowance is 1 mm. 

The standard deals in Appendix C with fatigue, for 
which it lists the following causes: (1) periodic temperature 
transients, (2) restrictions of expansion or contraction 
during normal temperature variations, (3) applications or 
fluctuations of pressure, (4) forced vibrations and (5) var¬ 
iations in external loads. Attention is drawn to the influ¬ 
ence on fatigue of corrosion and of creep. 

The standard requires that the design stress be kept 
reasonably below the fatigue limit if the expected number 
of cycles during the service life of the vessel might other¬ 
wise lead to fatigue failure. A detailed fatigue analysis is 
not required, however, where the design is based on pre¬ 
vious and satisfactory experience of strictly comparable 
service or where certain alternative conditions are satis¬ 
fied. A generalized chart for a design fatigue curve is given 
in the standard. It also gives a recommended method of 
constructing a design fatigue curve from test data. 

The standard gives requirements for protective devices 
and for inspection. These are described here in Section 
12.12 and Chapter 19, respectively. 

12.6.4 Standards committees 

Support for BS 5500: 1991 is provided by the Pressure 
Vessels Technical Committee (PVTC) (PVE/1) of the British 
Standards Institute (BSI). There is also a Pressure Vessel 
Quality Assurance Board (PVQAB) set up under the spon¬ 
sorship of the Institution of Mechanical Engineers 
(IMechE). 

12.6.5 ASME Boiler and Pressure Vessel Code 

Another principal code is the American Society of 
Mechanical Engineers (ASME) Boiler and Pressure Vessel 
Code : 1992. The 11 sections of the code are shown in 
Table 12.6. Of particular relevance here are Sections II and 


Table 12.6 Principal contents of the ASME Boiler and 
Pressure Vessel Code 


Section No. 

I 

Power boilers 

II 

Material specification 

III 

Nuclear power plant components 

IV 

Heating boilers 

V 

Non-destructive examination 

VI 

Recommended rules for care and operation of 
boilers 

VII 

Recommended rules for care of power boilers 

VIII 

Pressure vessels: 

Division 1 

Division 2 — Alternative rules 

IX 

Welding and brazing qualifications 

X 

Fibre-glass reinforced plastic pressure vessels 

XI 

Rules for in-service inspection of nuclear 
power plant components 


VIII which deal, respectively, with materials specifications 
and with pressure vessels themselves. Section VIII has two 
parts: Pressure Vessels, Division 1 and Pressure Vessels, 
Division 2 - Alternative Rules. Division 1 is a conventional 
code and Division 2 an advanced code. 

12.6.6 Fibre-reinforced plastic vessels 

There are also a number of standards and codes for the 
design of vessels and tanks in FRP. Relevant standards and 
codes are BS 4994:1987 Specification for Design and Con¬ 
struction of Vessels and Tanks in Reinforced Plastic; the 
ASME Boiler and Pressure Vessel Code, Part X, Fiber-Glass 
Reinforced Plastic Pressure Vessels (1992); ASTM D 4021-86 
Standard Specification for Contact Moulded Glass-fiber- 
reinforced Thermosetting Resin Underground Petroleum 
Storage Tanks and ASTM D 4097- 88 Standard Specification 
for Contact Moulded Glass-fiber-reinforced Thermosetting 
Resin Chemical Resistant Tanks. HSE guidance is given in 
PM 75 Glass Reinforced Plastic Vessels and Tanks: Advice to 
Users (mi). 

12.6.7 Limitations of standards 

It is important to appreciate that standards and codes of 
practice have certain inevitable limitations. They are by 
their nature generalized and cannot readily cover all 
situations that may arise. They are prepared by committees 
and may represent the minimum standard on which agree¬ 
ment can be obtained. Their revision is a time-consuming 
task and they can become out of date. A fuller discussion of 
standards and codes is given in Appendix 27. These points 
have particular relevance to plants which have major 
hazards and/or novel technology. In these cases it should be 
appreciated that the standards represent a minimum 
requirement. Nevertheless, standards and codes of practice 
have an essential role to play in the design and operation of 
process plant. 

12.7 Pipework and Valves 

Loss of containment from a pressure system generally 
occurs not from pressure vessels hut from pipework and 
associated fittings. At least as much attention should be 
paid to the pipework and fittings as to the vessels. 

The cause of the Flixborough disaster was a modifica¬ 
tion to a 28 in. pipe connection between two reactors. The 
modification involved the installation of a temporary 20 in. 
pipe with bellows at each end. The design of the pipe system 
was defective in that it did not take into account the bend¬ 
ing moments on the pipe due to the pressure in it. The 
bellows were not installed in accordance with the manu¬ 
facturer’s instructions. The pipework assembly was not 
adequately supported. The relevant British Standards, 
notably BS 3351 and 3974, were not followed. Further 
details are given in Appendix 2. 

12.7.1 Pipework 

The plant pipework and fittings include the piping itself, 
flanges and joints, and fittings, such as the many types of 
valves, bellows, etc., together with the pipe supports. 

Accounts of pipework on process plants include those 
given in the Handbook of Industrial Pipework Engineering 
(Holmes, 1973), Process Piping Design (Weaver, 1973), 
Handbook of Pipeline Engineering Computations (Marks, 
1979), Piping Stress Handbook (Helguero, 1986), Piping and 
Pipe Support Systems (P.R. Smith and van Laan, 1987) and 
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the Engineering Design Guidelines of the Center for Chemi¬ 
cal Process Safety (CCPS, 1993/13). 

Pipework in process plant in the United Kingdom has 
been covered by BS 3351:1971 Piping Systems for Petroleum 
Refineries and Petrochemical Plants and by BS 3974: 1966 
Pipe Supports, together with numerous other British Stand¬ 
ards for pipework and fittings, some of which are listed in 
Appendix 27. 

BS 3351: 1971 is now withdrawn. The code now com¬ 
monly used is the ASME B31 Code for Pressure Piping. Also 
relevant until its withdrawal was the American Petroleum 
Institute Guide for Inspection of Refinery Equipment, 
Chapter 11, Pipes, Valves and Fittings (API, 1974). ASME 
B31.3 is described below, but first there are some prelim¬ 
inary points to be made. 

A large proportion of failures of containment in process 
plants occur on the pipework and fittings. Some sugges¬ 
tions for reducing pipework failures have been given by 
Kletz (1984k) as part of a survey of such failures, which is 
described in Section 12.30. The design of pipework should 
be done by a fully integrated design organization working 
in a structured manner. There should be a relatively small 
number of designers of high quality making full use of 
computer aids. Similar principles should apply to the 
fabrication and construction stages. 

Kletz recommends detailed design of even small bore 
pipework, though he recognizes that some organizations 
consider this impractical. He states that efforts should be 
made to reduce the number of grades of steel required so as 
to reduce the chance of installation of the incorrect grade, 
and instances restriction of steam temperatures so as to 
avoid the need for creep resistant steel. His survey high¬ 
lights the high proportion of failures which are attributable 
to the construction phase and he makes suggestions for 
improved inspection during and after construction. Kletz 
states that the incidents which he lists suggest that of all the 
measures proposed this would be the most effective. 

The pipework should be designed for ease of mainte¬ 
nance. If a joint may have to be broken, there should be 
adequate access and sufficient ‘spring’ in the pipework. If 
the insertion of a slip plate into a joint is likely to be a fre¬ 
quent operation, consideration should be given to instal¬ 
ling a slip ring or spectacle plate. 

Work on safe piping systems has been the subject of a 
study by the Institution of Chemical Engineers (IChemE), 
as described by Hancock (1990a). The principal features 
considered were (1) layout, (2) quality control, (3) construc¬ 
tion, (4) pipe supports, (5) dead ends and (6) vibration and 
the principal causes of failure (1) vibration, (2) external 
corrosion, (3) temporary supports, (4) blocked in liquids, (5) 
water hammer, (6) steam hammer, (7) cavitation and (8) 
pressure surge. 


12.7.2 ASME B31.3 

The ASME B31 Code for Pressure Piping includes, in par¬ 
ticular, Sections B31.1: 1992 Power Piping, B31.3: 1990 
Chemical Plant and Petroleum Refinery Piping, B31.4 Liquid 
Transportation Systems for Hydrocarbons, Liquid Petroleum 
Gas, Anhydrous Ammonia, and Alcohol, B31.5:1987 Refrig¬ 
eration Piping, B31.8 Gas Transmission and Distribution 
Systems, and B31.9: 1988 Building Services Piping. In this 
chapter it is B31.3, the ASME Chemical Plant and Refinery 
Piping Code, which is the most relevant. The principal 
contents of ASME B31.3 are shown in Table 12.7. 


Table 12.7 Principal contents of ASME B31.3 


Chapter 


I Scope and definition 

II Design 

Part 1 Conditions and criteria 
Part 2 Pressure design of piping components 
Part 3 Fluid service requirements for piping 
components 

Part 4 Fluid service requirements for piping 
joints 

Part 5 Flexibility and support 
Part 6 Systems 

III Materials 

IV Standards for piping components 

V Fabrication, assembly and erection 

VI Inspection, examination and testing 

VII Non-metallic piping and piping lined with 
non-metals 3 

VIII Piping for Category M fluid service 3 

IX High pressure piping 3 
Also various appendices, including: 

A Allowable stresses and quality factors for 

metallic piping and bolting materials 
B Stress tables and allowable pressure tables for 

non-metals 

C Physical properties of piping materials 

E Reference standards 

F Precautionary considerations 

G Safeguarding 

K Allowable stresses for high pressure piping 

M Owner’s guide to classifying fluid services 

X Metallic bellows expansion joints 


“Chapters VII-IX have a structure broadly similar to, but in some 
cases more detailed than, that of Chapter II. 


B31.3 defines the following categories of fluid service: 
(1) Category D, fluid service; (2) Category M, fluid 
service; (3) high pressure fluid service and (4) normal fluid 
service. Category D applies where: (1) the fluid handled is 
non-flammable, non-toxic and not damaging to human 
tissues; (2) the design pressure does not exceed 150 psig 
(10.3 barg) and (3) the design temperature is in the range 
-20 to 366°F (—29 to 186°C). The term‘damaging to human 
tissues’ describes a fluid such that ‘exposure to the fluid, 
caused by leakage under expected operating conditions, 
can harm skin, eyes, or exposed mucous membranes so that 
irreversible damage may result unless prompt restorative 
measures are taken’. 

Category M, which is particularly relevant here, is ‘a 
fluid service in which the potential for personnel exposure 
is judged to be significant and in which a single exposure to 
a very small quantity of a toxic fluid, caused by leakage, 
can produce irreversible harm to persons on breathing or 
bodily contact, even when prompt restorative measures are 
taken’. 

High pressure fluid service is one for which the owner 
specifies the use of chapter DC of the code. Normal fluid 
service is fluid service not covered by the other three cate¬ 
gories and not subject to severe cyclic conditions, and is the 
most commonly occurring service. 

Appendix M of the code gives a guide to classification of 
fluid services (Figure M-l). The code utilizes a system of 
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listed materials and components, which are those con¬ 
forming to a specification given in appendices A, B or K or to 
certain listed standards (tables 326.1, A326.1 and K326.1). 

It also utilizes certain prefixes. These include A for 
entries in chapter VII on non-metallic piping, M for those in 
chapter VIII on Category M fluid service piping, and K for 
those in chapter DC on high pressure piping. 

Dealing first with the provisions for metallic pipework, 
the code gives guidance in chapter II on design pressures 
and temperatures. Essentially, the design pressure of a 
component should not be less than the pressure at the most 
severe condition to which the equipment may be subject, 
the most severe condition being that combination of pres¬ 
sure and temperature which requires the greatest compo¬ 
nent thickness and highest component rating. 

For a straight pipe under internal pressure the code gives 
for the pipe thickness: 

Zm = f+c 112.7.1] 


where c is the sum of mechanical, corrosion and erosion 
allowances, t is the pressure design thickness and f m is the 
minimum required thickness. The pressure design thick¬ 
ness t is given by: 


PD 

*~2(SE+PY) 


[12.7.2] 


It also allows three alternative equations, one of which is 



where D is the outside diameter of the pipe, E is the quality 
factor, P is the internal design gauge pressure, 5 is the 
stress value for the material and Fis a coefficient. Values for 
the quality factor £ are given in appendix A of the code and 
those for the coefficient Fare given in a table. These equa¬ 
tions apply for t < D/6. For t > D/6 or P/SE > 0.385 the 
design is more complex and requires account to be taken of 
factors such as thermal stress and fatigue, and application 
of failure theory 

The design temperature of a component should be that at 
which, in combination with the relevant pressure, the 
greatest component thickness and highest component rat¬ 
ing are required. In determining the design temperatures, 
factors to be considered include fluid temperatures, ambi¬ 
ent temperatures, solar radiation, and heating and cooling 
medium temperatures. 

The code gives guidance on the component temperatures 
to be assumed for uninsulated, externally insulated and 
internally insulated components. For the former, for fluid 
temperatures below 150°F (65°C) the component tempera¬ 
ture is taken as that of the fluid, unless there are factors 
such as solar radiation which indicate that a higher value 
should be taken. For fluid temperatures above 150°F the 
component temperature is taken as a given fraction of the 
fluid temperature, as follows: (1) 95% of the fluid tempera¬ 
ture for pipes, valves, lapped ends, welding fittings, and 
other components of wall thickness comparable to that of the 
pipe; (2)90% for flanges, except lap joint flanges; (3) 85 % for 
lap joint flanges and (4) 80% for bolting. For externally 
insulated pipework the component temperature should be 
taken as the fluid temperature unless some other tempera¬ 
ture can be justified by calculation, test or experience. 


The code deal with materials in chapter III, in appen¬ 
dices A-C and also in other parts. For severe cyclic condi¬ 
tions only certain types of pipe may be used, as listed in 
chapter II (paragraph 305.2.3). The code gives guidance on 
materials suitable for use at high temperatures and those 
suitable for low temperatures. It contains a table of 
requirements for low temperature toughness tests for 
metals (table 323.2.2). This table gives design minimum 
temperatures. 

Flanges, valves and other fittings are dealt with in 
chapter II of the code and also in chapter IVand appendix F. 
Chapter IVgives for flanges, valves and other fittings, lis¬ 
ted components, each with its appropriate standard (table 
326.1), together with guidance on the use of unlisted 
components. 

Appendix F of the code on precautionary considerations 
provides guidance on certain potential hazards and weak 
points in pipework. It highlights certain hazards such as 
expansion of trapped liquids and fluid transients including 
geysering and bowing during cooldown, but is mainly 
concerned with: (1) valves; (2) flanged joints, including 
flanges, gaskets and bolting and (3) materials. 

The integrity of a flanged joint depends on the flanges, 
the gasket and the bolting. For the flanges themselves, the 
code gives guidance on flange rating, type, facing and 
facing finish. It also gives guidance on selection of gaskets. 

Bolting covers bolts, bolt studs, studs, cap screws, nuts 
and washers. The codes gives listed bolting. It also gives 
guidance for conditions subject to high pressure, to high 
and low temperatures and temperature cycling and to 
vibration. For high, low and cycling temperatures and for 
vibration conditions consideration should be given to the 
use of controlled bolting procedures to reduce (1) joint 
leakage due to differential thermal expansion and (2) stress 
relaxation and loss of bolt tension. 

With respect to valves, the use of extended bonnet valves 
is recommended where appropriate to establish a differ¬ 
ential between the temperature of the valve stem packing 
and that of the fluid. This can be an effective way of avoid¬ 
ing problems of packing shrinkage, leakage and icing. 
Attention is also drawn to the potential for entrapment of 
liquids in valves such as double-seated valves, with its 
attendant liquid expansion problem. 

Metallic bellows expansion joints are treated in the code 
in Appendix X, which delineates the relative responsi¬ 
bilities of the pipework designer and the expansion joint 
manufacturer, and gives guidance on: expansion joint 
design conditions; joint design, including fatigue analysis; 
joint support and restraint; and fabrication, examination 
and pressure and leak testing. Reference is made to the 
standards of the Expansion Joint Manufacturers Associa¬ 
tion (EJMA). The use of expanded joints is not allowed in 
Category M (fluid service) or high pressure piping. 

Appendix G of the code on safeguarding deals with 
measures to protect pipework against accidental damage 
and to minimize the consequences of pipework failure. 
Normal safeguards listed include: (1) plant layout; (2) 
equipment, such as instrumentation, ventilation and fire 
protection; (3) systems of access and of work; (4) means for 
fluid containment, recovery or disposal and (5) operating 
procedures. Whilst in most cases additional engineered 
safeguards are not necessary, in some they may be. Engi¬ 
neered safeguards listed include: (1) temperature protection 
by instruments, thermal insulation or thermal shields; 
(2) mechanical protection by shields, barricades, etc.; 
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(3) vibration protection; and (4) measures to mitigate 
pipework failure. 

The code addresses the question of the use of isolation 
valves, or stop valves, in pressure relief piping. Stop valves 
between the piping being protected and the protective 
device (s) and between the latter and the point of discharge 
are not allowed, except subject to conditions. Essentially 
these are: (1) the stop valves are so constructed and subject 
to such positive control that any closure made does not 
reduce the pressure relief capacity; (2) the stop valves are 
either full-area valves or are such that they will not affect 
either the operation or the capacity of the pressure relief 
device(s); and (3) the stop valves are so arranged that they 
can be locked or sealed in both the open and closed posi¬ 
tions. The procedures to be followed if stop valves installed 
according to these principles are to be closed whilst the 
plant is operating are given in appendix F of the code. This 
requires the presence of an authorized person who has the 
means to observe the pressure in the equipment and to 
relieve it in the event of overpressure. Before leaving the 
scene, this person should lock or seal open the stop valves. 

The requirements for examination of the pipework are 
given in chapter VI of the code. For piping for normal fluid 
service the minimum requirements are certain specified 
visual examinations, covering materials, fabrication, 
longitudinal welds, assemblies and erection and examina¬ 
tion by radiographic or ultrasonic methods of a random 
sample of 5% of circumferential butt welds and mitre 
groove welds. 

Chapter VI also contains the provisions for testing. For 
normal fluid service piping the essential requirement is for 
a hydrostatic test. The test is performed using water and 
the test pressure is 1.5 times the design pressure, but with 
an adjustment for the difference between the test and 
design temperatures and with a limitation to ensure that 
the yield strength is not exceeded. There are various alter¬ 
native provisions such as those for the use of a pneumatic 
test and of hydraulic test fluids other than water. 

High pressure pipework is dealt with in chapter IX of the 
code. The basic approach is similar, but the requirements 
are more stringent in respect of a number of features. There 
is a different formula for the thickness of straight pipe 
under internal pressure. 

Piping for Category M fluid service is treated in chapter 
VIII. Again, the requirements for certain features are more 
stringent. 

12.7.3 Pipe supports 

Pipe supports are dealt with in BS 3974:1974. This stand¬ 
ard lists the following loads for which supports are 
required: (1) mass of the pipe, including operating or test¬ 
ing medium, insulation and associated equipment; (2) 
expansion and contraction; (3) reaction due to pumping 
effects and discharge to atmosphere and (4) wind, snow or 
ice loads. 

Equations are given for the calculation of maximum 
bending stresses and deflections based on a single span 
simply supported or a continuous beam. Pipes are usually 
assumed to be simply supported or unrestrained rather 
than supported as beams with fixed ends. Concentrated 
loads, direction changes and pipe joints require special 
attention. Increase in pipe diameter is sometimes used to 
obtain a greater distance between supports. 

Some devices used to support horizontal pipes include 
pipe hangers, slider supports and roller supports. Spring 


and turnbuckle hangers are used for suspending hot insu¬ 
lated pipes. For vertical pipes methods of support include 
trunnions supported on guide lugs, and sling rods sup¬ 
ported by pipe hangers. 

Pipe clips or hangers should be in direct contact with the 
pipe or insulation, but should not be too tight around 
them. Distance pieces are generally used to prevent this. 
The insulating material should be capable of bearing 
the compression load imposed. Pipe guides are used to 
restrain sideways movement of pipes. Anchors are used 
where it is necessary to provide fixed points for pipe bends 
and loops. 

Pipework supports are also dealt with in ASME B31.3. 
This code gives separate treatments for pipe supports for 
piping for normal fluid service, Category M fluid service 
and high pressure service, and for non-metallic piping. 

12.7.4 Gaskets 

Flanged joints in process plant are sealed mainly by gas¬ 
kets or ring seals. Gaskets are considered in this subsection 
and ring seals in the next. 

Two commonly used types of gasket are compressed 
asbestos fibre (CAF) gaskets and metallic spiral wound 
gaskets. These are covered in BS 1832:1972 Specification 
for Oil Resistant Compressed Asbestos Fibre Jointing and BS 
3381:1989 Specification for Spiral Wound Gaskets for Steel 
Flanges to BS 1560. There is a trend towards the use of 
metallic spiral wound gaskets instead of CAF gaskets for 
many of the more severe and hazardous duties. A metallic 
spiral wound gasket takes the form of a ring made out of 
metal windings, with a V-shaped cross-section, wrapped in 
a continuous spiral with soft filler between the metal plies, 
all encased in an outer wrap. 

The features of metallic spiral wound gaskets are dis¬ 
cussed by Granek and Heckenkamp (1981). Such spiral 
wound gaskets have many merits. They provide a relatively 
simple and low cost joint. They offer the elasticity and 
material flow required for good sealing. They are well sui¬ 
ted to high pressures. They are resistant to high tempera¬ 
ture and corrosive conditions. They are resilient to thermal 
shock and vibration. The method of construction and the 
permutations of metal and filler support a family of gaskets 
with shapes compliant to different flange configurations 
and with properties such as the stiffness matched to the 
application. On the other hand, they have certain disad¬ 
vantages. They are not readily tightened up to stop leaks 
and they are not resusable. They are also relatively sensi¬ 
tive to the quality control on the gasket itself, the applica¬ 
tion in which it is used and the manner in which it is bolted 
up. These authors also discuss the extent of confinement of 
the gasket, favouring the practice of confining it so that it 
has no freedom to move and immobilizing it to prevent leak 
paths when pressurized. Metallic spiral wound gaskets are 
resistant to blowout, and this is often an important factor in 
their selection. 

12.7.5 Ring seals 

The other main kind of seal for flanged joints is the ring 
seal, also known as a lens or ring type joint (RTJ).This type 
of seal is used particularly for high pressure plant. A ring 
seal is a ring with an approximately ovoidal cross-section 
which fits into two grooves, one on each of the two flanges. 
The seal is made at the edges rather than at the bottom of 
the groove. The ring is capable of a degree of deformation to 
make a good seal. It is good practice to use a new ring seal 



2/26 PRESSURE SYSTEM DESIGN 


when remaking a joint. Ring seals are another form of 
blowout-resistant sealing. 


12.7.6 Bellows 

Pipework needs to incorporate means of accommodating 
expansion and contraction. One method of doing this is by 
utilizing bellows. A bellows assembly may be used, for 
example, between two pipe sections, between two vessels 
or between a pipe and a vessel. 

After the Flixborough disaster in 1974, referred to above, 
the use of bellows came under a cloud. It is now subject to 
much stricter control. Typically, proposals to use bellows in 
pipework with potential for hazardous release are reviewed 
individually during design, and in some cases there may be 
restrictions on their use. An account of one company’s 
policy on bellows is given by Boyett (1979). 

Following Flixborough, a British Standard on bellows 
was issued. This is BS 6129: 1981 Code of Practice for the 
Selection and Application of Bellows ExpansionJoints for Use 
in Pressure Systems, which has a single part, Part 1:1981 
Metallic Bellows Expansion Joints. In the United States, 
standards for bellows are issued by the EJMA. 

An account of the design and application of bellows as 
expansion joints is given by C. Taylor (1985). The bellows 
itself consists of a convolution. The convolution may be 
‘thick-walled’ or ‘thin-walled’, the latter term covering 
multi-wall construction which may be thicker than a ‘thick- 
walled’ unit. Its stiffness is expressed as a spring rate. 

The design of a bellows assembly has to take into 
account: the forces on, and stresses induced in, the bellows, 
and its movement; the forces and moments on equipment 
connected to it; the external forces such as wind loads on it; 
its stability; and its fatigue performance. The design 
requires also to cover the anchors and guides. 

The EJMA method gives relations for determining the 
spring rate of the convolution. It treats the bellows as an 
elastic shell with stresses induced by pressure and deflec¬ 
tion. It deals with the stability of the bellows and gives a 
fatigue curve. 

Taylor describes three types of system used to compen¬ 
sate for expansion: (1) compression systems, (2) tension 
systems and (3) pressure balanced systems. The compres¬ 
sion system is the simplest: the bellows is placed between 
the two pipe sections and, when expansion occurs, the 
bellows is compressed. The fixed pipe section is held by an 
anchor which resists the compressive forces and the mov¬ 
ing section may be provided with a guide. 

In a tension system, the pressure end load is taken up not 
by anchors but in some other way. The arrangement 
exploits angulation, or slight off-axis movement of the 
bellows. Three tensile systems are hinged assemblies, 
gimbal assemblies and tied double assemblies. Hinged 
units give movements in one plane by angulating the bel¬ 
lows; the pressure end load is contained by the hinge parts. 
Gimhal assemblies allow angular movements. Tied double 
assemblies permit large movements in a plane and, using 
two tie bars, angulation. 

In a pressure balanced system, the force induced by the 
pressure in the bellows is balanced so that only the spring 
rate needs to be accommodated by external means. Two 
commonly used systems are the in-line assembly and the 
elbow-type assembly. Systems of this kind tend to be rela¬ 
tively bulky and expensive, but find application where 
movements are small and space is restricted, and also on 


high pipework where anchors are impractical. They are 
widely used on compressors and turbines. 

Hydrostatic testing requirements can present a diffi¬ 
culty in bellows design. Whereas with most pipework fit¬ 
tings there is no fundamental problem in increasing the 
strength, a bellows is unique in that there is a tradeoff to be 
made between strength and deflection. An increase in 
thickness of the bellows gives an increase in strength, but a 
decrease in allowable deflection, the limiting factor being 
squirm. The point is discussed by D.J. Peterson (1991), who 
instances design of bellows for piping on a fluid catalytic 
cracker unit with gas at 45 psig and 1300°F. He argues that 
in practice the metal temperature of such bellows would be 
1000°F. Design for a test pressure of 76 psig and the actual 
operating temperature of 1000°Fyields a bellows thickness 
of 0.048 in. However, if the test pressure is taken as that for 
the nominal operating temperature of 1300°F and, fur¬ 
thermore, as that applicable to the material of construction 
of the pipework rather that of the bellows, this results in a 
test pressure of 343 psig and a corresponding bellows 
thickness of 0.150 in. The spring rate is increased by a fac¬ 
tor of 28 and the cycle life is reduced by a factor of 317. 


12.7.7 High integrity pipework 

Where the consequences of pipework failure could be 
especially serious, the pipework should be of high integ¬ 
rity. Measures to improve pipework integrity are discussed 
by numerous authors. A convenient summary of many of 
these is given for highly toxic materials in the CCPS HTHM 
Guidelines (1988/3). 

Measures should be taken to reduce the stresses to which 
the pipework is liable to be subjected and to give it robust¬ 
ness in the face of such stresses. Sources of vibration and of 
severe cycling should be minimized and, if necessary, 
countermeasures taken. A flexibility analysis of the pipe¬ 
work should be carried out. 

Joints on pipework should be welded or flanged, and 
threaded joints should be avoided. Features which may 
prove to he weak points should be minimized; these include 
expansion bellows, hoses and sight glasses. 

Gaskets should be suitable for the fluid handled and the 
temperatures, and should be resistant to blowout. Blowout 
resistant-gaskets include metal reinforced, spiral wound 
and ring joint types. 

Fittings, particularly valves, are potential weak points 
and should receive attention both in respect of fugitive 
emissions and outright failure. Leakage can be reduced by 
the use of double packing boxes or bellows seals. 

The design should seek to limit the size of any release 
which may occur. One measure is the avoidance on vessels 
of nozzles larger than is strictly necessary. Another is the 
use of flow restrictor orifices in pipes. The approach taken 
here is to make the pipe of larger diameter, and thicker 
walled, with a lower normal flow velocity. 

The pipework should be protected against over¬ 
temperature, particularly from fire. Methods of protection 
include fire insulation and water sprays used as alter¬ 
natives or in combination. The fire insulation should not 
only possess a suitable nominal fire resistance but also 
should remain in place under fire conditions, which include 
the use of water jets for fire fighting. With respect to fire 
insulation there is a balance to be struck between fire pro¬ 
tection which it affords and the threat of external corrosion 
beneath it. 
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Where the pipework may be subjected to low tempera¬ 
ture, whether this be the normal operating temperature or 
one resulting from a deviation such as sudden depressur¬ 
ization, the constructional materials should have sufficient 
impact resistance to prevent low temperature brittle frac- 

If the material in the pipe may freeze at the lowest tem¬ 
peratures expected, countermeasures such as trace heating 
are necessary. Freezing poses two distinct threats. One is 
expansion on freezing. The other is uneven thawing and 
expansion of the unfrozen liquid. 

The pipework should be protected against overpressure, 
using a suitable combination of protective measures. These 
may include trips, expansion chambers and pressure relief 
devices. 

With respect to physical abuse the CCPS Guidelines 
state that a properly supported NFS 1.5 in. steel pipe is 
generally accepted as being resistant to loads such as 
being stepped on or struck by a heavy pipe wrench. It is 
desirable that piping of other materials be similarly resis¬ 
tant, whether by materials selection, pipe thickness or 
protection. 

Impurities may constitute a threat to pipework integrity, 
particularly where the materials handled are highly reac¬ 
tive, which includes those which are strong oxidizers. The 
system may therefore need to be cleaned after construction. 
This can be assisted by a design which avoids dead spaces 
and provides adequate vents and drains. 

In supporting pipework carrying a corrosive fluid, the 
hangers which support the pipe from above by rods 
are liable to suffer corrosion of these rods, and the 
arrangement is generally to be avoided. An arrangement 
which supports the pipe from below is less liable to fail. 
In more critical duties, it may be necessary to consider 
protection of the pipe support themselves against very low 
or high temperatures, including those occurring in fire 
conditions. 

The routing of pipes should take account of the threat 
from tanks and vessels, pumps and pipework holding 
flammables and, generally, of the threat from fire. Routes 
should pass through protected areas and away from roads. 
It may be appropriate to furnish protection against vehicle 
impact and against physical abuse. In some cases, piping is 
armoured and extra protection is provided for nozzles and 
small bore pipework. 

The pipework should be designed with a view to main¬ 
tenance of the valves, important aspects being access and 
ease of slip plating. Attention should also be paid to the 
avoidance of unbolting errors in the maintenance of valves, 
so the bolts necessary to containment of the pressure are 
not removed in the mistaken belief that they are associated 
only with, say, the actuator or with a spool piece. 

Tanks and vessels should be provided where necessary 
with remotely operated emergency isolation valves, as 
described below. Open-ended external valves should be 
fitted with a blind flange or plug. 

Another potential weak point is the pumps.These should 
be designed to withstand the highest pressures and most 
extreme temperatures to which they may be subject. 

Construction of the pipework should also be to high 
standards. This aspect is dealt with in Chapter 19. Aspects 
mentioned in the CCPS Guidelines include: colour coding 
for identification; cleaning after construction, and design 
to facilitate this; procedures for controlled bolting; and 
access for inspection. 


12.7.8 Fibre reinforced plastic pipework 

There are also a number of standards and codes for the 
design of pipework in FRP. Relevant standards and codes 
are BS 6464:1984 Specification for Reinforced Plastics Pipe, 
Fittings and Joints for Process Plants, BS 7159:1989 Code of 
Practice for Design and Construction of Glass-reinforced 
Plastic (GRP) Piping Systems for Individual Plants or Sites, 
and ASTM D 3517-91 Standard Specification for ‘Fiberglass’ 
(Glass-fiber-reinforced Thermosetting Resin) Plastic Pipe. 
ASME B31.3, the Chemical Plant and Refinery Piping Code, 
deals with non-metallic piping. 

12.7.9 Valves 

Valves constitute another important class of component in 
pipework systems. There is a wide variety of valves in use, 
and only a few types, that is, those with an essentially 
protective function, are considered here. They are (1) non¬ 
return valves, (2) excess flow valves and (3) emergency 
isolation valves. Regular control valves are dealt with in 
Chapter 13. Another aspect of protection is the interlocking 
of valves to prevent their being operated in an incorrect 
sequence. This is discussed in Subsection 12.7.13. 

12.7.10 Non-return valves 

Non-return valves (NRVs), or check valves, are used to 
prevent undesired reverse flows. Reverse flow can have 
serious consequences and some form of protection is often 
necessary. Some situations in which reverse flow occurs 
have been described by Kletz (1976b). They include: (1) flow 
into plant from storage vessels or blowdown lines, (2) flow 
from plant into service lines, (3) reverse flow through a 
pump and (4) reverse flow from reactors. An NRV is a prime 
means of preventing reverse flow in many of these situa¬ 
tions, although it is not always an adequate, or even the 
most appropriate, method in all cases. 

Process materials can flow back into service lines with 
disastrous results if a pressure reversal occurs. AN NRV 
should be installed on service lines, but other measures are 
also necessary. If the service line is in continuous use, it 
may be necessary to have low service pressure and high 
process pressure alarms/trips. If the service line is used 
intermittently, it should be isolated when not in use by 
positive means such as hose disconnection or double block 
and bleed valves. 

NRVs are widely used on the discharge of pumps to pre¬ 
vent reverse flow through the pump. If reverse flow occurs, 
it can disintegrate the impeller and damage the motor. 
Consideration should also be given to reverse rotation locks 
on pumps. 

Reverse flow of one reactant from a reactor into the feed 
pipe of another reactant is likely in many cases to result in 
an explosion. NRVs may be appropriate on the feed pipes. 
Another precaution is the use of a small inventory feed 
tank. This limits the scale of any possible explosion, 
although it also lessens the degree of dilution of a con¬ 
taminant and may thus increase the probability of a 
reaction. 

NRVs are not a fully reliable means of eliminating 
reverse flow. Numerous instances have occurred in which 
materials have travelled back not just through one but sev¬ 
eral NRVs in series. According to Ellis and Mualla (1986), 
a survey of stoppages in Central Electricity Generating 
Board (CEGB) power stations showed that some 16% were 
connected with NRVs. 
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NRVs on critical duties are important pressure system 
components and should be included in the pressure system 
register and regularly tested and maintained. 

Leakage from storage vessels or blowdown lines into the 
plant tends to occur when the latter is shut-down, and can 
have serious consequences. It is usually due to leaks 
through closed but defective valves. The remedy is more 
positive isolation by means such as blanking off. 

Increasingly, environmental considerations lead to 
requirements for vents from storage tanks and other 
equipment to he routed to a disposal system. It is necessary 
to ensure that reverse flow does not occur in such a system. 
However, reverse flow protection for storage tank vents is 
not readily effected by the use of NRVs, because the storage 
tank pressures are low and the flows are often very low and 
intermittent. The problem is discussed by Englund, Mal¬ 
lory and Grinwis (1992), who describe instrument systems 
for this duty. These authors also describe reverse flow pro¬ 
tection arrangements, including NRVs, for a number of 
other situations, such as pump and reactor systems. 

In some cases, it is necessary to take quite elaborate 
precautions to prevent reverse flow. The importance of 
avoiding reverse flow in ethylene oxide plants was empha¬ 
sized in Chapter 11. Figure 12.8 shows a reverse flow pro¬ 
tection system for the ethylene oxide feed to a reactor. There 
is a kick-back line around the pump to prevent overheating 
and an NRV on the pump delivery There are two trip 
initiators and two shut-down valves with both initiators 
and valves arranged as l-out-of-2 systems, as described in 
Chapter 13. One of the valves is also used as a control valve. 
There are two further NRVs. Diversity of the types of NRV 
is used to reduce the probability of common cause failure. 

Reverse flow of ammonia into an ethylene oxide feed 
tank on a reactor was responsible for the disaster in 1962 at 
Doe Run, Kentucky (Case History A31). Appendix 1 also 
describes various other incidents involving reverse flow 
and NRVs. Further case histories are given by Kletz (1976b). 


12.7.11 Excess flow valves 

Another type of valve with a protective function is the 
excess flow valve (EFV). Such a valve is used to shut off 
flow in a situation where the flow has suddenly risen far in 
excess of its normal value. The rise in flow which triggers 
the operation of an EFV is generally 50% or more above the 
normal value. 

EFVs are used at loading facilities to give flow shut-off in 
the event of rupture of a filling line hose. The EFV on a fill¬ 
ing line may be installed internally in the storage vessel. 



control 


Figure 12.8 Ethylene oxide feed system to a reactor 
(Kletz, 1976b) (Courtesy of Hydrocarbon Processing) 


Where the fluid is held as a superheated liquid under 
pressure and will flash when released to atmosphere, the 
flow will become two-phase. The sizing of the EFV thus 
involves a two-phase flow calculation. A calculation 
method for two-phase flow in this application has been 
described by R. A. Freeman and Shaw (1988). The method is 
presented as an alternative to testing of excess flow valves, 
which is a code recommendation for liquefied petroleum 
gas (LPG), but which the authors consider to be potentially 
hazardous. 


12.7.12 Emergency isolation valves 

Emergency isolation valves (EIVs) are used in process 
plant to prevent the loss from containment of large quan¬ 
tities of flammable or toxic substances. An account of EIVs 
has been given by Kletz (1975b). Kletz gives rules for 
deciding whether to install an EIV, and illustrations of the 
application of these rules in particular plants. Points where 
large escapes of material are liable to occur include 
(1) pumps, (2) drain points and (3) hose connections. 

Large leakages can occur from pump glands and seals. 
Some cases of pump leakage are quoted by Kletz. In one 
instance there was a 3 ton escape of ethylene over a period 
of 20 min. 

Drain points are also liable to large escapes. Again a 
number of examples are given by Kletz. The drainage of 
water from hydrocarbons can take some minutes, so that an 
operator tends to go and do something else. Then, if there is 
less water than he expected, or if he forgets to return, there 
may be a leak of hydrocarbons. 

Another problem is the blockage of drain lines and drain 
valves by ice or hydrate formation. In some cases, a drain 
valve freezes open and the operator is unable to close it. In 
others, a blockage occurs and the operator clears it, but is 
then unable to approach to close the valve on account of the 
material escaping. The Feyzin disaster in 1966 (Case His¬ 
tory A38) began with a blockage in the drain line from a 
propane storage sphere, due almost certainly to ice or 
hydrate. 

EIVs may be installed between the inventory and the 
point of expected leakage, but it is unnecessary to install 
an emergency isolation valve between every inventory and 
every leakage point. In fact, it is undesirable to do so, since 
every such device itself introduces further chances of 
leakage. The decision as to whether an emergency isolation 
valve is required in a given case depends, therefore, on the 
expected scale and effects of a leakage and on its prob¬ 
ability. Inventory is an important factor, but it is not the 
only one. 

In many cases, a rough estimate of the probability of a 
leak may be sufficient to show that an EIV is or is not 
needed. In cases where the decision is not clear-cut, it may 
be helpful to do a hazard assessment as described in 
Chapter 9. Relevant to such assessment is the probability of 
pump fires. Some estimates given by Kletz (1971) are quoted 
in Table 16.55. 

The condition of the material should also be taken into 
account in determining the need for an emergency isolation 
valve. A cold liquid that is well below its atmospheric boil¬ 
ing point is less hazardous than one which is superheated 
and will flash off when let down to atmospheric pressure. 
Other factors which may be taken into account include the 
possibility of isolating the inventory by other means, such 
as on the feed to the unit, or of pumping the inventory away. 
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Kletz (1975b) gives some examples of the need for emer¬ 
gency isolation valves, which illustrate the fact that inven¬ 
tory is not the only criterion. An emergency isolation valve 
is recommended for a 10 ton inventory on an ethylene side- 
stream pump which in the past has leaked and ignited, 
whereas one is not recommended for a 70 ton inventory on a 
naphtha feed pump which contains cold material and has 
not leaked. 

An emergency isolation valve may be installed as a new 
valve or by motorization of an existing valve. Figure 12.9 
illustrates the two methods for two pumps piped up in 
parallel. In this case the use of existing valves requires the 
motorization of two valves. But there are some advantages 
in this method in that the amount which can leak out after 
the valves are closed is much reduced and that the valves 
are more easily tested. 

The valve may be arranged so that air, hydraulic or elec¬ 
trical power is required to keep it open or, alternatively, to 
close it. The normal arrangement is closure on power fail¬ 
ure, unless this is undesirable for some reason.Valves which 
are very large and existing valves which have to be motor¬ 
ized, however, require power to move them either to open or 
close. 

If the emergency isolation valve closes on loss of power, it 
is not generally necessary to provide fire protection on the 
air or electrical power lines to it. But if power is needed to 
close the valve, the power lines should be provided with 
15-min protection and a latching device installed to keep 
the valve closed if the power lines are destroyed. The 




Figure 12.9 Emergency isolation valves between a 
vessel and pumps: (a) new isolation valve; (b) existing 
isolation valves motorized, (after Kletz, 1975b) (Courtesy 
of the American Institute of Chemical Engineers 


15-min protection allows the operator time to decide 
whether to close the valve. 

There appears to be little evidence to suggest that either 
pneumatic or electrical operation is more reliable, but it is 
desirable to ensure that the valve actuator is sufficiently 
powerful, particularly on dirty fluids, slurries, and so on. 
An oversized actuator may well be worthwhile. 

Operation of the emergency isolation valve should be 
sufficiently remote that the operator can close it readily in 
an emergency He or she should not have to approach a gas 
cloud or a fire or to go up on higher level platforms or to 
stand on a ladder. The most suitable arrangement is often 
remote operation from the control room. Emergency isola¬ 
tion valves which are controlled remotely are also known as 
remotely operated valves (ROVs) and remotely operated 
block valves (RBVs). 

For EIVs it is recommended by Kletz that two switches 
should be provided at a safe distance from potential leak 
points and separated by at least 30 ft. Where there is more 
than one device to be operated remotely, such as an emer¬ 
gency isolation valve and a pump shut-off, it will generally 
be desirable to group the switches for the different devices 
together. 

In some older plants, the handles of emergency isolation 
valves are taken through a wall, which thus provides pro¬ 
tection for the operator. This method is not recommended, 
however, since walls interfere with ventilation and hinder 
the dispersal of leaks. Remote operation is better. 

Where an emergency isolation valve is fitted on the suc¬ 
tion of a pump, operation of the valve should cause the 
pump motor to trip so that the pump does not overheat and 
ignite the leak. 

The closure of an EIV is not instantaneous. An elec¬ 
trically operated valve typically takes about 1 min to close, 
a pneumatically operated ball valve somewhat less and a 
pneumatically operated gate valve somewhat more. 

In some cases, an automatic control valve is used for 
emergency isolation. Such a valve is not an ideal isolation 
valve, because a characterized valve often does not give a 
tight shut-off, especially after a period of operation. But 
where a control valve is installed, it may be difficult to 
justify a separate emergency isolation valve. If a control 
valve is used for this purpose, there should be a separate 
manual control for isolation; the manual mode of the con¬ 
troller should not be used. 

EIVs have not been widely used on compressors, but 
their installation on a new compressor plant has been 
described by Kletz. He makes the point that, since the 
valves are very large and are motorized, they are useful for 
plant operation as well as for emergencies, and this makes 
their installation easier to justify. 

The Flixborough disaster involved the escape of large 
quantities of superheated flammable liquid from a train of 
high inventory reactors in series. It has been suggested that 
it would have been desirable to have an emergency isolation 
valve between each reactor. Conversely, it has also been 
argued that the probability of an escape from a pipe 
between two reactors in the original, as opposed to the 
modified, plant was remote and that the introduction of 
emergency isolation valves might have increased rather 
than decreased the hazard; the latter is probably the more 
widely held view. 

EIVs may be used to prevent low temperature fluids get¬ 
ting into mild steel plant and causing low temperature 
embrittlement, but in general where this hazard exists it is 
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better to use materials which can withstand the lower 
temperatures. 

The most positive method of ensuring isolation of the 
bottom offtake from a storage vessel is to have a single 
offtake pipe with an EIV on it and with all other devices 
such as sample points or drain points downstream of this. 

Self-closing valves using the dead-man’s handle princi¬ 
ple may be used for drains, but they are liable to be wired 
open by operators. Drain points which are required only for 
maintenance should be blanked off. 

With regard to the type of valve used as an emergency 
isolation valve, relevant features are the torque required to 
operate it, the propensity to trap liquid and the leak tight¬ 
ness. Valves should be provided with power operated 
actuators, but should be capable of being operated manu¬ 
ally. Valves which do not trap liquid include globe, ball and 
high pressure butterfly types. Leak-tightness cannot he 
assumed in an emergency isolation valve and the pipework 
arrangements should be such that positive isolation can 
be effected by methods such as double block and bleed 
systems or slip plates. 

EIVs with potential exposure to flammables, and hence 
fire, should be fire resistant or should have fire protection in 
the form of fire shields and insulation or water deluge. 

EIVs are also installed on pipelines as described in 
Chapter 23. 

EIVs are important components of the pressure system. 
They should be included in the pressure system register 
and should be regularly tested and maintained. 


12.7.13 Valve interlocks 

In some cases, it is critical that operations in a pressure 
system take place in a specified sequence. This applies 
particularly to the opening and closing of valves. The con¬ 
trol of such operations may be effected using interlocks. 
This topic is treated in Chapter 13, but it is convenient here 
to consider the more specialized matter of mechanical 
interlocks, particularly for valves. 

Some principal forms of mechanical interlock are those 
used for (1) supply, (2) access and (3) exchange. In supply 
there is a choice between two mutually exclusive condi¬ 
tions. An example might be where two different fluids may 
be admitted to a system, but where only one is to be admit¬ 
ted at a time. One interlock system that can ensure this is to 
fit each of the two valves with a single lock and to provide a 
single key. The two states of the lock are (1) switch on with 
the key turned and trapped in the lock and (2) switch off 
with the key removable. When the key is turned and trap¬ 
ped the valve is closed and when it is removed the valve is 
open. Another example might be two power supplies that 
are configured in parallel but only one of which should he 
connected at a given time. 

With regard to access, there is to be no access unless 
there is a safe condition. The safe condition generally 
depends on the isolation of a power supply or other source 
of energy or pressure. One interlock system that can ensure 
this is to fit both the access point and the power supply 
point each with a lock and to provide a single key. The basic 
principle is similar to that in the case of the two-valve 
system just described. 

An alternative method, which is applicable to the sys¬ 
tems just described but comes into its own particularly in 
more complex systems, is exchange. Some interlock sys¬ 
tems based on key exchange may be illustrated by reference 



Figure 12.10 Valve system controlled by key interlocks. 
C, closed; O, open 


to the system shown in Figure 12.10 in which there are two 
lines, only one of which is operational at a given time. 

The particular interlock system to be used for such a 
system will depend on whether it is critical that one line 
always be open or that one line always be closed. It is the 
first case which is considered here for illustrative pur¬ 
poses. One interlock system is: to fit each of the four valves 
with a single lock, valves 1 and 2 being fitted by key type A, 
and valves 3 and 4 by key type B such that when a key is 
turned and trapped the valve is locked and when the key is 
removed the valve is open; to provide two keys of each type, 
A and B; and to provide also a key exchange box with four 
locks which contains at any one time the pair of keys of one 
type such that the pair of keys in residence (say type B) are 
removable only when the pair of keys of the other type (A) 
are inserted, turned and trapped. For the case where the 
initial state is line 1 closed and line 2 open and the system is 
to be moved under interlock to the final state of line 1 open 
and line 2 closed, the procedure is to open valves 1 and 2, 
remove the two A keys, insert, turn and trap them in their 
locks in the key exchange, thus allowing the B keys to be 
removed from the exchange and inserted, turned and 
trapped in valves 3 and 4, thus closing it. The sequence is 
then as follows: 



Initial state 

Final state 

Key 

Valve 

Key 

Valve 

Key exchange 

B, B 

_ 

A, A 

_ 

Valve 1 

A 

Closed 

_ 

Open 

Valve 2 

A 

Closed 

- 

Open 

Valve 3 


Open 

B 

Closed 

Valve 4 

- 

Open 

B 

Closed 


Another interlock system applicable to the same valve 
system is as follows. Each of the four valves is fitted with a 
double lock with two different keys such that when the first 
key is turned and trapped the valve is open and the second 
key is removable, and when the second key is turned and 
trapped the valve is closed and the first key is removable. 
Thus, for valve 1 the first key might be A and the second B. 
Five keys are used for the four valves. The keys overlap 
around the system so that for valve 2 the two keys are B and 
C, for valve 3 keys C and D, and for valve 4 keys D and E; key 
Awould then be held in the key box. For the case where the 
initial state is line 1 closed and line 2 open with keys B and C 
turned and trapped to hold closed valves 1 and 2, respec¬ 
tively, with keys D and E turned and trapped to hold open 
valves 3 and 4, respectively, and with key A in the key box, 
and the system is to be moved under interlock to the final 
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state of line 1 open and line 2 closed, the procedure is to 
insert, turn and trap key A in valve X, thus opening it; this 
allows key B to be removed and inserted, turned and trap¬ 
ped in valve 2, thus opening it; this allows key C to be 
removed and inserted, turned and trapped in valve 3, thus 
closing it; this allows key D to be removed and inserted, 
turned and trapped in valve 4, thus closing it; and this 
allows key E to be removed and returned to the key box. The 
sequence is then as follows: 



Initial state 

Final state 

Key 

Valve 

Key 

Valve 

Key exchange 

A 

_ 

E 

_ 

Valve 1 

B 

Closed 

A 

Open 

Valve 2 

C 

Closed 

B 

Open 

Valve 3 

D 

Open 

C 

Closed 

Valve 4 

E 

Open 

D 

Closed 


12.7.14 Fluid transients 

There are a number of flow phenomena which can con¬ 
stitute a threat to the piping system. They include various 
forms of hammer, two-phase flow, and geysering. Some of 
these fluid transients are referred to in codes such as 
ASME B31.3:1990 and API RP 521:1990. 

The best known of the hammer phenomena is water 
hammer, which occurs when the closure of a valve at the 
end of a pipe is too rapid. Steam hammer is another rather 
similar effect in high pressure steam mains. Steam flow 
may also accelerate condensate causing another hammer 
phenomenon which is referred to here as ‘condensate 
hammer’. 

The terminology used to describe these effects reflects 
the fact that, in many cases, the fluids concerned are water 
and/or steam, but similar effects can occur with other 
substances. Thus, for example, water hammer may more 
generally be termed ‘hammerblow’. Another form of ham¬ 
mer which occurs when an NRV is slow to close, so that a 
return velocity builds up and the fluid movement is then 
arrested. It is referred to here as ‘reverse flow hammer’. 


Figure 12.11 



Simple pipeline system 


to pass back down the pipe to B at the velocity of sound in 
the liquid. When this pressure wave reaches B, the liquid in 
the pipe surges back in the direction of B and causes the 
pressure at A to fall. The time for this to happen is 

f = — [12.7.4] 


where l is the length of column of liquid, t is the time for the 
pressure wave to travel the length of the column of liquid, 
and u a is the velocity of sound in the liquid. For any closure 
time less than this the pressure at A has its maximum 
value. Thereafter, the pressure at A oscillates as the pres¬ 
sure waves pass back and forth between A and B, the 
oscillation being damped by friction in the pipe. 

For an inelastic pipe, the pressure on the valve may be 
obtained by equating the loss of kinetic energy of the liquid 
to the gain in the strain energy of the liquid. The latter is 


W = ^PV [12.7.5] 

where P is the pressure of the liquid, V is the volume of the 
liquid, and Wis the strain energy of the liquid. 

The bulk modulus K of the liquid is defined as: 


K _ P 

Wm 


[12.7.6] 


1 p 2 v 

W = -— 

2 K 


[12.7.7] 


Then, equating the kinetic energy loss to the strain 
energy gain for a differential element: 


12.7.15 Water hammer 

If a valve on a liquid pipeline is closed quickly, a large 
change in momentum of the liquid column occurs in a short 
period of time and a large force is exerted on the valve.This 
is known as ‘water hammer’ and it can have a very destruc¬ 
tive effect, resulting in the shattering of the valve and/or 
the line. 

Accounts of water hammer are given in Hydraulics 
(Lewitt, 1952), Hydraulic Transients (Streeter and Wylie, 
1967), Analysis of Surge (Pickford, 1969), Hydraulic Analy¬ 
sis of Unsteady State Flow in Pipe Networks (Q.A. Fox, 
1977) and by Hayashi and Ransford (1960), Streeter (1964), 
Pearsall (1965-66), Ludwig and Ruiterman (1974), Ardron, 
Baum and Lee (1977), Kremers (1983) and D. Clarke 
(1988a,b). 

Following Lewitt (1952), a simple treatment of hammer 
blow in a pipelines is as follows. Consider the pipeline sys¬ 
tem shown in Figure 12.11. If the valve at A is closed sud¬ 
denly, there will be a rapid rise in pressure at this point due 
to the change in momentum of the column of liquid in the 
pipe. This sudden pressure rise at A causes a pressure wave 
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IP 2 ,, 11 of 
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[12.7.8] 

[12.7.9] 

[12.7.10] 





[12.7.11] 

[12.7.12] 


where E is the elastic modulus of the pipe, h is the thickness 
of the pipe wall, r is the radius of the pipe, p is Poisson’s 
ratio of the pipe, a\ is the longitudinal stress in the 
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pipe, and a 2 is the circumferential stress i: 
assuming ^ = 1/4: 

n the pipe. Hence, 

pu 2 IP 2 P 2 r 

[12.7.13] 

~T~2K + Eh 

r p i 1/z 


P U [(l/K + 2r/Eh)\ 

[12.7.14] 


Equation 12.7.14 reduces to Equation 12.7.9 as the elastic 
modulus E goes to infinity. A treatment of the case where 
the fluid flow is two-phase bubbly flow has been given by 
Karplus (1961). 

A principal means of avoiding water hammer is the limi¬ 
tation of the rate of closure of the valve in question. There 
are available computer codes for the analysis of liquid flows 
in networks which can be used to analyse the system and 
determine the safe rate of closure of the valve. 

12.7.16 Steam hammer 

A treatment of transients in lines containing a steam- 
water mixture is given by Karplus (1961). An account of the 
occurrence in high pressure steam lines of a steam hammer 
effect on rapid closure of the stop valves to a steam turbine 
has been given by Crawford and Santos (1986). The closure 
time of the valves was very short, some 50-100 ms. 

12.7.17 Condensate hammer 

Another hammer effect can occur when steam is admitted, 
typically after a shut-down, into a line which contains 
condensate. The condensate can he propelled along the line 
with tremendous and destructive force. 

This effect is treated in AvoidingWater Hammer in Steam 
Systems by Mortimer and Edwards (1988 HSE SIR 5). They 
distinguish three cases: (1) condensate driven by steam, 
(2) condensate drawn by vacuum and (3) flash steam 
effects. In the first case, condensate collects in a pipe or at 
fittings. When steam is admitted and flows past, at velo¬ 
cities which can be up to 40 m/s, waves are set up on the 
condensate surface and, in due course, slugs of condensate 
are formed. When a liquid slug encounters an obstruction, 
such as a sharp bend or valve, it strikes it with a ‘hammer 
blow’. The second case is where the steam is admitted to a 
space where it is cooled in some way and condenses, draw¬ 
ing condensate at high speed towards the space. The third 
case occurs in a pipe containing superheated water which 
is let down in pressure so that some vaporizes as flash 
steam and drives the water away. The flash steam then 
condenses, creating a vacuum with the effects described in 
the second case. Frequently, the damage done is slight, 
but in some instances it is severe. It does not necessarily 
manifest itself at the point of hammer, but sometimes a 
metre or more away. 

The principal measure taken to avoid condensate ham¬ 
mer is design to prevent the build-up of condensate. Provi¬ 
sion of adequate fall in the pipe is one aspect, avoidance of 
fittings which collect condensate another and provision of 
means to remove condensate a third. Fittings such as globe 
valves and strainers are liable to collect condensate. With a 
globe valve, for example, the depth of water collecting 
behind the weir even when the valve is open can exceed half 
the pipe diameter. In this particular case, the problem can 
be avoided by mounting the valve with its spindle hori¬ 
zontal. Manual drain points may be appropriate at some 


locations, but automatic steam traps are the principal 
means of draining condensate. 

There are also operational measures which can be taken. 
One is to drain condensate before starting up. Another is to 
exercise care in the admission of steam. It should be 
appreciated that condensate may form from leaks through 
closed steam valves, even several closed valves in series, 
while the pipe is shut-down. 

12.7.18 Reverse flow hammer 

Another form of hammer is that which occurs when an 
NRV does not close rapidly enough. This is referred to here 
as ‘reverse flow hammer’. The effect is described by Ellis 
and Mualla (1986). If the closure of an NRV is not suffi¬ 
ciently rapid there is an appreciable ‘reverse velocity’, the 
arrest of which, when the valve does close, gives rise to a 
high pressure transient on one side of the valve and a low 
pressure one on the other. Incorrect selection of NRVs has 
for a long time been a source of troublesome pressure 
transients. In order to make the correct choice, it may be 
necessary to conduct tests and to model valve behaviour. 
The trend is to present the valve characteristics as a plot of 
reverse velocity on closure vs the rate of velocity reversal. 
The lack of a standard definition of the latter has caused 
some variability in treatments. 

12.7.19 Two-phase flow effects 

Two-phase flow can often give rise to pressure oscilllations 
and surges. Another phenomenon associated with such 
flow is ‘bowing’, which occurs when a refrigerated liquid is 
introduced at such a rate that two-phase stratified flow 
occurs, with attendant large temperature differences. 

12.7.20 Geysering 

Geysering is a phenomenon which occurs when a liquid 
near its boiling point is handled in a vertical, or sometimes 
in an inclined, pipe. It involves a rapid evolution of vapour, 
expelling liquid from the pipe and causing a destructive 
pressure surge. 

12.8 Heat Exchangers 

Heat exchangers are components of importance in pressure 
systems. They include (1) vaporizers, (2) reboilers, (3) con¬ 
densers, and (4) waste heat boilers, as well as heat exchan¬ 
gers on general heat interchange duties. The design of heat 
exchangers is dealt with in Process Heat Transfer (D.Q. 
Kern, 1950) and in Process Heat Transfer (Hewitt et at. 1993). 

Relevant standards are BS 3274: 1960 Tubular Heat 
Exchangers for General Purposes , API Std 660: 1973 Heat 
Exchangers for General Refinery Services and the Tubular 
Exchangers Manufacturers Association (TEMA) Stand¬ 
ards of the Tubular Heat Exchangers Manufacturers Associ¬ 
ation (n.d.). Until its withdrawal, heat exchangers were 
dealt with in the API Guide for Inspection of Refinery 
Equipment , Chapter 7, Heat Exchangers, Condensers and 
Cooler Boxes. 

Some problems that occur in heat exchangers and which 
may affect safe operation are (1) fouling, (2) polymerization 
and solidification, (3) leakage, (4) tube vibration and (5) 
tube rupture. 

12.8.1 Fouling 

If fouling occurs in a heat exchanger, it may affect (1) heat 
transfer and (2) pressure drop. Reduction of heat transfer 
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capacity may be particularly serious if the heat exchanger 
is a cooler on a critical duty such as removal of heat from 
a reactor in which an exothermic reaction is carried out. 
Effects of increasing pressure drop which may be serious 
are reduction in the maximum flows which can be passed 
through the exchanger and reduction in the pressure drop 
across the control valve and hence deterioration in the 
tightness of control. In the extreme, fouling can result in 
complete blockage of the exchanger. 

Fouling may be reduced by correct selection of tube and 
shell side fluids and by the use of appropriate fluid velo¬ 
cities. Thus, for example, D.Q. Kern (1950) gives separate 
tabulations of fouling factors for water velocities below and 
above 3 ft/s. An allowance may be made for fouling by the 
use of a fouling factor which is equivalent to a heat transfer 
coefficient. This may be a general value taken from the lit¬ 
erature or a specific value determined on the plant. 

Generally, the so-called ‘fouling factor’ measures all the 
deficiencies of the heat exchanger, not just fouling. Often 
these deficiencies are much more significant than fouling 
itself. Thus, for example, a symmetrical positioning of the 
inlet and outlet on a two-pass heat exchanger can cause 
bypassing of the tubes below and above the level of these 
connections and a consequent reduction in heat transfer. 
Or again, a vertical condenser tends to have an inferior 
performance if it is updraft rather than down-draft. 

It is claimed, however, that it is possible by good design 
virtually to eliminate the features which tend to cause 
serious reductions in heat transfer. Detailed design aspects 
have been described by Gilmour (1965). He states that 
where heat transfer deficiencies do still occur, they are 
usually on the shell side. 

The use of a large fouling factor is not necessarily con¬ 
servative. It may give a degree of overdesign which results 
in higher than expected temperatures and greater corro¬ 
sion or coke deposition in the equipment. An example is 
discussed by Small (1968). 

The use of very compact equipment can give rise to 
fouling due to lack of turbulence. Gilmour quotes a case in 
which reboiler tubes were very tightly packed and tended 
to foul by polymerization with bridging of polymer 
between tubes. The original tubes were replaced by half the 
number of finned tubes so that turbulence was increased 
and satisfactory heat transfer restored. This point is clearly 
relevant to design for limitation of inventory. 

Fouling can also occur due to operational factors such as 
stoppage of a pump, omission of a filter, transfer of debris 
from other equipment, and so on. If this can have a serious 
effect, it may be necessary to take appropriate precautions, 
but the incorporation of a fouling factor in the design is of 
little use in this situation. 


12.8.2 Tube vibration 

The use of high capacity, compact heat exchangers with 
long tubes and high fluid velocities has intensified the 
problem of tube vibration. Tube vibration can cause 
damage to the tubes themselves and possibly to the 
exchanger shell and its supports or to the pipework con¬ 
nected to it, can transmit destructive pressure fluctuations 
from the exchanger and can generate considerable noise. 
Vibration can be sufficiently severe to lead to shut-down 
with multiple tube failure within 1 or 2 days. Two such cases 
are quoted by Gainsboro (1968) and by Eilers and Small 
(1973). 


A heat exchanger tube may be regarded as a beam 
clamped at both ends and with distributed load. For such a 
system the natural frequency / n is: 



with k = 1.136 and where E is the elastic modulus, I is the 
moment of inertia, l is the length of the beam, and w is 
the mass per unit length. In a more detailed treatment 
A. A. Thompson (1969) gives a value of the constant k for 
heat exchanger tubes in the range 0.781-1.125. 

The tube may be excited to resonance by vortex shed¬ 
ding. The vortex shedding frequency / v has been studied 
by Y.N. Chen (1968), who obtained for gases a correlation in 
terms of the Strouhal number S: 

/v=~ (12.8.2] 

where d is the diameter of the tube and u is the fluid velocity 
(based on the minimum flow area between tubes of a row). 

The Strouhal number was correlated by a relation of the 
following form: 

s =/(*!,*,) (12.8.3] 

where X\ is the longitudinal spacing ratio, and x t is the 
transverse spacing ratio. 

The problem of tube vibration in heat exchangers has 
been investigated by P.R. Owen (1965), Y.N. Chen (1968), 
Gainsboro (1968), A.A. Thompson (1969) and Eilers and 
Small (1973). 

Also relevant is the acoustic frequency. The acoustic 
resonant frequency / a in a cavity is 

/a = g [12.8.4] 

where c is the velocity of sound, n is the wave mode (inte¬ 
ger), and z is the characteristic dimension. 

If the vortex shedding frequency approaches the acous¬ 
tic resonant frequency, loud noise may be generated. 
Acoustic resonance in heat exchangers has been described 
by Barrington (1973). Resonance may be avoided by 
alteration of the parameters in Equations 12.8.1-12.8.4. 

In one case quoted by Barrington, a heat exchanger with 
an operating weight of 125,000 lb suffered displacements of 
1 mil (0.001 in.) at the anchor bolts with accelerations up to 
175 ft/s. A force of 340 ton was applied to the foundations at 
a frequency of about 350 Hz. He found that few foundations 
can withstand such forces without damage. The monitoring 
of heat exchanger vibration is discussed in Chapter 19. 

12.8.3 Tube rupture 

In a heat exchanger with high pressure gas or vapour in the 
tubes and low pressure liquid in the shell, tube rupture can 
lead to overpressure of the shell. The need for protection of 
the heat exchanger shell is recognized in pressure vessel 
codes such as BS 5500 and the ASME Boiler and Pressure 
Vessel Code. The latter states: ‘Heat exchangers and similar 
vessels shall be protected with a relieving device of suffi¬ 
cient capacity to avoid overpressure in the case of an inter¬ 
nal failure’. 
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More specific guidelines are given in API RP 520:1990. 
This recommends that it be assumed that the area available 
for flow of gas or vapour from the high pressure tube into 
the shell be taken as twice the cross-sectional area of the 
tube, which is the worst case for failure of a single tube. 

The pressure rise in the shell caused by a tube rupture is 
not a simple matter, however. The problem has been inves¬ 
tigated by Simpson (1972), who distinguished two effects: 
(1) local pressure rise at point of rupture and (2) overall 
peak pressure rise in shell. The time-scale of these two 
phenomena differs by an order of magnitude; the first 
occurs in about 1 ms, and the second in about 10 ms. But 
these times are very dependent on the precise conditions in 
the shell, particularly the amount of gas or vapour present 
initially. As little as 1% of inert gas in the shell can increase 
by a factor of 3 the time required to reach peak shell pressure. 

Simpson presents a calculation of the bubble pressure 
created by the rupture in 1 ms of a tube at 10,000 psia. The 
peak bubble surface pressures reached at 1 tube diameter 
and 5 tube diameters from the rupture were about 900 
and 550 psia, respectively. In other words, the peak 
bubble pressure was less than 10% of the tube pressure. 
The pressure experienced by the shell wall is the reflected 
pressure P T : 

Pr&2Pi-P 0 [12.8.5] 

where Pi is the incident pressure and P 0 is the initial liquid 
pressure. Here the effective incident pressure is that of the 
bubble surface. If the rupture time was halved, the peak 
bubble pressure was increased by about 50 %. 

Although the localized overpressure is less than the 
overall peak pressure rise in the shell which occurs later, 
the latter is normally catered for by a pressure relief device, 
while the former is not. The effect of local overpressure on 
the shell and its implications for the positioning of tubes 
relative to the shell should be considered as a separate 
matter. The pressure relief of heat exchangers is discussed 
in Section 12.12. 

12.8.4 Waste heat boilers 

Process heat recovery boilers, or waste heat boilers, are 
widely used, particularly on ethylene and ammonia plants 
and on sulfuric acid and nitric acid plants. This type of 
boiler has developed as a cross between a conventional 
shell-and-tube heat exchanger and a firetube boiler. Its 
original function was to cool high temperature process gas 
and, as a by-product, to generate low pressure steam. The 
steam generation aspect, however, has grown in impor¬ 
tance and the operating conditions have become increas¬ 
ingly severe. Moreover, as with heat recovery schemes in 
general, the use of waste heat boilers increases the degree 
of interlinking of plant and its vulnerability to failure. 

Waste heat boilers and their problems have been dis¬ 
cussed by Streich and Feeley (1972). A comparison given by 
these authors of the typical process waste heat boiler with 
the traditional Scotch marine boiler is instructive: 


Typical conditions 

Process waste 
heat boiler 

Scotch boiler 

Heat load (BTU/ft 2 h) 

11,000 

15,000 

Steam pressure (psig) 

<2300 

200-225 


Waste heat boilers do not have a raw flame licking at the 
tube seats, but otherwise experience conditions at least as 
severe. 

Firetube boilers tend to leak at the tube inlets and this 
problem occurs in waste heat boilers also. Tube size is a 
compromise between the conflicting requirements for low 
velocity at the high temperature inlet and high velocity at 
the low temperature outlet. 

12.9 Fired Heaters and Furnaces 

Fired heaters are another important component in pressure 
systems. They include pipe stills on crude oil units, fur¬ 
naces on olefins plants, and heaters for reactors and for heat 
transfer media. 

General treatments of fired heaters are given in Safe 
Furnace Firing by the American Oil Company (Amoco/3), 
Handbook of Industrial Loss Prevention by the Factory 
Mutual Engineering Corporation (FMEC, 1967), Heaters for 
Chemical Reactors by Lihou (IChemE 1975/61) and the CCPS 
Engineering Design Guidelines (1993/13). 

Relevant codes include BS: 799: 1981- Oil Burning 
Equipment and 5410:1976- Code of Practice for Oil Firing, 
and the British Gas (BG) Code of Practice for Large Gas and 
Dual Fuel Burners (the BG Burner Code) (1976/1). National 
Fire Protection Association (NFPA) codes include the 
NFPA 31,85 and 86 series. 

Selected references on furnaces, fired heaters and flare 
systems are given in Table 12.8. 

Fired heaters are a prime source of hazards.These hazards 
are principally (1) explosion in firing space and (2) rupture of 
tubes. Explosion in the firing space occurs mainly either 
during lighting up or as the result of flame failure. Rupture 
of tubes is usually caused by loss of feed or by overheating. 
In addition, heaters are a source of ignition for escapes of 
flammable materials from other parts of the plant. 

The elimination of hazards in fired heaters is a good 
illustration of the need for measures both in design and 
operation. The design aspects are considered here and the 
operating aspects in Chapter 20. 

Many explosions in the firing space take place during 
start-up when an attempt is made to light a burner. The 
usual situation is that fuel leaks and forms a flammable 
atmosphere in the firing space while the plant is shut-down 
and an explosion occurs when an attempt is made to light a 
burner. There are a number of measures which should be 
taken to prevent this hazard. The most important is to 
eliminate the admission of unburnt fuel into the firing 
space. This is principally a matter of achieving a positive 
isolation on the main fuel feed pipe to the burner. The 
importance of this is strongly emphasized. 

For isolation it is not sufficient to rely on a single valve. 
Use should be made either of double block and bleed valves 
or of slip plates. There are different views on which of these 
methods is preferable and in any case the choice is affected 
by the fuel. For gas, double block and bleed valves should be 
used and for oil either double block and bleed valves or slip 
plates. 

Where oil is used, the configuration of the pipe between 
the shut-off valve and the burner should be such that oil 
does not flow from this section of pipe into the firing space 
after the valve has been shut. In addition, the entry of fuel 
from the main feed pipe during the few seconds while the 
burner is shutting down after flame failure or from the 
subsidiary feed pipe to the pilot burner should be avoided. 






PRESSURE SYSTEM DESIGN 12/35 


Table 12.8 Selected references on furnaces, fired 
heaters and flare systems 


American Oil Co. (n.d./3,9); ASME (Appendix 28 Heat 
Transfer, 1984/55,1985/56,57,1992 CSD-1); Griswold 
(1946);Thring (1952); Krebs (1962); Finnie (1963); 
Wimpress (1963); lichtenstein (1964); Charlton (1965); 
Runes and Kaminsky (1965,1973); F.A.Williams (1965); 
Backensto, Prior and Porter (1966); Ellwood and Danatos 
(1966); FMEC (1967); Loftus, Schutt and Sarofim (1967); 
Maddock (1967); Lenoir (1969); C. Davies (1970); von 
Wiesenthal and Cooper (1970); Demarest (1971); Mack 
(1971,1976); OIA (1971 Publ. 501); Siegel and Howell (1972); 
J. Chen and Maddock (1973); Fitzsimmons and Hancock 
(1973); R.D. Reed (1973); Ulrich (1973); Chambers and Potter 
(1974); Mol and Westenbrink (1974);Taube (1974); Fertilio 
and Princip (1975); IChemE (1975/61); Mitcalf (1975); 
Ashbaugh (1976); Coulter and Tuttle (1976); Krikke, Hoving 
and Smit (1976); Anon. (19771); Hoffman (1977); Lihou 
(1977); Tittle and Coulter (1977); Berman (1978); Hougland 
(1978); Jensen (1978); R. Kern (1978f); Ministry of Social 
Affairs (1979b); Goyal (1980); API (1981 Refinery 
Inspection Guide Ch. 9,1986 Std 560,1988 RP 530); 
Lovejoy and Clark (1983); Schillmoller and van den Bruck 
(1984); Gomes (1985); Institute of Materials (1985 B367); 
Kauffman (1987); TO. Gibson (1988); NFPA (1985 NFPA 
85E, 1987 NFPA 85A, 85G, 1988 85F, 1989 NFPA 85B, 85D, 
1990 NFPA 86,1991 NFPA 86C, 1992 NFPA 31,54); Ghosh 
(1992); L. Thomas (1992) 

Reformers 

Francis (1964); Axelrod and Finneran (1966); Avery and 
Valentine (1968); Kratsios and Long (1968); Pennington 
(1968); Jacobowitz and Zeis (1969); Kobrin (1969); 
Bongiorno, Connor and Walton (1970); EW.S. Jones (1970); 
Zeis and Heinz (1970); Holloway (1971); Nisbet (1971); 
Attebery and Thompson (1972); Salot (1972,1975); Strashok 
and Unruh (1972); A.J.P. Tucker (1972); Fuchs (1974); 
Ruziska and Bagnoli (1974); Demarest (1975); Fuchs and 
Rubinstein (1975); van der Horst and Sloan (1975); 

E.R. Johnson (1975); Leyel (1975); Sterling and Moon 
(1975); Sparrow (1986) 

Burners 

British Gas (Appendix 27, 28); Anon. (1957-58); 

P.G. Atkinson, Grimsey and Hancock (1967); FMEC (1967); 
Gas Council (1969 GC166); Brook (1978); Elias (1978); 

J. A. Wagner (1979); Murphy (1988); NFPA (1992 NFPA 
31,52) 

ANSI Z83; BS (Appendix 27 Burners) 

Refractories 

Chesters (1961, Institute of Materials 1974 B135); Burst and 
Spieckerman (1967); Crowley (1968); McGreavy and 
Newmann (1974) 

Flare systems 

Zink and Reed (n.d.); P.O. Miller, Hibshman and Connell 
(1958); Hajek and Ludwig (1960); Bluhm (1961,1964b); 
Husa (1964); G.R. Kent (1964,1968,1972); Kevil (1967); 

P. Peterson (1967);Tan (1967a,b); Kilby (1968); R.D. Reed 
(1968,1972); Grumer et al. (1970 BM RI7457); F.R. Steward 
(1970); Escudier (1972); Lauderback (1972); Seebold 
(1972a,b, 1984); Swithenbank (1972); Brzustowski (1973, 
1976,1977); Brzustowski and Sommer (1973); Peters (1973); 
H.M. Chief Alkali Inspector (1974 annual report); Kletz 
(1974b); Vanderlinde (1974); Brzustowski etal. (1975); 


Klooster etal. (1975); Ito and Sawada (1976); Bonham 
(1977); Jenkins, Kelly and Cobb (1977); Schmidt (1977a,b); 
R. Schwartz and Keller (1977); Straitz (1977); Straitz and 
O’Leary (1977); Straitz etal. (1977); Agar (1978); Bonilla 
(1978); McGffl and McGffl (1978); Anon. (1979 LPB 28, 
p. 97); Boeye (1979); Paruit and Kimmel (1979); Anon. (1980 
LPB 31, p. 27); Oenbring and Sifferman (1980a,b); Kandell 
(1981); E.B. Harrison (1982); McMurray (1982); P.J. Turner 
and Chesters (1982); Anon. (1983n); G.D. Allen,Wey and 
Chan (1983); Beardall (1983); Blanken and Groefsma 
(1983); Chung-YouWu (1983); B.C. Davis (1983,1985); 
Fumarola etal. (1983); Lutzow and Hemmer (1983); Max and 
Jones (1983); Romano (1983); Alcazar and Amillo (1984); 
Coulthard (1984); Vaughan (1984); Banerjee, Cheremisinoff 
and Cheremisinoff (1985); Boix (1985); ChunghuTsai 
(1985); Cindric (1985a); Corbett (1985); deFaveri etal. 
(1985); Herbert and Rawlings (1985); Narasimhan (1986); 
Pohl etal. (1986); Swander and Potts (1986,1989); British 
Gas (1987 Comm. 1349); D.K. Cook, Fairweather, 
Hammonds and Hughes (1987); D.K Cook, Fairweather, 
Hankinson and O’Brien (1987); Straitz (1987); Leite (1988, 
1990); de Suva (1988); Tite, Greening and Sutton (1989); 
API (1990 RP 521); Crawley (1993 LPB 111); Niemeyer and 
Livingston (1993); Bryce and Fryer-Taylor (1994) 
Explosions (see Table 17.1) 


Before a burner is started up, the firing space should be 
purged with air. The atmosphere in the space should then 
be sampled to confirm that it is not flammable. The purging 
of the firing space is essential. It is emphasized, however, 
that it is in no way a substitute for elimination of leakage of 
fuel into this space. 

Means for lighting a burner include a poker, a spark 
igniter, a permanent pilot burner and an interrupted pilot 
burner. An interrupted pilot burner is extinguished a few 
seconds after main flame ignition. The use of a poker is not 
a good method of ignition. An interrupted pilot burner may 
be more satisfactory than a permanent pilot burner, since 
the latter tends to go out. 

The ignition period is a critical one. The approach adop¬ 
ted is illustrated by the procedures given in the BG Burner 
Code. The burner is started up on a start-gas flow which is 
less than the normal flow. The establishment of the start 
flame consists of two periods: an initial period of not more 
than 5 s in which ignition is checked and a second period of 
at least 5 s during which flame stability is checked. 

It is essential that if the flame fails, the burner should be 
shut-down immediately. A flame failure detector is used to 
monitor the flame and to initiate the trip. Loss of combus¬ 
tion air also necessitates immediate shut-down. Methods of 
detecting this condition are measurement of static pressure 
or of air flow. 

The sequence of operations for the start-up of a burner 
should be carefully specified. In particular, the following 
operations should be carried out in sequence and the start¬ 
up should not proceed unless this has been done: establish¬ 
ment of air flow; purging of firing space; testing of 
atmosphere in space; and establishment of flame. Some 
detailed start-up sequences are given in the BG Burner Code 
and by the FMEC (1967). It is necessary to ensure that any 
start-up sequence specified is rigidly adhered to. Generally, 
the reliability of execution of these sequences can be 
improved by the use of automatic operation or of interlocks. 
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Many cases of tube rupture in fired heaters occur 
because the flow of process fluid through the tubes either 
falls too low or ceases altogether. If this happens, it is 
essential for the flame to be extinguished immediately. It 
should be appreciated that in a furnace where at normal 
throughput the ratio of the heat required to vaporize liquid 
to that required to superheat vapour is high, a given 
reduction in feed flow can result in a disproportionate 
increase in outlet tube temperature. Overheating of the 
tubes is another cause of rupture. It is necessary, therefore, 
to have measurements of tube temperature. 

Instrumentation should be provided to measure and 
control the main operating parameters and, if necessary, to 
trip the furnace. Measurements should normally include: 
fuel pressure and flow; combustion air flow and fuel/air 
ratio; combustion gas oxygen content; process fluid pres¬ 
sure, flow and outlet temperature; flame state; and tube 
temperatures. There should be appropriate alarms based on 
these measurements. 

The fail-safe principle should he applied in the design of 
the control system. Thus there is frequently a control loop 
which manipulates the feed flow in order to control the 
temperature of the process fluid leaving the furnace. If 
the instrument measuring this outlet temperature fails, 
the control loop may increase the fuel flow, which is a 
hazardous condition. It is essential, therefore, that the 
measurement on which any alarm or trip is based be sepa¬ 
rate from that used for control. 

There should be trip systems which shut off the fuel flow 
to the furnace and inject snuffing steam (1) if the electrical 
power fails, (2) if the fuel pressure and/or flow is low, (3) if 
the flame goes out, (4) if the combustion air pressure and/or 
flow is low, or (5) if the process fluid pressure and/or flow is 
low or its outlet temperature high. 

The provision of automatic sequence controls or inter¬ 
locks for burner start-up has already been mentioned. The 
safe operation of burners depends critically on the relia¬ 
bility of the instrumentation and it is essential for this to 
be high. 

Difficulties are sometimes experienced with the flame 
failure device. One problem is instrument failure. Flame 
failure devices are available with some degree of self¬ 
checking. Another is sighting of a pilot burner flame 
instead of the main flame. If this situation might arise, the 
flame failure detector should be fitted in such a way that it 
cannot ‘see’ the pilot flame. 

The foregoing indicates some of the general safety 
aspects of the design of fired heater systems, but it should 
be emphasized that this is a specialist matter. 


12.10 Process Machinery 

Process machines such as compressors and pumps are 
particularly important items in pressure systems. Not 
only are they themselves potential sources of loss of con¬ 
tainment, but they also affect the rest of the plant by 
imposing pressure and/or flow fluctuations and by causing 
vibrations. 

The size, complexity and severe operating conditions of 
many process machines create numerous problems. Much 
attention is devoted to critical machinery, however, as much 
for economic as for safety reasons. In consequence, the 
level of reliability attained is generally rather high. Never¬ 
theless, a failure of a process machine can be serious. 


An account of some of the problems associated with 
process machinery is given in Safe Operation of Air, 
Ammonia and Ammonium Nitrate Plants by the American 
Oil Company (Amoco/9). Selected references on process 
machinery are given in Table 12.9. 


Table 12.9 Selected references on process machinery 


ASME (Appendix 28 Applied Mechanics, Design 
Engineering, Fluids Engineering, 1981/85); ASTM (STP 
231); IMechE (Appendix 28,1987); Routh (1882,1905); 
Riegel (1953); EEUA (1960 Doc. 15); Meyer (1961); Everett 
(1964); Axelrod, Daze and Wickham (1968); Sternlicht, 
Lewis and Rieger (1968); Blubaugh and Watts (1969); 
Scheel (1970); Tucker and Cline (1970,1971); Carrier (1971); 
Perkins and Stuhlbarg (1971); Bultzo (1972); Weaver (1972); 
Abraham (1973); Dziewulski (1973); J.E. Ross (1973); 
Barnes (1974); Ryder (1975); API (1976 Refinery Inspection 
Code Ch. 10); HSE (1978b); Sohre (1977,1979,1981); 

C. Jackson (1976a,b, 1981); Bloch and Geitner (1983,1990); 
Bloch (1988,1989); IEE (1991/5); Oberg et al. (1992); Rutan 
(1993) BS (Appendix 27 Machinery), BS 5304:1988; VDI 
2224:1988 

Turbines, turbomachinery 

Keith (1965); Shield (1967,1973); Naughton (1968); Purcell 
(1968); Swearingen (1970,1972); Farrow (1971); ASME 
(1972/28,1977/189,1982/43); H. Cohen, Rogers and 
Saravanamuttoo (1972); Wachel (1973); B. Turner (1974); 
Bloch (1976); IMechE (1976/29); Leonard (1976); Millar 
(1978); Simmons (1978); Athearn (1979); Bergmann and 
Mafi (1979); C. Jackson and Leader (1979); Molich (1980); 
Neerken (1980b); Fielding and Mondy (1981); Harman 
(1981); Nippes (1981); Sohre (1981); Nicholas (1983); 

L.L. Fisher and Feeney (1984);Turton (1984); Campagne 
(1985); Rail and Fromm (1986); API (1987 Std 612,1988 Std 
611,1992 Std 616); Lake (1988); AGA (1989/13) BS 132: 
1983, BS 3863:1992 

Compressors 

American Oil Co. (n.d./9); Horlock (1958); Coopey (1961); 
Troyan (1961c); Younger and Ruiter (1961); Esplund and 
Schildwachter (1962); Borgmann (1963); Anon. (1964a); 
Chlumsy (1966); Bultzo (1968);Telesmanic (1968); 
Kauffmann (1969); Bresler (1970); R.N. Brown (1972,1974); 
Hallock, Farber and Davis (1972); Mehta (1972); Dwyer 
(1973); D.F. Neale (1973,1976); H.M. Davis (1974a,b); 

P. Lewis (1974); Bauermeister (1975); C. Jackson (1975,1978); 
Neerken (1975); Sayyed (1976,1978); Bryson and Dickert 
(1977); Cordes (1977); IMechE (1977/34,1989/108); Kusha 
(1977); W. E. Nelson (1977); Dimoplan (1978); Winters (1978); 
Matley and Chemical Engineering Staff (1979-); van 
Ormer (1979); Stokes (1979); Broekmate (1980); Haselden 
(1980); Burke (1982); AGA (1983/39,1988/52,58,1989/12); 
G. Bowen (1984); Greene etal. (1985a); Zafar (1986); Ablitt 
(1987): EEMUA (1987 Publ. 152); Sandier and Luckiewicz 
(1987); ASME (199019.1,199119.3); Nissler (1991); 

B.C. Price (1991); Bloch and Noack (1992); Hallam (1992); 
Livingstone (1993); O’Neill (1993) 

Centrifugal compressors: Schildwachter (1961); Church 
(1962); Sedffle (1965-66); Hile (1967); Badger (1968); 
Chodnowsky (1968); Morrow (1968); Moschini and 
Schroeder (1968); Scheel (1968,1971); Zech (1968); Sohre 
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(1970,1977); ASME (1971/25,1976/36,1984/46,1990 19.1, 
1991 B19.3); Burns (1971); H.M. Davis (1971); Dwyer 
(1971a,b, 1974); C Jackson (1971b, 1975); D.LE. Jacobs (1971); 
D.F. Neale (1971); Rassman (1971); Schirm (1971); Stafford 
(1971); Wachel (1973); Cameron and Danowski (1974); 

B. Turner (1974); Lapina (1975,1982); Strub and Matile 
(1975); Leonard (1976); Sayyed (1976,1985); Boyce (1978); 
Gupta and Jeffrey (1979); Rehrig (1981); H. Davis (1983); 
API (1988 Std 617) 

Reciprocating compressors: Deminski and Hunter (1962); 
Deminski (1964a,b); Morain (1964); Chlumsy (1966); Scheel 
(1967a,b); Gallier (1968); F.G. Jones (1971); Bultzo (1972); 
Dziewulski (1973); Prentice, Smith and Virtue (1974); 
Traversari and Beni (1974); ASME (1975/33); Whittaker 
(1975); Barnes (1976); Messer (1979); Schiffhauer (1984); 
API (1986 Std 618); Dube, Eckhardt and Smalley (1991); 
WooUatt (1993) BS 7322:1990 

Rotary compressors: Scheel (1969b); van Ormer (1980); API 
(1990 Std 619); IMechE (1994/163) Compressor control: 
Claude (1959); Hagler (1960); R.N. Brown (1964); Daze 
(1965); Marton (1965); Hatton (1967); Magliozzi (1967); 
Gallier (1968); Labrow (1968); Spence (1972); Staroselsky 
and Carter (1990) 

NRC (Appendix 28 Fans and Blowers)', Woods Ltd (1960); 
Scheel (1969a); Poliak (1973); Eck (1974); IMechE (1974/8, 
1975/24,1977/34,1984/78,1990/119,1993/151); Martz and 
Pfahler (1975); J.P. Lee and Chockshi (1978); Matley and 
Chemical Engineering Staff (1979); Summerell (1981); J.E. 
Thompson and Trickier (1983); Fringe and Kasthuri (1986); 
ASHRAE (1992 ASHRAE 87.1) 

Pumps 

ASME (Appendix 28 Fluids Engineering, 1991 B73.1, 
B73.2M); ASTM (STP 307,408); IMechE (Appendix 28, 
1974 Item 11,1975 Items 14,24,1976 Item 25,1977 Item 34); 
NRC (Appendix 28 Pumps); Church (1944); Hicks (1957, 
1958); Stepanoff (1957); Minami etal. (1960); Doolin (1961, 
1963,1978,1984,1990); Korzuch (1961); Younger and Ruiter 
(1961); Troyan (1961c); Anon. (1962g); Niemkiewicz (1962); 
T.E. Johnson (1963); Poliak (1963); C. Jackson (1965,1972a, 
1973); J.K Jacobs (1965); Thurlow (1965,1971); Addison 
(1966); Chapman and Holland (1966); Holland and 
Chapman (1966a,b); Hummer (1966); R. Montgomery 
(1967); I. Taylor (1967); EEUA (1968 Hndbk 26); Hernandez 
(1968); Rost and Visich (1969); Hattiangadi (1970b); 
Chemical Engineering (1971); Glikman (1971); R. Kern 
(1971); Knoll and Tinney (1971); J. A. Reynolds (1971); Stindt 
(1971); Anon. (1972h); H.E. Doyle (1972); D’lnnocenzio 
(1972); Karassik (1972,1977,1982,1993); Platt (1972); 
Ramsden (1972); C.A. Robertson (1972); M.G.Murray 
(1973); Simo (1973); Black et al. (1974); van Blarcom (1974, 
1980); British Pump Manufacturers Association (1974); 
Hancock (1974); Neerken (1974,1980a, 1987); Waring (1974); 
Yedidiah (1974); Buse (1975,1985,1992); Karassik and 
Krotsch (1975); Anon. (1976d); R. James (1976); Makay 
(1976); de Santis (1976); Bloch (1977a, 1978,1980,1982, 
1983a, 1989); R.J. Meyer (1977); Rinard and Stone (1977); 
Sparks and Wachel (1977); W.H. James (1978); McLean 
(1982); Morlock (1978); Panesar (1978); Penney (1978); 
Tinney (1978);Thai (1982); Anon. (1979 LPB 29, p. 139); 
Grohmann (1979); Henshaw (1979,1981); Lightle and 
Hohman (1979); Panesar (1979a); Poynton (1979); 

A.P. Smith (1979a,b); Webster (1979); Mattley and Chemical 


Engineering Staff (1979-); API (1980 Std 674,676,1989 Std 
610); IChemE (1980/121,1985/127); Krienberg (1980); Vetter 
and Hering (1980); Anon. (1981f); Bristol (1981); Ekstrum 
(1981); Eraser (1981); J.D. Johnson (1981); Lapp (1981); 
Mikasinovic and Tung (1981); WV. Adams (1982); Hallam 
(1983); F.J. Hill (1983); R. King (1983); Krutzsch (1983); 

R.R. Ross (1983);Talwar (1983); Baker-Counsell (1984b); 
Dobrowolski (1984); Hornsby (1984); Vlaming (1984); Bloch 
and Johnson (1985); Cody,Vandell and Spratt (1985); 
Etheridge (1985); S. Hughes (1985,1987); Lobanoff and 
Ross (1985); Nevffl (1985); Rattan and Pathak (1985); Lonel 
(1986); Karassik etal. (1986); Nasr (1986,1992); R. Edwards 
(1987); EEMUA (1987 Publ. 157); Reeves (1987); Sandier 
and Luckiewicz (1987); I. Taylor (1987); T. Martin (1988a,b, 
1989a); Rendell (1988b); API (1990 Std 610); Dufour (1989); 
Garbers and Wasfi (1990); Gravenstine (1989); Giilich and 
Rosch (1989); Lahr (1989); Luetzow (1989); McCaul (1989); 

G. Parkinson and Johnson (1989); J. A. Reynolds (1989); 

H. Davis (1990); Doolin and Teasdale (1990); Flyght Pumps 
Ltd (1990); Mabe and Mulholland (1990); Anon. (1991i); 

C. Butcher (1991d); Doolin et al. (1991); Jaskiewicz (1991); 
Margus (1991); Newby and Forth (1991); Wild (1991); Hawks 
(1992); G. Parkinson and Ondrey (1992); Schiavello (1992); 
UL (1992 UL 51); Bitterman (1993); Blair (1993); Buck 
(1993); Chyuan-Cheng Chen (1993); Cleary (1993); 

J.R. Peterson and Davidse (1993); Vandell and Foerg (1993); 
Vetter etal. (1993); BS 4082:1969-, BS 5257:1975 

Agitators 

N.H. Parker (1960); Troyan (1961c); EEUA (1962 Hndbk 9); 
Penney (1970); Gates, Hicks and Dickey (1976); Hicks and 
Dickey (1976); R.S. Hill and Kime (1976); Ramsey and Zoller 
(1976); Ketron (1980) 

Centrifuges 

IChemE (1976/67,1987/81); Crosby (1979); BS 767:1983 
Conveyors 

EEUA (1965 Doc. 30); ASME (1990 B20.1-1990); BS 490: 
1975-BS 2890:1989 

Drives 

NRC (Appendix 28 Electric Motors)', Gillett (1960); 

H.H. Meyer (1961); Cunningham (1962); Lane and Holzbock 
(1962); Olson (1963,1979); ASME (1966/122); Caplow 
(1967); Olson and McKelvy (1967); EEUA (1968 Hndbk 29); 
Roe (1969); Nailen (1970a,b, 1973a-c, 1974,1975,1978); 

E.F. Cooke (1971,1973); P. Bell (1971b); Cates (1972); Hallock, 
Faber and Davis (1972); IEE (1972 Conf. Publ. 93); Platt 
(1972); Pritchett (1972); J.C. Moore (1975); Plappert (1975); 
Bloch (1977a); M.G. Murray (1977); Constance (1978); 
Albright (1979); Deutsch (1979); Fishel and Howe (1979); 
Kohn (1979b); Panesar (1979b); Basta (1980); Finn (1980); 
M.N. Kraus (1980); Pollard (1980); Anon. (1981e); IMechE 
(1981/55,1983/ 69,1985/85); Antony and Gajjar (1982); Doll 
(1982); Hartmann (1984); Long (1984); Beevers (1985b); API 
(1987 Std 541); Feldman (1987); Sandier and Luckiewicz 
(1987); EEMUA (1988 Publ. 132); I. Evans (1988); Ranade, 
Robert and Zapate-Suarez (1988); UL (1988 UL 1004,1991 
UL 1247); Anon. (1989a); Burton (1989); Mabe and 
Mulholland (1990); Basso (1992); Patzler (1992);Thibault 
(1993) BS (Appendix 27 Electrical) 

Power transmission 

North and Parr (1968); Anon. (1973h); Beard (1973); E.F. 
Cooke (1973); Dubner (1975); Finney (1973); Shipley (1973); 
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Thoma (1973); Bloch (1974); Kraemer (1974); Arndt and 
Kiddoo (1975); Calistrat (1975,1978-); Roney (1975); 
Wattner (1976); Vanlaningham (1977); Coupland (1980); 
Renold Ltd (1980); J.D. Smith (1983); ASME (1985 
B106.1M); C.M. Johnson (1985); Polk (1987); API (1988 Std 
613,1989 Std 677); Mancuso (1988); Timmerman (1989); 
Horrell, Neal and Needham (1991); IMechE (1993/153); 
Thibault (1993) ANSI B93 series, BS (Appendix 27 
Machinery) 

Bearings, seals, lubrication 

ASME (Appendix 28 Applied Mechanics, Fluids 
Engineering)-, ASTM (STP 77, 84, 88, 437); IMechE 
(Appendix 28); Whalen (1963); Anon (1964d); Coopey 
(1965, 1967, 1969); EEUA (1965 Handbook 10, 1971 
Handbook 27); LH. Price (1965); Koch (1966); Stock 
(1966); Lindsey (1967); C. Jackson (1968, 1970, 1972a, 
1975); N.H. Miller (1968); Samans (1968); Samoiloff 
(1968); Furey (1969); Yaki and Carpenter (1970); 
Battilana (1971,1989); C.P. Shaw (1971, 1977); E. Meyer 
(1972); Ruckstuhl (1972); EEMUA (1973 Publ. 115); 
Bushar (1973); Kellum (1973); M.J. Neale (1973); Rothman 
(1973); J.O.S. MacDonald (1973); Tinney, Knoll and Diehl 
(1973); B. Turner (1973); R.M. Austin and Nau (1974); 
Miannay (1974); Nisbet (1974); Anon. (1975k); Pattinson 
(1975); J. Wright (1975); Anon. (1976 LPB 9, p. 12); 
Cameron (1976); Fern and Nau (1976); Houghton (1976); 
M.G. Murray (1976); Ramsey and Zoller (1976); 
Summers-Smith and Livingstone (1976); Czichos (1978); 
Hills and Neely (1978); Hoyle (1978); Ramsden (1978); 
Barwell (1979); McNally (1979); J. Phillips (1979); Tipler 
(1979); Ummarino (1979); Hawk (1980); P.T. Jones (1980); 
Mendenhall (1980); Panesar (1980); P. Rogers (1980); 
Sangerhausen (1981); Warring (1981); Kerklo (1982); 
Lansdown (1982); Summers-Smith (1982, 1988); Anon. 
(1983g); W V. Adams (1983, 1987); Bloch (1983b, 1989); 
Booser (1983); Cameron and McEttles (1983); Cleaver 
(1983); Higham (1983); M.H. Jones and Scott (1983); 
BOHS (1984 TG3); Fuller (1984); W.S. Robertson (1983); 
Dunhill (1984b); Wallis (1984); Wong and Ansley-Watson 
(1985); Baker-Counsell (1985h); Buse (1985); Wallace and 
David (1985); Flitney (1986,1987); Trade and Technical 
Press (1986); Anon. (1987e); Chynoweth (1987); Mattel, 
Botte and Regazzacci (1987); Abrams and Olson (1988); 
Ferland (1988); Fort and Jehl (1988); Newby (1988); 

API (1992 Std 614); Gregory (1993); Wells (1993) 

BS 1399: 1970 


Vibration (see also Table 19.9) 

ASME (Appendix 28 Applied Mechanics, Design 
Engineering, Dynamic Systems and Control, Flow Induced 
Vibration and Noise, Fluids Engineering, Heat Transfer, 
Pressure Vessels and Piping, 1988/197); Church (1963); 
Summers-Smith (1969); Ker Wilson (1970—71); R.H.Wallace 
(1970); Anon. (1973h); IMechE (1975/24,1977/43,1979/49, 
1984/84,1988/100,106,1991/131,1992/145); J.M. Baker 
(1976); R.J. Meyer (1977); Sallenbach (1980); M.H. Jones and 
Scott (1983); J.D. Smith (1983) 

Alignment and balancing 

Blake (1967); C. Jackson (1971a,b, 1976a,b); Essinger (1973, 
1974); M.G. Murray (1974,1979); Ryman and Steenbergen 
(1976); Kirlan (1977); AGA (1985/44); Horrell (1991); IMechE 
(1991/128) 


12.10.1 Process compressors 

The process industries use both positive displacement and 
centrifugal compressors, some of which are very large ma¬ 
chines with high throughputs and energy. An account of com¬ 
pressors is given in Industrial Compressors (O’Neffl, 1993). 

The three principal types of compressor are centrifugal 
compressors, reciprocating compressors and screw com¬ 
pressors. Both the last two are positive displacement 
machines, but with reciprocating and rotary motions, 
respectively. 

Reciprocating compressors have long been used for high 
pressure duties. There has been a trend, however, towards 
centrifugal compressors and, although these machines 
were originally used mainly for relatively low compres¬ 
sions, the pressures for which they are used have tended to 
increase. Some centrifugal compressors are now very big. 
A large ethylene plant may depend on single large com¬ 
pressors not only for main gas compression but also for 
refrigeration compression. Another trend is the increase 
in the application of screw compressors. The range of 
throughput and compression of these machines has exten¬ 
ded so that they now constitute a significant third option. 

Compressors are complex machines and their reliability 
is crucial. It is essential, therefore, to put much effort into 
the specification of the machine and to liaise with the 
manufacturer. It is equally necessary to maintain high 
standards in the operation of compressors. Some general 
features of compressors which are important are (1) lubri¬ 
cation, (2) protection, (3) isolation, (4) purging, (5) liquid 
slugs, (6) housekeeping and (7) observation. 

The lubrication systems are an integral part of the com¬ 
pressor. It is essential for them to he well engineered and 
reliable if they are not to be a weak link. 

Compressors are provided with protective devices such 
as pressure relief valves and pressure, temperature and 
vibration measuring instruments which activate alarms 
and trips. These are particularly important instruments 
and they should be reliable. 

There need to be arrangements for the isolation of the 
compressor. Isolation may be by a single block valve and 
blind or by double block and bleed valves. It may also be 
appropriate to have an emergency isolation valve on the 
compressor suction. 

Facilities should be provided to allow the compressor to 
be purged. A permanent purge connection is often con¬ 
sidered undesirable because of the hazard of reverse flow 
from the compressor into the purge gas main. If a perma¬ 
nent connection is installed, it should be shut off when not 
in use by a blind. 

A slug of liquid entering a compressor can be as 
destructive as a lump of metal. It is important, therefore, 
for the system to be designed so that this does not happen. 
It is also necessary before start-up to check that there is no 
liquid in the inlet or interstage piping, intercoolers, knock¬ 
out drums or pulsation bottles. 

A high standard of housekeeping around compressors is 
very desirable. Leaks of oil or water should be eliminated 
and cleaned up promptly. 

The process operators should, and usually do, learn to 
detect changes in external appearance, noise and vibration 
as well as in the pressure and temperature measurements. 
This monitoring by the operators often gives early detec¬ 
tion of malfunction and allows corrective action to be taken 
in time. For large compressors, however, it is now usual to 
monitor condition and performance using instrumentation. 
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It is essential to have the highest standard of main¬ 
tenance on compressors. The maintenance methods need to 
be thought out thoroughly and the maintenance personnel 
well trained in them. The conditions under which the 
maintenance is done should be suitable both with respect to 
weather and to cleanliness. 

Prime movers for compressors include electric motors, 
turbines and gas engines. 

12.10.2 Reciprocating compressors 
Reciprocating compressors are utilized for high compres¬ 
sions. They have long been the machines used for com¬ 
pression to the high pressures required in ammonia plants 
and on offshore platforms. Accounts of reciprocating com¬ 
pressors are given by Whittaker (1975), Barnes (1976), 
Messer (1979) and Woollat (1993). Relevant standards are 
BS 7322:1990 Specification for the Design and Construction 
of Reciprocating Type Compressors for the Process Industry 
and API Std 618:1986 Reciprocating Compressors for Gen¬ 
eral Refinery Services. 

Reciprocating compressors can be provided with capa¬ 
city control, or turndown, by the use of volume pockets and 
by drive speed control. Some principal malfunctions on 
reciprocating compressors are (1) valve leakage, (2) cylin¬ 
der/piston scoring, (3) piston ring leakage, (4) gasket fail¬ 
ure, (5) tail rod failure, and (6) vibration, as well as the 
general compressor failures such as those caused by liquid 
slugs or loss of lubricating oil or cooling water. 

Leakage of the suction or discharge valves is one of the 
commonest failures. There are a number of symptoms of 
valve malfunction. The valve may become unusually hot, 
the cylinder capacity may fall, the discharge temperature 
may rise and the interstage pressures may be abnormal. 
The suction pressure may rise and the discharge pressure 
fall unless automatically controlled. 

On some machines, there is nothing to prevent a suction 
valve being fitted on the discharge, or vice versa, by mis¬ 
take. If this happens, it is possible to create very high 
pressures in the cylinder, particularly the high pressure 
cylinder, and so cause failure of the cylinder, the piston or 
the drive system. Preferably, this feature should be desi¬ 
gned out. Where this is not the case, there should be pro¬ 
cedures to minimize the probability of error. 

The piston rod in high pressure cylinders is sometimes 
balanced by a tail rod on the other side of the piston. There 
have been some serious accidents in which the tail rod has 
broken off and flown out like a projectile. There should be a 
‘catcher’ of sufficient strength to prevent escape of the tail 
rod if it does break. Tail rods are frequently surface hard¬ 
ened and it is important for them to be free of surface 
cracks. They should be regularly inspected. A tail rod fail¬ 
ure allows the escape of high pressure gas. 

The reciprocating movement of the piston inevitably 
causes some degree of vibration. This vibration may be 
transmitted to, and cause failures in, the process pipework. 
Small auxiliary piping on the machine tends to be particu¬ 
larly vulnerable to fracture from this vibration. It should be 
anchored to reduce vibration and inspected regularly. 

Changes in the discharge temperature are often a sign of 
malfunction on a reciprocating compressor. High discharge 
temperature may be associated with valve failure, piston 
ring leakage, increased compression ratio, gas composition 
change or loss of cooling water. 

On air compressors lubricated with oil, a high discharge 
temperature can result in an explosion. Such air compressor 


explosions, and the discharge temperature limits 
necessary to avoid them, are discussed in Chapter 17. Some 
compressors are required to produce compressed air which 
is free of oil. It is very desirable, for example, that instru¬ 
ment air be oil-free. Carbon ring compressors are often 
used for this purpose. 

The reciprocating compressors were one of the potential 
sources of the gas leak investigated in the Piper Alpha 
Inquiry (Cullen, 1990). The questions of the tolerance of 
such machines to ingestion of liquid slugs and of the bolt 
tightening practices used were considered in evidence by 
Bett (1989). 

12.10.3 Centrifugal compressors 

Centrifugal compressors are the main workhorse machines in 
the process industries. They can be built for very high 
throughputs. Although the compression obtained has been 
lower than that given by reciprocating machines, the range of 
pressures attainable has gradually been extended. As men¬ 
tioned, centrifugal compressors are used for the main duties 
on ethylene plants, both for process gas and for refrigeration. 

Accounts of centrifugal compressors are given by 
Rehrig (1981), H. Davis (1983) and Sayyed (1985). A relevant 
standard is API Std 617:1988 Centrifugal Compressors for 
General Refinery Services. 

Centrifugal compressors have relatively limited turn¬ 
down. On centrifugal compressors some of the main mal¬ 
functions are (1) rotor or shaft failure, (2) bearing failure, 
(3) vibration and (4) surge, as well as the general com¬ 
pressor failures mentioned earlier. 

In some duties the rotor suffers relatively little attack, 
but rotors sometimes have flaws or suffer embrittlement or 
debris deposition. Rotors can become unbalanced or dis¬ 
placed axially. Shafts may contain flaws. 

The various kinds of bearing failure are one of the 
commonest faults in centrifugal compressors. Shaft or 
casing misalignment and rotor imbalance are frequent 
causes of bearing failure. 

Vibration can cause damage to parts of the compressor 
itself, such as the bearings. It may also be transmitted to 
and induce failure in the pipework. 

Surging can cause serious damage on a centrifugal 
compressor. Surge is a condition which occurs when the 
machine is operating on too low a load, generally in the 
range 50-85% of normal capacity, which gives rise to vio¬ 
lent rapid flow changes and vibration. It is usually pre¬ 
vented by automatic controls which detect the near-surge 
condition and bypass gas from the discharge to the suction 
of the compressor. A further discussion of surge control is 
given in Chapter 13. 

12.10.4 Screw compressors 

Screw compressors are positive displacement machines 
with rotary motion, and are also known as ‘helical screw’ or 
‘spiral lobe’ compressors. They are relatively simple and 
low in capital cost. They have gradually extended their 
range of application to emerge as a third force in process 
industry compression. They are now in widespread use for 
lower compression and refrigeration duties. 

Accounts of screw compressors are given by B.C. Price 
(1991) and Bloch and Noack (1992). A relevant standard is 
API Std 619:1985 Rotary Type Positive Displacement Com¬ 
pressors for General Refinery Services. 

The original screw compressors were oil-free, or dry, 
machines. They ran at high speed to minimize internal gas 
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bypassing and were very noisy In the 1950s, oil-injected 
machines came in and found application in natural gas 
compression and refrigeration. 

Capacity control on screw compressors is effected by the 
use of a slide valve which moves axially along the housing. 
They have good turndown, being able to operate at loads as 
low as 10% of the normal throughput. Another feature of 
screw compressors is that they can tolerate relatively large 
changes in suction pressure, a characteristic useful in 
refrigeration duties. 

Screw compressors have the advantage over reciprocat¬ 
ing compressors that they require no suction or discharge 
valves. By comparison with centrifugal compressors, the 
spares problem with screw compressors tends to he less 
severe. Since screw compressors are designed for oil-injec¬ 
tion, they have some tolerance to a liquid slug, although 
continuous liquid slugging can cause problems. 

A large proportion of the heat of compression in a screw 
compressor is absorbed by the oil. This characteristic may 
be advantageous if it is desirable to avoid high gas com¬ 
pression temperatures, as in cases where the gas may 
polymerize or explode if overheated. 

12.10.5 Gas engines 

Gas engines are used to drive compressors. Some principal 
failures which occur are explosions of (1) starting air line, 
(2) fuel line and (3) crankcase. A number of explosions have 
occurred in the starting line to gas engines. Generally, 
these have been the result of leakage from the power cylin¬ 
der through a defective NRV Preventive measures include 
regular inspection and maintenance of the NRV on the 
starting line, elimination of oil from this line and venting of 
the header when the engine is in normal operation. 

When the engine is shut-down, it is desirable that the fuel 
be shut off also. If this is not done, fuel may collect in the 
engine and the exhaust system, and may explode when 
the engine is restarted. There have been a number of 
explosions of combustible mixtures of oil or gas and air in 
crankcases during operation. Crankcase explosions may be 
minimized by ventilating the crankcase or purging it with 
inert gas and fitting an explosion relief device. A further 
discussion of crankcase explosions is given in Chapter 17. 

12.10.6 Process pumps 

Most process pumps are centrifugal machines, although 
reciprocating machines are used in some cases. Where the 
application is severe and/or critical, a degree of redun¬ 
dancy may be provided, using one or more standby pumps 
or using several pumps operating at less than full capacity. 
Thus, for example, the equipment to perform the duty of 
a single pump may be one pump operating at 100% 
throughput and a similar pump on stand-by or two pumps 
each rated for 100% capacity, but both operating at 50% 
throughput. Diversity of the power supply may also he 
provided using as drives steam turbines as well as electric 
motors, thus reducing dependence on electrical power. 

If a stand-by pump is provided, it is necessary to ensure 
that it can be started up rapidly and dependably. The relia¬ 
bility of the pump set can be seriously degraded by pump 
changeover failure. The arrangements for pump shut-down 
also need to be reliable. This is particularly the case where 
there is a potential weak point in the discharge piping such 
as a flexible hose at a loading facility. 

As described earlier, it will often he appropriate to install 
an emergency isolation valve between a pump and its feed 


vessel. It is good practice to group together controls for 
both items. 

12.10.7 Centrifugal pumps 

The principal malfunctions on centrifugal process 
pumps are: 

(1) bearing failure; 

(2) gland/seal failure; 

(3) maloperation damage 

(a) cavitation, 

(b) deadheading, 

(c) dry running. 

The most common pump faults are failures of bearings 
or of glands or seals. A common cause of failure is shaft 
misalignment. Also, a bearing failure can induce a gland or 
seal failure. If seal failure is particularly undesirable, 
a type of pump may be used which has a more reliable 
sealing arrangement. Such pumps include: 

(1) pumps with mechanical seals 

(a) single mechanical seals, 

(b) double mechanical seals; 

(2) seal-less pumps. 

The pump sealing arrangements should both minimize 
fugitive emissions and have a low probability of cata¬ 
strophic failure. Gland seals and single mechanical seals 
leak to some degree. Leaks may be minimized by the use of 
double mechanical seals or of seal-less pumps. As a pre¬ 
caution against catastrophic failure, use may be made of a 
double mechanical seal with monitoring of the atmosphere 
between the two seals. Another arrangement with the same 
purpose is a single mechanical seal with a packing gland 
backup. 

Seal-less pumps are also referred to as ‘glandless pumps’ 
or ‘canned pumps’. In a canned pump, the impeller of the 
pump and the rotor of the motor are mounted on an integral 
shaft, the rotor and stator being encased, or canned, so that 
the process fluid can circulate in the space which is nor¬ 
mally the air gap of the motor. The bearings are lubricated 
by the process fluid. Pumps with mechanical seals and 
seal-less pumps are less liable to leakage, but are also more 
expensive. 

Pumps are particularly liable to be damaged by mal¬ 
operation. Cavitation, deadheading and dry running can 
have destructive effects and failure can be catastrophic. 
Not infrequently, pumps are allowed to run whilst cavitat- 
ing. Cavitation occurs if the liquid is close to its boiling 
point and involves incipient vaporization in the pump, the 
bubbles formed collapsing on the pump impeller due to the 
pressure induced condensation. This causes pitting and, 
eventually, more serious damage to the impeller, and can be 
very destructive. It is avoided by provision of adequate net 
positive suction head. In order to ensure this it is helpful to 
keep the suction lines to the pump short. Another measure 
which may be taken is the provision of a bypass. 

Deadheading involves pumping against a closed outlet, 
or possibly a closed outlet with a closed inlet also. 
The pump may then generate enough heat and/or pressure 
to rupture. Cases have occurred of a runaway reaction in 
the pump or a reaction between the pump material and the 
fluid. Although avoidance of deadheading is principally an 
operations matter, there are countermeasures which can be 
taken in the design. One is a trip system, based on rise in 
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temperature or pressure in the pump. Another is a bypass 
line free of valves from the pump delivery to the feed tank, 
or ‘kickback’ line. 

The provision of bypasses on centrifugal pumps is dis¬ 
cussed by I. Taylor (1987). Apart from boiler feed-water 
pumps, centrifugal pumps have traditionally not been 
equipped with a bypass. Over the last 20 years, however, 
this has changed. It remains true that most centrifugal 
pumps do not need a bypass. In order to decide whether one 
is needed, it is necessary to establish the expected fre¬ 
quency and extent of low flow operation, including shut-off 
of a downstream control valve, and the extent of any hazard 
if failure occurs. Centrifugal pumps can generally tolerate 
‘1-min’ periods of low flow immediately after start-up. The 
cases where bypasses are required tend to be those invol¬ 
ving pumps which are of large size, high horsepower and 
high head, and are in continuous low flow operation. The 
author gives some 10 reasons for installing a bypass, the 
two principal ones being to prevent excessive tempera¬ 
ture rise and to avoid unstable flow conditions. For pump 
thermal control a bypass flow of 10% is generally sufficient. 

Taylor discusses the net positive suction head (NPSH) 
required to prevent Cavitation. In the 1960s and the early 
1970s a spate of problems occurred on high head and high 
horsepower pumps, involving excessive vibration and pul¬ 
sation at low flows. Work by Minami etal. (1960) and others 
showed that, whereas traditionally a 3% reduction of first 
stage head had been taken as an indication of impairment 
of pump performance by cavitation due to lack of NPSH, at 
low flows incipient cavitation can occur even at a much 
higher suction head. In fact, the NSPH required to suppress 
‘low flow’ cavitation in such cases could be two to five times 
as much as the conventional figure. Subsequently, Fraser 
(1981) presented a method of estimating the minimum con¬ 
tinuous flow based on the suction specific speed index 
number iV ss . 

Incorrect design of a bypass, however, can itself be 
a cause of failure at pumps. Taylor recommends that, with 
certain exceptions, an automatic bypass should branch off 
on each pump upstream of the first valve, whether this be 
an isolation valve, NRVor control valve. Whilst it is true that 
in many cases involving two motor driven pumps, a com¬ 
mon bypass has often been satisfactory, there are two dan¬ 
gers. One is that if one pump stops or trips out and the other, 
on stand-by, cannot be started up, the bypass opens and 
connects the high pressure of the delivery side to the suc¬ 
tion side. The other danger is that if both pumps are run¬ 
ning but with one at a higher speed, perhaps because one is 
driven by a motor and the other by a steam turbine, the 
difference in speed may be sufficient to hold closed the NRV 
valve of the lower speed pump, so that it overheats. 

Pumps are sometimes allowed to run completely dry, 
often due to loss of head in a feed tank. Under these condi¬ 
tions the pump can be wrecked very quickly. Pumps which 
are not operating can suffer damage due to vibration of the 
plant, which causes ‘brinelling’ at one particular point. Such 
pumps may be turned over periodically to prevent this. 

12.10.8 Positive displacement pumps 

Positive displacement pumps are less common in process 
plant than are centrifugal pumps, and, apart from metering 
applications, are used mainly for high pressure work. 
In particular, reciprocating pumps are used to obtain high 
pressures. The discharge side of a positive displacement 
pump requires protection against overpressure. The usual 


arrangement is the provision of a pressure relief valve with 
its discharge returned to the suction side. 

12.11 Insulation 

Another element of the pressure system on process plants is 
the insulation. Insulation is employed to control heat 
transfer both in normal operation and in fire conditions. It 
has more implications for safety than might at first appear. 
Accounts of insulation are given in Thermal Insulation 
(Malloy, 1969), in the CCPS Engineering Design Guidelines 
(1993/13) and by Britton (1991), Britton and Clem (1991), 
Irwin (1991a,b), McMarlin and Gerrish (1992), Reddi (1992) 
and Gamboa (1993). 

There are two basic types of insulation: thermal insula¬ 
tion and fire insulation. There is potential for confusion in 
that many types of thermal insulation have fire-resistant 
properties. Thermal insulation is used to (1) reduce heat 
loss from plant operating at temperatures above ambient, 

(2) reduce heat gain from plant at temperatures below 
ambient, (3) protect personnel from hot or cold surfaces 
on the plant and (4) attenuate sound from the plant. Two 
particular reasons for reducing heat loss are to prevent 
(1) freezing of liquid and (2) condensation of vapour. 

12.11.1 Safety aspects of insulation 

Some of the principal safety aspects of insulation are (1) 
corrosion beneath insulation, (2) self-heating in insulation, 

(3) insulation against fire and (4) effect on the process of 
inadequacies, defects or failures of insulation. Corrosion 
beneath insulation is considered in Section 21.11.4, self¬ 
heating in insulation in Section 12.11.6, fire insulation in 
Section 12.11.7 and fire properties of thermal insulation in 
Section 12.11.8. The effects on process or storage of defects 
in insulation depend on the particular case, but may 
include hazards from freezing, condensation, rollover, etc. 

12.11.2 Materials for thermal insulation 

The thermal conductivity is by no means the sole criterion 
in selecting an insulation. Materials with similar thermal 
conductivities may differ widely in their other relevant 
properties. Categories of non-combustible insulation 
material are (1) calcium silicate, (2) expanded perlite, (3) 
expanded vermiculite, (4) mineral fibre, and (5) cellular 
glass. 

Some properties of thermal insulation which are impor¬ 
tant in the present context, in addition to its thermal con¬ 
ductivity are its characteristics in respect of fire 
resistance, liquid absorption, fabrication, durability and 
damage resistance. The liquid absorptivity and fire resis¬ 
tance of insulation are considered in Sections 12.11.3 and 
12.11.8, respectively. 

The insulation should provide complete cover of the 
areas of the equipment which it is intended to insulate. 
Properties which bear on this are dimensional stability and 
shrinkage. Furthermore, it should be sufficiently easy to 
fabricate that gaps do not occur as a result of fabrication 
difficulties. Insulation is often subject to conditions which 
lead to its being crushed or torn, damage from feet being 
quite common. Vibration may lead to degradation of short- 
fibre insulation. 

12.11.3 Absorption of liquids in insulation 

An important property of an insulation is the extent to 
which it retains liquid that it already contains or that leaks 
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into it.This property is relevant to the insulation in respect 
of its (1) thermal performance, (2) mechanical performance 
and (3) weight, and to (4) corrosion beneath the insulation 
and (5) self-heating in the insulation. 

Water absorption is greatest for calcium silicate and least 
for cellular glass, whilst for the other types it is variable, 
depending in part on any added water repellent. Water may 
enter the insulation as rain or washing water or in other 
ways such as a steam leak from a trace heating system. 
Water present in insulation can cause a marked increase in 
the effective thermal conductivity of the latter, as spaces 
which should be filled with air become filled with water, 
with a thermal conductivity more than 20 times that of air. 
Water also has the potential to cause disruption of the 
insulation, a typical situation being that which occurs 
when water freezes to ice and then melts. Since some insu¬ 
lation materials can absorb twice their mass in liquid, 
water absorption can cause a significant increase in the 
weight of the insulated system. 

Another effect of water is to cause external corrosion of 
the equipment beneath the insulation, as discussed in 
Section 12.11.4. 

With some insulations the moisture can be driven out 
and thermal performance restored, but with others this is 
not so. Calcium silicate, which has a high propensity to 
absorb water, falls in this latter group. 

Process liquids may enter from pipework as may heat 
transfer fluids. Possible sources of in-leak are flanges and 
drain and sample points. Some liquids react with the binder 
in the insulation and promote its disintegration. Flammable 
liquid entering insulation can give rise to self-heating, as 
described in Section 12.11.6. 

12.11.4 External corrosion beneath insulation 

Factors which determine the extent of external corrosion 
beneath insulation include (1) the insulation material, (2) 
the equipment material, (3) the equipment configuration, 
(4) the equipment coating, (5) the equipment stress, (6) the 
service temperature, (7) any temperature transients and 
(8) the climate and location. 

One important factor governing external corrosion is the 
insulation material. An insulation which absorbs a large 
amount of water is likely to cause increased corrosion. One 
which contains chloride is liable to cause corrosion of 
stainless steel. The extent to which water is excluded by 
efficient cladding is another significant factor in external 
corrosion. 

The material of construction of the equipment insulated 
is another factor. In particular, stainless steel is prone 
to corrosion by chloride in the insulation. A further factor 
is the equipment configuration. There are a number of 
equipment features where corrosion is especially likely to 
occur. On a vessel these might include nozzles, manholes, 
supports, brackets, lifting lugs and small bore and instru¬ 
mentation piping. There are also features such as flanges 
and drain and sample points which may allow entry of 
liquids into the insulation. The extent of external corro¬ 
sion under insulation also depends on the degree of pro¬ 
tection afforded by any coating such as paint. External 
corrosion may be increased by residual stress in the 
equipment. This is a factor particularly in the stress 
corrosion cracking of stainless steel. 

External corrosion under insulation occurs mainly on 
equipment operating in the range -5 to 105°C, and espe¬ 
cially in the range 60—80°C. At lower temperatures the 


reaction rate is slower, whilst at higher temperatures water 
tends to be driven off. Much equipment is subject to tem¬ 
perature transients, which can increase external corrosion. 
These may be major changes occurring during the start-up 
and shut-down of high or low temperature plants, or they 
may take the form of temperature cycling. High plant tem¬ 
peratures can cause concentration of salts which then cause 
severe corrosion when rewetted. 

Corrosion occurs on low temperature plant at thawing 
zones which tend to remain wet and corrosive. 

External corrosion can be aggravated by the presence of 
salt, as at a coastal location, especially in combination with 
water precipitating, say, from cooling towers, or conden¬ 
sing, say, from low temperature plant. Pollack and Steely 
(1990) have described a case in which a large steel column 
had to be replaced due to corrosion underneath the 
insulation. 

One of the proposals put to the Piper Alpha Inquiry 
(Cullen, 1990) was that gas risers on production platforms 
should be provided with passive fire protection in the form 
of lagging. However, the Inquiry heard evidence that there 
were also potential problems with this approach - a riser 
could be put at risk by corrosion beneath the lagging. 
It made no recommendation on the fire insulation of risers. 

It is also convenient to mention at this point the tendency 
of some insulation to cause abrasive wear of equipment. 

12.11.5 External corrosion beneath insulation: 
protective measures 

Measures to prevent external corrosion under insulation 
relate broadly to (1) the insulation material, (2) the cladding, 
(3) the equipment coating and (4) the equipment design 
features. The insulation material should match the equip¬ 
ment to be insulated. For example, an insulation for stain¬ 
less steel should contain minimal amounts of chloride. The 
insulation should be one with low water content and 
absorption capacity. 

The insulation should be designed to exclude water. It 
should be provided with weatherproof cladding. This 
should permit water entering to be drained and water in the 
insulation to vaporize and exit when the insulation is 
heated. The equipment should be protected by coating with 
paint or other suitable covering. 

The design should assist inspection for external corro¬ 
sion. Inspection ports are available which are specifically 
designed for this purpose. With regard to abrasive wear of 
the equipment, there are available anti-abrasive coatings 
which can be used to reduce this. 

12.11.6 Self-heating in insulation 

Another insulation issue related to fire is self-heating in 
insulation soaked with a flammable liquid. Above a critical 
temperature, which depends on the liquid-substrate sys¬ 
tem and on the geometry, self-heating initiates and smoul¬ 
dering occurs, limited both by heat transfer from the 
combustion zone and mass transfer of oxygen into the zone. 
The explosive destruction of an ethylene oxide column at 
Antwerp in 1989 was found to be due to self-heating of 
a leak of the fluid into the insulation (Case History A122). 

Accounts of self-heating in insulation are given by 
Gugan (1974a), Britton (1991) and Britton and Clem (1991). 
The latter authors discuss the spontaneous ignition 
temperature (SIT) of liquid in insulation. Values of the 
SIT range from above 180°C down to near ambient 
temperature. 
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Precautions against self-heating include (1) use of a non- 
porous insulation, (2) exclusion of flammable liquids, and 
(3) use of a geometry less favourable to its occurrence. One 
non-porous insulation is cellular glass. However, its fire 
resistance properties leave something to be desired. Meas¬ 
ures for the exclusion of flammable liquids have been dis¬ 
cussed in Section 12.11.3. Both self-heating in general and 
lagging fires in particular are discussed in more detail in 
Chapter 16. 


12.11.7 Fire insulation 

Fire insulation proper is provided on equipment which 
requires fire protection but not thermal insulation. For fire 
insulation use is made of material which is generally 
cementitious, such as vermiculite cement. A further dis¬ 
cussion of fire insulation, including criteria and tests, is 
given in Chapter 16. 


12.11.8 Fire performance of thermal insulation 

On equipment which does require thermal insulation, fire 
protection may be provided by a fire resistant thermal 
insulation system. This phrasing is used advisedly, since 
the effectiveness of the protection is a function of the whole 
system rather than of the insulation alone. 

From the fire protection viewpoint, the ideal thermal 
insulation is one which does not burn or melt and is non¬ 
absorbent. To the extent that it does undergo combustion, it 
should not give off toxic fumes. Some insulating materials 
such as polyisocyanurate foam are not suitable. The main 
categories of non-combustible insulation are listed in 
Section 12.11.2. 

Standard tests of fire properties such as those for flame 
spread and smoke development are applicable to the insu¬ 
lation materials. There are also standard fire tests such as 
ASTM E-119 and other tests which seek to simulate more 
closely hydrocarbon fires. Tests for the insulation material 
itself and for the insulation system are discussed in the 
CCPS Guidelines and by Britton and Clem (1991). A review 
of insulation materials for fire protection has been given by 
Wright and Fryer (1982). 

The insulation needs to be protected against the weather. 
Methods of weatherproofing include the use of caulking, of 
mastic or of metal jacketing. Metal jacketing is to be pre¬ 
ferred. Stainless steel provides a quality jacket, with gal¬ 
vanized steel being a less expensive alternative. There is 
some experimental evidence of good fire performance of 
galvanized steel jackets, but it is uncertain how far this can 
be generalized. Aluminium jackets melt on exposure to fire, 
in some cases within minutes. 

The jacket should have points through which any water 
entering can drain away and should allow for the egress of 
any water vaporized when the insulation is heated. In a fire 
the insulation system may be subject to quite severe con¬ 
ditions, including impingement by flame and/or water jets. 
These need to be borne in mind in the design. 

Britton and Clem (1991) describe the measures used 
in Union Carbide for certain situations where fire insula¬ 
tion is regarded as particularly critical. One such case is 
fire insulation of equipment handling reactive chemicals. 
An example of such a chemical is acetylene. For such reac¬ 
tive chemicals a double layer of insulation is used with 
staggered joints. Stainless steel is specified for the metal 
jacketing. 


12.11.9 Personnel protection by insulation 

One function of thermal insulation is to prevent injury to 
personnel. Hazard exists not only on high temperature 
plants but also on those operating at low temperatures 
which can cause ‘cold burns’. The usual method of protec¬ 
tion is to make the insulation sufficiently thick to prevent 
injury; For high temperatures, a criterion commonly used is 
that the external surface of the insulation should not 
exceed 60°C. Britton and Clem (1991) discuss the effect on 
the outer surface temperature of the insulation of its emis- 
sivity and absorptivity. An alternative means of protecting 
personnel from hot or cold equipment is the use of guards to 
prevent access to the hazardous surface. 


12.11.10 Design of insulation systems 

As already emphasized, design must address the total 
insulation system rather than just the insulation itself. It 
needs to have regard to the several goals of thermal insu¬ 
lation, fire protection and personnel protection and to the 
avoidance of corrosion beneath the insulation, self-heating 
and hazardous effects on the process. It is likely to involve a 
number of trade-offs. Attention should be paid to any 
special situations. These include, as discussed above, the 
insulation of stainless steel equipment and of equipment 
handling reactive chemicals. 

Some of the errors commonly made in insulation, not all 
in design, are rehearsed by Irwin (1991a,b). They include (1) 
using the wrong insulation material, (2) installing the 
wrong thickness, (3) struggling with difficult calculations, 
(4) specifying the wrong thickness for jacketing, (5) laying 
insulation over jacketing, (6) poor workmanship, (7) hiding 
damage and (8) no insulation at all. 


12.12 Overpressure Protection 

Pressure systems need to be provided with protection 
against failure, particularly from overpressure. Standards 
and codes which deal with overpressure include: BS 5500: 
2003; the ASME Boiler and Pressure Vessel Code 2001; the 
ASME B31 Code for Pressure Piping , particularly B31.3: 
2002 Process Piping ; API RP 520: 2000 Sizing, Selection, 
and Installation of Pressure-Relieving Devices in Refineries', 
API RP 521:1997 Guide for Pressure-Relieving and Depres¬ 
suring Systems', and API Std 2000: 1998 Venting Atmo¬ 
spheric and Low-Pressure Storage Tanks. 

Accounts of pressure relief include those given in Relief 
Systems Handbook (Parry, 1992) (the IChemE Relief Sys¬ 
tems Guide), Guidelines for Pressure Relief and Effluent 
Handling Systems, (CCPS, 1998/nn) (the CCPS Guidelines 
for PRS), and by Isaacs (1971), Fitt (1974), Duxbury (1976), 
Crawley and Scott (1984), A. Moore (1984), Cunningham 
(1985), Tomfohrde (1985), Crooks (1989), Duckworth and 
McGregor (1989), and Parry (1989). 

The overpressure protection considered here applies to 
situations in which the pressure rise is relatively gradual. 
Protection against explosion overpressure is treated in 
Chapter 17. A number of equations given in the standards 
and codes are quoted in the following sections. Particular 
symbols may have different meanings in different equa¬ 
tions, but in all cases the symbols are fully defined with the 
equation and in the notation at the end of the chapter. 
Selected references on overpressure protection, pressure 
relief and blowdown are given in Table 12.10. 
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Table 12.10 Selected references on overpressure pro¬ 
tection, pressure relief and blowdown 


Overpressure protection 

Sylvander and Katz (1948); C.G.Weber (1955); Conison 
(1960,1963); Block (1962); Jenett (1963a-c); Loudon (1963); 
Driskell (1964,1976); Ruleo (1964); Rearick (1969); Warwick 
(1969); Hattiangadi (1970a); Heitner (1970); ICI/RoSPA 
(1970IS/74);Wittig (1970); Isaacs (1971); Pilborough (1971, 
1989); Fitt (1974,1976b, 1983); Kletz (1974a,d,e, 1989); 
BCISC (1975/1); Whelan and Thomson (1975); Anon. 
(1976m); Duxbury (1976); Henderson and Kletz (1976); Huff 
(1977a, 1988); Jenkins, Kelly and Cobb (1977); Frankland 
(1978); Wia-Bu Cheng and Mah (1976); Richter (1978a,b); 
Sengupta and Staats (1978a,b); IMechE (1979,1984); 

J.S. Parkinson (1979); Sallet (1979a); Anon. (1980 LPB 36, 
p. 1); Chambard (1980); IP (1980 Eur. MCSP Pt 2,1981 MCSP 
Pt 3,1987 MCSP Pt 9); D. Scott (1980,1980 LPB 34,36); 
Gerardu (1981); P.L Jones (1981); Kauders (1980-1984); 
Chen-Hwa Chiu (1982); Doelp and Brian (1982); McKinley 
(1982); Uchiyama (1982); Badami (1983); IMechE (1984/ 81); 
Knox (1984); Middleton and Lloyd (1984); A. Moore (1984); 
Cunningham (1985); Francis and Shackleton (1985); Poole 
(1985);Tomfohrde (1985); Valdes and Svoboda (1985); Politz 
(1988); Crooks (1989); Duckworth and McGregor (1989); 
IChemE (1989/136); Parry (1989,1992); LPGITA (1991LPG 
Code Pt 1); Ridey (1991); Aarebrot and Svenes (1992); Prugh 
(1992b); Cassata, Dasgupta and Gandhi (1993); Nichols 
(1994); Schiappa and Winegardner (1994); Tanner (1994); 
CCPS (1998/nn); BS 5500: 2003 

Fire relief 

Fitt (1974); A.F. Roberts, Cutler and Billinge (1983); 
Grolmes and Epstein (1985); Moodie etcd. (1988); Morris 
(1988b); Wilday (1988); Epstein, Fauske and Hauser (1989): 
Venart (1990b) 

Containment 

Bartknecht (1981a); Wilday (1991) 

Particular equipment 

Gas filled vessels: Heitner, Trautmanis and Morrissey 
(1983a,b) 

Heat exchangers: Case (1970); P.M.M. Brown and France 
(1975); Sumaria etal. (1976); WY. Wong (1992a,b) 

Storage vessels: Kutateladze (1972) 

Offshore: Crawley and Scott (1984) 

Pressure relief valves, liquid relief valves, 
relief pipework 

NRC (Appendix 28 Safety Relief Valves); Burgoyne and 
Wilson (1957); Conison (1960); Missen (1962); Porter (1962); 
Boyle (1967); Rearick (1969); Hattiangadi (1970a); 
Wissmffler (1970); Klaassen (1971); K.Wood (1971); Anon. 
(1972k); G.F. Bright (1972); Beck and Raidl (1973); 
Bodurtha, Palmer and Walsh (1973); API {1974 Refinery 
Inspection Guide Ch. 16,1984 Std 526,1988- RP 520,1990 
RP 521,1991 Std 527); Forrester (1974); Kletz (1974a,d,e, 
19851,1986a,g, 1987J, 1989a); Pasman, Groothuizen and de 
Gooijer (1974); Anon. (1975 LPB 6, p. 12); ASME (1975/ 
130,1983/168); Chlorine Institute (1975 Pamphlet 41,1982 
Pamphlet 39); Schampel and Steen (1975,1976); Anon. 
(1976); Anon. (1976 LPB 10, p. 15); F.E. Anderson (1976); 
Anon. (1977 LPB 17, p. 5); R. Kern (1977f); D. Martin (1977); 
Welsh (1977); Frankland (1978); Sallet (1978,1979a,b, 
1990a-c); Sengupta and Staats (1978a,b); Bourdelon and 
Lai (1979); Coffman and Bernstein (1979); Ezekoye (1979); 


Haupt and Meyer (1979); Moody, Wheeler and Ward (1979); 
Sallet,Weske and Giihler (1979); Semprucci and Holbrook 
(1979); Strong and Baschiere (1979); Wheeler and Moody 
(1979); CGA (1980 S-l.l, S-l.3,1989 S-1.2); Copigneux (1980, 
1982); Crozier (1980,1985); Dockendorff (1980); Mukerji 
(1980); Weighell (1980); O.J. Cox and Weirick (1981); Scully 
(1981); Aird (1982,1983); van Boskirk (1982); AGA (1983/ 
39,1988/58); Heller (1983); Huff (1983); Papa (1983a,b, 
1991); Bradford and Durrett (1984); Brahmbhatt (1984); 

J. A. Fuller (1984); S.F. Harrison (1984); Chester and Phillips 
(1985); Emerson (1985,1988); I.D. Pearce (1985); Sallett and 
Somers (1985); Anon. (1986t); Bayliss (1987); DIERS (1987); 
DnV (1987 RP C202); Maher et al. (1988); Chambers and 
Fisher (1989); Desaedeleere/aZ. (1989); Morley (1989a,b); 
WW.Wong (1989); Anon. (1990 LPB 92, p. 1); Kast (1990 LPB 
95); Gavrila and Sethi (1991); Glinos and Miers (1991); 
Ridey (1991); Zappe (1991); Coker (1992); Lai (1992); Leung 
(1992a); WY. Wong (1992a-c); Bravo and Beatty (1993); W.E. 
Nelson (1993); British Gas (1994 BGES/DAT44); Crombie 
and Green (1994); Hanks (1994); D.W Thompson (1994); BS 
1123:1987—, BS 5500:1991. 

Relief pipework: Duxbury (1976); Friedel and Schmidt 
(1993); S.M.Hall (1993); Perbal (1993) 

Bursting discs 

CGA (S-3); Fire Metal Products Corp. (n.d.); Bonyun (1935, 
1945); Creech (1941); Murphy (1944a,b); Bigham (1958); 
J.FW. Brown (1958); Lowenstein (1958); Luker and Leibson 
(1959); Diss, Karam and Jones (1961); Franks (1961); Block 
(1962); Solter, Fike and Hansen (1963a,b); Ruleo (1964); 
liptak (1965); Myers and Wood (1965); Sestak (1965); 
L.E.Wood (1965); Boyle (1967); Alba (1970); C.R.N. Clark 
(1970); Harmon and Martin (1970); Kayser (1972); Brodie 
(1973); Huff (1973,1977a); Anon. (1975 LPB 6, p. 12); Anon. 
(19761); Zook (1976); Ganapathy (1976); Cockram (1977); 
Anon. (1978 LPB 23, p. 125); Fitzsimmons and Cockram 
(1979); Beese, Organ and Wade (1980); Hoffman, Hansen 
and Doelling (1980); L.Wood (1981); Anon. (1982 LPB 45, 
p. 1,7); Falconer et al. (1982 LPB 45); L.R. Harris (1983a,b); 
Mathews (1983); Phadke (1983); British Gas (1984 TIN20); 
Prickett (1984); Watton and Brodie (1984); Zanetti 
(1984b); Beveridge (1985); Walker (1985); Anon. (1989 LPB 
90, p. 30); Zappe (1991); Brazier (1993); Anon. (1994a) BS 
2915:1990 

Fusible plugs 

Warwick (1969) 

Venting and blowdown 

Rudinger (1959); API (1988- RP 520,1990 RP 521); Grote 
(1967); Klaassen (1971); Craven (1972); Simon and Thomson 
(1972); Fitt (1974,1976b); BCISC (1975/l);Wia-Bu Cheng and 
Mah (1976); Pilz (1977); von Boskirk (1987); Haque etal. 
(1990); Haque, Richardson and Savffle (1992); Haque et al. 
(1992); Perbal (1992); Mahgerefteh, Giri and Wong (1993); 
N.E. Stewart and McVey (1994) 

Vents: Cindric (1985a,b); P. Watts (1985); Burgoyne (1986a); 
P.F. Thorne (1986) 

Depressuring: Chiu (1982); Sonti (1984) 

Relief disposal 

Kneale (1984,1989,1984 LPB 59); Grossel (1986); DnV (1987 
RP C202) 

Trip systems 

Kletz (1974a,d,e); Lawley and Kletz (1975) 
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12.12.1 Requirements for protection 

The statutory requirements for protection of pressure 
vessels and the legislative background to these were out¬ 
lined in Chapter 3. As described in Section 12.1, the prin¬ 
cipal legislation in the United Kingdom covering pressure 
systems is the Pressure Systems and Transportable Gas 
Containers Regulations 1989 (the Pressure Systems 
Regulations), with, for fixed plant, the associated code 
COP 37 Safety of Pressure Systems (HSE, 1990). 

The requirement for protection is given in Regulation 
4(5) which states ‘The pressure system and transportable 
gas container shall be provided with such protective 
devices as may be necessary for preventing danger; and 
any such device designed to release contents shall do so 
safely, so far as is practicable.’ It is also required by 
Regulations 14 and 15 that a permanent outlet to the 
atmosphere, or to a space at atmospheric pressure, be kept 
open and free of obstruction at all times. 

It has been a requirement of the Factories Act 1961 in 
Sections 32,35 and 36 that steam boilers and receivers and 
air receivers have a safety valve to prevent overpressure. 
These sections of the act were revoked by the Pressure 
Systems Regulations 1989. 

Relevant to disposal is the legislation dealing with pol¬ 
lution. The Control of Pollution Act 1974 requires the use of 
best practicable means for preventing emission of noxious 
or offensive substances and for rendering harmless and 
inoffensive any which may be emitted. There is also the 
general duty to provide safe equipment, which is rein¬ 
forced by the Health and Safety at Work, etc. Act 1974. 

The statutory controls are not the only external influence 
to which industry is subject. Provision of protection similar 
to the statutory requirements is normally a condition of 
obtaining insurance for other vessels. 

It is necessary to define both the conditions against 
which protection is required and the nature of the system to 
be protected. PD 5500: 2003 requires that every pressure 
vessel be protected from excessive pressure or vacuum. If 
the source of pressure or temperature, however, is external 
to the vessel and is controlled so that overpressure of the 
vessel cannot occur, then the standard does not require 
the use of a protective device. Thus, overpressure protec¬ 
tion is not required, for example, if the source of pressure is 
a pump which has a maximum delivery pressure less than 
the design pressure of the vessel. 

For a vessel that is subdivided, each compartment should 
be treated as a separate vessel and suitably connected to a 
protective device. On the other hand, PD 5500 states: 
‘Vessels connected together in a system by piping of ade¬ 
quate capacity, free from potential blockages and which 
does not contain any valve that can isolate any vessel may 
be considered as a system of vessels for the application of 
pressure relief.’ The protective device should have adequate 
capacity to prevent overpressure in the face of failure of any 
heating coil or other similar element in the vessel. 

The protective devices envisaged in the standard are 
primarily safety valves and bursting discs complying with 
BS 6759:1984 and BS 2915:1990, respectively, but it also 
allows other devices provided they are suitable and reliable. 
It requires the maintenance of a register of all protective 
devices fitted to the vessel. The standard states ‘Where the 
total capacity of the devices necessary to protect an instal¬ 
lation from overpressure requires appropriate account to be 
taken of operating and fault conditions, the register should 
also include a record of the relevant calculations.’ 


12.12.2 API RP521 

Guidance on protection of plant against overpressure is 
given in API RP 521: 1997. The contents are (1) general, 
(2) causes of overpressure, (3) determination of individual 
relieving rates, (4) selection of disposal systems, (5) dis¬ 
posal systems, and (6) bibliography. The appendices are: A, 
determination of fire relief requirements; B, special system 
design considerations; C, sample calculations for sizing a 
flare stack; and D, typical details and sketches. This is 
supplemented by the information on the relief devices 
themselves given in API RP 520, Part I: 2000, and Part II: 
1994. 


12.12.3 IChemE Relief Systems Guide 

Further guidance is available in the Relief Systems Hand¬ 
book by Parry (1992) (IChemE Relief Systems Guide). The 
contents are (1) introduction, (2) relief devices, (3) deter¬ 
mining the set pressure and bursting pressure, (4) total 
relief systems, (5) vacuum relief, (6) thermal relief, (7) fire 
relief, (8) reliability of relief systems, (9) performance of 
relief systems, (10) installation of relief devices, (11) opera¬ 
tion and maintenance, (12) current and future develop¬ 
ments and (13) concluding remarks. The Guide contains 
some 19 appendices covering the legislation and (1) causes 
of relief situations, (2) relief rates, (3) minimum discharge 
velocity for dispersion, (4) Mach number, (5) atmospheric 
dispersion from a relief, (6) heat radiation at ground level 
from an elevated flare, (7) steam supply for smokeless flare 
operation, (8) flare purge gas velocity, (9) knockout drum 
droplet drag coefficient, (10) ground flares, (11) elevated 
flares, (12) thermal relief rate, (13) classification of liquids 
for thermal relief, (14) reliability data and (15) discharge 
reaction force. The Guide gives a brief summary of eighteen 
pressure relief case histories, classifying them as (1) safety 
valve failures, (2) bursting disc failures or (3) failures of 
containment systems. 

12.12.4 Sources of overpressure 

API RP 521 gives detailed guidance on causes of over¬ 
pressure. The principal events may be summarized 
as follows: (1) connection to a high pressure source, 
(2) disconnection from a low pressure sink, (3) increased 
heat input, (4) decreased heat output, (5) vapour evolution, 
(6) absorbent failure, (7) heat exchanger tube failure, 
(8) expansion of blocked-in liquid, (9) reverse flow, 
(10) fluid transients and (11) plant fire. 

Connection to a high-pressure source can occur if a valve 
is opened in error. Likewise, loss of connection to a low- 
pressure sink can occur if a valve is erroneously closed. 

Increased heat input can occur due to malfunction of 
heating equipment or to chemical reaction. A heat exchan¬ 
ger such as a reboiler when just cleaned may temporarily 
have a high heat transfer capacity. 

Decreased heat output, or loss of cooling, can occur in 
numerous ways. Malfunction of cooling equipment such as 
a heat exchanger is an obvious case. Distillation columns 
particularly can lose cooling in a number of ways. In a 
single column, loss of cooling can occur not only due to 
malfunction of the condenser but also due to loss of reflux 
or of subcooled feed. Where there is a set of columns in 
series, loss of heat input to one column can cause over¬ 
pressure of the next column, due to carry forward of light 
ends in the bottoms from the first column which then over¬ 
load the second column. 
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Overpressure can be caused by admission of water or 
light hydrocarbons to hot oil resulting in rapid evolution of 
vapour. Failure to remove sufficient gas due to loss of flow 
of absorbent can also cause overpressure. Failure of a tube 
in a heat exchanger so that the low-pressure shell is 
exposed to the high-pressure tube fluid can cause over¬ 
pressure. This has been discussed in Section 12.8. Over¬ 
pressure can be caused by expansion of liquid in a section 
of line between two closed block valves. 

A particular case of increased heat input is a fire on the 
plant. In this case the potential heat input is so great that it 
is accorded special treatment, as described in Section 12.14. 
Failure of a pressure raiser and reverse flow from the high- 
pressure discharge to the low-pressure suction can cause 
overpressure of the latter. Fluid transients, such as those 
described in Section 12.7, can be another source of over¬ 
pressure. 

Some of these events may themselves be caused by fail¬ 
ure of a utility such as electrical power to equipment or 
cooling water, or other coolant, or by failure of air or elec¬ 
trical power to instruments. The actions of control loops 
and those of the process operator are further causes. API 
RP 521 gives a table (table 1) of possible utility failures and 
the equipment affected. 

12.12.5 Identification of relief requirements 

An account of the identification of the nature and magni¬ 
tude of the sources of overpressure has been given by Fitt 
(1974), with emphasis on practical interpretation. The first 
step in dealing with hazards is to ensure that they have 
been fully identified. The overview of sources of over¬ 
pressure presented in API RP 521: 1997 and summarized 
above provides an excellent starting point and ‘check list’ 
for the task of identifying potential overpressure scenarios. 
Hazard identification, which has been described in 
Chapter 8, is an essential part of the design of protection for 
pressure systems. The technique of hazard and operability 
(hazop) studies can be helpful in ensuring that all potential 
overpressure scenarios have been considered. 

Once the hazards have been identified, it is appropriate 
to consider whether measures other than overpressure 
protection are more suitable. Some alternatives are to make 
the plant inherently safer by means such as increasing 
vessel strength or limiting the delivery pressure of pumps. 
It must be emphasized that typical process and safety con¬ 
trols (such a pressure or level alarms or trips), while reduc¬ 
ing the probability of an overpressure scenario, are not 
sufficiently reliable to remove the need for overpressure 
protection by a pressure relief valve, a bursting disc or a 
device with equivalent reliability. 

Full consideration should be given to the action of the 
process operator. He or she is an integral part of the hazard 
situation. It is usually reasonable to place some reliance on 
operator action in averting a hazard, but the extent of such 
reliance depends on such factors as ease of recognition of 
the existence of the hazard, instructions and training for 
dealing with it, and difficulty of and time available for this 
task. The possibility that the operator would do something 
positively harmful has to be allowed for, although this is 
less probable than that he will fail to take some beneficial 
action. Problems associated with action by the process 
operator are discussed in Chapter 14. 

Some hazards may have such a low probability that they 
can be disregarded. The cut-off level is commonly deter¬ 
mined by the consequences of a failure, which in turn 


depend on factors such as the number of people exposed to 
the hazard. Overpressure protection should be considered 
at an early stage in the design so that unnecessarily severe 
demands can be identified and averted, but the main work 
has to be done at a relatively late stage. 

Pressure relief becomes necessary when plant condi¬ 
tions are abnormal. Thus, flow sheet quantities provide 
only a partial guide to the required relief capacities and 
conditions. Some cases discussed by Fitt to illustrate the 
practical application of pressure relief are (1) shut-down 
pumps and compressors, (2) pressure let-down, (3) con¬ 
tinuous distillation columns, (4) isolable equipment, (5) low 
pressure storage tanks, (6) control loop failures, (7) power 
turbines and let-down engines, (8) heat exchanger tube 
bursts, and (9) batch operations. 

For a pump discharging into a receiver, the pressure 
relief valve should pass the volume of fluid that the pump 
could deliver if the feed valve is open and the receiver dis¬ 
charge is blocked. While it is common to assume normal 
operating (i.e. flow sheet) suction conditions, some 
designers assume more conservative conditions, such as 
a suction pressure at alarm or trip value. 

Failure of pressure let-down devices can cause a large 
and sudden rise in downstream pressure, particularly 
where a liquid line is blown down by gas. Therefore, con¬ 
sideration should always be given to making the down¬ 
stream section capable of withstanding the upstream 
pressure. An alternative policy is to size the downstream 
pressure relief device to handle the combination of let- down 
valve and bypass valve both fully open. Neither of these 
valves should be oversized and bypasses should be avoided 
or limited in capacity (e.g. by a reduced trim or installation 
in series with a restriction orifice) wherever practicable. 

On a continuous distillation column, overpressure may 
be created by an increase in heat input. Some causes of 
increased heat input include increase in temperature dif¬ 
ference in the reboiler, loss of cooling, loss of reflux and loss 
of subcooled feed. Loss of cooling is often, but not always, 
the worst case. In some columns, a subcooled feed provides 
as much cooling as the condenser. 

The case of a column with a subcooled feed also provides 
an illustration of the need to consider the action of the 
process operator. If there is a loss of reflux on the column, 
he may well shut off the feed while he tries to re-establish 
normal conditions. This then represents a worse case for 
pressure relief than loss of either reflux or feed alone. 

Pressure relief should be provided between isolations if 
the equipment is subject to pressure from a source of high 
pressure or of process heat and, generally, if the equipment 
can be isolated when the plant is operating and it is in a fire 
zone. Relief need not be provided, however, between isola¬ 
tions if there is no such high pressure or process heat source 
and if either there is no significant fire risk or the equip¬ 
ment cannot be isolated while the plant is on line, there is 
adequate provision of vents and drains between the isola¬ 
tions, and operating and maintenance procedures ensure 
that the segment is drained and vented upon isolation. This 
philosophy applies to all fluids, including steam and 
water. It is particularly applicable to valved spare heat 
exchanger sets. 

Low-pressure storage tanks are capable of withstanding 
only a very low pressure. It is important, therefore, to avoid 
exposing them to high pressure. The problem is discussed 
in Chapter 20 on plant operation and in Chapter 22 on 
storage. 
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Failure in a control loop may occur in the measuring ele¬ 
ment, in the controller, in the control valve or its actuator, in 
the transmission lines or by operator action. The possible 
failures and combinations of failure should be reviewed 
and the worst case considered. In evaluating the relief load 
upon control failure, a credible set of simultaneous occur¬ 
rences must be selected. Is the upstream pressure at the 
normal operating, high-pressure alarm, or high-pressure 
trip value? Should the bypass be assumed fully or partially 
opened when the control failure occurs? In the design of 
new facilities, it is usually assumed that both the control 
valve and the bypass may be fully open, if this constitutes a 
worst case. It need not be assumed that all control valves on 
equipment will fail to danger simultaneously, but neither 
should it be assumed that all control loop actions will be 
favourable. In considering control loops, it should be 
assumed that flow may not be fully controlled by the control 
valve, either because the bypass is open or because the 
controller is on manual setting. 

The system downstream of a power turbine or let-down 
engine is liable to be subjected to the upstream pressure. 
Such machines often have a low resistance to flow when 
stopped. Flow may also occur through an open bypass. The 
pressure relief valve on the downstream system should be 
sized to handle the maximum flow from the combination of 
let-down engine and open bypass. Sentinel ‘relief valves’ 
function merely as mechanical high-pressure alarms; they 
are not intended as, nor are they capable of serving as, a 
means of pressure relief. 

For the bursting of a high-pressure tube in a heat 
exchanger, the pressure relief valve on the low-pressure 
side should be sized to handle the flow from twice the 
cross-sectional area of the tube. If the high-pressure fluid 
is gas or vapour and the low-pressure side contains 
liquid, particular attention must be given to the potential 
for a water-hammer effect as the compressible fluid con¬ 
tacts the incompressible fluid as it flows through the 
rupture. Pressure increase rates in the liquid-filled low- 
pressure side can be very high; for many such scenarios 
designers prefer the high response rate of a bursting 
disc over the relatively slow-opening pressure relief valve 
(IP, 2000). The internal failure of a heat exchanger may 
also bring a hot fluid into direct contact with a highly 
volatile one. Consideration should be given to the potential 
for a greatly increased rate of vaporization upon such 
direct contact. 

Batch operations require special consideration, because 
the conditions change throughout the cycle. 


12.13 Overpressure Protection: Pressure 
Relief Devices 

12.13.1 Pressure relief valves 

Valves for the relief of pressure are referred to by a number 
of names and there is no universally agreed terminology. 
Two names commonly used as generic terms are ‘pressure 
relief valve’ and ‘safety valve’. 

A set of definitions is given in the successive editions of 
API 520. These are very similar to those given in ASME 
documents, primarily PTC 25-2001. These documents use 
‘pressure relief valve’ as the generic term. API RP 520: 
2000 defines it as a pressure relief device designed to 
open and relieve excess pressure and to reclose and 
prevent further flow of fluid after normal conditions have 
been restored. RP 520 proceeds to make the following 


distinctions. A ‘relief valve’ is a spring-loaded pressure 
relief valve actuated by the static pressure upstream of the 
valve. It opens normally in proportion to the increase in 
pressure over the opening pressure. It is used mainly for 
incompressible fluids. A ‘safety valve’ is a spring-loaded 
pressure relief valve actuated by the static pressure 
upstream of the valve and characterized by rapid opening 
or pop action. Normally it is used for compressible fluids. 
A ‘safety relief valve’ is a spring-loaded pressure relief 
valve that can be used as either a safety or a relief valve, 
depending on the application. 

According to the IChemE Relief Systems Guide, the BSI 
has decided that the use of these definitions is impossible 
without ambiguity. The relevant standard, BS 6759:1984, 
describes any mechanical valve designed for the automatic 
relief of pressure as a'safety valve’. Similarly, BS 5500:1990 
refers to ‘safety valve’. This term is also that adopted in the 
Guide. The generic term used here is ‘pressure relief valve’. 

BS 5500 requires that safety valves comply with BS 6759 
Safety Valves. BS 6759 has three parts, the most relevant 
here being BS 6759: Part 3: 1984 Specification for Safety 
Valves for Process Fluids. Part 1:1984 deals with steam and 
hot water and Part 2: 1984 with compressed air or inert 
gases. The installation is required to comply where appro¬ 
priate with these standards and with BS 1123:1961 Safety 
Valves, Gauges and Other Safety Fittings for Air Receivers, 
and Compressed Air Installations, which has one part, 
Part 1:1987 Code of Practice for Installation. 

There are a number of different types of pressure relief 
valve. Three broad categories of valve are (1) the conven¬ 
tional, direct-loaded valve, (2) the balanced valve, and (3) 
the pilot-operated, indirect-loaded valve. 

A conventional pressure relief valve, the simplest type, 
is a spring-loaded valve. The pressure at which the valve 
relieves is affected by the hack pressure. 

The direct-loaded pressure relief valve has a number of 
variants. One is the assisted-opening valve, which has 
power-assisted opening. One use of this type of valve is to 
give depressurization down to a predetermined level. In a 
supplementary-loaded pressure relief valve, an external 
power source is used to impose an additional sealing force, 
which is released automatically when the set pressure is 
reached. This arrangement gives an improved degree of 
leak-tightness. 

A third variant is the pilot-assisted valve, which is a dif¬ 
ferent type from the pilot-operated valve. A pilot-assisted 
valve is a direct-loaded valve in which some three-quarters 
of the load is due to the spring and the rest to the pressure of 
the fluid from the pilot valve. When the set pressure is 
reached, the pilot opens and that part of the load con¬ 
tributed by it is removed. 

A balanced pressure relief valve is one that incorporates 
means of minimizing the effect of back pressure on per¬ 
formance. With this type of valve the back pressure has 
little effect on the pressure at which the valve relieves. 
A balanced relief valve is used to accommodate the back 
pressure in a relief header. 

The principal type of balanced pressure relief valve is 
the balanced bellows valve. The valve incorporates a bel¬ 
lows with an effective area equal to that of the valve seat so 
that it counteracts the effect of back pressure on the set 
pressure. The balanced pressure relief valve also comes in a 
number of variants. They include the balanced piston valve, 
in which the counteracting balance is effected by a piston, 
and the balanced bellows valve with auxiliary piston. 
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A pilot-operated, indirect-loaded pressure relief valve is 
one in which the main valve is combined with and con¬ 
trolled by an auxiliary direct-loaded pressure relief valve. 
The whole load on the main valve is provided by the fluid 
pressure from the pilot valve. When the set pressure is 
reached, the pilot valve opens and releases the loading 
pressure. 

A pilot-operated pressure relief valve may he used where 
the margin between the operating and set pressures is 
narrow or where the set pressure is low. It is also used when 
discharging direct to atmosphere to ensure high discharge 
velocity and hence good jet mixing. The principal draw¬ 
back of a pilot-operated pressure relief valve is that the 
small passages of the pilot valve are liable to become 
blocked if the process fluid is dirty, so that is suitable only 
for relatively clean duties. 

Some pressure relief valves are illustrated in Figure 12.12. 
Figure 12.12(a) shows a conventional pressure relief valve 
and Figure 12.12(b) a pilot-operated pressure relief valve. 
Further accounts of pressure relief valves are given in API 
RP 520 and the IChemE Guide. Each of these documents 
includes diagrams of the various types. 

12.13.2 Bursting discs 

As for reclosing pressure relief devices, there is no 
universally agreed terminology for non-reclosing 
diaphragm-type devices. In API and ASME parlance, such 



devices are ‘rupture disks’. According to the BSI, they are 
‘bursting discs’, which is the term used here. 

The conventional bursting disc is the simple disc illu¬ 
strated in Figure 12.13(a). The disc has its dome with the 
direction of the bursting pressure. Conventional bursting 
discs tend to be very thin. Many are less than 0.05 mm in 
thickness. 

A conventional bursting disc should be carefully instal¬ 
led. Manufacturers provide disc mountings that have a 
number of fool proofing features of which the following are 
typical. The ring holding the disc on the vent side is made 
thicker than the dome in order to protect the latter. The disc 
has an identification tag with full details stamped on. The 
tag neck serves to centre the disc in place and is notched on 
one side so that, if correctly installed, the disc does not seat 
properly and, if not readjusted, will vent at a low pressure. 
Discs with different pressures have pegs located at differ¬ 
ent points so that a disc for one pressure will not fit into a 
holder for a different pressure. Conventional bursting discs 
are normally made of metal, but graphite discs are also 
used. 

Some other types of disc which are used in general 
applications include: 


(1) composite slotted disc; 

(2) reverse buckling disc. 



5 Liner 12 Exhaust tube 

6 Piston 13 Lift adjustment screw 

7 Piston seal 14 Dipper tube 


Figure 12.12 Some typical pressure relief valves: (a) conventional pressure relief valve (Crosby Valve and Engineering 
Company Ltd); (b) pilot-operated relief valve (Anderson Greenwood Company) 
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Figure 12.13 Some typical bursting discs: (a) conventional bursting disc; and (b) reverse buckling bursting disc 


A composite slotted disc is a variation on the conven¬ 
tional disc. It consists of the main disc, which is slotted to 
burst at the rated pressure, and a protective membrane, in 
plastic or metal. The use of slotting allows the disc to be 
made of thicker material so that it is less liable to fatigue, 
while the use of the membrane gives protection against 
corrosion by the process fluid. There are also grooved discs, 
which are less deeply scored. 

A reverse buckling disc has its dome against the direc¬ 
tion of the bursting pressure, as shown in Figure 12.13(b). 
An account of reverse buckling discs is given by Watton and 
Brodie (1984), who list the following types: 

(1) disc that, on reversal, bursts by being sheared either 
radially or circumferentially by serrated cutters 
mounted on the vent side; 

(2) disc with preformed diametral grooves which, on 
reversal, opens at the grooves; 

(3) disc that, on reversal, slips out of the holder; 

(4) disc that, on reversal, shears around the dome. 

The latter type is available in metal or graphite. 

A reverse buckling disc is thicker than a conventional 
disc for the same duty. Watton and Brodie quote for 50 mm 
diameter discs rated for a burst pressure of 20 bar at 20°C 
thicknesses for stainless steel of 0.04 and 0.3 mm for con¬ 
ventional and reverse buckling discs, respectively. The lat¬ 
ter is thus 7.5 times thicker than the former. The greater 
thickness of a reversed buckling disc makes it less liable to 
failure by fatigue, creep or corrosion. 

The reversal time of a reverse buckling disc bursting as 
designed is very short. For 450 mm diameter discs, Watton 
and Brodie quote reversal times of 40 ms at 0.035 bar and 
5 ms at 10 bar. In order for the disc to be cut by the knife 
there needs to be sufficient energy. The disc may fail to 
burst properly if the pressure rise is too slow. If the disc is 
damaged, even by a quite small dent, in the dome, it may 
‘roll through’ and lie on the knife without being cut. The 
disc may then fail to burst at the design burst pressure. 
Furthermore, the knife blades generally must receive rou¬ 
tine sharpening to maintain their cutting edge. For these 
reasons, designers have begun to prefer reverse-buckling 
discs equipped with preformed grooves. 

A reverse-buckling disc should be carefully installed 
and securely mounted. The following fool proofing features 
are typically provided by the manufacturer. The disc is 
preassembled in the holder and pretorqued. The holder is 
provided with a pin to ensure that it is mounted the right 
way up. The screws in the holder are of a special type that 
can require the use of a special tool. Another device to 
prevent the holder being installed the wrong way up is the 
use of a J-bolt. Only when the bolt is in can the holder be 
centred and the flange bolts tightened. This arrangement is 


particularly useful where frequent cleaning of discs to 
remove blockages is necessary. 

In addition to its use as the primary relief device a 
bursting disc may also be used mounted in series below a 
pressure relief valve to protect the latter from corrosion. 
This arrangement is suitable only if the bursting of the disc 
will not cause obstruction of the relief valve, and is effec¬ 
tive only as long as there are no pinhole leaks in the disc. 
A pressure gauge is usually mounted on the space between 
the valve and the disc to detect any rise of pressure due to 
leakage. This ‘tell-tale’ gauge is one of several alternative 
installation details required by ASME Section VIII to 
ensure proper operation of a pressure relief valve/bursting 
disc series combination. 

In a similar arrangement, a bursting disc is sometimes 
installed on the discharge side of a pressure relief valve to 
provide isolation between the valve and a collection system. 
In this arrangement, the burst pressure of the disc is typi¬ 
cally a minimal value, as there is little to no static pressure 
at the discharge of the pressure relief valve. 

There are also available disc assemblies based on the 
reverse buckling principle that give protection against both 
overpressure and underpressure, or vacuum. An arrange¬ 
ment described by Watton and Brodie consists of a reverse 
buckling metal disc perforated with a number of holes and 
sealed with a graphite membrane. If overpressure occurs, 
the metal disc and graphite membrane burst in the normal 
reverse buckling mode; in effect, the system has the char¬ 
acteristics of the metal disc. If underpressure occurs, the 
graphite membrane bursts, acting like a simple domed disc. 

Bursting discs can be made in quite large diameters. 
Manufacturers are able to supply discs up to some 1.2 m. 
There are a number of other applications for which special 
bursting disc systems are available. They include (1) high 
temperature gas relief, (2) general liquid relief, (3) liquid 
relief, (4) pulsating liquid relief and (5) two-way relief. 

12.13.3 Other relief devices 

In addition to pressure relief valves and bursting discs, 
there are a number of other devices that may be used to 
relieve pressure. One such device is the buckling pin device 
(Taylor and Austin, 1992), which is classified by ASME 
Section VIII - along with the bursting disc - as a ‘non¬ 
reclosing’ pressure relief device. In such a device, sanc¬ 
tioned by the ASME under Code Cases 2091 and 2169, a 
pressure-containing member (e.g. a piston) is held closed 
against the system pressure by a thin, typically metal, pin. 
When installed, the pin is held in compression; it has been 
engineered (and tested) to fail when the force exerted upon 
it by the system pressure reaches a specified value. Fol¬ 
lowing an overpressure event, such a device can be restored 
to its closed position by simply sliding the piston back 
against the process and inserting a new pin with the correct 
failure pressure. This convenience is touted relative to the 
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bursting disc, which requires separation offlangesto restore 
the process to operability following an overpressure event. 

Avariety of devices is used to provide overpressure pro¬ 
tection of low-pressure and atmospheric storage tanks. The 
simplest of these devices is the atmospheric vent, typically 
a short pipe. An atmospheric vent is used on atmospheric 
storage tanks where there is minimal hazard from the 
ingress of air or egress of vapour. 

On an atmospheric storage tank where the liquid held is 
more volatile, use is generally made of pressure-vacuum 
valves, which allow the tank to ‘breathe’. Another device 
that can be used to provide pressure relief on low-pressure 
tanks is the liquid seal. Fire relief for an atmospheric 
storage tank may be provided in the form of a weak roof- 
to-shell seam, or rupture seam. For a pressure vessel a 
device that can provide fire relief is the fusible plug, a non¬ 
reclosing device actuated by high temperature. 


12.14 Overpressure Protection: Relief 
System Design 

12.14.1 Location of relief devices 

In some cases, the provision of a pressure relief device on a 
particular kind of equipment is a legal or code requirement. 
An example is the requirement in the Factories Act 1961 for a 
pressure relief device on a steam boiler, steam receiver or air 
receiver. ASME Section VIII states: ‘All pressure vessels... 
shall be provided with pressure relief devices in accordance 
with the requirements’ of the subsequent approximately 
fifteen pages of the code. It must be noted directly that those 
pages include the statement that vessels connected together 
by adequate piping not containing isolation valves may be 
considered as one unit in evaluating the pressure relief 
requirements. But furthermore, in appendix M, it is noted 
that an isolation valve would be permissible in such a col¬ 
lection of vessels if, when isolating one component vessel 
from its protective relief device, the valve also isolated the 
vessel from all source of overpressure. 

The only logical method for determining the required 
location of pressure relief devices is by starting with the 
identification of potential sources of overpressure. This is 
best done for each equipment item in the process unit.When 
this task has been completed, relief devices are then ‘loca¬ 
ted’ on equipment or associated piping in such a way that 
they will be accessible to provide relief for each potential 
overpressure scenario identified. The relief devices should 
be installed not simply to protect the particular points at 
which they are located, but to provide protection for all 
vulnerable points. Generally, a process vessel is provided 
with a pressure relief device, but, as described below, there 
are exceptions, as noted above for section VIII, and dis¬ 
cussed further below for API RP 521. 

Conditions for the protection of several components in a 
pressure system by a single pressure relief device are given 
in API RP 521:1997 in appendix B. Four criteria are given. 
The first is that there should not exist any means for 
blocking in any of the components so protected. The other 
three criteria, given in detail in the code, have to do with the 
set pressure, the accumulation pressure and the operating 
pressure. RP 521 gives an example of a hydrotreater- 
reactor-recycle gas loop system that has a compressor 
and six process vessels/units but is protected by a single 
pressure relief device on the last vessel in the train, and lists 
the conditions for the acceptability of such protection in 
this case. 


12.14.2 Selection of relief devices and systems 

Guidance on the selection of the pressure relief devices to 
be used for a particular duty is given in the IChemE Relief 
Systems Guide. The first decision is whether to make use of 
a bursting disc, either alone or in combination with a pres¬ 
sure relief valve. It advises the use of a bursting disc if there 
is a completely free choice and if this is the more economic 
option or if either (1) the pressure rise is too rapid for a 
pressure relief valve or (2) the process fluid properties 
make a pressure relief valve unsuitable (toxicity, corro¬ 
siveness, blockage-forming components, aggressiveness). 

If a system based on pressure relief valves alone is indi¬ 
cated, this may be a single valve or a set of multiple valves 
in parallel, depending on whether a single valve can pro¬ 
vide the necessary capacity. The principal types of pressure 
relief valve are (1) conventional valves, (2) balanced valves, 
and (3) pilot-operated valves. The characteristics and 
applications of these different valves are described in 
Section 12.13. 

One fundamental factor that affects the choice of relief 
valve type is the sink to which the valve will discharge. 
If this is a relief header and therefore exerts a back pres¬ 
sure, a balanced valve may be indicated. On the other hand, 
if discharge is to atmosphere, a pilot-operated valve may be 
selected for its high discharge velocity. Other factors that 
affect the choice are (1) the margin between operating and 
the set pressure, (2) the required speed of opening and (3) 
the required valve tightness. The first and third cases 
favour a pilot-operated valve. 

If the discharge is into a header where the built-up back 
pressure is expected to exceed 10% of the gauge set pres¬ 
sure, a balanced pressure relief valve is needed, the work¬ 
horse valve being of the balanced bellows type. In this case, 
consideration should be given to the effects of bellows 
failure in altering the set pressure or leaking process fluid 
into the valve bonnet. 

If the system is to incorporate a bursting disc, it is 
necessary to consider whether, following operation of the 
relief, (1) the loss of the plant contents is acceptable and (2) 
the plant can be shut-down to replace the disc. If neither 
is acceptable, a system incorporating a bursting disc in 
series with a pressure relief valve is indicated. If only the 
first is acceptable, use may be made of two bursting disc 
systems in parallel. If both are acceptable, a bursting disc 
system alone suffices. For a bursting disc system, use 
may be made of a single bursting disc or, if the process 
conditions are aggressive, two bursting discs in series. The 
latter case would require installation details as shown in 
Figure 12.14 and as described above in Section 12.13.2 for 
the series combination of a bursting disc and a pressure 
relief valve. 

For a bursting disc/pressure relief valve system, the 
valve may have a bursting disc (1) upstream, (2) down¬ 
stream, or (3) on both sides, depending on whether it is the 
process-side fluid, the discharge-side fluid or both fluids 
that are aggressive. 

The principal types of bursting disc are (1) conventional 
domed disc, (2) reverse domed disc and (3) composite slot¬ 
ted disc; these are discussed in further detail in Section 
12.13.2. Use of the conventional type is suitable provided 
that there is a wide margin, say 30%, between the operat¬ 
ing and design pressures and that the pressure does not 
pulsate. If these conditions are not met, if a long life is 
required or if the disc is to be used in series with a safety 
valve, consideration should be given to the other two types. 



PRESSURE SYSTEM DESIGN 12/51 



Figure 12.14 Some typical bursting disc arrangements: (a) single bursting disc; (b) two bursting discs in series with 
pressure indicator (PI) on intermediate space; (c) two bursting discs in parallel with three-way valve to allow replacement 
without plant shut-down 



Figure 12.15 Some typical pressure relief valve + burst¬ 
bursting disc arrangements: (a) pressure relief valve and 
bursting disc in parallel; and (b) pressure relief valve in 
series with bursting disc upstream and with pressure 
indicator on intermediate space 


12.14.3 Relief device configurations 

Figure 12.14 illustrates some relief configurations based on 
bursting discs only. Figure 12.14(a) shows a single bursting 
disc. Figure 12.14(b) shows two bursting discs in series 
with a pressure indicator on the space between to detect 
pinholes leaks. Figure 12.14(c) shows two bursting disc in 
parallel with a three-way valve. 

Figure 12.15 illustrates some pressure relief valve + 
bursting disc configurations. Figure 12.15(a) shows a 
pressure relief valve and bursting disc in parallel and Fig¬ 
ure 12.15(b) a pressure relief valve with an upstream 
bursting disc to protect against aggressive process condi¬ 
tions. Other arrangements (not shown) are a pressure relief 
valve with a downstream bursting disc to protect against 
aggressive discharge conditions, and one with both 
upstream and downstream bursting discs to protect 
against aggressive conditions on both sides. 

12.14.4 Setting of relief devices 

Once the location of the relief system and the type of system 
to be used have been decided, it is possible to determine the 
setting and capacity of the device. Guidance on the set 
pressure for pressure relief valves and for bursting discs is 
given in the codes. Discussion of this aspect is deferred to 
Sections 12.19 and 12.20, respectively. 

12.14.5 Sizing of relief devices 

Guidance on the sizing of individual pressure relief valves 
in given in API RP 521, which considers in detail the 
assumptions to be made in relation to each of the sources of 
overpressure listed in Section 12.12. The situations treated 


are similar to those discussed in Section 12.12. The 
approach taken is to describe the scenario and to define a 
basis for the determination of the relief capacity, indicating 
whether credits can be taken for particular mitigating fac¬ 
tors and discussing features to be taken into account. The 
account given in Section 12.15 of the treatment of external 
fire illustrates the general approach. An essentially similar 
philosophy is applicable to the sizing of bursting discs. 

12.15 Overpressure Protection: Fire Relief 

The pressure relief requirements just discussed are those 
for relief of conditions that may arise during operation. In 
addition to such operational relief, there is a requirement 
for fire relief.‘Fire relief’refers to an overpressure scenario 
in which flames external to an equipment item heat the 
contained fluid, producing a pressure increase either via 
vaporization of liquid or thermal expansion of gas or 
vapour. Except in storage areas, operational upsets are 
more likely to give rise to a requirement for pressure relief 
than are fires. But fires tend to require a larger pressure 
relief capacity. In cases where fire can affect a number of 
vessels, the requirement for fire relief is very much greater 
than that for operational relief. 

Equipment for which fire relief may be required includes 
atmospheric storage tanks, pressure storage vessels and 
process systems. For pressure vessels there are two distinct 
cases: vessels containing gas, vapor, or supercritical fluids 
only and vessels containing liquids. Guidance on fire relief 
for pressure storage vessels has been given in the succes¬ 
sive editions of API RP 520 and RP 521. In the most recent 
editions of these documents (RP 521: 1997 and RP 520: 
2000), the fire relief guidance appears only inRP 521. There 
are also a number of other codes which give recommenda¬ 
tions on fire relief. A critique of these codes and summary 
of the current situation is given in the IChemE Relief Sys¬ 
tems Guide, as described below. 

The account of fire relief given here is supplemented 
by the further discussion in Chapter 22 of fire relief for 
storage. 

12.15.1 Scenarios for fire relief 

The first step in design for fire relief is to define the sce¬ 
narios for which such relief is to be provided. A discussion 
of this aspect is given by Fitt (1974). The amount of fire 
relief required depends on the surfaces which may be 
exposed to fire. The requirement is greatest for groups of 
process vessels and of storage vessels. If the scenario indi¬ 
cates that the fire would develop slowly and would cause 




2/52 PRESSURE SYSTEM DESIGN 


overpressure only after a long period, say several hours, it 
is sometimes assumed that the fire would be brought under 
control by fire fighting before overpressure occurs. 

12.15.2 Fire protection measures 

Some methods of protection against fire in addition to 
pressure relief are (1) inventory reduction, (2) fire insula¬ 
tion, and (3) water sprays. These alternative protection 
methods have been the subject of recent experimentation 
and recommendations (IP 2002, Salater, Overaa and 
Kjensjord 2002, Bjorn Hekkelstrand and Skulstad 2002; 
Roberts, Medonos and Shirvill 2000). Inventory reduction 
is discussed in the following section. Fire insulation and 
water sprays are discussed in Chapter 16 and fire insulation 
and water sprays for storage vessels in Chapter 22. 

12.15.3 Inventory reduction in fire 

Consideration also needs to be given to measures for lim¬ 
itation of developed pressure and for reduction of inventory 
in fire conditions. One method of limiting the overpressure 
which can develop is vapour depressurization, or blow¬ 
down. Vapour is blown down to a suitable disposal system 
through a depressurization valve which is separate from 
any pressure relief device and which is normally operated 
before the pressure reaches the set pressure of the relief 
device. This reduces the stress on the vessel walls, reducing 
the likelihood of their failure as the fire increases their 
temperature. It also reduces the potential consequences if 
failure should occur. The depressurization valve needs to 
be capable of remote operation. Depressurization systems 
are discussed further in Section 12.23. 

Provision may also be made for the removal of the liquid 
inventory. One reason for doing this is to limit the amount 
of vapour which has to be handled. Another is to limit 
the release of material which could then feed the fire if the 
vessel should fail. The preferred means of removal is the 
normal liquid withdrawal system, but a separate liquid 
pulldown system may be used. However, removal of the 
liquid inventory is not necessarily the best policy. Liquid 
remaining in the vessel provides effective cooling for the 
portion of the walls which it wets. Each case needs to be 
considered on its merits. 

12.15.4 Fire relief of pressure vessels containing 
liquid: API RP 521 

A method for determining of the requirement for fire relief 
of a pressure vessel is given in section 3.15 and appendix A 
of API RP 521:1997. 

API RP 521 gives one treatment for a vessel containing 
liquid and another for a vessel containing only gas, vapor, 
or supercritical fluid when exposed to fire. For the former, it 
is the wetted surface which is effective in generating 
vapour. The code states that the portion of the vessel to be 
considered is that which is wetted by the liquid and which 
is at a height equal to or less than 25 ft (7.6 m) above the 
source of the flame, usually, but not necessarily, the ground 
surface. For the heat absorbed, two cases are considered. 
For the case where there is drainage of flammable liquid 
away from the vessel and fire fighting is prompt, the rela- 

Q = 21000 FA 082 [12.15.1] 

where A is the total wetted surface (ft 2 ), F is the environ¬ 
ment factor and Q is the total heat absorption to the wetted 


surface (BTU/h). For the < 


where these conditions are 


0 = 34500 FA 082 [12.15.2] 

The heat absorbed per unit area q is therefore proportional 
to A -018 , which is termed the ‘area exposure factor’; it 
accounts for the fact that a large vessel is less likely than a 
small one to be completely exposed. 

From Equation 12.15.1 or 12.15.2, the flow of vapour gen¬ 
erated may be obtained and hence the capacity required of 
the pressure relief valve determined. The two important 
parameters of this model, therefore, are the wetted area A 
and the environment factor F. 

For the wetted area, the standard gives guidance (table 4) 
on the degree of fill to be assumed for various vessels, 
including storage vessels, process vessels, distillation col¬ 
umns, etc. 

The environment factor Fis, in principle, a function of a 
number of variables related to fire protection: (1) insulation, 
(2) water application, and (3) depressurizing and emptying 
facilities. The factor F has a value of unity for bare metal 
and 0.3, 0.15, 0.075 and 0.03 for insulations with con¬ 
ductances of 4, 2, 1 and 0.4 BTU/(ft 2 h°F), respectively. A 
full set of values is given in the code (table 5). No credit is 
given by way of reduction of this factor (i.e. Fis unity) for 
depressurizing and emptying facilities or for water sprays 
on a bare vessel. The reason given is that neither of these 
mitigation steps is sufficiently reliable to reduce the relief 
requirement. 

As described below, differences between API RP 521 and 
other codes in respect of fire relief are in large part asso¬ 
ciated with differences in the credit given for fire protection 
by way of the environment factor F 


12.15.5 Fire relief of pressure vessels containing 
no liquid: API RP 521 

For a vessel containing only gas, vapour, or fluid above the 
critical pressure and exposed to fire, API RP 521 gives the 
following simplified method, which in this case gives 
directly the required discharge area of the pressure relief 
valve: 


A=F’A I /P\ 12 [12.15.3] 


0.1406 |"(T W - Pi) 1 ' 25 ] 

C/Q [ 7?®* J 


[12.15.4] 


Ti = T,,(Pi/P„) 


[12.15.5] 


where A is the effective discharge area of the valve (in. 2 ), A! 
is the entire exposed surface area of the vessel (ft 2 ), C is a 
coefficient, F is a parameter, K A is the coefficient of dis¬ 
charge, Pi is the upstream relieving pressure (psia), P, is 
the normal operating pressure (psia), Ti is the upstream 
relieving temperature (°R), T w is the vessel wall tempera¬ 
ture (°R) and T,is the heated fluid’s normal operating tem¬ 
perature (°R). RP 521 states that the recommended 
minimum value of F is 0.01 and when the minimum value is 
unknown, a value of 0.045 should be used. Then, from 
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Equations 12.15.3 and 12.15.4 together with Equation 
12.19.15 given below the relief load is: 

r - 0.1 [12.15.6] 

where M and Z are, respectively, the molecular weight and 
compressibility of the fluid at relief conditions and JFis the 
required mass flow (lb/h). 

This simple method is based on the assumption that the 
gas behaves as an ideal gas, that the vessel is uninsulated 
and has negligible mass, that the gas temperature does not 
change and that the vessel wall temperature does not reach 
its rupture value. The document states that these assump¬ 
tions should be reviewed and, if necessary, use made of 
a more rigorous method, on which it gives some further 
guidance. 

It must be emphasized that the heat flux modelling used 
in the fire relief methods described in API RP 521: 1997 
are based on empirical observations of heat flux to pressure 
vessels from fires of pools of flammable liquids. Therefore, 
the heat flux correlations above are not appropriate for 
fire scenarios involving jet fires. In jet fire cases, parti¬ 
cularly those in which the fire may impinge upon a vessel, 
the intense, localized heating of the vessel wall may cause 
vessel failure before the relief pressure is reached. In such 
cases, depressurization and fireproofing may present the 
only feasible means of protection. 

12.15.6 Fire relief of pressure vessels: other codes 

There are several other codes which give guidance on fire 
relief. A critical review is given in the IChemE Guide. The 
other major code discussed in the Guide is NFPA 30:1981, 
together with the Occupational Safety and Health Admin¬ 
istration code (OSHA) 1910.106:1981, which is essentially 
similar. It states that for storage equipment with wetted 
areas below 2000 ft 2 , NFPA 30 appears to give heat fluxes 
twice those of API RP 521, but that this difference gradually 
reduces for wetted areas between 2000 and 2800 ft 2 so that 
for wetted areas above the latter value the two coincide. 

It is also necessary, however, to consider the environ¬ 
mental factor. For good drainage, NFPA 30 gives credit in 
the form of a value of 0.5 for this factor. As stated above, 
API RP 521 gives no explicit credit for good drainage, the 
existence of good drainage being a condition of the use of 
Equation 12.15.1. Thus for wetted areas of less than 2000 ft 2 
the heat fluxes given by the method of API RP 521 and that 
of NFPA 30 are the same. The Guide concludes that the 
method of API RP 521 is to be preferred. A further discus¬ 
sion of heat fluxes to pressure vessels is given in Chapter 16. 

The Guide also considers the Compressed Gas Associa¬ 
tion code CGA S-1.3:1980 for gas cylinders, together with 
the Chlorine Institute code Cl 5.3.3:1977, which is essen¬ 
tially similar. CGA S-1.3 utilizes for gas cylinders the more 
conservative Equation 12.15.2. The Guide argues that 
cylinders may well be exposed to higher heat fluxes so that 
a case can be made for this approach. 

12.15.7 Fire relief of atmospheric storage tanks: API 
Standard 2000 

Guidance on fire relief for atmospheric and low pressure 
storage tanks is given in API Std 2000:1998. This standard 
distinguishes between tanks with a weak roof-to-shell 
attachment, or rupture seam, and those without. For tanks 


with a rupture seam, the standard does not require any 
further emergency venting for fire relief. For tanks without 
a rupture seam, the standard provides a table of relieving 
requirements given as a function of the wetted area of the 
tank. It should be noted that recent reports indicate that the 
rupture of seams on tanks with diameters less than 50 ft 
cannot be sufficiently relied upon to remove the need for 
separate relief devices. (Ferry, 2002). 

For a vertical tank, the wetted area is taken as the total 
cylindrical surface area of the shell up to height of 30 ft 
above grade. For a horizontal tank, it is the greater of 75% 
of the total surface area or the surface area to a height of 
30 ft (9.14 m) above grade. For a sphere or spheroid it is the 
greater of 55% of the total surface area or the surface area 
to a height of 30 ft above grade. 

The value of the wetted area used in API Std 2000 
reflects the fact that such an atmospheric storage tank 
normally stands in a bund in which there could be a liquid 
fire. This contrasts with the values of the wetted area in 
API RP 521, which reflect the fact that the ground under a 
pressure storage vessel is normally sloped to drain any 
liquid away. Fire relief for atmospheric storage is discussed 
further in Chapter 22. 

12.15.8 Effect of fire on relief devices 

It is also necessary to consider the effect of fire on pressure 
relief devices. On a pressure relief valve there are two main 
effects of fire. One is to cause thermal expansion of the 
spring, which reduces the force on the valve and is a 
deviation in the safe direction.The other is to cause thermal 
expansion of the valve spindle which can lead to jamming. 
However, if the valve is immersed in the fire so that the 
temperatures in it are equalized, this effect may he mini¬ 
mal. On a bursting disc the effect of fire is to reduce the 
bursting pressure or to cause rupture, both of which are 
effects in the safe direction. 

12.15.9 Heating of unwetted surfaces 

Provision of fire relief does not give full protection against 
fire. Unwetted surfaces which are exposed to fire may 
experience overtemperature and may rupture, even though 
overpressure of the vessel has not occurred. API RP 521 
gives a graph for the time taken by steel plate of different 
thicknesses to reach particular temperatures when exposed 
to an open gasoline fire on one side, and another graph for 
the time to rupture at different rupture stresses and tem¬ 
peratures. These two graphs are shown in Figure 12.16(a) 
and (b), respectively. RP 521 quotes the example of an 
unwetted steel vessel of plate thickness 1 in. and with a 
stress of 15,000 psi in an open fire. The time for the vessel 
wall to heat up to 1300°F is 17 min and the time for rupture 
to occur at that temperature is 2.5 min. 

The failure of LPG pressure storage vessels in 1966 at 
Feyzin (Case History A38) was due to the effect of fire on the 
unwetted walls, even though the pressure relief valves 
operated. 

12.16 Overpressure Protection: Vacuum and 
Thermal Relief 

12.16.1 Vacuum relief 

Vacuum collapse of equipment is destructive and hazar¬ 
dous, despite the fact that in some instances the pressure 
differential may appear relatively small. There is a wide 
variety of situations that can lead to at least a partial 
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Figure 12.16 Effect of fire engulfment on steel plate (American Petroleum Institute, 1997 API RP 521): (a) average 
rate of heating of steel plates of different thickness exposed to an open gasoline fire on one side; and (b) time to 
rupture of steel plate (ASTM A515 grade) as a function of temperature and stress (Courtesy of the American 
Petroleum Institute) 
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vacuum. They include (1) pumping out with inadequate 
vent opening, (2) condensation of a vapour, (3) absorption of 
a vapour, (4) cooling of a volatile liquid, (5) connection to a 
source of vacuum or suction, (6) depletion of oxygen in air 
by rusting, and (7) sudden arrest of a moving column of 
liquid. Some scenarios of storage tank collapse due to such 
situations are illustrated in Chapter 22. 

Some equipment is capable, as designed, of withstanding 
full vacuum. This is often the case with steel pressure ves¬ 
sels. Other equipment such as plastic storage tanks or large 
diameter pipework may not have full vacuum strength. 

The IChemE Guide states that a cylindrical pressure 
vessel with a length/diameter ratio not exceeding about 
three and a design pressure of 3.5 barg can generally 
withstand full vacuum, but that it is prudent to make the 
check. An increase in the vacuum strength of a vessel can 
often be obtained by a quite small increment in wall thick¬ 
ness or addition of a stiffening ring. 

Vacuum relief devices include vacuum valves and burst¬ 
ing discs. A vacuum valve is a direct-loaded valve which 
opens to admit air. An alternative is a vacuum bursting 
disc, which may be preferred where the fluid is corrosive or 
liable to create blockage, or where it is sufficiently toxic that 
even a small leak is unacceptable. Bursting disc arrange¬ 
ments are also available which provide both overpressure 
and vacuum protection, as described in Section 12.13. 

On atmospheric storage tanks widespread use is made of 
pressure/vacuum valves which allow flow in either direc¬ 
tion. These are discussed in more detail in Chapter 22. In 
some cases, vacuum protection may be provided by way 
of a liquid seal. Where it is not acceptable for air to be 
admitted to the equipment, inert gas may be used. A typical 
inert gas arrangement on a storage tank is illustrated in 
Figure 12.17. 

In such an installation, the tank pressure is maintained 
within acceptable limits primarily by inflow or venting of 


the inert ‘blanket’ gas. Installation of pressure and vacuum 
vents is still required, however, as these provide the ulti¬ 
mate means of protection in the event of failure of the 
blanketing system. Inflow of air or venting of tank vapours 
is generally to be preferred over tank rupture or implosion. 

12.16.2 Thermal relief 

Another form of pressure relief which may be required is 
thermal hydraulic relief. This is the relief of pressure due to 
expansion of a liquid that is blocked in and then heated.The 
pressure generated by a blocked-in and heated liquid is 
independent of the volume, hut the latter does affect the 
consequences of any escape. 

A treatment of thermal relief is given in the IChemE 
Relief Systems Guide. The factors governing the decision as 
to whether to provide thermal relief are (1) the nature of the 
liquid, (2) the heat source, (3) the volume of the plant sec¬ 
tion or system, (4) the tightness of the closure, (5) the 
probability of blocking in, (6) the location of the system, 
and (7) the availability of other means of relief. 

The Guide divides liquids into the following categories: 
(1) cryogenic, (2) low boiling point, (3) volatile, (4) flam¬ 
mable, (5) toxic, (6) other liquids, and (7) water. 

Sources of heat are classified as (1) process heat, (2) heat 
tracing, (3) solar radiation, and (4) ambient temperature. 
Subject to the volume exemption described below, the first 
of these cases should be provided with relief, as should the 
second, unless the controls are such as to make it unneces¬ 
sary, whilst the third and fourth cases require the exercise 
of judgement. For liquids in categories 1-5 relief should 
generally be provided except for insignificant volumes, 
that is, volumes <0.1 m 3 (perhaps less for toxic compounds). 
The location of the system may strengthen the case for 
relief, which is indicated if the system is located in an 
unmanned offsite area (where corrective action is unlikely) 
or on public property. 



Figure 12.17 Storage tank system showing inert gas blanketing and arrangements for pressure and vacuum relief 
(Parry, 1992). PIC, pressure indicator controller (Courtesy of the Institution of Chemical Engineers) 
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TUrning to category 6 liquids, these require judgement. 
Account may be taken of the frequency with which the 
system may be blocked in and the degree of control. If the 
frequency is judged sufficiently low, it may be possible to 
dispense with relief. 

The Guide advises that in borderline cases account may 
be taken of the volume of the system. The volume which 
may be regarded as insignificant is related to the tightness 
of closure. The following tightness categories are given: 


Construction 

Valves 



Bubble Soft 

Metal 

All welded 

A A 

B 

Class 300 flanges or higher 

A B 

C 

Class 150 flanges 

B C 

D 

It also gives the following relationships between tightness 
category and limiting volume requiring thermal relief: 

Tightness category 

Limiting volume (m 3 ) 

A 

0.1 


B 

1.0 


C 

5.0 


D 

10.0 



Separate thermal relief may not be needed if other means of 
relief exist. These may include a small hole in the valve or a 
small bore bypass around it, bellows, or relief provided for 
other purposes. 

The following equation is given in the IChemE Relief 
Systems Guide for the thermal relief requirement: 

W = QP/S [12.16.1] 

where Q is the heat input rate (W), S is the specific heat 
of the fluid (J/kg°C), Wis the required relief rate (kg/s) and 
P is the coefficient of volumetric expansion (°C _1 ). 

12.17 Overpressure Protection: Special Situations 

There are a number of special situations in pressure 
relief which require separate consideration. They include 
(1) extreme operating conditions, (2) aggressive fluids, 
(3) multiphase fluids, and (4) uncontrolled chemical reaction. 

12.17.1 Extreme operating conditions 

Extreme operating conditions that can affect pressure 
relief include (1) high pressure, (2) high temperature, and 
(3) low temperature. 

With high pressure relief valves factors to be considered 
are valve tightness and precision of lift. Increased tightness 
may be obtained by the use of a supplementary-loaded 
valve. In high pressure processes, it is usual to operate close 
to the design pressure and precision of lift becomes impor¬ 
tant. A pilot-operated valve may meet the case for clean 
fluids. Advice on selection of valves for dirty fluids is given 
in the IChemE Guide. There are also available bursting 
discs for high pressure duties. A feature of relief flows at 
high pressure is that the gas behaviour may not be ideal. 

For a high temperature pressure relief valve relevant 
factors are materials of construction, spring relaxation, the 


hot set pressure and the difference between the operating 
temperature and the relieving temperature. Avalve spring 
subject to high temperature may suffer relaxation. The 
problem, and work on it, have been described by Aird (1982, 
1983). A method of minimizing the effect by the hot set 
procedure has been described by Weighell (1980). The hot 
set procedure is specified by the valve manufacturer and 
should be followed. 

If the process fluid has to travel any significant distance 
before reaching the valve, there may be a difference 
between the operating temperature and the relieving tem¬ 
perature. It is the latter which is to be used in performing 
the sizing calculations. 

For a pressure relief valve on low temperature duty, fac¬ 
tors to consider are materials of construction, the low tem¬ 
perature set pressure, the difference between the operating 
temperature and the relieving temperature and icing. The 
low temperature set pressure may be obtained by using a 
correction on the ambient set pressure but it is also practice 
to adjust avalve in place at the operating temperature. Icing 
is countered in various ways. Use may be made of insula¬ 
tion or trace heating. If the plant is in a cold box, the valve 
may be mounted outside it so that it is at a temperature close 
to ambient. 

For a bursting disc on high or low temperature duty the 
important feature is the material of construction. 

12.17.2 Aggressive fluids 

Where a fluid is corrosive, it may be possible to use a pres¬ 
sure relief valve on its own if suitable materials of con¬ 
struction are available. Otherwise, options are the use of a 
bursting disc upstream of the valve, a bursting disc on its 
own, or, if the fluid is especially corrosive, two bursting 
discs in series. 

Where the fluid is liable to cause blockage, a pressure 
relief valve alone may not be suitable. One option is to 
install a bursting disc upstream of the valve. Another is to 
use a bursting disc on its own. 

If the fouling could be severe, further steps may need to 
be taken to keep the disc clear. Methods include the use of a 
coating or anti-fouling compound on the disc, or even water 
sprays to wash the disc clean. 

12.17.3 Multiphase fluids 

In some applications, the fluid flowing through the pres¬ 
sure relief valve will be a two-phase vapour-liquid mix¬ 
ture, either because the fluid is two-phase at the valve inlet 
or because it becomes so in passing through the valve. Two- 
phase flow through a pressure relief valve is a specialist 
topic of active current research. It is discussed further in 
Chapter 15. 

Another type of two-phase system is a liquid containing 
solid particles. There are two potential effects of such solid 
matter. One is blockage, which has just been discussed. The 
other is any effect on the flow properties of the fluid. 

12.17.4 Runaway reactions 

Chemical reaction has long been recognized as a potential 
source of overpressure in equipment and piping elements. 
It is unavoidably a specialized domain within the field of 
overpressure protection, because the rate at which pressure 
builds - and must be relieved - is inextricably connected 
to the kinetics of each particular reactive system. Further¬ 
more, reactions that may lead to overpressure include not 
only reactions intentionally carried out but control of which 
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is lost, but also unintended reactions that occur due to 
feeding incorrect compounds, impurities, or failing to 
maintain process parameters within specified limits. An 
ongoing thrust of the DIERS User’s Group - with world¬ 
wide participation - is to share, compare and validate 
experimental and theoretical studies of reactive systems of 
wide industrial relevance. A series of international sym¬ 
posia has featured reports of data for ‘runaway reactions’ 
(Runaway Reactions 1-3). 


12.18 Overpressure Protection: Disposal 

12.18.1 Disposal and disposal systems 

Pressure relief necessarily involves the provision of 
arrangements for the disposal of the material vented. The 
selection of the method of relief disposal and the design of 
any relief disposal system are integral to the overall design. 

With all credible overpressure scenarios as a starting 
point, the nature, temperature, phase and flow rate of the 
each relief stream are defined. Fluids may be flammable, 
toxic and/or corrosive. Some may be at high or low tem¬ 
perature. Some flows may be two-phase or liable to con¬ 
dense on release. 

For each relief location there will be a flow profile with 
time. There may also be contributions to the total flow from 
other devices such as depressuring valves. If the overall 
profile shows too high a peak, measures may be taken to 
shave the peaks by means such as the staggering of pres¬ 
sure relief valve settings. 

Discharge of gas or vapour to atmosphere is relatively 
simple and dependable, but its use may be constrained by 
regulatory and other requirements. API RP 521 recognizes 
this method for use where it is acceptable. The code also 
deals with some of the problems which can arise with 
atmospheric discharge, including formation of flammable 
plumes, ignition of such plumes, toxic or corrosive plumes, 
noise and pollution. Its guidance on avoidance of flam¬ 
mable plumes is discussed in the next subsection. 

Another option for gas or vapour, which is applicable in 
some cases, is disposal to a lower pressure system. Mini¬ 
mum requirements in this case are that the unit have the 
capacity to receive the relief safely and that it be available to 
do so, bearing in mind that the lower-pressure system may 
be affected by the same conditions that created the need for 
relief in the first place. 

If these methods of disposal are not appropriate, other 
methods available include: scrubbing, followed by dis¬ 
charge of the scrubbed gas; discharge from a vent stack; or 
burning from a flare stack. In these cases, the necessary 
pipework has to be provided in the form of a relief header, or 
headers. Here a basic distinction is between single- and 
multiple-valve disposal systems. In the design of the latter 
there are a number of features which need to be taken into 
account. 

It is common practice to use a common header both for 
normal vents and for emergency relief. In this case the 
normal vent flows should be added to the emergency relief 
flows in designing the header. Alternatively, separate 
headers may be provided for normal vents, for gas/vapour 
relief and for liquid blowdown. Separate headers for gas/ 
vapour and for liquid permit separate disposal arrange¬ 
ments such as a flare stack and blowdown drums, respec¬ 
tively. It may be necessary to consider segregation of 
streams which are in some way incompatible. Such incom¬ 
patibility may have to do with fluids that react together, 


with a low-temperature fluid that requires a more expen¬ 
sive material of construction, or with a fluid that is sus¬ 
ceptible to freezing by another, colder fluid. 

As far as liquids are concerned, some may be suitable for 
disposal to the drains. Others may need to be routed to a liquid 
blowdown receiver or disposed of in an earth burning pit. 

12.18.2 Load on disposal system 

If the relief flows are discharged to a closed system rather 
than to atmosphere, it becomes necessary to define the load 
the system is required to handle. The determination of the 
flow for which the relief header should be designed is not a 
simple matter. Its capacity must lie somewhere between the 
largest single relief flow and the sum of all relief flows. 
Except for very small plants the latter solution is too con¬ 
servative and uneconomic. 

Before the total design load of the disposal system can be 
determined, credible ‘global scenarios’ must be defined. 
These are scenarios in which multiple relief devices can 
credibly be expected to discharge simultaneously into the 
disposal system as a result of a single initiating event. All 
sources tied to the disposal system - which typically 
include relief devices, blowdown valves, and process con¬ 
trol valves (e.g. pressure bleeds to flare) - must be con¬ 
sidered in this evaluation. 

Guidance on the identification of global scenarios and 
determination of the associated loads on the disposal sys¬ 
tem is given in API RP 521. The essential principle is to 
design for the set of individual contingencies, rather than 
for coincident occurrence of multiple independent con¬ 
tingencies. However, each contingency should be carefully 
examined, because the consequences of certain events can 
be very widespread. 

The code gives guidance particularly on loss of utilities. 
For failure of electrical power to equipment, the design is 
commonly based on failure of one bus, or possibly of the 
distribution centre or the incoming line. Sudden total or 
partial loss of instrument air or instrument electrical power 
is also typically considered. The presence of large reser¬ 
voirs of instrument air may provide for the failure of an air 
compressor, but cannot protect against the rupture of an air 
manifold. 

Definition of the load resulting from fire requires a spe¬ 
cific study taking into account the plant layout, including 
location of potential sources of release, natural barriers 
and drainage, etc. The fire on a plant handling only gas can 
generally be assumed to be more localized than on one 
handling liquids. RP 521 states that in the absence of spe¬ 
cial factors the ground area of fire is often taken as being 
limited to 2500-5000 ft 2 (230-460 m z ). 

Fitt (1974) describes an approach to this problem based 
on certain‘standard hazards’. These are (1) fire, (2) electrical 
power failure, (3) instrument air failure and (4) cooling 
water failure. 

Fire may affect a group of vessels. It should be assumed, 
therefore, that there would be simultaneous relief on these 
vessels. It is usually not necessary to assume a process 
upset at the same time. 

Failures of electrical power, instrument air or cooling 
water are all obvious causes of simultaneous relief. Total 
power failure can cause failures on a large number of 
equipments and all electronic instrumentation. Partial 
power failure can be even more hazardous. Thus, for 
example, reboiler fuel pumps might continue to operate 
after reflux pumps have stopped. 
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Total instrument air failure disables all pneumatic 
instrumentation. It is normal practice, however, to design 
instrument systems so that the control valves ‘fail safe’ on 
air failure. Thus again, it may be more hazardous if the air 
failure is partial. In this case the movement of valves may 
be in the directions opposite to those on total air failure. In 
addition, a control valve with an open bypass will not shut 
off flow completely even if it does close. 

Failure of cooling water is usually a consequence of 
power failure and should be assumed unless the supply can 
be maintained by pumps with prime movers which have an 
independent power supply. Note that RP 521 recommends 
against taking credit for independent-driver pumps not 
normally operating, stating that their start-up upon power 
failure has proven not sufficiently reliable. 

According to Fitt (1974), once the credible standard 
hazards have been identified, the flows expected to occur 
over three different time periods (1) less than 10 min, 
(2) 10—30 min, and (3) up to 1 h (4 h for fire), are determined. 


12.18.3 Disposal to atmosphere 

Disposal of gas or vapour by direct discharge to atmo¬ 
sphere possesses the virtue of being relatively simple and 
dependable, and may be used where it is acceptable. A 
method for the design of atmospheric discharge arrange¬ 
ments is given in API RP 521. The case considered is that of 
a safety relief valve discharging a flammable vapour 
upwards through a vertical tail pipe. The vapour is dis¬ 
charged at a velocity sufficiently high that it is rapidly 
diluted below the lower flammability limit (LFL). 

The criterion for the vapour to be diluted below the LFL 
whilst the mixing is still dominated by the momentum of the 
jet is that the Reynolds’ number, Re, exceed following value: 

Re > 1.54 x lOVy/Poo [12.18.1] 

where pj is the density of the vapour at the vent outlet and 
Poo is the density of the air. 

The code quotes the work of Taylor, Grimmett and 
Comings (1951) and gives for the dilution of the discharged 
vapour the relation: 

W v 

w 0 =om i wws 


Miga (1970) which has shown that even at flows of 25% of 
capacity the vapour is safely dispersed. 

API RP 521 also refers to studies on venting of oil tankers 
(ICS, 1978) which indicate that dilution is effective at 
release velocities exceeding 100 ft/s (30 m/s). It gives a set 
of graphs for the estimation, for petroleum gases, of the 
maximum vertical and downwind horizontal distances 
from the jet exit to the LFL and of the axial distances to the 
upper flammability limit (UFL) and LFL. For the vertical 
distance the correlation is: 


dj(Pj/Poo) 1,Z 


Uoo/Uj 


[12.18.3] 


where dj is the inside diameter of the tip, or jet exit diameter, 
Uj is the jet exit velocity, is the wind speed and y is the 
vertical distance to the LFL. The correlations for horizontal 
distance x and axial distance S are of similar form, with y 
replaced by x and S, respectively. 

The code comments that the studies demonstrate the 
adequacy of the industry practice of locating the discharge 
of a safety relief valve at a horizontal distance of at least 
50 ft (15 m) from any equipment or structure above the 
discharge level. 

API RP 521 also gives consideration to the case in which 
the vapour discharged condenses to form a mist. In princi¬ 
ple, condensation can occur if the ambient temperature is 
below the dewpoint of the vapour. However, there are two 
factors that may mitigate this situation. One is that con¬ 
densation does not necessarily occur and the other is that, 
even if it does, the droplets may coalesce and fall out. 

Vapour let down in pressure through a safety relief valve 
becomes superheated and this may prevent condensation. 
Furthermore, the vapour may be diluted so rapidly that 
condensation is avoided. A method of determining whether 
condensation occurs has been given by Loudon (1963). It 
shows that condensation does not occur with most hydro¬ 
carbons, though it may with some of high molecular 
weight, a finding which is in accord with industrial 
experience. 

RP 521 states that, whilst conclusive data are lacking, 
condensation at a hydrocarbon partial pressure of 5 psi 
(0.34 bar) or less should be assumed to result in a fine mist, 
the dispersion and flammability of which are similar to 
those of a vapour. A further discussion of discharge to 
atmosphere and from vents is given in Chapter 15. 


where D is the diameter of the nozzle (ft), Wis the mass flow 
of vapour-air mixture at distance y from the tail pipe (lb/ 
h), W 0 is the mass flow of vapour from the safety relief valve 
(lb/h), andy is the distance from the end of the tail pipe (ft). 

On this basis it is calculated that, provided that the 
velocity of the discharged material leaving the tail pipe is 
more than 500 ft/s (150 m/s) so that sufficient energy is 
supplied for mixing to occur, a hydrocarbon discharging 
from a safety relief valve into the atmosphere will entrain 
enough air to become diluted below its LFL at a distance of 
approximately 120 diameters from the end of the tail pipe. 

The code recognizes that, whilst this is fine as long as the 
valve discharges at this high rate, it cannot be assumed that 
the flow through a safety relief valve is the full capacity 
flow. Once a spring-loaded valve has opened, the force 
exerted on it by the flowing fluid is sufficient to prevent 
reclosure until the flow has fallen to about 25 % of capacity. 
However, the code quotes a study by Hoehne, Luce and 


12.18.4 Design of a relief header 

The use of a closed system involves the design of the relief 
discharge pipework. In certain cases, use may be made of 
individual discharge lines, but commonly there is a relief 
header taking discharges from a number of points. 

A discussion of relief headers is given by Fitt (1974) in the 
study mentioned. As stated above, he considers for a given 
standard hazard the flows occurring over the three time 
periods (1) less than 10 min, (2) 10-30 min, and (3) up to 1 h 
(4 h for fire). The relief header is designed to handle the sum 
of the flows of the largest of these groups. The header may 
be required to handle both gas/vapour and liquid flows. 

If conventional relief valves are used, relief headers 
should be so sized that the back pressure developed is lim¬ 
ited to 10% of the set pressure. This requirement can be 
relaxed, however, if balanced relief valves are used. The lat¬ 
ter thus permit a more economical design of the relief header. 
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The pressure drop in the header is sometimes high and 
the changes in gas density and velocity are correspond¬ 
ingly large. Not infrequently, sonic flow conditions occur. 
The design of relief headers is therefore relatively complex. 

The gas flow in the header may be treated either as iso¬ 
thermal or as adiabatic. For an ideal gas the flow is greater 
under adiabatic than under isothermal conditions, but for 
a ratio of specific heats y<1.8 this difference does not 
exceed 23 %. Frequently, calculations are done on the basis 
of isothermal flow. 

API RP 521 gives in Section 5.4.1 guidance on the design 
basis for a relief header. Essentially, the flows are deter¬ 
mined for each credible global scenario and the design is 
based on the most severe flow condition. This is the condi¬ 
tion which gives the highest pressure drop, which is not 
necessarily that with the highest mass flow; the volumetric 
flow is relevant, and hence so are molecular weight and 
temperature. 

Once the design loadings are determined, then for each 
global scenario the maximum allowable back pressure on 
each pressure relief valve should be calculated. The code 
gives detailed guidance on these back pressures. 

In addition to the flows from the pressure relief valves, 
there may be flows from depressuring valves. Normally, a 
depressuring valve is treated as fully open or fully closed 
and the maximum flow from it taken as the flow capacity of 
the valve at the maximum pressure of the equipment that it 
protects, which may be the maximum accumulated pres¬ 
sure. However, the code advises that where the same 
equipment is protected by both a pressure relief valve and a 
depressuring valve, only the larger of the two flows is to be 
considered. 

API RP 521 gives a method for the design of the relief 
header, which is based on the method of Lapple (1943) for 
isothermal flow of gas through pipes at high pressure drop. 
The design of relief headers is a specialist matter. It is also 
an economically important one, since relief headers can be 
expensive items, particularly if it is necessary to use spe¬ 
cial materials of construction. Some of the specialist topics 
in the sizing of relief headers, including non-ideal gas flow 
and pipe section changes, are discussed by Duxbury (1976). 

12.18.5 Disposal to a flare stack 

Guidance on the design of a flare for the disposal of gas or 
vapour is given in API RP 521. The code gives methods for 
the determination of the diameter and height of the flare 
stack, the fuel gas supply to the flare, and the steam 
requirement for a smokeless flare. 

The selection of flare stack diameter and height is treated 
in appendix C of the code. As described there, the diameter 
is chosen to give a particular Mach number at the flare tip 
and the height is chosen to limit thermal radiation at 
ground level. Appendix D of the code gives typical sketches 
and details of a complete flare system, and of seal drums 
and knockout drums. 

The code also deals with thermal radiation and pollution 
from the flare. Appendix C gives two models for the flame 
on the flare, a simple model and the model of Brzustowski 
and Sommer. These API flare models are described in 
Chapter 16. 

API RP 521 gives information on the exposure times 
necessary to reach the threshold of pain (table 7) and 
recommended design radiation levels (table 8). RP 521:1997 
differs from previous editions in that table 8 specifies 
recommended design values of total radiation; in previous 


editions the corresponding table explicitly excluded solar 
radiation from the design values. These and other thermal 
radiation limits are discussed in Chapter 16. 

With regard to the estimation of ground level concentra¬ 
tions of combustion products from the flare, the code refers 
to the method of Gifford (1960a). 

Methods for dispersion from elevated stacks are con¬ 
sidered in Chapter 15. 

12.18.6 Disposal to a vent stack 

API RP 521 also contains guidance on the design of a vent 
stack for the disposal of gas or vapour. It gives methods for 
the determination of the diameter and height of the stack. 

The diameter is chosen to give a high exit velocity. As 
discussed above, the code states that excellent dispersion 
is obtained with a velocity of 500 ft/s (150 m/s). However, 
sonic velocity should be avoided, or else allowance made for 
the effect on the pressure drop of the pressure dis¬ 
continuity at the discharge. The choice of the height of the 
stack is governed by the need to ensure acceptable con¬ 
centrations at the points of interest. The code gives gui¬ 
dance on the level of noise from such a stack. 

An equation for the maximum ground concentration 
of a gas downwind of a vent stack is: 

= vwm mw 

where C max is the maximum ground concentration (% v/v), 
H is the height of the stack (ft), M is the molecular weight, 
Fis the wind velocity (mile/h) and IFis the mass flow rate 
of gas (lb/h). 

There are a number of restrictions on the use of Equation 
12.18.4. It assumes that the air velocity increases with 
height above the ground and that the gas-air mixture is 
not much heavier than air itself. It is not applicable if the 
wind velocity is zero or very low, or if the discharge velocity 
is much below 500 ft/s. 

12.18.7 Selection of disposal system 

Guidance on the selection of a disposal system is given in 
the IChemE Relief Systems Guide. The disposal systems 
considered in the guide are to (1) atmosphere, (2) quench 
vessel, (3) process, (4) storage, (5) dump tank, (6) sewer, 
(7) elevated flare, (8) ground flare, (9) incinerator, or 
(10) scrubber. 

The selection scheme passes through four broad stages. 
If the fluid to be disposed of is mainly vapour and if it is 
lighter than air or can be discharged at high velocity, dis¬ 
posal to atmosphere is a technical option. If the fluid 
contains both vapour and liquid and needs to be cooled, 
disposal to a quench vessel is indicated. Otherwise, if a 
sink for the fluid is available in process or in storage, it may 
be disposed of to that sink. If the fluid is mainly liquid 
and it is suitable for discharge to a plant sewer, it may he 
so disposed of. Otherwise it should be discharged to a 
dump tank. 

If the fluid is both vapour and liquid and cannot be dis¬ 
posed of as described above, other options must be con¬ 
sidered. Flammable vapours with some liquid may be sent to 
a flare. If the fluid contains toxic and/or particulate matter 
which can be scrubbed out, treatment in a scrubber is sui¬ 
table. Otherwise the fluid should be sent to an incinerator. 

Guidance on selection and design of systems for dipsosal 
of relief streams is also provided in the CCPS Relief 
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Guidelines (CCPS/NN). This work considers a wide variety 
of collection, treatment, and containment equipment. It 
also makes brief mention of several treatment and disposal 
alternatives that may be applied in special circumstances, 
noting that the highly variable flow rates associated 
with relief systems limit the general applicability of these 
alternatives. 

12.19 Overpressure Protection: Pressure 
Relief Valves 

The basics of pressure relief valves have been outlined in 
Section 12.13. In this section, consideration is given to valve 
set pressure, sizing and failure. 

12.19.1 Valve set pressure 

A pressure vessel has a design pressure. The definition of 
design pressure given in PD 5500: 2003 was quoted in Sec¬ 
tion 12.6. The set pressure of a safety valve is defined in 
codes by reference to a specific terminology. The pressure 
relationships used in PD 5500: 2003 for a safety valve on a 
vessel are indicated in Figure 12.18(a), which shows the case 
of a safety valve on gas or vapour service with a 10% over¬ 
pressure. The pressures on the left-hand side refer to the 
vessel, whilst those on the right-hand side refer to the safety 
valve. For the vessel, the normal operating pressure lies 
between 90 and 95% of its design pressure. The maximum 
permitted regulated pressure is 110 % of the design pressure, 
the difference between the two being the accumulation. For 
the safety valve, the set pressure is equal to the design 
pressure. The relieving pressure is 110% of the set pressure, 
the difference between the two being the overpressure. 
Where the set pressure of the valve is the design pressure of 
the vessel, the overpressure equals the accumulation. 

PD 5500: 2003 states that a safety valve should normally 
be set to operate at a nominal pressure not exceeding the 
design pressure of the vessel at the operating temperature. 
However, if the capacity is provided by more than one 
safety valve, it is permissible for only one of the valves to be 
set to operate in this way and for the additional valve (s) to 
be set to operate at a pressure not more than 5% high. The 
pressure relationships given in BS 5500:1991 for a safety 
valve for liquid service with a 25 % overpressure are shown 
in Figure 12.18(b). 

Figure 12.18(c) gives the pressure relations for pressure 
relief valves on a vessel used in API RP 520: 2000. Again, 
pressures pertaining to the vessel are shown on the left of the 
figure, whilst those on the right refer to the relief device. For 
the vessel, the maximum expected operating pressure is 
90% of the maximum allowable working pressure (MAWP), 
which is not less than the design pressure at a coincident 
design temperature. The figure shows several values of 
the maximum allowable accumulation, for the following 
three cases: (1) non-fire exposure with a single valve, (2) non¬ 
fire exposure with multiple valves, and (3) fire exposure.The 
accumulation values are 110,116 and 121%, respectively. For 
the pressure relief valve, a similar set of distinctions apply. 
The maximum set pressure and maximum relieving pres¬ 
sure are equal, respectively, to 100 and 110% of the design 
pressure for case 1; 105 and 116% for case 2; and 110 and 
121% for case 3. Note that in all cases, at least one pressure 
relief valve must be set no higher than the vessel MAWP. 
Where the set pressure of the valve is the design pressure of 
the vessel, the overpressure equals the accumulation. RP 520 
states that Figure 12.18(c) conforms to the ASME Boiler and 
PressureVesselCode, SectionVIII. 


Note that all applicable codes would require that where a 
single relief device or set of devices is designed to protect 
multiple equipment items, the set pressure of at least one 
relief device be no higher than the equipment with the 
lowest design pressure. 

For further details of, and qualifications and variations 
on, the above pressure relief requirements, such as the 
use of multiple pressure relief valves, reference should be 
made to the appropriate codes, including the codes 
just mentioned, and other codes such as API RP 521 and 
Std 2000. 

12.19.2 Valve sizing: BS 5500 

Equations for pressure relief valve sizing were given in BS 
5500:1976. PD 5500: 2003 simply refers to the standards 
for pressure relief valves BS 6759. The equations given in 
PD 5500: 2003 are widely quoted and are given here for 
reference. 

For a gas or vapour under critical flow conditions: 



where A is the actual discharge area (m 2 ), K is the coeffi¬ 
cient of discharge for gas flow, M is the molecular weight, 
p is the absolute accumulation pressure (N/m 2 ), Tis the inlet 
temperature (K), W is the rated capacity (kg/s) and C is a 
constant. 

For saturated steam: 


and for air at 20°C 


[12.19.2] 


[12.19.3] 


where W a is the rated capacity for air at 20°C (kg/s) and W s 
is the rated capacity for saturated steam (kg/s). 

The coefficient of discharge, K, may vary. The standard 
quotes a value of 0.25 for a parallel inlet guided wing type 
valve of high lift and 0.97 for a nozzle inlet type valve with 
flat disc. The value of the coefficient should be provided by 
the manufacturer. The value of C is 133 for a ratio of specific 
heats of 1.4. 

For liquid flow: 


W = KA(2ApG) 1/2 [12.19.4] 

where G is the density (kg/m 3 ) at the inlet temperature, K is 
the coefficient of discharge for liquid flow and Ap is the 
pressure drop (N/m 2 ). 


12.19.3 Valve sizing: BS 6759: 1984 

The relations given for pressure relief valve sizing in BS 
6759: Part 3:1984 are as follows. For air or any gas at cri¬ 
tical flow conditions: 



= 0.2883 c{^j 


1/2 


[12.19.5] 

[12.19.6] 
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Figure 12.18 continued 
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PRESSURE VESSEL VESSEL TYPICAL CHARACTERISTICS 

REQUIREMENT PRESSURE OF SAFETY RELIEF VALVES 
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1. The operating pressure may be any lower pressure required. 

2. The set pressure and all other values related to it may be moved downward if the operating pressure permits. 

3. This figure conforms with the requirements of Section VIII, Division 1, of the ASME Code. 

4. The pressure conditions shown are for safety relief valves installed on a pressure vessel (vapor phase). 

Figure 12.18 Settings for pressure relief valves: (a) safety valve with 10% overpressure for gas or vapour service 
(BS 5500: 1991) (Courtesy of the British Standards Institution); (b) safety valve with chosen 25% overpressure for liquid 
service (BS 5500: 1991) (Courtesy of the British Standards Institution); and (c) pressure relief valve for vapour or liquid 
service (API RP 520:2000) (Courtesy of the American Petroleum Institute) 




"Kf-o' 


where q mg is the theoretical flowing capacity (kg/h/mm 2 of 


flow area), M is the molecular mass of gas (kg/kmol), p is 
the actual relieving pressure (bara), T is the actual relieving 
temperature (K), v is the specific volume at the actual 
relieving pressure and temperature (m 3 /kg), Z is the com¬ 
pressibility factor, k is the isentropic expansion coefficient 
at the relieving inlet conditions and C is a parameter which 
is a function of that coefficient. 
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For air or any gas at subcritical conditions: 




(MV 2 

g mg =pCK h (J f j [12.19.8] 

= 0.2883 CK h (^j 1 [12.19.9] 

if b Jj fe* - [ 1219 -10] 

j| (k(2/{k¥X)))P' ' 1 TV/ 

where K b , is the capacity correction factor for back pressure 
and p h is the back pressure (bara). 

For liquids: 

q m i = 1.61(pA pf 2 [12.19.11] 


Ap=p-p b [12.19.12] 

where A p is the pressure difference (bar), q m \ is the theore¬ 
tical flowing capacity (kg/h/mm 2 of flow area) and p is the 
mass density (kg/m 3 ). 

For dry saturated steam with a minimum dryness frac¬ 
tion of 0.98 or a maximum superheat of 10°C: 

q ms = 0.525 p p < 110 [12.19.13] 

where q ms is the theoretical flowing capacity of dry satu¬ 
rated steam (kg/h/mm 2 of flow area). 

The coefficient of discharge K A is the ratio of the actual to 
the theoretical flow capacity. A derated coefficient of dis¬ 
charge K dl is also defined as 0.9A d . 


12.19.4 Valve sizing: API RP 520 

The relations given in API RP 520: 2000 for sizing of 
pressure relief valves are as follows. The critical flow pres¬ 
sure ratio is estimated as: 


K o x (*+i)/(*-i)1 1/2 

^i) I 12 - 19 - 1 ! 

where A is the effective discharge area (in. 2 ), K b is the 
capacity correction factor due to back pressure, K & is the 
effective coefficient of discharge, AT is the molecular weight 
of the gas, T is the relieving temperature (°R), W is the 
required flow rate through the valve (lb/h), Z is the com¬ 
pressibility factor and C is a coefficient. The effective 
coefficient of discharge K d has the value 0.975. Two further 
equations are also given for volumetric flows, one for air 
and one for gas. 

The capacity correction factor due to hack pressure is 
obtained from manufacturer’s literature or from a graph 
given in the code; the graph is for balanced bellows pres¬ 
sure relief valves. The correction factor is not a means of 
extending Equation 12.19.15 to subcritical flow, for which 
separate equations are given. 

For subcritical flow: 


W = 735F 2 K A A[ MP ^ T - P2 ^ 
or, in the form given 


[12.19.18] 


/[ .. w r zr i l ' 2 

735 F 2 K d [mPi(Pi-P 2 )J 


[12.19.19] 




[12.19.20] 


r = P 2 /Pi 


[12.19.21] 


where F 2 is the coefficient of subcritical flow, P 2 is the 
absolute back pressure (lb f /in 2 ) and r is the ratio of back 
pressure to upstream pressure. 

For liquid flow: 


p CF / 2 \ 

7 V U+V 


[12.19.14] 


q r Q ( G 

3SK a K w K v \P } - P 2 J 


[12.19.22] 


where* is the ideal gas ratio of specific heats, p c F is the abso¬ 
lute critical flow throat pressure (lbf/in. 2 ) and Pi is the abso¬ 
lute upstream relieving pressure (lb f /in. 2 ). The code gives 
values of the ratio of specif ic heats * for a number of gases. 
For critical flow conditions: 

fM\ V2 

W = CKiAK^P\ i ZT J [12.19.15] 

or, in the form actually given 


W (ZT\ 1/2 
~ CK A PiK b \m) 


[12.19.16] 


where G is the specific gravity of the liquid at the flowing 
temperature relative to water at 70°F, K d is the effective 
coefficient of discharge, K, is the viscosity correction 
factor, K w is the back pressure correction factor and Q is the 
required flow (USgal/min). For the effective coefficient of 
discharge, the value should be obtained from the manu¬ 
facturer; for preliminary estimates a figure of 0.65 can be 
used. For the viscosity correction factor, K v , the code gives 
a graph. For the correction factor due to back pressure, K w , 
the approach is as follows. If the back pressure is atmo¬ 
spheric K w = 1. If a balanced bellows valve is used, the 
correction factor may be obtained from a graph given in 
the code. If a conventional valve is used, no correction is 
necessary 
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12.19.5 Valve sizing: two-phase flow 

With the publication of its seventh edition, API RP 520: 
2000 includes for the first time two-phase flow sizing 
methods designed to include the effects of vapour genera¬ 
tion as the fluid flows through the relief valve. The equa¬ 
tions presented in appendix D of the code are based on the 
omega method of Leung (1995), which explicitly assumes 
both thermal and mechanical equilibrium are maintained 
as the fluid passes through the safety valve. RP 520 notes 
that these assumptions are equivalent to those made in the 
development of the homogeneous equilibrium model 
(HEM). The code makes note of the fact that the methods 
presented have not been validated experimentally, princi¬ 
pally because there is no recognized procedure for certify¬ 
ing the flow capacity of relief devices in two-phase service. 

RP 520 distinguishes among four potential types of two- 
phase flow scenarios, depending on the character of the 
fluid entering the relief valve. These are: (1) vapour and 
liquid at equilibrium, containing no non-condensable gas, 
(2) highly subcooled liquid with either non-condensable 
gas or condensable vapour or both, (3) subcooled liquid 
with no gases or vapours, and (4) subcooled or saturated 
liquid, with either non-condensable gas or condensable 
vapour or both. Mixtures (1), (3) and (4) are expected to 
flash as they flow through the relief valve, but mixture (2) 
will not flash, due to its high degree of subcooling. Having 
classified his fluid into one of these categories, the 
designer is directed to one of three procedures for evaluat¬ 
ing the mass flux through the relief valve. Appendix D 
includes examples of the application of each of these three 
calculation procedures. 

Additional discussion of two-phase flow, and of methods 
for calculating relevant flow rates, including the cases of 
relief flow and of reactor venting, appears in Chapter 15. 

12.19.6 Valve sizing: safety factors 

A discussion of safety factors applicable to pressure relief 
valves and relief systems is given in Appendix 13. 

12.19.7 Valve failure 

Pressure relief valves are relatively reliable equipment and 
the incidence of overpressure due to failure of a relief valve 
appears low. Accounts of pressure relief valve failure are 
given by Aird (1982), Maher et al. (1988), Crombie and Green 
(1994), D.W. Thompson (1994), A.B. Smith (1995) and Parr 
(1998). Modes of failure of pressure relief valves include: 

(1) failure to open on demand 

(a) total failure to open, 

(b) opening at a pressure higher than set pressure 
(lifting ‘heavy’); 

(2) opening in the absence of demand 

(a) opening at a pressure lower than set pressure 
(lifting ‘light’), 

(b) chattering, 

(c) failure to reseat after a correct opening on 
demand, 

(d) leakage; 

(3) disabling of valve inlet or outlet. 

Failure to open is a functional failure and opening in the 
absence of demand an operational, or spurious, failure. 

Information on the failure rates of pressure relief valves 
is given in Appendix 14. 


API RP 576: 2000, Inspection of Pressure Relieving Devi¬ 
ces, provides a detailed discussion of failure modes of both 
pressure relief valves and bursting discs, and provides 
guidance on frequency and methods of inspection and 
maintenance of these devices. 


12.20 Overpressure Protection: Bursting Discs 

An alternative pressure relief device is a bursting disc. The 
circumstances under which a bursting disc may be applic¬ 
able are given in PD 5500:2003 as those where the pressure 
rise may be so rapid that the inertia of a relief valve may be a 
disadvantage, where even minute leakage cannot be toler¬ 
ated, or where blockage may render a valve inoperative. 

The relevant standard is BS 2915:1990 Specification for 
Bursting Discs and Bursting Disc Devices. The basics of 
bursting discs have been outlined in Section 12.13. In this 
section, consideration is given to disc set pressure, sizing 
and failure. 

12.20.1 Bursting disc sizing: BS 2915 

For a bursting disc it is usual to specify a range of pressures 
within which the disc will burst. Therefore, a disc has 
minimum, mean and maximum bursting pressures. 

Equations for the sizing of bursting discs are given in BS 
2915:1990. Earlier editions of this standard contained the 
following treatment, given here for reference. For gas or 
vapour: 

/M\ 1/2 

W=CKAP[-^\ [12.20.1] 

whereA is the actual orifice area (mm 2 ), K is the coefficient 
of discharge, Mis the molecular weight of the gas, P is the 
absolute vessel pressure (bara), T is the inlet temperature 
(K), W is the rated capacity (kg/h) and C is a constant. For 
saturated steam 

W s = 0.535 KAP [12.20.2] 

and for air at 20°C 

W a = 0.85 KAP [12.20.3] 

where W a is the rated capacity for air at 20°C (kg/h) and W a 
is the rated capacity for saturated steam (kg/h). The coef¬ 
ficient of discharge is usually takenas0.6andthe value of C 
is 2.7 for a ratio of specific heats of 1.4. 

These equations have similarities with Equations 
12.19.1-12.19.3. 

BS 2915:1990 gives the following relations for bursting 
disc sizing. 

For compressible fluids: 

Q mg =A 0 pFo>(M/ZT) 1/2 [12.20.4] 

where A 0 is the required minimum cross-sectional area 
(mm 2 ), Mis the molecular mass (kg/kmol),/) is the relieving 
pressure (bara), Q mg is the required flow of gas (kg/h), T 
is the relieving temperature (K), Z is the compressibility 
factor, a is the coefficient of discharge of the branch/nozzle 
type and bursting disc combined and F is a correction 
factor (described below). 
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For steam 

Q mw = 0.2883A 0 (i7*)a(/>/f) 1/2 0.9 < x < 1.0 [12.20.5] 

and for saturated or superheated steam ( x= 1) 

Q ms = 0.2883A o Foi(p/v) 1/ 2 [12.20.6] 

where Q mw is the required flow of wet steam (kg/h), Q ms is 
the required flow of saturated or superheated steam (kg/h), 
x is the dryness fraction and v is the specific volume at the 
relieving pressure and temperature (m 3 /kg). 

The standard gives a graph for the coefficient of dis¬ 
charge a. The correction factorFis: 

F = 3.984|=^ 1 [(p b lp) 2li - (p t /P) m)/k \ } V2 [12.20.7] 

where k is the isentropic expansion exponent and p b is the 
back pressure (bara). For steam, the standard gives a graph 
for the isentropic exponent k. 

For incompressible fluids: 

Q ml = 1.6104o/„a(A/> ■ p) 1/2 [12.20.8] 

where / M is the correction factor for liquid viscosity, Q m i is 
the required flow of liquid (kg/h), A p is the pressure dif¬ 
ference (bar) and p is the mass density (kg/m 3 ). The pres¬ 
sure difference term should take account of any static head. 
The standard gives a graph for the correction factor for 
liquid viscosity /„. The coefficient of discharge has the 
value of 0.5 or 0.62, depending on the type of branch/nozzle; 
details are given in the standard. 

12.20.2 Bursting disc sizing: API RP 520 

API RP 520: 2000 presents two methods for sizing burst¬ 
ing discs used as independent relief devices. The first 
method is essentially identical to that used for pressure 
relief valves (as embodied in Equations 12.19.16, 12.19.19 
and 12.19.22). The sole distinction is that for bursting disc 
sizing, a value of 0.62 is to be used for the coefficient of 
discharge K d . Consistent with the requirements of ASME 
Section VIII: 2001, this method is applicable only for 
bursting disc installations in which: 

(a) pipingfromtheprotectedvesseltotheburstingdiscand 
from the disc to the atmospheric discharge location has 
a nominal diameter at least as large as the disc, and 

(b) the bursting disc is installed within 8 pipe diameters 
of the protected vessel, and 

(c) the length of the discharge pipe is less than 5 pipe 
diameters. 

The second sizing method described by RP 520: 2000, is 
applicable to all installations in which a bursting disc 
is used as the sole pressure relief device. In this method, 
the flow capacity of the entire piping system, of which the 
bursting disc is one component, is calculated using accep¬ 
ted engineering practices. The calculation is to take into 
consideration the flow resistance of the bursting disc device, 
piping and piping components (tees, elbows, reducers, 
valves, etc.), and entrance and exit losses. Per ASME 


SectionVIII, the calculated flow capacity is to be multiplied 
by 0.9 to determine the relief capacity of the bursting disc 
system. Finally, the flow resistance coefficient, K R , of the 
bursting disc device is typically to be supplied by the 
manufacturer (who will have measured it per the certifica¬ 
tion requirements of ASME VIII). If manufacturer’s data 
are not available, a value of 2.4 is to be used for K R . 

12.20.3 Bursting disc sizing: two-phase flow 

The standards and codes described refer to, but do not give 
calculation methods for, two-phase flow in bursting discs. 
Methods for two-phase flow, including the case of reactor 
venting, are considered in Chapter 15. 

12.20.4 Bursting disc sizing: safety factors 

A discussion of safety factors applicable to bursting discs 
and relief systems is given in Appendix 13. 

12.20.5 Bursting disc failure 

Like a relief valve, a bursting disc may suffer functional or 
operational failures. In other words, it may fail to burst at 
the set burst pressure and thus fail to danger, or it may 
burst below that pressure and thus fail prematurely but, 
generally, be safe. 

Some of the principal modes of failure of a conventional 
bursting disc are fatigue, creep and corrosion. Pulsation of 
the fluid pressure induces fatigue, while high temperature 
causes creep and contributes to fatigue. 

Another type of failure is caused by blockage. Blockage 
may occur on the process side and may be caused by corro¬ 
sion, crystallization or polymerization. It can also occur on 
the vent side. 

Malinstallation constitutes a third type of failure. The 
disc may be installed upside down. Another example of 
malinstallation is putting more than one disc in the holder. 
Discs are sometimes supplied in stacks and in this case 
duplication may be a simple error. In other cases, the use of 
more than one disc is done deliberately to avoid frequent 
bursting, particularly during commissioning. 

Reverse buckling discs are thicker and less prone to 
fatigue, creep and corrosion, but they have their own char¬ 
acteristic failures. One of these is ‘roll through’.The dome of 
the disc becomes dented and it rolls through onto the knife 
but with insufficient energy to cause bursting. 

In a reverse buckling disc equipped with knife blades, 
the condition of the knife is critical. It may suffer corrosion, 
cracking or blunting so that it is no longer capable of cut¬ 
ting. Failure of a reverse buckling disc may also occur if 
there is insufficient energy to cause cutting of the disc. 
This is particularly liable to occur on liquid systems. 

Malinstallation is another type of failure with a reverse 
buckling disc. Again the disc may be put in upside down. 
This may occur where the fitter is accustomed to installing 
conventional discs and is insufficiently alert to the differ¬ 
ence between the two. 

Information on the failure rate bursting discs is given in 
Appendix 14. 


12.21 Overpressure Protection: Installation of 
Relief Devices 

In addition to the factors already considered, it is necessary 
in the design of a relief system to pay close attention to the 
installation of the relief devices. The installation of relief 
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devices is treated in API RP 520 Pt II, the CCPS Engineer¬ 
ing Design Guidelines (CCPS/13), the IChemE Relief Systems 
Guide , and the CCPS Relief Systems Guidelines (CCPS/NN). 

12.21.1 API RP520: Part II 

A prime source of guidance on the installation of relief 
devices is API RP 520 Pt II: 1994 Sizing, Selection and 
Installation of Pressure-relieving Devices in Refineries, Part II, 
Installation. This deals with the following topics: (1) general, 
(2) inlet piping, (3) discharge piping, (4) isolation valves, 
(5) bonnet or pilot vent piping, (6) drain piping, (7) valve 
location and position, (8) bolting and gasketing, (9) multiple 
pressure-relieving devices with staggered settings, and 
(10) pre-installation handling and inspection. 

12.21.2 Inlet piping to pressure relief valves 

A pressure relief valve should be mounted directly on the 
vessel which it protects at a dedicated nozzle unless there is 
good reason to do otherwise. Similar considerations apply 
to bursting discs. 

Cases where a pressure relief valve may be positioned 
at some short separation from the vessel include those 
where this improves access, allows the valve to be put 
outside the insulation, reduces the valve temperature, 
minimizes the vibration to which the valve is subject, or 
permits improved drainage of the discharge pipework. 

Where a pressure relief valve is connected to the vessel by 
piping, the desirable features of this piping are that it should 
be short, full bore, vertical and self-draining with low pres¬ 
sure drop and exerting minimum stress on the equipment. 

12.21.3 Reaction force from pressure relief valve 
discharge 

The reaction forces due to discharge from a pressure relief 
valve can he appreciable and need to be allowed for in the 
design. Accounts of reaction forces are given in API RP 521 
Pt II: 1994 and the IChemE Relief Systems Guide and by 
Moody (1969, 1973), Stikvoort (1986), Huff (1990, 1991), 
Hansen (1991), and Leung (1992,1998). 

API RP 520 Pt II gives a relationship for the reaction 
force for the case where the pressure relief valve is mounted 
vertically with its discharge entering a pipe which runs a 
short distance horizontally, then through a 90° elbow, and 
vertically upwards. The equation is: 


F : 


W ( kT \ 1/2 
366 \(&+ l)AfJ 


+ 41 ()P 2 


[12.21.1] 


where Aq is the area of the outlet at the point of discharge 
(in. 2 ), F is the reaction force (lb f ), k is the ratio of specific 
heats of the gas, Mis the molecular weight of the gas, P 2 is 
the static pressure at the point of discharge (lb f /in. 2 ), T is 
the absolute temperature (°R) and Wis the mass flow of gas 
(lb/h). The reaction force is exerted downwards on the hor¬ 
izontal section. The code shows a support between this 
section and the vessel. 


12.21.4 Isolation of relief devices 

There are certain circumstances in which it would be 
convenient to be able to isolate a relief device on an operating 
vessel. This is particularly the case where the device needs 
to be removed for maintenance. Any such isolation is 
restricted by regulatory requirements and by good practice. 

In British legislation, as described in Section 12.12, 
steam boilers and air receivers have long been subject to 


specific requirements. It has not been permitted even to 
install an isolation valve between a steam boiler and its 
safety valve. For air receivers, BS1123: Part 1:1987 permits 
the installation of an isolation valve between the vessel 
and its safety valve, provided (1) that the source of supply is 
also isolated by the same valve and (2) the receiver is 
fitted with a fusible plug. For process vessels, the installa¬ 
tion of an isolation valve between the vessel and its 
relief valve without further precaution is regarded as bad 
practice. 

BS 5500:1991 does, however, provide in appendix J for 
installation of isolation valves subject to the following 
conditions: ‘Intervening stop valves or cocks may be 
installed provided that they are so constructed and con¬ 
trolled by mechanical interlocks that a limited number only 
can be closed at any one time and that those stop valves or 
cocks which remain open are adequately sized to permit 
the unaffected pressure relieving devices to discharge at 
the required capacity for the vessel’. Thus, there must be 
at least duplicate pressure relief valve systems and there 
must be a mechanical interlock between the two systems. 

ASME Section VIII specifies that there shall be no inter¬ 
vening stop valves between a vessel and its relief 
device except when (1) the stop valves are constructed or 
positively controlled such that closing the maximum 
number of stop valves at one time will not reduce the avail¬ 
able relief capacity below the required value, or (2) the 
stop valve is installed for inspection or repair purposes 
only, is installed such that it can be locked or sealed open, 
and shall be closed only by an authorized person who shall 
remain stationed at the stop valve during the period of the 
vessels operation while the valve remains closed and who 
shall relock or reseal the valve open before leaving that 
station. 

The fitting of an isolation valve on a single relief device is 
permitted in some companies, provided that there are strict 
administrative controls. A case in point might be the fitting 
of an isolation between a liquid relief device and the 
space protected. It may be a condition of such exemption 
that it be shown by hazard assessment that the probabi¬ 
lity of a demand during the period of valve isolation is 
acceptably low. 

The requirements of the Pressure Systems Regulations 
1989 given in Regulation 4(5) have been quoted in Section 
12.12. Guidance is given in COP 37:1990. This states: ‘every 
plant item in which the pressure can exceed the safe oper¬ 
ating limit for pressure should be protected, whenever 
operational, by at least one pressure relieving or pressure 
limiting device.’ 


12.21.5 Overpressure protection: design basis 
documentation 

The design basis of a process unit’s pressure relief system 
is widely recognized as a key element of the unit’s process 
safety information (see Chapter 6, and CCPS nn/YYYY, 
OSHA 29 CFR 1910.119, EPA 40 CFR 68). The US EPA, in 
guidance materials for its Risk Management Program 
(EPA,‘General Guidance for Risk Management Programs’ 
(40 CFR Part 68)), has defined the relief systems design 
basis in the following manner: 

Design basis means documenting how the loads and 
sizes of the relief system, as well as inlet and outlet sizes, 
were determined. This includes a description of over¬ 
pressure scenarios considered, the scenario that creates 
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the largest load to be relieved, the assumptions used, and 

if the device meets a certain code.... Industry codes (e.g. 

API RP 520) also provide guidance on scenarios that 

should be considered and on equations for sizing of 

devices. 

In documenting pressure relief systems, Berwanger and 
Kreder, (Kreder and Berwanger, 1995; Berwanger and 
Kreder, 1998) have argued that an equipment-based rather 
than a relief-device-based approach is necessary, giving 
two central reasons. First, the purpose of the relief system 
is to ensure that the entire process unit - that is, every 
pressure-containing component - is protected against 
potential overpressure. Accordingly, the rationale for each 
equipment item’s need for - or lack of need for - over¬ 
pressure protection must be documented. Second, having 
the relief device, with its specification and purchase, be 
central to the documentation of the relief system design 
has traditionally placed exclusive emphasis on documen¬ 
tation of the ‘worst-case’ overpressure scenario. Subsidiary 
cases that may have been considered in the original 
system design are documented insufficiently, or not at 
all (particularly when the relief device specification 
sheet is the only piece of documentation that is main¬ 
tained). When process changes are considered years after 
original commissioning, these subsidiary cases may 
become governing. Because of their poor or missing doc¬ 
umentation, these cases are then overlooked by plant 
engineers - rarely experts in relief system design - 
contemplating the consequences of the process change 
under consideration. 

As evidence of the need for an equipment-based 
approach, Berwanger and Kreder cite statistical analysis of 
their findings in detailed revalidations of the pressure 
relief systems in over 400 process units in the chemicals, 
refining, and oil production sectors of the process indus¬ 
tries during the period 1994 through 2002 (Berwanger 
et al., 2000; Berwanger, 2002). These studies reviewed the 
overpressure protection of some 42,000 equipment items, 
provided by approximately 25,000 relief devices. Evaluat¬ 
ing these relief systems against design standards specified 
by the owner/operators of the process units, these studies 
found that 12% of the equipment items analysed were left 
unprotected against one or more credible overpressure 
scenario. These results are in substantial agreement with 
those of Parr (1998), who reports one study in which 25 % of 
the relief systems evaluated were found to be inadequately 
documented (i.e. the basic purpose of the design was 
unclear), and another study in which UK HSE personnel 
over a 10-year period found that nearly 40% of reportable 
pressure systems incidents were associated with equip¬ 
ment not fitted with a relief valve. Berwanger et al. (2000) 
note that nearly all of the process units in their studies 
found to have unprotected equipment had recently under¬ 
gone Process Hazard Analysis (PHA) studies, and con¬ 
clude that this finding is attributable to the ‘traditional’ 
approach of documenting the adequacy of each relief 
device. The authors reiterate the need for a paradigm shift 
to documenting the adequacy of the protection of each plant 
equipment item. 

The core purpose of the relief system design basis doc¬ 
umentation is two-fold: (1) to ensure that the entirety of the 
process unit is adequately protected against all credible 
sources of overpressure, and (2) to ensure that this design 
basis information is available to all interested parties 


throughout the operating life of the unit. These goals may 
be satisfied if the documentation captures the analysis 
process of the original designers of the unit’s pressure 
relief system. The key steps in this design process given by 
Kreder and Berwanger (1995) are: 

(a) for each equipment item, identify all potential scenar¬ 
ios that can credibly lead to overpressure; for these, 
and for commonly occurring scenarios that may have 
been deemed not credible, document the rationale for 
the identification of the scenario as potentially caus¬ 
ing overpressure (or not) 

(b) for each overpressure scenario identified as credible in 
(a), calculate the required relief flow rate 

(c) for each flow rate calculated in (b), specify a relief 
device with the set pressure, flow capacity, and instal¬ 
lation location required to protect the associated 
equipment item(s) against overpressure. 

(d) for each credible overpressure scenario and combina¬ 
tion of scenarios, ensure that the relief devices are 
equipped with effluent handling systems to dispose 
safely of the relief streams while not compromising 
the performance of the relief devices. 

The Process Safety Management committee of the 
DIERS Users Group has recommended a list of information 
to be included in all pressure relief system documentation 
(Lee, 1996). In addition to data concerning the individual 
relief device, the equipment it protects, and the inlet and 
outlet piping associated with the device, the list includes 
‘summary of all relief cases considered, including the worst 
credible design case’, and a description of ‘containment, 
handling, and treatment of relief device effluents’. 

12.22 Flare and Vent Systems 

A principal method of disposal of gases and vapours dis¬ 
charged from the process is flaring. The function of a flare 
system is generally to handle materials vented during 
(1) normal operations, particularly start-up and (2) emer¬ 
gency conditions. 

Guidance on flare system design is given in API RP 521: 
1990, on which much of the other literature draws heavily. 
Accounts of flare systems are given in Flare Gas Systems 
Pocket Handbook (Bannerjee, Cheremisinoff and Cher- 
emisinoff, 1985), the CCPS Engineering Design Guidelines 
and the IChemE Relief Systems Handbook and by Bluhm 
(1961, 1964b), Husa (1964), G.R. Kent (1964, 1968, 1972), 
P. Peterson (1967), Tan (1967a,b), Kilby (1968), Seebold 
(1984), Straitz (1987), Swander and Potts (1989) and Tite, 
Greening and Sutton (1989). 

12.22.1 Types of flare system 

There are three main types of flare system: (1) elevated 
flare, (2) ground flare, and (3) low pressure flare. The last 
two are described first. 

12.22.2 Ground flares 

A ground flare generally consists of a battery of tubular 
burners contained in a short refractory-lined stack, which 
serves as combustion chamber and windshield. The bottom 
of the stack is above grade so that the combustion air can 
enter. Typically, this air inlet is provided with a louvred 
shield to maintain flame stability and masks the glare from 
the flame; the stack is circular or square in cross-section 



2/68 PRESSURE SYSTEM DESIGN 


and it is set inside an octagonal windshield. The elements 
of a ground flare system are knockout drum, seal drum, 
burner system, ignition system, stack and windshield. 

In one design of ground flare systems, the height Hoi the 
stack is about 0.3D, where D is the diameter of the com¬ 
bustion chamber, and the bottom of the stack wall is also 
about 0.3D from grade. Other designs of ground flare are 
described by Swander and Potts (1989), who give illustra¬ 
tions of designs ranging from a completely open flare to one 
with a quite high stack. There are also variations in the 
number of burners, some low volume ground flares having 
just a single burner. Details of ground flare systems are 
given in the IChemE Guide. 

A ground flare may be favoured where there is a limita¬ 
tion on the height of the flare which can be installed. Inso¬ 
far as the products of combustion are discharged relatively 
close to ground level, a ground flare is not suitable if these 
gases are noxious or pollutant. Flare glow and noise may 
also be limiting factors. 

12.22.3 Low pressure flares 

There are in process plants various low pressure units 
which may produce an off-gas stream. These include sto¬ 
rage tanks, and oil-water separator and wastewater treat¬ 
ment units. These off-gases may be routed to a low pressure 
flare. The tightening of controls on the emission of volatile 
organic compounds increases the number of situations 
where a low pressure flare may be needed. There are avail¬ 
able a number of designs of low pressure flare such as small 
‘stick’ flares. 

The principal problems and hazards of a low pressure 
flare arise from the fact that the pressure in the discharging 
unit may be barely sufficient to maintain the flow. The 
pressure drop in the low pressure header should be calcu¬ 
lated with care and the header adequately sized. Not all 
computer programs used for header design are suitable 
for this case, and it may be necessary to resort to hand 
calculation. 

Where the discharge source pressure is insufficient, use 
may be made of a blower installed in the off-gas line. The 
use of an off-gas blower, however, is not an ideal arrange¬ 
ment in that it introduces rotating equipment which may 
fail and which may have the potential to act as a source of 
ignition. Designs based on off-gas blowers are discussed in 
the CCPS Guidelines. 

12.22.4 Elevated flares 

Elevated flares are used to handle both normal and emer¬ 
gency loads and are generally the system of choice except 
where environmental considerations prevent their use. An 
elevated flare is a normal feature of a refinery or a petro¬ 
chemical plant. 

A flare system consists of a flare stack and of gathering 
pipes which collect the gases to be vented. Other features 
include the flare tip, which typically has steam nozzles to 
assist entrainment of air into the flare, seals installed on the 
stack to prevent flashback of the flame and a knockout 
drum at the base of the stack to remove the liquid from the 
gases passing to the flare. 

A typical elevated flare system is illustrated in the widely 
quoted diagram from API RP 521 shown in Figure 12.19. 
The elements of this system are gas collection pipework, 
knockout drum, seal drum, flare stack, flare tip, molecular 
seal, ignition system, steam injection system and purge 
system. 


12.22.5 Flaring policy 

The type of flare system required and the associated 
hazards depend very much on the venting and flaring poli¬ 
cies adopted. Thus, for example, the decision to vent certain 
cold columns of an ethylene plant direct to the atmosphere 
can greatly reduce the size of the system and avoid the need 
to use the special steels required to handle cold gases. 

The emergency load on the flare is highly dependent on 
factors such as the extent to which trip systems are used to 
reduce the frequency of discharges from pressure relief 
valves and on the staggering of such discharges. 

Descriptions of practice in flaring include those given in 
the CCPS Guidelines, and the IChemE Guide, and by Barker, 
Kletz and Knight (1977), Bonham (1977), R. Schwartz and 
Keller (1977) and Straitz etal. (1977). 

12.22.6 Flare system hazards 

There are a number of hazards associated with a flare sys¬ 
tem. These include (1) failure of the collection system 
pipework due to low temperature embrittlement or corro¬ 
sion, (2) obstruction in the flare system, (3) explosion in the 
flare system, (4) heat radiation from the flare, (5) liquid 
carryover from the flare, and (6) emission of toxic materials 
from the flare. 

Even if these features are not such as to present a hazard, 
the latter three may be environmentally objectionable. 
Other features which cause environmental problems are 
(1) smoke in the flare, (2) glare from the flare, and (3) noise 
from the flare. 

12.22.7 Flare collection system 

The collection system which gathers the gas and vapour to 
be flared may comprise a single system or a set of systems 
in which different types of stream are sepegated. Brittle 
fracture of the pipework in the gathering system is a 
hazard if the temperature of the steel is taken below its 
transition value. It may be necessary to use stainless steel 
in parts of the pipework where this condition may occur. 
Stainless steel may also be required for highly corrosive 
gases. The use of such steel is expensive, however, and the 
amount used is kept to a minimum. The extent to which 
stainless steel is required depends on the discharge and 
segregation policies adopted. 

The CCPS Guidelines distinguish the following cases: 
(1) cold gas, (2) intermediate gas, (3) hot gas and (4) sour gas. 
Typical cold gas is ethane and lighter hydrocarbons flash¬ 
ing at or below -45°C.The material of construction used for 
the header is commonly austenitic stainless steel. Most 
gaseous effluents are hot wet gases above 0°C which are 
generally collected in a header made of carbon steel. Liquid 
droplets are separated in the knockout drum. A third class 
of gaseous effluent is cold dirty gases at a temperature 
intermediate between 0 and -45°C. For these use is fre¬ 
quently made of a header constructed in killed carbon steel. 

Certain processes give rise to sour gas streams contain¬ 
ing appreciable concentrations of hydrogen supplied which 
are toxic and corrosive. A sour gas stream is often provided 
with its own header, made of stainless steel. This segrega¬ 
tion avoids the use of an expensive steel for the whole gas 
collection system. Frequently a separate flare is also used, 
which gives better control of the flaring. 

Separate collection systems may also be provided for low 
and high pressure gas streams. The size of the system is 
generally governed by the low pressure streams, but if the 
system is to take all the discharges, it must be designed for 
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Figure 12.19 Typical flare system (American Petroleum Institute, 1990 API RP 521): (a) flare system; and (b) alternative sealing system. Note: this figure represents an 
operable system arrangement and its components. The arrangement of the system will vary with the performance required. Correspondingly, the selection of types and 
quantities of components, as well as their applications, should match the needs of the particular plant and its specifications. FRC, flow recorder controller; FT, flow 
transmitter; FV, flow valve; LAH, level alarm (high); LC, level controller; LG, level gauge; LSH, level switch (high); L V, level valve; PAL, pressure alarm (low); PI, pressure 
indicator; PSL, pressure switch (low); TIC, temperature indicator controller; TV, temperature valve; XCV, steam trap 
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the highest pressure which it could experience. It can be 
more economic to use a separate high pressure collection 
system with smaller piping. 

Elements of the collection system are the various relief 
headers, the piping from the individual valves discharging 
into these headers and the flare header connecting these 
relief headers to the flare itself. 

12.22.8 Flare system 

The flare system consists of the collection system, the liquid 
knockout and seal drum system, the flare assembly and the 
ancillary equipment. The collection system is described in 
the next section. The flare assembly comprises the flare 
stack itself and the associated components, notably (1) the 
flare tip, (2) the pilot burners, (3) the pilot igniters, and (4) the 
steam injection system. Between the collection system and 
the flare stack comes the knockout and seal drum system. 
This typically includes a knockout drum and a seal drum, 
and may also have a quench drum. 

12.22.9 Flare stack 

The flare stack itself is tyically self-supporting or sup¬ 
ported by guy wires. Associated components are (1) the 
flare tip, (2) the pilot burners, (3) the pilot igniters, (4) the 
steam injection system, and (5) the flame monitoring 
instrumentation. 

The process design of the flare stack is essentially the 
determination of the stack height and diameter. API RP 521 
gives one design method. The stack height is basically 
governed by the heat radiation from the flare, which is 
described below. 

The stack diameter is set by the gas velocity. API RP 521 
suggests that the design aim for a flare tip Mach number of 
0.2 at normal gas flows and 0.5 for short, infrequent peak 
flows. It also states that a smokeless flare should be sized 
for the conditions under which it will operate smokelessly. 

Flare stack conditions are discussed further in Chapter 16. 
Discussion of the other elements in the flare system is 
deferred until the flare stack obstruction and explosion 
hazards have been considered. 

12.22.10 Flare system obstruction 

Obstruction of the flare system is a hazard which can occur 
in a number of ways. One is the blockage of devices such as 
flame arresters and molecular seals. Another is the freez¬ 
ing of water seals in cold weather. 

In some flare systems steam is injected at the base of the 
stack. The combination of contact with a cold gas such as 
ethylene and of cold weather may cause the water inj ected to 
freeze. There may also be other fluids in the flare system 
which are liable to freeze in cold weather. Freezing points of 
two common hydrocarbons are: benzene 5°C and cyclo¬ 
hexane 6.5°C. 

The solidification of heavy oils can create blockage. 
Blockage can also be caused by refractory debris at the base 
of the flare stack, unless this is catered for in the design. 

12.22.11 Flare system explosion 

In a flare system there is a hazard that air will enter and 
form a flammable mixture. The hazard is particularly 
serious, because a source of ignition is always present in 
the form of the flame on the flare tip. Air may enter the flare 
system due to factors such as open valves or corrosion, or 
by diffusion down from the flare tip when the flame is not 
operating. 


There are three specific conditions which are conducive 
to entry of air into the flare stack. One is when flaring has 
just ceased and cooling and shrinkage of the gas column in 
the stack draws air in. Another is when the gas being flared 
is light, especially if it is hydrogen, so that the pressure at 
the bottom of the stack is lower than atmospheric and air 
may enter through any apertures. The third is when the 
flare stack creates a natural draught and air leaks in at the 
bottom. 

The precautions taken against the hazard of an explo¬ 
sion in a flare system divide into those aimed at avoiding a 
flammable mixture, such as (1) use of purge gas, (2) elim¬ 
ination of leaks, (3) monitoring the oxygen concentration, 
and those directed to mitigating the results of any ignition 
which may occur, such as (4) the use of flame arresters. 
Associated measures include the use of (5) molecular seals 
and (6) seal drums. 

The discharge of waste gas to the flare system is inevi¬ 
tably somewhat erratic. If the gas flow falls too low and if 
there are air leaks into the system, a flammable mixture 
may form. Also if the gas flow is too low, the flame may go 
out, flash back down the stack or start pulsating. It is com¬ 
mon practice, therefore, to maintain the gas flow in the flare 
system. This purge is usually a fuel gas. A method of cal¬ 
culating the purge gas rate is given by Husa (1964). 

The best approach to the prevention of explosions in flare 
systems, however, is to prevent air from getting into the 
system in the first place and to monitor the oxygen content 
to check that this has been achieved. The elimination of air 
inleak into the pipework should be a specific objective.The 
prevention of air inleak through open valves is particularly 
important. 

Air may also enter the system by diffusion down the 
stack when the flare is not operating. A molecular seal is 
often installed to prevent this. The use of molecular seals 
(described below) effects a large reduction in the purge 
gas flow required to prevent air diffusion down the stack. 

The oxygen concentration in the flare system should be 
monitored. This is necessary in order to ensure that a large 
air inleak does not develop undetected. 

The elimination of air inleak by the measures just 
described is preferable to the use of large purge gas flows to 
dilute such inleak. Devices which are used to guard against 
flashback of the flame down the stack are flame arresters 

12.22.12 Seal drums 

A device widely used to prevent ingress of air from the flare 
stack into the gas collection system is a seal drum in which 
the gas passes through a water seal. API RP 521 gives one 
design for a seal drum together with the method of sizing. 
The IChemE Guide gives further design details. 

A seal drum is generally designed for an internal pres¬ 
sure of at least 50 psig in order to withstand an internal 
explosion. Two problems with water seals are the creation of 
an uninterrupted gas passage through the water at high gas 
flows, which can render the seal ineffective, and the ten¬ 
dency to surge, which can affect operation of the flare. 
Proprietary water seals are available which are designed to 
overcome both these difficulties. 

Another difficulty with water seals is the loss of the 
water from the seals. A further disadvantage of water seals 
is that they tend to freeze in cold weather. This problem is 
sufficiently serious that some operators prefer not to use 
them at all. 
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12.22.13 Molecular seals 

A molecular seal is a device designed to limit the rate at 
which air can flow back into the flare stack. The principle of 
operation is to make the air flow through a set of concentric 
tubes in which it suffers reversals of direction so that its 
flow is reduced. A molecular seal is best located close to the 
top of the stack. 

The benefit of a molecular seal is economy of purge gas. 
Molecular seals have the disadvantage that they tend to 
block up. One cause of blockage is corrosion products 
from the stack. Another is blockage by water or ice. In cold 
climates, prevention of ice formation requires the use of 
heating. 

12.22.14 Flashback arresters 

One common device for preventing passage of a flame 
along a pipe or stack is the flame, or flashback, arrester. 
A disadvantage of flame arresters is the tendency for the 
small passages to become obstructed. This problem is 
sufficiently serious that some companies do not use them. 

12.22.15 Flare combustion and smoke control 

Brzustowski and co-workers (Brzustowski, 1973, 1977; 
Brzustowski and Sommer, 1973; Brzustowski et al., 1975) 
have studied the fundamentals of combustion in flare sys¬ 
tems. Efficient combustion in the flame depends on 
achieving good mixing between the fuel gas and the air, 
and avoidance of a pure diffusion flame. Failure to achieve 
efficient combustion results in a smoky flame. 

There are various methods which are used to promote 
efficient combustion. One of the principal methods is steam 
injection. The main function of the steam is to increase the 
entrainment and mixing of the air. The steam also takes 
part in the water gas shift reaction 

C + H 2 0 = C0 + H 2 


at the root of the flame, where the difference in the heat 
radiated by a smoky and by a non-smoky flame is particu¬ 
larly pronounced. 

There are a number of problems involved in achieving 
positive ignition and in retaining a flame on the flare tip as 
well as in preventing flashback. These problems are parti¬ 
cularly difficult where the turndown ratio is high, which is 
often the case. 


12.22.16 Flare heat radiation 

The flare stack radiates intense heat which constitutes a 
potential hazard. The flame on a flare stack is often several 
hundred feet long and has a heat release of the order of 10 7 
BTU/h. There is intense heat radiation from a flare. It is 
generally necessary, therefore, to have an area around the 
flare in which people do not normally work. A large flare 
can thus sterilize a sizeable area of land. It may be accep¬ 
table in some cases, however, to locate certain types of 
equipment within the flare compound, provided that the 
time which personnel have to spend in the compound is 
strictly limited. 

Methods of caculating the heat radiated from a flare are 
given in API RP 521: 1990. This code gives the following 
equation based on the work of Hajek and Ludwig (1960): 


D = 


'iFQ \ 1/2 
,4 nKj 


[12.22.2] 


where D is the distance from the centre of the flame, F is the 
fraction of heat released which is radiated, K is the allow¬ 
able intensity of heat radiation, Q is the net heat release rate 
and t is the atmospheric transmissivity. 

Combustion in the flare is a complex process. In Equa¬ 
tion 12.22.2 this complexity is subsumed in the factor F. 
This factor has traditionally been taken as a property of the 
fuel only. Some typical values of Fare: 


and the steam reforming reaction 
C^+H 2 0 = xC0 + zH 2 

Alternatively, low pressure air may he used to assist the 
entrainment and mixing of the atmospheric air. 

There are available a number of proprietary flare tips 
for steam injection. One which is widely used is the Zink 
S type, which has a ring of small jets around the tip of 
the flare. 

The equation given in API RP 521 for the amount of 
steam injection required to give a smokeless flare is that 
of Tan (1967): 

W st = W HC (o.68 - M > 16 [12.22.1] 

where Mis the molecular weight of the gas, W HC is the mass 
flow of hydrocarbons (kg/s) and IF st is the mass flow of 
steam (kg/s). This is based on maintaining a steam/C0 2 
mass ratio of about 0.7. 

The control of the state of the flame by the manipulation 
of the steam supply has traditionally been done by the 
process operator relying on visual observation. Automatic 
control is difficult, because it is not easy to obtain a good 
measure of the state of the flame. One automatic system 
now in use is based on the measurement of the heat radiation 


Gas 

F 

Reference 

Methane 

0.16 

Brzustowski and Sommer (1973) 

Propane 

0.33 

G.R. Kent (1964) 

Butane 

0.30 

Brzustowski and Sommer (1973) 

Ethylene 

0.38 

Brzustowski and Sommer (1973) 


It has been shown, however, that the F factor depends also 
on other features of the flame such as the Reynolds number. 
The Ffactor is discussed by Brzustowski (1977) and Straitz 
etal. (1977). 

Models of the flame on a flare are considered in Chapter 16. 
Guidance on the permissible level of heat radiation from 
a flare in different situations is given in API RP 521 and BS 
5908:1990. Further discussions of acceptable levels of heat 
radiation are given by G.R. Kent (1964), R. Schwartz and 
Keller (1977) and Straitz et al. (1977). This aspect is con¬ 
sidered in Chapter 16. 

12.22.17 Liquid carryover in flares 

Liquid carryover from the flare stack may result in a more 
smoky flame, in dispersion of burning drops of flammable 
material or dispersion of drops of toxic material. Liquid 
drops as small as 15 pm can negate the devices used for 
smokeless operation and give a smoky flame. The principal 
means used to prevent liquid drops reaching the flame is 
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the use of a knockout drum at the base of the stack. It is 
sometimes difficult, however, to eliminate completely spray 
and condensation. 

12.22.18 Toxics in flares 

In some flares, gases containing materials such as chlorine 
and sulfur are burned, giving compounds such as HC1 and 
S0 2 . In such cases the flare stack should be sufficiently 
high to prevent unacceptable ground level concentrations 
of these toxic gases. 

12.22.19 Flare environmental problems 

Smoke, glare and noise from a flare are environmentally 
objectionable. The elimination of smoke has already been 
discussed. There is relatively little which can be done to 
eliminate light from the flame. If this is a serious problem, it 
may be necessary to use a low level enclosed burning 
system instead of a flare. Flare noise is discussed in 
Appendix 12. 

12.22.20 Combined flare systems 

In some installations, the flaring arrangements consist of 
an elevated flare combined with a ground flare. Normal 
operating and start-up loads are handled by the ground 
flare, while both flares are used to handle the relatively 
infrequent high volume emergency loads. In this way the 
environmental impact of the flaring is kept to a minimum. 

12.23 Blowdown and Depressuring Systems 

The response to a plant emergency may require the dis¬ 
posal of hazardous inventories. This is effected by the 
emergency blowdown and depressuring systems. 

12.23.1 Blowdown systems 

Disposal of liquid streams in an emergency is through the 
blowdown system. An emergency blowdown system has 
two basic features: treatment and disposal. An account of 
blowdown systems is given in the CCPS Engineering 
Design Guidelines. 

Fluids which may require disposal are, in general, 
streams containing volatile organics or mixtures of volatile 
organics and water. More specific cases are reaction fluids 
vented from a reactor and cooling water contaminated with 
organics following a tube burst in a heat exchanger where 
the process fluid is at the higher pressure.The streams to be 
disposed of may contain flammable, toxic, corrosive or 
pollutant substances. 

Blowdown streams may be unsuitable for immediate 
disposal, and may therefore require treatment. Principal 
types of treatment are disengagement of gases and vapours 
from liquid, and quenching to cool and partially condense 
hot vapours. 

Disengagement is effected in a disengagement drum. 
The CCPS Guidelines refer to the API RP 521 knockout 
drum design. In a typical disengagement operation, invol¬ 
ving a mixture of organics and water, the vapour is sent to a 
flare and the organic and water phases are separated by 
gravity in the drum. 

Quenching is carried out in a quench nozzle, a quench 
drum or a blowdown drum. In a quench nozzle, water is 
injected to effect at least partial condensation of the 
blowdown fluid. In a quench drum, condensation of the 
blowdown fluid is effected by spraying water or other liquid 


onto it. The CCPS Guidelines refer to the API RP 521 quench 
drum design (figure D-2). 

A blowdown tank is charged with an inventory of solvent 
through which the blowdown fluid is sparged, effecting 
condensation. The design of blowdown tanks for high rate 
releases of short duration has been discussed by Fauske 
and Grolmes (1992). 

The sinks to which the liquid effluent part of a blowdown 
stream may be sent include a clean water sewer, an oily 
water sewer, a closed drain header and a tank for further 
treatment. The CCPS Guidelines give a detailed discussion. 

12.23.2 Depressuring systems 

Disposal of vapours from equipment at pressures below 
those of the pressure relief devices is by means of the 
emergency depressuring system. Depressuring is used to 
reduce hazard by removing vapour or gas from an equip¬ 
ment. This may be necessary where the equipment may fail 
at a pressure below the set pressure of the pressure relief 
valve, as in fire engulfment of a vessel which is filled with 
gas or one which contains some liquid but in which part of 
the walls is unwetted. Another situation where depressur¬ 
ing may be appropriate is where there may be benefit in 
anticipating the operation of the relief, as in the depres¬ 
suring of a reaction runaway. A third case is where the 
equipment pressure is very high (say, 1000 psig) where 
depressuring reduces both the inventory and the stress in 
the equipment. 

12.24 Pressure Containment 

An alternative to pressure relief is pressure containment. 
This may be effected by ensuring that the system is suffi¬ 
ciently strong that any pressure generated is contained. 
This approach is currently applied only to a relatively lim¬ 
ited extent. A discussion of the potential for wider appli¬ 
cation is given by Wilday (1991). 

12.24.1 Problems of pressure relief 

Protection against overpressure by the provision of pres¬ 
sure relief has a number of disadvantages. In general, 
pressure relief involves the use of an active system which is 
subject to failure and has to be inspected and maintained, 
and which may operate spuriously. 

Pressure relief creates the problem of relief disposal. 
Environmental pressures make this an increasingly oner¬ 
ous matter. The basis for the design of the disposal train is 
often not well defined. The demands on the disposal train 
will be rare and its reliability in responding to them 
uncertain. 

In some cases pressure relief is not a practical option. 
This is the case, for example, where the vent area on a 
reactor is simply too large to fit on the vessel. 

12.24.2 Inherently safer design 

The containment approach to overpressure protection 
requires that all the potential sources of overpressure be 
identified. Generic sources include (1) flow in, (2) momen¬ 
tum effects, (3) heat input, and (4) chemical reaction. 

Likewise, in principle, it is necessary to identify all the 
potential sources of underpressure. Generic causes of 
underpressure include (1) flow out, (2) heat removal, and 
(3) chemical reaction. However, vacuum-causing events, such 
as vapour condensation, are often difficult to quantify. 
Thus in the case of underpressure the practical approach is 
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often to design for full underpressure. The pressure devia¬ 
tion scenarios, including combinations, should then be 
considered and a credible worst case determined as the 
basis of design. 

Design for full overpressure is assisted if sources of 
overpressure can be designed out. Wilday (1991) gives as 
examples (1) heat exchanger tube failure, (2) process heat¬ 
ing, and (3) runaway reactions. A heat exchanger with high 
pressure gas in the tubes and liquid in the shell can present 
a difficult case for pressure relief. If the design is to be 
based on the common assumption of full bore rupture of a 
single tube, a large two-phase flow may be generated and 
the pressure relief requirement is severe. One solution may 
be to eliminate the pressure differential by raising the 
liquid pressure. 

Other aspects of heat exchanger tube failure considered 
by Wilday include the use of a non-reactive cooling medium 
to eliminate reaction between the material cooled and 
cooling water and the merits of using air-cooled heat 
exchangers. 

In the heating of a liquid, the total pressure due to the 
vapour pressure of the liquid and the partial pressure of 
non-condensablegasescanbehigh.Methodsof dealing with 
this problem include the use of a lower vapour pressure 
liquid, the provision of adequate gas space, the limitation of 
the heat input, the prevention of isolation of the equipment, 
and the use of a sufficiently high design pressure. 

The measures suggested for avoidance of high pressure 
in reactors include laboratory screening to identify reac¬ 
tion exotherms and decompositions, use of a low vapour 
pressure solvent, avoidance of accumulation of reactants, 
use of a semi-batch configuration with one component fed 
continuously, and provision of a trip to cut off the feed. 

12.24.3 Safety instrumented systems 

One approach to the elimination of sources of overpressure 
is the use of safety instrumented systems. The use of such 
systems as an alternative to pressure relief is relatively 
limited and generally subject to strict conditions. Several 
international standards for the criteria and methods for the 
design and application of these systems have recently been 
promulgated by the ASME (Code Case 2211,1996), the ISA 
(S84.01,1996), and the IEC (IEC 61511, 2003). Guidance is 
provided by CCPS (2001/MM), Karcher et al. (1996). 

The use of an instrumented protective system requires 
that all the sources of high pressure be identified and pro¬ 
tected against. Another problem is that such a system is an 
active one, with the disadvantages already mentioned. 
Nevertheless, where the pressure relief option also poses 
severe difficulties, as in some reactor relief situations, there 
has been considerable interest in the use of instrumented 
protective systems. Work on the options for overpressure 
protection of reactors is described in Chapter 11. 

Examples of the use of instrumented protection given 
by Wilday are (1) the protection of plant downstream of a 
pressure letdown valve by a trip which shuts a trip valve 
and (2) the protection of a reactor by a trip which shuts off 
the feed. 

IEC 61511, Functional Safely - Safely Instrumented Sys¬ 
tems for the Process Industry Sector is published in three 
parts. Part 1 provides the overview and core of the standard; 
it is entitled Framework, Definitions, System, Hardware and 
Software Requirements. It is divided into 19 sections, which 
deal with issues such as safety life cycle requirements, pro¬ 
cess hazard and risk analysis, allocation of safety functions 


to protective layers, SIS safety requirements specification, 
SIS design and engineering, factory acceptance testing, and 
SIS installation and commissioning, safety validation, 
operation and maintenance, modification, and decom¬ 
missioning. This overview document describes the frame¬ 
work of the standard and the relationship between IEC 61511 
and IEC 61508. 

Part 2, referred to as 61511-2, is titled Guidelines for the 
Application of 61511-1. It has an organizational structure 
that is clause-by-clause identical to that of 61511-1, so as to 
provide clear, concise guidance on the application of that 
Part 1. 

Part 3, 61511-3, is called Guidance for the Determination 
of the Required Safety Integrity Levels, and is divided into 
only three sections - scope, terms and definitions, and risk 
and safety integrity - general guidance. It also contains 
six informative annexes. 

12.24.4 Problems of, and scope for, containment 

Containment also has its problems. One general problem is 
protection against external fire. If a vessel is engulfed in a 
fire it is liable to fail due to overtemperature of the metal, 
even though the normal failure pressure has not been 
attained. There may also be additional hazards such as a 
liability of the material held to decompose. 

There are certain measures which may be taken in some 
cases to limit the degree of potential fire exposure such as 
elimination or reduction of flammable materials near the 
vessel, provision of fire insulation and, possibly, location of 
the vessel above the level at which flame impingement 
could occur, but the overall conclusion is that it is very dif¬ 
ficult to protect against external fire by containment. 

There are certain types of equipment, such as atmo¬ 
spheric storage tanks, to which overpressure protection by 
containment is not applicable. The same applies to certain 
reactors. Wilday suggests that a plant protected solely by 
containment would be likely to be designed for a relatively 
high pressure and for full vacuum and would require to be 
engineered so as effectively to eliminate the external fire 
hazard or the need for fire relief. However, even if a policy of 
full containment is not adopted, the principles described 
may be used to limit the extent of pressure relief needed. 

12.25 Containment of Toxic Materials 

Some plants handle substances which rank as high toxic 
hazard materials (HTHMs) and the pressure system must 
ensure their containment. Guidance is given in the CCPS 
Guidelines for Safe Storage and Handling of High Toxic 
Hazard Materials (1988/3) (the CCPS HTHM Guidelines), 
which covers a wide range of topics. These guidelines are 
considered in Chapter 22. Many aspects are dealt with in 
other parts of the present text. Table 22.10 gives an indica¬ 
tion of the chapter or section where relevant material is to 
be found. 

Containments for HTHMs should be designed and con¬ 
structed to standards which are higher than average. This 
applies to, among other things, the vessel wall thickness 
and connections, the materials of construction, the welds 
and the quality control. 

12.25.1 Storage tanks and vessels 
US standards and codes applicable to the storage of 
HTHMs include API Std 620: 1990, API Std 650: 1988 
and the ASME Boiler and Pressure Vessel Code 1992. Also 
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relevant is the ASME B31.3: 1990 Chemical Plant and 
Petroleum Refinery Piping Code. 

API Std 650 is the standard for large oil storage tanks 
and has limited relevance to HTHMs. The safety factors 
and welding standards are less stringent and the tank relief 
is to atmosphere. The more relevant standard is API Std 
620. For storage of larger quantities of HTHMs the pre¬ 
ferred method will often be the use of refrigerated storage. 
This is dealt with in the standard in appendices R and Q 
which treat, respectively, tanks for refrigerated liquids 
stored in the temperature range 40 to -60°F and those 
stored at temperatures in the range down to -270°F. 

Tank designs for refrigerated storage given in API Std 
620 include both single and double wall metal tanks, but in 
the latter the outer wall is not intended to withstand major 
failure of the inner tank, either in respect of the hydrostatic 
head or of the temperature of the liquid stored. A more 
suitable design is one incorporating a high bund close 
to the metal tank. The CCPS Guidelines refer to that given 
the CIA Refrigerated Ammonia Storage Code, which is con¬ 
sidered in Chapter 22. Materials of construction for refri¬ 
gerated storage of HTHMs need to possess both the 
necessary impact toughness and corrosion resistance. 

In design of storage tanks for HTHMs, particular atten¬ 
tion should be given to features such as the foundations, the 
weld radiography and the pressure testing. API Std 620 
contains stress relief requirements which are given in 
appendices Hand I. 

With a storage tank designed to API Std 620 the pressure 
relief is generally designed for normal ‘breathing’; and for 
operational variations. These arrangements are less sui¬ 
table for HTHMs, for which there are more severe restric¬ 
tions on release to atmosphere. It may be necessary to use a 
closed relief and vent system. If direct relief to atmosphere 
is permissible, a rupture disc should not be used alone, as it 
does not reclose after opening. 

API Std 620 contains provisions by which fire relief may 
be provided by a rupture seam. The CCPS Guidelines state 
that a rupture seam is not normally acceptable for HTHMs. 
The implication of this is that there need to be specific 
alternative arrangements for fire relief. Whatever arrange¬ 
ments are adopted, it is essential to ensure that the tank 
does not rupture at the wall -floor seam, which would allow 
discharge of its entire contents. 

For storage vessels, the ASME Boiler and Pressure Vessel 
Code recognizes lethal service. It states that ‘by lethal 
substances are meant poisonous gases or liquids of such a 
nature that a very small amount of gas or of the vapour of 
the liquid, mixed or unmixed with air, is dangerous to life 
when inhaled ... this class includes substances of this 
nature which are stored under pressure or which may gen¬ 
erate a pressure if stored in a closed vessel.’ 

The minimum wall thicknesses given in pressure vessel 
codes may yield for small vessels at low pressure relatively 
thin walls, and it may be prudent for certain HTHMs to use 
a thicker walled container. A suggestion made in the CCPS 
Guidelines is the use of compatible DOT cylinders. 

The nozzles are frequently the weak points on a vessel 
and for containment of HTHMs they need to be of high 
integrity. Measures to ensure this include high nozzle spe¬ 
cifications, use of sufficient thickness and of suitable welds 
and avoidance of small nozzles and of excessive projection. 
The CCPS Guidelines recommend that: nozzles should 
preferably be to Class 300 flanged welding necks; all 
nozzle-to-shell welds be full penetration welds; nozzles of 


less than 1-1.5 in. nominal bore (NB) be avoided, or at least 
protected; and nozzles less than 2 in. NB do not project 
more than 6 in., or be provided with additional strength or 
protection. 

Since for HTHMs avoidance of catastrophic failure is of 
particular importance, use should be made of fracture 
mechanics so that, where practical, the vessel operates in 
the lower risk ‘leak-before-break’regime. This is discussed 
in Section 12.28. 

12.25.2 Pipework 

As for tanks and vessels, so for piping - design and con¬ 
struction for HTHM service should be to high standards. 
Some features of high integrity pipework have been dis¬ 
cussed in Section 12.7. Only those aspects are considered 
here where the toxicity of the material is of particular 
relevance. 

ASME B31.3 recognizes a Category M Fluid Service in 
which the potential for personnel exposure is judged to be 
significant, and in which a single exposure to a very small 
quantity of a toxic fluid, caused by leakage, can produce 
serious irreversible harm to persons upon breathing or 
bodily contact, even when prompt restorative measures are 
taken. Chapter VIII of the code deals with Category M Fluid 
Service. 

It is preferable that filling and discharge lines enter a 
storage tank through the top, thus avoiding piping pene¬ 
tration below the liquid level. However, for discharge this 
requires the use of submerged pumps, which may con¬ 
stitute a maintenance problem. 

The pipework should have an adequate degree of fire 
protection. Whereas, in general, the emphasis in fire pro¬ 
tection is avoidance of further releases which could feed the 
fire, in the case of HTHMs it shifts rather to the avoidance 
of serious toxic release. It follows that for HTHMs it may be 
necessary to provide pipework with protection which 
would otherwise be considered unnecessary. The CCPS 
Guidelines recommend a fire resistance of at least 30 min 
at 1100°E 

12.25.3 Limitation of release 

There are a number of devices which may be used to shut off 
or reduce releases of HTHMs. These include EIVs, NRVs, 
excess flow valves, restrictor orifices and pump trips. 

Storage tanks and vessels for HTHMs should be pro¬ 
vided with emergency isolation valves or control valves 
with separate shut-off facilities. Other situations which 
may merit an emergency isolation valve are a large vapour 
line on a pressurized storage vessel and a long pipeline. 

NRVs, or check valves, can be used with the purpose 
of preventing back flow out of a tank in the event of rupture 
of a liquid line on it, but are notoriously unreliable and 
are not suitable as the sole device in a critical duty. The 
flow from a line may be reduced by the use of an excess 
flow valve or a restrictor orifice. Another measure is 
remote shut-off of pumps providing the pressure behind 
the release. 

12.25.4 Secondary containment 

There are a number of arrangements which can be used to 
contain a release and prevent its escape to atmosphere. 
Such secondary containments include double-walled 
equipment, enclosures and bunds. Pressure relief and vent 
systems are also sometimes so classified. Common to all 
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these arrangements is the need to provide in addition some 
form of disposal system. 

Double-walled equipment is used particularly for sto¬ 
rage tanks. In particular, the principle is exploited in the 
design of large refrigerated ammonia storage tanks. This is 
described in Chapter 22. 

The double-wall principle is also used to a limited extent 
for pipework. One system involves the enclosure of the pipe 
carrying the HTHM in a second, concentric pipe. The 
annular space between the two pipes is filled with inert gas 
either at a pressure higher than that in the inner pipe or at 
a lower pressure with monitoring to detect leakage of the 
toxic fluid. An alternative system involves the use of double 
seals on flanges and of bellows seals on valves, both purged 
with monitored inert gas. 

The use of an enclosure building provides another form 
of secondary containment but allows accumulation of small 
leaks. It therefore requires the provision of toxic detectors 
and alarms and of ventilation and disposal systems. Where 
toxic liquids are handled, it is also necessary to provide for 
their retention, collection and disposal. The sump should 
be of small cross-sectional area but deep, in order to mini¬ 
mize vaporization. If there is a possibility of an internal 
overpressure sufficient to cause structural damage, con¬ 
sideration should be given to this. 

Material from the pressure relief and depressuring, or 
blowdown, devices should be collected in a closed relief or 
vent header system. This is usually a common header, 
though in some instances this approach may need to be 
modified in order to avoid a problem arising from the 
interconnection of systems. The header typically passes to 
a knockout drum or catchpot and then to the disposal sys¬ 
tem, usually a flare or scrubber. Disposal systems are con¬ 
sidered in Chapters 11 and 22. 

12.26 Pressure Systems for Chlorine 

As just described, the design of pressure systems for 
hazardous materials requires special consideration. This is 
illustrated by the requirements for chlorine, which is 
highly toxic and, if wet, very corrosive, and which is pro¬ 
duced in large tonnages. 

The handling of chlorine is treated in the publications of 
the Chlorine Institute, including the Chlorine Manual (1986 
Pamphlet 1). The generally used code has been the Chemi¬ 
cal Industries Association (CIA) Code of Practice for Che¬ 
micals with Major Hazards: Chlorine (BCISC, 1975/1) (the 
CIA Chlorine Code). Another CIA publication has been 
Guidelines for Bulk Handling of Chlorine at Customer Instal¬ 
lations (1980/9). These are both now superseded by HS(G) 
28 Safety Advice for Bulk Chlorine Installations published by 
the Health and Safety Executive (HSE, 1986) in cooperation 
with the CIA; it is this document which now appears in the 
CIA publication list. 

An account of chlorine as a chemical is given in Chapter 
11. The storage of chlorine is considered in Chapter 22 and 
its transport, including pipeline transport, is discussed in 
Chapter 23. The principles of chlorine handling are, in large 
part, applicable to the handling of many other chemicals 
which are toxic, irritant and non-flammable, and are made 
on a large scale. 

12.26.1 Chlorine and chlorine plants 

Typically, chlorine is produced in integrated systems in 
which part of the production is liquefied and transported 


away and part is consumed as gas in user plants within the 
works. Such a system is illustrated in Figure 18.11. 

The quantity of chlorine handled in a producer plant, or 
cell room, is generally much greater than in a user plant. In 
a producer plant the important thing is to be able in an 
emergency to stop the production of the gas quickly and so 
avoid a large release to atmosphere. This requires that 
means be provided to detect this need, to communicate it 
and to shut-down rapidly and safely. There should be facil¬ 
ities for emergency venting of the chlorine to gas absorp¬ 
tion plant. 

In a user plant, the size of potential chlorine release is 
usually less, but the operating conditions tend to be more 
arduous. In such a works chlorine is handled both as gas 
and as liquid (see Chapter 11). Particularly important in 
chlorine handling are the facts that wet chlorine attacks 
mild steel and that chlorine forms the unstable explosive 
compound nitrogen trichloride. 

12.26.2 Materials of construction 

The usual material of construction for dry chlorine is mild 
steel. If the chlorine is wet, however, it attacks mild steel 
severely. It is essential, therefore, for water to be excluded if 
mild steel is to be used for handling chlorine. Corrosion is 
particularly severe with liquid chlorine if there is a sepa¬ 
rate water phase. The corrosiveness of wet chlorine also 
depends on the temperature. 

The Chlorine Code states that the normal dissolved water 
content of chlorine is 20—60 ppm and that this is satisfac¬ 
tory for the common materials of construction. In con¬ 
formity with BS 3947, commercial chlorine should have a 
maximum water content of 100 ppm. 

Mild steel equipment for use with dry chlorine itself 
needs to be dried out before commissioning. HS(G) 28 
recommends purging with air or inert gas down to a dew¬ 
point of -40°C. 

Corrosion of mild steel by chlorine is also affected by 
temperature. The Chlorine Code states that attack is sig¬ 
nificant at about 200°C and rapid at about 230°C and that it 
is normal practice to impose a limit of 120°C. This is the 
normal limit advised by HS(G) 28, for example, for steel 
tubes in chlorine vaporizers. 

Materials widely used for handling wet or dry chlorine 
gas include ebonite-lined mild steel or reinforced polyester 
resin. Glass and stoneware may also be used in appropriate 
applications. With certain exceptions, plastic materials are 
unsatisfactory for liquid chlorine. Another material which 
can be used for chlorine gas or liquid up to about 100°C is 
titanium, but only provided that the fluid is wet; titanium is 
attacked by dry chlorine. If this material is used for wet 
chlorine, therefore, there must be assurance that it will not 
be contacted with dry chlorine, even under fault conditions, 
otherwise some alternative material should be selected. 
There are available carbon steels which are suitable for the 
low temperatures found in the normal handling of chlorine. 

12.26.3 Vessels, pipework and equipment 

Pressure systems for handling chlorine should be of a par¬ 
ticularly high standard, with appropriate attention paid to 
control of impurities, isolation arrangements, protective 
devices, pressure relief arrangements and protection 
against external damage. 

Chlorine vessels are designed to normal pressure vessel 
codes but with the additional requirements stated in 
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HS(G) 28. Storage tanks and vessels for chlorine are dis¬ 
cussed in Chapter 22. For chlorine process vessels, parti¬ 
cular consideration should be given to possible impurities 
in the chlorine, which are a more severe problem in process 
than in storage. 

Chlorine pipework may carry chlorine gas in which the 
presence of liquid is excluded, chlorine gas which may 
contain some liquid, or liquid chlorine. Pipelines are 
designed for dry gas, wet gas and dry liquid. HS(G) 28 
gives guidance on pipework for liquid chlorine. The pipe¬ 
work should be designed, fabricated, inspected and tested 
to a recognized code. The design pressure should be in 
accordance with the code, but in any case not less than 
12 barg which corresponds to a design temperature of 45°C. 

Seamless steel tubing is preferred, but resistance seam 
welded tubing that has been welded and stress relieved 
automatically during manufacture is acceptable. The 
number of flanged joints should be kept to a minimum. All 
butt welds should be fully radiographed or ultrasonically 
examined. 

Gaskets used for liquid chlorine are of compressed 
asbestos fibre and should be to BS 2815 Grade A. The use 
of an incorrect gasket for chlorine can be hazardous and 
gaskets should be tabbed if there is any possibility of 
misidentification. 

Pipelines should be sited so as to be as safe as possible 
from impact, fire or other threats. They should be protected 
from external corrosion, but accessible for inspection and 
maintenance. 

HS(G) 28 gives less guidance on lines for chlorine gas. 
The following guidance is given in the Chlorine Code , but it 
should be borne in mind that it is somewhat dated. Gas 
pipelines in which it is known with confidence that there 
will be no liquid chlorine are usually designed so that they 
are sufficiently strong to withstand the highest pressure 
which can be applied or so that relief is inherent in the 
design, and do not normally require relief devices. Pipe¬ 
lines for gas which may contain liquid are operated at 
rather higher pressures than the previous ones, hut are not 
necessarily designed for the full pressure which could arise 
from the vaporization of trapped liquid chlorine. Usually 
some relief capacity is necessary to cater for any liquid 
present and this should be considered in relation to the gas 
absorption facilities. Often such pipelines contain vapor¬ 
ized chlorine. It may be appropriate to provide trace heat¬ 
ing. This is necessary if the lowest winter temperature to 
which the pipeline is exposed could cause formation of the 
liquid. The gaskets used for dry gas are compressed 
asbestos fibre, whilst those for wet gas are a special rubber. 
Although the latter is suitable for low pressure dry gas, it is 
quite unsuitable for liquid or high pressure gas. It is 
essential, therefore, that means such as tabbing be pro¬ 
vided to ensure that the correct gasket is used. 

Liquid pipelines may be subject to overpressure caused 
by hammer blow resulting from rapid closure of valves and 
by thermal expansion of the liquid. Slow-acting valves and 
surge vessels may be used to protect against hammer blow 
from liquid chlorine. Good communication between opera¬ 
tors is also helpful in reducing this problem. 

Liquid chlorine has a high coefficient of thermal expan¬ 
sion and the possible effects of liquid thermal expansion 
should always be considered in liquid chlorine pipework 
systems. The trapping of liquid between two valves should 
be minimized by a combination of design and operations 
measures. Liquid trapping is particularly likely to occur if 


there is a proliferation of valves which can close auto¬ 
matically. This may be avoided by the judicious use of a 
proportion of valves which are manually operated. 

Traditionally, for small lines the industry has placed 
some reliance on liquid thermal relief by the springing of 
flanged joints. Thus, the Chlorine Code states that on smal¬ 
ler systems the release may he relatively small and harm¬ 
less, and indicates that in order to provide such relief 
flanged joints should not be eliminated completely. 

HS(G) 28 states that if the capacity of the system is such 
that a release could have serious consequences, automatic 
means of relief should be provided and that reliance on the 
springing of flanged joints for thermal relief is not accep¬ 
table. It refers to two means of relief: (1) a bursting disc 
discharging to a suitable disposal system and (2) an 
expansion tank designed to accommodate the gas phase. 

The Chlorine Code states that an expansion bottle or 
other relief device is normally used if: 

(1) the system is fully welded and includes no flanged 
joints; 

(2) there is a substantial length of pipework involved 
such that the volume of chlorine released in easing a 
potential pressure would be significant; 

(3) the two valves, the closure of which traps the liquid 
chlorine, are under the control of different operators 
and there is a reasonable chance of this occurring 
without either being aware of it; 

(4) overpressure due to external causes can be foreseen. 

However, it also states that an expansion bottle is effective 
only provided it contains non-condensable inert gas and 
does not fill up with liquid. HS(G) 28 states that, in view of 
the difficulty in determining whether the gas space con¬ 
tains chlorine or inert gas, the use of such a device is not 
recommended for new installations. 

Arrangements for pressure relief of chlorine pipelines 
using these two systems are given in HS(G) 28. In both 
cases the relief volume needs to be at least 20% of the line 
volume. Figure 12.20 shows the two systems. Figure 
12.20(a) gives the bursting disc system. The disc relieves 
into a pressure vessel fitted with a pressure alarm and vents 
from there to the disposal system. Figure 12.20(b) gives the 
expansion vessel system. There is a heating system to 
maintain the temperature at around 60°C. There are a 
number of further design requirements, which are given in 
the guide. In each case the vessel used should be a pressure 
vessel and entered as such in the pressure vessel register. 

The possibility of low temperature embrittlement should 
be considered carefully for pipelines carrying liquid 
chlorine. The line may be subjected to temperatures down 
to the normal boiling point of chlorine (-34°C) or even 
lower. Pipelines carrying liquid chlorine are liable to ice up 
on the outside and to corrode under the ice, and require to 
be protected by suitable wrapping or painting. 

Valves for chlorine pipelines should be carefully chosen, 
particularly in respect of corrosion resistance, strength 
against possible overpressures, leak-tightness of the gland 
and ease of removal and maintenance. Some requirements 
for valves in liquid chlorine systems are given in HS(G) 28. 
Such valves should preferably be in forged steel, and in any 
event not in cast iron. If the valve is of a type in which liquid 
chlorine may become trapped, measures need to be taken to 
prevent the development of excessive pressure due to tem¬ 
perature rise. The types of valve referred to in HS(G) 28 as 
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Figure 12.20 Overpressure protection arrangements for chlorine pipelines (Health and Safety Executive, 1986 HS(G) 
28): (a) bursting disc system; and (b) expansion vessel system (Courtesy of HM Stationery Office. Copyright. All rights 
reserved) 


suitable for liquid chlorine or dry chlorine gas are (1) ver¬ 
tical globe valves, (2) conical plug valves and (3) ball valves. 
Detailed guidance is given on each type. 

Isolation arrangements are particularly important in 
chlorine systems. A single valve should not be relied on to 
give complete isolation. More positive isolation is required 
using means such as the provision of spool pieces which 
can be removed and replaced by blanks and the use of slip 
plates. Where the latter are to be utilized, the layout and 
piping should provide for this. Large low-pressure chlorine 
gas mains are particularly difficult to isolate effectively 
due to the size of the line and the dirtiness of the gas. Ease 
of removal of valves and of insertion of slip plates is espe¬ 
cially important in such systems. 

Every item of equipment which contains, and could 
release, a significant quantity of chlorine should have a 


means of isolation and a means of venting to a gas 
absorption unit. Stop valves at inlet and outlet are the 
normal means provided for effecting immediate isolation, 
but the arrangements should facilitate the insertion of 
slip plates. 

Chlorine liquefiers are subject to the general require¬ 
ments for chlorine vessels, but involve some special con¬ 
siderations. The operating temperatures are low and 
require suitable materials of construction. The chlorine 
gas, even after drying, is not completely clean and tends to 
cause blockage and corrosion, so that ease of cleaning is 
important. The refrigerant used should not react with the 
chlorine if there is a leak. 

Likewise, there are some particular considerations in 
chlorine vaporizers. There is a potential for creating over¬ 
pressure. The higher temperatures are conducive to 
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increased corrosion. The impurities, particularly nitrogen 
trichloride, may concentrate and explode. There is a possi¬ 
bility of failure of the heating surfaces. Materials of con¬ 
struction for chlorine vaporizers should withstand both the 
temperatures and impurities. There should be effective 
control on pressure, temperature and level. Pressure relief 
should be provided and should take account of the possi¬ 
bility of heating surface failure. There should be specific 
arrangements to prevent concentration of nitrogen 
trichloride. The effects of heating surface failure should be 
thoroughly reviewed and means provided for its prompt 
detection. Chlorine vaporizers are utilized by users of 
chlorine which are not necessarily large chemical works. A 
robust design is therefore important. A further discussion 
of chlorine vaporizers is given in Chapter 22. 

12.26.4 Compressors, pumps and padding 

Compressors are used to re-compress chlorine vapour and 
need to be suitable for intermittent operation. Dry carbon 
ring and diaphragm types are used, the latter having dou¬ 
ble stainless steel diaphragms with inert fluid in between. 
The shaft of a carbon ring compressor needs to be sealed so 
as to prevent escape of chlorine and ingress of moist air. The 
shaft glands should be pressurized during operation with 
dry inert gas. After use the compressor should be purged 
with dry air to prevent leakage of residual chlorine. 

The temperature rise in the compressor may need to be 
controlled. The cooling arrangements should take account 
of the possibility of water leaks. Direct water cooling 
should be avoided. It is preferable to use air cooling. The 
compressor should have a bypass allowing the chlorine 
to be recycled so that its temperature is high enough to 
avoid liquefaction in the delivery lines. There should, 
however, be an alarm which will activate if the temperature 
exceeds 90°C. 

In general, transfer of liquid chlorine may be effected 
by the use of (1) chlorine vapour at the vapour pressure of 
the liquid, (2) dry compressed chlorine vapour, (3) dry 
compressed padding gas, and (4) pumping. The choice of 
method for different applications such as transfer from 
storage to consuming units and unloading from tankers to 
storage is discussed in HS(G) 28. For the former, all four 
methods are listed, but with the first two preferred, whilst 
for the latter the third method is the preferred one, with the 
second as a possible alternative. 

In many cases, transfer of liquid chlorine from storage 
may be effected under the vapour pressure of the liquid. If 
this method is used, factors to be taken into account are the 
effect on the vapour pressure of low external temperatures 
and the need to maintain in the vessel a positive pressure, 
which should be specified. Alternatively, liquid chlorine 
may be transferred by pressure of gas, such as dry air or 
nitrogen, or of chlorine vapour from a vaporizer or com¬ 
pressor. HS(G) 28 gives the following guidance. 

Gas used for transfer of liquid should be a dedicated 
supply. Nitrogen at pressure may be obtained from a liquid 
nitrogen vaporizer. Compressed air can be provided by an 
air compressor. It is highly desirable that this be an oil-free 
machine; if oil lubrication is used, the machine should have 
an oil filter which is regularly maintained. Measures 
should be taken to ensure that the air is dried to a dewpoint 
of -40°C. The padding gas, nitrogen or air, should have its 
own pressure control and pressure relief arrangements. It 
should be held in a gas receiver with a relief valve set to 
operate at the safe working pressure of the chlorine plant or 


150 psig, whichever is the lesser. Further detailed require¬ 
ments are given in the guide. 

Chlorine vapour for padding may be obtained by recom¬ 
pression of vapour from a storage vessel or by vaporization 
of liquid chlorine. The storage vessel from which transfer is 
made should have a design pressure and pressure relief 
arrangements which protect against pressures which the 
padding gas or vapour can develop. It should also have a 
relief to the gas absorption facilities. 

It may be necessary to pump liquid chlorine if it has to be 
delivered at a higher pressure (say, 100 psig) or if the use of 
dry padding gas is for some reason inappropriate. Some of 
the problems in pumping chlorine are discussed in the 
Chlorine Code. Pump cavitation can be a problem in pump¬ 
ing chlorine, which tends to vaporize. It is essential to pro¬ 
vide sufficient liquid head on the suction side to avoid 
liquid flashing. Severe cavitation can damage the pump or 
even cause the casing to fail. Another problem in pumping 
chlorine is seal leakage. This virtually rules out the use of 
rotating shaft seals. Liquid chlorine pumps are generally 
canned, diaphragm or submersible types. The code recom¬ 
mends that centrifugal pumps should be provided with a 
bypass to a pumping tank to prevent liquid boiling and that 
a positive displacement pump should have a pressure relief 
valve on the outlet bypassing to the suction. 

HS(G) 28 describes the use of an arrangement in which 
liquid chlorine is transferred from a storage vessel using a 
canned pump. There should be sufficient NPSH and a 
remotely operated emergency isolation valve installed 
either inside the vessel or between it and the pump. The 
guide also discusses the use of submersible pumps. 

12.26.5 Pressure relief and gas absorption 

The philosophy of pressure relief for chlorine has tradi¬ 
tionally been somewhat different from that for most other 
materials. It is stated in the Chlorine Code thus: 

(1) Any relief system shall be regarded as a safeguard of 
last resort; its existence shall not be regarded as 
an alternative to providing protective systems and 
operating instructions such that process conditions 
cannot, in the absence of human or equipment failure, 
lead to the relief conditions arising. 

(2) Relief to atmosphere shall be sanctioned only as a last 
resort when the consequences of not doing so would be 

(3) A relief device shall not be isolated unless approved 
alternative arrangements to protect the vessel have 
been made. 

Likewise, the philosophy in HS(G) 28 for chlorine 
systems lays emphasis on prevention of overpressure with 
pressure relief as a last resort. These measures include 
(1) prevention of overfilling of storage tanks by use of 
weighing systems or of ullage pipes giving warning of 
entry of liquid into vent lines, combined in both cases with 
alarms and (2) prevention of overpressure by pressure 
control and relief on the padding gas system and storage 
vessel high-pressure alarms. 

As a last line of defence, a chlorine storage vessel should 
be provided with pressure relief.This pressure relief should 
be provided by a bursting disc rather than a relief valve, 
because chlorine tends to corrode the latter. The relief 
should normally pass to an expansion vessel. For a simple 
system consisting of a single storage tank and expansion 
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tank, a single bursting disc system may suffice, installed 
directly on the storage vessel without isolation valves. A 
system commonly found on much existing plant is two 
bursting discs in series with a pressure alarm on the inter¬ 
vening space and with isolation valves upstream and 
downstream of this assembly, with both valves locked 
open. The preferred arrangement is two such assemblies of 
bursting discs and isolation valves in parallel. In this case 
one arrangement is that the valves are interlocked and 
another that the upstream valves and at least one down¬ 
stream valve are locked open. 

Where there are several storage vessels, they may each be 
provided with an expansion vessel or there may be a com¬ 
mon expansion vessel. An expansion vessel should have a 
capacity at least 10% of the largest storage vessel. It should 
be capable of being vented manually to an absorption sys¬ 
tem. It should be fitted with a high pressure alarm to indi¬ 
cate build-up of chlorine. Any necessary measures should 
be taken to ensure that the expansion vessel is not itself 
overpressurized. 

Arrangements should be made to ensure that facilities 
exist for absorption of chlorine gas vented by the pressure 
relief system. In some installations, there are chlorine¬ 
consuming plants to which the relief gas can be routed, and 
a separate gas absorption facility may be deemed unne¬ 
cessary. In this case, it is essential to ensure that the 
absorption capability is available whenever it may be 
required. Usually it is necessary to provide a separate gas 
absorption facility. This should be a high reliability plant 
with adequate redundancy and comprehensive instru¬ 
mentation. HS(G) 28 gives detailed recommendations. 

The pressure relief arrangements should cater for fire 
relief as well as operational relief. In some cases it may be 
necessary to provide protection against the risk of explo¬ 
sion of chlorine with other gases, particularly hydrogen. 
The design of such explosion relief is a specialist matter. 
The Chlorine Code refers to the possible need for explosion 
relief to atmosphere in unavoidable cases, and states that 
this a matter for expert advice. HS(G) 28 does not consider 
this eventuality. 


12.27 Failure in Pressure Systems 

Maintenance of the integrity of the pressure system and 
avoidance of loss of containment is the essence of the loss 
prevention problem. It is necessary, therefore, to consider 
the failures which occur in pressure systems. Of particular 
importance are catastrophic failures in service. 

Catastrophic failure of a properly designed, constructed 
and operated pressure vessel is comparatively rare. The 
most common cause of such failure is inadequate opera¬ 
tional procedures. Most failures in pressure systems occur, 
however, not in pressure vessels but in the rest of the 
system, which includes pipework, valves and fittings and 
equipment such as heat exchangers and pumps. 

The problem of failure in pressure systems is treated here 
by first describing some principal causes of failure, parti¬ 
cularly sudden failures, and then giving some historical 
data on failure. In the present context it is service failures 
which are of prime importance. Service failures of pressure 
systems are generally caused by exposure to operating 
conditions more severe than those for which the system was 
designed. 

It is usual to classify service failures as (1) mechanical 
failure, through stress and fatigue and (2) corrosion failure, 


although many failures have an element of both of these. 
Accounts of causes of failure in pressure systems are 
given in Defects and Failures in Pressure Vessels and 
Piping (Thielsch, 1965) and Inspection of Chemical Plant 
(Pilborough, 1971,1989). 


12.27.1 Materials identification errors 

Mistakes in identifying materials of construction which 
result in the construction of plant using the wrong materi¬ 
als are a significant problem. Such errors are particularly 
likely to occur where the materials have a somewhat 
similar appearance, for example low alloy steel and mild 
steel, or stainless steel and aluminium-painted mild steel. 
It is necessary, therefore, to exercise careful control of 
materials. Methods of reducing errors involve marking, 
segregation and instrument spot checks. For critical 
applications, is may be necessary to carryout a full 100% 
in situ check on materials using an instrument such as a 
Metascope. 

Misidentification of materials and some accidents 
caused by it have been described by WD. Clark and Sutton 
(1974). In 1984, a leak due to erosion failure on a hydro¬ 
carbon liquid line at Fort McMurray, Alberta, resulted in a 
major fire (Case HistoryA109). The investigation found that 
inadvertently an 18 in. long section of carbon steel had been 
inserted into an alloy steel line. 


12.27.2 Mechanical failure 

Some common causes of mechanical failure in process 
plant are: 

(1) excessive stress; 

(2) external loading; 

(3) overpressure; 

(4) overheating; 

(5) mechanical fatigue and shock; 

(6) thermal fatigue and shock; 

(7) brittle fracture; 

(8) creep; 

(9) hydrogen attack. 

Excessive stress in equipment may be caused by factors 
such as stress raisers or by malpractices such as uneven 
tightening of flanges. 

Equipment may be externally loaded by loads carried on 
additions such as lugs, supports, brackets and hangers. 
Common sources of external loads are platforms, stairs and 
ladders. Movement of foundations may cause external 
loads, as may restraint on thermal expansion of pipework 
passing through concrete walls. Wind and occasionally ice 
may contribute a significant external load. 

Overpressure may occur due to failure of a pressure relief 
valve to fulfil its function. Such failures may be due to poor 
design or incorrect operation, or to relief valve failure. 
Freezing of liquid, particularly in pipework, is another 
cause of overpressure. 

Gross overheating may cause rapid failure due to opera¬ 
tion well outside the temperature range of the material. In 
particular, direct flame impingement can give rise to sud¬ 
den failure. Less severe overheating can cause creep as 
discussed below. 

The other causes of mechanical failure are now 
considered. 
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12.27.3 Mechanical fatigue and shock 

Conditions which give rise to mechanical fatigue include 

(1) pressure variations, (2) flow variations, (3) expansion 
effects, and (4) imposed vibrations. Stress cycling can be 
caused by normal changes of pressure in the process. Nor¬ 
mal flow fluctuations or effects such as hammer blow or 
cavitation also give rise to stress cycles. So do differential 
expansions and contractions of the process plant. Other 
stress cycling is imposed by vibrations from such equip¬ 
ment as compressors, pumps or valves. 

Although there is often some degree of vibration in 
pressure vessels and pipework, it is usually at a sufficiently 
low level as not to cause fatigue failure. In some cases, 
however, fatigue can progress very rapidly. Thielsch quotes 
the case of the fatigue failure of a carbon monoxide gen¬ 
erator which was subjected in a period of only 17 days to 
several hundred million stress cycles. 

Mechanical shock differs from mechanical fatigue in that 
the load is greater and causes failure within only one or a 
few cycles. Shock is often caused by hammer blow or liquid 
slugs. In 1975 at Antwerp, Belgium, a leak of ethylene at 
high pressure due to fatigue failure of a vent connection on 
the suction of a compressor led to an explosion and fire at 
a low-density polyethylene plant (Case History A74). Six 
persons were killed and extensive damage was done. 

12.27.4 Thermal fatigue and shock 

Similarly, the distinction between thermal fatigue and 
thermal shock is that in the latter the applied temperature 
difference and the rate of change of temperature are greater 
and cause failure in one, or a few, cycles. A given tempera¬ 
ture cycle may give rise to thermal fatigue or shock, 
depending on the material. It may constitute thermal 
fatigue for a ductile material, but shock for a brittle one. 
Thermal cycling is caused by (1) intermittent operation and 

(2) particular equipment conditions. 

There are many types of intermittent operation ranging 
from batch processes to throughput changes and including 
forced shut-downs. These all create thermal stress cycles. 
This source of thermal fatigue is much reduced if the plant 
is operated continuously, even though the operating tem¬ 
peratures may be relatively high. 

Thermal fatigue is also caused by the conditions in 
particular types of equipment. Steam desuperheaters 
using direct water spray cooling may suffer thermal fati¬ 
gue failures. Thermal fatigue occurs in reducing valves 
due to repeated flow changes. Slugs of condensate can 
cause thermal fatigue in steam lines. 

12.27.5 Brittle fracture 

The materials used in plant handling low temperature 
fluids should have a ductile-brittle transition temperature 
below not only the normal operating temperature but also 
the minimum temperature which may be expected to occur 
under abnormal conditions. If this requirement is not 
observed and cold fluid contacts metal below the transition 
temperature, brittle fracture may occur. Brittle fracture is 
catastrophic, since the fracture can propagate at a velocity 
close to that of sound. 

In 1973 at Potchefstroom, South Africa, an ammonia 
tank suffered brittle fracture, which resulted in the release 
of some 30 ton of ammonia (Case History A65). The fracture 
occurred in a dished end which was fabricated in carbon 
steel and which had not been stress relieved after manu¬ 
facture. The minimum transition temperatures obtained by 


subsequent testing were 20°C for the fragment and U5°C 
for the remaining part of the dished end. Thus, the metal 
was below its transition temperature under normal operat¬ 
ing conditions. 

The possibility of accidental entry of cold fluids into 
parts of the plant where they are not normally present and 
the resultant hazard of brittle fracture present a difficult 
problem. In general, the best practice is to use suitable 
materials in any part of the plant where it is realistic to 
expect that low temperature fluids could enter under 
abnormal conditions. But alternative means of protection 
such as trip systems may be used in some cases. An exam¬ 
ple of the application of hazard analysis to this problem was 
discussed in Chapter 9. 

Where a liquefied gas is held under pressure, sudden 
depressurization to atmospheric pressure will cause the 
temperature of the gas to fall to its normal boiling point. 
This could be below the transition temperature of the metal 
unless this has been taken into account in the design. 

It is not only the vessels and pipework which may suffer 
low temperature embrittlement, but also features such as 
vessel supports and flange bolts. It is essential, therefore, 
for these latter also to be made of the appropriate material. 

12.27.6 Creep 

The problem of creep at high temperatures has already been 
discussed in Section 12.3. Since design for high tempera¬ 
tures is based on creep strength, failure due to creep is 
usually unlikely under normal operating conditions and is 
generally caused by abnormal conditions such as malopera- 
tion or f ire. It is appropriate to emphasize here the very rapid 
increase in creep rate with temperature. For mild steel in 
the creep range, a temperature increase of about 10-15°C 
is sufficient to double the creep rate. A stress which gives 
an 11-year life at 500°C can result in rupture in 1 h at 700°C. 

Creep involves plastic deformation and, eventually, rup¬ 
ture. However, some metals have a very low ductility in the 
normal creep range, although they are more ductile at low 
and at very high temperatures. Low ductility fractures 
with an elongation of less than 1% are frequently asso¬ 
ciated with the formation of cavities at the grain bound¬ 
aries. The development of cavities can occur at low stress 
over long time periods. The application of higher tempera¬ 
tures and higher strain rates, as in a fire, can accelerate 
cavitation and cause low ductility failure. 

Creep cavitation of stainless steel occurred on the 
plant at Flixborough, as described in Appendix 2. The 
8 in. pipe, which was made of 316L stainless steel, had a 
50 in. rupture which was initiated by creep cavitation. It 
was estimated that for failure in 20 min, a temperature 
of 900-950°C would have been needed. 

If there has been overheating, there may be creep effects 
such as deformation and distortion which can be detected 
by visual examination and by measurement. Often there 
are also oxidation and scaling. But, since creep can occur 
with very little deformation, it may not be readily detect¬ 
able. Expert advice should be sought if this is a possibility. 

Fire on a process plant may result in local overheating 
and hence creep. Equipment should be protected against 
overheating by fixed protection such as fire insulation and 
by fire fighting. If equipment has been exposed to fire so 
that creep may have occurred, expert advice should be 
sought before it is put back into service. 

The process should be operated at the temperatures 
specified. If an alteration is proposed, its effect on creep 
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should be checked. This includes such alterations as 
change in lagging thickness, since this affects equipment 
temperature. 

Further information on creep is given inTDN 53/3 Creep 
of Metals atElevatedTemperatures (HSE, 1977). 

12.27.7 Hydrogen attack 

Mild steel is subject to the following types of hydrogen 
attack: (1) hydrogen blistering and (2) hydrogen embrittle¬ 
ment and damage. 

Hydrogen blistering can occur when atomic hydrogen 
diffuses into steel. Normally the atomic hydrogen diffuses 
right through, but if it encounters voids it forms molecular 
hydrogen, which can generate pressures of several hundred 
bar. Internal splitting of the steel occurs and gives surface 
blisters. Steels which are dirty and contain numerous 
voids, laminations and inclusions are especially prone to 
hydrogen blistering. Hydrogen blistering has been a quite 
common problem in catalytic reformers and has occurred 
at temperatures as low as low as 315°C. It has also been 
reported in butane storage tanks with butane run down 
from a gas separation treatment plant at 21°C. The butane 
was sometimes contaminated with small amounts of water 
with traces of hydrogen sulphide. When corrosion occurs, 
the latter favours the evolution of atomic rather than mole¬ 
cular hydrogen. 

At high temperatures and high hydrogen partial pres¬ 
sures, steels can suffer hydrogen embrittlement and 
damage.The steel suffers decarburization by the hydrogen, 
which causes a loss of ductility, and development of micro¬ 
fissures at the grain boundaries, which leads to loss of 
strength. The decarburization reaction is reversible, but 
the formation of cracks is not. These two effects are some¬ 
times distinguished as hydrogen embrittlement and 
hydrogen damage, but often one of these terms is used to 
describe both phenomena. Both effects are referred to here 
as ‘hydrogen attack’. 

Hydrogen attack has been a relatively common problem 
in equipment handling hydrogen at high temperatures 
such as refinery boilers and catalytic reformers. Failures 
usually occur in the temperature range 300-550°C. The 
resistance of steel to hydrogen attack can be greatly 
increased by the addition of suitable alloying elements, and 
CrMo steels are widely used for hydrogen service. Operat¬ 
ing limits for steels in hydrogen service have been given by 
a number of workers, notably G.A. Nelson (1966). The 
Nelson curves are published with periodic amendments in 
Steels for Hydrogen Service at Elevated Temperatures and 
Pressure in Petroleum Refineries and Petrochemical Plants 
(API, 1991 Publ. 941). Typical Nelson limit curves are illu¬ 
strated in Figure 12.21. These are used to select a suitable 
material. The basis of design for equipment in which 
hydrogen attack may occur is therefore selection of a sui¬ 
table material and use of a design stress less than the lower 
critical stress. 

In 1984 at Romeoville, Illinois, an absorption column 
came apart at the weld and rocketed up, initiating a vapour 
cloud explosion and a series of fires and boiling liquid 
expanding vapour explosions (BLEVEs), in which 17 peo¬ 
ple were killed (Case History Alll). The vessel had a history 
of hydrogen attack problems. 

12.27.8 Corrosion failure 

A large proportion of failures in process plant are due to 
corrosion Accounts of corrosion include Deterioration of 


Materials (Greathouse and Wellel, 1954), Seawater Corro¬ 
sion Handbook (Schumacher, 1979), Basic Corrosion and Oxi¬ 
dation (Q.M. West, 1980), Corrosion Inhibitors (Rozenfeld, 
1981), Corrosion Processes (R.N. Parkins, 1982), Inter¬ 
granular Corrosion of Steels and Alloys (Cihal, 1984), Cor¬ 
rosion Control in the Chemical Process Industries (Dillon, 
1986), Corrosion Engineering (Fontana, 1986), DECHEMA 
Corrosion Handbook (DECHEMA, 1987-), The Chemical 
Engineering Guide to Corrosion Control in the Process 
Industries (R.W. Green, 1987), High Temperature Corrosion 
(Kofstad, 1988) and Corrosion and Corrosion Protection 
Handbook (Schweitzer, 1989). 

Corrosion occurs as (1) general corrosion, (2) local corro¬ 
sion and (3) erosion. In general corrosion, there is a fairly 
uniform deterioration of the overall surface. In contrast, 
localized corrosion involves little generalized corrosion but 
severe local attack, often at points of surface defects or 
stress. Erosion is also localized at points of high velocity or 
impact. 

Some common types of corrosion in process plant, fol- 
lowingThielsch (1965), are 

(1) general corrosion; 

(2) scaling; 

(3) exfoliation; 

(4) galvanic corrosion; 

(5) crevice corrosion; 

(6) corrosion pitting; 

(7) stress-related corrosion 

(a) stress corrosion cracking, 

(b) corrosion fatigue, 

(c) stress-enhanced corrosion; 

(8) intergranular corrosion; 

(9) knife-line corrosion; 

(10) erosion; 

(11) external corrosion. 

It should be emphasized, however, that many corrosion 
failures are not easily classified and may involve more than 
one type of corrosion. Corrosion frequently occurs at welds 
rather than in the parent metal and corrosion at welds 
ranks as a topic in its own right. Accounts of the practical 
treatment of corrosion problems in process plants have 
been given by M. Turner (1987,1988,1989a,b, 1990a,b). 

General corrosion often results from attack by a corrosive 
chemical or impurity over the whole exposed surface. 
Scaling corrosion is the result of oxidation in a gaseous 
atmosphere caused by exposure to high temperatures. It 
occurs particularly in steam boilers. Exfoliation is another 
type of scaling corrosion caused again by oxidation, but in 
a steam atmosphere. Steam-heated boiler feedwater heaters 
exhibit exfoliation. 

There are several kinds of corrosion which are associated 
with concentration cells. In the salt concentration cell, 
which involves a dissolved salt containing ions of the 
metal, there is a difference of salt concentration at two 
parts of the exposed surface. The metal in contact with the 
lower salt concentration becomes the anode and corrodes 
preferentially. In the differential aeration cell, two parts of 
the exposed surface are subject to a difference of oxygen 
concentration. The metal in contact with the lower oxygen 
concentration becomes anodic and corrodes. Such corro¬ 
sion takes two forms: pitting corrosion of an exposed sur¬ 
face, and crevice corrosion in a crevice. The detailed 
mechanisms are described further in relation to crevice 






Figure 12.21 Recommended operating limits of steel for hydrogen service to avoid decarburization and hydrogen attack: Nelson curves (American Petroleum 
Institute, 1991 Publ. 941) (Courtesy of the American Petroleum Institute) 
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corrosion. Both types of concentration cell corrosion occur 
in water containing chloride ions. Galvanic corrosion is 
considered in Section 12.27.9; crevice corrosion in Section 
12.27.10; corrosion pitting in Section 12.27.11; stress-related 
corrosion, including stress corrosion cracking, corrosion 
fatigue and stress-enhanced corrosion, in Section 12.27.12; 
particular forms of stress corrosion in Sections 12.27.13 
and 12.27.14; and inter-granular corrosion, or weld decay, in 
Section 12.27.18. 

Knife-line corrosion takes place between the parent and 
weld metals. It occurs mainly in austenitic stainless steels. 
Erosion and external corrosion are discussed in Sections 
12.27.16 and 12.27.17. 

In 1970 in Brooklyn, New York, a road tanker carrying 
liquid oxygen ruptured violently causing a number of fires, 
with two deaths (Case History A48). The investigation 
found, amongst other things, that there had been a appre¬ 
ciable loss of metal from the aluminium tank shell, even 
though the tank had been in service for only a month. 

In 1988 at Norco, Louisiana, an explosion occurred on a 
catalytic cracker (Case History A121). The cause was a 
release due to internal corrosion of an elbow in the depro¬ 
panizer overhead piping. Some 9 te of hydrocarbons was 
released and there was a vapour cloud explosion. Seven 
people were killed and damage was extensive. 

Some of the types of corrosion mentioned are now con¬ 
sidered in more detail. 

12.27.9 Galvanic corrosion 

Galvanic corrosion is caused by current flowing between 
two dissimilar metals which form a galvanic cell, or bime¬ 
tallic couple. A discussion of galvanic corrosion in process 
plants is given by M. Turner (1990c). 

A typical pair of dissimilar metals which exhibits gal¬ 
vanic corrosion is copper and iron, typically in steel. In this 
case it is the steel which corrodes. The electromotive series 
gives the ranking of metals in descending order of their 
electrode potential relative to that of the hydrogen elec¬ 
trode, the metals higher in the series being the more noble. 
If a galvanic cell is set up, it is the less noble metal which 
suffers the corrosion. The noble metal forms the cathode 
and the less noble one the anode. 

The electromotive series is an imperfect indicator of 
what happens in practice. For this a more relevant guide is 
the galvanic series which ranks metals according to their 
nobility in seawater. Some materials in this series, in des¬ 
cending order of nobility, are 316 stainless steel > ferritic 
stainless steel > copper > low alloy steel > carbon steel > 
aluminium > zinc. However, while the galvanic series is 
applicable to an aqueous medium of wide interest, the 
ranking in other solutions is not necessarily the same. 

In galvanic corrosion, the corrosion rate is a function of 
the potential difference between the two surfaces and the 
slope of the cathodic and anodic polarization curves, which 
may be analysed using the Evans diagram. In neutral 
solutions, particularly with dissolved oxygen, the cathodic 
polarization is crucial. The relative sizes of the cathode and 
anode are also important in this situation. Features which 
reduce cathodic polarizations, and can therefore greatly 
increase the corrosion rate, include agitation and air spar¬ 
ging. A large surface area of the cathode favours an 
increased corrosion rate. 

Galvanic corrosion may occur in equipment incorporat¬ 
ing two dissimilar metals. It can also occur when two such 
metals are joined together at a weld. It may also result from 


the utilization of a second metal as a plated surface. But 
such corrosion can also occur with minor dissimilarities in 
composition such as different metallurgical phases. 

Measures which can be taken against galvanic corrosion 
include the selection of compatible materials and the 
insertion in the circuit of an ohmic resistance, either in the 
metal path or in the ionic path. Examples of the insertion of 
a resistance for these two paths are the use of an insulated 
gasket in pipework and the coating of one of the metal 
surfaces, respectively. 

The purpose of such coating is to protect the less noble 
metal, but it does not follow that it is this metal which 
should be coated. The coating is liable to contain holes, or 
‘holidays’. A couple of coats of paint may still leave gaps of 
perhaps 1% of the area. If the coating is put on the less noble 
metal and gaps exist amounting to 1% of the area, the cor¬ 
rosion at these gaps will simply be enhanced by a factor of 
about 100. 

12.27.10 Crevice corrosion 

Crevice corrosion of steel occurs in crevices sufficiently 
narrow for an oxygen deficiency to occur which leads in 
due course to a build-up of acidity. Its occurrence in process 
plant is described by M. Turner (1989a). 

It is exemplified by the corrosion of carbon steel in salt 
water. In general corrosion of an exposed surface, part of 
the surface acts an anode and part as a cathode. The cor¬ 
rosion can be represented as: 

Fe —* Fe z+ + 2e“ Anodic reaction 

O2 + 2H 2 0 + 4e“ —* 40H - Cathodic reaction 

The location of the anodes and cathodes shifts with time. 

Where the metal surface is within a crevice the situation 
is quite different. The cathodic reaction consumes oxygen 
and the concentration falls, since the rate of diffusion into 
the crevice is slow. A differential aeration cell is set up. The 
metal surface in the crevice becomes anodic relative to the 
exposed surface. The anodic reaction creates ferrous 
ions, which combine with chloride ions to give ferrous chlo¬ 
ride; this oxidizes to ferric chloride, which combines with 
hydroxyl ions from the cathodic reaction to form 
ferric hydroxide. This insoluble hydroxide in turn forms 
ferric oxide, or rust, and hydrochloric acid. The chloride 
ions are attracted to the anode. The water in the crevice 
can become so acidic that corrosion then occurs simply 
by acid attack. 

From this point on, the rate of corrosion is determined by 
the acidity, which depends on the particular solution. In the 
example just given the solution contained chloride. There 
is a rank order of aggressiveness, headed by chlorides, then 
sulfates, phosphates, etc. With crevice corrosion, the cor¬ 
rosion rate can be orders of magnitude greater than with 
general corrosion. 

Crevice corrosion can occur where the two surfaces 
forming the crevice are of the same metal, where they are of 
different metals or where one is non-metallic. In the second 
case there may be bimetallic corrosion as well. 

Many of the situations where crevice corrosion occurs 
involve single-sided fillet welds. It occurs, for example, on 
lap joints with such a weld. On process plants, use is often 
made of a support ring welded around the inside of a vessel. 
The use of a full penetration weld instead of a single-sided 
fillet weld can minimize such corrosion. Another support 
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detail in plants is a pad seal welded to the inside of a thin 
walled vessel to support a heavy internal memher. In this 
case, crevice corrosion may be reduced by making the seal 
weld a continuous one. In some cases, a ‘sentinel hole’ is 
drilled from the outside through the vessel wall to leak test 
the weld; it also serves to provide warning of any leak dur¬ 
ing service. Crevice corrosion occurs at the tube-tube 
plate joints of heat exchangers. It is fairly common in 
threaded joints. 

12.27.11 Corrosion pitting 

Corrosion pitting also involves concentration cell corrosion 
by a differential aeration cell, but in this case without cre¬ 
vice effects. The anode and cathode move over the surface 
of the exposed metal, with the oxygen-lean area acting as 
the anode and suffering preferential corrosion. Pitting is 
favoured by no-flow conditions and by surface defects. It 
occurs in boiler feedwater heaters during shut-down if the 
oxygen content of the feedwater is high. This type of cor¬ 
rosion may be prevented by chemical treatment. 

The resistance of steels to pitting and crevice corrosion 
can be characterized by the pitting index (Henderson, King 
and Stone, 1990) 

PRE n = %Cr + 3.3( %Mo) +16( %N) [12.27.1] 

Broadly, alloy steels with an index value below 32 are sus¬ 
ceptible to pitting and crevice corrosion in salt water, 
whilst those with a value of 36 are resistant. A minimum 
value of 40 is quoted for resistance to hot seawater. 

12.27.12 Stress-related corrosion 

Often failure results from a combination of corrosion and 
stress. Stress corrosion cracking (SCC) is non-ductile fail¬ 
ure caused by the combination of corrosion and static ten¬ 
sile stresses. Corrosion fatigue is caused by corrosion and 
stress cycling. An account of stress corrosion is given in 
The Stress Corrosion of Metals (Logan, 1966). 

Many types of steel are liable to SCC, including mild steel 
and austenitic stainless steel. The stresses necessary to 
cause SCC may be internal or due to externally applied 
loads. Generally, normal operating pressures are not alone 
sufficient to cause such cracking and appreciable internal 
stress must be present. SCC can occur in the parent metal of 
vessels and pipes, in welds and on nozzle connections and 
support attachments. In welds the cracks may be trans¬ 
verse or longitudinal. 

Chlorides are a common cause of SCC. They are a very 
widespread impurity and are rather difficult to eliminate. 
SCC due to chlorides is discussed in Section 12.27.13. There 
is also a form of SCC due to nitrates, which is considered in 
Section 12.27.14. 

SCC caused by an alkaline solution is known as ‘caustic 
embrittlement’, which has been a frequent cause of failure 
in boilers. It is normal to treat boiler feedwater to reduce the 
risk of caustic embrittlement. SCC, particularly by chlor¬ 
ides, can occur externally as well as internally. A common 
cause is the leaching of chlorides from lagging. Some fail¬ 
ures caused by SCC have been described by Ashbaugh 
(1970) and M. Turner (1989b). 

Corrosion fatigue involves a mutual interaction between 
corrosion and fatigue. Corrosion occurs in the fatigue 
cracks. Alternation of stress prevents the build-up of films 
which protect against corrosion. Thus, corrosion reduces 


the fatigue limit and fatigue speeds up the corrosion. In 
consequence, corrosion tends to occur with a wider range of 
chemicals and concentrations than is the case in the 
absence of fatigue. 

Stress-enhanced corrosion describes corrosion at fea¬ 
tures where there are high residual stresses, such as welds, 
nozzles and attachments. Measures to counter stress- 
related corrosion depend on the particular case, but include 
selection of suitable materials, operation in a suitable 
temperature range, elimination of corrodants, reduction of 
residual stresses, reduction of vibrations, and close control 
of operations. 

12.27.13 Chloride stress corrosion cracking 

Chloride SCC occurs in austenitic stainless steels. A dis¬ 
cussion of this form of SCC is given by M. Turner (1989b). 
When a dislocation propagates and a slip plane forms, there 
is a rupture of the protective oxide layer. Although the 
passive film usually reforms on the surface thus exposed, 
in an aqueous solution of chloride ions the repair is imper¬ 
fect and the film contains chloride ions, so that the renewed 
surface has a different composition. The repaired surface 
constitutes an anode and, since it is small relative to the rest 
of the surface which becomes the cathode, rapid corrosion 
occurs. This in turn creates a crack, which propagates along 
the slip plane. The corrosion is further promoted by the 
build-up of acidity at the anodic crack and now becomes 
well established. 

There are four main factors which influence SCC: (1) the 
temperature, (2) the chloride ion concentration, (3) the 
stress, and (4) the grade of steel. SCC rarely occurs at tem¬ 
peratures below 60°C, but above 200°C it can progress 
rapidly, the relevant temperature being that of the metal 
rather than of the liquid. The rate at which SCC occurs is a 
function of the chloride ion concentration, the relevant 
concentration being that in the liquid film at the metal 
surface. The stress causing SCC may sometimes be the 
tensile stress in the metal surface at the operating pressure, 
but a more common cause is residual stresses. Stainless 
steels such as the commonly used 304, 321 and 347 types 
are susceptible, and the 316 and 317 types are only mar¬ 
ginally less so. 

Where SCC is detected, specialist advice is required. If 
the cracks are sufficiently deep, immediate shut-down is 
necessary. If they are more shallow, the advice may be that 
it is possible to continue in operation with appropriate 
monitoring and perhaps that the cracks may be dealt with 
in due course by grinding out. 

Prevention of SCC by elimination of stress is generally 
difficult. Stress relief may be practised, although the 
temperatures required are high and can cause distortions. 
On the other hand, operation with a metal temperature 
below 60°C eliminates the problem. Control of chloride ion 
concentration is more problematic, particularly if chlorides 
can concentrate by evaporation. Selection of an appropriate 
stainless steel is an effective measure. The steels which 
show resistance to SCC are those with higher nickel 
contents: the 904L grade is resistant and the 825 grade 
highly so. 

Other measures of protection include exclusion of oxy¬ 
gen, use of inhibitors and cathodic protection. A critique is 
given by M. Turner (1989b), who rehearses some drawbacks 
of these methods. The quantity of oxygen required to initi¬ 
ate SCC is very small. Inhibitors have not proved uni¬ 
versally effective. Cathodic protection requires very 
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precise control. Failures due to SCC are mostly not cata¬ 
strophic, though hey can be. They tend to exhibit leak- 
before-break behaviour. 


12.27.14 Nitrate stress corrosion cracking 
A particular type of SCC is the nitrate SCC of mild steel. It 
was nitrate stress corrosion which caused the crack in No. 5 
Reactor at Flixborough and led to the removal of the reactor 
and the installation of the 20 in. pipe. The cracking occurred 
because cooling water treated with nitrite had been played 
on the reactor to dilute small leakages of cyclohexane. 

The conditions for nitrate cracking of mild steel to occur 
are a high concentration of nitrate, a low pH, a temperature 
above 80°C and high stress. This combination of features is 
not often present and nitrate cracking is not common out¬ 
side plants handling nitric acid and nitrates. Most water 
contains some nitrates. In particular, water treatment of 
industrial cooling water results in an appreciable nitrate 
concentration. But such cooling water does not normally 
cause nitrate cracking. It is concentration of nitrates which 
presents the main hazard of nitrate cracking. Concentra¬ 
tion may occur on a nitric acid plant or a plant producing 
nitrates, inside a crack which has been created by some 
other mechanism such as fatigue, or due to evaporation. 

Contamination with nitrates should be avoided as far as 
practicable. In particular, it is not good practice to let water 
penetrate thermal insulation. This creates a risk of various 
kinds of corrosion apart from nitrate cracking. If heavy 
contamination may occur, equipment should be stress 
relieved. This is not a full answer for all fittings, since some 
items such as bolts have a high working stress. These need 
to be checked by regular inspection. 

Where it is not possible to rely on either avoidance of 
contamination or stress relief, some protection may be 
obtained by the use of certain paint coatings. On plants 
handling nitric acid and nitrates, nitrate cracking is a well- 
known problem and special procedures have been evolved. 

Further information on nitrate cracking is given in TON 
53/2 Nitrate Stress Corrosion of Mild Steel (USE, 1976). 


12.27.15 Zinc embrittlement 

At high stresses and temperatures, traces of other metals 
such as copper or zinc can cause rapid and severe embrit¬ 
tlement of some types of steel. The effects of zinc embrit¬ 
tlement of austenitic stainless steel were illustrated at 
Flixborough. Many of the stainless pipes found on the site 
had suffered zinc embrittlement. 

For zinc embrittlement of stainless steel to occur it is 
necessary for the material to be under high stress and at a 
high temperature, but given these conditions the quantity 
of molten zinc required to cause embrittlement is very small 
and failure can occur in seconds. The features which 
determine zinc embrittlement of stainless steel are (1) tem¬ 
perature, (2) applied stress, (3) wetting, (4) type of steel, and 
(5) time. 

Austenitic stainless steel is not used in process plant 
above 750°C except in certain specialized applications. 
Zinc embrittlement is not likely to occur below this tem¬ 
perature. Zinc has a melting point of 419°C and molten zinc 
penetrates stainless steel above 450°C, but embrittlement is 
improbable below 750°C. Investigations by Cottrell and 
Swann (1976), after Flixborough, showed that the most 
favourable metal temperature for rapid attack is 
800-900°C. Thus zinc embrittlement is unlikely to occur 


under normal operating conditions, but requires tempera¬ 
tures such as usually occur only in a fire. 

High stress is also a condition for zinc embrittlement to 
occur. In Cottrell and Swann’s work zinc embrittlement 
did not occur at low stress, even though the temperature 
was 1050°C and the specimen was coated on all sides by a 
pool of zinc. 

Wetting of the steel by the molten zinc is the condition 
most favourable to zinc embrittlement. Surface layers such 
as metal oxides can prevent penetration, but if the layer is 
broken in some way, such as by abrasion or a reducing 
atmosphere, wetting can occur. There is some evidence that 
embrittlement can be caused by contamination from zinc 
vapour, but this is unlikely to occur, unless the molten zinc 
is at a distance of no more than an inch or so. 

The type of stainless steel affects its susceptibility to zinc 
embrittlement. The latter is believed to be the result of inter¬ 
action between zinc and nickel in the steel. It is the austenitic 
chromium nickel steels which are particularly affected. 

Given conditions favourable to zinc embrittlement fail¬ 
ure can be rapid. Cottrell and Swann obtained failures in a 
matter of seconds. 

There are a number of possible sources of zinc on process 
plants. Zinc is used in galvanized, sprayed and painted 
coatings. Typical zinc-coated items are galvanized fittings, 
walkways, wire and finned tubes. Paints which contain 
zinc compounds but not metallic zinc are not a serious risk 
in this respect. 

The principal hazard posed by zinc embrittlement is 
rapid and catastrophic failure as a result of a fierce local fire 
on the plant. Zinc embrittlement also creates the problem 
that, after a general plant fire, stainless steel equipment 
which has a nearby source of zinc is suspect. The problem 
of zinc embrittlement, however, should be kept in perspec¬ 
tive. It is significant mainly as a secondary effect which 
can increase the severity of a local fire. 

On stainless steel plant where zinc embrittlement could 
have serious consequences in the event of fire, zinc should 
be eliminated as far as possible. In particular, zinc-coated 
items should not be placed in direct contact with stainless 
steel or in positions where they could drip molten zinc onto 
it. Thus, for example, galvanized wire netting used in 
insulation should not be in direct contact with stainless 
steel pipe. Similar considerations apply to stainless steel 
plant which has a normal operating temperature above 
400°C. Care should also be taken to prevent zinc con¬ 
tamination of stainless steel in welding and other fabrica¬ 
tion or maintenance activities. 

If plant made of stainless steel is subjected to fire, it 
should be examined by experts to check that it has not 
suffered zinc embrittlement. Deterioration is difficult to 
determine by normal inspection methods and requires 
metallurgical examination. Further information on zinc 
embrittlement is given in TDN 53/1 Zinc Embrittlement of 
Austenitic Stainless Steel (HSE, 1976). 


12.27.16 Erosion 

Erosion is a common form of corrosion and takes many 
forms. It occurs particularly at sites where there is a flow 
restriction or change of direction. These included nozzle- 
sand valves, elbows, tees and baffles, and points opposite 
to inlet nozzles. It is enhanced by the presence of solid 
particles in gas or liquid, by drops in vapours or by bubbles 
in liquids and by two-phase flow. Conditions which can 
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cause severe erosion include pneumatic conveying, wet 
steam flow, flashing flow and pump cavitation. 

12.27.17 External corrosion 

External corrosion can be caused by components in insu¬ 
lation and in fireproofing. The leaching of chloride salts 
from insulation by dripping water corrodes pipework. An 
account of corrosion beneath lagging has been given in 
Section 12.11. External corrosion is also considered in 
relation to maintenance in Chapter 21. 

Underground pipework can be corroded by the soil. This 
form of corrosion is often electrochemical, and cathodic 
protection is used to combat it. 

12.27.18 Corrosion at welds 

In much process equipment, the welds constitute both a 
potential fault line and a line of common cause failure, in 
that if there is corrosion at one point in the weld it is quite 
likely to be occurring along much of it. It is this combina¬ 
tion, with its potential for catastrophic failure, which makes 
corrosion at welds so serious. An account of corrosion at 
welds is given by M. Turner (1990a), who distinguishes 
three basic causes of such corrosion: (1) hydrodynamics, 
(2) differences in composition and (3) differences in metal¬ 
lurgical structure. 

Corrosion due to hydrodynamic effects is seen in butt 
welds on pipes. One cause is lack of root fusion, such that 
there is a small hollow at the root of the weld on the inner 
surface of the pipe, which then becomes the site of turbu¬ 
lence and impingement corrosion. Another cause is pro¬ 
trusion of a weld bead, which gives rise to impingement 
pitting in the pipe surface beyond the protrusion. In both 
cases, attack can be rapid and can accelerate. If the defect 
extends sufficiently far round the pipe, it may result in pipe 
rupture. In addition to control of welding to eliminate such 
defects, countermeasures may include the use of a backing 
ring; for a small bore connection, the use of an undersized 
connection which is then drilled out to size; and the limita¬ 
tion of fluid velocity 

A weld has the structure of cast metal and, if made of 
the same material as the parent metal, will generally be 
weaker. In order to compensate for this, use is commonly 
made of a weld metal of different composition. However, 
this difference in composition can be another cause of weld 
attack, by galvanic cell, or bimetallic couple, corrosion. The 
corrosion effects are governed by the ionic conductivity of 
the liquid which determines the extent of the pipe which 
participates as an electrode. If the weld metal is more noble, 
it is cathodic towards the parent metal, and it is principally 
the latter which will corrode, but even if the corrosion zone 
is relatively narrow, the rate of corrosion will tend to be 
limited by the small area of the cathode. If the weld metal 
is less noble and is therefore anodic, corrosion will occur 
mainly atthe weld, with the rate of corrosionbeing dependent 
on the area of the pipe acting as the cathode. If the ratio of 
this area to that of the weld is high, corrosion can be rapid. 

During welding a zone of the parent metal is affected by 
the heat. This heat affected zone (HAZ) can be some 20 mm 
wide and usually it is more susceptible to corrosion. Early 
stainless steels suffered serious problems of grain bound¬ 
ary corrosion, or weld decay, which led to brittle failure.The 
cause was depletion of chromium at the grain boundaries, 
due to the fact that under these conditions the carbon in 
solid solution migrates to the boundaries and forms chro¬ 
mium carbide, which precipitates, whilst chromium 


migrates more slowly and thus the chromium deficiency is 
not made good. The solution was the production of stainless 
steels with low carbon contents. 

In steels, generally, the high temperatures involved in 
welding cause a number of metallurgical changes in the 
HAZ, many of which make it more susceptible to corrosion. 
One mechanism of corrosion is a bimetallic couple. Control 
of the welding, including the heat input and interpass 
temperatures, can minimize, but generally not totally 
eliminate, the corrosion susceptibility. This susceptibility 
is, however, little affected by post-weld heat treatment, 
which is a form of tempering aimed at partial stress relief 
of the weld to reduce its brittleness, and is conducted at 
temperatures below those required to reverse changes in 
the metallurgical structure of the heat affected zone. 

In 1984, an oil line fracture at Las Piedras, Venezuela, 
sprayed hot oil across a roadway onto hydrogen units, 
causing a major fire (Case History A110). The pipe failure 
was a circumferential fracture in the parent metal in the 
heat affected zone about 1.5 in. from the weld. 

12.27.19 Corrosion testing 

Corrosion is generally a function of a number of variables 
and can be very sensitive to the particular process condi¬ 
tions. It is not always easy to predict, and in some cases 
corrosion testing is necessary. As described by M. TUrner 
(1988), there are essentially two distinctly different types 
of corrosion test. The first type is standard tests, which are 
characterized by the fact that they apply essentially to a set 
of relatively straightforward conditions and are precise, 
reproducible, rapid and cheap, and require neither skilled 
supervision and interpretation nor input from the client. 
Plant simulation tests, on the other hand, which simulate 
actual plant conditions, are not very precise or repro¬ 
ducible, can be prolonged and expensive, and require close 
supervision, skilled interpretation and client input. 

Since in a candidate design corrosion is likely to proceed 
relatively slowly, testing can take a long time. It is therefore 
not uncommon to use some form of accelerated test. As with 
any form of accelerated testing, this can be misleading. An 
alternative is the use of corrosion rate monitoring for which 
instrumentation now exists. This allows information to be 
obtained in tests which simulate the plant conditions. 
However, since the corrosion rate can vary with time, if this 
method is used it is necessary to ensure that the steady- 
state rate has been reached. It is desirable that the design of 
corrosion tests be a joint exercise between the chemical 
engineer and the corrosion specialist. 

12.27.20 Corrosion policy 

In establishing a policy on corrosion, there is a need to 
strike a balance between neglect and excessive caution. 
Process plants live with corrosion. The important thing is 
to identify, and act on, those cases where corrosion can be 
especially hazardous or costly. Some of the factors to be 
considered are discussed, with illustrations, by M. Turner 
(1987, 1990b). Most experienced corrosion engineers will 
themselves admit to cases where they have been surprised 
by the rapid corrosion which has occurred and others 
where they anticipated corrosion which never materialized. 

The Report of the Committee on Corrosion and Protection 
(Hoar, 1971) (the Hoar Report) reviewed national policy on 
corrosion. It made the point that there were substantial 
gains to be made simply by applying existing knowledge; in 
other words, there is a need for ‘corrosion awareness’ on the 
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part of engineers. However, there has to be an economic 
balance. Corrosion technologists for their part need a keen 
appreciation of the practicalities of the economics of pro¬ 
cess plants. For example, in many applications the choice of 
carbon steel will be the right one, even though it will cor¬ 
rode faster than an alternative, more expensive material. 

As an instance of living with corrosion, M. Turner (1987) 
cites the case of the steam reforming process for hydrogen. 
Theoretically, this should have been severely inhibited by 
the problem of creep rupture of the catalyst tubes, which, 
since creep is a probabilistic process, was liable to cause 
disruption due to premature failures. The solution was the 
use of ‘pigtails’ which could be nipped closed, allowing the 
furnace to continue in operation. 

Corrosion is another area in which it is important that 
engineers know enough to recognize those situations in 
which specialist advice is necessary. 

12.28 Fracture Mechanics 

Avery powerful tool for the avoidance of catastrophic fail¬ 
ure in pressure equipment is fracture mechanics. In this 
section an account is given of deterministic fracture 
mechanics, which deals essentially with the propagation 
of cracks, whilst the following section treats probabilistic 
fracture mechanics, which deals with the probabilistic 
aspects of equipment failure due to cracks such as the 
probabilities of prior existence of defects, of failure to 
detect them, and so on. 

Accounts of fracture mechanics are given in Fracture 
of Structural Materials (Tetelman and McElivy, 1967), Ele¬ 
ments of Elasticity (Dugdale, 1968), Fracture -An Advanced 
Treatise (Liebowitz, 1968), Fundamentals of Fracture 
Mechanics (Knott, 1973), Elementary Engineering Fracture 
Mechanics (Broek, 1974), Fracture and Fatigue Control in 
Structures (Rolfe and Barsom, 1977,1987), The Mechanics of 
Fracture and Fatigue (A.P. Parker, 1981) and Engineering 
Safety Assessment^ Thomson, 1987). Background treatments 
of elasticity and plasticity include those by Godfrey (1959), 
W. Johnson and Meller (1962), Spencer (1968), Timoshenko 
and Goodier (1970) and Benham and Warnock (1973). 

Fracture mechanics deals with the initiation and growth 
of cracks to a critical size and with failure due to cracks. It 
identifies different regimes of crack growth, and the effect 
of material properties, plate thickness, and so on. It pro¬ 
vides the basis for strategies for the avoidance, control and 
mitigation of crack propagation. 

As such it provides a tool not only for the avoidance of 
catastrophic failure, but also for discrimination between 
those defects which require prompt action and those which 
do not. The failure mechanism mainly treated in fracture 
mechanics is fatigue, but it is applicable to other mechan¬ 
isms also. 

12.28.1 Loading regimes 

The account of fracture mechanics given here is concerned 
essentially with steel plate such as is used in pressure ves¬ 
sels. An applied load gives rise in a body to stress a and 
strain e. The general problem of determining the stresses 
and strains within a loaded body is a complex one. A con¬ 
siderable simplification can be obtained if for a body of 
coordinates x, y, z it can be assumed that there is no change 
in the distribution of stress in the z direction. Then for 
deformation in the x, y plane two cases may be dis¬ 
tinguished: plane stress and plane strain. 


Plane stress is applicable to the case of a plate sufficiently 
thin that it can be assumed incapable of supporting stress a z 
through the thickness (the z direction) so that c r* = 0. Plane 
strain applies in the case of a plate sufficiently thick that it 
prevents strain t z through the thickness so that e z = 0. 

In most engineering applications, the combination of the 
dimensions of the structure and the steels used is such that 
at normal service temperatures the thickness of the steel is 
not sufficient to ensure plane strain under slow loading 
conditions. The material exhibits a behaviour which is not 
purely elastic but is to some degree elastic-plastic. Another 
distinction is in the mode of crack surface displacement. 
Three such modes are commonly treated. The modes 
involve opening (Mode I), shearing (Mode II) and tearing 
(Mode III). It is the first mode which is of interest here. 


12.28.2 Modelling of crack behaviour 

In describing the modelling of the stresses and strains 
caused by an applied load, and of the effect on cracks, it is 
usual to start by considering purely elastic behaviour. 
Models of loading are based on equations of equilibrium 
and compatibility. There are a number of stress functions 
which can be shown to satisfy the equilibrium conditions. 
One of these is the Airy stress Function F. There are also a 
number of complex stress functions which satisfy both the 
equilibrium and compatibility conditions. It can be shown 
that both sets of conditions are satisfied by the solution 

F + iB = ztj>(z) + J i/r(z) dz [12.28.1] 

where F is the Airy function, B is some other function, 
4> and i j/ are analytic functions, and z=x + iy and z=x—iy. 


12.28.3 Stored energy 

When a body is loaded the movement caused by the applied 
load does work which is stored as strain energy. For uni¬ 
axial tension this work is: 

U = o 2 /2E [12.28.2] 

where E is the modulus of elasticity, or Young’s modulus 
and U is the energy stored per unit volume of material. 


12.28.4 Griffith crack model 

Early work on fracture faced the apparent paradox that a 
sharp notch is capable of producing very high stress con¬ 
centration, yet an infinitely sharp one does not necessarily 
lead to failure. This problem was addressed by Griffith 
(1920-21), who for the case of a single crack of length 2 a in a 
brittle material considered the energy changes associated 
with an incremental extension of that crack and showed that 

U ' 2E m ‘* plane stress [12.28.3] 

f/ = 2g7ta 2 (l-w 2 ) plane strain [12.28.4] 

since for plain strain 


[12.28.5] 
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where a is the crack half-length and v is Poisson’s ratio. The conditions K c has a minimum value Kj C the plane strain 

energy release rate for crack extension G is defined as fracture toughness or, simply the fracture toughness. 

For biaxial loading an expression for the stress intensity 
G = dU/da [12.28.6] factor is 


Hence from Equations 12.28.3,12.28.4 and 12.28.6 


if: = * (no) 


1/2 


[12.28.16] 


°-t r 

plane stress 

12.28.7] 


plane strain 

[12.28.8] 

The energy absorption rate for crack extension 

R = dW/da 

[12.28.9] 


where W is the energy absorbed in producing crack 
extension. 

At the threshold condition for unstable crack growth 
dU/da = dW/da and hence G=R. But since R is a constant, 
there is a critical value G cr at which such growth will occur 
and this value is a constant. Then from Equations 12.28.7 
and 12.28.8 


G cr = G c = plane stress [12.28.10] 

Got = Gic = (1 _ plane strain [12.28.11] 


Then from Equations 12.28.7,12.28.8 and 12.28.16 

Ki = (GE) 1/2 plane stress [12.28.17] 

/ nj? \ 1/2 

A'i m> | | _ A plane strain [12.28.18] 


Compilations of stress intensity factors are given by Sih 
(1973a), Rooke and Cartwright (1976) and Hudson and 
Seward (1978). 

The fracture toughness is a property of the material, and 
plays a crucial role in fracture mechanics. It is discussed 
further below. 


12.28.6 Westergaard stress function 

Mention has already been made of the Airy function. 
Another stress function, or rather family of functions, 
which has proved fruitful is the Westergaard stress func¬ 
tion Zi, where the subscript I refers to the x axis of sym¬ 
metry. The stress intensity factor ki may be expressed in 
terms of a Westergaard function: 

Ki = (2ti) 1/2 lim (2 - a) 1/2 Zi(z) [12.28.19] 


where G c and Gi C are the critical values of G for plane It can t> e shown that using the appropriate Westergaard 
stress and plane strain, respectively, and U c is the critical function the stress intensity factor for a biaxially loaded 
value of the stress. Equations 12.28.10 and 12.28.11 give crack in a plate is given by 


o \ = plane stress 

and 

n EGic , 

at = — -plane strain 

c na(l -1?) 

Equation 12.28.12 is sometimes written as 



G c = 2y 

where y is the surface energy per unit area. 


[12.28.12] 


[12.28.13] 


[12.28.14] 


[12.28.15] 


12.28.5 Stress intensity factor 

For a body containing a crack the magnitude of the stress 
field at the crack tip may he characterized by the stress 
intensity factor K. For the first mode of crack surface dis¬ 
placement, Mode I, which is that of interest here, the stress 
intensity factor is K\. 

This stress intensity factor K x has a critical value K , f at 
which unstable crack propagation occurs. As the plate thick¬ 
ness is increased, the value of K c decreases asymptotically 
to a minimum value K k . In other words, under plain strain 


A'i = a(ra?) 1/2 [12.28.20] 

as already given. 

Another situation of interest is that of an array of cracks 
aligned in the same direction. Then, using the Westergaard 
function appropriate to this case, it can be shown that 




,1/2 


[12.28.21] 


where the distance between the centres of the cracks is 2b. 
Equation 12.28.21 reduces to Equation 12.28.20 as b/a-* oo. 


12.28.7 Geometric factor 

Equation 12.28.20 may he generalized to cover other cases 
such as that given in Equation 12.28.21 by the introduction 
of a configuration correction factor, or geometric factor Q, 
so that 


ifi = Qa(na) 1/2 [12.28.22] 

Then, for example, for the case of an array of cracks given 
by Equation 12.28.21 




[12.28.23] 


The geometric factor Q has the value unity for a central 
through crack in a thick plate. Values for other configura¬ 
tions are given by Harvey (1974). 
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12.28.8 Fracture toughness 

The fracture toughness K k is a property of the material 
and there are standard tests for it. They include BS 
5447: 1977 and ASTM Test Method E-399: 1990. There 
are also relations between fracture toughness and other 
parameters such as the Charpy V-notch (CVN) toughness 
and the crack opening displacement (COD). Both tests and 
relationships are described by Rolfe and Barsom (1987). 

As described earlier, below the transition temperature 
there is a marked fall in the toughness of a ferritic steel. 
Typically the fracture toughness is reduced by a factor of 
about four. Hydrogen embrittlement and impurities can 
also cause a pronounced reduction in fracture toughness. 

12.28.9 Modelling of crack behaviour: plastic 
deformation 

In the account given so far the assumption has been made 
that the behaviour of the material is elastic. In practice, 
most materials exhibit at some critical combination of 
stresses a degree of plastic deformation, or yielding. 

There are two principal criteria for the onset of yielding. 
These are theTresca criterion 

]*bt —«r 3 | =%s [12.28.24] 

and the von Mises criterion 

(ffi - (T 2) 2 + (02 - 03) 2 + (03 - 01) 2 = 2o^ s [12.28.25] 

where a ys is the yield stress and 01 > <r 2 > <r 3 . 

Some principal models of crack tip plastic behaviour are 
those given by Irwin (1958) and Dugdale (1960). 

12.28.10 Irwin model 

A model of crack tip plastic behaviour has been given by 
Irwin (1958). If the plastic zone is treated as a circle of 
radius A, the model gives 

*-*(£)’ |12M| 

The crack may be envisaged as having a notional length 
(a + A). Then, following Equation 12.28.22, an alternative 
stress intensity factor K* may be defined as 

K* = Qa[ 7t(a + A )] 1/2 [12.28.27] 


An early model for failure at the crack tip was that of 
Neuber (1937). In this model failure is considered to occur 
when, over some characteristic distance b from the crack 
tip, the average stress, or stress integrated over the dis¬ 
tance from a to (a + b), reaches a critical value. 

The characteristic distance b has a critical value b CI , such 
that at shorter distances the stress concentration at the crack 
becomes critical. Following the treatment of Thomson (1987), 
itself based on that of Irvine (1977 SRD R48), when the average 
stress over the characteristic distance reaches a critical value 

~=(y + 1 Y [12.28.29] 

where b is a ‘spreading length’, b a its critical value and cr u is 
the ultimate tensile stress. 

Use is also made of another parameter S, effectively an 
alternative critical spreading length, where 

6 cr =?S [12.28.30] 

An account is now given of the first three models 
mentioned earlier. The fourth is the / integral model of 
Rice (1968a,b). 

12.28.13 LEFM model 

The linear elastic fracture mechanics (LEFM) model follows 
directly from Equation 12.28.29. If the spreading length is 
much less than thecrack size(S cr <C a), thenfromthat equation: 



and from Equations 12.28.30 and 12.28.31 

H(?)’ ' i2 28 32 i 

12.28.14 SCT model 

The stress concentration theory (SCT) model is a modi¬ 
fication of the LEFM model. It may be expressed in the form 
of Equation 12.28.29 or, using equation 12.28.30, as: 

1-5 [(vH I 122833 ! 


12.28.11 Dugdale model 

Another model for crack tip plasticity is that of Dugdale 
(1960). In this model the notional length of the crack is 
taken as (a + p), where p is the length of the plastic zone. 
The model yields the relation: 


-m 2 


[12.28.28] 


which may be compared with Equation 12.28.26 in the 
Irwin model. 


12.28.12 Modelling of critical crack length 
There are a number of models for the critical length of crack 
for fracture. They include the following: the linear elastic 
fracture mechanics (LEFM) model, the stress concentra¬ 
tion theory (SCT) model, the Bilby, Cottrell and Swinden 
(BCS) model, and the J integral model. 


12.28.15 BCS model 

The third model, that of Bilby, Cottrell and Swinden (1963), 
or the BCS model, may be stated as: 




[12.28.34] 


12.28.16 Crack opening displacement 

In the extension of the modelling of fracture into the region 
of elasto-plastic behaviour, an important concept is the 
crack opening displacement (COD), or crack tip opening 
displacement (CTOD), proposed by Wells (1961). In this 
region, if a crack is envisaged as a triangular wedge 
extending some distance A into a circular plastic zone, such 
that the effective half-length is (a + A), then at the distance 
a from its centre, where it enters the plastic zone, it must 
have a certain width. This width is the COD. 
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The COD is a property of the material, is the subject of 
standard tests and may be related to other properties 
such as the fracture toughness. Standard tests include 
BS 5762: 1979 and ASTM Test Method E1290: 1990 and 
relations exist between the COD and other parameters; 
the tests and relationships are discussed by Rolfe and 
Barsom (1987). 

Expressions for the COD <5 may he obtained from the 
models of crack tip plastic behaviour. For the model of 
Dugdale (1960): 

<5=~^aln(^tZ) [12.28.35] 

and also 

*-«>"■ KOI 11228 361 

This last equation may be 

5 ~l*r <T<0 - 7a y s [12.28.37] 

Then from Equations 12.28.16 and 12.28.37 
5=K?/Eo ys [12.28.38] 

The crack opening displacement <5 has a critical value <5 C 
corresponding to the critical stress <r c . 

In line with the foregoing, a general relation for the 
critical crack opening displacement has been given by 
J.N. Robinson andTetelman (1974) 

K 2 

5 C ■ plane stress [12.28.39] 

c5 c — plane strain [12.28.40] 

where )! is a constraint factor. 


12.28.17 Fatigue crack growth 

A principal mechanism of crack propagation is fatigue. If a 
crack is subjected to a cyclic stress of amplitude A a this 
induces a corresponding range of the stress intensity factor 
AA.Then from Equation 12.28.22 

A K = QAcr(jta) 1/z [12.28.41] 

If the rate of increase da/dN of the crack length is plotted 
against the stress intensity factor range AK on a log-log 
plot, then as shown in Figure 12.22, the curve has three 
regions. In the first region (1) there is rapid crack growth; in 
the second region (2) the crack growth is slower and more 
predictable; and in the third region (3) the crack growth 
accelerates again to failure. Over the second region the 
curve is given by the Paris equation: 

~ = C(AK) m [12.28.42] 

where N is the number of loading cycles, C is a constant, 
and m is an index. For most ferrous and non-ferrous 
metals m ss 4. 



range, A/C (log scale) 

Figure 12.22 Typical crack growth rate for mild steel 
Equation 12.28.42 may be integrated as follows: 



where subscripts f and i indicate final and initial, respec¬ 
tively. Fatigue is not, however, the only mechanism of crack 
propagation. At high temperatures, crack growth can occur 
by creep. In this case the rate of growth is expressed not 
in terms of the number A of cycles but of time t, hence as 
da/d/. Treatments have been given by Tomkins (1983) and 
by Ainsworth and Goodall (1983). 

12.28.18 Failure assessment diagram 

A method for the assessment of the regime in which a 
particular equipment is operating has been developed at 
the CEGB, and is described by R.P. Harrison and Milne 
(1981). 

Linear elastic failure and fully plastic failure represent 
two limiting cases. Two parameters are defined as follows. 
For linear elastic failure 

K t =K 1 (o)/K k [12.28.44] 

and for fully plastic failure 

S r = a/<T\(a) [12.28.45] 

where K r is a measure of the proximity to linear elastic 
failure, S r is a measure of the proximity to fully plastic 
failure and oi(a) is the plastic collapse stress. As indicated, 
both K, and cy are functions of the crack half-length. 

Figure 12.23 illustrates the failure assessment diagram 
(FAD) given by the authors and based on these two para¬ 
meters. The failure assessment line in the diagram is 
constructed using an elastic-plastic model from the work 
of Dugdale (1960), Bilby, Cottrell and Swinden (1963) 
and Heald, Spink and Worthington (1972) to interpolate 
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Figure 12.23 Failure assessment diagram (after 
R.P. Harrison and Milne, 1981) (Courtesy of The Royal 
Society) 


between the two limiting behaviours. It has been shown 
by Chell (1978) that this approach is a reasonable approx¬ 
imation to the failure curve for any structural geometry. It 
is supported by tests on laboratory specimens and on 
structures as described by R.P. Harrison, Loosemore and 
Milne (1979). Failure is conceded if the assessment point 
lies outside (to the right) or on the curve. If lower bound 
data areused, the curve may be regarded as a failure 
avoidance line. 

The method has been developed to support a compre¬ 
hensive system of fracture mechanics used in the CEGB 
and elsewhere. This system is referred to as the ‘R6 Proce¬ 
dure’. Its third revision is given in a CEGB report by Milne 
etal. (1986) and in the open literature by Milne et al. (1988b). 

12.28.19 Fracture analysis diagram 

Another widely used diagram is the fracture analysis dia¬ 
gram (also FAD). This was developed by Pellini (1971) as a 
means of providing guidance on steels which exhibit a 
transition temperature. The diagram is a plot of stress vs 
temperature and has four reference points: the null ducti¬ 
lity transition (NDT), fracture transition elastic (FTE) and 
fracture transition plastic (FTP) points and midrange 
point between NDT and FTE. As described by the author, 
restricting the service temperature to just above the NDT 
provides fracture initiation protection for most common 
failures; restricting it to the mid-range between NDT and 
FTE provides fracture arrest protection for o-<0.5o- ys ; 
restricting it to above the FTE provides fracture arrest 
protection for ff<<7 ys ; and restricting it above the FTP 
ensures that the fracture is fully ductile. 

12.28.20 Through-thickness yielding 

It is of interest to be able to establish in a given case whether 
through-thickness yielding will occur before fracture. 
Such yielding is a function of plate thickness. As already 
described, the two limiting conditions are those of plane 
stress in thin plates and plane strain in thick plates. Prac¬ 
tical situations to lie between these two extremes. 


Through-thickness yielding is generally treated in terms 
of the dimensionless parameter fl 



where B is the plate thickness. 

A discussion of the values given by various workers for 
the parameter (I and their interpretation is given by Rolfe 
and Barsom (1987). They quote ASTM Committee 24 
on Fracture Testing as advising that to ensure plain 
strain behaviour it is necessary to have (1 > 0.4. Hahn and 
Rosenfield (1968) found a significant increase in the rate 
at which through-thickness deformation occurs for p >1. 
Irwin (1962) used a value of p = 1.4 in his leak-before-break 
model, described below. 


12.28.21 Leak-before-break behaviour 

If a crack grows to the point where it will cause failure, it is 
obviously desirable that it give warning of impending fail¬ 
ure by leaking. It is possible using fracture mechanics to 
assess whether or not in a given situation the crack will 
exhibit such leak-before-break (LBB) behaviour. This 
behaviour is also sometimes called leak-before-fracture 
(LBF) and its obverse as fracture-before-leak (FBL). 

The LBB criterion was proposed by Irwin et al. (1967) 
with the aim of predicting the toughness required in a 
pressure vessel so that before fracture occurs a surface 
crack will grow through the wall and give a leak. Another 
way of putting this is that the critical crack size is greater 
than the wall thickness. 

An account of the LBB criterion is given by Rolfe and 
Barsom (1977). It is assumed that a surface crack might 
grow through a wall of thickness B into a through-thickness 
crack of length 2B. Hence the LBB criterion is 2a m 2B. The 
authors use for the stress intensity factor Kj, the relation 

K? = - ~— [12.28.47] 

1 -'ffi5(<T/tf ys ) a 

or, for low stress 

Xi = a (no) 1 ' 2 [12.28.48] 

as given earlier. Then for the critical stress Ki=K c . The 
critical stress intensity factor K c is obtained using the fol¬ 
lowing relation: 

ig=Jf c (l+1.4/&) [12.28.49] 

with 

[12.28.50] 

where B is the wall thickness and ft c a dimensionless 
parameter. 

Another treatment of LBB is given by Harvey (1974), who 
deals with practical aspects such as allowance for residual 
stress. 

One use of the LBB method is in the design of a vessel to 
ensure that it operates in the LBB region. Another is to 
calculate the allowable stress in a vessel where a crack has 
been observed. Another is to check that the size of crack 
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which requires a reduction in operating stress is detectable 
by the inspection methods used. 


12.28.22 Some design features 

The fracture characteristics just described have a number 
of implications for the design of pressure systems. They 
include: the effects of plate thickness and through¬ 
thickness yielding; the effect of the use of advanced design 
codes; and the LBB principle. 

If a plate is sufficiently thin, fracture is ductile; if it is 
sufficiently thick, fracture is brittle. Much equipment in 
pressure systems will lie somewhere in between. The rela¬ 
tions for through-thickness yielding provide a means of 
quantifying this behaviour. 

Advanced design codes such as BS 5500 and ASME 
Boiler and Pressure Vessel Code, Section VIII, Division 2, 
permit the use of a stress which constitutes a higher pro¬ 
portion of the ultimate tensile stress; in other words the 
ratio crja is lower, so that instead of being 4 it lies in the 
range 2-3. Whilst this gives economies in equipment 
design, it means that the length of the critical crack is 
appreciably reduced, thus making it more difficult to 
ensure detection of such a crack. 

For critical equipment, such as a vessel containing a 
large inventory of a hazardous material, it is possible to 
identify the region in which a fracture will exhibit LBB 
behaviour, with a view to designing to ensure that the 
equipment operates always in that region. 

There are also implications for inspection. Fracture 
mechanics can indicate the size of crack which needs to be 
detected by the inspection procedures and the inspection 
interval necessary to ensure that no crack grows to its 
critical value before the next inspection. 


12.29 Probabilistic Fracture Mechanics 

A comprehensive approach to equipment failure from crack 
propagation requires that the deterministic treatment just 
described be complemented by probabilistic methods. 
Probabilistic fracture mechanics addresses such questions 
as the probability that a crack will be present, that it is not 
detected on a given inspection and that it grows to a critical 
size before the next inspection, causing failure. Accounts 
of probabilistic fracture mechanics include those by O’Neil 
(1980), Temple (1983,1985), Haines (1983), Lidiard (1984) 
and Thomson (1987). 

The probability that a pressure vessel, or similar equip¬ 
ment, will fail due to crack propagation may be expressed 
as follows: 

Pf=PAx)PmP g c [12.29.1] 

where P t is the probability that the vessel fails, P gc is the 
probability that the defect grows to critical size before the 
next inspection, P nf is the probability that the defect is not 
detected by non-destructive examination (NDE) at a given 
inspection, P x0 (x) is the probability that the vessel has an 
initial defect of depth > x, and x is the crack depth (mm). 

Work in this area has focused particularly on pressure 
vessels for nuclear pressurized water reactors (PWRs). In a 
study of this problem, Lidiard (1984) obtained the relation 


whereA and 0 are constants (both mm -1 ). He obtained for 
such vessels values of A and 0 of 0.59 and 0.16, respectively. 
These values imply, for example, that the probability of 
such a vessel having a crack of depth exceeding 25 mm is 
0.067 and the probability of one exceeding 50 mm is 
1.24 x 10“ 3 . 

The reliability of detection by NDE was the subject of a 
study by the European Community Plate Inspection 
Steering Committee (PISC). Information obtained on defect 
detection probability (DDP) is described by O’Neil (1980) 
and an analysis is given by Haines (1983). 

The data on the probability of detection, or DDP, may 
be fitted to an appropriate distribution. That used by 
W. Marshall (1982) is the exponential distribution. 
Thomson (1987) proposes, for a simplified analysis, that 
the probability of detection by NDE, P n may be fitted to 
a log-normal distribution, as given by Equation 7.7.20. 
He gives for the parameters of the distribution m* and a 
the values 3.135 and 0.667 mm, respectively. The prob¬ 
ability P nf of failure to detect is the complement of P n . 

The probability that a crack will grow to critical size may 
be obtained deterministically by the method described in 
the previous section. Alternatively, it too may be treated 
probabilistically. This approach has been described by Tem¬ 
ple (1985). The probability P gc that the crack grows to critical 
size given that it has an initial depth x 0 and stress intensity 
factor range A K and is subject to N loading cycles may be 
written as P gc (x/x 0 , A K, N). Then, taking for this probability 
a log-normal distribution,Temple obtains for PWR vessels: 

m*=x o + 6.56 x l(r 5 AA ■ N mm 
<t = 2.93 x 10“ 5 AA mm 

where A K is the stress intensity factor range (MPa/m 1/2 ).The 
application of the relations just described to obtain the prob¬ 
ability of vessel failure is discussed, with illustrative exam¬ 
ples, by Thomson. He casts Equation 12.29.1 in the form 

Pi = J* Pxo(x)P n {x)p gc (x) dx [12.29.3] 

where p gc is the probability density function correspond¬ 
ing to the probability distribution P gc and x c is the critical 
crack length. 

H.M. Thomas (1981) describes an approach to the deter¬ 
mination of the probability p c of catastrophic failure and pl 
of leak which starts with generic estimates but involves a 
learning process using data from the actual plant to obtain 
more refined estimates. 

12.30 Failure of Vessels, Equipment and Machinery 

There is a certain amount of statistical information avail¬ 
able on the failure of pressure system components. 

12.30.1 Failure of pressure vessels 

Work on the failure rates and modes of pressure vessels 
has been driven initially by the needs of the nuclear 
industry. 

Information on pressure vessel failure is given in A 
Survey of Defects in Pressure Vessels Built to High Standards 
of Construction and its Relevance to Nuclear Primary Circuit 
Envelopes by Phillips and Warwick (1968 UKAEA AHSB(S) 
R162).The survey deals with pressure vessels built to Class 1 


p *°W=is ex P(- 0 *) 


[12.29.2] 
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requirements of BS 1500, BS 1515 and comparable stan¬ 
dards. It classifies failures as catastrophic or potentially 
dangerous. The former are disruptions of the vessel which 
require major repair or scrapping; the latter are defects 
which might deteriorate under the working conditions and 
which require remedial action. The following information is 
given on failures prior to service and in service: 



Sample size 

Failure rate 
(failures/year) 



Potentially 

Catastrophic 



dangerous 

failures 

failures 

Failure in 

12,700 vessels 

5.5 x 10“ 4 

2.3 x 10“ 4 

construction 
Failure in 

100,300 

1.25 x 10“ 3 

0.7 x 10“ 4 

service 

vessel-years 




failures were: maloperation (four cases), fatigue (two 
cases), and pre-existing from manufacture (one case). The 
authors comment: ‘Most of these catastrophic failures are 
due to inadequate operational procedures and highlight the 
need for more consideration of control techniques.’ 

The authors then analyse the data to assess the failure 
frequency of the pressure vessels used in nuclear reactor 
primary circuit envelopes. They conclude that many of 
the failures given in the survey would not apply in such 
vessels, for example, cracks in boiler furnaces, and reduce 
the total number of applicable service failures from 132 
to 62 and the number of applicable catastrophic failures 
from 7 to 2. Then the failure frequencies become: 


Failure rate (failures/year) 


Potentially dangerous Catastrophic 

failures failures 

Failure in service 6 x 10 -4 2 x 10 -6 


For all the service failures the causes were classified. 
The results are shown in Table 12.11. The vast majority 
of failures, some 89.3%, were due to cracks. The causes of 
cracks were therefore analysed separately as shown in 
the table. The table also gives the methods by which the 
failures were detected. 

In addition, Phillips and Warwick analysed the effects 
of other variables such as materials of construction, design 
conditions, fluid handled, component state and age. The 
results are given in Table 12.12. As indicated in Table 12.12, 
there were seven catastrophic failures. The causes of these 


These results agree reasonably well with the cata¬ 
strophic failure frequencies estimated for nuclear vessels 
by Kellerman and Seipel (1967). This study provides a good 
illustration of the determination of failure data and of the 
derivation from crude data of failure data applicable to the 


Table 12.12 Other variables relevant to service failure in 
pressure vessels (after Phillips and Warwick, 1968 UKAEA 
AHSB(S) R162) (Courtesy of the UK Atomic Energy Authority) 


Variables Failures 


Table 12.11 Causes and methods of detection of service 
failure in pressure vessels (after Phillips and Warwick, 
1968 UKAEA AHSB(S) R162) (Courtesy of the UK Atomic 
Energy Authority) 


No. of Percentage of 
cases total cases 


Causes of failures: 

Cracks 118 

Maloperation 8 

Pre-existing from manufacture 3 

Corrosion 2 

Creep 1 

132 

Causes of cracks: 

Fatigue 47 

Corrosion 24 

Pre-existing from manufacture 10 
Miscellaneous 2 

Not ascertained 35 

118 

Method of detection: 

Visual examination 75 

Leakage 38 

Non-destructive testing 10 

Hydraulic tests 2 

Catastrophic failure 7 

132 


89.3 

6.1 

2.3 

1.5 

0.8 

100.0 


35.6 

18.2 

7.6 

1.5 

26.5 


56.9 

28.8 

7.5 

1.5 
5.3 

100.0 


Potentially Catastroph- 

dangerous ic failures a 

failures a 



No. 

(%) 

No. 

(%) 

Materials of construction: 





Mild steel 

105 

79.5 

5 

3.9 

Alloy steel 

20 

15.1 

2 

1.5 

Design pressure: 





<500 lb/in. 2 

41 

31.1 

4 

3.1 

>500 lb/in. 2 

84 

63.5 

3 

2.3 

Design temperature: 





<600°F 

15 

11.4 

1 

0.7 

>600°F 

69 

52.5 

1 

0.7 

Not stated 

41 

31.1 

5 

3.9 

Age: 





<10 years 

59 

45.0 

6 

5.0 

>10 years 

64 

48.5 

1 

0.7 

Not stated 

2 

1.5 



Component state: 





Fired 

29 

22.0 

4 

3.1 

Unfired 

96 

72.6 

3 

2.3 

Fluid handled: 





Gas (including steam) 

69 

52.2 

4 

3.1 

Liquid 

14 

10.6 



Mixture 

42 

31.8 

3 

2.3 


a These columns give alternative breakdowns of the 125 potentially 
dangerous and seven catastrophic failures. 
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case which is of interest. The survey just described has 
been updated hy a further survey by Smith and Warwick 
(1974 SRD R30). Again this survey dealt only with pressure 
vessels built to Class 1 requirements. The period covered by 
the survey was from the latter half of 1967 to the end of 
1972. The information shown in the table below was 
obtained on failures prior to service and in service: 


Sample size Failure rate (failures/year) 


Potentially Catastrophic 
dangerous failures 
failures 


Failure in 

8,823 vessels 2.1 x 10 3 

_ 

construction 
Failure in 

105,402 1.1 x 10“ 3 

1.5 x 10“ 4 

service 

vessel-years 



In this latter survey, therefore, there were no catastrophic 
failures in construction, but the failure rates of potentially 
dangerous failures in construction and catastrophic fail¬ 
ures in service are appreciably greater than in the earlier 
survey. The failure rate of potentially dangerous failures in 
service is similar. The survey includes further tables giv¬ 
ing the classifications of service failures and the variables 
relevant to service failures similar to Tables 12.11 and 12.12. 

A further analysis of pressure vessel failure statistics 
made by the Atomic Energy Commission (AEC) Advisory 
Committee on Reactor Safety (ACRS) has been described 
by Engel (1974). This work refers to further large collections 
of pressure vessel failure data by the Edison Electric 
Institute-Tennessee Valley Authority (EEI-TVA), by the 
American Boiler Manufacturers Association (ABMA) and 
by the Institut fur Reactorsicherheit der Technischen 
Uberwachungs-Verein (TUV). The EEI-TVA data are effec¬ 
tively a subset of the ABMA data. Studies based on theTUV2 
data have been published by Kellerman (1966), Kellerman 
and Seipel (1967) and Slopianka and Mieze (1968). 

The most severe category of failure used by Engel is a 
disruptive failure, which is breaching of the vessel accom¬ 
panied by the release of a large volume of contained fluid. 
He treats this as a more restrictive category other than of 
catastrophic failure used by Phillips and Warwick. Engel 
considers failures of non-nuclear vessels applicable to 
nuclear reactor vessels. The largest data collections are as 
tabulated below: 


Data source Sample size Disruptive failures 

(vessel-years) (failures/year) 


No. of Upper bound 
failures of failure rate 
at 99% 
confidence 


Phillips and 

100,300 

0 

4.6 x 10“ 5 

Warwick (1968) 

ABMA 

723,000 

0 

0.64 x 10“ b 

(Marx, 1973) 

Kellerman 
and Seipel (1967) 

1,700,000 

0-49 

0.27 x KT b - 
4.0 x 10“ 5 


The work by Kellerman and Seipel does not indicate how 
many of the 49 failures reported might be classified as 
disruptive and therefore the number of failures and the 
upper bound on this failure rate are shown in the table as 
ranges. The upper bound of the failure rate in the table 
is determined by the statistical methods described in 
Chapter 7 and for zero disruptive failures is equal at the 
99% confidence level to 4.6 (9.2/2) divided by the number of 
vessel-years. 

Engel concludes that the ABMA data are the most useful 
and significant. These data are for pressure vessels 
designed to the ASME Boiler and Pressure Vessel Code, 
Section I or Section VIII, version 1956 or later, for pres¬ 
sures and temperatures equal to or exceeding those in 
light water reactors (LWRs) and with wall thicknesses 
exceeding 1.5 in. He states that the data support the con¬ 
clusion that for failure of pressure vessels applicable to 
nuclear reactors the disruptive failure rate is less than 
1 x 10 -5 failures/year. 

In a further survey, Smith and Warwick (1981 SRD R203) 
obtained for the period 1962- 78 the following failure rates 
for pressure vessel failures in service. For some 20,000 
vessels they obtained the results given below. Of the 229 
failures, 206 were cracks. 


Sample 

No. of 
failures 

Failure rate 
(failures/year) 

(vessel- 

years) 

Potentially Catastrophic Potentially Catastrophic 


dangerous failures 

dangerous failures 


failures 

failures 

310,000 

216 13 

6.9 x 10 -4 4.2 x 10 _s 


A survey of pressure vessel failures in process plants has 
been reported by Arulanantham and Lees (1981). The work 
covered process pressure vessels, pressure storage vessels, 
non-pressure storage vessels, heat exchangers and fired 
heaters. The plants studied were four olefins plants and one 
plant handling a toxic and corrosive material, in a single 
works. Two of the olefins plants were commissioned in the 
1950s and closed down in the 1960s, one was commissioned 
in the 1960s and closed in the 1970s and one was commis¬ 
sioned in the 1960s and was still operating. The toxics 
plant was also commissioned in the 1960s and was still 
operating. The olefins plants operated at about 3.5 and 
35 barg at the hot and cold ends, respectively, except that at 
the hot end there was steam generation at about 85 harg. 
The temperatures ranged from -100° to 800°C. The toxics 
plant operated at relatively low pressures and mild tem¬ 
peratures. Excluded from the survey were failures in steam 
boilers and steam and air receivers and in pipework and 
also heat exchanger tube failures. The authors define fail¬ 
ure as a condition in which a crack, leak or other defect has 
developed in the equipment so that repair or replacement is 
required, a definition which they treat as including some of 
the potentially dangerous as well as all the catastrophic 
failures in that of Phillips and Warwick. They report failure 
rates classified by type of vessel, operating conditions and 
causes of failure. 
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For pressure vessels other than fired heaters, that is, 
process pressure vessels, pressure storage vessels and heat 
exchangers they obtain: 


Sample size 

No. of 
failures 

Failure rate 
(failures/year) 

Vessels Vessel-years 

1216 16,417 

70 

4.3 x 10“ 3 

Other failure data given a: 

re as follows. For the olefins 


plants: 


failures/year. A failure rate of 10 -5 failures/year is used in 
the study, but the sensitivity of the results to the higher 
failure rate is also given. The treatment of pressure vessel 
failure rates in the report is described in Appendix 7. 

The Rijnmond Report gives for catastrophic failure and 
for serious leakage of a pressure vessel failure rates of 10 -6 
and 10 -5 failures/year, respectively. 

The estimated failure rate of a pressure vessel is given by 
Batstone and Tomi (1980) as 10 -6 failures/year. 

12.30.2 Failure of pipework 

There is a considerable amount of data available on pipe¬ 
work failures, but the range of values quoted is wide and 


Vessel 

Sample size 

No. of failures 

Failure rate 
(failures/year) 

Vessels 

Vessel-years 

Process pressure vessel 

415 

5535 

15 

2.7 x 10“ 3 

Pressure storage vessel 

129 

2220 

4 

1.8 x 10“ 3 

Heat exchanger 

446 

5950 

10 

1.7 x 10“ 3 

Fired heaters 

36 

447 

181 

405 x10 -3 

High temperature vessel, except fired heater 

58 

809 

6 

7.4 x 10“ 3 

Low temperature vessel 

147 

1941 

3 

1.5 x 10“ 3 

Here the pressure storage vessel data are 

for the whole 

tends to be confusing. There are several important distinc¬ 

works and the fired heater data are for the toxics plant also. 

tions to be made. One concerns the type of failure. Complete 

For the toxics plant: 


pipe breaks, or guillotine fractures, constitute only a small 

Vessel 


Sample size 

No. of 

Failure rate 




failures 

(failures/year) 


Vessels 

Vessel-years 



Process pressure vessel 

131 

1572 

15 

26 x10“ 3 

High temperature vessel, except fired heater 

16 

192 

7 

36 x10“ 3 

Vessel in corrosive duty 

45 

540 

21 

39 x KT 3 

Vessel subject to stress corrosion 

49 

588 

12 

20 x 10 3 


Davenport (1991) has reported a survey involving some 
360,000 vessels and 1.8 x 10® vessel-years over the period 
1983-88, which is a much larger sample than that obtained 
by Smith and Warwick. The survey was not confined to 
Class 1 vessels, but took in a much larger range, and in fact 
is dominated by relatively thin-walled air receivers, so that 
the two surveys are not comparable. In the survey by 
Davenport there were 92 failures, of which 60 were cracks. 

The distribution of pressure vessel disruptive failure 
rates from a number of sources has been analysed by Hurst, 
Davies et al. (1994). In this work the authors give various 
sets of failure rate data as plots of logi 0 X vs normal quantiles, 
where X is the failure rate of the exponential distribution, in 
order to check whether the failure rates are log-normally 
distributed. Their plot for pressure vessels is shown in 
Figure 12.24(a), the straight line confirming that the 
distribution of the failure rates is log-normal. The mean 
pressure vessel disruptive failure rate obtained from this 
plot is X »10 _5 /year. The failure rates vary, however, by 
some five orders of magnitude at the 95 % confidence level. 

With regard to pressure vessel failure rates used in hazard 
assessments, the First Convey Report gives for spontaneous 
failure of a pressure vessel a failure rate of some 10 _5 -10~ 4 


proportion of failures. Another relates to the pipe size. 
The failure rate tends to be higher for small than for large 
diameter pipes. A further difference in the figures arises 
from the basis on which figures are quoted, which may be 
per unit length of pipe run, per pipework section or per 
plant. 

Even so, the quoted failure rates of pipework show con¬ 
siderable variation. Table 12.13 shows some estimates of 
the failure rate of pipework on nuclear plants quoted in the 
Rosmussen Report. Similarly, Figure 12.25 has been given 
by Hawksley (1984) to illustrate the variability of pipework 
failure rates. 

As with pressure vessels, so with piping, early work on 
failure rates and modes was directed to nuclear industry 
needs. Data on pipework failure have been given by a 
number of authors, particularly those concerned with 
nuclear systems, such as Smith and Warwick (1974 SRD 
R30) and Bush (1977). 

Smith and Warwick (1974 SRD R30), applying definitions 
of catastrophic and potentially dangerous failures, similar 
to those which they used for pressure vessels as described 
in the previous section, obtained for reactor systems the 
data contained in the table below. 
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(a) 



Normal quantiles 
(b) 



Normal quantiles 


Figure 12.24 Distribution of disruptive failure rates of 
pressure vessels and pipework (Hurst Davies et al., 1994): 
(a) pressure vessel disruptive failure rates (failures/year); 
and (b) pipework guillotine fracture failure rates (failures/ 
m-year). In these graphs the variable of interest is the 
logarithm of the exponential failure rate, which is shown 
plotted against the quantiles of the normal distribution. A 
straight line through the points indicates that this variable is 
log-normally distributed. The value corresponding to the 
zero value of the normal quantile is the mean of the failure 
rate values. 


Sample 

No. of 

Failure rate 

(reactor 

system- 

failures 

(failures/year) 

Potentially Catastrophic Potentially Catastrophic 

years) 

dangerous failures 

dangerous failures 

failures 

failures 

2397 

35 6 

1.5 x 10 -2 2.5 x 10 -3 


The reactor system included reactors and other equip¬ 
ment such as heat exchangers as well as pipework, but the 
failures were predominantly in the latter. 

The failure rate of pipework in nuclear plants is given by 
Bush (1977) as 4.3 x 10 -5 failures/man-year derived from 
eight failures, which are individually described and of 
which four were due to water hammer. 

A survey of pipework failure in nuclear plants to provide 
information more up-to-date than that given in Rosmussen 
Report has been described by R.E. Wright, Steverson and 
Zuroff (1987). They distinguish between pipework for 
which a failure would result in a loss-of-coolant accident 
(LOCA), which they term ‘LOCA-sensitive’, and other 
pipework. Their summary of the pipework failure rates 
used in the Rosmussen Report is shown in Table 12.14. 

The authors obtained data for US nuclear reactors with a 
total operating time of nearly 800 reactor-years, covering 
both PWRs and boiling water reactors (BWRs). They con¬ 
sider three pipe ranges: 0.5-2 in. > 2-6 in. and > 6 in. For 
LOCA-sensitive systems they defined a failure as a leak 
flow > 50 US gal/min for PWRs and > 500 US gal/min for 
BWRs. For non-LOCA-sensitive systems all pipe break 
failures were collected which had a leak flow >1 US gal/ 
min for pipes > 2 in. diameter or which had a leak flow 
of > 50 US gal/min for all pipe sizes. 

For PWRs with a total period of operation of 485 years 
and BWRs with a period 313 years, there were no failures of 
LOCA-sensitive pipework.There were, therefore, 798 years 
of operation of the two types of (LWR) free of failure. The 
point estimates of the failure rate based on this information 
were 0.0005, 0.0007 and 0.0003 failures/reactor-year for 
PWRs, BWRs andLWRs, respectively. The value for LWRs 
is evidently not the average of the values for the two types 
of LWR, but a value determined in its own right and based 
on the total of 798 years accumulated by both reactor types. 

For the non-LOCA-sensitive pipework there were nine 
failures in PWRs and 10 in BWRs, making a total of 19 
failures for LWRs. Pipe length and weld population data 
were available for 18 plants. The authors used these data to 
give the pipe length and weld populations of a nuclear 
plant. The mean pipe lengths and weld numbers obtained 
are given in Table 12.15, Sections A and B. Breakdowns of 
the failures by plant type and pipe size, by leak flow and by 
operational mode are given in Sections C, D and E of 
Table 12.15, respectively. The causes of failure were mainly 
vibration (10 cases) and water hammer (3 cases). The other 
cases were attributed one each to pump seizure, corrosion, 
fatigue, impact, operator error and unknown cause. 

In the survey of failure rates of pressure equipment 
in process plants described in the previous section, 
Arulanantham and Lees (1981) also report data on major 
failures of pipework in one of the olefins plants. Over a 
9.5-year period there were seven failures, giving a failure 
rate of 0.74 failures/plant. The failures are described 
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Table 12.13 Estimates of failure rates of pipework in nuclear plants given in the Rasmussen Report (after Atomic 
Energy Commission, 1975) 


Failure rate 


‘Probability of large scale rupture of primary coolant system’ 

(A.E. Green and Bourne) (1968) 

‘Catastrophic rupture of primary system pipes’ (Salvatory) (1970) 

‘Pipe rupture’ (Erdmann) (1973): 
which corresponds roughly to 

‘Pessimistic probability for catastrophic failure of primary system of PWR’ (Otway) 
Total probability of severence anywhere in primary system piping’ 

(General Electric Report) (1970): 

Without ultrasonic testing 
With ultrasonic testing 

‘Failure rate for rupture of primary coolant system piping’ (Wells-Knecht) (1965) 


3 

1 

1.5 

1 

1.7 


10“ 6 - 2 x 10“ 3 /plant-year 

10 _4 /plant-year 

10 _6 /section-year 

10 4 —1 x 10 _2 /plant-year 

10 _7 /plant-year 


10 -3 /plant-year 
10 yplant-year 
10 7 /plant-year 


Note : The references given in this table refer to those in the Rasmussen Report, not this book. 



Figure 12.25 Some data on pipework failure rates (Hawksley, 1984) 
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Table 12.14 Failure rates for LOCA-initiating ruptures 
used in the Rasmussen Report (after R.E. Wright, 
Steverson and Zuroff, 1987) 


Pipe repture size 
(in.) 

LOCA-initiating rupture 
rates (failures/plant-year) 


Median 

Range 


1—2 

1 x 10“ 3 

1 x 10- 4 - 

L x 10- 2 

2-6 

3 x 10“ 4 

3 x io- 5 -: 

3 x IO" 3 

>6 

1 x 10- 4 

i x io- 5 -: 

1 x 10~ 3 


individually: two were due to water hammer, two to vibra¬ 
tion-induced fatigue, one to brittle fracture resulting from 
admission of freezing hydrocarbon and one to overpressure 
of a pump suction line. 

A survey of pipework failure in plants in the nuclear, 
chemical and other industries had been described by 
Blything and Parry (1988 SRD R411). The data sources 
were as follows. For chemical plants use was made of data 
from a medium-sized plant and of incident data from four 
separate sources; for refineries data were obtained from 
the plants of an oil company and from incidents; for nuclear 
plants data sources were a study by Riso National Lab¬ 
oratory and a presentation by the Nuclear Installations 
Inspectorate (Nil); for steam plants the data were taken 
from T.A. Smith and Warwick (1974) and Gibbons and 
Hackney (1964). 

The data were analysed by ‘failure cause’ and ‘root cause’. 
Essentially, failure causes are the mechanical causes, such 
as corrosion, fatigue and water hammer, and root causes are 
activities such as error in design, operation and maintenance. 
Their results are summarized in Table 12.16, which gives 
the failure causes vs root causes for chemical plants and 
refineries (Section A) and for nuclear plants and steam 
plants (Section B). 

The severity of failure expressed as leak flow is shown in 
Table 12.17 for the medium-sized chemical plant in Section 
A and for the GEC steam plant survey in Section B. The 
mechanical failures for the five chemical plant sources 
were as follows: 



No. 

Proportion (%) 

Weld failure 

45 

33.1 

Stress rupture 

30 

22.1 

Bending stress 

2 

1.5 

Fatigue 

3 

2.2 

External load 

4 

2.9 

Bellows failure 

3 

2.2 

Valve failure 

27 

19.9 

Seal failure 

15 

11.0 

Miscellaneous 

7 

5.1 

Total 

136 

100.0 


Kletz (1984k) has given information on some 50 major 
pipe failures in process plants as shown in Table 12.18. 
Section A of the table gives general failures, Section B 
gives failures in dead ends, and Section C gives bellows 
failures. The suggestions which Kletz makes for prevention 
of each failure are given in Table 12.19. He also makes 


proposals for reduction of pipework failures by improved 
design and describes some points to look for in inspection 
of pipework. These aspects are described in Section 12.7 
and Chapter 19, respectively. 

A study of pipework failures in process plants has been 
described by Bellamy and co-workers (Bellamy, Geyer and 
Astley 1989; Geyer et d., 1990; Geyer and Bellamy, 1991; 
Hurst et d., 1991). This work was concerned particularly 
with human factors as a cause of failure. This study 
reviewed 921 incidents from incident data bases such as the 
HSE MARCODE, the Safety and Reliability Directorate 
(SRD) MHIDAS and (the Toegepast-Natuurwetens- 
chappelijk Onderzoek (TNO) FACTS data bases. Some 
analysis was undertaken on all 921 incidents, and some 500 
of these incidents were selected as suitable for further 
analysis. Pipelines and flexible hoses were excluded. 

The data were biased towards failures in larger pipes, as 
the following breakdown of pipework failures shows: 


Pipe size (mm) 

Frequency of failure 

>150 

70 

51-149.9 

31 

26-50.9 

19 

13.1-25.9 

22 

<13 

3 

Total 

145 


This reflects the fact that the study was based on incidents 
held in data bases. 

Incidents were classified under the three headings: 
(1) direct cause, (2) origin of failure or underlying cause, 
and (3) recovery from failure or preventive mechanism. 
Detailed accounts of these definitions are given by Bellamy 
and Geyer (1989) and by Hurst et d. (1991). 

Table 12.20 gives the direct causes of failure and Table 12.21 
the underlying causes vs the recovery failure. 

Table 12.22 gives a breakdown of the failures of pipes, 
valves and other equipment, for those incidents where the 
information was available.Table 12.23 shows the state of the 
equipment, again for those cases where there was infor¬ 
mation. The survey also yielded information on various 
aspects of the releases, some of which is described in other 
chapters. 

In the work already described, Hurst Davies et d. (1994) 
also plotted the distribution of pipework guillotine failure 
rates from a number of sources, in order to check whether 
the failure rates are log-normally distributed. Their plot for 
pipework guillotine failure rates is shown in Figure 
12.24(b), the straight line confirming that the distribution 
of the failure rates is log-normal. The mean pipework 
guillotine failure rate obtained from this plot is X m 4.6 x 
10 _7 /m-year. The failure rates vary, however, by some 
2.5 orders of magnitude at the 95 % confidence level. 

Further values for pipework failure are quoted in work 
on hazard assessment. Estimated failure rates of pipework 
quoted by Batstone and Tomi (1980) are given inTable 12.24. 

Pape and Nussey (1985) in a hazard assessment of a 
chlorine installation have used for 25 mm diameter pipe the 
following values: 

Frequency of guillotine fracture 
= 3 x 10 -7 failures/m-year 
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Table 12.15 Failure rates for rupture in non-LOCA-sensitive pipework in US nuclear plants (after R.E. Wright, 
Steverson and Zuroff, 1987) 


A Pipe length populations (ft) a 

Pipe size (in.) 2 


2 >2-6 >6 No. of plants Total lengthen) 


PWRs: 

LOCA-sensitive 212 338 

Non-LOCA-sensitive b 6,312 11,883 

BWRs: 

LOCA-sensitive 2,603 3,024 

Non-LOCA-sensitive b - 5,906 


209 6 1,834 

15,021 2-8 (av. 4.7) 33,239 

4,427 1-2 (av. 1.7) 5,803 

6,577 0-2 (av. 1.0) 3,045 


B Pipe weld populations (no. of welds ) 3 

Pipe size (in.) 2 


>2-6 >6 No. of plants Total 


PWRs: 

LOCA-sensitive 123 161 

Non-LOCA-sensitive b 2,914 3,862 

BWRs: 

LOCA-sensitive 870 448 

Non-LOCA-sensitive b — 1,915 


100 8 579 

3,800 3-10 (av. 5.2) 12,289 

622 2 1,078 

2,114 1-2 (av. 1.7) 861 


C Failures by plant type and pipe size 


Pipe size (in.) 

No. of failures No. of reactor-years Failure rate (failures/reactor-year) 

PWRs: 





1-2 

2 

484 

0.0041 


>2-6 

4 

484 

0.0083 


>6 

3 

484 

0.0062 


Total 



0.0186 


BRWs: 





1-2 

3 

313 

0.0096 


>2-6 

2 

313 

0.0064 


>6 

5 

313 

0.0160 


Total 



0.0320 


LWRs: 

Total 

19 

798 

0.0238 


D Failures by leak flow 

Leak flow (US gal/min) 

No. of failures 

No. of reactor-years 

Leak frequency (leaks/reactor-year) 

PWRs: 





>1—<15 


5 

484 

0.0103 

>15 

BWRs: 


4 

484 

0.0083 

>1—<15 


1 

313 

0.0032 

>15 


9 

313 

0.0287 

E Failures by operational mode 

Plant type 


No. of failures 

Total 


Starting up 

Normal operatiot 

i Whilst shut-down 


PWR 

2 

5 

2 

9 

BWR 

0 

8 

2 

10 


a The figures in Sections A and B of the table are for background information only. They give an indication of the population of pipe lengths and 
welds on which data were available. They were not used as such in determining failure rates, which are given as failures/ reactor-year. The total in 
the final columns is not necessarily the sum of those in the earlier columns. A full explanation of these data is given by the authors. 
b For PWRs this is primary circuit pipework, for BWRs it is recirculation, main steam and main feed (interpreted as feedwater) pipework. 
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Table 12.16 Failure of pipework in chemical, refinery, nuclear and steam plants: failure cause vs root cause (after 
Blything and Parry, 1986 3 RD R 441) (Courtesy of the UKAEA Safety and Reliability Directorate) 

A Failures in 

chemical plants and refineries 

- ‘failure cause’ vs ‘roc 

>t cause’ 




Design Installation 

i Design/ 

Operation 

Maintenance 

Manufacture Unknown 

Unspecified 

Total 



installation 






Corrosion: 








External 

18 8 

- 

2 

4 

- - 

1 

33 

Internal 

56 1 

2 

1 

1 

1 

3 

65 


15 

1 

- 

- 

- - 

- 

16 

Erosion 

2 1 

- 

- 

1 

- - 

- 

4 

Restraint 

1 2 

4 

- 

- 

— — 

— 

7 

Vibration 

9 1 

3 

1 

- 

- - 

1 

15 

Mechanical 

28 10 

5 

11 

12 

18 2 

21 

107 

Material 

5 7 

10 

- 

4 

2 

21 

49 

Freezing 

13 1 

- 

2 

- 

- - 

1 

17 

Thermal fatigue 

2 1 

- 

2 

- 

1 

1 

7 

Water hammer 

2 1 

1 

4 

- 

- - 

- 

8 

Work systems 

6 4 

36 

47 

49 

- - 

2 

144 

Unknown 





29 

1 

30 

Unspecified 

1 1 

13 

3 

3 

- 

33 

54 

Total 

158 38 

75 

73 

74 

22 31 

85 

556 

B Failures in 

steam plan is ‘failure cause’ c 

rs ‘root cause’ 




Corrosion: 








External 


- 


- 


— 


Internal 

16 

- 

14 

- 

i 

- 

31 

Stress 

5 

- 

- 

- 

i 

- 

6 

Erosion 

13 

- 

53 

- 

i 

- 

67 

Restraint 

2 

2 

- 

- 

- - 

- 

4 

Vibration 

7 1 

- 

- 

- 

- - 

- 

8 

Mechanical 

11 6 

- 

4 

1 

22 1 

— 

45 

Material 

3 

- 

- 

- 

14 

- 

17 

Freezing 

1 - 

- 

- 

- 

- - 

- 

1 

Thermal fatigue 

7 

- 

- 

- 

3 

- 

10 

Water hammer 

- 

- 

2 

- 

- - 

- 

2 

Work systems 

2 

1 

- 

- 

- - 

- 

3 

Unknown 

- - 

- 

- 

- 

4 

- 

4 

Unspecified 

- 

- 

- 

- 

4 

- 

4 

Total 

65 9 

3 

73 

1 

46 5 

- 

202 


Frequency of lesser failure 
= 3 x 10 -6 failures/m-year 

Frequency of gasket failure 
Gaskets 0.6 mm thick = 3 x 10 -6 failures/year 
Gaskets 3 mm thick = 5 x 10 -6 failures/year 

The authors state that these data include valve leaks. 

The failure rates given by Hawksley (1984) in Figure 12.25 
yield the values given in Table 12.25. Comparison of the fre¬ 
quency of a guillotine rupture for pipe diameters > Sin. 
quoted by some of these sources gives: 


Failure frequency (failures/year) 

Gulf 

3 x 10“ 7 

Pape and Nussey 

3 x 10“ 7 

Cremer and Warner 

«1 x 10“ 6 

Batstone and Tomi 

3 x 10“ 6 


In converting the data of Batstone and Tomi, it has been 
assumed that a connection is a pipe section 10 m long. 

From these data it might be estimated that for regular 
pipework the frequency of guillotine rupture for a pipe > 3 
in. diameter is 1 x 10~ 6 failures/m-year and that for more 
critical pipework it is some three times less. 

12.30.3 Failure of process equipment 

A survey of the causes of service failure in process equip¬ 
ment generally has been given by Collins and Monack and 
this has been further analysed by Lancaster (1975). Some 
685 failures were recorded. The results of the survey are 
shown in Table 12.26. Causes of general service failure 
which are emphasized by this work are general corrosion, 
stress corrosion cracking and mechanical failure. The 
number of failures caused by brittle fracture is small. 

12.30.4 Failure of process machinery 

The results of a survey of causes of service failure in process 
machinery are shown in Table 12.27. The importance of mis¬ 
alignment as a cause of failure is brought out strongly 
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Table 12.17 Failure of pipework in chemical, refinery, 
nuclear and steam plants: leak flows (after Blything and 
Parry, 1986 SRD 441) (Courtesy of the UKAEA Safety and 
Reliability Directorate) 


A Failures 

in a chemical plant 


Pipe 

No. of leaks 

No. of ruptures 

d< 6 

29 

2 

10 < d < 15 

12 

- 

Total 

41 

2 

B Failures of steam plant (GEC study) 

Pipe size (in.) 

No. of leaks 

No. of ruptures 

d< 6 

115 

9 

10 < < 15 

26 

7 

d> 15 

6 

1 

Unspecified 

18 

2 

Total 

165 

19 

Table 12.18 

Some pipework failures in process plants: 

individual cases (after Kletz, 1984k) (Courtesy of the 

American Institute of Chemical Engineers) 


A General failures 


1. A pipe was secured too rigidly by welding to 
supports; vibration caused a section to be torn out 

2. Thermal expansion of a pipe caused a 1 2 3 / 4 -in. branch to 
press against a girder on which the pipe rested; the 
branch was torn off 

3. A batch of pipe-hangers were too hard and many 
cracked 

4. A crane was used to move a live line slightly so that a 
joint could be remade 

5. An old pipe was reused after being on corrosive/ 
erosive service; it failed 

6. A pipe was laid on the ground and corroded badly. 
Construction team may have used a pipe which was 
already corroded 

7. Water injection caused excessive corrosion/ erosion 
because the mixing arrangements were poor 

8. Water injection caused excessive corrosion/ erosion 
because the mixing arrangements were poor 

9. A temporary support was left in position 

10. The exit pipe from a converter was made of carbon 
steel instead of y 2 % Mo; the pipe fragmented and the 
reaction force caused the converter to fall over 

11. A crane hit an overhead pipeline 

12. Vibration caused fatigue failure of a 2-in. long pipe 

13. The wrong valve was opened and liquid nitrogen 
entered a mild-steel line causing it to disintegrate 

14. Vibration caused fatigue failure of a 1-in. long pipe 

15. An underground pipeline corroded and leaked 

16. Vibration caused a fatigue failure at a badly designed 
joint 

17. A construction worker cut a hole in a pipeline in the 
wrong place and, discovering his error, patched the pipe. 
Therepairwassubstandard,corroded,andleakedbadly 


18. A heat transfer oil line failed by fatigue as the result of 
repeated expansion and contraction. There should 
have been more expansion bends in the line 

19. Water froze in an LPG drain line. A screwed joint 
fractured. Screwed joints should not be used for LPG 

20. A section of steam tracing was isolated, causing a 
blockage. Expansion of the liquid in the rest of the 
pipe caused it to burst 

21. A level controller fractured at a weld, the result of poor 
workmanship. According to the report, the failure 
‘emphasizes the need for clear instructions on all 
drawings and adequate inspection during 
manufacture’ 

22. A 1-in. screwed nipple blew out of a hot oil line. It was 
installed 20 years before, during construction, for 
pressure testing and was not shown on any drawing 

23. Water injection caused corrosion/erosion because a 
properly designed mix nozzle was installed pointing 
in the wrong direction (see (7)) 

24. A Be/Cu circlip was used in an articulated arm 
carrying ammonia instead of a stainless steel one. The 
joint blew wide open 

25. Decomposition of the contents caused a pipeline 
to fail 

26. An LPG line corroded because it passed through a pit 
full of water contaminated with acid 

27. The tail pipe from a relief valve came down to the 
ground and dipped into a pool of water which froze 

28. Underground propane and oxygen lines leaked 
causing an underground explosion, the report states, 
‘During execution of the pipework, doubts were 
expressed by the works management as to the quality 
of the workmanship and the qualifications of those 
employed’ 

29. A little-used line was left full of water. Frost split it 

30. A portable hand-held compressed air grinder being 
used on a new pipeline was left resting between two 
live lines. When the air compressor was started the 
grinder, which had been left switched on, started to 
turn and ground away part of a live line 

31. A new line had the wrong slope so the contractors cut 
and welded some hangers. They failed. Other hangers 
failed due to incorrect assembly and absence of 
lubrication 

32. The space between a reinforcement pad and the pipe 
was not vented. Water in the space vaporized causing 
collapse of a pipe 

33. An old pipe was reused after use on duty which used 
up most of its creep life (see (5)) 

34. Two pipe-ends which were to be welded together did not 
fit exactly and were welded with a step between them 

35. An ice/hydrate plug blocked a blowdown line. It was 
cleared by external steaming. When the choke cleared 
the pressure above it caused it to move with such force 
that the line fractured at aT 

36. A carbon steel line was installed instead of 
iy 4 Cr y 2 Mo and ruptured after 16 years by 
H 2 attack (see (10)) 

B Failures in dead ends 


1. Water collected in a dead end branch 10 ft long and 
caused corrosion. Five men were killed when the 
branch failed and the escaping gas ignited 

2. Water collected in a dead end branch and froze, 

breaking the branch 
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3. Water collected in the dead end branch leading to a 
flowmeter which had been removed. It froze and 
damaged a valve 

4. Corrosion products collected in the branch leading 
to a spare pump which was never used; the branch 
failed 

5. A stainless steel line operating at 360°C was fitted 
with a branch leading to a relief valve. The branch 
was made of stainless steel for 1 m and then mild 
steel. The temperature of the mild steel exceeded 
the 100°C estimate and the line failed by 
hydrogen attack 

6. Corrosive by-products collected in a blanked branch; 
the branch failed 

7. Water collected in a branch on the feed line to a 
furnace; the branch was permanently connected to 
a steam supply. The water froze and fractured 

the line 

8. Water collected in an open-ended branch which 
was welded onto a pipeline as an instrument 
support. After 4 years the process line had 
corroded right through 

C Bellows failures 


1. A bellows was damaged before delivery 

2. A Fluon bellows failed because the pipe was free to 
move sideways 

3. Two pins in a hinged bellows failed by fatigue and the 
bellows became distorted 

4. A bellows was designed for normal operating 
conditions but distorted under abnormal, but 
foreseeable, conditions 

5. A bellows blew apart a few hours after installation. The 
split rings around the convolutions which support 
them and equalize expansion were slack 

6. Flixborough - two 28 -in. bellows failed completely 


Table 12.19 Some pipework failures in process plants: 
preventive measures (after Kletz, 1984k) (Courtesy of the 
American Institute of Chemical Engineers) 


A Points to look for during construction 

1. Equipment is made of the grade of steel specified and 
has received the right heat treatment 

2. Old pipe is not being reused without checking that it is 
suitable 

3. Pipes are not laid underground 

4. Workmanship is of the quality specified and tests are 
carried out as specified 

5. Purchased equipment is undamaged 

B Points to look for after construction 


1. Pipes are not secured too rigidly (by welding or 
clamping) so that they are not free to expand 

2. Pipes will not foul supports or other fixtures when they 
expand 

3. Pipes are not in contact with the ground 

4. Temporary supports have been removed 

5. Pipes are free to expand 

6. Screwed joints have not been used 


7. Steam tracing cannot be isolated on different sections 

8. Temporary branches, nipples, and plugs have been 
removed and replaced by properly designed welded 
plugs 

9. Equipment has not been assembled wrongly (First 
identify equipment which can be assembled wrongly) 

10. Pipes do not pass through pits or depressions which 
will fill with water 

11. Relief-valve tail pipes are not so close to the ground 
that they may be blocked by ice or dirt 

12. Lines which may contain water can be drained 

13. The slope of lines is correct (for example 
blowdown line should slope towards the 
blowdown drum) 

14. There is no ‘bodging’ 

15. Reinforcement pads are vented 

16. There are no dead ends in which water or 
corrosive materials can collect (Note: dead 
ends include little used branches as well as 
blanked lines) 

17. There are no water traps formed by brackets, etc., 
fixed to equipment 

18. Bellows are not bent because the two pipe ends are not 
in line 

19. The support rings on bellows are not loose 


C Points t 

:o look for after st£ 

irt-up 

1. Pipes ar 

e not vibrating 



Table 12.20 Failures of pipework in incidents: direct 
causes (after Bellamy, Geyer and Astley, 1989) (Courtesy 
of the Health and Safety Executive) 


No. of Contribution 


incidents 


Normalized Proportion 
No? (%) 

Corrosion 

92 

85.5 

9.3 

Erosion 

11 

7.3 

0.8 

External 

35 

27.5 

3.0 

load 




Impact 

49 

43.8 

4.8 

Overpressure 

129 

111.8 

12.1 

Vibration 

16 

14.0 

1.5 

Temperature 

44 

34.8 

3.8 

(high or low) 




Wrong or incorrectly 

44 

36.8 

4.0 

located in-line 




equipment 




Operator error 

190 

167.8 

18.2 

Defective pipe or 

303 

293.5 

31.9 

equipment 




Other 

17 

14.0 

1.5 

Unknown 

84 

84.0 

9.1 

Total 

1014 

921.0 

100.0 

a Some incidents were assigned to m 

ore than one di 

rect cause so that 


the total number of entries in the first column is 1014. The second col¬ 
umn gives the number of incidents normalized to a total of 921. 
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Table 12.21 Failures of pipework in incidents: underlying cause vs recovery failure (after Geyer et at., 1990) 


Underlying cause 



Recovery failure (%) 




Not 

recoverable 

Hazard 

study 

Human 
factors review 

Task 

checking 

Routine 

checking 

Unknown 

recovery 

Total 

Natural causes 

1.8 

_ 

_ 

0.2 

_ 

_ 

2.0 

Design 

- 

24.5 

2.0 

- 

0.2 

~ 

26.7 

Manufacture 




2.4 


~ 

2.4 

Construction 

0.1 

0.2 

1.9 

7.5 

0.2 

0.4 

10.3 

Operation 

- 

0.1 

11.0 

1.6 

0.2 

0.8 

13.7 

Maintenance 

- 

0.4 

14.5 

12.7 

10.3 

0.8 

38.7 

Sabotage 

1.2 

- 

- 

- 

- 

- 

1.2 

Domino 

4.5 

0.2 

- 

- 

0.3 

- 

5.0 

Total 

7.6 

25.4 

29.5 

24.4 

11.1 

2.0 

100.0 


Table 12.22 Failures of pipework in incidents: failures of 
pipes, valves and other equipment (after Bellamy, Geyer 
and Astley, 1989) (Courtesy of the Health and Safety 
Executive) 


A Pipe failures 

Frequency 

Full bore release: 


Spontaneous rupture 

165 

Release during line opening or 

25 

other human activity 


Leak: 


Spontaneous leak 

85 

Leak during line opening or 

5 

other human activity 


Failure 

99 

Total 

379 

B Valve failures 

Valve operation mode: 


Manual 

7 

Automatic 

4 

Remotely operated 

2 

Valve function: 


Flow control 

20 

Isolation 

7 


5 

Emergency shut-down 

2 

Safety/relief 

6 

Other 

3 

Valve position: 


Valve failed open 

2 

Valve failed closed 

25 

C Failure of other equipment 11 

Bellows 

5 

Coupling 

6 

Drum 

3 

Elbow 

2 

Gasket 

10 

Joints 

20 

Compressor 

2 

Filter 

4 


Flange 48 

Fitting 2 

Gasket 10 

Packing 14 

Gland (gland packing) 2 

Pump 10 

Rupture/bursting disc 5 

Seal 9 

Shell 5 

Sightglass 2 

T pieces 3 

Weld 17 

Total 179 


Total 179 


a Only equipment with more than one repoi 

-ted failure is listed. 

Table 12.23 Failures of pipework in incidents: equipment 
in incorrect status (after Bellamy, Geyer and Astley, 1989) 
(Courtesy of the Health and Safety Executive) 

A Type of equipment 

Frequency 

Pipe 

76 

Valve 

53 

Flange 

5 

Pump 

4 

Other 

9 

Total 

147 

B Nature of incorrect status 

Disconnected/connected 

4 

Removed 

10 

Not bled/ drained/cleaned 

35 

Not effectively isolated 

25 

Open/on 

50 

Closed/ off 

8 

Other/unknown 

8 

Total 

140 
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Table 12.24 Some failure rates of pipework used in 
hazard assessment (after Batstone and Tomi, 1980) 


Pipe diameter 

Failure rate per connection 
(failures/10® years) 

<25 

30 

40 

10 

50 

7.5 

80 

5 

100 

4 

>150 

3 


Table 12.25 Some failure rates (failures/ft-year) of pipe¬ 
work given in the literature (after Hawksley, 1984) 


Source Type of Pipe 

failure diameter (in.) 


3 


Upper line 10 5 


Energy 

Gulf 


Cremer and 
Warner 


Lower line 

Small 

5% 

20% 

Severe 

Guillotine 

3 ? 

Undefined 


1.7 x 10“ f 
10“ 6 
5 x 10- 7 

2 x 10" 7 
9 x 1(T 8 

3 x 10“ 6 

3 x 1(T 7 


FPC, Federal Power Commission; SRD, Safety: 


Reliability Direc- 


Table 12.26 Causes of service failure in metal equipment 
and piping in chemical plants (Collins and Monack, 1973) 
(Courtesy of Materials Protection and Performance) 


Corrosion (%) 


Cavitation 0.3 

Cold wall 0.4 

Cracking, corrosion fatigue 1.5 

Cracking, stress corrosion 13.1 

Crevice 0.9 

Demetallification 0.6 

End grain 0.4 

Erosion-corrosion 3.8 

Fretting 0.3 

Galvanic 0.4 

General 15.2 

Graphitization 0.1 

High temperature 1.3 

Hot wall 0.1 

Hydrogen blistering 0.1 

Hydrogen embrittlement 0.4 


Hydrogen grooving 0.3 

Intergranular 5.6 

Pitting 7.9 

Weld corrosion 2.5 

Subtotal 55.2 

Mechanical failure 

Abrasion, erosion or wear 5.4 

Blisters, plating 0.1 

Brinelling 0.1 

Brittle fracture 1.2 

Cracking, heat treatment 1.9 

Cracking, liquid metal pen 0.1 

Cracking, plating 0.6 

Cracking, thermal 3.1 

Cracking, weld 0.6 

Creep or stress rupture 1.9 

Defective material 1.6 

Embrittlement, sigma 0.3 

Embrittlement, strain age 0.4 

Fatigue 14.8 

Galling 0.1 

Impact 0.1 

Leaking through defects 0.4 

Overheating 1.9 

Overload 5.4 

Poor welds 4.4 

Warpage 0.4 

Subtotal 44.8 

No. of failures: 685 
Period: 1968-71 


Table 12.27 Causes of service failure of rotating 
machinery in the process industries (after Anon., 1970a) 


Cause 

(%) 

Misalignment between machines 

>50 

Ingestion of solid materials 

10 

Portions of rotating element thrown 

10 

Vibration causing seal loss, causing 

10 

thrust bearing failure 

Various other sources: lubrication 

10 

failures, internal misalignment, piping 
vibration, overspeed, slugging with 
liquid, chemical attack, surge 

Design and manufacturing errors 

<10 
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3/2 CONTROL SYSTEM DESIGN 


The operation of the plant according to specified condi¬ 
tions is an important aspect of loss prevention. This is very 
largely a matter of keeping the system under control and 
preventing deviations. The control system, which includes 
both the process instrumentation and the process operator, 
therefore has a crucial role to play. Selected references on 
process control are given in Table 13.1. 


Table 13.1 Selected references on process control 


NRC (Appendix 28 Control Systems); A.J. Young (1955); 
Ceaglske (1956); D.F. Campbell (1958); Grabbe, Ramo and 
Wooldrige (1958); Macmillan (1962); Buckley (1964); 

R.J. Carter (1964,1982); Harriott (1964); Hengstenberg, 
Sturm and Winkler (1964); Coughanowr and Koppel (1965); 
Perlmutter (1965); Franks (1967); IChemE (1967/ 45); 

C.D. Johnson (1967); E.F. Johnson (1977) H.S. Robinson 
(1967b); Shinskey (1967,1977,1978,1983); Himmelblau and 
Bischoff (1968); Chemical Engineering (1969c); Gould 
(1969); McCoy (1969); Soule (1969—); Himmelblau (1970); 
Considine (1971); Hartmann (1971); Pollard (1971); Luyben 
(1973); C. A.J. Young (1973); C.L. Smith and Brodman (1976); 
Lees (1977a); R.E. Young (1977,1982); C.L. Smith (1979); 
Dorf (1980); L. A. Kane (1980); Basta (1981d); Frankland 
(1981); Auffret, Boulvert and Thibault (1983); 
Stephanopoulos (1984); Hydrocarbon Processing 
(1986a-);Tbai, Lane and Lin (1986); Benson (1987); Prett 
and Morari (1987); W.R. Fisher, Doherty and Douglas 
(1988); Prett and Garcia (1988); Asbjornsen (1989); 

T. Martin (1989b); K. Pritchard (1989); R. Hill (1991); Ayral 
and Melville (1992); Y.Z. Friedman (1992); T. Palmer (1992); 
C. Butcher (1993c); Holden and Hodgson (1993); Ponton and 
Laing (1993); Roberson, O’Hearne and Harkins (1993) 

Sequence control, batch control, including 
computer control 

Kochhar (1979); Thome, Cline and Grille (1979); Ghosh 
(1980); Rosenof (1982b); Armstrong and Coe (1983); 
Severns and Hedrick (1983); Anon. (1984ii); M. Henry, 
Bailey and Abou-Loukh (1984); Bristol (1985); Cherry, 
Preston and Frank (1985); E.M. Cohen and Fehervari 
(1985); Krigman (1985); Namur Committee (1985); 

Preston and Frank (1985); Egli and Rippin (1986); Love 
(1987a,b, 1988); Rosenof and Ghosh (1987); ISA (1988); 
Kondili, Pantiiedes and Sargent (1988); Cott and 
Macchietto (1989); IChemE (1989/135); T.G. Fisher (1990); 
Crooks, Kuriyna and Macchietto (1992); Wilkins (1992); 
Sawyer (1992a,b, 1993a,b); Hedrik (1993) 

Reactor control (see also Table 11.4) 

Aris and Amundson (1957,1958); Harriott (1961,1964); 
Levenspiel (1962); Dassau and Wolfgang (1964); 
Coughanowr and Koppel (1965); Denbigh (1965); 
Perlmutter (1965); Shinskey (1967); Buckley (1970); 
Schottle and Hader (1977); Rosenhof (1982a,b); R. King and 
Gilles (1986); Rosenof and Ghosh (1987); Craig (1989) 

Compressor control, turbine control 

Claude (1959); Hagler (1960);Tezekjian (1963); R.N. Brown 
(1964); Daze (1965); Marton (1965); Hatton (1967); 
Magliozzi (1967); Hougen (1968); Labrow (1968); M.H.White 
(1972); Nisenfeld etal. (1975); Sweet (1976); IEE (1977 
Coll. Dig. 77/38); Nisenfeld and Cho (1978); Staroselsky 
and Ladin (1979); D.F. Baker (1982); Bass (1982); 


Gaston (1982); Maceyka (1983); B. Fisher (1984); 

Rana (1985); AGA (1988/52) 

Process instrument and control systems 

Isaac (1960); Anon. (1962a); Fusco and Sharshon (1962); 
Richmond (1965); Fowler and Spiegelman (1968); Byrne 
(1969); Frey and Finneran (1969); Klaassen (1971); Hix 
(1972); Nisenfeld (1972); Jervis (1973); K. Wright (1973); 
Calabrese and Krejci (1974); Wilmot and Leong (1976); 
Gremillion (1979); Mosig (1977); Redding (1977); Shinskey 
(1978); Kumamoto and Hensley (1979); Rinard (1982); 
Cocheo (1983); Rindfleisch and Schecker (1983); Swanson 
(1983); Galuzzo and Andow (1984); Love (1984); E.M. Cohen 
(1985); B. Davis (1985); S.J. Brown (1987); Cluley (1993); 
I.H.A. Johnston (1993) 


Traditionally, control systems have tended to grow by a 
process of accretion as further functions are added. One of 
the thrusts of current work is to move towards a more sys¬ 
tematic design approach in which there is a more formal 
statement of the control objectives, hierarchy, systems and 
subsystems. 

Once the objectives have been defined, the functions of 
the systems and subsystems can be specified. Typical sub¬ 
systems are those concerned with measurement, alarm 
detection, loop control, trip action, etc. The next step is the 
allocation of function between man and machine - in this 
case the instrumentation and the operator. This allocation 
of function and the human factors aspects of process con¬ 
trol are discussed in Chapter 14. 

It is convenient to distinguish several broad categories of 
function that the control system has to perform: these are 

(1) information collection, (2) normal control and (3) fault 
administration. A control system is usually also an infor¬ 
mation collection system. In addition to that required for 
immediate control of the process, other information is col¬ 
lected and transmitted. Much of this is used in the longer 
term control of the process. Another category which is 
somewhat distinct from normal control is the administra¬ 
tion of fault conditions which represent disturbances more 
severe than the control loops can handle. 

13.1 Process Characteristics 

The control system required depends very much on the 
process characteristics (E. Edwards and Lees, 1973). 
Important characteristics include those relating to the dis¬ 
turbances and the feedback and sequential features. A 
review of the process characteristics under these headings 
assists in understanding the nature of the control problem 
on a particular process and of the control system required 
to handle it. 

Processes are subject to disturbances due to unavoidable 
fluctuations and to management decisions. The dis¬ 
turbances include: 

(1) raw materials quality and availability; 

(2) services quality and availability; 

(3) product quality and throughput; 

(4) plant equipment availability; 

(5) environmental conditions; 
and due to 

(6) links with other plants; 

(7) drifting and decaying factors; 
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(8) process materials behaviour; 

(9) plant equipment malfunction; 

(10) control system malfunction. 

Quality may relate to any relevant parameter such as the 
composition or particle size of the material, the voltage 
level of a power supply or the specification of a product. 
Plant equipment may be taken off or brought back into 
service. Links with other plant may require changes in the 
operation of the process. Typical drifting and decaying 
factors are fouling of a heat exchanger and decay of cata¬ 
lyst. Process materials introduce disturbances through 
such behaviour as the clogging of solids on weighbelts 
or the blocking of pipes. Plant equipment failures con¬ 
stitute disturbances, as do those of the control system 
such as instrument faults, measurement noise, control loop 
instability or operator error. 

Certain trends in modern plants tend to intensify the 
process disturbances. They include use of continuous, high 
throughput processes, existence of recycles, elimination of 
storage and interlinking of plants. 

Some process characteristics which tend to make feed¬ 
back control more difficult include: 

(1) measurement problems; 

(2) dead time; 

(3) very short time constants; 

(4) very long time constants; 

(5) recycle; 

(6) non-linearity; 

(7) inherent instability; 

(8) limit cycles; 

(9) strong interactions; 

(10) high sensitivity; 

(11) high penalties; 

(12) parameter changes; 

(13) constraint changes. 

Measurement has always been one of the principal pro¬ 
blems in process control. A measurement may be difficult 
to make; it may be inaccurate, noisy, or unreliable; or it may 
be available in sampled form only. Even if the measurement 
itself is satisfactory, it may not be the quantity of prime 
interest. An ‘indirect’ or ‘inferred’ measurement may have 
to be computed or otherwise obtained from the actual plant 
measurement(s). Feedback control is totally dependent on 
measurement. 

Dead time or time delay arises in various ways in pro¬ 
cesses. It may be introduced by the distance—velocity lag in 
pipework, the nature of distributed parameter systems or 
the time to obtain a sample or laboratory analysis. Dead 
time makes feedback control more difficult, owing to the 
delay before any error is measured and corrective action is 
initiated. 

Processes with very short time constants are obviously 
difficult to control, because the speed of response required 
for control decisions and actions is rapid. But so also are 
processes with very long time constants, where the pro¬ 
blems have to do with the increased chance of disturbances 
and other control interactions upsetting the control action 
taken and with the difficulty of remembering all the rele¬ 
vant factors. 

Recycle takes a number of forms, including recycle of a 
process stream to an earlier point in the process and inter¬ 
nal recycle within a vessel. 


If a process is very non-linear, its behaviour tends to vary 
with throughput, its responses to disturbances and cor¬ 
rective actions differ, and it becomes difficult to find satis¬ 
factory controller settings. 

Some processes, notably certain chemical reactors, are 
inherently unstable over a certain range of operation. If the 
process enters the unstable region, variables such as tem¬ 
perature and pressure may increase exponentially, leading 
to an explosion. In other cases, the process enters a limit 
cycle and oscillates between definite limits. 

The relationships between the input and output vari¬ 
ables of a process are often complex and there may be 
strong interactions. One input may change several outputs 
and one output may be changed by several inputs. Where 
the output variables are controlled by single loops, severe 
interactions may occur between these loops. 

Some processes are very sensitive and this clearly 
intensifies the difficulty of control. So also does the exis¬ 
tence of very high penalties for excursions outside the 
control limits. 

Process parameter changes tend to reduce the effective¬ 
ness of controller settings and may make the process 
inherently more difficult to control. Constraint changes 
alter the envelope within which the process is to be con¬ 
trolled. 

The sequential control characteristics of a process 
include: 

(1) plant start-up; 

(2) plant shut-down; 

(3) batch operation; 

(4) equipment changeover; 

(5) product quality changes; 

(6) product throughput changes; 

(7) equipment availability changes; 

(8) mechanical handling operations. 

The sequential element in the start-up and shut-down of 
continuous processes and in batch processes is obvious, 
but there are other operations with sequential fea¬ 
tures. Continuous processes often contain semi-continuous 
equipment, particularly where regeneration is necessary. 
Deliberate changes in product quality or throughput or in 
equipment status involves sequential operation. In general, 
a sequence consists of a series of stages, of which some are 
initiated by events occurring in the process and others are 
initiated after the lapse of a specified time. 

Some other process characteristics which may be sig¬ 
nificant include requirements for: 

(1) monitoring; 

(2) feedforward control; 

(3) optimization; 

(4) scheduling; 

(5) process investigation; 

(6) plant commissioning. 

Monitoring is usually a very important function in the 
control system. The monitoring requirements posed by a 
process vary, but in cases such as multiple identical units or 
batch operations, they can be very large. 

Feedforward control may be appropriate if there are dif¬ 
ficulties in feedback control due to measurement problems 
or process lags. It is applicable where the disturbances can 
be measured but not eliminated, and where a model exists 
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which makes possible the prediction of the effect on the 
controlled variable of both the disturbing and correcting 
variables. 

If the plant has a time-varying operating point, con¬ 
tinuous optimization may be appropriate. Although opti¬ 
mization is carried out normally for economic reasons, it 
is characterized by adherence to a set of constraints. 
Operation within the envelope of constraints contributes 
to process safety. 

Some processes pose a scheduling requirement, parti¬ 
cularly where batch operations are concerned. There is 
normally some element of novelty in the process or plant 
equipment, and this may give rise to a requirement for 
process investigation and collection of information which is 
not otherwise needed for control. 

The investigative element is particularly important 
during plant commissioning. So also is the need for facil¬ 
ities which assist in bypassing problems on plant equip¬ 
ment or control instrumentation, while solutions are sought 
or equipment ordered. 

13.2 Control System Characteristics 

The characteristics of process control systems have passed 
through three broad phases: (1) manual control, (2) analo¬ 
gue control and (3) computer control (covering all forms of 
programmable electronic system). However, such a classi¬ 
fication can be misleading because it does not bring out the 
importance of measuring instrumentation and displays, 
because neither analogue nor computer control is a homo¬ 
geneous stage and because it says very little about the 
quality of control engineering and reliability engineering 
and the human factors involved. 

The sophistication of the measuring instrumentation 
greatly affects the nature of the control system even at the 
manual control stage. This covers instruments for measur¬ 
ing the whole range of chemical and physical properties. 
The displays provided can also vary widely. These are dis¬ 
cussed in more detail in the next chapter. 

The stage of analogue control implies the use of simple 
analogue controllers, but may also involve the use of 
other special purpose equipment. Most of this equipment 
serves to facilitate one of the following functions: (1) mea¬ 
surement, (2) information reduction and (3) sequential 
control. 

The first two functions, therefore, improve the informa¬ 
tion available to the operator and assist him to digest it, but 
leave the control to him. The equipment typically includes 
data loggers and alarm scanners. The third function does 
relieve the operator of a control function. Batch sequential 
controllers exemplify this sort of equipment. 

Another crucial distinction is in the provision of protec¬ 
tive or trip systems. In some cases, the safety shut-down 
function is assigned primarily to automatic systems; in 
others it is left to the operator. Similarly, computer control 
is not a homogeneous stage of development. In some early 
systems, the function of the computer was limited to the 
execution of direct digital control (DDC). The real control 
of the plant was then carried out by the operator with 
the computer as a rather powerful tool at his disposal. In 
other systems the computer had a complex supervisory 
program which took most of the control decisions and 
altered the control loop set points, leaving the operator a 
largely monitoring function. The two types of system are 
very different. 


The quality of the theoretical control engineering is 
another factor which distinguishes a system and largely 
determines its effectiveness in coping with problems such 
as throughput changes, dead time and loop interactions. 

Equally important is the reliability engineering. Unless 
good reliability is achieved nominally automated functions 
will he degraded so that they have to be done manually or 
not at all. Control loops on manual setting are the typical 
result. 

The extent to which human factors has been applied is 
another distinguishing feature. This aspect is considered 
further in Chapter 14. The general trend in control systems 
is an increase in the degree of automation and a change in 
the operator’s role from control to monitoring. 

Computer control itself has progressed from control by a 
single computer, or possibly several such computers, to 
distributed control by programmable electronic systems 
(PESs). These are described further in Section 13.4. 

13.3 Instrument System Design 

The design of process instrument systems, like most 
kinds of design, is largely based on previous practice. The 
control panel instrumentation and the control systems on 
particular operations tend to become fairly standardized. 
Selected references on process instrumentation are given 
in Table 13.2. 

13.3.1 Some design principles 

There are some basic principles which are important for 
control and instrument systems on hazardous processes. 
The following account has been given by Lees (1976b): 

(1) There should be a clear design philosophy and 
proper performance and reliability specifications 
for the control and instrumentation. The design 
philosophy should deal among other things with 
the characteristics of the process and of the dis¬ 
turbances to which it is subject, the constraints 
within which the plant must operate, the definition 
of the functions which the control system has to 
perform, the allocation of the function of these 
between the automatic equipment and the process 
operator, the requirements of the operator and the 
administration of fault conditions. The philosophy 
and specification should cover: measurements, dis¬ 
plays, alarms and control loops; protective systems; 
interlocks; special valves (e.g. pressure relief, non¬ 
return, emergency isolation); the special purpose 
equipment; and the process computer(s). 

(2) The process should be subjected to a critical exam¬ 
ination such as a hazop study to discover potential 
hazards and operating difficulties. 

(3) If a process contains serious hazards and requires 
an elaborate instrument system, it should be re¬ 
examined to determine whether the hazards can be 
reduced at source. 

(4) If the process continues to contain serious hazards, 
these should be assessed and protective systems 
provided as appropriate. If necessary, these should 
be high integrity protective systems (HIPS). 

(5) For pressure systems it is necessary to provide pro¬ 
tection not just against overpressure, but also 
against other conditions such as underpressure, 
overtemperature, undertemperature, overfilling, etc. 
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Table 13.2 Selected references on process 
instrumentation 


British Gas (Appendix 27 Instrumentation); Institution of 
Electrical Engineers (IEEE) (Appendix 27); ISA 
(Appendix 27); Gillings (1958); Howe, Drinker and Green 
(1961); Jenett (1964a); J.T. Miller (1964); O.J. Palmer (1965); 
Richmond (1965,1982); Holstein (1966); Liptak (1967,1970, 
1993); Regenczuk (1967); Considine (1968,1971,1985); 
Fowler and Spiegelman (1968); EEUA (1969 Doc. 32,1970 
Doc. 37D, 1973 Hndbk 34); Health and Safety Executive 
(HSE) (1970 HSW Bkit 24);Tully (1972); Whitaker (1972); 
Zientara (1972); Engineering Equipment and Materials 
Users Association (EEMUA) (1973 Publ. 120); Perry and 
Chilton (1973); Weston (1974a,b); Anon. (1975i); Andrew 
(1975); Doebelin (1975); Anon. (1976 LPB 7, p. 1); J. Knight 
(1976); Benedict (1977); Hayward (1977,1979); C.D. Johnson 
(1977); Yothers (1977); Anon. (1978 LPB 21, p. 68); Cavaseno 
(1978b); C. Tayler (1987a); Verstoep and Schlunk (1978); 
Cheremisinoff (1979,1981); B.E. Cook (1979); Hayward 
(1979); Hougen (1979); Marcovitch (1979); Ottmers etol. 
(1979); Andrew and Williams (1980); Chemical 
Engineering Staff (1980); Coppack (1980); IChemE 
(1980/73); Medlock (1980); Messniaeff (1980); Hewson 
(1981); Cramp (1982); Liptak and Venczel (1982); R.J. Smith 
(1982); R.H. Kennedy (1983); Anon. (1984gg); IBC (1984/ 
51); Klaassen (1984); Perry and Green (1984); Atkinson 
(1985); Borer (1985); Cahners Exhibitions Ltd (1985); 
Demorest (1985); M.J. Hauser, McKeever and Stull (1985); 
Higham (1985a,b); Langdon (1983); Leigh (1985); 

Challoner (1986); A. Moore (1986); A. Morris (1986); Tily 
(1986); Leigh (1987); Sinnott (1988); C. Butcher (1990b, 
1991c); Bosworth (1991); Burchart (1991); Bond (1992 LPB 
106); Krohn (1992); Nimmn (1992); K. Petersen (1992); API 
(1993 RP 551); Goodner (1993); Chilton Book Co. (1994); 
McClure (1994) 

BS (Appendix 27 Instrumentation), VDI (see Appendix 27) 

Symbols 

ISA (1976,1982) 

Measurement 

Flow: IBC (1982/26,1984/54); IMechE (1989/100) 

Level: IBC (1982/28) 

Pressure, vacuum: Waters (1978); Pressure Gauge 
Manufacturers Association (1980); Masek (1981,1982, 
1983); Demorest (1985); Liptak (1987); Roper and Ryans 
(1989) 

Temperature: ASTM (1974 STP 470A) 

Process analysers: Huyten (1979); Verdin (1973,1980); 
Huskins (1977); Carr-Brion (1986); Clevett (1986); EEMUA 
(1988 Publ. 138); Dailey (1993) 

Non-invasive instruments 

Asher (1982) 

Intelligent and self-checking instruments 

Hasler and Martin (1971,1973,1974); J.O. Green (1978); 

R.E. Martin (1979,1980); Barney (1985); Dent (1988); 

Anon. (1994b) 

Control valves 

ISA (Appendix 27); Charlton (1960); Liptak (1964,1983); 
EEUA (1969 Hndbk 32); Driskell (1969,1983,1987); 
Baumann (1971,1981); Baumann and Villier (1974); Hays 
and Berggren (1976); Hutchison (1976); Forman (1978); 


R.T. Wilson (1978); Kawamura (1980); Perry (1980); Royle 
and Boucher (1980); Whitaker (1981); Langford (1983); 

M. Adams (1984); Kerry (1985); Kohan (1985); Vivian 
(1988); Barnes and Doak (1990); Bhasin (1990); Fitzgerald 
(1990); Luyben (1990); B.A.White (1993); Anon. (1994b) BS 
5793:1979- 
Fluidics 

J. Grant and Marshall (1976,1977); Grant and Rimmer 
(1980); Anon. (1981 LPB 40, p. 7) 

Sampling 

Cornish, Jepson and Smurthwaite (1981); Strauss (1985) 
Signal transmission, cabling 
Berry (1978); Garrett (1979); Kaufman and Perz (1978); 
Boxhorn (1979); Anon. (1984cc); K. Hale (1985); Higham 
(1985a,b); Mann (1985); C. Tayler (1986e); P. Reeves (1987); 
Fuller (1989) 

Sneak circuits 

McAlister (1984); Rankin (1984) 

Intrinsic safety (see Table 16.2) 

Fail-safe philosophy 

Fusco and Sharshon (1962); Axelrod and Finneran (1965); 
Hix (1972); Nisenfeld (1972); Bryant (1976); Ida (1983) 
Instrument commissioning 
Cans and Benge (1974); Spearing (1974); Shanmugam 
(1981); Meier (1982) 

Instrument maintenance 

Upfold (1971); Skala (1974); Denoux (1975); van Eijk (1975); 
R. Kern (1978d) 

Instrument failure (see also Appendix 14) Scientific 
Instrument Research Association(SIRA)(1970); Anyakora, 
Engel and Lees (1971); A.E. Green and Bourne (1972); Lees 
(1976b); Cornish (1978a-c); English and Bosworth (1978); 
H.S.Wilson (1978); Mahood and Martin (1979); Kletz 
(1981i); Perkins (1980); Weir (1980); R.I. Wright (1980); 
Vannah and Calder (1981); Rooney (1983); Prijatel (1984); 
May (1985) 

Logic systems 

Hodge andMantey(1967);F.J.HillandPeterson(1968);Maley 
(1970); Steve (1971); D. King (1973); E.P. Lynch (1973,1974, 
1980); Zissos (1976); Kampel (1986); S.B. Friedman (1990) 
Protective systems, trip systems 
Bowen and Masters (1959); Obermesser (1960); Barnes 
(1965 UKAEAAHSB(S) R99,1966 UKAEA AHSB(S) R119, 
1967 UKAEA AHSB(S) R122, R131); A.E. Green and 
Bourne (1965 UKAEA AHSB(S) R91,1966 UKAEA 
AHSB(S) R117,1972); L.A.J. Lawrence (1965-66); Bourne 
(1966 UKAEA AHSB(S) R110,1967); A.E. Green (1966 
UKAEA AHSB(S) R113,1968,1969 UKAEA AHSB(S) 
R172,1970); Hensley (1967 UKAEA AHSB(S) R136,1968, 
1971); Hettig (1967);Vaccaro (1969); Schillings (1970); 

M.R. Gibson and Knowles (1971,1982 LPB 44); Kletz (1971, 
1972a, 1985n, 1987J, 1991n); R.M. Stewart (1971,1974a,b); 
Stewart and Hensley (1971); Tucker and Cline (1971); Wood 
(1971); Bennet (1972); R.L. Browning (1972); Herrmann 
(1972); Nisenfeld (1972); Ruziska (1972); J.T. Fisher (1973); 
de Heer (1973,1974,1975); J.R. Taylor (1973,1976c); AEC 
(1975); van Eijk (1975); Lawley and Kletz (1975); 

E.J. Rasmussen (1975); Hullah (1976); B.R.W. Wilson 
(1976); Giugioiu (1977); Quenne and Signoret (1977); 
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B. W. Robinson (1977); Suss (1977);Troxler (1977); 

M.R. Gibson (1978); Kumamoto and Henley (1978); Verde 
and Levy (1979); Chamany, Murty and Ray (1981); Wheatley 
and Hunns (1981); Aitken (1982); Lees (1982a); Rhodes 
(1982); Ciambarino, Merla and Messina (1983); Jonstad 
(1983); Yip, Weller and Allan (1984); Enzina (1985); Lihou 
and Kabir (1985); Hill and Kohan (1986); Onderdank (1986); 

C. Tayler (1986c); Zohrul Abir (1987); Barclay (1988); R. Hill 
(1988,1991); Kumar, Chidambaram and Gopalan (1989); 
Oser (1990); Papazoglu and Koopman (1990); Rushton 
(1991a,b, 1992); Argent, Cook and Goldstone (1992); 
Beckman (1992a,b, 1993); Englund and Grinwis (1992); 

S.B. Gibson (1992); Gruhn (1992a,b); Kobyakov (1993); 

R.A. Freeman (1994);VDI2180 (1967) 

Interlocks 

D. Hughes (n.d.); Richmond (1965,1982); E.G. Williams 
(1965); Platt (1966); Holmes (1971); Rivas and Rudd (1974); 
Rivas, Rudd and Kelly (1974); Becker (1979); Becker and 
Hill (1979); E.P. Lynch (1980); Kohan (1984); Rhoads (1985) 

Control system classification 

WS. Black (1989); EEMUA (1989 Publ. 160) 

Emergency shut-down (ESD)systems 

DoEn (1984); AGA (1988/52); Cullen (1990); HSE (1990b); 

J. Pearson (1992) 

Leak detection 

ISA (1982 S67.03) 

Gas, smoke and fire detectors (see Table 16.2) 
Toxics detectors (see Table 18.1) 

Reaction runaway detectors 

Hub (1977c); Wu (1985) 

Fracture detectors 

Ponton (1980); Wilkie (1985a) 

Instrument air (see Table 11.17) 


(6) The measurements should be as far as possible on 
the variable of direct interest. If this variable has to 
be inferred from some other measurement, this fact 
should be made clear. It is also important that the 
measurement should be at the right location. 

(7) If the variable is critical for process safety, the same 
measurement should not be used for control and for 
an alarm or trip. 

(8) If the variable is critical for operator comprehension, 
it may be desirable to provide additional integrity. 

(9) The alarm system should have a properly thought 
out philosophy, which relates the variables alarmed, 
the number, types and degrees of alarm, and the 
alarm displays and priorities to factors such as 
instrument failure and operator confidence, the 
information load on the operator, the distinction 
between alarms and statuses, and the action which 
the operator has to take. 

(10) The control loops should have fail-safe action as far 
as possible, particularly on loss of instrument air or 
electrical power to the control valves. The action for 
other equipment should also be fail-safe where 
applicable. 


(11) Those control loops which can add material or 
energy to the process are particularly critical and it 
may be desirable to provide additional integrity. 

(12) The control system as a whole and the individual 
instruments should have the ‘rangeability’ neces¬ 
sary to maintain good measurement and control at 
low throughputs. 

(13) The control system should be designed for off- 
normal as well as normal conditions, for example, 
start-up and shut-down. 

(14) Restart situations, such as restarting after a trip 
or restarting an agitator, tend to be particularly 
hazardous. 

(15) Manual stations should be provided which allow the 
operator to manipulate control valves in situations 
such as the failure of the automatic controls. 

(16) The fact of instrument failure should be fully taken 
into account. The reliability of critical instru¬ 
mentation should be assessed quantitatively where 
possible. 

(17) The ways in which dependent failures can occur and 
the ways in which the instrument designer’s inten¬ 
tions may be frustrated should be carefully con¬ 
sidered. 

(18) Instrumentation which is intended to deal with a 
fault should not be disabled by the fault itself. And if 
the process operator has to manipulate the instru¬ 
mentation during the fault, he should not be pre¬ 
vented from doing so by the condition arising from 
the fault. 

(19) The services (instrument air, electrical power, inert 
gas) on which instruments depend should have an 
appropriate degree of integrity. 

(20) The instrument system should be checked regul¬ 
arly and faults repaired promptly. It should not be 
allowed to deteriorate, even though the process 
operator compensates for this. The process operator 
should be trained not to accept instrumentation 
unrepaired over long periods. 

(21) Ease of detection of instrument faults should be an 
objective in the design of the instrument system. The 
process operator should be trained to regard detec¬ 
tion of malfunction in instruments as an integral 
part of his job. 

(22) Instruments which are required to operate only 
under fault conditions, and which may therefore 
have an unrevealed fault, require special consid¬ 
eration. 

(23) Important instruments should be checked regularly. 
The proof test interval should, where possible, be 
determined from a reliability assessment. The 
checks should not be limited to protective systems 
and pressure relief valves, but should include non¬ 
return valves, emergency isolation valves, etc., and 
often also measurements, alarms, control loops, etc. 

(24) Tests should correspond as nearly as possible to the 
expected plant conditions. It should be borne in mind 
that an instrument may pass a workshop test, but 
still not perform satisfactorily on the plant. 

(25) Valves, whether control or isolation valves, are liable 
to pass fluid even when closed. Characterized control 
valves in particular tend not to give a tight shut-off. 
More positive isolation may require measures such 
as the use of double block and bleed valves or of slip 
plates. 
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(26) Valves, particularly control valves, also tend to stick. 
This can give rise to conditions which do not always 
emerge from a simple application of fail-safe philo¬ 
sophy. Jamming in the open position is often parti¬ 
cularly dangerous. 

(27) Practices which process operators tend to develop in 
their use of the instrumentation should be borne in 
mind, so that these practices do not invalidate the 
assumptions made in the reliability assessments. 

(28) The fact of human error should he fully taken into 
account. To the extent that is practical, human fac¬ 
tors principles should be applied to reduce human 
error, and the reliability of the process operator 
should be assessed quantitatively. 

It is also necessary to pay careful attention to the details of 
the individual instruments used. Some features which are 
important are as follows: 

(1) Instruments are a potential source of failure, either 
through a functional fault on the instrument or 
through loss of containment at the instrument. 

(2) Use of inappropriate materials of construction can 
lead to both kinds of failure. Materials should be 
checked carefully in relation to the application, 
bearing in mind the possible impurities as well as the 
bulk chemicals. It should be remembered that the 
instrument supplier usually has only a very general 
idea of the application. 

(3) Instruments containing glass, such as sight glasses 
or rotameters, can break and give rise to serious 
leaks and should be avoided if such leaks could be 
hazardous. 

(4) Instruments may need protection against the pro¬ 
cess fluid due to its corrosiveness. Examples of pro¬ 
tection are the use of inert liquids in the impulse lines 
on pressure transmitters or of chemical diaphragm 
seals on pressure gauges. 

(5) Sampling and impulse lines should be given careful 
attention. Purge systems are often used to overcome 
blockages in impulse lines. Freezing is another 
common problem, which can be overcome by the use 
of steam or electrical trace heating. 

(6) Temperature measuring elements should not nor¬ 
mally be installed bare, but should be protected by a 
thermowell. A thermowell is frequently exposed to 
quite severe conditions such as erosion/corrosion or 
vibration and should be carefully designed. 

(7) Pulsating flow is a problem in flowmeters such as 
orifice plate devices and can give rise to serious 
inaccuracies. This is a good example of a situation 
where replication of identical instruments is no help. 

(8) Pressure transmitters and regulators are easily damaged 
by overpressure and this needs to be borne in mind. 

(9) Complex instruments such as analysers, speed con¬ 
trollers, vibration monitors and solids weighers are 
generally less reliable than other instruments. This 
requires not only that such instruments should receive 
special attention but also that the consequences of 
failure should be analysed with particular care. 

(10) Different types of pressure regulators are often con¬ 
fused, with perhaps a pressure reducing valve being 
used instead of a non-return valve, or vice versa. It is 
specially necessary with these devices to check that 
the right one has been used. Also, bypasses should 
not be installed across pressure regulators. 


(11) Selection of control valves is very important. A con¬ 
trol valve should have not only the right nominal 
capacity but also appropriate rangeability and con¬ 
trol characteristics. It should have any fail-safe 
features required, which may include not only action 
on loss of power but also a suitable limit to flow when 
fully open. It should have any necessary temperature 
protection, for example cooling fins. Bellows seals 
may need to be provided to prevent leaks. The valve 
should have a proper mechanical balance for the 
application, so that it is capable of shutting off against 
the process pressure. It should be borne in mind that 
any valve, but particularly a characterized valve, 
may not give completely tight shut-off, and also that a 
badly adjusted valve positioner can prevent shut-off. 

(12) Instruments should not be potential sources of igni¬ 
tion and should conform with the hazardous area 
classification requirements. 

Further discussions of the safety and loss prevention(SLP) 
aspects of instrument systems are given by Mix (1972) and 
the Center for Chemical Process Safety (CCPS, 1993/14). 

13.3.2 Instrument distribution 

A feel for the distribution of types of instrument on a 
process plant may be obtained from the following figures 
given by Tayler (1987a): 



Overall 

(%) 

Monitoring 

(%) 

Control 

(%) 

Pressure 

40 

26 

21 

Temperature 

32 

56 

15 

Flow 

20 

8 

47 

Level 

8 

4 

8 

Analysis 


3 

4 

Miscellaneous 


3 

5 


The first column evidently refers only to the four main 
types. It can be seen that, whereas temperature is dominant 
for monitoring, it is flow which predominates in control. 

13.3.3 Instrument accuracy 

Most process plant instrumentation are quite accurate 
provided they are working properly. Information on the 
expected error limits of commercially available instru¬ 
mentation has been given by Andrew and Williams (1980), 
who list limits for over 100 generic types of instrument. 
Some ranges of total error quoted by these authors are: 

Pressure: 

Bellows transmitter ±0.5% 

Temperature: 

Thermocouple ±0.25—5% 

Resistance thermometer ±0.2—0.5 
Flow: 

Orifice meter ±0.5-1% 

Differential pressure ±0.5-2% 

Analysis: 

Gas chromatograph ±0.5-1% 
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13.3.4 Instrument signal transmission 

Pneumatic instrument signals are transmitted by tubing, 
but several means are available for the transmission of 
electrical signals: wire, fibre optics and radio waves. The 
signals from measuring instruments can become cor¬ 
rupted in transmission. Pneumatic signals may be affected 
by poor quality instrument air, while electrical signals are 
liable to be subject to electromagnetic interference. 

Both pneumatic and electrical instrument signals utilize 
live zero, standard ranges being 3-15 psig for pneumatic 
instruments and 4-20 mA for electronic ones. This avoids 
the situation where a zero signal is ambiguous, meaning 
either that the measured variable actually has a zero value 
or that the instrument signal has simply gone dead. 

13.3.5 Instrument utilities 

Instrument systems require high quality and high relia¬ 
bility utilities. A general account of instrument utilities 
has been given in Chapter 11. As far as quality is con¬ 
cerned, pneumatic systems require instrument air which is 
free of dirt and oil. Many electronic instrument systems can 
operate from an electrical feed which does not constitute an 
uninterruptible power supply (UPS). But computers and 
PESs are intolerant of even millisecond interruptions, 
unless they have their own in-built means of eliminating 
them. A further treatment of instrument utilities is given 
by the CCPS (1993/14). 

13.3.6 Valve leak-tightness 

In many situations on process plants, the leak-tightness of 
a valve is of some importance. The leak-tightness of valves 
is discussed by Hutchison (1976) in the ISA Handbook of 
Control Valves. 

Terms used to describe leak-tightness of a valve trim are 
(1) drop tight, (2) bubble tight or (3) zero leakage. Drop 
tightness should be specified in terms of the maximum 
number of drops of liquid of defined size per unit time and 
bubble tightness in terms of the maximum number of bub¬ 
bles of gas of defined size per minute. 

Zero leakage is defined as a helium leak rate not exceed¬ 
ing about 0.3 cm 3 /year. A specification of zero leakage is 
confined to special applications. It is practical only for 
smaller sizes of valves and may last for only a few cycles of 
opening and closing. Liquid leak-tightness is strongly 
affected by surface tension. 

Specifications for leak-tightness of a stop, or isolation, 
valve are given in SP-61 by the US Valve Manufacturers 
Standardization Society, and are quoted in the ISA Hand¬ 
book. In respect of control valves, the Handbook states: 
Properly designed control valves can achieve stop valve 
tightness and maintain it throughout a long service life 
before trim replacement; particularly with cage guided, 
balanced trim having elastomer plug-to-cage seals. The 
control valve, however, is expected to throttle and often 
shuts off much more frequently than stop valves. For 
example, some dump valves may have from 4000 to 7000 
opening and closing cycles per day, handling high pres¬ 
sure and erosive fluids at 1000 to 4000 psi pressure drop. 
Few stop valves could match this performance and 
remain tight. 

It is normal to assume a slight degree of leakage for control 
valves. It is possible to specify a tight shut-off control valve, 
but this tends to be an expensive option. A specification for 


leak-tightness should cover the test fluid, temperature, 
pressure, pressure drop, seating force and test duration. 
For a single-seated globe valve with extra tight shut-off, 
the Handbook states that the maximum leakage rate may 
be specified as 0.0005 cm 3 of water per minute per inch 
of valve seat orifice diameter (not the pipe size of the 
valve end) per pound per square inch pressure drop. Thus, 
a valve with a 4 in. seat orifice tested at 2000 psi differential 
pres|ure would have a maximum water leakage rate of 

13.3.7 Hazardous area compatibility 

The instrument system, including the links to the control 
computers, should be compatible with the hazardous area 
classification. Hazardous area classification involves first 
zoning the plant and then installing in each zone instru¬ 
mentation with a degree of safeguarding appropriate to 
that zone. Since much instrumentation is of low power, an 
approach based on inherent safety is often practical. These 
various aspects of hazardous area classification are dealt 
with in Chapter 16. 

13.3.8 Multi-functional vs dedicated systems 

An aspect of basic design philosophy which occurs 
repeatedly in different guises is the choice which has to be 
made between a multi-functional and a dedicated system. 
Some basic functions which are typically required are 
(1) monitoring, (2) control, (3) trips and interlocks, (4) fire 
and gas detection, (5) ESD and (6) communication. The trip 
system may well be separate from the monitoring and con¬ 
trol system and the ESD system trips separate from the 
other trips. 

The situation which develops is illustrated in Figure 13.1(a) 
which shows a traditional design for an offshore produc¬ 
tion platform system (A. Morris, 1986). The alternative 
design which he proposes for consideration is shown in 
Figure 13.1(b). To the objection that this latter design puts 
all its eggs in one basket, the author puts two arguments. 
First, the overall reliability has been improved to such an 
extent that the frequency of a complete system failure will 
be very low. Second, in the majority of cases, the process 
should be able to survive such failure because it can be 
brought to a safe state by simple measures, notably by 
shutting off the heat input and depressurizing. 

A particular but common example of the multi¬ 
functional vs dedicated system problem is the choice bet¬ 
ween a computer-based and a hardwired trip system. This 
aspect is discussed further in Sections 13.9,13.12 and 13.15. 

13.4 Process Computer Control 

The use of computers in control systems began in the late 
1950s and is now a mature technology. Process control 
computer systems and applications are described in Com¬ 
puter Control of Industrial Processes (Savas, 1965), Compu¬ 
ter Control of Industrial Processes (Lowe and Hidden, 1971), 
Handbook of Industrial Control Computers (Harrison, 1972), 
Understanding Distributed Process Control (Moore and 
Herb, 1983), Computer Systems for Process Control (Giith, 
1986) and Industrial Digital Control Systems (Warwick and 
Rees, 1986), while a description of computer control and its 
relation to operator control has been given in Man and 
Computer in Process Control (E. Edwards and Lees, 1973). 
Selected references on process computer control are given 
in Table 13.3. 
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(b) 


Figure 13.1 Instrumentation fora system on an offshore production platform (A. Morris, 1986): (a) conventional 
system and (b) alternative system (Courtesy of Process Engineering) 


The inclusion of a process control computer greatly 
extends the capabilities, but also affects the reliabil¬ 
ity, of the control system. These two aspects are now 
considered. 


13.4.1 Computer configurations and reliability 

There are several ways in which a computer may be incor¬ 
porated in a process control system. The approaches ori¬ 
ginally used are illustrated in Figure 13.2. If there is no 
computer, then the loops are controlled by analogue con¬ 
trollers as shown in Figure 13.2(a). 

The configuration given in Figure 13.2(b) is set-point 
control. The computer takes in signals from measuring 
instruments and sends signals to the set points of analogue 
controllers. If there is a computer failure, control is still 
maintained by the analogue controllers. Figure 13.2(c) 
shows DDC. The computer again takes in signals from 
measuring instruments, but now sends signals direct to the 
control valves; there are no analogue controllers. If there is 
a computer failure, control is lost on all loops, unless stand¬ 
by arrangements have been made. Although set-point con¬ 
trol developed first, it was followed quickly by DDC, and 
both methods came into use. 

The first large DDC installation on a chemical plant was 
on the ammonia soda plant of Imperial Chemical Industries 
(ICI) at Fleetwood (Burkitt, 1965; A. Thompson, 1965). The 
computer carried out DDC on 98 loops and achieved an 
availability of about 99.8%. Further accounts of DDC 


systems have been given by Barton et al. (1970) and by 
Higson etal. (1971). 

Although the initial intention was for DDC to save the 
cost of analogue controllers, it soon became apparent that 
many other factors were involved in the choice between set- 
point control and DDC. Since, with DDC, computer failure 
leads to loss of control, it may be necessary to achieve a 
much higher reliability than with set-point control. The 
effort required to implement a DDC installation tends, 
therefore, to be much greater. It is necessary to pay very 
careful attention to details of the computer, the power sup¬ 
ply and the environment, the input-output equipment and 
the programming. Usually DDC does not reduce the cost of 
adding computer control to the control system much below 
that for set-point control. Savings in costs per loop tend to 
be slight, because the equipment needed to get measure¬ 
ments into the computer and to position the control valves 
from it is quite expensive. It is necessary to provide stand¬ 
by analogue controllers for critical control loops and 
change-over equipment to transfer between computer and 
analogue control. The extra general effort required to 
assure integrity in DDC is also significant. 

On the other hand, DDC does offer some advantages, not 
only over conventional control but also over set-point con¬ 
trol. The advantages derive from the fact that the computer 
takes in signals from the measuring instruments and can 
process them in all sorts of ways before sending out the 
results as signals to the control valves. It makes it possible 
to: carry out operations on the measurements, such as 
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Table 13.3 Selected references on process 
computer control 


Process computer control, including 
distributed control 

Savas (1965); Anke, Kaltenecker and Oetker (1970); Lowe 
and Hidden (1971); TJ. Harrison (1972); Lees (1972); 

E. Edwards and Lees (1973); IEE (1977 Conf. Publ. 153,1982 
Control Ser. 21,1988 Control Ser. 37,1989 Conf. Publ. 314, 
1990 Control Ser. 44,1993 Control Ser. 48); R.E. Young 
(1977); Bader (1979); Sandefur (1980); Cocheo (1981); 
IMechE (1982/61); Petherbridge (1982); Helms (1983); 

D. R. Miller, Begeman and Lintner (1983); J.A. Moore and 
Herb (1983); Rembold, Armbruster and Ulzmann (1983); 
Anon. (1984rr); Nordic Liaison Committee (1985 NKA/LIT 
(85)5); C.Tayler (1985b, 1986d); Giijth (1986); Hide (1986); 
Morrish (1986); Warwick and Rees (1986); J. Pearson and 
Brazendale (1988); D.L. May (1988); Strock (1988); 
Eddershaw (1989 LPB 88); J.A. Shaw (1991); Livingston 
(1992); Ray, Cary and Belger (1992); Wadi (1993) BS 
(Appendix 27 Computers) 

Computer integrated processing 

Zwaga and Veldkamp (1984); C.Tayler (1985d); O’Grady 
(1986);T.J.Williams (1989);W.Thompson (1991); Canfield 
and Nair (1992); Conley and Clerrico (1992); Mehta (1992); 
Nair and Canfield (1992); Sheffield (1992); Stout (1992); 
Bernstein et d. (1993); Koppel (1993); Mullick (1993); 
Yoshimura (1993) 

Programmable electronic systems 

Zielinski (1978); Bristol (1980); Sargent (1980); EEMUA 
(1981 Publ. 123); HSE (1981 OP 2,1987/21,22); Dartt (1982); 
IBC (1982/39); Devries (1983); Martinovic (1983); Martel 
(1984); Lihou (1985b, 1987); Skinner (1985 LPB 62); Weiner 
(1985); Wilkinson and Balls (1985); R. Bell (1986); Daniels 
(1986); Fulton and Barrett (1986); Holsche and Rader 
(1986); Margetts (1986a,b, 1987); Pinkney (1986); 
Wilkinson (1986); Anon. (1987u); Pinkney and Hignett 
(1987); Wilby (1987); Bellamy and Geyer (1988); Clatworthy 
(1988); D.K. Wilson (1988); Deja (1989); IGasE (1989IGE/ 
SR/15); Max-lino (1989); Oser (1990); British Gas (1991 
Comm. 1456); Borer (1991); J. Pearson (1991); Sawyer 
(1991a); Gruhn (1992b); Prugh (1992d) 

Control rooms, computer displays 

Bernard and Wujkowski (1965); Wolff (1970); IEE (1971 
Conf. Pub. 80,1977 Conf. Pub. 150); Dallimonti (1972,1973); 

E. Edwards and Lees (1973); Strader (1973); Lees (1976d); 
Bonney and Williams (1977); Jervis and Pope (1977); 
Hammett (1980); Burton (1981); Lieber (1982); C.M. Mitchell 
and Miller (1983); Banks and Cerven (1984); Jansen (1984); 
Mecklenburgh (1985); C.Tayler (1986a); Gilmore, Gertman 
and Blackman (1989) 

Computer system reliability, including safety 
critical systems (SCS), fault tolerant systems, 
computer system security (see also Table 7.1) 

Hendrie and Sonnenfeldt (1963); R.J. Carter (1964); 
Sonnenfeldt (1964); Burkitt (1965); A. Thompson (1965); 
Lombardo (1967); Regenczuk (1967); Amrehn (1969); Stott 
(1969); Anon. (1970d); Barton etd. (1970); Hubbe (1970); 
Luke and Golz (1970); H.F. Moore and Ballinger (1970); 
Parsons, Oglesby and Smith (1970); J. Grant (1971); 

J.A. Lawrence and Buster (1972); E. Edwards and 
Lees (1973); Daniels (1979 NCRS17,1983,1986); 


N.R. Brown (1981); Wong (1982); Anon. (1984cc); Hura 
(1984); Bucher and Frets (1986) 

Computer-based trips 

Wilkinson and Balls (1985); Wilkinson (1986); Cobb and 
Monier-Williams (1988) 

Computer-based ‘black box’ recorder 

Anon. (1977a) 

Safety of computer-controlled plants 

Kletz (1982g, 1991g, 1993a); Pitblado, Bellamy and Geyer 
(1989); P.A. Bennett (1991a); Frank and Zodeh (1991); 

PG. Jones (1991); Pearson (1991) BS (Appendix 27 
Computers) 

Computer control applications 

W.E. Miller (1965); UKAC (1965); Control Engineering 
(1966); IEE (1966 Conf. Pub. 24,1967 Conf. Pub. 29,1968 
Conf. Pub. 43,1969 Coll. Dig. 69/2,1971 Conf. Pub. 81,1972 
Conf. Pub. 83,1973 Conf. Pub. 103,1975 Conf. Pub. 127,1977 
Coll. Dig. 77/30); Washimi and Asakura (1966); IChemE 
(1967/45); M.J. Shah (1967); Whitman (1967); Barton etd. 
(1970); Higson etd. (1971); Sommer etd. (1971); E. Edwards 
and Lees (1973); Daigre and Nieman (1974); St Pierre (1975); 
Tijssen (1977); P.G. Friedman (1978); Weems, Ball and 
Griffin (1979); British Gas (1983 Comm. 1224); IBC (1983/ 
40); Seitz (1983); C.Tayler (1984b);Tatham, Jennings and 
Klahn (1986) 


calculation of indirect measurements and filtering of mea¬ 
surement signals; ensure that the control algorithm is truly 
proportional, integral and derivative without the inac¬ 
curacies and interactions which tend to occur in analogue 
controllers; use different control algorithms such as non¬ 
linear or asymmetrical algorithms or algorithms with some 
logic in them; eliminate features such as integral saturation 
and derivative kick; position valves more accurately; alter 
the control configuration; and so on. 

There are several ways in which the reliability of DDC 
systems can be improved. One of these, as mentioned ear¬ 
lier, is the use of standby controllers on critical loops. But 
this is by no means a complete answer to the problem. The 
system may still be upset by intermittent faults, there may 
be difficulties in keeping the standby instrumentation 
maintained and avoiding degradation, and the operator is 
faced with a different interface to use on loss of computer 
control. Another approach is the use of duplication. In this 
case it is necessary not only to use dual computers, but also 
to duplicate other parts of the system such as power sup¬ 
plies and input-output equipment.Various configurations 
are possible and in normal operation the work may be 
divided either on a parallel or a hierarchical basis, but in all 
cases the essential principle is that the surviving computer 
takes over the critical control functions. The reliability of 
dual computer systems is undoubtedly higher, but it can 
still be affected by factors such as intermittent failures, 
data link troubles, hardware faults in common, such as 
earthing, and software faults in common, such as pro¬ 
gramming errors. With regard to reliability, for the type of 
system just described, the most reliable systems achieved a 
mean time between failures (MTBF) and an availability of 
not less than 2000 h and 99.9%, respectively. 

Advances in process control systems, and particularly 
the trend towards distributed PESs, have largely resolved 
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the dilemmas described and have gone far towards solving 
the reliability problems. Figure 13.3 shows schematically a 
system configuration typical of these developments. The 
backbone of the system is a data highway to which various 
devices are connected. The individual PES controllers are 
capable of operating as DDC controllers in the stand-alone 
or set-point control modes. The VDU display can also oper¬ 
ate independently of the computer. Thus, the system allows 
the full facilities of DDC if the computer is working, but on 
computer failure, the controllers maintain control and the 
VDU display continues to provide the operator with the 
usual interface. 

Various configurations may be used to obtain back-up 
control of critical loops. Where a loop is backed up, it is 
desirable to ensure ‘bumpless’ transfer when the standby 
equipment assumes control. This involves a process of 
initialization before control is transferred. 

Accounts of computer-based and PES-based process 
control systems based on these principles include those by 
E. Johnson (1983),Tatham, Jennings and Klahn (1986), Cobb 
and Monier-Williams (1988) and the CCPS (1993/14). PESs 
for process control are considered further in Section 13.12. 
Data on the reliability of computer systems are given in 
Appendix 14. 


13.4.2 Computer functions 

If the computer carries out DDC, then this is its most 
important function. The facilities and flexibility which 
DDC offers have already been described. However, as just 
described, modern process control systems are generally 
based on distributed PESs. 

The other main functions which a process control com¬ 
puter or PES performs are: 

(1) measurement; 

(2) data processing and handling; 

(3) monitoring; 

(4) other control; 

(5) sequential and logical control; 

(6) optimization; 

(7) scheduling; 

(8) communication. 

Several of these functions are important in relation to SLP. 

The measurements on which control depends are critical. 
The computer is often used to carry out certain checks 
on the measurements as described in Chapter 30. It can also 
upgrade them in various ways such as by extraction of non- 
linearities, zero or range correction, or filtering. 

The computer’s ability to calculate ‘indirect’or ‘inferred’ 
measurements is widely used. These are calculated from 
one or more process measurements and possibly other data 
inserted into the computer, for example, laboratory ana¬ 
lyses. Thus, the mass flow of a particular component may 
be calculated from a total mass flow and a concentration 
measurement. It is often such indirect measurements 
which are of principal interest and their use represents a 
real advance in control. An indirect measurement can be 
subjected to all the operations which are carried out on 
direct measurements: it can be displayed, logged, mon¬ 
itored, controlled and used in modelling and optimization. 

The computer usually logs data and provides summaries 
for the process operator and management. These logs 
often contain important information on equipment faults, 
operator interventions, etc. Arrangements are also some¬ 
times made for a post-mortem log in the event of a serious 
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incident on the process. This usually involves holding a 
continuously updated set of data on process instrument 
readings so that it can be replayed if necessary. 

The computer almost invariably carries out monitoring 
of the process measurements and statuses to detect abnor¬ 
mal conditions. This constant scanning of the operating 
conditions is invaluable in maintaining control of the pro¬ 
cess. Computer alarm scanning is considered, together 
with other aspects of the alarm system with which the 
operator interacts, in more detail in Chapter 14. 

Frequently, there are one or two process variables, 
equipments or operations which are particularly difficult 
to control, and for these, more advanced control methods 
may be appropriate. These methods are usually difficult to 
implement without a computer. The following appear to be 
especially useful: (1) indirect variable control, (2) automatic 
loop tuning, (3) control of dead time processes and (4) non¬ 
interacting control. 

The execution by the computer of sequential operations 
in a reliable manner is another common function which is 
invaluable in maintaining trouble-free operation of the 
process. Such sequential control involves much more than 
simply sending out control signals. It is essential for checks 
to be made to ensure that the process is ready to proceed to 
the next stage, that the equipment has obeyed the control 
signals, and so on. There is, therefore, a liberal sprinkling 
of checks throughout the sequence. Thus, sequential con¬ 
trol involves continuous checking of the state of the process 
and the operation of equipment. 

Using a computer, it is possible to carry out more com¬ 
plex sequences with greater reproducibility. This is parti¬ 
cularly useful in operations where it is necessary to follow a 
rather precise schedule in order to avoid damage to the 
equipment. 

On some processes where there is a time-varying 
optimum, the computer carries out continuous optimiza¬ 
tion. Optimization is usually performed with a set of 
constraints. Computer optimization therefore provides as 
by-product, a more formal definition of, and adherence 
to, process constraints. 

There are several other computer functions which are 
particularly relevant to SLP. These include computer alarm 
analysis, valve sequencing and malfunction detection. 
These are dealt with in Chapter 30. 

For many years there was very little use of computers to 
carry out the protective function of tripping plant when a 
hazardous condition occurs. The protective system has 
almost invariably been a system separate from the control 
system, whether or not the latter contains a computer, and 
engineered for a greater degree of integrity. There is now 
movement towards the use of PESs for the trip functions 
also, but only where it can be demonstrated that the system 
has a reliability at least equal to that of a conventional 
hardwired system. 

13.4.3 Computer displays and alarms 

Process computers, as just indicated, are powerful tools for 
the support of information display and alarm systems. The 
design of such systems is intimately bound up with the 
needs of the process operator, and discussion is therefore 
deferred to Chapter 14. 

13.4.4 Fault-tolerant computer systems 

To the extent practical, process computer systems should 
be fault tolerant. A fault-tolerant system is one which 


continues to perform its function in the face of one or more 
faults. Accounts of fault-tolerant design of computer sys¬ 
tems, including process computer systems, are given by 
Shrivastava (1991), the CCPS (1993/14) and Johnston (1993). 

The creation of a fault-tolerant system involves a combi¬ 
nation of approaches. A necessary preliminary effort is to 
obtain high reliability and thus to eliminate faults. The 
methods of reliability engineering may be used to model the 
system and to identify weak points. The use of redundancy 
and diversity is a common strategy. Dependent failures and 
methods of combating them should receive particular 
attention. 

Prompt detection and repair of faults is an important 
part of a strategy for a fault-tolerant system. A fault- 
tolerant system should degrade gracefully, and safely. One 
important aspect is the fail-safe action of the system. 

13.4.5 Computer power supplies 

Process computers and PESs require a high reliability and 
high quality power supply A general account of power 
supplies is given in Chapter 11. The operation of such 
equipments can be upset by millisecond interruptions, 
unless they have in-built means of dealing with them. They 
therefore generally require a UPS. Devices used to provide 
a UPS include motor generators, DC/AC inverters and 
batteries. 

The power supply also needs to be uninterruptible in the 
sense that it has high reliability. One option is the use of 
batteries, another is some form of redundancy or diversity 
of supply. 

A treatment of power supplies for PESs is given by the 
CCPS (1993/14). A relevant code for UPSs is IEEE 446. 

13.4.6 Computer system protection 

Process computers and PESs require suitable protection 
against fire and other hazards. 

For fire protection, the relevant codes are BS 6266:1992 
Code of Practice for Fire Protection of Electronic Data 
Processing Installations, NFPA 75: 1992 Protection of 
Electronic Computer/Data Processing Equipment and 
NFPA 232:1991 Protection of Records. 

Lightning protection is covered in NFPA 78:1989 Light¬ 
ning Protection Code. 

Codes for earthing are BS 1013:1965 Earthing and IEEE 
142:1982 Grounding of Industrial and Commercial Power 
Systems (the IEEE Green Book). 

These hazards and protection against them are treated 
by the CCPS (1993/14). 

13.5 Control of Batch Processes 

The control of batch processes involves a considerable 
technology over and above that required for the control of 
continuous processes. Accounts of hatch process control 
are given in Batch Process Automation (Rosenof and Ghosh, 
1987), Batch Control Systems (T.G. Fisher, 1990) and 
Computer-Controlled Batch Processing (Sawyer, 1993a) and 
by Love (1987a-c, 1988). 

Batch processes constitute a large proportion of those in 
the process industries. Sawyer (1993a) gives the following 
figures: 

Many batch plants are multi-purpose and can make 
multiple products. Their outstanding characteristic is their 
flexibility. They differ from continuous plants in that: the 
operations are sequential rather than continuous; the 
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environment in which they operate is often subject to major 
variability; and the intervention of the operator is to a much 
greater extent part of their normal operation rather than a 
response to abnormal conditions. A typical batch plant is 
shown in Figure 13.4. 


13.5.1 Models of batch processing 

There are a number of models which have been developed to 
represent batch processing. Three described byT.G. Fisher 
(1990) are (1) the recipe model, (2) the procedure model and 
(3) the unit model. 

The recipe model centres on the recipe required to make a 
particular product. Its elements are the procedures, the 
formula, the equipment requirements and the ‘header’. The 
procedure is the generic method of processing required to 
make a class of product. The formula is the raw materials 
and operating conditions for the particular product. The 
equipment requirements cover the equipment required to 
execute the formula, including materials of construction. 
The header is the identification of the batch in terms of 
product, version, recipe and so on. 


Charging unii 



To product packaging 


Figure 13.4 A typical batch plant (Sawyer, 

1993) (Courtesy of the Institution of Chemical Engineers) 


The procedure model has the form: 

Procedure —> Operation —> Phase —> Control step 

The overall procedure consists of a number of operations, 
akin to the unit operations of continuous processes, except 
that they may be carried out by the same equipment. The 
phase is a grouping of actions within an operation. The 
control step is the lowest level of action, typically involving 
the movement of a small number of final control elements. 

The concept of phase is a crucial one in batch processing. 
A phase is a set of actions which is logical to group together 
and which ends at a point where it is logical and safe for 
further intervention to take place. It is closely connected, 
therefore, with the concept of ‘hold’ states at which it is safe 
for the process to be held. The possibility that other facil¬ 
ities on which the progress of the batch depends may not be 
immediately available makes such hold states essential. 
The unit model is equipment-oriented and has the form: 

Unit —> Equipment module —► Device/loop —► Element 

The unit is broken down into functional equipment mod¬ 
ules such as vessels and columns. These in turn are 
decomposed into devices and loops which are groupings of 
elements such as sensors and control valves. 


13.5.2 Representation of sequential operations 

The control of a batch process is a form of sequential 
control. A typical sequential control procedure, expressed 
in terms of the procedure model, is shown in Table 13.4. 
Various methods are available for the specification of 
sequences. They include (1) flowcharts, (2) sequential 
function charts and (3) structured plain language. 

The flowchart is a common method of representing 
sequences, but its successful use requires that: a consistent 
style be adopted; that the method cater to the procedure 
hierarchy by the use of a hierarchy of charts for operations, 
phases and control steps; it also allows for parallel activities 
and for actions prompted by alarms and failures; and is 
supplemented by information on recipes, units, etc., and 
by other representations such as structured language. 
Computer-based drafting aids are invaluable in creating 
flowcharts. 

The sequential flowchart has been developed expressly 
to describe sequential control and has three basic features: 
(1) steps, (2) transitions and (3) directed links. A step is an 
action and ends with a conditional transition. If the condi¬ 
tion is satisfied, control passes to the next step. This latter 
step then becomes active and the previous step inactive. A 
directed link creates a sequence from steps and transitions. 
Figure 13.5 shows a sequential flowchart together with the 
standard symbols used in the creation of such charts. 

With regard to the use of structured language, Rosenof 
and Ghosh advise that: (1) simple statements should be 
used; (2) the required function should be clearly defined in 
a statement; (3) the plant hardware addressed should, 
where possible, be identified; (4) text should be indented 
where necessary; (5) negative logic should be avoided and 
(6) excessive nested logic should be avoided. 


13.5.3 Structure of batch processing 

The overall structure of batch processing is commonly 
represented as a hierarchy. The following structure and 
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Table 13.4 

Typical sequential control procedure (Sawyer, 1993a) (Courtesy of the Institution of Chemical Engineers) 

Operations 

Phases 

Controls steps 

Initialize 

Initialize 

Start jacket circulation pump. Put reactor temperature controller in 
SECONDARY AUTO mode with set-point of 120°C 

Weigh 

Weigh Component 3 

Initialize (tare-off weigh tank). Open outlet valve from head tank. 
When weight of component 3 equals preset, close outlet valve from 
head tank 

Charge 

Add Component 3 

Open outlet valve from weigh tank. When enough of component 3 has 
been added, start the agitator. When weigh tank is empty, close 
outlet valve 


Add Component 1 

Initialize (reset flow totalizer to zero). Open outlet valves from head 
tank to flowmeter and from flowmeter to reactor. When volume of 
Component 1 charged equals preset, close outlet valves 

React 

Heat 

Initialize (put reactor temperature controller in CASCADE mode with 
set-point of 120°C) 


Hold 

Sample 

Initialize (reset timer). Start timer 

Discharge 

Cool 

Initialize (set reactor temperature set-point to 35°C) 


Transfer 

Initialize (set reactor outlet valves to correct destination, i.e. storage 
tank). Start discharge pump. Set reactor temperature controller 
to MANUAL mode with output at zero (full cooling). Before 
agitator blades are uncovered, stop agitator. When reactor is empty, 
close reactor outlet valves, stop discharge pump, stop jacket 
circulation pump 


terminology by Rosenof and Ghosh (1987) is widely used: 

Production planning —► Production scheduling 
—> Recipe management —> Batch management 
—> Sequential control —> Discrete/regulatory control 
—> Process interlocks —► Safety interlocks 

A treatment of batch processing as a form of computer 
integrated manufacturing (CIM) is given in Section 13.7. 

13.5.4 Batch control systems 

Batch processing may be controlled by the process opera¬ 
tor, by a system of single controllers or by a programmable 
logic control (PLC) system, a distributed control logic sys¬ 
tem (DCL) or a centralized control system (CCS). The 
selection of the system architecture and hardware is dis¬ 
cussed by Sawyer (1993). 

Recommendations for batch control have been made in 
Europe by the NAMUR committee (1985), which addresses 
particularly the need for standard terminology and for a 
hierarchical structure of the control system which reflects 
that of batch processing itself. 

In the United States, guidance is available in the form of 
ISA SP88:1988 Batch Control Systems. 

13.6 Control of Particular Units 

The safe operation of process units is critically dependent 
on their control systems. Two particularly important fea¬ 
tures of control in process plant are (1) compressor control 
and (2) chemical reactor control. These are now considered 


13.6.1 Compressor control 

Centrifugal and axial compressors are subject to the phe¬ 
nomenon of surging. Surging occurs when flow through the 


compressor falls to a critical value so that a momentary 
reversal of flow occurs. This reversal of flow tends to lower 
the discharge pressure and normal flow resumes.The surge 
cycle is then repeated. Severe surging causes violent 
mechanical shock and noise, and can result in complete 
destruction of parts of the compressor such as the rotor 
blades. 

A typical centrifugal compressor characteristic showing 
the surge limit is illustrated in Figure 13.6(a). A centrifugal 
compressor is usually fitted with antisurge controls which 
detect any approach to the surge conditions and open the 
bypass from the delivery to the suction of the machine, thus 
increasing the flow through the machine and moving it 
away from the surge conditions. 

The compressor delivery and suction pressures P A and P s 
are related to the gas flow Q as follows: 

P d - P s (x Q 2 [13.6.1] 

The shape of the surge curve is therefore parabolic as 

shown in Figure 13.6(a). An expression of this form is gen¬ 
erally inconvenient in instrumentation, for which linear 
relations are preferred. A linear relation can be obtained by 
making use of the relation for pressure drop AP across the 
orifice flowmeter on the compressor suction: 

Q 2 tx AP [13.6.2] 

Hence from relations 13.6.1 and 13.6.2, 

P d -P s cxAP [13.6.3] 

Figure 13.6(b) shows the compressor characteristics 

redrawn in terms of this pressure drop. The surge condition 
is now given by a straight line. The antisurge control sys¬ 
tem is set to operate on a line somewhat in advance of the 
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Figure 13.5 Sequential function chart (Sawyer, 1993): (a) chart for control steps ADD COMPONENT; 
and (b) basic symbols (Courtesy of the Institution of Chemical Engineers) 


surge limit, as shown in Figure 13.6(b). The antisurge con¬ 
troller is usually a P+I controller and, since it operates only 
intermittently, it needs to have arrangements to counteract 
integral saturation. 

Accounts of centrifugal and axial compressor control are 
given by Claude (1959), R.N. Brown (1964), Daze (1965), 
Hatton (1967) and Magliozzi (1967), and accounts of reci¬ 
procating compressor control are given by Hagler (I960) 
and Labrow (1968). Multi-stage compressor control is dis¬ 
cussed by D.F. Baker (1982), Maceyka (1983) and Rana 
(1985), and control of compressors in parallel by Nisenfeld 
and Cho (1978) and B. Fisher (1984). 

13.6.2 Chemical reactor control 

The basic characteristics of chemical reactors have already 
been described in Chapter 11, in which, in particular, 
an account was given of the stability and control of a 


continuous stirred tank reactor. It is appropriate here to 
consider some additional aspects of reactor control. 

A continuous stirred tank reactor is generally stable 
under open-loop conditions, but in some cases, a reactor 
may be unstable under open-loop but stable under closed- 
loop conditions. Some polymerization reactors and some 
fluidized bed reactors may be open-loop unstable under 
certain conditions. 

The reactor should be designed so that it is open-loop 
stable unless there is good reason to the contrary. One 
method of achieving this is to use jacket cooling with a large 
heat transfer area. Another is to cool by vaporization of the 
liquid in the reactor. This latter method gives a virtually 
isothermal reactor. 

If the reactor is or may be open-loop unstable, the control 
system should be very carefully designed. The responses of 
the controls should be fast. One method of achieving this 
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Figure 13.6 Centrifugal compressor characteristics illustrating surge and antisurge control: (a) conventional 
characteristic; (b) characteristic for antisurge control 


is the use of cascade control for the reactor temperature to 
the coolant temperature. The dead time should be mini¬ 
mized. A high coolant flow assists in reducing dead time. 

Continuous stirred tank reactors and batch reactors have 
their own characteristic control problems. Some of the 
control problems of continuous stirred tank reactors are as 
follows. A reaction in a continuous reactor is often carried 
out in a single phase in one pass. This requires accurate 
control of the feed flows to the reactor. Failure to achieve 
such control may have effects such as unconverted reactant 
leaving the reactor, undesirable side reactions or rapid 
corrosion. 

It is often possible for impurities to build up in a con¬ 
tinuous reactor. Where this is the case, arrangements 
should be made to purge the impurities. If the reactants to a 
continuous reactor need to be preheated, this should be 
done before they are mixed, unless the reaction requires a 
catalyst. A continuous reactor is sometimes provided with 
regenerative preheating. It should be borne in mind that 
such preheating constitutes a form of positive feedback. 

As described in Chapter 11, batch reactors are of two 
broad types. In the first, the ‘all-up’ batch reactor, the main 
reactants are all charged at the start. In the semi-batch 
reactor, one reactant is not charged initially but is fed 
continuously. 

The reaction mass in a batch reactor cannot necessarily 
be assumed to be completely mixed. It is not uncommon for 
there to be inhomogeneities, hot spots and so on. This has 
obvious implications for reactor control. 

Some of the control problems of batch reactors are as 
follows. In a typical all-up batch cycle, the reactants and 
catalyst are charged, the charge is heated to reaction tem¬ 
perature, and the reaction mass is then cooled and dis¬ 
charged. In some cases the reaction stage is followed by a 
curing stage which may be at a temperature below or above 
the reaction temperature. 

In the initial heating up period, the temperature of the 
charge should be brought up to the operating point rapidly, 
but it should not overshoot. If the reactor temperature is 
controlled by an ordinary three-term controller, integral 
saturation in the controller will cause overshoot. It is 
necessary, therefore, to employ a controller which is mod¬ 
ified to avoid this. Alternatively, the heating up may be 
controlled in some other way which avoids overshoot. Once 
the reaction is under way in a batch reactor, the initial heat 


release is large. The cooling system should be adequate 
for this peak heat release. 

Semi-batch reactors have different problems. The addi¬ 
tion of the continuously fed reactant before the batch is up 
to temperature should be avoided, otherwise it is liable to 
accumulate and then react rapidly when the operating 
temperature is reached. 

If agitation is interrupted and then resumed, there may 
be a sudden and violent reaction of reactants which have 
accumulated. There should be suitable alarms, trips and 
interlocks to signal loss of agitation, to cut off feed of reac¬ 
tant, and to ensure an appropriate restart sequence. 

In both types of reactors, there should be arrangements 
to prevent material from the reactor passing back into 
reactant storage tanks where this could constitute a hazard. 
The control of flows in the reactant feed pipes is important. 
It is necessary to ensure tight shut-off of the reactants 
and to prevent flow from the reactor into the reactant feed 
system. 

The reactor should be provided with suitable display and 
alarm instrumentation, so that the process operator has full 
information on the state of the reactor. Important variables 
are typically the flows of the reactants and of the coolant, 
the pressure in the reactor and the temperature of the 
reactor and of the coolant. Important statuses are the state 
of the agitator, of the pumps and of the valves. 

The reactor should have a control system which is fully 
effective in preventing a reaction runaway. The main reac¬ 
tor control is usually based either on reactor temperature or 
on reactor pressure. The dynamic response of the loop is 
especially important. There should be adequate potential 
correction on the control loops. In other words, the steady- 
state gain between the manipulated variable and the 
controlled variable should be high enough to ensure that 
control of the latter is physically possible. 

The instrumentation should possess both capability and 
reliability for the duty. Important aspects of capability are 
accuracy and dynamic response. The effects of instrument 
failure should be fully considered. In particular, failure in 
the measurement and control of the main variable, which is 
usually temperature, should be assessed. The ease of 
detection of instrument malfunction by the process opera¬ 
tor should be considered. Factors which assist in malfunc¬ 
tion detection include the use of measuring instruments 
with a continuous range rather than a binary output and 
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the provision of recorders and of indications of valve 
position. 

Trip systems should be provided to deal with potentially 
hazardous conditions. These typically include loss of feed, 
loss of coolant, loss of agitation and rise in reactor tem¬ 
perature. ESD arrangements for reactors are discussed in 
Chapter 11. 

Use should be made of interlocks to ensure that critical 
sequences which have to be carried out on the reactor are 
executed safely and to prevent actions which are not per¬ 
missible. Many of these control functions are facilitated by 
the use of a process control computer. A fuller discussion of 
instrumentation is given in Section 13.8. 

13.7 Computer Integrated Manufacturing 

There is now a strong trend in the process industries to 
integrate the business and plant control functions in a total 
system of CIM. Accounts of CIM are given by T.J. Williams 
(1989), Canfield and Nair (1992), Conley and Clerico (1992), 
Mehta (1992), Nair and Canfield (1992), Bernstein et al. 
(1993) and Koppel (1993). 

The aim of CIM is essentially to obtain a flexible and 
optimal response to changes in market demand, on the one 
hand, and to plant capabilities on the other. It has been 
common practice for many years for production plans to be 
formulated and production schedules to be produced by 
computer and for these schedules to be passed down to the 
plant. In refineries, use of large scheduling programmes 
is widespread. In addition to flexibility, other benefits 
claimed are improved product quality, higher throughputs, 
lower costs and greater safety. 

A characteristic feature of CIM is that information also 
flows the other way, that is, up from the plant to the plan¬ 
ning function. This provides the latter with a continuous 
flow of up-to-date information on the capability of the plant 
so that the schedule can be modified to produce the optimal 
solution. A CIM system may therefore carry out not only 
the process control and quality control but also scheduling, 
inventory control, customer order processing and account¬ 
ing functions. 

The architecture of a CIM system is generally hier¬ 
archical and distributed. Treatments of such architecture 
are given in Controlling Automated Manufacturing Sys¬ 
tems (O’Grady, 1986) and by Dempster et al. (1981). 

For such a system to be effective, it is necessary that the 
data passing up from the plant be of high quality. The sys¬ 
tem needs to have a full model of the plant, including the 
mass and energy balances and the states and capabilities of 
the equipment. This involves various forms of model-based 
control, which is of such prominence in CIM that the two 
are sometimes treated as if they are equivalent. 

Plant data are corrupted by noise and errors of various 
kinds, and in order to obtain a consistent data set, it is 
necessary to perform data reconciliation. Methods based 
on estimation theory and other techniques are used to 
achieve this. Complete and rigorous model-based reconci¬ 
liation (CRMR) is therefore a feature of CIM. Data reconci¬ 
liation is discussed further in Chapter 30. One implication 
of CIM is that the plant is run under much tighter control, 
which should be beneficial to safety. 

13.7.1 Batch plants 

Batch processing involves not only sequential operations 
but also a high degree of variability of equipment states and 


is particularly suited to CIM. Accounts of integrated batch 
processing include those by Rosenof (1982b), Armstrong 
and Coe (1983), Rippin (1983), Severns and Hedrick (1983), 
Bristol (1985), Krigman (1985), Egli and Rippin (1986), 
Kondili, Panteides and Sargent (1988), Cott and Macchietto 
(1989) and Crooks, Kuriyna and Macchietto (1992). 

In the system described by Cott and Macchietto (1989), use 
is made of three levels of control, which are, in descending 
order: plant level control, batch level control and resource 
level control, operating respectively on typical time-scales of 
days, minutes and seconds. A comprehensive approach to 
batch processing requires the integration of tools for plant 
design, automation and operating procedures. 

13.8 Instrument Failure 

Process plants are dependent on complex control systems 
and instrument failures may have serious effects. It is 
helpful to consider first the ways in which instruments are 
used. These may be summarized as follows: 


Instrument 

System application 

Measuring instrument 

Input to: 

Display system-measurement/ 
status/alarm 

Control loop 

Trip system 

Computer model 

Control element 

Output from: 

Control loop 

Trip system 

Measuring instruments; 

are taken to include digital as well 


as analogue outputs. Control elements are normally control 
valves, but can include power cylinders, motors, etc. 

The important point is that some of these applications 
constitute a more severe test of the instrumentation than 
others. The accuracy of a flowmeter may be sufficient for 
flow control, but it may not be good enough for an input to a 
mass balance model in a computer. The dynamic response 
of a thermocouple may be adequate for a panel display, but 
it may be quite unacceptable in a trip system. 

This leads directly, of course, to the question of the defi¬ 
nition of failure. In the following sections, various kinds of 
failure are considered. It is sufficient here to emphasize 
that the reliability of an instrument depends on the defini¬ 
tion of failure, and may vary depending on the application. 

13.8.1 Overall failure rates 

There are more data on the failure rates of instrumentation 
than on most other types of plant equipment. It is now 
usually possible to obtain sufficient data for assessment 
purposes, though there are inevitably some gaps. There are 
two types of failure data on instruments. The first relates to 
performance in standard instrument tests and the second 
to performance on process plant. It is the latter which is of 
primary interest here. 

Many of the data on the failure rates of instruments on 
process plants derive from the work of the UK Atomic 
Energy Authority (UKAEA). Table 13.5 gives data quoted in 
early investigations by UKAEA workers. Table 13.6 shows 
data in another early survey by Anyakora, Engel and Lees 
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Table 13.5 Some data on instrument failure rates published by the UKAEA 


Instrument 

Failure rate (faults/year) 

Observed Assumed/predicted 

Reference a 

Control valve b 

0.25 

0.26 

1-4 

5,6 

Solenoid valve 


0.26 

5,6 

Pressure relief valve 


0.022 

5,6 

Hand valve 


0.13 

5,6 

Differential pressure transmitter b 

0.76 


1-4,7,8 

Variable area flowmeter transmitter 11 

0.68 


1-4,8 

Thermocouple 

Temperature trip amplifier: 


0.088 

5,6 

Type A 

2.6 


7 

TypeB 

1.7 


7 

Pressure switch 


0.14 

1-4,8 

Pressure gauge 


0.088 

5,6 

0 2 analyser 

2.5 


1,2,4,8 

Controller 11 

0.38 


7 

Indicator (moving coil meter) 


0.026 

5,6,8 

Recorder (strip chart) 


0.22 

5,6,8 

Lamp (indicator) 


0.044 

5,6,8 

Photoelectric cell 


0.13 

5,6 

Tachometer 


0.044 

5,6 

Stepper motor 


0.044 

5,6 

Relay 1 ' 

0.17 


7 

Relay (Post Office) 


0.018 

5,6 


a (1) Hensley (1967 UKAEA AHSB (S) R136); (2) Hensley (1968); (3) Hensley (1969 UKAEA AHSB (S) R178); 
(4) Hensley (1973 SRS/GR/1); (5) Green and Bourne (1966 UKAEA AHSB (S) R117); (6) A.E. Green and Bourne 
(1972); (7) Eames (1966); (8) Green (1966 UKAEA AH S B (S) R113). 
b Pneumatic. 


(1971) in three works in the chemical industry. The first 
(works A) was a large works producing a wide range of 
heavy organic chemicals. The second (works B) made 
heavy inorganic chemicals. The third (works C) was two 
sites in a glass works. The failures were defined as and 
derived from job requests from the process operators. 
The failure rates were calculated on the assumption of a 
constant failure rate. The environment factor quoted in 
Table 13.6 is explained below. 

The failure rates given in Table 13.6 are in broad agree¬ 
ment with other work published about the same time, such 
as that of Skala (1974). It should be emphasized that, of the 
failures given in the tables, only a very small proportion 
resulted in a serious plant condition. In most cases the 
failures were detected by the process operator, who then 
called in the instrument maintenance personnel. 

The failure rates quoted are those for normal commercial 
instruments in the process industries. In certain other 
applications where higher instrument costs are acceptable, 
the failure rates are lower. Thus, instruments used in some 
defence applications are of an order of magnitude more 
expensive, but have a much higher reliability. Further data 
on instrument failure rates are given in Appendix 14. 

13.8.2 Factors affecting failure 

Some of the factors which affect instrument failure are 
listed below. 

(1) System context; 

(a) application (display, control, etc.); 

(b) specification (accuracy, response, etc.); 

(c) definition of failure. 


(2) Installation practices. 

(3) Environmental factors - process materials; 

(a) degree of contact (control room, plant); 

(b) material phase (gas, liquid, solid); 

(c) cleanliness; 

(d) temperature; 

(e) pressure; 

(f) corrosion; 

(g) erosion. 

(4) Environmental factors — ambient and plant conditions: 

(a) temperature; 

(b) humidity; 

(c) dust; 

(d) frost exposure; 

(e) vibration; 

(f) impact exposure. 

(5) Operating factors: 

(a) movement, cycling. 

(6) Maintenance practices. 

There is little information available on which to assess the 
effect of these factors. In the survey by Anyakora, Engel 
and Lees, an attempt was made to assess the effect of 
environment, defining this rather loosely in terms of both 
ambient conditions and process materials. Two approaches 
were tried. One was to compare the effect of being or 
not being in contact with process fluids. Table 13.7 shows 
this effect for two groups of instruments, one consis¬ 
ting of those which are in contact and one consisting of 
those which are not. The instruments which are not in 
contact with process fluids show a much lower failure rate, 
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Table 13.6 Some instrument failure rate data from three chemical works (Anyakora, Engel and Lees, 1971) 

(Courtesy of the Institution of Chemical Engineers) 

Instrument 

No. at 

Instrument 

years 

Environment 

factor 

No. of 
faults 

Failure 

(faults/year) 

Control valve 

1531 

747 

2 

447 

0.60 

Power cylinder 

98 

39.9 

2 

31 

0.78 

Valve positioner 

334 

158 

1 

69 

0.44 

Solenoid valve 

252 

113 

1 

48 

0.42 

Current/pressure transducer 

200 

87.3 

1 

43 

0.49 

Pressure measurement 

233 

87.9 

3 

124 

1.41 

Flow measurement (fluids): 

1942 

943 

3 

1069 

1.14 

Differential pressure transducer 

636 

324 

3 

559 

1.73 

Transmitting variable area flowmeter 

100 

47.7 

3 

48 

1.01 

Indicating variable area flowmeter 

857 

409 

3 

137 

0.34 

Magnetic flowmeter 

15 

5.98 

4 

13 

2.18 

Flow measurement (solids): 

Load cell 

45 

17.9 


67 

3.75 

Belt speed measurement and control 

19 

7.58 

- 

116 

15.3 

Level measurement (liquids): 

421 

193 

4 

327 

1.70 

Differential pressure transducer 

130 

62 

4 

106 

1.71 

Float-type level transducer 

158 

75.3 

4 

124 

1.64 

Capacitance-type level transducer 

28 

13.4 

4 

3 

0.22 

Electrical conductivity probes 

100 

39.8 

4 

94 

2.36 

Level measurement (solids) 

11 

4.38 


30 

6.86 

Temperature measurement (excluding pyrometers): 

2579 

1225 

3 

425 

0.35 

Thermocouple 

772 

369 

3 

191 

0.52 

Resistance thermometer 

479 

227 

3 

92 

0.41 

Mercury-in-steel thermometer 

1001 

477 

2 

13 

0.027 

Vapour pressure bulb 

27 

10.7 

4 

4 

0.37 

Temperature transducer 

300 

142 

3 

124 

0.88 

Radiation pyrometer 

43 

30.9 

4 

67 

2.17 

Optical pyrometer 

4 

3.4 

4 

33 

9.70 

Controller 

1192 

575 

1 

164 

0.29 

Pressure switch 

549 

259 

2 

87 

0.34 

Flow switch 

9 

3.59 

- 

4 

1.12 

Speed switch 

6 

2.39 

- 

0 

- 

Monitor switch 

16 

6.38 

— 

0 

— 

Flame failure detector 

45 

21.3 

3 

36 

1.69 

Millivolt-current transducer 

12 

4.78 

- 

8 

1.67 

Analyser: 

86 

39.0 

— 

331 

8.49 

PH meter 

34 

15.8 

- 

93 

5.88 

Gas-liquid chromatograph 

8 

3.43 

- 

105 

30.6 

0 2 analyser 

12 

5.67 

— 

32 

5.65 

C0 2 analyser 

4 

1.90 

- 

20 

10.5 

H 2 analyser 

11 

5.04 

- 

5 

0.99 

H 2 0 analyser (in gases) 

3 

1.38 

- 

11 

8.00 

Infrared liquid analyser 

3 

1.43 

- 

2 

1.40 

Electrical conductivity meter (for liquids) 

5 

1.99 

- 

33 

16.70 

Electrical conductivity meter (for water in solids) 

3 

1.20 

— 

17 

14.2 

Water hardness meter 

3 

1.20 


13 

10.9 

Impulse lines 

1099 

539 

3 

416 

0.77 

Controller settings 

1231 

609 

- 

84 

0.14 


although control valves and temperature measurements 
are exceptions. 

The other approach, which was applied to instruments 
which are in contact with process fluids, was to distinguish 
between ‘clean’ and ‘dirty’ fluids. A fluid was regarded as 
dirty if it contained ‘gunk’, polymerized, corroded, etc. 
Table 13.8 gives data for instruments in these two cases. 

From this work it was concluded, as a first approxima¬ 
tion and for the instruments considered, that the severity 


of the environment of an instrument depends on the 
aggressiveness of any process materials with which it is in 
contact and that other factors are generally of secondary 
importance. 

If the failure rate is taken to be a product of a base failure 
rate and of an environment factor, then Tables 13.7 and 13.8 
suggest that a maximum value of about 4 is appropriate. 
Environment factors are given in Table 13.6; the failure 
rates given in the table are the original data and should be 
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Table 13.7 Effect of environment on instrument reliability: instruments in contact with and not in contact with 
process fluids (Anyakora, Engel and Lees, 1971) (Courtesy of the Institution of Chemical Engineers) 

Instrument 

No. at risk 

No. of faults 

Failure rate 
(faults/year) 

Instruments in contact with process fluids: 

2285 

1252 

1.15 

Pressure measurement 

193 

89 

0.97 

Level measurement 

316 

233 

1.55 

Flow measurement 

1733 

902 

1.09 

Flame failure device 

43 

28 

1.37 

Instruments not in contact with process fluids: 

2179 

317 

0.31 

Valve positioner 

320 

62 

0.41 

Solenoid valve 

168 

24 

0.30 

Current-pressure transducer 

89 

23 

0.54 

Controller 

1083 

133 

0.26 

Pressure switch 

519 

75 

0.30 

Control valve 

1330 

359 

0.57 

Temperature measurement 

2391 

326 

0.29 


Table 13.8 Effect of environment on instrument reliability: instruments in contact with clean and 
dirty fluids (Anyakora, Engel and Lees, 1971) (Courtesy of the Institution of Chemical Engineers) 


Instrument 

No. at risk 

No. of faults 

Failure rate 
(faults/year) 

Control valve: 

Clean fluids 

214 

17 

0.17 

Dirty fluids 

167 

71 

0.89 

Differential pressure transmitter: 

Clean fluids 

27 

5 

0.39 

Dirty fluids 

90 

82 

1.91 


divided by the environment factor to give the base failure 
rate. It should also be noted that the sampling/impulse line 
failure rates given in Table 13.6 should be added to the fail¬ 
ure rates of the instruments themselves to obtain the failure 
rates of installations. 


13.8.3 Failure modes 

The overall failure rate of an instrument gives only limited 
information. It is often necessary to know its failure modes. 
Failure modes can be classified in several ways. Some 
important categories are (1) condition, (2) performance, 
(3) safety and (4) detection. 

In a failure classification based on conditions, a failure 
mode is exemplified by a faulty bellows on a flowmeter or a 
broken diaphragm in a control valve. In a classification by 
performance, illustrations of failure are a zero error in a 
flowmeter or the passing of fluid when shut by a control 
valve. Aperformance classification emphasizes effects and 
a condition classification emphasizes causes, but the dis¬ 
tinction is not rigid: a blockage in a control valve could 
reasonably be classed either way. The safety classification 
divides faults into fail-safe and fail-dangerous. The detec¬ 
tion classification distinguishes between revealed and 
unrevealed faults: a revealed fault signals its presence and 
is at once detectable, an unrevealed fault is not immediately 
detectable, but is usually detected by a proof check. 

Condition and performance may be regarded as the pri¬ 
mary types of failure. Safety and detection modes may be 
obtained from these and from the system context of the 
instrument. 


Table 13.9 Failure modes of some instruments 
(Lees, 1973b) (Courtesy of the Institution of Che¬ 
mical Engineers) 


Instrument failure mode 

No. of faults 

Control valve: 

Leakage 

54 

Failure to move freely: 

Sticking (but moving) 

28 

Seized up 

7 

Not opening 

5 

Not seating 

3 

Blockage 

27 

Failure to shut off flow 

14 

Glands repacked/ tightened 

12 

Diaphragm fault 

6 

Valve greased 

5 

General faults 

27 

Thermocouple: 

Thermocouple element faults 

24 

Pocket faults 

11 

General faults 

20 


Table 13.9 shows some data obtained by Lees (1973b) 
in the survey already described on failure modes in 
thermocouples and control valves. These failure modes are 
essentially classified by condition, although the condition 
is often revealed by a performance failure. Similar data for 
other instruments are given in the original paper. Some 
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data used in reliability studies described in the literature 
on failure modes of instruments and control loops are 
shown inTable 13.10. 

If information is available on overall but not on mode 
failure rates, it is sometimes assumed that about one third 
of the faults are in the fail-dangerous mode. The safety and 
detection failure modes of the temperature trip amplifier 
shown in Figure 13.7 have been analysed by Eames (UKAEA 
1973 SRS/GR/12) as shown in Table 13.11. The fault is 
described by a four-letter code. The first indicates that it is 
fail-safe (S), fail-dangerous (D) or a calibration shift in the 
dangerous direction (C). The second is the number of the 
equipment adversely affected by the fault.The number 1 -5 
refers to, respectively, the main trip, the excess margin 
alarm the low margin alarm and the indicating meter 
shown in the figure and the indicating lamp (not shown). 
The third letter indicates that the fault is revealed (r) or 
unrevealed (u). The fourth is the number of the equipment 
which reveals the fault; the numbering code is as before. 


The various failure ral 

:es of the equipment a 

re as follows: 

Faults 

Failure rate 


(faults/10 6 h) 

(faults/year) 

Fail-dangerous (Dl) 

9.85 

0.086 

Fail-dangerous, 

4.6 

0.040 

unrevealed (Dlu) 



Total 

145.5 

1.27 


Thus, the total fail-dangerous and fail-dangerous unre¬ 
vealed faults are, respectively, 6.8% and 3.2% of the total 
faults, which is one measure of the success of the fail-safe 
design of the equipment. 





Figure 13.7 Temperature trip amplifier (Fames, 1973 
UKAEA SRS/GR/12) (Courtesy of the UK Atomic Energy 
Authority, Systems Reliability Directorate) 


Table 13.10 Failure modes of some instruments defined by performance 


Reference 


Level measurement and alarm: 

Failure rate (faults/year) 

Lawley (1974b) 

Level indicator fails to danger 

2 


High level alarm fails 

0.2 


Operator fails to observe level indicator or take action 

Probability 

0.04 


Operator fails to observe level alarm or take action 

0.03 


Flow measurement and control: 

Failure rate (faults/year) 

S.B. Gibson (1977b) 

For an FRC where high flow is undesirable: 

Flow element fails giving low reading 

0.1 


Flow transmitter fails giving low reading 

0.5 


FRC fails calling for more flow 

0.4 


Flow control valve fails towards open position 

0.1 


High flow trip fails to operate 

Fractional dead time 

0.01 


For an FRC where low flow is undesirable: 

Failure rate (faults/year) 


Flow element fails giving high reading 

0.2 


Flow transmitter fails giving high reading 

0.4 


FRC fails calling for less flow 

0.4 


Flow control valve fails towards closed position 

0.2 


Low flow trip fails to operate 

Fractional dead time 

0.01 


Low flow trip left aborted after start-up 

0.01 


Manual and control valves: 

Failure rate (faults/year) 

Lawley (1974b) 

Manual isolation valve wrongly closed 

0.05 and 0.1 


Control valve fails open or misdirected open 

0.5 


Control valve fails shut or misdirected shut 

0.5 



FRC, flow recorder 



















3/22 CONTROL SYSTEM DESIGN 


13.8.4 Prediction of failure rates 

It is sometimes necessary to know the failure rate of an 
instrument for which field data are not available. To meet 
this situation, methods have been developed for estimating 
the failure rate of an instrument from those of its con¬ 
stituent parts. Table 13.12 shows part of a prediction by 
Hensley (UKAEA1969 AHSB(s) R178) of the failure rate of 
a pressure switch. 

A comparison of some observed and predicted failure 
rates is given in Table 13.13. It can be seen that the agree¬ 
ment is quite good. A more quantitative measure of the 
effectiveness of the technique is Figure 13.8, which is given 


by A.E. Green and Bourne (1972) and shows the ratio of 
observed and predicted failure rates for a number of 
equipments. The median value of this ratio is 0.76 and the 
probabilities of the ratio being within factors of 2 and 4 of 
this value are 70% and 96%, respectively. 

13.8.5 Loop failure rates 

Data on failure rates of complete control loops have been the 
given by Skala (1974) and are shown in Table 13.14. Loop 
failure rates can be calculated from the failure rates of the 
constituent instruments. The failure rates of a loop with a 
pneumatic flow indicator controller, as calculated from the 


Table 13.11 Failure modes and rates of a temperature trip amplifier (Eames, 1973 UKAEA SRS/GFt/12) 
(Courtesy of the UK Atomic Energy Authority, Systems Reliability Directorate) 


Failure rate (faults/10 6 h) 

Sri 

53.89 

Dlr2 

4.85 

D2r3 

9.95 

Clu 

3.15 

Sr2 

2.1 

Dlr3 

0.4 

D2r4 

0.15 

C2u 

6.79 

Sr3 

7.4 

Dlu 

4.6 

D2u 

6.0 

C3u 

5.77 

Sr5 

5.0 



D3r2 

0.35 



Su 

15.84 



D3u 

3.3 







D4r4 

5.8 







D5u 

10.2 



Total S 

84.23 

Total D1 

9.85 

Total other D 

35.75 

TotalC 

15.71 


Table 13.12 Predicted failure rates of a pressure switch (Hensley, 1969 UKAEA AHSB(S) R178) (Courtesy of 
the UK Atomic Energy Authority, Systems Reliability Directorate) 


Component 

Fault 

Category 

Failure rate (faults/10 6 h) 





Dangerous 

Safe 

Total 

Spring 

Fracture 

Dangerous 

0.2 



Bellows 

Rupture 

Safe 


5.0 


Screws - pivot (2 items) 

Loosen 

Dangerous 

1.0 



Microswitch 

Random 

Dangerous 25% 
Safe 75% 

0.5 

1.5 


Total of above 5 

— 

— 

1.7 

6.5 


Total for 30 components in instrument 



2.9 

11.7 (faults/year) 

14.6 

Total for 30 components in instrument 



0.025 

0.10 

0.13 


Table 13.13 Observed and predicted instrument failure rates 


Instrument 

Failure rate (faults/year) 

Observed Predicted 

Reference a 

Control valve b 

0.25 

0.19 

1-3 

Differential pressure transmitter* 5 

0.76 

0.45 

1-4 

Variable area flowmeter transmitter* 5 

0.68 

0.7 

1-3 

Temperature trip amplifier; 

Type A 

2.6 

2.8 

1,2,4 

TypeB 

1.7 

2.1 

4 

Controller 

0.38 

0.87 

4 

Pressure switch 

0.14 

0.13 

1-3 

Gas analyser 

2.5 

3.3 

1,2 

Relay* 5 

0.17 

0.35 

4 


a (1) Hensley (1967 UKAEA AHSB (S) R136); (2) Hensley (1968); (3) Hensley (1969 UKAEA AHSB (S) R178); 
(4) Eames (1966). 
b Pneumatic. 
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Cumulative probability <%) 

Figure 13.8 Ratio of observed to predicted equipment failure rates (A.E. Green and Bourne, 1972) (Reproduced 
with permission from Reliability Technology by A.E. Green andJ.R. Bourne, Copyright©, 1972, John Wiley & Sons Inc.) 


data in Table 13.5 (UKAEA), as calculated from the data in 
Table 13.6 (Anyakora, Engel and Lees), and as given by 
Skala, are shown in Table 13.15. 

Again it should be emphasized that, of the failure rates 
for loops given in these tables, only a very small proportion 
results in a serious plant upset or trip. In one study of the 
control loop failures on a large chemical plant quoted by 
M.R. Gibson (1978), it is found that there had been three 
control loop failures which resulted in plant trips and 
that the frequency of such failures was one failure every 
20 years per loop. 


13.8.6 Detection of failure 

If instrument failure occurs, it is important for it to be 
detected. The ease of detection of an instrument failure 
depends very much on whether the fault is revealed or 
unrevealed. Unrevealed faults are generally detectable only 
by proof testing. 

An instrument fault which is revealed is usually detected 
by the process operator either from the behaviour of the 
instrument itself or from the effect of the failure on the 
control system.There are, however, developments in the use 
of the process computer to detect instrument faults. Fault 
detection by the operator and by the computer is discussed 
in Chapters 14 and 30, respectively. 


The detection of failure in instruments which have a 
binary output such as pressure or level switches is parti¬ 
cularly difficult, because the fault if generally unrevealed, 
but is particularly important, because such instruments 
are frequently part of an alarm or trip system. One 
approach to the problem is to use an instrument with a 
continuous range output rather than a binary output. Thus, 
a level measuring instrument may be used instead of a level 
switch. In this way, many of the faults on the instrument 
which would otherwise be unrevealed become revealed. 


13.8.7 Self-checking instruments 

Developments are also made in instruments which have a 
self-checking capability. Principles on which such instru¬ 
ments are designed include (1) multiple binary outputs and 
(2) electrical sensor check. 

A self-checking level measuring instrument which uses 
multiple binary outputs has been described by Hasler and 
Martin (1971). The instrument has a series of binary output 
points, which measure the liquid level at different heights. 
These points provide a mutual check. Thus, for example, 
if there are 10 points and the liquid level is up to point 5, 
so that this point gives a positive output, the absence of a 
positive output from point 4 indicates a failure on that point 
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A self-checking level switch in which electronic signals 
are used to check the state of the sensor has been described 
byJ.O. Green (1978). 

Increasingly, instruments are also being provided with 
the enhanced capabilities available from the incorporation 
of microprocessors. Self-checking is one such capability. 

A general account of such instruments is given in Intel¬ 
ligent Instrumentation (Barney, 1985). A further discus¬ 
sion of intelligent, or smart, instruments is given by the 
CCPS (1993/14). 


13.8.8 Fault-tolerant instrumentation 

Instrument systems should have a degree of fault tolerance. 
The need for fault-tolerant systems has already been men¬ 
tioned in relation to computer systems, where certain basic 
principles were outlined. These principles are equally 
applicable to the design of fault-tolerant instrument 
systems. Two main features of such instrumentation 
are redundancy and/or diversity and fail-safe operation. 
Fault-tolerant design of instrument systems is discussed by 


Table 13.14 Control loop failure rates (after Skala, 1974) 
(Reproduced from Instrument Technology with permission 
of the publisher, Copyright ©, Instrument Society of 
America, 1974) 


Loop failures (by type of loop): 

(faults/year) 

PIC 

1.15 

PRC 

1.29 

FIC 

1.51 

FRC 

2.14 

LIC 

2.37 

LRC 

2.25 

TIC 

0.94 

TRC 

1.99 

Loop failures (by frequency per loop ): 3 

(faults/year) 

(% loops) 


25 

0 

34 

1 

14 

2 

9 

3 

5 

4 

4 

5 

3 

6 

2 

7 

1 

8 

1 

9 

0 

10 

0 

11 

2 

12 

Loop failures (by element in loop): 

(% faults) 

(loop element) 


Sensing / sampling 

21 

Transmitter 

20 

Transmission 

10 

Receiver 11 

18 

Controller 

7 

Control valve 

7 

Other 

17 


3 These data have been read from figure 2b of the original paper. 


Bryant (1976), Ida (1983), Frederickson and Beckman 
(1990) and the CCPS (1993/14). 

13.8.9 Instrument testing 

Information is also available on the performance of instru¬ 
ments when subjected to a battery of standard tests. The 
evaluation of instruments is carried out both by special 
testing organizations and by major users. In the United 
Kingdom, the main organization concerned with instru¬ 
ment evaluation is the SIRA. Some of the tests carried out 
by SIRA have been described by Cornish (1978a). The 
instruments tested are normal production models. 

Results of instrument evaluations by SIRA for the period 
1971 -76 have been given by Cornish (1978b) and are shown 
in Table 13.16. The reference conditions are the manu¬ 
facturer’s specification or, where no specification is quoted, 
an assumed specification based on current practice. The 
influence conditions refer to variations in electrical power 
or instrument air supply, high and low temperature, and 
humidity. These failure rates under test are high, but simi¬ 
lar results are apparently obtained in other industrial 
countries. 


Table 13.15 Failure rates for a pneumatic flow indicator 
control loop 


UK AHA data: 

(faults/year) 

Differential pressure transmitter 

0.76 

Controller 

0.38 

Control valve 

0.25 


1.39 

Anyakora, Engel and Lees’data: 
Impulse lines 

0.26 

Differential pressure transmitter 3 

0.58 

Controller 3 

0.29 

Control valve 3 

0.30 

Valve positioner 3 

0.09(0.2 x 0.44) b 


1.52 

Skala’s data: 

FIC Loop c 

1.51 

3 Pneumatic. 


b It is assumed that 20percent of the valves ha 
c FIC, Flow indicator controller. 

ve positioners. 


Table 13.16 Instrument test failures (after Cornish, 
1978b) 


Fault Instruments 

Subject to fault 

_ (%) 

Instruments faulty as received 21 

Outside specification under reference 27 

conditions 

Outside specification under influence 30 

conditions 

Component failure during evaluation 27 

Inadequate handbook/manual 26 

Modification to design or 33 

manufacturing method after 
evaluation 
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13.9 Trip Systems 

It is increasingly the practice in situations where a hazard¬ 
ous condition may arise on the plant to provide some form 
of automatic protective system. One of the principal types 
of protective system is the trip system, which shuts down 
the plant, or part of it, if a hazardous condition is detected. 
Another important type of protective system is the inter¬ 
lock system, which prevents the operator or the automatic 
control system from following a hazardous sequence of 
control actions. Interlock systems are discussed in 
Section 13.10. 

Accounts of trip systems are given in Reliability Tech¬ 
nology (A.E. Green and Bourne, 1972) and by Hensley 
(1968), R.M. Stewart (1971), Kletz (1972a), de Heer (1974), 
Lawley and Kletz (1975), Wells (1980), Barclay (1988), 
Rushton (1991a,b) and Englund and Grinwis (1992). 

The existence of a hazard which may require a protective 
system is usually revealed either during the design pro¬ 
cess, which includes, as routine, consideration of protective 
features, or by hazard identification techniques such as 
hazop studies. 

The decision as to whether a trip system is necessary in a 
given case depends on the design philosophy. There are 
quite wide variations in practice on the use of trip systems. 
There is no doubt, however, about the general trend, which 
is towards the provision of a more comprehensive coverage 
by trip systems. The problems are considered further in 
Chapter 14. The decision as to whether to install a trip sys¬ 
tem can be put on a less subjective basis by making a 
quantitative assessment of the hazard and of the reliability 
of the operator in preventing it. 

13.9.1 Single-channel trip system 

A typical, single-channel trip system is shown in 
Figure 13.9. It consists of a sensor, a trip switch and a trip 
valve. The configuration of a trip loop is therefore not dis¬ 
similar to that of a control loop. The difference is that, 
whereas the action of a control loop is continuous, that of a 
trip loop is discrete. 

The trip switch may be of a general type, being capable of 
taking an electronic or pneumatic signal from any type of 
sensor. Thus, in a pneumatic system, a pressure switch 
would serve as the trip switch. Alternatively, the trip switch 
and the sensor may be combined to give a switch dedicated 
to a particular variable. Thus, common types of trip 


Set point 



Flowmeter Trip valve 


switch include flow, pressure, temperature, level and limit 
switches. 

13.9.2 Dependability of trip systems 

Since a trip system is used to protect against a hazardous 
condition, it is essential for the system itself to be depend¬ 
able. The dependability of a trip system depends on (1) capa¬ 
bility and (2) reliability. Thus, it is necessary both for the 
system to have the capability of carrying out its function in 
terms of features such as accuracy, dynamic response, etc., 
and for it to he reliable in doing so. The reliability of the trip 
system may be improved by the use of (1) redundancy and 
(2) diversity. Thus, one approach is to use multiple redun¬ 
dant instruments, which generally give a reliability greater 
than that of a single instrument. But redundancy is not 
always the full answer, because there are some dependent 
failures which may disable the whole set of redundant 
instruments. This difficulty can he overcome by the use of 
diversity, which is exemplified by the use of different mea¬ 
surements to detect the same hazard and by the use of dif¬ 
ferent instruments to measure the same variable. 

Most trip systems consist of a single channel comprising a 
sensor, a switch and a shut-off valve, but where the integrity 
required is higher than that which can be obtained from a 
single channel, redundancy is generally used. 

A trip system should be reliable against functional fail¬ 
ure, that is, failure which prevents the system shutting the 
plant down when a hazardous condition occurs. Such a 
condition is not normally present and its rate of occurrence, 
which is the demand rate on the trip system, is usually very 
low. Thus, functional failures of the system are generally 
unrevealed failures. The trip system should also he reliable 
against operational failure, that is, failure which causes the 
system to shut the plant down when no hazardous condition 
exists. Thus operational failures of the system are always 
revealed failures. 

It is the object of trip system design and operation to 
avoid both loss of protection against the hazardous condi¬ 
tion due to functional failure and plant shut-down due to 
operational failure, or spurious trip. Since functional fail¬ 
ure of the system is generally unrevealed, it is necessary to 
carry out periodic proof testing to detect such failure. 

The simpler theoretical treatments of trip systems 
usually assume that the functional failures are unrevealed 
and the operational failures revealed and that the fail¬ 
ure rates are constant; this approach is followed here. 
The treatment draws particularly on the work of A.E. 
Green and Bourne (1966 UKAEA AHSB(S) R117), some of 
which was later published by the same authors in 
Reliability Technology (1972). 

13.9.3 Fractional dead time 

The fractional dead time (FDT) of an equipment or system 
gives the probability that it is in a failed state. If the failure 
of an equipment is revealed with a revealed failure rate /l, the 
FDT <j> depends on the failure rate and the repair time t r : 

<t> = Xz I i r < 1 [13.9.1 

For a series system with revealed failure, the FDT <j) of 
the system is related to the FDT fa of the constituent 
equipments as follows: 

^ = tori < 1 


Figure 13.9 A trip system 


[13.9.2] 
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For a parallel system with revealed failure, the FDT 0 of 
the system is related to the FDT fa of the equipments as 
follows: 


=n* 


For a parallel redundant, or 1/n (1-out-of -n), system with 
revealed failure, the FDT 0 1/n of the system is related to 
the FDT 0i/i of a single equipment as follows: 


<k/n — 01/1 


q = Xt Xt<l 
Then the FDT is: 


0i /„ = — J 0i/»dt 


= ¥ 


Ps = 1 - exp(-(5T p /2) 
For small values of 6t 0 : 
Ps - # Sx„ < 1 


If, however, the failure of an equipment is unrevealed with 
an unrevealed failure rate X, the FDT depends on this 
failure rate and on the proof test interval t p . The probability 
q of failure within time period t is: 

q = 1— exp(-Af) 

or, for small values of Xt 


The probability p, that a plant hazard will be realized c; 
be written in terms of the plant hazard rate q: 

Pq = 1 — exp(-)/Tp) [13.9.1 

For small values of jjt p : 

P„ = I/Tp t]Tp < 1 [13.9.1 


Pq = qps 


For a 1/n system with unrevealed failure, the FDT0 1/b of 
the system is obtained from the probability q 1/n of fadure 
of the system within the time period t: 


/It p < 1; (5t p < 1; qz p 4 


If the assumptions underlying Equation 13.9.18 are 
valid, an expression which has been commonly used is 


13.9.4 Functional reliability of trip systems 

Functional failure of a trip system here is assumed to be 
unrevealed. The failure rate X used in the equations in 
this section is that applicable to these unrevealed fail- 
dangerous faults. 

For a simple trip system consisting of a single channel 1/1 
(1-out-of-1) system with a failure rate X, the probability q of 
failure within proof test interval i p is: 


? = 1 —exp(-lTp) 

For small values of Xx„: 


[13.9.9] 


The trip system is required to operate only if a hazardous 
plant condition occurs. The probability p s that such a plant 
demand, which has a demand rate S, will occur during the 
dead time t 0 after the failure is: 


q = d<j> [13.9.20] 

As given earlier, the probability q of failure of the simple 
trip system within the time period t is: 

<7 = 1 — exp( —Xt) [13.9.21] 

For small values of Xt 

q = Xt Xt < 1 [13.9.22] 

Then the FDT <j> of the simple trip system is: 

0 - l . I " qdt [13.9.23] 

0 -I 9 [ 13 - 9 . 24 ] 
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as before. 

For a parallel redundant, or 1 In (1-out-of-rc), system, or for 
an min (w-out-of-w) system, which may be a majority vot¬ 
ing system, the following treatment applies. If there are n 
equipments of which m must survive for the system to 
survive and r must fail for the system to fail*: 

r=n-m +1 [13.9.26] 

The probability q m / n of failure of this system within the 
proof test interval is: 

For small values of q: 

Qm,n= (-)/ q«l [13.9.28] 

The FDT of the system is: 

<l>m/n = ~ f’ Qm/nti [13.9.29] 

Then, from Equations 13.9.22,13.9.28 and 13.9.29, the FDT 
0 OT /„ of the system is: 

[13.9.30] 

Thus, for a 2/3 majority voting system: 

02/s = (^p) 2 [13.9.31] 

For the special case of a parallel redundant, or 1 /n (1-out- 
of -n), system, Equation 13.9.30 reduces to give the FDT 

0i/»: 

[13 - 9 - 32] 

Thus, for a 1/2 parallel system: 

0i/2=%^ [13.9.33] 

and for a 1/3 system 

0i/3 = ^- [13-9.34] 


* In this trip chapter, the number of equipments which must fail 
for the system to fail is r. This notation differs from that used in 
Chapter 7 for r-out-of-M parallel systems, in which r was used for the 
number of equipments which must survive for the system to sur¬ 
vive. These two notations are used in order to preserve correspon¬ 
dence with established usage in texts on general reliability (e.g. 
Shooman, 1968) and on trip systems (e.g. A.E. Green and Bourne, 
1972). 


FDTs calculated from Equation 13.9.30 are shown in 
Table 13.17, both as functions of Xt p and of the FDT for 

a single channel. Table 13.17 assumes that the instruments 
are tested simultaneously at the end of the proof test inter¬ 
val. Some improvement can be obtained by staggered test¬ 
ing, as shown by the data in Table 13.18, which are taken 
from A.E. Green and Bourne (1972). 

13.9.5 Operational reliability of trip systems 

It is also necessary to consider operational failure of trip 
systems. Operational failure here is assumed to be revealed. 
The failure rate X used in the equations in this section is 
that applicable to these revealed fail-safe, or fail-spurious, 
faults. 

For a simple trip system consisting of a single channel 1/1 
system with a failure rate X the operational failure, or 
spurious trip, rate y is: 

fmX [13.9.35] 

For a parallel redundant, or 1/n, system the operational 
failure rate yy„ is: 

y 1/B = nX [13.9.36] 

For an m/» system, which may be a majority voting system, 
the following treatment applies. The rate at which the 
first operational failure of a single channel occurs is nX. 


Table 13.17 Fractional dead times for trip systems 
with simultaneous proof testing 


System 

n * 

n r 

0 


1/1 

1 1 

1 

Xx p 

IT , 

0i/i 

1/2 

2 1 

2 

(XT p) 2 

3 

301/1 

1/3 

3 1 

3 

(^p)- 

4 

20i/i 

2/2 

2 i 


Ai p 

20i/i 

2/3 

3 I 

! 2 

(Xtpf 

10i/i 


Table 13.18 Fractional dead times for trip systems with 
staggered proof testing (A.E. Green and Bourne, 1972) 
(Reproduced with permission from Reliability Technology 
by A.E. Green and J.R. Bourne, Copyright©, 1972, John 
Wiley and Sons Inc.) 


System 

0* 

0/0* 

1/1 

At p 

~T 

1 

1/2 

J^p) 2 

1.6 

1/3 

>p )3 

3.0 

2/2 

Xr p 

1 

2/3 


1.5 


</>, Fractional dead time for simultaneous testing; </>*, fractional dead 
time for staggered testing. 
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This first failure only results in a system trip if further 
operational failure of single channels sufficient to trip the 
system occurs within the repair time i r . The probability q y 
that this will occur is: 

q y = (* “ J) {Ax t ) m ^ At r < 1 [13.9.37] 

Then the operational failure rate y m/n of the system is: 
ym/n = nAq y [13.9.38] 

7 m/ n = ^(”l 1 1 )(^r 1 [13.9.39] 

Thus, for a 2/3 majority voting system: 

72/3 = (3A) • (27.Tr) [13.9.40] 

y 2/3 = 67 2 t r [13.9.41] 

Operational failure, or spurious trip, rates calculated from 
Equations 13.9.36 and 13.9.39 are shown in Table 13.19. It is 
emphasized again that the foregoing treatment is a simpli¬ 
fied one. The expressions derived here appear, however, to 
be those in general use (e.g. Hensley, 1968; Kletz, 1972a; de 
Heer, 1974; Lawley and Kletz, 1975). Full theoretical treat¬ 
ments of trip systems have been given by A.E. Green and 
Bourne (1966 UKAEA AHSB(S) R117) and Wheatley and 
Hunns (1981). The latter gives expressions for a wide vari¬ 
ety of trip systems. 

13.9.6 Proof testing of trip systems 

The treatment of the functional reliability of trip systems 
which has just been given demonstrates clearly the impor¬ 
tance of the proof test interval. The expressions derived 
show that the condition for high functional reliability is 
7 t p < 1 [13.9.42] 

As an illustration of the effect of the proof test interval, 
consider a simple trip system which has a failure rate of 0.67 
faults/year on a duty where the demand rate is 1 demand/ 
year: 

5 = 1 demand/year 
A = 0.67 faults/year 

If the proof test interval is 1 week: 
t p = 0.0192 year 


Table 13.19 

trip systems 

Spurious trip rates for 

System y 

1/1 

A 

1/2 

2 A 

l/ 3 

3A 

2/2 

2\ 

2/3 

6A\ 


Then the FDT is: 



= 0.0064 


and the plant hazard rate is 
q = 5<j> = 0.0064 hazards/year 

The plant hazard rate for a range of proof test intervals is: 


T p 

q (hazards/year) 

lweek 

0.0064 

1 month 

0.027 

lyear 

0.26 


For the longer proof test intervals, the approximate 
Equation 13.9.18 is not valid and Equation 13.9.19 was used. 

Some additional factors which affect the choice of proof 
test interval are the facts that, while it is being tested, a trip 
is disarmed and that each test is an opportunity for an error 
which disables the trip, such as leaving it isolated after 
testing. 

Thus, for a simple trip system with a trip disarmed per¬ 
iod i d and an isolation dead time </> is , the FDT becomes: 

<£ = 7.T p + 7d + ( fe I 13 - 9 - 43 ! 

This expression has a minimum at: 

0r) 1/2 i 13 - 9 - 44 ] 

The effect of these factors can be illustrated by considering 
the trip system described in the previous example. If the 
trip disarmed period is lh and the isolation dead time 
is 0.001: 

T d = 1.14 x 10 -4 year 
0 is = 0.001 

(Tp) min = 0.0184 year = 0.96 weeks 

Assume that a proof test interval of 1 week is chosen: 

t p = 0.0192 year 

Then the FDT is 

</> = 0.013 

and the plant hazard rate is 
q = 0.013 hazards/year 

In some instances it is not possible to test all parts of 
the trip system every time a proof test is carried out. For 
example, it is often not permissible to close the shut-off 
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valve completely. In such cases a partial test is done, 
checking out the system to demonstrate valve movement 
but not valve shut-off. 

If for a simple trip system the functional failure rate and 
proof test interval of the first part of the system are 
X A and x pA respectively, and those of the second part are 


7 B and TpB, respectively, then: 

<7a = 1 — exp(—2 A t) [13.9.45] 

Qa = X A t X A t < 1 [13.9.46] 

Similarly 

qB = A B f 2 B f« 1 [13.9.47] 

Then the FDT is: 

0 1 • r q A dt + — [ P q B dt [13.9.48] 

T pA Jo ^pB Jo 

0=i(A A x pA + i B t pB ) [13.9.49] 


There appears to be some variability in industrial practice 
with respect to the proof test interval. Generally a parti¬ 
cular firm tends to have one longer interval, which is the 
standard one, and a shorter interval which is used for more 
critical cases. One such pair of intervals is 3 months and 
1 month. Another is 1 month and 1 week. Thus, 1 month and 
1 week proof test intervals are mentioned in many of the 
trip system applications described by Lawley and Kletz. In 
some cases the policy is adopted that if analysis shows that 
the proof test interval for a single trip is short, a redundant 
trip system is used. 

13.9.7 Some other trip system characteristics 

There are certain general characteristics which are desir¬ 
able in any instrument system, but which are particularly 
important in a trip system. A trip system should possess 
not only reliability but also capability. In other words, when 
functional, it should be capable of carrying out its function. 
If it is not, then no amount of redundancy will help. The 
measuring instrument of the trip system should be accu¬ 
rate. This is particularly important where the safety mar¬ 
gin is relatively fine. 

The trip system should have a good dynamic response. 
What matters here is the ability of the trip to give rapid 
detection of the sensed variable and to effect rapid corr¬ 
ection of that variable or rapid plant shut-down. This 
response therefore depends on the trip system itself, but 
also on the dynamic response of the plant. This aspect is 
considered further in Section 13.9.16. 

The trip system should have sufficient rangeability to 
maintain accuracy at different plant throughputs. Another 
important property of a trip system is the ease and com¬ 
pleteness with which it can be checked. It is obviously 
desirable to be able to check all the elements in a trip sys¬ 
tem, but this is not always easy to arrange. 

13.9.8 Trip system applications 

Some illustrations of the specification and design of pro¬ 
tective systems have been given by Kletz (1972a, 1974a) and 


by Lawley and Kletz (1975). As already mentioned in 
Chapter 12, the use of trip systems instead of pressure relief 
valves is sometimes an attractive proposition, particularly 
where the relief valve solution involves large flare or 
toxic scrubbing systems.This is considered by Kletz (1974a) 
and by Lawley and Kletz (1975), who suggest that if a trip 
system is used instead of a relief valve, it should be designed 
for a reliability 10 times that of the latter.The reason for this 
is the uncertainty in the figures and the difference in the 
modes of failure; a relief valve which fails to operate at the 
set pressure may nevertheless operate at a higher pressure, 
whereas a trip is more likely to fail completely. 

The fail-dangerous failure rates of a pressure relief 
valve and of a simple 1/1 trip system are quoted by these 
workers as 0.01 and 0.67 faults/year, respectively (Kletz, 
1974a). Then, using these failure rates and assuming a 
demand rate of 1 demand/year, the plant hazard rates 
shown in Table 13.20 are obtained. For the longer proof test 
interval, <St p < 1 and 7r p < 1 do not apply, and for this case, 
the data in the table are obtained not from the approximate 
Equation 13.9.18, but from Equation 13.9.19. Thus, to meet 
the design criterion suggested for functional reliability, 
a 1/2 trip system with weekly testing is required. The spu¬ 
rious trip rate for this system, however, might be unaccep¬ 
table, leading to a requirement for a 2/3 system. 

Another example of the use of trip systems is the hydro¬ 
carbon sweetening plant shown in Figure 13.10 (Kletz, 
1972a). The hydrocarbon is sweetened with small quan¬ 
tities of air which normally remain completely dissolved, 
but conditions can arise in which an explosive mixture may 
be formed. Initially it was assumed that the principal pro¬ 
blem lay in a change in the air/hydrocarbon ratio but a 
hazop study revealed that a hazard could arise in a number 
of ways. One is for an air pocket to be formed, which can 
occur as follows: 

(1) the temperature can be so high that the amount of air 
normally used will not dissolve; 

(2) an air pocket can be left behind when a filter is 
recommissioned; 

(3) the pressure can fall, allowing air to come out of 
solution; 

(4) a fault in the mixer can prevent the air being mixed 
with hydrocarbon, so that the pockets of air can be 
carried forward; 

(5) a fault in the air/hydrocarbon ratio controller can 
result in the admission of excess air. 


Table 13.20 Plant hazard rates for pressure relief 
valves and for trip systems (after Kletz 1974a) (Courtesy of 
Chemical Processing) 


System 

Plants hazard rate, 
r] (hazards/year) 

(years/hazard) 

No relief valve or trip 

1 

say, 1 

Relief valve: 

Annual testing 

0.004 

250 

Single 1/1 trip: 

Annual testing 

0.264 

4 

Monthly testing 

0.027 

36 

Weekly testing 

0.0064 

180 

Duplicate 1/2 trip: 

Weekly testing 

5.5 x 10“° 

18,000 
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1 Air pocket detector 

2 Low pressure 

3 High temperature 


Figure 13.10 Hydrocarbon sweetening plant (Kletz, 
1972a) (Courtesy of the American Institute of Chemical 
Engineers) 


In this case it is also necessary for the feed to be above its 
flashpoint, which can occur in a number of ways: (1) the 
temperature can be above the normal flashpoint and (2) the 
feed can contain low flashpoint material. Alternatively, if 
there is both a loss of pressure in the receiver and a failure 
of the non-return valve, hydrocarbon may find its way into 
the air receiver. 

The fault tree for the hazard is shown in Figure 13.11. The 
probabilities of the various fault paths were evaluated from 
this and the trip requirements were identified. The trip 
initiators considered, shown by the circles in Figures 13.10 
and 13.11, were 

(1) a device for detecting a pocket of air in the reactor; 

(2) a pressure switch for detecting a low pressure in the 
receiver; 

(3) a temperature measurement device for detecting a 
high temperature in the feed; 

(4) laboratory analysis for detecting a low flashpoint feed; 

(5) a device for detecting a high air/hydrocarbon ratio. 

As the latter condition is detected by the trip initiator 1 
anyway, trip initiator 5 was not used. The shut-down arra¬ 
ngement was that any of the trip initiators 1-3 shuts a valve 
in the air line and shuts down the compressor. The use of the 
laboratory analysis of feed flashpoint was restricted to 
ensuring that low flashpoint feeds were only present a for 


sufficiently small fraction of the time to meet the system 
specification. 

A third example is the distillation column heating system 
shown in Figure 13.12 (Lawley and Kletz, 1975). Heat was 
supplied to the distillation column from an existing steam- 
heated reboiler and a hot-water-heated feed vaporizer. The 
plant was to be uprated by the addition of another reboiler 
and vaporizer. 

The existing pressure relief valve was a 2/2 system and 
was adequate to handle overpressure from the existing 
reboiler and vaporizer. The problem was to cope with the 
overpressure which the new reboiler and vaporizer might 
give rise to. Both re-sizing of the existing relief valves and 
the addition of a third were unattractive in the particular 
situation. There was therefore a requirement for a trip sys¬ 
tem which would shut-down both the steam to the new 
reboiler and the hot water pump on the new vaporizer. 

Both 1/1 and 1/2 trip systems were considered. The 1/1 
system consisted of a pressure switch for detecting a high 
pressure on the overhead vapour line, a relay and a contact 
on the power supply to the hot water pumps and a relay and 
contact on that to the solenoid-operated shut-off valve on 
the reboiler steam supply. The 1/2 system consisted of 
a duplication of the 1/1 system. The summary of the failure 
rates of a simple trip system for this case is shown in 
Table 13.21. 

The functional reliability of the existing 2/2 relief valve 
system was calculated as follows: 


1- - 0.005 faults/year 
t p = 2 years 
<j> = At p = 0.01 


The target FDT for the new trip system was taken as a 
factor of 10 less than this, namely 0.001, for the reasons 
already explained. The functional reliability of a 1/1 trip 
system was calculated as follows: 

1 = 0.42 faults/year (from Table 13.21) 



= 0.21t p 


Then, taking into account also the disarmed time and the 
isolation dead time: 


id = 1 h/test 

» 0.0001 years/test 


0 is = 0.001 


0 = 0.21t p + 


0.0001 
r p + 0.001 


The minimum FDT is at a proof test interval of 
(Tp) min =(2Tp/7) 1/2 
= 0.022 years 
«= 8 days 


Assuming a proof test interval of 1 week, the FDT is 

0 = 0.01 

This does not meet the target. 
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Figure 13.11 Fault tree for explosion on a hydrocarbon sweetening plant (after Kletz, 1972a) (Courtesy of the 
American Institute of Chemical Engineers) 


The authors therefore consider a 1/2 trip system. The 
analysis for this system is more complex and takes into 
account the fact that the complete shut-off of the valves can 
be checked only on a proportion of the tests. It is concluded 
that a 1/2 system does just meet the target set. 

13.9.9 High integrity trip systems 

The trip system applications described so far have been 1/1 
or 1/2 systems. The more complex system with 2/3 majority 
voting is now considered. 

A major system of this kind, which appears to be the then 
most sophisticated on a chemical plant and which has been 
influential in the general development of protective sys¬ 
tems in the industry, is that on the ethylene oxide process of 
ICI described by Stewart and co-workers (R.M. Stewart, 
1971,1974a; R.M. Stewart and Hensley, 1971). The ethylene 
oxide process is potentially extraordinarily hazardous: it 
operates with a reaction mixture very close to the explosive 
limit, there is a fire/explosion hazard and a toxic release 
hazard. 


The design of the protective system followed the 
methods already outlined. The risk criterion was set at a 
probability of one fatality of 3 x 1(T 5 per year. The hazards 
were assessed by means of a fault tree, part of which is 
shown in Figure 13.13. 

The system devised is a HIPS, consisting of the high 
integrity trip initiators (HITIs), the high integrity voting 
equipment (HIVE) and the high integrity shut-down sys¬ 
tem (HISS). A schematic system diagram, which omits 
replicated signal connections, is shown in Figure 13.14. 

Redundancy is fully exploited throughout the system. 
Against each logic path to fire/explosion in the fault tree at 
least one parameter was selected initially to be a trip 
initiator. The integrity specified in fact required the use of 
at least two parameters. The choice of the trip initiating 
parameters is important but difficult. Some are obvious 
such as high oxygen concentration, high reactor tempera¬ 
ture, low recycle gas flow. Others are far less obvious, but 
are needed to guard against combinations of faults or to 
substitute for other parameters. The latter occurs, for 
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example, where the measurement response is too slow, 
for example oxygen concentration, or where the trip could 
result in a hazardous condition, for example recycle 
compressor trip. 



Figure 13.12 Distillation column heating system (Lawiey 
and Kletz, 1975) (Courtesy of Chemical Engineering) 


The measuring instruments used are carefully selected 
and, if necessary, modified to ensure high reliability. Each 
parameter is measured by triplicate instruments. The 
cables from each trip initiator on a parameter go by differ¬ 
ent routes so that there is less chance of all three being 
disabled by an incident such as a flash fire; the equipments 
have separate power supplies; and so on. The arrangement 
of the shut-down valves in the oxygen line illustrates fur¬ 
ther the use of redundancy. There are two lines each with 
three valves. A single line represents a 1/3 shut-down sys¬ 
tem. Duplication is provided to permit complete testing 
without disarming. 

The advantages of the system are that the failure of one 
trip initiator in the fail-safe mode does not cause the plant 
to be tripped spuriously, the failure of one trip initiator in 
the fail-dangerous mode does not prevent the plant from 
being tripped, and the proof testing can be done without 
disarming the system. 

The design of the system was subjected to an indepen¬ 
dent assessment by assessors within the company who 
were advised by the UKAEA. The assessors checked all 
feasible faults which could lead to hazardous conditions: 
the capability of the HIPS to carryout the protective action 
against the hazardous conditions arising from such faults 
and the occurrence rate of other hazardous conditions 
which the HIPS would not prevent, in relation to the design 
target Table 13.22 shows an extract from the table produced 
during this assessment. 

The assessment showed that at this stage the plant 
hazard rate was 4.79 x 10 _5 /year, which was higher than 
the target of 3 x 10“ 5 /year. An extra HITI was used to 
reduce the contribution of fault 3 from 2.72 x 10 -5 to 


Table 13.21 Failure rates of trip systems for a distillation column heating systems (Lawiey and Kletz, 1975) 
(Courtesy of Chemical Engineering) 


Components Failure rate (faults/year) 

Fail-to-danger Fail-safe Total 


Trip initiator: 

Impulse lines - blocked 0.03 

- leaking 0.06 

Pressure switch (contacts open to give trip signal on rising pressure) 0.10 

Cable fractured or severed 

Loss of electrical supply — 

Total 0.19 

Steam shut-off system: 

Relay coil (de-energize to trip) 

Relay contact 0.01 

Relay terminals and wire 

Solenoid valve (de-energize to trip) 0.10 

Loss of electrical supply (to solenoid valve) 

Trip valve (clothes on air failure) 0.10 

Air supply line — blocked or crushed 0.01 

- fractured or holed 

Loss of air supply — 

Total 0.22 


0.03 

0.06 

0.03 0.13 

0.03 0.03 

0.05 0.05 

0.11 0.30 


0.05 0.05 

0.01 0.02 

0.01 0.01 

0.20 0.30 

0.05 0.05 

0.15 0.25 

0.01 

0.01 0.01 

0.05 0.05 

0.53 0.75 


Pump shut-off system: 

Relay coil, contact, terminals and wire (as above) 0.01 0.07 0.08 

0.01 0.07 0.08 
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□ 0 


Figure 13.13 Fault tree for fire/explosion on an ethylene oxide plant (after R.M. Stewart, 1971) (Courtesy of the Institution of Chemical Engineers) 
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Figure 13.14 High integrity protective system (after 
Stewart, 1971) (Courtesy of the Institution of Chemical 
Engineers) 


0.8 x 10 _5 /year, which brought the system within specifi¬ 
cation. 

The assessors also examined the HIPS as installed 
to ensure that there were no significant deviations from 
design and reviewed the maintenance, calibration and 
testing procedures. The quality of the maintenance and 
testing is crucial to the integrity of a protective system 
and much attention was paid to this aspect. 

It was estimated that an alternative system with 70 1 /! 
single trip initiators would result in some 30 spurious trips 
a year and that the system used reduced this by a factor of 
over 12. Since the cost of a trip was estimated as £2000, the 
saving due to avoidance of spurious trips was about 
£55,000 per annum. The cost of £140,000 for the installation 
was therefore considered justified on these grounds alone. 

A coda to this account has been given by A. Taylor (1981), 
who describes the operation of the trip system over the 
period 1971 -80. The information on the performance of the 
trip system is of two kinds: operations of and tests on the 
system. Events were classified as spurious, genuine and 
deliberate, the last being initiations by the operators. 

Analysis of these events revealed that in a few cases the 
demand frequency was greater than that originally esti¬ 
mated by orders of magnitude. The author gives a table 
listing seven fault conditions, with the event numbering 
rising to 53, which exemplify the worst discrepancies. The 
two fault conditions which show the greatest discrepancies 
are the opening of a certain relief valve and loss of reaction: 


Fault description 

Fault condition 

Predicted 
frequency 
(events / 

Actual 

frequency 

(events/ 

Ratio of 
actual/ 
predicted 
frequency 

15 

A certain relief 

0.001 

1.68 

1680 


valve opens 




48b 

Loss of reaction 

0.01 

1.16 

116 


The relief valve fault was due to ‘feathering’, which had not 
been anticipated. The loss of reaction fault is not explicitly 
explained, but references by the author to the effect of 
modifications in reaction conditions may bear on this. It is 
noteworthy that of the seven fault conditions, it is those for 
which the original frequency estimates were lowest which 
are most in error. 

With regard to instrument failure rates, in the case of mag¬ 
netic float switches, three different failure mechanisms, 


and three different failure rates, were observed. Switches 
operating submerged in clean lubricating oil recorded no 
failures; those operating in recycled gas with occasional 
slugs of dirty water choked up; and a new type of switch 
was found to suffer from corrosion. 

The author quotes three examples of dependent failure. 
One of these relates to the choked level switches just men¬ 
tioned, which were all on one vessel. On four occasions, 
testing of the switches revealed that all were choked. The 
test procedure was altered to require that if one switch was 
found to be choked, the others should be tested. 

There were also mistakes made in the installation of the 
instruments. In one case, pneumatic pressure switches, of 
a flameproof type which is not waterproof, were located 
downwind of a low pressure steam vent pipe, and suffered 
water ingress and corrosion. 

13.9.10 PES-based trip systems 

A trip system needs to be highly reliable. For this reason, it 
has been the practice to design trip systems as separate, 
hardwired systems. The acceptability of using a PES to 
implement the trip functions has long been a matter of 
debate. There has been a marked reluctance to abandon 
dedicated, hardwired systems. 

The most constructive approach to the problem is to try 
to define the conditions which must be met by a PES-based 
trip system. As described in Section 13.12, the Health and 
Safety Executive (HSE, 1987b) has issued guidance based 
on this approach. Further guidance is given in the CCPS 
Safe Automation Guidelines described in Section 13.15, 
which are largely concerned with this topic. 

An account of a computer-based trip system on an 
ammonia plant has been given by Cobb and Monier- 
Williams (1988). The reason given for moving to such a 
system is the avoidance of spurious trips. Design options 
were considered based on PLC and computer systems. The 
latter was selected largely because it offered a better inter¬ 
face with the operator. The system uses two computers 
operating in parallel. Some features of the system are: the 
ability to use inferred measurements; improved reliability 
of the trips; decreased defeating, or disarming, of the trips; 
and better control of any disarming which does occur. 

13.9.11 Disarming of trip systems 

It may sometimes be necessary to disarm a trip. This need 
arises particularly where a transition is being made 
between one state and another such as during start-up. The 
disarming of a trip should be assessed to ensure that it does 
not negate the design intent, whether this check is made at 
the time of the original design or subsequently. Such dis¬ 
arming should be the subject of a formal authorization 
procedure. This may be supplemented by hardware mea¬ 
sures such as a key interlock. 

If a trip proves troublesome, it is liable to be disarmed 
without such authorization. This is particularly likely to 
occur if there are frequent spurious trips, due to sensor 
failure or other causes. In order to disarm a trip, it may not 
be necessary to interfere with the hardware. It is often 
sufficient simply to alter to set-point. 

13.9.12 Restart after a trip 

Once a trip has operated, it is necessary to reset the system 
so that a safer restart can be made. Therefore, the trip 
action which has driven the plant to a safe state should not 
simply be cancelled, but instead a planned sequence of 
















Table 13.22 Assessment of reliability of a high integrity trip system (after R.M. Stewart, 1971) (Courtesy of the Institution of Chemical Engineers) 


Description Fault condition Relevant Fractional deed time Hazard 




Occasions 
per year 

Probability 
that it 
leads to 
rupture 

b 

Probability 

that 

operator’s 

intervention 

fails 

Demand rate 
(demands/year) 

(d=axbxc) 

inp 

initiator 

No. 

HITI 

HIVE 

f 

HISS 

g 

Overall 

(h=e+f+g) 

(x 10 5 ) 
(hazards/ 

(i=dxh) 

1 

Feed filters blocked 

0.001 

0.2 

0.1 

0.00002 

10 & 12 

10“ 4 

10“ 5 

10“ 5 

1.2 x 10“ 4 

0.00024 

2 

Oxygen supply failure 

2.0 

0.2 

0.1 

0.04 

10&38 

10“ 4 

10“ 5 

10“ 5 

1.2 x 10“ 4 

0.48 

3 

PCV fails open 

0.25 

0.1 

1.0 

0.025 

11 

10“ 3 

8.3 x 10“ s 

10“ 5 

1.09 x 10“ 3 

2.72 

4 

Compressor antisurge 

0.2 

1.0 

0.1 

0.02 

18&36 

10“ 4 

10“ 5 

10“ 5 

1.2 x 10“ 4 

0.24 


bypass fails open 











5 

Gross carryover 

0.1 

1.0 

0.1 

0.01 

18,24 

10“ 4 

10“ 5 

10“ 5 

1.2 x 10“ 4 

0.12 


from absorber 











6 

etc. 










etc. 


PCV; pressure control valve. 
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actions taken to effect the restart. One situation which has 
frequently led to incidents is the restart of agitation in a 
batch reactor following an interruption of agitation. 

A case history caused by restart after a trip has been 
described by Kletz (1979a). A cumene oxidation reactor was 
fitted with a high temperature trip for which the trip action 
was to shut off the air and dump the contents of the reactor 
into a water tank. A spurious trip occurred, the air valve 
closed and the dump valve opened. The trip condition 
cleared itself, the dump valve remained open, but the air 
valve reopened. Air passed into the reactor, creating a 
flammable mixture. 


13.9.13 Restart after a depressurization 

A particular case of restart after a trip is the repressuriza¬ 
tion of a vessel following emergency depressurization 
(EDP). The effect of rapid reduction of pressure in a vessel 
containing a material such as liquefied gas may be to chill 
the vessel below the transition temperature, thus creating 
the hazard of brittle fracture. Too prompt a repressuriza¬ 
tion, before the vessel has warmed up sufficiently, can 
result in realization of this hazard. 

Cases where this has occurred are mentioned by Valk and 
Sylvester-Evans (1985). Treatment of the problem using a 
model of blowdown has been described by S.M. Richardson 
and Saville (1992). 

13.9.14 Hazard rate of a single-channel trip system 

In the relations for the functional reliability of a single¬ 
channel trip given in Section 13.9.3: 



The assumptions made are that Xx p -Cl; <5 t p Ct/r p Cl, as 
stated. 

If Equation 13.9.50 is used outside its range of validity, 
the results obtained can be not only incorrect but also 
nonsensical. Consider the case where the failure rate is 
X = O.Olfailures/year, thedemandrateisci = 3demands/year 
and the proof test interval is t p = 1 year. Then, 
Equation 13.9.50 gives for the hazard rate >/ a value of 
0.015 hazards/year, which is actually greater than the 
failure rate X. 

A treatment is now given for the more general case, based 
on the work of Lees (1982a) as extended by de Oliveira and 
Do Amaral Netto (1987). For a single-channel trip, one 
formulation of the possible states is: (1) trip operational; 
(2) trip failed but failure undetected and (3) trip failed, 
failure detected and trip under repair. The corresponding 
Markov model is: 


With the initial condition that the trip is operational, the 
solution of Equation 13.9.51 is as follows: 


n(n - r 2 ) 

r 2 (r 2 + n + 8)-\- 


[13.9.52a] 


r\r 2 n(n - r 2 ) 


[13.9.52b] 


m = 


XS 

r\r 2 


XS 


exp(rif) 


XS 

r 2 {n - r 2 ) 


exp {r 2 t) 


[13.9.52c] 




.-fr+l+O-[,3.9.53a] 


lli953b] 

Then the FDT and hazard rate obtained from Equations 
13.9.52b and 13.9.52c are instantaneous values, and are: 

q>(t)=P 2 {t)+P 3 (t) [13.9.54] 

if(0= m(t)+P 3 (t)] [13.9.55] 

The FDT and the hazard rate given in Equations 13.9.54 

and 13.9.55 are functions of time. The average value of 
the hazard rate over the proof test interval is: 

*1 = ^J [13.9.56] 

Then, substituting Equation 13.9.55 in Equation 13.9.56 

and integrating gives the average hazard rate: 


P 1 {t) = -XP 1 {t) + t iP 3 (t) 
P 2 (t) = XP^t) - SP 2 (t) 


[13.9.51a] 

[13.9.51b] 


nr 2 rftpin-rz) 
Xd(r 2 +n + S), . . 

rlxp{n-r 2 ) 


P 3 (t) = SP 2 (i) - nP 3 (t) [13.9.51c] 

where P„ is the probability that the trip is in state n. 


The foregoing treatment is based on the assumptions that 
the trip is always operational after a proof test is performed 
and that the test duration is negligible compared with the 
proof test interval. 
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Although this model has a high degree of generality, it is 
based on the assumption that, following detection of a trip 
failure, the plant continues to operate while the trip is 
repaired. If in fact the policy is that the plant operation does 
not continue while the trip is being repaired, different 
expressions apply. If the state P 3 (f) is dropped from the 
instantaneous hazard rate v\(t) in Equation 13.9.55 and if the 
repair rate g = 0, Equation 13.9.57 for the average hazard 
rate, then becomes: 

»7 = i|l-|i[A e xp(-5Tp) -5exp(-Ai p )]| X^8 

[13.9.58a] 


r\ = — [1 — (1 + Xx p ) exp( - Xip)\ X — 5 


[13.9.58b] 


This case is essentially that considered by Lees (1982a), 
who used the joint density function method. Two of the 
relations which he gives, for the failure density function/,, 
and the probability p, of realization of the hazard, are also 
of interest and are 


/„ - [exp(-(5T p ) - exp( -At p ) X £ 8 [13.9.59a] 


f n = X\ exp(-Ax) X = 8 [13.9.59b] 


%jsl-jij[A«p(-aJtp) - 5exp(-Ai p )] X £ 8 

[13.9.60a] 


p, = 1 - (1 + Xr p ) exp(l + Xr p ) A=8 [13.9.60b] 

A number of other relations have been given in the litera¬ 
ture for situations where Equation 13.9.50 is not valid. An 
expression given by Kletz and Lawley (Kletz, 1972a; Lawley 
and Kletz, 1975; Lawley, 1976) is 


f m X[1 - exp(—(5 t p /2)] [13.9.61] 


This is in effect Equation 13.9.19. It may be derived 
from Equation 13.9.17 together with Equations 13.9.10, 
13.9.13 and 13.9.16. It is applicable for small Xr p and j/t p , but 
higher <5 t p . 

Lawley (1981) has subsequently given the more accurate 
Equation 13.9.58. The assumptions underlying this equa¬ 
tion have just been described. 

Wells (1980) has given an expression 


n 


8X 

r wu 


[13.9.62] 


as an upper bound on the hazard rate for higher values 
of Sx p (>2). This expression is equivalent to taking the 


FDT as q> = X/(X + 8). De Oliveira and Do Amaral Netto 
give the relation: 

>1 = djl — ^ [1 - exp(-/k p )] j [13.9.63] 

for low values of 8 but higher values of Xz p . 

Numerical results for some of these expressions have 
been given by Lees and by de Oliveira and Do Amaral Netto. 
Table 13.23 shows some comparative results obtained, 
mainly by the latter workers. 

13.9.15 Frequency of events in a trip system 

A method of determining for a trip system the frequency of 
the events of principal interest has been described by 
Kumamoto, Inoue and Henley (1981). These events are the 
demand, the functional failure and the operational failure 
of the trip. The method is implemented in the program 
PROTECT. 

The procedure is to designate each of these events in turn 
as the top event of a fault tree, to create the fault tree and to 
determine its cut sets. These cut sets together with the 
proof test interval for the trip are the inputs used by the 
model to provide estimates of the frequency of the events 
mentioned. 

The application of this program to determine the expec¬ 
ted frequency of these events for an ammonia-air mixing 
plant as a function of the proof test interval has been 
described by Kumar, Chidambaram and Gopalan (1989). 

13.9.16 Time response of a trip system 

The point has already been made that the dependability of 
a trip system is a function not only of its reliability but also 
of its capability. An important aspect of capability is the 
dynamic response. The effect of the dynamic response of 
the instrument is illustrated in Figure 13.15. It is assumed 
in the figure that, when a fault occurs, the variable increa¬ 
ses linearly from its normal level to the danger level. The 
nominal trip point is set part way up the ramp, but the trip 
will not usually occur at the point in time corresponding to 
this level of the variable. There will normally be delays due 
to sampling and the dynamic response of the measuring 
instrument and there may be an instrument error. After the 
measuring instrument has responded, there will be delays 
in the safety circuitry and the shut-down valve. There will 
be a further delay in the process itself, before the effect of 
the shut-off is felt on the variable measured. All these fac¬ 
tors, delays and errors, erode the nominal safety margin 
and should be considered carefully. The original assump¬ 
tions concerning the maximum rate of rise of the variable 
are clearly critical also. 

Further reduction of the nominal trip point may be 
appropriate, but the setting should not be put so low that 
noise on the variable at its normal level activates the trip. 
A spurious trip can arise from too low a level of the trip 
setting as well as from instrument unreliability. 

The dynamic response of the complete situation against 
which the trip system is designed to protect may be mod¬ 
elled using standard methods. An account of unsteady- 
state modelling of plant is given in Mathematical Modeling 
in Chemical Engineering (Franks, 1967) and the modelling 
of instrumentation is treated in texts on process control 
such as those by Harriott (1964) and Coughanowr and 
Koppel (1965). 
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Table 13.23 Some numerical values given by expressions for the average hazard rate of a single-channel trip system 
(after de Oliveira and Do Amaral Netto, 1987) (Courtesy of Elsevier Science Publishers) 


Parameter 




Equation a 



ip (year) 

A (year -1 ) 

6 (year *) 

13.9.57 

13.9.58 

13.9.61 

13.9.63 

13.9.18 

0.0192 

0.1 

0.1 

0.958 x 10 -4 

0.958 x 10 -4 

0.958 x 10 -4 

0.958 x 10 -4 

0.958 x 10 -4 



1.0 

0.954 x 10 -3 

0.952 x 10 -3 

0.954 x 10 -3 

0.958 x 10 -3 

0.959 x 10 -3 



10 

0.919 x 10 -2 

0.900 x 10 -2 

0.914 x 10 -3 

0.958 x 10 -2 

0.959 x 10 -2 


1.0 

0.1 

0.952 x 10 -3 

0.952 x 10 -3 

0.958 x 10 -3 

0.953 x 10 -3 

0.959 x 10 -3 



1.0 

0.949 x 10 -2 

0.947 x 10 -2 

0.954 x 10 -2 

0.953 x 10 -2 

0.959 x 10 -2 



10 

0.913 x 10 -1 

0.895 x 10 -1 

0.914 x 10 -1 

0.953 x 10 -1 

0.959 x 10 -1 


10 

0.1 

0.900 x 10 -2 

0.900 x 10 -2 

0.958 x 10 -2 

0.900 x 10 -2 

0.959 x 10 -2 



1.0 

0.897 x 10 -1 

0.895 x 10 -1 

0.954 x 10 -1 

0.900 x 10 -1 

0.959 x 10 -1 



10 

0.864 

0.845 

0.914 

0.900 

0.959 

1.0 

0.1 

0.1 

0.468 x 10 -2 

0.468 x 10 -2 

0.488 x 10 -2 

0.484 x 10 -2 

0.5 x 10 -2 



1.0 

0.359 x 10 -1 

0.355 x 10 -1 

0.393 x 10 -1 

0.484 x 10 -1 

0.5 x 10 -1 



10 

0.916 x 10 -1 

0.860 x 10 -1 

0.993 x 10 -1 

0.484 

0.5 


1.0 

0.1 

0.358 x 10 -1 

0.355 x 10 -1 

0.488 x 10 -1 

0.368 x 10 -1 

0.5 x 10 -1 



1.0 

0.284 

0.264 

0.393 

0.368 

0.50 



10 

0.847 

0.591 

0.993 

3.68 

5.0 


10 

0.1 

0.892 x 10 -1 

0.860 x 10 -1 

0.488 

0.900 x 10 -1 

0.5 



1.0 

0.827 

0.591 

3.93 

0.900 

5.0 



10 

4.82 

1.00 

9.93 

9.00 

50 


a In equations where p is used, n =365/year. 


The following treatment is confined to the dynamic 
response of the measuring instrument, or sensor. The 
inputs to a sensor are generally characterized by a set of 
idealized forcing functions, of which the main types rele¬ 
vant here are (1) the step function, (2) the ramp function and 
(3) the impulse function. The unit step function changes 
suddenly at time zero from a value of zero to one of unity. 
The unit ramp function increases linearly with time and 
has a slope t. The unit impulse is a function which is infi¬ 
nitely large at time zero and zero elsewhere, but which also 
has an area which is unity. These three forcing functions 
are shown in Figure 13.16(a)-(c). 

The instrument itself is typically modelled as either a 
first- or second-order system. Thus, a temperature sensor 
might be modelled as a first-order system: 

Mc p ^=UA(Ti-T) [13.9.64] 

where A is the area for heat transfer to the sensor, c p is the 
specific heat of the sensor, Mis the mass of the sensor, t is 
time, T is the temperature of the sensor, U is the overall heat 
transfer coefficient, and the subscript i indicates input, or 
forcing.Thus, 7] is the temperature of the surrounding fluid. 

Equation 13.9.64 may be written in the more general 
form for a first-order system as: 


t^=Ti-T [13.9.65] 

where 

imMcp/UA [13.9.66] 

and r is a time constant. A lag of the form given by Equation 
13.9.65 is known as a ‘transfer lag’. 



Figure 13.15 Effect of instrument error and dynamic 
response on the safety margin in a trip system (after 
Hensley, 1988) (Courtesy of the Institute of Measurement 
and Control) 


In this case, the model obtained is a linear one. If the model 
obtained is non-linear, it needs first to be linearized. A non¬ 
linear model is obtained, for example, if the mode of heat 
transfer to the sensor is radiation rather than conduction. 

The normal approach is then to express each term in 
the linear model as the sum of the steady-state value and of 
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0 Time, t 

(c) 



(9) 



Figure 13.16 Dynamic response of sensor systems: (a) step forcing function; (b) ramp forcing function; (c) impulse 
forcing function; (d) response of first-order system to step forcing function; (e) response to first-order system to 
ramp forcing function; (f) response to first-order system to impulse forcing function; (g) response of second-order system 
to step forcing function. For second order system: m n natural frequency: C, damping factor 
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a transient component. Equation 13.9.65 then becomes: 

( t m* + 0i) + ( Tss + 9 ) I 13 - 9 - 67 ! 

The corresponding steady-state equation is: 

0 = T i ss - T ss [13.9.68] 

Subtracting Equation 13.9.68 from Equation 13.9.67 gives: 
T ^ = 0i-0 [13.9.69] 

where 0 is the transient component of temperature and the 
subscript ss indicates steady state. 

Equation 13.9.69 is then transformed into the Laplace, 
or s, domain by taking the Laplace transform: 


Taking the initial condition as the steady state with zero 
deviation gives 0(0) = 0, and hence the ratio of the output to 
the input, or the transfer function, is: 


(l-HfS)s 2 


[13.9.79] 


J=*| t -[1 — exp(—f/t)jj [13.9.80] 

The ramp response has the important property that 

0. - f- oo [13.9.81] 

In other words, after an initial transient, the measured 
value lags the actual value by a time equal to the time con¬ 
stant t. For the impulse response: 

0i = kS(t), say 
6i = k 

k 

“1 + w 


[13.9.82] 

[13.9.83] 

[13.9.84] 


s - = -exp(-f/t) 


[13.9.85] 


where k is a constant. Taking the Laplace transform of 
Equation 13.9.72 gives 

0; = - [13.9.73] 

Substituting Equation 13.9.73 in Equation 13.9.71 gives: 

[13.9.74] 


where S(f) is the impulse function. The step, ramp and 
impulse responses of a first-order system are shown in 
Figure 13.16(d)—(f). 

An overdamped second-order system is equivalent to 
two transfer lags in series. The basic model is therefore 

T. 71 T; [13.9.86] 


(1 + xs)s 


Q = k[ 1 - exp(-//r)] 

Equation 13.9.75 is sometimes written as 


Where this is done, it should be noted that 0i is a constant, 
defined by Equation 13.9.72, whereas in Equation 13.9.69, it 
was a variable. For the ramp response, proceeding in the 
same way: 

0i = kt , say [13.9.77] 

0 i = A [13.9.78] 


where subscripts 1 and 2 indicate the first and second 
stages, respectively. The transfer function of the second- 
order system is: 


0 i (1 + t iS )( 9 + t 2 5 ) 1 J 

The step response is: 

J = 1 - \ ^ It.exp(-f/Ti) - T 2 exp(-f/T 2 )] [13.9.89] 

The impulse response is: 

02 _ 


-[exp(-f/n) - exp(—f/r 2 )] 


[13.9.90] 
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It is sometimes required to provide an unsteady-state 
model of the sensor for incorporation into an unsteady- 
state model of the total system. In this case, an equation 
such as Equation 13.9.65 may be used for a first-order sys¬ 
tem and a pair of equations such as Equations 13.9.86 and 
13.9.87 for a second-order system. 

The three forcing functions may be illustrated by the 
example of a flammable gas cloud at a gas detector. The gas 
cloud may present to the sensor as any one of these forcing 
functions. The gas concentration may rise suddenly from 
zero to a value which then remains constant (step function), 
it may rise linearly (ramp function) or it may rise momen¬ 
tarily from zero to a high value and then subside as rapidly 
(approximated by an impulse function). 

An account of the time lags which occur in practical trip 
systems has been given by R. Hill and Kohan (1986), who 
characterize the dynamic response of a trip by a ramp 
function similar to that shown in Figure 13.15 and consider 
in turn the individual time lags. If the total interval from 
the time when the process starts to deviate to the time when 
it reaches the danger point exceeds 2 min, there is normally 
no problem in designing a trip system, but if the interval is 
less than this, there is a potential problem, and, if it is of the 
order of seconds, a trip solution may well not be practical. 

The signal transmission lags to and from the logic sys¬ 
tem, and the logic system delay itself is normally negli¬ 
gible, even for pneumatic systems. Exceptions may occur 
where there are very long pneumatic transmission lines or 
where the logic is executed on a time-shared device. The 
more significant lags are likely to be in the sampling and 
the sensor, in the final control element, and in the process 
itself. Sampling lags may amount to a dead time of 10-30 s. 
Transfer lags in sensors vary, with temperature measure¬ 
ment lags often being large due to the thermal inertia of the 
measuring pocket. The lag at the control valve can vary 
from a fraction of a second up to several minutes, depend¬ 
ing on the valve size. The lag in the process is also highly 
variable. 

13.9.17 Configuration of trip systems 

Inspection of Tables 13.17 and 13.19 indicates that the use of 
parallel redundant, or 1 /n, systems gives an increase in 
functional reliability, but a decrease in operational relia¬ 
bility compared with a 1/1 system. Better overall reliability 
characteristics can be obtained by the use of a majority 
voting system, of which the 2/3 system is the simplest. 
A comparison of a 2/3 system with a 1/1 system shows that 
the 2/3 system has a high functional and operational relia¬ 
bility, while a comparison with a 1/2 system shows that the 
2/3 system has a slightly lower functional reliability, but a 
much higher operational one. The 2/2 system is little used 
for trip systems but has some interesting characteristics. It 
is effectively a series system which has a rather lower 
functional reliability than a 1/1 system, but its operational 
reliability exceeds not only that of the 1/1 but also that of 
the 2/3 system. 

The configuration of trip systems has been discussed by 
Rushton (1991a,b), who describes a formal approach. 
According to Rushton, for typical systems, the ranking of 
trip systems with respect to their functional and opera¬ 
tional reliability is invariant and is as shown in Table 13.24. 
The trip systems most commonly used are the 1/1,1/2 and 
2/3 systems. The requirement for functional reliability is 
rarely such as to justify a % system and that for operational 
reliability rarely such as to justify a 2/2 or 3/3 system. 


Table 13.24 Ranking of trip system configurations with 
respect to functional and operational failure (Rushton, 
1991b) (Courtesy of the Institution of Chemical Engineers) 


Functional ranking 

Operational ranking 

<iw» 

System 

'Tfm/n 

System 

Low 

1/3 

Low 

3/3 

1 

1/2 

1 

2/2 


2/3 


2/3 

1 

1/1 

1 

1/1 

T 

2/2 

Y 

1/2 

High 

3/3 

High 

1/3 


The criterion given by Rushton for selection of the trip 
system configuration is an economic one and is: 

V = nC + 5</> s H + y s S +5(1-<t> s )G [13.9.91] 

where C is the annualized cost of a single channel trip, G is 
the cost of a genuine trip, H is the cost of realization of a 
hazard, S is the cost of a spurious trip, V is the overall 
annual cost, and the subscript s indicates the trip system 
(as opposed to a single channel). The most economic solu¬ 
tion is that which minimizes V. 

For a genuine trip, there is an element of loss related to 
the process failure which causes the demand. If, for pur¬ 
poses of comparison, this element (which will occur in all 
cases) is neglected, the cost of a genuine trip is approxi¬ 
mately the same as that of a spurious one (G= S), so that 
Equation 13.9.91 becomes: 

V = nC + 54> S H + [y s + 5(1 - <t> s )\S [13.9.92] 


If the basic parameters of a particular application are 
known, namely the demand rate 5, the fail-to-danger and 
spurious failure rates 4 and y s , the proof test interval r p , 
the repair time r r and the costs of hazard realization H and 
spurious trip S, then a plot of H/C vs S/C gives a map 
showing the regions where a particular configuration is 
optimal. The boundaries of the regions are curves of con¬ 
stant V/C. 

As an illustration, consider the case given by Rushton 
where the application is characterized by 5 = 0.01 demands/ 
year, X =0.2 failures/year, y=0.5 failures/year, t p = 1/12 
and T r = 1/52. The map giving the optimal configurations 
for this case is shown in Figure 13.17(a). If 5 is increased to 
1.0 demands/year, the map becomes that shown in Figure 
13.17(b). 

Rushton also treats the case where there is an element of 
common cause failure (CCF) and uses for this the beta 
method described in Chapter 9. He considers the simplest 
trip configuration to which such failure applies, the 1/2 
system. For such a system: 


, Wl-fth>] 2 , hbp 
<h/2 = - 3 -+ 


[13.9.93] 


7i/ 2 = 2 x (1 - f} 2 )y + fl 2 y 

= (2 - jS 2 )y 


[13.9.94a] 

[13.9.94b] 
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(c) 

Figure 13.17 Configuration selection map for trip systems: 
8 = 0.01, [1- 0; (b) case with 8 = 0.1, p = 0; (c) case with 8 = 
details (Courtesy of the Institution of Chemical Engineers) 


where ft is the fraction of the functional failure rate which 
is common cause, or the beta value for that failure rate, and 
ft is the operational beta value. 

The effect of CCF may be illustrated by considering the 
extension given by Rushton of his example to the case of a 
1/2 trip system where 5 = 1 demand/year, X =0.2 failures/ 
year, y=0.5 failures/year, r p = l/12, r r = l/52 and where 
ft = ft = ft- Maps of the configuration space for this 
case are shown in Figure 13.17(c) and (d) for different 
values of (i. Table 13.25 gives expressions for the FDT 
and spurious trip rate for different trip configurations. 

This cost-based approach allows the different trip sys¬ 
tem configurations to be put on a common basis for pur¬ 
poses of comparison. Where the hazard includes one to 
human life, there will be a certain level of functional relia¬ 
bility which must be achieved and this should be a factor in 
the choice of configuration. The approach described may 
still be applicable with adaptation in judging which con¬ 
figurations are reasonably practicable. 

13.9.18 Integration of trip systems 

As already described, a trip system is normally dormant 
and comes to life only when a demand occurs. An element 
of the trip system such as a sensor or a valve may experi¬ 
ence failure and such a failure will lie unrevealed unless 
detected by proof testing or some other means. By contrast, 
equivalent elements in a control system are exercised 



(b) 



illustrative examples (Rushton, 1991b): (a) case with 
1, (S = 0.3 and (d) case with 8=1, P=1. See text for further 


continuously, and failure in such an element is liable to 
cause an operational excursion of some kind. The failure in 
this case is a revealed one. Yet the actual physical fault in 
the two cases may well be identical. A sensor may fail giv¬ 
ing a low/zero or high reading, or a valve may jam open or 
shut. The concept of trip integration, which has been 
described by Rushton (1992), is based on this contrast 
between a fault which lies unrevealed in a trip system but is 
revealed in a measurement and control system. The princi¬ 
ple applies to any system which has a protective function. 
The system is regarded as integrated provided it is reg¬ 
ularly exercised, which generally means that it is in use 
during the normal operation of the plant. As an illustration, 
Rushton describes a refrigerated storage tank for a toxic 
liquid, equipped with a cooling system and a pressure relief 
valve. Both are protective systems, but the cooling system 
is in more or less continuous use and is thus integrated, 
whereas the relief valve is not. 

In this case the integration is benign, but it can also be 
malignant. As an example of the latter, the author cites the 
case of a sensor which is common to both a level control 
loop and a high level alarm. Failure of the sensor results in 
failure not only of the control loop but also of the alarm. 

It should be an aim of trip system design to convert 
unrevealed failures into revealed failures, and hence to 
enhance reliability, by the judicious exploitation of benign 
integration. 
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Table 13.25 Fractional dead times and spurious trip rates for trip systems with simultaneous proof testing and 
common cause failures accounted for by the beta method (Rushton, 1991b) (Courtesy of the Institution of Chemical 
Engineers) 


System 

K/n 

7 mm 


1/1 




2 

y 


1/2 

[Ar p (i - A)] 2 , 

3 

(2-ft)y 


2/2 

■%( t-hm 

2y 2 (i -p 2 )\ 

+ p27 

1/3 

(Kf n 

4 

(3 — 2^)7 


2/3 

(^ P ) 2 (i-« 2 +^ 

6y 2 (l -p 2 )\ 

+ P2V 

3/3 

^(3-2ft) 

3f(l-p 2 ) 3 rl 

+ p2l 

m/n 

q [Ax P (i-wr, pm 

wy(l — ^2) ( ” 



13.9.19 Maintenance of trip systems 

The foregoing account of trip systems has brought out the 
importance of proof testing. This testing and, more gen¬ 
erally, the maintenance of trips needs to be of a high stan¬ 
dard if the design reliabilities are to be achieved. Accounts 
of the testing and maintenance of trip systems have been 
given by R.M. Stewart (1971), A. Taylor (1981) and Barclay 
(1988). 

The system described by Barclay is broadly as follows. 
The trips on a plant are covered by a testing schedule which 
specifies a test interval for each trip system. A common test 
interval is 12 months, but the interval is established for 
each trip individually. A change to the test interval, or 
complete removal of the trip, are governed by formal pro¬ 
cedures which involve consultation with the interested 
parties. 

There is a written procedure for the test which details the 
actions to be taken. This is necessary because the proce¬ 
dure can be quite complex, because the individual per¬ 
forming the test may not be familiar with the particular 
trip and because in many cases the test is one of the last 
tasks done prior to a start-up when there may be consider¬ 
able pressure. This procedure can be changed only after 
formal consultations. 

The test should cover the whole trip from initial to final 
element. From the point of view of testing, the preferred 
method is an actual test in which the procedure is to take the 
process to the trip point and verify the trip action. The 
alternative is a simulated test which is performed by 
simulating process conditions using test equipment. 

In many cases it is impractical to carry out an actual test. 
In the case of a hazardous process, the reasons are obvious. 
But even for a less hazardous process, the number of trips 
may be such that repeated shut-down and start-up is not 
practical. On a plant with 30 or 40 trips the equipment may 
be worn out just by testing. 

It can be misleading to rely on a single-point trip as a 
sufficient test. And particularly where there is complex 
logic, it is necessary to exercise all the steps in the chain; 
omission of intermediate steps can be misleading. 


Instruments which are part of a trip system are provided 
with identification, both on circuit diagrams and in the 
field by a tag. This helps avoid shut-downs caused by work 
on such instruments. 

The trip system is maintained in good condition by 
preventive maintenance. Equipment is inspected for 
deterioration. Critical equipment is classified as such and 
subject to periodic overhaul. It is required that following 
maintenance work a function check be carried out on 
the equipment. A trip which is out of service or fails to 
operate is not tolerated. It is classed as a hazard and action 
is taken. 

At the site described by Barclay, there are some 
35,000-40,000 instruments with more than 5000 trips and 
interlocks. Trip maintenance is handled by a computerized 
system. The responsibility for testing in this works lies 
with the operations rather than the mechanical function. 
Essentially similar considerations apply to the main¬ 
tenance of interlocks. 


13.10 Interlock Systems 

Interlocks are another important type of protective device. 
They are used to control operations which must take 
place in a specified sequence and equipments which 
must have specified relations between their states. This 
definition of an interlock differs from that often used in 
the American literature, where the term ‘interlock’ tends to 
be applied to both trip and interlock systems (as defined 
here). 

Accounts of interlock systems are given in Applied Sym¬ 
bolic Logic (E.P. Lynch, 1980) and Logical Design of Auto¬ 
mation Systems (V.B. Friedman, 1990) and by D. Richmond 
(1965), E.G. Williams (1965), Becker (1979), Becker and Hill 
(1979), Kohan (1984) and the CCPS (1993/14). 

There are various kinds of interlock The original type is 
a mechanical device such as a padlock and chain on a hand 
valve. Another common type is the key interlock. Increas¬ 
ing use is made of software interlocks based on process 
computers. 
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Some typical applications of interlocks are in such 

(1) electrical switchgear; 

(2) test cubicles; 

(3) machinery guards; 

(4) vehicle loading; 

(5) conveyor systems; 

(6) machine start-up and shut-down; 

(7) valve systems; 

(8) instrument systems; 

(9) fire protection systems; 

(10) plant maintenance. 

An interlock is often used to prevent access as long as an 
equipment is operating. Thus, electrical switchgear may be 
installed in a room where an interlock prevents the door 
opening until there is electrical isolation. Similarly, an 
interlock prevents access to a test cubicle for operations 
involving high pressure or explosive materials until safe 
conditions pertain. An interlock may be used to stop access 
to a machine or entry into a vessel unless the associated 
machinery cannot move. In vehicle loading, interlocks are 
used to prevent a tanker moving away while it is still con¬ 
nected to the discharge point. 

Where synchronized operation of equipment is neces¬ 
sary, as in a conveyor system, interlocks are used to ensure 
this. Interlocks are used for the start-up of machinery to 
ensure that all the prestart conditions are met, that the 
correct sequence is followed and that conditions for tran¬ 
sition from stage to stage are met. For large rotating 
machinery, key factors are process conditions and oil 
pressures. 

Pressure relief valves have interlocks to prevent all the 
valves being shut off simultaneously. There may be inter¬ 
locks on other critical valve systems. Interlocks are also a 
part of instrument systems. An interlock may be used to 
prevent the disarming of a trip system unless certain con¬ 
ditions are met. Fire protection systems are provided with 
interlocks as a safeguard against leaving the system dis¬ 
abled, particularly after testing or maintenance. Plant 
maintenance operations make much use of interlocks to 
prevent valves being opened or machinery started up while 
work is in progress. 

Some features of a good hardware interlock are that it 
(1) controls operations positively, (2) is incapable of defeat, 
(3) is simple, robust and inexpensive, (4) is readily and 
securely attachable to engineering devices and (5) is reg¬ 
ularly tested and maintained. 

Some interlocks are quite simple, but some interlock 
systems are quite complex. Such systems are often not 
confined to interlocks, but incorporate other logic func¬ 
tions. Interlock systems therefore shade over into general 
logic control systems. In particular, there are some very 
large interlock systems on boilers and gas turbines. 

An especially important type of logic control is the con¬ 
trol of sequential operations. Sequential control systems 
usually have numerous checks which must be satisfied 
before the next stage is initiated and checks that equipment 
has obeyed the control signals. These checks constitute 
a form of interlock. 

Since an interlock can bring the process to a halt, it is 
important to provide adequate status and alarm signals to 
indicate which feature is responsible for the stoppage. It 
will be apparent that some interlocks are effectively trips. 
The distinction between the two is often blurred. 


The interlocks described so far are simple rather than 
high integrity systems, but the latter can, of course, be 
used, if the situation warrants it. The general approach is 
similar to that described for trip systems. 

13.10.1 Interlock diagrams 

As with protective systems so with interlock systems, the 
design may involve a number of parties and a common 
language is needed. Unfortunately, this is an area of some 
difficulty, for three reasons. The description of interlock 
systems involves the use of several different types of dia¬ 
gram; there appears to be considerable variability in the 
types of diagram employed and in the nomenclature used to 
describe them. The symbols for use in these diagrams are 
given in standards; however, not only are these standards 
subject to continuous revision, but also the symbols given 
are often not those in common use. Interlock systems are 
not well served with textbooks. In particular, there is in 
electrical engineering a large literature on switching sys¬ 
tems, but very little of this addresses process interlock 
systems as such. 

Three types of diagrams commonly used in the design of 
interlock systems in the process industries are (1) the pro¬ 
cess flowchart, (2) the logic diagram and (3) the ladder 
diagram. The last two are sometimes referred to as the 
‘attached logic diagram’ and the ‘detached logic diagram’, 
respectively. 

The starting point for design of an interlock system is a 
description of a sequence of operations. A diagram show¬ 
ing this is a process chart. Process chart symbols have 
been given in Work Study (Curie, 1960) and are shown in 
Table 13.26, Section A. 

The logic required to implement this sequence may be 
shown in a logic diagram. This utilizes standard symbols 
for functions such as OR, AND and NOT, similar to those 
used in fault tree work, as described in Chapter 9. Standard 
symbols for fault trees are given in BS 5760 Reliability of 
Systems, Equipment and Components, Part 7:1991 Guide to 
FaultTreeAnalysis. For some functions, two sets of symbols 
are given, the preferred and the alternative. It is the latter 
which is commonly used in the process industries and 
which is used here. The logic symbols used here are the 
alternative symbols given in BS 5760 and are shown in 
Table 13.26, Section B. 

The logic diagram may then be converted to a ladder 
diagram. Standard symbols for protective logic systems 
are given in BS 3939:1985 Graphical Symbols for Electrical 
Power, Telecommunications and Electronic Diagrams. The 
relevant IEC standard is IEC 617 Graphical Symbols for 
Diagrams. BS 3939: Part 7: 1985 Switchgear, Controlgear 
and Protective Devices, which is identical to IEC 617-7, gives 
relevant symbols. Other sets of symbols include those 
given by E.G. Williams (1965) and those of E.P Lynch 
(1980). An account of the evolution of logic symbols is given 
in An Introduction to the New Logic Symbols (Kampel, 1986). 
Table 13.26, Section C, shows a selection of symbols, 
including those used here, from those given by Lynch. 

13.10.2 Some basic systems 

Some of the basic building blocks of interlock systems are 
illustrated in Figure 13.18. Figure 13.18(a) shows a simple 
starting circuit. Activation of the circuit occurs if there is a 
signal due to depression of the start pushbutton AND a 
signal due to non-depression of the stop pushbutton. Since 
the signal from the start pushbutton will disappear when it 
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Table 13.26 Interlock logic symbols 


A Work study symbols® 

Symbol 

Activity 

Predominant 

result 

o 

□ 

Operation 

Produces 
accomplishes 
changes further 
the process 

Inspection 

Verifies quantity 
or quality 

o 

Transport 

Moves or carries 

D 

Delay 

Interferes or 
delays 

V 

Storage 

Holds, retains or 
stores 

B Logic symbols* 1 



Pushbutton start 
Pushbutton stop 

Position, or limit, switch 

Relay or solenoid contracts, normally 
open, closed when relay or solenoid is 
energized 

Relay or solenoid contacts normally 
closed, opened when relay or solenoid is 
energized 

Motor n 
Relay n 
Solenoid n 


PB start 



is no longer being depressed by the operator, it is necessary 
to provide the feedback signal shown, which ensures that 
there continues to be an output signal. If the stop pushbut¬ 
ton is depressed, the output signal is extinguished. 

Figure 13.18(b) shows a time delayed holding circuit. If 
following activation by the start pushbutton, the signal X 
does not appear within the time interval specified, the 
output signal disappears. A typical application of this cir¬ 
cuit is start-up of a motor-driven pump which is supplied 
with lubricating oil by a lube oil pump driven from the same 
motor. If the lubricating oil pressure signal is still absent 
after the time interval specified, the pump is shut-down. 

Figure 13.18(c) shows a self-extinguishing circuit. 
Activation of the pushbutton gives an output signal which 
continues until the time interval specified has elapsed, 
when the output signal is extinguished. This circuit might 
typically be used to have a motor-driven equipment run for 
a period and then shut-down. 

13.10.3 Illustrative example: conveyor system 

As an illustration of an interlock system, consider the con¬ 
veyor system described by Lynch. A screw conveyor A 
feeds material from a car vibrator to an elevator, which 
discharges to screw conveyor B above two storage bins 
A and B. There is a slide gate on the pipe between conveyor 
B and each bin, with a limit switch on each gate. Material is 
fed from a bin by a star feeder into screw conveyor C. The 
loading equipment can fill the bins at several times the rate 
at which it can be withdrawn. 

Figure 13.19(a) shows a logic diagram for the interlocks 
for manual operation of this system. Conveyor B can be 
started only if either A or B slide gate is open. The elevator 
can be started only if conveyor B is running. Conveyor A 
can be started only if the elevator is running. The diagram 
also shows the simple non-interlocked starting circuit for 
the car vibrator. 

The corresponding ladder diagram is shown in 
Figure 13.19(b). The diagram shows six circuits A-F. 
Certain relays occur in more than one circuit, for example, 
relay R1 in circuits A and D, and it is this which imparts the 
interlocking feature. Circuit A is the starting circuit for 
conveyor B. This circuit can be activated only if either relay 
R2 or R3, the relays for the slide gates limit switches (LS), is 
closed. If this condition is met, depression of the start 
pushbutton (PB) energizes relays R1 and Ml and causes R1 
to close and Ml to operate a relay in the power circuit. When 
the stop pushbutton is pressed, the circuit is de-energized 
and R1 opens. 

In circuit B, closure of the slide valve limit switch LSI 
energizes relay R2 and causes it to close, and opening of 
the switch causes R2 to open. Circuit C implements a simi¬ 
lar relationship between limit switch LS2 and relay R3. 
Circuit D is the starting circuit for the elevator. The circuit 
can be activated only if relay R1 is closed. If this condition is 
met, depression of the start button energizes relays R4 and 
M2 and causes R4 to close and M2 to operate. Circuit E is the 
starting circuit for conveyor A, and is similar to circuit D. 
The circuit can be activated only if relay R4 is closed. 
Circuit F is a simple starting circuit and is not interlocked. 


a These symbols are given by Currie (1960), who attributes them 
without reference to the American Society of Mechanical Engineers. 
b These symbols are given in BS 5670: Part 7:1991. The alternative 
symbols for NOT is a common alternative and is that used by 
E.P. Lynch (1980). 

c These symbols are those used by E.P. Lynch (1980). 


13.10.4 Illustrative example: reactor system 

Another example of a simple interlock system is illustrated 
in Figures 13.20 and 13.21. Figure 13.20 shows a plant con¬ 
sisting of a water-cooled reactor in which a batch reaction is 
carried out. The reactor is charged with chemical A and 
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chemical B is then fed in gradually from a weigh tank as the 
reaction proceeds. The interlock system is required to cut 
off the supply of B from the weigh tank if any of the fol¬ 
lowing conditions apply: (1) the shut-off valve V3 on reactor 
2 is open; (2) the agitator is not operating; (3) the agitator 
paddle has fallen off or (4) the reactor temperature has risen 
above a fixed limit. The loss of the agitator paddle is 
detected by a current-sensitive relay on the motor. 


An interlock system for carrying out these functions 
is shown in Figure 13.21. The start input opens valve 1, 
unless valve 3 is open or the agitator is stopped, which 
conditions inhibit start-up. If these conditions occur later 
or if the reactor temperature rises or the agitator paddle 
falls off, valve 1 is closed. The interlock causing the clo¬ 
sure is signalled by a status or alarm display. There is a 
10 s delay on the reactor high temperature interlock to 


PB stop 
PB start 



PB start 
PB stop 
Signal X 




(c) 


Figure 13.18 Some basic interlock system logic diagrams: (a) simple starting circuit; (b) time delayed holding circuit and 
(c) self-extinguishing circuit. PB, pushbutton 




(a) 


Figure 13.19 continued 
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(b) 

Figure 13.19 Conveyor interlock system diagrams: (a) logic diagram; and (b) ladder diagram (E.P. Lynch, 1980) 
(Reproduced with permission from Applied Symbolic Logic by E.P. Lynch, Copyright ©, 1980, John Wiley & Sons Inc.) 


allow for noise on that signal. If operation is inhibited 
by the reactor high temperature or agitator stoppage 
interlocks, these inhibitions are removed 5 and 10 min, 
respectively, after the inhibiting condition has disapp¬ 
eared. An account of the reliability of interlock systems 
is given by R.A. Freeman (1994). 


13.11 Programmable Logic Systems 

As already indicated, increasing use is made in process 
control systems of PLCs. An account of the application of 
PLCs to functions such as pump change over, fire and gas 
detection and ESD has been given by Margetts (1986a,b). 
He describes the planning of an operation such as pump 
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Figure 13.20 Batch reactor system. FIC, flow indicator controller; S, speed measurement; Tl, temperature 
indicator; TIC, temperature indicator controller 


change over using hierarchical task analysis, in which the 
change over task is successively redescribed until it has 
been broken down into executable elements, and the appli¬ 
cation of the hazard and operability (hazop) method to 
assess the adequacy of the resultant design. 

He also deals with the reliability of the PLC system. For 
the system which he considers, the MTBFs of the input 
device, the control logic and the output device are 100,000, 
10,000 and 50,000 h, respectively, giving an overall system 
MTBF of 7690 h. Use of as many as four control logic units 
in parallel would raise the system MTBF to 14,480 h, but 
this is not the complete answer. The method described by 
the author for the further enhancement of reliability is the 
exploitation of the ability of the PLC to test the input and 
output devices and also itself. 


13.12 Programmable Electronic Systems 

Increasingly, the concept of computer control has become 
subsumed in the broader one of the PES. The account given 
here is confined to the safety aspects of PESs and is based 
on the HSE PES Guide. The treatment in the CCPS Safe 
Automation Guidelines is discussed in Section 13.15. 

13.12.1 HSE PES Guide 

An account of PESs and their safety implications is given 
in Programmable Electronic Systems in Safety Related Appli¬ 
cations (HSE, 1987b) (the HSE PES Guide), of which Part 1 
is an Introductory Guide (PES 1) and Part 2 the General 
Technical Guidelines (PES 2). The general configuration of a 
PES is shown in Figure 13.22. 

Whereas in a safety-related system the use of conventional 
hardwired equipment is routine, the use of a PES in such an 
application has been relatively unknown territory. The 
approach taken, therefore, has been to assess the level of 


integrity required in the PES by reference to that obtained 
withaconventionalsystembasedongoodpractice.Thislevel 
of integrity is ref erred to as ‘conventional safety integrity’. 

PES 2 gives three system elements which should be 
taken into account in the design and analysis of safety- 
related systems: 

(1) configuration; 

(2) reliability; 

(3) overall quality. 

Safety integrity criteria for the system should be specified 
which cover all three of these system elements. 

13.12.2 Configuration 

The configuration of the system should be such as to pro¬ 
tect against failures, both random and systematic. The 
former are associated particularly with hardware and the 
latter with software. PES 2 lays down three principles 
which should govern the configuration: 

(1) the combined number of PES and non-PES safety- 
related systems which are capable, independently, of 
maintaining the plant in a safe condition, or bringing 
it to a safe state, should not be less than the number of 
conventional systems which have provided conven¬ 
tional safety integrity; 

(2) no failure of a single channel of programmable elec¬ 
tronic (PE) hardware should cause a dangerous mode 
of failure of the total configuration of safety-related 
systems; 

(3) faults within the software associated with a single chan¬ 
nel of PE should not cause a dangerous mode of failure of 
the total configuration of safety-related systems. 












PB stop • 
PB start ■ 



Figure 13.21 Batch reader interlock system logic diagram 
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Figure 13.22 A programmable electronic system (HSE, 1987b). ADC, analogue-to-digital converter; 

DAC, digital-to-analogue converter; NP, non-programmable hardware; PE, programmable electronics (Courtesy of 
HM Stationery Office) 


Observance of the second principle may require that, in 
addition to the single channel of PE hardware, there should 
be at least one additional means of achieving the required 
level of safety integrity. Three such means might be: 


(1) additional non-programmable hardware; 

(2) additional programmable hardware of diverse design; 

(3) additional PE hardware of same design. 


The latter is applicable only where the design is well 
established and there is a record of reliable operation in an 
environment similar to that under consideration. 

Observance of the third principle may require that where 
a single design of software is used, there should be an 
additional means of achieving safety integrity. Such means 
maybe: 


(1) additional software of diverse design; 

(2) additional non-programmable hardware. 


Diversity of software is required only where: 

(1) PES safety-related systems are the sole means of 
achieving the required level of safety integrity; 

(2) faults in the software of a single channel of PE might 
cause a dangerous mode of failure of the total config¬ 
uration of safety-related systems. 

This strategy is intended to protect against systematic 
failures and, in particular (a) software errors in the 
embedded or applications software; (b) differences in the 
detailed operation of microprocessor and other large-scale 
integrated circuits from that specified; (c) incompatibility 
between original and replacement hardware modules and 
(d) incompatibility of updated or replacement embedded 
software with original software or hardware. 

The extent to which it is necessary to have diversity 
of software depends on the application. As a minimum, 
the safety-related function should use diverse applica¬ 
tions software. For higher reliability it may be necessary 
to consider also diverse embedded software. The safety 
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requirements specification is necessarily a common feature 
of the diverse software implementations. It is therefore 
important that it be correct. 

PES 2 recognizes that there may exist other ways of 
providing against failure. In some applications it may be 
possible to achieve the required level of safety integrity 
by adopting a formal approach to the software design 
and testing. Furthermore, for situations where a relatively 
low level of reliability is acceptable, the use of a single 
PE channel may be acceptable provided there is extensive 
self-monitoring of the hardware and automatic safety 
action on detection of failure. 

13.12.3 Reliability 

The governing principle for reliability of the hardware is 
that the overall failure rate in a dangerous mode of failure, 
or, for a protection system, the probability of failure to 
operate on demand, should meet the standard of conven¬ 
tional safety integrity. PES 2 specifies three means of 
meeting this criterion: 

(1) a qualitative appraisal of the safety-related systems, 
using engineering judgement; 

(2) a quantified assessment of the safety-related systems; 

(3) a quantified assessment of the safety of the plant. 

Essentially, the level of reliability should be governed by 
the conventional safety integrity principle. Where the 
acceptable level of reliability is relatively low, the first 
method may suffice, but where a higher reliability is 
required, the second and third methods will he appropriate. 

13.12.4 Overall quality 

Whilst the foregoing measures concerning configuration 
and reliability are a necessary framework, they are not in 
themselves sufficient. In particular, systematic errors 
creep in due to deficiencies in features such as the safety 
requirements specification and software faults. They 
need, therefore, to be supplemented by the third system 
element, overall quality. Overall quality is concerned 
essentially with high quality procedures and engineering. 
These should cover the quality of the specification, design, 
construction, testing, commissioning, operation, main¬ 
tenance and modification of the hardware and software. 

In determining the level of overall quality to be aimed for, 
regard should be paid to the level which would be appropriate 
for conventional safety integrity and to the level determined 
for the system elements of configuration and reliability. As a 
minimum, attention should be paid to (1) the quality of 
manufacture and (2) the quality of implementation. For over¬ 
all quality to match a higher level of reliability (3) each 
procedural and engineering aspect should be reviewed. 

Qualitative assessment checklists in support of such a 
review are included in PES 2 in Appendix 7. Three sets of 
checklists are given for (1) a control computer, (2) PLC and 
(3) CCF. The headings of these checklists are (1) safety 
requirements specification, (2) hardware specification, 
(3) hardware design, (4) hardware manufacture, (5) hard¬ 
ware test, (6) installation, (7) system test, (8) operations, 

(9) hardware maintenance and modification, (10) software 
specification, (11) software design, (12) software coding, 
(13) software test, (14) embedded software, (15) application 
programming and (16) software maintenance and 
modification. The applicable headings are: for a control 
computer, all except (14)-(15); for a PLC, all except 

(10) —(13); and for CCF, all. 


13.12.5 Design considerations 

PES 2 describes a number of design considerations which 
are particularly relevant to the safety integrity of PESs. 
The replacement of a control chain in which the sensor 
sends a signal directly to the actuator by one which 
involves analogue-to-digital (A/D) converters and PEs 
may reduce the safety integrity. Unless there is a positive 
contribution to safety by doing otherwise, the direct route 
between sensor and actuator should normally be retained. 
An additional signal may be taken from the sensor with 
suitable isolation to the PEs. 

For the execution of safety functions, it may be neces¬ 
sary to have a shorter sampling interval than is required for 
normal measurement and control functions. 

There should be hardware or software to ensure that on 
switch- on or on restart after a power failure, the resetting of 
the system is complete and the point in the program at 
which entry occurs is a safe one. Interruptions of the power 
supply should be catered for and should not lead to uni¬ 
dentified or unsafe conditions. 

As far as practicable, safety critical functions should be 
automatically monitored or should be self-checking. The 
emergency ESD systems should he proof checked at 
appropriate intervals to discover unrevealed failures. 

PES 2 also gives detailed guidance on the environmental 
aspects of PESs, particularly in respect of electrical inter¬ 
ference and of electrostatic sensitive devices. 

13.12.6 Software considerations 

The software for use in safety-related applications needs to 
be of high quality and PES 2 gives an account of some of the 
measures which may be taken to achieve this. These include: 

(1) safety requirement specification; 

(2) software specification; 

(3) software design, coding and test; 

(4) system test. 

They also include: 

(5) software modification procedures. 

For all these aspects, there should be 

(6) Formal documentation. 

PES 2 puts considerable emphasis on the safety require¬ 
ments specification, as already described. It also devotes a 
good deal of space to the control of software changes. 

A further account of software reliability is given in 
Section 13.13. 

13.12.7 Illustrative example 

PES 2 gives as an illustrative example part of the safety 
integrity assessment of a plant for the manufacture of the 
explosive pentaerythritol tetranitrate (PETN). Figure 13.23 
shows a schematic diagram of one of the nitrators. 

A particularly critical parameter is high temperature in 
the nitrator, the limit being 35°C. For this, protection is 
provided in the form of a dump valve, which opens to dump 
the reactor contents to a drowning tank. The conventional 
control and protection system for such a plant is a control 
system incorporating some protection features and a single 
dedicated protection system. 





Figure 13.23 A nitrator unit under control of a PSE (HSE, 1987b) (Courtesy of HM Stationery Office) 































CONTROL SYSTEM DESIGN 13/53 


In the design considered, the plant is controlled by a 
control computer which performs the basic control of the 
operating sequence. At each stage of the sequence the 
computer performs checks to ensure that the previous 
stage is complete and that the plant is in the correct state 
and ready to proceed to the next stage. 

On each of the critical parameters there are duplicate 
sensors. The signal from one sensor goes to the computer 
and that from the other to a PLC. The computer and the PLC 
operate their own relays in the appropriate interlock sys¬ 
tem. An attempt by the computer to take an action is 
inhibited if: (1) the PLC relay contact is not closed in 
agreement with the computer; or (2) the combination of 
permissives being sent to the computer is correct but indi¬ 
cates that the action is to be inhibited; or (3) the combina¬ 
tion of permissives being sent to the computer is 
incompatible with the inputs to the PLC. The latter occur¬ 
rence is assessed by the computer. Thus, the control of cri¬ 
tical parameters and sequences is by the computer 
monitored by the PLC, which is in turn monitored by the 
computer. 

For the critical parameter of high temperature in the 
nitrator, the computer and PLC act in effect as a 1/2 pro¬ 
tective system. If either detects a high temperature, it acts 
to open the dump valve on the reactor. 


A hazard analysis of the nitrator system was performed 
and a fault tree developed for the top event ‘Decomposition’, 
as shown in Figure 13.24(a). This event occurs if there is a 
demand in the form of high temperature and a failure of the 
top level of protection (‘protection fails’). The guide 
includes the further fault trees for the events Cl—C4 and 
B4-B8. 

Figure 13.24(b) shows one of these constituent fault 
trees, subtree B5 for the event ‘no dump signal’. This has 
several interesting features. The top event in the subtree 
will occur if both the computer and the PLC fail to send a 
trip signal. Among the causes for the computer failing to 
send this trip signal are various combinations of instru¬ 
ment failure, including CCF of all the instruments in one 
group, for example, resistance thermometers RT1 and RT2. 
In the tree the failures of RT1 and RT2 are regular random 
failures, whilst the failure ‘CCF of RTs’ is the CCF for this 
group. The separation of the CCF in this way both high¬ 
lights it as a specific event and assists in assigning to it a 
numerical value. 

Other CCFs occur higher up the subtree just beneath the 
top event. These are the CCFs of: (1) all three resistance 
thermometers, RT1 and RT2 on the computer and RTS on 
the PLC; (2) the hydraulic valves and (3) both the computer 
and the PLC. 



Figure 13.24 continued 
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Figure 13.24 Sections of fault tree for the top event ‘Decomposition’ for the nitrator unit shown in Figure 13.23 (HSE, 
1987b): (a) top section of fault tree; and (b) subtree for event B5 (Courtesy of HM Stationary Office) 


A safety integrity analysis of the system is given in 
which each of the three system elements (configuration, 
reliability and overall quality) are examined. For config¬ 
uration, a check is made against each of the three principles 
given in Section 13.12.2. In respect of criterion 1, the com¬ 
bined number of PES and non-PES systems is two, as in the 
conventional system, so this criterion is met. For criterion 2, 
failure of no single channel, computer or PLC, will cause 
loss of protection, so criterion 2 is met. For criterion 3, 
failure of no single set of software, on the computer or on 
the PLC, will cause loss of protection, so criterion 3 is met. 

For reliability, the fault tree is analysed to produce the 
cutsets and it is shown that the Boolean relation for the top 
event A1 is: 

A1 = DIO + Z + X(B6 + J13 + J14 + J15 + J16 + J18 + J20 
+ L1 + L2 + Y) + Y(D11 + D12) + (B1 + D1 + D2 
+ Dll + D12 + HI + H2) (J20 + B6) 

[13.21.1] 

The frequency of the top event A1 was then estimated by 
applying data on the frequency of failures and, for protec¬ 
tive features, by utilizing Equation 13.9.18 with data on 
proof test intervals. Table 13.27 shows the numerical values 
obtained for the events given in Equation 13.12.1. The 


frequency of the top event was found to be 8.8 x 10 _4 /year. 
This was based on a number of pessimistic assumptions 
and on this basis was deemed an acceptable frequency. 

For overall quality, it was considered necessary to 
examine not only the quality of manufacture and imple¬ 
mentation, but also the procedures and engineering. For 
this the checklists given in appendix 7 of PES 2 were used 
and the results obtained for each item in this example are 
shown in that appendix. This check led to consideration of 
the following modifications: (1) addition of software limits 
on programmable alarm and trip levels; and (2) provision of 
test signal injection and monitoring points, particularly on 
the resistance thermometers measuring high temperature 
in the nitrator. 


13.13 Software Engineering 

The use of various types of computer aid in process plant 
design and operation is now routine. The dependability of 
these aids is determined by the quality of the computer 
programs. The dependability of this software is therefore 
important and may be critical. This is especially the case in 
real-time, on-line computer-based systems. 

The dependability of software, particularly in SCS, is a 
major topic in software engineering and is beyond the 
scope of this book. However, it cannot be neglected, and 
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Table 13.27 Some results obtained in the estimation of the hazard rate of the nitrator shown in Figure 13.23 


(HSE, 1987b) (Courtesy of HM Stationery Office) 

Event 

Event description 

Failure rate 

Test 

Probability 

reference 


(failures/10 s h) 

interval 

of failure 





on demand 

DIO 

Common cause failure of resistance thermometers 

0.06 




RT1, RT2 and RT3 giving low output 




Z 

Common cause failure of computer and PLC 

Not quantified 



X 

Failure in a dangerous mode of control computer 

7.5 



B6 

Drain valve fails to open 



3.8 x 10“ 4 

J13 

Failure of resistance thermometer RT3 giving tow output 

2.0 

1 month 

7.3 x 10“ 4 

J14 

Temperature switch TSW1 fails to operate on high 

3.4 

1 month 

1.2 x 10“ 4 


temperature 




JX5 

Logic unit (PLC) input LUI1 failed; does not respond to 

1.0 

1 month 

3.7 x 10“ 4 


TSW1 




J16 

Valve V3 fails to open 



7.5 x 10“ 4 

J18 

Logic unit (PLC) output LUO 1 failed; does not 

1.0 

1 month 

3.7 x 10“ 4 


de-energize 




LI 

Drowning tank leaking 



Negligible 

L2 

Drowning tank drain valve opened 



1 x 10“ 3 

Y 

PLC failed in dangerous mode 

2.5 

1 month 

9.1 x 10“ 4 

Si 




5.7 x 10“ 3 

X-Ei 


0.042 



Y 

PLC failed in dangerous mode 

2.5 

1 month 

9.1 x 10 -4 

Dll 

Common cause failure of temperature transmitters TT1, 

0.06 




TT2 giving low output 




D12 

Common cause failure of control computer analogue 

0.03 




inputs All and A12 giving low reading 




£2 


0.09 



ye 2 


8.2 x 10“ 5 



B1 

PE impure 

Not quantified 



D1 

Feeder fails at high speed 

2.6 



D2 

Control computer analogue output A01 fails to high O/P 

1.0 



Dll 

Common cause failure of temperature transmitters 

0.06 




Tti,tt2 




D12 

Common cause failure of control computer analogue 

0.03 




inputs All, A12 




HI 

Hydraulic failure of agitator causing high speed 

Negligible 



H2 

Stirrer breaks from shaft 

Negligible 



£3 


3.7 



J20 

Common cause failure of hydraulic valves V2 and V3 

2.3 x 10“ 6 



B6 

Drain valve fails to open 

3.8 x 10“ 4 



£4 


3.8 x 10“ 4 



£ 3 - £4 


1.4 x 10“ 3 



Total 

(DIO + Z + XEj + YE 2 + E3E4) 

0.1 




therefore a brief description is given of some of the princi¬ 
pal issues of which engineers in the process industries 
should be aware. 

Accounts of software engineering and software relia¬ 
bility are given in Software Engineering (Bauer, 1975a), 
Software Reliability, Principles and Practice (Meyers, 1976), 
Quality Assurance for Computer Software (Dunn and 
Ullman, 1982), ProgramVerification Using ADA (McGettrick, 
1982), Software Engineering (Shooman, 1983), Software 
Defect Removal (Dunn, 1984), Program Construction and 
Verification (Backhouse, 1986), Systematic Software Devel¬ 
opment Using VDM (C.B. Jones, 1986), The Spine of Soft¬ 
ware: Designing Probably Correct Software - Theory and 
Practice (Baber, 1987), Achieving Safety and Reliability with 
Computer Systems (Daniels, 1987), The Craft of Software 


Engineering (Macro and Buxton, 1987), Software Reliability 
(Littlewood, 1987b), Software Reliability (Musa et al., 1987), 
Handbook of Software Quality Assurance (Schulmeyer and 
MacManus, 1987), Software Diversity in Computerised 
Control Systems (Voges, 1987), Managing the Software 
Process (Humphrey, 1989), High Integrity Software (Sennett, 
1989), Software Engineering (Somerville, 1989), Case 
Studies in Systematic Software Development (C.B. Jones 
and Shaw, 1990), Deriving Programs from Specifica¬ 
tions (C. Morgan, 1990), Software Quality and Reliability 
(Ince, 1991a), Software Engineers Reference Book (McDermid, 
1991), Developing Safety Systems: A Guide Using ADA 
(Pyle, 1991), Reliability in Instrumentation and Control 
(Cluley, 1993) and Safety Aspects of Computer Control 
(P. Bennett, 1993). 
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13.13.1 Software dependability 

The software provided should be dependable in serving the 
purposes of the system. The dependability of the software 
has two aspects: (1) specification and (2) reliability. The 
requirements of the system need to be defined and then 
converted into a specification. Both the formulation of the 
requirements and the conversion into a specification are 
critical features. It is then necessary to ensure that the 
software conforms with the specification to a high degree 
of reliability. One of the recurring themes in discussions of 
software dependability is that reliability alone is not 
enough. If the specification is defective, the software will 
be so too, however high its reliability. 

13.13.2 Some software problems 

There are some persistent problems associated with soft¬ 
ware. A review of these problems by Bauer (1975b) gives 
the following tendencies: (1) software is produced in a 
relatively amateurish and undisciplined way, (2) it is devel¬ 
oped in the research environment by tinkering or in 
industry by a human wave approach, (3) it is unreliable and 
needs permanent maintenance, (4) it is messy, opaque and 
difficult to modify or extend and (5) it arrives later, costs 
more and performs less well than expected. 

13.13.3 Software error rates 

There are a number of rules-of-thumb used in the software 
industry for the error rates which occur in programming. 
An account is given by Cluley (1993). For software, an 
important distinction is that made between a fault and 
failure. A fault is an error in the program. A failure occurs 
when the program is run and produces an incorrect result 
for software reasons. It is a common occurrence that a pro¬ 
gram which contains a fault may be run many times before 
a failure occurs. 

A rule-of-thumb widely used in the industry is that a 
program typically contains 1 fault per 1000 instructions. 
This is supported by data given by Musa et al. (1987) to the 
effect shown that for programs of some 100,000 lines of 
source code, when, first operational, the incidence of faults 
varies between 1.4 and 3.9 faults per 1000 lines. For pro- 
gramswhenfirstwritten,thenumberoffaultsismuchhigher. 

Faults may be corrected, but correction is not always 
straightforward and the potential exists to introduce other 
faults. The data of Musa et al. indicate that between 1 and 6 
new faults are introduced for every 100 faults corrected. 

Musa et al. also quote data for the number of failures 
per fault for a single run of a program. The average value 
of this ratio is 4.2 x 10 -7 failures/fault. In other words, this 
implies that in order to detect a fault by triggering a failure, 
it is necessary on average to run a program 2.4 x 10 -6 times. 

In real-time applications of SCS, another metric of con¬ 
cern is the failure intensity, or frequency of failure per unit 
time, or per mission. For passenger aircraft, an error rate 
used has been 10~ 9 per mission, where the mission is a 
flight of 1-10 h. 

The progress of a debugging task may be monitored by 
‘seeding’ the program with deliberate errors which are not 
known to the team engaged in the work. Thus, if 35 faults 
have been introduced deliberately and 25 genuine and 
7 deliberate faults are found, the estimated number of 
original faults is 125 (= 25 x 35/7). 

There exist reliability growth models for software which 
may be used by management to estimate the time necessary 
to debug a program. One such model is described by Cluley. 


13.13.4 Software management 

Management commitment is crucial in achieving depend¬ 
ability in software, as in other fields. Management needs to 
create a culture which gives priority to, and so ensures, 
dependability of the software. The management of a soft¬ 
ware project includes the following aspects: 

(1) project management; 

(2) software quality assurance (QA); 

(3) software standards; 

(4) system requirements and software specifications; 

(5) software development; 

(6) software documentation; 

(7) software verification; 

(8) software modification control; 

(9) software validation and testing; 

(10) software maintenance. 

Accounts of project management are given by Tsichritzis 
(1975a) and P.A.V. Hall (1991). The other aspects are con¬ 
sidered below. 

13.13.5 Software quality assurance 

There should by a system of QA for the software. The extent 
of this system will depend on the scale of the operation, and 
in some cases will be governed by standards and/or user 
requirements, but as a minimum, there should be a formal 
system and an independent QA function. Some of the 
methods of assuring quality are described below. 

13.13.6 Software standards 

Use has long been made in software development of the 
traditional quality standards such as BS 5750 and ISO 
9000, but there are an increasing number of standards 
specific to software. Accounts of developments in these 
standards are given by P. Bennett (1991a), the CCPS 
(1993/14) and Rata (1993). In the United Kingdom, stan¬ 
dards and guidance include: BS 5887:1980 Code of Practice 
for Testing of Computer-Based Systems, BS 6238:1982 Code 
of Practice for Performance Monitoring of Computer-based 
Systems, BS 5515:1984 Code of Practice for Documentation 
of Computer-based Systems and BS 6719: 1986 Guide to 
Specifying User Requirements for a Computer-based Sys¬ 
tems; Programmable Electronic Systems in Safety Related 
Applications (HSE, 1987b) (the HSE PES Guide)-, the Minis¬ 
try of Defence (MoD) Interim Defence Standards 0055: 
1989 Requirements for the Procurement of Safety Critical 
Software in Defence Equipment (MoD, 1989c) and 0056: 
1989 Requirements for the Analysis of Safety Critical Hazards 
(MoD, 1989b). 

Relevant US standards are IEEE 1058-1987 Software 
Project Management Plans, IEEE 1012-1987 Software Veri¬ 
fication and Validation Plans, IEEE 1028-1988 Software 
Reviews and Audits, IEEE 730-1989 Software Quality 
Assurance Plans and IEEE 1063-1989 Software User Docu¬ 
mentation, as well as the guides IEEE 830-1984 Guide to 
Software Requirement Specifications and IEEE 1042-1987 
Guide to Software Configuration Management. An inter¬ 
national standard is IEC SC65A WG9: 1991 Software for 
Computers in the Application of Industrial Safety-related 
Systems. 

The PES Guide has been described in Section 13.12. 
MOD 0055 is in three main sections. The first deals with 
the project management, the parties involved and the doc¬ 
umentation; the second with the software engineering; and 
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the third relates the requirements of these two sections to 
the life cycle of the project. 

MOD 0056 gives requirements for the hazard analysis 
ofSCS. 

There are also two IEC working groups, WG9 and WGIO, 
which deal with software for safety-related applications 
and with generic safety aspects, respectively. WG9 is 
responsible for IEC SG65A. 

13.13.7 Software development 

The process of software development is generally descri¬ 
bed broadly in the following terms: 

(1) requirements specification; 

(2) system specification; 

(3) program specification; 

(4) program design; 

(5) program production; 

(6) program verification; 

(7) program validation and testing; 

(8) system integration and testing. 

In software development, two terms that are widely 
used are ‘Verification’ and ‘Validation’ (V&V). Verification 
is the process of determining whether the product of 
a given phase of development meets the requirements 
established in the previous phase. Validation is the pro¬ 
cess of evaluating software at the end of the software 
development process to ensure compliance with software 
requirements. 

It is good practice to verify the software produced in each 
phase of the project before proceeding to the next phase. 
Another aspect of good practice is the production of good 
documentation. 

One method of software development which is found 
useful in many cases is prototyping. There is more than one 
kind of prototype. An account of prototyping is given by 
Ince (1991b). 

13.13.8 Software specification 

The conversion of the user’s requirements into an unam¬ 
biguous specification for the system and then for the soft¬ 
ware is one of the most important, but difficult, tasks in 
software development. There is a high degree of formality 
in the approach taken to the specification of the software 
and a number of formal methods have been developed. An 
account is given by Webb (1991). Use is made of mathema¬ 
tically based languages such as VDM, Z and OBT and of 
mathematically based methodologies such as JSD, EPOS 
and Yourdan Structural Development. For many SCS, such 
formal methods are a requirement 

13.13.9 Software design, production and verification 

There are a number of basic principles governing software 
design. They include (1) modularity and (2) hierarchy. 

The computer program required for even a moderately 
sized project may be large. A large program needs to be 
subdivided into manageable parts, or modules. Whilst 
subdivision into modules is necessary, problems arise if the 
interfaces between modules are poorly defined. The speci¬ 
fication of the interfaces between modules requires careful 
attention. In some applications, it may be possible to exploit 
the use of verified modules and of a module library. 

The program will generally have a hierarchical struc¬ 
ture, with the higher level modules controlling the lower 
level ones. Structured programming involves the use of a 


hierarchy of conceptual layers and provides a formal 
approach to the creation of hierarchical software. 

As already mentioned, verification of the programs 
produced at each phase should not be relegated until the 
end but should be performed before proceeding to the 
next phase. 

13.13.10 Software modification control 

A major software project will generally be subject to mod¬ 
ifications. Demands to make modifications may occur at 
any level, starting with the system requirements. There 
should be a system for the control of such modifications. 
The ease with which such a system can be created and 
operated depends very much on the quality of the software 
design and documentation. 

13.13.11 Software reliability 

The point has already been made that ‘software reliability’ 
is not the same as ‘software dependability’. It is never¬ 
theless an essential feature. Accounts of software relia¬ 
bility are given in the quoted texts and by Thichritzis 
(1975b). Some aspects of software reliability are: 

(1) programming language; 

(2) programming practice; 

(3) software design; 

(4) measurement of reliability; 

(5) assessment of reliability. 

The programming language used can influence the relia¬ 
bility of the software produced. A number of examples of 
differences between languages in this respect are given by 
Tsichritzis. 

Likewise, the programming style can affect reliability: 
One aspect is the naming of items. It is usually recommended 
that semantic naming be practised in which the name is a 
meaningful one. Another aspect is the length of sections of 
the program. Here the recommendation is to keep the veri¬ 
fication length short. A practice which tends to increase the 
verification length is the use of GO TO statements. 

One aspect of good design practice which contributes to 
software reliability is a strong structure. Another is trans¬ 
parency of the programs. A third is well-defined interfaces 
between modules. 

In principle, improvement of reliability depends on the 
ability to measure it. Traditionally, metrics have been con¬ 
cerned primarily with aspects of performance such as 
execution time rather than with reliability Measures for 
reliability are discussed by Tsichritzis. Software protection 
contributes to reliability by providing barriers to the trans¬ 
mission of errors between different features of the system. 

13.13.12 Software testing and debugging 

The traditional way of dealing with errors in a program is 
testing and debugging. An account of this aspect is given 
by Poole (1975). Debugging and testing are greatly facili¬ 
tated if they are planned for in the design phase. Another 
feature which can make a major contribution is doc¬ 
umentation written with this requirement in mind. 

Debugging tends to be a difficult task and various aids 
are available. One is the system dump, activated by a call in, 
or by catastrophic failure of, the program. Another is the 
snapshot, similar to a dump, but occurring during execu¬ 
tion. The trace mode of program execution causes an 
output to be made for each statement in the section traced. 
The traceback facility shows how control reached the point 
in the program where the error has occurred. 



3/58 CONTROL SYSTEM DESIGN 


It is helpful to debugging if key quantities in the program 
are made parameters which the user can alter. This permits 
a fuller exploration of the program characteristics. Debug¬ 
ging is also assisted by the incorporation of debugging code 
in the program. The use of such code is discussed by Poole. 

Testing is assisted by subdivision of the program into 
modules. It is not, however, a straightforward matter to 
devise testbeds and test strategies for modules. 

13.13.13 Software protection 

Software protection may be regarded as an aspect of soft¬ 
ware reliability. The aim of software protection is to guard 
against error and malice. There are a variety of items, such 
as files and programs, which need to be protected and a 
corresponding variety of means of achieving protection. 

Protection establishes barriers to the transmission of an 
error between one part of the system and another. It there¬ 
fore contributes to reliability by limiting the effect of an 
error. Protection contributes to reliability in another way. 
The occurrence of an error usually results in an attempt to 
violate a protection barrier. This can be used as a means of 
error detection. 

Closely related to software protection is software secur¬ 
ity. The aim of software security is to guard against unau¬ 
thorized use. 

13.13.14 Software assessment 

There are a number of methods available for the assess¬ 
ment of the software reliability. Accounts of these techni¬ 
ques are given in the texts mentioned and by Tsichritzis 
(1975b), Fergus etal. (1991), Webb (1991) and M.R. Woodward 
(1991). Three main approaches are: 

(1) auditing; 

(2) static analysis; 

(3) dynamic analysis. 

Auditing particularly addresses aspects such as the QA 
and standards, the comprehensibility and readability of 
the program, and the documentation. 

Static analysis involves analysing the program without 
running it. Some methods which may be used include: 

(1) semantic checking; 

(2) control flow analysis; 

(3) data use analysis; 

(4) information flow analysis; 

(5) semantic analysis; 

(6) compliance analysis. 

The program compiler is generally utilized to perform 
checks on statements in the program, or semantic checks. 
The power of this facility depends on the programming 
language used. 

The control flow of the program may be analysed to 
reveal its structure and to detect undesirable features such 
as multiple starts, multiple ends, unreachable code, etc. 
One method of doing this is to represent the program as a 
graph of nodes joined by arcs, where initially each node 
represents a statement. A process of reduction is then 
applied whereby nodes are successively eliminated to 
reveal the underlying structure. 

The data use of the program may be analysed to identify 
incorrect uses of data such as attempts to read data which 
are not available or failure to utilize data which have been 
generated. 


The information flow in the program may be analysed to 
identifythedependenceofoutputvariablesoninputvariables. 

Semantic analysis determines the mathematical relation¬ 
ship between the input and output variables for each seman¬ 
tically feasible path. It can be used to determine the outputs 
for the whole input space, including unexpected inputs. 

Compliance analysis compares the program with the 
specification and reveals discrepancies. The specification 
is expressed as a statement in the predicate calculus of the 
pre-conditions and post-conditions to be satisfied by the 
program. For a complex program, assertions may be pro¬ 
vided about the functionality of the program for inter¬ 
mediate stages. 

Use may also be made of diagrams showing the logic of 
the program, such as fault trees, event trees, Petri nets, and 
state transition diagrams, as described by P. Bennett 
(1991a). The application of fault tree analysis to programs 
has been developed by Leveson and co-workers (Leveson 
and Harvey, 1983; Leveson and Stolzy, 1983). Figure 13.25 
shows the analysis of an IF ... THEN ... ELSE statement 
by fault tree, Petri net and event tree methods. 

Fault trees and event trees are described in Chapter 9, 
but the Petri net representation requires brief explanation. 
A Peiri net consists of the quintuple C: 

C = (P, T, 1,0, u) 13.13.1' 

where P is a place, T a transition, I an input, 0 an output 
and u an initial condition. Initialization of a Petri net is 
called ‘marking’ it. A transition is said to ‘fire’. Assigning a 
value is referred to as ‘passing’ a ‘token’ to a place. 

Software tools have been developed to assist in the static 
analysis of software. Some of the tools available are 
described by Fergus et al. (1991). They include MALPAS, 
SPADE and the LDRA testbed. An account of MALPAS, 
which includes control flow, data use, information flow, 
semantic and compliance analysers, is given by Webb (1991). 

Dynamic analysis, or testing, involves running the pro¬ 
gram and analysing the results. The basic technique is to 
force situations where errors are revealed. There are two 
main approaches. One is ‘black box’ testing and the other 
‘white box’ testing.The distinction is that the latter relies on 
knowledge of the structure of the program, whilst the for¬ 
mer has no such knowledge but tests the performance 
against the requirements and relies essentially on knowl¬ 
edge of the application domain. Dynamic testing may be 
control flow or data flow driven. A discussion is given by 
M.R. Woodward (1991). 

One aim of testing is to remove whole classes of error. 
A technique for doing this is mutation testing. An account 
is given by Woodward. The basic concept is to make a small 
change to the program in the expectation that this will 
make an observable difference in its performance. 

It should be appreciated that good results from a valida¬ 
tion test do not necessarily indicate high reliability. 

This is so only if the exercise of the control path in the vali¬ 
dation test corresponds to that which will occur in practice. 

The level of assessment should be matched to the appli¬ 
cation. This aspect is discussed by P. Bennett (1991a). He 
lists five classes of assessment: 

0 System overview. 

1 System structure analysis. 

2 System hazard analysis. 

3 Rigorous analysis. 

4 Formal mathematical methods. 
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(a) 



(b) 



(c) 


Figure 13.25 Some representations used in error analysis of an IF... THEN... ELSE statement in a computer 
program (after P. Bennett, 1991a): (a) fault tree; (b) Petri net and (c) event tree (Courtesy of Butterworth-Heinemann) 


13.13.15 Software correctness 

The use of formal methods to prove the correctness of the 
program has already been mentioned. This is a major area 
of research. There are differing views as to the feasibility of 
such proof. 


The methods used to prove correctness may be informal 
or formal. The informal method derives from the work of 
Naur (1966), Floyd (1967) and London (1968), following von 
Neumann. Points are selected on all the control paths at 
which assertions can be made about the variables. Then if 
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A is an assertion at one point in a control path and B an 
assertion at the following point, the approach taken is to 
prove that the code is such that if A is true, B is true. If this 
verification is performed for all adjacent pairs of assertions 
and for all control paths, the partial correctness of the pro¬ 
gram is proved. Proof of complete correctness requires a 
separate proof of halting. It tends to be a substantial task, 
however, to develop the assertions and to perform the 
proofs. 

The formal method of proving correctness is based on 
the demonstration by Floyd (1967) that proof of par¬ 
tial correctness is equivalent to proving corresponding 
theorems in the first order-predicate calculus. Manna 
and Pnueli (1969) extended such proof to include halt¬ 
ing. The approach taken is to formulate the problem so 
that it is possible to apply automatic theorem-proving 
techniques. 

13.13.16 Software maintenance 

Software generally requires a good deal of maintenance. 
This is particularly true of safety-related software, espe¬ 
cially real-time software. The project management should 
make suitable provisions for software maintenance. The 
quality of the software, and the associated documentation, 
largely determines the ease of maintenance. 

13.13.17 Software for real-time systems 

Real-time, on-line systems controlling process plants place 
even more stringent demands on software. An account of 
the software aspects is given by Fergus et al. (1991). 

The characteristics of real-time systems have been des¬ 
cribed by Quirk (1985). In such systems the demands 
are driven in timing and sequencing by the real world, 
they may occur in parallel and they may be unexpected and 
even conflicting. The software must satisfy time con¬ 
straints and it must continue to operate. Moreover, the 
software is part of a total system and is difficult to validate 
in isolation. 

Work on the methods of describing the behaviour of real¬ 
time systems typically deals with issues such as con¬ 
currency and synchronization, resource scheduling, and 
liveness and deadlock. 

The dynamic testing of a real-time program may be car¬ 
ried out using an off-line host machine. Such testing is 
described by Fergus et al. 

13.13.18 Safety critical systems 

If the consequences of failure of a real-time computer 
system are sufficiently serious, the system is a SCS. SCSs 
are of particular concern in the military, aerospace and 
nuclear fields, but are of growing importance in the process 
industries. 

SCSs are treated in Safety Aspects of Computer Control 
(P. Bennett, 1993). Other accounts are given in the texts 
cited at the start of this section and by P. Bennett (1991a,b), 
Bologna (1993), Ehrenberger (1993), Malcolm (1993), 
McDermid (1993) and Pyle (1993). Standards are particu¬ 
larly important for SCSs. Some relevant standards and 
guidance are detailed in Section 13.13.6. Practical guidance 
is available in the HSE PES Guidelines and the CCPS Safe 
Automation Guidelines, described in Sections 13.12 and 
13.15, respectively 

There are a number of real-time languages and environ¬ 
ments which have special safety-related features. One such 
is ADA. Accounts are given in Program Verification Using 
ADA (McGettrick 1982), ADA for Specification and Design 


(Goldsack, 1985), ADA in Industry (Heilbrunner, 1988) and 
Developing Safety Systems: A Guide Using ADA (Pyle, 1991). 
Pyle (1993) discusses the guidance given in the HES PSE 
Guide in the context of ADA. 

Where the process is dependent on a computer or PES, 
methods are required to identify the associated hazards. 
The application of hazop to process computers (chazop) is 
described in Chapter 8. 

13.14 Safety-related Instrument Systems 

It will be apparent from the foregoing that it is necessary to 
adopt a systematic approach to the whole system of instru¬ 
mentation, control and protection. 

13.14.1 EEMUA Safety-related Instrument System Guide 

A scheme for this is described in Safety-related Instrument 
Systems for the Process Industries by the EEMUA (1989 
Publ. 160) (the EEMUA Safety-related Instrument System 
Guide). This document complements the HSE PES Guide by 
proving additional guidance specific to the process indus¬ 
tries. The background to, and an account of, the scheme is 
given by W.S. Black (1989). 

The starting point is the practice in conventional sys¬ 
tems of separating the protective functions from the control 
functions. Whereas in such systems control functions may 
be performed by a PES, it has been almost universal prac¬ 
tice to use hardwired systems for protective functions. 

13.14.2 Categories of system 

Four categories of system are defined: 

0 Self-acting devices. 

1 Non-self-acting devices. 

2 System which protects against damage to environment. 

3 System which ensures reliable production and keeps 
plant operation with operational limits. 

These categories are amplified in Table 13.28 

13.14.3 Categorization process 

Assignment of systems to these categories should be made 
on the basis of a review, involving consideration of the plant 
line by line. A schedule should be prepared of all the fail¬ 
ures which result in excursions outside normal process 
operating limits. The process conditions after failure 
should be determined. Cases where the process conditions 
are unacceptable with respect to safety should be identi¬ 
fied. The option of making a modification to eliminate the 
unacceptable condition should be considered. If it is deci¬ 
ded to rely on the instrument system to prevent the unac¬ 
ceptable condition, the system should be listed together 
with the potential hazard. 

The review may be part of a hazop study or it may be sep¬ 
arate. A separate review has the advantage that any rethink¬ 
ing can be done outside the hazop. If a separate review is 
undertaken, the results shouldbe considered in thehazop. 

13.14.4 Selection of systems 

In selecting a system for a Category 1, 2 or 3 duty, con¬ 
sideration should be given as to whether the system should 
be programmable or non-programmable. The IEE classifi¬ 
cation of programmable systems recognizes three types: 

(1) fixed program system; 

(2) limited variability system; 

(3) full variability system. 
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Table 13.28 Categories of control and protective system given in the EEMUA Guide (after EEMUA, 1989) 
(Courtesy of the Engineering Equipment Manufacturers and Users Association) 


Category 

Type of system 

Purpose 

Consequence of failure 

Requirements 

0 a 

Self-acting device 
such as PRV, BD, or 
containment 

Safety 

Hazard to persons 

Relevant BSs 

1” 

Instrument safety 
system 

Safety 

Hazards to persons 

PES Guide: 

EEMUA Guide 

2 C 

Protective system 

Economic or 
environmental 

Loss of production or harm to 
environment 

Reliability comparable 
to conventional 
analogue systems so 
that demands on 
protective devices 
are limited 

3 C 

Control system 

Operational 

Loss of production and possible 
demand on category 0,1, of 2 
system 



a Where Category 0 devices are installed and their capability and integrity alone are adequate to ensure safety, Category 1 systems will be 
unnecessary. 

b Where mechanical devices cannot be used or are not adequate alone to ensure safety, category 1 systems will be necessary. 
c If programmable systems are used for Category 2 or 3 systems, a full assessment of the system according to the PES Guide or the EEMUA Guide 
will be unnecessary. 


Table 13.29 Selection scheme for control and protective systems given in EEMUA Guide (EEMUA, 1989) 
(Courtesy of the Engineering Equipment Manufacturers and Users Association) 


System 

Selfacting 

Non-programmable 

Fixed program 

Limited variability 

Full variability 

Ultimate safety, Category 0 

Preferred 

- 

- 

- 

- 

Ultimate safety, Category 1 

- 

Preferred 

Acceptable 

Acceptable 

Avoid 

Protection, Category 2 

- 

Preferred 

Preferred 

Acceptable 

Avoid 

Regulatory, Category 3 

- 

Acceptable 

Acceptable 

Preferred 

Avoid 

Supervisory control 

- 



Preferred 

Acceptable 

Information 

- 

- 

- 

Acceptable 

Preferred 


Examples of these three types are a three-term controller 
which emulates its analogue equivalent, a PLC and a 
minicomputer. Table 13.29 gives the selection scheme pre¬ 
sented in the EEMUA Guide. 

13.14.5 Review of systems 

Once the systems have been selected, the arrangements 
should be subjected to a review by a team including process 
engineers, control engineers and operations managers. It 
should be established that the requirements given in the 
PES Guide for configuration, reliability and quality are met 
The EEMUA Guide ref ers to the checklists in the PES Guide 
and gives its own checklists. 

13.14.6 Implementation of systems 

A Category 0 or 1 system should have the capability and 
reliability to deal with the foreseeable failure modes and 
failure frequency of the plant itself and of the Category 2 
and 3 systems. 

Where a Category 1 system is used, the system should be 
engineered in accordance with the PES Guide and the 
EEMUA Guide. The requirements in these documents 
relating to hardware, quality and reliability are applicable 
both to programmable and non-programmable systems. For 


the latter, however, the requirements relating to software 
are not applicable. 

Failure of a Category 2 or 3 system may put a demand on 
a Category 0 or 1 system. Where a Category 0 or 1 system is 
used which is based on a PES, the failure rate should not 
exceed that of the equivalent conventional system. 


13.14.7 Failures in systems 

The EEMUA Guide gives an account of, and guidance on, 
the failures which occur in conventional and program¬ 
mable systems. In conventional systems, a single output 
failure is usually to the zero or low states. This is the mode 
of failure on loss of air or power. Systems are designed so 
that the plant goes to a safe state on this failure mode. In 
such systems the usual assumption is that multiple failures 
are in the zero or low mode. This is commonly the basis on 
which relief capacity is sized. 

In programmable systems, a single output failure will be 
due to failure in an input or output channel. The failure rate 
to the high state is unlikely to exceed that in a conventional 
system. There is potential, however, in a programmable 
system for multiple failures to the high state due to ran¬ 
dom hardware failure or systematic software failure. An 
assessment should be made of the system to ensure that the 
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probability of multiple failure to the high state due to ran¬ 
dom hardware failure is low. 

Failures of software may be failures of system software 
or of applications software. It is rare for system software to 
be fault free, although a mature system can be expected to 
contain fewer faults than a new one. The system software 
for any control system to be used in a safety-related appli¬ 
cation should be evaluated.The alternative means given are 
formal evaluation and user experience. 

Failure in the applications software should be minimized 
by good software engineering. The EEMUA Guide gives 
guidance on software development and testing. 


13.14.8 Loop allocation strategies 

There are two basic strategies for loop allocation: (1) out¬ 
puts distributed and (2) outputs grouped. The principles 
are that, in the first case, the outputs from a single PES unit 
are distributed around a number of process units, whereas 
in the second they are concentrated at a single process unit 
or at least at a minimum number of units. 

If the outputs are distributed, loops which may fail 
simultaneously are not concentrated on the same process 
unit. The resultant problem at any given unit will therefore 
be less severe. In particular, this policy allows the pressure 
relief system to be designed for a single failure on each 
unit. On the other hand, there may then be a quite large 
number of process units with some degree of problem. 
Alternatively, the outputs may be grouped. The problem of 
multiple failures of loops is then concentrated on one pro¬ 
cess unit. 

The choice between these strategies depends on the 
characteristics of the process and the probability of multi¬ 
ple failure. A distributed strategy may be suitable for a 
simple, slow-responding process, but a grouped strategy 
for a fast-acting process. With a well-designed instrument 
system, particularly with redundancy, the probability of 
multiple failure may be small compared with failures of 
the process unit for other causes. 


13.15 COPS Safe Automation Guidelines 

13.15.1 Guidelines for Safe Automation of Chemical 
Processes 

The safety aspects of process control systems are the sub¬ 
ject of Guidelines for Safe Automation of Chemical Processes 
(CCPS, 1993/14) (the CCPS SafeAutomation Guidelines).The 
Safe Automation Guidelines cover the safety aspects of the 
whole process control system, including the basic process 
control system (BPCS), the safety interlock system (SIS) 
and the human operator. Two types of interlock are dis¬ 
tinguished: (1) failure interlocks and (2) permissive inter¬ 
locks. The distinction corresponds to that used here 
between trips and interlocks proper. 

The headings of the Guidelines are: (1) overview; (2) the 
place of automation in chemical plant safety - a design 
philosophy; (3) techniques for evaluating integrity of pro¬ 
cess control systems; (4) safety considerations in the selec¬ 
tion and design of BPCSs; (5) safety considerations in 
the selection and design of SISs; (6) administrative 
controls to ensure control system integrity; (7) an example 
involving a batch polymerization reactor and (8) the path 
forward. Appendices deal with SIS technologies, separa¬ 
tion of the BPCS and SIS, watchdog timer circuits, com¬ 
munications, sensorfail-safeconsiderations,SISequipment 


selection, PES failure modes and factory acceptance test 
guidelines. 

The Guidelines are concerned particularly with PES- 
based SISs. As described earlier, at least until recently, the 
normal approach has been to use for the safety interlock 
(SI) a hardwired system separate from the rest of the con¬ 
trol system, whether or not this be computer based. The 
Guidelines describe a design philosophy in which the sys¬ 
tem of choice for an SIS is a PES-based system. In large part 
the guidance is concerned with ensuring that a PES-based 
system has the availability and reliability required for 
this duty. 

This section gives an outline of the Guidelines. The latter 
contain a wealth of practical guidance on the various topics 
which are touched on here. 

13.15.2 Basic design method 

The design requirements for the SIS arise out of the 
process hazard analysis (PHA). The Guidelines require 
that the SIS should be designed by a formal method, but 
are flexible with respect to the method used. They give a 
basic design method, which includes what they term a 
‘qualitative approach to specification’ of the Sis required 
but which allows for the use of alternative quantitative 
approaches. 

The basic design method given in the Guidelines is based 
on the following features: 

(1) independent protection layers; 

(2) process risk ranking; 

(3) SI integrity level specification; 

(4) SI integrity level implementation. 

This philosophy is outlined in Table 13.30 Section A of the 
table lists the features which are treated as layers of pro¬ 
tection and Section B gives the criteria for a layer or com¬ 
bination of layers to constitute an independent layer of 
protection (IPL). An IPL protects against a particular type 
of hazardous event. The event severity and event likelihood 
are obtained from the process hazard analysis as shown in 
Section C. The scheme given in Section D indicates the 
integrity level (IL) required for any SI. There are three 
integrity levels: Levels 1, 2 and 3 (IL1, IL2 and IL3). 
As stated in the footnotes, the number of IPLs to be used 
in the table is the total number of IPLs, including the SI 
being classified. The implementation of a SIS of specified 
integrity level is indicated in Section E and an example 
of the determination of the integrity level of a SI is given 
in Section F. 

13.15.3 Evaluation of control system integrity 

The Guidelines review the various safety and integrity 
evaluation techniques applicable to process control sys¬ 
tems, including under the qualitative techniques operating 
experience, standards and codes, design guidelines, 
checklists, What-If analysis, failure modes and effects 
analysis (FMEA) and hazop and under the quantitative 
techniques trip capability analysis, fault tree analysis, 
event tree analysis, reliability block diagrams, Markov 
models, Monte Carlo simulation, non-destructive fault 
insertion testing and QRA. 

The BPCS and SIS should both be certified, either by 
self-certification or third party certification. For PES devi¬ 
ces, three maturity levels are recognized: user-approved 
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Table 13.30 Basic design philosophy of the safety interlock system in the CCPS safe Automation Guidelines 
(CCPS, 1993/14) (courtesy of the American Institute of Chemical Engineers) 


A Layers of protection 


1. Process design 

2. Basic controls, process alarms, operator supervision 

3. Critical alarms, opearator supervision and manual intervention 

4. Automatic SIS 

5. Physical protection (relief devices) 

6. Physical protection (containment dikes) 

7. Plant emergency response 

8. Community emergency response 

B Criteria for independent layers of protection 


The criteria for a protection layer or a combination of protection layers to qualify as an independent protection layer 
(IPL) are: 

1. The protection provided reduces the indentified risk by large amount that is, at least by a 100 -fold reduction 

2. The protective function is provided with a high degree of availability - 0.99 or greater 

3. The protection has the following characteristics: 

- Specificity. An IPL is designed solely to prevent or to mitigate the consequences of one potentially hazardous event 
(e.g. a runaway reaction, release of toxic material, a loss of containment, or a fire). Multiple causes may lead to the same 
hazardous event and therefore multiple event scenarios may initiate action of one IPL 

- Independence. An IPL is indepentent of the other protection layers associated with the identified danger 

- Dependability. It can be counted on to do what it was designed to do. Both random and systematic failure modes are 
addressed in the design 

- Auditability. It is designed to facilitate regular validation of the protective functions. Functional testing and 
maitenance of the safety system is necessary 


C Process risk ranking 


An event is assigned a severity and a likelihood: 
Event severity 


Serious incident 


Extensive incident 
Event likelihood 


of the event with potential for broader consequences if 


Impact initially limited to local 
corrective action is not taken. 

One that could cause: 

- any serious injury or fatality on-site or off-site 

- property damage of $1 million off-site or $5 million on-site 
One that is five more times worse than a serious incident 

A failure or series of failures with a very low probability of occurrence within the expected 
lifetime of the plant (<10 _4 failures/year). Exambles: (1) three or more simultaneous 
instrument, valve or human failures; (2) spontaneous failure of single tanks or process 
vessels 

A failure or series of failures with a very low probability of occurrence within the expected 
lifetime of the plant (10“ 4 to 10~ 2 failures/year). Examples: (1) dual instrument failures; 

(2) combination of instrument failures and operator errors; (3) single failures of small 
process lines or fittings 

A failure can reasonably be expected to occur within the expected lifetime of the plant 
(>10 _z failures/year). Examples: (1) process leaks; (2) single instrument or valve failures; 

(3) human errors that could result in material releases 


The event is designated low risk for any of the following combinations: (1) severity low, likelihood low; (2) severity serious, 
likelihood low; (3) severity low, likelihood moderate. It is designated high risk for any of the following combinations 
(1) severity extensive, likelihood high; (2) severity serious, likelihood high; (3) severity extensive.Likelihood moderate. It is 
designated moderate risk for the other three combinations. 


D Safety interlock integrity level specification 3 


Event severity 




Minor 



Serious 



Extensive 


Event likelihood 

Low 

Moderate 

High 

Low 

Moderate 

High 

Low 

Moderate 

High 

No. of IPLs b 3 

(5) 

(5) 

(5) 

(5) 

(5) 

(5) 

(5) 

1 

1 

2 

(5) 

(5) 


(5) 

1 

2 


2 

3(2) 

1 

1 

1 

3 

1 

2 

3(2) 

3(2) 

3(2) 

3(1) 


a The values in the table without brackets refer to the integrity level (IL) required; the values inbrackets refer to the number of the note given below. 
b Total number of IPLs, including the safety interlock being classified. 
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Table 13.30 (continued) 

Notes: 

1. One Level 3 safety interlock does not provide sufficient risk reduction at this risk level. Additional PHA modifications are required. 

2. One Level 3 safety interlock may not provide sufficient risk reduction at this risk level. Additional PHA review is required. 

3. Event likelihood - likelihood that the hazardous event occurs without any of the IPLs in service (i.e. the frequency of demand). 

4. Event likelihood and total number of IPLs are defined as part of the PHA team work. 

5. SIS IPL is probably not needed. 

Integrity level availability 


Availability (%) 


Level 1 about 99 

Level 2 99-99.9 

Level 3 up to 99.9- 99.99 


E Safety interlock integrity level implementation 


Integrity level (IL) Minimum interlock design structure 


1 Non-redundant: best single path design 

2 Partially redundant: redundant independent paths for elements with lower availability 

3 Totally redundant: redundant, independent paths for total interlock system. Diversity should be 
considered and used where appropriate. A single fault of an SIS component is highly unlikely to 
result in a loss of process protection 


F Illustrative example 

Event severity 

Extensive 

Event likelihood without benefit of either IPL 

Moderate 

Total number of IPLs (non-SIS IPL + SIS interlock) 

2 

Required SIS interlock integrity level 

2 


(for BPCS), user-approved safety (HAS) (for SIS) and user- 
obsolete.The Guidelines give criteria for user approvals. 

13.15.4 Basic process control system 

The BPCS is not usually an IPL. It is, nevertheless, the 
next line of defence after the process design and has an 
important part to play. The Guidelines therefore deal with 
the safety considerations in the selection and design of the 
BPCS. The account given covers (1) the technology selec¬ 
tion, (2) the signals, (3) the field measurements, (4) the final 
control elements, (5) the process controllers, (6) the opera¬ 
tor/control interfaces, (7) communication considerations, 
(8) electrical power distribution systems, (9) control system 
grounding, (10) batch control, (11) software design and data 
structures and (12) advanced computer control strategies, 
and contain much practical material on these features. 

The Guidelines advise that use of a supervisory computer 
should be subject to a discipline which restricts it to 
manipulation of loop set points. It should not normally be 
able to change the operational mode of the loops except for 
transfer to the back-up mode on computer failure or to 
computer mode on initialization. It should not compromise 
the integrity of the back-up controls. 

The design philosophy of the Guidelines requires that the 
BPCS and the SIS should be separate systems. The BPCS 
should not be relied on to protect against unsafe process 
conditions. The integrity of the SIS should not be compro¬ 
mised by the BPCS. Appendix B of the Guidelines gives 
detailed guidance on separation. 

13.15.5 Safety interlock system 

As far as safety considerations in the selection and design 
of the SIS are concerned, the Guidelines cover (1) the design 


issues, (2) the requirements analysis, (3) the technology 
selection, (4) the architecture selection, (5) the equipment 
selection and (6) the system design. The necessary pre¬ 
liminaries are to determine the need for Sis and to establish 
their integrity levels. 

Design issues 

Design issues are of two main kinds: function and integrity. 
Issues concerning function include the parameters to be 
monitored, the trip actions to be taken, the testing facilities 
and policy. Among those bearing on integrity are the num¬ 
ber of integrity levels required, which affects the choice of 
technology. 

Some specific design issues addressed in the Guidelines 
are (1) the fail-safe characteristics, (2) logic structures, 
(3) fault prevention and mitigation, (4) separation of the 
BPCS and SIS, (5) diversity, (6) software considerations, 
(7) diagnostics, (8) the human/machine interface and 
(9) communications. 

The fail-safe issue involves the choices de-energize-to- 
trip vs energize-to-trip. There is also the question of the 
failures modes of PES-based devices. Even at the chip level, 
probable states are equally likely to be on or off. The pro¬ 
blem is even more severe at the level of a PES-based device. 
Effectively, the Guidelines suggest alternative approaches 
based on the use of equipment of proven reliability, capable 
of self-diagnosis and of proof-testing, with judicious use of 
redundancy. 

There should be a separation between the SIS and BPCS 
such as to ensure the integrity of the former. Conventional 
SISs have long utilized separate sensors and power sup¬ 
plies. The Guidelines also bring into consideration the 
input/output system, the software and the human/ 
machine interface. 
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Diagnostics may be used to detect fail-to-danger failures 
in the SI equipment including the sensor, the logic solvers, 
the final control elements and the energy sources. The 
Guidelines distinguish between passive and active diag¬ 
nostics. In passive diagnostics, the failure is revealed only 
when a demand is imposed, either by the system or by 
a user test. In active diagnostics, the device is subjected 
continuously to testing by input of out-of-range conditions 
and its response monitored, but over a time interval short 
enough not to upset the SI loop. The example quoted is the 
perturbation of a solenoid valve on a control valve with 
sufficient rapidity that the control valve is not affected. 

Requirements analysis 

The requirements analysis determines the targets for 
availability and reliability (or functional and operational 
reliability). 

Technology selection 

The SIS technologies given in the Guidelines include: 
(1) fluid logic (pneumatic, hydraulic); (2) electrical logic, 
including direct-wired systems, electromechanical devices 
(relays, timers), solid state relays, solid state logic and 
motor-drive timers; (3) PES technology, involving PLCs 
and distributed control systems (DCSs) and (4) hybrid 
systems. The technologies are detailed in appendix A of the 
Guidelines. 

The hardware of a typical SIS as envisaged in the 
Guidelines might consist of a logic solver with input mod¬ 
ules receiving sensor signals, output modules sending out 
signals to final control elements, a BPCS interface, a 
human/machine interface and an engineer’s interface. 

Architecture selection 

Under architecture selection, the Guidelines discuss the 
various ways of achieving an integrity appropriate for the 
integrity level determined. Thus, for IL1, redundancy is 
usually not necessary, though it may be appropriate for a 
lower reliability element. For IL3, on the other hand, there 
should be full redundancy. Other features mentioned for 
IL3 are use of analogue sensors so that active diagnostics 
can be practised, monitoring of the logic solver outputs by 
the BPCS and consideration of the use of diversity in the 
sensors. For both high availability and high reliability, use 
may be made of a triple modular redundant (TMR) system, 
or | voting system. 

Equipment selection 

The equipment selected for a PES-based SIS should be of 
user-approved safety. 

System design 

The basic design method for the SIS has already been 
described, but the design involves more than this. The 
design should allow for the special features of PES-based 
systems. One of these, the difficulty of determining fail¬ 
safe states, has already been mentioned. Another feature is 
false ‘turn-ons’ of inputs or outputs. 

Another problem in PES-based systems is that the life of 
a given version of the software is relatively short so that the 
version initially used is liable to become out of date and, 
after a time, no longer supported by the vendor. The pro¬ 
blem then arises that insertion of an updated version con¬ 
stitutes a software modification, with all that that entails. 


There are various approaches to the problem, none entirely 
satisfactory. 

The design should take into account the potential 
impacts of the SIS on the other components of the process 
control system, including the alarm system, the communi¬ 
cations system and the human/machine interfaces. 

Most process control systems involve some sequential 
control even if it is largely limited to start-up and shut¬ 
down. The sequential logic should operate in such a way as 
not to cause any safety problems. Its operation should be 
tested against the SI logic to ensure that normal operation 
of the sequential control does not trigger interlock action. 

The documentation for the SIS specified in the Guide¬ 
lines includes (1) the operational description, (2) the sche¬ 
matic diagrams, (3) the binary logic diagrams and (4) the 
single line diagrams. Examples are given of these different 
types of diagrams. 

13.15.6 Administrative actions 

In order to ensure the control system integrity, the design 
process just described needs to be supported by adminis¬ 
trative actions The Guidelines outline minimum procedural 
requirements, the scope of which includes (1) operating 
procedures, (2) maintenance facilities, (3) testing of the 
BPCS, (4) testing of the SIS and alarms, (5) test frequency 
requirements, (6) testing facilities, (7) operations training, 
(8) documentation and (9) auditing of maintenance and 
documentation. 

The test frequency indicated in the Guidelines for SIS 
functional testing is, for minimal risk systems, testing once 
every 2 years or at major turnarounds, whichever is more 
frequent, and for high risk systems, testing at least once a 
year or on major maintenance, whichever is more frequent. 

13.16 Emergency Shut-down Systems 

In quite a large proportion of cases, the plant is provided 
not just with individual trips but with a complete automatic 
emergency shut-down (BSD) system. There is relatively 
little written about BSD systems. One of the principal 
accounts is that given in Offshore Installations: Guidance on 
Design and Construction, Guidance Notes to the Offshore 
Installations (Construction and Use) Regulations 1974 
issued by the Department of Energy (1984) followed now 
by Offshore Installations: Guidance on Design, Construction 
and Certification (HSE, 1990b) (the HSE Design, Construc¬ 
tion and Certification Guidance Notes). 

13.16.1 Conceptual design of ESD 

The function of an ESD system is to detect a condition or 
event sufficiently hazardous or undesirable as to require 
shut-down and then to effect transition to a safe state. The 
potential hazards are determined by a method of hazard 
identification such as hazop. Estimates are then made of 
the frequency and consequences of these hazards. The 
hazards against which the ESD system is to protect are 
then defined. 

This protection is effected by identifying the operating 
parameters which must be kept within limits if realization 
of the hazards is to be avoided and selecting shut-down 
actions which will achieve this. A shut-down sequence is 
determined and the shut-down logic formulated. It is not 
always necessary to shut-down the whole plant and there 
are different levels of ESD which fall short of this, such as 
shut-down of an individual unit or of a section of plant. 
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13.16.2 Initiation of ESD 

The arrangements for initiation of the ESD are critical. If 
these are defective, so that the system is not activated when 
it should be, all the rest of the design goes for nothing. 
There is a balance to be struck between the functional and 
operational reliability of the ESD system. It should act 
when a hazard arises, but should not cause unnecessary 
shut-downs or other hazards. 

One factor which affects this balance is the fact that 
usually the plant is safest in the normal operating mode 
and that transitions such as shut-down and start-up tend to 
be rather more prone to hazards and are to be avoided 
unless really necessary. Another, related factor is that shut¬ 
down of one plant may impose shut-down on other, linked 
plants. 

Initiation may be manual, automatic or, more usually, 
both. The usual arrangement is a manual initiation point, 
or shut-down button, in the control centre, other manual 
initiation points located strategically throughout the plant 
and initiation by instrumentation. Such automatic initia¬ 
tion may be effected by the fire and gas system and/or by 
process instruments. Measures should be taken to avoid 
inadvertent activation, including activation during main¬ 
tenance and testing. 

13.16.3 Action on ESD 

There are a variety of actions which an ESD system may 
take. Three principal types are: 

(1) flow shut-off; 

(2) energy reduction; 

(3) material transfer. 

Flow shut-off includes shut-off of feed and other flows. It 
often involves shut-down of machinery and may include 
isolation of units. Energy reduction covers shut-off of heat 
input and initiation of additional cooling. Material transfer 
refers to pressure reduction, venting and blow-down. 

A fundamental principle in ESD is failure to a safe state. 
The overall aim is failure to a safe state for the system as a 
whole. This is normally effected by applying the principle 
to individual units, but there may be exceptions, and cases 
should be considered individually. Each required action of 
the ESD system should be effected by positive means. 
Reliance should not be placed on the cascading effect of 
other trip actions. 

13.16.4 Detail design of ESD system 

It is a fundamental principle that protective systems be 
independent of the rest of the instrument and control sys¬ 
tem, and this applies equally to an ESD system. The design 
of the ESD system should follow the principles which apply 
to trip systems generally, as described in Section 13.9. 
There should be a balance between functional and opera¬ 
tional reliability. Dependent failures should be considered. 
The reliability may be assessed using fault tree and other 
methods. The techniques of diversity and redundancy 
should be used as appropriate. Use may be made of major¬ 
ity voting systems. 

The emergency shut-down valves (ESVs) should have a 
high degree of integrity. Such valves are frequently pro¬ 
vided with pneumatic or hydraulic power supplies in addi¬ 
tion to electrical power supply. An ESVshould be located so 
that it is unlikely to be disabled by the type of incident 
against which it is intended to protect. 


The ESD system should be provided with power supplies 
which have a high degree of integrity. The normal approach 
is to provide a UPS. This supply should be designed and 
located so that it is unlikely to be disabled by the incident 
itself. The cables from the power supply to the final shut¬ 
down elements should be routed and protected to avoid 
damage by the incident. 

13.16.5 Operation of ESD system 

The status of the ESD system should be clear at all times. 
There should be a separate display showing this status 
in the control centre. This display should give the status of 
any part of the EDS system which is under test or main¬ 
tenance and of any part which is disarmed. Initiation of 
ESD should activate audible and visual alarms in the con¬ 
trol centre. There should be an indication of the source of 
the initiation, whether manual or instrument. BSD should 
also be signalled by an alarm which is part of the general 
alarm system. 

It may be necessary in certain situations such as start¬ 
up, changeover or maintenance to disarm at least part of the 
BSD system, but such disarming should be governed by 
formal arrangements. The principles are essentially simi¬ 
lar to those which apply to trip systems generally, as 
described in Section 13.9. 

13.16.6 Testing and maintenance of ESD system 

The ESD system should be subject to periodic proof test¬ 
ing and such testing should be governed by a formal 
system. The principles of proof testing were discussed in 
Section 13.9. As far as is practical, the test should cover the 
complete system from initiation to shut-down condition. 

The need for proof testing and, more generally, for the 
detection of unrevealed failure should be taken into 
account in the design. The equipment should be designed 
for ease of testing. It should be segregated and clearly 
identified. Techniques for detection of instrument mal¬ 
function should be exploited. In voting systems, the failure 
of a single channel should be signalled. 

13.16.7 Documentation of an ESD system 

The ESD system should be fully documented. The HSE 
Design, Construction and Certification Guidance Notes give 
details of recommended documentation. 

13.16.8 ESD of a gas terminal 

The design of systems for ESD and EDP of a gas terminal 
has been described by Valk and Sylvester-Evans (1985). 
The design philosophy described is that the ESD system 
should operate only in an extreme emergency, that the 
ESD and EDP systems are separate from the control, trip 
and relief systems, and that the systems should be simple 
and reliable. 

The preliminary design of the ESD and EDP systems 
was reviewed by means of a hazop study. Potential opera¬ 
tional failures were studied using general reliability engi¬ 
neering methods and functional failures were studied 
using, in particular, fault tree analysis. A further hazop 
was conducted on the final design for the ESD and EDP 
system. 

Design studies showed that a totally fail-safe concept 
would result in a relief and flare system of exceptional size. 
Alternatives considered were to allow an increase in the 
depressurization time for certain critical equipment beyond 
that recommended in the codes and to control the peak 
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depressurization flow in the relief and flare system. In the 
design adopted, the plant was divided into sections such 
that the depressurization of each section could be done 
independently and the operation of the sections was inter¬ 
locked. The depressurization time of certain items was 
extended to 30 min as opposed to the 15 min recommended 
in API 521, but the design compensated for this extension 
by provision of additional fireproofing and water cooling 
arrangements. 

The authors highlight the differences of philosophy 
between companies on whether the ESD and EDP systems 
should be used for normal shut-down and depressurization 
or reserved as systems dedicated for emergency use. This 
project reaffirmed the need to consider the ESD and EDP 
systems at an early stage and to avoid treating them as an 
‘add-on’ feature to be dealt with late in the design. 

13.16.9 ESD on Piper Alpha 

The ESD system on Piper Alpha illustrates a number of the 
points just made. Overall, the system was largely effective 
in achieving shut-down and venting and blow-down, but 
there were a number of features which are of interest. 

The main button for the initiation of the ESD caused 
closure of the ESV on the main oil pipeline but not on the 
three gas pipelines. One reason for this was that closure of 
these latter ESVs would impose a forced shut-down on the 
linked platforms. There were three separate shut-down 
buttons, one for each of these valves, and shut-down 
depended on manual action by the control room operator - 
he was thrown across the control room by the explosion. 

The ESVs on the risers of the gas pipelines were so loca¬ 
ted that they were vulnerable to the fires that developed. 
This defect was widespread throughout the North Sea and 
regulations were introduced without delay to require such 
valves to be relocated. There was also evidence that some of 
the ESVs did not achieve tight shut-off. The explosion 
damaged power supplies, and in some cases closure of ESVs 
occurred, not due to survival of the intended power supply, 
but fortuitously Further details are given in Appendix 19. 

13.17 Level of Automation 

The allocation of function between man and machine is a 
principal theme in human factors and is discussed in the 
next chapter. Of particular interest here is the allocation of 
control and protective functions to the process operator or the 
instrument system. This was touched on above and is now 
considered in more detail by means of a industrial example. 


13.17.1 Illustrative example: steam boiler protective 
system 

A case study of the optimum level of automation has been 
described by Hunns (1981). The system investigated was 
the protective system of a large steam plant. The plant 
consisted of a 100 MW boiler operating at 1500—2000 psi 
and producing 500 ton/h of steam, the boiler being dual 
fired with oil and gas. The principal relevant features of the 
three candidate control and protective systems are shown 
in Table 13.31. 

Each system was assessed for its reliability in the start¬ 
up and operational phases of the plant. Avariety of start-up 
sequences were considered, each related to the event which 
had caused the previous shut-down. Some 200 logic dia¬ 
grams were produced. 

The criterion used to determine the optimum system was 
a function of the expected shut-downs. These were clas¬ 
sified as low penalty and high penalty. Low penalty shut¬ 
downs were unwanted shut-downs due to spurious trips and 
correct shut-downs in response to a demand, whilst high 
penalty, or catastrophic, shut-downs were those caused by a 
demand to which the protective system did not respond. 

One such case is an excessive release of unignited fuel 
into the combustion chamber. Figure 13.26 shows a section 
of the logic, which the authors term ‘matrix logic’. Events 
envisaged by the analyst are shown in the left-hand col¬ 
umn. A particular event sequence is shown by a vertical 
column of the matrix containing one or more dots. The cir¬ 
cle enclosing the “&’ symbol at the head of the column 
indicates that the events are ANDed together. The set of 
event sequences is collected under the OR symbol, which 
indicates that these event sequences are related to the top 
event, the unignited release, by OR logic. 

The equipment failure data were taken from the Safety 
and Reliability Directorate SYREL data bank, whilst the 
human error estimates were obtained by expert judgement. 
There were some 180 elements in the latter list. Estimates of 
the values in the list were made by two experienced ana¬ 
lysts. Use was made of performance shaping factors such 
as ‘time to react’,‘prior expectancy’,‘conspicuity of task’and 
‘perception of consequence’. Good agreement was obtained 
between the two. Those estimates which were particularly 
critical or where a divergence had emerged were mediated 
by a third, independent, analyst. 

The results of the study were expressed in terms of the 
number of low and high penalty shut-downs per year and 
the corresponding mean outage time. The mean outage of 


Table 13.31 Elements of three candidate protective systems for a large steam boiler plant (after Hunns, 1981) 
(Courtesy of Elsevier Science Publishers) 


Control and protective features 


Protective system design a 


Manual 

Medium automated 

Higly automated 

Trip parameters’ 1 

A 

A 

A 

Boiler purge sequence 

M 

A 

A 

Burner flame failure detection 

M 

A 

A 

Gas valves leak test 

M 

M 

A 

Ignition burner control 

M 

M 

A 

Burner fuel valves operation 

M 

A 

A 


“ A, automated; M, manual. 

h Low boiler drum level; low combustion air flow; low instrument air pressure; low level fuel oil pressure; low atomizing steam pressure; low fuel 
gas pressurel; high fuel gas pressure; high knockout drum level; and loss of 110 DC supplies. 
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Figure 13.26 Matrix logic diagram for a steam boiler protective system: event ‘excessive unignited fuel release’ 
(Hunns, 1981) (Courtesy of Elsevier Science Publishers) 


low penalty events was taken as 1/3 days/event and that of 
high penalty events as 60 days/event. The manual system 
gave appreciably more high penalty shut-downs but fewer 
low penalty ones and overall a higher outage than the other 
two systems. The medium automated system gave slightly 
more high penalty shut-downs and fewer low penalty ones 
than the highly automated one, but the same outage time. 
On a life cycle cost basis, for which the highly automated 
system had higher capital and maintenance costs, the 
medium automated system was superior. The total life 
cycle costs of the three systems - manual, medium auto¬ 
mated and highly automated - were £0.122, 0.095 and 
0.099 million/year, respectively. 


13.18 Toxic Storage Instrumentation 

On plants handling high toxic hazard materials (HTHMs), 
the instrumentation and control system assumes parti¬ 
cular importance. Some relevant considerations are out¬ 
lined in Guidelines for Safe Storage and Handling of High 
Toxic Hazard Materials by the CCPS (1988/2) (the CCPS 
HTHM Guide). 

Depending on the degree of hazard, the instrumentation 
and control system should be a high integrity one. This 
requires adherence to the various principles already 
described for high integrity design, including the applica¬ 
tion of principles such as fail-safe and second chance 
design and the use, as appropriate, of high reliability 
instrumentation, instrument diversity and redundancy, 
and high quality maintenance. It also involves the applica¬ 
tion of the techniques of hazard identification and assess¬ 
ment to the design. 


In respect of measurement, principal considerations are 
that the potential for release from the instrument, or its 
fittings, should be minimized, that the instrument be reli¬ 
able and that the measurement be accurate. For flow mea¬ 
surement this favours the use of non-invasive sensors such 
as magnetic flowmeters and avoidance of glass in instru¬ 
ments such as rotameters. Orifice flowmeters also have the 
disadvantage of an extra flange and associated piping. 
For pressure measurement, diaphragm pressure sensors 
are preferred to direct-connected gauges of the Bourdon 
tube type. Precautions to be taken where the latter have to 
be used include protection by inert liquid filling in corro¬ 
sive service and installation of shut-off valves and, possi¬ 
bly, flow limiters in the form of restriction orifices. For level 
measurement, weighing methods have advantages, but 
use of sightglasses should be avoided. For temperature 
measurement, particular care should be taken in the design 
of the thermowell, which can be a weak point. 

The arrangements for control and protection should 
address the hazards of particular importance for the 
storage of tonics. These include (1) overpressure, (2) over¬ 
filling, (3) overtemperature and (4) high release flow. For 
overpressure, the main requirements are the provision of 
overpressure protection and of means of disposal for the 
relief flows. For overfilling, a significant role is likely to be 
played by trip systems. For temperature deviations, which 
may indicate reaction runaway or thermal stratification 
with its attendant risk of rollover, the need is for warning. 
Some methods of dealing with overtemperature are 
described below. High releases flow following a failure of 
containment may be mitigated by the use of suitable control 
valve trims and of restrictor orifices or excess flow valves. 
















































CONTROL SYSTEM DESIGN 13/69 


Storage of a reactive chemical requires close control in 
respect both of temperature and of contamination. Methods 
of temperature control include the use of cooling coils, a 
reflux condenser, a quench system and short stop arrange¬ 
ment. All these methods of temperature control require for 
their effective functioning good mixing in the tank. 

A toxic gas detection system should be provided, on the 
lines described in Chapter 18. Toxic gas detectors should 
also be installed on vents on which breakthrough of a toxic 
gas may occur. The sensors should have a range adequate 
for this duty. Instrumentation may also be required to 
ensure that the pilot burner remains lit on any flare which 
has the function of destroying by combustion any toxic gas 
routed to it. 

13.19 Notation 

Section 13.6 

Pi delivery pressure 

P s suction pressure 

AP pressure drop 
Q gas flow 

Section 13.9 

f v density function for a plant hazard occurring 

m number of equipments which must survive for 

trip system to survive 
n number of identical equipments 

P v probability of a plant hazard occurring 
r number of equipments which must fail for 

trip system to fail 

y spurious trip rate 

<5 plant demand rate 

q plant hazard rate 

X equipment failure rate 

t p proof test interval 

t T repair time 

(j> fractional dead time (with simultaneous testing) 

Subsections 13.9.1-13.9.13 
ps probability of a plant demand occurring 
q probability of a single channel failing 

q y probability defined by Equation 13.9.37 

t 0 dead time 

< p * fractional dead time (with staggered testing) 

0 is isolation dead time 


Subscripts 

m/n for an m/m (m-out-of-M) system 


Subsection 13.9.14 

P n probability that system is in state n 
r u r z terms defined by Equation 13.9.53 


Subsection 13.9.16 

A heat transfer area of sensor 

c p specific heat of sensor 

k constant 

M mass of sensor 

s Laplace operator 

t time 

T temperature 

Ti input temperature 

U overall heat transfer coefficient of sensor 

(5(f) delta function 

£ damping factor 

<j> temperature division 

(pi input temperature deviation 

I time constant of sensor 

to n natural frequency 


Subscripts 
i input 

ss steady-state 

1,2 first, second stage 

Superscripts 

- Laplace transform 


Subsection 13.9.17 

C annualized cost of a single channel trip 

G cost of genuine trip 

H cost of realization of hazard 

S cost of spurious trip 

V overall annual cost 

ft functional beta value 

ft operational beta value 

Subscripts 
s trip system 

1/2 1/2 system 
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14/2 HUMAN FACTORS AND HUMAN ERROR 


It is appropriate at this point to deal with the topic of human 
factors, and one important aspect of that, human error. 
Human factors considerations are relevant to all aspects 
of the design and operation of process plants. The topic 
is, however, avast one and the account given here is neces¬ 
sarily limited. The approach taken is to consider in parti¬ 
cular the process operator and then to touch on certain other 
aspects such as communications, maintenance and con¬ 
struction. 

Overviews of human factors are given in Biotechnology 
(Fogel, 1963), Human Factors Engineering (McCormick, 
1957b), Human Engineering Guide to Equipment Design 
(C.T. Morgan et al., 1963), Human Engineering Guide for 
Equipment Designers (Woodson and Conover, 1964), 
Human Factors Evaluation in System Development (Meister 
and Rabideau, 1965), Ergonomics (Murrell, 1965a), Human 
Performance in Industry (Murrell, 1965b), Human Factors 
(Meister, 1971), Handbook of Human Factors (Salvendy, 
1987), Applied Ergonomics Handbook (Burke, 1992 ACGIH/ 
76) and Human Factors in Design andEngineering (Sanders, 
1993). Accounts of human factors with specific reference 
to safety are given in Ergonomics Guides (AIHA, 1970—/l), 
Human Aspects of Safety (Singleton, 1976b) and Human 
Factors in Process Operations (Mill, 1992). HSE guidance is 
given in HS(G) 48 Human Factors in Industrial Safety 
(HSE, 1989). 

Selected references on human factors are given in 
Table 14.1 and references on the process operator are given 
in Table 14.2. 


Table 14.1 Selected references on human factors 


IOHSI (Inf. Sht 15); NRC (Appendix 28 Human Factors)', 
Chapanis, Garner and Morgan (1949); Grossman (1956); 
McCormick (1957,1976); Institute of Personnel 
Management (1961); Bennett, Degan and Spiegel (1963); 
Fogel (1963); C.T. Morgan et al. (1963); E. Edwards (1964, 
1973); Woodson and Conover (1964); Chapanis (1965); 
Meister and Rabideau (1965); Murrell (1965a,b); Edholm 
(1967); Sackman (1967,1970); Singleton, Easterby and 
Whitfield (1967); Kelley (1968); Hands (1969); Hurst (1969); 
Ragsdale (1969); Siegel and Wolf (1969); Bongard (1970); 
De Greene (1970,1974); Meister (1971,1987); Poulton (1971); 
Sayers (1971SRS/GR/9); Singleton, Fox and Whitfield 
(1971); E. Edwards (1973); E. Edwards and Lees (1973,1974); 

R. G. Mills and Hatfield (1974); Christensen (1976); 
Singleton (1976a,b);Towill (1976); Welford (1976); 

S. Brown and Martin (1977); Jennings and Chiles (1977); 
Rouse and Gopher (1977); Craig (1978); Jagacinski and 
Miller (1978); Stammers (1978);VR. Hunt (1979); Kiguchi 
and Sheridan (1979); Anon. (1980i); Shackel (1980); 
McCormick and Sanders (1982); M.S. Sanders (1982—, 
1993); J.C. Williams (1982); S. Cox and Cox (1984); 
Helmreich (1984); Nordic Liaison Committee (1986 NKA/ 
LTT(85)1); L.E. Davis and Wacker (1987); Goldstein (1987); 
Lehner and Zirk (1987); Parasuraman (1987); Salvendy 
(1987); Sanders and McCormick (1987); Swain (1987c); 
deVries-Griever and Meijman (1987);Wiener (1987); 
Woodson (1987); Holloway (1988); Grollier-Barron (1989); 
HSE (1989b); Bond (1990 LPB 92); Broadbent, Reason and 
Baddeley (1990); J.R.Wilson and Corlett (1983); A.F. Sanders 
(1991); Mill (1992); Moraal (1992); Needham (1992) 


Allocation of function 

Fitts (1962); Ephrath and Young (1981); Bainbridge (1983); 
H.E. Price (1985); Kantowitz and Sorkin (1987); Kletz 
(1987b); Swain (1987b); J. Lee and Moray (1992) 

Human information processing, including 
decision-making, control tasks 
Wald (1947); Heider (1958); Newell, Shaw and Simon (1960); 
Sinaiko (1961); Senders (1964); W. Edwards (1965); Zadeh 
(1965); Dreyfus (1972); Newell and Simon (1972); Kelley 
(1973); Ince and Williges (1974); Levine and Samet (1974); 
Pew (1974); Sheridan and Ferrell (1974);Tversky and 
Kahneman (1974); McLeod and McCallum (1975); 

J. Anderson (1976); W. Edwards and Tversky (1976); Gaines 
(1976); Keeney and Raiffa (1976); Senders and Posner 
(1976); Gaines and Kohout (1977); Janis and Mann (1977); 
Rouse (1977); Schank and Abelson (1977); Jagacinski and 
Miller (1978); Feigenbaum (1979); Kochhard and All (1979); 
Ringle (1979); Hammond, McClelland and Mumpower 
(1980); Cuny and Boy (1981); Barnett (1982); Baron et al. 
(1982); Rasmussen and Lind (1982); Rasmussen (1983); 
Eberts (1985); Friedman, Howell and Jensen (1985); Sayers 
(1988); Moray etal. (1991);Thimbleby (1991); Bainbridge 
(1993b); Bainbridge etal. (1993); van der Schaaf (1993); 
Siinderstrom (1993) 

Vigilance 

Levine and Samet (1974); Wiener (1974,1987); Kvalseth 
(1979); Mackie (1977); Loeb (1978); Craig (1979,1980,1981, 
1987); Curry (1981); Fisk and Schneider (1981); Kessel and 
Wickens (1982); Anon. (1984s); Wiener (1987); Wogalter 
etal. (1987) 

Inspection tasks 

Mackenzie (1958); Drury and Addison (1973); Drury and 
Fox (1975); Yao-ChungTsao, Drury and Morawski (1979); 
Gallwey (1982); Geyer and Perry (1982); Drury and 
Sinclair (1983) 

Displays, controls, display-control relations 

Sleight (1948); Murrell (1952a,b, 1965a); Sinaiko (1961); 
Loveless (1962); Fogel (1963); Ziebolz (1964); Carbonell 
(1966); H.H. Bowen (1967); Meister (1967); Kelley (1968); 
Luxenberg and Kuehn (1968); Singleton (1969); Bainbridge 
(1971); Bernotat and Gartner (1972); Ince and Williges 
(1974); Jacob, Egeth and Bevan (1976); Seeberger and 
Wierwille (1976); Sheridan and Johanssen (1976); Curry, 
Kleinman and Hoofman (1977); Potash (1977); Demaio, 
Parkinson and Crosby (1978); B. Gibson and Laios (1978); 
Cakir, Hart and Stewart (1980); Penniall (1980); 
Petropoulos and Brehner (1981); Goodstein (1984); Kautto 
etal. (1984); Bullinger, Kern and Muntzinger (1987); 
Downing and Sanders (1987); Helander (1987);Triggs 
(1988);Whalley (1989); Buttigieg and Sanderson (1991); 
Dillon (1992) 

Diagnostic tasks 

Dale (1958,1964,1968); Shriver, Fink and Trexler (1964); 
Tilley (1967); Rasmussen and Jensen (1973,1974); Gai and 
Curry (1976); Brooke and Duncan (1980a,b, 1981,1983a,b); 
Bond (1981); Brehmer (1981); Brooke (1981); Freedy and 
Lucaccini (1981); Gaddes and Brady (1981); R.M. Hunt and 
Rouse (1981); Leplat (1981); Moray (1981); Patrick and 
Stammers (1981); Sheridan (1981); Syrbe (1981); 

W.B. Johnson and Rouse (1982); Rouse and Hunt (1982); 
Brooke, Cook and Duncan (1983); N.M. Morris and Rouse 
(1985); Patrick etal. (1986);Toms and Patrick (1987,1989); 





HUMAN FACTORS AND HUMAN ERROR 


4/3 


Carlson, Sullivan and Schneider (1989); Brinkman (1993); 
Patrick (1993); Reinartz (1993); Schaafstal (1993) 

Emergency actions 

Haas and Bott (1982); Lester and Bombaci (1984) 

Shiftwork 

HSE (1978 Research Review 1,1992 CRR 31); Folkard and 
Monk (1979); Akerstedt and Torsvall (1981); Tilley et al. 
(1982); Folkard and Condon (1987); Costa etal. (1989); 
Folkard (1992); Wedderburn (1992); Wilkinson (1992a,b); 
Rosa and Bonnet (1993) 

Workload, mental load, stress, fatigue, boredom 

Bartlett (1943); Berkun etal. (1962); Berkun (1964); 
Bainbridge (1978); Goldstein and Dorfman (1978); Leplat 
(1978);Welford (1978); Moray (1979); R.P. Smith (1981); 
Sharit and Salvendy (1982); Anon. (1984ss); Braby, Harris 
and Muir (1993); Dorner and Pfeifer (1993); Gaillard (1993); 
HSE (1993 CRR 61) 

Drink, drugs 

NTSB (annual reports); HSE (1981 OP 1) 

Task sharing 

Goldstein and Dorfinan (1978); Cellier and Eyrolle (1992) 

Teamwork 

D.P. Baker and Salas (1992); Driskell and Sals (1992); 
Reinartz (1993); Rogalski and Samurcay (1993) 

Personnel selection 

Mallamad, Levine and Fleishman (1980); Gallwey (1982); 
Osburn (1987); HSE (1993 CRR 58) 

Training 

Holding(1965,1987); Boydell (1970,1976); Patrick(1975,1992); 
API (1977 Publ. 756,1979 Publ. 757); S.L. Johnson (1981); 
Nawrocki (1981); Svanes and Delaney (1981);Towne (1981); 
Wickens and Kessel (1981);W.B. Johnson and Rouse (1982); 
Kessel and Wickens (1982); Buch and Diehl (1984); Gagne 
(1985); Cannon-Bowers etal. (1991); Bainbridge (1993a); 
Kozak etal. (1993) 

Task analysis 

Annett et al. (1971); Leplat (1981); Piso (1981); Drury (1983); 
Kirwan and Ainsworth (1992) 

Operating instructions 

S. Jones (1968); Booher (1975); Kammann (1975); Anon. 
(1976 LPB 8, p. 19); Duffy, Curran and Sass (1983); Krohn 
(1983); Berkovitch (1985); Hartley (1985); R.C. Parker 
(1988); DTI (1989); Chung-Chiang Peng and Sheue-Iing 
Hwang (1994) 

Computer aids 

Mitter (1991); Marmaras, lioukas and Laios (1992); 
Adelman et al. (1993); Kirlik (1993) 

Air traffic control systems 

Whitfield, Ball and Ord (1980); Wiener and Curry (1980) 

Formal safety assessment (FSA) 

Bellamy, Kirwan and Cox (1986); Bellamy and Geyer (1991) 

Evacuation 

Bellamy and Harrison (1988) 

Offshore (see Table A18.1) 


Table 14.2 Selected references on the process operator, 
including fault administration and computer aids (see also 
Table A14.1) 


NRC (Appendix 28 Operating Personnel, Simulators, 
Training ); Riso National Laboratory (Appendix 28); 
Crossman (1960); W.R. King (1965); Rasmussen (1968a-c, 
1969,1971,1973,1974,1976a,b, 1977,1981a,b, 1983,1986, 
1988); Beishon (1969); Lees (1970,1974c); E. Edwards and 
Lees (1971a,b, 1973,1974); E. Edwards (1973); IEE (1975 
Coll. Dig. 75/12); Purdue Europe (1977); A. Shepherd (1979, 
1993); SN (1979123); Lenior, Rijnsdorp and Verhagen 
(1980); Bainbridge (1981); Ergonomics Society (1983); Boel 
and Daniellou (1984); Brouwers (1984); Daniellou and Boel 
(1984); EPRI (1984); IChemE (1984/77); Kragt and Daniels 
(1984); S.B. Gibson (1987); Hoyos (1987); Bellamy and 
Geyer (1988); Sanderson,Verhage and Fuld (1989); 

J.R.Wilson and Rutherford (1989); ACSNI (1990,1991, 
1993); Mill (1992); Hoc (1993) 

Manual vs automatic systems 

Hunns (1981); Bessant and Dickson (1982); Bainbridge 
(1983); Rijnsdorp (1986);Visick (1986); Bodsberg and 
Ingstad (1989) 

Operator activities 

Troyan (1963); Lees (1970); E. Edwards and Lees (1973, 
1974); Skans (1980) 

Control tasks 

E. Edwards and Lees (1973,1974); Patternotte (1978); 
Umbers (1979,1981) 

Information display 

Rasmussen (1968a-c, 1969,1971,1973,1976b); Rasmussen 
and Goodstein (1972); E. Edwards and Lees (1973,1974); 
Pedersen (1974); A. Shepherd (1979); Pew, Miller and 
Feehler (1981); Buttigieg and Sanderson (1991) 

Fault administration 

Annett etal. (1971); CAPITB (1971 Inf. Pap. 8); E. Edwards 
and Lees (1973,1974); Rasmussen and Jensen (1973,1974); 
Duncan (1974); Goodstein etal. (1974); Lees (1974c); Duncan 
and Gray (1975a,b); Duncan and Shepherd (1975a,b); 

A. Shepherd (1976); Rouse (1977,1979a,b, 1981); 

A. Shepherd etal. (1977); Himmelblau (1978); Landeweerd 
(1979); Lihou (1979,1981); A. Shepherd and Duncan (1980); 
Christeansen and Howard (1981); Duncan (1981); 
Johannsen (1981); B.C. Marshall, Duncan and Baker (1981); 

B. C. Marshall and Shepherd (1981); B.C. Marshall etal. 
(1981); Patrick and Stammers (1981); Process Control 
Training (1981); Rasmussen and Rouse (1981); 

D.A. Thompson (1981); Rouse and Hunt (1982); Embrey 
(1986); PJ. Smith etal. (1986);Toms and Patrick (1987,1989); 
Vermeulen (1987); Malaterre etal. (1988); Morrison and 
Duncan (1988); Patrick and Haines (1988); Moray and 
Rotenberg (1989); Patrick etal. (1989);Yukimachi, 
Nagasaka and Sasou (1992); Decortis (1993); Hukki and 
Norros (1993); Patrick (1993); Chung-Chiang Peng and 
Sheue-Ling Hwang (1994) 

Alarm systems 

Andow and Lees (1974); Hanes (1978); E. Edwards (1979); 
Hanes (1980); Kortlandt and Kragt (1980a,b); Benel etal. 
(1981); Dellner (1981); Andow (1982,1985a,b); Kragt (1982, 
1983,1984a,b); Kragt and Bonten (1983); Renton (1984); 
Schellekens (1984); J. A. Shaw (1985); British Gas (1986 
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Comm 1296); Arnold and Darius (1988); Sorkin, Kantowitz 
and Kantowitz (1988); Fort (1989); Edworthy, Loxley and 
Dennis (1991); Fordestrommen and Haugset (1991) 

Batch processes 

Lihou and Jackson (1985); Rayment (1986) 

Operator-computer interaction 
Rasmussen (1968b, 1981a); Rasmussen and Goodstein (1972); 
Goodstein (1981,1982,1984);Kletz(1982g, 1991g); Rasmussen 
and Lind (1982); Goodstein etal. (1983); Hollnagel (1984); 

J.C. Shaw(1985); Rayment (1986); Gilmore, Gertman and 
Blackman (1989); Hockey etal. (1989) 

Control room design 

NRC (Appendix 28 Control Rooms)-, Ergonomics Society 
(1983); Stumpe (1984); Nordic Liaison Committee (1985 
NKA/LLT(85)4); Singleton (1986); Wanner (1986); Pikaar 
etal. (1990); HSE (1993 CRR 60); Ain s worth and 
Pendlebury (1995); Umbers and Rierson (1995); Whitfield 
(1995) 

Operator training, including simulators 

MCA (SG-15); NRC (Appendix 28 Operating Personnel, 
Simulators, Training)-, Pontius, van Tassel and Field (1959); 
Crossman (I960); S.D.M. King (1960,1964); Crossman and 
Cooke (1962); Stapleton (1962); Crossman, Cooke and 
Beishon (1964);Weltge and Clement (1964); BCISC (1965/5); 
Whitesell and Bowles (1965); Carmody and Staffin (1970); 
Annett etal. (1971); Atherton (1971); CAPITB (1971 Inf. Paps 
6-10,1972 Inf. Pap. 13); PLTB (1971/1,2,1972/3,1975/6); 
Biggers and Smith (1972); City and Guilds Institute (1972); 
E. Edwards and Lees (1973,1974); Duncan (1974,1981); 
Goodstein etal. (1974); Lees (1974c); Duncan and Gray 
(1975a,b); Duncan and Shepherd (1975a,b); Patrick (1975, 
1992); Barber andTibbets (1976); A. Shepherd (1976,1982b, 
1986,1992); J. Davies (1977); Doig (1977); A. Shepherd etal. 
(1977); Shindo and Umeda (1977); Stephens (1977); 
Crawford and Crawford (1978); Goldstein (1978,1987); 
Duncan, Gruneberg and Willis (1980); Landeweerd, 
Seegers and Praagma (1981); Process Control Training 
(1981);Vervalin (1981c, 1984); Sorotzkin and Lock (1983); 
Demena etal. (1984); Madhavan (1984); Clymer (1985); 
Pathe (1985); Tomlinson (1985); Embrey (1986); Marcille 
(1986); Nordic Liaison Cttee (1986 NKA/LLT(85)6); 
Wetherill and Wallsgrove (1986); Drury et al. (1987); 
Elshout and Wetherill (1987); Flexman and Stark (1987); 
Avisse (1989); IAEA (1989); Patrick etal. (1989); ACSNI 
(1990); Mani, Shoor and Petersen (1990); Ferney (1991); 
Grossman and Dejaeger (1992); IEE (1992 Coll. Dig. 
92/123); Sanquist (1992) 

Operating procedures, instructions 

Oriolo (1958);Troyan (1961a); Minich (1979); Lopinto (1983); 
S.T.Wood (1984); Kujawski (1985); Bardsley and Jenkins 
(1991SRDA Rl); Connelly (1992); McIntyre (1992); 

I.S. Sutton (1992); Swander and Vail (1992) 

Three Mile Island (see also Table A21.1) 

Livingston (1980); Malone etal. (1980); Kletz (19821) 


14.1 Human Factors in Process Control 

In the previous chapter the importance of plant operation 
was emphasized and the automatic control system was 
described. Consideration is now given to the other element 
in the overall control system - the process operator. 


Although modern control systems achieve a high degree 
of automation, the process operator still has the overall 
immediate responsibility for safe and economic operation 
of the process. There are different philosophies on the 
extent to which the function of safety shut-down should be 
removed from the operator and assigned to automatic trip 
system. In general, the greater the hazards, the stronger the 
argument for protective instrumentation. This question is 
considered in more detail later. But, whatever approach is 
adopted, the operator still has the vital function of running 
the plant so that shut-down conditions are avoided. 

The job of the process operator is therefore a crucial one, 
but it is also rather elusive in that it presents the engineer 
with a type of problem with which he is not normally 
required to deal. The study of industrial jobs and work 
situations is the province of ergonomics or, its American 
near-equivalent, human factors. It is appropriate, there¬ 
fore, to consider the contribution which this discipline 
can make to the problems associated with the work of the 
process operator. 

It should be said, however, that the chemical industry in 
general appears to make little use of human factors in this 
area. There is considerable willingness to do so among 
engineers, but perhaps also some lack of appreciation of the 
scope of human factors as a discipline. 

14.2 Human Factors in System Design 

The pace of technological change and the scale of systems 
have now become so great that it is often not possible to rely 
on evolutionary trial and error to achieve the proper adap¬ 
tation of human tasks. Instead, it is necessary to try to 
foresee the problems and to design to overcome them. The 
discipline that is concerned with this on the human side of 
systems is human factors. 

The development of human factors has been strongly 
influencedby the problems of large, complex man-machine 
systems that occur in the fields of defence, aerospace and 
computers. Much of the fundamental research and design 
experience are in these areas. 

An important area of study in the early work on human 
factors was the compatibility of man and machine, with its 
emphasis on ‘knobs and dials’. More recent work has laid a 
greater stress on system design. In consequence, the ergo¬ 
nomist has concerned himself increasingly with all stages 
of the design process, particularly the early stages where 
the crucial decisions are made. 

Human factors is now established, therefore, as an 
aspect of systems engineering. An outline of the human 
factors activities in system design is shown in Figure 14.1. 
Two main points may be noted: (1) human factors play a role 
at all stages of the design; and (2) the decisions taken early 
on, such as those on allocation of function, are especially 
important and the design process is a highly interactive 
and iterative one. Only one iteration loop is shown, but in 
fact iteration occurs at all stages of the design process. 
Important emphases in human factors, therefore, are the 
system criteria and the system design process. 

The engineer unfortunately frequently misunderstands 
human factors. The view of the subject as being concerned 
with knobs and dials is entrenched. The application of 
human factors is too often ineffective because it is called 
upon too late in the day to fulfill a rescue or cosmetic func¬ 
tion. Its greatest contribution should in fact come earlier, 
particularly at the allocation of function stage. 
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Subsystem function 


I Allocation of function 
---1 MAN 


Machine specification 
(hardware, software) 

T 


Machine design 

Prototype production 


t 

System evaluation 



Task synthesis 




J 


Figure 14.1 Human factors activities in system design (Lees, 1974c) (Courtesy of Taylor & Francis Ltd) 


Like the engineer, the ergonomist is concerned with solv¬ 
ing problems, particularly those arising in design. He 
draws on the work of psychologists and others, much as the 
engineer draws on that of physicists. 


14.3 Themes in Human Factors 

It is appropriate at this point to give a very brief account of 
some of the themes in human factors work which have 
obvious relevance to process control. Some of these are 
shown in Table 14.3. This is an abstract from a fuller table, 
which gives detailed references, in an account of the devel¬ 
opment of human factors in this context by Lees (1974c). 

Much of the early work on human factors was concerned 
with physical tasks, but in more recent years, the emphasis 
has been increasingly on mental tasks. This is certainly 
more relevant as far as the process operator is concerned, 
since his job is essentially decision-making. 

The question of the sampling and processing of informa¬ 
tion by the human operator is therefore of great importance. 
Work in this area largely evolved from study of the skills 
involved in physical tasks to investigation of those required 
for perceptual and decision-making tasks (Crossman, 
1956). The model of man as an information processor has 
proved fruitful, although the application of information 
theory to the problem has not been entirely successful.Work 
in the area has emphasized: the ability of man to accept 
information coming through many sensory channels and 
coded in many different ways, and his ability to compensate 
for errors in the information; the differences in the amounts 
of information which can he handled by the various chan¬ 
nels; the sampling of information and the updating of 
his mental model of the environment; the effect of informa¬ 
tion overload, resulting in selective omission of parts of 
the task; and the characteristics of memory, particularly 


Table 14.3 Selected topics in human factors 


Information sampling and processing 

Learning 

Skill 

Stress, fatigue 
Decision-making 
Diagnostic tasks 
Motivation 

Performance assessment 

Task analysis 

Man-machine systems 

Manual control, tracking 

Man-machine system reliability, human error 

Emergency situations 

Air traffic control 

Aircraft pilot’s task 

Dynamic modelling of operator 

Man-computer systems 

Displays 

Vigilance, signal detection 
Inspection tasks 
Controls 

Control-display relations 
Control panels, computer consoles 
Personnel selection 
Training 

Organizational factors, job enrichment 
Repetitive work, boredom, rest pauses, shift work 


short-term memory such as is exercised in remembering a 
telephone number to make a phone call. 

The ergonomist’s approach to a particular job tends to be 
to enquire into the skill involved, including the nature of 
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the skill, its acquisition through the learning process and 
its disintegration under stress. Skills differ greatly in their 
amenability to study; some skills, such as that of the pro¬ 
cess operator, are particularly inaccessible. Nevertheless, 
skilled performance does exhibit certain common char¬ 
acteristics. Skill seems to lie largely in the timing and 
co-ordination of activities to give a smooth and effortless 
performance. It is highly learned and barely accessible to 
consciousness, as indicated by the fact that the attempt to 
describe it, as in instructing a novice, often leads to actual 
degradation in performance. 

The effects on skill of various forms of stress such as 
fatigue, workload and anxiety, have been investigated both 
on account of the importance of these effects in themselves 
and of the light which they throw on the nature of skill as it 
degrades under stress. An important finding is that skilled 
performance tends to improve with moderate stress, but 
that beyond a certain threshold, which varies greatly with 
the individual, it deteriorates rapidly. 

The characteristics of human as opposed to mathematically 
optimal decision-making have been studied (W. Edwards, 
1965). Interesting results are man’s tendency to make deci¬ 
sions that are based on rather small samples, that is to jump 
to conclusions, and to make decisions that are biased towards 
optimism, that is to gamble on beating the odds. 

A type of decision-making that is rather important is 
diagnosis (Dale, 1958, 1964; Tilley, 1967). Studies of this 
indicate that man does not so much follow through the 
decision tree irrespective of the probabilities of the various 
paths, but rather moves about the tree, testing first the high 
probability paths, and only goes to the low probability ones 
when the former have been exhausted. 

Human performance in manual control tasks has been 
much studied. Early work evolved a transfer function 
model of the operator: 

exp(-^J^|. 

W (1 + t n s)(1 + tis) 1 J 

whereas) is the transfer function; if the gain; s the Laplace 
operator; r d the reaction time (usually 0.1—0.3 s); tl the lead 
time constant (0.2-2.5 s); r N the neuromuscular lag time 
constant (0.1-0.2 s); and ti the compensatory lag time con¬ 
stant (5-20 s). Of these parameters, the gain is particularly 
significant, alteration of gain being a favoured response of 
the human operator to a changing situation. This approach 
has been developed by later workers to take account of non- 
linearities, sampled data features, etc. 

Work in this area shows clearly the increased difficulty 
which the human operator has in controlling processes with 
an increasing number of transfer lags or integrations or 
with dead time. Certain systems are virtually uncontrol¬ 
lable by the operator, unless he is provided with specially 
processed information. In particular, systems with more 
than three integrations in series tend to be beyond the lim¬ 
its of manual control. For systems such as submarines, 
which have this feature, the technique of quickening has 
been developed, in which the signal displayed to the 
operator is a weighted sum of signals from various points 
in the series of integrations. Another feature of man as 
a controller is his ability to carry out predictive and 
feedforward control functions. This is a rather character¬ 
istic feature of operator control. 

Much work has been done on displays, in terms both of 
detailed design of dials, etc., and of the display layout, and 


it is perhaps this aspect which the engineer most readily 
identifies as human factors. Particularly relevant here is 
the classification of the uses of displays (Murrell, 1965a). 
These are: 

(1) Indicating, that is the operator perceives one of two 
binary states. 

(2) Quantitative reading, that is the operator requires a 
precise numerical value. 

(3) Check reading, that is the operator requires con¬ 
firmation that value lies within an acceptable range. 

(4) Setting, that is the operator manipulates his machine 
controls in order to achieve a predetermined display 
state. 

(5) Tracking, that is the operator carries out an on-going 
control task in order to achieve certain display condi¬ 
tions which may vary as a function of time. 

These are very different uses and a display which is 
optimal for one is not necessarily so for another. There is 
some work which suggests that some 75% of industrial 
applications is accounted for either by check reading 
alone or by check reading and setting combined (Murrell, 
1952b). 

The acquisition of information from large display lay¬ 
outs is another important problem. Work in this area tends 
to emphasize the value to the operator of being familiar 
with the position of dials which give particular readings. 
Such spatial coding is lost, for example if the same instru¬ 
ment is used to display different variables at different 
times. The operator then has to devote more effort to find¬ 
ing out which variable is on a particular display and he is 
less able to recognize patterns. 

Control-display relations can be important. In a given 
culture, there tend to be expectations of particular rela¬ 
tions between control movements and display readings. 
A typical stereotype of a control-display relation is shown 
in Figure 14.2. Although an operator can he trained to use 
equipment that embodies faulty control-display relations 
in its design, he may tend under stress to revert to the 
expected relation. Violation of the stereotype can result in 
severe penalties. 

Monitoring, signal detection and vigilance is another 
related and important area on which a large amount of work 
has been done. Some of this has been concerned with the 
fall-off in attention over the watch-keeping period, that is 
the vigilance effect. The application of this to process con¬ 
trol is doubtful, but perhaps more relevant is the well- 
established relation between the frequency of a signal and 



Figure 14.2 Expected relationships between control 
and display movements (E. Edwards and Lees, 1973) 
(Courtesy of the Institution of Chemical Engineers) 
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the probability of its detection. The probability of detection 
of a rare signal is rather low. This has been studied both in 
dial monitoring and in inspection tasks. 

The problems of man-computer systems have been stu¬ 
died quite extensively. These include allocation of function 
between man and machine, man-computer interaction and 
man-computer problem-solving. For many functions the 
emphasis has moved away from early attempts at complete 
automation towards computer-assisted operator decision¬ 
making. 

This rather brief survey is intended to show that the 
problems with which human factors deals are very relevant 
to process control by the human operator. These and other 
topics such as learning and training, organizational and 
social factors, and human error are now considered more 
specifically in relation to process control. 

14.3.1 Human factors in process control 

The task of process control is of interest to workers in 
human factors as an example of a task involving cognitive 
rather than manipulative skills and was the subject of a 
series of early classic studies by Crossman. Since then there 
have been numerous investigations of the process control 
task. This work is described below. 

A review of the control of processes by operators and 
computers is given in Man and Computer in Process Control 
and some of the classic papers on the process operator are 
collected in The Human Operator in Process Control, both by 
E. Edwards and Lees (1973,1974). 


14.4 Process Operator Functions 

The job of the process operator has developed over the 
years from one based largely on manual work to one con¬ 
sisting primarily of decision-making. The physical work 
content is now frequently vestigial. 

The process operator is part of the control system. The pri¬ 
mary functions of the control system and, therefore, of the 
operator, depend on the nature of the process. In a chlorine 
cellroom, it may be the monitoring of alarm conditions, and in 
a batch reactor plant the conduct of sequential operations. 

The nature of the control system provided also influences 
strongly the operator’s functions. The stages of develop¬ 
ment of control systems have already been described in 
Chapter 13. The job of the operator is generally different in 
systems based on analogue and on computer control. The 
job of the process operator, at least in the control room, is 
essentially decision-making in a rather artificial situation, 
involving the manipulation of symbolic displays. 

If the process control task as a whole is considered, 
a number of distinct operator functions may be identified 
(E. Edwards and Lees, 1973; Lees, 1974c): 

(1) goal formulation; 

(2) measurement; 

(3) data processing and handling; 

(4) monitoring; 

(5) single variable control; 

(6) sequential control; 

(7) other control; 

(8) optimization; 

(9) communication; 

(10) scheduling; 

(11) manual operations. 


These functions have been discussed in detail by E. Edwards 
and Lees (1973). Although most process control tasks have 
elements of all these functions, the relative importance 
varies widely. 

The state of the process also affects the operator’s task. 
If process conditions are abnormal, he has the crucial 
function of fault administration. In simple terms, this 
may be regarded as having three stages: (1) fault detection, 

(2) fault diagnosis and (3) fault correction. But this can be 
an oversimplification, in that following fault detection the 
priority is often to move to a safe condition rather than to 
diagnose the fault. As control systems achieve increasing 
automation, the function of fault administration tends to 
grow in importance. It is a crucial one in relation to loss 
prevention. 

14.5 Process Operator Studies 

In a review in 1974 of studies of the process operator, Lees 
(1974c) listed some 140 items. This list was limited to work 
directly concerned with the process operator and did not 
include work on more general but related problems such as 
vigilance or manual control. There exists, therefore, a quite 
substantial body of work on the process operator and 
his problems, although it is not well known among engi¬ 
neers. Selected studies of the process operator are given in 
Table 14.4. Some of the salient points from these studies are 
now considered. 

It may be mentioned at this point that the compilation of 
this list appears to have coincided with the end of that 
phase in the development of human factors in which studies 
were conducted of the process operator per se. Subsequent 
research has been directed rather to specific tasks, parti¬ 
cularly fault diagnosis, to methodologies such as task 
analysis and to training. 

Much of the pioneering work on the process operator was 
initiated by Crossman and his co-workers. His interest in 
process control was that it is a good example of an indus¬ 
trial skill that is predominantly cognitive rather than phy¬ 
sical. Crossman (1960) did an investigation of a number of 
process control tasks and concluded that it is particularly 
difficult to control the following processes: 

(1) where several display and control variables depend on 
one another; 

(2) where the process has a long time constant; 

(3) where important variables have to be estimated by the 
operator rather than measured by an instrument; 

(4) where the readings of instruments at widely separated 
points have to be collated, and the operator has to 
remember one while going to another (‘short-term 
memory’); 

(5) where the operator gets imperfect knowledge of the 
results of his performance, or where the knowledge 
arrives late; 

(6) where the basic process is either difficult to visualize, 
for example chemical reactions, or contradicts 
‘common-sense’ assumptions, or is too complicated to 
be held in mind at one time. 

One aspect of process control skill, which was investigated 
by Crossman and his colleagues is information sampling 
(Crossman, Cooke and Beishon, 1964). The information 
sampling behaviour of the operator was studied in the labora¬ 
tory task of controlling the temperature of a water bath 
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Table 14.4 Selected studies of the process operator 


Author 

Subject of study 

Type of study 

Hiscock (1938) 

Selection tests for process operators 

Industrial study 

Crossman (1960) 

Process control task and skill in plants of different types 

Industrial study 

Kitchen and Graham (1961) 

Decision-making and mental load of process operators in 

50 chemical plants 

Industrial study 

Crossman and Cooke (1962) 

Manual control by process operator 

Experimental 
laboratory study 

Sell, Crossman and 

Box (1962) 

Evaluation of human factors aspects of control system of 
hot strip mill 

Industrial study 

Spencer (1962) 

Manual control by process operator on liquid washing 
plant 

Experimental in-plant 
study 

Crossman, Cooke and 

Beishon (1964) 

Information sampling by process operator 

Experimental 
laboratory and in- 
plant studies 

Vander Schraaf and 

Acceptability of process computer to process operator 

Industry study 

Strauss (1964) 

Bernard and Wujkowski 

Acceptability of process computer to process operator 

Industry study 

(1965) 

CEGB (1966) 

Evaluation of human factors aspects of control room of 
nuclear reactors 

Industry study 

Sinclair et al. (1966) 

Evaluation of human factors aspects of control room of 
Linz-Donau (LD) converter waste heat boilers 

Industrial study 

Beishon (1967) 

Manual control by process operator on paper machine 

Experimental in-plant 
study 

Davies (1967) 

Selection tests for process operators 

Industrial study 

Bainbridge etal. (1968); 

Decision-making by process operator in scheduling 

Experimental 

Bainbridge (1971,1972, 

electric arc furnaces 

simulation study 

1974) 

Crawley (1968) 

Allocation of function between process operator and 
process computer and computer graphic displays for 
process operator on LD converter 

Industrial study 

Munro, Martin and Roberts 
(1968) 

Workload of process operator 

Experimental 
simulation study 

Rasmussen (1968a-c, 1971, 

Control and surveillance by process operator, displays for 

Experimental, 

1973,1974,1976a,b, 1977, 

process operator, fault diagnosis by process operator, 

industrial and general 

1978); Rasmussen and 

reliability of process operator 

studies 

Goodstein (1972); 

Rasmussen and Jensen 
(1973); Goodstein etal. 

(1974); Rasmussen and 

Taylor (1976) 

Beishon (1969) 

Manual control and decision-making by process operator 
on baking ovens 

Experimental in-plant 
studies 

Whitfield (1969) 

Evaluation of human factors aspects of control room of 
nuclear reactor 

Industrial study 

Attwood (1970) 

Manual control by process operator on paper machine 

Experimental 
laboratory and in- 
plant studies 

Engelstad (1970) 

Social and organizational features in process control in 
paper mill 

Experimental in-plant 

Ketteringham, O’Brien and 

Computer-aided scheduling by process operator in steel 

Experimental 

Cole (1970); 

mill soaking pits 

simulation study 

Ketteringham and 

O’Brien (1974) 

Annett etal. (1970); Duncan 
(1974); Duncan and Gray 

Task analysis and training for process control tasks 

Experimental in-plant 
studies 

(1975); Duncan and 

Shepherd (1975a, b) 

Daniel, Puffier and 

Strizenec (1971) 

Mental load of process operator in four chemical plants 

Experimental in-plant 
studies 

de Jong and Koster (1971) 

Process operator in computer-controlled refinery 

Review 

Anyakora and Lees (1972a) 

Detection of instrument malfunction by process operator in 
chemical plants 

Experimental in-plant 
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Table 14.4 (continued) 
Dallimonti (1972,1973) 

E. Edwards and Lees (1973, 
1974) 

Lees (1973a, 1976a) 

Duncan (1974); Duncan and 
Gray (1975); Duncan and 
Shepherd (1975a,b); 
Shepherd (1976); 
Shepherd etal. (1977) 
Kragt and Landeweerd 
(1974) 


Design of man-computer interface and acceptability of 
process computer to process operator 
The human operator in process control, including process 
computer systems 

Design for human reliability and human reliability 
assessment in process control 
Training of process operator in fault diagnosis 


Manual control and surveillance by process operator 


West and Clark (1974) Information display for and manual control and fault 

administration by process operator in computer- 
controlled pilot plant 

Brigham and Laios (1975) Manual control by process operator 


Lees and Sayers (1976) Emergency behaviour of process operator 


Industrial study 

Review 

Review 

Experimental in-plant 
studies 


Experimental 
laboratory and 
in-plant studies 
Experimental in-plant 

Experimental 
laboratory study 
Experimental 
simulation study 


and the industrial one of controlling the basis weight on a 
paper machine. It was found that the Shannon-Wiener 
sampling theorem did give a basic minimum sampling rate, 
provided a system bandwidth modified for error tolerance 
was used. But many other factors were identified which 
tend to increase the sampling rate. Sampling behaviour 
depends on the operator’s uncertainty and its growth over 
time and on the cost of sampling, and it cannot be separated 
from the control problem, which raises questions of the 
control accuracy required, the penalty for error, the opera¬ 
tor’s understanding of the system, the nature and predict¬ 
ability of the disturbances and the lags in the process. Five 
factors were identified as governing the sampling rate: 
(1) bandwidth, (2) noise, (3) tolerance, (4) predictability and 
(5) control calibration. 

Bandwidth is a function of the maximum possible rate of 
change of the signal. Noise on the signal causes excursions 
of the signal near the tolerance limit. Tolerance limits 
depend on the importance of the variable, its possible rate 
of change and the signal noise. Predictability of the signal 
allows extrapolation and reduces the need for sampling. 
Control calibration, which gives the relation between the 
change of the manipulated variable and that of the con¬ 
trolled variable, assists predictability. 

In the light of this work the authors criticized the use of 
displays which show only a deviation between the set point 
and a measured value. Such displays greatly reduce the 
operator’s ability to learn the signal characteristics such as 
noise, predictability and control calibration. This problem 
has also been considered by de Jong and Koster (1971) in 
terms of the sampling of information from chart recorders. 

Crossman and his colleagues also studied manual con¬ 
trol of the laboratory water bath and the paper machine 
(Crossman and Cooke, 1962; Beishon, 1967). The control 
action required in both cases was to bring the system to a 
new operating point. The work showed that a good subject 
often begins with a closed-loop strategy that tends to pro¬ 
duce the oscillatory response shown in Figure 14.3, but 
soon learns to use an open-loop approach, limiting the use 
of feedback to fine tuning as in Figure 14.3(b). 



Figure 14.3 Change of operating point in a manually 
controlled system: (a) closed-loop behaviour; (b) open- 
loop behaviour 


Similar work has been done by Attwood (1970), also on a 
laboratory water bath and a paper machine, by Kragt and 
Landeweerd (1974) on a laboratory heater and by B. West 
and Clark (1974) on a distillation column in a computer- 
controlled pilot plant. This work further confirms the imp¬ 
ortance of the open-loop strategy. 

Crossman also raised the question of the operator’s 
mental model of the process and investigated the difference 
in performance between subjects who were given an 
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account of the physics of the plant and those who were 
simply told to control calibration settings. The performance 
of the former was much less effective. He concluded that 
the results cast some doubt on the practice of instructing 
operators in the physics and chemistry of the process. 
Similar results were obtained byAttwood and by Kragt and 
Landeweerd. 

Brigham and Laios (1975) have studied manual control 
of level in a laboratory rig consisting of three tanks in 
series, with interaction between the levels. The tanks 
were glass, so that the operator also had feedback of infor¬ 
mation from intermediate points in the process. Cross¬ 
correlation of his control manipulations with level error 
showed little correlation between the two, indicating that 
the control was based on predictive rather than feedback 
strategy. 

The effect of the number and types of lag in the process 
has also been studied. Crossman and Cooke added further 
lags to their laboratory apparatus by putting additional 
sheaths round the thermometer and found that control 
became more difficult and response was more oscillatory. 
Attwood introduced dead time into his water bath and found 
a similar effect. Control behaviour on paper machines 
observed by Crossman, Cooke and Beishon and byAttwood 
shows similar oscillatory responses. 

Manual control of a liquid washing plant has been stud¬ 
ied by Spencer (1962). This work highlighted the difficul¬ 
ties of control in the absence of feedback of information on 
the results of control actions and the wide differences 
between operators in terms of the control gain which they 
employ. 

The mental load on the operator has been studied by 
Kitchin and Graham (1961) in an investigation covering 
some 50 plants. The decision-taking load was analysed 
under the following five headings: (1) number of factors in 
the situation; (2) complexity of comprehension of each 
factor; (3) memory; (4) interdependence of factors and 
(5) delay characteristics of situation. This is somewhat 
similar to Crossman’s description of the factors which 
make process control difficult, as described earlier. 

Another study which involved sampling of the operator’s 
activities and assessment of the mental workload imposed 
by the work is that done by Daniel, Puffier and Strizenec 
(1971) on four chemical plants. The Monte Carlo simulation 
of the workload on the operator has been described by 
Munro, Martin and Roberts (1968). 

There have been a number of studies by ergonomists of 
industrial control rooms. Examples are those of a hot strip 
mill by Sell, Crossman and Box (1962), of an Linz-Donau 
(LD) converter waste heat boiler control room by Sinclair 
et al. (1966) and of nuclear power station control rooms by 
the Central Electricity Generating Board (1966) and by 
Whitfield (1969). 

Decision-making by the operator has been investigated 
by Bainbridge et al. (1968) in a simulation study of electric 
arc furnace scheduling. A running commentary, or verbal 
protocol, was given by the subjects as they performed the 
task and has since been analysed in detail by Bainbridge 
(1971, 1972, 1974). This analysis identifies subroutines 
which the operator uses and attempts to describe the 
executive programme which organizes these. 

An important aspect of this work is the light which it 
throws on the way in which the operator keeps track of the 
state of the process and so updates his mental model of it. In 
general, he tends to predict the future of the process state 


and then subsequently samples only enough readings to 
confirm that his prediction was correct. This is in line with 
other work such as that of Crossman, Cooke and Beishon 
(1964) referred to earlier. This work has significant impli¬ 
cations for displays. Good display facilities allow the 
operator to survey the state of the process as a whole with 
minimum effort. 

The advent of the process computer has brought pro¬ 
found changes in the work of the operator. A number of 
investigations have been done (e.g. Vander Schraaf and 
Strauss, 1964; Bernard and Wujkowski, 1965) on the reac¬ 
tion of process operators to computers. Another such study 
is that by Dallimonti (1972,1973), which was particularly 
concerned with the design of computer facilities. 

The problem of system objectives and allocation of func¬ 
tion in computer control of a basic oxygen furnace has been 
discussed by Crawley (1968). He gives as an example of a 
function that is more appropriately allocated to man the 
interpretation of the noise signal given by a bomb thermo¬ 
couple. The point is also made, however, that the optimal 
allocation of function changes continuously as technology 
progresses. 

The difficulty of automating certain functions is further 
illustrated by the work of Ketteringham, O’Brien and Cole 
(Ketteringham, O’Brien and Cole, 1970; Ketteringham and 
O’Brien, 1974) on the scheduling of soaking pits using a 
man-computer interactive system. Problems of providing 
all the necessary information to the computer and of com¬ 
plexity in the decision-making make it difficult to automate 
this function, but it is possible to provide computer facil¬ 
ities, which by storage of large amounts of information, the 
use of predictive models and the provision of appropriate 
displays, greatly assist the operator to make decisions. The 
work involved simulation using a realistic interface and 
actual steel works schedulers. The problem is very similar 
to that of air traffic control, which has been extensively 
investigated in human factors. 

The importance of organizational and social factors is 
shown by the work of Engelstad (1970), who investigated 
these in a paper mill. The work revealed that individuals 
tended to operate too much in isolation and to have goals that 
were not necessarily optimal as far as the system was con¬ 
cerned. It sought to encourage communication by treating 
the control room as an information and control centre, which 
all concerned should use, and by designing jobs to give 
greater variety, responsibility, learning opportunity and 
wholeness. Other workers too have commented on the losses 
that can occur in continuous flow processes, if there are poor 
relationships between the men controlling the process at 
different points. 

Other studies have been concerned with task analysis, 
fault administration, displays, selection and training and 
human error. These topics are considered below. 

14.6 Allocation of Function 

As already emphasized, human factors has at least as impor¬ 
tant a role to play in matters of system design, such as 
allocation of function as in those of detailed design. The 
classic approach to allocation of function is to list the 
functions which machines perform well and those which 
men perform well and to use this as a guide. One of the 
original lists was compiled by Fitts (1962) and such a list is 
often referred to as a ‘Fitts’ list’. However, this approach 
needs some qualification. As Fitts pointed out later, the 
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functions which should be allocated to man are not so 
much those which he is good at as those which it is best 
from the system point of view that he perform, which is 
slightly different. The question of motivation is also 
important. De Jong and Koster (1971) have given a similar 
type of list showing the functions which man is motivated 
to perform. Further accounts of allocation of function is 
given by H.E. Price (1985) and Kantowitz and Sorkin (1987). 
Particularly important in relation to loss prevention are 
functions concerned with fault administration, fault 
diagnosis, plant shut-down and malfunction detection. 

14.7 Information Display 

Once the task has been defined, it is possible to consider the 
design of displays. Information display is an important 
problem, which is intensified by the increasing density of 
information in modern control rooms. The traditional dis¬ 
play is the conventional control panel. Computer graphics 
now present the engineer with a more versatile display 
facility, offering scope for all kinds of display for the 
operator, but it is probably fair to say that he is somewhat 
uncertain what to do with it. 

The first thing that should be emphasized is that a dis¬ 
play is only a means to an end, the end being improved 
performance by the operator in executing some control 
function. The proper design of this function in its human 
factors aspects is more important than the details of the 
display itself. Some types of display that may be provided 
are listed in Table 14.5. 

The provision of displays that the operator deliberately 
samples with a specific object in view is only part of the 
problem. It is important also for the display system to cater 
both for his characteristic of acquiring information ‘at a 
glance’ and for his requirement for information redundancy. 
There is a need, therefore, for the development of displays 
that allow the operator to make a quick and effortless survey 
of the state of the system. As already described, the operator 
updates his knowledge of system state by predicting 


Table 14.5 Some displays for the process operator 


Displays of flow and mimic diagrams 
Displays of current measurements, other variables, 
statuses (other variables include indirect measurements, 
valve positions, etc.) 

Displays of trends of measurements, other variables, 
statuses 

Displays of control loop parameters 
Displays of alarms 

Displays of reduced data (e.g. histograms, quality control 
charts, statistical parameters) 

Displays of system state (e.g. mimic diagrams,‘status 
army’,‘surface’ and polar plots) 

Displays for manual control (e.g. predictive displays) 

Displays for alarm analysis 

Displays for sequential control 

Displays for scheduling and game-playing 

Displays for valve sequencing 

Displays for protective system checking 

Displays of maloperation 

Displays for malfunction detection 

Command displays 


forward, using a mental model of the process and sampling 
key readings to check that he is on the right lines. He needs a 
survey display to enable him to do this. 

This need still exists even where other facilities are pro¬ 
vided. Facilities, such as alarm systems are based on a 
‘management by exception’ approach, which is essential if 
thelarge amounts of information are tobehandled. But when 
the exceptional condition has been detected, the operator 
must deal with it and for this he needs knowledge of the state 
of the process, which a survey display provides. A display 
of system state also allows the operator to use his ability 
to recognize patterns. This aspect is considered below. 

14.7.1 Regular instrumentation 

It will be apparent from the foregoing that the conventional 
control panel has certain virtues. The panel shown in 
Figure 14.4 is typical of a modern control panel. The con¬ 
ventional panel does constitute a survey display, in which 
the instruments have spatial coding, from which the 
operator can obtain information at a glance and on which he 
can recognize patterns. These are solid advantages not to be 
discarded lightly. This is only true, however, if the density 
of information in the panel is not allowed to become too 
great. The advantages are very largely lost if it becomes 
necessary to use dense blocks of instruments which are 
difficult to distinguish individually. 

An important individual display is the chart recorder. 
A trend record has many advantages over an instantaneous 
display. As the work of Crossman, Cooke and Beishon (1964) 
shows, it assists the operator to learn the signal charac¬ 
teristics and facilitates his information sampling. Both 
Attwood (1970) and B. West and Clark (1974) found that 
recorders are useful to the operator in making coarse 
adjustments of operating point, while the latter authors also 
noted the operator’s use of recorders in handling fault con¬ 
ditions. Anyakora and Lees (1972a) have pointed out the 
value of recorders in enabling the operator to learn the 
signal characteristics and so recognize instrument mal¬ 
functions. 

14.7.2 Computer consoles 

The computer console presents a marked contrast to con¬ 
ventional instrumentation. This is illustrated with parti¬ 
cular starkness in Figure 14.5(a), which shows the console 
of the original ICI direct digital control (DDC) computer. 
Some of the features of ergonomic importance in this panel 
are: (1) specific action is required to obtain a display; 
(2) there is no spatial coding and the coding of the infor¬ 
mation required has to be remembered or looked up; (3) only 
one variable is displayed at a time; (4) only the instanta¬ 
neous value of the variable is displayed and (5) the pres¬ 
entation is digital rather than analogue. 

This is a revolutionary change in the operator’s interface. 
While there is, among engineers, a general awareness 
that the change is significant, its detailed human factors 
implications are not so well appreciated. The subsequent 
refinement of process computer consoles and the introduc¬ 
tion of computer graphics have somewhat mitigated these 
features. A more modern computer console is shown in 
Figure 14.5(b). Moreover, the facilities that the computer 
offers in functions such as alarm monitoring or sequential 
control are powerful new aids to the operator. 

It remains true, however, that the transition from the 
conventional panel to the computer console involves some 






14/12 HUMAN FACTORS AND HUMAN ERROR 



- Moooooo o?oS‘ B -■ 


1 V 


•CCocccccc 


Mg 

S -Ji t £J 22 222 SCSI 


cc 


Figure 14.4 Control panel in a chemical plant (Courtesy of Kent Instruments Ltd) 
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serious human factors losses, particularly in information 
display.Thisdoesnotnecessarilymeanthatthechange should 
notbemade.Conventionalpanelsareexpensiveandlosemuch 
of their advantage if the information density becomes too 
high. Computers offer some very worthwhile additional 
facilities. But the change should at least be made in the full 
awareness of its implications and with every effort to restore 
in the new system the characteristic advantages of the old. 


14.8 Alarm Systems 

As stated in the previous chapter, the progress made in the 
automation of processes under normal conditions has 
focused attention on the monitoring and handling of 
abnormal or fault conditions. It is the function of the control 
system to prevent, if possible, the development of condi¬ 
tions which will lead to plant shut-down, but to carry out 
the shut-down if necessary. The responsibility for averting 
shut-down conditions falls largely to the operator. The 
principal automatic aid provided to assist him is the alarm 
system. Alarm systems are an extremely important but 
curiously neglected and often unsatisfactory aspect of 
process control. 

An alarm system is a normal feature of conventional 
control systems. If a process variable exceeds specified 


limits or if an equipment is not in a specified state, an alarm 
is signalled. Both audible and visual signals are used. 

Accounts of alarm systems include those by E. Edwards 
and Lees (1973), Andow and Lees (1974), Hanes (1978), Swain 
and Guttman (1983), Schellekens (1984), Shaw (1985) and 
the Center for Chemical Process Safety (CCPS, 1993/14). 
There have also been investigations of the operation of alarm 
systems, as described below. 

14.8.1 Basic alarm systems 

The traditional equipment used for process alarms is a 
lightbox annunciator. This consists of a fascia, or array, of 
separate small rectangular coloured glass panels, behind 
each of which there is a lamp that lights up if the alarm is 
active. Each panel is inscribed with an alarm message. The 
panels are colour coded, usually with red being assigned 
the highest priority. This visual display is complemented 
by a hooter. When a new alarm occurs, the hooter sounds 
and the fascia light flashes until the operator acknowledges 
receipt by pressing a button. The panel then remains lit 
until the alarm condition is cleared by operator action or 
otherwise, as described below. 

There are a number of variations on this basic system. An 
account of some of these is given by Kortland and 
Kragt (1980a). One is a two-level hierarchical arrangement 
in which there is a central fascia and a number of local 



Figure 14.5(a) Control panel of the direct digital control (DDC) computer on ICIs ammonia soda plant at Fleetwood, 
1961 (Courtesy of Ferranti Ltd and Imperial Chemical Industries Ltd) 







14/14 HUMAN FACTORS AND HUMAN ERROR 



Figure 14.5(b) Control panel and display of Foxboro Intelligent Automation computer system 
(Foxboro Company Ltd) 


fascias, the light on the former indicating the number of the 
local fascia on which the alarm has occurred. These authors 
also describe hierarchical systems with additional levels. 
Another arrangement is a mimic panel with alarms located 
at the relevant points on the flow diagram. 

In computer-controlled systems alarms are generally 
printed out on hard copy in the time sequence in which they 
occur and are also displayed on the VDU. On the latter there 
are numerous display options, some of which are detailed 
by Kortlandt and Kragt. One is the use of a dedicated VDU 
in which the alarms come up in time sequence, as on the 
printer. Another is a group display in which all the alarms 
on an item of equipment are shown with the active 


alarms(s) highlighted. Another is a mimic display akin to 
the hardwired mimic panel. 

The occurrence of an alarm is normally accompanied 
by an audible warning in the form of the sounding of the 
hooter and a visual warning in the form of a flashing light. 
On a computer system, the sound of the printer serves as 
another form of audible signal. The operator ‘accepts’ the 
alarm by depressing the appropriate pushbutton. 

Annunciator sequences are given in ISA Std S18.1:1975 
Annunciator Sequences and Specifications, which recognizes 
three types: (1) automatic reset (A), (2) manual reset (M) and 
(3) ringback (R). Automatic reset returns to the normal 
state automatically once the alarm has been acknowledged 
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and the process variable has returned to its normal state. 
Manual reset is similar except that return to the normal state 
requires operation of the manual reset pushbutton. Ring- 
back gives a warning, audible and/or visual, that the process 
condition has returned to normal. 

There are alarms on the trips in the Safety Interlock 
System (SIS). Operation of a trip is signalled by an alarm. 
The SIS alarm system, like the rest of the SIS, should be 
separate from the basic process control system (BPCS). 

In a conventional instrument system, the hardware used 
to generate an alarm consists of a sensor, a logic module 
and the visual display. The sensor and the logic elements 
may be separate or may be combined in an alarm switch. 
Such combined switches are referred to as flow switches, 
level switches and so on. 

In a computer-based system there are two approaches 
that may be used. In one, the computer receives from the 
sensor an analogue signal to which the program applies 
logic to generate the alarm. In the other, the signal enters in 
digital form. The latter can provide a cheaper system, but 
reduces the scope for detection of instrument malfunction. 

Some basic requirements for an alarm are that it attracts 
the attention of the operator, that it be readily identifiable 
and that it indicate unambiguously the variable which has 
gone out of limit. 


14.8.2 Alarm system features 

As just described, an alarm system is a normal feature of 
process computer control. The scanning of large numbers 
of process variables for alarm conditions is a function 
very suitable for a computer. Usually the alarm system 
represents a fairly straightforward translation of a con¬ 
ventional system on to the computer. Specified limits of 
process variables and states of equipment are scanned and 
resulting alarms are displayed on a typewriter, necessarily 
in time order, and also on a VDU, where time order is one of 
a number of alarm display options. 

The process computer has enormous potential for the 
development of improved alarm systems, but also brings 
with it the danger of excess. There is first the choice of vari¬ 
ables which are to be monitored. It is no longer necessary 
for these to be confined to the process variables measured by 
the plant sensors. In addition, ‘indirect’ or ‘inferred’ meas¬ 
urements calculated from one or more process measure¬ 
ments may be utilized. This considerably increases the 
power of the alarm system. 

Then there are a number of different types of alarm 
which may be used. These include absolute alarms, relative, 
deviation or set-point alarms, instrument alarms and rate- 
of-change alarms, in which the alarm limits are, respec¬ 
tively, absolute values of the process variable, absolute or 
proportional deviations of the process variable from the 
loop set-point, zero or full-scale readings of the instrument 
and rate of change of the process variable. 

The level at which the alarm limits are set is another 
important feature. Several sets of alarm limits may be put 
on a single variable to give different degrees of alarms such 
as early warning, action or danger alarms. The alarms so 
generated may be ordered and displayed in various ways, 
particularly in respect of the importance of the variable 
and the degree of alarm. 

The conventional alarm system, therefore, is severely 
limited by hardware considerations and is relatively inflex¬ 
ible. The type of alarm is usually restricted to an absolute 


alarm. The computer-based alarm system is potentially 
much more versatile. 

The alarm system, however, is frequently one of the least 
satisfactory features of the control system. The most com¬ 
mon defect is that there are too many alarms and that they 
stay active for too long. As a result, the system tends to 
become discredited with the operator, who comes to dis¬ 
regard many of the alarm signals and may even disable the 
devices which signal the alarms. 

Computer-based alarm systems also have some faults 
peculiarly their own. It is fatally easy with a computer to 
have a proliferation of types and degrees of alarm. More¬ 
over, the most easily implemented displays, such as time- 
ordered alarms on a typewriter or a VDU, are inferior to 
conventional fascias in respect of aspects such as pattern 
recognition. 

The main problem in alarm systems is the lack of a clear 
design philosophy. Ideally, the alarm system should be 
designed on the basis of the information flow in the plant 
and the alarm instrumentation selected and located to 
maximize the information available for control, bearing in 
mind instrumentation reliability considerations. In fact, an 
alarm system is often a collection of subsystems specified 
by designers of particular equipment with the addition of 
some further alarms. 

An alarm system is an aid for the operator. An important 
but often neglected question is therefore what action he is 
required to take when an alarm is signalled. 

There are also specific problems which cause alarms to be 
numerous and persistent. One is the confusion of alarms and 
statuses. A status merely indicates that an equipment is in a 
particular state, for example that an agitator is not running. 
An alarm, by contrast, indicates that an equipment is in a 
particular state and should be in a different one, for example, 
that an agitator is not running but should be. On most plants 
there are a number of statuses that need to be displayed, but 
there is frequently no separate status display and so the alarm 
display has to be used. As a result, if a whole section of plant 
is not in use, a complete block of alarms may be permanently 
up on a display, even though these are not strictly alarm 
conditions. The problem can be overcome by the use of sepa¬ 
rate types of display, for example yellow for alarms, white for 
statuses, in conventional systems and by similar separate 
displays in computer systems, but often this is not done. 

A somewhat similar problem is the relation of the alarms 
to the state of the process. A process often has a number of 
different states and a signal which is an alarm in one state, 
for example normal operation, is not a genuine alarm in 
another, as with, say, start-up or maintenance. It may be 
desirable to suppress certain alarms during particular 
states. This can be done relatively easily with a computer 
but not with a conventional system. It should be added, 
however, that suppression of alarms needs to be done with 
care, each case being considered on its merits. 

On most plants there is an element of sequential control, 
for example start-up. As long as no fault occurs, control of 
the sequence is usually straightforward, but the need to 
allow for faults at each stage of the sequence can make 
sequential control quite complex. With sequential opera¬ 
tions, therefore, the sequential control and alarm systems 
are scarcely separable. A computer is particularly suitable 
for performing sequential control. 

The state of the art in alarm system design is not 
satisfactory, therefore. In conventional systems this may be 
ascribed largely to the inflexibility of the hardware, but the 
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continuance of the problem in computer systems suggests 
that there are also deficiencies in design philosophy. 

The process computer provides the basis for better alarm 
systems. It makes it possible to monitor indirect measure¬ 
ments and to generate different types and degrees of alarm, 
to distinguish between alarms and statuses and to adapt 
the alarms to the process state. It is also possible to provide 
more sophisticated facilities such as analysis of alarms, as 
described below. However, there is scope for great improve¬ 
ment in alarm systems even without the use of such advanced 
facilities. 

14.8.3 Alarm management 

It will be apparent from the foregoing that in many systems 
some form of alarm management is desirable. Alarm man¬ 
agement is discussed by the CCPS (1993/14). Approaches 
to the problem include (1) alarm prioritization and segrega¬ 
tion, (2) alarm suppression and (3) alarm handling in 
sequential operations. 

Alarms may be ranked in priority. The CCPS suggests a 
four level system of prioritization in which critical alarms 
are assigned to Level 1 and important but non- critical alarms 
to Level 2, and so on.The alarms are then segregated by level. 

With regard to alarm suppression, the CCPS describes 
two methods. One is conditional suppression, which may 
be used where an alarm does not indicate a dangerous 
situation and where it is a symptom which can readily be 
deduced from the active alarms. The other is flash sup¬ 
pression, which involves omitting the first stage in the 
alarm annunciation sequence, namely the sounding of the 
hooter and flashing of the fascia lamp. Instead, the alarm is 
shown illuminated, as if already acknowledged. 

As already discussed, sequential operations such as 
plant start-up tend to activate some alarms. With a computer- 
based system arrangements may be made for appropriate 
suppression of alarms during such sequences. 

Alarm management techniques need to be approached 
with caution, taking account of the overall information 
needs of the operator, of the findings of research on the 
operation of alarm systems and of other factors such as the 
fact that an alarm which is less important in one situation 
may be more so in another. 

14.8.4 Alarm system operation 

Studies of the operation of process alarm systems have 
been conducted by Seminara, Gonzalez and Parsons (1976) 
and Kragt and co-workers (Kortlandt and Kragt, 1980a,b; 
Kragt, 1983,1984a,b; Kragt and Bonten, 1983; Kragt and 
Daniels, 1984). 

The work of Seminara, Gonzalez and Parsons (1976) was a 
wide-ranging study of various aspects of control room 
design. On alarms, two features foundby these authors are of 
particular interest. One is that, in some cases, the number 
of alarms was some 50-100 per shift, and in one case 100 
in an hour. The other is the proportion of false alarms, for 
which operator estimates ranged from‘occasional’, through 
15% and30%,upto50%. 

Kortland and Kragt (1980a,b) studied five different control 
room situations, by methods including questionnaire and 
observation, two of the principal investigations being in the 
control rooms of a fertilizer plant and a high pressure poly¬ 
ethylene plant. On both plants, the authors identified two 
confusing features of the alarms. One was the occurrence 
of oscillations in which the measured values moved back and 
forth across the alarm limit. The other was the occurrence of 


clusters of alarms. The number of alarms registered on the 
two plants was as follows: 



Fertilizer 

Polyethylene 


plant 

plant 

Observation period (h) 

63 

70 

Single alarms, not occurring 

816 

1714 

during clusters or oscillations 
Single alarms during clusters 

280 a 

325 a 

or oscillations 



Signals during oscillations 

410 a 

NA 

Signals from clusters 

1288 a 

1300 a 

Total 

2794 

3339 

a Estimated from analysis of the data. 



The authors suggest that oscillations can be overcome by 
building in hysterisis, which is indeed the normal approach, 
and that clusters may be treated by grouping and suppres¬ 
sion of alarms. The intervals between successive signals, 

disregarding oscillations and clusters, were 

analysed and 

found to fit a log-normal distribution. The response of the 

operators to the alarms was as follows: 



Fertilizer 

Polyethylene 


plant 

plant 

Signal followed by action (%) 

47 

43 

Action followed by signal (%) 

46 

50 

No action (%) 

7 

7 


Thus about half the alarms were actually feedback cues 
on the effects of action taken by the operators, who in many 
cases would have been disturbed not to receive such a sig¬ 
nal. Further evidence for this is given by the fact that on the 
fertilizer plant 55% of the alarm signals were anticipated. 
On this plant, the operators judged the importance of the 
signals as follows: important 13%, less important 36%, not 
important 43% and unknown 8%. 

Kragt (1984a) has described an investigation of the 
operator’s use of alarms in a computer-controlled plant. The 
main finding was that sequential information presentation 
is markedly inferior to simultaneous presentation. 

14.9 Fault Administration 

As already stated, it is the function of the control system to 
avert the development of conditions which may lead to shut¬ 
down, but if necessary to execute shut-down. Generally, 
there are automatic trip systems to shut the plant down, but 
the responsibility of avoiding this situation if at all possible 
falls to the operator. 

Fault administration can be divided into three stages: 
fault detection, fault diagnosis and fault correction or shut¬ 
down. For the first of these functions, the operator has a job 
aid in the form of the alarm system, while fault correction 
in the form of shut-down is also frequently automatic, but 
for the other two functions, fault diagnosis and fault correc¬ 
tion less drastic than shut-down, he is largely on his own. 

14.9.1 Fault detection 

The alarm system represents a partial automation of fault 
detection. The operator still has much to do, however, in 
detecting faults. This is partly a matter of the additional 










HUMAN FACTORS AND HUMAN ERROR 14/17 


sensory inputs such as vision, sound and vibration that the 
operator possesses. But it is also partly due to his ability to 
interpret information, to recognize patterns and to detect 
instrument errors. 


14.9.2 Fault diagnosis 

Once the existence of some kind of fault has been detected, 
the action taken depends on the state of the plant. If it is 
in a safe condition, the next step is diagnosis of the 
cause. This is usually left to the operator. The extent of 
the diagnosis problem may vary considerably with the 
typeof unit. It has been suggested, for example that whereas 
on a crude distillation unit the problem is quite complex, on 
a hydrotreater it is relatively simple (Duncan and Gray, 
1975a). 

There are various ways in which the operator may 
approach fault diagnosis. Several workers have observed 
that an operator frequently seems to respond only to the 
first alarm which comes up. He associates this with a par¬ 
ticular fault and responds using a rule-of-thumb. This is an 
incomplete strategy, although it may be successful in quite 
a high proportion of cases, especially where a particular 
fault occurs repeatedly. 

An alternative approach is pattern recognition from the 
displays on the control panel. The pattern may be static or 
dynamic. The static pattern is obtained by instantaneous 
observation of the displays, like a still photograph. The 
operator then tries to match this pattern with model patterns 
or templates for different faults. Duncan and Shepherd 
(1975b) have developed a technique for training in fault 
diagnosis in which some operators use this method. The 
alternative, and more complex, dynamic pattern recognition 
involves matching the development of the fault over a period 
of time. 

Another approach is the use of some kind of mental 
decision tree in which the operator works down the paths of 
the tree, taking particular branches, depending on the 
instrument readings. Duncan and Gray (1975a) have used 
this as the basis of an alternative training technique. Yet 
another method is the active manipulation of the controls 
and observation of the displays to determine the reaction of 
the plant to certain signals. Closely related to this is the 
situation where no fault has been detected, but the operator 
is already controlling the process when he observes some 
unusual feature and continues his manipulation to explore 
this condition. 

Whatever approach is adopted by the operator, fault 
diagnosis in the control room is very dependent on the instru¬ 
ment readings. It is therefore necessary for the operator to 
check whether the instruments are correct. The problem of 
checking to detect malfunctions is considered later, but 
attention is drawn here to its importance in relation to fault 
diagnosis. 

These different methods of fault diagnosis have impor¬ 
tant implications for aspects such as displays and training. 
The conventional panel assists the recognition of static 
patterns, whereas computer consoles generally do not. 
Chart recorders aid the recognition of dynamic patterns 
and instrument faults. The question of training for fault 
diagnosis is considered later. 

Fault diagnosis is not an easy task for the operator. There 
is scope, therefore, for computer aids, if these can be 
devised. Some developments on these lines are described 
below. 


14.9.3 Fault correction and shut-down 

When, or possibly before, a fault has been diagnosed, it is 
usually possible to take some corrective action which does 
not involve shutting the plant down. In some cases, the 
fault correction is trivial, but in others, such as operating a 
complex sequence of valves, it is not. Operating instruc¬ 
tions are written for many of these activities, but otherwise 
this is a relatively unexplored area. 

Fault correction is one of the activities for which interlocks 
may be provided. Conventional interlocks were described in 
the previous chapter and developments in computer soft¬ 
ware interlocks are outlined below. 

Some fault conditions, however, require plant shut¬ 
down. Although fault administration has been described in 
terms of successive stages of detection, diagnosis and cor¬ 
rection, in emergency shut-down usually little diagnosis is 
involved. The shut-down action is triggered directly when 
it is detected that a critical process limit has been passed. 

There are differing philosophies on the problem of 
allocation of responsibility for shutting down the plant 
under fault conditions. In some plants, the operator deals 
with fault conditions with few automatic aids and is 
thus required to assure both safety and economic opera¬ 
tion. In others, automatic protective systems are provided 
to shut the plant down if it is moving close to an unsafe 
condition and the operator thus has the economic role of 
preventing the development of conditions which will cause 
shut-down. 

In a plant without protective systems the operator is effec- 
tivelygiventhedutyofkeepingtheplantrunningifhecan,but 
shutting it down if he must. This tends to create in his mind a 
conflict of priorities. Usually, he will try to keep the plant 
running if he possibly can and, if shut-down becomes neces¬ 
sary, he may tend to take action too late. Mention has already 
been made of the human tendency to gamble on beating the 
odds. There are numerous case histories which show the 
dangers inherent in this situation (Lees, 1976b). 

The alternative approach is the use of automatic protec¬ 
tive systems to guard against serious hazards in the plant. 
The choice is made on the basis of quantitative assessment 
of the hazards. This philosophy assigns to the operator the 
essentially economic role of keeping the plant running. 

Although the use of protective systems is rapidly increas¬ 
ing, the process operator usually retains some responsibility 
for safe plant shut-down. There are a number of reasons for 
this. In the first place, although high integrity protective 
systems with 2/3 voting are used on particularly hazardous 
processes (R.M. Stewart, 1971), the majority of trip systems 
do not have this degree of integrity. The failure rate of this 
simple 1/1 trip system has been quoted as 0.67 faults/year 
(Kletz, 1974d). 

Protective systems have other limitations that apply even 
to high integrity systems. One is that it is very difficult to 
foresee and design for all possible faults, particularly those 
arising from combinations of events. It is true, of course, 
that even if a process condition arises from an unexpected 
source a protective system will usually handle it safely. But 
there remains a residual of events, usually of low prob¬ 
ability against which there is no protection, either because 
they were unforeseen or because their probability was 
estimated as below the designer’s cut-off level. 

Another problem is that a protective system is only par¬ 
tially effective against certain types of fault, particularly 
failure of containment. In such an event, the instrumentation 
can initiate blowdown, shut-off and shut-down sequences, 
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but while this may reduce the hazardous escape of materials, 
it does not eliminate it. 

Yet another difficulty is that many hazards occur not 
during steady running but during normal start-up and 
shut-down or during the period after a trip and start-up 
from that condition. A well designed protective system 
caters, of course, for these transitional regimes as well as 
continuous operations. Nevertheless, this remains some¬ 
thing of a problem area. Even with automatic protective 
systems, therefore, the process operator tends to retain a 
residual safety function. His effectiveness in performing 
this is discussed later. 


14.10 Malfunction Detection 

Another aspect of the administration of fault conditions 
by the control system is the detection of malfunctions, parti¬ 
cularly incipient malfunctions in plant equipment and in¬ 
struments. These malfunctions are distinguished from 
alarms in that although, they constitute a fault condition of 
some kind, they have not as yet given rise to a formal alarm. 

Malfunction detection activities are not confined to the 
control system, of course. Monitoring of plant equipment 
by engineers, as described in Chapter 19, is a major area of 
work, usually independent of the control system. Insofar as 
the control system does monitor malfunctions, however, 
this function is primarily performed by the operator. The 
contribution of the computer to malfunction detection is 
considered later. 

Detection of instrument malfunction by the operator 
has been investigated byAnyakora and Lees (1972a). In gen¬ 
eral, malfunction may be detected either from the condition 
of an instrument or its performance. Detection from condi¬ 
tion is illustrated by observation on the plant of a leak on the 
impulse line to a differential pressure transducer or of 
stickiness on a control valve. Detection from performance is 
exemplified by observation in the control room of an exces¬ 
sively noise-free signal from the transducer or of an incon¬ 
sistency between the position of a valve stem and the 
measured flow for the valve. Most checks on instrument 
condition require the operator to visit the equipment and use 
one of his senses to detect the fault. Most performance 
checks can be made from the control room by using instru¬ 
ment displays and are based on information redundancy. 

Some of the ways in which the operator detects mal¬ 
function in instruments are illustrated by considering the 
way in which he uses for this purpose one of his principal 
detection aids - the chart recorder. Some typical chart 
records are shown in Figure 14.6. The operator detects error 
in such signals by utilizing some form of redundant infor¬ 
mation and making a comparison. Some types of redun¬ 
dant information are (1) a priori expectations, (2) past 
signals of instrument, (3) duplicate instruments, (4) other 
instruments and (5) control valve position. 

Thus it may be expected a priori that an instrument 
reading will not go ‘hardover’ to zero or full scale, that it 
will give a ‘live’ rather than a ‘dead’ zero, that it will exhibit a 
certain noise level, that its rate of change will not exceed a 
certain value and that it is free to move within the full scale 
of the instrument. On the basis of such expectations, the 
operator might diagnose malfunction in the signals shown 
in Figures 14.6(b—f). However, the firmness of such expec¬ 
tations may vary with the plant operating conditions. For 
example, during start-up, zero readings on some instru¬ 
ments may be correct. 





Figure 14.6 Typical chart recorder displays of measure¬ 
ment signals (Anyakora and Lees, 1972a): (a) normal 
reading; (b) reading zero; (c) reading constant; (d) reading 
erratic; (e) reading suddenly displayed; (f) reading limited 
below full scale; (g) reading drifting; (h) reading cycling; 

(i) reading with unusual features (Courtesy of the Institution 
of Chemical Engineers) 


It may not be possible to decide a priori what constitutes 
a reasonable expectation. The level of noise, for example 
tends to vary with the individual measurement. In this 
case, the operator must use his knowledge of the range of 
variation of the noise on a particular instrument in the 
past. Thus, Figures 14.6(c) and 14.6(d) might or might not 
indicate malfunction. 

If there is a duplicate instrument, then detection of the 
fact that one of the instruments is wrong is straightfor¬ 
ward, although it may not be possible to say which. How¬ 
ever, duplication is not usual in the normal instrument 
systems that are of primary concern here. On the other 
hand, near duplication is quite common. For example, the 
flow of a reactant leaving a vaporizer and entering two 
parallel reactors may be measured at the exit of both the 
vaporizers and the reactors, and the flow measurement 
systems provide a check on each other. 

What constitutes a reasonable signal may depend on the 
signals given by other instruments. Thus, although a signal 
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that exhibits drift, such as that in Figure 14.6(g), may 
appear incorrect, a check on other instruments may show 
that it is not. 

Some types of variation in a signal, such as a change in 
the noise level, appear easy to detect automatically. Others, 
such as that shown in Figure 14.6(i), are probably more dif¬ 
ficult, especially if their form is not known in advance. 
Here the human operator with his well developed ability to 
recognize visual patterns has the advantage. 

There are a number of ways in which the readings of 
other instruments can serve as a check. Some of these are 

(1) near-duplication, (2) mass and heat balances, (3) flow- 
pressure drop relations and (4) consistent states. This last 
check is based on the fact that certain variables are related 
to each other and at a given state of operation must lie 
within certain ranges of values. 

The position of control valves also provides a means of 
checking measurements. This is most obvious for flow 
measurement but it is by no means limited to this. 

These remarks apply essentially to measuring instru¬ 
ments, but checks can also be developed for controllers 
and control valves. A general classification of instru¬ 
ment malfunction diagnoses by the operator is shown in 
Table 14.6. 

Many of the checks described do not show unambigu¬ 
ously that a particular instrument is not working properly; 
often they indicate merely that there is an inconsistency 
that needs to be explored further. However, this informa¬ 
tion is very important. 

Another kind of information that the operator also uses in 
checking instruments is his knowledge of the probabilities 
of failure of different instruments. He usually knows which 
have proved troublesome in the past. 

The detection of instrument malfunction by the process 
operator is important for a number of reasons. Instrument 
malfunctions tend to degrade the alarm system and intro¬ 
duce difficulties into loop control and fault diagnosis. Their 
detection is usually left to the operator and it is essential for 
him to have the facilities to do this. This includes appro¬ 
priate displays and may extend to computer aids. 

14.11 Computer-based Aids 

There are some functions that the computer can perform 
automatically, whereas there are others which at present 
are performed by the operator, but for which computer 
aids have been, or may be, developed to assist him. Some 
computer-based aids to assist the operator which have been 
described include: 

(1) system state display; 

(2) alarm diagnosis; 

(3) valve sequencing; 

(4) malfunction detection. 

The provision of such an aid is not solely a matter of engi¬ 
neering. There is an essential human factors angle also. 
A facility that is intended to assist the operator to perform a 
particular function, as opposed to replacing him by execut¬ 
ing that function automatically, must conform to the 
requirements of the operator. 

The main account of computer-based aids is given in 
Chapter 30. The treatment at this point is confined to con¬ 
sideration of one particular aid, computer-based alarm 
diagnosis. This, is in its own right, one of the most 


Table 14.6 General classification of methods of 
instrument malfunction detection (Anyakora and Lees, 
1972a) (Courtesy of the Institution of Chemical Engineers) 


Measuring instruments 
Ml Measurement reading zero or full scale 
Ml.l Reading zero 
M1.2 Reading full scale 

M2 Measurement reading noise or dynamic response 
faulty 

M2.1 Reading constant 
M2.2 Reading erratic 
M2.3 Reading sluggish 
M3 Measurements reading displaced suddenly 
M3.1 Reading fell suddenly 
M3.2 Reading rose suddenly 
M4 Measurement reading limited within full scale 
M4.1 Reading limited above zero 
M4.2 Reading limited below full scale 
M5 Measurement reading drifting 
M5.1 Reading falling 
M5.2 Reading rising 

M6 Measurement reading inconsistent with 
duplicate measurement 

M7 Measurement reading inconsistent with one 
other measurement 

M7.1 Reading inconsistent with near-duplicate 
measurement 

M7.2 Reading inconsistent with level-flow 
integration 

M7.3 Reading otherwise inconsistent 
M8 Measurement reading inconsistent with simple 
model 

M8.1 Reading inconsistent with mass balance 
M8.2 Reading inconsistent with heat balance 
M8.3 Reading inconsistent with flow—pressure 
drop relations 

M8.4 Reading otherwise inconsistent 
M9 Measurement reading inconsistent with plant 
operating state 

M9.1 Reading zero but variable not zero 
M9.2 Reading not zero but variable zero 
M9.3 Reading low 
M9.4 Reading high 
M9.5 Reading otherwise inconsistent 
M10 Measurement reading inconsistent with control 
valve position 

M10.1 Reading (flow) zero with valve open 
M10.2 Reading (flow) not zero with valve 

M10.3 Reading otherwise inconsistent 
Mil Measurement reading periodic or cycling 
M12 Measurement reading showing intermittent 
fault 

M13 Measurement reading faulty 
M14 Measurement instrument tested by 
active tests 

M15 Measuring instrument condition faulty 

Control action and controllers 
Cl Control action faulty 
Cl.l Control erratic 
Cl.2 Control sluggish 
C1.3 Control cycling 
C1.4 Control unstable 
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C1.5 Control error excessive 
C1.6 Control otherwise faulty 
C2 Controller performance faulty 

C3 Controller tested by active tests 

C4 Controller condition faulty 

Control valves and valve positioners 
VI Valve position inconsistent with signal to valve 
(this requires independent measurement of 
position) 

V2 Valve position inconsistent with flow (but not 

necessarily flow measurement) 

V2.1 Valve passing fluid when closed 
V2.2 Valve not passing fluid when open 
V2.3 Valve position otherwise inconsistent with 
flow measurement 

V2.4 Valve position inconsistent with one other 
measurement 

V2.5 Valve position inconsistent with simple 

V3 Valve not moving 

V3.1 Valve stays closed 
V3.2 Valve stays open 
V3.3 Valve stays part open 
V4 Valve movement less than full travel 
V4.1 Valve not closing fully 
V4.2 Valve not opening fully 
V4.3 Valve travel otherwise limited 
V5 Valve movement faulty 

V5.1 Valve movement erratic 
V5.2 Valve movement sluggish 
V5.3 Valve movement otherwise faulty 
V6 Valve movement cycling 

V7 Valve or positioner performance faulty 
V8 Valve or positioner tested by active tests 
V9 Valve or positioner condition faulty 


significant aids, but in addition it also illustrates the 
human factors problems which can arise. 

14.11.1 Alarm analysis 

In some process systems, the number of alarms that can be 
generated is large and it seems desirable tohelp the operator to 
assimilate these by an analysis of the alarms using a process 
computer.Theproblem is most acute in nuclear power stations 
and alarm analysis has been pioneered by the nuclear indus¬ 
try. Computer-based alarm systems, which include alarm 
analysis, were installed on the nuclear reactors at Oldbury 
(Kay, 1966; Kay and Heywood, 1966; Patterson, 1968) and at 
Wylfa (Jervis and Maddock, 1965;Welbourne, 1965,1968). 

The number of alarms in the systems described is very 
large. At Wylfa, for example, there are two reactors with 
some 6000 fuel channels, 2700 mixed analogue inputs and 
1900 contacts on each reactor. These systems, therefore, 
represent an extreme form of the problem of potential 
information overload that is always encountered when a 
wide span of control is concentrated in one centralized 
control station. Some kind of information reduction is 
required if overload is to be avoided. Thus, alarm analysis 
was undertaken not as a desirable optional facility but 
rather as a matter of necessity. There are two possible 
objectives of alarm analysis that are related but distinct. 
The weaker one is to interpret fresh alarms as they appear 


in the real-time situation, whilst the stronger one is to 
identify the original, usually mechanical, cause. 

On the Oldbury system, as described by Patterson 
(1968), the method of analysis is ‘alarm tree analysis’ in 
which the propagation of a fault is followed up through 
successively higher levels of the tree. A prime cause alarm 
is an active alarm at the lowest level. All important alarms 
are displayed together, with the cause alarm at the head of 
the group and the effect alarms beneath it. Other asso¬ 
ciated effect alarms that are not considered important for 
the operator’s understanding of the fault are not displayed 
but are ‘suppressed’ or ‘inhibited’ by ‘darkening’. 

Initially, the alarms displayed were the prime cause 
alarms and the uninhibited alarms; the highest level alarm 
reached was not shown, unless it was an uninhibited alarm. 
It was found, however, that this system led to an excessive 
demand for more uninhibited alarms. It was, therefore, 
modified so that the highest alarm reached is always dis¬ 
played. The operator thus knows how far the fault has 
propagated. 

The analysis method at Wylfa, as described by 
Welbourne (1965, 1968) is rather similar. When a fresh 
alarm occurs, it is classed as a prime cause alarm, unless it 
could have been caused by an existing prime cause alarm, 
in which case it is classed merely as a new alarm. There 
are separate VDU displays for prime cause and new 
alarms. There is, however, no suppression of intermediate 
alarms. 

At Oldbury, in addition to real process alarms based on 
plant sensors, messages may be generated based on 
such alarms. If the message relates to a fault, it is in effect a 
‘deduced alarm’. Similarly, at Wylfa there are ‘synthetic’ 
alarms. The number of alarms to be displayed at Oldbury 
proved to be rather larger than expected. It was necessary to 
increase the number of 32 -line pages of alarms from 3 to 9.The 
number of alarms is also large at Wylfa, where there is no 
suppression of alarms. 

It is apparent that there are a number of problems in the 
provision and use of an alarm analysis facility. They fall 
into two hroad categories: those that are concerned with the 
engineering work involved in conducting a comprehensive 
analysis, and those that concern the use of the analysis by 
the operator. 

The method of conducting the analysis in the systems 
described is that a team of experienced engineers studies 
systematically and in detail the various situations which 
can occur on the plant and the alarms to which these give 
rise. The engineering effort in the system described by 
Patterson was a team of five for 2 years. 

As far as concerns process plants, an early exploration 
was undertaken by Barth and Marleveld (1967), but was 
not apparently followed through. 

One of the main obstacles to the use of an aid such as 
alarm analysis is the large effort required to create the 
alarm data structure. It is clear that progress in its appli¬ 
cation to process plants would be greatly assisted by the 
development of a systematic and economical method of 
creating the alarm data structure. By the mid-1970s, there 
were indications of work in this area (Andow, 1973; Powers 
and Tompkins, 1974b; Andow and Lees, 1975). 

Since that time, as described in Chapter 30, the develop¬ 
ment of real-time aids to assist the operator in handling 
fault conditions, including expert system aids, has been an 
active area of investigation, but progress is perhaps best 
described as sporadic. 
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Turning to the human factors aspects, alarm analysis is a 
facility to assist the operator. It is essential, therefore, to give 
the fullest consideration to the human factors problems that 
arise. Otherwise, the engineering effort is largely wasted. 

The objective of alarm analysis is principally to assist 
the operator in handling rarely occurring but seriously 
hazardous situations. These occur typically as a result not 
of a single fault but of a combination of faults. If an analysis 
is to be useful, it must be sufficiently comprehensive to 
include these low probability but hazardous conditions, 
and it must do this in such a way as to convince the operator, 
who may be disinclined initially to believe in the existence 
of a low probability event or combination of events until he 
has exhausted the more familiar high probability causes. 
The point is well put by Rasmussen (1968b): 

It may be extremely difficult, if not impossible, for the 
designer of a large plant to carry through an analysis that 
takes into account not only all failures in the plant itself 
and the instrumentation, but also the combination of 
failures. 

One has to realize that direct automatic identification 
of the primary fault based on a not completely compre¬ 
hensive analysis, which assumes that the operator criti¬ 
cally evaluates the results of the analysis, involves a great 
risk of further decreasing that probability that the 
operator takes into consideration very improbable but 
hazardous failures not dealt with in the simplified ana¬ 
lysis of the designer and thus of the instrumentation. 

If one utilizes a simplified analysis of failure condi¬ 
tions in this way, one may therefore be in the paradoxical 
situation that it is as risky for the operator to trust the 
analysis too much when it indicates a probable cause of 
failure as to incline towards distrusting it when it indi¬ 
cates an a priori improbable cause. 

In addition to this problem of the confidence that the 
operator can place in the analysis, there is the question of 
the way in which the results are to he displayed. Moreover, 
the display of the analysis itself is not the whole of the dis¬ 
play problem. A knowledge of the current state of the process 
is also necessary to the operator when a fault is detected. 
Bothhisowndiagnosisandhiscorrectiveactiondependvery 
much on this background information. It is not satisfactory 
that he should have to begin his evaluation of the process 
state ab initio on detection of a faultbefore he can take action. 

An additional aspect is the phenomenon of operator 
indecision. It has been found by several workers that an 
operator may have difficulty in bringing himself to actu¬ 
ally take a control action. Thus Bainbridge (1974) describes 
this situation, which in her work occurred even in a simu¬ 
lation study: 

Another type of poor performance, independent of abil¬ 
ity to think about the task, is shown by the subjects who 
can choose the action to take, considering more and more 
refined dimensions of this choice, but have difficulty in 
committing themselves to making it. 

It seems reasonable to assume that this inability to come to 
the point of decision is largely a matter of the confidence 
that the operator has in his assessment of the situation and 
in his intended remedial action. This in turn depends to a 
considerable extent on his knowledge of the state of the pro¬ 
cess, on information redundancy in the displays, andso on. 


14.12 Human Information Processing 

At this point, it is necessary to devote some consideration 
to the topic of human information processing, some appre¬ 
ciation of which is essential to the understanding of modern 
developments in areas such as training and human error. 
The task of the process operator is largely one of processing 
information. An understanding of the characteristics of 
human information processing in such a task is therefore 
crucial to the design of his work situation. In particular, it 
can contribute to the design of the interface and to assess¬ 
ment of human error. The process operator as an informa¬ 
tion processor is described in Information Processing and 
Human-Machine Interaction (Rasmussen, 1986). The 
following is a simplified account of this work. 

14.12.1 Cognitive task analysis 

An account has already been given of the use of task analysis 
as an aid to understanding the task of the process operator 
and its role in design of the system and provision of assis¬ 
tance to the operator. Figure 14.7 shows a generalized frame¬ 
work for task analysis in process operation in the form of 
information processing activities required to pass from one 
state of knowledge to the next. The left-hand, upwards lad¬ 
der gives the activities leading to evaluation of some plant 
state which requires action. The activities are (1) detection, 
(2) observation, (3) identification, (4) interpretation and 
(5) evaluation. The right-hand, downwards ladder gives the 
activities leading to action in response to that state.They are 
(1) evaluation, (2) interpretation, (3) definition of task, 

(4) formulation of procedure and (5) execution of procedure. 
Also shown in the diagram are some of the links that allow 
bypassing of intermediate stages. 

Several different types of information processing are 
involved. There is analysis of the current state of the sys¬ 
tem, evaluation both of the current state and of the ultimate 
goal and planning of the task to be undertaken in response 
to that state. 

14.12.2 Level of abstraction 

The operator may think about the system at several differ¬ 
ent levels of abstraction: (1) physical form, (2) physical 
function, (3) generic function, (4) abstract function and 

(5) functional purpose. Consider the example of a pump. 
The level of physical form corresponds to the appearance of 
the pump. A typical representation at this level might be 
the symbol for a pump on the flow diagram. The level of 
physical function corresponds to the pumping function of 
the pump. The level of generic function corresponds to the 
maintenance of flow and that of abstract function to 
the maintenance of the mass and/or heat balance. These 
functions in turn contribute to the ultimate functional 
purpose of the plant. The levels of abstraction constitute a 
means-ends hierarchy, with the functional end at the top 
and the physical means of fulfilling this at the bottom. 

In making decisions about the system, the operator may 
need to move between the different levels of abstraction. In 
an emergency situation, for example, he may have to step 
back and consider the ultimate functional purpose. If he 
decides that this is best served by maintaining the heat 
balance, he may consider whether to reconfigure the sys¬ 
tem. This is a decision at a lower level of abstraction. He may 
then decide to effect this by altering a flow and may alter 
this flow by making a physical change to a pump system. 
This takes the decision-making to still lower levels. 
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Figure 14.7 The information processing activities of the operator in making a control decision represented as a ladder 
diagram (Rasmussen, 1986), The diagram also shows (a) bypassing of certain stages and (b) the domains of skill-based, 
rule-based and knowledge-based behaviour (Reproduced with permission of John Wiley <S Sons Ltd from Information 
Processing and Human- Machine Interaction by J. Rasmussen, 1986, Copyright©) 


14.12.3 Human behaviour in diagnostic tasks 

One of the principal functions of the process operator is 
diagnosis. On a process plant, however, diagnosis is not 
entirely straightforward. If an equipment is known to have a 


fault, the response required from the maintenance tech¬ 
nician is relatively simple. It is to identify the fault and repair 
it. With a fault on a process plant, fault matters are not quite 
so simple. The identification of the fault is typically not the 
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first priority; The priority is generally to evaluate the 
situation, decide whether the ultimate goal is to be modified, 
decide the new target state of the plant and define the tasks, 
and formulate and execute the procedures required to bring 
the plant to that state. Only if diagnosis of the fault is neces¬ 
sary to this sequence need it be undertaken at this stage. 

A study of trouble-shooting in electronic equipment was 
undertaken by Rasmussen and Jensen (1973, 1974) as an 
example of human behaviour in a diagnostic task. They 
identified two broad search strategies: 

(1) functional search; 

(2) topographic search. 

Functional search involves detailed observation of the 
specific characteristics of the fault, followed by inter¬ 
pretation in the light of a model of the system. It requires 
relatively few items of data but a possibly quite complex 
model. It is characteristic of the expert designer. 

Topographic search is quite different. It involves a search 
through the system making a rapid sequence of good/bad 
checks until the fault is located. It requires a large number of 
items of data, on average, but only simple good/bad decisions. 
It is characteristic of the expert maintenance technician. 

The maintenance technician is able to operate success¬ 
fully a topographic search strategy using a rather general 
search procedure that is not dependent on the specific 
equipment or fault. The task is viewed not as one of solving 
a problem but of locating a faulty item. Aspects of the 
search strategy include search along the main flow path 
and hierarchical ordering of the search. The technician is 
also able to make do with a very generalized model of the 
system. In electronic trouble-shooting, the circuit diagram 
is used for simple purposes such as identification of the 
main signal paths rather than to obtain a full functional 
understanding. 

In performing topographic search, the maintenance 
technician follows a strategy that he finds to be broadly 
optimal in terms of time and trouble. It may not appear 
optimal in terms of the conventional measures. He will tend 
to follow the line of least resistance and to take apparently 
impulsive decisions. 

Behaviour in topographic search may sometimes appear 
to display a fixation. The search may come to an impasse. 
Even in these circumstances there is relatively little ten¬ 
dency to resort to the use of functional reasoning. The 
technician is likely to take a break and then to resume using 
a topographic search strategy again. 

Functional search is often used to identify the subsystem 
that is faulty, prior to the use of topographic search on the 
subsystem. A common example is trouble-shooting on a TV 
set where the behaviour of the ‘picture’ may provide an indica¬ 
tion of the type of fault and the associated faulty subsystem. 

This work provides background to the diagnostic tasks 
performed by the process operator. The operator may utilize 
one of two broad strategies: 

(1) topographic search; 

(2) symptomatic search: 

(a) pattern recognition, 

(b) sequential decision-making. 

The topographic search is based on a map of the system 
that shows the location of items the state of which can be 
observed and subjected to a good/bad check. 


The symptomatic search may take two forms. It may 
involve assessment of the state of the system by some form 
of pattern recognition. Or it may involve a sequential pro¬ 
cess of decision-making equivalent to logical forms such 
as truth tables, fault trees and event trees. An alternative 
sequential approach is search by hypothesis and test. 

These considerations have implications for various 
aspects affecting the operator such as information display, 
computer aiding and training. 

14.12.4 Design of overall control system 

Design of the overall control system for a process plant is 
seen by Rasmussen as involving three principal stages: 

(1) definition of control requirements; 

(2) analysis of the decision tasks; 

(3) cognitive task analysis and design. 

The designer defines the control requirements by moving 
down through the levels of abstraction, defining at each 
level the context of the control task, including the task 
specification from the level above and the resources avail¬ 
able at the level below. The decision tasks implied in this 
scheme of control are then analysed. The decision ladder 
diagram given in Figure 14.7 provides a framework for such 
analysis. 

In the cognitive task analysis, the designer formulates 
the possible information-processing strategies that the 
operator may use. System design does not require knowl¬ 
edge of the detailed mental models used by the operator. 
Rather it can be based instead on knowledge of the higher 
level, more generic, models which operators can and do use. 
The fact that different operators may use different detailed 
models also argues for a higher level approach. 

Rasmussen gives several ladder diagrams illustrating 
the decision task analysis for different tasks and in differ¬ 
ent systems. These all have the same broad structure but 
differ in detail. For example, different diagrams apply for 
fully and partially automated systems. 

14.12.5 Human behaviour in cognitive tasks 

Rasmussen distinguishes three types, or levels, of human 
behaviour in tasks such as process control. Such behaviour 
may be: 

(1) skill-based; 

(2) rule-based; 

(3) knowledge-based. 

The relation between the three types is shown in Figure 14.8. 

This description of operator behaviour by Rasmussen 
is frequently referred to as the skill-rule-knowledge, or 
SRKmodel. Skill-based, or skilled, behaviour occurs without 
conscious attention and is data-driven. Rule-based behaviour 
is consciously controlled and goal-oriented. Knowledge- 
based behaviour is also conscious and involves reasoning. 
These three types of behaviour apply to both parts of the 
decision ladder diagram, as shown in Figure 14.7. 

Another, closely related distinction is that between (1) a 
signal, (2) a sign and (3) a symbol, illustrated in Figure 14.9. 
The distinction lies in the way in which the input is 
perceived. A signal is an input perceived simply as a con¬ 
tinuous quantitative indicator of system state. A sign is 
perceived as an indication of some discrete state and often 
of the need for action. A symbol relates to some functional 
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* Causal condition not considered 



Sensory input Signals Actions 


Figure 14.8 The three levels of control of human actions: skill-based, rule-based and knowledge-based behaviour 
(Rasmussen, 1986) (Reproduced with permission of John Wiley & Sons Ltd from Information Processing and 
Human-Machine Interaction by J. Rasmussen, 1986, Copyright©) 


property of the system. A sign cannot be used for functional 
reasoning about the system, which is the province of the 
symbol. Signsbelong essentially to thedomainof rule-based 
behaviour, and symbols to that of knowledge-based behav¬ 
iour, as shown in Figure 14.8. 

14.12.6 Human as control system component 

Much work has been done on human behaviour in control 
tasks generally and in process control tasks in particular, 
and various characterizations have been developed of man 
as a component in a control system. 

Rasmussen discusses the behaviour of the human as a 
component in a control loop, and his needs for aiding, in 
relation to the successively more difficult tasks of (1) direct 
manipulation, (2) indirect manipulation, (3) remote manipu¬ 
lation and, finally, (4) remote process control. In the first 
three cases, the operator receives information in analogue 
form and exercises a basic sensorimotor skill in a relatively 
simple space-time loop. This may not be so in the fourth 
case, where the signals on both the input, or sensory, 
channel and the output, or manipulative, channel, are likely 
to be symbolic and therefore to require translation. Such 
translation is a relatively high-level activity and therefore 
breaks the simple space-time loop. 

In this light, the aim of the designer should be to restore 
to the operator the ability to apply to the task the basic 
sensorimotor skill. This requires that the designer do at 
least two things. On the sensory channel, the information 
presented should be based on symbols directly related to 
the function to be controlled. On the manipulative channel, 


the information presented should provide symbols and 
structure which allow the symbolic representation of the 
space-time feature to be directly manipulated. 

14.12.7 Mental models used in cognitive tasks 

At the level of knowledge-based behaviour, the operator 
requires to effect transformation between different types of 
model. Rasmussen identifies three strategies which he uses to 
do this: (1) aggregation, (2) abstraction and (3) analogy. 

If a system is viewed with a high degree of resolution, it 
may appear complex. This complexity, however, is not an 
inherent property. If the elements of the system are aggre¬ 
gated into a larger whole by reducing the degree of resolu¬ 
tion, a simplification may be achieved. 

The apparent complexity of a typical control system is 
largely due to the one-sensor-one indicator technology. 
Given this technology, the operator has to transform the 
information by aggregation in order to reduce the com¬ 
plexity. Alternative forms of display can be devised which 
effect this aggregation for him. Another basic transforma¬ 
tion strategy is shifting the level of abstraction. The 
operator moves between different levels of abstraction, as 
already discussed. The third strategy is analogy. This may 
be regarded as a special case of shifting the level of 
abstraction. Since systems that are physically different 
may have the same higher level model, a shift to this higher 
level may provide a useful analogy. 

These considerations have implications for the decision 
support systems provided for the operator. Traditionally, 
displays consist mainly of measured values and some 
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Figure 14.9 Three perceptions of the same indication (Rasmussen, 1983): as a signal; as a sign; and as a symbol 
(Courtesy of the Institute of Electrical and Electronic Engineers) 


structural information such as mimic diagrams. There is 
relatively little that relates directly to the various levels of 
the means-ends hierarchy. There is need for displays to 
support decision-making at the different levels. 

Lind (1981) has developed a description of process sys¬ 
tems in terms of the mass and energy balances which has 
several levels and maps well onto the means-ends hier¬ 
archy. Goodstein (1984) has done work on multilevel dis¬ 
plays. The provision at a higher level of abstraction of 
displays which give a one-to-one mapping between the 
appearance of the display and the properties of the process 
to be controlled allows rule- and skill-based behaviour to be 
extended to this higher level. 

A functional representation can serve as a set of pre¬ 
scriptive signs. Cuny and Boy (1981) have shown that an 
electrical circuit diagram can be analysed as a set of signs 
controlling activities in design, installation and repair. 
A closely associated topic is co-operative decision-making 
where the computer supports human decision-making by 
undertaking parts of the information processing. 


With regard to the form of mental models, the model used 
by man tends to be based on common-sense reasoning, or 
causal reasoning. As a model at the purely physical level, 
this does not have the precision of a formal mathematical 
model such as a set of differential equations, but it is ser¬ 
viceable and can be extended to higher levels of reasoning. 

14.12.8 Human error in cognitive tasks 

The causes of unsatisfactory system performance are 
technical faults and human error. The tracing of the causes 
of poor performance by an investigator is arbitrary to a 
degree. Rasmussen points out that there is a strong ten¬ 
dency for the trace to terminate if it reaches a human; it 
does not often pass through. 

He discusses human error mainly in terms of human 
variability and of human-machine mismatch. This vari¬ 
ability is a desirable characteristic. It is an important 
ingredient in human adaptability. In particular, it plays an 
important part in the learning processes. Small excursions 
outside limits are needed in order to learn where limits lie. 
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Similar experimentation underlies the development of 
rules-of-thumb. 

If the environment is unforgiving, however, so that if such 
excursions prove to have bad effects it is not possible to 
recover, error becomes a problem. Overall, it is generally 
more fruitful both for error prevention and error prediction 
to concentrate onrecovery from error than on the initial error. 

At the level of knowledge-based behaviour, error may 
occur due to selection of an inappropriate goal or selection of 
an appropriate goal followed by incorrect implementation. 

At the level of rule-based behaviour a prime cause of 
error is a change in the environment. Practice of a task leads 
to a tendency for knowledge-based behaviour to be 
replaced by rule-based behaviour and use of signs. If the 
environment changes so that the signs do not alter but the 
rules are no longer appropriate, error is liable to occur. This 
may be compounded by the tendency to utilize convenient, 
informal signs instead of formal signs and to modify rules 
to give more convenient sequences. 

Human error may occur in a normal situation in the 
execution of familiar tasks. Some of the mechanisms 
include (1) motor variability, (2) topographic misorienta- 
tion, (3) stereotype take-over, (4) forgetting an isolated item 
and (5) selecting an incorrect alternative. 

Motor variability is exemplified by an operator applying 
different degrees of force to a set of valves so that one of 
them is not leak-tight. Selecting the wrong pump in a set of 
pumps is an example of topographic misorientation. Ste¬ 
reotype take-over is illustrated by switching during an 
emergency shut-down sequence to the regular shut-down 
sequence. 

Forgetting an isolated item can take many forms. A 
typical form is omission of an isolated act. An analysis of 
nuclear plant test and calibration reports by Rasmussen 
(1980b) found that this category accounted for 50% of 
errors. Precisely because the act is an isolated one, the 
probability of initial error tends to be high and that of 
recovery low. Another form of forgetting an isolated item is 
incorrect recall of a number. Insertion by an operator of a 
wrong set-point is an example. An example of incorrect 
selection between alternatives is adding to a figure a cor¬ 
rection factor which should in fact be subtracted. 

Other types of human error occur in off-normal situa¬ 
tions. Skill-based behaviour is appropriate to the normal 
situation, but if the situation changes it may no longer he 
appropriate. Generally, however, adaptation tends not to 
take place until a mismatch has occurred. 

Rule-based behaviour is liable to two types of mismatch: 
(1) stereotype fixation and (2) stereotype take-over. An 
example of stereotype fixation is execution of a sequence of 
operations appropriate to normal dusts when in fact the 
dust being handled is radioactive and calls for additional 
precautions. Stereotype take-over, by contrast, is exempli¬ 
fied by an operator initially conscious of the need to vary a 
sequence of operations to suit the particular circum¬ 
stances, such as the dust-handling task just described, but 
then relapsing into the normal sequence. Such interference 
is more likely to occur in situations where the mind is 
occupied by forward planning of other activities before the 
action concerned has been executed. 

Another form of failure in rule-based behaviour is fail¬ 
ure to switch to knowledge-based behaviour even though 
this is what the situation warrants. If the system has chan¬ 
ged but the signs remain unchanged, rule-based behaviour 
based on the signs may no longer be appropriate. 


An operator is typically faced with the display of a set of 
measurements. It is apparently the expectation of the 
designer that he will interpret them using knowledge- 
based behaviour. In fact, an operator relies not so much on 
sets of relationships between variables as on linear 
sequences of events. He does not derive states and events 
from sets of relations but utilizes state and event indicators. 
Thus, if the system changes, the operator is required not 
only to shift to knowledge-based behaviour but also to 
cease interpreting information as signs and to interpret it 
instead as symbols. His difficulty is compounded if the 
information sources are attended to sequentially. 

Once the domain of knowledge-based behaviour is 
entered, it becomes much more difficult to characterize the 
mechanisms leading to mismatch. Some types of human 
error which may occur in this situation include the follow¬ 
ing: (1) slips, mistakes and interference; (2) premature 
selection of a hypothesis; and (3) inappropriate testing of a 
hypothesis and (4) failure to map/match resource to goal. 
Rasmussen concludes that given current types of display, 
the situation is generally too unstructured to permit the 
development of a model of the problem-solving process and 
hence the identification of typical error modes. 

The taxonomy for description and analysis of events 
involving human malfunction given by Rasmussen is 
shown in Figure 14.10. Human malfunctions are classified 
as external or internal malfunctions. An external mal¬ 
function relates to omission or commission of acts that 
affect the state of plant equipment. An internal malfunc¬ 
tion relates to decisions made at some level on the decision 
ladder. The scheme is not hierarchical. It allows quite a high 
degree of resolution. It is based on internal rather then 
external malfunctions, which retains the internal structure 
of the error, allows a reasonably economical description of 
it and avoids the combinatorial explosion that is liable to 
occur in a scheme based on external malfunctions. 

One of the factors which affect the probability of error is 
stress. However, although much work has been done on the 
effects of stress, relatively little is applicable to cognitive 
tasks. An abnormal situation tends to result in a modifica¬ 
tion of behaviour even if there is little stress. But frequently 
in an abnormal situation, there is an increase in stress. Apart 
from the effect of anxiety, there are some specific effects 
related to the cognitive task itself. The need to apply func¬ 
tional reasoning to a disturbed function increases the work¬ 
load and reduces the time available for general monitoring of 
the state of the system. At the same time, the existence of 
abnormal conditions means that familiar indicators may be 
less reliable as guides to the state of the system. There is a 
tendency for the operator to focus on the disturbed function 
and thus to exhibit the cognitive tunnel effect. The need for 
shifts of strategy is another factor increasing stress. 

Work on pilot performance by Bartlett (1943) indicates 
that under stress the tendency is for skilled subroutines to 
be retained but for the higher level co-ordination of these 
routines to deteriorate. 


14.12.9 Models of human information processing 

There exist a variety of models of human information pro¬ 
cessing activities which may have a contribution to make in 
the present context. These are reviewed by Rasmussen in 
respect of the characteristics of each model and of its rela¬ 
tionships with the other models. The models are summa¬ 
rized in Table 14.7. 
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Figure 14.10 A taxonomy for description and analysis of events involving human malfunction (Rasmussen, 1982b) 
(Reproduced with permission of John Wiley & Sons Ltd from High Risk Safety Technology By A.E. Green, 1982, Copyright©) 


Table 14.7 Some models of human information processing 


Model 

Further description 

References 

Attention allocation 

Queueing theory 

Sampling theory 

Carbonell (1966); Senders and Posner (1976); Rouse (1977) 
Senders (1964) 

Detection 

Manual control 

Human judgement 
Decision theory 

Signal detection 

Estimation theory 

Wald (1947); Sheridan and Ferrell (1974) 

Gai and Curry (1976) 

Crossman and Cooke (1962); Pew (1974); Sheridan and 
Ferrell (1974); Baron etol. (1982) 

Hammond, McClelland and Mumpower (1980) 

Keeney and Raiffa (1976) 

Behavioural decision 
theory 

Subjective probability and its 
revision by Bayesian 
approach 

W Edwards andTversky (1976) 

Psychological decision 
theory 

Subjective probability 

Tversky and Kahneman (1974) 

Social judgement 

Expert judgement 

Hammond, McClelland and Mumpower (1980); 

Brehmer (1981) 

Information integration 
theory 

Attribution theory 

Fuzzy set theory 

Cognitive algebra of 
stimulus-response 

N. Anderson (1974) 

Heider (1958); Kelley (1973) 

Zadeh (1965); Gaines (1976); Gaines and Kohout (1977) 

Artificial intelligence 
models 

Expert systems 

Problem-solving 

Ringle (1979); Schank and Abelson (1977); Feigenbaum 
(1979) 

Newell, Shaw and Simon (1960); Newell and Simon (1972); 
Dreyfus (1972) 


14.13 Task Analysis 

The analysis of the task to be done logically precedes other 
stages of the design process, such as interface or training 
design, as shown in Figure 14.1. Insofar as any analysis 
of the operator’s task is made in the process industries, 


this has traditionally tended to be done implicitly in the 
course of writing the plant operating instructions. 
Increasingly, however, use is being made of more funda¬ 
mental approaches, mainly based on the various forms of 
task analysis. 
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14.13.1 Hierarchical task analysis 

Early work was given in Task Analysis (Annett et al., 1971). 
The method described by these authors is hierarchical task 
analysis (HTA), in which the task is broken down into a 
hierarchy of task elements. The hierarchical task analysis 
method of Annett et al. has been developed by Duncan and 
co-workers (Duncan, 1974; Duncan and Gray, 1975a,b; 
Duncan and Shepherd, 1975a,b). 

The method adopted is to break the task down into a 
hierarchy. The elements of the hierarchy are a goal, plans 
and operations. The task involves a goal and this is then 
redescribed in terms of the plans and operations necessary 
to achieve it. Operations are units of behaviour, typically 
with an action-information feedback structure. The main 
operations in the task of controlling an acid purification 
plant are shown in Figure 14.11, the full hierarchy of 
operations in Figure 14.12 and representative subordinate 
operations in a start-up procedure in Figure 14.13. 

One of the difficulties in any task analysis is to know when 
to stop. Unless there is a suitable stopping rule, the redescrip¬ 
tion gets out of hand. The rule used is that redescription 
stops when the product of the probability p and the cost c 
of failure is acceptably low. The application of the rule is 
shown by the underlining in Figure 14.11. Double under¬ 
lining indicates that this product has an acceptably low value. 
This is usually because the action required is trivial and 
does not call for training. Single underlining denotes a 
possible difficulty and perhaps need for training. 

Thus, as mentioned in Chapter 8, this method is a type of 
hazard identification procedure and should take its place 
along with other such techniques. It conforms to the loss 
prevention approach of taking into account both the mag¬ 
nitude and probability of the hazard. Although the techni¬ 
que is intended primarily to assist in the design of training, 
it is not assumed that training is in all cases the right 


solution. On the contrary, in some instances other meas¬ 
ures such as design alteration may be more appropriate. 

The type of material that the method produces is 
shown in Table 14.8. The numbers in the left-hand column 
identify the operation in the corresponding box diagram of 
Figure 14.12. Thus 3/1.2 (Run plant) is operation 3, which is 
the second subdivision of operation 1. The column on the 
extreme right refers to further breakdown. Thus operation 
4 is broken down into operations 11-13, which are detailed 
further down the table. The notes in the main body describe 
the operation, mentioning particularly any constraints or 
tolerance limits and also tentative suggestions for a train¬ 
ing method. The columns headed I or F, and A, are checked 
with a cross if any difficulty has been found in the input or 
feedback to the operator (that is a sensory or perceptual 
difficulty) or if an action difficulty (inability to perform the 
motor act) has been found. The letter R indicates that the 
operation is redescribed elsewhere in the table. 

The task analysis breaks the task down into operations 
which are carried out according to aplan.The simplest plan is a 
fixed sequence, but variable sequences may be handled, and 
training maybe particularly important for these. One problem 
that task analysis studies reveal is the identification of equip¬ 
ment, such as bypass and isolation valves around control 
valves. Figure 14.14 shows a typical plant control valve and 
Figure 14.15 some representative bypass and isolation configu¬ 
rations, the variety of which can lead to confusion. Another 
problem is fault diagnosis, which is considered below. 

14.13.2 Development of task analysis 

Task analysis has now developed into a family of tech¬ 
niques, undertaken for a variety of purposes and employing 
different methodologies. Thus, for example, task analysis 
may be used as an aid to identifying information require¬ 
ments, writing operating procedures, defining training 



Column 10, has 39 sub-operations) or underlining to indicate that analysis has ceased. 

Double underlining is used to indicate that probability of inadequate performance and attendant co 


Figure 14.11 Main operations in an acid purification task (Duncan, 1974) (Courtesy of Taylor & Francis Ltd) 
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Figure 14.12 Hierarchy of operations in an acid purification task (Duncan, 1974) (Courtesy of Taylor & Francis Ltd) 


needs, specifying manning levels, estimating human 
reliability in probabilistic safety assessment and investi¬ 
gating problems. 

As far as concerns the methods, there are some 25 or 
more major techniques available. In effect, therefore, in 
many areas of human factors in the process industries, task 
analysis has become an indispensable tool. 


14.13.3 Hierarchical task analysis: standard 
task elements 

An approach to rendering hierarchical task analysis more 
systematic has been described by A. Shepherd (1993), with 
special reference to the information requirements of the 
process operator, as described below. In HTA, the task is 
decomposed into a set of suhgoals for each of which there is 
a set of information requirements, which the author calls 
‘subgoal templates’ (SGTs). He identifies five broad classes 
of task element: 

(1) sequence elements (S); 

(2) action elements (A); 

(3) communications elements (C); 

(4) monitoring elements (M); 

(5) decision-making elements (D). 

He further divides each class of element into subclasses to 
give the scheme shown in Table 14.9. 

Shepherd illustrates the translation of a conventional 
HTA into his standard form by reference to the simple 
example shown in Figure 14.16. The original plan is: 


This plan is translated into standard task elements as fol¬ 
lows, where the left-hand side shows the plan and the right- 
hand side the standard elements: 


Upon instruction from supervisor- 
do 

1 (Establish feeds) 
then do 

2 (Open steam valve to 7 psi) 
then 

when temperature = 100 degrees - 
do 

3 (Switch steam to ‘automatic’) 
then 

If pH is within specification 


4 (Switch feeds to ‘automatic’) 
otherwise do 

5 (Adjust feeds) 


-receive instruction (C4) 
then do (SI) 
redescribed 
then do (SI) 
redescribed 
then do (SI) 
monitor to anticipate 
change (M2) 
then do (SI) 

■activate (Al) 

-then do (SI) 
monitor to anticipate 
change (M2) 
then do ... either (S2) 
■activate (Al) 
then do ... or(S2) 
redescribed 


In this method sequence elements need to be introduced 
between each of the other elements. This serves to clarify 
for each subgoal in the task the information required and 
the time when it is needed. Another feature is that moni¬ 
toring elements and decision-making elements need to be 
introduced within sequences to handle contingencies that 
may arise. Frequently in task analyses these elements are 
not made explicit. 


Upon instructions from supervisor, do 1, then do 2, then 
when temperature=100 degrees, do 3. Then ifpHis within 
specification, do 4, otherwise do 5. 


14.13.4 Applications of task analysis: operator 
information requirements 

A methodology for the definition of the information 
requirements of the process operator where he is part of a 
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Figure 14.13 Representative subordinate operations in a start-up procedure (Duncan, 1974) (Courtesy of Taylor & 
Francis Ltd) 


control loop has been described by A. Shepherd (1993) in 
the work just referred to. He describes a number of operator 
information acquisition problems found in industrial stud¬ 
ies. One is ‘breaking the loop’. In one case, the display of 
information on the effect of control actions was distant 
from the controls to be manipulated, being two floors up 
from the controls. In another, the problem was that the 
control actions on a rather sensitive distillation process on 
a batch plant had to be performed by interrupting work on 
preparation of batches and going to another part of the 
plant, with the result that the operators tended to adopt a 
rather conservative and uneconomic control strategy. In a 
third example, the target information and the controls - 
required to effect changes were shown on different VDUs 
because the VDUs were arranged to display information by 
geographical area on the plant and the equipments were in 
different areas, with the result that in order to make a 
change, two operators, each viewing one screen, had to 
shout across the control room to each other. 

Another problem identified was ‘information fragmen¬ 
tation’. This can arise where the operator has to examine 
several items of information before making a decision. In 
one case the operator was required to deal with dis¬ 
turbances in a particular part of the plant but in order to do 
so required information from points throughout the plant. 


This was not too difficult to do using the original conven¬ 
tional control panel but with a new VDU system it became 
very difficult, because the menu hierarchy was organized 
geographically and considerable search activity was 
involved in order to locate the necessary data. 

14.13.5 Applications of task analysis: emergency 
stand-by system 

Umbers and Reiersen (1994) have described the application 
of task analysis to assessment of an emergency stand-by 
system. This arose as part of the long-term safety review 
(LTSR) of the UK Magnox nuclear reactors, which includes 
the installation of a new, tertiary feed water system as 
stand-by for the two existing systems. Several task analy¬ 
sis techniques were used, including hierarchical task ana¬ 
lysis and timeline analysis. 

Information for the work was drawn from a wide variety 
of sources. The documentation consulted included the out¬ 
line design specification, summary of safety arguments, 
fault study results, station operating procedures, site 
drawings and plant system drawings. Discussions were 
held with operations staff, the feed system designers and 
fire service teams. A timed walk-through was done. 

Also of interest are the topics on which assumptions had 
to be made, including: plant status following a fault; system 
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Table 14.8 Extracts from the analysis of an acid purification task (Annett etal., 1971) (Courtesy of HM Stationery Office) 


No. Description of operation and training notes 


IorF A redescribed 


1 Operate acid purification plant. R Instructions when to start-up or - 

shut-down the whole process given by supervisor 
2/1,1 Start-up plant. R Must memorize order of units, i.e. CIO, R2, C12 — 

3/1,2 Run plant. R Log keeping and sampling tests for contamination at - 

intervals fixed by supervisor. Alarms signal dynamic failure 
4/1,3 Shut-down plant. R Must memorize order of units for routine - 

shut-down, i.e. CIO, R2, C12. In an emergency units may be shut¬ 
down in any order depending on instructions, and an 
abbreviated procedure is followed 

5/2,1 Start-up vacuum distillation column, CIO. R Invariant order 5,1 to - 

5,39.Very long fixed procedure. Use job aid? Group steps under 
headings and learn order of headings? Few opportunities to 
practise in a continuous process plant. Delays due to plant 
response could be avoided and practice speeded on a 
simulator 

6/2,2 Start-up hydrogenerator reactor, R2. R Invariant order 6,1 to 6,35. - 

7/2,3 Start-up final water distillation column, C12. R Invariant order 7,1 - 

to 7,45. See 5 
8/3,1 Keep log 

9/3,2 Locate and correct or report dynamic failures. R Acknowledge - - 

first accept responsibility - then locate 
10/3,3 Locate and report product contamination. R Only report 

contaminants other than water; report and locate water 
contamination 

11/4,1 Shut-down CIO. R Invariant order 11,1 to 11,13. See 5. In emergency, — 

procedure is abbreviated to suboperations 172,170,171,174 
in that order. This procedure and locations of console 
instruments must be overlearned 

12/4,2 Shut-down R2. R Invariant order 12,1 to 12,13. See 5. In emergency, - 

procedure is abbreviated to suboperations 188 to 193 in that 
order. See 11 

13/4,3 Shut-down C12. R Invariant order 13,1 to 13,11. See 5. In emergency, - 

procedure is abbreviated to suboperations 198 to 203 in that 
order. See 11 

23/21,2 Turn switch from ‘manual’ to ‘auto’ 

25/5,7 Open inlet valve to reflux pump in use and check outlet, drain and X 

valves about stand-by pump are closed (P66/67). I Must find 
way through plant to pump plinth 66/67 - ‘landmarks’ for 
learning plant geography? Pumps are labelled but inlet valve is 
one of six unlabelled hand valves on pump lines. Rote learn 
which is which, OR learn generalization and discrimination of 
classes of valves, i.e. inlet, outlet or discharge, and drain! Sketch 
to indicate 

relevant valves and lines against cluttered plant background? 

48/47,1 Adjust valve. A Compensatory tracking of pen movements to X 

produce an acceptable slope on recorder. Plant control law might 
be simulated, but expense justifiable? Practice on the job under 
supervision feasible, but would be infrequent. F Examples of 
‘acceptable’ and ‘unacceptable’ slopes could easily be provided 
78/6,18 Set up a pressure of 1 psig on the gauge after the block valve. X 

Then check that there is a purge through the system by putting 
a hand over the outlet vent. F Must find way through plant to 
outlet valve. Once pointed out, vent is easily identified 
161/10,2 Locate origin of water contamination by taking further samples - 

from other points on the plant. R The number and order of 
samples taken, i.e. suboperations, varies. 

Given (a) a relative cost index for each of 7 sampling points and 
(b) for each of 8 plant components, estimated probability of 
failure (i.e. contaminating product), the operator must apply a 
search strategy which minimizes sampling costs. Need flow 


X 2 to 4 

X 5 to 7 
X 8 to 10 

X 11 to 13 


18 to 21 
24 to 47 
51 to 60 


X 61 to 93 
X 94 to 138 

X 139 and 140 
X 160,161 and 169 

X 170 to 179 
182 to 184 

X 185 to 197 

X 198 to 208 


X - 


X 162 to 168 
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Table 14.8 (continued) 



No. Description of operation and training notes 

lorF 

A redescribed 

diagram showing only relevant information, i.e. (a) and (b). 
Simulation inevitable - in this case instructor might provide 

Tab reports’ for a series of ‘faults’ (occurring with a frequency 
proportional to their probabilities). Should trainee (1), be told 
efficient strategy, e.g. decision tree-prescribing branching 
sequence of samples? or (2), attempt unaided to minimize his 
sampling costs? 





Figure 14.14 A slave valve and sensing device with bypass and isolating configurations (Duncan, 1974) (Courtesy of 
Taylor & Francis Ltd) 



Figure 14.15 Some bypass and isolating configurations (Duncan, 1974) (Courtesy of Taylor & Francis Ltd) 


design aspects; maintenance and testing aspects; and the 
number, training and responsibilities of personnel. 

The study had a number of outcomes. It gave estimates 
of the time to commission the tertiary feed water system in 
an emergency. It highlighted the importance of avoiding 
delay in establishing loss of the primary and secondary 


feeds and identified the indications of such loss, some of 
which varied as between one plant and another. It showed 
up potential errors and simple design enhancements to 
avoid them. 

The work included a comparison of the commissioning 
times predicted by the task analysis with those found in 
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Table 14.9 Standard task elements for hierarchical task analysis (A. Shepherd, 1993) (Courtesy of Taylor & Francis Ltd) 


Code Label Description Information 

suggestion 


SI 

then do 

Fixed sequence - where the first 
operation of REMAINDER is carried 
out upon completion of the previous 
operation 


S2 

then do either 

Choice - where the first operation of 
REMAINDER varies in accordance 
with a specified condition detected in 
the first operation 


S3 

Then do 
together 
...and ... 

Time sharing — where the first operation 
of REMAINDER is carried out at the 
same time as the previous operation 


S4 

do in any 
order... 

Sometimes it does not matter which order 
suboperations are carried out in. This 
is the case in setting-up operations, 
e.g. prior to plant start-up 


A1 

Prepare 

The operator sets items of equipment, 

Indication of alternative 


equipment 

e.g. valves, in readiness for subsequent 
operations 

operating states. Feedback 
that equipment is set to 
required state 

A2 

Activate 

The operator carries out an act locally on 
plant or on a central or local control 
panel to bring an item of equipment on¬ 
line or take it off-line, e.g. open valve, 
switch on centrifuge 

Auditory or mechanical 
feedback that the action has 
been effective 

A3 

Adjust 

The operator carries out an act locally 
or on a central or local control panel to 
adjust an item of equipment 
to modify operating rates, 
e.g. increase amps, adjust valve 
controller, decrease feed-pump rate 

Feedback confirming 
controller position 

A4 

De-activate 

The converse of Al 

Auditory or mechanical 
feedback that the action 
has been effective 

Cl 

Read 

The operator reads a value of a parameter 
or listens to a sound, 
e.g. read pressure indicator 

Indication of item 

C2 

Record 

The operator records items of 
information for managerial purposes 
or to provide data for later stages in 
processing (e.g. remember, record) 

Location of record for storage 
and retrieval 

C3 

Wait for 

The operator waits for an instruction 

Project wait time. Contact 


instruction 

before commencing the next action 

point 

C4 

Receive 

The operator receives instructions 
pertinent to operation, e.g. to proceed 
or not proceed, adjustment to targets, 
priorities, running conditions, 
potential hazards 

Channel for confirmation 

C5 

Give 

instruction/ 

information 

The operator gives instructions or 
provides information (e.g. to 
management, other operators in plant, 
operators on other plants outside, 
suppliers, customers, services) 

Feedback of receipt 

C6 

Remember 

The operator commits information to 
memory (e.g. times to act, operating 
values, operating constraints) 


C7 

Retrieve 

The operator may be required to retrieve 
previously stored information to 
provide current operating information 

Location of information for 
retrieval 

Ml 

Monitor to detect 
deviance 

Target values of particular parameters 
are to be maintained through specified 

Key parameters to monitor 
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Table 14.9 

(continued) 



Code 

Label 

Description 

Information suggestion 



phases of processing, usually as 
a precautionary action. This form of 
monitoring is usually intermittent, 
with low expectancy of deviation, 
unless certain preconditions have 
occurred. Often this form of 




monitoring is dealt 

with by attention grabbing alarms 


M2 

Monitor to 

The operator anticipates change to detect 

Key parameters 


anticipate 

a cue for a subsequent action. In 



change 

contrast to Ml, the operator expects 
change, usually after the passing of 
some time or the occurrence of an 
intermediate event 


M3 

Monitor rate of 

Where the current plant status is 

Key parameters to monitor 


change 

changing over time (e.g. during a plant 

Change rates 



start-up or other change of operating 




conditions), the operator may have to 
ensure that rates of change are within 
tolerance 


M4 

Inspect plant 

The satisfactory state of equipment may 

Access to symptoms 


and 

only be determined by human 



equipment 

inspection via the human senses 


D1 

Diagnose 

Operators must diagnose situations 

Information requirements 


process 

judged out of tolerance to determine a 

must be identified in 


problems 

course of compensatory or corrective 

conjunction with training 



action 

strategies 

D2 

Plan adjustment 

The operator must observe conditions 

Planning information deriving 



and work out a sequence of steps to 

from analysis of typical cases 



move to a desired (safe) state in an 




acceptable fashion. Planning must 
anticipate the consequence of choices 
of intermediate actions and select only 
those which lead to acceptable 
conditions 


D3 

Locate 

In plants where there may he problems 

Sample points in the system 


contaminant 

associated with contaminants entering 

enabling the problem, 



pipework, through impure feeds or 

eventually to be bracketed 



leaks in heat exchangers, there may be 

between a clean input and a 



a need for examination of samples at 
various points in order to detect the site 
of the problem 

contaminated output 

D4 

Judge 

Often operators are required to make an 

The target indicator 


adjustment 

adjustment to an item of equipment to 
affect processing conditions. The 
degree of adjustment must be judged 
prior to the action 

Adjustment values 


demonstration exercises. The differences were attributable 
mainly to pessimistic assumptions made by the analysis. 

14.13.6 Task Analysis Guide 

A full treatment of the topic is given in A Guide to Task 
Analysis (Kirwan and Ainsworth, 1992) (the Task Analysis 
Guide). Other accounts include those by Drury et al. (1987) 
and A. Shepherd (1992). 

The Task Analysis Guide divides task analysis methods 
into five broad categories: (1) task data collection, (2) task 
description, (3) task simulation, (4) task behaviour assess¬ 
ment and (5) task requirement evaluation. The Guide 
gives short accounts of a number of techniques under each 


of these headings. For task data collection the techniques 
are (1) activity sampling, (2) critical incident technique, 
(3) observation, (4) questionnaire, (5) structured interview 
and (6) verbal protocol. The task description techniques 
are (1) charting and networking methods, (2) decomposition 
methods, (3) hierarchical task analysis, (4) link analysis, 
(5) operational sequence diagram and (6) timeline analysis. 

Task simulation is represented by (1) computer modelling 
and simulation, (2) simulator and mock-up, (3) table top 
analysis and (4) walk-through and talk-through. Techni¬ 
ques considered under task behaviour assessment are 
(1) barrier and works safety analysis, (2) event tree, (3) 
failure modes and effects analysis, (4) fault tree, (5) hazard 
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Figure 14.16 Hierarchical task analysis of part of a process control operation (A. Shepherd, 1993) (Courtesy of Taylor & 
Francis Ltd) 

and operability (hazop) study, (6) influence diagram and operator that are concerned with handling faults and 

(7) management oversight and risk tree (MORT). The task keeping the plant running, notably fault administration 

requirement techniques treated are (1) ergonomics check- and malfunction detection. These are tasks for which, in 
lists and (2) interface surveys. general, man has the ability and the motivation and they 

The Guide also gives some 10 case histories of the appli- are entirely in line with the aims of loss prevention, 
cation of task analysis to (1) allocation of function between Such an approach requires more attention to be given 
humans and automatic systems, (2) preliminary commu- to these functions of the operator and that he be given 

nications system assessment, (3) plant local panel review, the necessary training and job aids. Training should empha- 


(4) staffing assessment for a local control room, operator 
workload assessment in a command system, (5) analysis 
of operator safety actions, (7) maintenance training, 

(8) quantification of effectiveness of ultrasonic inspection, 

(9) operations safety review and (10) a task analysis pro¬ 
gramme for a large plant. 

14.13.7 CCPS Guidelines 

Other task analysis methods are described in the Human 
Error Prevention Guidelines (CCPS, 1994/17), described in 
Section 14.38. Under the heading of ‘action oriented techni¬ 
ques’ they give an account of hierarchical task analysis, 
operator action event trees, decision/action flow diagrams, 
operational sequence diagrams and signal flow graph analy¬ 
sis. The two cognitive task analysis techniques given are the 
critical action and decision evaluation technique (CADET) 
and the influence modelling and assessment system (IM AS). 

14.14 Job Design 

Job design involves the arrangement of the individual 
tasks which the manhas to do into a job which he is capable of 
doing and from which he obtains satisfaction. An account of 
job design is given by L.E. Davis and Wacker (1987). 

As the control system becomes more automatic, the active 
control work of the operator is reduced and his function is 
increasingly one of monitoring. Such passive monitoring, 
however, is not a function to which man is well suited. 

There is, therefore, a potential problem of job design. An 
entry to this problem is to consider why man is part of the 
control system at all. To a large extent, he is there as the 
component used by the designer to give the system a self¬ 
repairing capability. An approach to job design that starts 
from this fact is to develop explicitly those functions of the 


size the importance of running a tight ship and not tolerating 
degraded equipment. Job aids, including computer-based 
aids, should assist him in fault administration and malfunc¬ 
tion detection. 

Other aspects of job design such as workload and organi¬ 
zation and social factors have been considered above. 

14.15 Personnel Selection 

There does not appear to be very much guidance available 
on selection methods for process operators. This is no 
doubt largely due to the difficulty of defining criteria for 
operator performance. 

One of the first studies of the process operator was in 
fact that by Hiscock (1938), who described the development 
of a set of selection tests, but subsequent work by 
D.G. Davies (1967) showed little correlation between per¬ 
formance assessed by a selection test battery and by the 
judgement of supervisors. 

It is probably true that enough is now known about pro¬ 
cess control skill to offer a better prospect of success in 
developing selection tests. The abilities that an operator 
needs are better understood. They include signal detection, 
signal filtering, probability estimation, system state eva¬ 
luation, manual control and fault diagnosis. Tests may 
be devised to measure these abilities, using perhaps a 
computer-based simulator. 

It is also important, however, to take into account in 
selection personal qualities. Crossman (1960) suggested 
that it is desirable that a process operator should be: 

(1) Responsible - able to make satisfactory judgements 
on matters of discretion, so that his work does not need 
frequent checking by superiors. 
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(2) Conscientious - ready to take extra trouble and 
care, without direct instructions, when the situation 
demands it. 

(3) Reliable - never making mistakes, forgetting instruc¬ 
tions, overlooking important indications, etc., or other¬ 
wise failing in his prescribed duties. 

(4) Trustworthy - honest and truthful in reporting to 
superiors; not concealing the facts when his own 
actions may have had adverse effects. 

Other important factors are temperament, motivation and 
social skills. Temperament includes response to monotony 
and to stress. Motivation is partly an individual matter, but 
is also influenced by job design. Social skills cover the wide 
range of communication activities that the work entails. 

The operator’s job requires a reasonably high level of 
intelligence, particularly on large plants, but it is not 
necessary to look for a high intelligence score or university 
degree. The graduate sometimes makes a rather poor 
operator. The question of education is considered below 
together with that of training. A further account of per¬ 
sonnel selection is given by Osburn (1987). 

Selection for process control tasks is touched on in a study 
by the Advisory Committee on the Safety of Nuclear Instal¬ 
lations (ACSNI, 1990) in relation to testing for trainability. 
The authors emphasize the need for the formulation of cri¬ 
teria for operator performance applicable to both training 
and selection, and thus imply that full development of 
selection tests must wait on the availability of such criteria. 
They do, however, consider it practical to select out indivi¬ 
duals who have chronic stress problems or are unable to cope 
with high levels of stress. This aspect is also addressed by 
Weisaeth (1992), who describes the variability of individual 
response to the stress of emergency conditions. 

The elimination of completely unsuitable individuals is 
probably the most useful feature of selection tests in other 
fields, such as those for aircraft pilots, which might appear 
to be a suitable model for some process situations. 

A review of the state of knowledge and current practice 
on operator selection has been published by the HSE (1993 
CRR58). 

14.16 Training 

The training of process operators is an area in which more 
can be achieved and, in general, industry devotes consider¬ 
able effort to this. An overview of training applicable to 
the process industries is given in Training (Patrick, 1992). 

14.16.1 Training and education 

There is a distinction to be made between training and 
education: the former is specific to a particular task or job, 
the latter is more general. The difference may be seen 
clearly in the evolution of training for electronic main¬ 
tenance technicians in the US armed services (Shriver, Fink 
and Trexler, 1964). Initially, this involved a general educa¬ 
tion in electronics, but this did not prove very effective in 
training people to repair equipment. Latterly, the emphasis 
has been on specific training for the diagnostic tasks 
involved. 

The question of the operator’s mental model of the pro¬ 
cess and of his need for a scientific understanding of it was 
raised in the work of Crossman and Cooke (1962) on manual 
control and has been extensively discussed by subsequent 
workers (Attwood, 1970; Kragt and Landeweerd, 1974). 


Investigations in fairly simple manual control tasks do tend 
to suggest that it is better to train the operator in control 
strategies, controller settings, etc., but it is not clear how 
far this can be generalized to other tasks such as fault 
diagnosis. 

In the United Kingdom, the City and Guilds Institute 
runs a Chemical Technicians Certificate (1972) that con¬ 
stitutes a substantial education in chemical processes. 
Such an educational background probably is beneficial, but 
it is not a substitute for specific training in process tasks. 

General guidance on the training of process operators is 
given in the publications of the former Industry Training 
Boards (ITBs), in particular the Chemical and Allied Pro¬ 
ducts ITB (CAPITB) and the Petroleum ITB (PITB). For 
example, CAPITB Training Recommendation 12 (1971/9) 
contains Information Papers which represent outline 
approaches to job analysis, training needs, training pro¬ 
grammes and fault analysis which the user should apply to 
his own plant, while other Information Papers such as that 
on distillation (1972/6) represent outline subject syllabuses. 
Another Information Paper (1971/5) deals with safety train¬ 
ing. The work of Duncan and his colleagues has been sup¬ 
ported by the CAPITB and has been published partly as 
reports of that body (Duncan and Shepherd, 1975a). 


14.16.2 Training principles 

The job of the trainer is to observer and analyse, and to 
arrange to supply the right amount of the right kind 
of information to the learner at the right time. He must 
know a great deal about the task being trained, but the 
kind of knowledge needed is what comes from careful, 
objective analysis of the job and of the necessary skill 
rather than from the experience of becoming personally 
proficient. His task is to find out what factors affect the 
learning of the skill with which he is concerned, to watch 
the effects of varying them and to try to arrange the best 
combination. 

This account by Holding (1965) highlights some of 
the important features in training. It brings out clearly the 
importance of the prior task analysis to determine where 
the operator may have difficulty and where training may 
be necessary. The content of training should be appro¬ 
priate, which in effect means it should be related to these 
difficulties. The training should be at a suitable pace. It 
should provide feedback of results, since this is essential 
for learning. 

Motivation of the trainee is another important factor and 
this can be strengthened by recognizing successful per¬ 
formance and treating failures objectively by explaining 
the cause in a non-condemnatory manner. 

There are a number of classic problems in training. The 
training period may be spaced out or massed together. The 
task may be learned whole or in parts. The task may have to 
be done under some form of stress and this may need to be 
taken into account. 

A particularly important question is the transfer of skill 
from one task to another. It is possible, for example, to 
achieve good performance in a particular task using 
methods such as decision trees that leave relatively little to 
the operator, but the penalty tends to be that he cannot 
transfer the skill to other tasks. 

Many of these problems are discussed in the specific 
context of process control in the work of Duncan and 
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his colleagues (Duncan, 1974; Duncan and Shepherd, 
1975a,b). A further account of concepts of training is 
given by Holding (1987). The relationship between training 
goals and training systems is described by Goldstein 
(1987) and the use of training simulators by Flexman and 
Stark (1987). 

14.16.3 Process operator training 

The process operator needs to have the safety training 
received by other employees also, but in addition has cer¬ 
tain specific needs of his own. In this section, consideration 
is given to the content of training for process operators. 
A further account of operator training is given in 
Section 14.17. Safety training is considered in Chapter 28. 
Some topics for training are listed in Table 14.10. 

In general, it is usually a mistake to provide numerous 
lectures on areas such as details of the process design or 
of the process computer program. It is better to stick 
fairly closely to the operator’s own problems. Nevertheless, 
he does need to understand the process flow diagram, 
the unit operations which compose it and the control 
system. In addition, a basic understanding of the goals 
and constraints with which the plant manager operates 
and the possible changes of priorities that may occur is 
necessary. 

The operator also requires some knowledge of the plant 
equipment and the instrumentation. In particular, he needs 
to be able to identify items and to carry out the manipula¬ 
tions for which he is responsible. 

There are numerous operating procedures with which he 
has to become familiar. These include start-up, shut-down, 
batch operation and all other sequential routines. 

The operator needs to learn to administer faults and, in 
particular, to interpret the alarm system, to diagnose faults 


Table 14.10 Some aspects of the training of process 
operators 


Process goals, economics, constraints and priorities 
Process flow diagram 
Unit operations 

Process reactions, thermal effects 
Control systems 

Process materials quality, yields 
Process effluents and wastes 
Plant equipment 
Instrumentation 
Equipment identification 
Equipment manipulation 
Operating procedures 
Equipment maintenance and cleaning 
Use of tools 
Permit systems 

Equipment failure, services failure 
Fault administration 
Alarm monitoring 
Fault diagnosis 
Malfunction detection 
Emergency procedures 
Fire fighting 
Malpractices 

Communications, record-keeping, reporting 
See also Table 28.5 


and to detect incipient malfunction. He must also be thor¬ 
oughly conversant with the emergency procedures. 

The system of permits-to-work on a plant is extremely 
important and the operator requires to have a full grasp of 
the system used. 

Training in fire fighting is a particularly important 
aspect of emergency work. The best training is provided by 
realistic fire fighting exercises in a training area dedicated 
to this purpose. 

Operational malpractices develop on most plants. A 
typical example is the operation of furnaces at tempera¬ 
tures that drastically reduce creep life. If this can be fore¬ 
seen, training may be given to counter this. 

The operator has quite an important role to play in 
communicating information about plant operation to 
other people and it may be appropriate to include this in 
training. 

14.16.4 Fault diagnosis 

Fault diagnosis is a particularly important activity of the 
process operator. It has been studied in detail by Duncan 
and his co-workers (Duncan, 1974; Duncan and Gray, 
1975a,b; Duncan and Shepherd, 1975a,b) and is considered 
here as an example of training in a specific task. 

Fault diagnosis is usually carried out by the operator at 
the control panel. Frequently, therefore, use is made of a 
panel simulator for training. The simulator used at the 
beginning of Duncan’s work is shown in Figure 14.17. It 
represents a typical panel and the trainer sets up manually 
combinations of instrument readings corresponding to 
particular process conditions. The training is interrupted, 
however, by the rather slow process of resetting the simu¬ 
lator to represent the next set of conditions. Duncan and 
Shepherd (1975b) have overcome this problem by using a 
mock-up of the panel, shown in Figure 14.18, and back- 
projecting this on to a full-size screen in front of which the 
trainee operator can stand. Different sets of instrument 
readings can be brought up by projection without delay. 

Using this device, Duncan and Shepherd have studied 
the training of operators to recognize different fault pat¬ 
terns on the panel. A cumulative part-training method was 
used in which the number of sets of faults was progres¬ 
sively increased. The subjects achieved encouragingly high 
rates of success in diagnosing faults. Debriefing of the 
subjects suggested that different diagnosis strategies were 
used. One was a pattern recognizer, looking first at the 
alarms and then considering possible failures consistent 
with these. Another examined first the instruments and 
then used hueristics based on plant functions. 

An alternative approach is the use of decision trees as 
described by Duncan and Gray (1975a). Figures 14.19 and 
14.20 show for a crude distillation column the decision tree 
and fault-symptom matrix, respectively. The operators 
were taught to use the decision tree to diagnose faults. 
Again a high success rate was achieved. 

There are various ways in which the information in the 
decision tree in Figure 14.19 may he presented and learned. 
The tree as shown gives the faults in the ‘natural’grouping. 
An alternative tree can be constructed in which the maxi¬ 
mum number of decisions is reduced from 8 to 3, but the 
rationale of such a tree is no longer apparent, and the tree 
would be more difficult to remember. The method actually 
adopted was to retain the tree in its natural form and to 
use the ‘linked lists’ shown in Figure 14.21 to assist in 
learning it. 
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Figure 14.17 The Carmody ‘Universal Process Trainer' (Courtesy of Taylor & Francis Ltd; photograph courtesy of BP 
Chemicals (International) Ltd) 


Some of the decisions in the tree depend on the instru¬ 
ment readings, which may be in error. Training in the 
checking of instruments was therefore developed also. 
The emphasis here was on determining the true value of 
a parameter rather than on deciding the instrument 
failure. The following general principles were evolved for 
checking: 

(1) Direct observation — represents truth. 

(2) An outside report, such as a sight glass reading, is a 
direct observation only if the correct procedure for 
reading is followed. 

(3) Two control instruments that agree represent truth. 

(4) The costs (time, effort, danger) must be taken into 
account, and the cheapest route to truth taken. 

(5) Only independent indicators of the same parameter 
can be used for checking. 

(6) Where only two indicators of a parameter are avail¬ 
able, the more reliable of the two is to be believed. 

(7) An individual instrument may show itself to be faulty 
by deviant behaviour; for example, a straight line on a 
pen record. 

This work brings out the importance of verifying the 
instrument readings before embarking on the main diag¬ 
nosis. The need for this in the automated equivalent of 
computer alarm analysis was mentioned earlier. 

This work also included the development of programmed 
learning texts to assist the operator to learn both the 
linked lists of the main decision tree and the instrument 
verification procedures. These developments in training do 
not of course solve the problem of diagnosing very rare but 
very hazardous fault conditions. It is doubtful if training is 
the proper approach to this problem. Such faults are better 


dealt with by the protective system; since they are very 
rare, the shut-downs involved are probably acceptable. 

14.17 Training: ACSNI Study Group Report 

A review of training is given in the First Report: Training 
and Related Matters of the ACSNI (1990). Although this is a 
report to the nuclear industry, it is applicable in large part 
to the process industries also. The report starts from the 
point that human error is the major source of accidents and 
refers to the cases of Three Mile Island and Chernobyl. 

The authors treat the topic under the following headings: 
(1) definition of training, (2) the safety culture, (3) initiation 
of training, (4) internal monitoring, (5) training needs ana¬ 
lysis, (6) criteria for operator performance, (7) standards 
for training, (8) methods of training, (9) central vs site- 
based simulators, (10) individual vs team training, (11) 
training for stress, (12) training of management, instruc¬ 
tors, etc., (13) certification and (14) privatization. They 

It is misleading to think of training solely in terms of the 
transfer of items of verbal knowledge or technical skill 
from instructor to pupil. Although both knowledge and 
skill are necessary, they are not on their own sufficient to 
assure safety. They must be augmented by different qual¬ 
ities : habits of forethought and precaution that place mini¬ 
mization of risk first, and other goals such as short term 
performance or convenience, second. 

The main purpose of training is to create a safety culture. 
The report rehearses some of the elements of this, which 
have already been described in Chapter 6. It is necessary 
that senior management give a lead and take certain spe¬ 
cific measures. Line management should have operational 
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Figure 14.18 Control panel display used for operator training (Duncan and Shepherd, 1975b) (Courtesy of Taylor & 
Francis Ltd) 


responsibility inter alia for safety and training. There 
should be monitoring of the safety culture using objective 
measures and independent assessment and a policy of 
continuous improvement with specific targets and with 
feedback to the workforce. Training should aim to 
rehearse the individual’s experience deliberately so as to 
reinforce compliance and self-monitoring and awareness 
and reporting of hazards. Senior management should 
ensure not only that the organization has a suitable for¬ 
mal training system, but that it is operating effectively in 
practice. 

Training should be monitored. One method of monitor¬ 
ing is the use of objective measures such as the frequency 
of accidents, incidents, operational deviations, trips, etc. 
Another method is to sample regularly what people say 
about the safety culture and about their own attitudes. The 
monitoring should be done by an assessor who is indepen¬ 
dent both of the local line management and of the training 
specialists. 

Task analysis should be used to establish training needs. 
The analysis should specify in concrete terms the infor¬ 
mation to be supplied, the alternative actions that can be 
taken, and the quality of calculation or judgement the task 
requires. It may reveal different needs such as knowledge 
about equipment or practice in control skills, and thus 


point to different types of training such as lectures or use of 
a simulator. 

Evidence from a number of industries shows that, even 
after quite thorough training, an individual may have little 
idea of the hazards of the job. The training should aim to 
raise the awareness of these hazards. 

The report states that performance on the job should be 
not only monitored but also measured. This implies that 
there should be criteria of operator performance. Closely 
related to this is standards for training. The report accepts 
that it may be unrealistic to seek totally objective measures. 
Where these are not practical, it suggests that the assess¬ 
ment take the form of two independent assessments by 
supervisory staff using carefully defined rating scales and 
that these staff themselves receive training to ensure that 
the criteria used are consistent. 

With regard to methods of training, the report refers to the 
distinctionbetween skill-based, rule-based andknowledge- 
based behaviour and between responses to signal and to 
signs. Control skills such as making adjustments to main¬ 
tain constant a single variable have become relatively less 
important on automated plant, but there are a range of 
control room skills which still need to be learned. Skills 
used in normal operation may perhaps be adequately 
learned on the job, but this is not so for skills required in 

















































































Figure 14.19 Decision tree for fault diagnosis on a crude oil distillation unit (Duncan and Gray, 1975a) (Courtesy of the Journal of Occupational Psychology) 
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an emergency situation, for which simulator training is 
appropriate. 

The report argues that for the control of nuclear plants, 
an average level of performance is not good enough. It fol¬ 
lows that training may have to seek to change certain pat¬ 
terns of highly learned skilled-based behaviour. 

The report places particular emphasis on the rule-based 
level of control. Here the operator responds to signs rather 
than signals and has to categorize the situation. Whilst 
rules may be learned to some degree in the classroom, 
practice in the use of rules to categorize the situation is 
most effectively given on a simulator. 

The report gives high priority to the provision of simula¬ 
tors for each type of control room, since there are aspects of 
task that cannot readily be taught without them. It discusses 
the merits of local vs off-site simulators, but regards this 
question as less important that clear specification of the 
skills to be learned and the level of competence to be achieved. 

With regard to individual vs team training, the authors 
suggest that the initial emphasis should be on individual 
training, with team training introduced later. Simulator 
training is treated as a form of team training. 


Operator performance is affected by the level of stress 
experienced. It is not desirable that any operator of a 
nuclear plant should have to carry out the job under an 
abnormal degree of stress. This has implications for selec¬ 
tion and for monitoring of individuals. The individual 
should be free from chronic stress symptoms and be able to 
tolerate acute stress. Given this, the training should give 
practice in performing the task in realistic conditions and 
with a raised level of stress so that the trainee learns to 
handle it. Factors that affect stress include the level of 
demand and the degree of control over the task that the 
person feels he has. The individual’s confidence that he is 
in control may be built up by experience of successful 
handling of similar problems. This experience can be given 
using a simulator. The level of demands should be built up 
until it reaches that experienced in real operation. 

Another aspect of stress is the danger inherent in a major 
incident. The reports acknowledge that this aspect is diffi¬ 
cult to simulate in an exercise, but refers to the expectation 
of possible criticism. In a healthy safety culture criticism of 
the performance of an individual or team can be made and 
accepted constructively.The report urges that management 
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FAULT: 5 Accumulator boot valve shut—control oil water 

1 Water in crude interface manually 

2 Feed pump failure 6 Top reflux pump failure 

3 Furnace overheating—reduce furnace heat ^ Cooling water pump failure 

4 Furnace underheating—determine cause 8 No 1 sidestream pump failure 


Figure 14.20 continued 
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9 No 2 sidestream pump failure 

10 Too little cooling water—increase flow 

11 Too little reflux—increase flow 

12 Too much cooling water—decrease flow 

13 Too much reflux—decrease flow 


14 Column puking 

1 5 Too much stripping steam (S.S.S.1)—reduce 
16 Too much stripping steam (S.S.S 2)—reduce 


Figure 14.20 Fault-symptom matrix for faults on a crude oil distillation unit (Duncan and Gray, 1975a): 0 , zero; L, low; 
H, high; vH, very high; S, swinging; B, swinging and high (Courtesy of the Journal of Occupational Psychology) 


at all levels should be periodically assessed for training 
need and that no-one should be ‘above it.’ 

The report devotes considerable attention to the question 
of certification, which is supported by some and opposed 
by others. In order to disentangle the argument, it is 
necessary to assign a clear meaning to the word ‘certifica¬ 
tion’. The report gives some eight possible definitions, 
together with comments. These may be summarized as 
follows: (1) specification of the content of training and clear 
responsibility for authorization of an individual to under¬ 
take certain actions; (2) separation between individuals 
who undertake (1) and line management; (3) a requirement 
that line management accept without further question 
separate assessment of the individual competence; (4) a 
requirement that line management authorize only persons 
from amongst those who have satisfied a separate assess¬ 
ment; (5) a rule that (3) or (4) apply only at the stage common 
to all reactors with different procedures thereafter; (6) a 
requirement that separate assessment should not mean 
simply testing by the training function but by another 
part of the organization; (7) a requirement that separate 
assessment should not be carried out by the licensee’s organi¬ 
zation at all but by a separate body and (8) a requirement 


that assessment should include observation of performance 
on the job and not merely verbal knowledge. 

The report suggests that the first two interpretations 
would attract widespread consent. Opponents of certifica¬ 
tion may understand it in the third sense, but the authors 
doubt whether this view has proponents. A more serious 
argument turns on the fourth definition. Here opponents of 
certification argue that the trend is towards more involve¬ 
ment by line management in any matter which affects pro¬ 
duction and that there are dangers if it is not involved in 
training, whilst proponents emphasize that line manage¬ 
ment is liable to develop blind spots. The authors suggest 
that this points to the need for a ‘two key’ system, in which 
an operator needs to satisfy both an independent assess¬ 
ment and local line management. They argue that given the 
wide variety of reactor types in Britain the fifth definition 
would effectively rule out independent assessment. With 
regard to the sixth and seventh definitions, the report 
supports an assessment of the trainee performed by 
assessors who are independent both of the local line man¬ 
agement and of the training function, but is unconvinced 
that the independent assessors need to come from outside 
the licensee. The authors support the type of assessment 
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Figure 14.21 Linked lists for learning fault diagnosis on 
of the Journal of Occupational Psychology) 


given in the eighth definition. With regard to privatization, 
the report makes the point that, in order to support the type 
of training envisaged, a certain minimum size of training 
establishment is required. 

The framework for training developed in the report is 
therefore broadly on the following lines. The starting point 
is task analysis. On the basis of this a specification for 
training is formulated by line management and the train¬ 
ing is carried out by the training function. It is monitored 
by assessors independent of both local line management 
and the training establishment. Assessment of the trainee 
contains a component of actual or simulated performance. 
The trainee first has to satisfy the independent assessors 
and is then authorized by line management. Assessment is 
a continuing process. 


a crude oil distillation unit (Duncan and Gray, 1975a) (Courtesy 


The report deals particularly with the training of pro¬ 
cess operators. However, it emphasizes that training should 
not be confined to process operators but should also cover 
instrument artificers, maintenance personnel, etc. 

Under the guise of trainability testing, the report touches 
on the question of personnel selection. It states: 

The Study Group believes it is important to find a valid 
way of deciding the relative success of different indivi¬ 
duals, and that thereby it will become possible to devise 
satisfactory selection procedures. In other occupations it 
has frequently been found that systematic assessment of 
individuals can significantly improve trainability and 
subsequent performance. The potential of such methods 
should be explored further. 
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14.18 Human Factors and Industrial Safety 

An account of the role of human factors in safety is given in 
Human Factors in Industrial Safety (HSE, 1989 HS(G) 48). 
This study sets out the factors that emerge most frequently 
from accident investigations and gives numerous case his¬ 
tories to illustrate the points made. Some of these case his¬ 
tories are given in Appendix 1. 

It refers to the disaster at Chernobyl as an illustration. 
The background to the incident was serious defects in the 
management culture and in the regulatory system. The 
personnel conducting the test on the reactor were under 
pressure to complete the test in a short time. They failed to 
distinguish between small and large risks. They removed 
layer upon layer of protection and violated operational 
rules. The incident has many lessons, but the authors warn 
against treating it as a universal model. 

The study starts from the viewpoint that the human 
operator is basically a positive rather than a negative factor 
in process plants. The operator gives the system a much 
enhanced ability to deal with abnormal situations. But it is 
necessary to design systems which protect against, and are 
tolerant of, human error and to train operators to improve 
their decision-making in these situations. Above all, the 
operator needs the support of a good safety culture. 

The authors describe case histories that illustrate three 
aspects of human factors in particular: inadequate infor¬ 
mation, inadequate design and minimization of the con¬ 
sequences of human error. Human error is classified, with 
examples, under the headings of slips and lapses, mistakes, 
misperceptions, mistaken priorities and violations. 

Measures for the prevention of human error, and an overall 
strategy for this, are considered under the headings of the 
organization, the job and personal factors. In this strategy, 
the organization is considered in terms of the safety climate, 
standard setting, monitoring, supervision and incident 
reports; the job is considered in terms of task analysis, 
decision-making, man-machine interfaces, procedures and 
operating instructions, the working environment, tools and 
equipment, work patterns and communication; and per¬ 
sonal factors are considered in terms of personnel selection, 
training, health assessment and monitoring. Checklists are 
given under each of these headings. 

Many of the examples given in this study are drawn from 
the process industries. The application of human factors to 
the process industries specifically is treated in Human Fac¬ 
tors in Process Operations (Mill, 1992). This is a report of the 
Human Factors Study Group of the Loss Prevention Panel of 
the European Federation of Chemical Engineering (CEFIC). 

The study covers a number of topics dealt with elsewhere 
in the present text, notably: management; accident models; 
control room design; operator control, mental models and 
workload; operating and emergency procedures; and human 
error. 

A five-step strategy is described for modification of 
human behaviour in relation to accidents and hazards. 
These steps are: (1) identification and analysis of accidents 
and hazards; (2) revision of safety rules concerning work¬ 
ing behaviour; (3) development of a plan of measures; 
(4) implementation of the plan and (5) follow-up - assessing 
the effectiveness of the measures taken. 

14.19 Human Error 

The topic of human error as such is avast one and beyond 
the scope of the present work. The treatment here is limited 


to consideration of the effect of human error on the per¬ 
formance of process systems and on methods of dealing 

Accounts of human error include Handbook of Human 
Reliability Analysis with Emphasis on Nuclear Power Plant 
Applications (Swain and Guttmann, 1983), Information 
Processing and Human-Machine Interaction (Rasmussen, 
1986), Human Reliability (Park, 1987), Human Reliability 
Analysis (Dougherty and Fragola, 1988), Human Error 
(Reason, 1990) and An Engineers View of Human Error 
(Kletz, 1991e). Selected references on human error and 
operator error are given in Table 14.11. 


Table 14.11 Selected references on human error, 
operator error 

NRC (Appendix 28 Human Error)-, Riso National 
Laboratory (Appendix 28); Flanagan (1954); Lincoln 
(1960); Rook (1962,1964); Irwin, Levitz and Ford (1964); 
Irwin, Levitz and Freed (1964); Leuba (1964); Swain 
(1964a,b, 1968,1969,1972,1973a,b, 1982); Chase (1965); 
Pontecorvo (1965); Blanchard et al. (1966); Rigby (1967, 
1971a,b); Rasmussen (1968a-c, 1969,1976b, 1978, 

1980a,b, 1982a,b, 1985,1987,1990); Rigby and Edelman 
(1968a); Askren and Regulinski (1969); Faverge (1970); 
Sayers (1971 UKAEA SRS/GR/9,1976); E. Edwards and 
Lees (1973); Kletz and Whitaker (1973); Lees (1973a, 1976b, 
1983a); Regulinski (1973); Finley, Webster and Swain 
(1974); AEC (1975); Anon. (1976 LPB 7, p. 15); Apostolakis 
and Bansal (1976); R.L. Browning (1976); Embrey 
(1976a,b, NCSR RIO, 1979a,b, 1981,1983a,b, 1984,1985, 
1992a-c); Rasmussen and Taylor (1976); Hopkin (1977); 
Reason (1977,1979,1986,1987a,b, 1990); Skans (1978); 
Bello and Colombari (1980); J. Bowen (1980); Griffon 
(1980); R.A. Howard and Matheson (1980); W.G. Johnson 
(1980); Kletz (1980c,e, 1982g, 1985d,f, 1987f,h, 1989d, 
1990c, 1991e,g, 1993a); Senders (1980); Swain and 
Guttman (1980,1983); B,J. Bell and Swain (1981,1983); 
J.A. Adams (1982); Carnino and Griffon (1982); 
Rasmussen and Pedersen (1982,1983); Singleton (1982, 
1984); Beare et al. (1983); Brune, Weinstein and Fitzwater 
(1983); Embrey and Kirwan (1983); HSE (1983a); Mancini 
and Amendola (1983); Nieuwhof (1983a); Seaver and 
Sitwell (1983); J.C. Williams (1983,1985a,b, 1986,1988a,b, 
1992); Embrey et al. (1984); Siegel et al. (1984); Willey 
(1984); Ball (1985 LPB 62); Dhillon and Misra (1985); 
Leplat (1985); Carnino (1986); Dhillon (1986); Dhillon and 
Rayapati (1986); Hannaman et al. (1986); P. Miller and 
Swain (1987); Park (1987); Rasmussen, Duncan and Leplat 
(1987); J.B. Smith (1987); Whalley (1987); D.D. Woods, 
O’Brien and Hanes (1987); Bercani, Devooght and 
Smidts (1988); Bersini, Devooght and Smidth (1988); 
Dougherty and Fragola (1988); Drager, Soma and 
Falmyr (1988); Humphreys (1988a,b); Kirwan (1988); 

D. Lucas and Embrey (1988); Purdy (1988); Whittingham 
(1988); Worledge et al. (1988); Whalley and Kirwan (1989); 
ACSNI (1990,1991,1993); CMA (1990); Gall (1990); 
Kirwan et al. (1990); Lorenzo (1990); Ball (1991 SRDA R3); 
Bellamy (1991); Masson (1991); Hollnagel, Cacciabue and 
Rouhet (1992); Ishack (1992); Paradies, Unger and 
Ramey-Smith (1992); Samdal, Kortner and Grammeltvedt 
(1992); Sten and Ulleberg (1992); Vestrucci (1992); Welch 
(1992); Yukimachi, Nagasaka and Sasou (1992); Nawar and 
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Samsudin (1993); Wreathall (1993); Wreathall and Reason 
(1993); CCPS (1994/17) 

Organizational factors as cause of human error 

Bellamy (1983,1984,1986) 

Data banks 

Payne and Altaian (1962); Altaian (1964); Meister (1964); 
Rigby (1967); Swain (1970);Topmiller, Eckel and 
Kozinsky (1982) 

Vigilance tasks 

Ablitt (1969 UKAEA AHSB(S) R160); A.E. Green 
(1969 UKAEA AHSB(S) R172,1970); Kantowitz and 
Hanson (1981) 

Inspection tasks 

Mackenzie (1958); McCornack (1961); Rigby and Edelman 
(1968a); Drury and Addison (1973); Rigby and Swain 
(1975); Drury and Fox (1978); Pedersen (1984); Murgatroyd 
etal. (1986) 

Emergency situations 

Fitts and Jones (1947); Ronan (1953); Rigby and Edelman 
(1968b); Lees (1973a); AEC (1975); Lees and Sayers (1976); 
Danaher (1980); Apostolakis and Chu (1984); Giffin 
and Rockwell (1984); Woods (1984); Briggs (1988); 

Waters (1988b) 

Deliberate violations 

W.B. Howard (1983,1984); Zeitlin (1994) 

Human reliability assessment 

NRC (Appendix 28 Human Reliability Assessment)', 

R.A. Howard and Matheson (1980); Swain and Guttman 
(1980,1983); R.G. Brown, von Herrman and Quilliam 
(1982); R.E. Hall, Fragola and Wreathall (1982); Rasmussen 
and Pedersen (1982); Hannaman etal. (1983); L.D. Phillips 
etal. (1983);Weston (1983); Anon. (1984aa); Watson (1984 
LPB 58); White (1984 SRD R254); Hannaman etal. (1985); 
Hayashi (1985); Heslinger (1985); Pedersen (1985); Soon 
Heung Chang, Myung Ki Kim and Joo Young Park (1985); 
L.A.Watson (1985); R.F.White (1986); Hannaman and 
Worledge (1987); Murgatroyd and Tate (1987); Dougherty 
and Fragola (1988); Humphreys (1988a); Purdy (1988); 
Kirwan (1990); Oliver and Smith (1990); L.D. Phillips etal. 
(1990); Delboy, Dubnansky and Lapp (1991); Paradies, 
Unger and Ramey-Smith (1991); Banks and Wells (1992); 
Bridges, Kirkman and Lorenzo (1992); Zimolong (1992); 
J.C. Williams (1993); CCPS (1994/17) 

Benchmark exercise 
Waters (1988a, 1989); Poucet (1989) 

Pipework failures 

Bellamy, Geyer and Astley (1991); Geyer and Bellamy 
(1991); Hurst etal. (1991) 

Computer control (see also Table 8.1) 

Bellamy and Geyer (1988); Kletz (1993a) 

Effect of human error on system performance 
J. Cooper (1961); Cornell (1968); Ovenu (1969); R.L. Scott 
(1971); S. Brown and Martin (1977); Burkardt (1986); 
Gerbert and Kemmler (1986); Hancock (1986); B.J. Bell 
(1987); Latino (1987); Whitworth (1987); Holloway (1988); 
Suokas (1989); Rasmussen (1990); Vervalin (1990b); Pyy 
(1992); Rothweiler (1994 LPB 118) 


14.19.1 Engineering interest in human error 

Engineering interest in human error derives from two 
principal sources. One is accident investigation, where the 
apparent salience of human error gives rise to concern. The 
other is hazard assessment, where the requirement to 
quantify the effect of human error on system performance 
creates a demand for a methodology capable of doing this. 

In certain areas, such as an aircraft flightdeck, the 
primeemphasishasbeenontheapplicationofhumanfactors 
in system design to improve performance and reduce human 
error. In the nuclear field, however, there has been a much 
greater emphasis on the development of methodology for the 
assessment of the effect of human error on system perfor¬ 
mance. This has been the case in the process industries also. 

There are, therefore, two distinct sources of interest in 
human error in engineering. Design seeks to improve the 
work situation and should not too readily accept the 
inevitability of human error. Assessment must to a con¬ 
siderable extent accept the situation as it is and seek to 
evaluate human error. 

Work both on features that cause human error and on the 
methods of assessing it is a well established aspect of 
human factors. 

14.19.2 Human error as a cause of accidents 

Human error often figures as a major factor in analyses of 
incidents. Such an attribution appears in large part to 
derive from the nature of the investigative process. Refer¬ 
ence has already been made to the comment by Rasmussen 
that in the investigation of accidents the tracing of the 
causes is generally terminated when it reaches a human, as 
if this was a stopping rule of the tracing process. 

When a failure occurs, there is frequently an adminis¬ 
trative requirement to determine the cause, and allocation 
to human error is notorious. In fact, the incident has 
occurred in a specific set of circumstances involving men, 
machines, systems and procedures, physical and social 
factors, and their interactions. Often the error is more truly 
that of another party who is responsible for some aspect of 
the work situation. This point is important because, 
whereas assignment to human error suggests little can be 
done, recognition of the effect of the work situation does 
tend to indicate the possibilities for improvement. 

It is relevant to remember that experimental psycholo¬ 
gists frequently conduct experiments in which various 
aspects of the work situation are altered and the subject’s 
error rate is evaluated. This demonstrates clearly the 
importance of these factors in determining human error. 

The reporting of errors in man-machine systems is 
often deficient, because reporting systems are frequently 
designed essentially to give information on equipment 
failure. The reporting of malfunctions in missile systems 
was studied by J. Cooper (1961), who found that, whilst the 
reporting system did reveal failures involving equipment 
only, it was deficient in discovering those involving man as 
well. He found that man appeared to be involved in 
20-53% of all malfunctions for the systems studied, and 
this result is probably typical. 

Thus, other investigations of the contribution of man to 
system failure have been made - in aerospace by Cornell 
(1968), on nuclear reactors by R.L. Scott (1971) and on indus¬ 
trial boilers by Ovenu (1969). These studies too attribute a 
large proportion of failures in the system to human error. 

The contribution of human error to major accidents 
appears to be greater than it is to less serious failures. It has 
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been estimated by Rasmussen (1978) that whereas human 
error probably contributes about 10% to general failures, it 
contributes about 50-80% to major accidents. 

14.19.3 Approaches to human error 

In recent years, the way in which human error is regarded, 
in the process industries as elsewhere, has undergone a 
profound change. The traditional approach has been in 
terms of human behaviour, and its modification by means 
such as exhortation or discipline. This approach is now 
being superseded by one based on the concept of the work 
situation. This work situation contains error-likely situa¬ 
tions. The probability of an error occurring is a function of 
various kinds of influencing factors, or performance 
shaping factors. 

The work situation is under the control of management. 
It is therefore more constructive to address the features of 
the work situation that may be causing poor performance. 
The attitude that an incident is due to ‘human error’, and 
that therefore nothing can he done about it, is an indicator 
of deficient management. It has been characterized by 
Kletz (1990c) as the ‘phlogiston theory of human error’. 

There exist situations in which human error is particu¬ 
larly likely to occur. It is a function of management to try to 
identify such error-likely situations and to rectify them. 
Human performance is affected by a number of performance 
shaping factors. Many of these have been identified and stud¬ 
ied so that there is available to management some knowledge 
of the general direction and strength of their effects. 

The approach to the work situation has itself undergone 
development. Three phases may be distinguished. In the 
first phase, the concern was with error-likely situations 
and performance shaping factors in general and on the 
application of ergonomic and human factors principles. 
The second phase saw greater emphasis on cognitive and 
decision-making aspects of the task. The third phase seeks 
the root causes in the organizational and, more generally, 
socio-technical background. 

The approaches taken to human error may therefore be 
summarized as: 

(1) behavioural approach; 

(2) work situation approach: 

(a) general work situation, 

(b) cognitive features, 

(c) organizational features. 

Any approach that takes as its starting point the work 
situation, but especially that which emphasizes organiza¬ 
tional factors, necessarily treats management as part of the 
problem as well as of the solution. Kipling’s words are apt: 
‘On your own heads, in your own hands, the sin and the 
saving lies!’ 

14.20 Models and Classifications of Human Error 

A systematic approach to human error must involve the 
classification of errors and must, therefore, be based on 
appropriate models, either explicitly or implicitly. The 
classification is not necessarily along a single dimension. 
Most workers in the field have found it necessary to clas¬ 
sify in terms of at least two dimensions: (1) human beha¬ 
viour and (2) task characteristics. 

An early detailed classification of operator error, which 
was developed for use in analysing licensee event reports 


(LERs) for nuclear plants by Rasmussen, quoted by 
J.R. Taylor (1979), is shown in Table 14.12. Also shown in the 
table is an analysis of 200 such reports. A more comprehen¬ 
sive version of this analysis is given by Rasmussen (1980). 
This classification includes categories both of behaviour 
and of task. 

14.20.1 Task analysis framework and model 

The general framework in which most models and classi¬ 
fications of human error are applied is that of task analysis. 
That is to say, the task is decomposed into elements such as 
plans and actions and the errors associated with these are 
modelled and classified. The extent of the decomposition 
varies, some approaches being highly decompositional and 
others more holistic, as discussed below. 

In addition to being a general framework within which 
particular models are applied, task analysis, particularly 
hierarchical task analysis, may be regarded as a model in 
its own right. One common classification of human error is 
in terms of actions. This type of classification refers to acts 
of omission, acts of commission, and also delays in taking 
action and so on. It does not attempt to explain them in 
terms of any other model, such as one involving skills or 
ahsentmindedness, although it make take into account 
various types of influencing factor. This approach has 
much in common with hazop in the way in which action 
errors are classified. The similarity between the task ana¬ 
lysis scheme and the human error classification shown in 
Tables 14.9 and 14.18 respectively, makes the point. 

14.20.2 Work situation framework and models 

Another general framework in the modelling of human 
error is the work situation, which covers the task itself and 
the various influencing factors including the ergonomic, 
the cognitive and the organizational. Where an approach is 
adapted to human error which accords a central role to the 
work situation, or some aspect of it such as communication, 
the work situation virtually becomes the model. In such a 
model, the emphasis tends to be on identifying, classifying 
and quantifying the strength of the factors influencing 
human error rather than on seeking a more fundamental 
explanation. 

14.20.3 Demand-capacity mismatch model 

Tbrning now to other models of human error, or human 
reliability, one early model views it as a mismatch between 
the demands of the task and the capacity of the human to 
perform the task. The mismatch may arise in various ways. 
It maybe due, for example, to physical incapacity. Or it may 
arise from lack of training. 

A particular case, which is properly regarded as invol¬ 
ving human reliability rather than human error, is where 
sudden death or incapacity, such as a heart attack, occurs. 
This may need to be taken into account in relation to crucial 
functions. 

14.20.4 Tolerance-variability model 

Another early model starts from the viewpoint that funda¬ 
mental to human error is variability, both of people and of 
tasks. Variability in performance is associated with the 
desirable human feature of adaptability. Variability is also 
present in the task. Even a standardized assembly opera¬ 
tion involves some variability. More complex industrial 
tasks are much more variable. 
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Table 14.12 Classification of operator error in 200 
licensee event reports (J.R. Taylor, 1979; after Rasmussen) 


No. 


Task condition 

Routine task on schedule 89 

Routine task on demand 11 

Special task on schedule 51 

Ad hoc, improvization 21 

Various, not mentioned 27 

Task control 

Paced by system dynamics 9 

Paced by program, orders 4 

Self-paced 166 

Various, not mentioned 21 

Error situation 

Spontaneous error in undisturbed task 93 

Change in condition of familiar task 27 

Operator distracted in task, preoccupied 10 

Unfamiliar task 22 

Various, not mentioned 48 

Task 

Monitoring and inspection 3 

Supervisory control 13 

Manual operation, manual control 17 

Inventory control 30 

Test and calibration 47 

Repair and modification 60 

Administrative, recording 4 

Management, staff planning 13 

Various, not mentioned 13 

Effect from 

Specified act not performed 103 

Positive effect of wrong act 65 

Extraneous effect 15 

Sneak path 12 

Various, not mentioned 6 

Potential for recovery 

Effect not immediately reversible 29 

Effect not immediately observable 137 

Various, not mentioned 34 

Error categories 

Absent-mindedness 3 

Familiar association 6 

Capability exceeded 1 

Alertness low 10 

Manual variability, lack of precision 10 

Topographic, spatial orientation inadequate 10 

Familiar routine interference 0 

Omission of functionally isolated act 56 

Omission of administrate act 12 

Omission, other 9 

Mistake, interchange among alternative possibilities 11 
Expect, assume rather than observe 10 

System knowledge, insufficient 2 

Side- effects of process not adequately considered 15 

Latent causal condition or relations not 20 

adequately considered 

Reference data recalled wrongly 1 

Sabotage 1 

Various, not mentioned 17 


Some variations in the performance of the task can be 
tolerated. It is only when some limit is overstepped that 
error is said to occur. The definition of error is therefore 
critical. The limits may be defined in various ways such as 
physical barriers, warning signs, operating procedures, 
production tolerances and standards, process conditions, 
and social and legal codes. 

Swain (1972) distinguishes between random, systematic 
or sporadic errors. Random and systematic errors can 
usually be corrected by reducing, respectively, the variance 
and the bias in the performance of the task, but it may be 
more difficult to understand and correct sporadic errors, 
which typically involve sudden and often large excursions 
out of limits. 

14.20.5 Time availability model 

Another type of model is based on the premise that human 
reliability in certain tasks, particularly emergency response, 
increases with the time available to perform the task. 
This model might be regarded as a particular case of the 
demand-capacity mismatch model. 

14.20.6 Skills-rules-knowledge model 

The skills-rules-knowledge (SRK) model, developed by 
Rasmussen (1986), treats the human as operating on the 
three levels of skills, rules and knowledge. Each level has 
its characteristic types of error. An account of this model 
has been given in Section 14.12. 

14.20.7 Absentmindedness model 

The absentmindedness model, developed by Reason (1990), 
distinguishes between slips, lapses and mistakes. A slip is 
either (1) an error in implementing a plan, decision or 
intention, where the plan is correct but the execution is not 
or (2) an unintended action. A lapse is an error in which the 
intended action is not executed due to a failure of memory. 
A mistake is an error in establishing a course of action 
such as an error in diagnosis, decision-making or planning. 
This model is described more fully in Chapter 26. 

14.20.8 Organizational model 

The organizational, or socio-technical system, model 
stresses the contribution of organizational and wider socio- 
technical factors to human error. It may be regarded as a 
version of the work situation model that puts particular 
emphasis on these factors. 

14.20.9 Violations 

It is recognized that some actions are not strictly human 
errors but outright violations. There appears to be no 
developed model for violations. Whilst it is now accepted 
that human error is something that is under the influence of 
management, this is less so for violations. In this respect, 
the treatment of violations seems to be at the point where 
that of human error was some two or three decades ago. 
There is a need for a better understanding of why viola¬ 
tions occur and how they may be designed out. 

14.20.10 Decompositional and holistic approaches 

Along a different dimension, approaches to human error may 
be characterized either as decompositional or as holistic. 
In the decompositional approach, also referred to as ‘reduc¬ 
tionist’,‘mechanistic’or ‘atomistic’, the task is decomposed 
into its constituent elements, and for each element the prob¬ 
ability of failure is estimated. The probability of failure for 
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the task overall is taken as the product of the individual 
probabilities. Allowance may be made for certain features 
such as dependent failure, but for the most part other 
aspects of task failure such as errors in decision-making are 
not well handled. The holistic approach by contrast takes 
high level elements of the work and thus covers features such 
as decision-making. 

14.20.11 Classifications of human error 

Classifications of human error flow from the above 
described models. A common distinction, based essentially 
on the task analysis model, is between errors of omission, 
transformation or commission. A human may fail to 
execute a required action, or he may execute it but incor¬ 
rectly or out of sequence or too slowly, or he may execute an 
unwanted action. Errors of omission may involve failures of 
attention or memory, and errors of commission failures in 
identification, interpretation or operation. Error classifi¬ 
cations along these lines have been given by Lincoln (1960) 
and Swain (1970). 

Classifications related to the work situation model are 
typically in terms of the influencing factors. The SRK 
model of Rasmussen gives rise to a classification based on 
distinction between errors arising at the levels of skill, 
rules and knowledge. The classification deriving from 
Reasons’s absentmindedness model is into slips, lapses and 
mistakes. 

Another classification of human error is based on the 
relationship in time of the error to the initiating event in an 
incident sequence. If the error precedes the initiating event, 
it is a latent, or enabling, error. If it is the direct cause of the 
event, it is an initiating error. And if it follows the event, it is 
a response or recovery error. 

14.21 Human Error in Process Plants 

14.21.1 Human error in general and in plant operation 

An overview of human error in process plants is given in 
An Engineer’s View of Human Error (Kletz, 1991e). This 
work provides a useful account of the practicalities of 
human error in the various activities occurring on such 
plants. Kletz describes the following types of human error: 


(1) 

simple slips; 


(2) 

errors due to poor training or 

' instructions; 

(3) 

errors due to lack of physical 

or mental abili 

(4) 

wrong decisions; 


(5) 

management errors. 


He treats human error in: 


(6) 

design; 


(7) 

construction; 


(8) 

operation; 


(9) 

maintenance. 



Kletz also gives numerous examples. 

The basic approach that he adopts is that already 
described. The engineer should accept people as they are 
and should seek to counter human error by changing the 
work situation. In his words: ‘To say that accidents are due 
to human failing is not so much untrue as unhelpful. It does 
not lead to any constructive action’. 

In designing the work situation the aim should be to 
prevent the occurrence of error, to provide opportunities 


to observe and recover from error, and to reduce the con¬ 
sequences of error. 

Some human errors are simple slips. Kletz makes the point 
that slips tend to occur not due to lack of skill but rather 
because of it. Skilled performance of a task may not involve 
much conscious activity. Slips are one form of human error to 
which even, or perhaps especially, the well trained and skil¬ 
led operator is prone. Generally, therefore, additional train¬ 
ing is not an appropriate response.The measures that can be 
taken against slips are to (1) prevent the slip, (2) enhance its 
observability and (3) mitigate its consequences. 

As an illustration of a slip, Kletz quotes a incident where 
an operator opened a filter before depressurizing it. He was 
crushed by the door and killed instantly. Measures pro¬ 
posed after the accident included: (1) moving the pressure 
gauge and vent valve, which were located on the floor 
above, down to the filter itself; (2) providing an interlock 
to prevent opening until the pressure had been relieved; 
(3) instituting a two-stage opening procedure in which the 
door would be ‘cracked open’ so that any pressure in the 
filter would be observed and (4) modifying the door handle 
so that it could be opened without the operator having to 
stand in front of it. These proposals are a good illustration 
of the principles for dealing with such errors. The first two 
are measures to prevent opening while the filter is under 
pressure; the third ensures that the danger is observable; 
and the fourth mitigates the effect. 

One area of process operation where slips are liable to 
occur is in the emptying and filling of equipment. It is often 
necessary to drain a vessel or other equipment such as a 
pump. Not infrequently, fluid is admitted to the equipment 
while the drain valve is still open. In some applications, an 
interlock may be the appropriate solution, as described in 
Chapter 13. 

Misidentification of the equipment to be worked on is 
another fertile source of error. Kletz gives as an example a 
plant that had an alarm and trip on the same process vari¬ 
able and where the technician who intended to work on the 
alarm in fact disabled the trip. He also gives a number of 
examples of the operation of the wrong press button or the 
wrong valve caused by inconsistent labelling. The identifi¬ 
cation of equipment for maintenance is considered in more 
detail in Chapter 21. 

Another type of slip is failure to notice. This is particu¬ 
larly liable to occur if some item is similar but not identical. 
A case in point is where an operator draws from a drum 
which contains the wrong chemical but where the drums 
containing the right and the wrong chemicals have similar 
markings. 

The need to calculate some process quantity introduces a 
further opportunity for error. In some cases, the result may 
be sufficiently unusual as to highlight the error, but in 
others it may not. 

Many human errors in process plants are due to poor 
training and instructions. In terms of the categories of 
skill-, rule- and knowledge-based behaviour, instructions 
provide the basis of the second, whilst training is an aid 
to the first and the third, and should also provide a moti¬ 
vation for the second. Instructions should be written to 
assist the user rather than to hold the writer blameless. 
They should be easy to read and follow, they should be 
explained to those who have to use them, and they should 
be kept up to date. 

Problems arise if the instructions are contradictory or 
hard to implement. A case in point is that of a chemical 
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reactor where the instructions were to add a reactant over a 
period of 60-90 min, and to heat it to 45°C as it was added. 
The operators believed this could not be done as the heater 
was not powerful enough and took to adding the reactant at 
a lower temperature. One day there was a runaway reac¬ 
tion. Kletz comments that if operators think they cannot 
follow instructions, they may well not raise the matter but 
take what they believe is the nearest equivalent action. In 
this case, their variation was not picked up as it should 
have been by any management check. If it is necessary in 
certain circumstances to relax a safety-related feature, this 
should be explicitly stated in the instructions and the gov¬ 
erning procedure spelled out. 

Certain features of the operation and maintenance of 
process plants should be covered in elementary training. 
Incidents occur because operators do not fully appreciate 
the basic properties and hazards of flammable and toxic 
chemicals and the precautions necessary in handling them, 
the operation and hazards of pressure systems, the reasons 
for the principal procedures and the importance of adher¬ 
ence to all procedures.This elementary training is discussed 
in more detail in Chapter 28. 

There are a number of hazards which recur constantly 
and which should be covered in the training. Examples are 
the hazard of restarting the agitator of a reactor and that of 
clearing a choked line with air pressure. 

Training should instil some awareness of what the trainee 
does not know. The modification of pipework that led to 
the Flixborough disaster is often quoted as an example of 
failure to recognize that the task exceeded the competence of 
those undertaking it. 

Kletz illustrates the problem of training by reference to 
the Three Mile Island incident. The reactor operators had a 
poor understanding of the system, did not recognize the 
signs of a small loss of water and they were unable to 
diagnose the pressure relief valve as the cause of the leak. 

Installation errors by contractors are a significant con¬ 
tributor to failure of pipework. Details are given in 
Chapter 12. Kletz argues that the effect of improved 
training of contractors’ personnel should at least be more 
seriously tried, even though such a solution attracts some 
scepticism. 

Human error may occur due to physical or mental 
inability to perform the task. Even if there is not total 
inability, the task may be very difficult and therefore liable 
to error. Physical difficulties can arise in the manipulation 
of controls and valves. The task may require the operator to 
observe a display whilst manipulating a control, but the 
display may be too far from the control to do this. Manual 
valves on the plant may be inaccessible or stiff to turn. 
The need to use protective equipment such as breathing 
apparatus may introduce physical difficulties. 

There are a number of situations that may create mental 
difficulties. Mental overload is one such situation that may 
come in various forms. The operator may suffer overload 
due to an excessive number of alarms. A supervisor may be 
overloaded by the number of permits-to-work. Another 
type of mental difficulty occurs where the operator is 
required to undertake tasks that are not his forte. One case 
is detection of rare events. Another is taking over in an 
emergency from a totally automated system. 

Another category of human error is the deliberate deci¬ 
sion to do something contrary to good practice. Usually it 
involves failure to follow procedures or taking some other 
form of short-cut. Kletz terms this a ‘wrong decision’. 


WB. Howard (1983,1984) has argued that such decisions 
are a major contributor to incidents, arguing that often an 
incident occurs not because the right course of action is 
not known but because it is not followed: ‘We ain’t farmin’ 
as good as we know how’. He gives a number of examples 
of such wrong decisions by management. 

Other wrong decisions are taken by operators or 
maintenance personnel. The use of procedures such as the 
permit-to-work system or the wearing of protective cloth¬ 
ing are typical areas where adherence is liable to seem 
tedious and where short-cuts may be taken. 

A powerful cause of wrong decisions is alienation. 

Wrong decisions of the sort described by operating 
and maintenance personnel may be minimized by making 
sure that rules and instructions are practical and easy to 
use, convincing personnel to adhere to them and auditing 
to check that they are doing so. 

Responsibility for creating a culture that minimizes and 
mitigates human error lies squarely with management. The 
most serious management failing is lack of commitment. To 
be effective, however, this management commitment must 
be demonstrated and made to inform the whole culture of 
the organization. 

There are some particular aspects of management 
behaviour that can encourage human error. One is insular¬ 
ity, which may apply in relation to other works within the 
same company, to other companies within the same indus¬ 
try or to other industries and activities. Another failing to 
which management may succumb is amateurism. People 
who are experts in one field may be drawn into activities in 
another related field in which they have little expertise. 

Kletz refers in this context to the management failings 
revealed in the inquiries into the Kings Cross, Herald of Free 
Enterprise and Clapham Junction disasters. Senior manage¬ 
ment appeared unaware of the nature of the safety culture 
required, despite the fact that this exists in other industries. 

14.21.2 Human error and automation 

The automation of functions previously performed by the 
human operator can give rise to certain characteristic prob¬ 
lems. These ironies of automation have been discussed by 
Bainbridge (1983), who identifies four areas of concern. 
One is the potential for deterioration of the skills of the 
process operator. Another is the need for the operator to 
monitor the functioning of the automatic equipment, a role 
to which he is not particularly well suited. The third is the 
difficulty for the operator of maintaining an up-to-date 
mental model of the status of the process in case he has to 
intervene. The fourth is the tendency of automated systems 
to reduce small variations at the price of occasionally 
introducing very large ones. 

These characteristics of automated systems were dis¬ 
cussed in general terms in the early part of this chapter. Here 
attention is drawn to their potential to induce human error. 

14.21.3 Human error in plant maintenance 

Much of the literature on human error in process plants is 
devoted to the process operators. However, a large propor¬ 
tion of serious incidents is attributable to errors in main¬ 
tenance work. Maintenance errors may endanger those 
doing the work, the plant, or both. 

Several treatments of human error in maintenance work 
have been published by the Health and Safety Executive 
(HSE). Accounts illustrated with case histories are given 
in Deadly Maintenance (HSE, 1985b) and Dangerous 
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Maintenance (HSE, 1987a). Human Factors in Industrial 
Safety (HSE, 1989 HS(G) 48) gives general guidance on 
human factors relevant inter alia to maintenance work. 

Here again it is appropriate to start with the designer. If it 
is practical to design out the need for maintenance, the 
problem disappears. 

One cause of error in maintenance is lack of understand¬ 
ing either of the process and chemicals or of the equipment. 
This is exemplified by a number of incidents where the 
wrong bolts have been loosened on a valve, resulting in a 
release. 

Maintenance is an area where poor practices can easily 
creep in. An example is breaking a flange the wrong way. 
Maintenance personnel on process plants spend a large 
proportion of their time dealing with heavy, dirty equip¬ 
ment. It is not easy to make the transition required when 
they have to work on relatively delicate items. A case in 
point is leaving flameproof equipment with loose screws 
and an excessive gap so that it is no longer flameproof. 

In some cases defects of workmanship in maintenance 
are gross. Kletz cites a case where a fitter had to remake a 
flanged joint using a new spiral wound gasket. Since it was 
too large, he ground depressions in the outer metal ring of 
the gasket so that it would fit between the bolts. He made 
matters worse by making only three depressions so that the 
gasket did not fit centrally between the bolts. 

Maintenance is an activity which can often be frustrat¬ 
ing and short-cuts may be taken. Use of protective clothing, 
isolation procedures and the permit-to-work system are 
areas where such short-cuts tend to be taken. 

Reference has already been made to errors in identifica¬ 
tion of equipment. Measures need to be taken to ensure 
effective identification. 

An overview of the management of maintenance to 
ensure safe working is given in Chapter 21. 

14.21.4 Human error in pipework failure 

In construction, errors in the installation of pipework loom 
large. The problem was highlighted in a survey by Kletz 
(1984k), who has given a checklist aimed at eliminating 
such defects. Two of the measures proposed by Kletz to 
reduce pipework construction errors are improved train¬ 
ing of the construction workforce, as already described, 
and the use of the barrier principle. A more detailed 
treatment of Kletz’ work on pipework errors is given in 
Chapter 12. 

This theme has been taken up again in the study of 
pipework failure, and human error as cause of such failure, 
described by Bellamy and co-workers (Bellamy, Geyer and 
Astley, 1989; Geyer et al., 1990; Geyer and Bellamy, 1991; 
Hurst et al., 1991). This study has already been referred to in 
Chapter 12 in dealing with failure of pipework, where a 
number of tables are given based on this study. 

A total of 921 incidents from incident data bases were 
reviewed, some analysis was done on all 921 incidents and 
further analysis on some 502 incidents. Incidents were 
classified in three ways: (1) ‘direct cause’, (2) ‘origin of fail¬ 
ure’ or underlying cause and (3) ‘recovery failure’ or pre¬ 
ventive mechanism. 

The crude data showed that operator error contributed 
18.2% to the direct causes of pipework failure, whilst 
defective pipe or equipment contributed 31.9% and 
unknown causes 9.1%. If the last two categories are 
removed from consideration, operator error then contri¬ 
butes 30.9%. Table 14.13, Section A, shows the contribution 


Table 14.13 Human error as a cause of pipework 


failure (after Bellamy, Geyer and Astley, 1989) (Courtesy 
of the Health and Safety Executive) 

A Direct causes 

Cause 

Contribution of 
human error (%) 

Operator error 

30.9 

Wrong or incorrectly located 
in-line equipment 

4.5 

Human-initiated impact 

5.6 

Total 

41.0 

B Underlying cause 

Cause 

Distribution of human error 
between underlying causes (%) 

Design 

8 

Manufacture 

2 

Construction 

8 

Operation 

22 

Maintenance 

59 

Sabotage 

1 

Total 

100 

C Recovery failures 

Failure 

Distribution of human error 
between recovery failures (%) 

Not recoverable 

1 

Hazard study 

6 

Human factors review 

60 

Task checking 

31 

Routine checking 

2 

Total 

100 


to the direct causes of operator error and of two other 
human errors. Sections B and C of the table give the dis¬ 
tribution of human error among the underlying causes and 
the recovery failures, respectively. For the former, the pre¬ 
dominant errors are in maintenance and for the latter, in 
human factors review and task checking. 

14.21.5 Human error and plant design 

Tbrning to the design of the plant, design offers wide scope 
for reduction both of the incidence and consequences of 
human error. It goes without saying that the plant should 
be designed in accordance with good process and mechani¬ 
cal engineering practice. In addition, however, the designer 
should seek to envisage errors that may occur and to guard 
against them. 

The designer will do this more effectively if he is aware 
from the study of past incidents of the sort of things that 
can go wrong. He is then in a better position to understand, 
interpret and apply the standards and codes, which are one 
of the main means of ensuring that new designs take into 
account, and prevent the repetition of, such incidents. 

A significant contribution can be made by the designer 
to the elimination of errors leading to pipework failures. 
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One is to remove situations vulnerable to an operator error 
such as opening the wrong valve so that the plant suffers 
overpressure or undertemperature. Another is to counter 
errors in construction and maintenance by applying the 
barrier principle so that it is literally impossible to assem¬ 
ble an item in a manner other than the correct one. 

Another area where the designer has a large contribution 
to make is in facilitating maintenance activities on the 
plant. This includes: provision of access to equipment, 
pipework and valves; pipework arrangements which assist 
isolation of sections of plant; and measures to prevent of 
misidentification of equipment. 

An aspect of operation that provides a new field for 
human error is computer control of process plants. This is 
considered in Chapter 13. 

14.21.6 Human error and organizational factors 

At a fundamental level human error is largely determined 
by organizational factors. Like human error itself, the sub¬ 
ject of organizations is a wide one with a vast literature, and 
the treatment here is strictly limited. 

It is commonplace that incidents tend to arise as the 
result of an often long and complex chain of events. The 
implication of this fact is important. It means in effect that 
such incidents are largely determined by organizational 
factors. An analysis of 10 incidents by Bellamy (1985) 
revealed that in these incidents certain factors occurred 
with the following frequency: 


Interpersonal communication errors 9 

Resources problems 8 

Excessively rigid thinking 8 

Occurrence of new or unusual situation 7 

Work or social pressure 7 

Hierarchical structures 7 

‘Role playing’ 6 

Personality clashes 4 


The role of organizational factors is a principal theme in the 
work of Kletz, who has described a number of incidents that 
appear to arise from failures which at the superficial level 
might be assigned to hardware or humans, but which on 
deeper investigation can be attributed to organizational 
aspects. He describes the process of seeking out these more 
fundamental causes as ‘peeling the onion’. 

Organizational factors are to a degree taken into account 
in current methods of human reliability analysis (HRA) in 
several ways. In particular, allowance is made for these 
factors in relation to oral and written procedures and to 
factors that influence task performance. 

14.21.7 Human error in communications 

One aspect of organizational factors is interpersonal com¬ 
munication. Communications is one of the relatively few 
topics in human error in process plants that has been the 
subject of study. Work on communication errors has been 
described by Bellamy (1983, 1984, 1985). She found that 
interpersonal communication errors played a part in nine 
out of the ten incidents which she studied (Bellamy, 1985). 
The errors might be associated with either enabling or 
initiating events. 

Incidents studied by Bellamy (1983) include the explo¬ 
sion at Flixborough, the explosion at Houghton Main col¬ 
liery and the radioactive release at Sellafield. Figure 14.22 


shows her analysis of the chain of events at Houghton Main 
in which communication errors were prominent. 

It is normal to place considerable reliance on commu¬ 
nication as a line of defence. Where this is the case it is 
necessary to take steps to ensure that the communication is 
effective. In order to ensure the integrity of communication, 
there is need for a considerable degree of formality in the 
communication procedures. In certain fields, such as air 
traffic control, this is normal practice. In the process indus¬ 
tries, the degree of formality in communication tends to be 
variable. Two important features include the handover pro¬ 
cedures and permit-to-work system. Other aspects of com¬ 
munication may be less formal. 

Table 14.14 is a list given by Bellamy (1983) of some of the 
errors that may occur in interpersonal communications. 
One feature prominent in the incidents that she describes is 
ambiguous or incomplete messages occurring within a 
formal system. The existence of a formal system such as 
handover with associated logbooks may not, therefore, 
be sufficient if in practice the quality of communication 
within it is poor. 

Two central features of the system of communication on a 
plant are the permit-to-work system and the handover sys¬ 
tem. It is not surprising, therefore, that many communica¬ 
tions errors are associated in some way with one or other 
of these systems. Kletz (1991e) gives as an illustration the 
instance of the failure of a permit-to-work system, descri¬ 
bed in Chapter 20. 

14.22 Prevention and Mitigation of Human Error 

There exist a number of strategies for prevention and 
mitigation of human error. Essentially these aim to: 

(1) reduce frequency; 

(2) improve observability; 

(3) improve recoverability; 

(4) reduce impact. 

Some of the means used to achieve these ends include: 

(1) design-out; 

(2) barriers; 

(3) hazard studies; 

(4) human factors review; 

(5) instructions; 

(6) training; 

(7) formal systems of work; 

(8) formal systems of communication; 

(9) checking of work; 

(10) auditing of systems. 

The Guide to Reducing Human Error in Process Operation 
compiled by the Human Factors in Reliability Group 
(HFRG), (1985 SRD R347) gives guidance in check-list form. 
The checklists cover (1) operator-process interface, (2) pro¬ 
cedures, (3) workplace and working environment, (4) train¬ 
ing and (5) task design and job organization. 

14.22.1 Role of engineering measures 

There is some danger that emphasis on the apparently 
dominant role of human error in major incidents may 
induce in the engineer a feeling of helplessness. This is 
misplaced. As this chapter indicates, there is a variety of 
methods, from the managerial to the technical, which can 
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| Failed to issue sufficient warnings"] 



Figure 14.22 Chain of events in the Houghton Main colliery accident illustrating communication errors (Bellamy, 
1983. Reproduced by permission.) 
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Table 14.14 Some human errors in interpersonal 
communication (Bellamy, 1983. Reproduced with 
permission.) 

1. Sender errors 

(a) In encoding information 

Information not encoded (e.g. message contains no 
information) 

Information ambiguous (e.g. semantic ambiguity) 
Information incomplete (e.g. details omitted) 
Information or code incorrect (e.g. wrong values given, 
wrong terms used) 

Code inappropriate (e.g. code foreign to intended 
receiver) 

(b) In transmitting information 

Information not transmitted (e.g. not sent, not recorded) 
Information not transmitted in time (e.g. too late for 
action to be taken) 

Information transmitted via incorrect channel (e.g. 
standard channel not used) 

Unacknowledged transmission not repeated (e.g. repeat 
not possible) 

Acknowledged transmission not corrected (e.g. error in 
the acknowledgement not noticed) 

2. Receiver errors 

Failure to acquire message (e.g. does not read record 
book, ignores message) 

Incomplete decoding of message (e.g. forgets details) 
Incorrect decoding of message (e.g. misinterprets 
meaning) 

Receipt of message not acknowledged (does not give 
feedback to sender) 

Receipt of message acknowledged but no feedback of 
decoded message (e.g. does not repeat back 
interpreted content of message) 

Feedback of decoded message is ambiguous (e.g. 
semantic ambiguity) 

3. Errors in additional recording of sent or received 
messages 

Sent information not recorded (e.g. not written down) 
Received information not recorded (e.g. not written 
down) 

Information recorded but poorly encoded ( see 1(a)) 

(e.g. in written report) 


be used to reduce the frequency with which human error 
gives rise to an initiating event. But it may well be in his 
contribution to the mitigation of the consequences that the 
engineer comes into his own. 


14.23 Assessment of Human Error 

Turning now to the assessment of human error, the growing 
use of quantitative risk assessment has created a demand 
for the development of techniques for the assessment of 
human error to complement those available for the assess¬ 
ment of hardware failures. 

In the following sections an account is given of develop¬ 
ments in the assessment of human error. First, the task 
analytic approach is described in which a task is decom¬ 
posed into its elements and error rates are assigned to 
each of these elements (Section 14.24). Next, an overview 


is given of early attempts to decompose the process control 
task into elements for which there might be available 
information on human error probabilities (Section 14.25). 
The account then reverts to qualitative methods developed 
to ensure that the analyst has a sound understanding of 
the problem before embarking on quantification (Section 
14.26). There follow descriptions of some of the principal 
methods of estimating human reliability (Sections 14.27- 
14.32), of performance shaping factors (Section 14.33) and 
of human error data (Sections 14.34). Treatments are then 
given of certain guides and overviews, including a bench¬ 
mark exercise, and of applications at Sizewell B (Sections 
14.35—14.39). The topic of human reliability assessment 
is replete with acronyms and the account here necessarily 
reflects this. 


14.24 Assessment of Human Error: Task 
Analytic Approach 

Turning then to the methods available for making a quan¬ 
titative assessment of human error in process plant opera¬ 
tion, the starting point is analysis of the task. 


14.24.1 Task analysis 

Early work on discrete tasks generally took as its starting 
point some form of task analysis in which the task was 
broken down into its component parts. The probabilities of 
error in the performance of these component subtasks were 
then estimated and the probability of error in the complete 
task then assessed. 

A methodology based on the task analytical approach, 
the technique for human error rate prediction (THERP), 
developed by Swain and co-workers is described below. An 
overview of this type of approach is given here based on an 
early account by Swain (1972). 

Estimates of the probability of success in a planned dis¬ 
crete task may be made at different levels of sophistication. 
At one extreme, an average task error rate of, say, 0.01 is 
sometimes quoted.Thisis apparently based on the assump¬ 
tion that the average element error rate is 0.001 and that 
there are, on average, 10 elements per task. At the other 
extreme is the collection and application of experimental 
data on error rates as a function of the performance shap¬ 
ing factors. 

An important aspect of task reliability is the possibility 
of recovery by detection and correction of the error. If an 
error is retrievable in this way, the error rate for the task 
may be reduced by orders of magnitude. The probability of 
recovery depends very much on the cues available con¬ 
cerning the error, whether from displays and controls or 
from the system generally. 

The effect of an error is also relevant, since only a pro¬ 
portion of errors have significant effects. Swain suggests 
that if the probability that an error will occur is between 
10“ 4 and 1CT 3 , that it will be corrected is between 0.02 and 
0.2 and that it will have a significant effect is between 0.2 
and 0.3, then the probability that an error will occur, will 
remain undetected and will have a significant effect is of 
the order 0.4 x 10 -6 to 60 x 10“ 6 . 

The application of task reliability calculation to process 
control is exemplified by the work of Ablitt (1969 UKAEA 
AHSB(S) R160) on the estimation of the reliability of 
execution of a schedule of trip and warning tests involving 
some 55 items. 
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14.25 Assessment of Human Error: Process 
Operation 

It was recognized early on that the above approach, based 
as it is on routine tasks such as equipment assembly, was of 
dubious applicability to the overall task of process control, 
and attempts were made to classify tasks in process control 
so as to make the links between these tasks and relevant 
areas of research in human factors. 

One such classification is that given by Lees (1973a, 
1980b), who breaks the overall process control tasks down 
into three categories on which information is available: 

(1) simple tasks, (2) vigilance tasks and (3) emergency beha¬ 
viour - and two further more difficult categories - (4) com¬ 
plex tasks and (5) control tasks. In this classification, simple 
tasks are essentially the planned, usually routine, discrete 
tasks of the type just described, whereas complex tasks are 
those which are not routine but require some element of 
decision-making.The control task is essentially the residual 
of the operator’s overall task in supervising the process, 
after exclusion of the specific simple and complex tasks, the 
vigilance, or monitoring, task and emergency response.The 
classification was an early attempt to decompose the process 
control task into categories that are recognized in work on 
human factors and on which there is therefore some prospect 
of obtaining data, or at least guidance. 

A more recent but somewhat similar classification is 
that given by Dougherty and Fragola (1988). They give the 
following analogy between hardware failures and human 
error: 


Hardware failure 

Human activity 

Demand failure 

Plan-directed behaviour 

Stand-by failure 

Vigilance behaviour 

Running failure 

Event-driven behaviour 


To the above list might be added, for hardware, emergency 
response failure and, for human activity, emergency 
response behaviour. 

Other techniques which take a more holistic approach to 
complex tasks are the goal-directed activity (GDA) techni¬ 
que and success likelihood index method (SLIM) of 
Embrey and the human error assessment and reduction 
technique (HEART) of Williams, described below. 

14.25.1 Routine tasks 

As described above, the usual approach to the estimation of 
human error rates in simple, or routine, tasks is to break the 
task down into its constituent elements and to derive an 
estimate of the reliability of the task from that of its con¬ 
stituent elements. The deficiencies of this rather mecha¬ 
nistic approach have long been recognized for any task that 
involves decision-making, but it may serve to the degree 
that a routine task may be defined as one that does not 
require decision-making so that errors are confined to slips 
rather than mistakes. Given this restriction, the methods 
developed inTHERP may be used. Alternatively, use may 
be made of the methods developed for complex, or non¬ 
routine tasks, as described below. 

14.25.2 Vigilance tasks 

A vigilance task involves the detection of signals. There 
is a large body of work on the performance of vigilance 


tasks. Some of the factors that affect performance in such 


(1) sensory modality; 

(2) nature of signal; 

(3) strength of signal; 

(4) frequency of signal; 

(5) expectedness of signal; 

(6) length of watch; 

(7) motivation; 

(8) action required. 

Sight and hearing are the main channels for receiving the 
signal. The signal itself may be a simple GO—NO GO one or 
a complex pattern. In this latter case, the out-of-limit con¬ 
dition may not be well defined in advance, but may have to 
be judged by the subject at the time. The signal may be 
strong and noise-free or weak and noisy, it may be frequent 
or infrequent and it may be an expected or unexpected 
type. The performance of the subject is affected by such 
factors as length of watch, degree of motivation and the 
action required on receipt of the signal. 

Some general conclusions may be drawn from the work 
on vigilance. In general, the auditory channel is superior to 
the visual for simple GO-NO GO signals such as alarms. 
The probability of detection of a signal varies greatly with 
signal frequency; detection is much more probable for fre¬ 
quent than for infrequent signals. Avigilance effect exists 
so that performance tends to fall off with time. 

There is an appreciable amount of data on vigilance tasks 
such as scanning displays, responding to alarms, and so 
on. A typical piece of work on vigilance in process control is 
that described byA.E. Green (1969 UKAEA AHSB(S) R172, 
1970). The equipment used was the Human Response Ana¬ 
lyser and Timer for Infrequent Occurrences (HORATIO), 
which automatically produces signals that are reasonably 
representative in form and time distribution of certain 
types of fault indication, and measures the time interval 
between the onset of the signal and the operator’s response 
to it. Experiments were conducted in nuclear reactor con¬ 
trol rooms in which operators were asked to respond to a 
simultaneous visual indication and an audible alarm signal 
by pressing a button. The signal rates were between 0.35 
and 1.5 events/h. The probability of failure to respond to 
signals within the allowed response time was about 10~ 3 . 

Another related type of task is inspection, which has 
also been much studied. In general, there is a greater 
probability of error in an inspection task where it is rather 
passive, the discrimination required is simple, the defect 
rate is low and the inspection is continuous. If there are 
more active features, such as taking measurements to 
detect the defect, the defect rate is high and inspection is 
alternated with another task, the error rate is reduced. 
A survey by McCornack (1961) suggests that with a defect 
probability of 0.01 the average inspection error is about 
0.15, but inspection error probabilities vary widely and 
Swain (1972) quotes the range 0.01-0.6. 

14.25.3 Emergency behaviour 

Another definable task is response to an emergency This is 
treated here as a situation which requires decision-making 
under stress. Here a certain amount of information is 
available from military and aerospace sources. One source 
of information is the critical incident technique that 
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involves debriefing personnel who have been involved in 
critical incidents. 

Two studies in particular on behaviour in military 
emergencies have been widely quoted. One is an investiga¬ 
tion described by Ronan (1953) in which critical incidents 
were obtained from US Strategic Air Command aircrews 
after they had survived emergencies, for example loss of 
engine on take-off, cabin fire or tyre blowout on landing.The 
probability of a response which either made the situation 
no better or made it worse was found to be, on average, 0.16. 

The other study, described by Berkun (1964), was on 
army recruits who were subjected to emergencies, which 
were simulated but which they believed to be real, such as 
increasing proximity of mortar shells falling near their 
command posts. As many as one-third of the recruits fled 
rather than perform the assigned task, which would have 
resulted in a cessation of the mortar attack. 

Information is also available from work on simulators. In 
process control, a typical study is the bounding study on 
operator response to emergencies done with reactor opera¬ 
tors on a process simulator in the UK AEA and described by 
Lees and Sayers (1976). The simulation involved typical 
faults, for example control rod runout, blower failure and 
gas temperature rise. The fault rate was high at 10 faults/h. 
The response was to push a single button. These conditions 
were favourable and the result may therefore be regarded 
as an upper limit to the operator reliability that can be 
expected. For response times in the range 0-30 s the error 
probability was 0.24, and for those in the range 60-90 s it 


14.25.4 Non-routine tasks 

For complex, or non-routine, tasks the mechanistic 
approach of subdividing the task into its constituent 
elements is inappropriate. The appropriate approach is to 
treat the task in a more holistic way. Using this approach, 
it is necessary to obtain estimates for the reliability of the 
whole task. 

One method of doing this is to obtain estimates of task 
reliability from the judgement of experts. Early work on 
this was done by Rook (1964), who developed a method in 
which tasks were ranked by experts in order of their error- 
likeliness, and ranking techniques were used to obtain 
error rates. 

Embrey (1979b) has developed this line of approach in 
his work on GDA. Whole tasks which are undertaken in 
process control are identified and estimates made of task 
reliability by a combination of data collection and expert 
judgement. 

The other main method of determining the reliability of 
the whole task is the use of simulation. The information 
from simulation is generally a correlation between the 
probability of failure and the time available to perform 
the task. 

14.25.5 Overall control task 

There remains an overall control task that is essentially the 
residual remaining after the above activities have been 
treated. The effect of progress in the treatment of human 
error in process control has been to reduce this undefined 
residue. 

14.25.6 Isolated acts of commission 

There is a finite possibility that in performing his overall 
control task the operator will intervene unnecessarily, with 


unfortunate results. Such an event is not brought out by 
analyses that consider only activities which the operator is 
required to perform. 

There are also other possibilities, including deliberate 
damaging action by the operator. One such action is suicide 
by destruction of the plant which is discussed by Ablitt 
(1969 UKAEA AHSB(S) R190): 

The probability per annum that a responsible officer will 
deliberately attempt to drop a fuel element into the reactor 
is taken as 10 -3 since in about 1000 reactor operator years 
there have been two known cases of suicide by reactor 
operators and at least one case in which suicide by reactor 
explosion was a suspected possibility. The typical suicide 
rate for the public in general is about 10 -4 per year 
although it does vary somewhat between countries. 

The report on the underground tube train crash at 
Moorgate Station in London (DoE, 1976/7) drew attention to 
the possibility of suicide by the driver. Sabotage is another 
type of action by the operator that is not unknown in pro¬ 
cess plants. 

14.25.7 Time-reliability correlations 

Error in executing a task is in general, a function of 
the time available to perform it. There has been a growing 
tendency to use time as a principal correlator of operator 

Thus error in vigilance situations depends very much on 
the response time that is allowed. Ablitt (1969 UKAEA 
AHSB(S) R190) tentatively proposed the following esti¬ 
mates of the error probability q for operator action in 
response to an alarm signal as a function of response time t: 

t Is 10s 60s 5 min lOmin >10min 

q 1 10” 1 10“ 2 10“ 3 10“ 4 10“ 6 -10- 6 

A similar type of correlation underlies the estimates 
of the general probability of ineffective behaviour in emer¬ 
gencies used in studies such as the Rasmussen Report. 
In that study the error probability q used for operator 
action in response to an emergency as a function of res¬ 
ponse timet is: 

t 60 s 5 min 30 min Several hours 

q 1 0.9 IT 4 10“ 2 


14.25.8 Human error probabilities: Rasmussen Report 

One of the earliest sets of estimates for the probability of 
human error was that given in the Rasmussen Report as 
shown in Table 14.15. These estimates are mostly of the 
type used inTHERP, but they include the time reliability 
correlation just referred to. 

14.25.9 Human error probabilities: hazard analysis 

Estimates of human error probability (HEP) are given in 
a number of fault trees. Operator error occurs in the tree 
as errors that either initiate or enable to the fault sequ¬ 
ence and as errors that constitute failures of protection. 
Table 14.16 is a summary by Lees (1983a) of the estimates 
used in two fault trees published by Lawley (1974b, 1980). 
Errors that result in failure of protection (expressed as 
probabilities) predominate over errors that initiate or enable 
the fault sequence (expressed as frequencies). Initiating 
and enabling errors tend to be associated with an item of 
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Table 14.15 General estimates of error probability used in the Rasmussen Report (Atomic Energy Commission, 1975) 


Estimated error Activity 
probability 

10~ 4 Selection of a key-operated switch rather than a non-key switch (this value does not include the 

error of decision where the operator misinterprets situation and believes key switch is correct choice) 
10 -3 Selection of a switch (or pair of switches) dissimilar in shape or location to the desired switch 

(or pair of switches), assuming no decision error. For example, operator actuates large-handled 
switch rather than small switch 

3 x 10 -3 General human error of commission, e.g. misreading label and therefore selecting wrong switch 

10~ 1 2 General human error of omission where there is no display in the control room of the status of the 

item omitted, e.g. failure to return manually operated test valve to proper configuration 
after maintenance 

3 x 10 -3 Errors of omission, where the items being omitted are embedded in a procedure rather than at 

the end as above 

3 x 10 _z Simple arithmetic errors with self-checking but without repeating the calculation by re-doing 

it on another piece of paper 

1/x Given that an operator is reaching for an incorrect switch (or pair of switches), he selects 

a particular similar-appearing switch (or pair of switches), where x = the number of 
incorrect switches (or pairs of switches) adjacent to the desired switch (or pair of switches). 

The 1/x applies up to 5 or 6 items. After that point, the error rate would be lower because the operator 
would take more time to search. With up to 5 or 6 items he does not expect to be wrong and therefore 
is more likely to do less deliberate searching 

10 _1 Given that an operator is reaching for a wrong motor operated valve (MOV) switch (or pair 

of switches), he fails to note from the indicator lamps that the MOV(s) is (are) already in the 
desired state and merely changes the status of the MOV(s) without recognizing he had selected 
the wrong switch(es) 

~1.0 Same as above, except that the state(s) of the incorrect switch(es) is (are) not the desired state 

~1.0 If an operator fails to operate correctly one of two closely coupled valves or switches in a procedural 

step, he also fails to correctly operate the other valve 

10 _1 Monitor or inspector fails to recognize initial error by operator. Note: With continuing feedback of 

the error on the annunciator panel, this high error rate would not apply 
10 _1 Personnel on different work shift fail to check condition of hardware unless required by checklist 

or written directive 

5 x 10 -11 Monitor fails to detect undesired position of valves, etc., during general walk-around inspections, 

assuming no checklist is used 

0.2-0.3 General error rate given very high stress levels where dangerous activities are occurring rapidly 

2 ( ” -1) x Given severe time stress, as in trying to compensate for an error made in an emergency situation, 

the initial error rate, x, for an activity doubles for each attempt, n, after a previous incorrect 
attempt, until the limiting condition of an error rate of 1.0 is reached or until time runs out. This 
limiting condition corresponds to an individual’s becoming completely disorganized or ineffective 
~1.0 Operator fails to act correctly in first 60 s after the onset of an extremely high stress condition, 

e.g. a large LOCA 

9 x 10 _1 Operator fails to act correctly after the first 5 min after the onset of an extremely high stress 

condition 

10 _1 Operator fails to act correctly after the first 30 min in an extreme stress condition 

10 -2 Operator fails to act correctly after the first several hours in a high stress condition 

x After 7 days after a large LOCA, there is a complete recovery to the normal error rate, x, for 

any task 


(1) Modifications of these underlying (basic) probabilities were made on the basis of individual factors pertaining to the tasks evaluated. 

(2) Unless otherwise indicated, estimates or error rates assume no undue time pressures or stresses related to accidents. 


equipment, and protection errors with a process variable. 
Such a variable may have (1) no measurement, (2) measure¬ 
ment only or (3) measurement and alarm, and this is an 
important feature influencing the error rate. 

The great majority of figures given are assumed values, 
with a few values being obtained from the literature and 
a few from the works. Engineering judgement is used in 
arriving at these values and the values selected take into 
account relevant influencing factors such as variable mea¬ 
surement and alarm and time available for action. The way 


in which allowance is made for these influencing factors is 
illustrated by the following extracts from the supporting 


There is therefore a very high probability that the opera¬ 
tor would be made aware of a spurious Slowdown condi¬ 
tion by the alarms and this would be augmented by 
observation of excessive flaring and header noise that 
would highlight the cause of the problem. Because alarms 
will be set quite close to normal operating pressure and 
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Table 14.16 Some estimates? of operator error used in fault tree analysis (Lees, 1983a; after Lawley, 1974, 1980) 
(Courtesy of the Institution of Chemical Engineers) 


Crystallizer plant 


Operator fails to observe level indicator or take action 
Operator fails to observe level alarm or take action 
Manual isolation valve wrongly closed (p) 

Control valve fails to open or misdirected open 
Control valve fails shut or misdirected shut (1) 

Propane pipeline 


0.04 

0.03 Frequency (events/year) 
0.05 and 0.1 


Time Probability 

available 


Operator fails to take action: 

To isolate pipeline at planned shut-down 


0.001 

To isolate pipeline at emergency shut-down 


0.005 

Opposite spurious tank blowdown given alarms and flare 

30 min 

0.002 

header signals 

Opposite tank low level alarm 


0.01 

Opposite tank level high given alarm with 

5-10 min 


(a) controller misdirected or bypassed when on manual 


0.025 

(b) level measurement failure 


0.05 

(c) level controller failure 


0.05 

(d) control valve or valve positioner 


0.1 

Opposite slowly developing blockage on heat exchanger 


0.04 

revealed as heat transfer limitation 

Opposite pipeline fluid low temperature given alarm 

5 min 

0.05 

Opposite level loss in tank supplying heat transfer medium 

5 min 

0.2 

pump given no measurement (p) 

Opposite tank blowdown without prior pipeline isolation given alarms 

30 min 


which operator would not regard as significant and pipework icing 

(a) emergency blowdown 


0.2 

(b) planned blowdown 


0.6 

Opposite pipeline fluid temperature low given alarm 


0.4 

Opposite pipeline fluid temperature low given alarm 

Limited 

0.8 

Opposite backflow in pipeline given alarm 

Extremely short 

0.8 

Opposite temperature low at outlet of heat exchanger given failure of 


1 

measuring instrument common to control loop and alarm 

Misvalving in changeover of two-pump set (stand-by pump left valved 


0.0025/changeover 

open, working pump left valved in) 

Pump in single or double operation stopped manually without 


0.01/shut-down 

isolating pipeline 

Low pressure steam supply failure by fracture, blockage or 


0.1/year 

isolation error (p) 

Misdirection of controller when on manual (assumed small 


1/year 

proportion of time) 


a 1, Literature value; p, plant value; other values are assumptions. 


level, there would be almost 30 min available for action 
before the pipeline is chilled to -15°C. 

and 

The probabilities quoted are based on experience 
assuming that 5 min would be available for action, and 
including allowance for failure of the alarm. They take 
into account factors such as whether or not the operator 
would be in close attendance at the time of the fault, ease 
of diagnosis of the problem, whether or not the fault could 
be corrected from the control room or only by outside 


action, reluctance to shut-down the export pumps until 
correction of the fault has been attempted because back¬ 
up trip protection is provided, etc. 

14.26 Assessment of Human Error: Qualitative 
Methods 

The foregoing account has described some early approaches 
to human reliability assessment in support of probabilistic 
risk assessment (PRA). It is now necessary to backtrack a 
little and revert to a consideration of qualitative methods for 
analysis of human error. 
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Methods are available which may be utilized to identify 
and so reduce error-likely situations and also to support 
incident investigation. The elements of such methods are 
the underlying model of human reliability, the taxonomy of 
human error and the analysis technique. 

These methods may be used in their own right to reduce 
error or as a stage in a human reliability assessment method. 
Their significance in the latter application is that they pro¬ 
vide a structured approach to gaining understanding of the 
problem. In the absence of a high quality technique for this 
essential preliminary stage, quantification is premature. 

Task analysis may be regarded as the prime technique, or 
rather family of techniques, but there are also a number of 
others. Early work in this area was that of J.R. Taylor (1979), 
who described a variety of approaches. 

A method based on hierarchical task analysis is pre¬ 
dictive human error analysis, described below. Another 
method is the work analysis technique described by 
Pedersen (1985). 

A fuller discussion of human error analysis methods is 
given by Kirwan (1990) and the CCPS (1994/17). 

14.26.1 Some error analysis strategies 

Against the background of a long-term programme of work 
on human error, J.R. Taylor (1979) has developed a set of four 
error analysis strategies: 

(1) action error method; 

(2) pattern search method; 

(3) THERP; 

(4) sneak path analysis. 

The third of these has already been outlined and is con¬ 
sidered further below. The others are now described. 

14.26.2 Action error method 

The action error method is applicable to a sequence of 
operator actions that constitute intervention on the plant. 
The structure of the sequence takes the form: action/effect 
on plant/action/effect on plant. An outline of the structure 
of the procedure in the form of a cause-consequence dia¬ 
gram is shown in Figure 14.23.The range of errors handled 
is shown in Table 14.17. 

Usually it is found that for any reasonably large operat¬ 
ing procedure, it is practical to take into account only single 
initial errors, although in a few cases it may be possible to 
use heuristic rules to identify double errors that it is 
worthwhile to explore. For example, one error may result in 
material being left in a vessel, while a second error may 
result in an accident arising from this. 

Taylor states that the method is not suitable for quanti¬ 
tative assessment, because the spread of error rates on the 
individual elements is considered to be too wide. Factors 
mentioned as influencing these error rates are cues, feed¬ 
back and type of procedure (freely planned, trained). 

14.26.3 Pattern search method 

The pattern search method is addressed to the problem that 
an accident is typically the result of a combination of 
operator errors. For such cases, detailed analysis at the task 
element level is impractical for two reasons. One is the 
combinatorial explosion of the number of sequences. The 
other is that the error rates, and above all the error rate 
dependencies, are not determinable. 



Figure 14.23 Outline structure of action error method 
(J.R. Taylor, 1979. Reproduced by permission.) 


An important feature of such accidents is that they 
may have a relatively long sequence of errors, say 3-5, 
which have a common cause, such as error in decision¬ 
making, in work procedure or in plant state assessment. 
Often the sequence is associated with an unrevealed 
plant failure. 
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Table 14.17 Operator errors addressed in action error 
method (J.R. Taylor, 1979. Reproduced by permission.) 


Cessation of a procedure 

Excessive delay in carrying out an action or omission of an 
action 

Premature execution of an action - too early 

Premature execution of an action - preconditions not 
fulfilled 

Execution on wrong object of action 

Single extraneous action 

In making a decision explicitly included in a procedure, 
taking the wrong alternative 

In making an adjustment or an instrument reading, an 
error outside tolerance limits 


The pattern search method is based on identifying a 
common cause error, developing its consequence, perhaps 
using an event tree, and using the results to ‘steer’ the con¬ 
struction of the fault tree. 

14.26.4 Sneak path analysis 

Sneak path analysis is concerned with the identification of 
potential accident situations. It is so called by analogy with 
sneak circuits. It seeks to identify sources of hazard such as 
energy or toxins and targets such as people, critical equip¬ 
ment or reactive substances. The standpoint of the analysis 
is similar to the accident process model of Houston (1971) 
described in Chapter 2. 

For an accident to occur, it is necessary for there to be 
some operator action, operator error, equipment failure or 
technical sequence. A search is made to determine whether 
any of these necessary events can occur. In examining 
operator error, attention is directed particularly to actions 
that are ‘near’ to the necessary error. Nearness may be 
temporal, spatial or psychological. Often such an action is 
very near to the normal operator action. 

14.26.5 Predictive human error analysis (PHEA) 

Predictive human error analysis (PHEA) is described by 
Embrey and co-workers (e.g. Murgatroyd and Tait, 1987; 
Embrey, 1990) and by the CCPS (1994/17). PHEA uses 
hierarchical task analysis to discover the plan involved in 
the task, combined with the error classification shown in 
Table 14.18. The task is then analysed step by step in terms 
of the task type, error type, task description, consequences, 
recovery and error reduction strategy. 

In a validation study of PHEA, Murgatroyd and Tait 
(1987) found that the proportion of errors with potentially 
significant consequences that actually occurred in an 
equipment calibration task over a 5 -year-period was 98 %. 

14.26.6 System for predictive error analysis and 
reduction (SPEAR) 

The system for predictive error analysis and reduction 
(SPEAR) is a set of qualitative techniques, of which PHEA 
is one. It is described by the CCPS (1994/17). SPEAR com¬ 
prises the following techniques: (1) task analysis, (2) per¬ 
formance influencing factor (PIF) analysis, (3) PHEA, 
(4) consequence analysis and (5) error reduction analysis. 

Consequence analysis involves consideration not just of 
the consequences of failure to perform the task but also 
of the consequences of any side-effects that may occur whe¬ 
ther or not the task is executed. Error reduction analysis is 


Table 14.18 Error classification for predictive human 
error analysis (Center for Chemical Process Safety, 
1994/17) (Courtesy of the American Institute of Chemical 
Engineers) 


Action 

A1 

Action too long/short 

A2 

Action mistimed 

A3 

Action in wrong direction 

A4 

Action too little/too much 

A5 

Misalign 

A6 

Right action on wrong object 

A7 

Wrong action on right object 

A8 

Action omitted 

A9 

Action incomplete 

A10 

Wrong action on wrong object 

Checking 

Cl 

Checking omitted 

C2 

Check incomplete 

C3 

Right check on wrong object 

C4 

Wrong check on right object 

C5 

Check mistimed 

C6 

Wrong check on wrong object 

Retrieval 

R1 

Information not obtained 

R2 

Wrong information obtained 

R3 

Information retrieval incomplete 

Transmission 

T1 

Information not transmitted 

T2 

Wrong information transmitted 

T3 

Information transmission incomplete 

Selection 

SI 

Selection omitted 

S2 

Wrong selection made 

Plan 

PI 

Plan preconditions ignored 

P2 

Incorrect plan executed 

P3 

Correct but inappropriate plan executed 

P4 

Correct plan executed too soon/too late 

P5 

Correct plan executed in wrong order 


concerned with measures to reduce those errors that do not 
have a high probability of recovery. Task analysis and PHEA 
have already be described and PIF analysis is treated in 
Section 14.33. 


14.27 Assessment of Human Error: Human 
Reliability Analysis Handbook 

The first systematic approach to the treatment of human 
error within a PR Awas theTechnique for Human Error Rate 
Prediction (THERP). An early account of THERP was given 
by Swain (1972). Its origins were work done at Sandia 
Laboratories on the assessment of human error in assembly 
tasks. This work was then extended to human error in pro¬ 
cess control tasks, with particular reference to nuclear reac¬ 
tors. This extension to nuclear reactor control was used in 
the Rasmussen Report, or WASH-1400 (AEC, 1975), which 
contains generic PR As for US commercial nuclear reactors. 
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The accident at Three Mile Island gave impetus to work 
in this area and led to the publication of the Handbook of 
Human Reliability Analysis with Emphasis on Nuclear Power 
Plant Applications. Final Report (the HRA Handbook) by 
Swain and Guttmann (1983). This report was widely circu¬ 
lated in draft form in 1980 and many literature references 
are to the draft. Further work is described in Accident 
Sequence Evaluation Program. Human Reliability Analysis 
Procedure (Swain, 1987a). 

The HRA Handbook gives a complete methodology for 
addressing the human error aspects of a PRA, butTHERP 
is central to the approach, and the methodology as a whole 
is generally referred to by that acronym. However, the 
Handbook represents a considerable extension of the origi¬ 
nal THERP methodology, particularly in respect of its 
adoption of the time reliability correlation method. 

A further review of HRA and THERP is given by P. Miller 
and Swain (1987). Table 14.19 gives the contents of the HRA 
Handbook and Figure 14.24 shows the structure of the 
principal data tables. An account is now given of THERP. 
The HRA Handbook should be consulted for a more 
detailed treatment. 


Table 14.19 HRA Handbook: contents (Swain and 
Guttmann, 1983) 

1. Introduction 

2. Explanation of Some BasicTerms 

3. Some Performance Shaping Factors Affecting Human 
Reliability 

4. Man-Machine Systems Analysis 

5. ATechnique for Human Reliability Analysis 

6. Sources of Human Performance Estimates 

7. Distribution of Human Performance and Uncertainty 
Bounds 

8. Use of Expert Opinion in Probabilistic Risk 
Assessment 

9. Unavailability 

10. Dependence 

11. Displays 

12. Diagnosis of Abnormal Events 

13. Manual Controls 

14. Locally Operated Valves 

15. Oral Instructions and Written Procedures 

16. Management and Administrative Control 

17. Stress 

18. Staffing and Experience Levels 

19. Recovery Factors 

20. Tables of Estimated Human Error Probabilities 

21. Examples and Case Studies 

22. Concluding Comments 

Appendices 

A Methods for Propagating Uncertainty Bounds in a 
Human Reliability Analysis and for Determining 
Uncertainty Bounds for Dependent Human Activities 
B An Alternative Method for Estimating the Effects of 
Dependence 

C Calculations of Mean and Median Trials to Detection 
D Calculations of Basic Walk-around Inspections as a 
Function of Period between Successive Walk-arounds 
E Reviews of the Draft Handbook 
F A Comparison of the October 1980 and Present Versions 
of the Handbook 


14.27.1 Overall approach 

The overall approach used in the Handbook is shown in 
Figure 14.25. The tasks to be performed are identified as 
part of the main PRA. The HRA involves the assessment of 
the reliability of performance of these tasks. 

14.27.2 Technique for human error rate 
prediction (THERP) 

The starting point is a task analysis for each of the tasks to 
be performed. The method is based on the original THERP 
technique and uses a task analytic approach in which the 
task is broken down into its constituent elements along the 
general lines described above. The basic assumption is that 
the task being performed is a planned one. 

The task is described in terms of an event tree as shown 
in Figure 14.26. This figure gives the event tree for two 
tasks A and B which are performed sequentially and which 
constitute elements of a larger overall task. In reliability 
terms, the relationship between the two constituent tasks 
to the overall task may be a series or a parallel one. 

The probability that task A will be performed success¬ 
fully is a and the probability that it will not be performed 
successfully is A. Since task A is the first in the sequence it is 
assumed to be independent of any other task and the prob¬ 
abilities a and A are therefore unconditional probabilities. 
The probability that task B will be performed successfully is 
b and the probability that it will not be performed success¬ 
fully is B. Since task B is performed after task A it is assumed 
to be dependent in some degree on task A and the prob¬ 
abilities b and B are therefore conditional probabilities. 
Thus for b it is necessary to distinguish between b \ a and 
b | A and for B between B \ a and B | A. The probabilities 
to be used are therefore as shown in Figure 14.26. 

The structure of the tree is the same whether the con¬ 
figuration is a series or parallel one but the status of the 
outcomes is different. As shown in Figure 14.26 for a series 
system in which it is necessary for both tasks to be suc¬ 
cessful, there is only one which rates as a success, whilst for 
a parallel system in which it is sufficient for only one of the 
tasks to be successful, there are three outcomes which rate 
as success. 

A distinction is made between step-by-step tasks 
and dynamic tasks. The latter involve a higher degree of 
decision-making. The approach just described is most 
readily justified for step-by-step tasks. 

14.27.3 Human error probability 

The event tree so produced, and the corresponding equa¬ 
tions, are then used to determine the probability of failure 
for the overall task. For this estimates are required of the 
HEP for each of the constituent tasks. 

Several different human error probabilities are distin¬ 
guished: nominal, basic, conditional and joint. A nominal 
HEP is a generic value before application of any perfor¬ 
mance shaping factors. A basic HEP (BHEP) is the basic 
unconditional HEP after application of performance shap¬ 
ing factors. A conditional HEP (CHEP) is a BHEP adjusted 
to take account of dependency. A joint HEP (JHEP) is the 
HEP for the overall task. 

The simple application of HEP values that make no 
allowance for dependence tends to give very low prob¬ 
abilities of failure which do not accord with experience and 
carry little conviction. Allowance for dependence is there¬ 
fore important. There is in any event some value of the HEP 
below which the estimate is no longer credible. A cut-off 
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Screening 


Diagnosis 


-Diagnosis f|j 

-Rule-based actions 

-Nominal diagnosis 

-Post-event CR staffing 


[I] 

a 

0 


Errors of omission 


-Written materials mandated 

Preparation [IF] 
Administrative control [~6~] 

Procedural items [T] 

-No written materials 

Administrative control [¥] 

Oral instruction items [IT] 


-Displays 


Errors of commission- 


Display selection [sT] 
Read/record quantitative [To] 

Check-read quantitative [TT] 


-Control & MOV selection & use [T|] 

-Locally operated valves 

Valve selection [FF] 

Stuck valve detection [u] 


Performance 
shaping 
factors (PSFs) 


-Tagging levels [Ts] 

-Stress/experience [TS] 

-Dependence [17] (Tf)] 

-Other PSFs (see text) 


0 


Uncertainty bounds (UCBs) 


-Estimate UCBs [20] 

-Conditional HEPs and UCBs 


0 


Recovery factors 


-Errors by checker Jaz] 

-Annunciated cues [0 [0 

-Control room scanning [25] [26] 

-Basic walk-around inspection [27] 


Figure 14.24 HRA Handbook: structure of principal data tables (Swain and Guttmann, 1983). CR, control room; 
HEP, human error probability; MOV, motor operated valve 


value is therefore applied. Reference is made to a cut-off of 
about 5 x 1(T 5 . 

Many of the HEPs in the Handbook are expressed as 
log-normal distributions, quoted in terms of the two 
parameters - median and error factor (EF). 

14.27.4 Dependence model 

The dependence model is an important feature of the 
methodology. A significant proportion of the Handbook is 


concerned with dependency. There are two basic forms of 
dependence: dependence between tasks and dependence 
between people. 

Where two tasks are performed in sequence the second 
task may be influenced by the first. Dependence is likely, 
for example, where an operator has to change two valves 
one after the other. 

The other situation is where two people are involved 
in the same task. The form of the involvement may vary. 
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PLANT VISIT 

- I 


TASK ANALYSIS 


DEVELOP HRA EVENT 


TREES | 


|ASSIGN NOMINAL HEPs| 

ESTIMATE THE RELATIVE 
EFFECTS OF PERFORMANCE 
SHAPING FACTORS 


ASSESS DEPENDENCE 


PHASE 1: 
FAMILIARIZATION 


PHASE 2: 

QUALITATIVE ASSESSMENT 


PHASE 3: 

QUANTITATIVE ASSESSMENT 


PHASE 4: 
INCORPORATION 


Figure 14.25 HRA Handbook: methodology for human reliability analysis (Swain and Guttmann, 1983) 


The two persons may be involved in a joint task such as 
calibrating an instrument. They may perform separate but 
closely linked functions such as those of two operators 
sharing a control room but controlling different sections of 
the plant. The work of one person may be subject to the 
general supervision of another person. Or it may be for¬ 
mally checked by another. 

There are various approaches that may be used to quan¬ 
tify dependence, including data and expert judgement. 
There are few relevant data. Expert judgement can be used 
to a limited extent. An example is given of the use of expert 
estimates of dependence in a calibration task. 

The approach used in the Handbook, therefore, is the 
development of a generalized dependence model. The 
degrees of dependence used are zero, low, medium, high 
and complete. The determination of the appropriate degree 
of dependence depends on the situation under considera¬ 
tion. The Handbook gives quite extensive guidance. Here it 
is possible only to give a few examples. 


In some cases, there may be judged to be zero depen¬ 
dence. An example given of a situation where zero depen¬ 
dence bet ween two tasks would be assumed is check-reading 
of one display followed by check-reading of another 
display as part of periodic scanning of the displays. Zero 
dependence is not normally assumed for persons working 
as a team or for one person checking another’s performance. 

The assumption of even a low level of dependence tends 
to result in an appreciably higher HEP than that of zero 
dependence. If there is any doubt, it is conservative to use 
low dependence rather than zero dependence. 

A level of dependence between people that would be 
assessed as low is illustrated by the checking of the work of 
a new operator by a shift supervisor. In this situation, the 
shift supervisor has an expectation that the new operator 
may make errors and is more than usually alert. 

A moderate level of dependence is usually assessed 
between the shift supervisor and the operators for tasks 
where the supervisor is expected to interact with them. 
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Series 

Parallel 



Task A = The first task 

Task B = The second task 

a = Probability of successful performance of task A 
A = Probability of unsuccessful performance of task A 
bja = Probability of successful performance of task B given a 
SJa = Probability of unsuccessful performance of task B given a 
b\A = Probability of successful performance of task B given A 
B\A - Probability of unsuccessful performance of task B given A 

FOR THE SERIES SYSTEM: 

Pr[S] = a(ba ) 

Pr[F] = 1 - a(bia) = a(8-a) + A(b A) + A{B A) 

FOR THE PARALLEL SYSTEM: 

Pr[S] = 1 - A(B\A) = a(b'a) + a(B a) + A(b A) 

Pr[F] = A(BA) 

Figure 14.26 HRA Handbook: event tree for two tasks in sequence illustrating conditional probabilities (Swain and 
Guttmann, 1983); F, failure; S, success 


A high level of dependence, or even complete dependence, 
would be assigned for the case where the shift supervisor 
takes over a task from a less experienced operator, since the 
latter may well defer to the supervisor both because of his 
greater experience and his seniority. 

The other aspect of the dependence model is the quanti¬ 
fication of the adjustment to be made given that the degree 
of dependency has been determined. The adjustment is 
made to the BHEP. The relation used is: 

P c = (l-kP b )/(k+ 1) [14.27.1] 

where P h , is the BHEP and P c is the CHEP, k is a constant 
which has the following values: low dependency k = 19; 
medium dependency k = 6; high dependency k = l. 

Equation 14.27.1 and the values of the constant k are 
selected to give CHEPs of approximately 0.05, 0.15 and 
0.50 of the BHEP for low, medium and high dependency, 
respectively, where BHEP < 0.01. Where BHEP > 0.01, the 
effective multiplying factor is slightly different. Thus, 
for example, for a BHEP of 0.1 the values of the CHEP are 
0.15, 0.23 and 0.55, respectively, for these three levels of 
dependency. 


14.27.5 Displays, annunciators and controls 

Common tasks in process control are obtaining informa¬ 
tion from displays, responding to annunciators and mani¬ 
pulating controls. This is very much the home ground of 
human factors and there is a good deal of information 
available on response times and probabilities of error in 
such tasks. The Handbook gives a number of tables for 
HEPs for these tasks. 

For unannunciated displays, the Handbook gives the fol¬ 
lowing HEP values for selection of a display (Table 20.9). 
The HEP depends on the existence of similar adjacent 
displays. It is assumed to be negligible if the display is 
dissimilar to adjacent displays and the operator knows the 
characteristics of the display he requires. The HEP is taken 
as 0.005 (EF10) if it is from a group of similar displays on a 
panel with clearly drawn mimic lines which include the 
displays; as 0.001 (EF 3) if it is from a group of similar dis¬ 
plays which are part of a well-delineated functional group 
on the panel; and as 0.003 (EF 3) if it is from an array of 
similar displays identified by label only. These HEP values 
do not include recovery from any error. The probability that 
this will occur is high if the reading obtained is grossly 
different from that expected. 
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For check reading from displays the HEPs given are as 
follows (Table 20.11). The HEP is taken as 0.001 for digital 
displays and for analogue meters with easily seen limit 
marks; as 0.002 for analogue meters with limits marks 
which are difficult to see and for analogue chart recorders 
with limits marks; as 0.003 for analogue meters without 
limit marks; and as 0.006 for analogue chart recorders 
without limit marks. In all cases, the EF is taken as 3. The 
HEP for confirming a status change on a status lamp and 
that for misinterpreting the indications an indicator lamp 
are assumed to be negligible. These HEPs apply to the 
individual checking of a display for some specific purpose. 


14.27.6 Oral instructions and written procedures 

Communication in process control includes both oral 
instructions and written procedures. For oral instructions, 
a distinction is made between general and detailed 
instructions. Table 14.20 gives some HEP estimates for 
these two cases. 

For written instructions, the types of HEP treated 
include error in the preparation of the instructions, failure 
to refer to them and error in their use. Table 14.21 gives 
some HEP estimates for these three cases, respectively. 


14.27.7 Locally operated valves 

Another common task in process control is the manipula¬ 
tion of locally operated valves (LOVs). This task, therefore, 
receives special treatment in the Handbook. The valves 
concerned are manually operated. They include valves 


with or without a rising stem and with or without position 
indicators. 

Three principal errors are distinguished. One is selec¬ 
tion of the wrong valve. Here the base case is a single iso¬ 
lated valve. Where there are other valves present, the 
possibility exists that the wrong valve will be selected. 
Another type of error is reversal, or moving the valve in the 
wrong direction. The operator opens it instead of closing it, 
or vice versa. One form of this error is to reverse the state of 
a valve, which is in fact already in the desired state. The 
third type of error is failure to detect that the valve is stuck. 
A common form of this error is to fail to effect complete 
closure of a valve. Table 14.22 gives some HEP estimates for 
selection of a valve, for detection of a stuck valve and for 
checking a valve. The manipulation of valves is a particular 
case where there may exist a strong dependence, or cou¬ 
pling, between two tasks. This case is one that was taken 
into account in the Rasmussen Report. An operator may be 
required to cut off flow by closing two valves, closure of 
either of which is sufficient to stop the flow. If the prob¬ 
ability of error in closing one valve is 1CT 2 and there is zero 
dependence, the probability of error in the overall task is 
10 -4 (10 -2 x 1CT 2 ). On the other hand, if there is complete 
coupling, the probability of error is 10 -2 (10 —2 x 1). These 
two cases represent the two extremes and constitute lower 
and upper hounds on the probability of failure. For the more 
realistic case of loose coupling, the approach used in 
WASH-1400 was to take for the probability of error the 
log-normal median or square root of the product of the 
two bounds: (10 -2 x 10 -4 ) /<2 = 10“ 3 . The dependence model 


Table 14.20 HRA Handbook: human error probability (HEP) estimates and error factors (EFs) for oral instructions? 
(after Swain and Guttmann, 1983) 




Number of oral 
instruction 
items or 
perceptual units 

(a) 

Pr(F) to recall 
item'N', order of 
recall not 
important 

(b) 

Pr(F) to recall 
all items, order 
of recall not 
important 

(c) 

Pr(F) to recall 
aU items, order 
of recall is 
important 




HEP 

EF 

HEP EF 

HEP EF 

Oral instructions a> 
(1) 

re detailed: 

l c 

0.001 

3 

0.001 3 

0.001 3 

(2) 


2 

0.003 

3 

0.004 3 

0.006 3 

(3) 


3 

0.01 

3 

0.02 5 

0.03 5 

(4) 


4 

0.03 

5 

0.04 5 

0.1 5 

(5) 


5 

0.1 

5 

0.2 5 

0.4 5 

Oral instructions ai 
(6) 

re general: 

*. 

0.001 

3 

0.001 3 

0.001 3 

(7) 


2 

0.006 

3 

0.007 3 

0.01 3 

(8) 


3 

0.02 

5 

0.03 5 

0.06 5 

(9) 


4 

0.06 

5 

0.09 5 

0.2 5 

(10) 


5 

0.2 

5 

0.3 5 

0.7 5 


a It is assumed that if more than five oral instruction items or perceptual units are to be remembered, the recipient will write them down. If oral 
instructions are written down, useTable 20.5 in the Handbook for errors in preparation of written procedures and Table 20.7 for errors in their use. 

Thefirst column of HEPs (a) is for individual oral instruction items, e.g. the second entry, 0.003 (item 2a), is thePr(F) to recall the second of two 
items, given that one item was recalled, and order is not important. The HEPs in the other columns for two or more oral instruction items are joint 
HEPs, e.g. the second 0.004 in the second column of HEPs is the Pr(F) to recall both of two items to be remembered, when order is not important. 
The 0.006 in the third column of HEPs is the Pr(F) to recall both of two items to be remembered in the order of performance specified. For all 
columns, the EFs are taken fromTable 20.20. 

b The term ‘item’ for this column is the usual designator for tabled entries and does not refer to an oral instruction item. 
c The Pr(F) values in rows 1 and 6 are the same as the Pr(F) to initiate the task. 
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Table 14.21 HRA Handbook; human error probability (HEP) estimates and error factors (EFs) for written procedures 
(after Swain and Guttmann, 1983) 


A Preparation of written procedures 3 


Item Potential errors 


HEP 


EF 


(1) 

(2) 


Omitting a step or important instruction from a formal or ad hoc procedure 15 or a tag 0.003 
from a set of tags 

Omitting a step or important instruction from written notes taken in response to Negligible 

oral instructions 0 

Writing an item incorrectly in a formal or ad hoc procedure or a tag 0.003 

Writing an item incorrectly in written notes made in response to oral instructions 0 Negligible 


5 


5 


“Except for simple reading and writing errors, errors of providing incomplete or misleading technical information are not addressed in the 
Handbook. The estimates are exclusive of recovery factors, which may greatly reduce the nominal HEPs. 

b Formal written procedures are those intended for long-time use; ad hoc written procedures are one-of-a-kind, informally prepared procedures 
for some special purpose. 

c A maximum of five items is assumed. If more than five items are to be written, use 0.001 (EF = 5) for each item in the list. 


B Neglect of written procedures 

Item Task HEP EF 


(1) 

Carry out a plant policy or scheduled tasks such as periodic tests or maintenance 
performed weekly, monthly or at longer intervals 

0.01 

5 

(2) 

Initiate a scheduled shiftly checking or inspection function 3 

Use written operations procedures under: 

0.001 

3 

(3) 

Normal operating conditions 

0.01 

3 

(4) 

Abnormal operating conditions 

0.005 

10 

(5) 

Use a valve change or restoration list 

0.01 

3 

(6) 

Use written test or calibration procedures 

0.05 

5 

(7) 

Use written maintenance procedures 

0.3 

5 

(8) 

Use a checklist properly 15 

0.5 

5 


a Assumptions for the periodicity and type of control room scans are discussed in Chapter 11 of the Handbook in the section, ‘General Display 
Scanning Model'. Assumptions for the periodicity of the basic walk-around inspection are discussed in Chapter 19 of th eHandbook in the section, 
‘Basic Walk-around Inspection’. 

b Read a single item, perform the task, check off the item on the list. For any item in which a display reading or other entry must be written, assume 
correct use of the checklist for that item. 


C Use of written procedures 3 

Item b Omission of item 


When procedures with check-off provisions are correctly used: 0 

(1) Short list, <10 items 

(2) Long list, >10 items 

When procedures without check-off provisions are used, or when check-off provisions are 
incorrectly used: d 

(3) Short list < 10 items 

(4) Long list, >10 items 

(5) When written procedures are available and should be used but are not used d 


HEP 


EF 


0.001 

0.003 


3 

3 


0.003 3 

0.01 3 

0.05° 5 


a The estimates for each item (or perceptual unit) presume zero dependence among the items (or units) and must be modified by using the 
dependence model when a nonzero level of dependence is assumed. 

b The term'item’ for this column is the usual designator for tabled entries and does notrefer to an item of instruction in aprocedure. 
c Correct use of check-off provisions is assumed for items in which written entries such as numerical values are required for the user. 
d Table 20.6 in the Handbook lists the estimated probabilities of incorrect use of check-off provisions and of non-use of available written 

e If the task is judged to be ‘second nature’, use the lower uncertainty bound for 0.05, i.e. use 0.01 (EF = 5). 


given in the Handbook allows the use of more levels of 
dependence. 

14.27.8 Time ± reliability correlation 

As already mentioned, there has been an increasing ten¬ 
dency, associated mainly with experimental work with 


operators on simulators, to correlate the probability of 
operator failure with time. In particular, use is made of the 
time—reliability correlation (TRC) to obtain human error 
probabilities for complex, or non-routine, tasks, including 
handling an emergency. The assumption underlying such a 
TRC is that, although there are in principle other factors 
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Table 14.22 HRA Handbook; human error probability (HEP) estimates and error factors (EFs) for manipulation and 
checking of locally operated valves (after Swain and Guttmann, 1983) 


A Selection of valve 


Item Potential errors HEP EF 


Making an error of selection in changing or restoring a locally operated valve when the valve to be 

manipulated is: 

(1) Clearly and unambiguously labelled, set apart from valves that are similar in all of 0.001 

the following: size and shape, state and presence of tags 3 

(2) Clearly and unambiguously labelled, part of a group of two or more valves that are 0.003 

similar in one of the following: size and shape, state or presence of tags 3 

(3) Unclearly or ambiguously labelled, set apart from valves that are similar in all of the 0.005 

following: size and shape, state and presence of tags 3 

(4) Unclearly or ambiguously labelled, part of a group of two or more valves that are 0.008 

similar in one of the following: size and shape, state or presence of tags 3 

(5) Unclearly or ambiguously labelled, part of a group of two or more valves that are 0.001 

similar in all of the following: size and shape, state and presence of tags 3 


3 

3 

3 

3 


3 


a Unless otherwise specified, level 2 tagging is presumed. If other levels of tagging are assessed, adjust the tabled HEPs according toTable 20.15 
in the Handbook. 


B Detection of stuck valves 


Item Potential errors 


HEP 


EF 


Given that a locally operated valve sticks as it is being changed or restored, 3 the operator fails to 
notice the sticking valve, when it has: 

(1) A position indicator 11 only 

(2) A position indicator 11 and a rising stem 

(3) A rising stem but no position indicator 13 

(4) Neither rising stem nor position indicator 13 


0.001 3 

0.002 3 

0.005 3 

0.01 3 


a Equipment reliability specialists have estimated that the probability of a valve’s sticking in this manner is approximately 0.001 per manip¬ 
ulation, with an error factor of 10. 

b A position indicator incorporates a scale that indicates the position of the valve relative to a fully opened or fully closed position. A rising stem 


qualifi 

es as a position indicator if there is a scale associated with it. 



C Checking, including valves 3 



Item 

Potential errors 

HEP 

EF 

(1) 

Checking routine tasks, checker using written materials (includes over-the- 
shoulder inspections, verifying position of locally operated valves, switches, 
circuit breakers, connectors, etc., and checking written lists, tags or 
procedures for accuracy) 

0.1 

5 

(2) 

Same as above, but without written materials 

0.2 

5 

(3) 

Special short-term, one-of-a-kind checking with alerting factors 

0.05 

5 

(4) 

Checking that involves active participation, such as special measurements 

0.01 

5 

Given that the position of a locally operated valve is checked (item (1) above), noticing that it 
is not completely opened or closed: 

0.5 

5 

(5) 

Position indicator 13 only 

0.1 

5 

(6) 

Position indicator 13 and a rising stem 

0.5 

5 

(7) 

Neither a position indicator 13 nor a rising stem 

0.9 

5 

(8) 

Checking by reader/checker of the task performer in a two-man team, or 
checking by a second checker, routine task (no credit for more than 2 checkers) 

0.5 

5 

(9) 

Checking the status of equipment if that status affects one’s safety when 
performing his tasks 

0.001 

5 

(10) 

An operator checks change or restoration tasks performed by a maintainer 

Above HEPs/2 

5 


a This table applies to cases during normal operating conditions in which a person is directed to check the work performed by others either as the 
work is being performed or after its completion. 

b Aposition indicator incorporates a scale that indicates the position of the valve relative to a fully opened or fully closed position. A rising stem 
qualifies as a position indicator if there is a scale associated with it. 
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that affect operator performance in such tasks, time is the 
dominant one. 

An aspect of operator performance of particular concern 
to the nuclear industry is behaviour following the initial 
event. One of the main methods used to study such behaviour 
is the use of simulators. Work on simulators has shown that 
the probability of success in post-event behaviour correlates 
strongly with time. Early work on this was done by R.E. Hall, 
Fragola and Wreathall (1982). A number of TRC models have 
since been produced based on simulator results. 

Figure 14.27 shows someTRCs given by Hall, Fragola and 
Wreathall for operator vigilance and for particular events 
to which a nuclear reactor operator may have to respond. 

14.27.9 Nominal diagnosis model 

The task analysis approach on whichTHERP is based is not 
well adapted to handling the behaviour of the operators in 
an abnormal situation. For this, use is made of the TRC 
approach. Several TRCs are given in the Handbook. Two are 
used for screening: one for diagnosis and one for post¬ 
diagnosis performance. The main TRC is the nominal diag¬ 
nosis model that is applicable to diagnosis only and not to 
post-diagnosis performance. This TRC is shown in Figure 
14.28. In contrast to the other HEP relations, which refer to 
individuals, theTRCs refer to the behaviour of a team. The 
nominal diagnosis model, therefore, implies a particular 
manning model. This is described in the next section. 

Figure 14.28 includes curves for the upper and lower 
bounds. The Handbook gives guidance on the choice of 
curve. Essentially the lower bound is applicable if the event 
is a well-recognized one and the operators have practised 
on a simulator and demonstrate by interview that they 
know how to handle it. The upper bound is applicable if the 
event is not covered by training or is covered only in initial 
training or if the operators demonstrate by interview that 
they do not know how to handle it. The main, or nominal, 


curve is applicable if the operators have practised the event 
only on simulator requalification exercises or if none of the 
rules for the lower or upper bound apply. 

The nominal diagnosis TRC does not itself fit a 
log-distribution, but it may be approximated by such a 
distribution. The parameters of the log-normal distribu¬ 
tion approximating to this TRC have been estimated by 
Dougherty and Fragola (1988), who obtain values for 
the median and the EF of m = 4 and/ = 3.2, respectively. 
The relation between the nominal diagnosis TRC and the 
approximating log-normal distribution is: 


Time (min) 

Human et 

ror probability 

Nominal 
diagnosis TRC 

Approximating log¬ 
normal distribution 

5 

0.9 

0.4 

10 

0.1 

0.1 

20 

0.01 

0.01 

30 

0.001 

0.002 

60 

0.0001 

0.00006 


14.27.10 Manning model 

The nominal diagnosisTRC just described applies toawhole 
team and is in fact postulated on a particular team composi¬ 
tion. In other words there is an implied manning model. 

The manning model used is shown inTable 14.23.The team 
consists of operators 1 and 2, the shift supervisor and the 
shift technical advisor. At 10 min into the incident for 
operator 1 the BHEP is 0.1. Operator 2 has complete depend¬ 
ency. The shift supervisor has high dependency At this 
stage, no credit is taken for the shift technical advisor. 
For operator 1, the BHEP remains constant at 0.1. At 20 min 
for operator 2, the dependency reduces to the high level and 



Time (min) 


Figure 14.27 Some time-reliability correlations relevant to nuclear power plants (R.E. Hall, Fragola and Wreathall, 
1982). LOCA, loss of coolant accident; SI, safety interlock. Notation <x, y> denotes median m, errorfactorf of log-normal 








4/68 HUMAN FACTORS AND HUMAN ERROR 



T 0 Time after a compelling signal of an abnormal situation. T (min) 

Figure 14.28 HRA Handbook: nominal diagnosis model (Swain and Guttmann, 1983): human error probability (HEP) of 
diagnosis of one abnormal event by control room personnel 


Table 14.23 HRA Handbook: manning model for nominal diagnosis model - illustrative example (after Dougherty and 
Fragola, 1988, from Swain and Guttmann, 1983) 


Time (min) 

Conditional probability of error 

Joint probability of error 

TRC value 

10 

Operator 1 

Operator 2 

Shift supervisor 

Shift technical adviser 

0.1 (basic probability) 

1.0 (complete dependence) 

0.55 (high dependency) 

1.0 (no credit) 

0.055 

0.1 

20 

Operator 1 

Operator 2 

Shift supervisor 

Shift technical adviser 

0.1 (basic probability) 

0.55 (high dependency) 

0.23 (moderate dependency) 

1.0 (high dependency) 

0.007 

0.01 

30 

Operator 1 

Operator 2 

Shift supervisor 

Shift technical adviser 

0.1 (basic probability) 

0.55 (high dependency) 

0.15 (low dependency) 

0.15 (low dependency) 

0.0012 

0.001 


for the shift supervisor it reduces to medium level. The shift 
technical advisor is now taken into account with a high 
dependency. At 30 min for operator 2, the dependency 
remains at the high level but for the shift supervisor it reduces 
again to the low level. For the shift technical advisor, the 
dependency reduces to the low level. The CHEPs shown 
are those given by Equation 14.27.1. The JHEPs shown are 
the products of the BHEP for operator 1 and the CHEPs for 
the other members of the team.These JHEPs are then rounded 
to give the actual values used in the nominal diagnosisTRC. 

14.27.11 Recovery model 

Some errors are not recoverable, but many are and the 
recovery model is therefore another important feature of 


the methodology. The probability of recovery depends on 
the opportunities for detection, the use made of these 
opportunities and the effectiveness of the recovery action. 
Recovery mechanisms include: 

(1) human actions - checking; 

(2) plant states - panel indications; 

(3) equipment states — inspections. 

Recovery is treated under the headings: 

(1) human redundancy; 

(2) annunciated indications; 
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(3) active inspections; 

(4) passive inspections. 

Human redundancy is essentially the checking of one 
person’s work by another person. For checking, the Hand¬ 
book gives the following HEP values (Table 20.22). The HEP 
for checking is taken as being determined by two distinct 
errors, failure to execute the check at all and error in per¬ 
forming it. The HEP is taken as 0.1 if a written procedure is 
used; as 0.2 if a written procedure is not used; as 0.05 if the 
check is a one-off with alerting factors; and as 0.01 if the 
check involves active participation. The HEP is taken as 0.5 
for checking by a second member of a two-man team or by a 
second checker. It is taken as 0.001 for checking of equip¬ 
ment which affects the safety of the checker. In all cases, 
the EF is taken as 5. These HEPs apply where a person is 
directed to check the work of others, either as the work is 
being performed or after its completion. Credit for check¬ 
ing is limited to the use of two checkers. The HEP of the 
second checker in a routine task is taken as 0.5. 

Recognition is given to a number of problems associated 
with checking. Checking is particularly affected by 
psychological considerations. There is an expectation that 
an experienced person will not make errors. Conversely, 
there is an expectation that an inexperienced person may 
well do so. 

It is often suggested that if a person knows that his 
work is to be checked he may perform it with less care 
and that the end result may be a lower task reliability 
than if checking were not employed. This view is rejected. 
It is argued that for any credible values of the BHEP and 
the CHEP for checking the JHEP will be lower with 
checking. 

The possibility exists that on a particular plant checking 
may have fallen into disuse.This is one feature in particular 
which it is prudent for the analyst to observe and check. 
There is a tendency in some situations for the task and its 
checking to become elided and for the whole to become a 
joint operation. Where this occurs, there is no longer an 
independent check. 

Annunciated indicators, or alarms, are treated at two 
levels. The HEP for taking the prescribed corrective action 
in response to a single alarm is 0.0001, but this may be 
drastically modified for other alarm situations. 

An annunciator response model is used which applies to 
multiple alarms and is expressed by two equations. The 
probability Pi of failure to initiate action in response to the 
ith alarm in a group of n alarms is: 

Pi = 10“ 4 |&I [14.27.2a] 

Pi = 2~ 2 x 10“ 3 1 < * < 10 [14.27.2b] 

Pi = 0.25 *>10 [14.27.2c] 

The probability P r of failure to initiate action in response to 
a randomly selected alarm in a group of alarms and is: 


P r = Y^Pi/n [14.27.3] 


Active inspection is defined as inspection for a specific 
purpose. The main forms are prescribed periodic logging 
of readings and prescribed audit of indications with 
written instructions, both in the control room, and a 


walk-around inspection on the plant with instructions. 
The inspection may be based on oral instructions or writ¬ 
ten instructions. The HEP for an active inspection is that 
applicable to oral instructions and written procedures, 
already described. 

Passive inspection is defined as a casual type of inspec¬ 
tion. There are no written instructions and no instructions 
to look for any particular feature. The main forms are 
scanning of the control room displays and a walk-around 
on the plant. 

As described above, HEPs are given for detection of 
deviant unannunciated displays in a periodic scan. 

For passive inspection by walk-around, the Handbook 
gives the following HEP values (Table 20.27). The event 
concerned is failure to detect a particular deviant state 
within 30 days. It is assumed that there is one inspection 
per shift. The HEPs are taken as 0.52, 0.25, 0.05, 0.003, 
0.002, 0.001 and 0.001 for periods between walk-around of 
1,2,3,4,5,6 and 7 days, respectively. 

For a planned task recovery may be introduced into the 
task event tree. This is illustrated in the event tree shown 
in Figure 14.29, which shows recoveries from error repre¬ 
sented by tasks C and G. C is a recovery from failure at 
task B. G is a recovery from failure at task E and also at 
task H. 

14.27.12 Performance shaping factors 

The performance shaping factors (PSFs) are divided into 
the following classes: 

(1) external factors: 

(a) situational characteristics, 

(b) task and equipment characteristics, 

(c) job and task instructions, 

(2) internal factors; 

(3) stressors. 

Stressors are treated separately and are considered in the 
next section. 

The PSFs used listed in the Handbook are shown in 
Table 14.24. Each PSF is discussed in some detail. The 
Handbook does not, however, appear to give any simple 
method of adjusting the nominal HEPs by way of a multi¬ 
plying factor or otherwise. It is evidently up to the analyst 
to judge the quality of a particular PSF for the situation 
concerned and to make a suitable adjustment. 

However, some estimates, described as speculative and 
conservative, are given of the potential benefit of the 
adoption of good ergonomic practices. The authors state 
that in nuclear power plants violations of conventional 
human factors practices are the rule rather than the 
exception. The Handbook indicates that a reduction in HEP 
by a factor in the range 2-10 might be attained by adoption 
of good human factors practices in the design or displays 
and controls, and a similar reduction can be achieved by the 
use of checklists and well-written procedures instead of 
narrative procedures (Table 3.8). The EFs given alongside 
the nominal HEPs also provide further guidance for the 
analyst. 

14.27.13 Stress 

As already described, stress is an important determinant of 
performance and must be taken into account. It is one of the 
PSFs, but is accorded special treatment. Stress may be 
caused by both external and internal factors. Some of these 
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A 

Fail to initiate action to annunciators 

0.00008 

B 

Misdiagnosis 

0.01 

C 

Fail to initiate action to annunciator 

0.00015 

D 

Omit step 2.4 

0.0016 

E 

Omit step 2.5 

0.0016 

G 

Fail to initiate action to annunciator 

0.00001 


Omit step 2.6 

0 0016 

K 

Fail to initiate high-pressure injection 

0.0001 


Figure 14.29 HRA Handbook: event tree for task of handling loss of steam generator feed in a nuclear power plant, 
illustrating recovery from error (Swain and Guttmann, 1983) 


stressors are listed in Table 14.24 for stress that could 
potentially be rather complex. 

The approach adopted in th e Handbook is to simplify and 
to treat stress as a function of workload. The assumption 
underlying this approach is that, although there are in 
principle other factors that affect stress, workload is the 
dominant one. 

At a very low workload, performance is less than opti¬ 
mal. There is some higher workload at which it is optimal. 
At a higher workload yet, performance again deteriorates. 
Finally, the situation may induce threat stress, which is 
qualitatively different and is accorded separate treatment. 


The four levels of stress are therefore defined as: 

(1) very low task load; 

(2) optimum task load; 

(3) heavy task load; 

(4) threat stress. 

A heavy task load is one approaching the limit of human 
capacity. 

For the first three levels of stress, the Handbook gives 
multiplying factors which are applied to the nominal HEP 
(Table 20.16). The multiplying factors for an experienced 
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Table 14.24 HRA Handbook: some performance shaping factors (PSFsf (after Swain and Guttmann, 1983) 


External PSFs 


Situational characteristics: Task and equipment 
those PSFs general to one characteristics: those PSFs 
or more jobs in a work specific to tasks in a job 

situation 


Architectural features 
Quality of environment 
Temperature, humidity, air 
quality, and radiation 
Lighting 

Noise and vibration 
Degree of general 
cleanliness 

Work hours/work breaks 
Shift rotation 
Availability/adequacy of 
special equipment, tools 
and supplies 
Manning parameters 
Organizational structure 
(e.g. authority, 
responsibility, 

ActX^by supervisOTs” 6 S 
co-workers, unions 
representatives 
and regulatory personnel 
Rewards, recognition, 
benefits 


Job and task instructions: 
single most important 
tool for most tasks 
Procedures required 
(written or not written) 
Written or oral 
communications 
Cautions and warnings 
Work methods 
Plant policies 
(shop practices) 


Perceptual requirements 
Motor requirements (speed, 
strength precision) 
Control-display 
relationships 

Anticipatory requirements 
Interpretation 
Decision-making 
Complexity (information 
load) 

Narrowness of task 
Frequency and 
repetitiveness 
Task criticality 
Long- and short-term 
memory 

Calculational requirements 
Feedback (knowledge or 

Dynamic vs step-by-step 
activities 

Team structure and 
communication 
Man-made interface factors: 
design of prime equipment, 
test equipment, manufacturing 
equipment, job aids, 
tools, fixtures 


Stressor PSFs - 
psychological 
stressors: PSFs which 
directly affect mental 
stress 


Internal PSFs - organismic 
factors: characteristics 
of people resulting 
from internal and 
external influences 


Suddenness of onset 
Duration of stress 
Task speed 
Task load 
High jeopardy risk 
Threats (of failure, loss 

Monotonous, degrading 
or meaningless work 
Long, uneventful 
vigilance periods 
Conflicts of motives 
about job performance 
Reinforcement absent or 
negative 

Sensory deprivation 
Distractions (noise, glare, 
movement, flicker, colour) 
Inconsistent cueing 


Previous training/experience 
State of current practice or skill 
Personality and intelligence 
variables 

Motivation and attitudes 
Emotional state 
Stress (mental or bodily 
tension) 

Knowledge of required 
performance standards 
Sex differences 
Physical condition 
Attitudes based on influence of 
family and other outside 
persons or agencies 
Group ldentitications 


Physiological stressors: 
PSFs which directly 
affect physical stress 
Duration of stress 
Fatigue 

Plain or discomfort 
Hunger or thirst 
Temperature extremes 

G-force extremes 
Atmospheric pressure 

Oxygen insufficiency 
Vibration 

Movement constriction 
Lack of physical exercise 
Disruption of circadian 
rhythm 


1 Some of the tabled PSFs are not encountered in present-day nuclear power plants (e.g. g-force extremes), but are listed for application to other 


operator are: 2 for a very low task load and for a heavy task 
load of a step-by-step task; and 5 for a heavy task load of 
a dynamic task and for a threat stress condition of a step- 
by-step task. The multiplier for optimum workload is unity. 
Different factors are given for an inexperienced operator. 

A situation that can arise is where an error is made and 
recognized and an attempt is then made to perform the task 
correctly. Under conditions of heavy task load the prob¬ 
ability of failure tends to rise with each attempt as con¬ 
fidence deteriorates. For this situation the doubling rule is 
applied. The HEP is doubled for the second attempt and 
doubled again for each attempt thereafter, until a value of 
unity is reached. There is some support for this in the work 
of Siegel and Wolf (1969) described above. 


For a dynamic task or for diagnosis under threat stress 
the approach is different. A multiplier is not used, but 
instead a HEP value is given. The HEP for these cases is 
taken as 0.25 for an experienced operator and as 0.5 for 
an inexperienced one (both EF 5). The Handbook gives 
guidance on the assignment of the levels of workload, and 
hence stress. 

The basis of the HEP value of 0.25 is the work on beha¬ 
viour in emergencies by Ronan and Berkun already 
described. The probability of ineffective behaviour from 
the work on in-flight emergencies is about 0.15. The train¬ 
ing of a pilot is particularly intensive. Operators are not 
expected to perform as well. Hence, the HEP value of 0.25 is 
used for operators. 
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This HEP for threat stress conditions applies to dynamic 
tasks and to diagnosis, not to step-by-step tasks, for which, 
as already stated, a multiplier of 5 is used. 

A different treatment again is applied to a loss-of-coolant 
accident (LOCA). 


14.27.14 Sources of human performance estimates 

Ideally, the data on human performance used in this study 
would have been obtained from the nuclear industry alone. 
In fact, the data from this source were very limited and a 
much wider range of sources was used, as follows: nuclear 
power plants (NPPs); NPP simulators; process plants; other 
industrial and military sources; experiments and field 
studies on real tasks; and experiments on artificial tasks. 
This list is in order of decreasing relevance but, unfortu¬ 
nately, of increasing data availability. Some 29 ‘experts’on 
human error were approached for assistance in providing 
HEP estimates, but virtually none were forthcoming. 

For the nuclear industry the main potential source of 
human error data is licensee events reports (LERs). These 
contain an entry ‘Personnel error’. HEPs were determined 
from these LERs for tasks involving operation, maintenance 
and testing of manual isolation valves, motor operated 
valves (MOVs) and pumps. The HEP values obtained were 
low. Work by Speaker, Thompson and Luckas (1982) on 
valves has shown, however, that for every LER classification 
of ‘Personnel error’, there were some 5-7 additional repor¬ 
table events that in their judgement involved human error. 
Multiplication of the original HEP estimates by a correction 
factor of 6 brought them much closer to those from other 
sources. 

Most studies on NPP and other simulators have not 
yielded usable human error data.The first systematic study 
found which does was that of Beare et al. (1983). This work 
came too late for incorporation in the Handbook but was 
used as a cross-check. Extensive use was made of HEP data 
from the process industries given by Kletz and Whitaker 
(1973), E. Edwards and Lees (1974) and the ICI Safety 
Newsletter (1979). Other industrial HEP data mentioned are 
those of Rook (1962), Rigby and Edelman (1968a,b) and 
Rigby and Swain (1968,1975) on the production and testing 
of military systems. 

A number of field studies and experiments in industrial 
settings were conducted and yielded usable data. These 
were subject, however, to the usual caution that the very 
fact that an experiment is being conducted tends to distort 
the results. 

There is a large amount of experimental data on artificial 
tasks such as those conducted in laboratories. This work 
suffers from the fact that not only is it artificial, but also the 
limits of acceptable performance are often very narrow. It 
tends to be a poor indicator of absolute performance in real 
situations, but is a much more reliable guide to comparative 
performance. The correction that needs to be applied to 
such data to allow for the broader tolerances in industrial 
situations was the subject of a study by Payne and Altaian 
(1962), who obtained an average correction factor of 0.008. 
The Handbook states that using this factor the HEP values 
obtained are similar to those found in field operations. 

Expert judgement was utilized extensively to obtain 
HEP estimates where hard data were not available. Use was 
made of scaling techniques to calibrate HEPs for tasks 
estimated by the experts against known task HEPs. For the 
HEP in an emergency or highly stressed situation use was 


made of the work of Ronan (1953) and Berkun and 
co-workers (Berkun etal., 1962; Berkun, 1964). 

The Handbook discusses the estimation of HEPs where 
these are a function of time. For such tasks the three relevant 
features are: the time to begin the task, essentially the 
response time and the time required for diagnosis, if any; the 
time required to do the task correctly; and the time available 
to do the task correctly. Data on the time to perform the task 
were obtained from operating records and from experts.The 
time available was often determinedby the characteristics of 
the plant. 

The Handbook also gives an account of the determination 
of HEPs for: displays and controls; LOVs; oral instructions 
and written procedures; administrative controls; and 
abnormal events. 


14.27.15 Human performance estimates from 
expert judgement 

The estimates of human performance given in the Hand¬ 
book, whether for human error probabilities or performance 
shaping factors, are based on expert judgement. A discus¬ 
sion of expert judgement techniques applicable to human 
factors work is given in the Handbook by Weston (1983). He 
discusses the following methods: (1) paired comparisons, 
(2) ranking and rating procedures, (3) direct numerical 
estimation and (4) indirect numerical estimation. In dealing 
with estimates of human error, it is particularly important 
to give a full definition of the task for which the estimate is 
to he made. If the definition is poor, the estimates obtained 
are liable to exhibit wide differences. 

A study is quoted by Seaver and Sitwell (1983) in which 
these methods were compared in respect of six criteria. For 
the three criteria selected by Weston (quality of judge¬ 
ments, difficulty of data collection and empirical support) 
the rankings obtained by these workers were as follows: 
(1, best; 4, worst): 


Criterion Type of procedure 


Paired Rankingl Direct Indirect 
comparisons rating numerical numerical 
estimation estimation 


Quality of 1 

judgement 

2 

4 

3 

Difficulty of 4 
data 

collection 

1 

2 

3 

Empirical 3 
support 

4 

1 

1 


14.27.16 Uncertainty bounds and sensitivity analysis 

It is normal to include in a hazard assessment a sensitivity 
analysis and this creates a requirement to express an esti¬ 
mate of HEP not just as a point value but as a distribution. 
The distribution that is generally used is the log-normal 
distribution. As described in Chapter 7, the log-normal 
distribution is characterized by the two parameters m* and 
a Alternatively, it may be defined instead in terms of the 
log-normal median m and the EF /. Often only a point 
value is available, and generalized values of a or/are used 
to give the spread. 
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The log -normal distribution is that used in theHandbook. 
It is admitted that the basis for preferring this distribution is 
not strong. The experimental support that exists relates to 
distributions of response times. On the other hand, it is 
argued that the choice of distribution does not appear criti¬ 
cal. It is also the case that the log-normal distribution is a 
convenient one to use. Uncertainty arises from (1) lack of 
data, (2) deficiencies in the models used, (3) the effects of the 
PSFs and (4) the variable quality of analysts. 

Using the log-normal distribution, characterized by the 
log-normal median m and the EF/the uncertainty bounds 
(UCBs) are expressed in terms of the error factor. As an 
illustration, consider the following case: 

Nominal HEP =0.01 

Lower UCB =0.003 

Upper UCB =0.03 

Error factor/ = (0.03/0.003) 1/2 «* 3 

For the most part symmetrical UCBs are used, but there are 
exceptions. If the median value is low, the use of symme¬ 
trical UCBs may give a lower bound which is below the HEP 
cut-off, whilst at the other extreme for an HEP > 0.25 it may 
give an upper bound which exceeds unity. In these cases 
asymmetrical bounds are used. 

The general guidelines given in the Handbook for esti¬ 
mating the EF (Table 20.20) are given in Table 14.25. 

14.27.17 Validation 

A methodology of the type just described is clearly difficult 
to validate. There is a good deal of information provided in 
the Handbook in support of individual HEP estimates and 
some of this is described above. An account is also given of 
validation exercises carried out in support of the original 
THERP methodology, but these relate to tasks such as 
calibration and testing rather than process control. 


14.28 Assessment of Human Error: Success 
Likelihood Index Method (SLIM) 

A method of obtaining HEP estimates based on PSFs is the 
success likelihood index (SLI) which is incorporated in the 
SLI method (SLIM). Accounts are given in SLIM-MAUD: 
An Approach to Assessing Human Error Probabilities using 
Structured Judgement by Embrey et al. (1984 NUREG/ 
CR-3518) and by Embrey (1983a,b) and Kirwan (1990). 

SLIM treats not only the quality of the individual PSFs 
but also the weighting of these in the task. It is thus a 
complete method for assessing of human error, and not 
merely a technique for determining values of the PSFs. The 
basic premise of SLIM is that the HEP depends on the 
combined effects of the PSFs. A systematic approach is 
usedtoobtainthe quality weightings and relevancy factors 
for the PSFs, utilizing structured expert judgement. From 
these PSFs the SLI for the task is obtained. 

As defined by Embrey (1983a) the SLI for n PSFs is: 

SLI = J2 r m [14.28.1; 

where r is a relevancy factor and w a quality weighting. 
Thus, the SLI approach makes explicit the distinction 
between quality and relevance. 

The quality weighting is obtained from the judgement of 
a panel of experts and is assigned a value on the scale 1-9. 


Table 14.25 HRA Handbook: general guidelines on 

estimation of the error factor (EFf (after Swain and 

Guttmann, 1983) 

Item Task and HEP guideline 11 EF C 

Task consists of performance of 
step-by-step procedure* 1 conducted 
under routine circumstances (e.g. 
a test, maintenance or calibration 
task); stress level is optimal: 

(1) Estimated HEP <0.001 10 

(2) Estimated HEP 0.001-0.01 3 

(3) Estimated HEP >0.01 5 

Task consists of performance of 
step-by-step procedure* 1 but carried 

out in non-routine circumstances such 
as those involving a potential turbine/ 
reactor trip; stress level is moderately 
high: 

(4) Estimated HEP<0.001 10 

(5) Estimated HEP>0.001 5 

Task consists of relatively dynamic* 1 
interplay between operator and system 
indications, under routine conditions, 

e.g. increasing or reducing power; 
stress level is optimal: 

(6) Estimated HEP <0.001 10 

(7) Estimated HEP >0.001 5 

(8) Task consists of relatively dynamic* 1 10 

interplay between operator and system 
indications but carried out in non¬ 
routine circumstances; stress level is 
moderately high 

(9) Any task performed under extremely 5 

high stress conditions, e.g. large LOCA, 
conditions in which the status of ESFs 

is not perfectly clear, or conditions in 
which the initial operator responses 
have proved to be inadequate and now 
severe time pressure is felt (see text of 
Handbook for rationale for EF = 5) 


a The estimates in this table apply to experienced personnel. The per¬ 
formance of novices is discussed in Chapter 18 of the Handbook. 
b For UCBs for HEPs based on the dependence model, see Table 7.3 of 
the Handbook. 

'The highest upper UCB is 1.0. 

See Appendix A to calculate the UCBs for Pt(F t ), the total-failure 
term of an HRA event tree. 

d See Table 18.1 of the Handbook for definitions of step-by-step and 
dynamic procedures. 


The relevancy factor, which again is obtained from the 
judgement of the expert panel, is a measure of the con¬ 
tribution of that PSF, the sum of the relevancy factors being 
unity. The SLI so obtained is a relative value. 

In order to convert an SLI into a HEP, it is necessary to 
calibrate it against tasks for which the HEP is known. The 
relation used is: 

log 10 (HEP) =«SLI + b [14.28.2] 

where a and b are constants. These constants are 
obtained from two tasks of known HEP. Due to the 
logarithmic relationship, SLI values that do not differ 
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greatly (e.g. 5.5 and 5.75) may correspond to very differ¬ 
ent HEPs. 

The SLI methodology has two modules. The first is the 
multi-attribute utility decomposition (MAUD), usually 
referred to as SLIM-MAUD. The second is the systematic 
approach to the reliability assessment of humans (SARAH). 
The former is used to obtain the SLI and the latter to perform 
the calibrations. Both are embodied in computer programs. 
Accounts of work done to validate this approach have been 
given by Embrey (1983a) and Embrey and Kirwan (1983). 
Illustrative examples of SLIM are given by Dougherty and 
Fragola (1988), as described below, and Kirwan (1990). 


14.29 Assessment of Human Error: Human Error 
Assessment and Reduction Technique (HEART) 

In the HEART, described by J.C. Williams (1986,1988a,b, 
1992), the HEP of the task is treated as a function of the 
type of task and of associated error producing conditions 
(EPCs), effectively PSFs. The method is based on a classi¬ 
fication of tasks into the generic types shown in Section A 
of Table 14.26, which also gives the proposed nominal 
human unreliabilities for execution of the tasks. There is an 
associated set of EPCs, for each of which is given an esti¬ 
mate of the maximum predicted normal amount by which 
the unreliability might change going from ‘good’ to ‘bad’. 
Section B of the table shows the first 17 EPCs listed, those 
with the strongest influence; entries 18—38 list further 
EPCs with a weaker influence. 

In applying an EPC use is made of a weighting for the 
proportion of the EPC that is effective. Thus, for a task of 
type D with a nominal unreliability of 0.09, a single EPC of 4 
and a weighting of 0.5, the resultant unreliability is: 

0.09[(4 - 1) x 0.5 + 1] = 0.23 [14.29.1] 

The method also includes a set of associated remedial 
measures to be applied to improve the reliability. 

HEART has been designed as a practical method, and is 
easy to understand and use. It was on of the principal 
techniques used in the quantitative risk assessment for 
Sizewell B, as described in Section 14.39. 

14.30 Assessment of Human Error: Method of 
Dougherty and Fragola 

The deficiencies of THERP in respect of non-routine 
behaviour have led to the development of alternative meth¬ 
ods. One of these methods is that described in Human 
Reliability Analysis by Dougherty and Fragola (1988). Like 
THERP, this method has been developed essentially as an 
adjunct to fault tree analysis, but the approach taken is 
rather different. 

The earlier approach associated human errors essentially 
with equipment or procedure failures. One effect was the 
generation of a large number of human events linked to the 
equipment failures. Another was the neglect of more sig¬ 
nificant but complex human errors. The approach taken in the 
HR A of Dougherty and Fragola is to concentrate on a smaller 
number of more significant failures and human errors. There 
is also strong emphasis on integrating the HR A into the PR A. 

14.30.1 Overall approach 

The HRA process is shown in Figure 14.30. The generation 
of the human events to be considered is part of the PRA. As 


with physical hazards, identification has a good claim to be 
the most difficult stage of the process. Error classification 
schemes have been developed as an aid, but give no guar¬ 
antee of completeness. 

The human events are identified, characterized and 
quantified according to the scheme shown in Figure 14.31. 

Certain principles have been identified to guide the devel¬ 
opment of the PRA so that there is compatibility with the 
HRA. In broad outline these guidelines include the following: 

(1) The description of the human event should refer to 
failure of a function rather than to some lower level of 
abstraction. 

(2) The human events should be confined to the three 
categories of pre-initiator (or latent) events, human- 
induced initiator events and post-initiator events. 

(3) Human events in the latent category should be incor¬ 
porated in the faulttree at the highest appropriate level. 

(4) A human-induced initiator event should be subsumed 
in the initiator type which includes the human event. 
The data required should be expressed as a prob¬ 
ability and not as a frequency. 

(5) A human event in the post-initiator category which 
relates to failure of a system should be modelled as a 
single event under the gate below the top event of the 
fault tree for that system, the gate being (a) an OR gate 
if the system is manually activated or (b) an AND gate 
if the system is automatically activated. 

14.30.2 Task analysis 

The starting point is again a task analysis. A typical task 
analysis is outlined in Table 14.27. 

14.30.3 Response and recovery events 

Human events that occur in the post-initiator period are 
treated as either response or recovery events. The nuclear 
industry has gone to some pains to provide a rather com¬ 
prehensive set of emergency response guidelines. Follow¬ 
ing such guidelines, a planned activity is classed as a 
response, whilst an unplanned activity is classed as a 
recovery. Recovery activity is applicable only to those 
events from which recovery is possible; there are some 
events for which there is no recovery. 

The incorporation of recovery is not undertaken during 
the development of the main fault tree but is deferred until 
the tree, and its cut sets, are available. There are two rea¬ 
sons for this. One is that introduction of recovery during 
the main synthesis tends to result in an undue increase in 
the size of the tree. The other is that recovery analysis is an 
iteration through much of the PRA/HRA process, embra¬ 
ces system and human aspects, and tends to be highly 
specific to the set of events from which the recovery is to be 
made. It is therefore better to consider the set of events and 
the associated recovery as a separate exercise at the end. 


14.30.4 Operator action event trees 

Some of the activity of the operator consists of planned 
tasks, but he may also have to respond to an abnormal 
condition on the plant. Thus, although some events can be 
incorporated into the main fault tree of the PRA, post¬ 
initiator events involving action by the operator require the 
introduction of a specific event tree - the operator action 
event tree (OAET). 
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Table 14.26 

Classification of generic tasks and associated unreliability estimates (J.C. Williams, 1986) 

A Generic classifications 


Generic 


Proposed nominal 

task 


human unreliability 
(5th-95th percentile 
boundaries) 

A 

Totally unfamiliar, performed at speed with no real idea of likely 
consequences 

0.55(0.35-0.97) 

B 

Shift or restore system to a new or original state on a single attempt 
without supervision or procedures 

0.26(0.14-0.42) 

C 

Complex task requiring high level of comprehension and skill 

0.16(0.12-0.28) 

D 

Fairly simple task performed rapidly or given scant attention 

0.09(0.06-0.13) 

E 

Routine, highly practised, rapid task involving relatively low level 
of skill 

0.02(0.007-0.045) 

F 

Restore or shift a system to original or new state following 
procedures, with some checking 

0.003(0.0008-0.007) 

G 

Completely familiar, well-designed, highly practised, routine task 

0.0004(0.00008- 


occurring several times per hour, performed to highest possible 
standards by highly motivated, highly trained and experienced 
person, totally aware of implications of failure, with time to correct 
potential error, but without the benefit of significant job aids 

0.009) 

H 

Respond correctly to system command even when there is an 

0.00002(0.000006- 


augmented or automated supervisory system providing accurate 
interpretation of system stage 

0.00009) 

M 

Miscellaneous task for which no description can be found. (Nominal 

5th to 95th percentile data spreads were chosen on the basis of 
experience suggesting log-normality) 

0.03(0.008-0.11) 

B Error-producing conditions ’ 1 


Error-producing condition 

Maximum predicted 
nominal amount by 
which unreliability might 
change going from ‘good’ 
conditions to ‘bad’ 

1. 

Unfamiliarity with a situation which is potentially important but 
which only occurs infrequently or which is novel 

x 17 

2. 

A shortage of time available for error detection and correction 

xll 

3. 

A low signal-to-noise ratio 

x 10 

4. 

A means of suppressing or overriding information or features which 
is too easily accessible 

x 9 

5. 

No means of conveying spatial and functional information to 
operators in a form which they can readily assimilate 

x 8 

6. 

A mismatch between an operator’s model of the world and that 
imagined by the designer 

x 8 

7. 

No obvious means of reversing an unintended action 

x 8 

8. 

A channel capacity overload, particularly one caused by 
simultaneous presentation of non-redundant information 

x 6 

9. 

A need to unlearn a technique and apply one which requires the 
application of an opposing philosophy 

x 6 

10. 

The need to transfer specific knowledge from task to task without 
loss 

x 5.5 

11. 

Ambiguity in the required performance standards 

x 5 

12. 

A mismatch between perceived and real risk 

x 4 

13. 

Poor, ambiguous or ill-matched system feedback 

x 4 

14. 

No clear direct and timely confirmation of an intended action from the 
portion of the system over which control is to be exerted 

x 3 

15. 

Operator inexperienced (e.g. a newly qualified tradesman, but not an 
‘expert’) 

x 3 

16. 

An impoverished quality of information conveyed by procedures and 
person-person interaction 

x 3 

17. 

Little or no independent checking or testing of output 

x 3 
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Table 14.26 (continued) 


18. 

19. 

20. 

21. 

22. 

23. 

24. 

25. 

26. 

27. 

28. 

29. 

30. 

31. 

32. 

33. 

34. 


35. 

36. 

37. 

38. 


A conflict between immediate and long-term objectives. 

No diversity of information input for veracity checks 
A mismatch between the educational achievement level of an 
individual and the requirements of the task 
An incentive to use other more dangerous procedures 
Little opportunity to exercise mind and body outside the immediate 
confines of the job 

Unreliable instrumentation (enough that it is noticed) 

A need for absolute judgements which are beyond the capabilities or 

experience of an operator 

Unclear allocation of function and responsibility 

No obvious way to keep track of progress during an activity 

A danger that finite physical capabilities will be exceeded 

Little or no intrinsic meaning in a task 

High-level emotional stress 

Evidence of ill-health amongst operatives, especially fever 
Low workforce morale 

Inconsistency of meaning of displays and procedures 
A poor or hostile environment (below 75% of health or life- 
threatening severity) 

Prolonged inactivity or highly repetitious cycling of low mental 
workload tasks 

Disruption of normal work-sleep cycles 

Task pacing caused by the intervention of others 

Additional team members over and above those necessary to perform 

task normally and satisfactorily 

Age of personnel performing perceptual tasks 


x 2.5 
x 2.5 
x 2 

x 2 
x 1.8 

x 1.6 
x 1.6 

x 1.6 
x 1.4 
x 1.4 
x 1.4 
x 1.3 
x 1.2 
x 1.2 
x 1.2 
x 1.15 

x 1.1 for first half-hour 
x 1.05 for each hour 
thereafter 
xl.l 
x 1.06 

x 1.03 per additional 
x L02 


a If none of the task descriptions A- H fits the task under consideration, the values given under M may be taken as reference points. 
b Conditions 18-38 are presented simply because they are frequently mentioned in the human factors literature as being of some importance 
in human reliability assessment. To a human factors engineer, who is sometimes concerned about performance differences of as little as 3%, 
all these factors are important, but to engineers who are usually concerned with differences of more than 300%, they are not very significant. 
The factors are identified so that engineers can decide whether or not to take account of them after the initial screening. 


The response of the operator to an abnormal condition 
may be described in terms of an event tree. The use of event 
trees for this purpose has been formalized as the OAETor, 
simply, the operator action tree (OAT) technique. 

The OAET method has been described by R.E. Hall, 
Fragola and Wreathall (1982). Three basic features are 
recognized: (1) perception, (2) diagnosis and (3) response. 
Figure 14.32 shows a typical OAET for a nuclear reactor 
coolant pump seal LOCA. The OAET tends to be used in 
conjunction with a time-reliability correlation. 


14.30.5 Modelling of human events 

The classification of human events and the associated 
event models used in the HRA are shown in Figure 14.31. 
The human activity is divided into three classes which are 
specifiable and one that is not. The three definable activ¬ 
ities are planned tasks, response and recovery. Each of 
these definable activities is further divided into slips and 
mistakes, and these in turn are divided into errors of 
omission or commission. 

In each case a slip is modelled using a modified version of 
THERE Mistakes of response and recovery are modelled 
using TRCs. Other mistakes are not modelled, except that 
response mistakes of commission may be modelled. 
Recovery mistakes of commission may be estimated as 
described below. 


14.30.6 Filtering of human events 

The human events identified are subjected to both a quali¬ 
tative and a quantitative filter. This process is assisted if 
the analysis of the hardware and human aspects proceeds 
simultaneously. This is the most effective way to apply a 
qualitative filter to the large proportion of the human 
events identified. 

A quantitative filter is then applied. This means that an 
approximate estimate is made of the probability of each 
human event and, if at this level of probability the event has 
negligible effect on the fault tree, it is not pursued. 

The approach used draws on THERE A probability of 
0.001 is used as a basic screening value for the probability of 
ahumaneventforlatentorhuman-inducedinitiatorfailures. 
If there is redundancy so that a second error must occur for 
the failure to occur, aconditionalprobability of valueofO.lis 
used, corresponding to moderate dependency. For post¬ 
initiator events, use is made of the appropriateTRC, taking 
the probability at 5 min as the screening value. 


14.30.7 Modelling of slips 

Slips are errors in an activity that has to some degree been 
planned. This applies even to recovery, where the operator 
first formulates and then executes a plan. The method used 
to model slips is a modified version of THERE One modi¬ 
fication is to consider only one slip per task. The probability 
of the slip is taken as a basic value of 0.001 or, if there is 
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Figure 14.30 Method of Dougherty and Fragola: methodology for human reliability analysis (Dougherty and Fragola, 
1988) (Reproduced with permission of John Wiley & Sons Ltd from Human Reliability Analysis by E.M. Dougherty and 
J.R. Fragola, 1988, copyright©) 


redundancy, O.OOOl.These values are the same as those used 
for screening. They are then adjusted using appropriate per¬ 
formance shaping factors. The authors also describe alter¬ 
native, more complex methods of estimating the probability 
of slips. 


14.30.8 Modelling of mistakes 

Response and recovery mistakes are modelled using time- 
reliability correlations. The underlying assumption in this 
approach is that, although the probability of success 
depends, in principle, on many factors, the time available is 
the dominant one. Four separate TRCs are used. These are 
for the cases 


(1) response without hesitancy; 

(2) response with hesitancy; 

(3) recovery without hesitancy; 

(4) recovery with hesitancy. 

Hesitancy is associated with the burden of the task that in 
turn depends on a number of factors as described below. 
Account is also taken of the effect of PSFs. The incorpora¬ 
tion of these two features into the TRCs is described below. 

14.30.9 Time-reliability correlations 

It is found empirically that response times tend to fit a 
log-normal distribution. TheTRC models used are based 
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Environs Preparation Mode Effect Technique 


Plan-driven 
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Figure 14.31 Method of Dougherty and Fragola: classification of human events (Dougherty and Fragola, 1988) 
(Reproduced with permission of John Wiley & Sons Ltd from Human Reliability Analysis by E.M. Dogherty and 
J.R. Fragola, 1988, Copyright©) 


on the assumption that the log-normal distribution is 
applicable. They are characterized by a log-normal median 
m and an EF / and give a straight line when plotted on 
log-probability paper. The basic response time x is given by: 

T r = hk 2 x [14.30.1] 

where r is the median response time, r r is the adjusted 
median response time and k\ and k 2 are adjustment factors. 
The value of m used is the adjusted median response time. 

The first factor ki takes account of the availability or 
otherwise of a rule, in other words of the difference 
between response and recovery. It has the values: 

k\ = 1 Rule available [14.30.2a] 

ki = 0 no rule available [14.30.2b] 


The second factor k 2 takes account of the performance 
shaping factor as measured by the SLI. It is assumed that at 
best (SLI = 1), the median response time is halved and at 
worst (SLI = 0), it is doubled. The factor is defined as: 

k 2 = 2( 1 - &) [14.30.3] 

where x is the SLI. 

The base TRC is the nominal diagnosis curve given in 
THERP. This curve has a median m of 4 and an EF/of 3.2. 
It, therefore, has a relatively high median and low EF. The 
high median corresponds to a recovery rather than a 
response and the low error factor to absence of hesitancy. 
On this basis this curve is taken as that for recovery with¬ 
out hesitancy. 

The other TRC curves are then obtained from this basic 
curve. The curve for response without hesitancy has the 






































HUMAN FACTORS AND HUMAN ERROR 14/79 


Table 14.27 Task analysis in support of a human 
reliability analysis for a task in nuclear power plant 
operation (Dougherty and Fragoia, 1988) 

(Reproduced with permission of John Wiley & 

Sons Ltd from Human Reliability Analysis by 

E.M. Dougherty and J.R. Fragoia, 1988, Copyright©) 


Goal 

Obtain reactor core system water make-up and cooling 
following a small loss of coolant accident (LOCA) 

Step 

Means 

Diagnose event 

Detect plant upset condition 

Several alarms 

Observe RCS level indicator 

Pressurizer or 
reactor level 

Observe decreasing 

Pressure indicator 

RCS pressure 

Observe sump level 

Level indicator 

increasing 

Observe containment 

Pressure indicators 

pressure increasing 

Observe no secondary 

Radiation monitors 

side radiation 

Isolate the LOCA 

Close PORV block valve 1 

One valve control 

Close PORV block valve 2 

Another valve control 

Close letdown line 

One valve control 

Close RCP seal 

One valve control 

isolation valve 1 

Close RCP seal 

Another valve control 

isolation valve 2 

Verify safety system actuation 

Observe HPI pump meters 

Two flow indicators 

Start HPI pumps 

Two pump start controls 

Observe AFW pump meters 

Two flow indicators 

Start AFW pumps 

Two pump start controls 

Obtain long-term cooling 

Await low level tank alarm 

One level indicator 

Open sump valve 1 

One valve control 

Open sump valve 2 

One valve control 

Open tank valve 1 

One valve control 

Open tank valve 2 

One valve control 


AFW, auxiliary feedwater; HPI, high pressure injection; PORV, power 
operated relief valve; RCP, reactor coolant pump; RCS, reactor cooling 


parameters m = 2 and/= 3.2; that for response with hesi- 
tance m = 2 and /= 6.4; and that for recovery with hesi- 
tance m = 4 and/= 6.4. 

The TRC curves so derived are shown in Figure 14.33. 
These curves already incorporate the factor k\ but not the 
factor k 2 . The response time obtained from the curves 
should be multiplied by k 2 . 

14.30.10 Performance shaping factors 

PSFs are treated using SLIM. In the format given by the 
authors the SLI is defined as: 


SU = J2r m q t [14.30.4] 


r ni = r t /J2r, [14.30.5] 


where q is the quality, r the rank and r n the normalized 
rank. 

In general, q has a value in the range 0-1. This is so if the 
PSFcan have either a bad or a good influence. If it can have 
only a bad influence, the range of q is restricted to 0-0.5 
and if it can have only a good influence the range is 
restricted to 0.5-1. 

The determination of the SLI is illustrated in Table 14.28, 
which gives the SLI for a human error in a recovery mis¬ 
take. The SLI is can be used to adjust probabilities of slips 
or mistakes. In the latter case it is applied to the median 
response time of theTRC, as described below. 

14.30.11 Recovery mistakes of commission 

In an incident situation, the possibility exists that the 
operator will take some action which actually makes the 
situation worse. As so far described, the methodology does 
not include a model for such an action which is called a 
‘recovery mistake of commission’. 

A method is given, however, for estimating the prob¬ 
ability that such an error will occur. This probability is 
the product of three probabilities. The first is the prob¬ 
ability of a significant and extended commission error, the 
second the probability that the emergency response 
guidelines (ERGs) do not cover the resulting situation, 
and the third the probability that the senior reactor 
operator (SRO) or other personnel fail to recover the 
situation. 

The values of these three probabilities are estimated as 
follows. At the time of writing there had been 10,000 reactor 
scrams. Two involved misdiagnoses that led to core melt, 
including Chernobyl. The probability of a significant and 
extended commission error is thus estimated as 0.0002 
(2/10,000). It is assumed that ERGs would effect a reduction in 
probability of between one and three orders of magnitude and 
a reduction of two orders of magnitude is selected so that the 
second probability is estimated as 0.01. The action of the SRO, 
whose function is to stand back and monitor plant status, is 
assumed to have only low dependency with that of the crew 
and the probability that he will fail to effect recovery is esti¬ 
mated as 0.05. From these figures the authors derive a figure 
for the frequency of unrecovered mistakes of commission. 

14.30.12 Computer aids 

The documentation required of the HRA by the PRA is 
quite extensive and a computer program ORCA (Operator 
Reliability and Assessment) has been developed to assist in 
producing it. Table 14.29 shows a typical document for a 
recovery mistake. 

14.30.13 Application to nuclear power plants 

Detailed illustrations of the application of the HRA technique 
to particular nuclear power plants are given by the authors. 

14.30.14 Validation 

The HRA method just outlined is described by its authors 
as speculative. In other words, it lacks validation. In this it 
is on a par with most of the techniques used for quantifying 
human error in nuclear and process plants. Nevertheless, 
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Figure 14.32 Operator action event tree for a nuclear reactor pump seal loss-of-coolant accident (LOCA) (Dogherty and 
Fragola, 1988). BWST, borated water storage tank; RCP, reactor coolant pump; RCS, reactor cooling system; SI, safety 
interlock; Sl/I/, seal water (Reproduced with permission of John Wiley & Sons Ltd from Human Reliability Analysis by 
E.M. Dougherty and J.P. Fragola, 1988, Copyright©) 


this general type of approach represents the most sys¬ 
tematic method currently available for the treatment of the 
human error aspects of a PRA. 


14.31 Assessment of Human Error: CCPS Method 

Another methodology for human reliability assessment 
is that described in the CCPS Human Error Prevention 
Guidelines (1994/17). The structure of the method is shown 
in Figure 14.34. The core is the four stages of (1) critical 
human interaction identification and screening, (2) quali¬ 
tative prediction of human error, (3) representation of 
event development and (4) quantification of significant 
human errors. 

The qualitative error prediction stage utilizes the 
SPEAR method involving task analysis, PIF analysis, 
PHEA, consequence analysis and error reduction analysis. 
The representation of event development typically takes 
the form of fault trees and event trees. The techniques 
described for the quantitative error prediction stage are 


THERP, SLIM and influence diagram analysis (IDA). The 
latter is described in the next section. 

The CCPS HRA methodology has the important char¬ 
acteristic that it requires the analyst to start by acquiring a 
thorough understanding of the system first by critical 
human interaction identification and then by detailed 
qualitative analysis. Only then does the work progress to 
the use of the quantitative methods. 


14.32 Assessment of Human Error: Other Methods 

The following methods also merit mention. A brief account 
of each is given in the Second Report of the Study Group on 
Human Factors of the ACSNI (1991). Accounts are also 
given by J.C. Williams (1985), Waters (1989) and Brazendale 
(1990SRDR510). 

14.32.1 TESEO method 

A simple model for the estimation of the probability of 
operator error is that used in TESEO (Tecnica Empirica 
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Time (min) 


Figure 14.33 Method of Dougherty and Fragola: time- 
reliability correlations (Dougherty and Fragoia, 1988) 
(Reproduced with permission of John Wiley & Sons Ltd 
from Human Reliability Analysis by E.M. Dougherty and 
J.R. Fragola, 1988, Copyright©) 


Stima Errori Operatori) developed by Bello and Colombari 
(1980). The probability, q, of error is assumed to be the 
product of five parameters K r -K 5 as follows: 

q=K ] K 2 K :l KtK b (.14.32. T 

Definitions and values of the parameters are given in 
Table 14.30. 

An illustration of the use of TESEO has been given by 
Kletz (1991e). He considers a daily task of filling a tank by 
watching the level and closing a valve when the tank is full. 
He suggests that a reasonable estimate of failure is 1 in 
1000, or once in 3 years. In practice, men operate such sys¬ 
tems without incident for periods of 5 years. Using the 
TESEO approach he setsifi as 0.001, K 2 as 0.5 and the other 
parameters as unity, obtaining a probability of failure of 
1 in 2000, or once every 6 years. 

14.32.2 Absolute probability judgement (APJ) method 

In the absolute probability judgement (APJ) method, descri¬ 
bed by Seaver and Sitwell (1983), experts are asked to 
make direct estimates of human error probabilities for 
thetask. 

14.32.3 Method of paired comparisons (PCs) 

The use of the method of paired comparisons (PCs) in expert 
judgement was outlined in Chapter 9. It may be applied to 
the estimation of HEPs, as described by Blanchard et ol. 
(1966) and Hunns (1980,1982). 


14.32.4 Influence diagram approach (IDA) 

Influence diagram analysis is a tool developed in the con¬ 
text of decision analysis (R.A. Howard and Matheson, 


1980). It has been adapted for work on human factors by 
L.D. Phillips, Humphreys and Embrey (1983). Essentially, it 
is a form of logic tree showing the relations between parti¬ 
cular performance shaping factors. As such it may be used 
to obtain quantitative estimates based on expert judgement 
of the effects of these factors. 

14.32.5 Human Cognitive Reliability (HCR) correlation 

The human cognitive reliability (HCR) correlation of Han- 
naman and co-workers (Hannaman et d., 1985; Hannaman 
and Worledge, 1987) is a method in which the actions of the 
operating crew are represented in the form of an extended 
operator action tree and the probability of failure to 
respond is assessed using a set of three time-reliability 
correlations. 

14.32.6 Systematic human error reduction and 
prediction approach (SHERPA) 

The systematic human error reduction and prediction 
approach (SHERPA), and its application to human perfor¬ 
mance in ultrasonic inspection, has been described by 
Murgatroyd et d. (1986). SHERPA involves the three stages 
of identification of the set of tasks, hierarchical task ana¬ 
lysis and human error analysis. HTA is used to identify the 
two main types of task element handled: those involving 
manual skills, and those involving the application of con¬ 
dition-action rules. The human error analysis utilizes a 
flowchart technique to identify the external error modes of 
the actions comprising the task and the psychological error 
mechanisms which give rise to these modes. Other types 
of task element are dealt with by some other appropriate 
method. 

SHERPA is one of the two methods cited in the SRDA 
Operating Procedures Guide (Bardsley and Jenkins, 1991 
SRDA-R1) for the treatment of human error in the develop¬ 
ment of operating procedures. 

14.32.7 Critical action and decision approach (CADA) 

The other method quoted by these authors is the critical 
action and decision approach (CADA) of Gall (1990). This is 
a technique for systematic examination of decision-making 
tasks and is thus complementary to SHERPA. CADA 
utilizes checklists to classify and examine decision errors 
and to assess their likelihood. 

14.32.8 Maintenance personnel performance 
simulator (MAPPS) 

The maintenance personnel performance simulator 
(MAPPS) method is concerned principally with the effect 
of manning levels on maintenance tasks. The basic premise 
is that the probability of failure is a function of the loading 
on the personnel. 

14.32.9 Comparative evaluations 

Comparative evaluations of sets of human reliability tech¬ 
niques have been given by several authors, including 
Brune, Weinstein and Fitzwater (1983), J.C. Williams (1983, 
1985a), Bersini, Devooght and Smidts (1988), Humphreys 
(1988a,b) and Kirwan (1988). J.C. Williams (1985b) has 
compared six methods of human reliability assessment, 
including the AIR data bank, APJ, PC and SLIM. 

The methods treated in the comparative evaluation by 
Humphreys (1988a,b), described more fully in Section 
14.35, are APJ, PC, TESEO, THERP, HEART, IDA, SLIM 
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Table 14.28 Success likelihood index calculation for a recirculation event in nuclear power plant operation 
(Dougherty and Fragola, 1988) (Reproduced with permission of John Wiley & Sons Ltd from Human Reliability 

Analysis by E.M. Dougherty and J.R. Fragola, 1988, Copyright ©) 

Influence 

Type 

Rank 

Relative rank 

Quality 

Product 

% 

Competing resources 

Bad 

10 

0.05 

0.4 

0.02 

3 

Tank level indication 

Good 

50 

0.23 

0.9 

0.21 

31 

Size of LOCA 

Both 

10 

0.05 

0.2 

0.01 

1 

Expectation of failure 

Both 

50 

0.23 

0.3 

0.07 

10 

Training on contingencies 

Both 

100 

0.45 

0.8 

0.36 

54 



220 


SLI = 0.67 




Table 14.29 Proforma for a mistake in a recovery event in nuclear power plant operation (Dougherty and Fragola, 
1988) (Reproduced with permission of John Wiley & Sons Ltd from Human Reliability Analysis by E.M. Dougherty 
andJ.R. Fragola, 1988, Copyright©) 


Event designators 

Event description 

NDXOVERH 

Event type: 

Recovery 


The crew fails to realign equipment following recirculation hardware failures 



Option information: 


Screening value: 


4E-1 

Rule based? 


No 



Hesitancy? 


No 



SLI calculated? 


Yes 



Standard TRC? 


Yes 



Influences 

Rank 

Normed-rank 

Quality 

Product 

1. Display adequacy 

10 

0.06 

70 

4.2 

2. Procedure adequacy 

40 

0.24 

30 

7.2 

3. Team effectiveness 

20 

0.12 

80 

9.6 

4. Communication effectiveness 

10 

0.06 

80 

4.8 

5. Workload 

40 

0.24 

30 

7.2 

6. Training adequacy 

7. 

8. 

9. 

10. 

50 

0.29 

70 

20.3 





53.3 

SLI 


50.3 



Available time (min) 


20 



Mean probability and statistics 


IE—2 



Lower bound 


4E—4 



Upper bound 


4E-2 



Median time (min) 


4.0 



Error factor 


3.2 




and HCR. Another account of this work is given by Kirwan 
(1988). 

A comparative evaluation was also made in the Bench¬ 
mark Exercise described in Section 14.36. 


14.33 Assessment of Human Error: Performance 
Shaping Factors (PSFs) 

14.33.1 THERP method 

The use of PSFs in theTHERP methodology as given in the 
HRA Handbook has been outlined above. The factors are 


listed and described but a formal quantitative method of 
determining for each PSF an adjustment factor to be 
applied to the human HEP does not appear to be used. 


14.33.2 SLIM 

PSFs are the basis of SLIM, as described above. In this 
method the value, or quality, of a PSF is determined by 
structured expert judgement. The influence diagram tech¬ 
nique is used to show the structure of the relationship 
between PSFs. 
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Figure 14.34 A methodology for human reliability 
assessment (CCPS, 1994/17) (Courtesy of the American 
Institute of Chemical Engineers) 


14.33.3 HEART 

HEART is another method in which PSFs play a central 
role.The classification of the generic tasks is itself based on 
PSF-like distinctions and the EPCs that are applied to the 
basic generic task reliability estimates are in effect PSFs. 


14.33.4 White method 

R.F. White (1984 SRD R254) has described a form of PSF, 
the observable operational attribute (OOA) in which, as the 
name implies, the emphasis is on the observability of the 
attribute. He provides a checklist of attributes, broken down 


Table 14.30 Operator error probability parameters used 
in TESEO (Bello and Colombari, 1980) (Courtesy of 
Elsevier Applied Science Publishers Ltd) 


Type of activity 


Ai 


Simple, routine 0.001 

Requiring attention, routine 0.01 

Not routine 0.1 


Temporary stress factor for routine activities 

Time available (s) K 2 


2 10 

10 1 

20 0.5 


Temporary stress factor for non-routine activities 

Time available (s) K 2 


3 10 

30 1 

45 0.3 

60 0.1 


Operator qualities 

K 3 

Carefully selected, expert, well trained 0.5 

Average knowledge and training 1 

Little knowledge, poorly trained 3 


Activity anxiety factor 

K a 

Situation of grave emergency 3 

Situation of potential emergency 2 

Normal situation 1 

Activity ergonomic factor 

K 5 

Excellent microclimate, excellent interface 0.7 

with plant 

Good microclimate, good interface with plant 1 

Discrete microclimate, discrete interface 3 

with plant 

Discrete microclimate, poor interface with plant 7 

Worst microclimate, poor interface with plant 10 


into (1) plant attributes and (2) main- tenance attributes. 
Examples of attributes listed as observable are: 

(1) What is the time-scale of a filling operation of one tank 
(or two at a time)? (e.g. Within one shift? Longer than 
one shift?) 

(2) Is formal training given at instrument fitter level? 

14.33.5 Whalley model 

A methodology for identifying error causes and making the 
link between them and the PSFs has been developed by 
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Whalley(1987).TheclassificationstructureofthePSFsusedis 
shown in Figure 14.35. Atotal of 146 PSFs is defined.The PSFs 
influence the error causes. Each error causemay be affected by 
several PSFs and each PSF may affect several error causes. 

The method utilizes classifications of (1) task types, 
(2) response types, (3) error types, (4) error mechanisms 
and (5) error causes. There are seven task types (TTk), 
which are shown in Table 14.31, Section A. There are also 
seven response types (RTs) as shown in Section B of the 
table. The ten error types (ETk) are shown in Section C. 
The error mechanisms and error causes are shown in 
Figure 14.36. There are 10 error mechanisms (EMs) and 37 
error causes (ECs) (including causes 23a and 30a). 

The task types may be summarized as follows. TT 1 is 
response to a familiar input and requires essentially no 
decision-making. TT 2 is response to several familiar 
inputs, matches the mental model and requires no decision¬ 
making. TT 3 is interpretation of, and response to, a devel¬ 
oping situation using the mental model. TT 4 is a pre¬ 
determined response to a recognized situation. TT 5 is a 
self-determined activity that may involve planning. TT 6 is 
selection of one of several alternative plans. TT 7 is correc¬ 
tion of error, and thus differs from the other types. For the 
response types the primary classification is into discrete or 
sequence responses, the former involving a single unit of 
performance, the latter a sequence. The secondary classi¬ 
fication is into action and communication activities. The 
error types are cast as guidewords that are broadly similar 
to those used in Hazop studies. 

The overall structure of the method is shown in 
Figure 14.37. The primary linkages are from TT, RT and 
ET to possible ECs. Each TT can be mapped to a set of 


ECs, either through an information processing chain (IPC) 
(TT —> IPC —► EC) or through a set of error mechanisms 
(TT —► EM —> EC). Each response type can be mapped to 
a set of error causes either through a set of error types 
(RT —>ET —* EC) or directly (RT - EC). 

The analyst uses these various routes to identify the ECs 
for the task under consideration and then determines for 
each cause the relevant PSFs and their impact. A computer 
aid has been developed to assist in identifying the ECs, 
linking these to the PSFs and quantifying the effect of the 
latter. 

14.33.6 CCPS method 

Another set of PSFs are those given in the Human Error 
Prevention Guidelines by the CCPS (1994/17), which refers 
to them as performance influencing factors (PIFs). The PIF 
classification structure is shown in Table 14.32. The Guide¬ 
lines give a detailed commentary on each of these factors. 


14.34 Assessment of Human Error: Human Error Data 

The various methods described for quantitative assess¬ 
ment of human reliability give rise to a demand for data on 
human error. Some aspects of this are now considered. 
Human error data and its acquisition has been discussed by 
a number of workers. The account given in Human Error 
Prevention Guidelines by the CCPS (1994/17) deals with the 
essentials. 

14.34.1 Human error data 

Data on human error may be acquired by a number of 
methods. One approach involves study of the task from 
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Figure 14.35 Classification structure of performance shaing factors (Whatley, 1987. Reproduced by permission.) 
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Table 14.31 Some classifications of task, response and 
error for the human operator (Whalley, 1987. Reproduced 
with permission.) 


A Task types 

1. Stimulus 

2. Integration 

3. Interpretation 

4. Requirement 

5. Self-generation 

6. Choice 

7. Correction required 


B Response types” 


Discrete 

Sequence 

Action 

Y 

Y 

No action 

Y 

N 

Give information 

Y 

Y 

Get information 

Y 

Y 

C Error types 


1. Not done 

2. Less than 

3. More than 

4. As well as 

5. Other than 

6. Repeated 
Timing errors 

7. Sooner than 

8. Later than 

9. Misordered 

10. Part of 


a Y, valid combination; N, invalid combination. 

documentation, which may be aided by task analysis. 
Another group of methods are those based on some form of 
direct observation. This may be informal or may utilize 
formal techniques such as activity sampling, verbal proto¬ 
col, or withholding of information. 

A third group of methods are based on debriefing. One 
technique here is the critical incident technique, originally 
used by Flanagan (1954), in which a person who has 
experienced a near miss is debriefed. Debriefing may also 
be used to gain information about more normal tasks and 
situations. A fourth approach is the elicitation of informa¬ 
tion from experts. 

The situation studied may be that on real plant or on a 
simulator. Simulation is widely used to present situations 
representative of real life in a compressed time-scale. A 
review of these and other methods of acquisition of data on 
human error is given by the CCPS. 

14.34.2 Human error data collection 

The acquisition of high quality data on human error is 
clearly of central importance. Human error data collection 
and data collection systems are also treated by the CCPS. 
The account deals with (1) types of data collection system, 
(2) design principles for data collection systems, (3) orga¬ 
nizational and cultural aspects of data collection, types of 
data collected, (5) methods of data collection and storage 
and (6) data interpretation. 


The CCPS distinguishes between consequence-driven 
and causally oriented systems. The traditional reporting 
system in the process industries is one triggered by inci¬ 
dents. It is of ten largely a matter of chance, however, whether 
or not an error has significant consequences. For this reason 
the Guidelines concentrate on causally oriented systems. 
Some types of data collection system that are described are 

(1) the incident reporting and investigation system (IRIS), 

(2) the root cause analysis system (RCAS), (3) the near miss 
reporting system (NMRS) and (4) the quantitative human 
reliability data collection system (QHRDCS). 

It is primarily the latter type of system that has the 
potential to generate data for HRA. There is little evidence 
of the development of such systems. The CCPS sees them as 
most likely to emerge in the first instance at in-house level. 

The type of data collected will depend on the perspective 
dominant in the organization, on the human error model 
implied and on the associated error classification. The 
CCPS list the following types of causal data. Data may refer 
to (1) event sequence and structure, (2) human error ten¬ 
dencies, (3) performance-influencing factors and (4) orga¬ 
nizational issues. 


14.34.3 Human reliability data banks 

Human error data banks were a relatively early develop¬ 
ment. The data entered into these data banks were of the 
type necessary to support techniques such asTHERP. One 
such data bank is the American Institute for Research (AIR) 
data bank developed by Altaian and co-workers (Payne and 
Altaian, 1962; Altaian, 1964) and also described by Meister 
(1964) and others (Swain, 1968; De Greene, 1970). The store 
provides data for the execution time and probability of 
success of task ‘elements’or ‘steps’. Each step has an input, 
a mediating and an output component. Typical input com¬ 
ponents are indicators such as scales and lights; typical 
output components are controls such as knobs and push 
buttons, and the two mediating components are identifi¬ 
cation/recognition and manipulation. Each component has 
several parameters. Those for a light include size, number 
and brightness. Each parameter has several discrete levels 
or ‘dimensions’. Data on time and reliability for each para¬ 
meter are recorded as functions of its dimensions. The time 
and reliability of the component are estimated by summing 
and multiplying, respectively, the time and reliability of the 
parameters. The time and reliability of the element are 
obtained from those of the components in a similar way. 

Two other data banks from this era are the Aerojet- 
General data bank, described by Irwin and co-workers 
(Irwin, Levitz and Ford, 1964; Irwin, Levitz and Freed, 
1964), and the Bunker-Ramo data bank, described by 
Meister (1967). These three data banks have been repro¬ 
duced in Topmiller, Eckel and Kozinsky (1982). Another 
somewhat similar data bank is the Sandia Human Error 
Rate Bank (SHERB) described by Rigby (1967) and Swain 
(1970). 

It will be clear that the development of these data banks 
was largely driven by the needs of the defence and aero¬ 
space industries. 

Work on the cognitive and socio-technical aspects of 
human error is almost certainly too recent for the emer¬ 
gence of data banks utilizing classifications based on these 
approaches. Nor is it clear whether the needs of the process 
industries are perceived as sufficiently urgent to support 
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Figure 14.36 Structure of error mechanisms and error causes (Whalley, 1987. Reproduced by permission.) 
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Figure 14.37 Relations between task and response 
types, error causes and other quantities (Whalley, 1987. 
Reproduced by permission.) 

the creation of data banks which are both based on this 
more recent work and applicable to those industries. 

14.34.4 Human error database (HED) 

The Human Error Database (HED), described by Kirwan 
(1988), is based on the HEP data given in the Rosmussen 
Report, temperedbyexpertjudgement.Inthatitderivesfrom 
that report, it has similarities to THERP, but it is less 
decompositional and is not dependent on any specific model. 

14.34.5 Accident and human error classification 
system (TAXAC) 

A design for an accident and human error classification 
system, TAXAC, as the basis of a human error data bank, 
has been given by Brazendale (1990 SRD R510). The acci¬ 
dent classification is obtained as a function of the accident 
signature (a skeletal account) S, and the accident causes 
and conducive factors. The features which contribute to the 
latter are grouped under the headings: activity A, man M, 
organization 0, and plant P. Accidents are also categorized 
by industry I. Checklists are given for features I, S, A, M, 0 
and P. The author also reviews the requirements and pro¬ 
spects for a human error data bank. Such a venture should 
not be an isolated entity but should be part of a wide activ¬ 
ity on human performance. 

14.35 Assessment of Human Error: SRD Human 
Error Guides 

Guidance on several aspects of human error in design and 
assessment has been issued by the Safety and Reliability 
Directorate (SRD). 

Design is dealt with in Guide to Reducing Human Error in 
Process Operation (short version) by the Human Factors in 
Reliability Group (HFRG) (1985 SRD R347) (the HFRG 
Guide) and The Guide to Reducing Human Error in Process 
Operation by P. Ball (1991 SRDA-R3), the short and full 
versions. 

The treatment of human error in hazard assessment is 
covered in A Suggested Method for the Treatment of Human 
Error in the Assessment of Major Hazards by R.F. White 
(1984 SRD R254). Human Reliability Assessors Guide by 
Humphreys (1988a) and Human Error in Risk Assessment 
by Brazendale (1990 SRD/HSE/510). 


A related publication is Developing Best Operating Proce¬ 
dures by Bardsley and Jenkins (1991 SRDA-R1). This is 
considered in Chapter 20. 

The HFRG Guide (1985 SRD R347), as its title indicates, 
is concerned with qualitative measures for reducing human 
error rather than with predicting it. It is essentially a col¬ 
lection of checklists under the following headings: 
(1) operator-process interface, (2) procedures, (3) work¬ 
place and working environment, (4) training and (5) task 
design and job organization. 

The Guide distinguishes three meanings of procedure: 
(1) general guidance, (2) an aid and (3) prescribed beha¬ 
viour. With regard to the latter, it states the following prin¬ 
ciples: (1) there should be no ambiguity about when a 
procedure is to be used, (2) if a procedure is mandatory 
there should be no incentive to use another method, 
(3) where possible a procedure should support the opera¬ 
tor’s skill and discretion rather than replace them and (4) a 
procedure should be easy to understand and to follow. 

R.F. White (1984 SRD R254) describes the use of event 
tree and fault tree methods to identify the points at which a 
human action occurs which has an effect on the outcomes. 
As described earlier, he uses a form of PSF, the OOA, which 
is distinguished by the fact that it is observable and for 
which he provides a checklist. He gives as an illustrative 
example the analysis of the filling of an liquefied natural 
gas tank. 

The Human Reliability Assessors Guide (Humphreys, 
1988a), given in overview by Humphrey (1988b), is in two 
parts, the first of which gives a summary of eight techniques 
for human reliability assessment and the second evaluation 
criteria for selection and a comparative evaluation based on 
these criteria. The eight techniques are APJ, PC, TESEO, 
THERP, HEART, IDA, SLIM and HCRM. For each technique 
the Guide gives a description and a statement of advantages 
and disadvantages. The evaluation criteria used relate to 
(1) accuracy, (2) validity, (3) usefulness, (4) effective use of 
resources, (5) acceptability and (6) maturity. Accuracy has 
to do with correspondence with reality and with consistency; 
validity with incorporation of human factors knowledge 
and of the effect of appropriate PSFs. 

The report by Brazendale (1990 SRD/HSE/510) presents 
a taxonomy for an accident classification scheme, TAXAC, 
intended for use in connection with a human error data 
bank. The classification is preceded by a discussion of 
models of human error. An account of this work is given in 
Section 14.34. 


14.36 Assessment of Human Error: Benchmark 
Exercise 

A benchmark exercise of human reliability is described in 
HF-RBE: Human Factors Reliability Benchmark Exercise: 
Summary Contributions of Participants (Poucet, 1989). The 
study is one of a series of benchmark exercises conducted 
by the Commission of the European Communities (CEC) 
and organized by the Joint Research Centre (JRC) at Ispra, 
Italy. The exercise was carried out over 1986-88 with 
13 participants. The system studied was the emergency feed- 
water system (EFS) on a nuclear reactor at the Kraftwerk 
Union (KWU) site at Grohnde. Two studies were performed: 
a routine test and an operational transient. 

The study carried out by SRD is described in Poucet’s 
volume by Waters. The work showed the importance of the 
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Table 14.32 Classification structure of performance influencing factors (CCPS, 1994/17) (Courtesy of the American 
Institute of Chemical Engineers) 

Operating environment 

Task characteristics 

Chemical process environment: 

Equipment design: 

Frequency of personnel involvement 

Location/access 

Complexity of process events 

Labelling 

Perceived danger 

Personal protective equipment 

Time dependency 

Suddenness of onset of events 

Control panel design: 

Content and relevance of information 

Physical work environment: 

Identification of displays and controls 

Noise 

Compatibility with user expectations 

Lighting 

Grouping of information 

Thermal conditions 

Overview of critical information and alarms 

Atmospheric conditions 


Job aids and procedures: 

Work pattern: 

Clarity of instructions 

Work hours/rest hours 

Level of description 

Shift rotation 

Specification of entry/exit conditions 

Quality of checks and warnings 

Degree of fault diagnostic support 
Compatibility with operational experience 
Frequency of updating 

Training: 

Clarity of safety and production requirements 
Training in using new equipment 

Practice with unfamiliar situations 

Training in using emergency procedures 
Training in using automatic systems 

Operator characteristics 

Organizational and social factors 

Experience: 

Teamwork and communications: 

Degree of skill 

Distribution of workload 

Experience with stressful process events 

Clarity of responsibilities 

Personality: 

Authority and leadership 

Motivation 

Group planning and orientation 

Risk taking 

Risk homeostasis 

Management policies: 

Locus of control 

General safety policy 

Emotional control 

Systems of work 

Type Avs type B 

Learning from operational experience 

Policies for procedures and training 

Physical condition and age 

Design policies 


qualitative modelling stage prior to any quantification and 
the value of event trees as a tool for such modelling. Meth¬ 
ods investigated included APJ, TESEO, THERP, HEART 
and SLIM. No single method appeared superior in all 
applications. 


14.37 Assessment of Human Error: ACSNI Study 
Group Report 

The accounts given of attempts to assess human error 
illustrate the difficulties and raise the question of whether 
such assessment is even feasible. The use of quantitative 
risk assessment has created a demand for the development 
of techniques for the assessment of human error and this 
demand has been satisfied by the development of methods, 


which have just been described, but the validation of these 
methods leaves much to be desired. 

This problem is addressed in Second Report (A the ACSNI 
(1991) entitled Human Reliability Assessment — A Critical 
Review. The study deals with the control of the process, but 
emphasizes that the question is wider than this, embracing 
also maintenance and other activities. Although it is a 
report to the nuclear industry, its findings are in large part 
applicable to the process industries also. 

As systems become more automated and reliable, but 
still vulnerable to human error, the relative importance of 
human error increases. 

The report quotes the view expressed to the Sizewell B 
Inquiry by the Nuclear Installations Inspectorate (HSE, 
1983e) that it was ‘considered that comprehensive quanti¬ 
fication of the reliability of human actions was not, with 
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current knowledge, meaningful or required’, and considers 
how far the situation has changed since that time. 

The report describes the basic procedure of HRA. This is 
the breakdown of the task into a series of events, each of 
which has two alternative outcomes and the assignment to 
these events of basis error probabilities (HEPs). These 
HEPs are then modified in respect of dependencies and of 
PSFs. The HEP for the task is then determined. The 
robustness of the result is assessed by means of a sensi¬ 
tivity analysis. 

The variations on this basic procedure lie in the areas of 
the data sources, the rules for combination and the handling 
of time. The different techniques vary in the use which 
they make of field data, data banks, and expert judgement. 
They also differ in the way in which they combine the influ¬ 
encing factors. In one method some factors may be taken into 
account by making distinctions in the basic tasks, whilst in 
another they may be handled as PSFs. The effect of time may 
be taken into account by treating it simply as another PSF, 
or, alternatively, it may be accorded a special status. In this 
latter case the favoured method is the time response corre¬ 
lation, in which time is the principal independent variable 
determining the HEP, the HEP decreasing as the time avail¬ 
able increases. 

The report examines some of the areas of HRA in which 
problems arise or over which care must be taken. The 
include (1) classification of errors, (2) modelling and audit¬ 
ing, (3) operator error probabilities, (4) maintenance error 
probabilities, (5) interaction between PSFs, (6) sensitivity 
analysis and (7) changes in management and organization. 

It adopts the distinction between skill-based, rule-based 
and knowledge-based behaviour and that between slips 
and mistakes. Essentially it argues that slips, associated 
with skilled behaviour, are amenable to prediction, but 
mistakes, associated with rule-based behaviour, are harder 
to predict, whilst for errors in knowledge-based behaviour 
there is currently no method available. It also draws atten¬ 
tion to wilful actions, or violations, which again are not well 
covered in current methods. 

The first step in an assessment of HEPs is the modelling 
of the task. There is evidence that for skill-based errors at 
least, the variability between techniques is less than that 
between analysts. This points to the need for training of 
analysts and for an independent check. For auditing it is 
necessary that the analyst record sufficient detail on his 
procedures and reasoning. 

The report cites estimates of HEPs given in the literature 
such as the Rasmussen Report , described below. It draws 
attention to the importance of dependency between human 
actions. It is characteristic of human error that the prob¬ 
ability of a further error following an initial one is often not 
independent but conditional on, and increased by, the 
occurrence of the first error. On the other hand, humans 
have the capability to recover from error. It is also neces¬ 
sary to consider the HEP for tasks where more than one 
operator is involved. 

With regard to maintenance error, the report makes the 
point that hardware failure rate data already include the 
effects of maintenance errors. Nevertheless, it is prudent to 
make some assessment of the maintenance error. In parti¬ 
cular, there is the possibility that such errors may be a 
source of dependent failures, as described in Chapter 9. 

Most methods make the assumption that the PSFs are 
independent of each other. Yet, the effects of lack of super¬ 
vision and of training, for example, are likely to be greater 


when they occur in combination. An exception is SLIM, 
which does allow for this effect. The HEP estimates should 
be explored using sensitivity analysis. 

The HR A is likely to more affected than the PR A as a whole 
by changes in the management and organization of the com¬ 
pany, but the assessment of such changes on HEPs is not 
straightforward. It seems likely that certain types of error 
will be more affected than others and, therefore, that their 
relative importance will change. Skill-level errors may be 
less influencedbymanagement changes thanbyknowledge- 
level ones.Violations might wellbe sensitive to such changes. 

The report reviews the strengths and limitations of 
HRA. It is accepted that PRA has an essential role to play in 
improving reliability; HRA is a logical and vital extension. 
Its use has been given impetus by the retrospective 
assessments conducted after the Three Mile Island inci¬ 
dent. A HRA contributes to system design in three ways: it 
provides a benchmark for designs and safety cases; it gives 
a quantitative assessment of alternative design or organi¬ 
zational solutions; and it provides a means and a justifica¬ 
tion for searching out the weak points in a system. 

The limitations of HRA principally considered are those 
of HEP data and of validation. There is a wealth of data 
from various kinds of human factors experiments, but the 
situations in which they are obtained are usually to a 
degree artificial and their applicability is questionable. 
They provide guidance on the relative importance of dif¬ 
ferent PSFs but generally need to be supplemented by 
information from other sources. The quantity and quality 
of field data are relatively low. Those data that do exist are 
predominantly for slips rather than mistakes or violations. 
Again they are a guide to the relative importance of differ¬ 
ent PSFs, but need to be supplemented. A third source of 
data is expert judgement. The methods for maximizing the 
quality of assessments and avoiding pitfalls are discussed. 
The importance is emphasized of the experts having full 
information on the operational context, such as normal 
operation or abnormal conditions. 

The report addresses the question of the lack of valida¬ 
tion of HRA methods. It quotes the following critique of 
J.C. Williams (1985b): ‘It must seem quite extraordinary to 
most scientists engaged in research in other areas of the 
physical and technological world that there has been little 
or no attempt made by human reliability experts to validate 
the human reliability assessment techniques which they so 
freely propagate, modify and disseminate’. 

Four kinds of validity are considered by the authors: 
(1) predictive validity, (2) convergent validity, (3) content 
validity and (4) construct validity. Essentially, for the pre¬ 
diction of a given analyst, predictive validity is concerned 
with agreement with the real situation, convergent validity 
is concerned with agreement with the predictions of other 
analysts, content validity is concerned with agreement 
between the elements of the model and the features which 
are critical in real life, and construct validity is concerned 
with agreement between the structure of the model and 
that of the real-life situation. 

A study of predictive validity has been made by Kirwan 
(1988). He compared six HRA methods in respect of 
their ability to predict accident data from experimental, 
simulator and plant sources, and found that on some criteria 
some methods seemed reasonably successful. The work 
was limited, however, to the assessment of the HEP for spe¬ 
cified errors and did not deal with modelling of tasks. Two 
studies of convergent validity, by Brune, Weinstein 
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and Fitzwater (1983) and Bersini, Devooght and Smidts 
(1988), have found that different assessors give widely 
differing estimates, even when using the same method. 
Content validity is probably best assessed by peer review. 
A study by Humphreys (1988a) based on a comparison of 
eight methods against a checklist concluded that the relative 
performance of the methods depends on the problem and 
that few are completely comprehensive. The report states 
that construct validity does not appear to have been applied 
in HRA and that it may not be applicable at this stage of 
development. 

Considering the areas where work is required, the report 
suggests that one important topic is the development of an 
improved model of operator behaviour. Here it is the high 
level decision-making processes which are of prime 
importance, since it is failures at this level which have the 
most serious consequences. There is a hierarchy of patterns 
of learned behaviour, highly learned at the lower levels and 
but less so towards the upper ones. It is the conservatism of 
these processes which is responsible for behaviour such as 
‘mind set’ and switch to ‘automatic pilot’ and for slips when 
the mind ‘jumps the points’ and then continues with a whole 
series of inappropriate actions. Another area where work is 
needed is the creation of a data set which may be used for 
validation studies. 

The report supports the development and use of methods 
of HRA. It is an essential element of PRA and is beneficial 
in its own right. But the techniques available for predicting 
slips are better than those for mistakes, and particular 
caution should be exercised with the latter. It should be 
recognized that HRA is still in its infancy. 

It rej ects the view that HR A in the nuclear industry should 
be optional and supports a requirement for its use. HRA 
provides a structured and systematic consideration of 
human error. It is already avaluable tool and has the potential 
to become an invaluable one. A requirement for its use is 
necessary to provide the necessary impetus for this. The 
report emphasizes, however, that effort should not be con¬ 
centrated exclusively on assessment; there is equal need fora 
systematic approach to the reduction of human error. 

The report contains appendices (Appendices 1-4) on 
HRA methods and their evaluation, dependability of 
human error data, attempts to establish validity of HRA 
methods, and approaches to reducing human error. Some 
of the procedures reviewed in Appendix 1 are APJ, IDA, 
TESEO.THERP, HEART, SLIM,TRCs, MAPPS and HED. 

Appendix 4 of the report gives guidance on approaches 
to the reduction of human error. It discusses accident 
chains and latent and active (enabling and initiating) fail¬ 
ures and gives the accident model shown in Figure 2.5 
which shows the ‘shells of influence’ for the PSFs. The 

including the sensitivity analysis, of the features where 
human error is critical, the application of human factors 
methods and the implementation of the improvements 
indicated by these methods. The role of human factors both 
in system design and in the design of the man-machine 
interface and the workplace is described. 

14.38 CCPS Human Error Prevention Guidelines 

14.38.1 CCPS Guidelines for Preventing Human Error 
in Process Safety 

The prevention of human error on process plants is 
addressed in the Guidelines for Pre venting Human Error in 


Process Safety edited by Embrey for the CCPS (1994/17) (the 
CCPS Human Error Prevention Guidelines). 

The Human Error Prevention Guidelines are arranged 
under the following headings: (1) the role of human error in 
chemical process safety, (2) understanding human perfor¬ 
mance and error, (3) factors affecting human performance 
in the chemical industry, (4) analytical methods for pre¬ 
dicting and reducing human error, (5) qualitative and 
quantitative prediction of human error in risk assessment, 
(6) data collection and incident analysis methods, (7) case 
studies and (8) setting up an error reduction program in 
the plant. 

14.38.2 Approaches to human error 

The Guidelines distinguish four basic perspectives on 
human error, which they term: (1) the traditional safety 
engineering approach, which treats the problem as one of 
human behaviour and seeks improvement by attempting to 
modify that behaviour; (2) the human factors engineering 
and ergonomics (HF/E) approach, which regards human 
error as arising from the work situation which it therefore 
seeks to improve; (3) the cognitive engineering approach, 
which again accords primacy to the work situation, but 
places its main emphasis on the cognitive aspects; and 
(4) the socio-technical systems approach, which treats 
human error as conditioned by social and management 
factors. Until quite recently, it has been the HF/E approach 
which has made the running. In the last decade, however, 
the last two approaches, cognitive engineering and socio- 
technical systems, have emerged strongly. 

The stance of the Guidelines is one of system-induced 
error. This is akin to the work situation approach but 
enhanced to encompass the cognitive and socio-technical 
approaches. 

14.38.3 Performance influencing factors 

The factors shaping human performance are referred to in 
the Guidelines as PIFs. They give a PIF classification 
structure and a detailed commentary on each factor. 

14.38.4 Methods of predicting and reducing human error 

The Guidelines deal with methods for predicting and redu¬ 
cing human error in terms of (1) data acquisition techni¬ 
ques, (2) task analysis, (3) human error analysis and 
(4) ergonomics checklists. 

They describe a number of methods of task analysis, 
grouped into action-oriented techniques and cognitive 
techniques. The former include HTA and operation action 
event trees (OAETs). The two representatives of the latter 
are the critical action and decision evaluation technique 
(CADET) and the influence modelling and assessment 
system (IMAS). A critical review is given of each method. 

Human error analysis is represented by PHEA and work 
analysis. The PHEA method is that utilized in the Guide¬ 
lines’ methodology for HRA. 

14.38.5 Methods of predicting HEP for risk assessment 

The Guidelines describe a methodology for HRA, as part of 
quantitative risk assessment, utilizing both qualitative and 
quantitative methods for predicting human error. They 
begin with an illustrative example of fault tree analysis in 
which the prime contributors are human error events. 

The HRA methodology presented in the Guidelines is 
that already described in Section 14.31 and outlined in 
Figure 14.34. A detailed commentary is given on each of the 
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stages involved. The core of the method is the four stages of 

(1) critical human interaction identification and screening, 

(2) qualitative prediction of human error, (3) representation 
of event development and (4) quantification of significant 
human errors. 

It is a feature of this HR A methodology that it directs the 
analyst to acquire understanding of the system and its 
problems by critical human interaction identification and 
to undertake a detailed qualitative analysis to further 
enhance this understanding before embarking on the use of 
the quantitative methods. It is this rather than the intro¬ 
duction of any new quantitative technique which is its most 
distinctive characteristic of the method. 

14.38.6 Methods for data collection and incident analysis 

The Guidelines review the collection of data on human error. 
The treatment given is outlined in Section 14.34. 

The Guidelines give a number of methods of incident 
analysis. They are (1) the causal tree/variation diagram, 
(2) the management oversight and risk tree (MORT), (3) the 
sequentially timed events plotting procedure (STEP), 
(4) root cause coding, (5) the human performance investi¬ 
gation process (HPIP) and (6) change analysis. They also 
refer to the CCPS Incident Investigation Guidelines, where 
most of these techniques are described. A relatively 
detailed account is given of HPIP by Paradies, Unger and 
Ramey-Smith (1991); HPIP is a hybrid technique combin¬ 
ing several of those just mentioned. The CCPS treatment of 
incident investigation both in these Guidelines and in the 
Incident Investigation Guidelines is described Chapter 27. 

14.38.7 Case studies 

A feature of the Human Error Prevention Guidelines is the 
number of case histories given. The section on case studies 
gives five such studies: (1) incident analysis of a hydro¬ 
carbon leak from a pipe (Piper Alpha); (2) incident investi¬ 
gation of mischarging of solvent in a batch plant; (3) design 
of standard operating procedures for the task in Case 
Study 2; (4) design of VDUs for a computer controlled plant; 
and (5) audit of offshore emergency blowdown operations. 
Other case studies occur throughout the text. One illus¬ 
trates system induced error. Other scene-setting case stu¬ 
dies cover (1) errors occurring during plant changes and 
stressful situations, (2) inadequate human-machine inter¬ 
face design, (3) failures due to false assumptions, (4) poor 
operating procedures, (4) routine violations, (5) ineffective 
organization of work, (6) failure explicitly to allocate 
responsibility and (7) organizational failures. There are 
case studies illustrating the application of models of 
human error such as the step ladder and sequential models. 

The importance of human error in QR A is illustrated by 
the case study, already mentioned, dealing with the pre¬ 
valence of human error in fault trees. Other case studies 
illustrate HTA, SPEAR,THERP and SLIM. 

14.38.8 Error reduction programmes 

The Guidelines provide guidance on the implementation of 
an error reduction programme in a process plant. A neces¬ 
sary precondition for such a programme is a management 
culture that provides the background and support for such 
initiatives. The general approach is essentially that given 
in the CCPS Process Safety Management Guidelines descri¬ 
bed in Chapter 6. 

Since both safety-related and quality-related errors tend 
to have the same cause, an error reduction programme may 


well run in parallel with the quality programme. An error 
reduction programme should address both existing sys¬ 
tems and system design. The tools for such a programme 
given in the Human Error Prevention Guidelines include 
(1) critical task identification, (2) task analysis, (3) PIE 
analysis and (4) error analysis, as described in Sections 
14.38.3 and 14.38.4. System design should also address 
allocation of function. Error reduction strategies for these 
two cases are presented in the Guidelines. 

14.39 Human Factors at Sizewell B 

14.39.1 Sizewell B Inquiry 

The potential contribution of human factors to the design 
and operation of nuclear power stations was urged in evi¬ 
dence to the Sizewell B Inquiry by the Ergonomics Society, 
as described by Whitfield (1994). 

The Society saw this contribution as being in the areas 
of: (1) setting operational goals; (2) allocation of function 
between humans, hardware and software; (3) definition of 
operator tasks; (4) job design; (5) overall performance 
assessment and monitoring of operational experience; 

(6) operator-plant interface and workplace conditions; 

(7) pperator support documentation; (8) selection and 
training of operating staff; (9) human reliability assess¬ 
ment; and (10) construction and quality assurance. The 
Nuclear Installations Inspectorate also laid emphasis on 
human factors aspects (HSE, 1983e). 

The report of the Inquiry Inspector (Layfield, 1987) 
states: ‘I regard human factors as of outstanding sig¬ 
nificance in assessing the safety of Sizewell B since they 
impinge on all stages from design to manufacture, con¬ 
struction, operation and maintenance.’ (paragraph 25.90). 
It recommended the involvement of the discipline. 

The plan put forward by the Central Electricity Gen¬ 
erating Board in support iof its licence application included 
commitments to an extensive schedule of training and to 
the use of probabilistic safety assessment, including 
quantification of human error. 

14.39.2 Human factors studies 

A review of the applicability of ergonomics at Sizewell B 
was undertaken by Singleton (1986), who identified appli¬ 
cations in control room design, use of VDU displays, docu¬ 
mentation, fault diagnosis, maintenance and task analysis. 
He stated: ‘We know that human operators can achieve 
superb performance if they are given the right conditions. 
Appropriate conditions in this context can be listed within 
the four categories: the information presentations, the 
training, the support systems and the working conditions 
and environment’. 

An overview of the application of human factors at Size- 
well B has been given by Whitfield (1994). 

Human factors specialists are involved in extensive work 
on training, supported by task analysis, as described 
below. In the main control room one feature is the use of a 
plant overview panel, separate from the other displays, for 
the monitoring of safety critical parameters. Another area 
of involvement is in operating instructions. Use is made of 
‘event-based’ instructions to diagnose a fault and to initiate 
recovery. But in addition, for safety critical functions, there 
are ‘function-based’ procedures, which assist in restoring 
the plant to a safe condition if for some reason the event- 
based instructions are inappropriate. Further details are 
given by McIntyre (1992). 
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HRA within the PSA utilizes OAETs and the HEART 
method, with some use of THERP. An account is given by 
Whitworth (1987). The application of task analysis at Size- 
well B is described by Ainsworth (1994). The programme 
for this comprised five stages: 

(1) preliminary task analysis of critical tasks; 

(2) task analysis of selected safety critical tasks; 

(3) preliminary talk-through/walk-through evaluations 
of procedures in a control room mock-up; 

(4) validation of procedures on a control room simulator; 

(5) task analysis of tasks outside the main control room. 

One crucial task on which task analysis was performed was 
the cooling down and depressurization of the reactor. This 
was a major study involving some 60 task elements and 
taking some 44 person-weeks. Time line analysis was used 
to address issues such as manning. 

A review of procedures revealed a number of defects. 
Besides obvious typographical errors, they included: 

(1) incorrect instrument numbering (in procedures); 

(2) incorrect instrument labelling (on panels and in proce¬ 
dures); (3) omission of important clarifiers such as ‘all’,‘or’, 
‘either’ and ‘if available’; (4) omission of important cautions 
and warnings; (5) requirements for additional information; 
and (6) lack of consistency between procedures, panels 
and VDU displays. Overall, the task analyses identified 
a number of mismatches between task requirements and 
man-machine interfaces. 

Ainsworth makes the point that the ergonomists were 
often better at identifying problems than in devising 
solutions, those which they proposed often being imprac¬ 
tical, but that it is possible to achieve a mode of working 
in which these problems are communicated to the desig¬ 
ners who take them on board and come up with effective 
solutions. 

14.40 Notation 

Section 14.3 

H(s) operator transfer function 

K gain 


T d reaction time (s) 

ti compensatory lag time constant (s) 

t l lead time constant (s) 

t n neuromuscular lag time constant (s) 

Section 14.27 

Subsection 14.27.4 

k constant 

.Pb basic human error probability 

P c conditional human error probability 

Subsection 14.27.11 

n number of alarms in group 

Pi probability of failure to initiate action in response 
to *th alarm 

P r probability of failure to initiate action in response 
to a randomly selected 

Section 14.28 

a, b constants 

HEP human error probability 

n number of performance shaping factors 

r relevancy factor 

SLI Success Likelihood Index 

w quality weighting 

Section 14.30 

/ error factor 

k\, k 2 constants 

m median 

q quality 

r„ normalized rank 

x Success Likelihood Index 

t mean response time 

t r adjusted median response time 

Section 14.32 

K,-K 5 parameters 
q probability of error 
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The three major hazards - fire, explosion and toxic 
release - usually involve the emission of material from 
containment followed by vaporization and dispersion of the 
material. The treatment given here is relevant to all three 
hazards; in particular, the development of the emission and 
dispersion phases is relevant to such situations as: 

(1) Escape of flammable material, mixing of the material 
with air, formation of a flammable cloud, drifting of 
the cloud and finding of a source of ignition, leading to 
(a) a fire and/or (b) a vapour cloud explosion, affecting 
the site and possibly populated areas. 

(2) Escape of toxic material, formation of a toxic gas cloud 
and drifting of the cloud, affecting the site and pos¬ 
sibly populated areas. 

15.1 Emission 

There is a wide range of circumstances which can give rise 
to emission. The situation which appears to be most fre¬ 
quently discussed is a failure of plant integrity, but it is 
important to consider other occurrences, including escape 
from valves which have been deliberately opened and 
forced venting in emergencies. Thus on a low pressure 
refrigerated liquefied petroleum gas (LPG) installation, for 
example, a large quantity of flammable vapour may be 
released by failure of a pressure vessel or of pipework. But 
loss of refrigeration with resultant forced venting could 
also give a large release of vapour. Finally, emissions 
caused by terrorist acts are of growing concern. 

In view of the many different situations which can give rise 
to emission, it is peculiarly difficult to obtain meaningful 
estimates of the quantity and duration of emissions. The 
emission stage is therefore subject to great uncertainty It is 
nevertheless very important, because the way in which emis¬ 
sion occurs can greatly influence the nature and effect of the 
release, and particularly of any vapour cloud which is formed. 

Emission flows may be determined by the basic relations 
of fluid mechanics. Fundamentals of fluid flow are treated 
in such texts as Hydraulics (Lewitt, 1952), Thermodynamics 
Applied to Heat Engines (Lewitt, 1953), The Dynamics and 
Thermodynamics of Compressible Flow (Shapiro, 1953-), 
Chemical Engineering (Coulson and Richardson, 1955-, 
1977-), Machanics of Fluids (Massey, 1968-) and Chemical 
Engineers Handbook (Perry and Green, 1984). Selected 
references on emission are given in Table 15.1. 


Table 15.1 Selected references on emission 


Cremer and Warner (1978); HSE (1978b, 1981a); Rosak and 
Skarka (1980); McQuaid and Roberts (1982); O’Shea (1982); 
Pikaar (1985); Ramskffl (1986 SRD R352) 

Liquid, gas and vapour flow 

Stanton and Pannell (1914); Lacey (1922/23); Lea (1930); 
Lapple (1943); Streeter (1951-); Lewitt (1952,1953); Shapiro 
(1953-); Coulson and Richardson (1955—, 1977-); Bulkley 
(1967); Grote (1967); Massey (1968-);Tate (1970); Simpson 
(1971); VJ. Clancey (1974a); Loeb (1975); Levenspiel (1977); 
HSE (1978a, 1981a); Pham (1979); Nowak and Joye (1981); 
Gyori (1985); Lipowicz (1985); Belore and Buist (1986); 
Pirumov and Roslyakov (1986); Leung and Epstein (1988); 
J.L. Woodward and Mudan (1991) 

Coefficient of discharge 

Perry (1949); Arnberg (1962); S.D. Morris (1990a) 


Friction factor 

Colebrook and White (1937); LF. Moody (1944); Colebrook 
(1939); Churchill (1973,1977,1980); Jain (1976); N.H. Chen 
(1979-); Serghides (1984) 

Slow leaks 

D.H. Jackson (1948); Mencher (1967); 

Pilborough (1971,1989) 

Vessel drainage times 

Loiacono (1978); T.C. Foster (1981); Schwartzhoff and 
Sommerfeld (1988); Sommmerfeld (1990); J.L. Woodward 
and Mudan (1991); Papas and Sommerfeld (1991); Crowl 
(1992b); Hart and Sommerfeld (1993); Sommerfeld and 
Stallybrass (1993); K.S. Lee and Sommerfeld (1994) 

Bund overflow 

Michels, Richardson and Sharifl (1988); Phelps and 
Jureidni (1992) 

Pipelines 

Cronje, Bishnoi and Svrcek (1980);T.B. Morrow (1982a,c); 
Fayed and Olten (1983); Oranje (1983); Lagiere, Miniscloux 
and Roux (1984); Battarra et al. (1985); Cawkwell and 
Charles (1985); Maddox and Safti (1985); Schweikert 
(1986); Picard and Bishnoi (1988,1989); Clerehugh (1991); 
Olorunmaiye and Imide (1993) 

Two-phase flow (see Table 15.2) 

Vessel venting, blowdown 

Zuber and Findlay (1965); DNV (1983 83-1317); Fauske, 
Grolmes and Henry (1983); Swift (1984); Grolmes and 
Epstein (1985); Fauske (1988a); Evanger et al. (1989); 

Haque etal. (1990); Haque, Richardson and Saville (1992); 
Haque et al. (1992); S.M. Richardson and Saville (1992) 

Pressure relief valves 

F.J. Moody (1966); Richter (1978b); Sallett (1978,1979a,b, 
1990a-c); Lyons (1979); Sale (1979a,b); Sallet,Weske and 
Giihler (1979); L. Thompson and Buxton (1979a,b); Z. Chen, 
Govind and Weisman (1983); Heller (1983); Rommel and 
Traiforos (1983); Cloutier (1985); Forrest (1985); Sallett and 
Somers (1985); Moodie and Jagger (1987); Wilday (1987); 
Morley (1989a,b) 

Bursting discs 

Huff and Shaw (1992) 

Vessel rupture 

Artingstall (1972); Hardee and Lee (1974,1975); Hess, 
Hoffman and Stoeckel (1974); J.D. Reed (1974); Lonsdale 
(1975); Maurer etal. (1977); HSE (1978b); Bongers, ten Brink 
and Rulkens (1980); R. A. Cox and Comer (1980); Leiber 
(1980); A.F. Roberts (1982); Drivas, Sabnis and Teuscher 
(1983); Friedel (1986,1987a); CEC (1990 EUR 12602 EN); 
Nolan etal. (1990); Schmidli, Bannerjee and Yadigaroglu 
(1990); J.L.Woodward (1990); Nolan, Hardy and Pettitt 
(1991); Bettis and Jagger (1992); Pettit etal. (1992) 

Pipeline rupture 

Inkofer (1969); Westbrook (1974); R.P. Bell (1978); HSE 
(1978d); D.J. Wilson (1979b, 1981b); Morrow (1982a,c); 
Morrow, Bass and Lock (1982); Grolmes, Leung and Fauske 
(1983); Tarn (1989); Tarn and Higgins (1990); J.R. Chen, 
Richardson and Saville (1992) 

Fugitive emissions (see Table 15.70) 
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15.1.1 Emission situations 

Emission situations may be classified as follows: 

(1) Fluid 

(a) gas/vapour, 

(b) liquid, 

(c) vapour-liquid mixture; 

(2) Plant 

(a) vessel, 

(b) other equipment, 

(c) pipework; 

(3) Aperture 

(a) complete rupture, 

(b) limited aperture; 

(4) Enclosure 

(a) in building, 

(b) in open air; 

(5) Height 

(a) below ground level, 

(b) at ground level, 

(c) above ground level; 

(6) Fluid momentum 

(a) low momentum, 

(b) high momentum. 

Some typical emission situations are shown in 
Figure 15.1. 

The fluid released may be gas, vapour, liquid or a two- 
phase vapour-liquid mixture, as shown in Figure 15.1(a). 
If the escape is from a container holding liquid under pres¬ 
sure, it will normally be liquid if the aperture is below the 
liquid level and vapour or vapour-liquid mixture if it is 
above the liquid level. For a given pressure difference the 
mass of release is usually much greater for a liquid or 
vapour-liquid mixture than for a gas or vapour. 

The plant on which the release occurs may be a vessel, 
other equipment such as a heat exchanger or a pump, or 
pipework, as shown in Figure 15.1(b). The maximum 
amount which can escape depends on the inventory of the 
container and on the isolation arrangements. 

The aperture through which the release occurs may 
range from a large fraction of the envelope of the container 
in the case of complete rupture of a vessel to a limited 
aperture such as a hole, as shown in Figure 15.1(c). 
An aperture on a vessel may be (1) a sharp-edged orifice, 
(2) conventional pipe branch, (3) a rounded nozzle branch, 
or (4) a crack. The flow through a rounded nozzle is greater 
than through a conventional pipe branch, but it is the latter 
which is generally used. Other apertures on vessels, 
equipment and pipework include: (5) drain and sample 
points; (6) pressure relief devices - (a) pressure relief 
valves, (b) bursting discs, and (c) liquid relief valves; 

(7) seals; (8) flanges and (9) pipe ends. 

The relief may take place from plant in a building or in 
the open air, as shown in Figure 15.1(d). This greatly affects 
the dispersion of the material. A large proportion of 
escapes to the open air are dispersed without incident. 

The height at which the release occurs also has a strong 
influence on the dispersion, as shown in Figure 15.1(e). 
A liquid escape from plant below ground level may be 
completely contained. An escape of gas or vapour from 
above ground level may be dispersed over a considerable 
distance. 

Dispersion is further affected by the momentum of the 
escaping fluid, as shown in Figure 15.1(f). Low and high 


momentum releases of gas or vapour form a plume and a 
turbulent momentum jet, respectively. Low and high 
momentum releases of liquid form a liquid stream and a 
high ‘throw’ liquid jet, respectively, both of which then 
form a liquid pool. 

A generalized chart for the calculation of the discharge 
of liquids and gases under pressure has been given by Pilz 
and van Herck (1976) and is reproduced in Figure 15.2. 


15.1.2 Elementary relations 

For flow of a single fluid 

W = Qp [15.1.1] 

Q = uA p 5.1.2] 

G = W/A Jl 5.1.3] 

G = up [15.1.4a] 

G = u/v [15.1.4b] 

where A is the cross-sectional area of the pipe, G is the 
mass flow per unit area, Q is the total volumetric flow, u is 
the velocity, v is the specific volume of fluid, W the total 
mass flow, and p is the density of the fluid. 

The general differential form of the energy balance for 
the flow of unit mass of fluid is 

-dq + dW s + AH + d + g dz = 0 115.1.5] 

where g is the acceleration due to gravity, H is the enthalpy, 
q is the heat absorbed from the surroundings, is the work 
done on the surroundings (shaft work), and z is the height. 

It is often convenient to eliminate H from Equation 15.1.5 
using the relation: 

dff(= TdS+vdP) = dq + dF+vdP :|15.1.6] 

where F is the mechanical energy irreversibly converted to 
heat (frictional loss) and P is the absolute pressure. 

Then, combining Equations 15.1.5 and 15.1.6 gives 

dkF s + wdP + dF + d^“j + £dz = 0 (15X7]' 

For the discharge processes considered here, the work done 
on the surroundings W s is zero. Then Equation 15.1.7 
becomes: 

vdP + dF + df~j +£dz = 0 [15.1.8a] 

or, alternatively, 

vdP + dF + udu+gdz = d [15.1.8b] 

In some applications the friction loss and potential energy 
terms may be neglected, in which case Equation 15.1.8b 
reduces to: 

v dP + u du = 0 


[15.1.9] 
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Figure 15.1 Some emission situations 
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Figure 15.2 Mass flow vs pressure difference for flow of gases, vapours and liquids through an orifice 
(Pitz and van Herck, 1976; reproduced by permission) 


Equation 15.1.8b may also be expressed in the form of a 
pressure drop relation: 


The pressure drop dP/dl may also be expressed in terms of 
its constituent elements: 


d P ldF 
dl + vdl 




dP ldF udu gdz_ 
61 + vdl + vdl + vdl ~ 


dP _ dPf dP a dP g 
[15.1.l°a] & - d/ dl dl 


[15.1.13] 


where dPf/dl is the frictional pressure change, dPJdl is the 
accelerational pressure change and dPJdl is the gravita¬ 
tional pressure change. 

[15.1.10b] For flow in pipes, the friction term dFis: 


[15.1.10c] 


dF = 44>^u 2 
QJ .d/« 2 


[15.1.14a] 

[15.1.14b] 


where l is the distance along the pipe. 

A relation for pressure drop may also be obtained from 
the momentum balance: 


- n - + -rR o + G- ir + pg- n = 0 


[15.1.11] 


where R 0 is the shear stress at the pipe wall and S is the 
perimeter of pipe. The term dz/dl in Equations 15.1.10 and 
15.1.11 is often replaced by the term sin 0, where 0 is the 
angle between pipe and horizontal. 

Comparing Equations 15.1.10b and 15.1.11, which each 
give the pressure drop, it follows that: 


where d is the diameter of the pipe, R is the shear stress at 
the pipe wall and <j> is the friction factor. 

The most commonly used friction factor / is twice the 
friction factor rj>: 


Hence from Equations 15.1.14b and 15.1.16 


[ 15 . 1 . 12 ] 


[ 15 . 1 . 17 ] 
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Another form of the pressure drop equation which is 
derived from Equation 15.1.10b together with Equations 
15.1.14 and 15.1.17 is: 



The equations just given are in differential form. In order to 
obtain relations useful in engineering, they need to be 
integrated. Integrating the energy balance Equation 15.1.8a 

£ vdP + F+gAz + &(^ m$ [15.1.19] 

where limit 1 is the initial state and limit 2 is the final state. 

Integration of the first term in Equation 15.1.19 requires a 
relation between pressure P and specific volume v. Three 
principal relations are those for incompressible, isothermal 
and isentropicflow: 

n~ Constant Incompressible flow [15.1.20a] 

Pv = Constant Isothermal flow [15.1.20b] 

Py = Constant Isentropic flow [15.1.20c] 


where y is the ratio of the gas specific heats. Also, for an 
adiabatic expansion: 

Pi/ = Constant Adiabatic flow [15.1.20d] 

where k is the expansion index. 

Then it can be shown that for these flow regimes: 


v dP = v(Pz - Pi) Incompressible flow [15.1.21a] 

= P\V\ In Isothermal flow [15.1.21b] 

7 [ /PA 1 

= -—-Pitq Ip-1 —1 Isentropic flow 

[15.1.21c] 


15.1.3 Liquid or incompressible fluid discharge 

For the flow of a liquid, or incompressible fluid, the term 
jf (1 Ip) dP is given by Equation 15.1.21a. Substituting this 
term in Equation 15.1.19 gives 

- p {Pi-P2)+ g{z i - Z2) = A + F [15.1.24] 

When flow is on a horizontal axis, the left-hand side sim¬ 
plifies to (Pi — P2)/p.When flow is not on a horizontal axis, 
variation in elevation can be incorporated in subsequent 
equations by replacing P with P +pgz where z is based on a 
common reference height. The first term on the right hand 
side of Equation 15.1.24, p (u 2 / 2), represents the increase in 
kinetic energy of (final) state 2 from (initial) state 1. Many 
authors include a coefficient on the kinetic energy term 
correcting for non-uniform velocity distributions 


'kinetic energy 1 _ f u 3 da _ /w 2N 
k mass of fluid J 2f uda a \ 2, 


[15.1.25] 


where integration is over the cross-sectional area of the 
flow and u is defined by Equation 15.1.2. For laminar flow in 
pipes, p = 2, and McCabe, Smith and Harriott (1956-) state 
that p is about 1.05 for fully developed turbulent flow in 
pipes. 

For the flow of liquid through a pipe, the frictional loss F 
is given by 

P = F C +F f +F ft [15.1.26] 

where F is the total frictional loss, F c is the frictional loss 
due to sudden contraction, F t is the frictional loss due to 
the pipe (or skin friction), and F ft is the frictional loss due 
to fittings. In this expression, expansion losses have been 
ignored, but expressions for the expansion loss can be 
found in standard texts. Expansion losses cannot exceed 
the kinetic energy of the fluid and do not apply at the point 
of discharge to the atmosphere. 

McCabe, Smith and Harriott (1956-) give the friction 
loss from contraction as 


k r (p \ i 

k^l PlVl [ _1 J Adiabatic flow F c = 0.4^1 -^ ^ 


IttlJld] 

It is frequently convenient to work in terms of the head h 
rather than the pressure Pof the fluid. The relation between 
the two is: 

P = hpg [15.1.22] 

It is generally necessary to define the flow regime. The 
principal criterion of similarity is the Reynolds number Re 


where u is the velocity in the (smaller) pipe with cross- 
sectional area A 2 . The frictional loss due to the pipe is: 



The friction coefficient/is described in Section 15.1.5. The 
friction loss from pipe fittings is usually expressed as a 
number of velocity heads: 


Re = y [15.1.23] 

where d. is the diameter of the orifice or pipe, and p is the 
viscosity of the fluid. 

The discharge of liquids and of gases and vapours is now 
considered. 


Fft = K it (^j [15.1.28] 

where K tt is the friction coefficient for pipe fittings 
(expressed as the number of velocity heads) and is dis¬ 
cussed in Section 15.1.5. 
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All of the frictional losses can be expressed in terms of 
the number if velocity heads. For flow from a vessel through 
a pipe of a single diameter, the total number K of velocity 
heads lost, excluding any exit, is 


K = K c Kf + Ktt JI5.1.30] 

where K c is the number of velocity heads lost at the con¬ 
traction (pipe entrance), K f is the number of velocity heads 
lost due to skin friction and K it is the number of velocity 
heads lost due to fittings. Comparing with Equation 15.1.27, 
Ac is 


[15 ' L31] 

and K t is 


Kf = ^ [15.1.32] 

15.1.4 Liquid discharge rates 

Equation 15.1.24 can be used to predict the discharge rate 
from a vessel at (stagnation) pressure P\(+pgz) to ambient 
pressure Pz(+pgz). As discussed above, the frictional loss 
due to a sudden pipe expansion does not apply at pipe 
openings to the atmosphere. This section discusses liquid 
discharge rates through an orifice, an external mouthpiece, 
and a constant diameter pipe system. 

For discharge through an orifice or nozzle, changes in 
elevation are negligible, and frictional losses are much less 
than the flow kinetic energy. Based on vessel (stagnation) 
pressure Pi, Equation 15.1.24 shows that the velocity of a 
liquid through an orifice with a cross-sectional area A, 
which is small relative to that of the vessel, is 

ro l’/2 

«=C D -(P!-P 2 ) [15.1.33] 

or, in terms of the mass rate W, 

W = Q)A[2p(Pi - P 2 )f 2 [15.1.34] 

where Cp is the coefficient of discharge. 

For orifice flow, the coefficient of discharge Cd is the ratio 
of the actual to the theoretical discharge. This actual dis¬ 
charge is the product of the actual cross-sectional area of 
the jet and the actual velocity of the jet. Then defining a 
coefficient of contraction C c as the ratio of the actual to the 
theoretical area, and a coefficient of velocity C, (= 1/p in 
Equation 15.1.25) as the correction factor for non-uniform 
velocity profile at the actual cross-sectional area of the 
jet gives 

C D = C c Q, [15.1.35] 

The coefficient of contraction C c is defined as 
Q = A c /A 0 [15.1.36] 

where A„ is the cross-sectional area of the orifice and A c is the 
cross-sectional area of the vena contracta. For a sharp-edged 
orifice in the side of a vessel there are available theoretical 


expressions for the coefficient of contraction. Thus for 
two-dimensional sharp-edged orifice for liquid 


Q = -^—= 0.61 [15.1.37] 

and for gas 


Q = 


* + 2 (p 2 /p : ) 


[15.1.38] 


where the subscripts 1 and 2 refer to stagnation and outlet 
conditions, respectively. 

An average experimental value of C c for sharp-edged 
orifices for liquids is 0.64. The difference between the 
actual and theoretical velocities for a sharp-edged orifice 
for liquid is very small. An average experimental value of Q, 
for sharp-edged orifices for liquids is 0.97. Thus for a sharp- 
edged orifice for liquids an average experimental value of 
the coefficient of discharge C D is 0.62 (=0.97 x 0.64). 

Studies on the coefficient of discharge from sharp-edged 
orifices for water have been described by Lea (1930). The 
coefficient of discharge for sharp-edged orifices for gases 
has been studied by Perry (1949). He found that the coeffi¬ 
cient of discharge is a function of the ratio of the outlet to 
the stagnation pressure, or pressure ratio, as shown in 
Figure 15.4. The limiting values of the coefficient are 0.6 and 
0.84 at high and low pressure ratios, respectively. Similar 
results have been obtained for short pipe outlets by Arnberg 
(1962). Values of the coefficient of discharge used in hazard 
assessment work range between 0.6 and 1.0. Avalue of 0.6 is 
frequently used for orifices. Coefficients of discharge are 
treated in more detail in standard texts (e.g. Lewitt, 1952; 
Coulson and Richardson, 1977-). 

Another common discharge situation is that of an exter¬ 
nal mouthpiece on the side of a vessel, such as a short nozzle 
or pipe stub, as shown in Figure 15.3. 

For short pipe stubs with Z/d at least about 10, the fric¬ 
tional loss can be approximated as that of a flow contraction 
per Equation 15.1.27 or 15.1.31. Based on vessel (stagnation) 
pressure Pi, Equation 15.1.24 shows that the liquid velocity 
through an opening with cross-sectional area A which is 
small relative to that of the vessel is 


^/pXPf-Pz)] 


1/2 


[15.1.39] 


In a similar fashion to Equations 15.1.33 and 15.1.34, 
the discharge rate can be calculated using an effective 



Figure 15.3 External mouthpiece 
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Figure 15.4 Coefficient of discharge for gas flow through an orifice (after J.A. Perry, 1949) (Courtesy of the 
American Society of Mechanical Engineers) 


discharge coefficient, and using the number of velocity 
heads lost, the effective discharge coefficient is 


C D = 


(I +- R,) 1 “ ' 


[15.1.40] 


Using Equation 15.1.31 and considering discharge from 
small opening in a large vessel, 


(1 


[15.1.41] 


An average experimental value of the coefficient of 
discharge is 0.81 that applies to mouthpieces for which the 
length/diameter ratio of the pipe is not less than 3. A value 
of 0.8 is frequently used for short nozzles and pipe stubs. 

Similarly for constant diameter pipe systems, an effec¬ 
tive coefficient of discharge C can be defined as 


C = 




[15.1.42] 


where K is given by Equation 15.1.30. 


(1944) and are given in standard texts (e.g. Coulson and 
Richardson, 1977-, Perry and Green, 1984). 

It is also desirable to have equations for the friction factor, 
and a number of these are available. Some of the equations 
are implicit, others explicit. Some are more convenient for 
use if the flow is known, others if the pressure drop is known. 

The friction factor depends on the flow regime, the three 
regimes being those of laminar, transitional and turbulent 
flow. In the laminar regime the friction factor may be 
obtained from the Poiseuille equation and may be written as: 

0 = A [15.1.45] 

In the other regimes the friction factor is, in general, a 
function of the Reynolds number Re and of the roughness 
ratio eld., where e is the pipe roughness. 

A correlation of the friction factor for these regimes has 
been given by Colebrook (1939) as follows: 

' ,5146 ! 


15.1.5 Friction, friction factor and fittings loss 

The friction loss in a pipe is given by Equation 15.1.27, 
where the friction factor / is obtained from Equations 
15.1.15 and 15.1.16. The relationship between the friction 
factors 9 and/is given by Equation 15.1.16. 

Relationships between the principal friction factors used 
are given by Churchill (1977). The friction factor/as defined 
above is identical to the Fanning friction factor / F so that 
/f = 2cj> [15.1.43] 

Another friction factor is the Darcy friction factor / D . This 
is related to the other friction factors as follows: 


He: 


; that Equation 15.1.46 reduces for smooth pipes to 


[15.1.47] 


and for rough pipes to 

i=21og 10 ^ [15.1.48] 


/ D = 8(p [15.1.44a] 

ft 4/ [15.1.44b] 

= 4/ f [15.1.44c] 


Colebrook also gives as an alternative to Equation 15.1.47 
which avoids the implicit formulation by means of the 
following approximate equation: 


Graphs of the friction factor are available based primarily Tj/g — 1-8 logio(Re/7) [15.1.49] 

on the work of Stanton and Panned (1914) and of L.F. Moody ' d 
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Coulson and Richardson (1977-) state that the transition 
regime occurs at 2000 < Re < 3000 and give the following 
equations for the turbulent regime. 

Smooth pipes: 


0 = 0.0396/Re 0 ' 25 2.5xl0 3 <Re<10 5 

[15.1.50] 

0-°* & 2.5 In (Re 0 a5 ) + 0.3 10 5 < Re < 10 7 

[15.1.51] 

Rough pipes: 


0-°- 5 = -2.5 In [0.27 e/d + 0.885/(Re 0” a5 )] 

[15.1.52] 

0-°- 5 = 3.2 - 2.5 In {e/d) {e/d )Re 0 a6 > 3.3 

[15.1.53] 

Equation 15.1.50 is the Blasius equation. 



Churchill (1977) has given an explicit equation for the 
friction factor 0 for all three regimes as follows: 


0 [(Re) 


15.1.6 Critical flow 

For compressible fluids, including gases and two-phase 
mixtures, it is necessary to consider critical flow. If, for such 
a fluid, the upstream pressure is high relative to the down¬ 
stream pressure, the flow is choked. The flow is then no 
longer a function of the pressure difference but is a function 
of the upstream pressure alone and has a maximum or 
critical value. This is the condition of critical or choked flow. 
For a gas this flow is then sonic and the condition is also 
referred to as sonic flow. 

The measure of approach to sonic conditions is the Mach 
number Ma which is 

Ma = - [15.1.58] 

where c is the velocity of sound. For sonic flow the Mach 
number is unity and the velocity u of the fluid equals the 
velocity of sound c. The velocity of sound in a gas of absolute 
pressure P and specific volume v is given by the relation 

c={kPvf' 2 [15.1.59] 

where k is the expansion index. Hence under critical 
conditions 




u={kP lV i) 1/2 


[15.1.60] 


A = [2.457 Inf- ^15.1.55] 

L \(7/Re)°‘ 9 + 0.27e/ d) \ 

B = (37530/Re) 16 [15.1.56] 

where A and B are constants. Elsewhere, Churchill (1980) 
states that the transition regime occurs at 1800 < Re < 4000. 

Another explicit equation for the friction factor for all 
three regimes, expressed this time in terms of the Darcy 
friction factor, is that of N.H. Chen (1979): 


1.8257 id) 


The relative merits of the equations for the friction 
factor are considered in the discussion on the work of 
N.H. Chen (1980). 

Tabulations are available for the pressure drop across the 
various types of pipe fitting such as elbows, tees, valves, 
etc. A prime source is Flow of Fluids through Valves, Fittings 
and Pipe (Crane Company, 1986), which gives the loss in 
terms of the number of velocity heads. Tables are given in 
standard texts (e.g. Perry and Green, 1984) and appear 
mostly to be based on the data given in the various editions 
of the Crane Company publication. 

An alternative formulation of fittings loss is in terms 
of number of pipe diameters. A table giving for selected 
fittings both the number of velocity heads and the number 
of pipe diameters is given by Coulson and Richardson 
(1977-). For many of the entries in this table the 
number of pipe diameters equivalent to one velocity head is 
about 50. 


where subscript 1 indicates upstream (stagnation) condi¬ 
tions. A pressure ratio»/ may be defined 

n = J [15.1.61] 

Then it can be shown that the critical pressure ratio r/ c is 


[15.1.62] 


Equation 15.1.62 is often used to determine the down¬ 
stream, or choke, pressure under critical conditions. 

For a given upstream pressure, the flow is zero both when 
ri = 0 and when r\ = 1. At some intermediate value of t), and 
P, the flow passes through a maximum, which occurs when 


[15.1.63a] 


~ = 0 [15.1.63b] 

Differentiating Equation 15.1.4b with respect to P and 
applying Equation 15.1.63a gives for the critical flow G c 



Then from Equations 15.1.64 and 15.1.9 


6 ®- 


dP 

dv 


[15.1.64] 


[15.1.65] 


Critical flow is discussed further in the following sections. 
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15.1.7 Gas and vapour discharge 

For the flow of a gas, or compressible fluid, through an ori¬ 
fice it is necessary to define the type of fluid and the type of 
expansion. For an ideal gas 


Py=- 


M 


[15.1.67] 


where M is the molecular weight, R is the universal gas 
constant, T is the absolute temperature, and Z is the com¬ 
pressibility factor. 

The flow of an ideal gas may be calculated using 
Equation 15.1.21 with a suitable expression for jf v dF The 
flow of a non-ideal gas may be obtained from Equation 
15.1.5 using enthalpy values from thermodynamic tables. 

The expansions which take place in discharge situations 
are normally throttling expansion or free expansion. 
Throttling expansion occurs when gas issues through 
a very narrow aperture or crack. There is high frictional 
resistance and low kinetic energy. When applied to vapour, 
the process is sometimes called ‘wire-drawing’. 

The frictional resistance of a fluid passing through a pipe 
varies inversely with the fifth power of the pipe diameter. 
Similarly, as an aperture becomes larger a situation is 
quickly reached where there is free expansion. The frictional 
resistance is low and the kinetic energy is high. In the pre¬ 
sent context it is free expansion which is of prime interest 
and which is considered in the treatment given below. 

The free expansion of an ideal gas is usually treated as 
an approximately adiabatic expansion with some degree of 
irreversibility. The entropy change dS for the expansion is 


dS: 


d q dF 


[15.1. 


If the expansion is adiabatic d q = 0, and if it is reversible 
dF = 0. If the expansion is reversible adiabatic dS = 0. 
The free expansion of an ideal gas is usually treated by 
the use of the Equation 15.1.21d. 

If the expansion process is reversible and adiabatic or 
intermediate between adiabatic and isothermal, Equation 
15.1.21d is applicable. If the expansion is not reversible, it 
may not be possible to give a continuous function for the 
relation between pressure and volume, but Equation 
15.1.21d is often applied over a limited range of conditions. 
If the expansion is isentropic, then the index k is equal 
to the ratio of specific heats y. If the expansion is not 
isentropic, then k is less than y. 

If the absolute upstream pressure Pi is only slightly 
greater than the absolute downstream pressure P 2 , in other 
words for low values of the pressure ratio Pi/P 2 , it may be 
adequate to assume an isothermal expansion according 
to Equation 15.1.20b. For isothermal flow of an ideal gas 
(Pv = PiVj 


J vAP = PiViJ Jd P 

Pi 


[15.1.69a] 

[15.1.69b] 


Then, assuming flow on a horizontal axis (A? = 0) and 
using a coefficient of discharge Cd to take account of the 
friction term F in Equation 15.1.19, it can be shown from 
Equations 15.1.4a, 15.1.19 and 15.1.76b that for the flow of an 
ideal gas through an orifice with a cross-sectional area A 
which is small relative to that of the vessel 



For adiabatic flow of an ideal gas (Pif = PiVi), 



[15.1.72a] 


[15.1.72b] 

= I ^ l (P2V2-Pm) 

[15.1.72c] 

Following the same approach, it can be shown from 
Equations 15.1.4,15.1.19 and 15.1.72b that for the adiabatic 
flow case 

-g{t'raHri 

v /2 

\ [15.1.73] 


Introducing the pressure ratio r\ from Equation 15.1.61 in 
Equation 15.1.73 gives 

G=Cd {T'*-i [r,2/k - ,?( * +i)/ * ] T [is ' L74] 

If the ratio of the upstream pressure P\ to that downstream 
P 2 is sufficiently high, the flow is choked, or sonic. Under 
these conditions Equation 15.1.62 applies. Then, taking 
friction into account the maximum discharge G c under 
these conditions is 




[15.1.75] 


Equation 15.1.75 shows that, under sonic conditions, the 
flow depends on the upstream pressure Pi, but is inde¬ 
pendent of the downstream pressure P 2 . 

Equations 15.1.73 and 15.1.75, for subsonic and sonic flow 
of gas, respectively, are those normally required here for 
the calculation of high pressure gas discharges both from 
vents and pressure relief valves and from ruptures. 

Equation 15.1.20d and the expressions based on it should 
be used only within the range of their validity. The equation 
is based on a modification of the equations for isentropic 
expansion of an ideal gas, in which the index k is equal to the 
ratio of specific heats y. The index k is used instead of y to 
take account of a degree of non-ideal behaviour. The value of 
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k is obtained from thermodynamic charts by fitting 
Equation 15.1.20d to the appropriate constant entropy line. 
In addition, the index k is also used to take into account a 
degree of friction energy loss in expansion. In this case 
the value of k is determined empirically for the system 
concerned. The use of Equation 15.1.20d is not suitable for 
gases at very high pressures. These require separate treat¬ 
ment, as discussed in standard texts (e.g. Shapiro, 1953-; 
Massey, 1968—). 

The use of Equation 15.1.20d is less appropriate for 
vapour which becomes wet when expanded. This case may 
be treated by the direct use of Equation 15.1.5. The work 
done on the surroundings is zero, and neglecting potential 
energy changes (dz = 0) along with heat transfer to the 
fluid, for finite changes, Equation 15.1.5 becomes 

A1? + a(^)= 0 [15.1.76] 

Hence for negligible upstream velocity, 

G = p 2 [2(H 1 -H 2 )] 1/2 [15.1.77] 

In order to solve Equation 15.1.77 it is necessary to deter¬ 
mine the mass fraction constituted by the vapour phase, or 
quality, x. This can be obtained from the assumption of 
isentropic expansion which from the entropy balance gives 

Si = S2 [15.1.78a] 

S 1 = S v2 x + S tl (l-x) [15.1.78b] 


15.1.8 Temperature effects 

For an adiabatic expansion the absolute temperature after 
expansion T 2 is 



For sonic flow the pressure ratio P2/P1 is given by 
Equation 15.1.62. Hence for this case 


T2 

f| 


[15.1.81] 


15.1.9 Vessel discharge: gas flow through pipe 

It is sometimes necessary to calculate the flow of high 
pressure gas from a vessel. The pressure in the vessel 
decreases as the mass of gas decreases. Equation 15.1.82, 
for sonic flow, can be used until the upstream pressure falls 
to the value at which flow becomes subsonic, at which point 
Equation 15.1.80 is used. An illustrative example is given 
by Coulson and Richardson (1977—, vol. 1, p. 110). 

Another problem that may occur is the flow of gas from a 
vessel through a pipe, as shown in Figure 15.5. In this case, 
the calculation involves simultaneous solution of the 
equations for flow through the aperture at the entrance to 
the pipe and through the pipe itself. 

Charts to facilitate the calculation have been constructed 
by Lapple (1943) and are widely used. It has been pointed 
out by Levenspiel (1977), however, that this work is in error 
due to the assumption that sonic flow can be isothermal. 
Corrected charts given by Levenspiel are reproduced in 
Figure 15.6. The parameters used in the charts are the 
pressures shown in Figure 15.5 and 


where subscripts 1 and v refer to the liquid and the vapour, 
respectively. The enthalpy after expansion H 2 is then 
given by: 

H 2 = H v2 x + 7/12(1 - x) [15.1.79] 

The effect of friction may be taken into account by applying 
to the enthalpy change (Hi - H 2 ) an efficiency factor. 
Efficiencies of orifices and nozzles are discussed in stand¬ 
ard texts (e.g. Lewitt, 1953). 

If the vapour flow is sonic, as determined by Equations 
15.1.61 and 15.1.62, then, as for a gas, the flow is independ¬ 
ent of the downstream pressure. In this case, the pressure 
P 2 for the calculation of the terminal conditions of the 
fluid is that obtained from Equation 15.1.61 with r] = r\ c . 
An illustrative example is given by Lewitt (1953, p. 275). 

Avapour undergoing sudden expansion tends, however, 
to be supersaturated with less than the equilibrium quan¬ 
tity of condensed liquid droplets. It is frequently assumed 
that such a vapour does in fact follow a path given by 
Equation 15.1.20d. 

A calculation which is sometimes required is the flow of 
vapour from a liquid vaporizing adiabatically in a vessel. 
The pressure in the vessel decreases as the temperature of 
the liquid falls due to the removal of the latent heat of 
vaporization. 

Further discussions of methods of calculating the 
expansion of gases and vapours are given in the High 
Pressure Safety Code (E.G. Cox and Saville, 1975) and by 
Lapple (1943). 


d = diameter of pipe (m) 

/ F = Fanning friction factor 
G = mass velocity of gas (kg/m 2 s) 

G* = critical mass velocity of gas through an adiabatic 
nozzle (kg/m 2 s) 

k = expansion index (= ratio of gas specific heats) 

L = length of pipe (m) 

N = pipe resistance factor (= (4 f F L)/d) 

P = absolute pressure (N/m 2 ) 

Figure 15.6(a) is useful for finding the length of pipe for a 
given flow rate and Figure 15.6(b) for finding the flow rate 
for a given length of pipe. Note that the pipe resistance 
factor does not include entrance loss effects. Also, this 
method relies on the pipe having a uniform diameter. 
Changes in pipe diameter may result in multiple shocks in 
the discharge pipe. 



Rounded Surroundings pj 


Figure 15.5 Vessel with connected discharge pipe 
(Levenspiel, 1977) (Courtesy of the American Institute of 
Chemical Engineers) 
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Pipe resistance N 
(6) 


Figure 15.6 Charts for calculation of adiabatic flow of gas from a vessel to atmosphere (Levenspiel, 1977): 
(a) chart useful for finding the allowable length of pipe for a given flow rate; (b) chart useful for finding the flow 
rate for a given length of pipe (Courtesy of the American Institute of Chemical Engineers) 


Expressions exist for the calculation of the fraction 
of fluid left in a vessel after a given discharge time. 
Such relations are given in the Rijnmond Report and by 
Mecklenburgh (1985). 

15.1.10 Vessel discharge: liquid discharge time 

It is convenient to have expressions for the time taken for 
a vessel containing liquid to discharge its contents. Treat¬ 
ments of liquid discharge times for vessels have been given 
in the Rijnmond Report and by Lewitt (1952), T.C. Foster 
(1981), Mecklenburgh (1985), Loiacono (1987), Sommerfeld 
and co-workers (Schwartzhoff and Sommerfeld, 1988; 
Sommerfeld, 1990; Papas and Sommerfeld, 1991; Hart and 
Sommerfeld, 1993; Sommerfeld and Stallybrass, 1993; 
K.S. Lee and Sommerfeld, 1994), Crowl and Louvar (2002), 
J.L. Woodward and Mudan (1991) and Crowl (1992b). 

In the most elementary case, the vessel is of simple geo¬ 
metry and the outflow is through a hole at the bottom and is 
due solely to the head of liquid. Complexity is introduced 
by the following features: (1) pressure above the liquid in 


the vessel, (2) hole at an arbitrary height in the liquid space 
and (3) outflow through a pipe rather than an orifice. 

The basic relations for liquid outflow, taking account of 
the pressure on the liquid surface and for a hole of arbitrary 

-A^ = Q [15.1.82] 

Q = C D A o {2\g(h-h 0 )+AP/p} 

where A is the cross-sectional area of the vessel at height h 
(m 2 ), A„ is the cross-sectional area of the orifice (m 2 ), C D is 
the coefficient of discharge, g is the acceleration due to 
gravity (m/s 2 ), h is the height of the liquid above the bottom 
of the vessel (m), h 0 is the height of the orifice above the 
bottom of the vessel (m), Q is the outflow through the orifice 
(m 3 /s), A P is the pressure difference between the liquid 
surface and atmosphere, or gauge pressure (Pa), t is the 
time (s) and p is the density of the liquid (kg/m 3 ). 
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Rearranging and integrating Equations 15.1.82 and 
15.1.83 gives the general relation for the time for discharge, 
or efflux time fe (s), as: 

4 =-^ t - — -172 d h [15.1.84] 

C 0 A 0 (2f 2 k \g(h-h 0 )+AP/p] 1/2 

for liquid with initial height above the bottom of the vessel 
hi (m). The solution of this equation requires the specifica¬ 
tion of the terms A(h) and A Pip. The function A =f(h) 
depends on the geometry of the vessel; specific cases are 
given below. 

As for the term AP/p, this is zero for the case where there 
is no imposed pressure on the liquid surface. The other 
simple case is where the pressure is maintained constant, 
as with an inert gas padding system, so that the term 
may be expressed as A P/p = ghp, where h p is an equivalent 
liquid head (m). 

Some expressions for the vessel cross-sectional area 
A(h) are: 

A = -D 2 vertical cylindrical vessel [15.1.85] 

A = 2 L(hD — h 2 ) 1/2 horizontal cylindrical 

vessel (flat ends) [15.1.86] 

A = ^C 2 spherical vessel [15.1.87] 




And for the case where the hole is at the bottom of the 
vessel (h a = 0) 


--imr 


[15.1.93] 


Horizontal cylindrical vessel, no imposed pressure 
The alternative case of a horizontal cylindrical vessel has 
been treated by Sommerfeld and Stallybrass (1993), who 
consider the case of a vessel with flat ends and no imposed 
pressure. Then from Equations 15.1.84 and 15.1.86 


few 


2 l r* 

OoAo(2g) 1/2 h 


[(£> - h)h] l/2 

{k-hf* 


d h 


[15.1.94] 


The authors obtain an analytical solution, albeit a some¬ 
what complex one. 


Spherical vessel, no imposed pressure 
The case of a spherical vessel with no imposed pressure has 
been described by Hart and Sommerfeld (1993). For this 
case, from Equations 15.1.94 and 15.1.87 

4 + lODk, - 3 h 2 - 4hih 0 

15CdA 0 (^) 1/2V 

-8/z 2 )(4-4,) 1/2 [15.1.95] 


C = 2(hD-h 2 ) 1/2 [15.1.88] 

A = nf? tan 2 0 vertical conical vessel, tip down 

[15.1.89] 


where L is the length of the vessel (m) and 9 is the half-angle 
of the vessel tip(°). 

It may sometimes be helpful to derive the cross-sectional 
area from the volume using the relation 



For the case where the hole is at the bottom of the vessel 
(h 0 = 0): 


[15.1.96] 


Vessels with other geometries 

K.S. Lee and Sommerfeld (1993) have obtained analytical 
solutions for vessels with a number of other geometries 
with no imposed pressure. These are conical, paraboloid 
and ellipsoid vessels, both with the tapering end at the 
bottom and with it at the top. 


where V is the volume of the vessel (m 3 ). A number of spe¬ 
cific cases are now considered. 


Vertical cylindrical vessel, finite imposed pressure 
Crowl and Louvar (2002) have treated the case of a vertical 
cylindrical vessel with a finite imposed pressure on the 
liquid surface. For this case, Equation 15.1.84 yields 




where A is given by Equation 15.1.85. For the case where 
there is no imposed pressure AP = 0: 

te= -^{£) mhi - ho)]1/2 [i5 - L92] 


Vessel drainage times and flows 

Expressions have just been given for vessel drainage time. 
The average drainage flow is then obtained as the initial 
volume of liquid in the vessel divided by the drainage 
time. Expression of the drainage relations in dimensionless 
form allows some more general conclusions to be drawn. 
K.S. Lee and Sommerfeld (1993) define a dimensionless 
drainage time t as the ratio of the time to drain the vessel with 
the liquid at the actual height h and the hole at the actual 
height h 0 to the time to drain a full vessel with the hole at the 
bottom (h a = 0). They also define a dimensionless hole 
height x as the ratio of the hole height h 0 to the vessel diameter 
Dor height H. 

They show that for certain vessel geometries the varia¬ 
tion of the dimensionless drainage time t with the dimen¬ 
sionless hole height x is such that it passes through a 
maximum. The geometries where this occurs are those 
where the cross-sectional area of the vessel A(h) decreases 
as the height h a decreases. They give a tabulation of values 
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of the maximum dimensionless drainage time T max , which 
includes the following: 


Vessel geometry 

Dimensionless 
drainage time 
maximum , 

Corresponding 
dimensionless 
height of hole, 

Vertical cylindrical 

None 

- 

Horizontal cylinidrical 

1.161 

0.17 

Spherical 

1.299 

0.25 

Cone, tip down 

1.776 

0.683 

Paraboloid, tip down 

1.414 

0.50 

Vertical ellipsod 

1.299 

0.25 

Horizontal ellipsoid 

1.299 

0.25 


The sphere may be considered a special case of the ellipsoid. 

The authors state that in no case does the maximum 
dimensionless drainage time attain a value of 2. 

Vessels with pipe attached 

Treatments for the case where the outflow is through a 
pipe attached to the vessel are given by Loiacono (1987), 
Sommerfeld (1990), Papas and Sommerfeld (1991) and 
Sommerfeld and Stallybrass (1992). 

15.1.11 Model systems 

There are available a number of model systems for deter¬ 
mining the emission of fluid from vessels. These include 
those of the two Convey Reports and the Rijnmond 
Report and of the Committee for the Prevention of Disasters 
(CPD), (1992a), Solberg and Skramstad (1982), Considine 
and Grint (1985), Mecklenburgh (1985) and Napier and 
Roopchand (1986). There are also the model systems asso¬ 
ciated with computer codes for hazard assessment such as 
WHAZAN and SAFETI. 

15.2 Two-phase Flow 

In some cases the fluid is neither a pure gas (or vapour) nor 
a pure liquid, but is a vapour-liquid mixture, and it is then 
necessary to use a correlation for two-phase flow. 

The behaviour of fluids in two-phase flow is complex and 
by no means understood. Of the large literature on the topic 
mention may be made of the accounts in One Dimensional 
Two-Phase Flow (Wallis, 1969), Two-Phase Flow and Pleat 
Transfer (Butterworth and Hewitt, 1977), in Two-Phase 
Flow in Pipelines and Heat Exchangers (Chisholm, 1983) 
and Emergency Relief Systems for Runaway Reactions and 
Storage Vessels: A Summary of Multiphase Flow Methods 
(AIChE, 1992/149) and of the work of Benjaminsen and 
Miller (1941), Burnell (1947), Lockhart and Martinelli 
(1949), Pasqua (1953), Schweppe and Foust (1953), 0. Baker 
(1954, 1958), Isbin, Moy and da Cruz (1957), Zaloudek 
(1961), Fauske (1962,1963,1964), Isbin etal. (1962), Fauske 
and Min (1963), Dukler, Wicks and Cleveland (1964), 
Levy (1965), F.J. Moody (1965), Baroczy (1966), Chisholm 
and Watson (1966), Chisholm and Sutherland (1969-70), 

R. E. Henry and Fauske (1971), M.R.O, Jones and Underwood 
(1983,1984), van den Akker, Snoey and Spoelstra (1983), 
Nyren and Winter (1983), B. Fletcher (1984a,b), B. Fletcher 
and Johnson (1984), Leung (1986a, 1990a,b, 1992a) and 

S. D. Morris (1988a, b, 1990a,b). 

Work on two-phase flow, particularly in pipelines, has 
been carried out by the American Institute of Chemical 


Engineers (AIChE) Design Institute for Multiphase 
Processing (DIMP). An important distinction in two-phase 
flow is that between one-component systems, such as 
steam and water, and two-component systems, such as air 
and water. It is the former which is of prime concern here 
and, unless otherwise stated, it is to these systems that 
the account given here refers. Two situations which are of 
particular interest in the present context are the escape of a 
superheated, flashing liquid and the venting of a chemical 
reactor. Selected references on two-phase flow are given in 
Table 15.2. 


Table 15.2 Selected references on two-phase flow 


ASME (Appendix 28 Applied Mechanics, 1984/53,183); 
NRC (Appendix 28 Two-Phase Flow); Schiller (1933); 
Benjaminsen and Miller (1941); Burnell (1947); Lockhart 
and Martinelli (1949); W.F. Allen (1952-); Pasqua (1953); 
Schweppe and Foust (1953); O. Baker (1954,1958); Lottes 
and Flynn (1956); Brigham, Holstein and Huntington 
(1957); Isbin, Moy and da Cruz (1957); Chisholm and Laird 
(1958); Hesson and Peck (1958); Fauske (1961,1962,1963, 
1964,1983,1985a, b, 1986a-c, 1987a,b, 1988a); Zaloudek 
(1961); R. Brown and York (1962); Friedrich and Vetter 
(1962); Isbin etal. (1962); Fauske and Min (1963); D.S. Scott 
(1963); Dukler,Wicks and Cleveland (1964); Starkman etal. 
(1964); R.J. Anderson and Russell (1965—); Lacey (1965); 
Levy (1965); F.J. Moody (1965); Baroczy (1966); Chisholm 
and Watson (1966); Gouse (1966); Min, Fauske and Petrick 
(1966); Romig, Rothfus and Kermode (1966); Uchida and 
Nariai (1966); Cruver and Moulton (1967); Paige (1967); 
Collier and Wallis (1968); R.E. Henry (1968,1970); Hubbard 
and Dukler (1968); Ogasawara (1969); Simpson 
(1968,1991); Chisholm and Sutherland (1969-70); Schicht 
(1969); Wallis (1969,1980); Degance and Atherton (1970); 
R.E. Henry, Fauske and McComas (1970); Flinta, Gernborg 
and Adesson (1971); Greskovich and Shrier (1971); 

R.E. Henry and Fauske (1971); Klingebiel and Moulton 
(1971); Collier (1972); Beggs and Brill (1973); Choe and 
Weisman (1974);TW. Russell etal. (1974); Cude (1975); 
Dukler and Hubbard (1975); Ishii (1975); Sozzi and 
Sutherland (1975); Isii, Chawla and Zuber (1976); 
Kopalinsky and Bryant (1976); Taitel and Dukler (1976); 
Ardron, Baum and Lee (1977); Butterworth and Hewitt 
(1977); Kevorkov, Lutovinov and Tikhonenko (1977); 
Ardron (1978); Wallis and Richter (1978); Fauske, Grolmes 
et al. (1980); Rassokhin, Kuzevanov and Tsiklauri (1980); 
Azbel (1981); Bergles, Collier and Delhaye (1981); 

Bergles and Ishigai (1981); Blackwell (1981); Chisholm 
(1981,1983); B. Fletcher (1982,1984a, b); Hewitt (1982); 

IBC (1982/31,1984/55); Landis (1982); S. Levy Inc. (1982); 
Sabnis, Simmons and Teuscher (1982); Fernandes, 

Semiat and Dukler (1983); Azzopardi and Gibbons 
(1983); van den Akker, Snoey and Spoelstra (1983); 
El-Emam and Mansour (1983); Friedel and Purps 
(1983,1984a,b); Grolmes and Leung (1983,1984); 
Hutcherson, Henry and Wollersheim (1983); M.R.O. Jones 
and Underwood (1983,1984); R. King (1983); Nyren and 
Winter (1983,1987); Veziroglu (1983); AGA (1984/43,1989/ 
66); van den Akker (1984); Botterill, Williams and 
Woodhead (1984); Duiser (1984); Dukler and Taitel (1984); 
B. Fletcher and Johnson (1984); S.D. Morris and White 
(1984); Nicholson, Aziz and Gregory (1978); Soliman (1984); 
Berryman and Daniels (1985); Grolmes and Epstein (1985); 







EMISSION AND DISPERSION 15/15 


Huff (1985,1990); D.A. Lewis and Davidson (1985); Olujic 
(1985); D.A. Carter (1986 LPB 70,1988); Friedel (1986,1987a, 
1988); S.C. Lee and Bankoff (1986); Leung (1986a, 1990a,b, 
1992a); Orell and Rembrand (1986); Yamashiro, Espiell and 
Farina (1986); Bettis, Nolan and Moodie (1987); Cindric, 
Gandhi and Williams (1987); Leung and Grolmes (1987— 
1988); Ewan, Moodie and Harper (1988); Hardekopf and 
Mewes (1988); S.D. Morris (1988a,b, 1990a,b); First and 
Huff (1989b); Leung and Fisher (1989); Nyren (1989); 
Eggers and Green (1990); Hague and Pepe (1990); Haque 
etal. (1990,1992); Leung and Epstein (1990a,b, 1991); 

D.S. Nielsen (1991); Nolan, Pettit and Hardy (1991); 
Sumipathala,Venart and Steward (1990a,b); J.L.Woodward 
(1990,1993); Haque, Richardson and Saville (1992); Lantzy 
(1992); Giot (1994); Khajehnajafi and Shinde (1994); 
Seynhaefve et al. (1994); Holland and Bragg (1995) 

Control valves: Ziegler (1957); Hanssen (1961); Sheldon 
and Schuder (1965); Romig, Rothfus and Kermode (1966) 

Pressure relief valves 

Tangren, Dodge and Seifert (1949); Richter (1978); 

Sallet (1978,1979a,b, 1984,1990a-c); Sallet,Weske and 
Guhler (1979); Simpson, Rooney and Grattan (1979); 
Fauske etal. (1980); O.J. Cox and Wierick (1981); Zahorsky 
(1983); J.W. Campbell and Medes (1985); Fauske (1985b, 
1990); Forrest (1985); Sallet and Somers (1985); 

DnV (1982 RP C202); Friedel and Kissner (1987,1988); 
Banerjee (1988); Friedel (1988); Morris (1988a,b, 1990a,b); 
M. Epstein, Fauske and Hauser (1989); Friedel and 
Molter (1989); Morley (1989a,b); Alimonti, Fritte 
and Giot (1990); API (1990 API RP 520); Bilicki and 
Kestin (1990); Curtelin (1991); M.R. Davis (1991); 
Lemonnier et al. (1991); Selmer-Olsen (1991,1992); 

Simpson (1991); Leung (1992a); Wehmeier,Westphal and 
Friedel (1994) ISO 4126:1991 

Computer codes: Nylund (1983 DnV Rep 83-1317,1984); 
Middleton and Lloyd (1984); Bayliss (1987); Klein (1987); 
Evanger etal. (1990); Haque, Richardson and 
Saville (1992); Haque et al. (1992) 

Benchmark study: Skouloudis (1992) 

Reactor venting (see also Table 17.13) 

DIERS: Klein (1987); Wilday (1987); Fauske (1988a, 1989a); 
Leung and Fisher (1989) 

Liquid swell: Grolmes (1983); Grolmes and Fauske (1983); 
Friedel and Purps (1984a,b) 

Storage vessel venting 

Fauske, Epstein etal. (1986) 

Leaks through cracks 

Pana (1976); Amos etal. (1983); Abdollahian etal. (1984); 
Collier (1984); John et al. (1986); Refer et al. (1986); 

Friedel (1987b); Friedel and Westphal (1987,1988,1989) 


15.2.1 Experimental studies 

Much work on two-phase flow has been done on two- 
component systems, for example, air and water, but for the 
two cases mentioned the more relevant work is that on one- 
component systems, for example, steam and water. The 
bulk of the experimental work has been done on small 
pipes, often 25 mm diameter or less, but more recent work 
has been done on pipes of larger diameter. Details of some 
of the experimental work are given in Table 15.3. 


15.2.2 Two-phase flow phenomena 

Some characteristic features of, and problems in, two-phase 
flow are: 

(1) flow pattern; 

(2) phase equilibrium; 

(3) phase velocity; 

(4) critical flow; 

(5) friction factor. 

There are a variety of flow patterns in two-phase flow, 
the pattern depending on the mass flow and on the mass 
fraction of vapour, or quality, and also on whether the pipe 
is horizontal or vertical. The flow patterns are considered in 
the next section. 

For very short flow outlets, there may be insufficient 
time for relaxation to occur and equilibrium between the 
liquid and vapour phase to be established. In this case it is 
necessary to make some assumption about the degree of 
equilibrium attained. One limiting assumption is that of 
frozen flow in which there is no interchange between the 
phases. The alternative limiting assumption is that equili¬ 
brium is attained. 

Another principal feature is the relative velocity between 
the two phases. One limiting assumption is that of zero slip 
in which the relative velocity of the two phases is the same. 

Critical flow occurs in two-phase flow but it is a much 
more complex phenomenon than in gas flow, and it tends 
not to be well defined. The essential feature, however, is 
that, as in gas flow, the flow is independent of the down¬ 
stream pressure. 

For flow in long pipes, it becomes necessary to take 
friction into account. Pressure drop due to friction is 
characterized in two-phase as in single-phase flow by a 
friction factor, but again this is somewhat more complex 
than in single-phase flow. 

The types of two-phase flow calculation which are of 
interest here are primarily releases from plant and venting of 
reactors and vessels. An assumption which is conservative for 
one of these cases is not necessarily conservative for the other. 

15.2.3 Two-phase flow patterns 

There are a number of different flow patterns in two-phase 
flow. Among the numerous descriptions are those by 
O. Baker (1954, 1958), D.S. Scott (1963), Schicht (1969), 
Choe and Weisman (1974), Butterworth and Hewitt (1977), 
Chisholm (1983), and Cindric, Gandhi and Williams (1987). 

The flow patterns for horizontal two-phase flow in 
pipelines were identified and correlated by O. Baker (1954, 
1958). Figure 15.7, after Coulson and Richardson (1977-), 
shows a set of flow patterns denoted in accordance with 
Baker’s terminology. 

Figure 15.8 shows the correlation of flow patterns given by 
Baker in terms of the gas and liquid mass velocities G and L 
and the parameters X and i/>, where the latter are defined as 



where p is the viscosity, p is the density, a is the surface 
tension, and the subscripts a, g, 1, and w denote air, gas, 
liquid and water, respectively. 
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Table 15.3 Some experimental studies on two-phaseflow a 

Investigator(s) 

System fluitP 

Geometry 

W Schiller (1933) 



Benjaminsen and Miller (1941) 

Single component 

Orifices 

Burnell (1947) 

Single component 

Orifices, nozzles, pipes 

Lockhart and Martinelli (1949) 

Two components 

Horizontal pipes 

Pasqua (1953) 

Single conponent 


Schweppe and Foust (1953) 

Single components 

Vertical tubes 

Brigham, Holstein and Huntington (1957) 

Two components 

Inclined pipes 

Isbin, Moy and da Cruz (1957); Isbin etal. (1962) 

Single component 


Chisholm and Laird (1958) 

Two components 

Horizontal pipes 

Zaloudek (1961) 

Single component 

Pipes 

Fauske (1962,1963,1964) 

Single component 

Horizonal pipes 

Friedrich and Vetter (1962) 

Single component 

Nozzles, short tubes 

Baroczy (1966) 

Single and two 



component systems 


Chisholm and Watson (1966) 

Single component 

Orifices 

Uchida and Nariai (1966) 

Single component 

Orifices, nozzles, pipes 

Finta, Gernborg and Andesson (1971) 

Single component 

Horizontal pipes 

Beggs and Brill (1973) 

Two components 

Inclined pipes 

Sozzi and Sutherland (1975) 

Single conponent 

Horizontal pipes 

Kevorkov, Lutovinov and Tikhonenko (1977) 

Single component 

Horizontal pipes 

Sallet (1979b); Sallet,Weske and G'hler (1979); 

Single component 

Safety valve 

Sallet and Sommers (1985) 



van den Akker, Snoey and Spoelstra (1983) 

Single component 

Vertical then horizontal section 

Fermandes, Semiat and Dukler (1983) 

Two components 

Vertical tubes 

Hutcherson, Henry and Wollersheim (1983) 

Single component 

Horizonal pipes 

Nyren and Winter (1983) 

Single component 

Horizonal pipes 

B. Fletcher (1984a,b); B. Fletcher and Johnson (1984) 

Single component 

Horizonal pipes 

M.R.O. Jones and Underwood (1984) 

Single component 

Nozzles, short tubes 

D. A. Lewis and Davidson (1985) 

Single component 

Orifices, nozzles 

Friedel (1988) 

Two components 

Bursting disc, safety valve 


a See also work of Fauske and coworkers (Section 15.3) and work on relaxation length (Tablel5.4), on pressure relief valves (Section 15.6), on vessel 
blowdown (Section 15.7) and in the DIERS project (Chapter 17). 

b Single-component systems are those with a single saturated or superheated liquid, typically water. Two-component systems are those with a 
gas and a liquid, typically air and water. 


The Baker curves have been widely used to correlate the 
flow patterns in two-phase flow. A set of equations for the 
Baker curves has been given by Yamashiro, Espiell and 
Farina (1986). 

The flow patterns for horizontal two -phase flow given by 
Butterworth and Hewitt are similar except that they omit 
dispersed flow. Figure 15.9 shows the flow patterns for 
vertical two-phase flow and Figure 15.10 a flow pattern map 
given by Butterworth and Hewitt. 

There is a considerable variation in the terminology 
used for the flow patterns in two-phase flow. A summary 
of the terminology and a classification has been given by 
Chisholm (1983). 

A simplified classification scheme for horizontal two- 
phase flow has been proposed by Choe and Weisman (1974), 
following earlier work by Hubbard and Dukler (1968). They 
identify four flow patterns, which correlate as follows with 
massvelocityGand with massfractionof vapour, orqualityx. 


Flow pattern 

Mass velocity, G (kg/m 2 s) 

Quality, x 

Homogeneous 

G > 2700 

0-1.0 

Intermittent 

94 < G < 2700 

0-0.8 

Annular 

94 < G < 2700 

>0.8 (±0.1) 

Separated 

G<94 

0-1.0 


In terms of the relations given by Chisholm between the 
usual terms and those of Choe and Weisman, homogeneous 
flow corresponds to bubble flow, intermittent flow to plug 
and slug flow and separated flow to stratified flow; annular 
flow is the same in both cases. 

Olujic (1985) has given a classification of flow patterns in 
horizontal two-phase flow based on a distinction between 
high and low quality. He defines parameters a and /!: 



where u is the velocity. In the /? regime, the velocity of the 
two phases is approximately equal, while in the a regime 
that of the gas is much higher. The /? regime corresponds to 
bubble and slug flows, and the a regime to wavy, slug and 
annular flows. The author gives a map of the two regimes, 
plotting 1//? vs the Froude number Fr. 

Cindric, Gandhi and Williams (1987) discuss the work of 
DIMP and present flow pattern maps, one for horizontal 
and one for vertical two-phase flow. The former is a plot 
of certain flow parameters vs the Martinelli parameter 
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(described below), and the latter a plot of superficial liquid 
velocity vs superficial gas velocity. 


distinguishes essentially three types of model for critical 
two-phase flow: 


15.2.4 Modelling of two-phase flow 

Two-phase flow is a complex phenomenon and has given 
rise to a large number of models. Of particular interest 
here are models for critical two-phase flow. A review of 
such models has been given by Wallis (1980). Wallis 



LJggSg 

£E§i3 



Figure 15.7 Flow patterns in two-phase flow: horizontal 
flow (Coulson and Richardson, 1977-) (Courtesy of 
Pergamon Press) 


(1) homogeneous equilibrium model; 

(2) models incorporating limiting assumptions 

(a) frozen flow models, 

(b) slip flow models, 

(c) isentropic stream tube models; 

(3) equilibrium models, 

(a) empirical models, 

(b) physically based models for thermal equilibrium, 

(c) two fluid models. 

The homogeneous equilibrium model (HEM) is based on 
the two limiting assumptions: that the flow is homo¬ 
geneous, that is, there is no slip between the two phases; 
and that the flow is in equilibrium, that is, there is effec¬ 
tively perfect transfer between the two phases. 

This is a well-established and widely used model; it is 
used in a number of computer codes. Wallis states that the 
model gives reasonably good predictions for the mass 
velocity under conditions where the pipe is long enough for 
equilibrium to be established and the flow pattern is such 
as to suppress relative motion. For short pipes where there 
is insufficient relaxation time the flow can be in error by a 
factor of about 5. For longer pipes with a flow pattern which 
allows large relative velocity, such as annular flow, the error 
factor tends to be somewhat less than 2. 

The homogeneous equilibrium model is based on limiting 
assumptions. The second group of models are based on 
alternative limiting assumptions. The limiting assumption 
made in the frozen flow model is that there is no transfer 
between phases so that flow is effectively frozen and quality 
remains constant. This assumption is most nearly met if 
the outlet is short. While no interphase transfer is the key 
assumption in this model it may be combined with other 
assumptions such as those of no slip or isentropic expansion. 



Figure 15.8 Regimes in two-phase flow; the Baker diagram (O. Baker, 1954) (Courtesy of the Oil and Gas Journal) 
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Chum Annular Wispy-annular 

flow flow flow 


Figure 15.9 Flow patterns in two-phase flow: vertical flow (Butterworth and Hewitt, 1977) (Courtesy of Oxford 
University Press) 



(Courtesy of Oxford University Press) 


The limiting assumption made in the slip equilibrium 
model is that there is equilibrium between the phases, 
which is the opposite of the previous case. Two principal 
slip equilibrium models are those by Fauske (1962,1963) 


and F.J. Moody (1965). These two models differ in terms of 
the way in which the exit condition is determined. In the 
Moody model, the exit conditions are determined by an 
energy balance and the maximum flow occurs at a slip ratio 
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k = {pi/pg) 1 / 3 , while in theFauske model the exit conditions 
are determined by a momentum balance and the maximum 
flow occurs at k = ( Pi/p g )^ 2 - 

The slip equilibrium models just described treat the 
velocity ratio k as a parameter to be adjusted to obtain the 
maximum flow, without indicating how this condition is 
actually achieved.Wallis and Richter (1978) have described an 

of individual stream tubes originating from the vapour- 
liquid interface, which attempts to address this point. 

The third group of models incorporate non-equilibrium 
effects. One approach used to handle such effects is the use 
of empirical correction factors. This is the basis of the 
model by RE. Henry and Fauske (1971). 

Other non-equilibrium models are based on physical 
descriptions of the processes of bubble nucleation and 
vapour generation. Wallis concludes that the development 
of such models is not such as to offer much improvement on 
the purely empirical models. 

Another type of non-equilibrium model is the two fluid, 
or separated flow, model, in which effects such as inter¬ 
phase drag are taken into account, but again Wallis con¬ 
cludes that the stage of development is not such as to make 
these models more useful than the empirical ones. 

15.2.5 Elementary relations 

For a two-phase system the following equations apply for 


continuity and other relations: 


W g =Wx 

[15.2.5] 

Wi=W(l-x) 

[15.2.6] 

G g = Ugp g 

[15.2.7] 


[15.2.8] 

q._ G(i-x) 

[15.2.9] 

j 

*13 

[15.2.10] 

pi 

[15.2.11] 

_ Gx 

g ~ ap g 

[15.2.12] 

_C( 1-x) 

1 (1 - a)Pi 

[15.2.13] 

k=^ 

U\ 

[15.2.14] 


[15.2.15] 


[15.2.16a] 


[15.2.16b] 

o if 

p €h + Q g 

[15.2.17] 

"=( ,+, n:r 

[15.2.18] 


where Q is the volumetric flow, v is the specific volume, 
W is the mass flow, p is the fraction of volume occupied 
by vapour, or void fraction, and /J is the vapour phase 
volumetric flow fraction. 

The pressure drop derived from the energy balance for 
two-phase flow, analogous to Equation 15.1.10b for single 
phase flow, is 


d P 
d* 


Ph 


d F ^d u 
d/ +G dJ + 


[15.2.19] 





[15.2.20] 


where F is the friction loss, g is the acceleration due 
to gravity, l is the distance along the pipe, P is the absolute 
pressure, z is the vertical distance, and subscript h denotes 
homogeneous flow. 

The pressure drop derived from the momentum balance 
for two-phase flow, analogous to Equation 15.1.11 for single 
phase flow, may be written as 

d PS 

l [15.2.21] 

+g[«P g + (! - «)Pi] -jj = 0 


whereA is the cross-sectional area of the pipe, R 0 is the shear 
stress at the pipe wall and S is the perimeter of the pipe. 

Comparing Equations 15.2.19 and 15.2.21, which each 
give the pressure drop, it follows that, in a manner analo¬ 
gous to the derivation of Equation 15.1.12, 


[15.2.22] 


As with Equation 15.1.19 for single-phase flow, the pressure 
drop given in Equation 15.2.19 may also be expressed 
in terms of its constituent elements, as given in Equa¬ 
tion 15.1.13. 


15.2.6 Homogeneous flow 

If the gas and liquid velocities are equal and the slip ratio 
k therefore unity, the flow is said to be homogeneous. 
The specific volume for homogeneous flow % is defined as 

[15.2.23] 

and hence 


[15.2.24] 


®=V+«r(l-4 [15.2.25] 

where v is the specific volume. 
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The density for homogeneous flow p h is defined as the But, from Equation 15.2.25. 
reciprocal of the specific volume 


Ph = V«b 


[15.2.26a] 


[15.2.36] 


[15.2.26b] Then, f r0 m Equations 15.2.30,15.2.33 and 15.2.36 


It may be noted that Equation 15.2.26b is the same as 
Equation 15.2.20. This is the reason for the use of the sym¬ 
bol p h to define the density in Equation 15.2.20. In that case, 
however, there was no implication that Equation 15.2.20 
is restricted to homogeneous flow. Also for homogeneous 



[15.2.27a] 

[15.2.27b] 

[15.2.28] 

[15.2.29] 


d P 
61 : 


61 + 


G 2 


[d% 6P 
LdP 61 


\6l 

[15.2.37a] 


cLP f /d/ + G 2 (t> g - Vl )(6x/6l) + (g/v h )(6z/6l) 
1 + G 2 (^) 


where dP f /6l is the pressure drop due to friction. 

The critical condition occurs where the pressure gradient 
becomes infinite 


1 + G 2 


d^h 

6P 


dPh 

dP 


& 


[15.2.38a] 

[15.2.38b] 


For homogeneous flow, since ph = 1/Ph, Equation 15.2.19 
may be written as 


dP 1 dP d u g 6z 
dT + Wh dT + G ¥ + Whd/ : 


[15.2.30] 


15.2.7 Non-homogeneous flow 

If the gas and liquid velocities are different, the flow is non- 
homogeneous. For non-homogeneous flow the specific 
volume of the two-phase mixture v m is not equal to the 
reciprocal of the density of the two-phase mixture p m : 

Vm £1 1 Pm [15.2.31] 

The specific volume for non-homogeneous flow is often 
defined as 


Wm=[p g « + Pi(l-oc)]- 1 [15.2.32] 

The use of this relationship for specific volume has been 
criticized by Fauske (1962). His alternative treatment is 
described in the following section. 


15.2.9 Empirical friction correlations 

The solution of the equations for pressure drop in two- 
phase flow requires a relation for the friction loss term. 
Much effort has been devoted to obtaining a correlation 
for this. Typically, the two-phase pressure drop has been 
correlated in terms of some single phase pressure drop. 
One pair of relations used for correlation is 


I 152 - 39 -! 

I 15 - 2 - 3 *] 


where dP f /d/ is the actual two-phase pressure drop, 
(dP f /dZ)g is the pressure drop which would occur if the 
gas phase were flowing alone in the pipe, (dPf/d/)i is the 
pressure drop which would occur if the liquid phase were 
flowing alone and </>| and <j>\ are friction parameters. 

Another pair of relations are 


15.2.8 Critical flow 

As an introduction to critical two-phase flow, the condition 
is derived for critical flow in homogeneous flow. The 
acceleration pressure drop term in Equation 15.1.13 may be 
written as 


dP a _ n2 6v h 
61 G d/ 
But 

Vh =f{P,x) 


[15.2.33] 


[15.2.34] 


f = I 15240 '! 

?=<(?)„ |15240bl 


where (dP f /d/) go is the pressure drop which would occur if 
the whole fluid were flowing as gas in the pipe, (dPf/d/)i 0 
is the pressure drop which would occur if the whole fluid 
were flowing as liquid <j>\ 0 and (j) ? 0 are further friction 
parameters. 

Lockhart and Martinelli (1949) introduced the parameter 


d«4 _ di>h dP d% 6x 
dT“ 6P dT + Wd7 


v2 (6Pt/6I) h 
[15-2.35] x ~ (dP f /d/)| 


[15.2.41] 
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Chisholm and Sutherland (1969-70) utilized the parameter 


_ «UV<Bi w 

(d/yd/)i Q 


[15.2.42] 


This parameter was also used by Baroczy (1966) in the form 


[I52 ' 431 

The friction factor may be expressed in a generalized form 
of the Blasius equation 

/ oc Re-” [15.2.44] 

where n is an index. Then the parameters X and T are 
related to the quality x as follows: 


[15.2.45] 


15.2.10 Lockhart-Martinelli model 

A method for determining the pressure drop in two-phase, 
two-component flow has been given by Lockhart and 
Martinelli (1949), who correlated <j> 2 and <j>f with X 2 . The 
equations of the model are Equations 15.2.39 and 15.2.41. 
The relations given by Lockhart and Martinelli between 
the parameters cp g , fa and X are shown in Figure 15.11. 

The method is to calculate the single-phase gas and 
liquid Reynolds numbers Re g and Re[ and pressure drops 
(dPf/d/) g and (dP f /d/)i, to calculate X from Equation 
15.2.41, to obtain from Figure 15.11 either 4> g or fa, depend¬ 
ing on the value of X, and then to calculate (dP f /d/) from 
Equation 15.2.39a or 15.2.39b. The curves given in Figure 
15.11 for <f> g and fa depend, as shown, on whether the gas 
and liquid flow regimes are viscous or turbulent. 

Equations for the Lockhart-Martinelli parameters, which 
may be used instead of Figure 15.11, have been given by 
Degance and Atherton (1970). Although it is one of the earlier 
two-phase flow correlations, the method of Lockhart and 
Martinelli remains one of the most widely used. 



Reynolds No. Regime 
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Re g 
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Figure 15.11 Pressure gradient in two-phase flow: the Lockhart- Martinelli correlation (after Lockhart and Martinelli, 
1949) (Courtesy of the American Institute of Chemical Engineers) 
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15.2.11 Other friction correlation methods 

Baroczy (1966) obtained a correlation in terms of 4> io, x, 
and the group which is defined as 1/r 2 in Equation 15.2.43. 
A further more economical correlation was derived by 
Chisholm and Sutherland (1969-70). The correlation 
depends on the value of n in relation 15.2.44. For the case of 
n = 0 their correlation is 


A third form of the model is that given by Starkman et al. 
(1964), as quoted by R.E. Henry and Fauske (1971). Again, 
the additional assumption of isentropic expansion is made: 


{2[fe 0 - (1 - ^ E )fe 1E - ^ e ^ 8 e ]} 1/2 

(1 - Xe)V]E + X E WgE 


[15.2.50] 


[15.2.46a] 

[15.2.46b] 


[15.2.47] 
is velocity G and 


<t>\ = l + CX+X 2 

^ ) f = 1 + J + i 

-V + *®r 

The parameter C is a function of the rr 
the parameter T. 


15.2.12 Friction factor 

The friction factor to be used in two-phase flow equations 
depends on the particular correlation. Use is often made of 
a single-phase flow friction factor, obtained from one of the 
relations given in Section 15.1. In some cases, the approach 
taken is even simpler. The friction factor recommended by 
Perry and Green (1984) for use with Equation 15.2.48 below 
is the single value of 0.003. 

15.2.13 DIMP project 

A study of non-flashing two-phase flow has been con¬ 
ducted by the Design Institute for Multi-phase Processing 
(DIMP) of the AIChE. An account of the DIMP work has 
been given by Cindric, Gandhi and Williams (1987). 

15.2.14 Homogeneous flow models 

Much of the recent development in two-phase flow which is 
of interest here relates to homogeneous equilibrium flow 
models. 

15.2.15 Homogeneous equilibrium flow model 

The homogeneous equilibrium model has been described 
by a number of workers. The minimal assumptions in 
this model are that the phase velocities are equal and that 
thermal equilibrium exists. 

From Equation 15.1.18 but substituting v b for v it is 
possible to derive for a horizontal pipe 


Gm 


'_=1_.1 

_dfh/dP + (4/bh)/2rf(dP/d/)J 


[15.2.48] 


This appears to be the form most commonly quoted (e.g. 
Perry and Green, 1984). 

For critical flow the following relation is given by Fauske 
(1962). From Equation 15.2.38b utilizing the definition of 
in Equation 15.2.25 and assuming isentropic expansion, 
the critical mass velocity G c is 

r -i i 1/2 

Gc= [^(difg/dPJ.+CPg—*>s) (dar/ dP), g +(l— x) (d»i/ dP) g J 
[15.2.49] 

where subscript s indicates constant entropy. 


where h is the specific enthalpy and subscripts c, E and o 
indicate critical, equilibrium, and stagnation conditions, 
respectively. 

15.2.16 Homogeneous frozen flow model 

The homogeneous frozen flow model has also been 
described by a number of workers. In the form given by 
R.E. Henry and Fauske (1971), the model is based on the two 
necessary assumptions for this type of model, that the 
phase velocities are equal and that there is no transfer 
between phases so that thermal equilibrium does not exist, 
but also on the assumption that the vapour expansion is 
isentropic and that the critical flow is determined by gas 
dynamic principles. The expression for the critical mass 
velocity is 

G c = i [2 x 0 v g0 P 0 4 r ' l,/5 ')] V2 [15-2.51] 

where y is the ratio of gas specific heats, ri c is the critical 
pressure ratio and subscript o indicates the stagnation 
condition. The critical pressure ratio is the ratio of the 
throat pressure to the downstream pressure, and the 
expression given for it is relatively complex. 

15.2.17 Two-phase flashing flow 

The two-phase flow which is of particular interest here is 
single-component, two-phase flashing flow. This is the 
type of flow which occurs when liquefied gas is released to 
the atmosphere, whether in a controlled manner through a 
relief device or due to an accident. A number of models have 
been developed for two-phase flashing flow, particularly 
through the work of Fauske and co-workers in the DIERS 
project, as described below. 

The type of model characteristic of this work is a homo¬ 
geneous equilibrium model for a very short pipe. The pres¬ 
ence of the pipe makes it possible to assume equilibrium 
conditions, but the pipe is sufficiently short that frictional 
effects can still be neglected. Allowance is then made for 
frictional pressure drop by the use of empirical correlations. 

The assumption of negligible pipe length leads to much 
simpler expressions for the critical flow. Initially, the length 
of pipe at which equilibrium is established was assumed to 
be defined by a length/diameter, or l/d, ratio. As described 
below, it has been shown that equilibrium is reached as a 
fixed length of some 0.1 m. 

Two models, or rather families of models, of the type 
described are those of Fauske and of Leung. These are 
described in Sections 15.3 and 15.4, respectively. 

15.2.18 Maximum critical flow 

The maximum possible flow of a two-phase fluid in a pipe 
is obtained if it is assumed that friction can be neglected 
and that the energy released by the drop in pressure is 
converted to kinetic energy. At the critical flow conditions 
dG/dP = 0 or, alternatively, dG/dr; = 0. 






EMISSION AND DISPERSION 15/23 


For a horizontal pipe Equation 15.1.77 yields vdP= udu 
(dJF s = dF = dz = 0). Noting that the velocity u = Gv, it can 
readily be shown that at the critical flow conditions (d G/ 
dP = 0) the maximum, or critical, mass velocity G c is given 
by the relation G 2 = - (dF/dv), where the pressure P and 
the specific volume v refer to the inlet conditions. 

Critical flow conditions can occur at quite a high value of 
the ratio of the downstream pressure to the upstream 
pressure, or critical pressure ratio. Avalue as high as 0.7 in 
some cases is quoted by Coulson and Richardson (1977- 
p. 95). The Leung model, described below, includes corre¬ 
lations for the critical pressure ratio. 

15.2.19 Relaxation length 

As already mentioned, it was initially believed that in 
two-phase flow the length of pipe over which equilibrium 
becomes established, or relaxation length, is a function of 
the length/diameter ratio. However, it has been shown in a 
number of studies that it is the absolute length which matters. 

Work designed specifically to elucidate this point has 
been described by B. Fletcher (1984a,b) and B. Fletcher 
and Johnson (1984). Experiments were carried out on dis¬ 
charges of Refrigerant 11 through sharp edged orifices 
and tubes in the diameter range 3.2-10.8 mm and length/ 
diameter ratio (lid) range 0.88-200. In this work it was 
found that the onset of flashing was favoured by higher 
excess pressure, and hence superheat, and by increased 
tube length. It was also found that as the tube length was 
increased the flow at first decreased rapidly but then much 
more gradually. The transition point marking the end of the 
rapid decrease in flow with length occurred at a length of 
about 75 mm. Figure 15.12 shows the jet in some of Fletcher 
and Johnson’s experiments. 

At the time when this work was done one of the most 
widely used models for two-phase flow was the empirical 
model of Fauske (1964) 

G m C d [2 Pl (P 0 - P c )] 1/2 1/d < 3 [15.2.52] 

where C d is the coefficient of discharge, P c is the absolute 
critical outlet pressure and P 0 is the absolute upstream 
pressure. 

As described below, Fletcher and Johnson are somewhat 
critical of Equation 15.2.52. The correlation preferred is 
based on the assumption that for a given length 

G cx C d P 0 1/2 [15.2.53] 

Figure 15.13 shows the results of discharge experiments 
correlated in this way. Figure 15.13(a) shows Fletcher’s own 
results for Refrigerant 11 and Figure 15.13(b) shows the 
results of other workers. Thus, in this work, relation 15.2.53 
is used for excess pressures in the range 1-102 bar. 

Fletcher points out that the transition distance of 75 mm 
found in his work corresponds in Fauske’s work to a length/ 
diameter ratio of 12, a ratio which Fauske treats as a transi¬ 
tion point. 

Fletcher discusses the point at which all liquid flow 
ceases and flashing begins. He refers to the assumption in 
the Rijnmond Report that all liquid flow can be assumed to 
exist for l/d < 2 and states that he has observed flashing at 
l/d < 1 if the excess pressure is sufficiently high. 

In presenting their own correlation, Fletcher and 
Johnson state certain criticisms of Equation 15.2.52. Two 
of these have already been discussed: the use of l/d instead 


of I as a correlator and the assumption of all liquid flow for 
lid < 2. Another is the assumption that P c = 0.55P d for all 
fluids. They refer to the use in the Second Convey Report 
of Equation 15.2.52, but point out that this applies strictly 
only to the all gas, or vapour, condition. 

Confirmation that the relaxation length is a function 
of the absolute length of pipe for large pipe diameters is 
provided by the work at Marviken by S. Levy Inc. (1982). 
The available data on relaxation length has been reviewed 
by Fauske (1984c), who quotes the data shown in Table 15.4. 
The later models of Fauske incorporate the absolute length 
method of correlation. This method is now generally 
adopted. The value of the relaxation length is taken as 0.1 m. 

15.2.20 Critical pressure ratio 

As the foregoing account indicates, a crucial parameter in 
two-phase flow is the critical pressure ratio (CPR), defined 
as the ratio of the critical pressure to the upstream, or stag¬ 
nation pressure. A review of the CPR is given by Hardekopf 
and Mewes (1988). 

For the fluid, they distinguish between a saturated 
liquid, a two-phase mixture and a superheated vapour and 
for the outlet between an orifice, a pipe, and a nozzle. They 
state that for orifices and long pipes there is no single CPR, 
but that for nozzles, including outlets with short pipes, a 
CPR can be calculated. They refer particularly to the work 
of Schiller (1933) and Friedrich and Vetter (1962), as well as 
that of Fauske and coworkers. 

For an orifice with saturated liquid or two-phase flow 
there is no readily calculable CRP, whilst for superheated 
vapour they give the CPR as zero. For a pipe with any of the 
three fluid conditions the CPR is a function of pipe length; 
they suggest that for two-phase flow use be made of the 
model by R.E. Henry and Fauske (1971), described in the next 
section, or of the homogeneous equilibrium model (HEM). 
For a nozzle with saturated liquid or two-phase flow, they 
again refer to these two models and quote typical values for 
a saturated liquid of CPR ~ 0.85 and for two-phase flow of 
0.85 < CPR < 0.55, whilst for superheated vapour they give 
the adiabatic expansion equation with a typical CPR of 0.55. 

15.2.21 Two-phase flow transients 

The two-phase flow models described apply to steady-state 
conditions. The steady state is preceded and followed by 
transients. A treatment of such transients in pipelines is 
given by Seynhaefve et al. (1994). 

15.2.22 DIERS project 

Two-phase flow was a major aspect of the project by the 
Design Institute for Emergency Relief Systems (DIERS) of 
the AIChE. Although it was not intended that the project 
should produce new relations for two-phase flow, much work 
was done to investigate the suitability of the various correla¬ 
tions, and newmethodshaveresulted.This work is described 
in the DIERS Technical Summary and in a series of papers 
by Fauske, Epstein, Grolmes, Leung and co-workers. 

15.2.23 Choice of model 

With regard to choice of model, it is relevant to distinguish 
between one-component, two-phase flashing flow, mainly 
in controlled or accidental releases from plant, and two- 
component, two-phase non-flashing flow, mainly of fluids 
in pipelines. It is the former which is of prime interest here. 

Guidance on the choice of model for non-flashing two- 
phase flow based on the work of DIMP has been given by 



5/24 EMISSION AND DISPERSION 



Figure 15.12 Discharge of Refrigerant 11 through 3.2 mm pipe (B. Fletcher and Johnson, 1984): (a) excess 
pressure of 0.7 bar; (b) excess pressure of 2.5 bar (Courtesy of HM Stationery Office) 
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Figure 15.13 Correlations for discharge of Refrigerant 11 and of saturated water (B. Fletcher and Johnson, 1984): 
(a) Refrigerant 11; (b) saturated water. G, mass velocity (kg/m 2 s); p 1 upstream pressure (N/rrf) 

(Courtesy of HM Stationery Office) 


Table 15.4 Relaxation length observed in some critical two-phase flow experiments 


Source 

Fluid 

Diameter (mm) 

Length (mm) 

Length / diameter 

Fauske (1964) 

Water 

6.35 

**100 

s=al6 

Sozzi and Sutherland (1975) 

Water 

12.7 

**127 

sslO 

Flinta, Gernborg and Adesson (1971) 

Water 

35 

**100 

sa3 

Uchida and Nariari (1966) 

Water 

4 

**100 

«25 

B. Fletcher (1984) 

Freon 11 

3.2 

sal 05 

«33 

van den Akker, Snoey and Spoelstra (1983) 

Freon 12 

4 

90 

«22 

S. Leavylnc. (1982) a 

Water 

500 

<166 

<0.33 


a Marviken data. 
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Cindric, Gandhi and Williams (1987). For horizontal flow 
the following models are recommended: 


Flow 

Model 


Stratified 

Stratified 

Taitel and Dukler (1976) 

Stratified wavy 

Stratified 

Taitel and Dukler (1976) 

Intermittent 

Horizontal 

Dukler and Hubbard 

slug 

slug 

(1975) 

Nicholson, Aziz and 
Gregory (1978) 

Intermittent 

elongated 

bubble 

Similarity 

Dukler, Wicks and 
Cleveland (1964) 

Annular 

Similarity 

Dukler, Wicks and 
Cleveland (1964) 

Dispersed 

bubble 

Similarity 

Dukler, Wicks and 
Cleveland (1964) 


The choice of model for two-phase flashing flow is discussed 
below, in particular in Sections 15.3 and 15.4 which deal with 
families of models of Fauke and Leung, Section 15.6 which 
treats the model given by Leung for pressure relief valves 
and Chapter 17 which covers venting of reactors. 

For reactor venting, Fauske (1985b) suggests: for orifices, 
the non-equilibrium model; for short outlets, the equilibrium 
rate model (ERM); and for longer outlets, where friction is 
significant, the homogeneous equilibrium model (HEM). 

15.2.24 Design conservatism 

In considering what constitutes a conservative assumption, 
it is necessary to make a number of distinctions. In deter¬ 
mining the flow through a relief such as a pressure relief 
valve or a reactor vent, for the purpose of sizing the relief, it 
is conservative to use a method which tends to underestimate 
the flow. However, this approach is not conservative with 
respect to aspects such as the reaction forces on the vessel, 
the pressure drop in the relief header or the flow through 
the relief disposal train, for all of which it is conservative to 
use a method which tends to overestimate the flow. 

For an accidental release to atmosphere, it is generally 
conservative to use a method which tends to overestimate 
the flow. However, this may not always be true. For example, 
if the release gives a jet flame, a smaller flame of longer 
duration could be a worse case. 


cited are principally those of R.E. Henry (1970), Pana (1976) 
and Levy (1982). 

The work has been reviewed by Friedel (1987b) and 
Friedel and Westphal (1987,1988,1989). They observe that 
there are a number of features, such as viscosity changes, 
surface tension and wetting effects, and non-equilibrium 
conditions, which current models tend not to account for 
and that no model can be regarded as universally valid, 
even for water. 


15.3 Two-phase Flow: Fauske Models 

15.3.1 Fauske empirical model 

An early empirical model for two-phase flow was that 
described by Fauske (1964). The model is relatively simple 
and readily adaptable, and has been widely used. The gen¬ 
eral form of the model is 


G=C d [2 Pl (P 0 -P,)] 1/z (15.3.1j 

where C d is the coefficient of discharge, G is the mass veloc¬ 
ity, P a is the absolute stagnation pressure, P, is the effective 
downstream pressure and p\ is the density of the liquid. 

A correlation for the transition from single-phase to two- 
phase flow in fluid flowing from a vessel through an aper¬ 
ture or short pipe to atmosphere has been given by Min, 
Fauske and Petrick (1966). The transition is correlated in 
terms of a modified cavitation number C a ': 


r ,_2A P_l_ 
a p l U*d 


[15.3.2] 


where d is the diameter of the pipe, l is the length of the 
pipe, AP is the pressure difference, Uis the average velocity 
of fluid and p\ is the density of the saturated or subcooled 
fluid in the vessel. Flow is single-phase for values of C a ' less 
than 9 and two-phase for values greater than 15. At values 
between 9 and 15, unstable transitional flow occurs. 

The empirical model given by Fauske (1964) is based on 
experimental work on the flow of a saturated liquid from 
a vessel through an aperture or an aperture connected to 
a short pipe to atmosphere. For a system in which the 
aperture was a sharp edged orifice, the following equations 
were obtained: 


G = Ci[2 Pl {P 0 - py] 1/2 [15.3.3a] 

G = Cd[2 Pl (P„ - P c )] 1/Z , l/d < 3 [15.3.3b] 


15.2.25 Two-phase flow in valves 

Two-phase flashing flow occurs in valves, both control 
valves and pressure relief valves. Accounts of methods 
used to calculate such flow through control valves have 
been given by W.F. Allen (1952-), Ziegler (1957), Hanssen 
(1961), Sheldon and Schuder (1965) and Romig, Rothfus 
and Kermode (1966). Flow through pressure relief valves is 
considered in Section 15.6. 

15.2.26 Two-phase flow through cracks 

It is convenient to deal at this point with flow, particularly 
two-phase flow of a flashing liquid, through cracks in 
pressure vessels such as may be relevant to the leak-before¬ 
break condition. A number of workers have studied the leak 
rate through such cracks and have modelled it using various 
two-phase flow models (e.g. Amos etal., 1983; Abdo Uahian 
et al., 1984; R.P. Collier, 1984; John et al., 1986; Refer et al., 
1986). The two-phase flow models used by the workers 


where subscripts b and c denote the downstream and 
critical values, respectively. The value of the coefficient of 
discharge was 0.61. 

Equation 15.3.3a applies to an orifice without a pipe 
and Equation 15.3.3b to an orifice with a pipe attached. 
For this latter case the critical exit pressure P c was found to 
be a function of the length/diameter ratio l/d of the pipe. 
Fauske considered separately the regions 3 <l/d< 12 and 
12 < Ijd < 40. He found that in the latter region there was 
very little decrease in flow with 1/d, indicating a relatively 
small friction effect. His data over the two regions may be 
represented by the approximate equation 

&fc0.55[l-exp(-l/3d)] [15.3.4] 

Equation 15.3.3 was derived from experiments on saturated 
water flowing through a sharp-edged orifice of 0.25 in. 
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diameter with an upstream pressure of up to 2000 psi. This 
model has been used extensively in industry to determine 
the two-phase flow from pipe ruptures. An account of such 
application has been given by Simpson (1971). 

Equation 15.3.3 is that used in the Second Convey Report 
for estimation of two-phase flow from pipe ruptures. The 
report uses for the critical pressure ratio Equation 15.1.69. 

15.3.2 Relaxation length 

As described earlier, Fauske (1964) correlated his results 
in terms of the length/diameter ratio. Subsequent work 
indicates, however, that it is the absolute length / rather 
than the length/diameter ratio l/d which is the appropriate 
correlator and this position has been adopted by Fauske. 

15.3.3 Jones and Underwood model 

The Fauske empirical model has been widely used and has 
been subject to various adaptations. M.R.O. Jones and 
Underwood (1983) refer to Fauske’s empirical model and 
point out that the use of an average density p m implies 
the assumption of homogeneous equilibrium flow. They 
present as an alternative relations derived from the theory 
for critical annular flow given by Fauske (1961): 

G = \p™ B p W - P ‘)] 1/2 I 15 - 1 2 3 * - 5 ] 




[ ** a-*.) 2 ] 

[p g f?g Pl (i-i? g )j 



[15.3.6] 

[15.3.7] 


where C D m is the modified coefficient of discharge, R g is the 
fraction of the cross-sectional area occupied by vapour, x is 
the mass fraction of the vapour, and subscripts c, g, 1, and n 
denote the pipe exit, vapour, liquid and two-phase annular 
value, respectively. 

The authors describe experimental work on Freons 12, 
22, and 114 discharging through pipes of diameter 0.5 and 
4 mm and length/diameter ratios between 10 and 617. The 
authors found that the coefficient of discharge C D m in 
Equation 15.3.5 was a function of the length/diameter ratio 
and obtained the relation 


n \~ 0 - 77 

C dm = 5.46M +0.29 [15.3.8] 

Equation 15.3.8 actually gives a coefficient of discharge 
greater than unity for l/d < 15 and the coefficient so 
obtained should be treated as a purely empirical one. 

In a further study, M.R.O. Jones and Underwood (1984) 
investigated releases from apertures rather than full bore 
ruptures. Experiments were carried out using Freons and 
propane with pipes 4.3-4.5 mm in diameter and ending in 
a ball valve followed by one of the following apertures: 


It might be expected that for pipes of cross-sectional area 
A p and apertures of area A a the flow would be proportional 
to the area ratio AJA P , but the correlation obtained was in 
fact in terms of ( AJA p ) 1/2 . Three regions were observed: 

0 < (AJAp) 112 < 0.25 Flow effectively metastable. 

0.25 < (AJA P ) 1/2 < 0.9 Ratio of actual flow to maximum 
flow proportional to (AJA p ) 112 . Constant of propor¬ 
tionality 1.15. 

0.9 < (AJAp) 112 < 1.0 Flow equal, or close, to maximum 
flow. 

The authors warn, however, that their experiments were 
small scale and that caution should be exercised in extra¬ 
polating the results to the large scale. 

15.3.4 Henry-Fauske non-equilibrium model 

A non-equilibrium model for outlets with short pipes has 
been given by R.E. Henry and Fauske (1971). The model 
receives frequent mention. The assumption is made that 
flow is homogeneous but not that it is in equilibrium. The 
expansion of the vapour is assumed to be polytropic. The 
model gives the flow in terms of the stagnation conditions. 
For critical two-phase flow the authors derive the relation 

= (jp - x)kv, + xv g ] }) ~ 1 IJ15.3.9] 


where k is the slip ratio, v is the specific volume and sub¬ 
script t indicates the throat. The equations of the model are: 


g2 (1 - xJvJR, - P t ) + [x 0 y/(y - l)](P u i> g „ - P tVgt ) 
[(1 - Xo)vi 0 + x 0 v gt f/2 


= [((1 — ° t o)/ g 0 )(i —»?) + y/(y — i)r 


i/(2/?«t) + 7/(7 — l) 

0 _ (1 , (, v h \ \ (1 - Xo )NP t ds, E ] „ l/n - \/y 

' “ l» + l W L^-sbMP] t M 


[15.3.11] 

Vv\ 



[15.3.12] 

X 0 Vg Q 

0 (1 - Xo)Vl 0 + X 0 V g0 

[15.3.13] 

a _ X 0 V gt 

1 (1 - X 0 )Vl 0 + X 0 % 

[15.3.14] 

% = %o rf lh 

[15.3.15] 

(i - *)ci/c pg + 1 
n (1 — x)c\/cp g + 1/y 

[15.3.16] 

N =m ^°- 14 

[15.3.17a] 


(1) circular aperture, d = 0.5—4.4 mm, // d < 3; N =*■ 1 XEt > 0.14 [15.3.17b] 

(2) circular aperture, d = 0.5 mm, lid = 10; 

(3) rectangular aperture, height/width ratio 5.5, 10.2 * E = —-!!L [15.3.18] 

and 25.6. s gE -si E 
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where c is the specific heat, n is the polytropic index, Nis a 
non-equilibrium parameter, s is the specific entropy, a is the 
void fraction, y is the isentropic index and the subscript E 
denotes equilibrium (corresponding to local static pressure). 

For N = 1 the model reduces approximately to the homo¬ 
geneous equilibrium model, while for N = 0 it reduces 
approximately to the homogeneous frozen model. For 
inlet quality greater than x a = 0.1, corresponding to throat 
quality * E t in the range 0.125—0.155, with an assumed 
average of 0.14, the homogeneous equilibrium model is 
assumed, so that N = 1, as given in Equation 15.3.17b. For 
inlet qualities less than x„ = 0.1, Equation 15.3.17a is used. 


15.3.5 Fauske slip equilibrium model 

In the models described so far, the usual assumptions are 
thermal equilibrium and homogeneous flow. Fauske (1962, 
1963) has developed a slip equilibrium model in which the 
latter assumption is relaxed. The model is applicable 
essentially to annular flow, in which the vapour and liquid 
flows are largely separate so that the vapour velocity is 
likely to exceed that of the liquid. The starting point of the 
model is the momentum balance: 


dP + dF' + d(G g « g + G«i) = 0 [15.3.19] 

where dF is the friction term. Differentiating Equation 
15.3.19 with respect to the quality x gives 


dP dF d(G g Ug + Gm) 
dx + dx + dx 


[15.3.20] 


It is assumed that the friction term can be expressed as 


dFes 


f*G 2 vdl 
2 d 


[15.3.21] 


can be expressed as a function of k by combining Equations 
15.2.16b and 15.3.24 to give 

[ 15 .3. 2 5] 

Differentiating Equation 15.3.22 with respect to k gives 


[ Sl\8k) 2d 8k 


-sIH 


[15.3.26] 


In order to obtain from Equation 15.3.26 an expression for 
the maximum flow it is necessary to make some limiting 
assumptions. One limit is that of isentropic flow (/= 0, 8v/ 
8k = 0), but this is rejected because of the irreversibil¬ 
ities inherent in different phase velocities. Instead, the 
assumption made is isenthalpic flow ( 8f / 8k = 0, 8v/8k = 0). 

Differentiating Equation 15.3.25 with respect to k gives 


|-(,-<■>(„-$) [15.3.27] 


Then the values of k for which Equation (15.3.27) is equal to 


k = l * = 0,1 [15.3.28a] 

f v \W 

k=[-) 0<*<1 [15.3.28b] 

Integrating Equation 15.3.22 over the length l of the pipe 
gives 


jC? + < + SH 


[15.3.29] 


where/" is a friction factor for two-phase flow. 

Substituting for u g , U\ and dF in Equation 15.3.20 from 
Equations 15.2.12,15.2.13 and 15.3.21 gives, eventually, 


dP 

dl 


(T^ag)piJ 



[15.3.22] 


But the corresponding equation for single-phase flow is 


f m =l%^ p (l/l)d p [15.3.30] 

where f m is the average friction factor. 

Differentiating Equation 15.3.30 with respect to P and 
setting dG/dP = 0 and then combining the result with 
Equation 15.3.29 gives 


dP 
d l' 


[dw 

k 


[15.3.23] G c = 


v[d\nv/dP + (1/2 d) d/ m /dP]J 


where/is the friction factor. 

Equations 15.3.22 and 15.3.23 become identical because 
the specific volume v is defined as 


[15.3.24] 


But 


_8U8k 
k 8P) ~ 8k 8P 


[15.3.32] 


and, since, 8f m /8k = 0, it follows that 8f m /8P = 0. 
Then from Equations 15.3.31 and 15.3.25 


This definition of the specific volume is a crucial feature of 
the model. 

In the model, the slip ratio k is treated as a variable to be 
adjusted to obtain the maximum flow. The specific volume v 


vd/dpc;a - x )v$ 4- xvg ] i +x(k - 1 )]}j 

[15.3.33] 
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Completing the differentiation of the denominator of Then the maximum m 
Equation (15.3.33) with respect to P gives of quality x is 


Go = (-*/Q 1/s 


is velocity G c for different values 


= [(l-x + kx)x]^ 

+ [» g (l + 2kx -2x)+ V\(2xk -2k-2xtf + A 2 )] | 



[15.3.35] 

Equation 15.3.34 is the required relation for the critical two- 
phase flow. 

The derivative terms in Equation 15.3.35 are calculated 
under isenthalpic conditions as follows: 

dv g ~ (Av g \ 
dP ~ \AP/ h 

[15.3.36] 

di>i _ /AvA 
dP~ \APJ b 

[15.3.37] 

dx 1 /d4f d/zf g \ 

dP* ~htg[dP +X dFj 

[15.3.38a] 

dx ^ 1 (Ahi Ahig\ 

dP ** htg \AP + AP ) 

[15.3.38b] 


Av g = 0.7440 - 0.7973 
Avi = 0.0202 - 0.0201 
A ht = 727.2 - 736.1 
Ah fg = 475.2 - 467.4 

S-i£j(- 83+ “> 

-9.2535 xRT 6 
k = 6.19 


8960 

7605 

6510 

5100 

3570 

2740 

2235 


The term (dvi/dP) can often be neglected. In the calculation 
given for a value of the pressure P of 600 psi, the error in 
neglecting the term is 3 %. At 400 psi the error reduces to 1%. 

A further illustrative calculation has been given by 
Ramskill (1986 SRD R352) for an ammonia flow problem. 

In the Fauske slip-equilibrium model, the friction factor 
defined is relatively complex and is unique to that model, 
although this does not present a problem since it is elimi¬ 
nated in the manipulations and does not appear in the final 
equation for the critical mass velocity. 

15.3.6 Fauske non-equilibrium model 

A model for critical two-phase flow in short outlets which 
has both non-equilibrium and equilibrium versions has been 
given by Fauske (1985b). The model is suitable for venting of 
vessels such as reactors and storage vessels where the outlet 
is sufficiently short for friction to be neglected. The general, 
or non-equilibrium, form of the model is: 


where the subscripts f, fg and h denote the liquid, the liquid- 
vapour transition and constant enthalpy, respectively. 

The method of calculation is as follows. For a given 
pressure P and given value of the quality x, the quantities 
v B , Vi, h tg , Av g IAP, Avi/AP, Ah f /APand Ah fg /APare obtained 
from thermodynamic tables. As an illustration, consider 
the calculation (in British units) given by Fauske for the 
maximum mass velocity of a steam—water mixture at a 
pressure of 600 psi. From steam tables 

v g = 0.7698 

Vi = 0.0201 

htg = 731.6 
and for AP = 40 




JSfTC) 


As 


2A P Pl K 2 vj g TC 


+ 1/ 4 0 < //4 < 1 


[15.3.39] 


[15.3.40] 


where C is the specific heat of the liquid, K is the coefficient 
of discharge, 4 is the equilibrium or relaxation length, N is 
a non-equilibrium parameter and AP is the total available 
pressure drop. The discharge coefficient K is the usual 
coefficient of discharge; it is given by Fauske variously as 
0.6 and 0.61. The relaxation length 4 is 0.1 m. 

Equation 15.3.39 is applicable over the range 0 < l/l e < 1. 
For //4 = 0, it reduces to 


[15.3.41] 


G = K(2APpi) 1/2 

AP = P 0 - P a [15.3.42] 

where P a is the absolute atmospheric pressure. 

15.3.7 Fauske equilibrium rate model 

If, on the other hand, the pipe length is sufficient for 
equilibrium to be reached, which occurs at ljl e > 1, then in 
Equation 15.3.39 N = 1, and hence 


[15.3.43] 

is Equation 15.3.43 the equilibrium rate 


■S(i) 
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An alternative form of Equation 15.3.43 which is often 
more convenient is 


G 


dP m 1/2 

dT \C/ 


[15.3.44] 


For a liquid with a small degree of subcooling, and thus 
in the transition zone between a saturated and strongly 
subcooled liquid: 

G = {2[P 0 - P v (T 0 )\ Pl + GIrm} 1 ' 2 l/k > 1 [15.3.50] 


Equation 15.3.44 gives a good estimate of two-phase flash¬ 
ing flow, provided the mass fraction x of vapour does not 
exceed a limiting value. The condition for its validity is 
given by Fauske and Epstein (1989) as 


_ p v dp fry 2 

Germ - PdT (^ c J 


[15.3.51] 


Pv fg, 
IF/ 


where P v is the absolute vapour pressure. 

[15.3.45] Equation 15.3.50 reduces to Equation 15.3.44 for zero 
subcooling and to Equation 15.3.49 for strong subcooling. 


This condition implies a corresponding value of the void 
fraction a, since 


[15.3.46] 


15.3.10 Source term models 

From this family of models, Fauske (1985b) and Fauske and 
Epstein (1988) have summarized those which may be used 
for the source term of an accidental release. They are: 


Liquid condition 


Equation 

Saturated stagnation 

Orifice (non-equilibrium, frictionless, l/k = 0) 

15.3.41 


Nozzle (non-equilibrium, frictionless, 0 < l/l e < 1) 

15.3.39 


Nozzle/short pipe (equilibrium, frictionless, l/k > 1) 

15.3.44 


Longer pipe (equilibrium, frictional effecs, l/k > 1) 

15.3.47 

Week subcooling 

Nozzle (non-equilibrium, l/l e < 1) 

15.3.50 (with Germ replaced 
by G from 15.3.39) 


Longer pipe (equilibrium, l/l e > 1) 

15.3.50 (with Germ from 15.3.51) 

Strong subcooling 

Nozzle/longer pipe 

15.3.49 


15.3.8 Flow through a pipe 

The equilibrium rate model applies essentially to flow 
through a nozzle just long enough for equilibrium condi¬ 
tions to be established but sufficiently short that frictional 
effects can be neglected. The flow is only weakly dependent 
on the length of the outlet, but if it is necessary to take 
friction into account, Fauske suggests two approaches. 

One is the use of the homogeneous equilibrium model, 
discussed in Section 15.2.15. 

The other approach given by Fauske (1989a) is the use of 
a flow correction factor F to the ERM so that Equation 
15.3.44 becomes 




[15.3.47] 




F=f(l/d) 


[15.3.48] 


In the context of venting of reactors with vapour pressure, 
or tempered systems, Fauske (1989a) has reported the 
values of F given here in Table 15.5. 


15.3.9 Subcooled liquids 

For flow of a liquefied gas which is initially subcooled, 
Fauske (1985b) gives the following relations. For a liquid 
with a large degree of subcooling: 


1/2 


15.4 Two-phase Flow: Leung Models 

Another family of models for two-phase flow is that given 
by Leung, another contributor to the DIERS project. The 
model of particular interest here is the homogeneous 
equilibrium model (HEM) for one-component two-phase 
flashing flow (Leung, 1986a). In addition to the basic 
model, the author has treated two-phase flashing flow in 
a horizontal duct (Leung, 1990a; Leung and Grolmes, 
1987—), in an inclined duct (Leung, 1990a; Leung and 
Epstein, 1990a), with a subcooled liquid (Leung and 
Grolmes, 1988) and with non-condensable gas (Leung and 
Epstein, 1991), has presented a unified approach for nozzles 
and pipes (Leung, 1990b) and an overall comparison of 
flashing flow methods (Leung and Nazario, 1990). He has 
also given a model for two-phase non-flashing flow (Leung 
and Epstein, 1990b) and has shown the similarity between 
the flashing and non-flashing flow models (Leung, 1990a). 


Table 15.5 Flow correction factor for Fauske 
equilibrium rate model (after Fauske, 1989a) 


ltd 

F 

0 

1.0 

50 

0.85 

100 

0.75 

200 

0.65 

400 

0.55 


G = K[2(P 0 -P a ) Pl ] 1 


[15.3.49] 
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Applications of the model given by Leung include its use 
for: two-phase flow in storage vessels (Leung, 1986b); 
pressure relief valves (Leung, 1992a); and venting of reac¬ 
tors (Leung and Fauske, 1987; Leung and Fisher, 1989). 
These applications are described in Sections 15.5,15.6 and 
Chapter 17, respectively. 

15.4.1 Flow through a nozzle 

The homogeneous equilibrium flow model of Leung 
(1986a) follows on from an earlier model by Grolmes and 
Leung (1984) which was restricted to an inlet condition of 
all liquid flow. This has been generalized by Leung to allow 
the handling of two-phase flow at the inlet. 

The basic momentum and energy balance relations are: 


vdP + (?{vdv + Afi?^j =0 

[15.4.1] 

G 2 ^ 2 

K =h + —^~ 

[15.4.2] 


where a> is a parameter. Grolmes and Leung (1984) utilized 
Equation 15.4.10 to obtain the flow through a nozzle for an 
all liquid inlet condition. 

For isentropic expansion, the correlating parameter a> in 
Equation 15.4.10 is 


QqTqPq (v fgo y 

Vio \htj 


[15.4.11] 


where Q is the specific heat of the liquid and T is the 
absolute temperature. 

The critical mass velocity G c is 


f Po \ 1/2 

[15A12! 

where f/ c is the critical pressure ratio. The pressure ratio r\ is 
defined as 


P 

¥ 0 


[15.4.13] 


where D is the diameter of the pipe, / is the friction factor, 
h is the specific enthalpy, L the length of the pipe and sub¬ 
script o denotes stagnation. The situation considered is 
frictionless flow through a nozzle. This is treated as an 
isentropic process. 

For a nozzle (L = 0), Equation 15.4.1 becomes 


The critical pressure ratio r\ c was found to be the value of 
q satisfying the relation 

rj 2 + (m 2 - 2co) (1 - ij) 2 + 2w 2 In r/ + 2co 2 (l - rj) = 0 

[15.4.14] 


G = (—df/dP) -1 / 2 [15.4.3] 

The relations for specific enthalpy h, specific entropy s and 
specific volume v are: 

h = ht + xht g [15.4.4] 

s — S{ + :*:% [15.4.5] 

v = Vt + xvfg [15.4.6] 


where subscripts f and fg indicate the liquid and the 
liquid-vapour transition, respectively 
Equation 15.4.2 for the energy balance can be written as 

c 

But 

ho-h^J vdP 


[15-4.7] 


[15.4.8] 


Further, for the all liquid inlet condition 


P 0 

01 y foGfm 

[15.4.15] 

and hence from Equations 15.4.11 and 15.4.15 


/ 1 


II 

P\ 

1 

[15.4.16] 

where Gi m is the mass velocity at this limiting condition. 
Starting from these relations, Leung extends the treatment 
to the case of a two-phase inlet condition. Equation 15.4.10 

becomes 



[15.4.17] 

which is also given as 


(v/v 0 -l) 

03 {Po/P ~ 1) 

[15.4.18] 

and Equation 15.4.12 becomes 



Then from Equations 15.4.7 and 15.4.8 

r = t 2 JZ ^ V2 


[15.4.9] 


In order to solve Equation 15.4.9, use is made of an equation 
of state proposed by M. Epstein et al. (1983) for isentropic 
expansion from (all) liquid stagnation conditions: 



Introducing a dimensionless mass velocity G * 

G*^ ‘ 

(PolVof* 

the critical value G* becomes 


[15.4.19] 


[15.4.20] 




[15.4.10] 


G* = 


C*V«o) l/2 


[15.4.21] 
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At this point, the assumption is made that the process is 
isenthalpic. This approximation allows co to be expressed 
more readily in terms of the stagnation properties. The 
relations for the specific enthalpy, specific entropy and 
specific volumes are: 


For the inclined pipe, use is made of the flow inclination 
number Fi defined as: 


gD cos 6 

IfiW 


[15.430] 


h 0 = hi 0 + x 0 ht S0 [154.22] 

s 0 = Sfo + x 0 s fg0 [154.23] 

v 0 = Vfo + x 0 Vf g0 [154.24] 

where x is the mass fraction of the vapour. 

It is shown that with the isenthalpic assumption and 
certain other approximations: 


where g is the acceleration due to gravity and 9 is the angle 
between the pipe axis and the vertical. 

Figure 15.14 shows the ratio G/G 0 of the mass velocity 
through a pipe G to that through a nozzle G 0 , or flow 
reduction factor. Figure 15.14(a) is for a horizontal pipe 
(Fi = 0) and Figure 15.14(b) for an inclined pipe with 
Fi = 0.1. 

For the case of all liquid inlet flow (co = 0): 


X 0 Vfga QoT 0 P 0 ^ ffgo ^ 


[15.4.25] 


Starting from Equation 15.4.19 and utilizing data for two- 
phase flow of water and nine other fluids, Leung obtains 
the following empirical correlation: 


G c 


> co >4.0 

0.66 

“039 03 < 4 '° 


[15.4.26a] 

[15.4.26b] 


The critical pressure ratio tj c was found to be the value of 
tl satisfying the following relations. For a stagnation 
pressure of P 0 = 5 bara (absolute bar) 

r\ = 0.6055 + 0.1356 lnco - 0.131(lnco) z [15.4.27] 

and for P a = 15 bara (absolute bar) 

r/ = 0.55 + 0.217 lnco - 0.046(lnco) 2 + 0.004(lnco) 3 

[15.4.28] 

This correlation was found to apply up to a reduced 
temperature T r = 0.9 and reduced pressure P T = 0.5. 

The most general formulation of the parameter co is: 


co = a„ + (1 - a o )p fo Ct o T o P 0 [15.4.29] 

where a is the void fraction. For the all liquid condition 
a Q = 0, and for the all vapour condition a D = 1. The para¬ 
meter co takes the following values: 

x„ -1 a,, -1 all vapour co -1 

0 < x 0 < 1 Oo<l but flashing co > 1 

0 < * 0 < 1 Oo<l but non-flashing co = a Q < 1 

The larger the value of co, the greater the increase in 
specific volume upon depressurization and the more 
readily the flow attains the choking condition. 


G /l-ATi\ 1/z 

Go~ \ U-N } 

[15.4.31a] 

*= --—Fi = 0 (horizontal pipe) 

(1 + 1V) 1/Z 

[15.4.31b] 

-» 0 IVFi = 1 

[15.4.31c] 

with 



[15.4.32] 

where N is the pipe resistance factor. 


15.4.3 Subcooled liquids 

The case of flashing critical flow of an initially subcooled 
liquid is considered by Leung and Grolmes (1988). A more 
general relation which applies to such flow as well as flow of 
an initially two-phase mixture is 

r «_ G 
{Po/Vof* 


{2(1 - %) + 2[co>7s MlsM -(a>- l)(»/ s - 

- v )]} 1/2 

(o((nJn) - 1) + 1 

[154.33] 

with 


P s 

^-Po 

[154.34] 

where the subscript s denotes saturation. 
Setting dG*/d;j = 0 gives for the critical mas: 

s velocity 

Gc ’ = (^ 

[15.4.35] 

The flow behaviour depends on the degree of subcooling. 
The critical value ij sc separating the two regimes is 

^ ~ 2co 

[154.36] 


15.4.2 Flow through a pipe 

The case of flow through a horizontal pipe as opposed to a 
nozzle has been treated by Leung and Grolmes (1987-), 
whilst Leung and Epstein (1990a) have considered flow 
through a pipe inclined upwards. The results of this work 
have been summarized by Leung (1990a). 


For low subcooling (>/ s > >/ sc ), the fluid attains flashing 
before reaching the choked location. For high subcooling 

rjo = % [154.37] 

G* = [2(1 - r,^ 2 [15.4.38] 
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(a) 4 /l/d 



Figure 15.14 Leung homogeneous equilbrium flow model: critical flow for discharge through a pipe (Leung, 1990a): 
(a) horizontal pipe; and (b) inclined pipe Fi =0.1 (Courtesy of the American Institute of Chemical Engineers) 


or, from a relation similar to Equation 15.4.21 but with Vf„ 
instead of v ot 

G c = [2 Pf0 (P 0 -P s )]^ [15.4.39] 

which is the usual equation for liquid flow through an orifice. 

15.4.4 Subcritical flow 

The case of flashing subcritical flow is treated by Leung 
(1992a). A more general relation which applies to such flow 
as well as critical flow is 


15.4.5 Non-flashing flow 

The case of non-flashing critical flow has been dealt with 
by Leung and Epstein (1990b). Non-flashing two-phase 
flow is exemplified by two-phase flow of a two-component 
mixture such as air and water. A comparison of flashing 
and non-flashing flows is given by Leung (1990a). 

Figure 15.15 shows the correlation given by Leung 
(1990a) for the dimensionless mass velocity G) and the 
critical pressure ratio r\ c in two-phase critical flow in both 
the flashing and non-flashing regimes. 


r* - 

(p o /v 0 r 

{—2[caln»/ + (co — 1)(1 — >?)]} 1/ ' 2 
m (l/r,-l) + l 

Setting AG*jAr\ = 0 gives for the critical: 


15.5 Vessel Depressurization 

Some of the most complex fluid flow problems arise in the 
[15 4 401 depressurization or venting of vessels, particularly reac- 
^ ' ‘ ‘ tors and storage vessels. In order to specify the venting 
arrangements for a vessel, it is necessary to determine the 
i velocity flow, the phase condition of fluid and the vent area required 

for this flow. The venting of vessels is complicated by the 
[15.4.41] feet that in many situations the flow is likely to be two- 
phase. It is necessary therefore, to be able both to estimate 
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<o = a 0 + Po 


Figure 15.15 Leung homogeneous equilibrium flow model: critical flow for discharge through a frictionless nozzle 
(Leung, 1990a) (Courtesy of the American Institute of Chemical Engineers) 


the vapour mass fraction, or quality, of the fluid entering 
the vent and the flow through the vent. 

The need to determine the quality of the fluid vented has 
been highlighted during the work of the DIERS project.The 
quality of the fluid entering the vent is determined by 
liquid swell and vapour disengagement. There are two 
principal regimes that are recognized as occurring when a 
vessel is depressurized. If the liquid is non-foaming the 
regime tends to be churn turbulent, whereas if it is foaming 
the regime is bubbly. 

For a non-foaming liquid, methods have been developed to 
predict the onset of two-phase flow. In the depressurization 
of a vessel containing such a liquid there will, in general, be a 
region in which the flow is all vapour and another region in 
which it is two-phase. A large initial vapour space, or free¬ 
board, will favour all vapour flow. For a foaming liquid it is 
necessary to assume two-phase flow. Broadly, a pure liquid 
held in a storage vessel may well be non-foaming. It is to this 
situation that the methods developed principally apply. 

An otherwise non-foaming liquid may be rendered 
foaming by the presence of impurities. Quite small quan¬ 
tities of a surface active agent may suffice to effect this. 
Since impurities are likely to be present in the liquid in a 
reactor, it is usual to treat a reaction mass as foaming. 

In this section an account is given of models of liquid 
swell and vapour disengagement. Models have been given 
in the DIERS Technical Summary and by Fauske, Grolmes 
and Henry (1983), Swift (1984) and Grolmes and Epstein 
(1985). The application of these models to venting, particu¬ 
larly of storage vessels, is described in Chapter 17. 


15.5.1 Liquid swell 

Depressurization of a vessel containing superheated liquid 
or addition of heat to liquid in a vessel gives rise to the 
formation of vapour bubbles, which results in liquid swell. 
If this is severe, the level of the swollen liquid may 
reach the vent. But even if this is not so, there may be 
carryover of droplets into the vent. Liquid swell and vapour 
disengagement therefore affect the vapour mass fraction 
entering the vent. Some of the flow regimes that can occur 
on operation of the relief are shown in Figure 15.16. 


For a liquid subject to swell, the average void fraction is 





Ho = j- [15.5.2] 

where A x is the cross-sectional area of the vessel (m 2 ), H is 
the height of the liquid (m), H 0 is the height of the liquid 
without swell (m), Vj is the volume of the liquid (m 3 ) and a 
the average void fraction. A distinction is made between the 
average void fraction a and the local void fraction a. 

The initial void fraction in the vessel, or freeboard, a 0 is 


a 0 = l-| [15.5.3] 

where i7 x is the height of the vessel (m). 


15.5.2 Gas or vapour generation 

Gas or vapour may be present in the liquid because gas is 
injected into the liquid or because gas or vapour is gener¬ 
ated in the liquid, due either to exothermic reaction or to an 
external heat source. The first case is that of uniform flux 
(UF) and the second that of a uniform volumetric source 
(VS). It is the latter that is of principal interest here. 

The vapour superficial velocity above the height of the 
swelled liquid is 


[15.5.4] 


where j g ais the vapour superficial velocity (m/s) and S is 
the volumetric source strength (m 3 /s). 

A dimensionless source strength i j/ is defined as 


[1554 

where U .is the bubble rise velocity (m/s). The parameter i jt 
is also referred to as the ‘dimensionless velocity’. 
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(a) 

Gas flow 



Two-phase flow 



(c) 

Bubbly flow 



(d) 


Churn turbulent 
flow 



Droplet flow 


Figure 15.16 Some flow regimes in venting of vessels (Swift, 1984) (Courtesy of the Institution of Chemical Engineers) 


The volumetric source strength is a function of the heat 
input. For an external heat source 


the ‘particle velocity’ and the ‘characteristic velocity’. 
The bubble velocity is given by 


1 


FQ ex 
P\D 


[15.5.6] Tj _ %g(Pi ~ Pg)] V4 
~ 1/2 


[15.5.12] 


where D is the vessel diameter (m), q is the heat input per unit 
mass (kW/kg), Q ex is the external heat input flux (kW/m 2 ), 
Pi is the density of the liquid (kg/m 3 ) and F is a geometric 
factor. For the geometric factor F the Technical Summary 
gives for a sphere F = 6, for a vertical cylinder F = 4 and 
for a horizontal cylinder with hemispherical ends F = (LI 
D + T)/(3L/D + 2), where LID is the length/diameter ratio. 

15.5.3 Drift flux 

A drift flux model for the behaviour of the liquid in a vessel 
subject to vapour generation has been described in the 
Technical Summary. The concept of drift flux has been 
described in work by Zuber and Findlay (1965) and Wallis 
(1969). The local gas and liquid superficial velocities are: 

j g = aUg [15.5.7] 

X = a-«)Di [15.5.8] 

r %/g +ii [15.5.9] 

where j is the total volume flux, or superficial velocity 
(m/s),/ g is the superficial gas velocity (m/s),yj is the super¬ 
ficial liquid velocity (m/s), U B is the area average gas veloc¬ 
ity (m/s), and U\ is the area average liquid velocity (m/s). 

From these relations is derived the expression for the 
drift flux: 


igi=;g(i -«)-»» [is.5.10] 

where/gi is the superficial drift velocity, or drift flux (m/s). 

It has been shown by Wallis that the drift flux j gi can 
be expressed as a function of the bubble rise velocity U x . 
The particular relation adopted in the Technical Summary 
differs slightly from that of Wallis and is 


7gi» 


q(l — a) n U 0O 


[15.5.11] 


where Up is the density (kg/m 3 ), a is the surface tension of 
the liquid (N/m), k is a constant, and subscript c denotes the 
continuous phase. 

The values of the indices m and n and of the constant k 
depend on the regime as follows: 



n 

m 

k 

Bubbly regime 

2 

3 

1.18 

Churn turbulent regime 

0 

-►oo 

1.53 


Substituting these values in Equation 15.5.11 gives 


jg\ sr ’ Bo o bubbly regime [15.5.13] 

j g ] = oiUoo churn turbulent regime [15.5.14] 

A further drift flux is defined j\ s , complementary to j gi , 
such that 

jgi +ji g = 0 [15.5.15] 

The two drift fluxes are given by 

j gl = a (l- a )(Ug-U{) [15.5.16a] 

j\ g = —a(l — oi)(Ug — U]) [15.5.16b] 


where;ig is the superficial drift velocity of the liquid phase 
relative to the gas phase (m/s). 

The foregoing treatment does not take account of the 
radial distribution of the void fraction. In order to obtain 
better correlations Zuber and Findlay (1965) introduced the 
distribution parameter C G . Equation 15.5.10 for the drift 
flux then becomes 


where is the bubble velocity (m/s) and m and n ■ _ n r . ■ r ■ 
are indices. The velocity is also variously termed ^ gl — ' ° a " e ° a “ 


[15.5.17] 
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For the case of no radial void distribution C Q is unity. 
In general, the value of C D used tends to lie in the range 
1.0-1.5. For C Q a best estimate is 1.2 and 1.5 for the bubbly 
and churn turbulent regimes, respectively, and a conserva¬ 
tive estimate is 1.0 for both regimes. 

This drift flux model is now applied to three situa¬ 
tions: (1) an open system with a uniform gas injection flow, 
(2) an open system with uniform volumetric gas generation 
and (3) a closed system with a uniform volumetric gas 
generation. 


15.5.4 Superficial velocity: open system 
with uniform injection flow 

For an open system with uniform gas injection at the 
bottom of the vessel, the steady state condition is 
h = 0 and Equation 15.5.17 with Equation 15.5.11 then 
gives 


«(l-q)*Ck 

h V(1 — a’")l 1 — Qjc), 


[15.5.18] 


But, since the gas flow is constant throughout the height, 
is = isoo< and hence from Equation 15.5.5: 


+ =*} 


«(!-«)" 

(1 -cf)(l -Qa) 


[15.5.19] 


Then for the two regimes 


* = _!<!_ 

V (1 — a 3 )(l — C a x) 


bubbly regime 


[15.5.20] 


t/r = -—— churn turbulent regime [15.5.21a] 

t/r —* a churn turbulent regime; a <C 1 [15.5.21b] 

15.5.5 Superficial velocity: open system 
with uniform volume source 

For an open system with uniform volumetric gas generation 
throughout the liquid, the vapour flux varies with height. 
The energy balance is: 


Pghf g dj g = qpi( 1 - a) d/7 


[15.5.22] 


where h is is the latent heat of vaporization (kj/kg). Limiting 
the treatment to the churn turbulent regime, differentiation 
of Equation 15.5.18 with respect to a and combination with 
Equation 15.5.22 yields 


* 


d H* 
dot 






?(pi/p g - i) H o 
hi g U M 


[15.5.23] 


[15.5.24] 

[15.5.25] 


where H* is the dimensionless liquid height. Equation 
15.5.23 may then be integrated: 

ij/H* = j (1 - a) -3 da [15.5.26] 

Two successive integrations are then performed. The first 
gives a as a function of H *: 

a = 1 - (1 + 2i l/H*)~ 1/2 [15.5.27] 

The second gives a as a function of //*, subject to the 
condition 


//max = 1/(1 - a) [15.5.28] 

This second integration yields 

i 15 - 5 - 29 *] 


[15.5.29b] 


Introducing the distribution parameter C OJ Equation 
15.5.29 becomes 


2 + C 0 xli 



[15.5.30a] 

[15.5.30b] 


The corresponding equation for bubbly flow is 


jM 


a(l-a) 2 

(l-a3)(l-C 0 a) 


[15.5.31] 


15.5.6. Superficial velocity: closed system 
with uniform volume source 

The case of a closed system is also relevant, since it repre¬ 
sents the condition just before the relief device operates. 
It is used for the analysis of transient conditions. For this 
case;) is not equal to zero. 

For a closed system with uniform volumetric gas gen¬ 
eration throughout the liquid, the treatment is as follows. 
Continuity of flow gives: 


h = ajg [15.5.32] 


[15.5.33] 


where a is a parameter and x e is the mass fraction of vapour 
at the vent. Then from Equations 15.5.11,15.5.17 and 15.5.32: 


h *|P 


eXU a q 

i-q,ap 


[15.5.34] 
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, (1 - «)“ 

1 —a« 


[15.5.35] 

^ 1 - C 0 a 


[15.5.36] 

where e and X are parameters. 

For the two regimes, the values of the parameters, a, e 
and X are as follows. For the bubbly regime: 

a = a 


[15.5.37] 

(1 — a) 2 
.1 


[15.5.38] 

^ l-t-Ssi. 


[15.5.39] 

For the churn turbulent regime: 


2oc 

1 + GoOi 


[15.5.40] 

gml 


[15.5.41] 

X - 2 “ 

1 - C 0 a 


[15.5.42] 


A mass balance on the vapour at the vent gives: 


criterion for two-phase flow into the vent is that the average 
void fraction is greater than the vessel freeboard 

a>a 0 [15.5.48] 

The value of the average void fraction a for use in relation 
15.5.48 is obtained as follows. The actual value of the 
dimensionless velocity i/r is determined from the appro¬ 
priate equation. The corresponding value of a is then deter¬ 
mined from the appropriate relation between i// and a. For 
example, for an externally heated vessel with a churn tur¬ 
bulent regime, Equation 15.5.47 gives i/r and Equation 
15.5.30a the corresponding value of a. 

Alternatively, the criterion for two-phase flow to occur 
may be formulated in terms of the dimensionless velocity i/r. 
The criterion is then 

i/r(a)>i/r(oe 0 ) [15.5.49] 

For example, for the externally heated vessel with churn 
turbulent regime (a) is obtained as before from Equation 
15.5.47 «/r(a Q ) and from Equation 15.5.30b with a 0 instead of a. 

15.5.9 Criterion for two-phase flow: illustrative example 

An illustrative example of the determination of the quality 
of the vapour entering the vent is given in Table 15.6. 
The case considered is a vertical cylindrical vessel with 
external heating. The calculation shows that the flow 
entering the vent is two-phase. 


h 


Gx e n 

Pi 




n , 15.5.10 Vapour carryunder 

[lo.b.4o] A moc j e j based on vapour carryunder has been developed 
and applied to an externally heated vessel by Grolmes and 
Epstein (1985). A dimensionless heat flux / Q is defined as 


il=A/A x [15.5.44] 

where A is the area of the vent (m 2 ) and Q is the ratio of 
the vessel area to the vent area. Then from Equations 
15.5.34-15.5.43: 


Gx c Q eX 
Uoop^l-C 0 Xa 


[15.5.45] 


Equation 15.5.45 provides an expression coupling between 
the vessel and the vent line description. As described by 
Grolmes and Leung (1985), it is used for this purpose in 
numerical models of vessel venting. 

The value of i j/ at the all vapour flow condition with 
x e = 1 may be obtained as follows. Noting that Equation 
15.5.43 is for the vent point and hence j s = j goo , then 
Equations 15.5.43 and 15.5.5 give 



The external heating at the vessel walls creates a boiling two- 
phase boundary layer in the liquid which generates vapour 
bubbles that rise. This rise is balanced by liquid downflow in 
the centre of the vessel, which creates the potential for vapour 
carryunder. Vapour carryunder is assumed to occur if the 
downward recirculating velocity U c exceeds the bubble rise 
velocity U [*,. The conditions which can occur are shown 
in Figure 15.17, where Figure 15.17(a) shows no vapour 
carryunder (U c < U ^ throughout) and Figure 15.17(b) shows 
vapour carryunder to a level 7 Tbl (where U c = UaJ. 

The downward liquid recirculating velocity U c is related 
to the upward liquid superficial velocity U s , evidently 
the same as the bubble rise velocity U^, by a geometric 
factor e: 



15.5.7 Vapour generation by external heat 

From Equations 15.5.3,15.5.6 and 15.5.25 it may be shown 
that for an externally heated vessel 


U c = dJ s [15.5.51] 

The geometric factor e is the ratio of the area for downward 
recirculation flow to the boundary layer area for upward 
flow. It is a function of the boundary layer thickness 8(H) 
measured at the height H of the liquid, which itself is a 
function of the heat flux: 


FQ ex ( 1- y„l// x 
W UaohigpgD 


[15.5.47] e = fW)\ 

m =/(/o) 


[15.5.52] 

[15.5.53] 


15.5.8 Criterion for two-phase flow 

These relations may be used to indicate the boundary 
between all vapour venting and two-phase venting. The 


The interface height T/bl below which there is no 
vapour carryunder is determined as the height at which 
U c =U s ore = 1. 
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Table 15.6 Illustrative calculation for occurrence of 
two-phase flow of fluid entering the vent of an externally 
heated storage vessel 


A Scenario 


Liquid density, pi = 750 kg/m 3 

Vapour density, p g = 4.5 kg/m 3 

Latent heat of vaporization, hf s = 900 kJ/Kg 

Surface tension, a = 0.02 N/m 

Vessel type: vertical cylindrical 

Vessel diameter, D = 1.0 m 

Vessel height, H x = 2.0 m 

Vessel freeboard, a Q = 0.16 

Vessel geometric factor, F = 4 

External heat input, Q e x = 60 kj W/m 2 

Vessel regime: churn turbulent 

k = 1.53 

C„ - 1 


B Fluid phase 

From Equation 15.5.12: 

U x = 1.53[0.02 x 9.81(750 - 4.5)] 1/4 /750 1/2 = 0.19 m/s 
From Equation 15.5.47 


x 60(1-0.16) x 2.0 


From Equation 15.5.5 
j goo = 0.51x0.19 = 1.097 m/s 


From Equation 15.5.29a 


0.51 

K — 2 + 0.51 


= 0.20 


But 


oc 0 = 0.16 


Hence a > a 0 , indicating that flow entering vent is two phase. 
Alternatively, from Equation 15.5.29b with a D instead of a: 


Hence i/'/a) > i/f(a 0 ), again indicating that flow entering 
vent is two phase. 


The authors give a graphical relation of the form 
U s =f(J a ,z) [15.5.54] 

where z is the height (m). Using this relation, the height H BL 
can be determined. 

Using this model, the authors derive the following 
results for the fraction HmJH of vessel height where there 
is no vapour carryunder: 


Heat flux, J„ 


Vessel diameter (m) 


0.61 

1.52 

3.05 

6.1 

0.310 

0.41 

0.32 

0.26 

0.22 

0.062 

0.62 

0.48 

0.39 

0.33 

0.006 

1 

0.86 

0.69 

0.58 



(a) 



Figure 15.17 Vapour carryunder in venting of a vessel 
(Grolmes and Epstein, 1985): (a) case where the 
recirculating liquid velocity U c is less than the bubble rise 
velocity U Y throughout the vessel; and (b) case where 
the recirculating liquid velocity U c is not less than the 
bubble rise velocity U y , throughout the vessel (Courtesy 
of the American Institute of Chemical Engineers) 


The results show that the proportion of the liquid subject to 
vapour carryunder increases with heat flux and with vessel 
size. Thus large vessels are more prone than small ones to 
vapour carryunder. 

The potential significance of these models for large 
atmospheric storage tanks is discussed by Fauske et al. 
(1986). Assuming that vapour carryunder could cause 
sufficient liquid swell to give a two-phase mixture at the 
vent inlet, then since in such tanks the permissible over¬ 
pressure is very low, the ratio of the vent area required for 
two-phase flow to that for all vapour flow is, to first order, 
proportional to (p g /Pi)^ Z , which implies augmentation by a 
factor of 10-30. 

The authors suggest, however, that while vapour carry¬ 
under is possible hydrodynamically, the vapour bubbles will 
in fact tend to collapse as they are carried down into liquid, 
the subcooling of which increases with depth, and state that, 
to first order, liquid swell is determined by the boiling 
two-phase boundary layer without vapour carryunder. 

They describe experimental work on the measurement of 
liquid swell in vessels heated externally. The measured 
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liquid swells agree well with those predicted neglecting 
vapour carryunder. They suggest, therefore, that in the 
sizing of vents for atmospheric storage tanks for liquids 
that are not highly viscous or foaming, the assumption of 
all vapour flow will normally be valid. 

For reactors, the situation is quite different, as discussed 
by Fauske (1985a). He states that it is a hopeless task to seek 
to generalize the results just described to reacting systems, 
or indeed to any system with traces of impurities. For such 
systems, the appropriate assumption is that there will be 
two-phase homogeneous flow at the vent inlet. 

15.6 Pressure Relief Valves 

As components of a pressure system, pressure relief valves 
have been treated in Chapter 12. In this section some fur¬ 
ther consideration is given in respect of the flow through 
such devices. Dispersion of the discharge is considered in 
Section 15.20 and, for dense gases in Section 15.43. 

15.6.1 Single-phase flow 

Relations for single-phase flow of gases and liquids have 
been presented in Section 15.1. Formulae derived from 
these are given in the codes for pressure relief. The API and 
BS formulae are stated in Chapter 12. 


15.6.4 Two-phase flow: Leung method 

As described in Section 15.4, a comprehensive set of models 
for two-phase flow has been developed by Leung. These 
have been applied by the author to the problem of two- 
phase flow through a safety relief valve (Leung, 1992a). 

The treatment described by Leung is essentially the 
application of his homogeneous equilibrium model (HEM) 
to the safety relief valve (SRV) design requirements of API 
RP 520:1990 and RP 521:1990. The equations used are a 
subset of those given in Section 15.4, based mainly on 
Leung (1986a). For clarity, this subset is given again here 
together with an explanation of their use in SRV system 
design and with the illustrative examples given by Leung. 

In his method, Leung distinguishes four initial states of 
the liquid in the vessel: 

(1) saturated liquid; 

(2) two-phase gas-liquid mixture; 

(3) subcooled liquid 

(a) low subcooling, 

(b) high subcooling. 

Each of these cases is treated differently. 

The model utilizes the parameter co which determines 
the equation of state 


15.6.2 Two-phase flow 

Two-phase vapour-liquid flow has been discussed in 
Sections 15.2—15.4, from which it will be apparent that this 
is a much more complex topic. The various models for two- 
phase flow do not lend themselves to formulae for calculat¬ 
ing the area of the pressure relief valve orifice that are 
comparable in simplicity with those for single-phase flow. 
Moreover, with two-phase flow the determination of the flow 
through the valve orifice by no means exhausts the problem. 
The flows in the inlet and outlet lines are also complex. 

The treatment here deals primarily with flow through 
the valve orifice and is confined to an account of the widely 
used American Petroleum Institute (API) method and of a 
method given by Leung which has gained some acceptance, 
together with a overview of the wider aspects of the design. 


[15-6.1] 

and is given by 

m ~ ^ + Cfo ^ oF2 115.6.2] 

where C is the specific heat (J/kgK), h is the specific 
enthalpy (J/kg), P is the absolute pressure (Pa), T is the 
absolute temperature (K), v is the specific volume (m 3 /kg), 
x is the mass fraction of vapour, and subscripts f, fg, g and o 
indicate the liquid, the liquid-vapour transition, the vapour 
and stagnation, respectively. The inlet void fraction a D is 


15.6.3 Two-phase flow: API method 

API RP 520 Part 1: 1990 gives the following method 
for sizing a two-phase gas-liquid relief. It describes the 
method as reasonably conservative. The method is to cal¬ 
culate separately the cross-sectional areas required for the 
vapour and the liquid flows. The quantity of vapour formed 
is determined by assuming an adiabatic, isenthalpic 
expansion from the relieving condition down to the critical 
downstream pressure or the back pressure, whichever is 
the greater. The area for the vapour flow is then obtained 
using the equations given for all vapour flow, supercritical 
or subcritical, as the case may be. Likewise, the area for 
liquid flow is obtained from the equation for liquid flow, 
taking as the downstream pressure the back pressure. The 
areas for vapour and for liquid flow are then summed to 
give the required area of the valve orifice. The valve 
selected will have an area greater than or equal to this 
required area. The quantity of vapour formed downstream 
of the orifice of the actual valve should then be rechecked. 

Whilst this method is probably the most widely used, it 
is commonly criticized by workers in the field as lacking 
theoretical basis and experimental validation. Critiques of 
the API method have been given by Leung and Nazario 
(1989) and Leung (1992a). 


[15.6.3] 


The specific volume of the fluid is 

t'„=*o»go + (l-*o )v i0 (15.6.4] 

The following pressures are defined: P the pressure, P h the 
back pressure at the orifice, P c the critical pressure, P a the 
stagnation pressure in the vessel and P s the saturation 
pressure of the liquid (all pressures absolute in Pa). Sub¬ 
scripts 1 and 2 denote upstream and downstream ends of 
the outlet line, respectively. The corresponding pressure 

n = y J15.6.5] 


[15.6.6] 


% 115.6.1 

where the subscripts c and s denote critical and saturation, 
respectively. 
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For the outlet line the following expression is used for the The value of the parameter eo s is then used to determine 
critical pressure at the downstream end: the critical pressure ratio »/ c : 


P?c 


W act (P 0 co\ 1/2 

a-ApJ 


[15.6.8] 


whereA 2 is the cross-sectional area of the outlet line (m 2 ), W 
is the mass flow (kg/s), p is the density (kg/m 3 ) and the 
subscript act indicates actual. 


Saturated liquid 

For the case where the inlet fluid condition is a saturated 
liquid, the vapour fraction x 0 = 0. 

A value of the parameter co is calculated from Equation 
15.6.2. This value is then used in the following equation to 
determine the critical pressure ratio r/ c : 

t/ 2 + (co 2 - 2co)(l - 17 C ) Z + 2co z In rj c + 2ro 2 (l - ?/ c ) = 0 

[15.69] 


From the value of so obtained, the critical pressure P c is 
calculated using Equation 15.6.6. 

If P c < P b the flow is not choked, and P is set equal to 
P b . The mass flux is then calculated from the following 
equation: 

G (-2{«ln(P/P 0 ) + (co - 1) [1 - (P/P„)]}) 1/2 
(P o /v 0 ) V2 m(P„/P-l)+l 

[15.6.10] 

where G is the mass velocity (kg/m 2 s). If P c > P b the flow is 
choked and the mass flux may be obtained either from 
Equation 15.6.10 or from 


Go % 

(p 0 / Vo yp a> vz 


[15.6.11] 


Two-phase mixture 

For the case where the inlet fluid condition is a two-phase 
gas-liquid mixture, the vapour fraction x 0 has a finite 
value. Otherwise the calculation procedure is essentially 
the same as for the case of a saturated liquid. 


Subcooled liquid 

For the case where the inlet fluid condition is a subcooled 
liquid, a distinction is made between a low degree of sub¬ 
cooling and high subcooling. 

A form of the parameter co appropriate to the saturated 
condition is defined as 


+ ^<»s'/s-l &0 [15.6.14] 

From the value of r\ c so obtained, the critical pressure P c is 
calculated using Equation 15.6.6. 

The mass flux is calculated from the following equation: 

G 

(A/0 1/2 

_ {2(1-// s )+2[o^i(// s /) ? )-(co s - 1)Q, s -;?)]} 1 ^ B 

®s(r/sA/-l)+l J 

As the condition of a saturated liquid is approached P 0 —> P s 
and ri s —> 1, so that Equations 15.6.14 and 15.6.15 reduce to 
Equations 15.6.9 and 15.6.10. 

If the case is one of high subcooling, no flashing occurs 
at the throat. The critical pressure ratio is 


P s 

* m P 0 


[15.6.16] 


and the critical pressure is the saturation pressure P s . 

The mass flux is given by Equation 15.6.15, which for this 
case reduces to 


[15.6.17] 


G c = [2p f0 (P 0 -P s )] 1/2 [15.6.18] 

This completes the set of expressions for the mass flow 
through the valve orifice. It remains to consider the valve 
sizing and selection and the effect of the inlet and outlet 
lines. 


Valve sizing 

The pressure relief requirement is specified as a required 
mass flow. The actual mass flux is obtained by the methods 
just described. The required area of the valve orifice is then 

W „ 

Areq= m^ [15 - 619] 


_ Q 0 roP s (v igo y 
S Vto Wgo ) 

The condition for low subcooling is 
2to s 

~ l-F&Os 


whereA is the cross-sectional area of the valve (m 2 ), K is the 

[15.6.12] valve discharge coefficient and the subscript req denotes 
required. 

A valve size is then selected. Since, in general, this will 
have an orifice cross-sectional area slightly larger than that 
required, the actual mass flow will also be larger: 

[ 15 .6. 13 ] Wact =KA act G 3Ct [15.6.20] 


If the case is one of low subcooling, the fluid flashes in the It is this actual mass flow, which is used in the piping 
throat. calculations which follow. 
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Inlet line 

The treatment of the inlet and outlet piping conforms to the 
API requirements. For the inlet piping, these are that the 
piping be as short as possible with the recommendation that 
the line losses be limited to 3% of the gauge set pressure. 

The pressure drop in the inlet line is determined from the 
equation 



where A in is the cross-sectional area of the inlet pipe (m 2 ), 
An is the diameter of the inlet pipe (m), / is the Fanning 
friction factor, g is the acceleration due to gravity (m/s 2 ), H 
is the change in elevation (m), An is the length of the inlet 
pipe (m), AP in is the total pressure difference across the 
inlet pipe (Pa) and V{ n is the average specific volume in the 
inlet pipe (m 3 /kg). The value of K is taken as 0.95. 

The average specific volume in the inlet is evaluated at 
0.98 of the stagnation pressure, so that 



However, if the liquid is subcooled and PJP 0 < 0.98, then 

Vin = Vfo. 


Part A: mass flux 

The initial, or stagnation, state of the liquid is 

P 0 = \ x 10 6 Pa 
T 0 = 298 K 
v io = 0.001658 m 3 /kg 
v so = 0.1285 m 3 /kg 

vtg 0 = 0.1268 m 3 /kg 

C[ 0 = 4806J/kgK 
Ago = 1165430 J/kg 

The mass flux is calculated for two liquid conditions: 
(1) saturated liquid, x a = 0; and (2) two-phase gas-liquid 
mixture, x a = 0.1. The latter is included to illustrate how 
this liquid condition is tackled, but is not strictly relevant 
to the main problem. 

Case 1: saturated liquid 

*o = 0 

v 0 = 0.001658 m 3 /kg 
p 0 = 603 kg/m 3 
a Q = 0 

a = 10.2 (from Equation 15.6.2) 
r\ c = 0.85 (from Equation 15.6.9) 

G c = 6510 kg/m 2 s (from Equation 15.6.11) 

Case 2: two-phase mixture 


Outlet piping 

For the outlet piping, a calculation is made to determine the 
maximum allowable length of the pipe. This is governed by 
the maximum allowable back pressure on the valve. This 
back pressure is specified by the SRVmanufacturer and is 
typically 10% of the differential set pressure for unbal¬ 
anced valves and up to 50% for balanced valves. 

The maximum allowable length of the outlet line is 
determined from the equation 


. 2 , 

( Wut/AiY 




m-co^i+tol 


| ~(1—co)—iy 1+ co 

L (l-C0)»/2 + W 


x a = 0.1 

v a = 0.014 34 m 3 /kg (from Equation 15.6.4) 

p 0 = 69.7 kg/m 3 

a 0 = 0.9 (from Equation 15.6.3) 

to = 2.1 (from Equation 15.6.2) 

r\ c = 0.7 (from Equation 15.6.9) 

G c = 6010 kg/m 2 s (from Equation 15.6.11) 

PartB: sizing of valve and piping 
The pressures around the SRV are: 

Atmospheric pressure = 0.101 MPa (a) 

Backpressure = 0.0101 MPa (a) 

Set pressure = 0.915 MPa (a) = 1.016 (g) 

Differential set pressure = 0.915 - 0.101 = 0.814 MPa 
Relieving pressure = 1.0 MPa (a) 


[15.6.23] 


The gauge relieving pressure is 110% of the differential set 
pressure (1.1 x 0.814 = 0.90) and thus the absolute reliev¬ 
ing pressure is 1.0 MPa. The details of the SRV piping are: 


n ~Po 

p 2 

"2 =pT 


. 1 Elevation of valve, H = 1 m 

[ 5 ' b J Length of inlet pipe, An = 1 m 

. . Equivalent length of outlet pipe, L 2 = 20 m 

Outlet pipe Fanning friction factor,/= 0.005 


where D 2 is the diameter of the outlet pipe (m) and L 2 is the 
length of the outlet pipe (m). 

Illustrative example 

As an illustration of this method, consider the example 
given by Leung, which is the design of an SRV for the 
venting of liquefied ammonia. The example is given in two 
parts, Part A being the determination of the mass flux for 
the specified liquid condition and Part A the sizing of the 
valve itself and of the inlet and outlet lines. 


The SRV is sized for the saturated liquid condition. 
The valve is required to vent a mass flow W leq of 1.0 kg/s, 
the actual mass flux G ac t is 6510 kg/s and the value of the 
valve coefficient K is 0.95. Then from Equation 15.6.19 
the required area A req of the valve orifice is 1.62 x 10~ 4 m 2 . 
Consulting the table of standard valve orifice sizes, the next 
size up is an F size valve with an actual area M act of 
1.98 x 10 -4 m 2 . This is the valve size selected. 

Then from Equation 15.6.20 the actual mass flow is 
W act = 1.22 kg/s. 
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For the size-F valve the diameter D in and cross-sectional 
area A in of the inlet are 0.0409 m and 1.313 x 10 -3 m 2 , 
respectively. An inlet line of the same diameter is used and a 
check is made that the inlet line losses do not exceed 3% of 
the gauge set pressure. Then Equation 15.6.22 with co = 10.2 
and v a = 0.001658 m 3 /kg yields v m = 0.002 m 3 /kg. 

The pressure drop AP in in the inlet line is calculated from 
Equation 15.6.21. For the vertical line the length L in and the 
elevation H are identical at 1 m. The value obtained for AP in 
is 5328 Pa. The inlet line losses are thus much less than 3 % 
of the gauge set pressure of 1.016 x 10 6 Pa. 

For the outlet line, the calculation required is to establish 
that the equivalent length of 20 m is within the maximum 
allowable length of the line. The first step is to determine 
the values to be used for the pressures Pi and P 2 at the inlet 
and outlet of the line, respectively. For Pi the value is 10% of 
the gauge set pressure and is thus 0.183 MPa. For P 2 , from 
Equation 15.6.8 P 2c = 5.64 x 10 4 Pa. The back pressure P b is 
10.1 x 10 4 Pa. Hence P 2c < P b and thus P 2 is set equal to P b . 
Then from Equations 15.6.24 and 15.6.25 »ji = 0.183 and 
r/ 2 = 0.101. 

The line diameter D 2 is taken as that of the valve outlet, 
which is 0.0629 m, giving a corresponding cross-sectional 
areaM 2 of 3.089 x 10“ 3 m.Then with a value of the Fanning 
friction factor / of 0.005, Equation 15.6.23 yields a maxi¬ 
mum allowable line length of 28 m. The actual equivalent 
line length is 20 m, which is within the allowable range. 

15.6.5 Two-phase flow: overall system 

As indicated earlier, there is more to the design of a pressure 
relief for a two-phase vapour—liquid mixture than the 
sizing of the valve orifice. Accounts of overall design for 
pressure relief include those by Crawley and Scott (1984) and 
S.D. Morris (1988b). An overview, with particular reference 
to offshore systems, has been given by Selmer-Olsen (1992). 

Selmer-Olsen identifies a number of difficulties: (1) there 
is no accepted method of deciding when two-phase flow 
needs to be considered; (2) there is no accepted design 
method for two-phase flow; (3) the widely used API method 
may be inadequate; (4) the methods available are generally 
not sufficiently validated by experimental work, particu¬ 
larly on the large scale and (5) there is a strong coupling 
between the thermohydraulic behaviour of the fluid system 
and the flow through the pressure relief device for which the 
commonly used modular approach may be inappropriate. 

The occurrence of two-phase flow can completely alter 
the characteristics of the relief system, in particular the 
behaviour of the fluid in the pipework downstream of the 
pressure relief valve. This can result in increased back 
pressure or in choking in the relief header, possibly with 
oscillating location of the choking throat between the valve 
and the pipe - the multiple choke effect. Potential con¬ 
sequences of such flow effects are prolonged depressuri¬ 
zation times, intermittent flows, high header pressures and 
blowback to lower pressure sources, and high thermal and 
mechanical loads. 

The author identifies the following work relevant to 
the design of a pressure relief system for two-phase flow. 
Work on the sizing of the valve itself includes that of 
Simpson, Rooney and Grattan (1979), Sallet and co-workers 
(Sallet, 1984,1990b,c; Sallet and Somers, 1985), Campbell 
and Medes (1985), Friedel and Kissner (1985,1987,1988), 
S.D. Morris (1988b, 1990a,b), Morley (1989a,b), Alimonti, 
Fritte and Giot (1990), Curtelin (1991), M.R. Davis (1991), 
Simpson (1991) and Leung (1992a). 


Treatments of the inlet line to the valve are given by 
O.J. Cox and Weirick (1980), Zahorsky (1985), S.D. Morris 
(1988b) and Leung (1992a) and treatments of the outline 
line are given by Richter (1978b), Friedel and Lohr (1982), 
S.D. Morris (1988b, 1990b) and Leung (1992a). 

The author states that the method of Leung (1992a), 
based on the homogeneous equilibrium model (HEM) of 
two-phase flow appears to be the increasingly preferred 
choice for flow through the valve, for which it is said to 
be reasonably conservative. He comments, however, that it 
may well not be conservative for the associated inlet and 
outlet lines and downstream tanks. 

The effects of non-equilibrium assumptions are dis¬ 
cussed by Bilicki and Kestin (1990) and Lemonnier et al. 
(1991). 

Experimental work on the flows through a configuration 
relevant to pressure relief has been done by Selmer-Olsen 
(1991,1992), using a converging—diverging nozzle with inlet 
and outlet lines. For short nozzles and low pressures the 
flows exceeded those predicted by the HEM by a factor of up 
to 2. As the throat length and pressure were increased the 
predictions of the HEM were approached, but never reached. 
The concomitant of this is that the flows in the inlet and 
outlet lines may be higher than predicted by the HEM. 

15.6.6 Two-phase flow: computer codes 

A number of computer codes have been developed for 
pressure relief flows. An account is given by Selmer-Olsen 
(1992). 

One of these codes is BLOW-DOWN by Nylund (1983 
DnV Rep. 83-1317,1984). Another is the BLOWDOWN code 
of Haque, Richardson and Saville (1992), described in the 
next section. Other codes include those by Middleton and 
Lloyd (1984), Bayliss (1987), Klein (1987), Evanger et al. 
(1990) and the NEL code PIPES. 

A benchmark exercise on vessel depressurization meth¬ 
ods is described by Skouloudis (1990 CEC EUR 12602 EN). 


15.7 Vessel Blowdown 

Emergency shut-down of a hydrocarbon processing plant 
may involve the depressurization of major process vessels 
by blowdown to the flare. On offshore production platforms 
blowdown is a normal part of emergency shut-down. 

In many cases, blowdown will be two-phase. One aspect 
of the treatment of blowdown is therefore the estimation of 
the flow. The account of flow in relief systems given in the 
previous section is applicable to blowdown. The other 
aspect is the hazards associated with blowdown, particu¬ 
larly the fall in the temperature of the gas. 

15.7.1 BLOWDOWN 

A treatment which covers both aspects has been given by 
Richardson, Saville and co-workers (S.M. Richardson, 
1989; Haque et al., 1990; Haque, Richardson and Saville, 
1992; S.M. Richardson and Saville, 1992). 

The hazards arise essentially due to the large tempera¬ 
ture drop associated with the sudden depressurization 
of a vessel containing gas or vapour. Thus, for example, 
if nitrogen at 150 bar and atmospheric temperature is 
expanded adiabatically down to atmospheric pressure the 
isentropic expansion gives a final gas temperature of 78 K. 

The type of vessel of interest is one that retains, under 
pressure, a vapour space, a layer of liquid hydrocarbon and 
beneath that a layer of water. The potential effects of the 
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temperature drop associated with sudden depressurization 
are chilling of the vessel walls, condensation of vapour to 
form droplets with carryover of these droplets into the flare 
header and formation of hydrates in the hydrocarbon 
liquid. It is therefore of practical interest to be able to pre¬ 
dict the temperature profiles of the fluid phases and of the 
vessel walls. 

An account of a model for vessel blowdown has been 
given by Haque, Richardson and Saville (1992). The model is 
embodied in the code BLOWDOWN. For a non-condensable 
gas, an acceptable estimate of the time profiles of pressure 
in and of flow from the vessel can generally be obtained 
assuming choked adiabatic flow. For this case the authors 
give: 


of the gas at the choke (kg/m 3 ) and subscript s denotes 
isentropic conditions. The expansion is isentropic so that 

Si = S c {15.7.4] 

where S is the entropy of the gas (kJ/kmolK) and the 
subscripts c and i denote choke and vessel, respectively. 
The energy balance is 

//i // c • a/2 {15.74 

where H is the enthalpy of the gas (J/kg). These three 
equations are solved simultaneously using the thermo- 
physical package. The mass flow is then obtained as 


-MV* 

\m ) 




/p\ b+i)/2r 

,PJ 


[15.7.2] 


where A is the cross-sectional area of the choke (m z ), Mis 
the molecular weight of the gas, R is the absolute pressure 
in the vessel (Pa), R is the universal gas constant (J/kg mole 
K), T is the absolute temperature of the gas (K), V is the 
volume of the vessel (m 3 ), Wis the mass flow from the vessel 
(kg/s), y is the ratio of the gas specific heats, p is the density 
of the gas (kg/m 3 ), and the subscript o indicates initial 
conditions in the vessel. 

Since in this model the conditions are adiabatic, it 
excludes heat transfer between the gas and the wall of the 
vessel. By definition, therefore, it cannot be used to deter¬ 
mine the temperature of the vessel wall. On these grounds 
alone a fuller model is needed. Moreover, it turns out 
that this model is also inadequate for the representation 
of the more complex vessel blowdown scenarios of the 
kind described earlier. The BLOWDOWN model has been 
developed to meet this requirement. It consists of a ther¬ 
mophysical model in combination with relationships for 
heat, mass and momentum and for flow through the choke. 
The thermophysical properties are calculated using the 
computer package PREPROP. 

The vessel is modelled as a set of three fluid zones (gas, 
liquid hydrocarbon and water), three corresponding vessel 
wall zones, and the outflow system consisting of the pipe¬ 
work between the vessel and the choke, the choke itself and 
the pipework downstream of the choke. 

The outflow from the vessel is modelled as follows. It is 
assumed that the pressure drop at the orifice is such that 
the flow is critical. For a gas the flow is choked and is 
determined by its velocity through the choke which is equal 
to the velocity of sound in the gas: 


W = CbAapc J15.7.6] 

where Cd is the coefficient of discharge. The value of Cd at 
the choke is generally taken as 0.8. 

For a gas-liquid, thus two-phase, fluid the flow is again 
assumed to be critical, but in this case the velocity does not 
equal the speed of sound. Consider changes in the overall 
pressure difference caused by, say, decreasing the down¬ 
stream pressure. At small overall pressure differences the 
liquid is in the metastable condition and does not flash as 
it passes through the orifice. As the overall pressure dif¬ 
ference increases, the limit of meta-stability is reached. 
There is then no further change either in the flow through 
the orifice or the pressure at the orifice. The fluid down¬ 
stream of the orifice undergoes flashing. The behaviour of 
the fluid is therefore analogous to that of a gas in that a 
critical condition is reached, but differs from it in that the 
speed of sound plays no role. 

For the pressure at which metastability can no longer 
be supported, the authors give the following relation, 
generalized from the work of Abuaf, Jones and Wu (1983): 


P s -P ms = l.l 


n ii a ls {T/T c f{l + 2.2 x KHlI 08 ) 0 ' 5 

7? 5 [1 - (Pg/Pi)] 

T < 0.85T C [15.7.7] 


where P ms is the absolute pressure at which metastability is 
no longer supported (Pa), P s is the absolute saturated 
vapour pressure of the liquid at temperature T (Pa), T is the 
absolute temperature of the liquid upstream of the orifice 
(K), T c is the absolute critical temperature of the liquid (K), 
IT is the depressurization rate (N/m 2 s), p s is the density of 
the gas (kg/m 3 ), p x is the density of the liquid (kg/m 3 ), is the 
surface tension of the liquid (N/m), and subscripts g and 1 
denote the gas and liquid, respectively The depressuri¬ 
zation rate IT is approximated as the pressure difference 
across the orifice divided by the time required to traverse 
twice the diameter of the orifice. 

The flow conditions are then as follows. For the range 

P U >P S , P d <P s : 

P d > Pms flow unchoked 
P d < Pms flow choked 



where a is the velocity of sound in the gas at the choke (m/s), 
Pis the absolute pressure at the choke (Pa), p is the density 


where subscripts d and u denote downstream and 
upstream, respectively. The mass flow through the orifice 
is given by 

W = CdA[2 Pi (P u - P x )] 1/2 ]15.7.8] 
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where C D is the coefficient of discharge and P x is an 
appropriate absolute orifice pressure (Pa). The pressure P x 
is the greater of P ms and P d . The coefficient of discharge is 
taken as approximately 0.65 for an orifice and unity for a 
properly formed nozzle. 

The situations treated in this work are complex and it is 
not practical to construct a model that represents in equal 
detail all the relationships involved. Rather, the authors 
proceeded by seeking to identify the more significant phe¬ 
nomena and to model these accurately. 


Experiments done to validate the model are described by 
Haque et al. (1990,1992) and S.M. Richardson and Saville 
(1992). Two vessels were utilized, one 1.52 m long and the 
other 3.24 m long. In some tests the fluid used was nitrogen, 
in others it was a mixture of light hydrocarbons. The 
papers cited present for selected experiments a number of 
time profiles of the pressure in the vessel and of the tem¬ 
peratures of the gas and the vessel walls. 

Some of these time profiles for tests of blowdown through 
a top outlet are shown in Figure 15.18. Figures 15.18(a) and 






Time (s) Time (s) 

(c) (d) 


Figure 15.18 Profiles of pressure and temperature in blowdown of a vessel (Haque et al., 1992): (a) pressure in 
vessel for nitrogen; (b) temperatures of bulk gas and of vessel wall for nitrogen; (c) temperatures of bulk gas and of 
bulk liquid for hydrocarbon mixture (C 1t 66.6%; C 2 , 3.5%; and C 3 , 30.0%); (d) temperature of sections of vessel inside 
wall in contact with (1) gas and (2) liquid for hydrocarbon mixture (C 1t 66.6%; C 2 , 3.5%;andC 3 , 30.0%). Vertical vessels, 
top outlets. Hatched regions span experimental measurements; solid lines are predictions (Courtesy of the Institution 
of Chemical Engineers) 
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(b) are for a vessel containing nitrogen; the first shows the 
profiles of the vessel pressure, the second those of the tem¬ 
peratures of the gas and of the vessel wall Figures 15.18(c) 
and (d) are for a vessel containing hydrocarbons with the 
composition Ci 66.5%, C2 3.5% and C3 30.0%; the first 
shows the profiles of the gas and the liquid and the second 
those of the vessel wall in contact with these two phases. 

Case studies of the application of the model are also 
described. One is for the blowdown of the suction scrubber 
of a gas compressor and another for the blowdown of a 
gas-condensate separator. The model is also applicable to 
the prediction of an accidental release from a vessel. 

15.8 Vessel Rupture 

In certain circumstances a vessel may rupture completely. 
If vessel rupture occurs, a large vapour cloud can be formed 
very rapidly. Accounts of vessel rupture include those by 
Hardee and Lee (1974,1975), Hess, Hoffmann and Stoeckel 
(1974), J.D. Reed (1974), Maurer et al. (1977), AF. Roberts 
(1981/82) and B. Fletcher (1982). 

15.8.1 Vaporization 

If a vessel containing a superheated liquid under pressure 
ruptures, a proportion of the liquid vaporizes. This initial 
flash fraction is determined by the heat balance, the latent 
heat of vaporization being supplied by the fall in the 
sensible heat of the liquid. The rapid formation of vapour 
bubbles also generates a spray of liquid drops so that 
typically most or all of the remaining liquid becomes 
airborne, leaving little or no residue in the vessel. 

This effect has been demonstrated by J.D. Reed (1974), 
who carried out experiments on sudden vessel depressuri¬ 
zation. In one series of experiments, 3.5 kg of liquid 
ammonia contained at an absolute pressure of 3 bar and a 
temperature of - 9° C in a vessel 15 cm diameter and 45 cm 
high was released using a quick release lid. One of the 
experiments is shown in Figure 15.19, in which the time 
interval between the first and last frame is one-sixth of a 
second. In all the experiments at least 90% of the liquid 
ammonia was vaporized. 

Similarly, Maurer et al. (1977) have carried out experi¬ 
ments (described below) on the rapid release of propylene 
held at pressures of 22-39 bar and temperatures of 
50—80°C. The flash fraction of vapour was 50—65% and 
the remaining liquid formed spray. 

An investigation of the extent of vapour and spray for¬ 
mation and of retained liquid has been made by B. Fletcher 
(1982), who carried out experiments, principally in a ver¬ 
tical vessel of 127 x 47 mm cross-section, in which a charge 
of superheated Refrigerant 11 was depressurized and the 
liquid residue was determined. The results are correlated in 
terms of the ratio (h b lh 0 ) of the height reached by the liquid 
on depressurization h b to the initial height of the liquid h m 
as shown in Figure 15.20. The parameter in the figure is the 
ratio K of the vent area to the vessel cross-sectional area. 
The mass of retained liquid is given by the relation 

Ml -1 [15.8.1] 

m 0 K\m 0 p w \ m 0 J\ 

where m is the mass of fluid, p is the density, and subscripts 
1, o, r and v denote the liquid, initial, retained and vapour, 
respectively. For a full bore release the value of the constant 
K is unity. 


Figure 15.19 Sudden depressurization of a vessel 
containing liquid ammonia underpressure (J.D. Reed, 
1974) (Courtesy of Elsevier Publishing Company) 
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Further correlation of the results is given in terms of the 
superheat AT onb required for vapour nucleation, and hence 
nucleate boiling. The expression for superheat is 


4 RT sat c 
~ AH V MSP\ 


4 a/Pi8 < 1 


[15.8.2] 



Superheat, AT (K) 

Figure 15.20 Sudden depressurization of a vessel 
containing superheated liquid: effect of a restriction on 
the height to which the liquid rises (B. Fletcher, 1982) 
(Courtesy of the Institution of Chemical Engineers) 


where A H v is the latent heat of vaporization, M is the 
molecular weight, P is the absolute pressure, R is the uni¬ 
versal gas constant, Tis the absolute temperature, ATis the 
superheat, 8 is the diameter of the vapour nucleus, a is the 
surface tension and subscripts onb and sat denote onset of 
nucleate boiling and saturation, respectively. 

The proportion of retained liquid was expressed in terms 
of the ratio (h/h,) of the height h of the liquid residue to the 
height h v of the vessel. The limiting value of the superheat, 
or value at the onset of nucleate boiling (A T on ^), corre¬ 
sponds to the situation where all the liquid is retained and 
thus h/kv = 1. 

For Refrigerant 11 the value of AT onb is about 1.9 K. Using 
this value in Equation 15.8.2 with the appropriate physical 
value for Refrigerant 11 a value of 8 can be obtained. Then, 
utilizing this value, the superheat AT onb for other sub¬ 
stances can be obtained. 

The correlation given by Fletcher for the superheat 
effect is shown in Figure 15.21. The proportion of retained 
liquid h/h v falls off rapidly with increase in the ratio AT/ 
AT onb and for values in excess of about 12 falls to less 
than 5%. 

A comparison of the proportion of liquid retained in the 
tank cars in several transport incidents with that estimated 
from Equation 15.8.1 is given as: 


Incident 

Liquid 

Mass fraction retained (%) 

Reported 

Estimated 

Pensacola 

Ammonia 

50 

40 

Mississauga 

Chlorine 

10 

13 

Youngstown 

Chlorine 

44 

37 



A7/A7 onb 

Figure 15.21 Sudden depressurization of a vessel containing superheated liquid: depth of liquid remaining 
(B. Fletcher, 1992) (Courtesy of the Institution of Chemical Engineers) 















EMISSION AND DISPERSION 15/47 


Further work on vaporization following vessel rupture has 
been described by Schmidli, Bannerjee and Yadigaroglu 
(1990). 

15.8.2 Hardee and Lee model 

An investigation of the rapid depressurization of a vessel 
containing a superheated liquid has been described 
by Hardee and Lee (1975). The growth of the cloud is 
considered to occur in three stages, as shown in Figure 
15.22. The first stage is the expansion of the fluid from 
the original vessel pressure to atmospheric pressure, the 
second the entrainment of air, and the third the dispersion 
of the cloud. 

For the first stage, the expansion is assumed to be isen- 
tropic and the flash fraction at the end of the expansion is 
given by the entropy balance 

*l«vl + (1 - *l)Sfl = *2Sv2 + (1 - *2)Sf2 [15.8.3] 


The initial mass of fluid IFmay be expressed in terms of the 
volume given in Equation 15.8.6 as follows: 


W = p 2 V 2 

[15.8.7a] 

*= p 2 U2A 2 td 

[15.8.7b] 

where p is the density. Then, during the second stage, the 
momentum 1 jt is 

= p 2 ulA 2 t t < fa 

[15.8.8a] 

m p 2 ulA 2 ti t>t A 

[15.8.8b] 

= WU 2 

[15.8.8c] 


The momentum may be obtained via the momentum 
balance from the initial pressure Pi and final pressure P 2 
as follows: 


where s is the specific entropy, x is the mass fraction of 
vapour and subscripts f and v denote liquid and vapour and 
1 and 2 initial and final states, respectively. 

The velocity of the expanding fluid may then be obtained 
from the energy balance. Taking the initial velocity «i of the 

XihfL + (1 - *i)Afi = X2K2 + (1 - *2)^2 + *4/2 [15.8.4] 

where h is the specific enthalpy and u is the velocity. 

The first stage is evidently to be regarded as virtually 
instantaneous. At the end of this stage the fluid consists of 
vapour and spray. In the second stage air is entrained, the 
spray is vaporized and the cloud grows. At the end of this 
stage the cloud has attained a height that thereafter does 
not increase. In the third stage the cloud grows, but only in 
the radial direction. 

In the second stage, the momentum of the cloud increases 
linearly with time until the end of the stage is reached at 
the depressurization, or dump, time fa- In the third stage, 
the momentum remains constant. For the second stage the 
volume of the expanding fluid is 

7 2 = UiA 2 t [15.8.5] 


(Pi - P2VI1 = P2U\A 2 Jp-5.8.9] 

where Ai is the area of the vessel aperture. Also, from 
Equations 15.8.8 and 15.8.9 


Aj/a _ u 2 

W Pi-Pi 

For the momentum of a general moving vortex 


[15.8.10] 


1 // = cpuV [15.8.11] 

where c is a constant. The value of the constant c is 
shown by the authors to be approximately 3/2. Then, from 
Equation 15.8.11: 


dr_ 
df U 

2i/, 

^3pF 


[15.8.12] 

[15.8.13] 


where r is the radius of the cloud. 
For a hemispherical cloud 


where A 2 is the area of cloud perpendicular to direction of 
expansion at end of the second stage, t is the time and Fis 
the volume of fluid; subscript 2 denotes the value at the end 
of expansion down to atmospheric pressure. At the end of 
the second stage, and hence at time t A 


V^nr 3 [15.8.14] 

Hence substituting from Equations 15.8.8a and 15.8.14 in 
Equation 15.8.13 and integrating 


V2 = U 2 A 2 t A 


[15.8.6] 



^P2 u 2 / ^2 S j ^ t l/2 

or, from Equation 15.8.8b 



At the end of this stage 


Figure 15.22 Rupture of a vessel containing superheated / 2ij/ h 1 / 4 y 2 

liquid: cloud expansion process (Hardee and Lee, 1975) r = ( J M 
(Courtesy of Pergamon Press) ^ & 


[15.8.15] 


[15.8.16] 


[15.8.17] 
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For the third stage, the height h of the cloud is constant at 
the value of the radius r reached at the end of the second 
stage. Then for a cylindrical cloud 


V = % r*h [15.8.18] 

Since the cloud is now relatively dilute it is possible to set, 
p~ p 3 , where p a is the density of air. Then from Equations 
15.8.13 and 15.8.18: 


Ar_ 2i 1/ 

At 3p a nr 2 h 


[15.8.19] 


and integrating 

'-(5*) W,W ' I5 - 8 - 2 °i 

The use of the model is assisted by the graphs given in 
Figures 15.23 and 15.24, which give the momentum and the 
dump time, respectively. 

For a hazardous release there will be some concentration, 
corresponding to a cloud volume V, below which the cloud 
no longer presents a hazard. The model may be used to 



225 250 275 300 325 

Temperature (K) 


Figure 15.23 Rupture of a vessel containing superheated liquid: momentum release per pound of fuel 
(Hardee and Lee, 1975) (Courtesy of Pergamon Press) 


0.0014 
0.0012 
0.0010 | 

0.0008 } 

| 

0.0006 g- 
0.0004 | 

0.0002 

0 

-50 0 50 100 150 

Initial liquid temperature (°F) 

225 250 275 300 325 

Initial liquid temperature (K) 

Figure 15.24 Rupture of a vessel containing superheated liquid: vessel dump time (Hardee and Lee, 1975) 
(Courtesy of Pergamon Press) 
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determine the range r and time t at which the concentration 
falls below this critical value. 

The authors carried out experiments in which vessels 
containing up to 422 kg of propane and 436 kg of a methyl 
acetylene-propylene-propadiene (MAPP) mixture were 
suddenly depressurized and obtained good agreement for 
the increase of the cloud radius with time and for the cloud 
height. 

Thus for a release of 29 kg of MAPP at a temperature of 
284 K through an aperture of 0.728 m 2 the relation for 
the growth of the cloud radius, derived from Equation 
(15.8.20), is 

r = 8.84f 1//3 [15.8.21] 

where r is the radius (m) and t the time (s). The cloud height 
is 2.74 m. 

Hardee and Lee also describe the use of the model to 
determine cloud growth for the incidents of propane release 
at Lynchburg, Virginia, and of ammonia at Crete, Nebraska. 

15.8.3 Model of Hess, Hoffman and Stoeckel 

Another model for vessel rupture has been given by Hess, 
Hoffmann and Stoeckel (1974). The situation modelled is 
again the depressurization of a superheated liquid. 

After the vessel burst the growth of the cloud is con¬ 
sidered to occur in three stages. The first stage is expansion 
down to atmospheric pressure with flash-off of vapour and 
formation and partial evaporation of spray and some 
admixture of air. The second stage is the evaporation of the 
remaining spray and entrainment of air into the cloud. The 
third stage is the further entrainment of air and, if the fluid 
is flammable, the formation of a flammable mixture. 

The model deals primarily with this third stage. For this 
stage, using spherical symmetry, the basic equation 
describing the variation of concentration c with radial dis¬ 
tance r and time t is: 



where e is eddy diffusion coefficient. Time zero is taken as 
the start of the third stage. The boundary conditions used 
are as follows: 0 < r < a, t = 0, c = c 0 ; r > a, f = 0, c = 0. 
Then from a standard solution given by Carslaw and Jaeger 
(1959, p. 257), Equation 15.8.22 can be integrated to give 


about 230 K. It was estimated that without admixture of air 
the vapour would form a hemisphere with a radius of about 
20 cm, but the actual radius was somewhat larger, implying 
that some air had already been mixed in. This phase was 
complete within about 3 ms. In the second phase the 
remaining liquid propane vaporized on mixing with air, 
from which it obtained the necessary heat of vaporization. 
It was estimated that from the energy balance the vapour- 
air mixture would form a hemisphere with a radius of about 
46 cm. The average concentration of propane was then 
20 %. This phase was complete in about 8 ms. 

The concentrations of vapour obtained following this 
bursting process were compared with those predicted by 
using Equation 15.8.23. The radius of and concentration 
in the initial cloud were obtained from the experiment. 
The eddy diffusion coefficient e was obtained from the 
Prandtl mixing length formula: 

««&' [15.8.24] 

where l is the mixing length and u' the fluctuating velocity 
The mixing length l was taken as the average eddy dia¬ 
meter and the fluctuating velocity ul was taken as the speed 
at which the eddies moved, both quantities being obtained 
from photographs. The parameters required for solution of 
Equation 15.8.23 were then 

c 0 = 20% 
a = 46cm 
t ~ 0.52 m 2 s 

Using these values in the model, good agreement was 
obtained with the results of this experiment. 

15.8.4 Model of Maurer et at. 

A development of the model of Hess, Hoffman and Stoeckel 
has been described by Maurer et al. (1977). In the second 
model it is again assumed that there is a central highly 
mixed core at uniform concentration and that the con¬ 
centration outside this core decays in a Gaussian manner, 
but the second model differs in that it allows for the vari¬ 
ability of the eddy diffusion coefficient, which in the first 
model is assumed to be constant. 

For the air entrainment stage, using spherical symmetry, 
the basic equations given are: 


6(ef) 3/ V/2 




»{ 4 -( 4 ]} 


[15.8.25] 


where a is the radius of the initial cloud formed on com¬ 
pletion of the bursting process and c a is the concentration 
of vapour in the initial cloud. 

The authors carried out experiments in which 40 and 
60 mm diameter cylindrical vessels with a length/diameter 
ratio of 3.5 :1, filled with liquid propane, were heated until 
they burst. The bursting of the vessels was recorded by 
high speed photography. They describe in detail the burst¬ 
ing of a 40 mm cylinder. The time for the vessel itself to 
burst was less than 1 ms. Following bursting the vapour 
cloud formed in two phases. In the first phase the propane 
expanded to ambient pressure and about half the liquid 
flashed off as vapour with the temperature dropping to 



r e =Xc(4et) 1/2 [15.8.27] 

where V g is the effective volume of vapour, X c is a parameter 
characterizing the mass fraction of gas in the core, and 
subscripts c and g denote the core concentration and the 
core radius, respectively. The volume V g is taken as twice 
the mass divided by the density at standard pressure and 
temperature; this allows for the use of spherical symmetry 
to model a hemispherical cloud. 
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The parameter /(X c ) is obtained experimentally. The 
value used is 1.36, which corresponds to a fraction of 
vapour in the core of 50 %. 

In addition, as observed by A.F. Roberts (1981/82), 
the following additional relation for the eddy diffusion 
coefficient may be obtained from a graph of experimental 
results given by the authors: 

c = 0.75^ /3 Q|| [15.8.28] 

Experiments were carried out in which cylindrical vessels 
containing propylene were heated up and then made to 
burst by mechanical means or by a small explosive charge. 
The quantities of propylene used ranged from 0.124 
to 452 kg, the vessel in this latter case being 0.7 m 
diameter x 2.8 m long. The propylene was heated to tem¬ 
peratures of 50-80°C corresponding to pressures of 22-39 
bar. After rupture and flash evaporation the vapour was 
ignited and overpressure generated was recorded. 
Some 50-65% of the liquid vaporized and the rest formed 


spray. The propagation velocity of the cloud boundary was 
followed by the condensation contours, which correspond 
to vapour concentrations of 1 -3%. 

The expansion velocities obtained, and the turbulence 
generated, were high. Only a very small proportion of the 
mechanical energy available was required to generate this 
turbulence. 

The authors correlate their results in terms of a reduced 
time, t/Vg 3 , a dimensionless time t = et/ V^ 3 and a scaled 
distance r/v]J 3 . Some of these results are shown in Figures 
15.25 and 15.26. Figure 15.25 shows the propagation 
velocity w of the cloud boundary. The plateau at short times 
corresponds to the expansion velocities predicted thermo¬ 
dynamically, which ranged from 240 to 370 m/s for vessel 
preheats of 35 and 80°C, respectively. Figure 15.26 gives the 
overpressures measured due to flash evaporation. 

Figure 15.27 shows the concentration profiles and con¬ 
tours predicted by the model. Figure 15.28 shows the ratio 
Vg igJVg of the flammable volume V gj i gn to the total volume 
V g as a function of t. The maximum flammable fraction is 
70% and the period during which a flammable mixture 
exists at all is 0.15 < t < 0.4 s. 
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Figure 15.25 Rupture of a vessel containing superheated liquid (Maurer et at., 1977): propagation velocity of 
vapour cloud boundary due to condensation from humid air (Courtesy of DECHEMA) 
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Figure 15.26 Rupture of a vessel containing superheated liquid: blast wave overpressure due to flash expansion 
(Maurer et at., 1977) (Courtesy of DECHEMA) 


The flammable mixture showed considerable unmixed- 
ness, as evidenced by the afterburning of the cloud sub¬ 
sequent to the pressure-generating combustion. Investigation 
revealed that only some 30—50% of the macromixed gas 
participated in the pressure-generating combustion. Then 
taking the maximum flammable fraction as 70% and the 
fraction of the latter participating in pressure-generating 
combustion as 40%, the maximum fraction of the original 
contents participating in pressure-generating combustion 
is 0.28 (= 0.4 x 0.7). The authors therefore quote a round 
figure for this fraction of 30 %. 


with 

A = A'~ Pa [15.8.30] 

where g is the acceleration due to gravity, r is the radial 
distance, A is a relative density, p is the density, and 
subscripts a and v denote air and vapour, respectively. 
The value of Wat the transition point is taken to be unity. 
For the Hardee and Lee model, Roberts obtains 


15.8.5 Roberts model 

A discussion of vessel rupture in the context of the fireballs 
has been given by A.F. Roberts (1981/82). Roberts compares 
the models of Hardee and Lee and of Maurer et al. in respect 
of the predictions of the transition from control by diffu¬ 
sion to control by gravity slumping, using the transition 
criterion - proposed by Jagger and Kaiser (1981): 


n = 'W±LL [ 15 . 8 . 31 ] 

and for the model of Maurer et al. 

JB / n \ 

N = 0.6^- ( 1 - aj m 1/6 / 1/2 [15.8.32] 


_ grA 

~ (dr/dif 


[15.8.29] where Af is the initial mass of liquid and a is the momentum 

per unit mass. 
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Figure 15.27 Rupture of a vessel containing superheated liquid - model predictions (Maurer et at., 1977): 
(a) concentration profiles; (b) concentration contours (Courtesy of DECHEMA) 


Then, for a transition with N = l, Roberts obtains for 
propane for the time t s to transition for the Hardee and 
Lee model 

t g = 0.05a [15.8.33] 

and for that of Maurer et al. 

tg = 10AT 1/3 [15.8.34] 

Also in the Hardee and Lee model the concentration c at 
transition is 

C = 22AL 1/4 a- 3/2 [15.8.35] 

Thus, in both models gravity slumping becomes more 
important as the release size increases. With increase in 
release size the concentration at transition to gravity 
slumping also increases. 


Roberts also gives the following expression for the radial 
velocity w in the Hardee and Lee model: 





V g = 2 M/p v [15.8.37] 

where V g is the volume of vapour released and the factor of 2 is 
included to allow for the hemispherical symmetry. Substitut¬ 
ing values for propane of p r /p a = 2 and a = 220 m/s gives 
/ t \ - 3 /4 

w = 1 ' 0_ W [15 ' 8 ' 38] 

He comments that this also agrees well with the data of 
Maurer et al. 
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Figure 15.28 Rupture of a vessel containing superheated liquid - model predictions (Maurer et al., 1977): 
fractions of flammable and reacting gas (Courstey of DECHEMA) 


15.8.6 Other treatments 

A further discussion of vessel rupture has been given by 
Appleton (1984 SRD R303). 

15.8.7 Entrainment of air 

The cloud formed from a vessel rupture entrains air. The 
determination of the amount of air entrained is important, 
because the cloud constitutes the source term for disper¬ 
sion models and these models are rather sensitive to the 
degree of air entrainment. The air entrained may be esti¬ 
mated using the models just described. Alternatively, use 
may be made of empirical relations. 

Air entrainment has been discussed by Griffiths and 
Kaiser (1979 SRD R154) in relation to rupture of vessels 
containing liquefied ammonia. They propose for ammonia 
the rule-of-thumb that in such a release the ammonia mixes 
with ten times as much air by mass. They also state: ‘to the 
accuracy that is possible here, this is also equivalent to 
mixing in about ten times as much air by volume’. 

This estimate is based partly on the incident at Potch- 
efstroom in which a horizontal pressure vessel burst, 
releasing 38 te of ammonia through a hole some 7 m 2 . From 
eyewitness accounts the immediate resulting gas cloud was 


‘about 150 m in diameter and about 20 m in depth’. They also 
refer to the work of van Ulden (1974) in which 1 te of Freon 12 
was poured onto water, giving immediate vigorous boiling 
and rapid formation of a gas cloud in which the volume of 
air was about 10 times that of the Freon. 

The rule-of-thumb that for a vessel rupture the volume of 
air entrained is some 10 times that of the gas released has 
been widely used in the modelling of heavy gas dispersion. 

Griffiths and Kaiser give an example of a release of 20 te 
of liquefied ammonia, giving 4 te of vapour and 16 te of 
spray. If sufficient dry air is entrained at 20°C just to eva¬ 
porate the drops, this requires 400 te of air, or a factor of 20 
on the mass of ammonia released. This gives a cloud at a 
temperature of -33°C and a relative density of 1.18. The 
density of the cloud is greatly in excess of that of air and the 
cloud will exhibit heavy gas behaviour. 

15.8.8 Storage tank rupture 

A quite different problem arises when rupture of an atmo¬ 
spheric storage tank occurs. If the rupture is sufficiently 
sudden and complete, a wave of liquid surges outwards and 
may overflow the bund. This hazard is considered further 
in Chapter 22. 
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15.9 Pipeline Rupture 

Another situation that can lead to a large release of gas or 
vapour is rupture of a pipeline. Pipelines that may give rise 
to such a release are principally those carrying either high 
pressure gas or liquefied gas. In each case, while the deter¬ 
mination of the initial emission rate is relatively straight¬ 
forward, the situation then becomes rather more complex. 

15.9.1 Gas pipelines 

Accounts of emission from pipelines containing high pres¬ 
sure gas have been given by R.P. Bell (1978), D.J. Wilson 
(1979b), Picard and Bishnoi (1988, 1989) and J.R. Chen, 
Richardson and Saville (1992). 

An empirical model for flow from a pipeline rupture has 
been given by R.P. Bell (1978). This model may be written as 

m = —— K exp(-f/x 2 ) + nw exp(-f/n)] [15.9.1] 


where 0 is a parameter. Furthermore, 




JV = 8[1 — exp(—26400d//)] 


- [exp(—f/T 2 ) + iA exp(-//n)] 


with 

<A = mr/m 0 

faR/v! 

TJ = Wa/mr 

i2 = iA 2 n 


—(?n 




45.9.11] 


[15.9.2] 

[15.9.3] 

[15.9.4] 


where A is the cross-sectional area of the pipeline, d, is the 
diameter of the pipeline, / is the friction factor, / is the 
length of the pipeline, m a is the initial mass flow from 
the pipeline, m T is a steady-state, or reference, flow from the 
pipeline defined by Equation 15.9.2, Ais a correction factor, 
P is the absolute pressure, W„ is the initial mass holdup in 
the pipeline, p is the density and n and t 2 are time con¬ 
stants. The friction factor /is evidently the Darcy friction 
factor / D (= 8(A). 

For the correction factor N, Bell gives the empirical 
formula 


[15.9.5] 


He also states that he used a value of 0.02 for the friction 
factor /. 

Bell also discusses the dispersion from the pipeline. 

D.J. Wilson (1979b) has derived a rather more complex 
model, but also states that Bell’s model compares quite well. 

A formulation of the Bell model has been given by the 
CCPS (1987/2) and this may be put in the following form: 


where M is the molecular weight, R is the universal gas 
constant, T is the absolute temperature, u s is the velocity of 
sound and y is the ratio of the gas specific heats. 

More complex treatments are given by Picard and Bishnoi 
(1988,1989) and J.R. Chen, Richardson and Saville (1992). 
The work of the latter authors is treated in Section 15.9.3. 

15.9.2 Liquefied gas pipelines 

Accounts of emission from pipelines containing lique¬ 
fied gas are given by Inkofer (1969), Westbrook (1974) and 
T.B. Morrow, Bass and Lock (1982). 

Inkofer (1969) discusses the factors determining the 
rate of emission in a liquid ammonia pipeline rupture. He 
envisages an initial spurt of liquid followed by a period of 
prolonged and spasmodic ejection of liquid and vapour due 
to the effect of vapour locks at humps along the pipeline. 

Estimates of the rate of emission from a rupture in a 
chlorine pipeline have been given by Westbrook (1974). These 
estimates are an initial escape rate of 60.3 ton/h from each of 
two 4 in. orifices and a total escape of 28.4 ton in 24 min. 

T.B. Morrow, Bass and Lock (1982) have given a method of 
estimating the flow from a pipeline containing liquefied gas. 
They consider two cases: complete rupture and partial 
rupture. For the two-phase critical flow at the rupture 
point the method utilizes Fauske’s slip equilibrium model. 
Upstream of the rupture point it is assumed that there is a 
transition, or interface, point at which the flow changes from 
liquid flow to two-phase flow and that this point is that at 
which the pressure corresponds to the bubble point of the 
liquid.The basic equation for the two-phase pressure drop is 


dz = ld* ' 15 - 9 ' 12 1 

where / is the friction factor, u is the velocity, v is the 
specific volume, z is the distance along the pipe from the 
rupture point, <j) g is a parameter, and subscripts f and fs 
denote liquid and superficial value for liquid, respectively. 
The friction factor/is the Fanning friction factor (=20). 
The actual liquid velocity u f is 


[15.9.6] 


15.9.7a] 

[15.9.7a] 

115.9.8] 

[15.9.9] 


ttfs 

*=T^F 

where Fis the void fraction. The parameter <f> 

f 

Then from Equations 15.9.12-15.9.14 
dP _ 2/«| 


[15.9.13] 


[15.9.15] 
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Using the same assumption for slip as made by Fauske in 
the derivation of the slip equilibrium model, namely 



where subscript g denotes vapour. Expressing the quality 
in terms of the fluid enthalpies, and hence of pressure, the 
authors obtain 



dP _ 2fm 2 V{ 
d z~ AHf(P) 


[15.9.17] 


[15.9.18] 


In order to integrate Equation 15.9.18 the mass flow m is 
expressed as a function of the distance z from the rupture 
point: 


[15.9.19] 


where subscript e denotes the rupture point, or exit, and i 
denotes the transition, or interface, point. Expressions are 
also given for the volume of the vapour space, and hence of 
the liquid removed, between the transition and rupture 
points. The model allows the mass flow from the rupture 
point and the position of the transition point to be deter¬ 
mined as a function of time. 

The authors have used the model to study ruptures in the 
propane pipeline system shown in Figure 15.29. They 


investigated different pumping station distances, valve 
spacings and shut-down times of the upstream pump, with 
valves shut down 5 min after the pump. Typical results 
for the flow profiles given by ruptures are shown in 
Figure 15.30. Curve A shows the flow for a complete rup¬ 
ture. This flow is for some time unaffected by pump shut¬ 
down and valve closure, since the two-phase interface 
moves relatively slowly. For example, for a spacing between 
pumps of 15 miles the interface is estimated to reach the 
isolation valves at 754 miles only after some 25 min. Curve 
B in Figure 15.30 shows the flow for a partial rupture. In 
this case the pressure is maintained at the value before 
rupture until the pump shuts off, then falls, and finally 
reaches a new steady value corresponding to the bubble 
point. The fall may approximate to a ramp or may change to 
a steeper slope as the isolation valve shuts. 

A description of the actual pipeline break at Port Hudson 
has been given by the NTSB (1972 PAR-72- 01) and Burgess 
and Zabetakis (1973 BM RI7752). The event is described in 
Case History A52. 


15.9.3 BLOWDOWN 

An account has been given in Section 15.8 of the model 
BLOWDOWN developed for the prediction of conditions 
during blowdown of, or release from, a vessel. This model 
has also been adapted for use in the determination of con¬ 
ditions arising during outflow of fluid from a pipeline, 
whether as intentional blowdown or accidental release. 

One of the topics in which the Piper Alpha Inquiry was 
interested was the explanation of the change in pressure 
that occurred during the accident in the gas pipelines con¬ 
nected to the platform. Evidence on this topic, based on the 
use of the BLOWDOWN code, was presented to the inquiry 
by Richardson (1989b). 



• Pipeline flow rate 

• Isolation valve spacing 

• Pump stations 

• Pump shut-off time 

• Valve closure time 

• Break sizes 


40 000 bbl/day 
45, 15 and 5 miles 
45 miles apart 
5 min and 20 min 
after rupture 
5 min after pump 
shut-off time 
Complete break (venting 
from both ends), 
and partial break 
(initial venting rate 
10 000 bbl/day) 


Figure 15.29 Emission from an LPG pipeline: configuration of pipeline studied (T.B. Morrow, Bass and Lock, 1982) 
(Courtesy of the American Society of Mechanical Engineers) 
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Figure 15.30 Emission from an LPG pipeline: flow of propane for partial and complete ruptures. Isolation value 
spacing = 45 miles (T.B. Morrow, Bass and Lock, 1982) (Courtesy of the American Society of Mechanical Engineers) 


An account of the extensions made to the BLOWDOWN 
model to allow it to be applied to a gas pipeline has been 
given by J.R. Chen, Richardson and Saville (1992). The basic 
model comprises the unsteady one-dimensional Euler 
equations supplemented by friction and heat transfer rela¬ 
tions. Chen et al. describe the investigation of a number of 
methods for the solution of these equations, including 
finite difference methods (FDMs), the method of char¬ 
acteristics (MOC), a hybrid method and a wave tracing 
method. The technique found to be most efficient and 
accurate was the multiple wave tracing method. 

The investigation made use of the test problem of Picard 
and Bishnoi (1989) and of data on the depressurization of 
the pipeline between Piper Alpha and MCP- 01 on the night 
of the accident. Results are presented which include values 
of the intact end pressure, the open end pressure and the 
release rate. 

15.9.4 Pipeline isolation 

The quantity of material released from a pipeline rupture 
depends on whether the section of line is isolated or not. 
The arrangements for line break detection and isolation are 
therefore of the greatest importance in minimizing escapes. 


15.10 Vaporization 

If the fluid that escapes from containment is a liquid, then 
vaporization must occur before a vapour cloud is formed. 
The process of vaporization determines the rate at which 
material enters the cloud. It also determines the amount of 
air entrained into the cloud. Both aspects are important for 
the subsequent dispersion. Selected references on vapori¬ 
zation are given in Table 15.7 

15.10.1 Vaporization situations 

In considering the generation of a vapour cloud from 
the liquid spillage, the following situations can be dis¬ 
tinguished: 

(1) A volatile liquid at atmospheric temperature and 
pressure, for example, acetone. 

(2) A superheated liquid 

(a) at ambient temperature and under pressure, 
for example, butane; 

(b) at high temperature and under pressure, 
for example, hot cyclohexane. 

(3) A refrigerated liquefied gas at low temperature but at 
atmospheric pressure, for example, cold methane. 
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Table 15.7 Selected references on vaporization 


Liquid spreading 

Stoker (1957); Abbott (1961); Fay (1969); Hoult (1969,1972b); 
Fannelop and Waldman (1972); Webber and Brighton 
(1986SRDR317) 

Spillage and evaporation 

Hinchley and Himus (1924); O.G. Sutton (1934); RW. Powell 
and Griffiths (1935); Lurie and Michailoff (1936); RW. 
Powell (1940); T.K. Sherwood (1940); Wade (1942); Pasquill 
(1943); Linton and Sherwood (1950); Langhaar (1953); 
Burgoyne (1965b); Humbert-Basset and Montet (1972); 
Pancharatnam (1972a,b); Mackay and Matsugu (1973); 
AGA (1974); V.J. Clancey (1974a, 1977c); Kalelkar and Cece 
(1974); Drake and Reid (1975); Feind (1975); Opschoor 
(1975b, 1978); Japan Gas Association (1976); Meadows 
(1976); Bellus, Vincent etd. (1977); Deacon (1977); HSE 
(1978b); Reid and Wang (1978); Shaw and Briscoe (1978 SRD 
R100); Flothmann, Heudorfer and Langbein (1980); 

N.C. Harris (1980,1982); Reijnhart etal. (1980); Reijnhart 
and Rose (1980); Raj (1981,1991); Brutsaert (1982); Drivas 
(1982); Hilder (1982); O’Shea (1982); Jensen (1983); Kunkel 
(1983); Webber and Brighton (1986,1987 SRD R390); Anon. 
(1985i); Brighton (1985b, 1986 SRD R371,1987 SRD R375, 
1990); Pikaar (1985); Prince (1985 SRD R324); Lebuser and 
Schecker (1986,1987); Moorhouse and Carpenter (1986); 
Kawamura and Mackay (1987); Webber (1987 SRD R421, 
1988 SRD R404,1989); Webber and Jones (1987); Studer, 
Cooper and Doelp (1988); Deaves (1989); Lantzy 
etal. (1990); Raj and Morris (1990); J. Singh and McBride 
(1990); J.L Woodward (1990); Alp and Matthias (1991); 
Mikesell et at. (1991); Angle, Brennan and Sandhu (1992); 
Frie et al. (1992); Stramigioli and Spadoni (1992); J. Cook 
and Woodward (1993a,b); Leonelli, Stramigioli and 
Spadoni (1994); Takeno et al. (1994) 

Solar radiation, solar constant 

Fritz (1954); C.O. Bennett and Myers (1962); N. Robinson 
(1966); Coulson (1975); L.B. Nielsen etal. (1981); Multer 
(1982); Lide (1994) 

Burning spills 

Opschoor (1975a,b, 1980) 

Spillage and vaporization on water 

Blokker (1964); Burgess, Murphy and Zabetakis (1970 RI 
7448); Enger and Hartman (1972a,b); Hoult (1972a); 
Kneebone and Boyle (1973); Mackay and Matsugu (1973); 
Raj and Kalelkar (1973,1974); Raj, Hagopian and Kalelkar 
(1974); Drake, Jeje and Reid (1975); Eisenberg, Lynch and 
Breeding (1975); Opschoor (1975a, 1977,1980); Raj etal. 
(1975); Dincer, Drake and Reid (1977); Griffiths (1977 SRD 
R67); Havens (1977,1980); HSE (1978b); Shaw and Briscoe 
(1978 SRD R100); Raj and Reid (1978a,b); Reid and Smith 
(1978); Raj (1979,1981,1991); Shell Research Ltd (1980); 
Anon. (1982f); Chang and Reid (1982); Dodge etal. (1983); 
Hirst and Eyre (1983);Waite etal. (1983); Prince (1985 SRD 
R324); Zumsteg and Fannelop (1991); J. Cook and 
Woodward (1993a) 

Flash-off, flash fraction, aerosol 

NRC (Appendix 28 Aerosols)', Pinto and Davis (1971); 

A.R. Edwards (1978); Mesler (1985); API (1986 Publ. 4456); 
Ramsdale (1986 SRD R382,1987 SRD R401); Emerson 
(1987b); Bache, Lawson and Uk (1988); Britter and 


McQuaid (1988); I. Cook and Unwin (1989); Lantzy etal. 
(1990); Schmidli, Bannerjee and Yadigaroglu (1990); 

D.W Johnson (1991); D.W. Johnson and Diener (1991); Raj 
(1991); Kukkonen andVesala (1991,1992); J.L. Woodward 
and Papadourakis (1991) 

Vaporization in jets (see Table 15.40) 

Spill control 

BDH (1970); Anon. (1972b); May, McQueen and Whipp 
(1973); AIChE (1974/99,1988/100,1989/70); May and 
Perumal (1974); University Engineers Inc. (1974); 
Weismantel (1974); Welker, Wesson and Brown (1974); 
Lindsey (1975); Otterman (1975); Wirth (1975); 

L.E. Brown etal. (1976);WD. Clark (1976b); Martinsen and 
Muhlenkamp (1977); D.P. Brown (1978); Harsh (1978a,b); 
Norman and Dowell (1978,1980); Whiting and Shaffer 
(1978); Kletz (1982i); Jeulink (1983) 

Vaporization suppression 

R.H. Hiltz (1982,1987); Dilwali and Mudan (1986,1987); 
Norman (1987); ASTM (1988 F1129); Dimaio and Norman 
(1988,1990); Norman and Dimaio (1989); Leone (1990); 
Norman and Swihart (1990); Martinsen (1992); Howell 
(1993); Scheffler, Greene and Frurip (1993) 


The vaporization of the liquid is different for these three 
cases. In the first case the liquid after spillage is approxi¬ 
mately at equilibrium and evaporates relatively slowly. 
In the second case the liquid is superheated and flashes 
off when spilt, and then undergoes slower evaporation. 
The first category of a superheated liquid, at ambient tem¬ 
perature but under pressure, is that of a liquefied gas, while 
the second, at high temperature and under pressure, is that 
of a liquid heated above its normal boiling point. The third 
case is that of a refrigerated liquefied gas that on spillage 
evaporates rapidly at first and then more slowly. 

15.10.2 Vaporization of a superheated liquid 

If the liquid released from containment is superheated, a 
proportion flashes off as vapour. The remaining liquid is 
cooled by the removal of the latent heat of vaporization and 
falls to its atmospheric boiling point. 

The theoretical adiabatic flash fraction (TAFF) of vapour 
so formed is usually determined by the simple heat balance 

^ = A (Ti_Tb) Ti>Tb PttMJ 

where c p is the specific heat, T is the absolute temperature, 
AH V is the latent heat of vaporization, 0 is the fraction of 
liquid vaporized and subscripts b, i and 1 denote boiling 
point, initial and liquid, respectively. 

An alternative expression that takes account of the dif¬ 
ferential nature of the vaporization is 

(1 - </>)Cpi(—dT) = A H w d<j> [15.10.2] 

and hence 

<£ = l-exp[-^(Ti-T b )] 7j>T b [15.10.3] 

Equations 15.10.1 and 15.10.3 give the theoretical fraction of 
vapour formed. The sudden growth and release of vapour 
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bubbles also results in the formation of liquid droplets, or 
spray. The mass of liquid in spray form is generally of the 
same order as that in the initial vapour flash and may 
exceed it. 

This spray then either vaporizes, increasing the vapour 
cloud, or rains out as liquid, forming a pool on the ground. 
The total amount of vapour formed, both that from the 
initial flash and that from the evaporation of spray, con¬ 
stitutes the ultimate flash. 

For the fraction of liquid which forms spray a rule-of- 
thumb frequently used is that it is equal to the initial 
vapour flash (Kletz, 1977J). Another rule-of-thumb is that if 
the fraction flashing off is small it may be appropriate to 
assume that the spray fraction is two or three times the 
initial vapour flash-off (W.G. High, 1976). 

A discussion of spray and rainout following the dis¬ 
charge of a flashing liquid, with particular reference to 
liquid ammonia, has been given by Wheatley (1986). Two 
discharge situations may be distinguished: meta-stable 
flow of a superheated liquid and choked two-phase flow. 
These two cases have been modelled by Wheatley. As 
shown in Table 15.8, the flow characteristics obtained are 
significantly different. 

In the non-choked liquid flow case there is a large 
increase in diameter of the flow at the outlet. Such large 
increases have been observed in the Desert Tortoise tests 
(Koopman et al., 1986). In the choked two-phase flow case 
the flow velocity is much higher. The flash fraction is 
similar in the two cases. 

The drops formed are subject to shear stress and there is 
a maximum size of drop given by the drop Weber number: 



where d is the diameter of the drop, u is the velocity, p is the 
density, a is the surface tension and subscript d denotes drop. 
Table 15.8 shows the drop sizes obtained for the two cases. 

The extent to which rainout of the drops occurs depends 
on a balance between the inertial and gravity forces. The 
drops will have higher inertia than the vapour but will be 
more affected by gravity. Wheatley treats rainout in terms 
of the inclination of the bounding drop trajectory, which is 
obtained from the ratio of the settling velocity to the hor¬ 
izontal velocity of the drops. The settling velocity and 
inclination of the drops for the cases considered are shown 
in Table 15.8. Both for the superheated liquid flow and the 
choked two-phase flow the inclinations are too small to give 
significant rainout, but for the refrigerated liquid flow the 
inclination is much larger and rainout could be significant. 


Following flash-off, the residual liquid is at its normal 
boiling point. Vaporization then continues as a rate-limited 
process. This secondary stage of rate-limited vaporization 
is usually regarded as relatively less important compared 
with the initial flash-off, particularly with respect to the 
formation of flammable gas clouds. 

The spray fraction from a ruptured vessel was con¬ 
sidered in Section 15.7. Frequently, very little liquid is left in 
the vessel. The spray fraction in fireballs is discussed in 
Chapter 16. 

15.10.3 Mass and heat transfer for a pool 

In general, vaporization from a pool is a mass and heat 
transfer limited process, but in a specific case there may be 
one dominant transfer mode. Thus for vaporization of a 
cryogenic liquid it is the heat transfer from the ground to 
the pool which governs the rate of vaporization. 

For a pool there is only one mode of mass transfer, 
that between the liquid surface and the atmosphere. By 
contrast, for heat transfer there are several modes, namely 
heat transfer by convection between the liquid surface and 
the atmosphere, by conduction between the liquid and the 
ground, and by radiation, both solar and between the liquid 
surface and the atmosphere. 

The heat balance on the pool is thus 


wc p i ^ = —A p (q v - q cn - q ci - q t ) [15.10.5] 

It = Qrs + Qa - Qrl [15.10.6] 

?T = m,AH, [15.10.fJ 

where A p is the area of the pool, c p] is the specific heat of the 
liquid, m v is the mass vaporization rate per unit area, q ci is 
the heat flow per unit area by conduction from the ground to 
the pool, q CB is the heat flow per unit area by convection 
from the atmosphere to the pool, q T is the net heat flow per 
unit area by radiation to the pool, q la is the heat flow per unit 
area by radiation from the atmosphere to the pool, q A is the 
heat flow per unit area by radiation from the pool to the 
atmosphere, q IS is the heat flow per unit area by solar radia¬ 
tion to the pool, q v is the heat required per unit area for 
vaporization, t is the time and w is the mass of liquid. 

The mass balance on the pool is 


— = A p m v [15.10.8] 


Table 15.8 Flow characteristics of discharge of liquid ammonia (after Wheatley, 1986) (Courtesy of 
the Institution of Chemical Engineers) 


Storage Flow Axial Flow Flash Spray characteristics Inclination (°) 

temperature (°C) type velocity (m/s) diameter (cm) fraction (%) - 

Drop Settling 
size (pm) velocity (m/s) 


20 Liquid 154 13 17.6 25 0.013 0.0048 

20 Two-phase 37.7 61 18.7 420 1.4 2.1 

-34 Liquid 1900 5.2 16 
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KMW-pJl 

— RT^~ 


[15.10.9] 


where k m is the mass transfer coefficient, p° is the vapour 
pressure of the liquid and pao is the partial pressure of the 
liquid outside the influence of the pool. The partial pressure 
p a o can usually be set equal to zero. For a multi-component 
liquid Drivas (1982) has modified Equation 15.10.9 as follows: 


RTn T Y,$Mi 


exp (-kpist) 


[15.10.10] 




[15.10.11] 


where M t is the molecular weight of component i, is the 
initial mass of the liquid, n r is the number of moles of the 
liquid, p is is the vapour pressure of component i, is the 
initial mole fraction of component i in the liquid and k is a 
constant. 

In general, heat transfer may be correlated by the factor 
ju of Chilton and Colburn (1934) and mass transfer by the 
corresponding factor j m . For a geometry where the char¬ 
acteristic dimension is the diameter d these j factors are 
defined as 


A 


= StPr 0 ' 67 


[15.10.12] 


km Cbm o 

= VcT Sl 


[15.10.13] 


where C Bm is the log mean concentration difference, Cr is 
the total concentration and k m is the mass transfer 
coefficient. The term CBm/Cx is the drift factor. 

The definitions of, and relations between, the Reynolds 
number Re, the Prandtl number Pr, the Nusselt number Nu, 
the Schmidt number Sc and the Stanton number St are 


Given a correlation for j h , the heat transfer coefficient h 
may he obtained from the definition of jb in Equation 
15.10.12. Then, using the approximate equality, 

j m e*h [15.10.20] 

and using the definitions of/h, andj m in Equations 15.10.12 
and 15.10.13 



Alternatively, if the correlation available is for j m this 
may be used to obtain;),. For other geometries the diameter 
d is replaced by the characteristic length. 

A number of workers have measured mass transfer from 
a plane liquid surface to a gas stream above, particularly in 
the evaporation of water. An account is given by Coulson 
and Richardson (1977—). Their results have been correlated 
by T.K. Sherwood (1940) in terms of a point Reynolds 
number Re x where the characteristic dimension is the 
distance across the liquid surface to the point considered. 
His results may be expressed as 

j m = 0.0415Re“°' 21 [15.10.22] 

over the approximate range 10 4 <Re x <10 5 . Equation 
15.10.22 may be used, in conjunction with Equation 
15.10.20, to obtain both the mass and heat transfer 
coefficients. 

The mass transfer coefficient may also be correlated 
directly in terms of the Sherwood number Sh: 


Sh = ^ [15.10.23] 

Fleischer (1980) has given the following correlation for the 
Sherwood number over a plane liquid surface: 

Sh = 0.037Sc 1/3 (Re°' 8 - 15,200) [15.10.24] 


n r 10 14i The transition from the laminar to the turbulent regime is 
^ ‘ taken here to occur at Re = 320,000. 

In the case of the plane liquid surface there is also avail¬ 
able for the mass transfer a specific correlation for the 
[15.10.15] evaporation rate derived by Sutton and Pasquill. This is 
described in Section 15.10.4. 

Heat transfer from the ground is complex, because it 
involves an unsteady-state process. An account of unsteady- 
[15.10.loJ state heat t rans f eri including many standard cases, is given 
by Carslaw and Jaeger (1959). The basic equation is 


[15.10.17] d^_J_d0 

d?“^df 


[15.10.25] 


[15.10.18] 


with 

9=T-T S 


[15.10.26] 


[15.10.19] 


ks 

Ps c ps 


[15.10.27] 


where d is the pool diameter, D is the diffusion coefficient, where a is the thermal diffusivity, 6 the temperature above 
k is the thermal conductivity and n is the viscosity. the datum, or soil, temperature and subscript s denotes soil. 
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For the case of constant liquid temperature, Equation 
15.10.25 may be solved with the boundary conditions z = 0, 
9 = 6yZ = oo,6 = 6 S . For temperature this gives 


0 

01 



[15.10.28] 


where z is the vertical distance down into the ground and 
subscript 1 denotes liquid. 

For the heat flow per unit area q 


? = 


[15.10.29] 


The albedo of a plane water surface has also been dis¬ 
cussed by Shaw and Briscoe (1978 SRD R100).The albedo is 
actually a function of the sun’s elevation. They give the fol¬ 
lowing values: 


Elevation (°) 90 50 40 20 10 0 

Albedo 0.02 0.025 0.034 0.134 0.348 1.0 


Data on the albedo for different surfaces are given by Oke 
(1978). A further discussion of albedo is given by Byrne 
etal. (1992 SRD R553). 


Then from Equations 15.10.28 and 15.10.29 and 



For the total heat transferred per unit area Q 


[15.10.30] 




qdt 


[15.10.31] 


15.10.4 Sutton-Pasquill model 

A model for mass transfer in evaporation from a liquid 
surface at constant temperature has been derived by 
O.G. Sutton (1934). Sutton’s model was subsequently modi¬ 
fied by Pasquill (1943) and the modification was accepted 
by O.G. Sutton (1953). In the form given by Pasquill, the 
relations for evaporation from a rectangular and a circular 
pool are: 

E=Kuf~' ,)/i2+n) x l J^yo rectangular pool [15.10.37] 


and from Equations 15.10.30 and 15.10.31 


E=K'uf~ n)l ^ n) r^l^ circular pool 


Q = 2 0^/2 [15.10.32] 

For the more complex case of varying liquid temperature, 
Equation 15.10.25 may be solved with the boundary condi¬ 
tions f = 0, 0 = 0; 2 = 0, 0 = 0i(f); 2 = 00, 0 = 0. For 
temperature this gives 



[15.10.38] 


[15.10.39] 


=-^ [‘ -^ exp[-—^—-] dr [15.10.33] 

2(na s ) 1/2 Jo (t-rf 2 l 4a s (/-r)J 


The decrease in temperature of a vaporizing pool will he 
approximately exponential. An analytical solution of 
Equation 15.10.33 for the case 0i = exp( -it), where X is a 
constant, is given by Carslaw and Jaeger. 

For heat transfer by radiation the net heat radiated to the 
pool is given by Equation.15.10.6. The individual terms in 
the equation are given by 


« = #(!-«} 

[15.10.34] 

i = 

[15.10.35] 

= £1 alf 

[15.10.36] 


where a is the albedo of the liquid surface, t is the emis- 
sivity, a is the Stefan-Boltzmann constant, is the solar 
constant and subscript a denotes atmosphere. The value of 
the solar constant is 1373 W/m 2 (Lide, 1994). 

The albedo and emissivities have been discussed by 
Mackay and Matsugu (1973), who propose for the albedo a 
value of 0.14 and for the emissivities of the atmosphere and 
of the liquid values of 0.75 and 0.95, respectively. 


2 2 +» Jc 1 / 2 r(3 + w /2 + «)A' 
r(8 + 3«/2(2 + »)) 


[15.10.40] 


c , | [(V2)] 1 - , ’(2-K) 1 -y-” | 
I (1 — n) (2n — 2) 2(1_ ^ | 


»)/(2—K) 

[15.10.41] 


Xo = l V T [15.10.42] 

where E is the evaporation rate (g/s), k is the von Karman’ 
constant, M is the molecular weight, n is the diffusion 
index, p° is the vapour pressure of the liquid (dyn/cm 2 ), r is 
the radius of the pool (cm), R is the universal gas constant 
(erg/gmol K), T is the absolute temperature (K), u.\ is the 
wind speed at height Z\ (cm/s), x 0 is the downwind length of 
the pool (cm),y 0 is the crosswind width of the pool (cm), zi is 
the height at which the wind speed % is measured (cm), i is 
a parameter (cm 2 /s), is the concentration (g/cnr) and a, 
K and K! are constants. The constant K may be written as: 


K = [15.10.43] 

^X„/i(«) 2/(2+ ’’ ) / 2 («) 2/(2+ ’ ,) * 4(1 -’ ,)/(2+b) 

x / i 2 "/( 2 +") 2-'‘/( 2 +») [15.10.44] 
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M») = 


(1 — n)(2 - 2n) 2 ~ 2n 


Sutton’s treatment is based on 


[15.10.46] 

the wind velocity profile: 

[15.10.47] 


where u is the wind speed (cm/s) and z is the height (cm). 

Sutton identified the parameter X with the kinematic 
viscosity of the air v. Pasquill gives a table of values for the 
constants K and K' for the following case: 
k = 0.4 

X =:$ s 0.147 cm 2 /s 

Xo = lg/cm 3 


«i = 500 cm/s 


Clancey states that in deriving Equations 15.10.48 and 
15.10.49 he has used values X = 0.147 cm 2 /s and 
D « 0.075 cm 2 /s, the latter being typical for hydrocarbons. 
In determining K from Equation 15.10.39 he appears to 
have included both the terms x 2n,i2+n) and L ~? r, / ( - 2+n \ which 
for n = 0.25 have the values 0.653 and 0.56, respectively. 
Equations 15.10.48 and 15.10.49 may be corrected for this 
by dividing by 0.653. 

Relations for the Sutton-Pasqill model in SI units 
are given in the Rijnmond Report. The report gives 
Equations 15.10.37 and 15.10.38 together with the equations 

K = [15.10.50] 


K' = a' Zo D 2B /( 2 + B ) 2 ]-’ ,/(2+ ’ ,) [15.10.51] 

where D is the diffusion coefficient of vapour in air (m 2 /s), 
E is the evaporation rate (kg/s), r is the radius of the pool 
(m), x a is the downwind length of the pool (m), y 0 is the 
crosswind width of the pool (m), Zo is the concentration of 
the vapour in the air (kg/m 3 ), u is the wind speed at height 
Zi(m/s), Zi is the height at which the wind speed is measured 
(m) and a and a' are constants. The constant a is different 
from that given in Equation 15.10.41. The following values 
are given for the groups Kjx 0 and JT'/x„: 




K K' 


0.20 0.0094 0.0283 

0.25 0.0180 0.0537 

0.30 0.0313 0.0926 


He also gives the results of an experiment for which 
M = 157 
T = 290 K 
* 0 = 10 cm 
y 0 = 20 cm 
n = 0.219 
Hence 

K = 0.0122 Z(I 

^ = 1.89 x 10~ 6 (g/s)/(dyn/cm 2 ) 

However, Pasquill argued that the parameter should prop¬ 
erly be the diffusion coefficient D of the vapour in air and 
this argument was accepted by O.G. Sutton (1953). Hence in 
Equations 15.10.39—15.10.44, X should be set equal to D. 

Equations for the Sutton-Pasquill model have been 
given by V.J. Clancey (1974a) in the following form. For a 
rectangular pool set square to the wind direction: 

£ = 1.2 x 10- 10 ^M 078 x°- 89 y o rectangular pool 

[15.10.48] 

£ = 3.6 x 10 -10 ^^M a78 r 1 - 89 circular pool [15.10.49] 


» 

Klx o 

K'lxo 

0.20 

1.278 x 10“ 3 

3.846 x 10“ 3 

0.25 

1.579 x 10“ 3 

4.685 x 10“ 3 

0.30 

1.786 x 10“ 3 

5.285 x 10“ 3 


15.10.5 Vaporization of a volatile liquid 

Vaporization of a volatile liquid is governed by the mass 
and heat transfer rate processes described in Section 
15.10.3. If the vaporization rate is low so that the heat 
transfer to the pool is sufficient to prevent a fall in the 
temperature of the liquid, the vaporization is a mass 
transfer limited process that depends on the vapour pres¬ 
sure of the liquid and the wind flow across the pool. At 
higher vaporization rates, where the heat transfer to the 
pool is insufficient to prevent chilling, the liquid tempera¬ 
ture will fall, approaching asymptotically to a steady-state 
value. The approach will generally be approximately 
exponential. 

It has been shown theoretically by Flothmann, 
Heudorfer and Langbein (1980) that for pools of liquids 
such as hydrogen cyanide and acrolein, neglect of heat 
transfer from the ground can lead to appreciable error in 
the estimation of the vaporization rate, particularly under 
conditions of low solar radiation and/or low wind speeds. 
Vaporization from a pool of a volatile liquid constitutes a 
steady, continuous source of vapour. 

Higher vaporization rates still occur where the liquid is 
at or close to its boiling point. There is relatively little 
information available on vaporization under these condi¬ 
tions. This situation has been discussed by Shaw and 
Briscoe (1978 SRD R100), who consider the vaporization of 
a liquid such as butane (b.p. -0.5°C) on a cold surface at 
0°C. The liquid boils and the vaporization is limited by heat 
transfer, the heat transfer being by convection from the air 
and by radiation, that from the ground being minimal. 
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They propose the use of the relations of Mackay and 
Matsugu (1973), given in Section 15.10.6, both for con¬ 
vective heat transfer from the air to the pool and for the net 
radiative heat transfer. For the former the heat transfer 
coefficient may be obtained from the expression for the 
mass transfer coefficient. They also discuss the question of 
the concentration and temperature at which the necessary 
physical properties should be determined. 

A correlation for the vaporization rate for a liquid at a 
temperature above ambient has been given by the Centre 
for Chemical Process Safety (CCPS, 1987/2): 

w v = C D a(p gs -p g ) [15.10.52] 

where C D is the drag coefficient, u is the wind speed, p s 
is the density of gas 10 m above the pool and p gs is 
the saturation density of the gas at ambient conditions. The 
value of C D is about 10 -3 if u is measured 10 m above 
the pool. 


15.10.6 Mackay and Matsugu model 

A model for the vaporization of a volatile liquid from a cir¬ 
cular pool has been given by Mackay and Matsugu (1973). 
The authors carried out experiments on the evaporation 
of water, gasoline and cumene from 4 x 4ftand4 x 8ftpans. 

In their model the heat balance on the pool is given by 
Equation 15.10.5, except that the term for heat conduction 
from the ground is omitted. For mass and heat transfer 


between the pool and the atmosphere: 


N _K{p-Poo) 

RT\ 

[15.10.53] 

q ca = h(T a -T 1 ) 

[15.10.54] 

with 


km = Cm 0 ' 78 * -0 - 11 

[15.10.55] 


For the net radiation the authors use Equations 
15.10.34-15.10.36 with the values of the parameters quoted 
in Section 15.10.3. 

As stated earlier, the model given by these authors does 
not include a term for heat transfer from the surface 
beneath the pool. This term was presumably not significant 
in their particular experiments, which involved evapora¬ 
tion pans. 


15.10.7 Spreading of a liquid 

Accounts of the spreading of liquids are given in Water 
Waves (Stoker, 1957) and Oil on Sea (Hoult, 1969) and by 
Abbott (1961) and Webber and Brighton (1986). Much of the 
work is concerned with the spreading of oil slicks, which is 
treated by Fay (1969,1973) and by Hoult (1969,1972b). 

If the liquid is not confined within a hollow or a bund, but 
is free to spread, it is usually necessary to take account of 
such spreading and to use a treatment based on simulta¬ 
neous spreading and vaporization. Spreading of a liquid on 
land and on sea differ somewhat and may require separate 
treatment. 

The volume Fof the liquid pool is a function of its radius 
r and height h 

V = n^h [15.10.59] 

The growth of the pool may be expressed in terms either of 
the velocity u of the pool edge 



or of its acceleration. 

As the pool spreads, it passes through different spread¬ 
ing regimes. Initially the frictional resistance may be 
negligible so that the gravity force is balanced by the iner¬ 
tia force. At a later stage, the inertia may be negligible 
so that the gravity force is balanced by the resistance force. 

The pool growth has most commonly been modelled by 
the energy balance relation 


h = KpM Sc/Pr) 0 ' 67 [15.10.56] 

C = k Sc“°' 67 [15.10.57] 

where c is the specific heat, h is the heat transfer coefficient, 
k m is the mass transfer coefficient, N is the mass trans¬ 
ferred per unit area, p is the partial pressure of the vapour, 
q cn is the heat flow per unit area by convection from the 
atmosphere to the pool, u is the wind speed, x is the 
diameter of the pool, C and k are constants and subscripts 
a, 1, v and oo are air, liquid, vapour and atmosphere beyond 
influence of pool, respectively. In SI units, the value of k is 
0.00482 m° ,/s 0 ' . 

Equation 15.10.55 is based on the Sutton-Pasquill model 
with the diffusion index n = 0.25. The authors state that in 
terms of the factor j m their correlation for the mass transfer 
coefficient is equivalent to 

j m = 0.0565Re -0 ' 22 [15.10.58] 

where Re is in the range 7 x 10 4 — 4.6 x 10 5 . 


~=(2 g'h) 1 ' 2 [15.10.61a] 

or, more generally, 

^ = c(^) 1/2 [15.10.61b] 

g'=g on land [15.10.62a] 

g 1 =gA on water [15.10.62b] 

A = Pv p Px [15.10.63] 

where g is the acceleration due to gravity, g' is the reduced 
gravity, A is the reduced density, c is a constant and 
subscripts 1 and w denote liquid and water, respectively. 
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The value of the constant c in Equation 15.10.61b has 
been extensively treated in the literature. A value of c of 1.4 
is often used. This value is close to the value of 2 1/2 implied 
in Equation 15.10.61a. 

It may be noted that Equations 15.10.59 and 15.10.61 give 



where P is a shape factor. The shape factor p determines the 
edge height of the pool and its value depends on the pool 
boundary conditions. Relevant factors include the surface 
tension of the liquid and the resistance of the ambient 
medium. For a convex pool P < 0, for a concave pool p > 0, 
for a cylindrical pool P = 0. Avalue of p = -4 corresponds 
to a pool with zero edge height (zero surface tension) and 
one of P = 4 corresponds to a pool with its centre tending to 
zero thickness. Hence from Equation 15.10.70 


Atreatment which takes account of both thegravity-inertia 
and gravity-viscous regimes has been given by Raj and 
Kalelkar (1974). In the former the gravity force F g is 
opposed by the inertial force iq 

F g = npg'rfr [15.10.65] 

Fi = —Cnphr 2 ^ [15.10.66] 

where C is a constant. The constant C represents the ratio 
of the inertia of the liquid system to the inertia that would 
exist if all the liquid were moving at the acceleration of the 
spill edge. The value given for C is 0.754. 

Then, equating the two forces F g and Fi gives 


d 2 r_ 


g!h 
' C 


[15.10.67] 


[15.10.71] 


15.10.8 Vaporization of a cryogenic liquid 

In the general case of vaporization of a cryogenic liquid, or 
refrigerated liquefied gas, it is necessary to consider 
simultaneous spreading and vaporization. Considering 
initially just the vaporization, this is governed by heat 
transfer from the ground to the liquid. There is a short 
period of very rapid vaporization followed by a relatively 
steady lower rate of vaporization. 

The rate of vaporization is obtained from the heat flux as 
given by Equation 15.10.30: 


V 2 

P* 


[15.10.72] 


Equation 15.10.72 may be written; 


The authors also give a treatment of the gravity-viscous 
regime. 

A relation that takes account of the frictional resistance 
has been given by Webber and Brighton (1986). They sug¬ 
gest that the natural model to use for the spreading of a thin 
layer of liquid is the shallow water, or shallow layer, equa¬ 
tions (Stoker, 1957). From these equations they derive the 
relation 


d 2 r 4^(1-s) 
df* = -r- F 


[15.10.68] 


where F is a friction term and 
friction factor is 


■4+m 


shape factor. The 


[15.10. 


F = C W j + 1.877p(l-/) on water [15.10.69b] 

where v is the kinematic viscosity and C L and C w are 
constants for land and sea, respectively. The factor/allows 
for the effect on the shear stress on the pool of the radial 
motion in the water beneath it. In Equation 15.10.69 the right- 
hand side contains both a turbulent and a laminar term. 

In a further treatment, Webber and Brighton (1986 SRD 
R371) have expressed their results in the form 


dV_ 
df 2 ^ 


ill 

n r 3 


[15.10.70] 


q = A v t 1 ' 2 
with 


Ay 


1/2 

6i 


[15.10.73] 


[15.10.74] 


where A w is the vaporization parameter. Equation 15.10.73 
has been confirmed experimentally. 

It should be noted that for zero time Equation 15.10.72 
gives an infinite heat transfer rate and is not applicable, but 
the period over which the heat transfer rate is over¬ 
estimated is very short. 

Most studies of the vaporization of cryogenic liquids 
have been concerned with liquefied natural gas (LNG) or 
liquefied ammonia. These are considered in the following 
sections. 

Large-scale tests on the vaporization of refrigerated 
liquid ethylene have been conducted in Japan by a working 
group headed by Professor HikitaTsuyoshi under the aus¬ 
pices of the Ministry of International Trade and Industry 
(MITI) (1976) and other bodies. This work was part of a 
programme of tests on various aspects of hazards of liquid 
ethylene. 

In one test, 392 kg of liquid ethylene at a temperature of 
-104°C was poured into a 2.5 m diameter bund with a 
pebble floor. There was violent boiling of the liquid that 
caused an estimated 66% of it to vaporize or form spray 
within the first minute. The spillage gave rise to a cloud of 
ethylene with regions of mist and vapour. 

The contours of the mist and of the vapour concentra¬ 
tions corresponding to lower explosive limit were similar, 
but not identical. The maximum distances reached by 
vapour concentrations of 2.7% (the lower explosive limit), 
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2.0% and 1.0% were 60, 80 and 86 m, respectively, all 
attained after 70 s. The mean wind speed was approxi¬ 
mately 2.5 m/s. 

The initial vaporization rate of the liquid ethylene over 
the first minute was fitted by the equation 

o m 0.625 exp( -0.0507 t) [15.10.75] 

where t is the time (s) and v is the regression rate (cm/s). 
After the first minute the rate of vaporization was much 
reduced. 

A collection of experimental data for the validation of 
models of spills of cryogenic liquids on land and water has 
been made by Prince (1985 SRD R324). 

Vaporization from a pool of a cryogenic liquid constitutes 
initially a near-instantaneous source of vapour followed by 
steady, continuous source. 


15.10.9 Spreading and vaporization of LNG 

Accounts of the spreading and vaporization of LNG have 
been given by a number of workers including Burgess, 
Murphy and Zabetakis (1970 BM RI7448), Humbert-Basset 
and Montet (1972), Kneebone and Boyle (1973), Feldbauer 
et al. (1972), Raj and Kalelkar (1973), the American Gas 
Association (AGA) (1974), Drake and Reid (1975), Opschoor 
(1977, 1980), Shaw and Briscoe (1978 SRD R100) and Raj 
(1979,1981). 

A general account of the spreading of a liquid such as 
LNG has been given in Section 15.10.7. In this section a 
description is given of work on the vaporization rate of a 
pool of LNG of fixed area on land or on water and of some 
simple treatments of simultaneous spreading and vapori¬ 
zation of LNG. Some principal models for the latter are 
given in the following sections. 

Evaporation of liquid methane on common surfaces such 
as soil has been investigated by Burgess and Zabetakis 
(1962 BM RI 6099). They found that initially the vaporiza¬ 
tion rate v was limited by the rate of heat transfer from the 
substrate and was given by the relation 


k s T s - T x 

AAffvKf ) 1 / 2 


[15.10.76] 


Values of the thermal conductivity and thermal diffusivity 
for different substrates are given by Carslaw and Jaeger 
(1959), as described below. There is relatively little difference 
between the values for average soil and normal concrete. 

During the initial period the vaporization rate for 
liquid methane is high. Thereafter it decays and becomes 
dependent on the wind speed and is thus convection con¬ 
trolled. It approaches a constant value of approximately 
0.02 in./min at low wind speeds after periods of 0.25-2 h. A 
log - log plot of vaporization rate vs time gives a straight line. 

The evaporation of LNG on various surfaces has been 
investigated by Drake and Reid (1975). These authors 
describe experimental work at MITand refer also to other 
experimental work by the American Gas Association 
(AGA) (1974) and work done by Gaz de France (Humbert- 
Basset and Montet, 1972). They found that the initial 
transfer and vaporization rates are in accordance with 
Equation 15.10.73, but that they vary considerably, 
depending on the nature of the substrate. 

Drake and Reid quote both calculated and experimental 
values of the vaporization parameter^, in Equation 15.10.73. 
Values of the parameters p s , c ps and k s for various substrates 
are given by Carslaw and Jaeger (1959). From these para¬ 
meters the corresponding values of A may be calculated. It is 
assumed that the substrate is at 16°C (60°F) and the LNG is 
at -162°C (—260°F) so that (T s -T,) is 178°C. These calcu¬ 
lated values of A T are compared by Drake and Reed with 
experimental values for LNG spills obtained in the AGA and 
Gaz de France tests, as shown in Table 15.9. By contrast the 
value of A given for insulating concrete is 0.61. 

Drake and Reid state that the rate of vaporization of 
LNG is greater than that of pure methane. It is greater on 
surfaces such as crushed rock or pebbles than on compacted 
soil. On soils, the vaporization rate is enhanced by percola¬ 
tion if the soil is dry. The extent of percolation in most soils 
is limited by the formation of a frozen barrier. Foaming is 
another factor that may increase the vaporization rate of 
LNG. A marked reduction in the vaporization rate of LNG 
may be obtained by the use of insulating concrete. 

VJ. Clancey (1974a) has developed equations for the 
vaporization of a cryogenic liquid such as LNG. For the 
initial rapid vaporization 


Equation 15.10.76 applied only to the initial rapid vapori- j<\ m h(T s _ TH [15.10.77] 

zation period, which did not exceed 1 min. A H v 


Table 15.9 Vaporization parameters for LNG on different substrates (after Drake and Reid, 1975) (Courtesy of 
the American Institute of Chemical Engineers) 


3 s (g/cm) c ps (cal/g°C) k s (cal/s cm°C) A v (cal/s 1/z cm 2 ) 


Carslaw and. Jaeger (1959, p. 497) 


Soil (average) 2.5 

Soil (sandy, dry) 1.65 

Soil (sandy, 8% moist) 1.75 

Concrete (1:2:4) 2.3 


AGA tests 
Soil (compacted) 

Gaz de France 
Soil (dry, 15°C) 
Soil (wet, 50°C) 
Soil (wet, 15°C) 


0.2 0.0023 3.41 

0.19 0.00063 1.40 

0.24 0.0014 2.45 

0.23 0.0022 3.39 


8.5 


18.2 

12.7 

5.68 
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and for the steady continuous vaporization 


ft* 


hi'i'.-Ti) 

AH V 


[15.10.78] 


where E { is the mass vaporized per unit area within 1 min 
(g/cm 2 ), E s is the steady-state mass vaporization rate per 
unit area (g/cm 2 min), Aff v is the latent heat of vaporization 
(cal/g) and k 3 and k 2 are constants. The values of the 
constants k 3 and k 2 are as follows: 


Substrate 

h 

k 2 

Average soil 

7.1 x 10“ 4 

1.5 x 10“ 2 

Concrete 

7.5 x 10“ 4 

1.5 x KT 2 

Sandstone 

1.3 x 10“ 3 

2.6 x 10“ 2 


Equation 15.10.77 is applicable where the temperature 
difference (T s — 7\) is large, as for a spillage of liquid 
methane. It is assumed in Equation 15.10.77 that the depth 
of ground which gives up heat to the pool is proportional to 
(T s -7j); this accounts for the occurrence in Equation 
15.10.77 of the term ( T s - T,) 2 

For a large spillage the time that elapses before the 
vaporization rate reaches a quasi-steady state may be an 
hour or more. Clancey suggests that the values of the 
vaporization rate in this intermediate period may be 
obtained by logarithmic interpolation between the initial 
and steady vaporization rates. 

Vaporization rates of LNG on water are relatively high. 
Work has been carried out by a number of investigators, 
including Burgess, Murphy and Zabetakis (1970 BM RI 
7448), Kneebone and Boyle (1973), Feldbauer et al. (1972), 
Germeles and Drake (1975) and Opschoor (1977,1981). 

Burgess, Murphy and Zabetakis obtained a mass 
vaporization rate of 0.18 kg/m 2 s and Feldbauer et al. (1972) 
one of 0.20 kg/m 2 s. The First Canvey Report states that the 
vaporization rate obtained in such work is of the order of 
0.19 kg/m 2 s. 

For the vaporization rate, Opschoor (1980) quotes the 
following relation of J.S. Turner (1965): 



where q w is the heat flow per unit area by conduction from 
the water to the spill, AT is the temperature difference 
between the water and the liquid, /? is the coefficient of 
cubical expansion and v is the kinematic viscosity. For 
LNG, taking A T = 47.4 K, Equation 15.10.79 gives 


Opschoor also gives relations for the estimation of the 
mass vaporization rate with ice formation beneath the LNG. 
It is found that an ice layer forms in about 20 s. Before the 
ice forms, film boiling pertains; once the film has formed 
heat transfer is by conduction through the ice. He gives for 
these two regimes the following mass vaporization rates: 

«v = 0.008/ 0 < f < 25 [15.10.80a] 


0.517 
(t - 20) 1/2 


f > 25 


[15.10.80b] 


where m, is the mass vaporization rate per unit area 
(kg/m 2 s) and t is the time (s). 

For simultaneous spreading and vaporization of LNG, 
Burgess, Murphy and Zabetakis (1970) have given the 
relations 


^ = % pvr 2 [15.10.82] 

m = npv J t [15.10.83] 


m = ^pvk 2 3 f > [15.10.84] 

where m is the total mass vaporized, r is the radial 
distance and k 3 is a constant. The value of the constant k 3 is 
0.381. Then, taking the density of LNG as 416 kg/m 3 , 
Equation 15.10.84 becomes 

m = 63.2vt? [15.10.85] 

Lind (1974) has given a similar treatment but uses a value of 
k 3 of 0.635 based on the Esso experiments described by 
Feldbauer et al. (1972). From Equation 15.10.84 this gives 

m= \75.7vt 3 [15.10.86] 

Fay (1973) has used Equations 15.10.59 and 15.10.61a, inte¬ 
grating the latter with the boundary conditions t=0 and 
r = 0 to obtain 


-m 


[15.10.87] 


q w = 2.3 x 10 4 W/m 2 

which corresponds to a mass vaporization rate of 
«v = 0.045 kg/m 2 s 

This value agrees well with the experimental results of 
Kneebone and Boyle (1973). Opschoor gives a preferred 
value of 0.05 kg/m 2 s. 

Shaw and Briscoe (1978 SRD R100) use a regression rate 
based on the Esso work of 4.7 x 10 -4 m/s. The regression 
rate used by Raj (1979) is 6.5 x 10 -4 m/s. 


Equation 15.10.87 may be used with Equation 15.10.83 to 
determine the mass vaporized. Fay assumes in his treat¬ 
ment that ice forms beneath the spill, and that this deter¬ 
mines the vaporization rate. Raj and Kalelkar (1973) 
obtained the relation 

m = l.712npvA 4/ ¥ [15.10.88] 

where A is the volume of liquid for an instantaneous spill. 

These and other models have been reviewed by Shaw and 
Briscoe (1978 SDR R100). 
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15.10.10 Shaw and Briscoe model 

A series of models for simultaneous spreading and vapori¬ 
zation of continuous and instantaneous spills of LNG on 
land and on water has been given by Shaw and Briscoe 
(1978 SRD R100). 

For the vaporization of LNG on land in a fixed area such 
as a bund they give 




[15.10.96] 


For an LNG spill on land the vaporization rate is 
determined by the heat transfer, and hence the vaporization 
rate decreases with time. The relation used for the vaporiza- 


Am = A v Xk s (T a -T b ) 
df AH y (n%) t/2 t% : 

where A p is the area of the pool, A H v is the latent heat of 
vaporization, k is the thermal conductivity, m is the total 
mass vaporized, a is the thermal diffusivity, and subscripts 
b and s denote the boiling point and soil, respectively. The 
factor X takes account of surface roughness. In the tests by 
the Japan Gas Association, after 1 s the regression rate was 
some three times the theoretical value (X = 1), and on this 
basis the authors suggest a value for Xof 3. 

In general, for an LNG spill the volume Fof the pool is 


V = A + Bt -m.jp 


= (*y 


d m 2 


For an instantaneous spill on water, Equation 15.10.91 is 
solved with the condition B = 0 (and hence V=A), t= 0 
and r = r ot where r 0 is the initial radius of the pool. Then, 
integrating Equation 15.10.91 




1/2 


m = npv | ) ' t 2 + [15.10.94] 

For a continuous spill on water, Equation 15.10.91 is 
solved with the condition A = 0 (hence V = Bt ), f = 0 and 
r = 0. Then, as before, integrating Equation 15.10.91 
followed by Equation 15.10.92 gives 






_ Xk s (T s -T h ) 
" &H v (nsk ) 12 


[15.10.98] 


where A is the volume of liquid for instantaneous spill and 
B is the volumetric flow for a continuous spill. 

From Equations 15.10.59 and 15.10.61 


where r x is the radius at time 4, r 2 is the radius at time 
h (4 > 4) and 9 is a parameter. Equations 15.10.90 and 
15.10.91 are again used. 

For an instantaneous spill on land, Equation 15.10.91 
is solved with the conditions B = 0 (hence V = A), t = 0 
[15.10.90] and r = r D Also on land, g=g'. Then, integrating 
Equation 15.10.91 gives 


, = 


[15.10.91] 


At 


where r is the radius of the pool. 

Analytical solutions of Equation 15.10.91 are obtained by 
neglecting the term w/p in Equation 15.10.90. 

For an LNG spill on water the heat transfer rate, and 
hence the vaporization rate, is taken as constant and is 
characterized by the regression rate v. The authors use 
Equations 15.10.90 and 15.10.91 together with the relation 


[15.10.92] 


For small r 0 . Equation 15.10.99 becomes 



[15.10.100] 

Hence 


f = ftr 2 

[15.10.10| 

with 


/ n y/2 



[15.10.102] 


where ft is a constant. 

Utilizing Equation 15.10.101 and integrating Equation 
15.10.97 gives 

m = ® 9(2ngA) 1/2 t 3/2 [15.10.103] 

For a continuous spill on land, Equation 15.10.91 is solved 
with the conditions A = 0 (hence V = Bt), t = 0 and r = 0. 
Then, as before, integrating Equation 15.10.91 gives 

f :s= | ^ [15.10.104] 

Hence 

t = /iV 4 / 3 [15.10.105] 

with 

/Q _\l/3 
?-{&&) 
where f} 2 is a constant. 
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Utilizing Equation 15.10.105 and integrating Equation 
15.10.97 gives 

m = 7t 3 / 2 0 t 2 [15.10.107] 

As stated above, the authors use for the regression rate for 
LNGonwaterthevaluefromtheEssoworkof4.7 x 10 -4 m/s. 

The authors also performed numerical integration of the 
full equations and obtained for the radius r e and time t e at 
the end of evaporation: 

lnr e = 1.51nf e - 2.45 [15.10.108] 


In f e = 0.25(ln M s + 6) [15.10.109] 

where M s is the mass of the spill. 

They also confirmed that it is justifiable to neglect the 
term mjp. 


15.10.11 Raj model 

Another series of models for simultaneous spreading and 
vaporization of continuous and instantaneous spills of 
LNG on land and on water has been given by Raj (1981), 
developing the earlier work of Raj and Kalelkar (1974). For a 
continuous spill on land the basic equation is 


d? 

df 


ksAT 

(««. r(t-hr 


27irid r 


[15.10.110] 




A T=T S - T\ 


[15.10.111] 


where k is the thermal conductivity, q is the heat flux per 
unit area, r is the radial distance, A T is the temperature 
difference between the liquid and the soil at distance r h and 
subscript 1 denotes at distance rj. 

Then, equating the steady-state vaporization rate per 
unit area and the volumetric flow of liquid into the spill V c : 


2nk s AT r r ® 


(i-m yg 


dn 


where subscript 1 denotes the liquid. 
Integration of Equation 15.10.112 gives 


[15.10.112] 





s =(^y 


[15.10.114] 


where c is the specific heat and p is the density. 
Raj also shows that 


_ nr^SAT 1/2 
(2/n)AH v 


[15.10.115] 


For a continuous spill of finite size on land, using the result 
just given in Equation 15.10.115 

i i5ion7a i 

■fcFcfep t>t s p [15.10.117b] 


where V is the volume of the pool and the subscript sp 
denotes the spill duration. The first term on the left-hand 
side of Equation 15.10.117 is the volume of liquid remaining 
and the second the volume vaporized. 

Raj utilizes the liquid spreading relations 15.10.59 and 
15.10.61b to obtain a numerical solution of Equation 
15.10.117. For an instantaneous spill of LNG on land the 
basic equation is 


7(f)+jf v(t)nr 2 (t)dt=V i 
with 

SAT 

V( ) ~(2/ji)A ff v p,fV2 


[15.10.118] 


[15.10.119] 


where Vi is the volume of liquid in the instantaneous 
spill. 

The relations utilized for the liquid spreading are 
Equations 15.10.59 and 15.10.67, together with Equation 
15.10.118. From these relations are obtained for the final 
evaporation radius r e and time t e : 

■% =1.248^ T ^ i y / V 4/9 [15.10.120] 




[15.10.121] 


For a continuous spill on water the basic equation is 


V(t)+nr 2 v=V c 


[15.10.122] 


The relations utilized for liquid spreading are Equations 
15.10.59 and 15.10.61. The following relation is obtained for 
the final evaporation radius r e : 


[15.10.123] 


For an instantaneous spill on water the basic equation is 




[15,10.124] 


The relation utilized for spreading is Equation 15.10.67. 
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The following relations are obtained for the final evapora¬ 
tion radius and time: 


^vy /8 

[15.10.125] 

/ Vi \ 1/4 

4 =a 6743 fe) 

[15.10.126] 

Raj (1979) has also given a criterion for classifying a spill of 
LNG on water as instantaneous or continuous. He defines 
the following dimensionless quantities: 

L— F? /3 

[15.10.127] 

tdh=L/v 

[15.10.128] 

t = r/L 

[15.10.129] 

^ — t/tch 

[15.10.130] 


where L is a characteristic length, t ch is a characteristic 
evaporation time, f is a dimensionless maximum spread 
and t is a dimensionless time. 

Utilizing Equations 15.10.123 and 15.10.125 for the final 
spill radii for the two types of spill together with the fact 
that V c = Vi/t, he obtains 


$«• 


instantaneous spill 


[15.10.131] 


{ 


(-) 1/2 


continuous spill 


[15.10.132] 


/ 2t/;\ 1/4 

4=0.67 {^2) [15.10.136] 

Opschoor also considers an LNG spill on a water surface of 
limited area A 0 . Using Equation 15.10.134, but neglecting 
the first term on the right-hand side, the following relation 
is obtained for the time t a for a water surface of area A a to be 
fully covered: 

/ A 2 \ 1/2 

to = 0.24^J [15.10.137] 

The work of Opschoor on the mass vaporization rate of 
LNG on water has already been described in Section 15.10.9. 


15.10.13 Spreading and vaporization of ammonia 

Work on the spreading and vaporization of liquefied 
ammonia (LNH 3 ) on water has been described by Raj, 
Hagopian and Kalelkar (1974). Experiments were carried 
out in which quantities of ammonia up to 50 US gal were 
spilled on water. 

When ammonia is spilled on water, part of it vaporizes 
and part goes into solution in the water. Defining a parti¬ 
tion coefficient p as the proportion that dissolves, the 
authors obtained a value of p ss 0.6 ± 0.1. The remainder 
(1 —p) vaporizes. 

The authors modelled the release assuming that the 
ammonia was at a temperature of -33°C, there was no 
initial entrainment of air and no spray formation. Under 
these conditions the cloud is buoyant. They treated the 
dispersion in terms of a buoyant plume model. For the final 
evaporation radius and time they give: 

*e = 2.5F 0 ' 375 [15.10.138] 


Then from Equations 15.10.131 and 15.10.132 a value of t 
may be obtained for the point at which the value of {is the 
same for the two equations. 

Using a typical value of the regression rate v of LNG on 
water of 6.5 x 10 -4 m/s gives a value of 7 of 2 x 10 -3 s. 
Then for the crossover time t a Raj gives the following values: 


Volume spilled (m 3 ) 1000 10,000 25,000 50,000 
Crossover time (s) 31 68 92 116 


15.10.12 Opschoor model 

A model for the simultaneous spreading and vaporization 
of an instantaneous spill of LNG on water has been given by 
Opschoor (1977,1980). 

For an instantaneous spill of LNG on water 

V(t)pi + n J* Wv^fjdf = Vipi [15.10.133] 

where «, is the mass rate of vaporization per unit area. 
Integration of Equation 15.10.133 gives 

r = [o-44”^ / 3 + LSfe'Fj ) 1/2 ij ' [15.10.134] 

For the final evaporation radius and time 



and 

4 = 0.674^) 7 [15.10.139] 

where r e is the final evaporation radius (ft), 4 is the final 
evaporation time (s), v is the regression rate (ft/s), and Fis 
the volume spilled (US gal). The authors obtained a 
regression rate of 2.8 in./min. 

Using a thermodynamic analysis, Raj and Reid (1978a) 
have shown that it is possible to determine the point at 
which further addition of water simply dilutes the solution 
without causing any further evolution of ammonia and to 
obtain the value of the partition coefficient. For the illus¬ 
trative example considered the experimental partition 
coefficient was 0.73 and the theoretical value 0.715. 

Griffiths (1977 SRD R67) has criticized the interpretation 
given by Raj, Hagopian and Kalelkar and gives an alter¬ 
native interpretation of the results assuming that spray 
formation occurs and that the plume is not buoyant. 


15.10.14 Computer codes 

A number of computer codes have been written for vapori¬ 
zation. A review of these has been given by the CCPS (1987/ 
2). The Safety and Reliability Directorate (SRD) code 
SPILL is based on the model of Shaw and Briscoe (1978 
SRD R100). It has been described by Prince (1981 SRD 
R210). Another program is the Shell SPILLS code which is 
described by Fleischer (1980). 
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15.11 Dispersion 

Emission and vaporization are followed by dispersion of 
the vapour to form a vapour cloud. 

Accounts of gas dispersion of particular relevance here 
include those given in Micrometeorology (O.G. Sutton, 
1953), Atmospheric Diffusion (Pasquill, 1962a, 1974) 
Meteorology and Atomic Energy (Slade, 1968), An Evalua¬ 
tion of Dispersion Formulas (Anderson, Hippier and 
Robinson, 1969), Recommended Guide for the Prediction of 
the Dispersion of Airborne Effluents (ASME, 1969/1,1973/2, 
1979/4), Workbook of Atmospheric Dispersion Estimates 
(D.B. TUrner, 1970), Turbulent Diffusion in the Environment 
(Csanady, 1973) and Handbook on Atmospheric Diffusion 
(Hanna, Briggs and Hosker, 1982), and those given by 
Pasquill and Smith (1983). 

Dispersion models used in the nuclear industry are 
described in the Nuclear Regulatory Commission (NRC) 
Regulatory Guide 1.111 Methods for Estimating Atmospheric 
Transport and Dispersion of Gaseous Effluents in Routine 
Releases from Light-water-cooled Reactors (1974) and the NRC 
Regulatory Guide 1.145 Atmospheric Dispersion Models for 
Potential Accident Consequence Assessments at Nuclear Power 
Plants (1979a). The NRC has also published an account of the 
basis for Regulatory Guide 1.145 (1981 NUREG/CR-2260). 
Another nuclear industry dispersion model is A Model for 
Short and Medium Range Dispersion of Radionuclides into the 
Atmosphere by Clarke (1979 NRPB R91). 

Work on dispersion is primarily concerned with the dis¬ 
persion of pollutants from industrial chimney stacks. Most 
of the fundamental work on dispersion relates to this prob¬ 
lem. There is, however, an increasing amount of work on 
dispersion of hazardous releases from process plant. 

Selected references on dispersion are given inTable 15.10. 


Table 15.10 Selected references on dispersion 


Meteorology 

NRC (Appendix 28 Meteorology, 1972); Lamb (1932); 
Nikuradse (1933); Prandtl (1933); Schlichtling (1936,1960); 
Brunt (1934); Milne-Thomson (1938); O.G. Sutton (1949, 
1953,1962); Geiger (1950); Hewson (1951); Malone (1951); 
Batchelor (1953,1956,1964,1967); Brooks and Carruthers 
(1953); Singer and Smith (1953,1966); Clauser (1954,1956); 
G.F. Taylor (1954); AEC (1955); Townsend (1956); Haltiner 
and Martin (1957); Scorer (1958,1978); Byers (1959); 
Priestley (1959); Chandrasekhar (1961); Monin (1962); 
Ogura and Phillips (1962); Pasquill (1962,1974); Lumley and 
Panofsky (1964); Roll (1965); Munn (1966); Wu (1965); 
Bowne, Ball and Anderson (1968); Meteorological Office 
(1968,1972,1975,1991,1994); Slade (1968); Swinbank (1968); 
Trewartha (1968); ASME (1969/1,1975/2,1979/3,4); 
McIntosh and Thorn (1969); Monin (1970); D.B. Turner (1970); 
R.J. Taylor, Warner and Bacon (1970); Bradshaw (1971,1978); 
Businger and Yaglom (1971); B.J. Mason (1971); Monin and 
Yaglom (1971);Tsang (1971); Launder and Spalding (1972); 
McIntosh (1972);Tennekes and Lumley (1972); Zilitinkevich 
(1972a); Busch (1973); Blackadar (1976); Oke (1978); Caughey, 
Wyngaard and Kaimal (1979); Sethuraman and Raynor 
(1979); Cermak (1980); Kreith (1980);Venkatram (1980b, 
1981a); A.E. Mitchell (1982); Plate (1982);Tennekes (1982); 
Volland (1982); Pasquffl and Smith (1983); Panofsky and 
Dutton (1984); Houghton (1985); J.C.R. Hunt (1985); Page and 
Lebens (1986); Anfossi (1989); Bartzis (1989); A.D. Young 
(1989); Lindzen (1990); Swaid (1991) 


Lagmngian length scale: J.S. Hay and Pasquill (1959); 

J.D. Reid (1979); Hanna (1979a, 1981b); Hanna, Briggs and 
Hosker (1982) 

Atmospheric boundary layer: Panofsky (1968,1973,1978); 
Deardorff (1970,1973,1974); Pasquill (1972); Zilitinkevich 
(1972b); Businger (1973,1982); Csanady (1973);Tennekes 
(1973a); Wyngaard (1973,1982); Wyngaard, Arya and Cote 
(1974); Wyngaard and Cote (1974); Wyngaard, Cote and Rao 
(1974); Counihan (1975); Kaimal etal. (1976); H.N. Lee (1979); 
Nichols and Readings (1979); Caughey (1982); Nieuwstadt 
(1984a,b); Holtslag and Nieuwstadt (1986) 

Wind characteristics: Irwin (1979b); Wieringa (1980); 
Oehlert (1983); Nitz, Endlich and Ludwig (1986); R.Weber 
(1992) 

Roughness length, friction velocity: Paeschke (1937); 

O.G. Sutton (1953); Plate (1971); Mulhearn (1977); Oke 
(1978); Wieringa (1981); Brutsaert (1982); Venkatram and 
Paine (1985); San Jose etal. (1986) 

Wind velocity profile: Frost (1947); Deacon (1949,1957); 
Lettau (1959); Panofsky, Blackadar and McVehil (1960); 
McVehil (1964); Swinbank (1964); Bowne and Ball (1970); 
Dyer and Hicks (1970); Paulson (1970); Webb (1970); 
Businger et al. (1971); P.M. Jones, Larrinaga and Wilson 
(1971); Colder (1972);Tennekes (1973a); Dyer (1974); 
Sethuraman and Brown (1976);Touma (1977); Yaglom 
(1977); Carson and Richards (1978); H.N. Lee (1979); 
Sethuraman and Raynor (1979); Skibin and Businger 
(1985); Hanafusa, Lee and Lo (1986); Leahey (1987) 

Mixed layer height: Holzworth (1967,1972); Zilitmkevich 
(1972a,b); Businger and Arya (1974);Tennekes and van 
Ulden (1974); Gryning et al. (1987) 

Mixed layer scaling, convective velocity scale: 

Wyngaard, Cote and Rao (1974); Deardorff and Willis 
(1975); Wyngaard (1975); Willis and Deardorff (1976,1978); 
Panofsky etal. (1977);Venkatram (1978); Nieuwstadt 
(1980b) 

Exchange coefficients: O.G. Sutton (1953); Pasquill (1974); 
Mizuno and Yokoyama (1986) 

Stability criteria: L.F. Richardson (1920,1925,1926); 

Monin and Obukhov (1954); Kazanski and Monin (1960); 
Monin (1970); Obukhov (1971); Willis and Deardorff (1976, 
1978) 

Stability classification: O.G. Sutton (1953); M.E. Smith 
(1956); Singer and Smith (1953,1966); Cramer (1957, 

1959a,b, 1976); Pasquill (1961); D.B. Turner (1961,1964); 
Klug (1969); Carpenter et al. (1971); Colder (1972); 

Luna and Church (1972); F.B. Smith (1973,1979); Liu etal. 
(1976); Hanna etal. (1977); AMS (1978); Clarke (1979 
NRPB R91); Sedeflan and Bennett (1980); Schacher, 

Fairall and Zannetti (1982);Taglizucca and Nanni 
(1983); Kretschmar and Mertens (1984); Skupniewicz 
and Schacher (1984,1986); Hasse and Weber (1985); 

Larsen and Gryning (1986); Ning and Yap (1986); 

Draxler (1987) 

Vertical heat flux: Caughey and Kaimal (1977); Clarke 
(1979 NRPB R91); Maul (1980); Holtslag and van Ulden 
(1983) 

Atmospheric visibility: Horvath (1981) 
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Dispersion 

NRC (Appendix 28 Gas Dispersion, 1974,1979a); G.I. Taylor 
(1915,1921,1927); O.F.T. Roberts (1923); LF. Richardson and 
Proctor (1925); Schmidt (1925); LF. Richardson (1926); 

O.G. Sutton (1932,1947,1953); Dryden (1939); Bakhmeteff 
(1941); Katan (1951); Batchelor (1952,1953,1956,1964); 
Frenkiel (1952); Chamberlain (1953); AFC (1955); Bodurtha 
(1955); Gosline, Falk and Helmers (1955); Crank (1956); 
Cramer (1957,1959a,b); Gifford (1957,1960a, 1961,1962a,b, 
1968,1976a, b,1977,1986,1987);H.L.GreenandLane(1957-); 
Cramer, Record and Vaughan (1958); Hilst and Simpson 
(1958); Hinze (1959); Ellison and Turner (1960); Bowne 
(1961); Friedlander and Topper (1961); Pasquill (1961,1962, 
1965,1975,1976a,b); P.M. Roberts (1961); Monin (1962); 
Beattie (1963 UKAEAAHSB(S) R64); Bryant (1964 
UKAEA AHBS(RP) R42); Cramer et al. (1964); Panofsky 
and Prasad (1965); Yih (1965); Kreyzig (1967); Hansen and 
Shreve (1968); D.O. Martin and Tikvart (1968); R.O. Parker 
and Spata (1968); Ross (1968); Slade (1968); Anderson, 
Hippier and Robinson (1969); API (1969 Publ. 4030,1982 
Publ. 4360,1987 Publ. 4457); ASME (1969/1,1975/2,1979/3, 
4); Briggs (1969); Csanady (1969,1973); Fay and Hoult 
(1969); Larsen (1969); Burgess, Murphy and Zabetakis 
(1970); A.J. Clarke, Lucas and Ross (1970); Hearfield (1970); 
MCA (1970/16); D.B. Turner (1970); Pasquill and Smith 
(1971); Ramsdell and Hinds (1971); Simpson (1971); 
Beryland (1972,1975); J.T. Davies (1972); Monji and 
Businger (1972); Tennekes and Lumley (1972); Yang and 
Meroney (1972); Calder (1973); Haugen (1973,1976); Leslie 
(1973); Mathis and Grose (1973); Ragland (1973); F.B. Smith 
(1973); J.S. Turner (1973); Winter (1973); VJ. Clancey (1974a, 
1976a, 1977a,c); Deardorff and Willis (1974); J.D. Reed 
(1974); Eisenberg, Lynch and Breeding (1975); 

R.W McMullen (1975); Runca and Sardei (1975); Drysdale 
(1976a); Nappo (1976,1981); Willis and Deardorff 
(1976,1978); Bass, Hoffnagle and Egan (1977); Comer 
(1977); S.K Friedlander (1977); Griffiths (1977 SRD R85); 
Kletz (1977-78); US Congress, OTA (1977); AMS (1978); 
R.P. Bell (1978); Carson and Richards (1978); HSE (1978b); 
Nieuwstadt and vanUlden (1978); Slater (1978a); Venkatram 
(1978,1980a); Beychok (1979); Bowne and Yocom (1979); 
Dobbins (1979); S.R. Hanna (1979b); C.J. Harris (1979); 
Harvey (1979b); Nieuwstadt and van Duuren (1979); Raj 
(1979); TNO (1979); T.B. Morrow et al. (1980); Nieuwstadt 
(1980a,b); Reijnhart, Piepers and Toneman (1980); 
Reijnhart and Rose (1980); Rodi (1980); Spencer and 
Farmer (1980); Arya and Shipman (1981); Arya, Shipman 
and Courtney (1981); Bower and Sullivan (1981); Dunker 
(1981); Holtslag, de Bruin and van Ulden (1981); Nappo 
(1981); Steenkist and Nieuwstadt (1981); Venkatram (1981b, 
1988a,b); D.J. Wilson (1981a); deWispelaere 
(1981,1983,1984,1985); S.R. Hanna (1982); S.R. Hanna, 
Briggs and Hosker (1982); N.C. Harris (1982); J.C.R. Hunt 
(1982); Lamb (1982,1984); Mecklenburgh (1982,1985); 
Nieuwstadt and van Dop (1982); O’Shea (1982); Comer et al. 
(1983); C.D. Jones (1983); Ludwig, Listen and Salas (1983); 
Ludwig and Livingston (1983); Diedronks and Tennekes 
(1984); Panofsky and Dutton (1984); Pendergrass and Arya 
(1984); Zeman (1984); Cogan (1985); Hukkoo, Bapat and 
Shirvaikar (1985); Lupini and Tirabassi (1985); 

K.R. Peterson (1985); Carson (1986); Davidson (1986); 
Enger (1986); Hamza and Golay (1986); Jakeman,Taylor 
and Simpson (1986); Mizuno and Yokoyama (1986); de 
Wispelaere, Schiermeier and Gillani (1986); Zanetti (1986, 
1990); Andren (1987); Irwin et al. (1987); Li Zong-Kai and 


Briggs (1988); Lawson, Snyder and Thompson (1989); 
Nema and Tare (1989); Underwood (1989 SRD R483); 

Finch and Serth (1990); S.R. Hanna, Chang and Strimatis 
(1990); Linden and Simpson (1990); Guinnup (1992); 

Runca (1992); van Ulden (1992); Verver and de Leeuw 
(1992); Eckman (1994); Straja (1994) 

Lagrangian models: van Dop (1992); Runca (1992) 

Large eddy simulation: Henn and Sykes (1992); Nieuwstadt 
(1992); Sykes and Henn (1992) 

Models, codes 

Kaiser (1976 SRD R63); NRC (1972); Church (1976); 
Tennekes (1976); Benson (1979); D.B. Turner and 
Novak (1978); NRPB (1979 R91); AGA (1980/31,32); 

Pierce and Timer (1980); Schulman and Scire (1980); 
Zanetti (1981,1990); Hanna et al. (1984); Doron and 
Asculai (1983); Mikkelsen, Larsen and Thykierg-Nielsen 
(1984); Ames et al. (1985); Irwin, Chico and Catalano 
(1985); Berkowitz, Olesen and Torp (1986); EPA (1986); 
Layland, McNaughton and Bodner (1986); H.N. Lee 
(1986); WB. Petersen (1986); Benarie (1987); API (1988 
Publ. 4461,1989 Publ. 4487); Doury (1988); Freiman 
and Hill (1992); Seigneur (1992); Bianconi and 
Tamponi (1993) 

Experimental trials 

M.E. Smith (1951); Pasquill (1956,1962); Lettau and 
Davidson (1957); Barad (1958); Haugen (1959); Islitzer 
(1961,1965); MacCready, Smith and Wolf (1961); F.B. Smith 
and Hays (1961); Barad and Fuquay (1962); Haugen and 
Fuquay (1963); Haugen and Taylor (1963); Islitzer and 
Dumbauld (1963); Cramer et al. (1964); Fuquay, Simpson 
and Hinds (1964); Gartrell etal. (1964); Islitzer and Markee 
(1964); Islitzer and Slade (1964,1968);T.B. Smith et at. 
(1964); J.H. Taylor (1965); Lapin and Foster (1967); McElroy 
and Pooler (1968); Seargeant and Robinett (1968); 
Carpenter et al. (1971); Halitsky and Woodward (1974); van 
der Hoven (1976); Nickola (1977); Nieuwstadt and van 
Duuren (1979); AGA (1980/31); Defense Technical 
Information Center (1980); Doury (1981); Dabberdt etal. 
(1982); Dabberdt etal. (1983);Yersel, Goble and Merrill 
(1983); Vanderborght and Kretschmar (1984); Ramsdell, 
Glantz and Kerns (1985); Briggs etal. (1986); Schiermeier, 
Lavery and Dicristofaro (1986) 

Meandering plumes 

Falk etal( 1953); M.E. Smith (1956); Gifford (1959,1960b); 
Csanady (1973); Vogt, Straka and Geiss (1979); Zanetti 
(1981); S.R. Hanna (1984,1986); Ride (1988) 

Inversion conditions, non-Gaussian models 

Gifford (1960b); Sagendorf (1975); van der Hoven 
(1976); Tennekes (1976); Robson (1983); Hukkoo, 

Bapat and Shirvaikar (1985); Venkatram and 
Paine (1985) 

Calm conditions 

Sagendorf (1975); Gifford (1976a,b); van der Hoven (1976) 

Time-varying conditions 

Ludwig (1981,1984,1986); Skibin (1983) 

Puff vs plume criterion 

Eisenberg, Lynch and Breeding (1975); Hesse (1991b) 
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Similarity models 

Townsend (1956); Panofsky and Prasad (1965); Gifford 
(1968); Csanady (1973); PasquiU (1974,1976b); Scorer 
(1978); Horst (1979); S.R. Hanna, Briggs and Hosker (1982) 

Gradient transfer models, K models 

O.F.T. Roberts (1923); Nieuwstadt and van Ulden (1978); 
Dvore and Vaglio-Laurin (1982); S.R. Hanna, Briggs and 
Hosker (1982); Runca (1982); Gryning, van Ulden and 
Larsen (1983); Gryning and Larsen (1984); Larsen and 
Gryning (1986); Gryning etal. (1987) 

Urban areas 

D.B. Turner (1964); PasquiU (1970); S.R. H a nna (1971,1976); 
W.B. Johnson et al. (1971); Gifford (1972,1976a,b); Ragland 
(1973); Bowne (1974); Chang and Weinstock (1974); 
Dabberdt and Davis (1974); D.S. Johnson and Bornstein 
(1974); Yersel, Goble and Morrill (1983); Depaul and Sheih 
(1985,1986); Oerlemans (1986); Jakeman, Jun and Taylor 
(1988); Surridge and Goldreich (1988); Bachlin, Plate and 
Theurer (1989); Gatz (1991); Grimmond, Cleugh and 
Oke (1991) 

Coastal areas, sea 

Roll (1965); Sethuraman, Brown and Tichler (1974); 

Kondo (1975); Gifford (1976a,b); Lyons (1976); Sethuraman, 
Meyers and Brown (1976); Nichols and Readings (1979); 
Cooper and Nixon (1984 SRD R307); S.R. Hanna, Paine and 
Schulman (1984); Manins (1984); Hasse and Weber (1985); 
Larsen and Gryning (1986); Stunder and Sethuraman 
(1986); Gryning etal. (1987); S.R. Hanna (1987a); Spangler 
and Johnson (1989); Khoo and Chew (1993) 

Model comparisons 

Nappo (1974); Gifford (1976a,b); Long and Pepper (1976); 
Venkatram (1981b); EPA (1984a,b); W.M. Cox and Tikvart 
(1986); Hayes and Moore (1986); Hinrichsen (1986); 
Layland, McNaughton and Bodmer (1986); M.E. Smith 
(1986); Stunder and Sethuraman (1986); Irwin etal. (1987); 
Zannetti (1990); Cirillo and Poll (1992); Dekker and 
Sliggers (1992); Poli and Cirillo (1993) 

Diffusion parameters 

O.G. Sutton (1953); Haugen, Barad and Athanaitas (1961); 
PasquiU (1962,1974,1976a); Hogstrom (1964); Beals (1971); 
Eimutis and Konicek (1972); Montgomery etal. (1973); 
Hosker (1974b); Pendergast and Crawford (1974); 

R. W. McMullen (1975); Draxler (1976,1979); Gifford 
(1976a,b, 1980,1987); AH. Weber (1976); Doran, Horst and 
Nickola (1978); Horst, Doran and Nickola (1979); Sedefian 
and Bennett (1980); DJ.'Wilson (1981a); S.R. Hanna (1981a); 

S. R. Hanna, Briggs and Hosker (1982); Schayes (1982); 
Comer et al (1983); PasquiU and Smith (1983); Irwin (1984); 
Venkatram, Strimaitis and Dicristoforo (1984); Atwater 
and Londergan (1985); Bowling (1985); Henderson-Sellers 
(1986); San Jose etal. (1986); Gryning etal. (1987); 

Wratt (1987); Georgopoulos and Seinfeld (1988); 

R.F. Griffiths (1994b) 

Estimation schemes: AMS (1977); Hanna etal. (1977); Irwin 
(1979a, 1983); Randerson (1979) 

Urban areas: D.B. Turner (1964); McElroy (1969); Bowne 
(1974); Gifford (1976a,b); Santomauro, Maestro and 
Barberis (1979); Yersel, Goble and Morrffl (1983) 

Complex terrain: Kamst and Lyons (1982) 


Dispersion over water: Hosker (1974a); Kondo (1975); Ching- 
Ming Sheih (1981); Hanna, Paine and Schulman (1984); 
Hasse and Weber (1985); Skupniewicz and Schacher (1984); 
Larsen and Gryning (1986) 

Dispersion over short ranges 
O.G. Sutton (1950); Long (1963); G.A. Briggs (1974); 
Hanzevack (1982); Palazzi etal. (1982);Yersel, Golle and 
Morrill (1983); R. Powell (1984); CaUander (1986); Kaufman 
etal. (1990) 

Dispersion from pipelines 

D.J. Wilson (1979b, 1981b) 

Concentration fluctuations, peak-mean 
concentrations 

Gosline (1952); Fuquay (1958); Gifford (1960b, 1970); 

Becker, Hottel andWilliams (1965); Hinds (1969); Barry 
(1971,1972); Ramsdell and Hinds (1971); Csanady (1973); 

C.D. Jones (1979,1983); Fackrell andRobins (1982);D.J.Wilson 
(1982,1986,1991a); D.J.Wilson, Robins and Fackrell (1982, 
1985); D.J.Wilson, Fackrell and Robins (1982); Deardorff and 
WilUs (1984); R.F. Griffiths andMegson (1984); S.R. Hanna 
(1984,1986); Ride (1984a,b, 1988); R.F. Griffiths and Harper 
(1985); D.J.Wilson and Sims (1985); Apsimon and Davison 
(1986); Georgopoulos and Seinfeld (1986); Lewellen and 
Sykes(1986);S.T.Brown(1987);DerksenandSullivan(1987); 
Bara,Wilson and Zelt (1992) 

Emergency gas dispersion modelling (see also 
Table 29.1) 

M.E. Smith etal. (1983); Mudan (1984b); Lynskey (1985); 
Nitz, Endlich and Ludwig (1986); McNaughton, Worley and 
Bodmer (1987); Mulholland and Jury (1987) 

Jets and plumes (seeTable 15.40) 

Obstacles, buildings 

Gifford (1960a, 1976a,b); Halitsky (1963,1968,1977); Barry 
(1964); Hinds (1967,1969); van der Hoven (1968); Slade 
(1968); Dickson, Start and Markee (1969); J.C.R. Hunt 
(1971,1985); Meroney and Yang (1971); AEC (1975); Cagnetti 
(1975); Huber and Snyder (1976,1982); D.J.Wilson (1976, 
1979a); Vincent (1977,1978); Brighton (1978,1986); 

J.C.R. Hunt, Snyder and Lawson (1978); D.J.Wilson and 
Nettervffle (1978); Hosker (1979,1980); Huber (1979,1984, 
1988,1989); Ferrara and Cagnetti (1980); J.C.R. Hunt and 
Snyder (1980); C.D. Barker (1982); Castro and Snyder 
(1982); Fackrell and Robins (1982); Ogawa and Oikawa 
(1982); Ogawa etal. (1982); D.J.Wilson and Britter (1982); 

Li and Meroney (1983); Ogawa, Oikawa and Uehara (1983); 
Fackrell (1984a,b); Snyder and Hunt (1984); C.D. Jones and 
Griffiths (1984); Ryan, Lamb and Robinson (1984); M.E. 
Davies and Singh (1985a); Rottman etal. (1985); Arya and 
Gadiyaram (1986); Bachlin and Plate (1986,1987); Boreham 
(1986); McQuaid (1986); Maryon, Whitlock and Jenkins 
(1986); R.S. Thompson and Shipman (1986); M. Epstein 
(1987); G.A. Briggs et al. (1992); R.S. Thompson (1993) 

Complex terrain 

Egan (1976); Egan, d’Errico and Vaudo (1979); Reible, Shair 
and Kauper (1981); Lett (1984,1986); Callander (1986); P. A. 
Davis etal. (1986); Dawson, Lamb and Stock (1986); 
Dicristofaro and Egan (1986); Horst and Doran (1986); 
Lavery et al. (1986); Massmeyer et al. (1986); Rowe and Tas 
(1986); Schiermeier, Lavery and Dicristofaro (1986); 
Strimaitis and Snyder (1986); R.S. Thompson and 
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Shipman (1986); Arya, Capuana and Fagen (1987); Snyder 
and Britter (1987); Castro, Snyder and Lawson (1988); 
Lawson, Snyder and Thompson (1989); Ohba, 

Okabayashi and Okamoto (1989); Spangler and Johnson 
(1989); Ohba etal. (1990); Ramsdell (1990); Snyder (1990); 
Yoshikawa etal. (1990) 

Physical modelling, wind and water tunnel 
experiments 

Strom and Halitsky (1955); Strom, Hackman and Kaplin 
(1957); Meroney and Yang (1971); Hoot, Meroney and 
Peterka (1973); Meroney, Cermak and Neff (1976); Britter 
(1980); Castro and Snyder (1982); Huber and Snyder (1982); 
Meroney (1982); Ogawa etal. (1982); Bradley and Carpenter 
(1983); Cheah, Cleaver andMilward (1983a,b); Chea etal. 
(1984); Wighus (1983); Ogawa, Oikawa and Uehara (1983); 
Meroney and Lohmeyer (1984); T.B. Morrow, Buckingham 
and Dodge (1984); D.J. Hall and Waters (1985); van Heugten 
and Duijm (1985); Milhe (1986); RiethmuUer (1986); 
Schatzmann, Lohmeyer and Ortner (1987); Snyder and 
Britter (1987); Bara, Wilson and Zelt (1992) 

Flammable cloud formation 

Hess and Stickler (1970); Hess, Leuckel and Stoeckel (1973); 
Burgess et al. (1975); VJ. Clancey (1974a, 1977a,c); 
Eisenberg, Lynch and Breeding (1975); Sadee, Samuels and 
O’Brien (1976-77); R.A. Cox (1977); J.G. Marshall (1977, 
1980); Harvey (1979b); van Buijtenen (1980); T.B. Morrow 
(1982b); Hesse (1991a) 

Infiltration into buildings 

Dick (1949,1950a,b), Dick and Thomas (1951); BRE (1959); 
Megaw (1962); Slade (1968); Handley and Barton (1973); 
AEC (1975); Ministry of Social Affairs (1975); CIBS (1976); 
Brundrett (1977); HSE (1978b); Gufflaumeef a/. (1978); 
KronvaU (1978); Jackman (1980); Warren and Webb 
(1980a,b);Terkonda (1983); Haastrup (1984); Pape and 
Nussey (1985); Sinclair, Psota-Kelty and Weschler (1985); 
PC. Davies and Purdy (1986); Pietersen (1986c); British 
Gas (1987 Comm. 1355); ASHRAE (1988 ASHRAE119); 
El-Shobosky and Hussein (1988); Deaves (1989); Jann 
(1989); van Loo and Opschoor (1989); D.J.Wilson (1990, 
1991b); D.J. Wilson and Zelt (1990); Zelt and Wilson (1990); 
McQuaid (1991); Engelmann (1992); McCaughey and 
Fletcher (1993); Rosebrook and Worm (1993) 

Infiltration into cars: M. Cooke (1988) 

Dispersion in buildings 

B.R. Morton,Taylor and Turner (1956); Baines and Turner 
(1969); L.A.Wallace etal. (1985); Loughan and Yokomoto 
(1989); Cleaver, Marshall and Linden (1994) 

Safe discharge and dispersion 

Bosanquet (1935,1957); Bosanquet and Pearson (1936); 
Chester and Jesser (1952); Bodurtha (1961,1980,1988); 
Long (1963); Loudon (1963); ASME (1969/1); Cairney and 
Cude (1971); Bodurtha, Palmer and Walsh (1973); Cude 
(1974a,b); Nonhebel (1975); de Faveri, Hanzevack and 
Delaney (1982); Hanzevack (1982); Palazzi et al. (1982); 
Jagger and Edmundson (1984); Palazzi et al. (1984); 
Burgoyne (1987); Moodie and Jagger (1987) 

Deposition and removal 

Gregory (1945); Bosanquet, Carey and Halton (1950); 
Chamberlain (1953,1959,1961,1966a,b, 1975); 
Chamberlain and Chadwick (1953,1966); N.G. Stewart etal. 


(1954); Csanady (1955,1973); F.G. May (1958); P.A. Sheppard 
(1958); E.G. Richardson (1960); Leighton (1961); Gifford 
and Pack (1962); F.B. Smith (1962); Hage (1964); Calvert and 
Pitts (1966); Engelmann (1968); van der Hoven (1968); 
Slade (1968); Marble (1970); Beadle and Semonin (1974); 
Demerjian, Kerr and Clavert (1974); Hosker (1974b); Krey 
(1974); AEC (1975); McEwen and Phillips (1975); Dana and 
Hales (1976); Hales (1976); Heicklen (1976); Overcamp 
(1976);VJ. Clancey (1977b); Horst (1977,1980); Sehmel and 
Hodgson (1978,1980); Slater (1978a); McMahon and 
Denison (1979); Jensen (1980); NRPB (1980 R101); Sehmel 
(1980); Corbett (1981); Lodge etal. (1981); Meszaros (1981); 
PM. Foster (1982); Garland and Cox (1982); S.R. Hanna, 
Briggs and Hosker (1982); Hosker and Lindberg (1982); 
Sievering (1982,1989); R.M. Williams (1982a,b); Bartzis 
(1983); Ibrahim, Barrie and Fanaki (1983); Murphy and 
Nelson (1983); Pruppacher, Semonin and Slinn (1983); 
Cadle, Dasch and Mulawa (1985); Cher (1985); Doran and 
Horst (1985); El-Shobosky (1985); Schack, Pratsinis and 
Friedlander (1985); Sinclair, Psota-Kelty and Weschler 
(1985); Kumar (1986); Bettis, Makhviladze and Nolan 
(1987); Underwood (1987,1987 SRD R423,1988 SRD R442); 
Bache, Lawson and Uk (1988); M. Bennett (1988); 
El-Shobosky and Hussain (1988); Joffre (1988); Nicholson 
(1988,1993); Venkatram (1988b); Dugstad and Venkatram 
(1989); Adhikari etal. (1990); M.P. Singh, Kumari and 
Ghosh (1990); A.G. Allen, Harrison and Nicholson (1991); 
Schorling and Kardel (1993) 

Vapour solubility and chemical reactions 

Clough and Garland (1970); Murata et al. (1974); HSE 
(1978b); Burton etal. (1983); Das Gupta and Shen Dong 
(1986); Raj (1986); Shi and Seinfeld (1991) 

Topics common to passive and dense gas 
dispersion, including source terms, mitigation 
systems and hazard assessment (see Table 15.42) 


15.11.1 Dispersion situations 

Dispersion situations may be classified as follows. The 
fluid and the source may be classified as: 


(1) Fluid buoyancy 

(a) neutral buoyancy, 

(b) positive buoyancy, 

(c) negative buoyancy 

(2) Momentum 

(a) low momentum, 

(b) high momentum. 

(3) Source geometry 

(a) point source, 

(b) line source, 

(c) area source. 

(4) Source duration 

(a) instantaneous, 

(b) continuous, 

(c) intermediate. 

(5) Source elevation 

(a) ground level source, 

(b) elevated source. 
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The dispersion takes place under particular meteorological 
and topographical conditions. Some principal features of 
these are as follows: 

(1) Meteorology 

(a) wind, 

(b) stability. 

(2) Topography 

(a) surface roughness, 

(b) near buildings and obstructions, 

(c) over urban areas, 

(d) over coastal zones and sea, 

(e) over complex terrain. 


These aspects of the dispersion situation are now 
considered. 

15.11.2 Buoyancy effects 

The fluid may have neutral, positive or negative buoyancy. 
Neutral density is generally the default assumption and 
applies where the density of the gas-air mixture is close to 
that of air. This is the case where the density of the gas 
released is close to that of air or where the concentration of 
the gas is low. In determining the density of the gas it is 
necessary to consider not only molecular weight but also 
the temperature and liquid droplets. Gases with positive 
buoyancy include those with low molecular weight and hot 
gases. Many hazardous materials, however, form nega¬ 
tively buoyant gases, or heavy gases. 

Much of the fundamental work on dispersion, and the 
models derived from this work, relate to the dispersion of 
gas of neutral density, or neutral buoyancy. This work is 
relevant to dispersion from stacks once buoyancy effects 
have decayed. There are separate models that treat gases of 
positive buoyancy, which apply to releases close to stacks, 
and gases of negative buoyancy. Dispersion of gases that do 
not exhibit positive or negative buoyancy is generally 
referred to as ‘passive dispersion’. 

15.11.3 Momentum effects 

A continuous release of material with low kinetic energy 
forms a plume that tends to billow. If the kinetic energy is 
high, however, a momentum jet is formed which has a well- 
defined shape. 

The momentum of the release has a marked effect on the 
extent of air entrainment. If the kinetic energy is high, 
large quantities of air are entrained. The degree of air 
entrainment affects the density of the cloud and is impor¬ 
tant in its further dispersion. 

15.11.4 Source terms 

The principal types of source used in idealized treatments 
of dispersion are the point source, the line source and 
the area source. An escape from a pipe is normally treated 
as a point source, while vaporization from a pool may be 
treated as an area source. There may also be some situa¬ 
tions that may be modelled as an infinite or semi-infinite 
line source. 

Avery short and a prolonged escape may approximate to 
an instantaneous release and to a continuous release, 
respectively. An escape of intermediate duration, however, 
may need to be treated as a quasi-instantaneous or, alter¬ 
natively, quasi-continuous release. 


The most common scenarios considered are an instan¬ 
taneous release from a point source, or ‘puff’, and a con¬ 
tinuous release from a point source, or ‘plume’. 

It will be apparent that the source terms described are 
idealizations of the actual situation. 

15.11.5 Source elevation 

Another distinction is the elevation of the source. Sources 
are classed as ground level or elevated. Most hazardous 
escapes are treated as ground level sources. Stacks are the 
principal elevated sources. 

15.11.6 Meteorology and topography 

The two main meteorological conditions that affect the 
dispersion are the wind direction and speed and the stabil¬ 
ity conditions. 

The stability of the atmosphere determines the degree of 
mixing. The simplest classification of stability is: 

(1) unstable; 

(2) neutral; 

(3) stable. 

Dispersion is greatest in unstable conditions and least in 
stable conditions. 

With respect to topography the default condition may be 
regarded as dispersion over flat grassland of moderate 
roughness, but there are many other situations, including 
dispersion over surfaces with very low or very high rough¬ 
ness, at buildings or other obstacles, over urban areas, over 
coastal zones and sea, and over other complex terrain. 

Meteorology and topography are discussed further in 
Sections 15.12 and 15.13, respectively. 


15.11.7 Dispersion of passive gas plume 

As already mentioned, the dispersion situation that has 
been studied most extensively is the dispersion of a plume 
of neutral density gas from a continuous point source. It is 
convenient at this point to consider some basic features of 
gas dispersion in relation to this source term. 

It has frequently been shown by experiment that for such 
a plume both the crosswind and vertical concentration 
distributions are approximately Gaussian, as illustrated in 
Figure 15.31(a). 

By convention, the boundaries of a cloud are defined in 
dispersion work as the locus of the points at which the 
concentration has fallen to 1/10 of that at the centre. For a 
plume at ground level the horizontal and vertical cloud 
boundaries are given by the envelope at which the 
concentrations are 1/10 of those down the centre line. This 
defines the cloud width w, the lateral spread 6 and the 
cloud height h, as shown in Figure 15.31(b). 

Since the concentration distribution is Gaussian, the 
cloud spread may also be defined in terms of the standard 
deviations of concentration in the crosswindy and vertical 
z directions o y and a z . The relation between the cloud height 
h and vertical standard deviation a z is 

h = 2.15c-, [15.11.1] 

The factor of 2.15 derives from the Gaussian distribution 
and corresponds to the 1/10 maximum value. 
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15.11.8 Co-ordinate systems for gas dispersion 

Three widely used co-ordinate systems are (1) the rectan¬ 
gular, (2) the spherical and (3) the cylindrical systems. 
A treatment of their use in chemical engineering is given by 
Bird, Stewart and Lightfoot (1960). 

Most gas dispersion modelling utilizes rectangular 
coordinates (x, y, z). For dispersion of instantaneous 
releases it is sometimes convenient to use spherical co¬ 
ordinates (r, 6). Models for instantaneous releases may use 
a coordinate system moving with the cloud. Some use is 
made of special coordinate systems. An example is that 
used in the DRIFT model described in Section 17.35. 

15.11.9 Concentration fluctuations and sampling 

It is found experimentally that if the concentration in a gas 
cloud from a continuous point source under near neutral 
conditions is measured at points along an arc across wind, 
the distribution of concentration obtained is Gaussian, but 
the shape of the distribution depends on the sampling 
interval. If the sample is virtually instantaneous, the dis¬ 
tribution has a relatively narrow spread and a high maxi¬ 
mum, while if the sample is averaged over a time period the 
distribution has a wider spread and a lower maximum.This 
behaviour is illustrated in Figure 15.32. 

Typically, at 100 m the total width of the cloud as meas¬ 
ured by instantaneous samples is about 20 m, but the 
width as measured by time mean samples is about 35 m. 
The width of the cloud increases rapidly as the interval 
over which the sample is averaged increases from zero to 
2 min. For intervals greater than 3 min the concentration 
distribution remains fairly constant, provided the wind 
direction does not alter. 

Over longer periods, however, the wind does alter direc¬ 
tion and there is a further but more gradual increase in the 
spread of the concentration distribution. The variation of 
concentration with sampling period may be taken into 
account using a relation of the form 

[15.11.2] 

where t is the sampling period which yields concentration 
X, p is an index and subscript r denotes the reference value. 


There can be considerable differences between peak and 
time-mean concentrations. Values of the peak/mean ratio of 
50 or more have been reported in some investigations. The 
concentrations given by the common dispersion models for 
passive dispersion gas are time-mean values. In some 
applications it is necessary also to consider the peak 
values. 


15.11.10 Models for passive gas dispersion 

The modelling of dispersion, particularly that of neutral 
density gas, and passive gas dispersion models are dis¬ 
cussed further in Sections 15.15 and 15.16, respectively. 
Passive gas dispersion over particular surfaces and in 
particular conditions is considered in Sections 15.17 and 
15.18, while dispersion parameters for passive gas disper¬ 
sion models are described in Section 15.19. 


15.11.11 Models for dense gas dispersion 

For high concentration releases of many of the hazardous 
materials of interest in process plants the assumption of 
neutral density gas behaviour is not valid. In particular, the 
gas cloud is often heavier than air. In this situation the 
common neutral density gas models are not applicable. 
However, the behaviour of dense gases has been the subject 
of much work in recent years and dense gas dispersion 
models have been developed. Dispersion of dense gas is 
discussed further in Section 15.22 and succeeding sections. 

15.11.12 Other topics 

Other topics in gas dispersion considered below include 
dispersion of buoyant plumes and momentum jets, con¬ 
centration fluctuations, dispersion over short distances, 
transformation and removal mechanisms, flammable and 
toxic clouds, infiltration into buildings, fugitive emissions, 
dispersion by fluid curtains and leaks and spillages. 


15.12 Meteorology 

Gas dispersion depends on meteorology and, in particular, 
on turbulence. Both the form of the models used to describe 
dispersion and the values of the parameters in them derive 
from meteorological considerations. 
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Accounts of meteorology include those given in Physical 
and Dynamical Meteorology (Brunt, 1934), The Climate Near 
the Ground (Geiger, 1950-), Micrometeorology (O.G. Sutton, 
1953), The Challenge of the Atmosphere (O.G. Sutton, 1962), 
Elementary Meteorology (G.F. Taylor, 1954), Exploring the 
Atmosphere’s First Mile (Lettau and Davidson, 1962), 
Natural Aerodynamics (Scorer, 1958), Environmental 
Aerodynamics (Scorer, 1978), General Meteorology (Byers, 
1959), Atmospheric Diffusion (Pasquill, 1962a, 1974; Pasquill 
and Smith, 1983), An Introduction to Climate (Trewartha, 
1968), Essentials of Meteorology (McIntosh and Thorn, 1969), 
Evaporation into the Atmosphere (Brutsaert, 1982), CRC 
Handbook of Atmospherics (Volland, 1982), Engineering 
Meteorology (Plate, 1982) and Meteorological Glossary 
(McIntosh, 1972), Dynamics in Atmospheric Physics (Lindzen, 
1990), and in the Meteorological Glossary (McIntosh, 
1972). An account specific to the United Kingdom is 
available in Climate in the United Kingdom (Page and 
Lebens, 1986). 

Works on turbulence and related phenomena include 
Massenaustausch in freier Luft and verwandte Erscheinun- 
gen (Schmidt, 1925), Turbulence (Hinze, 1959), Turbulent 
Transfer in the Lower Atmosphere (Priestley, 1959), Bounda¬ 
ry Layer Theory (Schlichtling, 1960), Turbulence: Classic 
Papers on Statistical Theory (Friedlander and Topper, 1961), 
The Structure of Atmospheric Turbulence (Lumley and 
Panofsky, 1964), Introduction to Turbulence and Its 
Measurement (Bradshaw, 1971), Statistical Fluid Mechanics: 
Mechanics of Turbulence (Monin and Yaglom, 1971), Turbu¬ 
lence Phenomena (J.T. Davies, 1972), A First Course in 
Turbulence (Tennekes and Lumley, 1972), Turbulent Diffu¬ 
sion in the Environment (Csanady, 1973), Buoyancy Effects 
in Fluids (U.S. Turner, 1973), Mathematical Modelling of 
Turbulent Diffusion in the Environment (C.J. Harris, 1979) 
and Turbulence and Diffusion in Stable Environments 
(Q.C.R. Hunt, 1985). 


Treatments of gas dispersion, with particular emphasis 
on air pollution, include those given in Atmospheric 
Pollution: Compendium of Meteorology (Hewson, 1951), Air 
Pollution (Scorer, 1968), Contemporary Problems of Atmos¬ 
pheric Diffusion and Pollution in the Atmosphere (Beryland, 
1975), Atmospheric Motion and Air Pollution (Dobbins, 1979), 
Air Pollution Modelling and its Application (de Wispelaere, 
1981, 1983, 1984, 1985; de Wispelaere, Schiermeier and 
Gillani, 1986), Atmospheric Diffusion (Pasquill and Smith, 
1983), and Atmospheric Turbulence and Air Pollution Model¬ 
ling (Nieuwstadt and van Dop, 1982). 

15.12.1 Atmospheric boundary layer 

The meteorological conditions that are of prime relevance 
here are those within the atmospheric boundary layer 
(ABL), or planetary boundary layer (PEL). In unstable, or 
convective, conditions this layer is also known as the con¬ 
vective boundary layer (CBL). 

The ABL has an outer and an inner region, as shown in 
Figure 15.33. The outer region, or defect layer, has a height 
of some 10 z -10 3 m and the inner region, or surface layer, 
one of some 10 m. There is within the surface sublayer a 
dynamic sublayer with a height of 1-10 m. Between the 
dynamic sublayer and the surface is the interfacial layer, 
the height of which depends on the surface roughness. 

Within the PEL, the surface layer is of particular impor¬ 
tance. Within this layer stress is virtually constant and it is 
also termed the constant stress layer, or surface stress layer. 
Considering the PEL over land, conditions in the layer 
depend on the stability conditions. The simplest case is that 
of neutral conditions where buoyancy forces are negligible. 
It is to this case that the classical treatments primarily apply. 

In the neutral PEL turbulent energy derives from two 
main sources. One is due to the mechanical drag of the wind 
over the surface, and the other to the turning of the wind 
direction with height. In the unstable boundary layer 
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Figure 15.33 Atmospheric boundary layer: orders of magnitude of the heights of the sublayers (Brutsaert, 1982). 

The vertical scale (m) is distorted; h„ is the height of the roughness obstances (Courtesy of Reidel Publishing Company) 


a further source of turbulent energy is that due to buoy¬ 
ancy. Over land, such buoyancy is mainly caused by ver¬ 
tical flux of sensible heat into the air at the surface. Over 
sea, vertical flux of latent heat associated with water 
vapour plays a significant role. 

Stable conditions occur mainly at night. In the stable 
boundary layer the surface is cool relative to the air and 
the vertical heat flux is in the reverse direction so that the 
mechanical and buoyancy forces are opposed. At some 
height above the surface turbulence becomes very weak 
and is virtually suppressed. 

15.12.2 Wind characteristics 

Wind is a main factor in determining dispersion. Some 
principal wind characteristics are: 

(1) direction; 

(2) speed 

(a) at surface, 

(b) above ground; 

(3) persistence; 

(4) turbulence. 

Wind direction is defined as the direction from which the 
wind is blowing. Information on wind direction and speed 
at a given location is conveniently summarized in the form 
of a ‘wind rose’. This is a polar diagram in which the length 
of the sections of the spokes is proportional to the observed 
frequencies of wind direction and speed. The period for 
which the wind rose is drawn is typically a month or a year. 
Some monthly wind roses show a marked degree of sea¬ 
sonal variation, others do not. The degree of symmetry in 
wind roses also varies considerably. A table of percentage 
frequency of wind direction and speed and corresponding 
wind rose for Watnall is shown in Figure 15.34. 


The predominant wind direction is usually called the 
‘prevailing wind’. This wind direction only applies, how¬ 
ever, for a relatively limited proportion of the time, and it is 
usually necessary in dispersion calculations to consider 
other directions also. 

Persistence of the wind direction is important in asses¬ 
sing dispersion. This is often expressed in the form of a 
persistence table such as that shown for Watnall in 
Table 15.11, which gives the number of occasions during the 
given period in which the wind remained within the sectors 
indicated for the number of hours in sequence indicated. 

Alternatively, the persistence of wind direction may be 
expressed in terms of the constancy, which is based on the 
ratio of the vector and scalar winds and has a value of 1 for 
an invariant wind direction and 0 for a completely uniform 
distribution of wind directions. This measure has the 
advantage that, unlike persistence, it is relatively little 
affected by brief excursions outside the 45° sector. 

Localized variations of wind direction and speed can 
occur and may affect dispersion. Features that can give rise 
to these variations include irregularities in terrain and 
differences in surface temperature.Where there is a marked 
slope, a drainage wind can occur. This is a downhill flow of 
air cooled by radiation at night and it may be in a direction 
quite different from the gradient wind. In well-defined 
valleys there are usually complex flow patterns. Typically, 
at night there is a drainage wind from the sides and down 
the bottom of the valley and during the day a tendency for 
wind to flow up the valley bottom. On the coast the land is 
warmer in daytime and the sea at night. Hence during the 
day there tends to be a sea breeze blowing onto the land and 
during the night a land breeze blowing towards the sea. 

Thrbulence is another feature of wind variation. In the 
present context turbulence includes wind fluctuations with 
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Figure 15.34 Table of percentage frequency of wind direction and speed and corresponding wind rose for Watnall, 
1959-68 (Meteorological Office, 1977; reproduced by permission) 


Table 15.11 Table of wind persistence for Watnall, 1974- 76 (Meteorological Office, 1977; reproduced by permission) 


No. of hours in sequence 




Direction 




N 

NE 

E 

SE 

S 

sw 

W 

NW 

1 

756 

565 

510 

411 

587 

1043 

1087 

721 

7 

91 

110 

64 

29 

82 

176 

202 

46 

13 

27 

49 

29 

4 

49 

97 

72 

12 

25 

14 

8 

8 

2 

6 

15 

9 

2 

37 

2 

7 

1 

0 

0 

6 

5 

0 

>49 

0 

5 

0 

0 

0 

2 

3 

0 

Total no. of hours 

3374 

4007 

2404 

1190 

3106 

6503 

6153 

2202 

Watnall: latitude 53° 01' N, longitude 01° 15' W 








a frequency of more than 2 cycle/h, the most important 
fluctuations lying in the range 0.1-1 cycle/s. The main 
factors that determine the turbulence are the gradient wind 
speed and the roughness of the terrain, and the tempera¬ 
ture differences between the surface and the air. Turbulence 
tends to increase as the gradient wind speed increases, or 
as the temperature of the air close to the surface increases, 
relative to that of the air aloft. A measure of turbulence is 
given by the standard deviation, or, o, value of the wind 
fluctuations over a 1 h period. These wind speed a values 
can be related to the dispersion a values in the models of 
gas dispersion. 

Before leaving wind characteristics, it is convenient to 
give at this point the method of characterizing high wind 
speeds. This is the Beaufort scale, developed originally for 
use at sea. It is shown inTable 15.12. The scale is not used in 
work on gas dispersion, but is relevant to wind hazard. 


15.12.3 Geostrophic wind and Ekman spiral 

In the free atmosphere above the PEL it is usual to assume 
that the wind is horizontal and free from friction. In this 
situation the wind velocity becomes a function of the pres¬ 
sure gradient and of the forces arising from the rotation of 
the Earth. The wind that satisfies these conditions is 
known as the gradient level wind. 

Where the lines of constant pressure, or isobars, are 
straight so that any centripetal acceleration is negligible, 
the gradient level wind is known as the geostrophic wind. 
The direction of the geostrophic wind is not the same as the 
surface wind. An idealized representation of the wind 
velocity vectors at different heights is given hy the Ekman 
spiral, developed originally in relation to ocean currents, as 
shown in Figure 15.35. The Ekman spiral is the locus of the 
end points of the wind velocity vectors. These vectors 
approach the geostrophic wind velocity at the mixed layer 
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Table 15.12 The Beaufort Scale 



Force 

Wind speed a (mile/h) 

Description 

Specification (land) 

Weather 

forecast 


Average 

Limits 



0 

<1 


Calm 

Calm; smoke rises vertically 

Calm 

1 

2 

1-3 

Light air 

Wind shown by smoke drift, not wind vanes 

Light 

2 

5 

4-7 

Light breeze 

Wind felt on face; leaves rustle 

Light 

3 

10 

8-12 

Gentle breeze 

Leaves and small twigs in constant motion 

Light 

4 

15 

13-18 

Moderate breeze 

Raises dusts and loose paper 

Moderate 

5 

21 

19-24 

Fresh breeze 

Small trees in leaf begin to sway 

Fresh 

6 

28 

25-31 

Strong breeze 

Large branches in motion; whistling heard 
in telegraph 

Strong 

7 

35 

32-38 

Near gale 

Whole trees in motion; inconvenience when 
walking against the wind 

Strong 

8 

42 

39-46 

Gale 

Breaks twigs off trees; generally impedes progress 

Gale 

9 

50 

47-54 

Strong gale 

Slight structural damage 

Severe gale 

10 

59 

55-63 

Storm 

Trees uprooted; considerable structural damage 


11 

68 

64-72 

Violent storm 

Very rarely experienced; accompanied by 
widespread damage 

Violent 

12 

>73 


Hurricane 

As Force 11 

Hurricane 


a Wind speeds are average speeds measured at a height of 10 1 



GEOSTROPHIC WIND SPEED 


Figure 15.35 Geostrophic wind and Ekman spiral (S.R. Hanna, Briggs and Hosker, 1982). The wind velocity vectors 
(z 1: z 2 , z 3 ) approach the geostrophic wind velocity vector at the top of the mixed layer z, 


height. The angle of a vector is the angle by which it is 
backed from the direction of the geostrophic wind. The 
angle of the surface wind vector is backed 45° from this 
direction. Actual observed angles between the geostrophic 
and surface winds are typically 5-10°, 15-20° and 30-50° 
for unstable, neutral and stable conditions, respectively. 

Wind direction shear affects dispersion, particularly 
over large distances, where the top and bottom of a plume 
can move with a difference of direction of some 40-50°, 
which gives a much larger plume spread than would be 
obtained by diffusion alone. 


15.12.4 Force balance equation 

The balance of forces acting horizontally on the air in free 
stream conditions is given by the relations 

5 +/ '-^5 +x > 15121 *] 

%* Y l 151211 « 


where/is the Coriolis force, p is the pressure, t is the time, u 
and v are the wind velocity components in the downwind 
and crosswind directions, respectively, X and Fare accel¬ 
erations representative of forces not due to pressure and 
gravity, and p is the air density. The Coriolis force, or para¬ 
meter,/is 

/ = 2o> sin 0 [15.12.2] 

where 0 is the latitude and co is the angular velocity of the 
Earth.The Coriolis force has a value of approximately 10 -4 s _1 
at intermediate latitudes and tends to zero atthe equator. 


15.12.5 Turbulent exchange, momentum flux, 
eddy viscosity and mixing length 

The theory of turbulence derives from the work of Schiller 
(1932), Nikuradse (1933), Prandtl (1933) and Schlichtling 
(1936) on the boundary layer for flow in pipes. The exten¬ 
sion of this theory for flow over open ground is described 
by O.G. Sutton (1953) and Pasquill (1962a). The theories of 
turbulence which describe the mixing that occurs when 
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wind passes over a surface are complex. The treatment 
given here is limited to the description of a few simple 
concepts and relations. The momentum flux is given by 
the equation 

I=(v + ZM)g [15.12.3a] 

The eddy viscosity K M is generally much greater than the 
kinematic viscosity v, and hence 

v<K m [15.12.3b] 


U,^(z/pf 2 [15.12.11b] 

The friction velocity may be obtained from the geostrophic 
wind velocity using the relation 

u, = CgU g [15.12.12] 

where c g is the drag coefficient and u g is the geostrophic 
wind speed. 

An empirical relation for the drag coefficient c g in neu¬ 
tral conditions has been given by Lettau (1959) as follows: 


where K M is the eddy viscosity, u is the mean wind speed, 
z is the height, v is the kinematic viscosity of air, p is the 
density of air and r the mean momentum flux per unit area. 

The constant K M is variously described as the coefficient 
of exchange for momentum, the eddy diffusivity for 
momentum, or the eddy viscosity. In terms of the mixing 
length theory of Prandtl, 


0.16 

log 10 Ro-1.8 





[15.12.13] 


[15.12.14] 


Km = 1 2 ^ [15.12.4] 

where l is the mixing length. The momentum flux is then 



On the assumption that the mixing length is proportional 
to the distance from the surface, 


where Ro is the Rossby number and z 0 is the roughness 
length. 

For other stability conditions Lettau uses the following 
approximate ratios of the drag coefficient to that in neutral 
conditions: 


Unstable 1.2 

Slightly stable 0.8 

Stable 0.6 


t-kz [15.12.6] 

where the constant k is von Karman’s constant. The value 
usually quoted for von Karman’s constant is 0.4. A value of 
0.35 has been given by Businger et al. (1971). 

From Equation 15.12.3b and the relation ul = r/p, 
described below, 



The value of the friction velocity varies between about 3 
and 12% of the mean wind speed, the lower values being 
associated with smooth surfaces. It is often taken as one- 
tenth of the wind speed. The friction velocity is generally 
tabulated together with the surface roughness as a func¬ 
tion of the type of surface, as described below. 

15.12.7 Law of the wall 

On the assumption that the flow at the surface depends 
only on the shear stress and the distance from the wall 


Then from Equations 15.12.7 and the ‘law of the wall’ j 

Equation 15.12.15, given below, — = -g- [15.12.15] 


K u = ku,z [15.12.8] 

In terms of mixing length theory, using Equation 15.12.6, 
Equation 15.12.15 may be rewritten as 


l d u 
u , dz 


[15.12.9] 


and Equation 15.12.8 as 

Kyi = u,l [15.12.10] 


This is the so-called ‘law of the wall’. The term (kzdu/u r dz) 
is a non-dimensional wind shear. Equation 15.12.15 is 
applicable to adiabatic, or neutral, conditions. 

15.12.8 Empirical vertical wind velocity profile 

The gradient wind is, by definition, uninfluenced by fric¬ 
tion effects, but at lower heights the wind velocity is 
reduced by such effects. Figure 15.36 illustrates some ver¬ 
tical profiles of wind speed. 

A widely used empirical relation for the vertical wind 
velocity profile is 


15.12.6 Friction velocity 

Closely related to the momentum flux is the friction veloc¬ 
ity u, defined by the relations 

- = (4 [15.12.11a] 


***©' 


[15.12.16] 


where u is the wind speed, u r is the wind speed at the 
reference height, z is the height, z r the reference height and 
p is an index. 
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(b) 

Figure 15.36 Wind speed vs height above ground (American Society of Mechanical Engineers, 1973/2): (a) effect of 
stability conditions on wind speed; (b) effect of terrain on wind speed 


The gradient level reference height z r lies approximately 
in the range 300-750 m, being typically 300 m over level 
ground and 500 m over an urban area. 

The value of the index p generally lies in the range 0.11 < 
p < 0.65, and invariably in the range 0 <p < 1. Range values 
obtained include: 0.145 <p< 0.77 by Frost (1947); 0.10 <p < 
0.63 byTouma (1977); and 0.11 <p< 0.65 by Hanafusa, Lee 
and Lo (1986). 

As pointed out by O.G. Sutton (1953), the generally 
accepted value of the index p for the turbulent boundary 
layer of a flat plate in a wind tunnel is 1/7 (0.142). 


Touma states that in the absence of measured values the 
wind speed is generally estimated using the 1/7 wind pro¬ 
file and assuming neutral stability conditions. He presents 
experimental data, however, which indicate that the index p 
has a value of about 0.10 at Pasquill stability category A, 
may pass at some sites through a weak minimum and then 
increases markedly through categories D—F to a value of 
up to 0.62. 

In further experimental work in Japan by Hanafusa, 
Lee and Lo (1986), the value of the index p varied 
with the Pasquill stability categories approximately 
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follows: 


Pasquill stability category 

Index, p 

A 

0.33 

B 

0.26 

C 

0.20 

D, E 

0.38 

F 

0.42 

G 

0.57 


effects. For diabatic conditions Equation 15.12.15 may be 
modified by the inclusion of the similarity factor intro¬ 
duced by Monin and Obukhov (1954). It then becomes 

where 0 m is the similarity factor. These authors take 
0 m =/(*/£) [15.12.22] 


The strong increase in the index p with stability categories 
D-F broadly confirmed that found by Touma, but the 
values of p for categories A and B were higher than those 
obtained by the latter. The authors suggest that the differ¬ 
ence may be due to the different methods used to define the 
stability category. The index 0 may also be written as 

p = n/(2-n) [15.12.17] 

where n is an index. This index is one of the parameters in 
the Sutton model for neutral density gas dispersion, as 
described below. 


15.12.9 Empirical vertical wind velocity 
profile: Deacon relation 

An empirical relation for the vertical wind velocity gra¬ 
dient was formulated by Deacon (1949) as follows: 



where a is a constant and /J an index. He gave the following 
values of the index /?: 

P > 1 superadiabatic conditions 
/? = 1 adiabatic conditions, or small temperature 
gradients 

/? < 1 inversion conditions 
Then for 0=1 


They also use the relation 


Pm [15.12.23] 

which yields for Equation 15.12.21 


I -£( 1 + “0 I 151221 ! 

where L is a characteristic length (the Monin—Obukhov 
length), and a is the Monin-Obukhov coefficient. Inte¬ 
grating Equation 15.12.24 

+a [15.12.25] 

and taking2>2 0 yields 

« = |[ln(z/z 0 )+a|] [15.12.26] 

This is the log-linear vertical wind velocity profile. The 
log-linear velocity profile is applicable over a limited 
range of unstable conditions and a wide range of stable 
conditions. In a further treatment Ragland (1973) has given 


[15.12.19] 


Equation 15.12.19 is an alternative form of the law of the 
wall given above as Equation 15.12.15. 

15.12.10 Logarithmic vertical wind velocity profile 

Another vertical wind velocity profile is the logarithmic 
profile. This is applicable to adiabatic, or neutral, condi¬ 
tions. The logarithmic vertical wind velocity profile is 
obtained by integration of Equation 15.12.15 to give 


0 M = 1 neutral conditions z<(ku,/f) [15.12.27a] 

s| + i^ stable conditions 0<^<1 [15.12.27b] 
= l+a neutral conditions 1<^<6 [15.12.27c] 

= (l - 15J) stable conditions —2<~ <0 

[15.12.27d] 


|m2 ' 201 

where z„ is a constant of integration. This constant is 
termed the ‘roughness length’. 

15.12.11 Modified logarithmic vertical 
wind velocity profiles 

For non-adiabatic, or diabatic, conditions a different treat¬ 
ment is required. The analysis is complicated by buoyancy 


He quotes for a the value of 5.2 given by Webb (1970). 

15.12.12 Surface roughness and roughness length 

A surface is aerodynamically rough when the flow is tur¬ 
bulent down to the surface itself. Over such a surface the 
velocity profile and surface drag are independent of vis¬ 
cosity and depend on the roughness length. In meteorology, 
nearly all surfaces are aerodynamically rough for any sig¬ 
nificant wind speed. The roughness length depends on the 
height and spacing of the roughness elements. 
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From work on pipe roughness, the roughness length z a 
and the mean height e of the roughness elements are related 
approximately as follows: 

z„ = e/30 [15.12.28] 

Roughness of flow may be defined in terms of the rough¬ 
ness Reynolds number «„z/v. For fully rough flow the cri¬ 
terion obtained from Nikuradse’s work is 

— > 75 [15.12.29a] 


or, using Equation 15.12.28, 


— > 2.5 [15.12.29b] 

Paeschke (1937) correlated roughness length z a with the 
mean height e of roughness elements on a larger scale and 
obtained for various grass and field surfaces 

Zq = e/7.35 [15.12.30] 

Other workers have obtained similar results, while yet 
others have found it to be a more complex function. Some 
typical values of the roughness length given in the litera¬ 
ture are shown in Table 15.13. 

For very rough surfaces the logarithmic wind profile of 
Equation 15.12.20 may be extended using the empirical 
modification 

u = ^ln^— z>(d+z 0 ) [15.12.31] 

where d is the zero plane displacement, or displacement 
height. 

The displacement height d is the datum level above 
which normal turbulent exchange occurs. Using the dis¬ 
placement height concept the base of the roughness 
elements is at z = 0. 


Table 15.13 Some values of roughness length 


A Values given by O.G. Sutton (1953) 

Type of surface 

2o 

u . 


(cm) 

(cm/s) 

Very smooth (mud flats, ice) 

0.001 

16 

This grass upto 10 cm high 

0.7 

36 

Thick grass upto 50 cm high 

9 

63 

B Values given by Pasquill and Smith (1983) 

Type of surface 

(m) 


Grass: closely mown 

10“ 3 


short (c. 10 cm) 

10“ 2 


long 

3 x 10“ 2 


Agricultural-rural complex 
Towns, forests 

0.2 



15.12.13 Vertical temperature profile 

The stability of the atmosphere is essentially the extent to 
which it allows vertical motion by suppressing or assisting 
turbulence. One source of turbulence is the mechanical 
turbulence due to wind movement. Another is the turbu¬ 
lence associated with the vertical temperature gradient. 
Traditionally stability has been expressed primarily in 
terms of the latter. 

If a small volume of air is taken vertically upward in the 
atmosphere, it meets lower pressure and therefore expands 
and cools. The rate of decrease of temperature with height 
is known as the lapse rate. If the air were dry and the pro¬ 
cess adiabatic, then the rate of decrease would have a par¬ 
ticular value which is known as the dry adiabatic lapse rate 
of temperature. Although such a process does not occur in 
the atmosphere, the dry adiabatic lapse rate provides a 
standard of comparison for real atmospheric conditions. 

The rate of change of temperature with height dT/dz 
under adiabatic, or neutral, conditions is approximately 
-0.01°C/m. The definition of lapse rate as a rate of decrease 
of temperature, and thus as a positive quantity under 
adiabatic conditions, is a potential source of confusion. It is 
appropriate, therefore, to quote the following statement by 
O.G. Sutton (1953, p. 9): ‘dT/dz = -l°C per 100 m. This 
particular rate of decrease of temperature with height, 
known as the dry adiabatic lapse rate and denoted by the 
symbol T (gamma), is one of the fundamental constants of 
meteorology’. 

The potential temperature 9 of dry air is the temperature 
attained if a small volume of the air is taken adiabatically 
from its existing pressure to a standard pressure, usually 
that at the surface. Then 


t (jT' 


[15.12.32] 


where p is the absolute original pressure, p B is the absolute 
pressure at the surface, T is the absolute temperature of 
the volume of air and 9 is the potential temperature of 
this air. 

Taking logarithms of Equation 15.12.32 and differ¬ 
entiating with respect to z: 


ldd _ ldT y-1 1 dp 
Odz T dz y p dz 


[15.12.33] 


and noting that 

dp = gp(-dz) [15.12.34] 

P = 4f [15.12.35] 


where g is the acceleration due to gravity, R is the universal 
gas constant and y is the ratio of the specific heats of air, the 
following relation is obtained: 


ldfl _ /l 
8dz~T 


[15.12.36] 
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y- i g 

7 R 


[15.12.37] 


The term (dT/dz + T) is the difference between the actual 
temperature gradient and the dry adiabatic lapse rate. 
Under adiabatic conditions it is zero, so that dT/dz = — r. 

At the surface the potential temperature 8 and the 
absolute temperature T are equal by definition, so that 
Equation 15.12.36 becomes 


d0 

dz 


[15.12.38] 


The relation between the vertical temperature gradient and 
the stability condition is described below. 


15.12.14 Vertical heat flux and the Bowen ratio 

Another feature that affects turbulence is buoyancy 
effects associated with the vertical heat flux. As already 
mentioned, in neutral conditions this heat flux is negli¬ 
gible, but in unstable and stable conditions it is significant. 
The vertical heat flux consists of a sensible heat flux and a 
latent heat flux. The ratio of the vertical sensible heat flux to 
the vertical latent heat flux is given by the Bowen ratio Bo: 



where H is the sensible heat flux into the air, E is the eva¬ 
poration rate and L e is the latent heat of evaporation. Over 
land, the latent heat flux is usually small compared to the 
sensible heat flux. 

There are several empirical methods of estimating the 
vertical heat flux H(e.g. Holtslag and van Ulden, 1983). For 
the United Kingdom, the following equation is given by 
Clarke (1979, NRPB R91): 


H = 0.4(S - 100) [15.12.40] 

where H is the vertical heat flux (W/m 2 ) and S the incoming 
solar radiation (W/m 2 ). 

The incoming solar radiation (ISR) may be estimated 
from Figure 15.37. Figure 15.37(a) gives the value of the ISR 
for a cloudless day as a function of time of day and month. 
For cloudy conditions this value is multiplied by the cor¬ 
rection factor given in Figure 15.37(b). 


15.12.15 Stability conditions 

As stated earlier, stability has traditionally been described 
primarily in terms of the vertical temperature gradi¬ 
ent. The theoretical adiabatic condition and some of the 
other conditions that occur in practice are illustrated in 
Figure 15.38. Curve 1 shows the dry adiabatic condition. 
Curve 2 shows a superadiabatic condition which can result 
from strong sunlight, or insolation, or from passage of cold 
air over a warm surface and which promotes convection 
and favours instability. Curve 3 shows a neutral condi¬ 
tion which is associated with overcast skies and moderate 
to strong wind speeds and which is neutral with respect 
to stability. Curve 4 shows a subadiabatic condition that 
favours stability. Curve 5 shows an isothermal condi¬ 
tion that favours stability strongly. Curve 6 shows an 
inversion condition that suppresses convection and is most 
favourable to stability. 


There are several different types of inversion 
condition. One is surface inversion, as shown by Curve 6 in 
Figure 15.38. This tends to occur at night with clear skies 
and light winds when the ground and the air near to it lose 
heat by radiation. The condition is therefore also referred to 
as radiation inversion. 

Another type of inversion is elevated inversion, as illus¬ 
trated in Figure 15.39. 

There are a number of causes for such inversions. One is 
subsidence of air from greater heights, which results in com¬ 
pression and hence warming. Another is a sea breeze, which 
may introduce a layer of cold air beneath a warm air mass. 
A third is a meteorological front, which also constitutes 
aboundary between cold air below and warm air above. 

An inversion layer inhibits vertical motion. Surface 
inversion suppresses upward dispersion of a gas release at 
ground level and also downward dispersion of a release at 
elevated level. Elevated inversion acts as a ‘lid’, inhibiting 
further upwards dispersion. There is a virtually permanent 
inversion lid on the atmosphere at a height of about 10,000 m. 

If in any layer the rate of change of temperature with 
height is negative, that layer is effectively a ‘mixing layer’ 
There is diurnal variation of stability within the lowest few 
hundred metres above the ground. The rate of change of tem¬ 
perature with height tends to be negative by day and posi¬ 
tive by night giving, respectively, a lapse and an inversion 
condition. The latter is a surface inversion. Figure 15.40(a) 
illustrates a typical diurnal variation. An elevated inversion, 
however, can last for days or even weeks on end. 

There are several special features that can affect stabi¬ 
lity. These include (1) semi-permanent pressure areas, 
(2) sea-land locations and (3) urban areas. Some areas are 
subject to a relatively fixed high or low pressure system. 
The United Kingdom, for example, is often under the 
influence of the Icelandic semi-permanent low pressure 
area, with cloudy weather and near neutral stability 
Stability in coastal locations is strongly influenced by 
sea-land interactions. One effect may be the complete 
suppression of surface inversion during winter due to rela¬ 
tively warm sea breezes, as illustrated in Figure 15.40(b). 
Urban areas affect stability in various ways. One 
major aspect is the ‘heat island’ effect, which prevents the 
development of surface inversion at night. 


15.12.16 Stack plume regimes 

The effect of stability conditions on dispersion has been 
studied extensively and is most readily illustrated in rela¬ 
tion to the behaviour of the plume from an elevated source 
such as a factory chimney. Some of the principal types of 
plume behaviour are shown in Figure 15.41. 


15.12.17 Stability criteria 

A simple stability parameter, the environmental stability s, 
may be defined: 



This parameter is proportional to the rate 
generation of turbulence is suppressed. 


[15.12.41a] 

[15.12.41b] 
which the 
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Figure 15.37 Incoming solar radiation (ISR) at Cambridge (after Clarke, 1979 NRPB R91; reproduced by permission): 
(a) ISR on a cloudless day (W/m 2 ); (b) correction factor by which ISR for cloudless day is multiplied to allow for cloudy 
conditions 


15.12.18 Richardson number 

The rate at which mechanical turbulence is generated 
by wind shear is proportional to (dw/dz) 2 . A criterion for 
the stability of the atmosphere that is effectively the ratio 
of the rates of suppression and generation of turbulence, as 
just described, was proposed by L.F. Richardson (1920, 
1925) and is known as the Richardson number. 

There are several forms of the Richardson number. The 
gradient Richardson number Ri is defined as 


fd'/'/dz- r j 
[ (du/dzf J 


[15.12.42a] 


g \ <Wdz 1 

' 0 [(da/dz) 2 ] 


[15.12.42b] 


The bulk Richardson number Ri B is defined as 
RiB= f^^ [15.12.43] 


This form of the Richardson number is convenient for use 
where the value is determined experimentally from meas¬ 
urements made at two heights. The value of z is usually 
taken as the geometric mean of these heights and the value 
of u as that at the upper level. The flux Richardson number 
RiF is defined as 


Rip 


gH 

Tcpx(Au/dz) 


[15.12.44] 


where c p is the specific heat of air, H is the vertical heat flux 
and x is the Reynolds stress. 









EMISSION AND DISPERSION 15/85 



Figure 15.38 Vertical temperature profiles and lapse rates (American Society of Mechanical Engineers, 1973/2; 
reproduced by permission): (1) dry adiabatic condition; (2) super-adiabatic condition; (3) neutral condition; 

(4) subadiabatic condition; (5) isothermal condition; (6) inversion condition 



A modified Richardson number Ri mo d which is also 



where/is the mixing length and A p is the density difference 
between the cloud and the air. 

The Richardson number Ri is the ratio of the buoyancy to 
the turbulent stress and is a criterion of similarity for turbu¬ 
lent motion. In his original treatment, Richardson suggested 
that there is a critical value Ri cr at which motion becomes 
turbulent and postulated that this value is unity Then for 
Ri < 1 motion is laminar and for Ri > lit is turbulent. 


Figure 15.40 Diurnal variation of vertical temperature 
profile (American Society of Mechanical Engineers, 
19731/2; reproduced by permission): (a) open country site 
all year; (b) coastal site in winter 


Subsequent work indicates other values for the critical 
Richardson number. Obukhov (1971) quotes various values 
derived from theory including 1/2 (Prandtl), 1/4 (Taylor) 
and 1/24 (Tollmien) as well as an experimental value of 1/11 
(Sverdrup). 
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(a) 


0 ) 


(0 


(d) 


(e) 



Figure 15.41 Plume behaviour as a function of atmospheric stability conditions: (a) unstable ('looping'); (b) neutral 
(‘coning’); (c) stable above and below source; surface inversion (‘fanning); (d) stable below source only: surface inversion 
(‘lofting’); (e) stable above source only- elevated inversion (‘fumigation’) 


Since mechanical turbulence decreases quite rapidly 
with increase in height, the Richardson number is a func¬ 
tion of height. 


15.12.19 Monin-Obukhov length 

The stability criteria just described take no account of two 
parameters that are now known to be important determi¬ 
nants of similarity in the surface layer. These are the ver¬ 
tical heat flux H and the friction velocity u t . 

These parameters are taken into account in another 
criterion of stability that is now increasingly used. This is 
the Monin—Obukhov length scale L (Monin and Obukhov, 
1954; Obukhov, 1971), which is defined as 


, _ _t4<vP T 

~^kgET 


[15.12.46] 


This parameter has the dimensions of length. It may he 
regarded as a measure of the depth of the mechanically 
mixed layer near the surface. 


The Monin—Obukhov length L is negative for unstable 
and positive for stable conditions and infinite for adiabatic 
conditions. A dimensionless parameter, the Monin- 
Obukhov parameter £is obtained by taking the ratio of the 
height £to the Monin-Obukhov length L\ 

C = z/L [15.12.47] 

The Monin-Obukhov parameter is thus directly propor¬ 
tional to the height. Thus both the Richardson number and 
the Monin-Obukhov parameter are functions of the height. 

The Richardson numbers and the Monin-Obukhov 
length and parameter are related, but the relations depend 
on stability conditions. Colder (1972) gives the following 
relations. For unstable conditions the Pandolfo-Businger 
hypothesis gives a good approximation: 



[15.12.48a] 
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For stable conditions use may be made of the empirical 
relation given by McVehil (1964): 


L 


Ri 

l-/?Ri 


[15.12.48b] 


Values of the constant /? are reviewed by Colder who uses 

The relation between the Richardson number and the 
Monin-Obukhov parameter may also be written in alter¬ 
native form as given byTagliazucca and Nanni (1983). For 
unstable conditions 


L 

*/L 

1 + yzfL 


[15.12.49a] 

[15.12.49b] 


where y is a constant. 

The following empirical relation for the Monin- 
Obukhov length has been obtained by Venkatram (1980b): 


L — 


llOOaJ 


[15.12.50] 


15.12.20 Other stability criteria 

Another stability parameter is the Kazanski-Monin para¬ 
meter ji (Kazanski and Monin, 1960). This is defined as 


ku, 

M = JL 


K 

L 


[15.12.51a] 

[15.12.516] 


where/is the Coriolis parameter and h' is the scale height of 
the neutral ABL. This parameter is also sometimes denoted 
by the symbol S. 

A further stability criterion that is sometimes used is the 
non-dimensional windshear S: 


S 


kzdu 
u, dz 


[15.12.52] 


A stability classification based on insolation and wind 
speed has been given by Pasquill (1961,1962a) and is shown 
in Table 15.14. Night refers to the period from 1 h before 
sunset to 1 h after sunrise. Strong insolation corresponds to 
sunny, midday conditions in midsummer England and 
slight insolation to similar conditions in midwinter. If 
during day or night, there are overcast conditions then, 
regardless of wind speed, category D should be assumed. 

Stability conditions in terms of the Pasquill stability 
categories are approximately: 

A Unstable conditions 
D Neutral conditions 
F Stable conditions 

The frequency of the different Pasquill stability categories 
in Great Britain is shown inTable 15.15. The contours on the 
map given in Figure 15.42 show the percentage of time 
during which the neutral category D prevails. 

The Pasquill stability categories are used to define the 
dispersion coefficients in the Pasquill-Gifford equations 
and the parameters in the Pasquill equations, as described 
below. 

An additional stability category G is used by some 
workers (e.g. Bryant, 1964 UKAEA AHSB(RP) R42). 

Relations between the Pasquill stability categories and 
the two main stability criteria, the Richardson number Ri 
and the Obukhov length L have been given by Pasquill and 
Smith (1971) and are shown inTable 15.16. 

There are a number of other stability classifications 
schemes. A review of these has been given by Gifford 
(1976b). Some of schemes are shown inTable 15.17. 

The scheme of Brookhaven National Laboratory (BNL) 
(Singer and Smith, 1966) is based on the fluctuations of the 
horizontal wind direction trace recorded over a 1 hour 
period. The categories are 

A Fluctuations >90° peak to peak, 

B2 Fluctuations 40-90°, 

B1 Fluctuations 15—45°, 

C Fluctuations >15° distinguished by unbroken solid 

D Trace approximatesaline,short-termfluctuations <15°. 


The condition S=1 corresponds to the law of the wall as 
given in Equation 15.12.15. 

15.12.21 Stability classification 

The stability conditions have a strong influence on disper¬ 
sion. The principal dispersion relations contain parameters 
that are functions of these conditions. Stability is a com¬ 
plex phenomenon, however, and its characterization is a 
difficult problem. There is a large literature dealing with 
approaches to turbulence typing or stability classification. 
Accounts are given by Pasquill (1962a), Gifford (1976b) and 
Sedefian and Bennett (1980). 

A simple set of stability categories is: 

(1) unstable conditions - lapse conditions; 

(2) neutral conditions; 

(3) stable conditions - including inversion conditions. 

These categories are used to define the diffusion para¬ 
meters in the Sutton equations, as described below. 


Typical wind direction traces illustrating these wind gusti¬ 
ness categories given by Singer and Smith are shown in 
Figure 15.43. 

The BNL scheme makes it possible to classify turbulence 
using relatively simple wind direction measurements and to 
relate the stability categories to experimental dispersion 
data obtained at asite. Strictly the categories are site specific 
and those published for BNL apply to the BNL site. The rela¬ 
tions between the BNL categories and the wind speed and 
temperature gradient is shown inTable 15.18. 

The scheme proposed by D.B. Turner (1961, 1964) is a 
version of Pasquill’s scheme in which the insolation is 
according to the amount and height of cloud cover and the 
solar elevation angle. 

The scheme developed by Klug (1969) is similar to that of 
Pasquill, but differs in that the categories are defined using 
more detailed rules for cloud cover, wind speed, time of day 
and season. 

The scheme of Cramer (1957,1959b) is based on correla¬ 
tion of stability with the azimuth ct a and the elevation angle 
<r E . Cramer’s turbulence categories are shown inTable 15.19. 
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Table 15.14 Pasquill’s stability categories (Pasquill, 1961) (Courtesy of HM Stationery Office) 


Surface 

wind speed at 10 m 
height (m/s) 


Insolation 


Night 


Strong 

Moderate 

Slight 

Thinly 
overcastor 
>4/8 cloud 

<.3/8 

<2 

A 

A-B 

B 

_ 

_ 

2-3 

A-B 

B 

C 

F 

F 

3-5 

B 

B-C 

C 

D 

E 

5-6 

C 

C-D 

D 

D 

D 

>6 

c 

D 

D 

D 

D 


Table 15.15 Pasquill stability categories for Great Britain (see also Figure 15.42) (Meteorological Office, 1977; 
reproduced by permission) 


Surface wind 
speed at 

10 m height 
(mile/h) 



Frequency of stability category (%) 



A 

B 

C 

D 

E 

F 

G 

16 

0 

4 

11 

80 

3 

2 

0 

14.5 

0 

4 

13 

75 

4 

3 

1 

13 

0 

4 

14 

70 

5 

5 

2 

11.5 

1 

5 

15 

65 

6 

6 

2 

10 

1 

6 

17 

60 

7 

7 

2 

9 

2 

7 

19 

55 

7 

7 

3 

8 

2 

9 

21 

50 

6 

8 

4 


TheTennessee Valley Authority (TVA) scheme, described 
by Carpenter et al. (1971) is concerned with stability classi¬ 
fication for buoyant plumes from tall chimneys. It is based 
on lapse rate A 9/Az. The TVA stability categories are given 
in Table 15.20. 

Relationships between some of these stability classifi¬ 
cation, or turbulence typing, schemes have been given by 
Gifford and are shown in Table 15.21. 

The Pasquill scheme has been modified by F.B. Smith 
(1973) so that the stability is described in terms of a con¬ 
tinuous index P rather than by discrete categories. The P 
value is a function of the wind speed, the upward heat flux 
and the incoming solar radiation, and also of the roughness 
length. P values of 0.5-6.5 correspond to the Pasquill 
categories A-G as follows: 


A 

B 

C 

D 

E 

F 

G 


P 


0.5 

1.5 

2.5 

3.6 

4.5 

5.5 

6.5 


The graph given by Smith for the determination of the P 
value is shown in Figure 15.44. 

There are a number of other stability classification 
schemes based on relations between the Pasquill stability 


categories and particular parameters. A review of several 
such schemes has been given by Sedefian and Bennett 
(1980), as shown in Table 15.22. The authors also analysed 
dispersion data and derived relations for the P value in 
some of the schemes. 

In the a a, or sigma theta, method the stability category is 
taken as a function of the wind direction standard devia¬ 
tion a e . This method is one of two that has been recom¬ 
mended by the Nuclear Regulatory Commission and is 
widely used. 

Sedefian and Bennett give the following relation involv¬ 
ing (t b : 


M*2) = Mzi)(.Z2/zif e [15.12.53] 

where P g is an index and where the heights zi and z 2 are 10 
and 50 m, respectively. The values of P g corresponding to 
Pasquill categories A-F are -0.06, -0.15, -0.17, -0.23, 
—0.38 and -0.53, respectively. 

The temperature difference A T method is the other 
method recommended by the NRC. 

The wind speed ratio U R is a parameter devised by 
Sedefian and Bennett and is the ratio of the wind speeds at 
50 and 10 m height. The authors give the following relation 
involving U R 


Ok-W*/ 1, [15.12.54] 

where P u is an index and U R is the wind speed ratio and where 
theheightsziandz 2 are 10 and 50 m, respectively. The values 
of P n are related to the Pasquill stability categories. 
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Figure 15.42 Frequency of occurrence of Pasquill stability categories over Great Britain (Meteorological Office, 

1977; reproduced by permission). Contours showing percentage of time during which Pasquill stability category D prevails 
(see Table 15.15) 
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Table 15.16 Relations between Pasquill stability 
categories and stability criteria (after Pasquill and Smith, 
1971) (Courtesy of Academic Press) 


Pasquill stability Richardson No. Obhukov 

category Ri Length L 


A -1.0 to-0.7 -2 to-3 

B -0.5 to-0.4 -4 to-5 

C -0.17 to-0.13 -12 to-15 

D 0 oo 

E 0.03 to 0.05 35 to 75 

F 0.05 to 0.11 8 to 35 


Table 15.18 BNL turbulence categories (after Gifford, 
1976b) (Courtesy of Nuclear Society) 


Turbulence 

category 

Wind speed (m/s) 

Temperature 
gradient (AT/Az) 
(°C/123 m) 

9m 

108 m 

A 

_ 

1.8 ± l.l a 

-1.25 ±7 a 

B2 

2.5 

3.8 ±1.8 

-1.6 ±0.5 

B1 

3.4 

7.0 ±3.1 

-1.2 ±0.65 

C 

4.7 

10.4 ±3.1 

-0.64 ±0.52 

D 

1.9 

6.4 ±2.6 

-2.0 ±2.6 


a Standard deviation. 


Table 15.17 Some stability classification schemes Table 15.19 Cramer’s turbulence categories 


Stability classification Categories Reference(s) 
scheme 


Pasquill A-F 

Brookhaven National A-D 
Laboratory (BNL) 

Turner 1-7 

Klug 

Cramer a a, ce 

Tennessee Valley A-F 

Authority (TVA) 


Pasquill (1961,1962) 
M.E. Smith (1951), 
Singer and Smith 
(1953,1966) 

D.B. "IUrner (1961,1964) 
Klug (1969) 

Cramer (1957,1959b) 
Carpenter etal. (1971) 


Stability 

Azimuth, 

oa(°) 

Elevation 
angle, a E (°) 

Extremely unstable 

30 

10 

Near neutral 

15 

5 

(rough surface; trees, 
buildings) 

Near neutral 

6 

2 

(very smooth grass) 
Extremely stable 

3 

1 



Figure 15.43 Typical wind direction traces illustrating 
wind gustiness categories (Singer and Smith, 1966) 
(Courtesy of Brookhaven National Laboratory) 


The stability array (STAR) method is based on cloud 
cover, solar altitude and wind speed. 

The relation between the Pasquill stability categories 
and the parameters of these various methods as deter¬ 
mined by Sedefian and Bennett is shown in Table 15.23. 


Table 15.20 TVA stability categories (after Carpenter 
et al., 1971) (Courtesy of the Air Pollution Control 
Association) 


Stability category 

Lapse rate, 

A e/Az 
(K/lOOm) 

A Neutral 

0 

B Slightly stable 

0.27 

C Stable 

0.64 

D Isothermal 

1.00 

E Moderate inversion 

1.36 

F Strong inversion 

1.36 

Table 15.21 Relations between turbulence typing 
schemes (Gifford, 1976b) (Courtesy of Nuclear Safety) 

Stability 

Scheme 



Pasquill 

Turner 

BNL 

CA 

Very unstable 

A 

l a 

B2 

25 

Moderately unstable 

B 

2 

B1 

20 

Slightly unstable 

C 

3 

B1 

15 

Neutral 

D 

4 

C 

10 

Moderately stable 

E 

6 

- 

5 

Very stable 

F 

7 

D 

2.5 


a After Golder (1972). 


Pasquill related his stability categories to the lateral spread 
of the wind 9. The relations are given in Table 15.24. 

There have been a number of studies in which sta¬ 
bility classification schemes have been compared with 
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Figure 15.44 Stability parameter, or P value (after F.B. Smith, 1973; Clarke, 1979 NRPB R91; reproduced by 
permission) 


Table 15.22 Some schemes for assigning Pasquill 
stability categories (after Sedefian and Bennett, 1980) 


Scheme 

Comment 

Wind direction standard 

One of two methods given 

deviation erg 

in NRC Guide 1.23 

Temperature difference, AT 

Other method given in NRC 
Guide 1.23 

Richardson number, Ri 

Authors’own 
method,utilizing 
relations given by Golder 
(1972) between Pasquill 
categories and 

Monin - Obukhovlength 

L and roughness lengthz 0 

Bulk Richardson 
number, Ri B 

Authors’ own method 

Wind speed ratio U R 

Authors’ own method, 
based on ratio of wind 
speed sat heights of 

10 and 50 m 

Stability array (STAR) 

Author’s own method, 
based on wind speed at 

10 m, solar altitude and 
cloud cover 


experimental measurements, including those done by 
Sedefian and Bennett (1980) and A.E. Mitchell (1982). 

An alternative approach to stability is to treat it as pri¬ 
marily a function of the Obukhov length L and the rough¬ 
ness length z 0 . Colder (1972) has developed relationships 
between the Pasquill stability categories and these two 
parameters. Figure 15.45 shows these relations. Colder also 


concluded that the most appropriate conversion between 
the Pasquill and Turner categories is A to 1, B to 2, C to 3, 
D to 4, E to 6 and F to 7. 

Relations between theTurner stability categories and the 
Monin—Obukhov length, inferred from the work of Colder 
(1972) have been given by Ning and Yap (1986). These are 
given in Table 15.25. 

Another stability classification scheme is that of 
Holtslag and van Ulden (1983). This is based on the sensible 
heat flux. 

The stability classifications just described were devel¬ 
oped for use over land. They do not necessarily hold over 
water. 

A stability classification scheme for use over water has 
been developed at the Naval Postgraduate School (NFS), 
Monterey, by Schacher, Fairall and Zannetti (1982). 

Following Colder, stability is treated as primarily a 
function of the Monin—Obukhov length and the roughness 
length. The Monin-Obukhov length is determined from 
air-sea temperature difference, wind speed and relative 
humidity. Figure 15.46, given by Skupniewicz and Schacher 
(1986), illustrates the classification for 50% relative humid¬ 
ity. A somewhat similar scheme has been given by Hasse and 
Weber (1985). In that stability is characterized by the 
Monin-Obukhov length, the derivation and use of this 
parameter may be regarded as a stability classification 
‘scheme’. 

The selection of a stability classification method scheme 
for gas dispersion modelling is exemplified by the set of 
schemes used in the DRIFT dense gas dispersion model 
described in Section 15.35. The model can accommodate 
three schemes. One is the use of the Monin-Obukhov 
length, valid for all locations and all times. The others are 
the Pasquill scheme, used for day on land, and the Holtslag 
and van Ulden scheme, used for neutral or unstable condi¬ 
tions for day on land. 



















Table 15.23 Relations between Pasquill stability categories and parameters of some typing schemes (after Sedfian and Bennett, 1980)(Courtesy of Pergamon Press) 
Pasquill a e a g AT/Az Ri b Ri B b f/ R b 
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Table 15.24 Relations between Pasquill stability 
categories and lateral spread of wind 


Pasquill stability 
category 

Lateral spread 9 (deg) 

d—O.l km 

d = 100 km 

A 

60 

(20) 

B 

45 

(20) 

C 

30 

10 

D 

20 

10 

E 

(15) 

(5) 

F 

(10) 

(5) 


The stability category is the other main piece of infor¬ 
mation which is required, in addition to the wind char¬ 
acteristics, for the estimation of dispersion at a given 
location. 

15.12.22 Flux-gradient relations 

In the surface layer it is assumed that stress does not vary 
with height. Similar arguments based on the work of Monin 
and Obukhov lead to the conclusion that for any transfer¬ 
able property S the relation between vertical flux and ver¬ 
tical gradient is determined by the following parameters: z, 
p, g/T, zip, and H/Cpp. 

The flux-gradient relations may be expressed in 
the form: 

1 = 1 *-© “““s 

where S is the mean quantity of the property per unit mass 
of air, S» is a scale parameter with the same dimensions as 
S, <t> is a similarity factor, and the subscript s denotes the 
property specified. 

The scale parameter S» is defined by the relation to the 
vertical flux F s : 

S t = Fs [15.12.56] 


The vertical flux is given by the relation: 


F s =-pK s ^ [15.12.57] 

where if is a turbulent exchange coefficient. 

For momentum, heat and water vapour the flux rela¬ 
tions are: 


t:«pif M — [15.12.58] 

H=-p Cp K u ^ [15.12.59] 

E=-pL w K w ^ [15.12.60] 

where c p is the specific heat of air, E is the vertical flux of 
water vapour, H is the vertical heat flux, L w is the latent 
heat of water vapour, q is the specific humidity, or 










EMISSION AND DISPERSION 15/93 



Figure 15.45 Relations between Pasquill stability categories and Monin- Obukhov length and surface roughness 
(Golder, 1972) (Courtesy of Kluwer Academic Publishers) 


Table 15.25 Relations between Turner stability 
categories and Monin-Obukhov length (after Ning and 
Yap, 1986) (Courtesy of Pergamon Press) 


Turner stability 

V L 

category 

(m J ) 

A 

1/E <-0.087 

B 

-0.087 < 1/E <-0.028 

C 

-0.028 < 1/E <-0.005 

D 

-0.005 < 1/E 


a D.B. "Rimer (1964) denoted his stability categories 1-7. 

Ning and Yap state that the Turner stability categories A-D are 
derived from the work of Golder (1972) for a roughness length z„ of 
20 cm on land, and the Holtslag and van Ulden scheme, used for neu¬ 
tral or unstable conditions for day on land. 


The corresponding equations for the turbulent exchange 
coefficients are then 


pdu/dz 

* 


[15.12.61] 

[15.12.62] 

[15.12.63] 


Then, applying Equations 15.12.56 and 15.12.57 to momen¬ 
tum and noting that for this case 


and 



Figure 15.46 Illustration of the NPS stability classification 
scheme over water (Skupniewicz and Schacher, 1986) 
(Courtesy of Pergamon Press) 


F s = -pul [15.12.65] 

|15.12.66] 

Similarly, the gradient relations for heat and water vapour 


E 

pLy/ku, 


[15.12.67] 

[15.12.68] 


concentration of water vapour, u is the wind velocity, 9 is 
the potential temperature, p is the density of air, and the 
subscripts H, M and W denote heat, mass and water vapour, 
respectively. 


K m = ku,z/<t> u [15.12.69] 

K H = ku,z/<l> H [15.12.70] 

K w = ku,z/<j > w [15.12.71] 
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Also from the definitions of the Richardson number Ri and 
the Monin-Ohukhov parameterz/L, as given by Equations 
15.12.42b and 15.12.46, and from Equations 15.12.66 and 
15.12.67 

Ri = j % [15.12.72] 

L <t>u 

15.12.23 Universal functions 

Monin and Obukhov expanded the function <j> M (z/L) as the 
power series 

d M -l - X ,Q- a z Q Z . [15.12.73] 

where ai and a 2 are coefficients. They truncated the series 
after the first term in (z/L) to give 

^ M = 1 + a O [15 - 12 ' 74] 


where the subscript cr denotes critical. 

Equation 15.12.77a follows from the definition of </> (Ri) 
and from the fact that for adiabatic conditions Ri = 0, and 
Equation 15.12.77c follows from the fact that turbulence is 
suppressed for Ri > Ri cr . 

As already described, the Monin—Obukhov form of the 
universal function c/> M gives for the wind velocity gradient 
Equation 15.12.24, which on integration yields Equation 
15.12.25 or, forz 3> z„, Equation 15.12.26. 

15.12.24 Turbulent exchange coefficients 

The turbulent exchange coefficients are: 


K m Turbulent exchange coefficient for momentum; eddy 
viscosity. 

Kh Turbulent exchange coefficient for heat; eddy thermal 
diffusivity. 

K w Turbulent exchange coefficient for water vapour; 
eddy diffusivity. 


where a (= aj is the Monin-Obukhov coefficient. This 
coefficient is to be determined empirically. 

An alternative relation for i p M is the exponential relation 
proposed by Swinbank (1964): 


These coefficients are defined by Equations 15.12.58- 
15.12.60, respectively. It was assumed in early work by 
Schmidt (1925) that 


<t>M = [l - exp(z/L)]‘ 


[15.12.75] 


Relations for the universal functions have been derived by a 
number of authors and have been reviewed by Dyer (1974). 
Some of these relations are given in Table 15.26. Obukhov 
(1971) has defined an alternative universal function by the 
relation 

A M = AM 0 (/>(Ri) [15.12.76] 

where K Uo is the adiabatic value of if M . He gives the 
following relations for </> (Ri): 

</>( Ri) = 1 Ri = 0 [15.12.77a] 

/ Ri\ 1/2 

t= ( 1 - — j Ri < Rfe [15.12.77b] 


The identity of the three exchange coefficients is still a 
common assumption for neutral conditions. According to 
Dyer (1974), however, there is evidence that for such condi¬ 
tions the ratio KulK m is equal to 1.35. 

From Equations 15.12.69—15.12.71, the ratio of the 
exchange coefficients may be expressed in terms of the 
ratios of the universal functions 4>m, 4>h and </>w For neutral 
conditions the latter approach unity. For other conditions 
the ratios K H /K M and K W IK M will be unity only if the 
asymptotic approach to unity of the 0 H and </>w is identical 
with that of <f> M - For unstable conditions there is evidence 
that this is not so. 

The identity of the exchange coefficients for mass and 
heat transfer implies, from Equations 15.12.58 and 15.12.59, 


H__ dfl/dz 
Cpi ~ d«/dz 


[15.12.79] 


Ri > Ri cr 


[15.12.77c] Equation 15.12.79 is a form of the Reynolds analogy. 


Table 15.26 Some forms of the universal functions (after Dyer, 1974) (Courtesy of Kluwer Academic Publishers) 
A Unstable conditions 


4> M 

</>H 

<hr 

Regime 

Reference 

(z/Ltfl-explz/L)]- 1 

0.613 (-z/L) 020 

1 +4.5(z/L) 

[1 — 16(z/L)]-F* 
[l-15(z/L)]- 1/4 

0.227(—z/L)” 044 

1 +4.5(z/L) 

[1 - 16(z/L)] —1/2 
0.74[l-9(z/L)]- 1/2 

1 +4.5(z/L) 

[l-16(z/L)]- 1/2 

-0.1 > (z/L) >-2 
(z/L) > -0.03 

0 > (z/L) > —1 
(z/L) > -2 

Swinbank (1964) 
Swinbank (1968) 
E.K.Webb (1970) 

Dyer and Hicks (1970) 
Busingerc/a/. (1971) 

B Stable conditions 

1 + 5.2 (z/L) 
l+4.7(z/L) 

1+5.2 (z/L) 

0.74 + 4.7(z/L) 

l + 5.2(z/L) 

(z/L) > -0.03 
(z/L) > -2 

E.K.Webb (1970) 
Busingeref a/. (1971) 
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15.12.25 Wind direction fluctuations 

Wind direction fluctuations may be defined in terms of the 
standard deviation of the horizontal direction and inclina¬ 
tion of the wind: 

o e Standard deviation of the horizontal direction of 
the wind. 

00 Standard deviation of the inclination to the horizontal 
of the wind. 

Alternative notation for these quantities is for a e the 
standard deviation of the azimuth a a and for <7^ the stand¬ 
ard deviation of the elevation <r E . Distributions of the 
standard deviations a e and <70 by Pasquill stability cat¬ 
egory have been given by Luna and Church (1972) and are 
shown in Figure 15.47. 

As described above, the concentration measured in a 
plume varies with the sampling time. Similarly, the value 
measured for a g varies with sampling time. Slade (1968) 
suggests that a correction for sampling time may be made 
using the following approximate relation: 


Wind velocity fluctuations may be defined in terms of 
the standard deviations a u , a v and a w of the velocities as 
follows: 



[15.12.82a] 


[15.12.82b] 


[15.12.82c] 


where u 2 , v 2 and w 2 are the variances of u, v and w, 
respectively. 

Relationships for <7„, <7„ and <7„, derived from the work 
of Wyngaard, Cote and Rao (1974) and Wyngard (1975) 
have been given by S.R. Hanna, Briggs and Hosker (1982). 
For <r„: 

<7 / 2A 1/3 

— =(l2-0.5~J unstable [15.12.83] 


— =( t 1 \ P [15.12.80] 

O'er \kj 

where t is the sampling period which yields a g , p is an index 
and subscript r denotes the reference value. The value olp is 
of the order of 0.2. 

The standard deviations a g and <70 are used in the 
Pasquill model for passive gas dispersion. 

15.12.26 Wind velocity fluctuations 

The wind velocities u, v and w in the downwind, crosswind 
and vertical directions respectively, may be written as the 
sum of a mean velocity and a velocity fluctuation: 



neutral 


stable 


[15.12.84] 

[15.12.85] 


where/is the Coriolis parameter, L is the Monin—Obukhov 
length and 2; is the mixed layer height. The authors also 
give relationships for <7„ and a w . 


15.12.27 Turbulence intensity 

Intensities of turbulence are defined as: 


u + u' 
v + i/ 


[15.12.81a] iy= ^ /M 
[15.12.81b] 

[15.12.81c] h = (tf 2 ) /« 


[15.12.86a] 

[15.12.86b] 


where u, v and w are the mean values and u' v' and w' the where i y and 4 are the intensities of the lateral and vertical 
fluctuations of u, v and w, respectively. components of turbulence, respectively. 



Figure 15.47 Standard deviations of wind direction fluctuations (Luna and Church, 1972): (a) distribution ofa A by 
stability class; (b) distribution ofo A by stability class. A-F, Pasquill stability categories. Reproduced by permission 
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The root-mean-square turbulent velocities are related to 
the friction velocity: 


(^) 1/2 = 2.2m, [15.12.87a] 

= 1.25k. jl5.12.87b] 




[15.12.95] 

where i is the intensity of turbulence. 

The ratio /J decreases as the intensity of turbulence 
increases. Reid (1979) gives the relation 


For neutral conditions, combining Equations 15.12.86, 
15.12.87 and 15.12.20: 


0.88 

0.5 

In (z/«o) 


[15.12.88a] 

[15.12.88b] 


Also, combining Equations 15.12.82 and 15.12.86: 


i, = a v /u [15.12.89a] 

% = a„/u [15.12.89b] 


15.12.28 Eddy dissipation rate 

The eddy dissipation rate t is the rate at which on the small 
scale turbulence is dissipated into heat. In the surface layer: 

-z/L) [15.12.90] 


For neutral conditions: 


[15.12.91] 


15.12.29 Lagrangian turbulence 

Turbulence may be measured at a fixed point or by refer¬ 
ence to a particle moving through the turbulent field. The 
types of turbulence measured in these two different ways 
are known as Eulerian and Lagrangian turbulence, 
respectively The dispersion of a gas in air is a Lagrangian 
process, but it is generally observed by Eulerian 
measurements. 

The difference between the two types of turbulence may 
be illustrated by the following simplified argument. Con¬ 
sider a wind speed u carrying a circular eddy radius r and 
tangential velocity co. The Eulerian time scale f E is the time 
for the eddy to pass a fixed point: 


k = 2r/« 


[15.12.92] 


The Lagrangian time scale k, is the time for a particle on 
the circumference of the eddy to travel once round the eddy: 


k = 2nr/m 


[15.12.93] 


The ratio p of the Lagrangian to the Eulerian time scale 





[15.12.94a] 

[15.12.94b] 

[15.12.94c] 


P = 0.5 /i [15.12.96] 

This suggests that, although the form of Equation 15.12.93 
derived from the crude model is correct, the equation over¬ 
estimates p. An average value given by Pasquill (1974) 
for P is 4. 

A study of the time scales over water is described by 
Sethuraman, Meyers and Brown (1976). 

15.12.30 Autocorrelation function 

If in a field of homogenous turbulence measurements are 
made at two points of the instantaneous components of 
velocity u[ and ui and, if the position of the second point is 
moved while that of the first is kept fixed, a correlation 
coefficient R(x) may be defined as 

R(x) = [15.12.97] 

For eddy sizes which are large compared with the distance * 
this correlation coefficient is high, and vice versa. 

The correlation coefficient may also be expressed in terms 
of time. This time correlation coefficient R(x), which is also 
known as the autocorrelation coefficient, is defined as 


R{ r) + [15.12.98] 

The two correlation coefficients are identical: 

R(r)=R(x) [15.12.99] 

with x = m. 

Properties of the autocorrelation coefficient are: 

R(x) = 1 t = 0 [15.12.100a] 

= 0 x —► o© [15.12.100b] 

The form of the autocorrelation coefficient is not fully 
understood. One model commonly used is the Markov 
model for which 


R(x) = exp(-r /k) 


[15.12.101] 


15.12.31 Taylor’s theorem 

A relation between the autocorrelation function and the 
dispersion parameters has been derived by G.I. Taylor 
(1921). The displacement x of a particle is related to its 
velocity u as follows: 

x(t} j [15.12.102] 

Then 


0 „d* 
d t ^d t 

= 2 u(t)u(P)6f 


[15.12.103a] 

[15.12.103b] 
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Substituting the autocorrelation coefficient from Equa¬ 
tion 15.12.98 in Equation 15.12.103 yields 



[15.12.104] 

But it can be shown that 



[15.12.105] 

Hence 



[15.12.106] 

and 


a 2 x = 2tfj‘j R(t) dr df' 

[15.12.107] 

Equation 15.12.107 is Taylor’s theorem. 

If a form of the autocorrelation coefficient: 

is assumed, 


such as that given in Equation 15.12.101, it is possible to 
derive from Equation 15.12.107 an expression for the dis¬ 
persion coefficient. The application of Taylor’s theorem for 
this purpose is described below. 

15.12.32 Mixed layer scaling 

Much of the foregoing treatment has been concerned with 
the properties of, and similarity within, the surface stress 
layer. In mixed layer scaling, similarity is extended to the 
whole boundary layer. 

The initial treatment by Deardorff (1970) was for the con¬ 
vective boundary layer, in other words, for the planetary 
boundary layer in convective, or unstable, conditions, and is 
also termed convective layer, or convective velocity, scaling. 

Scaling has also been extended by other workers such as 
Caughey, Wyngaard and Kaimal (1979) to stable conditions 
and for this the term ‘mixed layer scaling’ is perhaps more 
appropriate. A parameter widely used in mixed layer scal¬ 
ing is 


where c is a constant. Values of the constant c are quoted 
by Venkatram and Paine (1985) as varying between 0.4 
and 0.7. 

Another correlation, applicable to stable conditions at 
night in high wind, is that of Venkatram and Paine (1985): 

z; = 2300 i/J 2 [15.12.110J 

They state that the constant, given here as 2300, tends to be 
site specific and quote a value of 1300 at another site. 

15.12.34 Convective velocity scale 

The convective velocity, or velocity scale, w, is defined as 



where Q a is the surface heat flux and T a is the absolute 
average temperature of the mixed layer. 

The convective velocity w » may be estimated from cor¬ 
relations for the quantity ajw ., together with correlations 
for g w or, more directly, from correlations for w * itself. A 
correlation of the first type has been given by Irwin (1979a) 
and is shown in Figure 15.48. Correlations for a w have been 
discussed above. 

Direct relations for w * have been given by Venkatram 
(1978) in terms of the maximum surface heat flux Q m and 
the maximum mixed layer height z im as follows: 

w,=AQ)[ 2 [15.12.112] 

Q m = Q 0 sin(7tf/2r) [15.12.113] 

And 

w,=Bz im [15.12.114] 


X = lt^ [15.12.108] 

where w, is the convective velocity and z,- the mixed layer 


15.12.33 Mixed layer height 

Over land the mixed layer has a height of some 1000- 
2000 m by day but about an order of magnitude less by 
night. Over sea the diurnal variation is much less. By day 
the mixed layer height is usually set by an inversion layer 
capping the well mixed layer above the ground surface. By 
night, when there is some degree of inversion at all levels, 
the height of the mixed height may be taken as that at which 
surface induced mechanical turbulence dies out. Extensive 
data on the mixed layer height in the United States have 
been published by Holzworth (1972). 

The mixed layer height z,- has been investigated by 
Zilitinkevich (1972a), who gives the following relations: 


Zi = -yr- neutral conditions [15.12.109a] 

(u L \ 1/12 

== c( -j-J stable conditions [15.12.109b] 


where r is the time after sunrise when Q a is a maximum, 
and A and B are constants. The values of the constants are 
A = 4.74 and B = 1.12 x 10“ 3 . 


15.12.35 Density effects 

In some conditions the density of the air may be assumed to 
be a function of temperature and humidity, but not of 
pressure. This is the Boussinesq approximation. Then the 
buoyancy of the air, which is a function of the ratio of the 
density difference to the mean density, may be assumed to 
be a function of the ratio of the temperature difference to 
the mean absolute temperature. The Boussinesq approxi¬ 
mation is generally valid when the ratio of the density 
difference to the mean density is 0.1 or less. 

15.12.36 Meteorological variables 

The meteorological variables of particular interest here in 
respect of gas dispersion are (1) wind speed and (2) stability 
category. Other variables that are of interest in hazard 
assessment generally include: (1) minimum temperature, 
(2) maximum temperature, (3) maximum wind speed and 
(4) maximum rainfall. The behaviour of the variable may be 
expressed in terms of the values averaged over a fixed 
period such as an hour, day, month or year. 
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Figure 15.48 Relation between the standard deviations of the vertical velocity fluctuations n w and the convective 
velocity w. for fully convective conditions (Irwin, 1979a; reproduced by permission) 


15.12.37 Meteorology of the United Kingdom 

Information on the meteorological characteristics of the 
United Kingdom is available from the Meteorological 
Office. A simple introduction is given in Climate of the 
British Isles (Meteorological Office, 1994), which contains a 
number of maps of wind speed, minimum temperature, 
maximum temperature, rainfall and snowfall. An account 
of British meteorology with particular reference to the 
hazards that it poses is given in Environmental Hazards in 
the British Isles (Perry, 1981). 


15.13 Topography 

In dispersion work the ground surface that may be 
regarded as the base case is flat grassland such as that on 
Salisbury Plain, where much of the early work on disper¬ 
sion was done. Terrain may differ from this base case in a 
number of ways, particularly in respect of: 


(1) surface roughness; 

(2) urban areas; 

(3) coastal zones and sea; 

(4) complex terrain; 

(5) buildings and obstructions. 


General aspects of such terrain are considered briefly in 
this section. Models for dispersion over such terrain are 


treated in Section 15.14 and the corresponding dispersion 
parameters in Section 15.16. 

15.13.1 Surface roughness 

There is a wide range of surface roughness that is of 
interest in dispersion work. At one extreme ice has a very 
low value of the roughness length, while trees or urban 
areas have a very high value. There are also considerable 
differences in the roughness length of fields. For example, 
that for short grass is much lower than for wheat. The sur¬ 
face roughness of sea is affected by the wave motion and 
requires special treatment. 

15.13.2 Urban areas 

Accounts of dispersion over urban areas have been given 
by Gifford (1976a,b) and by S.R. Hanna (1976). An urban 
area acts as a heat island. It also constitutes terrain with a 
high surface roughness. Over an urban area the principal 
meteorological features such as wind speed, air and surface 
temperatures, mixing height and stability, are different 
from those over rural terrain. 

Stable air from the surrounding rural area is modified as 
it approaches an urban area. Stability near a city tends to be 
nearly neutral, however stable the rural area may be. Hence 
the more stable conditions associated with Pasquill cat¬ 
egories F and G tend not to occur. An urban area also tends 
to give increased turbulence. Measurements by Bowne, 
Ball and Anderson (1968) at Fort Wayne showed that the 
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intensity of turbulence was some 40% above that of the 
surrounding area. 

15.13.3 Coastal areas and water 

Dispersion over coastal areas and water has been described 
by Gifford (1976a,b) and Lyons (1976). Water in this context 
includes both sea and lakes, but unless otherwise stated 
reference here is to sea. Much of the experimental work 
described by Lyons, however, relates to the Great Lakes, 
which constitute a feature well suited to the study of coastal 
area dispersion. 

Conditions at the coastline may exhibit extreme varia¬ 
tions of wind pattern, temperature and humidity. In fact 
radical changes of stability and turbulence are the rule. 
Dispersion under such conditions is much more complex 
than over flat rural terrain and Lyons places some emp¬ 
hasis on what is not known as well as what is. 

In general, turbulence, and hence dispersion, is often 
less over sea than over land. In particular, this is so when 
warm air is advected over colder water. On the other hand, 
when colder, or drier air, is advected over warmer water, 
strong turbulence can occur. Lyons distinguishes three 
situations: 

(1) dispersion over water; 

(2) dispersion over the coastline 

(a) with gradient wind, 

(b) with sea breeze. 

The surface of the sea tends to be more uniform than that of 
land, but sharp differences of water temperature and the 
sudden discontinuity at the coastline introduce complica¬ 
tions not met on a land mass. 

For dispersion over water, in unstable and neutral con¬ 
ditions, with a flow of cold air over warmer water, intensity 
of turbulence is high. Water spouts and steam devils, may 
occur. In stable conditions, with a flow of warm air over 
colder water, intense inversion can occur. Conditions in 
which conduction of heat from the air to the water below is a 
dominant influence on the over-water air temperature are 
termed by Lyons ‘conduction inversions’. 

For dispersion in a gradient onshore flow, without a sea 
breeze, the low level flow crossing the coastline reacts to 
the changes in surface roughness, temperature and eva¬ 
poration. This creates internal boundary layers for 
momentum, heat and water vapour that do not necessarily 
coincide. 

Two conditions are of particular interest: plume trapping 
and fumigation. As described above, plume trapping 
occurs when a plume is trapped beneath an elevated inver¬ 
sion, while fumigation is of several types, that of interest 
here being coastline fumigation in which cold sea air is 
heated rapidly by the ground. 

Sometimes a sea breeze blows onshore at low level while 
the gradient wind above blows in the opposite direction. 
This condition tends to occur in very light gradient winds, 
strong insolation and daytime air temperatures greater 
than the sea surface temperature. The condition, known as 
a ‘sea breeze’, is therefore something different from a simple 
onshore wind. The sea breeze inflow layer has a depth of 
some 100-1000 m, typically 500 m, and the peak wind 
speed is about 7 m/s. 

Dispersion in a sea breeze is often regarded as the least 
favourable condition for dispersion of pollutants from a 
source near the coastline, in that the breeze will tend to 


blow these back on shore. In practice, along shore air 
movements, wind shear and other effects can cause appre¬ 
ciable dispersion. The effects of sea breeze tend to be 
varied. 

Over the sea, most of the meteorological parameters, and 
their diurnal variation, tend to differ from those over land. 
The stability categories required to classify stability are 
different, as are the roughness length and friction velocity, 
and the mixed layer height. 

15.13.4 Complex terrain 

An account of dispersion over complex terrain has been 
given by Egan (1976) and Gifford (1976a,b). Urban and 
industrial development often occurs at sites that have some 
special geographical feature, such as along rivers, in val¬ 
leys, or at the base of mountains beside a lake or the sea or 
at the end of a plain. Thus complex terrain is likely to be 
encountered quite frequently. The type of terrain princi¬ 
pally discussed by Egan is mountainous areas. 

In complex terrain there are a number of effects that tend 
to increase dispersion. One is wind shear due to the varia¬ 
tion of wind speed and wind direction with height. Another 
is distortion of the plume. 

There are significant distortions of flow in complex ter¬ 
rain. Flow separation, which occurs when the streamlines 
no longer follow the shape of an obstacle, may take place. 
Separation tends to be less severe for flow around an iso¬ 
lated three-dimensional object such as a hill than for flow 
normal to an object that is effectively two-dimensional 
such as a ridge. Separation is more pronounced for unstable 
or neutral conditions than for stable conditions, which tend 
to suppress it. 

The difference between complex and level terrain in 
respect of stability is most marked for stable conditions. 
Stable stratification is liable to produce shearing motions 
and thus to promote turbulence. The effect of the terrain is 
less pronounced for unstable and neutral conditions. 

Air flow in stable stratified conditions has been the sub¬ 
ject of considerable work, since the phenomenon consti¬ 
tutes a hazard to aircraft, but this work tends to concentrate 
on the two-dimensional aspects, and there is less work 
available on three-dimensional stratified flow. 

In valleys there tend to be local variations of wind direc¬ 
tion and velocity. Typically there are upslope winds during 
the day and downslope winds at night. Two issues in air 
pollution in complex terrain are the impingement of a 
plume from an elevated source on the ground and episodes 
of high pollution in stagnant regions. 

15.13.5 Buildings and obstructions 

Dispersion at buildings and other obstructions has 
been described by Halitsky (1968), Gifford (1976a,b) and 
S.R. Hanna, Briggs and Hosker (1982). The presence of 
buildings or other obstructions in the path of the gas cloud 
has a marked influence on its flow and dispersion. Buildings 
act as obstacles to the flow of gas. They also give rise to flow 
distortions with local pressure and velocity fluctuations. 

In considering the effect of a building in the near field, 
therefore, there is a distinction to be made between its 
influence on a release from a source some distance upwind 
and its influence on one from a source at a point near the 
building such as on its roof or in its lee. In the far field the 
influence of a number of buildings may often be treated in 
terms of their effect on the surface roughness. 
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Diagrams and photographs showing the flow patterns 
around buildings have been given by a number of authors, 
including Halitsky (1968), Hosker (1979) and D.J. Wilson 
(1979a). The flow pattern for conditions where the wind is 
perpendicular to the upwind face of a rectangular building 
are shown in Figure 15.49. This shows several important 
features. There is a roof cavity at the front edge of the 
building. Above this cavity, starting at about its maximum 
height, is a high turbulence layer boundary and a roof 
wake boundary. In the lee of the building there is a wake 
cavity. 


If the wind speed in they and z directions is zero (v = w= 
0) and the diffusion coefficients are the same in each 
direction (K x =Ky=K z =K), Equation 15.14.1 becomes 


dy dy _ K ( d 2 y d 2 y dM 
d/ + dx ^d* 2 + dy 2 + dz 2 J 


[15.14.2] 


where x, y, z are the distances in the downwind, crosswind 
and vertical directions (m) and K is the diffusion coeffi¬ 
cient (m 2 /s). 

If the wind speed in the x direction is also zero (u = 0), 
Equation 15.14.2 reduces to 


15.14 Dispersion Modelling 

There are a number of different approaches to the model¬ 
ling of dispersion. These include: 


'ft , d 2 * , dV\ 

dx 2 dy 2 dz 2 J 


[15.14.3] 


(1) gradient transfer models; 

(2) statistical models; 

(3) similarity models; 

(4) top hat, box and slab models. 

These are now described in turn. 


The corresponding equation for a symmetrical spherical 
system is 


dx = Kdf,dx\ 
d t r 2 dr \ dr J 


[15.14.4] 


15.14.1 Diffusion equation 

The fundamental equation for diffusion of a gas, in rec¬ 
tangular coordinates, is 


dy dy dy 
dt dx dy 


r 2 = x 2 -by 2 +Z 2 [15.14.5] 

where r is the radial coordinate (m). 

Analytical solutions of the above equations with a con¬ 
stant value of the diffusion coefficient K have been given 
by O.F.T. Roberts (1923) as described below. 


where x, y, z are the rectangular coordinates (m), K x , Ky, 
K z are the diffusion coefficients in the x, y, z directions 
(m 2 /s), t is the time (s), u, v, w are the mean wind speeds in 
the x, y, z directions (m/s) and y is the concentration 
(kg/m 3 ). The coordinate system is shown in Figure 15.50(a). 


15.14.2 Gradient transfer models 

Gradient transfer models, or K models, are solutions of the 
diffusion equation. Although the assumption of a constant 
diffusion, orturbulent exchange, coefficient wasmadein the 
early work, it is known that this is an oversimplification that 



Figure 15.49 Simplified flow pattern around a sharp-edged building (Pasquill and Smith, 1983; after Halitsky, 
reproduced by permission) 
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Figure 15.50 Coordinates for dispersion equations: 
(a) elevated source; (b) ground level source 


yields unsatisfactory results.The approach now adopted is to 
solve the diffusion equation using relationships for the 
variation of the individual exchange coefficients K x , K y and 
K z and for the wind speed u. If the form of these relations is 
amenable, an analytical solution may be obtained, but 
usually it is necessary to resort to numerical solution. 

15.14.3 Statistical models 

Analytical solution of the diffusion equation with a con¬ 
stant exchange coefficient K shows that the concentration 
profiles obtained for releases such as plumes and puffs are 
Gaussian in form and may therefore be characterized by 
standard deviations for dispersion, or dispersion coeffi¬ 
cients, a x , dy and a z . 

The statistical properties of turbulence may be 
described in terms of quantities such as the Lagrangian 
time scale and the autocorrelation function. Moreover, 
using Taylor’s theorem the autocorrelation function may be 
related to the standard deviations of the wind velocity 
fluctuations, which in turn may be related to the standard 
deviations for dispersion. 

In the model developed by O.G. Sutton (1953) the diffu¬ 
sion parameter C is related to the dispersion coefficients, 
while in the Pasquill-Gifford model these dispersion 
coefficients are used directly. These models therefore pos¬ 
sess a statistical basis. 

15.14.4 Similarity models 

Another approach is the use of dimensional analysis to 
derive similarity, or self-similar, models. Typically, the 
basis of a similarity model is an equation, derived 
from dimensional analysis, for the rate of growth of some 
characteristic dimension of the cloud, such as the height 
of a plume. This part of the model, however, gives no 


information about the concentration distribution within 
the cloud; for this, additional relations are required, which 
tend to have an empirical basis. 

Similarity models are used particularly for buoyant 
plumes and momentum jets, but such models also exist for 
plumes and puffs. The similarity approach is also used to 
obtain relationships for the dispersion coefficients used in 
the Gaussian models. 


15.14.5 Similarity criteria 

There are a number of dimensionless groups which con¬ 
stitute criteria of similarity and which are particularly 
relevant in dispersion work. 

The Reynolds number Re is defined as 



[15.14.6a] 

[15.14.6b] 


where / is a characteristic dimension, u is the velocity of the 
fluid, p its viscosity, v its kinematic viscosity and p its 
density. The Reynolds number is the ratio of the inertial 
forces to the viscous forces and is a criterion for similarity 
of flow regime. The Peclet number Pe is 

Pe = 2 ) [15.14.fJ 

where D is the diffusion coefficient, or diffusivity. 

The Peclet number characterizes the ratio of the inertial 
forces to the diffusivity and is a criterion for the relative 
importance in mass transfer of bulk transport and diffu¬ 
sive transport. 

The Schmidt number Sc is 


D 


[15.14.8a] 

[15.14.8b] 


It is thus the ratio of the Peclet and Reynolds numbers 


Sc = Pe/Re [15.14.9] 

The Schmidt number is the ratio of the kinematic viscosity 
to the diffusivity and is a criterion for similarity of mass 
transfer. The Prandtl number Pr is 


Cpfl 

k 


15.14.10; 


where c p is the specific heat of the fluid and k its thermal 
conductivity. The Prandtl number is the ratio of the kine¬ 
matic viscosity to the thermal diffusivity and is a criterion 
of similarity for heat transfer, corresponding to the 
Schmidt number for mass transfer. 

The Froude number Fr is 




[15.14.11] 


It is the ratio of the inertial force to the gravitational force 
and is acriterionof similarity where buoyancy is significant. 
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15.14.6 Top hat, box and slab models 

Another family of models is that comprising the models 
referred to as top hat, box and slab models. 

A top hat model has an essentially flat top, although 
vertical mixing takes place at the top surface. The cloud can 
therefore be considered to have a defined height. 

In a box model the cloud is treated as a vertical cylinder 
that at a given instant has a uniform concentration 
throughout. A source cloud is defined, which may or may 
not contain some initial entrained air, and the subsequent 
development of the cloud is described in terms of its 
advection and of the entrainment of air into it. In a slab 
model the concentration in the cloud is a function of 
distance. However, the terms ‘box’ and ‘slab’ are not invari¬ 
ably used in this way. A model in which the concentration 
in the cloud varies with distance is sometimes called a 
box model. 

The principal application of box and slab models in 
hazard assessment is to the dispersion of dense gases. Such 
box models are usually solved numerically, although some 
analytical solutions have been obtained. 

The term ‘box model’ is also applied to models of passive 
gas dispersion in a defined zone such as an urban area.The 
zone is modelled as a perfectly mixed box in which the 
concentration is uniform. This use of the term appears to 
antedate its application to dense gas dispersion. 

The box model has also served as a starting point for the 
development of models in which the concentration prof ile is 
based on similarity. 

15.14.7 Physical modelling 

Complex situations that are not readily handled by the 
various types of model described may be investigated by 
physical modelling using wind tunnels or water flumes. In 
such a study it is necessary to establish similarity of con¬ 
ditions. This means that the relevant dimensionless simi¬ 
larity criteria should ideally have identical values in the 
scenario investigated and in the tunnel experiments. Since 
in some cases several such groups may be involved, it may 
not be possible to achieve complete identity of all the 
groups. 

15.15 Passive Dispersion 

The dispersion of gases with neutral buoyancy, or pas¬ 
sive dispersion, has been the subject of a very large volume 
of work. Some of the early work was oriented to gas 
warfare, but latterly air pollution has been the principal 
concern. 

Neutral buoyancy is commonly due to the low con¬ 
centration of the contaminant gas released, although it may 
also occur if the density of the gas is close to that of air. The 
neutral buoyancy condition may be negated if the gas 
release causes a large change in the temperature of the 
resultant cloud. 

Hazard assessment utilizes, but has not greatly con¬ 
tributed to, work on neutral density gas dispersion. Most of 
the work has therefore been concerned with dispersion of 
continuous releases from an elevated point source, as 
represented by an industrial chimney stack. The two other 
main types of release studied that are of industrial rel¬ 
evance are continuous and instantaneous point source 
releases at ground level. There is some work on continuous 
line sources at ground level, relevant to gas warfare, but 
also to industrial area releases. 


Early work on the subject includes that of G.I. Taylor 
(1915) and O.F.T. Roberts (1923). The models that are most 
widely used, however, are those of O.G. Sutton (1953) and of 
Pasquill (1961, 1962a) and the Pasquill-Gifford model 
(Pasquill, 1961; Gifford, 1961). 

In this section an account is given of experimental 
studies and empirical features of passive dispersion. 
Section 15.16 describes passive dispersion models and 
Sections 15.17-15.19 describe dispersion over particular 
surfaces, dispersion in particular conditions and disper¬ 
sion parameters, respectively. 


15.15.1 Experimental studies 

Passive gas dispersion has been the subject of a large 
volume of experimental work. Accounts of this work 
include those by Islitzer and Slade (1968), Slade (1968), 
Colder (1972), Gifford (1976a,b) and A.E. Mitchell (1982). 
Some experimental studies of such dispersion are listed in 
Table 15.27. More detailed listings are given by Islitzer and 
Slade (1968). 

Work on passive gas dispersion on Salisbury Plain at 
Porton Down established what may be regarded as a base 
case for terrain. The terrain at Porton is open country with 
some clumps of trees. The work at Porton provides the 
experimental background for the work of O.G. Sutton (1953) 
and Pasquill (1962a). 

An important set of experiments carried out on this ter¬ 
rain are those used by Pasquill to derive parameters in his 
dispersion models. In this work there was a continuous 
release from a point source at ground level, the distance to 
which concentration measurements were made was 800 m 
and the sampling period was 10 min. 

15.15.2 Empirical features 

Experiments on passive gas dispersion indicate several 
important empirical features. The fundamental features 
have been described by O.G. Sutton (1953). 

One of the most important features is that, for both con¬ 
tinuous and instantaneous releases from a point source at 
ground level, the concentration profiles are Gaussian. 
Another basic feature is that for both types of release the 
spread of the measured concentration increases as the 
sampling period increases. It is observed that the plume 
from a continuous point source release tends to meander 
and that the dispersion due to turbulence is augmented by 
that due to this meandering. 

The concentration downwind of a continuous or instan¬ 
taneous point source at ground level is found to vary 
according to the strength of the source, provided that the 
latter does not itself cause appreciable convection. For a 
continuous point source the concentration is also inversely 
proportional to the mean wind speed. 

The concentration on the centre line of a continuous 
point source is 

X oc x ~ 176 [15.15.lf 

and that on the centre plane of a continuous infinite line 
crosswind source is 

X oc x ~ 109 [15.15.2] 

This information on the variation of concentration with 
distance has played an important role in guiding the 
development of dispersion models. 
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Table 15.27 Some experimental studies of passive gas dispersion 

Location 

Experiment 

Reference 

A Continuous elevated sources 3 

Porton Down 

Porton 

J.S. Hay and Pasquill (1957) 

Idaho Falls, ID 

National Reactor 

Testing Station (NRTS) 

Islitzer (1961) 

Richland,WA 

Hanford 

Hilst and Simpson (1958); Nickola (1977) 

Harwell 

Harwell (BEPO) 

Stewart etal. (1954) 

Long Island, NY 

Brookhaven National 
Laboratory (BNL) 

Gartrell etal. (1964); Carpenter etal. (1971) 

Tennessee Valley, TN 

Tennessee Valley 

Authority (TVA) 


B Continuous ground level releases 3 

Porton Down 

Porton 

J.S. Hay and Pasquill (1959) 

Cardington 

Cardington 

Pasquill (1962) 

O’Neill, NE 

Prairie Grass 

Cramer (1957); Lettau and Davidson 
(1957); Barad (1958); Islitzer and Slade (1964) 

Round Hill 

Round Hill 

Islitzer and Slade (1964) 

Richland,WA 

Green Glow 

Barad and Fuquay (1962); Fuquay, 

Simpson and Hinds (1964) 

Cape Kennedy, FL 

Ocean Breeze 

Haugen and Fuquay (1963); 

Haugen and Taylor (1963) 

Vandenberg AFB, CA 

Dry Gulch 

Haugen and Fuquay (1963); 

Haugen and Taylor (1963) 

Idaho Falls, ID 

NRTS 

Islitzer and Dumbault (1963) 

C Instantaneous ground level releases 11 

Porton Downs 

Porton 

F.B. Smith and Hay (1961) 

Edwards AFB, CA 

Sand Storm 

J.H. Taylor (1965) 

Agesta and Studsvik, 
Sweden 


Hogstrom (1964) 

Dugway Proving Grounds, 
Utah 

Dugway 

Cramer etal. (1964) 

Point Arguello, CA 

Naval Missile Facility 
(NMF) 

T.B. Smith etal. (1964) 

Idaho Falls, ID 

NRTS 

Islitzer and Markee (1964) 

Dallas,TX 

Cedar Hill 

McCready, Smith and Wolf (1961) 

D Releases in urban areas 

Worcester, MA 


Yersel, Goble and Morrill (1983) 

St Louis, MO 


McElroy and Pooler (1968) 

E Releases over water 

Cameron, LA 


Dabberdt etal. (1982) 

Pismo Beach, CA 


Dabberdt etal. (1982) 


a Many of these experiments are also described by Slade (1968). 
b These releases are more accurately described as ‘quasi-instantaneous’. 


15.16 Passive Dispersion: Models 

Some principal models for passive dispersion are: 

(1) Roberts model; 

(2) Sutton model; 

(3) Pasquill model; 

(4) Pasquill-Gifford model. 

An account is now given of each of these models in turn. 


15.16.1 Roberts model 

The fundamental diffusion equation has been given in 
Section 15.14. Solutions of this equation have been given by 
O.F.T. Roberts (1923), who analysed the behaviour of smoke 
from various types of release. The following treatment is 
based on Roberts’ work and on modifications of it derived 
by O.G. Sutton (1953). 

For dispersion from an instantaneous point source under 
windless conditions Equation 15.14.4 is applicable. The 
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relevant boundary conditions are: 

X —> 0 as f-> 0, r> 0 [15.16.1a] 

X -> 0 t -► oo [15.16.1b] 

The continuity condition is 

J JJ x&cdydz = Q* [15.16.2] 

where Q is the mass released instantaneously (kg). The 
solution of Equation 15.14.4 is then 


For dispersion from a continuous infinite line source at 
right angles to the wind direction, Equation 15.16.6 can be 
modified and integrated in they direction to give 






[15.16.9] 


where Q is the continuous mass rate of release per unit 
length (kg/ms). K a is the modified Bessel function of the 
second kind. Provided the term u(x^ + ^f k /2K is suffi¬ 
ciently large, Equation 15.16.9 may be approximated by 


|I5J6 ' 3 * 1 

|15,63bI 


Equation 15.16.3b may also be applied to an instantaneous 
point source with a wind speed in the x direction by meas¬ 
uring the coordinates from an origin moving with the 
cloud at the mean wind speed. 

For dispersion from a continuous point source under 
windless conditions, Equations 15.16.3, with Equation 
15.14.5, may be integrated with respect to time to give 


(4^)^ [ 2 ^) Vs 


[15.16.4a] 


X(x,y,z,t) 


[ \ 


[15.16.4b] 


where Q is the continuous mass rate of release (kg/s). At 
steady state, Equation 15.16.4 becomes 


Z ^ 4ji Kr 

x(x,y,z) = — 


[15.16.5a] 

[15.16.5b] 


Equation 15.16.5b may be applied to a continuous point 
source with a wind speed u in the x direction by a transfor¬ 
mation of coordinates. This gives 


X(x,y,z) = 


9 

4*£(#+/+,y ! ) 1/2 




[15.16.10] 


For the case where dispersion is anisotropic the equations 
are as follows. For an instantaneous point source: 


8(ti tf /2 {K x K y K z ) 112 


15.16.1 r 


For a continuous point source 


4nx(K x K y ) 1/2 




[15.16.12] 


For a continuous infinite line crosswind source: 


[15.16.13] 


The equations derived so far apply to an elevated source 
dispersion which is unaffected by the ground. If the source 
is on the surface, the ground forms an impervious boundary. 
The coordinate system is shown in Figure 15.50(b). The 
effect of the ground is to double the concentration. Thus 
Equations 15.16.11—15.16.13 become: for an instantaneous 
point source 


4{ntfP(K x KyTQ yz 


[15.16.14] 


xexp { _ ^[^ +z2+z2 ) 1/2_x ]} I 15 - 16 - 6 ! 

If the concentrations considered are those not too far from 
the* axis so that 


for a continuous point source 

„ Vi _ ® 


» p N(4- 


[15.16.15] 


y 2 + .r 2 


< 1 


[15.16.7] 


then for all but the lightest winds Equation 15.16.6 becomes 


and for a continuous infinite line crosswind source 


■(-£) 


[15.16.16] 


z(w)= ^ 6XP [-^ +22 )] 


[15.16.8] An intermediate situation occurs where the ground forms 
an impervious barrier to the material from an elevated 
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source such as a chimney or high vent. For this case 
shown that for a continuous elevated point source 


_uy*\ 
4 Kx) 


it can be x tx x~ r [15.16.23] 

and that the ground level concentration downwind over 
the centre plane of a continuous infinite line crosswind 
source is 


x { exp [-^ z ~ h)2+exp [-m {z+h)2 }} 

[15.16.17] 

where h is the height of the source (m). Equation 15.16.17 
reduces to Equation 15.16.15 if h is set equal to zero. 

The equations for continuous sources are steady-state 
equations and therefore apply only to fully established 
plumes. The concentrations given by the equations are 
applicable only if the duration of the release t is equal to or 
greater than the ratio of the distance x at the location of 
interest to the wind speed u(t>x/u). 

Equations 15.16.14—15.16.17 give the concentrations at all 
distances from the source. For practical purposes it is con¬ 
venient to define some boundaries for the cloud. The con¬ 
vention adopted is to take the cloud boundaries y 0 and z a as 
a fixed proportion, usually one-tenth, of the maximum 
concentration at distance x. If y a and z 0 are the semi-lateral 
and semi-vertical dimensions of the cloud, as shown in 
Figure 15.50, then from Equation 15.16.15, for a continuous 
point source 

/4 y/ 2 

y 0 = l -K y x In 10 j 

/4 N 1 / 2 

z 0 = (-K/X In 10 J 

y o ex 2„ oc y 2 


[15.16.18] 

[15.16.19] 

[15.16.20] 


X 


X 1/2 


[15.16.24] 


Comparison of relations 15.16.23 and 15.16.24 with the 
relations 15.15.1 and 15.15.2 obtained by experiment shows 
that this model is unsatisfactory 
Thus, it is not appropriate to model dispersion in the 
atmosphere using the constant Fickian diffusion coefficient 
K. Nevertheless, the equations given form the basis for most 
subsequent developments in work on passive dispersion. 


15.16.2 Sutton model 

The failure of the simple Fickian diffusion model has 
prompted the search for more realistic models of dispersion. 
The first model considered here is that of O.G. Sutton (1953). 

The basic equation derived by Sutton for an instanta¬ 
neous point source at ground level is 


% 3 / 2 C x CyQ(ut) 3,2{2 - n) 


[15.16.25] 


where C x , Cy, C z are diffusion parameters in the downwind, 
crosswind and vertical (x, y, z) directions (m 1/sn ), n is the 
diffusion index, and the coordinates x, y, z are measured 
from an origin moving with the cloud at the mean wind 
speed u. 

Equation 15.16.25 is related to Equation 15.16.14 in the 
Roberts model and becomes identical with it by putting 


[15.16.26a] 


The ground level concentration on the centre line (y=z = 0) 2 4/f 

ofacontinuouspointsourceisgivenbyEquationl5.16.15as C = — 


[15.16.26b] 


i(x}m 


Q 

2nx(K x Ky) 1/2 


[15.16.21] 


and that on the centre plane (z = 0) of a continuous infinite 
line crosswind source is given by Equation 15.16.16 as 


The equation for a continuous point source at ground 




k + n)\ [15.16.27] 


xW f * 


2 Qf 

{2kk]x)W- 


[15.16.22] and that for a continuous infinite line crosswind source at 
ground level is 


The visible outline of the cloud is not determined as simply, 
but depends on the theory of opacity. 

An important implication of Equations 15.16.15 and 
15.16.16 is that for Equation 15.16.15 at a fixed distance x 
from the source the concentration distribution in both 
the crosswind and the vertical directions is a Gaussian, 
or normal, distribution. Similarly, Equation 15.16.16 gives 
a concentration distribution that is Gaussian in the vertical 
direction. This feature is important in the further develop¬ 
ment of dispersion equations, as described below. 

ItcanalsobeseenfromEquationsl5.16.15andl5.16.16that 
the ground level concentration downwind along the centre 
line, or axis, of a continuous point source (y = z =0), is 


x exp [-z*- 2 (£) ] [15.16.28] 

for a continuous elevated point source is 

1j) 

exp[-^!yS + exp[-,-^]} 

[15.16.29] 
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where His the height of the source (m). 

As mentioned above, the concentrations given by the 
equations for continuous sources are applicable only if the 
duration t of the release is equal to or greater than the ratio 
of the distance x to the wind speed u(t > x/u). 

Equations 15.16.27-15.16.29 correspond to Equations 
15.16.15-15.16.17 in the Roberts model. Equations 15.16.25 
and 15.16.27-15.16.29 are frequently written with the 
assumption of isotropic conditions, for which the diffusion 
parameters are 

C x = Cy = C z = C [15.16.30] 


greater than the ratio of the distance to the wind speed 
u(t>d xlO 3 lu). 

For the lateral spread 9 used in Equation 15.16.31, 
Pasquill recommends that if suitable data are available 
the following relations should be used: 

9 = 4.3(r e [15.16.32] 

os at (Tyjx [15.16.33] 


The index n and the generalized diffusion parameter C are 
meteorological constants. Values of these constants have 
been discussed in detail by O.G. Sutton (1947,1953). The 
index n is a function of the stability conditions. The limit¬ 
ing values of n are zero and unity under conditions of very 
high and very low turbulence, respectively. In average 
conditions n has a value of approximately 1/4. The value 
of the generalized diffusion parameter C is a function of 
the height above ground and of the stability conditions. 
Values of these parameters given by Sutton are shown in 
Table 15.28. Further values are given in Section 15.28. 


15.16.3 Pasquill model 

Another general system of dispersion equations has been 
derived by Pasquill (1961, 1962a, 1965) and is generally 
referred to as the Pasquill model. The basis of the system is 
a modification of Equation 15.16.29 for a continuous point 
source at ground level: 


C„ - 


2.8 x 10 -3 Q 
udhd 


[15.16.31] 


where C 0 is the ground level concentration on the axis of the 
plume (units/n?), d is the distance in the downwind direc¬ 
tion (km), h is the vertical spread (m), Q is the mass rate of 
release (units/min), u is the mean wind speed (m/s) and 9 is 
the lateral spread (degrees). 

Equation 15.16.31 is based on Equation 15.16.29, 
generalized to allow for relatively slow changes of wind 
direction. The lateral spread 9 and the vertical spread 
h define an envelope at the edge of which concentrations 
are one-tenth of the axial or ground level values, respec¬ 
tively, that is, the envelope of the cloud defined by the usual 
convention. 

Equation 15.16.31 is for a continuous source and hence, 
as mentioned above, the concentrations given are applic¬ 
able only if the duration of the release is equal to or 


Table 15.28 Meteorological parameters for Sutton 
model a (after O.G. Sutton, 1947) 


Source height 
(m) 

n 

Cy 

(>) 


Cy 

(>) 

0 

0.25 

0.21 


0.12 

10 

0.25 

0.21 


0.12 

25 

0.25 


0.12 


30 

0.25 


0.10 


75 

0.25 


0.09 


100 

0.25 


0.07 



a Values are for small lapse rate and wind speed of 5 m/s. 


where x is the downwind distance (m), ts 3 is the standard 
deviation of concentration in the crosswind direction 
(m) and og is the standard deviation of wind direction 
(degrees). 

If such data are not available, he suggests that approx¬ 
imate estimates of 9 for a long release, lasting 1 h or more, 
may be made from wind direction traces using the follow¬ 
ing rules: 

d= 0.1km 

9 = difference between maximum and minimum trace over 
period of release 
d = 100 km 

9= difference between maximum and minimum ‘15-min 
averages’ of wind direction 

For a short release, lasting a few minutes, Pasquill gives the 
estimates of 9 shown in Table 15.29. 

The vertical spread used in Equation 15.16.31 increases 
with distance d at a rate that depends on the extent of ver¬ 
tical mixing. If, however, vertical convection is suppressed 
by an isothermal or inversion layer, the height of this layer 
sets a limit to h. Ultimately, the concentration between the 
ground and the layer becomes uniform. 

For the vertical spread h, Pasquill recommends that if 
suitable data are available the following relation be used: 

h = 2150 do# [15.16.34] 

where is the standard deviation of the wind inclination 
(rad) and </> is the wind inclination (rad). 

If such data are not available, he suggests that tenta¬ 
tive estimates of h be made using the graph shown in 
Figure 15.51. These estimates are applicable only to open 
country. The curves given in the graph are fitted by the 
approximate equations given in Table 15.29. The limits of 
the equations are as shown in the table. 

In the stable conditions of a clear night with very light 
winds (<2m/s), and thus under conditions conducive to 
sharp ground frost or heavy dew, the vertical spread h may 
be even less than that given for stability category F. 

In unstable conditions, the vertical spread h may be 
estimated by the methods just described only until it 
reaches a value h! equal to the estimated vertical extent of 
convection which will occur at some distance d'. Under 
these conditions at the distance d' there is a concentration 
profile with a limiting vertical spread h'. For approximate 
work it may be assumed that over a further interval d', and 
therefore at a distance 2d', a uniform concentration devel¬ 
ops. Thus for distances greater than 2d' the vertical spread 
h used in Equation 15.16.31 may be taken as 2 h!. 

The wind speed u and the wind direction used in 
Equation 15.16.31 at distances 0.1 and 1 km are the usual 
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Table 15.29 Meteorological parameters for Pasquill model (after Pasquill, 1961) 
A Lateral spread for a short release, 9 


Pasquill stability Lateral spread 9 (deg) 

category - 

d = 0.1km d=100km 


A 

60 


(20) 

B 

45 


(20) 

C 

30 


10 

D 

20 


10 

E 

(15) 


(5) 

F 

(10) 


(5) 

B 

Vertical spread, h 



Pasquill’s values, shown in Figure 15.51, are fitted by the following approximate equations: 


A 

logio ^ — 2.95 H- 2.19 logio d H - 0.723(logio d) 2 

0.1<d<2 


B 

logio h = 2.36 +1.05 logio d + 0.067(logi O d) 2 

0.1 <d< 10 


C 

logio h = 2.14 + 0.919 logio d - 0.017(logi 0 d) 2 

0.1 <d<30 


D1 

logio ^ = 1-85 + 0.835 logio d — 0.0097(logio d) 2 

0.1<d<100 


D2 

logio ^ = 1.83 + 0.754 logio d — 0.087(logio d) 2 

0.1<d<100 


E 

logio h = 1.66 + 0.670 logio d - 0.100(logi 0 d) 2 

0.1<d<100 


F 

logio h = 1.48 + 0.656 logio d - 0.122(logi O d) 2 

0.1<d<100 



surface values. At distances of 10 and 100 km, the wind 
speed and direction used are the averages of the surface 
and geostrophic values, but in addition the latter is backed 
(i.e. moved anticlockwise) by 10°. 

For an elevated source, Equation 15.16.31 is modified by 
the stack correction factor Fi to give 


C c = 


2.8 


10“ 3 x QF 1 
udhQ 




[15.16.35] 


Fi = expJ-2.3O30^ J 


[15.16.36] 


where C c is the ground level concentration on the axis of the 
plume for the elevated source (units/m 3 ), and H is the 
height of the stack (m). 

Equations 15.16.31 and 15.16.35 give the concentration on 
the axis of the plume. Other concentrations may be calcu¬ 
lated by multiplying the values given by these equations by 
the off-axis correction factor F 2 : 

F 2 = exp |-2.303^ j [15.16.37] 

where a is the deviation from the axis (degrees). Thus 
Equation 15.16.31 becomes 


2.8 x 10- 3 QFiF 2 
udh9 


[15.16.38] 


where C is the ground level concentration (units/m 3 ). 

The parameters 9 and h are functions of distance and 
should be determined for the distance d at which the con¬ 
centration C 0 or C c is to be calculated. It is convenient to 


tabulate and plot base values of C D or C c at distances d of 
0.1,1,10 and 100 km and to obtain other values by inter¬ 
polation. lines of equal concentration, or isopleths, may be 
calculated from Equation 15.16.38 by fixing the concentra¬ 
tion C and determining the corresponding distance d and 
deviation a. 

As an illustration of the application of the method the 
example described by Pasquill (1961,1962a) is given. The 
problem is the determination of the ground level concentra¬ 
tion for a prolonged release from continuous point sources 
(1) at ground level and (2) above ground level. A state¬ 
ment of the problem is given in Section A of Table 15.30. The 
results of the calculations for the solution of the problem are 
shown in Section B of the tableand in Figures 15.52 and 15.53. 

It may be noted that, although Equation 15.16.31 is for a 
continuous point source, so that the concentration given is 
applicable only if the duration t is equal to or greater than 
the ratio of the distance to the wind speed (t>d x 10 3 /w),it 
nevertheless gives the correct value of the total dosage for 
the total mass released, and may therefore be used to cal¬ 
culate dosage for a nearly instantaneous point source. 

Graphical solutions of the Pasquill model have been 
presented by Bryant (1964 UKAEA AHSB(RP) R42). 

15.16.4 Pasquill—Gifford model 

An alternative form of the Sutton equations has been pre¬ 
sented by Pasquill (1961,1962a) and values of the disper¬ 
sion coefficients used in this model have been obtained by 
Gifford (1961). This alternative form is often referred to as 
the Pasquill-Gifford model, as described below. 

In this formulation, use is made of the relations given by 
O.G. Sutton (1953, p. 286): 

^ = ^.( ut f- n [15.16.39] 

Similar expressions apply for <s y and o z where a x , a y and 
are the standard deviations, or dispersion coefficients, in 
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Distance, d (km) 

Figure 15.51 Vertical spread h for Pasquill equation (Pasquill, 1961) (Courtesy of HM Stationery Office) 


the downwind, crosswind and vertical ( x , y, z) direc¬ 
tions (m). 

The equation for an instantaneous point source at 
ground level then becomes 


where the coordinates x, y, z 
moving with the cloud at th 
natively, if the coordinates at 
release 


ire measured from an origin 
: mean wind speed u. Alter- 
: measured from the point of 


.♦$)] 

[15.16.40a] 


*?*« 
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Table 15.30 Illustrative example of the application of the Pasquill equation for a prolonged release from continuous point 
sources at and above ground level (after Pasquill, 1961) 


A Problem 


Effective height of elevated source H 




100 m 




Stability category 




B-C 




Surface wind speed 




4 m/s 




Surface wind direction 




275° 




Geostrophic wind direction 




8 m/s 




Geostrophic wind speed 




325° 




Vertical extent of convection 




1000 m 




Source strength 




1 unit/min 




B Solution 

Distance at which vertical spread h equals 
vertical extent of convection h! 











5.5 km 




1 Ground level source 

Distance d, km 


0.1 

1 


10 


100 

Effective wind speed u, m/s 


4 

4 


6 


6 

Effective wind direction, deg 


275 

275 


290 


290 

Lateral spread 0 a , deg 


120 

93 


67 


40 

Effective vertical spread h, m 


20 

170 


2000 


2000 

Concentration along axis C 0 , units/m 3 


2.9 x 10“ { 

1 4.4x10“* 


3.5 x 10“' 


5.8 x 10“ u 

2 Elevated source 








Arbitrary values of h/H 

Corresponding values of: 

Effective vertical 

1/2 

2/3 

4/5 

1 

1 % 

2 

4 

Spread h, m 

50 

67 

80 

100 

150 

200 

400 

Distance d, km 

Concentration along 

0.28 

0.37 

0.46 

0.59 

0.86 

1.15 

2.20 

axis C 0 , x 10“ 10 units/m 3 

4600 

2700 

1800 

1200 

580 

330 

82 

Stack correction 
factor F 1 

Corrected concentration 

10“ 4 

5.6 x 10“ 3 

0.027 

0.10 

0.36 

0.56 

0.87 

C c , x 10“ 10 units/m 3 

0.46 

15 

49 

120 

210 

185 

71 

“These values are obtained from wind direction traces. 


The equation for a continuous point source at ground level 
becomes 

*&*.*) = * ex P [15.16.41] 

The equation for a continuous infinite line crosswind 
source at ground level becomes 

^ eXP ("^) [15.16.42] 

The equation for a continuous elevated point source 
becomes 



As mentioned above, the concentrations given by the 
equations for continuous sources are applicable only if 
the duration t of the release is equal to or greater than the 
ratio of the distance x to the wind speed u ( t>x/u ). 
Equations 15.16.40-15.16.43 correspond to Equations 
15.16.25andl5.16.27-15.16.29,respectively. Asstatedabove, 
Equations 15.16.40-15.16.43 are often referred to as the 
Pasquill-Gifford model. Pasquill (1962a, p. 190) himself 
states that an equation of the particular form of Equation 
15.16.40a appears to have been first given by Frenkiel 
(1952), but that Equations 15.16.41 and 15.16.42 are implicit 
in the equations given by O.G. Sutton (1947). D.B. Turner 
(1970, p. 3) states that values of the dispersion coefficient 
er have been obtained by Cramer and co-workers (Cramer, 
Record and Vaughan, 1958; Cramer, 1959a,b) and by Gifford 
(1961), the tetter’s values for continuous releases being 
converted from Pasquill’s values of angular spread and 
height for similar releases, which were described above. It 
is the latter that are recommended for use by D.B. Turner 
(1970, p. 3). 

Again the dispersion coefficients o x , a y and are 
meteorological constants. Different values are used for 


[15.16.43] 
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Figure 15.52 Illustrative example of Pasquill equation: 
ground level concentrations along axis for a prolonged 
release from continuous point sources at and above 
ground level (Pasquill, 1961) (Courtesy of HM Stationery 
Office) 


Equations 15.16.40 for an instantaneous point source and 
for Equations 15.16.41-15.16.43 for a continuous source. 
The values of the dispersion coefficients <r y and a z for a 
continuous point source have been discussed in detail hy 
D.B. Turner (1970, p. 7). The values given by the latter, which 
are based on the work of Gifford (1961), are shown in 
Figures 15.54(a) and (b). These estimates are applicable 
only to open country The curves in the graph are fitted by 
the approximate equations given in Table 15.31, Section A. 
The limits of the equations are as shown in the table. 

The values given for the dispersion coefficients are best 
estimates (D.B. Turner, 1970, p. 7). In unstable and in stable 
conditions several-fold errors may occur in the estimate of 
a z . There are some circumstances, however, when the esti¬ 
mate of a z may be expected to be within a factor of 2. These 
are (1) for all stability conditions up to a few hundred 
metres, (2) for neutral or moderately stable conditions at 
distances up to a few kilometres and (3) for unstable con¬ 
ditions in the lower 1000 m of the atmosphere with a 
marked inversion above at distances up to 10 km or more. 
The uncertainty in the estimation of a y is, in general, less 
than that in the estimation of rs z . Equations 15.16.41 and 
15.16.43 are applicable only for time periods up to about 
10 min. For time periods exceeding 10 min the concentra¬ 
tion downwind of the source is somewhat less, due to 
alteration of the wind direction. This effect can be taken 
into account for time periods of between 10 min and 2 h 
using the following approximate relation suggested by 
D.B. Turner (1970, p. 38): 

X « r 017 [15.16.44] 

The concentration from a continuous point source at 
ground level or at an elevation obtained from Equations 



Figure 15.53 Illustrative example of Pasquill equation: ground level concentration profile for a prolonged release from, 
continuous point source at ground level (Pasquill, 1961; reproduced by permission of HM Stationery Office) 
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Distance, x (m) 

Figure 15.54(a) Meteorological parameters for Pasquill- Gifford equations for continuous source: crosswind dispersion 
coefficient n y (D.B. Turner, 1970). A-F refer to Pasquill stability categories. 


15.16.41 and 15.16.43, respectively, is often plotted as xu/Q 
vs distance*. 

The values of the dispersion coefficients a x , a y and a z for 
an instantaneous point source, which differ from those for 
continuous sources, are discussed by Slade (1968). The 
values of oy and o- z given by the latter are shown inTable 15.31, 
Section B. It is normally assumed that a x is equal to a y . 

15.16.5 Effect of sampling period 

As described above, if the concentration in a plume is 
sampled virtually instantaneously, the concentration dis¬ 
tribution has a relatively narrow spread, while if the sam¬ 
ple is taken over a longer time period, the distribution has a 


wider spread. D.B. Turner (1970) quotes the following esti¬ 
mates by Meade of the effect of sampling period t on the 
concentration % at ground level expressed as the ratio xllz, 
where %3 is the concentration for a sampling period of 3 min. 


t xlx3 

3 min 

1.00 

15 min 

0.82 

lh 

0.61 

3 h 

0.51 

24 h 

0.36 
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Figure 15.54(b) Meteorological parameters for Pasquill- Gifford equations for continuous source: vertical dispersion 
coefficient n> (D.B. Turner, 1970). A-F refer to Pasquill stability categories 


He suggests that the variation of concentration with sam¬ 
pling period may be taken into account using the following 
approximate relation: 



where f is the sampling period which yields concentra¬ 
tion x, p is an index and subscript r denotes the reference 
value. Equation 15.16.45 is intended for use for sampling 
periods up to 2 h using a typical reference sampling 
period of 10 min. The value of index p is between 0.17 
and 0.2. 


[15.16.45] 
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Table 15.31 

Meteorological parameters for the Pasquill-Gifford model 

A values of o v and o z for continuous sources given by Turner (1970) are shown in Figure 15.54. Turner’s 
values are fitted by following approximate equations: 

Pasquill 

stability 

category 

Dispersion Coefficient 

(m) 


A 

rs y = 0.493x°' 88 

<s z = 0.087x 110 

logio <x z = -1.67 + 0.902 logiox + 0.181(logio*) 2 

100<x<300 

300<x<3000 

B 

o y = 0.337x°- 88 

<>■* = 0.0135x a95 

logio = -1-25 +1.09 log 10 z + 0.0018(log 1Q x) z 

100<x<500 

500 <x<2 x 10 4 

C 

<s y = 0.195x a90 

<r z = 0.112x°' 91 

100 < x < 10 5 

D 

tj y = 0.128x a9 ° 

= 0.093x a85 

logio <x z = -1.22 +1.08 logiox - 0.061(logi O x) 2 

100<x<500 

500 < x < 10 s 

E 

<Sy = 0.091x°' 91 

<r z = 0.082x asz 

logio <r* = -1.19 +1.04 logiox - 0.070(logiox) z 

100 <x <500 

500 < x < 10 5 

F 

Gy = 0.067x°' 90 

a z = 0.057x aso 

logio <*z = 1.91-1.37 logiox - 0.119(logi 0 x) 2 

100 <x<500 
500<x<10 5 


B Values of n y and c z 

for instantaneous s< 

jurces given by Slade (1968) 

Stability condition 

x = 100: 


x = 400 m 

Approximate equation 


Oy 


Gy a z 



(m) 

(m) 

(m) (m) 


Unstable 

10 

15 

300 220 

Gy = 0.14x 0-92 g z = 0.53x°' 73 

Neutral 

4 

3.8 

120 50 

Gy = 0.0 6x 0 ' 92 g z = 0.15x°' 70 

Very stable 

1.3 

0.75 

35 7 

g x = 0.024x°' 89 g z = 0.05x°- 61 


15.16.6 Plume model characteristics 

The Sutton equations for instantaneous and continuous 
point sources are models of the behaviour of a ‘puff’ and a 
‘plume’of gas, respectively.The equations are convenient in 
form for the calculation of various derived quantities and 
have been used extensively. Some important characteristics 
in the plume model of dispersion from a ground level source 
are (1) the concentration on the axis of the plume and (2) the 
dimensions of the plume. Again, these quantities are 
mainly of interest at ground level. 

Applying the Sutton model, for a continuous point 
source at ground level use is made of Equation 15.16.27 with 
Equation 15.16.30. If the concentration considered is that 
at ground level z = 0, then 

*( x > y ’ °) = rccS-” 6XP (~^" Z &) [15.16.46] 


extinction concentration Xex- For the dimensions of the 
cloud at ground level the coordinates (x, y) of a point of 
concentration y cb are obtained from Equation 15.16.46. 

The plume model for dispersion from an elevated source 
is also relevant. In this case two important characteristics 
are (1) the maximum concentration on the axis at ground 
level and (2) the distance at which the maximum ground 
level concentration occurs. 

For a continuous elevated point source, use is made of 
Equation 15.16.29 with Equation 15.16.30. If the concentra¬ 
tion considered is that at ground level on the axisy = 0 and 
z = 0, then 

xa = xi x > o, o) = [15 ' 16 ' 49] 

For the maximum ground level concentration / mg i on the 
axis the appropriate equation may be shown to be 


For the ground level concentration xa on the axisy = 0 

* c1 = xM0) = 7I cS^, I 15 - 16 - 47 ! 

For n = 0.25 and C=0.14 


[15.16.48] 


2 Q 

"*™ gl enuH 2 C y 


[15.16.50] 


where e is the base of natural logarithms. 

The distance y mg i at which the maximum ground level 
concentration y mg i occurs may be shown to be given by the 
equation 


/u\ 2 A 2 " 

The cloud boundary concentration y cb may be defined as Zmgl = I —) 
either one-tenth of the axial concentration Xci or as the \QiJ 


[15.16.51] 
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The corresponding equations based on the Pasquill- 
Gifford model are as follows. For a continuous point source 
at ground level use is made of Equation 15.16.41. If the 
concentration considered is that at ground level 2=0, then 


For the other quantities mentioned it is necessary to define 
the cloud. If the definition used is the convention that the 
concentration x C b at the cloud boundary is one-tenth of that 
at the centre, then 


[15.16.52] 


For the ground level concentration on the axis 


^ = 0.1 [15.16.60] 

Xcc 

Alternatively, the cloud boundary concentration may be 
defined as some extinction value Xex at which the con¬ 
centration is no longer of interest: 


[15.16.53] 


For the dimensions of the cloud at ground level, the coor¬ 
dinates (x, y) of a point of concentration / cb are obtained 
from Equation 15.16.52. 

For a continuous elevated source use is made of Equation 
15.16.43. If the concentration considered is that at ground 
level on the axis y=z= 0, then 


( 1 h 2 


[15.16.54] 


For the maximum ground level concentration Xmgi on the 
axis the appropriate equation may be shown to be 


2 Q 

^ mgl enuh 2 a y 


[15.16.55] 


The distance at which the maximum ground level con¬ 
centration occurs may be shown to be the point at 
which 


[15.16.56] 


15.16.7 Puff model characteristics 

Some important quantities in the puff model of dispersion 
from a ground level source are (1) the concentration at the 
centre of the cloud, (2) the dimensions of the cloud, (3) the 
maximum distance travelled and (4) the total integrated 
dosage given by the cloud. These quantities are mainly of 
interest at ground level. 

Applying the Sutton model, for an instantaneous point 
source at ground level use is made of Equation 15.16.25 with 
Equation 15.16.30. If the concentration considered is that at 
ground level 2 = 0, then 


Xcb = Xex [15.16.61] 

A typical extinction concentration is the lower flam¬ 
mability limit for a flammable gas. 

For the dimensions of the cloud at ground level the cloud 
radius x is determined by calculating x cc from Equation 
15.16.58, / cb from Equation 15.16.60 or 15.16.61 and x from 
Equation 15.16.57, setting x = Xcb- 

For the maximum distance travelled by the cloud the 
group ut is calculated from Equation 15.16.58 with Xcc set 
equal to Xex- 

The corresponding equations based on the Pasquill- 
Gifford model are as follows. For an instantaneous point 
source at ground level use is made of Equation 15.16.40. 
If the concentration considered is that at ground level 
2 = 0, then 


« 4 - 1{H 


For the ground level concentration x cc 
cloud x=y=0 



the centre of the 


[15.16.63] 


For the dimensions of the cloud at ground level the cloud 
radius x is determined by calculating x cc from Equation 
15.16.63, Xcb fro m Equation 15.16.60 or 15.16.61 and x from 
Equation 15.16.62, setting x = Xcb- 
For the maximum distance travelled by the cloud use is 
made of Equation 15.16.63 with x cc set equal to x e x- 


15.16.8 Dosage and dosement 

The total integrated dosage Z> tM , or more simply the 
dosage/), is 




For the ground level concentration Xcc at the centre of the 
cloud*=y= 0 


Zcc = x(0,0,0,t) 


2 Q* 


[15.16.58] 


For n = 0.25 and C= 0.14 


D — jP° x df [15.16.64] 

In the Sutton model for a puff release, the dosage at ground 
level on the axis may be obtained by integrating Equation 
15.16.57 to obtain 

D(x, 0,0) = ^ [15.16.65] 

In the Pasquill -Gifford model for a puff release, the dosage 
D at ground level and at ground level on the axis, the 
appropriate equations may be shown to be, respectively, 


Xc 


131Q* 

(ut) m 


[15.16.59] D(x,y, 0) = ^/xpj- ^ J 


[15.16.66a] 
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D(x, 0,0) = - ^ [15.16.66b] 

For some materials it is necessary to work in terms not of 
the dosage D as defined by Equation 15.16.64 but of a load, 
or dosement, defined as 

L = fit [15.16.67] 

where n is an index. 

For the Pasquill-Gifford model it has been shown by 
Tsao and Perry (1979) that for a puff release the dosement at 
ground level is 



For a plume release the load, or dosement, is obtained from 
the steady-state concentration and the period of exposure 
to that concentration. 


15.16.9 Virtual sources 

In the models just described, it is assumed that the sources 
are point sources, instantaneous or continuous. If the 
source is of finite size, it may be necessary to allow for this 
using the virtual source method. An account of the method 
has been given by Mecklenburgh (1985). 

The need to allow for finite source size may occur, for 
example, as the result of the instantaneous flashing off of 
vapour at the source to form a relatively large cloud. A 
change of surface roughness, and hence of the dispersion 
parameter, may also require the use of the virtual source 
method. 

Mecklenburgh treats the determination of the ground 
level concentration at the centre of the cloud formed from 
an instantaneous release. For this he utilizes Equation 
15.16.63 rewritten in the form 


sometimes to determine the group a x fs y o z from C and 
sometimes vice versa. 

Consider as an illustration the example given by 
Mecklenburgh, which is the determination of (1) the con¬ 
centration of gas at the works boundary and (2) the distance 
to the lower flammability limit for a release of 8240 m 3 of gas 
from a point where the distance in the downwind direction 
between that point and the works boundary is 100 m. 

The release gives a cloud of finite size. Equation 15.16.69 
is strictly applicable to an instantaneous point source. 
In order to allow for the finite size of the cloud, the release 
is assumed to originate from a point source VS1 located at a 
virtual distance V\ upwind of the actual release point. Then 

Xyi = vi + x s [15.16.70J 

where is the distance between the virtual and actual 
sources (m), x s is the distance between the actual source 
and the point of interest (m) and x vl is the distance between 
the virtual source and the point of interest (m). These 
distances are shown in Figure 15.55(a). The concentration 
of the cloud at the actual source is taken as pure gas so that 
C=lv/v. 

Then Equation 15.16.69 with V = 8240 m 3 and C = 1 v/v 
yields {a x a y a^ = 1046 m 3 . The on-site equations for the a 
values (with x in these relations equal to v{) give Vi = 129 m. 
The virtual source VS1 is thus 129 m upwind of the 
actual source. 

For the concentration at the works boundary, the dis¬ 
tance x v i between the virtual source and the boundary is 
given by Equation 15.16.70 with x s = x b , so that 

x A = v\ J c x b [15.16.71] 

where x b is the distance between the actual source and the 
boundary (m). Using the on-site a equations (with x = x v i) 
yields (o x o y <T z ) = 4696m 3 . Then from Equation 15.16.69 at 
the boundary C = 0.223 v/v. 

Across the boundary the surface roughness changes and 
it is necessary to utilize a second virtual source VS2, 
determining its distance upwind from conditions at the 
works boundary. Utilizing again C= 0.223 v/v, and hence 
(o x o y Oz) = 4696m 3 , but this time using the off-site a 
equations (with x = x v2 ), gives x v2 = 365 m. At the boundary 



where C is the volumetric concentration (v/v) and V is the 
volume of gas released (m 3 ), together with the following 
relationships for the dispersion parameters: 

Onsite: 

ct j[ =0.13x; o y = 0.064x a905 ; a z = 0.395x a701 ; 

(oyrJ 1/2 = 0.159* 0 ' 803 ; (a x a y <r z ) V3 = 0.149x a869 


Xv2 = v 2 + x b [15.16.72] 

where v 2 is the distance between the virtual and actual 
sources (m). Then, from Equation 15.16.72, w 2 = 365 
100 = 265 m. 

For the distance to the lower flammability limit, the 
distances are shown in Figure 15.55(b). Setting C = 0.0355 v/v 
in Equation 15.16.69 yields (c x <r y cr z ) = 29,475 m 3 . Using the 
off-site a equations (with x = x v2 ) gives x v2 = 528 m. But 

Xv2 = v 2 + (x s - x b ) [15.16.73] 


Off site: 

a x = 0.13x; a y = 0.064x°- 905 ; a z = 0.200x a76 °; 

(<J y cr z ) V2 = 0.113x a833 ; {a x c y a z ) V3 = 0.118x°' 888 

The equations are for Pasquill stability category D and a 
surface roughness of 0.1 on site and 1.0 (urban) off site. The 
method involves the repeated use of Equation 15.16.69, 


Hence x s = 528 - (265 - 100) = 363 m. 


15.16.10 A-theory models 

An alternative approach to that given in the Sutton, 
Pasquill and Pasquill-Gifford models is the direct solution 
of the fundamental diffusion equation in which the dis¬ 
persion is characterized by the parameter K. As mentioned 
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•e of initial cloud; and (b) use of virtual 


above, early work on this, in which if was assumed to be a 
constant, such as that of Roberts, gave unsatisfactory 
results, but more modern models, which take into account 
the variation of A, have been more successful and find use 
alongside the models already described. 

Accounts of such gradient transfer, or A-theory, models 
are given by S.R. Hanna, Briggs and Hosker (1982), by 
Runca (1982) and Gryning, van Ulden and Larsen (1983). 
These if-theory models may be solved analytically, if cor¬ 
relations of a suitable form are available for A. Alter¬ 
natively, they may be solved numerically. 

For analytical solutions the profiles of the wind velocity 
u and of the parameter A may be expressed as power 
functions of the height z. 




[15.16.74] 

15.16.75] 


where m and n are indices and r denotes the reference value. 

A further discussion of values of the parameter A is given 
in Section 15.24. Various analytical solutions for A-theory 
models are given by S.R. Hanna, Briggs and Hosker (1982). 

Numerical solution of A-theory models tends to involve 
severe problems both of numerical inaccuracy and numeri¬ 
cal instability. The effect of the former is to give a spurious 
diffusion which arises solely from the numerical method of 
solution. The effect of the latter is to require very small step 
lengths and hence very long computation times. 

15.16.11 Criterion for type of release 

The dispersion situations that occur in practice often cor¬ 
respond not to the puff or the plume model but to the inter¬ 
mediate case. The usual method of dealing with this 
problem is to calculate dispersion using both models and to 
take the worst case. 

The alternative approach is to select the model on 
the basis of a suitable criterion. A criterion for deciding 
whether to use the puff or the plume model, as given by 
the respective Pasquill—Gifford equations, has been 


suggested by Eisenberg, Lynch and Breeding (1975). The 
puff model is preferable if the diffusion in the downwind, or 
x, direction is large relative to the length of the plume. A 
measure of diffusion in the downwind direction is the 
dispersion coefficient a x , where this is evaluated using the 
puff data, and a measure of the length of the plume is ut e , 
where u is the wind speed and f e is the time taken for total 
discharge or evaporation of the gas. The coefficient a x is 
evaluated using the puff data at utJ2. The authors suggest 
the following criteria: 

ut e < 2 o x Use puff model 

«4 > 5rr x Use plume model 

2u x < ut e < 5(7 x Neither model entirely appropriate 

In addition, the plume model is undefined for zero wind 
speeds, is inaccurate for low wind speeds and is therefore 
not recommended for use at wind speeds of less than 2 m/s. 
Further criteria for model selection are given in relation to 
some of the model systems described below. 


15.17.1 Dispersion over urban areas 

Accounts of dispersion over and in urban areas have been 
given by Gifford (1972, 1976a,b), S.R. Hanna (1976) and 
S.R. Hanna, Briggs and Hosker (1982).There are two rather 
different types of model that are used to describe the con¬ 
centration of pollutant in an urban area. The first type is 
concerned with the overall concentration of the pollutant in 
the urban atmosphere as required for pollution studies.The 
second describes the dispersion and gives concentration 
profiles. 

Models used for dispersion over and within an urban 
area include the Pasquill-Gifford model and A models. 
D.B. Turner (1964) carried out a study to validate the use of 
the Pasquill-Gifford model over and within a city, and 
various other workers have carried out studies to deter¬ 
mine the parameters of this model in the urban situation. 

Models used for pollution studies include rollback mod¬ 
els, statistical correlations and box models. In a rollback 
model it is assumed that the concentration is proportional 
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Perfectly mixed 
volume 


Area source 


Figure 15.56 Box model for dispersion over an urban area 


A model which has been used for complex terrain is the 
model of Environmental Research and Technology Inc. 
(ERT) which is based on the Pasquill-Gifford equation for 
a release from an elevated continuous point source as given 
in Equation 15.16.43. The effective stack height h 0 is taken 
as usual as the sum of the actual stack height h and the 
plume rise Ah. Then an effective plume height, essentially 
the height of the centre line of the plume, is defined as 
follows. For a receptor on a hill, the height hi of which is 
lower than the effective stack height h 0 , the effective plume 
height hp is taken as 

hp = ho- hi/2 h x <ho [15.17.3a] 


to the strength of the emission source(s). A rollback model 
therefore focuses attention on the level of emissions. Sta¬ 
tistical correlations are used to relate concentrations to 
meteorological variables such as solar radiation, wind 
speed and temperature. 

In a box model the urban area is treated as a box as shown 
in Figure 15.56. The basic equation is 

A** f = AxQ a + uzi( Xb ~x)+Axf( Xa - X ) [15.17.1] 

where Q a is the mass rate of release per unit area, Ax is an 
incremental length, z, is the mixed layer height, x is the 
concentration, / a is the concentration above the mixed 
layer height and X b is the concentration upwind of the city, 
or background concentration. 

With zero background concentration and at steady state, 
Equation 15.17.1 becomes 


whilst for a receptor on a hill height hi, which is higher than 
ho, the expression used for hp is 

hp = ho/2 h 2 <k, [15.17.3b] 

The model has been used for unstable, neutral and stable 
conditions. For a hill higher than the effective stack height 
this model is the so-called ‘half-height’ model. 

Flow in complex terrain may be modelled using potential 
flow theory. Standard cases in potential flow are treated by 
Lamb (1932) and Milne-Thomson (1938). Two cases relevant 
to complex terrain are the half circular cylindrical ridge 
and the hemispherical hill. Potential flow theory may be 
extended to include diffusion. 

Thus the Pasquill-Gifford equation giving the ground 
level centre line concentration from an elevated point 
source may be modified to give 


X 


AxQa 


[15.17.2] 


In some versions of the box model it is assumed that the 
pollutant is mixed not to the mixed layer height z,-, but to 
some other height. A correlation for this height is given by 
S.R. Hanna (1976). 

Dispersion coefficients for use in the Pasquill-Gifford 
model in urban areas are discussed in Section 15.19. 


15.17.2 Dispersion over coastal areas and water 

An account of the meteorology relevant to coast and sea is 
given in Physics of the Marine Atmosphere (Roll, 1965). The 
modelling of dispersion over coastal areas and water has 
been described by Gifford (1976a,b) and by Lyons (1976). 

Dispersion over coastal areas and water is most often 
modelled using the Pasquill-Gifford method. It is pointed 
out by Lyons that this involves use of the model outside the 
range of conditions for which it was developed, which were 
flat rural terrain. Moreover, a further weakness is that the 
assumption of a steady state is less valid in the more vari¬ 
able wind conditions characteristic of coastal areas. 
Nevertheless, this is the model that is most widely used. 
Dispersion coefficients for this model are described in 
Section 15.19. 

Several other models are described by Lyons. These 
include a model for conduction inversion and one for 
shoreline fumigation based on a modification of the noc¬ 
turnal inversion breakup model of TUrner. 


(rjhof 1 

2(rJf 2 Lf| 


Dy = %/%£ 

D z = c y /a* 
n »%~z)/h o 
C=(diP/dhp)J(d^/6hp) 


[15.17.4] 


[15.17.5a] 

[15.17.5b] 

[15.17.6] 

[15.17.7] 


where h p is the local height of the plume, z is the local height 
of the terrain, i jt is the stream function and subscripts f and 
o denote flat terrain and effective source height, respec¬ 
tively, £ is the ratio of the average vertical gradient of the 
stream function at the effective source height to the 
gradient at the plume centre line over the surface. 

For flat terrain, D y , D z , rj and £ are all unity. For two- 
dimensional flow, as over a ridge, it can be shown that near 
the surface rj and ( are approximately equal and, assuming 
that D y and D z are also equal to unity, Equation 15.17.4 
reduces to Equation 15.16.43. For three-dimensional flow, 
as over a hill, the parameters r\ and £ have the values 


r\ = ho/2a [15.17.8] 

£ = 2ho/3a [15.17.9] 


where a is the radius of the hill. Then, again assuming that 
D y and D z are unity, Equation 15.17.4 becomes 


15.17.3 Dispersion over complex terrain _ Q \ (/*o/2) 2 l , , 

A description of the modelling of dispersion over complex % ~ t n <s o z u) eX ^ 2a 3 [iD.i/.iUJ 

terrain has been given by Egan (1976). y 2 f <- a J 
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Comparing Equation 15.17.10 with Equation 15.16.43 it can 
be seen that the effect of the hill is to give an equivalent 
source height h e half the effective source height h a . 
Thus Equation 15.17.10 is another form of the ‘half-height’ 
equation for complex terrain. 

Another approach is physical modelling using wind and 
water tunnels. As described above, Egan discusses the 
requirements of similarity in such work. He gives several 
examples of tunnel studies for complex terrain. 

15.17.4 Dispersion at buildings and obstacles 
Accounts of models available for dispersion at buildings and 
obstacles are given by Halitsky (1968), Gifford (1976a,b), 
Vincent (1977), S.R. Hanna, Briggs and Hosker (1982) and 
Fackrell (1984a). A review of the aerodynamics of flow 
around buildings has been given by J.C.R. Hunt (1971). 

Treatments of the effect of a building on release from an 
upwind source are mainly concerned with the case of an 
elevated source. A rule-of-thumb applicable to this situa¬ 
tion is that the plume will rise over the building if the dis¬ 
tance from the source to thebuilding is greater than 2 h, where 
h is the height of the building, and if the height h s of the 
source exceeds two-thirds that of the building ( h s > 2h/3). 

The overall effect of the building is to enhance the dis¬ 
persion of the plume. DJ. Wilson and Netterville (1978) 
found that the main effect is to increase the mixing between 
the roof and ground levels. Around the building itself 
aerodynamic effects may give high local concentrations. 

For groups of buildings or buildings of less regular 
shape, the flow patterns tend to be complex. It has been 
shown by Cagnetti (1975) for a reactor site that dispersion 
may vary markedly for relatively small changes in wind 


direction. Dispersion from sources close to a building has 
been modelled more extensively, since this is relevant to the 
siting of vents and stacks. 

Rules for the siting of roof stacks for the case of wind 
impinging perpendicularly on the face of a rectangular 
building, as shown in Figure 15.57, have been derived by 
D.J. Wilson (1979a). For a building with height h, crosswind 
width w and alongwind length /, he defines a scaling factor 
R such that 

R = lf s 67 D P' 33 15.17.11] 

where D s is the smaller dimension of the height h and the 
width w, and D\ is the larger of these two. He gives the fol¬ 
lowing correlations for the roof cavity length l c and height h c : 

k = 0.9 R [15.17.12] 

h c = 0.22 R [15.17.13] 

The upper boundary Z n of the high turbulence layer, which 
starts near the maximum roof cavity height, is given as 

~ = §J7-0.1~ [15.17.14] 

and that of the roof wake Z m as 

^ = 0.28(|) V3 [15.17.15] 

where x is the downwind distance. 



Figure 15.57 Flow pattern and How zones around the roof of a square edged building for wind perpendicular to the 
upwind face (D.J. Wilson, 1979a) H, H c , L, L c in the figure are denoted in the text by h, h c , I, l c (Courtesy of the American 
Society of Heating, Refrigerating and Air Conditioning Engineers) 
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Wilson suggests that for a roof-mounted stack there is 
little risk of high pollutant concentrations on the roof if 
plume clears the boundary of the high turbulence zone and 
virtually no risk if it clears the roof wake boundary. 

Concentrations arising from vents on roofs have been 
studied in wind tunnel investigations as described by 
Halitsky (1963,1968) and D.J.Wilson (1976). Results of such 
studies are plotted in terms of the dimensionless con¬ 
centration K defined as 


[15.17.16] 


where A is a characteristic area, Q is the mass rate of release 
and u is the wind speed. A typical characteristic area is wh. 

Wilson gives the following correlation for the maximum 
value of the concentration x(x) from a roof vent: 


X(x) 

X(0) 


[15.17.17] 


where A v is the vent area, u is the wind speed, w„ is the 
effluent velocity, x is the downwind distance, and x(0) is the 
effluent concentration. 

For a roof stack, a widely used rule-of-thumb is the ‘2 Yi 
rule that to avoid downwash problems the stack height 
should be 2 '/ 2 times the building height. This height will 
cause the plume to clear the wake cavity. 

Another model is that of G.A. Briggs (1974), which 
applies to a stack located upwind of the building. For such a 
stack of height h the effective stack height h' is taken as 


There have been a number of treatments of the wake 
cavity in the lee of the building. These include studies of the 
characteristics of the wake cavity itself and of the 
concentrations resulting from a release within the cavity. 
The wake cavity approximates a perfectly mixed zone 
with the concentration being nearly the same throughout. 

A review of models for building-influenced dispersion 
has been given by Fackrell (1984a). These include: the 
model of Gifford (1960a), described below; the models of 
D.B. Turner (1970) and Barker (1982), which involve the use 
of a virtual source; and those of Ferrara and Cagnetti (1980) 
and Huber and Snyder (1976), which involve modification 
of the dispersion coefficients. Both the models that use a 
virtual source and those that use modified dispersion 
coefficients correlate the parameters in terms of the build¬ 
ing width w and height h. 

For the wake cavity itself, Hosker (1979, 1980) has 
developed the following correlations for the length x T : 


Xr A{w/h) 

h 1 + B{w/h) 


[15.17.20] 

with 



A m —2.0 + 3.7(//fc) _1/3 

l/h< 1 

[15.17.21a] 

= 1.75 

l/h> 1 

[15.17.21b] 

B = —0.15 + 0.305(1/hy 1 / 3 

l/h < 1 

[15.17.22a] 

<= 0.25 

l/h> 1 

[15.17.22b] 


h' = h-h A [15.17.18a] 

h A = 2^ -1.5) D s [15.17.18b] 

where D s is the diameter of the stack outlet, h A is the down- 
wash, or initial fall in the plume, and w a is the efflux velocity 
from the stack. The equation reflects the fact that downwash 
does not occur if the efflux velocity is maintained above a 
critical level,generallytakenasw 0 /j< = 1.5.Theplumeisout 
of the building wake if h! > (h+ 1.5D S ). If this condition 
does not apply, the plume is to some degree affected by the 
building and if h 0 < 0.5D S , it is assumed to be trapped by the 
wake cavity. Then 

ho = h' H >(h+ 1.5A) [15.17.19a] 

= 2V-(/* + 1.5A) h' <(h + 1.5A) [15.17.19b] 

= //-1.5A h'<h [15.17.19c] 


As far as concerns the width y r and height z r of the cavity, 
these rarely exceed the building width w and height h, 
respectively 

For a plume from a source in the wake cavity, the 
following treatment by Gifford (1960a, 1976a,b) is widely 
quoted. Following an approach by Fuquay, an atmospheric 
dilution factor D A is defined as 

D a = Q/x [15.17.23a] 

= m y o z u [15.17.23b] 

where Q is the mass rate of release, u is the wind speed, and 
G y and o z are the downwind and crosswind dispersion coef¬ 
ficients, respectively. But a building dilution factor D B 
can be defined as 

Db = cAu [15.17.24] 

whereA is the cross-sectional area of the building normal to 
the wind (= wh) and c is a constant. The total dilution factor 
Act is 


If the plume is trapped it may be treated as a ground level 
source with initial area Z^. 

If a plume is entrained into the wake cavity (h 0 < 0.5AX 
the dimensionless concentration tends to lie in the range 
0.2-2. Given that the plume is entrained into the wake 
cavity, the precise height of the stack makes little difference 
to the ground concentrations. There is, however, one par¬ 
ticular case where stack height can have a marked effect. If 
the stack height is about the same height as the wake cavity, 
the effluent may be carried directly to the ground along the 
boundary of the cavity. 


Aot =D a + Db 

= (JCGyGz + cA)u 


Hence 


X = 


Q 

(7 iGyOz + cA)u 


[15.17.25a] 

[15.17.25b] 

[15.17.25c] 


[15.17.26] 
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Gifford (1960a) has estimated that the value of c lies in the 
range 0.5-2. He states (Gifford, 1976b) that this estimate, 
though widely quoted, was purely intuitive and that there 
are other studies that support a value of about 0.5. 

There is evidence that the dispersion coefficients a y and 
a z applicable in Equation 15.17.26 differ somewhat from 
the regular values. The latter tend to give downwind con¬ 
centrations that vary with distance to a power lying 
between —1.3 and -1.6, depending on the stability 
condition. Laboratory studies by Meroney and Yang (1971) 
and Huber and Snyder (1976) have found this power to 
be close to -0.8 to a distance of 50 h, although field studies 
such as those by Dickson, Start and Markee (1969) have 
given the power as about —1.3. 

Gifford (1976b) draws attention to other conditions in 
which dispersion deviates from that predicted by Equation 
15.17.26. 

Barry (1964) has reviewed published expressions for the 
concentration given by pollutants in the lee of a rectangular 
block of square cross-section (alongwind length = 
height = S) and found them to be of the general form 


[15.17.27] 




where C is the mean concentration, Q is the source 
strength, u is the main stream air velocity and k is a 
constant. The value of the constant k is in the range 0.5-20. 

Vincent (1977) has described wind tunnel work on the 
dispersion of pollutant near buildings, and particularly in 
building wakes. He uses dimensional analysis to derive the 
principal parameters governing flow around a rectangular 
block. These are X/S and 


rr Uti 

H =^r 


[15.17.28] 

[15.17.29] 


where kt is the characteristic energy of free stream turbu¬ 
lence, k is the characteristic length scale of free stream 
turbulence, t A is the mean residence time of the scalar 
entities in the wake bubble, X is the length of the wake 
‘bubble’ and A is a free stream turbulence parameter. 
Vincent gives results of wind tunnel work correlating H 
and X/S against A. 

For a pollutant source wholly contained within the 
bubble he derives the relation 


C. 


QSH 

Vu 


But 




[15.17.30] 


[15.17.31] 


where V is the volume of the wake bubble. Then from 
Equations 15.17.30 and 15.17.31 


*“(£)(*%) |I5I7 ‘ 321 

Vincent points out that Equation 15.17.32 gives for k in 
Equation 15.17.27 the explicit expression H/(X/S). 


Fackrell (1984b) has derived a model for a building wake 
and for the concentration in this wake and has used wind 
tunnel experiments to obtain values of the parameters 
involved. For flow out of the wake 


F = aSu h Q v [15.17.33] 

where C w is the average concentration in the near-wake 
region, F is the flow out of the wake, S is the surface area 
of the near-wake region, u h is the wind speed at the build¬ 
ing height in undisturbed flow, and a is a flux constant. 
If there is a source of strength Q in the wake 

F = Q [15.17.34] 

so that from Equations 15.17.33 and 15.17.34 
Q = aSMhCw [15.17.35] 

The residence time in the wake is 


[15.17.36] 


where t T is the residence time in the near-wake region and 
Vis the volume of the near-wake region. 

Fackrell defines the following dimensionless quantities 
for the recirculation, or near-wake, region: 


■I-r/h 

_«hfr 


_ CyUbA 
= ■ 


[15.17.37] 

[15.17.38] 

[15.17.39] 

[15.17.40] 


where A is the frontal area of the building, h is the height of 
the building, L r is the length of the recirculation region, /J 
is the wake shape parameter, is the dimensionless length 
of the recirculation region, r T is the dimensionless 
residence time in the recirculation region and / w is the 
dimensionless average concentration in the near-wake 
region. 

Then from Equations 15.17.35—15.17.40 

[15.17.41] 

[15.17.42] 


Fackrell reviews the correlations available for A r and r r . 
He modifies Equation 15.17.20 of Hosker to give 


4 # _ 0.3<'<3 


[15.17.43] 


where b is the crosswind breadth of the building. He also 
obtains 


iWfe )’ 6 

[l + 0.6 (b/h) ls ] 


[15.17.44] 
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15.18 Passive Dispersion: Dispersion in Particular 
Conditions 

The other type of special situation is determined not by the 
terrain but by the meteorological conditions. Two such 
situations are considered here: 

(1) dispersion in calm conditions; 

(2) dispersion in a uniformly mixed layer. 

15.18.1 Dispersion in calm conditions 

For a small proportion of the time, calm, near windless, 
conditions prevail. These occur typically on clear nights 
with frost or heavy dew. 

Conditions that are usually classified as Pasquill cat¬ 
egory F apply in the United Kingdom for some 20% of the 
time. Included in these are the periods of calm. Beattie 
(1963 UKAEA AHSB(S) R64) found that the proportion of 
time for which such conditions apply is about 5-8%. 
Pasquill actually excluded such conditions from his original 
categories because dispersion then tends to be irregular. 

Beattie has classified such conditions as category G, but 
does not give the associated dispersion coefficients. It is 
natural to assume that dispersion is less in G than in F 
conditions. This assumption is made, for example, in NRC 
Regulatory Guide 1.21. However, there is evidence to show 
that under G conditions dispersion is ill-defined. Work on 
such conditions by Sagendorf (1975) has shown that a 
plume is subject to considerable meander, while work by 
van der Hoven (1976) has indicated values of dispersion 
coefficients which correspond to those found across the 
whole range from A to F conditions. 

15.18.2 Dispersion in a uniformly mixed layer 

Another meteorological condition that requires special 
treatment is that of limited mixing fumigation, where there 
is an elevated inversion which acts as a ‘lid’. There is then a 
well mixed layer of height H in which, beyond a certain 
distance, the concentration is uniform. For this condition 
Gifford (1976a) gives the relation 


representation of stability is of more importance than the 
correlation of dispersion coefficients with stability. In some 
cases, there are differences of two or more stability classes 
between the class based on the meteorology and that 
inferred from the observed dispersion coefficients and 
between that inferred from the horizontal dispersion 
coefficient and that inferred from the vertical dispersion 
coefficient. The discussion of dispersion parameters is 
confined initially to those for a plume. Those for a puff are 
considered in Section 15.19.12. 

15.19.1 Fundamental relations 

The relations between the turbulent exchange coefficient 
K, the Sutton diffusion parameter C, the Pasquill para¬ 
meters 6 and h, and the Pasquill-Gifford dispersion coef¬ 
ficient a may be summarized as follows. 

As described above, the condition for the reduction of the 
Sutton model to the A-model is 

n 1 [15.19.1] 

C 2 X = ^ [15.19.2] 

Similar equations apply relating a y to c y , and a z to c z . 

The relation between the Pasquill-Gifford dispersion 
coefficients and the Sutton diffusion parameters is 

a x = \c 2 x {ut) 2 - n [15.19.3] 

Similar equations apply relating a y to C y and a z to C z . 

The relation between the Pasquill-Gifford dispersion 
coefficients and the turbulent exchange coefficients is 

of = 2 K x t [15.19.4] 

Similar equations apply relating o y to K$, and a z to K z . 

The Pasquill parameters are related to the Pasquill- 
Gifford dispersion coefficients as follows: 

a y = gqx [15.19.5] 


X = 


Q 

(2nf/ 2 a x uH, 


[15.18.1] 


6 


where, in this case, H is the height of the ‘lid’, Q is the mass 4.3 

rate of release, u is the wind speed, a y is the crosswind 
dispersion coefficient and x is the concentration. and 


[15.19.6] 


15.19 Passive Dispersion: Dispersion Parameters 

The dispersion models described contain parameters that 
are functions of the meteorological variables and of the 
distance from the source. The Sutton model contains the 
diffusion parameter C, the Pasquill model the parameters 6 
and h, and the Pasquill-Gifford models the dispersion 
coefficient a. The values of, and correlations for, these 
parameters proposed by the authors of the models were 
given in the overall account of these models in Section 15.16. 
There is, in addition, a considerable literature on these 
parameters, especially the Pasquill-Gifford dispersion 
coefficients, ranging from fundamental relations to 
empirical correlations, which is now described. 

In the estimation of dispersion parameters a crucial 
aspect is the definition of the stability condition. It is 
argued by Atwater and Londergan (1985) that the 


[15.19.7] 


The constants 4.3 and 2.15 in Equations 15.19.6 and 
15.19.7 are the values derived from the Gaussian distribu¬ 
tion corresponding to the cloud boundary as defined by 
convention. 

The physical meaning of the dispersion coefficient may 
be interpreted as follows. For diffusion through a vertical 
plane in the x direction, the dispersion variance a\ is the 
second moment of the concentration with respect to 
distance x, normalized with respect to concentration: 


* n/d* 


[15.19.8] 


Similar expressions apply to a y and a z . 
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Following Csanady (1973), consider the one-dimensional 
diffusion of a mass Q’ s of material (kg/m 2 ) initially con¬ 
centrated in a thin sheet at x = 0, in an instantaneous plane 
source. Then the diffusion is given hy the relationship 


0Z_ K &X 
6f *6x 2 
The mass released is 


[15.19.9a] 


QpspJ 00 X&c [15.19.9b] 

and the solution is 


X 2(nK x t ) 1/2 6XP \4K*f) 
Furthermore, it may be shown that 


[15.19.9c] 


q; s 


miy 


[15.19.10] 


Hence from Equations 15.19.8,15.19.9b and 15.19.10 

m = (2 K x t) 1/2 [15.19.11] 

Moving on, if the exponential form of the autocorrelation 
coefficient R(x) given in Equation 15.12.101 is used in 
Taylor’s theorem as given in Equation 15.12.107, the 
solution obtained is 


of = %%% [~ - 1 + exp 01 [15.19.12] 

where t L is the Lagrangian time scale. 

Then for a short time t (t —* 0) 

a x cx t [15.19.13a] 

while for a long time (t — > oo) 

(5 X oc t 1 ' 2 [15.19.13b] 

Since the distance x is proportional to the time t(x= ut), at 


<r* oc x [15.19.14] 

Similar relations apply for cr,, and o z . 

The dispersion coefficients may be related to the 
standard deviations of the wind velocity (cr w oj as 
follows: 

ay = a Y tfi(t/T y ) [15.19.15a] 

o> = a w tf 2 {t/T z ) [15.19.15b] 

where ft and / 2 are universal functions and T y and T z are 
the time scales (s) for lateral and vertical dispersion, 
respectively But 

« a B x [15.19.16a] 

o v t » otpx [15.19.16b] 


Hence from Equations 15.19.15 and 15.19.16 
a y = agxfi(t/T y ) [15.19.17a] 

= ^x/ 2 (f/T 2 ) [15.19.17b] 

The universal functions f\ and / 2 may be derived from 

theoretical considerations or expressed as empirical corre¬ 
lations. Pasquill (1976a) has tabulated values of /i, which 
is taken as independent of stability and source height and as 
a function of distance only. Irwin (1979a) has correlated 
these values as follows: 

f x = (1 4- 0.031x°' 46 ) _1 x < 10 4 [15.19.18a] 

ss 33X -1 / 2 x > 10 4 [15.19.18b] 


Correlations for both and / 2 have been given by Draxler 
(1976). He obtains for f x the relation 


[1 + 0.9(f/Ti)] 1/2 


[15.19.19] 


whereT; is the dispersion time. He states that the function/ 2 
may be assumed equal to/i except for a ground level source 
in unstable conditions and an elevated source in stable 
conditions. For the former case it was difficult to obtain a 
correlation, but for a limited set of data 


, 0.3(t/Ti - 0.4) 2 

/2 = -016- 


+ 0.7 


For the latter case he obtained 


[15.19.20a] 


^ 1 + 0.945(f/ri) a806 


[15.19.20b] 


The dispersion time 7] is the time for ft, or / 2 , to become 
equal to 0.5. Draxler gives the following values for T ; (in 
seconds) 


Source 

Horizontal dispersion 

Vertical dispersion 

height 

Stable 

Unstable 

Stable 

Unstable 

Ground 

level 

300 

300 

50 

100 

Elevated 

1000 

1000 

100 

500 


A further discussion of these universal functions is given 
by Gryning etal. (1987). 

15.19.2 Sutton diffusion parameters 

Sutton’s original values for the diffusion parameters C y and 
C f have been given in Section 15.16. Values have also been 
given by other workers as shown in Table 15.32. 

15.19.3 Pasquill cloud parameters 

Pasquill’s original values for the cloud parameters 6 and h 
have been given in Section 15.16. 

For a long release where wind direction traces are not 
available, Beattie (1963 UKAEA AHSB(S) R64) has sug¬ 
gested the use of the following values for 9: 

d = 0.1 km, 0=30° 
d= 100 km, 0=15° 
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Table 15.32 Sutton diffusion parameters 


A Values given by N.G. Stewart, Gale and Crooks (1958) 

Source height 68 cm 


Downwind distance (m) 

Stability condition 




C z 

150-1000 

Unstable 




0.27 


Neutral 




0.22 


Stable 




0.12 

590-620 

Unstable, neutral 


0.46 



880-1050 

Unstable, neutral 


0.28 



1200 

Unstable, neutral 


0.33 



2400-2800 

Unstable, neutral 


0.26 



6000- 9700 

Unstable, neutral 


0.18 



B Values of Brookhaven National Laboratory (after Slade, 1968) a 

Source height Elevated and ground level sources 

Wind gustiness 

Category 

n 




c z 

B2 

0.15 

0.48 



0.50 

B1 

0.26 

0.44 



0.38 

C 

0.48 

0.54 



0.32 

D 

0.57 

0.41 



<0.08 

C Values of Barad and Fuquay (1962) 

Stability condition 

Wind speed (m/s) 

n 


C y 

C z 

Source height: elevated 

Unstable 


0.20 


0.30 

0.30 


5 



0.26 

0.26 


10 



0.24 

0.24 

Neutral 


0.25 


0.15 

0.15 


5 



0.12 

0.12 


10 



0.11 

0.11 

Source height: ground level 
Unstable 

j 

0.20 


0.35 

0.35 


5 



0.30 

0.30 


10 



0.28 

0.28 

Neutral 

1 

0.25 


0.21 

0.17 


5 



0.15 

0.14 


10 



0.14 

0.13 


D Values of V.J. Clancey (1974a) 


Stability condition n C 


Lapse 0.17 0.2 

Neutral 0.25 0.14 

Inversion 0.35 0.09 


E Values of Long (1963) 


Stability condition 

n 

Cy (m n/2 ) 

C z {m" 12 ) 

Large lapse 

1/5 

0.37 

0.21 

Neutral 

1/4 

0.21 

0.12 

Moderate inversion 

1/3 

0.13 

0.08 

Large inversion 

1/2 

0.11 

0.06 


a A slightly different set of values are given by Gifford (1976b). 
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These values of 9 are based on neutral weather conditions 
with Pasquill stability category D and relatively invariant 
wind direction, but are also applicable to stable weather 
conditions with Pasquill stability category F if the wind 
direction is variable. The values quoted are three times 
greater than those given by Pasquill for a short release in 
stability category F conditions, as shown in Table 15.29. The 
difference may be regarded as allowing for the variability 
of wind direction which tends to apply to this type of 
weather. If, however, the wind direction is invariant, then 
the lower values given in Table 15.29 for stability category F 
should be used. 

15.19.4 Pasquill—Gifford dispersion coefficients 

The dispersion coefficients most often used with the 
Pasquill-Gifford model are probably those of D.B. Turner 
(1970), as given in Section 15.16. There are, however, several 
other sets. 

Correlations of the dispersion coefficients in terms of 
the Brookhaven National Laboratory (BNL) stability 


categories have been given by Singer and Smith (1966) as 
shown in Table 15.33 and in Figure 15.58. 

Correlations have also been given by Carpenter et al. 
(1971) of the Tennessee Valley Authority (TVA) in terms of 
temperature gradient categories as shown in Figure 15.59. 


Table 15.33 Pasquill-Gifford dispersion coefficients: 
BNL formulae (Singer and Smith, 1966) (Courtesy of 
International Journal of Air and Water Pollution) 


BNL gustiness 
class 

Dispersion coefficient (m) 

% 


B2 

0.40* 0 - 91 

0.4hr a91 

B1 

0.36x°' 86 

0.33x°' 86 

C 

0.32x a78 

0.22x°' 78 

D 

0.3Lr on 

0.06# 71 



Figure 15.58 Meteorological parameters for Pasquill-Gifford equations for continuous source: dispersion coefficients 
based on BNL scheme (Gifford, 1976b; after Singer and Smith, 1966) (Courtesy of Nuclear Safety) 











EMISSION AND DISPERSION 15/125 



Figure 15.59 Meteorological parameters for Pasquill- Gifford equations for continuous source: dispersion coefficients 
based on TV A scheme (Gifford, 1976b; after Carpenter et al., 1971 (Courtesy of Nuclear Safety) 


It can be seen from comparison of Figure 15.54 and Figures 
15.58 and 15.59 that the correlations for the dispersion 
coefficients differ. An attempt to resolve these differences 
has been made by G.A. Briggs (1974). His work has been 
summarized by Gifford (1976b). 


The Pasquill-Gifford curves are based on experiments 
on dispersion of non-buoyant gas over flat ground up to a 
downwind distance of 800 m. The BNL curves are for 
dispersion of a non-buoyant plume from an elevated stack 
(108 m) out to a distance of several kilometres with few 
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measurements taken within 800 m. TheTVA curves are for 
dispersion of a buoyant plume with stack heights of 
75-250 m, and with effective stack heights at least twice 
these values, and to a distance of up to some tens of kilo¬ 
metres. The dispersion of this latter type of plume is a 
function more of buoyancy and entrainment effects than of 
atmospheric turbulence. 

Briggs therefore proposed a set of interpolation formulae 
with properties conformable to these three sets of results. 
They would agree with the Pasquill-Gifford curves for 
downwind distances over the range 100-10,000 m except 
that for A and B stability classes and for a z 100, the a z 
curves would be based on the values given by the American 
Society of Mechanical Engineers (ASME) (1968/1), which 
reflect mainly BNL data. The BNL and TVA curves agree 
reasonably well with each other, except at short distances 
where the latter are influenced by buoyancy; they also 
agree reasonably well with the Pasquill-Gifford curves at 
about 10 km, except for the A and B conditions, as just 
described. 

Briggs’ formulae are shown in Table 15.34 and curves 
given by Hosker (1974b) based on these are shown in Figure 
15.60. The formulae are applicable up to 10 km. 

15.19.6 Pasquill-Gifford dispersion coefficients: NRPB 
scheme 

A scheme for the estimation of the Pasquill-Gifford dis¬ 
persion coefficients based on F.B. Smith’s P stability clas¬ 
sification and his correlation of the vertical coefficient a z 
and on allowance for plume meandering for the horizontal 



dispersion a y has been developed at the National Radi¬ 
ological Protection Board (NRPB), as described by Clarke 
(1979 NRPB R91). 

Following F.B. Smith (1973), the vertical dispersion 
coefficient is a function of the distance, the P class and 
the roughness length z a . The value of a z is obtained from 
Figures 15.61-15.63. Figure 15.61 gives a z as a function of 
distance for P= 3.6 and z o = 0.1 m. Figure 15.62 gives the 
correction for other P values at the same value of z„. Figure 
15.63 gives the correction for other values of z a for all P 
values. 


Table 15.34 Pasquill-Gifford dispersion coefficients: 
Briggs interpolation formulae for open country 
(G.A. Briggs, 1974) 


Pasquill 

stability 

Dispersion coefficient (m) 

* 

* 

A 

0.22*(l+0.0001*r 1/2 

0.20* 

B 

0.16*(l+0.0001*r 1/2 

0.12* 

C 

O.II4I +0.0001*) _1/2 

0.08*(l+0.0002*)- 1/2 

D 

0.0841+0.000Lr)“ 1/2 

0.06*(1+ 0.0015*)~ 1/2 

E 

0.06*(l+0.0001*r 1/2 

0.03*(1 +0.003*)- 1 

F 

0.0441 +0.0001*)- 1/2 

0.01641 +0.0003*)- 1 



Figure 15.60 Meteorological parameters for Pasquill- Gifford equations for continuous source: dispersion 
coefficients based on Briggs’ interpolation formulae for open country (Gifford, 1976b; after Hosker, 1974b) (Courtesy 
of Nuclear Safety) 
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Distance downwind from source (km) 

Figure 15.61 Meteorological parameters for Pasquill- Gifford equations for continuous source: dispersion coefficients 
based on NRPB scheme (Clarke, 1979 NRPB R-91): vertical dispersion coefficient n z for stability parameter P= 3.6 
and surface roughness z 0 = 0,1 m 


Formulae for rs z for the discrete Pasquill classes, or P 
values, and for discrete values of z 0 have been given by 
Hosker (1974b). These are 

ax b 

a * = TT^ F{z °’ x) [15 - m21] 

F( 2o ,x) = ln{/^[l+(W) -1 ]} 2„>0.1 [15.19.22a] 

= In [/** (1 + hx j ) _1 ] 2 0 < 0.1 [15.19.22b] 

where F(z a , x) is the roughness length correction factor and 
a-j are constants or indices. Values of the constants and 
indices for use in Equations 15.19.21 and 15.19.22 are given 
in Table 15.35. 

Figure 15.64 shows the values of <s z given by Smith’s 
scheme for roughness length z D = 0.1 m. 

For the horizontal dispersion coefficient a y the regular 
Pasquill-Gifford values, which apply for very short 
releases, typically of 3 min duration, are used for releases of 
up to 30 min duration. For longer releases, account is taken 
of meandering using the relation 


where a yt is the turbulent diffusion (or 3 min) term and a yyl 
is the term due to fluctuations in wind direction. 

The values used for cr yt are the regular Pasquill-Gifford 
values. For a yw two relations are given. If the standard 
deviation of the horizontal wind direction a g is known, use 
is made of the equation 

a ,w = a e x [15.19.24a] 

and if it is not, the equation used is 
7 r JT\ 1/2 

a^ = 0.065 * [15.19.24b] 

where T is the duration of the release (h), x is the downwind 
distance (m), u 10 is the wind speed at 10 m height (m/s) and 
a g is the horizontal standard deviation of the wind direction 
averaged over 3 min periods and sampled over the duration 
of the release (rad). 


15.19.7 Pasquill-Gifford dispersion coefficients: other 
correlations 

Various authors have given for the Pasquill-Gifford coef¬ 
ficients power law formulae of the form 
ay = ax* [15.19.25a] 

a z = cx* [15.19.25b] 


°v = °vt + 


[15.19.23] 
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Figure 15.62 Meteorological parameters for Pasquill- Gifford equations for continuous source: dispersion coefficients 
based on NRPB scheme (Clarke, 1979 NRPB R91): correction factor to vertical dispersion coefficient o z for stability 
parameter P 


Many of the Pasquill-Gifford curves given in Figures 15.54 
and 15.58-15.60 clearly cannot be fitted over their whole 
range by such formulae, but provided they are used over 
the range of their validity such equations have their use in 
making it possible to obtain analytical solutions to disper¬ 
sion problems. 

R.W. McMullen (1975) has given the following formulae 
for both dispersion coefficients: 

cr = exp | a + b lnx + c(ln *) 2 j [15.19.26] 

where a may be either a y or The values of the constants 
a-c are given inThble 15.36. 

15.19.8 Dispersion coefficients for urban areas 

Work on dispersion coefficients for use in the Pasquill- 
Gifford model over and in urban areas has been described 


by a number of workers, including D.B. Turner (1964), 
Bowne, Ball and Anderson (1968), Bowne and Ball (1970) 
and Bowne (1974), McElroy and Pooler (1968), McElroy 
(1969) and Yersel, Goble and Morrill (1983). In general, 
dispersion over or within an urban area is greater than over 
a flat rural area. Mechanical turbulence is enhanced by the 
increase surface roughness and thermal turbulence by the 
heat island effect. 

Summaries of experimental work on dispersion over 
urban areas have been given by Gifford (1972, 1976a,b). 
The experimental work of McElroy and Pooler (1968) over 
St Louis has provided dispersion data. These data have 
been used by Pasquill (1970) to compare dispersion over 
urban and rural terrains. Further data have been analysed 
by W.B. Johnson et al. (1971). On the basis of this work, 
G.A. Briggs (1974) has proposed relations for the disper¬ 
sion coefficients. Table 15.37 gives information on the 
vertical dispersion coefficient <s z and Table 15.38 gives 
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Figure 15.63 Meteorological parameters for Pasquill- Gifford equations for continuous source: dispersion coefficients 
based on NRPB scheme (Clarke, 1979 NRPB R91): correction factor to vertical dispersion coefficient n z for surface 
roughness z 0 


the Briggs’ formulae for both the horizontal and the 
vertical dispersion coefficients u y and o z . Figure 15.65 
shows graphs obtained by Hosker from Briggs’ equations. 

Experimental work on dispersion over short distances 
within an urban area at Worcester, Massachusetts, has 
been conducted by Yersel, Goble and Morrill (1983). They 
carried out releases in a parking lot, with the nearest 
building 40 m away, and measured the concentration at 
distances up to 600 m. Their results for o y and u z are 
shown in Figure 15.66. For <j y the values for stability class B 
are well described by the regular Pasquill-Gifford curves 
for class A, a shift of one class, while for classes C and D the 
values are best described by a shift of two classes. For o z , 
however, the data differ significantly in magnitude and 
slope and around 200 m are substantially higher than even 
the class Acurve. 


15.19.9 Dispersion coefficients for coastal areas 
and water 

A number of authors have described work on dispersion 
coefficients for the Pasquill-Gifford model for coastal 
areas and water, including Kondo (1975), Gifford (1976a,b), 
Lyons (1976), S.R. Hanna, Paine and Schulman (1984), 
Hasse and Weber (1985), Larsen and Gryning (1986) and 
Skupniewicz and Schacher (1986). In general, dispersion 
over water tends to be less than over land but, as described 
above, this generalization needs heavy qualification. 

The surface roughness of the seamay be characterized by a 
roughness length, hut waves do not behave as simple rough- 
nesselements.ThisproblemisdiscussedbyGifford(1976a,b). 

In order to use the Pasquill-Gifford model it is nec¬ 
essary to define the stability classes. The Pasquill 
classes over land are not necessarily applicable without 
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Table 15.35 Pasquill- Gifford dispersion coefficients: Hester’s formulae (Hosker, 1974b) (Courtesy of International 
Atomic Energy Agency) 

A Vertical dispersion coefficient 

Stability class 

a 

b 

c 

d 

A 

0.112 

1.06 

5.38 x 10 -4 

0.815 

B 

0.130 

0.950 

6.52 x 10- 4 

0.750 

C 

0.112 

0.920 

9.05 x 10” 4 

0.718 

D 

0.098 

0.889 

1.35 x 10“ 3 

0.688 

E 

0.0609 

0.895 

1.96 x 10“ 3 

0.684 

F 

0.0638 

0.783 

1.36 x 10“ 3 

0.672 

B Roughness length correction factor 

Roughness 

/ 

g 

h 

i 

length (m) 





0.01 

1.56 

0.0480 

6.25 x 10“ 4 

0.45 

0.04 

2.02 

0.0269 

7.76 x 10“ 4 

0.37 

0.1 

2.72 

0 

0 

0 

0.4 

5.16 

-0.098 

18.6 

-0.225 

1.0 

7.37 

-0.0957 

4.29 x 10 3 

-0.60 

4.0 

11.7 

-0.128 

4.59 x 10 4 

-0.78 


modification over sea. The definition of suitable classes for 
use over sea was discussed in Section 15.12. 

Empirical correlations for the Pasquill-Gifford disper¬ 
sion coefficients for use over water have been given by 
Skupniewicz and Schacher (1986) in terms of the NFS sta¬ 
bility classification. The relations are 

'%= %(*)(!)“ [15.19.27a] 

*-*<*)©' [15.19.27b] 

where o y (R) and a z (R) are the values of a y and a z at the 
reference distance R (= 100 m), and a and /? are indices. 
Values of o y and a z at 100 m and of the indices a and /? are 
given in Table 15.39. 

These equations are empirical correlations. The data for 
o y exhibit considerable scatter. The authors state that sta¬ 
bility classification can reasonably be used to characterize 
a z but not a y . 

An alternative treatment for the estimation of dispersion 
coefficients for use over water based on the AMS Workshop 
scheme has been given by S.R. Hanna, Paine and Schulman 
(1984). 

15.19.10 Dispersion coefficients for complex terrain 

Dispersion coefficients for complex terrain are discussed 
by Egan (1976). In general, dispersion over complex terrain 
tends to give complex dispersion patterns. The overall 
effect is generally to increase dispersion, but, as described 
below, there are two features that may lead to local high 
concentrations. 

There tends to be enhancement of both the dispersion 
coefficients, but the crosswind dispersion coefficient <s y is 
enhanced more than is the vertical dispersion coefficient 
a z . This is often attributed mainly to plume meandering 
and splitting. For a ground level source the implication is 


that the ground level centre line concentration will be less 
than for flat terrain. 

For an elevated source the situation is not quite so 
straightforward. The Pasquill-Gifford Equation 15.16.55 
for the maximum ground level concentration for a release 
from an elevated continuous point source shows that, if 
there is an increase in the ratio <r z /oy, this maximum con¬ 
centration increases. Therefore, in principle, if <r z increases 
and there is no compensating increase in oy, there will bean 
increase in the maximum ground level concentration and a 
decrease in the distance at which this occurs. The other 
feature that can give rise to a high local concentration is a 
stagnant pocket. 


15.19.11 Effect of sampling period 

As described above, if the concentration in a plume is 
sampled virtually instantaneously, the concentration dis¬ 
tribution has a relatively narrow spread, while if the sam¬ 
ple is taken over a longer time period the distribution has a 
wider spread. It follows that the dispersion coefficients are 
a function of the sampling period. The following relation 
has been proposed by Gifford (1976a) to take account of this 
variation: 



where t is the sampling period which yields dispersion 
coefficient a y , p is an index, and subscript r denotes the 
reference value. The value of p is approximately 0.2 for 
sampling periods between 3 min and 1 h and in the range 
0.25-0.3 for periods between 1 and 100 h. 

Gifford states that similar considerations apply to o z , 
except that the effect of variations in a z should not extend 
beyond downwind distances of a few kilometres. 

The regular Pasquill-Gifford curves correspond to a 
sampling period of about 10 min. 
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Distance (m) 

Figure 15.64 Meteorological parameters for Pasquill- Gifford equations for continuous source: dispersion coefficients 
based on NRPB scheme (Clarke, 1979 NRPB R91): vertical dispersion coefficient a z as a function of stability 


Table 15.36 Pasquill-Gifford dispersion coefficients: McMullen’s formulae (R.W. McMullen, 1975) 
(Courtesy of Air Pollution Control Association) 


Pasquill stability Formulae parameters 

class - 


b 


A 

B 

C 

D 

E 

F 


5.357 0.8828 

5.058 0.9024 

4.651 0.9181 

4.230 0.9222 

3.922 0.9222 

3.533 0.9181 


-0.0076 6.035 

-0.0096 4.694 

-0.0076 4.110 

-0.0087 3.414 

-0.0064 3.057 

-0.0070 2.621 


2.1097 0.2270 

1.0629 0.0136 

0.9201 -0.0020 

0.7370 -0.0316 

0.6794 -0.0450 

0.6564 -0.0540 
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Table 15.37 Pasquill- Gifford dispersion coefficients for urban areas: comparison of vertical dispersion coefficient for 
rural and urban terrain (after Gifford, 1976b) a (Courtesy of Nuclear Safety) 


Downwind distance Terrain Ratio of a z for following stability 

(km) classes to value in neutral conditions 




B 

C 

D 

E-F 

1 

City b 

4.5 

2.7 

1.7 

0.7 


City c 

4.0 

2.4 

1.5 

0.6 


Open country 

3.2 

1.9 

1.0 

0.5 

10 

City* 5 

9 

3.4 

1.0 

0.3 


City c 

11 

4.1 

1.2 

0.4 


Open country 

6 

2.4 

1.0 

0.3 


a Based on work of McElroy and Pooler (1968) at St. Louis and analysis by Pasquill (1970). 
b Based on McElroy and Pooler’s figure 2 using curve for bulk Richardson number B = ± 0.01. 
c Using data for B = ± 0.01 in evening conditions only. 


Table 15.38 Pasquill- Gifford dispersion coefficients 
for urban areas: Briggs interpolation formulae (after 
G.A. Briggs, 1974) 


Pasquill 

stability 

class 

Dispersion coefficient (m) 

% 

<r 2 

A-B 

0.32x(l +0.0004*r 1/2 

0.24x(l + 0.001x)“ 1/2 

C 

0.22x(l +0.0004x)“ 1/2 

0.20x 

D 

0.16x(l+0.0004x)“ 1/2 

0.14x(l+0.0003x)- 1/2 

E-F 

0.Ux(l+0.0004x)- 1/2 

0.08x(l+ 0.0015x)“ 1/2 


15.19.12 Puff dispersion coefficients 

For a puff, the size of eddy that mainly influences disper¬ 
sion lies within a limited range, approximately 1/3 to 3 times 
the size of the puff. A smaller eddy effects little dispersion, 
while a larger one moves the whole cloud. 

Relations for a puff dispersion coefficient cr have been 
derived by Batchelor (1952) from similarity considerations. 
It can be shown that 

(t 2 = + ci(eo- 0 ) 2 ' ,3 f Z short times [15.19.29a] 

t= C2d? intermediate times [15.19.29b] 

= c 3 t long times [15.19.29c] 




Figure 15.65 Meteorological parameters for Pasquill-Gifford equations for continuous source: dispersion coefficients 
based on Briggs’ interpolation formulae for urban areas (Gifford, 1976b; after Hosker, 1974b) (Courtesy of Nuclear Safety) 
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Figure 15.66 Meteorological parameters for Pasquill- Gifford equations for continuous source: dispersion coefficients 
for urban areas (Yersel, Goble and Morill, 1983) (Courtesy of Pergamon Press) 


Table 15.39 Pasquill- Gifford dispersion coefficients over water: empirical formulae (after Skupniewicz and Schacher, 
1986) (Courtesy of Pergamon Press) 


NPS class 

Dispersion coefficient (100 m) 



Indices 



r y 





P 


Water 

Land 

Water 

Land 

Water 

Land 

Water 

Land 

B 

25.0 

19.0 

10.0 

11.0 

0.75 b 

1.00 

0.75 b 

1.00 

C 

20.0 

12.5 

8.0 

7.5 

0.70 b 

1.00 

0.70 b 

0.90 

D 

15.1 

8.0 

3.2 

4.5 

0.69 

0.90 

0.65 

0.85 

E 

16.1 

6.0 

1.8 

3.5 

0.65 

0.80 

0.62 

0.80 


a Over land values are those given by DTIC (1980). 
b Insufficient data for verification. 


where e is the eddy dissipation rate, cr 0 is the initial size of 
the cloud, and cy c 2 and c 3 are constants. 

The constant c 2 is generally found to lie in the range 
0.5-2 and is often taken as unity. 

Then, from Equation 15.19.29, 

a oc t short times [15.19.30] 

oc f 3 / 2 intermediate times [15.19.30b] 

oc fl 2 long times [15.19.30c] 

Also at long times 

Opuff^plume ^0 [15.19.31] 

Here short times may be interpreted as a few seconds and 
long times as greater than 10 4 s. Generally it is the inter¬ 
mediate times that are of most interest. The number of data 
sets available on which to base estimates of the puff dis¬ 
persion is very much less than for plume dispersion. 
Work on puff dispersion coefficients has been described by 
Islitzer and Slade (1968), who give the (cr y and a z values 
shown in Table 15.31. 


A somewhat different variation of the puff dispersion 
coefficients with distance, or time, is suggested by the work 
of Gifford (1977). One of his plots showing experimental data 
on the relation between a y and t is given in Figure 15.67. For 
times up to about 10 4 s the data give a reasonably good fit to 
relation 15.19.30b for intermediate times. 

A method of estimating the dispersion coefficients based 
on Equation 15.19.29 has been given by S.R. Hanna, Briggs 
and Hosker (1982). For a y , Equation 15.19.29b is used up to 
a travel time of 10 4 s, the eddy dissipation rate e being 
initially determined locally and then, as a y approaches 
0.3z,-where z,- is the mixed layer height, at a height midway 
in the boundary layer. At a travel time equal to 10 4 s, the 
constant c 3 in Equation 15.19.29c is evaluated by equating 
the values of a y obtained from Equations 15.19.29b and 
15.19.29c, and thereafter Equation 15.19.29c is used with 
this value of c 3 . For a z , a similar procedure is used, except 
that once a z attains a value of 0.3z,- that value is used for all 
times thereafter. 

15.19.13 Turbulent exchange coefficients 

The foregoing account of dispersion parameters has con¬ 
centrated mainly on those for the Pasquill-Gifford model. 
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3 Seneca (1955) 
a Smith and Hay (1961) 
+ Hogstrom (1964) 


Figure 15.67 Meteorological parameters for Pasquill- Gifford equations for instantaneous source: dispersion coefficient 
a (Gifford, 1977): (a) selection of original data of Crawford (1966); (b) collection of subsequent data by Gifford. The 
references quoted are those given by Gifford and do not all appear in this text 


The turbulent exchange coefficients K used in ff-theory 
models have been discussed in Section 15.12. Accounts of 
A-theory models commonly include a discussion of the 
estimation of the Avalues used in the models. 

15.20 Dispersion of Jets and Plumes 

The dispersion of material issuing as a leak from a plant is 
determined by its momentum and buoyancy. If momentum 
forces predominate, the fluid forms a jet, while if buoyancy 
forces predominate, it forms a plume. Such dispersion 
contrasts with the dispersion by atmospheric turbulence 
considered so far. However, once the momentum or buoy¬ 
ancy decay dispersion by atmospheric turbulence becomes 
the predominant factor for leaks also. 

Emission situations were classified in Section 15.1. In 
respect of jets and plumes the following distinctions may be 
made: 

(1) Fluid 

(a) gas, 

(b) liquid, 

(c) two-phase vapour-liquid mixture; 


(2) Fluid momentum 

(a) low momentum, 

(b) high momentum; 

(3) Fluid buoyancy 

(a) positive buoyancy, 

(b) neutral buoyancy, 

(c) negative buoyancy; 

(4) Atmospheric conditions 

(a) low turbulence, 

(b) high turbulence. 

If the momentum of the material issuing from an orifice on 
a plant is high, the dispersion in the initial phase at least is 
due to the momentum, and the emission is described as a 
momentum jet. If the momentum is low, either because the 
initial momentum is low or because it has decayed, the 
dispersion is due to buoyancy and atmospheric turbulence, 
and, if buoyancy is involved, the emission is described as a 
buoyant plume: the buoyancy may be positive or negative. 

An account is now given of dispersion by momentum jets 
and buoyant plumes. Both types of emission are sometimes 
described as plumes, the jet being a forced plume. The 
forces in a buoyant plume are often of the same order as 
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those in a momentum jet. Selected references on jets and 
plumes are given in Table 15.40. Some jet and plume dis¬ 
persion situations are illustrated in Figure 15.68. The figure 
shows schematically instances of releases issuing as jets 
and becoming plumes as the influence of buoyancy takes 
over from that of momentum. 


Table 15.40 Selected references on jets and plumes 
(See also Table 15.42 for dense gas) 


Turbulent momentum jets, buoyant plumes, plumes 
dispersed by wind 

Abraham (n.d., 1970); Albertson etol. (1948,1950); O.G. 
Sutton (1950); J.F. Taylor, Grimmett and Comings (1951); Yih 
(1951); Gosline (1952); Nottage, Slaby and Gojsza (1952); 
Rouse, Yih and Humphreys (1952); Tuve (1953); Priestley 
and Ball (1955); B.R. Morton,Taylor andThrner (1956); 
W.R. Warren (1957); B.R. Morton (1959,1961,1965); Ricou 
and Spalding (1961); Abramovich (1963,1969); Keffer and 
Baines (1963); Long (1963); Kleinstein (1964); 

R.A.M. Wilson and Danckwerts (1964); Becker, Hottel and 
Williams (1965,1967); Heskestad (1965,1966); Schmidt 
(1965); J.S. Turner (1966,1973); Baines and Turner (1969); 
Spalding (1971); Ballal and Lefebvre (1973); Gugan (1976); 
Rajaratnam (1976); Sadee, Samuels and O’Brien (1976-77); 
J.G.Marshall (1977); Birch etal. (1978); Meroney (1979a); 
TNO (1979); Birch, Brown and Dodson (1980); C.J. Chen and 
Rodi (1980); Delichatsios (1980,1988); Gartner, Giesbrecht 
and Leuckel (1980); R.M. Harrison and McCartney (1980); 
Lehrer (1981); Anfossi (1982); Davidson and Slawson 
(1982); de Faveri, Hanzevack and Delaney (1982); Fumarola 
etal. (1982); Golay (1982); Hanzevack (1982); List (1982); 
O’Shea (1982); Rittman (1982); Rodi (1982); Whaley and Lee 
(1982); Barr et al. (1983); Epstein et al. (1983); Giesbrecht, 
Seifert and Leuckel (1983); Kerman (1983); Willis and 
Deardorff (1983,1987); Khalil (1983); Badr (1984); Baines 
and Hopflnger (1984); Brennan, Brown and Dodson (1984); 
Leahy and Davies (1984); D.B. Turner (1985); Hsu-Cherng 
Chiang and Sill (1986); Hwang and Chaing (1986); 
Overcamp and Ku (1986); Pierce (1986); Birch, Hughes and 
Swaffleld (1987); Krishnamurty and Hall (1987); Pfenning, 
Millsap and Johnson (1987);Technica (1987); P.A. Clark and 
Cocks (1988); Fairweather, Jones and Marquis (1988); 
Haroutunian and Launder (1988); Shaver and Fornery 
(1988); Subramanian etal. (1988); Birch and Brown (1989); 
Birch and Hargrave (1989); Emerson (1989); G.K Lee (1989); 
Loing and Yip (1989); Vergison, van Diest and Easier 
(1989); J.L. Woodward (1989a); Arya and Lape (1990); 
Cleaver and Edwards (1990); M. Epstein, Fauske and 
Hauser (1990); Moodie and Ewan (1990); Nettervffle (1990); 
Anfosssi etal. (1993); Bagster (1993); Lane-Serff, Linden 
and Hillel (1993); Webber and Wren (1993 SRD R552); 
Landis, Linney and Hanley (1994). 

Sonic jets: Hess, Leuckel and Stoeckl (1973); Ramskill (1985 
SRD R302); Ewan and Moodie (1986) 


Elevated plumes, stacks, chimneys 

Bosanquet (1935,1957); Bosanquet and Pearson (1936); 
Church (1949); Barad (1951); Gosline (1952); N.G. Stewart 
etal. (1954); Strom and Halitsky (1955); F.B. Smith (1956); 
O.G. Sutton (1956); Best (1957); Hay and Pasquill (1957); 
Hilst (1957); Strom, Hackman and Kaplin (1957); 


N.G. Stewart, Gale and Crooks (1958); Strauss and 
Woodhouse (1958); Nonhehel (1960); Bodurtha (1961,1988); 
Bowne (1961); Scorer and Barrett (1962); Briggs (1965, 
1968,1969,1974,1976); D.J. Moore (1969,1975); Slawson and 
Csanady (1971); Ooms (1972); Cude (1974a,b, 1975); Hoot 
and Meroney (1974); Ooms, Mahieu and Zelis (1974); 
Readings, Haugen and Kaimal (1974); Bowne, Cha and 
Murray (1978); Lamb (1979); Venkatram and Kurtz (1979); 
Venkatram (1980a,c); P.M. Foster (1981); Nonhehel (1981); 
Kerman (1981,1982); Reible, Shair and Kauper (1981); 
Venkatram and Vet (1981); Fumarola etal. (1982); Londergan 
and Borenstein (1983); Robson (1983); R.F. Griffiths 
(1984a); Carras and Williams (1984); Deardorff and Willis 
(1984); Leahey and Davies (1984); Manins (1984); Ooms and 
Duijm (1984); Venkatram, Strimaitis and Dicristoforo 
(1984); Venkatram and Paine (1985); Li Xiao-Yun, Leijdens 
and Ooms (1986); Paine, Insley and Eberhard (1986); 

R.L. Petersen (1986); Pierce (1986); Rowe and Tas (1986); 
Weil, Corio and Brower (1986); Willis (1986); S.R. Hanna 
and Paine (1987); Havens, Spicer and Layland (1987); 

J.L. Woodward (1989a) 


Liquid jets 

Holly and Grace (1921); Rayleigh (1932); Lewitt (1952); 
Brodkey (1967); Bushnell and Gooderum (1968); Benatt 
and Eisenklam (1969); van de Sande and Smith (1976); 
Suzuki etal. (1978); Engh and Larsen (1979); Blanken 
(1990);Tilton and Farley (1990) 


Flash-off (see Table 15.7) 

Two-phase jets 

R. Brown and York (1962); Bushnell and Gooderum (1968); 
Hetsroni and Sokolov (1971); Gyarmathy (1976); Suzuki etal. 
(1978); Melville and Bray (1979a,b); Koestel, Gido and 
Lamkin (1980);Tomasko,Weigand and Thompson 
(1981a,b); M. Epstein etal. (1983); Appleton (1984 SRD 
R303); Kitamura, Morimatsu and Takahashi (1986); 
Wheatley (1986,1987 SRD R410); Fauske and Epstein 
(1988); Tarn and Cowley (1989); M. Epstein, Fauske and 
Hauser (1990); Hague and Pepe (1990); Webber (1990); 
Webber and Kukkonen (1990); J.L.Woodward (1990,1993); 
D.W Johnson and Diener (1991); Papadourakis, Caram and 
Earner (1991); Webber et al. (1992 SRD R584, R585); J. Cook 
and Woodward (1993b); DunbarefeZ. (1994) 


15.20.1 Jets 

Accounts of jets are given in The Theory of Turbulent Jets 
(Abramovich, 1963), Turbulent Jets of Air, Plasma and Real 
Gas (Abramovich, 1969), Turbulent Jets (Rajaratnam, 1976), 
Vertical Turbulent Buoyant Jets (C.J. Chen and Rodi, 1980) 
and Turbulent Buoyant Jets and Plumes (Rodi, 1982). Work on 
jets includes that by Albertson et al. (1948), O.G. Sutton 
(1950), J.F. Taylor, Grimmett and Comings (1951), Nottage, 
Slaby and Gojsza (1952), Tuve (1953), B.R. Morton, Taylor 
and Turner (1956), B.R. Morton (1959, 1961), Ricou and 
Spalding (1961), Long (1963), Kleinstein (1964), Heskestad 
(1965, 1966), J.S. Turner (1966), Spalding (1971), Hess, 
Leuckel and Stoeckl (1973), Birch et al. (1984); Ramskill 
(1985 SRD R302), Ewan and Moodie (1986), Birch, Hughes 
and Swaffold (1987), Birch and Brown (1989) and Birch etal. 
(1989). 
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Wind Neutral Positive Negative 

buoyancy buoyancy buoyancy 


Figure 15.68 Some jet and plume dispersion situations (after TNO, 1979): (a) upwards vertical release, zero wind 
speed; (b) upwards vertical release, finite wind speed; (c) downwards vertical release, zero wind speed; (d) upwards 
vertical release, finite wind speed; (e) horizontal release, zero wind speed; (f) horizontal release, wind speed in direction of 
release; and (g) horizontal release, wind speed in direction opposed to release 


15.20.2 Gas jets 

The behaviour of a circular, or conical, turbulent momen¬ 
tum gas jet has been studied by Ricou and Spalding (1961), 
Long (1963) and Cude (1974b). 

Long summarizes the empirical features of such a jet. 
The characteristics that he enumerates include the follow¬ 
ing. The jet is conical and apparently diverges from a 
virtual point source upstream of the orifice; dilution 
occurs by turbulent mixing; the time-mean velocity and 


time-concentration profiles are similar after 10 
diameters and are approximately Gaussian; the con¬ 
centration profile is wider than the velocity profile; the jet 
entrains air, but conserves its momentum, so that 
the momentum flux at any plane normal to the axis is 
constant. 

Models of a momentum jet have been given by Ricou and 
Spalding, Long and Cude. The following treatment is based 
on these models, particularly that of Long. A momentum 
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If a Gaussian radial concentration profile is assumed, 
Equation 15.20.7 maybe rewritten as 

t'KD"fef“’[-(¥)] |15M1 

where k 2 and k 3 are constants. 

From the work of a number of experimenters Long pro¬ 
poses for constants k 2 and k 3 values of 6 and 5, respectively. 
The density rj xo is not readily calculated, but it is frequently 
set equal to the density of air (e.g. Cude, 1974b).The point is 
discussed by Gugan (1976). 

The length of the jet may be obtained by combining 
Equations 15.20.3 and 15.20.4 to give 


jet is shown schematically in Figure 15.69. For such a jetthe 
mass discharge flow is 


* = u °(p*X 

do h u x \pj 


[15.20.9] 


m 0 = ^ dlp 0 u 0 
the mass balance is 


[15.20.1] The end of the jet is usually defined (e.g. Cude, 1974b) as the 

point at which the jet velocity u x equals the wind speed w. 
Then 


m x = 7 ^(2xtanf))2p x u 
and the momentum balance is 


[15.20.2] , tr= , / p x-V 2 

d 0 hw \pj 


[15.20.10] 


[15.20.3] 


where d 0 is the diameter of the outlet, m is the mass flow, u 
is the velocity of the gas, x is the axial distance from the 
outlet, f) is the half-angle of the jet, p is the density of the 
gas and subscripts o and x denote the orifice and the mean 
value axial distance x, respectively. Then from Equations 
15.20.1-15.20.3 the mass flow ratio is 


m 0 d 0 \pj 


[15.20.4] 


where x tT is the length of the jet at the transition point and w 
is the wind speed. For the purpose of determining this 
transition in relatively still air, the wind speed is generally 
taken as2m/s. 

As already mentioned, the axial gas concentration c xo is 
found to be twice the mean gas concentration c x : 

Cxo = 2 c x [15.20.11] 

The minimum discharge velocity of the jet to obtain a 
safe value c s of the concentration c xo may be obtained 
by combining Equations 15.20.7, 15.20.9 and 15.20.11 and 
so that 


h = 2tanj3 [15.20.5] 

In modelling a gas jet, it is necessary to distinguish for 
velocity u at distance x between the mean value (u x ), the 
value on the axis («„) and the value at radial distance r 
(« xr ). A similar notation is used for concentration c and 
density t / From Equation 15.20.4 the velocity ratio is 

t-mw 

The mean volumetric concentration is inversely propor¬ 
tional to the volumetric flow of the gas-air mixture and 
hence 


H (f)"feF [I5 - 20 - 71 

where c is the volumetric concentration. Long proposes for 
the constant ki the value of 0.32 obtained by Ricou and 
Spalding. 


15.20.12] 


The behaviour of the momentum jet was studied experi¬ 
mentally by Ricou and Spalding (1961). In addition to air, 
they also used hydrogen, propane and carbon dioxide. As 
already mentioned, they obtained for the constant k 3 the 
value of 0.32. They verified Equation 15.20.4 up to 418 dia¬ 
meters. These authors also discuss the ratio of the widths of 
the concentration and velocity profiles and make the 
assumption that this has a value of 1.17. 

In their theoretical analysis they point out that another 
feature of the momentum jet is that at high Reynolds num¬ 
ber and uniform fluid density and at a distance along the 
axis that is large compared with the outlet diameter the 
mass flow m of entrained air is proportional to the axial 
distance x. They give the relations 


^ = k{Mp a ) 1/2 [15.20.13a] 

- = k(Mp a ) 1/2 [15.20.13b] 
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M = M 0 = * d 2 0 p 0 u 2 0 [15.20.14] 

where Mis momentum flux and k is a constant. They give 
for k a value of 0.282. 

For work on jets, Mecklenburgh (1985) introduces the air/ 
fuel mass ratio 9. For this ratio 


Hess, Leuckel and Stoeckl (1973) have given relations for 
both subsonic and sonic gas jets. For the subsonic flow the 
condition is 


Pv /y + lYW^ 

r(V) 

At the exit plane after isentropic expansion 


[15.20.24] 


[15.20.15J 


[15.20.16] 


A set of equations for velocity ratio u m /u 0 and the 
concentration ratio c TO /c D for circular and planar jets has 
been given by C.J. Chen and Rodi (1980). These are, for a 
circular jet 





[15.20.25] 

[15.20.26] 

[15.20.27] 

[15.20.28] 


S-KsRsF |,5 - 2o - , i 

I- 6 © 'feT |i5 - 2oisi 

and for a planar jet 

5- 2 ' 4 ©" ,,2 (sr |i5 ' 2 ° 191 

|I5 - 20 - 201 


where d is the width of the slot and the subscript cl denotes 
the centre line. 

A set of equations for the velocity ratio u m /u 0 only for 
circular, planar and radial jets for air has been given by 
Rajaratnam (1976). These are, for a circular jet 

for a planar jet 

S-Kfi " 1 I 15 - 20 - 22 ! 

and for a radial jet 

|I5 - 20 - 231 

where b a is the half-width of the slot (for a planar or radial 
jet), r is the radial distance, r p is the radius of the pipe or 
flange in which the outlet exists and the subscript m denotes 
the centre line, and hence the maximum. 


where P is the absolute pressure, R is the universal gas con¬ 
stant, T is the absolute temperature, y is the ratio of the gas 
specific heats, and subscripts a, E and v denote atmospheric 
conditions, exit conditions and vessel conditions, respectively. 

Some illustrative calculations on momentum jets have 
heengivenby Cude (1974b), Gugan (1976) and Mecklenburgh 
(1985). 

15.20.3 Gas jets: sonic jets 

The models just given apply to a gas jet with subsonic flow. 
A different treatment is necessary for sonic flow condi¬ 
tions. Models for underexpanded sonic jets have been 
reviewed by Ramskill (1985 SRD R302).The structure of an 
underexpanded sonic jet is shown in Figure 15.70. 

As already mentioned, Hess, Leuckel and Stoeckl (1973) 
have also given a treatment for circular jets with sonic flow. 
For sonic flow the condition is 

~> (^ r )^ 715 [15 - 2a29] 


FLOW 



Figure 15.70 Underexpanded momentum jet (Ewan and 
Moodie, 1986). M, Mach number (Reproduced by permis¬ 
sion of Gordon and Breach Science Publishers, ©) 
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At the exit plane, after isentropic expansion P E 
the conditions are: 

> P a , and 

/ 0 v/b-O 



[15.20.30] 


[15.20.31] 

/ 0 \y/fr-0 



[15.20.32] 


[15.20.33] 


x' is the distance between the virtual source and the outlet, 
y is the radial distance, fa and b 2 are constants, fa is defined 
hy Equation 15.20.40 and subscript m denotes the centre 
line, and hence maximum, and subscript xy denotes point 
{x, y). 

The following relations are given for the constants fa 
and b 2 

fa = 50.5 + 48.2p^ a - 9.95(pg a ) 2 [15.20.42] 


b 2 = 23 + 41 p’ ga [15.20.43] 


At the shock plane downstream of the exit, Hess, Leuckel where Pg a is the normalized density of the gas at atmos- 
and Stoeckl define an equivalent diameter: pheric conditions. 

The equivalent diameter <4 q is defined as 


D s = 


2M s 

(7 z Ps M s u s ) 1/2 


[15.20.34] 


where D is the diameter, M is the mass flow and subscript 
s denotes the shock plane. 

It has been shown by Ramskill that the equivalent dia¬ 
meter may also be expressed as 


D s =Dn 



[15.20.35] 


where subscript N denotes the nozzle. 

The term‘equivalent diameter’ is generally used in work 
on underexpanded jets and is used here also. It should not 
be confused with the equivalent diameter used to relate 
non-circular to circular orifices and ducts. 

For the velocity at this plane it is assumed that all the 
excess pressure goes to increase the momentum of the jet: 

u s = UE + PE ~ Pa [15.20.36] 

Pe«e 


Pe“e£§ 

uj)l 


[15.20.37] 



[15.20.44] 


where p go is the normalized density of the gas at the outlet 
and Po e q is the normalized density of the gas at the equiva¬ 
lent diameter. The velocity ratio is 


Um 

U 0 




[15.20.45] 


and the concentration ratio is 


U (fa + fa)/fa 

To 0.32 (x/d^Q/Jp'^) +1 - |J 


[15.20.46] 


Ewan and Moodie (1986) have given a treatment of under¬ 
expanded sonic jets based on the work of Kleinstein (1964). 
For fully expanded supersonic jets Kleinstein obtained the 
relation 


Another model based on the apparent diameter is that 
given in theTNO Yellow Book (1979). The equations of this 
model are as follows. In the model use is made of gas den¬ 
sities normalized with respect to the density of air, these 
densities being denoted by a prime. The radial velocity and 
concentration are expressed as 

^ = exp(-6i^) [15.20.38] 

ia = exp(-J 2 />f) [15.20.39] 


[k(f>JPe) y2 (z/rn) -x c \ 


[15.20.47]: 


where k is a compressible eddy coefficient, r n is the 
equivalent radius, u is the velocity of the gas, x c is a 
dimensionless core length, 2 is the distance along the axis 
from the outlet and subscripts e, m and n denote the exit, 
the maximum and the nozzle, respectively. 

They also quote the following equation given by Warren 
(1957) and based on a different analysis for the radial vari¬ 
ation of velocity in fully developed flow 


fa =y/x!' 
x/' = x + x! 


[15.20.40] 

[15.20.41] 


i- exp {‘ ,n Ki)1} 


[15.20.48] 


where; is the volumetric concentration of the gas, u is the where r 0 5 is the radius at which the velocity is half the cen- 
velocity of the gas, x is the axial distance from the outlet, tre line value. 
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Ewan and Moodie have adapted the Kleinstein model to 
an underexpanded jet by introducing the equivalent dia¬ 
meter. For the expansion 


If 

-<ir 


[15.20.49] 

[15.20.50] 

[15.20.51] 

[15.20.52] 


7^ = 1 ~ exp I - 


1 


iKpJPea) 7 - 


k= 0.08(1 -0.16Ma) 
2*= Z -2 Zb 

2b -0.77 dn + 0.068 d™ 5 N 


[15.20.54] 

[15.20.55] 

[15.20.56] 


= Pu^ 
~ RT. 


Pu 


/J \ 1/2 

\RTJ 


(yi?r) 1/5 

-«*o% 

Then from Equation 15.20.57 
P e U n _A m _P e 
PeqMeq ~ A e ~ P a 
Hence 

/PeV 72 


[15.20.58a] 

[15.20.58b] 


= 1 - ex| bt- ^ - [15.20.62] 


where N is the ratio of the vessel pressure to atmospheric 
pressure and subscripts eq and v denote equivalent and 
vessel, respectively. Equivalent conditions are based on the 
sonic jet at ambient pressure, nozzle exit temperature and 
nozzle mass flow. They obtain for the velocity ratio 


15.20.4 Liquid jets 

It is also necessary to consider liquid jets. The ‘throw’ of 
a liquid jet can be quite large. Such a jet may reach beyond 
the limit of the area classification zone or may jump over 
a bund. 

The simplest treatment of a liquid jet is based on the 
assumption that the jet suffers no drag and does not disin¬ 
tegrate. For a jet at ground level, as shown in Figure 15.71(a) 
the motion in the horizontal direction is given by 

g=«cosa [15.20.63] 


where t is time, u is the horizontal velocity of the liquid, x is 
the horizontal distance and a is the angle between the jet 
and the horizontal. At t = 0, x = 0 and hence 

x = ut cos a [15.20.64] 

For motion in the vertical direction 


where d is the diameter, Ma is the Mach number, 2 b , is the 
barrel length and 2* is the modified axial distance.The unit 
of length in Equations 15.20.55 and 15.20.56 is millimetres. 

The equivalent diameter d eq is derived as follows. For 
continuity 

Pe U n A e = Pe qU e qA e q [15.20.57] 

where A is the cross-sectional area of flow. But 


Integrating Equation 15.20.65 gives 

^ t =-gt + c [15.20.66] 

where g is the acceleration due to gravity, 2 is the vertical 
distance and c is a constant of integration. At t= 0, 
dz/dt = u sin a and hence 


dz 


[15.20.67] 


deq = <4(^ 

In calculating the equivalent diameter the authors apply to 
the flow a discharge coefficient C D so that Equation 
15.20.60 becomes 

deq = <400 1/2 [15.20.61] 


= wsina — gt 
At f = 0, 2=0 and hence 

z—utsina-^gf [15.20.68] 

The jet returns to the ground at t = t, z = 0 and hence 
f= 2u sm« [15.20.69] 
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(a) (b) 

Figure 15.71 Travel range of a liquid jet, neglecting air resistance and break up: (a) jet from ground level source; 
(b) jet from elevated source 



The maximum distance of travel * max occurs at a = 45° 
and is 


where the subscript max denotes maximum. 

For an elevated jet, as shown in Figure 15.71(b), the jet 
returns to the ground at t=t, z= —l and, following the 
same approach, it may be shown that 



where l is the height above the ground of the outlet and z is 
the vertical distance above the outlet. Equation 15.20.72 
reduces to Equation 15.20.70 for/= 0. 

For a horizontal elevated jet the following simple treat¬ 
ment is applicable. 


x = ut [15.20.73] 

l = \g? [15.20.74] 

From Equations 15.20.73 and [15.20.74] 

x = u(^j' [15.20.75] 

Equation 15.20.72 reduces to Equation 15.20.75 for a = 0. 

In practice, the travel distance of the liquid jet will be less 
than that predicted by the expressions just given, because 
the jet is subject to air resistance and to disintegration. It is 
often assumed that the actual travel distance is halved by 
these factors. 

A treatment that takes air resistance into account is as 
follows. It is assumed that the resistance is proportional to 
the velocity. Then for motion in the horizontal direction 


Following the same approach as previously, it can be shown 


u cos a 

JP 


[l-exp(-W); 


with 

t (ku\m<i+fp $xp l~kt\ 


[15.20.77]: 


[15.20.78] 


where k is a constant representing air resistance. 

The disintegration of a liquid jet under air resistance has 
been studied by a number of workers including Rayleigh 
(1932), van de Sande and Smith (1976) and Engh and Larsen 
(1979). The following treatment is based on the work of the 
latter. 

The disintegration of a jet is determined by the Weber 
number We, which gives the ratio of the momentum to the 
surface tension forces. The Weber number is 


We = L^ [15.20.79] 

where d is the diameter of the jet, u is the velocity of the jet 
and a is the surface tension. 

The propagation of a disturbance in a liquid jet leading 
to its break up was studied by Lord Raleigh. In his model 
the amplitude <5 of a surface disturbance of initial ampli¬ 
tude <5 0 increases exponentially with time t: 

8 = 8 0 exp(ut) [15.20.80] 

where a is a constant. When the amplitude 8 of the dis¬ 
turbance is equal to the jet radius a, disintegration into 
drops begins. Drops are therefore formed at time 

t = ln(a/<5 0 )/oc [15.20.81] 

Then the break-up length Z is 


d 2 * 
df 2 : 


-k- 

*df 


Z = ut 


[15.20.76] 


’,\n{a/8 0 )/a 


[15.20.82] 

[15.20.83] 
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From this starting point Engh and Larsen derive the 
following expression for break-up length: 

| = 1.03 ln(a/<5 0 ) (2We) 1/2 [15.20.84] 

For an inviscid jet it has been found that 

ln(a/i5 0 ) s» 12 [15.20.85a] 

Other values of the term ln(a/<5 0 ) have been given by vari¬ 
ous workers. 

Engh and Larsen conducted experiments on water and 
molten steel. They state that the term ln(a/<5 0 ) decreases 
with increasing length/diameter (l/d) ratio of the nozzle, 
tending for lid > 13 to a value 

ln(a/i5 0 ) « 4 [15.20.85b] 

They also state that for water their results give 

|« 100 [15.20.86] 

The relations for jet travel and for jet disintegration depend 
on different parameters, but for many cases of practical 
interest the jet will start to disintegrate within a short dis¬ 
tance of the orifice. 

15.20.5 Two-phase jets 

Work on two-phase jets includes that by R. Brown and York 
(1962), Bushnell and Gooderum (1968), Hetsroni and 
Sokolov (1971), Gyarmathy (1976), Suzuki et al. (1978), 
Melville and Bray (1979a,b), Koestel, Gido and Lamkin 
(1980), and Tomasko, Weigand and Thompson (1981a,b). 


A review has been given by Appleton (1984 SRD R303). 
Two-phase jets may be classified as non-flashing or 
flashing. 

A liquid jet in air tends to disintegrate. Break up may 
occur due either to air resistance or to vapour bubble for¬ 
mation. The break up of a non-flashing jet due to air resis¬ 
tance was considered in the previous section. 

A two-phase non-flashing jet consists of a gas flow with 
entrained droplets. Characteristics of interest are: for the 
gas phase, the centre line and the radial velocities; and for 
the liquid phase, the radial mass flux of the droplets. Rela¬ 
tions for these may be found in the work of Hetsroni and 
Sokolov (1971) and Melville and Bray (1979a,b). 

It is two-phase flashing jets, however, which are of 
prime interest here. An account of such jets is given in 
Section 15.21. 


15.20.6 Plumes 

The principal types of jet and plume that occur are illu¬ 
strated in Figure 15.72. Figure 15.72(a) shows a non-buoyant 
jet, or pure jet, or simply a jet. Figure 15.72(b) shows a pure 
plume with no momentum. This figure, therefore, shows as 
the source not a discharge orifice, but a heated surface. 
Figure 15.72(c) shows a buoyant plume, with some initial 
momentum, or forced plume. Figure 15.72(d) shows a 
negatively buoyant plume. 

Accounts of plumes are given in Plume Rise (G.A. Briggs, 
1969), Vertical Turbulent Buoyant Jets (C.J. Chen and Rodi, 
1980) and Handbook on Atmospheric Diffusion (S.R. Hanna, 
Briggs and Hosker, 1982). Work on plumes includes that by 
O.G. Sutton (1950), Yih (1951), Rouse, Yih and Humphreys 
(1952), B.R. Morton (1959, 1961), Long (1963), Schmidt 
(1965), J.S. Turner (1966), G.A. Briggs (1965, 1968, 1976), 
Ooms (1972), Cude (1974a,b), Ooms, Mahieu and Zelis 
(1974), Davidson and Slawson (1982) and Frick (1984). 




Figure 15.72 Principal types of jet and plume (after C.J. Chen and Rodi, 1980): (a) pure, non-buoyant jet; (b) pure 
plume; (c) buoyant jet (forced plume); (d) negatively buoyant jet 
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Most models of plumes deal with the case of an initial jet in 
which the momentum decays so that the emission undergoes 
transition to a buoyant plume. Much of the work on plumes 
relates to elevated emissions from stacks and is concerned 
primarily with pollution rather than with hazards. Funda¬ 
mental quantities in models of dispersion of forced and 
buoyant plumes are the momentum and buoyancy fluxes. 
The momentum flux at the outlet orifice is 

M 0 = ji r%p 0 u 2 0 [15.20.87] 

where M is the momentum flux, r a the radius of the outlet, u 
is the velocity of the gas, p is the density and subscript o 
denotes the outlet. The buoyancy flux at the outlet is 

Fo = nfeip a - Po)«o [15.20.88] 

where F is the buoyancy flux and subscript a denotes air. 

Use is frequently made of momentum and buoyancy 
fluxes which are normalized with respect to density, for 
example, 

M 0 = rn^—u 2 [15.20.89] 

F 0 = nr 2 0 g^—£s,u 0 [15.20.90] 

This then gives for momentum and buoyancy the SI 
units m 4 /s 2 and m 4 /s 3 , respectively. In addition, n is some¬ 
times omitted from the definitions of momentum and 
buoyancy. 

In expressions for buoyancy flux, use is sometimes made 
of the relation 


T a) 


[15.20.91] 


where /? is the coefficient of cubical expansion (ral/T r ) 
and subscript r denotes the reference. 

The measure of the ratio of the momentum forces to 
the buoyancy forces is given by the Froude number Fr. 
The Froude number is defined as 


“ (gif 2 


[15.20.92] 


where l is a characteristic length. 

In the context of plumes, the Froude number is more 
usually defined as 


(M>(P a - Po/Pa)) V2 


[15.20.93] 


where d a is the diameter of the outlet. 

Use is also sometimes made of the following Froude 
group (e.g. C.J. Chen and Rodi, 1980): 


[15.20.94] 


In some definitions of the Froude number the divisor of 
the term p a - p 0 is p 0 rather than p a .The Froude number is 


a criterion for the transition from momentum control to 
buoyancy control. 

Some principal characteristics of a plume have been 
described by Long (1963). He summarizes the empirical 
features of a buoyant plume as follows. Under turbulent 
conditions the plume is conical and apparently diverges 
from an equivalent point source, the position of the point 
source depending on the point of transition from laminary 
to turbulent flow; the time—mean velocity and time- 
concentration profiles are similar and are approximately 
Gaussian. 

Under adiabatic conditions buoyancy is conserved 
within the plume and the buoyancy flux remains constant 
with distance. The momentum flux therefore increases 
with distance. For the distance within which turbulence 
sets in for a pure plume Long gives the following relation 
based on the work of Yih (1951) on plumes from cigarettes: 



where Q is the volumetric flow, X\ t is the distance for tran¬ 
sition from laminar to turbulent flow, p is the viscosity and 
A is the density difference. For most plumes of practical 
interest this transition distance is very short. 

For the concentration ratio and radial distribution of a 
plume, Long gives: 



where c is the volumetric concentration, r is the radial dis¬ 
tance, k 4 and k 5 are constants, and subscript xr denotes at 
the axial distance x and radial distance r. 

Long suggests that, from the work of Yih, the time mean 
values of the constants k 4 and k 5 may be taken as 11 and 8.4, 
respectively. 

For a forced plume with both momentum and buoyancy, 
Long proposes as the criterion of transition from momen¬ 
tum to buoyancy control the following modified Froude 
number: 


pl /2 &Pogdo 


[15.20.97] 


He obtains an approximate value for the transition point by 
equating Equations 15.20.8 and 15.20.9. Then the transition 
point occurs at 2.4Fr 1/2 diameters from the source. This 
criterion is confirmed by the work of Ricou and Spalding 
(1961) in that the point of equal entrainment in the jet and 
plume regimes occurs at 2.3 Fr 1/2 diameters.The jet persists 
at least to 0.5 Fr 1/2 diameters and the plume is fully devel¬ 
oped beyond 3 Fr 1/Z diameters. 

With the exception of last point, the treatment just given 
applies to a pure plume in a still atmosphere. In many 
practical applications the case to be considered is more 
complex. The emission may have both momentum and 
buoyancy, starting off as a jet and undergoing transition to 
a plume. The plume may be affected by the various weather 
conditions. In addition, the plume may have heavy gas 
characteristics requiring special treatment. 


15.20.7 Plumes in atmospheric turbulence 

A different situation occurs where a higher wind speed 
results in atmospheric turbulence. If conditions are such 
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that the discharge momentum and buoyancy effects are neg¬ 
ligible relative to atmospheric turbulent diffusion, the dis¬ 
persion may he estimated using the methods described in 
Sectionl5.10suchastheSuttonandPasquill-Giffordmodels. 

Using the Sutton model, Long (1963) gives the following 
equations for an elevated vent, derived from Equation 
15.16.2(c) The full equation is 


X(x,y,z) =- 


i^exp^- 

_ lA 

q x 2-nl 


f 

) 




x(*,0,0) = 


nCyQux 2 -” 


-I-exp I 


ch 2 -”)_ 


[15.20.98b] 


where x, y and z are the downwind, crosswind and vertical 
distances, C is the diffusion parameter, h is the height of the 
outlet, <3 is the volumetric flow from theoutlet, «is the wind 
speed, x is the concentration, n is the diffusion index and 
subscripts x and y denote downwind and crosswind, 
respectively. The origin of the coordinates in Equation 
15.20.98, but in this equation only, is the outlet of the vent. 
The maximum ground level concentration Xmgi is 


[15.20.99] 


^ = °- 234 l| 


(t?x v 

Zmg i=y 


Values of the index n and of the generalized diffusion 
parameters C y and C 2 for the first 10 m above ground are 
given by Long as follows: 


Stability condition 

n 

C y (m” /2 ) 

CA m” /2 ) 

Large lapse rate 

1/5 

0.37 

0.21 

Neutral condition 

1/4 

0.21 

0.12 

Moderate inversion 

1/3 

0.13 

0.08 

Large inversion 

1/2 

0.11 

0.06 


The Sutton equation (15.20.98) was not originally intended 
for use over the very short distances involved in vent cal¬ 
culations, and its use demands some justification. This 
point has been discussed by Long, who concludes that the 
use of the equation is justified. A further discussion of this 
aspect is given in Section 15.48. 

15.20.8 Plumes with negative buoyancy 

In many practical situations the emission of interest is that 
of a dense gas. Plumes with negative buoyancy are there¬ 
fore of particular interest. A study of a plume with negative 
buoyancy has been made by J.S. Turner (1966). He carried 
out experiments in which a dense liquid was injected into 


a less dense one. The flow pattern obtained is illustrated in 
Figure 15.72(d). 

For this case Turner obtained the following expression 
for maximum plume rise z max : 

M 3 / 4 

W = Cfpr [15.20.101] 

F=nr z 0 g(^-^ju 0 [15.20.102] 


M = my o [15.20.103] 

where F is the buoyancy flux, Mis the momentum flux, u a 
is the outlet velocity of the gas, p„ is the density of the outlet 
gas, pi is the density of ambient fluid and C is a constant. 
Timer gives the value of the constant C as 1.85. 

15.20.9 Cude model 

A model for jets and plumes has been given by Cude 
(1974b). The Cude model distinguishes between a jet, a 
buoyant plume, a negatively buoyant plume and a buoyant 
plume at low wind speed. 

Plume in still air 

A treatment of the rise or fall of a buoyant plume in low 
wind speed conditions has been given by Bosanquet 
(Bosanquet 1935,1957; Bosanquet and Pearson, 1936). In 
the simplified form given by Cude, the rise or fall of the 

im -u/AFi(xi) [15.20.104] 

A = 9.42 ~ Pg ~ Pa [15.20.105] 


xi = hi A [15.20.106] 

where A is a time parameter, Fifo) is a function that 
expresses the change in density of the plume as a result of 
dilution by air, i is the rise or fall of the plume at a distance 
wt\ from the source, N is the volumetric flow from the outlet, 
h is an arbitrarily chosen time interval, w is the wind speed 
and p g is the density of the gas at the outlet. The time h is 
taken by Cude as 100 s. 

If the gas density is greater than that of air, the plume 
falls and i has a negative numerical value, while if the gas 
density is less than that of air the plume rises and i has a 
positive value. 

The function Fi(*i) is a complicated one. Some values 


Xl 

Fi 

Xl 

Fi 

<10“ 3 

1.0543V’ 75 

10 

2.33 

10“ 3 

0.0059 

10 2 

4.50 

10“ 2 

0.0323 

10 3 

6.79 

HT 1 

0.170 

10 4 

9.09 

1 

0.767 

>10 4 

= In *i-0.12 
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Plume in atmospheric turbulence 

For conditions of atmospheric turbulence with higher wind 
speeds Cude gives the following equations. For the axial 
concentration p a from an elevated source 


Pa 


[15.20.107] 


assumed that at the transition point the mass flow of the 
gas-air mixture Wi can be approximated by the mass flow 
of air w a 

wi« w a [15.20.110] 

and that the velocity of the jet u is equal to that of the wind w 


for the maximum ground level concentration p msi 


[15.20.111] 


Angl = 


0.234 J 
w{H + lf 


n - 9n , Then for still air, substituting in Equation 15.20.4 for d 0 
' ' ‘ fromEquationl5.20.landforOTifromEquationl5.20.110 


and for the distance x mg i at which the maximum ground 
level concentration occurs 

x mg i = 5.3 (H + I) u * [15.20.109] 


"j = kik 6 (m 0 v) 112 
= k\h ^ 12 


[15.20.112a] 

[15.20.112b] 


where H is the height of the outlet (m), / is the volumetric 
flow from the outlet referred to the ambient temperature 
(m 3 /s), l is the height of the jet (and of the horizontal axis of 
the plume above the outlet) (m), p 3 is the concentration of 
gas along the axis at a distance x (mole fraction), p m gi is the 
maximum ground level concentration of the gas (mole frac¬ 
tion), w is the wind speed (m/s), x is the downwind distance 
(m) and x mg i is the distance at which the maximum ground 
level concentration occurs (m). 

Momentum jet 

For a momentum jet the model given by Cude is that already 
described in Equations 15.20.1-15.20. The height of the jet 
at which transition occurs is calculated as follows. It is 




[15.20.113] 


<p = mov [15.20.114] 

where m 0 is the mass flow at the outlet, v is the velocity of 
the gas at the outlet, \p is the momentum flux in the still air, 
Pi is the density of the jet at distance l, and k 6 is a constant. 


Forced plume in wind 

For a momentum jet that undergoes transition to a plume in 
a wind, Cude gives the following treatment. The situation is 
illustrated in Figure 15.73. The transition from momentum 
to buoyancy control is obtained as follows. For windy 



Figure 15.73 Cude model of dispersion as jet and plumes from a stack (after Cude, 1977): (a) turbulent momentum jet; 
(b) and (c) buoyant plumes; (d) negatively buoyant plume with steep descent 
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conditions the momentum flux is a vector quantity. In this 
treatment it is assumed that 

<l/ w m, [(w 0 i;) 2 +(maM/) 2 ] 1/2 [15.20.118J 

where \j/ v is momentum flux in windy conditions. But from 
Equations 15.20.3,15.20.110 and 15.20.111 


[15.20.116] 


Hence from Equations 15.20.114—15.20.116 


But 

r «= xtan0 [15.20.121] 

where p is the angle between the axis and the edge of the 
plume, or half-angle of plume. Hence Equation 15.20.120 
can be rearranged to give 

u h = kjxrW [15.20.122] 

|i5 - 2omi 


xji w = 2 [15.20.lltJ 

Then, since from Equation 15.20.112b the length of the jet is 
inversely proportional to the root of the momentum flux, 
the transition heights of the jet in still air conditions / tr and 
in windy conditions 4 rw are related as follows: 

^=w=r2 [15 - 20 - 118] 


The half-angle of a plume from a stack is generally 5° or 6° 
so that tan 4>~ 1- The drag coefficient D c is estimated by 
Cude from the work of Bodurtha, Palmer and Walsh (1973) 
as 0.4. 

The treatments given by Cude for rising and for falling 
plumes are slightly different. The condition for a rising 
plume is p a < p a . The treatment for a rising plume shown 
in Figure 15.73(c) is as follows. The rise of the plume is 
given by 


The following relation is given by Cude for the horizontal 
displacement of the transition point x trw : 

Xtrw ~ 0.5 4™ [15.20.119] 


[15.20.124a] 

[15.20.124b] 


The height reached by the plume from the transition point 
is calculated as follows. It is assumed that, as shown in 
Figure 15.73(b), there is a virtual source for the plume at 
point S that is a distance x a upwind from the transition 
point T. This assumption allows for the mixing effect of the 
jet. The distance x„ is that which would be necessary to 
achieve the same concentration at the transition point if the 
mixing were done by the wind. Then, consider the element 
5x in Figure 15.73(b): 

Volume of element = m^Sx 

Volume of pure gas in element = Q5x/w 

Volume of air in element = nr^dx — Qdx/w 

Mass of pure gas in element = Qp 0 5x/w 

Mass of air in element = mPpJSx — Qp a 8x/w 

Mass of air displaced by element = n^p^dx 

Buoyancy force on element =g[nr 2 p a 5x - (n^p^x 

-Qp a dx/w ) - Qp 0 8x/u>] 

where Q is the volumetric flow of the gas at the outlet, r is 
the radius of the plume and x is the downwind distance 
from the virtual source. 

The rising plume experiences a resistance due to the 
shear stress in the air adjacent to it. Equating the buoyancy 
force and the shear stress 

(p a - Po) = 2nr5xulp a D c [15.20.120] 


where z is the vertical distance above the transition 
point. Integrating Equation 15.20.124 with the boundary 
conditions 

m o, x =* 0 

z^^-xl' 2 ) [15.20.125] 

The maximum rise z max of a plume occurs at a distance 
r mal where 

X max =k S W + X 0 [15.20.126] 

where k s is a constant. The value of the constant k s may be 
obtained from the observation that a plume generally 
reaches its maximum rise after 200 s so that k s = 200.Then 
from Equation 15.20.125 

2max = ^ (xV% % - [15.20.127] 

The distance x D is obtained from Equation 15.20.107: 


<5.82A 1/175 
\Wp a ) 


[15.20.128] 


The concentration p a is, in this case, the concentration on 
the axis at the transition point and, assuming that the axial 
concentration is twice the mean concentration in the jet, 


Pa « 


2 M a m 0 
Mtn^ 


[15.20.129] 


2M a io 

Mv 


where D c is the drag coefficient and is the buoyancy, 

upward, velocity of the plume. 


[15.20.130] 
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where M is the molecular weight of the gas and M a is the 
molecular weight of the air. 

The total effective height h pi reached by the plume is thus 

hpi = H + 4 rw + 2max [15.20.131] 

The maximum ground level concentration p msl is calcu¬ 
lated from an equation similar to Equation 15.20.108, using 
the total effective height of the plume: 


Pr ngl = 


0.234/ 


[15.20.132] 


and the distance x mgl at which the maximum ground level 
concentration occurs is calculated from an equation similar 
to Equation 15.20.109: 


[15.20.133] 


The treatment for a falling plume, which is an approximate 
one, is as follows. The condition for a falling plume is p 0 > 
p a . As before, calculations are made of the distances 2 and 
2max, but in this case the quantities denote vertical 
distances below the transition point. In calculating £ 7 , the 
term [(p a - p 0 )/p a ] is replaced by the term [(p 0 - p a )/p a ]. 
For a falling plume there are two situations that can 
arise. If conditions are favourable 


^max < (H -+- 4rw) 


[15.20.134] 


vertical component is tv tan 9. The resultant velocity 
u g is 

u e = w( 1 + tan 2 0) VZ [15.20.138] 

The distance xg from the virtual source S to the point where 
the plume reaches the ground measured along the axis of 
the plume is 

Xe = cos0 = ^ + tan2 0 ) V2 I 15 ' 20 ' 139 ] 

The maximum ground level concentration /> mgl may be 
estimated by substituting u s and x e for w and x„ in Equation 
15.20.128. The distance x mg i at which the maximum ground 
level concentration is reached is 

x mg ,= Xl -x 0 [15.20.140] 

Cude has compared his method with that of Bosanquet and 
with experimental data on plume paths given by N.G. 
Stewart etal. (1954) and quoted by Pasquill (1962a, p. 221). 
It predicts a plume rise approximately twice that of 
Bosanquets method and apparently more in accordance 
with the experimental data of Stewart et al. It gives a maxi¬ 
mum ground level concentration which is approximately 
half that obtained by Bosanquets method, although Cude 
emphasizes that this difference is well within the range of 
variations which arise as a result of different atmospheric 
conditions. The method is applicable where the density 
difference between the plume and the air is zero, a condition 
where Bosanquets method is unreliable. 


The plume tends to become horizontal as it approaches the 
ground. In this case the method is to determine the total 
effective height h p \ from Equation 15.20.131 but with the 
modification that the term z max is subtracted not added. 
The maximum ground level concentration z max is then 
calculated as before from Equation 15.20.132. 

It should be noted that Equation 15.20.132, which is 
approximate, gives very large values for /> mgl for very small 
values of h pl and is not valid for such values. A check may 
be made by substituting * max instead of x a into Equation 
15.20.128 and calculating p a . If p a < p mgh the value of/> mg i is 
rejected and the value of p a is accepted in its place. 

If conditions are unfavourable 

«max>(ff + 4rw) [15.20.135] 

The plume approaches the ground at an angle. The maxi¬ 
mum ground level concentration is the axial concentration 
in the plume when it reaches ground level. The situation is 
shown in Figure 15.73(d). In this case the method is to make 
the substitution 

z={H + 4 rw ) [15.20.136] 

The distance X\ from the virtual source at which the plume 
axis reaches the ground is then calculated from Equation 
15.20.125, using Equation 15.20.13. Then from the geometry 
of Figure 15.73(d) 

tanfl = g + 4rw [15.20.137] 

xi-x 0 

where 6 is angle between axis of plume and horizontal. The 
horizontal component of the plume velocity is w and the 


15.20.10 Briggs models 

A model for jet and plumes and, in particular, for plume rise 
has been given by G. A. Briggs (1965,1968,1969,1976), and 
S.R. Hanna, Briggs and Hosker (1982). The Briggs model 
distinguishes between a plume dominated by momentum 
and a plume dominated by buoyancy; between a vertical 
plume and a bent-over plume; and between a plume near 
the source and a plume in the three main stability condi¬ 
tions (stable, near neutral and convective, or unstable). The 
plume scenarios described in Briggs’ models are illustrated 
in Figure 15.74. 

In these models, the prime concern is with stack gases 
that have a temperature much greater than that of air but a 
molecular weight that does not differ greatly from that of 
air. For such gases Briggs defines the momentum flux as 
M = wV [15.20.141] 

and the buoyancy flux as 

(T„ - T.„j 

F=g -^- V [15.20.142] 

where Fis the buoyancy flux, M is the momentum flux, 7is 
the volumetric flow, w is the velocity in the vertical direc¬ 
tion and the subscripts en and p denote environment and 
plume, respectively. The volumetric flow V is defined as 

V — wr 2 Vertical plume [15.20.143a] 

V — ur 2 Bent-over plume [15.20.143b] 

where r is the radius and u is the wind speed. 

Thus, in definition 15.20.143 Briggs omits the term n 
and in definitions 15.20.141 and 15.20.142 the term nr 2 . 
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Figure 15.74 Briggs model of dispersion of plumes from a stack (S.R. Hanna, Briggs and Hosker, 1982): (a) vertical 
plume; and (b) bent-over plume h and R in the figure are denoted in the text by h e and r, respectively 


He adopts a similar approach to the definition of other 
quantities. 

The initial momentum flux is 
M 0 = ut 0 V 0 [15.20.144] 

and the initial buoyancy flux is 

Fo=g ( yp °^ fe °) F ° [15.20.145a] 

A=*(l-£“)vi [15.20.145b] 

where subscripts eo, o and po denote the initial environ¬ 
ment, the outlet and the initial plume, respectively. 

If the molecular weight of the gas emitted differs 
significantly from that of air, the initial momentum and 
buoyancy may be modified as follows: 

M o = ^w o V 0 [15.20.146] 

|m20U7 > 


The basis of the Briggs model is the equations for con¬ 
servation of momentum and of buoyancy, together with 
additional relations required for the solution, or closure, of 
the equations. The closure relation is the Taylor entrain¬ 
ment assumption. 

The basic equations are as follows. For conservation of 
momentum 

^ Vertical plume, bent-over plume [15.20.148] 
For conservation of buoyancy 

Vertical [15.20.149a] 


dF sV 

— =--^- Bent-over plume [15.20.149b] 

«^( 5 + r ) [ 15 - 20 - 15 °] 

where s is the environmental stability, S is the ratio of the 
effective area influenced by the plume momentum to 
the cross-sectional area of the so-called thermal plume, 
T e is the absolute temperature of the environment, z is the 


where m is the molecular weight. 
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vertical distance above the outlet and T is the dry adiabatic Transition from momentum to buoyancy control occurs at 
lapse rate. The value of S is found to be 2.3. For closure time 


= 2 raw Vertical plume [15.20.151a] 

dV 

= 2 r/hv Bent-over plume [15.20.151b] 

where a and /? are constants. 

The velocities are 


[15.20.152] 

[15.20.153] 


M 

t = y [15.20.161] 

Typically, the time to transition is less than 10 s. 

After transition there is a buoyancy dominated plume, or 
buoyant plume. For this 

pi/2 

w = 2.3^°- [15.20.162] 

The radius r is again given by Equation 15.20.157, but the 
constant j5 has a value of 0.15 for the plume phase. 

Plume near source: bent-over plume 

Near the source, setting F = constant in Equation 15.20.154 

gives on integrating 


^1 = F [15.20.154] 

The derivation of the model equations is largely based on 
solutions of Equation 15.20.154 for the various conditions. 

Plume near source: vertical plume 

At the source there is a momentum-dominated plume, or jet. 

Then, taking the buoyancy as zero, or setting F = 0, gives 


wV = constant 

[15.20.155a] 

Hence 


{wV) l,2 = constant 

[15.20.155b] 

Then from Equation 15.20.143a 


(wV) 1/2 = wr 

[15.20.156a] 

= w 0 r 0 

[15.20.156b] 

But for a jet 


r = pz 

[15.20.157] 


wV = M 0 + F 0 t 

But for a bent-over plume 


um^ = M 0 + F 0 t 

_ (3MJ 3 Fof^ /3 
*-\p 2 u 2 fu) 

Alternatively, since 
u = x/t 

Equation 15.20.167 can be written as 


_ f m o x 3F 0 x? \ 
\P 2 u 2 + 2p 2 uV 


1/3 


[15.20.165] 

[15.20.166] 


[15.20.169] 

For the momentum-dominated plume, setting F 0 = 0, gives 


The constant /J has the value 0.16 for the jet phase. Then 
wz oc w 0 r 0 [15.20.158] 

From the work of Pai, the centre line velocity w A of a jet is 


[15.20.159] 


_ (3M 0 t\ 1/3 

*~\W) 

or from Equation 15.20.168 

_ (3Mox\ 1/3 

WJ 


[15.20.170] 


[15.20.171] 


But the mean velocity is about half the centre line velocity 
and hence 

w= 6.25^ [15.20.160a] 


Equation 15.20.171 is the 1/3 law for a bent-over momentum 
plume. 

For the buoyancy-dominated plume, setting M„ = 0, 
gives 


(IT 


[15.20.160b] 


[15.20.172] 
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(3 FoX 2 \ 1/3 


Plume rise in stable conditions: vertical plume 
For the momentum plume, G. A. Briggs (1976) gives 


[15.20.173] 


.WJSY* 


[15.20.181] 


But for a buoyant plume the constant /? has the value 0.6. 
Substituting in Equation 15.20.173 gives 


[15.20.174] 


[15.20.182a] 

[15.20.182b] 




S.R. Hanna, Briggs and Hosker (1982) also give 


Ci = 1.6 15.20.175] 

where Ci is a constant. Equation 15.20.174 is the 2/3 law for a 
bent-over buoyant plume. A table of values of the constant 
Ci is given by G.A. Briggs (1976). His preferred value is 1.6. 

Plume rise in stable conditions 

In stable conditions the environmental stability s is con¬ 
stant. Then from Equations 15.20.148, 15.20.149 and 
15.20.152 

^=-sM [15.20.176] 

This is the equation of a harmonic oscillator. 

Briggs introduces a correction to the environmental sta¬ 
bility s to allow for the effective vertical momentum flux 
M e it and defines a modified stability s' such that 

s' = s Vertical plume [15.20.177a] 

= Bent-over plume 

The ratio A7/M eff has the value 2.3. Then from Equations 
15.20.141 and 15.20.176, and using s' rather than s, 

d2 ^ 2 F) = sW [15.20.178] 


z eq = 2.44^0 7 [15.20.183] 

For the buoyant plume G.A. Briggs (1976) gives 
2ma x = 5^ [15.20.184] 

S.R. Hanna, Briggs and Hosker (1982) also give 


z eq = 5-3-^g - 6 r 0 [15.20.185] 

The last term in Equation 15.20.185 is a correction to allow 
for the virtual source. 


Plume rise in stable conditions: bent-over plume 
For the buoyant plume, Equation 15.20.178 may be refor¬ 
mulated using Equations 15.20.143,15.20.152 and 15.20.157. 
Then integrating the equation and taking the maximum 
value of z gives 



[15.20.186] 

But for F 0 > (MJw') Equation 15.20.186 reduces to 


Integrating Equation 15.20.178 with the initial conditions 
f = 0; d(wV)/dt = F 0 ; wV=M 0 


- ( 6F ° V A 


[15.20.187] 


Taking the constant /? as 0.6 in Equation 15.20.187 gives 


wV = M 0 cos (u/t) + -^sin(n/f) 


[15.20.179] 




[15.20.188] 




Also 


td = s^ 2 [15.20.180] 

In Briggs’ model use is made of several plume heights. One 
is the maximum rise z max . Another is the ‘equilibrium’ 
height z eq , defined as the point at which F= 0. A third is the 
‘falling back’ height z^, defined as the height where the 
plume at maximum rise would be in equilibrium if no 
further mixing were to take place. Both z eq and z^, are 
fractions of z max , as described below. 


Zeq = 0.79z max [15.20.189a] 

z fb = 0.83z max [15.20.189b] 

G.A. Briggs (1976) also gives the following equation for 
plume rise Ah: 

/Fn\ 1/3 

Ah = Cz \us) [15.20.190] 
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where C 2 is a constant. Values of the constant C 2 are tabu¬ 
lated by Briggs (1976). His preferred value is 2.6. 


Plume rise limited by atmospheric turbulence 
For conditions other than stable conditions, Briggs’ 
treatment utilizes a‘break-up’ model in which it is assumed 
that the plume rise terminates when the internal plume 
eddy dissipation rate equals the ambient eddy dissipation 
rate eThen 


r\n? _ 


[15.20.191] 


where 17 is a constant. The constant v\ has the value 1.5. The 
term on the left-hand side of Equation 15.20.191 is 
the internal plume eddy dissipation rate. For a stack, the 
effective stack height (ESH) is 


K = 


K + Ah 


[15.20.192] 


G.A. Briggs (1982) also gives 

Ah = 3d 0 (^ -l) [15.20.199] 

The additional term is evidently a virtual source 
correction. 


Near neutral conditions: buoyant plume 

For a buoyant plume for which the first phase of rise is 

given by Equation 15.20.173] 


m = ( S ) 3/5 © 2/5 [15 ' 2a200] 

Proceeding as before, it can be shown that 

Ah = W {r,k)m O) ( X + ^J /3 [15-20.201] 


where Ah is the plume rise above the stack outlet, h e is the 
ESH and h s is the actual stack height. 

The plumes considered are momentum and buoyant 
plumes, both bent over. 

Near neutral conditions 

In near neutral conditions the ambient eddy dissipation 


[15.20.193] 


where u, is the friction velocity and k is von Karman’s con¬ 
stant. The constant k has a value of 0.4. 


Near neutral conditions: momentum plume 

For a momentum plume for which the first phase of rise is 

given by Equation 15.20.171 




Neglecting the last term of Equation 15.20.201 and taking 
for the constants /?, r/ and k values of 0.6, 1.5 and 0.4, 
respectively, gives 




[15.20.202] 


Briggs also gives as an approximation for Equation 
15.20.201 the following equation: 


/ j? \ 2/3 

AA = 1.54f^J h]' 3 


[15.20.203] 


Convective conditions 

For convective, or unstable, conditions Equation 15.20.193 
does not apply. Instead, the relation used is 

im0.25H [15.20.204] 

where H is surface buoyancy flux. The resultant equation 
for plume rise is 


From Equations 15.20.192 and [15.20.193] 

Ah = ' W V7 (i +1|) ' Mi 1 ' 1 [15.20.195] 


-TO m K) i“' 


Assuming M»/z s so that the last term of Equation 
15.20.196 can be neglected and substituting for r\ and k 
values of 1.5 and 0.4, respectively, gives 


0.9 / u \V2/H 0 1/2 


. 0.9 (u\ 

h= jU 


[15.20.197] 


From Equations 15.20.141,15.20.143a and 15.20.197, taking 
the constant /J as 0.6 and the ratio uju t as 15, 


Ah = 2.9^ 


[15.20.198] 


A* = 3P) H~ 2/s 


[15.20.205] 


but this equation is to be regarded as tentative. 

Ground level concentration 

Once the plume rise Ah and hence the ESH h e have been 
obtained, the maximum ground level concentration Xmgi 
may be found in the usual way, using Equation 15.16.55, 
which may be written in the form 

= [15.20.206a] 


Zmgl = 0.234^^ [15.20.206b] 

where e is the base of natural logarithms, Q is the mass rate 
of release and and cr z are the longitudinal and vertical 
dispersion coefficients, respectively. 


where d 0 is the diameter of the source. 
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The maximum ground level concentration / mgl is low 
both at low and at high wind speeds, because in the first 
case the plume rise is high and in the second dilution is 
high. It therefore passes through a maximum value / max at 
some critical wind speed u c . 

A minimum value of the term uh 2 is obtained from 
Equationl5.20.201when Ah = hJ3. The following relations 
can then be derived: 

/ u\ 2/3 (FA 1 ' 3 

= 2.15 f —J MJ [15.20.207] 

/„\ 2/3 

u c k% = 3.8 ( Ft' 3 hl /3 [15.20.208] 

15.20.11 Jet transients 

The jet and plume models described apply to steady-state 
conditions. The steady state is preceded and followed by 
transients that are much less well defined. In particular, the 
decay can result in a plume with a relatively low momen¬ 
tum. A study of gas jet transients has been described by 
Landis, Linney and Hanley (1994). 


15.21 Dispersion of Two-phase Flashing Jets 

The type of jet considered here is the jet resulting from a 
release of superheated liquid at high pressure, with choked 
liquid or two-phase flow. Such a jet may be divided into a 
number of zones, as shown in Figure 15.75. One common 
division is into two zones, a depressurization zone and an 
entrainment zone. In the depressurization zone, which is 
some two orifice diameters in length, the pressure falls 
essentially to atmospheric pressure, but there is little air 
entrainment. This occurs in the entrainment zone. 

A modification of this scheme is to introduce between the 
depressurization and entrainment zone an intermediate 
zone in which deposition of liquid droplets, or rainout, is 
completed but negligible entrainment of air occurs. This is 
referred to here as the deposition zone. 


The jet is commonly considered to end at the point where 
the jet velocity has fallen to a minimum value or to the wind 
speed, whichever is higher. 


15.21.1 Disintegration of jets 

Two-phase jets in general were considered in Section 15.2. 
The two-phase jets of main interest here are those of 
superheated liquids, which give flashing jets. A review of 
such jets has been given by Appleton (1984 SRD R303). 

The break-up of a flashing jet will, in general, be due 
both to air resistance and vapour bubble formation. 
Appleton states that for most situations of interest in the 
process industries the latter will usually be the more 
important effect. 

Work by Bushnell and Gooderum (1968) has shown that 
there is a critical degree of superheat above that the jet will 
disintegrate due to vapour bubble formation. They define 
a shattering temperature as follows: 



Hence 


Tsh=^ [15.21.1b] 

where e is a constant and subscripts sat and sh denote 
saturation and shattering, respectively. They give for the 
value of the constant e the range 0.07-0.1. 

Below the shattering temperature the jet remains well 
formed, while above it the jet shatters. In their work break¬ 
up did not appear to be affected by outlet diameter or liquid 
velocity. In the work of R. Brown and York (1962), however, 
for experiments where the Weher number was high, shat¬ 
tering occurred at lower values of the superheat. Mention 
should also be made of work by Suzuki et al. (1978), which 
has shown that, even when the jet conditions are held con¬ 
stant, large variations can occur in break-up length and 
pattern. 



Figure 15.75 Two-phase momentum jet (Fauske and Epstein, 1988). Subscript 2<]> in the figure is denoted in the 
text by subscript tp. 
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For a two-phase flashing jet the characteristics of interest 
are similar, but in this case the mass flow of droplets increa¬ 
ses along the axis, so that in addition information is required 
on the production rate of droplets and on droplet size. 

For droplet size relations for minimum and for maximum 
droplet size have been given by Koestel, Gido and Lamkin 
(1980) and by Gyarmathy (1976), respectively. Appleton has 
compared theoretical estimates from the methods of these 
authors with values obtained by Brown and York as follows: 


Brown and York: 

Smooth orifice 34.7 pm 

Rough orifice 54.5 pm 

Koestel et al. (for minimum size) 19 pm 

Gyarmathy (for maximum size) 31 pm 


Quantitative treatment of the production rate of droplets 
is sparse. In Brown and York’s experiments there was 
initial flashing and jet expansion some 0.15 m downstream 
from the outlet and there was then rapid evaporation of the 
droplets, so that by 1.2—1.5 m downstream practically all 
the liquid phase had disappeared. 

15.21.2 Wheatley model 

A model for a two-phase jet of liquefied ammonia has been 
given by Wheatley (1986,1987 SRD R410). The model deals 
with: jet disintegration; gravitational settling of liquid 
droplets, or rainout; entrainment of air; and thermo¬ 
dynamics of mixing ammonia and moist air. It is not con¬ 
cerned with the effect on the jet of gravity or wind speed. 

Wheatley’s treatment of jet disintegration and rainout 
was considered in Section 15.1. The account given here is 
confined to his model for air entrainment. The situation 
that he considers is that in which the aerosol particles are 
sufficiently small for motion in the jet to be taken as 
homogeneous. 

The basic relations of the model are 

G d =AuC [15.21.2] 

G d u d = Au 2 p [15.21.3] 

G=G d +G a [15.21.4] 

G=Aup [15.21.5] 

Furthermore, from Equations 15.21.3 and 15.21.5 

G a u a = Gu [15.21.6] 

where A is the cross-sectional area of the jet, C is the 
concentration (mass per unit volume), G is the mass flow in 
the jet, u is the velocity of the jet, p is the density of the jet 
and subscripts a and d denote air and the end of deposition 
zone, respectively. 

The relation for the growth of the jet due to air entrain- 


*iRupJ(p/p,) [15.21.7] 

where R is the radius of the jet and z is the distance down¬ 
stream of the source. Here / (p/p a ) is a function yet to be 
defined. 


Wheatley considers two models of air entrainment. The 
first is that of Ricou and Spalding (1961). These workers 
give for an isothermal gas jet over a limited range of initial 
densities 

^ = n 1 ' 2 tan [15.21.8] 

where poa is the asymptotic half-angle of the jet. 

It is found empirically that P^ = 9.1° and hence tan 
Pco = 0.15. An entrainment coefficient oc is sometimes 
defined as 

a = 1/2 tan^ [15.21.9] 

Comparison of Equations 15.21.7 and 15.21.8 implies 

/(p/p a ) = l/2(p/p a ) 1 / 2 tan^ [15.21.10] 

This equation indicates that entrainment is affected by the 
density of the jet. 

A density effect is indicated in the following equation 
obtained for isothermal gas jets: 

tan p = 1/20S+ 1 ^ ^ ' tan p x [15.21.11] 

Wheatley quotes experimental work to the effect that, 
where the density ratio p/p a is appreciably greater than 
unity, p can be smaller than /?„ by a factor of about 2, which 
is not consistent with Equation 15.21.1. He notes that in the 
work of Ricou and Spalding the density ratio p/p a was at 
most about 1.05 and concludes that Equation 15.21.8 is not 
valid where p differs significantly from p a . 

Work by B.R. Morton, Taylor and Turner (1956) has 
shown that / is independent of p/p a . Thus, Equation 
15.21.10 becomes 

/(p/p a ) = 1/2 tan p x [15.21.12] 

and Equation 15.21.11 becomes 

tan p = 1/2 (p a /p + 1) tan^ [15.21.13] 

This equation gives the decrease of P with increasing p 
found experimentally. 

Wheatley concludes that the treatment of Morton, Taylor 
and Turner should be used in preference to that of Ricou 
and Spalding. This model forms the basis of the computer 
code TRAUMA developed by Wheatley (1987 SRD R393, 
SRD R394). The code was developed initially for ammonia 
but was subsequently generalized to handle other liquefied 
gases. 

15.21.3 Webber and Kukkonen model 

A generalized model of a two-phase jet has been given by 
Webber and Kukkonen (1990). The model is intended as an 
exploration of basic principles. Most attempts to model 
two-phase jets have been partial ones, concentrating on 
particular aspects and neglecting others. The aim of the 
work was to determine which are the important phenomena 
and hence how comprehensive a realistic model needs to be. 






15/154 EMISSION AND DISPERSION 


In this model the depressurization zone is ignored. For where B and / are the buoyancy and momentum flux, 
the entrainment zone the basic relations are: respectively. The quantities L and U are defined as 


d (<t>u 2 A) _ 


A = nR 2 


/S 2 \ 1/2 

[15.21.14] L =(rf) l 152127 l 

15.21.lo- U =f/ B t 15 ' 21 - 28 ] 


[15.21.16] 


With incorporation of the first entrainment model, 
Equation 15.21.20, Equations 15.21.25 and 15.21.26 yield 
for Case 


R = L(q/p) 


[15.21.29] 


[15.21.17] 


[15.21.30] 


where A is the cross-sectional area of the jet, C is the con¬ 
centration of the contaminant, R is the radius of the jet, u is 
the velocity of the jet, u E is the entrainment velocity, x is the 
downstream distance and p is the ratio of the densities of 
the jet and air. 

For the density of the jet, two cases (A and B) are con¬ 
sidered. For Case A the density of the jet is the same as that 
of the ambient air 

<j> = 1 [15.21.18] 

For Case B the jet is an isothermal mixture of contaminant 
and air: 

<£ = 1 + C [15.21.19] 

Two entrainment models are considered. These are the 
models of B.R. Morton,Taylor and Turner (1956) and Ricou 
and Spalding (1961), as treated by Wheatley. The authors 
state these models in the form 


0 = 1 /(pqf [15.21.31] 

p 2 = u/U [15.21.32] 

q 2 =Au/(nI?U) [15.21.33] 

£ 2 =(l + 9 2 ) -1 [15.21.34] 

q{ 1 + ? 2 ) 1/2 + ln[? + (1 + ? 2 ) 1/Z ] = 2ax/L [15.21.35] 

where/) and q are dimensionless variables. 

For the Case B Equations 15.21.25 and 15.21.26 with the 
second entrainment model, Equation 15.21.21, the result is 

R = 2oa[l + L/(2ax)] 1/2 [15.21.36] 


m = m [15.21.20] 

and 

u E = out i 1/2 « [15.21.21] 

where a is an entrainment coefficient. These two entrain¬ 
ment models are identical for Case A, but not for Case B. 

For Case A of a jet of ambient density, the solution of 
Equations 15.21.14—15.21.16 with incorporation of either 
entrainment model is 

R = 2ax [15.21.22] 

u = UL(2ax) [15.21.23] 

C = L/(2ax) [15.21.24] 

where L and U are length and velocity scales determined by 
conditions at the source, and x is the downstream distance. 

The solution for Case B of a dense jet before incorpora¬ 
tion of the entrainment model is 

(<p - Y)uA = B [15.21.25] 

<t>u 2 A = f [15.21.26] 


u = f/[Z-/(2«)][l + L/(2ax)]“ 1 [15.21.37] 

0-1 + l./(2y.x) [15.21.38] 

For a two-phase jet that is not dense initially, L is rather 
smaller than R, and U is larger than u at the end of 
the depressurization zone. For an initially dense jet, L can 
be somewhat larger than R, whilst U approximates to u 
at the end of the zone. 

The authors then develop the model to treat the effects of 
gravity, wind speed and liquid deposition. They give illus¬ 
trative estimates from this model, utilizing the TRAUMA 
code to determine the conditions at the end of the deposi¬ 
tion zone. 


15.21.4 Fauske and Epstein model 

Fauske and Epstein (1988) have described a more specific 
two-phase jet model, shown in Figure 15.75. They point out 
that, although in laboratory work the shattering tempera¬ 
ture exceeds the saturation temperature, in practice due to 
factors such as vaporization upstream, roughness of the 
hole and air resistance, the extent of superheat without 
disintegration is very small. They take it as established that 
a superheated liquid released to the atmosphere disin¬ 
tegrates into droplets in the size range 10-100 pm, citing 
the work of Bushnell and Gooderum just described. 
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The basic relations of the model for the depressurization 


(a — «b H- 

«b P 

_ A b u b p h 


a xJpg + il-X^/Pf 
h 0 = hf + x a ht e 


[15.21.39] 

[15.21.40] 

[15.21.41] 

[15.21.42] 


Then, rearranging Equation 15.21.44 gives the following 
equations for the end of the entrainment zone 





[15.21.49] 


whereA is the cross-sectional area of the jet, h is the specific 
enthalpy of the jet, Pis the pressure in the jet, u is the veloc¬ 
ity of the jet, x is the vapour fraction, or quality, p is 
the density of the jet, subscript b denotes at the orifice, or 
break, and subscript a denotes the end of the depressuriza¬ 
tion zone. Subscripts f, fg, g and o denote the liquid, liquid- 
vapour transition, the vapour and stagnation conditions, 
respectively.The densities and specific enthalpies at the end 
of the zone are evaluated at atmospheric pressure. 

For the entrainment zone the entrainment relation used 
is that of Ricou and Spalding (1961): 

«*«(£) [15.21.43a] 


[15.21.43b] 


where e is the entrainment rate, E a is the entrainment coeffi¬ 
cient and the subscript oc denotes atmospheric conditions. 
The relations for the conditions at the entrainment zone 


h-hoo 
ho-hoo 

[15.21.44a] 

R p 

\ to 

[15.21.44b] 


[15.21.44c] 


where R is the radius of the jet, z is the distance along the jet 
axis and is the specific enthalpy of the gaseous phase 
evaluated at atmospheric temperature Too. Equation 15.21.44 
is valid at the end of the entrainment zone; it should not be 
used to determine conditions part way through the zone. 

The authors discuss the thermal effects within the 
entrainment zone, particularly the formation of vapour 
from evaporating liquid droplets and the condensation of 
vapour onto droplets, and refer to the work of Weimer, Faeth 
and Olson (1973) on the latter. They conclude that it is rea¬ 
sonable to proceed on the assumption that the liquid and 
vapour phases are at the normal boiling point. Then, for a 
release that is all liquid and is from a vessel at ambient 
temperature, the specific enthalpies may be taken as 
h = h g {T bv ) [15.21.45] 

ho = hf(T x ) [15.21.46] 


zq, = j_ /m i/2 r K-hoo 
i?a 2 EoKpJ [h s {T bv )-h x 


[15.21.50] 


where the subscript tp denotes two-phase. 

Utilizing Equations 15.21.45—15.21.47, the last factor in 
Equation 15.21.50 is modified to give 


% * J (Pa \ ' 1 ' 11 - *5)V,* 
B* WoKpJ Cpg(Too-T bp ) 


[15.21.51] 


where c pg is the specific heat of the gaseous phase. 

As an illustration, consider the example given by the 
authors of an ammonia jet in one of the Desert Tortoise 
ammonia release trials, described by Goldwire (1986) and 
considered in more detail in Section 15.3. This example is 
summarized in Table 15.41. 


15.22 Dense Gas Dispersion 

The account given so far of gas dispersion has been 
confined to the dispersion of gases of neutral buoyancy, 
or passive dispersion. A large proportion of industri¬ 
ally important gases exhibit negative buoyancy. It is 
these gases particularly which are prominent in hazard 
assessment. 

An account of the dispersion of dense, or heavy, gases 
is given in this and following sections. Section 15.23 
deals with source terms; Section 15.24 with models and 
modelling; Section 15.25 with modified conventional mod¬ 
els; Sections 15.26-15.28 with some principal box models; 
Sections 15.29—15.33 with some if-theory and other three- 
dimensional models; Section 15.34 with the Workbook ; 
Section 15.35 with the DRIFT three-dimensional model; 
Section 15.36 with some other models; Sections 15.37 and 
15.38 with field trials; Section 15.39 with physical model¬ 
ling; Section 15.40 with terrain, obstructions and build¬ 
ings; Section 15.41 with validation and comparison; Section 
15.42 with particular gases; and Sections 15.43 and 15.44 
with elevated plumes and an elevated plume model. Further 
aspects of dense gas dispersion are treated in Section 15.45 
on concentration and concentration fluctuations; Sections 
15.46 and 15.47 on flammable and toxic gas clouds; Section 
15.48 on dispersion over short ranges; Section 15.49 on 
hazard ranges for dispersion; and Sections 15.53 and 15.54 
on vapour cloud mitigation. Selected references on dense 
gas dispersion are given in Table 15.42. 


hoo = h g (T 0 o) [15.21.47] 

where the subscript bp denotes boiling point. 


15.22.1 Dense gas 

Many of the more hazardous gases such as hydrocarbons, 
chlorine, ammonia and hydrogen fluoride, and oxygen, are 
capable of giving a gas cloud that is denser than air. 
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Table 15.41 Illustrative calculation for a two-phase 
flashing jet of liquefied ammonia from pressure storage 
(after Fauske and Epstein, 1988) (Courtesy of Butterworth- 
Heinemann) 


A Scenario 


Atmospheric pressure = 1.01 x 10 5 Pa 
Density of ambient air = 1.1 kg/m 3 
Orifice diameter d b = 0.0945 m 
Storage temperature 7/, = 297 K (24°C) 

Storage pressure P 0 = 1.4 x 10 s Pa 
Discharge velocity u t = 22.7 m/s 
Pressure of jet at discharge conditionsPb = 0.968 x 10 6 Pa 
Density of jet at discharge conditions p b = 603 kg/m 3 
Density of gaseous ammonia at discharge conditions 
(boilingpoint, atmospheric pressure) p g = 0.89 kg/m 3 
Specific heat of liquid ammonia c P £ = 4.46 x 10 3 J/kgK 
Specific heat of gaseous ammonia c ?g = 10 3 J/kg K 
Latent heat of vaporization of ammonia fef g = 1.37 x 10 6 J/kg 
Normal boiling point of ammoniaT bp = 240 K (-33°C) 
Entrainment coefficient E 0 = 0.116 


Quality at end of depressurization zone: 

= Cp f (T 0 - T bp )//i fg = 4.46 x 10 6 (297 - 240)/ 
1.37 x 10 6 = 0.19 

Density of jet at end of depressurization zone: 

Pa ~ p g / x a = 0.89/0.19 = 4.68 kg/m 3 
Velocity of the jet at end of depressurization zone: 

«a = M b +(-Pb— P^lu^pb 

= 22.7 + (0.968 x 10 6 - 0.101 x 10 6 )/(22.7 x 603) 
= 86 m/s 

Radius of jet at end of depressurization zone: 

_ 0.0945 / 22.7 x 603 \ 1/2 
2 ^ 86 x 4.68 ) 

= 0.275 m 


Distance to end of two-phase jet zone: 

, n 1 f PaV /2 M^a) 

tp a 2 E 0 \p) Cpg^-Tbp) 

= 0 075 1 A.68\ 1/2 1.37 x 10 6 (1 - 0.19) 

' 2 x 0.116 ^ 1.1 J 103(306 - 240) 

= 39.1 m 


Velocity at end of two-phase jet zone: 




= 86[l + 2 
= 5.06 m/s 


0.116 


/ 1.1 \V 2 39.1 -i-i 
V4.68/ 0.275 J 


Radius at end of two-phase jet zone: 



= 9.6 m 


a The numerical values in this example have been revised after con¬ 
sultation with one of the authors (HKF). 


Table 15.42 Selected references on dense gas 
dispersion 


Howerton (n.d., 1969); Abbott (1961); Joyner and Durel 
(1962); J.S. Turner (1966); Hoult, Fay and Forney (1969); 
Feldbauer et d. (1972); Humbert-Basset and Montet (1972); 
MacArthur (1972); Yang and Meroney (1972); Bodurtha, 
Palmer and Walsh (1973); Hoot, Meroney and Peterka 
(1973); Simmons, Erdmann and Naft (1973,1974); Battelle 
Columbus Laboratories (1974); Hoot and Meroney (1974); 
Kneebone and Prew (1974); Lutzke (1974); Buschmann 
(1975); Germeles and Drake (1975); Simmons and Erdmann 
(1975); Anon. (1976 LPB10, p. 10); McQuaid (1976b, 1979a,b, 
1980,1982a,b, 1984a-c, 1985a); Havens (1977,1980,1982b, 
1985,1986,1987,1992); Kletz (1977i); US Congress, OTA 
(1977); HSE (1978b, 1981a); Slater (1978a); Britter (1979, 
1980,1982,1988a,b); Gutsche, Ludwig and Vahrenholt 
(1979); Harvey (1979b); R. A Cox et d. (1980); Fiedler and 
Tangermann-Dlugi (1980); Flothmann and Nikodem (1980); 
Forster, Kramer and Schon (1980); Hartwig (1980a,b, 
1983a,b, 1986a,b); Hartwig and Flothmann (1980); 
Kinnebrock (1980); Klauser (1980); McNaughton and 
Berkowitz (1980); Schnatz and Flothmann (1980); Bloom 
(1980); Fay (1980,1984); Kaiser (1980,1982a, b); Shell 
Research Ltd (1980); Dirkmaat (1981); Fay and Ranck 
(1981,1983); Jagger and Kaiser (1981); Jensen (1981,1984); 
Snyder (1981); Anon. (1982f); Blackmore, Eyre and 
Summers (1982); Blackmore, Herman and Woodward 
(1982); Britter and Griffiths (1982); Farmer (1982 SRD 
R221); R.F. Griffiths and Kaiser (1982); Gunn (1982,1984); 
N.C. Harris (1982,1983,1986); Hogan (1982); Jagger (1982, 
1983); List (1982); Meroney (1982,1984a,b, 1985,1987a,b); 
Zeman (1982a,b, 1984); Astleford, Morrow and 
Buckingham (1983); Byggstoyl and Saetran (1983); 
Emblem and Fannelop (1983); Havens and Spicer (1984); 
Pikaar (1983,1985); Schnatz, Kirsch and Heudorfer (1983); 
Anon. (1984q,y); Emblem, Krogstad and Fannelop (1984); 
Fanaki (1984); Hartwig, Schatz and Heudorfer (1984); 
Jacobsen and Fannelop (1984); Jensen and Mikkelsen 
(1984); A.G. Johnston (1984,1985); Knox (1984); Webber 
(1984); Barrell and McQuaid (1985); Ermak and Chan 
(1985); Fay and Zemba (1985,1986,1987); Raj (1985); Spicer 
(1985); Alp etd. (1986); Bachlin and Plate (1986); Brighton 
(1986,1988); Duijm et d. (1986); Fannelop and Zumsteg 
(1986); Heinhold etd. (1986); Heudorfer (1986); Layland, 
McNaughton and Bodmer (1986); Riou (1986); Schnatz 
(1986); M.T.E. Smith etd. (1986); Verhagen and Buytenen 
(1986); Bettis, Makhviladze and Nolan (1987); N.E. Cooke 
and Khandhadia (1987a,b); Emerson (1987a); S.R. Hanna 
(1987b); Jacobsen and Magnussen (1987); Raj, 
Venkataraman and Morris (1987); Redondo (1987); 
Schreurs and Mewis (1987); Schreurs, Mewis and 
Havens (1987); Webber and Wheatley (1987 SRD R437); 
Cave (1988); Doury (1988); C.D. Jones (1988); Mercer 
(1988); Shaver and Fornery (1988); Kakko (1989); 

Nielsen and Jensen (1989); Vergison, van Diest and Easier 
(1989); Askari etd. (1990); Chaineaux and 
Mavrathalassitis (1990); Cleaver and Edwards (1990); 
Matthias (1990,1992); P.T. Roberts, Puttock and Blewitt 
(1990); Schulze (1990); Witlox (1990); J.L. Woodward 
(1990,1993); Ayrault, Balint and Morel (1991); Ermak 
(1991); Huerzeler and Fannelop (1991); Mercer and Porter 
(1991); J.K.W. Davies (1992); Van Dop (1992); Anfossi etd. 
(1993); Cauffleld etd. (1993); Webber and Wren (1993 SRD 
R552) 
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Density effects, gravity currents 

Penney and Thornhill (1952); Keulegan (1957); NBS (1957 
Rep. 5482,1958 Rep. 5831); Stoker (1957); Ellison and 
Turner (1959); Lofquist (1960); Middleton (1966); Benjamin 
(1968); Hoult (1972b); van Ulden (1974); Kantha, Phillips 
and Azad (1977); Britter and Simpson (1978); J.C.R. Hunt 
etal. (1978); Britter (1979); Fischer et al. (1979); Simpson and 
Britter (1979); Brighton (1980 SRD R444); Britter and 
Linden (1980); Huppert and Simpson (1980); Yih (1980); 
Beghin, Hopflnger and Britter (1981); Jagger (1982 SRD 
R238); Simpson (1982,1987); Crapper (1984); J.C.R. Hunt, 
Rottman and Britter (1984); Kranenberg (1984); Rottman 
and Simpson (1984a,b); Stretch, Britter and Hunt (1984); 
Zeman (1984); Grundy and Rottman (1985); Stretch (1986); 
Britter and Snyder (1988); Carruthers and Hunt (1988); 
Darby and Mobbs (1988); J.C.R. Hunt, Stretch and Britter 
(1988); J.C. King (1988); Linden and Simpson (1988); 
McGuirk and Papadimitrou (1988) 

Source terms 

NRC (Appendix 28 Source Terms); HSE (1978b, 1981a); 
Rijnmond Public Authority (1982); Zeman (1982a,b); 
Mudan (1984a); Wheatley (1986); Fauske and Epstein (1987, 
1988,1989); C. Harris (1987);Webber and Wheatley (1987); 
Britter and McQuaid (1988); Puttock (1988a, 1989); 
Chikhliwala etal. (1989); Lannello etal. (1989); Kaiser 
(1989); J.L Woodward (1989a); Finch and Serth (1990); 
Matthias (1990,1992); J. Singh, Cave and McBride (1990); 
McFarlane (1991); Webber (1991); Lantzy (1992); de Nevers 
(1992); Spadoni etal. (1992). 

Release inside buildings: Brighton (1989 SRD R467); 
Raman (1993) 

Heat transfer, thermodynamic effects 

Andreiev, Neff and Meroney (1983); Meroney and Neff 
(1986); Ruff, Zumsteg and Fannelop (1988) 

Buildings, obstacles, complex terrain 

D.J. Hall, Barrett and Ralph (1976); Brighton (1978,1986); 
Kothari and Meroney (1979,1982); Raupach,Thorn and 
Edwards (1980); Kothari, Meroney and Neff (1981); 
Meroney (1981,1992); Britter (1982,1988a); Deaves (1983a, 
1984,1985,1987a,b, 1989); Robins and Fackrell (1983); 
Chan and Ermak (1984); Chan, Rodean and Ermak (1984); 
Gunn (1984); Jensen (1984); de Nevers (1984b); Guldemond 
(1986); Krogstad and Pettersen (1986); McQuaid (1986); 
Riou and Saab (1986); Heinhold, Walker and Paine (1987); 
Britter and Snyder (1988); Britter and McQuaid (1988); 
Carissimo etal. (1989);Vergison, van Diest and Easier 
(1989); Briggs,Thompson and Snyder (1990); Deaves and 
Hall (1990); Snyder (1990); M. Nielsen (1991); Brighton et al. 
(1992 SRD R583); Jones et al. (1992 SRD R582); Kukkonen 
and Nikmo (1992); Nikmo and Kukkonen (1992); Webber, 
Jones and Martin (1992,1993); Castro et cd. (1993); S.J. Jones 
and Webber (1993); Duijm and Webber (1994); Perdikaris 
and Mayinger (1994) 

Physical modelling, wind tunnels, water flumes 

D.J. Hall, Barrett and Ralph (1976); Neff, Meroney and 
Cermak (1976); Meroney etal. (1977); BRE (1978 CP71/78); 
D.J. Hall (1979a,b); Isyumov and Tanaka (1979); Kothari and 
Meroney (1979,1982); Meroney (1979b, 1981,1982,1985, 
1986,1987a,b); Meroney and Lohmeyer (1979,1981,1982, 
1983,1984); J.C.R. Hunt (1980); Meroney, lindley and Bowen 
(1980); Meroney and Neff (1980,1981,1984,1985); 

T.B. Morrow (1980); Raupach,Thorn and Edwards (1980); 


Hansen (1981); Kothari, Meroney and Neff (1981); 
Lohmeyer, Meroney and Plate (1981); Neff and Meroney 
(1981,1982); D.J. Hall, Hollis and Ishaq (1982,1984); 

C. I. Bradley and Carpenter (1983); Cheah, Cleaver and 
Milward (1983a); Meroney et al. (1983); Wighus (1983); 
Builtjes and Guldemond (1984); Cheah etal. (1984); Morrow, 
Buckingham and Dodge (1984); M.E. Davies (1985); 

D. J. Hall and Waters (1985,1989); van Heugten and Duijm 
(1985); Krogstad and Pettersen (1986); Riethmuller (1986); 
Schatzmann, Koenig and Lohmeyer (1986); Bachlin and 
Plate (1987); Knudsen and Krogstad (1987); R.L. Petersen 
and Ratcliff (1989); Blewitt etal. (1991); D.J. Hall, Kukadia 
et al. (1991); D.J. Hall, Waters et al. (1991); Moser et al. (1991); 
Seong-Hee Shin, Meroney and Williams (1991); ASME 
(1992 DSC 36); Heidorn etal. (1992); Havens,Walker and 
Spicer (1994); P.T. Roberts and Hall (1994) 

Concentration fluctuations 

Chatwin and Sullivan (1980); Chatwin (1982a,b, 1983, 
1991); R.F. Griffiths and Megson (1982,1984); Meroney and 
Lohmeyer (1983); Cam and Chatwin (1985); Misra (1985); 
Carn (1987); Mole and Chatwin (1987); Cam, Sherrell and 
Chatwin (1988) 

Models 

API (Appendix 28,1986/16,1987 Publ. 4459,1989 Publ. 
4491,4492, DR 229,1990 Publ. 4522,4523,1992 Publ. 4539, 
4540,4545-4547,1993 Publ. 4559,4577); Considine (1981); 
Blackmore, Herman and Woodward (1982); J.L. Woodward 
etal. (1982,1983); S.R. Hanna and Munger (1983); R.L. Lee 
etal. (1983); Ministry of Environment, Canada (1983,1986); 
Scire and Lurmanis (1983); Grint (1984 SRD R315); Kunkel 
(1985);Whitacre etal. (1986); Havens, Spicer and Schreurs 
(1987a,b); Betts and Haroutunian (1988); Kaiser (1989); 
Nussey, Mercer and Clay (1990); Gudivaka and Kumar 
(1990); Zapert, Londergan and Thistle (1990); Goyal and 
Al-Jurashi(1991); S.R. Hanna, Strimaitis and Chang 
(1991a);Touma etal. (1991); S.R. Hanna etal. (1992); 

S.R. Hanna, Chang and Strimaitis (1993); Kumar, Luo 
and Bennett (1993); Brighton etal. (1994); S.R. Hanna 
(1994); Kinsman etal. (1994). 

Eidsvik model: Eidsvik (1978,1980,1981a,b); Havens and 
Spicer (1983) 

van Ulden model: van Ulden (1974,1979,1984,1988); 
van Ulden and de Haan (1983) 

BG/C& W model: R. A. Cox and Roe (1977); R. A. Cox 
and Carpenter (1980); C.I. Bradley etal. (1983); 

Carpenter etal. (1987) 

TNO models: van den Berg (1978) 

VKI models: Foussat (1981); van Dienst etal. (1986) 
COBRA: Alp (1985); Alp and Mathias (1991) 

DENZ, CRUNCH: Fryer and Kaiser (1979 SRD R152); 
Jagger (1983 SRD R229); Jagger (1985 SRD R277); 
Wheatley, Brighton and Prince (1986) 

DISP2: Fielding, Preston and Sinclair (1986); Preston and 
Sinclair (1987) 

SIGMET: England etal. (1978); Havens (1979,1982a); Su 
and Patniak (1981); Havens and Spicer (1983); Havens, 
Spicer and Schreurs (1987a,b) 

HEAVYGAS, SLUMP: Deaves (1985,1987a, 1992) 
MARIAH-II: Taft, Rhyne and Weston (1983); Havens, 
Schreurs and Spicer (1987); Havens, Spicer and Schreurs 
(1987a,b) 

MERCURE-GL: Riou and Saab (1986); 

Riou (1987,1988) 
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SLAB, FEM3: Chan, Gresho and Ermak (1981); Ermak, 
Chan et al. (1982); Zeman (1982a,b); Chan (1983); R.L Lee 
etal. (1983); D.L Morgan, Morris and Ermak (1983); Chan 
and Ermak (1984); Chan, Rodean and Ermak (1984); 

D.L. Morgan (1984); D.L. Morgan, Kansa and Morris (1984); 
Rodean etal. (1984); Leone, Rodean and Chan (1985); 
Ermak and Chan (1986,1988); Rodean and Chan (1986); 
Chan, Ermak and Morris (1987); Chan, Rodean and Blewitt 
(1987); Havens, Spicer and Schreurs (1987a,b); Zapert, 
Londergan and Thistle (1990); S.R. Hanna, Strimatis and 
Chang (1991b);Touma etal. (1991) 

HEGADAS: Te Riele (1977); Colenbrander (1980); 

J.L. Woodward et al. (1982); Colenbrander and Puttock 
(1983); Havens and Spicer (1983); Puttock (1987b,c, 1988a, 
1989); Zapert, Londergan and Thistle (1990); S.R. Hanna, 
Strimatis and Chang (1991b); Moser et al. (1991) 
HEGABOX: Puttock (1987b,c, 1988a); S.R. Hanna, 
Strimatis and Chang (1991a); Moser et al. (1991) 
HGSYSTEM: McFarlane etal. (1990); Rees (1990);Witlox et 
al. (1990); McFarlane (1991); Puttock etal. (1991) 

PLUME: McFarlane (1991) 

ADREA: Andronopoulos etal. (1993); Statharas etal. (1993) 
DEG ADIS: Havens (1985,1986,1992); Havens and Spicer 
(1985); Spicer and Havens (1986,1987); Spicer et al. (1986); 
Spicer, Havens and Kay (1987); Havens, Spicer and 
Guinnup (1989); Zapert, Londergan and Thistle (1990); 
Hanna, Strimatis and Chang (1991a); Havens etal. (1991); 
Moser et al. (1991); Touma etal. (1991) 

CHARM: Fabrick (1982); Radian Corporation (1986); 
Zapert, Londergan and Thistle (1990); Hanna, Strimatis 
and Chang (1991a); HSE Workbook: McQuaid (1982b); 
Britter and McQuaid (1987,1988) 

DRIFT: Byren etal. (1992 SRD R553); Edwards (1992 SRD 
R563); Webber etal. (1992 SRD R586, R587); Webber and 
Wren (1993 SRD R552) 

Experimental trials 

AGA (1974/20-23); Buschman (1975); HSE (1978 RP 8); 
Puttock, Blackmore and Colenbrander (1982); Puttock and 
Colenbrander (1985a); Lewellen and Sykes (1986); 
Heinrich, Gerold and Wietfeldt (1988); Havens (1992). 

AGA: Feldbauer et al. (1972); Drake, Harris and Reid (1973) 
China Lake: Ermak etal. (1983) 

Porton Down: Picknett (1978a-c, 1981); McQuaid 
(1979a,b); Anon. (1981J); D.J. Hall, Hollis and Ishaq (1982, 
1984); Kaiser (1982b); Heudorfer (1986) 

Maplin trials: Anon. (1982f); Puttock, Blackmore and 
Colenbrander (1982); Puttock, Colenbrander and 
Blackmore (1983,1984); Colenbrander and Puttock (1984) 
Nevada Test Site: Koopman and Thompson (1986); 
Koopman etal. (1986) 

LLNL: Hogan (1982); Koopman, Ermak 
and Chan (1989) 

Experimental trials: Thorney Island 

McQuaid (1982b, 1984b,c, 1985a-c, 1987); HSE (1984 RP 
24); Brighton (1985a, 1985 SRD R319,1987); Brighton, 
Prince and Webber (1985); Cam and Chatwin (1985); CEC 
(1985 EUR 9933 EN, EUR 10029 EN); M.E. Davies and 
Singh (1985a, b); Deaves (1985); Gotaas (1985); R.F. Griffiths 
and Harper (1985); D.J. Hall and Waters (1985); N.C. Harris 
(1985); Hartwig (1985); van Heugten and Duijm (1985); 
D.R. Johnson (1985); Leek and Lowe (1985); Nussey, Davies 
and Mercer (1985); Pfenning and Cornwell (1985); Prince, 
Webber and Brighton (1985 SRD R318); Puttock 


(1985,1987a-c); Puttock and Colenbrander (1985b); 
Riethmuller (1985); Roebuck (1985); Rottman, Hunt and 
Mercer (1985); Rottman etal. (1985); Spicer and Havens 
(1985); Wheatley, Prince and Brighton (1985,1985 SRD 
R355); Wheatley, Brighton and Prince (1986); Brighton and 
Prince (1987); Cabrol, Roux and Lhomme (1987); Cam 
(1987); Carpenter et al. (1987); Chan, Ermak and Morris 
(1987); Cornwell and Pfenning (1987); J.K.W. Davies (1987); 
M.E. Davies and Inman (1987); Havens, Schreurs and 
Spicer (1987); Knudsen and Krogstad (1987); Mercer and 
Davies (1987); Mercer and Nussey (1987); Riou (1987,1988); 
Sherrell (1987); van Ulden (1987); Wheatley and Prince 
(1987); Cam, Sherrell and Chatwin (1988); Carissimo etal. 
(1989); Andronopoulos etal. (1993) 


Particular chemicals 

Ammonia: HSE/SRD (HSE/SRD/WP13,14,16,22 and 
unnumbered); W.L. Ball (1968b); Rohleder (1969); Comeau 
(1972); MacArthur (1972); J.D. Reed (1974); Lonsdale (1975); 
Luddeke (1975); HSE (1978b, 1981a); Kaiser and Walker 
(1978); Slater (1978a); R.F. Griffiths and Kaiser (1979 SRD 
R154,1982); Haddock and Williams (1979); Kaiser (1979 
SRD R150,1980,1981LPB 38,1982,1989); Blanken (1980); 
Kaiser and Griffiths (1982); R.F. Griffiths and Megson 
(1984); Goldwire (1985,1986); Goldwire etal. (1985); 
Guldemond (1986); Koopman etal. (1986); Chan, Rodean 
and Blewitt (1987); Koopman, Ermak and Chan (1989); 

J. Singh and McBride (1990); S.R. Hanna, Strimaitis and 
Chang (1991a); Statharas et al. (1993) 

Antiknock compounds: HSE/SRD (HSE/SRD/WP17) 
Chlorine: McClure (1927); Ministry of Social Affairs 
(1975); R.F. Griffiths and Megson (1984); Riethmuller 
(1986); Wheatley (1986 SRD R357); Clough and Wheatley 
(1988 SRD R396); Vergison, van Dienst and Easier (1989); J. 
Singh and McBride (1990) 

Hydrogen fluoride: Beckerdite, Powell and Adams (1968); 
Bosch and de Kayser (1983); Blewitt etal. (1987a,b); Chan, 
Rodean and Blewitt (1987); Chikhliwala and Hague (1987); 
Clough, Grist and Wheatley (1987); Schotte (1987,1988); 
Koopman, Ermak and Chan (1989); Holve etal. (1990); 
Leone (1990); R.L. Petersen and Diener (1990); Blewitt et al. 
(1991); Fthenakis, Schatz and Zakkay (1991); S.R. Hanna, 
Strimaitis and Chang (1991a); Meroney (1991); Moser 
(1991); Puttock, MacFarlane, Prothero and Roberts etal. 
(1991); Antonello and Buzzi (1992); Schatz and Fthenakis 
(1994); Webber, Mercer and Jones (1994) 

LNG: HSE/SRD (HSE/SRD/WP21); Fay (1973); AGA (1974/ 
20-23,1978/27); Duffy, Gideon and Puttnam (1974); Drake 
and Puttnam (1975); Fay and Lewis (1975); Meroney, 
Cermak and Neff (1976); Neff, Meroney and Cermak (1976); 
Havens (1977,1978,1979,1980,1982a); Meroney etal. (1977); 
England etal. (1978); Koopman, Bowman and Ermak 
(1980); Meroney and Neff (1980,1981,1984,1985); Hogan, 
Ermak and Koopman (1981); Kothari, Meroney and Neff 
(1981); Neff and Meroney (1981,1982); TNO (1981 Rep. 
81-07020); Blackmore, Eyre and Summers (1982); Ermak 
etal. (1982); D.J. Hall, Hollis and Ishaq (1982); Hogan (1982); 
Koopman etal. (1982); Rodean (1982,1984); Ermak etal. 
(1983); Goldwire etal. (1983); Havens and Spicer (1983); 
Meroney etal. (1983); Chan and Ermak (1984); D.L. Morgan 
etal. (1984); Rodean etal. (1984); Misra (1985); Havens, 
Spicer and Schreurs (1987a,b); Leone (1990); Havens etal. 
(1991); Seong-Hee Shin, Meroney and Williams (1991); 
Chan (1992) 
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Propane, LPG: Puttock, Colenbrander and Blackmore 
(1983);Wighus (1983); Meroney and Lohmeyer (1984) 

Other gases: McRae etal. (1983); McRae (1986); Koopman 
et d. (1986) 

Dispersion of aersosols 
J.L. Woodward (1989) 

Visibility of cloud 

CCPS (1988/3); De Nevers (1992) 

Mitigation sytems 

RW. Johnson etal. (1989); Hague (1992); Prugh (1992b); 
Buchlin (1994) 

Vapour barriers, fences: R.L. Petersen and Diener (1990); 
Chan (1992) 

Gas curtains: Rulkens etal. (1983) 

Steam, curtains: Cairney and Cude (1971); Simpson (1974); 
Seifert, Maurer and Giesbrecht (1983); Sato (1989); Lopez et 
al. (1990); Earth (1992) 

Water curtains: Rasbash and Stark (1962); Buschmann 
(1975); McQuaid (1975,1976a, 1977,1980,1982b); Ministry 
of Social Affairs (1975); Eggleston, Herrera and Pish (1976); 
Heskestad, Kung and Todtenkopf (1976); Vincent et al. 
(1976a,b); JW. Watts (1976); Benedict (1977); HSE (1978 TP1, 
1978b, 1981a); van Doom and Smith (1980); Beresford 
(1981); Greenwood (1981); N.C. Harris (1981a); IChemE 
(1981/123); McQuaid and Fitzpatrick (1981,1983); Moodie 
(1981,1985); P.A.C. Moore and Rees (1981); J.M. Smith and 
Doom (1981); Zalosh (1981); McQuaid and Moodie (1982, 
1983); Deaves (1983b); De Faveri etal. (1984); Kirby and 
Deroo (1984); Emblem and Madsen (1986); Blewitt etal. 
(1987b); NIOSH (1987/10); Fthenakis and Zakkay (1990); 
Holve etal. (1990); Lopez etal. (1990); Schatz and Koopman 
(1990); Fthenakis, Schatz and Zakkay (1991); Lopez, Lieto 
and Grollier-Baron (1991); Meroney (1991); Meroney and 
Seong-Hee Shin (1992); St Georges etal. (1992a,b); 
Fthenakis (1993); Fthenakis and Blewitt (1993); Ratcliff 
etal. (1993); Schatz and Fthenakis (1994) 

Jets and plumes 

Bodurtha (1961,1980,1988); Ooms (1972); J.L. Anderson, 
Parker and Benedict (1973); Bodurtha, Palmer and Walsh 
(1973); Hoot, Meroney and Peterka (1973); Ooms, Mahieu 
and Zelis (1974); Chu (1975); Meroney (1979b); Blooms 
(1980); Giesbrecht, Seifert and Leuckel (1983); Hirst (1984, 
1986); Jagger and Edmundson (1984); Ooms and Duijm 
(1984); Emerson (1986a,b, 1989); Li Xiao-Yun, Leijdens and 
Ooms (1986);Tarn and Cowley (1989); J.L.Woodward 
(1989a); Epstein, Fauske and Hauser (1990); D.K. Cook 
(1991b); McFarlane (1991); Schatzmann, Snyder and 
Lawson (1993) 

Hazard assessment 

R.A. Cox and Roe (1977); Air Weather Service (1978); HSE 
(1978b, 1981a); Wu and Schroy (1979); Cornell and Church 
(1980); Doron and Asculai (1983); Barboza, Militana and 
Haymes (1986); Gebhart and Caldwell (1986); Hart (1986); 
Kasprak,Vigeant and McBride (1986); Layland, 
McNaughton and Bodmer (1986); Schewe and Carvitti 
(1986); Shea andjelinek (1986); Costanza etal. (1987); 
Fauske and Epstein (1987); Nussey and Pape (1987); Paine, 
Smith and Egan (1987); Studer, Cooper and Doelp (1988); 
English and Waite (1989) 

Accident simulation 

M.P. Singh and Ghosh (1987); Fay (1988); Billeter and 


Fannelop (1989); M.P. Singh (1990); M.P. Singh, Kumari and 
Ghosh (1990) 

Incident investigation 

Vegetation damage: Benedict and Breen (1955); Hindawi 
(1970); Jacobson and Hill (1970); Booij (1979) 


Whether ornotaparticulargas release forms a gas cloud that 
is denser than air depends on a number of factors.These are: 

(1) the molecular weight of the gas; 

(2) the temperature of the gas; 

(3) the presence of liquid spray; 

(4) the temperature and humidity of the air. 

A gas cloud may be dense by virtue of the molecular 
weight of the gas released. However, even if the molecular 
weight of the gas is less than that of air, the gas cloud may 
be rendered dense by other factors. If the boiling point of 
the gas is low so that the gas cloud is cold, this may be suf¬ 
ficient to make the cloud dense. 

The presence of liquid spray is another factor that can 
render the cloud dense. The effect of vaporization of the 
droplets of liquid is to remove heat from the gas and so cool it. 

The density of the cloud is also affected by the humidity 
of the ambient air. The effect of the condensation of the 
droplets of water is to add heat to the gas. In general, the 
cloud will tend to have a higher density when mixed with 
dry air than with wet air. 

The effect of molecular weight and temperature may be 
illustrated by considering the densities of gas clouds from 
releases of chlorine, methane and ammonia into dry air.The 
molecular weight of chlorine (71) is much greater than that 
of air (28.9) and thus gives a cloud heavier than air at 
ambient temperature. The cloud given by chlorine at its 
boiling point (-34°C) is even heavier. 

Methane (mol. wt. 16) is much lighter than air at ambient 
temperature. But the cloud given by methane at its boiling 
point (-161°C) is heavier than air. Ammonia (mol. wt. 17) is 
much lighter than air at ambient temperature. The cloud 
given by ammonia at its boiling point (-33°C) is also 
lighter than air. But ammonia clouds tend to be denser than 
air due to presence of liquid spray. 

There is now ample evidence, both from experiments 
and incidents, that releases of liquefied gas such as pro¬ 
pane, LNG, ammonia, chlorine and hydrogen fluoride give 
rise to dense gas clouds. 

As the gas cloud is diluted, the concentration, and the 
relative density, decrease and the mode of dispersion 
changes from dense gas dispersion to passive dispersion of 
a neutrally buoyant gas. 

15.22.2 van Ulden’s experiment 

Experimental work on the dispersion of a heavy gas has 
been described by van Ulden (1974). Some results from this 
work are shown in Figure 15.76. Figures 15.76(a) and (b) 
show, respectively, the growth of the height and radius of 
the dense gas cloud from an instantaneous release at 
ground level. The first part of the curve in the former figure 
shows the initial sharp decrease in cloud height due to 
gravity slumping, followed by a gradual increase in height. 
The height is much less and the radius much greater than 
that predicted by the Gaussian model, which overestimates 
the height and underestimates the radius by factors of 5 and 
2.5, respectively. 
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The flow is gravity driven in both the first two stages. 
The first stage is normally described as gravity slumping. 
The second stage is gravity-driven flow with stable strati¬ 
fication. The term‘gravity spreading’ is applied sometimes 
to both the first two stages and sometimes only to the sec¬ 
ond stage; it is used here in the latter sense. The third stage 
is one of passive dispersion. 

Gravity-driven flow is illustrated in Figure 15.77, which 
shows shadowgraphs taken in a water tunnel, these illus¬ 
trate the intrusion of a more dense fluid into a less dense 
one on surfaces of different slopes. Features are the ‘head’ at 
the leading edge of the denser fluid and the mixing at the 
horizontal interface between the two fluids. 

The density difference between the cloud and the atmos¬ 
phere, or density excess, has four main effects. First, it 
imparts a strong horizontal velocity to the cloud. Second, it 
creates velocity shear. Third, it inhibits vertical mixing by 
atmospheric turbulence through the top of the cloud. 
Fourth, it affects the inertia of the cloud. 

The inhibition of vertical mixing by atmospheric turbu¬ 
lence through the top of the cloud means that the mixing is 
less sensitive to the stability conditions. Vertical mixing 
still occurs, however, due to other forms of turbulence 
in the cloud. Moreover, the inhibition of mixing by 
atmospheric turbulence is counteracted by the creation of 
a large top surface area on the cloud due to gravity 
spreading. 

If the ratio of the density difference to the density of the 
atmosphere, or reduced density, is small, an important 
approximation may be made. This is to neglect the effect of 
the density difference on the inertia. This is the Boussi- 
nescq approximation and it is widely used in dense gas 
dispersion modelling. 


Figure 15.76 Dutch Freon 12 trial on dense gas disper¬ 
sion (van Ulden, 1974): (a) growth of height; (b) growth 
of radius (Courtesy of Elsevier Publishing Company) 


Van Ulden formulated a model for dense gas dispersion 
which was influential in the development of the topic. This 
is described in Section 15.26. 


15.22.3 Experimental work 

Experimental work bearing on dense gas dispersion 
includes not only field trials but also physical modelling in 
wind tunnels and water flumes, the latter being often on the 
laboratory scale. The work on field trials is described in 
Sections 15.37 and 15.38 and the physical modelling in 
Section 15.3(2). The laboratory experiments are referred to 
in discussion of the particular aspects to which they relate. 

15.22.4 Dense gas behaviour 

The behaviour of a dense gas may be described by con¬ 
sidering the development of the gas cloud from the burst¬ 
ing of a vessel. The source term for this is usually modelled 
by assuming that air is entrained in a ratio of some 10-20:1 
and that a cloud of unit aspect ratio is formed. 

The behaviour of the cloud is influenced by gravity. 
Three stages may be distinguished: 

(1) gravity slumping; 

(2) gravity spreading; 

(3) passive dispersion. 


15.22.5 LNG spill study 

Another piece of work which was influential in the devel¬ 
opment of the topic was the study for the US Coast Guard 
by Havens (1978) of the hazard range from a spill of 
25,000 m 1 2 3 of LNG onto water. The work was a comparative 
study of the predictions of the distance to the lower 
flammability limit given by seven gas dispersion models. 
These predictions ranged from 0.75 up to 50 km. Reference 
to this study was made in Chapter 9 as an illustration of 
uncertainty in modelling. It is considered again in Section 
15.41 in the context of validation of models. 


15.23 Dispersion of Dense Gas: Source Terms 

The source term can be critical for the modelling of the 
subsequent dispersion of a dense gas. It is therefore 
important that the source model should be realistic and 
complete. If the model for the source term is poor, the 
results of the whole dense gas dispersion estimate may be 
seriously in error. 


15.23.1 Release scenarios 

The modelling of release scenarios is assisted by an 
appropriate classification. Such classifications have been 
given by a number of workers, including Fryer and Kaiser 
(1979 SRD R152), Griffiths and Kaiser (1979 SRD R154) 
and Kaiser (1989). 

The main concern is the modelling of the source term for 
a release of liquefied gas. The classification given for 
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liquefied gases is 

(1) Pressurized release 

(a) small hole in vapour space, 

(b) large hole in vapour space - catastrophic failure, 

(c) intermediate-sized hole in vapour space, 

(d) hole in liquid space; 

(2) Refrigerated release 

(a) spill onto land, 

(b) spill onto water; 

(3) Jet release. 

These cases are considered in turn for a dense gas. 

15.23.2 Release from pressurized containment 

For a pressurized liquefied gas, a release from a small hole 
in the vapour space (Case 1(a)) gives rise to a vapour jet 
which loses momentum and turns into a dense gas plume. 
This is considered further in Section 15.43. 

A catastrophic failure of the vessel (Case 1(b)) results in 
the flash-off of a vapour fraction with the liquid falling to 
its normal boiling point. The vapour fraction is obtained by 
heat balance. A proportion of the residual liquid is also 
ejected as liquid droplets, or spray. The evidence is that in 
fact substantially all the residual liquid becomes airborne. 
Such a release generates considerable turbulence and 
results in the entrainment of large amounts of air. The 
liquid droplets in the cloud undergo partial evaporation 
with a further drop in their temperature. Thereafter the 


heat required for their further evaporation is taken from 
the gas cloud, which results in cooling of the cloud. 

A release from a hole of intermediate size (Case 1(c)) 
may be presumed to give as spray a liquid fraction inter¬ 
mediate between the above two cases. Work bearing on 
this is described in Section 15.10. Some simple experi¬ 
ments by A.R. Edwards (1978) suggest that the liquid 
fraction which becomes airborne is a function of the ratio 
of the hole size to the vessel area. When this ratio reached 
about 0.01 the liquid fraction ejected became appreci¬ 
able, whilst above a ratio of about 0.1 virtually all the 
liquid become airborne as spray. More detailed work is 
described in Section 15.10. 

A hole in the liquid space (Case 1(d)) gives a two-phase 
flashing jet, as considered below. 


15.23.3 Release from refrigerated containment 

For a fully refrigerated liquefied gas, a spill onto land (Case 
2(a)) results in a spreading, vaporizing pool. If the spill is 
into a bund, the size of the pool is constrained by the bund. 
Otherwise, the pool spreads until the liquid depth is so 
small that spreading ceases and break-up occurs. If the 
release is violent, there is a possibility that the wave created 
will spill over the edge of the bund. 

The vaporization from the pool is a function of the area of 
the pool and of the rate of vaporization per unit area. The 
vaporization process is governed by the heat transfer from 
the surface to the liquid, which is initially high but rapidly 
falls off as the surface chills. 



Figure 15.77 Continued 
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(c) 


Figure 15.77 Water tunnel modelling of the intrusion of a more dense fluid into a less dense one on flat and on sloping 
surface (Britter and Linden, 1980: (a) slope 0°; (b) slope 5°; (c) slope 20°. The entrainment increases with slope both into 
the head and into the flow behind it (Courtesy of Cambridge University Press) 
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For a pool of fixed size filled rapidly, the pattern is one of 
very high vapour flow for a short initial period, lasting 
perhaps a minute, followed by rapid and then more gradual 
decline. For a spreading pool the vapour flow tends to pass 
through a maximum. 

A spill onto water (Case 2(b)) again results in a pool 
spreading until the liquid depth becomes small and break¬ 
up occurs. The vaporization from the pool is a function of 
the area of pool and of the specific rate of vaporization. 
In this case, however, renewal of the water surface occurs 
and the heat transfer rate is constant and high. The vapour 
flow starts high and increases as the pool spreads, then 
falls off quite sharply as the pool evaporates. 

Another possible scenario is an elevated jet release. In 
this case the liquid may well vaporize completely before it 
reaches the surface. Since the heat of vaporization is 
obtained from the entrained air rather than the surface, the 
resultant gas cloud is much colder. 

15.23.4 Release from semi-refrigerated containment 

For a semi-refrigerated liquefied gas, the scenarios are 
basically similar to those for the fully pressurized case. 

The liquid is, however, at a lower pressure and a lower 
temperature. This may be expected to affect the proportion 
of the residual liquid which becomes airborne and the 
extent of rainout. The evidence is limited, but suggests that 
a semi-refrigerated release behaves broadly like a full 
refrigerated one. The main difference is that some, limited, 
degree of rainout may occur. 

15.23.5 Two-phase jets 

For a pressurized liquefied gas, a hole in the liquid space of 
a vessel or in a pipe gives a two-phase flashing jet. 
Accounts of such jets include those by Mudan (1984a), 
Wheatley (1987 SRD R410), Fauske and Epstein (1988), 
Webber and Kukkonen (1990) and Webber (1991). 

The development of such a jet proceeds through three 
zones. The first is the depressurization, or flashing, zone in 
which the vapour and liquid droplets form. This extends 
several hole diameters and increases rapidly in diameter. 
The second zone is that of the two-phase momentum jet at 
atmospheric pressure into which air is entrained. The third 
zone starts where the jet loses momentum and other dis¬ 
persion mechanisms take over. 

The jet disintegrates into a spray of liquid droplets. 
These tend to remain airborne until they evaporate rather 
than to rain out. 

Two-phase jets are considered in more detail in 
Section 15.21. 

15.23.6 Initial density 

The density of the gas cloud formed from the release 
depends on a number of factors. These include the density 
of the contaminant gas, the normal boiling point, the frac¬ 
tion of liquid present as droplets and the humidity of the 
ambient air. Typically, the density and temperature of the 
gas cloud is given as a function of the concentration of 
contaminant gas with the liquid fraction and humidity as 
parameters. The factors affecting the density of the gas 
cloud are discussed in general in Section 15.22 and, for 
particular gases, in Section 15.42. 

15.23.7 Air entrainment 

The mass of air entrained into the gas cloud is a crucial 
feature of the source model. There are available some 


estimates of the extent of entrainment for some of the sce¬ 
narios just described. 

For vaporization from a pool on land, the vapour is gen¬ 
erally taken as pure vapour and the entrainment of air is 
modelled within the dense gas dispersion model. 

For vaporization from a pool on water, the same approach 
appears often to be used. However, the turbulence gener¬ 
ated by the boiling will cause some entrainment of air. 
Kaiser (1980) has estimated this as an entrainment within 
5s of enough air to dilute the contaminant gas by a factor 
of 10. 

For catastrophic failure of a pressurized containment 
vessel, estimates have been made by Fryer and Kaiser (1979 
SRD R152) of the aspect ratio and of the mass of air 
entrained for ammonia. The gas cloud is assumed to form a 
cylinder. From field trials and incidents they suggest that 
the radius and height of this cloud be taken as equal and the 
mass ratio of air to contaminant gas as some 2:1 This 
applies to the failure of a vessel at a quite high pressure, 
with a correspondingly high degree of induced turbulence; 
the degree of entrainment may be expected to be rather less 
if the vessel pressure is lower. 

The Second Canvey Report takes for the initial cylindrical 
gas cloud a value of the aspect ratio, or ratio of diameter to 
height, of unity and this value is adopted in the Workbook 
by Britter and McQuaid (1988). 

Further discussion of such empirical estimates for cata¬ 
strophic failure is given in Section 15.8, which also gives 
models of vessel failure from which alternative estimates of 
the quantity of air entrained may he made. 

For two-phase flashing jets and for elevated jets the 
entraiment of air is part of the model for the jet. An account 
of these models is given in Section 15.21. 

15.23.8 Liquid droplets 

Another important aspect of the source term is the initial 
liquid fraction present in the gas cloud as spray, together 
with the extent to which this rains out and, if so, evaporates 
again. The methods of estimating the liquid fraction have 
been described briefly above and are dealt with in more 
detail in Section 15.10. 

The liquid droplets tend not to rain out but rather to 
evaporate. The behaviour of liquid droplets in the gas cloud 
is considered in Section 15.2. If rainout does occur, the 
liquid in the resulting pool will evaporate and the con¬ 
tribution to the source term of this re-evaporation may be 
significant. 

15.23.9 Matching to dispersion model 

For the determination of the dispersion of the material 
released, the source model has to he matched to the dis¬ 
persion model. The cases for which such matching is 
required include: 

(1) vaporization from a liquid pool; 

(2) catastrophic failure of a vessel; 

(3) two-phase flashing jet; 

(4) elevated jet. 

Vaporization from a liquid pool appears at first sight to 
constitute a relatively simple source. However, both the 
area of and the rate of heat transfer to the pool are variable. 
Therefore either the vapour flow has to be treated as an 
idealized instantaneous or continuous release or the 
dense gas dispersion model has to be able to handle a 
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time-varying release. In addition, a gas blanket may form 
above the pool. A separate submodel of this gas blanket 
may be included in the dense gas dispersion model. 

Catastrophic failure of a vessel is generally modelled by 
taking as the source term a cylindrical cloud of defined 
aspect ratio and containing a specified quantity of 
entrained air. It may then be treated by the dense gas dis¬ 
persion model as an instantaneous release. A similar 
approach may be used for a release from an intermediate 
sized hole. 

A two-phase flashing jet model may or may not be readily 
conformable with the dispersion model. Models of such jets 
are described in Section 15.21, including some which are 
designed explicitly to give a smooth transition to a dense 
gas dispersion model. 

For an elevated jet, models have been developed that 
conform with dense gas dispersion models, but the two- 
phase aspect of such jets is not well developed. The models 
for an elevated jet give two main types of output. One type 
consists simply of the touchdown distance and the con¬ 
centration at touchdown. The other gives the full profile of 
the touchdown plume, including dimensions, velocity and 
concentration. It is this latter type which gives the better 
match to a dense gas dispersion model. Both types of model 
for an elevated jet are described in Section 15.4. A jet would 
generally be expected to constitute a continuous release, 
unless the time is so short that this is not appropriate. 

The matching of emission and vaporization models to 
dispersion models is treated in the CCPS Workbook of Test 
Cases for Vapour Cloud Source Dispersion Models (1989/8). 
This is described in Section 15.52. 

15.23.10 LNG 

Treatments of the source terms for specific gases are also 
available. Source terms for LNG have been discussed by 
Kaiser (1980) and Puttock (1987c, 1988a, 1989). 

As stated above, for LNG spilled onto water evidence for 
field trials involving Refrigerant 12 suggests that the vio¬ 
lent boiling results within about 5 s in the entrainment of 
some 10 times as much air. It is not known how this effect 
scales up. 

LNG is not normally stored under pressure, but if it were 
the extent of air entrainment following catastrophic failure 
would be sufficient to dilute it close to its lower flamm¬ 
ability limit. 

An elevated jet release of LNG might well disintegrate 
and evaporate before it reached the surface. 

15.23.11 Ammonia 

Source terms for ammonia have been discussed by Kaiser 
and Walker (1978), Fryer and Kaiser (1979 SRD RR152), 
Griffiths and Kaiser (1979 SRD R154) and Kaiser (1980,1989). 
They consider in particular the field trials with Refrigerant 
12 and the ammonia release incidents at Potchefstroom in 
1973 (Case History A65), Houston in 1976 (Case History A84), 
and Pensacola in 1977, and deduce for catastrophic failure of a 
vessel rules of thumb for aspect ratio and air entrainment, as 
mentioned above and described more fully in Section 15.8. 
The work of Wheatley (1986) on two-phase flashing jets is 
concerned specifically with ammonia. 

15.24 Dispersion of Dense Gas: Models and Modelling 

The mathematical modelling of dense gas dispersion is a 
complex subject with a large literature. 


15.24.1 Types of model 

There are three broad classes of model of dense gas 
dispersion: 

(1) modified conventional models; 

(2) box and slab models; 

(3) K-theory and other three-dimensional models. 

15.24.2 Modified conventional models 

Once it was realized that some materials exhibit a degree 
of dense gas behaviour, the initial response was to attempt 
to modify existing models such as the Sutton and 
Pasquill-Gifford models, usually by making empirical 
adjustments to the diffusion parameter C or the disper¬ 
sion coefficient u. This approach is described in Section 
15.25. It was soon appreciated, however, that the behaviour 
of a dense gas is radically different from that of a neutrally 
buoyant gas and that a totally different approach is 
necessary. 

15.24.3 Box models 

A new generation of models, usually known as box models, 
was created. In the simple box model the gas cloud is 
assumed to be a pancake-shaped cloud with properties 
uniform in the crosswind and vertical directions. The 
model contains relations which describe the growth of 
the radius and height of an instantaneous release, or the 
crosswind width and height of a continuous release, and the 
entrainment of air at the top and edges of the cloud. The 
concentration in the cloud is obtained by mass balance. For 
an instantaneous release it is uniform in all three direc¬ 
tions. For a continuous release it is uniform in the cross- 
wind and vertical directions, but varies in the downwind 
direction. 

The characteristic features of a typical box model are as 
follows. The cloud shape is determined by gravity-driven 
flow. Mixing inside the cloud is sufficiently rapid that the 
cloud has uniform concentration. Air entrainment veloc¬ 
ities are specified as a function of cloud advection velocity, 
density difference and turbulence levels. 

Although simple in concept, the box model actually pla¬ 
ces considerable demands on the modeller to specify cor¬ 
rectly the various features just mentioned, such as cloud 
advection velocity and entrainment rates. In this respect it 
contrasts with the three-dimensional models described 
below, which largely take care of these aspects. In this 
sense, the apparent simplicity of the box model is decep¬ 
tive. A box model contains a small number of adjustable 
parameters. These may be determined individually by 
experiment and confirmed by field trials. 

The features of the box model for the investigation of 
dense gas dispersion have been described by McQuaid 
(1984a). A box model utilizes a top-hat concentration 
profile. McQuaid cites a number of other problems in 
fluid mechanics in which a similar ‘black box’ approach 
has been used, including the analysis of the boundary 
layer by Clauser (1954) and of plumes and of wakes by 
B.R. Morton, Taylor and Turner (1956) and B.R. Morton 
(1962). 

A box model is based on the principle of similarity. For 
dense gas dispersion the conditions necessary for similar¬ 
ity are given by McQuaid as that the gas cloud is not so 
large as to alter the ambient atmosphere and that it is not 
subject to rapid change of depth. 
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McQuaid discusses the applicability of box models for 
the assessment of releases of flammable or toxic materials. 
He concludes that for toxic releases a box model gives con¬ 
centrations which are generally sufficiently accurate, 
given the relatively high uncertainty in relations for toxic 
injury, but may be insufficiently accurate for some prob¬ 
lems which arise in relation to flammability. 

Box models are relatively simple, but have a number of 
drawbacks. One is that they are essentially limited to flat, 
unobstructed terrain and are not designed to handle terrain 
with slopes, obstructions, buildings or other special fea¬ 
tures. Another defect is the assumption of uniform con¬ 
centration which may be inadequate for assessment of 
flammability and toxicity. A box model is sometimes 
termed a bulk property (BP) model. 

Box models have been the dominant type of model used 
for dense gas dispersion and several such models are 
described below. 

15.24.4 Advanced similarity models 

Box models are simple similarity models which are based 
on assumptions about the shape of the gas cloud. A devel¬ 
opment from these is the advanced similarity models, 
which incorporate also assumptions about the concentra¬ 
tion profile. The HEGADAS model, described below, is an 
advanced similarity model. 

15.24.5 /(-theory models 

The limitations of box models have led to increasing use of 
the more fundamental if-theory models. An if-theory model 
consists of a set of equations for the conservation of mass, 
energy, momentum, and so on, together with boundary 
conditions. The model determines the variation of proper¬ 
ties, velocity and concentration along the flow streamlines. 

When the basic equations are averaged with respect to 
time certain second-order terms appear. The number of 
equations is less than the number of unknowns. It is there¬ 
fore necessary to specify some of the unknowns in terms of 
the others. This is known as ‘turbulence closure’ and much 
work has been done on methods of effecting it. In an if- 
theory model the closure is a low order one. It is effected by 
making the gradient transfer assumption. 

The model utilizes empirical relationships for the eddy 
diffusivities and eddy viscosities as a function of space, 
and sometimes also of stability category or Richardson 
number. Higher order closures are those in which addi¬ 
tional equations are derived for the Reynolds stresses (e.g. 
uw) and therefore also for the velocity concentration corre¬ 
lations (e.g. wc). The new equations include third-order 
terms which in turn have to be modelled. 

For undisturbed ambient flows if-theory models are rea¬ 
sonably satisfactory. But the presence of dense gas or 
obstructions renders them less so. In such cases the rela¬ 
tions used for the eddy diffusivity K become inadequate, 
because they take insufficient account of local variations. 
In particular, the Reynolds analogy for the equivalence of 
mass, heat and momentum eddy diffusivities is not valid 
when the flow has stable density stratification. 

The development of if-theory models was influenced by 
the need to obtain analytical solutions. This requirement 
meant that K had to be specified in a way compatible with 
this aim. The advent of computers has removed this con¬ 
straint. 

In some areas of work on turbulent diffusion the use of 
eddy diffusivities is regarded as out-dated and use is made 


of higher order closure models, if-theory models were in use 
before the recognition of the need for models specific to 
dense gas dispersion and a if-theory model, SIGMET, was 
in fact one of the first models applied to this problem. An if- 
theory model is sometimes termed a turbulence scheme 
model. 

A-theory models are full three-dimensional models, but 
they may also be used in the two-dimensional mode, and in 
fact it is often sufficient to use them in this way. 

Several of the models described below are if-theory 
models. 


15.24.6 K-e Models 

As just mentioned, the presence of a dense gas or of 
obstructions tends to render inadequate the relations nor¬ 
mally used for the eddy diffusivity in a if-theory model. 

The eddy diffusivity A is related to the turbulence ener¬ 
gy (and the energy dissipation rate e as follows: 

JL 

A tx — [15.24.1] 

The value of the eddy diffusivity is subject to local varia¬ 
tions which are much more significant in the presence of 
dense gas or obstructions. A region of high density gra¬ 
dient tends to give low values of k and thus, from Equation 
15.24.1, very low values of A. 

One way of overcoming this difficulty is to determine 
local values for k and e and then use them to obtain local 
values for A. This may be done by formulating the trans¬ 
port equations for k and e. This creates a two-equation K—e 
model. The parameters required for this K-e model are 
available and apply over a wide range of flows. This 
approach retains eddy diffusivity but allows it to vary 
locally. 

K-e models are used extensively for the study of flows in 
regions of recirculation. One of the models described below, 
HEAVYGAS, is a K-e model. 


15.24.7 Algebraic stress models 

The K-e models just described still utilize the gradient 
transport relationship in regions where the diffusivities 
are very low and difficult to specify. They still retain the 
assumption that the eddy diffusivity is isotropic. It is 
known, however, that stability affects the different com¬ 
ponents of the Reynolds stresses in different ways. 

A development that addresses this problem is the alge¬ 
braic stress model. This replaces the gradient transport 
relation with equations which relate the various fluxes and 
stresses to the velocity and density gradients. This type of 
model is not, however, developed for dense gas dispersion. 


15.24.8 Density difference 

The treatment described below makes use of certain com¬ 
mon relations and, before describing the principal models, 
it is convenient to give some of these relations. For the 
density intrusion represented by a dense gas spreading in 
ambient air 

A p=p-p a [15.24.2] 


A = — [15.24.3] 
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/=££__& [15.24.4a] 

#gA [15.24.4b] 

where A p and A are the absolute and reduced density dif¬ 
ferences between the gas cloud and the ambient air, g and g 1 
are the absolute and reduced accelerations due to gravity, p 
is the density of the cloud and p a is the density of the 
ambient air. The variable g 2 is generally referred to simply 
as the ‘reduced gravity’. 

An alternative reduced density difference is also used 
defined as 

A' = — [15.24.5] 

where A' is an alternative reduced density difference. 


where c p is the specific heat, Gr is the Grashof number, h is 
the heat transfer coefficient, k is the thermal conductivity, 
A is a characteristic linear dimension, Nu is the Nusselt 
number, Pr is the Prandtl number, T is the absolute tem¬ 
perature, A T is the temperature difference for heat transfer, 
/J is the coefficient of thermal expansion, p is the viscosity, 
p is the density and the subscript f denotes film conditions. 
Then from Equation 15.24.9 

[15.24.14] 

where the subscript gr denotes between the ground and the 
cloud. 

For heat transfer by forced convection use is made of the 
relation given by Treybal (1955) for heat transfer from an 
upwards-facing heated plate: 


15.24.9 Wind velocity 

The vertical wind velocity profile is frequently obtained 
from the empirical expression 




[15.24.6] 


where u is the wind velocity, u T is the wind velocity at the 
reference height z T , z is the height, z a is the roughness 
length and p is an index. 

Use is made of the logarithmic vertical wind velocity 
profile: 



where u is the friction velocity, z a is the roughness length 
and k is the von Karman constant. 

The logarithmic vertical wind velocity profile is also 
used in the modified form: 

"tK 1 ?)-*©] I 15 ' 24 '*! 

where L is the Monin—Obukhov length and ip is a profile 
function. 


15.24.10 Heat transfer 

Heat transfer from the ground to the cloud will, in general, 
have contributions from both natural and forced convec¬ 
tion. For natural convection use is frequently made of the 
relation given by McAdams (1954) for heat transfer from an 
upwards-facing heated plate: 

Nu= 0.14(0 Pr) 1/3 [15.24.9] 


L 3 PtP t gAT 

Af 

= Wf 

h 

= l/T 


[15.24.10] 

[15.24.11] 

[15.24.12] 

[15.24.13] : 


IS = St H Pr 2/3 = ^ [15.24.15] 

St H = ~ [15.24.16] 

Ct = 2(—) 2 [15.24.17] 

where Cf is a friction factor, G is the mass velocity ,/h is they 
factor for heat transfer, St H is the Stanton number for heat 
transfer and u is the velocity of the cloud. Equation 15.24.15 
can be rearranged to give, for the case considered, 

[{¥5"^© 2 ]“ pc p [15 - 2418] 


15.24.11 Density intrusion models 

A dense fluid within a less dense fluid, such as a dense gas 
cloud in the atmosphere, represents a density intrusion 
which flows as a gravity current. The modelling of density 
intrusions and of the associated gravity-driven flow is a 
distinct area of work with applications in a number of 
fields. Reviews of gravity currents have been given by 
Benjamin (1968) and Simpson (1982). Gravity currents 
occur in many natural situations in the atmosphere and the 
ocean and they are relevant to industrial accidents such as 
oil spills and dense gas releases. 

Work on gravity-driven flow includes the investigation 
of: the different phases of the flow (e.g. Huppert and 
Simpson, 1980); of the flow on a flat surface, and in par¬ 
ticular the ‘head’ which develops at the leading edge (e.g. 
Benjamin, 1968) and the mixing which occurs (e.g. Britter 
and Simpson, 1978); of flow on slopes (e.g. Ellison and 
Turner, 1959; Britter and Linden, 1980; Beghin, Hopfinger 
and Britter, 1981); and of flow over and around obstacles 
(e.g. Rottman etal., 1985). 

The driving force of the gravity current is the buoyancy 
force. This is opposed by the inertial force, which is 
dominant initially, and the viscous force, which becomes 
dominant later. There is therefore an inertia-buoyancy 
phase and a viscous-buoyancy phase. 
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A model of gravity-driven flow which is increasingly 
utilized is the ‘shallow water equations’. These are descri¬ 
bed in Water Waves (Stoker, 1957), Stratified Flows (Yih, 
1980) and Introduction to Water Waves (Crapper, 1984). A 
derivation of the shallow water equations has been given by 
Penney and Thornhill (1952). 

The non-linear shallow water equations are: 


dh d(uh) uh 
6/ + dx +n x 


du 6« , dh 

0/ + “0* + ^ = ° 


[15.24.19] 

[15.24.20] 


where g 1 is the reduced gravity, h is the height of the dense 
fluid, u is the velocity of the dense fluid, x is the distance 
and n is a symmetry index. For planar flow n = 0, and for 
axisymmetric flow n = 1. 

From Bernouilli’s equation, the velocity of the gravity- 


115.24.21] 


where c is the velocity of the wave. Then, from Equations 
15.24.19—15.24.21, for « = 0 


0C C 0M 0C 
0/ + 20i + M 0x 


du 

0f 


U ——h 2c— = 0 


[15.24.22] 

[15.24.23] 


15.24.12 Basic box model relations 

The basic equations of the typical box model are: 


™ = CE (g'H) 1 ' 2 [15.24.24] 

dV 

—- m^R 2 u e + 2nRHw e [15.24.25] 


where g'is the reduced gravity, H is the height of the cloud, 
R is the radius of the cloud, u e is the top entrainment veloc¬ 
ity, V is the volume of the cloud, w e is the edge entrainment 
velocity and c E is the damping coefficient. 

Equation 15.24.24 may also be formulated in terms of the 
negative buoyancy B: 


Section 15.25. However, in view of the fundamentally 
different physical phenomena involved, this attempt came 
to be regarded as inappropriate, although the newer models 
often incorporate features of, and make transition to, 
passive dispersion models. 

The next generation of models were box models. Of 
these, the models of van Ulden, of Cox and Roe (developed 
as the BG/C&W model) and the SRD models (DENZ and 
CRUNCH) are described in Sections 15.26-15.28, respec¬ 
tively. Even at this stage the box models did not have 
the field entirely to themselves. An early and influential 
if-theory model was SIGMET, which has already been 
referred to in connection with LNG spill study and which is 
described further in Section 15.29. 

The more modern systems of models include: SLAB and 
FEM3; HEGADAS and HGSYSTEM; DEGADIS; and 
SLUMP and HEAVYGAS. These are described in Sections 
15.30—15.33, respectively. Both advanced box models and 
three-dimensional models are represented here. A different 
type of modern model is the similarity model given in the 
Workbook and described in Section 15.34. In Section 15.35 
an account is given of DRIFT, a model which develops but 
transcends the box model approach. Some other models are 
described in Section 15.36. 


15.25 Dispersion of Dense Gas: Modified 
Conventional Models 

15.25.1 Bureau of Mines model 

Attempts were made in early work to modify the para¬ 
meters in passive gas dispersion models to take into 
account heavy gas behaviour. An account is given, 
although the approach has now been largely superseded by 
other methods. 

Thus, for example, for a neutral gas the vertical disper¬ 
sion coefficient a 2 in the Pasquill-Gifford equations tends 
to be about half the value of the horizontal dispersion 
coefficient, but work at the Bureau of Mines (Burgess and 
Zabetakis, 1973 BM RI7752) indicated that for a heavy gas 

<r z = 0.2% [15.25.1] 

where o y and <s z are the dispersion coefficients in the cross- 
windandvertical(yandz)directions,respectively. Equation 

15.25.1 has been used by Burgess and Zabetakis to take into 
account the density effect in the gas cloud formed in the 
Port’Hudson explosion in 1970 (Case HistoryA52). 


B=g'V [15.24.26a] 

m g 1 (nRpH) [15.24.26b] 

Thus, from Equation 15.24.24 and 15.24.26b 


15.25.2 Clancey model 

VJ. Clancey (1976a) suggested that in Equation 15.16.25 the 
generalized diffusion parameter in the vertical direction C 2 
should he taken as 



15.24.13 Model development 

Since the work on dense gas dispersion in the Netherlands 
in the early 1970s, notably the work of van Ulden, there has 
been a high level of interest and work on the subject, 
including mathematical modelling, physical modelling 
and field trials. Some early workers, such as the Bureau 
of Mines and Clancey, attempted to adapt passive disper¬ 
sion models to dense gas dispersion, as described in 


Q = \C X = lf y [15.25.2] 

where C x , C y and C z are the generalized diffusion para¬ 
meters in the downwind, crosswind and vertical ( x , y and z) 
directions, respectively. 

15.25.3 Germeles and Drake model 

A modified Gaussian model was presented by Germeles 
and Drake (1975) to describe the dispersion of LNG vapour 
clouds. This model has also been described by Ermak, 
Chan etal. (1982). 
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The Germeles and Drake model for a continuous release 
contains elements both of a dense gas box model and a 
passive dispersion model. The source is assumed to be a 
cylindrical cloud with an initial radius Ri that of the pool 
and initial height H given by 

H i = 2R i W w /u [15.25.3] 

The mass and heat content of the source are 

m = npR 2 H [15.25.4] 

E = mc v T [15.25.5] 

where c p is the specific heat of the gas in the source cloud, E 
is the heat in the source cloud, m is the mass of gas in the 
source cloud, T is the absolute temperature, u is the wind 
speed, W v is the velocity of the vapour source, and p is the 
density. The value of W v is some 250 times the liquid 
regression rate. 

The development of the source cloud is as follows. For the 
rate of change of the radius use is made of Equation 
15.24.24 and for that of the mass and heat content 


^ = np a R 2 u e [15.25.6] 


=^=np a R 2 c pa T a u e +ey + e w [15.25.7] 

where u e is the top entrainment velocity, e v is the heat 
released by the condensation and by freezing of the 
water vapour, e w is the surface heat flux and subscript a 
denotes air. 

It is assumed that the release is from a finite line source 
of width L located at a virtual source a distance x w upwind 
of the true source. Use is then made of a model of the 
Pasquill-Gifford type to model the dispersion. This gives 
for the concentration 

c(w)= <4^“ p (-s?) 

44WHF^]} 

where c is the volumetric concentration, L is the width of the 
source, V is the volumetric rate of release, and a y and a z are 
the dispersion coefficients in the crosswind and vertical 
directions, respectively. The values used for a y and a z are 
the regular Pasquill-Gifford values. 

The source model is run until the radial velocity of the 
cloud is equal to the wind speed. The source length L 
is then set equal to the diameter 2 R of the cloud and 
the virtual source distance x v is found from the values of 
<Ty{Xy) and aJiX v ) required to make the concentration at 
the source centre, as given by Equation 15.25.8, equal to 
that in the source cloud. Equation 15.25.8 is then used 
with these parameters to determine the concentrations 
downwind. 

Ermak, Chan et al. (1982) have compared the perfor¬ 
mance of the Germeles and Drake model with that of other 
models in relation to the Burro trials. 


15.26 Dispersion of Dense Gas: Van Ulden Model 

15.26.1 Van Ulden model 

The experimental work of van Ulden (1974) which demon¬ 
strated the marked difference in behaviour between a neu¬ 
trally buoyant gas and a dense gas has already been 
described. At the same time van Ulden also presented a 
theoretical model.The main model was for the dispersion of 
an instantaneous release of dense gas in still air, but a 
model for a continuous release with finite wind velocity 
was also outlined. Van Ulden has subsequently extended 
his model (van Ulden 1979,1984,1987,1988; van Ulden and 
de Haan, 1983). 

In van Ulden’s original work the behaviour of the cloud is 
modelled as a two-stage process, in which spreading occurs 
in the first stage by gravity slumping and in the second by 
Gaussian dispersion. In the first stage the dispersion is 
treated as a dense fluid flow process hut with air entrain¬ 
ment at the edge of the cloud. 

The starting point of the model is the following equation 
for the movement of a front of dense fluid such as that 
resulting from a dam burst: 


ut = c R {EgH i ) 1 ! 2 [15.26.1| 


A = (Pi - P 2 )/Pi [15.26.2] 

where H t is the height of the front, Ut is the velocity of the 
front, A is the reduced density difference, pi is the density 
of the fluid behind the wavefront, p 2 is the density of the 
fluid ahead of the wavefront and c E is a slumping constant. 
Van Ulden states that experiment suggests that the con¬ 
stant C E is approximately unity. 

It is assumed that in the first stage the initial gas cloud is 
a cylinder of radius R, height H(R) and volume V(R) with a 
front moving at velocity Uf(R) and with changing density 
p(R). Then from the model just given 

^ = «f [15-26.3] 

= Ce (A' -gH) 1 ' 2 [15.26.4] 

A 'c = (Pc-Pa)/Pc [15.26.5] 

where t is the time, A' c is the reduced density difference of 
the cloud, p a is the density of air and p c is the density of 
the cloud. The volume Fof the cloud is 


V = nR z H [15.26.6] 

Mixing at the front, or edge, of the cloud is assumed to 
take place at the rate 

^ = y2 nRH^ [15.26.ft 
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where y is the edge entrainment coefficient. Solution of Then, by an argument similar to that for the instanta- 
Equations 15.26.3-15.26.7 gives neous release, 


V/fc* (*/&)* 

[15.26.8] 

H/H 0 = {R/R 0 ) 2r ~ 2 

[15.26.9] 

d R ce\ gVo/n 1 1/2 

df R \Vo/V + p a /( Po -p a )\ 

[15.26.10] 

A ~ [ 1 + (Po-Pa)j 

[15.26.11] 

where the subscript o denotes time zero 
source. 

Equation 15.26.10 reduces to 

and hence the 

d R c E U Po - Pa )gV 0 -\ 
df R [ np 0 \ 

[15.26.12] 

if the mixing at the front is negligible or if the term 
(Po—Pa)/ Pa is small. Therefore Equation 15.26.12 is an 
adequate approximation in all circumstances. From Equa¬ 
tion 15.26.12 the relation between the cloud radius and 
the time f is 

R 2 -R 2 0 =2c E \ {p °- p * )8V °] 1/2 t 

L n Po 1 

[15.26.13] 

The transition from gravity spread to diffusional mixing is 
taken to occur at the point where the turbulent energy is 
equal to the average potential energy difference and hence 
where 

2p a ul = l/2(p c -p a )gH 

[15.26.14a] 

•1/2 Po4 

[15.26.14b] 

The condition for transition with p e ss p a is 

then 

Ut = 2u. 

[15.26.15] 


Van Ulden uses the model just given to calculate the tran¬ 
sition radius R u and height H a at which condition 15.26.15 
applies and the position of the cloud and then applies an 
area source Gaussian dispersion model for the further 
determination of concentrations. The cloud radius and 
height obtained by Van Ulden for the experiment described 
earlier are shown in Figure 15.76. The fit is much superior to 
that given by the Gaussian model. 

Van Ulden also gave a treatment of a continuous release. 
The mass flux across the cross-section of the plume at right 
angles to the wind direction is constant. The area of the 
cross-section is 

S = 2LH [15.26.16] 

where L is the half-width of the plume and S is the area of 

the cross-section of the plume. For the source 

S„ = 2LoH 0 [15.26.17] 

W 0 = S 0 u [15.26.18] 

where u is the mean wind speed and W a is the volumetric 
flow from the source. 


S/So = ( L/L o y 
H/Ho = (L/L o y-' 

CE r gSo/ 2 1 

Uy ~LV^[s 0 /S + pJ(p 0 - P y ) \ 


+ ^(3 


[15.26.19] 

[15.26.20] 

[15.26.21] 

[15.26.22] 


where u y is the velocity of the cloud in the crosswind 
direction. 

For the particular case of no mixing (y = 0) and hence 
constant reduced density(A' = A' 0 ) 



15.26.2 Critique of model 

In subsequent work, van Ulden has described certain defi¬ 
ciencies in this model and in models by other workers, and 
has made modifications to his own model. Van Ulden and de 
Haan (1983) analyse the forces which determine the behav¬ 
iour of an unsteady-state gravity current, notably the 
buoyant, viscous and inertial forces, and describe the vis¬ 
cous-buoyant and inertia-buoyant phases. They refer to the 
finding of Huppert and Simpson (1980) in work on flow of 
a dense fluid under a lighter fluid in a channel that the 
velocity of the gravity current is not solely a function of 
{g’H) lli and that an important parameter is the fractional 
depth H/D, where D is the total depth of the channel. 

Van Ulden (1984) gives a model for the particular case of 
two-dimensional flow in the inertia-buoyancy regime. In 
further critiques, van Ulden (1987, 1988) points out that 
Equation 15.26.4 is deficient in that it takes no account of 
the horizontal acceleration of the cloud from rest and 
therefore does not give conservation of momentum. 

Various modellers have described air entrainment at the 
top and at the edge of the cloud by the relation 

^ = nR 2 u t + 2nRHw e [15.26.24] 

where u e is the top entrainment velocity and w e is the edge 
entrainment velocity. However, proportionality between u e 
and Ui violates conservation of energy. 


15.26.3 Van Ulden model 2 

Van Ulden (1987,1988) has presented a second model which 
corrects some of the weaknesses of the initial model just 
described. The model is again for an instantaneous release 
in still air. 

The model consists of four simultaneous differential 
equations for the rate of change with time of the radius R, 
the volume V, the edge velocity Uf and the bulk turbulent 
kinetic energy T E . It gives a more fundamental treatment in 
that the relations for u t and T E are based on conservation of 
momentum and of energy, respectively, and the velocity of 
entrainment u e through the top surface of the cloud is 
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obtained from the bulk turbulent velocity « t which itself is 
derived from the turbulent energy T E . 

The equations for the radius R and the volume Fare 


d R 
dt 
dF 

ft 


= «f 
= nR 2 u e 


[15.26.25] 

[15.26.26] 


For the edge velocity ui, conservation of radial momentum 
gives 


= F s + F a + F a + F v [15.26.27] 

where F a is the force due to the reaction of the ambient fluid 
to the outward radial acceleration of the cloud edge, F d is 
the drag force on the cloud edge due to the presence of the 
quiescent ambient fluid, F s is the static pressure force due 
to the negative buoyancy of the cloud, F, is the force due to 
vertical acceleration in the cloud and the reaction of the 
ambient fluid to vertical acceleration of the cloud top and 
M ri is the radial momentum integral of the cloud. This 
momentum budget yields a relation of the form 


=f(g',H,R,Uf,u e ,p c ,p a ,p c ,Ap c ) [15.26.28] 

where p c is the mean density of the cloud and Ap c is the 
mean density difference. 


The relation for the bulk turbulent kinetic energy T E is 
derived from conservation of the total energy in a large 
control volume containing the cloud and the secondary 
flows around it. Four types of energy are considered: / E 
the internal heat, K E the kinetic energy of the mean radial 
and vertical motions, P E the potential energy and T E the 
turbulent kinetic energy. Then 


-Af = S - 


[15.26.29] 

[15.26.30] 

[15.26.31] 

[15.26.32] 


where B is the rate of buoyant destruction of turbulent 
energy, which is the conversion of turbulent energy into 
potential energy by entrainment, D is the rate of dissipation 
of turbulent energy into internal heat, G is the rate at which 
gravity transforms potential energy into mean kinetic 
energy and S is the rate of shear production of turbulent 
energy. The relationship between these forms of energy is 
shown in Figure 15.78(a) and their variation with time is 
shown in Figure 15.78(b). Conservation of energy gives 


d(I E + K E + P E +T E ) 
At 


= 0 


[15.26.33] 
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(b) 

Figure 15.78 van Ulden’s second model of dense gas dispersion - components of energy balance (van Ulden, 1988): 
(a) relationship between components; (b) change of components with time, f* is scaled time (Courtesy of Clarendon 
Press) 
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This energy budget yields a relation of the form 
^ =f(g,H,R,u i ,Ut, V, F„,M e ,P c ,P a ,P c ,Ap 0 ,Ri t ) 


where Ri t is a bulk turbulent Richardson number and 
A p 0 is the mean initial density difference for the cloud. 
For air entrainment, edge entrainment is neglected and 
top entrainment is obtained using the entrainment model 
of Diedronks and Tennekes (1984): 


where s is a profile shape factor and A and B are constants. 
In fitting his model to experimental results, he utilizes a 
shape factor 5 = 1/2, giving 

[15.26.47] 


[15.26.34] C(z)/C = 6exp[-(12z/i7) 1 ' 2 


15.26.4 Extensions of De Nevers 

De Nevers (1984b) has described a model of the type given 
by van Ulden and has extended it to the case of a con¬ 
tinuous release and then to a comparison of instantaneous 
and continuous releases in windless conditions. The treat¬ 
ment is concerned with the short-term behaviour and 
[15.26.35] ignores entrainment of air. Following van Ulden, for an 
instantaneous release 


d R 


where Ci and c t are constants. The values of and c t are 0.2 
and 1.5, respectively. 

The bulk turbulent velocity ii t is a function of the bulk 
turbulent kinetic energy T E : 


_ = CE&Hf 2 

% = kR 2 0 H 0 
= nR 2 H 

but with 


[15.26.49a] 

[15.26.49b] 


Pc = P a + Ap c 
Ap = Ap 0 V 0 /V 
C = V 0 /V 


[15.26.38] 

[15.26.39] 

[15.26.40] 


assuming C a = 1. 

The model itself assumes a uniform profile of con¬ 
centration with height.Van Ulden states that, in general, the 
concentration may be described by a relation of the form 


where C is the mean concentration. 

Any such relation should be consistent with conserva¬ 
tion of mass: 


L 


where g' is the reduced gravity and subscript 0 denotes 
time zero. Then, combining Equations 15.26.48 and 
15.26.49b 

f=“(sr 11526511 

Integrating this equation with the initial condition 
t = t 0 ; R = R 0 

and taking the initial aspect ratio as 

Ro = H 0 [15.26.52] 

yields 


R 2 


f(z/H) d (z/H) m I [15.26.42] 

and with the definition of H, taken as 

H = 2 J o °°zC(z) dz j J™C{z) 6z [15.26.43] 

Van Ulden quotes as a possible candidate the family of 
profiles 

C(z)/C = A exp l-{Bz/H) s ] [15.26.44] 

A = 2sr(2/s ) / [r(l/s)f [15.26.45] 

B = 2r(2/3)/r(l /s) [15.26.46] 




x 2/3 


V 0 = Qt 
= nR 2 H 


[15.26.53] 


[15.26.54a] 

[15.26.54b] 


where Q is the volumetric rate of release. Then, combining 
Equations 15.26.48,15.26.49b and 15.26.54a 


R 

r ;CE t 


wv /: 

nR 2 ) 


Integrating this equation with the initial condition 
t=t 0 ; R = 0 
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yields 




^ = 2cE^Qy^ /2 


[15.26.56] = 


[15.27.3] 


There is a small transient when expansion by bulk flow 
from the source exceeds that due to gravity-driven flow, but 
this is so short it can be neglected. 

From Equations 15.26.53 and 15.26.56 and setting 
Qt 


Ri _ [3 j /2 

Rc~ [2 + 4cg(g') 1 ^®#/ 6 J 



[15.26.57a] 

[15.26.57b] 


where subscripts c and i denote continuous and instanta¬ 
neous, respectively. The second term on the right-hand side 
of Equation 15.26.57a falls rapidly to zero, giving Equation 
15.26.57b. From Equations 15.26.54b and 15.26.57b 

w'A i 15 - 26 - 58 ] 


15.26.5 Validation and application 

Van Ulden (1974) compared the performance of his first 
model against the Freon 12 experiment given in his paper, 
as described in Section 15.22 and shown in Figure 15.76. His 
work demonstrated that his model was much superior to the 
Gaussian model in predicting the radius and the height of 
the cloud, and stimulated work on dense gas dispersion. 


where Q e is the volumetric flow of air entrained at the edge 
of the cloud per unit distance crosswind, w e is the 
edge entrainment velocity and y is an edge entrainment 
coefficient. 

In this model account is also taken of entrainment of air 
at the top of the cloud: 

Qt = 2 Lu e [15.27.4] 

where Q t is the volumetric flow of air entrained at the top of 
the cloud per unit distance downwind and u e is the top 
entrainment velocity. The rate of change of volume of the 
cloud is then 


~=Q, + Qe [15.27.5] 

where V is the volume of the cloud per unit distance down¬ 
wind. For the top entrainment velocity u e 





[15.27.7] 


15.27 Dispersion of Dense Gas: British 
Gas/Cremer and Warner Model 

The work of van Ulden gave impetus to the development of 
a number of models of dense gas dispersion. One of the first 
of these was that by R.A. Cox and Roe (1977) of Cremer and 
Warner and British Gas, respectively. This model was fur¬ 
ther developed in treatments by R.A. Cox and Carpenter 
(1980), C.I. Bradley et al. (1983) and Carpenter et al. (1987), 
who refer to it as the British Gas/Cremer and Warner (BG/ 
C&W) model. 

15.27.1 Cox and Roe model 

The model of R.A. Cox and Roe (1977) is for a continuous 
release. It follows the same approach as van Ulden in that 
the cloud is modelled as a sequence of rectangular cross- 
wind slices each of uniform concentration and spreading 
laterally under gravity. The movement of the cloud edge is 

~= {hg'H) 1/2 [15.27.1] 

where H is the height of the cloud, L is the half-width of the 
cloud, g 1 is the reduced gravity and kv is a spreading con¬ 
stant. The value of the constant & E is taken as unity, fol¬ 
lowing van Ulden, although there is theoretical and some 
experimental basis for a value of 2. 

For entrainment of air at the cloud edge, the approach 
followed is that of van Ulden: 

Q e = Hw e [15.27.2] 


where l is a turbulence length scale, Ri is a Richardson 
number, U\ is the longitudinal turbulence velocity and a is a 
top entrainment coefficient. Equation 15.27.6 is valid for 
moderate values of Ri, but as Ri tends to zero the term 
(ujui) tends to a limiting small value. 

The longitudinal turbulence velocity may be expres¬ 
sed in the form 



where u is the wind speed and u, is the friction velocity. The 
ratio (uju,) has been shown by Monin (1962) to depend 
primarily on the stability condition. His results indicate the 
following approximate values: 


Stability condition 

«l/«* 

Very stable 

3.0 

Neutral 

2.4 

Very unstable 

1.6 


The ratio ( uju ) has been shown by O.G. Sutton (1953) to 
depend primarily on the surface roughness. A typical value 
for open terrain is 0.1. For the turbulence length scale l, use 
is made of the results of R.J. Taylor, Warner and Bacon 
(1970), which show that the parameter varies with the sta¬ 
bility condition and the height H of the cloud. For the top 
entrainment coefficient a work in the literature suggests 
values ranging from 0.15 to 1.0. Avalue of 0.5 was obtained 
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by fitting the model to one of the American Gas Associa¬ 
tion tests for LNG dispersion. 

The authors state that in the model the entrained air is 
assumed to mix adiabatically with the gas and that the 
effects of water vapour present in the air are taken into 
account, but give no further details. 


15.27.2 Cox and Carpenter model 

R. A. Cox and Carpenter (1980) extend the model of Cox and 
Roe to cover both continuous and instantaneous releases. 
The situations modelled are shown in Figure 15.79(a) and 
(b) for the instantaneous and continuous release cases, 
respectively. The models cover a continuous release in wind 
and an instantaneous release in still air or in wind, but not a 


continuous release in still air. The movement of the cloud 
edge for the two cases is 

~ = (kEg'H) 1/2 continuous release [15.27.9a] 

^ = (&Eg , ff) 1 ' ,2 instantaneous release [15.27.9b] 

where R is the radius of the cloud. The value of the constant 
k E is unity. The entrainment of air at the cloud edge is 

Q e = Hw e continuous release [15.27.10a] 

Q e = 2nRHw e instantaneous release [15.27.10b] 


WIND DIRECTION 
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where Q e is the volumetric flow of air entrained at the edge 
of the cloud, this being the total value for the instantaneous 
release case and the value per unit distance crosswind for 
the continuous release case. The edge entrainment velocity 

w e = y ^ continuous release [15.27.11a] 

= instantaneous release [15.27.11b] 

The entrainment of air at the cloud top is 

Qt = 2 Lu e continuous release [15.27.12a] 

Qt = 2iiR 2 u e instantaneous release [15.27.12b] 


15.27.15 for forced convection. The heat balance on the 
cloud is then 

WyoM^o) + mi 0 k(T 0 ) + m^Ts) + + Q gr 

= »A(r e ) +mMT e ) +«a K{T C ) + rn m K,{T c ) 

+ m vX h v \{Tc) [15.27.16] 

where h is the specific enthalpy of a component, w,- is the 
mass of component i in the cloud, T a is the temperature of 
the air and subscripts a, 1, o, v, wl and wv denote air, liquid, 
source, vapour, liquid water and water vapour, respectively. 

The model is extended in the region of passive disper¬ 
sion. The transition from dense gas to passive dispersion is 
assumed to occur at the point where the rate of lateral 
spreading due to turbulence exceeds that due to gravity: 


where Q t is the volumetric flow of air entrained at the top of 
the cloud, this being the total value for the instantaneous 
release case and the value per unit distance downwind for 
the continuous release case. 

The treatment of the entrainment velocity u e at the top of 
the cloud is essentially that given by Cox and Roe. There is 
a limiting small value /I to which the group (« e /#i) tends as 
Ri tends to zero. The values used for a, /? and y are discussed 
below. 

The rate of change of volume of the cloud is 


- if 1 continuous release '[ 15.27.17a! 


instantaneous release [15.27.17b] 

where a is the dispersion coefficient and subscript y 
denotes crosswind. 

Then from this point a continuous release is modelled 
using the Gaussian model for a finite line source: 


= Qt + Qe [15.27.13] 

where Fis the volume of the cloud, this being the total value 
for the instantaneous release case and the value per unit 
distance downwind for the continuous release case. 

A more detailed description is given of the heat balance 
used in the model. Vaporization of liquid spray, condensa¬ 
tion of water vapour and heat transfer from the ground to 
the cloud are taken into account. If the source is not one 
which generates pure vapour but involves a flashing liquid 
it is assumed that the liquid flash-off is adiabatic, giving 
vapour and liquid spray. It is also assumed that half the 
liquid rains out but that this rainout revaporizes instantly. 
Thereafter the cloud is assumed to be at the saturated 
condition as long as liquid still remains. The cloud is 
assumed to be saturated with water. 

For heat transfer from the ground by natural convection 



[15.27.18] 


where l, s is the width of the virtual source, Q is the con¬ 
tinuous mass rate of release and x is the concentration 
(mass per unit volume). 

The treatment for an instantaneous release is slightly 
more complex. The virtual source is represented as a set of 
253 instantaneous point sources on a rectangular grid: 


x(x,y,Qtm, 


2Q*S* 

253(27t) 3/2 o-2<r 2 




[15.27.19] 


Q p = hgm(T gr - T c ) 4/3 


and by forced convection 


-smi 


[15.27.20] 


Qgr = 0.5CfP c e pc w'(Tg r - 7 C ) 15.27.15] 

where Q is a friction factor, c pc is the specific heat of the 
cloud, h grn is the heat transfer coefficient between the 
ground and the cloud by natural convection, Q gr is the heat 
flux from the ground to the cloud, T c is the temperature of 
the cloud, T gr is the temperature of the ground, u' is the 
magnitude of the vector sum of the slumping and wind 
velocities and p c is the density of the cloud. The friction 
factor Cf is given by Equation 15.24.17. The value used for 
the heat flux Q ^ is the larger of the values obtained from 
Equation 15.27.14 for natural convection and Equation 


where Q* is the mass released instantaneously and r(n) is 
the distance downwind from the source n. 

The dense phase model gives a uniform cross-sectional 
concentration profile, whereas the passive model gives a 
Gaussian concentration profile. The Gaussian model has 
only two degrees of freedom: the distance of the virtual 
source upstream of the matching point, and the width of the 
virtual source. The two cloud parameters selected 
for matching are the centre line concentration and the 
cloud width. It is assumed that at the matching point the 
cloud width is equal to the width at the virtual source plus 
2o y , where a y is the value at the matching point based on its 
distance from the virtual source. 
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The authors discuss the calibration of the top entrain¬ 
ment coefficient a, the limiting value /i of the group uju\ 
and the edge entrainment coefficient y, and give values of 
0.1,0.15 and 0.6, respectively. 


15.27.3 Development of model 

Development of the model of Cox and Carpenter has been 
described by C.I. Bradley et al. (1983). A deficiency of that 
model is the neglect of conservation of momentum and the 
assumption that the cloud travels at a constant speed equal 
to that of the wind. 

For the cloud from an instantaneous release the rate of 
change of momentum in the frame of reference of the mov¬ 
ing cloud is 


^^ = m e u„+mtU h +D-F [15.27.21] 

where D is the drag force on the cloud, F is the friction force 
on the cloud, m is the total mass in the cloud, m e is the mass 
of air entrained at the edge of the cloud, m t is the mass of air 
entrained at the top of the cloud, w av is the average wind 
speed over the cloud height, « c is the velocity of the cloud 
and « h is the wind speed at the cloud height H. The drag 
force D is 


D = Ca fj RpMz) - «c]|«(z) - #c| dz [15.27.22] 

where C d is a drag coefficient and u(z) is the wind speed at 
height z. The value of the drag coefficient C d is taken as 1.0. 
The friction force F is obtained by analogy with the shear 
stress r in the atmospheric boundary layer 

F = vkR 2 [15.27.23] 




[15.27.24] 


where u T is the wind speed at the reference height and x is 
the shear stress. The reference height is 10 m. Then, from 
Equation 15.27.21 the acceleration of the cloud relative to a 
fixed point is 


^ = l K(«av - «c) + «t(«h -u c )+D-F [15.27.25] 


For the cloud from a continuous release there is no aero¬ 
dynamic drag, since the main effect of this force is to 
reverse the upwind flow and give the plume its initial 
acceleration. There is, however, an additional term which 
allows for the interaction of one slice of the plume with 
another due to the variation of cloud dimensions and den¬ 
sity as the plume is carried downwind. The rate of change of 
momentum is 


d« c 

df 


I'd «! e , 


«c) + w (u h -u c )-2xLu c 


d[LH 2 (p c 

w 


[15.27.26] 


A method is also described of handling a transient release 
which corresponds to neither of the two ideal cases, i.e. to 
neither a continuous nor an instantaneous release. A case 
in point is vaporization from a spill of a cryogenic liquid 
such as LNG. A suitable approach in such a case may he to 
model the release as an instantaneous release followed by a 
continuous release. If successively larger masses of vapour 
are considered, it is found that for a small amount m,\ the 
time 4 for vaporization to occur is so short that the trailing 
edge of the cloud is still upwind of the source. For a large 
amount m 3 , the time t 3 is so long that the trailing edge has 
moved downwind of the source. There is some intermediate 
mass m 2 and time t 2 such that the trailing edge is just on the 
source. This time t 2 is taken as that at which transition 
occurs. The instantaneous release model is used up to this 
time and the continuous release model thereafter. 

At low wind speeds this method gives a large instanta¬ 
neous release and the maximum travel distance to a 
given concentration is determined by this instantaneous 
part of the release. At high wind speeds and/or for small 
releases the maximum travel distance is determined by the 
continuous part of the release. 

For very low wind speeds it can occur that the cloud is 
diluted below its lower flammability limit before it has 
moved away from the source. This is an indication that the 
model is inapplicable and it should not be used. 

In a further treatment for an instantaneous release, 
Carpenter etal. (1987) express the average wind speed « av over 
the cloud height as a function of the wind speed « h at height H: 

u„ =fu h [15.27.27] 

where/is the wind speed coefficient. 

The authors present a further calibration of the para¬ 
meters a, ft y and /based on data from theThorney Island 
Phase 1 tests, and give values of 0.08, 0.30, 0.65 and 0.55, 
respectively 

15.27.4 Validation and application 
R.A. Cox and Roe (1977) compared predictions from their 
model with observations in the Matagordo Bay tests. 
R.A. Cox and Carpenter (1980) used the SS Gadila LNG 
spill trials to calibrate the parameters in their model. The 
resultant predicted cloud shape is shown in Figure 15.92(a). 
Carpenter et al. (1987) used the Thorney Island trials to 
calibrate the parameters in the BG/C&W model. 


15.28 Dispersion of Dense Gas: DENZ and CRUNCH 

Two models on somewhat similar lines have been developed 
by the Safety and Reliability Directorate (SRD). The model 
for an instantaneous release, DENZ, is described by Fryer 
and Kaiser (1979 SRD R152) and that for a continuous 
release, CRUNCH, by Jagger (1983 SRD R229). The two 
models are incorporated in the computer codes of the same 
name and have been widely used. 


15.28.1 DENZ 

Kaiser and Walker (1978) have described a model which was 
a forerunner of DENZ and applied it to releases of liquefied 
anhydrous ammonia. 

DENZ is a model for an instantaneous release of a dense 
gas. It is described by Fryer and Kaiser (1979 SRD R152). 
The model is based on three simultaneous differential 
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equations for the radius R of the cloud, the mass m a of air in 
the cloud and the temperature T c of the cloud. 

The cloud is assumed to be advected downwind at an 
advection velocity which corresponds to the mean wind 
velocity at the half-height of the cloud. This advection 
velocity is given by 


«c(0 = 


, HH/2z 0 ) 
k ln( 2 r / 2 0 ) 


[15.28.1] 


where u c (t) is the mean velocity of the cloud, M r is the mean 
wind velocity at the reference height, z„ is the roughness 
length, 2 r is the reference height and H is the height of the 
cloud. The reference height z r is 10 m. 

The rate of change of the downwind distance x(t) of the 
centre of the cloud is equal to the advection velocity m c (f): 


ale- 

i 

[15.28.2] 

For the radius R of the cloud 



[15.28.3] 

The volume Fis 


F = ti R 2 H 

[15.28.4] 

and c E is the slumping coefficient. 
Equation 15.28.3 is actually cast ii 

n the alternative form 

di? 2 0 (g'V Y /2 

[15.28.5] 

For the mass m 3 of air entrained 


^ = 7iR 2 p a M e + 2nRHp 3 w e 
at 

[15.28.6] 

The edge entrainment velocity w e is 

d R 

W ° = 7 dt 

[15.28.7]; 


Following van Ulden (1974), the default value of the 
edge entrainment coefficient y is taken as zero. Following 
R. A. Cox and Roe (1977), the top entrainment velocity u e is 
obtained from Equation 15.27.6 using the methods given by 
these authors for relations for the group (mi/m») and for the 
turbulence length scale l. 

Heat transfer between the ground and the cloud is 


assumed to be by natural convection: 


Q p = hgrAT gr 


[15.28.8] 

with 



E-? 

E-? 

E? 

<1 


[15.28.9] 

h gt = OAIS^-Z^AT^ 

laminar convection 

[15.28.10a] 

m o.ue^z^AT^ 3 

turbulent convection 

[15.28.10b] 



and with convection turbulent if 
3 x 10 10 > ZAT gr > 2 x 10 7 


[15.28.llf 


where c p is the specific heat, h gI is the heat transfer coeffi¬ 
cient between the ground and the cloud, k is the thermal 
conductivity of the cloud, L is a characteristic dimension of 
the cloud, Q gr is the heat flux between the ground and 
the cloud, T gr is the temperature of the ground, 6T gr is the 
temperature difference between the ground and the 
cloud, P is the coefficient of volumetric expansion, p is 
the viscosity and subscript f denotes at film temperature 
(=(T c +T gr )/2). 

Equation 15.28.8 gives the heat transfer between the 
ground and the cloud. Then for the temperature T c of the 
cloud 


dT c _ m a c pa AT a + h gr (7iR 2 )AT gr 
df Wcipa + 


[15.28.12] 


AT a = T a - T c [15.28.13] 

where m 3 is the mass of air, m g is the mass of gas, AT a is 
the temperature difference between the air and the cloud, 
and subscripts a, c and g denote the air, cloud and gas, 
respectively. 

Use is also made of the relations 
V Pc 

m a + m g T a 
Pc (nh/Pi'i + (mg/p g ) T c 


[15.28.14] 

[15.28.15] 


For transition from dense gas dispersion to passive dis¬ 
persion use is made of two alternative criteria. The first 
criterion is that transition occurs if the following two con¬ 
ditions are satisfied. The first condition is that the rate of 
increase of the radius due to gravity spreading is less than 
that due to atmospheric turbulence 


d R 
d t 


[15.28.16] 


For the determination of the term (do^/df) use is made of the 
treatment by Hosker (1974b): 


1528.17! 


where u c is the velocity of the cloud and C* is a constant. The 
constant C* is a function of the stability category and for 
categories A, B, C, D, E and F has the values 0.22,0.16,0.11, 
0.08,0.06 and 0.04, respectively.The second condition is that 

Me > Mi [15.28.18] 

where u e is determined from Equation 15.27.6 and Mi is the 
longitudinal turbulence velocity 
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The alternative criterion for transition is based on the 
density difference A p c for the cloud: 

Ap c < Ap r [15.28.19] 

where A p T is a reference value. The default value of A p r is 
10“ 3 Kg/m 3 . 

Transition occurs at distance x tr with cloud radius R tI 
and height H tI . Then assuming a Gaussian distribution the 
dispersion parameters are: 





where A is the reduced density difference and the subscript 
o denotes the initial value. With minimal approximation, 
Equation 15.28.6 may be integrated and Equation 15.27.6 
utilized to give the following solutions: 


[15.28.20] 

<7*tr = O-ytr [15.28.21] 


V = { [5/(10 - C)] [5 s - i^(5/5 0 ) c/2 + Vy 2 (R/R 0 ) c/2 } 2 
[15.28.28] 


= 5tr/2.14 [15.28.22] 

Beyond the transition point 
tf(x) = (T 2 (x) = 0- 2 r + <7 2 h (x - X tr ) = (5/2.14) 2 

[15.28.23] 

of (*) = ai r + a^(x - Xu) » (ff/2.14) 2 [15.28.24] 


H = {[5/10 - CH5 4 - 5^(5/5 0 ) c/2_1 /7c 1/2 


+ 5 0 1/2 (5/5o) C/Z_1 } 2 

[15.28.29] 

with 


5 = aM 3 7t 1/2 /6A 3 CE 

[15.28.30] 

C = 2y 

[15.28.31] 


where subscript H denotes the value given by the Hosker 
scheme. 

The concentration distribution in the cloud is assumed 
to be Gaussian, even though this is not consistent with the 
gravity spreading treatment. The concentration is 


2V2 7c 3/W eXP< 


f + [x-x(t)] 2 z 2 l 


where x(t) is the distance to the centre of the cloud at time t. 

A simplified model is also given. The model has four 
stages: (1) formation of the source cylinder, (2) gravity 
slumping, (3) ‘ground hugging’ and (4) passive dispersion. 
Stage 1 involves the formation of the source cylinder. In Stage 
2, this cylinder undergoes gravity slumping with little air 
entrainment; zero entrainment is assumed. The growth of 
the cloud radiusRis given by Equation 15.28.3.The criterion 
for the end of this stage is that slumping terminates when the 
cloud height H is comparable to that of the roughness ele¬ 
ments of the surface. In Stage 3, the growth of the cloud 
radius R is again given by Equation 15.28.3. The growth of 
the cloud heightiTIs taken for all stability categories as one- 
third of that which would occur with dispersion by atmos¬ 
pheric turbulence for stability category F. The criterion for 
the end of this stage is that given by Equation 15.28.19. In 
Stage 4, passive dispersion applies. 

Further developments of DENZ are described by Jagger 
(1985 SRD R277). It is shown by Jagger in this latter work 
that, on certain simplifying assumptions, it is possible to 
obtain a solution for the dense gas dispersion phase. Not¬ 
ing that 


where 5 and C are parameters. 

In windless conditions there is no top entrainment and 
5 = 0, so that Equations 15.28.28 and 15.28.29 reduce to 

V=V 0 {R/R 0 f [15.28.32] 

H = H 0 (R/R 0 ) C ~ 2 [15.28.33] 

15.28.2 CRUNCH 

The CRUNCH model for an instantaneous release of a dense 
gas, described by Jagger (1983 SRD R229), is based on three 
simultaneous differential equations for the half-width L of 
the cloud, the mass m a of air in the cloud and the tempera¬ 
ture T c of the cloud. 

The cloud is assumed to be advected downwind at an 
advection velocity u(t) which corresponds to the mean wind 
velocity at the half-height of the cloud. This advection veloc¬ 
ity is given by 


ln(F/4Z,« c 2 0 ) 

Uc ~ Ur ln(z r /* 0 ) 


[15.28.34] 


where u c is the mean velocity of the cloud, u T is the mean 
wind velocity at the reference height, Fis the volume of the 
cloud and z r is the reference height. The reference height z r 
is 10 m. 

The rate of change in the downwind distance x is equal to 
the advection velocity u c : 


= u c [15.28.35] 

For the half-width 5 of the cloud 


A ■ V = A 0 ■ F„ 

Equation 15.28.3 may be integrated to give 


[15.28.26] 

The rate of change in the volume Fis 


[15.28.36] 


i 2 = R 2 d + 2cEAt 


[15.28.27a] 


[15.28.37] 
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Equation 15.28.36 is recast, utilizing Equations 15.28.35 
and 15.28.37, in terms of downwind distance x. 


d L (g'VV 

dx E \2Lul) 


[15.28.38] 


Transition occurs at downwind distance x tr with cloud 
half-width Lt r and height H tI . Then, assuming a Gaussian 
profile, the dispersion parameters are 

Oytt = itr/2-14 [15.28.50] 


For the mass of air entrained per unit distance downwind oyt r = iitr/2.14 


[15.28.5| 


°^ = 2Ldxp a u e + 2Hdxp a w e [15.28.39] 

where m a is the mass of air. 

Equation 15.28.39 is recast in terms of x 


a ^=2Lp a u e + 2Hp a w e 


[15.28.40] 


The edge entrainment velocity w e is 


[15.28.41] 


Following Cox and Roe, the top entrainment velocity u e is 
obtained from Equation 15.27.6 using the methods given by 
these authors for the group («i/a») and for the turbulence 
length scale/. For the latter the following relation is quoted: 


11= 5.88H° AS [15.28.42] 

Equation 15.28.40 is recast, utilizing Equation 15.28.41, to 
maintain it as a function of x only: 


[15.28.43] 


Heat transfer between the ground and the cloud is treated 
as in DENZ. Then for the temperature T c of the cloud 

~ ^-[(T, - T c )e pa ^ + 2LQJ 

ax m a c va + m g c w y dx * J 

[15.28.44] 

where m g is the mass of gas. 

Use is also made of the relations 


m = m a + m g 


[15.28.45] 

where m is the total mas 

>s in the cloud. 


m = 2LHp c u c 


[15.28.46] 

y _ TcWj Tcntg 

Pa^a PgTg 


[15.28.47] 

v 


[15.28.48] 


For transition from dense gas dispersion, use is made of 
two alternative criteria, which correspond to those in 
DENZ. For the first criterion the first condition is 


^<2.14^ [15.28.49] 

dx dx 

and the second condition is that given in relation 15.28.18. 
The alternative criterion is that given in relation 15.28.19. 


For the dispersion beyond the transition point the 
approach used is to utilize two separate virtual sources at 
locations x VJ) and x T2 for crosswind and vertical dispersion, 
respectively, as shown in Figure 15.80 where x vy is upwind 
of the source, whilst x V2 is downwind of it. The determina¬ 
tion of these two points is as follows. Use is made of the 
relations 

»#»)=% [15.28.52] 

<t*h(X w ) = a* [15.28.53] 

where subscript H is the value given by the Hosker scheme. 
Since this scheme gives a values which are a function of x, 
the solution is a trial-and-error one. Beyond the transition 
point the dispersion is determined using the virtual source 
at x vy for the crosswind dispersion and the virtual source at 
x V2 for the vertical dispersion and with a values from the 
Hosker scheme. 

The concentration distribution in the cloud is assumed 
to be Gaussian. The concentration x is 

*(***) = ^ 6XP [- (if + If) ] [15 - 28 ' 54] 

On certain simplifying assumptions, it is possible to obtain 
a solution for the dense gas dispersion phase. One case 
considered is that in which it is assumed that the advection 
velocity of the cloud is constant and that the cloud is at 
ambient temperature, so that heat effects can be neglected. 


For this case 

^=A{Li$~ y2 [15.28.55] 

^ = BL{m a + C)+ |y(wa + C)/L^j [15.28.56] 

A = CE\gm g ( 1 - p a /p g )/2p a ] 1/2 [15.28.57] 

B = 2p a oo4/glm g {l - pjp g ) [15.28.58] 

C = [15.28.59] 

Pg 

Integration of Equation 15.28.55 gives 
L = X 2 / 3 [15.28.60] 

X = L 3 J 2 +A'x [15.28.61] 

A' = I Auf 2 [15.28.62] 
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Figure 15.80 CRUNCH model for dense gas disperion - transition from dense gas to passive dispersion (Dagger, 1983 
SRD R229) h, X and subscript t in the figure are denoted in the text by H, x and subscript tr, respectively (Courtesy of the 
UKAEA Safety and Reliability Directorate) 


where L 0 is the half-width of the cloud at the source. Sub¬ 
stitution of Equation 15.28.60 in Equation 15.28.56 and 
integration gives 

ma = C{X exp[3B(X 6 / 3 - L 5 J 2 ) ./&4']//4 - 1} 

[15.28.63] 

For short downwind distances Equation 15.28.63 reduces to 


A derivation is also given for the case where the advection 
velocity of the cloud is variable. 

15.28.3 Validation and application 

Kaiser and Walker (1978) have given a rough comparison of 
the predictions from their model with the observed clouds 
in the ammonia release incidents at Potchefstroom in 1973 
and Houston in 1976; a further discussion has been given by 
Fryer and Kaiser (1979 SRD R152). Jagger (1985 SRD R277) 
has discussed the calibration of DENZ against the van 
Ulden trial and the Porton Down trials. Jagger (1983 


SRD R229) has also compared predictions of CRUNCH 
for the cloud shape in the SS Gadila trials as shown in 
Figure 15.92(b). 

DENZ and CRUNCH have been widely used. The Second 
Convey Report gave hazard ranges computed from DENZ 
and more detailed relations for hazard ranges based on 
DENZ and CRUNCH have been given by Considine and 
Grint (1985), as described in Section 15.49. CRUNCH has 
been used by McQuaid and Fitzpatrick (1983) to model the 
dispersion of dense gas by a water spray barrier. 

15.29 Dispersion of Dense Gas: SIGMET 

Most of the early models were box models. Some of these 
have just been described. The early models also included, 
however, several if-theory models. Of these, the SIGMET 
model was particularly influential in the development of 
the subject. 

15.29.1 SIGMET 

SIGMETwas developed by Science Applications Inc. (SAI) 
for the US Coast Guard (USCG). It has been described by 
England et ol. (1978), and evaluated by Havens, who also 
gives a description (Havens, 1982a). 
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The model is intended for investigating the dispersion 
of a large spill of LNG onto water. The starting point of 
the model is the set of hydrodynamic equations. In apply¬ 
ing these to dense gas dispersion, where the cloud is 
wide but shallow, a simplification is made which eliminates 
the equation for the vertical velocity. The governing 
equations are 


d(nu) 6 (uitu) 6 (vim) 6 (emu) fdep c0tt\ 

6/ i* % 'i* pdx) 




[15.29.1] 

8(nv) 8(unv) 8(vnv) 8(&nv) / 

'dip adn) 

|=0 

dt «*. 8y \ 

^dy pdy) 



[15.29.2] 

8(nh) 8(unh) 8(vnh) 0(<b*) i 
dt 8x 0y ' dff 

0 

[15.29.3] 

d(nc) d(unc) d(vKc) 8(anc) _ 

it 8x 0rr 


[15.29.4] 

0(7t) 8(un) 8(vn) 6(&n) 

dt dx 0y 0c 


[15.29.5] 

with 



a _P-Pt 


[15.29.6] 

n=p s -p t 


[15.29.7]; 

<t>=gz 


[15.29.8] 


where c is the concentration (mass fraction), h is the specific 
enthalpy, p is the pressure at a given height, p s is the pres¬ 
sure at the surface, p t is the pressure at the top, T is the 
absolute temperature, p is the density, c is a dimensionless 
pressure coordinate, ip is the geopotential height, w is the 
substantial pressure derivative, and u, v and m are the 
components of the velocity in the alongwind, crosswind 
and vertical directions, respectively, c is the substantial 
derivative in x, y, c, t coordinates. The sigma coordinate 
takes the values c = 0 at the top and c = 1 at the surface. 

The hydrostatic relation is 


The following supplementary equations are used: 


The eddy diffusivities required in the submodel for 
turbulent mass, momentum and energy transfer, as 
described by Havens, are obtained as follows. 

For the horizontal eddy diffusivities the Reynolds ana¬ 
logy is assumed and the eddy diffusivities for turbulent 
momentum, mass and energy transfer are taken as equal 
and are denoted by K b . The vertical diffusivities are like¬ 
wise assumed equal and are denoted K w . The relation for the 
vertical diffusion coefficient is 

K y = 0.45<t £ z<Z u >1 m/s [15.29.12a] 

= 0.45<x £ Z u< lm/s [15.29.12b] 

where l is turbulence length scale and c £ is the standard 
deviation of the wind direction. Tabulated values of l and c £ 
are given by England et al. and a plot for K h is given by 
Havens. The diffusion coefficient K h is obtained from 
the vertical diffusion coefficient K v using values of the 
ratio K h /Ky Havens gives for this ratio the values shown in 
Table 15.43, which evidently supersede the table of values 
given by England et al. 

Other submodels are those for heat transfer and 
momentum transfer from the surface to the cloud. For heat 
transfer 

q = U(T S - T c ) [15.29.13] 

where q is the heat flux, T c is the temperature of cloud, T s is 
the temperature of the surface and U is the heat transfer 
coefficient. The value used for U is 20.4 W/m 2 K. For 
momentum transfer 

T 0 = C&pu 2 [15.29.14] 

where C d is the drag coefficient, u is the velocity and t 0 is 
the shear stress at the surface. The velocity u is that at 1 m 
height. The value of C d is 0.001. 

SIGMET incorporates a source submodel for the spillage 
of LNG on water. The source is assumed to be a cylindrical 
pool. The pool radius is determined from the density 
intrusion model given by Equation 15.24.21. The pool 
radius is allowed to grow, with a corresponding decrease in 
height, until a depth is reached at which break-up occurs. 
After pool break-up, the evaporation rate is determined by 
the empirical correlation of Feldbauer et al. (1972): 

m = «max exp [ —21. {t _ ; max )j [15.29.15] 


h = [c pa (l - c) + c pg c]T + WL 0 (1 - c)f(T) 


—( 


07t 
dt + 


07t 

U dx 


07t\ 

V 8xJ 


[15.29.10] w here H min is the height at break up, m is the mass rate 

of evaporation, is the mass rate of evaporation at 

[15.29.11] break-up, t is time, f max is the time at break-up and pi is the 
density of the liquid. 


where L a is the latent heat of vaporization of water, IFis the 
mass of water per unit mass of air, and the subscripts a and 
g denote air and gas, respectively. 

These equations, which are the set given by England 
et al., describe the fluid dynamic and thermodynamic 
processes but do not include the effects of turbulence. 
Corresponding equations incorporating the turbulence 
terms, includingthe eddy diffusivities, are givenby Havens. 
He also gives a diagram showing the boundary conditions 
for solution of the model equations. 


Table 15.43 Ratio of horizontal to vertical 
diffusion coefficients (Havens, 1982a) 
(Courtesy of Elsevier Science Publishers) 


Stability category 

K h IK v 

D 

1.0 

E 

10.0 

F 

25.0 
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15.29.2 Validation and application 

England et al. (1978) give comparisons of the prediction of 
SIGMET with results of the American Gas Association 
LNG dispersion trials. They also use SIGMET to simulate 
an instantaneous spillage of 30,000 m 3 of LNG onto water. 

An assessment of SIGMET has been carried out by 
Havens (1982a), who studied the somewhat similar case of a 
25,000 m 3 LNG spill and performed a sensitivity analysis, 
investigating the effect of spill size, wind velocity and 
atmospheric stability, and made comparisons between the 
distance to the lower flammability limit for this dense gas 
and for a neutrally buoyant gas. 

SIGMET, in the version SIGMET-N, was one of four 
models in a comparative evaluation of models by Havens 
and co-workers (Havens, 1986; Havens, Spicer and 
Schreurs, 1987), the other models being ZEPHYR, 
MARIAH-II and FEM3. SIGMET-N was discarded because 
the turbulent mixing model did not scale properly and 
because of the difficulty of controlling numerical ‘diffusion’. 

15.30 Dispersion of Dense Gas: SLAB and FEM3 

A pair of models have been developed at the Lawrence 
Livermore National Laboratory (LLNL) by Chan, Ermak 
and coworkers (Ermak, Chan et al., 1982; S.T. Chan, Rodean 
and Ermak, 1984; Ermak and Chan, 1986,1988; S.T. Chan, 
Ermak and Morris, 1987). SLAB is an advanced similarity 
model and FEM3 a full three-dimensional model. 


where B is a cloud width parameter, c p is the specific heat, 
A is a cloud height parameter, Q gr is the heat flux between 
the ground and the cloud, T is the absolute temperature, 
u is the wind velocity, u c is the velocity of the cloud in 
the downwind direction, u e is the vertical entrainment 
velocity, u 0 is the velocity of material at the source, u y is 
the velocity of the cloud in the crosswind direction, w e is the 
horizontal entrainment rate, p is the density, w is the mass 
fraction of material released and subscripts a, c and o 
denote the air, cloud and source, respectively. 

The following supplementary equation is used: 


p c T c - 


Pa T a M 0 

M 0 + {Mo - M 0 )co 


[15.30.7] 


where M is molecular weight. 

The vertical entrainment velocity u e is taken as 


«e=« 


2.7 ku* 

m) 


[15.30.8] 


where k is the von Karman constant and ((Ri) is the 
Monin-Obukhov profile function given by Dyer (1974). 
The profile function <f> is 

</> = ! + 5Ri Ri > 0 [15.30.9a] 

0 = (1 — 16Ri)“^ Ri<0 [15.30.9b] 


15.30.1 SLAB 

SLAB was originally formulated by Zeman (1982a,b) and 
its development has been described by Ermak, Chan et al. 
(1982), D.L. Morgan, Kansa and Morris (1984) and Ermak 
and Chan (1986,1988). 

The SLAB model is for a continuous release. It is a slab 
model with properties averaged in the horizontal and ver¬ 
tical directions and is thus one dimensional. The model is 
based on a set of six simultaneous differential equations, 
for the conservation of total mass, conservation of the 
material released, conservation of momentum and con¬ 
servation of energy. These equations are given by Ermak, 
Chan et al. (1982) as a set of six partial differential equa¬ 
tions, in time t and downwind distance x, but subsequently 
by Ermak and Chan (1986) as six ordinary differential 


where Ri is a Richardson number and p' is an index. The 
index p' is 1/4 for momentum and 1/2 for species and energy. 
The horizontal entrainment velocity w e was given in the 
earlier versions (Ermak, Chan et al., 1982) as 


= (1.8 ) l {h/B)u e 


[15.30.10] 


where the term {h/B) implies that at low values of the height 
the horizontal entrainment rate is low but that it increases as 
the height increases. In the later version (Ermak and Chan, 
1986,1988) w e is described as a function of the ground sur¬ 
face friction coefficient and of the Monin-Obukhov length. 

The profile of the volumetric concentration C is repre¬ 
sented as 


equations in x. The latter are 


C(x,y,z) = C(x)Ci(y)C2(z) 

[15.30.11] 

W f ^ = B 0 u oPo + {Bu e + h«, e ) Pa 

[15.30.1] 

where C is the volumetric concentration and C(x), Ci(y), 
C 2 (z) are concentration functions. These functions are 

d 

[15.30.2] 

C(x) — M* 01 

W M„ + {Mo - M 0 )a> 

[15.30.12] 

d{Bhu cP oC vc T c ) = BoUof) ^ oTo + ( BUe + hWe)p ^ 

: pa 7a + Qgr 


[15.30.13] 

d(B y = -\[Btf(Pc ~ Pa)k + (5«e + hw e ) P . c 

[15.30.3] 


[15.30.14] 


[15.30.4] 

with 


d {Bhu* yPc )_^ ^ )g 

[15.30.5] 

B 2 = ft 2 + if 

[15.30.1S] 

dSfcH + M'e 
dx 

[15.30.6] 

where co is the mass fraction and b and /? 
parameters. The variation of B with x is 

are shape 
given by 
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Equation 15.30.6, and the variation of b with x is given by 


d b 
dx 


Bu c 


[15.30.16] 


FEM3 is based on a generalized anelastic approxima¬ 
tion, adapted from Ogura and Phillips (1962), which allows 
large density changes to be handled whilst precluding 
sound waves. The approximation is the use of Equation 
15.30.19 instead of 


The horizontal concentration profile is uniform when/i = 0 
and approaches a Gaussian one as ft > b. The ratio of /? to b 
remains constant under the influence of the horizontal 
velocity u y . It is the horizontal entrainment rate w e which 
causes an increase in /? and results in a crosswind Gaussian 
profile. 

The cloud shape parameters B, b and h are defined by 
Equations 15.30.15,15.30.13 and 15.30.14, and are related to 
the velocities Uy, w e and « e by Equations 15.30.6, 15.30.16 
and 15.30.2. The parameters B and h are related to the 
dispersion parameters as follows: 


V-(p c u )+-^ = ° [15.30.26] 

In FEM3 turbulence is treated using the if-theory 
approach. The eddy diffusion tensors are associated with 
three diffusion coefficients, two horizontal and one ver¬ 
tical. The latter is particularly important. In the earlier 
versions (Ermak, Chan et al., 1982) the vertical diffusion 
coefficient K v was taken as 

K y = Aa(l - to) + K p co [15.30.27] 


^ = 3B 2 15.30.17] 

of = 3 h 2 [15.30.18] 

15.30.2 FEM3 

Accounts of FEM3 have been given by Ermak, Chan et al. 
(1982), S.T. Chan and Ermak (1984), S.T. Chan, Rodean and 
Ermak (1984) and Ermak and Chan (1986,1988). 

The FEM3 model is also for a continuous release. It is a 
full three-dimensional model. The model is based on a set of 
four simultaneous differential equations, in terms of tensor 
quantities, for the conservation of total mass, conservation 
of the material released, conservation of momentum and 
conservation of energy. The equations are 


where K a is the ambient vertical diffusion coefficient, K w is 
the vertical diffusion coefficient and K p is a dense-layer 
diffusion coefficient. Two submodels were used for K p , one 
based on a Richardson number and one on a mixing length. 

In the later versions (Ermak and Chan, 1988) three sub¬ 
models are given for the vertical diffusion coefficient. In 
the first submodel 


k[ (U^f + ^h) 2 ] 1 ' 2 

v *(Ri) 


[15.30.28] 


V ■ (p c u) = 0 [15.30.19] 

+ p c u ■ Vu = - Vp + V • (p c K m ■ Vu) + (p c - p h )g 

[15.30.20] 

^ + u ■ V0 = V • (K 8 ■ V0) + Cpg ~ Cpa (K m ■ Vco) ■ V0 + S 

[15.30.21] 

~ + u-Vco = V-(K“-Vco) [15.30.22] 


u K = u*\u c /u\ [15.30.29] 

where u * is the friction velocity, u K is the cloud friction 
velocity, w K is a cloud ‘convection velocity’ and d>(Ri) is the 
Monin—Obukhov profile function. The cloud convection 
velocity is a function of the temperature difference between 
the ground and the cloud. 

The horizontal diffusion coefficient K h is taken as 

K h = [15.30.30] 

where /F is an empirical coefficient. The value of /F is taken 
as 6.5. 


u = (W) 

M g M a P 

Pc ~ RT\M e + (M a - Mg) to] 

Cpc = Cpa(l — CO) + CpgCO 


[15.30.23] 

[15.30.24] 

[15.30.25] 


where/) is the pressure deviation from an adiabatic atmos¬ 
phere at rest with corresponding density p h , Pis the abso¬ 
lute pressure, S is the temperature source term (e.g. latent 
heat), 0 is the potential temperature deviation from an 
adiabatic atmosphere, co is the mass fraction of material 
released, g is the acceleration due to gravity, K“, K s and K‘" 
are the diagonal eddy diffusion tensors for the momentum, 
energy and mass fraction, respectively, u is a velocity ten¬ 
sor, and subscript g denotes material released. The numeri¬ 
cal solution of these equations has been described by 
S.T. Chan, Rodean and Ermak (1984). 


15.30.3 Validation and application 

Ermak, Chan and coworkers (Ermak, Chan et al., 1982; 
S.T. Chan, Rodean and Ermak, 1984; Ermak and Chan, 
1986; Koopman, Ermak and Chan, 1989) compared predic¬ 
tions from SLAB and FEM3 with observations from the 
Burro trials. D.L. Morgan, Kansa and Morris (1984) have 
compared the predictions of SLAB with observations from 
the Burro and Coyote trials and Blewitt,Yohn and Ermak 
(1987) have compared its predictions with observations 
from the Goldfish trials. Touma et al. (1991) have compared 
the performance of this model with that of other models in 
relation to the Burro, Desert Tortoise and Goldfish trials. 


15.31 Dispersion of Dense Gas: HEGADAS 
and Related Models 

A series of models have been developed by Shell, leading to 
the model HEGADAS and then to the model system 
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HGSYSTEM. The first of these models was that of Te Riele 
(1977), which was followed by the model of Colenbrander 
(1980) and then HEGADAS itself. HEGADAS is com¬ 
plemented by the front-end model HEGABOX. 

Another major model, DEGADIS, developed by Havens 
and coworkers is based on HEGADAS. 


15.31.1 Te Riele model 

The model described by Te Riele (1977) is for a continuous 
release. It is based on two simultaneous partial differential 
equations for conservation of mass and of momentum. The 
assumption is made that the take-up of material into the 
ambient flow field and the dispersion of material within 
this field are independent. Other assumptions are the 
Reynolds analogy and the Boussinesq approximation. 
The basic equations are: 


an evaporating pool of liquefied gas. This source is 
modelled as a rectangular area source of length L s and half¬ 
width B s and mass rate of release per unit area Q". 
Figure 15.81 shows the general form of the model, in the 
later version HEGADAS. 

For the concentration profile it is assumed that there is a 
middle part of half-width b in which the dispersion occurs 
in the vertical direction but not in the horizontal direction. 
The width of this middle part reduces due to mixing at the 
crosswind edges of the plume and thus decreases from a 
value of 2 B at the source to zero at some point downwind. A 
concentration profile is assumed which in the vertical 
direction is Gaussian throughout but which in the cross- 
wind direction has Gaussian features at the crosswind 
edges, but becomes fully Gaussian only when the middle 
part disappears: 


dx 0y \ y dy) dz \ 2 dz) 

dpu 2 _ 0 / dpu\ 0 / dpu\ 
dx 6y V ^ 0y J 0z V 2 6z J 


where K is the eddy diffusion coefficient, u is the wind 
speed, p is the density of the cloud and subscripts x and 
y denote in the downwind and crosswind directions, 
respectively. 

The assumption that the wind speed is independent of 
the take-up of material, the presence of the dense gas layer 
and the density gradients in the ambient flow field gives 


0M 

dx 


[15.31.3] 


It can be shown from Equations 15.31.1-15.31.3 that 


= Pa T ° fd u 

p 2 \0* 


[15.31.4] 


where i 0 is the shear stress acting on the upwind ground 
surface, and subscript a denotes air. Then from Equation 
15.31.4 it is possible to derive the shear stress acting on the 
top of the plume, which gives 


[15.31.5] 


where p gI is the density downwind and r gr is the shear 
stress acting on the downwind ground surface. 

For the relation between density and concentration it is 
assumed that the ambient air and the dense gas are ideal 
gases with the same molecular specific heats and that 
equalization of temperature and density occur only 
through convection originating in atmospheric turbulence. 
Then 


~ = exp [- f| \y\<b [15.31.7a] 

~ = exp [- (£) S ] ]y\£b [15.31.7b] 

where c A is the ground level concentration on the centre 
line, and r and s are shape factors for the crosswind and 
vertical concentration profiles, respectively. 

This approach ensures a seamless transfer from the 
dense gas dispersion regime to the passive dispersion 
regime and avoids the need to define a transition point and 
to use separate models for the two regimes. 

From Equations 15.31.1-15.31.4 and 15.31.6 the integral 
form of the mass and momentum balances can be derived: 

[15.31.8] 

e (IT •***)-£&* |i5 ' 3ui 

where the subscript gr denotes ground level. 

Equation 15.31.8 is used with three different values of the 
limit yLs- These are: 

Total mass balance: y Ls —> oo 

Mass balance on middle part: y Ls < b;b > 0 

Mass balance for determination of rr.yh s = b + 0.5(2) lj/z cr J , 

This therefore gives a set of four equations, the three ver¬ 
sions of Equations 15.31.8 and 15.31.9, which are used to 
determine the four variables c A , b, a y and a z . 

The parameters necessary for this model include: the 
wind velocity u; the shape parameters r and s\ the vertical 
eddy diffusion coefficient K y ; the upstream shear stress r 0 ; 
and the mass rate of release per unit area Q". 


[15.31.6] 


where c is the concentration (mass per unit volume) and 
subscript g denotes material released. 

The prime purpose of the model is to determine con¬ 
centrations downwind of an area source such as that from 


Wind velocity 

For the wind velocity u use is made of the vertical wind 
velocity profile given in Equation 15.24.6 in the form 



[15.31.10] 
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Figure 15.81 HEGADAS model for dense gas dispersion - idealized cloud shapes (Puttock, 1987c) (Courtesy of the 
American Institute of Chemical Engineers) 


where u T is the wind speed at reference height z T and a' is an 
index. For the friction velocity use is made of Equation 
15.24.7. 


Shape parameters and eddy crosswind diffusivity 
The parameters r, s and K y are obtained by applying 
Equations 15.31.1,15.31.4,15.31.6 and 15.31.10 to the case of 
a point source with release of a neutrally buoyant gas 
(b = 0, p = p a ). This yields 


fm2 




k* = 


<5'W 1/2 

2 \ 


W h = b + — t 
/ = 2 — \/f/ 


[15.31.11a] 

[15.31.11b] 


[15.31.13] 

[15.31.14] 

[15.31.15] 


where K* is the vertical eddy diffusion coefficient at 
reference height z r acting on a concentration profile 
of width 2S, TFb, is the half-width of the crosswind 
concentration profile, and /?', y and S' are constants. The 
constants /?' and S' are obtained from the relation for the 
crosswind dispersion coefficient for a point source: 

Oy = S'xfi' [15.31.16] 

Table 15.44 gives the values of the shape parameter a' for 
the wind velocity profile given by Te Riele. The parameters 
[S' and S' are obtained from Equation 15.31.16, which corre¬ 
sponds in general form to a number of correlations for the 
crosswind dispersion coefficient. 


Shear stress 

For the shear stress r D the relation used is 


where z B is the roughness length. 


[15.31.17j; 


Take-up flux 

For the flux of material taken up into the ambient atmos¬ 
phere, or take-up flux, Q" there is a certain maximum value 
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Table 15.44 Wind velocity profile shape parameter 
(after Te Riele, 1977) (Courtesy of DECHEMA) 


Stability category 

Shape parameter, a' 

A 

0.02 

B 

0.05 

C 

0.09 

D 

0.14 

E 

0.20 

F 

0.28 


Qmax- This maximum value is obtained from Equation 
15.31.5 which yields 


where p E is the density at emission conditions and S z is 
evaluated at x = 0.5L. The length L and half-width B of the 
gas blanket are obtained from 

Q"LbS p = Q^ ax LB [15.31.22] 

where B p is half-width of the pool and Lp is the length of the 
pool. The centre line ground level concentration c A is 

c A = Pe [15.31.23] 

For the case where Q p < Qm ax , the ambient take-up rate is 

Q = Q" [15.31.24] 


[15.31.18) 

Then the value of Q" is given by 
Q" = > (% [15.31.19a] 

= ^max O'raax < Q'o [15.31.19b] 

where Q" is the mass flux of material from the source. 

The model consists of Equations 15.31.8 and 15.31.9 with 
the supplementary Equations 15.31.6, 15.31.7 and 
15.31.10—15.31.12 together with the three values of the 
integration limit y Ls - It yields the four parameters c A , b, a y 
and o z . 

The dimensionless groups which govern dense gas dis¬ 
persion are given as: 

a ,. Q"L S TqLs K*Ls Pg 

PgUrZr’ PgUfa’ B(u r ’ p a 

15.31.2 Colenbrander steady-state model 

The further development of the Te Riele model has been 
described by Colenbrander (1980). The principal features 
which he describes are developments in: the source term; 
the treatment of the four parameters - centreline con¬ 
centration c A half-width of the middle part b, cross-wind 
dispersion parameter S y and vertical dispersion parameter 
S 2 ; and in the criterion for transition to passive dispersion. 


The length L and half-width B of the gas blanket are 


L = Z P [15.31.25] 

B = B P [15.31.26] 

The centre line ground level concentration c A is obtained 
from the relation 


Q"» 


(1 + 8 


[15.31.27] 


where S z is evaluated at x = 0.5 L. 

The foregoing applies to a rectangular source. It is 
convenient in dealing with the effective source constituted 
by a gas blanket to work in terms of a circular source. 
Assuming that the rectangle is a square, the radius R of 
this source is then 


[15.31.28] 


If there is a gas blanket, the radius R h (t) of the blanket is 
taken as having a minimum value and as growing at 
the rate 


d ^ = c E [g'7i b (/)] 1 / 2 [15.31.29] 

where H b is the height of the 100% gas blanket. 

The value of Qm ax ( t) is obtained from the mass balance 


Source term 

An evaporating pool may generate above itself a gas blanket. 
The condition for formation of such a gas blanket is that the 
rate of vapour evolution per unit area Q p exceeds the ambient 
take-up rate per unit area Q'4^ of vapour. Where this is 
the case, the gas blanket grows until the area of the cloud is 
such that the rate of ambient take-up rate equals the rate of 
input into the cloud. If the rate of vapour evolution is less 
than the ambient take-up rate, a gas blanket does not form. 

For the case where Qp > Qm ax , the ambient take-up 
rate Q" is constrained to be 

Q" = (& ax [15.31.20] 

It is shown by a mass balance that 


^ (nR&t)H b (t)p B ) = nR\(t)Q!; - [15.31.30] 

For a spreading pool of radius Ri(f) 

Q"=J^ [15.31.31] 

where Q p is the total mass rate of evaporation. 

Vertical dispersion parameter 

The vertical concentration distribution given by Equation 
15.31.7a satisfies the two-dimensional diffusion equation 


PY.UrS^ 

(l4^ipR 


„ 6c = i^ 6cN ) 

0X 02 V SzJ 


[15.31.21] 


[15.31.32] 
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[15.31.33] 


Width of middle part 

The growth of the effective half-width B eff is 


d | ff = CE(^ff ) 1/2 


Ri * [15.31.34] 

where H efl is the effective height of the cloud, Ri, is a 
Richardson number, k is the von Karman constant and 
<(>( Ri,) is the Monin-Obukhov profile function. 

Then from Equations 15.31.7a, 15.31.10, 15.31.32 and 
15.31.33 


u r(l/(l + a')) c 

H * ii= 1 + a' S * 
dS eff _ 1 dS eff 

dx «e£f df 


■ I5.3l.4lj 


[15.31.42] 

[15.31.43] 


d 1 + af 

dx\z r J ZrUr </»(Ri,) 


[15.31.35] 


The ratio («,/w r ) is obtained from the logarithmic wind 
velocity profile Equation 15.24.7. Equation 15.31.35 
describes the vertical growth of a plume for the two- 
dimensional case of a plume of constant width. It is 
generalized for a dense gas plume which spreads laterally to 


_ / 0 °° cu dz 
J^cdz 


[15.31.44] 

[15.31.45] 


where u e n is the effective local cloud velocity. 

The half-width b of the middle part is obtained from 
Equation 15.31.37 with B eH obtained from Equation 
15.31.43. 


wr- 


k u, (1 + «') 2 B eff 

Z r « r flp| 




[15.31.36] 


,4/2 

£ eff = J + — Sy [15.31.37] 

where B e « is the effective half-width of the plume. 


Crosswind dispersion parameter 

The crosswind concentration distribution given by 
Equation 15.31.7b with z = 0 satisfies the two-dimensional 
diffusion equation 


u- = -(k 
dx dy \ y dry) 


[15.31.38] 




Centre-line concentration 

For the centre-line concentration ca the integral mass bal¬ 
ance with substitution of the similarity profiles for c and u 
yields 


0(1 + a')2?' 

CA +0.5)1^) 


[15.31.46] 


The foregoing treatment does not allow for dispersion in 
the along-wind direction, which can be significant. In order 
to allow for this a correction is derived which when applied 
to the centreline ground level concentration c A yields a 
concentration c A corrected for this effect. 


Transition conditions 

Transition to passive dispersion occurs when b = 0 at 
downwind distance x tI . Avirtual source is assumed to exist 
at x Y . The dispersion parameter S y is 

S y = & 2 d , (x + x v f [15.31.47] 


K y =K 0 uW)) 


„ Q , The downwind distance of the virtual source is obtained 
[lb.31.39J from Equation 15.31.47 by setting x = x tI .At transition 


where Wb, is the half-width of the cloud, K 0 is a constant 
and y" is an index. Then, again from Equations 15.31.7b, 
15.31.38 and 15.31.39, 


[15.31.40] 


For b = 0, Equation 15.31.40 describes the lateral growth of 
a plume for the case of a plume where the width of the 
middle part is zero. In the generalization for a dense gas 
plume with a finite middle part, Equation 15.31.40 still 
applies but with finite b in Equation 15.31.37. 


Sy = 2 1 / 2 o> [15.31.48] 

15.31.3 Colenbrander quasi-steady-state model 

Colenbrander has also described a method of accommo¬ 
dating within his model a transient release. The scenario 
of concern is the evaporation of a liquefied gas from a 
spreading pool. The author gives a source model which 
defines as a function of time both the rate of release Q(t) and 
the radius of the pool R(t). 

He then applies to this source the concept of ‘observers’. 
A series of observers is envisaged as passing over the 
source at fixed time intervals. A given observer i passes 
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over at a velocity u,{t) which is time dependent. The 
observer velocity increases with downwind distance and at 
a given distance x the velocity of all observers is the same 
(u,{x) = Ui + i(x)). It is implied in this that at a given time the 
velocity of observer i is greater than that of the succeeding 
observer («,{/) > u i+ i(t)). A detailed derivation of the velo¬ 
city u,{t) of passage is given by the author. 

There is then derived for each observer i a corresponding 
set of source parameters. If the times when observer i 
passes over the upwind and downwind edges of the source 
are ty, and t 2 i, respectively, and if x t {t) is the location of 
the observer at time t, the local half-width B' si (f) is 


R'jt) = \R\t) -4m 1/2 

[15.31.49] 

Then 


A<- f\ i (t)B' si (t)dt 

[15.31.50] 

Lsi = x i(t%) ~ x i(t\i) 

[15.31.51] 

B si =A si /L s i 

[15.31.52] 

o'/BsiLsi = Fwftomw 

[15.31.53] 


where for observer i, A si is the half-area of the source, B si 
is the half-width of the source, L si the length of the source 
and Q" the average take-up flux. 

Then for any specified time t s the concentration dis¬ 
tribution in the plume may be determined. At this time for 
observer i the location x t {Q is calculated and the plume 
parameters c A , b, S y and S z are obtained as functions of this 
distance. A steady-state calculation is then performed, 
utilizing Equation 15.31.7, to obtain the concentration 
attributable to this observer. The calculation is repeated for 
all observers. 


15.31.4 HEGADAS 

As already described, HEGADAS is a development of 
the models of Te Riele (1977) and Colenbrander (1980). 
Accounts of this development have been given by 
Colenbrander and Puttock (1983, 1984) and Puttock 
(1987b,c, 1989). Further enhancements of the model have 
been described by Witlox (1991). 

The basic HEGADAS model is for a continuous release of 
dense gas. The source is assumed to be an area source. The 
plume from this source is modelled as consisting of a mid¬ 
dle part which has a uniform crosswind concentration and 
an outer part which has Gaussian features. The middle part 
initially constitutes the whole plume, but eventually dis¬ 
appears completely so that the plume assumes a fully 
Gaussian form. The development of the plume is illustrated 
in Figure 15.81. The model is a prime example of an 
advanced similarity model. 

HEGADAS originally had two versions. The first, 
HEGADAS-S, is the steady-state model for a continuous 
release; this is the basic model just described. The other 
version, HEGADAS-T, is the quasi-steady-state model for a 
transient release, utilizing the Observer* concept. 

In a subsequent version of the model, described by 
Colenbrander and Puttock (1983, 1984), enhancements 


were incorporated to take account of heat transfer between 
the ground, or water, surface and the cloud. The fifth 
version, HEGADAS-5, described by Witlox (1991), deals 
with interfacing with other source models and gives a 
model for vertical sources and an improved gas blanket 
model, and contains improved treatments of gravity 
spreading and of crosswind and along-wind dispersion and 
of time step selection. It also contains an HF thermo¬ 
dynamics model. 

Witlox describes particularly the interface of HEGADAS - 
5 with the jet/plume model PLUME. Transition is taken as 
occurring when the jet/plume velocity is close to the wind 
velocity at centroid height and the air entrainment rate of 
the plume model is close to that of the dense gas model. 
There is also an advection criterion which stops the tran¬ 
sition if the cloud becomes too buoyant. The PLUME model 
gives averaged values of the density, concentration, veloc¬ 
ity and enthalpy. The matching of these variables between 
the two models is discussed in detail by the author. 

The gas blanket model, as originally formulated, exhib¬ 
ited oscillatory behaviour and has been modified to correct 
this. A model is also given for a vertical source in terms of a 
breakpoint. Using this model, breakpoint data are speci¬ 
fied for a series of times for the effective half-width and for 
any two of the following: the effective cloud height, the 
mass flow of gas and the centre line ground level con¬ 
centration of gas. 

The treatment of crosswind gravity spreading in 
HEGADAS-5 recognizes that gravity spreading undergoes 
a collapse beyond which the degree of gravity spreading is 
much reduced. This effect has been shown in wind tunnel 
work by R.L. Petersen and Ratcliff (1989) and is dealt with 
by P.T. Roberts, Puttock and Blewitt (1990). For the cross- 
wind dispersion coefficient S y use is made of an alternative 
formula for a y due to Briggs. 

The HEGADAS-5 model gives the four dependent vari¬ 
ables: crosswind dispersion coefficient S y , vertical disper¬ 
sion coefficient S 2 , effective half-width of cloud B eif and 
centre line ground level concentration c A . It contains five 
ordinary differential equations for the variables S v S z , B eff , 
H e andy w3 , where H e is the surface heat transfer andy w3 is 
the mole fraction of surface water vapour. The earlier ver¬ 
sions of the program were sensitive to the choice of time 
interval for solution of the equations. HEGADAS-5 con¬ 
tains automatic time interval selection. 

HEGADAS-5 incorporates a model of HF thermo¬ 
dynamics. This is described by Puttock et al. (1991a,b). 


Vertical dispersion 

In this later work the vertical dispersion is expressed in 
terms of the top entrainment velocity u e : 


u e =»■ 


(1 + *)ku, 

m*) 


[15.31.54] 


with Ri, defined by Equation 15.31.34. 

Improved relations are also given for the Monin— 
Obukhov profile function (/>(Ri„): 


<j>( Ri,) = 0.74 + O^Ri^ 7 +1.2 x 10“ 7 Ri® Ri, > 0 

[15.31.55a] 


0.74 

l + 0.65|Ri»|°' 6 


Ri, <0 


[15.31.55b] 
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Equation 15.31.55a applies to stable conditions and is based 
on work by McQuaid (1976b) and Kranenburg (1984), and 
Equation 15.31.55b applies to unstable conditions and is 
based on fitting data from the Prairie Grass experiments. 


Heat transfer 

For heat transfer between the ground and the cloud, 
expressions are given for both the natural and forced con¬ 
vection cases. For natural convection the expression given 
for this heat flux Q gr is 

r2 o -11/3 

Qgr = 0.14 SM ( PcCpc ) 3 (Tgr - r c ) 4/3 [15.31.56] 

with, for an ideal gas, 

p c = l/T c [15.31.57] 

where Cf is a friction factor (=(2 uju% u c is the velocity of 
the cloud, «r c is the thermal diffusivity of the cloud, /? c is the 
coefficient of volumetric expansion and v c is the kinematic 
viscosity of the cloud. For forced convection the heat flux is 
given as 


where m b is a bulk cloud velocity and u,\ is an internal 
velocity scale. The internal velocity scale u,\ is chosen to be 
consistent with the uniform density assumed over the 
height of the cloud. 

The bulk cloud velocity m b is determined as follows. 
Strictly, this quantity should be obtained from conser¬ 
vation of momentum, but there are a number of aspects 
such as the effective velocity of the air entrained in 
the cloud, which are not well understood. The approach 
taken is therefore a semi-empirical one. The cloud acquires 
momentum from the entrainment of air passing over it. 
There is evidence that the effective air velocity « A ‘seeri by 
the cloud bears a constant ratio to the average air velocity 
over the height H of the cloud and that this ratio is of 
the order of 0.7. Furthermore, the cloud must eventually 
accelerate to the velocity of the ambient air. 

These features are taken into account by using the fol¬ 
lowing relations: 

«b=/(«a) [15.31.66] 

•“-( 0 - 7+ tt [l53m 


Qgr = 1/2 ' QpCpMTgr - T c ) [15.31.58] 

15.31.5 HEGABOX 

HEGADAS models for a continuous release of dense gas the 
gravity spreading of the gas in the lateral direction. But for 
an instantaneous release, or for a non-instantaneous 
release in low wind, there is also strong gravity spreading 
along the direction of the wind. This aspect is taken care of 
by HEGABOX, which is used as a front-end addition to 
HEGADAS to cater for such cases. HEGABOX has been 
described by Puttock (1987c, 1988a). 

In HEGABOX, the cloud from an instantaneous release 
is treated as a cylinder of uniform concentration. The 
gravity spreading and air entrainment are modelled as 
follows: 


^ = ce(^) 1/2 [15.31.59] 

^ = nR 2 u e + 2nRHw e [15.31.60] 

The value of is taken as 1.15. 

For the edge entrainment velocity w e 



where y is the edge entrainment coefficient. 
For the top entrainment velocity u e 

ku, i 

“ e “ </>(Ri*i) 


4>(Ri„i) * (l + 0.8Ri„i) 1/2 



[15.31.61] 


[15.31.62] 

[15.31.63] 

[15.31.64] 

[15.31.65] 





If HEGABOX is used as a front end for HEGADAS, transi¬ 
tion is taken to occur at a transition value of Rif. This value 
is taken as 10. 

At transition the cylindrical cloud is divided into slices 
with an observer at each slice, as shown in Figure 15.82. The 
parameters with which an observer starts are as follows. 
The half-width b of the middle part is equal to the cloud 
width at that point. The width parameter S y is initially 
zero. The height parameter S z is obtained from the height H. 
The centre line ground level concentration c A is set equal to 
the uniform concentration c. 

The transition from HEGABOX to HEGADAS is illu¬ 
strated by the example shown in Figure 15.83. 


15.31.6 HGSYSTEM 

A set of models named HGSYSTEM has been developed, 
built around HEGADAS. These models were originally 
created specifically for releases of hydrogen fluoride and 
for this case the model system is called HFSYSTEM and the 
constituent models mainly bear the prefix HF. The models 
were subsequently generalized to give a set for an ideal gas. 
HGSYSTEM has been described in outline by Puttock et al. 
(1991a,b) and in detail by MacFarlane et al. (1990), Rees 
(1990) and Witlox et al. (1990). HFSYSTEM contains source 
models for an unpressurized source and for a pressurized 
source. 

For an unpressurized source the model used is EVAP, 
which describes evaporation from a pool and which con¬ 
tains two options. The first models evaporation from a pool 
of fixed size or a spreading pool on land. Evaporation is 
assumed to be mass transfer limited. The second option 
models evaporation from a spreading pool on water. Eva¬ 
poration is assumed to be heat transfer limited. 

For a pressurized source at ground level the model used is 
HFSPILL. This gives the flow of a time-varying release of 
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gas, subcooled liquid or two-phase flashing liquid. The 
models used are of an accuracy matched to that of the 
models for the later dispersion phase. 

For a pressurized release from an elevated source the 
model used is HFPLUME. This models the airborne, 
touchdown and slumping phases of the plume. An account 
of the generalized model PLUME is given in Section 15.44. 
Each of these three source models is designed to interface 
withHEGADAS. 

As stated, the models in HFSYSTEM have been gen¬ 
eralized to form the set of models for an ideal gas given in 
HGSYSTEM. This model system also contains an alter¬ 
native model PGPLUME for passive dispersion. The mod¬ 
els in HGSYSTEM are intended to give reasonable accuracy 
in the near field. One aim is to allow prediction of condi¬ 
tions both at the inlet and outlet of a mitigation system. 



Figure 15.82 HEGADAS model for dense gas 
dispersion-initial locations of Observers’ (Puttock, 1987c) 
(Courtesy of the American Institute of Chemical Engineers) 


15.31.7 Validation and application 

Te Riele (1977) compared predictions from his model 
with observations in the Bureau of Mines, van Ulden, and 
SS Gadila trials. The latter is shown in Figure 15.92(c). 
Colenbrander (1980) used the Matagordo Bay trials for 
comparison with predictions from his model. 

Validations of the various versions of HEGADAS include 
comparison of predictions from the model with observa¬ 
tions from the Maplin Sands trials by Colenbrander and 
Puttock (1983) and Puttock (1987c). 

Puttock (1987c, 1988a) has compared predictions of 
HEGABOX/HEGADAS with observations from the Maplin 
Sands and Thorney Island Phase I trials. 

J.L. Woodward et al. (1982) have compared the per¬ 
formance of HEGADAS with that of other models in rela¬ 
tion to the Matagordo Bay and Porton Down trials, and 
S.R. Hanna, Strimaitis and Chang (1991b) its perform¬ 
ance against other models for nine sets of trials, including 
the Porton Down, Maplin Sands, Thorney Island Phase I, 
Burro, Coyote, Desert Tortoise and Goldfish trials. 

15.32 Dispersion of Dense Gas: DEG ADIS 

15.32.1 DEGADIS 

As described above, the related model DEGADIS has been 
developed by Havens and coworkers (Havens, 1985,1986; 
Spicer and Havens, 1986, 1987). DEGADIS is based on 
HEGADAS, but differs in several respects and, in particu¬ 
lar, it incorporates its own source, vertical entrainment and 
heat transfer models. DEGADIS is for a continuous release 
but may be adapted to time-varying releases, and an 
instantaneous release, by treating these as a series of 
quasi-steady-state releases. 

The source model used in DEGADIS has been described 
by Spicer and Havens (1986). It describes the transition by 
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Figure 15.83 HEGABOX/HEGADAS model for dense gas dispersion - prediction of combined model for cloud 
development for Thorney Island trial 14 (Puttock, 1987c), Contours are for 500 ppm ground level concentration shown at 
20-s intervals from time of release; 20 and 40 s contours are from HEGABOX, remainder from HEGADAS (Courtesy of 
Reidel Publishing Company) 









































15/190 EMISSION AND DISPERSION 


gravity slumping from a cloud of high aspect ratio to one of 
low aspect ratio and to gravity spreading. 

The source model includes the following treatment of 
heat transfer from the ground surface to the cloud. Rela¬ 
tions are given for both natural convection and forced con¬ 
vection. For natural convection, use is made of Equation 
15.24.14. The authors state that for the hydrocarbon gases 
methane and propane this equation can be written as 

^= 18 [(3 2A7 f [15 - 32 - 1] 

For heat transfer by forced convection, use is made of 
Equation 15.24.18. Then utilizing Equation 15.31.10 to give 
at height H 


and taking Pr = 0.741, Equation 15.32.1 yields 


lV=[l.22^dj] pCp [15-32.3] 


Another feature of DEGADIS is the correlation used for 
vertical dispersion in the stratified flow phase. The corre¬ 
lation is based on analysis of data obtained by McQuaid 
(1976b) in wind tunnel experiments and other data by 
Lofquist (I960) and Kantha, Phillips and Azad (1977) and 
is shown in Figure 15.84. The vertical entrainment velocity 
« e is given by Equation 15.31.54 but with a' = 0, so that 


% „ xJk 

[15.32.2] m» “ 0(Ri») 


[15.32.4] 



Figure 15.84 Correlation of vertical entrainment velocity with bulk Richardson number (Spicer and Havens, 1986) 
(Courtesy of Elsevier Science Publishers) H eff , height at which concentration is one-tenth of the maximum value; u eff , 
effective advection velocity; w' e = dH eff /dt 
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<j>(Ri,) = 0.88 + 0.099R1]' 04 +1.4 x 10“ 25 Ri®' 7 Ri, > 0 

[15.32.5a] 


where Ri, is a modified Richardson number. 

In later treatments by the authors (Spicer and Havens, 
1987) the last term in Equation 15.32.5a is zero. The corre¬ 
lation has the properties that 


= 0.4 Ri, - 0 [15.32.6a] 

Ri, -+ oo [15.32.6b] 


taking the value of k for Equation 15.32.6a as 0.35. Equation 
15.32.6a corresponds to the passive dispersion limit. 
Account is also taken of the enhancement of vertical 
mixing by the convective turbulence due to heat transfer. 


15.32.2 Validation and application 

Havens and co-workers (Spicer and Havens, 1985, 1986, 
1987; Havens, 1986,1992; Havens etal., 1991) have compared 
predictions of DEGADIS with observations from the 
Matagordo Bay, Maplin Sands, Thorney Island Phase I, 
Burro, Coyote, Desert Tortoise, Eagle and Goldfish trials, 
and Blewitt, Yohn and Ermak (1987) have compared its 
predictions against the Goldfish trials. Touma et al. (1991) 
have compared the performance of the model with that of 
other models in relation to the Burro, Desert Tortoise and 
Goldfish trials, and S.R. Hanna, Strimaitis and Chang 
(1991b) have compared its performance against other 
models for nine sets of trials, including the Porton Down, 
Maplin Sands, Thorney Island Phase I, Burro, Coyote, 
Desert Tortoise and Goldfish trials. 


15.33 Dispersion of Dense Gas: SLUMP and 
HEAVYGAS 

Another pair of models are SLUMP and HEAVYGAS 
developed at WS Atkins. They have been described by 
Deaves (1983a,b, 1987a,b). SLUMP is a box model and 
HEAVYGAS an if-theory model with K—e modification. 


15.33.1 SLUMP 

SLUMP is described by Deaves (1987a), who refers to the 
equation set for box models formulated by Wheatley and 
Webber (1984 CEC EUR EN 9592) and deals particularly 
with the treatment in his model of slumping velocity, cloud 
advection and transition to passive dispersion. 


15.33.2 HEAVYGAS 

An account of HEAVYGAS has been given by Deaves 
(1983a). He has also described its subsequent development 
(Deaves, 1983b, 1984, 1985, 1987a,b, 1989b). The basic 


equations of the model are: 


dp 
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dxj 
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[15.33.1] 


[15.33.2] 

[15.33.3] 


where/) is the pressure, t is the time, u is the velocity, x is the 
distance, p is the viscosity, p is the density, <j> is any scalar 
quantity and subscripts i and j denote the i and; directions, 
respectively S $ and are functions which vary with the 
quantity <fx Equation 15.33.3 is the general equation for 
any scalar quantity. Thus if it is used for concentration, 
Sj, = 0 and is the eddy diffusion coefficient. 

The model incorporates the K—e modification. The 
quantities k and e may be obtained from Equation 15.33.3 
with y adjusted to give the usual form of the K—e turbulence 
model equations and with y either given as a function of k 
andc: 


[15.33.4] 


where c^, is a constant or defined in some other way such 
as a function of height for each stability category. The 
model is formulated in both two - and three-dimensional 
forms. The relative merits of the two forms has been 
discussed by Deaves (1987a). In essence, two-dimensional 
modelling is much simpler and is usually sufficient, but 
three-dimensional modelling may be required in special 
cases. 


15.33.3 Validation and application 

The predictions of HEAVYGAS have been compared 
with the results of Thorney Island Phase II trials 5 and 
21 without and with a solid fence (Deaves, 1987a) and 
trial 29 with a single building (Deaves, 1984,1985). 

HEAVYGAS has been used to model a number of appli¬ 
cations which exploit the ability of this type of model to 
deal with situations other than flat, unobstructed terrain. It 
has been used to model the dispersion of chlorine within a 
building (Deaves, 1983a) and the effect of water spray bar¬ 
riers on the dispersion of a plume of carbon dioxide 
(Deaves, 1983a,b, 1984). These studies are described in 
Sections 15.40 and 15.53, respectively. 

It has also been applied to problems arising in safety 
cases (Deaves, 1987,1989a,b). These include: the release of 
chlorine into and then from a building; the effect of individ¬ 
ual buildings on hazard ranges for chlorine; and the effect 
of a whole plant site on hazard ranges for ammonia. 
Accounts of this work are given in Section 15.40. 

15.34 Dispersion of Dense Gas: Workbook Model 

A unified methodology for dense gas dispersion is given in 
the Workbook on the Dispersion of Dense Gases (Britter and 
McQuaid, 1988). The work was supported, though not 
necessarily endorsed, by the Health and Safety Executive 
and was closely associated with theThorney Island trials. 
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15.34.1 Basic model 

The basic model is a similarity relation and consists of a 
correlation of dimensionless groups. This relation is 

c F y_ Z toref go(Q 
Co 7 Ld’T>’Z)’ D • UretLP 

^ < f & 2o k r 

D ’ gD’ p a ' D' D’ 

qV 3 , 

or -Q-, atmospheric stabilityj [15.34.1] 

where C is the volumetric concentration, C 0 is the volu¬ 
metric concentration of the initial release, D is a character¬ 
istic dimension of the source, g is the acceleration due to 
gravity, G is the source geometry, £ is the length scale of the 
turbulence in the atmospheric boundary layer, q a (t ) is the 
volumetric rate of release of material, Q a is the volume of 
material released, u rei is a characteristic mean velocity, p a is 
the density of air, p a is a characteristic density of the 
material released, and *, y and z are the distances in the 
downwind, crosswind and vertical directions, respectively. 

The influence of some of the items in Equation 15.34.1 
is relatively weak and in order to obtain a sufficient data 
set the following are disregarded: (£/£>), ( z a /D ), G and 
atmospheric stability. This then yields 

c_ i£ y z *c*n ey 3 Po 

&~ J [D , D'D ,r M' :, UrtD z \ P ’gD’ p a 

[15.34.2] 


15.34.2 Model for continuous release 

For a continuous release the concentration of interest is the 
time mean concentration C. From Equation 15.34.2 


C [x y « _q^_ p 0 1 

C„ 1 [D’D’D’UrefDi 1 ’gD’p a \ 


[15.34.3] 


For the maximum time mean concentration Cm on the centre 
line of the cloud 


_ f \ x 1° u ref Pol 

C 0 J [D’u rei D2’gD’ P;l \ 


[15.34.4] 


Since the number of terms in Equation 15.34.4 is still too 
high for the data set available, two further approximations 
are called in aid. One is the Boussinesq approximation, in 
which the density variation is neglected in the inertial 
terms but is retained in the buoyancy terms. This means in 
effect that the problem is restricted to the case where for¬ 
mally [(p 0 -Pa)/Pa]<l and, in practice, [(p 0 -p a )/pj < 1; 
the value of [(p 0 —p a )/pj for the initial release tends to 
approximate to unity or less. The Boussinesq approxima¬ 
tion allows the terms ( t4 ef /gD ) and (p 0 /pa) to be replaced by 

(«?ef/go) with 

g, o= g(Po-Pa) [15.34.5] 

where gi, is the reduced gravity of the initial release. 


The other approximation invoked is to neglect the char¬ 
acteristic dimension D of the source. D has progressively 
less effect as the distance * from the source increases, and 
becomes insignificant at about x > 5 D. 

With these simplifications, Equation 15.34.4 reduces to 


Cm r * ^o?o/«?ef 1 

[15.34.6a] 

" / L m'A 

[15.34.6b] 

with 
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[15.34.7] 

where <f> is a stability parameter. The power 1/5 is intro¬ 
duced solely to give convenient numbers. 

Equation 15.34.6b can be recast in the more useful form 

(?o/«ref) 7 

[15.34.8] 


where x„ is the distance at which the concentration is the 
fraction n of the initial concentration Cm/C 0 . 


Downwind distance to a given concentration 
The correlation of the data based on Equation 15.34.8 is 
shown in Figure 15.85(a). The correlation is intended to 
apply to the long-term average concentrations. It is based 
on both laboratory and full-scale trial data. Justifications of 
the correlation itself and of the limit of effectively passive 
dispersion are given in Appendices C and E of the report, 
respectively. The correlation is valid within the limits 


0.002 < ^ < 0.1; 0 < 0 < 4 

There are two useful relations which can be obtained from 
Figure 15.85(a). One is 




:A</>- 1/2 0>1 


[15.34.9] 


x = Aq° 0 \g' 0 )-° 2 [15.34.10] 

where A is given by Figure 15.85(b). This equation shows a 
quite strong dependence of the distance x to a particular 
concentration on source strength q„. It also shows that the 
distance decreases as the stability parameter <j> increases. 
The interpretation is that increased lateral spread more 
than compensates for the inhibition of vertical mixing. The 
other relation is 

# = 17.5 ' 0 < <£ < 3 [15.34.liji 

Thus the distance depends only on the length scale 

(?o/«ref) 1/2 - 
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(a) 
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(b) 

Figure 15.85 Workbook method for dense gas dispersion - correlation for continuous release (Britter and McQuaid, 
1988; reproduced by permission): (a) correlation; (b) parameter A 
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For low concentrations outside the range of validity 
given, the suggestion made is that Equation 15.34.10 may 
be extrapolated, but still subject to the limits on </>. 


Area bounded by a given concentration 
A method is also given to obtain the area bounded by 
a given concentration. On the basis of modelling and 
experiment the dimensions of the cloud are found to he 
approximately as follows: 

L u = D/2 + 2/ b [15.34.12] 

Lh = Lh 0 + 2.5/J 73 * 2 / 3 [15.34.1$f 

k = ^ [15.34.14] 

L ho = D + 8l h 15.34.15] 

where 4, is the buoyancy length scale, Lh is the half-width of 
the plume, L ho is the half-width of the plume at the source 
and L u is the upwind extent of the plume. 

For the height of the plume, from conservation of mass 


15.34.3 Model for instantaneous release 

For an instantaneous release the case considered is a source 
of unit aspect ratio. This allows the external length scale 
D to be equated with the internally set length scale Qi' 3 . 

Then, following an approach similar to that for the 
continuous case, 



15.34.17] 


[15.34.18] 


where i/r is a stability parameter. Again the power 1/2 is 
used solely to give convenient numbers. Then, 


[15.34.19] 



where Ly is the height of the plume. 

Equation 15.34.16 assumes that the concentration is 
homogenous throughput the plume. In fact, the concentra¬ 
tion varies with height, but the exact vertical profile is 
uncertain and variable. There is experimental evidence 
that the bulk of the material is contained within a height of 

2(<?o/«ref£h). 

Since Equation 15.34.16 is unduly conservative, an 
alternative approach is also given. This is to locate, for the 
concentration of interest, the lateral boundaries of the 
cloud at the distance (2/3 )jc„ and to join these boundary 
points with x„, as shown in Figure 15.86. 


In this case, since D = Q^ 3 , the assumption that the effect 
of D can be neglected is not necessary. 

Downwind distance to a given concentration. The 
correlation based on Equation 15.34.19 is shown in 
Figure 15.87(a). The correlation is intended to apply to 
the ensemble average of the maximum short-time (0.6 s) 
mean concentrations. It is based on both laboratory and 
full-scale trial data. Justifications of the correlation itself 
and of the limit of effectively passive dispersion are 
given in Appendices D and E of the report, respectively. 
The correlation is valid within the limits 


0.001 < ^ < 0.1; 0.7 < i/r < 10 



Figure 15.86 Workbook method for dense gas dispersion - area covered by concentration contour for continuous 
release (Britter and McQuaid, 1988; reproduced with permission) 
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(a) 



(b) 

Figure 15.87 Continued 
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Figure 15.87 Workbook method for dense gas dispersion - correlation for instantaneous release (Britter and McQuaid, 
1988; reproduced with permission): (a) correlation; (b) parameter B; (c) correlation if initial dilution already taken into 
account 


There are again two useful relations which can be obtained 
from Figure 15.87(a). One is 

= B'l' 1 ' 2 0.001 < ^ < 0.002; 2 < i/r < 10 
Qo C ° 

[15.34.20] 


x = BQl y o - y4 «* f [15.34.21] 

where B is given by Figure 15.87(b). This equation shows 
a rather weaker dependence on source strength of the 
distance x to a given concentration compared with the 
continuous case. The other relation is 


The Workbook also gives for an instantaneous release 
the correlation shown in Figure 15.88 obtained from the 
Thorney Island trials for 1 < < 5. 


Area swept by a given concentration 

For the area swept by a given concentration the method is 

as follows. A model is used which is based on gravity 

slumping 


~ = c E (g’H) 1 ' 2 [15.34.23] 


fC \ -1 / 2 

x = 2.8 (l<i/f <5 [15.34.22a] 

(C \“ 1/2 

-1.8(7 J i/'-oo [15.34.22b] 


For low concentrations outside the range of validity given, 
the suggestion made is that Equation 15.34.21 may be 
extrapolated, but subject still to the limits on i //. 

For the case where there has already been significant 
dilution of the cloud and consequent cloud acceleration the 
Workbook proposes the modification shown Figure 15.87(c). 


g>= g(P_Pal [15.34.24] 

where H is the height of the cloud, R is the radius of 
the cloud and C E is the slumping constant. The value of the 
constant c E is 1.07. By conservation of buoyancy 

8'Q = ff 0 Qo [15.34.25] 

Also 

H = Q/nR 2 


[15.34.26] 
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Figure 15.88 Workbook method for dense gas dispersion- variation of maximum concentration with scaled distance, 
Thorney Island instantaneous release trials (see text) (Britter and McQuaid, 1988; reproduced with permission) 


where Q is the volume of the cloud. Integration of Equation 
15.34.23 gives 

R(t) = [R 0 + 1.2(^ o 0„) 1/2 /] 1 / 2 [15.34.27] 

where R 0 is the initial radius. The advection velocity of the 
cloud is taken as 0.4« ref . At a distance x the arrival time 4 of 
the leading edge of the cloud is given by 

* = 0.4^4 + R( 4) [15.34.28] 


The area required is a parabola enclosing the source and 
closed off at the downwind end hy an arc of radius R(t c ). 

By conservation of mass, the cloud height H is 


_ C 0 Q 0 
~nR 2 C 


[15.34.32] 


In practice, the bulk of the material is contained within 
twice this height. 


and the departure time 4 of the trailing edge by 
* = 0.4^4 +R(t A ) [15.34.29] 

Now consider any time 4 between the arrival time 4 and the 
departure time f d . For this time 4 the distance x c of the 
leading edge is 

x c = OAureftc + R(t c ) [15.34.30] 

where x c = x, 4 = 4 and x c >x, 4 > 4- Then for a given 
concentration C of interest, the value of x c is obtained from 
the correlation given in Figure 15.87(a), or the equivalent 
equations, 4 is obtained from Equation 15.34.30 and the 
cloud half-width y c is obtained from 

y c = R(t c ) [15.34.31] 


15.34.4 Criterion for type of release 

The criterion used to distinguish between a continuous and 
an instantaneous release is based on the group (u Te fT 0 /x) or, 
alternatively, (uj'jx). 

An effectively continuous plume may be assumed if 
-> 2.5 [15.34.33a] 


— > 0.15 [15.34.33b] 

where u, is the friction velocity. This criterion applies on 
the centre line of the cloud. Larger values apply off the 
centre line. 
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Relation 15.34.33 implies that the distance x at which the 
release can be regarded as continuous recedes closer to the 
source as the duration T 0 of the release decreases. For dis¬ 
tances greater than those given by relation 15.34.33, the 
assumption of a continuous source overestimates the con¬ 
centration. An effectively instantaneous release may be 
assumed if 

<0.6 [15.34.34a] 


First the release is treated as if it were an instantaneous 
one. For an instantaneous release ij/ = 5.6 and 
x/Qo = 15.9, so that from the correlation for an instan¬ 
taneous release C m /C Q = 0.04. Then the release is treated 
as a continuous one, with a release rate q a of 2000 /T a m 3 /s. 
A series of values of C m /C Q are determined using the cor¬ 
relation for a continuous release. The results are shown in 
Figure 15.89. The figure also shows the limits determined 
from relations 15.34.35 and 15.34.36. 


In the region 


[15.34.34b] 


15.34.6 Criterion for effectively passive dispersion 

The criterion used for effectively passive dispersion is for 
a continuous release 



[15.34.37] 


0.6 < 


UreiTp 


<2.5 


and for an instantaneous release 


the release is a transient one, being neither effectively ( g l 0 Qo/’4 e f ) 1/ ' 2 < q 20 

continuous nor instantaneous. |p “ qV 3 - 


[15.34.38] 


15.34.5 Treatment of transient release 

A transient release, as just defined, may be treated by con¬ 
sidering it first as a quasi-continuous release and then as a 
quasi-instantaneous one.Taking first the quasi-continuous 
approach, a release of quantity Q a over a release duration T a 
has an effective release rate q 0 . This release rate may be 
utilized in the continuous release correlation to obtain a 
value of the concentration. This approach neglects the 
effect of longitudinal dispersion and will overestimate the 
concentration. Alternatively, the release may be treated as a 
quasi-instantaneous one with quantity release Q a . This 
approach will again give an overestimate of the concentra¬ 
tion. The recommendation is then to take as the upper 
bound of concentration the lower of the two concentrations 
obtained by these two methods. 

This treatment is based on the assumption that the 
material is transported downwind by the ambient velocity 
only. But such transport occurs also due to the buoyancy 
induced motion. For the ambient velocity the time scale is 
x/u let and for buoyancy-driven velocity it is x 2 /(g' 0 Q o) 1 ^ 2 . 
Then for an instantaneous release the additional criterion 
which must be met is 


(. g'oQo) 1/2 To 


<0.6 


[15.34.35] 


The justification of these criteria is given in Appendix A of 
the report. 

For the case of an instantaneous release where the aspect 
ratio of the cloud is not unity, the suggestion made is 
that Qo be replaced by the initial height. 

15.34.7 Thermodynamic and heat transfer effects 

In the treatment so far described, it is assumed that the 
temperature of the release corresponds to ambient tem¬ 
perature, the relevant release temperature being that which 
pertains after the source effects have subsided and any 
aerosol has evaporated. If this is not the case, there are two 
additional effects, one thermodynamic and one of heat 
transfer, for which allowance needs to be made. 

The first effect relates to the non-linear variation of 
temperature and density with volume fraction (or mole 
fraction) where the species have different molar specific 
heats. Considering the initial concentrations, the non- 
isothermal initial volume is V a and the isothermal initial 
volume VJ'JTo, where T a and T a are the absolute tempera¬ 
ture of the air and the initial release, respectively, so that 
the isothermal concentration C ; and the non-isothermal 
concentration C n i are 

C ni = 1 ^_ [15.34.39] 


By a similar argument for a continuous release the buoy¬ 
ancy-driven time scale is ^ 1/3 /(g^? 0 ) 1/3 and the additional 
criterion is 


> 2.5 [15.34.36] 

As an illustration, consider the example given in the 
Workbook. This is the determination of the concentration 
ratio C m /C Q at a distance of 200 m for a release of a total 
of 2000 m 3 of dense gas with initial reduced gravity 
10 m/s 2 with a wind speed at reference height of 2 m/s 
for some release timeT 0 such that the release is truly neither 
instantaneous nor continuous. The procedure is as follows. 


(8^. ) V3 T 0 

*4/3 


and 

l/T/T 

q ~ ywV. [15 ' 3440] 

where subscripts a, i and ni denote ambient, isothermal and 
non-isothermal, respectively. Hence 


Q - - Gni _ 

' Ca-Cy/Ta/To) 


[15.34.41; 


For example, for LNG at -162°C (111 K) and with 
ambient temperature of 17°C (290 K), a non-isothermal 
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Figure 15.89 Workbook method for dense gas dispersion - treatment for transient release (Britter and McQuaid, 1988; 
reproduced with permission) 


concentration of 0.05 in Equation 15.34.41 gives an iso¬ 
thermal concentration of 0.02. 

The Workbook states that this effect is probably not sig¬ 
nificant for most hazardous materials, but it is for methane 
and hydrogen. It suggests that it be handled by determin¬ 
ing the following two limiting cases (Cases A and B). For 
Case A the source density difference and volume, or volu¬ 
metric flow, are used in the correlations. For Case A the 
density difference at the concentration of interest and the 
volume which satisfies mass conservation are obtained. A 
revised source density difference, source temperature and 
source volume, or volumetric flow, are then determined 
based on mass conservation, pure species at the source, 
adiabatic mixing and a constant molar specific heat equal 
to that of the ambient air, and used in the correlations. 

These two limiting cases (A and B) are then compared. If 
the difference is small, the effect is unimportant. If it is 
neither large nor small, say a factor 2, the more pessimistic 
estimate is used. If it is large, say more than a factor of 2, 
further investigation may be warranted. 

The second effect relates to heat transfer. This occurs by 
(a) air entrainment, (b) heat transfer at the surfaces of the 
cloud, particularly the lower surface and (c) latent heat 
exchange due to condensation and re-evaporation of water 
vapour. There is some uncertainty as to the effect of such 
heat transfer. Although it is usually assumed that it works 
to reduce the downwind extent of the cloud, it is not certain 
that this is universally the case; there may be parameter 
ranges where the reverse could be so, particularly if the sole 
effect of heat transfer is on density. This is a reflection of 
the uncertainty concerning the relative effects of inhibition 


of vertical mixing and of increase in the top area of the 
cloud. The authors’ correlations suggest that this may vary 
with the stability condition. 

This effect is handled in the Workbook by determining 
the following two limiting cases (Cases A and B). For Case A 
the source density difference and volume, or volumetric 
flow, are used in the correlations. For Case B the conditions 
of Case A are taken as the starting point. It is then assumed 
that heat addition at the source raises the cloud tempera¬ 
ture to the ambient temperature. The revised source den¬ 
sity difference and volume, or volumetric flow, obtained 
from this temperature are then used in the correlations. 
These two limiting cases (A and B) are then compared, the 
approach being identical to that used for the thermo¬ 
dynamic effect. 


15.34.8 Concentration vertical profile 

This basic method provides an estimate of the alongwind 
concentration profile but not of the crosswind or vertical 
concentration profiles and implies by default that the con¬ 
centration is uniform in both these directions. 

For crosswind concentration, the Thorney Island trials 
confirm that the assumption of uniform concentration is 
reasonable near the source where density effects are 
dominant. However, further from the source the cloud 
becomes diffuse at the edges. A criterion for the develop¬ 
ment of these diffuse edges has been given by Britter and 
Snyder (1988). This is the condition , where is 

the reduced gravity corresponding to the maximum 
concentration and h is a measure of plume height. 
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For a continuous release, the development of diffuse 
edges is due partly to true plume dilution and partly to 
meandering. For an instantaneous release, the equivalent 
to meandering is the difference between different members 
of an ensemble of trials at the same nominal conditions. It is 
necessary to decide whether the frame of reference is to be a 
fixed point one or a relative one such as that obtained by 
overlaying the centres of mass of the ensemble members. 

For vertical concentration, the trials show clearly that 
the profile is not uniform. The variation of the vertical 
concentration can be represented by the relation 

C a exp(-z”) [15.34.42] 

In the Gaussian models used for passive dispersion the 
profile is normal with n = 2. Avalue of n = oo corresponds 
to a uniform distribution. The Workbook suggests that a 
more appropriate value of n is about 1.5. It also states that 
where density effects are strong, there is evidence pointing 
to a still smaller value of n. 

In any event, there is in dense gas dispersion a very rapid 
change in concentration close to the surface. Implications 
of this are that it is necessary to exercise care in specifying 
a ground level concentration and that such a concentration 
may not be that most relevant to hazard assessment. 

15.34.9 Dispersion at buildings and obstacles 

The treatment of the effect of buildings and obstacles in the 
Workbook is limited to releases upwind and releases in the 
immediate lee. The Workbook treatment of these two cases is 
described in Section 15.40. Broadly, the effect of a building 
or obstacle on a release upwind is to reduce the concentra¬ 
tion at a given distance. The evidence is that, even close to 
the face, the upwind concentration is not increased and that 
downwind it is significantly reduced. 

15.34.10 Dispersion in complex terrain 

The treatment of complex terrain in the Workbook is limited, 
but consideration is given to two bounding cases. One is 
where the topographical feature is large compared to the 
scale of the release and the other where it is small. If the 
feature is large relative to the scale of the release, the topo¬ 
graphy will tend to reduce locally at the source to a rela¬ 
tively simple feature, typically a slope. 

If the feature is small relative to the scale of the release, 
the dense gas will tend to flow around it. For the case 
where the cloud or plume is very wide compared with the 
feature, the Workbook gives the following criterion for the 
cloud to flow over or around the feature: 

Flow over crest of feature: 



Flow around feature: 



where h c is the height of the crest. 

15.34.11 Concentration and concentration fluctuations 

The Workbook discusses concentration and its definition 
and use in models, including the Workbook correlations, and 


considers concentration fluctuations. The Workbook treat¬ 
ment of concentration is described in Section 15.45. The 
concentration used in the Workbook correlations is defined 
in Section 15.34.2 for a continuous release and in Section 
15.34.3 for an instantaneous release. For a continuous 
release the concentration in the Workbook correlations is the 
long-term average, whilst for an instantaneous release it is 
the ensemble average of the maximum short-time (0.6 s) 
mean concentrations. 


15.34.12 Validation and application 

The Workbook includes a section on comparisons between, 
on the one hand, the predictions of its correlations and, on 
the other, observations from the field trials on LNG and 
liquefied propane at Maplin Sands, the Burro trials at the 
Nevada Test Site on LNG, the Thorney Island trials on 
Freon, and the chlorine trials at Lyme Bay, and the predic¬ 
tions of other models for these trials. The models include 
the following: the Germeles - Drake model; SLAB and 
FEM3; the BG/C&W model; HEGADAS; DEGADIS; a 
model by Wheatley etal. (1987 SRD R438); and a correlation 
by the Center for Chemical Process Safety (CCPS, 1987/2). 
Figure 15.90 shows a comparison given in the Workbook 
between the predictions of its correlation and those of 
DEGADIS for continuous releases of propane in the Maplin 
Sands trials. A comparison is also made between the pre¬ 
diction of the correlations and the observed cloud dimen¬ 
sions in the Potchefstroom incident (Lonsdale, 1975). 

In estimating the distance to the LFL, the Workbook 
correlations were generally in good agreement. However, 
the correlations are essentially for gas clouds at ambient 
temperature and are not intended to handle very cold clouds 
such as those formed by LNG. The predictions for the Burro 
trials were conservative, even after utilizing the cold gas 
correction to the isothermal correlation. 


15.35 Dispersion of Dense Gas: DRIFT and 
Related Models 

A family of dense gas dispersion models based on a set of 
fundamental conservation equations has been developed 
by the SRD. The work is described in the following reports: 
Mathematical Modelling of Two-phase Release Phenomena in 
Hazard Analysis (Webber etal., 1992 SRD R584), Description 
of Ambient Atmospheric Conditions for the Computer Code 
DRIFT (Byrne et al., 1992 SRD R553), A Differential Phase 
Equilibrium Model for Clouds, Plumes and Jets (Webber and 
Wren, 1993 SRD R552), A Model of a Dispersing Dense Gas 
Cloud and the Computer Implementation DRIFT. I, Near- 
instantaneous Releases (Webber et al., 1992 SRD R586) and 
A Model of a Dispersing Dense Gas Cloud and the Computer 
Implementation DRIFT. II, Steady Continuous Releases 
(Webber et al., 1992 SRD R587). These reports may be 
summarized as 


Source term R584 

Ambient atmospheric model R553 

Differential phase R552 

equilibrium model 

Integral dispersion model: R586 

near-instantaneous release 
Integral dispersion model: R587 

steady continuous release 
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Figure 15.90 Workbook method for dense gas dispersion-comparison of predictions of Workbook correlation with 
those of DEGADIS for Maplin Sands continuous propane spills (Britter and McQuaid, 1988; reproduced with permission) 


15.35.1 Source term model 

The source term model is given in R584, which is in 
four parts: (1) modelling of two-phase jets; (2) modelling 
jets in ambient flow; (3) differential phase equilibrium 
model for clouds, plumes and jets and (4) dynamics of two- 
phase catastrophic releases. The third part is the same as 
R552. 

15.35.2 Differential phase equilibrium model 

The differential phase equilibrium model given in R552 is a 
simple two-phase model of the thermodynamics of the 
cloud. It provides a module which covers this aspect only 
and is intended to be used in combination with a set of fluid 
flow models which cover aspects such as the source term, 
air entrainment and deposition. The model can handle dry 
or moist air and contaminants which are immiscible with 
water or water soluble. The report includes a treatment of 
hydrogen fluoride in moist air. 

15.35.3 Ambient atmospheric conditions model 

The model for ambient atmospheric conditions described 
in R553 supplies the meteorological parameters required 
by the DRIFT model. The DRIFT model requires the fol¬ 
lowing meteorological parameters: the roughness length 
z 0 , the friction velocity u * and the Monin-Obukhov length 
scale L s (or rather the reciprocal 1/L S ). The two latter 


quantities are obtained from the ambient atmospheric 
conditions model. 

This model gives three schemes for determining 1 /L s . 
The first is the Monin-Obukhov scheme itself and the 
other two schemes are named after Pasquill and Holtslag. 
In the Pasquill scheme use is made of the relationship given 
by Colder (1972) between z D and 1 /L s , which has been 
described in Section 15.12. The graph given in Figure 15.45 
by Colder is fitted by the following equation: 

1 /Ls = (1/Tref) [loglo(Zo/Zref)] [15.35.1] 

where L s is the length scale (m), z 0 is the roughness length 
and L re f (m) and z Tef (m) are the corresponding refer¬ 
ence values. The two latter quantities are functions of the 
Pasquill stability class: 


Pasquill stability category 

Tref(m) 

Zref(m) 

A 

33.162 

1117 

B 

32.258 

11.46 

C 

51.787 

1.324 

D 

oo 

- 

E 

-48.330 

1.262 

F 

-31.325 

19.36 
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The Holtslag scheme (Holtslag and van Ulden, 1983) 
involves the estimation of the sensible heat flux H , which is 
a function of the solar radiation and the albedo of the sur¬ 
face. The length scale L s is obtained from Equation 15.12.46. 

For al three schemes the friction velocity u * is obtained 
from the wind speed at the height of interest using the 
similarity profile of Businger et al. (1971). 


15.35.4 DRIFT: near-instantaneous release 

The dense gas dispersion model itself is DRIFT (Dense 
Releases Involving Flammables or Toxics), an inte¬ 
grated model which is described in two reports: the near- 
instantaneous release version in R586 and the steady 
continuous release version in R587. The DRIFT models 
have similarities to the earlier SRD models DENZ and 
CRUNCH, but represent a significant advance on these. 
They incorporate both a more comprehensive thermo¬ 
dynamic module and improved models for the dispersion 
processes. 

It is convenient to describe first the near-instantaneous 
model. The model uses the coordinate system (£, y, z ) of 
Wheatley (1986 SRD R445), where y is the crosswind coor¬ 
dinate, z is the vertical coordinate and { is a coordinate 
described as the downwind coordinate relative to the 
skewed cloud axis. This allows for the case where the cloud 
is not a right cylinder but ‘leans over’. The variable { is 
defined as 

f [15.35.2] 

x'^x-X [15.35.3] 

where x (is a relative coordinate (m), X is the downwind 
coordinate of the cloud centre (m), Z is the vertical coordi¬ 
nate of the cloud centroid (m), f is a measure of the skew¬ 
ness of the cloud and {is a downwind coordinate relative to 
the skewed cloud axis (m). 

A characteristic feature of the model is the way in which 
the air entrainment is modelled. Use is made of a general 
profile which comprehends both the top-hat and Gaussian 
approaches. This means that it is possible to dispense with 
arbitrary definitions of the cloud boundary, such as a 
concentration which is one-tenth that of the centre line 
concentration and that there is seamless transfer between 
the dense gas and passive gas dispersion regimes. 

The concentration is expressed as 

C=C m F b (^,y)F v (z) [15.35.4] 

F b {U) = exp {-U/ ai f + (y/a z ) 2 r /2 } [15.35.5] 

F v (z) = exp[-(z/« 3 ) s ] [15.35.6] 

where C is the concentration, C m is the ground level centre 
concentration and «i, a 2 , a 3 , s and w are parameters. 

The DRIFT model contains a model of the atmosphere 
with profiles of the wind speed and the diffusion coeffi¬ 
cient and relationships for the moisture content. Essen¬ 
tially, the model may be regarded as a framework which 


takes care of the basic conservation relations and into 
which can be slotted models for the cloud dynamics and 
cloud thermodynamics. The former includes models for 
lateral spreading, air entrainment and vertical diffusion, 
downwind travel, and so on. 

For the cloud thermodynamics there is a basic homo¬ 
geneous equilibrium model. Models are also provided cov¬ 
ering a number of additional options such as moist air, 
contaminant immiscible with or miscible in water and for 
ammonia and hydrogen fluoride. It will be apparent from 
this description that the model has the ability to accom¬ 
modate new models both for cloud dynamics and cloud 
thermodynamics as these may be developed. 

15.35.5 DRIFT: steady continuous release 

The second DRIFT model, for a steady continuous release, 
which is described in R587, is essentially similar, but uti¬ 
lizes variables representing mass flux rather than mass, 
and so on. Apart from this the two versions, and the reports 
R586 and R587, are very similar. 

15.35.6 Validation and application 

Accounts of the application and validation of DRIFT do not 
as yet seem to have appeared. 

15.36 Dispersion of Dense Gas: Some Other 
Models and Reviews 

Several other models, or sets of models, and reviews of 
models merit brief mention. The field trials referred to in 
this account are described in Sections 15.37 and 15.38. 

15.36.1 Eidsvik model 

Another early and influential box model was that by 
Eidsvik (1979,1980). The model utilizes the basic box model 
Equations 15.24.24 and 15.24.25. The vertical entrainment 
velocity is taken to be a function of a characteristic vertical 
turbulent velocity and the Richardson number. 

15.36.2 Fay and Ranck model 

Another box model frequently mentioned is that by Fay and 
Ranck (1983). This again uses the same two basic box model 
equations.The vertical entrainment velocity is taken as the 
product of the friction velocity and a function of the 
Richardson number. 

15.36.3 TNO models 

Several models for dense gas dispersion have been devel¬ 
oped at TNO. One of these is the model described by van 
Buijtenen (1980). This models the dispersion as an initial 
phase of slumping without entrainment of air followed by a 
phase in which gas is ‘picked off’ into the air from the top of 
the cloud. Its subsequent dispersion is modelled as passive 
dispersion from a number of sources on the top of the cloud. 
A further account of TNO dense gas dispersion models is 
given by Verhagen and Buytenen (1986). 

15.36.4 TRANSLOC 

One of the early if-theory models for dense gas dispersion, 
SIGMET, has already been described. Another early 
if-theory model was TRANSLOC, produced at the Battelle 
Institute at Frankfurt, and described by Schnatz and 
Flothman (1980). Further information on TRANSLOC is 
given in the comparative review by Blackmore, Herman 
and Woodward (1982). 
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15.36.5 VKI models 

The von Karman Institute (VKI) in Belgium has produced a 
number of models for dense gas dispersion. Early work was 
done by Foussat (1981). Van Dienst et al. (1986) have descri¬ 
bed subsequent work. Further development includes the 
BITC model referred to below. 


15.36.6 BITC model 

The Bureau International Technique du Chlore (BITC) and 
the VKI have developed a model for dense gas dispersion, 
with particular reference to chlorine. An account of the 
model is given by Vergison, van Dienst and Easier (1989). 
The BITC model is a three-dimensional one. 


15.36.7 ZEPHYR 

A further if-theory model is ZEPHYR, developed by 
Energy Resources Co. (ERCO) for Exxon Research and 
Engineering, as described by McBride (1981). The com¬ 
parative review by Blackmore, Herman and Woodward 
(1982) gives further information on ZEPHYR. It is one of 
the models considered in the comparison of model predic¬ 
tions and results of the field trials at Matagordo Bay and 
Porton Down described by J.L. Woodward et al. (1982). 


15.36.12 COPS correlation 

The CCPS (1987/2) has obtained expressions for the 
dilution ratio V/V 0 , including the following relation 
obtained from dimensional analysis: 



where V is the volume of the cloud and subscript o denotes 
initial. They obtain a fit to the Thorney Island Phase I 
instantaneous releases with the correlation 



[15.36.2] 


C 

Co 




where C is the volumetric concentration. 


[15.36.3] 


15.36.8 MARIAH and MARIAH-II 

MARIAH is a if-theory model developed for Exxon 
Research and Engineering by Daygon-Ra. Descriptions 
have been given by Taft (1981) and Taft, Ryne and Weston 
(1983). MARIAH is one of the models included in the com¬ 
parative review by Blackmore, Herman and Woodward 
(1982). The comparison given by J.L. Woodward et al. (1982) 
of model predictions with the results of the field trials 
at Matagordo Bay and Porton Down includes those of 
MARIAH. 

Havens, Schreuers and Spicer (1987) have described an 
updated version, MARIAH-II, and given a comparison of 
its predictions with results of the Thorney Island field 
trials. 


15.36.9 DENS20 

DENS20 is an advanced slab model which has been 
described by Meroney (1984a). He gives comparisons of the 
prediction of the model with results both from wind tunnel 
experiments and from the Porton Down and Burro trials. 

15.36.10 MERCURE-GL 

The MERCURE-GL (GL = gaz lourd) model has been 
developed at Electricite de France (EOF) and described by 
Riou (1987,1988) and Riou and Saab (1986). MERCURE-GL, 
which is a three-dimensional model, is a development of 
the non-hydrostatic model MERCURE (Caneffl et al., 1985). 
The accounts by Riou (1987,1988) and Riou and Saab (1986) 
include comparisons of model predictions with results of 
the Thorney Island trials. 

15.36.11 DISP2 

DISP2 is a pair of advanced box models, one for an instan¬ 
taneous release and one for a continuous release, developed 
at ICI. Accounts have been given by Fielding, Preston and 
Sinclair (1986) and Preston and Sinclair (1987). The latter 
describe the calibration of the model against the results of 
theThorney Island trials. 


15.36.13 Reviews of model characteristics 

A number of reviews have been published in which the 
characteristics, as opposed to performance, of dense gas 
dispersion models are compared. These include reviews by 
Blackmore, Herman and Woodward (1982), Webber (1983 
SRD R243), Wheatley and Webber (1984 CEC EUR 9592 EN) 
and the CCPS (1987/2). 

Characteristics typically considered in such reviews 
include: 

(1) Source elevation: ground level, elevated. 

(2) Source dimensions: point, line, area, spreading pool. 

(3) Source type: jet, plume, evaporating pool. 

(4) Type of release: instantaneous, continuous, transient. 

(5) Meteorological conditions: wind speed, including 
calm conditions; stability conditions; atmospheric 
humidity. 

(6) Topography: flat, sloping terrain; open, obstructed 
terrain. 

(7) Type of model: modified Gaussian, box, if-theory, 
other. 

(8) Submodels of model: gravity-driven flow; momentum 
relations; cloud advection; air entrainment; heat 
transfer. 

(9) Model outputs: cloud width, height; concentration 
profiles vs downwind distance, crosswind distance, 
time. 

Reviews of the performance of dense gas dispersion mod¬ 
els are considered in Section 15.41. 

15.36.14 Webber generalized box model 

Webber (1983 SRD R243) has given a generalized box 
model in the form of a set of dimensionless equations. The 
basic box model equations, corresponding to Equations 
15.24.24 and 15.24.25, are given as 
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trUtMt) 

[15.36.5] 

with 


r = R/Ro 

[15.36.6] 

h = H/H 0 

[15.36.7] 

v=V/V a 

[15.36.8] 

t=t/t 3 

[15.36.9] 

R o 

° 2ut0 

[15.36.10] 


where H is the height of the cloud, R is the radius of the 
cloud, / is the time, t a is an initial time scale, u t is the cloud 
front velocity, V is the volume of the cloud, h, r, t and v are 
normalized values of H, R, t and V, respectively and o 
denotes initial. 

Integration of Equation 15.36.4 gives 
r=(l + t) V2 [15.36.11] 

Dividing Equation 15.36.5 hy Equation 15.36.4 yields 


15.37.1 Early work 

A series of experiments on dispersion of chlorine over 
water were carried out at Lyme Bay in 1927 (McClure, 1927). 
A summary of these trials has been given by Wheatley etal. 
(1988SRDR438). 

In 1967, some chlorine dispersion experiments were 
conducted at the Chemical Defence Establishment (CDE), 
Porton Down, for ICI and BP. Other than this, there appears 
to have been little work on dense gas dispersion prior to 
1970. 

In 1966-67, Air Products carried out experiments in 
which liquid oxygen was spilled into a bund and a steady 
continuous release maintained using a water spray and the 
oxygen concentration in the gas plume was measured 
(Lapin and Foster, 1967). 

Some 18 experiments in which about 0.2 m 3 of LNG was 
spilled into a 2 m 2 bund with three types of surface were 
carried out in 1968 for the American Gas Association 
(AGA) by Thomson Ramo Woolridge (TRW) (Seargeant and 
Robinett, 1968). The vaporization rate decreased over the 
course of the experiment. Measurements were taken of the 
methane concentration in the plume. The correlation pre¬ 
sented gives the concentration decreasing proportionately 
with downwind distance. 
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[15.36.13b] 
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where me is the edge entrainment velocity, mt is the top 
entrainment velocity, m e and Ur are normalized values of m e 
and m t , respectively, and a and /? are parameters. Webber 
then classifies models according to the dependency of u E 
and Ut on v. 


15.37 Dispersion of Dense Gas: Field Trials 

As already indicated, there have been a large number of 
field trials conducted on the dispersion of dense gases. 
Accounts of such field trials have been given by Puttock, 
Blackmore and Colenbrander (1982), McQuaid (1984b), 
Koopman, Ermak and Chan (1989) and Havens (1992), and 
also hy Blackmore, Herman and Woodward (1982) and 
Koopman etal. (1986). 

A summary of these trials is given in Table 15.45 and 
details of some of the principal trials are given inTable 15.46. 
Details of the Porton Down, Maplin Sands and Thorney 
Island trials are given separately below. 


15.37.2 Bureau of Mines trials 

The Bureau of Mines (BM) performed a series of trials in 
1970—72 involving the vaporization and dispersion of LNG 
following spillage on water, as reported by Burgess and 
coworkers (Burgess, Murphy and Zabetakis, 1970 BM RI 
7448, S 4105; Burgess, Biordi and Murphy, 1972 BM PMSRS 
4177). In the 1970 work, some 51 trials were conducted in 
which LNG was spilled instantaneously on water and the 
pool spread and vaporization were measured; measure¬ 
ments of gas dispersion were not taken. Four trials were 
also carried out with continuous spillage of LNG and in 
these the gas dispersion was measured. The Pasquill- 
Gifford relations were used to model the dispersion, the 
data being correlated by taking the ratio a y /<j z as 5, indi¬ 
cating a relatively flat cloud. A further 13 continuous spil¬ 
lage experiments were done in 1972, of which six were 
usable. The ratio o y /o z was again high. 

15.37.3 Esso/API trials 

In 1971, a series of spillages of LNG onto the sea were car¬ 
ried out in Matagordo Bay, Texas, by Esso under the aus¬ 
pices of the AGA (Feldbauer et al, 1972). The concentration 
of methane in the cloud was measured. There were 10 
smaller experiments of about 0.9 m 3 and seven larger ones 
of between 2.5 and 10.2 m 3 ; the former were virtually 
instantaneous and the latter nearly so. Again high values of 
the ratio a y /a z in the Pasquill-Gifford model were 
obtained. Downwind concentrations obtained in these tests 
are shown in Figure A7.3. 

15.37.4 Gaz de France trials 

A series of 40 experiments involving the instantaneous 
spillage of LNG into a bund were performed in 1972 at 
Nantes by Gaz de France to investigate vaporization, dis¬ 
persion and combustion (Humbert-Basset and Montet, 
1972). Most of the tests involved the spillage of 3 m 3 into 
bunds with areas 9-200 m 3 . The vaporization rate 
decreased with time. There was also a test with a con¬ 
tinuous release of 10 m 3 /h. 
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Table 15.45 Some field trials on dense gas dispersion 

Location 

Date 

Gas 

Code name 

Organization a 

References 

A Refrigerated liquefied gas 

California 

1966-67 

Oxygen 


Air Products 

Lapin and Foster (1967) 


1968 

LNG 


AGA/TRW 

Seargeant and Robinett (1968) 

Various 

1970-72 

LNG 


Bureau of Mines 

Burgess, Murphy and Zabetakis 






(1970 BM RI4105); Burgess, 

Biordi and Murphy(1972 BM RI 4177) 

Matagordo 

1971 

LNG 


Esso/API 

Feldbauer et al. (1972) 

Bay Nantes 

1972 

LNG 


Gaz de France 

Humbert-Basset and Montet (1972) 

SS Gadila 

1973 

LNG 

Gadila 

Shell 

Kneebone and Prew (1974) 

Capistrano 

1974 

LNG 


AGA/Battelle 

Duffy, Gideon and Putnam (1974) 

China Lake 

1978 

LNG 

Avocet 

US DOE/LLNL 

Koopman, Bowman and Ermak (1980) 

China Lake 

1980 

LNG 

Burro 

US DOE/LLNL 

Koopman et al. (1982) 

China Lake 

1981 

LNG 

Coyote 

USDOE/LLNL 


Maplin Sands 

1980 

Propane, LNG 


Shell/NMI 

Puttock, Blackmore and 






Colenbrander (1982) 

NTS b 

1987 

LNG 

Falcon 

US DOT, 

T.C. Brown et al. (1989) 





GRI/LLNL 


B Pressurized liquefied gas 

NTS C 

1983 

Ammonia 

Desert 

USCG,TFI/LLNL 

Goldwire (1985,1986) 




Tortoise 



NTS C 

1983 

Nitrogen 

Eagle 

USAF/LLNL 

McRae et al. (1984); McRae (1986) 



tetroxide 




NTS 

1986 

Hydrogen 

Goldfish 

Amoco/LLNL 

Blewitt,Yohn, Koopman 



fluoride 



and Brown (1987) 

NTS 

1988 

Hydrogen 

Hawk 

HMAP 

Diener (1991) 



fluoride 




C Ambient pressure and temperature gas 

Netherlands 

1973 

Refrigerant 12 


DGL 

van Ulden (1974); Buschmann (1975) 

Porton Down 

1976-78 

Refrigerant 12 


HSE/CDE 

Picknett (1981) 

Thorney Island 

1980-83 

Refrigerant 12 


HSE/NMI 

McQuaid (1985b, 1987) 


a AGA, American Gas Association; API, American Petroleum Institute; CDE, Chemical Defence Establishment, Porton Down; DGL, Directorate 
General of Labour, the Netherlands; GRI, Gas Research Institute; HMAP, Hydrogen Fluoride Mitigation and Assessment Program; HSE, Health 
and Safety Executive; LLNL, Lawrence livermore National Laboratory; NMI, National Maritime Institute; TFI, The Fertilizer Institute; TRW, 
Thomson Ramo Woolridge; USAF, US Air Force; USCG, US Coast Guard; US DOE, US Department of Energy; US DOT, US Department of 
Transportation. 
b NevadaTest Site. 

c Area of NTS known as Frenchman Flat. 


These trials showed several features of interest. Follow¬ 
ing the spillage the vaporization was initially very rapid 
but then fell to a lower, plateau value. The initial visible 
cloud was observed to separate from the steady plume. 
The flammable region was always contained within the 
visible cloud. In a number of tests the cloud tended to lift off 
the ground in its later stages. 

15.37.5 SS Gadila trials 

In 1973, larger scale trials of spillage of LNG onto the sea 
were performed by Shell from the SS Gadila, a LNG carrier 
(Kneebone and Prew, 1974; Te Riele, 1977). The vessel was 
being commissioned and the purpose of the trials was to 
confirm recommended procedures for jettisoning cargo in 
an emergency. The study of gas dispersion was not a main 
intent, but photographs were taken of the cloud. There were 
six tests lasting some 10 min and involving releases of up to 
200 m 3 . The liquid was ejected from a nozzle at the stern 


18 m above the water. It is believed that vaporization was 
complete before the jet reached the water surface. In two of 
the tests the ship was stationary and in the others it was 
moving at up to 10.5 knots. The wind speed at 30 m was 
1.9-5.1 m/s with a stable atmosphere. The relative humid¬ 
ity was 80-85%. 

Two trials, tests 4 and 6, have proved of particular inter¬ 
est. In test 4, the flow was 7.6 m/min (53.5 kg/s) of LNG with 
a wind speed of 5.1 m/s. The visible cloud was 1370 m long, 
although with considerable inhomogeneity beyond 1000 m. 
The plume had a maximum width of 300 m at 750 m down¬ 
wind. Its height was about 8—10 m. This test is shown in 
Figure 15.91. 

In test 6, the flow was 19.3 m 3 /h (136.5 kg/s) with a wind 
speed of 3.9 m/s. The plume was more coherent and had a 
visible length of 2250 m, which was still increasing at the 
end of the test. It had a maximum continuous width of 550 m 
and a height of about 10-12 m. The outline of the plume is 
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Table 15.46 Experimental conditions in some field trials on dense gas dispersion 

Trial 

Date 

Gas 

Surface 

Topography 



Release 







Type 

No 

Volume 

Volumetric 

Duration 







(m 3 ) 

(min 3 /min) 

(mi„) 


BM a 

1970 

LNG 

Water 


I c 

51 

0.04-0.5 



BM 

1970 

LNG 

Water 


C 

4 

0.2—0.3 



Esso/API a 

1971 

LNG 

Sea 


I 

17 

0.09-10.2 


0.1-0.6 

BM 

1972 

LNG 

Water 


C 

13 

0.2-1.3 


<10 

Gazde France 

1972 

LNG 

Soil 

Bund 

I 

40 

<3 






Soil 

Bund 

c 

1 

0.16 


4.5 

Gadila 

1973 

LNG 

Sea 


c 

6 

27-198 

2.7-19.8 

10 

Avocet 

1978 

LNG 

Water 



4 

e.4.5 

4 


Burro b 

1980 

LNG 

Water 



8 

40 

12-18 

2.2—3.5 

Coyote 

1981 

LNG 

Water 



15 

3-28 

6-19 

0.2-2.3 

Desert 

Tortoise 

1983 

Ammonia 

Land 



4 

15-60 

7.3-10.3 


Eagle 

1983 

Nitrogen 

tetroxide 

Land 



6 

1.3—4.2 

0.5-1.8 


Goldfish 

1986 

Hydrogen 

fluoride 

Land 







Falcon 

1987 

LNG 

Land 

Fences 



20-66 



Porton Down 

See Table 15.47 









Maplin Sands 

See Table 15.49 









Thorney Island 

See Table 15.52 










Sources: Puttock, Blackmore and Colenbrander (1982); Koopman, Ermak and Chan (1989); Havens (1992); inter alia. See also text. 
a API, Amerucan Petroleum Institute; BM, Bureau of Mines. 
b See alsoThble 15.48. 
c C, continuous; I, instantaneous. 



Figure 15.91 SS Gadila trials on dense gas dispersion at sea - plume from continuous spill of LNG in trial 4 
(Kneebone and Prew, 1974) (Courtesy of Gastech) 


shown in Figure 15.92, together with the predictions of the 
models of Cox and Carpenter, CRUNCH and Te Riele. 

15.37.6 Dutch Freon 12 trial 

The first trial involving the virtually instantaneous release 
of a dense gas at atmospheric pressure and temperature, as 
opposed to an evaporating liquefied gas, was conducted in 


1973 by the Directorate General of Labour (DGL) of 
the Dutch Ministry of Social Affairs. This experiment has 
been described by van Ulden (1974) and Buschmann 
(1975), and also by Te Riele (1977). The release was 1000 kg 
of Freon 12 which has a relative density of 4.2. The 
wind speed at 10 m was 3 m/s and the stability was 
neutral. 
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(a) 


(x 10 2 m) 



Figure 15.92 Continued 
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(C) 



Figure 15.92 SS Gadila trials on dense gas dispersion at sea-plume from continuous spill of LNG and comparison of 
observed cloud contour with model predictions of contour: (a) prediction of Cox and Carpenter model for trial 6 (R.A. Cox 
and Carpenter, 1980) Courtesy of Fteidel Publishing Company); (b) prediction of CRUNCH for trials 4 and 6 (Jagger 1983 
SRD R229) Courtesy of UKAEA Safety and Reliability Directorate); (c) prediction of te Riele model for trials 4 and 6 (te 
Riele, 1977) (Courtesy of DECHEMA) 


On release, there was rapid and intensive mixing with air 
and after some 5 s the estimated volume of the gas-air 
mixture was 2400 m 3 . The shape of the cloud was roughly 
cylindrical with some elongation along the direction of the 
wind. Its height fell from an initial value of 5 m to a mini¬ 
mum of 0.2 m before increasing again, reaching 10 m at 
1000 m downwind. Its radius increased rapidly with dis¬ 
tance at first with the rate of increase then reducing. 

The height and radius of the cloud are shown in 
Figure 15.76. The radius is much greater and the height 
much less than predicted for passive dispersion of a cloud 
of neutral buoyancy. 

15.37.7 AGA/Battelle trials 

In 1974, further experiments on the spillage of LNG into 
bunds were conducted near Capistrano, California, by 
Battelle Columbus Laboratories sponsored by the AGA 
(Duffy, Gideon and Puttnam, 1974). There were 42 trials, of 
which 14 involved ignition and 28 dispersion. Of the latter, 
17 were with a 2 m bund, 9 with a 6 m bund and 2 with a 24 m 
bund. The test approximated an instantaneous spill, the 
release being made over 20-30 s. The results were marred 
by a tendency for the liquid to spill outside the bund. A 
correlation was derived for maximum downwind con¬ 
centration in terms of bund area and wind velocity. 

15.37.8 Porton Down trials 

In 1976—78, a series of trials were conducted at the Chemi¬ 
cal Defence Establishment for the HSE involving the vir¬ 
tually instantaneous release of a dense gas at atmospheric 
pressure and temperature. These have been described by 
Picknett (1981), and also by McQuaid (1979b). 

Five sites were used: two flat with short grass, one flat 
with rough grass and two sloping with short grass. The 


source was a 40 m 3 collapsible tent. The gas released was a 
mixture of Refrigerant 12 and air, with relative densities 
varying from 1.03 to 4.2. Coloured smoke was also added to 
make the cloud more visible. 

Selected experiments in the Porton trials are given in 
Table 15.47. The experiments were designed to yield pairs of 
trials which differed in one feature only and thus demon¬ 
strated the effect of that feature. Picknett gives tables of 
such trial pairs showing the effect of relative density, 
roughness length, ground slope and wind speed. Picknett 
describes the behaviour of the dense gas in these trials. The 
effect of density is seen in trial 8 which was conducted in 
still air. The cloud kept its original shape momentarily after 
the collapse of the tent and then gravity caused an accel¬ 
erating flow downwards to the ground, followed by a bil¬ 
lowing, outwards motion involving considerable mixing 
with air. The cloud then expanded as a horizontal disc but 
with a raised annular rim. This rim was highly turbulent 
and persisted for some seconds before the turbulence and 
the rim itself collapsed. These features are illustrated in 
Figure 15.93. There followed a phase in which the cloud 
height remained virtually constant, but the area of the 
cloud grew almost linearly, as shown in Figure 15.94. 

The effect of wind, as in trial 36, was to cause the cloud to 
spread initially upwind somewhat and to assume down¬ 
wind a horseshoe shape, as shown in Figure 15.95. At first 
the width exceeded the length, but this then reversed. 
Initially the cloud velocity was much less than the wind 
speed, but the cloud underwent a gradual acceleration. 

The initial violent motion of the cloud caused rapid dilu¬ 
tion. In trial 8 the gas concentration fell from an initial value 
of 30 to 3 % in 6 s. In wind the rate of dilution was even higher. 

The concentration of gas in the cloud initially was very 
inhomogeneous. In trial 8 in still air the concentration 
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Table 15.47 Experimental conditions i, 

n some field trials 

on dens , 

3 gas dispersion: Porton Down (after Picknett, 1981) 

Trial 

density 

relative 

Site 

Roughness 

length 

Wind 

speed 

(m/s) 

Pasquill 

stability 

category 

Comment 

6 

1.7 

Flat 

2 

2.8 

C-D 


8 

2.0 

Flat 

2 

<0.5 

F-G 

Calm after release. 

Cloud remained in layer 
on ground for 20 min 

10 

2.5 

Sloping 

2 

0.4 

F 

Calm allowed long period 
of gravity flow downhill 

11 

2.4 

Sloping 

2 

2.0 

F 


12 

2.4 

Flat 

20 

5.7 

C 


15 

2.0 

Sloping 

2 

6.4 

D 

Dispersion in uphill wind 

24 

1.9 

Flat 

150 

2.5 

B 

Dispersion over very long grass 

29 

4.2 

Flat 

2 

4.3 

C 

Initially 100 % dense vapour 

36 

1.5 

Flat 

10 

4.7 

C-D 


39 

1.03 

Flat 

10 

1.8 

E-F 

Initial density near neutral 



2 3 



(a) 



(b) 


Figure 15.93 Porton Down trials on dense gas dispersion with Refrigerant 12 - growth of cloud in trial 8-1 
(Picknett, 1981): (a) elevation view; (b) plan view (Courtesy of Pergamon Press) 
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Figure 15.94 Porton Down trials on dense gas dispersion 
with Refrigerant 12 - growth of cloud in trial 8-2 
(Picknett, 1981) (Courtesy of Pergamon Press) 


measured near the ground fluctuated by a factor of 2 or 
more within 10 s. In trials 6 and 12 with wind the behaviour 
of the concentration varied with the measurement distance. 
In trial 6, at a point near the source the vertical concentra¬ 
tion profile at 5 s was concave, but eventually a profile was 
established in which the concentration decreased mono- 
tonically with height, as shown in Figure 15.96(a). In trial 
12, at a distance of 25 m the profile at 10 s was convex, but 
again in due course a monotonically decreasing profile was 
established, as shown in Figure 15.96(b). 

The effect of slope was very large for a release in still air. 
In wind the effect was less marked. The main feature was 
that with wind blowing uphill and the cloud flowing 
downhill, the two opposing effects suppressed the forma¬ 
tion of the raised rim and gave instead a tongue flowing 
along the ground and a reverse, uphill flow above the ton¬ 
gue. The cloud soon became dilute enough for the wind to 
carry it uphill. 

15.37.9 China Lake trials: Avocet, Burro 
and Coyote series 

The Naval Weapons Center (NWC) test facility at China 
Lake, California, has been the site of several series of dense 
gas dispersion trials. Accounts of the facility have been 


given by Ermak et al. (1983). Much of the work at this site 
has been sponsored by the Department of Energy (DoEn) 
and conducted by the Lawrence Livermore National 
Laboratory (LLNL). 

The Avocet series was a set of four trials involving spil¬ 
lage onto water of some 4.5 m 3 of LNG over about 1 min. The 
main purpose of these trials, described by Koopman, 
Bowman and Ermak (1980), was the development of the test 
facility. 

In 1980, the Burro series of trials was performed involv¬ 
ing the continuous release onto water of up to 40 m 3 of LNG 
over periods up to 3.5 min. These tests are therefore classed 
as continuous releases. They have been described by 
Ermak, Chan et al. (1982) and Koopman et al. (1982). Selec¬ 
ted trials are summarized in Table 15.48. 

The experiments were well instrumented and obtained 
a fairly comprehensive set of measurements, including 
turbulence and concentration fluctuations in the plume. 

Figure 15.97(a) shows the plume in Burro 8 after 30 s and 
Figure 15.97(b) the plume in Burro 6 after quasi-steady 
state had been reached. Analyses of the results of the Burro 
trials have been given by Koopman et al. (1982) and by 
Ermak, Chan et al. (1982). The latter have given compar¬ 
isons of the results with predictions from the Germeles- 
Drake model and from SLAB and FEM3. 

Further analyses have been reported by Koopman, 
Ermak and Chan (1989). Concentration contours in the 
Burro trial 8 are shown in Figure 15.98. Figure 15.98(a) 
gives the observed crosswind elevation view contours at a 
downwind distance of 140 m at 180 s. Figures 15.98(b) and 
(c) give the predictions of FEM3 for flat terrain and variable 
terrain, respectively. Figures 15.98(d) and (e) show the 
observed and predicted plan view contours. 

The Burro tests were followed in 1981 by the Coyote 
series which were concerned primarily with rapid phase 
transition (KPT) and with ignition. 

15.37.10 Maplin Sands trials 

In 1980, a series of trials was carried out by Shell at Maplin 
Sands. Accounts of the work has been given by Puttock and 
coworkers (Puttock, Blackmore and Colenbrander, 1982; 
Puttock, Colenbrander and Blackmore, 1983,1984; Colen¬ 
brander and Puttock, 1984). 

Figure 15.99 shows the site used for the trials. The 
liquefied gases were released onto water from a pipeline 
terminating in a downwards-pointing pipe and measure¬ 
ments were taken by instruments located on pontoons 
placed in arcs around the release point. 

Two series of trials were carried out, one with propane 
and one with LNG. The experiments were mainly con¬ 
tinuous spills but, for both gases, some trials with instan¬ 
taneous spills were conducted. A total of 34 trials were 
performed, of which 11 involved ignition. Table 15.49 gives 
details of some of the trials selected by the authors as pro¬ 
viding results useful for dispersion work. 

The propane trials with continuous spills, of which there 
were 11, have been described by Puttock, Colenbrander and 
Blackmore (1983). The two trials not shown in Table 15.49 
are trial 42, an underwater release, and trial 50, an ignited 
release. Two experiments in particular are described. In 
trial 46 the wind speed was 8.1 m/s and in trial 54 3.8 m/s. 
Figure 15.100(a) and (b) show the corresponding compari¬ 
sons between the outline of the observed plume and the 
contour predicted by HEGADAS. 
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Figure 15.95 Porton Down trials on dense gas dispersion with Refrigerant 12 - growth of cloud in trial 36 
(Picknett, 1981): (a) elevation view; (b) plan view (Courtesy of Pergamon Press) 


An account of the three propane trials with instanta¬ 
neous spillage has been given by Puttock, Blackmore and 
Colenbrander (1982). Trial 60 was performed with a very 
low wind speed of 1.2 m/s and gave an almost circular 
cloud. In trial 63 the wind speed was 3.5 m/s, and thus also 
fairly low. The cloud started off roughly circular and very 
shallow, then moved off with the wind, with a raised head 
around the edge, and growing in height as it moved. 

The LNG trials have been described by Puttock, 
Blackmore and Colenbrander (1982), Puttock, Colen¬ 
brander and Blackmore (1984) and Puttock (1987c). There 
were 13 continuous spills, of which the authors describe 
three in particular: trials 15,29 and 56. Figure 15.101 shows 
a comparison for the latter between the outline of the 
observed plume and the contour predicted by HEGADAS. 

Of the instantaneous LNG spills, trials 22 and 23 were 
considered of particular value. The wind speed in these 
trials was 5 m/s and thus higher than in the propane 


instantaneous spills. Compared with the latter the cloud 
produced was very elongated and more like that from a 
continuous spill. Figure 15.102 shows the development of 
the cloud in trial 22 together with a comparison of the 
contour predicted by HEGADAS. 

15.37.11 Thorney Island trials 

The Thorney Island trials were a progression from the 
Porton Down trials and again involved release of a dense 
gas at atmospheric pressure and temperature. Most of the 
releases were instantaneous. The second series involved 
obstructions and a building. A third series was done 
with continuous releases. The Thorney Island trials are 
described in Section 15.38. 

15.37.12 NTS trials: Desert Tortoise and Eagle series 

The experimental work described so far has been con¬ 
cerned with dispersion of dense gases in general and of 
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Figure 15.96 Porton Down trials on dense gas dispersion with Refrigerant 12 - vertical concentration profiles in trials 6 
and 12 (Picknett, 1981); (a) at point close to source in trial 6; (b) at 25 m downwind in trial 12 (Courtesy of Pergamon Press) 


Table 15.48 Experimental conditions in some field trials on dense gas dispersion: China Lake, Burro series 


Trial 

Volume 

released 

(m 3 ) 

Volumetric 

flow 

(m 3 /min) 

DuratiorT 

(min) 

Wind 

speed 

(m/s) 

Stability 

category 

Bulk 

Richardson b 


Travel 

Distance (m) 

Concentration (%) 

2 

34.3 

11.9 

2.9 

5.4 

Unstable 

-0.178 



3 

34.0 

12.2 

2.8 

5.4 

C 

-0.221 

255 

LFL 

4 

35.3 

12.1 

2.9 

9.0 

Slightly 

-0.054 








unstable 




5 

35.8 

11.3 

3.2 

7.4 

Slightly 

-0.079 








unstable 




6 

27.5 

12.5 

2.1 

9.1 

Slightly 

-0.044 








unstable 




7 

39.4 

13.6 

2.9 

8.4 

D 

-0.018 

200 

LFL 

8 

28.4 

16.0 

1.8 

1.8 

E 

+0.121 

420 

LFL 

9 

24.2 

18.4 

1.3 

5.7 

D 

-0.014 

325 

LFL 


Sources: Ermak, Chan etol. (1982); Koopman etol. (1982); Havens (1992). 
a Calculated from volume and volumetric flow. 
b Richardson no. at 2 m height. 
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Figure 15.97 Nevada Test Site trials, Burro series, on dense gas dispersion with LNG (Ermak, Chan et at., 1982): 
(a) plume in Burro trial 8 after 30 s; (b) plume in Burro trial 6 at quasi - steady state (Courtesy of Elsevier 
Science Publishers) 


hydrocarbons in particular. More recently, there has been 
growing interest in other hazardous materials, especially 
toxic liquefied gases. 

Much of this work has been done at the Nevada Test Site 
(NTS). This site includes the area of Frenchman Flat which 
is the location of the Liquefied Gaseous Fuels Spill Test 
Facility (LGFSTF). This facility, and some of the test pro¬ 
grammes conducted there, have been described by Leone 
(1990), and also by Koopman, Ermak and Chan (1989). 

In 1983, the Desert Tortoise series of trials involving 
liquid ammonia were carried out at the NTS by the LLNL 
for the US Coast Guard and The Fertilizer Institute (TFI). 
These have been described by Goldwire (1986) and Koop¬ 
man et al. (1986), and also by Koopman, Ermak and Chan 
(1989). A summary of the Desert Tortoise trials is given in 
Table 15.50. There were four trials, all approximating con¬ 
tinuous spills. The accounts concentrate mainly on the lar¬ 
gest release, trial 4. In this experiment 60 m 3 of liquid 


ammonia at 171 psia and 24°C was released at a rate of 
9.5 m 3 /min into air at 30.8°C and relative humidity 21% 
with a wind speed of 4.5 m/s and stability category E. 
The release was from a horizontal pipe 0.8 m above the 
ground surface and pointing downwind. The adiabatic 
flash was estimated to give 17% vapour and 83% spray. 

Most of the ammonia remained airborne as vapour and 
spray but, in contrast to the smaller releases, a large pool of 
liquid formed and persisted for about 8 min. The pool tem¬ 
perature was measured as —52°C at 3 m and —63°C at 9 m 
downwind. Mass balances on the plume showed that the 
proportion of material released which passed the 100 m and 
800 m arcs was about 70%; 30% was unaccounted for. At 
the 100 m point, small puffs of boiled-off vapour were seen 
on and off at least 1100 s after the start. 

The jet persisted beyond the 100 m arc. The movement of 
the plume was dominated by the jet and dense gas features. 
At the 100 m arc the plume was about 70 m wide and 
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Figure 15.98 Nevada Test Site trials, Burro series, on dense gas dispersion with LNG (Koopman, Ermak and Chan, 
1989) - trial 8: (a) observed crosswind elevation view of concentration contours 140 m downwind after 180 s; 

(b) predictions of FEM3 of crosswind elevation view of concentration contours 140 m downwind after 180 s with flat terrain; 

(c) predictions of FEM3 of crosswind elevation view of concentration contours 140 m downwind after 180 s with 
variable terrain; (d) observed plan view of concentration contours at 1 m above ground level at 180 s; (e) predictions 
of FEM3 of plan view of concentration contours at 1 m above ground level at 180 s with variable terrain 
(Courtesy of Elsevier Science Publishers) 


generally less than 6 m high. At the 800 m arc the width had 
increased to about 400 m, but the height was still about 6 m. 
The ammonia fog persisted beyond 400 m. 

The values given for the maximum gas concentrations 
vary slightly. Koopman et al. state that this concentration 
was 10% at 100 m, 1.6% at 800 m and 0.53% at 2800 m.The 
crosswind elevation of the concentration contours at the 
800 m arc given by Goldwire is shown in Figure 15.103. 

The boiling point of ammonia is -33.4°C. The tempera¬ 
ture of the plume rose to -7°C at 100 m and to 23°C at 800 m, 
compared with the ambient air temperature of 32.8°C. The 
surface heat flux was determined as 2.2 kW/m 2 . 

The Eagle trial series, performed by LLNL for the US Air 
Force, involved spillages of nitrogen tetroxide and followed 
straight on from the Desert Tortoise series. It has been 
described by McRae and coworkers (McRae et al., 1984; 
McRae, 1986). 


15.37.13 NTS trials: Goldfish series 

In 1986, the Goldfish series of trials involving liquid 
hydrogen fluoride was carried out at the Frenchman 
Flat area of the NTS for Amoco by LLNL and Amoco. An 


account of these has been given by Blewitt et al. (1987a), and 
also by Koopman, Ermak and Chan (1989). 

A summary of the Goldfish trials is given in Table 15.51. 
There were six trials, all approximating continuous spills, 
three concerned with dispersion and three with water spray 
barriers. Of the former group, the first was an exploratory 
test. The main dispersion trials, therefore, were trials 2 and 3. 

The liquid hydrogen fluoride was released as a hori¬ 
zontal jet. The adiabatic flash was estimated to give some 
20% vapour and 80% spray, although the thermodynamics 
of hydrogen fluoride are complex. In none of these tests was 
any liquid collected in the spill pond. Special facilities were 
provided to give a capability to increase the humidity of the 
ambient air. These were located upwind and consisted of a 
large pond and of an array of nozzles half operating on 
steam and half on water spray. 

Trial 2 was performed at low relative humidity, the dew¬ 
point temperature being 1.1°C. In this experiment liquid 
hydrogen fluoride at 115 psig and 38°C was released at a 
rate of 175 US gal/min (0.011 m 3 /s) into the ambient air at 
36°C with a wind speed of 4.2 m/s and stability category D. 
The crosswind elevation of the concentration contours at 
300 m at 54 s and 121 s are shown in Figure 15.104(a) and (b). 
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Figure 15.99 Maplin Sands trials on dense gas dispersion - site layout (Puttock, Biackmore and Colenbrander, 1982) 
(Courtesy of Elsevier Science Publishers) 


Trial 3 differed in that the relative humidity was raised 
artificially to give a dewpoint temperature of 6.6°C. In this 
experiment the wind speed was 5.4 m/s and the air ambient 
was at 26.5°C, the other conditions being similar to 
those mentioned above for trial 2. The plume was visible 
at 400-500 m. The crosswind elevation concentration 
contours at 300 m at 113 and 225 s and at 1000 m at 292 and 
358 s are shown in Figures 15.104(c)—(f). 

The boiling point of hydrogen fluoride is 20°C. In trial 2 
the temperature of the plume at 20 m downwind dropped 
within seconds to about -30°C below ambient tempera¬ 
ture, then fell more gradually to about -45°C below over 
350 s, whilst in trial 3 it fell sharply to about —48°C below 
and remained at about -45°C below again for about 350 s. 
In both trials the plume temperature then rose rapidly, 
stayed at about —10°C below until about 600 s and then rose 
to eliminate the temperature differential by about 700 s. 

Trials 4-6 on water spray barriers are described in 
Section 15.53. 

15.37.14 NTS trials: Hawk series 

In 1988 another series of trials, the Hawk series, was car¬ 
ried out on hydrogen fluoride at the Nevada Test Site for the 
Industry Co-operative Hydrogen Fluoride Mitigation and 
Assessment Program (ICHMAP, or HMAP). These trials 


investigated not only dense gas dispersion but also the use 
of vapour barriers and water spray barriers. An account 
has been given by Diener (1991). The Goldfish trials caused 
some concern due to the ineffectiveness of a dike for con¬ 
taining a pressurized release and to the hazard ranges 
obtained. 

The work included the development of a complete model 
system for emission, vaporization and dispersion of 
hydrogen fluoride. The HEGADAS model was selected for 
development as the basis of the system, HFSYSTEM, 
described in Section 15.31. The trials on vapour barriers 
and water spray barriers are described in Section 15.53. 


15.38 Dispersion of Dense Gas: Thorney Island Trials 

In 1982-84, the HSE organized a series of heavy gas dis¬ 
persion trials (HGDTs) at Thorney Island. The trials were 
a major undertaking involving over a number of years the 
collection, processing and reconciliation of data from the 
trials and the comparison of the results with those from 
theoretical models and from physical modelling. They are 
described in Heavy Gas Dispersion Trials at Thorney 
Island (two volumes) by McQuaid (1985a, 1987). 

The main trials were with instantaneous releases and 
were conducted in two series, Phases I and II. Phase I 
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Table 15.49 Experimental conditions in some field trials on dense gas dispersion: Maplin Sands 
(after Puttock, Blackmore and Colenbrander, 1982) (Courtesy of Elsevier Science Publishers) 


Trial 

Volume 

released 

(m 3 ) 

Volumetric 

flow 

(m 3 /min) 

Duration 

Wind speed 
(m/s) 


Travel 

Comments 

No. Type 

Distance (m) 

Concentration (%) 

A Propane 3 

43 C 


2.3 

5.8 

5.8 




45 C 


4.6 

6.8 

2.2 



Unusual atmospheric 








conditions 

46 C 


2.8 

7.8 

7.9 

245 

LFL 


47 C 


3.9 

4.5 

5.2 

340 

LFL 


50 C 


4.3 

4.0 

8.3 



Ignited 

51 C 


5.6 

3.7 

7.8 



Ignited 

52 C 


5.3 

3.3 

7 




54 C 


2.3 

5.0 

3.6 

400 

LFL 


55 C 


5.2 

4.0 

5.7 




60 I 

27 



1.2 




63 I 

17 



3.4 




B LNG b 

12 C 


1.0 

10.7 

2 



Low and non-constant 








spill rate and wind 

15 C 


2.7 

6.7 

3.9 

150 

LFL 


29 C 


3.5 

5.4 

5 




34 C 


2.9 

3.5 

8.5 




35 C 


3.8 

4.5 

10.0 




37 C 


3.9 

5.0 

4.9 



Highly buoyant cloud 

39 C 


4.5 

2.3 

4.5 

130 

LFL 

Ignited 

56 C 


2.5 

1.5 

4.8 

110 

LFL 


22 I 

10 



5 



Ignited 

23 I 

7 



5 



Momentary ignition 


a Pasquill stability category quoted as D for trials 43,46,47,50,54; bulk Richardson number for all trials = 600. 
b Pasquill stability category quoted as D for trials 29,34,35,39,56; bulk Richardson number for all trials = 40. 


involved unobstructed releases over a flat surface, Phase II 
releases over a flat surface with obstructions. A short series 
of trials with continuous releases was also performed. In 
addition, theThorney Island site was subsequently used by 
the US Coast Guard and Department of Transportation to 
conduct their own series of experiments, termed the Phase 
III series. A summary of theThorney Island trials is given 
inTable 15.52. 

15.38.1 Phase I trials 

An account of the Phase I trials has been given by McQuaid 
(1984b,c, 1985b,c). The organization of the trials has been 
described by A.G. Johnston (1985) and McQuaid (1985b). 
Other accounts cover the following aspects: systems deve¬ 
lopment and operations procedures (D.R. Johnson, 1985); 
the site geography and meteorology (M.E. Davies and 
Singh, 1985b); the gas sensor system (Leek and Lowe, 
1985); the meteorological data (Puttock, 1987a); the deter¬ 
mination of the cloud area and path from visual records 
(Brighton, Prince and Webber, 1985; Prince et al., 1985 SRD 
R318); the determination of the cloud path from concentra¬ 
tion measurements (Brighton, 1985 SRD R319); the com¬ 
puter processing of the visual records (Riethmuller, 1985); 
the cloud advection velocities (Wheatley and Prince, 1987); 
the effect of averaging time on the statistical properties 
of the sensor records (Nussey, Davies and Mercer, 1985); 
the mean concentration and variance (Cam, 1987); the 


area-averaged concentration, height scales and mass bal¬ 
ances (Brighton, 1985a); the computer processing of the 
data for comparison with models (Pfennning and Cornwell, 
1985); the presentation and availability of the data 
(Roebuck, 1985); and users’ views of the data (N.C. Harris, 
1985; Brighton, 1987). Critiques which discuss the con¬ 
tribution to dense gas dispersion modelling have been 
given by Hartwig (1985) and Puttock and Colenbrander 
(1985). 

The aim of the Phase I trials was to obtain data which 
might be used to increase understanding of the mecha¬ 
nisms of dense gas dispersion and to validate models. The 
trials were designed with the needs of modellers very much 
in mind. Consideration was given to the requirements for 
the meteorological parameters and the parameters used in 
box and if-theory models. In particular, attention was given 
to the variables required to define stability and to char¬ 
acterize both Richardson number and Monin—Obukhov 
similarity, and thus in particular to wind speed, roughness 
length, friction velocity and sensible heat flux. These 
aspects are discussed by McQuaid (1985b). 

The site was an airfield flat to within about 1 in 100. The 
layout of the site is shown in Figure 15.105. Some 250 
instruments were deployed. The gas sensors were fixed to 
masts, the lowest level being located 0.4 m above ground 
and the highest levels being 4,10 and 14.5 m in the near, mid 
and far fields, respectively. Photographic records were also 
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(a) Distance (m) 



Figure 15.100 Maplin Sands trials on dense gas dispersion - continuous spills of propane: comparison of 
observed plumes with limits of visible plumes predicted by HEGADAS (Puttock, Colenbrander and Blackmore, 1983). 
(a) Trial 46 (wind speed =8.1 m/s); (b) trial 54 (wind speed 3.8 m/s) (Courtesy of Reidel Publishing Company) 


taken, the visibility of the cloud being enhanced by the use 
of cartridges of orange smoke. 

The Phase I trials involved an instantaneous release 
of 2000 m 3 of a gas-nitrogen mixture. The gas used 
was Freon 12, the proportion being varied to give mixtures 


of different relative density up to 4.2. The container was 
a 12-sided container 14 m across by 13m high. The 
container was held up by rigging until the operation of 
a release mechanism which allowed it to fall to the 
ground. 
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Distance (m) 

Figure 15.101 Maplin Sands trials on dense gas dispersion - plume from continuous spill of LNG: Trial 29: comparison 
of observed plume with limits of visible plume predicted by HEGADAS (Puttock, Colenbrander and Blackmore, 1984) 
(Courtesy of the American Institute of Chemical Engineers) 


On release, the gas cloud slumped rapidly and spread out 
radially. There was some movement upwind until this was 
stopped by the wind. The cloud had a raised front and 
assumed the characteristic doughnut shape. It then travelled 
in this form for several hundred metres. Eventually a low- 
lying cloud formed which covered a large part of the site. 

A total of 15 trials was performed, as shown in Table 
15.52. In each trial measurements were taken of the con¬ 
centration vs time profiles at the gas sensors within the 
cloud. These raw data have subsequently been processed to 
yield a variety of results. Plate 8 shows the development of 
the gas cloud in one of these trials. Figure 15.106 shows the 
peak concentration on the path of the cloud centroid in the 
Phase I trials. 

15.38.2 Phase II trials 

The Phase II trials have been described by M.E. Davies and 
Singh (1985a). The following aspects of the Phase II have 
been covered in other accounts: the overall properties of the 
clouds (Brighton and Prince, 1987); and a user’s view of the 
data (Brighton, 1987). 

The Phase II series was concerned with dense gas dis¬ 
persion at obstructions. Three types of obstruction were 
used: 

(1) solid fence; 

(2) permeable screen; 

(3) building cube. 

Details of the Phase II trials are given in Table 15.52. 

15.38.3 Phase II trials: solid fence 

The solid fence consisted of tarpaulin sheets hung over 
scaffolding. The fence was 5 m high and was located on a 
180° arc at 50 m from the source. Four trials were conducted 
with this configuration: trials 20—22 and 25. 


In trial 25 there was complete blocking of the cloud by the 
fence, in trial 21 partial blocking and in trial 20 virtually no 
blocking. There was also appreciable blocking in trial 22 in 
which the cloud density was much higher. 

The results of these trials were compared with Phase I 
trials carried out under similar conditions but without a 
fence. The fences affected the concentrations in the far 
field. Comparison of trial 20 with trial 19 exhibited a 
marked reduction in peak centreline concentration vs dis¬ 
tance, with a several-fold reduction factor out to at least 
500 m. 


15.38.4 Phase II trials: permeable screens 

The permeable screens consisted of military camouflage 
nets draped over scaffolding. The screens were 10 m high 
and were located on a 180° arc. Two trials were performed 
with this configuration: trial 23 with two rows of screens 
and trial 24 with four rows. The first row was located 50 m 
from the source, with the subsequent rows at intervals 
of 3.3 m. 

The screens delayed the passage of the gas, and 
increased the height of the cloud, thus distributing the gas 
vertically, but they had little effect on peak ground level 
concentrations at the screens. 

The screens affected the concentrations in the far field. 
Comparison of trial 23 with trial 19 showed a marked 
reduction in peak centreline concentration vs distance, 
with a several-fold reduction factor out to at least 500 m. 


15.38.5 Phase II trials: building cube 
The building cube was a single, isolated 9 m cube con¬ 
structed of plastic sheets on a wooden frame. Four trials 
were performed with this configuration: trials 26—28 with 
the cube 50 m downwind of the source and trial 29 with it 
27 m upwind. 
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(b) 

Figure 15.102 Maplin Sands trials on dense gas dispersion - plume from instantaneous spill of LNG - trial 22 
(Puttock, 1987c) (a) observed plume; (b) predictions by HEGADAS of 3% concentration contour, corresponding to 
visible limit (Courtesy of the American Institute of Chemical Engineers) 


Table 15.50 Experimental conditions in some field trials on dense gas dispersion: Nevada Test Site, 
Desert Tortoise series (Goldwire, 1986; Koopman et al., 7986; Havens, 1992) 


Trial 

Volume 

released 

(m 3 ) 

Volumetric 

flow 

(m 3 /min) 

Duration 

Wind speed 
(m/s) 

Stability 

category 


Travel 

Distance (m) 

Concentration 

(%) 

1 

14.9 

7.0 

2.1 

7.4 

D 



2 

43.8 

10.3 

4.3 

5.7 

D 

100 

9 







800 

1.4 

3 

32.4 

11.7 

2.8 

7.4 

D 

100 

9 







800 

1.6 







2400 

0.22 

4 

60.3 

9.5 

6.4 

4.5 

E 

100 

10 







800 

1.6 







2400 

0.53 
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Figure 15.103 Nevada Test Site trials, Desert Tortoise series, on dense gas dispersion with ammonia - trial 4: 
crosswind elevation view of concentration contours at 800 m arc (Goldwire, 1986) (Courtesy of the American 
Institute of Chemical Engineers) 


Table 15.51 Experimental conditions in some field trials on dense gas dispersion: Nevada Test Site, Goldfish series 
(after Blewitt et al., 1987a) (Courtesy of the American Institute of Chemical Engineers) 


Trial 

Volume 

released 

(m 3 ) 

Volumetric 

flow 

(m 3 /min) 

Duration 

(min) 

Wind 

speed 

(m/s) 

Stability 

category 

Comments 

1 

3.7 

1.77 

2.1 

5.6 

D 

System check and dispersion test 

2 

4.0 

0.66 

6.0 

4.2 

D 

Dispersion test 

3 

3.9 

0.65 

6.0 

5.4 

D 

Dispersion test 

4 

3.6 

0.255 

14 

6.8 

D 

Air/water mitigation test 

5 

2.0 

0.123 

16 

3.8 

C/D 

Water spray (upflow) test 

6 

2.0 

0.123 

16 

5.4 

C/D 

Water spray (downflow) test 


The effect of wind speed on the promotion of mixing by 
the building was examined in trials 26 and 28. In the former 
trial the cloud passed around the building without much 
sign of mixing, whilst in the latter the enhancement of 
mixing by the building was more obvious. 

Trial 27 tested the effect of a building located upwind of 
the source. The gravity front moving upwind was drawn 
into the wake of the building but the cloud did not pass 
around the sides. 


15.38.6 Continuous release trials 

A description of the continuous release trials has been 
given by McQuaid (1987). Accounts have also been given of 
the following aspects: the mass and flux balances (Mercer 
and Nussey, 1987); the turbulence records (Mercer and 
Davies, 1987); and a user’s view of the data (Brighton, 1987). 
The aim of the trials was essentially similar to that for the 
instantaneous releases, i.e. to obtain data which might be 
used to increase understanding of the dispersion mecha¬ 
nisms and to validate models. 


The gas used was a mixture of air and Freon 12 with a 
relative density of 2.0 in all trials. The source was designed 
to give a release with zero vertical momentum, the gas 
being released through an aperture in the ground with a 
cap above it. The release was at a rate of 5 nr/s maintained 
for 400 s. Details of the continuous trials are given in Table 
15.52. Three trials were conducted: trials 45-47. 

The conditions for trials 45 and 47 were similar, except 
that the wind speeds were 2.1 and 1.5 m/s, respectively. In 
trial 45 at the higher wind speed the lateral spread was less 
and the downwind extent was greater than in trial 47. 

The concentration vs time profiles showed that at 36 m 
downwind a steady-state profile existed for some 360 s, 
whereas at 250 m no steady profile was obtained. The shape 
of the concentration profile at 36 m was a sharp rise fol¬ 
lowed by a slow fall, whilst at 90 m there was a nearly 
symmetrical concentration rise and fall. With regard to 
the vertical concentration profile, at 36 m the concentra¬ 
tion exhibited intermittency. The plume was character¬ 
istically very shallow, about 2 m high, and very broad, up to 
300 m wide. 
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Figure 15.104 Nevada Test Site trials, Goldfish series, on dense gas dispersion with hydrogen fluoride - crosswind 
elevation views of concentration contours for trials 2 and 3 (Blewitt et at., 1987a): (a) at 300 m downwind at 54 s in trial 2; 
(b) at 300 m downwind at 121 s in trial 2; (c) at 300 mat 113 sin trial 3; (d) at 300 m downwind at 113 s (sic) in trial 3; 
(e) at 1000 m downwind at 225 s in trial 3; and (f) at 1000 m downwind at 358 s in trial 3 (Courtesy of the American 
Institute of Chemical Engineers) 
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Table 15.52 

Experimental conditions in some field trials on dense gas dispersion: Thorney Island 

Trial 

Volume 

released 

(m 3 ) 

Volumetric 

(m 3 /min) 

Duration Relative 
(min) density 

Wind 

speed 

(m/s) 

Stability 

category 

Bulk 

Richardson 

Comments 

No. 

Type a 

005 

T/l 

1320 



1.65 

4.6 

B 



006 

I/I 

1580 



1.60 

2.6 

D/E 

8.9 


007 

1/1 

2000 



1.75 

3.2 

E 

9.3 


008 

1/1 

2000 



1.63 

2.4 

D 

15.5 


009 

1/1 

2000 



1.60 

1.7 

F 

26.5 


010 

1/1 

2000 



1.80 

2.4 

C 

17.7 


Oil 

1/1 

2100 



1.96 

5.1 

D 

4.9 


012 

I 1 

1950 



2.37 

2.6 

E 

24.7 

Flat unobstructed terrain 

013 

IT 

1950 



2.00 

75 

D 

2.2 


014 

1/1 

2000 



1.76 

6.8 

C/D 

2.1 


015 

1 1 

2100 



1.41 

5.4 

C/D 

2.1 


016 

IT 

1580 



1.68 

4.8 

D 

3.0 


017 

1/1 

1700 



4.20 

5.3 

D/E 

12.5 


018 

1/1 

1700 



1.87 

5.3 

D 

1.7 


019 

1'1 

2100 



2.12 

6.6 

D/E 

3.5 


034 

1/1 

2110 



1.8 

1.4 

F 

60.4 


020 

II/2 

1920 



1.92 

5.7 


3.5 

5 m high, solid fence at 50 m 

021 

II/2 

2050 



2.02 

3.9 


8.8 

5 m high, solid fence at 50 m 

022 

II/2 

1400 



4.17 

5.9 


8.1 

5 m high, solid fence at 50 m 

023 

II/2 

1960 



1.80 

5.8 


3.0 

Two rows of permeable 










screens, 10 m high 

024 

II/2 

1925 



2.03 

6.8 


2.7 

Four rows of permeable 










screens, 10 m high 

025 

II/2 

2000 



1.95 

1.4 


61.8 

5 m high, solid fence at 50 m 

026 

II/2 

1970 



2.00 

1.9 


34.8 

9 m cube buliding, 50 m 










downwind 

027 

II/2 

1700 



4.17 

2.2 


71.0 

9 m cube buliding, 50 m 










downwind 

028 

II/2 

1850 



2.00 

9.0 


1.5 

9 m cube buiding, 50 m 










downwind 

029 

II/2 

1950 



2.00 

5.6 


4.0 

9 m cube building, 50 m 










upwind 

045 

C/3 

1972 

260 

7.6 

2.0 

2.1 

E/F 

380 

Flat unobstructed terrain 

046 

C/3 

1490 

260 

5.7 

2.0 

3.2 

D 

160 


047 

C/3 

1938 

250 

7.8 

2.05 

1.5 

F 

740 

Flat unobstructed terrain 

030 

III/4 

1603 

260 

6.2 

1.4 

4.3 

E 

0.2 

Release inside fenced 










enclosure 

033 

III/4 

1870 

340 

5.5 

1.6 

2.8 

D/E 

1.2 


036 

III/4 

1963 

310 

6.3 

1.6 

2.4 

F/G 

1.6 


037 

III/4 

1891 

255 

7.4 

1.6 

3.2 

E 

0.7 


038 

III/3 

1867 

280 

6.7 

1.6 

3.8 

F 

0.5 

Flat unobstructed terrain 

039 

III/4 

1808 

350 

5.2 

1.4 

5.8 

D 

0.1 

Release inside fenced 










enclosure 

040 

III/4 

1860 

310 

6.0 

1.2 

3.1 

D 

0.2 


042 

III/4 

1973 

185 

10.7 

1.6 

3.4 

D 

0.5 


043 

III/4 

1899 

265 

7.2 

1.3 

1.5 

F 

2.5 


049 

III/4 

1907 

260 

7.3 

1.6 

2.5 

F 

1.3 


050 

III/4 

1800 

270 

6.7 

1.4 

1.74 

F 

2.1 


Sourc 

es: McQu; 

aid (1985b, 1987); M.E.Dav 

ies and Singh (1985a); M.E. Davie 

is and Inrnai 

i(1987). 


a Phase C, cont 

inuous tria 

Is. Type: 1, insti 

intaneou: 

s release, flat ui 

lobstructed terrain; 5 

!, instantaneous 

> release, flat obstructed terrain; 3, con- 


tinuous release, flat unobstructed terrain; 4, continuous release, flat obstructed terrain. 
b Nominal value. 


15.38.7 Associated physical modelling 

The programme of work associated with the Thorney 
Island trials included wind tunnel modelling. Preliminary 
wind tunnel experiments were conducted to screen the 


programme of trials and confirm that it was on the right 
lines. Following the trials comparisons were made with 
these simulations and with earlier ones conducted for the 
Porton trials. This work is described in Section 15.39. 
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Figure 15.105 Thorney Island trials on dense gas dispersion - site layout (McQuaid, 1985b) (Courtesy of Elsevier 
Science Publishers) 


15.38.8 Phase IN trials 

As described by M.E. Davies and Inman (1987), the Phase 
III trials involved releases with a 54 m x 26 m enclosure 
bounded by a 2.4 m vapour fence. They state that 
some 40 trials were performed. 

15.38.9 Application to models 

The Thorney Island trials, together with the analysis car¬ 
ried out on them, have provided a data set which has been 
extensively used for the determination of parameters in, 
and for the validation of, models. Reference to the use of 
these trials for both these purposes has already been made 
in the preceding sections. In particular, the trials have been 
used in the derivation of the Workbook correlations. The use 
of the Thorney Island data set in model validation is dis¬ 
cussed further in Section 15.41. 

15.39 Dispersion of Dense Gas: Physical Modelling 

Another method of experimental investigation of dense gas 
dispersion is physical modelling, using mainly wind tun¬ 
nels and water tunnels or flumes. Physical modelling 
makes it possible to perform dispersion experiments not 
only for flat unobstructed surfaces, but also with different 
ground slopes and other topographical features and with 
all kinds of obstructions, including fences and buildings, 


and even complete process plants, sites or terminals. It is 
also sufficiently economical to allow experiments to be 
repeated, either exactly or with minor variations. 

The principal drawback is that it is not possible to scale 
so as to achieve complete similarity between the physical 
model and the scenario simulated, so that there is always a 
degree of distortion. However, the effects of such distortion 
are fairly well understood. 

Accounts of physical modelling have been given by 
Snyder (1981), D.J. Hall, Hollis and Ishaq (1982), Meroney 
and Lohmeyer (1984), Meroney (1987a) and in the Work¬ 
book by Britter and McQuaid (1988). 

15.39.1 Guidelines for physical modelling 

Guidelines for physical modelling of dense gas dispersion 
have been given by Meroney (1987). They include guidance 
on formulation of the information to be obtained, the choice 
of modelling medium, the design of the experiments, the 
reporting of the experiments, the performance envelope 
within which experiments may be conducted and the scal¬ 
ing of the experiments. 

The experiments should be matched to the information 
required. It may be required to determine the distance 
beyond which a hazardous concentration will not exist, or 
the distance at which the hazardous condition will occur 
more than a certain time with a certain probability. 
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Distance from Release Point (m) 

Figure 15.106 Thorney Island trials on dense gas dispersion - peak concentrations on path of cloud centroid for 
instantaneous release trials (McQuaid, 1985b) (Courtesy of Elsevier Science Publishers) 


Or again, it may be required to determine the maximum 
concentration at a location near the source, or the con¬ 
centration vs time profile at that location. 

The information sought should be limited to what is 
really needed and overelaboration should be avoided. The 
data set specified should accord with what is realistically 
obtainable. It is useful to carry out preliminary experi¬ 
ments with a simple box model. 

The modelling medium may be air or water. Broadly, 
water is often convenient for qualitative studies and 
visualization, but air is more often used for quantitative 
work. Air allows the use of a wide range of density ratios. 
Using heat it is comparatively easy to stratify. In theory, 
water should allow a Reynolds number some 16 times that 
of air, but in practice this advantage is not easily realized. 

15.39.2 Wind tunnel facilities 

A wind tunnel not only represents a major investment but 
also requires expertise in its use. It is therefore normal to 
contract work to an organization operating the wind tunnel 
with its own specialist team. A list of some of the principal 
wind tunnel facilities is given by Meroney (1987a). 

15.39.3 Scaling for wind tunnel modelling 

Physical modelling involves simulation of a full-scale 
situation by scaling down the dimensions in such a way as 
to retain similarity in the essential features. 


Accounts of scaling for physical simulation include 
those given by Meroney (1979b, 1982), D.J. Hall, Hollis and 
Ishaq (1982), Cheah, Cleaver and Milward (1983a,b), Krog- 
stad and Pettersen (1986), and Schatzmann, Koenig and 
Lohmeyer (1986) and the one given in the Workbook by 
Britter and McQuaid (1988). 

The usual procedure is to list the relevant variables and 
then to derive from these the appropriate dimensionless 
groups. The number of dimensionless groups should be 
equal to the number of variables minus the number of 
dimensions. The lists of the variables given by different 
workers tends to vary slightly, in part because some list a 
variable only to disregard it, whilst others do not list it in 
the first place. 

The conditions for similarity may be defined in stages. 
Thus, the Workbook defines first the requirements for the 
atmospheric boundary layer, then those for release of a gas 
with the same properties and temperature as air, and 
finally those for release of a dense gas. The variables com¬ 
monly listed for similarity of the atmospheric boundary 
layer are 

u characteristic velocity 
L characteristic length scale 
p density of atmosphere 
p viscosity of atmosphere 
g acceleration due to gravity 
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The Workbook also includes 

A p/p characteristic potential density difference due to 
atmospheric stability/instability 
/ Coriolis parameter 

The dimensionless groups listed by the Workbook are: 

Re = U ^ > - Reynolds number 
Ri = g —~ Richardson number 


fL 


Rossby number 


Similarly, the source number and density r 
combined to give 


source momentum ratio 


If the source momentum is negligible, this t< 
replaced with the source number qJuLr. 


If the fine scale structure of the concentration field is tc 
be preserved, the similarity of the Schmidt number Sc is 
relevant 

Sc = Schmidt number 


where D is the diffusion coefficient and v is the kinematic 
viscosity. 

This aspect may also be expressed in terms of the Peclet 
number Pe: 


Peclet number 


This gives only three dimensionless groups, not the four 
which the rule quoted above would indicate. The explana¬ 
tion given in the Workbook is that the Boussinescq 
approximation has been made, so that the effect at Ap Ip on 
inertia is neglected but that on buoyancy is not. 

Proceeding straight to the dense gas case, the further 
variables introduced in the Workbook are: 

q a volumetric release rate, or 

Q 0 volume released 

p a density of air 

p 0 density of source gas 

x, y, z downwind, crosswind, vertical distance 

The further dimensionless groups given are then: 

source number (continuous source), or 
uL z 

source number (instantaneous source) 

— density ratio 


Pr = , Prandtl number 
k 

where k is the thermal conductivity. 

Additional quantities mentioned by s 
include: 


Z’Z and Z dimensionless downwind, cross wind and 
vertical distance 

If a degree of distortion is accepted, it is practice in model¬ 
ling buoyant plumes to make the following approximations, 
which the Workbook tentatively proposes for dense plumes 
also. The Froude number and the density ratio may be 
combined using the Boussinesq approximation to give 

IBa U i —\ r densimetric Froude number 


a ground slope 
z 6 roughness length 
u* friction velocity 
p 0 viscosity of source gas 

and additional dimensionless groups are 
■j- dimensionless roughness length 
— dimensionless friction velocity 

The conditions for flow to be fully aerodynamically rough 
depend on the group ujsjv. In other words, for such flow 
the role of the kinematic viscosity v is taken over by the 
group ujzjv. The Workbook therefore defines a more rel¬ 
evant Reynolds number as 
uL 


modified Reynolds number 


It may be noted that this modified Reynolds number is the 
product of the reciprocals of the dimensionless roughness 
length and friction velocity just defined. 

The source volumetric flow q a is sometimes represented 
by the product m<jA 0 , where u a is the source velocity and A a 

Timing to the application of these similarity criteria to 
the scaling problem, it is not possible to achieve similarity 
of all the relevant groups. Complete similarity is not 
attainable and some degree of distortion has to be accepted. 

Some of the groups quoted are of secondary importance, 
and some are frequently not mentioned by modellers. Since 
the full scale and model fluids are generally both air, the 
Prandtl number is the same. Rossby number similarity is 
not attainable, but a limit can be set. The Workbook suggests 
that it would be reasonable to neglect rotational effects for 
Ro > 10, but that a value of Ro m 1 should be justified. 
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It is not possible to obtain Reynolds number similarity. 
However, since the properties of turbulent flow are inde¬ 
pendent of the Reynolds number provided it is large, the 
approach generally taken is to make the Reynolds number 
as large as practical. 

The Workbook gives a detailed discussion of the setting of 
the Reynolds number. The essential requirement is simi¬ 
larity of the mean and turbulence velocity profiles and in 
practice the boundary layer is adjusted until this is 
achieved. It suggests that the condition u,k/v > 50 gives 
Reynolds number independence, though for sharp-edged 
elements particularly u„k/v>5 may suffice. Since typi¬ 
cally z a ks 0.1, these conditions are equivalent to ujt/v> 5 
and «»z 0 /v > 2, respectively. 

As far as concerns Froude number similarity, this is 
often difficult to achieve because it tends to involve an air 
velocity that is too low to give stable flow. Generally the 
approach taken is to combine the density ratio and Froude 
number into a densimetric Froude number, as described 
above. The Workbook recommends that priority be given to 
achieving similarity of two groups, the densimetric Froude 
number and the source momentum ratio. 

If the fine scale structure of the concentration field needs 
to be modelled, and molecular diffusion effects taken into 
account, the Schmidt number should be similar and the 
Reynolds number as large as possible. Failure to achieve 
adequate Reynolds number results in loss of fine scale 
structure and is not compensated by a correct Schmidt 
number. 

Reports of physical modelling frequently discuss 
aspects of scaling, either in relation to the design of the 
experiments or in explanation of the results, and many of 
those quoted below include such discussions. 

15.39.4 Wind tunnel performance envelope 

There are a number of practical features which set a limit to 
the conditions under which a wind tunnel may be operated 
and to the applications for which it may be used. There are 
problems in achieving a steady low velocity A velocity of 
1 m/s is quoted as a practical lower limit, although veloc¬ 
ities half this or less are sometimes used. This tends to be a 
major constraint. 

Dense gas clouds are shallow but wide, and the width of 
the tunnel may be a constraint. The length of the tunnel can 
also constrain the concentrations which can be studied; 
there is usually little difficulty in obtaining concentrations 
down to typical flammability limit levels but it may not be 
possible to achieve concentrations at levels of interest for 
some toxic gases. 

The use of a very small model can cause problems of 
spatial resolution. There is a practical limit to the fineness 
of size of measurement probes. 

Attainment of a Reynolds number high enough to give 
correct wake flows can be a difficulty, particularly for 
smooth structures. 

The performance envelope of a wind tunnel, with par¬ 
ticular reference to LNG dispersion experiments, has been 
described by Meroney and Neff (1980) and Meroney 
(1987a). 

15.39.5 Universal plume profile 

An early wind tunnel study of dense gas dispersion was 
that by D.J. Hall, Barrett and Ralph (1976). These workers 
addressed the determination of the distance for the gas 
concentration to fall to 2% and expressed their results in 


the form of a universal plume, as shown in Figure 15.107. 
The plume is defined by the dimension Z), which for a cloud 
boundary concentration of 2 % is given by the empirical 
equation 



where Q is the volumetric release rate and u is the wind 
speed. The results apply only to a fully developed plume, 
which may take some hours to develop. 

The work illustrated the fact that a dense gas forms a 
wide, very shallow plume with a strong resistance to ver¬ 
tical dispersion and that its behaviour is quite different 
from that of neutral buoyancy gas. The authors present 
calculations which show that for stable atmospheric con¬ 
ditions the travel distances given by passive dispersion 
models considerably exceed those obtained from their 
model. 

15.39.6 Porton Down trials 

A wind tunnel investigation of some of the Porton Down 
trials has been carried out by D.J. Hall, Hollis and Ishaq 
(1982,1984). The aim of the work was to assess the applic¬ 
ability of wind tunnel modelling to dense gas dispersion. 

Figures 15.108 and 15.109 show some of the results 
obtained for the Porton trials. Figure 15.108(a)-(c) give, 
respectively, the cloud width, the cloud arrival and depar¬ 
ture times and the profile of the peak ground level con¬ 
centration vs downwind distance for trial 37. Figure 
15.109(a)—(d) show the concentration-time profiles at four 
points in this trial. The figure shows the profiles of the 
physical model tending to lead, and to be less smoothed 
than, the full-scale profiles. 

Figure 15.109(e) shows the variability of the concentra¬ 
tion-time profile in repeat runs at a single point in trial 52. 
The figure brings out the high degree of variability 
between individual runs and the desirability of performing 
enough runs to obtain a stable characterization of the con¬ 
centration. Since such repeat runs are not practical in field 
trials, but are so in a wind tunnel; this is an important 
contribution of the latter. The authors give comparative 
photographs for the field trials and the wind tunnel. This 
format for presenting results has also been used in sub¬ 
sequent work by the authors and others 

The authors also proposed a relationship between the 
distance to the 2% concentration level and the Richardson 
number. They investigated this further in relation to the 
Thorney Island trials, as discussed below. 

15.39.7 Thorney Island trials 

At the time when the above work was being done, the 
Thorney Island experiments were being designed and 
some additional, exploratory wind tunnel work was carried 
out to assist in this. Following the trials, the simulations 
done on the Porton trials and this further work for the 
Thorney Island trials were revisited. Several of the simu¬ 
lations were sufficiently closely matched to particular 
Thorney Island trials to allow comparisons to be made. 
These have been described by D.J. Hall and Waters (1985). 

Figure 15.110 shows some of the results obtained for the 
Thorney Island trials. Figures 15.110(a)-(c) again give 
the cloud width, the cloud arrival and departure times and the 
profile of the peak ground level concentration vs distance, 
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Figure 15.107 Wind tunnel simulation of dense gas dispersion - universal plume profile (D.J. Hall, 
Barrett and Ralph, 1976) (Courtesy of Warren Spring Laboratory) 


respectively. Figure 15.111 shows the profile of concentration 
vs time at particular downwind locations. Figure 15.112 and 
Figure 15.113 show, respectively, plan and elevation views of 
the full-scale trial and of the wind tunnel model. 

Figure 15.111 shows the profiles of the physical model 
tending in this case to lag, and to be more smooth than, the 
full-scale profiles. This contrasts with the results described 
above for Porton trial 37, where the reverse was the case. 
This ‘persistence’ of the concentration was the main dis¬ 
crepancy. The authors suggest that it may be explained in 
part by surface roughness present in the wind tunnel but 
not at full scale, and perhaps in part by the need to use a low 
wind speed of 0.4 m/s. Nevertheless, the concentrations 
obtained in the wind tunnel work were within a factor of 2 of 
those at full scale. 

The authors also consider a correlation derived from 
their Porton simulations between the distance to a 2% 


concentration and the reciprocal of the Richardson number. 
This is shown in Figure 15.114. The distance is shown as 
having a maximum at Ri ~ 3(1/Ri ~ 0.3). For high values 
of Ri the cloud is advected by the wind with relatively little 
dispersion. For lower values atmospheric turbulence 
increases dispersion above that obtained from gravity- 
driven flow. If valid, the relationship is of some interest, but 
it does not appear to be supported by the Thorney Island 
results. 

M.E. Davies and Inman (1987) describe a programme of 
86 simulations of the Thorney Island trials. They give 
numerous sample plots, particularly concentration-time 
profiles, concentration-distance correlations and plan view 
concentration contours. 

Figure 15.115 shows photographs of full scale trials and 
wind tunnel simulations for instantaneous and continuous 
releases, in both cases without and with fences. The decay 
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Figure 15.108 Wind tunnel simulation of Porton Down trials on dense gas dispersion - comparison of observed 
and simulated features (D.J. Hall, Hollis and Ishaq, 1984): (a) cloud width in trial 37; (b) arrival and departure 
times in trial 37; (c) peak ground level concentration (Courtesy of Springer Verlag) 
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Figure 15.109 Wind tunnel simulation of Porton Down trials on dense gas dispersion - comparison of 
observed and simulated features for trials 37 and 52 (DJ. Hall, Hollis and Ishaq, 1984): (a)-(d) concentration 
profiles at four points in trial 37; (e) variability of concentration profile in repeat simulation runs for trial 52 
(Courtesy of Springer Verlag) 
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Figure 15.110 Wind tunnel simulation of Thorney Island trials on dense gas dispersion - comparison of observed 
and simulated features for (D.J. Hall and Waters, 1985): (a) cloud width; (b) cloud travel time; (c) peak ground level 
concentration (Courtesy of Elsevier Science Publishers) 
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Figure 15.111 Wind tunnel simulation of Thorney Island trials on dense gas dispersion - comparison of observed 
and simulated features: (a) and (b) concentration profiles at two points in trial 7; (c) and (d) concentration profiles 
at two points in trial 18 (D.J. Hall and Waters, 1985) - model; - trial samplers. Note the varying vertical scales 
(Courtesy of Elsevier Science Publishers) 


of peak concentration with distance for the continuous 
releases, without and with fences, is correlated in the form 
shown in Figure 15.116, after Meroney and Neff (1980). A 
buoyancy length scale 1/, is defined as 


k 


gV 

If 


[15.39.2] 


and the further length scale l q ■ 


[15.39.3] 


where Q is the volumetric release rate. 
The plot gives 



[15.39.4] 


The distance to the 2 % concentration was investigated. It 
was found that the ratio of this distance in the model to that 
at full scale fell to about unity, though with some scatter. The 
authors suggest that the full scale distance may be estimated 
with 90% confidence as lying within the range delimited by 
a lower limit of half the model value and an upper limit of 
twice that value. The peak concentrations were found to be 
insensitive to the value of the Richardson number. 

Several other workers have performed wind tunnel 
simulations of the Thorney Island trials. Figure 15.117 
shows a computer graphics simulation of trial 8 by 
S.T. Chan, Ermak and Morris (1987); the computer simula¬ 
tion has the appearance of a wind tunnel simulation. 

Van Heugten and Duijm (1985) investigated trial 8. They 
obtained reasonable agreement between the full-scale 
trials and wind tunnel model and bet ween both of these and 
theTNO model described by van den Berg (1978). 

Thorney Island trial 20, with a solid fence, has been 
simulated in a wind tunnel by Knudsen and Krogstad (1987). 
Again there was a tendency for the wind tunnel concentra¬ 
tion profile to persist longer than that for the full-scale trial. 
The authors state that a possible explanation is the differ¬ 
ence in Reynolds number and thus in the wake at the fence. 


where c is the volumetric concentration. 


[15.39.5] 


15.39.8 Ground slope 

Physical modelling is particularly suited to investigation 
of the effects of terrain, obstructions and buildings. The 
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Figure 15.113 Wind tunnel simulation of Thorney Island trials on dense gas dispersion - comparison of observed 
and simulated elevation views of cloud in trial 13 (D.J. Hall and Waters, 1985): (a) both at time zero; (b) observed after 
3.1 s and simulated after 2.9 s; (c) observed after 6.1 s and simulated after 5.8 s; and (d) observed after 9.2 s and 
simulated after 8.7 s; (e) observed after 11.2s and 11.6 s; all times approximate (Courtesy of Elsevier Science Publishers) 
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Figure 15.114 Wind tunnel simulation of Thorney Island trials on dense gas dispersion - effect of bulk Richardson 
number on concentration downwind (D.J. Hall and Waters, 1985) (Courtesy of Elsevier Science Publishers) 


dispersion of dense gas on a slope was another feature 
investigated in the study by D.J. Hall, Barrett and Ralph 
(1976) already described. Some of their results for the uni¬ 
versal profile on a slope are shown in Figure 15.118. 

15.39.9 Obstructions and buildings 

There have been several investigations of dense gas dis¬ 
persion in the presence of obstructions and buildings. 
Cheah, Cleaver and Milward (1983a) have used a water 
tunnel to make an ad hoc study of the effect of a simple 
barrier on the dispersion of a dense gas plume. Their 
results give a clear illustration of the effect of the gravity- 
driven phase. The authors comment that Figure 15.119, 
which is a plot of mean concentration vs downstream dis¬ 
tance (the distance being expressed in terms of the ratio of 
the distance to the source diameter and with the relative 
density as a parameter) shows that for the plumes of higher 
relative density (and Richardson number) there is an initial 
phase with gravity slumping but little entrainment fol¬ 
lowed by a further gravity-driven phase where entrain¬ 
ment does occur and that the slope of the curve in this latter 
phase is not the same as for passive dispersion, whilst 
for the plume of low relative density (and Richardson 
number) the slope in the second region progressively 
approximates that of a passive plume. 

The work also indicated the effectiveness of a barrier in 
reducing the downstream concentration. Even with the 
least effective barrier distance the concentration down¬ 
stream was reduced by an order of magnitude. 


The dispersion of a dense gas plume around a building 
has been investigated by Krogstad and Pettersen (1986). 
The presence of the building caused a strong modification 
of the plume. 

C.I. Bradley and Carpenter (1983) have described an 
assessment of physical modelling which included the 
comparison of results from such modelling with results 
from models for the dispersion of 1000 te of LNG spilled 
onto land at a tanker terminal and onto water at the term¬ 
inal. Experiments were done using both a wind tunnel and 
a water flume. 

They discuss the problem of scaling up in respect of the 
temperature of the gas. Heat transfer from the surface to 
the cloud has a greater influence at low wind speeds, but at 
higher wind speeds is less significant. They followed Neff 
and Meroney (1981) in taking the gas density as the source 
value, but restricted their study to higher wind speeds 
(>5 m/s). 

Comparisons were made with results from the Germeles 
and Drake, Cox and Carpenter, Fryer and Kaiser, and 
ZEPHYR models. For the land spills a global roughness 
length of 0.2 m, corresponding to rough terrain, was used in 
the box models. The ZEPHYR model, being a if-theory 
model, modelled the effect of the structures directly. 

Broadly, the distances to the extinction of the flammable 
plume in both the wind tunnel and water flume modelling 
were reduced by the presence of the terminal structures by 
a factor of about 2. Further, the dispersion of the land spill 
was dominated by the presence of the single tank from 
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Figure 15.115 Wind tunnel simulation of Thorney Island trials on dense gas dispersion - comparison of observed 
and simulated releases (M.E. Davies and Inman, 1987): (a) instantaneous release (Type 1); (b) instantaneous 
release with fence (Type 2); (c) continuous release (Type 3); (d) continuous release in fenced enclosure (Type 4) 
(Courtesy of Elsevier Science Publishers) 
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(a) 


Figure 15.116 Wind tunnel simulation of Thorney Island trials on dense gas dispersion-distance to 2% concentration 
(M.E. Davies and Inman, 1987): (a) observed; and (b) simulated. The solid lines represent the limits of data in the work of 
Meroney and Neff (1980) (Courtesy of Elsevier Science Publishers) 


which the spill originated. The models tended to give 
higher distances to cloud extinction than the physical 
modelling, but the distances generally agreed to within a 
factor of 2 and again showed the reduction caused by the 
terminal structures. 

Guldemond (1986) performed wind tunnel simulations of 
releases of 15 ton of liquefied ammonia at release rates in 
the range 6.5-52 kg/s. Air entrainment was assumed such 
that the air/ammonia mass ratio at the source was 10 :1 and 
that there was complete evaporation of the liquid spray 
formed. Figure 15.120(a) shows the model of the industrial 
site in the wind tunnel and Figure 15.120(b)-(e) show the 
plumes formed by a dense gas on flat terrain and on the 
industrial site and by neutral buoyancy gas on these two 
types of terrain, respectively. 

On flat terrain for the neutral buoyancy gas the upwind 
dispersion was 10 m and the initial cloud width was 120 m. 
For the dense gas the values were 90 and 540 m, respec¬ 
tively. For the industrial site the corresponding figures for 
the neutral buoyancy gas were 60 and 250 m and for the 
dense gas 210 and 540 m. 

The effect of different locations of the source within the 
industrial site was investigated. The location had a marked 
effect on the neutral buoyancy plume, which was strongly 
influenced by particular buildings. It had much less effect 
on the dense gas plume. Mixing of the dense gas plume was 
caused not only by atmospheric turbulence but was also 
strongly affected by mechanically induced turbulence due 
to the obstructions. The cloud tended to mix vertically up to 
the average height of the buildings. 

The author gives concentration vs distance profiles and 
data on times to particular concentrations. Measurements 
were made at distances of 100, 400 and 450 m downwind. 
The concentrations at the first point were in the range 
1000-3000 ppm, except for the very low release rate. 
Thereafter, the slope of concentration decay with distance 
on a log-log plot was about 1.7, which is characteristic of 
passive dispersion. 


15.39.10 Concentration variability 

As already mentioned, one of the strengths of wind tunnel 
modelling is that it furnishes an economical way of making 
a large number of repeat runs at the same nominal condi¬ 
tions. The variability in the concentration vs time profiles 
obtained in the simulation of the Porton trials by D.J. Hall, 
Hollis and Ishaq (1982,1984) has already been described. 

A systematic investigation of this variability in terms of 
the intensity of concentration fluctuations has been made by 
Meroney andLohmeyer(1984).Theirworkisdiscussedin the 
context of concentration fluctuations in Section 15.45. 

15.40 Dispersion of Dense Gas: Terrain, 

Obstructions and Buildings 

The account of dense gas dispersion given so far has con¬ 
centrated on dispersion over flat, unobstructed terrain. It is 
necessary now to consider more complex and obstructed 
terrain, including that containing buildings and obstruc¬ 
tions. The corresponding treatment for passive dispersion 
is given in Section 15.17. 

Some particular types of terrain which have been the 
subject of investigation include: 

(1) slopes and ramps; 

(2) fences and vapour barriers; 

(3) water spray barrier and steam curtains; 

(4) buildings - release upstream; 

(5) buildings - release into wake; 

(6) buildings - release inside; 

(7) industrial sites; 

(8) complex terrain. 

The three principal approaches are the use of: (1) analyti¬ 
cal models, (2) three-dimensional models and (3) physical 
modelling. The most versatile methods are three- 
dimensional models and physical modelling, but there is a 
growing body of analytical models for such features as 
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(b) 

Figure 15.117 Wind tunnel simulation of Thorney Island trials on dense gas dispersion - simulation of trial 9 
(S.T. Chan, Ermak and Morris, 1987) (a) time 20 s; (b) time 30 s (Courtesy of Elsevier Science Publishers) 
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Figure 15.118 Wind tunnel simulation of dense gas dispersion - universal plume profile for dispersion on a slope 
(D.J. Hall, Barrett and Ralph, 1976) (Courtesy of Warren Spring Laboratory) 


slopes and obstructions which generally draw on the theo¬ 
ry of gravity-driven flow and which may be used alone or in 
combination with the other methods. 

General discussions of the effect of more complex and 
obstructed terrain have been given by Britter and Griffiths 
(1982), Gunn (1984), McQuaid (1986) and Britter and 
McQuaid (1988). 

15.40.1 Slopes and ramps 

An account of the behaviour of a dense gas on a slope in the 
field trials at Porton Down has been given by Picknett 


(1978a), as described in Section 15.37. Analytical models of 
the dispersion of a dense gas on a slope have been given by 
several workers. 

A gravity current flowing down a slope develops a char¬ 
acteristic thickening at the downhill edge, or ‘head’. Ellison 
and Turner (1959) conducted an experimental and theore¬ 
tical investigation of the gravity current on a slope. For the 
experiments they used salt water flowing down an inclined 
plane in pure water. They found that for the continuous 
current well behind the head the mean velocity is independ¬ 
ent of distance, but that the thickness of the fluid layer 
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Figure 15.119 Water tunnel simulation of dense gas 
dispersion at an obstacle - variation of mean concentra¬ 
tion at ground level with distance for gas plumes of different 
density C, mean concentration; D, diameter of plume 
source; Q * non-dimensional plume spill rate; Ri, Richard¬ 
son number; x, distance downstream of source; 
p, density of surrounding fluid; p h , density of dense fluid 
(Cheah, Cleaver and Milward, 1983a) (Courtesy of the 
Institution of Chemical Engineers) 


increases at a constant rate due to entrainment. The density 
excess decreases, maintaining a constant buoyancy flux 
down the slope. 

Another experimental and theoretical study is described 
by Britter and Linden (1980). The experiments again 
involved the flow of salt water in pure water down an 
inclined plane. These workers investigated particularly the 
head of the gravity current on a slope. They found that the 
behaviour of the head depends on the angle 9 of the incline 
to the horizontal. For 0 :> 5° the head has a constant velocity, 
for 0<;O.5° its velocity is strongly affected by friction and 
decreases with distance, whilst in the range 0.5° <; 0 <;5° 
there is a perceptible but weaker frictional effect. 

They also found that the velocity % of the front is pro¬ 
portional to the volumetric flow per unit width: 

m oc(^ 0 Q) 1/3 [15.40.1] 

4 = & [15.40.2] 


where g' 0 is a reduced gravity, Q is the volumetric flow per 
unit width, u± is the velocity of the front, or head, p is the 
density and subscripts 1 and 2 denote less and more dense 
fluid, respectively. They obtain the relation 


. %- =5 V3 [cos O'; asmj sinO ]*■#* 
{g'oQ) 1/S 2 L a 2(£ + C D r(£ + Cb)j 



[15.40.3] 

with 


***/« 

[15.40.4] 

E = dh/dx 

[15.40.5] 

Ri n tan0 —Cd 

2 ~ iTO.SSiRin 

[15.40.6] 

Ri n =(^“ s0 ) 

[15.40.7J 

pi 

[15.40.8] 


where C D is a drag coefficient due to stress at the lower 
surface, E is a dimensionless rate of entraiment, or 
entrainment coefficient, g 1 is a reduced gravity, h is the 
height of the following flow, u is the mean velocity of the 
following flow, u s is the velocity on a defined streamline, x is 
the downhill distance, Si and S2 are parameters, 9 is the 
angle of incline (°), and subscript n denotes ‘normal’. The 
numerical values of the parameters are typically as follows: 
C D < 0.02; 0.1 < Si < 0.15; 0.6 < S 2 < 0.9; a » 1.2. Ellison 
and Turner obtained typical values of E = 0.0010 and 
S 2 = 0.75. 

This value of the entrainment coefficient E should be 
valid for dense gases also, provided the density difference 
is not too large. For flow of a dense gas on slope there is a 
significant dilution which quite quickly produces a small 
density difference. 

Britter and Linden found that for the velocity of the 
head 


“ f ,„ = l.5±0.2 0 > 5° [15.40.9] 

{m v 

The authors give expressions for the mean velocity u of the 
following flow for limiting cases. For large slopes (0 > 30°) 
they obtain with a small density excess ut ~ 0.6m and with 
a large density excess u t « u as 0 —> 90°. For small slopes 
they quote the results of Middleton (1966) to the effect that 
at very small angles Uf = u and that ut/u decreases rapidly 
as 0 increases. 

De Nevers (1984a) has given a model based on a force 
balance in which the force in the downhill direction due to 
gravity, less buoyancy, is balanced by three forces acting in 
the uphill direction: the shear forces at ground surface and 
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(d) (e) 

Figure 15.120 Wind tunnel simulation of dense gas dispersion over an industrial site - continuous release of ammonia 
(Guldemond, 1986); (a) model in wind tunnel; (b) dense gas plume on flat terrain; (c) dense gas plume on industrial site; 
(d) neutral buoyancy gas plume on flat terrain; (e) neutral buoyancy plume on industrial site (Courtesy of the Institution 
of Chemical Engineers) 
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at the top of the cloud, and the form force at the leading edge 
of the cloud. The force balance on a slope of angle 9 is then 

nR 2 HpJ sin 9 = nR 2 p g ^ (f h +f t ) + 2 RHp a C D 

[15.40.10] 

and hence 

■■[wtoWp)]^ |15 " u| 

where Cd is the form drag coefficient,/is the friction factor, 
g' is the reduced gravity, H is the height of the cloud, R is the 
radius of the cloud, u is the velocity downhill, p is the den¬ 
sity, and subscripts a and g denote air and gas and b and t 
the bottom and top of the cloud, respectively. 

De Nevers concludes that for even a modest slope the 
downhill velocity can be as large as the lateral velocity due 
to gravity spreading. The effect of a degree of slope in the 
Burro field trials has been investigated by Koopman, 
Ermak and Chan (1989) using FEM3, as described in 
Section 15.37. 

The universal plume profile of a dense gas on a slope has 
been studied by D.J. Hall, Barrett and Ralph (1976). This 
work was described in Section 15.39. A model of the dis¬ 
persion of a dense gas up a ramp has been given by Britter 
and Snyder (1988). 

The effect of a slope in mitigating the dispersion of a 
dense gas from a source to an uphill target has been studied 
by Heinhold, Walker and Paine (1987) using both an analy¬ 
tical model and wind tunnel work. They start by quoting 
the work of Meroney et al. (1977) who carried out wind 
tunnel tests on the flow of dense gas on a slope with an 
uphill wind. After the initial gravity slumping, the flow of 
the gas is governed by the wind speed. There is a critical 
uphill wind speed below which the dense gas flows down¬ 
hill and above which it flows uphill. 

The authors model this situation as an energy balance 
between the potential energy which must be supplied to 
raise a plume element up the slope and the kinetic energy of 
the wind, and derive the relation 





change in potential energy of the element. For a given den¬ 
sity, and hence concentration, Equation 15.40.12 may he 
used to determine the height uphill which the plume can 
reach. The initial and final cross-plume areas were deter¬ 
mined using the authors’ own AIRTOX dense gas disper¬ 
sion model. 

Heinhold, Walker and Paine describe the application of 
this model to releases of liquefied ammonia, assuming 
complete evaporation of all liquid spray formed. Two 
release rates were studied, 10 and 100 kg/s. At the lower 
flow rate the plume became passive at 100 m. Only atmos¬ 
pheric stability inhibited dispersion uphill. At the higher 
flow rate the plume remained dense beyond 1000 m. In the 
latter case, the concentration at uphill locations decreased 
as the slope increased. For slopes of 50 :1,10 :1, 5 :1 and 
2 :1 the concentration was the following proportion of its 
value for flat terrain: 98,90,83 and 45% at 100 m; 86,65,35 
and 20% at200mand50,28,14and8% at400muphill.The 
authors conclude that a slope can afford an appreciable 
degree of protection to a target uphill of a source. This is so 
not only for dense gas but also for passive dispersion. 

Deaves (1987b) has described the treatment of the case of 
dense gas flowing over a river and encountering a river 
bank on the far side. For this use was made of the model of 
Rottman etal. (1985) for an obstacle, given below. 

15.40.2 Fences and vapour barriers 

One of the simplest obstacles to the dispersion of a dense 
gas is a fence, wall or similar barrier. This may be a feature 
which is already there, but in others a vapour barrier may 
be expressly erected to effect a reduction in downstream 
concentrations. 

An account of the behaviour of a dense gas encountering 
a fence in the field trials at Thorney Island has been given 
by M.E. Davies and Singh (1987a), as described in Section 
15.38. Field trials on dispersion of a dense gas at a fence 
have also been described by M. Nielsen (1991). A simple 
treatment of the effect of a fence has been given by Jensen 
(1984). 

A model for the behaviour of a dense gas encountering an 
obstruction such as a fence or vapour barrier has been 
given by Rottman et al. (1985). The situation considered is 
shown in Figure 15.121(a). The model is based on the shal¬ 
low water equations. At steady state, the governing equa¬ 
tions are 

= 0 [15.40.14] 

dx 


[15.40.13] uf x + £— 1^ = 0 [15-40.1$ 


where A a is the initial cross-plume area of the plume ele¬ 
ment, A p is the final cross-plume area of the element, g ' is 
the initial reduced gravity, u is the wind speed at ground 
level, z is the height from the source to the target, 9 is the 
potential temperature, p is the density, and the subscript 
p denotes the plume. The left-hand side term is the kinetic 
energy. The first term on the right-hand side is the potential 
energy of the atmosphere, assuming constant lapse rate; 
this is zero for neutral conditions and a maximum for stable 
conditions. The second term on the right-hand side is the 


with 


g 1 = ^ [15.40.16] 

Pi 


where g' is the reduced gravity, h is the height of the dense 
fluid layer, is the height of the obstacle, u is the velocity 
of the fluid, p is the density of the fluid and subscript 1 
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Vh. 

(c) 

Figure 15.121 Dispersion of dense gas over an obstacle (Rottman et al., 1985): (a) shallow two-layer flow over an 
obstacle; (b) shallow two-layer flow over a wall; and (c) solutions of shallow water equations for depth of fluid 
behind the hydraulic jump as function of wall height (Courtesy of Elsevier Science Publishers) 



denotes upstream. These equations are solved to give 
uh = uih [15.40.17 


^ + h + h w ~^ + ki [15.40.18] 


The regimes of interest are those of blocked flow and par¬ 
tially blocked flow. The equation of the boundary between 
these two regimes is 

± + [15.40.19] 

H„ = ^ [15.40.20] 

where H w is a ratio of heights. 

If the flow is completely blocked, the gas does not dis¬ 
perse downwind at all. The dispersion downwind for the 
case of partial blockage is obtained as follows. This situa¬ 
tion is shown in Figure 15.121(b). Conservation of mass and 


momentum at the jump requires the conditions 


(mi - U)h = («2 - U)hi [15.40.21] 

(«t - Uf= \ (s'*) | (l +[15.40.22] 

and, assuming that flow over the obstacle is critical 
« w = (gh) V2 [15.40.23a] 

A h = h 2 - K [15.40.23b] 


where Ah is the head difference, U is the velocity of the wave 
travelling upstream, u w is the velocity over the obstacle, 
and subscript 2 is the fluid in the space between the 
upstream-moving wave and the obstacle. 

By mass conservation Equation 15.40.23 can be 
expressed in terms of u 2 to give 

U5.40.24a] 

*=0 Y >1 [15.40.24b] 
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It can be shown that Equations 15.40.21, 15.40.22 and 
15.40.24 yield for h^lhi < 1 

ui- {l- H h ) U = (g'h) 1 ' 2 jft (l - ^) ] ^ [15.40.25] 

(ft - Uf= l (g'h)H h ( 1 + H b ) [15.40.26] 

and for h^/hz > 1 


respectively, are as follows. The ratio Wf/W^t increases with 
increase in fence height: 

Wt h 

^h=3 H rs 0.05 [15.40.33a] 

Wt h 

1.5 *4 0.15 [15.40.33b] 

KKnf ri 

WitWni also increases weakly with u/ (g^qo/Wni) 1 ^ 3 . 

The following relation for concentration in terms of fence 
width is also given: 


Ui = (l-H b )U [15.40.27] 


U 3 = mU 2 - (g'h 1 ) 1/2 U + l/2(g'hi) 1,2 ui = 0 [15.40.28] 

H h = ^ [15.40.29] 

h\ 

where H h is a ratio of heights. 

Solutions of these equations are shown in 
Figure 15.121(c). The range 1.5 < h 2 /h 1 < 2.5 covers most 
cases of interest and as a rule-of-thumb fe/Ai = 2. 

Release upstream of an obstacle such as a fence is one of 
the two main cases of more complex terrain treated in the 
Workbook by Britter and McQuaid (1988). The treatment is 
based on the work of Britter (1986 SRD R407). Using the 
Workbook notation given in Section 15.34, for a plume from 
a continuous release encountering a fence height H normal 
to the wind direction the height h of the plume in the 
absence of the fence is obtained from 


C uHWt 
C 0 q 0 


2.1 ±0.3 0.04 


(g' 0 qo/W n{ ) 1/z 

[15.40.34] 


where q a is the volumetric rate of release. 

Meroney (1991) has described the use of models for the 
simulation of the effects of a fence on the dispersion of a 
dense gas. Carissimo etal. (1989) have described the use of 
MERCURE-GL to study the effect of a fence on dense gas 
dispersion. The water tunnel study by Cheah, Cleaver and 
Milward (1983a) of dense gas dispersion at a simple barrier 
has been described in Section 15.39. 


15.40.3 Water spray barriers and steam curtains 

Work on water spray barriers and steam curtains is descri¬ 
bed in Section 15.53. Accounts of the use of HEAVYGAS to 
simulate the effects of the water spray barrier used in the 
field trials described by Moodie (1981) have been given by 
Deaves (1983b, 1984). This work is described in Section 
15.53. In the work just mentioned on dense gas dispersion at 
a fence, Meroney (1991) has also treated the case of a water 
spray barrier. 


Cguh = C 0 q* 0 [15.40.30] 

where C g is the maximum volumetric concentration at 
ground level, C Q is the volumetric concentration of the 
initial release, h is the height of the cloud, q* a is the volu¬ 
metric release rate per unit width and u is the mean velocity 
at the fence. 

The following regimes are distinguished. For uj 
(g 0 ql)^ > 5and H/h < 30, the plume is not blocked by the 
fence. In the range 4.5 < H/h < 15 the ground level con¬ 
centration is as if the plume were not dense and 

£^ = 1.7 ±0.3 [15.40.31] 

whilst in the range 3.5 <ul(g' 0 q* 0 )^ 3 < 5 

^^ = 2.2 ±0.4 [15.40.32] 

where C is the volumetric concentration. 

For ho. 5 /H > 2 and u/(g' 0 q * 0 ) 1/3 > 3.5, where ho.s is the 
height at which the concentration is half the ground level 
value, the ground level concentration is little affected by 
the fence. 

As far as concerns plume width, the relations given for 
the plume widths Wt and W n t with and without a fence, 


15.40.4 Buildings: release upstream 

Another well defined obstacle to the dispersion of a dense 
gas is a single building or a defined sequence of buildings. 
The effect of a building on an upstream release is well 
treated for passive dispersion, but not so well for dense gas 
dispersion. 

McQuaid (1987) has given an account of the behaviour of 
a dense gas encountering a building in the field trials at 
Thorney Island, as described in Section 15.38. A review of 
turbulent diffusion near buildings, including a treatment 
of dense gas dispersion, has been given by Meroney (1982). 
Krogstad and Pettersen (1986) used a wind tunnel to 
investigate the flow of a dense gas around a rectangular 
building. The effect of a sequence of rectangular buildings 
on the dispersion of a dense gas has been studied by Deaves 
(1989) using an adaptation of the model by Brighton for 
release into a building wake, described below. 

15.40.5 Buildings: release into lee 

Release into the immediate lee of a building is another topic 
where treatments are available for passive dispersion, but 
where there is less guidance for dense gas dispersion. This 
case is relevant, however, to a number of scenarios which 
may arise in practice. In particular, it applies to the case 
where a spillage occurs from a storage tank and then eva¬ 
porates in the lee of the tank. 

A model for the dispersion of a dense gas in the lee of a 
building has been given by Brighton (1986). He takes as his 
starting point the models for passive dispersion in a 
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building lee given by Vincent (1977, 1978) and Fackrell 
(1984b), which were described in Section 15.17. A dense gas 
will tend to reduce the turbulent mixing and, if the flow is 
large, to modify the mean wake flow, and a separate treat¬ 
ment is necessary. 

He considers a rectangular building of height h, width ui, 
length l and frontal area A 


A = wh [15.40.35] 

and a recirculation region, or wake, in the lee with height h, 
width w, length % surface area and volume V w The 
dimensionless wake length is defined as 

X^-lv/h [15.40.36] 

The basis of the model is the existence of two layers, a lower 
and an upper layer, in the lee. It is assumed that air flows 
directly into the upper layer but not into the lower one: 


release rate, p is the density of the cloud and p a is the 
density of air. 

The flow from the lower to the upper layer F w is equal to 
that from the upper to the lower layer _F UL given that there is 
no air flow directly into the lower layer. These flows are 
taken as 


Ai.u = Am. = Ri > Ri x [15.40.47a] 

» a M 2 W Ri < Ri T [15.40.47b] 

where ai and aM are mixing coefficients. The Richardson 
number Ri is defined as 


R . (Q, - Gj)g' 0 h 


[15.40.48] 


which at the source becomes 


F a = a^u [15.40.37] 

where F A is the flow of air into the wake, u is the wind speed 
and a 0 is a constant. The concentration of contaminant C 
resulting from a source of strength Q in the lee is 

C = Q/F a [15.40.38] 

Then from Equation 15.40.37 


Ri=^ [15.40.49] 

The transition Richardson number Rix is 

Rix = oci/oc M [15.40.50] 

From analysis of the flows and concentrations in the wake, 
Brighton derives for one regime Ri < Ri T : 


C = Q/uoS^u 

The heights of the two layers are 
h = hL/h 


[15.40.39] 


[15.40.40] 


(<*m4 w + 0.7%) Q 
0.7%o(m4 w + (aivi/lw + 0.7%) Q 
«m2 w Cl 

«w|pllSR 


[15.40.51] 

[15.40.52] 


% = h v /h [15.40.41] 

% + % = /z [15.40.42] 

where % and h v are the heights of the lower and upper 
layers, and % and % are the corresponding normalized 
values, respectively. Hence 


where Cl and Cu are the volumetric concentrations in the 
lower and upper layers, respectively. At the limit as 
% —> 0 and Qi —> 0 


-»1.4 [15.40.53] 

whilst at the other limit as % —> 0 


[15.40.43] Cl _ ! 


[15.40.54] 


The treatment utilizes 
meters: 



dimensionless para- This latter case corresponds to the situation where the 
source strength is so great that the gas released moves 
with a velocity comparable to the wind speed and occupies 
the whole of the wake region. For the other regime, with 
[15.40.44] Ri > Rix . 




[15.40.55] 

[15.40.56] 


/o =*f£-r^ [15.40.46] 

where B is the dimensionless buoyancy flux, g' 0 is the 
reduced gravity at the source, Q is the dimensionless 


where Ri 0 is the initial Richardson number before mixing. 

Brighton describes the matching of this model to unpub¬ 
lished experimental work by Britter. He takes for a value 
of 2.08, as given by Fackrell ai^is taken as 0.036; and a M as 
unity, although the influence of this parameter is weak. 
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This model gives as outputs the width, height and con¬ 
centration at the end of the wake region. The inputs 
required for a dense gas dispersion model are these para¬ 
meters plus the velocity; Brighton suggests matching may 
be achieved by retaining the width and concentration given 
by his wake model, but adjusting the height to give mass 
conservation. This will generally involve a reduction in the 
height; the plume contracts as it accelerates up to the wind 
speed. 

If the buoyancy flux is large with B > 1, there is a ten¬ 
dency for the cloud at the source to spread upwind and 
sideways. For this condition Brighton quotes the relations 
obtained by Britter (1980): 

Su=^D + 2L b [15.40.57] 


These results apply for the condition (qJuBP) or (qJuPf) 
less than about 0.1, where q' 0 is the volumetric rate of release 
per unit length. Further downwind, the effect of the den¬ 
sity difference is liable to reassert itself. For concentrations 
further downwind, one approach is to work in terms of a 
new source with values of q„ and g' 0 determined from the 
value of C. 

15.40.6 Buildings: release inside 

A release of gas may occur inside a building and then 
escape into the atmosphere. A study of this scenario has 
been made by Brighton (1986,1989 SRD R468). The parti¬ 
cular case of interest was a release of liquefied chlorine. 

For a continuous release of gas into a space ventilated by 
air, the molar flow of gas is 


[15.40.58] 


<lG_ 

m g 


NgQ 

V 


[15.40.61] 




L b =^ [15.40.59] 

where D is the diameter of the source orifice, L B is the 
buoyancy length scale, S L is the lateral spread of the cloud 
and Su is the upwind spread of the cloud. This model has 
been used by Deaves (1987b, 1989), as described above, in 
modelling for safety cases. 

Release into the lee of a building is the other main case 
treated by Britter and McQuaid (1988)intheWorkbook.The 
treatment for a continuous release is based on the work of 
Britter (1982,1986 SRD R407) on a square flat plate of side 
H normal to the direction of flow. 

For the concentrations in the immediate lee, the following 
regions or limits are distinguished: 

S'On n 

Region 1 p^<4xl0“ 3 

Region 2 4 x 10“ 3 < ^ <4 x 1(T 2 

Limit 3 %>2x 11T 1 


and that of air is 

QaPa N g Q 
M h : 'p" 


[15.40.62] 


where M is the molecular weight, N is the number of moles, 
Q is the volumetric flow, V is the volume of space, p is the 
density, and subscripts A and G denote air and gas, 
respectively. The variables Q and p without a subscript 
refer to the gas-air mixture. 

The natural ventilation flow Q A is given by the ventila¬ 
tion equation 


Qa = M(AP/p A ) 1/2 [15.40.63] 

where A is the area of the opening, A P is the pressure dif¬ 
ference between the outside and the inside, and b is a con¬ 
stant. Equation 15.40.63 is an application of Bernouilli’s 
equation and is a standard relation given in various venti¬ 
lation codes such as BS 5925:1980. The value of constant b 
is taken by Brighton as 0.88. The pressure drop is a func¬ 
tion of the wind speed u: 




[15.40.64] 


where g' 0 is the reduced gravity at the source, H is the 
height of the obstacle, q a is the volumetric rate of release of 
material and u is the mean velocity at the obstacle height. 

In region 1, the release rate is so low that the density of 
the release has virtually no effect on the concentration. In 
region 2, the lateral width of the plume is maintained 
within the recirculation zone in the immediate lee. At limit 
3, there is some enhanced dilution in the immediate lee but 
the effect is weak. By limit 4, the effect of the obstacle has 
become negligible. 

In both regions 1 and 2 by a distance of x/H = 2 the con¬ 
centration is given by the relation 

[15.40.60] 

where C is time mean ground level volumetric concentra¬ 
tion and C D is the volumetric concentration at the source. 


where C is a pressure coefficient. Values of C for cuboid 
buildings are tabulated in BS 5925:1980. They are in the 
range 0.7-0.8 for an upwind face, -0.8 to -0.5 for the sides, 
and -0.4 to -0.1 for the lee. 

The cases considered are (1) release under gravity alone 
and (2) release under the combined influence of gravity and 
wind. For the first case, Equation 15.40.63 is used for the air 
flow; Equation 15.40.64 is not used. For this case, the 
gas-air mixture flows out through an area at the bottom of 
the space and air flows in through an area at height h at the 
top of the space. The hydrostatic pressure is 

= (p-p A )gh [15.40.65] 

where p is the density of the gas-air mixture and p A is the 
density of air. The pressure at the top openings is 

= P 0 -P I [15.40.66] 
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and that at the bottom opening is the sum of these 
= P 0 -P' + (p-p A )gh [15.40.67] 

where P is the pressure difference between atmospheric 
pressure and the internal pressure and P a is the atmos¬ 
pheric pressure. Applying Equation 15.40.63 to the two 
areas, the inflow of air is 

Q a = Mi(P'/p A ) 1/2 [15.40.68] 

and the outflow of gas-air mixture is 

Q = bA 0 (-P'/p + ' [15.40.69] 

whereAj is the area for inflow and A a is the area for outflow. 

Eliminating P from Equations 15.40.68 and 15.40.69 and 
then utilizing Equations 15.40.61 and 15.40.62 yields 


For this case n and i are shown in Figures 15.122(a) and (b), 
respectively. 

For the second case, that of release under the combined 
influence of gravity and wind, use is made of both Equa¬ 
tions 15.40.63 and 15.40.64. For this case, it is necessary to 
consider several different situations since, depending on 
the configuration, the ventilation flow may assist or oppose 
the gravity flow. This is illustrated in Figure 15.123. For 
Case (a) in Figure 15.123, the inlet opening is high up on the 
upwind face and above the outlet opening and hence the 
ventilation effect always assists the gravity effect. For 
Cases (b) and (c) the inlet opening is low down on the 
upwind face and below the outlet opening and hence 
the ventilation effect opposes the gravity effect. In Case 

(b) the ventilation effect is strong enough to overcome the 
gravity effect, whilst in Case (c) it is not. Case (a) is termed 
the ‘co-operative combined’ mode, whilst Cases (b) and 

(c) are termed the ‘opposing combined’ mode. 

A Richardson number is defined as 


Hg = N g 


' P/Pa ~ 1 V 
^NZ + tfp/pJ 




_( Kmk v 
" \bM G p A A,(ghf 


p: 

[15.40.70] (A - Qa 3 


[15.40.79] 


[15.40.71] 


where Q is the pressure coefficient for the inflow opening 
and C 0 is that for the outflow opening. 

The point at which gravitational and wind effects are of 
equal importance is given by 

RE 1 = p /p A - 1 [15.40.80] 


y .NqRT a 
G P 0 V 


Then, incorporating the additional pressure term from 
[15.40.72] Equation 15.40.64 and proceeding as before yields 


a = Ai/A 0 [15.40.73] 

n = N A /N G [15.40.74] 

where a is the ratio of areas, n is the ratio of molar flows, N G 
is a dimensionless quantity, q G is the flow of gas, q G is the 
dimensionless flow of gas, R is the universal gas constant 
and T a is the absolute temperature of the air. 

Treating the contents of the space as a mixture of perfect 
gases or a two-phase mixture with vapour fraction/ 

^■ : TTf T T [15 - 40 - 75] 

where / is the vapour fraction and T is the absolute tem¬ 
perature of the gas-air mixture. 

The time r for the concentration ofthegasto reach steady 
state if outflow is neglected is 


[15.40.76] 

[15.40.77] ; 


[15.40.78] 
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G G \n 2 Nl + d z p/p A ) 

Ri < (p/p A — l) -1 (Case (b)) 


[15.40.81a] 


= N g \ P L Ph ~ 1 - Rr 

>^ + (l/«2)p/p A J 

Ri> (p/pa- 1) -1 (Case (c)) 


[15.40.81b] 


For this case, n and f are shown in Figures 15.124(a) and (b), 
respectively. The plots have a rather peculiar shape. At 
values of q G below a critical value, there are three steady- 
state solutions, of which one is unstable. For the case of a 
space containing originally zero concentration of the gas, it 
is the higher value of q in Figure 15.124(a) which represents 
the eventual steady state. At values of q G above the critical 
value there is only one steady state. 

Accounts of the use of this work in the modelling of dense 
gas dispersion for safety cases have been given by Deaves 
(1987b, 1989). 


15.40.7 Industrial sites 

There have been several studies of the effect on the behav¬ 
iour of a dense gas when it disperses over an industrial site 
containing features such as process plants, storages or 
terminals. 

C.I. Bradley and Carpenter (1983) have conducted an 
investigation of dense gas dispersion at a storage and 
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Figure 15.122 Brighton model of release of gas inside a building - continuous release of chlorine under gravity 
alone (Brighton 1989, 3RD R468): (a) air/chlorine molar flow ratio; (b) dimensionless time (Courtesy of the 
UKAEA Safety and Reliability Directorate) 
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Figure 15.124 Brighton model of release of gas inside a building - continuous release of chlorine in opposing 
combined mode with a = 1 (Brighton, 1989 3RD R468): (a) air/chlorine molar flow ratio n; and (b) dimensionless time 
(Courtesy of the UKAEA Safety and Reliability Directorate) 
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terminal site using both ZEPHYR and wind tunnel model¬ 
ling. This work is described in Section 15.39. An account is 
also given in the same section of the work of Guldemond 
(1986) on a wind tunnel study of dispersion of ammonia on 
an industrial site. 

Deaves (1989), in the work on safety cases already men¬ 
tioned, used HEAVYGAS to study dense gas dispersion over 
aworkssite.AnaccountofthisstudyisgiveninSectionl5.33. 

Both in the work of Bradley and Carpenter and in that of 
Deaves the presence of the industrial site caused a reduc¬ 
tion in the hazard range compared with unobstructed 
ground. This reduction was typically of the order of 2, 
although this value should be regarded as no more than a 
pointer. 

15.40.8 Complex terrain 

Complex terrain such as hills and valleys appears not to 
have been investigated to any great extent in relation to 
dense gas dispersion. Such terrain is of practical impor¬ 
tance for passive dispersion of pollutant gases where the 
contamination distances are typically some kilometres, but 
of less concern for dense gas dispersion where the hazard 
ranges tend to be shorter. Likewise, coastal regions and 
urban areas have not received much attention as far as 
dense gas dispersion is concerned. 

15.41 Dispersion of Dense Gas: Validation and 
Comparison 

In the account given so far of dense gas dispersion, the 
various models have been presented, often with some 
mention of comparisons made with experimental work, and 
physical modelling has been described, much of it simu¬ 
lating field trials. 


The degree of scale-up between laboratory experiments 
(or even field trials) and incident scenarios, the differences 
in the definitions of concentration used and the variability 
of concentration between different realizations of an 
ensemble of experiments, the large number of models and 
the appreciable differences in the predictions which they 
give, and the variety of outputs which may be of interest, all 
underline the need for methods of evaluating models. 

Model evaluation has been a live issue for passive dis¬ 
persion, as described in Section 15.15. Approaches to vali¬ 
dation of models of dense gas dispersion have been 
described by Fay (1980), Wheatley and Webber (1984 CEC 
EUR 9542 EN), Brighton (1987) and Mercer (1988). 

15.41.1 Degree of scale-up 

The degree of scale-up which is involved in going from even 
the largest field trials to the scenario of a maj or incident can 
be very large. For example, the Thorney Island trials 
involved 2000 m 3 of gas. The LNG spill studied by Havens 
(1978) involved 25,000 m 3 of LNG, equivalent to 6 x 10 6 m 3 
of gas; this is a scale-up of over three orders of magnitude. 

15.41.2 Differences between models 

At the start of the Thorney Island trials the organizers 
invited modellers to submit for defined conditions and 
releases the profile of concentration with downwind dis¬ 
tance which their models predict for a particular scenario. 
The results of this exercise are illustrated in Figure 15.125. 
The figure shows a high degree of variability between the 
models. 

15.41.3 Differences in model outputs 

There is large variety of outputs which have been used 
by authors of models in making comparisons with 
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Figure 15.125 Evaluation of models for dense gas dispersion - predictions of different models prior to the 
Thorney Island trials (McQuaid, 1984b) (Courtesy of Springer Verlag) 
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experimental results. A review of these outputs has been 
given by Mercer. They include the concentrations 

(1) bulk concentration as function of distance or time; 

(2) peak concentration as function of distance or time; 

(3) concentration at a given distance and time; 

and 

(4) cloud radius or height as a function of distance or time; 

(5) location of cloud centre, leading edge or trailing edge, 
peak concentration as a function of time; 

(6) maximum downwind extent of the lower flammability 
limit (LFL) or (1/2) LFL 

Mercer gives details of comparisons made, showing 
there is little uniformity in the choice of outputs used for 
comparison. 

15.41.4 Definition and determination of concentration 

In large part, the problem of evaluation centres around that 
of defining the experimental concentrations and then 
obtaining experimentally stable values for these. One prob¬ 
lem is that the values of the concentration obtained in a 
single trial vary with the sampling time. It is necessary 
that the sampling time be clearly defined both for the model 
and for the experiment. 

Frequently, experimental results are reported using 
some kind of average concentration at a fixed location. 
Usually, for the plume from a continuous release the con¬ 
centration used is a long-time average, whilst for the cloud 
from an instantaneous release it is a short-time average. 
Likewise, a model should include adequate definitions of 
the concentration to which the predictions are intended to 
apply. Such definitions are exemplified by those given in 
the Workbook. For a continuous release the correlations are 
for a concentration averaged over 10 min, whilst for a 
instantaneous release they are for the ensemble average of 
the maximum of 0.6 s mean concentrations. 

A second problem is that there is a high degree of vari¬ 
ability between the values of a concentration measured in 
experiments under the same nominal conditions. In prin¬ 
ciple, it is necessary to perform sufficient experiments to 
obtain a stable ensemble value. However, this is impractical 
with large field trials. Yet it is highly desirable that the 
predictions of models be compared with large-scale 
experiments. 

A third problem is that the maximum concentration of a 
plume occurs on the centre line, but in relation to a fixed 
location this centre line may be continuously displaced due 
to plume meander. An alternative approach described by 
Puttock, Blackmore and Colenbrander (1982) is therefore to 
reconstruct from experimental measurements the varia¬ 
tion of the location of the centre line with time and to utilize 
for comparison the concentrations on this reconstructed 
centre line. 

A more detailed discussion of concentration is given in 
Section 15.45. The work described there, particularly that 
of Chatwin and co-workers, points to a fundamental 
approach in which the concentration is defined in terms of 
concentration probability contours. 

15.41.5 Methods of evaluation 

Some of the methods available for checking a model are 
described by Mercer. The predictions of the model may be 


compared with experimental work, either by the authors or 
by others. The data may also be compared with those from 
other models. The sensitivity of the predictions may be 
investigated. The variables and the dimensionless quan¬ 
tities used in the model may be examined. The constants in 
the submodels may be optimized by comparison with 
observation. 

15.41.6 Comparison between models and experiments 

Most authors of models have presented some comparison of 
predictions from their model with results of experimental 
work, ranging from laboratory-scale experiments to field 
trials. However, as just described, the problem of evaluation 
is a complex one, and such comparisons are frequently 
pointers rather than full validations. 

A review of comparisons between models and experi¬ 
ments has been given by Mercer (1988). He defines a num¬ 
ber of variables which are commonly compared (as 
described above), tabulates those which have been used in 
particular comparative studies and lists the data sets used 
in these studies. He comments that there is little common¬ 
ality in the variables chosen for comparison and little jus¬ 
tification given for the choice of experiments with which to 
make the comparison. 

15.41.7 Comparison between models and experiments: 
some studies 

Some mention of comparisons made between models and 
experiments has been made above in the accounts given of 
the individual models. In most cases, these are compari¬ 
sons made by the authors themselves.There have also been 
a number of comparative studies involving a number of 
models and trial series. Reviews of studies involving com¬ 
parison of models with experiments have been given by 
Blackmore, Herman and Woodward (1982) and the CCPS 
(1987/2). 

The CCPS (1987/2) describes evaluation studies by a 
number of workers. Quantities compared include: cloud 
dimensions; concentration contours, both in plan and 
crosswind elevation views; concentration vs distance; and 
mean relative error. 

J.L. Woodward et al. (1982, 1983) have compared the 
Germeles and D >del, HEGADAS, 

ZEPHYR and MARIAH with the Dutch Freon, Matagordo 
Bay and Porton Down trials. Quantities compared include 
cloud height, cloud concentration contour (for LFL), and 
the concentration vs time profile at a fixed point. 

A comparison has been given by Havens, Spicer and 
Schreurs (1987a) of SIGMET-N, ZEPHYR, MARIAH-II 
and FEM3 with the Burro trials, the quantity compared 
being concentration vs distance. 

Koopman, Ermak and Chan (1989) have described a 
comparison of the Gaussian model, SLAB, FEM3 and 
HEGADAS and the proprietary model CHARM with the 
Burro, Coyote, Desert Tortoise, Eagle, Goldfish, Falcon, 
Maplin Sands and Thorney Island trials. Quantities com¬ 
pared include: concentration contours, both in plan and 
crosswind elevation views; concentration vs distance; and 
cloud temperature vs distance. 

S.R. Hanna, Strimaitis and Chang (1991b) have com¬ 
pared the Gaussian model, INPUFF, HEGADAS, DEGA- 
DIS and the Workbook model and the propriety models 
AIRTOX and CHARM with the results of the Burro, Coyote, 
Desert Tortoise, Goldfish, Porton Down, Maplin Sands and 
Thorney Island trials and also with the passive dispersion 



EMISSION AND DISPERSION 15/251 


Hanford and Prairie Grass trials. The quantities compared 
were the fractional bias and the normalized mean square 
error, evidently for the concentrations at different 
distances. 

Touma etal. (1991) have compared SLAB, HEGADAS and 
DEGADIS and also AIRTOX and CHARM with the results 
of the Burro, Desert Tortoise and Goldfish trials, the quan¬ 
tity compared being concentration vs distance. 

In some cases (e.g. CCPS, 1987/2) investigators have 
found the performance of the Gaussian model to be vir¬ 
tually as good as that of dense gas dispersion models, 
though this finding should be treated with caution. 

15.41.8 Comparison between models and experiments: 
some problems 

The use of data from field trials to validate models involves 
a number of problems. An account of these in the context of 
the Thorney Island trials has been given by Brighton 
(1987). He describes in detail the sources of error in the data 
obtained from such trials. 

The data required depend on the type of model. The data 
yielded by a trial are a set of measurements of profiles 
of concentration vs time at each sensor within the cloud 
together with the parameters. 

For a three-dimensional model the outputs are again 
concentration vs time profiles and thus comparison is 
relatively straightforward. A problem can arise, however, 
if the experimental measurements are taken very close to 
the ground. The grid size in the three-dimensional model 
may be too coarse to give an accurate prediction of these 
concentrations. 

The comparison is more difficult for a box model. It is not 
a simple matter to extract from the experimental data the 
quantities required by modellers. The extent of the proces¬ 
sing necessary to convert the Thorney Island results into a 
data set that conforms with the requirements of modellers 
was indicated in Section 15.38. 

Quantities required are those such as mean concentra¬ 
tion, cloud dimensions and advection velocity. Brighton 
gives examples of the differences in the estimates of these 
quantities given by different workers. 

In view of the work involved in establishing the data sets 
required to conduct model evaluations, it is valuable, where 
the data permit it, to have an archive of data in standard 
format. S.R. Hanna, Strimaitis and Chang (1991b) describe 
the creation of such a modeller’s data archive (MDA). 

15.41.9 Comparison between different models: some 
studies 

In addition to comparisons between predictions of models 
and results of experiments made by the authors of the par¬ 
ticular model, comparisons have also been made between a 
number of models. A series of studies of the performance of 
available models has been carried out by Havens, starting 
with the LNG spill studies described in Section 15.22. 
Mention of some of the other comparisons made bet¬ 
ween models has been made in the accounts of the various 
models. 

The CCPS Workbook of Test Coses for Vapor Cloud 
Source Dispersion Models (CCPS, 1990/8) gives results 
from a number of models, principally the Gaussian disper¬ 
sion model, SPILLS, SLAB and DEGADIS, and thus gives a 
comparison of models in a set of typical hazard assessment 
applications. 


15.41.10 Measures for evaluation 

There have been, therefore, quite a large number of model 
evaluation studies. Most of these studies have relied on 
essentially ad hoc criteria of evaluation. One problem in 
developing evaluation criteria is to identify those para¬ 
meters which are the best discriminators. Thus, for exam¬ 
ple, one of the main features which a model should predict 
is the degree of air entrainment. The cloud radius tends not 
to be a good discriminator for this. It is the height which is 
much more strongly affected by entrainment. 

Another problem is the formulation of criteria which 
allow comparisons to be made between models. Here cri¬ 
teria such as cloud dimensions or concentration profiles 
may be abandoned in favour of statistical measures. There 
is no generally accepted set of measures for validating 
models, but several authors have developed particular 
methods. 

Fay (1980) has utilized a scatter diagram technique in 
which for the variable of interest the experimental value is 
plotted against the model value. By normalizing the vari¬ 
able, the method can be extended to allow comparisons to 
be made between the experimental value and the values 
predicted by different models. One of the plots using a 
normalized variable given by Fay is shown in Figure 15.126. 

Work on goodness-of-fit measures (GFMs) between area- 
averaged concentrations obtained in experiments and 
concentrations given by box models has been described by 
Wheatley, Prince and Brighton (1985). 

S.R. Hanna, Strimaitis and Chang (1991b) have utilized 
two statistical measures: the fractional bias (FB) and the 
normalized mean square error (NMSE). They give a series 
of plots of FB vs NMSE, each showing the performance of 
a number of models for a particular series of trials. 

In wind tunnel work there is evidence of a degree of uni¬ 
formity in comparing results of field experiments and of 
physical modelling, in that several workers have adopted 
the practice of D.J. Hall, Hollis and Ishaq (1982, 1984) in 
utilizing cloud width, arrival and departure times, and 
concentration vs time profiles. 


15.41.11 Extent of validation attainable 

For gas dispersion modelling generally, it has to be recog¬ 
nized that there may be limits to the degree of agreement 
which can be expected between model predictions and 
experimental results. A discussion of the problem is given 
by Mercer (1988). In large part, it centres on the variability 
of concentrations just described. Mercer quotes the follow¬ 
ing statement by Lamb (1984) made in the context of air 
pollution and its regulation: 

The predictions even of a perfect model cannot be 
expected to agree with observations at all locations. 
Consequently, the goal of ‘model validation’ should be one 
of determining whether observed concentrations fall 
within the interval indicated by the model with the fre¬ 
quency indicated, and if not, whether the failure is attri¬ 
butable to sampling fluctuations or is due to failure of the 
hypotheses on which the model is based. From the stand¬ 
point of regulatory needs the utility of a model is mea¬ 
sured partly by the width of the interval in which a 
majority of observations can be expected to fall. 

For heavy gas dispersion specifically, the high degree of 
inertia of the cloud results in some reduction in the vari¬ 
ability which would otherwise occur. Mercer suggests that 
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Figure 15.126 Evaluation of models for dense gas dispersion - comparison of observed peak concentrations with those 
predicted by models x, time of passage of peak concentration; j_ peak cloud concentration. (Fay and Ftanck, 1983) 
(Courtesy of Pergamon Press) 


a realistic expectation for a model may be that its predic¬ 
tions be accurate within a factor of 2-3. 

In order to reduce the degree of uncertainty, the experi¬ 
mental work should cover a wide range of conditions and 
scales and should include repeat experiments, which may 
most conveniently be obtained by physical modelling. 

15.41.12 Validation of models against Thorney Island 
trials: Phase I 

Mention has already been made of the exercise carried out 
before the Thorney Island trials in which modellers were 
invited to submit predictions from their models. A large 
number of comparisons have been presented between the 
results of the Thorney Island Phase I trials and those from 
model simulations. Some of these comparisons are listed in 
Table 15.53. 

15.41.13 Validation of models against Thorney Island 
trials: Phase II 

The number of models which are capable of simulating 
dense gas dispersion over other than flat, unobstructed 
terrain is limited, and the number of comparisons between 
the results of the Thorney Island Phase II trials and those 
from model simulations is correspondingly smaller. Such 
comparisons have been given for SLUMP and HEAVYGAS 
by Deaves (1985,1987a,b). 

15.41.14 Comparison of physical models with Thorney 
Island trials 

Comparisons have also been presented between the results 
of the Thorney Island trials and those from physical mod¬ 
elling, predominantly in wind tunnels. Mention has already 
been made of the exploratory work done by D.J. Hall, Hollis 
and Ishaq (1982,1984) using a wind tunnel to assist in the 
design of the trials. Some of the trials conducted were suf¬ 
ficiently close to these pre-trial experiments to allow com¬ 
parison to be made. These comparisons have been reported 


for trials 7,11,13,15 and 18 by D.J. Hall and Waters (1985). 
Further comparisons include those for trial 8 by van 
Heugten and Duijm (1985) and for trial 20 by Knudsen and 
Krogstad (1987). A programme of wind tunnel simulations 
for all the Thorney Island trials has been described by 
M.E. Davies and Inman (1987). 

15.42 Dispersion of Dense Gas: Particular Gases 

So far the account given of dense gas dispersion has been a 
general one. It is now necessary to consider some gases of 
industrial interest for which the dense gas behaviour is 
governed by the specific characteristics of the gas. The 
gases considered are: 


(3) chlorine; 

(4) ammonia; 

(5) hydrogen fluoride. 

The source terms for some of these gases are considered in 
Section 15.23. The validation of models against experi¬ 
mental work on, and the application of these models to 
simulations for, these gases are treated in the sections on 
the individual models, Sections 15.25—15.36. Mitigation of 
releases of the gases is dealt with in Sections 15.53 and 
15.54. 

The account in this section deals with the effect on the 
density of the gas cloud of the following factors: 

(1) molecular weight; 

(2) boiling point; 

(3) chemical behaviour; 

(4) atmospheric humidity; 

(5) surface heat transfer; 

(6) liquid spray. 
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Table 15.53 Some comparisons made between results 
of Thorney Island Phase I trials and results of model 
simulations 


Model 

Authors 

van Ulden 

van Ulden (1987) 

BG/C&W 

Carpenter etal. (1987); 

Cornwell and Pfenning 
(1987) 

FEM3 

S.T. Chan, Ermak and 

Morris (1987) 

HEGADAS 

Cornwell and Pfenning (1987) 

HEGABOX/HEGADAS 

Puttock (1987b) 

DEGADIS 

Spicer and Havens (1985,1987) 

Fay and Ranck 

Sherrell (1987) 

Eidsvik 

Gotaas (1985); Cornwell and 
Pfenning (1987) 

Picknett 

Sherrell (1987) 

Webber and Wheatley 

Webber and Wheatley 
(1987) 

CIGALE2 

Cabrol, Roux and Lhomme 
(1987) 

MARIAHII 

Cornwell and Pfenning (1987); 
Havens, Schreurs 
and Spicer (1987) 

MERCURE-GL 

Riou (1987) 

Jacobsen and Magnussen 

Jacobsen and Magnussen 
(1987) 


The modelling of the dispersion of these materials raises 
two questions: whether the gas cloud is dense immediately 
following the initial release; and, if so, how the cloud 
changes in density and whether it becomes buoyant. The 
main interest is in the behaviour of the gas cloud from 
release of a liquefied gas. 

15.42.1 Propane 

Propane has a molecular weight of 44. It is dense by virtue 
of its molecular weight. This is so whether the release is one 
of propane gas or liquefied propane. 

The normal boiling point of propane is -42°C. If the 
release is one of liquefied propane, the low temperature 
makes the gas cloud initially somewhat more dense. In 
principle, heating up of the gas will render it less dense. 
However, the initial temperature difference between the 
gas at its boiling point, and the ambient features, the 
ground or water surface and the atmosphere, is not great 
and heat transfer to the gas does not play a major role. Any 
density changes due to temperature changes tend to be 
small. 

The density of the gas cloud will also be affected by 
atmospheric humidity and by any liquid present as spray. 
The effect of these factors on the density of propane gas 
clouds does not appear to have been much studied, but 
some indication may be obtained from their effect on clouds 
of the other gases, as described below. Propane is generally 
modelled as a ‘simple’ dense gas. 

15.42.2 LNG 

The characteristics of the gas cloud from a release of LNG, 
mainly methane, have been described by Puttock (1987c). 
Broadly, LNG releases normally give rise to dense 
gas clouds. However, under conditions of very high 


atmospheric humidity the initial cloud may be buoyant, 
whilst in other cases the cloud, initially dense, may become 
buoyant with time due to surface heat transfer. 

LNG is mainly liquefied methane and, as such, has a 
molecular weight of 16 and a normal boiling point of 
-161°C. Insofar as it behaves as a dense gas, it does so by 
virtue of factors other than its molecular weight. Of these 
the principal factor is temperature. The gas is sufficiently 
cold that on release it is dense. 

The temperature difference between the cold gas and the 
ambient features is significant. Heat transfer from the 
atmosphere and from the surface is appreciable and can 
have a significant effect on the density. The gas may be 
heated up sufficiently that it becomes buoyant. 

Another factor which affects the density of the gas cloud 
is the humidity. The cold gas causes condensation, and also 
freezing, to occur and the heat release consequent on these 
phase changes causes heating of the cloud. If the humidity 
is high, this can just cause the cloud to become buoyant. 

Figure 15.127, from Puttock, gives relative density vs 
concentration curves for mixing of methane at its boiling 
point with air with relative humidity (RH) as parameter. 
They show that with dry air (RH = 0%) the gas cloud 
remains dense at all concentrations, whereas with wet air 
(RH = 100%) the cloud is slightly buoyant at lower 
concentrations. 

The effect of the above variables is illustrated in the 
modelling work done on the Maplin Sands trials, described 
by Puttock. Using a version of the HEGADAS model in 
which surface heat transfer and atmospheric humidity 
were neglected gave downwind distances to the LFL which 
were large and exceeded those observed, whilst inclusion of 
these effects in the model reduced the distances appreci¬ 
ably and brought them closer to the observed values. This is 
illustrated in Figure 15.128 for trial 29, for which the wind 
speed was quite high (7.4 m/s). Comparative results for this 
and other trials are tabulated by Puttock. 

Some accounts of work on mathematical modelling and 
physical modelling of LNG dispersion suggest that surface 
heat transfer can be neglected, except for low wind speed 
conditions. These results of Puttock indicate that failure to 
take it into account can lead to appreciable error. 

The density of an LNG cloud will also be affected by any 
liquid spray which may be present. The source invariably 
considered for an LNG cloud is a spillage of the refrigerated 
liquid followed by evaporation of the liquid pool. By com¬ 
parison with the quantity of spray generated by a typical 
flashing liquid jet, the quantity entrained in the vapour 
evolved will be small; it may be expected to be rather 
greater from a spillage on sea than from one on land. In any 
event, accounts of the density of gas clouds from LNG 
spillages tend to disregard the effect of liquid spray. 


15.42.3 Chlorine 

As a dense gas, chlorine has some of the features of pro¬ 
pane. The molecular weight of chlorine is 71 so that it is 
dense by virtue of its molecular weight. This is so whether 
the release is one of chlorine gas or liquefied chlorine. 

The normal boiling point of chlorine is -34°C. If the 
release is one of liquefied chlorine, the low temperature 
makes the gas somewhat more dense so that, in principle, 
heating up of the gas will render it less dense, but in practice 
heat transfer to the gas does not play a major role and any 
densitychangesduetotemperaturechangestendtobesmall. 
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(b) 

Figure 15.127 Density of a methane-air mixture formed 
by release of LNG into the atmosphere (Puttock, 1987c): 
(a) main plot; and (b) enlargement of lower left-hand 
section of (a) (Courtesy of the American Institute of 
Chemical Engineers) 


With regard to atmospheric humidity and liquid spray, 
the points made above in relation to propane apply also to 
chlorine. Chlorine is another gas which tends to be mod¬ 
elled as a ‘simple’ dense gas. 

15.42.4 Ammonia 

The characteristics of the gas cloud from a release of 
anhydrous liquefied ammonia have been described by 
Haddock and Williams (1978 SRD R103,1979) and Blanken 
(1980). Broadly, a release of liquid anhydrous ammonia 
normally gives rise to a dense gas cloud. The cloud will tend 
to be dense if the atmospheric humidity is low and/or the 
fraction of liquid spray is high. A cloud with little or no 
liquid spray in air with high humidity may be buoyant. 

The molecular weight of ammonia is 17 and its normal 
boiling point is -33°C. Thus the molecular weight is not 
responsible for any dense gas behaviour. A systematic 


investigation of the factors governing the density of clouds 
of ammonia in air has been made by Haddock and Williams 
(1978 SRD R103, 1979). They consider chemical interac¬ 
tions, atmospheric humidity and liquid spray. 

Possible chemical interactions with atmospheric air 
would appear to be formation of ammonium hydroxide 
(NH 4 0H), ammonium bicarbonate (NH4HCO3) and ammo¬ 
nium carbonate ((NH 4 ) 2 C03). The authors conclude that 
formation of these compounds directly from ammonia 
vapour, water vapour and carbon dioxide would be negli¬ 
gible, but that there would be dissolution of ammonia into 
water droplets formed due to cooling of the air by the cold 
ammonia gas and dissolution of carbon dioxide in these 
droplets. The effect of these processes on the density and 
temperature of the cloud would be minimal, but the effect 
on toxicity could be appreciable. Thus the volume of air 
required to convert a cloud of pure ammonia to one with an 
ammonia concentration of 2000 ppm contains enough car¬ 
bon dioxide to reduce the concentration of free ammonia to 
about 1400 ppm. 

A model of the thermodynamics of the NH 3 —H 2 0—air 
system is used to derive plots of the density and tempera¬ 
ture of a cloud formed from the mixing of ammonia and air, 
as shown in Figure 15.129, whilst Figure 15.129(a) shows 
the temperature for the dry air case. Figure 15.129(b) shows 
a plot of the density vs the air/ammonia mass ratio with the 
liquid fraction /as the parameter, for ammonia initially at 
its boiling point, for dry air (RH = 0%) and Figure 
15.129(c) that for wet air (RH = 100%). 

The work showed that if there is no liquid spray, the 
density of the cloud, for dry or wet air, rises asymptotically 
to that of air, and therefore never exceeds that of air. If 
liquid spray is present, the cloud may be denser than air. 
There are limits to the liquid fraction below which the cloud 
density will not exceed that of air, the limits being different 
for dry and wet air. For dry air, this limit on the liquid frac¬ 
tion is about 8 % and for wet air it is about 12 %. 

For wet air with liquid fractions of 12—16% the cloud is 
denser than air at low dilutions but less dense than air at 
high dilutions, whilst with liquid fractions of 16—20% it is 
denser than air at low dilutions and remains denser 
throughout the dilution process. 

Haddock and Williams consider the behaviour of the 
ammonia droplets. Ammonia will evaporate from the drop¬ 
lets, causing their temperature to fall. Evaporation 
becomes mass and heat transfer limited. The presence of 
water vapour will not greatly affect this process. For drop¬ 
lets up to the upper limit of interest, about 100 pm the time 
scale for evaporation remains short relative to that for 
precipitation. 

As far as concerns the behaviour of the droplets during 
the initial gravity slumping of the cloud, ammonia-air 
mixtures with mass ratios greater than 10 will not be sig¬ 
nificantly depleted of ammonia by precipitation of ammo¬ 
nia droplets. This applies even where the cloud height after 
slumping is quite low. 

The broader aspects of an ammonia release, particularly 
dispersion, have been treated by Kaiser and Walker (1978), 
Griffiths and Kaiser (1979 SRD R154) and Kaiser and 
Griffiths (1982). 

15.42.5 Hydrogen fluoride 

The gas cloud characteristics for a release of liquefied 
anhydrous hydrogen fluoride (HF) have been described by 
Puttock et al. (1991). Broadly, releases of liquid HF may give 
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- NO HEAT OR WATER VAPOUR TRANSFER 

-WITH HEAT TRANSFER 

. WITH HEAT AND WATER VAPOUR TRANSFER 



Figure 15.128 Effect of heat transfer from surface on dense gas dispersion - predictions of HEGADAS for 
distance to the LFL for the Maplin Sands LNG spill trial 29 under three different assumptions (Puttock, 1987c) 
(Courtesy of the American Institute of Chemical Engineers) 


rise to gas clouds which are dense or buoyant; a large 
proportion will be dense. The cloud will tend to be dense if 
the atmospheric humidity is low and/or the fraction of 
liquid spray is high. A cloud with little or no liquid spray in 
air with high humidity may be buoyant. 

The molecular weight of HF is 20 (as monomer) and its 
normal boiling point is 20°C. Dense gas behaviour is 
therefore attributable to factors other than molecular 
weight of the monomer. 

HF differs from the other gases considered here in that it 
is subject to self-association and tends to form polymers of 
the general formula (HF)„. Treatments of this feature in 
the context of dense gas dispersion have been given by 
Chikhliwala and Hague (1987), Clough, Grist and Wheatley 
(1987) and Schotte (1987). 

Saturated vapour of HF has an apparent molecular 
weight of 78.2 at its normal boiling point. At 100°C, HF has 
a molecular weight of 49.1; at 300°C it is virtually mono- 
molecular. Dilution of the gas cloud with air also results in 
a decrease in its apparent molecular weight. This associa¬ 
tive behaviour, or oligomerization, of HF has been studied 
by a number of workers and various schemes have 
been proposed. For example, MacLean et al. (1962) give a 
monomer-dimer-hexamer model, and Beckerdite, Powell 
andAdams(1968)giveamonomer—trimer—hexamermodel. 

Thus, in order to have a complete description of the 
behaviour of an HF cloud it is necessary to take account of 
self-association, atmospheric humidity and liquid fraction. 


A model of HF fog formation is that proposed, and revised, 
by Schotte (1987,1988). The model treats the self-associa¬ 
tion of HF and the formation of HF fog, or liquid HF—H 2 0 
droplets. 

Another model of HF which takes into account self¬ 
association and atmospheric humidity has been described 
by Clough, Grist and Wheatley (1987); the model is entitled 
WETAFH. It comprises for self-association the monomer- 
dimer—hexamer model of MacLean et al., which includes 
the chemical equilibrium relations, and a model for the 
equilibrium and thermodynamic relations of the 
HF-air-water system. The model shows that in moist air 
an HF-H 2 0 liquid phase will generally form and that in 
some cases as much as 50% of the HF will be in this liquid 
phase. It is assumed that the liquid will be in the form of an 
aerosol. The density of the aerosol would be low, of the order 
of 0.05 kg/m 3 . Provided the droplet size is not too large 
(<20 pm), the aerosol would be expected to persist for sev¬ 
eral hours. The authors give plots of cloud density and 
temperature vs concentration of HF, with relative humidity 
of the air as parameter. 

A model which yields similar information and which is 
incorporated in HFSYSTEM has been described by 
Puttock, MacFarlane, Prothero, Roberts et al. (1991). The 
model is based on that of Schotte. Plots from this model are 
shown in Figure 15.130. This figure gives relative density 
and temperature curves with relative humidity as para¬ 
meter for the mixing of HF and air, both initially at 25°C, 
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thus close to the boiling point of HF. They show that with 
dry air (RH = 0%) the gas cloud remains dense at all con¬ 
centrations, whereas with saturated air (RH = 100%) the 
cloud is slightly buoyant at lower concentrations. 

The effect of liquid present as spray is treated in the 
model given by Chikhliwala and Hague (1987). The authors 
refer to the method of Haddock and Williams for ammonia, 
and adopt a somewhat similar approach. They use the self¬ 
association model of Beckerdite, Powell and Adams and a 
model for the equilibrium and thermodynamic relations of 
the HF vapour-HF liquid system in dry air. Figure 15.131 
gives plots of density and temperature vs the air/HF 
mass ratio with the liquid fraction as the parameter for the 
mixing of HF and air, the initial temperatures of the HF and 
of the air being 292.7 and 293 K, respectively. 


Figure 15.132 gives the parameters for the condition 
where the liquid fraction just evaporates: the density D”, 
the temperature T "and the air/HF mass ratio R*. 


15.43 Dispersion of Dense Gas: Plumes 
from Elevated Sources 

The treatment of dense gas dispersion given so far has been 
largely confined to releases from sources at ground level. It 
is now necessary to consider elevated releases. A review of 
work on the dispersion of an elevated plume of dense gas 
has been given by Ooms and Duijm (1984). 

Inthisandthefollowingsectionanaccountisgivenofsome 
of the principal models for the dispersion of an elevated 




Air/ammonia mass ratio 
(b) 


Figure 15.129 continued 
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Figure 15.129 Temperature and density of an ammonia-air mixture formed by release of ammonia into the atmosphere 
(after Haddock and Williams, 1978 3RD R103): (a) temperature for release into dry air; (b) density for release into dry air: 
and (c) density for release into wet air. (1)f= 20%; (2) f= 16%; (3) f= 12%; (4) f= 8%; (5) f= 4%; (6) f=0, in all three 
plots (Courtesy of the UKAEA Safety and Reliability Directorate) 


release of a dense gas. A further discussion related to safe 
dispersion from reliefs and vents is given in Section 15.48. 

15.43.1 Experimental work 

Experimental work on dispersion of dense gas from an 
elevated source has been mainly by physical modelling. 
Bodurtha (1961,1980,1988), Hoehne and Luce (1970), Hoot, 
Meroney and Peterka (1973), Giesbrecht, Seifert and 
Leuckel (1983), Li XiaoYun, Leidens and Ooms (1986) and 
Schatzmann, Snyder and Lawson (1993) used a wind tunnel; 
Holly and Grace (1972), J.L. Anderson, Parker and Benedict 
(1973), Chu (1975) and Badr (1984) used a water flume. 

Bodurtha (1961) carried out wind tunnel experiments in 
which a photographic record was taken of a Freon 114—air 
mixture made visible with oil-fog smoke released from a 
stack. Measurements taken from the photographs include 
the maximum initial plume rise, distance to touchdown, 
velocity of plume descent and plume radius. Figure 15.133 
shows the effect of the specific gravity of the gas on the 
behaviour of the plume. 

The wind tunnel work of Hoot, Meroney and Peterka 
(1973) yielded data on, and correlations of, the maximum 
initial plume rise, distance to touchdown, and maximum 
concentrations, including those at maximum rise and at 
touchdown. 

Work in the field has been reviewed by Schatzmann, 
Snyder and Lawson (1993). The main data sets are those of 
Bodurtha (1961) and Hoot, Meroney and Peterka (1973). The 
authors comment that the data of Bodurtha do not lend 
themselves to generalization and that those of Hoot, 
Meroney and Peterka are regarded as the most reliable and 
complete. However, the latter set has certain limitations. 
The experiments were performed in a laminar crossflow, 
whereas the real atmosphere is turbulent. The densimetric 
Froude numbers investigated did not cover the whole range 
of interest. The data of Bodurtha (1961) and Li Xiao Yun, 


Leidens and Ooms (1986) are also for laminar crossflow and 
low-to-medium Froude numbers. The work of Giesbrecht, 
Seifert and Leuckel (1983) does cover larger Froude num¬ 
bers, but for quiescent atmospheres. The investigation 
which the authors report extends to a turbulent atmosphere 
and to higher Froude numbers. 

Schatzmann, Snyder and Lawson found that a dense gas 
jet released into a turbulent atmosphere tended, by com¬ 
parison with one released into a laminar atmosphere, to 
have a reduced rise height and an increased touchdown 
distance with lower concentrations both at the point of 
maximum rise and at touchdown. 

The concentration of interest for a toxic release is generally 
much lower than that for a flammable release. The relative 
effect of atmospheric turbulence increases with distance 
from the release point. The authors suggest that, whereas it 
may not be overly conservative to neglect this factor for 
concentrations of interest in respect of their flammability, 
it appears essential to take it into account if a realistic esti¬ 
mate is to be obtained for toxic concentrations. 


15.43.2 Ooms model 

A model for dispersion of a dense gas plume from an elevated 
source which has been widely used is that described by 
Ooms (1972) and Ooms, Mahieu and Zelis (1974). Whereas 
previous models were based on the assumptions that the 
gas is of neutral density and that the plume velocity is 
equal to the wind speed, the Ooms model does not rely 
on these assumptions but gives a more realistic description 
of entrainment into and drag on the plume. 

The model consists of a set of equations for conservation 
of mass, momentum and energy and for air entrainment of 
the general form 


d f* 

dJo 


[15.43.1] 
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(a) 



HF concentration 
(b) 


Figure 15.130 Temperature and density of a hydrogen fluoride- air mixture formed by release of hydrogen fluoride into 
the atmosphere (Puttock, MacFarlane, Prothero, Roberts et al., 1991): (a) temperature for release into air of varying 
humidity; and (b) density for release into air of varying humidity (Courtesy of the American Institute of Chemical Engineers) 


where b is a characteristic width of the plume, r is the 
radius of the plume, s is the distance along the axis of the 
plume, n ,• is a set of functions and fa is a further set of 
functions. 

The functions fa is given by the following relations 
for conservation of total mass, mass of contaminant, 


momentum in the horizontal direction, momentum in the 
vertical direction and energy, respectively: 

fa(ij^pu [15.43.2a] 

mcu [15.43.2b] 
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Air/HF mass ratio 

(a) 



Figure 15.131 Temperature and density of a hydrogen fluoride-air mixture formed by release of hydrogen fluoride 
into the atmosphere -1 (Chikhliwala and Hague, 1987): (a) temperature for release with different liquid fractions; 

(b) density for release with different liquid fractions (Courtesy of the American Institute of Chemical Engineers) 
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Figure 15.132 Temperature arid density of a hydrogen fluoride-air mixture formed by release of hydrogen fluoride into 
the atmosphere - 2 (Chikhliwala and Hague, 1987): parameters for condition where liquid fraction (LF) just evaporates. 
D* density; T, temperature and Ft*, air/HF mass ratio (Courtesy of the American Institute of Chemical Engineers) 




Figure 15.133 Dispersion of dense gas from an elevated relief: wind tunnel tests (Bodurtha, 1961): Full scale conditions: 
stack diameter 610 mm, stack height 30.5 m, wind velocity 1.34 m/s, gas exit velocity 6.1 m/s: (a) gas specific gravity 1 
(air); (b) gas specific gravity 5.15 and (c) gas specific gravity 1.52 (Courtesy of the Air Pollution Control Association) 
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= pu 2 cos 9 [15.43.2c] 

= pw 2 sin 9 [15.43.2d] 

-<*(;-£) i 15 - 43 - 2 *' 

where c is the concentration of the contaminant, u is the 
velocity along the axis of the plume, 9 is the angle between 
the plume axis and the horizontal, p is the density of the 
plume and p ao is the density of the atmosphere at the stack 
outlet. 

The functions i/r,- are functions primarily of velocity and 
density. 

For example, the relation used for the conservation of mass 
draws on the work of Albertson et al. (1950) and Abraham 
(n.d.) for entrainment into a turbulent jet and of Abraham 
(1970) for entrainment into a plume and is 


d f' /2b 

/ pu2nr d r = 2nbp a [ai | u „ (s) | 

+ oc 2 t/ a | sin 9\ cos 9 + a 3 «'] [15.43.3] 


where u' is the entrainment velocity due to atmospheric 
turbulence, t/ a is the mean wind velocity, p a is the density of 


the air and ai, a 2 and a 3 are the entrainment coefficients 
for a free jet, a line thermal and due to turbulence, respec¬ 
tively. The values taken for the constants ai, a 2 and a 3 
are 0.057, 0.5 and 1.0, respectively. The set of equations 
represented by Equation 15.43.1 is integrated with respect 
to 5 numerically. 

The model has been compared with various sets of 
experimental results and gives good agreement for the 
position of the plume axis. The Ooms model has been 
encoded for the US Coast Guard in the computer code 
ONDEK. For determination of the distances within which 
vented hydrocarbon releases may be assumed for design 
purposes to have fallen below the lower flammability limit, 
Ooms, Mahieu and Zelis give the relations shown in Figure 
15.134(a). 

They also give the illustrative example shown in 
Figure 15.134(b) for the discharge of butane from two dif¬ 
ferent sized vents, one giving an exit velocity of 26.5 m/s 
and the other one of 41.5 m/s. For this heavy gas the lower 
outlet velocity leads to a much more rapid descent to ground 
level than does the higher velocity. 


15.43.3 Hoot, Meroney and Peterka model 

Another model is that given by Hoot, Meroney and Peterka 
(1973) (HMP model). This model too has found widespread 
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Figure 15.134 Dispersion of dense gas from an elevated relief: (a) approximate distances for dispersion of hydro¬ 
carbons; (b) dispersion of butane vapour (Ooms, Mahieu and Zelis, 1974) (Courtesy of Elsevier Science Publishers) 
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use. The basic equations of the model are those of 
conservation of mass, of horizontal and vertical momen¬ 
tum and of entrainment, and are as follows: 


d {R 2 p 0 u s ) ^ d (R 2 u s ) 

d(R 2 p 0 u 2 s cos8) _ d{R 2 u s ) 

ds - P * U 1®F"’ 

= aiR\u s - «cos0| + a 2 7?M| si 


d (R 2 u 


[15.43.4] 

[15.43.5] 

[15.43.6] 

[15.43.7] 


15.43.4 Jagger and Edmondson model 

An alternative approach to the modelling of a heavy gas 
plume is that of Jagger and Edmondson (1984), who have 
developed from the basic conservation equations a set of 
asymptotic solutions. The model utilizes the following 
length scales 

- Q 

^ Afl/2 
M 3/i 
^ 5 1 / 2 

MV 2 
Zm ~ U 


[15.43.lf 

[15.43.12] 

[15.43.13] 


where R is radius of the plume, s is the distance along the 
plume axis, u s is the velocity along the plume axis, 8 is the 
angle of the plume axis to the horizontal, p is the density of 
the plume, p a is the density of the air, p Q is the density of the 
outlet gas and oq and a 2 are the entrainment coefficients. 
Values of oq and a 2 from wind tunnel work are 0.09 and 0.9, 
respectively 

The authors divide the plume path into three regions and 
solve the model Equations 15.43.4-15.43.7 analytically in 
each region. The HMP model is then as follows. For the 
initial plume rise 


B 

2b _ m 




[15.43.14] 


[15.43.15] 

[15.43.16] 
15.43.17] 


(-reft 


for the touchdown distance 


2i? 0 [2Rog(p 0 - p a )/p 0 J 




xK/I^oK-pJ/Pa]} 7 [15.43 

and for the maximum concentration on the plume axis 


Co 


<)(- 


2 R 0 


where C is the concentration, h s is the height of the 
stack, Ah is the maximum initial plume rise, u is the wind 
speed, w is the velocity of the plume, x is the downwind 
distance, p is the density of the plume and subscripts a, m, o 
and td denote air, maximum, initial and touchdown, 
respectively. 

The HMP model is one of the models given in the CCPS 
Vapor Cloud Dispersion Model Guidelines and is selected 
for use in the associated Workbook. As an illustration, 
consider the following example given in the Workbook. 
Butane is released from a stack internal diameter 0.75 m and 
height 5 m such that h s = 5 m, R 0 = 0.375 m, u = 5 m/s, 
w Q = 12.7 m/s, p a = 1.16 kg/m 3 and p Q = 2.67 kg/m 3 . The 
resultant values of the initial plume rise, the touchdown dis¬ 
tance and the concentration ratio at the touchdown distance 
are, respectively, Ah = 6 m, x t( j = 57 m and C/Cg = 0.014. 


where B is the initial buoyancy flux (m 4 /s 3 ), g is the accel¬ 
eration due to gravity (m/s 2 ), g' is the reduced gravity 
(m/s 2 ), M is the initial momentum flux (m 4 /s 2 ), Q is the 
initial volumetric flow (m 3 /s), u 0 is the outlet velocity (m/s) 
and U is the wind speed (m/s). 

The length Iq is a function of the source and only influ¬ 
ences flow near the source. / m indicates the point of transi¬ 
tion from momentum to buoyancy control. z m and z B 
indicate the influence of crossflow. For large values of z m 
and zb the jet is essentially vertical, while for small values 
it is bent over. 

The method allows the calculation of the trajectory of the 
vertical co-ordinate z s of the jet or plume axis and, in par¬ 
ticular, of heights for the jet-plume transition and for the 
virtual source of the resultant effective plume. 

For a vertical jet the relations given include: 



[15.43.18] 

[15.43.19] 


where x, y and z are the distances in the downwind, 
crosswind and vertical directions (m), u, v and w are the 
components of the release velocity in the x, y and z direc¬ 
tions (m), z s is the coordinate of the jet axis (m) and the 
subscript cl denotes the centre line. 

Then from Equations 15.43.18 and 15.43.19 the authors 
derive the following relation for the vertical coordinate of 
the axis: 

= Ai ' [15.43.20] 


where Aj is a constant. The value given for the constant 
A 1 is 2.0. 
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For the gas density the authors give 


The model also utilizes a second virtual source, that of 
the plume falling to earth. Use is made of two sets of coor- 

[15.43.21] dinates. The first set is the horizontal and vertical coordi¬ 
nates (x ]e , Zje) of the jet end point. The second set is the 
horizontal and vertical coordinates (x ve ff, z ve ff) of the plume 
virtual source. The second set of coordinates is obtained 
from the first by applying the distance corrections 

[15.43.22] (Ax w Az v ). The following equations apply: 


where 6 is a relative density difference, p is the density, Ci is 
a constant and subscripts a and o denote atmosphere and 
initial gas, respectively. The value given for the constant Ci 
is 2.4. The complete set of asymptotic formulae, and the 
corresponding values of the constants, given by Jagger and 
Edmondson are shown in Table 15.54. 

The model is completed by the following additional 
relations. The maximum rise of the plume with weak 
crossflow is: 


A/3/4 M y2 

max - A 5 Byi R U < 1 

nd in strong crossflow conditions 
„ /Af 2 \ 1/3 M 1 ' 2 T1 


' \BUJ 


C» 1 


[15.43.23] 


[15.43.24] 


where z max is the maximum rise and A 5 and Ag are con¬ 
stants. The value given for constants A 5 ands A 6 is about 
2.0 for each. 

It is convenient from this point for the purposes of 
exposition to introduce several quantities additional to 
those given in the original paper and to use a modified 
notation. 

The distance of the virtual source of the jet below the 
stack outlet is given by 


[15.43.25] 


where d a is the diameter of the stack outlet (m), z TS is the 
distance of the jet virtual source below the stack outlet (m) 
and a is an entrainment coefficient. The value given for a 
is 0.15. 


Zje = 4s — Z V s + Zmax 

Zveff =Zje+Zv 
Xti = + Xyeff 


[15.43.26a] 

[15.43.26b] 

[15.43.26c] 

[15.43.27] 

[15.43.28] 


where c is the concentration of the plume at touchdown 
(v/v), h s is the height of the stack (m), x je is the horizontal 
coordinate of the jet end point (m), x td is the horizontal 
distance from the base of the stack at which touchdown 
occurs, or the touchdown distance (m), xjd is an uncor¬ 
rected touchdown distance (m), is the horizontal dis¬ 
tance between the jet end point and the plume virtual 
source (m), x ve ff is the horizontal coordinate of the plume 
virtual source (m), Zj e is the vertical coordinate of the j et end 
point (m), Az v is the vertical distance between the jet end 
point and the plume virtual source (m), z veff is the vertical 
coordinate of the plume virtual source (m) and <j> is a cor¬ 
rection factor. The coordinates (xj a x Te ff> Zj e , z V eff are mea¬ 
sured from the base of the stack. x veff may assume a 
negative value. 

The correction factor p is introduced to allow for the fact 
that the prior calculation applies to the centre line of the 
plume, whereas the touchdown distance at which a sig¬ 
nificant concentration occurs is that of the edge of the 
plume nearest the base of the stack. An empirical value of 
0.85 is assigned to <j>. 

The application of the model to the case where there is 
wind is to determine by repeated use of the asymptotic 
formulae given in Table 15.54 first the coordinates of the jet 
end point, then those of the plume virtual source and 
finally the touchdown distance and concentration. The 
procedure is illustrated in the example given below. 


Table 15.54 Formulae and constants for asymptotic plume model (after Jagger and Edmondson, 1984) (Courtesy 
of the Institution of Chemical Engineers) 


A Formulae 


Flow type 

Range of validity 

(A) 

(B) 

z s /z m 

(C) 

z s /z B 

(D) 

Mge/UB 


Vertical jet 
Bent-over jet 
Vertical plume 

Bent-over plume 

z s <z B 

z s >z b 


«z m /z s 

fe(Zm/Zs) 

~(z B /z s ) v 

*(Z B /Z S ) 1/2 

A^xjzJ 11 * 
A 2 (x/z m ) v 

A 3 (,xlz B f 14 

A 4 (x/z B f 13 

Ci(zjz s ) 2 

Cz(z m /Zs) Z 

C 3 (zB/z s ) 5/3 (z m /z B ) 2 

C 3 (ZB/Zs) Z (Z m /ZB) 2 


B Constants 

A 4 A 2 


a 3 

a 4 

G 

C 2 

c 3 

c 4 

2.0 2.0 


1.6 

2.0 

2.4 

2.4 

2.4 

3.1 
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There is a separate treatment for calm conditions, or zero 
wind. For this case the method is to determine first the 
maximum rise of the plume. The plume is then envisioned 
as falling from this point to earth so that the plume fall 
distance is 

V = ^-2vs-2max [15.43.29] 


Equation 15.43.29. The touchdown radius b, velocity w, 
ground area A pgr , volumetric flowF pgr and concentration c 
are then determined from Equations 15.32.30—15.43.33. 

Jagger and Edmondson give a set of illustrative exam¬ 
ples of their method, in which they determine the touch¬ 
down distances and concentrations for a release of butane 
fromanelevatedpressurereliefvalve.Thebase conditions are 


where z pf is the plume fall distance (m). The falling plume 
has a radius b and downward velocity w given by 



and covers an area A pgr and has a volumetric flow F pgn 
which are 


Height of vent h s = 30m 
Diameter of outlet d 0 = 0.2 m 
Mass flow of butane = 7.1 kg/s 
Density of butane = 2.54 kg/m 3 

Hence 

Volumetric flow of butane Q = 2.8 m 3 /s 

Initial momentum flux M = 255.6 m 4 /s 2 

Initial buoyancy flux B = 27.8 m 4 /s 3 

Distance below outlet of jet virtual source z TS = 0.7 m 


A pgr = ^ S 2 [15.43.32a] 

F pgr = «/A pgr [15.43.32b] 

where A pgr is the ground area centring on the base of the 
stack covered by the falling plume (m 2 ), b is the radius of 
the plume (m), K gr is the volumetric flow of the plume at 
ground level (m 3 /s) and w is the vertical downwards velocity 
of the plume (m/s).The concentration is then obtained from 

c = Q/Fpgr [15.43.33] 

The application of the model where there is a wind is as 
follows. The fluxes M and B, the wind speed U and the 
length scales Z m , Z Q , z B and z m are determined. The maxi¬ 
mum height of the plume 2 max is then obtained from Equa¬ 
tion 15.43.24. The distance z vs of the jet virtual source below 
the outlet is calculated from Equation 15.43.25. 

The procedure involves first the determination of coor¬ 
dinates (Xj e , Zj e ). The coordinate Zj e is obtained from Equa¬ 
tion 15.43.26a and the coordinate x je from the relation given 
inTable 15.54 for a bent-over jet z s /z m = A2(x/2 m ) 1/l3 , setting 
2 g = z max and x = Xj e . Next, an estimate is made of the dis¬ 
tances (Ax„ A2 v ). The first step is to obtain from the relation 
given in Table 15.54 for a bent-over jet the group 
Mgd/UB = (z m /z s ) 2 , setting z s = z max . Then the distance 
Az v is determined from the relation inTable 15.54 for a bent- 
over jet MgO/UB = Ci{z B /z s f{z m /z B ) 2 , setting z s = Az v . 
The distance Ax v is calculated from the relation in Table 
15.54 for a bent-over plume zJz B = A 4 (x/z B ) z/3 setting 
2 S = Az v and x = Ax,. The coordinates (x ve ff, 2 ve ff) are then 
obtained from Equations 15.43.26b and 15.43.26c. 

For the touchdown conditions, the uncorrected touch¬ 
down distancex/d is obtained from the relation inTable 15.54 
for a bent-over plume zJz B = A 4 (x/2 B ) 2/3 , setting z s = 2 veff 
and x = Xt' d . The corrected touchdown distance x td is 
then calculated from Equation 15.43.27. The touchdown 
concentration is obtained from the relation in Table 15.54 
forabent-overplumeAfgd/f/H = C 4 (z B /2 s ) 2 (2 m /2 B ) z , setting 
2 S = veff, which gives the relative density difference 8. 
For low concentrations the relation between the relative 
density difference 9 and the volumetric concentration c is 
c«[0(p o -p a )Pa]- 

For the case of calm conditions the model is applied as 
follows. The maximum rise of the plume 2 max is obtained 
from Equation 15.43.23 and the plume fall distance from 


Cases considered are calm conditions and wind speeds of 2 
and 4 m/s. For these cases: 




Wind speed (m/s) 


0 

2 

4 

Iq 

0.18 

0.18 

0.18 

Ib 

12.1 

12.1 

12.1 



8.0 

4.0 

Zb 


3.5 

0.4 


For the case of a wind speed of 2 m/s, the method described 
yields 

z max = 20.6 m 

x je = 17.1m; 2 je = 49.9 m 

Mgd/UB = 0.36 

Ax v = 21.5 m;A2 v = 23.5 m 

x ve ff = -4.4m;z veff = 73.4 m 

x td = 118.8 m;x td = 96.6 m 

8 = 8.2 x 10“ 4 

c(«20) = 0.00164v/v = 0.164% v/v 
For the case of calm conditions 

2max = 24.4 m 
2 pf = 53.7 m 

b = 9.7 m; A pgr = 296m 2 
w = 1.56 m/s; F= 462 m 3 /s 
c m 0.0061 v/v = 0.061%v/v 

The touchdown conditions obtained for all three cases are: 



Wind speed (m/s) 


0 2 4 

Touchdown distance 
(from stack base) (m) 
Touchdown concentration 
(v/v) 

0 96.6 239 

0.0061 0.0016 0.0011 


(These values differ from those given in the original paper 
but have been checked with one of the authors (S.F.J.)). 
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15.43.5 Emerson models 

Another model is that given by Emerson (1986a). The model 
is a modification of the Ooms model already described. The 
Emerson model differs from the Ooms model in several 
ways. One is that, whereas in the Ooms model the vertical 
component of the axial velocity tends to a constant value, in 
the Emerson model it is multiplied by the Gaussian term 
and therefore tends to zero. This obviates the need for the 
use of mb as the limit of integration. Another difference is 
in the selection of a more appropriate mass flow. This avoids 
problems with situations where the jet emission is in the 
upwind direction. The Emerson model is the basis of the 
computer codeTECJET (Technica, 1987). 

Emerson (1986b, 1989) has also given a further, separate 
model for a jet of dense gas undergoing transition to, and 
then dispersing as, a dense gas cloud. As already descri¬ 
bed, models for dense gas dispersion are sensitive to the 
source term used. It is the object of this model to provide an 
improved source term where the release occurs due to a jet, 
which is the usual situation. 

The dispersion of the gas is assumed to occur in three 
phases, as shown in Figure 15.135. The first phase is a 
momentum jet, the second phase is a hybrid one in which 
slumping and transition occur and the third phase is a 
dense gas cloud. A box model approach is used in which the 
dimensions of the gas cloud are calculated and concentra¬ 
tion within this envelope is assumed to be constant. 

For the momentum jet phase Emerson quotes the work of 
Ricou and Spalding for the entrainment of air with distance 
along the jet axis and gives for a jet in still conditions the 
relation 

Q a = h{pJ 0 ) V2 [15.43.34] 

where I a is the momentum flux, Q a is the entrainment flow 
and ki is a constant. The value of the constant h is 0.282. 
Equation 15.43.34 is equivalent to Equation 15.20.13a of 
Ricou and Spalding. 

Then, for a jet in windy conditions, Emerson assumes 
that Equation 15.43.34 can be modified to read 

Q a = %(Pa4) 1/Z [15.43.35] 


where I 0 is now the excess momentum flux, « w is the wind 
speed and v is the velocity of the gas in the jet. 

The jet is assumed to have a square cross-section. The 
rate of lateral growth is determined solely by the entrain¬ 
ment of air into the cloud. Transition to the second phase 
occurs when this rate of spreading falls below that which 
would occur due to gravitational slumping. 

The second, hybrid phase combines features of both the 
preceding and the succeeding phases. It is assumed that 
the rate of air entrainment is as in the previous stage, but 
the rate of lateral spreading is based on dense gas beha¬ 
viour. The relation used is 

^=(k 2g Hp/p) 1 ' 2 [15.43.36] 

where H is the height of the cloud, R is the half-width of the 
cloud, p is the density of the cloud, A p is the density dif¬ 
ference between the cloud and the air and k 2 is a constant. 
The value of the constant k 2 is approximately unity. The 
height of the cloud in this second phase is obtained from the 
mass of air entrained in the jet and the resulting necessary 
cross-section. 

In the third phase the dispersion is that of a dense gas 
cloud. This is described using the model of R.A. Cox and 
Carpenter (1980). 


15.43.6 Woodward model 

J.L. Woodward (1989a) has given a model for a release 
from an elevated source of a two-phase flashing fluid of 
pressurized liquefied gas, forming a jet of vapour and 
liquid droplets. The model is derived from that of Ooms, 
Mahieu and Zelis. The model is the basis of the computer 
codeEJET. 


15.43.7 Other models 

There are several other models for dispersion of an elevated 
release of a dense gas. The Environmental Protection 
Agency (EPA) (1989a) has developed a relief valve screen¬ 
ing model. Other models include those by Giesbrecht, 
Seifert and Leuckel (1983) and Havens and Spicer (1985). 


'Hybrid' model 



Figure 15.135 Emerson model for dispersion of dense gas from elevated jets and plumes - idealized cloud shape 
(Emerson, 1986a) (Courtesy of the Clarendon Press) 
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15.43.8 Criterion for dense gas dispersion 

A criterion for deciding whether a dense gas treatment 
is necessary has been given by Fay and Zemba (1986) as 
follows: 


Rio»l 



where D is the diameter, w is the velocity of the plume, p is 
the density of the plume and the subscripts a and o denote 
air and initial, respectively. This criterion is adopted in 
the CCPS Vapor Cloud Dispersion Model Guidelines. 


15.44 Dispersion of Dense Gas: Plumes from 
Elevated Sources PLUME 

A model for dispersion from a jet or plume has been devel¬ 
oped by Shell as part of the HGSYSTEM package. This 
model, PLUME, is one of the front-end models for the main 
dispersion model, HEGADAS. It has been described by 
McFarlane (1991). PLUME is a generalization of a more 
specific model HFPLUME developed for the dispersion of 
hydrogen fluoride. 

15.44.1 Plume development 

The scenario modelled is that of a jet or plume issuing along 
the direction of the wind at an inclination to the horizontal. 
The plume is treated as passing through three stages: 

(1) airborne plume; 

(2) touchdown plume; 

(3) slumping plume. 

The plume geometry, coordinate system and control 
volume are shown in Figure 15.136. 

The cross-section of the airborne plume is assumed to be 
circular. The touchdown regime starts when the circum¬ 
ference of the airborne plume touches the ground and it 
ends when the cross-section of the plume has become semi¬ 
circular. The slumping regime then begins and the cross- 
section becomes elliptical. 

The coordinate system used is as follows. For the air¬ 
borne plume the angle of inclination of the axis is p, and the 
distance along the axis s and a point on the cross-section of 
that plume is given by the polar coordinates r and 9. For the 
plume in all regimes the centroid of the plume is located at 
distances x and z from the sources in the horizontal, vertical 
directions. For the touchdown and slumped plumes the 
height of the centre of the plume is z c . 

The core of the model is a complex set of integral equa¬ 
tions which are then simplified to the sets of equations for 
the three regimes given below. 

15.44.2 Airborne plume 

The model for the airborne plume consists of the following 
set of six differential equations: 

^ = Entr [15.44.1] 





[15.44.3] 

[15.44.4] 

[15.44.5] 

[15.44.6] 


where e x is a unit vector in the horizontal, wind aligned 
direction, e z is a unit vector in the vertical direction, E is the 
excess energy flux, m is the mass flux, P x is the excess 
horizontal momentum flux, P z is the excess vertical 
momentum flux and s is the distance along the axis of the 
plume. 

The term ‘Buoy’ is the section averaged buoyancy 
force in the plume; ‘Drag’ is the drag force acting on 
the plume as a result of vortex formation in the plume 
wake; ‘Ener’ is the change in energy in the plume resulting 
from vertical gradients of temperature and wind speed; 
‘Entr’ is the entrainment rate for unit distance along 
the plume axis; and ‘Shear’ is the shear force associated 
with the vertical gradient of wind speed. Supplementary 
equations used are 


[15.44.7] 


m=Apu [15.44.8] 

m g = Acu [15.44.9] 

P x = m(u cos p-u x ) [15.44.10] 

P z = musmp [15.44.11J 

Smm^h + l^j - (a»+Ji&)] [15.44.12] 


where A is the cross-sectional area of the plume, c is the 
concentration (mass per unit volume), D is the diameter of 
the plume, h is the specific enthalpy, p is the density, u is 
the mean flow velocity and subscripts g and oc denote 
material released and ambient conditions at centroid 
height, respectively. 

15.44.3 Touchdown plume 

Touchdown occurs when the plume envelope first touches 
the ground. The plume cross-section is then modelled as a 
circular segment, the centroid of which falls until the cross- 
section becomes a semi-circle, at which point the touch¬ 
down regime ends. 

The model for the touchdown plume also consists of a set 
of six differential equations. These are Equations 15.44.1, 
15.44.2 and 15.44.4-15.44.6 with: 


' f = Drag ■ e z + Buoy + Foot [15.44.13] 

where ‘Foot’ is a reactive pressure force function. 

Supplementary equations used are Equations 15.44.8— 
15.44.12 and 


[15.44.2] A ~T [ C0S ~ r, ^ V2 \ 


[15.44.14] 



EMISSION AND DISPERSION 15/267 



centroid 

(axis) 



x zone establishment 


Figure 15.136 PLUME model for dispersion of dense gas from elevated jets and plumes: plume geometry, coordinate 
system and control volume (McFarlane, 1991) (Courtesy of the American Institute of Chemical Engineers) 
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* c ^i (i 


2z 

n " />|cos-0] 
2z c 


15.44.lo 

[15.44.16] 

[15.44.17] : 


where ?/ is a parameter and subscript c denotes centre. 


15.44.4 Slumped plume 

The model for the slumped plume consists of the same set 
of six differential equations as for the touchdown plume. 
Supplementary equations used are Equations 
15.44.8-15.44.12 and 





[15.44.18] 

[15.44.19] 


where D is the length of the major axis of the ellipse and 
e is the eccentricity of the ellipse. 


15.44.5 Buoyancy, shear and energy functions 

For the airborne plume the buoyancy function ‘Buoy’ is 

Buoy = A(p - p g )g [15.44.20] 

This relation is valid, for expansion about the plume cen¬ 
troid, for the touchdown and slumped plume regimes also. 
The shear function‘Shear’ is 

Shear = m sin cj >^ [15.44.21] 

for all three regimes. The energy function ‘Ener’ is 

Ener = WS in /^ +1 ^ + ^ [15-44.22] 

15.44.6 Drag and pressure force functions 

For the airborne plume the drag is airborne drag, which is 
not considered significant, and the drag function ‘Drag’ is 
taken as zero. For the touchdown and for the slumped 
plume there is a ground surface drag, which is significant. 
For these latter regimes the drag function ‘Drag’ is 

Drag = lp x i% [(p/p 0O ) 1/2 («/« 0 o) cos 0 - 1 

x [(p/Poo) 1/2 («/«oo) cos0 + l] 

where l is the width of the ‘footprint’ of the plume and u t is 
the friction velocity. 

The value of the pressure force function ‘Foot’ is gov¬ 
erned by the behaviour of the gravity current. At some 
point in the slumping regime the gravity current collapses. 
Before the point of collapse the spreading rate and the cor¬ 
responding value of ‘Foot’ are 


[15.44.23] 


2 ^ = (*/«) W - Poo/P)] 172 [15.44.24] 


where k is the slumping coefficient. The value of k is taken 
as 1.15. 

The criterion of collapse and the spreading rate after 
collapse are 

(pJpf\D/h) > -- [15.44.26] 

V 00 ' ' V ' ’ 3 K (Ri,) 1/2 C(Ri,) 

- jft&M [15 44 271 

2 ds 3KC D «DRi,0(Ri») L J 

<b(Ri») =- 1 -^ Ri, < 0 [15.44.28a] 

V ; (1 - 3Ri,/5) 1/2 1 J 

* 1 0 < Ri„< 189/80 [15.44.28b] 

* (10/17) max [Rh/7, (1 + 4Ri„/5) 1/2 ] 


ul 


i) 


[15.44.28c] 

[15.44.29] 


where h is the plume height, Ri» is a bulk Richardson num¬ 
ber, k is the von Karman constant and d>(Ri») is a heavy gas 
entrainment function. The value of ‘Foot’ after collapse is 


Foot= © 

3kQ> 

m*r 


[15.44.30] 

for 




{pJp) V \D/z) 


1024 

15.44.31] 

(97t 2 )(Ri i ) 1/2 0(Ri,) 

with 




R . _ 2gz(p/p a 

o-l) 


[15.44.32; 

where Cd is an 

empirical spreading coefficient. The value 


of Cd is taken as 5.0. 


15.44.7 Entrainment function 

The entrainment function Entr is, in principle, the sum of 
the following entrainment mechanisms: jet entrainment, 
crosswind entrainment, gravity slumping entrainment, 
passive entrainment and heavy gas entrainment. The jet 
entrainment function Entr jet is 

Entrj et = ejetrjpLtsp^u - u x cos cj>\ [15.44.33] 


_ l + (4/3)(p/ Pco -l) 
% ■|'4-(5/3)(p/p O0 -l) 


[15.44.34] 


where e jet is an entrainment coefficient and Lf S is the 
Monin-Obukhov length for a free surface, this latter being 
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the surface not bounded by the ground. The value of e jet is 
taken as 0.08. 

The crosswind entrainment function Entr cw is 
Entr = e aiCT riL [s p 00 u 00 (u 00 /u)V 2 \ sin0| [15.44.35a] 

r\ p = 1 + e p , C r max[0, {p/ Poo - 1) sin #\ [15.44.35b] 

where e UiCr and are e pcr coefficients and ri p is a parameter. 
The values of e UiCI and e PiCI are 0.6 and 7.5, respectively. 

The gravity slumping entrainment function Entr gs is, 
for the touchdown plume 

I 15 "' 36 ' 

and for the slumped plume 


Entr gs = e gsPoo zu\ cos=- [15.44.37] 


where e at is a coefficient, l y and 4 are the turbulent length 
scales in the horizontal and vertical directions, L is the 
Monin—Obukhov length, T gI is the temperature of the 
ground, uj'* is the ground-air heatflux.eis the dissipation 
rate of turbulent kinetic energy and is a parameter. The 
value of « at is 1.0. The heavy gas entrainment Entr hg is 

Entrhg = [15.44.44] 

with <I>(Ri„) given by Equations 15.44.28 and 15.44.29, but 
with z substituted for h in the latter. 

The jet entrainment and heavy gas entrainment each 
modify the level of turbulence and are not independent 
mechanisms. The combined contribution of these two 
effects is taken as the greater of the each of the two effects 
considered separately. Further, the contribution of each of 
the two effects is taken as proportional to the value of that 
effect divided by the sum of the values of the two effects. 
The passive entrainment and gravity slumping entrain¬ 
ment constitute another pair which interact and which are 
treated in a similar manner. 


where e gs is a coefficient. A value of 0.85 is given for e gs , but 
with some qualification. 

The passive entrainment Entr at due to atmospheric 
turbulence is 

Entr at = - l/pTOatPo. e 1/3 0y i/3 + 4 4/3 ) [15.44.38] 


15.44.8 Atmospheric model 

The plume behaviour is a function of the atmospheric con¬ 
ditions, and an atmospheric model is defined which 
includes the wind speed and temperature profiles and the 
Monin—Obukhov length. The wind speed profile is 

[15-44.45] 


4 = min[D/2,0.88(z + z„)(l - 7.4 k£/(1 - 5*0] 

Stability categories A—C [15.44.39a] 


= min[D/2,0.88(z + z o )] 

Stability category D [15.44.39b] 


■m min[D/2,0.88(z + z„) (1 + 0.10] 

Stability categories E and F 
4 = min[D/2,0.88(z + z„)(1 - 7.4*£/(l - 5/cQ] 
Stability categories A-C 

= min[D/2,0.88(z + z o )] 

Stability category D 
= min [D/2,0.88(z + z„)/(l + 40] 

Stability categories E and F 

e = (l-5K0u 3 J[K(z + z o )\ 

Stability categories A-C 
m^/[ K (z+z 0 )] 

Stability category D 

■m (1 + 4k)k^/[jc(z + z 0 )] 

Stability categories E and F 

‘-'-P 

K(g/T gI /u,T *) 


[15.44.39c] 

[15.44.40a] 

[15.44.40b] 

[15.44.40c] 

[15.44.41b] 

[15.44.41c] 

[15.44.42] 

[15.44.43] 


^ u (0 = (1 — 220“ 1/4 C<0 [15.44.46a] 

t=l + 6.9f C> 0 [15.44.46b] 

The temperature profile is 

K( y° )dr r* =[is - 44 - 4 ^ 


^ T (0 = (1 - 13f) 1/z C< o [15.44.48a] 

l vlll + 9.2£ C>0 [15.44.48b] 

where the subscript pot denotes potential. The Monin- 
Obukhov length is 

D= -10.992 o 00 " 3 
.p -13.44z„ 01631 
* -113.5z 0 °' 2946 

:ss 125z 0 °' 3090 
» 26.12z 0 ° 1667 


Stability category A J|5.44.49a] 

Stability category B [15.44.49b[ 

Stability category C [15.44.49c] 

Stability category D [15.44.49d] 

Stability category E [15.44.49e] 

Stability category F [15.44.49f] 


15.45 Concentration and Concentration Fluctuations 

The account of gas dispersion given so far has touched only 
lightly on the question of concentration and concentration 
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fluctuations and has dealt mainly with average 
concentration. It is now necessary to go into this more deeply. 

Concentration fluctuations are relevant both to flam¬ 
mable and toxic gas releases. For flammable gas clouds, 
fluctuations may cause the gas concentration equivalent to 
the lower flammability limit to reach further than the 
boundary given by the mean value. For a toxic gas cloud, 
fluctuations may result in toxic effects associated with 
concentrations higher than the mean value. 

Accounts of concentration fluctuations have been given 
by a number of authors, including Gosline (1952), Gifford 
(1960b), Long (1963), Slade (1968), Barry (1971), Ramsdell 
and Hinds (1971), Csanady (1973), Chatwin (1982b), C.D. 
Jones (1983), S.R. Hanna (1984), Ride (1984a,b) and J.K.W. 
Davies (1987,1989). 

It is convenient to deal primarily with the concentration 
in a plume from a continuous release, but that in a cloud 
from an instantaneous release is also considered. 

15.45.1 Experimenlal studies and empirical features 

It has been shown in experiments on plumes from a con¬ 
tinuous point source by a number of workers that the 
instantaneous concentration measured at a fixed point 
fluctuates about the mean value and that the ratio of the 
maximum instantaneous value to the time mean value, or 
peak-to-mean ratio, can be quite large. 

An account of experimental work on the peak-to-mean 
( P/M ) ratio has been given by Gifford (1960b). He describes 
the results obtained by six previous workers. The ratio of 
the peak concentration P to the mean concentration M, or 
P/M, is a function of the ratio of the corresponding sam¬ 
pling times / p and / m from which these concentrations are 


derived. As shown in Figure 15.137 the P/M ratio tends to 
increase with increase in f m /f p , or decrease in t p /t m . 

As Figure 15.137 indicates, the P/M ratio measured at 
ground level is appreciably greater for an elevated source 
than for one at ground level. This is illustrated also in 
Figure 15.138, which gives P/M as a function of distance. 
Gifford states that for measurements at ground level P/M 
can be expected to be about 1-5 for a ground level source 
but as much as 50—100 for an elevated source. Work by 
Ramsdell and Hinds (1971) has shown that the P/M ratio 
tends to be greater off the centre line. 

Other workers have measured the proportion of time for 
which the concentration at a point is zero, or the inter- 
mittency. Work on concentrations in a plume by C.D. Jones 
(1983) has shown that the levels of intermittency can be 
very high, some 80—90%, with P/M ratios in the range 
30-150. 

Physical modelling using wind tunnels makes it possible 
to perform repeated experiments at the same nominal 
conditions. Figure 15.109(e) shows an ensemble of 21 
concentration vs time profiles obtained by D.J. Hall, Hollis 
and Ishaq (1982) in wind tunnel work at Warren Spring 
Laboratory (WSL). The variability from one run to another 
is pronounced. 

The intensity of the concentration fluctuations, defined 
below, is another widely used measure. An intensity value 
of zero corresponds to zero fluctuation. Figure 15.139 shows 
intensities obtained in wind tunnel work by Meroney and 
Lohmeyer (1984). 

Such concentration fluctuations are not limited to gas 
clouds. Birch, Brown and Dodson (1980,1981) have found 
large fluctuations in jets. 



P/M 


Figure 15.137 Concentration fluctuations in a meandering plume: effect of mean sampling time t m and peak sampling 
time t p on the peak-to-mean concentration (Gifford, 1960b) (Courtesy of Pergamon Press) 
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Figure 15.138 Concentration fluctuations in a meandering plume: effect of distance (Gifford, 1960b) (Courtesy of 
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Figure 15.139 Concentration fluctuations in gas dispersion-concentration fluctuation intensities measured in a wind 
tunnel (Meroney and Lohmeyer, 1984). Different symbols represent different release volumes, each being the result of at 
least five runs; I, intensity, L 0 volume released; x, downstream distance (Courtesy of Kiuwer Academic Publishers) 


15.45.2 Causes of concentration fluctuation 

Fluctuations of concentration have a number of causes. 
One of these is meandering of the plume due to the varia¬ 
bility of wind direction. But even without meander, con¬ 
centration fluctuations occur due to the normal effects of 
turbulence. 


15.45.3 Measures of concentration fluctuation 

Concentration fluctuation may be characterized in a num¬ 
ber of ways. These include 

(1) peak-to-mean ratio; 

(2) intermittency; 
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(3) intensity; 

(4) distributional properties. 

The peak-to-mean ratio is the ratio of the maximum 
instantaneous concentration to the time mean value: 


where 7j is the integral time scale. They give forTj a typical 
value of 10 s. 

Other approaches have been used as described by 
D.J. Wilson (1991a). 


P 

M 


Gnax 

c 


[15.45.1] 


where C is the time mean concentration and C max is the 
maximum instantaneous concentration. 

Csanady (1973) introduced the concept of intermittency. 
The intermittency of concentration fluctuations, or simply 
intermittency, is the proportion of time during which the 
concentration is non-zero: 


[15.45.2] 


where t p is the time during which the concentration is zero, 
4 is the total sampling time and y the intermittency. It 
should be noted that some authors define intermittency as 
the proportion of time during which the concentration is 
zero (i.e., the complement of the definition just given). 

Two important statistical parameters of the concentra¬ 
tion are the mean and the variance: 


Mean: p = C 

Instantaneous deviation: c = C—C 
Standard deviation: cr = (c 2 ) 1 ^ 2 

The relative intensity i of concentration fluctuations, or 
simply intensity, is the ratio of the standard deviation to the 
mean of the concentration: 


15.45.5 Models for concentration fluctuation 

Most of the approaches used to model dispersion may also 
be applied to the modelling of concentration fluctuations. A 
review by S.R. Hanna (1984) describes Gaussian, gradient 
transfer, similarity, meandering plume and distribution 
function models. 


15.45.6 Distribution function for concentration 

The form of the distribution function of the instantaneous 
concentrations at a fixed point in a passive plume has been 
studied by several workers, including Barry (1971) and 
Csanady (1973). 

As described above, since concentration is zero for a 
proportion of the time, Csanady introduced the concept of 
intermittency. The intermittency is close to unity on the 
centre line of the plume and to zero at the cloud edges. 

Csanady adduces theoretical arguments that the dis¬ 
tribution function for the non-zero concentrations should 
be log-normal. He also obtains the log-normal distribu¬ 
tion for experimental results given by several authors. 
Figure 15.140 shows his plot of Gosline’s results on log- 
probability paper, confirming the log-normal form for the 
concentration distribution. 

Barry (1971) has found that the following exponential 
relation gives a good fit to experimental results: 

F(C)=P(0)exp(-F(0)£) [15.45.6] 


where P{ 0) and P(Q are the probabilities that the con- 
[15.45.3] centration exceeds 0 and C, respectively, and C and M are 


The distributional properties are the distribution, and its 
parameters, which best describe the concentration fluc¬ 
tuations. The distribution most favoured is the log-normal 
distribution, which is characterized by the mean and log 
standard deviation. Alternatively, the mode may be used 
instead of the mean. 

15.45.4 Time mean concenlration 

As discussed in Section 15.16, the mean concentration 
obtained by averaging over a particular sampling interval 
is a function of that interval. The correction used by D.B. 
Turner (1970) for this effect is 



where C is the concentration, t is the sampling time inter¬ 
val, p is an index and subscript r denotes reference. The 
value of p is between 0.17 and 0.2 where the sampling 
reference time 4 is of the order of 10 min and the other 
sampling time t is up to 2 h. 

Another approach is that described by the CCPS (1987/2). 
On certain assumptions it can be shown that 



Figure 15.140 Concentration fluctuations in a mean¬ 
dering plume: distribution function of concentrations 
(Csanady, 1973) (Courtesy of Reidel Publishing Company) 
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the concentrations averaged over the peak sampling time t p 
and the total sampling time / m , respectively. 

The form of the distribution function for concentration 
is also an issue in the work of Wilson, of Chatwin and of 
Davies, as described below. 

15.45.7 Peak-to-mean concentration models 

The distribution functions just described may be used as 
the basis for models of the peak-to-mean ratio. 

Barry (1971) points out that the peak-to-mean ratio is 
simply a special case of the ratio of any short-lived con¬ 
centration. By definition, the peak concentration is that 
which occurs only once. Hence the probability P(P) of the 
peak value is 

P(P) = fe/An I 15 - 45 - 7 ! 

But from Equation 15.45.6 

P(P)=P(0)expf-P(0)£) [15.45.8] 

Then from equations 15.45.7 and 15.45.8 


where C med is the median concentration and a is the 
logarithmic standard deviation. The mean concentration 
C m is then 

C^fcgdC [15.45.12a] 

= O ned exp( ( r?/2) [15.45.12b] 

Then from Equation 15.45.11 the probability P( = l— F) 
that a given peak concentration will not be exceeded is 

P = 1 _l| 1 + erf[M|^)]} [15.45.13] 

and hence the peak concentration C p is 

Cp = CWd exp [gVVierT^l - 2P)] [15.45.14] 

Then from Equations 15.45.12b and 15.45.14 


P_ 

M 




[15.45.9] ^ = ex P [^Verr 1 (1 - 2P) - 


[15.45.15a] 


Csanady gives the following approximate treatment of the 
case where the intermittency factor is unity and the con¬ 
centration distribution is log-normal. This restriction on 
the intermittency factor implies that the plume does not 
meander. The probability density function of the con¬ 
centration dF/dC is 


dP 

dC 


[15.45.10] 


and the probability distribution function P is then 


J MC/cw 

L pSi' 


[15.45.11] 


[15.45.15b] 

15.45.8 Gifford meandering plume model 

As stated above, concentration fluctuations in a passive 
plume are due partly to turbulent movements and partly to 
meandering. The effect of these two influences is shown in 
Figure 15.141. 

A model for a meandering plume has been given by 
Gifford (1960b). The basis of the model is Equation 15.16.41 
for a release Q from a continuous point source at ground 
level. He treats the dispersion variance a 2 as the sum of two 
parts: Y 2 , the variance attributable to the fluctuations 
about the instantaneous centre line; and the variance 



Figure 15.141 Concentration fluctuations in a meandering plume: effect of combination of meandering and of turbulence 
(Slade, 1968) 
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attributable to the meandering. Similarly, the variance is 
taken as the sum of the fluctuation variance z 2 and the 
meandering variance 


But, at large distances, D 2 approaches a constant value, 
whereas Y 2 continues to grow, and hence 


^ = Y 2 +L§ 


|5.45.16a] 
[15.45.16b] 
n concentration is then 


27tu(Y 2 + D'f) 7 [Z 2 + D 2 ) 1/2 

\ _ y _ * j j 

\2{Y 2 +D^ + 

and the instantaneous concentration to he 


\{y-D y f (g-A) 2 !] 
[ 2Y 2 ^ 2Z 2 J J 


The peak value of the instantaneous concentration % p 
occurs at a point on the centre line of the instantaneous 
plume (y =D y ,z = D z ), and hence 



1 22 n 

[ [ 2 ( 72 +^) 

2 (Z 2 +£f)J J 


At ground level on the centre line (y — z m 0) 

Xp ... ( y2+ ^) 1/2 ( z2+ ^) V2 
7m (F 2 Z 2 ) 1/2 


If conditions are such that 
Y 2 =Z 2 

n$=n% = D? 
then 

p _ Y 2 +ti i 

W 


[15.45.20a] 

[15.45.20b] 

[15.45.21a] 

[15.45.21b] 

[15.45.22a] 

[15.45.22b] 


M 


[15.45.2; 


15.45.9 Ride model 

A model for the intermittency effect in a passive plume has 
been given by Ride (1984b). The model envisages the cloud 
as a number of spheres of equal size and uniform con¬ 
centration in a matrix with zero concentration between the 
spheres. It can be shown that the peak-to-mean concentra¬ 
tion is 


C 1-7 l • • J 

and that 

T «©’ +1 I 15 - 45 ' 2 * 

where C* is the concentration in the sphere, C is the true 
mean concentration, y is the intermittency and a is the 
standard deviation of the instantaneous concentration. 
This author defines intermittency as the proportion of time 
the concentration is below a specified value. 

If the maximum concentration which can occur oyer time 
t is C T , the peak-to-mean ratio for this time is CJC. In the 
limit, C t tends to C* as r tends to zero and to C as t tends to 
infinity. The intermittency is then y x . 

Equation 15.45.25 holds for spheres of uniform size. 
Rodean (1982) has derived the more general relation 


where k is a coi 
From the for 

Me)>- 

c c v 


[15.45.28] 

[15.45.29] 


where /? is a constant. From the data of C.D. Jones (1983), 
Ride (1984b) assigns the values: k = 11, X = 1.5 and 
JJ = 0.4x. where x is the downwind distance. He gives for CJ 
C a comparison of predicted values with observations made 
at short ranges by Jones. 

In a further treatment, Ride (1984a) omits the factor i/^, 
equivalent to setting = 1. 

15.45.10 Wilson model 

A model for the intensity of concentration fluctuations in a 
passive plume has been given by D.J. Wilson (1982). The 
concentration fluctuation d is defined as 


[15.45.30] 
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where c is the concentration, d is the concentration 
fluctuation about the mean and c is the mean concentra¬ 
tion. The concentration variance is ? 2 . 

The model is based on the Gaussian description of a 


where d is the diameter of the source, H is the height of the 
neutrally stable atmospheric boundary layer, z e is a scale 
height, A is the normalized downwind distance and X 0 is the 
virtual origin of the variance source. The value of H is 
taken as 650 m. The intensity i is defined as 


[15.45.31] 


[15.45.42] 




Hence from Equations 15.45.31-15.45.36 and 15.45.42 




[15.45.32] 


[15.45.33] 


where F m is a height correction, G m is a crosswind distance 
correction, h is the height of the source, Q is the mass rate 
of release and u c is the advection velocity of the plume. 

From the work of D.J. Wilson, Robins and Fackrell (1982), 
the concept of a variance source strength q is introduced 


*-{zsh£) c ' F ’ |15 - 45 - 341 

[15.45.35] 


F w 

ky 


[ 1 fz-hy\ 2 ' 

1 r i fz+K\ 2 ] 


]-“ exp [-2hr)J 


[15.45.36] 

h\ 2 1 1/2 


s) + *1 

[15.45.37] 


where F v is a height correction, G v is a crosswind distance 
correction, hy is the effective height of the variance source, 
q is the variance source strength, a is the sink strength 
factor and is a location parameter for the variance source. 
The value of the parameter $ is 0.706. The variance source 
strength is given by the relation 


q _ 0.382 

Q~"a z + aI 


[15.45.38] 


■ (l\(G v F y f 2 
\QJ G m F m 


[15.45.43] 


The intensity just derived is the total intensity. Use is also 
made of the conditional intensity ip based on the time when 
the concentration is non-zero. 

A corresponding set of conditional concentrations is 
defined 


[15.45.44] 


where is the conditional concentration fluctuation about 
the mean, c p is the conditional mean concentration and 
subscript p refers to the time when the concentration is non¬ 
zero. The conditional concentration variance is d£. The 
conditional intensity i p is 



[15.45.45] 


The ratio of the mean concentration to the conditional 
mean concentration is the intermittency y 


This author defines intermittency as the proportion of time 
the concentration is non-zero. Then from Equations 
15.45.42 and 15.45.44-15.45.46 



[15.45.47J 

[15.45.48] 


On certain assumptions it can be shown that the condi¬ 
tional intensity ip is given by 


. [1 -aexp(—2/iyZ/of)] 1 ^ 
[l 4- exp(—2fe/ tr|) ] ' 


[15.45.49] 


0.119d 
0.033z e -l- d 


>[-(?)! 


[15.45.39] 

[15.45.40] 

[15.45.41] 


with 

ipoo = ^exp(-0 2 /4) 

% _ 0-38A 

Q ~1®+(0.U9) 2 


[15.45.50] 

[15.45.51] 
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where i poo is the conditional intensity on the centre line 
with negligible surface interaction and q p is the conditional 
variance source strength. The value of a is taken as 0.6. The 
results are sensitive to the value used for a. 

From Equation 15.45.47 the intermittency y is 

[15.45.52] 

The probability of exceeding a particular concentration c is 
then obtained using an appropriate distribution for the 
concentration c. The cumulative distribution function F c 
for the concentration is 


It is more convenient to work in terms not of the conditional 
median concentration c mp but of the conditional mean con¬ 
centration e p . The relation between them is 

Cmp = c p exp(—<rf/2) [15.45.63] 

Then from Equations 15.45.46 and 15.45.63 it can be shown 
that 



re But from Equation 15.45.31 the relation between the 

%*= / P(c)6c [15.45.53] mean concentration and the mean concentration c 0 on the 

Jo centre line is 


where p( c) is the probability density function for con¬ 
centration. With intermittency this latter is c = c 0 exp (—y 2 /2a 2 ] [15.45.65] 


P( c ) = (1 — ?)^(c) + yPvi c ) [15.45.54] 

where p p (c) is the probability density function for 
conditional concentration. The delta function <5(c) is a 
spike at c = 0 and zero elsewhere with the further property 
that 

J°° 5 (c) de- 1 [15.45.55] 

Hence from Equations 15.45.53—15.45.55 
Fc = (1 - 7) + 7 f a P 9 {c) dc [15.45.56] 

For the log-normal distribution 

Wc) '(2,)k e “ p [- 1 ”^r 1 ] |I545 - 571 


Hence from Equations 15.45.62,15.45.64 and 15.45.65 


^{ 1+erf [ 1 


ln(yc/c 0 ) + {f/2 a 2 ) + (of /2)1 ' 
2!/%! 


Equation 15.45.66 is the basic equation of the model, giving 
the distribution function of c as a function of the intensity i, 
the conditional intensity i p and the intermittency y. 

Wilson also discusses the use of alternative distribu¬ 
tions. The two distributions which are most appropriate for 
physical reasons are the log-normal and the exponential. 
The exponential distribution has advantages for high 
intermittency, but overall he favours the log-normal 
distribution. 

For the exponential distribution the probability 
density function in terms of the conditional mean con¬ 
centration is 




(i+‘?r 


[15.45.58] 

[15.45.59] 


irff? 


[15.45.61 


#P+* 2 r 

<n = {ln[y(l + f 2 )]} 1/2 [15.45.61] 

Then from Equations 15.45.54,15.45.56 and 15.45.57 


Fc = a-y) + t 


M]1 


[15.45.62] 


A>(c)«-rexp(—c/cp) 


[15.45.67] 


and that in terms of the mean concentration is 

A>(#»|exp(—cy/I) [15.45.68] 

Then from Equation 15.45.56 and Equations 15.45.67 and 
15.45.68 

F c = 1 — y + y[l - exp(-c/c p )] [15.45.69] 

F c = 1 — y + y[l - exp(-cy/c)] [15.45.70] 

This model has been developed in subsequent work by the 
authors and coworkers (D.J. Wilson and Simms, 1985; 
D.J. Wilson, 1991a). 

The application of this model to toxic gas clouds is 
described in Section 15.47. 
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15.45.11 Concentration ensemble 

Concentration measurements in one experiment represent 
a single realization of a potential ensemble of experi¬ 
ments. The WSL data set described above and shown in 
Figure 15.109(e) is an illustration of such an ensemble. 

The importance of working in terms of the properties of 
the ensemble rather than of a single experiment has been 
brought out by Chatwin (1982b), and subsequently devel¬ 
oped (Camand Chatwin, 1985; Cam, 1987; Mole and Chatwin, 
1987; Cam, Sherrel and Chatwin, 1988; Chatwin, 1991). 

Chatwin (1982b) discusses the concentration T(x, t) from 
a single experiment. The mean value of this concentration 
is T(x, f). The mean value for the ensemble C(x, t) is defined as 

C(x, t) = Um 1r« ( x , t) [15.45.71] 


The concentration fluctuation c(x, t) is then 

c(x, t) = T(x, t) - C(x, t) [15.45.72] 

This fluctuation has a mean value c(x, /) = 0. The ensemble 
mean square fluctuation (?(x, t) satisfies 

d*(x, t) = f 2 (x, t) - C 2 (x, t) [15.45.73] 

The quantities C(x, t) and c 2 (x, f) are the mean and variance 
of the ensemble, respectively. 

In a given realization, there is a certain probability of a 
particular concentration T(x, t). Let this concentration be 
8 = F(x, t). The ensemble may be characterized by a prob¬ 
ability density function (PDF) p(0, x, t). It is a property 
of the PDF that 

j\(8,x,t)d8 = l [15.45.74a] 

or for the case where air is entrained so that 0 max < 1 
J p{8, x, t) d0 = 1 [15.45.74b] 


A typical application of the PDF approach is the deter¬ 
mination of the probability P that a concentration in a 
steady state cloud or jet will lie between the lower flamm¬ 
ability limit 0 L and the upper flammability limit 8 V . Then 



Such an application is illustrated in the work of Birch, 
Brown and Dodson (1980) on the concentration fluctua¬ 
tions, and hence ignition probabilities, in methane jets. 
Figure 15.142(a) shows PDFs as a function of radial dis¬ 
tance measured in such jets and Figure 15.142(b) shows the 
probability of ignition of the jets. 

The experimental determination of a concentration 
ensemble from which statistical properties are to be derived 
requires considerable care. The experimental variables 
which can cause variability in concentration must be fully 
defined. 

The properties of the ensemble are affected by the frame¬ 
work, absolute or relative, in which the measurements are 
made. If an absolute framework is chosen, the properties 
depend significantly on any feature which influences the 
motion of the cloud as a whole. This implies the need for a 
much larger number of experiments. 

The relationships between the intermittency and the 
other quantities in this scheme have been given by Cam and 
Chatwin (1985). If the concentration 8 is assumed to have 
only one of two values, 8 a or 0: 

p(8,x, t) = y{x, f)5(8 - 8 0 ) + [1 - y(x, t)]d(8) [15.45.79] 

where y is the intermittency and S is the delta function. 
These authors define intermittency as the proportion of 
time the concentration is non-zero. Then from Equation 
15.45.79 and Equations 15.45.75 and 15.45.76 the mean and 
variance are 

C(x, t) = 8 0 y(x, t) [15.45.80] 

<?{x, t) = 8 2 0 [y(x, t) - y 2 (x, /)] [15.45.81] 

Hence from Equations 15.45.77 and 15.45.81 the intensity is 


The PDF is related to the mean and variance as follows: 


C(x,t) = J 8p(8,x,t)d8 

[15.45.75] 

<?{x,t)^${8-Cfp{8,x,t)d8 

[15.45.76] 

The intensity i is 


, (c*(x,t)) 1/2 

C(x, t) 

[15.45.77] 


T 0„ 1 1/2 

[15 - 45 - 82a] 

r i i 1/2 

= i 15 - 45 - 82b ] 


15.45.12 Concentrations for dense gas: intensity 
parameter 

In an extension of this work, Cam (1987) has addressed the 
problem of concentration fluctuations in dense gas clouds. 
He defines an intensity parameter R which is the square of 
the intensity I so that 


If the PDF can be characterized by one of the standard dis¬ 
tributions, such as the normal or log-normal distributions, 
the probability may be obtained analytically Otherwise it 
must be obtained by numerical integration of the PDF. Thus 
if the PDF fits the normal distribution, then, for example, 
there is 90% confidence that the concentration 8 lies 
between the limits C(x, t) ± 1 .65[l?(x, f)] 1/2 . 


i?(C) = [15.45.83] 

Thorney Island trials 7-19 were analysed and empirical 
values of this intensity parameter were obtained as shown 
in Figure 15.143. It was found that R(Q was constant for 
a substantial proportion of the total record of C(t) and 
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Figure 15.142 Concentration fluctuations in gas dispersion - concentration and ignition probability in gas jets: (a) prob¬ 
ability density functions of concentration in a methane jet (Birch et at., 1978) Courtesy of Cambridge University Press; (b) 
ignition probability in radial plane of a natural gas jet (Birch, Brown and Dodson, 1980; reproduced by permission) C, con¬ 
centration; d, diameter; p, probability; r, radial distance; x, axial distance. In (b) measurements made at Reynolds number 
12,500 (A.), 16,700 (x) and 20,900 (•). Curve of measured ignition probabilities is different from that of the LFL (C= 0.05) 


constant over much of the area of the cloud, but there were 
also some substantial variations of R(Q even at constant C. 

Carn quotes the following empirical relation, due to 
Chatwin (1982b), for the bound on R(Q: 

R(C) — c(l [C - 1.) [15.45.84] 

where e is a constant. The suggested value of t is 0.04. The 
behaviour of R{Q was further investigated by obtaining an 


area-averaged value. This started at a peak of about 5, fell 
over some 30 s to about 1 and held this value for a period of 
30-150 s and then rose to a plateau of about 4 some 160 s 
after the release. 

15.45.13 Concentrations for dense gas: Workbook 

The Workbook by Britter and McQuaid (1988) is primarily 
concerned with the provision of a method of estimating 
the mean concentrations in dense gas dispersion. It does, 
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Mean concentration 

Figure 15.143 Concentration fluctuations in gas dispersion - concentration fluctuation intensity factor for Thorney 
Island Phase 1 trials (Cam, 1987) (Courtesy of Elsevier Science Publishers) 


however, include a discussion of concentration fluctua¬ 
tions. It points out that, even for passive dispersion, there is 
uncertainty about the definition and quantification of con¬ 
centration. The treatments available for dense gas disper¬ 
sion are rudimentary. 

It is possible, however, that for dense gas dispersion the 
problem may be simpler than for passive dispersion. The 
more deterministic nature of dense gas dispersion may 
result in smaller concentration fluctuations. Moreover, in 
dense gas dispersion the release is usually at ground level 
and the cloud remains near the ground. Work on passive 
dispersion has shown that fluctuations are less for ground 
level and near ground level releases. 


The treatments are mainly for jets and plumes at the 
point of release or for clouds with passive dispersion. The 
cases considered here are 

(1) instantaneous source; 

(2) continuous source; 

(3) momentum jet; 

(4) buoyant plume. 

The flammable mass in a dense gas cloud is also discussed. 

Approaches to dealing with the effect of concentration 
fluctuations on the determination of the flammable cloud 
are described. 


15.45.14 Jets and plumes 

The concentration fluctuations in jets have been meas¬ 
ured by a number of workers. On the basis of this work 
Long (1963) has proposed that for the estimation of the 
maximum instantaneous concentration in a jet the value 
of the constants k 2 k3 to be used in Equation 15.20.8 
should be 9 and 2, respectively, and that for the maxi¬ 
mum instantaneous concentration in a plume the value 
of the constant to be used in Equation 15.20.96 should 
be 17; he does not propose a value for the constant k 5 . 

The work of Brown, Birch and Dodson (1980,1981) on the 
probability density function approach to concentration 
fluctuations in jets has been described above. 


15.46 Flammable Gas Clouds 


15.46.1 Instantaneous source 

A simple treatment for the mass of gas in the cloud from the 
instantaneous release of a neutral density gas has been 
given by VJ. Clancey (1977a), who uses the following equa¬ 
tions derived from Equation 15.16.40 with Equation 15.14.5: 


2Q* ( lr 2 

-(2,fV eXP l 2a* 


(2vrfV 
2Q* 

” pwj 372 «« 


[15.46.1] 

[15.46.2] 


where 0* is the mass released, r is the radial distance, a is 
the dispersion coefficient, x is the concentration and the 
subscript cc denotes the cloud centre. 

The mass Wof flammable gas between the radii r x and r 2 
may then be calculated as 


It is often necessary to be able to estimate the mass of gas 
within the flammable range in a cloud from a flammable 
gas release. Workers who have studied this problem include 
Burgess etal. (1975), Eisenberg, Lynch and Breeding (1975), 
V.J. Clancey (1977c), van Buijtinen (1980) and J.G. Marshall 
(1977,1980). 


W = y 2nr 2 exp^-^^jdr [15.46.3] 

where r\ is the inner radius, r 2 is the outer radius and Wis 
the mass of flammable gas. For r% = 0 and r 2 = oo, Equa¬ 
tion 15.46.3 gives W = Q*. 
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The maximum quantity of flammable mixture, and 
hence the maximum hazard, occurs when the concentra¬ 
tion Xcc at the centre of the cloud equals the upper flamm¬ 
ability limit xv- 


Xu ~ Xcc 

2 Q* 


[15.46.4] 

[15.46.5] 


where a m is the value of a at maximum hazard. The lower 
flammability limit xl and the radius r L at which this occurs 
are given by the equations 


= erf [(ln^/zi// 2 ] - erf [(ln Zcc / Zu )V : 

_2*U 


O XL 
W l/2 Xcc 
Xcc > Xu 
[15.46.12a] 


= erf [(lnx cc /x L ) 1/2 ] - [Ox cc /Xl) 1/2 ] Xcc < Xu 


Xl = Xu exp [15.46.6] 

n.= [2<4MXu/XL)] 1/2 [15.46.7] 

The mass F of flammable gas between the flammability 
limits at maximum hazard is 


where Q* is the mass of gas released and Q* e is the mass of 
gas within the flammable range. Equation 15.46.12 applies 
to a cloud completely free of the ground or, alternatively, to a 
cloud at ground level (H = 0). 

The maximum value of the fraction Q*JQ * of gas 
within the flammable range is obtained by differentiating 
Equation (15.46.12a) with respect to Zcc which gives 


F = Io 2nr2xvexp (~l^) dr [15.46.8] 

The evaluation of Equation 15.46.8 is assisted by noting 
that it may be rewritten as 



where the expression inside the square brackets is the 
Gaussian distribution. 

This model indicates that the ratio Zu /XLof the upper 
and lower flammability limits is an important quantity in 
determining the fraction of the cloud within the flammable 
range and thus available for combustion. 

For a typical hydrocarbon the ratio of the upper to the 
lower flammability limit is in the range 4-6, so that the 
ratio of gas within the flammable range to the total gas in 
the cloud at maximum hazard is 


Substituting for Zcc from Equation 15.46.13 into Equation 
15.46.12a gives 


® =erff,f)-erf (vf) 

2exp(-w 2 )4 /2 

WV max V 2 j v 1 ) 

%V 2 

2exp(— v\)vY 2 
+ sV 2 

[15.46.14] 

with 


V = Xu/Xl 

[15.46.15a] 

vi = ln(v)/(w z - 1) 

[15.46.15b] 

V2 = v 2 ln(ti)/(w z - 1) 

[15.46.15c 


F/Q* « 2/3 15.46.10] 

The growth of the cloud prior to this point may be deter¬ 
mined from Equations 15.46.1-15.46.3. As a first approxi¬ 
mation, however, the mass of gas within the flammable 
range may be taken as rising linearly from the initial value 
to the value at maximum hazard with a rapid fall-off 
thereafter. 

A further treatment for an instantaneous release from a 
point source has been given by van Buijtenen (1980). For¬ 
mulating his model in terms of mass and mass concentra¬ 
tions of gas, the starting point is the following relation for 
an instantaneous release from an elevated source, of height 
H, derived from Equations 15.16.40b and 15.16.43: 


x{X,y ’ Z,t) = (2 7l 


[15.46.11] 



where the subscript max denotes the maximum value. 

The influence of the ratio xul Xl of the flammability limits 
on the fraction Q* / Q* of gas bet ween the flammability limits 
according to Equation 15.46.14 is shown in Figure 15.144. 

Theapplicationof this model canbe extended if necessary 
by the use of the virtual source method.Van Buijtenen also 
gives an equation for an instantaneous source of finite size. 

The problem of the amount of gas available for combus¬ 
tion has also been considered by Eisenberg, Lynch and 
Breeding (1975). These authors list three assumptions 
which may be made about this quantity: 

(1) all the fuel above the lower flammability limit; 

(2) all the fuel between the upper and lower flammability 

(3) all the fuel between the upper and lower flammability 
limits for which oxygen is available. 

The third assumption is the most accurate. For this latter 
case the mass of gas available for combustion is 

W F = f X dV+ [ X F(c)dV 
Jv LS Jv sv 


[15.46.16] 
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Figure 15.144 Flammable gas clouds - effect of ratio of 
flammability limits on fraction of gas within flammable 
range for release from an instantaneous point source (van 
Buijtenen, 1980), LFL, lower flammability limit; UFL, upper 
flammability limit (Courtesy of Elsevier Science Publishers) 

where F(c) is the weighting function giving the fraction of 
fuel present that enters into the combustion reaction, Vls is 
the volume of the cloud between the lower flammability 
limit and the stoichiometric concentration (m 3 ), F su is the 
volume of the cloud between the stoichiometric concentra¬ 
tion and the upper flammability limit (m 3 ) and Wf is the 
mass of fuel available for combustion (kg). The weighting 
function F(c) is defined as 

F(c) = * [15.46.17] 


where u is the wind speed, and x L and x v are the maximum 
distances to the lower and upper flammability limits, 
respectively. Equation 15.46.21 applies to a cloud com¬ 
pletely free of the ground or, alternatively to a cloud at 
ground level. 

An alternative formulation of Equation 15.46.21 may be 
obtained by substituting for x L and x v from Equation 
15.16.43 in Equation 15.46.21 to obtain for a plume at ground 

Q e b + d / Q \ 1/(6+,i) [/l\V(W) /^lAwn 

Q~ (b+d+l)u\Juoc) "W J 

[15.46.22] 

For a plume free of the ground the term -mac in Equation 
15.46.22 is replaced by 2 nuac. If the concentration at the 
source is below the upper flammability limit xu *u in 
Equation 15.46.21 and the term in xu in Equation 15.46.22 
are zero. 

Values given by van Buijtenen of the parameters 
in Equation 15.46.20 for use in this model are shown in 
Table 15.55. 

For typical values of the indices b and d, the rate of 
increase of the ratio QJQ with Q exceeds a linear rate. The 
application of this model can be extended, if necessary, by 
the use of the virtual source method. This is discussed by 
van Buijtenen. A rather similar model for a continuous 
source has been given by J.G. Marshall (1980), who writes 
Equation 15.16.41 in the form 

X(x,y,z) = exp j [15.46.23] 

where m 0 is the mass rate of release. Thus for the con¬ 
centration on the center line at ground level (y = z = 0) 


where n c is the number of moles of fuel consumed and w p is 
the number of moles of fuel present. Then if 1 mol of fuel 
reacts with L mol of oxygen 


_ 0.21Wa 

L 

where « a is the number of moles of; 


[15.46.18] 
in the rich mixture. 


x( ' X ’°’ Ci)m mau [15.46.24] 

Use is made of the following correlation for the product of 
the crosswind and vertical dispersion coefficients 

(Ty(T z = Dx f [15.46.25] 


F(c)=°^ t ^ [15.46.19] 

15.46.2 Continuous source 

Van Buijtenen also gives a model for a continuous source, 
derived from Equation 15.16.43. In this case it is necessary 
to use a correlation for the crosswind and vertical disper¬ 
sion coefficients. The relations used are 


a, m a .** [15.46.20a] 

oi = cx d [15.46.20b] 


where a and c are constants and b and d are indices. 

Then the ratio QJQ of the mass of gas within the 
flammability limits to the mass of gas released is 


Qe 

Q 


b + d *l - xu 
b+d+1 u 


[15.46.21] 


where D is a constant and/an index. 

On the assumption that the crosswind isopleths are semi¬ 
elliptical in shape, substitution for a y a z from Equation 
15.46.25 in Equation 15.46.23 yields 



[15.46.26] 

where Q F l is the mass of gas within the flammability limits. 
Values given by Marshall of the parameters in Equation 
15.46.25 for use in this model are shown in Table 15.56. 


15.46.3 Momentum jet 

J.G. Marshall (1977) has also treated the cases of a flam¬ 
mable momentum j et and a buoyant plume. The basis of the 
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Table 15.55 Meteorological parameters for van Buijtenen’s equation (after van Buijtenen, 1980) (Courtesy of 

Elsevier Science Publishers) 

A Values of a and b 

Pasquill stability category 


Parameters 






a 

b 



B 


0.371 

0.866 



C 


0.209 

0.897 



D 


0.128 

0.905 



E 


0.098 

0.902 



F 


0.065 

0.902 



B Values of c, d, e 

Pasquill stability 



Distance (m) 



category 

1-10 

10-100 

100-1000 

1000-20,000 

20,000-10 5 

Values ofc 






B 

0.15 

0.1202 

0.0371 

0.054 

0.0644 

C 

0.15 

0.0963 

0.0992 

0.0991 

0.1221 

D 

0.15 

0.0939 

0.2066 

0.9248 

1.0935 

E 

0.15 

0.0864 

0.1975 

2.3441 

2.5144 

F 

0.15 

0.0880 

0.09842 

6.5286 

2.8745 

Values ofd 






B 

0.8846 

0.9807 

1.1530 

1.0997 

1.0843 

C 

0.7533 

0.9456 

0.9289 

0.9255 

0.9031 

D 

0.6368 

0.8403 

0.7338 

0.5474 

0.5229 

E 

0.5643 

0.8037 

0.6865 

0.4026 

0.3576 

F 

0.4771 

0.7085 

0.7210 

0.2593 

0.3010 

Values ofe 






B 

0 

0 

3.1914 

2.5397 

0 

C 

0 

0 

0.2444 

1.7383 

0 

D 

0 

0 

-1.3659 

-9.0641 

0 

E 

0 

0 

-1.1644 

-16.3186 

0 

F 

0 

0 

-0.3231 

-25.1583 

0 


Table 15.56 Meteorological parameters for Marshall’s 
equation (after J.G. Marshall, 1980) 


Pasquill stability 
category 

Parameters 


D 

f 

A 

3.06 x 10“ 3 

2.4 

B 

1.38 x 10“ 3 

1.9 

C 

8.9 x 10“ 3 

1.8 

D 

6.0 x 10“ 3 

1.7 

E 

3.88 x 10“ 3 

1.7 

F 

1.43 x 10“ 3 

1.7 


at an axial distance z, r is the radial distance from the axis 
(m), T is the absolute temperature (K), 2 is the axial length or 
vertical height (m), ki and k 2 are constants, and subscripts a 
denote air and 0 the original discharge. 

Marshall states that d 0 is the effective diameter of the 
jet after it has expanded to atmospheric pressure but 
before any entrainment has occurred. For a vent this will 
be the diameter of the vent, whereas for a plant failure it 
will be related to the effective ‘hole’ size and internal 
pressure. 

The distance at which transition from jet to plume occurs 
is governed by the internal Froude number Fr: 


model for a jet is the work of Long (1963). For a momentum 
jet the concentration in the jet is given by the equation 

■***! 

where c is the concentration (volume fraction), d B is the 
effective diameter of the discharge (m), M is the molecular 
weight, M is the mean molecular weight of the gas mixture 


•Ztr = ksFrdo 


M Z T 0 —M 0 T a 

8 Wr 0 


[15.46.28a] 

[15.46.28b] 


[15.46.29] 
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where w is the velocity (m/s), k 3 is a constant and subscript 
tr denotes transition. 

Equation 15.46.27 may be used to determine an axial 
length and maybe integrated for volume and for quantity of 
flammable material. In order to simplify the integration 
Marshall assumes that M is equal to M a . The effect of this 
simplification for a gas of lower molecular weight than air 
is to overestimate the axial distance at which the upper and 
lower limit concentrations are reached, the former more 
than the latter. For a gas of higher molecular weight than air 
the opposite is true. For most flammable gases the error in 
axial distance or quantity is much less than 20%. 


The equations for the jet ar 

e then 


31* 

II 


[15.46.30] 

(M a T a \ 3 ' 2 J' 
Ffl w\m 0 t 0 ) d °(^' 

'<*) 

[15.46.31] 

Tt^273 (MX 3/2 /T a > 
_ 6&| 22.4 \ T 0 J \M 0 j 


[15.46.32] 


where Qfl is the mass of flammable material in the cloud 
between the flammability limits (kg), F F l is the volume of 
the cloud between the flammability limits (m 3 ) and sub¬ 
script L denotes the lower flammability limit and U the 
upper flammability limit. 

The values of the constants used by Marshall are as 
follows. For k\ and k 2 , the values recommended by Long 
(1963) as giving the maximum instantaneous concentra¬ 
tions are 9 and 2, respectively. But these two constants are 
not independent. If the radial spread of velocity and con¬ 
centration in the jet are the same 

k 2 = {2) 1/2 h [15.46.33] 


[15.46.35d] 


it can be shown from Equations 15.46.30 and 15.46.34 that 


[15.46.36] 


15.46.4 Buoyant plume 

For the buoyant plume the basis of the model given by 
Marshall is the work of B.R. Morton, Taylor and TUrner, 
(1956),Yih (1951) and Rouse,Yih and Humphreys (1952).The 
basic treatment is for neutral stability conditions, but 
other stability conditions are also taken into account, as 
described below. 

For a buoyant plume the concentration in the plume is 
given by the equation 




>[-(¥)! 


where g is the acceleration due to gravity (m/s 2 ), v is 
the volumetric flow (m 3 /s) and & 4 and k 5 are constants. 

The equations for the length and volume of the flam¬ 
mable zone in the plume and for the mass of flammable gas 


M a T 0 \ 1/s 

ZL ~gV 5 c 3 ^ \M a T 0 -M 0 Tj 

SmJifvT ( M a T 0 \ 3/S ( 1 
Kfl ” 27A§£ 3 / 5 \M a T 0 - M 0 tJ OP 


[15.46.38] 



Marshall uses values of 9 and 12.7 for k\ and k 2 , respectively. 
For k 3 , values of 1.39 and 1.74 have been obtained by 
B.R. Morton (1959) and by J.S. Turner (1966) for the case 
where momentum and buoyancy forces are directly 
opposed. Marshall takes k 3 as 1.55, which is the mean of 
these two values. 

For this model a comparison can be made between the 
length of the jet to the lower flammability limit and the 
length of the corresponding jet flame. The length of a tur¬ 
bulent jet flame has been given by Hawthorne, Weddell and 
Hottel (1949). Their equation is quoted in Chapter 16 as 
Equation 16.3.3. Rewriting this in Marshall’s notation 


«f 


5.3 dp f T f 

Cs \«T 0 




[15.46.34] 


where a is the ratio of the number of moles of unreacted and 
reacted gas and subscript F denotes the flame and s the 
stoichiometric mixture. Then, making the following 
assumptions, 


[15.46.39] 

_ 5nM 0 k 9 / 5 v 6 0 /s 273 / M a T 0 \ 3/5 /l l\ 
~ 12 TJ%gW 22.4 X \M a T 0 -M 0 T a ) ^J 

[15.46.40] 

The dispersion is affected by three separate but related 
aspects of the atmospheric conditions. These are (1) the 
degree of turbulence, (2) the wind speed, and (3) the stabi¬ 
lity conditions. 

These characteristics are not independent. Inversions in 
which the temperature increases with height occur more 
frequently in conditions of low turbulence and low wind 
speed. This is the combination of conditions least con¬ 
ducive to dispersion. 

The effect of temperature gradient may be taken into 
account by using the parameter G: 


G = ^(dT a /dz + r) 


[15.46.41] 


T 0 = T a 



c s ~2cl 


[15.46.35a] w here T is the dry adiabatic lapse rate (= 0.0098°C/m). 

Equation 15.46.41 is related to the Richardson number. 
[15.46.35b] It is not uncommon in the United Kingdom to have tem- 
M 5 46 35rl P erature gradients dTJdz of the order of 0.01°C/m, while 
[15.4o.oocJ gradients of 0.1°C/m are not unknown. The corresponding 
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values of the parameter T are: 




dr a /dz(°C/m) 

G(s“ 2 ) 

0 (isothermal) 

0.000334 

0.01 

0.000674 

0.1 

0.00374 


For an atmosphere in which the temperature gradient is 
greaterthanthatofaneutraladiabaticatmosphere(r > 0)and 
in which these conditions continue sufficiently far upward, 
there will come a height at which the density of a plume of 
positive buoyancy equals that of the surrounding air. 
Marshall gives the following equationfor the height of aplume 
based on the work of B.R. Morton,Taylor and Turner (1956): 


k^J 11 (M a T 0 -M a TX 
Zmax ~ (?&'. \ M a T„ j 


[15.46.42] 


where k 6 is a constant. 

Equation 15.46.42 sets a limit on the rise of the plume in 
stability conditions where the temperature increases with 
height. The plume height z max calculated from Equation 
15.46.42 may be compared with the height z L at which the 
concentration reaches the lower flammability limit as given 
by Equation 15.46.38. If z max is less than z L , the plume does 
not rise sufficiently high to be diluted below the lower 
flammability limit. 

The values of the constants used by Marshall are as fol¬ 
lows. For & 4 , the value recommended by Long as giving the 
maximum instantaneous concentration is 17, and this is 
used by Marshall. For k 5 , Marshall assumes that the ratio 
k 5 /k 4 is the same as for time mean values and thus obtains 
for k 5 a value of 13; for k 6 he uses the value of 6.65 given by 
B.R. Morton,Taylor and Timer (1956). 


15.46.5 Comparative cloud sizes 
J.G. Marshall (1977,1980) has presented a number of illus¬ 
trative calculations of the dimensions of and quantities of 
flammable material in clouds from a continuous source, a jet 
and a buoyant plume for hydrocarbon gases. J.G. Marshall 
(1980) gives the following summary of his equations. 


Continuous source 


_0 : 321w^ 59 /_ 

U' s 


[15.46.43] 


Equation 15.46.43 is obtained from Equation 15.46.26 
with the value of the index/applicable to Pasquill stability 
categories D-F, which is 1.7. 


Momentum jet 


A p 0 = p a -p 0 [15.46.46] 

where m 0 is the mass rate of release (kg/s), u is the wind 
speed (m/s), Ap ot is the density difference between air and 
the gas (kg/nr) and / is the concentration (kg/m 3 ). 

The results shown in the table below were obtained 
by J.G. Marshall (1977) for jets of methane and ethylene at 
288 K, from Equations 15.46.30 and 15.46.32: 



M q c L 

c 0 Z\jd 0 

m/d 3 

Qfl/<£ Zf/zl 


m 

m 

(kg/m 2 s) 

(kg M 

ch 4 

16 0.05 

0.15 243 

236 

1388 0.83 

C 2 H 4 

28 0.027 0.36 340 

304 

4020 0.73 

For buoyant plumes of the same gases a 

t the same tem- 

perature, from Equations 15.46.38 and 15.46.42: 


m 

z L (neutral 

Zmax (stable atmosphere) 


(kg/s) 

atmosphere) 





(m) 

G = 0.00034 G= 0.001 




(m) 

(m) 

ch 4 

100 

181 

374 

248 


1000 

455 

665 

441 

c 2 h 4 

100 

346 

175 

116 


1000 

870 

311 

206 


Marshall also gives results for jets of ethane, propane and 
«-butane and at temperatures of 423 and 573 K. 

For buoyant plumes the results show the relation 
between the maximum height attained by the plume z max 
and the height required for dilution to the lower flam¬ 
mability limit z L . For methane, which has a large positive 
buoyancy, z max > z L approximately in all the cases con¬ 
sidered. For ethylene, which has only a small positive 
buoyancy, z L > 2 max in all the cases considered. 

Both for jets and buoyant plumes the residence time is of 
interest as giving the lower limit for the time required for 
the flammable cloud to form. For the cases of jets con¬ 
sidered by Marshall the residence times within the flam¬ 
mable envelope were in the range 2.5-11 s for mass flows of 
100 kg/s and 8-24 s for mass flows of 1000 kg/s. For the 
cases of plumes the minimum residence times were 3 and 5 s 
for mass flows of 100—1000 kg/s, respectively. The results 
also show that emission rates of 100-1000 kg/s can give 
rise to vapour clouds containing at least 1 te of flammable 
material. 

In a second study extending the comparison to a con¬ 
tinuous source also, J.G. Marshall (1980) gives the emission 
rates necessary to produce clouds containing given 
amounts of gas as follows: 


9,l ‘ 3 - 4 ‘’ ;s © (2-3) 


_ 1.45T 3 - 8 / p a 6 Po 6 ml 2 \ ( 1 l\ 

= ApM JU 8 $7 


Type of release 

Emission rate (kg/s) to give 
cloud containing 

1000 kg 

10,000 kg 

Continuous source 

6-100 

25-440 

Jet 

13-110 

50-600 

Buoyant plume 

16-110 

100-700 
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He also gives the graphical comparison shown in Figure 
15.145. In each of the three cases the critical parameter is 
different: for the continuous source in Figure 15.145(a) it is 
the stability category and wind speed u; for the jet in Figure 
15.145(b) it is the pipe velocity w„; and for the buoyant 


plume in Figure 15.145(c) it is the hydrocarbon species. In 
the case of the continuous source calculation assumes a 
hypothetical hydrocarbon with lower and upper flam¬ 
mability limits of 0.039 and 0.176 kg/m 3 , respectively. In the 
case of the jet, which is for a typical lower paraffin, the 



Figure 15.145 Flammable gas clouds - mass of gas within flammable limits in gas cloud in some principal dispersion 
situations (J. G. Marshall, 1980): (a) passive gas dispersion; (b) jet dispersion; (c) plume dispersion, u, mean wind speed; 
w ot jet discharge velocity (Courtesy of the Institution of Chemical Engineers) 
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lower pipe velocity is close to the limiting value below 
which jet dispersion would no longer be the controlling 
mechanism, while the upper velocity is close to the sonic 
velocity. In the case of the plume, methane has been taken 
as the most positively buoyant material likely to be of 
interest, other than hydrogen, while ethylene at 288 K 
represents the limiting gas density above which other 
modes of dispersion would predominate. This study indi¬ 
cates that in respect of the mass of gas within the flam¬ 
mable limits for a given size of release the three types of 
release appear remarkably similar. 

15.46.6 Dense gas clouds 

For dense gas clouds, the approach taken depends on the 
type of model used. A box model gives the cloud dimen¬ 
sions directly. The Workbook method gives correlations for 
the area within a given concentration. 

15.46.7 Empirical relations 

An empirical equation for the radius of a vapour cloud has 
been given in the Second Report of the Advisory Commit¬ 
tee on Major Hazards (ACMH) (Harvey, 1979b): 

R = 30M 1/3 [15.46.47] 

where Mis the mass of vapour (te) and R is the radius of the 
cloud (m). 

Equation 15.46.47 is based on the assumption that the 
ratio of the cloud radius to cloud height is 5 :1. It appears to 
agree reasonably well with the estimated size of the clouds 
at Flixborough and at Beek. If it is assumed that the quan¬ 
tities released in these two incidents were 40 and 5.5 te, 
respectively, the cloud sizes as calculated from Equation 
15.46.47 are 103 and 53 m, which compare with the esti¬ 
mated cloud sizes of 102 m (kidney-shaped cloud) (Sadee, 
Samuels and O’Brien, 1976—77) and of 50 m (Ministry of 
Social Affairs, 1976), respectively. 

15.46.8 Concentration fluctuations 

It has long been recognized that the effect of concentration 
fluctuations is to extend beyond the nominal mean lower 
flammability limit (LFL) concentration values the range 
and the area of the cloud which is susceptible to ignition. 

Feldbauer et al. (1972) allowed for this by the use of an 
effective limit, replacing the LFL value by an effective 
value, which they took as the 0.5 LFL value. This approach 
has been widely utilized. 

It has been suggested by Pikaar (1985) that the Maplin 
Sands vapour cloud fire tests indicate that for this purpose 
use may be made of a practical peak/mean concentration 
ratio of 1.4, which translates to a 0.7 LFL value. The account 
given by this author is discussed in more detail in Chapter 17. 

More sophisticated approaches may be used, based on 
the modelling of concentration fluctuations, as described 
in Section 15.45. In the work of Birch, Brown and Dodson 
(1980,1981) on ignition in jets, the relationship between the 
gas concentration and the occurrence of ignition is 
expressed as a probability distribution. 

A discussion of the problem in the context of dense gas 
dispersion has been given by McQuaid (1984a). The defi¬ 
ciencies of applying averaging to turbulence phenomena 
have been discussed by Spalding (1983). For instance, the 
average obtained depends on the averaging time selected. 
There is no simple solution. 


15.46.9 Cloud size estimation procedures 

A number of companies have developed procedures for 
estimating the size of the flammable vapour cloud to be 
considered in plant design. Essentially these define the 
scenarios to be treated, such as the size and duration of the 
leak. Accounts of such procedures include those by Exxon 
(n.d.), Brasie (1976a), FMRC (1990) and Industrial Risk 
Insurers (IRI) (1990), and a review is given by the CCPS 
(1994/15). 

The procedure of Brasie (1976a) for a continuous leak 
utilizes for the leak rate from a short nozzle or pipe the 
relation 

W s = 2343 P 07 [15.46.48] 

where P is the operating pressure (bar) and W\ T is the mass 
flow per unit area (kg/m 2 s). The flow of vapour into the 
cloud is obtained from the flash fraction. The mass of 
vapour in the cloud above the LFL is a function of time. The 
maximum time is the time span for the cloud concentration 
to fall below the LFL. For this use is made of the relation 

f=516(JE/M/) [15.46.49] 

where/is the lower flammability limit (%), M is the mole¬ 
cular weight, W is the mass flow (kg/s) and t is the time 
span (s). 

The CCPS (1994/15) describes an unpublished procedure 
of Exxon (n.d.). This distinguishes between releases of 
(1) gas, (2) liquid and (3) two-phase or flashing liquid. For a 
gas release, the mass of vapour entering the cloud is taken 
as the lesser of (1) the total inventory or (2) the product of the 
flow and the time to stop the leak. For a liquid release, the 
quantity spilled is taken as the lesser of (1) the total inven¬ 
tory or (2) the product of the flow and the time to stop the 
leak. The mass of vapour entering the cloud is then taken as 
the product of the liquid evaporation rate and the time to 
find a likely source of ignition. For a liquid which is two- 
phase or flashing, the mass of vapour entering the cloud is 
the lesser of (1) the total inventory times twice the flash 
fraction or (2) the product of the rate of release and the time 
to stop the leak and twice the flash fraction. 

The procedure of the Factory Mutual Research Corpora¬ 
tion (FMRC, 1990) is oriented towards the estimation of the 
loss potential in insurance. In this method the credible 
releases are taken as: (1) 10 -min releases from (a) the largest 
connection on the largest vessel or vessel train, (b) atmo¬ 
spheric or pressure storage, credit being given for the 
operation of excess flow valves, or (c) above-ground pipe¬ 
lines conveying material from a remote, large capacity 
source; and (2) the total inventory of mobile tanks, such as 
tank trucks or rail tank cars. 

Another insurance-related procedure is that of the 
Industrial Risk Insurers (IRI, 1990). For the catastrophic 
loss potential, the mass released is based on the content of 
vessels or vessel trains, storage tanks and pipelines to stor¬ 
age. For the latter a guillotine fracture is assumed with a 
release duration of 30 min. No credit is allowed for shut-off 
valves between vessels. For the probable maximum loss 
potential, a credible release is determined, allowing for 
the operation of emergency shut-off and blowdown. The 
minimum release is the inventory of the largest process 
vessel and the maximum that of the largest train of vessels 
which are interconnected and not isolated. 
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15.47 Toxic Gas Clouds 

The effect of exposure to a cloud of toxic gas is a function of 
the concentration-time profile and of the toxic character¬ 
istics of the gas. An account of the concentration behaviour 
of gas clouds was given in Section 15.45, whilst the toxic 
characteristics of gases are described in Chapter 18. This 
section describes the attempts made to marry these two 
features. 

15.47.1 Toxic load and probit 

As described in Chapter 18, the inhalation toxicity of a gas 
is characterized by the toxic load L which produces some 
defined toxic effect which is typically of the form 

J C*df [15.47.1a] 

4 C'T [.15.47.1b] 

= £6^ [15.47.1c] 

where C is the concentration, L is the toxic load, t is the 
time, T is the time of exposure and n is an index. 

The proportion of the exposed population which will 
suffer, or the probability that a single individual will suffer, 
this defined degree of injury is generally expressed in 
terms of a probit equation of the form 

Y = k l + k 2 \nL [15.47.2] 

where Y is the probit and k i and k 2 are constants. The prob¬ 
ability P of injury is a function of the probit Y. The use of 
probit equations is discussed in Chapter 9. 

Equation 15.47.1 is the form typically taken by correlation 
of experimental work. There is usually little information on 
its applicability to combinations of values of (C,f) where C is 
high and t is short. There must therefore be doubt as to the 
appropriateness of applying it in a mechanistic way. 

15.47.2 Intermittency and its effects 

Griffiths and co-workers (R.F. Griffiths andMegson, 1984; 
R.E Griffiths and Harper, 1985) have drawn attention to the 
implications of concentration intermittency when com¬ 
bined with the toxic load relation 15.47.1. The intermittency 
y is defined as the fraction of time for which the con¬ 
centration is zero: 



where y is intermittency and subscripts pe and s denote 
exposure and sampling, respectively. These authors define 
intermittency as the proportion of time the concentration is 
zero. The average concentration C is 

Cts = Qf pe [15.47.4] 

where C is the average concentration and C p is the con- 
centrationovertimef pe .ThenfromEquationsl5.47.2—15.47.4 

Y = k i + fe In [15.47.5] 


For the usual case of n> 1, the probit Y, and hence the 
probability P of injury, increase as the intermittency 
increases. The effect can be pronounced. 

15.47.3 Ride model 

The model given by Ride (1984b) for concentration fluc¬ 
tuations in a passive plume was described above. He has 


applied this model to the determination of toxic load. 

From Equation 15.45.27, with ifi = 1 

§-*(§)+! [15.47.6j 

From this equation, with Equation 15.45.24 

■k(c../Cy-Tr 11 — y, [15.47.Jf 

Then for a receptor with response time z Ride obtains from 
Equation 15.47.1a for toxic load with Equations 15.47.6 and 
15.47.7 

L=Q(l-y % )T [15.47.8] 

«C”Tco [15.47.9] 

with 

ffl = IMpJCf +1]*- 1 [15.47.10] 


where co is an enhancement factor which takes account of 
concentration fluctuations. 

The enhancement factor to is never less than unity and 
can be large. Table 15.57 given by Ride shows values of this 
factor obtained taking Jones’ values of k = 11 and X = 1.5 
with values of n quoted in the literature for several gases 
and with postulated values of the intensity a x /C the values 
of <j x /C from Jones’ data are about 1-2. 

15.47.4 Wilson model 

The model of D.J. Wilson (1982) for concentration fluctua¬ 
tions in a passive plume and for the distribution function of 
the concentration was given in Section 15.45. If the relevant 
effect is toxic concentration rather than toxic load, that 
model may be applied as described by D.J. Wilson and 
Simms (1985). The model gives the distribution function for 
concentration and from this it is possible to determine the 
distribution function for the probability of fatality given 
such concentration fluctuations. 

This is obtained by the authors as follows. The prob¬ 
ability F c that the concentration will not exceed a value c is 
given by Equation 15.45.66. Then the probability V c that it 
will exceed this value is the complement: 

7 C = 1 -F c [15.47.11] 

7 is the probability of exceeding the concentration c over 
the exposure time T e . Over some small time i5fj the prob¬ 
ability of exceeding c is Vdt and that of not exceeding it 
is 1 - VSt. If the number of breaths over time T e is 74 
the probability S(T e ) of not exceeding c, and thus of sur¬ 
viving, is 

S(T e )={l-VT e /N b ) Nb 

' - exp( • 77' c ) Np —» oo 


[15.47.12] 
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If the effect is one of toxic load, an extension of the model is 
required, giving the distribution function of the toxic load 
as defined by Equation 15.47.1b. This extension has been 
discussed by D.J. Wilson and Simms (1985) and D.J. Wilson 
(1991b). 


Table 15.57 Effect of variations in concentration on 
toxic load (Ride, 1984a) (Courtesy of Elsevier Science 
Publishers) 


Intensity of 
fluctuations 
rrflC 

Enhancement factor, w 

HCN 
n = 1.8 

Ammonia 
n =2.0 

Chlorine 
n = 2.75 

0 

1.0 

1.0 

1.0 

1 

7.2 

12.0 

77.4 

2 

16.1 

32.1 

433 

5 

47.3 

124 

4607 


An illustration of the effect of concentration fluctuations 
has been given by D.J. Wilson (1991b) for the case of con¬ 
tinuous release of hydrogen sulphide using a value of 
n = 2.5 in Equation 15.47.1a. Figure 15.146(a) shows the 
contours for the probability of fatality given by the mean 
toxic load, Figure 15.146(b) those for the median load and 
Figure 15.146(c) those for the 99% percentile. 


15.47.5 Davies model 

A model for the effective dosage based on concentration 
and dosage distributions obtained from concentration 
profiles for an ensemble have been given by J.K.W Davies 
(1987,1989a). 

J.K.W. Davies (1987) starts from a consideration of the 
ensemble of 21 concentration profiles obtained in the work 
at Warren Spring Laboratory (WSL) by D.J. Hall, Hollis and 
Ishaq (1982) shown in Figure 15.147(a). Analysis of the 
WSL data for concentration C showed that at the 95% con¬ 
fidence level the mean p(Q is constant over the period 
2.4-4.4 s and the standard deviation cr(C) is constant over 
the range 2.4—5.4 s, as shown in Figure 15.147(b) and (c), 
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Figure 15.146 Toxic gas clouds - contours of toxic load for a continuous release of hydrogen sulphide (D.J. Wilson, 
1991a); (a) without concentration fluctuations; (b) with concentration fluctuations, median; (c) with concentration 
fluctuations, 99% percentile (Courtesy of the American Institute of Chemical Engineers) 
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respectively. The variations of concentration at a given time 
between the members of the ensemble were fitted to various 
distributions. The distributions which best fitted the con¬ 
centration varied over the time period, the log-normal 
distribution being the best for the critical period 1.7-2.7 s 
containing the concentration peak. 

The distribution was also determined for dosage D, 
defined as 

D(t) = J C At [15.47.13a] 

= Ct C = constant [15.47.13b] 

and 

£>(/) = J C“At [15.47.14a] 

= C“t C = constant [15.47.14b] 

where n is an index. In both cases the best fit was obtained 
using the log-normal distribution. 

These findings have been applied by J.K.W. Davies 
(1989a) to devise a method of estimating the probability 9 of 
fatality due to exposure to a toxic gas cloud. For this he 
utilizes the following alternative form of the probit relation. 
The probability 9 of fatality is given by the distribution 
function 0: 

9(D) = 0( 5 ) [15.47.15] 

S = k\n(D/D5o) [15.47.16] 

where the dosage D is defined by Equation 15.47.14, D 50 is 
the median fatal dosage, k is a constant and 8 is a standard¬ 
ized log dose. The relation between Equations 15.47.28 and 
15.47.15 is then 


cj>- 1 {e)=k\n{D/D sa ) [15.47.17a] 

1= -IHnDso + Mn D [15.47.17b] 

Y=<t>- 1 (9) +5 [15.47.18] 

ki = 5 — &lnZ% 0 
k 2 = k 

0(0) = (Y — 5) _1 [15.47.19] 

k=k 2 [15.47.20] 

D50 = exp [15.47.21] 

The model given by Davies is then as follows. The dose 

D is log-normally distributed. Thus, lnD is normally 

distributed: 

In D = !V[lnA ff^lnD)] [15.47.22] 


where N [ • • • ] signifies the normal distribution and D is the 
mean dose. Then the standardized log dose 8, defined by 





Figure 15.147 Concentration fluctuations in gas 
dispersion - statistical parameters of a data set 
(J.K.W. Davies, 1987): (a) set of 21 concentration vs time 
traces obtained in repeat experiments in a wind tunnel (the 
WSL data set); (b) 95% confidence limits on mean 
concentration; (c) 95% confidence limits on ensemble stand¬ 
ard deviation (Courtesy of Elsevier Science Publishers) 
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equation [15.47.16], is also taken a 

s normally distributed 

8=N[8, tr(<5)] 

[15.47.23] 

with 


8 = h\n (D/Dso) 

[15.47.24] 

a 2 (8) = ^ln(lnD) 

[15.47.25] 


where 5 is the mean standardized log dose. 

An effective dose D* is defined as the dose which gives 
rise to the same mean number of fatalities as would be 
obtained by averaging the number of fatalities observed in 
successive realizations of the ensemble in which dose D is 
allowed to vary log-normally. 

An effective standardized log dose 5* is also introduced, 
defined as the standardized log dose which gives rise to the 
same mean number of fatalities as would be obtained by 
averaging the number of fatalities observed in successive 
realizations of the ensemble in which the standardized log 
dose <5 is allowed to vary normally. It is defined as 

8* = £In(/r/A, 0 ) [15.47.26] 

An ideal gas dispersion model will produce for the stand¬ 
ardized log dose a prediction 8 and the corresponding 
probability of fatality will be <j>(8). The true probability of 
fatality is <t>(8*). The difference <i>(8*) - cj>(8) is a measure 
of the error in the prediction of fatality, even by an ideal 
model due to variations between members of the ensemble. 

The equivalent standardized log dose 8* may be deter¬ 
mined by selecting values of 8 from the normal distribu¬ 
tion, calculating the corresponding values of the 
probability of fatality <j>(8) and taking the mean value of 
this probability as <j>(8*). Table 15.58 (from Davies) shows 
the results of such a calculation. 

The case of <r(<5) = 0 corresponds to no concentration 
fluctuation, whilst <r(<5) = 1 is typical of the value in the 
body of the cloud and cr(<5) > 1 of values at the edges. For 
D > Z> 5 o the use of 8 instead of 8* results in an overestimate 
of the probability of fatality, whilst for D < D 50 it results in 
an underestimate. This misestimate is less than 10% in 
absolute terms for <r(<5) < 1, but for o(8) > 1 it becomes pro¬ 
gressively greater, reaching a value of about 30% at 
<r(<5) = 5. 

An illustrative example is shown in Table 15.59. The case 
considered is the toxic effects 1000 m downwind of a 20 te 
release of chlorine in D/3 conditions. The index n is taken as 
3.49, which is at the upper end of the range of published 
estimates. The effect of concentration fluctuations on toxic 
load is most marked towards the edges of the cloud. 


15.48 Dispersion over Short Distances 

It is necessary in some applications, particularly in relation 
to plant layout, to estimate dispersion over short distances. 

15.48.1 Dispersion of passive plume 
The relationships for passive dispersion are commonly used 
over relatively large distances, but the question of the range 
of his model was specifically considered by O.G. Sutton 
(1950). He describes experiments on the dispersion of a 
vertical jet of hot gas for which he obtained a value of 
the diffusion coefficient C. This value is similar to that 
obtained in the dispersion of smoke from a smoke generator 
over a distance of 100 m, provided that for comparability 
use is made in the latter case of the instantaneous rather 
than the time width of the plume. Sutton states: 

This leads to the striking conclusion that the same coef¬ 
ficient of diffusion is valid for the spread of smoke over 
hundreds of meters as for the mixing of a tiny column of 
hot air with the cold air of a laboratory. 

The use of the Sutton model for estimation of dispersion in 
relation to hazard areas around vents has been treated by 
Long (1963), who devotes an appendix to the applicability 
of the model over short ranges. He discusses both the basic 
assumptions and the available experimental results. He 
reviews the assumptions systematically and finds no fun¬ 
damental inapplicability for short ranges. In particular, the 
semi-angle of divergence of the roughly conical plume pre¬ 
dicted using the values given by Sutton for the diffusion 
coefficient is about 10° and 16° in the vertical and hori¬ 
zontal directions, respectively, which compares well with 
semi-angles in the range 9—16° found for jets and plumes. 


Table 15.58 Effect of variations in dose between 
members of an ensemble on predicted fatality: <j>(8*) - <j>(y) 
(J.K.W. Davies, 1989a) (Courtesy of Elsevier Science 
Publishers) 


o(8) 


4>(8*)~ 

m 



8 



0 

1 

2 

3 

0 

0 

0 

0 

0 

0.2 

0 

0 

0 

0 

0.5 

0 

-0.03 

-0.02 

0 

1 

0 

-0.08 

-0.06 

-0.02 

2 

0 

-0.17 

-0.17 

-0.09 

5 

0 

-0.20 

-0.28 

-0.29 


Table 15.59 Effect of variations in dose between members of an ensemble on predicted fatality: 20 te chlorine 
release* (J.K.W. Davies, 1989a) (Courtesy of Elsevier Science Publishers) 


Crosswind distance (m) 

In C*t 

Y 

8 

o 

m 

<P(S*)-<P(8) 

52 

28.80 

8 

3 

0.5 

i 

0 

215 

26.84 

6.04 

1.04 

1 

0.85 

-0.08 

235 

26.32 

5.52 

0.52 

1.2 

0.70 

-0.04 

287 

24.96 

4.16 

-0.84 

2 

0.20 

-0.17 

a Table relates to conditions 10' 

00 m downwind of an i 

nstantaneor 

is release of 20 te chlorim 

3 in-D/3 cond 

itions, assuming a so 

urceterm in which 


400 te of air is entrained. The cloud radius, defined as 10% of the centre line concentration, at this distance is 417 m. 
b Toxicity parameters: n = 3.49; k = 1; ln_D 50 = 25.8. 
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The only experimental work found by Long was that of 
Katan (1951). Using values of the Sutton coefficient 
based on a 3-min sampling time, Long found that the 
Sutton equations tend to overestimate the concentration 
somewhat. 

15.48.2 Dispersion of dense gas plume 

Some guidance on the dispersion of a dense gas plume over 
short ranges has been given by McQuaid (1980) in the 
context of the design of water spray barriers. He takes 
the plume as issuing at an angle of 35° and having a height 
of lm. 

15.48.3 Dispersion from vents and reliefs 

It is common practice in the process industries to discharge 
material to atmosphere. Intended discharges occur through 
chimneys, vents and relief devices. The treatment here is 
mainly confined to the problem of the safety of discharges 
occurring in an emergency, usually as a result of the 
operation of relief devices. Discharges to flare are dis¬ 
cussed in Chapter 12 and disposal of material vented from 
chemical reactors in Chapters 12 and 17. 

Recent years have seen a marked tightening up in the 
extent to which discharge to atmosphere is permissible 
and, although the situation varies as between countries, the 
trend is clear. Accounts of safe discharge include those 
given in the various editions of API RP 520 and RP 521 and 
by Long (1963), Loudon (1963), Bodurtha, Palmer and 
Walsh (1973) and Gerardu (1981). The topic is also fre¬ 
quently discussed by authors of models developed to assist 
with this problem. 

An early review is that by Loudon (1963), who identifies 
the hazards arising from such a release as including, for 
flammable or toxic material 

(1) hazardous concentration, particularly at ground level; 
and, for flammables 

(2) vapour cloud explosion; 

(3) jet flame. 

Another hazard is flashback of flame into a vent. 

For discharges, a distinction is to be made between those 
which have high momentum and/or buoyancy and those 
which do not. If the release has a high velocity, and thus 
high momentum, this promotes entrainment of air and 
dilution of the cloud. Another aspect is the height to which 
the material discharged travels before it starts to descend 
to the ground, the effective ‘stack’ height. This is increased 
if the release has high buoyancy and, for a discharge 
directed upwards, high momentum. 

Safe discharge is generally addressed by a combination 
of engineering measures and hazard assessment. The for¬ 
mer centre mainly on the height of the vent and on the 
velocity of the discharge, whilst the latter involves the use 
of suitable models to assess the hazards listed above. 

Widespread use has been made of the equation in API RP 
520 for the estimation of concentration of contaminant as a 
function of distance for use in high velocity discharge cal¬ 
culations based on the recommendations on discharge 
velocity. This equation is given in Chapter 12. 

There are a considerable number of models for the 
estimation of the ground level concentration resulting from 
an elevated release. They include: the early models of 
Bosanquet (1935) and Bosanquet and Pearson (1936); 
O.G. Sutton (1952); the Pasquill model (Pasquill, 1961) and 


the Pasquill-Gifford model (Pasquill, 1961,1962; Gifford, 
1961); the model of Cude (1974b); and that of G.A. Briggs 
(1965,1969). Other models have been developed to obtain 
the ground level concentration for elevated releases of a 
dense gas. Amongst these are the models of Hoot, Meroney 
and Peterka (1973), Bodurtha, Palmer and Walsh (1973), 
Ooms, Mahieu and Zelis (1974), Jagger and Edmondson 
(1984), Emerson (1986a), J.L. Woodward (1989a) and 
McFarlane (1991). Accounts of many of these models are 
given in Sections 15.20,15.43 and 15.44. 

The mass of gas from a discharge which is within the 
flammability limits and thus available to participate in a 
vapour cloud fire or explosion may be obtained from mod¬ 
els of jets and plumes. There are also some models which 
specifically address this problem. These include the famil¬ 
ies of models given by Hess and co-workers (Hess and 
Stickel, 1970; Hess, Leuckel and Stoeckel, 1973), J.G. Marshall 
(1977,1980), Palazzi et al. (1984) and Stock and co-workers 
(Stock and Geiger, 1984; Stock, 1987; Stock, Geiger and 
Giesbrecht, 1989). The effects of ignition may be estimated 
using models for vapour cloud fires or explosions, which 
are dealt with in Chapters 16 and 17, respectively. 

Ignition of a sustained high momentum discharge gives 
a jet flame. Early models of jet flames developed for the 
assessment of such situations include those by Craven 
(1972,1976) and Kovacs and Honti (1974). There are now a 
number of jet flame models, as described in Chapter 16. 

Several authors have described sets of models used for 
the estimation of the hazards from discharges. They 
include Kovacs and Honti (1980) and Gerardu (1981). The 
models cover ground level concentration, jet flame radia¬ 
tion and vapour cloud overpressure. 

Mention has already been made of the work of Katan 
(1951) on safe dispersion distances for aircraft fuelling. 
More recent work in this area has been described by Thorne 
(1986), who gives models for the plumes from circular, slot 
and elliptical vents. The results from these models show 
distances for dilution of the jet fuels below the LFL in the 
range 1.5-4 m. 


15.48.4 ASME equation 

A formula for plume rise from a momentum source widely 
used in design for safe discharge is that given by 
the American society of Mechanical Engineers (ASME, 
1969/1). This is 

/t=£>(^y 4 [15.48.1] 

where D is the internal diameter of the stack (m), Ah is the 
plume rise (m), v s is the velocity of the stack gas (m/s) and u 
the wind speed at stack height (m/s). 

The equation quoted for the maximum concentration at 
ground level is Equation 15.16.55. The applicability of the 
ASME equation is to a stack gas which is essentially of 
neutral density. 


15.48.5 Bodurtha and Walsh method 

An early method for safe discharge which applies to a dense 
gas mixture is that of Bodurtha and Walsh, described in 
Bodurtha, Palmer and Walsh (1973). Figure 15.133 shows 
photographs of the simulation of a dense gas plume in a 
wind tunnel obtained by these workers. The difference 
between the three tests lies in the density of the gas 
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discharged relative to that of air, the relative densities in 
Figures 15.133(a)-(c) being 1.0,1.52 and 5.17, respectively. 

On the basis of these admittedly limited tests, Bodurtha 
and Walsh obtained the following design equation: 

As = 1.33ED 2 [15.48.2] 

where D is the diameter of the vent tip (ft), E is the number 
of dilutions with air of the stack gas required to reduce its 
concentration to the lower flammability limit and h a is the 
height of the vent above the exposure level (ft). As a design 
equation, the relation is conservative. The authors state 
their belief that it contains ample safety factors. They also 
say, however, that it is intended only for short period 
releases of dense gases. 

15.48.6 Hanzevack method 

Another experimentally based method is that by 
Hanzevack (1982), who conducted tests in which he meas¬ 
ured the ground level concentration from elevated releases 
of both ambient and high density gas mixtures. He gives a 
model for the ground level concentration due to a con¬ 
tinuous emission which is based on a modification of the 
ASME plume rise formula described in Section 15.48.4. 
The modification allows for differences in the density of 
the stack gas mixture and includes a constant to improve 
the fit to his experimental data. 

The equations given by Hanzevack for the plume rise 
from a momentum source and for the maximum ground 
level concentration are 

Ah = 14 (^j [15.48.3] 


15.48.7 Method of de Faveri, Hanzevack and Delaney 

Recognizing that in many instances the release of interest 
is not a continuous one, but a relatively short one, de Faveri, 
Hanzevack and Delaney (1982) have described an extension 
to Hanzevack’s method which allows for this. The authors 
conducted experiments in which 10-min time-averaged 
concentrations were measured for (1) continuous releases 
and (2) 10-min releases, and obtained the ratio of the two 
time-averaged concentrations. This ratio should theoreti¬ 
cally lie between 1 and 3. Their results indicate a ratio of 
approximately 2. 


15.48.8 Bodurtha method 

In addition to the method of Bodurtha and Walsh, descri¬ 
bed in Section 15.48.5, Bodurtha (1988) has also given 
another method for safe discharge of dense flammable 

The method is based on an adaptation of the Hoot, 
Meroney and Peterka (HMP) model. As discussed by 
Bodurtha (1980), the touchdown concentration passes 
through a maximum with stack gas outlet velocity, which 
the author terms the critical stack gas outlet velocity v s cr 
The expression given by the author for this velocity is 


3.73D°- 684 (i?Q/L) 105 

jjj*W8£2.05 


10“ 3 


[15.48.5] 




A = s a67 /(s - l) 0 ' 33 [15.48.6] 

&mM w T a /29T a [15.48.7] 

Qn = L/p [15.48.8] 


and 

where D is the internal diameter of the stack (m), h is the 
height of the stack (m), Ah is the plume rise (m), Q is 
the mass rate of release (g/s), u is the wind speed (m/s), v s 
is the stack gas outlet velocity (m/s), p is the density of the 
gas mixture (kg/m 3 ), j£ cr is the critical ground level con¬ 
centration (pg/m 3 ) and subscripts a and s denote air and 
stack gas, respectively. The relations apply to a 1-h time- 
averaged concentration. 

Ci and C 2 are empirical constants obtained from the 
experimental data. In adjusting concentrations averaged 
over other time periods to the 1-hour average, use was made 
of Equation 15.16.45 with a value of the index p measured 
as 0.5. 

For design, a more conservative approach is suggested 
with the two constants Ci and C 2 replaced by constants C 3 
and C4, respectively.The values given for the four constants 


Cl 

c 2 

c 3 c 4 

Ps<Pa 6 

0.012 

3 0.02 

As > Pa 2 

0.027 

1 0.044 


The more conservative values thus incorporate a safety 
factor of about 2. 


where C m is the maximum permissible value of the touch¬ 
down concentration of the contaminant (% v/v), C s is the 
concentration of the contaminant in the stack gas (% v/v), 
D is the internal diameter of the stack (mm), L is the lower 
flammability limit (% v/v), M w is the molecular weight of 
the stack gas mixture, s is the specific gravity of the stack 
gas mixture relative to air, T a is the absolute temperature of 
the ambient air (K), T s is the absolute temperature of the 
stack gas (K), u is the wind speed (m/s), v s is the velocity of 
the stack gas (m/s), A is a parameter, /? is the applicable 
peak/mean concentration ratio, and subscript cr denotes 
critical. The value of the touchdown concentration C m pas¬ 
ses through a maximum with specific gravity, this maxi¬ 
mum occurring at a value of s = 2, and thus A = 1.59. 

Substitution of the critical value v SjCr of the stack gas 
outlet velocity in the HMP model yields the following 
expression for the required height of the stack: 


, 43.8D L35 (/?G 5 /.L4) 1 ' 05 lfl _ 6 

** ~ ,,0.702 X 1U 


[15.48.9] 


where h s is the height of the stack (m). 

The model is applicable to a release directed vertically 
upwards and only for stack gas specific gravity s > 1.15 and 
for stack gas outlet velocity v s less than the choked, or 
sonic, value. The author suggests that for design purposes 
the value of the wind speed be taken as u = 1 m/s. 

For the peak/mean concentration ratio ft Bodurtha 
quotes minimum and maximum values of 2.5 and 5, 
respectively, and states that the former is used in current 
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practice. This method is conservative in that the calcula¬ 
tion of the required stack height is based on the critical 
value Vg'Cr of the stack outlet velocity, whereas use of the 
actual stack outlet velocity v s will generally give a much 
lower stack height. 

Bodurtha gives several sample calculations. As an 
illustration, consider the first of his examples. The problem 
is stated in terms of the following values of the variables: 


For passive dispersion of a continuous release from a 
point source the relevant expression in the Pasquill- 
Gifford model is Equation 15.16.41. Considering concentra¬ 
tion on the centre line at ground level so thatjy = 0 and 2 = 0 
this equation reduces to 


C s = 100 v/v; L = 2.2% v/v; M w = 44; T a = 298K; 

T s = 298 K; u = lm/s; v s = 152.3 m/s; /J = 2.5 From the correlations given in Table 15.31 


Hence s = 1.52, A = 1.64, v ?>C r = 8.6 m/s and h s = 6.6 m. 
The degree of conservatism is indicated by the fact that the 
actual velocity v s is very much greater than the critical 


a, a * a9 [15.49.5a] 

b , cx *°' 85 [15.49.5b] 


15.49 Hazard Ranges for Dispersion 

It is convenient for certain purposes, such as comparison of 
models or preliminary hazard assessment, to have simple 
expressions for the downwind extent of particular con¬ 
centrations, such as lower flammability limits or toxic 
concentrations; in other words, for the hazard range. 

The variables which enter into the simpler correlations 
are generally the concentration, the downwind distance, 
the mass rate of release and the wind speed, and the treat¬ 
ment here is confined to these. 

15.49.1 Passive dispersion 

For passive dispersion of an instantaneous release from a 
point source the relevant expression in the Pasquill-Gifford 
model is Equation 15.16.40b. Considering concentration at 
the centre of the cloud at ground level so that x = ut, y = 0 
and 2 = 0, this equation reduces to 


Then relations 15.49.4 and 15.49.5 give for the hazard 
range x 



In this case the hazard range is a function both of the mass 
rate of release and of the wind speed. 

15.49.2 Dense gas dispersion 

It is less easy to derive analytical expressions for the 
hazard range of a dense gas. One approach is to correlate 
results from a number of runs of a dense gas dispersion 
model. The Second Convey Report gives for an instanta¬ 
neous release the following correlation derived from DENZ 
for propane and butane: 

R = kM° A [15.49.7] 


[15.49.1] 


From the correlations of Slade given in Table 15.31 and 
noting that it is usual to take a x = a y : 

a x = By a x 0M [15.49.2a] 

b , oc *°' 7 [15.49.2b] 

Then relations 15.49.1 and 15.49.2 give for the hazard range x 


where Af is mass of release (te), R is the downwind range (km) 
and k is a constant. It also gives the following additional 
relations for distance (km): maximum width = k\R\ distance 
to maximum width, X = k 2 R, and upwind range = ^ff.The 
values of the constants are shown inTable 15.60. 

A more detailed treatment on the same lines has been 
given by Considine and Grint (1985), who used DENZ and 
CRUNCH to obtain for propane and butane correlations for 
instantaneous and continuous releases, respectively. For a 
quasi-instantaneous release they give for any given dis¬ 
tance or dimension L the relation 


[15.49.8] 


In this case the hazard range is a function of the mass 
released, but not of the wind speed. 


where L is a distance/dimension (m), M is the mass 
released (te), k is a constant and n is an index for the 


Table 15.60 Constants for correlation of downwind extent of flammability limits, and other cloud distances, for 
instantaneous releases of propane and butane (HSE, 1981a) (Courtesy of HM Stationery Office) 


Constant Propane Butane 



LFL 

1/2 LFL 

LFL 

1/2 LFL 

D/5 

F/2 

D/5 

F/2 

D/5 

F/2 

D/5 

F/2 

k 

0.12 

0.17 

0.14 

0.21 

0.10 

0.14 

0.12 

0.16 

h 

0.8 

1.2 

0.8 

1.2 

1.0 

1.6 

1.0 

1.5 

k 2 

0.5 

0.4 

0.4 

0.4 

0.4 

1.2 

0.4 

0.2 

k 3 

0.1 

0.25 

0.1 

0.3 

0.2 

0.6 

0.2 

0.6 
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Table 15.61 Constants for downwind extent of flammability limits, and other cloud parameters, for instantaneous and 
continuous releases of propane and butane (Considine and Grint, 1985) (Courtesy of Gastech) 


A Dispersion of instantaneous release over land 


Constants for 

Pressurized 

propane 

Pressurized 

butane 

Refrigerated 

propane 

Refrigerated 

butane 


D/5 

F/ 2 

D/5 

F/2 

D/5 

F/2 

D/2 

F/2 

Value ofk 

Rlfl 

145.7 

112.5 

153.1 

143.1 

121.1 

147.2 

116.5 

139.8 

U 

13.1 

15.7 

12.2 

18.1 

29.6 

64.5 

31 

71.3 

f?UFL 

23.9 

10.2 

12.8 

15 

60.7 

56.5 

54.5 

44.5 

F max 

29.7 

32.1 

35.5 

41.7 

49.6 

92.4 

50.2 

96.9 

h 

5.6 

4.2 

4.8 

2.1 

3.0 

0.94 

3.12 

1.33 

Value ofn 

Rlfl 

0.294 

0.248 

0.319 

0.273 

0.383 

0.408 

0.386 

0.415 

U 

0.356 

0.374 

0.375 

0.374 

0.364 

0.351 

0.363 

0.346 

i?UFL 

0.241 

0.226 

0.382 

0.239 

0.392 

0.423 

0.393 

0.442 

F max 

0.34 

0.322 

0.349 

0.334 

0.390 

0.384 

0.391 

0.384 

h 

0.335 

0.340 

0.264 

0.353 

0.220 

0.237 

0.174 

0.175 


B Dispersion of instantaneous release over water (refrigerated gas) 


Constants for k n 


Propane Butane Propane Butane 



D/5 

F/2 

D/5 

F/2 

D/5 

F/2 

D/2 

F/2 

Rlfl 

174.1 

270.8 

104.9 

268.3 

0.351 

0.352 

0.335 

0.356 

U 

22.5 

36 

21.9 

38.1 

0.387 

0.405 

0.394 

0.404 

Rvfl 

109.4 

156 

98.64 

145.4 

0.337 

0.332 

0.342 

0.332 

F max 

49.8 

91.9 

50.2 

92.2 

0.389 

0.385 

0.390 

0.385 

h 

1.4 

0.843 

1.94 

0.683 

0.313 

0.277 

0.269 

0.276 

C Dispersion of continuous release ovei 

r land (pressurized and refrigerated gas 



Constants for 


k 





n 



Propane 

Butane 


Propane 

Butane 


D/5 

F/2 

D/5 

F/2 

D/5 

F/2 

D/2 

F/2 

Rlfl 

12.1 

44.2 

11.23 

41.9 

0.557 

0.571 

0.582 

0.574 

R\jfl 

6.25 

15.8 

5.53 

12.9 

0.553 

0.486 

0.553 

0.481 

h 

0.51 

0.34 

0.46 

0.29 

0.327 

0.323 

0.329 

0.330 

k* 

1.85 

5.47 

2.1 

6.0 

0.159 

0.145 

0.149 

0.142 

D Dispersion of continuous release ovei 

r water 






Constants for 


k 





n 



Propane 

Butane 

Propane 

Butane 


D/5 

F/2 

D/5 

F/2 

D/5 

F/2 

D/2 

F/2 

Rlfl 

19.4 

76.4 

18.71 

73.6 

0.524 

0.503 

0.526 

0.513 

Rvfl 

10.31 

31.6 

9.47 

27.65 

0.499 

0.408 

0.496 

0.404 

h 

0.403 

0.243 

0.390 

0.196 

0.343 

0.361 

0.349 

0.371 

r 

0.805 

2.16 

0.845 

2.25 

0.253 

0.262 

0.252 

0.248 


distance/dimension L. These parameters are given for the 
following dimensions: Rlfl, the downwind range to the 
LFL (m); f?uFL the downwind range to the UFL (m); Ulfl, 
the upwind range to the LFL (m); Y ma x , the maximum 
crosswind range of the LFL (m); and h the height of the 
cloud (m). 


The crosswind distance Fat any distance R downwind 
is given by 


Y =fc 


(Rlfl + Ulfl) 2 J 


[15.49.9] 


(Rlfl + UlflY 
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For the cloud radius R c at any downwind distance R gives for the downwind distance x 


/?I.FL — R R> R(:r 

[15.49.10] 

[Yl + {R-X 1 ffl 2 R<R cr 

[15.49.11] 


n 2F2 m 

LFL Rlfl + C4fl 

[15.49.12] 

L 4Y^ ax (R LFL - t/ LFL l / 

[i 1 

|_ 2(i?LFL + £/lfl) 2 J / 

|_ (f?LFL + (4 fl) 2 J 


[15.49.13] 


F| .JhlWOal“ [15.49.14] 
1 (i?LFL + C4 fl) 2 J 


where R is the downwind distance (m), R c is the radius of 
the cloud (m), R CI is a range transition criterion value (m), 
X\ is a downwind dimension (m), F is the crosswind dis¬ 
tance (m) and Fj is a crosswind dimension (m). 

For a continuously formed cloud the authors give for any 
given distance or dimension L the relation 


[15.49.15] 


where L is a distance/dimension (m), nu, is the mass rate of 
release of vapour (kg/s), k is a constant and n is an index for 
the distance/dimension L. These parameters are given for 
the following dimensions: f?uFL, the downwind range to the 
LFL (m); R UFL , the downwind range to the UFL (m); h, the 
height of the cloud (m); and k*, a constant (defined below). 
Then for a downwind distance R the crosswind distance Fis 


F = k*R 2/3 [15.49.16] 

The values of the constants are shown in Table 15.61. The 
flammable inventory of the cloud is 


[15.49.17] 


where I is the inventory (kg) and u is the wind speed (m/s). 

The authors also give guidance for the case of a flam¬ 
mable gas cloud where the release is neither truly instan¬ 
taneous nor continuous, but transient. The procedure 
suggested is to evaluate J? LF l and the arrival time T a from 

T a =R LFL /u [15.49.18] 


* cx Q°' 25 « r °e?f [15.49.19] 

where Q 0 is the volume released, u Tet is the wind speed at 
the reference height and x is the downwind distance. For a 
continuous release Equation 15.34.10 yields 

* oc q 0 o A [15.49.20] 

where q 0 is the volumetric rate of release. In this case there 
is no dependence on wind speed. Further details, including 
the range of applicability of these equations, are given in 
Section 15.34. 

15.50 Transformation and Removal Processes 

There are various transformation and removal processes 
which a gaseous or particulate pollutant may undergo in 
the atmosphere. These may need to be considered in rela¬ 
tion to acute accidental releases, although in general they 
are more relevant to long-term pollution. Accounts of these 
processes include those given by Chamberlain (1953), van 
der Hoven (1968), Csanady (1973), Hosker (1974), Gifford 
(1976a), Hales (1976) and S.R. Hanna, Briggs and Hosker 
(1982). Processes of transformation and removal include: 

(1) chemical transformations; 

(2) physical transformations; 

(3) dry deposition 

(a) gravitational settling, 

(b) small particle deposition; 

(4) wet deposition 

(a) rainout, 

(b) washout. 

An account is now given of the models and parameters for 
these various processes. 

15.50.1 Chemical transformations 

Atmospheric reactions may occur in the gaseous or aqueous 
phase and may be conventional reactions or photochemical 
reactions. There is a large literature on atmospheric 
chemistry which includes Chemistry of the Atmosphere 
(McEwan and Phillips, 1975), Atmospheric Chemistry 
(Heicklen, 1976) and Atmospheric Chemistry (Meszaros, 
1981). Information on conventional reactions is given in 
standard texts and information on photochemical reactions 
is given by Leighton (1961), Calvert and Pitts (1966) and 
Demerjian, Kerr and Calvert (1974). A review of atmospheric 
photochemical reactions is given by Hales (1976). 

The decay of concentration due to chemical reaction is 
frequently modelled by a first order decay model: 


where T a is the arrival time (s). The release is treated as 
continuous if 7d > TJi, where 7^ is the duration of the 
release (s); otherwise the release is treated as an instanta¬ 
neous one, based on the total mass released over the dura¬ 
tion time. 

Correlations obtained in this way are only as good as the 
model from which they are derived. The reliability of the 
hazard ranges predicted by dense gas dispersion models 
has been discussed in Section 15.41. 

Explicit expressions for the downwind extent, or hazard 
range, are given in the Workbook by Britter and McQuaid 
(1988). For an instantaneous release Equation 15.34.21 


Z (f)=x(0)exp(-f/Tc) [15.50.1] 

where x is the concentration of the pollutant and t c is a 
chemical decay time constant. 

From Equation 15.50.1, the half-life fi /2 of the concentra¬ 
tion is 

tyz = 0.693/t c [15.50.2] 


15.50.2 Physical transformations 

Physical transformations are relevant principally to liquid 
particles, or aerosols. They include: nucleation, in which a 
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liquid particle is created by condensation of vapour; 
condensation, in which further vapour condenses onto an 
existing particle; and coagulation, in which particles 
come together to form a larger particle. Another relevant 
physical process is the absorption of soluble gas in water 
particles. 

A case of particular relevance here is the behaviour of 
ammonia in humid air. A detailed discussion is given by 
Haddock and Williams (1978 SRD R103). An outline of their 
treatment of ammonia is presented in Section 15.42. 

15.50.3 Dry deposition 

In dry deposition of particles from a plume there are two 
distinct regimes. Deposition of larger particles is governed 
essentially by gravitational settling, while that of smaller 
particles is determined by turbulent motion. 

Gravitational settling of the larger particles, say of 
radius >5 pm, is given by Stokes law, or modifications of it. 
Stokes law, for spherical particles, is 



where r is the radius of the particle, v t is the terminal velo¬ 
city of the particle, p is the viscosity of the air, and p p is the 
density of the particle. 

For particles of radius greater than about 10-30 pm, 
Stokes’ law requires modification to take account of inertia 
and slip flow. Terminal velocities incorporating these cor¬ 
rections have been given by Hage (1964) for a particle of 
density 5 g/cm 3 . Hage’s work is described by van der Hoven 
(1968), and a plot derived from this work by S.R. Hanna, 
Briggs and Hosker (1982) is shown in Figure 15.148. For a 
particle of another density p p2 the corresponding value 



Radius (pm) 


Figure 15.148 Dry deposition from a dispersing cloud - 
gravitational settling speed of particles near earth’s 
surface (S.R. Hanna, Briggs and Hosker, 1982). 

Particle density 5 g/cm 3 


of the terminal velocity v a may be obtained from the stand¬ 
ard value of the density p pl and from the velocity v t i as 
given by the figure using the approximate relation, based 
on Equation 15.50.3: 

m = vti^ [15.50.4] 

Pp i 

For a non-spherical particle, an equivalent radius r e may be 
defined as 


[15.50.5] 


where F p is the volume of the particle. The terminal velocity 
v tn of the particle may be estimated from the terminal 
velocity v ts of a spherical particle with radius r equal to its 
equivalent radius r e using an empirical dynamical shape 
factor a defined by 

t'tn = %/a [15.50.6] 

Values of the dynamical shape factor are given by 
Chamberlain (1975). For a cylinder with a 1:1 ratio of axes 
the value of the factor is 1.06 and for a ratio of 4:1 it is 1.32. 

As stated above, the gravitational settling regime starts 
at a particle radius of about 5 pm, which corresponds to a 
terminal velocity of about 1 cm/s. There are a number of 
models for dry deposition and the appropriate model 
depends on the regime, and hence on the particle radius. For 
deposition of particles with a terminal velocity > 100 cm/s, 
which corresponds to a radius of about 100 pm, it is sug¬ 
gested by van der Hoven that gravitational settling is so 
fast that it may be determined from the terminal velocity 
and the wind speed using a conventional ballistic approach. 

For particles with terminal velocity in the range 
1-100 cm/s the deposition rate co is defined as 

® = « g Z [15.50.1 


where v g is the fall velocity. 

The main model in this regime is the tilted plume model 
for an elevated source. In this model the height H of the 
source is modified with distance by the term xvju as 
shown in Figure 15.149. Then the Sutton relation for a 
release from an elevated continuous point source given in 
Equation 15.16.29 may be modified to give 


= * e 

IlCyQttX 2 -” 



Figure 15.149 Dry deposition from a dispersing 
cloud - tilted plume model (S.R. Hanna, Briggs and 
Hosker, 1982) 
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The effect of depletion of the cloud may be taken into 2Q va / *" _2 y 2 \ 

account by modifying Equation 15.50.7 by a depletion fac- ( -° = , exp I -x n ~ „ 1 [15.50.14] 

tor F] so that the deposition rate becomes n y z \ y ) 


co = FvgX [15.50.9] 

This depletion factor has been given by Csanady (1955) as 


Chamberlain has also given a model for an elevated source. 

An alternative model given by van der Hoven is derived 
from the Pasquill-Gifford equations. The depletion of the 
source is obtained as follows: 


F 1 (l-n/2)(Hu/xv g -T)+2 [15.50.10] 

The tilted plume model is applicable only in the well-mixed 
boundary layer such as occurs in daytime adiabatic 
conditions. 

For smaller particles with a terminal velocity of <1 cm/s, 
the deposition rate is defined in terms of the deposition 
velocity v d : 

co = VAX [15.50.11] 


dQ* f 00 , 

^L aiy 

(2\v a Q x ( h 2 \ 


which on integration yields 


Q* = 
Q 0 ~ 


hr 


d* 

oiexp(/t z /o|)J 


[15.50.15] 


15.50.17] 


Models available for the deposition of such particles are 
discussed by van der Hoven (1968). One is the model by 
Chamberlain (1953). For a ground level continuous point 
source this author modifies the Sutton relations to obtain 
for an initial source strength Q a an effective source 
strength Q x at distance x using the depletion term 


4v A x n l 2 \ 
nun^CJ 


[15.50.12] 


This correction is then applied to the Pasquill-Gifford 
equation for a release from an elevated continuous point 
source (Equation 15.16.43) to yield for the ground level 
concentration 

x{X ’ y,0) %<i« eXp [“(|f + Sf)] [15 - 5018] 


This correction is then applied to Sutton’s relation for a 
release from a ground level continuous point source given 
by Equation 15.16.27 to yield for the ground level 
concentration 


|15 - 50131 

and for the deposition rate from Equations 15.50.11 and 
15.50.13 


and for the deposition rate from Equations 15.50.11 and 
15.50.18 


T ex p - ks+wi 


[15.50.19] 


Evaluations of Equation 15.50.17 based on numerical inte¬ 
gration have been made by van der Hoven (1968) for 
Pasquill categories A-F for a wind speed u = 1 m/s and a 
deposition velocity va = 10~ 2 m/s. Figure 15.150 shows 



Figure 15.150 Dry deposition from a dispersing cloud - effect of distance on source depletion fraction (van der Hoven, 
1968). Weather conditions D/1; wind speed - 1 m/s; deposition velocity 10 2 m/s 
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his plot for D conditions, while Table 15.62 summarizes the 
other plots in terms of the times at which Q x falls to half its 
initial value of Q a . For other wind speeds and deposition 
velocities use may be made of the relation 


(tHtr'”* |i5 - 50 - 201 

where subscripts 1 and 2 refer to the standard conditions 
used by van der Hoven, as given in Figure 15.150, and to the 
conditions of interest, respectively. 

Another model used for small particles is the partial 
reflection model of Overcamp (1976). The model is based on 
the Pasquill-Gifford relations and incorporates both the 
tilted plume approach to deal with the gravitational settling 
of larger particles and a reflection coefficient a which 
qualifies the ‘image’ term, or term containing (z +h). The 
basic equation is 


+ a(^ G )exp< 


-*W«)] 2 | 


2 <J 2 Z 


X ( X 1 v t + Vd + 
and where x G is obtained from the implicit equation 


2p d 


(*■ 


v t x G \ < h(x) 




[15.50.23] 


Table 15.62 Source depletion fraction Q x /Q q given by 
the van der Hoven model for dry deposition (after van der 
Hoven, 1968) 


Pasquitt 

stability 

category 

Source 
height ( m) 


Distance (m) 


10 

100 

1000 

10,000 

A 

0 

0.90 

0.82 

0.75 



10 

1.0 

0.96 

0.90 



100 

1.0 

1.0 

1.0 


B 

0 

0.90 

0.80 

0.65 



10 

0.98 

0.95 

0.80 



100 

1.0 

1.0 

1.0 


C 

0 

0.90 

0.70 

0.60 

0.45 


10 

1.0 

1.0 

0.80 

0.60 


100 

1.0 

1.0 

1.0 

0.80 

E 

0 

0.90 

0.60 

0.15 

0.012 


10 

1.0 

1.0 

0.80 

0.10 


100 

1.0 

1.0 

1.0 

0.80 

F 

0 

0.90 

0.65 

0.40 

0.07 


10 

1.0 

1.0 

0.80 

0.20 


100 

1.0 

1.0 

1.0 

0.80 


Another model is the surface depletion model of Horst 
(1977). 

A comparison of the models available has been made by 
Horst (1979), who found that in the near field the partial 
reflection model was reasonably accurate and easy to use, 
while in the far field the source depletion model performed 

These models incorporate the deposition velocity which, 
as described below, is subject to considerable uncertainty 
and may be at least as great a source of error as inade¬ 
quacies in a particular model. 

15.50.4 Deposition velocity 

Reviews of the deposition velocity, which include extensive 
data, have been given by McMahon and Denison (1979) and 
by Sehmel (1980). The deposition velocity is defined by 
Equation 15.50.11. It should be noted that the surface area 
for deposition implied in this equation is the normal ground 
surface area, not the actual vegetation surface, which can 
be much greater. 

Sehmel lists a large number of variables which affect 
deposition velocity, divided into four categories: meteorol¬ 
ogy, surface, particle and gas. For particles of diameter 
>1 pm gravitational settling is dominant, while the move¬ 
ment of particles of diameter <0.1 pm is governed by 
Brownian motion. The deposition velocity tends to pass 
through a minimum with particle diameter and it may vary 
by two orders of magnitude. These effects are illustrated in 
Figure 15.151, which shows the variation of deposition 
velocity with particle diameter for grass surfaces. 

Deposition velocity is applicable to gases also. Inert 
gases have almost negligible deposition velocity, say 
10 _4 -10 _3 cm/s, but chemically or biologically active 
gases tend to have a much larger deposition velocity, typi¬ 
cally in the range 0.5-3 cm/s. Of interest in the present 
context are the deposition velocities of toxic gases. From 
data given by Sehmel, the ranges of deposition velocities of 
some typical toxic gases are as follows: 


Gas 

Deposition velocity (cm/s) 

Cl 2 

1.8-2.1 

so 2 

0.04-7.5 

HF 

1.6—3.7 

H 2 S 

0.015-0.38 


Deposition velocity is affected very strongly by the surface 
on which deposition takes place. Again there are order of 
magnitude differences between different surfaces. Sur¬ 
faces differ in the actual vegetation surface exposed. They 
also have different retention properties. Some deposition 
velocities for selected surfaces are shown in Figure 15.152. 

Deposition velocity is also affected by wind speed, 
roughness length and friction velocity, but these effects are 
less readily characterized and are a matter of some debate. 

A method for prediction of deposition velocity has been 
given by Sehmel and Hodgson (1978), but prediction 
remains subject to considerable uncertainty. 

15.50.5 Wet deposition 

In wet deposition due to rain, a distinction may in principle 
be made between scavenging within clouds (or rainout) and 
below clouds (or washout), but in practice these two are 
generally treated as a single process. 













EMISSION AND DISPERSION 15/299 



Figure 15.151 Dry deposition from a dispersing cloud - effect of particle diameter on deposition velocity of particles to 
grass (McMahon and Denison, 1979) (Courtesy of Pergamon Press) 


Wet deposition of a pollutant is often treated empirically 
in terms of the washout ratio W r : 

W r = k 0 /Xo [15.50.24] 

where x is the concentration of pollutant in the air, k is the 
concentration of pollutant in the rainwater and subscript o 
denotes the reference height. 

Use is also made of an alternative washout ratio W( 

K = pA/Xo [15.50.25] 

where F is the concentration of pollutant in the rainwater 
and p a is the density of air. The difference between k and F 
is that the first has units of mass per unit volume and the 
second has units of mass per unit mass. The relation 
between the two washout ratios is: 

W' r = p a W r /p w [15.50.26] 

where p w is the density of water. The flux of pollutant to the 
surface F w is 

F w = k 0 J 0 [15.50.27] 

where/ D is the equivalent rainfall rate. Hence from Equa¬ 
tion 15.50.24 

F v = WrXoJo [15.50.28] 

A wet deposition velocity v w may be defined 

[15.50.29a] 
[15.50.29b] 


An alternative approach is that based on the washout coef¬ 
ficient, or scavenging coefficient A. The decay of the con¬ 
centration of pollutant due to scavenging is frequently 
modelled by a first-order decay model 

x(t) = x(0)exp(—Af) [15.50.30] 

It may readily be shown, by deriving Equation 15.50.8 from 
the unsteady-state mass balance, that the same washout 
coefficient may also be defined in terms of the relation 
between the interphase transport rate w and the con¬ 
centration x- 

w = Ax [15.50.31] 

The flux of pollutant _F W through a wetted plume of height 


£,*.•/ W wd2 [15.50.32a] 

e=| W Axdz [15.50.32b] 

For a Gaussian plume from a continuous point source the 
concentration x may be obtained from Equation 15.16.41. 
Then, integrating this equation with respect to z from 0 to 
oo, the effective concentration x e over the height z w is 



= F w /x 0 

= WrJo 


[15.50.33] 
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Figure 15.152 Dry deposition from a dispersing cloud - effect of deposition surface on deposition velocity of sulfur 
dioxide (Sehmel, 1980) (Courtesy of Pergamon Press) 


Assuming constant A and substituting / e from Equation 
15.50.33 for / in Equation 15.50.32b gives 


undergo an irreversible reaction, it is liable to be desorbed 
as it passes through a zone of lower gas concentration. 


Fy, 


A Q 

(2 n) v \u 




On the centre line 


F w 


A Q 


15.50.6 Washout ratio and washout coefficient 

[15.50.34] The washout ratio W r is an essentially empirical parameter. 

Data on the washout ratio have been given by McMahon 
and Denison (1979). The washout ratio tends to decrease 
with rainfall. As a rule of thumb, it halves for each order of 
magnitude increase in rainfall. The washout coefficient, or 
,, _ „„ scavenging coefficient, A has been estimated theoretically 

^ ' for certain situations. The following relation has been given 

by Chamberlain (1953): 


The use of a constant washout coefficient is a rather crude 
approximation. Strictly, it is applicable only to single size, 
or monodisperse, rain drops. Data on the washout coeffi¬ 
cient for polydisperse systems have been given by Dana 
and Hales (1976). 

It may be noted that for a polydisperse system the use of 
the geometric mean drop size tends appreciably to under¬ 
estimate the washout coefficient. Another problem in the 
use of a constant washout coefficient concerns the absorp¬ 
tion of gas in rain drops. If an absorbed gas does not 


A = jf A s N s v s E ds [15.50.36] 

where is the cross-sectional area of a drop of radius s, N s 
is the number of drops per unit volume per unit time, v s is 
the velocity of the drops and E is the collection efficiency 
and subscript max denotes maximum. 

Chamberlain used Equation 15.50.36 to determine theo¬ 
retical values of the washout coefficient as a function of the 
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velocity v s and the rainfall, as shown in Figure 15.153. 
Experimental work by F.G. May (1958) on the washout 
of Lycopodium spores has shown good agreement with 
theory, as shown in Table 15.63. 

The washout coefficient is a function of the physical and 
chemical characteristics and of the raindrop size distribu¬ 
tion and the rainfall. In many cases where the system is not 
so well defined as that just described theoretical estimates 
may be less satisfactory. In such cases it is necessary to fall 
back on empirical values. Data on the washout coefficient 
have been given by McMahon and Denison (1979). 


15.51 Infiltration into Buildings 

In most toxic release scenarios, the major part of 
the population in the path of the gas cloud is likely to 





Rate of rainfall (mm/h) 


Figure 15.153 Wet deposition from a dispersing cloud - 
effect of rate of rainfall on washout coefficient (Chamber- 
lain, 1953) (Adapted from Deposition of Aerosols and 
Vapours in Rain, graph of A.C. Chamberlain (1955), the 
original graph being used by kind permission of AEA 
Technology) 


be indoors. The mitigating effect of such shelter can 
be appreciable. It is therefore necessary to be able to esti¬ 
mate the indoor concentrations. Discussions of air infiltra¬ 
tion relevant to hazard assessment have been given in 
Meteorology and Atomic Energy (Slade, 1968) and the 
Rasmussen Report (AEC, 1975) and by Haastrup (1984) and 
P.C. Davies and Purdy (1986). 

The degree of protection given by a building depends on 
the frequency of the air changes, or ventilation rate. The 
latter is a function of the construction and topographical 
situation of the building, of the wind speed and direction, 
of the difference between the outside and inside tempera¬ 
tures and of the number of doors and windows left open. 


15.51.1 Models of infiltration 

The infiltration of air into a building is usually modelled by 
assuming that the air in the building space is perfectly 
mixed so that 

^ = X(c 0 - cj) [15.51.1] 

where c is the concentration (various units), / is the time 
(h) and X is the ventilation constant (h -1 ) and subscripts i 
and o refer to indoor and outdoor, respectively. The ven¬ 
tilation constant is equal to the frequency of the air 
changes, is generally also referred to as the ventilation 
rate and is most often expressed as air changes per hour 
(ach). Imperfect mixing may be allowed for, as described 
below. 

In the general case, where the outdoor concentration 
profile c 0 t is arbitrary, the indoor concentration is obtained 
from Equation 15.51.1 numerically. 

For the case where the outdoor concentration profile, or 
forcing function, takes the form of a pulse, with 

Co (t < t 0 ) = c 0 [15.51.2a] 

c„(t > t 0 ) = 0 [15.51.2b] 

as shown in Figure 15.154(a), an analytical solution is 
available. If the outdoor concentration undergoes a step 
change from zero to c 0 and then persists to time t B , the rise of 
the indoor concentration is obtained by integrating Equa¬ 
tion 15.51.1 to give 

Cj == c 0 [l - exp(-Af 0 )] [15.51.3] 


Table 15.63 Washout coefficient for Lycopodium spores (after May, 1958) (Courtesy of The Royal Meteorological 
Society) 


Type of rain 

Rate of rainfall 
(mm /h) 

Wind velocity 
(cm/s) 

Washout coefficient, A10 4 /s 


Observed 

Theoretical 

Frontal 

3.91 

320 

10.2 

9.7 

Frontal 

1.12 

543 

4.2 

3.6 

Heavy frontal 

14.1 

845 

30.8 

26.8 

Frontal 

1.01 

334 

3.2 

3.2 

Continuous rain 
of showery type 

3.64 

332 

8.9 

9.2 
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Outdoors 
ES3 Indoors 



T (a ) 6 



and the toxic load is generally defined 

as 

L-/«( 

[15.51.7] 

where D is the toxic dose (units h) and L is the toxic load 
(units” h). 

It is shown below that for the pulse model the ratio of the 
indoor dose A to the outdoor dose D 0 is unity. For the step 
model it is readily shown from Equation 15.51.3 that 

A l-exp(-A) 

D 0 ' Xt 

[15.51.8] 

An extension of the pulse model in ter 
been given by Haastrup (1984), who 
lowing relations: 

ms of toxic load has 
has derived the fol- 

L 0 = J cjd t 

[15.51.9] 

A (t<t 0 ) = J $dt 

[15.51.10a] 

= <% J [1 - exp(-A)]” At 

[15.51.10b] 

A(/>4)= /°° c? At 

[15.51.10c] 

^ [1 —exp(—li 0 )] B 
c ° ;» 

[15.51.10d] 


The ratio R of the indoor to the outdoor toxic load is then 


Figure 15.154 Infiltration of gas into buildings - 
outdoor and indoor concentration profiles for a 
rectangular pulse forcing function (Pietersen, 1986c): 
(a) short pulse, low ventilation rate; and (b) long pulse, 
high ventilation rate 


R Jg ex P^ *T ,exp(-A)]” At d 5.51.11] 
It may be noted that if n = 1, Equation 15.51.11 simplifies to 


If the outdoor concentration then falls to zero, the decay of 
the indoor concentration from its maximum value Ci(t 0 ) is 
again obtained by integrating Equation 15.51.1: 


4 = Ci(/„)exp[-A(f - /„)] [15.51.4] 

» c„[l - exp(-f 0 )]exp[—A(f - 4)] [15.51.5] 


R = ^- = t [15.51.12] 

For low values of the group Xt B it can be shown that 
L i (t>t 0 ) >A(/<4) [15.51.13] 

In other words, the total indoor load is dominated by the 
load during the decay period, or tail. For this case 


This yields the concentration profile shown in Figure 
15.154(b). 

This rectangular pulse model may be used to obtain an 
approximate estimate of the indoor concentrations both for 
a puff from a nominally instantaneous release and for a 
plume from a short-duration continuous release. For a long- 
duration continuous release the appropriate model is a step 
forcing function and the indoor concentration is given by 
Equation 15.51.3. 

In assessing the effect of a toxic gas, however, it is fre¬ 
quently necessary to work in terms of toxic dose or, more 
generally, toxic load rather than of concentration. The toxic 
dose is defined as 

D = J c At [15.51.6] 


exp(-A) rsl-Xt A <0.1 [15.51.14] 

Then 

A » Li(t > 4) [15.51.15] 

and from Equations 15.51.10b and 15.51.14 

A = [15.51.16] 

If the building space is not perfectly mixed, the effect of 
imperfect mixing may be taken into account in the model 
by substituting for the ventilation rate X an effective 
ventilation rate X'. The effective ventilation rate may be 
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determined by applying to the ventilation rate a mixing 
efficiency factor k: 

M = kX [15.51.17] 

15.51.2 Ventilation rate 

The ventilation of a building may be natural or mechanical. 
For the assessment of toxic hazard it is normally natural 
ventilation which is relevant. Information on ventilation is 
available from a number of sources. These include Princi¬ 
ples of Modern Building (Building Research Establishment, 
1959), the CIBS Guide Parti A4 Air Infiltration (Chartered 
Institute of Building Services, 1976) and BS 5925: 1991 
Code of Practice: Ventilation Principles and Designing for 
Natural Ventilation. 

The equations for air infiltration given by these sources 
have been reviewed by Brighton (1986). They are all based 
on following relation: 

Q = M(^) ' [15.51.18] 

where A is the area of the aperture (m 2 ), A p is the pressure 
drop (N/m 2 ), Q is the volumetric flow of air (m 3 /s), p B is the 
density of the ambient air (kg/m 3 ) and ki is a constant. 
Equation 15.51.18 is based on Bernouilli’s theorem and the 
constant is related to the contraction ratio of the emerging 
jet. For this constant 4 Brighton gives a compromise value 
of 0.88. 

Work on air infiltration into houses is done for a number 
of purposes. These include the comfort of the occupants, 


the safety of gas appliances and the saving of energy. In the 
latter case the emphasis is on eliminating infiltration, 
and work in this area illustrates the high degree of leak- 
tightness which can be achieved. 

Studies of air infiltration into houses in Britain have 
been done at the Building Research Establishment (BRE). 
Work has been published by Dick (1949,1950a,b), Dick and 
Thomas (1951), Brundrett (1977) and Warren and Webb 
(1980a, b). 

Air infiltration is due to the existence of pressure differ¬ 
ence between the outside and inside of the building and this 
pressure difference may be caused by wind or by air tem¬ 
perature, and hence air density, or buoyancy, difference. 
The ventilation rate due to wind effects may be expressed as 

Xy, = k 2 u [15.51.19] 

and that due to buoyancy effects as 

4 = k 3 (AT) 1/2 [15.51.20] 

where AT is the temperature difference between outdoors 
and indoors (°C), u is the wind speed (m/s), 4 is the venti¬ 
lation rate due to buoyancy (nr/h), 4, is the ventilation 
rate due to wind (m 3 /h), and k 2 and k 3 are constants. 
Figure 15.155 shows data obtained by Dick and Thomas 
(1951) in work at the BRE on the effect of temperature dif¬ 
ference and wind speed on ventilation rate. 

In considering ventilation rate it is necessary to distin¬ 
guish between closed houses and occupied houses, the 



(AT °C)l 
(a) 



Wind speed u (m/s) 
(b) 


Figure 15.155 Infiltration of gas into buildings - effect of buoyancy and wind on house ventilation rate (Dick and 
Thomas, 1951): (a) effect of buoyancy (temperature difference): (b) effect of wind speed, o, house with no vents 
open; x, house with three bedroom vents open. (Courtesy of the Chartered Institution of Building Services Engineers) 
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difference being that the latter typically have some 
windows open. The BRE work includes correlations for the 
ventilation rate of a closed house as a function of wind 
speed. RC. Davies and Purdy (1986) have presented ver¬ 
sions of these equations modified so that the wind speed is 
that at the standard 10 m height. These are: 

Exposed site 

X = 0.87 + 0.13m [15.51.21] 

Sheltered site 

X = 0.88 u < 4.2 [15.51.22a] 

X = 0.22m u > 4.2 [15.51.22b] 

Davies and Purdy give the following relation as the most 
recent BRE infiltration model: 

X = X s (hAT li + k 5 u 2A ) 0S [15.51.23] 

where A s is the ventilation rate measured at standard 
conditions ( h _1 ) and k 4 and k 5 are constants. 

The distribution of infiltration between the different 
apertures in the building has been investigated by Warren 
and Webb (1980b). For a typical house with a pressure dif¬ 
ference of 50 Pa and an air infiltration rate of 3000 m 3 /h 
they found the following distribution: 



Contribution to t 

lir infiltration 

(m 3 /h) 

(%) 

Windows and WC fan 

940 

31.3 

Back door 

280 

9.3 

Skirting boards 

575 

19.2 

Lights, plugs, pipes, etc 

85 

2.8 

Other sources 

1120 

37.4 


For occupied houses it is necessary to take into account the 
effect of open windows. The relation given by Dick and 
Thomas (1951) for houses with open windows is 


X = 0.87 + 0.13m + 0.23(w + lAm) + 0.05(« +1.4 m)u 

[15.51.24] 

where m is the number of open casement windows and n is 
the number of open top-vent windows. Equation 15.51.24 is 


based on a study on an estate at Abbotts Langley. 
The following data were obtained on the number of 
windows open: 



Abbotts 

Bucknalls 


Langley 

Close 

Casement windows 

0.25 

0.4 

open, m 

Vent windows open, n 

1.75 

3 


Abbotts Langley is an exposed site and Bucknalls Close a 
sheltered one. 

The number of windows open depends on a number of 
factors, including the degree of exposure, the season, the 
time of day, the wind speed, the outside temperature and 
the number of occupants. These factors are discussed in 
detail by Davies and Purdy. Many of the factors tend to 
cancel out. For example, the number of windows open on an 
exposed site tends to be less than on a sheltered site. Like¬ 
wise, the number open in summer is greater than in winter, 
but the buoyancy effect is less. 

Information on room ventilation rates from the work of 
Warren and Webb is givenTable 15.64. The best estimates of 
whole house ventilation rates given by Davies and Purdy 
are shown in Table 15.65. 

Data for air infiltration into British houses are not 
necessarily applicable in other countries. The ventilation 
rates for American houses are less and those for Swedish 
houses much less. Data given by Kronvall (1978) indicate 
that ventilation rates for Swedish houses are about a quar¬ 
ter those in Britain. Data on ventilation rates for buildings 
in the United States have been given by Handley and Barton 
(1973). The work of Handley and Barton also shows, how¬ 
ever, that there is a wide range of ventilation rates. They 
found values from 0.07 to 3.0 air changes/h. 

15.51.3 Hazard assessments 

The mitigating effect of shelter is considered in the First 
Convey Report in Appendix 7 by Beattie, who quotes 
Equation 15.51.3 and suggests that a suitable value of the 
ventilation rate X is 1 change/h for a modern building, but 
that this may rise to 2-3 changes/h if doors or windows are 
left ajar. 

In the Rijnmond Report credit is taken for the effect 
of shelter using Equation 15.51.1. A ventilation rate of 
2 changes/h is used, but it is stated that this could be as 
low as 1 or as high as 3. 


Table 15.64 Room ventilation rated 1 (after P.R. Warren and Webb, 1980b) (Courtesy of the Chartered Institute of 
Building Services Engineers) 


Room 


Room ventilation rate (air changes/h) 


Mean 

Minimum 

Maximum 

Living room 

0.89 

0.24 

1.64 

Kitchen 

1.43 

0.43 

3.50 

Small bedroom (<15 m 3 ) 

0.87 

0.28 

2.90 b 

Large bedroom (>15 m 3 ) 

0.65 

0.25 

1.19 

Bathroom 

1.81 

0.25 

3.19 


a Number of rooms in sample ranged from 14 to 29. 

b This value corrected from one of 3.9 in the original paper (P.R. Warren, 1992). 
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Table 15.65 Whole house ventilation rates (after P.C. Davies and Purdy, 1986) (Courtesy of the Institution of 
Chemical Engineers) 


Ventilation (air changes/h) a,b 

D/2.4 

D/4.3 

D/6.7 

F/2.4 

Closed house 1 

Normal occupied house 2 

1 

2 

1.5 

3 

1 

2 

a Best estimate. 

b Values used by Pape and Nussey (1985) for these four stability category/wind speed combinations a 

ire 0.7, 1, 1.5 and 0.5 a 

ir changes/h, 


respectively. 


15.52 Source and Dispersion Modelling: CCPS 
Guidelines 

The CCPS has issued two publications giving practical 
guidance on emission and dispersion of hazardous 
materials. These are now described. 


15.52.1 Guidelines for Use of Vapor Cloud Dispersion 
Models 

The CCPS Guidelines for the Use of Vapor Cloud Dispersion 
Models (the CCPS Vapor Cloud Dispersion Model Guidelines) 
(1987/2) covers both emission and dispersion. The Guide¬ 
lines give an overview of release scenarios, particularly 
pipe ruptures, vessel rupture and reactor venting, review 
the dominant phenomena of initial acceleration and dilu¬ 
tion, buoyancy and atmospheric turbulence, and give a 
decision tree for handling the scenarios. A selection of 
release scenarios is given, and amplified in an appendix. 
The characteristics of routine and accidental releases are 
compared. 

Models are given for the determination of emission 
flows. These include: two-phase flow; flow from tanks 
under liquid head as well as pressure; and flow from pipe¬ 
lines. Models for various types of jet are covered. Models 
for vaporization from pools include both heat and mass 
transfer limited cases and spreading pools. A critical 
review is given of pool vaporization models. 

For gas dispersion, separate treatments are given for 
ground level and elevated releases. An overview is given of 
passive gas dispersion, including the Pasquill-Gifford 
model, the Pasquill stability categories and correlations for 
dispersion coefficients. The set of six models contained in 
the EPAUNAMAP6 system is outlined. 

The variety in type and origin of dense gas dispersion 
models is described. The authors state that there are some 
100 models, with 10 further models being created annually. 
Many existing models continue to undergo development 
and to acquire new features. 

Dense gas dispersion is considered first in the absence of 
heat effects. The box model of van Ulden is outlined. The 
authors then derive for dense gas dispersion a number of 
simplified relations for cloud dimensions and concentra¬ 
tion, and compare them with theThorney Island trials data. 

Accounts are then given of the thermodynamic and heat 
transfer phenomena and of correlations used for air 
entrainment.The three-dimensional models considered are 
FEM3 and MERCURE-GL. The review given of the criteria 
utilized by various workers for effectively passive disper¬ 
sion brings out the large disparities in the criteria adopted. 
Physical modelling is described, particularly in respect 
of plume lift and complex terrain. The implications of 


concentration fluctuations are treated and the effect of 
sampling time and volume are discussed. 

A review is given of some principal dispersion models, 
covering some 40 models and giving a tabulation of 
the characteristics of each model. Four models are 
described in more detail: AIRTOX, DEGADIS, FEM3 and 
INPUFF. 

For elevated releases of dense gas the Guidelines give an 
overview of models for momentum jets and buoyant 
plumes. The use is described of an effective height in the 
Pasquill-Gifford model for handling plume rise and gas 
density. Momentum jet scenarios are classified and the 
model of D.J. Wilson (1979b) for a momentum jet from a 
pipeline is described. For plumes reference is made to the 
models of G.A. Briggs (1984) which are utilized in UNA- 
MAP. An account is given of the models of Ooms, Mahieu 
and Zelis (1974) and of Hoot, Meroney and Peterka (1973). A 
criterion is given for effectively dense gas dispersion in an 
elevated release. 

The Guidelines consider the extent to which models have 
been validated against field trials and the uncertainty in 
model estimates, and list some of the comparisons made 
between models and trials. They refer to the Environ¬ 
mental Protection Agency set of model evaluation pro¬ 
cedures for passive dispersion and give a number of 
measures of performance. 

The Guidelines give one of the few quantitative treat¬ 
ments of uncertainty in modelling. The sources of uncer¬ 
tainty considered are model physics, random variability 
and input data errors. A treatment is given of the effect on 
uncertainty of the number of model parameters. 


15.52.2 Workbook of Test Cases for Vapor Cloud 
Source Dispersion Models 

The CCPS Vapor Cloud Dispersion Model Guidelines are 
supplemented by the CCPS Workbook onTest CasesforVapor 
Cloud Source Dispersion Models (the CCPS Vapor Cloud 
Source Dispersion Model Workbook) (1989/8). The Workbook 
gives a set of emission, pool vaporization and jet models, 
and describes methods of matching the output of these 
models with the input required by selected dispersion 
models. The principal models treated are: for emission, the 
Fauske-Epstein models for liquids, subcooled liquids 
and saturated liquids; for vaporization, the Fleischer model 
for an evaporating pool; for jets, the Briggs momentum 
jet model and the Hoot, Meroney and Peterka dense gas 
jet model; and for gas dispersion, the Pasquill-Gifford 
model, CAMEO, the Ooms model, SPILLS, SLAB and 
DEGADIS. 

The criterion used to determine whether it is necessary 
to use for a continuous release a dense gas dispersion model 
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is Ri > 10 with 

11 = ^52 [15.52.1] 

u, m 0.065« [15.52.2] 

where D is the initial diameter of the plume, g' is the 
reduced gravity, u is the wind speed, u D is the velocity of 
release and u, is the ambient friction velocity. Five release 
scenarios are treated: 

(1) continuous jet release of gaseous butane from a vent 
stack; 

(2) continuous release of liquefied ammonia from a stor¬ 
age vessel 

(a) nozzle failure (liquid release), 

(b) line rupture (two-phase release); 

(3) continuous jet release of high pressure carbon 
monoxide gas from a low level source; 

(4) continuous two-phase release of liquefied chlorine 
from a storage vessel; 

(5) continuous release of liquid acetone into a bund. 

These are all continuous releases, the choice being delib¬ 
erate, since the models for instantaneous or transient 
releases are subject to more uncertainty. Likewise, the first 
four cases were selected because the excess density is sig¬ 
nificant and it is necessary to use a dense gas dispersion 
model. 

The Workbook gives detailed working for these five cases, 
with hand calculation of the sections on emission, vapori¬ 
zation, jet behaviour and interface to the dispersion model 
being followed by results of the gas dispersion computer 
codes. Several sample outputs are given from CAMEO, 
SPILLS, SLAB and DEGADIS. 

15.53 Vapour Release Mitigation: Containment and 
Barriers 

There are a number of methods of preventing or mitigating 
the dispersion of gases. They include the use of: 

(1) bunds 

(2) foam 

(3) solid barriers 

(4) fluid barriers 

(a) water spray barriers 

(b) steam curtains. 

An account of the effect of some of these devices on gas 
dispersion is given in Section 15.40. The results of field 
trials and of physical modelling are given in Sections 
15.37-15.39. Guidelines for vapour release mitigation have 
been given by Prugh (1985-, 1987b,c). The various meth¬ 
ods of prevention and mitigation are now considered. 

15.53.1 Bunds 

The rate of evaporation of a spill, particularly that of a 
refrigerated liquefied gas, can be greatly reduced if the 
spill is contained within a bund. In turn, the evaporation 
from the bund may be much reduced by appropriate design. 
Two principal features are the geometry and the substrate 
of the bund. A bund around a storage tank is generally 
designed to contain the contents of the tank. A bund with 
a smaller floor area but higher walls presents a smaller 


surface to heat up and vaporize the liquid. The higher wall 
also acts as a barrier to the flow of the vapour. 

The use of a suitable material for the substrate can 
greatly reduce the rate of heat transfer to the liquid. The 
relations for this heat transfer process are given in Section 
15.10. From Equation 15.10.30 the rate of heat transfer is 
proportional to the heat transfer parameter (k s p s c s ) 1/2 . 
Table 15.66 lists some values of this parameter for different 
substrates, as given by Dilwali and Mudan (1987). As the 
table indicates, there are differences of up to 16 in the values 
of the parameter. These authors describe a hazard assess¬ 
ment of the dispersion of the vapour from a spill of liquid 
chlorine into a bund. The study considered various designs 
of bund and showed that the distance to the concentration 
immediately dangerous to life and health could be reduced 
from 2.6 km for the base case to 320 m for an alternative 
design. Further, the provision of a bund facilitates the use 
in suitable cases of foam, which can effect a further large 
reduction in evaporation. 

15.53.2 Foam 

The use of foam is an effective means of reducing the rate of 
evaporation, where a suitable foam is available. Accounts 
of the testing of foams at facilities in 1986 at Pueblo, 
Colorado, and in 1988 at the Nevada Test Site (NTS) have 
been given by Dimaio, Norman and co -workers (Dimaio and 
Norman, 1988, 1990; Norman and Dimaio, 1989; Norman 
and Swihart, 1990). 

Foams tested included: Hazmat 2, an acid resistant foam; 
ARAFFF, an alcohol resistant AFFF foam; and a fluor- 
oprotein foam. Chemicals tested included bromine, chlor¬ 
ine, hydrogen fluoride, monomethylamine, phosphorous 
oxychloride, phosphorous pentachloride and sulphur 
dioxide. Using Hazmat 2 the proportional vapour suppres¬ 
sions achieved were as follows: bromine >95%; chlorine 
67-82%; hydrogen fluoride 70-85%; sulfur dioxide 
>61%. 

Foam acts by insulating the surface of the spill and pre¬ 
venting vaporization. Other modes of action include 
absorption of the vapour and scrubbing out of aerosol and 
particulate matter. Any foam used must be suitable for the 
application; the wrong foam can do more harm than good. 
A guide to the use of foam on hazardous materials has been 
published by Norman (1987). Likewise, water should only 
be used advisedly; incorrect use can make things worse. 

Table 15.66 Some values of the heat transfer parameter 
(k s p s c s ) 1/2 for different substrates (after Dilwali and 
Mudan, 1987) (Courtesy of the American Institute of 
Chemical Engineers) 


Material 

Heat transfer 
parameter {k s p s c s ) 1/2 
(W s 1/2 /m 2 K) 

Soil (dry) 

2570 

Sand (dry) 

2660 

Sand (wet: 3% moisture) 

2335 

Uninsulated concrete 

3750 

Insulated concrete 

230-440 

Polyurethane 

140 

Other insulating materials 


Celofoam 

99 

Foamglass 

74 
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Foam should be applied gently, possibly with continuous 
application or frequent reapplication. Personnel should be 
trained and should have suitable protective equipment, 
including self-contained breathing apparatus. 

15.53.3 Solid barriers 

A solid barrier such as a fence or wall can serve either to 
contain a gas cloud entirely or to effect an appreciable 
dilution. An impermeable barrier designed for this pur¬ 
pose and erected within the works is generally know as a 
vapour barrier. A barrier does not need to be impermeable 
to mitigate a gas release. A plantation of trees may provide a 
worthwhile degree of dilution of a gas cloud. 

15.53.4 Vapour barriers: Hawk programme 

As described in Section 15.37, two series of field trials have 
been conducted at the NTS on the mitigation of hydrogen 
fluoride releases. These trials were largely concerned with 
water spray barriers and are considered in Section 15.53.13. 
The second investigation, the Hawk programme, under the 
auspices of ICHMAP, also included a study of vapour bar¬ 
riers. An account of this work is given here. 

The programme on vapour barriers included a review of 
the effectiveness of vapour barriers and wind tunnel tests 
on such barriers. The review concluded that, whilst a 
vapour barrier reduces the near field concentrations, in the 
far field this effect decays. 

In the wind tunnel work, two types of configuration were 
tested. One consisted of vapour barriers or fences, with 
only partial enclosure of the gas cloud, and the other of 
vapour boxes, with complete enclosure. In addition, the 
effect of other types of plant obstacle was investigated. 

The work demonstrated that the effect of a vapour bar¬ 
rier is extremely dependent on the nature of the release, the 
site where the release occurs and the barrier design. The 
results were expressed as the ratio of the concentration 
without a vapour barrier or box to the concentration with 
a barrier or box - the concentration reduction factor. 



Typically, concentration reduction factors were of the order 
of 2-10 in the near field, falling to factors of unity in the far 
field, but with the latter ranging up to 4. 

There was concern that the use of a vapour box might 
aggravate the hazard of a vapour cloud explosion. Over¬ 
pressure increases with cloud height; a vapour box 
increases the cloud height and may therefore be expected 
to increase the overpressure. The effect was investigated 
using the FLAGS explosion simulation code. This con¬ 
firmed that the use of a vapour box does increase over¬ 
pressure. This effect may be mitigated by reducing the 
height of the box or by installing vents in it, but the over¬ 
pressure is still higher than without a box. 


15.53.5 Vapour barriers: FENCE62 

Meroney (1991) has described the use of a set of models with 
the generic title FENCE to simulate the behaviour of a 
dense gas cloud at a fence used as a vapour barrier, in par¬ 
ticular FENCE62. 

Models for the simulation of the dilution of a cloud of 
hydrogen fluoride are adaptations of the box model 
DENS62 and the slab model DENS23. For simulation of the 
effects of a vapour barrier the corresponding models are 
FENCE62 and FENCE23 and those for the effects of a water 
spray barrier are SPRAY62 and SPRAY23; SPRAY 65 is a 
modification of SPRAY62. 

These models were used to simulate the Goldfish field 
trials on the dispersion by a fence of a continuous release of 
hydrogen fluoride. Figure 15.156(a) shows the effect of 
fence height on the height of the cloud and Figure 15.156(b) 
the effect on the downwind concentration. These effects 
decay so that by about 200 fence heights downwind they 
have largely disappeared. 

The fence was found to be more effective in diluting the 
gas cloud if located near the source. For a fence placed 
within 400 m of the source, the dilution effects did not 
persist beyond about 1000 m. For a fence located 100 m from 



(b) 


Figure 15.156 Dispersion of dense gas at obstacles - predictions of FENCE62 for dispersion of hydrogen fluoride 
across barrier for Goldfish trial 1 (Meroney, 1991): (a) effect on plume height; (b) effect on centre line concentration 
(Courtesy of the American Institute of Chemical Engineers) 
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the source there was little effect of wind speed in the range 
l-8m/son either downwind cloud height or concentration. 

15.53.6 Water spray barriers 

A good deal of work has been done on the development of 
water spray barriers, or water curtains, as a means of 
mitigating the hazard from a gas release. The systems used 
include fixed water spray installations and mobile water 
spray monitors. Fixed installations are typically a set of 
spray nozzles several metres off the ground with the spray 
directed downwards. Such systems are used both in the 
open air and in buildings. A typical mobile monitor system 
is a set of spray nozzles inclined at an angle of approxi¬ 
mately 45° to the horizontal. Water sprays and curtains are 
used mainly against flammable gases, but may be applied 
against toxic gases also. 

A water spray directed vertically through a gas cloud 
will have a number of effects. These include: 

(1) mechanical effects of acting as a barrier to the passage 
of gas, of imparting upward momentum to a gas or of 
dispersion and dilution by air entrainment; 

(2) thermal effects by warming of cold gas; 

(3) physico-chemical effects of absorption of gas, without 
or with chemical reaction. 

A water spray barrier may be used for any of these 
purposes. 

Where a water spray barrier is used, consideration 
should be given to the need for arrangements to drain away 
the water used, particularly if the application may be 
prolonged. 

15.53.7 Water spray barriers: early work 

An experimental investigation of the effectiveness of water 
sprays against gas clouds has been described by Eggleston, 
Herrera and Pish (1976). The experimental rig was a set of 
water spray nozzles mounted on a frame initially 15 ft high, 
later modified to 20 ft, and directed downwards. Clouds of 
ethylene and vinyl chloride monomer vapour were directed 
towards the spray system at ground level. 

The water spray was effective as a vapour barrier in 
some experiments but not in others. The spray entrains air 
and pumps it down and horizontally outwards. If the velo¬ 
city of this air exceeds that of the vapour cloud, the spray 
acts as a barrier, otherwise it does not. Thus vapour clouds 
with velocities of 3 and 9 mile/h were stopped by sprays 
with 100 psig nozzle pressure, but only the former was 
stopped when the nozzle pressure was reduced to 40 psig. 
The vapour tended to spread out at ground level in front of 
the spray, but did not go over the top. 

The air entrainment rates obtained were in the range 
87-213 ft 3 /min air per US gal/min water with nozzle pres¬ 
sures in the range 20-90 psig. Total entrained air rates were 
in the range 1242-7107 fr/min. The velocity of the air 
pumped by the spray was low and the flow was therefore 
sensitive to any obstruction. In cases where the vapour 
cloud passed through the spray barrier there was still an 
appreciable dilution effect. The gases used are highly 
insoluble and the absorption effects were negligible. 

The effect of the water spray on the ignition of a flam¬ 
mable vapour cloud and on the flame speed in the cloud was 
also investigated. It was found that the water spray did 
not prevent ignition occurring and that the flame speed 
actually increased, probably due to the greater turbulence. 


Further experimental work on water sprays has been 
described by J.W. Watts (1976). Again the experimental rig 
was a set of nozzles mounted on a 20 ft high frame and 
directed downwards. Clouds of propane vapour were 
directed towards the spray system at ground level. 

Some experiments were done in which ignition sources 
in the form of cans of burning gasoline were located on the 
far side of the sprays. In cases where the spray was not an 
effective barrier the vapour cloud ignited and the flame 
passed back through the spray. 

Further experiments were carried out in a 13 ft high open 
rig with a single nozzle with the introduction of ethylene 
vapour through a pipe just below the nozzle. The flow of 
ethylene was increased until the concentration measured 
by gas detectors near the ground rose to just below the 
lower flammability limit. The maximum flow of ethylene 
controllable by the spray was 2609 lb/h with a calculated 
air entrainment rate of 23,600 ft 3 /min. 

Other experiments were done in which volumes of 
ethylene-air mixture held in polyethylene chambers were 
ignited by pentaerithrytol tetranitrate (PETN) and obser¬ 
vations were made of the conditions under which defla¬ 
gration and detonation were obtained. The volumes used 
were 500,4000 and 10,000 ft 3 .The authors state that given a 
sufficient charge of PETN detonation could be obtained, 
that the explosion yield was generally much higher with 
detonation than with deflagration, that the detonation lim¬ 
its were 5—10.5% and were thus narrower than the flam¬ 
mability limits, and that with a water spray in the chamber 
the strength of the PETN charge necessary to obtain deto¬ 
nation was considerably increased. 

The effectiveness of water sprays in suppressing com¬ 
bustion in mists of heat transfer media, specifically 
Dowtherm A, has been investigated by Vincent etal. (1976a) 
in a 6.5 ft diameter spherical vessel. It was shown that 
combustion could be suppressed and it was tentatively 
concluded that, for such mist droplets, the mechanism was 
one of scrubbing rather than quenching. 

Although in Watts’ work water sprays were not effective 
in arresting the passage of flames, Brasie (1976b) has 
described work at the Bureau of Mines in which flames in 
gas clouds were quenched by the use of very high nozzle 
pressures in the range 1000-2000 psig, which give a much 
finer spray. In this case the mechanism was considered to 
be one of quenching, the distance between the drops being 
less than the quenching distance of the gas. 

Experiments on the use of a water curtain generated by 
mobile monitors against a chlorine gas cloud have been 
described by the Ministry of Social Affairs (1975) in the 
Netherlands. A water curtain was successfully used to 
protect a small area against the gas cloud. 


15.53.8 Water spray barriers: air entrainment 

The design and application of a water spray barrier to 
entrain air into a gas cloud has been described in a series of 
studies by McQuaid. These include: the entrainment char¬ 
acteristics of a water spray barrier (McQuaid, 1975); the use 
of a water spray barrier to effect ventilation in mines 
(McQuaid, 1976a); the design of a water spray barrier to 
dilute flammable gas clouds (McQuaid, 1977); a compara¬ 
tive review of water spray barriers and steam curtains for 
dilution of flammable gas clouds (McQuaid, 1980); and 
the application to dense gas clouds. These aspects are 
described below. 
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An account of work on the entrainment of air by a water 
spray barrier has been given by McQuaid (1975), who has 
also described the application of this work to the design of 
water spray barriers for dispersion of gas clouds (McQuaid, 
1977). 

In order to dilute a gas cloud it is necessary to deliver 
air not only in sufficient quantity but also at a sufficient 
velocity. The relation for the flow of air Q a and the air velo¬ 
city Fat the base of the cone of spray cone with base dia¬ 
meter!) is 



where D is diameter of the spray cone (m), Q a is the volu¬ 
metric flow of air (m 3 /s) and V is the velocity of the 
entrained air (m/s). 

McQuaid obtained the following correlation for entrain¬ 
ment of air into a spray nozzle: 


ft 

Qw 


'(#\ 


[15.53.2] 
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where Fn is the flow number of the nozzle ((1/s) ■ (kN/m 2 ) 1/,z ), 
P w is the pressure of water at the nozzle (kN/m 2 ) (gauge) Q w 
is the volumetric flow of water (1/s) and p w is the density of 
water (kg/m 3 ). This correlation is given in Figure 15.157(a). 
The ratio QJQ W is both a measure of the efficiency of the 
spray and a design parameter. It is given as a function of the 
water pressure and flow number in Figure 15.157(b). It 
should be noted that in other work different units are quo¬ 
ted for the nozzle flow number. 

In the original work, this correlation was validated in 
small scale experiments with D = 0.3 m and ft, <11/s. 
McQuaid (1977) has compared values predicted by the 
correlation with results from the larger scale work of 
Rasbash and Stark (1962), Eggleston, Herrera and Pish 
(1976), J.W. Watts (1976), Heskestad, Rung and Todtenkopf 
(1976) and Beresford (1977). 

For design, McQuaid takes an air velocity Fof 6 m/s. 
Then, given a water pressure P w , the number of nozzles n 


P w x 1CT 5 (N/m 2 ) 

0 4 8 12 16 20 




Figure 15.157 Mitigation of gas dispersion by water spray barriers - water spray nozzle relationships (McQuaid, 1977): 
(a) and (b) air entrainment relationships. A = n V/4PZ 2 (Courtesy of HM Stationery Office) 
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and the required total air flow nQ a , the water flow Q w and 
hence the flow number F of the nozzles may be determined. 
There is some latitude in the choice of the number of noz¬ 
zles, since this does not affect the efficiency QJQ W . 


15.53.9 Water spray barriers: illustrative example 

An illustrative example of the design of a water spray bar¬ 
rier is given by McQuaid (1980). This example is summar¬ 
ized in Table 15.67. The problem considered is the design of a 
barrier for the dilution of a continuous release of ethylene 
gas escaping at a rate of 1 kg/s and forming a plume with an 
angle of 35° and a height of 1 m. The table also treats the 
case of a steam curtain, as described below. 


15.53.10 Water spray barriers: Moore and Rees model 

P. A.C. Moore and Rees (1981) have given a model, or rather a 
set of models, for the forced dispersion of gases by water or 
steam curtains. The model is applied by the authors to 
dilute gas plumes and to dense gas plumes. The situation 
considered is that shown in Figure 15.158. 

Following Bosanquet (1957), the authors consider an 
elemental slice of the gas cloud 


Table 15.67 Illustrative calculation for a water spray 
barrier for dispersion of a dense gas plume (after 
McQuaid, 1980) 


A Scenario 


Release of ethylene (MW = 28; LFL = 2.7%) 
Mass rate of release from source = 1 kg/s 
Angle of plume = 35° 

Distance between source and barrier = 16 m 
Width of plume at barrier = 10 m 
Height of plume at barrier = 1 m 
Gas loading at barrier = 1/10 = 0.1 kg/s m 

B Water spray barrier 


Water pressure = 700 kPa 
Spacing between nozzles = 1.15 m 
Height of nozzles = 2 m 
Angle of spray cone = 60° 

Distance from nozzle to top of plume = 2 — 1 = 1 m 
Mass flow of air required = 0.1 x (29/28) x (1/0.027) 

= 3.8 kg/s m 

Density of air = 1.2 kg/m 3 
Diameter D of spray cone at plume top = 1.15 m 
Volumetric flow of air required per unit length 
= 3.8/1.2 = 3.2 m 3 /s m 

Volumetric flow of air required per nozzle = 3.2 D m 3 /s 
= 3.2 x 1.15 m 3 /s = 3.7 m 3 /s 
Velocity of entrained air at top of cloud = 6 m/s 
Ratio Q a /Q w (from Figure 15.157) = 2 m 3 /l 
Water flow Q w = 3.7/2 = 1.851/s 


C Steam curtain 


Mass flow of air required = 3.8 kg/s m 
Steam flow S required (from Equation 15.53.26) 
= (0.1 x 2 x 3.8J/200 = 0.0385 kg/s m 


[15.53.4] 


where c is an entrainment parameter for the wind, S is the 
surface area of an elemental slice, u is the velocity of the gas 
and (5Fis the volume of the slice. 

It is assumed that the cloud velocity u is equal to the wind 
speed w. 

u = w [15.53.5] 

Also 


[15.53.6] 


where x is the distance along the plume. 

The first model (model A) is for a downward pointing 
spray. The three regions (I—III) are considered in turn. For 
region I, the source has a volumetric rate of release Q. In 
time S1 a volume QSt is emitted which at distance x is con¬ 
tained within the volume SV with radius r. 


SV = n^wSt 

[15.53.7] 

The area Sis 


S = 2nrwSt 

[15.53.8] 

By conservation of mass 


QSt = nr^wSt 

[15.53.9] 

= Cn^wSt 

[15.53.10] 


where C is the volumetric concentration and subscript o 
denotes the source. From Equations 15.53.4,15.53.5,15.53.7 
and 15.53.8 


Hence from Equations 15.53.6 and 15.53.11 


[15.53.1| 


[15.53.12] 


Integrating Equation 15.53.12 with respect to x over region I 
and at the boundary of the region 


r = r 0 + cx [15.53.13a] 

n = r 0 + cx i [15.53.13b] 

where subscript 1 denotes the end of region I. In region II 

^!l f | 2%rwSt ■w + c s ■ 2nrwSt ■ v 3 [15.53.14] 

where c s is an entrainment parameter for the spray and v a 
is the velocity of the air entrained in the spray. In this 
equation the first term on the right-hand side represents 
the entrainment of air by the wind and the second term 
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Figure 15.158 Mitigation of gas dispersion by water spray barriers - elevation view of dense gas cloud passing through 
a water spray barrier (P.A.C. Moore and Rees, 1981) (Courtesy of the Institution of Chemical Engineers) 


represents the entrainment by the spray. Proceeding as 
before yields 



FD is the forced dispersion effectiveness factor. For region 
III without spray Equation 15.53.13a applies. Then utilizing 
Equation 15.53.19 with Equation 15.53.13a to obtain C ND 
and with Equation 15.53.18 to obtain C F d in Equation 
15.53.20: 


and integrating gives 

, 2 ,„ + (c + ^)D 


[15.53.16a] 

[15.53.16b] 



[15.53.21a] 

[15.53.21b] 


D = x 2-Xi [15.53.17] 


From Equation 15.53.10 
C = 

nr 2 w 


The effectiveness of dilution is given in terms of a factor 
FD defined as the ratio 


FD = ^ [15.53.20] 

C-FD 

where C ND is the concentration with natural dilution, C FD is 
the concentration with forced dispersion by the spray and 


Bosanquetgivesavalueofe = 0.13. The authors also derive 
from Katan’s formula a value of c = 0.14. 

The two other models (models B and C) are for an upward 
pointing spray. Taking model B, it is assumed that in region 
II the elemental slice gains a vertical velocity v in the spray 
and that in region III the horizontal velocity is given by 

u=(u? + v*) 1/2 [15.53.22] 


This model contains an additional equation for dv/dx. The 
result for FD is 



[15.53.23] 


Model C is similar but treats a cloud from a line source. 
Moore and Rees describe field trials conducted to validate 
their models using water spray barriers and steam curtains. 
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The trials included a continuous release of propane gas at 
2 kg/min, a spill of some 60 kg of liquid propane and a 
continuous release of liquid propane at 10 kg/min. The 
barrier was generally located 1 m downwind of the source. 
The first of these three sources gave a propane concentra¬ 
tion at the barrier of 10% and the other two concentrations 
of 100%. The concentration was measured at 15 m down¬ 
wind. Other experiments were conducted with argon and 
sulphur hexafluoride at much lower flows and different 
downwind measurement distances. For downward-point¬ 
ing nozzles the FD factors were in the range 1.1 -3.3 and for 
upward-pointing nozzles they were in the range 2.5—6.3; 
the upward-pointing nozzles were more effective. The 
results of the experiments were used to obtain empirical 
values of cjc in the model and the predictions of the model 
were then compared with the results of the experiments. 


15.53.11 Water spray barriers for dense gases: HSE 
field trials 

Experimental work by the HSE on the dispersion of a dense 
gas plume from a continuous source has been described by 
Moodie (1981,1985) and McQuaid and Moodie (1983). Three 
configurations of water spray barrier were used: sprays 
pointing vertically downward, sprays pointing downward 
but angled forward at 45° and sprays pointing vertically 
upward. The downward-pointing nozzles were at a height 
of 3 m and were spaced at 0.33 m intervals along a 17 m pipe; 
the upward-pointing nozzles were at the same interval on 
an 18 m long pipe. Solid cone, hollow cone and flat fan 
sprays were investigated. The distance between the barrier 
and the source was varied, one distance quoted being 5 m. 
The gas released was carbon dioxide at release rates of 2 
and 4.2 kg/s in wind speeds of 0.6-11 m/s and with water 
consumptions at the barrier of 0.4-7.61/(sm).Wind speeds 
were measured at, and quoted for, 1.25 m. 

Figure 15.159 shows the variation of the entrained air and 
of the concentration of carbon dioxide across the barrier. 
The results are correlated in terms of the momentum of the 
spray. Moodie (1985) defines a momentum flow number 
M n as 


Mu=KF n [15.53.24] 

where F N is the flow number (l/(min bar 1 / 2 )), Af N is the 
momentum flow number (N s/(s bar)) and if is a constant. 
The value of the constant K is 0.236. Use is also made of the 
momentum flowMof the barrier (N s/(s m)). 

The results are presented as a concentration ratio CR, 
defined as the ratio of the concentration with the water 
sprays off to that with the sprays on. Figure 15.160 shows 
the variation of CR with wind speed with specific momen¬ 
tum as the parameter. Values of CR are mainly in the range 
1-4. The ratio increases with the momentum of the spray 
and decreases with wind speed. 

Compared with the sprays pointing vertically down¬ 
wards, those angled at 45° showed no apparent improve¬ 
ment in performance, but the upwards-pointing sprays did, 
being some 17% more effective at a wind speed of 2 m/s. 

For upwards-pointing barriers only, and for the range of 
parameters studied, the authors give the following correlation: 

M = ^1.25 [0.65 exp(0.5CR) - 0.23] 2 [15.53.25] 

where M is the specific momentum flow (N s/(s m)) and 
«i.25 is the wind speed at 1.25 m height (m/s). 

McQuaid and Moodie (1983) have reviewed the implica¬ 
tions of this work for the design of a water spray barrier. 
The barrier should be located near the source, though not 
so near as to promote increased evaporation of any liquid 
pool. A barrier near the source gives a considerable reduc¬ 
tion in gas in the first few tens of metres downwind, but 
this effect decays quite rapidly. It is most effective at low 
wind speeds (<3-4 m/s). 

Water consumption at a water pressure of 700 kPa is 
about 1.61/(s m). A standard fire tender giving 60 1/s can 
thus supply a 35 m length of barrier. 

15.53.12 Water spray barriers for dense gases: HSE 
modelling studies 

McQuaid and Fitzpatrick (1981, 1983) of the HSE have 
described the modelling of the dispersion of a dense gas 
plume by a water spray barrier. One question addressed 
was the extent to which the effect of the water spray barrier 
falls off with downwind distance. For a dense gas cloud the 
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Figure 15.159 Mitigation of gas dispersion by water spray barriers - variation of entrained air and concentration 
of carbon dioxide across barrier in HSE trials (Moodie, 1981) (Courtesy of the Institution of Chemical Engineers) 
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effect of the density difference is to increase the area of the 
cloud top by lateral spreading, but to reduce vertical mix¬ 
ing. As far as concerns entrainment of air, the former effect 
tends to outweigh the latter so that the net effect is to 
increase entrainment and to shorten the length of the plume 
to a given concentration. A water spray barrier gives an 
addition of air and hence an immediate dilution, hut it also 
gives a reduction of density and hence in lateral spread. 
Another question considered was the effect of the distance 
between the source and the barrier. If a barrier is close to 
the source it can be made smaller, but it will reduce the 
density of the cloud just at the point where this density is 
most effective in promoting entrainment. 

The dispersion of a dense gas from a continuous release 
was modelled using CRUNCH. The experimental work 
showed that the entrained air mixes with the gas cloud 
within a distance roughly equal to the width of the spray. 
This effect was therefore modelled by assuming that the 
entrainment of the air at the barrier effects a change both in 
the geometry of the cloud and in its concentration. The 
plume modelled was a continuous release of 2 kg/s of 
carbon dioxide, representative of the sources used in the 


experiments of Moodie (1981). Some predictions given 
by the model are shown in Table 15.68 and Figure 
15.161(a)—(d), which illustrate, respectively, the effect on 
plume height and concentration of the stability category, 
the wind speed, the downwind distance of the barrier and 
the specific air entrainment rate. The plume widths at the 
barrier vary, but it is assumed that they are not altered by 
passage through the barrier and that the only effect of this 
is to alter plume height. The results show that a water spray 
barrier gives a higher dilution if located close to the source, 
that a barrier with high specif ic air entrainment rates gives 
higher dilutions and that a barrier is particularly effective 
in stability category Fconditions. The large air flows in this 
case are due to the large plume widths. The results also 
show that the effect of the barrier decays and that some 
distance downwind it disappears altogether. 

As just described, the assumption in Figure 
15.161(a)—(d) is that the effect of the barrier is to change 
the height of the plume hut to leave its width unaltered. 
Figure 15.161(e) and (f) illustrate the results of the alter¬ 
native assumption that it is the plume width which changes 
whilst the height remains unaltered. They show that it is 


Specific 

momentum Source 
Barrier flow rate strength 



u, 25 (m/s) 

Figure 15.160 Mitigation of gas dispersion by water spray barriers - effect of wind speed and specific momentum 
on concentration ratio (CR) for carbon dioxide in HSE trials (Moodie, 1985). Flat fan nozzles spaced 1 m apart each 
with momentum flow number M N =4.9 Ns/(s bar) (Courtesy of the Institution of Chemical Engineers) 


Table 15.68 Predictions of CRUNCH of effect of water spray barrier on plume from continuous release of carbon 
dioxide (after McQuaid and Fitzpatrick, 1983). Air entrainment rate =3.6 kg/s m (Courtesy of the Institution of 
Chemical Engineers) 
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38.2 

0.75 

2.94 

15 
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88.3 

0.66 
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30 
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Figure 15.161 Mitigation of gas dispersion by water spray barriers - predictions of CRUNCH for concentrations of 
carbon dioxide downwind of source for trials (McQuaid and Fitzpatrick, 1981): (a) air flow at barrier — 3.6 kg/s m, weather 
conditions D/4.3; (b) air flow at barrier =3,6 kg/s m, weather conditions F/2; (c) air flow at barrier = 12 kg/s m, 
weather conditions D/4.3; (d) air flow at barrier = 12 kg/s m, weather conditions F/2; (e) air flow at barrier =3,6 kg/s m, 
weather conditions D/4.3; (f) air flow at barrier =3.6 kg/s m, weather conditions F/2. Plume width maintained constant 
through barrier in (a)- (d) and plume height maintained constant in (e)- (f). The key to all six figures is given in graph (f) 
(Courtesy of the Institution of Chemical Engineers) 
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much more effective to change the plume width. Quite how 
as a practical matter this may be effected is not obvious, but 
the general message is clear that any outward movement 
which can be imparted to the plume is highly beneficial. 

These HSE field trials have also been modelled by 
Deaves (1983b, 1984) using HEAVYGAS. Figure 15.162 
shows a comparison of the observed and predicted con¬ 
centration profiles in one experiment. Other results from 
the model show that the gas, which had been hugging the 
ground, is lifted up and mixed by an upwind recirculation 
of the entrained air. 


15.53.13 Water spray barriers for dense 
gases: Goldfish and Hawk trials 

The Goldfish field trials at the NTS in 1986 on the disper¬ 
sion of hydrogen fluoride included three trials involving 
the use of forced dispersion barriers. The main natural 
dispersion trials (trials 1-3) were described in Section 15.37 
and the forced dispersion trials (trials 4-6) are described 
here. Accounts of these latter trials have been given by 
Blewitt, Yohn, Koopman and Brown (1987) and Blewitt, 
Yohn, Koopman, Brown and Hague (1987). The work con¬ 
stitutes an investigation of the case of dilution of a gas 
cloud due to absorption of the gas as well as entrainment of 
air into the cloud. 

Trial 5 utilized an upwards-pointing water spray barrier 
and trial 6 a downwards-pointing one. A barrier with the 
water spray atomized by air was used in trial 4.The general 
conditions of the trials were described in Section 15.37. 
In trial 5 the flow of liquid hydrogen fluoride was 32.5 
US gal/min with a wind speed of 3.8 m/s and stability 
category C/D, and trial 6 was essentially similar but with a 
wind speed of 5.4 m/s. The ambient temperature was 21°C 
in all three tests. In none of these three tests was any liquid 
collected on the spill pad. 

The interpretation of trials 5 and 6 was complicated by 
shifts in wind direction during both trials, but the use of 
mass balances as well as concentration measurements 
allowed an estimate to be made of the proportion of 
hydrogen fluoride removed. The reduction in maximum 
hydrogen fluoride concentration 300 m downwind of the 
barrier was estimated as between 36 and 49%; the con¬ 
centration at this point in trial 5 before the spray was 
turned on was 2028 ppm. The atomized water spray used in 
trial 4 was not effective in the form tested. 


As already mentioned, a further set of field trials, the 
Hawk series, was performed at the NTS in 1988 under the 
auspices of ICHMAP. The gas dispersion aspect of these 
trials was considered in Section 15.37 and the vapour bar¬ 
rier work was described in Section 15.53.4. An account of 
the work on water spray barriers is given here. 

A total of 87 trials were performed to investigate the 
effect of various parameters on the removal of hydrogen 
fluoride by a water spray barrier. The water/HF liquid 
volume ratio was found to be the dominant factor. Hydro¬ 
gen fluoride removal efficiencies of 25 to >90% were 
achieved at water/HF liquid volume ratios of 6 :1 to 40 :1. 

Of the other factors, the liquid droplet size also had 
some influence. Upward-pointing sprays were rather more 
effective than downward-pointing ones. The pressure 
and temperature of the hydrogen fluoride had little effect 
and the same applied to the atmospheric humidity and 
wind speed. Little difference was observed in removal 
efficiency of the spray as between hydrogen fluoride and 
alkylation unit acid. 

Trials were done with the water augmented by various 
additives, including sodium bicarbonate, sodium hydrox¬ 
ide, calcium chloride and surfactant, but the only benefit 
was a marginal increase in removal efficiency when using 
sodium hydroxide. 

It was found that fire monitors were virtually as effective 
in removing hydrogen fluoride as were fixed barriers. The 
best results were obtained using coarse droplets aimed 
directly at the release point from a short distance, as 
opposed to a wide angle fog or a jet directed from a distance. 
Tests were conducted to check on the risk of damage from 
jets from such monitors.The most severe of these involved a 
flow of 6000 US gal/min applied as a narrow jet at a dis¬ 
tance of 7 ft from the target; damage was minimal. 


15.53.14 Water spray barriers for dense 
gases: physical modelling 

A wind tunnel investigation of the effect of water spray 
barriers on dense gas dispersion has been described by 
Blewitt et al. (1991). Tests were performed simulating con¬ 
tinuous releases of hydrogen fluoride at flows in the range 
11-96 kg/s and wind speeds in the range 3-10 m/s and 
with barrier configurations with water pressure 172 psi and 
flow 33,000 US gal/min with nozzle spacings of 0.46-1.83 m 
and orientations vertically downwards, angled, horizontal 
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Figure 15.162 Mitigation of gas dispersion by water spray barriers - predictions of HEA VYGAS for concentrations 
of carbon dioxide across barrier for HSE trials (Deaves, 1984). Nozzles pointing into wind and at an angle of 45° to 
horizontal. (Courtesy of Springer Verlag) 
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and vertically upwards. The most effective dilution was 
good mixing with nozzles spaced as far apart as 1.83 m, 
the widest spacing studied. The authors discuss the 
principles of scaling water sprays in wind tunnel work. 

15.53.15 Water spray barriers for dense gases: SPRAY65 

The work of Meroney (1991) on the use of models of dense 
gas dispersion at vapour barriers was mentioned earlier. 
He has also reported work on models for dense gas disper¬ 
sion at water spray barriers using the model SPRAY65. 

This model was used to simulate the Goldfish field trials 
on the dispersion of a continuous release of hydrogen 
fluoride by a water spray barrier. Figure 15.163(a) shows for 
Goldfish trial 1 the effect of the water spray barrier location 
on the height of the cloud, and Figure 15.163(b) shows the 
effect on the downwind concentration. The water spray 
barrier is more effective in diluting the gas cloud if located 
near the source. The effects decay with distance and even¬ 
tually disappear. 

15.53.16 Water spray barriers: leak containment 

The use of a water spray barrier by a works fire brigade to 
deal with escapes of gas has been described by Beresford 
(1981). The approach adopted is to hold the gas cloud inside 
a ‘chimney’ formed by a set of four mobile water spray bar¬ 
riers. These form a barrier to the passage of the gas, entrain 
air and dilute the gas, and impart to it upwards momentum 
so that it rises and disperses harmlessly. It is possible to see 
inside the chimney and for personnel to enter to effect valve 
isolation. 

Two monitors are placed some 30 ft apart and arranged 
to give an inverted V some 40-50 ft above ground. At this 
point the water spray feathers and heavy drops fall to 
ground. Two fan-shaped sprays are set at right angles to the 
monitor curtains to give a vertical water curtain some 40 ft 
wide x 40 ft high. The overall effect is to surround the gas 
with an upward-moving wall of water so creating the 


chimney effect. The gas disperses some 50 ft or more above 
ground. The monitors are 250-1200 UKgal/min and the 
fan sprays 180-200 Ukgal/min devices and the water 
pressure used is 150 psig. 

This technique is suitable for quite serious leaks but not 
for catastrophic failures. It may be used for flammable or 
toxic releases. It requires that the equipment be set up 
rapidly. Ignition of a flammable vapour cloud, for example, 
is liable to occur within 3-5 min of the start of the leak. It is 
necessary to consider the drainage of the water if applica¬ 
tion is likely to be prolonged. 

Beresford gives examples of a number of escapes han¬ 
dled by this method. They include a leak of propylene from 
a 2 in. diameter drain line at 400 psig discharging at a rate 
of about 100 te/h which could not be isolated for several 
hours; one of ethylene gas from a flanged joint on a 14 in. 
diameter pipe at 500 psig which lasted some 50 minu; one 
of methane escaping at about 50 te/h for 30 min from a 
fracture on a 6 in. diameter pipe at 60 psig; and various 
other leaks of benzene, ethylene, ethylene oxide, naphtha 
and hydrocarbon solvents. 

15.53.17 Water spray barriers: enclosed spaces 

Work on the use of water sprays to promote entrainment 
into, or act as a barrier to, instantaneous and continuous 
leaks of gas in an enclosed space has been described by van 
Doom and Smith (van Doom and Smith, 1980; J.M. Smith 
and van Doom, 1981). 

15.53.18 Steam curtains 

A steam curtain is used as a permanent installation to 
contain and disperse leaks of flammable gas heavier than 
air. A steam curtain system has been described by Cairney 
and Cude (1971) and Simpson (1974). 

The arrangement is that the plant is surrounded by a 
solid but lightly constructed wall. A horizontal steam pipe 
with a row of small holes is mounted near the top of the 




(a) (b) 

Figure 15.163 Mitigation of gas dispersion by water spray barriers - predictions of SPRAY65 for dispersion of hydrogen 
fluoride across barrier for Goldfish trial 1 (Meroney, 1991): (a) effect on plume height; and (b) effect on centreline 
concentration, x is the downward distance of the water spray (m) (Courtesy of the American Institute of Chemical 
Engineers) 
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wall. The pipe is divided into sections which are individu¬ 
ally supplied with steam from distribution mains with 
remotely controlled, quick-acting valves. The associated 
monitoring of leaks is carried out by the flammable gas 
detector system, as described in Chapter 16. In the system 
described by the authors mentioned, Sieger diffusion-type 
detectors are used. 

The wall constitutes an initial barrier to the cloud and 
thus serves both to provide a time delay during which the 
detection system can operate and to spread the gas along 
the length of the curtain. The relative spacing of the 
potential sources of escape, the detectors and the wall are 
chosen with these factors in mind. The wall is 1.5 m high, 
which is sufficient to check a heavy vapour cloud, but 
does not prevent dispersal of small leaks by natural air 
movement. 

The steam pipe is designed so that the individual jets 
combine to form a planar jet which entrains sufficient air to 
dilute the vapour cloud below its lower flammability limit. 
The division of the pipe into sections allows steam to be 
supplied only to those sections near the leak. The activation 
of the system is controlled by the process operators. 

The steam curtain was designed to dilute heavy flam¬ 
mable vapours. It is possible, in principle, to apply it to the 
dispersion of toxic gases, but in this case it is necessary to 
effect dilution to much lower concentrations. 

The use of steam jets, particularly jets containing wet 
steam, can create a hazard of ignition by static electricity. 
Therefore particular care is taken that all pipework and 
other metal objects near the jets are properly earthed. 

A method for the design of a steam curtain has been 
given by McQuaid (1980). The quantity of steam required is 
determined from the relation 


Sm. 


G+2Q a 

200 


[15.53.26] 


where G is the mass flow of gas, Q a is the mass flow of air 
and S is the mass flow of steam. The equation is based on 
conservation of momentum, a wind velocity of 2 m/s and 
a steam velocity equal to the velocity of sound in steam of 
400 m/s. The illustrative example given in Table 15.67 also 
covers the case of a steam curtain. 

P.A.C. Moore and Rees (1981), in the work already 
described, also conducted experiments on steam curtains 
and obtained empirical correlations for the FD value. 

The generation of static electricity in steam curtains and 
in water curtains has been investigated by Napier (1974b). 
He concluded that a degree of static electricity hazard 
exists both with steam and with water curtains. 


15.53.19 Water spray barriers vs steam curtains 

Several authors have compared the use of water spray bar¬ 
riers and steam curtains. A detailed comparison of the two 
devices has been made by McQuaid (1980), as illustrated 
in Table 15.68. For the water spray barrier the water flow 
required is 1.6 kg/(s m) and the steam flow is 0.0385 kg/(s m). 
The ratio of the required mass of water to that of steam is 
therefore some 40 :1. 

EA.C. Moore and Rees (1981) state that in their experi¬ 
mental work the FD value for steam curtains was less 
than 4, whereas for upwards-pointing water spray barriers 
it was in the range 4-16. 


15.54 Vapour Cloud Mitigation: COPS Guidelines 

The CCPS has published guidance on the mitigation of 
vapour clouds and this is now described. 

15.54.1 Guidelines for Vapor Release Mitigation 

The CCPS GuidelinesforVaporRelea.se Mitigation (the CCPS 
Vapor Release Mitigation Guidelines) (1988/4) cover a wide 
range of approaches to mitigation. Prugh (1985-, 1987b,c) 
has given a number of accounts of vapour release mitiga¬ 
tion which foreshadow the Guidelines. 

The main headings of the Guidelines maybe summarized as 


(1) Overview; 

(2) Inherently safer design; 

(3) Engineering design; 

(4) Process safety management; 

(5) Early vapour detection and warning; 

(6) Cuntermeasures; 

(7) On-site emergency response; 

(8) Off-site emergency response; 

(9) Selection of measures. 

The interpretation of the concept of mitigation in the 
Guidelines is a broad one and covers both prevention and 
protection. It constitutes, but is more than, a comprehen¬ 
sive checklist of measures. Many of the topics listed above 
are dealt with in other parts of the present text. Table 15.69 
gives an indication of the chapters or sections in which 
these topics are treated here. 

The Guidelines give as a base case a system consisting of 
an unloading rail tank car, pump transfer, storage vessel, 
pump transfer and reactor. This system is then used 
throughout the text to illustrate the various points under 
consideration. 

It starts with a discussion of the broad features of a 
vapour release: the forms which a release may take; the 
features of a flashing release; the causes of release; and the 
consequences of release. The different types of release are 
exemplified and categorized and an appendix is given 
which contains a checklist of release scenarios. 

The principles of inherently safer design treated are: 
limitation of inventory; substitution of less hazardous 
materials; substitution of a less hazardous process; and 
siting. Consideration is given to both on-site and off-site 
exposure. There is an appendix on the properties of hazard¬ 
ous materials. 

The contribution of engineering design is considered 
under the headings of plant integrity, process integrity, and 
emergency control. There is a fairly extensive treatment of 
the latter, dealing with emergency relief disposal, abort 
systems, isolation systems, material transfer, and spill 
containment. Emergency relief disposal covers active and 
passive scrubbers, stacks and flares, catchtanks, incin¬ 
erators, and absorbers, adsorbers and condensers. There is 
an appendix on catchtank design and another on vendors of 
emergency equipment. 

The treatment of management in the Guidelines concen¬ 
trates on: operating procedures; training for emergencies; 
audits and inspections; equipment testing; maintenance 
programmes; plant and process modifications; methods of 
stopping a leak; and security. 

Early warning is treated in terms of detectors for 
flammable and toxic gases, including their response time 
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Table 15.69 Some principal topics treated in the CCPS Vapor Release Mitigation Guidelines and their 
treatment in this text 


Chapter 

1 Overview 

2 Inherently Safer Design 

11 

3 Engineering design 

3.1 Plant integrity 

3.1.1 Design practices 

11,12 

3.1.2 Materials of construction 

12 

3.1.3 Inspection and testing (in construction) 

12,19 

3.2 Process integrity 

3.2.1 Identification of process materials 

20 

3.2.2 Process operating limits 

11, 20 

3.2.3 Process control system 

13 

3.2.4 Pressure relief system 

12 

3.3 Emergency control 

3.3.1 Emergency relief disposal 

11,12 

3.3.2 Emergency abort systems 

12 

3.3.3 Emergency isolation systems 

12 

3.3.4 Emergency material transfer 

12 

3.3.5 Spill control 

15,23 

4 Process Safety Management 

6 

5 Early Vapour Detection and Warning 

5.1 Detectors and sensors 

13,16,18 

5.2 Detection by personnel 

20 

5.3 Alarm systems 

13, 24 

6 Countermeasures 

6.1 Vapour-liquid release 

6.2 Vapour release countermeasures 

6.2.1 Water sprays 

15 

6.2.2 Water curtains 

15 

6.2.3 Steam curtains 

15 

6.2.4 Air curtains 

- 

6.2.5 Deliberate ignition 

17 

6.2.6 Ignition source control 

10,16 

6.3 Liquid release countermeasures 

6.3.1 Dilution 

6.3.2 Neutralization 

6.3.3 Covers 

15,16 

6.3.4 Avoidance of spill aggravation 

15,16 

7 On-site Emergency Response 

24 

8 Off-site Emergency Response 

4, 24 

9 Selection of Measures 

9 


and positioning, detection by personnel, and alarm 
systems. 

Countermeasures against vapour releases are water 
sprays, water, steam and air curtains, deliberate ignition, 
and ignition source control, whilst those against liquid 
releases are dilution, neutralization, and liquid, foam and 
solid covers, together with the method of application and 
avoidance of actions which may aggravate vaporization. 

On-site emergency response embraces: on-site commu¬ 
nications; emergency shut-down equipment and pro¬ 
cedures; site evacuation; havens; escape; personal 
protective equipment; medical treatment; and emergency 
plans, procedures, training and drills. There is an appendix 
on the capacity of a haven. 

Off-site emergency response as such is not the direct 
responsibility of the company, and the account is confined 


to those aspects which are its responsibility: alerting sys¬ 
tems; roles and lines of communication; and information to 
be communicated. 

The approach described to the selection of mitigation 
measures is based on a formal system of hazard identifica¬ 
tion and assessment, by which the scenarios for loss of 
containment and potential Countermeasures are identified 
and the nature of the hazards and the effectiveness of the 
Countermeasures are assessed. 


15.55 Fugitive Emissions 

Process plants have numerous potential sources of leaks 
and, although the emission rate from any one source may 
be small, the cumulative effect of these leaks may be such 
as to require action. One effect of such emissions is to raise 
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the concentration of toxic chemicals in the plant and thus 
make it difficult to meet the workplace limit values set. 
Another effect is to increase the level of pollutants 
outside the plant. There is also a cost due to the loss of the 
chemicals. 

Some of the emissions from the plant are attributable to 
particular sources or operations such as combustion 
and solvents handling, storage and terminal operations, 
process vents and stacks. The others are classed as 
fugitive emissions and consist of leaks from flanges, 
valves, pump and compressor seals, pressure relief valves, 
and so on. 

An account of fugitive emissions is given in Fugitive 
Emissions of Vapours from Process Equipment by the 
British Occupational Hygiene Society (BOHS) (the BOHS 
Guide) (1984 TG3), Health Hazard Control in the Chemical 
Process Industry (Lipton and Lynch, 1987), Fugitive Emis¬ 
sions and Controls (Hesketh and Cross, 1983) and Handbook 
of Health Hazard Control in the Chemical Process Industry 
(Lipton and Lynch, 1994). There have been a number of 
publications by the Environmental Protection Agency 
(EPA) (1973,1978a,b, 1982b, 1984c). Other accounts include 
those by Rosebrook (1977), Bierl and co-workers (Bierl 
et al., 1977; Bierl, 1978, 1980; Bierl and Kremer, 1978), 
TW Hughes, Tierney and Khan (1979), M.J. Wallace (1979) 
and Wetherold et al. (1983). Selected references on fugitive 
emissions are given in Table 15.70. 

Estimates of sources of emission in a typical refinery 
and in chemical plants are given inThbles 15.71 and 15.72, 
respectively. 


15.55.1 Regulation of fugitive emissions 

In the United States, early work on the control of fugitive 
emissions was the Los Angeles County project in 1958. Los 
Angeles has a particular problem of smog to which hydro¬ 
carbons are a main contributor. 

A study was carried out of fugitive emissions in 11 refi¬ 
neries in the Los Angeles area in which measurements were 
made of the emission factors for various types of equip¬ 
ment. These constituted the original data for the compila¬ 
tions of emission factors produced by the EPA and were 
published as AP- 42, which then became the basis for regu¬ 
latory controls. 

The EPA subsequently commissioned a number of stud¬ 
ies, including in 1979 studies by the Radian Corporation 
and by Monsanto. The Radian project covered total emis¬ 
sions on refineries, but fugitive emissions received parti¬ 
cular attention. The Monsanto project covered similar 
ground for chemical plants. The EPA has issued a number 
of documents giving emission factors. 

The EPA has promulgated as amendments to the Clean 
Air Act 1970 regulations limiting fugitive emissions from 
refineries and chemical plants. These controls are con¬ 
cerned mainly with pollution rather than occupational 
exposure. 

In the Federal Republic of Germany the Federal author¬ 
ities maintain a register of emission factors (Bierl, 1980), 
which are used by the inspectorate of the States. In Nord 
Rhein-Westfalen, for example, these emission factors are 
incorporated in the local regulations. 

In the United Kingdom, there is no specific requirement 
on emission factors as such. Fugitive emissions are regu¬ 
lated as an aspect of pollution and of the control of toxic 
concentrations in the workplace. 


Table 15.70 Selected references on fugitive emissions 


R.K. Palmer (1957); Anon. (1958); Steigerwald (1958); API 
(1959 Bull. 2513,1962 Bull. 2516,2518,1967 Bull. 2522, 
2533,1980 Publ. 2517,4322,1981 Publ. 2514A, 1983 Publ. 
2519); Schwaneke (1965,1968,1970); Chieffo and McLean 
(1968a,b); G.F. Bright (1972); Lfflis and Young (1975); Mack 
(1975); Radian Corporation (1975,1979); Boland etal. (1976); 
Chicago Bridge and Iron Co. (1976b); Kremer (1976); 
Meteorological Research Inc. (1976); Burklin, Sugarek and 
Knapf (1977); Bierl et al. (1977); Jonker, Porter and Scott 
(1977a,b); Rosebrook (1977);Taback etal. (1977); Western Oil 
and Gas Association (1977); Zanker (1977); Bierl (1978, 
1980); Bierl and Kremer (1978); Cavaseno (1978a); EPA 
(1978a,b, 1982b, 1984c, 1988a); Kittleman and Akell (1978); 
Monsanto Research Corporation (1978); Bochinski, 
Schoultz and Gideon (1979); Hesketh (1979); T.W. Hughes, 
Tierney and Kahn (1979); Hydroscience Inc. (1979); 
Morgester et al. (1979); M.J. Wallace (1979); Schroy (1979); 
Kenson and Hoffland (1980); Kunstmann (1980); Beckman 
and Gillmer (1981); Siegel (1981); Wetherold, Rosebrook and 
Tichenor (1981); Blackwood (1982); Freeburg and Aarni 
(1982); Gwyther (1982); Anon. (1983 LPB 49, p. 28); Cleaver 
(1983); Hanzevack, Anderson and Russell (1983); Harbert 
(1983,1984); Hesketh and Cross (1983); Hess and Kittleman 
(1983); Kusnetz and Phillips (1983);Wetherold etal. (1983); 
Beckman (1984); BOHS (1984,1987); Flanagan (1984); 
Goltz (1984); A. Jones (1984); R. Powell (1984); Rhoads, Cole 
and Norton (1984); Sivertsen (1984); Recio and Rhein 
(1985); Beckman and Holcomb (1986); CONCAWE (1986 
2/86,1987 87/52); Anon. (1987o); Berglund and Whipple 
(1987); lipton and Lynch (1987,1994); Lipton (1989,1990, 
1992); Strachan etal. (1989); Early and Eidson (1990); 

J.C. Edwards and Bujac (1990); Kaufman etal. (1990); King 
(1990); Samdani (1990b); Surprenant (1990); Anon. 
(1991h,i,z); Adams (1991,1992); Brestal etal. (1991); 
Gardner (1991); Jacob (1991b); Myerson (1991); Schaich 
(1991); Shiel, Siegel and Jones (1991); Stucker (1991); Bruere 
and Coenen (1992); CIA (1992 RC58); Crowley and Hart 
(1992); Gardner and Spock (1992); IBC (1992/96,1993/108); 
Key (1992); Crowley (1993); Fruci (1993); Moretti and 
Mukhopadhy (1993); PA. Ross (1993); Ruddy and Carroll 
(1993); Spock (1993); J.B. Wright (1993) 


15.55.2 Measurement of fugitive emissions 

The existence of a leak may be detected using the soap 
bubble method. However, this method is not generally 
regarded as suitable for quantitative measurement. The 
concentration at the point of leak may be used as a measure 
of the leak rate, but the values obtained are highly depend¬ 
ent on factors such as the size of leak, the wind conditions, 
the plant geometry, etc. 

In the Radian study, the maximum concentration 
obtained around an emission source was termed the 
‘screening value.’ The EPA has attempted to relate screen¬ 
ing values to mass emission rates, but the correlation 
shows appreciable scatter. 

The two principal methods of measuring emission rates 
both involve enclosing the source in a container. In the bag 
method the bag is placed around the source, air is passed 
through the bag and the outlet steady-state concentration 
of the chemical in the air stream is measured. In the box 
method there is no air flow and the measurement taken is 
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Table 15.71 Estimated sources of emission in a refinery 
(Freeberg and Aarni, 1982) (Courtesy of the American 
Institute of Chemical Engineers) 


Source 

Proportion of total 
emissions (%) 

Combustion 

2 

Solvents, organics 

2 

Tanks 

9 

Bulk loading 

2 

Fugitive emissions 

85 

Total 

100 


Table 15.72 Estimated sources of emission in chemical 
plants (British Occupational Hygiene Society, 1984 TG3) 

Source 

Proportion of total 
emissions (%) 

Waste disposal 

2-5 

Storage tanks, transport vents 

8-10 

Process vents, stacks 

65-70 

Fugitive emissions 

15-20 

Total 

100 


Table 15.73 Fugitive emission sources in a hypothetical 
refinery (Environmental Protection Agency) 

Source 

Emission ra 



(lb/h) 

(%) 

Pump seals 

60 

48.7 

Valves 

305 

4.0 

Flanges 

25 

9.6 

Compressor seals 

29 

4.6 

Relief valves 

21 

7.7 

Drains 

48 

3.4 

API separators 

138 

22.0 

Total 

626 

100 


the rate of rise of concentration of the chemical in the air in 
the box. 


15.55.3 Monitoring of fugitive emissions 

The arrangements for monitoring emissions depend on the 
purpose of the monitoring. If the aim is to reduce pollution 
outside the works, periodic spot checks on emission sour¬ 
ces may be sufficient. The control of toxic concentrations in 
the atmosphere of the workplace normally requires addi¬ 
tional measures. In the latter case it is necessary to imple¬ 
ment continuous sampling of the atmosphere. The data 
obtained by such sampling must then be interpreted sta¬ 
tistically. A discussion of sampling and interpretation of 
sampled data is given in the BOHS Guide. 


15.55.4 Emission factors for equipment 

The contribution of the various sources of fugitive emis¬ 
sions to the total plant emission has been the subject of 
several studies. Table 15.73 shows the fugitive emission 
sources assigned in a hypothetical refinery in an EPA 
study. Table 15.74 gives the actual sources in the Monsanto 
study (TW Hughes,Tierney and Khan, 1979). 

Information on emission factors is available from several 
sources. Mention has already been made of the Los Angeles 
County study and of the studies commissioned by the EPA. 
The California Resources Board has carried out a project 
involving six refineries to check the 1958 data. Rockwell 
International has carried out a study for the American 
Petroleum Institute on oil production operations. 

Table 15.75 lists emission factors from the Los Angeles 
County project as given in the 1973 edition of the EPA 
publication AP-42. Tables 15.76 and 15.77 show emission 
factors obtained in the work by Radian (Wetherold, Roseb- 
rook and Tichenor, 1981) and by Monsanto (TW. Hughes, 
Tierney and Khan, 1979). 

Work by Bierl (1978, 1980) at BASF is shown in Table 
15.78. The literature values referred to in this table are those 
from earlier work by Schwaneke (1965, 1968, 1975). Bierl 
expresses his own measured values as percentages of these 
published ones. 

A composite set of emission factors given by Schroy 
(1979), based mainly on those of AP42 and Bierl, are shown 
in Table 15.79. 

The spread of emission rates is illustrated by the data for 
valves in light liquid service given by A.L. Jones (1984) and 
shown in Table 15.80. 


Table 15.74 Fugitive emission sources in four chemical plants (after T. 1/1/. Hughes, Tierney and Khan, 1979) 
(Courtesy of the American Institute of Chemical Engineers) 


Source 




Plant type 


Monochbro-benzene 

Butadiene 

Dimethyl 

terephthalate 

Ethylene 

oxide/glycol 

(ton/year) 

(%) 

(ton/year) 

(%) 

(ton/year) (%) 

(ton/year) (%) 

Pumps 

1 

3.1 

96 

8.6 

8 

2 

Valves 

0.2 

0.6 

1000 

90.0 

? 

? 

Flanges 

29 

91.0 

0 

0 

? 

? 

Other 

1.7 

5.3 

16 

1.4 

7.9 

8.6 

Total 

31.9 

100.0 

1112 

100.0 
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The effect of maintenance on emission rates is shown in 
the data in Table 15.81 given by Kunstmann. In this a set of 
valves was selected at random and the leak rates were 
measured, the average value being 2.37 g/h. Some 80% of 
the total emission was attributable to the valves with leak 
rates greater than 2 g/h. The leak rates of these valves were 


Table 15.75 Emission factors in Los Angeles County 
project (AP-42) (after Environmental Protection Agency, 
1973) 


Source 

inspected 

Items 

tested 

Emission 
rate (g/h) 

Pumps 

473 

75 

79 

Valves 

9521 

100 

3.8 

Flanges 

326 

129 

0 

Compressors 

326 

90 

161 

Relief valves 

165 

165 

55 


reduced by maintenance and their leak rates were remeas¬ 
ured with the result that the average leak rate for all the 
valves was reduced to 0.44 g/h. 


15.55.5 Emission losses from storage tanks 

Losses from storage tanks have been the subject of a series 
of API bulletins, including: 


API Bull. 2513: 1959 Evaporation Loss in the Petroleum 
Industry - Causes and Control (reaffirmed 1973) 

API Bull. 2516: 1962 Evaporation Loss from Low Pres¬ 
sure Tanks 

API Pub. 2517: 1980 Evaporation Loss from External 
Floating Roof Tanks 

API Bull. 2518: 1962 Evaporation Loss from Fixed Roof 
Tanks 

API Pub. 2519: 1983 Evaporation Loss from Internal 
Floating-roof Tanks 


Table 15.76 Emission factors in Radian project (Wetherold, Rosebrook and Tichenor, 1981) 

Source Emission rate (g/h) 

Mean 95 % confidence limits 

Lower Upper 


Pump seals 

Light liquid service 113 

Heavy liquid service 20.9 

Valves 

Gas/vapour service 26.8 

Light liquid service 10.9 

Heavy liquid service 0.23 

Hydrogen service 8.16 

Flanges 0.25 

Compressor seals 

Hydrocarbon service 635 

Hydrogen service 49.9 

Pressure relief valves 86.2 

Drains 31.8 

Open-ended lines 2.3 


73 

8.6 

14 

7.7 

0.1 

3.2 

0.1 

300 

20 

32 

10 

0.73 


170 

50 

49 

16 

0.68 

20 

1300 

100 

220 

91 

7.3 


Table 15.77 Emission factors in Monsanto project (after T. W. Hughes, Tierney and Khan, 1979) (Courtesy of the 
American Institute of Chemical Engineers) 


Source Emission rate by plant type (g/h) a 



Monochloro 

benzene 

Butadiene 

Dimethyl 

terephthalate 

Ethylene 

oxidelglycol 

Pump seals 

7.7(23) 

63(160) 

3.3(20) 

13(82) 

Valves 

0.05(1.5) 

17(120) 

1.5(32) 

0.07(1.6) 

Flanges 

2.2(82) 

0 

3.4(110) 

0.03(1.0) 

Compressor seals 

- 

54(59) 


5.9(11) 

Relief valves 

- 

5(14) 

0 

0 

Agitators 

200(200) 

- 

145(218) 

- 

Drains 

- 

- 

- 

40(68) 

Sample valves 

- 

- 

40(91) 



a The figures given are average emission rates, those without parentheses being for all potential sources and those within parentheses being 
for significant sources. 
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Table 15.78 Emission factors in BASF project (after Bieri, 1980) 

Items tested Literature value (g/h) Emission rates 

Measured value 


(% of literature value) (g/h) 


Pumps 

67 

60 

9 

5.4 

(mechanical seals) 

Valves 

General 

1800 

2.8 

20 

0.56 

High pressure valves 

400 

2.8 

18 

0.50 

Ball valves and stop- 

125 

2.8 

0.5 

0.014 

cocks 

Flanges 

Gas service 

5000 

0.2 g/h m 

2.5 

0.005 

Liquid service 

600 

2.0 g/h m 

2.0 

0.04 

High pressure flanges 

950 

0.2 g/h m 

4.8 

0.01 

Reciprocating compressors 

13 

104 

12.5 

13 

Relief valves 

50 

55 


0.61 

Agitators 

8 

60 

0.2 

0.12 

(mechanical seals) 


Table 15.79 Some composite emission factors (after 
Schroy, 1979) 


Source 

Emission rate a (g/h) 

Flanges 

Gas service (10-20 bar) 

0.02 g/h m 

Liquid service (10—20 bar) 

0.2 g/h m 

High pressure (40-80 bar) 

0.01 g/h m 

Valves 

Gate and control valves 

10-20 bar 

6 

40-80 bar 

0.1 

Ball valves 

0.015 

Pressure relief valves 

2.8 

Pressure relief valve + 

0 

bursting disc 

Pumps and centrifugal compressors 

Packed seals 

80 

Single mechanical seals 

Process fluid flush 

6 

Water flush 

0.02 

Double mechanical seals 

0 

Reciprocating compressors 

Rod single packing 

161 

Rod double packing 

13 

Agitators 

- b 

Tanks: 

Floating roof 

- c 


a Emission rate is expressed as g/h per metre of outer flange 
circumference. 

b Use packed or double mechanical seal data for pumps with the 


Loss for agitator = Loss for pump (x m/1.9 where u is the face velocity 
(m/s). 

c Loss 60% of value estimated from method given in API Bull, 2517. 


Table 15.80 Distribution of emission rates for valves in 
light liquid service (A.L. Jones, 1984) (Courtesy of the 
Institution of Chemical Engineers) 


No. of valves 

Emission rate (g/h) 

573 

0 

4 

0.0076 

10 

0.021 

14 

0.056 

28 

0.152 

40 

0.414 

58 

1.125 

50 

3.06 

52 

8.32 

46 

22.6 

20 

61.4 

12 

167 

4 

454 

2 

1234 


API Bull. 2521: 1966 Use of Pressure-Vacuum Vent Valves 
for Atmospheric Pressure Tanks to Reduce Evapora¬ 
tion Loss 

API Bull. 2522: 1967 Comparative Test Methods for Evalu¬ 
ating Conservation Mechanisms for Evaporation Loss 
API Bull. 2523: 1969 Petrochemical Evaporation Loss 
from Storage Tanks 


These publications give equations for the estimation of 
evaporation losses. 

Extensive work has been done on emissions from float¬ 
ing roof tanks.The background to this work is discussed by 
Zabaga (1980), by Hanzevack, Anderson and Russell (1983) 
and by Laverman (1984). 
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Table 15.81 Effect of maintenance of emission rates of 
valves (after Kunstmann, 1980)(Courtesy of Elsevier 
Sequoia SA) 


A 

Valves before maintenance 



Valves tested 

Emission rate 
(g/h) 

No. 

(%) 

31 

79 

0-2 

6 

16 

2-10 

2 

5 

10-50 

0 

0 

>50 

B 

Valves after maintenance 


36 

92 

0-2 

3 

8 

2-10 

0 

0 

10-50 


15.55.6 Control of fugitive emissions 

The information on emission factors given above indicates 
that for a given type of emission source there is a wide 
variability in emission rates but also that for almost all 
types the technology exists to reduce the emission rate to a 
low level. A detailed review of the methods of obtaining 
leak tight plant is given in the BOHS Guide. A further 
account is given by Bierl et oil. (1977). The BOHS Guide 
describes the following types of seal: 

(1) static seals 

(a) gasketed joints (full faced flanges, narrow faced 
flanges), 

(b) automatic face seals; 

(2) dynamic seals 

(a) contact seals, 

(b) clearance seals (bushing seals, labyrinth seals); 

(3) miscellaneous seals 

(a) O-rings, 

(b) flexible lip seals. 

The Guide also gives a detailed account of packed glands 
(stuffing boxes) and mechanical seals. 

For flanges, the Guide describes the elements of good 
practice necessary to reduce leakage. Its principal proposal 
for cases where high leak-tightness is required is the elimi¬ 
nation of flanges by the use of all-welded pipe. 

For valves, leakage of the rising stem may be reduced by 
the use of 100% graphite packing. For high leak-tightness 
use may be made of bellows-sealed or diaphragm-sealed 
valves. Bellows-sealed valves were developed for use in the 
nuclear industry. The Guide gives the following emission 
rates for rising stem valves: 


Emission rate 
(Fg/s) 


Regular packing 


<20 bar 

100 

>20 bar 

2 

100% graphite packing 


<20 bar 

12 

>20 bar 

0.2 


For pumps, the Guide gives the following emission rate 
index: 


Seal type 

Shaft emission rate index 

Regular packing 

100 

Regular packing 

10 

with lantern ring 


100% Graphite packing 

10 

Single mechanical seal 

1.2 

Double mechanical seal 

0.004 


For bellows seal pumps, diaphragm pumps and canned 
pumps the index is zero. Details of the seal arrangements 
are given in the Guide. A further discussion of packed 
glands is given by Hoyle (1978). 

For agitators, the Guide states that the pump data may 
also be used as a guide to the relative effectiveness of the 
different seal types. A discussion of agitator seals is given 
by Ramsey and Zoller (1976). 

The sealing of centrifugal or reciprocating compressors 
is appreciably more difficult than the sealing of 
pumps. Labyrinth seals are commonly used on both types, 
but leakage rates are high, being typically 1-2% of the 
flow through the compressor. Carbon seals give lower leak 
rates, but for a more positive seal the Guide suggests oil 
film seals or mechanical seals with oil flush. A further 
discussion of centrifugal compressor seals is given by 
WE. Nelson (1977). 

15.55.7 Economics of emission control 

Several studies have been published on the economics of 
emission losses and of control measures, including those by 
Kittleman and Akell (1978), Wetherold et al. (1983) and 
Rhoads, Cole and Norton (1984). The cost of control meas¬ 
ures is also considered by Kunstmann (1980). These studies 
tend to be concerned with the costs of reducing leaks and 
with minimization of these costs rather than with savings 
obtained by leak elimination. The general conclusion is that 
effort should be concentrated on individual sources with a 
high leak rate, the outliers, and that thereafter the law of 
diminishing returns sets in strongly. 


15.56 Leaks and Spillages 

Leaks and spillages are main causes of fire and explosion in 
chemical plants. They may give rise to a local fire or explo¬ 
sion, a wider flash fire or a large vapour cloud explosion. 
Some of the situations which can give rise to leaks and spill¬ 
ages have been described by Kletz (1975b). They include: 

(1) leaks from pump glands and seals; 

(2) leaks from joints, valves and fittings; 

(3) spillages from drain valves; 

(4) spillages occurring during maintenance work; 

(5) spillages from road and rail tankers. 

Leaks have occurred not infrequently on pumps handling 
cold liquid ethylene. In some cases vapour clouds have been 
formed, while in others the leak has ignited, apparently due 
to static electricity. 

On pumps handling C 3 and C 4 hydrocarbons at ambient 
temperature and moderate pressure there is little trouble 
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with seal leakages, but failures have occurred on high 
pressure injectors. 

Joints, valves and fittings are common sources of leak¬ 
age due to features such as loose bolts, ruptured gaskets, 
failed instrument connections. 

Another fertile source of spillage is drain valves. Typi¬ 
cally a drain valve blocks due to ice or hydrate formation, 
the blockage is cleared in some way, but it then proves 
impossible to shut the valve off. 

The disaster at the Rhone Alps refinery at Feyzin in 1966 
(Case History A38) began with blockage in a drain line from 
a propane storage sphere which was almost certainly 
caused by ice or hydrate. The drain line was a vertical pipe 
below the sphere and had two valves on it. The standing 
instruction was to drain by opening the top valve and con¬ 
trolling the flow with the lower one so that, if necessary, the 
former could be used to shut the flow off. But the operator in 
fact turned the bottom valve wide open and controlled 
draining from the top one. When this latter valve blocked, 
he opened it further, the blockage gave way and a jet of 
propane came out full bore through the 2 in. line, struck the 
ground, rebounded into the operator’s face and knocked 
the handle off the valve. Attempts to replace the handle on 
the top valve or to shut the bottom one failed. There was 
a massive escape of propane, the vessel was engulfed by 
fire and 18 people were killed. 

Maintenance work sometimes gives rise to spillages. 
This is usually the result of failure to ensure isolation of 
equipment. Isolation procedures are described in Chapter 21. 
Failures of connecting hoses on road and rail tankers at 
filling terminals are not unusual. These are discussed in 
Chapter 22. 

The volume of vapour generated by a liquid spillage can 
be very large. Moreover, only a small percentage of vapour 
is needed to give a flammable mixture. Thus one volume of 
liquid can become 10,000 or more volumes of a flammable 
vapour-air mixture. Leaks of liquefied flammable gas 
(LFG) of different sizes are discussed in the ICILFG Code 
(ICI/RoSPA 1970IS/74). 

Small leaks such as those from pump and valve glands or 
pipe joints are quite probable, but usually involve little risk, 
provided that the leak is discovered quickly, the gas is dis¬ 
persed rapidly and there is no nearby source of ignition. 
Dispersion is assisted by ventilation and may be promoted 
by steam from a steam lance. 

Medium leaks are defined as those large enough to go 
beyond the plant boundaries. The leak should be isolated 
if possible. Isolation by the use of hand valves near the leak 
may be hazardous and the use of remotely operated isola¬ 
tion valves is preferable if the latter are available. It may be 
noted that excess flow valves do not operate at lower leakage 
rates. 

Attempts should also be made to disperse the leakage 
and to prevent it finding a source of ignition. Use may be 
made of steam curtains, if installed, or of mobile water 
curtains. A leak of LFG which is water soluble can be dealt 
with by diluting it with large amounts of water. 

Major leaks are defined as those of 1 ton/h or more. The 
methods just described are appropriate, but a major leak 
usually gives rise to a large pool of liquid. There is typically 
a rapid flash-off of vapour followed by slower vaporization 
from the pool. It is necessary, therefore, to decide how the 
liquid is to be handled. One method is to assist vaporization 
and dispersion, another is to suppress vaporization and to 
dispose of the liquid. Vaporization may be suppressed by 


laying foam on the surface. In some cases the formation of 
an ice layer effects complete suppression. 

Leaks are also discussed by J.R. Hughes (1970) who 
states that a leak of more than 1 UK gal/h (4.51/h) would be 
regarded as unusual on a modern pump seal and would not 
be allowed to continue, and that experiments on this size of 
leakage with motor gasoline have shown that in the open air 
the concentration of vapour produced is so small that a 
flammable concentration exists only within a few inches of 
the leakage point. 

Hughes also describes experiments involving the spil¬ 
lage of two pints (11) of gasoline. In a light wind of 2 mile/h 
(3.2 km/h) the vapour cloud floated downwind and gave a 
flammable concentration near the ground at 20 ft (6 m) 
downwind, but at a few inches above ground the con¬ 
centration was undetectable. For spillage near a low wall 
the distance at which the cloud gave a flammable con¬ 
centration increased to 30 ft (9.1 m). 

Leaks in confined spaces, such as an enclosed and poorly 
ventilated compressor or pump house, are another matter 
and can easily build up to flammable concentrations, giv¬ 
ing rise in due course to a fire or explosion. 


15.57 Notation 


Bowen ratio 
Froude number 
Grashof number 
Mach number 
Nusselt number 
Peclet number 
Prandtl number 
Reynolds number 
Richardson number 
Rossby number 
Schmidt number 
Sherwood number 
Stanton number 
Weber number 
specific heat 

acceleration due to gravity 
reduced gravity 
molecular weight 
absolute pressure 
universal gas constant 

absolute temperature 
ratio of gas specific heats 
reduced density 
viscosity 
density 

density difference 


Superscript 


time derivative 


Subscripts 

max maximum 

r or ref reference 

Note: 

(a) Some of these variables have different local defini¬ 
tions, for example; P (probability), R (radius of cloud), 
T (time interval), y (edge entrainment coefficient). 
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(b) 

There ar 

s'- 

e different definitions of the reduced gravity 

Subscripts 

accelerational 

critical 

Section 15.1 


f 

frictional 

a 


cross-sectional area of pipe 

g 

gravitational 

a c 


cross-sectional area of 

1 

liquid 



vena contractor 

V 

vapour 

a Q 


cross-sectional area of orifice 

1 

intial, upstream, stagnation 

A 


cross-sectional area of pipe or orifice; 

2 

final, downstream, outlet 



constant defined by 

Equation 15.1.62 

Subsection 15.1.9 


B 


constant defined by Equation 15.1.63 

d 

diameter of pipe (m) 

C 

C c 

C cv 


velocity of sound 
effective coefficient of discharge 
coefficient of contraction 
coefficient of contraction at vena 

G 

G* 

k 

mass velocity of gas (kg/m 2 /s) 
critical mass velocity of gas through an 
adiabatic nozzle (kg/m 2 s) 
expansion index 

Cd 

Cy 


contracta 

(external mouthpiece) 
coefficient of discharge 
coefficient of velocity 

L 

N 

P 

length of pipe (m) 
pipe resistance factor 
absolute pressure (N/m 2 ) 

d 


diameter of pipe or orifice 





pipe roughness 

Subsection 15.1.10 

f 


friction factor 

A 

cross-section area of vessel at height h 

/d 


Darcy friction factor 


(m 2 ) 

/f 


Fanning friction factor 

A a 

cross-sectional area of orifice (m 2 ) 

F 


total frictional loss 

C 

constant defined by Equation 15.2.95 

F c 


frictional loss due to sudden 

C D 

coefficient of discharge 


contraction 

D 

diameter of cylinder (m) 

F f 


frictional loss due to pipe 

g 

acceleration due to gravity (m/s 2 ) 

F tt 


frictional loss due to fittings 

h 

height of liquid above bottom of 

G 


mass velocity 


vessel (m) 

h 



h 0 

height of orifice, or hole, above bottom 

h c 


head loss due to contraction 


of vessel (m) 

hn 


head loss due to fittings 

hp 

equivalent liquid height (m) 

H 


enthalpy 

H 

height of vessel (m) 

k 


expansion index 

L 

length of horizontal cylindrical 

K 


number of velocity heads 


vessel (m) 

K 


total number of velocity heads lost 

A P 

pressure difference between liquid 

K e 


number of velocity heads lost at 


surface and atmosphere, imposed 



entrance 


pressure (Pa) 

K f 


number of velocity heads lost due to 

Q 

outflow through orifice (m 3 /s) 



friction 


time (s) 

K it 


number of velocity heads lost due to 

V 

volume of vessel (m 3 ) 



fittings 

X 

dimensional hole height 

l 


distance along pipe, length of pipe 

e 

half-angle of cone of vertical conical 

q 


heat absorbed from surroundings 


vessel (°) 

Q 


total volumetric flow 


density of liquid (kg/m) 

R 


shear stress at pipe wall (Equation 
15.1.15) 

T 

dimensionless drainage time 

R 0 


shear stress at pipe wall (Equation 

Section 15.2 




15.1.11) 

A 

cross-sectional area of pipe 

S 


entropy; perimeter of pipe (Equation 

C 

parameter defined by Equation 15.2.47 



15.1.11) 

C D 

coefficient of discharge 

u 


velocity 

d 

diameter of pipe 

u c 


velocity at vena contractor 

f 

friction factor 

V 


specific volume 

F 

friction loss 

W 


total mass flow 

G 

mass velocity 

w s 


work done on surroundings, shaft work 

h 

specific enthalpy 

X 


mass fraction of vapour in wet vapour, 

k 

slip ratio 



or quality 

l 

distance along pipe, length of pipe 

2 


vertical distance, height 

n 

poly tropic index 

Z 


compressibility factor 

dPJdl 

pressure drop due to acceleration 

y 


ratio of gas specific heats 

dPi/dl 

pressure drop due to friction 

n 


pressure ratio 

(dPf/d/) g 

pressure drop which would occur if gas 

0 


friction factor 


phase were flowing alone in pipe 
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(dPf/d/) g0 

pressure drop which would occur if 
whole fluid were flowing alone in pipe 

4 

(dPf/d/)! 

pressure drop which would occur if gas 

N 


fluid were flowing as liquid in pipe 

P 

(dPf/d/)i 0 

pressure drop which would occur if 

P” 


whole fluid were flowing as liquid 

AP 


in pipe 

P a 

dPg/d/ 

pressure drop due to gravitational 

Pc 

forces 

Po 

Q 

volumetric flow 

P v 

Po 

shear stress at wall 

R g 

S 

perimeter of pipe 


u 

velocity 
specific volume 

u 

W 

mass flow 

V 

x 

mass fraction of vapour, or quality 

X 

X 

parameter defined by Equation 15.2.41 
vertical distance, height 

1 


fraction of volume occupied by vapour, 
void fraction, or voidage; parameter 
defined by Equation 15.2.3 

C 

Pi 

P 

vapour phase volumetric flow fraction; 
parameter defined by Equation 15.2.4 

Pm 

r 

n 

parameter defined by Equation 15.2.42 
critical pressure ratio 

Subscripts 

X 

parameter defined by Equation 15.2.1 

b 


surface tension 


<t> 

parameter used in Equations 

E 


15.2.40-15.2.43 

ERM 

* 

parameter defined by Equation 15.2.2 

f 

fg 

Subscripts 


g 

h 

c 

critical 

m 

E 

equilibrium 

n 

g 

gas 

t 

go 

gas only 


h 

1 

homogeneous 

liquid 

Section 15 

lo 

liquid only 

Q 

L 

all liquid condition 
two-phase mixture 

/ 

Fi 


stagnation 

s 

two-phase 

G 


water 

G* 

G 0 

Section 15.3 


L 

A 

cross-sectional area of aperture 

N 

A p 

cross-sectional area of pipe 


Cl 

specific heat of liquid 

V 

C 

specific heat of liquid 

X 

cl 

modified cavitation number 

a 

Cd 

coefficient of discharge 

n 

Cdm 

modified coefficient of discharge 

e 

d 

diameter of pipe 


f 

friction factor 


r 

friction factor (two-phase flow) 

Subscripts 

fm 

average friction factor 

c 

F 

flow correction factor 

f 

F' 

friction loss 

fg 

G 

mass velocity 

1m 

k 

slip ratio 

o 

K 

l 

coefficient of discharge 
distance along pipe, length of pipe 

s 


equilibrium, or relaxation, length 
polytropic index 
non- equilibrium parameter 
absolute pressure 

absolute effective downstream pressure 
pressure drop 

absolute atmospheric pressure 
absolute back pressure in choked flow 
absolute stagnation pressure 
absolute vapour pressure 
fraction of cross-sectional area 
occupied by vapour 
specific entropy 
average velocity 
specific volume 

mass fraction of vapour, or quality 
void fraction 

parameter defined by Equation 15.3.12 
parameter defined by Equation 15.3.34 
parameter defined by Equation 15.3.16 
density of liquid 
average density 


downstream 
critical 
equilibrium 
equilibrium rate model 
liquid 

transition from liquid to vapour 
vapour 

constant enthalpy 
liquid 

two-phase mixture 
two-phase annular 
throat 


specific heat of liquid 
diameter of pipe 
friction factor 
flow inclination number 
specific enthalpy 
mass velocity 

dimensionless mass velocity 
mass velocity through nozzle 
length of pipe 
pipe resistance factor 
specific entropy 
specific volume 

mass fraction of vapour, or quality 
void fraction 
pressure ratio 

angle between pipe axis and vertical 


critical 

liquid 

transition from liquid to vapour 

limiting 

stagnation 

reduced 

saturation 
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Section 15.5 


A 

A k 

Co 

D 

F 


hfg 


H 
H * 


H 0 


•7g 

7gi 

h 

iig 

t 

L 


Vex 

S 

u 

Uc 

u g 

If 

u s 

Uoo 

Vi 


s 

* 

a 


parameter defined by Equation 15.15.53 
area of vent (m 2 ) 

cross-sectional area of vessel (m 2 ) 
distribution parameter 
diameter of vessel (m) 
geometric factor 

latent heat of vaporization (kj/kg) 
height of liquid (m) 
dimensionless liquid height 
height of interface below which there is 
no vapour carryunder (m) 
height of liquid without swell (m) 
height of vessel (m) 
total volume flux, or superficial 
velocity (m/s) 

superficial velocity of gas (m/s) 
superficial velocity of gas phase relative 
to liquid phase, drift flux (m/s) 
superficial velocity of liquid (m/s) 
superficial velocity of liquid phase 
relative to gas phase, drift flux (m/s) 
vapour superficial velocity (m/s) 
dimensionless heat flux constant 
length of vessel (m) 
index 
index 

heat input per unit mass (kW/kg) 
external heat input flux (kW/ m 2 ) 
volumetric source strength (m 3 /s) 
velocity (m/s) 

downward liquid recirculating 
velocity (m/s) 

area average velocity of gas (m/s) 
area average velocity of liquid (m/s) 
upward liquid superficial velocity 
(m/s) 

bubble rise velocity (m/s) 
volume of liquid (m 3 ) 
mass fraction of vapour at vent 
vertical distance from bottom of 
vessel (m) 
void fraction 

initial void fraction, or freeboard 
thickness of boundary layer (m) 
geometric factor 
parameter density (kg/m 3 ) 
surface tension (N/m) 
dimensionless source strength, 
dimensionless velocity 
ratio of vessel area to vent area 


Superscript 


average 


Subscripts 


Section 15.6 

See Section 15.4 plus 

A cross-sectional area of valve (m 2 ) 

Am cross-sectional area of inlet pipe (m 2 ) 


A 2 

Q 

Din 

d 2 

f 

g 

G 

h 

H 

K 

l 2 

Lin 

A P iT 

P 

Pb 

Pc 

Po 

p s 

T 


W 


fg 


req 


2 


P s 

74 

R 

S 

T 

T 


T c 

V 


cross-sectional area of 
outlet pipe (m 2 ) 
specific heat of liquid (J/kg K) 
diameter of inlet pipe (m) 
diameter of outlet pipe (m) 

Fanning friction factor 

acceleration due to gravity (m/s 2 ) 

mass velocity (kg/m 2 s) 

specific enthalpy (J/kg) 

change in elevation (m) 

valve discharge coefficient 

length of outlet pipe (m) 

length of inlet pipe (m) 

total pressure difference across inlet 

pipe (Pa) 

absolute pressure 

absolute back pressure at orifice (Pa) 
absolute critical pressure (Pa) 
absolute stagnation pressure in 
vessel (Pa) 

absolute saturation pressure of 
liquid (Pa) 

absolute temperature (K) 
specific volume (m 3 /kg) 
average specific volume in inlet pipe 
(m 3 /kg) 

mass flow (kg/s) 

mass fraction of vapour, or quality 
void fraction 

pressure ratio defined by Equation 15.6.5 

density (kg/m 3 ) 

parameter 


actual 

critical 

liquid 

liquid-vapour transition 

vapour 

stagnation 

required 

saturation 

upstream end of outlet line 
downstream end of outlet line 


velocity of sound in gas at choke (m/s) 
cross-sectional area of choke (m 2 ) 
coefficient of discharge 
enthalpy (J/kg) 
absolute pressure (Pa) 
absolute pressure at which metastability 
is no longer supported (Pa) 
absolute saturated vapour pressure of 
liquid (Pa) 

absolute orifice pressure (Pa) 
universal gas constant (kj/mol K) 
entropy (kJ/kgK) 
absolute temperature (K) 
absolute temperature upstream of 
orifice (K) (Equation (15.7.7) 
absolute critical temperature of 
liquid (K) 

volume of vessel (m 3 ) 
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mass flow from vessel (kg/s) 
depressurization rate (N/m 2 s) 
density of gas (kg/m s ) (Equations 
15.7.1-15.7.6); density (Equations 15.7.7 

V 

vapour 

1,2 

initial and final states 

Subsections 15.8.3 and 15.8.4 

and 15.7.8) 


radius of initial cloud formed on 

surface tension of liquid (N/m) 


completion of bursting process 



concentration 


l 

mixing length 

choke 

r 

radial distance 

downstream 

u' 

fluctuating velocity 

gas 

V s 

effective volume of vapour 

vessel 


propagation velocity of cloud boundary 

liquid 

x c 

parameter characterizing mass fraction 

initial 


of gas in core 

isentropic 

e 

eddy diffusion coefficient 

upstream 

t 

dimensionless time 


Section 15.8 


Subsection 15.8.1 

h height of liquid in vessel 

hb height reached by liquid on depressur¬ 

ization 

h 0 initial height of liquid 

h v height of vessel 

A H v latent heat of vaporization 

K ratio of vent area to vessel cross- 

sectional area 

AT superheat 

<5 diameter of vapour nucleus 

p density 

a surface tension 


Subscripts 

c core concentration 

g core radius 

ign within flammable limits 

o initial cloud 


Subsection 15.8.5 

M 

N 


A 

P 


concentration at transition 
initial mass of liquid 
transition criterion 
distance 

time to transition 
volume of vapour released 
radial velocity 
momentum per unit mass 
buoyancy term 
density 


Subscripts 

1 

nb 

onb 


liquid 

nucleate boiling 
initial 

onset of nuclear boiling 
retained 
saturation value 
vapour 


Subsection 15.8.2 
A 1 area of aperture 

A 2 area of cloud perpendicular to direction 

of expansion at end of second stage 
(Hardee and Lee model) 
c constant 

h height of cloud; specific enthalpy 

(Equation 15.8.4) 

r radius, radial distance 

s specific entropy 

u velocity 

V volume of cloud 

W initial mass of fluid 

p density 

ip momentum of cloud 


<P e 

* 


Subscripts 


Subscripts 

d dump 

f liquid 


fs 

g 


cross-sectional area of pipeline 

diameter of pipeline 

friction factor 

Darcy friction factor 

length of pipeline 

mass flow from pipeline 

correction factor 

velocity 

specific volume 

mass hold-up in pipeline 

void fraction 

distance along pipeline from rupture 
point 

time constants 

parameter defined by Equation 15.9.14 
parameter defined by Equation 15.9.7a 


exit 

liquid 

superficial value for liquid 
vapour 

two-phase interface 
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Section 15.10 


area of pool 

logarithmic mean concentration 

difference 

total concentration 

pool diameter or, more generally, 

characteristic length 

diffusion coefficient 

heat transfer coefficient 

latent heat of vaporization 

j factor for heat transfer 

j factor for mass transfer 

thermal conductivity 

mass transfer coefficient 

mass vaporization rate per unit area 

partial pressure 

vapour pressure 

heat flow per unit area 

heat flow per unit area by conduction 

from ground to pool 

heat flow per unit area by convection 

from atmosphere to pool 

net heat flow per unit area by radiation 

from pool 

heat flow per unit area by radiation 

from atmosphere to pool 

heat flow per unit area by radiation 

from pool to atmosphere 

heat flow per unit area by solar 

radiation to pool 

heat required per unit area for 

vaporization 

total heat transferred per unit area 
point Reynolds number 
velocity 
mass of liquid 

vertical distance down into soil 
thermal diffusivity 
emissivity 

temperature above datum, or soil, 

temperature 

constant 

surface tension (Equation 15.10.4); 
Stefan-Boltzmann constant 
(Equations 15.10.35 and 15.10.36) 
fraction of liquid vaporized, flash 
fraction 
solar constant 


air, atmosphere 

normal boiling point 

drop 

initial 

liquid 

initial 

soil 

vapour 


oo atmosphere beyond influence of pool 

Equations 15.10.10 and 15.10.11: 
k constant 

Mi molecular weight of component i 

Mto initial mass of liquid 

n T moles of liquid 

pi s vapour pressure of component i 

Xio initial mol fraction of component i in 

liquid 


Subsection 15.10.4 

a constant defined by Equation 15.10.41 

D diffusion coefficient of vapour in air 

(cm 2 /s) 

E evaporation rate (g/s) 

/i,/ 2 parameters defined by Equations 

15.10.45 and 15.10.46 

k von Karman constant 

K constant defined by Equation 15.5.39 

K' constant defined by Equation 15.5.40 

M molecular weight 

n diffusion index 

p° vapour pressure of liquid (dyn/cm 2 ) 

r radius of pool (cm) 

R universal gas constant (erg/gmol K) 

T absolute temperature (K) 

u wind speed (cm/s) 

U\ wind speed at height Zi (cm/s) 

xo downwind length of pool (cm) 

y 0 crosswind width of pool (cm) 

z height (cm) 

Zi height at which wind speed ui is 

measured (cm) 

X parameter (cm 2 /s) 

v kinematic viscosity of air (cm 2 /s) 

Xo concentration (g/cm 3 ) 

Equations 15.10.50 and 15.10.51 

As for Subsection 15.10.4, but with SI units plus 

a, a! constants 

Subsection 15.10.5 
Cd drag coefficient 

u wind speed 

p e density of gas at 10 m from pool 

p sg saturation density of gas at ambient 

conditions 


Subsection 15.10.6 
c specific heat 

C constant 

h heat transfer coefficient 

j m j factor for mass transfer 

k constant 

k m mass transfer coefficient 

N mass transferred per unit area 

p partial pressure 

q cn heat flow per unit area by convection 

from atmosphere to pool 
u wind speed 

* diameter of pool 


Subscripts 

a air, atmosphere 

1 liquid 
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Subsection 15.10.7 

C 
C L 
Cw 
/ 


constant 

constant (for land) 
constant (for water) 
constant 
friction term 
gravity force 
inertia force 
height of pool 
radius of pool 
shape factor 
velocity of pool edge 
volume of pool 
shape factor 
buoyancy term 
kinematic viscosity 


Equation 15.10.80 

m T mass vaporization rate per unit area 

(kg/m 2 /s) 

t time (s) 

Subsection 15.10.10 

A volume of liquid for instantaneous spill 

A p area of pool 

B volumetric flow of liquid for 

continuous spill 

A H v latent heat of vaporization 

k thermal conductivity 

m total mass vaporized 

M s mass of spill liquid 

r radius of pool 

v vaporization, or regression, rate of 

liquid surface 
V volume of pool 

X surface roughness factor 

a thermal diffusivity 

ft constant defined by Equation 15.10.102 

ft constant defined by Equation 15.10.106 

6 parameter defined in Equation 15.10.98 


Subsection 15.10.8 
As Subsections 15.10.1-15.10.3 plus: 

A v vaporization parameter 


Equation 15.10.75 
t time (s) 

v vaporization, or regression, rate of 

liquid surface (cm/s) 


Subsection 15.10.9 
As Subsections 15.10.1-15.10.3 plus 
A volume of liquid for instantaneous 

spill 

ft constant 

m total mass vaporized 

r radial distance 

v vaporization, or regression, rate of 

liquid surface 


Equations 15.10.77 and 15.10.78 

ft mass vaporized per unit area within 

lmin(g/cm 2 ) 

ft steady-state mass vaporization rate per 

unit area (g/cm 2 /s) 

A Hy latent heat of vaporization (cal/g) 

ft, ft constants 


Equation 15.10.79 

m w mass vaporization rate per unit area 

g w heat flow per unit area from water to 

spill 

A T temperature difference between 

substrate and spill 

P coefficient of cubical expansion 

(Equation 15.10.79) 
v kinematic viscosity 


Subscripts 

b normal boiling point 

e end of evaporation 

o initial 

1,2 at time ft t 2 


15.10.11 and 15.10.12 

area of confined spill 
specific heat 

latent heat of vaporization 
thermal conductivity 
characteristic length 
mass vaporization rate per unit area 
heat flux per unit area 
radial distance 

parameter defined by Equation 
15.10.114 

characteristic evaporation time 
time for transition from instantaneous 
to continuous spill, crossover time 
time for spill to cover confined area 
temperature difference between liquid 
at distance n and soil 
vaporization, or regression, rate of 
liquid surface 
volume of pool 

volumetric flow of liquid into con¬ 
tinuous spill 

volume of liquid in instantaneous spill 
thermal diffusivity 
dimensionless maximum spread 
dimensionless time 


Subscripts 

e end of evaporation 

1 liquid 
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sp spill duration 

1 value at radial distance r x 

Subsection 15.10.13 

p fraction which dissolves in water, 

partition coefficient 

r e final evaporation radius (ft) 

4 final evaporation time (s) 

v regression rate (ft/s) 

V volume spilled (US gal) 

A buoyancy term defined by Equation 

15.10.63 


E 

f 

F s 

H 
b 4 
k 
K 

Ka 


K m 


Subsections 15.11-15.66 


slumping coefficient 
distances in downwind, crosswind, 
vertical directions 
wind speed 

wind velocity components in down 

wind, crosswind, vertical directions 

friction velocity 

mixed layer height 

roughness length 

dry adiabatic lapse rate 

standard deviations of wind velocity 

in downwind, crosswind, vertical 

directions 

standard deviations, or dispersion 
coefficients, in downwind, 
crosswind, vertical directions 
concentration (mass per unit volume) 


Subscripts 

cl 

mgl 

x,y,z 


centreline 

critical 

maximum ground level 

transition 

in x, y, z directions 


Section 15.11 

h height of cloud 

p index 

Section 15.12 


Qo 

Ri B 

Rip 

Rimo 


S 


Subsection 15.12.4 

f Coriolis force u / v > w ' 

p pressure 

X,Y accelerations in downwind, crosswind j/2 ~,2 ^,2 

directions representative of forces 
not due to pressure and gravity w * 

(p latitude x 

a> angular velocity of earth 

Subsections 15.12.5-15.12.28 and 15.12.32-15.12.34 a 

a constant ai,a 2 

c constant fi 

c g drag coefficient 

c p specific heat of air e 

d zero plane displacement, displacement 

height 


vertical flux of water vapour, 
evaporation rate 
Coriolis force 
vertical flux 

scale height of neutral atmospheric 
boundary layer 

vertical heat flux, sensible heat flux 

intensities of lateral, vertical turbulence 

von Karman constant 

coefficient of exchange, turbulent 

exchange coefficient 

coefficient of exchange for heat, eddy 

thermal diffusivity 

coefficient of exchange for momentum, 

eddy diffusivity for momentum, 

eddy viscosity 

adiabatic value of 

coefficient of exchange for water 

vapour, eddy diffusivity 

mixing length 

Monin—Obukhov length 

latent heat of vaporization 

latent heat of water vapour 

index 

index (Subsection 15.12.8 and 15.12.25); 
absolute pressure (Subsection 
15.12.13) 

absolute pressure at surface 

Rvalue 

Rvalue 

concentration of water vapour, or 

specific humidity 

surface heat flux 

bulk Richardson number 

flux Richardson number 

modified Richardson number 

environmental stability 

non-dimensional windshear (Equation 

15.12.25); mean quantity of property 

per unit mass of air (Equation 

15.12.55) 

scale parameter 

absolute average temperature of mixed 
layer 

geostrophic wind speed 
wind speed ratio 

wind speeds in downwind, crosswind, 

vertical directions 

mean wind speeds in downwind, 

crosswind, vertical directions 

wind speed fluctuations in downwind, 

cross-wind, vertical directions 

variances of wind speed in downwind, 

crosswind, vertical directions 

convective velocity 

parameter defined by Equation 

15.12.108 

height 

Monin—Obukhov coefficient 
constants 

ratio of specific heats of air; constant 
(Equation 15.12.49b) 
mean height of roughness elements 
(Subsection 15.12.12); eddy 
dissipation rate (Subsection 15.12.28) 
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9 

C 


</> H 

4>M 


potential temperature 
Monin-Obukhov parameter 
Kazanski-Monin parameter 
kinematic viscosity of air 
density of air 

density difference between cloud 
and air 

standard deviation of azimuth 
standard deviation of elevation 
standard deviation of horizontal 
direction of wind 

standard deviation of inclination to 
horizontal of wind 

mean momentum flux per unit area, 

Reynolds stress 

similarity factor for heat flux 

similarity factor for 

momentum flux 

similarity factor for property s 

similarity factor for water 

vapour flux 


Sections 15.14 and 15.15 
Subsection 15.14.1 

K diffusion coefficient (m 2 /s) 

K x , K y , K z diffusion coefficients in downwind, 

cross-wind, vertical directions (m 2 /s) 
r radial distance (m) 

t time (s) 

u, v, w wind speeds in downwind, crosswind, 

vertical directions (m/s) 

x,y, z distances in downwind, crosswind, 

vertical directions (m) 

X concentration (kg/m 3 ) 

Subsection 15.14.5 

D diffusion coefficient, diffusivity 

k thermal conductivity 

l characteristic dimension 

u velocity 

v kinematic viscosity 


Subscripts 

s property specified 

1,2 at height 10 and 5 m, respectively 


Equation 15.12.40 

H sensible heat flux (W/m 2 ) 

S incoming solar radiation (W/m 2 ) 

Equation 15.12.80 
p index 

t sampling period 

Equations 15.12.112-15.12.114 
A,B constants 

Q m maximum surface heat flux 

Zi m maximum mixed layer height 

i time after sunrise 


Subsection 15.12.29 

i intensity of turbulence 

r radius of eddy 

f E Eulerian time scale 

f L Lagrangian time scale 

P ratio of Lagrangian to Eulerian time 

scales 

co tangential velocity 


Subsections 15.12.30 and 15.12.31 

R{x) correlation coefficient 

R(x) correlation coefficient 

t time 

u velocity 

u' component of velocity 

x distance 

o x standard deviation in downwind 

direction 

t time 


Subscripts 

1,2 points 1,2 


Section 15.16 


Subsections 15.16.1, 15.16.2 and 15.16.5 
As Subsection 15.14.1 plus 
C diffusion parameter (m (1/2) ”) 

C x , C yi C 2 diffusion parameters in downwind, 

crosswind, vertical directions 
(m (1/2) ") 

h height of source (m) 

H height of source (m) 

K diffusion coefficient (m 2 /s) 

K 0 modified Bessel function of second kind 

n diffusion index 

p index 

Q continuous mass rate of release (kg/s) 

O' continuous mass rate of release per 

unit length (kg/ms) 

Q* mass released instantaneously (kg) 

y Q , z D cloud bondary in y, z directions (m) 

o x ,<j y ,o z standard deviations, or dispersion 

coefficients, in downwind, cross 
wind, vertical directions (m) 


Subsection 15.16.3 

C ground level concentration (units/m 3 ) 

C c ground level concentration axis of 

plume for elevated source (units/cm 3 ) 
C 0 ground level concentration axis of 

plume (units/m 3 ) 

d distance in downwind direction (km) 

d! half- distance for development of 

uniform vertical concentration 
profile (km) 

F 1 stack correction factor 

F 2 off-axis correction factor 

h vertical spread (m) 

h! limiting vertical spread (m) 

H height of stack (m) 

Q mass rate of release (units/min) 

x downwind distance (m) 

u mean wind speed (m/s) 

P deviation from axis (°) 
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6 lateral spread (°) 

<7 y standard deviation of concentration in 

crosswind direction (m) 

og standard deviation of wind direction (°) 

<70 standard deviation of wind inclination 

(rad) 

<j> wind inclination (rad) 

Subsections 15.16.6-15.16.8 

As sections 15.16.1-15.16.4 plus 
D dosage 

Am total integrated dosage 

e base of natural logarithms 

L load 

n index (Equation 15.16.67) 


Subscripts 

f flat terrain 

o effective source height 

Subsection 15.17.4 

A larger of dimensions height h and 

A smaller of dimensions height h and 

h height of building 

h a height of source 

l alongwind length of building 

R scaling factor 

w crosswind width of building 


Subscripts 

cb cloud boundary 

cc cloud centre 

ex extinction 


Subsection 15.16.9 

C 

Vi 


V 

x b 


volumetric concentration (v/v) 

distance between first virtual source 

and actual source (m) 

distance between second virtual 

source and actual source (m) 

volume of gas released (m 3 ) 

downwind distance (m) 

distance between actual source and 

works boundary (m) 

distance between actual source and 

point of interest (m) 

distance between first virtual source 

and works boundary (m) 

distance defined by Equation 15.16.72 


Equations 15.17.11-15.17.15 
h c height of roof cavity 

l c length of roof cavity 

x downwind distance 

Zn upper boundary of high turbulence 

layer 

Z m upper boundary of roof wake 

Equations 15.17.6 and 15.17.17 
A characteristic area 

A, vent area 

K dimensionless concentration 

Q mass rate of release 

ui 0 effluent velocity 

Equations 15.17.18 and 15.17.19 
h actual stack height 

h! effective stack height after downwash 

h A downwash 

ho effective plume height 


Subsections 15.16.7 and 15.16.8 
K parameter 

m, n indices 

f e time for total discharge or evaporation 

Section 15.17 
Subsection 15.17.1 

Q a mass rate of release per unit area 

Ax incremental length 

concentration above mixed layer height 
fb concentration upwind of city, 

background concentration 

Subsection 15.17.3 
As Sections 15.16.1—15.16.4 plus 
<2 radius of hill 

A, A parameter defined by Equations 

15.17.5a and 15.17.5b 
h actual stack height 

Ah plume rise 

h e equivalent stack height 

ho effective stack height 

hi, h% height of hills land 2 

hp local height of plume 

C parameter defined by Equation 15.17.7 

q parameter defined by Equation 15.17.6 

i/< stream function 


Equations 15.17.20-15.17.22 

A, B parameters defined by Equations 

15.17.21,15.17.22 

x T ,y T , z r length, width, height of wake cavity 

Equations 15.17.23-15.17.26 

A cross -sectional area of building normal 

to wind 

c constant 

D a atmospheric dilution factor 

A building dilution factor 

Act total dilution factor 

Q mass rate of release 

* downwind distance 

<7 y , <7 Z dispersion coefficients in crosswind, 

vertical directions 

Equations 15.17.27-15.17.44 
C mean concentration 

H parameter defined by Equation (15.17.28) 

k constant 

kf characteristic energy of free stream 

turbulence 

k characteristic length of free stream 

turbulence 

Q source strength 

S dimension of block 
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u mainstream air velocity 

V volume of wake bubble 

X length of wake bubble 

A free stream turbulence parameter 


Equations 15.17.33-15.17.44 
A frontal area of building 

b crosswind breadth of building 

C w average concentration in near-wake 

region 

F flow out of wake 

h height of building 

L r length of recirculation region 

Q source strength 

S surface area of near-wake region 

t r residence time in near-wake region 

u h wind speed at building height in 

undisturbed flow 

V volume of near-wake region 

a flux constant 

P wake shape parameter 

X r dimensionless length of recirculation 

region 

i r dimensionless residence time in 

recirculation region 

Xw dimensionless average concentration 

in near-wake region 

Section 15.18 


Subsection 15.19.1 
As Subsections 15.16.1-15.16.4 plus 
fi,f 2 universal functions 

R(x) autocorrelation coefficient 

f L Lagrangian time scale 

T; dispersion time 

T y , T„ time scales for lateral, vertical 

dispersion 

5 delta function 

<Tg standard deviation of wind direction 


Subsection 15.19.3 
As Section 15.16.3 plus 
d distance 

h vertical spread 

6 lateral spread 

Subsection 15.19.6 
As Sections 15.16.1—15.16.4 plus 

a, c,f, h constants 

b, d,g,j indices 

F\z 0 , x) roughness length correction factor 

P P value 

T duration of release (h) 

«io wind speed at 10 m height (m/s) 

(T y dispersion coefficient in crosswind 

direction (m) 

<T yt turbulent diffusion term (m) 

a yw wind direction fluctuation term (m) 

a s standard deviation of horizontal wind 

direction (rad) 


Subsection 15.19. 
As Sections 15.16.1 
Equation 15.19.25 

b,d 

Equation 15.19.26 



Subsection 15.19.* 
As Sections 15.16.1 

Subsections 15.15 
As Sections 15.16.1 
P 
R 


Subsection 15.19. 
As Sections 15.16.1 


Subscripts 

plume 

puff 

Section 15.20 

d 0 

Subscripts 


Subsections 15.20 


Equations 15.20.1- 
bo 


d 

k 

k\ — k 7 
M 


1 

e 


Subscripts 


tr 


-15.16.4 plus 

constants 

indices 


constants 

dispersion coefficient 


-15.16.4 

'.9- 15.19.11 
-15.16.4 plus: 
index 

reference distance 
indices 

12 

-15.16.4 plus 
constants 

eddy dissipation rate 
dispersion coefficient 
initial size of puff 


initial 

plume 

puff 


diameter of outlet 
radius of outlet 


exit 

outlet 

1.2- 15.20.3 
velocity of gas 

-15.20.23 
half-width of slot 
volumetric concentration 
width of slot 
constant 
constants 
mass flow 
momentum flux 
radial distance 
radius of pipe (for radial jet) 
velocity of gas 
wind speed 

distance along axis of jet 
half angle of jet 


centre line, and hence maximum 
transition (from jet to plume) 
mean value at axial distance x 
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x D centre line 

xr at axial distance x and radial distance r 


Equations 15.20.24—15.20.37 
D diameter 

M mass flow 

u velocity of gas 


Subscripts 

E 

N 


atmospheric 
exit, or outlet 
nozzle, or outlet 
shock plane 
vessel 


equivalent diameter 
volumetric concentration 
distance along axis of jet 
distance between virtual source and 
outlet 

distance defined by Equation 15.15.41 
radial distance 
normalized density of gas at 
atmospheric conditions 
normalized density of gas at outlet 
normalized density of gas at equivalent 
diameter 


Subscripts 

m centre line, hence maximum 

xy at point x,y 


Equations 15.20.47-15.20.62 
A cross-sectional area of flow 

c D coefficient of discharge 

d diameter 

k compressible eddy coefficient 

k 1 eddy viscosity coefficient 

m mass fraction 

N pressure ratio 

r radius 

r 0 5 radius at which velocity is half centre 

line value 

u velocity of gas 

x c dimensionless core length 

z distance along axis of j et 

z b barrel length 

z* modified axial distance 


Subscripts 

eq equivalent 

m centre line, hence maximum 

v vessel 


Subsection 15.20.4 
a radius of outlet 

c constant 

d diameter of outlet 

k constant representing air resistance 

l height of outlet 

* distance in horizontal direction 


u horizontal velocity of liquid 

z distance in vertical direction 

Z breakup length 

a angle between jet and horizontal 

(Equations 15.20.63-15.20.78); 
constant (Equations 15.20.79- 
15.20.86) 

5 amplitude of disturbance 

8 0 initial amplitude of disturbance 

a surface tension 


Subsection 15.20.6 

c volumetric concentration 

F buoyancy flux 

& 4 and k 5 constants 

l characteristic length 

M momentum flux 

Q volumetric flow 

r radial distance 

u velocity of gas in j et or plume 

x distance along axis 

fl coefficient of cubical expansion 

A p a density difference 

Subscripts 

It transition (from laminar to turbulent) 

xr at axial distance x and radial distance r 


Subsection 15.20.7 
As Sections 15.16.1-15.16.4 


Subsection 15.20.8 
C constant 

F buoyancy flux 

M momentum flux 

u velocity of gas 

z max maximum plume rise 

Subscripts 

1 ambient fluid 


Subsection 15.20.9 

A 

D c 

Fi(x{) 


J 

h, k 6 -kc s 


M a 

N 

Q 


time parameter (defined by Equation 

(15.20.105)) 

drag coefficient 

function expressing change in density 
of plume due to dilution by air 
total effective height of plume 
height of outlet (m) 
rise of fall of plume at distance wti 
volumetric flow from outlet referred to 
ambient temperature (m 3 /s) 
constants 

height of jet (above outlet) 

mass flow of air 

mass flow of gas-air mixture at 

distance/ 

mass flow at outlet 

molecular weight of gas 

molecular weight of air 

volumetric flow from outlet 

volumetric flow at outlet 
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u b 


x 0 

Xi 


Ps 

Pi 


concentration along axis at distance x 
(mole fraction) 

maximum ground level concentration 
at distance x (mole fraction) 
radial distance from axis 
arbitrary chosen time interval 
velocity of gas 
buoyancy velocity 

velocity of plume along axis of falling 
plume from virtual source to ground 
velocity at outlet 
wind speed 

downwind distance, downwind 
distance from virtual source 
downwind distance from virtual 
source at which maximum rise of 
plume occurs 

downwind distance to maximum 
ground level concentration 
downwind distance of transition point 
from virtual source 
downdwind distance from virtual 
source at which plume axis reaches 
ground 

distance defined by Equation (15.20.106) 

distance from virtual source to point 

where plume reaches ground 

measured along axis of plume 

vertical distance above transition point 

maximum plume rise 

angle between axis of falling plume 

and horizontal 

density of gas at outlet 

mean density of gas-air mixture at 

distance/ 

angle between axis and edge of plume, 
half-angle of plume 
momentum flux in still air 
momentum flux in windy conditions 


Subscripts 

g gas at outlet 

trw transition in windy conditions 

w windy conditions 


Subsection 15.20.10 

Ci, C 2 constants 

e base of natural logarithms 

F buoyancy flux 

h e effective stack height 

h s stack height 

Ah plume rise (above stack outlet) 

H surface buoyancy flux 

k von Karman’s constant 

m molecular weight 

M momentum flux 

Q mass rate of release 

r radius 

s environmental stability 

s' modified stability 

S ratio of effective area influenced by 

plume momentum to cross-sectional 
area of so-called thermal plume 
u wind speed 


V 


Subscripts 

eff 


eq 

fb 

P 

po 


volumetric flow 
velocity in vertical direction 
parameter defined by Equation 
(15.20.180) 

vertical distance above stack outlet; 

height of jet or plume 

maximum plume rise 

constant 

constant 

ambient eddy dissipation rate 
dispersion coefficient 


critical 

effective 

environment 

initial environment 

equilibrium 

fallback 

plume 

initial plume 


Section 15.21 


Subsection 15.21.1 

e constant 


Subscripts 

sat saturation 

sh shattering 

Subsection 15.21.2 

A cross-sectional area of jet 

C concentration (mass per unit volume) 

G mass flow in jet 

R radius of jet 

u velocity of jet 

z distance downstream from source 

a entrainment coefficient 

/J half-angle of jet 

Subscripts 

d end of deposition zone 

oo asymptotic value 


Subsection 15.21.3 

A cross-sectional area of jet 

B buoyancy flux 

C concentration of contaminant 

/ momentum flux 

L length scale 

p dimensionless variable defined by 

Equation 15.21.32 

q dimensionless variable defined by 

Equation 15.21.33 
R radius of jet 

u velocity of jet 

«e entrainment velocity 

U velocity scale 

x downstream distance 

a entrainment coefficient 

0 ratio of density of jet to that of air 
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Subsection 15.21.4 

A cross-sectional area of jet 

e entrainment rate 

E a entrainment coefficient 

h specific enthalpy 

P pressure in jet 

R radius of jet 

u velocity of jet 

x vapour fraction, or quality 

z distance along j et axis 


Subscripts 

a at end of depressurization zone 

b at orifice 

bp boiling point 

f liquid 

fg liquid-vapour transition 

g vapour 

o stagnation conditions 

tp two-phase 

oo atmospheric conditions 


Section 15.24 


Subsections 15.24.6-15.24.9 
k van Karman constant 

K eddy diffusivity 

L Monin—Obukhov length 

p index 

z height 

A reduced density difference defined by 

Equation 15.24.3 

A' reduced density difference (alternative 

formulation, defined by Equation 
15.24.5) 

A p absolute density difference 

e energy dissipation rate 

k turbulence energy 

i jt profile function 


Subsection 15.24.10 

Cf friction factor 

G mass velocity 

h heat transfer coefficient 

ju .7 factor for heat transfer 

k thermal conductivity 

L characteristic dimension 

St h Stanton number for heat transfer 

AT temperature difference for heattransfer 

u velocity of cloud 

P coefficient of thermal expansion 


Subscripts 

t film 

gr between ground and cloud 


Subsection 15.24.11 

c velocity of wave 

h height of dense fluid 

n symmetry index 

u velocity of dense fluid 

* distance 


Subsection 15.24.12 
B negative buoyancy 

H height of cloud 

R radius of cloud 

u e top entrainment velocity 

V volume of cloud 


Section 15.25 

As Sections 15.16.1-15.16.4 plus 
c volumetric concentration 

c p specific heat of gas in source cloud 

E heat source in cloud 

H height of cloud 

L width of source 

m mass of gas in source cloud 

R radius of cloud 

u e top entrainment velocity 

V volumetric rate of release 

W Y velocity of vapour source 

Xy distance of virtual source upwind of 

actual source 

ty heat released by condensation and 

freezing of water vapour 
e w surface heat flux 

Subscript 

i initial 

Section 15.26 

A,B constants 

B rate of buoyancy destruction of 

turbulent energy 
Ci constant 

c t constant 

C volumetric concentration 

D rate of dissipation of turbulent energy 

into internal heat 

F a force due to reaction of ambient fluid 

to outward radial acceleration of 
cloud edge 

F a drag force on cloud edge due to 

presence of quiescent ambient fluid 
F s static pressure force due to negative 

buoyancy of cloud 

F v force due to vertical acceleration in 

cloud and reaction of ambient fluid 
G rate at which gravity transforms 

potential energy into mean kinetic 
energy 

H height of cloud 

H f height of fluid front 

/ E internal heat 

K e kinetic energy of mean radial and 

vertical motions 

L half-width of plume 

M r i radial momentum integral of cloud 

P E potential energy 

Q volumetric rate of release 

R radius of cloud 

Ri t bulk turbulent Richardson number 

s profile shape parameter 

S cross-sectional area of plume 

from continuous release 
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(Equations 15.26.19-15.26.18); rate of 


instantaneous release; value per unit 


shear production of turbulent energy 


downwind distance for continuous 


(Equations 15.26.30 and 15.26.31) 


release) 

T E 

turbulent kinetic energy 

r(n) 

distance downwind from source f/ 


top, or vertical, entrainment velocity 

R 

radius of cloud 

Uf 

velocity of fluid front 

S* 

parameter defined by Equation 15.27.20 

Uy 

cloud velocity in crosswind direction 

u' 

magnitude of vector sum of slumping 

u t 

bulk turbulent velocity 


and wind velocities 

V 

volume of cloud 

u ay 

average wind speed cloud height 

w e 

edge, or horizontal, entrainment velocity 

u c 

velocity of cloud 

w 0 

volumetric flow from source 

u e 

top, or vertical, entrainment velocity 

y 

edge entrainment coefficient 

u h 

wind speed at cloud height H 

A 

reduced density difference 

U r 

wind speed at reference height (nor¬ 

A! 

reduced density difference for cloud 


mally 10m) 

Ph P2 

density of fluid behind, ahead of 

U\ 

longitudinal turbulence velocity 


wavefront 

V 

volume of cloud per unit distance 

Pc 

mean density of cloud 


downwind (total value for 


mean density difference of cloud 


instantaneous release; value per unit 

Ap 0 

mean density difference of cloud 


downwind distance for continuous 
release) 

Superscript 

Subscripts 

average 

fi 

edge, or horizontal, entrainment 
velocity 

top entrainment coefficient 
limiting value of group (u e /ui) 

cloud 

y 

edge entrainment coefficient 

° 

time zero, hence source 
transition 

° 

dispersion coefficient 
shear stress 


Subsection 15.26.4 

Subscripts 

Subscripts 

cloud 

c 

continuous 

gr 

ground 

1 

instantaneous 

1 

liquid 

source 

Section 15.27 


V 

vapour 

c d 

drag coefficient 

wl 

water liquid 

Q 

friction factor 

wv 

water vapour 

D 

f 

specific heat of cloud 
drag force on cloud 
wind speed coefficient 

y 

crosswind 

F 

friction force 

Section 15.28 


h 

specific enthalpy 

C* 

constant 

hgrn 

heat transfer coefficient between 
ground and cloud by natural 

g S r 

heat transfer coefficient between 
ground and cloud 


convection 

H 

height of cloud 

H 

height of cloud 

l 

turbulence length scale 

kE 

spreading constant 

k 

constant 

l 

turbulence length scale 

k 

thermal conductivity (with subscript) 

ks 

width of virtual source 

m 

total mass in cloud 

L 

half-width of cloud 

m a 

mass of air 

m 

total mass in cloud 

m s 

mass of gas 

m 

mass of component in cloud (with 

Qgr 

heat flux between ground and cloud 


subscript) 

R 

radius of cloud 

m e 

mass of air entrained at edge of cloud 

A T a 

temperature difference between air 

m t 

mass of air entrained at top of cloud 


and cloud 

Q 

continuous mass rate of release 

A T gI 

temperature difference between 

Q" 

mass released instantaneously 


ground and cloud 

Qe 

volumetric flow of air entrained at 

u c 

velocity of cloud 


edge of cloud (total value for 

« e 

top, or vertical, entrainment velocity 


instantaneous release; value per unit 
downwind distance for continuous 

M r 

wind speed at reference height 
(normally 10 m) 


release) 

Mi 

longitudinal turbulence velocity 

Qgr 

heat flux from ground to cloud 

V 

volume of cloud 

Qt 

volumetric flow of air entrained at top 
of cloud (total value for 

W e 

edge, or horizontal, entrainment 
velocity 
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v 

A 


Ap 


Subscripts 

f 


distance downwind of virtual source 

for horizontal dispersion 

distance downwind of virtual source 

for vertical dispersion 

parameter defined by Equation 

15.28.61 

reference height (normally 10 m) 
parameter defined by Equation 
15.28.11 

coefficient of volumetric expansion 
edge entrainment coefficient 
reduced density difference 
density difference 


cloud 
fluid film 

gas, material release 
ground 

Hosker scheme 
initial 

virtual source for crosswind effects 
virtual source for vertical effects 


Section 15.30 

b 


C 

c,,c 2 

k 


k 

K a 

K h 


K a 

Qzr 


Subsection 15.28.1 

A,B,C parameters 

L characteristic dimension of cloud 


Subsection 15.28.2 

A,B, C 
A' 


L 


parameters n* c 

parameter defined by Equation 
15.28.62 g 

half-width of cloud 


Section 15.29 


C d 

h 

Amin 

if h ,K v 

/ 

L a 

in 

P 

Ps 

Pt 

Q 

max 

w 


concentration (mass fraction) 
drag coefficient 
specific enthalpy 
height at breakup 

horizontal, vertical eddy diffusivities 

turbulence length scale 

latent heat of water 

mass rate of evaporation 

mass rate of evaporation at breakup 

pressure 

pressure at surface 

pressure at top 

heat flux 

time at breakup 

heat transfer coefficient 

mass of water vapour per unit mass 

of air 

parameter defined by Equation 15.29.7 
dimensionless pressure coordinate 
substantial derivative in x,y a, t 
coordinates 

standard derivation of wind direction 
shear stress at surface 
geopotential height 
substantial pressure derivative 


Section 15.31 

At 

b 



CA 


Q 

H 

H b 

H e 

H eii 


surface 


cloud shape parameter 
cloud width parameter 
volumetric concentration 
concentration functions 
cloud height parameter 
von Karman constant 
ambient vertical diffusion coefficient 
horizontal diffusion coefficient 
vertical diffusion coefficient 
dense-layer diffusion coefficient 
eddy diffusion tensor for momentum 
eddy diffusion tensor for energy 
eddy diffusion tensor for mass fraction 
heat flux between ground and cloud 
pressure deviation from an adiabatic 
atmosphere at rest 
index 

temperature source term 

velocity of cloud 

vertical entrainment velocity 

velocity of material at source 

velocity of cloud in crosswind direction 

cloud friction velocity 

velocity tensor 

horizontal entrainment velocity 
cloud ‘convection velocity’ 
cloud shape parameter 
constant 

potential temperature deviation from 
an adiabatic atmosphere 
density corresponding to pressure/) 
profile function 

mass fraction of material released 


cloud 

material released 
source 


half-area of source for observer i 

half-width of middle part 

half-width of gas blanket 

effective half-width of plume 

half-width of pool 

half-width of source 

half-width of source for observer i 

local half-width of source for observer I 

concentration in mass per unit volume 

ground level concentration on centre 

corrected ground level concentration 
on centre line 

concentration at ground level 

friction factor 

height of cloud 

height of 100 % gas blanket 

surface heat flux 

effective height of cloud 

counter for observer i 



5/340 EMISSION AND DISPERSION 


k 

K 

K a 

K% 


L 

Lp 

L s 

L si 

Qgr 

Op 

Q’ 

O'/ 

Omax 


R 

R b 


Ri, 


S 


ty, t2 i 


Ua 

Ub 


J'Ls 


a T 

He 


H' 

S' 


Pe 

Pgr 


von Karman constant 
eddy diffusion coefficient 
constant 

vertical eddy diffusion coefficient at 

reference height z r acting on 

concentration profile of width 2B 

length of gas blanket 

length of pool 

length of source 

length of source for observer i 

heat flux between ground and cloud 

total mass rate of evaporation 

mass rate of take-up into atmosphere per 

unit area 

mass rate of take-up into atmosphere 
per unit area for observer i 
mass rate of take-up into atmosphere 
per unit area 

mass rate of evaporation per unit area 
mass rate of evaporation per unit area 
shape factor for crosswind concentration 
profile 

radius of source 
radius of gas blanket 
radius of spreading pool 
Richardson number defined by 
Equation 15.31.34 

internal Richardson number defined 

by Equation 15.31.65 

shape factor for vertical concentration 

profile 

dispersion parameter 
specified time 

times when observer i passes upwind, 
downwind edges of source 
wind speed; gas velocity (Equation 
15.31.58) 

top entrainment velocity 
effective local cloud velocity 
effective air velocity 
bulk cloud velocity 
velocity of observer i 
internal velocity scale 
edge entrainment velocity 
half-width of concentration profile 
downwind distance of observer i at 
time/ 

downwind distance of transition 
point 

downwind distance of virtual source 
limit of integration of y 
mole fraction of surface water vapour 
thermal diffusivity 

coefficient of volumetric expansion of 

cloud 

constant 

edge entrainment coefficient 

constant 

constant 

kinematic viscosity 

density at emission conditions 

density downwind 

shear stress acting on downwind 

ground surface 


shear stress acting on upwind ground 
surface 

profile function 


Subscripts 

g 

gr 


Section 15.32 

As Section 15.24.10 and Section 15.31 plus 
H height 

k von Karman constant 

Ri, modified Richardson number 

« e vertical entrainment velocity 

<j) profile function 


cloud 

material released 
ground, ground level 
observer i 


Section 15.33 

c„ constant or function 

p pressure 

S 0 function 

u velocity 

x distance 

r o function 


k turbulence energy 

<j> scalar quantity 


Subscripts 

i,j i,j direction 


Section 15.34 

A constant given in Figure 15.85(b) 

B constant given in Figure 15.87(b) 

C volumetric concentration 

C m maximum time mean volumetric 

concentration on the centre line 
C Q volumetric concentration at initial 

release 

D characteristic dimension of source 

gin reduced gravity corresponding to 

maximum concentration 

go reduced gravity of initial release 

G source geometry 

h measure of plume height 

h c height of crest 

H height of cloud 

Zb buoyancy length scale 

k length scale of turbulence in the 

atmospheric boundary layer 
Ly half-width of plume 

L ho half-width of plume at source 

L u upwind extent of plume 

L, height of plume 

n fraction of initial concentration 

(= C m / Cq); index (Equation 15.34.42) 
q 0 volumetric rate of release 

Q volume of cloud 

Qo volume of material released 

R radius of cloud 

R a initial radius of cloud 
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4 arrival time of leading edge of cloud 

4 time between arrival time t a and 

departure time t d 

4 departure time of trailing edge of cloud 

x c distance of leading edge 

x„ distance at which the fraction of initial 

concentration is n 
y c half-width of cloud 

u Tef characteristic mean velocity 

p a density of air 

p 0 density characteristic of material 

released 

tj) stability parameter 

stability parameter 

Subsections 15.34.4 and 15.34.5 

T„ duration of release 


Subsection 15.34.7 

T a 


K 

V 0 


absolute temperature of air 
absolute temperature of initial volume 
volume of air 

non-isothermal initial volume 


Subscripts 

I isothermal 

ni non-isothermal 


Section 15.35 

fii-03 

C 

C m 

F h 

F t 

L s 

X 

z 

c 

t 


parameters 

concentration 

ground level centre concentration 
parameter defined by Equation 15.35.5 
parameter defined by Equation 15.35.6 
Monin-Obukhov length scale 
parameter 
relative coordinate 
downwind coordinate of cloud centre 
parameter 

vertical coordinate of cloud centroid 
measure of skewness of cloud 
downwind coordinate relative to 
skewed cloud 


to 

«e 

« f 

Ut 

V 


volumetric concentration 

normalized height of cloud 

height of cloud 

normalized radius of cloud 

radius of cloud 

normalized time 

initial time scale 

edge entrainment velocity 

cloud front velocity 

top entrainment velocity 

normalized volume of cloud 

volume of cloud 

parameter defined by Equation 

15.36.13a 

parameter defined by Equation 
15.36.14a 


Superscript 

A normalized value 


Subscript 


Po 

P 

-V /' 


area of source 
diffusivity 
Coriolis parameter 
characteristic length scale 
volumetric release rate 
volume released 
characteristic velocity 
source velocity 
ground slope 
thermal conductivity 
viscosity of atmosphere 
viscosity of source gas 
kinematic viscosity 
density of atmosphere 
density of air 
density of source gas 
potential density difference 


Subscript 

o source gas 


Subsection 15.39.5 
D plume dimension 

Q volumetric release rate 

Subsection 15.39.7 

c volumetric concentration 

4, buoyancy length scale 

L length scale 

Q volumetric release rate 


Section 15.40 

Equations 15.40.1 -15.40.9 
C D drag coefficient 

E entrainment coefficient 

g'g reduced gravity 

h height of following flow 

Q volumetric flow per unit width 

Si, S 2 parameters 

x downhill distance 

u mean velocity of following flow 

Uf velocity of front 

u s velocity on a defined streamline 

a parameter defined by Equation 

15.40.4 

9 angle of incline to horizontal 


Subscripts 

n normal 

1,2 less, more dense fluid 


Equations 15.40.10 and 15.40.11 
C D form drag coefficient 

/ friction factor 

H height of cloud 

R radius of cloud 

u velocity downhill 

9 angle of slope 
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Subscripts 

b bottom of cloud 

g gas 

t top of cloud 


Equations 15.40.12 and 15.40.13 
A a initial cross plume area of plume 

element 

A p final cross plume area of plume element 

g J 0 initial reduced gravity 

u wind speed at ground level 

z height from source to target 

6 potential temperature 

Subscript 

p plume 


h 

h 

H 


Li 


Q 

Q 

Ri 0 

Ri T 

S L 

Su 

S w 


Subsection 15.40.2 
As Section 15.34.4 plus 

C g maximum volumetric concentration at 

ground level 

C 0 volumetric concentration at initial 

release 

h height of dense fluid layer 

Ah head difference 

h w height of obstacle 

h 0 .s height at which concentration is half 

ground level value 
H height of fence 

H h ratio of heights defined by Equation 

15.40.29 

H w ratio of heights defined by Equation 

15.40.20 

q a volumetric rate of release 

q* 0 volumetric release rate per unit width 

u velocity of fluid 

u w velocity over obstacle 

U velocity of wave travelling upstream 

(hydraulic jump) 

W plume width 


Equation 15.40.60 


ai 


a w 

P 

Pa 

Superscript 


A 

A it 

A a 

b 

C 


Subscripts 

f with fence 

f without fence 

1 upstream 

2 space between upstream moving wave 
and obstacle 


Subsection 15.40.5 

A frontal area of building 

B dimensionless buoyancy flux 

C a time mean ground level concentration 

C L concentration in lower layer 

C a volumetric concentration at source 

Cu concentration in upper layer 

D diameter of source orifice 

F a flow of air into wake 

F lu flow from lower layer to upper layer 

E\jl flow from upper layer to lower layer 

g' 0 reduced gravity at source 

h height of building 

h L height of lower layer 

h v height of upper layer 


Q 

Co 

/ 

N 

N g 

P 

AP 


Po 


Qo 

Q 


T a 

V 


dimensionless height of lower layer 
dimensionless height of upper layer 
height of obstacle 
length of building 

length of recirculation region, or wake 
buoyance length scale 
volumetric rate of release 
volumetric rate of release per unit 
length 

release rate, source strength 
dimensionless release rate 
initial Richardson number before 
mixing 

transition Richardson number 

lateral spread of cloud 

updwind spread of cloud 

surface area of wake 

wind speed; mean velocity at obstacle 

height 


volume of wake 
width of building 
mixing coefficient 
mixing coefficient 
constant 

dimensionless length of wake 
density of cloud 
density of ab¬ 


normalized 


ratio of areas defined by Equation 
15.40.73 

area of opening 
area for inflow 
area for outflow 
constant 

pressure coefficient 

pressure coefficient for inflow opening 

pressure coefficient for oulflow 

opening 

vapour fraction 

height of inlet opening 

ratio of molar flows 

number of moles 

dimensionless quantity defined by 
Equation 15.40.72 

pressure drop between atmospheric 
pressure and internal pressure 
pressure difference between outside 
and inside 

atmospheric pressure 
flow of gas 

dimensionless flow of gas 
volumetric flow 
volumetric air flow of air 
absolute temperature of air-gas 
mixture 

absolute temperature of air 
wind speed 
volume of space 
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t time for concentration of gas to reach m 

steady state if outflow is neglected M 

r ratio defined by Equation 15.40.78 Q 


Subscripts 

A air 

G gas 

Section 15.42 

If density of cloud 

R* air/ HF ratio of cloud 

T* absolute temperature of cloud 

Section 15.43 


*TD 

**TD 


Subsection 15.43.2 


characteristic width of plume 

concentration 

radius of plume 

distance along axis of plume 

velocity along axis of plume 

entrainment velocity 

mean wind velocity 

angle between axis of plume and 

horizontal 

density of plume 

density of air 

density of atmosphere at stack outlet 

entrainment coefficients 

set of functions defined by Equation 

15.43.2 

set of functions used in Equation 15.43.1 


initial momentum flux (m 4 /s z ) 
initial volumetric flow (m 3 /s) 
wind velocities in downwind, 
crosswind, vertical directions (m/s) 
outlet velocity (m/s) 
wind speed (m/s) 
entrainment velocity (m/s) 
distances in horizontal, crosswind and 
vertical directions (m) 
horizontal distance from virtual source 
of final plume to touchdown point (m) 
horizontal distance from stack to 
touchdown point (m) 
horizontal distance from stack to jet 
transition point (m) 
horizontal distance from stack to 
virtual source of final plume (m) 
length scale, related to effect of 
crossflow on plume (m) 
effective stack height with strong 
crossflow (m) 

effective stack height with weak 
crossflow (m) 

length scale, related to effect of 
crossflow on jet (m) 
maximum rise (m) 
vertical coordinate of jet or plume 
axis (m) 

distance of virtual source of jet below 
stack outlet (m) 
entrainment coefficient 
relative density difference 


Subsection 15.43.3 
C concentration 

A h maximum initial plume rise 

h s height of stack 

R radius of plume 

x distance along plume axis 

u s velocity along plume axis 

w velocity of plume 

x downwind distance 

a.i, 2 entrainment coefficients 

6 angle of plume axis to horizontal 


Subscripts 

m maximum 

o initial 

td touchdown 


Subscripts 

o Source 

v virtual source 

Subsection 15.43.5 
H height of cloud 

I 0 momemtum flux (Equations 15.43.34); 

excess momentum flux (Equations 
15.43.35) 

k lt k 2 constants 

Q a flow of entrained air 

R half-width of cloud 

u w wind speed 

v velocity of jet 

A p density difference between cloud 

and air 


Subsection 15.43.4 

Ai-j4 6 constants 

b width of plume (m) 

B initial buoyancy flux (m 4 /s 3 ) 

C constant 

Ci —Ce constants 

d 0 diameter of outlet (m) 

g acceleration due to gravity (m/s 2 ) 

g' (reduced gravity (m/s 2 ) 

h s stack height (m) 

lm length scale, related to source (m) 

Iq length scale, related to transition from 

momentum to buoyancy control (m) 


Subsection 15.43.8 
D diameter 

w velocity of plume 

Subscript 


Section 15.44 

A 

Buoy 

C D 


cross-sectional area of plume 
buoyancy function 
concentration (mass per unit volume) 
spreading coefficient 
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D 

diameter of circle, major axis of ellipse 

Section 15.45 


Drag 

drag function 

M 

mean value of concentration 

e 

eccentricity of ellipse 

P 

peak value of concentration 

e at 

coefficient 



e gr 

coefficient 

Subsections 15.45.1-15.45.7 

gjet 

entrainment coefficient 


instantaneous deviation of 

0 UjCr 

coefficient 


concentration 

e e ’ cr 

coefficient 

C2 

variance of concentration (see text) 

e x , c z 

unit vector in horizontal (wind 


concentration 


aligned), vertical direction 

C 

mean concentration 

E 

excess energy flux 

Cma* 

maximum concentration 


energy function 

c med 

median concentration 

Entr 

entrainment function 

c p 

peak concentration 

Foot 

reactive pressure force function 

c 

time mean concentration 

h 

plume height; specific enthalpy 

F(Q 

probability distribution function of 


(Equation 15.44.12) 


concentration C 

k 

slumping coefficient 

i 

intensity 

l 

width of ‘footprint’ of plume 

M 

mean value of concentration 

ly, 4 

turbulence length scales in crosswind, 

P 

index 


vertical directions 

P 

peak value of concentration 

L 

Monin—Obukhov length 

m 

probability that concentration 


mass flux 


exceeds C 

Px 

excess horizontal momentum flux 

t 

sampling time 

P z 

excess vertical momentum flux 

4a 

sampling time for mean value M 

r 

polar radius coordinate of 

tp 

time during which concentration is 


cross-section of airborne plume 


non-zero (Equation 15.45.2); 

Ri» 

bulk Richardson number 


sampling time for peak value P 


distance along axis of plume 


(Equations 15.45.6-15.45.9) 

Shear 

shear force function 

4 

total sampling time 

T S r 

absolute temperature of ground 

Ti 

integral timescale 

T. 

u»T* = ground to air heat flux 

y 

intermittency 

u 

mean flow velocity 


mean of concentration 

x,z 

horizontal, vertical distance of 


variance of concentration 


centroid 

«1 

standard deviation (logarithmic) 


vertical distance of centre 



e 

dissipation rate of turbulent kinetic 

Subsection 15.45.8 


energy 

As Sections 15.16.1 

-15.16.4 plus 

V 

parameter defined by Equation 

Dy,D z 

crosswind, vertical standard deviations 


15.44.16 


attributable to meandering 

1c 

parameter defined by Equation 

Q 

continuous mass rate of release 


15.44.17 

Y 

crosswind standard deviations 

Ip 

parameter defined by Equation 


attributable to fluctuations about 


15.44.34 


centre line 

e 

polar angle coordinate of cross-section 

Z 

crosswind standard deviations 


of airborne plume 


attributable to fluctuations 

l 

parameter 




von Karman constant 



4> 

angle of inclination of airborne plume 

Subscripts 


®(RiJ 

heavy gas entrainment function 

* 

instantaneous 

<At 

temperature function 

m 

mean 

>Au 

velocity function 

P 

peak 



Subsection 15.45.9 



C 

concentration in sphere 

Subscripts 


C x 

maximum concentration which can 

at 

atmospheric turbulence 


occur over time period x 

c 

centre 

C 

time mean concentration 


crosswind 

k 

constant 

fs 

free surface 

X 

downwind distance 

g 

material released 

P 

constant 

gs 

gravity slumping 

y 

intermittency 

hg 

heavy gas 

X 

index 

jet 

jet 

a 

standard deviation of instantaneous 


potential 


concentration 

oc 

ambient conditions at centroid height 

t 

time period 
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i // parameter defined by Equation 15.45.29 P 


Subscript 

T 

limiting value 

Subsection 15.45.10 

As Subsections 15.16.1-15.16.4 plus 

c 

concentration 

d 

concentration fluctuation about mean 


mean concentration 

~d 2 

concentration variance 

C mp 

condition median concentration 

c 

mean concentration on centre line 

d J 

conditional concentration fluctuation 

Cp 

conditional mean concentration 


conditional concentration variance 

T 

diameter of source 

F c 

cumulative distribution function for 
concentration 

F m 

height correction 

Fy 

height correction 

G m 

crosswind distance correction 

Gy 

crosswind distance correction 

h 

height of source 

hy 

effective height of variance source 

H 

height of neutrally stable atmospheric 
boundary layer 

i 

intensity 

i 

conditional intensity 

ip 

conditional intensity on centre line 
with negligible surface interaction 

P(c) 

probability density function for 
concentration 

P p (c) 

probability density function for 
conditional concentration 

Q 

variance source strength 

Ip 

conditional variance source strength 

Q 

mass rate of release 

u c 

advection velocity of plume 

z e 

scale height 

a 

sink strength 

5 

delta function 

y 

intermittency 

X 

normalized downwind distance 

x a 

virtual origin of variance source 

Cl 

standard deviation (log-normal) 

4> 

location parameter for variance source 

Subscript 

P 

conditional 

Subsection 15.45.11 

c(x, t) 

concentration fluctuation about mean 

c{x,t) 

mean value of concentration 
fluctuations c(x, t) 


variance defined by Equation 

15.45.76 

C(x,t) 

mean value of ensemble of 


concentrations r(x, t) 

C 

mean concentration 

i 

intensity 

I 

intensity 

P(Q,x,t) 

probability density function for 9 


R(Q 
y(x,t) 
T(x, t) 
T(x,t) 


Subsection 15.45. 

k 2 -h 


Section 15.46 


Subsection 15.46. 
As Sections 15.16.1- 
F 


H 

Q* 

<5 


Vl,V 2 

W 


Subscripts 

cc 

L 

U 

1,2 

Equations 15.49.16- 

F c 

L 


V sv 

W F 


Subsection 15.46.. 


b,d 

D 

f 

mo 

Q 

Qe 


probability that concentration 9 lies 
between lower and upper 
flammability limits 
intensity parameter 
interim ttency 

concentration from a single experiment 
mean value of (x,t) 
delta function 
constant 

(x, t) particular value of (x, t) 
lower limit of flammability 
limiting value of 9 
upper limit of flammability 

14 

constants 


-15.16.4 plus 

mass of flammable gas at maximum 
hazard 

height of source 

mass of gas released instantaneously 
mass of gas within flammable range 
radial distance 

ratio of upper to lower flammability 

parameters defined by Equations 
15.46.15b and 15.46.15c 
mass of flammable gas 
dispersion coefficient 


cloud centre 

lower flammability limit 
at maximum hazard 
upper flammability limit 
inner, outer 

-15.49.19 

weighting function 

number of moles of oxygen reacting 

with one mole of fuel 

number of moles of air in rich mixture 

number of moles of fuel consumed 

number of moles of fuel present 

volume of cloud between lower flamm 

ability limit and stoichiometric 

concentration (m 3 ) 

volume of cloud between stoichiometric 

concentration and upper 

flammability limit (nr) 

mass of fuel available for combustion 

(kg) 


constants 

indices 

constant 

index 

mass rate of release 
mass of gas released 
mass of gas within flammability limits 
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mass of gas within flammability limits Subscripts 

distances to lower, upper flammability pe exposure 

limits s sampling 


Subsections 15.46.3-15.46.5 

c concentration (volume fraction) 

d 0 effective diameter of discharge (m) 

D constant 

/ index 

g acceleration due to gravity (m/s 2 ) 

G parameter defined by Equation 

15.46.41 


ki-k6 constants 

m 0 mass rate of release (kg /s) 

M molecular weight 

M mean molecular weight of gas mixture 

at distance z 

Qfl mass of flammable material in cloud 

between flammability limits (kg) 
r radial distance from axis (m) 

T absolute temperature (K) 

u wind speed (m/s) 

v volumetric flow (m 3 /s) 

Ffl volume of cloud between flammability 

limits (m 3 ) 

w velocity (m/s) 

z axial length or vertical height (m) 

a ratio of number of moles of unreacted 


Ap 0 

X 


and reacted gas 
dry adiabatic lapse rate (°C/m) 
density difference between gas and air 
concentration (kg/m 3 ) 


Subscripts 

F flame 

L lower flammability limit 

o original discharge 

s stoichiometric mixture 

U upper flammability limit 


Equations 15.47.8-15.47.10 
As Subsection 15.45.9 plus 

co enhancement factor 

Subsection 15.47.4 
c concentration 

F c probability that concentration will not 

exceed c 

Nb number of breaths 

S( T e ) probability that concentration will not 

exceed c over exposure time T e 
T e exposure time 

V c probability that concentration will 

exceed c 


Subsection 15.47.5 


KQ 

m 

4 > 


effective dose 
median fatal dose 
constant 
constants 
index 

normal distribution 

standardized log dosei mean 
standardized log dose 
effective standardized log dose 
probability of fatality 
mean of concentration 
standard deviation of concentration 
distribution function 


Subsection 15.46.7 
M mass of vapour (t) 

R radius of cloud (m) 


Subsection 15.46.9 

f lower flammability limit (%) 

P operating pressure (bar) 

t time span (s) 

W mass flow (kg/s) 

Wi r mass flow per unit area (kg/m 2 ) 

Section 15.47 


Subsections 15.47.1-15.47.3 

C concentration 

C p concentration over time/ p 

k lt k 2 constants 

L toxic load 

n index 

P probability of inj ury 

T exposure time 

Y probit 


Section 15.48 
Subsection 15.48.4 

D internal diameter of stack (m) 

A h plume rise (m) 

u wind speed (m/s) 

v s velocity of stack gas (m/s) 

Subsection 15.48.5 

D diameter of vent tip (ft) 

E number of dilutions to lower 

flammability limit 

h s height of vent above exposure level (ft) 


Subsection 15.48.6 

C1-C4 constants 

D internal diameter of stack (m) 

h height of stack (m) 

A h plume rise (m) 

Q mass rate of release (g/s) 

u wind speed (m/s) 

v s stack gas outlet velocity (m/s) 

p density of gas mixture (kg/m 3 ) 



EMISSION AND DISPERSION 15/347 


X critical ground level concentration 

(jug/m 3 ) 

Subscripts 

s stack gas 

Subsection 15.48.8 
A parameter 

C m maximum permissible value of 

touchdown concentration of 
contaminant (%v/v) 

C s concentration of contaminant in stack 

gas (%v/v) 

D internal diameter of stack (mm) 

h s height of stack (m) 

L lower flammability limit (%v/v) 

M w molecular weight of stack 

gas mixture 

s stack gas specific gravity relative to air 

T a absolute temperature of ambient air (K) 

T s absolute temperature of stack gas (K) 

u wind speed (m/s) 

v s velocity of stack gas (m/s) 

P peak/mean concentration ratio 


Section 15.49 

Subsection 15.49.1 
As Sections 15.16.1-15.16.4 


Subsection 15.49.2 
Equation (15.49.7) 
k constant 

&i-k 3 constants 

M mass released (te) 

R downwind range (km) 

X distance to maximum width (km) 

Equations 15.49.8-15.49.18 
h height of cloud (m) 

k constant 

L distance/dimension (m) 

M mass released (te) 

n index 

R downwind distance (m) 

R c radius of cloud (m) 

Rcr range transition criterion (m) 

i?LFL downwind range to lower flammability 

limit (m) 

«ufl downwind range to upper flammability 

limit (m) 

X I downwind dimension (m) 

Y crosswind distance at downwind 

distance R (m) 

maximum crosswind range of lower 
flammability limit (m) 

Fl crosswind dimension (m) 

(7lfl upwind range to lower flammability 

limit (m) 

Equations 15.49.15—15.49.18 
I inventory (kg) 

k constant 

k * constant 


L distance/dimension (m) 

« v mass rate of release of vapour (kg/s) 

R downwind distance (m) 

T a arrival time (s) 

T d duration of release (s) 

u wind speed (m/s) 

Y crosswind distance at downwind 

distance R(m) 

Equations 15.49.19 and 15.49.20 
q 0 volumetric rate of release 

Q a volume released 

x downwind distance 


Section 15.50 


Subsections 15.50.1-15.50.3 
As Sections 15.16.1—15.16.4 plus 
F depletion factor 

H height of source 

Q 0 initial source strength 

Q x effective source strength 

r radius of particle 

r e equivalent radius 

4/2 half-life of concentration 

x G distance defined by implicit Equation 

15.50.23 

Vi deposition velocity 

v s fall velocity 

v t terminal velocity of particle 

V p volume of particle 

a dynamical shape factor (Equation 

15.50.6); reflection coefficient 
(Equations 15.50.21 and 15.50.22) 
p viscosity of air 

p p density of particle 

t c chemical decay time constant 

co deposition rate 


Subscripts 

n non-spherical 

s spherical 

1,2 standard value, other value 


Subsections 15.50.5 and 15.50.6 

A s cross-sectional area of drop 

E collection efficiency 

F w flux of pollutant to surface 

Jo equivalent rainfall rate 

k concentration of pollutant in rainwater 

(mass per unit volume) 

k concentration of pollutant in rainwater 

(mass per unit mass) 

N s number of drops 

s diameter of drop 

v w wet deposition velocity 

v s velocity of drop 

w interphase transport rate 

W r washout ratio 

washout ratio (alternative formulation) 
Z w height of wetted plume 

A washout coefficient, scavenging 

coefficient 
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density of air 
density of water 
concentration of pollutant in air 
effective concentration over height of 
wetted plume 


Section 15.53 

Subsection 15 

As 


Subscripts 

o reference height 

s drop 


Section 15.51 

c 

concentration (various units) 

D 

toxic dose (units h) 

k 

mixing efficiency factor 

L 

toxic load (units-h) 


index 

R 

ratio of indoor to outdoor toxic loads 


time (h) 


duration of finite outdoor 

X 

concentration (h) 

ventilation rate, ventilation constant 

X' 

Or 1 ) 

effective ventilation rate (h ) 

Equation 15.51.18 

A 

area of aperture (m ) 

h 

constant 

Q 

volumetric flow of air (m 3 /s) 

A p 

pressure drop (N/m 2 ) 

Po 

density of ambient air (kg/m 3 ) 


Qa 

Qw 

V 


Subsection 15 


C 

Cfd 

Cnd 

D 

FD 

Q 

S 


Equations 15.51.19-15.51.24 


constants 

number of open casement windows 
number of open top-vent windows 
temperature difference between 
outdoors and indoors (°C) 
wind speed (m/s) 
ventilation rate (h -1 ) 
ventilation rate due to buoyancy (m 3 /h) 
ventilation rate measured at standard 
conditions (h -1 ) 

ventilation rate due to wind (m 3 /h) 


Section 15.52 

D initial diameter of plume 

u a velocity of release 


Subscripts 

1,2 

Subsection 15 
CR 
F n 
K 
M 
M n 
#1.26 

Subsection 15 

G 
Qa 
S 


53.1 

Section 15.10.8 
.53.8 

diameter of spray cone (m) 
flow number of nozzle (1/s). (kN/m 2 ) 1/2 ) 
pressure of water at nozzle 
(kN/m 2 ) (gauge) 
volumetric flow of air (m 3 /s) 
volumetric flow of water (//s) 
velocity of entrained air (m/s) 

.53.10 

entrainment parameter 
entrainment parameter for spray 
volumetric concentration 
concentration with forced dispersion 
concentration with natural dilution 
width of spray 

forced dispersion effectiveness factor 
volumetric rate of release 
radius of plume 

surface area of elemental slice of plume 

velocity of plume 

vertical velocity in spray 

velocity of air entrained in spary 

volume of elemental slice of plume 

wind speed 

downwind distance 


source 

end of region I, II 

.53.11 

concentration ration 

flow number (1/ (minbar 1/2 )) 

constant 

specific momentum flow (m 2 /s 3 ) 
momentum flow number (N s/(s bar)) 
wind speed at 1.25 m height (m/s) 

.53.18 

mass flow of gas 
mass flow of air 
mass flow of stream 
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16/2 FIRE 


The first of the major hazards in a process plant is fire. Fire 
in the process industries causes more serious accidents 
than explosion or toxic release, although the accidents in 
which the greatest loss of life and damage occur are gen¬ 
erally caused by explosion. Fire is normally regarded as 
having a disaster potential less than explosion or toxic 
release. One of the worst explosion hazards, however, is 
usually considered to be that of an explosion of a vapour 
cloud that has drifted over a populated area, and in this 
case the difference in the number of casualties caused by a 
flash fire rather than an explosion in the cloud may be 
relatively small. 

Fire is, therefore, a serious hazard. The Second Report of 
the Advisory Committee on Major Hazards (ACMH) 
(Harvey, 1979b) refers in particular to vapour cloud fires 
and to the description of fires given by VC. Marshall 
(1977a): 

It can be said that such clouds will start to burn around 
their outer envelopes and will ‘lift off’ to form fireballs. 
Such fires are dangerous in the extreme. When formed of 
hydrocarbons, they are luminous and radiate heat which 
can cause fatal burns to bystanders and ignite wood and 
paper; for example, they have been known to set fire to the 
interior of office blocks. As fireballs rise they produce 
mushroom clouds, in the stalks of which are formed vio¬ 
lent upward convection currents that can suck up and 
ignite debris, and scatter burning brands over a wide 
area. Such an occurrence can clearly cause damage far 
beyond the normal safety distance of what are termed 
conventional fires. 

Vapour cloud, or flash fires and fireballs radiate intense 
heat that can be lethal. Another lethal effect is the depletion 
of oxygen in the atmosphere caused by a flash fire. 
Although the Flixborough disaster was primarily a vapour 
cloud explosion, a large flash fire in part of the cloud also 
accompanied the latter and this fire was responsible for 
some of the deaths that occurred. Flash fires can also do 
considerable damage to the plant. In buildings, fire is the 
main threat and can cause great damage as well as loss 
of life. 

In the United Kingdom there are a number of bodies 
concerned with fire and fire protection. These include the 
fire services and organizations such as the British Fire 
Services Association, the professional institutions such as 
the Institution of Fire Engineers (IFE), the insurance 
organizations such as the Fire Offices Committee, the 
research establishments such as the Fire Research Station 
(FRS) and the educational institutions such as the Fire 
Protection Association (FPA) and the Department of Fire 
Engineering at Edinburgh University. 

In the United States of America the relevant bodies 
include: in insurance, the National Board of Fire Under¬ 
writers, the Industrial Risk Insurers (IRI) (formerly the 
Factory Mutual Engineering Corporation (FMEC); in 
research, the Underwriters Laboratories (UL), the Bureau 
of Mines (BM) and the Combustion Institute; and in the 
formulation of codes and research, the National Fire Pro¬ 
tection Association (NFPA). 

There is a voluminous literature on fire and fire protec¬ 
tion. Only a few selected items particularly relevant to 
process plants can be instanced here. These are Safety in 
Petroleum Refining and Related Industries (Armistead, 
1959), Chemical Fires and Chemicals at Fires (IFE, 1962), 
Fire Protection Handbook (Vervalin, 1964a, 1973a), Hand¬ 


book of Industrial Loss Prevention (FMEC, 1967), A Guide to 
Fire Prevention in the Chemical Industry (BCISC, 1968/7), 
Storage and Handling of Petroleum Liquids: Practice and 
Law (Q.R. Hughes, 1970), Background Notes on Fire and its 
Control (FPA, 1971/14), Heat Transfer in Fires (Blackshear, 
1974), Manual of Firemanship (Home Office, 1974—), An 
Introduction to Fire Dynamics (Drysdale, 1985) and Fire 
Protection Handbook (NFPA, 2003). 

Information on numerous aspects of fire and fire protec¬ 
tion is given in the FPA Compendium of Fire Safety Data 
Sheets (1974-), which covers the following topics.Volume 1: 

(I) organization of fire safety and (2) management of fire 
risks. Volume 2: (3) industrial and process fire safety and 
(4) occupancy fire safety. Volume 3: (5) housekeeping and 
general fire precautions and (6) nature and behaviour of 
fire.Volume 4: (7) information sheets on hazardous materi¬ 
als. Volume 5: (8) fire protection equipment and systems, 

(9) security precautions and (10) arson.Volume 6: (11) design 
guides and (12) building products. 

A relevant standard is BS 5908:1990 Code of Practice for 
Fire Precautions in Chemical Plant. This contains the fol¬ 
lowing sections: 

(1) general; 

(2) legal requirements; 

(3) principles of initiation, spread and extinction of fire; 

(4) site selection and layout; 

(5) buildings and structures; 

(6) storage and movement of materials; 

(7) design of process plant; 

(8) operation of process plant; 

(9) maintenance of process plant; 

(10) fire prevention; 

(II) fire defence; 

(12) works fire brigades; 

(13) classification of fires and selection of extinguishing 
media; 

(14) fixed fire fighting systems; 

(15) portable and transportable appliances; 

(16) organization of emergency procedures. 

Most of these aspects are considered in the present chapter, 
but some are dealt with elsewhere, notably legal aspects, 
plant siting and layout, storage, maintenance and emer¬ 
gency procedures, which are treated in Chapters 3,10,22,21 
and 24, respectively. 

US codes include the National Fire Codes of the NFPA. 
A selection of the codes relevant to process plant is given 
in Appendix 27. 

Selected references on fire, prevention, protection and 
control are given in Tables 16.1 and 16.2, respectively. In 
addition, many of the publications listed in Appendices 27 
and 28 are concerned with fire. 

16.1 Fire 

16.1.1 The combustion process 

Fire (or combustion) is a chemical reaction in which a sub¬ 
stance combines with oxygen and heat is released. Usually, 
fire occurs when a source of heat comes into contact with 
a combustible material. If a combustible liquid or solid is 
heated it evolves vapour and if the concentration of vapour 
is high enough, it forms a flammable mixture with oxygen 
in the air. If this flammable mixture is then heated 
further to its ignition point, combustion starts. Similarly, a 
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Table 16.1 Selected references on fire 


FRS (Appendix 28); NRC (Appendix 28 Fire, Fire 
Protection)', von Schwartz (1904—); McCarthy (1943); Smart 
(1947); Cameron (1948); Spiers (1950); Prentiss (1951); 
Bowden (1953); Spalding (1955); Wise and Agoston (1958); 
Simms, Hird and Wraigh (I960); B. Lewis and von Elbe 
(1961,1987); FPA (1965 CFSD NB4,1965/4,1971/14,1988 
CFSD NB2,1989 CFSD NB1); Risinger (1964a—f,hj); 
Vervalin (1964a, 1966,1972a, 1973a,g, 1975a, f); 

FA. Williams (1965); Zabetakis (1965); Waugh (1966); FMEC 
(1967); W.B. Howard (1970b); Custer (1972); de Ris, Kanury 
and Yuen (1973); Sylvia (1973); Home Office (1974- Manual 
ofFiremanship); Ottoson (1974); Raj and Kalelkar (1974); 
Skramstad (1974); Wharry and Hirst (1974); Eisenberg, 
Lynch and Breeding (1975); AlChE (1976/69); Drysdale 
(1976b, 1985); Kletz (1976h, 1979a); Rasbash (1977a, 1979/ 
80); Stull (1977); R. King and Magid (1979); Lock (1979); 
Solomon (1980); PH. Thomas (1980); J.G. Marshall and 
Rutledge (1982); Pantony and Smith (1982);'Ikuchiya 
(1982); ASME (1983/52); Hofinan (1983); Hottel (1984); BRE 
(1985 BR 60); Schultz (1985); Babrauskas (1986a); Kuo 
(1986); de Ris (1986); Harmathy and Mehaffey (1987); 
Emms (1988); Bagster and Pitblado (1989); ILO (1989); 

J.B. Moss (1989); Mudan (1989b); C.D. Woodward (1989); 
V.C. Marshall (1990b); Pineau et al. (1991); CPD (1992a,b); 
Carhart (1994) BS 5908:1980 

Fire statistics, fire costs ( see also Table 2.1) 

BIA (annual report, 1975); Anon. (1960—61); Chandler 
(1969); BRE (1970-, UK Fire and Loss Statistics); CIA 
(1970/3); FRS (1972 Fire Res. Notes 910,920,1973 Fire Res. 
Notes 978,981,1974 Fire Res. Note 1011); H.D. Taylor and 
Redpath (1971); Vervalin (1972c, 1973d, 1974a, 1975c, 1976b, 
1977,1978a,b); Anon. (1974e,g,m);Tovey (1974); Duff (1975); 
Fry (1975); Redpath (1976); Rutstein (1979b); Rutstein and 
Clarke (1979); Beard (1981/82); Ramachandran (1982,1988); 
Anon. (1983h) 

Fire rating 

UL (n.d./b); Dow Chemical Co. (1964,1966a,b, 1976,1980, 
1987,1994); Law (1991) 

Fire properties of materials, fire tests (see also 
Tables 8.1,11.1,11.18,16.3,17.2 and 17.62) 

BRE (n.d./4-6,1974 CP 91/74,1975 CP 36/75); SMRE (Fire 
1,3,6); Burgoyne and Richardson (1948); Burgess and 
Zabetakis (1962 BM RI6099,1964); IFE (1962,1972); 
Madorsky (1964); Risinger (1964a,c,d,h);W.S. Wood (1965); 
Mansfield (1969); Hilado (1970,1973); W.B. Howard (1970b); 
FPA (1971 /14,15,1974/22,1986- CFSD H series NFPA 
(1972/9,2000 NFPA 30, 2001/704,1991/27,1992 NFPA 49, 
325M, 491M, 445); Woinsky (1972); DOT, CG (1974a,b); 
Rasbash (1975b); Groothuizen and Romijn (1976);Tewarson 
and Pion (1976); Kletz (1977i); Dokter (1985a); W.J. Bradford 
(1986a); Clarke (1986b); M.F. Henry (1986); UL (1986 UL 
723); Walls (1986); Wharton (1990); BS 476:1970- 
Calorijic value of wood: Goldfinger (1949); A.F. Roberts 
(1964,1967b, 1971c); Allan, Cameron and Lambie (1966); 
Brenden (1967); Hsiang-Cheng Rung and Kalelkar (1973) 
Oxygen index: Fenimore and Martin (1966); Abbott (1974) 

Solids fires 

F.R. Steward (1964,1971); Kanury and Blackshear (1970); 
Havens et al. (1972); Kanury (1972a-c); Annamali and 
Durbetaki (1975); W. A. Gray (1979); Vovelle, Mellottee and 


Delbourgo (1982); Vovelle, Akrich and Delfau (1984); 
Wichman and Atreya (1987);Wichman andAgrawal (1991); 
Janssens (1991). 

Crib and rack fires 

FRS (Fire Res. Note 600); Fons, Clements and George 
(1963); P.H. Thomas, Simms and Wraight (1964,1965); 

P.H. Thomas (1965b); Hsiang-Cheng Rung (1972); Hsiang- 
Cheng Rung and Kalelkar (1973); Hsiang-Cheng Rung 
and Hill (1975-); Delichatsios (1976); Emori and Saito 
(1983);Tewarson (1985); You and Rung (1985); Carrier, 
Fendell and Wolff (1991); Wolff, Carrier and Fendell (1991) 

Free-burning fires, fire plumes 

P.H. Thomas (1963); Emmons (1965); B.R. Morton (1965); 
P.H. Thomas, Baldwin and Heselden (1965); Huffman, 
Welker and Sliepcevich (1967); Block (1971); S.L. Lee and 
Otto (1975); G. Cox and Chitty (1980); Heskestad (1981, 
1989); Rung and Stavrianidis (1982); Babrauskas (1986a); 
Zonato etal. (1993) 

Large area fires: Muraszew, Fedele and Kuby (1979); 

T.Y. Palmer (1981); Carrier, Fendell and Feldman (1984); 
R.O. Weber (1989); Heskestad (1991); D.A. Carter (1992); 
Ghoniem etal. (1993); Fendell and Mitchell (1993); Weihs and 
Small (1993); Husain (1995) 

Small area fires: Heikes, Ransohoff and Small (1990) 
Subterranean fires: BRE (1989IP3/98) 

Metals fires 

Steinberg, Wilson and Benz (1992); Classman (1993) 

Propellant fires 

Grumer etal. (1961) 

Fires in buildings, warehouses 

Kawagoe (1958); P.H. Thomas and Heselden (1962); FRS 
(1963 Fire Res. Tech. Pap. 5,1966 Fire Res.Tech. Pap. 15,1975 
Fire Res. Note 1029); Kawagoe and Sekine (1963); 

P.H. Thomas (1963,1973b, 1981a,b, 1982); P.H. Thomas et al. 
(1963); Roth (1964);Thomas and Hinckley (1964); 

P.H. Thomas, Simms and Wraight (1964,1965); FMEC (1967); 
Waterman (1968); Law (1971,1991); Langdon-Thomas 
(1967a,b, 1972); FPA (1970/9,13,1971/14,1973/20,21,1982 
CFSD FS 6017); P.H. Thom a s and Law (1972,1974); Butler, 
Martin and Wiersma (1973); BRE (1974 CP 30/74, CP 32/74, 
CP 43/74,1978 CP 40/78); Hagglund, Jansson and Onnemark 
(1974); Rasbash (1974a, 1991); Croce (1975); Fang (1975); HSE 
(1975 TON 29); Prahl and Emmons (1975); Quintiere (1975, 
1979,1983); Petterson, Magnusson and Thor (1976); Rockett 
(1976); Ove Arup (1977); Theobald (1977); P.H. Thomas and 
Theobald (1977); Babrauskas and Williamson (1978); Bullen 
(1978); Quintiere, McCaffrey and Kashiwaga (1978); Bullen 
and Thomas (1979); Butcher and Parnell (1979); Emmons 
(1979); P.H. Thomas and Bullen (1979/80); Babrauskas (1981, 
1986c); D.S. Baker (1981); McCaffrey, Quintiere and 
Harkleroad (1981); Siu (1982); Drysdale (1985); Lawson and 
Quintiere (1985); Steckler, Baum and Quintiere (1985); Beyler 
(1986); Budnick and Evans (1986); Budnick and Walton 
(1986); Shields and Silcock (1987); Anon. (1988 LPB 84); Ho, 
Siu and Apostolakis (1988); Jaluria and Kapoor (1988); 
Rabinkov (1988); Heskestad and Delichatsios (1989); 
Lockwood and Malalasekera (1989); Peacock and Bukowski 
(1990); Brandyberry and Apostolakis (1991a,b); Peacock and 
Babrauskas (1991); Babrauskas and Peacock (1992); 

N.R. Marshall and Morgan (1992); McCaughey and Fletcher 
(1993); Melinek (1993a); Pagella and de Faveri (1993); 
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Chamberlain (1994); Comitis, Glasser and Young (1994). 
Warehouses: Barthelemy and Lamboley (1978); Isman 
(1978); G.T. Atkinson, Jagger and Kirk (1992); D. A. Carter 
(1992); G.T. Atkinson and Jagger (1994); Christiansen 
(1994); Smith-Hansen (1994) 

Ventilated fires 

Tewarson and Steciak (1983); Alvares, Foote and Pagni 
(1984); Chippett (1984); Mitler (1984) 

Smoke 

Hilado and Kosola (1977); Rasbash and Drysdale (1982); 
Fothergill (1984); Marchant (1984); Drysdale (1985); 
Heskestad (1986); Savilonis and Richards (1988); Gross 
(1991); Delichatsios (1993a); Ghoniem etal. (1993); Kandola 
and Morris (1994) 

Brands from fires 

Shao-Iin Lee and Heilman (1969,1970) 

Decomposition products of fires ( see also Table 18.1) 

FRS (1972 Fire Res. Note 913,947,951,1973 Fire Res. Note 
966,1975 Fire Res. Note 1025,1976 Fire Res. Note 1048); 
Rasbash (1969b); Hilado (1970,1973); FPA (1971/14,1989 
CFSD N3); BRE (1974 CP5/74, CP 11/74, CP12/74, CP 91/74, 
1976 CP 22/76); Woolley and Raftery (1976); Hilado and 
Kosola (1977); Chisnall (1978); Einhorn and Grunnet (1978); 
Hilado, Cumming and Casey (1978); Hilado and Huttlinger 
(1980,1981a,b); Herpol andVandervelde (1981/82); Woolley 
and Fardell (1982); Landrock (1983); Kaplan and Hartzell 
(1984); Hartzell, Packham etal. (1985); Hartzell, Priest and 
Switzer (1985); Hartzell, Stacy et al. (1985); Alexeeff et al. 
(1986); Delumyea, Moore and Morgan (1986); Doe etal. 
(1986); Pollock, Campbell and Reid (1986);Tsuchiya and 
Nakaya (1986); Hartzell, Grand and Switzer (1987); 

M.T. Mills (1987); van Loo and Opschoor (1989); Hartzell 
(1989); CPD (1992b) 

Warehouses: G.T. Atkinson, Jagger and Kirk (1992); 

D.A. Carter (1992); Smith-Hansen and Jorgensen (1993); 

G. T. Atkinson and Jagger (1994); Christiansen (1994); 
Smith-Hansen (1994) 

Oil slick fires 

Brzustowski andTwardus (1982) 

Fires in process plants 

H. R. Brown (1956 BM RI5198); IFE (1962); Vervalin (1964a, 
1973a); Zabetakis (1965); H.S. Robinson (1968); Hearfleld 
(1970,1974); FPA (1971/14); Bland and Beddow (1974); 
Rasbash (1974b); Kletz (1978c, 1979a, 1988d); Kanury 
(1981); A.F. Roberts (1981/82); Considine, Grint and Holden 
(1982), BS 5908:1980 

Cable fires: FPA (1974a); Anon. (1980c); Anon. (1981LPB 
41, p. 5); B.F. Gray etal. (1990) 

Duct fires: A.F. Roberts and Kennedy (1965); A.F. Roberts, 
Clough and Blackwell (1966); A.F. Roberts and Clough 
(1967a,b); de Ris (1970); A.F. Roberts (1971a); Wilde (1972); 
Church (1978); Lovachev (1978a); Anon. (1979 LPB 30, p. 55); 
C.K. Lee, Chaiken and Singer (1979); Hunter and Favin 
(1981); Brandeis and Bergman (1983); Newman and 
Tewarson (1983); Krupper (1991) 

Flange fires: McFarland (1969) 

Hydraulic accumulator fires: HSE (SIR 9) 

Iron-chlorine fires: Anon. (1991 LPB 98, p. 25) 

Lagging fires: PH. Thomas and Bowes (1961b, 1967); 
Petkus (1963,1964); Darling (1967); Lindner and Seibring 


(1967); Bowes and Langford (1968); Bowes (1974a, 1976); 
BRE (1974 CP 35/74); Gugan (1974a); Anon. (1977 LPB 17, 
p. 2); Buch and Filsinger (1985); Britton (1991); Craig (1993 
LPB 110) 

Pump fires: Kletz (1971); Fromm and Rail (1987b) 
Transport: NFPA (2002/10) 

Tank fires, including boilover, frothover 

Burgoyne and Katan (1947); Burgoyne (1950,1952); Laney 
(1963,1964); Risinger (1964b,f); Herzog (1974); OIA (1974 
Loss Inf. Bull. 400—2); Yumoto (1977); Brotz and 
Schonbucher (1978); Lois and Swithenbank (1979); Viergas, 
Campos and Oliviera (1984); Broekmann and Schecker 
(1992); Inamura, Saito andTagavi (1992); Michaelis, 
Mavrothalassitis and Pinjeau (1992); Palmer (1992 LPB 
106); Purdy, Pitblado and Bagster (1992) 

Bitumen tank fires: Anon. (1991 LPB 102, p. 35) 

Fires in liquids, leakages and spillages 

Rasbash (1956,1970a); Burgoyne, Roberts and Quinton 
(1968); Burgoyne and Roberts (1968a,b); Leroy and 
Johnson (1969); FPA (1971/14); Wilde and Curzon (1971); 
Stark (1972); A.F. Roberts (1975a); Kletz (1976h); Anon. 
(1980d,k); Crawley (1982); Toa and Kaviany (1991) 

Fire models 

Considine (1981); Simpson and Taylor (1984 SRD R276); 
Drysdale (1985); A.D. Davies (1987); Beard (1992a,b); 

PH. Thomas (1992,1993); Nam and Bill (1993) 

Flames 

NRC (Appendix 28 Combustion)', Flamm and Mache (1917); 
Mache (1918); Bone andTownend (1927); Burke and 
Schumann (1928a,b); Bone and Newitt (1929); Jahn (1934); 
B. Lewis and von Elbe (1937,1938,1943,1951,1961,1987); 
Jost (1939,1946); Forsyth and Garside (1949); Hawthorne, 
Weddel and Hottel (1949); Hottel (1949,1953); Hottel and 
Hawthorne (1949); Scholefield and Garside (1949); 

G.C.Williams, Hottel and Scurlock (1949); Wohl, Kapp and 
Gazley (1949);Thring (1952); Gaydon and Wolfhard 
(1953-); Gerstein (1953); Grove and Walsh (1953); Karlovitz 
(1953); Karlovitz etal. (1953);Wohl (1953); R. Friedman and 
Burke (1955); Grumer, Harris and Rowe (1956 BM RI 5225); 
Barnett and Hibbard (1957); Fristrom (1957); Spalding 
(1957a, 1963a, 1976); Berlad and Yang (1959); van Krevelen 
and Chermin (1959); Kydd (1959); Prudnikov (1959); 
Sundukov and Predvoditelev (1959); Zeldovitch and 
Barenblatt (1959); Westenberg and Favin (1960); Cekalin 
(1962); Menkes (1962); Potter, Heimel and Butler (1962); 
Yamazaki and Tsuji (1962); Markstein (1964); Fristrom and 
Westenberg (1965); Khitrin etal. (1965); H. Phillips (1965); 
Shchelkin andTroshin (1965);Wiebelt (1966); Essenhigh 
(1967); Gaydon (1967); J.N. Bradley (1969); Edmondson and 
Heap (1969); Gunther (1969); F. Powell (1969); Hearfield 
(1970); Emmons (1971); Werthenbach (1971a,b); Fox and 
Sarkar (1972); Ballal and Lefebvre (1973,1975c); Chomiak 
(1973); H.B. Palmer and Beer (1973); Afgan and Beer (1974); 
Barnes and Fletcher (1974); R.O. Parker (1974); Eisenberg, 
Lynch and Breeding (1975); Kanury (1975); Modak (1975, 
1978/79); Gugan (1976); Stambuleanu (1976); A. Williams 
(1976); G. Cox (1977); Classman (1977); Goodger (1977); 
Kaptein and Hermance (1977); Lockwood (1977); 

J.G. Marshall (1977); Lockwood and Syed (1979); Chandra 
and Davis (1980); Albini (1981); D. Bradley (1982); 
Buckmaster and Ludford (1982); Ishikawa (1982); Pong 
Chung and Smith (1982); Jeng, Chen and Feath (1982); 
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W.P. Jones and Whitelaw (1982); S.T. Lee and Tien (1982); 
Takahashi, Mizomoto and Ikai (1982); F.A.Williams (1982); 
Heskestad (1983a,b, 1984); Clavin (1984); Ramohalli, Jones 
and Bashar (1984); Hertzberg (1985); R.S. Levine (1985); 
Tune and Venart (1984/5a,b); Zukoski, Cetegen and Kubota 
(1985); Law (1989); Schefer, Namazian and Kelly (1989); 
Adiga etal. (1990); Carriere etal. (1991); Dixon-Lewis (1991); 
Kennel, Gottgens and Peters (1991); P.M. Thomas (1993) 

Premixed flames 

Burgess (1962 BM Bull. 604); S.B. Reed (1967,1971); 
Vinckier and vanTiggelen (1968); Basu and Bhaduri (1972); 
N.J. Brown, Fristrom and Sawyer (1974-); Vance and Krier 
(1974); Lockwood (1977); Strehlow and Savage (1978); Bray, 
Champion and Libhy (1989); Searby (1992); Duclos, 
Veynante and Poinsot (1993) 

Diffusion flames 

Wohl, Kapp and Gazley (1949); Barr (1953); H.N. Powell 
(1955); Sunavala, Hulse and Thring (1957); Schmitz (1967); 
Bilger (1975,1976,1977); Suris, Flankin and Shoring (1977); 
Kalghatgi (1981—); Chakravarty, Lockwood and Sinicropi 
(1984); Birch etal. (1988); Birch and Margrave (1989); 
Delichatsios and Orloff (1989); deFaveri etal. (1989); Chao, 
Law and Tien (1991) 

Laminar diffusion flames: Burke and Schumann (1928a,b); 
Savage (1962) 

Turbulent diffusion flames: F.R. Steward (1970); 
Brzustowski (1973); Kent and Bilger (1973); Chigier and 
Strokin (1974); Brzustowski, Collahalli and Sullivan (1975); 
Markstein (1976); Lockwood (1977);Tamanini (1977); 
Becker and Liang (1978); Becker and Yamazaki (1978); 
Pergament and Fishburne (1978); Heskestad (1983a); 
Nguyen and Pope (1984); Bilger (1989); Annaruma, Most 
and Joulain (1991); D.A. Smith and Cox (1992); Blake and 
McDonald (1993) 

Turbulent jet diffusion flames: Baron (1954); Sunivala, 
Hulse and Thring (1957); Bilger (1976); Onuma and 
Ogasawara (1977); Peters and Williams (1983); Kalghatgi 
(1984); Pitts (1989); Delichatsios (1993b) 

Buoyant diffusion flames! PH. Thomas, Webster and 
Raftery (1961); Putnam and Grinberg (1965); PH. Thomas, 
Baldwin and Heselden (1965); Masliyah and Steward 
(1969); Steward (1970); Delichatsios and Orloff (1985) 
Flame regime intermediate between premixed and diffusion 
conditions: Talley (1992) 

Radiant heat transfer, fire spread 

BRE (n.d./2—4,1974 CP 29/74, CP 72/74); FRS (Appendix 
28, F3, F4, Fire Res. Special Rep. 2,1961 FI, 1963 Fire Res. 
Tech. Pap. 5,1966 F6, F8,1972 Fire Res. Note 921); Lawson 
and Simms (1952a,b); McAdams (1954); Eckert and Drake 
(1959); Kreith (1962); Sparrow (1962); Sparrow and Cess 
(1966,1978); Law (1969); Hearfield (1970,1974); FPA (1971/ 
14); Langdon-Thomas (1972); Siegel and Howell (1972, 
1991); Sirignano (1972); PH. Thomas and Law (1972,1974); 
Blackshear (1974); L.E. Brown, Wesson and Welker (1974a,h, 
1975); Fernandez-Pello and Williams (1974,1977); W. A. Gray 
and Muller (1974); Kovacs and Honti (1974); Alpert (1975); 
Eisenberg, Lynch and Breeding (1975); Feng, Williams and 
Kassoy (1975); Craven (1976); Groothuizen and Romijn 
(1976); Klootwijk (1976); Nakakuki (1976); Rasbash (1976c); 
R.B. Robertson (1976b); Feng and Sirignano (1977); Straitz 
and O’Leary (1977); Yumoto (1977); HSE (1978b); Modak 
(1979); D.C. Bull et al. (1980); Carrier, Fendell and Feldmann 


(1980); F.R.S. Clark (1981); Anon. (1984 LPB 56, p. 11); 
Harmathy (1985); Modest (1993) 

Flame radiation: Hottel and Mangelsdorf (1935); Hottel and 
Smith (1935); Hottel and Egbert (1941,1942); Daly and 
Sutherland (1949); Hottel,Williams and Satterfield (1949); 
Cassel, liebman and Mock (1957); Foster and McGrath 
(1960); D.K. Edwards (1963); Siddall and MacGrath (1963); 
Echigo, Nishiwaki and Hirata (1967); Hottel and Saroflm 
(1967); R.K. Smith (1967); Tien (1968); Beer andHowarth 
(1969); Dalzell and Saroflm (1969); Godridge and 
Hammond (1969); Masliyah and Steward (1969); Sato etal. 
(1969); Dalzell, Williams and Hottel (1970); Leckner (1971, 
1972); Lowes and Newall (1971); J.M. Jones and Rosenfeld 
(1972); Thring and Lowes (1972); Felske and Tien (1973, 
1974a,b); C.S. Kelly (1973); N.K. King (1973); Cess (1974); 
Markstein (1974,1976,1977,1985,1989); P.B. Taylor and 
Foster (1974,1975); C.K. Lee (1975); W A. Gray, Kilham and 
Muller (1976); Yuen and Tien (1977); Fishburne and 
Pergament (1979); Orloff, Modak and Markstein (1979); de 
Ris (1979); Wagner (1979); Calcote (1981); Ganapathy (1981); 
Grosshandler and Modak (1981); Orloff (1981); Vervisch, 
Puechberty and Mohamed (1981); Becker and Liang (1982); 
Tien and Lee (1982); Coppalle and Vervisch (1983); 
Frenklach,Taki and Matula (1983); Vervisch and Coppalle 
(1983); Gill and Olson (1984); Brosmer and Tien (1986); 
Raparotte and Brzustowski (1986); E.B. Cohen and Taylor 
(1987); MHAP (1988 LPB 82); Mudan (1989b); Hamins etal. 
(1991); Orloff, de Ris and Delichatsios (1992) 

Radiant heat factor: A.F. Roberts (1981/82); Hymes (1983 
SRDR275) 

Soot: Mie (1908); Arthur and Napier (1955); Schalla and 
McDonald (1955);Tesner, Robinovitch and Rafalkes (1962); 
A.Thomas (1962); Yagi and lino (1962); Bonne, Homann and 
Wagner (1965); Narasimhan and Foster (1965); Homann 
(1967); Kunugi and Jinno (1967); McLintock (1968); 
Fenimore and Jones (1969); J.B. Howard (1969); Columbo 
and Thring (1972); Feugier (1972); Wersborg, Howard and 
Williams (1973); Muller-Dethlefs and Schlader (1976); 
Becker and Yamzaki (1977); Prado et al. (1977); Orloff, 
Modak and Markstein (1979); Wagner (1979); Classman and 
Yaccarino (1981); S.C. Lee and Tien (1981); Pong Chung and 
Smith (1982); Sen and Ludford (1982); Homan (1983); 
Santoro, Semerjian and Dobbins (1983); Senkan, Robinson 
and Gupta (1983); Takahashi and Classman (1984); 
Hirschler (1985); Kent and Wagner (1985); K.Y. Lee, Zhong 
and Tien (1985); R.S. Levine (1985); Markstein (1985,1989); 
Pagni and Okoh (1985); Santoro and Semerjian (1985); 
Delumyea et al. (1986); Kent and Honnery (1987,1991); 
Classman (1989); Giilder (1989); McCaffrey and Harkleroad 
(1989); Megaridis and Dobbins (1989); J.B. Moss (1989); 
Honneiy and Kent (1990,1992); I.M. Kennedy Kollman and 
Chen (1990); Leung, Lmstedt andjones (1991); C.D. Stewart, 
Syed and Moss (1991); Syed, Stewart and Moss (1991); 
Fairweatheref al. (1992); Smedley, Williams and Bartle 
(1992); Coppalle and Joyeux (1993); Chamberlain (1994) 
View factor: Hottel (1930,1931,1954); Hamilton and Morgan 
(1952); McGuire (1953); McAdams (1954); Coulson and 
Richardson (1955-, 1977—); Rogers and Mayhew (1957); 
Eckert and Drake (1959); Bird, Stewart and Lightfoot 
(1960); Chandrasekhar (I960); C.O. Bennett and Myers 
(1962); Sparrow (1962); Sparrow, Miller and Johnson (1962); 
Dunkle (1963); Kourganoff (1963); Feingold (1966); 
Sparrow and Cess (1966,1978); Hottel and Sarofim (1967); 
Grier (1969); Rein, Sliepcevich and Welker (1970); Chung 
and Sumitra (1972); Merriam (1972); Siegel and Howell 
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(1972); Ozisik (1973); Raj and Kalelkar (1974); Minning 
(1977); Becker (1980a,b); Chung and Naraghi (1981); Howell 
(1982); Mecklenburgh (1985);Tune and Venart (1984/85a,b); 
Crocker and Napier (1986,1988a,b); Napier and Roopchand 
(1986); Mudan (1987,1989b); Wong and Steward (1988); 
B.C. Davis and Bagster (1989-); Bagster andDavies (1990); 
Beard etal. (1993); CPD (1992a); CCPS (1994/15) 
Atmospheric transmissivity: R.O. Parker (1974); Glasstone 
and Dolan (1980); Horvath (1981); Lihou and Maund (1982); 
Hymes (1983 SRD R275); Considine (1984 SRD R297); 
Simpson (1984 SRD R304); Bahrauskas (1986b); R.C. Henry 
(1987); V.C. Marshall (1987); Wayne (1991); CPD (1992a) 
CCPS (1994/15) 

Flames on pools, pool fires 

Rasbash (1956); Blinov and Khudiakov (1957); Hottel 
(1958); Rasbash, Rogowski and Stark (1960); Burgess, 
Strasser and Grumer (1961); Fons (1961); Magnus (1961); 
Welker and Sliepcevich (1965,1966); Agoston (1962); 
Burgess and Grumer (1962); Burgess and Zabetakis (1962 
BM RI6099); Spalding (1962); P.H. Thomas (1963); 

PH. Thomas, Pickard and Wraight (1963); Pipkin and 
Sliepcevich (1964); Akita and Yumoto (1965); Atallah 
(1965); Welker, Pipkin and Sliepcevich (1965); Corlett and 
Fu (1966); A.F. Roberts (1966,1971b); Corlett (1968,1970); 
Classman and Hansel (1968); Canfield and Russell (1969); 
Classman, Hansel and Eklund (1969); Huffman,Welker and 
Sliepcevich (1969); Masliyah and Steward (1969); B.D.Wood 
and Blackshear (1969); Hearfield (1970); ICI/RoSPA (1970 
IS/74); Murad etal. (1970); Akita and Fujiwara (1971); 
Hillstrom (1971); Torrance (1971); B.D.Wood, Blackshear 
and Eckert (1971); Yumoto (1971b); Chetty and Voinov 
(1972); A.R. Hall (1972); de Ris and Orloff (1972); Hertzberg 
(1973); C.S. Kelly (1973); Nakakuki (1973,1974a,b, 1976); 
A.F. Roberts and Quince (1973); Dayan and Tien (1974); 
Duffy, Gideon and Puttnam (1974); Fu (1974); P. Nash 
(1974a); Dehn (1975); Escudier (1975); Hirano and Kinoshita 
(1975); Craven (1976); Dow Chemical Co. (1976); MITI 
(1976); Brotz, Schonbucher and Schable (1977); Modak 
(1977,1981); Modak and Croce (1977); Yumoto,Takahashi 
and Handa (1977); Alger etal. (1979); NASA (1979); Raj, 
Moussa and Aravamudan (1979a,b); Anon. (1980d,k); 
Classman and Dryer (1980/81); Mizner (1981); Mizner and 
Eyre (1982); Dinenno (1982); Hsiang-Cheng Kung and 
Stavrianidis (1982); Kletz (1982h); Moorhouse (1982); 
Moorhouse and Pritchard (1982); Orloff and de Ris (1982); 
Pantony and Smith (1982); Sher (1982); Babrauskas (1983, 
1986b); Cline and Koenig (1983); Mudan (1984c, 1989b); 
Santo and Delichatsios (1984); Shinotake, Koda and Akita 
(1985); Webber (1985 SRD R325); Croce and Mudan (1986); 
Crocker and Napier (1986); Frank and Moieni (1986); 
Uguccioni and Messina (1986); Brosmer and Tien (1987); 
Delichatsios (1987,1988,1993a,b); Fischer, Hardouin- 
Duparc and Grosshandler (1987); Nishio and Machida 
(1987); Fischer (1988); Koseki and Yumoto (1988); Adiga 
etal. (1989); Bagster and Pitblado (1989); Bouhafld, 
Vantelon, Soudil etal. (1989); Bouhafid.Vantelon, Joulain 
etal. (1989); Fischer and Grosshandler (1989); Koseki 
(1989); Koseki and Hayasaka (1989); J.B. Moss (1989); 
Schneider and Kent (1989); SeungWook Back and Chan Lee 
(1989); Arpaci and Selamet (1991); Holen, Brostrom and 
Magnussen (1991); Koseki and Mulholland (1991); Pineau 
etal. (1991); Ditali, Rovati and Rubino (1992); Hayasaki, 
Koseki and Toshiro (1992); Inamura, Saito andTagavi 
(1992); Klassen etal. (1992); Lautkaski (1992); Mangialavori 


and Rubino (1992); Schonbucher, Gock and Fiala (1992); 
Cetegen and Ahmed (1993) 

LNG fires: HSE/SRD (HSE/SRD/WP 34); Welker, Wesson 
and Sliepcevich (1969); Hoult (1972a); Atallah and Raj 
(1973); Fay (1973); May and McQueen (1973); Welker (1973, 
1982); Opschoor (1975a,b); Raj and Atallah (1975); 
Stannard (1977); Raj, Moussa and Aravamulan (1979); 
Schneider (1980); Blackmore, Eyre and Summers (1982); 
Ermak, Koopman etal. (1982); Mizner and Eyre (1982); 
Croce, Mudan and Wiersma (1986); Napier and Roopchand 
(1986); Rosenblatt and Hassig (1986); A.D. Johnson (1992) 
LPG fires: Rasbash (1979/80); Blackmore, Eyre and 
Summers (1982); Mizner and Eyre (1982) 

Pool fires on water: A.D. Little (1979); Mizner and Eyre 
(1983); Arai, Saito and Altenkirch (1990); Alramadhan, 
Arpaci and Selamet (1991) 

Pool fires in enclosures: Tatem etal. (1986) 

Fires on wicks: Burgoyne, Roberts and Quinton (1968);Toa 
and Kaviany (1991) 

Trench fires 

Welker (1965); Alger and Capener (1972); Gollahalli and 
Sullivan (1974); Mudan and Croce (1984); Croce, Mudan and 
Wiersma (1986); D.A. Smith (1992) 

Fire engulfment, including directed jets 

Chichelli and Bonilla (1945-); L.H. Russell and Canfield 
(1973); C. Anderson etal. (1974); Charles (1974); Charles and 
Norris (1974); Borgnes (1979a,b); Borgnes and Karlsen 
(1979); Birk and Oosthuize (1982); J.M.Wright and Fryer 
(1982); Heitner.Trautmanis and Morrissey (1983a,b); Hunt 
etal. (1983 SRD R240); A.F. Roberts, Cutler and Billinge 
(1983); Solberg and Borgnes (1983); Sousa and Venart 
(1983); Nylund (1984); Droste etal. (1984); Schulz-Forberg, 
Droste and Charlett (1984); Venart etal. (1984);Tune and 
Venart (1984/85a); Grolmes and Epstein (1985); Moodie, 
Billinge and Cutler (1985); Siddle (1986); Aydemir et al. 
(1988); Bainbridge and Keltner (1988); Beynon et al. (1988); 
Birk (1988,1989); Droste and Schoen (1988); Moodie (1988); 
Moodie et al. (1988); Ramskill (1988); Venart et al. (1988); 
Venart etal. (1989); Dancer (1990); Hadjisophocleous, 
Sousa and Venart (1990); Tanaka etal. (1990); Bennet etal. 
(1991); Cowley and Pritchard (1991); Crespo etal. (1991); 
Verheif and Duijm (1991); Giselle and Krause (1992); 
Hernandez and Crespo (1992); Duijm (1994) 

Fireballs, BLEVEs {see also Table 17.36) 

Gayle and Bransford (1965); vanNice and Carpenter (1965); 
R.W. High (1968); Bader, Donaldson and Hardee (1971); 
Patterson etal. (1972); Hardee and Lee (1973,1975,1977-78); 
MLTI (1976); Fay and Lewis (1977); Hasegawa and Sato 
(1977,1978); VC. Marshall (1977a, 1987); Maurer et al. (1977); 
Hardee, Lee and Benedick (1978); HSE (1978b, 1981a); A. 
Baker (1979); Fay, Desgroseillers and Lewis (1979); Harvey 
(1979b); R.C. Reid (1979); Appleyard (1980); Gillette (1980); 
Mallory (1980); Aravamudan and Desgroseillers (1981); 
Kletz (1981n); A.F. Roberts (1981a,b, 1981/82,1982); 
Considine, Grint and Holden (1982); Crawley (1982); 
Moorhouse and Pritchard (1982); Williamson and Mann 
(1981); Lihou and Maund (1982); Pantony and Smith (1982); 
Ursenbach (1983); Martinsen (1984); D.L.M. Hunt and 
Ramskffl (1985); Kohler (1985); Pietersen (1985); "11106 and 
Venart (1984/5a,b); Blything (1986); Hirst (1986); Roper 
et al. (1986); Bagster and Pitblado (1989); J.B. Moss (1989); 
Buckmaster, Joulin and Ronney (1991); Pineau et al. (1991); 
Satyanarayana, Borah and Rao (1991); Buckmaster, 
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Gessman and Ronney (1992); Buckmaster and Joulin (1993); 
Buckmaster, Smooke and Giovangigli (1993); Prugh (1994) 
Vapour cloud fires, flash fires 
Kletz (1971); Eisenberg, Lynch and Breeding (1975); Fay 
and Lewis (1975,1977); Raj and Emmons (1975); A.D. Little 
(1979); Hogan (1982); Rodean etal. (1984); Roper, Arno and 
Jaggers (1991); Seshadri, Berlad and Tangirala (1992); 
CCPS (1994/15) 

Jet flames 

Hawthorne,Weddell and Hottel (1949); Hottel and 
Hawthorne (1949); Hottel (1953); Thring and Newby (1953); 
Goldburg and Sin-I Cheng (1965); Chervinsky and 
Manheimer-Timnat (1969); Hoehne, Luce and Miga (1970); 
Guruz etal. (1974); Lockwood and Naguib (1975); Becker 
and Yamazaki (1978); Becker (1980a,b); Kalghatgi (1983); 
Peters and Williams (1983); Hirst (1984,1986); Sonju and 
Hustad (1984); Tune and Venart (1984/85b); Delichatsios 
and Orloff (1985); de Faveri et al. (1985); Hustad and Sonju 
(1986); McCaffrery and Evans (1986); M.T.E. Smith etal. 
(1986); Beychok (1987b); Chamberlain (1987,1989); 

D.K. Cook, Fairweather, Hammonds and Hughes (1987); 
D.K. Cook, Fairweather, Hammonds and O’Brien (1987); 
Delichatsios (1987,1993a); Leahey and Schroeder (1987); 
Crocker and Napier (1988b); Bagster and Pitblado (1989); 
Birch etal. (1989); Greenberg (1989); Grint (1989); Loing 
and Yip (1989); J.B. Moss (1989); Mudan (1989b); Tarn and 
Cowley (1989); Turns and Lovett (1989); J. Cook, Bahrami 
and Whitehouse (1990); Damiano (1990); RW. Davis etal. 
(1990); D.A. Carter (1991); D.K. Cook (1991a); Cowley and 
Pritchard (1991); Fairweather etal. (1991); Peters and 
Gottgens (1991); Arnaud etal. (1992); Fairweather, Jones 
and Linstedt (1992); GollahaUe, Khanna and Prabhu (1992); 
Vfflermaux and Durox (1992); API (1990 RP 521); Coppalle 
and Joyeux (1993); Sivathanu and Gore (1993); Duijm 
(1994); A.D. Johnson, Brightwell and Carsley (1994); 

C.R. Kaplan etal. (1994) 

Mist and spray fires 

Godsave (1953); Burgoyne and Cohen (1954); J. A. Browning 
and Krall (1955); Hottel, Williams and Simpson (1955); 
Kobayasi (1955); Agoston,Wise and Rosser (1957); Bolt and 
Saad (1957); J.A. Browning,Tyler and Krall (1957); Eraser 
(1957); Kumagai (1957); F.A. Williams (1959); Reichenbach, 
Squires and Penner (1962); Rosser (1967); Aldred and 
Williams (1966); Eisenklam and Arunachalam (1966); 
Eisenklam, Arunachalam and Weston (1967); Faeth (1967, 
1977,1979,1983); Polymeropoulos and Peskin (1969); Sioui 
and Roblee (1969); Lemott, Peskin and Levine (1971); Law 
and Williams (1972); Mizutani and Nakajima (1973); 
A.Williams (1973,1976,1990); Polymeropoulos (1974,1984); 
Kapila, Ludford and Buckmaster (1975); Hayashi and 
Kumagai (1975); Law (1975); Miyasaki and Mizutani (1975); 
Polymeropoulos and Das (1975); Yuen and Chen (1976); 
Sangiovanni and Kesten (1977); Ballal and Lefebvre (1978, 
1979,1981a,b, 1983a,b); Anon. (1980h); Briffa (1981); 

K.N. Palmer (1983); Yule, Ereaut and Ungut (1983); Pindera 
and Brzustowski (1984); Sichel and Palinaswamy (1985); 
Polymeropoulos and Peskin (1989); P.J. Bowen and Shirvffl 
(1994a,b) 

Flames on flares 

Ludwig etal. (1968); Becker (1980a,b); de Faveri etal. (1985); 
Beychok (1987b); Chamberlain (1987); O.K. Cook etal. 
(1987); D.K. Cook etal. (1987); A.D. Johnson, Brightwell and 
Carsley (1994) 


Flames on pipelines 

Hoff (1983); Hirst (1984); Chamberlain (1987); D.A. Carter 
(1991) 

Effect of fire on materials, buildings 

Kashiwagi (1974,1976,1979a,b, 1981); C.S. Kelley (1975); 
Hymes (1984); J.L. Bryan (1986); Rasbash, Drysdale and 
Deepak (1986); van Loo and Opschoor (1989); Opschoor, 
van Loo and Pasman (1992). 

Ignition and combustion of wood, cellulose: Bamford, 
Crank and Malan (1946); Hopkins (1952); E.K. Lawrence 
(1952); Lawson and Simms (1952a,b); Stout (1952); Garden 
(1953,1959); C.C.Williams (1953); Hottel and Willi a ms 
(1955); S. Martin (1956,1964,1965); Akita (1959); Simms 
(1960,1961,1962,1963); Courteney (1962); A.F. Roberts and 
Clough (1963); Blackshear and Murty (1965); Weatherford 
and Sheppard (1965); Lipska (1966); Weatherford and 
Valtierra (1966); Koohyar (1967); Murty and Blackshear 
(1967); A.F. Roberts (1967a, 1971d); Simms and Law (1967); 
Rasbash and Langford (1968); Deverall and Lai (1969); 
Kosdon, Williams and Buman (1969); A.F. Roberts (1970); 
WK. Smith and King (1970); Wesson (1970); Alvares and 
Martin (1971); Garg and Steward (1971); Panton and 
Rittmann (1971); Wesson, Welker and Sliepcevich (1971); 
Kanury (1972a-c); Kashiwagi (1974,1979a,b, 1980,1981); 
Ndubizu and Durbetaki (1978); EPRI (1979b, 1981a); 
Gelderblom (1980); Vovelle, Mellotee and Delbourgo (1982); 
Yoshizawa and Kubota (1982); Cullis et al. (1983a,b); 
Wichman and Atreya (1987); Janssens (1991) 

Ignition of flammable liquids: Burgoyne and Roberts 
(1968a); Burgoyne, Roberts and Quinton (1968); Sirignano 
and Classman (1970); A.F. Roberts and Quince (1973); 
Kashiwagi (1980); Dorof eevetal. (1993) 

Flame spread 

Kinbari, Endo and Sega (1966); Baldwin (1968); de Ris 
(1969); Magee and McAlevy (1971); Kanury (1972a); 

WJ. Parker (1972); Akita (1973); Femandez-Pello and Williams 
(1974,1977); Hirano, Noreikis and Waterman (1974); Alvares 
(1975); Kashiwagi (1976); Fernandez-Pello (1977a,b, 1984); 
R. Friedman (1977); F.A.Williams (1977); Hirano and 
Tazawa (1978); Annamalai and Sibulkin (1979a,b); 
Fernandez-Pello and Mao (1981); Quintiere (1981); 
Fernandez-Pello and Hirano (1983); Ray and Classman 
(1983); Anon. (1984 LPB 56, p. 11); Alpert and Ward (1984); 
Delichatsios (1985); Drysdale (1985);Takeno and Hirano 
(1989); Mekki etal. (1991); Mitler (1991); Drysdale and 
Macmfflan (1992); Hirano and Sato (1993) 

Flame spread over liquids: Sirignano and Classman (1970); 
Drysdale (1985); Burgoyne and Roberts (1968a,b); 
Burgoyne, Roberts and Quinton (1968); MacKinven, Hensel 
and Classman (1970); Welker, Wesson and Sliepkevich 
(1971); Torrance and Mahajan (1975); Suzuki and Hirano 
(1982); Murphy (1985); Hirano and Suzuki (1993) 

Flame spread over oil-soaked ground: Ishida (1986,1988, 
1992) 

Effect of fire on people 

Williams etal. (n.d.); Bigelow et al. (1945); Henriques (1947); 
Moritz and Henriques (1947); J.P. Bull and Squire (1949); 
Buettner (1950,1951a,b, 1952,1957); Hardy, Wolff and 
Goodell (1952); Benjamin (1953); Elder and Strong (1953); 
Hardy, Jacobs and Meixner (1953); J.P. Bull and Fisher 
(1954); Hinshaw (1957); Stoll and Greene (1958,1959); 
Mixter (1959); Glasstone (1962); Mehta and Wong (1967); 
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Schlapowksy (1967); Stoll and Quanta (1969,1971); Graves 
(1970); J.P. Bull (1971); White (1971); Arnold et al. (1973); 
Denison and Tonkins (1967); Mehta, Wong and Williams 
(1973);Wulff (1973);Wulff et al. (1973); I.F.K Muir and 
Barclay (1974); Wulff and Durbetaki (1974); Eisenberg, 
Lynch and Breeding (1975); Lawson and Rashash (1976); 
Hardee and Lee (1977/78); Seader and Einhorn (1977); 
Einhorn and Grunnet (1978); HSE (1978b, 1981a); Artz, 
Moncrief and Pruit (1979); Carson (1981); Pantony (1981); 
Williamson and Mann (1981); Crawley (1982); JWL. Davies 
(1982); Hummell (1982); Mecklenburgh (1982,1985); Anon. 
(1983e); Hymes (1983 SRD R275,1984); Kemble (1983); 
Pietersen (1985); Sutherland (1985); J.L. Bryan (1986); 

W Clark and Fromm (1987); Goldin (1987); J.C. Lawrence 
and Bull (1988); Mudan (1989b); API (1990 RP 521); Boydell 
(1990 SRD R536); McCarthy (1990); Salisbury (1990); 

J.C. Lawrence (1991); Pineau et al. (1991); CPD (1992b); 
Opschoor, van Loo and Pasman (1992); CCPS (1994/15); 
Lees (1994a); Shoemaker (1995) BS 5980:1980 

Hazard assessment 

ASTM (1982 STP 762); Budnick (1986); F.B. Clarke (1986a); 
J.R. Hall (1986); Milke (1986); J.M. Watts (1986); H.E. Nelson 
(1987); MHAP (1988 LPB 82); FPA (1990 CFSD FPDG 7); 
Ramachandran (1990c); J.R. Hall and Sekizawa (1991); 

G.T. Atkinson, Jagger and Kirk (1992); Melinek (1993c); 
Williamson and Dembsey (1993) 


Table 16.2 Selected references on fire prevention, 
protection and control 


FIA (n.d.); FPA (Appendix 28, CFSD OR series, 1964/2, 
1965/3,1968/5,1969/7,8,1971/14,1972/18,1974/26,1975 
S10,1979 CFSD FS 6013,1988 CFDS GP5,1989 CFSD FS 
6011, FS 6012,1990 CFSD FS 6014); FRS (Appendix 28,1973 
Fire Res. Note 963); IRI (n.d./l, 2,4,1964/5,1966/7); MCA 
(SG-13, SG-17); NFPA (Appendix 27,28,1976/17,2002/19, 
1986/19,1988/22,20031989/24, 2002/26,1991/27, 2003 
NFPA 1); NRC (Appendix28F«>e, Fire Protection)-, UL 
(Appendix 27); Ashton (1961); Bahme (1961); Risinger 
(1962); Vervalin (1962,1964a, 1966,1972a, 1973a,g, 1975a, 
1985a); R.V. Wright (1962); Bateman (1963); Webb (1963); 
Bluhm (1964a); Dow Chemical Co. (1964,1966a,b, 1976, 
1980,1987,1994); Lindemann and Whitehorn (1965); FMEC 
(1967); Aubrecht, Lindemann and Schreiber (1968); BCISC 
(1968/7); Leeah (1968); P. Nash (1969); Newall (1969); 
Rasbash (1969a, 1970b, 1974a,b, 1976a, 1977a, 1980a,c); 
Watkins (1969); Way (1969); Hearfleld (1970); HSE (1970 
HSW Bklt 10); J.R. Hughes (1970); ICI/RoSPA (1970IS/74, 
1975IS/107); Constance (1971a); Klaassen (1971); Kletz 
(1971,1972a, 1974e, 1975d); Strother-Smith (1971); 
Underwood (1971-); Birchler (1972); Lockwood (1973a); 
Ackroyd (1974); Emmons (1974,1990); Home Office (1974-, 
Manual of Firemanship)', Hoy-Petersen (1974); 

R.B. Robertson (1974a,h, 1976a,b); Unwin, Robins and Page 
(1974); Drewitt (1975); PITB (1975/6); Clayton (1976); 

J.M. Rees (1976); Spiers (1976); ASTM (1977 STP 614,1985 
STP 882); N.T. Freeman (1977); Monroy and Majul (1977); 
H.West and Brown (1977); Coleman (1978); Beard (1979); 

R. King and Magid (1979); Planer (1979); IP (1980 Eur. 
MCSP R 2,1981MCSP R1,1987 MCSP Pt 9,1993 MCSP R 
19); Anon. (1981q); Beaumont (1981); Chandnani (1981); 


Hilado and Huttlinger (1981a); Anon. (1982 LPB 43, p. 1); 
Benedetti (1982); WS.Wood (1982a); Anon. (1983d); 
Besnard (1983); R.S. Levine and Pagni (1983); New (1983); 
API (1984 RP 2001,1991 RP 2003); British Gas (1984 BGC/ 
PS/SFP1); Prugh (1985-); Soden (1985); Cote (1986); Cote 
and Lmvffle (1986); Haessler (1986); Anon. (1987 LPB 74, 
p. 17); Burke and Finucane (1988 SRD R428); Quintiere 
(1988); Ramachandran (1988); Haverstad (1989); Hirst 
(1989); NSW Government (1989a); Pastorini et al (1989); 
Tuhtar (1989); Barnfield and Hay (1990); Ellinor (1990); 
Renowden and Woolhead (1990); Becker and Hertel (1991); 
Clerehugh (1991); Hirano (1993); C.J. King (1993); Shelley 
(1993) BS (Appendix 27 Fire Protection) 

Fire risk management 

FPA (CFSD MR series); ASTM (1982 STP 762); NFPA (2002 
NFPA 550); Alexander (1992b); C.J. King and Alexander 
(1992); C.J. King (1993) 

Buildings 

BRE (Appendix 28,1974 CP 72/74,1975 CP 37/75); FPA 
(n.d., CFSD B and CFSD series, 1971/14,1973/20, 21,1974/ 
24); FRS (Appendix 28); Langdon-Thomas (1967a,b, 1972); 
Dahms (1964); ASTM (1967,1979 STP 685); ISO (1968); 
Cutmore (1972); Malhotra (1972,1977,1984a,b); Binns, 
Nelson and Thompson (1973); G.M.E. Cooke (1974,1975); 
ASCE (1975/4); Harmathy (1977); Raes (1977); Quintiere, 
Macaffrey and Kashiwagi (1978); Lecornu (1980); BRE 
(1982IP22/82,1984IP15/84,1989IP21/89); Diysdale 
(1985); Kendik (1986); Shields and Silcock (1987); Gross 
(1991); BS 476:1970, BS 5306:1976-, BS 5588:1978- 
Time-temperature curves: Hinkley (1984); Shipp (1984); 
Harmathy and Sultan (1988) 

Fire resistance: Ministry of Works (1946); BRE (1975 CP37/ 
75); Home Office (1975 Manual of Firemanship Bk 8); Janss 
and Minne (1981/82); Malhotra (1984a,b); Gehri (1985); 
Odeen (1985); K.J. Schwartz and lie (1985); American 
Insurance Services Group (1986); Anchor, Malhotra and 
Parkiss (1986); Jacobsen (1986); UL (1986 UL 263); Choi 
1987); Cullington (1987); Harmathy and Oleskiewicz (1987); 
Harmathy and Sultan (1988); Pettersson (1988); NFPA 
(1999 NFPA 251, 2002/262,2001 NFPA 258,1995 NFPA 
220,1992/29, 2001 NFPA 80A, 2003 NFPA 259); G. Butcher 
(1991); Hosser, Dorn and Richter (1994) 

Fire resistance of steel: FPA (n.d.); FRS (1966 Fire Res.Tech. 
Paper 15); UL (1981 UL 1709); Klingsch (1981/82); 
Wickstrom (1981/82); Witteveen andTwilt (1981/82); 
American Iron and Steel Constructors (1983); European 
Convention for Constructional Steelwork (1985); 
Wickstrom (1985); Barnfield (1986); Franssen and Bruls 
(1986); Anderherg (1988); G.M.E. Cooke (1988); Gandhi 
(1988); Kirby and Preston (1988); Rubert and Schaumann 
(1988);Twilt (1988); Melinek (1989); Schneider (1990); 
Burgess, Olawale and Plannk (1992); Franssen and 
Dotreppe (1992);Tomecek and Milke (1993) 

Fire resistance of concrete: Schneider (1988); O’Meagher 
and Bennetts (1991); Sullivan and Sharshan (1992) 

Fire resistance of glass: FPA (CFSD B series); Howe (1989); 
Klein (1990); Jackman (1993); Joshi and Pagni (1994) 

Oil soaked floors: FPA (1973 S4,1983 CFSD GP10) 

Piped services: FPA (1973/21,1982 CFSD FS 6017) 

Fire ventilation, smoke control: ASHRAE (n.d./l); IRI (n.d./ 
3); FRS (1964 Fire Res.Tech. Pap. 10,1965 F5); Leach and 
Bloomfield (1973,1974 BRE CP 36/74); Gerhardt (1982); 
BRE (1984IP21/84, IP22/84); Marchant (1984); Drysdale 
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(1985); Hinkley (1986); NFPA (2000 NFPA 92A, 2000 NFPA 
92B); FPA (1989 CFSD FS 6018,1990 CFSD FRDG 3); 
Wighus and Medland (1989); Wild (1989) 

Fire venting and sprinklers: Naidus (1981a); Heselden 
(1982); Holt (1982); Hinkley et d. (1992) 

Floors: FPA (CFSD FPDG14,1974/24,1990 CFSD GP11); 
NFPA (1999 NFPA 80) 

Fire dampers: Baines (1988 LPB 84); UL (1989 555); Cullen 
(1990) 

Emergency lighting: C.Watts (1984); BS 5266:1981- 

Handling of flammable materials 

MCA (SG-3); Bahme (1961,1972); FPA (1964/1,1970/12, 
1971/14,1974 S5,1987 CFSD FS 6028); Orey (1973); NFPA 
(1991 NFPA 49,325M, 491M, 1991/27,2000 NFPA 30); 

HSE (1978 HS(G) 3); Bradford (1986b) 

Handling cylinders: Carver etal. (1977); CGA(1983 SB-3, 

1985 SB-10,1990P-1, SB-4) 

Plant layout (see also Table 10.2) 

Landy (1964a-c); Seppa (1964); FPA (1971/14); Hearfield 
(1970); Atallah and Allan (1971); Simpson (1971); Day and 
Moorhouse (1973); Mecklenburgh (1973,1976,1982,1985); 
R.B. Robertson (1974a,b, 1976a,b); Klootwijk (1976); Anon. 
(1982j); Martinsen, Johnson and Millsap (1989); GoreWillse 
and Smith (1993) 

Warehouses 

FPA (1970/9,13,1972/17,19); FRS (1972 Fire Res. Note 914, 
916,944,1977 Fire Res. Note 1068); P. Nash (1972a, 1977a); 
BRE (1974 CP 68/74,1988IP5/88); Home Office (1974/10); 
Bridge (1977); R.A. Young and Nash (1977); Parnell (1979); 
Anon. (1980t); Baldovinetti (1983); Field (1985); 
Mackintosh (1988 LPB 84); Murrell (1988); Johnston (1989 
LPB 85); Palmer (1989 LPB 86); Murrell and Field (1990); 
NFPA (1991 NFPA 231C) 

Electrical protection, hazardous area classification 

ICI (n.d.a); IEC (n.d.); Illuminating Engineering Society 
(n.d.); IEE (1971 Conf. Publ. 74,1975 Conf. Publ. 134,1982 
Conf. Publ. 218, Control Ser. 17,1988 Conf. Publ. 296); MCA 
(SG-19); Post Office (n.d.); SMRE (Elec. Hazards 1-7); 
Swann (1957,1959); EEUA (1959 Doc. 9,1969 Doc. 32); 

R.W. Scott (1961,1964); IRI (1965/6); R.Y. Levine (1965a,b, 
1968a,b, 1972a, 1983); Magison (1966,1975,1978); 
Burgoyne (1967b, 1969,1971); ICI/RoSPA (1970IS/74,1972 
IS/91); Arnaud (1971); Bartels (1971a, 1975a,c, 1977-); 
Bartels and Howes (1971); Cockram (1971); W Cooper (1971); 
Cowen, Godsmark and Goodwin (1971); Dreier and Engel 
(1971); FPA (1971/14); Gehm and Bittner (1971); Heidelberg 
(1971); Lord (1971); MacCarthy (1971); J. Nixon (1971); Palles- 
Clark and James (1971); Steen (1971); Wheatley (1971); Short 
(1972,1982,1985); API (1973 RP 500B, 1982 RP 500A, 1984 
RP 500C, 1991 RP 500); Schon (1973,1977); Arnaud and 
Jordan (1975); Bartels and Day (1975); Buschart (1975); 
Chubb, Pollard and Butterworth (1975); Ellis (1975); 

N.C. Harris (1975); Nailen (1975); Rogowski (1975); Towle 
(1975a); Rees (1976); IBC (1981/9,1991/81); Marshall (1981 
LPB 39); J.T. Woods (1981); D.R. Brown and Gregory (1982); 
Bryce, Ramsey and Seaton (1982); B.D. Cooper (1982); 
Gwyther (1982); Hay (1982); O’Shea (1982,1985); Palles-Clark 
(1982); Peck and Palles-Clark (1982); Shevchenko etal. (1982); 
Summers-Smith (1982); British Gas (1983 BGC/PS/DAT12, 

1986 BGC/PS/SHA1); Boon (1983); Bryce and Robertson 
(1983); Calder and Magison (1983); Joshi (1983); ISA (1984 
S12.12,1987 RP 12.6,1988 S12.10); Pankowski (1984); 


Mecklenburgh (1985,1986); Ashmore (1987a, b); IMechE 
(1987/92); H. Kramer (1987); NFPA (1999/20,1997 NFPA 
497, 2002 NFPA 70,1999/35); A.W. Cox, Lees and Ang 
(1990); IP (1990 MCSP Pt 15,1991MCSP Pt 1); Ahern (1991); 
AGA (1992/17); BS (Appendix 27 Hazardous Area 
Classification, HBQ, BS 4683:1971-, BS 5345:1977- 
BS 5501:1977- 

Dusts: ICI/RoSPA (1972 IS/91); EEUA (1973 Doc. 47D) 
Safeguarding: EECS (SFA 3009,1992 EECG2); Riddlestone 
(1967,1975,1979); Engel and Wickboldt (1975); Macmfflan 
(1975,1982); HSE (1984 HS(G) 22) 

Flameproofing, explosion proofing 

Ministry of Power (n.d.a); NCB (n.d.a); SMRE (Elec. 
Hazards 2,3,7); UL (1951); IEE (1962 Conf. Publ. 3); Gelfer 
etd. (1964); Northrup (1964); Carhart (1968); House (1968a); 
Bartels (1971b, 1975b); Eastwood (1971); H. Phillips 
(1971a,b, 1972b, 1973,1984); Limn and Phillips (1973); 
Davison and Lord (1974); Fleisig (1975); Maekawa (1975); 
Sansom and Gust (1975); Maekawa,Takeichi and Kato 
(1978); Maekawa and Takeichi (1979); Shevchenko et al. 
(1982); Cleare (1991) BS 229:1957; BS 4683:1971; BS 5501: 
R 5:1977; BS 5345: R 3:1979 

Intrinsic safety 

BASEEFA (SFA 3012,1970 SFA 3004); EECS (SEA 3012); 
Ministry of Power (n.d.b); NCB (n.d.b); SMRE (Elec. 
Hazards 1,1968 Res. Rep. 256); Barlow (1963); Burgoyne 
(1965c); Hickes (1968,1969,1972); Redding (1969,1971a,b, 
1972); A.E. Turner (1969);Weismantel (1969b); Cartwright 
and Widginton (1971); Hickes and Brown (1971); 
Kheradmand-Fard (1971); Deloney (1972); Deuschle and 
Tiffany (1973); Krigman and Redding (1974); Weatherhead 
(1977); Hutcheon (1981); Calder (1982); Garside (1982); 
Bartels (1983); Bass (1984); Magison (1984); Beevers (1986); 
Tortoishell (1986); ISA (1987 RP 12.6) BS 5345: Pt 4:1977; 
BS 5501: Pt 7:1977; BS 5501: Pt 9:1982 

Purging, pressurization 

ICI/RoSPA (1972 IS/91); Ecker, James and Toensing (1974); 
Hinds (1975); Rogerson (1982); E.G. Butcher and Moss 
(1991); C. Campbell (1991—); NFPA (1998 NFPA 496) 

BS 5501: Pt 3:1977; BS 5345: Pt 5:1983 

Instrumentation 

Magison (1966,1975,1978,1984); Redding (1971a,b, 1972, 
1975); Towle (1975b); Bossert (1976); Foxboro Co. (1980); 
Hutcheon (1981); Garside (1982); Macmfflan (1982); 
Corrigan (1990) 

Portable apparatus 

EEUA (1958 Doc.4); IGasE (1970/9); UL (1992 UL 781) 
Diesels 

Lloyds Register (n.d.); HSE (1977g); ICI (1977); Oil 
Companies Materials Association (1977); BP Trading Ltd 
(1980); EEMUA (1983 Publ. 107) 

Electrical surface heating 

ICI/RoSPA (1972 IS/91); Angel (1975); Dobie, Cunningham 
and Reid (1976); UL (1990 UL 130) 

Inerting 

Hotchkiss and Weber (1953); P.A.F. White and Smith (1962); 
Funk (1963); Husa (1964); Penland (1967); Rosenberg 
(1968); H.A. Price and McAllister (1970); Kletz (1971,1984 
LPB 56); Kurz (1973); Loeb (1974); Craven (1975); Gammell 
(1976); Simon (1976); Corlett, Stone and Williams (1980); 
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Polytechnic Inst. (1980); Schwarz (1980); Depaola and 
Messina (1984); Halpern, Nyce and Wrenn (1986); Wrenn 
(1986); Tufano (1992) 

Lightning protection 

Baatz (1977); Golde (1977a, b); Gumley, Invernizzo and 
Khaled (1977); Rusck (1977); Saraoja (1977); FMEC (1987 
LPB 73); UL (1988 UL 96) 

Jet flame protection 

Ranz and Marshall (1952); Yuen and Chen (1978); van der 
Schaaf (1986); Lev (1991); Shirvill (1992) 

Fire detection and alarm 

FPA (1971/14,1989 CFSD PE 1,1991CFSD FPDG 6); FRS 
(1970 Fire Res. Note 810,1971 Fire Res. Note 899,1972 Fire 
Res. Note 932,1974 Fire Res. Symp. 6,1977 Fire Res. Note 
1063); Rasbash (1972); J.L Bryan (1974); M.J. Miller (1974); 
BRE (1975 CP 29/75, CP 32/75); Haessler (1975); NFPA 
(2003/14, 2002 NFPA 72,2001/36,1994/38); P. Nash and 
Theobald (1976a,b); Benarie (1977); R.G. Bright (1977); 
Rutstein (1979a); Anon. (1980g); Street,Williams and 
Alexander (1980); Cullis and Firth (1981); R. Phillips (1981); 
Bearman (1983); Frost (1983); R.W. Murray and O’Neill 
(1983); Scheidweiler (1983); vonTomkewitsch (1983); 
Finucane (1984 LPB 59); Gupta (1985); Gupta and 
Dharmadhikari (1985); Musselwhite (1985); O’Shea (1985); 
Todd (1985); Vaughn (1986); Atallah and Guzman (1987); 
Combley (1987); Northey (1988); Bellamy (1989); Drake 
(1989); Medlam (1990); Ramachandran (1991) 

Gas, smoke and fire detectors: BASEEFA (SFA 3007); 
SMRE (Gas Detectors 1-11); UL (Appendix 27,1985 UL 217, 
268A, 1987 UL 521,1988 UL 268); Schall (1962); R.L. Swift 
(1963); Steel (1971); FRS (1972 Fire Res. Note 938,1973 Fire 
Res. Note 957); Firth, Jones and Jones (1973,1974); HSE 
(1973 TON 45,1980 EC 3, EC 4,1987 CS1); Smith (1973); 
Steen (1973); Verdin (1973); Bossart (1974); Johanson (1974, 
1976); Allan and Schiff (1975); Associated Octel Co. (1975 
Bull. 13); Riley (1975); Anon. (19761); BRE (1976 CP 50/76); 
Dailey (1976); Herrick (1976); P. Nash and Theobald 
(1976a,b); K.N. Palmer (1976a,c);Weiby and Dickinson 
(1976); Anon. (1977h); Kletz (1977i); Gowar (1978); Kunz and 
Thalman (1978); St John (1978); Anon. (1979f,g); Bond 
(1979); H.N. Nelson (1979); Schaeffer (1980); Snee (1980); 
Cullis and Firth (1981); Mannon (1981); C. Martin (1981); 
Boccio (1982); Sonley (1982); Heitman (1983); Middleton 
(1983); Ricca (1983); Beyler (1984); Larsen (1984); British 
Gas (1986 Comm. 1298); ISA (1986 S12.13.1,1987 RP 12.13 
RII); Penny (1986); Anon. (1987m,x); EEMUA (1988 Publ. 
155); Cholin (1989a, b); Grover (1990); Mowrer (1990); NFPA 
(2002 NPFA 72); API (1991 Publ. 2031); Ishii etal. (1991); 
Okayama (1991); Ramachandran (1991); A.J. Rogers (1991); 
Smithies, Burry and Spearpoint (1991); Bjb’rkman, 
Kokkala and Ahola (1992); Buckland (1992);Varey (1992a); 
Wffley (1992); BS (Appendix 27 EN series), BS 5445:1977- 
Fire alarm: Fire Offices Committee (n.d.b); EEUA (1972 
Doc. 45D, 1975 Doc. 46D) 

Fire insulation, fireproofing 

Steverding and Nieberlein (1965); Waldman (1967); Way and 
Hilado (1968); Boult, Gamadia and Napier (1972); Boult and 
Napier (1972); Heselden,Theobald and Bedford (1972); Law 
(1972,1991); Castle (1974); Cooke (1974,1975,1988); Feldman 
(1974); Kayser (1974); McMillan (1974); Montle and Mayhan 
(1974); O’Rourke (1974); Schwab and Lawler (1974); 
Hildenbrand (1975); Rains (1975,1977); Warren and Corona 


(1975); Kbotwijk (1976); Florence (1977); Kawaller (1977, 
1980); Castle (1979); Anon. (1980 LPB 31, p. 5); Modak and 
Orloff (1980); Melinek (1989); Barry (1991); Shirvffl (1992) 
Fire resistance: SMRE (Fire 1,6); Parnell (1977); Duffy 
(1983); Corona (1984); Berhinig (1985); Buck and Belason 
(1985); Dilliberto and Gratzol (1985); Rains (1985); 
Gustaferro and Lin (1986); Castle and Castle (1987); 
Lathom, Kirby and Thomson (1987); Melinek and Thomas 
(1987); API (1988 Publ. 2218) 

Intumescent coatings, seals: O’Rourke (1974); R. James 
(1988); Gfflon (1989); Droste (1992); Hulin (1993) 

Fire water systems 

L.T. Wright (1962,1964); R. Wilson (1964a,b); FPA (1971/14, 
1988 PE 7,1989 PE 8,1990 PE 6); Orey (1972c); Sylvia 
(1972b,c);W.S. Thompson (1972,1973); FRS (1973 Fire Res. 
Note 959); Woodard (1973); R.B. Robertson (1974a,b, 

1976a,b); Unwin, Robins and Page (1974); Kfootwijk (1976); 
Theobald (1981,1984); Hodge (1985); Hodnett (1986d); 
NFPA (2002 NFPA 291, 2003 NFPA 14, 2002 NFPA 1961, 
2003 NFPA 14,2003/1962,1998/1963) 

Fire pumps: UL (1988 UL 1478; 1991 UL 1247); NFPA (1999 
NFPA 20) BS 5041:1974- BS 5306:1976-; BS 750:1984; 
BS 5908:1990 

Water sprinklers and sprays 

FPA (PE 10,1970/11,1971/14,1985 PE 13,1989 PE 9,11,12); 
Nickerson (1954); Rasbash and Rogowski (1957); Rasbash 
and Stark (1960,1962); Rasbash, Rogowski and Stark 
(1960); C.M.Wood (1961); Rasbash (1962); NFPA (1964/3, 
2001/15,1987 NFPA ISA, 2001 NFPA 15,2002/17A, 1995/18, 
2002/25,2002 NFPA 13, 2002/37, 39); Chaillot (1966); 
O’Dogherty, Nash and Young (1966); FMEC (1967); Fire 
Offices Committee (1968); Charney (1969); FRS (1971 Fire 
Res. Note 899,1972 Fire Res. Notes 914,916,1974 Fire Res. 
Note 1003); Kalelkar (1971); Association Nationale pour la 
Protection centre l’lncendie (1972); P. Nash (1972a, 1973a, 
1974a, b, 1975a,b, 1976,1990); W.S. Thompson (1972,1973); 
Arscott, Street andTwamley (1973); Bray (1973,1980); BRE 
(1975 CP 29/75, CP 42/75, CP 67/75, CP 77/75, CP 78/75, CP 
79/75,1976 CP 52/76,1977 CP 9/77); Leworthy (1975); 

P. Nash and Theobald (1976a,b, 1976 BRE CP 50/76,1988 
IP5/88); P. Nash and Young (1976);Tamanini (1976); Beyler 
(1977); FMEC (1977,1986 LPB 71); Ashfleld (1979,1993); 
Hems (1979,1983); Rieschl (1979); Anon. (1980t); Barris and 
Conte-Russian (1980); Bray (1980); Cresswell (1980); Kitson 
and Guy (1980); Nicholls (1981); R. Young (1981); Crowley 
(1982); IRI(1982); Pignato (1983); Wass (1983); Anon. 
(1984k); Angelini (1984); Watson (1984); Billinge, Moodie 
and Beckett (1986); Hodnett (1986a-c); Mullhaupt (1986); 
API (1987 Publ. 2030); Theobald (1987a,b); Murrell (1988); 
Theobald, Westley and Whitbread (1988); Thorne,Theobald 
and Melinek (1988); W.S. Wood (1988); Yao (1988); Lev and 
Strachan (1989a,b); McCaffrey (1989); Vasey (1989); Chow 
and Fong (1991); FMRC (1991); Lev (1991); Melinek (1993b); 
Jackman and Nolan (1994) 

Steam systems 

Steam curtains: Cairney and Cude (1971); Simpson (1971) 
Steam snuffing: Runes and Kaminsky (1965,1973); Muller- 
Dethlefs and Schlader (1976) 

Fire extinguishing agents and systems 

Guise and Zeratsky (1965,1982); FMEC (1967); Charney 
(1969); Hearfleld (1970); J.R. Hughes (1970); NFPA (1970/6); 
Harpur (1971); Haessler (1973); Anon. (1974d); J.L. Bryan 
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(1974); Anon. (1978 LPB 22, p. 107); Rushbrook (1979); Riley 
(1983); Fuchs (1984); HSE (1984 GS16); Webster (1984); 
Welker, Martinsen and Johnson (1986); Sharma, Lai and 
Singh (1987); Ewing et al. (1989a); Scheinson, Penner-Hahn 
and Indritz (1989); Simmonds (1993) BS 5306:1976- 
Water: Ashill (1966b); G. Clarke (1978); Corlett and 
Williams (1979); Heskestad (1980); Fritz and Jack (1983); 
Hodnett (1986a) 

Foam: Burgoyne (1949a); Burgoyne, Katan and Richardson 
(1949a); Bikerman et al. (1953); Perri (1953); Bartkowiak, 
Lambiris and Zabetakis (1959); Hird and Fippes (1960); 
Burgoyne and Steel (1962); UL (1963); Jensen (1964); 
Vervalin (1964b,d); Meldrum and Williams (1965); Ashffl 
(1966); G. Nash (1966); Hearfleld (1970); Hird, Rodrigues 
and Smith (1970); J.R. Hughes (1970); J.R.Williams (1970); 
FRS (1972 Fire Res. Note 925,1973 Fire Res. Note 980,993, 
1974 Fire Res. Note 1007); Meldrum (1972,1982); Sylvia 
(1972e); P. Nash (1973b, 1984); Corrie (1974,1977); E.M. 
Evans and Whittle (1974); Anon. (1975c); BRE (1975 CP 25/ 
75, CP 42/75,1976 CP 74/76,1978 CP15/78); Anon. (1976b); 
Burford (1976); Elliott and Chiesa (1976); MITI (1976); 
Gillespie and Dimaio (1977); Klunick (1977); P. Nash and 
Whittle (1978); Woodman et al. (1978); L.E. Brown and 
Romine (1979,1981); Chiesa (1980); Lev (1981b); Murphy 
(1981); Anon. (1983k); Boughen (1983); Dimaio and Lange 
(1984); Dimaio, Lange and Cone (1984); J.L. Evans (1985, 
1988); SKUM (1986); Lockwood (1986); Briggs and Webb 
(1988); NFPA (2002 NFPA11,1999/11A, 2003/16,1990 
NFPA11C, 2003 NFPA 16);Tabar (1989); Harker (1990); 
Waters (1990 LPB 91); M. Clarke (1992); Anon. (1993d); 
Howells (1993,1993 LPB 114) BS 5306: Pt 6:1988- 
Inert gas, including carbon dioxide: McGuire (1964); 
Atallah and Wohl (1965); Williamson (1986); Bryant (1991); 
NFPA (2000 NFPA 12) 

Solid carbon dioxide: Burgoyne, Katan and Richardson 
(1949b) 

Dry chemicals: Fire Control Engineering Co. (n.d.); Dolan 
(1957); McCamy, Shoub and Lee (1957); Lafitte and Bouchet 
(1959);T.G. Lee and Robertson (1960); UL (1963); Dewitte, 
Vrebosch and vanTiggelen (1964); Tuve (1964); Vervalin 
(1964e); Laffitte et al. (1965); Meldrum and Williams (1965); 
Anon. (1966b); WE. Wilson, O’Donovan and Fristrom (1969); 
BirchaU (1970); Dodding, Simmons and Stephens (1970); 
Emmrich (1971); Wesson (1972); Woolhouse and Sayers 
(1973); Schweinfurth (1974); Anon. (1975b); lya,Wollowitz 
and Kaskan (1975); McHale (1975); Spence and McHale 
(1975); Stauffer (1975); MITI (1976); Morikawa (1976); 
Dixon-Lewis and Simpson (1977); Russell (1977); Vanpee 
and Shirodkar (1979); Mitani (1981,1982,1983); Boughen 
(1982); Mitani and Niioka (1982); Haessler (1986); Ewing 
etal. (1989b); NFPA (2002 NFPA 17) BS 5306: Pt 7:1988 
Particulate materials: Sharma etal. (1992) 

Vaporizing liquids, halons: Burgoyne and Richardson 
(1949a); Belles and O’Neal (1957); Garner etal. (1957); 
Rasbash (1968); Homann and Poss (1972); Sylvia (1972d); 
Tatem, Gann and Carhart (1973a,b); Anon. (1974—); Hirst 
(1974a,b); NFPA (2002/13,1990 NFPA 12B, 1997 NFPA 
12A); Gann (1976); Williamson (1976); FRS (1977 Fire Res. 
Note 1073); Gann etal. (1978); P.F. Thorne (1978b,c); Wiersma 
(1978); Boughen (1979); Peterson (1979); Anon. (1981t); 
Tucker, Drysdale and Rasbash (1981); Peissard (1982); 
Westbrook (1982c); Capper (1983); Mitani (1983); C.C. Grant 
(1985); D.W Moore (1986) BS 5306: Pt 5:1982- 
Alternatives to halons, clean agents: Molina and Rowland 
(1974); Anon. (1991g); G. Taylor (1991); Senecal (1992a,b); 


B.Ward (1992); Hough (1993); McKay (1993); NFPA (2000 
NFPA 2001) 

Gels: Ishida and Iwami (1984) 

Combustible metal agents: McCormick and Schmitt (1974); 
Prokopovitsh (1986) 

Fixed equipment: Anon. (1974—); Schweinfurth (1974); 
Anon. (1975b,c); Stauffer (1975); Burford (1976); Rasbash 
(1976a); P. Nash (1977b); Boughen (1982,1983); J.L Evans 
(1985); FPA (1990 PE 6) 

Halon systems: Williamson (1976); Wiersma (1978); 
Boughen (1979); Anon. (1981t); Forrester (1982); Peissard 
(1982); C.C. Grant (1985); Hoskins (1985); R.J. Martin, 
Shepherd and Hamlin (1986); Goodall (1988); Genge (1989); 
Sreeves (1989); Whiteley (1989); Boyce (1990) 

Mobile and portable equipment: Fire Offices Committee 
(n.d.a); Guccione (1961); Lockwood (1965,1973b); BRE 
(1975 CP 82/75); P. Nash (1969,1975a, 1991); R. Russell 
(1977); M.E. Petersen (1986a,b); FPA (1988 CFSD PE 3,1990 
CFSD PE 4); NFPA (2002 NFPA 10) BS 5423:1987 
Fire points: FPA (1974 S6,1988 CFSD PE 2) 

Fire protection of particular activities, equipment 
Air compressors: Duguid (1965) 

Bin storage: Field and Murrell (1988) 

Cables: IRI (1965/6); F.E. Baker and Shepherd (1971); 
Kirkham (1987); Annemaier and Graf (1988); Woolhead 
(1989,1990) 

Computers: IRI (1971/8); Bray (1973); Pucill (1973); 
Mottershead (1977); NFPA (2003 NFC 75) 

Control systems: Castle (1984) 

Crushing and grinding equipment: FPA (CFSD FS 6033) 
Dip tanks, heat treatment baths: HSE (1971HSW Bklt 27); 
Orey (1972b); FPA (1974 S8) 

Documentation, records: FPA (1974 S7); NFPA (2000 NFPA 
232) 

Drum stores: Delichatsios (1982); Mikloucich and Noronha 
(1982); Rogerson (1982); Capizzani (1985) 

Electrical equipment: FPA (1968/6,1974/25,1990 CFSD 
FS 6014); NFPA (2002 NFPA 70B, 2002 NFPA 79, 2002 
NFPA 70) 

Gas and vacuum systems: NFPA (1993 NFPA 99C) 

Heat transfer systems: Fuhr (1992) 

Hydraulic oil systems: FPA (1976 CFSD FS 6016) 
Incinerators : FPA (S3,1987 CFSD GP 9) 

Oil burners: FPA (1989 CFSD FS 6042) 

Pilot plants: Capraro and Strickland (1989) 

Pneumatic conveying: NFPA (1990 NFPA 650) 

Power stations: NFPA (2000 NFPA 850) 

Reciprocating compressors: FPA (CFSD FS 6034) 

Valves: Arant (1981); Choquette (1984); Symalla (1984); 
Varey (1988) 

Turbines: NFPA (2002 NFPA 37) 

Vaporizers: Bowman and Perkins (1990) 

Vessels and tanks: Pettit (1945); Hird, Rodrigues and Smith 
(1970); Kletz (1971,1974e, 1975d, 1977d,k, 1986g); Bray 
(1964,1966); Thomas and Law (1965 FRS Fire Res. Note 
609); Anon. (1966d); Chaillot (1966); FPA (1966); Warren 
(1966); Hearfield (1970); J.R. Hughes (1970); ICI/RoSPA 
(1970IS/74); Vervalin (1973f); van Eijndhoven, 
Nieuwenhuizen and Wally (1974); Nash and Young (1975 
BRE CP 42/75); Kaefer (1977); Peyton (1984); Smith (1984); 
I. Williams (1984); B.M. Lee (1989); Droste (1992); Meiers 
and Jarman (1993); M. Wilson (1993) 

Construction activities: NFPA (2000 NFPA 241) 

Transport: NFPA (Appendix 27,1973/10); Fitch (1986); 
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Keller, Kerlin and Loeser (1986); McGinley (1986) 

Jetties: Dicker and Ramsey (1983) 

Waste disposal activities: FPA (1971/15) 

Oxygen enriched atmospheres 

HSE (1984 HSE 8); NFPA (1999 NFPA 53) 

Fire security, arson prevention 

FPA (CFSDAR, MR, SEC series, 1972/16,19,1989 CFSD OR 
7); NFPA (1986 NFPA 602,2000 NFPA 601) 

Fire fighting 

FPA (CFDS FPDG 5); Rasbash and Stark (1960); Risinger 
(1964b,c,e-g); Zeratsky (1964); O’Dogherty (1965); NFPA 
(1966-/4,1972/8,2002/11, 2003/16,1995/18); Guise (1967, 
1975,1976); Methner (1968); Home Office (1972/9,1974- 
Manual ofFiremanship, 1974/10); HSE (1970 HSW Bklt 10); 
J.R. Hughes (1970); Rawill (1971); Stark (1972,1976); Sylvia 
(1972b); W.E. Clark (1974); PLTB (1975/6); Clayton (1976); 
Hodnick (1976); Lawson and Rasbash (1976); Brennan and 
Stow (1977); Austin (1979); Ishida and Iwama (1984); 

P.F. Johnson (1986); Hem and Saunders (1986); Purington 
(1986); Rosenhah (1986); P.O. Davis and Dotson (1987); 
Nazario (1988); E. Meyer (1989); Gore, Evans and 
McCaffrey (1991); A. Evans (1994) BS (Appendix 27 Fire 
Protection, Hoses and Hose Couplings), BS 5041:1974-; 

BS 5274:1985; BS 3165:1986; BS 3169:1986; BS 336:1989 
Liquid fires: Rasbash and Rogowski (1957); Rasbash 
(1960); Rasbash and Stark (1960,1962); Sylvia (1972b,e); P. 
Nash (1973b, 1974b); Corrie (1974); Capper (1985) 

Dilution of water-soluble liquids: Thorne (1978a) 

LNG fires: Petersen, Morizumi and Carpenter (1968); 
Welker, Wesson and Sliepcevich (1969); Welker and 
Sliepcevich (1970); Walls (1971,1973); Wesson, Welker and 
Brown (1972,1975); Wesson et al. (1973a,b); Welker, Wesson 
and Brown (1974); Guise (1975,1976); H.H.West, Brown and 
Welker (1975); Bellus, Vincent et al. (1977); Wesson and 
Associates (1977); L.E. Brown and Romine (1979,1981); 
Boughen (1980); Lev (1981a, b); Lee (1989) 

LPG fires: Martinsen (1982); Williams (1984); Blomquist 
(1988); B.M. Lee (1989) 

Tank fires: Risinger (1964b,f,g); J.R. Hughes (1970); 
Stillman (1971); E.M. Evans and Whittle (1974); Herzog 
(1974,1979); Mahley (1975); NFPA (2003/16); P. Nash and 
Whittle (1978); Kletz (1982 LPB 47); B.M. Lee (1989); API 
(1991 Publ. 2021) 

Metal, metal powder fires: Reuillon etal. (1977); NFPA (2002 
NFPA 484); Sharma, Lai and Singh (1987); Varshney, Kumar 
and Sharma (1990); Cardillo and Nebuloni (1992); Sharma, 
Varshney and Kumar (1993) 

Sulfur fires: NFPA (2001 NFPA 655) 

Wood fires: Tamanini (1976) 

Transport fires: W.Ward (1978); Home Office (1985, Manual 
ofFiremanship Bk 4) 

Water curtains: Rielsch (1979); Stephenson and Coward 
(1987); Maini and Stephenson (1989); Coppalle, Nedel and 
Bauer (1993) 

Thermal image aids: Blatte (1985);Trcliving (1985) 

Fire fighting hazards: OSHA (n.d./l); Lathrop (1977) 

Gas cylinders: CGA (1990 SB-4) 

Breathing apparatus: NFPA (2002 NFPA 1404) 

Protective clothing: Abbott and Schulman (1976); Holcombe 
(1981); Anon. (1982/83); NFPA (1951/2001,1971/2000,1976/ 
2000,1977/1998,1994/2001,1999/2003) BS (Appendix 27 
Personal Protection), BS 1547:1969; BS 3791:1970; BS 4667: 
1974- 


Radiation control: NFPA (1960/2) 

Smokehoods: B. Brown (1989) 

Fire services (see also Table 24.1) 

Home Office (1974- Manual ofFiremanship)-, FPA (1988 
CFSD OR 2,1990 CFSD OR 1) 

Fire communications: NFPA (1221/2002) 

Occupational fire services: FPA (CFSD MR 11,1989 CFSD 
MR 14) 

Human behaviour in fires 

Wood (1972 FRS Fire Res. Note 953); J.L Bryan (1976,1978); 
Carmack (1976); Canter (1980,1980/81); Jin (1981); Ikeda 
(1982); Keating (1982);Tong (1983); Wardlaw (1983); Paulsen 
(1984); BRE (1985 BR 61, IP20/85); E.G. Butcher (1985); 
Ramachandran (1990a) 

Fire response, evacuation 

J.M. Watts (1987); FPA (1990 CFSD MR 7); NFPA (1990 
NFPA 902M, 2002/1561,2002 NFPA 471-473) 

Fire training 

FPA (CFSD M10,1974/23,1987 CFSD M12,1989 CFSD M 9); 
API (1966); B. Martin (1966); NFPA (1968/5,2000 NFPA 
1410); Anon. (1973b); Bruce and Diggle (1974); Long (1975); 
PITB (1975/6); Vervalin (1975d,e); N. Anderson (1991) 

Fire inspection, checklists 

Landy (1964a-c); FPA (1965/3); API (1971 Refinery 
Inspection Guide Ch. 20); NFPA (1994/41) 



Figure 16.1 The fire triangle 


combustible gas or vapour mixture burns if it is heated to a 
sufficiently high temperature. 

Thus there are three conditions essential for a fire: 
(1) fuel, (2) oxygen and (3) heat. These three conditions are 
often represented as the fire triangle shown in Figure 16.1. 
If one of the conditions is missing, fire does not occur; if one 
of them is removed, fire is extinguished. 

Normally, the heat required is initially supplied by an 
external source and then provided by the combustion pro¬ 
cess itself. The amount of heat needed to cause ignition 
depends on the form of the substance. A gas or vapour may 
be ignited by a spark or small flame, while a solid may 
require a more intense heat source. 

Ignition of a combustible gas or vapour mixture may 
occur in two ways. In the first, the energy for ignition is 
supplied by a local source such as a spark or small flame at 
a point within the mixture, as shown in Figure 16.2(a). In 
the second, the bulk gas mixture is heated up to its ignition 
temperature, as shown in Figure 16.2 (b). 
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Figure 16.2 Ignition of a flammable mixture: (a) local 
ignition and (b) bulk gas ignition 


The three conditions of the fire triangle indicate how 
fires may be fought. The first method is to cut off the fuel. 
This is particularly relevant for fires caused by leaks at a 
process plant. The second method is to remove heat. Put¬ 
ting water on the fire usually does this. The third method is 
to stop the supply of oxygen. This may be affected in var¬ 
ious ways, including the use of foam or inert gas. 

Fire is sustained only if there is a net release of heat. The 
heat comes from the combustion of fuel. If this fuel is liquid 
or solid, it must first be vaporized. With liquids or solids, 
fire usually involves a process of positive feedback. The 
heat evolved by the fire causes the vaporization of an 
increasing amount of fuel and the fire spreads. 

Development of the fire depends on the situation of the 
fuel. This is commonly illustrated by considering the dif¬ 
ference in modes of burning of a lighted match held 
upwards or downwards. Thus, the stacking of material in 
closely spaced vertical piles in a warehouse may tend to 
encourage fire spread. 

Fire needs to be supported by the ignition source until it 
is self-sustaining. For this, duration may be more important 
than temperature. Thermite bombs, which reach about 
1650°C for 15-20 s, have been found less effective in start¬ 
ing fires than napalm, which reaches about 1100°C for 
10-15 min. 

Different parts of a fire have different heat balances. In 
some parts, particularly near the edge of the fire, the heat 
balance may be only just positive. It is sometimes good 
sense, therefore, to direct fire extinguishant to those parts 
of the fire and attack it at its weakest points. 

It is not necessarily essential to remove all the oxygen in 
order to extinguish a fire. Reducing the oxygen concentra¬ 
tion below 12—16% can generally put out liquid fires. 
Solids fires may require a greater reduction of oxygen 


concentration - below about 5% for surface smoldering 
and as low as about 2 % for deep-seated smoldering. 

16.1.2 Fire growth and spread 

Fire normally grows and spreads by direct burning, which 
results from impingement of the flame on combustible 
materials, by heat transfer or by travel of the burning 
material. 

The three main modes of heat transfer are (1) conduction, 
(2) convection and (3) radiation. All these modes are sig¬ 
nificant in heat transfer from fires. Conduction is impor¬ 
tant particularly in allowing heat to pass through a solid 
barrier and ignite material on the other side. 

Most of the heat transfer from fires, however, is by con¬ 
vection and radiation. It is estimated that in most fires, 
some 75% of the heat emanates by convection. The hot 
products of combustion rising from a fire typically have a 
temperature in the range of 800—1200°C and a density a 
quarter that of air. On open plant much of the heat is dis¬ 
sipated into the atmosphere, but in buildings it is trans¬ 
ferred to the ceiling. 

Radiation is the other main mode of heat transfer. 
Although it usually accounts for a smaller proportion of the 
heat issuing from the fire, radiated heat is transferred 
directly to nearby objects, does not go preferentially 
upwards and crosses open spaces. For these reasons it is 
generally the most significant mode of transfer on open 
plant. 

An account of the modes of heat transfer is given in Heat 
Transfer in Fire (Blackshear, 1974). Radiant heat transfer is 
treated in Thermal Radiation Heat Transfer (Siegel and 
Howell, 1991). 

The other way in which fire spreads is by travel of bulk 
materials, such as burning liquids or solid brands. With 
fires in buildings particularly, a stage is generally reached 
when the materials have been heated up to the point where 
they produce flammable vapours. The rapid spread of fire 
which occurs at this point is called ‘flashover’. 

16.1.3 Classification of fires 

There are several classification systems for fires. In the 
United Kingdom, the BS classification is given in BS EN2: 
1992 Classification of Fires. This classification is: 

Class A Fires involving solid materials, usually of an 
organic nature, in which combustion takes 
place with the formation of glowing embers. 
Class B Fires involving liquids or liquefiable solids. 
Class C Fires involving gases. 

Class D Fires involving metals. 

BS EN2:1992 replaces BS 4547:1972. 

In the United states, the NFPA classification is given in 
the NFPA Codes. NFPA 10: 2002 contains the following 
classification: 

Class A Fires in ordinary combustible materials, such as 
wood, cloth, paper, rubber and many plastics 
Class B Fires in flammable or combustible liquids, oils, 
greases, tars, oil-based paints, solvents, lacquers, 
alcohols and flammable gases. 

Class C Fires that involve energized electrical equipment. 
Class D Fires in combustible metals, such as magnesium, 
titanium, zirconium, sodium, lithium and 
potassium. 
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Class K Fires in cooking appliances that involve combus¬ 
tible cooking media (vegetable or animal oils 
and fats). 

This classification has obvious relevance to the extin¬ 
guishing medium to be used. For a Class C fire, when 
electrical equipment is de-energized, extinguishers for 
Class A and B fires may be used. 

Fires are also classified by size. The classification 
recommended by the Central Fire Brigades Advisory 
Council and given in the Manual of Firemanship by the 
Home Office (1974-) is: 


Vapours (Zabetakis, 1965 BM Bull. 627). A further 
description of flammability characteristics is given by 
Burgoyne (1965a). Flammability data are also given in the 
Handbook of Industrial Loss Prevention (FMEC, 1967) and 
the ICI Electrical Installations in Flammable Atmospheres 
Code (ICI/RoSPA, 1972IS/91). 

The discussion of flammability characteristics given 
below assumes, unless otherwise stated, that the flam¬ 
mable gas mixture is with air and that the pressure and 
temperature conditions are the initial values. Selected 
references on flammability and ignition characteristics are 
given in Table 16.3. 


Major fire 
Large fire 
Medium fire 
Small fire 
Minor fire 


>20 jets 
8-19 jets 
3-7 jets 

1-2 jets, or >3 hose reels 

1-2 hose reels, or hand extinguishers 


The classifications of combustible and flammable liquids 
given in Chapter 10 are also relevant. 


16.1.4 Classification of fires: process industries 

With regard to fires in the process industries specifically, 
fires may be classified broadly into the following 
categories: 


(1) vapour cloud fires 

(a) fires with no explosion, 

(b) fires resulting from explosion, 

(c) fires resulting in explosion; 

(2) fireballs; 

(3) jet flames; 

(4) liquid fires 

(a) pool fires, 

(b) running liquid fires; 

(5) solids fires 

(a) fires of solid materials, 

(b) dust fires; 

(6) warehouse fires; 

(7) fires associated with oxygen. 


Many major fires are vapour cloud fires. It is convenient 
to term the three categories of vapour cloud fire, or flash 
fire, as 

Type 1 Fires with no explosion. 

Type 2 Fires resulting from explosions. 

Type 3 Fires resulting in explosions. 


16.2 Flammability of Gases and Vapours 

Combustion of a flammable gas-air mixture occurs if the 
composition of the mixture lies in the flammable range and 
the conditions exist for ignition. As already mentioned, 
ignition may result from either (1) bulk gas temperature 
rise or (2) local ignition. 

The combustion of the mixture occurs if the bulk gas is 
heated up to its auto-ignition temperature (AIT) Alter¬ 
natively, combustion occurs if there is a source of ignition 
that has sufficient energy to ignite the applied mixture. 

Accounts of flammability characteristics and collections 
of flammability data are given in Limits of Flammability of 
Gases and Vapours (Coward and Jones, 1952 BM Bull. 503) 
and Flammability Characteristics of Combustible Gases and 


16.2.1 Flammability limits 

A flammable gas burns in air only over a limited range of 
composition. Below a certain concentration of the flam¬ 
mable gas, the lower flammability limit (LFL), the mixture 
is too ‘lean’; while above a certain concentration, the upper 

Table 16.3 Selected references on flammability and 
ignition characteristics 


SMRE (Fire 3); Factory Mutual Insurance Co. (1940); NFPA 
(1972/9,2000 NFPA 30,2001/704,1991 NFPA 49,325M, 
491M, 1991/27); FPA (1974/22); Cruice (1986); Gerlach 
(1987); Bond (1991) BS (Appendix 27 Test Methods) 

Flammability 

Affens (1968); Affens, Carhart and McLaren (1977); Bajpai 
(1980) 

Flammability limits 

Mallard and Le Chatelier (1883); Le Chatelier (1891); Le 
Chatelier and Boudouard (1898); Burgess and Wheeler 
(1911); Coward and Brinsley (1914); A.G.White (1922,1924); 
G.W. Jones (1928,1937,1938); Goldmann (1929); G.W Jones 
et al. (1935 BM RI3278); Hsieh and Townend (1939b); 
Zeldovich (1941); Drozdov and Zeldovich (1943); G.W. Jones 
etal. (1945 BM RI 3826); Burgoyne (1948,1949a); Egerton 
and Fowling (1948); Matson and Dufour (1950); UL (1950); 
Fenn (1951); B. Lewis and von Elbe (1951,1961,1987); 
Zabetakis, Scott and Jones (1951); Coward and Jones (1952 
BM Bull. 503); Egerton and Thabet (1952); Spakowski 
(1952); Burgoyne and Neale (1953a,b); Egerton (1953); 
Simon, Belles and Spakowski (1953); Zabetakis and Jones 
(1953); Zabetakis and Richmond (1953); Burgoyne and 
Hirsch (1954); Umland (1954); J.A. Browning and Krall 
(1955); Wolfson and Dunn (1956); Delbourgo and Laffitte 
(1957); Linnett and Simpson (1957); Meyer (1957); Spalding 
(1957d); Dalmai (1958); Dixon-Lewis and Isles (1959,1961); 
Zabetakis, Lambiris and Scott (1959); Bartkowiak and 
Zabetakis (1960 BM RI 5610); Berlad (1961); Kuchta etal. 
(1961 BM RI 5877); Monger, Sello and Lehwalder (1961); 
K.N. Palmer and Tonkin (1961); Buckley and Husa (1962); 
Kuchta, Lambiris and Zabetakis (1962 BM RI 5992); Pusch 
and Wagner (1962); vanTiggelen and Burger (1964); G.S. 
Scott (1965 BM RI 6659); Zabetakis (1965 BM Bull. 627); 
Craven and Foster (1966); FMEC (1967); D.J. Miller and 
Webb (1967); Prugh (1967); Yang and Gray (1967); Kuchta 
etal. (1968); Burgess (1969);WB. Howard (1970a); 
Rozlovsky (1970); Furno et al. (1971); Lovachev (1971,1979); 
Lu, Dabora and Nicholls (1971); Steen (1971,1974); Grove, 
Patel and Webster (1972); Homann and Poss (1972); 
Andrews and Bradley (1973b); Gerstein and Stine (1973); 
Halstead, Prothero and Quinn (1973); Lovachev etal. (1973); 
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Tien (1973); Halstead, Pye and Quinn (1974); Burgess and 
Hertzberg (1975); Sorenson, Savage and Strehlow (1975); 
Hertzberg (1976 BM RI8127); Meadows (1976); Crescitelli 
etal. (1977); G.F.P. Harris and MacDermott (1977); Hilado 
and Cumming (1977,1979); Viallon (1977); FPA (1978 Fire 
Res. Note 1078); Jarosinski and Strehlow (1978); Nettleton 
(1978a, 1979,1980b); D.C. Bull (1979); Macek (1979); 
Yamaoka andTsuji (1979); Ale, Burning and Koenders 
(1980); Mitani (1980); P. Roberts, Smith and Ward (1980); 
Buckmaster and Mikolaitis (1982); Crescitelli etal. (1982); 
Hertzberg (1982,1985); Zalosh (1982); Kanury (1983); von 
Lavante and Strehlow (1983); Palazzi etal. (1984); ASTM 
(1985 E681); Peters and Smooke (1985); M.S. High (1987); 
Hustad and Sonju (1988); Kletz (1988a); Tarn and Ludford 
(1988); Wierzba, Karim and Cheng (1988); Wierzba, Harris 
and Karim (1990); Ishizuka (1991); Lakshimisha, Paul and 
Mukunda (1991); Law and Egolfopoulos (1991,1992); 
Seaton (1991); Conrad et al. (1992); Hansel, Mitchell and 
Klotz (1992); Gibbon, Wainwright and Rogers (1994) 

Effect of diluents: Burgoyne and Williams-Leir (1948a,b); 
Egerton (1953); Mellish and Linnett (1953); Atalla and Wohl 
(1965); Zabetakis (1965 BM Bull. 627); Hirst and Booth 
(1977); Crescitelli, Russo and Tufano (1979b); Mitani (1981); 
Hirst and Savage (1981/82); P. Roberts and Smith (1983); 
Plett (1984); Lihou (1993) 

Oxygen concentration: Denison etal. (1968); Huggett (1973); 
Nguyen and Branch (1987); Subramanian and Cangelosi 
(1989) 

Oxygen-enriched atmospheres: ASTM (1983 STP 812); HSE 
(1984 HSE 8); NFPA (1990 NFPA 53M) 

Flammability of mists 

Burgoyne (1949b, 1963); Burgoyne and Cohen (1954); 

J.A. Browning and Krall (1955); Hayashi etal. (1981) 

Flammability of liquids 

Burgoyone and Williams-Leir (1949); Anon. (1973c); Steen 
(1974) 

Flashpoint, fire point 

FRS (Fire Res. Note 1022); BDH (1962); Johnston (1974); 
Lenoir (1975); Li and Moore (1977); Lance, Barnard and 
Hooyman (1979); Loader (1981); Kanury (1983); ASTM 
(1984 E502,1990 D92, D93); Riazi and Daubert (1987); 
Nakano, Hirai and Hayashi (1990); Bothe and Brandes 
(1992) BS 6664:1986-; BS 2000: Pt 35:1993 
Vapour pressure: T.E. Jordan (1954) 

Autoignition temperature, spontaneous ignition 
temperature 

Townend and Madelkar (1933); Le Chatelier (1937); Silver 
(1937); Matson and Dufour (1950); UL (1950); J.L Jackson 
(1951); Coward and Jones (1952 BM Bull. 503); Setchkin 
(1954); Zabetakis, Furno and Jones (1954); Riddlestone 
(1958);Vanpee and Wolfhard (1959); Affens, Johnson and 
Carhart (1961); Zabetakis, Scott and Kennedy (1962 BM RI 
6112); Kuchta, Cato and Zabetakis (1964); Kuchta, 
Bartkowiak and Zabetakis (1965 BM RI 6654); J.A. 
MacDonald and White (1965); Ashmore and Preston (1967); 
FMEC (1967); B.F. Gray (1970); Hilado and Clark (1972a,b); 
Affens and Carhart (1974); Beerbouwer (1974); Santon 
(1976); Halstead, Kirsch and Quinn (1977); Stull (1977); 

D.J. Lewis (1980a); Cudahy and Troxler (1983); FPA (1984 
CFSD NB 5); C. Robinson and Smith (1984); Ashmore and 
Blumson (1987 LPB 75); Snee (1988 LPB 81); Conti and 
Hertzberg (1989); Oberhagemann and Schecker (1989); 
S.M. Richardson, Saville and Griffiths (1990); J.F. Griffiths 


et al. (1991); Egolf and Jure (1992); J.F. Griffiths et al. (1992); 
Lakshimisha et al. (1992); J.F. Griffiths (1993); J.F. Griffiths, 
Halford-Maw and Rose (1993) 

Liquid ignition temperature 

N.J. Thompson (1929); Setchkin (1954); Malychuk and 
Gollahalli (1987) 

Ignition energy 

Blanc etal. (1947,1949); Fenn (1951); Swett (1955,1956, 
1957); Brokaw and Gerstein (1957); Riddlestone (1957); 
Litchfield (1960 BM RI 5671); Ashman and Buchler (1961); 
Rae, Singh and Danson (1964); Slack and Woodhead (1966); 
FMEC (1967); Bartels and Howes (1971); de Soete (1971); 
Moorhouse, Williams and Maddison (1974); Ballal and 
Lefebvre (1975b); Bartels (1975a); Rao and Lefebvre (1976); 
Halm (1979); CMI (1980 CMI803301-1); H. Kramer (1987); 
Sloane and Schoene (1989); Frendi and Sibulkin (1990); 
Glor and Siwek (1992); Chin-ShuWang and Sibulkin (1993) 

Burning velocity 

Gouy (1879); Payman and Wheeler (1922); Fiock and 
Marvin (1937a,b); Zeldovitch and Frank-Kamenetsky 
(1938); Fiock etal. (1940);Tanford (1947);Tanford and Pease 
(1947); Culshaw and Garside (1949); M.E. Harris etal. 
(1949); Linnett and Hoare (1949,1951); Strickland- 
Constable (1949); Gerstein, Levine and Wong (1950); 
Coward and Jones (1952 BM Bull. 503); Dugger and Simon 
(1953); Linnett (1953); Manton, von Elbe and Lewis (1953); 
Egerton and Lefebvre (1954); J.A. Browning and Krall 
(1955); Bundy and Strong (1955); Fiock (1955); D.G. Martin 
(1956); Spalding (1956,1957a-c); Brokaw and Gerstein 
(1957); Gilbert (1957); Golovina and Fyodorov (1957); D. 
Smith and Agnew (1957); Eschenbach and Agnew (1958); 
Gibbs and Calcote (1959); O’Donovan and Rallis (1959); 
Schotte andVaags (1959a,b); Spalding and Yumlu (1959); 
Strauss and Edse (1959); Agnew and Graiff (1961); Raezer 
(1961); Yang (1961); Dugger (1962); Kuehl (1962); Raezer and 
Olsen (1962); Rallis, Garforth and Steinz (1965); Andrews 
and Gray (1964); Armitage and Gray (1965); Lefebvre and 
Reid (1966); Yumlu (1967a,b, 1968); Fells and Rutherford 
(1969); Palm-Leis and Strehlow (1969); Edmondson and 
Heap (1970,1971); D. Bradley and Hundy (1971); S.B. Reed 
(1971); Spalding, Stephenson and Taylor (1971); Andrews 
and Bradley (1972a,b, 1973a); Peschel and Fetting (1972); 
Simmons and Wright (1972); Halstead, Prothero and Quinn 
(1973); P.L Stephenson and Taylor (1973); Halstead, Pye and 
Quinn (1974); Nair and Gupta (1974); Putnam (1974); Muller- 
Dethlefs and Schlader (1976); Garforth and Rallis (1978); 
Sriramulu, Padiyar and Shet (1978); Putnam, Ball and Levy 
(1980); Agrawal (1981); Dixon-Lewis and Islam (1982); 
Gulder (1982); Liu and MacFarlane (1983); Tufano, 
Crescitelli and Russo (1983); Ronney and Wachman (1985); 
Yamaoka and Tsuji (1985); Lijima and Takeno (1986); Yu, 
Law and Wu (1986); P.G. Hill and Hung (1988); Gottgens, 
Mauss and Peters (1992); Sher and Ozdor (1992); Koroll, 
Kumar and Bowles (1993) Turbulent burning velocity: 
Damkb’hler (1940); Shchelkin (1943); Bellinger and 
Williams (1949); D.T.Williams and Bellinger (1949); 
Karlovitz, Denniston and Wells (1951); Wohl etal. (1953); 
Wohl (1955); Wohl and Shore (1955); J.M. Richardson (1956); 
Richmond, Singer et al. (1957); Fine (1958); Shetinkov 
(1959); Kozachenko (1962); Lefebvre and Reid (1966); 
Vinckier and vanTiggelen (1968); Palm-Leis and Strehlow 
(1969); Sanematsu (1969a,b); Annand (1970); Bhaduri 
(1970); Mizutani (1972); Andrews, Bradley and 
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Lwakabamba (1975a,b); Abdel-Gayed and Bradley (1977, 
1982); Gokalp (1980); Abdel-Gayed, Bradley and Lawes 
(1987); Sivashinsky (1988); Liu and Lenze (1989); Catlin 
and Linstedt (1991); D. Bradley, Lau and Lawes (1992); 

D. Bradley, Gaskell and Gu (1994) 

Quenching 

Blanc etal. (1947); R. Friedman (1949); M.E. Harris etal. 
(1949);Wohl (1953); Loison, Chaineaux and Delclaux (1954); 
Berlad and Potter (1955); Brokaw and Gerstein (1957); 
Potter and Berlad (1957); Singer and von Elbe (1957); 
Anagnostou and Potter (1959); Wolfhard and Bruszak (1959 
BM RI5457,1960); Potter (1960); Pusch and Wagner (1962); 
Kydd and Foss (1964); Grove (1966,1967); Rosser, Inami 
and Wise (1966); H. Phillips (1971a, b, 1981a); Rozlovski and 
Zakaznov (1971); E.C.Woodward and Drew (1971); FRS 
(1973 Fire Res. Notes 973,990,1974 Fire Res. Note 1018); 
Lunn and Phillips (1973); Nair and Gupta (1973); Ryason 
and Hirsch (1974); Ballal and Lefebvre (1975a, 1977,1978, 
1979); Maekawa (1975); Buckmaster (1976); F. A. Williams 
(1976b); Jarosinski and Strehlow (1978); Maekawa,Takeichi 
and Kato (1978); Maekawa and Takeichi (1979); Strehlow, 
Nichols etal. (1979); P. Roberts, Smith and Ward (1980); 
Chomiak and Jarosinski (1982); Lunn (1982a,b, 1984a); 
Jarosinski (1983); Dickie and Lunn (1984); Mendoza, 
Smolensky and Straitz (1993) 

Calorific value 

FMEC (1967); Association Nationale pour la Protection 
centre l’Incendie (1972) 

Flame temperature 

Loomis and Perrott (1928); G.W. Jones, Lewis and Seaman 
(1931,1932); G.W. Jones et al. (1931); Ministry of Power 
(1944); Fehling and Leser (1949); Winternitz (1949); Huff, 
Gordon and Morrell (1951); B. Lewis and von Elbe (1951, 
1961,1987);Thring (1952); Gaydon and Wolfhard (1953); 
Bundy and Strong (1955); General Electric Co. (1955); 
Kaskan (1957); Zabetakis, Lambiris and Scott (1959); 
Berenblut and Downes (1960); Gay etal. (1961); Zeleznik 
and Gordon (1968); Gordon and McBride (1971,1976); Stall 
and Prophet (1971); Svehla and McBride (1973); Eisenberg, 
Lynch and Breeding (1975); J.G. Marshall and Rutledge 
(1982); Vancini (1982); Chang and Rhee (1983); Rhee and 
Chang (1985) 

Gas specific heats: W.D.M. Bryant (1933); Spencer and 
Justice (1934); Justi and Liider (1935); Justi (1938); Spencer 
and Flannagan (1942); Dodge (1944); Spencer (1945); 
Hougen and Watson (1947); Prothero (1969); Vancini (1982); 
Barnard and Bradley (1985); Yaws, Ni and Chang (1988) 

Mists and sprays 

Haber and Wolff (1923); Burgoyne (1963); Mizutani (1972b); 
Mizutani and Nishimoto (1972); J.T. Bryant (1975); SJ. 
Cook, Cullis and Good (1977); Hayashi, Kumagai and Sakai 
(1977); Nettleton (1978a, 1987); Ballal (1983a,b) 

Thermodynamic properties (see also Table 11.1) 

Westenberg (1957); M.K. Martin and Hey wood (1977) 


flammability limit (UFL), it is too ‘rich’. The concentrations 
between these limits constitute the flammable range. The 
LFLs and UFLs are also sometimes called, respectively, the 
lower and upper explosive limits (LELs and UELs). They 
are distinct from the detonability limits. 


In general, the most flammable mixture corresponds 
approximately, but not exactly, to the stoichiometric mix¬ 
ture for combustion. It is frequently found that the con¬ 
centrations at the LFLs and UFLs are roughly one-half and 
twice that of the stoichiometric mixture, respectively 

Flammability limits are affected by pressure, tempera¬ 
ture, direction of flame propagation, gravitational field and 
surroundings. The limits are determined experimentally 
and the precise values obtained depend, therefore, on the 
particular test method. 

Although there is no universally used equipment, one 
which has been utilized for the measurement of many 
flammability limit data is the BM apparatus, which is 
described by Coward and Jones (1952 BM Bull. 503) and 
which consists of a cylindrical tube 5 cm diameter and 1.5 m 
high. The tube is closed at the top but open at the bottom. 
Gas-air mixtures of different compositions are placed in 
the tube and a small ignition source is applied at the bot¬ 
tom. The lower and upper limit concentrations at which the 
flame initiated by the source of ignition just travels the full 
length of the tube are then determined. 

The test is normally carried out with the mixture at 
atmospheric pressure and temperature and with upward 
flame propagation, but other conditions can be investi¬ 
gated such as different pressures and temperatures, 
downward flame propagation and/or addition of inert 
gases. Table 16.4 shows flammability limits of selected 
substances. It also gives other flammability characteristics 
that are described below. 

For many organic substances the LFL, expressed in mass 
per unit volume, lies within a relatively narrow range. 
Burgoyne (1963) quotes data that show the limits as lying 
mainly in the range 0.04-0.10 g/1 (or oz/ft 3 ). More specifi¬ 
cally, he states that for saturated hydrocarbons the LFL 
is of the order of 0.045 g/1 (oz/ft 3 ). For unsaturated hydro¬ 
carbons it is less and for oxygenated hydrocarbons it 

Flammability limits are affected by pressure. Normal 
variations of atmospheric pressure do not have any appre¬ 
ciable effect on flammability limits. The effect of larger 
pressure changes is not simple or uniform, but is specific to 
each mixture. A decrease in pressure below atmospheric 
can narrow the flammable range by raising the LFL and 
reducing the UFL until the two limits coincide and the 
mixture becomes non-flammable. This effect is illustrated 
for methane in Figure 16.3. 

Conversely, an increase in pressure above atmospheric 
can widen the flammable range by reducing the LFL and 
raising the UFL. This effect is shown in Figure 16.4 for 
natural gas. It may be noted that the effect is more marked 
on the upper than on the LFL. In the case of higher hydro¬ 
carbons, increase in pressure causes an abnormal increase 
in the UFL with the creation of a region of cool flames 
(Hsieh and Townend, 1939b). Cool flames are considered 
further below. However, an increase in pressure does not 
always widen the flammable range; in some cases it can 
narrow it. 

Flammability limits are also affected by temperature. An 
increase in temperature tends to widen the flammable 
range. This effect is shown for methane in Figure 16.5. The 
variation of the LFL of methane with temperature is illu¬ 
strated in Figure 16.6. The limit values obtained experi¬ 
mentally fall fairly close to a straight line that passes 
through the lower limit at 25°C and through zero at the 
flame temperature of 1225°C. 
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Table 16.4 Flammability limits, AITs and flashpoints of selected substances in 

air at atmospheric pressure 



Flammability limit 
(% v/v) 

Auto-ignition 
temperature (°C) 

Flashpoint (° C) 

Lower 

Upper 

Closed cup 

Open cup 

Acetone 

2.6 

13 

465 

-18 

-9 

Acetylene 

2.5 

100 

305 

- 

- 

Ammonia 

15 

28 

651 a 

- 

- 

Benzene 

1.4 a 

8.0 a 

562 a 

-11 

- 

-Butane 

1.8 

8.4 

405 

-60 

- 

Carbon disulfide 

1.3 

50 

90 

-30 

- 

Cabon monoxide 

12.5 

74 




Cyclohexane 

1.3 

7.8 

245 

-20 

- 

Ethane 

3.0 

12.4 

515 

-135 

— 

Ethylene 

2.7 

36 

490 

-121 

- 

Ethylene dichloride 

6.2 a 

15.9 a 

413 a 

13 

18 

Ethylene oxide 

3 a 

100 a 

429 a 

— 

-20 

Hydrogen 

4.0 

75 

400 

- 

- 

Methane 

5.0 

15.0 

540 

- 

— 

Propane 

2.1 

9.5 

450 

<-104 

- 

Propylene 

2.4 

11 

460 

-108 

- 

Styrene 

l.l a 

6.1 a 

490 a 

32 

38 

Toluene 

1.3“ 

7.0 a 

536 a 

4 

7 

Vinyl chloride 

4 a 

22 a 

472 a 

- 

-78 


Sources: Flammability limits: Zabetakis (1965 BM Bull. 627), except as given in footnote. AIT: Zabetakis (1965 BM Bull. 627), except as given in 
footnote. Flashpoints: FMEC (1967). 
a FMEC (1967). 
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Downward propagation erf flame, 2CTC 

Figure 16.3 Effect of pressure on flammability limits of 
methane in air (Coward and Jones, 1952 BM Bull. 503) 
(Courtesy of the Bureau of Mines) 





Figure 16.4 Effect of pressure on inflammability limits of 
natural gas in air (Zabetakis, 1965 BM Bull. 627) (Courtesy 
of the Bureau of Mines) 
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Concentration of methane (% v/v) 

Closed tube 2.5 cm dia 150 cm long; downward 


Figure 16.5 Effect of temperature on flammability limits 
of methane in air (Coward and Jones, 1952 BM Bull. 503) 
(Courtesy of the Bureau of Mines) 



Figure 16.6 Effect of temperature on low flammability 
limit of methane in air (Zabetakis, 1965 BM Bull. 627) 
(Courtesy of the Bureau of Mines) 


Similar results are obtained for the effect of temperature 
on the LFLs of other lower paraffinic hydrocarbons. For 
these the approximate flame temperature can be taken as 
1300°C. Then for the first 10 members of the series from 
methane to decane 


A . t -25 
Las 1300-25 


[16.2.1] 


The data may also be fairly well correlated by the 
modified Burgess-Wheeler law, suggested by Zabetakis, 
Lambiris and Scott (1959): 


Lt 0.75(f — 25) 
I® ■ A// c 


[16.2.2] 


where A H c is the net heat of combustion (kcal/mol). Like¬ 
wise the modified Burgess-Wheeler law may correlate the 
effect of temperature on the UFL of these hydrocarbons, in 
the absence of cool flames: 


U t _ 0.75(f — 25) 

t/ 25 - ’ A H c 


[16.2.3] 


where U t is the UFL at t°C (%v/v), and f/ 25 is the UFL at 
25°C (%v/v). 

The variation of flammability limits with temperature 
was studied by Bodurtha (1980), who obtained for the 
substances studied a value of 0.0008/°C both for the 
fractional decrease with temperature of the LFL and for 
the fractional increase with temperature of the UFL. 

A more recent study of the effect of pressure and tem¬ 
perature on flammability limits is that of Gibbon, 
Wainwright and Rogers (1994), who investigated a limited 
number of solvents. Their work confirmed that an increase 
in temperature causes a decrease in the LFL and an 
increase in the UFL. They also found that the UFL 
increased with increase in pressure. Unexpectedly, the 
LFL also increased with increase in pressure. 

In sum, the effect of pressure on the flammability limits 
is much less predictable than that of temperature. In parti¬ 
cular, increase in pressure causes in some cases a decrease 
in the LFL and in others an increase. 

It has been demonstrated that flammability limit mea¬ 
surements can be complicated by surface and vapour phase 
reactions that occur above the AIT. It has been shown, for 
example, that methane—air mixtures containing up to 
5% v/v methane bum readily at 1000°C. The experiments 
were conducted with methane concentrations as low as 
0.5% v/v (Burgoyne and Hirsch, 1954). 

Flammability limits are also affected by the addition of 
an inert gas such as nitrogen, carbon dioxide or steam. This 
effect is shown for methane in Figure 16.7. Minimum inert 
gas contents for suppression of flammability of selected 
substances in air are shown in Table 16.5. In general, carbon 
dioxide causes a greater narrowing of the flammable range 
than does nitrogen. For many flammable gas-air systems, 
the mixtures can be rendered non-flammable by the 
addition of about 30% of carbon dioxide or about 40% of 
nitrogen. 

The flammability limits described are those for mixtures 
of a flammable gas in air. There are also flammability limits 
for combustion in pure oxygen. In general, the LFL of a gas 
is almost the same in oxygen as in air, but the UFL is much 
greater in oxygen than in air. The flammable range in oxy¬ 
gen is thus wider than it is in air. The applicability of 
flammability limits is not confined, however, to air and 
oxygen. There are flammability limits for substances that 
burn in chlorine. 

Flammability limits for a fuel mixture that contains 
several flammable gases may be calculated from the equa¬ 
tion of Le Chatelier (1891). For the lower limit 


whereLtistheLFLatfC(%v/v),L 2 5isLFLat25°C(%v/v) L d»=,—-—— 
and t is the temperature (°C). Z^i=o wm) 


[16.2.4a] 
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Figure 16.7 Effect of inert gases on flammability limits of 
methane in air (Zabetakis, 1965 BM Bull, 627) (Courtesy of 
the Bureau of Mines) 


where L is the LFL of air-free fuel (%v/v), L t the LFL of 
fuel component i (%v/v) and y t is the concentration of 
fuel component i (mole fraction). For the upper limit 


Table 16.5 Minimum inert gas content for suppression of 
flammability of selected substances in air (after Burgoyne, 
1965a) (Courtesy of the Institution of Marine Engineers) 



Nitrogen (% v/v) 

Carbon dioxide (% v/v) 

Methane 

38 

24 

Ethane 

46 

33 

Propane 

43 

30 

«-Butane 

41 

28 

»-Pentane 

43 

29 

»-Hexane 

42 

29 

Ethylene 

50 

41 

Propylene 

43 

30 

Benzene 

45 

32 


required to maintain the concentration of a flammable 
gas-oxygen mixture entering a reactor just below the 
flammable range under other pressure and temperature 
conditions needs greater consideration, because the data 
may not be available so readily for these other conditions, 
but they must be accurate. 

16.2.2 Ignition temperature 

If the temperature of a flammable gas-air mixture is 
raised in a uniformly heated apparatus, it eventually 
reaches a value at which combustion occurs in the bulk gas. 
For the range of flammable mixtures there is a mixture 
composition that has the lowest ignition temperature. This 
is the minimum spontaneous ignition temperature (SIT) or 
auto-ignition temperature (AIT). 

The AIT for the first 10 paraffinic hydrocarbons are as 
follows (Zabetakis, 1965 BM Bull. 627): 



AIT CC) 


AIT(° C) 

Methane 

537 

«-Hexane 

223 

Ethane 

515 

n-Heptane 

223 

Propane 

466 

n -Octane 

220 

w-Butane 

405 

»-Nonane 

206 

«-Pentane 

258 

«-Decane 

208 


Vm 


Et®( x/m 


[16.2.4b] 


where U is the UFL of air-free fuel (% v/v), and [/,-, the UFL 
of fuel component i (%v/v). 

Le Chatelier’s equation is an empirical one and it is not 
universally applicable. Its limitations are discussed by 
Coward and Jones (1952 BM Bull. 503, p. 6). Further infor¬ 
mation on and examples of the calculation of the flamm¬ 
ability limits of fuel mixtures are given in BS 5345: 
Part 1:1976. 

It is necessary to exercise care in using flammability 
limit data, since the limit may vary with pressure, tem¬ 
perature and other conditions. The LFL required to deter¬ 
mine the amount of flammable gas-air mixture resulting 
from a plant leak can probably be obtained quite readily, 
because usually the data are available for ambient condi¬ 
tions and the accuracy called for is not high, but that 


It may be noted that there is a break between the AIT for 
w-butane and that for w-pentane and that the rate of 
decrease of these temperatures after «-pentane is low. 
Some substances have quite low AITs. The AIT of carbon 
disulfide, for example, is 90°C. 

The AIT temperature is a property that is particularly 
liable to variations caused by the nature of hot surfaces. 
The values normally quoted are obtained in laboratory 
apparatus with clean surfaces. The AIT may be reduced by 
as much as 100-200°C for surfaces that are lagged or are 
contaminated by dust. 

Auto-ignition temperatures of selected substances are 
given in Table 16.4. 


16.2.3 Ignition time delay 

Ignition of a flammable mixture raised to or above the 
temperature at which spontaneous ignition occurs is not 
instantaneous; there is a finite time delay before ignition 
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takes place. This time delay decreases as the ignition tem¬ 
perature increases and the reduction has been correlated by 
Semenov (1959) using the equation 

lm = ^ + fe {16.2.5] 

where E is the apparent activation energy, T is the absolute 
temperature, % is the time delay before ignition, and k\ and 
k 2 are constants. The time delay may be as little as a fraction 
of a second at higher temperatures or several minutes close 
to the AIT. 

This effect may be of significance in flow systems where 
the fluid is a flammable mixture that comes in contact with 
a hot surface above the AIT, but for a short time only. 

16.2.4 Flashpoint 

The flashpoint of a flammable liquid is the temperature at 
which the vapour pressure of the substance is such as to 
give a concentration of vapour in the air that corresponds to 
theLFL. 

There are two methods of measuring flashpoint, the 
closed cup test and the open cup test. Some standard test 
methods are: 

Closed cup Pensky Martens ASTM D 93 - 61 

BS 2839:1969 

Tagliabue ASTM D 56-61 

Open cup Cleveland ASTM D 92-57 

The open cup flashpoint is usually a few degrees higher 
than the closed cup flashpoint. The relationships between 
vapour pressure, flammability limits, flashpoint and AIT 
are illustrated in Figure 16.8. 

A liquid that has a flashpoint below ambient tempera¬ 
ture and can thus give rise to flammable mixtures under 
ambient conditions is generally considered more hazardous 





Flash point Autoignition 

temperature 

Figure 16.8 Relationships between vapour pressure, 
flammability limits, flashpoint and auto-ignition temperature 
(after Zabetakis, 1965 BM Bull. 627) (Courtesy of the 
Bureau of Mines) 


than one with a higher flashpoint. The flashpoint is a 
main parameter, therefore, in hazard classification of 
liquids and in government regulations based on these. 
Thus, in aviation there has been movement to replace fuel 
JP4 with JP1. The former is akin to petroleum and has a low 
flashpoint, while the latter is more like kerosene and has 
a higher flashpoint, which is therefore safer. 

Obviously, however, a higher flashpoint liquid also 
becomes more hazardous if it is heated up to a temperature 
above its flashpoint. The flashpoints of selected substances 
are given in Table 16.4. 

16.2.5 Fire point 

The fire point of a flammable liquid is the lowest tempera¬ 
ture at which the liquid, when placed in an open container, 
will give off sufficient vapour to continue to burn once 
ignited. The fire point is usually a few degrees above the 
open cup flashpoint. 

16.2.6 Ignition energy 

If a flammable gas-air mixture is to be ignited by a local 
source of ignition, however, it is not sufficient (as it is with 
auto-ignition) to raise a volume of the mixture to a certain 
temperature for a certain time. There is also a minimum 
volume of mixture so treated that is required in order to 
give rise to a continuing flame through the rest of the mix¬ 
ture. It has been shown, for example, that to ignite a 
methane—air mixture in a cold container by means of a hot 
patch an area of 18 mm 2 is required at 1000-1100°C (Rae, 
Singh and Danson, 1964). There is in effect an ignition 
energy requirement. 

Similarly, ignition of a flammable gas—air mixture by a 
local source of ignition by electrical discharge occurs only 
if the latter possesses a certain energy. The variation of 
ignition energy with composition is shown for hydrogen 
and for methane in Figure 16.9. 

There is a minimum ignition energy (MIE), which 
usually occurs close to the stoichiometric mixture. Mini¬ 
mum ignition energies (MIEs) for selected substances are 
shown in Table 16.6. 

16.2.7 Burning velocity 

The burning velocity affects the rate of combustion of a 
flammable mixture. The burning velocity is a property of 
the mixture. It is in effect the velocity at which a gaseous 
fuel-air mixture issuing from a burner burns back on to 
the burner. The burning velocity of a fuel—air mixture is 
usually determined by measurement of a premixed bunsen 
burner flame in the laminar region. The burning velocity 
S u is obtained by dividing the volumetric gas flow 7by the 
area A of the flame front cone: 


= V/A [16.2.6] 


Alternatively, the burning velocity may be obtained from 
the velocity u of the gas and the half-angle a of the apex of 
the flame front cone: 


S u = «sina 116 2 7,' 


If the flame front cone has radius r, height h and slant 
height /, the area A of the cone surface and the area A' of the 
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Concentration of flammable gas (% v/v) 


Figure 16.9 Effect of mixture composition on electrical 
ignition energy of methane and of hydrogen in air (Factory 
Mutual Engineering Corporation, 1967) 


cone triangular cross-section are, respectively 


A = nrl [16.2.8a] 

s= nr(f + h 2 ) 1/2 [16.2.8b] 

A' = rh [16.2.9] 

A = nA'l/h [16.2.10] 


The gas velocity u is 



The flame front is usually not a perfect cone and, in con¬ 
sequence, the equations just quoted are subject to errors of 
varying size. The choice of equations for the calculation of 
burning velocity is discussed by B. Lewis and von Elbe 
(1961) and by Fells and Rutherford (1969). The maximum 
burning velocity obtained at atmospheric pressure and 
temperature is referred to as the maximum fundamental 
burning velocity. 


Table 16.6 Minimum ignition energies for selected 
substances in air 


Minimum ignition energy (mj) 

Carbon disulfide 

0.01-0.02 

Hydrogen 

0.019 

Acetylene 

0.02 

Methane 

0.29 

Ethane 

0.24 

Propane 

0.25 

«-Butane 

0.25 

w-Hexane 

0.25 

Ethylene 

0.12 

Benzene 

0.22 

Ammonia 

up to >100 


Sources: Burgoyne (1965a); FMEC (1967). 


Burning velocities for methane in air and in oxygen are 
shown in Figure 16.10. In general, burning velocities for 
paraffinic hydrocarbons range from a few centimetres per 
second near the flammability limits up to about 45 cm/s 
near the stoichiometric mixture. For these hydrocarbons 
in oxygen the corresponding values are about 125 and 
425 cm/s, respectively. 

Burning velocities are affected by pressure and 
temperature. The effect of pressure changes is variable. 
A decrease in the burning velocity of stoichiometric 
methane—air mixtures has been found with increasing 
pressure in the range 0.5-20 atm, hut with stoichio¬ 
metric methane-oxygen mixtures an increase in pres¬ 
sure in the range 0.2-2 atm gave an increase in burning 
velocity. 

The effect of temperature on burning velocity is more 
consistent and is sometimes described by the equation 

S a =A+BT n [16.2.12] 

where T is the absolute temperature, A and B are constants 
and n is an index. A value of 2.0 for the index n has been 
found for some paraffinic hydrocarbons (Zabetakis, 1965 
BM Bull. 627, p. 43). Maximum fundamental burning velo¬ 
cities of selected substances in air and in oxygen are given 
in Table 16.7. 

The actual flame speed in combustion of a flammable 
mixture is greater, and sometimes very much greater, than 
the burning velocity. Whereas the burning velocity is a 
property of the mixture only, the flame speed depends on 
other factors such as turbulence and pressure waves. If 
detonation occurs, the flame speed is greater hy orders of 
magnitude than the burning velocity 

16.2.8 Adiabatic flame temperature 

The heat radiated by combustion of a flammable mixture 
depends on the flame temperature, the theoretical max¬ 
imum value of which is the adiabatic flame temperature. 
The adiabatic flame temperature is the temperature 
attained by combustion under adiabatic conditions. It 
is normally determined for the stoichiometric mixture 
and values quoted generally refer to this unless otherwise 
stated. 

The adiabatic flame temperature can be calculated, 
but for an accurate calculation this is not entirely 
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Figure 16.10 Effect of mixture composition on burning 
velocity of methane in air and in oxygen (Zabetakis, 1965 
BM Bull. 627) (Courtesy of the Bureau of Mines) 


Table 16.7 Maximum fundamental burning velocities 
of selected substances in air and in oxygen 



Maximum fundamental 
burning velocity? S u 


(cm/s) 

(ft/s) 

In air 

Methane 

36.4 b 

1.2 

Ethane 

40.1 


Propane 

45 b 

1.5 

w-Butane 

40.5 

1.3 

w-Hexane 

38.5 

1.3 

Ethylene 

68.8 b 

2.3 

Town gas c 

- 

3.7 

Acetylene 

173 

5.8 

Hydrogen 

320 

11.0 

Benzene 

40.7 b 

- 

In oxygen 

Methane 

393° 

- 

Propane 

390 

- 

Ethylene 

550 

- 

Acetylene 

1140 

- 

Hydrogen 

1175 

- 


a The values given in the first column (cm/s) are those of Fiock (1955) 
and in the second column (ft/s) those of the HSE (1965 HSW Bklt 34). 
The values quoted from Fiock are for initial pressure atmospheric and 
initial temperature room temperature and, in most cases, dry gas, and 
generally are selected from several values listed. 

“Some higher values are also listed by Fiock. 
c For town gas containing 63 % H 2 . 
d For stoichiometric mixture. 


straightforward. Accounts of calculation methods are 
given by Hoil pen. Watson and Rasyatz (1954-).WA. Grav. 
Kilham and Mffller (1976), Barnard and Bradley (1985), 
Drysdale (1985) and Kuo (1986). 

The adiabatic flame temperature may be determined for 
constant pressure or constant volume conditions. The value 
normally quoted is for the former. For this case the enthalpy 
balance is 


AH 2 + AHi + Aff c = 0 

[16.2.13] 

AH 2 + AH 1 + (-A H c ) 

[16.2.14] 

with 


A°Cp,(T)dT 

16.2.15] 

= c pmr (T 0 - T,) 

[16.2.16] 

AH 2 = Y,mJ T 2 cAT)<lT 

[16.2. If 

= Cpmp(T 2 — To) 

[16.2.18] 


where c p is the specific heat at constant pressure of com¬ 
ponent i (kJ/kmol°C), c pm is the mean specific heat over the 
range of interest (kJ/kmol°C), Aff c is the heat of combustion 
(kj/mol of fuel), AH, is the enthalpy change between states 1 
and 0 (kj/kmol of fuel), A H 2 is the enthalpy change between 
states 1 and 2 (kj/kmol of fuel), n is the number of moles per 
mole of fuel, p is the number of products, r is the number of 
reactants and subscripts i, p and r denote component i, 
products and reactants, and 0,1 and 2 denote the standard 
state, initial state and final state, respectively. 

The specific heat c pi of a reactant or product is a function 
of the temperature T. It is commonly represented in the 
form 


Cpi = a i + biT + CiT 2 + diT a [16.2.19] 

where a,- (kJ/kmol°C), ft,- (kJ/kmol°CK), a (kJ/kmol°CK 2 ) 
and di (kJ/kmol°C K 3 ) are constants. 

Then from Equations 16.2.17—16.2.19 the mean specific 
heat of product i is 


[ofT + biT 2 /2 + c,r 3 /3 + diT^/A)^ 

t 2 -t 0 


[16.2.20] 


and the mean specific heat of the product mixture is 

p 

c pm p = 5^«I-Cpn« [16.2.21] 


If necessary, equations similar to Equations 16.2.20 and 
16.2.21, derived from Equations 16.2.15 and 16.2.19, may be 
used to obtain c pmt ., but generally the initial temperatureT/ 
is close to the standard temperature T 0 so that a point value 
of c pmr may be used. If in fact T x = T 0 , then ATf = 0. 

Table 16.8 gives values of the constants in Equation 
16.2.19 for the determination of point values of the specific 
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Table 16.8 

and Hall) 

Constants for specific heat at constant pressure (Barnard and Bradley, 1985) (Courtesy of Chapman 

Species 


Constant a 


Valid over temperature 
range (K) 

a 

10 2 b 

10 5 c 

10 9 d 

h 2 

29.09 

-0.1916 

0.4000 

-0.870 

273-1800 

0 2 

25.46 

1.519 

- 0.7150 

1.311 

273-1800 

n 2 

27.32 

0.6226 

- 0.0950 

- 

273-3800 

CO 

28.14 

0.1674 

0.5368 

- 2.220 

273-1800 

co 2 

22.24 

5.977 

- 3.499 

7.464 

273-1800 

h 2 o 

32.22 

0.1920 

1.054 

-3.594 

273-1800 

ch 4 

19.87 

5.021 

1.286 

-11.00 

273-1500 

c 2 h. 

21.80 

9.208 

- 6.523 

18.20 

273-1500 

c 2 ii 

3.95 

15.63 

- 8.339 

17.66 

273-1500 

c 2 H 6 

6.895 

17.25 

6.402 

7.280 

273-1500 

C 3 H s 

-4.042 

30.46 

-15.71 

31.71 

273-1500 

c 6 h 6 

-39.19 

48.44 

-31.55 

77.57 

273-1500 

ch 3 oh 

19.04 

9.146 

-1.218 

-8.033 

273-1000 

nh 3 

27.55 

2.563 

0.9900 

-6.686 

273-1500 

NO 

27.03 

0.9866 

0.3223 

0.3652 

273-3800 

so 2 

25.76 

5.791 

- 3.809 

8.606 

273-1800 


a Constants in the equation c p = a + bT+cT 2 + dT 3 , where c p is the specific heat (kj/kmol °C) and Tis the absolute temperature (K). 


Table 16.9 Mean specific heats (kj/kmol °C) at a 
constant pressure (after Hougen, Watson and Ragatz, 
1954-) 


Final temperature, t(° C) 

Mean specific heat 
(kj/kmol °C) 

0 2 

JV 2 

co 2 

h 2 o 

2000 

35.27 

33.47 

54.85 

43.67 

2100 

35.42 

33.61 

55.14 

44.05 

2200 

35.55 

33.72 

55.43 

44.42 


“Mean specific heat over the temperature interval 0°C to t°C. Values 
based on data for zero pressure given by the authors and based on 
those of Wagman (1953). 


heats c p . Table 16.9 gives values of the mean specific heat 
c pm over the interval 0°C to t °C. 

In the foregoing the implicit assumption is that the pro¬ 
ducts of combustion are those given by the simple stoi¬ 
chiometric equation, which for hydrocarbons yields only 
C0 2 and H 2 0. In fact, for flame temperatures above about 
1370°C dissociation of the products of combustion occurs. 
At adiabatic flame temperatures, dissociation and ioniza¬ 
tion absorb a significant amount of energy and result in an 
appreciable lowering of the temperature of the flame. This 
is illustrated in Table 16.10, which shows that for propane 
the values obtained for the adiabatic flame temperature are 
2219 K using a comprehensive set of equilibriums, 2232 K 
using a simplified set and 2324 K considering only the 
formation of C0 2 and H 2 0. 

Calculations of the adiabatic flame temperature allowing 
for dissociation are complex. A computer program that 
performs such calculations has been described by Gordon 
and McBride (1971,1976). An account of its use is given by 
Kuo (1986). 

Table 16.11 gives some theoretical and experimental 
values of flame temperature quoted by B. Lewis and von 


Elbe (1987) and Siegel and Howell (1991). The theoretical 
values given in the table are adiabatic flame temperatures 
at constant pressure. Details of the experimental tempera¬ 
tures are given in the footnote to the table. Lewis and von 
Elbe state that the experimental flame temperatures were 
probably influenced somewhat by heat loss and other fac¬ 
tors, but that the error is small; Siegel and Howell describe 
the experimental values as ‘maximum temperatures’. 


16.2.9 Degree of flammability 

Comparisons are often made between the flammability 
either of different substances or of different mixtures of the 
same substance in air. There is no single parameter that 
defines flammability, but some that are relevant are (1) the 
flashpoint, (2) the flammability limits, (3) the AIT, (4) the 
ignition energy and (5) the burning velocity. 

The flashpoint of a substance is often treated as the 
principal index of flammability, a substance being regar¬ 
ded as highly flammable if it has a low flashpoint. The 
other flammability characteristics are also important, 
however. The flammability of the substance is increased by 
wide flammability limits and by a low minimum AIT, low 
MIE and a high maximum burning velocity. 

The mixtures that have the lowest AIT and ignition energy 
and the highest burning velocity, tend to occur near to, but 
normally not exactly at, the stoichiometric composition. 


16.2.10 Quenching effects 

Flame propagation is suppressed if the flammable mixture is 
held in a narrow space. Thus there is a minimum diameter for 
apparatus used for determination of flammability limits such 
that below this diameter the flammable range measured is 
narrower and inaccurate. Ultimately, if the space is suffi¬ 
ciently narrow, flame propagation is suppressed completely. 
The largest diameter as which flame propagation is sup¬ 
pressed is known as the quenching diameter. For an aperture 
of slot-like cross-section there is a critical slot width. 
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Table 16.10 Complete thermodynamic treatment of adiabatic flame temperature of propane it 
1985) (Courtesy of Chapman and Hall) 

? air (Barnard and Bradley, 

Species 


Concentration (mole fraction) 


Casel 

Constant pressure 

Case 2 

Case 3 

Constant volume 

o 

p 

0.1004 

0.1003 

0.1111 

0.0914 

h 2 o 

0.1423 

0.1439 

0.1481 

0.1374 

n 2 

0.7341 

0.7347 

0.7407 

0.7276 

CO 

0.0099 

0.0100 


0.0182 

h 2 

0.0032 

0.0033 


0.0053 

0 2 

0.0048 

0.0055 


0.0075 

NO 

0.0020 

0.0022 


0.0052 

CH 2 0 

<10“ 5 



<10“ 5 

c 2 h 4 

<10“ 5 



<10“ 5 

c 3 h 6 

<HT 5 



<10“ 5 

n 2 o 

<10“ 5 



<10“ 5 

CHO 

<10“ 5 



<10“ 5 

ch 3 

<HT 5 



<10“ 5 

c 2 h 5 

<10“ 5 



<10“ 5 

i-c 3 h 7 

<10“ 5 



<10“ 5 

H 

0.0035 



0.0009 

0 

0.0020 



0.0008 

N 

<10“ 5 



<10“ 5 

OH 

0.0027 



0.0058 

ho 2 

<10“ 5 



<10“ 5 

Final temperature (K) 

2219 

2232 

2324 

2587 


a Calculations are for a stoichiometric mixture. Case 1 refers to calculations based on a comprehensive set of equilibriums, Case 2 to calculations 
using a smaller set of equilibriums, and Case 3 to calculations made considering only the formation of C0 2 and H 2 0. 


Table 16.11 Adiabatic flame temperatures of selected 
substances in air at atmospheric pressure 



Theoretical a (K) 

Experimen¬ 
tal (K) 

Complete 

miiibiistioit 

With l a 

dissociation 
and ionization 

2 b 

Methane 

2285 

2191 

2148 

2158 

Ethane 

2338 

2222 

2168 

2173 

Propane 

2629 

2240 

2198 

2203 

w-Butane 

2357 

2246 

2168 

2178 

Ethylene 

2523 

2345 

2248 

2253 

Propylene 

2453 

2323 

2208 

2213 

Acetylene 

2859 



2598 

Benzene 

2484 




Carbon 

2615 




monoxide 





Hydrogen 

2490 



2318 


a Given by Siegel and Howell (1991), quoting Barnett and Hibbard 
(1957) and Gaydon and Wolfhard (1960). Values for combustion in dry 
air at 298 K. 

b Given by B. Lewis and von Elbe (1987), quoting Loomis and Perrott 
(1928), GW Jones, Lewis and Seaman (1931) and G.W Jones etol. (1931). 
See text. 

The term ‘quenching distance’ is used sometimes as a 
general term covering both quenching diameter and cri¬ 
tical slot width and sometimes meaning the latter only. An 


account of quenching distances is given by Potter (1960). He 
gives the following empirical relation between quenching 
diameter D 0 and critical slot width Df 

D|l = 0.65H o [16.2.22] 

He also discusses the effect of pressure and temperature on 
these variables. 

There is a maximum experimental safe gap (MESG) that 
avoids the transmission of an explosion occurring within a 
container to a flammable mixture outside the container. 
The MESG is measured in a standard apparatus. One 
apparatus consists of a spherical vessel with the gap 
between a pair of flat equatorial flanges, the breadth of the 
gap being 1 in. Avalue of less than 1 in. causes a decrease in 
the MESG, but a greater value has no effect. An account of 
maximum safe gaps is given by Lunn and Phillips (1973). 

Critical slot widths and MESGs for selected substances 
in air are given in Table 16.12. It is emphasized that these 
values relate to a stationary flame. If the gas flow is in the 
direction of flame propagation, a smaller gap is needed to 
quench the flame and, conversely, if the gas flow is in the 
opposite direction, a larger gap will effect quenching. If the 
gas velocity is high enough, a condition can occur in which 
a flame propagating against the flow is stabilized at a con¬ 
striction and causes local overheating. 

For some substances, notably acetylene, carbon disulfide 
and hydrogen, the quenching diameters and distances are 
very small. These quenching effects are important in the 
design of flameproof equipment and of flame arresters. 
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Table 16.12 Critical slot widths and maximum 
experimental safe gaps for selected substances in air 


Critical slot Maximum 

width a,b (mm) experimental 

safe gap b ’ c (mm) 


Acetone 

_ 

1.01 

Acetylene 

0.52 

0.37 d 

Ammonia 

- 

3.18 

Benzene 

1.87 

0.99 

w-Butane 

- 

1.07 e 

Carbon disulfide 

0.55 

0.20 

Carbon monoxide 


0.91 d 

Cyclohexane 

3.0 

0.94 

Ethane 


0.91 

Ethylene 

1.25 

0.65 

Ethylene dichloride 

- 

1.82 

Ethylene oxide 

1.18 

0.59 

Hydrogen 

0.50 

0.20 

Methane 

2.16 

1.14 

rc-Pentane 

2.07 

0.89 e 

Propane 

1.75 

0.92 

Propylene 

- 

0.91 

Vinyl chloride 

- 

0.96 


Sources: Critical slot width: Potter (1960). Maximum experimental 
safe gap: Lunn and Phillips (1973), except as given in footnotes. 
a Critical slot widths are for stoichiometric mixtures and are cor¬ 
rected where necessary to atmospheric pressure and 25°C. 
b Where several values of critical slot width or maximum experi¬ 
mental safe gap are given in original reference, the value quoted here 
is the smallest. 

c Maximum experimental safe gaps are corrected where necessary to 
atmospheric pressure and 20°C. 

d Data for acetylene and carbon monoxide should be interpreted with 
care. For acetylene under certain ill-defined circumstances external 
ignitions have been reported at flange gaps too small to measure. For 
carbon monoxide data are for moist (not saturated) gas. Addition of 
moisture greatly increases the burning velocity of carbon monoxide. 
e Burgoyne (1965a). Maximum experimental safe gap at atmospheric 


16.2.11 Flammability in oxygen 

The flammability of a substance depends strongly on the 
partial pressure of oxygen in the atmosphere. The oxygen 
concentration affects both the flammability limits and the 
other flammability parameters. In general, increasing 
oxygen content alters the LFL only slightly, but its effect on 
the UFL is marked. Figure 16.11 illustrates the effect 
of oxygen concentration on the flammability limits of 
methane-oxygen-nitrogen mixtures. Conversely, there is 
a minimum oxygen content to support combustion. For the 
system shown in Figure 16.11 this is approximately 12%. 
Increasing the oxygen content reduces the ignition energy 
and the quenching distance of methane-oxygen-nitrogen 
mixtures as shown in Figures 16.12 and 16.13, respectively. 
Again the effect is a marked one. 

The increase in burning velocity of methane when air is 
replaced by oxygen was illustrated in Figure 16.10. 


16.2.12 Uncertainty in data 

It has already been emphasized that there is frequently 
some uncertainty in the data available for design. The point 
is illustrated by the data on flammability characteristics 



Figure 16.11 Effect of mixture composition on burning 
velocity of methane in air and in oxygen (Zabetakis, 1965 
BM Bull. 627) (Courtesy of the Bureau of Mines) 



Figure 16.12 Minimum spark ignition energies in metha¬ 
ne-oxygen-nitrogen mextures at 1 atm pressure (B. Lewis 
and von Elbe, 1961) (Courtesy of Academic Press) 
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Figure 16.13 Quenching distances in 
methand-oxygen-nitrogen mixtures at 1 atm pressure 
(B. Lewis and von Elbe 1961) (Courtesy of Academic 
Press) 


given in Table 16.13. The LFL of ethylene-air mixtures at 
atmospheric pressure and temperature is generally taken 
as 2.7%, as indicated in the table, and it is not regarded as 
particularly uncertain. But as the figures show, previous 
values differ from this by a factor as high as 1.22. On the 
other hand, the MIE of ammonia—air mixtures at atmo¬ 
spheric pressure and temperature appears still to be sub¬ 
ject to some uncertainty. The situation is similar for the 
AITof acetone, methanol and methylethyl ketone mixtures 
with air at atmospheric pressure. 


16.3 Combustion Phenomena 

The use of the flammability characteristics just described 
is a simplification of rather complex combustion phenom¬ 
ena, which for engineering purposes it is necessary to 
make. It is convenient at this point, therefore, to indicate 
some of this combustion background, both as a commen¬ 
tary on the flammability characteristics just described and 
as an introduction to the subsequent sections on flames 
and fires. 

Accounts of basic combustion are given in The Science 
of Flames and Furnaces (Thring, 1952), Flames, Their 


Structure, Radiation and Temperature (Gaydon and Wolf- 
hard, 1953-), Some Fundamentals of Combustion (Spald¬ 
ing, 1955), Combustion, Flames and Explosions of Gases 
(B. Lewis and von Elbe, 1961, 1987), Combustion Theory 
(F.A.Williams, 1965), Fundamentals of Combustion (Strehlow, 
1968a), Flames and Combustion Phenomena (G.N. Bradley, 
1969), Flame and Combustion (Barnard and Bradley, 1985), 
An Introduction to Fire Dynamics (Drysdale, 1985), Principles 
of Combustion (Kuo, 1986) and Combustion of Liquid Fuel 
Sprays (A.Williams, 1990). 

Selected references on combustion phenomena are given 
in Table 16.14. Some topics in combustion research relevant 
to loss prevention are shown in Table 16.15. 

In this section the following aspects of combustion are 
reviewed: 


(1) flame propagation; 

(2) diffusion and premixed flames; 

(3) premixed flame flashback and blowoff; 

(4) diffusion flame characteristics; 

(5) flame stretch and wrinkling; 

(6) reaction kinetics and transport processes; 

(7) thermal explosion theory; 

(8) flammability limits; 

(9) ignition phenomena; 

(10) burning velocity; 

(11) quenching effects; 

(12) cool flames; 

(13) combustion in tubes. 


Some of the reviews are essentially historical, illustrating 
the development of the basic concepts. 


16.3.1 Flame propagation 

A useful starting point for consideration of combustion is 
the propagation of the flame as an adiabatic planar com¬ 
bustion wave, as shown in Figure 16.14. At the front of the 
combustion zone the temperature is that of the burnt gasT b . 
From this maximum value the temperature then falls off. 
Within the wave there is a plane at temperature T x where 
transition occurs from a heat source to a heat sink in that 
the heat supplied by the reaction now falls below the heat 
lost to the unburnt gas behind. The temperature then falls 
further until it reaches the temperature T u of the unburnt 
gas behind the wave. The first part of the combustion zone, 
in front of Ti, is the reaction zone and the second part, 
behind T lt the preheat zone. 

In many practical situations the flame front is not planar. 
In particular, a small spherical flame has a divergent flame 
front and undergoes stretch, as described below. However, 
as the spherical flame becomes larger, the flame front may 
be approximated by a planar front. 

Although it is convenient to start with the model of the 
adiabatic planar combustion wave, it has often been the 
case in combustion theory that progress has only been 
made when this model is abandoned and real, but more 
complex, situations are considered.Thus, B. Lewis and von 
Elbe (1961) state: 


The use of the adiabatic plane wave equations for general 
theoretical deductions of flame behaviour is futile 
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Table 16.13 Variability of experimental data on flammability characteristics it 

i a ir 

Property 

Mixture 

Value (% v/v) 

Reference 

Lower flammability limit 

Ethylene—air 3 

2.75 

Jones et al. (1935 BM RI3278) 

(upwards propagation of flame) 


3.2 

Burgoyne and Williams-Leir (1948a) 



3.3 

Chapman (1921) 



(mj) 


Minimum ignition energy 

Ammonia-air b 

40 

Magison (1966) 



60 

Magison (1966) 



<90 

G.F.P. Harris and MacDermott (1977) 



170 

G.F.P. Harris and MacDermott (1977) 



680 

Buckley and Husa (1962) 



(°C) 


Auto-ignition temperature 

Acetone-air c 

465 

Zabetakis (1965 BM Bull. 627) 



600 

Marsden (1963) 


Methanol-air c 

385 

Zabetakis (1965 BM Bull. 627) 



470 

Marsden (1963) 


Methylethyl c 

404 

Hilado and Clark (1972a) 


ketone-air 

550 

Marsden (1963) 


a The value given by Zabetakis (1965 BM Bull. 627) and in the ICI Electrical Installations Code (ICI/RoSPA 1972IS/91) is 2.7%. 
b These differences are discussed by G.F.P. Harris and MacDermott (1977). 
c These differences have been noted by Santon (1977). 


Table 16.14 Selected references on combustion, 
pre-flame and ignition phenomena, slow oxidation and 
cool flames and flame propagation 


Perkin (1882); Lotka (1920); Penning (1926); J. White (1927); 
Payman (1928); Prettre, Dumanois and Lafitte (1930); 
Norrish (1935); Pease (1935,1937); Ubbelohde (1935,1936); 
Norrish and Foord (1936); Coward and Payman (1937); von 
Elbe and Lewis (1937a,b); Newitt (1937); Newitt and 
Thornes (1937); Townend (1937); Hsieh and Townend 
(1939a-c);Townend and Hsieh (1939); B. Lewis and von 
Elbe (1947); Boord (1949); Henkel, Hummel and Spaulding 
(1949); Henkel, Spaulding and Hirschfelder (1949); 
Hirschfelder and Curtiss (1949); Prettre (1949); Reynolds 
and Gerstein (1949); Spence and Townend (1949); Jost 
(1950); Fenn (1951); Grove and Walsh (1953); J.E. Johnson, 
Crellin and Carhart (1953,1954); Schmidt, Steinecke and 
Neubert (1953); G.K. Adams and Scrivener (1955); Bardwell 
(1955); Bawn and Skirrow (1955); Dugger,Weast and Heimel 
(1955); Foresti (1955); Grumer (1955); Newitt (1955); 
Burgoyne and Weinberg (1956); Barnett and Hibbard 
(1957); von Karman (1957); Lucquin and Laffltte (1957); 
WW. Robertson and Matsen (1957); Tipper (1957); D.H. 
Allen etal. (1959); Berlad and Yang (1959,1960); Ferguson 
and Yokley (1959); Goldenberg and Pelevin (1959); Mullins 
and Penner (1959); Salooja (1960,1961,1964a, b, 1966,1967, 
1968a,b); Wolfhard and Bruszak (1960); Barnard and 
Hawtin (1961); Yang (1962); Hirschfelder (1963); Seakins 
and Hinshelwood (1963); Rhein (1964); Yao and Ruof (1964); 
Agnew and Agnew (1965); Barnard and Ibberson (1965); 
Bonner and Tipper (1965a,b); Sueyasu and Hikita (1965); 
Adler and Zaturska (1966); Fish (1966,1968); Melvin (1966, 
1969a,b); Ashmore (1967); Ashmore and Preston (1967); 
Barnard and Kirschner (1967); Hoare,Ting-Man Li and 
Walsh (1967); Knox (1967a,b); Barnard and Sankey (1968); 
Bell, Skirrow and Tipper (1968); M.H. Friedman (1968); J.F. 
Griffiths, Skirrow and Tipper (1968—); Howe andTing-Man 
Li (1968); Neiman and Gal (1968); Barnard and Watts (1969, 


1972); Fish etal. (1969); B.F. Gray (1969a,b); Bowman (1970); 
Fine, Gray and Macinven (1970); R. Hughes and Simmons 
(1970); Korman (1970); Perche, Perez and Lucquin (1970, 
1971); Dechaux, Flament and Lucquin (1971); Drysdale 
(1971); Halstead, Prothero and Quinn (1971,1973); Knox and 
Kinnear (1971); Leyer and Manson (1971); Meyer and 
Oppenheim (1971a,b); Burgess and Laughlin (1972); 
Crossley etal. (1972); Lucquin and Antonik (1972); 

H. Phillips (1972a, 1973); Tse (1972); Barnard and Harwood 
(1973a,b, 1974); Berlad (1973); Dehn (1973); Luckett and 
Pollard (1973); Feay and Bowen (1973); R. Hughes and 
Prodan (1973);Vovelle and Delbourgo (1973); McKay etal. 
(1975); FW. Williams, Indritz and Sheinson (1975); D.C. Bull, 
Pye and Quinn (1976); Caprio, Insola and Lignola (1977); 
Hirano etal. (1977); Bilger (1979); Dechaux and Delfosse 
(1979); Maly and Vogel (1979); Affens and Sheinson (1980); 
Coffee (1980,1982b); Kolodner and Pratt (1980); d’Onofrio 
(1980); Abdel-Gayed and Bradley (1981); Coffee (1981LPB 
81); Snee (1981 LPB 81); Hoffmann-Berling, Giinther and 
Leuckel (1982); Rhee (1982); F.A Williams (1982,1992); 

G. Freeman and Lefebvre (1984); Ronney (1985); Chakire/ al. 
(1989);Wilk etal. (1989); Xiao-JingWang (1989); Sloane 
(1990a,b, 1992); Borghese etal. (1991); P.P. Gray (1991); 

B.F. Gray, Merkin and Griffiths (1991); Leclerc-Battin et al. 
(1991); Pitt, Clements andTopham (1991); Battin-Leclerc 
etal. (1992); D. Bradley (1992); B.F. Gray, Little and Wake 
(1992); Miles and Gouldin (1992); Trevino and Mendez 
(1992); Sloane and Ronney (1993); Vanpee (1993) 

Chemical reaction kinetics 

Kassel (1937); Dugleux and Freling (1955); von Elbe (1955); 
Hoare and Walsh (1955); Levy (1955); Ubbelohde et al. 
(1955);Vanpee and Grard (1955); Giddings and Hirschfelder 
(1957); W.G. Parker (1958); Szabo (1959); Baulch etal. (1973); 
Jensen and Jones (1978); Lovachev (1981); Westbrook and 
Dryer (1981); Kaufman (1982); Golden and Larson (1985); 
Wolfrum (1985); R.D. Levine (1989); Stewart, Rothem and 
Golden (1989); Troe (1989); Hai Wang and Frenklach (1991) 
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Kinetic schemes: Dixon-Lewis (1955); WW. Robertson etal. 
(1955); Westbrook, Hellwig and Anderson (1955); 

Knox (1959,1967a); Minkoff and Tipper (1962); Ashmore, 
Dainton and Sugden (1967); Smoot, Hecker and Williams 
(1976); Dryer and Schug (1982); J.A. Miller et al. (1982); 
Westbrook and Pitz (1984);Warnatz (1985); Hwang etal. 
(1987); Yetter, Dryer and Rabitz (1991) 


because the model is unrealistically restricted by the 
specification of one-dimensional, adiabatic propagation 
in an infinite medium for an infinite time. For one thing, 
the model does not yield limits of inflammability as they 
are known to the experimenter, (p. 210) 

An important feature in combustion work is the flow 
regime. In particular, there is a distinction between a 
flame propagating in a stagnant gas and in a flowing gas. 
Another distinction is that between laminar and 
turbulent flow. Flammability characteristics such as the 
ignition energy or burning velocity are affected by the flow 
regime. 

16.3.2 Diffusion and premixed flames 

A fundamental distinction is made between (1) premixed 
flames and (2) diffusion flames. In a premixed flame the air 
for combustion is mixed with the fuel gas before it issues 
from the orifice, while in a diffusion flame gas or liquid 
leaving the orifice is pure fuel and the air for combustion 
has to diffuse to it from the surrounding atmosphere. Both 
types of flame may be produced on a bunsen burner, a pre¬ 
mixed flame being obtained by opening the primary air 
inlet and a diffusion flame by closing it. 

With a premixed flame the rate of burning is limited by 
reaction kinetics, while, in principle, with a diffusion flame 
the rate limiting mechanism is diffusion. At high turbu¬ 
lence in a diffusion flame, however, kinetics and diffusion 
may be of roughly equal importance. 

Another distinction in flames is that between (1) laminar 
flames and (2) turbulent flames. The criterion for transi¬ 
tion from the laminar to the turbulent regime in a flame is 
the Reynolds number. The relevant Reynolds number, 
however, is that of the flame, which is actually several 
times less than that of the cold gas leaving the tube, 
because the gas viscosity at the flame temperature is that 
much greater. 

16.3.3 Premixed flame flashback and blow-off 

The behaviour of a premixed flame burning on a tube or 
similar burner is a function of the concentration of the fuel 
and of the gas velocity. Aspects of particular interest are 
flashback, blow-off, lift and blow-out of the flame. These 
featureshavebeenstudiedforflamesofbutane-airmixture 
by Wohl, Kapp and Gazley (1949) and are shown in Figure 
16.15. In region A a stable flame can exist only at the burner 
port and in region B only lifted off the port. In region C the 
flame may be stable either on the port or lifted off it. In region 
D flashback can occur down the burner pipe. 

The limits for flashback, blow-off and lift are determined 
by the velocity gradients at the boundary of the flame. 
In the flame the gas velocity is opposed by the axial com¬ 
ponent of the burning velocity. Flashback occurs under 
conditions where the gas velocity is low relative to the 


Table 16.15 Some topics in combustion 
relevant to loss prevention 


Chemical kinetics of combustion 
Combustion initiation and propagation 
Flammability limits 
Ignition phenomena 
Spontaneous ignition 
Spark ignition 
Hot wire ignition 
Hot surface ignition 
Hot gas ignition 
Hot particle ignition 
Compression ignition, shock heating 
Induction period 
Flame propagation 
Slow oxidation, cool flames 
Quenching effects 
Burning velocity 
Measurement methods 
Turbulence effects 
Detonation 

Properties of detonation wave 
Detonation limits 
Detonation cell structure 
Transition from deflagration to detonation 
Detonation in tubes 
Detonation in vapour clouds 
Flames 

Premixed flames 
Diffusion flames 

Flame stability, flashback, blowoff 
Flame stretch and wrinkling 
Flame emissivity 
Emissivity of C0 2 , H 2 0 
Emissivity of sooty flames 
Soot formation and properties 
Inerting 
Inhibition 
Flame spread 

Flame spread over solid surfaces 
Flame spread over liquid pools 
Ignition and burning of wood and cellulose 
Calorific value of wood 

Thermal radiation levels for spontaneous and pilot 
ignition 

Burning of wood 
Wood crib fires 
Duct fires 
Pool fires 
Flame dimensions 
Flame emissivity 
Heat transfer to pool 
Regression rate 
Large fires 

Vapour cloud fires and explosions 
Mist and spray combustion and explosion 
Burning of single drops 
Burning of mist/spray clouds 
Dust fires and explosions 
Dust explosibility limits 
Dust cloud explosions 
Smoldering dust fires 
Self-heating, thermal explosion 
Building fires 
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Figure 16.14 Scheme of a planar combustion wave (B. Lewis and von Elbe, 1961) (Courtesy of Academic Press) 



Figure 16.15 Scheme of characteristic regions of flame 
stability for a premixed flame (after Wohl, Kapp and Gaz- 
ley, 1949) (Courtesy of the Combustion Institute) 


burning velocity. Blow-off at lower fuel concentration and 
lift at high fuel concentrations occur where the gas velocity 
is high relative to the burning velocity. The lift curve is an 
extension of the blow- off curve. The limits for blow- out and 
drop back of a lifted flame are not determined by the 
boundary velocity gradients and their shapes are specific 
for each burner diameter. 


For laminar flow, from the Poiseuille equation the 
boundary velocity gradient g is 

g = 4 F/ro- 3 (16.3.1] 

where r is the distance from the centre of the tube to the 
boundary of the stream and Fis the volumetric flow of gas. 
The critical boundary velocity gradient for flashback 
may be obtained from Equation 16.3.1 using the volumetric 
flow for flashback Fp Likewise, the critical boundary velo¬ 
city gradient for blow-off g B may be obtained using the 
volumetric flow for blow-off F B . 

Data on critical velocity gradients for flashback and for 
blow-off have been given by M.E. Harris et al. (1949). 


16.3.4 Diffusion flame characteristics 

The behaviour of a diffusion flame is a function of the fuel 
velocity. As aspect of particular interest is the dimensions 
of the flame. This is illustrated in Figure 16.16, which is 
based on the work of Hottel and Hawthorne (1949) and a 
further interpretation by Gugan (1976). In the laminar 
regime the flame length is approximately proportional to 
the velocity, while in the turbulent regime it is independent 
of velocity. Turbulence spreads from the flame tip down¬ 
wards. As velocity increases there are successively a region 
where the flame may be on the port or lifted, a region where 
only a lifted flame occurs and a point beyond which there is 
blow-off. 

There are a number of correlations for the dimensions of 
a diffusion flame. The simple equation given by Jost (1946) 
for flame length is 
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Figure 16.16 Scheme of characteristic regions of flame 
stability for a diffusion flame (after Hottel and Hawthorne, 
1949; Gugan, 1976) (Courtesy of the Combustion Institute 
and the Institution of Chemical Engineers) 


where d is the diameter of the pipe (m), D is the diffusion 
coefficient (m z /s), L is the flame length (m), and u is the fuel 
velocity (m/s). 

For the laminar regime the diffusion coefficient D may he 
taken as the molecular diffusion coefficient D m , which is a 
constant with respect to velocity. The flame length in this 
regime is thus proportional to velocity. But for the turbu¬ 
lent regime, D may be taken as the eddy diffusion coeffi¬ 
cient D e , which is proportional to the velocity u. The flame 
length in this regime is thus independent of velocity. 

For the turbulent regime an equation commonly used to 
predict flame length is that of Hawthorne, Weddell and 
Hottel (1949): 


L 


5.3DJ - T f 


[a -f (i— q) 


[16.3.3] 


where Q is the concentration of fuel in the stoichiometric 
mixture (mole fraction), D is the diameter of the pipe (m), L 
is the flame length (m), M n is the molecular weight of the 
fuel, M s is the molecular weight of the surrounding fluid 
(normally air), T t is the absolute adiabatic flame tempera¬ 
ture (K), T n is the absolute temperature of fuel in the pipe 
(K), and a t is the ratio of the number of moles of unreacted 
and reacted gas in the stoichiometric mixture. 

The shape of the flame envisaged in this treatment is an 
inverted cone with the apex at the orifice such that 


L 

D 


[16.3.4] 



Figure 16.17 Scheme of stretch of combustion wave in a 
flow field (after B. Lewis and von Elbe, 1961) (Courtesy of 
Academic Press) 


16.3.5 Flame stretch and wrinkling 

Two properties of the laminar combustion wave which are 
of particular importance in combustion theory are flame 
stretch and flame wrinkling. If a combustion wave enters a 
flow field where there are significant changes of velocity 
over a distance comparable with the width ri 0 of the wave, 
significant stretching of the flame occurs. If a flow line of 
velocity U intersects the Tf surface of the wave, as shown 
in Figure 16.17, the velocity of the flow line at a distance 
r/o along the line normal to this surface at the point of 
intersection is U+(dU/dy) r) 0 sin a. The ratio of the mass 
flows normal to this surface over the distance r] 0 is 1 + (dUj 
&y)(Vo/U) sin a and where the flow velocity is much greater 
than the burning velocity this reduces to 1 + (dU/dy)(ri 0 /U). 
The fractional increase, or stretch, is thus 


[16.3.6] 


where if is the Karlovitz number, which is thus a measure of 
the flame stretch. 

The parameter r\ 0 may be obtained from the heat balance 
in the combustion wave: 

- - 71 a ) [16.3.1 

The distance >/ 0 is taken as 


where Wis the diameter at the top of the flame (m). 

Another equation for the diameter of the flame is given 
by Baron (1954): 


Vo = (Ti - r u )/(dT/ck), [16.3.8] 

Then from Equations 16.3.7 and 16.3.8 


Z = 0.29s[ln(L/*)] 1/z 


[16.3.5a] % = k/cppvSu 


[16.3.9] 


and 

4, ax = 0.12/. at x = 0.61 A [16.3.5b] 

where x is the axial distance (m), Zis the flame diameter (m) 
and the subscript max denotes the maximum. 


where c p is the specific heat, S u is the fundamental burning 
velocity, p is the density, k is a constant and the subscript u 
denotes unburnt gas. 

If the flame stretch is sufficiently great, the flame is 
quenched. The Karlovitz number K, as a measure of flame 
stretch, is therefore also a criterion of quenching. 
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The Karlovitz number K may also be defined in terms of 
the critical velocity gradient for blow-off. The definition is 

K=gw 0 /S a [16.3.10] 

The flame stretch concept may also be applied to a sphe¬ 
rical combustion wave in stagnant gas. If a sphere diameter 
d of burnt gas exists with an unburnt outer shell thick¬ 
ness r/o, the ratio of the surface areas after and before 
combustion of this shell is 


many of the main compounds of interest. Certain reactions 
have proved of particular interest to investigators. For 
example, Semenov (1935) discusses the reactions of oxygen 
with hydrogen, carbon monoxide and hydrocarbons and of 
hydrogen with chlorine and bromine. B. Lewis and von 
Elbe (1961) also discuss the reactions of oxygen with 
hydrogen, carbon monoxide and hydrocarbons and those 
in the H2-CO-O2 system. The reactions in the hydrogen- 
bromine systems have been of particular interest, as 
discussed by Lovachev etal. (1973). 


_ x(d + 2f? 0 Pu/pb) 2 
nd 2 

+ 4) 7 oPjdPb 

The fractional flame stretch is then 


[16.3.11] 

[16.3.12] 


K = 4 %p u /dp b [16.3.13] 

Critical values of K for spark ignition are given by B. Lewis 
and von Elbe (1961) and lie mainly in the range 0.5-1.5. 

If in the combustion wave of a stoichiometrically unba¬ 
lanced mixture the diffusivity of the deficient component 
substantially exceeds that of the excess component, the gas 
mixture entering the wave stratifies so that there are alter¬ 
nate increases and decreases in the burning velocity. The 
wave becomes wrinkled and exhibits a cellular structure. 


16.3.6 Reaction kinetics and transport processes 

Chemical reaction and transport processes govern at the 
most fundamental level the process of combustion. There 
are available reaction kinetic schemes for the reaction of 


16.3.7 Thermal explosion theory 

Many problems in combustion involve the self-heating of 
a reactive mass in a defined volume. The theory that deals 
with this, thermal explosion theory, or simply thermal 
theory, is therefore important in combustion and has 
numerous applications. 

The concept of thermal explosion derives from Van’t Hoff 
(1884), who identified the condition for thermal ignition as 
one in which no equilibrium between the reacting system 
and its surroundings can exist. This was developed quali¬ 
tatively by Le Chatelier (1937), who characterized the pro¬ 
blem as one in which the variation of heat production is a 
curve and that of heat loss is a straight line, as illustrated in 
Figure 16.18. A quantitative treatment of thermal explosion 
theory was described in Chemical Kinetics and Chain Reac¬ 
tions by Semenov (1935), and developed by Semenov, 
Frank-Kamenetsky and Zeldovich (e.g. Zeldovich and 
Frank-Kamentsky, 1938; Frank-Kamenetsky, 1939a,b; 
Semenov, 1940). Accounts of thermal explosion theory are 
given in Diffusion and Heat Exchange in Chemical Kinetics 
(Frank-Kamenetsky, 1955) and Selfheating: Evaluating and 



Temperature 

Figure 16.18 Heat generation by and removal from a chemical reaction (after Semenov, 1935; Knox, 1967a) 
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Controlling the Hazards (Bowes, 1984) and by P. Gray and 
Lee (1967b) and Merzhanov and Averson (1971). 

The basic concepts of thermal explosion theory are as 
follows. For a mass subject to an exothermic reaction the 
unsteady-state heat balance is 


c P^ = kV 2T +Q 


= k 


[d 2 T_ d 2 _t tfr\ 
[dx 2 + df + dz^J 


+ Q 


[16.3.14a] 

[16.3.14b] 




Q = Q'pA exp( -E/RT) 116.3.15} 


where A is the pre-exponential factor, c is the specific heat 
of the reacting mass, E is the activation energy, k is the 
thermal conductivity, Q is the heat released per unit 
volume, O' is the heat of reaction per unit mass, t is the time, 
T is the absolute temperature, x, y and z are the distances 
from the centre of the hot spot in the x, y and z directions, 
respectively, p is the density and V 2 the Laplacian operator 
with respect to the distance x. 

The exponential term in Equation 16.3.15 may be 
approximated as follows: 

exp (-E/RT) « exp{~(E/RTo)[l — (T— 

[16.3.16] 

= exp{—(.E/i?T 0 ) exp {(E/RT%)(T - T 0 )}} 

[16.3.1?} 


where T a is the initial temperature. 

A dimensionless parameter 9 is defined as 

9 = ^(T-T 0 ) [16.3.18] 

Substituting from Equation 16.3.18 in Equation 16.3.17 
gives 

exp {-E/RT) = exp (-E/RT 0 ) exp 9 [16.3.19] 

Another dimensionless parameter <5 is defined as 

5 = ex P(-^ r “) I 16 - 3 - 20 ] 


where r is the semi-thickness or radius of the reacting 
volume. 

Then, defining two further dimensionless parameters 


i = x/r 
kt 

X opr 1 


[16.3.21] 

[16.3.22] 


Equation 16.3.14 becomes, in dimensionless form, 


^ = V z 0 + <5 exp 0 [16.3.23] 

where V 2 is now the Laplacian operator with respect to £. 


r, in dimensionless form, 
9 d 2 9 m d9 t 

+ + P 0 


where m = 0, 1 or 2 for a slab, cylinder or sphere, 
respectively. 

There are numerous assumptions that may be made con¬ 
cerning the geometry, the boundary conditions, the physi¬ 
cal properties and the reaction kinetics of the thermal 
explosion problem and there are numerous applications of 
the theory. This has given rise to a large literature. 

The application of the thermal explosion model to com¬ 
bustion problems is considered in this section, while its 
application to self-heating of solid materials is discussed in 
Section 16.6. 


16.3.8 Flammability limits 

It is convenient for design purposes to define flammability 
limits, but the question of whether such flammability lim¬ 
its are a fundamental physicochemical property has been 
the subject of some debate. Reviews of the fundamentals 
of flammability limits have been given by Egerton (1953), 
B. Lewis and von Elbe (1961), Lovachev et al. (1973), Lova- 
chev (1979) and Macek (1979). 

The determination of practical flammability limits is 
usually effected using the BM apparatus as described by 
Coward and Jones (1952 BM Bull. 503). In this apparatus it 
is found that the lower limit concentration is lower and the 
upper limit concentration is higher for upward than for 
downward propagation. Since for design purposes it is 
desirable to use the wider limits, Coward and Jones recom¬ 
mend the use of the flammability limits for upward 
propagation. 

In his review, Egerton states three conditions that a 
satisfactory theory of flammability limits should meet. It 
should predict (a) the existence of a lower limit, (b) the 
value of the lower limit concentration and (c) the value of 
the burning velocity at the lower limit. He discusses the 
relation between the flammability limit and the flame 
temperature attained at the limit. 

Egerton and Fowling (1948) have drawn attention to the 
relationship that exists, given complete combustion, 
between the lower and upper limits if a limit mixture 
requires a certain concentration of fuel to provide the tem¬ 
perature necessary for flame propagation. Provided 
allowance is made for the different specific heats of the two 
mixtures; the upper limit might then be estimated from the 
lower one. This approach is applicable only if combustion 
is complete. This is not the case for hydrocarbon-air 
mixtures. 

For the UFL Egerton and Fowling found the principal 
determining factor to be the heat of combustion per mole of 
mixture. Egerton states that the direction of propagation is 
important because of the effect of convection. The upward 
propagating flame is assisted by convection. 
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It is desirable to have some more fundamental method of 
measuring flammability limits than the standard tube 
method. Such a method is the flat flame method described 
by Egerton and Thabet (1952). This method appears better 
suited to the provision of fundamental data than the stan¬ 
dard method, although it is not suggested that it should 
replace the latter for practical determinations. Egerton 
(1953) presents data on the different limit flame tempera¬ 
tures obtained by the standard tube and flat flame meth¬ 
ods, as shown in Table 16.16. The temperature given by the 
latter is lower and more constant. 

Spalding (1957d) has presented a theory of flammability 
limits. He argues that a theory, which is capable of predict¬ 
ing the existence of a limit of flammability, needs to take 
account of heat loss. The novel feature of his theory is that it 
allows for heat loss by radiation. The theory for the laminar 
one-dimensional flame is thus brought into line with the 
theoretical treatments of other types of flame, each of 
which exhibits a zone of stable operation limited on one 
side by chemical kinetics and on the other by heat loss to the 
surroundings. The theory is not dependent on any parti¬ 
cular assumptions about the dependence of the reaction 
rate on concentration and temperature, other than that the 
dependence of the rate should be steeper than that for the 
heat transfer. Spalding found that at the flammability limit 
there is a small but finite burning velocity. In addition, he 


Table 16.16 Flammability limits: lean limit flame 
temperatures from standard tube and flat flame methods 
(after Egerton, 1953) (Courtesy of the Combustion Institute) 


Gas 

Lower 
limit (%) 

Flame temperature (°C) 

Tube method 

Flat flame method 

Methane 

5.26 

1254 

1222 

Propane 

3.10 

1383 

1200 

w-Butane 

1.93 

1445 

1233 

«-Pentane 

1.62 

1485 

1158 

w-Heptane 

1.26 

1569 

1228 


showed that there exist two burning velocities, of which 
only the upper one is stable in normal circumstances. 

Other workers who have given theories of flammability 
limits based on heat radiation include Zeldovich (1941) and 
Rozlovsky (1970). Later workers have tended to argue 
that the heat radiation theory is difficult to reconcile with 
experimental phenomena.The work of Egerton and Fowling 
(1948), showing that heat radiation loss is small, is often 
quoted. 

The contrasting views on flammability limits are descri¬ 
bed by Dixon-Lewis and Isles (1959). Although the limits 
are often treated as fundamental properties, they state that 
the limits obtained experimentally are essentially convection 
or quenching limits, depending on the conditions. 

In their review of flammability limits, B. Lewis and von 
Elbe (1961) emphasize that, despite the theoretical pro¬ 
blems, the experimentally determined limits have proved 
to be reliable for practical purposes. They state that there is 
no solution to the theoretical problem of flammability limits 
in terms of adiabatic one-dimensional propagation. 
Spalding’s model represents the only feasible approach in 
terms of one-dimensional propagation, but the attribution 
of heat loss to radiation is not regarded as satisfactory by 
experimentalists, who prefer to believe that heat absorp¬ 
tion by the unburned gas is the important effect. 

Lewis and von Elbe illustrate the effect of the direction of 
propagation by the data shown in Table 16.17. They refer to 
the work of Linnett and Simpson (1957), who draw attention 
to the role of convection. Evidently, convection currents are 
generated which are capable of quenching the flame. Such 
convectional quenching implies that heat is transferred to 
the unburned gas. 

Lewis and von Elbe suggest that the mechanism of such 
quenching may be flame stretching. Stretching leads to 
extinction if the stretch exceeds a critical value of the 
Karlovitz number. The latter is inversely proportional to the 
burning velocity. Thus flames with low burning velocity, 
such as occur at the flammability limit, are particularly 
susceptible to stretch and hence extinction. These effects 
accord with the existence of narrow limits for downward 
propagation of the flame, since flame stretch is greater for 
downward propagation. 


Table 16.17 Flammability limits: the effect of the direction of flame propagation (B. Lewis and von Elbe, 1987; after 
A.G. White, 1922, 1924) (Courtesy of Academic Press) 


Mixture Direction of propagation Fuel concentration Stoichiometric fraction 

(%) ratio 




Lower 

Upper 

Lower 

Upper 

Methane-air 

Upwards 

5.35 

14.85 

0.54 

1.7 


Horizontal 

5.40 

13.95 

0.54 

1.6 


Downwards 

5.95 

13.35 

0.60 

1.5 

Ethane-air 

Upwards 

3.12 

14.95 

0.54 

2.9 


Horizontal 

3.15 

12.85 

0.54 

2.5 


Downwards 

3.26 

10.15 

0.56 

1.9 

Pentane-air 

Upwards 

1.42 

8.0 

0.55 

3.3 


Horizontal 

1.44 

7.45 

0.56 

3.1 


Downwards 

1.48 

4.64 

0.57 

1.9 

Benzene—air 

Upwards 

1.45 

7.45 

0.53 

2.9 


Horizontal 

1.46 

6.65 

0.53 

2.6 


Downwards 

1.48 

5.55 

0.54 

2.1 
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They also discuss the susceptibility of the flammability 
limits to diffusional stratification. Experiments by Coward 
and Brinsley (1914) in hydrogen—air mixtures with 
4.1-10% hydrogen show that some hydrogen remains 
unburned. This effect has been explained by Goldmann 
and co-workers (Goldmann, 1929) as being due to diffu¬ 
sional stratification. Such stratification leads to local dif¬ 
ferences in concentrations and to locally increased burning 
velocities. 

Lewis and von Elbe also mention that, according to the 
work of Markstein, upward flame propagation tends to 
promote cell formation. Cell formation, and Markstein’s 
theory, is discussed below. 

A further discussion of preferential diffusion is given by 
Furno et al. (1971). Coward and Jones (1952 BM Bull. 503) 
describe work on hydrogen—air mixtures in which burning 
is propagated upward by the buoyancy of individual fla- 
melets and explain this by preferential diffusion. When the 
deficient reactant, in this case hydrogen, is the faster dif¬ 
fusing one, a flame zone concave to the burned gas will be 
enriched in this reactant. In downward propagation flame 
surfaces of small curvature are opposed by buoyancy, and 
the lean limit concentration is thus higher. 

Furno et al. refer to the quantitative treatment of pre¬ 
ferential diffusion given by Spalding (1955). He observed 
that the concentrations most easily ignited by electrostatic 
spark ignition were 0.9 and 1.8 stoichiometric ratios for 
methanol-air and heptane-air mixtures, respectively, and 
that the ratio of these two figures is close to the ratio (DJ 
D f f^ where D f and D a are the diffusivities of the fuel and 
oxygen, respectively. Spalding suggests that the actual 
fuel-oxygen ratio in the developing flame kernel is stoi¬ 
chiometric. Furno et al. extend this argument and suggest 
that the ratio of the limits for upward and downward pro¬ 
pagation may be given by this group also. They state that 
the data available to verify this hypothesis are sparse, but 
quote the results shown in Table 16.18. 


Table 16.18 Stoichiometric ratios? of most easily ignited 
mixtures and of limit mixtures in upward and downwards 
propagation (after Furno et al., 1971) (Courtesy of the 
Combustion Institute) 


Mixture 

(DolDff* 

Optimum 
ratio for 
ignition 

Ratio of 
upwards to 
downwards 
propagation limit 

Methane-air 

0.96 

0.9 

Upper limit 

1.02 

Ethane-air 

1.29 

1.2 

1.24 

Propane-air 

1.44 

1.3 

1.43 

Butane-air 

1.55 

1.5 

1.41 

Pentane-air 

1.63 

- 

1.72 

Hexane-air 

1.70 

1.7 

— 

Heptane-air 

1.78 

1.8 

- 

Benzene-air 

1.52 

- 

1.46 

Hydrogen—air 

0.54 


Lower limit 

0.46 

Methane-air 

0.96 

0.9 

0.92 


a Fuel concentration/stoichiometric fuel concentration. 
b Df, diffusivity of fuel; D 0 , diffusivity of oxygen. 


Furno etal. also discuss the limit temperatures. It would 
be helpful if the rich limit temperature could be taken to be 
the same as the lean limit temperature. This would be 
equivalent to saying that in heavy hydrocarbon-air 
mixtures downward propagation reaches its limit at a 
stoichiometric ratio of about 1.9. 

Several reviews of flammability limits have been given 
by Lovachev and co-workers (Lovachev, 1971, 1979; 
Lovachev et al., 1973). Like earlier reviewers, Lovachev 
(1971) states that a theory based on radiant heat loss does 
not account for the experimental phenomena and prefers to 
explain flame extinction as due to heat loss into the 
unburned gas due to convection flows. 

Lovachev et al. (1973) emphasize the role of convection. 
They state that agreement exists that convection is the 
reason for the difference between upward and downward 
propagation, but not on the mechanisms involved. 
They refer to three proposed mechanisms: Drozdov and 
Zeldovich (1943) have suggested unequal flame speeds and 
heat transfer; Linnett and Simpson (1957) have suggested 
differences in the flame surface; and B. Lewis and von Elbe 
(1961) have suggested flame stretching. 

They quote a relation, derived by Lovachev (1971), for the 
flame velocity at the flammability limit. They discuss the 
question of whether the upward or downward propagation 
limit is more appropriately regarded as the true flamm¬ 
ability limit. They acknowledge the practical reasons why 
Coward and Jones adopted the upward propagation limit, 
but opt for the downward propagation limit as the more 
fundamental. 

They state that for hydrocarbon-air mixtures the lean 
limit flame temperature is approximately constant. Differ¬ 
ent experimental methods give different values, those 
obtained by the flat flame method being the lowest quoted. 
They draw attention to the results of Gibbs and Calcote 
(1959), who found that for such mixtures the flame speeds 
are similar. This suggests that the heat release and the 
flame temperature should also be similar. 

Lovachev (1979) outlines the various factors that influ¬ 
ence the measured flammability limits, which he terms the 
ignition scheme. He states that the flammability limits 
determined in a large chamber of volume 8 m 3 are wider 
than those given by the standard tube method. Thus there 
are some compounds which are classed as flammable by 
the former method, but which would be classed as non¬ 
flammable by tests conducted in the latter one. He describes 
experiments showing the buoyant deformation of the 
flame kernel in large confinements. The illustrations given 
show a transition from a sphere to a vertically oblated 
sphere with an inflection at its based, somewhat kidney¬ 
shaped. 

Lovachev also describes the effect of turbulence on 
flammability limits and quotes several pieces of work that 
illustrate this. These include work by K.N. Palmer and 
Tonkin (1961) on propane-air mixtures in horizontal tubes. 
At flow velocities of 0.5 m/s the limits widened, but with a 
four-fold increase they narrowed again. He states that the 
experimental studies carried out on turbulence effects 
have been done with tubes that are too narrow and ignition 
sources that are too weak. He points out that flammability 
limits given in handbooks are for non-turbulent conditions, 
but that in practice turbulence effects are not negligible. 

Macek (1979) discusses the concept that extinction 
occurs when the burning velocity is so low that it is over¬ 
come by the dissipation processes and refers to the 
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accounts of these processes by Burgess (1969) and Burgess 
and Hertzberg (1975). 

The effect of pressure on flammability limits is discus¬ 
sed by Egerton (1953), B. Lewis and von Elbe (1961) and 
Lovachev efal. (1973). 

The temperature effect on flammability limits is discus¬ 
sed by Egerton (1953) and Lovachev et al. (1973). 

Other aspects of flammability limits include the effect of 
additives and of inhibitors. Additives are discussed by 
B. Lewis and von Elbe (1961), and inhibitors are considered 
by Lovachev et al. (1973) and Lovachev (1979). 

Further aspects of flammability limits are considered in 
Sections 16.3.10 on burning velocity and 16.3.11 on 
quenching. 

16.3.9 Ignition phenomena 

Ignition of a flammable mixture be effected either by rais¬ 
ing the temperature of the bulk gas until it ignites sponta¬ 
neously or by local ignition of a part of the gas. The modes 
of ignition considered here are principally: 

(1) auto-ignition; 

(2) local ignition; 

(a) spark ignition, 

(b) hot surface ignition, 

(c) friction and impact ignition, 

(d) hot gas jet ignition, 

(e) hot particle ignition, 

(f) flame torch and jet ignition, 

(g) compression ignition. 

Auto-ignition 

Auto-ignition, or spontaneous ignition, is of practical inter¬ 
est not only in relation to hazards, but also in combustion 
systems such as gas engines and turbines. Auto-ignition, 
though simple in concept, needs careful definition. A defi¬ 
nition of such ignition has been given by Sage and Weinberg 
(1959), who state that if the temperature of an infinite volume 
of reactants at constant pressure is raised instantaneously 
and homogeneously above some critical value and main¬ 
tained there, an explosion will occur homogeneously 
throughoutthevolume,thusforestallingflamepropagation. 
As these authors point out, available AITdata are based on 
experiments far removed from the conditions of this defini¬ 
tion. Under the conditions described ignition can occur even 
if the concentration of the gas mixture is outside the normal 
flammability limits. These limits constrain flame propaga¬ 
tion, but in this case the ignition occurs homogeneously 
throughout the mixture and propagation is not involved. 

Measurement of the AIT is usually carried out by heating 
the flammable gas mixture in a spherical vessel. With this 
method there is found to be an effect of the surface/volume 
ratio, the AIT decreasing as the vessel volume increases. 
This effect was observed by Setchkin (1954) and has been 
found by other workers. 

A method of measurement that matches more closely 
their definition of the AIT has been described by Sage and 
Weinberg (1959). The method is a two-stage one. A series of 
experiments is conducted in which, in the first stage, the 
flammable gas mixture is brought to a temperature some¬ 
what below the ignition temperature and, in the second 
stage, a small quantity of energy is added which ignites the 
gas. The AIT is found by extrapolation of these results to 
determine that temperature for which no additional energy 
is required. 


The application of thermal theory to spontaneous igni¬ 
tion has been discussed by several workers, including 
P. Gray and Harper (1959a,b), Kuchta, Barkowiak and 
Zabetakis (1965) and Cullis and Foster (1973). For a sphe¬ 
rical vessel with ignition at the the relation between the 
vessel radius r and the absolute ignition temperature T is, 
to a first approximation, 

Inr cx 1/T [16.3.26] 

It has been shown for a large number of fuels that if the AIT 
is plotted against vessel volume the lines pass through a 
single point, as shown in Figure 16.19 (Coffee (1982b), 
based on work by Beerbouwer (1974)). 

A comparison of the values of the ignition temperature 
obtained in work using heated vessels (auto-ignition), hot 
wires and hot gas jets has been made by Kuchta, Cato and 
Zabetakis (1964). Their results are shown in Table 16.19. The 
values of the ignition temperature obtained with the Pyrex 
Erlenmeyer flask are appreciably lower than the other values. 

The variation of ignition temperature with heat source 
dimensions has been discussed by Kuchta, Bartkowiak 
and Zabetakis (1965). They state that thermal theory pre¬ 
dicts that the ignition temperature varies inversely with 
the logarithm of the heat source size, as in relation 16.3.26. 
While this behaviour was observed for one material stu¬ 
died (engine oil) over the whole range of surface areas, the 
other hydrocarbons tested exhibited in large vessels an 
ignition temperature appreciably lower than that predicted 
by this equation. 

The variability of values of the AITgiven in the literature 
has already been mentioned.This is illustrated by the values 
for methane quoted by C. Robinson and Smith (1984), which 
range from 537°C to 748°C.They state that the convention is 
to quote the lowest value found in the literature, hut in the 
case of methane they could not determine the origin of the 
widely quoted value of 537°C and give the value of 601°C 
determined by themselves as the lowest of those for which 
experimental details are available. The AITof mixtures has 
been studied by Cullis and Foster (1974). They found that 
for the binary mixture studied (rc-decane and 2,2,5- 
trimethylhexane) the ignition tendency is controlled largely 
by the more ignitable component. It was necessary to go 
to nearly 50% of the less ignitable component before the 
ignition temperature started to rise appreciably. 


Ignition delay time 

In spontaneous ignition there is an induction period, or 
ignition delay, before ignition occurs. This delay is of 
interest both theoretically in relation to reaction kinetics 
and practically in relation to ignition in combustion sys¬ 
tems. The ignition delay may be as little as a fraction of a 
second at higher temperatures, or several minutes close to 
the AIT. 

Ignition delay decreases with increasing temperature. 
Semenov (1959) has given the following relation: 

\m= k ^ + k 2 [16.3.27] 

where E is the apparent activation energy, r is the time 
delay and k\ and k 2 are constants. 

Ignition delay has been studied by many other workers, 
including Brokaw and Jackson (1955), Ashmore and Levitt 
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Figure 16.19 Effect of vessel volume on the auto-ignition temperature (Reproduced with permission from Safety and 
Accident Prevention in Chemical Operations. 2nd ed., by H.H. Fawcett and W.S. Wood, ©, 1982, John Wiley and Sons 
Inc.) 


(1959), P. Gray and Harper (1959a,b),Voevodsky (1959) and 
Bascombe (1967). For propane-air mixtures with flowing 
gas, Brokaw and Jackson found the following variations of 
ignition delay with oxygen concentration and pressure p: 


1 oc [02] 1/4 [16.3.28] 

x \np [16.3.29] 

but did not find a constant activation energy relation with 
temperature. 

Spark ignition 

Turning to local ignition, it is convenient first to consider 
spark ignition. Here the ignition energy is determined by 


using the spark between two electrodes to ignite the flam¬ 
mable gas mixture. Apart from its implications for hazards, 
spark ignition has long been of practical interest for com¬ 
bustion in car engines and jet engines. A more recent 
aspect is lean burn engines for cars. 

The results obtained for spark ignition energy are criti¬ 
cally dependent on the electrode and spark arrangements. 
In early work this was not fully appreciated. In particular, 
the electrodes were usually too close together so that 
quenching occurred and the results obtained were too high. 

It was suggested in early work, such as that of 
B.W. Bradford and Finch (1937), that there was a specifi¬ 
cally electrical effect involving excitation of reactant 
molecules, but this suggestion was rejected by von Elbe 
(1953) in favour of a thermal effect. 

A model of spark ignition has been developed by von 
Elbe and Lewis (1949) and von Elbe (1953) and is described 
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Table 16.19 Ignition temperatures of flammable gas mixtures with different heated surface areas (Kuchta, Cato 
and Zabetakis, 1964) (Courtesy of Combustion and Flame) 


Substance 


Ignition temperature (°C) 



Pyrex Erlenmeyer 
flask a (2.2 cm radius, 

13 cm long) 

Cylindrical Pyrex 
vessel (0.5 cm radius, 

15 cm long) 

Inconel wire 

(0.5 cm radius, 5 cm long) 

>10cir 

1 (0.5 cm radius, 
l long) 

Methane 

537 

745 

- 

1040 c 


Ethane 

515 

580 

— 

840 c 


w-Butane 

405 

630 

- 

910 c 


ra-Hexane 

234 

605 

670 

765 


n- Octane 

220 

585 

660 

755 


w-Decane 

208 

585 

650 

750 


Benzene 

562 

685 

- 

1020 d 


Hydrogen 

554 

635 

- 

640 c 



a Minimum AIT values obtained in a 200 cm 3 Erlenmeyer flask equivalent cylinder radius 2.2 cm. 
b Hot air jet injected into fuel-air mixture, except as noted by footnotes (c) and (d). 
c Hot air jet injected into fuel only. 
d Hot nitrogen jet injected into fuel—air mixture. 


by B. Lewis and von Elbe (1961). In simple terms, the 
argument is that the volume heated needs to exceed a cer¬ 
tain critical size, otherwise the temperature gradient is too 
great and heat is lost too fast for combustion to be sus¬ 
tained. There is a MIE needed to overcome quenching by 
the unburnt gas. 

More formally, the theory envisages a preheat zone and a 
reaction zone. A heat balance is taken between a plane x in 
the combustion wave and the plane b where combustion is 
complete and, assuming that the heat transferred by mass 
diffusion is less than that transferred by heat conduction, 
the enthalpy per unit mass within the wave is larger than 
that at the boundary b of the burnt gas or that at the 
boundary u of the unburnt gas, the two latter being equal. 
Thus there is a wave of thermal energy, or excess enthalpy, 
travelling with the combustion wave. It is this excess 
enthalpy which ensures that the temperature gradient is 
such that heat flow into the preheat zone balances the heat 
liberated in the reaction zone. When a flame grows spheri¬ 
cally the combustion wave requires from some external 
source a continuous supply of excess enthalpy in propor¬ 
tion to the growth of its surface, until the wave has effec¬ 
tively become a planar one. On this theory the MIE is equal 
to the excess enthalpy requirement of the minimum flame. 

Von Elbe defines the MIE H in terms of the excess 
enthalpy per unit area h and the critical diameter d at which 
the flame can propagate unaided: 

H = n d 2 h [16.3.30] 

There are a number of models of spark ignition, including 
those of Fenn (1951), Khitrin and Goldenburg (1957), Mayer 
(1957), Swett (1957), Penner and Muffins (1959), Rose and 
Priede (1959a,b), Ballal and Lefebvre (1975a), Adelman 
(1981), Maly (1981) and Sher and Refael (1982). Adelman 
gives a review of spark ignition models. 

Fenn (1951) derives the critical diameter of the spark kernel 
by equating the heat released in the volume of the kernel to 
that transferred across its surface. The MIE H is then 

H = Knd ^ p ( Ti - T 0 ) [16.3.31] 


where T t is the absolute adiabatic flame temperature and K 
is a constant. He states that the value of K is probably less 
than unity. 

The model of Khitrin and Goldenberg (1957) is based on 
the thermal theory. Swett (1957) used long duration dis¬ 
charges and his treatment assumes that only part of this 
energy contributes to the ignition. 

Ballal and Lefebvre (1975a) consider a spark kernel of 
the shape shown in Figure 16.20. It is assumed in this model 
that the heat release occurs only within the flame front, 
rather than throughout the whole kernel volume. The cri¬ 
terion for ignition is that the width d c of the kernel is just 
equal to twice the width <) L (laminar) or dp (turbulent 
regime) of the flame zone: 

dc = 2<5l Laminar regime [16.3.32a] 

• 2<5 t Turbulent regime [16.3.32b] 

The authors give correlations for d c for stagnant gas con¬ 
ditions and for laminar and turbulent flow regimes. For the 
stagnant gas condition 



where Sl is the laminar burning velocity. 

The model given by Adelman (1981) takes account not 
only of the heat balance on the spark kernel but also of the 
rate of growth of the kernel. Adelman states that spark ker¬ 
nels with the same spark energy input show identical growth 
in inert and combustible mixtures up to the critical point and 
that it is the spark discharge itself rather than combustion, 
which is responsible for kernel growth up to this point. 

In his review Adelman relates the critical diameter of the 
spark kernel to the flame thickness <5 l and gives 



S L 


[16.3.34a] 

[16.3.34b] 
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d c = 2 6 t 


Figure 16.20 Idealized model for the formation of a spark 
kernel (Ballal and Lefebvre, 1975a). d q quenching 
distance; t s spark duration; U, How velocity (Courtesy 
of the Combustion Institute) 


where a(= k/c p p) is the thermal diffusivity. He defines a 
characteristic flame dimension / L as the value of the group 
os/Sl at ambient conditions and states that the flame thick¬ 
ness is about 10 Z L . Critical radii tend to be of the order 
5 Z L —8 / L and thus about 0.5-0.8 of the flame thickness. 

Maly (1981) distinguishes three modes of spark dis¬ 
charge - breakdown, arc and glow - and gives an ignition 
model. He emphasizes the importance of the breakdown 
mode. He states that ignition depends not so much on the 
total energy supplied but rather on high energy density 
deposition over a short time. 


Minimum ignition energy 

Work on measurement of ignition energy for spark ignition 
includes that of Blanc et al. (1947, 1949) and Moorhouse, 
Williams and Maddison (1974). The former determined 
ignition energies of hydrocarbon—oxygen-nitrogen mix¬ 
tures over a range of concentrations, while the latter 
determined MIEs energies. 

The problems in making such measurements have been 
discussed by a number of investigators. Rose and Priede 
(1959a) state that MIEs obtained by Lewis and von Elbe are 
some 1/100 of those obtained in early work in which the 
electrodes were too close together so that quenching could 
occur. Moorhouse, Williams and Maddison (1974) state that 
to obtain reproducible results they found it necessary to 
recondition the electrodes after about 15 trials. 

Moorhouse,Williams and Maddison discuss the effect on 
the MIE of molecular structure. 


The effect of turbulence on the MIE has been investi¬ 
gated by de Soete (1971). He states that turbulence causes an 
increase in the MIE, due mainly to an increase in flame 
front thickness, but also to a decrease in the fraction of 
energy that is effective. 

Another study of the effect of turbulence is that of Ballal 
and Lefebvre (1975a). They state that the overriding effect 
of turbulence is heat loss by diffusion. They found that the 
MIE increases with increase in velocity and in turbulence 
intensity. 

The effect of pressure and temperature on the MIE E is 
correlated by Moorhouse, Williams and Maddison (1974) 
as follows: 

E = AF"T P [16.3.35] 

where P is the absolute pressure, T is the absolute tem¬ 
perature, A is a constant and a and /? are indices. The values 
of the indices a and /I were approximately 2 and -2, 
respectively. 

Measurements of hot wire ignition energies have been 
made by number of workers, including Stout and Jones 
(1949). Different combinations of excitation current and 
time were used and the ignition energy was found to 
increase as the current was decreased and the time 
increased. A linear relation between the MIE and excitation 

E = A + Bt [16.3.36] 

Hot surface ignition 

Another mode of local ignition is contact with a hot surface. 
The AIT sets a lower limit to the temperature at which a hot 
surface may cause ignition, but it has long been known that 
in most situations of practical interest the hot surface tem¬ 
perature required to cause ignition is considerably higher 
than the AIT. 

Interest has therefore centered on the difference between 
the hot surface ignition temperature and the AIT, or tem¬ 
perature excess. Research has shown that this temperature 
excess is a function of the material, area and geometry of 
the hot surface, of the gas and gas concentration, and the 
fluid flow and heat transfer conditions. 

Some gases that have been widely used in work on hot 
surface ignition include methane, propane, butane and 
pentane. The AITs of these gases are 595, 470, 360 and 
285°C, respectively. 

Guest (1930 BM Tech. Pap. 475) investigated the ignition 
temperature of methane—air mixtures using various hot 
surface materials and areas up to 108 mm, and obtained 
values of 897-1420°C. 

The effect of the area of the hot surface has been studied 
by Rae, Singh and Danson (1964), who exposed a methane- 
air mixture to hot surfaces of different size. Some typical 
results are shown in Figure 16.21. The work on hot particles 
by Silver (1937) and Paterson (1939-), described below, 
shows a similar decrease of the temperature excess as the hot 
surface area increases. 

The effect of gas velocity has been studied by Mullen, 
Fenn and Irby (1949), who were concerned with the ignition 
of gas flowing past heated rods at high velocity as in a jet 
engine. Working with pentane-air mixtures, they found 
that the temperature excess increased with gas velocity. 

Gas velocity has also been investigated by Goodall and 
Ingle (1967), who studied the ignition of kerosene in a wind 
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Area of hot surface (mm 2 ) 

Figure 16.21 Hot surface ignition temperature: effect of hot surface area on ignition temperature (Laurendeau, 1982; 
after Rae, Singh and Danson, 1964) (Courtesy of Combustion and Flame) 


tunnel. The hot surface temperature required to cause 
ignition in the experiments was as follows: 


Gas velocity (m/s) 

Surface 


temperature for 


ignition (°C) 

0.3 

405 

1.5 

660 

3.0 

775 


The AITof kerosene is given as 208—257°C, depending on 
the method of measurement 

A number of workers have studied ignition of a flam¬ 
mable gas—air mixture on a vertical plate. A criterion 
widely used in this work has been the van’t Hoff criterion 
that ignition occurs when the temperature gradient normal 
to the hot surface at some point becomes zero. Investiga¬ 
tions have been done under forced convection by Toong 
(1957) and under natural convection by Ono et al. (1976). 

L.D. Chen and Faeth (1981a) found that the zero tem¬ 
perature gradient condition is not always the appropriate 
one, that the lume above the hot surface influences ignition 
and needs to be taken into account, and that near limiting 


conditions there needs to be a substantial distance above 
the surface for the deflagration wave to develop so that 
quenching surfaces may suppress the deflagration. 

Sharma and Sirignano (1969,1970) have studied other 
geometries. Bull and co-workers have conducted an exten¬ 
sive investigation of the parameters influencing hot 
surface ignition. 

Hot surface ignition is essentially a two-stage process, 
with initiation of a cool flame in the first stage followed by 
‘hof ignition’. A distinction is made between ignition and 
propagation. Propagation is confined between the flamm¬ 
ability limits, but auto-ignition is not so bounded. In con¬ 
stant volume tests substantial, rapid pressure rises have 
been obtained with very rich mixtures. 

Bull has conducted experiments using a parallel plate 
reactor (D.C. Bull and Quinn, 1975; D.C. Bull, 1977). In this 
apparatus the hot surface is placed above a cold surface so 
as to limit heat transfer to the conduction mode. Studies 
were conducted on propane, butane and hexane, and igni¬ 
tion diagrams for these gases obtained. The absolute 
results depended on the design of the apparatus, but cer¬ 
tain trends emerged. A typical ignition diagram is shown 
in Figure 16.22. The figure shows the effect of the surface 
temperature. Another result of this work is to demonstrate 
that if there is even a modest temperature gradient normal 
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Figure 16.22 Hot surface ignition temperature: ignition temperature boundaries for selected fuel-air mixtures in a parallel 
plate reactor (D.C. Bull, 1977). Plate separation 50mm ‘hot’ and ‘cold’plates at the same temperature - see text 
(Courtesy of DECHEMA) 


to the hot surface, a much higher temperature excess is 
required for ignition. 

D.C. Bull, Cairnie et al. (1980) have also described 
research directed at understanding of the influence of fluid 
flow on hot surface ignition. Experiments were done on 
ignition by a hot vertical plate under laminar flow condi¬ 
tions. These conditions are favourable for experimentation 
and modelling and also approximate to the practical cases 
of a hot vertical surface or a hot large diameter pipe. The 
work showed that as the gas flows over the vertical surface 
it undergoes self-heating. Figure 16.23 gives the results 
obtained for a non-reacting gas and for a reacting gas. 

The authors found that their initial model with reaction 
kinetics based on the Arrhenius equation was deficient. It 
predicted thermal runaway when the van’t Hoff criterion of 
zero temperature gradient is satisfied, but this did not fit 
the experimental results. A second, more complex model, 
based on the acetaldehyde kinetics model, described below, 
was more successful. Figure 16.24 shows some predictions 
given by this latter model. Bull and Grant (D.C. Bull and 
Grant, 1975; D.C. Bull, 1977) have investigated ignition by a 
hot horizontal pipe, using two concentric pipes. They found 
that there was a region of high temperature gradient at the 
hot inner pipe, then a region of nearly constant tempera¬ 
ture, then a cool region at the cold outer pipe. Ignition 
occurred in the region of nearly constant temperature. They 
derived a model, correlating their results in terms of the 
ratio of the pipe diameters, the Rayleigh number and the 
temperature across the annular gap. 

Work was also done to investigate ignition by a hot 
exhaust pipe in the open air. The model showed that for 
ignition to occur there would need to be a very high tem¬ 
perature excess with high convective flows and ignition in 


the wake of the pipe. Under these conditions the residence 
time in the hot region may be less than the induction time. 

Work on the development of a model for hot surface 
ignition has been described by Harrison and Cairnie and 
co-workers (A.J. Harrison and Cairnie, 1988; A.J. Harrison 
et al., 1988). These authors have developed a chemical reac¬ 
tion model for the hot surface ignition of acetaldehyde-air 
mixtures. The full model is a 20-reaction model, but has 
been simplified successively to 8-, 5- and 2-species models. 
Some success has been achieved in describing the initiation 
of cool flame behaviour for hot vertical plate and con¬ 
tinuous stirred tank reactor configurations. Below about 
500°C, the ignition process depends critically on a build 
up of intermediate compounds. This indicates that the 
one-step ignition model often used is inappropriate. 

Bartknecht (1988) has described work on ignition by 
steel pins heated by rubbing against a steel wheel. The pins 
were 6 and 8 mm in diameter with heated surfaces of area 
2.9 and 4.0 cm 2 , respectively. The lowest temperatures 
that he reports for ignition are 1248°C for methane and 
propane, and 1169°C for butane. 

Work on ignition by heated rods has been described by 
Adomeit (1965), who investigated, in particular, ignition 
delay. 

Friction and impact ignition 

If one body strikes another, ignition may occur by impact or 
friction. In either case the ignition occurs as a result of a 
rise in surface temperature. If one body strikes another 
normal to its surface, there is impact but little friction. 
Impact causes a surface temperature rise in two ways 
(Bowden and Tabor, 1954). Kinetic energy is converted to 
heat. This causes a surface temperature rise, which may 
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Distance normal to plate, y (mm) 

Figure 16.23 Hot surface ignition temperature: boundary layer temperature profiles (D.C. Bull et al., 1980). (n) 
experimental values for air (non-reacting flow); (o) experimental values for 7.1% diethyl ether- mixture (reacting flow); and 
(-) theoretical values for air. Plate temperature 623 K; distance up plate 0.1 m. (Reproduced with permission) 


lead to exothermic oxidation of the surface resulting in a 
further temperature rise. The second of these effects tends 
to predominate. 

The surface temperature rise depends on the oxidation 
characteristics and the thermal conductivity and does not 
simply correlate with the energy of impact. The heat gen¬ 
erated hy oxidation is highest for easily oxidizable metals 
such as iron and aluminium. The heat of oxidation of iron is 
several times that of copper and its thermal conductivity is 
less; the surface temperature rise of iron exceeds that of 
copper. 

If one body is pressed against the surface of another and 
made to move, there is friction and this causes a surface 
temperature rise. If the first body strikes the second at an 
angle, there is a combination of impact and friction, which 
is described as frictional impact. 


It has long been known that striking rusty steel covered 
with aluminium paint may produce incendive sparks. The 
effect is due to a chemical reaction, known as the thermite 
reaction. In this reaction the temperature can reach 3000°C. 
Following a study in 1941 by the Safety in Mines Research 
Board, which showed that no sparks were obtained unless 
the steel surface was rusty and that the effect varied with 
the type of paint, work was done by Kingman, Coleman and 
Rogowski (1952) to define more closely the conditions 
under which this effect occurs. Using both ferrous and non- 
ferrous strikers, they confirmed that sparks occurred only 
if rust was present. They found that no oil bound paint gave 
sparks unless the specimen had been preheated to at least 
150°C. Cellulose nitrate paints, however, gave sparks after 
preheating to 100°C. In an appended note, HM Senior Che¬ 
mical Inspector of Factories stated that the earlier report 
had given rise to exaggerated fears and that aluminium 
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Figure 16.24 Hot surface ignition temperature: theoretical boundary layer temperature profiles in a parallel plate reactor. 
6 = (T - T X )/AT; r] = [(gAT^p 00 )/(4T 00 p% ) )]' u lf y dy (D.C. Bull et al., 1980). Reproduced with permission 


paint could be used in hazardous areas provided cellulose 
nitrate based paints were avoided and that no aluminium 
paint, whatever its base, should be used if it was likely to be 
heated to 150°C. A review of ignition by friction and impact 
has been given by F. Powell (1969), with particular refer¬ 
ence to ignition of firedamp in coal mines. He states that 
frictional heating, usually by coal cutting machines, is the 
largest single cause of ignition in British mines. With 
regard to surface temperature rise he states that impact 
normal to the surface tends to give a relatively small surface 
temperature rise, that sliding friction gives surface tem¬ 
peratures sometimes approaching the melting points of the 
two materials and that frictional impact sometimes gives 
surface temperatures equal to the melting points. He 
reviews impact or rubbing between rocks, impact or sliding 


of metals on rocks, impact or rubbing between metals, and 
grinding and drilling operations. 

In a study of impact of metals on metals, Titman and 
Wynn (1954) ignited methane-air mixtures with steel balls 
shot at steel and aluminium targets. Burgess and Wheeler 
(1929) were able to ignite methane-air mixtures with a 
steel locomotive wheel rubbing on steel rails, but only by 
using a shield to concentrate the sparks. 

Powell describes extensive work in which ignition of 
mainly methane-air mixtures has been obtained by the 
impact of light alloys such as aluminium. In most cases 
ignition was by the thermite reaction. It is characteristic of 
light alloys that they tend to give a smear on rusty steel. 
Even if ignition does not occur at the time, a glancing blow 
from a hard object at some later time may produce the 
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thermite reaction and cause ignition. For this reason the 
use of light alloys in British mines is severely restricted. 
However, ignitions have been obtained with light alloys 
where neither rust nor steel were involved. W.G. Thomas 
(1962) ignited methane-air mixtures by shooting alumi¬ 
nium pellets at clean steel targets. In an investigation of an 
explosion in a ship’s tank, Rae (1965) obtained ignitions 
of methane-air mixtures by dropping brass onto partly 
consumed magnesium anodes. 

Ignition by the frictional impact of steel on rock has been 
studied by Blickensderfer (1975) in connection with igni¬ 
tion by coal-cutting machines. In severe impact a smear of 
molten metal is deposited on the rock. Most of the impact 
energy is converted to heat at the interface. This hot smear 
has the potential to ignite methane—air mixtures. In 
experimental work in which a metal object representing a 
cutting tool was secured to a flywheel and made to impact 
on rock, it was found that the impact energy had little effect 
on the probability of ignition, but that the impact speed had 
a strong effect. Hot streak temperatures of 1400°C were 
obtained. The effect of an increase in the impact speed was 
to increase the area rather than the temperature of the hot 
surface. This work includes a model of hot smear ignition. 

Ignition of methane-air mixtures has been obtained by 
both ferrous and non-ferrous metals striking against 
quartzite materials, such as sandstone or concrete 
containing sand. This work is relevant to the use of 
‘non-sparking’ tools. 

Hot gas jet ignition 

Ignition of flammable gas-air mixtures by jets of hot gas 
has been studied by Wolfhard and Vanpee (1959) to deter¬ 
mine the degree of hazard of ignition of methane in coal 
mines from hot spent gases from the detonation of an 
explosive charge. 

Ignition temperatures for a hot jet of air entering a cold, 
pure fuel are shown in Table 16.20 and those for a hot jet of 
nitrogen entering an ethylene—air mixture at an optimum 
concentration (close to stoichiometric) for ignition are 
shown inTable 16.21. 

Hot particle ignition 

Investigations of the ignition of flammable gas-air mix¬ 
tures by hot particles have been conducted by Silver (1937) 
and Paterson (1939-). Hot particles are another potential 
source of ignition in the use of blasting explosives in coal 

Silver carried out experiments in which hot particles 
were injected into flammable gas-air mixtures. The gases 
were coal gas, pentane and hydrogen and the particles 
quartz and platinum. The particle velocities were in the 
range 2-5 m/s. The particle temperature necessary to give 
ignition decreased as the particle diameter increased. 
Figure 16.25 shows some results obtained for the effect of 
particle diameter on the particle temperature required for 
ignition. 

Paterson extended this work, using a wider range of 
gases and materials and particle velocities up to 65 m/s. 
Some results showing the effect of particle velocity and 
diameter on the particle temperature required for ignition 
are shown in Figure 16.26. Paterson’s work shows that for 
small particles and for high particle velocities the surface 
temperatures required for ignition are very high. 

A model for ignition by a hot inert particle has been 
described by Su, Homan and Sirignano (1979). Sharma and 


Table 16.20 Hot gas jet ignition: ignition temperatures of 
a hot air jet entering a cold, pure fuel (Wolfhard and 
Vanpee, 1959) (Courtesy of the Combustion Institute) 


Fuel 

Ignition 

temperature (°C) 

Methane 

1190 

Ethane 

945 

Propane 

1010 

w-Butane 

1025 

Ethylene 

875 

Propylene 

1060 

iso -Butylene 

1070 

Acetylene 

755 

Carbon monoxide 

765 

(commercial) 

Hydrogen 

670 

Table 16.21 Hot gas jet ignition: ignition temperatures for 
a hot jet of nitrogen entering an ethylene-air mixture of 
optimum concentration (close to stoichiometric) for ignition 
(Wolfhard and Vanpee, 1959) (Courtesy of the Combustion 

Institute) 


Jet flow (cm 3 /s) 

Maximum temperature 
within jet (°C) 

25 

1020 

35 

1035 

50 

1040 

70 

1050 

100 

1100 

130 

1140 


Sirignano (1970) have given a model for ignition by a hot 
projectile. 

Flame torch and jet ignition 

Flame torch ignition of a flowing flammable gas mixture is 
important in combustion systems. The work of Mullen, 
Fenn and Irby (1949) has already been mentioned. Work on 
this topic has also been done by Wang et d. (1981). Ignition 
of a vapour cloud by a flame jet has been studied by Mackay 
et d. (1988) in the context of vapour cloud explosions.These 
are described in Chapter 17. 


Compression ignition 

If a mixture of flammable gas and air is compressed, the 
resultant temperature rise may take the mixture into the 
temperature range in which auto-ignition occurs. This 
effect is exhibited in the diesel engine and is sometimes 
known as the diesel effect. 

There is a considerable body of work on compression 
ignition, coming from several sources. Compression igni¬ 
tion is another of the modes of ignition studied in relation to 
ignition of firedamp in coal mines. Ignition by the pressure 
wave from a blasting explosive has been investigated by 
WC.F. Shepherd (1949). 
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Figure 16.25 Hot surface ignition temperature: effect of particle diameter on the particle temperature required for 
ignition of fuel-air mixtures by a hot particle travelling through the mixture (Laurendeau, 1982; after Silver, 1937; 
and Paterson, 1939-) 1, 3% pentane at m4m/s; 2, 3% pentane at ml, 2 m/s; 3, 10% coat gas at ml.2 m/s (Courtesy 
of Combustion and Flame) 


Another motivation for research on compression ignition 
is the study of fast chemical reactions. Compression is a 
convenient method of effecting the very rapid translation 
of a reaction mixture into the temperature range of interest. 
The technique has been described by Jost (1949). According 
to Jost, for hydrocarbon-air mixtures over the temperature 
range of interest the value of the ratio of specific heats 7 is 
about 1.3. He also states that the variation with hydro¬ 
carbon concentration is not negligible. 

A major aspect of research on combustion is the beha¬ 
viour of shock waves, and ignition by shock waves is one 
aspect of this. Such work has been described by J.W. Meyer 


and Oppenheim (1971b), Vermeer, Meyer and Oppenheim 
(1972) and Eubank et al. (1981). Regimes of weak and strong 
ignition and ignition time delay are features that have been 
particularly investigated. 

Research into internal combustion engines and diesel 
engines is another source of work on compression ignition. 
Work on compression ignition, and ‘knock’, in internal 
combustion engines is illustrated by the work of Halstead 
et al. (1975). There are also some studies of compression 
ignition of particularly sensitive chemicals such as those 
by Beeley, Griffiths and Gray (1980) on isopropyl nitrate 
and J.E Griffiths and Perche (1981) on ethylene oxide (EO). 
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Figure 16.26 Hot surface ignition temperature: the effect of particle velocity on particle temperature for the ignition of 
fuel-air mixtures by a hot particle travelling through the mixture (after Paterson, 1939-). Parameter of curves is con¬ 
centration of coal gas in air (% v/v) (Courtesy of the Philosophical Magazine) 


Ignition in compression is a form of auto-ignition. The 
comment made earlier is therefore applicable, that, given a 
homogeneous mixture, ignition may occur outside the 
normal flammability limits, since these apply essentially to 
propagation of the flame. 

16.3.10 Burning velocity 

It is usual to distinguish between flame speed, which is the 
actual speed of the flame front in a given situation, and 
burning velocity, which is a property, or at any rate a quasi¬ 
property, of the flammable gas mixture. Definition of the 
burning velocity is not, however, straightforward, Linnett 
(1953) states that it seems impossible to define a burning 
velocity which is equally applicable to both planar and 
spherical flames and will have the same value for both 
cases, but suggests that the best approach is to use a value 
obtained by dividing a suitable flame area into a volumetric 
flow rate. It has been shown by Spalding and Yumlu (1959) 
that there are in fact two burning velocities, the higher 
value normally being the stable one. 

There are a number of methods available for the mea¬ 
surement of burning velocity. These are reviewed by 
Linnett (1953) and by Andrews and Bradley (1972b). They 
include: 

(1) propagating flame methods 

(a) soap bubble, 

(b) bomb, 

(c) tube, 

(d) flame kernel; 

(2) cylindrical burner 

(a) cone angle, 

(b) total area; 

(3) nozzle burner 

(a) cone angle, 

(b) total area. 


With the cylindrical burner and nozzle burner methods 
measurement may be based on luminous flame, shadow or 
schlieren techniques. 

A model for a spherical flame is given in Chapter 17. 
Other early models, including those by Semenov (1940), 
Tanford and Pease (1947) and Manson (1949), are reviewed 
by Dugger and Simon (1953). Further rather more complex 
models have been given by Yang (1961) and by Spalding, 
Stephenson and Taylor (1971). 

Near the limits of flammability there is a minimum 
burning velocity to sustain combustion. This minimum 
burning velocity is influenced by natural convection. It has 
been suggested by Simmons and Wright (1972) that the 
following equation, derived by R.M. Davies and Taylor 
(1950) for the rise of an air bubble up a tube through a den¬ 
ser fluid, may be applied to the rise of a bubble of hot gas 
through a flammable gas mixture: % 

v 0 = 0.464 (grfl 1 2 3 [16.3.37] 

where g is the acceleration due to gravity (cm/s 2 ), r is the 
radius of the tube (cm) and v D is the velocity of the bubble 
(cm/s). 

The effects of pressure and temperature on burning 
velocity have been the subject of several studies including 
those by Andrews and Bradley (1972a, 1973a), Halstead, 
Pye and Quinn (1974), Gulder (1982) and Lijima and Takeno 
(1986). 

For methane, Andrews and Bradley (1972a, 1973) found 
that the burning velocity decreases with increasing 
pressure according to the relation 

So oc p~ m [16.3.38] 

where m = 0.5. A similar relation was obtained by Gulder 
(1982) for methanol, ethanol and iso-octane with values 
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of m of the order of 0.2. On the other hand, for hydrogen, 
Lijima and Takeno (1986) report an increase in burning 
velocity with pressure. 

Burning velocity is generally reported to increase with 
temperature. Giilder (1982) found the relation 

S* ex T [16.3.39] 

where n = 1.75 for methanol and ethanol and n = 1.56 for 
iso-octane. Andrews and Bradley (1972a) obtained for 
methane the relation 

Su = 10 + 0.000371T 2 [16.3.40] 

where S u is the burning velocity (cm/s) and T is the abso¬ 
lute temperature of the unburned gas. Lijima and Takeno 
(1986) obtained similarly strongly positive correlations of 
burning velocity with temperature for both methane and 
hydrogen. 

The effect of physical and chemical properties on burn¬ 
ing velocity has been studied by Golovina and Fyodorov 
(1957). The effect on burning velocity of the recirculation 
of the products of combustion has been investigated by 
Putnam (1974). 

The variability in the values of burning velocity given in 
the literature is discussed by Andrews and Bradley (1972b). 
For methane they quote values ranging from 31 to 50 cm/s 
and the variation is as great for most of the other gases 
considered. 

Relations for the burning velocity of mixtures have been 
given by Payman and Wheeler (1922) and Spalding (1956). 
The Payman and Wheeler rule is 

i 16 - 3 - 41 ] 

where y is the mole fraction in the fuel—oxidant mixture 
and subscripts i and m denote component i and the mix¬ 
ture, respectively. 

Spalding’s treatment is based on the concept that the sole 
effect of mixing two fuel-air mixtures is to alter the flame 
temperature to a common value. In the simplified form 
given by Yumlu (1967a), the Spalding rule is 

S 2 , m = £S u > [16.3.42] 


the turbulence due to the gas flow such as the axial com¬ 
ponent of turbulence u! and the radial component v'. Thr- 
bulence generated by the flame is also taken into account in 
some treatments. 

Treatments of turbulent burning velocity have been 
reviewed by B. Lewis and von Elbe (1961). The first model 
was that by Damkohler (1940), who suggested that the 
flame front is strongly distorted by turbulence and that 
under these conditions for a stable flame the burning velo¬ 
city must exceed not only the average velocity U but also 
the velocity U + u'. This leads to the relation 

Sr tx it [16.3.43] 

In this model St is independent of Sl. Shchelkin (1943) 
modified the Damkohler model by assuming that the dis¬ 
tortions of the flame front are cone shaped. Then from 
geometrical considerations he obtains 

^=[1 + ( 2 « 7 Sl ) 2 ] 1/2 [ 16 . 3 . 44 ] 

The model is a crude one, and in recognition of this the 2 in 
Equation 16.3.44 may be replaced by an undetermined 
number B of the order of unity. Equation 16.3.44 reduces to 
relation 16.3.43 for large values of (V/Sl) 2 

Thus, according to these theories, under conditions of 
high turbulence the turbulent burning velocity Sr should 
be independent of the fuel gas. Work by D.T. Williams and 
Bellinger (1949) has shown, however, that this is not so. 

Karlovitz, Denniston and Wells (1951) have developed a 
model that addresses this problem. The model is based on 
the concept of an undulated flame front and yields the 
relations 



St = (Wy|l-§71 - exp(—«7 Sl)]}) ' [16.3.46] 


where a is the ratio of the mass of fuel i and the corre¬ 
sponding amount of oxidant to the total mass of fuel and 
oxidant. 

The burning velocity so far considered is the laminar 
burning velocity S L . The burning velocity is increased by 
turbulence and it is necessary to consider also the turbu¬ 
lent burning velocity Sr- 

The definition of burning velocity becomes more diffi¬ 
cult if the conditions are turbulent. The definition is 
usually given in terms of the flame surface, but this surface 
is difficult to specify. A rigorous definition of turbulent 
burning velocity has been given by J.M. Richardson (1956). 
Its application has been discussed by Palm-Leis and 
Strehlow (1969). 

Measurement of the turbulent burning velocity has 
usually been carried out utilizing a modification of the 
burner method used for laminar burning velocity The 
method of flame propagation in a vessel has also been used. 

There are a number of correlations and models of turbu¬ 
lent burning velocity. Most of these involve parameters for 


where S t is the average velocity of displacement of the tur¬ 
bulent wave. At low turbulence, Equation 16.3.46 reduces to 


^=1 + ^ 

S L S l 


Sl 


[16.3.47] 


and at high turbulence it reduces to 



[16.3.48] 


In this model, therefore, the turbulent burning velocity 
remains dependent on the laminar burning velocity, even at 
high turbulence. 

In their work, D.T. Williams and Bellinger (1949) 
obtained the correlation 


Ut = 0.1761 M a2564 Re°' 238 3000 < Re < 35,000 

[16.3.49] 
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where d is the burner diameter (cm), « n is the laminar 
burning velocity (cm/s) and w t is the turbulent burning 
velocity (cm/s). 

Fine (1958) describes two models for the effect of turbu¬ 
lence on burning velocity. One treatment is based on the 
effect of turbulence in inducing flame wrinkling and gives 


K = 0.157 Re L % [16.3.58] 

in which the value of A has been taken as 40.4, while the 
Lewis number Le is defined as 


jr- =/(«7Sl) 


[16.3.50] 


[16.3.59] 


The other model involves the effect of turbulence on thick¬ 
ening of the reaction zone. Fine applied these models in an 
attempt to determine by studying the effect of pressure 
whether the Reynolds number is the proper correlator, but 
the results were inconclusive. Correlations of the turbulent 
burning velocity have been given by a number of workers. 
Thus Kozachenko (1962) gives a relation of the form 

Sr = SL + </>! [16.3.51] 

and Gokalp (1980) one of the form 

Sr = S L + <t> 2 [16.3.52] 

where </>i and </> 2 are functions of turbulence. 

An extensive program of work on the turbulent burning 
velocity has been undertaken by Bradley and co-workers. 
Andrews, Bradley and Lwakabamba (1975a) obtained a 
graphical correlation of turbulent burning velocity in 
terms of the unburnt gas Reynolds number defined as 

Rx = utX/v [16.3.53] 

where u' is the root mean square (rms) turbulent velocity, X 
is theTaylor microscale and v is the kinematic viscosity. On 
the assumption that u'/U= 0.05 this Reynolds number is 
given approximately by the relation 

Rx = (Re - 2500) 1/2 [16.3.54] 

Abdel-Gayed and Bradley (1977) present a further graphi¬ 
cal correlation. For high turbulence they give the relation 

- = 3.788Z??' 238 Rx > 100; m/u' -► 0 [16.3.55] 

U\ 

where U\ and u t are the laminar and turbulent burning 
velocities, respectively. Further work is reported by Abdel- 
Gayed and Bradley (1987), who also give details of the 
correlations found by previous workers. 

Continuing this investigation, Bradley, Lau and Lawes 
(1992) give the correlation shown in Figure 16.27. They use 
an integral length scale of turbulence L such that 



with a turbulent Reynolds number Rei,defined by 

Re L = — [16.3.57] 

whereA is a constant. Then for the parameter group ffLe in 
Figure 16.27 they give for the Karlovitz flame stretch factor 
A the relation 


where c p is the specific heat of the gas, D is the diffusion 
coefficient of the deficient reactant, k is the thermal con¬ 
ductivity of the gas and p is the density of the gas. They 
also give the following limited-range relation: 

^ = 0.88(ALe)- a3 0.01<ALe<0.63 [16.3.60] 

« k 

The correlation given makes use of the rms turbulent 
velocity u 'and the effective rms turbulent velocity acting 
on the flame «' k . Although in this work use was made of 
measured values, where necessary Abdel-Gayed and 
Bradley (1977) also used the relation 

^ = 0.1676 Re -0119 [16.3.61] 

With regard to u k this velocity is given mainly in terms of 
the ratio u k The treatment, described in detail by Abdel- 
Gayed and Bradley (1987), is complex, but at high turbu¬ 
lence the value of the ratio tends to unity. 

The effect of pressure on turbulent burning velocity has 
been studied by Fine (1958), as already mentioned. He 
obtained for propane and hydrogen the relation 

il ocP" [16.3.62] 

■JL 

where n is approximately 0.3. 

Selected values of the turbulent burning velocity of 
various fuels are given by Abdel-Gayed and Bradley (1977). 

Burning velocity is closely related to quenching 
distance, as described in the next section. 


16.3.11 Quenching effects 

Flame propagation may be extinguished by quenching. 
Such quenching may be due to heat loss to unburnt gas or to 
a solid surface. Quenching is closely related to several of 
the other properties already discussed. Explanations for 
the existence of flammability limits invoke quenching. 
There is a close inverse relation between burning velocity 
and quenching. 

Quenching is of practical interest in a number of ways. 
The stabilization of flames on burners is related to 
quenching. The quenching effect is utilized in equipment 
designed to stop the passage of flame, such as flameproof 
motors and flame arresters. The occurrence of unreacted 
fuel in car exhaust may be attributable to quenching. 

For quenching in a gap between surfaces use is often 
made of the quenching distance d p . This is sometimes used 
as a general term covering both the quenching diameter d a 
and the critical slot width </||and sometimes means only the 
latter. 
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Figure 16.27 Correlation for turbulent burning velocity (D. Bradley, Lau and Lawes, 1992) (Courtesy of The Royal 
Society) 


Potter (1960) gives the relation between the quenching 
diameter d 0 and the critical slot width d\\ as 

d|, = 0.65d o [16.3.63] 

A third quenching parameter is the depth of penetration of 
quenching dp. This is defined as the ratio of the burning 
velocity to the critical boundary velocity gradient for 
flashback: 


and correlations for quenching distance. Drawing on ear¬ 
lier work by Mallard and Le Chatelier (1883), R. Friedman 
(1949) derived a quenching equation. Equating the heat 
generated to the heat lost to the walls, he obtained for the 
critical value of the quenching distance x 


k [1 (Tf — Tj) ! 1/2 

SuCp„ [f (Ti - T 0 )J 


[16.3.65] 


dp = i fa [16.3.64] 

The variation of these three quantities for flammable mix¬ 
tures of natural gas and air is shown in Figure 16.28. The 
quenching diameter is the greatest dimension and the 
depth of penetration of quenching is the smallest. 

Measurement of the quenching distance may be made by 
a number of methods. Reviews of these methods have been 
given by R. Friedman (1949) and Anagnostou and Potter 
(1959). Methods include those based on measurement of 

(1) flame blow-off and stability; 

(2) the critical distance between parallel plates; 

(3) the critical tube diameter. 


where c pu is the specific heat of the unburnt gas,/is a geo¬ 
metrical factor of the order of unity, k is the thermal con¬ 
ductivity of the gas, 7) is the absolute flame temperature, 7) 
is the absolute ignition temperature and T 0 is the absolute 
temperature of the unburned gas. 

Some theories of quenching involve the Peclet number Pe 
defined as 

Pe=&dq/a u [16.3.66] 

= K/PnC u [16.3.67] 


Extensive measurements of quenching distance have been where a is the thermal diffusivity and subscript u denotes 
made by Blanc, et al. (1949). There are a number of models the unburned gas. 
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Figure 16.28 Quenching parameters of burner wall for 
natural gas-air mixtures (B. Lewis and von Elbe, 1961) 1, 
quenching diameter d 0 ; 2, quenching distance df 3 depth 
of penetration, d p (Courtesy of Academic Press) 


Equations 16.3.66 and 16.3.67 imply a constant value of 
the burning velocity-quenching product, which is also 
used by Potter and Berlad (1957). 

|Sm= Constant [16.3.68] 

Ballal and Lefbvre (1977) have attempted to correlate the 
quenching distance for turbulent flow conditions using 


= ^ = ^ [16.3.69] 

where A is a constant, but found that it was necessary to 
modify this relation and proposed instead 

d q =A+ 13Pr- 005 (M , /S L ) a5 [16.3.70] 

Kydd and Foss (1964) emphasize the influence on quench¬ 
ing of three-dimensional effects. 

Several investigators have studied the effect on quench¬ 
ing distance of gap length. R. Friedman (1949) states that 
the quenching distance appears to depend not on gap 
length but on gap width only. On the other hand, Maekawa 
(1975) obtained for quenching in rectangular channels the 
relation 

dq = hL exp( - fcL) + ksL [16.3.71] 

where L is the gap length and k\ to kz are constants. 



Channel length (mm) 


Figure 16.29 Quenching distance in a rectangular duct 
(Maekawa, 1975) (Courtesy of Combustion Science and 
Technology) 


Some results from this work are shown in Figure 16.29. 

Mention should also be made of experiments by Wolf- 
hard and Bruszak (1960) in which they investigated the 
propagation of flame down narrow tubes between two 
chambers. In experiments with methane the flame did not 
propagate through tubes of diameter less than 3 mm. But 
ignition could still occur in the outer chamber due to the jet 
of hot gases. Whether ignition did in fact occur depended 
on the properties of the jet. Very short channels were more 
effective in preventing ignition than were 10 mm long ones. 

The effect of pressure on quenching distance has been 
studied by several workers including Brokaw and Gerstein 
(1957), Potter (1960) and Ballal and Lefebvre (1975a). The 
quenching distance increases with decreasing pressure. 

Potter (1960) states that the quenching distance is 
approximately inversely proportional to pressure: 

d q tx P- 1 [16.3.72] 

This relation is in fact implied in the use of the Peclet 
number. 

Practical quenching criteria such as the MESG were 
discussed in Section 16.2. 


16.3.12 Cool flames 

Certain compounds are capable of slow oxidation at mix¬ 
ture concentrations outside the normal flammability limits 
and at temperatures lower than those pertaining in normal 
combustion. Cool flames are of practical interest for several 
reasons. Much of the work done has been concerned with 
knock in internal combustion engines and also in jet 
engines. They are also of interest in relation to hydrocarbon 
oxidation in chemical reactors. 

Cool flames were discovered by Sir Humphrey Davy and 
were studied by Perkin (1882), who found that they could 
be obtained with a wide variety of compounds, including 
hydrocarbons, alcoholsandaldehydes.They were most easily 
demonstrated with diethyl ether and acetaldehyde.They were 
effectively rediscovered by Prettre, Dumanois and Lafitte 
(1930) and Townend and Mandlekar (1933). 

Townend and co-workers carried out a series of studies 
on cool flames. The characteristics of such flames are illu¬ 
strated by the work of Hsieh and Townend (1939a-c). The 
concentration region within which cool flames occur is 
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illustrated by the results for hexane-air mixtures obtained 
by Hsieh and Townend (1939b), as shown in Figure 16.30(a). 
They state: 

Reference to the results at 1500°C shows that at pressures 
up to 4.1 atm there was only one range of inflammable 
mixtures, viz. that for normal flames. This was at first 
unaffected by increase in initial pressure, the lower limit 
being lower by about 0.3 % and the higher limit raised by 
about 1% of hexane at pressure up to 4 atm. At a pressure 
of 4.1 atm a cool flame range was located with mixtures of 
composition between 11 and 22% of hexane, the normal 
range at the same pressure extending over mixtures of 
hexane content between 1.2 and 7.0%. The ‘normal’ and 
‘coo! flame ranges were thus separated by a range of non¬ 
flammable mixtures containing between 7 and 11% of 
hexane. At pressures higher than 4.8 atm the two ranges 
of inflammability became superposed so that at, 6.5 atm, 
mixtures containing between 1 and 14.5 % of hexane were 
capable of propagating ‘normal’ flames and those 
between 14.5 and 32 % ‘cool’ flames. 

Hsieh and Townend (1939a) also investigated the ignition of 
cool flames both by spontaneous ignition and by hot wire 
ignition, in order to establish that the cool flame process 
is the same in both modes. Their results for ether-air 
mixtures are shown in Figure 16.30(b). 

The results of cool flame experiments may also be pre¬ 
sented as an ignition diagram in which the regions of the dif¬ 
ferent modes of combustion are shown on aplot of temperature 
vs. pressure for a given mixture composition. An ignition 
diagram for a propane-oxygen mixture given by Newitt and 
Thornes (1937) is shown in Figure 16.31. Ignition diagrams 
for a number of compounds have been given by Townend 
(1937). A characteristic feature of an ignition diagram is the 
peninsular region. Apart from its practical significance, the 
diagram provides a test of theories for cool flames. 

Cool flames are associated with a negative temperature 
coefficient for the overall combustion over a limited range 
of temperature, as illustrated by the data shown in Figure 
16.32 for the reaction rate of propane and oxygen obtained 
by Seakins and Hinshelwood (1963). The negative tem¬ 
perature coefficient is discussed by Knox, who interprets it 
as evidence of a fundamental change from one reaction 
mechanism to another. 

Interpretations of cool flames in terms of the reaction 
kinetics have been undertaken by a large number of work¬ 
ers. Reviews are given by von Elbe and Lewis (1937a), 
Ashmore (1967) and Knox (1967a). 

Von Elbe and Lewis (1937b) review the theories of Nor- 
rish and Foord (1936), Ubbelohde (1935, 1936), Jost, von 
Muffling and Rohrmann (1936), Pease (1935), Semenov 
(1935) and von Elbe and Lewis (1937a). They discuss the 
role of unbranched and branched chain reactions and of the 
intermediate aldehydes and peroxides formed. 

Thermal and isothermal theories of cool flames have 
been proposed by Semenov (1935) and are discussed by 
Ashmore (1967). In the thermal theory, which applies both 
to unbranched and branched chain reactions, a rapid 
increase in reaction rate occurs as a result of self-heating, 
while in the isothermal theory, which applies to branched 
chain reactions only, the reaction rate increases as a result 
of exponential growth in the chain centres at the end of an 
isotherm induction period. 

A series of investigations of pre-flame and ignition 
behaviour and of cool flames has been carried out by 


Barnard and co-workers (e.g. Barnard and Ibberson, 
1965 Barnard and Kirschner, 1967; Barnard and Sankey, 
1968; Barnard and Watts, 1972; Barnard and Harwood, 
1973a) and by Salooja (1966,1967,1968a,b). 

A feature of cool flames is the occurrence of multiple 
flames, one after the other. Coffee (1982b) quotes observa¬ 
tion of up to 11 cool flame zones. 

The periodicity of cool flames is another feature that is of 
theoretical interest. Attempts have been made to apply to 
cool flames the theory developed by Lotka (1920) for 
essentially biological phenomena, which for certain condi¬ 
tions predicts oscillations in the concentration of inter¬ 
mediate species. This aspect is discussed by B.F. Gray and 
Yang (1969). Cool flames exhibit an ignition delay, or 
induction period. Studies of ignition delay in cool flames 
include those of J.E. Johnson, Crellin and Carhart (1954), 
Fish (1968) and Barnard and Watts (1972). Fish obtained for 
the variation of ignition delay with pressure the relation 

UmkP~ n + c [16.3.73] 

where P is the absolute pressure, x is the ignition delay, c 
and k are constants and n is an index. 

Cool flames result in rises in pressure and temperature, 
but these are more modest than with normal combustion. 
Correlations for pressure and temperature effects are given 
by Fish (1968) and by Luckett and Pollard (1973). For the 
pressure rise Fish found 


AP cf = kFf [16.3.74] 


where P a is the absolute initial pressure, AP cf is the pres¬ 
sure rise for a cool flame, k is a constant and m is an index. 
The value of the index m was 1 < m < 2. 

The temperature rise was found by Fish to be a function 
of the oxygen concentration of the mixture. For low oxygen 
concentrations the rise in temperature corresponded 
closely to the rise in pressure, assuming the ideal gas law. 

Cool flames in mixtures have been studied by Salooja 
(1968b). He found that for binary mixtures two different 
types of behaviour could be distinguished: those cases for 
which the ignition tendency is (1) intermediate between 
those of the two compounds and (2) even greater than that 
of the more ignitable component. 

The features of cool flames have been compared with 
those of normal flames by Coffee (1982b) as follows: 



Normal flames 

Cool flames 

AT cf 

800-2000°C 

1-200°C 

Ptf/Po 

6-10 (confined spaces) 

Low (<2) 

Products 

CO z , H 2 0 

CO, CH 2 0 


Pet, absolute final pressure of cool flame; P„, absolute initial 
pressure; AT rf , temperature rise for cool flame. 


16.3.13 Combustion in tubes 

The behaviour of flames in tubes has been extensively 
studied. Early work was carried out by Mallard and Le 
Chatelier (1883) and by Wheeler and co-workers, the latter 
including the work by Mason and Wheeler (1917,1920a-c), 
Chapman and Wheeler (1926,1927), Ellis (1928), Ellis and 
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(a) 



Figure 16.30 Effect of pressure on cool flame ranges: (a) cool flames of hexane-air mixtures (after Hsieh and Townend, 
1939b); and (b) cool flames of ether-air mixtures (after Hsieh and Townend, 1939a). Latter shows ignition both by ignition 
source and by bulk gas ignition (Courtesy of the Chemical Society) 
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Pressure (mmHg) 

Figure 16.31 Ignition diagram for equimolar concentration of propane and oxygen, showing effect of pressure on ignition 
temperature and cool flame ranges (Knox, 1967a; Newitt and Thornes, 1937) (Courtesy of Cambridge University Press) 
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Figure 16.32 Effect of temperature on reaction rate for oxidation of propane, illustrating negative temperature coefficient 
(Knox, 1967a; after Seakins and Hinshelwood, 1963) P max maximum pressure (mmHg) (Courtesy of Cambridge Uni¬ 
versity Press) 


Wheeler (1925,1928a,b), Kirby and Wheeler (1931a,b) and 
H. Robinson and Wheeler (1933). 

Much work on combustion in tubes has dealt with deto¬ 
nation, and with the transition from deflagration to deto¬ 
nation; this is considered in Chapter 17. There is also, 
however, a body of work which is concerned with the more 
general aspects of combustion in tubes, including tubes 


containingobstacles, in respect of features such asvibratory 
oscillations, flame acceleration, pressure rise and so on. 

Such work includes Non-Steady Flame Propagation by 
Markstein (1964) and that by M.W. Evans et al. (1949), 
Schmidt, Steinicke and Neubert (1953), Guenoche (1964), 
Leyer and Manson (1971), Andrews, Herath and Phylaktou 
(1990) and Phylaktou, Andrews and Herath (1990). 
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The latter authors have reviewed some of the findings of 
this work. They consider four cases: Case 1, a tube open at 
one end with ignition at the open end; Case 2, a tube open at 
one end with ignition at the closed end; Case 3, a tube open 
at both ends; and Case 4, a tube closed at both ends. 

Case 1 appears to provide the simplest propagation con¬ 
ditions and has been the most widely investigated. After a 
short initial phase, the flame propagates for some distance 
at a fairly constant velocity. This phase is sufficiently pro¬ 
longed to permit measurement of the burning velocity. As 
the flame progresses, there begin vibrations of the com¬ 
bustion surface that can turn into violent oscillations. 
Towards the end of the tube the flame velocity falls rapidly 
to a roughly constant value. 

In Case 2 the flame accelerates rapidly and develops 
violent vibrations. In the work of Mason and Wheeler 
(1920a,b), using a long tube, this resulted in extinction of 
the flame. 

In Case 3 the behaviour of the flame is somewhat similar 
to that in Case 1, with a short initial phase followed by pro¬ 
pagation at a higher velocity, since the unburned gas can be 
pushed out of the open end. In this phase there is a slight 
acceleration. Vibration begins and the velocity increases, 
either with smooth acceleration or with oscillations. 

In Case 4 with ignition at one end it was found by Kirby 
and Wheeler (1931b) that initially the flame accelerated 
rapidly, then decelerated and travelled at a comparatively 
low speed until it approached the far end, when it acceler¬ 
ated somewhat. The time of attainment of maximum pres¬ 
sure coincided with that of the arrival of the flame at this 
end. 

Phylaktou, Andrews and Herath (1990) describe experi¬ 
ments on the Case 4 configuration using a pipe with a 
length/diameter (L/D) ratio of 21.6 with a wide range of gas 
concentrations and a variety of gases. All gases exhibited 
two distinct regimes: vibratory near the stoichiometric 
concentration and non-vibratory near the limits of flamm¬ 
ability. In the near-limit mixtures the flame speeds were 
higher than those in the stoichiometric mixtures, and the 
initial rates of pressure rise were high. For the near stoi¬ 
chiometric mixtures vibration was found to enhance the 
rate of pressure rise. 

Further accounts of combustion in pipes, and also in 
vessels, as well as treatment of detonation are given in 
Chapter 17. 

16.4 Flammability of Aerosols 

It is also relevant to consider the combustion of aerosols 
such as fogs, mists and sprays. Such aerosols may be pro¬ 
duced by condensation of a saturated vapour or by atomi¬ 
zation of liquid by mechanical forces. The former may be 
referred to as a condensed fog or mist and the latter as a 
mechanical spray. Normally in a condensed mist the dia¬ 
meter of most of the drops is less than 10 pm, while in a 
mechanical spray it is greater than 100 pm. 

Accounts of the combustion of aerosols, particularly 
liquid sprays, include Combustion of Liquid Fuel Sprays 
(A. Williams, 1990) and those by F. A. Williams (1959), Faeth 
(1977,1979,1983) and Kuo (1986). 

A large proportion of work in this field is directed 
towards the combustion of atomized fuels at burners in 
furnaces and boilers. Some of the work deals with the 
combustion of single droplets of fuel, and some deals with 
the combustion of an aerosol cloud. 


16.4.1 Combustion of aerosols 

A suspension of finely divided droplets of flammable liquid in 
air can give a flammable mixture which has many of the char¬ 
acteristics of a flammable gas-air mixture and which can burn 
orexplode.Thecombustionofaerosolshasbeenthesubjectofa 
series of studies by Burgoyne and co-workers (Burgoyne and 
Richardson, 1949b; Burgoyne and Cohen, 1954; Burgoyne, 
Newitt andThomas, 1954; Burgoyne, 1957,1963). 

In classic experiments using aerosols of tetrahydro- 
naphthalene, or tetralin, with droplets of closely controlled 
diameter in the range 7-55 pm, Burgoyne and Cohen (1954) 
found that below a droplet diameter of 10 pm, the aerosol 
behaved like a vapour in respect of the LFL and the burning 
velocity. With a droplet diameter above 40 pm, the beha¬ 
viour of the aerosol was different. The droplets were 
observed to burn individually in their own air envelopes, 
one burning droplet igniting the next. 

If the droplet size, and hence the distance between dro¬ 
plets, exceeds a critical value, the flame does not propagate. 
The critical distance is of the same order of magnitude as 
the radius of the sphere of air required for the combustion 
of a droplet. 

Coarser aerosols are capable of sustaining a flame at 
substantially lower fuel—air ratios than fine aerosols and 
vapours. The difference lies in the ability of the droplets to 
move in relation to the ambient air. Coarse particles are 
responsive to acceleration and move randomly, and thus 
communicate flame more readily. 

Burgoyne’s work has also shown that the burning velocity 
and the quantity of inert gas required for the suppression 
of flammability in aerosols with small droplet diameters 
are those of the equivalent vapour-air mixture. 

In addition to this work on the conditions for combustion 
to occur in an aerosol, there have been other studies that 
have investigated the behaviour and shape of the flame in a 
droplet cloud. The studies include those by J.A. Browning 
and Krall (1955), J.A. Browning, Tyler and Krall (1957), 
Reichenbach, Squires and Penner (1962), Rosser (1967), 
Mizutani and Nishimoto (1972), Mizutani and Nakajima 
(1973), Polymeropolous (1974,1984), Hayashi and Kumagai 
(1975), Polymeropoulos and Das (1975) and Ballal and 
Lefebvre (1978,1979,1981a). 

Another aspect of the combustion of aerosols, which has 
been actively investigated, is ignition and extinction. Work 
on this topic has been described by Polymeropoulos and 
Peskin (1969), Kapila, Ludford and Buckmaster (1975), Law 
(1975) and Pindera and Brzustowski (1984). 

The explosion of aerosols of flammable liquids is 
considered in Chapter 17. 

16.4.2 Burning of single droplets 

The combustion of the individual liquid droplets of an 
aerosol has been the subject of a good deal of work, parti¬ 
cularly in relation to spray combustion in gas turbines and 
rockets. 

Work on this topic includes that by Godsave (1953), 
Hottel, Williams and Simpson (1955), Kobayasi (1955), 
Agoston,Wise and Rosser (1957), Bolt and Saad (1957),Wise 
and Agoston (1958), Aldred and Williams (1966), Eisenk- 
lam and Arulachanam (1966), Faeth (1967), Sioui and 
Roblee (1969) and Yule, Ereaut and Ungut (1983). Reviews 
are given by A. Williams (1973,1990). 

Research in this area includes work on: the formation of 
droplets by atomization and other mechanisms, and the 
size distribution and velocities of the droplets produced; 
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the evaporation of and the drag on the droplets; and the 
mass burning rate of the droplets. 

The mass burning rate m-poi a liquid droplet is 


concentration Q that is related to the volumetric 
concentration C v as follows: 


Q _ V f + 7 a + F s 

4 I'f-r,- 


[16.4.5] 


where d L is the diameter of the droplet and p L is the density 
of the liquid. This equation can be rearranged to give 


nd L p L 


[16.4.2] 


It is found experimentally that 


[16.4.3] 


where Q is the volumetric flame front concentration, Q, is 
the volumetric concentration, V a is the downward velocity 
of the air, Vt is the upward velocity of the flame through the 
suspension and 7 S is the sedimentation velocity of the drops 
relative to the air. 

The LFL concentrations obtained by experiment were 
close to the flame front concentrations as defined by 
Equation 16.4.5. In some experiments with larger drop 
diameters the LFL measured was less than one-tenth of 
that for the equivalent vapour-air mixture. The burning 
velocity and the quantity of inert gas required for the sup¬ 
pression of flammability are also affected by large drop 


where the constant K is known as the burning constant. 
This constant is therefore 


K = 


4wf 

ndtpt 


[16.4.4] 


There are a number of correlations of the burning constant, 
predominantly for conditions of forced convection, as in 
spray combustion. One of the most widely used is that of 
Wise and Agoston (1958). 


In general, for flammable aerosols in air, it is found that 
for small droplet diameters the LFLs, measured as mass of 
fuel per unit volume of aerosol, are similar to those for 
vapour-air mixtures. Some values of the LFLs of vapours 
are quoted by Burgoyne (1963). For most of the substances 
which he lists the LFLs of the vapour lies in the range 
0.04-0.10 g/1 (or oz/ft 3 ). Further details are given in 
Section 16.2. 


16.4.3 Flammability limits 

Burgoyne and co-workers, as described above have studied 
the flammability limits of the aerosols of flammable 
liquids. Burgyone (1963) quotes early work by Haber and 
Wolff (1923), who obtained for the LFL the results shown in 
Table 16.22. 

As already described, Burgoyne and Cohen (1954) found 
in their studies on tetralin a difference in behaviour 
between aerosols with a droplet diameter d L less than 10 pm 
and those with a droplet diameter more than 40 pm. The 
LFLs were found to be 46 mg fuel/1 of aerosol for < 10 pm 
and 18 mg fuel/1 of aerosol for di_ > 40 pm; for intermediate 
diameters the LFLs change linearly between these two 
concentrations. 

For aerosols in which the droplet diameter is less than 
10 pm the LFL of the liquid and vapour suspension is vir¬ 
tually the same as that of the substance wholly in vapour 
form at the somewhat higher temperature necessary for 
vaporization. Above a droplet diameter of 10 pm the lower 
limit of flammability decreases as the drop diameter 
increases. 

Above a droplet diameter of 20 pm another phenomenon 
was identified as significant, namely the rate of sedi¬ 
mentation of the droplet. For this effect Burgoyne (1963) 
gives the following treatment. He defines a flame front 


16.4.4 Minimum ignition energy 

A method of obtaining the MIE of a dust cloud, which is 
also applicable to a vapour and an aerosol has been given by 
Ballal (1983b). Ballal has correlated MIEs for a number of 
mixtures of gases, vapours, liquid droplets and dusts with 
air at atmospheric pressure, the size of the liquid and solid 
particles being of the order of 50 pm. The correlation is in 
terms of the Spalding mass transfer number B: 


[16.4.6] 


where c p is the specific heat of the fuel, c pa is the specific 
heat of air, H is the heat of combustion, L is the latent heat of 
vaporization, q is the mass ratio of fuel to air, and sub¬ 
scripts b, g, s and st denote the boiling point of the fuel, gas, 
the surface of the fuel and stoichiometric, respectively. 

Figure 16.33 (a) gives an approximate relation between 
the MIE £ min and B for homogeneous and two-phase mix¬ 
tures of the type described. For a more accurate estimate 
Ballal gives the MIE E min as a function of the quenching 
diameter d q : 


Eonin = nCpPzATdl 


[16.4.7] 


Table 16.22 Lower flammability limits of some vapours and mists in air (after Haber and Wolff, 1923) 


Temperature (°F) 

Mist concentration (oz/ft 3 ) 

Temperature (°F) 

Vapour concentration (oz/ft 3 ) 

Petroleum 356-428°F 75 

0.044 

140 

0.043 

Tetralin 84 

0.0409 

212 

0.0416 

Quinoline 97 

0.0662 

230 

0.064 
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GASEOUS FUELS 



Mass transfer No., 8 

SOLID FUELS LIQUID MISTS GASEOUS FUELS 

(b) 

Figure 16.33 Some properties of mixtures of air with flammable vapours, aerosols or dusts: (a) minimum ignition energy 
(after Ballal, 1983b) (Courtesy of Combustion and Flame); and (b) fundamental burning velocity (after Ballal, 1983a) 
(Courtesy of the Combustion Institute) 
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rf q = (8«)1. 


CM 

8Cxf 2 (k/Cp)<f> ln(l + B) 


12.5a 


contact with a source of heat can result in the formation of 
cracking products such as hydrogen or acetylene, which 
reduce the LFL and increase the burning velocity and the 
quantity of inert gas required for the suppression of 
flammability. 


9q(%eaTl \ 
CpP p ClfD 32 AT st J 


[16.4.8] 


where c pg is the specific heat of the gas, Ci is the ratio of the 
surface mean area to the Sauter mean diameter, Q is the 
ratio of the volume mean diameter to the Sauter mean dia¬ 
meter, Z>32 is the Sauter mean diameter, / is the swelling 
factor of the fuel, k is the thermal conductivity of the fuel, 
S u is the laminar burning velocity, a is the thermal diffu- 
sivity of the particle, e is the emissivity of the particle, p 
is the density, AT is the temperature difference, a is 
the Stefan-Boltzman constant, p is the equivalence ratio 
and subscript p denotes fuel. 


16.4.5 Burning velocity 

Ballal (1983a) has also given a method of obtaining the 
laminar burning velocity of a dust cloud, which is also 
applicable to a vapour and an aerosol. Figure 16.33(b) gives 
an approximate relation between laminar burning velocity 
S u and B for homogeneous and two-phase mixtures. For a 
more accurate estimate Ballal gives the laminar burning 
velocity as a function of the thickness d T of the reaction 
zone: 


Su = 


aAT r 

SfATpr 


[16.4.9] 


16.5 Ignition sources 

Selected references on ignition sources are given in Table 
16.23. 


Table 16.23 Selected references on ignition and ignition 
sources 


D.J. Lewis (n.d.); SMRB (Pap. 74); von Elbe and Lewis 
(1949); von Elbe (1953); Khitrin and Goldenberg (1957); 
H.E. Rose and Priede (1959a); F. Powell (1960); Risinger and 
Vervalin (1964); SMRE (1965 Res. Rep. 231); FMEC (1967); 
FPA (1971/14); J.F. Griffiths, Gray and Gray (1971); Page and 
Gardner (1971); Dehn (1972); KN. Palmer (1973a, 1976b); 
Dixon-Lewis and Shepherd (1975); Eisenberg, Lynch and 
Breeding (1975); Japan Gas Association (1976); Kletz (1971); 
Birch, Brown and Dodson (1981); IBC (1981/9,19,1982/36, 
1991/81); Dold and Clarke (1985); Fordham Cooper (1986); 
Vilyunov and Zarko (1989); Bond (1991) 

Ignition induction period, time delay 

SMRB (1925 Pap. 9); Mullins (1949); Brokaw and Jackson 
(1955); Ashmore and Levitt (1959); P. Gray and Harper 
(1959a,b); R.E. Miller (1959);Voevodsky (1959); Salooja 
(1961); Melvin (1966); Bascombe (1967); Burcat, Scheller 
and Lifschitz (1971); Drysdale (1971); Bowes (1984); 
Freeman and Lefebvre (1984) 




<5 r = 


CfPfDja , 

8/ 2 Ci(c P A) g ^ln(l + B)" t ' 


aA T r 1 

vS|AT p .J 


9gC(eaT* 1 
CpgPfCj/TfcATr J 


[16.4.10] 


where c pg is the specific heat of the gas, S g is the laminar 
burning velocity of the gases liberated from the particles, 
a g is the thermal diffusivity of the gas, and subscripts f, g, 
pr and r denote the fuel, gas, pre-reaction zone and reaction 
zone, respectively. 

These correlations of Ballal are subject to a number of 
qualifications, as discussed by the author and by Nettleton 
(1987), who nevertheless concludes that the approach is 
applicable to many practical situations. Nettleton quotes 
some typical ranges of the laminar burning velocity S u in 
air. These are: 0.05 < S u < 0.2 m/s for particulate suspen¬ 
sions; 0.2 < S u < 0.35 m/s for fogs; 0.3 < S u < 0.4 m/s for 
hybrid fog and vapour; and S u < 0.5 m/s for mixtures with 
gas or vapour. For stoichiometric mixtures of acetylene or 
hydrogen in air, S u > 1.0 m/s. For the estimation of turbu¬ 
lent burning velocity, Nettleton quotes Equation 16.3.45 as 
one in common use. 


16.4.6 Chemical decomposition 

If a condensed mist is formed from the saturated vapour of 
a liquid hydrocarbon of high boiling point, prolonged 


Spontaneous ignition 

Khitrin and Goldberg (1957); Sage and Weinberg (1959); 
Sokolik (1960); J. A. Macdonald and White (1965); Melvin 
(1966); Goodman, Gray and Jones (1972); Cullis and Foster 
(1973,1974); Anon. (1982 LPB 47, p. 15); Bowes (1984); Reid, 
Robinson and Smith (1985); Gandhi and Kanury (1988) 

Compression ignition, shock ignition 

Falk (1906,1907); Dixon (1910); Dixon, Bradshaw and 
Campbell (1914); Dixon and Crofts (1914);Tizard and Pye 
(1922); Dixon, Harwood and Higgins (1926); Payman and 
Titman (1935); SMRB (1935 Pap. 93); Wheeler (1935b); 
Payman and Shepherd (1937,1946); Jost (1949); WC.F. 
Shepherd (1949); M.H. Friedman (1963a,b); Borisov, 
Kogarko and Lyubimov (1968); J.W. Meyer and Oppenheim 
(1971b); Vermeer, Meyer and Oppenheim (1972); Halstead 
etd. (1975); Anon. (1978 LPB 19, p. 24); Beeley, Griffiths and 
Gray (1980); Eubank etal. (1981); J.F. Griffiths and Perche 
(1981) 

Chemical ignition 

Bretherick (1979) 

Friction and impact 

SMRE (Appendix 28 Research Reports, Frictional Ignition 
2-5); SMRB (1928 Pap. 46,1929 Pap. 54,1930 Pap. 62,1931 
Pap. 70); Burgess and Wheeler (1929); Bowden, Stoke and 
Tudor (1947); Bowden (1949); Archard (1952); Calcote etd. 
(1952); Bowden and Tabor (1954); Bowden and Thomas 
(1954); Titman and Wynn (1954);Titman (1955/56); Rae 
(1961); M.H. Friedman (1963a,b); Downing (1964); 

N. Gibson, Lloyd and Perry (1967); F. Powell (1969,1978); 








FIRE 16/57 


Cutler (1974,1978); Blickensderfer (1975); Andersen (1979); 
HSE (1980 FI 2); Billinge (1981); Gomez, Wake and Gray 
(1985); Bartknecht (1988) 

Hand tools, non-sparking tools: Anfenger and Johnson 
(1941); API (1956,1980 PSD 2214,1989 Publ. 2214); 
Bernstein and Young (1960); Anon. (1962e); DSIR (1963); 
Fischer (1965); Riddlestone and Bartels (1965); F. Powell 
(1969); Bartels (1970); FPA (1975 Sll, 1989 CFSD FS 6029) 

Electrical discharges and sparks 

Coward, Cooper and Jacobs (1914); Thornton (1914a,b, 
1915a,b); Wheeler (1920,1924); Bradford and Finch (1937); 
Landau (1937a,b); Blanc etal. (1947); Llewellyn (1947-48); 
Blanc etal. (1949); H. Morris (1949); Fenn (1951); Calcote etal. 
(1952); Laffltte and Delbourgo (1953); Olsen, Gayhart and 
Edmondson (1953); Swett (1955,1956,1957); H.E. Rose and 
Priede (1959b); Berz (1961); SMRE (1966 Res. Rep. 240); 
Johnsson, Strid and Johansson (1972); Kumagai, Sakai and 
Yasugahira (1972); Kono, Kumagai and Sakai (1976); 
Adelman (1981); Ballal and Lefebvre (1981b); Maly (1981); 
Sher and Rafael (1982); Fiumara and Avella (1983); FPA 
(1984 CFSD NB 6); H. Kramer (1987); Ko, Anderson and 
Arpaci (1991); Ko, Arpaci and Anderson (1991) 

Flashlights: API (1983 Publ. 2212) 

Telephones: API (1974 PSD 2213) 

Hotwires 

J.H.T. Roberts (1913);Thornton (1919); SMRB (1927 Pap. 36); 
Stout and Jones (1949); Kumagai and Kimura (1957); 
Ashman and Buchler (1961); Detz (1976) 

Hot surfaces 

Mason and Wheeler (1922,1924); Coward and Guest (1927); 
Guest (1930 BM Tech. Pap. 475); Naylor and Wheeler (1931, 
1933); Landau (1937a,b); Mullen, Fenn and Irby (1949); 
Dooley (1957); Husa and Runes (1963); Kuchta, Cato and 
Zabetakis (1964); SMRE (1964 Res. Rep. 224); Adomeit 
(1965); Kuchta, Bartowiak and Zabetakis (1965); Goodall 
and Ingle (1967); Sharma and Sirignano (1969,1970); 
Bartels (1971a); Alkidas and Durbetaki (1973); KN. Palmer 
(1973a); Angel (1975); D.C. Bull and Grant (1975); D.C. Bull 
and Quinn (1975);Thiyagarajan and Hermance (1975); Ono 
etal. (1976); D.C. Bull (1977); Law (1978); Law and Law 
(1979); API (1980 PSD 2216,1991 Publ. 2216); Chen and 
Faeth (1981a); Trevino and Sen (1981); Laurendeau (1982); 
Laurendeau and Caron (1982); F. Powell (1984); Leiber 
(1985); Bartknecht (1988); A.J. Harrison and Cairnie (1988); 
A.J. Harrison etal. (1988); Bothe and Steen (1989); Kumar 
(1989); Giesbrechtefa/. (1992) 

Hot gases 

Muffins (1953);Wolfhard (1958); Wolfhard and Vanpee 
(1959); Vanpee and Bruszak (1973 BM RI6293); Fink and 
Vanpee (1975) 

Hot particles 

Silver (1937); Paterson (1939-); SMRE (1956 Res. Rep. 129); 
Tolson (1972); Su, Homan and Sirignano (1979);Yu-Pen Su 
and Sirignano (1981); F. Powell (1984); Hills etal. (1992) 

Hot projectiles 

Sharma and Sirignano (1970) 

Flame torches and jets 

FPA (CFSD GP 4); Wang etal. (1981); Mackay etal. (1988) 

Smoking 

FPA (1989 CFSD GP 8) 


Diesel engines 

HSE (1986 PM 58); Sokolov (1989) 

Lightning 

Golde (1977a); W.R. Lee (1977); Anon. (1987q); NFPA (2000 
NFPA780) 

Hygroscopic combustible materials 

P. Gray and Wake (1990) 

Sodium 

Yuasa (1985) 

Metal oxides 

Meguerian and Radowsky (1967) 

Welding (see Table 21.1) 

RF ignition 

Jordan and Balmain (1968); Anon. (1978 LPB 23, p. 147); 
Excell and Howson (1978); HSE (1978a, 1979f, 1983 GS 21); 
A. Hall and Burstow (1980); A. Hall and Loveland (1980); 
ERA (1981,1982); Burstow et al. (1981); Howson, Excell 
and Butcher (1981); Maddocks and Jackson (1981); 

S.J.J. Robertson and Loveland (1981); Rosenfeld etal. (1981); 
Bergman (1982); Mannon and Johnson (1982); Widginton 
(1982); Excell and Maddocks (1984); P. Knight and Robson 
(1984); Harrold (1992 SRD R579) 

Laser ignition 

Hills etal. (1992) 

FPA (CFSD AR series, 1972/19); J. Kennedy (1962); NFPA 
(1971/7); Broodo, Gilmore and Armstrong (1976); French 
(1979); Hanson (1980); Carson and Mumford (1986 LPB 70) 

Piloted ignition 

Tzeng, Atreya and Wichman (1990) 

Ignition of gas clouds, jets 

M.T.E. Smith etal. (1986); Gustafson and Mudan (1987) 

Ignition of sprays 

Aggarwal and Cha (1988); Capp (1988); Aggarwal (1989); 
Bergeron and Hallett (1989a,b) 

Ignition models 

English and Waite (1989); A.W. Cox, Lees and Ang (1990) 


Some potential ignition sources on process plants include 
the following: 

(1) flames; 

(2) hot work; 

(3) hot surfaces; 

(4) hot particles; 

(5) friction and impact; 

(6) chemical energy; 

(7) hot materials and gases; 

(8) reactive, unstable and pyrophoric materials; 

(9) engines; 

(10) vehicles; 

(11) lightning; 

(12) radio frequency (RF) emissions; 

(13) smoking; 
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(14) arson and sabotage; 

(15) self-heating; 

(16) static electricity; 

(17) electrical equipment. 

Each of the above sources can cause ignition of a flammable 
gas-air mixture outside the plant. 

Insofar as they can occur inside the plant, these sources 
can also cause ignition of a flammable gas-air mixture 
inside it. In addition, ignition of a flammable gas-air mix¬ 
ture inside the plant may occur due to: 

(18) autoignition 

(19) compression effects. 

Table 16.24 gives a more detailed breakdown of these 
ignition sources. 

These ignition sources are discussed in this section, with 
the exception of self-heating, static electricity and electrical 
equipment, which are considered in Sections 16.6,16.7 and 
16.8, respectively. Information on the most frequent sources 
of ignition was given inTable 2.11. 

The modelling of ignition sources for the purpose of 
hazard assessment is considered in Section 16.10. 

Many potential sources of ignition are associated with 
activities. These need to be controlled by a permit-to-work 
system. This aspect is discussed in Chapter 21. 

The area of flammable hazards should be fenced off and 
strict security enforced on persons entering the area. In 
particular, matches and cigarette lighters should be given 
up on entry. Equipment brought into the area should be 
suitable for use within it. 


16.5.1 Flames 

The flames of burners in fired heaters and furnaces, 
including boiler houses, may be sources of ignition on 
process plants. The source of ignition for the explosion at 
Flixborough may well have been burner flames on the 
hydrogen plant. The flame at a flare stack may be another 
source of ignition. Such flames cannot be eliminated. It is 
necessary, therefore, to take suitable measures such as care 
in location and use of trip systems. 

Burning operations such as solid waste disposal and 
rubbish bonfires may act as sources of ignition. The risk 
from these activities should be reduced by suitable location 
and operational control. 

Smoldering material may act as a source of ignition. In 
welding operations it is necessary to ensure that no smol¬ 
dering materials such as oil-soaked rags have been left 
behind. 

Small process fires of various kinds may constitute 
a source of ignition for a larger fire. The small fires incl¬ 
ude pump fires and flange fires; these are dealt with in 
Section 16.11. 

Dead grass may catch fire by the rays of the sun and 
should be eliminated from areas where ignition sources are 
not permitted. Sodium chlorate is not suitable for such 
weed killing, since it is a powerful oxidant and is thus itself 
a hazard. 

16.5.2 Hot work 

Hot work, such as welding, cutting and grinding activities, 
is a potential source of ignition. In welding, for example, 
this applies not only to the welding flame or arc, but also to 
material ignited by the welding. 


Table 16.24 Some ignition sources on process plants 
A General 


Flames 


Hot work 


Hot surface 


Flare: elevated or ground level 
flare; 

full flare or pilot condition; 
incinerator 

Furnace: natural or forced draught 
furnace 
Fired heater 
Boiler 

Laboratory heater: bunsen burner; 
furnace 

Personnel heater: solid fuel or 
electrical fire 

Burning operations: burning 
rubbish; burning during 
demolition 

Firing: explosion for demolition; 

other explosives 
Warning flare: hazard warning 
flare; fog warning detonator 
Accidental fire 

Hot material: brand; hot particles 
Welding: arc welding; 

oxyacetylene welding 
Cutting: oxyacetylene cutting 
Grinding 
Hot tapping 

General: vessel and pipework 
Machinery: engines; turbines; 
exhausts 

Laboratory equipment: hot plate; 


Friction and impact 


Hot material or gas 


Pyrophoric, reactive 
and unstable 
materials Engines 


Smoking 

Vehicles 


Atmospherics 
Radio frequency 
transmission 


Hot particles: soot 
Impact: hand tool; power tool; boot 
stud; loosening of caked 
material; moving vehicle 
Rubbing: belt, conveyor, roller; 
brake, clutch on machinery; 
skidding of road or rail tanker 
Discharged material: hot ash from 
boiler; used catalyst; hot 
process material 
Hot gas 

Ingestion of flammable: petrol, 
diesel or gas engine mixture 

Chemical effects 
Friction and impact: thermite 
reaction (see above) 

Instrument: catalytic element 
Means of lighting: matches; lighter 
Item smoked: cigarette; cigar; pipe 
General vehicles: petrol, diesel or 
electrically driven 
Crane 

Forklift truck 
Helicopter 
Aircraft 
Lightning 

See Subsection 16.5.12 
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Arson, sabotage 
Compression 
Mechanical rupture 

Self-heating 

Static electricity 
Electrical 


Fire 

Explosion 

Ingestion of flammable mixture: 

compressor; high speed blower 
Spark associated 
with rupture giving 
rise to release 
Dust layer 
Oil soaked lagging 
See also Section 16.6 
See Section 16.7 

Machinery: motors, alternators, 
dynamos, converters 
Fixed equipment: contact devices 
such as switches, relays, 
contactors 

Fixed equipment-failures: failure 
of protective equipment; failure 
causing arcing 

Insulator: arcing across spark 
gaps at high voltage insulators 
Wiring: loose connection; poor 
joint; damaged wiring 
Cable: broken cable; damaged 
cable; water ingress 
Batteries: connecting up damaged 
battery 
Instrument 
Heating tape 
Lighting 

Fault current conductor: 
poor joint 

Portable equipment: meter; radio; 
TV; camera; hearing aid 
Ground movement: 
sparking due to ground 
movement such as earthquake 
or subsidence 


B Internal 


Auto-ignition a 

Compression 


Reactive, unstable 
material 


Catalytic material 
Hot material 
Hot surface 


Electrical 


Pump: compression by pumping 
against closed valve 
Hammer blow: compression by 
hammer blow in pipeline 
Liquid slug: compression by liquid 
slug 

Air bubbles: compression of air 
bubbles in liquid 
Pyrophoric material 
Incompatible material: material 
which reacts with material of 
construction 

Hot catalyst; hot dust; hot gas 
External hot work 
Rotating machinery: ingestion of 
tramp metal 

Distressed machinery: hot bearings; 
hot particles 

Lamp: damaged wander lamp 
Heater - failure: failure causing 
overheating 


Self-heating See Section 16.6 

Static electricity See Section 16.7 


a A flammable mixture can undergo a combustion reaction outside the 
normal flammability limits. These limits apply essentially to propa¬ 
gation rather than ignition as such. 


Hot work accounts for an appreciable proportion of 
ignition incidents. In the vast maj ority of cases the material 
ignited is in the equipment being worked on. It is relatively 
rare for hot work to be the source of ignition of a vapour 
cloud. 

It is necessary to exercise close control of hot work by 
training, supervision and use of a permit system. 

16.5.3 Hot surfaces 

Surfaces of plant equipment are frequently hot and some 
may be potential ignition sources. Hot surfaces include: 

(1) hot process equipment; 

(2) distressed machinery. 

Much process equipment operates at high temperature. 
Although the equipment is usually lagged, there may be 
some surfaces, which could be a source of ignition. 

Machinery in distress, such as a pump with a faulty 
bearing, may run hot and this hot spot is a potential source 
of ignition. 

Traditionally, the AIT was taken as the limiting tem¬ 
perature above which a hot surface might ignite a gas 
mixture. Codes for HAC have tended to quote AITs as hot 
surface temperature limits. 

It has long been appreciated, however, that there is a 
difference between the hot surface temperature that will 
ignite a flammable gas-air mixture and the AIT. This 
temperature excess depends on the conditions. Relevant 
factors include the fuel and fuel concentration, the material, 
area and geometry of the surface, and the fluid flow and heat 
transfer conditions. 

Hot surface ignition has been the subject of a good deal of 
work and details are given in Section 16.3. This work con¬ 
sistently shows that an appreciable temperature excess is 
necessary for ignition to occur. It also demonstrates that 
the temperature excess required increases as the hot sur¬ 
face area decreases. The necessary temperature excess also 
increases as the gas velocity increases. One effect of 
increasing the gas velocity is to reduce the residence time of 
the gas and this may then fall below the ignition induction 
period. 

Industrially oriented work by Husa and Runes (1963) 
indicated that for hot surfaces in the open air a temperature 
excess of several hundred degrees was required to give 
ignition. The systems investigated were, however, not well 
defined by the standards of more recent work. 

Practical guidance is given in API Publ. 2216:1991 Igni¬ 
tion Risk of Hydrocarbon Vapors by Hot Surfaces in Open Air. 
This draws attention to the work of Hilado and Clark 
(1972b) and Goodall and Ingle (1967) on the effects on 
ignition of the induction time and of gas velocity, respec¬ 
tively, and the work of Husa and Runes. It states that as a 
rule of thumb, and based on open air tests, ignition by a hot 
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surface should not be assumed unless the surface tem¬ 
perature is at least 200°C above the normally accepted 
minimum ignition temperature. 

A hot surface is a potential ignition source inside as well 
as outside the plant. The rule of thumb just quoted is not 
intended to apply in this case, although induction time and 
gas velocity are again relevant factors. 

16.5.4 Hot particles 

Another form of hot surface is a hot particle. A hot particle 
that is common on plant is soot from burners or from a flare. 
Hot soot from chimneys may be a source of ignition. It is a 
particularly important potential source of ignition on 
ships. 

16.5.5 Friction and impact 

Impact, friction and frictional impact can be a source of 
ignition for a flammable gas—air mixture. A review has 
been given by F. Powell (1969). An account of some of the 
fundamental phenomena is given in Section 16.3. 

Essentially, incendive sparks caused by impact and 
friction are due to the generation of a surface hot spot. 
A falling object can give an incendive spark. The tempera¬ 
ture rise may correlate only weakly with the kinetic energy 
but can be sufficient to cause ignition. It is normal to adopt 
procedures to prevent damage to the plant by falling 
objects. However, dropping of objects can occur which may 
not be controlled by these measures such as drums, hand 
tools, etc. 

Ignition by a falling object is likely to be most serious in a 
space that already contains a flammable atmosphere. 
Objects such as tank washing machines or cathodic pro¬ 
tection anodes in ships’ cargo tanks illustrate this. Cigar¬ 
ette lighter flints can also cause a mechanical spark if the 
lighter is dropped. 

One situation that is liable to cause ignition in frictional 
impact is where rusty steel with an aluminium smear is hit 
by a hard object. Under these conditions the thermite reac¬ 
tion occurs. This reaction, which can reach a temperature of 
3000°C, is an effective ignition source. The source of the 
aluminium may be aluminium paint or the impacting obj ect 
itself. 

Work by Kingman, Coleman and Rogowski (1952) has 
shown that oil bound paints do not give sparks unless pre¬ 
heated to 150°C. Subject to avoidance of such heating, 
therefore, such paints may be used on steel in hazardous 

The striking of quartzite materials, including concrete 
containing sand, by a metal tool is another situation liable 
to give incendive sparks. A report by the Department of 
Scientific and Industrial Research (DSIR) (1963) gives 
details of fires attributed to frictional sparks, most of which 
involved various metals and concrete or stone. 

An aspect that has received a good deal of attention over 
the years is the use of ‘non-sparking tools’. Materials used 
in such tools characteristically do not readily oxidize and 
have high thermal conductivity. 

Reviews of the use of non-sparking tools have been given 
by F. Powell (1969) and Cross and Fairer (1982). Essentially, 
some investigators have concluded that regular steel tools 
are no more hazardous than non-sparking tools, while 
others believe there is a benefit to safety in the use of non¬ 
sparking tools. Anfenger and Johnson (1941) performed 
experiments on the incendivity of sparks produced by steel 


on a grinding wheel, which ignited carbon disulfide but not 
petrol vapour. 

On the basis of this work and practical experience the 
American Petroleum Institute (API) in Sparks from Hand 
Tools (1956) concluded that there is no significant increase 
in safety from the use of non-sparking tools. API Publ. 
2214: 1989 Spark Ignition Properties of Hand Tools states 
that nothing essentially new has been learned since the 
1956 publication and that the fire records of more and more 
companies which have never used, or have ceased to 
use, non-sparking tools amply confirm the position then 
taken. Non-sparking hand tools are discussed further in 
Chapter 21. 

Other workers such as those at the DSIR (1963) and Rid- 
dlestone and Bartels (1965) draw attention to ignitions 
caused by the striking of metals on concrete or stone and 
point out that it is in this situation that the ignition risk is 
significant, and that metals used in non-sparking tools are 
also liable to give ignition in this case. For this rather dif¬ 
ferent reason they conclude that non-sparking tools offer 
little benefit. 

Another point that detracts from the potential benefit of 
non-sparking tools is that they tend to be soft, so that hard 
particles can become embedded in the tool. 

Other workers have seen a benefit in the use of non¬ 
sparking tools. On the basis of impact and grinding 
experiments Fischer (1965) recommends the use of steel 
tools for work where there may be Class I gases, but not 
where there may be Class II gases. 

Certain gases such as hydrogen, acetylene and carbon 
disulfide are particularly sensitive to ignition by impact 
and friction. If such a gas is present, there is a potential 
ignition risk in the use of any tool. Non-sparking tools are 
considered further in Chapter 21. 

A study of ignitions by impact, friction and frictional 
impact has been made by Billinge (1981). He classifies these 
ignitions as due to impact, rubbing or cutting and grinding, 
and as high, medium or low energy. The individual inci¬ 
dents are shown in Table 16.25 and the analysis of these 
incidents is given in Table 16.26. 


16.5.6 Chemical energy 

There are several forms of chemical energy that may give 
ignition. They include (1) the thermite reaction, (2) reactive, 
unstable and pyrophoric materials and (3) catalytic 
instruments. The thermite reaction is obtained from alu¬ 
minium smears on rusty steel, as described above. Reac¬ 
tive, unstable and pyrophoric materials are considered 
below. 

Some instruments contain catalytic elements, which 
measure the temperature rise resulting from combustion of 
a flammable gas. Generally, these instruments (such as 
flammable gas detectors) are intended to operate in hazar¬ 
dous areas and are therefore designed so that they should 
not act as an ignition source. 


16.5.7 Hot materials and gases 

Hot materials such as hot ash, hot used catalyst or hot 
process material, and hot gases may, in principle, act as 
ignition sources. Generally, however, operations invol¬ 
ving such hot materials are excluded from hazardous 
areas and they do not figure as a significant ignition 
source. 
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Table 16.25 Some incidents involving friction and impact ignition relevant to the process industries in the period 
1958-78 (after Billinge, 1981): details of incidents (Courtesy of Fire Prevention Science and Technology) 


A Gases and vapours 

Fuel Cause Classification 


Group IIA 

Petrol Spark from hammer; hammer on steel clasp; shoe nail on Low energy impact 

concrete floor; boot nail on concrete floor; dropped tool 
or steel tipped boot on concrete floor; dropped tool on floor; 
screwdriver punched through drum lid 

Falling drum; dropped can of petrol on floor; impact between Medium energy 
drums; impact between car and petrol pump; impact between 


Jet fuel 

Crude oil vapour 


Oil vapour 


LPG 

Liquefied butane 
Propane 


Pentane 
Benzene 
Natural gas 

Methanol 


Ethanol 


Hexane/ethanol 

Isopropanol 

Acetone 

Acrylic paint solvent 
Mixed solvent vapours 

Ethyl chloride 
Vinyl acetate 
Group IIB 
Ethylene 


Coke oven gas 
Group IIC 
Hydrogen 


Acetylene 


Sparking from brakes of rail tank wagon 
Collision between ships 

Skidding overturned road tanker (x 3); barge ripped open 
by bridge fender 
Tanker scraped lock wall 

Magnesium anode impact; pipeline coupling falling onto 
ship’s deck 

Collision between ships 
Defective pump 

Ferrous metal in aluminium polishing and grinding machine 

Steel cylinders with aluminium smears 

Crashing rail wagons 

Crashing road tanker 

Valve knocked off gas tank 

Impact of aluminium wrench on pipe joint 

Metal object in chopping machine 

Collapsing metalwork 

Tool dropped down oil well 

Mechanical shovel fractured gas main 

Impact between nozzle and wall 

Tramp metal in grinding process 

Belt rubbing on copper tube 
Friction in centrifuge 

Impact between digger and center cone of centrifuge 
Grindstone sparks 

Friction in centrifuge 

Impact of drum on ground 

Impact of drum on ground 

Defective extractor motor fan 

Truck ran over drum of solvent 

Impact between drum or lighter and floor 

Impact between metal ditch covers 

Impact between filling nozzle and loading aperture 


Unscrewing valve from pipe 
Sparks from bursting tire 

Collapsing shelf holding gas meter 


Medium energy 
Rubbing 

High energy impact 
High energy rubbing 


Medium energy impact 

High energy impact 
Medium energy 
rubbing 
Medium energy 

cutting and grinding 
Low energy impact 
High energy impact 
High energy impact 
Medium energy impact 
Low energy impact 
Medium energy impact 
Medium energy impact 
Medium energy impact 
High energy impact 
Medium energy impact 
Medium energy 

cutting and grinding 
Medium energy rubbing 
Medium energy rubbing 
Medium energy impact 
Medium energy 

cutting and grinding 
Medium energy rubbing 
Medium energy impact 
Medium energy impact 
Medium energy rubbing 
Medium energy rubbing 
Medium energy impact 
Medium energy impact 
Medium energy impact 
Low energy impact 
Medium energy 

cutting and grinding 
Medium energy impact 


Hammer hitting bolts on steam line; spark between 
cylinder cap and tool 
Drilling pipe; 

abrasive cutting and grinding of pipe 
Moving or opening drum of carbide; cylinder fell from lorry; 
feed cone dropped into hopper of carbide 


Low energy impact 
Medium energy cutting 
and grinding 

Medium energy impact 
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Table 16.25 (continued) 


Sparks from grinding process 

Medium energy cutting and 



grinding 

Carbon disulfide 

Impact between brass rod and caked material 

Low energy impact 

Various vapours 

Gear wheels not properly meshed; friction in 

Medium energy impact 

and solvents 

centrifuge; falling metalwork; dismantling metalwork; 
agitator fell into mixing tank 



Cellulose film rubbing on roller 

Medium energy rubbing 


Cutting pipe with (mechanical) hacksaw 

Medium energy cutting and 



grinding 

B Powders and dusts 

Foodstuffs 

Grain dust 

Nut, bolt or stone in suction pipe; metal object in 

Low energy impact 


hopper machine 

Impact of pulley with wall; foreign body in mill 

Medium energy impact 

Sugar dust 

Wood screw fell into mill 

Medium energy impact 


Elevator buckets rubbing on guides 

Medium energy rubbing 

Peppercorn dust 

Foreign body in mill 

Medium energy impact 

Flour dust 

Overheated bearing (x 3); overheated motor 

Medium energy rubbing 

Flour and 

Overheated pulley and belt drive 

Medium energy rubbing 

grain dust 

Corn dust 

Friction between belt drive and pulley guard 

Medium energy rubbing 

Organic chemicals 

Organic powder 

Foreign body in mill 

Medium energy impact 

Niacin dust 

Bolt in mill 

Medium energy impact 

Phenolic molding 

Spark from unknown agent 

Medium energy impact 

powder 

Spark from grinding machine 

Medium energy cutting 



and grinding 

Cellulose nitrate dust 

Chipping concrete with air hammer 

Medium energy impact 

Dinitrosopentamethylene 

Impact of fork lift truck with 

Medium energy impact 

tetramine 

fibre container 


Diazonium salt 

Hammering wedges 

Low energy impact 

Sodium picramate 

Impact of drum on floor 

Medium energy impact 

Inorganic chemicals 

Giant gel 40% 

Aluminium tamp punch on steel grating bars 

Low energy impact 

dope/sulfur 

Ammonium perchlorate 

Scraping with spatula 

Low energy impact 


Spatula left in mixer 

Medium energy rubbing 


Friction from beryllium cutting knives 

Medium energy cutting 



and grinding 

Thermite 

Cleaning edge runner mill 

Low energy impact 

Aluminium 

Steel tool on rusty lid of container 

Low energy impact 

powder 

Sulfur 

Mechanical shovel striking metal deck; mechanical 

Medium energy impact 


impact of crane grab with bulkhead; metal grabs striking 
ships structure; frictional spark from crane grab; 
mechanical shovel hitting side of ship’s hold; steel 
tub falling into ship’s hold 

Medium energy impact 

Windproof 

Carton of matches fell 2 m 


matches 

Rocket propellant 

Metal-metal contact in mixer 

Medium energy rubbing 

Pyrotechnic mixture 

Metal-metal contact in mixer 

Medium energy rubbing 

Zirconium dust 

Sparks from grinding steel 

Medium energy cutting 



and grinding 

Powder 

Hopper fell and impacted tram car 

Medium energy impact 

Oil mist 

Overheated pump 

Medium energy rubbing 
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Table 16.26 Some incidents involving friction and impact 
ignition relevant to the process industries in the period 
1958-78 (after Billinge, 1981): analysis of incidents 
(Courtesy of Fire Prevention Science and Technology) 


No. of incidents 



Gases and 
vapours 

Powders and 
dusts 

Low energy: impact 

13 

7 

Medium energy: impact 

27 

19 

rubbing 

8 

11 

cutting and grinding 

High energy: 

8 

3 

impact 

5 


rubbing 

5 


Total low energy 

13 

7 

Total medium energy 

43 

33 

Total high energy 

10 

- 

Total impact 

45 

26 

Total rubbing 

13 

11 

Total cutting and grinding 

8 

3 

Overall total 

66 

40 


16.5.8 Reactive, unstable and pyrophoric materials 

Reactive, unstable or pyrophoric materials may act as an 
ignition source by undergoing an exothermic reaction so 
that they become hot. In some cases the material requires 
air for this reaction to take place, in others it does not. 

The most commonly mentioned pyrophoric material is 
pyrophoric iron sulfide. This is formed from reaction of 
hydrogen sulfide in crude oil in steel equipment. If condi¬ 
tions are dry and warm, the scale may glow red and act as a 
source of ignition. Pyrophoric iron sulfide should be 
damped down and removed from the equipment. No 
attempt should be made to scrape it away before it has been 
dampened. 

A reactive, unstable or pyrophoric material is a potential 
ignition source inside as well as outside the plant. 

16.5.9 Engines 

Engines on process plants are another ignition source and 
tend to figure significantly. 

One type of engine in use for a variety of purposes is the 
diesel engine. Guidance on the use of diesel engines in 
relation to hazardous areas is given in a number of codes. 
One is Guidelines on Protection of Diesel Engines for Hazar¬ 
dous Zone 2 Areas (Lloyd’s Register, n.d.). Another is 
Recommendation for the Protection of Diesel Engines Opera¬ 
tion in Hazardous Areas (Oil Companies Materials Asso¬ 
ciation, 1977). 

A discussion of diesel engines in this context has been 
given by Sokolov (1989), who considers the various poten¬ 
tial ignition sources on the engine and the steps that can be 
taken to prevent ignition by these sources. 

One potential ignition source on a diesel engine is the hot 
gas. Exhaust gas temperatures can be as high as 500°C. 
Ignition by hot exhaust gas involves turbulent stream 
ignition, which can occur at a temperature less than the 
average temperature of the gas mixture. A safety factor is 
therefore required. Codes typically recommend that the 
temperature of the exhaust gas should not exceed 0.6-0.8 


of the AIT of any flammable gas that may be present. 
Sokolov quotes the following: 


Gas 

Ignition Safe exhaust 

temperature (°C) gas temperature (°C) 

Methane 

595 

396 

Propane 

470 

313 

Natural gas 

482-650 

320 

Condensate 

275 

183 


Another important part of the engine is the induction and 
exhaust systems. These systems are designed to avoid 
detonation but to handle deflagration. There are minimum 
design pressures which tend to lie in the range 8-10 bar, 
that for the United Kingdom being 10 bar and that for the 
United States 8.6 bar. Induction and exhaust systems are 
provided with flame arresters; exhausts are provided with 
spark arresters. 

Crank cases are another feature of a diesel engine that 
requires protection. 

The preferred start-up arrangements for the engine in a 
hazardous area are pneumatic, hydraulic or manual rather 
than electrical. 

Diesel engines are generally equipped with shut-down 
devices and alarms activated by overspeed and by failures 
of the various subsystems. Depending on the application, 
the device may act to cut off the fuel or to shut off the air 
intake and effect gradual gas path deflection. 

16.5.10 Vehicles 

A chemical plant may contain at any given time consider¬ 
able numbers of vehicles. These vehicles are potential 
sources of ignition. Instances have occurred in which 
vehicles have had their fuel supply switched off, but have 
continued to run by drawing in, as fuel, flammable gas from 
an enveloping gas cloud. The ignition source of the flam¬ 
mable vapour cloud in the Feyzin disaster in 1966 was 
identified as a car passing on a nearby road (Case History 
A38). It is necessary, therefore, to exclude ordinary vehi¬ 
cles from hazardous areas and to ensure that those that are 
allowed in cannot constitute an ignition source. 

Vehicles that are required for use on process plant 
include cranes and forklift trucks. Various methods have 
been devised to render vehicles safe for use in hazardous 
areas and these are covered in the relevant codes. 

16.5.11 Lightning 

Lightning is another potential ignition source on process 
plants. Information on lightning and on lightning protec¬ 
tion is given in Installation of Lightning Protection Systems 
(NFPA 780) and Lightning (Golde, 1977a). 

Lightning has traditionally been a significant ignition 
source for storage tank fires. A major incident of this kind 
occurred at Beaumont,Texas, in 1970 (Case History A46). 

Guidance on lightning protection is given in BS 6651: 
1985 Code of Practice for Protection of Structures against 
Lightning. 

16.5.12 Radio frequency transmissions 

The possibility exists that RF transmissions from strong 
sources such as large military transmitters may act as an 
ignition source on process plants. This has been recognized 
for some time as instanced by the existence of a British 
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Standard BS 4992:1974 Guide to Protection Against Ignition 
and Detonation Initiated by Radio Frequency. 

A situation where concern was expressed about such 
possible interaction arose in Britain in the late 1970s in 
respect of the transmitter at Crimond operated by the Royal 
Navy and located about 4 miles from the natural gas term¬ 
inal at St Fergus. The naval transmitter responded by 
reducing its power output. 

Studies of this hazard were undertaken by a number of 
workers (A. Hall and Burstow, 1980; A. Hall and Loveland, 
1980; Burstow et al., 1981; Howson, Excell and Butcher, 
1981; Rosenfeld et al., 1981) and the Health and Safety 
Executive (HSE) published two reports: Assessment of the 
Hazard from Radio Frequency Ignition at the Shell and Esso 
Sites at Braefoot Bay and Moss Morran, Fife (HSE, 1978a) 
and Report of the Steering Committee on Radio Frequency 
Ignition Hazards at St Fergus, Scotland (HSE, 19790). 

The British Standard guidance was revised and issued 
as BS 6656: 1986 Prevention of Inadvertent Ignition of 
Flammable Atmospheres by Radio-frequency Ignition, and 
revised again in 1991. 

The conditions for RF ignition of a flammable mixture to 
occur are (1) electromagnetic radiation of sufficient inten¬ 
sity, (2) a structure capable of acting as a receiving aerial 
and (3) a mechanism for creating an incendive spark. 

The transmitter may be fixed or mobile. Mobile trans¬ 
mitters include vehicles, ships and aircraft. The standard 
give details of typical transmitter frequency ranges and 
power outputs. Transmission may be continuous wave 
(CW) or modulated. The latter includes pulsed radar. 

The degree of hazard depends on the frequency of the 
transmission. The hazardous range of interest is 15 kHz to 
35 GHz. There is little hazard at frequencies below 15 kHz. 
For frequencies below 30 MHz the most efficient receiver is 
the loop configuration. At higher frequencies all structures 
are large compared with the wavelength. A part of a struc¬ 
ture may behave as an efficient aerial and is then treated 
as a long dipole. An aerial can concentrate the power in 
a particular direction and is said to have gain in that 
direction. 

The structures primarily considered in BS 6656:1991 
are loop-type structures and vertical structures. Some 
typical loop-type structures are illustrated in Figure 16.34. 
A loop structure has maximum efficiency and is self¬ 
resonant when its internal perimeter is about half one 
wavelength, but structures with a smaller perimeter can 
be brought to resonance if there is a discontinuity with 
stray capacitance across it. Cranes are particularly 
efficient receivers in this context and require particular 
attention. 

For any potential discontinuity in the structure it is 
possible to determine the maximum extractable power 
given (1) the structure perimeter, (2) the transmission fre¬ 
quency and (3) the incident field strength. 

Vertical structures include vents, flares and columns. 
Free-standing structures of this kind are not classed as 
among the more efficient receivers, since even a concrete 
base has a low impedance path to ground. They can gen¬ 
erally be disregarded, except where the vertical structure is 
part of a loop. 

An RF discharge occurs most readily when two surfaces 
are drawn apart, thus giving a break-spark. Discharges 
across a fixed gap are not considered to be a significant 
problem. It is activities such as maintenance and handling 
and phenomena such as flexing and vibration of pipe work 


or thermal expansion of structures, which are liable to give 
rise to an incendive discharge. 

The factor determining RF ignition is the thermal 
initiation time. For times less than this ignition is governed 
by the discharge energy, and for times greater than this it is 
governed by its power. The thermal initiation times are 
approximately 100 ps for methane and ethylene and 20 ps 
for hydrogen, which are representative of the Class IIA, IIB 
and IIC gases, respectively. The standard gives ignition 
criteria for continuous transmissions and for pulsed radar 
transmissions. 

The potential RF ignition hazard exists only in a few 
locations.There are few reported incidents of such ignition. 
BS 6656:1991 adopts a graded approach to assessment of 
the hazard. An initial assessment is used for screening and 
a full assessment is undertaken only if a potential hazard is 
found to exist. 

The initial assessment is based on the search areas given 
in Table 16.27 and proceeds as follows. The search area 
around the plant is determined from the table. If there is no 
transmitter within the search area, there is no hazard. If 
there is a transmitter with the search area, a check is made 
as to whether the plant is within the vulnerable zone of the 
transmitter. The standard gives information on the vul¬ 
nerable zones for various types of transmitter. If the plant 
is within the vulnerable zone of a transmitter, a full 
assessment should be undertaken. 

BS 6656:1991 gives the procedures for a full assessment, 
including: a flow chart for a theoretical assessment and one 
for an assessment based on plant measurements; methods 
of taking measurements; methods of performing the cal¬ 
culations; and worked examples. 

If a hazard exists, the principal countermeasures are 
(1) bonding, (2) insulating, (3) reducing the RF efficiency of 
structures and (4) de-tuning of structures. Typical applica¬ 
tions where bonding might be used are where thermal 
expansion may result in intermittent contacts and across a 
pair of flanges prior to their parting in maintenance work. 
Bonding to ground is not suitable. Insulation may sometimes 
beused wherebonding is impractical; it is apossible solution 
for intermittent contact by thermal expansion. The RF effi¬ 
ciency of a structure may be reduced at the design stage by 
altering the internal perimeter. Other measures for reducing 
efficiency include breaking the loop into smaller sections by 
the use of conductors and covering the entire area of the loop 
with a sheet of metallic mesh bonded to the structure at 
points around the perimeter. If there is one major transmis¬ 
sion frequency causing the problem and other measures are 
not practical, it may be possible to detune the structure by 
connecting to it reactive components. 

Special cases considered in the standard include cranes, 
mobile and portable transmitters, ships and offshore plat¬ 
forms. The Orford Ness transmitter is accorded special 
treatment. 

16.5.13 Smoking 

Smoking and smoking materials are potential sources of 
ignition. Ignition may be caused by a cigarette, cigar or 
pipe or by the matches or lighter used to light it. A cigarette 
itself may not be hot enough to ignite a flammable gas-air 
mixture, but a match is a more effective ignition source. 

It is normal to prohibit smoking in a hazardous area and 
to require that matches or lighters be given up on entry to 
that area. The ‘no smoking’ rule may well be disregarded, 
however, if no alternative arrangements for smoking are 
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Figure 16.34 Some typical loop-type structures for RF ignition (BS 6656:1991): (a) loop formed by columns and pipes; 
(b) loop formed by columns and pipes; (c) horizontal loop; (d) tanker loading facility; (e) storage tanks; (f) fixed crane; and 
(g) mobile crane, h, Height of loops; p, internal perimeter of loop (Courtesy of the British Standards Institution) 
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Table 16.27 Maximum radius of search area (m) for initial 
assessment of an RF ignition hazard a (BS 6656: 1991) 
(Courtesy of the British Standards Institution) 


Gas group 

Maximum radius (m) 


All loop structures 

of inside perimeter <40 m 

and horizontal loops of height <5 m 

All other loop 
structures 

I or IIA 

4,100 

11,500 

IIB 

5,200 

14,200 

IIC 

6,500 

17,500 


“Table does not apply to locations to the seaward side of Orford Ness, 
Suffolk. 


provided. It is regarded as desirable, therefore, to provide a 
room where it is safe to smoke, though whether this is done 
is likely to depend increasingly on general company policy 
with regard to smoking. 


16.5.14 Arson and sabotage 

A source of ignition, which cannot be ruled out, is arson. 
Information on the frequency of arson as a source of igni¬ 
tion was given in Table 2.11. While arson is probably a less 
important cause of fires in the process industry than of 
fires generally, it should nevertheless be considered. 
Security in relation to arson is discussed in Chapter 20. 


16.5.15 Autoignition 

Strictly, ignition of a bulk flammable gas—air mixture by 
heating the mixture to its AIT is the alternative to ignition 
by a local ignition source. It is convenient, however, to deal 
with it at this point. 

Heating of the bulk gas-air mixture outside the plant 
will occur by contact with a hot surface, as described above. 
Autoignition as such may therefore be regarded as a form 
of ignition, which occurs inside the plant. 

The autoignition may occur inside the plant at essentially 
atmospheric pressure or at some higher pressure. If, however, 
the heating occurs due to compression, the phenomenon is one 
of compression ignition, which is described below. 


16.5.16 Compression effects 

A mixture of flammable gas and air may be heated to its 
AIT by compression. This effect is often referred to as the 
diesel effect. There are a number of conditions in process 
plant that can give rise to such compression. 

Compression ignition is described in Section 16.3. The 
point was made there that, given a homogeneous mixture, 
such autoignition is not restricted to the normal flamm¬ 
ability range. 

Compression of amixture of flammable gas and air maybe 
caused by pumping against a closed valve, by water hammer 
inapipelineorbyaliquid slug travelling down a line. 

A case history involving compression ignition in which a 
mixture of flammable gas and air was compressed by a 
pump pumping against a closed valve is described by Anon. 
(LPB191978, p. 24). The pump had a nominal head of 30 m. 
Subsequent tests showed that pressure oscillations occur¬ 
red in the trapped gas, which were up to eight times higher 
than the equilibrium head of the pump. 


Another form of compression ignition can occur due to 
compression of air bubbles in a flammable liquid. The tem¬ 
perature rise inside such bubbles can be high. 

16.6 Self-heating 

Self-heating, or spontaneous combustion, of a solid mate¬ 
rial is generally a process of slow oxidation. Material 
undergoing self-heating may act as a source of ignition or it 
may give rise to a fire or explosion. The topic of thermal 
explosion and self-heating has many ramifications beyond 
the self-heating of solid materials. These other aspects are 
considered in Section 16.3. 

Early work on self-heating was done by Frank- 
Kamenetsky (1955) and by Semenov (1935). P.M. Thomas 
and Bowes, both separately and together, have published a 
series of treatments (e.g. P.M. Thomas, 1958; P.M. Thomas 
and Bowes, 1961a, 1967; Bowes, 1976). The subject has been 
reviewed in Self-heating (Bowes, 1984) and by P. Gray and 
Lee (1967b). Application of the theory to process plant 
problems has been discussed by Bowes (1976). 

Selected references on self-heating are given in 
Table 16.28. 

16.6.1 Self-heating in industrial processes 

Materials in process, storage or transport may undergo 
self-heating. The self-heating is due to the exothermic 
reaction of slow oxidation of the material. If conditions are 
critical, this self-heating results in ignition. Examples are 
materials handled in process equipment such as driers, 
materials stored in piles in warehouses or in the open, or 
materials transported in large containers as in ships. A 
well-known example is the spontaneous combustion of coal 
stored in piles on the ground. 

In some cases the hazard is intensified by the fact that 
the material enters the storage relatively hot. This can 
occur, for example, with material that has just been passed 
through a drier. 

Unstable materials may also undergo an exothermic 
reaction so that self-heating occurs. 

Self-heating is liable to occur in oil-soaked lagging. In 
this case it is the oil, which undergoes oxidation. Self¬ 
heating may also occur in dust layers. In both cases the 
smoldering material may then act as an ignition source. 

Self-heating can also occur in oil rags left on steam pipes, 
in dirty cotton waste put in a boiler suit pocket, or in damp 
clothing stowed away in a locker. 

The substance that undergoes reaction must be reactive 
and may be bulk solid such as coal or a reactive substance 
on a substrate such as oil-soaked lagging. 

16.6.2 Self-heating incidents 

Most incidents due to self-heating arise in the kind of 
situations just described. Usually they do not have dra¬ 
matic consequences. This is not always so, however. 

In 1987, a severe explosion and fireball occurred at the BP 
Chemicals EO plant at Antwerp (Case History A115). The 
cause of the explosion was identified as the decomposition 
of EO in the purification column. It was concluded that the 
most probable cause of the explosion was a leak of EO into 
the insulation of the column, leading to self-heating which 
ignited the escaping EO. 

In 1989, the BASF EO plant at Antwerp suffered two 
severe explosions, each accompanied by a fireball (Case 
History A122). The first explosion occurred in a column 
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Table 16.28 Selected references on thermal explosion, 
self-heating and spontaneous combustion 


Mackey (1895,1896); Semenov (1928,1935,1940,1942, 
1959); Frank-Kamenetsky (1939a,b, 1942,1945,1955); 
Zeldovitch (1939); Gordon (1948); Rideal and Robertson 
(1948); N.D.Mitchell (1951); A. Thomas (1951); Chambre 
(1952); Bowes (1954,1962,1968,1969,1972,1974a,b, 1976, 
1984); Hicks (1954); Mullins (1955); Enig (1956,1966); Enig, 
Shanks and Southworth (1956); Khitrin and Goldenberg 
(1957); P.M. Thomas (1958,1960,1961,1965a, 1972,1973a, 
1984); Cook (1959); P. Gray and Harper (1959a,b); Kinabara 
and Akita (1960); Zinn and Mader (1960); Parks (1961); 
P.M. Thomas and Bowes (1961a,b, 1967); Bowes and 
Townshend (1962); Gross and Arnster (1962); Zinn (1962); 
Boddington (1963); M.H. Friedman (1963a,b, 1967,1968); 
Merzhanov, Barzykin and Gontovskaya (1963); Adler and 
Enig (1964); Wake and Walker (1964); Clemmow and 
Huffington (1965); P. Gray and Lee (1965,1967a,b); 
Steggerda (1965); Bowes and Thomas (1966); van Geel 
(1966); Merzhanov (1966,1967); Merzhanov and 
Dubovitsky (1966); B.F. Gray and Yang (1967); Gugan (1967, 
1974a); Tyler and Wesley (1967); Bowes and Langford 
(1968); B.F. Gray (1969a,b, 1973-); P. Gray, Lee and 
MacDonald (1969); Rosser and Rajapakse (1969); 
Boddington and Gray (1970); Boddington, Gray and 
Harvey (1971a,b); Merzhanov and Averson (1971); Wake 
(1971,1973); Birkby, Brown and Street (1972); FRS (1972 
Fire Res. Note 937); Goodman, Gray and Jones (1972); 

B.F. Gray and Sherrington (1972); Hardee, Lee and 
Donaldson (1972); Hermance (1973); Wake and Rayner 
(1973); Shouman, Donaldson and Tsao (1974); Zaturska 
(1974,1975,1978,1980,1981,1983,1984); Kassoy and Poland 
(1975); Shouman and Donaldson (1975,1977); MacDermott 
(1976); P. Gray and Sherrington (1977); Kerns (1977 BM 1C 
8757);Takeno (1977); Adler (1978,1983,1987); BRE (1978 
CP12/78,1982IP6/82,1984 SO 41); Anthony and Greaney 
(1979); Boddington, Gray and Robinson (1979); Gill, 
Donaldson and Shouman (1979-); Kordylewski (1979, 
1980); Naujokas (1979,1985); Brogli (1980); Brogli etcd. 
(1980); Drysdale (1980);Takemo and Sato (1980); 

M.M. Baum (1981); Beever (1981); Boddington, Gray and 
Scott (1981); Gill, Shouman and Donaldson (1981); 

B.F. Gray and Jones (1981); Kordylewski and Krajewski 
(1981,1985); Lawn, Street and Baum (1981);Tyler and Jones 
(1981); Boddington, Chang-Gen Feng and Gray (1982); 
Egeiban etal. (1982); Poland, Hindash and Kassoy (1982); 
Zaturska and Banks (1982,1990); Adler and Bowes (1983); 
B.F. Gray and Wake (1984,1988); Lermant and Yip (1984—); 
Vega and linan (1984); Gomez, Wake and Gray (1985); 

B.F. Gray and Scott (1985); Greenway and Spence (1985); 
Griffiths, Hasko and Tong (1985); Winters and Cliffe 
(1985); Adler (1987); Snee 1987,1989); Brooks, 

Balakotaiah and Luss (1988); Ahmed, Fisher and Janeshek 
(1989); de Faveri, Zonato et al. (1989); P. Gray and 
Griffiths (1989); Kassoy, Kapila and Stewart (1989); 
Kotoyori (1989a, 1993); Bahushok, Goldshtein and 
Sobolev (1990); Benin, Kossoi and Sharikov (1990); 
McIntosh andTolputt (1990); Britton (1991); Gorelov and 
Sobolev (1991); J.F. Griffiths and Kordylewski (1992a,b); 
Schliephake, Giesbrecht and Loffler (1992); Uehara and 
Seino (1992); Davie, Nolan and Tucker (1993); H. Martin 
and Ruppert (1993); Vaughan and Mancini (1993); 

El-Sayed (1994) 


separating EO and acetaldehyde. The investigation found 
that a small leak of EO had probably led to an accumulation 
of auto-oxidizable polyethylene glycols in the insulation of 
the column. Self-heating occurred in the insulation. 
Although the heat released would not have been enough to 
cause decomposition of the EO flowing past on the inside of 
the column, it was concluded that decomposition occurred 
at a section of pipe work where the gas was stagnant. 

16.6.3 Self-heating process 

If self-heating occurs, the occurrence of a thermal explo¬ 
sion depends on the heat balance in the solid. The heat bal¬ 
ance is illustrated in Figure 16.35 (after Semenov). The rate 
of heat release is a function of the temperature as shown in 
curve A. Over the lower temperature range the reaction is 
rate limited and the reaction rate, and hence the heat 
released, rises rapidly. The rise is often governed by an 
exponential relation, and in particular by the Arrhenius 
equation. Over the higher temperature range the rate 
becomes diffusion limited and increases only weakly with 
temperature, so that the reaction rate and the heat released 
then increase relatively slowly. 

The heat removed is approximately proportional to the 
temperature difference between the solid mass, or pile, and 
the surrounding medium. A series of lines can be drawn 
corresponding to different effective heat transfer coeffi¬ 
cients. Line B1 is tangential to curve A at point 1. For the 



Figure 16.35 Heat balance in a body undergoing self¬ 
heating (Bowes, 1984) (Courtesy of HM Stationery Office. 
© All rights reserved). 
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condition where the heat transfer is greater than this, the 
heat removed will always be greater than heat released and 
no thermal explosion will occur. Line B3 is tangential to 
curve A at point 5. For any condition where heat transfer is 
less than this, the heat removed will always be less than the 
heat released and thermal explosion will occur. Line B2 
represents the intermediate case. It crosses curve A at the 
three points 2,3 and 4, which each constitute a steady state. 
Points 2 and 4 are stable steady states in that if there is a 
small increase in the temperature difference AT, the heat 
removed is greater than that released and the system 
returns to the steady state point. Point 3, however, is an 
unstable steady state in that if there is a small increase in 
AT the heat removed is less than that released so that the 
system will tend move up curve A to the stable steady state 
at point 4. Conversely, if there is a small decrease in AT the 
system will tend to move down curve A to point 2. 

It is also instructive to consider the effect of the size of 
the solid mass and the temperature difference AT between 
the center of the mass and the surroundings as shown in 
Figure 16.36. There are two critical dimensions (>i and r 2 ) 
and four regions (A-D). There are two curves 1 and 2, 
which typically correspond to moderate heating and smol¬ 
dering combustion. If the dimension of the solid mass is 
less than ri and the initial temperature difference is in 
region A, the temperature difference will move to the value 
on curve 1 corresponding to the value of r. If the dimension 



Figure 16.36 Steady states in a body undergoing self¬ 
heating (Bowes, 1984) (Courtesy of HM Stationery Office, 
©, All rights reserved) 


is greater than r! and the initial temperature difference is in 
region B, the temperature difference will move to curve 2. 
If the dimension lies between r } and r 2 and the initial 
temperature difference is in region B or C, there are two 
possibilities. If the temperature difference tends towards a 
value within region C, it will move to curve 1. If it tends 
towards region B, it will move to curve 2. If the dimension 
lies between r\ and r 2 and the initial temperature difference 
is in region A, the temperature difference will move to 
curve 1, unless an additional heat source shifts it to curve 2. 
If the dimension is greater than r 2 and the initial tempera¬ 
ture difference is in region D, the temperature difference 
will move to curve 2. 

These considerations bring out the importance of the 
size of the pile. If the size of the pile is small, the system will 
tend to move towards curve 1, and if the pile is large the 
system will tend to move toward curve 2. 

16.6.4 Elementary relations of self-heating 

The basic equation for self-heating is 

pc~=W 2 T + Q [16.6.1] 

Q = QpA exp( -E/RT) [16.6.2] 

whereA is the pre-exponential factor, c is the specific heat, 
E is the activation energy, k is the thermal conductivity, Q is 
the heat released by the reaction per unit volume, Q is the 
heat of reaction per unit mass, R is the universal gas con¬ 
stant, T is the temperature and p is the density. 

For the three principal centrisymmetric shapes of 
interest - the slab, cylinder and sphere — Equation 16.6.1 
becomes, in rectangular co-ordinates in one dimension, 

+ ; §) + VpAeM-E/RT) [16.6.3] 

|s= 0 Plane slab 

j = 1 Cylinder 

jm2 Sphere 

where x is the distance from the centre of the body. 

The heat transfer at the surface is characterized by an 
overall heat transfer coefficient h such that 


-k-^ = h(T s -T a ) [16.6.4] 

h=hc + h [16.6.5] 

where h is the heat transfer coefficient at the surface, h c is 
the heat transfer coefficient for convection and h T is the heat 
transfer coefficient for radiation. 

The following dimensionless quantities are defined. The 
dimensionless distance z is 

z = x/r 


[16.6.6] 
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where r is the half-width or radius, or characteristic length, 
and z is the dimensionless distance. 

The dimensionless time i is 


k t 

1 per 2 

The dimensionless parameter e : 
e = RTJE 


The dimensionless ignition parameter 8 
„ E r 2 


Equation 16.6.17 is the Poisson-Boltzmann equation. 

The principal sets of boundary conditions that are used 
with Equations 16.6.12 and 16.6.17 are: 


[16.6.7] 

[16.6.8] 

[16.6.9] 


(1) surface exposed tc 

(2) surface exposed tc 


- surface heat transfer coeffi- 

- surface heat transfer coeffi- 

- surface heat transfer coeffi- 


(3) surface exposed 
cient infinite; 

(4) one surface against a hot body - constant tempera- 
tureat hot face; 

(5) one surface against a hot body - constant heat flux at 
hot face. 

The second boundary condition is referred to as the 
Semenov condition and the third as the Frank-Kamenetsky 
condition. 


Q! pA exp(—E/7?T a ) [16.6.10] 

Frank-Kamenetsky introduced the approximation 

-Jf*--s| + TTS E,RT ^ t [I6JSIIa| 

d 2 0 

[16.6.11b] -7-2 =exp 0 


RT 2 k * 


RT a ~ 


16.6.5 Model for a symmetrical slab 

One principal configuration is the symmetrical slab. For 
the steady-state condition the temperature profile for self¬ 
heating is as shown in Figure 16.37(a). From Equation 
16.6.17, setting; = 0 

[16.6.18] 


f-a? + ,a; + 5exp[0/ ( 1 + e0 ) ] 


6t 0z 2 z Sz 
and Equation 16.6.4 becomes 


z = 0;^ = 0 

d2 

dz 

The general solution of Equation 16.6.18 is 
e = In C 2 - 21ncosh[z(5G/2) 1/2 +Ci] 


[16.6.19a] 

[16.6.19b] 


[16.6.20] 


a = hr/k 


[16.6.14] 


where a is the Biot number. 

Equation 16.6.12 is the basic dimensionless equation of 
self-heating, as formulated by Frank-Kamenetsky. The 
parameter <5 is the Frank-Kamenetsky parameter. 

Use is also made of the following further dimension-less 
temperature differences: 


[16.6.15] 

[16.6.16] 


° s = m iT s -T 3 ) 

0o = ~(T o -T a ) 


and 

C2 = exp 0 O 

Utilizing boundary condition 16.6.19b 

2D tanh T) = y.0 s 

with 


where subscripts 0 and s denote the centre of the body and 
the surface, respectively. At steady state Equation 16.6.12 
becomes 


[16.6.21a] 

[16.6.21b] 

[16.6.22] 


11 

Eliminating 9 S from Equations 16.6.20 and 16.6.22 
, . , 2D 2 or ,tanhZ> 
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Figure 16.37 Steady-state temperature profiles in a slab undergoing self-heating: (a) symmetrical slab; (b) asymmetrical 
slab with constant temperature at a hot face; and (c) asymmetrical slab with constant heat flux at hot face 


16.6.6 Characteristics of symmetrical slab model 

It is instructive to consider the characteristics of the slab 
model. For low values of heat transfer at the surface, and 
hence of a, Equations 16.6.20—16.6.24 imply that 

0 O —* 0 S and 5 —* 0 a —* 0 


From Equations 16.6.22 and 16.6.24 
(2,5) 1/2 sinh[(<5exp(0 o )/2) 1/2 ] ^ 


In the region 0 <a< 1, 0 < 5 < 1,0 O ps< 5 S , Equation 16.6.25 
reduces to 


8/a = 0 s exp(—0 S ) [16.6.26] 

Equation 16.6.26 implies that for a given value of a the 
parameter 5 passes through a maximum with 0 S and has 


this maximum at 0 S = 1. This value of S is the critical value 
<5 C : 

S c = a/e [16.6.27] 

For values of <5 less than <5 C there exist steady-state tem¬ 
perature distributions that satisfy Equation 16.6.26, but for 
values that exceed 8 C there are no such steady states and 
thermal explosion occurs. 

At the other extreme, as a becomes very high Equation 
16.6.24 reduces to 

In <5 = In 2P ! [16.6.28] 

cosh 'D 

Equation 16.6.28 also implies that 5 passes through a max¬ 
imum with D. This maximum occurs at 

D = coth D = 1.2 [16.6.29] 

which gives a value for <5 C of 0.88. 
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(a) 



(b) 



Figure 16.38 Parameters governing self-heating without reactant consumption for three principal centrisymmetric 
shapes (P. H. Thomas, 1958): (a) critical values S c of the self-heating parameter (b) critical values of the dimensionless 
temperature 6 0 at the centre and (c) critical values of the dimensionless surface temperature 8 S (Courtesy of the Faraday 
Society) 
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Values of <5 C , 9 and 9 S for a slab over the whole range of a 
have been obtained by P.M. Thomas (1958) and are shown 
in Figure 16.38. The figure also gives the corresponding 
values for a cylinder and a sphere. The limiting values are: 



a —► 0 



s c e 0 

8 C 

do 

Plane slab 

ale 1 

0.88 

1.19 

Cylinder 

2 (ale) 1 

2.00 

1.39 

Sphere 

3(a/e) 1 

3.32 

1.61 


16.6.7 Model for a cylinder 

Another principal configuration is the infinite cylinder. 
From Equation 16.6.17, setting/ = 1 


0 + -^=-<5e xp 0 [16.6.30] 

Assuming a finite heat transfer coefficient, the boundary 
conditions are those given in Equation 16.6.19. 

The general solution is 

0 = taJ H J [16.6.31] 

|_<5(l + Sz 2 ) 2 J 

where B is a constant of integration. Then from boundary 
condition 16.6.19b 


In 5 = In 


f as 1 

4B 

[(S + 1) 2 J 

ol{B + 1) 


The maximum value of <5 occurs at 


[16.6.32] 


[16.6.33] 


where the subscript c denotes critical. 

Then, utilizing this value of a, the parameters d c and 0 S 
may be obtained from Equations 16.6.31 and 16.6.32. 


16.6.8 General model for slab, cylinder and sphere 

A general steady-state model for the symmetrical slab, 
cylinder and sphere may be obtained from Equation 16.6.17. 
The further approximation is introduced: 


(/+l)ft0 as 8 exp 9 

[16.6.34] 

where /? is an effective heat transfer coefficient. There is no 
simple relation for ft, but 

ft~« a < 1 

[16.6.35] 

Then, utilizing Equation 16.6.34 i: 

n Equation 16.6.17 

d 2 0 jiff „ . on 

[16.6.36] 

It can be shown that 

ft = 4 Plane slab 

[16.6.37a] 

= ^ Cylinder 

[16.6.37b] 

= — Sphere 

[16.6.37c] 


where C\ is the first root of 

c„ tan c n = a [16.6.38a] 

C2 is the first root of 

cn/i(c») = a/o(c*) [16.6.38b] 

and c 3 is a solution of 

c« cothc„ + a — 1 = 0 [16.6.38c] 

where/ 0 and/i are Bessel functions of the first kind and of 
order zero and one, respectively. The parameter <5 has a 
maximum at 9 = 1 so that 

5c = (i±l)/i [16.6.39] 


16.6.9 Model for an asymmetrical slab 

Returning to the slab, an alternative situation is one face 
against a hot body and one exposed to the atmosphere. For 
this case, in addition to the heat transfer at the surface 
exposed to the atmosphere, it is necessary to consider dif¬ 
ferent conditions at the hot face. One assumption is that 
there is a constant temperature at the hot face; another is 
that there is a constant heat flux at the hot face. The steady 
state temperature profiles for these two cases are shown in 
Figures 16.37 (b) and (c), respectively. For the asymmetrical 
slab the dimensionless ignition parameter is defined as 

8 = ^jQ’ P A. exp(-E /RT p ) [16.6.40] 

and the dimensionless temperature difference as 

e = —(T-T v ) [16.6.41] 

The relevant equation is Equation 16.6.18 and the general 
solution is Equation 16.6.20 and in addition 

^ = -(2 SCif tanh^G/^+Ci] [16.6.42] 

The case considered here is that where the hot face is at a 
constant temperature and the surface of the other face is at 


a much lower temperature. For this case 
conditions are 

the boundary 

2 =0; 0=0 

[16.6.43a] 

2 = 2; 0 = 0 S 

[16.6.43b] 

Then from boundary condition 16.6.43a 


Ci = ±cosh -1 (c 1/2 ) 

[16.6.44a] 

C2 = exp 0 m 

[16.6.44b] 

where subscript m denotes maximum. 

From boundary condition 16.6.43b 


(28)^ 2 


cosh -1 |exp(0 m /2) ± cosh -1 [exp(0 m /2) 

■ exp(-0 s /2)j 

exp(0 m /2) 

[16.6.45] 
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Given that the temperature of the surface is much less 
than that of the hot face, so that 9 S < 0, it can be shown that 
z m —> 0 and 0 m —> 0, and that 

(2 <5) 1/2 = cosh -1 [exp(-0 s /2)] [16.6.46] 

For large 10 S | Equation 16.6.46 provides a good estimate of <5 C 
so that 


16.6.10 Model for a hollow cylinder 

Another important asymmetrical case is that of the hollow 
cylinder with the inner face at a constant hot temperature. 
For this case the dimensionless distances are defined as 

Z = r/n [16.6.54a] 

2 = tifft = 1 Inner face [16.6.54b] 


(21n2 — 0 S ) 2 
8 

(1.4 — 0 S ) 2 
8 


[16.6.47a] 

[16.6.47b] 


Equation 16.6.47 is a good approximation for |0 8 | values as 
low as 8. 

This argument suggests that for large 9 S it is permissible 
to adopt the approximation used by Zeldovitch and 
Semenov that the maximum temperature occurs at the hot 
face. Physically this means that the hot face is a perfect 
insulator instead of a perfect conductor of infinite thermal 
capacity. 

The boundary conditions at the hot face then become 


z = r%/r\ = z s Outer face [16.6.54c] 

The dimensionless temperature difference 9 is defined by 
Equation 16.6.41 and the dimensionless ignition parameter as 

5 = ^2^Q f pAexp(-E/RT p ) [16.6.55] 

The relevant equation is Equation 16.6.30 and the general 
solution is 


[16.6.56] 


2 = 0; 0 = 0 [16.6.48a] 

2 = 0; g = 0 [16.6.48b] 

There is now only one steady-state temperature profile, 
which is the critical one. With these boundary conditions 


where Fand G are constants of integration. 
The boundary conditions are 


Ci = 0 

< 4*1 


[16.6.49a] Z Zs ’ 9 ° s 

[16.6.49b] From boundary condition 16.6.57b 


[16.6.57a] 

[16.6.57b] 

[16.6.57c] 


which gives Equation 16.6.47. 

An alternative derivation in terms of the ambient tem¬ 
perature utilizes the boundary condition 

2 = 2; ^ = -<x(0 s - 0 a ) [16.6.50] 

0a = J^(T a -T p ) [16.6.51] 

and yields for 0 a < 0 and large | 0 a | 


F^| = 2 [16.6.58] 

From Equations 16.6.56 and 16.6.58 

#<G< 1 [16.6.59] 

From Equation 16.6.56 and boundary condition 16.6.57c 


[16.6.60] 


(2<5 c ) 1/2 tanh[(2<5 c ) 1/2 ] + 2ahi{cosh[(2<5 c ) 1/2 ]} = -a 0 a 

[16.6.52] 

For S c > 5, Equation 16.6.52 simplifies to 


For the critical ignition parameter expressed in terms of 
the half thickness of the cylinder wall is 




[16.6.61] 


[ “ 531 

Equation 16.6.53 gives results of accuracy comparable to 
those of Equation 16.6.47 and simplifies to that equation as 

For the assumption that the hot face is a perfect insulator, 
Equation 16.6.53 is valid for all values of a, but as an 
approximation to the more realistic case it fails at a = 0. 


For a solid cylinder F=2 and Equation 16.6.56 then reduces 
to Equation 16.6.31. 

The model for the hollow cylinder may be applied to the 
problem of the self-heating of lagging on a pipe. The max¬ 
imum, or critical, thickness of lagging to avoid self-heating 
may be calculated as follows. Calculate <5 from Equation 
16.6.55, assume that this is the critical value of 8 (S = <5 C ), 
and calculate G and then F from Equations 16.6.58 and 
16.6.59. Then assume a normalized outer radius 2 S and 
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calculate 9 S from Equation 16.6.60. If 9 S differs from that 
specified, assume a fresh value of z s and recalculate. 

Some illustrative calculations have been made by Gugan 
(1974a) and are summarized inTable 16.29.The results show 
that if the pipe temperature is increased, the thickness 
of lagging needs to be decreased in order to avoid self¬ 
heating. Thus the relation between pipe temperature and 
lagging thickness is the reverse of that required for heat 
insulation. 


16.6.11 Critical parameters 

The parameter is given by Equation 16.6.10, which may 
be written as 



[16.6.62] 

For a slab, Equation 16.6.62 may be rewritten utilizing 
Equation 16.6.14 and 

V 

s~ r 

[16.6.63] 


[16.6.64] 

Further, since 


9 0 = ~(T 0 -T a ) 

[16.6.65] 

h n rV Q(T a ) 

°kSijo-w 

[16.6.66] 

Table 16.29 Illustrative calculation of the critical 
thickness of lagging to avoid self-heating (after Gugan, 
1974a) (Courtesy of the Institution of Chemical Engineers) 

Parameters assumed 

Q' = 2000cal/g 
p = 0.03g/cm 3 

A = 0.04 s -1 
k=10 4 cal/cms°C 
T s 313 K 

T p = 473 K Case 1 
573 K Case 2 

r, = 5.08 cm 
ii = 6000cal/mol 

R = 1.987 cal/mol K 

Calculation results 

5 C = 14.1 

G= 0.479 

F= 5.68 

9 S = —2.21 
z s = 1.75 

T S = 309K 
r s = 8.6 cm 

Case 2: 

5 C = 29.3 

G = 0.596 

F = 7.91 

0 S = —2.48 
z s = 1.55 

T S = 304K 
r s = 7.8 cm 


« V Q(T a ) 
0 hS(T o -T a ) 


[16.6.67] 

be extended to the other geometries by 


^ = o Cylinder 


[16.6.69a] 

[16.6.69b] 


or generally for the three principal symmetrical shapes 
Y = t +j [16-6.70] 


These equations show that for these geometries the value 
of <5 is a function of the surf ace/volume ratio S/V. 

The relation between <5 C and S/Fis illustrated in the table 
given in Section 16.6.6. As a —► 0, <5 C is exactly proportional 
to S/V, while as a —* oo, <5 C lies within 10% of S/V. 

There are a number of methods available for the estima¬ 
tion of the critical parameters <5 C and 9 0 . One approximate 
analytical method has been developed by Boddington, 
Gray and Harvey (1971b). This method is based on the 
application of Equation 16.6.17 to any centrisymmetric 
convex body. The parameters are expressed in terms of an 
average radius R 0 and of the shape factor; and procedures 
are given for determining these. At criticality, the following 
relations hold: 

Sc(r)=d c (R 0 )^ 

0„ = 21n[(/ + 7)/4] 


[16.6.71] 

[16.6.72] 


S c (Ro) = 3 F(j) [16.6.73] 

F (j)=j^ [16.6.74] 

For the three principal symmetrical shapes the shape 
parameter has its usual values (0,1 or 2) and 


[16.6.75] 


Another approximate analytical method has been given by 
Hardee, Lee and Donaldson (1972). Other methods include 
expansion about the maximum temperature and use of a 
step function. Numerical solutions have also been obtained. 
In particular, results for the principal geometries have been 
given by Enig and co-workers (Enig, 1956; Enig, Shanks 
and Southworth, 1956). Results for some of the principal 
cases are summarized inTable 16.30. 

The self-heating parameter <5 is a function of the para¬ 
meters of the reaction and solid mass and of the ambient 
temperature. There exists, therefore, a critical value of 
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Table 16.30 

Selected critical values of the ignition parameter S c and the center temperature t 

> 0 without reactant 

consumption for centrisymmetric shapes 






Shape 

Dimension 

e 

a 

Sc 

0 O 

Method a 

Reference 

Plane/slab, 

Thickness 2 r 

0 

0 

ot/e 

1 

FK 

P.M. Thomas (1958) 

infinite 


0 

oc 

0.88 

1.19 

FK 

P.M. Thomas (1958) 



0 

00 

0.86 

1.119 

BGH a 

Boddington, Gray and 
Harvey (1971b) 



0.02 

oo 

0.90 

1.24 

Numerical 

Enig, Shanks and 
Southworth (1956) 



0.06 

oo 

0.94 

1.37 

Numerical 

Enig, Shanks and 
Southworth (1956) 

Cylinder, 

Radius r 

0 

0 

2a/e 

1 

FK 

PM. Thomas (1958) 

infinite 


0 


2.00 

1.39 

FK 

P.M. Thomas (1958) 



0 

oo 

2.00 

1.39 

BGH 

Boddington, Gray and 
Harvey (1971b) 



0.02 

oo 

2.04 

1.45 

Numerical 

Enig, Shanks 

and Southworth (1956) 



0.06 

oo 

2.15 

1.61 

Numerical 

Enig, Shanks 

and Southworth (1956) 

Sphere 

Radius r 

0 

0 

3a/e 

1 

FK 

P.M. Thomas (1958) 



0 

00 

3.32 

1.61 

FK 

PM. Thomas (1958) 



0 

00 

3.33 

1.62 

BGH 

Boddington, Gray 
and Harvey (1971b) 



0.02 

oo 

3.40 

1.68 

Numerical 

Enig, Shanks 

and Southworth (1956) 



0.06 

oo 

3.57 

1.87 

Numerical 

Enig, Shanks 

and Southworth (1956) 

Cube 

Side 2 r 

0 


2.52 

1.89 

Numerical 

Parks (1961) c 



0.02 


2.58 


Numerical 

Parks (1961) 



0.06 


2.68 


Numerical 

Parks (1961) 

Right 

Radius r, height 

0 

X 

See formula 




cylinder 

2 d;p = r/d 



in footnote d 




Cuboid 6 

Sides 2a, 2b, 2c 

0 

oo 

See formula 





p=b/a; 

q=c/a 



in footnote* 





a BGH, Boddington, Gray and Harvey method; FK, Frank—Kamenetsky formulation. 

b Values of d c quoted are those given by Bowes (1984). The corresponding values of a are not given, but Parks gives results for the range 
a —20—100. 

c Corrected by Boddington, Gray and Harvey (1971b) and quoted by Bowes (1984). 
d Bowes gives the relation: d c ss 2.0 + OMp 2 . 
e Also referred to as a rectangular brick. 

1 Bowes gives the relation: <5 C rj 2.0 + 0.84(1 + Ijp 2 + l/q 2 ). 


the ambient temperature that gives a critical value <5 C 
for the self-heating parameter. As the parameter a—*-oc 
there is a corresponding critical value of the surface 
temperature. 

16.6.12 Oxidative self-heating 

The self-heating reaction is usually, though not invariably, 
an oxidative one. Then the reaction will typically be gov¬ 
erned by the reaction kinetics relation and by the diffusion 
of oxygen from the atmosphere. 

There is relatively little information on the oxidation 
reactions which occur in self-heating. Models of the reaction 
frequently assume that it is first order with respect to oxygen 
concentration with a reaction index n =1. For a number of 
reactions studied the value of the index n is about 0.7. Others 
are zero order over a wide range of oxygen concentrations. It 
is usual to assume that the Arrhenius equation applies, but 
Bowes warns that it is not always appropriate. 


For oxidative self-heating it can be shown by a steady- 
state analysis that at critical conditions the value of the 
dimensionless temperature difference 9 a is given by 

(1 + e0 o ) 2 [l + (n- 1) |] = 0„ (l -[16.6.76] 




E 

RT a 


(T 0 - T a ) 


[16.6.77] 

[16.6.78] 


where C Q is the concentration of oxygen in the atmosphere, 
D p is the diffusion coefficient of oxygen in the pores, n is 
the index of the concentration term, Q* is a modified heat 
release per unit mass, T„ is the temperature at the centre, 0 O 
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is the dimensionless temperature difference at the centre 16.6.15 Reactant consumption 

and f is a parameter. In general the reaction equation will be of the form 


16.6.13 Effect of water 

Organic materials tend to be hygroscopic and commonly 
contain some 10-20% water as a condensed phase. Water 
can have a strong effect on self-heating but its effect is 
somewhat complex. Reviews have been given by Walker 
(1967) and Bowes (1984). Some of the effects are chemical. 
Water increases the rate of oxidation of many materials. In 
some cases, however, there can be an inhibiting effect. 

Other effects are physical. Water has a high latent heat of 
vaporization and a correspondingly high heat of adsorp¬ 
tion. During self-heating it vaporizes in the hotter regions 
and condenses again in the cooler regions. The net effect is 
an appreciable increase in the rate of heat transfer. The 
presence of water thus increases the effective thermal con¬ 
ductivity of the material. The increase may be by an order of 
magnitude. 

The increase in temperature in the hotter region is 
retarded by the presence of water as vaporization takes 
place. The effect usually occurs at temperatures in the 
range 60-90°C, which is generally well below the tem¬ 
perature at which thermal ignition occurs. Thus this effect 
tends to manifest itself as an increase in the induction time. 

If the vaporization of water occurs fairly uniformly over 
the temperature range as the material undergoes self¬ 
heating, the effect is to reduce the effective heat of reaction. 
In some cases this may result in the suppression of thermal 
ignition. This effect is seen in the case of ‘overdried’ mate¬ 
rials. If a material is dried down to a very low water content, 
the reduction in the effective heat of reaction just described 
is no longer operative, and the material becomes more prone 
to thermal ignition. 

There is also another effect of water on overdried 
material. When the material is first exposed to the atmo¬ 
sphere, water is adsorbed and heat is released. This may 
cause a temperature rise in cool material or may delay a 
temperature fall in hot material. In either case the base 
temperature from which any self-heating process starts is 
increased. 

16.6.14 Unsteady-state model 

The treatment of self-heating given so far has been based 
on the assumption of steady state. There are a number of 
situations in which this assumption breaks down and for 
which it is necessary to adopt an unsteady-state approach. 
These include: 


^ = -CM exp{-E/RT) [16.6.79a] 

^ = -iA(C)A exp( -E/RT) [16.6.79b] 

i ji(C) = C 1 [16.6.80] 

Then Equation 16.6.2 becomes 

Q = C'Qf'A exp (-E/RT) [16.6.81a] 

= iA(C)Q'Mexp(-C/RT) [16.6.81b] 


where C is the concentration of oxygen, Q" is the modified 
heat released per unit volume, i/r is a concentration function 
and n is an index. Then Equation 16.6.3 becomes 


Sx 2 + x Sx , 


+ C n Q"A"exp(-E/RT) 


[16.6.82] 


Introducing the dimensionless concentration 

co = C/C 0 [16.6.83] 

where C D is the concentration of oxygen in the ambient air 
and co is the dimensionless concentration, and an alter¬ 
native form of the dimensionless ignition parameter 


S = | ^rjQQ"A exp (-E/RT a ) [16.6.84] 

Equation 16.6.82 becomes 

= S + S + ' exp[0/(1 + 19)] [16 - a85] 

and Equation 16.6.79 becomes 

^«^|c/‘exp[fy(l + c0)] [16.6.86] 


(1) reactant consumption; 

(2) induction period; 

(3) autocatalytic reactions; 

(4) hot spots and hot materials; 

(5) high ambient temperature; 

(6) varying ambient temperature. 

The basic equation for self-heating is the unsteady-state 
Equation 16.6.1 with Equation 16.6.2. This latter equation 
may be modified to make explicit the dependence on 
reactant consumption, and then takes the form of 
Equation 16.6.81. 

Consideration is now given to some of the principal 
aspects of the unsteady state, namely reactant consump¬ 
tion, induction period, autocatalytic reactions, and hot 
spots and hot materials. 




E C 0 Q’ 
RT 2 pc 


[16.6.87] 


where B is a dimensionless parameter. The parameter B 
may be interpreted as a dimensionless adiabatic tempera¬ 
ture rise. 

For the three principal symmetrical shapes and for gen¬ 
eral case of finite a the usual boundary conditions for 
Equation 16.6.85 are 


[16.6.88a] 

[16.6.88b] 
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and the initial conditions are 

r = 0; 0 = 0; eo=l [16.6.89] 

The behaviour of a self-heating mass may be characterized 
in terms of the parameters B and 8 as shown in Figure 16.39. 
For large values of B, shown in Figure 16.39(a), the profiles 
of 0 are sensitive to <5 and there is a value of 8 at which there 
is a relatively sharp transition to thermal explosion. For 
small values of B, shown in Figure 16.39(b), the profiles of 0 
are less sensitive, thermal explosion is less well defined and 
may not occur at all. 

It is possible to derive a relation for the critical value as 
a function of B and n. Let 8(B) be the initial value <5 and 
<5 c (oo) be the critical value of 8 at the end of the induction 
period for B — oo. Then it can be shown that 

8 C (B, n) = - k (oo) . - [16.6.90a] 

1 - 2.7 {n/B) 2 ' 3 

8 C (B, n) = <5 c (oo) (1 + 2.7 (n/B) 2/3 ) fi —> oo [16.6.90b] 

The effect of reactant consumption has been studied, par¬ 
ticularly for the three principal symmetrical shapes. 
Results for the centri-symmetric shapes obtained by Tyler 
and Wesley (1967) using numerical integration are shown in 
Table 16.31. 

16.6.16 Induction period 

It is possible to define a number of induction periods. One 
period of particular interest is the total time from the 
initiation of a situation leading to thermal explosion to the 
explosion itself. It is this induction period, which is con¬ 
sidered here. 

A treatment of the induction period, assuming no reac¬ 
tant consumption, has been given by Zinn and Mader 
(1960), who performed numerical integration of Equation 


16.6.12 for the following case. A body at initial temperature 
Ti has its surface suddenly raised to a temperature T SI 
which exceeds the critical value T c for thermal explosion. 
They defined a dimensionless induction period i ; such that 



where t-, is the induction period and t,- is the dimensionless 
induction period. They obtained for the three principal 
symmetrical shapes the results shown in Figure 16.40. The 
induction period decreases as the surface temperature 
increases. 

If the surface temperature is raised to one greatly in 
excess of the critical value, the temperature rise in the solid 
occurs near the surface rather than at the centre. Zinn and 
Mader examined this situation also and obtained for the 
case of a 1 in. sphere of cyclotrimethylene trinitramine, or 
RDX explosive the results shown in Figure 16.41. It has been 


Table 16.31 Selected critical values of the ignition 
parameter 8 C with reactant consumption for centrisym- 
metric shapes (after Tyler and Wesley, 1967) (Courtesy of 
the Combustion Institute) 


n B 


Cylinder 



Sphere 


£ = 0 

0.025 

0.05 

e=0 

0.025 

0.05 

0 

2.000 

2.057 

2.119 

3.322 

3.420 

3.527 

1 1000 

2.052 

2.113 

2.180 

3.405 

3.510 

3.626 

1 100 

2.248 

2.328 

2.417 

3.722 

3.859 

4.013 

1 25 

2.729 

2.860 

3.010 

4.491 

4.713 

4.965 

2 1000 

2.082 

2.145 

2.215 

3.453 

3.563 

3.684 

2 100 

2.403 

2.498 

2.606 

3.971 

4.134 

4.321 

2 25 

3.255 

3.443 

3.651 

5.309 

5.610 

5.937 




Figure 16.39 Effect of parameters governing self-heating with reactant consumption (Bowes, 1984). (a) Large B; 
differences between curves 1 and 2 can result from small changes in 3. (b) Small B; differences between curves 
can result from large changes in 3 (Courtesy of HM Stationery Office. © All rights reserved) 
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E E 

— - — (cal mol 'K ') 

Figure 16.40 Induction period for self-heating without reactant consumption for three principal centrisymmetric shapes 
(Zinn and Mader, 1960). Initial temperature T 0 = 298 K (<T C ) (Courtesy of the Journal of Applied Physics) 


shown that the values of for the transition from a central to 
an annular explosion are approximately as follows: 


8 

Plane slab 

9.25 

Cylinder 

12.25 

Sphere 

14.25 


16.6.17 Autocalalytic reactions 

In some cases the self-heating reaction is an autocatalytic 
one. For this case the reaction may be expressed as 

^-*(** + 0(1-*) [16.6.92] 


where (j) is the fractional conversion and <j>* is the small 
fractional conversion necessary to initiate the reaction. A 
quantity x may be defined as 


X = 


8 

(T+i)a 


[16.6.93] 


where x may be interpreted broadly as the ratio of the rate of 
heat generation to the rate of heat loss. The critical condi¬ 
tion for thermal ignition is 


[16.6.94a] 

[16.6.94b] 


and the value of the critical ignition parameter <5 C is 
8 C =-^—2 [16.6.95] 

a+<n 2 « 

16.6.18 Thermal explosions of the second kind 

As already described, there exist both stable and unstable 
steady states. A thermal explosion of the second kind 
involves passage through an unstable steady state. This 
situation can occur where there is an additional heat source 
or where there are certain initial conditions. A typical 
additional heat source might be a wander lamp left lying in 
a pile of material in a silo. Another form of additional heat 
source is a parallel reaction. The situation involving initial 
conditions of particular interest are those relating to hot 
spots, which are now considered. 

16.6.19 Hot spots and hot materials 

The topic of hot spots includes the following cases: 

(1) reactive hot spots, 

(2) inert hot spots and 

(3) hot materials. 

A hot spot is a limited volume in a mass of reactive 
material, which is at a temperature above that of 
the material. The hot spot may be reactive or inert. A hot 
material in this context is one in which the whole mass of 
the material is above ambient temperature. It may be 
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Figure 16.41 Temperature profiles for a 1 in. sphere of RDX at times close to the end of the induction period (Zinn and 
Mader, 1960): (1) fraction of time to explosion 0.9; (2) fraction of time to explosion 0.95; (3) fraction of time to explosion 
0.98. Initial temperature 25’ C. The steady-state temperature profile at the critical temperature T c is also shown (Courtesy 
of the Journal of Applied Physics) 

regarded as a form of reactive hot spot in which the hot A reactive hot spot, however, will generate some heat and, 

region extends to the whole mass. The temperature pro- assuming this is appreciable, its temperature distribution 

files in a hot spot with a ‘square’ initial temperature dis- in the early period may be expected to take a form such as 
tribution are shown in Figure 16.42. The initial that shown by curve C. 

temperature profile is given by outline A. An inert hot For a reactive hot spot it has been shown by P.H. Thomas 

spot will lose heat to the surrounding medium and the (1973a) that 

temperature distribution in the early period may then be ; 

expected to take a form such as that shown in curve B. ~ 8o*1* (x) 


[16.6.96] 
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Figure 16.42 Temperature profiles fora hotspot: A, initial temperature profile of hotspot, reactive or inert; B typical early 
temperature profile for inert hot spot; and C, typical early temperature profile for reactive hot spot 


i m i/4 [16.6.97] 

where the parameters are defined in terms of the initial 

temperature 7] of the hot spot so that 

5c=j^jQ , pAeM- E / R T i ) [16.6.98] 

[16.6.99] 

t^T-T [16.6.100] 

[16-6-101] 

where 7 ; is the initial temperature of the hot spot, 7 im is the 
initial temperature of the medium, 0; is the initial value of 9 
in the hot spot and t is the dimensionless time. 

Of particular interest is the solution of Equations 
16.6.96—16.6.101 for hot material, where in effect the hot 
spot extends through the whole mass. In applying these 
equations use is made of the fact that in the early stages of 
cooling of an inert hot spot the temperature profiles all tend 
to intersect at a temperature 9J2 as shown in Figure 16.42. 
Then the value of 0 o used in the treatments for hot materials 
is one-half of the value of 4 as given by Equation 16.6.99. 

Then for the case where a —► oo, P.H. Thomas (1972) has 
shown that 


expj-i^ 

V K > 2tcV2 T 3/2 

Plane slab 

[16.6.102] 

* ex P(-V4t) 
4tcV2 T 3/2 

Sphere 

[16.6.103] 

V 1 ' 27t 1 / 2 T 3 / 2 

[erf(l/2r 1 / 2 )] 2 Cube 

[16.6.104] 


For this case the value of 4 is obtained from Equation 
16.6.96 utilizing Equations 16.6.102-16.6.104. At the other 
extreme, for a—* 0 it can he shown that 

.f »t- exp(—aSrr/F) [16.6.105] 

Then, differentiating Equation 16.6.105 and utilizing 
Equation 16.6.70 for the three principal symmetrical shapes 
it is readily shown that 

4 = a(l +j)0 o exp[—a(l + ;')/4] [16.6.106a] 

4 » a(l +j)6 0 0 O > 1; 4 > 1 [16.6.106b] 

Treatments for the inert hot spot tend to be more complex. 

16.6.20 Determination of model parameters 

The self-heating properties of a porous solid may be char¬ 
acterized in terms of (1) the minimum ignition temperature, 
(2) the critical characteristic length, (3) the surface heat 
transfer coefficient and (4) the induction period. 

The minimum ignition temperature may be obtained by 
exposing a body of the material in a defined shape to a ser¬ 
ies of successively higher temperatures using calorimetric 
methods and determining the temperature which is just 
high enough for ignition to occur. 

For the critical characteristic length use is made of 
Equation 16.6.10 with the ignition parameter taken as the 
critical value 4 and rearranged to give 

T8,T 2 \ P 

Inf ft*) =M -r [16.6.107] 

M = In {Q'pAE/Rk) [16.6.108] 

P = E/R [16.6.109] 
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where R is the universal gas constant, T a is the absolute 
temperature of the air and M and Pare parameters. 

Then if experiments are conducted with a range of slabs 
of different sizes and different surface temperatures, pairs 
of values of r and T a are obtained. A plot of ln(<5 c 7f /r 2 ) vs 
1/T a then gives the values of M and P 
Such experiments are in fact usually done using cubes 
rather than slabs. For a cube, <5 C is 2.6 so that the relation 
between the critical characteristic length for a cube r ch and 
for a slab z sb is 

r sb = ^cb (0-88/2.6) 1/2 [16.6.110] 

The commonly used test for the determination of the self¬ 
heating parameters M and P is to heat up a cube of the 
material in an oven under standard conditions and to mea¬ 
sure the temperatures in the cube. 

For the surface heat transfer coefficient, and hence the 
Biot number, use is made of Equation 16.6.5. The heat 
transfer coefficient for convection depends on the shape of 
the body and on whether the convection is natural or 
forced. For the case of natural convection and for a small 
sphere 

Nu ** 2.0 + 0.6Pr°' 33 Gr°' 25 [16.6.111a] 


Differentiating Equation 16.6.118 with respect to T a , and 
linearizing 



[16.6.119a] 

[16.6.119b] 


As an approximation, the values of ei and e 2 in Equation 
16.6.119a may be taken as unity. Bowes gives the following 
values for a sphere: 


r 

0.6 

h c 

hr 

a 

6 C 

(mm) 

Ra 0 ' 25 

(W/m 2 K) 

(W/m 2 K) 



1.6 

0.87 

39 

47 

2.7 

1.80 

25.4 

8.2 

7.1 

21 

14.1 

2.90 

279 

54 

3.2 

12.6 

88 

3.24 


In Equation 16.6.117 for the convection heat transfer coef¬ 
ficient the dominant term is the film term at the smaller 
diameters and the convection term at the larger diameters. 

The induction period may be determined by experiment. 
The results of a number of experiments follow the relation 


For air, for which PrsiO.7, Equation 16.6.111a can be 
approximated by 


Nu m 2.0 + 0.6(PrGr)°' 25 
= 2.0 + 0.6(Ra)°' 25 


[16.6.111b] 

[16.6.111c] 

[16.6.112] 

[16.6.113] 

[16.6.114] 

[16.6.115] 

[16.6.116] 


fi cx r 2 [16.6.120] 

Alternatively, the induction period may be estimated from 
Figure 16.40. 

A material liable to self-heating is often a powder and its 
self-heating properties therefore depend on the particle 
size distribution. Experimental determinations of self¬ 
heating parameters are valid only for similar material. 

16.6.21 Precautions against self-heating 

Prevention of self-heating depends on recognition of the 
hazard, design features, and good housekeeping and 
adherence to procedures. 

If a material may be liable to self-heating, tests may be 
done to determine first whether this is the case, and, if so, 
the critical size. Bowes gives the following broad rules of 
thumb for liability to self-heating in terms of the critical 
dimension r c : 


where a is the volume coefficient of expansion, d. is the 
diameter of the sphere, k t is the thermal conductivity of the 
fluid, A T is the difference between the surface temperature 
and the ambient temperature (T s -T a ), is the thermal dif- 
fusivity of the fluid and v is the kinematic viscosity of the 
fluid. Gr, Nu, Pr and Ra are the Grashof, Nusselt, Prandtl 
and Rayleigh numbers, respectively. 

Then from Equations 16.6.111c, 16.6.112 and 16.6.115 

Ac = |(2.0 + 0.6Ra a25 ) [16.6.117] 

The first term in the brackets in Equation 16.6.117 repre¬ 
sents film conduction and the second term represents con¬ 
vection. The heat transferred by radiation q is 

q = -—- o(T} — 7f) [16.6.118] 

d + «2-ei£2 1 s 3> 1 J 

where ei is the emissivity of the surface and e 2 is that of the 
surroundings. 


r c > 40 m Material not liable to self-heating 
r c ^ 10 m Material liable to self-heating 
Materials leaving the process hot can be cooled before 
being sent to storage. Self-heating of materials in storage 
and transport can be prevented by using smaller containers 
and/or by remixing the material periodically. Where oxi¬ 
dative self-heating is involved, measures can be taken to 
reduce the oxygen content of the ambient gas. One 
approach is the use of atmosphere control and, in parti¬ 
cular, of inerting. Another method is the use of an oxygen 
barrier such as plastic liners inside paper bags. Poly¬ 
ethylene has been successfully used to prevent self-heating. 
It is not, however, a totally effective oxygen barrier and may 
be of limited use for more reactive materials. 

Factors that tend to increase safety include the presence 
of antioxidants and the limitation of the residence time. 
Conversely, the safety margin is reduced if there is a loss of 
antioxidants that are normally present or a rise in the resi¬ 
dence time above the normal value. 
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Some materials, such as freshly made activated carbon, 
heat up appreciably during the first 24 hours after manu¬ 
facture. The processes involved are probably sorption and 
oxidation of the most reactive sites. Such materials can be 
‘weathered’ by allowing the material to stand for a period in 
separate, freshly filled bags. 

Self-heating of lagging can be minimized by measures to 
prevent leaks and by use of suitable lagging thicknesses. 

Special measures are required to deal with situations 
where there is a possibility of a leak such as the EO leaks 
described in Section 16.6.2. Measures proposed following 
the investigation of these incidents include avoidance of 
dead leg pipework and other stagnant zones, reduction of 
the number of flanges and other possible leak points, 
measures to ensure leak-tight construction, use of non¬ 
absorbent lagging material if possible, inerting of regions 
at risk, provision of leak detection devices and regular 
testing for leak tightness and regular inspection for leaked 
materials. Large flanges may be installed without fire 
insulation but protected by sprinkler systems instead. The 
insulation used may be of the two-layer type with an inner 
material of close cell structure, such as cellular glass, and 
an outer layer of fire resistant material, with a vapour bar¬ 
rier between to prevent ingress of water and chlorides. 

Good housekeeping can reduce self-heating caused by 
items such as waste rags or dust layers. 

16.7 Static Electricity 

Static electricity is an important source of ignition in pro¬ 
cess plants. There have been many apparently mysterious 
explosions the cause of which was eventually traced to 
static electricity. On the other hand there has been some 
tendency in investigations to attribute to static electricity 
ignitions for which no other cause could be found, even 
though the positive evidence for static was weak. 

There is now much more information available both on the 
nature and on the prevention of static electricity But despite 
this it remains a phenomenon which is often not well under¬ 
stood or appreciated. It is for this reason that a separate sec¬ 
tion is devoted here to static electricity rather than because it 
is a statistically dominant source of ignition. 

Static electricity is a potential source of ignition wherever 
there is a flammable mixture of gas or of powder or dust. 
Accounts of static electricity are given in Electrostatics in the 
Petroleum Industry (Klinkenberg and van der Minne, 1958), 
Handbuch derRaumexplosionen (Frey tag, 1965), Handbookof 
Industrial Loss Prevention (FMEC, 1967), Electrostatic 
Hazards (Haase, 1977), Dust Explosions (Cross and Fairer, 
1982), Electrostatics (Cross, 1987), Electrostatic Hazards and 
Powder Handling (Glor, 1988) and Understanding and Con¬ 
trolling Static Electricity (Luttgens and Glor, 1989) and by 
R.V Wright (1964), J.C. Howard (1964), N. Gibson (1969), 
J.R. Hughes (1970), Napier (1971) and K.N. Palmer (1973a). 

The relevant British Standard is BS 5958:1991 Code of 
Practice for Control of Undesirable Static Electricity Part 1: 
1991 General Considerations and Part 2: 1991 Recommen¬ 
dations for Particular Industrial Situations. In the USA, 
NFPA 77: 2000 Static Electricity applies. 

Selected references on static electricity are given in 
Table 16.32. 

16.7.1 Static electricity in industrial processes 

The industrial situations in which undesired static charges 
are generated are largely those in which two surfaces move 


Table 16.32 Selected references on static electricity 


Pauthenier and Moreau-Hanot (1932); Guest (1938 BM Bull. 
638); Smythe (1939); Silsbee (1942); Ktinkenberg and Mooy 
(1948); NFPA (1950); Cooper (1953a,b); P.H.S. Henry (1953, 
1971b); Swann (1953); Bustin, Culbertson and Schleckser 
(1957); J.C. Howard (1958,1959,1964); Klinkenberg (1957, 
1959,1964b, 1967c, 1971); Klinkenberg and van der Minne 
(1958); McGuire (1958); Saletan (1959a,b);Trevana (1961); 
Anon. (1962a); Schon (1962a,b, 1965,1967,1968); 
Department of Labor (1963); L. Wright and Ginsburgh 
(1963,1964); R.V Wright (1964); Freytag (1965); Owens 
(1965); Durand (1966); Eichel (1967); Harper (1967a,b); 
Herzog (1967); Rees (1967); J.R. Hughes (1970); N. Gibson 
(1969,1971,1983,1986a, 1990b); Hearfleld (1970); Mahley 
(1971,1972); Napier (1971); A.D. Moore (1973); K.N. Palmer 
(1973a); Strawson (1973); Napier and Rossell (1974); Anon. 
(1975 LPB 2, p. 1); Barreto (1975); Chubb, Pollard and 
Butterworth (1975); Horvath and Bertha (1975); Pesetsky 
and Fisher (1975); PITB (1975 Safety Training Guide 2); 
Rivera (1975); J.F. Wagner (1975); Bright (1977); Haase 
(1977); R. King and Magid (1979); Wada, Perlman and 
Kokado (1979); J.T. Leonard (1981); Cross and Fairer (1982); 
IBC (1982/29,1983/43,1991/80); Ramage, Swithendy and 
Ross (1982); Bustin and Dukek (1983); Anon. (1986J); 
Crowley (1986); Cross (1987); Pay (1987 LPB 78); Sproston 
(1987); Kalisvaart (1988 LPB 79); Liittgens and Glor (1989); 
Hearn (1991); Britton (1992); Cartwright (1992); Dean etal. 
(1992); Pratt (1993,1994 LPB 120) BS 5958:1991- 

Prevention 

NFPA (1950); Klinkenberg and van der Minne (1958); Shell 
Chemical Co. (1963); Aron (1964); Beach (1964-);Valko and 
Tesoro (1964); FMEC (1967); Mallinson (1969); ICI/RoSPA 
(1970IS/74); Warren, Lange and Rhynard (1974); Lovstrand 
(1975); Jowett (1976); J.T. Leonard (1976); G.J. Butterworth 
(1979a); Denbow and Bright (1979); Felici and Larigaldie 
(1980); IP (1981NCSP Pt 3); Cross and Fairer (1982); API 
(1984 RP 2001,1991RP 2003); N. Gibson (1986a); Cross 
(1987); Kletz (1987d); Luderer (1987); Cartwright (1988); 
Expert Commission for Safety in the Swiss Chemical 
Industry (1988); Glor (1988); Mancini (1988); NFPA (2000 
NFPA 77); Liittgens and Glor (1989);Taillet etal. (1992) BS 
5958:1991- 

Earthing, grounding (seeTable 10.2) 

Fundamental phenomena 

Helmholtz (1879); Lenard (1882); Gouy (1910); Chapman 
(1913); Stern (1924); Peek (1929); Gemant (1933,1962); 
Bikerman (1947); Frohlich (1949); Butler (1951); Rutgers 
and de Smet (1952); Meek and Graggs (1953); Klinkenberg 
(1957,1964b, 1967c, 1970); Rutgers, de Smet and Myer 
(1957); Klinkenberg and van der Minne (1958); Pauthenier 
(1961); Gavis and Hoelscher (1964); D.K. Davies (1967); 
Douwes and van der Waarden (1967); M.D.Foster (1967); 
Gavis (1969); Parsons (1971a); Battocletti (1976); Pohl 
(1978); Gibbings (1979) 

Electrical fields 

E. Weber (1950,1965); Friedlander and Reed (1953); Harries 
(1953); Meek and Graggs (1953); A.D.Moore (1954); 

W.E. Rogers (1954); Klinkenberg and van der Minne (1958); 
Moon and Spencer (1961); Vellenga (1961); Carruthers and 
Wigley (1962); Heidelberg (1970b); Dakin etal. (1974); 
Penman and Fraser (1983) 
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Electrostatic charging 

Coehn (1898); Russel (1909); Loeb (1945,1958); Holm (1952); 
Vick (1953); Wagener (1956); Kragelski and Demkin (1960); 
Harper (1967a, b); D.K Davies (1970); Gibbings, Saluja and 
Mackey (1971); Krupp (1971); Bertein (1973); Chives, 
Mitchel and Rowe (1974); Haenen (1976); Coste and Pechery 
(1977); Postnikov (1978); Jonassen, Hansson and Nielsen 
(1979); Cross (1987); Owens (1988); Liittgens and Glor 
(1989) 

Electrostatic discharge 

Heidelberg (1959,1967,1970a); line, Rhodes and Gilmer 
(1959); Litchfield and Blanc (1959 BM RI5461); Berz (1961); 
D.V.Harris, Karel and Ludwig (1961); Bruinzeel (1963); 
Muller-Hillebrand (1963); N. Gibson and Lloyd (1965); Loeb 
(1965); J.T. Leonard and Carhart (1967); J.F. Hughes etal. 
(1973); Bertein (1975,1977); Dorsey (1976); Haig and Bright 
(1977); J.K. Johnson (1977); Goldman and Goldman (1978); 
Sigmond (1978); Berta and Gastanek (1979); H. Kramer and 
Asano (1979); Kalkert and Schecker (1980); Strnad (1980); 
Glor (1981,1984,1988); Guoxiang Li and Wang Changying 
(1981); Loveland (1981); Lovstrand (1981); Britton and 
Williams (1982); HSE (1982 OP 5); H.R. Edwards and 
Underwood (1984); Cross (1987); Glor etal. (1987); Maurer 
etal. (1987); Liittgens and Glor (1989); G.M.Williams and 
Pratt (1990) 

Liquid conductivity 

Klinkenberg and van der Minne (1958); Schb’n (1962a,b, 
1965); Douwes and van der Waraden (1967); Klinkenberg 
(1967a); H. Kramer and Schon (1973,1975); P.I. Mason 
(1975); Rees (1975); J.T. Leonard (1976) 

Liquid flow in pipes 

Mackeown andWouk (1942); Cooper (1953a); Boumanns 
(1957); Hampel and Luther (1957); Klinkenberg and van der 
Minne (1958); Schuringa and Luttik (1960); Gavis and 
Koszman (1961); Carruthers and Marsh (1962); Gavis (1964, 
1967a,b, 1972); Koszman and Gavis (1962a,b); Schon 
(1962a, 1965); Klinkenberg (1964a,b, 1967b,c, 1971); 
Vellenga and Klinkenberg (1965); Gibbings and Hignett 
(1966); Gibbings (1967); N. Gibson and Lloyd (1967, 

1970a,b); Schon and Masuda (1967,1969); Goodfellow and 
Graydon (1968a,b); J.T. Leonard and Carhart (1970); 

N. Gibson (1971); Schon and Kramer (1971); Lauer and 
Antal (1972); Cross, Haig and Cetronio (1977);Touchard 
(1978);Touchard and Dumarque (1978); P.I. Mason and Rees 
(1981); Walmsley and Woodford (1981a,b); Abedian and 
Sonin (1982); Walmsley (1982,1983a-c); Britton and Smith 
(1988); Pratt etal. (1989); Watanabe etal. (1991) 

Ball valves: N. Gibson and Lloyd (1975); Kletz (1989e) 
Filters: Cooper (1953a); Schon (1965); Gavis and Wagner 
(1967,1968); Masuda and Schon (1967); N. Gibson (1969, 
1979); J.T. Leonard and Carhart (1970); Huber and Sonin 
(1975) 

Liquid droplets, bubbles, etc. 

Lenard (1882); Raleigh (1882); Iribane and Mason (1967); 
Jonas and Mason (1968); Levin and Hobbs (1971); 
Schweitzer and Hanson (1971); Vos (1971); Vos, Ramakers 
and van de Weerd (1974); Napier and Rossell (1977); Felici 
(1979); H. Kramer (1981); Castle and Inculet (1991) 

Liquid droplet settling 

von Smoluchowski (1921); Klinkenberg and van der Minne 
(1958) 


Liquid agitation 

Vos etal. (1974); H. Kramer (1981) 

Liquid aerosols, mists and sprays 

C.N. Davies (1966); N. Gibson (1971); J.F. Hughes etal. (1973); 
Napier and Rossell (1973); Bassett (1975); Jennings (1975); 
J.T. Leonard and Clark (1975); G.J. Butterworth and 
Dowling (1981); Castle, Inculet and Littlewood (1983); 
Astbury (1991) 

Fire extinguishers, including carbon dioxide: Heidelberg, 
Nabert and Schb’n (1958a,b); Haessler (1963); Schon and 
Masuda (1969); Cockram (1971); J.T. Leonard and Clark 
(1977); Butterworth (1979b); Anon. (1980J); Collocot, 
Morgan and Morrow (1980); VT. Morgan, Collocott and 
Morrow (1981) 

Steam, including steam curtains: Napier (1974a); Anon. 
(1978LPB21, p. 81) 

Liquid foams 

Howells (1993 LPB114) 

Behavior of chemicals 

Ethyl acetate: Bond (1994 LPB 119) 

Tanks, vessels, including filling 

Heidelberg and Schon (1961);VeUenga (1961); Carruthers 
and Wigley (1962); Bruinzeel (1963); Bustin, Koszman and 
Tobye (1964); Vellenga and Klinkenberg (1965); M.D. Foster 
(1967); J.T. Leonard and Carhart (1967);Tinson (1967); 
Bulkley and Ginsburgh (1968); Schon and Masuda (1969); 
H. Kramer and Schon (1973,1975); Diserens, Smith and 
Bright (1975); Asano, Kramer and Schon (1977); Bright and 
Haig (1977); P. Lees etal. (1981); G.J. Butterworth and Brown 
(1982); Matsubara (1991); Pratt (1992) 

Road and rail tankers, including filling 

OIA (Publ.711); D.V Harris, Karel and Ludwig (1961); Herzog, 
Ballard and Hartung (1961,1964); LWright and Ginsburgh 
(1963); Holdsworth, van der Minne and VeUenga (1964); 
Bulkley and Ginsburgh (1968); Mahley and Warren (1968); 
Lyle and Strawson (1971,1972,1973); H. Kramer and Schon 

(1973.1975) ; Strawson and Lyle (1975a,b); H. Kramer, Asano 
and Schon (1977); Rees (1981); Anon. (1990 LPB 95, p. 5) 

Intermediate bulk containers 

Ebadat and Cartwright (1991a,b); Britton (1993); Dahn, 
Kushani and Reyes (1994) 

Pesetsky and Fisher (1975); Britton and Smith (1988); 
Rosenthal (1988) 

Tankers, including tank cleaning 

Holdsworth etal. (1962); Bustin (1963,1973-74); Rees (1971); 
van der Meer (1971); Smit (1971); Vos (1971); van de Weerd 

(1971.1972.1975) ; J.F. Hughes etal. (1973); A.W Bright and 
Hughes (1975); H.R. Edwards (1983); J.S. Mills and Haighton 
(1983); J.S. Mills and Oldham (1983); M.R.O. Jones and Bond 
(1984,1985); Anon. (1994 LPB 118, p. 14) 

Powders and dusts 

Boyle and Llewellyn (1950a,b); Mffller-Hildebrand (1963); 

N. Gibson (1969,1970,1972,1973b); Lapple (1970); Ramackers 
(1970); Eden (1971,1972); A.W. Bright (1977); Blythe and 
Reddish (1979); Lloyd (1979); Anon. (1980 LPB 35, p. 1); 
Boschung and Glor (1980); Napier (1983); Glor (1984,1985, 
1987,1988); Maurer (1984);T.B. Jones (1987); Ebadat (1991, 
1993);Wolfson Electrostatic Unit (1991); Britton (1993) 
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Powder flow in pipes: Cole, Baum and Mobbs (1969-70); 
van deWeerd (1974); Masuda, Komatsu and Lenora (1976); 
Boschung and Glor (1980); Napier (1983);Touchard etal. 
(1987); Bond (1989 LPB 88); Dahn (1992) Silos: J.F. Hughes 
etal. (1975); Blythe and Reddish (1979); Maurer (1979); 
Britton (1988); Glor (1988) 

Containment and containment materials 

Keller and Hoelscher (1957); Heidelberg and Schon (1960); 
Heidelberg (1970a,b, 1971); N. Gibson and Harper (1981a) 

Belts, conveyors 

Bulgin (1945); Hubbard (1967,1971a); Cunningham (1970); 
Javadi and Napier (1974) 

Human body 

Bulgin (1945); P.S.H. Henry (1971a); L.G. Wilson and 
Cavanagh (1972); Movilliat and Monomakoff (1977); 

N.Wilson (1977,1979,1983); Greason (1979); Movilliat and 
Giltaire (1979);Tolson (1980); RW. Johnson (1981); Berkey, 
Pratt and Williams (1988); Bailey, Smallwood andTomita 
(1991) 

Humidity 

Small, Brooksbank and Thornton (1931) 

Aircraft systems 

Winter (1962); Bruinzeel (1963); DM Harris, Karel and 
Ludwig (1967);Tinson (1967) 

Measurements 

M.D. Foster and Marsh (1964); Beck etal. (1971); Cross 
(1987); Liittgens and Glor (1989) 


relative to each other, with initial contact followed by sub¬ 
sequent separation. When the surfaces are separated, one 
body tends to be left with a positive charge and the other with 
a negative charge. If the bodies are good conductors of elec¬ 
tricity, the charge moves quite freely and both bodies are 
effectively restored to theiroriginal uncharged statethrough 
the last points of contact at separation. But if one or both of 
the bodies are poor conductors, the charge does not flow 
freely and both bodies retain charge after separation. 

There are many industrial processes that involve surface 
contact, movement and separation of poorly conducting 
materials. These processes may be classified in terms of: the 
phases involved, for example, gas-solid; the general type of 
system, for example, dusts and powders; or the particular 
type of process or equipment, for example, pneumatic con¬ 
veying. Some systems in the process industries where static 
effects are important are listed, by the phases involved, in 
Table 16.33. The treatment given below is based on the gen¬ 
eral type of system. The hazard of static electricity occurs in 
the process industry in: fluid handling operations such as 
pipeline flow, settling of drops, agitation, filling of storage 
tanks, filling of tankers; powder and dust and powder 
handling operations such as grinding, sieving and pneu¬ 
matic conveying; in sprays and mists such as in steam 
cleaning and steam leaks; moving equipment such as con¬ 
veyor belts and bucket elevators; and the human body. 

There are also industrial processes in which static elec¬ 
tricity is exploited. They include electrostatic gas filtration 
andelectrostaticspraycoating.Anaccountoftheseprocesses, 
which are of minimal interest here, is given by Cross (1987). 


Table 16.33 Some systems in the process industries 
where static electricity effects are important 


System 


Liquid-solid 

Flow of liquid through pipes, filters 
Splash filling of tanks 

Liquid-liquid 

Mixing of immiscible liquids 

Settling of drops of one liquid through 
another 

Gas—liquid 

Cleaning with wet steam 

Spraying with water 

Leakage of wet steam 

Gas-solid 

Pneumatic conveying 

Fluidized beds 

Solid-solid 

Belt drives 

Conveyor belts 

Reeling of paper or plastics 

Human body 


Static electricity is essentially a phenomenon of low 
current but high voltage. A low conductivity liquid flowing 
through a pipeline can generate charge at a rate of 
10 -8 —10 -4 A. A powder coming out of a grinding mill can 
carry charge at a rate of 10 _8 -10 -4 A. At a charging rate 
of 1(T 6 A the potential of a container insulated from 
ground can rise at a rate of 1000 V/s. Potentials of 10,000 V 
or more are readily obtained in this way. 

Objects that can become charged include process mate¬ 
rials, process plant and the human body. As long as any of 
these can remain charged, the electrostatic hazard is not 
eliminated. 

The static charge may discharge causing an incendive 
spark or it may give a less hazardous corona discharge or 
may leak away to ground. Sparks from good conductors are 
more incendive than are those from poor conductors. 

The hazard of static electricity may be estimated by 
comparing the energy of an electrostatic charge with the 
MIE of flammable gas mixtures and powder or dust sus¬ 
pensions. 

Static electricity is a complex phenomenon and it is 
emphasized that only an outline treatment is given here. 

16.7.2 Static ignition incidents 

In the past there has often been a tendency in incident 
investigation where the ignition source could not be iden¬ 
tified to ascribe ignition to static electricity. Static is 
now much better understood and this practice is now less 
common. 

In 1954, a large storage tank at the Shell refinery at 
Pernis in the Netherlands exploded 40 min after the start of 
pumping of tops naphtha into straight-run naphtha. The 
fire was quickly put out. Next day a further attempt was 
made to blend the materials and again an explosion occur¬ 
red 40 min after the start of pumping. The cause of these 
incidents was determined as static charging of the liquid 
flowing into the tank and incendive discharge in the tank. 
These incidents led to a major program of work by Shell on 
static electricity. 

An explosion occurred in 1956 on the Esso Paterson dur¬ 
ing loading at Baytown,Texas, the ignition being attributed 
to static electricity. 

In 1969, severe explosions occurred on three of Shell’s 
very large crude carriers (VLCCs): the Marpesa, which 








FIRE 16/85 


sank, the Mactra and the King Haakon VII. In all three cases 
tanks were being cleaned by washing with high pressure 
water jets, and static electricity generated by the process 
was identified as the ignition source. Following this set of 
incidents Shell initiated an extensive program of work on 
static electricity in tanker cleaning. 

Explosions due to static ignition occur from time to time 
in the filling of liquid containers, whether storage tanks, 
road and rail tanks or drums, with hydrocarbon and other 
flammable liquids. 

Explosions have also occurred due to generation of static 
charge by the discharge of carbon dioxide fire protection 
systems. Such a discharge caused an explosion in a large 
storage tank at Biburg in Germany in 1953, which killed 
29 people. Another incident involving a carbon dioxide 
discharge occurred in 1966 on the tanker Alva Cape. 

The majority of incidents have occurred in grounded 
containers. Grounding alone does not eliminate the hazard 
of static electricity. 

These incidents are sufficient to indicate the importance 
of static electricity as an ignition source. Further incidents 
attributed to static electricity are described in Case His¬ 
tories B36, B56 and B61. 

16.7.3 Some basic relations 

In work on static electricity it is often necessary to distin¬ 
guish between the potential </> at a point and the potential 
difference, or voltage, V between two points. Where one 
point is grounded and the other is not, the potential and the 
voltage are the same. 

Some of the fundamental relations of static electricity 
are as follows. 


containment (m 3 ), e is the relative permittivity, or dielectric 
constant, e a is the absolute permittivity (F/m), t a is the 
permittivity of free space (F/m), k is the conductivity 
(S/m), p is the volume resistivity (Q m) and a is the surface 
charge density (C/m 2 ). The volume resistivity p is fre¬ 
quently referred to simply as the resistivity. 

Field strength and force 

The field strength E is defined as 


E [16.7.11] 

where E is field strength (V/m) and x is the distance (m). 
Frequently the negative sign in Equation 16.7.11 is dropped, 
since it is only the magnitude of the voltage or field 
strength that is of interest. 

The force F e on a body due to the charge on it and to the 
field in which it is placed is 

F e = qE [16.7.12] 

where F e is force (N). For a gravitational field 

mg = qE [16.7.13] 

where g is the acceleration due to gravity (m/s 2 ) and m is 
the mass of the body (kg). 


Ohm’s law 
Ohm’s law states that 

V = IR [16.7.1] 

where I is the current (A), R is the resistance (£1), and Fis the 
potential difference, or voltage (V). 


Definitions 

The following relations are effectively definitions: 



[16.7.2] 

[16.7.3] 

[16.7.4] 

[16.7.5] 

[16.7.6] 

[16.7.7] 

[16.7.8] 

[16.7.9] 


Charge, energy and work 

The charge accumulated on a body charged by a current is 



The energy IF on a charged body is 


[16.7.14] 


^-7 

d q ~ 


[16.7.15] 


[16.7.16] 


where IFis work, or energy (J). 

Then, integrating Equation 16.7.16, 


W = £ : 16 - 7.17 

*=\lV [16.7.18] 

^\CV 2 [16.7.19] 

Equation 16.7.19 also gives the energy of discharge when 
there is discharge of the full charge on a charged body. 
If there is a partial discharge from potential V\ to potential 
V 2 , the energy of discharge is 


where A is the area (m 2 ), C is the capacitance (F), G is the . 

conductance (S), l is the length (m), q is the charge (C), s w = - C( V? - Ff) 
the space charge density (C/m 3 ), Fj n is the volume of the 2 


[16.7.20] 
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Surface charge density and displacement 

The surface charge density a is proportional to the field- 

Gauss’ law 

Gauss’ law may be stated as 

strength E. For a unidirectional field 

o-c xE 

= e a E 

[16.7.21a] 

[16.7.21b] 

VD = s 

which in Cartesian co-ordinates becomes 

= ee 0 E 

[16.7.22] 

OF 6F 6F _ 

For a bidirectional field 


dx + dy + 0z S 


[16.7.32] 


[16.7.33] 


[16.7.23] where x, y and z are the spatial co-ordinates (m). It may also 
be written for a cloud surface S as 


where subscripts 1 and 2 denote the two fields. 

Another quantity that is used is the displacement D DdS=^q 
which is defined as J 


[16.7.34] 


or, from Equations 16.7.26 and 16.7.34, 


Then 

D xE 
= e a E 
= ee 0 E 


[16.7.25a] 

[16.7.25b] 

[16.7.26] 


J FdS=^ 


or for constant E 


ES = ^ 


[16.7.35] 


[16.7.36] 


where D is the displacement (C/m 2 ). 

Time constant 

The time constant for charging and discharge of a liquid is 


Whereas Coulomb’s law applies to a point source, Gauss’ 
law is more widely applicable. It is used particularly to 
estimate capacitance and charge, given the limiting break¬ 
down field strength of air. Several applications of Gauss’ 
law are given below. 


= ee 0 p 


[16.7.28] Poisson’s law 

Poisson’s law, or equation, is 


where x is the time constant (s). 

16.7.4 Laws of Coulomb, Gauss and Poisson 
Coulomb’s law 

It was shown by Coulomb that the force between two 
charged bodies is proportional to each of the charges on the 
two bodies and inversely proportional to the square of the 
distance between them. In electrostatic units: 


V 2 Fis -~ 

which in Cartesian co-ordinates becomes 

0 2 F tfV 8 2 F_ 5 

dx 2 + £) s 0Z 2 d„ 


[16.7.37] 


[16.7.38] 


F e = ^- [16.7.29] 

where q is the charge on one of the bodies (C), q' is the 
charge on the other body (C) and x is the distance between 
them (m). In SI units 


In general, applications of Poisson’s equation tend to be 
relatively complex and often involve numerical solution. 
However, some applications of the equation are given below. 

The laws of Coulomb, Gauss and Poisson are all for¬ 
mulations of the same physical law. They relate the charge, 
the potential and the field strength. 


F e «; 


ft' 

47 ite 0 x 2 


[16.7.30] 


where F e is the force (N), q is the charge on one of the bodies 
(C), and q' is the charge on the other body (C). 

Coulomb’s law was originally derived by experiment, but 
has subsequently been demonstrated theoretically. 

It follows from Equations 16.7.12 and 16.7.30 that 


16.7.5 Charge 

The charge on a body is expressed as the total charge q, the 
surface charge density cor the space charge density s. 

Sphere (uniform surface charge density) 

For a sphere with uniform space charge density the 
charge is 


E = 


AneCoX 2 


q = 47uz 2 <7 

[16.7.31] 

where a is the radius of the sphere (m). 


[16.7.39] 
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Sphere (uniform space charge density) 

For a sphere with uniform space charge density the charge 

q = *ncr i s [16.7.40] 

Cylinder (uniform space charge density) 

For a cylinder with uniform space charge density the 
charge per unit length is 

q = ni^s [16.7.41] 

Maximum surface charge 

From Gauss’ law, as given by Equation 16.7.36, and from 
Equation 16.7.22, the maximum surface charge on an insu¬ 
lating surface is 

<W = eeoE b 

= 2.64 x 10 -6 C/m 2 

where E h is the breakdown field strength (V/m) 


Hence, substituting for E in Equation 16.7.47 and inte¬ 
grating gives 

q = CV [16.7.48] 

C = Anet 0 a [16.7.49] 

Concentric spheres 

The capacitance of two concentric spheres is 

C = 47i66 0 yzTa [16.7.50] 

where a and b are the radii of the smaller and larger spheres 
(m), respectively. 

Sphere and plane 

The capacitance of a sphere adjacent to a plane is 
C = 4nee 0 a[ilr + 0.5 ln(2 ajz)\ [16.7.51] 


16.7.6 Capacitance 

Given the charge on a body, the field strength, potential and 
capacitance may be obtained from Equations 16.7.6,16.7.11 
and 16.7.22. In this section the general approach to the deter¬ 
mination of the capacitance of a system is illustrated for the 
cases of parallel plates and an isolated sphere and expres¬ 
sions are given for the capacitance of some other common 
systems. The capacitance of some common objects is also 
given. Field strengths are treated in the following section. 


Parallel plates 

For the capacitance of two parallel plates, Equation 16.7.22 
yields 

q = eeoAE [16.7.42] 

and Equation 16.7.10 yields 


where z is the distance from the nearest point on the sphere 
to the plane (m) and i j/ is Euler’s constant. The value of 
Euler’s constant is 0.577. 

This system was originally studied by Russel (1909) and 
is treated by Cross (1987). 


Coaxial cylinders 

The capacitance of two coaxial cylinders is 
_ teo2nl 

ta(72/n) 


[16.7.52] 


where 1 is the length of the cylinders (m) and r, and r 2 are 
the radii of the inner and outer cylinders (m), respectively. 


Parallel cylinders 

The capacitance of two parallel cylinders is 


V~Ex [16.7.43] 

where A is the area of each plate (m 2 ) and x is the distance 
between the plates (m). Combining Equations 16.7.42 and 
16.7.43 

q = CV [16.7.44] 


neej 


[16.7.53] 


where a is the half-distance between the axes of the cylin¬ 
ders (m) and r is the radius of each cylinder (m). 




c = 

[16.7.45] 

Isolated sphere 

For the capacitance of an isolated sphere, Equation 16.7.22 
yields 

q = Anr^teoE 

and Equation 16.7.10 yields 

[16.7.46] 

V •- 1“ Edr 

[16.7.47] 

where r is the radial distance (m). 



Common objects 

The capacitance of some common objects is given in 
Table 16.34. 

16.7.7 Field strength and breakdown 
Permittivity 

The permittivity of a substance or medium is generally 
expressed in terms of its relation to the permittivity of free 
space. The relative permittivity, or dielectric constant, r of a 
substance is the ratio of the absolute permittivity of that 
substance e a to the permittivity 60 of free space, as given by 
Equation 16.7.9. Another notation that is quite widely used is 
to denote the absolutepermittivity of a substance as a and the 
relative permittivity as e r . The permittivity q, of free space is 

q, = 8.55 x 1CT 12 F/m 
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Table 16.34 The capacitance of some selected object s 3 


Object 

Capacitance h (pF) 

Single bolt 

1 

Tools 

5 

Small metal item (scoop, hose nozzle) 

10-20 

Flange (100 mm nominal) 

12(10-15) 

Shovel 

20 

Small container (bucket, 501 drum) 

20(10-100) 

Medium container (250—5001) 

30-300 

General plant item c 

100-1000 

Road tanker 

1000 

Human body 

200(100-300) 


a Sources: N. Gibson (1969); BS 5958: Part 1:1980; Expert Commission 
(1988); Glor (1988); Luttgens and Glor (1989). 
b Approximate values. 

c Item immediately surrounded by grounded structure. 

The relative permittivity, or dielectric constant, of air is 
about 1, that of hydrocarbons about 2, and that of water 
about 80. 


From Equation 16.7.42 the field strength between two par 
allel plates with one at potential V and the other at zen 
potential is 

I 167 * 54 

where^4 is the area of each plate (m 2 ). 

Isolated sphere 

From Equation 16.7.46 the field strength at the surface of ar 
isolated sphere is 


For a sphere with a uniform space charge density exert¬ 
ing fields both inside and outside the sphere the field 
strengths are 


> 

E 3ee 0 r 2 


[16.7.58a] 

[16.7.58b] 


where r is the radial distance (m). 

It can be shown by Gauss’ law that the field strength 
outside a sphere is the same if the total charge q is (1) con¬ 
centrated at one point, (2) uniformly distributed in space in 
the sphere and (3) uniformly distributed over the surface of 
the sphere. 

The relation between the field strength and the potential 
on a sphere is as follows. From Equation 16.7.10, for the 
sphere 


-f 


AmcoO? 1 

where a is the radius of the sphere (m). 

Infinite parallel plates (uniform space charge density) 

The maximum field strength between two infinite parallel 
plates with a uniform charge density between them and 
with both at zero potential occurs at the boundary and is 


Then from Equations 16.7.40,16.7.58 and 16.7.59 

E m- V/a [16.7.60] 

Cylinder (uniform space charge density) 

The maximum field strength in an infinite cylinder with a 
uniform space charge density and with zero potential at the 
boundary is 

E= So [16 - 7 ' 61] 

where r c is the radius of the cylinder (m). This equation is 
often applied to pipes. 

For a cylinder with a uniform space charge density 
exerting fields both inside and outside the cylinder the 
fields’ strengths are 




2ee 0 r 


[16.7.62a] 

[16.7.62b] 


where x is the half-distance between the plates (m). 

Sphere (uniform space charge density) 

The maximum field strength in a sphere with a uniform 
space charge density and with zero potential at the bound- 


where a is the radius of the sphere (m). 

This equation is often applied to systems that approx¬ 
imate a sphere such as a cubic storage tank. 


Coaxial cylinders (uniform space charge density) 

The field strengths at the surfaces of the inner and outer 
cylinders in a system of two coaxial cylinders with a uni¬ 
form charge density in the space between them are, 
respectively 


B=n/r 0 


B\nB\ 


[16.7.63] 

[16.7.64] 
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where £) and E a are the field strengths at the surfaces of the 
inner and outer cylinders (V/m) and r f and r 0 are the radii of 
the inner and outer cylinders (m). If r i -C r a 


[16.7.66] 

[16.7.67] 


These equations have been applied to the case of a cable 
hanging inside a storage tank. 

Tanks fully and partially filled 

A detailed treatment of the field strengths in fully and 
partially filled tanks is given by Hinkenberg and van der 
Minne (1958) and further treatments are described below. 

Field breakdown 

The breakdown field strength E b of air at atmospheric 
pressure is usually given as 

E^ = 3 x 10 6 V/m = 3000 kV/m = 3 MV/m 

In fact, the breakdown field strength is a function of the 
electrode gap. Klinkenherg and Van der Minne give the fol¬ 
lowing data for the critical field strength between large 
parallel electrodes in air at atmospheric pressure: 


Electrode gap 

Critical field strength 

(mm) 

(kV/m) 

0.6 

5220 

10 

3150 

100 

2650 

Large gap 

2240 


Figure 16.43 gives the breakdown field strength in air 
over a somewhat wider range. 

According to a relationship usually known as Paschen’s 
law, the breakdown field strength is a function of the 


product PI of the pressure Pand the gap l, where P is pres¬ 
sure (bar) and l is gap width (m). Figure 16.44 shows the 
breakdown voltage Ffor air as a function of PI. For values of 
PI > 10 -3 bar m, this graph is consistent with a constant 
breakdown field strength of 3000 kV/m. 

16.7.8 Electrostatic charging 

The conditions for a significant accumulation of electro¬ 
static charge are that there occurs some process, which 
generates the charge, and that any process of charge dis¬ 
sipation is sufficiently slow. 

There are a number of mechanisms by which an electro¬ 
static charge can build up. The mechanisms of principal 
interest here are (1) contact and separation, (2) induction, 
(3) double layer separation and (4) charge sharing. Other 
mechanisms include (5) corona charging, (6) diffusion 
charging, and (7) particle capture. 

Most accounts of the generation of static electricity 
begin with a discussion of the electrostatic phenomena 
involved in the contact and separation of surfaces, in the 
first instance solid surfaces. If two different materials 
are rubbed together, so that there is first contact and then 
separation of their surfaces, charges build up on the 
surfaces of the two materials, one material having a 
charge of one polarity and the other a charge of opposite 
polarity. 

Modern theory, stemming from work on solid-state phy¬ 
sics, treats electrostatic phenomena in terms of electron 
transfer. If the temperature of a surface is high enough, 
electrons are emitted from it.This emission is characterized 
by the electron work function. The work function is lower in 
conducting materials and higher in insulating ones. 

If the surfaces of two different materials at the same 
temperature are brought into contact, electron transfer 
occurs. The material with the lower work function is the 
donor and that with the higher work function the acceptor. 
Electrons migrate from the former to the latter, so that the 
acceptor acquires a negative charge and the donor a posi¬ 
tive one. At equilibrium the potential difference due to the 
difference in the two work functions is equal to that due to 
the charge transfer. The proportion of electrons transferred 
is very small, at most eight in a million. 



Gap width (mm) 


Figure 16.43 Dielectric strength of air (Glor, 1988): effect of gap width (Courtesy of Research Studies Press) 
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If the two surfaces are then separated, charge separation 
also occurs. Provided charge dissipation is limited, one 
material retains a negative charge and the other a positive 
charge. The two processes of contact and separation com¬ 
prise the process of charge generation. 

Charge is also generated between two surfaces of the 
same material at different temperatures. 

The nature of the charges depends on the permittivity of 
the two materials. According to Coehn’s (1898) laws’: 

(1) the body with the higher permittivity has the positive 
charge; 

(2) the magnitude of the charge is a function of the dif¬ 
ference in the permittivities of the two materials. 

These laws’ are, however, controversial. For one thing, as 
just stated, charge generation can occur between surfaces 
of the same material. 

Materials may be ranked in a triboelectric series. Charge 
generation is larger for two materials far apart in the series. 
However, there is no standard triboelectric series, different 
versions being given by different authorities. Before 
separation the distance between the surfaces will be very 
small, of the order of 10 -9 m. After separation the capaci¬ 
tance is greatly decreased due to the large increase in the 
distance between the surfaces. The charge remains con¬ 
stant. The voltage is therefore greatly increased (q = CV). 
The energy is also greatly increased (W = <?F/2). Energy is 
supplied to the system as work done in moving the two 
charges apart. 

The model just given is a highly simplified one. In par¬ 
ticular, it is based exclusively on electron transfer and takes 
no account of ion transfer. There are some phenomena that 
are more readily explained by ion transfer. For example, 
glass may acquire a negative or a positive charge, depend¬ 
ing on whether it has previously been in contact with acid 


or with alkali. An account of ion transfer is given by Cross 
(1987). 

In discussing charging by contact and separation, Cross 
draws a distinction between contact and friction charging 
and states that the failure to distinguish between them has 
been the cause of much confusion. Friction charging can 
occur even between identical materials. It is probably a 
surface temperature effect. 

However, some workers prefer to avoid the terms ‘con¬ 
tact’ and ‘friction’ altogether. There is no dispute that actual 
charge accumulation happens when separation occurs, and 
to this extent the term ‘separation charging’ may be pre¬ 
ferred. Liittgens and Glor (1989) argue that ‘friction char¬ 
ging’ is also a misnomer in that charge accumulation has 
nothing to do with friction per se, but is an effect of surface 
temperature. 

Some of the factors which influence the magnitude of 
charge accumulation in separation charging include (1) the 
temperature of the surfaces, (2) the permittivity, (3) the 
number and density of contact points, (4) the electrical 
conductivity, (5) the speed of separation and (6) changes in 
the condition of the materials. 

The temperature of the surfaces is a fundamental factor 
determining the extent of electron transfer. 

Coehn’s laws, as already discussed, describe the effect of 
permittivity. 

The number and density of contact points depends on the 
force on the two surfaces. Work on a series of metals and 
polymers has been done by Haenen (1976), who obtained 
the relation 

?c xF? [16.7.68] 

where F c is the force (N/m 2 ), q is the charge generated (C) 
and n is an index. The value of n was in the range 0.3—1.0. 

The higher the conductivity of the materials, the greater 
the extent to which any charge generated is neutralized. 
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If both bodies are poor conductors, both will become 
charged. Of one body is a good conductor and grounded, 
the charge on that body will flow to ground. If one body is a 
good conductor but not grounded, the charge will dis¬ 
tribute itself over the body. In this way a considerable 
charge may build up. 

The speed of separation is another factor governing the 
extent of charge neutralization. The higher the speed of 
separation, the less time there is available for charge neu¬ 
tralization to occur. 

Physical changes in the condition of the materials, such 
as expansion and compression, must have some effect, but 
are not well documented. Another important mechanism of 
charging is induction. Induction charging occurs only 
where the body is a conductor. If a body that is an isolated 
conductor is placed in an electrical field, charges of differ¬ 
ent polarity are induced on opposite sides. If then a groun¬ 
ded electrode touches, or even approaches close to, this 
body, the charges close to the electrode flow away, leaving 
the body with a charge of opposite sign. 

This effect may be illustrated by the situation shown in 
Figure 16.45. In Figure 16.45(a) the man, wearing non¬ 
conducting footwear approaches a positively charged con¬ 
veyor belt. A negative charge is induced on the upper part 
of his body on the side nearer the belt, and a positive charge 
on the lower part. In Figure 16.45(b) he touches a grounded 





Figure 16.45 Inductive charging of the human body 
(Cross, 1987): (a) the charge separates in the field due to 
the charged belt; (b) the charge from top of the body flows 
to ground; and (c) the body is left with a net charge 
(Courtesy of Adam Hilger) 


point on the conveyor and the negative charge leaks to 
ground. In Figure 16.45(c) he is left with a positive charge, 
which equalizes over his body. 

Liquids also can be charged by induction. A charging 
mechanism that is particularly important for liquids is 
double layer separation. If an ionic substance is dissolved 
in a liquid of high dielectric constant, the ions are dis¬ 
sociated and in an electrical field they move in opposite 
directions. An example of such a situation is sodium 
chloride ions in water. At an interface such as a pipe wall 
ions of one charge will be held strongly, while those of the 
other charge will be held less strongly and will form a dif¬ 
fuse layer. For a liquid with conductivity as high as that of 
water, the diffuse layer will be only a few molecules thick. 
Liquids such as hydrocarbons, however, also contain some 
ions. For these liquids, which have much lower con¬ 
ductivity, the diffuse layer will be much thicker. 

There are a number of models of the double layer, as 
shown in Figure 16.46. The original model was that of 
Helmholtz (1879). In the Helmholtz model, shown in Figure 
16.46(a), the layer of counter ions is compact, in the Guoy- 
Chapman model (Guoy 1910,1917; Chapman, 1913), shown 
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Figure 16.46 Double layer at a solid-liquid interface 
(Cross, 1987): (a) Helmholtz model; (b) Gouy-Chapman 
model; and (c) stem model (Courtesy of Adam Hilger) 
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in Figure 16.46(b) the layer is more diffuse, while in the 
Stern model (Stern, 1924), shown in Figure 16.46(c), the 
layer of counter ions partly compact and partly diffuse. If 
the liquid moves through the pipe, the diffuse layer moves 
with the liquid and charge separation occurs. 

Some of the factors that influence the magnitude of 
charge accumulation in liquid double layer separation 
include (1) permittivity, (2) electrical conductivity and 
(3) speed of separation. The effects of these variables are 
discussed below. 

Charge accumulation over time is not necessarily a sim¬ 
ple monotonic process. There are three principal patterns of 
charge accumulation, as shown in Figure 16.47. The charge 
may either (1) rise to a maximum and stay there, (2) rise to a 
maximum and then stabilize at a lower plateau, or (3) rise to 
a maximum, fall to zero and then stabilize at a plateau of 
opposite sign. 

The time taken to reach the maximum value may be 
characterized by the half-life, which is a function of the 
materials. 

Charge sharing occurs when two bodies, at least one of 
which is charged, come into contact and charge passes from 
one to the other. It is relevant particularly to mists and 
dusts. 

Corona charging can be used to create a defined charge 
on a body for experimental purposes. An account is given 
by Cross (1987). 

Diffusion charging of particles occurs as a result of col¬ 
lisions between particles and ions in a gas. Particle capture, 
particularly the capture of small particles by larger ones, is 
another mechanism of charging. 

In certain situations it is possible to calculate the limit¬ 
ing charge density. The limiting factor is the charge, which 
gives an electric field strength equal to the breakdown field 
strength of air. Gauss’ law, given below, may be used to 
determine the limiting surface charge densities and also 
the limiting volume charge densities. 

Little has been said so far about the polarity of the 
charge. This is important in some applications, as descri¬ 
bed below. 

Processes in which charge separation occurs include: 
(1) flow of liquids, (2) transfer of liquids, (3) size reduction, 


(4) transfer of powders, (5) reeling processes and (6) rota¬ 
tion of belts. 


16.7.9 Electrostatic charge accumulation, retention and 
relaxation 

The charging processes described lead to an accumulation 
of charge in the system. In the general case this input of 
charge is balanced by an output. This output may take 
various forms. Charge may be carried away in material 
leaving the system or it may leak away to ground. 
The equivalent electrical diagram such as that shown in 
Figure 16.48 commonly represents this situation. 

One common case is where the charging current on an 
object is balanced by the leakage current so that the system 
is at steady state. Then the voltage Fof the object is then 
related to the charging current I and the resistance R to 
ground by Equation 16.7.1 (Ohm’s law). 

This situation is relevant to grounding. If the charging 
current is known, it is possible to ensure that the voltage 
does not exceed a specified limit by ensuring a suitable 
resistance to ground. The limit on the voltage is generally 
set in order to avoid an incendive spark. The limiting factor 
may be the need to avoid a field strength, which causes 
breakdown or the need to avoid an accumulation of energy 
that equals the MIE of the flammable mixture. The energy 
accumulated also depends on the capacitance of the object. 
Table 16.35 gives typical electrostatic potentials and spark 
energies quoted for charged objects. 

Another common case is where material undergoes a 
transition from a situation where it was being charged to 
one where the charging reduces or ceases. It is then able to 
dissipate this charge, usually by leakage to a containment 
and so to ground. This process is known as relaxation. It is 
relevant particularly to liquids. Where a liquid has 
acquired a charge, arrangements may be made to allow the 
charge to relax. In a flow system these take the form of 
providing residence time, while in a storage or tanker sys¬ 
tem they involve allowing time to elapse before operations 
are undertaken. 

Some of the relations commonly used for the charging 
and discharge of a system are as follows. 



Figure 16.47 A streaming current in a liquid flowing in a pipe (Cross, 1987; aftter Coste and Pechery, 1977): 

(a) monotonic rise; (b) initial peak followed by a fall to a plateau; and (c) initial peak followed by a fall to a plateau, 
with reversal of sign (Courtesy of Adam Hilger) 
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Figure 16.48 Equivalent electrical circuit for an electro¬ 
statically charged conductor (BS 6958: Part 1: 1980) 
(Courtesy of the British Standards Institution) 


Integrating Equation 16.7.71 

V ~ V»\\ - exp( -t/x)] [16.7.73] 

Multiplying Equation 16.7.73 by C and applying Equation 16.7.6 

q = q 0 [l-exp(-t/x)\ [16.7.74] 

Differentiating Equation 16.7.74 and utilizing Equation 16.7.69 

/ = 7 0 exp (—t/x) [16.7.75] 

where I 0 is the current at the start of charging (A), q„ is the 
charge equivalent to the impressed voltage, or the charge at 
the end of charging (C), and V 0 is the voltage across the cir¬ 
cuit, or the voltage at the start of charging (V). 

Discharge of a condenser 

For the discharge of the circuit the unsteady-state charge 
balance is, from Equations 16.7.1,16.7.6 and 16.7.69 


Table 16.35 Typical electrostatic potentials and spark 
energies of selected objects 



Potential 

(kV) 

Spark 
energy (mj) 

Flange 

10 

0.5 

Shovel 

15 

2 

Drum 

20 

40 

Road tanker 

15 

100 

Human body 

10 

10 

Flange on a glass 

<15 


line with toluene 
flowing in it 

Flange on a steam ejector 

<15 


Transmission belt 

<80 


(speed 3-15 m/s) 

Surface of liquid fuel in large 

<100 


container which has 
been filled rapidly 


Sources: Britton and Smith (1988); Expert Commission (1988); Glor 
(1988). 


Charging of a condenser 

The relations for the charging of, and discharge from, a 
simple resistance-capacitance (RC) circuit provide the 
basis for analysis of more complex systems. For the char¬ 
ging of such a circuit 

J [16.7.69] 

[16.7.70] 

From Equations 16.7.6,16.7.69 and 16.7.70 the unsteady-state 
charge balance on the capacitance gives 

dF 

T d t =V °~ V [16 - 7 ' 71] 


t°^=-F [16.7.76] 

Integrating Equation 16.7.76 

V = F 0 exp(—f/t) [16.7.77] 

Multiplying Equation 16.7.77 by C and applying Equation 16.7.6 

q = q 0 exp(-t/t) [16.7.78] 

Differentiating Equation 16.7.78 and utilizing Equation 

16.7.69 

I = I 0 exp ( -t/x) [16.7.79] 

Charging of a tank 

For the charging of a tank into which liquid is being 
pumped, from Equation 16.7.4 

R = ^ [16.7.80a] 

R = ^ [16.7.80b] 

where h is the height of liquid in the tank (m). The relation¬ 
ships for the time constant r are given by Equations 16.7.27, 
16.7.72 and 16.7.80. 

The initial and final charges in the tank contents are 
q= 0 and q = q 0 . The initial rate of change of charge is the 
charge current in the liquid entering the tank, or streaming 
current I 0 : 

(!)„-'• |I6J - 811 

The unsteady-state charge balance on the tank is 


= RC 


[16.7.72] 


[16.7.82] 
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From Equations 16.7.81 and 16.7.82 

g 0 = I 0 x [16.7.83] 

Integration of Equation 16.7.82 gives, for tank charging, 
Equation 16.7.74. 

Relaxation of a tank 

Equation 16.7.78 is applicable for the relaxation of charge in 
a liquid in a tank into which pumping has just stopped. The 
rate of decay in this case may be defined in terms of the 
relaxation time x or of the charge half-life fy 2 . The relation¬ 
ship between the two is 

ll§= ln2 = 0.693 [16.7.84] 

where fy 2 is the half-life (s). The charge decays during 
relaxation to 50% of its original value in 0.69 t, 37% in 1 t 
and 5% in 3 x. 

16.7.10 Electrostatic discharge 

When an electrostatic charge has accumulated, it may dis¬ 
charge either by leaking away, usually to ground, or by a 
specific mode of discharge. There are a number of 
mechanisms by which an electrostatic charge can dis¬ 
charge. Those of principal interest here are (1) spark 
discharge, (2) brush discharge, (3) corona discharge, 
(4) propagating brush discharge and (5) bulking brush 
discharge. 

A corona discharge can cause ignition of a flammable gas 
mixture but its incendivity is borderline; it is sometimes 
stated to be non-incendive to flammable gases or dusts. 
Essentially it is incendive only to gases with very low MIEs 
such as hydrogen and carbon disulfide. The other modes of 
discharge can be incendive, except that it has not been 
demonstrated that a brush discharge can ignite dusts. 

A corona discharge occurs over a longer time than a 
spark discharge and may give a faint glow and a sound of 
hissing. 

Streaming currents for substances such as petroleum 
products are of the order of 10 _6 -1(T 5 A. Corona currents 
can be much larger. The existence of a corona may therefore 
dissipate the charge due to the streaming current and lead 
to a lower steady-state electrostatic potential. 

In discussion of discharges it is usual to speak of the 
bodies the surfaces of which act as points of discharge as 
electrodes. In this sense the human body may act as an 
electrode. 

A spark discharge is one that occurs between two con¬ 
ductors isolated from each other and involves two electro¬ 
des. Typically one of the conductors is isolated from ground 
and the other is grounded. Spark discharges are also called 
capacitor discharges, since any system of two conductors 
isolated from each other is effectively a capacitor. A spark 
discharge can occur between a fixed isolated object and a 
grounded object. Alternatively, one or even both of the 
objects may be moving. 

If the resistance between the origin of the spark and all 
other points on the conductor is less than about 10 6 Q, a 
spark discharge can occur. The resistance above that such a 
discharge will not occur cannot be stated with any precision. 

The value of the breakdown electric field strength 
usually quoted for air is that applicable to two parallel 
plates. If the surfaces are not parallel, the breakdown field 
strength can be lower. There are numerous industrial 


situations in which there are two objects in combination 
which constitute a capacitor and which therefore may have 
the potential for a spark discharge. 

A spark discharge occurs in a fraction of a second and 
gives a short, sharp, crackling sound. 

A brush discharge is one that occurs on a single electrode 
and the discharge ends in space. The electrode is a groun¬ 
ded conductor. A charged insulator or a charged conductor 
may create the electric field. Most accounts of brush dis¬ 
charges deal mainly with the former. 

Some industrial situations in which a brush discharge 
can occur are as follows. The grounded conductor may be a 
fixed metal object, a sampling device or the human body. 
The charged object may be a plastic pipe, a drum or a bag, a 
conveyor belt, a flowing liquid or a powder or a cloud of 
spray or dust. 

Where the second object, like the first, is a conductor, a 
spark discharge is also possible, and brush and spark dis¬ 
charges may be in competition. The nature of the discharge 
depends on the shape of the objects. 

A corona discharge is similar to a brush discharge but 
occurs where the electrode is more pointed. The radius of 
curvature limits quoted are >5—50 mm for a brush dis¬ 
charge and <1 mm for a corona discharge. A corona dis¬ 
charge may persist over a long period. 

There are a number of situations in which a propagating 
brush discharge may occur. These are where there is (1) a 
non-conducting film suspended parallel to a conductor, 
(2) a non-conducting film on a conductor, or (3) a non¬ 
conductor. The situation may be explained by reference to 
Figure 16.49, where Figure 16.49(a) shows an isolated 
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Figure 16.49 Electric field strength due to an electrically 
charged sheet (BS 6958: Part 1 1980): (a) isolated sheet; 
(b) sheet adjacent to a metal plate grounded on the 
opposite side; and (c) sheet backed by an grounded metal 
plate (Courtesy of the British Standards Institution) 
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non-conducting film in free space and Figures 16.49(b) and 
(c) show the first two cases mentioned; the third case is 
similar to the second as far as the field is concerned. The 
strength of the electric fields is proportional to the density 
of the arrows. For the isolated film in free space the break¬ 
down field strength of air sets a limit on the surface charge 
density For case 1 the presence of the grounded conductor 
causes a redistribution of the field so that much of it is 
directed towards the conductor. In this situation a much 
higher charge density can he accommodated before field 
breakdown occurs. For case 2 even greater redirection 
occurs and an even greater charge density can be accom¬ 
modated. Case 3 is similar to case 2 except that now there is 
a single non-conducting object. 

A propagating brush discharge can occur if there is a 
short circuit between the insulating film and the conductor 
or, in case 3, between one side and the other of the non¬ 
conductor. One way in which this can occur is if the film is 
perforated by mechanical damage. Alternatively, if an 
electrode approaches the non-conducting surface the field 
may be altered so that a brush discharge occurs on the 
electrode; the central channel may extend to that surface 
and damage it. In either case the change in direction of the 
field gives a very high field strength across the surface and 
ionization occurs, so that the whole non-conducting surface 
then discharges into the original channel. 

A suitable colouring powder may be used to effect 
visualization of the discharge patterns on the insulator 
surface. These patterns are characteristic and are called 
lichtenberg figures. Propagating brush discharges are 
referred to as Lichtenberg discharges. 

Propagating brush discharges have also been reported on 
insulating film not backed by a conductor. Although propa¬ 
gating brush discharges have traditionally been explained 
in terms of a non-conducting film adjacent to or on a con¬ 
ducting surface, the more important practical case is that of a 
non-conducting envelope such as a pipe or container. 

Some industrial situations in which a propagating brush 
discharge can occur include: the flow of a low conductivity 
liquid or a powder through a pipe or into a container which 
is either non-conducting or has an insulating internal 
coating, and rotation of a conveyor belt with a conductive 
coating on one side. 

A bulking brush discharge is a type of brush discharge 
that can occur on a heap of powder in a silo. Non- 
conductive, relatively coarse powders are the most suscep¬ 
tible. The discharge spreads over the surface of the powder, 
starting at the wall and moving to the centre. 

Reference should also be made to lightning-like dis¬ 
charges. These have been observed in the ash and dust 
clouds over volcanoes and at one time it was supposed that 
such discharges might occur in industrial operations. 
There is, however, no evidence of this. 

The four types of discharge described, other than bulk¬ 
ing brush discharge and lightning discharge, are shown in 
Figure 16.50. 

16.7.11 Liquids 
Charge generation 

Static electricity effects in liquids may usefully be con¬ 
sidered in terms of the classical theory of the electrical 
double layer at an interface. This has been described by 
Stern as comprising two parts: a compact or Helmholtz 
layer near the interface and a diffuse or Guoy layer 
extending further into the liquid. 


According to this model, if a liquid such as oil is at rest 
and in contact with another immiscible liquid such as water 
or with a solid such as a container wall, there builds up in 
that liquid an electrical double layer. This electrical double 
layer may be represented in convenient, though over¬ 
simplified, form as one layer of positive ions and one of 
negative ions. The phenomenon is illustrated schematically 
in Figures 16.51(a) and (b) for these two cases. There is no 
significance in the fact that the ions nearest the interface 
are positive; they could equally well be negative. 

If, in the system described, the oil is a poor conductor and 
there is a relative movement between the surface of the oil 
and that of the water or of the container, the ions closest to 
the interface tend to adhere to it so that the oil loses some 
ions of one particular sign and thus becomes electro¬ 
statically charged. Situations in which such charge 
separation may occur are the pipeline flow of an oil, the 
settling of water droplets through an oil and the splashing 
of oil droplets onto the side of a tank, as illustrated in Fig¬ 
ures 16.51(c) and (d), (e) and (f), and (g) and (h), respectively. 

The classical electrochemical models describe some of 
the situations mentioned. The equations are useful at least 
as a guide to the factors that are important. In some cases 
they have been further developed to give relations more 
applicable to industrial situations. 

The extent of charge separation is dependent on the resis¬ 
tivity of the liquid. If its resistivity is low, charge separation is 
easy, but so is charge recombination through the liquid, while 
if its resistivity is sohigh as to he effectively infinite, no charge 
separation occurs. If the liquid has high resistivity, however, 
there may be appreciable charge separation without immedi¬ 
ate recombination. It is the handling of high resistivity 
liquids, therefore, which tends to generate static electricity 
Examples of low resistivity liquids are water, ethanol and 
crude oil, and examples of high resistivity liquids are gaso¬ 
line, kerosene, naphtha, benzene and other white oils. 

Charge discharge 

A hazard occurs with a liquid if charge is able to accumu¬ 
late and if this charge undergoes rapid discharge rather 
than gradual dissipation. This hazard depends to a large 
extent on the container in which the liquid is held. Broadly, 
such containers are (1) containers made of conducting 
material and grounded, (2) containers made of conducting 
material and insulated from ground and (3) containers 
made of non-conducting material. 

In process plants the container is usually made of metal 
and is grounded. If the liquid has low conductivity, it is 
possible for a large charge to accumulate in the container. 
The relaxation time for dissipation of the charge may be 
long. A discharge may occur between the liquid and the 
grounded container. Thus, in this situation, grounding of 
the container is not sufficient to eliminate the hazard. The 
comment has already been made that the majority of igni¬ 
tion incidents have occurred in grounded containers. 

It is easier for charge recombination to occur if one, or 
both, of the two oppositely charged objects is pointed. Thus 
any metal object which protrudes into a tank and which is 
electrically connected to it acts as a path for the discharge 
current. Such an object is known as a ‘grounded probe’. 
Objects that can act as grounded probes include dipsticks 
and ullage tapes, tank washing machines and metallic 
objects floating on the liquid surface. 

An activity that causes particular risk of discharge is 
level gauging. If a man standing on a tank inserts a 
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Figure 16.50 Four types of electrostatic discharge (Liittgens and Glor, 1989): (a) spark discharge; (b) brush 
discharge; (c) corona discharge; and (d) propagating brush discharge (Courtesy of Expert Verlag) 


conducting ullage tape into the liquid in the tank and the 
liquid is charged, a discharge may occur between the liquid 
and the tape. This may happen in two ways. If the tape is 
connected to ground via the man, or otherwise, it can act as 
a grounded probe. Alternatively, if it is insulated from 
ground but inserted in the liquid there may be a discharge 
across to the grounded tank. 

A container may be made of metal but insulated from 
ground. In this case a large charge may accumulate in the 
liquid and on the container. Then if a path to ground is 
created there may be a discharge. 

A similarly large charge may accumulate in a liquid held 
in a container made of insulating material, and again dis¬ 
charge may take place if a path to ground occurs. 

Another configuration which gives rise to the possibility 
of discharge is that of an isolated conductor. The conductor 
may become charged and then give a discharge. Isolated 
conductors in plant may occur not only in vessels but also in 
pipework. A section of non-conductive material in metal 
pipework may constitute an isolated conductor. 

If the charged object is a good conductor, it may be treated 
in the conventional way as an electrical capacitance. The 
energy available for discharge is given by Equation 16.7.19. 
The energies calculated in this way may be compared with 
the MIEs of flammable gas mixtures and of dust suspen¬ 
sions (as described in Section 16.2 and Chapter 17, 


respectively) in order to determine the probability that 
a spark discharge may have sufficient energy to cause 
ignition. 

If the charged object is a poor conductor, no similar cal¬ 
culation of the energy available to produce a spark is pos¬ 
sible, because the charge is generally not uniformly 
distributed and the resistance to its flow is high. 

16.7.12 Some electrolytic relations 

The model of a hydrocarbon electrolyte which is most often 
used in work on static electricity is that of a binary, mono¬ 
valent electrolyte. For such an electrolyte some basic rela¬ 
tions are as follows. The number of charges z is 

z=|2+N1M [16.7.85] 

where z is the number of elementary charges per particle. 
The ionic mobility u is assumed to be 

u = u + = ~u- [16.7.86] 

where u is the ionic mobility (m 2 /Vs). The ionic velocity v is 
v = uE [16.7.87] 

where v is the ionic velocity (m/s). 
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Figure 16.51 Generation of static electricity in liquid systems: (a) electrical double layer at a liquid-liquid interface; 
(b) electrical double layer at a liquid-solid interface; (c, d) charge separation as oil flows through a pipeline; 

(e, f) charge separation as a water drop falls through oil; and (g, h) charge separation as oil spashes onto a tank wall 


The charge flux; for each ionic species with concentra¬ 
tion n is 



jmz^FuE 116.7.89; 


where F is the charge per kilomole equivalent (C/kmol),/ is 
the charge flux (A/m 2 ), n is the number of ions per unit 
volume (ions/m 3 ), and N is the number of molecules per 
kilomole (molecules/kmol). F is Faraday’s constant 
(= 9.65 x 10 7 ) and N is Avogadro’s number (= 6.02 x 10 26 ). 

The concentration c of each ionic species is 


The force F e due to the electric field is 

F e = zeE [16.7.91] 

where e is the charge on a proton (C) (= 1.6 x 10 “ 19 ) and F e 
is force (VAs/m). The electric charge is given by 

ne = cF [16.7.92] 

The total concentration of ions is 
c++c-=2c [16.7.93] 

The current density/is 


[ 16 . 7 . 90 ] j _ 2 nvze 


[ 16 . 7 . 94 ] 
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= 2 cvzF [16.7.95] 

= 2 cuzFE [16.7.96] 

•= kE [16.7.97] 

k — 2 nuze [16.7.98] 

* 2 cuzF [16.7.99] 

where /is the current density (A/m 2 ). In terms of the ionic 
concentrations, the conductivity is 

k = (c+ - +C-)uF [16.7.100] 


The surface charge density a at the electrical double layer is 
given by 


[16.7.11| 


where V4 is the potential difference across the double 
layer (V). 

Another important parameter is the zeta potential. This 
is the potential at the plane of slip between the surface and 
a liquid moving across it. The zeta potential is 


[16.7.112] 


where c + is the concentration of positive ions (kmol/m 3 ) 

and is the concentration of negative ions (kmol/m 3 ). n« 711^1 

The space charge density is >“ L ib ' 1 -J 


s 1 (e., - a )F [16.7.101] 

The relation between the ionic velocity and the diffusion 
coefficient is 


[16.7.102] 


where D m is the molecular diffusion coefficient (m 2 /s), k is 
Boltzmann’s constant (kgm 2 /s 2 K) and T is the absolute 
temperature (K). 

The relation between the concentration and the con¬ 
ductivity is 


c + FF 2 D m 

K± =:•••- RT 

K=X t¥ +K- 


(c+ + c.yF 2 D m 


J$F 

2cZ 2 F*D m 

RT 


[16.7.103] 

[16.7.104] 

[16.7.105] 

[16.7.106] 


where R is the universal gas constant (kj/kmol K). 

For a liquid from which all the ions of one sign have been 
removed, Equations 16.7.100 and 16.7.101 become 


k = cuF [16.7.10 7] 

s m cF [16.7.108] 

The thickness <5 of the double layer is derived as follows. It 
has been shown by Debye and Huckel that 


where £ is the zeta potential (V) and 17 is the viscosity of the 
liquid (kg/ms). 

16.7.13 Liquid conductivity 

The electrical conductivity of a liquid is due to the presence 
of ions. This is true for hydrocarbons as well as for aqueous 
solutions. Addition of ions increases the conductivity and 
removal of ions decreases it. 

It has been found by a number of investigators that the 
electrical conductivity of hydrocarbon liquids is not a true 
constant but may vary. It is therefore usual to speak of a 
‘rest’ conductivity, which is the intrinsic property, and an 
‘effective’ conductivity, which depends on the conditions. 

Douwes and van der Waarden (1967) showed that when 
the dc electrical conductivity of hydrocarbons was mea¬ 
sured under different conditions so that there were differ¬ 
ent decay times, extrapolation back to zero time gave 
conductivities equal to each other and equal to the ac con¬ 
ductivity. They concluded that it was this zero time dc 
conductivity, which is the intrinsic property. 

A discussion of fundamental aspects of liquid con¬ 
ductivity has been given by Klinkenberg (1967a). 

According to Schon (1967), the effective conductivity x e 
and rest conductivity k t (S/m) may vary by a factor of 10. In 
general, the difference increases as the charge density 
increases. 

Britton and Smith (1988) give relations for the effect of 
charge density on the conductivity and for the effect of 
temperature on the effective conductivity. They quote the 
work of H. Kramer and Schon (1973) on the effect of charge 
density: 

Ke = h + k 2 s [16.7.114] 



where k is the Boltzmann constant (J/K) and S is the thick¬ 
ness of the double layer (m). 

From Equations 16.7.98, 16.7.102 and 16.7.109 it can be 
shown that 


where k\ and k 2 are constants. The constant k 2 is positive for 
liquids with low rest conductivity (<1 pS/m) and negative 
for liquids with a higher rest conductivity. Kramer and 
Schon obtained a maximum value of 4 for the ratio K r / x e . For 
the effect of temperature Britton and Smith quote an equa¬ 
tion of P.I. Mason (1975): 

logwteM) = HT2 - Ti) 16.7.115] 


<5 = (D m r)Vz 


where k 3 is a constant and subscripts 1 and 2 refer to states 1 
[16.7.110J an( j 2 ? respectively. For liquids such as kerosene, the value 




FIRE 16/99 


of the constant k 3 is about 0.015°C _1 . H. Kramer and Schon 
(1975) give some experimental data showing the effective 
conductivity to be, on average, half the rest value. WD. Rees 
(1975) reports measurements in which the effective con¬ 
ductivity varied between one-tenth and one-half of the rest 
value. 

The above relations also indicate that for low con¬ 
ductivity liquids the effective conductivity is greater than 
the rest value. This is important, because the relaxation 
times for low conductivity liquids are long and any feature 
that reduces them is helpful. Thus Vellenga and Klinken¬ 
berg (1965) have derived a model of charge relaxation in a 
liquid in which the assumption is that the conductivity is 
proportional to the charge density and which gives a 
hyperbolic rather than an exponential decay. Another 
model has been given by M.D. Foster (1967). 

The range of conductivities that occur in practice is very 
wide. According to Klinkenberg and van der Minne (1958), 
the conductivity of a crude oil may be 10 7 times that of a 
light fraction. There tend to be large differences between 
the conductivity of pure and commercial chemicals. 
For example, the conductivity of pure heptane has been 
given as 0.03 pS/m and that of the commercial product as 
10-100 pS/m. 

The electrical conductivity, dielectric constant and 
relaxation time of selected liquids are shown in Table 16.36. 
Relaxation times vary from very small fractions of a second 
for some crude oils up to minutes or even hours for some 
highly purified products. 

One broad classification of liquid conductivity (Expert 
Commission, 1988) is that liquids with a conductivity of 
less than 10 _s S/m are classed as non-conductive and those 
with a conductivity exceeding this are classed as con¬ 
ductive. Examples quoted of non-conductive liquids are 
aliphatic and aromatic hydrocarbons, ethers and methane 
derivatives, and examples of conductive liquids are hydro¬ 
carbons with polar groups, alcohols, aldehydes, ketones, 
acids, esters (except those of higher acids), nitriles, amides, 
amines and nitro compounds. 


Two liquid conductivities that are commonly taken as 
demarcation values are IpS/m and 50 pS/m. A con¬ 
ductivity less than 1 pS/m is commonly classed as very low 
and one in the range 1-50 pS/m as low. The conductivity 
criterion of 50 pS/m appears to derive in large part from the 
work at Shell (e.g. Klinkenberg and van der Minne, 1958). It 
is quoted as a demarcation value in codes such as NFPA 77: 
1988 and BS 5958:1991. 

The greatest danger occurs where the liquid con¬ 
ductivity is in the intermediate range, that is, not so low 
that there is little charge generation and not so high that 
charge equalization is very rapid. Figure 16.52 illustrates 
the zone of particular hazard. 

Mention is made in the literature of the possibility of pro- 
static agents and of ‘hot fluids’, but usually only in passing. 

A note on the units of conductivity/resistivity is given in 
the notation at the end of this chapter. 

16.7.14 Liquid flow in pipes 

One of the most important situations in which static elec¬ 
tricity may be generated by a liquid is in flow through a 
pipe into a receiver such as a storage tank or a road or rail 
tanker. The flow of liquid results in a charging, or stream¬ 
ing, current that then transports charge into the receiver. 

Factors that affect the charge generation in liquid flow 
in pipes include the pipe diameter and material, the liquid 
viscosity and electrical conductivity, and the liquid 
velocity. Impurities, including water, are also important. 
Figure 16.53, from Leonard and Carhart (1970), illustrates 
the variation of charging current with conductivity. 

The charge generated by a liquid flowing in a pipe is 
greatly increased if the liquid contains water. An increase 
in the charge generated by a factor of up to 50 is quoted by 
Klinkenberg and van der Minne (1958). Many accidents 
attributed to static electricity have involved wet liquids. 

Charge generation by liquid flow in pipes has been 
modelled by a number of workers and some success has 
been achieved in explaining theoretically the charging 
currents generated in small diameter pipes, but there has 


Table 16.36 Electrical conductivity, dielectric constant and relaxation time of selected liquids 


A Electrical conductivity, dielectric constant and relaxation time 



Electrical conductivity (S/m) 

Dielectric constant Relaxation time (s) 

Highly purified hydrocarbons 

10“ 15 

2 1.8 x 10 4 

White products 

10“ 13 -10- 10 

2 1.8 x 10 _1 —10 2 

Crude oil 

10“ 9 -10“ 7 

2 1.8 x 10 -4 -1.8 x 10 -2 

Demineralized water 

10“ 5 

80 7.1 x 10“ 5 

B Dielectric constant 

Hexane 

1.9 


Heptane 

2.0 


Benzene 

2.3 


Toluene 

2.4 


Cyclohexane 

2.0 


Ethyl ether 

4.3 


Acetone 

21.0 


Methanol 

33.7 


Ethanol 

25.7 



Sources: Klinkenberg and van der Minne (1958); Eichel (1967); Napier (1971). 
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- log conductivity 

Figure 16.52 Liquid electrical conductivity (Saletan, 1959b): conductivity ranges of selected liquids (Courtesy of 
Chemical Engineering) 
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Figure 16.53 Streaming current for liquid flow in a pipe (Leonard and Carhart, 1970): effect of liquid electrical con¬ 
ductivity (Courtesy of the Journal of Colloid and interface Science) 


been less success with large pipes and for these it is 
necessary to rely on empirical correlations. Empirical cor¬ 
relations are generally of the form 

/ cx u m d n [16.7.116] 

where d is the pipe diameter (m), I is the streaming current 
(A), u is the velocity of the liquid (m/s) and m and n are 
indices. 


Most of the work on liquid flow in pipes refers to 
metal pipes, but there is a limited amount of work on non¬ 
conducting pipes. Obstructions in the pipe may cause 
appreciable charge generation. Filters are the main case in 
point, but other items such as ball valves have also received 
attention. 

16.7.15 Early models 

Early theories of charge generation by a liquid flowing in a 
pipe were given by W.F. Cooper (1953a) and Boumanns 
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(1957). In Boumanns’ theory charge is generated as the flow 
of liquid entrains ions from the double layer. But this 
mechanism, while capable of giving a transient, does not 
fully explain the existence of a steady-state current. Bou¬ 
manns therefore introduced the concept of a ‘wall current’. 

Another early model was that of Schon, given in unpub¬ 
lished work quoted by Hampel and Luther (1957). This work 
is also referred to by Klinkenberg and van der Minne (1958). 

16.7.16 Klinkenberg and van der Minne model 

A model for the streaming current and the streaming 
potential for the flow of liquid in a pipe has been given by 
Klinkenberg and van der Minne (1958). The assumptions of 
the model are that (1) the electrical double layer is thin 
compared with the pipe diameter, (2) this layer is also thin 
compared with the laminar sublayer, (3) the streaming 
current is independent of the pipe length, and (4) the shear 
stress is constant throughout the electrical double layer. 
The charging current / is 

/ = ndpJsvdx [16.7.117] 

where d p is the pipe diameter (m) and x is the distance from 
the pipe wall (m). The shear stress t s in the electrical double 
layer is 


where A p is the pipe cross-sectional area (m 2 ), l is the pipe 
length (m) and A P is the pressure drop (N/nT). Hence from 
Equations 16.7.123 and 16.7.124 

/= _ApO ? C Ap [ 16 . 7 . 125 ] 

The streaming potential F s is obtained by equating the 
streaming current to minus the leakage current through the 
liquid in the pipe: 

7=-^ [16.7.126] 

where R p is the resistance of the liquid in the pipe (n) and F s 
is the streaming potential (V). Then from Equations 16.7.4, 
16.7.5 and 16.7.126 

I= _A^c Vs [16.7.127] 

Equating Equations 16.7.125 and 16.7.127 yields 

F s .= —A P [16.7.128] 

KfJ 


[16.7.118] 


where r\ is the viscosity of the liquid (kg/m s) and t s is the 
shear stress (N/m 2 ). Then, since the shear stress is assumed 
constant throughout the layer, 


where t so is the shear stress at the wall (N/m 2 ). 

Applying Poisson’s equation, Equation 16.7.38, in one 
dimension 


S=~eeo^ [16.7.120] 

Hence from Equations 16.7.117-16.7.120 

[16.7.121] 

Integrating Equation 16.7.121 between the wall (x = 0) and 
the plane where the potential gradient is zero (dV/dz = 0) 


v r(*s-/£-rr ii6 ” 221 


For the limit just given the first term in the integration in 
Equation 16.7.122 is zero. The second term may be replaced 
by the zeta potential. Hence 

7= _ H*so«oC [16.7.123] 


Eliminating the shear stress by using a force balance which 
introduces the pressure drop 


[16.7.124] 


16.7.17 Koszman and Gavis model 

Another theoretical model, or rather suite of models, is that 
of Koszman and Gavis (Gavis and Koszman, 1961; 
Koszman and Gavis, 1962a,b). They postulate that electro¬ 
lytic oxidation-reduction reactions can occur in hydro¬ 
carbons, that in effect a cell reaction occurs in the pipe, and 
that the current flow is associated with this reaction. With 
current flow, concentration polarization will occur. They 
thus avoid the need to assume a wall current of unspecified 
origin. The current is explicitly described as a diffusion 
current due to the concentration polarization. The Koszman 
and Gavis models are given in cgs units and these units are 
retained for these models here. 

The first model derived is for a low conductivity liquid. 
The mechanisms of charge transport are diffusion, con¬ 
vection and electrical conduction. The basic equation for 
charge transport, or current, is 

I = -D m Wq - zcV</> + vq [16.7.129] 

where D m is the diffusion coefficient (cm 2 /s), I is the 
streaming current (A), q is the charge (C), v is the local 
velocity (cm/s), k is the electrical conductivity of the liquid 
(fi -1 cm -1 ) and </> is the potential (V). The solution of the 
charging current equation is 

/ = 2 nr v uD ^ F ( c ° ~ c *) [i _ ex p(—L/ mt)] [16.7.130] 

where c Q is the concentration of the discharging ion in the 
bulk fluid (mol/cm 3 ), c s is the concentration of the dischar¬ 
ging ion at the pipe wall (mol/cm 3 ), F is Faraday’s constant 
( = 96,500 C/mol), L is the length of tube (cm), n t is the 
transference number, r p is the pipe radius (cm), u is the 
average velocity (cm/s), (5 m is the thickness of the diffusion 
layer (cm) and r the relaxation time (s). 

The total transport of charge across the diffusion layer 
includes normal conduction transport under the influence 


xd p h S0 = A p AP 
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of the potential difference between the tube and the hulk 
liquid, and it is therefore necessary to include the trans¬ 
ference number nt of the ions of charge opposite to those 
being discharged. 

The thickness of the diffusion layer is given by 
c5 m = 2r p /Nu [16.7.131] 

Then from Equations 16.7.106,16.7.130 and 16.7.131 





From Equation 16.7.141 they derive 

, 0.044 He 1/8 Sc 1/2 
1 = 


[16.7.142] 


[16.7.143] 


/ = / 0O [l-exp(-i/«T)] 


ntt 0 RTu 

2«tF 


Nu(l 


C S /C„) 


[16.7.132] 


[16.7.133] 


From the correlation for the Nusselt number Nu 


Nu = 0.0223 Re 7/8 Sc 1/4 [16.7.134] 

Re= (2rp)# [16.7.135] 


where v is the kinematic viscosity (cm 2 /s). Then from 
Equations 16.7.133 and 16.7.134 

4 = 0m ^ RTU Re t/8 Sc V4 (1 _ Cs/Co) [16.7.1®! 

Sc is the Schmidt number. 

The concentration c s should be sensitive to the surface 
materials, but since these are found to have only a small 
effect it is possible to assume c s < c a . 

As described below, Equation 16.7.132 has had some 
success in describing the current generation in hydro¬ 
carbon liquids of low conductivity, but not for high con¬ 
ductivity hydrocarbon liquids. Koszman and Gavis 
utilizing the model of Klinkenberg and Van der Minne have 
therefore extended the treatment. Starting with Equation 
16.7.123, and introducing the Reynolds number 


[16.7.137] 


where ri is the viscosity of the liquid (g/cm s) and pi is the 
density of the liquid (g/cm 3 ), the friction factor/ 

/ = ^ [16.7.138] 

and the correlation for the friction factor 


/ = 0.079 Re“ 0 ' 25 [16.7.139] 

yields 

/ = 0.047t£6„ Re 3/4 «C [16.7.140] 

The authors then write Equation 16.7.140 as 


[16.7.141] 


where is given by Equation 16.7.133. 

The high conductivity model of Equation 16.7.141 does 
not include a term, which corrects for pipe length compar¬ 
able to that in Equation 16.7.132, because the relaxation 
time is so short that the equilibrium current is reached in a 
very short distance. 

The Koszman and Gavis model for low conductivity is 
Equations 16.7.132 and 16.7.133, and that for high con¬ 
ductivity is Equations 16.7.141 and 16.7.142. 

Some features of the low conductivity model are: 


I = f(x) Short pipes [16.7.144a] 

4 t4/(k) Long pipes [16.7.144b] 

4 tx u m [16.7.145] 

4 tx (2a) 7 / 8 [16.7.146] 


Koszman and Gavis performed experiments to study the 
charge generation in small diameter pipes. The experi¬ 
ments confirmed relations 16.7.144—16.7.146. They then 
plotted the group (I oa /u a, (2a) 7 ^ 8 ) against G, as shown in 
curve A of Figure 16.54. The graph shows that in the low 
conductivity region the group (4/« l7<! (2a) 7 / 8 ) is indepen¬ 
dent of G, as predicted by theory. This held for a wide range 
of liquid electrical conductivities, liquid velocities and a 
rather smaller range of pipe diameters and materials. 
The main exception was platinum pipes, which gave a 
much higher current generation, as shown in curve B of 
Figure 16.54. The authors attributed this to a surface 
roughness effect. 

The low conductivity model is not applicable, however, in 
the high conductivity region. Its range of applicability is 
for values of logi 0 G < —5. For higher conductivities the 
current predicted is higher than that observed. At high 
conductivities the high conductivity model, Equation 
16.7.141, was used. It gave the predicted values shown in 
curves C and D of Figure 16.54. The two curves are for the 
two extreme values of the Reynolds number used (2100 and 
45,000). 

N. Gibson (1971) has cast the Koszman and Gavis model 
in the form 


Y = Kf{G) 


G = 
K 4 



0.35 RTee 0 


Sc°' 25 /(C) 


[16.7.147]! 


[16.7.148] 

[16.7.149] 


where/(C) is a concentration function. 
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Figure 16.54 Streaming current for liquid flow in a pipe (Koszman and Gavis, 1962b): A, B experimental curves for 
platinum, stainless steel tubes respectively. C, theoretical line for low conductivity liquids; D, theoretical line for high 
conductivity liquids, Re=2100; and E, theoretical line for high conductivity liquids, R e = 45 000 (Courtesy of Chemical 
Engineering Science) 


Equation 16.7.147 applies to liquids of all conductivities. 
For the case of liquids of low conductivity in turbulent flow 

/(G) = 1 [16.7.151] 

The model of Equation 16.7.147 gives exponents for the pipe 
diameter d and the liquid velocity u, which may be com¬ 
pared with values obtained in empirical correlations. 

16.7.18 Schon model 

Schon (1965) carried out experiments using pipe diameters 
in the range 2.5-20 cm and ‘motor spirit’ (resistivity 
10“ 14 -10 -11 fi cm) and obtained the correlation 

loo = p(ur) n [16.7.152] 

where r is the pipe radius (cm), u is the liquid velocity 
(cm/s), P is a constant and n is an index. The value of n was 
in the range 1.8-2.0. The author states that the experi¬ 
mental scatter was such that a value of 2 may be taken for n. 
For this value of n the constant /? = 1.5 x 10 -13 . 

Equation 16.7.152 has been given by Klinkenberg (1967c) 
in SI units: 

loo = Ctfd 2 [16.7.153] 

where d is the pipe diameter (m), u is the liquid velocity 
(m/s) and C is a constant. The value of the constant C is 
given as 3.75 x 10 -6 As 2 /m 4 . 

Schon states that Equation 16.7.152 is intended to give an 
upper limit. It has been widely quoted in the literature and 
thus evidently is widely used. 

A critique of Equation 16.7.152 has been given by Britton 
and Smith (1988), who indicate that it is not conservative 
in all cases and propose a revised value of C of 2.5 x 10 -6 

16.7.19 Gibson and Lloyd model 

Another set of experiments are those of N. Gibson and 
Lloyd (1967, 1970b), who utilized pipe diameters in the 


range 1.62-10.9 cm with toluene and toluene with ASA 
additive as a conductivity modifier. 

They found that the Koszman and Gavis model broke 
down for these larger pipe diameters. They correlated their 
results using the equation 

loo = ku m d n [16.7.154] 

where d is the diameter of the pipe (cm), u is the velocity of 
the fluid in the pipe (cm/s), k is a constant and m and n are 
indices. The indices m and n were somewhat variable, as 
was the constant, hut N. Gibson (1971) has given Equation 
16.7.154 as 

loo = ku 2A d 16 [16.7.155] 

and the values of k given by N. Gibson and Lloyd (1970b) 
are then of the order of 10 _1 . 

The variability of the indices is taken into account in the 
alternative equation given by N. Gibson and Lloyd (1967) as 
follows: 

!« 2.24 x IQ -1 W' 48 

+ O.Old exp(0.4 logi 0 d logi 0 u ) [16.7.156] 

where d is the pipe diameter (cm) and u is the liquid velocity 
(cm/s).* Equation 16.7.156 is another equation which is 
often quoted. 

N. Gibson and Lloyd (1970a) also studied the effect of 
contamination on charge generation. They found that the 
presence of contaminant in the toluene could affect the 
charge generated, but that the values of the streaming 
current never exceeded those of pure toluene by a factor of 
more than 10. They attributed this effect to the influence of 
the contaminant on the electrical conductivity of the liquid. 


*In the original paper, and in the first edition of this book, a negative 
sign incorrectly preceded the index of d in Equation 16.7.156. 
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16.7.20 Other models 

There are a number of other models for the charging current 
in liquidflow through pipes.They include those by Gibbings 
(1967) and Gibbings and Hignett (Gibbings and Hignett, 
1966;HignettandGibbingsl968),GoodfellowandSGraydon 
(1968a,b), Walmsley (1982, 1983a-c) and Walmsley and 
Woodford (1981a,b), and Abedian and Sonin (1982). 

16.7.21 Liquid flow in non-conducting pipes 

Most of the work done on streaming currents has been for 
metal pipes, but a small amount of work has been done on 
non-conducting, or insulating, pipes. In this context a non¬ 
conducting pipe is one made of a material such as glass, 
rubber or plastic. However, the point is often made that 
these materials can conduct the very low currents, which 
occur in static electrification. 

Work using 12 mm diameter polyethylene pipe with 
kerosene has been described by N. Gibson (1971). The main 
difference compared with results for metal pipes was that 
for a low conductivity liquid (resistivity 10—10 12 Hem) 
the streaming current passed through a transient, dec¬ 
reasing with time to a constant value. For a high con¬ 
ductivity liquid the current was constant with time, as is 
the case for liquids of all conductivities in metal tubes. 
This decrease of current was attributed to the fact that the 
charge, which separates to the pipe surface, is unable to 
migrate along it sufficiently fast and impedes charge 
separation. 

Work on the electrification of xylene in a glass pipe has 
been described by Cross, Haig and Cetronio (1977). These 
workers found a number of features that had a marked effect. 
There were high charge levels at bends and constrictions 
compared with straight pipe. Current flowing to metal flan¬ 
ges and to metal bands placed around the pipe varied both in 
magnitude and polarity. The state of the pipe surface was 
difficult to control and had a strong effect. For example, 
baking the pipe at 400°C effected a change in polarity. 

16.7.22 Carruthers and Marsh model 

Carruthers and Marsh (1962) have developed a model for 
the streaming current that is applicable to both conducting 
and insulating pipes. The model was developed as part of a 
study of the fuelling of aircraft where a filter in the pipe is 
liable to generate a large amount of charge. The model 
assumes that the liquid entering the system is already 
charged and deals with its subsequent behaviour. It does 
no itself provide an estimate of the streaming current in 
the liquid entering the pipe. The simple model initially 
used was 

/„ = k exp(—f/r) + 7 P [1 - exp(—f/r) [16.7.157] 

where / is the current entering the pipe (A), / p is the current 
generated in the pipe (A), I 0 is the current leaving the pipe 
(A) and t is the residence time in the pipe (s). 

This model proved inadequate, however, and the follow¬ 
ing more complex model was developed. A conductance 
ratio B was defined as 

B 

Conductance per unit length of liquid in pipe 
Conductance per unit length of liquid in pipe+pipe wall 
[16.7.158] 


so that 

B = 0 Conducting pipe [16.7.159a] 

B = 1 Insulating pipe [16.7.159b] 

Then the general expression derived is 
1= [/ie- A +7 p (l-e- A ) 

+B(k-h) [(^-) - e '"] [16.7.160a] 

i=f/T [16.7.160b] 

For the two extreme cases 

i 0 =iim+i p [i-m\ [ 16 . 7 . 161 ] 

with, for conducting pipe 

f(X) e«P* 5 = 0 [16.7.162a] 

and for insulating pipe 

f(X) m i-p- B = 1 [16.7.162b] 


where/is the fraction of the charge unrelaxed. 

The authors conducted experiments with 0.47 cm dia¬ 
meter pipe and iso-octane. Some of their results are shown 
in Figure 16.55. Figure 16.55(a) gives experimental data for 
copper pipe and Figure 16.55(b) data for PTFE pipe. They 
regarded these results as reasonable confirmation of the 
model. 

Larger scale experiments using a 2.5 in. rubber hose 
were also performed and here the performance of the model 
using a rest conductivity was less good. However, the fit 
improved when an effective conductivity some 13 times 
lower than the rest value was used. 


16.7.23 Liquid flow through filters and ball valves 

Obstruction and filters in pipes can cause considerable 
increases in charge generation. Filters, in particular, can be 
prolific charge generators. For example, H. Kramer and 
Schon (1975) quote charge densities as high as 1000 C/m 3 
obtained at filters. N. Gibson (1969) states that the current 
generated by a filter can be as high as 10 _6 -10 _s A. 

Factors that affect the charge generation at a filter 
include the porosity and pore diameter, the electrical con¬ 
ductivity of the liquid, and the superficial velocity of the 
liquid. 

Experimental investigations of charge generation in fil¬ 
ters include those of Gavis and Wagner (1967), Masuda and 
Schon (1967), Leonard and Carhart (1970) and Huber and 
Sonin (1975). The latter workers also give a model for the 
charge generation. The filters used by these various inves¬ 
tigators were somewhat different and the original work 
should be consulted for the correlations obtained. The 
model of Carruthers and Marsh for the relaxation of charge 
after a charge generator such as a filter has already been 
described. 
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Key: 

O K = 370 picomho/metre 
a K = 18.3 picomho/metre 
a K = 5.3 picomho/metre 
• K = 110 picomho/metre 
■ K = 250 picomho/metre 

Copper tube length 103 cm 
Id tube 0.47 cm 
Od tube 0.79 cm 



(b) 


Figure 16.55 Streaming current for liquid flow in a pipe (Carruthers and Marsh, 1962): non-conducting pipe: (a) charge 
relaxation in a copper pipe; and (b) in a PTFE pipe (Courtesy of the Institute of Petroleum) 
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Work on charge generation in ball valves has been car¬ 
ried out by N. Gibson and Lloyd (1975). They performed 
experiments in a 10.9 cm stainless steel pipe with a 4 in. 
bore stainless steel ball valve with toluene and with tolue¬ 
ne + water. Parameters investigated were the liquid velo¬ 
city, the water content in the range 0—5 %v/v and the 
fractional opening of the valve. Charge densities in the 
liquid increased with liquid velocity and with water con¬ 
tent, the latter increase being marked for water contents 
above 0.1-0.2% v/v. Of the openings investigated, a frac¬ 
tional opening of 0.13 gave the highest charge generation. 
The highest charge density obtained in the work was 
623 C/m 3 at a liquid velocity of 10 m/s with a water content 
of 5%v/v and a fractional opening of 0.13. 

In addition to the effect such charging may have on a 
liquid flowing into a receiver, there is also a hazard of an 
incendive discharge at the valve itself. Gibson and Lloyd 
state that incidents have occurred where the valve body has 
been insulated by PTFE support rings and packing, and 
discharges have been observed during the flow of liquid. 
The capacitance of ball valves in the range 2-20 cm has 
been measured as 2-150 pF and the resistance to ground in 
the range 10 s -10 14 fi. The authors take a potential of 1 kVas 
the minimum likely to give an incendive spark, and use a 
MIE of 0.2 mj. They are then able to compute the charging 
current required to give an incendive spark for different 
values of the valve capacitance, resistance to ground and 
potential using Equations 16.7.1,16.7.6 and 16.7.19. 

16.7.24 Liquid droplet settling 

Klinkenberg and van der Minne (1958) have also given a 
treatment for liquid droplet settling, based on earlier work 
by von Smoluchowski (1921). For the settling of a drop of 
immiscible liquid, such as water, or of a solid particle, the 
downwards-acting force in an electric field is 

F e = ^ ncfgAp + qE [16.7.163] 

The upwards-acting force is 


where X is the volume fraction of the dispersed phase (v/v). 
From Equations 16.7.165-16.7.167 


E= qXgAp 
(mqaKOL 




[16.7.168] 


3 _ 1 | ”d q 2 

fmqaK 

Also, the settling velocity is 


[16.7.169] 



[16.7.170] 

16.7.171] 


where # Bt is the Stokes velocity (m/s) and a is a correction 
factor. 

Equation 16.7.168 contains the charge term q which is 
generally not known. It is more convenient to reformulate it 
in terms of the zeta potential, which can be estimated. From 
Equations 16.7.6 and 16.7.47 

q = 4nee 0 a£ [16.7.172] 

Hence from Equations 16.7.168 and 16.7.172 


2ct 0 XgApl 


[16.7.173] 


[16.7.174] 


The settling potential gradient 7 set is equal to the field 
strength E. The charge q Yes in the vessel is 


F e = 6nqau 


[16-7.164] , yes=Wd?7yes 


[16.7.175] 


where a is the diameter of the liquid droplet (m), u is the 
settling velocity (m/s) and A p is the density difference 
between the droplet and the continuous liquid phase 
(kg/m 3 ). Following Stokes’ law, and equating these two 
forces 


\nd?gAp + qE 
&nqa 


[16.7.165] 


The current caused by the transported charge is the sum of 
that from the falling droplets (un A q) and that from conduc¬ 
tion (kE). At equilibrium there is no net current and hence 

un&q + kE = 0 [16.7.166] 


where » d is the number of droplets per unit volume 
(droplets/m 3 ) and q is the charge on a droplet (C). But 


[16.7.167] 


where q ves is the charge in the vessel (C), F set is the settling 
potential gradient (V/m) and X, es is the volume of the 
vessel (m 3 ). 

The foregoing gives the field strength in the liquid. The 
field strength in the vapour space may be obtained by 
equating the potential differences so that 

[16.7.176! 

where E v is the field strength in the vapour space (V/m), h } 
is the height of liquid in the tank (m) and H is the height of 
the tank (m). 

As an illustration, consider the estimate made by Howells 
(1993 LPB 114) for the settling of droplets of water from a 
foam blanket injected onto the top of a hydrocarbon fuel in a 
floating roof storage tank, as described in Section 16.28. He 
uses the following values of the parameters: e = 2, typical of 
hydrocarbons; e a = 8.85 x 10 _4Z F/m; Ap = 300 kg/m 3 , 
typical for the density difference between water and hydro¬ 
carbons; C = 0.04 V, typically in the range 0.01—0.1 V; 
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r\ = 5 x ltT 4 Ns/m 2 , typical of hydrocarbons; k = 0.1 pS/m, 
typical of a very low conductivity product; a = l, constant 
dependent on particle size, which can be taken as unity for 
particles over a few hundred microns diameter; and g = 
9.81 m/s. The value of X is obtained on the assumptions that a 
0.3 mblanket of foam with an expansion ratio of 5 and a 25 % 
drainage time is applied to the surface and that the foam 
breaks down into 750 pm droplets; this gives X = 2.7 x 1CT 4 . 
Equation 16.7.173 then yields an electric field of 9 kV/m. 
Applied to a tank filled with liquid to a depth of 3 m 
grounded at the bottom, the liquid surface potential 
obtained is 27 kV. 

16.7.25 Liquid sprays and mists 

Another situation that can give rise to the generation of 
static charge is the break-up of a liquid to form a spray or 
mist. This can occur in two main ways: (1) discharge 
through an orifice, or (2) splashing against a surface. 

The charge on a liquid droplet resides on the surface and 
exerts an outward force, which is countered by surface 
tension. There is thus an upper limit to the amount of charge 
on a droplet, which was determined by Lord Rayleigh 
(1882), and is known as the Rayleigh limit. This may be 
written as 

q = (64t r 2 ££ 0 ya 3 ) 1/2 [16.7.177] 





3 


[16.7.178] 


[16.7.179] 


where a is the radius of the droplet (m), m is the mass of 
the droplet (kg), q is the charge (C), y the surface tension of 
the liquid (N/m), p\ is the density of the liquid (kg/m 3 ) and 
the subscript max denotes the maximum. The Rayleigh 
limit is higher than the Gauss limit. 

If a droplet is charged to the Rayleigh limit it disrupts. 
Work by Schweizer and Hanson (1971) on rc-octanol showed 
that such a droplet then forms one particle with some 95% 
of the mass and some 77% of the charge, and a number of 
other, much smaller particles. 

N. Gibson (1971) has reported work on the electrification 
of kerosene and of kerosene with 5% water released as a jet 
from a 3 mm pipe. Some results of this work are shown in 
Figure 16.56. The presence of relatively small amounts of 
water produced a 1000-fold increase in the space charge 
density 

Napier and Rossell (1973) studied the charge in a spray 
from a jet of xylene from a 0.25 mm tube. Space charge 
densities of 0.6 x 10~ 3 C/m 3 were measured. They comment 
that the conductivity of the liquid may have been increased 
by small amounts of water (up to 0.1%), oxidation products 
and dissolved metals. 

After separation the liquid droplets retain their charge 
until they settle out or until a discharge occurs. A mist 
containing enough energy to give an incendive spark can 
be created by a high-pressure jet, but the conditions under 
which discharge occurs are not well defined. Discharges 



Figure 16.56 Charge generated in a liquid jet (N. Gibson, 
1971): A, kerosene; B, kerosene plus 5% water (Courtesy 
of the Institute of Physics) 


observed have tended to be of the non-incendive corona 
type rather than spark discharges. 

N. Gibson (1971) has given a simple model that treats the 
mist as a sphere containing uniformly sized droplets. The 
maximum field strength occurs at the periphery of the 
sphere and is 


fw = 3^ o [16.7.180] 

while the total energy of such a spherical mist cloud iso¬ 
lated in space is 


W m 


2jrs 2 0 5 ms (l 1 \ 


[16.7.181] 


where a ms is the radius of the mist cloud (m), E is the field 
strength at the edge of the cloud (V/m), s is the space charge 
density of the mist (C/m 3 ), IFis the energy in the cloud (J), 
c ar is the dielectric constant of air and c ms is the dielectric 
constant of the mist. 

Another situation that can occur is where the jet impin¬ 
ges on a conducting object insulated from ground. A charge 
may accumulate on the object and then give a discharge. 

These electrostatic effects occur when steam is let down 
from a high pressure so that it comes out wet from the ori¬ 
fice, as with a leak on a steam main. The principal hazard 
with such a leak is generally that presented by a conducting 
object insulated from ground. 
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An electrostatic charge can accumulate in droplets in 
steam. There is a static electricity hazard, therefore, when 
steam is used for cleaning or purging of equipment that has 
contained flammables. 

Similarly, charge generation can occur when a vapour, 
such as propane, containing some small liquid droplets is 
let down through a jet. 

Charge is also generated when a gas containing solid 
particles issues from an orifice. Thus a carbon dioxide jet 
being directed from a fire extinguisher into a vessel con¬ 
taining a flammable atmosphere may contain small parti¬ 
cles of solid carbon dioxide and may generate enough 
charge to ignite the mixture. 

The splashing of liquid falling onto, or directed against, 
a surface also results is charge generation. This has been 
studied by Iribane and Mason (1967), Jonas and Mason 
(1968), Levin and Hobbs (1971) and Vos (1971). 

Levin and Hobbs showed that the main charging 
mechanism is disruption of the double layer at the liquid- 
air interface. Most of the charge is associated with the 
ejection of droplets of some 20 pm diameter from the liquid 
surface. 

Vos obtained for aqueous solutions the following relation 
for the charging current 

I=c*u 2 [16.7.182] 


cubic in shape. For long shallow tanks they refer to 
Equation 16.7.56. 

For a partially full tank with a uniform charge density in 
the liquid but otherwise no liquid surface charge and zero 
charge density in the vapour space, they give the following 
relation for the field strength in the vapour space 


ft* 


2 £ 0 (£ v Ai + e\hy) 


[16.7.183] 


where E v is the field strength in the vapour space (V/m), hi 
is the depth of liquid (m), h, is the height of the vapour space 
(m), 6i is the dielectric constant of the liquid and e v , is the 
dielectric constant of the vapour. 


16.7.29 Vellenga model 

Vellenga (1961) obtained a model for the electric field 
strength inside a rectangular tank. He assumes that the 
charge is uniformly distributed and that the dielectric 
constant of the liquid and of the vapour are the same, the 
difference between them being in practice a factor of about 
2. He obtained for the general case the expression 


Ey = 2eT r~ 


where c* is the charging tendency (As z /m 2 ), I is the char¬ 
ging current (A) and u is the velocity of the j et impinging on 
the surface (m/s). 


[16.7.184] 


16.7.26 Liquid agitation 

The agitation of liquids can generate charges of the same 
order of magnitude as charging by liquid flow in a pipe. 
Vos et al. (1974) have described work undertaken following 
several fires involving agitation to effect the dissolution of 
epoxy resin in xylene.With epoxy resin flakes of 0.3-4 mm 
and with a liquid conductivity of 50 pS/m, the charge 
density increased from below 30 pC/m 3 at a stirrer speed of 
250 rpm to 450 pC/m 3 at a speed of about 1250 rpm. 
Increasing the conductivity to 2000 pS/m led to a reduction 
in charge density to 10 pC/m 3 . The charge density 
decreased with increase in temperature to an extent that 
could not be accounted for simply by the effect of tempera¬ 
ture on conductivity. Further studies of agitation charging 
have been described by H. Kramer (1981). Blowing gas 
through the liquid may also effect agitation. This also is 
liable to generate charge. Static electricity is also generated 
by splash filling of tanks. 


n n 2 rp cosh (tm/2p) 

+ s i n ( W7t /2)/[»*J> 2 cosh(/)7t/2a)] [16.7.185] 

a = c/a [16.7.186] 

P = c/b [16.7.187] 

where a, b and c are the length, width and height of the tank 
(m), respectively, E y is the field strength at the fraction of 
the tank height y (V/m), w is the fraction of the height filled 
with liquid, a and P are shape parameters, and y is the 
fraction of the tank height at which the field strength is 
measured. 

For the particular case of a tank whose height is small 
relative to its lateral dimensions, Vellenga obtains 


16.7.27 Liquid storage tanks 

Charge accumulation and relaxation are particularly 
important in relation to the filling of liquid storage tanks 
and of road and rail tankers. The storage tank problem has 
a number of different aspects: charge accumulation and 
relaxation; field strengths and potentials; and the genera¬ 
tion of sparks, particularly incendive sparks. Some of the 
work in this field has been associated with the fueling of 
aircraft. 

16.7.28 Klinkenberg and van der Minne model 

Klinkenberg and van der Minne (1958) have given a number 
of expressions for the electric field strength in storage 
tanks. For a full spherical tank, Equation 16.7.57 is applic¬ 
able and they also suggest its use for tanks that are 



16.7.30 Carruthers and Wigley model 

Carruthers and Wigley (1962) developed a model for the 
field strength and potential in a partially filled rectangular 
metal storage tank filled with uniformly charged liquid. 
They then extended this model to give the fields produced 
by a charge on the surface of the liquid and in the mist in the 
vapour space above it. 

The space charge density s is given by 



[16.7.189] 
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where I a is the current entering the tank (A), t is the time 
of filling (s) and F Tes is the volume of the liquid in 
the tank (m 3 ). 

For a point in the vapour space with the co-ordinate x, y, z 
as measured from the top of the tank, the approximate field 
strength in the z direction E z is 


Co7r 3 (lM + l/^)^ 

(cosh pd - 1) cosh Pzsin(nx/a) sin(n y/b) 
e, cosh pp sinh pd + sinh pp cosh pd 

[16.7.190] 




j 6=7 c 2 (? + f) [16j - 191] 

where a is the length of the tank (m), b is the width of the 
tank (m), d is the height of the liquid (m), p is the height of 
the vapour space (m), 6! is the dielectric constant of the 
liquid and e v is the dielectric constant of the vapour. 

The authors also derive the space charge densities and 
field strengths for any mist existing in the vapour space in 
the tank. They consider two cases: (1) a tank filled with mist 
and (2) a tank half filled with liquid and half with mist. In 
this treatment they assume a cubical tank of length a. For 
the first case the field strength is at a maximum at the 
centre of each wall and is 

£m f = [16.7.192a] 

E mf = 6.79 [16.7.192b] 

ee 0 n s 

where is the maximum field strength with the tank full 
of mist and is the space charge density with the tank full 
of mist. For the second case, from Equation 16.7.190 and 
setting d=p=a/ 2, the maximum field strength in the 
vapour space is 

E mh = 2.84^ [16.7.193] 


where E mh is the maximum field strength in the vapour 
space with the tank half full of liquid (V/m) and s mh 
is the space charge density with the tank half full of liquid 
(C/m 3 ). 

It can then be shown that in some circumstances a charged 
mist may produce a field strength of the same order as that 
of a charged liquid. Thus, assuming that in the first case 
all the liquid entering the tank in a time equal to the relaxa¬ 
tion time t forms a mist, the space charge density is 


while in the second case the space charge density is 


From Equations 16.7.192 and 16.7.194 for the first case and 
Equations 16.7.193 and 16.7.195 for the second, the maxi¬ 
mum field strengths are, respectively, 


**-*»«% t = x [16.7.196] 

and 


[16.7.197] 


16.7.31 Vellenga and Klinkenberg model 

As already mentioned, there is frequently an appreciable 
difference between the effective and rest conductivities 
of the liquid. One consequence of this is that during the 
relaxation of charge in a liquid following the filling 
of a tank, the relaxation time constant, given by 
Equation 16.7.27, is not in fact constant and the decay of the 
charge does not then follow the exponential decay given by 
Equation 16.7.78. 

Vellenga and Klinkenberg (1965) have derived an alter¬ 
native expression for charge decay based on the assump¬ 
tion that the conductivity of the liquid is proportional to the 
charge density. Considering a small element of volume V 
with space charge density s and hence a charge Fs, 
application of Gauss law, Equation 16.7.34, gives 

J D n dA = sV [16.7.198] 

where D n is the component of D normal to an element of 
surface cL4. The rate of loss of charge from cL4 is the current 
density/ n , and that from the whole element is the current 
density/. Then from Equations 16.7.26,16.7.27,16.7.97 and 
16.7.198 

i J D n 6A = - [16.7.199] 

Integrating Equation 16.7.199 gives 

^=-- [16.7.200] 


Taking the limiting case where all the ions of one sign are 
removed, as described in Section 16.7.12, and substituting 
from Equations 16.7.107 and 16.7.108 in Equation 16.7.200 


ds _ us 1 
df e a e 

Integrating Equation 16.7.201 yields 


[16.7.201] 


[16.7.202] 


where s a is the initial charge density and x a is the initial 
relaxation time. 

Equation 16.7.202 is a hyperbolic equation and the 
authors describe it as the hyperbolic law of relaxation. 
Another hyperbolic decay model is that of M.D. Foster 
(1967). A number of workers have reported decay of charge 
in tanks, which approximates more closely to the hyper¬ 
bolic than to the exponential law. 
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16.7.32 Kramer and Schon model 

H. Kramer and Schon (1975) have carried out a series of 
fundamental studies of the static electricity hazard in stor¬ 
age tanks, including the charging current entering the 
tank, the distribution of charge in the liquid, the field 
strength in the liquid and in the vapour space and the effect 
of bodies which distort this field, the incendivity of sparks 
produced and development of rules for tank filling. 

With regard to the charge distribution, the authors pos¬ 
tulate that the charge is not uniformly distributed within 
the liquid but is concentrated in a charge cloud. They esti¬ 
mate the volume of this charge cloud as 

F e = Qr [16.7.203] 

where Q is the volumetric flow of liquid (m 3 /s) and V e is the 
volume of the charge cloud (m 3 ), this volume being that at 
the surface of which the charge density has decayed to 1/e 
of its original value. This model is based on laminar flow. 
For turbulent flow the cloud would be somewhat larger. 

Kramer and Schon made measurements in a 15 m 3 
tank, near the fill pipe outlet and at the far end of the tank, 
of the relative field strength, or field strength divided by 
total charge in the tank, at different filling rates, and plot¬ 
ted the relative field strengths at these two points vs the 
volume of the charge cloud. Whereas the relative field 
strength at the fill pipe was virtually constant, that at the 
far side of the tank was constant at high charge cloud 
volumes hut fell off rapidly for charge cloud volumes below 
2 m 3 . The authors suggest that these results indicate that 
the effective charge cloud volume was some five times the 
nominal value given by Equation 16.7.203. 

A further detailed study of the space charge cloud is 
given by Schon and Masuda (1969) and Schon and Kramer 
(1971). 

H. Kramer and Schon (1975) then discuss the problem of 
field strength. They comment that the model of Carruthers 
and Wigley may not be applicable to large tanks containing 
high conductivity liquids. In any event, features such as the 
fill pipe distort the field, and this is crucial. 

They treat the fill pipe as a cylindrical object. For such a 
configuration the relation between the potential and the 
field strength is 

</> max = En In (r 2 /n) [16.7.204] 

where jq and r 2 are the radii of the inner and outer cylinders 
(m) and <j) m ax is the maximum potential in the center of the 
tank in the absence of the fill pipe (V).The inner cylinder is 
the radius of the fill pipe and the outer one may be equated 
with a suitable lateral dimension of the tank. 

They measured the field strength at the fill pipe in a large 
tank and a tank truck as 

E = 7.5 x 19 9 <? Large tank [16.7.205a] 

E = 30 x 10 9 # Tank truck compartment [16.7.205b] 

where q is the charge (C). 

Then from Equation 16.7.204 they obtained the max¬ 
imum potential (/> max as 

'/’max = 1-9 x 10 9 q Large tank [16.7.206a] 

'/’max = 5-0 x 10 9 <? Tank truck compartment [16.7.206b] 


The smaller tank therefore had the higher maximum 
potential. The authors state that the Carruthers and Wigley 
model gives the maximum potential as inversely propor¬ 
tional to the diagonal of the mid-height cross-sectional 
area, and that their results confirm this. 

They then consider the incendivity of discharges. For an 
incendive discharge there is a critical radius of curvature 
below which an incendive spark is unlikely. This radius 
is about 5 mm. For small radii of curvature above this value 

E c r = 35,000 5 x 10~ 3 < r < 12 x 10“ 3 [16.7.207] 

where E e is the field strength for the onset of incendive 
discharge (V/m) and r is the radius of curvature (m). For 
larger radii 

E = 3,000,000 z > 12 x 10 -3 [16.7.208] 

With a small probe the potential distribution in the vicinity 
of the probe is changed only locally. The undisturbed 
potential at the probe determines the field strength E at 
the surface of the probe according to the relation 

Er « 0 [16.7.209] 

Then from Equations 16.7.207—16.7.209 an incendive spark 
is unlikely as long as the maximum potential in the vapour 
space is kept below 35 kV 

Kramer and Schon consider two limiting cases: (1) a tank 
with a probe and (2) a tank with a fill pipe only. These two 
cases correspond, therefore, to fieldstrengthsfortheonsetof 
an incendive discharge of 35 kVand 3000 kV[ respectively. 

For the first case, from relations 16.7.207-16.7.209 and 
taking account of the empirical factor of 0.6 for the max¬ 
imum potential 

0-6 </> max < 35,000 [16.7.210] 

The streaming current entering the tank and the total 
charge in the tank are 

q = I 0 ee 0 / Ke [16.7.212] 

where d is the diameter of the fill pipe (m), I D is the charging 
current in the liquid entering the tank (A), s D is the charge 
density of that liquid (C/m 3 ), u is the liquid velocity (m/s) 
and K e is the effective conductivity of the liquid (S/m). Then 
from Equations 16.7.206 and 16.7.210—16.7.212 

--< 2.2 x 10 6 Large tank [16.7.213a] 

and 
S UCp 1 

— - < 0.83 x 10 6 Tank truck compartment 

[16.7.213b] 

For the second case 
E e « 3,000,000 


[16.7.214] 
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and assuming that the field strength at the fill pipe is 

E oc 1/d [16.7.215] 

Equations 16.7.205,16.7.211,16.7.212 and 16.7.214 yield 

< 1.2 x 10 8 Large tank [16.7.216a] 

s ° 1 ^ < 0.6 x 10 s Tank truck compartment[16.7.216b] 

The relationship between the effective conductivity and 
the rest conductivity proposed by the authors in this con- 


K e = K r / 2 [16.7.217] 

From these relations the authors give the limiting filling 
criteria shown in the table at the bottom of the page. 

Where, for a container of lateral dimensions a and b, L is 
the length of the diagonal, calculated fromL = ( a 2 + b 2 ) 112 . 

The relation for other tank sizes utilizes scaling based on 
the diagonal of the mid-height-cross-sectional area. These 
are limiting criteria that do not include a safety factor. The 
authors also quote the following German safety rule: 

u 2 d < 0.64 [16.7.218] 

For liquids with very low conductivities the treatment 
described may be too restrictive. The streaming current is 
likely to be lower and may not reach its steady-state value. 
The authors state that experimental evidence suggests that 
a limiting rest conductivity of 0.8 pS/m may be applied. 

This treatment is applicable only to conditions where 
there are no generators of unusually large amounts of 
charge, such as a liquid velocity above 7 m/s, water in the 
liquid or a filter in the inlet pipe. Also the treatment applies 
to tank sizes up to those of a tank car. For larger tanks the 
assumption of a uniform charge density breaks down, 
because the effective relaxation volume is small compared 
with the tank volume. 


and a probe. They concluded that the latter was the princi¬ 
pal hazard. 

These authors developed the concept that the approach 
of a grounded probe can cause a very high charge to build 
up on the liquid surface. A system composed of a liquid 
surface and a probe is a capacitor. Capacitance is inversely 
proportional to separation. Therefore as the probe approa¬ 
ches the liquid surface, or rather as the liquid surface dur¬ 
ing filling approaches the probe, with the charge initially 
being constant, the liquid surface potential at the point 
near the probe will drop according to Equation 16.7.6. The 
difference in liquid surface potentials thus created will 
cause the charge to move in order to equalize the potentials. 
They carried out experimental work and found that at 
lower flow rates there was little difference in potential 
between a point near the probe and one some distance away, 
so that there was a degree of charge concentration, but that 
at higher flow rates a potential difference developed and 
the charge concentration was less; they attributed this lat¬ 
ter condition to the increased turbulence. 

They found that the design of the fill pipe had a marked 
effect on its capacitance. The pipe capacitance decreased 
linearly with the separation between the pipe and the liquid 
surface up to a separation of 0.1 in. The lowest separation 
at which capacitances were measured was 0.02 in. but 
capacitance values were extrapolated back to a separation 
of 0.0025 in. The pipe design with the lowest capacitance 
at 0.0025 in. was one with a 45° slant end, with a capaci¬ 
tance of 140 pF. Other designs were, in ascending order of 
capacitance, an open pipe end, a T deflector and a cone 
deflector, the latter having the highest capacitance at 470 pF. 
The liquid surface potentials measured in this work were 
up to 10 kV. 

Mahley and Warren (1968) carried out an investigation in 
which the effect of the following parameters was studied: 
(1) fill tube design, (2) liquid velocity, (3) compartment 
height, (4) fill tube height, (5) liquid conductivity, (6) liquid 
wetness, (7) air bleed and (8) filter. 

They found that the design of the fill tube had a marked 
effect on the potential of the liquid surface. The lowest 
potential was obtained with the 45° slant end pipe. The 
ranking of the other devices was generally, in ascending 



Filling condition 


Projections permitted 

Tank truck 

Rail tank car 

Other tanks a 


u 2 d < 6.2 x 10 12 «r 
ud < 0.29 x 10 6 « r 

u 2 d < 12.4 x 10 12 re r 
ud < 0,47 x 10 6 K r 

ud< ==1,17 

Fill pipe only; outlet fully covered by liquid 
Projections of all kinds permitted 


a Where, for a container of lateral dimensions a ana b,L is the length of the diagonal, calculated from L = (a 2 + b 2 j k . 


16.7.33 Road and rail tankers 

As described in Section 16.7.2, a large proportion of the 
incidents attributed to ignition by static electricity have 
involved road tankers and rail tank cars. The work of 
H. Kramer and Schon (1975) on tanks in general and road and 
rail tankers in particular was described in S ection 16.7.32. 

An early study of the static ignition hazard in filling road 
tankers was made by Herzog, Ballard and Hartung (1961). 
They considered three paths for a discharge: (1) between 
two points on the liquid surface, (2) between the liquid 
surface and the tank wall and (3) between the liquid surface 


order of potential, an open pipe end, aTdeflector and a cone 
deflector. 

Drop heights of <2, 30 and 60 in. were used. The differ¬ 
ence in liquid surface potential between the first two drop 
heights was minimal, but use of a 60 in. drop height gave 
much higher potentials. 

The liquid surface potential increased with liquid velo¬ 
city, with water content and with the use of a filter. The 
increase in potential with liquid velocity was more than 
proportional and the magnitudes were much higher for fill 
tube designs other than the slant end one. The increase in 
potential when a filter was used was large. 
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The effect of liquid conductivity was somewhat 
complex. The conductivity range studied was 2.5-100 cu 
(pS/m). In this range, use of a conductivity additive caused 
the liquid surface potential to decrease with the resultant 
increases in liquid conductivity. But the results for 
undoped liquid did not show this regular variation. A liq¬ 
uid with 16 cu gave a higher potential than one with 2.5 cu. 

The effect of an air bleed, which might occur due to 
equipment malfunction upstream, was simulated using a 
nitrogen bleed, but this appeared to have a minimal effect 
on the liquid surface potential. 

The account of this work just given is necessarily sim¬ 
plified. There was considerable interaction between the 
different variables, with mutually enhancing or reducing 
effects. 

The liquid surface potentials measured in this work were 
up to almost 50 kVj the latter value being obtained-with a 
liquid conductivity of 16 cu, a liquid velocity of 30 ft/s, a fill 
tube with cone deflector and a drop height of 60 in. 

Tank truck loading has been studied by Ginsburgh and 
co-workers (L. Wright and Ginsburgh, 1963; Bulkley and 
Ginsburgh, 1968) with special reference to charge relaxa¬ 
tion and discharge incendivity. 

L.Wright and Ginsburgh (1963) investigated discharges. 
They present a model that shows that the controlling fea¬ 
tures of the discharge are the potential of the liquid surface 
and the geometry of the probe. They report experiments on 
discharges induced by applying power between a liquid 
surface and a probe, including a 3 in. diameter vertical 
pipe, a vertical plate and a horizontal plate. For the pipe the 
potentials for onset of a discharge were 25 kVat a separation 
of 0.5 in. and 50 kVat one of 1 in. When power was applied 
the liquid rose towards the probe, and for separations of 
less than 0.5 in. it touched the probe. 

Bulkley and Ginsburgh (1968) continued this work on 
discharges. The MIE normally quoted, say >0.25 mj for 
hydrocarbons, applies only to a spark gap of optimal shape 
and separation and to a near-stoichiometric mixture. They 
suggest that, in practice, the energy required to give an 
incendive spark is at least an order of magnitude greater. 

The spark between a liquid surface and a probe is quite 
different from that between two metal electrodes. Although 
concentrated at the probe, it branches over a relatively large 
part of the liquid surface. 

The authors state that most of the sparks obtained in the 
work of Wright and Ginsburgh did not possess enough 
energy to be incendive. For an incendive spark to occur the 
liquid surface potential must exceed 20 kV, which requires a 
charge density of 30 pC/m 3 . They propose that a charge 
density of 15 pC/m 3 , incorporating a safety factor of 2, be 
taken as the safety limit. 

Bulkley and Ginsburgh point out that over the years, oil 
products have become much purer so that their conductivity 
is much less, with corresponding increases in relaxation 
times from seconds to minutes. One consequence of this is 
that the residence time of typically 30 s in tanks, provided to 
allow relaxation, is no longer adequate. 

16.7.34 Strawson and Lyle model 

Strawson and Lyle (Lyle and Strawson, 1971, 1972, 1973; 
Strawson and Lyle 1975a,b) have reported an extensive 
program of work by Shell on the safe loading of road and 
rail tankers. 

Lyle and Strawson (1971) conducted experiments in 
which they studied discharges between a charged liquid 


surface and a fill pipe when a tank is filled with 
charged fuel. The fuel was gas oil with a conductivity of 
2-7 pS/m. The locus of the liquid inlet charge density 
limit curve for onset of discharge ranged from an inlet 
liquid charge density of about 200 pC/m 3 at low liquid 
inlet velocities down to less than 20 pC/m 3 at high velo¬ 
cities. The discharge energies were determined to be about 
0.005 mj. 

A separate experiment was conducted to determine the 
energy in an incendive discharge between a liquid surface 
and a probe. The liquid used was kerosene with a pro¬ 
pane-air mixture in the vapour space around the probe. 
Liquid entering the tank was given a high charge by pas¬ 
sing it through a filter. The energy required to achieve 
ignition was 4.7 mj. This compares with the normal MIE 
of 0.2 mj. 

In an extension of this work, Strawson and Lyle (1975b) 
performed experiments in three metal tanks of 1.2, 2.3 and 
5 m 3 volume and with overhead and bottom filling pipes. 
They investigated the conditions for discharge between the 
liquid surface and the fill pipe or a gauge marker. They 
developed a model for the discharge conditions. In addition 
to determining the locus of the liquid inlet charge density 
limit curve for the onset of discharge as a function of liquid 
inlet velocity for a fixed tank length, they also obtained 
both experimentally and theoretically the locus of that 
curve as a function of tank length for a fixed liquid inlet 
velocity. The locus passed through a minimum for a tank 
length of about 2 m. For this tank length the authors 
determined the limiting liquid inlet charge density as 
20 pC/m 3 . 

The authors state that no sparks were obtained with 
liquids with conductivities greater than 4 pS/m. 

Strawson and Lyle went on to consider the parameters 
that might be taken as the basis of safety, the field strength 
and the potential. In particular they discuss the criterion of 
field strength at the filling tube used by Kramer and Schb’n 
(Schon and Kramer, 1971; H. Kramer and Schon, 1975).This 
model is based on a charge distribution in the liquid around 
the fill pipe. They argue that the charge distribution is more 
likely to be relatively uniform. At the high filling rates, 
which are of prime interest, turbulence will tend to equalize 
the charge density. Moreover, Kramer and Schon have 
shown that for a low conductivity liquid the charge density 
is uniform even in large tanks. 

The alternative is to use the potential of the liquid sur¬ 
face. Strawson and Lyle conclude that this is the better cri¬ 
terion. They assume that the charge is uniformly 
distributed and define the relevant potential as that exist¬ 
ing in the absence of any protrusion. Various limiting 
values of this potential have been proposed. Mahley and 
Warren (1968) have proposed 1 kV, based apparently on the 
work of Herzog, Ballard and Hartung (1961), but the 
authors regard this as too low. They refer to the value given 
by Kramer and Schon of 35 kV They state that in their own 
work the minimum potential for incendive discharge was 
45 kV, and propose this as the limit value. 

A model was developed for the potential of the liquid 
surface that gives 


0 c xs t f (tank dimension, liquid depth) [16.7.219] 


where s t is the space charge density in the liquid in the tank 
(C/m 3 ) and 0 is the potential of the liquid surface (V). 
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The charge density in the tank is in turn related to that in 
the liquid entering the tank according to the relation 

st= $S [l ~ expMA)] [l67 ' 220] 

where Q is the volumetric flow of the liquid entering the 
tank (m 3 /s), s a is the space charge density of the liquid 
entering the tank (C/m 3 ), and 7 ves is the volume of liquid in 
the tank (m 3 ). 

From Equations 16.7.219 and 16.7.220, the authors derive 
their guideline for safe filling conditions: 


ud < 


[™m\ 


V2 


[16.7.221] 


where d is the fill pipe diameter (m), L is the length of the 
tank (m), s 0 is the inlet charge density (pC/m 3 ), u is the 
liquid inlet velocity (m/s), k is the liquid conductivity 
(pS/m) and k is a constant. 

In subsequent work, Strawson and Lyle (1975a) obtained 
limiting values of the group s 0 /ku. Their results are shown 
inFigure 16.57, which gives the following limits: 


sJku 

(pC/s(pSm 3 ) 3 ) 

<1.8 

Tests at filling stations 

<3.3 

Experiments 

<12.5 

Experiments with 


partially blocked filter 


Also shown in Figure 16.57 are the limit lines given by the 
model of Schon (1962a) for charge generation in a pipe, 
which are a function of the residence time in the pipe, and 
hence of the pipe length. From this work Strawson and Lyle 
propose a limiting value for the group s 0 /ku of 12.5. 

Using this limit value in Equation 16.7.221 together with 
appropriate values of kf(L), the authors obtain the follow¬ 
ing guidelines for safe filling: 


Filling mode 



Tank length 



<2 

m 

>2 

m 


km 

ud 

kf(L) 

ud 

Top filling 

3.1 

<0.50 

3.1(L/2)V* 

0.50 (L/2) 1 - 4 

Bottom filling 

1.6 

<0.36 

1.6 (Lj2) k 

0.36 (L/2) 1 ^ 2 


The criteria for bottom filling allow for a central protrusion 
from the roof. In addition, a further overall limit is imposed 
to limit the field created by the jet: 

ud < 0.77 [16.7.222] 

This treatment contains a number of assumptions, which 
are therefore the conditions for its applicability. Three of 
these are: that the charge distribution in the liquid is 


• Measured at filling installations 
A Measured at filling system at Thornton 
o Measured at Thornton when the screen filter 
was partially blocked 


-Values predicted by Schon relationship 



Conductivity (pS/m) 


Figure 16.57 Charge generated at filling stations 
(Strawson and Lyle, 1975a) (Courtesy of the Institution of 
Electrical Engineers) 

uniform; that the charge generation due to splashing can be 
neglected; and that any charge density transient at start-up 
can be neglected. The authors regard these criteria as being 
confirmed experimentally. With regard to the conductivity 
of the liquid, it is assumed that the ratio of the effective to 
the rest conductivity is the same as in the experiments and 
that the inlet liquid charge density is proportional to the 
liquid conductivity. Further restrictions are the absence of 
high charge generation conditions, specifically water in the 
liquid or a filter in the pipe, and absence of insulated con¬ 
ductors in the system or tank. 

16.7.35 Kramer and Schon model 

The work of Kramer and Schon on the filling of tanks in 
general and of road and rail tankers in particular, was 
described in Section 16.7.32. This work provides another set 
of guidelines for tanker filling. 

16.7.36 Rees model 

Another extensive program of work on the safe loading of 
road and rail tankers is that carried out by BP, as described 
by W.D. Rees (1981). Rees describes experimental work on 
discharges between a charged liquid surface and a metal 
probe. In this work it proved relatively easy to obtain dis¬ 
charges, which would ignite a propane-air mixture with 
negatively charged liquids at liquid surface potentials as 
low as 25 kV, but ignition did not occur with positively 
charged liquids even at potentials as high as 80 kV. It was 
found that a charge transfer in the discharge of at least 
75 nC was required for ignition. The shape and dimensions 
of the probe affected ignition.The shape most favourable to 
ignition was a sphere, then a hemisphere and then a rod. 















16/114 FIRE 


Using a 28 mm sphere with the most ignitable propane-air 
mixture the probability of ignition was close to unity, pro¬ 
vided the charge transfer exceeded 75 nC. 

Rees summarizes the principal guidelines for safe filling 
as follows. The criterion of the Physikalische Technische 
Bundesanstalt (PTB) is 

ud < 0.38 [16.7.223] 

The Shell criteria are 

ud < 0.50 [16.7.224] 

s 0 /ku < 12.5(pC s(pS m 3 ) -1 ) [16.7.225] 

The criterion given by Equation 16.7.224 is criticized inso¬ 
far as the work described on incendive discharges has 
shown that critical values of the group sJku can be less 
than 12.5. The critical values depend on the pipe diameter, 
the liquid conductivity and the liquid inlet velocity; values 
down to 2.4 are quoted. 

Rees refers to four incidents that have occurred in 
Canada with a loading limit ud < 0.5, and two in Germany 
with a loading limit ud < 0.37. 

Rees states the BP view that it is not possible to deter¬ 
mine a loading velocity that is completely safe, but that it 
can be said that reducing the velocity reduces the risk. The 
PTB guideline is preferred and, in order to avoid prolifera¬ 
tion of guidelines, is the one adopted. 

However, he also puts forward for discussion the follow¬ 
ing proposals for loading limits: 


Liquid 

Loading 

conductivity (pS/m) 

rate, ud 

«>10 

<35001/min 

5 < re < 10 

<0.5 

re<5 

<0.38 

16.7.37 Oil and chemical tankers 


As described in Section 16.7.2, sc 

)me of the most serious 

incidents attributed to ignition by static electricity have 


involved oil tankers. An early study of the problem is that of 
Bustin (1963). Following the Esso Paterson explosion in 
1956 the company adopted a set of safety rules to reduce the 
static ignition hazard. The investigation described was to 
assess the effectiveness of these safety rules. 

Bustin considers the following conditions: (1) loading 
of product, (2) steam cleaning, (3) water washing, and 
(4) ventilation. 

He describes an extensive series of tests on the loading of 
tankers. Charge densities of up to 0.2 pC/m 3 , liquid surface 
potentials of 10 kV and field strengths of 4 kV/m were cal¬ 
culated from these tests. The author states that while at 
these potentials discharge would not occur to normal tank 
internals, it might well to a pointed probe. He therefore lays 
emphasis on ensuring that there are no grounded probes or 
insulated conductors. 

The cleaning of tanks using steam has been associated 
with a number of explosions. Tests by BP some years pre¬ 
viously showed that if the steam-cleaning machine was not 


grounded, or lost its ground connection, a high potential 
could build up on it and, in the event of a discharge, the 
spark was likely to incendive. Isolated conductors in par¬ 
ticular are a hazard in this respect. With regard to the 
steam cloud itself, faint discharges were detected. The 
highest field strength determined was 60,000 V/m, which 
indicates that a volume of steam equivalent to a sphere 
some 1.25 m diameter would need to discharge to give an 
incendiary spark. The author states that steam cleaning is 
to be avoided; in fact it is frequently banned. The main 
method of cleaning tanks is water washing. The author 
regards this as safe. 

Rapid ventilation may be used for gas freeing. But there 
was concern that charge generation could occur due to the 
presence of rust particles or fuel droplets in the air. Tests 
were performed in which the conditions in a ventilation 
pipe were measured. At 510 cfm of air, an air velocity of 
170 ft/s and a dust loading of 0.016 lb/ft 3 the charging cur¬ 
rent was 5 x 10 “ 6 A and the calculated field strength at the 
pipe wall was 50 kV/m. This was considered close to the 
region where discharges might occur, though not necessa¬ 
rily incendive ones. In fact even abnormally high dust 
loadings did not lead to ignition unless an insulated con¬ 
ductor was present. 

Bustin states that neither water washing nor ventilation 
necessarily ensure the elimination of a flammable mixture. 

Following the three tanker explosions in 1969, a major 
program of work was undertaken by Shell. Some of the 
results were described in a set of papers by van der Meer 
(1971), van der Weerd (1971), Smit (1971) and Vos (1971). 

The work described by van de Weerd (1971) was con¬ 
cerned with water washing. A typical washing machine 
operates at 10 bar giving 180 m 3 /h of water with a jet velo¬ 
city of 40 m/s. The jet diameter is 4 cm at the nozzle 
increasing to 1-3 m at the wall. Quite large amounts of 
air are entrained. The mist formed has a density of about 
1 g/m 3 . Mist formed by impact at the wall is charged. 

The factors studied were (1) number and type of washing 
devices, (2) jet velocity, (3) water temperature, (4) type of 
water, (5) impurities, (6) wall conditions and (7) tank size. It 
was found that the number of water guns had relatively lit¬ 
tle effect. The type of water, the water temperature and 
impurities in the water and presence of crude oil or sludge 
on the wall affected the sign and magnitude of the charge, 
but in an unpredictable way. 

In a series of tests on water washing of tanks a typical 
value obtained for the charge density of the mist was 
3 x 1(T 8 C/m 3 . For a 12 m-radius tank in the absence of a 
protrusion this translates using Equation 16.7.57 to a field 
strength of 13.5 V/m. The field strength at a probe com¬ 
prising a 2.5 cm cylinder was calculated to be 600 kV/m. 
The maximum field strength measured was 400 kV/m and 
the maximum space potential was estimated as 40 kV. 

Experiments were conducted to investigate discharges 
and their incendivity. Tests are described in which a 28 mm 
hemispherical probe was inserted into a steam mist with a 
maximum space potential of 36 kV and a field strength of 
330 kV/m. Discharges were obtained and were measured as 
groups of pulses. The discharges were of relatively long 
duration, some tens of milliseconds, which contrasts with a 
duration for metal to metal discharges of about 10 ~ 7 s. The 
energy dissipation in the first millisecond at this potential 
was some 0.04 mj. The author comments that such energy 
dissipation may be a better measure of incendivity than 
energy accumulation. 
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The charging of insulated conductors inside a tank was 
also studied. The charging mechanisms include charge 
induction, charge transfer from mist droplets, and corona 
charging. It was found that with a space potential of 30 kV 
a cord lowered by a man standing insulated on the deck 
charged up to about half the space potential within seconds 
once his resistance to ground exceeded 10 lo Q. A man wear¬ 
ing normal footwear on a well-painted deck would have a 
resistance to ground in excess of this. 

In another study a 13 mm diameter rod was dropped 
through a mist with a maximum space potential of 37 kV 
and the rod acquired a charge of some 2 x 10 “ 7 C. Labora¬ 
tory tests showed that such an object could have given an 
incendive spark. 

Smit (1971) describes models for potential distribution 
developed in support of this work, and Vos (1971) describes 
work on the generation of a charged mist by an impacting 
jet, as already described. 

J.F. Hughes et al. (1973) give an account of related work on 
water mists. One study dealt with periodic discharges at a 
probe that were found to be associated with the departure 
of a water droplet from the probe. These were corona 
discharges and were not incendive to a propane-air mix¬ 
ture. Another phenomenon investigated was a slug of water 
falling through the cloud. Slugs of water were made to fall 
on a trajectory spaced 0.1-0.4 cm from a grounded probe. 
The discharges obtained were incendive. 

A number of mechanisms for incendive discharges in 
water washing were investigated by van de Weerd (1975), in 
particular discharges from a falling water slug. Washing 
machines can give water slugs some 4 cm diameter by 50 cm 
long. The maximum space potential during tank washing is 
at least 30 kV.Work was done to determine the fraction of 
the energy of the charge induced on the slug, which partici¬ 
pates in the discharge when the slug approaches aprotrusion 
on the tank, and this fraction was estimated as 0.2-0.4. 
Taking a figure of 0.2 gives a discharge energy of 1.5 mj. This 
compares with a minimum ignition energy of some 0.5 mj 
for a hydrocarbon-air mixture in this situation, van de 
Weerd concludes that such discharges are incendive. 

H.R. Edwards (1983) addresses the rather different mat¬ 
ter of chemical tankers. The background was a proposal to 
extend to chemical tankers the Safety of life at Sea (SOLAS) 
regulations which are applicable to oil tankers. There is a 
problem with this in that inerting by combustion products 
is not acceptable for chemicals, while the use of nitrogen is 
expensive. 

He describes trials on five chemical tankers in respect of 
loading, steam cleaning and water washing. It was found 
that the liquid electrical conductivities were relatively 
high, being in the range 20-80 pS/m. These are the con¬ 
ductivities of the industrial chemicals as loaded. For 
example, Analar quality benzene has a conductivity of 
0.8 pS/m, but the conductivity for benzene loaded in the 
trials was 40 pS/m. The highest value measured for 
the liquid surface potential was 3.4 kV for benzene. The 
Carruthers and Wigley model was used to confirm that 
the liquid surface potential would not give rise to incendive 
sparks. 

In steam cleaning tests the maximum space potential 
in the steam mist in smaller tanks of 300 m 3 was about 4 kV, 
but tanks above 1000 m 3 gave potentials above 10 kV the 
maximum recorded value being 18 kV. 

Edwards details the procedures used in water washing. 
He gives data on the maximum space potentials in the water 


mist. Except for esters, the maximum space potential was 
7.9 kV For esters it exceeded 10 kV in several cases, the 
highest value being 11.7 kV for ethyl acetate. As already 
described, some of the space potentials given by Edwards 
are based on his model. He refers to 10 kV as the safety cri¬ 
terion. He lists a number of factors that suggest that, in 
practice, there is a safety margin. One is the safety margin 
in the 10 kVcriterion itself. Another is the fact that chemical 
tankers use smaller washing machines, which tend to give 
smaller water slugs. He suggests that for these the hazard 
threshold is closer to 15 kV. Another factor is that the max¬ 
imum space potential is near the centre of the vapour space, 
which is not the location of protrusions. 

The problem of a falling water slug has been investigated 
further by M.R.O. Jones and Bond (1984,1985), in the con¬ 
text of chemical tankers. The situation envisaged is a slug 
falling from the jet of the washing machine and approach¬ 
ing a grounded wall. The authors refer to work by Bustin 
(1973-74) on the size of water slugs from washing machine 
jets. They state that the hazardous conditions are often 
taken to be a space potential of at least 10 kV near the 
washgun and a slug of at least 0.5 m, but that there is no 
firm foundation for this. 

Jones and Bond refer to the empirical finding of van der 
Weerd that the effective ignition energy required for a 
discharge between a water slug and a metal conductor is 
about twice that for a metal-to-metal discharge. They 
describe a model for the limiting hazardous conditions in 
terms of the tank centre space potential (TCSP) and the 
slug length. They compare their model with data given by 
H.R. Edwards (1983) on space potential in chemical tan¬ 
kers, described below. The crude data need to be converted 
to give the TCSP using a suitable model. In their initial 
work Jones and Bond accept Edwards’ model for the calcu¬ 
lation of the TCSP, but in the second paper replace this with 
their own model. The highest TCSP in the test data set is 
calculated to be some 20 kV The initial treatment revealed 
no case in which the safety margin between the observed 
potential and the hazard threshold value was exceeded, but 
in some cases the difference was small, whereas in the 
revised treatment it is considerably larger. 

Jones and Bond give a number of recommendations for 
the conduct of water washing of tanks, including limits on 
the number of washing machines and the water supply 
pressure. 

J.S. Mills and Haighton (1983) have studied the charging 
of tanks by the flue gas used for inerting. The charge is 
generated in the boiler and carried by soot particles. 
Charge dissipation occurs by drift of soot particles to the 
walls and by corona discharge. The purpose of the work 
was to determine whether incendive discharges could be 
produced and to study the decay of the charge. Tests were 
done in which discharges from a charged cloud to a projec¬ 
tion were simulated by discharges from an electrode. An 
electrode with a 25 mm diameter tip gave ignition most 
easily. The lowest space potential at which this electrode 
would give ignition was estimated as 70 kV. In subsequent 
shipboard trials the maximum space potential obtained 
was about 55 kV. The time for decay to 10 kV was about 5.5 h. 
It was concluded that the maximum space potentials were not 
such as to give incendive brush discharges, but that spark 
discharges from isolated conductors were a possibility and 
more stringent measures should be taken to exclude these. 

J.S. Mills and Oldham (1983) review the hazard of static 
ignition in tankers. They quote the potentials required to 
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give an incendive brush discharge as 45 kV for a liquid 
surface potential and 70 kV for the space potential of a mist, 
both these potentials being negative. They refer to work 
that has shown mist space positive potentials of 40 kV in 
open cycle washing and 120 kV in closed cycle washing. 
These authors also discuss the static hazards of the use of 
glass reinforced plastic (GRP) pipes in tankers. 

16.7.38 Discharges incendive in gas and liquid systems 

As far as concerns ignition by an electrostatic discharge, 
what matters is the incendivity of the discharge. Non- 
incendive discharges can in some cases be helpful in dis¬ 
sipating charge that might otherwise participate in an 
incendive discharge. For a discharge to be incendive, a 
minimum voltage and a minimum energy are required. It is 
usually reckoned that for a spark discharge from a con¬ 
ducting object into a flammable mixture the minimum vol¬ 
tage is 1000 V, or lkV 

As far as the energy of the discharge is concerned, the 
incendivity of the discharge is generally assessed by com¬ 
paring the energy of the discharge with the MIE of the 
flammable mixture. For a flammable gas or vapour mixture 
this is the MIE of the gas. For hydrocarbons the figure most 
often quoted is that for a propane-air mixture which is 
given as 0.2 mj. The figure appears to derive in the first 
instance from Lewis and von Elbe. This MIE is that mea¬ 
sured for a spark discharge at metal electrodes. It is effec¬ 
tively a minimum figure. 

Certain substances have a lower MIE. Hydrogen and 
carbon disulfide are the gases generally mentioned in this 
context. The MIE of carbon disulfide is 0.009 mj and that of 
hydrogen is about 0.011 mj. Substances with such low MIEs 
are therefore treated as sensitive substances. 

In order to assess the incendivity of a discharge, there¬ 
fore, it is necessary to know any minimum potential 
required, the energy of the discharge and the efficiency of 
that energy in effecting ignition relative to the energy in the 
spark discharge between the metal electrodes used in the 
measurement of MIEs. For a spark discharge various 
values are given for the minimum potential, but these 
often incorporate a safety factor. One commonly quoted 
value of this kind is 100 V Britton and Smith (1988) give a 
value of 1000 V, or 1 kV, which they relate to the minimum 
gap required to avoid quenching. 

The energy in a spark discharge depends on the poten¬ 
tial and on the capacitance of the conductor. The energy is 
therefore variable, but there are many situations that will 
give an incendive spark discharge. For a brush discharge a 
minimum potential is not usually quoted, but may be 
obtained from field breakdown considerations. 

With regard to the energy of a brush discharge use is 
made of the equivalent energy as proposed by N. Gibson 
and Lloyd (1965). If a flammable gas has a given MIE and 
a brush discharge is just able to ignite the appropriate 
mixture for that gas, the discharge is said to have an 
equivalent energy equal to the MIE value. Glor quotes 
values of the equivalent energy of brush discharges in the 
range 1-3.6 mj and gives a theoretical treatment for a par¬ 
ticular configuration that gives an actual energy of 4 mj. 

A brush discharge is incendive to most flammable gases. 
A series of studies on brush discharges has been made by 
Heidelberg (1959,1967,1970a). 

For a propagating brush discharge there is a minimum 
voltage across the non-conducting layer for breakdown to 
occur. This is shown in Figure 16.58 (Maurer et al., 1987). For 



Figure 16.58 Voltage across dielectric layers for gen¬ 
erating a propagating brush discharge: (•) Propagating 
brush discharges; (O) no propagating brush discharges; 
(+) breakdown voltage (Maurer et al., 1987) (Courtesy of 
the Institute of Physics) 


layers of about 10 pm the minimum voltage is 4 kV, this 
value rising to 8 kV for layers of about 200 pm. 

Other conditions governing propagating brush dis¬ 
charges have been determined by Heidelberg (1967,1970a), 
who found that such discharges occur only if the surface 
charge density exceeds 2.7 x KT 4 C/m 2 andthattheydonot 
occur if the non-conducting layer is more than 8 mm thick. 

The energy in a propagating brush discharge is very 
high. It depends essentially on the participating area and 
the surface charge density. The high energies in propagat¬ 
ing discharges may be explained as follows. As explained 
in Section 16.7.5, the normal maximum surface charge 
density, given that the permittivity of free space is 
e 0 = 8.85 x 10~ 12 F/m, the dielectric strength of air is e = 1 
and the breakdown field strength of air is E b = 3 x 10 6 V/m, 
is given by Equation 16.7.22 as 2.64 x 10 -5 C/m 2 . For a 
configuration capable of giving a propagating brush dis¬ 
charge the relevant quantity to replace the breakdown field 
strength % is the dielectric strength. Then for a typical non¬ 
conducting material of dielectric strength 2.7 x 10 7 V/m 
and dielectric constant 2-4, the maximum surface charge 
density becomes 5 x 1CT 4 C/m 2 . This is nearly 20 times the 
previous figure. A propagating brush discharge is incend¬ 
ive to most flammable gases. 

The energy in the four main types of discharge and their 
incendivity to gases and dusts is illustrated in Figure 16.59 
(Glor, 1988). 

As described in Sections 16.7.27-16.7.39, investigations 
of liquid storage tanks, road and rail tankers and oil and 
chemical tankers have often included studies of the incen¬ 
divity of discharges in these systems. In addition, there has 
been some work specifically directed to this topic. 

In the context of aircraft fuelling, Bruinzeel (1963) car¬ 
ried out experiments on discharges during the filling of a 
liquid storage tank with kerosene. The tank was 4 x 1 x 
0.75 m divided into four compartments. Discharges were 
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Figure 16.59 Energy of five types of electrostatic dis¬ 
charge (Glor, 1988) (Courtesy of Research Studies Press) 


observed between the liquid surface and the fill pipe before 
its submersion, between the liquid surface and the roof 
even at a low liquid level, and between the liquid surface 
and a probe. The discharges occurred most frequently 
during filling when the liquid level was below one-quarter 
to one-third full and after it was three-quarters full. The 
liquid charge when discharges occurred was, with few 
exceptions, negative. 

As found by other workers also, discharges occurred at 
average field strengths of the order of 400-500 kV/m, 
although the local field strength at some point must have 
reached 3000 kV/m. The author quotes, however, the view 
of Heidelberg and Schb’n that hazardous discharges might 
occur at an average field strength as low as 100 kV/m. 

Typical results were for a liquid with a conductivity of 
3-4 pS/m, a discharge gap of 0.2 m, a charging current of 
12-18 pA and a liquid surface potential of 100 kV a dis¬ 
charge energy of 160-500 mj with more than half being 
transferred within 0.2-0.3 ps. It was estimated that the 
charge in the tank was typically 12-18 pC and that in the 
discharge 1-5 pC.The ignition of a flammable gas mixture 
was demonstrated. 

Leonard and Carhart (1967) carried out work on dis¬ 
charges between the liquid surface of JP4 andJP5 fuels and 
electrodes of different configurations. These were a needle, 
a 60° point and V4, V2 and 1 in. sphere electrodes. The char¬ 
acteristics of the discharges between these electrodes and 
a metal plate were also studied. 

The needle and 60° point electrodes gave mainly corona 
discharges, but the latter also gave spark discharges. 
The 60° point and small spherical electrodes gave spark 


discharges at small gaps, but otherwise gave corona dis¬ 
charges. The large spherical electrodes gave pre-break¬ 
down streamers, which never made the transition to 
filamentary sparks. These streamers occurred at a fre¬ 
quency of about 100/min and had a duration some 7 times 
longer than that of filamentary sparks of the same energy. 

It was found that for comparable conditions with the lin. 
spherical electrode the discharges between the electrode 
and the metal plate had 30-40 times as much energy as 
those between the electrode and the liquid surface. For the 
latter case the highest energies, up to 2.3 mj, were obtained 
with the lin. electrode. The discharges studied were not 
incendiveto JP4. 

Summarizing the work on incendive discharges in liquid 
storage tanks and in road and rail tankers, the principal 
conditions for which there have been proposed limiting 
values below which discharges are not incendive are the 
liquid surface charge and the maximum vapour space 
potential. For these conditions the value quoted may be 
either the technical limit at which the discharge is just 
incendive, or a safety limit that is intended to incorporate a 
safety margin. Bulkley and Ginsburgh (1968) proposed for 
the technical limit 20 kV and for the safety limit 10 kV. A 
much lower figure of IkV was suggested for the latter limit 
by Mahley and Warren (1968). Subsequent workers have 
regarded this as too low. The technical limit has been pro¬ 
posed as 45 kV by Strawson and Lyle (1975b) and as 25 kV 
by W.D. Rees (1981). H. Kramer and Schon (1975) have 
proposed 35 kV as the technical limit on the maximum 
vapour space potential. 

As far as concerns tanker water washing, a technical 
limit for the maximum vapor space potential of below 37 kV 
emerges from the work of van de Weerd (1971), while one of 
70 kV has been given by J.S. Mills and Oldham (1983). The 
safety limit on the maximum vapour space potential is 
taken as 10 kV by H.R. Edwards (1983) and by M.R.O. Jones 
and Bond (1984,1985). 

16.7.39 Powders and dusts 

The problem of ignition by static electricity in powder 
handling has some similarities with that in handling 
liquids, but there are also some important differences. 

The powder may be handled as a dust suspension or a 
settled powder, and often as both. 

The charging tendency of a powder is difficult to predict, 
but it tends to be high. It is also difficult to modify. Options 
that can be used with liquids may not be available. There is 
limited scope for reducing the velocity in pneumatic con¬ 
veying. There is also limited scope for dosing with an 
additive to increase conductivity. 

In the settled state particularly, a powder has a high bulk 
density and its volume charge density tends to be corre¬ 
spondingly high. 

Prediction of the charging tendency is made difficult by 
a number of factors, including the particle diameter and 
size distribution, impurities, the water content, and the 
speed of separation. 

The extent of charging of a powder depends on its 
volume resistivity. Charging is to be expected at a resistiv¬ 
ity of 10 8 Q m and above. The resistivity of most organic 
powders exceeds this value. 

Some data on the electrical volume resistivity of powders 
are given in Table 16.37. Figure 16.60 (N. Gibson, 1971) 
show the distribution of the resistivities of organic powder 
products. 
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Table 16.37 Electrical volume and surface resistivity of selected solid materials 

A Volume and surface resistivity 2 


Volume resistivity b (Q m) 

Surface resistivitf (Q) 

Plastics, overall range 

10 6 -10 15 

10 8 -10 17 

PVC, unplasticized 

10 12 -10 13 

10 13 -10 14 

PVC, plasticized 

10 9 -10 12 

10 lo -10 13 

Polyethylene, high density 

10 14 

10 14 -10 15 

Polyethylene, low density 

10 15 

10 14 -10 15 

Polypropylene 

10 15 

10 14 -10 1B 

B Surface resistivity of glass: effect of relative humidity 3 

Relative humidity (%) 

Relative surface resistivity 


100 

1 


80 

4 


70 

30 


60 

800 


50 

30,000 


40 

6,000,000 



a Source: Liittgens and Glor (1989). 
b Manufacturer’s specification. 

'Literature values. 

d Source: WF. Cooper (1953b), quoting Smail, Brooksbank and Thornton (1931). 



Figure 16.60 Electrical volume resistivity of powders 
(N. Gibson, 1979) (Courtesy of Filtration and Separation) 


Given that the resistivity of the powder is sufficiently 
high for it to exhibit charging, the charging tendency 
depends more on the operations to which the powder is 
subjected than on the powder properties. Operations in 
which charging occurs include micronizing, grinding, 
sieving, gas filtration, pneumatic conveying and mechan¬ 
ical transfer. 

The electrostatic charges generated in powders by these 
operations are typically as follows (N. Gibson, 1969): 


Charge ( C/lb) 

Micronizing 

10“ 7 -10“ 3 

Grinding 

«r 7 -ur 6 

Scroll feed transfer 

10“ 8 -10“ 6 

Pouring 

io~ 9 -io - 7 

Sieving 

10- u -10“ 9 


The charge per particle increases, but less than proportio¬ 
nately, with increasing particle diameter. Thus the charge 
per unit mass must decrease. This is in line with the data 
just given. 

The charge density on a powder is commonly expressed 
either as the volume charge density or the mass charge 
density. The relation between the two is 

q m y [16.7.226] 

where q is the charge on a particle (C), m is the mass of the 
particle (kg), s is the volume charge density (C/m 3 ) and p e is 
the effective density (kg/m 3 air). The ratio q/m is also the 
mass charge density of the powder (C/kg). The effective 
density is that of the dust cloud or settled powder, as 
the case may be, and in the latter case it is the bulk density. 
The charge on a particle is then 

q = n<fo [16.7.227] 

and the mass is 

m = *4p s [16.7.228] 

where d A is the particle diameter (m) and p s is the density of 
the particle (kg/m 3 ). Hence from Equations 16.7.227 and 
16.7.228 



The maximum charge on the particle in free space is 
determined by the maximum surface charge density. 

As an illustration, consider a powder with a material 
density of 1000 kg/m 3 and a limiting surface charge den¬ 
sity in free space of 2.7 x 10 -5 C/m 2 . Then for particle 
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diameters of 10 -2 and 1CT 6 m Equation 16.7.229 gives 
mass charge densities of 1.6 x 1(T 5 and 2 x 10 -1 C/kg, 
respectively. 

Dust may be in suspension or deposited. There is very 
little information on the occurrence of discharge between 
particles in suspension, but it cannot be ruled out. With a 
deposited dust there is a relaxation of the charge similar to 
that in a liquid. If the dust has a high resistivity, the ~ 
relaxation time may be hours or even days. Discharges from J? 

deposited dusts are often coronas. U 

In much equipment handling dusts a flammable atmo- o 
sphere does not exist during normal operation, because the 5 
dust suspension is above its upper flammability limit. But « 
a flammable suspension is more likely to occur during <S 
transient conditions such as start-up and shut-down. Jjj 

The principal hazard in dust-handling equipment is that g> 
presented by a container or other object made of conducting j? 

material but insulated from ground. There are certain fac- O 
tors that tend to reduce the probability of electrostatic 
ignition in equipment handling dust suspensions. One is 
that the dust suspensions tend to have high MIEs. A second 
is that discharge is frequently by a corona. The hazard of 
static electricity in dusts is discussed by K.N. Palmer 
(1973a). 


16.7.40 Powder flow in pipes 

The charging current for the flow of particles in a pipe, in 
other words in pneumatic conveying, has not been studied 
as extensively as that for liquids. The most common 
approach appears to be to estimate the maximum theore¬ 
tical charge on the particles and to express the experi¬ 
mental results in terms of the fraction of this maximum 
charge attained. 

The maximum charge on a particle in flow in a pipe dif¬ 
fers from the maximum charge in free space. The maximum 
space charge density is obtained from Equation 16.7.61 and 
is inserted in Equation 16.7.229 to give the maximum 
charge on a particle q/m, or mass charge density. 

As an illustration, consider the example given by 
J.F. Hughes and Bright (1979) for which the pipe radius is 
0.05 m and the particle density is 0.95 x 10 3 kg/m 3 . Then, 
utilizing the usual values for the permittivity of air and the 
breakdown field strength, Equation 16.7.61 gives a space 
charge density of about 1.06 C/m 3 and Equation 16.7.229 
gives a mass charge density of about 1.12 x 10 -6 C/kg. 
Furthermore, by equating the mass charge density q/m in 
Equations 16.7.226 and 16.7.229, and utilizing Equations 
16.7.22 and 16.7.61, the condition for the equality of the 
maximum mass charge densities in free space and in a pipe 
is obtained: 



Several workers have obtained experimentally determined 
values of mass charge densities, and hence charging cur¬ 
rents, which are close to the theoretical maximum. For 
example, J.F. Hughes and Bright (1979) report mass charge 
densities of 0.8-3.4 x 10 -6 C/kg for the case described 
above, for which the theoretical value was 1.12 C/kg. On the 
other hand, Boschung and Glor (1980) obtained the results 
shown in Figure 16.61, where the experimental mass charge 
densities are about one-tenth of the theoretical values. 



Specific surface area (m 2 /kg) 


Figure 16.61 Mass charge densities in powder flow in a 
pipe (Boschung and Glor, 1980): A, general trend of 
experimental data; and B, maximum values from a theo¬ 
retical model (Courtesy of the Journal of Electrostatics) 


16.7.41 Powder storage silos 

As with liquid storage tanks, so with powder silos there is a 
problem of charge accumulation and relaxation. The heap 
of powder in a silo tends to have a high volume resistivity 
and a high mass charge density. Such a powder will there¬ 
fore retain a large charge over a long period. Relaxation of 
the charge may take days or even weeks. 

The main hazard in such a situation is a discharge. The 
envelope of conditions that can give a discharge is deter¬ 
mined by two limiting factors. The field must be strong 
enough to give field breakdown but not so strong that it 
prevents a charged particle from settling under gravity. 
Glor (1984) has utilized these two limitations to derive a 
simple model, which gives the envelope for discharges 
shown in Figure 16.62. This model leads to the conclusion 
that discharges are to be expected only for rather coarse 
powders, having particle diameters in the range 1-10 mm. 


16.7.42 Discharges incendive in powder and dust systems 

The incendivity of discharges for flammable gases was 
described in Section 16.7.10. The incendivity of a discharge 
for dusts may be determined by comparing the effective 
energy of the discharge with the MIE of the dust. The MIEs 
of dusts are given in Chapter 17 but, broadly, dusts typi¬ 
cally have an MIE in the range 1—10 mj. 

A spark discharge may he incendive to dusts, depending 
on its energy. 

A brush discharge is not regarded as incendive to dusts. 
According to Glor, there is no known case of ignition of a 
dust by a brush discharge. In practice it is difficult in 
handling powders to avoid brush discharges. 
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Figure 16.62 Region for brush discharges on a settled powder in a silo: spherical heap of radius R (Glor, 1984) 
(Courtesy of the Journal of Electrostatics) 


A propagating brush discharge has very high energy and 
is incendive to most dusts. 

With powders it is also necessary to consider another 
type of discharge, that is a bulking brush discharge in a 
silo. A discussion of the conditions under which such a dis¬ 
charge is most likely to occur has been given by Glor (1988). 
The conditions are a high bulk resistivity (>10 10 fim) and 
relatively large particle size (diameter >1 mm). The energy 
release in a bulking brush discharge is estimated to be of 
the order of 10 mj and this is sufficiently high to be incendive 
to many dusts. 


16.7.43 Drums and small containers 

As mentioned earlier, explosions due to static ignition also 
occur in the filling of drums. Treatments of this problem 
include those by Pesetsky and Fisher (1975), Britton and 
Smith (1988) and Rosenthal (1988). 

An incident is described by Pesetsky and Fisher involving 
an explosion during the filling with toluene of a 55 US gal 
steel drum that was not grounded.Thedrum was lined witha 
5mil(lmil = 0.001in.)non-conductiveepoxycoating. Tests 
showed that when an ungrounded steel drum was filled with 
toluene, discharges between the steel drum and a grounded 
probe regularly caused ignition. It was also found that 
insertion of a 3 ft section of plastic pipe into the filling line 
increased the charging current by a factor of 23. It was 
estimated that under the test conditions the capacitance 
of the drum was about 100 pF, while the potential was mea¬ 
sured as 8700 V giving an energy of 3.6 mj. In other tests in 
which a plastic drum and a plastic filling pipe were sub¬ 
stituted, both the drum and the liquid reached a potential of 
87,000 V, that is a value 10 times as high, but incendive 
discharges were not obtained between an grounded probe 
and the liquid surface. The authors refer, however, to work 
by Bruinzeel (1963) on tank filling, using a liquid with 


conductivity some 20 times less than toluene, in which 
incendive discharges were obtained from the liquid surface. 

Britton and Smith (1988) describe an extensive investi¬ 
gation of drum explosions, following an incident in which 
an explosion occurred in a lined drum that was grounded. 
A review of all available incidents showed that in all cases 
low conductivity liquids (<50 pS/m) were involved. The 
authors conclude, however, that in certain situations a 
conductive liquid may give an incendive discharge. While it 
is true that for a grounded drum, unlined or with a lining of 
negligible resistance, an incendive discharge requires a low 
conductivity liquid, with a lined drum it may occur with 
either a conductive or a low conductivity liquid. 

In at least one case reviewed the drum was grounded and 
the ignition occurred due to brush discharge between the 
liquid surface and the filling lance tip. It is this type of 
incendive discharge in particular that the authors address. 

Such a discharge has a relatively low energy and ignition 
occurs only over a limited range of concentration. This cuts 
both ways. On the one hand it greatly reduces the risk of an 
explosion, but on the other it means that the fact that an 
explosion has not occurred to date is no guarantee that it 
will not do so. 

The risk of static ignition depends on a number of factors, 
including the grounding, the drum, the liquid conductivity, 
the filling arrangements and the fill pipe. With regard to 
grounding, the authors state that to obtain an incendive dis¬ 
charge a potential of 1000 V is required. Allowing a safety 
factor of 10, the potential should be limited to 100 V. The 
charging current rarely exceeds 10 ~ 4 A.Thus it is sufficient 
that the resistance to ground does not exceed 1MQ. 

One measure is to reduce the resistance of the lining. 
Some drum linings have a significant electrical resistance, 
while others do not. Polyethylene, for example, is essen¬ 
tially a perfect insulator. On the other hand, drum coatings 
of the epoxy or phenolic types have very low resistance. 
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Another approach is to address the charge generation 
and relaxation. Some features are prolific charge gen¬ 
erators. The authors state that a high charging current can 
be generated not only by a filter but also by a hose with an 
internal grounding spiral. In their work, such a hose gave a 
charging current much greater than that of a smooth bore 
hose and within an order of magnitude of that produced by 
a microfilter. 

Britton and Smith refer to recommendations on relaxa¬ 
tion of the charge. It is normally advised that three time 
constants be provided for the liquid between a filter and 
the drum. Of the then current guides, API RP 2003 gives 
a relaxation time of 30 seconds for liquids with a con¬ 
ductivity less than 50pS/m, and BS 5958: 1991 gives 
a relaxation time of 3 time constants for liquids with con¬ 
ductivities down to 2 pS/m combined with a global relaxa¬ 
tion time of 100 s for liquids with lower conductivity. 

The design of the fill pipe is also important. The dip pipe 
should have the largest practicable diameter and should 
have a pointed end; a rounded end is to be avoided. 

The authors present electrostatic models for drums 
in support of the assessment of the risk of incendive 
discharge. 

Dahn, Kashani and Reyes (1994) describe the problem of 
control of the static electricity hazard in the use of flexible 
intermediate bulk containers (FIBCs) for powders. They 
point out the hazard of attempting to solve the problem by 
utilizing grounded exterior bag surfaces. This tends to 
increase the likelihood of a propagating brush discharge. 
Further, if the grounding is lost and the static charge is 
high, there is potential for an incendive discharge. 

They describe their preferred approach, the elements of 
which are to estimate the static charging rate, the charge 
dissipation rate, the field strength and the discharge 
strength. The charging rate is determined by a test in which 
the powder is passed down an inclined chute into a metal 
bucket container where the charge is measured. Tests are 
also done using an ASTM method to determine the surface 
and volume resistivities so that the charge dissipation may 
be estimated. 

For the field strength in the container they use Equa¬ 
tion 16.7.58a. As an illustration, they give a calculation 
of the field strength for the case of a container of radius 
0.807 m, with a charge density of 38.53 x 10 -6 C/m 3 and 
utilizing the permittivity of air of 8.83 x 10 -12 C/V m. The 
resultant field strength is 1171 kV/m. 

They also give calculations of the energy in a propagat¬ 
ing brush discharge. 

16.7.44 Moving machinery 

Static electricity is generated by the relative movement of 
surfaces in machinery. In particular, conveyor belts and 
reeled material tend to accumulate a large electrostatic 
charge. 

The voltages generated by a conveyor belt are often 
compared with those generated by a van de Graaff gen¬ 
erator. Typically such a generator might have a potential of 
100 kV with a current of several microamps, but values of 
up to 50 kV and several milliamps have been quoted. 

Cross (1981) has described experiments on two conveyor 
belts, one an insulating belt and one an antistatic belt, in 
which the effect of humidity was measured. At zero abso¬ 
lute humidity the potential on the insulating belt reached 
110 kV, while that on the antistatic belt was about 6 kV 
Bucket elevators also can build up an appreciable charge. 


16.7.45 Human body 

The human body can become electrostatically charged and 
can be the source of an incendive spark. The human body 
has a low volume resistivity and thus acts as a conductor. 
Charging can occur by contact charging, by induction or by 
charge sharing. Some activities which can cause charging 
are walking, rubbing, removing clothing, pouring liquids 
and powders, and touching charged objects.The maximum 
potential of the body is of the order of 50 kV, the limitation 
being leakage and sparking. It is not uncommon for the 
body to be at some 10 kV The capacitance of the body is in 
the range 100-300 pF, say 200 pF. Then at a potential of 
10 ky from Equation 16.7.19 the energy of a discharge from 
the body is some 10 mj. 

Discharge from the body is therefore capable of giving a 
spark incendive to a flammable gas mixture. Removal of 
clothing can also give an incendive spark. BS 5958 :1991 
recommends precautions against incendive discharge for 
the body for flammable mixtures with MIEs < 100 mj. 
Discharge from clothing is reckoned to be incendive only to 
sensitive mixtures. 

The main precaution against sparks from the human 
body is grounding. The charging current which occurs as 
a result of manual activities generally does not exceed 
10 -6 A. Then, applying the 100//criterion gives a required 
resistance to ground of not more than 10 s fi. There are also 
two other relevant criteria. For avoidance of uncomfortable 
shocks the resistance to ground should not exceed 10 9 Q. 
For protection against mains voltage it should not exceed 
5 x 10 4 Q. In BS 5958 Part 1: 1991 a resistance to ground 
for personnel of 10 represents good practice in most app¬ 
lications, but the standard allows one of up to 10 6 Q in 
certain cases. 

In order to achieve this degree of grounding it is neces¬ 
sary to consider both footwear and flooring. BS 5958:1991 
gives requirements for the two main types of footwear 
used: antistatic footwear and conducting footwear. It also 
states that leather footwear usually has a sufficiently low 
resistance, except when very dry. 

BS 2050:1978 gives requirements for flooring materials 
and BS 3187:1991 gives requirements for laid floors, but 
only of the conductive type. A conductive type floor is not 
suitable if protection is required against mains voltage. It is 
sometimes permissible to provide a limited area of low 
resistance flooring such as a metal plate. 

16.7.46 Containments 

The effect of the containment has been referred to a number 
of times in the preceding sections. It is now considered in 
more detail. Containment materials are classed as con¬ 
ductive or non-conductive. BS 5958:1991 defines a non- 
conductive, or high resistivity, material as one with volume 
and surface resistivities of 10 l2 fim and 10 12 Q, respectively. 
In process containments the principal conductive materials 
are metals and the principal non-conductive materials are 
plastics. Some data on the electrical volume and surface 
resistivities of solid materials are given in Table 16.37. 
In addition, use is also made of non-metallic conductive 
materials, essentially plastics modified to increase their 
conductivity. 

Some principal containments and containment materials 
are given in Table 16.38, based broadly on the distinctions 
made in BS 5958. Most are self-explanatory, but several 
require further comment. Where the container is non¬ 
conducting, there may be the possibility of a discharge 
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Table 16.38 Some containments and containment 
materials 


Metal container for liquids 
Non-conducting container for liquids 
Metal container for liquids with fixed non-metallic coating 
Metal container for liquids with outer non-metallic coating / 
jacket 

Metal pipes for gases and liquids 
Metal container for powders 
Non-conducting container for powders 
Container for powders with liner: 

Metal container with conductive liner 
Metal container with non-conductive liner 
Non-conductive container with non-conductive liner 


from its external surface. Some metal containers have an 
internal non-conductive coating. This creates the possibi¬ 
lity that charge from repeated filling or rubbing is retained 
on the coating. Metal containers may also have an external 
non-conductive coating or jacket. There is then the possi¬ 
bility of a discharge from the external surface of the con¬ 
tainer. Another possible effect where there is a non- 
conductive outer surface, whether that of the main con¬ 
tainer or of a coating, is that metallic objects on this surface 
may constitute isolated conductors. Any situation where 
there may be a discharge from the container is relevant if 
the container is in a classified hazardous area. 

Some containers for dry powders have removable liners. 
Broadly, BS 5958: 1991 treats a metal container with a 
conductive liner as an unlined metal container and a non- 
conductive container with a non-conductive liner as an 
unlined non-conductive container. It recommends against 
the use of a non-conductive liner with a metal container or 
of a conductive liner with a non-conductive container, and 
recommends additional precautions where such mixed 
systems have to be used. 

16.7.47 Precautions against static electricity 

Static electricity can act as a source of ignition giving rise 
to a fire or explosion only under the following conditions: 

(1) a flammable atmosphere exists; 

(2) an electrostatic charge is generated, accumulates and 
produces an electric field strength which exceeds the 
critical value for breakdown; 

(3) the resultant incendive discharge has an energy 
greater than the minimum ignition energy of the flam¬ 
mable atmosphere. 

Thus precautions against static electricity aim to eliminate 
one or more of the above factors. These precautions tend to 
be based, therefore, on the following approaches: 

(1) elimination of a flammable atmosphere; 

(2) control of charge generation; 

(3) control of charge accumulation; 

(4) minimization of incendive discharge. 

It is a general principle in handling flammable materials to 
make avoidance of a flammable atmosphere the first line of 
defence where this is practical. It is necessary also to try to 


eliminate sources of ignition, but it is much more difficult 
to do this reliably. 

Since electrostatic charge builds up both on process 
materials and on process plant, it is not sufficient simply to 
ensure that charge is drained away from plant by measures 
such as grounding. It is essential to deal also with the 
charge on the material being handled. 

In the handling of liquids the precautions used may 
include the following: 

(1) elimination of flammable mixtures; 

(2) bonding and grounding; 

(3) modification of liquid conductivity; 

(4) limitation of flow velocity; 

(5) minimization of charge generation by - 

(a) immiscible liquids, 

(b) filters, valves; 

(6) avoidance of splashing and settling; 

(7) avoidance of grounded probes; 

(8) grounding of personnel; 

(9) measures associated with low conductivity 
containers; 

(10) provision of relaxation time. 

The elimination of a flammable mixture is used particu¬ 
larly for liquid storage tanks and for tank cleaning on 
tankers. 

Bonding and grounding are discussed in Section 16.7.48. 
The modification of liquid conductivity was developed 
particularly by Shell, and the Shell additive ASA 3 is 
widely used for conductivity modification. Modification of 
liquid conductivity has been discussed by Klinkenberg 
and van der Minne (1958). The liquid conductivities 
recommended in order to keep charge separation below a 
safe level are 50 and 500 pS/m for pipeline velocities below 
and above 7 m/s, respectively. 

Thus some products, such as crude oil, have a suffi¬ 
ciently high conductivity to render them safe, while others, 
such as light distillates, do not. It is possible, however, to 
modify the conductivity of the latter by the use of a very 
small amount of a suitable additive. Additives are usually a 
combination of divalent or polyvalent metal salt of an acid 
such as carboxylic or sulphonic acid and a suitable elec¬ 
trolyte that imparts a conductivity of about 10,000 pS/m in 
a 0.1% solution in benzene. Thus concentrations of 0.6 and 
6 ppm of additive Shell ASA 3 raise the conductivity of such 
products to about 200-300 and 1000 pS/m, respectively. 

The charging current in the pipeline flow of liquids is of 
the order of 10~ 10 —10 _7 A. This current is approximately 
proportional to the square of the velocity. Keeping the 
velocity down can, therefore, reduce charge generation. A 
limit on pipeline velocities of 7 and 1 m/s, respectively, for 
liquids without and with an immiscible component has 
been recommended by Klinkenberg and van der Minne 
(1958). The much lower limit for liquids with an immiscible 
component, such as free water, is due to the fact that in such 
liquids the rate of charge generation can be up to 50 times 
greater. 

Filters generally require special precautions. Since the 
streaming current generated in a filter is proportional to 
the flow rate rather than the square of the flow rate, as with 
a pipe, the limitation of liquid velocity is rather less effec¬ 
tive for filters. The usual approach is to allow a relaxation 
time by providing an adequate length of pipe between the 
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filter and the tank. This is more difficult to do, however, for 
high purity products with long relaxation times. 

For liquid storage in a tank of non-conductive material or 
in a tank of non-conductive material with an embedded 
metal grid not in contact with the liquid, BS 5958:1991 
recommends the use of an grounding plate of area 

A ep = 0.04 F t [16.7.231] 

where A ep is the area of the grounding plate (m 2 ) and V t is 
the volume of the tank (m 3 ). 

Although they are generally less prolific generators than 
filters, valves and other constrictions can also give sub¬ 
stantial increases in charging. 

Tank filling arrangements should avoid free fall and 
splash filling of liquids. Inlets should reach to the bottom of 
the tank or, preferably, should enter at the bottom of the 
tank and be submerged. 

Grounded probes in tanks should be avoided as far as is 
practicable, as should isolated conductors. 

There should be suitable arrangements for level gaug¬ 
ing. The hazard is reduced if antistatic additives are 
used and if an adequate relaxation time is allowed. Level 
measuring equipment, which is used where there is an 
electrostatic hazard, includes non-conducting ullage tapes 
and permanently fixed and grounded sounding pipes 
extending to within a few centimeters of the tank bottom. 
Detailed discussions of the precautions associated with 
level gauging are given by J.R. Hughes (1970) and Page and 
Gardner (1971). 

Settling of immiscible liquids, such as water droplets in 
oil, should be avoided as far as possible. 

A liquid storage tank made of a non-conductive material 
may be provided with a grounded metal grid on or just 
below the surface throughout the material. If this conduct¬ 
ing grid covers the inner surface of the tank and is thus in 
contact with the liquid, this provides a ground for the 
liquid. 

Precautions against the charging of the human body 
take the form of special footwear and flooring. There are 
two types of product available: antistatic and conductive. 
Both prevent accumulation of electrostatic charge, but 
whereas the former gives protection against electrical 
mains failure, the latter does not and should only be used 
where there is other protection against such failure. There 
are a number of British Standards on antistatic and con¬ 
ductive footwear and flooring. Since the resistance of these 
products can change, it is important that it be monitored 
regularly; instruments are available to do this. 

The hazard involved in using non-conducting containers 
may be dealt with by limiting the container size. Some 
maximum sizes for non-conducting plastic containers have 
been suggested by Heidelberg and Schon (1960) as follows: 


Maximum 
container size (1) 


Liquids with low ignition energy 1 
Liquids with flashpoint <21°C 2-5 

Liquids with flashpoint >21°C 60 


As already indicated, both conducting and non-conducting 
containers present static electricity hazards and applica¬ 
tions need to be considered individually. 


The precautions required in the handling of dusts and 
powders are somewhat similar to those for liquid handling. 
Principal measures again include elimination of flam¬ 
mable suspensions, bonding and grounding of plant, and 
grounding of personnel. Antistatic additives, which mod¬ 
ify dust resistivity, are not well developed. Measures such 
as humidification and ionization are used, but have limita¬ 
tions. Non-metallic containers for sensitive dusts should 
have low resistance. Detailed information on the precau¬ 
tions for dust handling is given by K.N. Palmer (1973a). 

The electrostatic hazard from steam leaks is that a near¬ 
by conductor insulated from ground becomes charged. An 
example of such a conductor is wire netting around lagging. 
Insulated conductors should be avoided in situations where 
they could become a hazard. 

Steam used for purging or cleaning can cause charge 
generation. Again it is necessary to consider both the plant 
and the fluid. The risk of ungrounded pipelines and charge 
accumulation on these is reduced if the lines used are fixed 
rather than portable apparatus. Keeping the flow velocity 
down should minimize charge generation in the steam. 
Grounded probes should be avoided so that the probability 
of a discharge is reduced. 

Carbon dioxide should not be used for the rapid inerting 
of flammable atmospheres, since it can generate static 
electricity and so act as an ignition source. 

The accumulation of electrostatic charge on moving 
machinery can be prevented in some cases by grounding 
the machinery. Objects such as conveyor belts and trans¬ 
mission belts, however, may also accumulate charge and 
this is not prevented by normal grounding arrangements. 
The usual solution is to modify the conductivity of the belt 
material by the incorporation of additives during manu¬ 
facturing or by the use of a dressing in operation. 

The reduction of the resistance of materials is a widely 
used approach and there are British Standard specifica¬ 
tions for low resistance polymeric materials not only for 
flooring, footwear and belts, as already mentioned, but also 
for sheeting, hose, tires and wheels. 

Electrostatic eliminators based on ionization are used to 
prevent charge accumulation in applications such as reel¬ 
ing operations. The charge is either drained to ground 
through the ionized air or is directly neutralized by ions 
from the air. Air can be ionized by heat, high voltage, 
ultraviolet light or radioactivity. Not all types of electro¬ 
static eliminator are suitable for flammable atmospheres. 
Flames are sometimes used, for example, as ionizers on 
printing presses. 

Devices that have pointed surfaces and are electrically 
energized are another type of ionizer. If flammable mix¬ 
tures can be present, however, it is necessary to ensure that 
the electrical equipment is not itself a source of ignition. 

Another method of ionization uses a radioactive source. 
This type of equipment is of limited applicability, because 
it is only suitable where charging rates are low. It is used, 
however, in the paper and textile industries. It is necessary 
with such devices to take the usual precautions for a 
radioactive hazard. 

Since a pointed object will ionize air near a charged 
object, it is also possible to use devices rather like wire 
brushes as induction collectors. There is in this case no 
electrical energization. 

The relative humidity in the atmosphere has a consider¬ 
able influence on the incidence of electrostatic hazards. In 
general, most fires attributed to static electricity occur 
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indoors in winter when the relative humidity is below about 
30%. If the relative humidity is kept above 60-70%, the 
electrostatic charge tends to drain away. This is largely a 
surface electrical conductivity effect. The change in sur¬ 
face conductivity with relative humidity can be dramatic. 
For plate glass there is a 1000-fold increase in surface con¬ 
ductivity between 20% and 50% relative humidity. 


16.7.48 Precautions against static electricity: grounding 
and bonding 

Grounding and bonding comprise one of the principal 
methods of providing protection against static electricity. 
Bonding involves making an electrical connection between 
two conducting objects and ground. The effect of bonding 
is to maintain the two objects connected at the same 
potential and that of grounding is to drain away to ground 
the charge on the object connected. Grounding and bond¬ 
ing systems are also required to give protection against 
electrical systems and against lightning, but the systems 
considered here relate only to static electricity. 

The purpose of grounding and bonding is to prevent an 
incendive discharge. The conditions for an incendive dis¬ 
charge to occur are that the field strength reaches the 
breakdown value and that the energy in the discharge 
equals the relevant ignition energy. 

A potential of at least 300 V is normally considered 
necessary for an incendive discharge, but since a potential 
of 100 V has been considered hazardous in explosives 
manufacture, the latter figure is generally taken as the 
limit value. Applying Equation 16.7.1 (Ohm’s law) gives 
the criterion that the resistance should not exceed 100/7. 
Charging currents vary in the range 10 -11 - 1CT 4 A. Taking 
the worst case of a charging current of 10 -4 A yields 
the criterion resistance to ground of 10 6 Q. Taking a more 
realistic value of 10 -6 A for the charging current yields a 
resistance to ground of 10 s Q. 

As a practical matter it is usually recommended that for 
conducting equipment, such as a metal, the resistance to 
ground should not exceed 10 fi. The reason for this is that 
the equipment might contain certain high resistance fea¬ 
tures such as paint, grease and oil, corrosion and rust, 
which could increase in resistance and negate the required 
grounding if the resistance were set at, say, 10 6 £2. The value 
recommended in BS 5958:1991 is 10 £2; this has the advan¬ 
tage of being the same as the value prescribed for lightning 
protection. 

Different requirements for grounding are given in BS 
5958 for equipment made of non-conducting material and 
of conductive or antistatic materials. For plant built in non¬ 
conducting material, isolated conductors are of particular 
concern. It is frequently recommended that all isolated 
conductors be grounded. BS 5958 questions this philoso¬ 
phy and proposes instead an approach based essentially on 
hazard assessment, taking into account the probability 
that the item will be charged, that it will give an incendive 
spark and that a flammable mixture will be present. For 
equipment made of conductive or antistatic material, BS 
5958 recommends a resistance to ground not greater than 
100/7. This will tend give a resistance in the range 10 4 - 
10 s £1 The general recommendation is for 10 6 £2, but a 
higher resistance, which still meets the 100/7 criterion, is 
acceptable. 

General grounding requirements are discussed in BS 
5958: Part 1:1991. These include a table summarizing the 


requirements. Further guidance on detailed requirements 
for particular situations is given in BS 5958: Part 2:1991. 

Grounding is usually achieved by means of copper strips 
or wire attached to a special point on the object to be 
grounded. Bonding across flanged joints to ensure better 
electrical continuity than that through the bolts has been 
widely practiced, but many companies have satisfied 
themselves by tests that this is not necessary and have 
discontinued the practice. 

A good grounding system also requires that it be recog¬ 
nizable as such and that it be checked periodically and after 
maintenance operations. 

Grounding of the human body and the use of appropriate 
footwear and floors are described in Section 16.7.45. 


16.7.49 Precautions against static electricity: BS 5958 

BS 5958: Parts 1 and 2: 1991 gives very detailed recom¬ 
mendations for precautions against static electricity, 
with those for particular situations being given in Part 2. 
Table 16.39 lists the principal contents of Part 2. 

Some of the precautions for handling liquids recom¬ 
mended in BS 5958: Part 2: 1991 are summarized in 
Table 16.40. For liquid storage tanks made of metal, a flam¬ 
mable atmosphere may be eliminated by reduction of the 
vapour space by using a floating roof, or by some form of 
atmosphere control such as inerting. The tank should be 
grounded. Splash filling should be avoided. Filling may be 
by a top or bottom fill pipe. A top fill pipe should extend 
close to the bottom of the tank. There should be a limitation 
of the liquid velocity during filling. Measures should be 
taken to avoid excessive charge in the liquid entering the 
tank. An adequate relaxation time should be allowed before 
operations such as gauging and sampling are carried 
out. Measures should be taken to avoid discharge between 
the liquid in the tank and the tank itself during such 
operations. 

The standard discourages the use of non-conductive 
liquid storage tanks and recommends that specialist advice 
be taken before installing one. The precautions recom¬ 
mended for metal storage tanks apply, but in addition it is 
preferable that the liquid itself should be grounded and, for 
a classified hazardous area, the effect of an external dis¬ 
charge should be considered. 

The recommendations for metal road and rail tanks are 
broadly similar, but additional measures are specified 
concerning filling hoses. 

For barge and ship loading BS 5958:1991 gives recom¬ 
mendations on atmosphere control, grounding, fill pipes 
and liquid filling velocity. 

Some of the limitations on liquid velocity for operations 
involving filling with liquids, as given in BS 5958:1991, are 
summarized in Table 16.41. For small liquid containers the 
Standard recommends for metal containers grounding of the 
container and a limitation of the liquid velocity during filling. 
For non-conductive containers consideration needs to be 
given to the hazardous area classification. The container 
itself can be considered a Zone 1 area if either a flammable 
liquid is being handled or if a flammable atmosphere may be 
present in normal operation. A non-conductive container 
should be used only if the risk of ignition is acceptably low, 
which may be a matter for expert guidance. With non- 
conductive containers in classified hazardous areas 
consideration needs to be given also to external discharge. 
This applies whether or not the liquid is flammable. 
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Table 16.39 Principal contents of BS 5958: Part 2: 1991 


Larger containers 

3. Fixed metal tanks for the storage of liquids 

4. Fixed non-metallic tanks for the storage of liquids sited 
partially or wholly above ground 

5. Fixed non-metallic tanks for the storage of liquids sited 
completely below ground 

7. Metal road/rail tanks for liquids 

8. Non-metallic road/rail tanks for liquids 

13. Ships (tankers) and barges 

17. Metal containers and tanks for the storage and 
transport of liquids, with a fixed internal non-metallic 
coating 

18. Metal containers for liquids with outer non-metallic 
coatings or jackets 

Smaller containers 

11. Small metal containers for liquids 

12. Small non-metallic containers for liquids 

21. Containers for powders 

22. Flexible intermediate bulk containers 

23. Removable non-metallic liners in containers for solvent 
wet materials or powders 

Equipment and processes 

9. Installation for the transfer of liquids to and from road 
and rail vehicles 

10. Liquid/liquid and solid/liquid blending and mixing 
16. Fine particle filters and water separators 

19. Pipelines for liquids and gases 

20. Pneumatic conveying systems 

33. Vacuum filters 

34. Centrifuges 

35. Flaker 

36. Dust collectors 

Operations 

6. Gauging and sampling of tanks 

14. Tank cleaning with high-pressure water jets 
or steam 

24. Manual addition of powders to flammable liquids 

25. Release of gases and vapours 


The standard also gives precautions for filling contain¬ 

ers with high resistivity powders. These may be summar¬ 

ized as follows. A distinction is made between metal 

containers of volume <65 m 3 or non-metallic containers of 

5 m 3 and larger ones, and between powders which give rise 

to flammable mixtures with a minimum ignition energy 

MIE of <25 mj and those with an MIE of >25 mj. It may be 

noted that for metal containers the volume delimitation j ust 

quoted is an increase from one of 5 m 3 in the 1983 edition, 
reflecting a growth in knowledge. For metal containers, if 
the container volume is <65 m 3 and the MIE is >25 mj, the 
measures recommended are to ground the container and 

any filling pipe. However, if there is a possibility that a 
flammable atmosphere such as a dust cloud with an MIE of 
<100 mj could occur, personnel should also be grounded. 
For the same size container, if the MIE is <25 mj, there 
should be grounding of equipment and personnel and, in 

addition, consideration should be given to charge rate 


limitation and explosion prevention and protection; these 
comprise a set of measures which in this context it is con¬ 
venient to refer to as ‘explosion protection’. If the metal 
container is >65 m * * 3 , there should he grounding of equip¬ 
ment and personnel and, unless incendive discharges can 
be ruled out, consideration should be given to explosion 
protection. Moving on to non-metallic containers to be fil¬ 
led with dry powders, if the container volume is <5 m 3 5 * * * * and 
the MIE is >25 mj, the measures recommended are to 
ground the container and any filling pipe. It should also be 
established that the rate of charge input is insufficient to 
promote propagating brush discharges. However, if there is 
a possibility that a dust cloud with an MIE of <100 mj could 
occur, personnel should also he grounded. For the same 
size container, if the MIE is <25 mj, there should be 
grounding of equipment and personnel and, unless 
incendive discharges can be ruled out, consideration 
should be given to explosion protection. For the same size 
container, if the MIE is <25 mj and there is a possibility of 
propagating brush discharges, there should be grounding 
of equipment and personnel and, unless incendive dis¬ 
charges can be ruled out, consideration should be given to 
explosion protection; in addition, grounded rods should be 
inserted into the container to assist relaxation of charge 
from the powder. If the non-metallic container is >5 m, for 
which the probability of incendive discharge from a dust 
cloud is as yet unknown, there should be grounding of 
equipment and personnel and, unless it can be shown that 
incendive discharges will occur neither from the bulk 
powder nor the dust cloud, consideration should be given to 
explosion protection; if there is a possibility of propagating 
brush discharges, consideration should he given to the use 
of grounded rods. 

The Standard deals with the use of removable non- 
metallic liners in containers for solvent wet materials or 
dry powders. The effect of such a liner depends on whether 
it is used in a metal or in a non-conductive container. If 
the liner is used in a metal container, it may insulate the 
material being handled from ground via the metal and it 
may itself become charged, with the possibility of a propa¬ 
gating brush discharge. The standard strongly recom¬ 
mends that the liner he conductive with a surface 
resistivity not exceeding 10 11 Q. The precautions applic¬ 
able to the equivalent unlined container should be taken. 
A liner with a higher resistivity should be used in a metal 
container only where this is essential, in which case 
expert advice is required. The precautions recommended 
by the standard for the case of a non-metallic liner in a 
non-conductive container are the same as those for a 
non-conductive container alone. The use of conductive 
liners in non-conductive containers is not recommended 
but, if practiced, such liners should he grounded. In almost 
all cases an essential precaution is that removal of the 
liner from the container, with the attendant risk of spark¬ 
ing, should be avoided in the presence of a flammable 
mixture. 

Another type of container is the FIBC used for powders. 
Typically, such containers are made of polypropylene fabric 
or some similar heavy-duty material. Some have conduct¬ 
ing thread woven into them. The variety of FIBCs, and the 
lack of data on their performance, is such that the standard 
gives only very general advice and recommends expert 
consultation. It does, however, state the basic principle that 
if an FIBC is made of a conducting material it should he 
grounded. 
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Table 16.40 Some precautions against static electricity given it 
containments and equipment and operations involving liquids 

i BS 5958: Part 2: 1991 - precautions for selected 

Configuration! operation 

Containment material 

Precautions 

1. Liquid storage tank 

Metal 

Vapour space reduction/atmosphere control 

Liquid conductivity 

Grounding of tank 

Avoidance of splash filling, fill pipe arrangements 
Liquid velocity 

Charge generators 

Relaxation time 

Gauging and sampling 

2. Liquid storage tank 

Non-conductor 

As (1) plus: limitation on use, grounding of liquid, 
hazardous areas 

3. Road/rail tanker 

Metal 

As (1) plus: hoses 


Non-conductor 

As (2) plus: hoses 

4. Liquid/liquidand 


Atmosphere control 

liquid/solid-blending 


Grounding 

Agitator power 

5. Small containers for liquids 

Metal 

Grounding 

Liquid velocity 

6. Small containers for liquids 

Non-conductor 

As (5) plus: 
hazardous areas 

7. Ships and barges: 


Atmosphere control 

loading 


Grounding 

Fill pipe 

Liquid velocity 

8. Ships and barges: 


Atmosphere control 

tank cleaning 


Grounding 


For liquid-liquid and liquid-solid blending, measures 
recommended in the Standard include atmosphere control, 
grounding of the container and limitation of agitator 
power. 

The Standard also deals with a number of operations. 
One of these is gauging and sampling. Such operations are 
commonly carried out on storage tanks. The gauging and 
sampling equipment should be made of a conducting 
material such as a metal or of wood or natural fibre. The 
resistivity of wood and natural fibre is such that they do not 
become highly charged or give incendive sparks. Use 
should not be made of metal chains or of synthetic poly¬ 
mers, which have high resistivity. All metallic parts on 
gauging and sampling equipment should be grounded, by 
connection to the grounded tank if it is a metal one or direct 
to ground if the tank is a non-conductive one. For liquids 
with conductivities of <50 pS/m, gauging and sampling 
operations should not he carried out during any charge 
generating operation, including filling, and after filling not 
until the lapse of a prescribed relaxation time. The relaxa¬ 
tion times recommended are at least 30 min if the filling 
liquid has a separate water phase and a period of, say, 
10 min if it does not. After any mixing operation the gau¬ 
ging and sampling should be deferred until the compo¬ 
nents have settled. After a cleaning operation that has 
generated a charged mist, gauging and sampling should be 
delayed until the mist has settled, which may take some 
hours. If the liquid conductivity is >50 pS/m, gauging and 
sampling may be done at any time. Also, the foregoing 
restrictions on when gauging can be performed do not 


apply if it is done using fixed gauging equipment or 
through a fixed, grounded pipe extending to the bottom of 
the tank. Gauging and sampling should not be undertaken 
during adverse weather conditions such as thunderstorms 
or snow or hail storms. 

Another operation considered is the manual addition of 
powders to flammable liquids. The flammable vapour 
should be contained within the receiving vessel, and dust 
cloud formation should be strictly controlled.The container 
being emptied should preferably be of metal or other con¬ 
ductive material and should he grounded. A paper sack can 
be grounded by contact with the grounded plant. Emptying 
from non-conductive containers is not generally recom¬ 
mended. The standard also gives precautions to he taken if 
there is a liner in the container being emptied, these pre¬ 
cautions being similar to those described above in relation 
to the filling of lined containers. The receiving vessel and 
chutes should preferably be of metal or other conductive 
material and should be grounded. The Standard recom¬ 
mends against the use of non-conductive materials for such 
equipment. The risk of incendive discharge by the powder 
as it enters the receiver is assessed as generally low unless 
the chute is longer than 3 m or the powder has high resis¬ 
tivity, in which case expert advice is in order. For a liquid in 
the receiving vessel with a conductivity of >50 pS/m, it is 
sufficient to ensure that the liquid is grounded, either by 
contact with the grounded metal vessel or, if the vessel has 
a non-conductive lining, by a special ground point at the 
base of the receiver. If the liquid conductivity is <50 pS/m, 
and it cannot be reduced below this by a conductivity 
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Table 16.41 Some precautions against static electricity given in BS 5958: Part 2: 1991 - some limitations on liquid 
velocity for operations involving filling with liquids 

Configuration!operation 

Liquid conductivity (pS/m) 

Liquid velocity 1 (m/s) 

1. Liquid storage tank filling 

<50 

<7 General limit 

<1 Until fill pipe submerged 

<1 If immiscible phase present 


>50 

No limitation 

2. Road or rail tanker loading 

<50 

Lower of 
(a) m < 7 
(1 b)ud <# 

<1 If immiscible phase present 

3. Small container filling 

<50 

<1 If immiscible phase present 


>50 

No limitation 

4. Ship or barge loading 

<50 

<1 Until fill pipe submerged 
<1 If immiscible phase present 


>50 

No limitation 


a These are the liquid velocity limits given for metal containers. 

b IVis a constant with a value of 0.5 m 2 /s for liquid conductivities of >5 pS/m. The Standard states that the value to be applied for liquid con¬ 
ductivities of <5 pS/m is a matter for debate and quotes values of 0.38 and 0.5 m 2 /s as having been accepted, but it also states that in the United 
Kingdom the value used is 0.5 m 2 /s. 


modifier, expert advice should be sought. An alternative 
basis of safety can be the elimination of a flammable 
atmosphere, but in this case it should be appreciated that 
air can enter with the powder. It may be necessary to 
monitor the oxygen content. 

The Standard emphasizes that in operations generally, it 
should be ensured that the human body does not present an 
ignition risk. 

The foregoing summary is no more than a sample from 
the detailed recommendations made in the Standard on a 
wide range of situations. 

16.7.50 Precautions against static electricity: NFPA 77 

In the United States the relevant standard is NFPA 77: 2000 
Static Electricity. Its recommendations agree in broad out¬ 
line with, but differ in some details from, those just 
described. 

The precautions given for the handling of liquids include 
avoidance of entrained water and gas, avoidance of splash 
filling and gas bubbling, limitation of flow velocity, loca¬ 
tion of the fill pipe near the bottom of the container and 
provision of relaxation time. 

The code gives detailed arrangements for a number of 
specific situations, including filling of storage tanks, road 
tankers, rail tank cars, small containers and drums. 

Where bottom loading of road tankers is used, the code 
recommends limitation of the flow velocity or use of splash 
deflectors to prevent upward spraying. 

It draws attention to the particular hazard of hydrogen 
containing small particles of oxide from the inside of con¬ 
tainments. In this contaminated state the gas will generate 
charge. Its MIE is very low. 

16.7.51 Precautions against static electricity: Expert 
Commission 

Another set of recommendations on static electricity are 
those of the Expert Commission for Safety in the Swiss 
Chemical Industry (1988). The following account sum¬ 
marizes some of the principal points. 


The report gives guidance on a number of specific 
situations. For the handling of liquids, these include 
(1) liquid transfer through pipes and hoses, (2) liquid filling 
or emptying of small containers and drums under gravity, 
(3) liquid transfer by drum pumps, (4) liquid filling of 
agitated vessels, (5) operations at the open access port of an 
agitated vessel, (6) liquid filling of large glass vessels, 

(7) loading and unloading of road and rail tankers and 

(8) transfer and filtration of suspensions on filters and 
centrifuges close to the flashpoint. 

Guidance is also given on the handling of powders. 
Separate consideration is given to the handling of powders 
without and with flammable vapours. Specific situations 
considered include (1) ‘open’ charging of powder into 
flammable liquids, (2) discharging of solids containing 
flammable liquids from filtration apparatus, (3) charging 
and emptying of containers, (4) pneumatic conveying, 
(5) charging of powders into silos, (6) spray and fluidized 
bed drying and (7) ventilation, extraction and dust aspira¬ 
tion systems. For each situation the report rehearses 
the hazards and describes precautions. It gives a large 
number of diagrams showing in detail the configurations 
recommended. 

For liquid transfer through pipes and hoses, the hazards 
are those already described. Precautions include exclusion 
of impurities such as water or dust, operation with the pipe 
full, limitation of the flow velocity and care with charge 
generators such as filters. Guidance is given on velocity 
limits for partially full pipes and for pipes conveying slur¬ 
ries of crystals, and on hose selection. 

For liquid filling or emptying of small containers and 
drums under gravity, the hazards depend on whether the 
container is conductive or non-conductive, as described 
above. Precautions include taking the fill pipe close to the 
bottom of the container, and grounding of the container 
and fill pipe and of personnel. Liquids containing an 
immiscible component should be charged only into con¬ 
ducting containers. For liquids at a temperature less than 
5°C below the flashpoint a table is given for the selection of 
a suitable type of container. 
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For liquid transfer by drum pumps, the hazards are 
charging of the liquid and sparking between the drum 
pump and the container. Precautions are to connect the 
drum pump both to the container being emptied and to that 
being charged and to ground it. The connectors should be 
permanently fixed to the drum pump so that it is clear that 
the connections need to be made. The connecting points 
should not be the openings of the drum or the container, as 
these are the very points where a flammable mixture is 
most likely to be present. 

For liquid filling of agitated vessels, the situation parti¬ 
cularly envisaged is the charging of a liquid using com¬ 
pressed air or inert gas, where the hazards are charging by 
turbulence and the creation of brush discharges between 
the liquid surface and internal fittings. Precautions include 
bottom filling or taking a top fill pipe close to the bottom, 
limitation of charging velocity, avoidance of discharging by 
‘blowing off with air, and use of nitrogen blanketing. Gui¬ 
dance is also given on the alternative procedure of charging 
under vacuum and on special precautions for enameled 
vessels. 

For operations at the open access port of an agitated 
vessel, the hazard is sparking between the liquid surface of 
the reaction mass and an approaching metal object, or 
between the port flange and a conducting object in contact 
with the liquid. Precautions include avoidance of sampling 
through open ports or, if this cannot be avoided, the use of 
non-conductive sampling devices and the observance of a 
relaxation time. 

For liquid filling of large glass vessels, the hazards are 
charging of the liquid and the vessel by turbulence and 
sparking between conductive items. Precautions include 
grounding of metal parts, limitation of flow velocity and 
inerting. Guidance is given on the alternative procedure of 
charging under vacuum. 

For loading and unloading of road and rail tankers, the 
hazards are charging of the liquid, the vehicle and even the 
driver when leaving the cab, and sparking between con¬ 
ductive items. Precautions include a connection between 
the vehicle and the fixed tank at the terminal and the use of 
conductive hoses and footwear. 

For the transfer and filtration of suspensions on filters 
and centrifuges at temperatures less than 5°C below the 
flashpoint, the hazard is charge generation during: the fil¬ 
tration or centrifugation so that the filter cake or isolated 
conductors become charged, and sparking between these 
and conductive items. Precautions include grounding and 
inerting. 

For powders, the report distinguishes between powders 
without and with flammable vapours. It takes the dividing 
line as 1% flammable solvent; powders with less than this 
can be considered as essentially solvent free. For solvent- 
free powders the hazard is charging of large metal parts 
and sparking from these. Precautions include the ground¬ 
ing of such parts. Provided the solvent-free status of the 
powder is assured, the construction material of contain¬ 
ments such as drums or pipes is not restricted. Containers 
with plastic liners are acceptable. 

For powders that are handled in the presence of a flam¬ 
mable vapour, are wet with flammable solvent or are char¬ 
ged into flammable solvent, the report gives the following 
guidance. The hazards include charging not only of metal 
parts but also of the powder and of sparking from metal 
parts. There is a particular hazard of brush discharges. 
A large proportion of incidents due to static electricity 


occur with such systems. Precautions include grounding 
and inerting. For powders containing flammable solvents 
only grounded containers should be used. 

Powders containing flammable solvents should not be 
poured from non-conductive containers or bags or through 
non- conductive ducts into a charging vessel. Nor should pow¬ 
ders be poured into a vessel containing a flammable solvent 
from non-conductive containers or non-conductive ducts. 

For the open charging of powder into flammable liquids, 
three cases are distinguished: Case A, non-combustible or 
high MIE powders; Case Bl, open charging of powders into 
precharged solvent; and Case B2, open charging of solvent- 
wet solids into an empty container. Guidance is given for 
each of these cases. 

For discharging of solids containing flammable liquids 
from filtration apparatus, including centrifuges, the 
hazard is charging of the filter cake, filter cloth and metal 
parts and sparking to conductive items. In some cases dust 
formation has been observed with solvent contents up to 
10%. Precautions include conductive filters, discharging 
using grounded chutes and containers, non-conductive 
shovels, local exhaust ventilation and inerting. Non-con¬ 
ductive filters should be withdrawn slowly. 

For charging and emptying of containers with powders 
containing flammable liquids, the hazard is charging and 
sparking to a conductive item or brush discharges. Pre¬ 
cautions include the use of grounded, metal containers and 
the avoidance of non-conductive containers or non- 
conductive linings. 

For pneumatic conveying, the hazards are charging of 
the pipe and of the powder, charge accumulation in silos 
and sparking between metal parts. Precautions include 
the use of grounded, metal pipes. If plastic piping is used, 
the flanges should be plastic also or, if metal, grounded. 
Before discharge into a silo, the charge on powder can be 
reduced by first passing the powder through a grounded, 
metal cyclone. 

For the charging of powders into silos, the hazard is as 
described above. In principle, a large, charged dust cloud 
could be created and could discharge, though the report 
states that no such cases are known. Precautions include 
the avoidance of internal insulating coatings, the use of 
conducting paints and the exclusion of tramp metal. 

For spray and fluidized bed drying, the hazard is char¬ 
ging of metal parts and of the powder, and sparking. The 
high-speed movement and the very dry atmosphere are 
conducive to high charge generation. Precautions include 
grounding and inerting. 

For ventilation, extraction and dust aspiration systems, 
the hazard is charging of dust deposits and sparking. Pre¬ 
cautions are the use of grounded metal rather than plastic 
ducting, the avoidance of sections of plastic duct or, if this 
is unavoidable, the use of bridging connections across such 
sections. 


16.8 Electrical Equipment 

Electrical equipment is widely used in process plant and 
may be a source of ignition unless close control is exercised. 

In the United Kingdom the relevant legislation is as fol¬ 
lows. For the premises to which it applies, the Factories Act 
1961, Section 31, deals with hazard from flammable and 
explosive materials, but the main statutory requirements 
governing electrical apparatus are those given in the Elec¬ 
tricity at Work Regulations 1989, which apply to all places 
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of work. Regulation 6, on adverse or hazardous environ¬ 
ments, states that: 

Electrical equipment which may reasonably/foreseeably 
be exposed to - (a) mechanical damage; (b) the effects of 
weather, natural hazards, temperature or pressure; (c) the 
effects of wet, dirty, dusty or corrosive conditions; or 
(d) any flammable or explosive substance, including 
dusts, vapors or gases, shall be of such construction or as 
necessary protected as to prevent, so far as is reasonably 
practicable, danger arising from such exposure. 

In addition, the Highly Flammable Liquids and Liquefied 
Petroleum Gases Regulations 1972 state in Regulation 9.1: 
‘No means likely to ignite vapor from highly flammable 
liquids shall be present when a dangerous concentration 
of vapors from highly flammable liquids may be reason¬ 
ably expected to be present.’ In general, these regula¬ 
tions apply to premises where the Factories Act applies. 
A highly flammable liquid is one that has a flashpoint 
below 32°C and supports combustion under specified test 
conditions. 

The Petroleum (Consolidation) Act 1928 is also relevant 
in cases where petroleum spirit and certain other materials 
are kept. 

The use of electrical apparatus in flammable atmo¬ 
spheres is a topic in which there is active development of 
standards and codes of practice. In consequence, there is a 
continuously changing situation and a rather large number 
of codes, which may contain contradictory provisions. 

Some important British Standards on electrical protec¬ 
tion are given in Table 16.42. 

The relations between these standards are as follows. BS 
5345:1977- gives the overall philosophy of the use of elec¬ 
trical apparatus in flammable atmospheres. It supersedes 
the older code BS CP 1003: 1964-, which is obsolescent 
and is retained only for use with existing plants. BS 5345: 
Part 1 covers general recommendations and Part 2 covers 
hazardous area classification. 

The principles and specific methods of safeguarding are 
dealt with in BS 4683:1971-BS 5501:1977- andBS 5345: 
Parts 3-8. 

There are several other relevant UK codes. Of particular 
importance are the Institute of Petroleum (IP )Area Classifi¬ 
cation Code for Petroleum Installations (the IP Area Classifi¬ 
cation Code) (1990 MCSP Pt 15) and the Electrical Safety Code 
(1991 MCSP Pt 1). Another, older code is the ICI Electrical 
Installations in Flammable Atmospheres Code (the ICI Elec- 
tricalInstallations Code) (ICI/RoSPA 1972IS/91). 

US codes include NFPA 70: 2002 National Electrical Code 
and API RP 540:1991 Recommended Practice for Electrical 
Installations in Petroleum Processing Plants. 

The international standard in this field is the Interna¬ 
tional Electrotechnical Commission (IEC) Publication 79, 
Electrical Apparatus for Explosive Gas Atmospheres. 

Codes and standards for HAC, as distinct from safe¬ 
guarding, are given in the next section. 

Organizations in the UK, which are engaged in work in 
this field, include the Electrical Research Association 
(ERA) and the Electrical Equipment Certification Service 
(EECS). 


16.8.1 Hazardous area classification 

The basis for the control of electrical equipment to pre¬ 
vent its acting as a source of ignition is the classification 


of plant according to the degree of hazard. Originally this 
procedure was commonly termed the ‘electrical area 
classification’, but it is now known by the more compre¬ 
hensive term HAC, or classification of hazardous loca¬ 
tions (CHL). 

The definitions originally used in the United Kingdom 
for area classification and given in BS CP 1003:1964- are 
based on divisions: 

Division 0 An area or enclosed space within which any 
flammable or explosive substance, whether 
gas, vapour or volatile liquid, is continuously 
present in a concentration within the lower 
and upper limits of flammability 
Division 1 An area within which any flammable or 
explosive substance, whether gas, vapour 
or volatile liquid, is processed, handled or 
stored, and where during normal operations 
an explosive or ignitable concentration is 
likely to occur in sufficient quantity to pro¬ 
duce a hazard. 

Division 2 An area within which any flammable or 
explosive substance, whether gas, vapour or 
volatile liquid, although processed or stored, 
is so well under control that the production 
(or release) of an explosive or ignitable 
concentration in sufficient quantity to con¬ 
stitute a hazard is only likely to occur under 
abnormal conditions. 

These definitions have been replaced in BS 5501: Part 1: 
1977 and BS 5345: Part 1:1989 with the international defi¬ 
nitions of the IEC which are in terms of zones: 


Zone 0 A zone in which an explosive gas air mixture 
is continuously present or present for long 
periods. 

Zone 1 A zone in which an explosive gas—air mixture 

is likely to occur in normal operation. 

Zone 2 A zone in which an explosive gas—air mixture 

is not likely to occur in normal operation and if 
it occurs will only exist for a short time. 

Non- 

hazardous An area in which an explosive gas—air mix¬ 
ture is not expected to be present in quantities 
such as to require special precautions for the 
construction and use of electrical apparatus. 

The IP Area Classification Code also makes use of the 

following fluid categories: 


Fluid Category A 


Fluid Category B 


Fluid Category C 


Fluid Category G 


A flammable liquid that, on release, 
would vaporize rapidly and sub¬ 
stantially. 

A flammable liquid, not in Category A, 
but at a temperature sufficient for boil¬ 
ing to occur on release. 

A flammable liquid, not in Categories 
A and B, but which can, on release, be 
at a temperature above its flashpoint, 
or form a flammable mist. 

A flammable gas or vaopur. 


The code gives further guidance on assignment to 
Category A. 
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Table 16.42 Selected British Standards on electrical protection 


BS CP 1003:1964- 


BS 5345:1977- 


BS 229:1957 
BS 4137:1967 
BS 1259:1958 

BS CP 1013:1965 
BS 4683:1971- 


BS 5501:1977 


BS 6941:1988 


Electrical apparatus and associated equipment for use in explosive atmospheres of gas or 
vapour other than mining applications (obsolescent) 3 
Part 1:1964 Choice, installation and maintenance of flameproof equipment and 
intrinsically-safe equipment 

Part 2:1966 Methods of meeting the explosion hazard other than by use of flameproof or 
intrinsically-safe equipment 
Part 3:1967 Division 2 areas 

Code of practice for the selection, installation and maintenance of electrical apparatus for 
use in potentially explosive atmospheres (other than mining applications or explosive 
processing and manufacture) 

Part 1:1989 General recommendations 
Part 2:1983 Classification of hazardous areas 

Part 3:1979 Installation and maintenance requirements for electrical apparatus with type 
of protection‘d’. Flameproof enclosure 

Part 4:1977 Installation and maintenance requirements for electrical apparatus with type 
of protection‘i’. Intrinsically safe electrical apparatus and systems 
Part 5:1983 Installation and maintenance requirements for electrical apparatus protected 
by pressurization ‘p’ and by continuous dilution, and for pressurized rooms 
Part 6:1978 Recommendations for type of protection ‘e’. Increased safety 
Part 7:1979 Installation and maintenance requirements for electrical apparatus with type 
of protection N 

Part 8:1979 Installation and maintenance requirements for electrical apparatus with type 
of protection ‘s’. Special protection 

Specification. Flameproof enclosure of electrical apparatus (obsolescent) 

Guide to the selection of electrical equipment for use in Division 2 areas (obsolescent) 
Intrinsically safe electrical apparatus and circuits for use in explosive atmospheres 
(obsolescent) 

Grounding 

Specification for electrical apparatus for explosive atmospheres 
Part 1:1971 Classification of maximum surface temperatures 

Part 2:1971 The construction and testing of flameproof enclosures of electrical apparatus 
Part 3:1972 Type of protection N (withdrawn) 

Part 4:1973 Type of protection ‘e’ (obsolescent) 

Electrical apparatus for potentially explosive atmospheres 
Part 1:1977 General requirements 
Part 2:1977 Oil immersion ‘o’ 

Part 3:1977 Pressurized apparatus ‘p’ 

Part 4:1977 Powder filling ‘q’ 

Part 5:1977 Flameproof enclosure ‘d’ 

Part 6:1977 Increased safety ‘e’ 

Part 7:1977 Intrinsic safety ‘i’ 

Part 8:1988 Encapsulation ‘m’ 

Part 9:1982 Specification for intrinsically safe electrical systems ‘i’ 

Specification for electrical apparatus for explosive atmospheres with type of protection N 


a Obsolescent. Replaced by BS 5345:1977-, but retained temporarily as a reference guide for existing plants. 
b Obsolescent. 


In the USA, NFPA 70: 2002 gives in Article 500 the fol¬ 
lowing classification of hazardous locations: 

Class I in which the combustible material is a gas or 
vapour. 

Class II in which the combustible material is a dust. 

Class III in which the combustible material is a fibre or 
flying material. 


Each class is divided into Division 1 and Division 2, the 
distinction between the two being based on the frequency 
with which the substance may be present in the atmosphere. 

The CHLs given in API RP 500:1991 is essentially the 
same as that in NFPA 70, but with some change of wording: 


Class I A location in which flammable gases or 
vapours are, or may be, present in the air in 
quantities sufficient to produce explosive or 
ignitable mixtures. 

Division 1 A location is a location (1) in which ignitable 
concentration of flammable gases or vapours 
exist under normal operating conditions; (2) in 
which ignitable concentrations of such gases or 
vapours may exist frequently because of repair 

which breakdown or faulty operation of equip¬ 
ment or processes might release ignitable con¬ 
centrations of flammable gases or vapours, 
and might also cause simultaneous failure of 
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electrical equipment that could become a 
source of ignition. Division 2 location is a loca¬ 
tion (1) in which volatile flammable liquids or 
flammable gases are handled, processed or 
used, but in which the liquids, vapours or gases 
normally will be confined within closed con¬ 
tainers or closed systems from which they 
escape only in case of accidental rupture or 
breakdown of such containers or systems, or in 
case of abnormal operation of equipment; (2) in 
which ignitable concentrations of gases and 
vapours normally are prevented by positive 
ventilation, and that might become ignitable 
through failure or abnormal operation of the 
ventilating equipment; or (3) that are adjacent 
to a Class I, Division 1 location (and not sepa¬ 
rated by a tight-tight barrier), and to which 
ignitable concentrations of gases or vapours 
might occasionally be communicated unless 
such communication is prevented by adequate 
positive-pressure ventilation from a source of 
clean air, and effective safeguards against 
ventilation failure are provided. 

NFPA 497 M: 1997 gives a grouping of atmospheric 
mixtures. API RP 500 gives the following partial listing: 

Group A Atmospheres containing acetylene. 

Group B Atmospheres such as butadiene, EO, propylene 
oxide, acrolein, or hydrogen (or gases or vapours 
equivalent in hazard to hydrogen, such as cer¬ 
tain manufactured gases). 

Group C Atmospheres such as cyclopropane, ethyl ether, 
ethylene, hydrogen sulfide or gases or vapours 
of equivalent hazard. 

Group D Atmospheres such as acetone, alcohol, ammonia, 
benzene, butane, gasoline, hexane, lacquer sol¬ 
vent vapours, methane, naphtha, natural gas, pro¬ 
pane or gases or vapours of equivalent hazard. 

16.8.2 Safeguarding of equipment 

There are a number of methods available for the safe¬ 
guarding of electrical equipment so that it is suitable for 
use in a hazardous area, but it is a fundamental principle 
that electrical equipment should not be located in a hazar¬ 
dous area if it is practical to site it elsewhere. The methods 
of safeguarding traditionally used in the United Kingdom 
are listed in the ICI Electrical Installations Code as: 

(1) segregation; 

(2) flameproof enclosures; 

(3) intrinsically safe systems; 

(4) approved apparatus and apparatus with type of 
protection's’; 

(5) pressurizing and purging; 

(6) apparatus with type of protection *N’; 

(7) Division 2 approved apparatus; 

(8) apparatus with type of protection ‘e’; 

(9) non-sparking apparatus and totally enclosed 
apparatus; 

(10) apparatus for use in dust risks. 

The Code discusses these methods and their application. 

Reference is made to normally sparking, non-sparking 
and totally enclosed apparatus. The ICI Code describes 


these as follows. Normally sparking apparatus is that 
which in normal operation produces sparks, arcs or surface 
temperatures capable of igniting the flammable atmosphere. 
Non-sparking apparatus is that which in normal operation 
does not produce such sources of ignition, although it may do 
so as a result of electrical or mechanical failure. It includes 
Division 2 approved apparatus and apparatus with type of 
protection N. Examples of non-sparking apparatus include 
cage motors and solenoid valves. 

Totally enclosed apparatus is that contained in an enclo¬ 
sure, which renders the risk of entry of a flammable atmo¬ 
sphere small. Total enclosure is applied to lamp fittings. It 
may also be applied to non-sparking apparatus as an addi¬ 
tional safeguard. An example of the latter is a totally 
enclosed cage motor. 

The principle of segregation is the use of a fire-resistant 
impermeable barrier to create a lower risk zone or non- 
hazardous area where electrical equipment suitable for a 
lower classification can be used. An example is the use of a 
non-sparking motor in a Zone 2 area to drive a pump in a 
Zone 1 area, the two machines being connected by a shaft 
that passes through a gas-tight gland in a wall separating 
the two zones. 

The methods of protection given above are now supple¬ 
mented by a number of newer methods. 

The British Standards governing safeguarding of elec¬ 
trical apparatus are principally BS 4683:1971-, BS 5501: 
1977- and BS 5345: Part 1:1989. BS 229:1957 also applies, 
but is obsolescent. 

The certification of equipment is performed by the EECS. 
This body is the successor to the former British Approvals 
Service for Electrical Equipment in Flammable Atmo¬ 
spheres (BASEEFA). Guidance on the system operated by 
the EECS is given in EECG2 Electrical Equipment Certifica¬ 
tion Guide (1992). The EECS inherited from BASEEFA a 
system of SFA standards. As far as concerns the ‘types of 
protection’ described below, this system is now essentially 
obsolete, although some limited use is made of SFA 3009 for 
special protection ‘s’ and of SFA 3102 for intrinsic safety ‘i’. 

The overall procedure for selecting electrical apparatus 
for flammable atmospheres is described in BS 5345: Part 1: 
1989. The selection is made by establishing the zone type in 
which the apparatus is to be used and then selecting the 
appropriate apparatus on the basis of: 

(1) temperature classification; 

(2) apparatus group; 

(3) environmental conditions. 

There is a maximum surface temperature of the equipment, 
which should not be exceeded. This corresponds to the igni¬ 
tion temperature of the gases or vapours involved. The rela¬ 
tion between the apparatus ClassTand the maximum surface 
temperature are given in BS 5345: Part 1:1989 as follows: 


Class 

Maximum surface 
temperature (°C) 

T1 

450 

T2 

300 

T3 

200 

T4 

135 

T5 

100 

T6 

85 
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Apparatus is grouped according to the properties of the 
gases or vapours involved. BS 5345: Part 1:1989 divides 
apparatus into: Group I, apparatus for mines susceptible 
to firedamp; and Group II, apparatus for places with 
potentially explosive atmosphere, other than mines sus¬ 
ceptible to firedamp. In the present context it is only 
Group II that is of interest. This is itself is divided into 
subgroups. 

BS 5345: Part 1: 1989 lists the following relationships 
between representative gases and the group and subgroup 
classifications: 


Representative gas 

BS 55 01 a 

BS 4683 

BS 229 

BS 1259 

Methane 

I b 

I b 

I 

1 

Propane 

IIA 

IIA 

II 

2c 

Ethylene 

IIB 

IIB 

II 

2d 

Hydrogen 

IIC 

IIC 

IV 

2e 

Acetylene 

IIC 

Not 

allocated 

IV 

2f 

Carbon disulfide 

IIC 

Not 

allocated 

IV 

2f 


a Reference is to the then current edition of these standards. 
b For underground mining applications. 


For BS 229 the entries refer to the former gas groups and for 
BS 1259 to the former apparatus class. 

BS 5345: Part 1: 1989 gives data on the flammability 
characteristics of the common industrial gases. Most gases 
and vapours are classified in BS 5345: Part 1 as Group IIA. 

The allocation to apparatus subgroup in BS 5345: Part 1: 
1989 is on the basis of the MESG and/or minimum igniting 
current (MIC). 

These apparatus groups and subgroups and the method 
of allocation follow broadly that given in BS 5501: Part 1: 
1977. For flameproof enclosures the criterion is the MESG, 
which is related to the subdivision as follows: 


MESG (mm) 

Subdivision A 

>0.9 

Subdivision B 

0.5-0.9 

Subdivision C 

<0.5 

The MESG was described in 

i Section 16.2. For intrinsically 

safe apparatus the criterion 

is the MIC ratio, which is rela- 

ted to the subdivision as follows: 

MIC 

Subdivision A 

>0.8 

Subdivision B 

0.45-0.8 

Subdivision C 

<0.45 


The MIC is the ratio of the MIC for the gas or vapour to that 
for laboratory methane. A gas or vapour is assigned to a 
subdivision on the basis either of its MESG, of its MIC ratio, 
or both. 

The methods of safeguarding recognized in BS 5345: 
Part 1:1989 are shown in Table 16.43, which gives the defi¬ 
nitions for each type of protection and cross-references to 


other standards. Similar, but in some cases not identical 
definitions, are given in BS 4683:1971- and BS 5501:1977. 

Type of protection ‘d’ is a flameproof enclosure. The 
principle of a flameproof enclosure is that an explosion may 
occur in the enclosure, but a flame does not then travel hack 
through any opening. There are maximum permissible 
dimensions for an opening in a flameproof enclosure. The 
opening needs to be of sufficient length and construction to 
prevent the passage of flame. MESGs were discussed in 
Section 16.2. The equipment should be sufficiently robust 
to withstand an occasional explosion without distorting, 
otherwise the dimensions of the gap may increase above 
the safe level. Alteration of the internals of a flameproof 
enclosure is not allowed because of the possible hazard of 
pressure piling. 

Where a flameproof enclosure is exposed to wet weather 
it should be weatherproof. Weatherproofing is normally 
effected by the use of gasketed joints additional to and 
separate from the flame paths. For other apparatus suitable 
grease or tape is usually used. Protection against corrosion 
is also necessary in some applications. 

Flameproof enclosures are classified by T Class and by 
apparatus subgroup. The main example of flameproof 
enclosures is the casing of flameproof electric motors. 

Type of protection ‘i’ is intrinsically safe apparatus or 
system. The principle of intrinsic safety is that there is 
insufficient energy in the system to given incendive 
sparking or heating effects. 

Two categories of intrinsically safe system are recog¬ 
nized in BS 5345: Part 4: 1977- ia, suitable for use in 
hazardous areas including Zone 0; and ib, suitable for use 
in hazardous areas excluding Zone 0. 

In an intrinsically safe system it is necessary to take 
precautions to ensure that the power source of the system 
cannot release unsafe amounts of energy in the hazardous 
area and also that power from other sources cannot invade 
the system. There are thus requirements for insulation, 
grounding, screening, etc. 

There are two main types of intrinsically safe system. 
One has some parts in the hazardous area, but the power 
supply is in the non-hazardous area. With this method it is 
necessary not only that the equipments in both areas be 
intrinsically safe but also that they be matched so that 
the system also is intrinsically safe. The power supply 
should be such as not to overload the current-limiting 
devices. Where the power supply is from the mains, it is 
usually necessary to use an inviolate transformer. Current 
limitation is then effected by inviolate resistors. Alter¬ 
natively, barrier units may be used to limit both voltage 
and current. 

The other system has all parts in the hazardous area and 
has its own power supply such as a battery. This type of 
system may be a fixed installation or a portable apparatus. 
In the former case it should again be intrinsically safe as a 
system. 

It is particularly important with an intrinsically safe 
system that the system is not used outside the scope of the 
certification. Intrinsically safe systems are classified by 
T Class and by apparatus subgroup. 

Since the minimum ignition energy of flammable 
mixtures is very small, this method of safeguarding is 
applicable only to low power systems, in particular instru¬ 
mentation. Examples of intrinsically safe systems include 
instrument systems and portable gas detectors. Further 
information is given in Intrinsic Safety by Redding (1971a). 
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Table 16.43 Types of electrical protection in BS 5345: 1989 (Reproduced by permission of the British Standards 
Institution) 

Type of protection 

Title 

Description 

d 

Flameproof 

enclosure 

A method of protection where the enclosure for electrical apparatus 
will withstand an internal explosion of the flammable gas or vapour 
(for which it is designed) that may enter it, without suffering damage 
and without communicating the internal flame to the explosive 
atmosphere for which it is designed, through any joints or structural 
openings in the enclosure 


Intrinsically safe 
apparatus or system 

A protection technique based upon the restriction of electrical energy 
within apparatus and in the interconnecting wiring, exposed to a 
potentially explosive atmosphere, to a level below that which can 
cause ignition by either sparking or heating effects. Because of the 
method hy which intrinsic safety is achieved it is necessary that not 
only the electrical apparatus exposed to the potentially explosive 
atmosphere, but also other (associated) electrical apparatus with 
which it is interconnected, is suitably constructed. 

P 

Pressurization, 
continuous dilution 
and pressurized 
rooms 

A method of protection using the pressure of a protective gas to 
prevent the ingress of an explosive atmosphere to a space that may 
contain a source of ignition and, where necessary, using continuous 
dilution of an atmosphere within a space that contains a source of 
emission of gas, which may form an explosive atmosphere 

e 

Increased safety 

A method of protection by which additional measures are applied to 
an electrical apparatus to give increased security against the 
possibility of excessive temperatures and of the occurrence of arcs 
and sparks during the service life of the apparatus. It applies only to 
an electrical apparatus, no parts of which produce sparks or arcs or 
exceed the limiting temperature 1 in normal service 

N 

Type of protection N 

A type of protection applied to an electrical apparatus such that, in 
normal operation, it is not capable of igniting a surrounding explosive 
atmosphere, and a fault capable of causing ignition is not likely to 

' 

Special protection 

A concept for those types of electrical apparatus that, by their nature, 
do not comply with the constructional or other requirements specified 
for apparatus with established types of protection, but that 
nevertheless can be shown, where necessary by test, to be suitable for 
use in hazardous areas in prescribed zones 

0 

Oil immersion 

A method of protection where electrical apparatus is made safe by oil 
immersion in the sense that an explosive atmosphere above the oil or 
outside the enclosure will not be ignited 

q 

Powder/sand filling 

A method of protection where the enclosure of electrical apparatus is 
filled with a mass of granular material such that, if an arc occurs, the 
arc will not be liable to ignite the outer flammable atmosphere 

m 

Encapsulation 

A type of protection in which parts that could ignite an explosive 
atmosphere by either sparking or heating are enclosed in a compound 
in such a way that this explosive atmosphere cannot be ignited 


a Limiting temperature is defined in BS 5345: Part 6:1976. 


Type of protection ‘p’ is pressurization, continuous dilu¬ 
tion and purging. Pressurizing and purging are used to 
control the atmosphere in a room or apparatus. Such control 
allows the safe use of electrical apparatus which otherwise 
would be hazardous. 

In pressurizing, a positive pressure of air or inert gas is 
maintained in the enclosure so that the flammable material 
cannot enter. In purging, a flow of air or inert gas is main¬ 
tained through the enclosure so that a flammable atmo¬ 
sphere does not form. Sometimes a combination of 
pressurization and purging may be employed. 


Mechanical ventilation may be used for pressurization 
and purging. In the latter case the ventilation may be a 
forced or induced draught. Alternatively, an air or gas sup¬ 
ply may be used. 

Air is a suitable pressurizing medium and is generally 
preferable to inert gas, because it does not constitute an 
asphyxiation hazard. For purging, inert gas provides a 
higher degree of protection against flammability hazard 
and is suitable for small enclosures, but air is preferable for 
large enclosures and rooms on account of the asphyxiation 
hazard. The source of air or inert gas should be free of 
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flammables and should be reliable. It may be necessary to 
clean and/or dry the air or inert gas. 

It is recommended in BS 5501: Part 3: 1977 that the 
minimum overpressure in a pressurized enclosure should 
be 0.5 m bar. 

The ICI Code states that pressurizing is not suitable for 
Zone 0. For Zone 1 with normally sparking apparatus there 
should be a pressure failure interlock and alarm. The 
interlock should disconnect the electrical supply on failure 
of pressure, except where this could create a hazardous 
condition, in which case other precautions are necessary. 
For Zone 1 with non-sparking apparatus and for Zone 2 
with normally sparking apparatus there should be a pres¬ 
sure alarm. The action to be taken on failure of purging 
requires consideration of the particular circumstances. 

Further details of pressurizing and purging, including 
monitoring systems, room and enclosure design, piping 
and ducting design and auxiliary apparatus are given in 
BS 5345: Part 5:1983 and in the ICI Code. 

Examples of enclosures, which may be pressurized with 
air or inert gas, are a totally enclosed motor and an 
instrument cubicle. Also a control room is often fitted 
with double doors, forming an air lock, and pressurized 
with air. Examples of enclosures that may be purged or 
pressurized/purged are rooms or instrument cubicles 
containing instruments analyzing flammable gas. 

Type of protection N is defined in terms of the degree of 
protection achieved rather than of the particular means by 
which this is done. The general characteristics of such 
apparatus are that under normal operation it does not pro¬ 
duce an arc or spark except where the latter occurs in an 
enclosed break device, has insufficient energy to cause 
ignition of a flammable atmosphere or occurs in a herme¬ 
tically sealed device and does not develop a surface tem¬ 
perature capable of igniting a flammable atmosphere. 

Apparatus with type of protection N complies with 
another British Standard that specifies this type of pro¬ 
tection, e.g. BS 5000: Part 16:1985 for motors. 

Guidance on the construction and testing for type of 
protection N is given in BS 6981:1988. 

Before the introduction of type of protection N, apparatus 
could be submitted to HM Factories Inspectorate (HMFI) for 
approval for use in Division 2 applications, the basis of 
examination being BS 4137: 1967 Guide to the Selection of 
Electrical Equipment for Use in Division 2 Areas. If an appa¬ 
ratus was considered suitable for use in a Division 2 area, 
HMFI issued a letter to this effect and the apparatus was then 
commonly referred to as ‘Division 2 approved’. 

Type of protection ‘e’ is again defined in terms of the 
degree of protection achieved. It has features in common 
with type of protection N, but is more stringent. Apparatus 
with type of protection ‘e’ complies with BS 5501: Part 6: 
1977. 

Special protection ‘s’ deals with ‘approved’ apparatus. 
This is equipment for which there is no specific British 
Standard. It is covered instead by the approval system. 

‘Approved’ apparatus is that which has been approved for 
use in flammable atmospheres by HMFI. This approval 
system operated up to 1969, the list of approved equipment 
being given in HMSO Form F931 Intrinsically Safe and 
‘Approved’ Electrical Apparatus. This was subsequently 
superseded by certification as special protection ‘s’ in 
accordance first with BASEEFA Certification Standard 
SFA 3009 and then with the EECS certification system. 


Apparatus with type of protection ‘s’ is classified byT Class 
and by apparatus subgroup. Examples of approved equip¬ 
ment include compressed air-driven generator and lamp 
sets, and battery handlamps. 

Before the introduction of ‘Division 2 approved’ appara¬ 
tus and apparatus with type of protection N, use was made 
in Division 2 areas of non-sparking apparatus and of 
totally enclosed apparatus. 

There are three other types of protection recognized in 
BS 5345: Part 1:1989. These are oil immersion V, powder/ 
sand filling ‘q’ and encapsulation ‘m’. Compounds used for 
encapsulation include thermosetting, thermoplastic and 
elastomeric compounds. 

There is much less guidance on dust risks, but some is 
given in the ICI Code. For dusts the most widely used 
method of safeguarding is a combination of (1) enclosure of 
apparatus and (2) elimination of hot surfaces. 

The apparatus is enclosed so as to limit the amount of 
dust that can come in contact with sources of ignition and it 
is designed so that in normal operation its surface tem¬ 
perature does not exceed the ignition temperature of the 
dust in cloud or layer form. Other methods that may be used 
with dust risks include segregation, intrinsically safe sys¬ 
tems and pressurizing or purging. 

There are certain general precautions that should be 
taken with all the methods of safeguarding described. 
Apparatus should be used only for the purpose for which 
it has been designed and certified. It should not be altered 
by modification. It should not be allowed to deteriorate 
due to weather or corrosion. It should be properly main¬ 
tained. 

BS 5345: Part 1:1989 gives a scheme for the selection of 
apparatus and systems, as shown in Table 16.44. Intrinsic 
safety is applied in all zones, but the type used should be 
suitableforthezone.Thesameappliestospecialprotection's’. 
The principal application of flameproof enclosures is in 
Zone 1. Pressurization and purging is applicable in Zones 1 
and 2. Of the methods involving enhanced safety, type of 
protection ‘e’ is suitable for Zones 1 and 2, while type of 
protection N is suitable for Zone 2. 

Other aspects of electrical systems in flammable atmo¬ 
spheres include: the installation of electrical equipment, 
particularly cabling; the inspection and maintenance of 
equipment; and electronic instrumentation. These are 
treated in detail in BS 4683:1971-, BS 5501:1977 and the 
ICI Code. 

16.8.3 Electrical surface heating 

The methods of safeguarding described above have been 
developed primarily for equipment such as electric motors 
and electronic instruments in which heating is undesirable. 
Their application to apparatus the prime purpose of which 
is heating requires separate treatment. 

Electrical surface heating (ESH) is widely used in pro¬ 
cess plants and constitutes another potential source of 
ignition. 

Types of heater used include (1) flexible heaters (fabric, 
braid, mesh), (2) heating cable, (3) panel heaters and 
(4) parallel circuitry heaters. The latter are often purpose 
made and may be in panel, mantle or jacket form. 

An account of the design of electrical surface heaters for 
use in hazardous areas has been given by Dobie, Cunning¬ 
ham and Reid (1976). Their approach to safeguarding is to 
design the apparatus so that for a given workpiece surface 
temperature (e.g. pipe temperature) the maximum linear 
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Table 16.44 Selection of methods of safeguarding 
electric apparatus in hazardous areas in BS 5345: 1989 
(Reproduced by permission of the British Standards 
Institution) 


Zone 

Type of protection 

Part of 
BS5345 

0 

‘ia’ Intrinsically safe apparatus 
or system 

4 


‘s’ Special protection (specifically 
certified for use in Zone 0) 

8 

1 

Any explosion protection 
suitable for Zone 0 and: 



‘d’ Flammable enclosure 

3 


‘ib’ Intrinsically safe apparatus or 
system 

4 


‘p’ Pressurization, continuous 
dilution and pressurized rooms 

5 


‘e’ Increased safety 

6 


‘s’ Special protection 

8 

2 

Any explosion protection 
suitable for Zones 0 or 1 and: 



ISP Type of protection N b 

7 


‘o’ Oil-immersion 

9 C 


‘q’ Sandfilling d 

9 C 


a Alternatively, apparatus that in normal operation is not capable of 
producing ignition capable arcs, sparks or surface temperatures may 
also be acceptable for use in Zone 2 where it has been assessed by 

(a) be familiar with the requirements of any relevant standards and 
codes of practice and their current interpretations; 

(c) where necessary, utilize similar test apparatus and test proce¬ 
dures to those used by recognized testing stations. 
b Whereas in BS 6941 the type of protection is known as type N, in IEC 
publication 7915 it is designated type ‘n’; 
c In preparation. 

“The use of apparatus with type of protection ‘q’ in Zone 1 is under 


power loading (W/m) cannot give an element surface tem¬ 
perature in excess of the ignition temperature of the flam¬ 
mable atmospheres as given in BS 4683: Part 1:1971. The 
equipment is also designed so as not to give rise to hazards 
from arcs and sparks. 

Guidance on EHS devices, including their use in hazar¬ 
dous areas, is given in BS 6351 Electrical Surface Heating, of 
which Part 1: 1983 deals with specification, Part 2: 1983 
deals with design and Part 3:1983 deals with installation, 
testing and maintenance. Part 1 requires that an ESH 
device for use in a hazardous area should inter alia: 
(1) comply with type of protection‘e’, N,‘d’,‘s’,‘m’or <p’- (2) be 
assigned a temperature classification; (3) be given a type 
test to establish the maximum surface temperature; and 
(4) comply with respect to the terminations and markings 
with specified in British Standards. Procedures are given 
for type testing, a distinction being made between ESH 
devices that have self-limiting characteristics and those 
that do not. 

BS 6351: Part 2: 1983 sets certain minimum safety 
requirements for all ESH devices. It gives a system of 
service categories with a two-digit code, the first digit 
indicating the probability of the presence of water and 


the second the risk of mechanical damage. 0 denotes no 
risk, 1 low risk and 2 high risk: thus, for example, a cod¬ 
ing of 00 denotes no risk in both categories and one of 22 
high risk in both categories. The principal requirements 
referred to are (1) overcurrent protection, (2) residual 
current protection with trip indication, (3) means of iso¬ 
lation and (4) overtemperature limitation. Overcurrent 
protection and means of isolation are required for all ESH 
devices. For types of protection N and ‘e’ all four require¬ 
ments apply. 

Part 3 states isolation and permit-to-work requirements. 

Further recommendations for ESH are given in the ICI 
Electrical Installations Code. 


16.9 Hazardous Area Classification 

The exclusion of sources of ignition is effected on process 
plant by a system of HAC. The principles of HAC have been 
outlined in Chapter 10 in relation to plant layout. In this 
section consideration is given to the application of these 
principles. 

Hazardous area classification is the subject of a number 
of codes and standards. These include BS 5345 Code of 
Practice for the Selection, Installation and Maintenance of 
Apparatus for Use in Potentially Explosive Atmospheres 
(Other than Mining Applications or Explosive Processing 
and Manufacture), including Part 1: 1989 General Recom¬ 
mendations and, in particular, Part 2:1983 (1990) Classifi¬ 
cation of Hazardous Areas. Other relevant British 
Standards have been given in Section 16.8. Influential 
codes have been those of the successive IP codes and the ICI 
Electrical Installations in Flammable Atmospheres Code (the 
ICI Electrical Installations Code) (ICI/RoSPA 1972IS/91). 
The current IP code is Area Classification Code for Petro¬ 
leum Installations (the IP Area Classification Code) (1990 
MCSP15). 

In the USA, NFPA codes include NFPA 70: 2002 National 
Electrical Code, NFPA 497:1997 Classification of Flammable 
Liquids, Gases, or Vapors and of Hazardous (Classified) 
Locations for Electrical Installations in Chemical Process 
Areas. API RP 500:1991 Recommended Practice for Classi¬ 
fication of Locations for Electrical Installations at Petroleum 
Facilities consolidates previous separate codes (RP 500A, 
500B and 500C). 

Other accounts of HAC include Classification of Hazar¬ 
dous Locations (AW. Cox, Lees and Ang, 1990) and those by 
Swann (1957,1959), Levine (1965a,b, 1968a,b, 1972a, 1983), 
Magison (1966,1975,1978), Burgoyne (1967b, 1969,1971), 
Bartels (1971a, 1975a,c, 1977-), O’Shea (1982), Palles-Clark 
(1982), Peck and Palles-Clark (1982), Fordham Cooper 
(1986) and Mecklenburgh (1986). 

Electrical safety and HAC has been the subject of a series 
of symposia by the IEE (1971,1975,1982,1988 Conf. Pubis 
74,134,218 and 296, respectively; 1982 Coll. Dig 82/26). 

Traditionally, HAC has centred around electrical equip¬ 
ment and has been the province of electrical engineers. 
Electric motors, instruments and other electrical equip¬ 
ment have to be present on plant, but may constitute 
potential sources of ignition. It is necessary, therefore, to 
assess the ignition risk and to match the equipment to it. 
This has been done by a system of area classification. 

As already described, however, there are many other 
potential ignition sources on plant and a more balanced 
approach is called for. The modern approach to HAC 
involves the control of all sources of ignition and deals not 
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only with design but also with activities such as operation 
and maintenance. There is a tendency for chemical engi¬ 
neers to be much more involved. 

16.9.1 Hazardous area classification systems 

The HAC system currently applicable in the United King¬ 
dom is that of the IEC and is outlined in Chapter 10 and in 
Section 16.8 where accounts are given of the system of 
zones used (Zone 0, Zone 1 and Zone 2) together with defi¬ 
nitions of these zones. 

In the United States, two principal systems are those 
of the NFPA and the API, which are also described in 
Section 16.8. 

16.9.2 ICI Electrical Installations Code 

The ICI Electrical Installations in Flammable Atmospheres 
Code (the ICI Electrical Installations Code) (ICI/RoSPA 
1972IS/91) describes the two basic methods of HAC: (1) the 
generalized method and (2) the source of hazard method. It 
remains a principal guide for the latter. Classification of 
electrical areas is not an exact science and inevitably 
involves a degree of judgment. There are, however, a num¬ 
ber of guidelines available. 

The terms ‘normal’ and ‘abnormal’ require some inter¬ 
pretation. Normal conditions should be taken to be not ideal 
but real conditions as they actually exist, taking into 
account the precautions that are taken on a well-run plant. 
Abnormal conditions should be read to refer not to cata¬ 
strophic accidents such as a major equipment rupture but 
to events that are generally non-catastrophic such as a 
pump gland or pipe gasket failure. 

The stages of the classification process are (1) identifi¬ 
cation of the hazard, (2) assessment of the hazard, and 
(3) delineation of the zone. The classification should be 
comprehensive. An area where flammable materials are not 
to be handled is non-hazardous, but this status should be 
formally established. 

A basic distinction is between (1) well-ventilated loca¬ 
tions and (2) poorly ventilated locations. Ventilation is here 
interpreted in a broad sense and covers the whole question 
of the dispersion of vapours and liquids from leaks and 
spillages. Thus it is necessary to consider how much flam¬ 
mable material may escape, whether an escape is con¬ 
tinuous or not, whether it is lighter or heavier than air, 
whether there may be jet effects, whether the liquid may 
travel outside the area on the surface of water on the ground 
or in drains or pipe trenches, and what the influence of the 
plant topography is. 

There are two basic approaches to area classification. 
These are (1) the generalized method and (2) the source of 
hazard method. The generalized method is the older and 
involves making a judgment on the appropriate classifica¬ 
tion for a fairly large area of plant. 

The ICI Code gives guidance for both the generalized and 
source of hazard methods. For the former a Zone 0 classi¬ 
fication is necessary for locations such as vapour spaces in 
closed storage tanks or closed process vessels in which a 
flammable atmosphere may exist continuously or for long 
periods and immediately above an open tank or vessel 
containing a flammable liquid. Locations where in normal 
operation there may be release of flammable materials suf¬ 
ficient to cause a hazard either from relief valves or vents 
designed to make such release or from other sources such 
as vessels, pumps or pipes, should be classified as Zone 1. 
Classification as Zone 2 is acceptable provided that there 


are no releases in normal operation of flammable materials 
sufficient to cause a hazard, that relief valves and vents 
release flammable materials only under abnormal condi¬ 
tions and that the area is well drained and ventilated so that 
any abnormal occurrence of a flammable atmosphere is 
rapidly dispersed. 

The Code states that it is characteristic of the general¬ 
ized method that it gives a large Zone l.The typical pattern 
is as follows. An area somewhat larger than that occupied 
by the process equipment is classified as either Zone 1 or 
Zone 2. If it is Zone 1, it may or may not be surrounded by 
a Zone 2. There may be isolated Zones 0 within a Zone 1 or a 
Zone 2. 

While this blanket application of a Zone 1 classification 
is in itself conservative, it is also expensive, and there may 
be a tendency, which should be guarded against, to ignore a 
few high hazard points and classify as Zone 2 an area that 
should be Zone 1. 

The source of hazard method is the newer approach and 
involves identifying, assessing and delineating affected 
areas for individual sources of hazard. The latter are clas¬ 
sified according to the expected frequency and period of 
release of flammable materials. The classification together 
with the suggested quantitative guidelines is as tabulated 
below: 


Source of 
hazard 

Period of release 

Frequency 

(hazards/year) 

0 (Continuous) 

Long periods 

>1000 

1 (Primary) 

Frequent or if 

10-1000 


infrequent persistent 

2 (Secondary) 

Infrequent and of 

<10 


short duration 



The characteristic area classification yielded by the source 
of hazard method is predominantly Zone 2 with small iso¬ 
lated Zones 1. Zones 0 may also occur in either Zones 1 or 
Zones 2. 

In a well-ventilated situation the extent of the zone is 
determined essentially in both methods by the distance at 
which it is judged that the flammable atmosphere will fall 
below its LFL. 

In a poorly ventilated situation it is necessary to pay 
particular attention to the following aspects: 

(1) sources of hazard which are continuous should be 
avoided or provided with special ventilation; 

(2) each room in a building should be given separate con¬ 
sideration for possible sources of hazard; 

(3) mobile sources of hazard should be taken into account; 

(4) spillage hazards associated with portable or trans¬ 
portable vessels or open handling of liquids should be 
taken into account. 

For a room which does not contain a source of hazard the 
classification depends on the probability of flammable 
materials entering the room and on the ventilation and may 
be Zone 1, Zone 2 or non-hazardous. In general, mechanical 
ventilation may be used as a means of modifying the clas¬ 
sification for an enclosed space. 

The extent of a zone in a poorly ventilated situation is 
again determined for both methods essentially by the dil¬ 
ution of the flammable atmosphere below its flammability 
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limit. In confined situations, however, even the source of 
hazard method tends frequently to lead to Zone 1 classifi¬ 
cations, so that there is less difference between the two 
methods in this case. 

Some area classifications are illustrated in Figures 16.63 
and 16.64. Figure 16.63(a) shows a classification for a reci¬ 
procating or centrifugal compressor handling a gas lighter 
than air (e.g. hydrogen or fuel gas) in a building with open 
sides and ventilation. There is a Zone 1 around the com¬ 
pressor. For a reciprocating compressor this Zone 1 is a 
sphere of 0.5 m radius all round the gland, cylinder, and 
frequently operated drain points or vents, and for a cen¬ 
trifugal compressor it is a sphere of 0.5 m radius all round 
the seal and a sphere of 1 m radius around the seal-oil tank 
cover and vent and around seal-oil traps. Figure 16.63(b) 
shows a classification for a reciprocating or centrifugal 
compressor handling a gas that is heavier than air (e.g. 
ethylene or propylene refrigerants). The Zones 1 are the 
same as for the previous case. Figures 16.64(a) and (b) 
show, respectively, classifications for a fixed roof and a 
floating roof storage tank for a flammable liquid with a 
flashpoint below 32°C. 

The ICI Code also deals with area classification for 
flammable dusts. The basic principles of classification are 
similar to those for flammable gases and liquids, but it is 
recognized that the behaviour of dusts is generally rather 
less predictable. 

The definition of the zones in the ICI Code includes dusts 
and has already been given. In this case the source of 
hazard method is less useful and the generalized method is 
usually more appropriate. 

Since dust presents a hazard in layer as well as in cloud 
form, it is necessary, irrespective of the area classification, 
to ensure that any surface on which dust can settle is below 
the ignition temperature of the dust in layer form. In 
exceptional cases where a surface temperature higher than 
the ignition temperature of the dust is required for process 
reasons, the equipment should be designed and operated so 
as to prevent the accumulation of dust on its surface and the 
formation of dust clouds. 


16.9.3 IP Area Classification Code 

The IP Area Classification Code for Petroleum Installations 
(the IP Area Classification Code) (1990 MCSP Pt 15) is writ¬ 
ten for petroleum installations, but the principles are of 
wider applicability. The code utilizes the IP classification of 
fluids given in Chapter 10 and the British Standard classi¬ 
fication of hazardous locations and IP grouping of atmo¬ 
spheric mixtures given in Section 16.8. The principal 
contents of the code are listed in Table 16.45 and its appli¬ 
cation is shown in Figure 16.65. 

The code emphasizes that HAC is not intended to deal 
with catastrophic events, but with more commonly occur¬ 
ring releases. In the design of new plant, or in plant mod¬ 
ification, HAC should be carried out before the design and 
layout are finalized, and reviewed again on completion of 
the design. 

The code describes two methods of HAC: (1) the method 
of direct example and (2) the point source method. 

Information required 

The information required for the conduct of HAC includes 
(1) the classification of the fluid(s), (2) the flow diagram, 
(3) the piping and instrument diagram, (4) the plant layout, 


(5) the equipment features, including operation and (6) the 
ventilation. 

Classification of petroleum fluids 

Petroleum fluids are classified by flashpoint. The code 
gives in Appendix A details of the IP classification by 
flashpoint. This classification system is described in 
Chapter 10. Fluids are classed as Class 0 (LPG); Class I; 
Class 11(1) or 11(2); Class III(l) or 111(2); and Unclassified. 

A further, supplementary classification by fluid cate¬ 
gory, utilized in the point source method, is given in the 
code in Appendix B. This categorization has been descri¬ 
bed in Section 16.8. 

General approach 

The general approach, described in the Chapters 1 and 2 of 
the IP Code , is to identify the sources and grades of release, 
and then to assign the appropriate zones. The grades of 
release are defined as: 


Continuous grade 
release 

Primary grade 
release 

Secondary grade 
release 


A release that is continuous or nearly 
so, or that occurs for short periods 
that occur frequently 
A release that is likely to occur 
periodically or occasionally in normal 
operation 

A release that is unlikely to occur in 
normal operation and, in any event, 
will do so only infrequently and for 
short periods 


The grade of release reflects the frequency and duration of 
the release. 

The Code gives the following rule of thumb to assist in 
the assignment of the grade of release. A release should be 
treated as continuous if it is likely to be present for more 
than 1000 h/year, as primary if present for more than 10 but 
less than 1000 h/year and as secondary if present for less 
than 10 h/year. 

For open-air conditions, there is a direct relation between 
the grade of release and the type of zone to which it gives 
rise, the continuous grade corresponding to Zone 0, the 
primary grade to Zone 1 and the secondary grade to Zone 2. 
However, this relationship applies only where the ventila¬ 
tion corresponds to unrestricted open locations with good 
natural ventilation. Poor ventilation may require the use of 
a more stringent zone, while very good ventilation may 
allow a relaxation to a less stringent one. There are certain 
guiding principles that govern HAC. 

Where a number of fluids are handled, as in storage and 
loading/unloading facilities, the classification should be 
based on the most volatile. 

The identification of sources of continuous and primary 
grade releases, and the delineation of Zones 0 and 1, should 
be as complete as possible. Many plant areas are designated 
as Zone 2. Particular attention should be given to sources of 
secondary grade releases at the edge of the plant, since 
these will tend to define the extent of the Zone 2. In some 
cases it is not practical to determine a blanket Zone 2 and 
the secondary grade sources, or groups of sources, must 
then be addressed individually. A Zone 1 area will often 
be surrounded in practice by a Zone 2 area, but there is 
no general requirement for this. Within a hazardous area, 
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Figure 16.63 Hazardous area classification - ICI Electrical Installations Code (Imperial Chemical Industries Ltd, id/ 
RoSPA 1972IS/91; reproduced with permission): zoning for a reciprocating or centrifugal compressor handling flammable 
gas in building with open sides and roof ventilation: (a) compressor handling a lighter than air gas; (b) compressor handling 
a heavier than air gas. Extentof Zone 2: for gases heavier than air, up to 30 bar, upto 100° C (e.g. ethylene and propylene 
refrigerants), A is 15m; for supercritical ethylene, upto 10Obar, A is 30m; dimension H is 3m or height of the wall opening, 
whichever is the greater 
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(b) 

Figure 16.64 Hazardous area classification - ICI Electrical Installations Code (Imperial Chemical Industries Ltd, ICI/ 
RoSPA 19721S/91; reproduced with permission): zoning for a storage tank holding a flammable liquid with flash point 
below 32° C: (a) fixed roof tank; (b) floating roof tank. Extent of Zones 1 and 2: fora tank with capacity greater than 50 m 3 , A 
is 3 m and for a tank with smaller capacity A is 1.5 m; Zone 2 extends Bm minimum from the tank side and C m minimum 
from the bund. For a tank with capacity greater than 100 m 3 B and Care 15 and 5 m respectively; for a tank with a capacity 
between 50 m 3 smaller distances may be appropriate 


the designation of small areas as non-hazardous should be 
avoided. HAC is not sufficiently precise to warrant this. 


Classification by method of direct example 

The basic method of classification, the method of direct 

example, is described in Chapter 3 of the IP Code. 


There are on petroleum installations some arrangements 
of equipment, which are so common that it is possible to 
give exemplars of the zonings to be used. The zoning of 
the relevant exemplar is applicable to an installation that 
does not differ significantly from it. Differences that may 
be significant may be associated with the fluid, the type 
of equipment, the operating conditions, the plant layout 
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Table 16.45 Principal contents of the IP Area Classifi¬ 
cation Code (IP, 1990 MCSP Pt 15) 


1. Introduction 

2. The technique of HAC 

3. The classification of storage tankage, bulk loading 
and unloading by road and rail, petroleum jetties, and 
bulk distribution and marketing facilities by the 
method of direct example 

4. The classification of drilling rigs and other equipment 
systems used in well operations and production 
wellhead areas 

5. Alternative procedure for classification of an upstream 
or downstream petroleum sector facility by 
consideration of the individual point source 

6. Variation in ventilation conditions 

7. Application to the selection and location of electrical 
facilities 

8. Application to the control and location of ignition 
sources other than electrical 


and/or the ventilation. If a significant difference exists, use 
should be made of the point source method. 

For this method examples are given for Classes 1,11(2) 
and 111(2) for: (1) storage tanks, both fixed and floating roof, 
in the open, (2) road tanker loading, (3) road tanker dis¬ 
charge, (4) rail car loading, (5) marine facilities and jetties, 
(6) drum filling in the open, (7) filling and service stations 
and (8) certain bulk pressurized liquefied petroleum gas 
(LPG) installations. 

Figure 16.66 shows the zoning recommended in the code 
for four storage tank configurations. Figure 16.66(a) is a 
cone or dome roof tank; Figure 16.66(b) a floating roof tank; 
Figure 16.66(c) a cone roof tank with an outer protective 
wall; and Figure 16.66(d) a floating roof tank with an outer 
protective wall. 

Chapter 4 of the code extends the method of direct 
example by giving exemplars for drilling rigs and other 
petroleum production systems. 

Classification by point source method 

The alternative method of classification, the point source 

method, is described in Chapter 5 of the IP Code. 

The process plant will generally consist of a Zone 2 area 
with Zone 1, and occasionally Zone 0, areas within this. The 
point source method is applied to potential sources of 
release to determine for each whether it should be assigned 
a Zone 1 or Zone 0 envelope and whether it affects the 
boundary of the Zone 2 area. 

The method involves identifying for each point source 
(1) the grade of release and (2) the extent of the hazard zone, 
or hazard radius. 

The grade of release determines the zone to be assigned: 
Zone 0 for continuous grade, Zone 1 for primary and Zone 0 
for secondary for open air conditions, with adjustment of 
the severity of the zone for poor or very good ventilation. 

The extent of the hazard zone is determined by the mass 
released and the fraction forming a gas or vapour cloud and 
by the conditions, which affect the dispersalofthecloudthat 
is its buoyancy and the ventilation at that location. The 
hazard zone is characterized in terms of the hazard radius. 
The hazard radius of a source is defined as ‘the largest 
horizontal extent of the hazardous area which is generated 


by the source when situated in an open area’. The Code gives 
guidance in Appendix C on the assessment of buoyancy and 
in Appendix D on the derivation of the hazard radius. 

TheCodetreatsanumberofcommontypesofpointsource, 
including the following: (1) pumps, (2) compressors, (3) pip¬ 
ing systems, (4) drains and liquid sample points, (5) process 
and instrument vents, (6) liquid pools due to spillage, 
(7) sumps, interceptors and separators, (8) pig receivers and 
launchers and (9) surface water drainage systems. 

The general approach taken is illustrated by the following 
examples. For pumps, for the case where the pump can be trea¬ 
ted as a single point source, the hazard radius (m) is given as: 


Fluid 

category 

Standard 

pump 

High integrity 
pump 

A 

30 

7.5 

B 

15 

3 

C 

7.5 a 

3 

a For clean fluids, e.g. 

finished products which 

are pumped from 

atmospheric storage at 



radius may be reduced to 3 m. 


For drains and liquid sample points the hazard radius 
(m) is: 

Fluid category 

Diameter * (mm) 


3 6 

12 25 

A 

7.5 15 

30 - b 

B 

3 7.5 

15 30 

C 

0.3 1.5 

1.5 3 

a Diameter of smallest i 
restrictor. 

tem on drain or sample lim 

e,i.e. line, valve or 

“The size of release is greater than is normally cons 

iidered in HAC, the 


hazard radius being greater than 30 m. 

Elimination or modification of sources 
As far as practical, features that pose problems in HAC 
should be eliminated or mitigated by changes in plant 
layout. In particular, (1) continuous or primary grades 
releases in less ventilated conditions should be avoided and 
(2) the creation of sheltered areas by obstructions should be 
minimized. 

Ventilation 

As the foregoing treatment indicates, ventilation affects 
the extent of the hazard zone. For artificial ventilation it 
may also affect the severity of the zone. 

The IP Code takes as it starting point the types of venti¬ 
lation given in IEC 79-10, which are (1) natural ventilation, 
(2) general artificial ventilation and (3) local artificial 
ventilation. IEC 79-10 recognizes two situations in which 
natural ventilation occurs. These are (1) open locations 
typical of process plant located outside and (2) open build¬ 
ings in which the size and positioning of the openings is 
such as to give an equivalent degree of ventilation. 

The IP Code treats ventilation in terms of the following 
situations: (1) ‘open areas’, (2) less ventilated conditions, 
which include (2a) sheltered areas and (2b) enclosed areas. 
The Code gives detailed guidance on what can be considered 
an open area. Essentially this is an open situation, which for 
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Familiarize concepts/definitions of area classification in Chapter 1 (1.1 to 1.9). 

Define installation/plant/process sections {2.212.3). 

Is quantity of flammable material that may be released sufficient to require classification? 


Section 2.10(g) 

I 


Class I, II, III or 
Unclassified 
(2.12.1 to 2.12.5) 


Class I, 11(2) or 111(2) Class 11(1) or 111(1) 

(2.12.1/2.12.4) (2.12.3) 

(Release flammable) I 


Is facility of common type as in 2.6? 
Check no significant differences in layout 
ventilation, etc., from type examples in 
Chapter 3 or 4 


Consider other safety 

precautions - 

nevertheless 


Apply point-source method of Chapter 5 
(see Figure 1.2 for details) 


2.6 confirmed. Apply Chapter 3 
for storage/distribution or 
Chapter 4 for drilling/workover 


6. 


Grade of release, zone number, buoyancy 
effect on shape of hazard zone, etc. 

In the type examples of Chapters 3 and 4, 
the level of ventilation: the grade 
(frequency and duration) 
of the releases and hence the zone 
number; the buoyancy factor 
(lighter or heavier than air) 
are all inbuilt into the diagrams 
presented. No further action is needed 


L 


For the point-source 
method of assessment 
applying Chapter 5, 
all these factors have 
to be individually 
evaluated and applied as 
indicated in Figure 1.2 


7. Final stages for completion of the area classification. In all cases, having evaluated the extent of 
the hazard zone and its zone number, Chapter 7 must be used to select the appropriate type of 
protection tor electrical equipment, and also its apparatus subgroup and temperature class (2.13). 
These should be incorporated in the final area classification records or drawings. 

In making this selection, the question of whether there is an internal release should be assessed 
in accordance with Appendix F, 7.5(b) and 7.6(c) to determine whether it is the internal release or 
the external zone assessment that will govern the ultimate type of protection requirement. 

8. For non-electrical sources of ignition see Chapter 8. 

Figure 16.65 Hazardous area classification - IP Area Classification Code (IP, 1990 MCSP Pt 15): decision tree for 
application of the code (Courtesy of the Institute of Petroleum; reproduced with permission) 
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Whole of distance to bund 


(b) 



-i- m ^ Zone 2 

~T 


\^\ (d) 



Figure 16.66 Hazardous area classification - IP Area Classification Code (IP, 1990 MCSP Pt 15): zoning for storage 
tanks for Class 1,11(2) and 111(2) flammable liquids, (a) Cone or dome roof tank; (b) floating roof tank; (c) cone roof tank with 
outer protective wall; and (d) floating roof tank with outer protective wall. See Code for notes and qualifications (Courtesy 
of the Institute of Petroleum; reproduced with permission) 
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Are open air conditions normal (wind speed rarely 



Figure 16.67 Hazardous area classification - IP Area Classification Code (IP, 1990 MCSP Pt 15): decision tree for 
ventilation. This figure applies to facilities not covered in Chapters 3 and 4 of the code (Courtesy of the Institute of 
Petroleum; reproduced with permission) 


land-based locations means that the wind velocity is rarely 
less than 0.5 m/s and is frequently greater than 2 m/s. 

With regard to less ventilated conditions, it distin¬ 
guishes between locations where the sheltered or enclosed 
area itself contains a source of release and those where it 
merely abuts an area containing, or lies within the hazard 
zone of, such a source. In both cases the severity of 
the zoning depends on the degree of ventilation. For less 
ventilated conditions, the Code utilizes the concept of 


‘adequate ventilation’, defined as: ‘the achievement of a 
uniform ventilation rate of at least twelve air changes an 
hour with no stagnant areas’. 

If a less ventilated location has adequate ventilation 
through natural ventilation, it may be treated as a sheltered 
area. Otherwise, it must be treated as an enclosed area. 
Guidance on the classification of sheltered areas, with 
natural ventilation, is given in the Code, which also 
describes a number of examples. 
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An enclosed area is one that in the absence of artificial 
ventilation has inadequate ventilation. The Code gives 
guidance on the classification of enclosed areas, utilizing 
the distinction between those with and those without an 
internal source of release. 

An enclosed area requires artificial ventilation, which 
the Code treats in terms of the following three categories: (1) 
‘adequate’ ventilation, (2) dilution ventilation and (3) over¬ 
pressure ventilation. 

The Code distinguishes between adequate ventilation and 
dilution ventilation. As already stated, adequate ventilation 
exists if there is an assurance of at least 12 air changes per 
hour. It is not related to the size of any potential release that 
may occur. If there is a release, adequate ventilation may not 
be sufficient to prevent the build-up of a flammable atmo¬ 
sphere, but on termination of the release it willbe sufficient to 
prevent the persistence of such an atmosphere. 

Dilution ventilation, by contrast, is intended to prevent a 
release giving rise to a flammable atmosphere and is 
therefore a function of the size of the potential release. It 
should be such that even immediately after a release the 
area can be considered as non-hazardous. The design cri¬ 
terion is that the flammable concentration should not rise 
above 20% of the LFL. 

In some cases, particularly where there is a source of 
release in a large area, local artificial ventilation, typically 
utilizing a hood, may be used either to obtain local dilution 
ventilation or to restrict the extent of a Zone 1 area. 

Another form of ventilation is pressurization, or over¬ 
pressure ventilation. In this method an overpressure is 
maintained in the space so that flammable gas is excluded. 
The Code recommends an overpressure of at least 5 mmWG 
(50 Pa). This form of ventilation is not used where there is a 
source of release inside the enclosed area. 

Figure 16.67 shows the decision tree given in the Code for 
the determination of ventilation. 

Where artificial ventilation is provided for an enclosed 
area, consideration should be given to possible stagnant 
areas. Where these exist, possible countermeasures may 
include additional ventilation and gas detectors. It is 
necessary to consider what precautions should be taken to 
deal with the possibility of loss of artificial ventilation. The 
appropriate measures will depend on the particular situa¬ 
tion. They may be aimed at reducing the frequency of fail¬ 
ure, such as the installation of stand-by fans with separate 
power supplies and/or mitigating its consequences, such 
as the provision of gas detectors. 

Selection and location of electrical equipment 
The IP Code deals in Chapter 7 with the selection and 
location of electrical equipment, covering much the same 
ground as Section 16.8. The table showing the types of 
protection available has already been given in the previous 
section as Table 16.43. 

The Code makes a distinction between electrical appa¬ 
ratus without and that with potential for internal release of 
flammable material. Certain types of instrument come into 
the latter category. Guidance on such apparatus is given in 
Appendix F of the Code. 

Control of non-electrical ignition sources 
Chapter 8 of the IP Code deals with the control and location 
of ignition sources other than electrical equipment. A 
hazardous area should preferably contain no fixed sources 


of ignition and close control should be exercised over any 
mobile ignition sources. In respect of mobile ignition 
sources, the Code deals mainly with permit-to-work sys¬ 
tems and with the use of gas detectors. 

Specific ignition sources the control of which is con¬ 
sidered in the code include (1) hot surfaces, (2) furnaces and 
fired heaters, (3) combustion engines, (4) turbines, (5) road 
and rail traffic and (6) flares. Consideration is also given to 
pyrophoric and electrostatic hazards and air intakes. 

16.9.4 API RP 500 

The approach described in API RP 500:1991 is broadly sim¬ 
ilar to the method of direct example just described. The code 
utilizes the NFPA classification of fluids given in Chapter 10 
and the NFPA classification of hazardous locations and 
grouping of atmospheric mixtures given in Section 16.8. It 
distinguishes between outdoor and enclosed locations. 

The Code gives exemplars of zoning in Section A for 
petroleum refineries; in Section B for production facilities, 
on land and offshore; and in Appendix C for petroleum 
pipelines. 

The criterion given in the Code for ‘adequate ventilation’ 
is 6 air changes per hour. Appendices A-C of the Code deal 
with ventilation. They treat, respectively, (1) ventilation of 
an enclosed area by natural means, (2) ventilation for fugi¬ 
tive emissions and (3) development of ventilation criteria. 

16.9.5 Quantification in hazardous area classification 

The methods used in the codes just described are based 
essentially on industry experience supplemented by esti¬ 
mates of the frequency and range of releases. An indication 
that traditional approaches have tended to yield disparate 
results is given in Figure 16.68 (A.W Cox, Lees and Ang, 
1990). The figure shows the zoning recommendations of 
selected codes for certain common items. 

One approach to hazardous area classification is: to 
identify particular types of source of release; to assign to 
each source a typical release rate, or set of rates; to assign 
to each release rate a frequency; to estimate the range of 
the release; and to use this release range to determine, for 
purposes of zoning, a hazard range. The estimation of fre¬ 
quency and the determination of the hazard range may be a 
matter of judgement. 

This basic approach may be applied in one of two ways. 
One is to perform the whole exercise afresh for each source 
of release on each occasion that such a source is encoun¬ 
tered in the design. The other, and more practical, way is to 
do the assessment once and for all and then to produce 
guidelines. 

Approaches on these lines evidently inform some of the 
methods used in the codes just described, such as the 
source of hazard method of the ICI Electrical Installations 
Code and the point source method of the IP Area Classifi¬ 
cation Code. 

A method based on the examination of individual leak 
sources has the advantage that it forces the engineer to 
identify these sources and to examine them more closely. It 
takes full account of the properties of the fluids and the 
operating conditions. It allows for engineering features 
designed to reduce the risk. It should give greater reassur¬ 
ance that the zone distances are right. On the other hand, 
there is a view that this approach can lead to much effort for 
little return, the end result often being little different from 
that obtained using a more general approach. 
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Hazardous area classification has not to date been based 
on any formal quantitative risk assessment. There have 
been different views on whether or not this is necessary. 
In any event, in this particular field quantification has 


proved difficult. Foremost among the problems is the lack 
of data on the basic frequency and size distribution of leaks 
for different potential sources. Uncertainties in modelling 
have been another significant factor. 


ICI/RoSPA: LPG (UK) 



30 m 


sZZfo. HSE 

LPG (U K) 


SS 42108 20 (Sweden) 

L. 

API 500 (USA) 


CPP: LPG (France) 


NFPA 30 (USA) 
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Det Norske Veritas (Norway) 


BCI (West Germany) 


Zone 1 feggggd 
Zone 2 VP77A 


BCI (West Germany) 



ICI/RoSPA (UK) 




(b) 

Figure 16.68 Hazardous area classification: zone distances given by selected codes (A.W. Cox, Lees and Ang, 1990): 
(a) zone distances for pumps for LPG; (b) zone distances for flanges of pipework handling LPG; and (c) zone distances 
for storage tanks (Courtesy of the Institution of Chemical Engineers) 
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Several parties have addressed the modeling aspect. In 
the mid-1980s, a draft appendix to BS 5345 was produced 
which contained a collection of models for use in hazardous 
area classification, but this did not see the light of day. A 
discussion of such models has been given light of day. A 
discussion of such models has been given by O’Shea (1982). 
Another set of models area those given for plan layout by 
Mecklenburgh (1985), as described in Chapter 10. A set of 
models for natural gas is given in the British Gas in-house 
code BGC/PS/SHA1. 

Research in support of a more quantitative approach 
has been described in Classification of Hazardous Areas 
A.W. Cox, Lees and Ang (1990). This work involved the 
development and refinement of estimates of (1) the fre¬ 
quency and size distribution of leak s from typical leak 
sources, (2) the probability of ignition of the release and 
(3) the probability of explosion given ignition. An account 
of this ignition model is given in the next section. The 
authors state that the provision of these data provides the 
basis for the development of guidance based on quantita¬ 
tive risk assessment. They suggest that quantitative gui¬ 
dance might be formulated by exploring representative 
scenarios of release on plant layouts incorporating typical 
equipment, and sources of release, using a three-dimen¬ 
sional computer-aided design (CAD) plant layout code, 
utilizing the data on release frequency and size and igni¬ 
tion on which the ignition model is based, together with 
other data such as the probability of exposure of personnel. 


16.10 Ignition Models 

It is frequently necessary in hazard assessment to estimate 
the probability of ignition and of explosion if a leak occurs. 
There is therefore a requirement both for ignition models 
and for data from which to determine the parameters in 
such models. This is, however, an area where there is rela¬ 
tively little guidance available. 


Information relevant to the modelling of ignition sources 
has been given in Classification of Hazardous Areas, the 
study byA.W. Cox, Lees and Ang (1990) already mentioned. 
This work includes a model for leaks of flammable fluids 
and for their ignition and explosion. 

16.10.1 Modes of ignition 

Ignition of a leak may occur either at the point of leak or at 
some distance from it. The cause of ignition may be the leak 
event itself or an ignition source. These distinctions may be 
illustrated by the following examples. A leak may occur at a 
pump seal which has failed due to a bearing failure and the 
hot bearing may ignite the leak. A leak may occur due to 
equipment rupture and the rupture may give a spark which 
ignites the leak. A leak may generate static electricity 
which then gives an incendive spark and ignites the leak. 
All these cases are treated here as ignitions by the leak 
event itself, regardless of how close to point of leak ignition 
occurs. 

It is usually convenient to consider a limited number of 
specific sources and to treat the large number of other 
potential ignition sources as background sources. A spe¬ 
cific ignition source may be present continuously or only 
intermittently. 

From the foregoing, the modes of ignition may be classi¬ 
fied as follows: 


(1) event ignition; 

(2) specific ignition source 

(a) continous, 

(b) intermittent; 

(3) background ignition. 

It may also be helpful to distinguish between those ignition 
sources on which action is practical when a gas alarm 
occurs and those for which it is not. 
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16.10.2 Distribution of ignition sources 

Some data on the distribution of ignition sources onshore 
are given in Table 16.46 These data are from a survey by 
Cox, Lees and Ang of incidents reported to the Health and 
Safety Executive (HSE). 

Information on ignition sources offshore has been given 
by Sofyanos (1981) and by Forsth (1981a,b,1983). Table 16.47 
shows data given by Forsth (1983) for the Gulf of Mexico 
(GoM) and for the Norwegian North Sea (NNS). The num¬ 
ber of accidents considered was 326 in the GoM over the 
period 1956-82 and 133 in NNS over an unspecified period. 

16.10.3 Probability of ignition 

The information available on the probability of ignition is 
mostly in the form of expert estimates. In the context of 
vapour cloud explosions, Kletz (1977j) states that on poly¬ 
ethylene plants the leaks are mostly very small and that 
about one leak in 10,000 ignities, due probably to good jet 
mixing with air. He also states that on a series of plants 
handling a hot mixture of hydrogen and hydrocarbons 
about one leak in 30 ignites. He argues that the probability 
of ignition increases with the size of leak and suggest 
that for large leaks (>10 ton) the probability of ignition is 
greater than 1 in 10 and perhaps as high as 1 in 2. 

R.L. Browning (1969c) has given a set of estimates of 
the relative probabilities of ignition. For ignition under 
conditions of no obvioius source of ignition and with 
explosion-proof electrical equipment he gives the following 
probabilities of ignition: 


Relative probability 
of ignition 

Massive LPG release 

lO” 1 

Flammable liquid with flashpoint 

10“ z 

below 110°F or with temperature 


above flashpoint 


Flammable liquid with flashpoint 

10“ 3 

110—200°F 



Elsewhere R.L. Browning (1980) gives a table of prob¬ 
abilities which are evidently absolute probabilities. The 
table includes an estimate of the probability of ignition of 
flammable gas-liquid spills of 10 -2 —10 _1 . 

The First Canvey Report (HSE, 1978b) gives for LNG 
vapour clouds: 


Probability of ignition 

Limited releases 

10” 1 

Large releases 

1 


Table 16.46 Ignition sources in fire and explosion survey 
of national case histories (A.W. Cox, Less and Ang, 1990) 
(Courtesy of the Institution of Chemical Engineers) 


No. of 
incidents 

Proportion of incidents (%) 

Unadjusted Adjusted? 

Flame: 

General 

8 

9.3 

16.7 

LPG fired 

2 

2.3 

4.1 

equipment 

Hot surfaces 

10 

11.6 

20.8 

Friction 

4 

4.7 

8.4 

Electrical 

8 

9.3 

16.7 

Hot particles 

3 

3.5 

6.3 

Static electricity 

6 

7.0 

12.5 

Smoking 


- 

- 

Autoignition 

7 

8.1 

14.5 

Unknown 

38 

44.2 

- 

Total 

86 

100.0 

100.0 


a Adjusted figures are based on eliminating the unknown category 
and redistributing the known ignition sources in their original 


Table 16.47 Ignition sources for fires and explosions on offshore platforms in the Gulf of Mexico 1956-81 and the 
Norwegian North Sea (A.W. Cox, Lees and Ang, 1990; after Forsth, 1983) (Courtesy of the Institution of Chemical 
Engineers) 


Proporation of incidents 3 (%) 


NNS 


GoM 

Unadjusted 

Adjusted 

Unadjusted Adjusted 


Welding/cutting/grinding 

18 

- 

59 

_ 

Engines and exhausts 

34 

50.7 

4 

14.3 

Sparks 

4 

6.0 

1 

3.6 

Electrical 

16 

23.9 

9 

32.0 

Hot surfaces b 

0 

0 

6 

21.4 

Self-ignition 

1 

1.5 

1.5 

5.4 

Cigarette, lighter, match 

1 

1.5 

1.5 

5.5 

Other 

11 

16.4 

5 

17.9 

Unknown, not reported 

17 

- 

12 

- 

Total 


100 


100 


GoM, Gulf of Mexico; NNS, Norwegian North Sea. 

a Adjusted figures are based on eliminating the hot work and unknown categories and redistributing the known ignition sources in their original 
relative proportions. 
b Other than engines and exhausts. 
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The Second Canvey Report (HSE, 1981a) gives the fol¬ 
lowing ‘judgment’ values for ignition on site: 


Ignition sources 

Probability of ignition 

None 

0.1 

Very few 

0.2 

Few 

0.5 

Many 

0.9 


For offshore locations, Dahl et al. (1983) have analysed 
ignition data for gas and oil blowouts, which may 
be regarded as massive releases. The data are shown in 
Table 16.48, Section A. They cover both drilling rigs and 
production platforms. The overall probability of ignition of 
blowouts is similar for the two cases. 

Cox, Lees and Ang draw on the foregoing to make 
estimates of the probability of ignition, They define a 
minor leak as one <1 kg/s and take for this an average 
leak flow of 0.5 kg/s. They define a massive leak as one 
>50 kg/s and take for this an average leak flow of 100 kg/s. 
They estimate the probability of ignition of a minor leak of 
either gas or liquid as 0.01, that of a massive leak of gas 
as 0.03 and that of a massive leak of liquid as 0.08. From 
these estimates they derive those given in Table 16.49 and 
Figure 16.69. 

16.10.4 Probability of explosion 

The information available on the probability of explosion is 
also mostly in the form of expert estimates. In his account of 


Table 16.48 Probability of ignition and of explosion for 
offshore blowouts (A.W. Cox, Lees and Ang, 1990; 
after Dahl et al., 1983) (Courtesy of the Institution of 
Chemical Engineers) 


A Probability of ignition 

Blowout 

No. of 

No. of 

Probability 

fluid 

blowouts 

ignitions 

of ignition 

Gas 

123 

35 

0.3 

Oil 

12 

1 

0.08 

B Probability of explosion, given ignition 

Blowout 

No. of No. of 

No. of 

Probability of 

fluid 

blowouts ignitions 

explosions 

explosion given 
ignition 

Gas 

123 35 

12 

0.34 

Oil 

12 1 

0 

0 


Table 16.49 Estimates of probability of ignition for leaks 
of flammable fluids (A.W. Cox, Lees and Ang, 1990) 
(Courtesy of the Institution of Chemical Engineers) 


Leak (kg/s) 

Probability of ignition 


Gas 

Liquid 

Minor (<1) 

0.01 

0.01 

Major (1-50) 

0.07 

0.03 

Massive (>50) 

0.3 0.08 


vapour cloud exlosions, Kletz (1977j) has also given esti¬ 
mates of the probability of explosion. He quotes the follow¬ 
ing figures: 

Frequency of serious vapour cloud fires = 5/year 
Frequency of serious vapour cloud explosions = 0.5/year 

and derives from these for a large vapour cloud 
Probability of explosion given ignition = 0.1 

He also gives estimates which are evidently for the prob¬ 
ability of explosion given leak. These are a probability >0.1 
for a large vapour cloud (>10 ton) and 0.0001-0.01 for a 
medium vapour cloud (1 ton or less). 

The First Canvey Report gives for a refinery 
Probability fo explosion, given major fire = 0.5 
and for large LNG vapour clouds 


Probability of explosion 
given ignition 

Large vapour clouds 

1 

Smaller clouds of gases other 

0.1 

than methane 


Smaller clouds of methane 

0.01 


For offshore locations, Dahl et al. (1983) have analysed 
blowouts as shown in Table 16.48, Section B. 

Sofyanos (1981) has given for fires and explosion s in the 
Gulf of Mexico the data shown in Table 16.50. 

For the estimation of the probability of explosion, 
Cox, Lees and Ang use for massive leaks the value of 0.3 
given by Dahl et al. for blowouts and for minor leaks the 
value of 0.04 given by Sofyanos for Category V leaks. From 
these estimates they derive those given in Table 16.51 and 
Figure 16.70. 

16.10.5 Distribution of leaks 

In order to model the occurrence of fire and explosion on 
a plant it is also necessary to have information on the 
frequency of leaks. Table 16.52 gives the estimates of leak 
frequency used by Cox, Lees and Ang. 

16.10.6 Cox, Lees and Ang model 

The approach taken by Cox, Lees and Ang is to define an 
equivalent standard plant and to make for this plant 
estimates of the frequency of leaks of flammable gas and 
liquid and of ignitions and explosions. The inventory of 
equipment in the equivalent standard plant (ESP) is list in 
Table 16.53. 

These various data sets are then combined to give a 
model, described by the authors as a fire and explosion 
model, but referred to here as an ignition model. From the 
inventory of equipment on the ESP and the generic esti¬ 
mates of leak frequency the frequency of leaks on the plant 
is obtained. The frequency of fire and explosions is then 
obtained from the ignition and explosion probabilities 
shown in Figures 16.69 and 16.70. 

The data in Tables 16.52 and 16.53 and Figures 16.69 and 
16.70 used in the model were initially obtained as indepen¬ 
dent estimates, but were then adjusted to give a better fit to 
the historical data such as the frequency of plant fires and 
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Figure 16.69 Estimated probability of ignition for leaks of gas or liquid (A. I/I/. Cox, Lees and Ang, 1990). (-) Initial 
estimates, which were used unaltered in the ignition model - see text (Courtesy of the Institution of Chemical Engineers) 


Table 16.50 Probability of explosion given ignition for blowouts in the Gulf of Mexico (A. W. Cox, Lees and Ang, 1990; 
after Sofyanis, 1981) (Reproduced by permission of the Institution of Chemcial Engineers) 


Damage 
category a 

No. of incidents with 
fire and explosion 

No. of incidents with 
explosion only 

Probability of 
explosion given 
ignition 

I 

9 

5 

0.55 

II 

13 

3 

0.23 

III 

33 

6 

0.18 

IV 

128 

22 

0.18 

V 

143 

6 

0.042 

Total 

326 

42 

0.13 b 


a The damage categories are in decreasing order of severity, Category I being loss of platform and Category V being an incident of no consequence. 
b Weighted average. 


vapour cloud explosions. For the leak frequency the origi¬ 
nal estimates are shown in Table 16.52 in brackets. No 
adjustment was made to the ignition probabilities given in 
Table 16.49 and Figure 16.69, but the explosion probabilities 
given in Table 16.51 and Figure 16.70 were adjusted to: 


Leak (kg/s) 

Probability of explosion 


given ignition 

Minor (<1) 

0.025 

Massive (>50) 

0.25 


If, therefore, the estimate of the probability of explosion is 
based on the outcome from the model the model rather than 
on those derived in Subsection 16.10.4, the values given by 
the dotted line in Figure 16.70 apply. 

Some results obtained by running the model for the 
equivalent standard plant are given Table 16.54. Leak, 
fire and explosion frequencies are given in Section A of 
the table by leak source and in Section B by fluid 
phase. The authors give comparisons of these results with 


Table 16.51 Estimates of probability of explosion given 
ignition for leaks of flammable gas (A. W. Cox, Lees and 
Ang, 1990) (Courtesy of the Institution of Chemical 


Engineers) 

Leak (kg/s) 

Probability of 


given ignition 

Minor (<1) 

0.04 

Major (1-50) 

0.12 

Massive (>50) 

0.3 


historical data on fires and vapour cloud explosions, both 
overall and by leak source and fluid phase. 

The purpose of the model as developed by the authors is 
to provide a check on the estimates of leak frequency. The 
conventional approach in hazard assessment is to make 
estimate of frequency and to derive confidence limits on 
these estimates. For leaks, however, the data appeared to be 
too sparse to permit this approach. The problem was 
therefore tackled in a different way. The estimates of leak 
size distribution and frequency were used to make, for a 
typical plant, estimates not only of the overall frequency of 
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Figure 16.70 Estimated probability of explosion given ignition for leaks of gas (A. W. Cox, Less and Ang, 1990): 
(-) Initial estimate; and (- -) estimate used in the ignition model - see text (Courtesy of the Institution of Chemical 
Engineers) 


Table 16.52 Estimates* of leak frequency used in ignition model (A. W. Cox, Lees and Ang, 1990) 
(Courtesy of the Institution of Chemical Engineers) 


A Pipework: leak frequency (leaks/m yr) 


Pipe diameter (m) 


0.025 0.050 0.100 0.300 


Rupture leak 0.005(0.01) 0.005(0.01) 0.0015(0.003) 0.0005(0.001) 

Major leak 0.05(0.1) 0.05(0.1) 0.015(0.06) 0.005(0.03) 

Minor leak 0.5(1) 0.5(1) 0.15(0.3) 0.05(0.1) 


B Flanges (all pipe diameters): leak frequency (leaks/yr) 


Major leak 0.3 (1) 

Minor leak 3 (10) 


C Valves: leak frequency (leaks/yr) 


Pipe diameter (m) 



0.025 

0.050 

0.100 

0.300 

Rupture leak 

0.01 (0.1) 

0.01 (0.1) 

0.01 (0.1) 

0.005(0.1) 

Major leak 

0.1(1) 

0.1(1) 

0.1(1) 

0.05(1) 

Minor leak 

1(10) 

1(10) 

1(10) 

0.5(10) 


D Pumps (all pipe diameters): leak frequency (leaks/yr) 


Rupture leak 0.3 (0.3) 

Major leak 3 (3) 

Minor leak 30 (30) 


E Small bore connections: leak frequency (leaks/yr) 


Pipe diameter = 0.01 m 


Rupture leak 1 (5) 

Major leak 10 (50) 


“All values to be multiplied by 10 4 . 


fire and explosion but also of leaks by leak size, by fluid 
phase and by leak source, and hence of the distribution of 
leaks by size, fluid phase and leak source. Thus the model 
may be tested in terms not only of the final results but 


also of a numbers of intermediate results. For example, not 
only should the overall frequency of explosions accord 
with historical values, but so should the distribution of 
explosions by leak source. The totality of such comparisons 
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Table 16.53 Inventory of leak sources on equivalent standard plant used in ignition model (A. W. Cox, Lees and Ang, 
1990) (Courtesy of the Institution of Chemical Engineers) 


A Pipework, flanged joints, valves 


Pipe diameter (mm) 

Pipe length 


Flanged joints 

Valves 

Proportion 
on gas (%) 

(m) 

(%) 

15 

525 

3.5 

100 

120 

0 

20 

90 

0.6 

200 

100 

0 

25 

3,000 

20.0 

600 

500 

0 

40 

2,100 

14.0 

420 

200 

5 

50 

2,100 

14.0 

650 

300 

8 

80 

3,300 

22.0 

530 

140 

8 

100 

1,050 

7.0 

160 

60 

8 

150 

1,050 

7.0 

120 

40 

8 

200 

600 

4.0 

100 

18 

10 

250 

300 

2.0 

55 

10 

20 

300 

150 

1.0 

30 

5 

20 

350 

45 

0.3 

5 

2 

20 

400 

525 

3.5 

20 

3 

20 

450 

45 

0.3 

5 


20 

500 

120 

0.8 

5 

2 

20 

Total 

15,000 


3,000 

1,500 



B Pumps 


No. of pumps = 25 


Table 16.54 Leak, fire and explosion frequencies obtained using the ignition model (A.W. Cox, Lees and Ang, 1990) 
(Courtesy of the Institution of Chemical Engineers) 


A By leak source 

Flow (kg/s) <1 1—50 >50 Total Proportion (%) 


Leak frequency (leaks I plant year) 

Pipework 

Flanges 

Valves 

Pumps 

Small bore connections 


0.422 0.115 0.00318 

0.910 0.080 0 

0.130 0.340 0.00037 

0.045 0.038 0.00030 

0.711 0.060 0 


0.540 21.2 

0.990 38.9 

0.164 6.4 

0.083 3.3 

0.770 30.2 


Total 

Proportion (%) 

Fire frequency a (fires/plant year) 

Pipework 

Flanges 

Valves 

Pumps 

Small bore connections 


2.22 0.33 0.0038 2.55 

87.0 12.8 0.15 


42.7 31.3 

91.0 16.3 

13.2 9.21 

4.50 9.02 

71.1 13.1 


5.82 80.0 25.9 

0 107 34.8 

0.741 23.1 7.5 

0.504 14.0 4.5 

0 84.2 27.3 


Total 222 

Proportion (%) 72.1 

Explosion frequency a (explosions/plant year) 

Pipework 0.431 

Flanges 0.753 

Valves 0.128 

Pumps 0.027 

Small bore connections 0.630 


79 

25.6 


1.42 

0.418 

0.427 

0.281 

0.362 


7 

2.3 


1.10 

0 

0.151 

0.090 

0 


308 


2.95 48.0 

1.17 19.1 

0.705 11.5 

0.398 6.5 

0.991 15.0 


1.90 2.90 1.34 6.14 

30.9 47.3 21.8 


Total 

Proportion (%) 













Table 16.54 (continued) 
B By fluid phase 


Flow (kg/s) 

<1 

1-50 

>50 

Total 

Proportion (%) 

Leak frequency (leaks /plant year) 

Liquid 

0.930 

0.164 

0.00184 

1.10 

43.0 

Gas 

0.285 

0.00494 

0.000026 

0.29 

11.4 

Two-phase 

1.00 

0.157 

0.00200 

1.16 

45.6 

Total 

2.22 

0.326 

0.0039 

2.55 


Proportion (%) 

87.0 

12.8 

0.15 



Fire frequency (fires/plant-year) 

Liquid 

93.0 

32.4 

1.46 

127 

41.1 

Gas 

28.6 

1.7 

0.077 

30 

9.8 

Two-phase 

101 

44.9 

5.53 

151 

49.1 

Total 

222 

79 

7.1 

309 


Proportion (%) 

72.0 

25.6 

2.3 



Explosion frequency a (explosions/plant year) 
Gas 

0.248 

0.137 

0.019 

0.404 

6.6 

Two-phase 

1.65 

2.77 

1.32 

5.74 

93.4 

Total 

1.90 

2.90 

1.34 

6.14 


Proportion (%) 

30.9 

47.3 

21.8 




a All values to be multiplied by 10 4 . 


constitutes a relatively robust cross-check. It is this con¬ 
ceptual approach which is the main value of the model. 

16.10.7 Models utilizing dispersion relations 

The model just described utilizes the overall probability of 
ignition expressed as a function of the leak flow. The char¬ 
acterization of ignition probability may be extended by 
modeling the physical basis for the relation between it and 
the leak flow. 

Some features which such a model should possess are 
given by Cox, Lees and Ang as follows: 

(1) the effect of the fluid phase, gas or liquid, should be 
taken into account; 

(2) the probability of ignition for an unprotected location 
should increase as the leak flow increases; 

(3) there should be a finite probability of event ignition 
which allows for the failure to achieve perfect protec¬ 
tion even within the designated zones, and this prob¬ 
ability also should increase as the leak flow increases; 

(4) there should be a finite probability of event ignition; 

(5) the estimated probability of ignition should be the sum 
of (3) and (4) over the range covered by zoning and of 
(2) and (4) over the range not so covered. 

The overall probability of ignition and the probability of 
event ignition estimated from the model should both be in 
broad agreement with that observed. 

The leak flow determines the distance, and hence the area 
covered or volume encompassed by the leak. This area or 
volume may be obtained using suitable emission and dis¬ 
persion relations. A model for the probability of ignition may 
then be constructed in which the probability is a function of 
the area or volume, depending on the situation considered. 

One outcome of such an approach is the speculative 
model shown in Figure 16.71. Lone A gives the estimated 
probability of ignition given a normal, partial degree of 
protection against ignition and corresponds to the line 


given in Figure 16.69. Lines B and C represent the 
component parts of line A, line C being the part due to event 
ignition and line B that due to ignition sources, both 
specific and background. Line D gives the estimated pro¬ 
bability of ignition assuming no protection. Line E illus¬ 
trates a possible actual curve for ignition probability. 

Critical features of such a model are the probabilities of 
event ignition and the slope of the lines derived on the one 
hand from estimates of overall probability of ignition and 
on the other from the dispersion models. 

16.10.8 Models with specific ignition sources 
The matter can be taken further by expressing the overall 
probability of ignition as a function of the contributions of the 
various ignition sources. For this purpose it is convenient to 
utilize the classification given in Section 16.10.1 and to write 
the overall probability of ignition Pas a function of the prob¬ 
ability P a of ignition by the event itself, or event ignition, 
of the probability P b of ignition by a specific ignition source, 
and of the probability P c of ignition by one of the background 
ignition sources, or background ignition: 

P=/(P a ,P b ,P c ) [16.10.1] 

The overall probability of ignition is then 
P = P a + P b + P c - P a P b - P a P c - P b P c + P a P b P c 

[16.10.2a] 

= Pa + Pb + Pc Pa, Pb, Pc < 1 [16.10.2b] 

The probability P b of ignition by specific ignition 
sources is 

P b = l- fj(l P b;l ) [16.10.3a] 

Pb = J2 P\ v Pb, < 1 [16.10.3b] 

where P b;l - is the probability of ignition by ignition source i. 







Leak flow(kg/s) 

Fiqure 16.71 Speculative model for the probability of ignition of leaks of flammable gas (after A. W. Cox, Lees and Ang, 
1990) (Courtesy of the Institution of Chemical Engineers) 


For a specific ignition source the probability of ignition is 

fV = %%/WVw p.e.io.4] 

where P bji] i is the probability that the source is present, 
Pb-i-,2 is the probability that the flammable region of the gas 
cloud reaches the source, Pb;i ; :i is the probability that the 
source, if active, is able to ignite the gas, and P b -i-,i is the 
probability that the source is active. 

The probability P b;l; i depends on the plant configuration 
and zoning practices under consideration. Probability P h;i;2 
may be estimated using dispersion relations. Probability 
P b ;i;3 allows for the strength of the ignition source in 
relation to the strength required to ignite the cloud. Prob¬ 
ability P b ; i;4 allows for the fact that the ignition source 
may be intermittent. The last two depend on the type of 
ignition source. 

The model can accommodate different sets of specific 
ignition sources. From Tables 16.46 and 16.47 and from 
general considerations a suitable set might be 

(1) flames; 

(2) hot work; 

(3) hot surfaces; 

(4) electrical; 

(5) engines, motors; 

(6) human activity. 

In making this selection, allowance has been made for the 
possibility of action when a gas alarm occurs. An engine 
may be shut-down, but a hot exhaust will remain hot for a 
period. Broadly speaking, the items in this set on which 
action may be taken are hot work, engines and motors and 
human activity. 


For the probability P a of event ignition the offshore data 
given inTable 16.47 suggest an overall value of about 1 -5 %, 
say 3%. It may be expected that this probability will be 
higher for a large leak than for a small one. 

Insofar as a model of this kind gives more detailed 
information about the specific ignition sources and their 
characteristics, it provides a basis not only for hazard 
assessment but also for taking action to reduce the prob¬ 
ability of ignition. 

16.10.9 Models in hazard assessment systems 

Hazard assessment systems often include an ignition 
model. Other ignition models have been given in specific 
hazard assessments. Most of these models relate to ignition 
sources which might ignite a vapour cloud drifting beyond 
the plant boundary. 

In the Vulnerability model described by Eisenberg, 
Lynch and Breeding (1975), the occurrence of ignition is 
determined as follows. It is assumed that an ignition source 
is located at the centre of each population cell and that 
ignition occurs if a flammable mixture reaches such an 
ignition source. The type of ignition source is specified for 
each cell by the user, the two types giving fire or explosion, 
respectively 

The handling of ignition sources in the SAFETI 
package has been described by Ale and Whitehouse (1986) 
and Pitblado and Nalpanis (1989). As for population, 
a 100 m x 100 m grid is used, and ignition sources are 
located inside each grid. Point, line or areas sources may be 
specified. Each source has two attributes: the probability 
that it is active and the probability that it is effective. Day 
and night are treated as separate cases. 

A somewhat different approach is used in the short-cut 
classical method (SCM) described by R.A. Cox and Comer 
(1982). There the probability P of ignition is assigned 
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specified values at regular intervals of distance d r and 
is thus specified as a function of the direction 9 and the 
distance r(=idr) 

P = f[9,r) [16.10.5] 

Another approach, described by English and Waite 
(1989), is to assume a constant density p of ignition sources. 
The probability increment SP of ignition for a sector of 
semi-angle 9 S at distance r is then 

(5P=prtan0 s dr [16.10.6] 

and the probability Pof ignition by the time a distance r has 
been reached is 

P ■■ 1 — exp(~0 s pr*) [16.10.7] 

The treatment of ignition sources in the Rijnmond Report is 
described in Appendix 8. 

16.11 Fire in Process Plant 

Fires in process plant are a serious hazard to both life and 
property. It is essential, therefore, to understand the ways 
in which fire can occur and develop. 

Normally, fire occurs as a result of a leakage or spillage of 
fluid from the plant. Larger leaks may occur due to the 
failure of a vessel, pipe or pump, and smaller ones from 
flanges, sample and drain points and other small bore 
connections. 

Combustion of material which has leaked from a plant 
may take a number of forms. A leak of gas or liquid may be 
ignited at the point of issue so that it behaves like a flame on 
a burner. In some circumstances this flame may be directed 
like a blow torch at another part of the plant. 

If the leak gives rise to a gas or vapour cloud which 
grows for a period before it is ignited, the resultant effect 
may be either a vapour cloud, a flash fire, or a vapour cloud 
explosion. Vapour cloud explosions are considered in 
Chapter 17. 

In a flash fire the gas cloud burns, but does not explode. 
A typical flash fire may cause quite extensive damage, 
particularly to vulnerable items such as electric cabling, 
but may leave the main plant equipment relatively un¬ 
harmed. However, a flash fire does cause a sudden deple¬ 
tion of oxygen, and this effect can be lethal to personnel. 

If the leak forms a liquid pool on the ground, this may 
ignite and burn. The flame may be substantial and may do 
damage by direct impingement or by radiation. 

If the release results from fire engulfment of a vessel, a 
fireball may be formed. 

Prevention of fire in process plant is primarily a matter of 
preventing leaks and avoiding sources of ignition. 

In addition to fires arising from leakage in general, there 
are certain characteristic types of fire on process plant. 
These include (1) pump fires, (2) flange fires, (3) lagging 
fires, (4) duct fires, (5) cable tray fires, and (6) storage tank 
fires. These various types of fire are now discussed. 

16.11.1 Pump fires 

Pumps tend to leak at the gland or the seal and the leakage 
frequently ignites causing a fire. Pump fires have been 
discussed by Kletz (1975b), who describes a number of 


Table 16.55 Estimated frequency of pump fires 
(after Kletz, 1971) (Courtesy of the Institution of 
Chemical Engineers) 


Material in pump 

Estimated frequency 
of fires 

(fires/pump-year) 

LPG below ambient temperature 

>1(T 3 

Material above autoignition 

>10“ 3 

temperature 

Flammable material well above 

<10“ J 

ambient temperature (e.g. petrol 

>10“ 4 

at 70°C, gas oil at 150°C) 

LPG at ambient temperature 

<0.33 x 10“ 3 
>0.33 x 10“ 4 

Petrol or similar materials at or 

<10“ 4 

near ambient temperature 

>10“ 5 

Gas oil or similar materials below 

<10“ 5 

their flashpoints 


incidents involving leakage and/or fire from seals on cold 
duty pumps on olefin separation plants. He quotes three 
cases of leaks from cold ethylene pumps. In one there was a 
leakage over 20 min of some 3 ton of vapour which formed a 
cloud, but blew away without igniting. In the other two 
there was ignition at the pump. The cause of ignition may 
have been static electricity. In both instances there was a jet 
of vapour containing liquid droplets. With C3 and C4 
hydrocarbons at moderate pressure and ambient tempera¬ 
ture, however, there are far fewer pump seal leak fires. 

Kletz (1971) has also provided estimates made by experts 
of the frequency of fires on pumps with different duties. 
These estimates are given in Table 16.55. 

These accounts of pump fires are given by Kletz in the 
context of the use of emergency isolation valves to prevent a 
serious leak at the pump. The provision of such isolation 
arrangements is one of the principal means of mitigating 
pump fires. An alternative approach is to improve the 
mechanical reliability of the pump. The use of double 
mechanical seals, for example, greatly reduces the fre¬ 
quency of seal failure. 

A fire at a pump can do considerable damage. It is 
important, therefore, to assess the effect of a fire on equip¬ 
ment above the pump. In some fires the damage has been 
much reduced by a concrete floor above the pump alley. 

Electrical and instrument cabling is particularly liable 
to be damaged by a pump fire. If such cabling is put out 
of action, the plant may be down for a much longer period 
than is required to deal with the fire itself. Methods 
are available for giving such cabling a 15-min protection 
against fire, but they involve additional expense. 

The provision of protection against pump fires is a good 
illustration of the loss prevention approach. The need for 
measures such as improved pump reliability, an emergency 
isolation valve or protected cabling, should be assessed by 
considering for each case the frequency and consequences 
of a pump fire. 

16.11.2 Flange fires 

Pipe flanges tend to leak and sometimes the leakage is 
ignited so that there is a fire. 

An account of flange fires and their prevention has been 
given by McFarland (1969). Leakage at flanges is induced 
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mainly by temperature transients which put elements 
of the flange assembly under stress and may cause them 
to yield. 

Figure 16.72 shows this effect for a normal gasketed joint. 
The joint is shown in Figure 16.72(a) as new, in Figure 
16.72(b) during the passage of hot fluid when the tempera¬ 
ture of the inside of the pipe is hotter than that of the out¬ 
side and causes differential expansion, and in Figure 
16.72(c) after the transient has caused yielding of the flan¬ 
ges an/or bolts and compression in the gasket. 

A lens ring joint of the type which is self-tightening 
under pressure is illustrated in Figure 16.73. Figure 16.73(a) 
shows the joint as new and Figure 16.73(b) shows it after a 
sudden reduction in temperature has caused the joint ring 
to suffer radial strain and leak. Figures 16.73(c) and (d) 
indicate two possible solutions, the use of an insulating pad 
between the joint ring and the pipe bore, and the provision 
of a more massive flange. 

Figures 16.74(a) and (b) show two other methods of 
improving the leak-tightness of an existing flanged joint: 
using longer bolts with sleeves and with Belleville washers, 
respectively. In the latter case it is necessary to ensure that 
the washers cannot lose temper due to high temperatures. 

The main alternative hypothesis advanced to explain the 
Flixborough disaster involved a flange fire. The elbow of an 
8 in. line showed evidence of having been subjected to a 
directed flame. It was suggested that a gasket blew on a 
non-return valve inside a lagging box near to the elbow and 
gave rise to an annular leak and off-port flame directed at 
the elbow. 



Figure 16.72 A normal gasketed joint (after McFarland, 
1969): (a) as new; (b) a hot fluid puts pipe under stress 
and causes bolts and flanges to yield; (c) when the fluid 
temperature falls, leakage can occur (Courtesy of the 
American Institute of Chemical Engineers) 






Figure 16.73 A lens ring joint (after McFarland, 1969): 
(a) as new; (b) if there is a sudden temperature reduction 
the joint ring can suffer radial strain and leak; (c) addition of 
an insulating panel between the joint ring and the pipe bore 
reduces leakage; (d) use of more massive flanges gives 
better resistance to stress (Courtesy of the American 
Institute of Chemical Engineers) 




( b) 


Figure 16.74 Modification of existing joints (after 
McFarland, 1969): (a) use of longer bolts and sleeves; 
(b) use of Belleville washers (Courtesy of the American 
Institute of Chemical Engineers) 
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16.11.3 Lagging fires 

Lagging on plant equipment frequently becomes impreg¬ 
nated with oils and other liquids. If the lagging is hot, self¬ 
heating and ignition may occur, leading to a lagging fire. 

In one small refinery the number of lagging fires in 
the period 1958—61 ranged from 14 to 21 per year (Petkus, 
1964). 

Lagging fires have been investigated by P.H. Thomas, 
Bowes and co-workers (e.g. P.H.Thomas, 1958; P.H.Thomas 
and Bowes, 1961a, 1967; Bowes and Langford, 1968; Bowes, 
1974a, 1976) and by Gugan (1974a, 1976). 

A lagging fire is essentially a self-heating phenomenon. 
Self-heating was discussed in Section 16.6. The design of 
insulation systems to minimize lagging fires has been 
considered in Chapter 12. 

The conditions for a lagging fire to occur are that there 
should be sufficient fuel, oxygen and heat. Factors relevant 
to the occurrence of a fire are (1) oil, (2) leak, (3) insulation 
material, (4) insulation sealing, and (5) insulation geometry 
and temperature. 

The most important factor in a lagging fire is the oil 
itself. For significant self-heating to occur the oil needs to 
be involatile (a volatile oil vaporizes too easily). An intrin¬ 
sically reactive unsaturated oil is more prone to self-heating 
than is a saturated mineral oil, but any combustible invo¬ 
latile oil may self-heat. 

Some liquids are described as ‘fire resistant’. Of these, 
some, such as chlorinated paraffins and phosphate esters, 
are intrinsically fire resistant, but others, such as liquids 
dosed with antioxidant or hydraulic fluids containing 
water, are not, and may become combustible again if 
they suffer preferential loss of the antioxidant or water, 
respectively, in the warm lagging. 

The amount of oil which gives the maximum ignition 
sensitivity in the more porous insulating media is esti¬ 
mated by Gugan (1974a) as about 6-12 %v/v (equivalent to 
about 150 = 300%w/w). 

A continuous leak is not necessarily the most favourable 
to self-heating. If a suitable concentration of oil can only be 
maintained by a continuous flow, the oil is too volatile; and 
if there is a continuous flow of involatile oil, it is likely to 
oversaturate the lagging. 

Typical leakage points which may cause a lagging fire 
are pumps, flanged joints, and sample and drain points. 

The material of insulation is another factor in determin¬ 
ing self-heating, although it is generally less important 
than the nature of the oil. A good insulating material has 
a low thermal conductivity based on a porous structure of 
low density. It is precisely these features which favour self¬ 
heating. The important aspects for self-heating are the 
extent to which the material provides surface area on which 
the oil is exposed, allows air to diffuse in and prevents heat 
from being conducted away. 

The insulation material may have some inhibiting or 
catalytic effect on self-heating in some systems. Bowes 
(1974a) quotes a difference in the minimum pipe tempera¬ 
ture of 24°C for the ignition of oil in two different lagging 
materials. 

Frequently the main insulating material is covered with 
an impervious cement finish or sealing material. This 
greatly reduces the extent to which oxygen can diffuse into 
the insulation. 

The temperature which can be attained in the lagging 
depends on its geometry and on the pipe temperature. 


In some cases it is possible to estimate the lagging 
temperature resulting from self-heating by using theore¬ 
tical methods in combination with suitable experimental 
tests, as described in Section 16.6. 

There are a number of precautions which can be taken 
against lagging fires. One is to prevent the lagging becom¬ 
ing soaked with oil. This means primarily a high standard 
of operation and maintenance to avoid leaks. But, in addi¬ 
tion, measures may be adopted such as not lagging flanged 
joints and protecting lagging at sample points with sheet 
metal collars. 

As discussed earlier, the maximum temperature which is 
attained in self-heating depends on the thickness of the 
lagging. A thick lagging gives good heat insulation, but 
also favours self-heating. A compromise is necessary, 
therefore, between these two factors. 

Methods of making the lagging surface impervious to air 
include the use of a cement finish, bituminous coating 
material or aluminium foil. If such sealing is used, it is 
necessary to ensure that the sealing is maintained, parti¬ 
cularly at the ends of the lagging. 

Another approach is to use not the usual type of insula¬ 
ting material but other insulation such as foam glass 
or crimped aluminium sheeting. Foam glass is relatively 
brittle and requires additional care. It is more expensive, 
although the price differential appears to be narrowing. 
Aluminium sheeting is another alternative, although it 
is not a particularly good insulation. It has been sugge¬ 
sted that the use of aluminium introduces the hazard of 
aluminium—iron smear ignition. 

On some plants with high risk and difficult self-heating 
problems, the approach adopted is to do without insulation 
altogether. In such cases expanded metal ‘stand-offs’ may 
be used to protect personnel from the hot pipework. 

A lagging fire is usually detected by the evolution of 
smoke or other fumes. Such fumes are in fact the most 
satisfactory means of detection insofar as they precede 
incandescence as well as accompany it. It is usually a mat¬ 
ter of chance, however, whether self-heating is detected 
before a fire has developed. 

The use of temperature sensitive paints has been sug¬ 
gested as a means of detection, but this is not likely to be 
particularly effective since the lagging surface tempera¬ 
ture is not a very reliable indicator of self-heating. 

The hazard from a lagging fire may be that of flames 
issuing from the lagging. But frequently the worst hazard 
occurs when the lagging is opened up to remove the 
smouldering material. The fire may then grow, sometimes 
very strongly, particularly if it has been deprived of air 
previously. 

Flames from a lagging fire should normally be 
extinguished with small quantities of water. Water should 
also be available to extinguish fire when smouldering 
lagging is removed. Fire extinguishing agents which do 
not contain water are generally less effective, because 
of the high risk of re-ignition. Regard should be paid, 
however, to any hazard which the use of water may involve, 
such as that associated with electrical equipment. 
Any lagging which might re-ignite should be removed to 
a safe place. Further precautions may be required if 
the lagging contains asbestos material or evolves toxic 
fumes. 

Accidents involving lagging fires are described in Case 
Histories A115 and A122. 
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16.11.4 Duct and cable fires 

Ducts of various kinds are common in process plants and 
buildings. They include ducts used for (1) the conveyance 
of fluids, (2) extraction and other ventilation, (3) pipes and 
(4) electrical cables. 

Such ducts may have walls which are combustible and/or 
may/contain combustible materials. In ordinary ventila¬ 
tion systems the duct walls may be plastic. In fume 
extraction systems combustible deposits may build up on 
the duct walls. Cable and pipe coverings may be combus¬ 
tible. Other sources of combustible material include leaks 
from pipes and debris left in the duct. 

In many ducts air flow occurs due to forced ventilation, 
which is used not only in the ventilation and extraction 
systems, but also to dilute leaks in ducts carrying pipes. In 
other cases air flow may occur in fire conditions due to the 
flue effect. 

If combustible material in a duct is ignited, fire growth 
can be rapid, because the heat does not escape as readily as 
in an open fire and much of it serves to preheat surfaces 
further down the duct, making the fire much more severe 
and causing combustion of materials which would not nor¬ 
mally make much contribution to a fire. 

Accounts of duct fires include those by A.F. Roberts 
(1969/70) and Anon. (1979 LPB 30, p. 155). Investigations 
have been carried out by Roberts and co-workers (A.F. 
Roberts and Clough, 1967a,b; A.F. Roberts, 1969/70,1971a). 
These have included experimental work on fires in ducts 
with walls of wood and of polyurethane. 

Roberts has given a model of duct fires in which, as 
shown in Figure 16.75 important parameters are the length 
L of the flame zone and the velocity Fof the advance of the 
leading edge of the flame. From these the dimensionless 
parameters L * and V* may be defined as 
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where B is the rate of penetration of burning into the 
fuel bed, C is the mass of air required for the complete 
combustion of unit mass of fuel, d is the depth of fuel 



Figure 16.75 Flame spread in a duct fire (A.F. Roberts, 
1969/70) (Courtesy of HM Stationery Office.© All rights 
reserved) 


bed consumed by the fire, D is the duct diameter, / is the 
fraction of surface covered by the lining, V A is the velocity of 
the air, p A , is the density of the air and p f is the density of the 
fuel bed. 

An important distinction is between oxygen-rich and 
fuel-rich fires. The parameter L * is effectively a fuel/air 
ratio so that the conditions for such fires are that for L * <1 
the fire is oxygen rich, while for L* >1 it is fuel rich. 

A fuel rich fire is the more serious hazard, There is a 
greater rate of flame advance and heat release, the com¬ 
bustion gases still contain a large proportion of flammable 
material and they are also toxic. In a fuel rich fire the flame 
advances some 10 times as rapidly as in an oxygen-rich 
fire. Potentially combustible materials arc subject to pro¬ 
longed preheating by flames and combustion products at 
1000—1300°C. At a fuel/air ratio of 3, two-thirds of the 
material vaporized or pyrolysed is still unreacted. The com¬ 
bustion gases contain a large proportion of carbon monoxide. 
Evidence indicates that fuel-rich combustion is favoured 
by narrow ducts, high air velocities, high fuel loading, the 
presence of obstructions and large ignition sources. 

In an established duct fire, the transition from oxygen- 
rich to fuel-rich conditions tends to increase the hazard. 
Reduction of the air flow may thus actually make things 
worse. Since the combustion gases leaving the duct 
may still be highly flammable, they present the hazard of 
further fire and explosion. These gases also contain large 
amounts of smoke and toxic gas, which are not only hazar¬ 
dous, but also tend to hamper severely attempts to fight 
the fire. 

Work by C.K. Lee, Chaiken and Singer (1979) on duct 
fires with forced ventilation indicates that the fire can cause 
an appreciable increase in the flow resistance of the duct 
and can even lead to flow reversal. 

Much of the interest in duct fires relates to fire in coal 
mine roadways, where wood is used as a lining. Work 
on such fires has been done by Roberts and co-workers 
(A.F. Roberts and Kennedy, 1965; A.F. Roberts, Clough and 
Blackwell, 1966; A.F. Roberts and Clough, 1967a,b) and by 
de Ris (de Ris, 1970; A.F. Roberts, 1971a). 

These studies indicate that in modelling duct fires with 
infinitely thick walls there is need for care in making the 
assumption of a steady state. Roberts comments that a fully 
developed duct fire would be a highly elongated phenom¬ 
enon and suggests that the full length of the fire, from the 
start of the burnt out zone to the end of the preheating zone, 
might be of the order of 370 times the duct diameter. 

Another point highlighted by this work is the uncer¬ 
tainty surrounding the value of the heat of vaporization 
H wap of wood, which extends not only to the magnitude but 
even to the sign. 

There are a number of precautions which may be taken 
against duct fires. Good housekeeping can reduce the 
amount of combustible material in the duct. Fire detectors 
may be provided to give early warning. Fire stops may be 
installed to prevent fire spread. The duct may be designed 
to allow access for firefighting. Fire protection systems of 
various kinds are available. Proper working practices may 
be enforced by the use of a permit-to-work system. 

As stated earlier, a case history of a duct fire is given by 
Anon. (1979 LPB 30, p. 155). Other case histories include 
those of cable tray fires as described below. 

A type of duct fire which is of particular concern in pro¬ 
cess plants is cable tray fires. This problem has been dis¬ 
cussed by the FPA (1974a) and by Anon. (1980 LPB 41, p. 5). 
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This is an important matter, because damage to cable 
systems often results in a long outage. 

The widespread use of electric motors in process plants 
has led to a proliferation of motor control centres and large 
electric power and control cable runs. In a large proportion 
of cases it is not practical to use metal conduits and cables 
are run in open metal troughs. 

A single cable may not burn very readily, but a number of 
cables will often burn vigorously, particularly in a vertical 
duct which is favourable to fire spread. Once heated up 
cables may not need a flame to ignite them. Rubber covered 
cables can be ignited by hot air or radiant heat. 

PVC insulated cables present a particular problem. They 
burn well and readily spread fire in vertical ducts, with the 
plastic melting and releasing burning droplets. The PVC 
also decomposes to give large quantities of hydrogen 
chloride gas which is toxic and renders corrosive the water 
used in firefighting. In one power station fire about a third 
of the damage was attributed to this cause. 

Where power and control cables are mixed, short circuits 
can occur from high current lines to lines which are not 
rated for such currents. 

Cable ducts form a means by which fire may spread. This 
is especially serious where the cable ducts lead to a vul¬ 
nerable point such as a control room. 

Ignition in several cable fires has been assisted by an oil 
leak from machinery which has entered the cable duct 
through an unsealed opening. 

Damage to cables may disable the emergency system, 
including the telephones required to summon assistance. 
In one incident notification of the fire brigade was delayed 
because the telephone circuits had failed. 

There are a number of precautions which may be taken 
against cable fires. Cables may be segregated from other 
services and the different types of cable, particularly 
power and instrument cables, may be segregated. The cri¬ 
ticality of all cable runs should be assessed and an appro¬ 
priate degree of protection provided for each. The hazard of 
fire spread through cable ducts to vulnerable points should 
be minimized. 

Fire protection for petrochemical plants and oil plat¬ 
forms has been discussed by Corona (1984) who states that 
a fire protection system for cabling should be based on 
a hydrocarbon pool fire at not less than 1800°F (980°C), 
should maintain the cable temperature within operating 
limits, which on ordinary PVC cables is usually below 
300°F (149°C), and should do this for a time period long 
enough for emergency operation of equipment, which might 
be of the order of 20 min. Another time period often quoted 
for cable protection in petrochemical plants is 15 min. 

Use may be made of fire resistant cabling. If reliance is 
placed on such fire resistance, it is important to select the 
right cable. This is partly a matter of specifying the degree 
of fire resistance required and partly one of assessing 
whether a given cable meets this specification. Several 
workers have emphasized that any tests conducted should 
be on a sufficiently large scale as to be realistic. 

The problem of fire testing of cables and of standard fires 
for such tests is discussed by Schultz (1986). He describes 
the protection of cables using a ceramic-refractory blanket 
held by steel bands. 

Spillage of oil into the cable duct may be minimized by 
sealing the cable holes. Protection against the spread of fire 
through the duct may be provided by fire stops. The design 
of such stops is discussed by Anon. (1980 LPB 41, p. 5). 


Smoke detection devices may be used to give early 
warning. The cable duct may be designed to give access for 
firefighting with a maximum distance between access 
points. Points may be provided to receive high expansion 
foam from mobile generators. 

Use is also made of sprinklers and other fixed fire pro¬ 
tection systems. The application of such protection to elec¬ 
trical cables is a specialist matter. 

Protection against cable fires is required during con¬ 
struction as well as during operation. There have been 
several serious cable fires during the construction phase. 

Accounts of case histories of cable fires have been given 
by the FPA (1974a) and by Anon. (1980 LPB 41, p. 5). 

16.11.5 Storage tank fires 

Storage tank fires are not infrequent in process plant and 
other sites. The quantities of material involved, and conse¬ 
quently the losses, tend to be large.The problem is discussed 
in Fire Protection Manual for HydrocarbonProcessing Plants 
(Vervalin, 1964a, 1973a), in Tank Fires (OIA, 1974 Loss 
Inf. Bull. 400—1) and by a number of other authors (e.g. 
Burgoyne, 1950; Kletz, 1971). 

Storage is discussed in Chapter 22, where the main types 
of storage tank are described. The larger storage tanks are 
atmospheric tanks of the fixed roof or floating roof types. 
The main materials held in atmospheric storage tanks are 
flammable liquids. 

The scale of the fire/explosion on a storage tank instal¬ 
lation can be very large. A single ‘jumbo’ storage tank in the 
petroleum industry may have a capacity of 500,000 barrels 
or more. In many tank fires more than one tank is involved. 

The frequency of fires/explosions in fixed roof tanks 
containing volatile hydrocarbons has been estimated by 
Kletz (1971) as once in 833 tank-years. The estimated fre¬ 
quency for tanks holding non-hydrocarbons is one-tenth of 
this value. Comparable data for floating roof tanks are not 
given. 

It is also apparent that, in addition to accidents involv¬ 
ing fire/explosion, there are also near misses in which, for 
example, tanks are buckled but do not rupture. 

In some cases there is a fire/explosion of a flammable 
mixture in the vapour space of the tank. In others a vapour 
cloud forms outside the tank and the ignites. Other cases 
are fire following liquid slopover or liquid spillage due to 
tank rupture. 

One of the most frequent causes of tank fires/explosions 
is overfilling of the tank. This is usually due to defects in 
operating procedures, failure of instrumentation and/or 
operator error. Failure of ancillary equipment, such as 
pumps, and strikes of lightning are other common causes. 

If there is an initial explosion which blows the tank roof 
off, a fire may be established in the tank and may burn there 
without spreading. 

If there is a spillage of liquid into the bund around the 
tank, due to overfilling, a vapour cloud may form, find a 
source of ignition, and flash back. This may ignite the 
liquid leaving the tank and/or that in the bund. 

If there is a spillage of liquid in the bund from ancillary 
equipment, such as a pump, and the spillage again ignites, 
a general fire may occur. Initially at least there may be no 
fire in the tank. 

Once a fire is established, it frequently causes failures 
which feed the fire. Thus a fire on equipment such as pumps or 
pipework within the bund can cause a pipe failure which 
then results in spillage of the tank contents into the bund. 
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Experience shows that pipework exposed to a strong fire 
in a bund usually fails within about 10-15 min. and heat 
radiation from a tank fire may cause other nearby tanks to fail. 

There are a number of measures which can be taken to 
reduce the risk of tank fires. Much can be done by good 
plant layout. There should be generous spacing between 
tanks to reduce the risk from radiant heat. Tanks should be 
provided with water spray systems which drench them in 
water and keep them cool. To some extent there is a trade-off 
which can be made between these two measures. 

Frequently the fire engulfs all tanks in the bund. It is 
highly desirable, therefore to have a separate bund for each 
tank, particularly for large tanks. 

Pipework inside bunds should be kept to a minimum 
with as few flanges, valves and other fittings as possible. 
Pipework can be buried, but then tends to corrode. Pumps 
should be installed outside bunds, both because they are 
sources of leakage and of ignition, and because they are 
often needed to fight the fire by pumping out the tank. 

Measures should he taken to prevent overfilling of the 
tank. A high level alarm is normally a minimum require¬ 
ment and often a high level trip is desirable. This instru¬ 
mentation should be backed up by appropriate operating 
procedures. 

If a fire occurs in a tank, the water sprays should be 
activated to protect the other nearby tanks. It is often 
appropriate to pump down to a suitable receiver the tank 
which is on fire, but it should be borne in mind that in the 
later stages of this operation the liquid may be very hot and 
may create a hazard at the receiver. 

Tank fires are fought with water and/or foam. The 
quantities required are very large. It is essential, therefore, 
that the fire water mains be adequately sized, both for the 
fire pumps and for the drench water sprays. The tank farm 
should not be a backwater in this respect. Similarly, there 
should be a substantial storage of foam. 

A tank fire can be difficult to fight for several reasons. 
The conditions favour the formation of vapour clouds. 
Metal surfaces become and remain very hot. In con¬ 
sequence, there is frequently flashback of fire to an area 
where it had appeared to have been extinguished. 

Some atmospheric storage tanks contain refrigerated 
liquefied flammable gas. There is much less experience, 
however, with fires on such tanks. 

Liquefied flammable gases are also stored in pressure 
vessels. Again, at a pressure storage vessel overfilling is 
one of the most frequent causes of fire. A fire which devel¬ 
ops around a storage vessel containing a liquid under 
pressure can cause the pressure in the vessel to build up so 
that there is an explosion. 

It is normal practice to provide a pressure relief valve on 
such vessels and it is essential for it to be properly designed 
and maintained, although this does not fully protect 
against the hazard. If the vessel is overheated, it. may rup¬ 
ture even though the relief valve has operated. The occur¬ 
rence of boiling liquid expanding vapour explosions 
(BI.EVEs) on pressure storage vessels is described in 
Chapter 17. 

Measures should be taken to minimize fire and explosion 
on pressure storage vessels. The ground underneath the 
vessel should be sloped away to prevent accumulation of 
flammable liquid. There should be water sprays and/or 
fireproof thermal insulation to give protection against 
fire exposure and there should be safeguards against 
overfilling. 


16.11.6 Major fire events 

In addition to the various types of process plant fire just 
described, there are a number of major fire events to 
which process plants are vulnerable. These are (1) vapour 
cloud fires, (2) fireballs, (3) pool fires, (4) jet flames and 

(5) engulfing fires. These are described in Sections 16.14, 
16.15,16.17,16.19 and 16.20, respectively. 

16.11.7 CCPS Fire and Explosion Model Guidelines 

Guidance on the modelling of such major fire events is 
given in the CCPS Guidelines for Evaluating the Character¬ 
istics of Vapor Cloud Explosions, Flash Fires and BLEVEs 
(1994/15) (the CCPS Fire and Explosion Model Guidelines). 

The Guidelines deal with (1) vapour cloud, or flash, fires, 

(2) vapour cloud explosions and (3) BLEVEs. They also 
cover (4) fireballs, which are treated as an aspect of 
BLEVEs. For each of the three phenomena the Guidelines 
outline basic physical concepts, experimental work and 
available models and correlations for the phenomena 
themselves and for damage and injury, and give sample 
problems. They also contain a set of case histories. 

Vapour cloud fires and fireballs are treated here in 
Sections 16.14 and 16.15, respectively and vapour cloud 
explosions and BLEVEs are discussed in Chapter 17. 

16.12 Flames 

An important factor in the consideration of both the causes 
and the effects of fires/explosions in process plants is the 
behaviour of flames. The study of combustion and flames is 
a specialist matter and only a few selected features are 
mentioned here. It is emphasized, however, that this dis¬ 
cipline makes a very large contribution to loss prevention. 

Accounts of combustion and flames are given in Flames 
(Gaydon and Wolfhard, 1953-) and Combustion, Flames 
and Explosion of Gases (B. Lewis and von Elbe, 1961), 
in the other texts quoted in Section 16.3 and in the 
series International Symposia on Combustion (Combustion 
Institute, 1928-). 

Certain aspects of the behaviour of flames inside plant 
have already been considered. These include flames in 
vessels, flames in pipes and cool flames, which were dis¬ 
cussed in Section 16.3. The present section is concerned 
with flames in the open. 

Flames outside the plant include those of: 

(1) flash fires; 

(2) pool fires; 

(3) fireballs; 

(4) flares; 

(5) jet flames; 

(6) fire engulfed vessels. 

These are considered in the following sections. 

In general, a complete model of a flame will include 
information on: 

(1) flame shape and dimensions; 

(2) heat release rate; 

(3) fraction of heat radiated; 

(4) flame temperature; 

(5) flame emissivity; 

(6) surface emissive power; 

(7) view factor. 

However, it is often not necessary to have full information 
on all of these. If the flame can be treated as a point source, 
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it may be characterized by the heat release rate and the frac¬ 
tion of heat radiated and the simple point source view factor 
used. The other methods require the flame dimensions and 
may utilize a more accurate view factor. There are three 
approaches. One is to use the flame dimensions in combina¬ 
tion with the heat release rate and the fraction of heat radi¬ 
ated, which together, in effect, give the surface emission. 
Another is to use the flame dimensions in combination with 
the flame temperature and flame emissivity, which together 
again give the surface emission. The third is to use the flame 
dimensions and the surface emissive power. 

16.13 Radiant Heat Transfer 

In many process plant fires the dominant mode of heat 
transfer is radiation. An account is given here of radiant 
heat transfer relevant in the present context, but it is 
emphasized that this is no more than an outline treatment 
of a rather complex topic. Standard texts on radiant 
heat transfer include Radiation Heat Transfer (Sparrow and 
Cess, 1966,1978), Thermal Radiation Heat Transfer (Siegel 
and Howell, 1991) and Radiative Heat Transfer (Modest, 
1993), and, for process plant, HeatTransmission (McAdams, 
1954) and Process HeatTransfer (D.Q. Kern, 1950). 


energy of a given frequency which can be emitted at a given 
temperature. An object which emits this quantity is termed 
a black body and the quantity itself the monochromatic, 
or spectral, emissive power for black body radiation. 
The fundamental form of Planck’s law is 


2nhv 3 n 2 

ebv ~ ^[exp [hv/kT) - 1] 


[16.13.3] 


where e bv is the monochromatic emissive power for a black 
body, h is Planck’s constant and k is Boltzmann’s constant. 

On the assumption that the refractive index is indepen¬ 
dent of frequency 

v = c 0 /nX [16.13.4] 

Equation 16.13.3 may be reformulated in terms of the 
wavelength X using the relation 

ebv dv = —e^ai di [16.13.5] 

which yields the equation 


16.13.1 Thermal radiation 

Radiant energy may be conceived as being transmitted 
either as electromagnetic waves or as photons. It travels at 
the speed of light and may be characterized either by its 
frequency v or by its wavelength X, which are related by the 
equation 

c-;Xv [16.13.1] 
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c ■ - c„/n [16.13.2] 

where c is the velocity of light, n is the refractive index and 
the subscript o refers to vacuum conditions. 

The electromagnetic spectrum ranges from y-rays (wave¬ 
length ss 1CT 12 m) to radio waves (wavelength «10 -10 2 m). 
The range of wavelengths for thermal radiation is approx¬ 
imately 0.3-50 pm. As shown in Figure 16.76, this range 
spans the infrared and visible ranges and part of the 
ultraviolet range. 


ci = 2nht? 0 [16.13.8a] 

c% = hcjk [16.13.8b] 

Equation 16.13.7 may be further recast in the form 


eu _ _ ci/g _ 

cn 3 T 3 (nXTf[exv{c 2 /nXT) -1] 


[16.13.9] 


16.13.2 Black body radiation 

It has been shown by Planck from thermodynamic con¬ 
siderations that there is a maximum amount of radiant 


where a is the Stefan-Boltzmann constant. The quan¬ 
tity on the right-hand side of Equation 16.13.9 is a func¬ 
tion solely of nXT. The form of this function is shown in 
Figure 16.77. 
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Figure 16.76 The electromagnetic spectrum 
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Figure 16.77 Emissive power of a black body (Sparrow and Cess, 1978) (Courtesy of Brooks/Cole Publishers) 


The principal black body radiation constants are: 
Speed of light in vacuum c B = 2.9979 x 10 8 m/s 
Planck’s constants = 6.626 x 10 -34 Js 
Boltzmann’s constant £ = 1.381 x 10 -23 J/K 
Stefan—Boltzmann constant a = 5.6705 x 10 -8 W/m 2 K 4 
First radiation constant Cy = 3.472 x 10 -16 W m 2 
Second radiation constant cz = 0.01439 m K 
The total emissive power of a black body is thus 


eb = J «bv dv 

[16.13.10] 

Then from Equation 16.13.3 
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Equation 16.13.13 is the Stefan-Boltzmann equation. 

The refractive index n in Equation 16.13.13 is con¬ 
ventionally taken as unity. This is the value in most prac¬ 
tical applications involving transmission of radiation 
through a gas. The equation then reduces to 


16.13.3 Non-black and gray body radiation 

For a non-black body the monochromatic emissive power e x is 

ex = exe u [16.13.15] 

where ex is the monochromatic hemispherical emissivity. 

It is also necessary to consider the absorption of radia¬ 
tion. If radiation incident on the surface is H x , the amount 
absorbed is a.xH x and that reflected is p x Hx, where a x is the 


monochromatic hemispherical absorptivity and p x the 
monochromatic hemispherical reflectivity. For an opaque 
surface 

ax + px=l [16.13.16] 

It has been shown that for a system in thermodynamic 
equilibrium that 


Equation 16.13.17 is Kirchhoff’s law. 

For a black body e x is unity and so therefore is ax- Thus 
a black body is also a perfect absorber as well as a perfect 
emitter of radiation. 

The total emissive power e of a non-black body is 
e=J™ex<tt [16.13.18a] 

• J°° ex%x61 [16.13.18b] 

The overall emissivity e is 
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where H x is the hemispherically incident radiation per unit 
area per unit time. 

The emissivity e is a function of the surface. The absor¬ 
ptivity a, on the other hand, is a function not only of the 
surface but also of the nature of the incident radiation. 

There are several cases for which a simple relation 
between e and a applies. The most important of these is the 
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gray body. For a gray body e x and 
wavelength X and hence 


<*A = « 


independent of An overall absorption coefficient k may be defined by the 

relation 
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Then from Kirchhoff’s law as given in Equation 16.13.17 

«=* [16.13.24] 

In engineering applications the gray body assumption is 
frequently made. 

Other cases where a simple relation holds between e and 
a are described by Sparrow and Cess (1966,1978). 

For gray body radiation from an opaque material 


and a similar relation applies for the overall scattering 
coefficient y. 


16.13.5 Radiant exchange 

The intensity of radiation 
as shown in Figure 16.78, is 



from a radiation source, 
[16.13.31] 


a + p = 1 [16.13.25] 

From Equations 16.13.14 and 16.13.19 the emissive power 
of a gray body is 


where d> is the radiant flux contained within the solid angle 
dco and 9 is the angle between the direction of this flux and 
the normal. For uniform, or diffuse, radiation 


e= eol 4 [16.13.26] 

The total radiation from a gray body is given by the 
radiosity B, which is the sum of the radiation emitted by the 
surface and that reflected from it 

B = eoT 4 + pH [16.13.27] 

Radiation from a surface may be uniform in all directions 
or it may be directional. The two situations are termed 
diffuse and specular radiation, respectively. Surfaces of 
interest in engineering applications usually approximate to 
diffuse surfaces and the assumption is usually made that 
the radiation is diffuse. 

In general, a surface tends to be diffuse at short wave¬ 
lengths and specular at long wavelengths. Roughness 
increases the diffuseness of the surface. 

16.13.4 Participating media 

The radiation transmitted may be affected by the medium 
through which it passes. Radiation can suffer attenuation 
due to absorption and scattering. A medium which causes 
such attenuation is termed a participating medium. 

Most monatomic and diatomic gases are non-participating 
media, except when at high temperature and/or when 
dissociated. Dry air is therefore also effectively a non¬ 
participating medium, but air containing water and air or 
gas containing water and carbon dioxide are participating 
media. 

The attenuation of the radiation with distance x may be 
expressed by the relation 

h = IoX exp( -fax) [16.13.28] 

h = K X +y x [16.13.29] 

where I x is the monochromatic radiation intensity, I oX 
is the initial monochromatic radiation intensity, (S x is the 
monochromatic extinction coefficient, k x is the monochro¬ 
matic absorption coefficient and y x is the monochromatic 
scattering coefficient. 


A similar expression applies for radiosity 
i = B/n [16.13.33] 

For the general situation of an arbitrary configuration with 
radiant transfer between two differential surfaces AA { and 
cL4y, as shown in Figure 16.79, the treatment is as follows. 
Noting that r is the distance between the surfaces and that 
dco is the solid angle subtended by AAj when viewed from 
AAi and that it is given by 

dco = AAj cos fy/t 2 [16.13.34] 

and that from Equation 16.13.33 

U=Bj/n [16.13.35] 

the radiation leaving cLA,- in the direction of AAj may be 
expressed as 

= AA, cos f J H dco [16.13.36] 



Figure 16.78 Intensity of radiation (Sparrow and Cess, 
1978) (Courtesy of Brooks/Cole Publishers) 






Figure 16.79 Radiant interchange between two differential surfaces (Sparrow and Cess, 1978) 
(Courtesy of Brooks/ Cole Publishers) 


= Bj cos ft cos ft cM; AAj/nr 2 


[16.13.37] 


Another case is where radiation occurs between black 
bodies consisting of two large parallel planes 1 and 2. For 
this case 


An angle factor dF^-^. may be defined as the fraction Q — Ao(Tf T%) [16.13.42] 

of the radiation dA,- which is incident on (L4,-. Then 

For gray body conditions, following D.Q. Kern (1950), 
dFiAi-Mj = cos ft cos fydAj/nr 2 [16.13.38] the radiant heat fluxes are 


Similarly, an angle factor F Al - Al may be defined for the 
radiation from finite surface Ax to finite surface A 2 . Angle 
factors are discussed in greater detail below. 

It should be noted that such angle factors only take account 
of radiation from a source to a target and not of radiation 
back from the target to the source. In the applications of 
interest here, however, the latter is usually negligible. 

Where it is necessary to consider radiation back from the 
target, an emissivity factor F c maybe introduced. Then the 
product of the angle factor F A and the emissivity factor F c 
is the overall interchange factor F 0 



Hot plane 1 

Cold plane 2 

Radiated 

ei (= £l aTt) 

e 2 (=e 2 alt) 

Returned 

ei(l-e 2 ) 

e 2 (l-e() 

Radiated 

«i(l - e 2 ) (1 - ej 

e 2 (l — £i) (1 — e 2 ) 

Returned 

erd-eAd-ei) 

e 2 d —ei)d —e 2 ) 


d-®) 

(1-ei) 


Summation of these terms e for the net radiant flux gives a 
series whose solution is 


F 0 = F A F e [16.13.39] 

The application of these factors is described below. 

There are a number of configurations which occur in 
engineering and for which simple solutions of the radiant 
flux are available. One is the case where a body with arbi¬ 
trary radiation properties and at temperature 7i is located 
inside a completely enclosed space with wall temperature 
T 2 such that black body radiation obtains. Then the net 
radiant heat transfer is 


-ciTi-Tt) 


[16.13.43] 


which reduces to Equation 16.13.42 for n = e 2 = 1. 

Equations 16.13.41 and 16.13.43 may be reformulated in 
terms of the angle and emissivity factors to give 


Q = AF a F £ o(T^ - Tf) 


[16.13.44] 


Q=A(e<rTt-*'jlt) [16.13.40] 

For gray body conditions, Equation 16.13.40 reduces to 
Q=Aecr(Tf-Tl) [16.13.41] 


[16.13.45] 
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16.13.6 Heat radiation 

The main application of radiant heat transfer in the present 
context is the estimation of the heat radiated from flames in 
accident conditions. Accounts of flame radiation are given 
in the standard texts on radiant heat transfer. A review 
relevant to process plant fires has been made by Considine 
(1984SRDR297). 

The radiant heat flux emitted by a flame in such a situa¬ 
tion is given by the relation 

E = £<7T 4 [16.13.46] 

[16.13.47] 

Qr=F r Q c [16.13.48] 

where A f is the surface area of the flame, E its surface 
emissive power, F r the fraction of het released which is 
radiated, Q c the total heat released by combustion and Q T 
the total heat radiated. 

The heat received by the target is 

I = axFE [16.13.49] 

where F is the view factor, lax the heat radition intensity 
received by the target and x is the atmospheric transmis¬ 
sivity. 

These equations are used in conjunction with relations 
for the geometrty of the flame and for the heat radiated per 
unit area of the flame surface. 

There are alternative approaches to the estimation of the 
heat radiated Q r . One is to work in terms of the flame tem¬ 
perature and emissivity. Another is to use empirical values 
of the surface emissivity of the flame envelope. A third is to 
calculate the total heat generated and to apply an factor F r 
for the franction of heat radiated. 

16.13.7 Heat radiation: flame emissivity 

If the first, and most fundamental, of these approaches is 
adopted, it is necessary to estimate the emissivity of the 
flame. The emissivity of a flame depends on the type of fuel 
and on the nature of the combustion. The heat radiated from 
a flame is emitted by gases, in particular the products of 
combustion C0 2 , H 2 0, N 2 , CO and 0 2 and by carbon parti¬ 
cles, or soot. The former are band emitters while the later 
emit over a continuous range. A flame in which the radia¬ 
tion is emitted solely from the gaseous constituents is 
termed non-luminous and one in which there is soot is 
termed luminous. 

C0 2 and H 2 0 

The principal gaseous contributors to flame emissivity 
are carbon dioxide and water vapour. The emissivity % of 
a non-luminous flame may be estimated from that of these 
gases using the relation 

e g = ec + e v -Ae [16.13.50] 

where e c and e w are the emissivities of C0 2 and H 2 0, res¬ 
pectively, and Ae is a correction term which allows for the 
overlap between the bands for these two gases. 

Flame emissivity is required for many furnace calcu¬ 
lations and there is a standard method of estimating it. 


The method is as follows. The emissivity for each gas 
species is a function of the partial product path length 

e c =f(p c L) [16.13.51a] 

e w = f(p w L) [16.13.51b] 

where L is the mean path length, p c is the partial pressure of 
C0 2 and p w is the partial pressure of H 2 0. 

In process calculations, it is necessary to make a 
correction to the partial pressure path length products for 
carbon dioxide and water if the total pressure is other than 
atmospheric. Plots for the correction factors C c and C„ are 
given in standard texts. These corrections are not required 
for flames at atmospheric pressure, which are those of prime 
interest here. The mean beam length Z, is considered below. 

The correction term Ae is a function of the ratio of the 
partial pressure of water to the sum that of the two gases 

Graphs for the determination of the two gas emissivities e w 
and e c and the correction Ae given by Hottel (1954), from the 
experiments of Hottel and Mangelsdorf (1935) and Hottel 
and Smith (1935) for carbon dioxide and the correlation of 
Hottel and Egbert (1942) on water vapour are shown in 
Figure 16.80. 

Soot 

An account of the properties of soot and of its occurrence 
in different types of flame is given by H.G. Wagner (1979). 
Soot usually forms in flames in the temperature range 
1000-2500°C. The total amount of soot is only a small 
fraction of the carbon present. Theoretically, from the 
stoichiometry for a hydrocarbon, soot formation should 
start when the carbon/oxygen ratio (C/O) reaches unity, 
but in practice it starts around C/O»0.5. In work on 
gaseous diffusion flames on burners it has been found that 
the soot concentration is a maximum along the axis, where 
measurements by Kunugi and Jinno (1967) gave concentra¬ 
tions of 3 x 10 z particles/cm 3 , orl0~ -lCT^g/cm 3 . In their 
classic work on turbulent diffusion flames, Dalzell, 
Williams and Hottel (1970) found axial concentrations of 
sootofl0 _6 g/cm 3 . 

The characterization of the emissivity of soot is some¬ 
what complex. The emissivity is a function of the wave¬ 
length, and the following expression has been, suggested 

&U = V'- fe [16.13.53] 

where e s2 is the emissivity of soot at wavelength X, and k\ 
and k 2 are constants. The value of the constant k 2 is of the 
order of unity. 

As described by Markstein (1974), highly sooty flames 
satisfy gray gas models. This implies that the radiation 
is concentrated in a relatively narrow waveband, which 
in turn indicates that the emitting soot particles are dis¬ 
tributed over a narrow temperature range. 

A relation widely quoted for the emissivity of soot from 
non-gray analysis is 

**$4;V(1+*) [16.13.54] 
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Figure 16.80 Emissivity of carbon dioxide and water vapour (Siegel and Howell, 1991): (a) carbon dioxide; 
(b) water vapour and (c) overlap correction term (Courtesy of Hemisphere Publishing Corporation) 
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X 


cLT 

C2 

36 nf y — 
[n 2 


n 2 k 

{nhf + 2f + A(nkf 


[16.13.55] 

[16.13.56] 


where c is the effective soot concentration (volume frac¬ 
tion),/, is the volume fraction of soot particles, L is the path 
length, T is the absolute temperature, X is a parameter and 
i^ (3 ' is the pentagamma function; c 2 is the Planck second 
constant, and k and n are the infrared-average optical con¬ 
stants of soot particles. The penta-gamma function is given 
byAbramowitz and Stegun (1974). 

It has been shown by Dalzell and Sarofim (1969) that an 
alternative, and more convenient, equation which gives 
results similar to Equation 16.13.54 is 

C3 = 1 ~(tlry 

Y hCLT 
C2 


[16.13.57] 

[16.13.58] 


where C is the volume fraction of soot particles, Y is a 
parameter and k 3 is a constant. The value of the constant k 3 
is discussed hy Siegel and Howell who use a value k 3 = 5.0 
in some of their calculations. 

A method for the emissivity of soot has been given by 
Yuen and Tien (1977) based on a gray analysis. They take 

e s = 1 — exp( —kL) [16.13.59] 




[16.13.60] 


where T m is the mean absolute temperature of the flame and 
k is a parameter. The constant 3.6 is that required to ensure 
that Equation 16.13.59 yields results similar to those given 
by Equation 16.13.54. 

These authors give a tabulation of values of these 
variables for a number of gaseous fuels, which includes: 


Gas 

C/H 

c 

Mcnr 1 ) 

T m (K) 

Methane 

0.25 

2.00 x 10“ 5 

0.0645 

1289 

Ethane 

0.33 

1.60 x 10“ 5 

0.0639 

1590 

Propane 

0.38 

3.41 x 10“ 5 

0.1332 

1561 

w-Butane 

0.40 

3.12 x 10 -5 

0.1259 

1612 

Ethylene 

0.50 

2.76 x 10“ 5 

0.1192 

1722 

Propylene 

0.50 

6.46 x 10“ 5 

0.2407 

1490 


Combined C0 2 , H 2 0 and soot 

For the emissivity e m of a gray gas containing C0 2 , H 2 0 and 
soot, Yuen and Tien use the method just described for the 
emissivity e s of soot together with the relation 

£m = es + eg (l- £s ) [16.13.61] 

A method for the estimation of the emissivity of a gray gas 
containing C0 2 , H 2 0 and soot, i.e. a gas-soot mixture, has 


been described by P.B. Taylor and Foster (1974,1975). These 
authors express the emissivity e m of such a mixture as 


e m = J2 a m,«[l - exp (~K m> „L)\ [16.13.62] 

Am,„ = exp (q h „ + q 2 ,„c) c > 0.0005 [16.13.63] 

except that 

Am,i = 0.09 + 500c c< 0.0005 [16.13.64] 

and with 

Om,n = f\n + r 2 ,nT n = 1 or 2 [16.13.65] 

0m,#=l-(0m,l+flm,2) w = 3 [16.13.66] 


where c is the concentration of soot (kg/m 3 ), L is the path 
length (m) and T is the absolute temperature (K); is a 
weighting coefficient, K m „ is an absorption coefficient and 
<h,n, </2,m ri, n and r 2i „ are coefficients; subscript m denotes 
a mixture and n denotes the component of the mixture. 

These relations are applicable to the combustion of oil 
iPwlPc = 1) and gas (p w /p c = 2) at atmospheric pressure 
with p c = 0.1 atm over the temperature range 1400-2400 K 
for path lengths between 0.01 and 10 m. 

The values given for the coefficients are: 



PwlPc = 

; 1 

PJP , 

. = 2 

n 

Ql,n 

Q2,n 

Ql,n 

Q2,n 

1 

-1.252 

558.55 

-1.274 

590.82 

2 

-0.221 

665.38 

-0.233 

672.04 

3 

2.608 

839.62 

2.452 

692.61 

and 

Soot 

n pjp e m I 

PJP 

c = 2 

concent¬ 





ri,n 


n,n r s 


ration, c 

(kg/m 3 ) 

0.0001 

1 0.8119 

-0.0000355 

0.7191 - 

-0.0000336 


2 0.0280 

0.0001013 

0.0804 

0.0001131 

0.0005 

1 0.5478 

-0.0001869 

0.6123 - 

-0.0002489 


2 0.3846 

0.0002071 

0.2688 

0.0002901 

0.001 

1 0.5478 

-0.0001869 

0.6123 - 

-0.0002489 


2 0.3846 

0.0002071 

0.2688 

0.0002901 


Further values are given by the authors. 

Mean beam length 

In his treatment of radiant heat transfer Hottel (1954) 
introduced the concept of the mean beam path length L, 
generally known as the mean beam length or path length, 
as a means of taking into account the geometry of the 
situation considered. He states: ‘The mean beam length L 
may be thought of as the radius of a gas hemisphere which 
will radiate to unit area at the center of its base the same as 
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the average radiation, over A, from the actual gas mass’, 
where A is the area of interest. 

A distinction, amplified below, is made between flames 
which are optically thick and those which are optically 
thin. If the flame is optically thin, and thus p g L « 0, the 
corresponding mean beam length L a is equal to four times 
the mean hydraulic radius 

u = 47/A [16.13.67] 


where A is the area of the enclosure, L 0 is the mean beam 
length for the optically thin condition, p g is the partial 
pressure of the radiating gases and 7 is the volume of the 
enclosure. 

Thus, for example, for a sphere 


4ttP 3 /6 2 n 

u 3 


[16.13.68] 


where D is the diameter of the sphere. For a long, thin 
cylinder 


4;rZ) 2 /4 


[16.13.69] 


where D is the diameter of the cylinder. 

For a gas which is optically thick, Equation 16.13.67 is 
modified to give 


Optical thickness 

Another aspect of effective flame emissivity is the extinc¬ 
tion of radiation within the flame itself. The ratio of the heat 
radiated E to the heat radiated under black body conditions 
E b is 

■=r~h— exp( -fiL) [16.13.73] 

Eb 

where P is an effective extinction coefficient and the 
subscript b denotes a black body. If the product flL is large, 
the flame is said to be optically thick and, conversely, if 
PL —>0 the flame is said to be optically thin. 

For a flame where the optical thickness depends only on 
the partial pressure p g of the radiating gases, the condition 
for optical thinness may be stated as p g L —> 0. 

Hydrocarbon flames 

The flames of some hydrocarbons, such as natural gas, 
contain relatively little soot, whereas those of other hydro¬ 
carbons, such as kerosene, contain much larger amounts. 
In consequence, with natural gas, for paths through the 
flame which in this context are short, say 5 m in length, the 
radiation exhibits a background level due to soot emission 
with superimposed peaks due to gaseous emission. As the 
path length increases so does the.contribution of the soot, 
until at a path length of 10-20 m the emission spectrum 
becomes that of a black body. 


[16.13.70] 

where C bi is a beam length correction factor. It is found 
that, as good approximation, 

C b i 5» 0.9 [16.13.71] 

Then from Equations 16.13.67,16.13.70 and 16.13.71 
47 

L « 0.9~|. [16.13.72] 

Following Hottel’s original tabulation, values of the mean 
beam length L 0 and of the beam length correction factor 
C b i, more accurate than that of Equation 16.13.71, are listed 
for various geometries by Siegel and Howell (1991). Their 
results include: 


System geometry 

Optical 
thickness 
tending 
to zero, 

L a 

Finite 

optical 

thickness, 

L 

Correction 
factor, C b i 

1. Sphere radiating 
to its surface 

2D/3 

0.65 D 

0.97 

2. Cylinder with 
a height 
equal to twice 
its diameter 
radiating to the 
entire surface 

0.871 

0.737) 

0.91 

3. Cube radiating 
to a face 

2Z/3 

0.6Z 

0.90 


where D is the diameter of the sphere or cylinder and X is 
the length of a side of the cube. 


Approximations 

Frequently use is simply made of a point estimate of flame 
emissivity. A smoky flame is often assumed to be a black 
body radiator and thus to, have an emissivity of unity. 
Values of emissivity of 0.9-1.0 are commonly used for 
such flames. LPG is a typical material which gives a smoky 
flame. LNG, on the other hand, tends to give a less smoky 
flame, but also a wider range of emissivities. 

16.13.8 Heat radiation: fraction radiated 

If the alternative approach is adopted of applying a radiant 
heat factor R, it is necessary to have appropriate values of 
this factor. Hymes (1983 SRD R275) has quoted the follow¬ 
ing values given by Roberts: 


Type of flame 

Radiant heat 

Flare and jet flames 

0.2 

Pool fires 

0.3 

Fireballs from vessels 

0.3 

bursting below relief 


valve pressure 


Fireballs from vessels 

0.4 

bursting above relief 


valve pressure 



In general, the fraction of heat radiated depends on the 
efficiency of combustion and the soot formation and on the 
heat lost by convection to the entrained air. Some flame 
models include correlations in which the fraction of heat 
radiated is a function of the operating conditions. 

Further discussion of flame emissivity, the radiant heat 
factor and the generalized heat flux is given in the sections 
below on specific types of flame. 
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16.13.9 Atmospheric transmissivity 

As described above, appreciable attenuation may occur 
when radiation is transmitted from a source to a target 
through the atmosphere. Accounts of gas transmissivity 
have been given by D.Q. Kern (1950) and McAdams (1954). 
These are concerned primarily with radiant transfer in 
process plant items such as furnaces. 

Treatments of atmospheric transmissivity have been 
given by Glasstone (1962) and Glasstone and Dolan (1980), 
Raj et al. (1979), Simpson (1984 SRD R304), VC. Marshall 
(1987), Wayne (1991) and the Committee for the Prevention 
of Disasters (CPD) (1992a). Other accounts of radiant heat 
transmission which include estimation of atmospheric 
transmissivity include those by R.O. Parker (1974), Lihou 
and Maund (1982) and Hymes (1983 SRD R275). 

Attenuation of radiation in the atmosphere is due to 
absorption and scattering. The constituents of the atmo¬ 
sphere responsible for such attenuation are water vapour 
and carbon dioxide. Absorption of radiation is a function of 
the number of absorbing molecules in the path, while scat¬ 
tering is a function of the number and the size of the droplets. 

Glasstone and Dolan (1980) state that, in general, the 
atmospheric transmissivity t for estimation of the thermal 
radiation received by a target from a nuclear bomb explo¬ 
sion is a complex function which depends on the absorp¬ 
tion, scattering and distance. For attenuation due only to 
absorption in a uniform atmosphere they give 

t — exp(-K'x) [16.13.74] 


where x is the distance to the target and k is the absorption 
coefficient. They also utilize this equation for the attenua¬ 
tion due to both absorption and scattering, but state that 
due to the latter k, now an attenuation coefficient, is then 
not constant with distance x. 

They give the following relations between atmospheric 
condition and visibility: 


Atmospheric condition 

Visibility (km) 

Exceptionally clear 

280 

Very clear 

50 

Clear 

20 

Light haze 

10 

Haze 

4 

Thin fog 

2 

Light to thick fog 

<1 


and the following values relating the attenuation 
coefficient k to the visibility: 


Visibility (km) 

«(km J ) 

80 

0.03 

40 

0.1 

20 

0.2 


A number of workers have utilized Equation 16.13.74 
with suitable values of the attenuation coefficient. Lihou 
and Maund have used values ranging from 0.4 km -1 for a 
clear day to 1.0 km -1 for a hazy day with an average of 
0.7 knT ’. Hymes has used values of 0,0.4,1.0 and 2.0 km -1 
for conditions ranging from zero absorption to foggy 


or smoky atmospheres. Simpson quotes values from 
Glasstone (1962) of 0.4,1.0 and 2.01 km -1 for visual ranges 
of 10,5 and 2 km, respectively. 

A more fundamental treatment has been given by 
Simpson (1984 SRD R304). This SRD method involves the 
separate computation of the transmissivities based on 
absorption and on scattering and each of these transmis¬ 
sivities is calculated for a set of discrete ‘windows’ span¬ 
ning the range of wavelengths. The overall atmospheric 
transmissivity is then obtained as the product of the 
transmissivities based on absorption and on scattering. 

For the transmissivity based on absorption the approach 
followed is based on the transmission windows method of 
Elder and Strong (1953) and is as follows. The water 
absorption bands occur at wavelength X = 1.1,1.38,1.87,2.7 
and 6.0 pm and the carbon dioxide bands at 2.7, 4.3 and 
14.5 pm. The wavelength spectrum from 0.72 to 15.0 pm is 
divided into 8 windows, as shown in Table 16.56 separated 
by the water and carbon dioxide bands. 

For a given window i the transmissivity based on 
absorption r a ,- is determined from the equations 

ta,- = exp( - Afto 1/2 ) w < Wi [16.13.75a] 

ta i = ki(m/wf w>wi [16.13.75b] 

where w is the concentration of water in the atmosphere (pr 
mm), Wi is the value of w which causes absorption in win¬ 
dow i to go from weak band to strong band absorption (pr 
mm), and A,-, ft and ft, are constants. The units for water 
content refer to precipitable water (pr mm). Equation 
16.13.75 is based on curve fitting of the plots given by Elder 
and Strong and on extensions by Simpson. Values of the 
parameters are given in Table 16.57. 

For scattering transmissivity an empirical approach is 
taken. This transmissivity is given by the relation 

t s - = exp[-p(Xj)x] [16.13.76] 

where x is the path length and yS(A,-) is the scattering coeffi¬ 
cient for window i. 

The scattering coefficient /l(ft) is reiated to the meteor¬ 
ological, or visible, range V. The meteorological range may 
be defined by the contrast between the sky and a distant 
black target. Taking a value of 2 % contrast gives the relation 


[16.13.77] 


Table 16.56 Window limits for estimation of atmospheric 
transmissivity (Simpson, 1984 SRD R304) (Courtesy of the 
UKAEA Safety and Reliability Directorate) 


Window no. 

Window boundaries, 
X(=m) 

I 

0.72-0.94 

II 

0.94-1.13 

III 

1.13-1.38 

IV 

1.38-1.90 

V 

1.90-2.70 

VI 

2.70-4.30 

VII 

4.30-6.0 

VIII 

6.0-15.0 
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Table 16.57 Parameters lor estimating the absorption 
effects on atmospheric transmissivity (Simpson, 1984 
SRD R304) (Courtesy of the UKAEA Safety and 
Reliability Directorate) 


Window no. A,- k; £,■ *»,• 


I 0.0305 

II 0.0363 

III 0.1303 

IV 0.2110 

V 0.3500 

VI 0.3730 

VII 0.9310 

VIII 0.5980 

I—VIII 0.2110 


0.800 0.112 54 

0.765 0.134 54 

0.830 0.093 2.0 

0.802 0.111 1.1 

0.814 0.1035 0.35 

0.827 0.095 0.26 

0.679 0.194 0.18 

0.784 0.122 0.165 

0.855 0.815 0.6 


where n is the refractive index of the scattering particles. 
Following standard practice in evaluating the visual range 
at X = 0.55 pm 

/? = 3.91/F | ^0.55 [16.13.78] 

Awidely used expression relating the scattering coefficient 
P to the wavelength X is 

P = AX~ q [16.13.79] 

where A is a constant and q is an index. 

Then from Equations 16.13.76-16.13.79 

i'" 3 - 80 ' 

The value most often proposed for q is 1.3, but on excep¬ 
tionally clear days it can be as high as 1.6 and for days in 
which haze reduces the visible range below 6 km a good 
estimate may be made from the relation 

q = 0.585 V 1 ' 3 [16.13.81] 

The total transmissivity t t . for window i is the product of 
the transmissivities based on absorption and on scattering: 

x Ti = [16.13.82] 

The radiation transmitted is then determined as follows. 
From the theoretical black body radiation spectrum a dis¬ 
crete black body radiation spectrum is derived with the 
radiation in each window i at a constant value. The discrete 
spectrum of transmitted radiation is then calculated by 
multiplying the theoretical values by the total transmis¬ 
sivity t t , for each window i. The procedure is illustrated in 
Figure 16.81. 

If desired, the overall transmissivity x may then be 
determined as the ratio of the total radiation transmitted to 
the total black body radiation. 

Values of the overall atmospheric transmissivity x have 
been tabulated by Simpson. He considers black body flame 
temperatures of 1000,1150,1300,1450 and 1600 K, ambient 
air temperatures of 0,15 and 30°C, relative humidities of 
10, 30, 70 and 100%, visual ranges of 2, 5,10 and 20 km 
and actual ranges of from 5 m to 10 km. Some of the 



(a) 



(b) 



(c) 


Figure 16.81 Estimation of radiation transmitted through 
the atmosphere: (a) theoretical black body radiation 
spectrum; (b) black body radiation spectrum produced 
using the procedure outlined; (c) example of the effect of 
atmospheric transmission on the radiation spectrum 
(Simpson 1984 SRD R304). J T thermal radiation flux 
(unattenuated) (Courtesy of the UKAEA Safety and 
Reliability Directorate) 


meteorological data for the United Kingdom given by 
Simpson are shown inTable 16.58. Values of the atmospheric 
transmissivity x obtained by Simpson for some typical 
meteorological conditions are given inTable 16.59. 

Simpson gives comparisons of results obtained with the 
SRD method with those obtained from the methods of 
Glasstone, Raj et ol. and TNO. The Glasstone method gives 
higher values of the atmospheric transmissivity, which 
Simpson attributes primarily to the fact that the method 
neglects absorption. The agreement with the Raj method is 
better, though the latter gives higher values at the longer 
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Table 16.58 Some meteorological data for the United Kingdom relevant to the estimation of atmospheric transmissivity 
(after Simpson, 1984 SRD R304) (Courtesy of the UKAEA Safety and Reliability Directorate) 

A Maximum air temperatures 3 

Temperature range (°C) 

Relative frequency (%) 






<0 

0.7 







0.5—5.0 

8.8 







5.5-10.00 

23.5 







10.5-15.0 

25.6 







15.5-20.00 

24.0 







20.5-25.00 

14.0 







25.5-30.00 

3.2 







>30.0 

0.2 







B Relative humidity 

(RH) as a 

function of 

air temperature 11 





Temperature (°F) 



Relative frequency ofRH (%) 





40-49 

50-59 

60-69 

70-79 

80-89 

90-100 

Total 

54.0-57.9 

- 

- 

- 

- 

0.6 

1.6 

2.2 

58.0-61.9 

- 

0.3 

1.9 

3.5 

3.5 

5.2 

14.4 

62.0-65.9 

0.4 

2.3 

6.5 

13.0 

8.1 

5.2 

35.5 

66.0-69.9 

0.6 

7.5 

8.1 

7.1 

2.9 

0.3 

26.5 

70.0-73.9 

0.3 

3.2 

4.5 

6.1 

— 

— 

14.1 

74.0-77.9 

_ 

1.9 

2.9 

0.3 

- 

- 

5.1 

78.0-81.9 

- 

1.6 

0.3 

- 

- 

- 

1.9 

82.0-85.9 

- 

0.3 

- 

- 

- 

- 

0.3 

Total 

1.3 

17.1 

24.2 

30.0 

15.1 

12.3 

100.0 


a Kew, 1914—40. 
b Calshot, July 1931—40. 


distances, which Simpson attributes to the fact that the 
method neglects scattering. There is good agreement with 
theTNO method for the conditions where comparison can 
be made, but the SRD method is more comprehensive in 
that it takes into account the visual range. 

A number of other treatments and expressions for 
atmospheric attenuation have been listed by Bagster and 
Pitblado (1989) and Satyanarayana, Borah and Rao (1991) 
as follows: 

f:s= 1,382- 0.135log 10 (/>w*) TNO (1979 YellowBook) 

[16.13.83] 

* m 2.02(p v x)~ 009 TNO revised [16.13.84] 

If** 1 — 0.058 In* Major Hazards Assessment Unit 

[16.13.85] 

where p w is the partial pressure of water vapour (Pa) and 
x is the distance (m). 

Wayne (1991) has given the following empirical method 
for the estimation of atmospheric transmissivity. The 
flame is assumed to be a black or gray body at a temperature 
of 1500 K, which is chosen as an average value lying 
between mat of a propane fire and that of an LNG fire. His 
equation is 

fe 1.006 - 0.01171[log 10 X(H 2 O)] - 0.02368[log 10 A(H 2 O)] 2 
- 0.03188[log 10 Z(CO 2 )] + 0.001164[lo glo Z(C0 2 )] 2 

[16.13.86] 


Table 16.59 Some typical values of atmospheric 
transmissivity as a function of visual range (Simpson, 
1984 SRD R 304) (Courtesy of the UKAEA Safety and 
Reliability Directorate) 


Visual range (km) 

100 

Range (m) 

5000 

1 

0.581 

0.003 

2 

0.631 

0.046 

3 

0.656 

0.115 

4 

0.662 

0.176 

5 

0.665 

0.224 

10 

0.665 

0.341 

50 

0.421 

— 

100 

0.426 

- 

500 

0.426 

- 




X(C(h)=L^ [16.13.87] 



where L is the path length (m), is the fractional relative 
humidity, S ^ is the saturated vapour pressure of water at 
temperatureT(mmHg),Xis the atmospheric temperature (K), 
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X(C0 2 ) is a function representing the amount of carbon 
dioxide in the path (m) and Z(H 2 0) is a corresponding 
function for water vapour (pm). X(H 2 0) is actually defined 
as the thickness of the uniform liquid layer which would be 
obtained by notionally condensing the water vapour in an 
absorbing path of unit cross-sectional area onto its base. 
X(H 2 0) must not exceed a minimum value, assigned as 
1 pm, which corresponds to a 10 m path through an atmo¬ 
sphere with T = 253 K and = 0.10. 

Another set of relations is that given by V.C. Marshall 
(1987), as described in Section 16.15. 


16.13.10 Target absorptivity 

The fraction of the incident radiant heat which the target 
absorbs depends on its absorptivity. As already described, 
absorptivity is closed related to emissivity. An account of 
the radiation properties of surfaces is given by Sparrow 
and Cess (1978). 

Emissivity is generally tabulated as a property of the 
material. It should be borne in mind that it is dependent 
both on the surface condition and on the temperature. The 
emissivity of many materials has been tabulated by Hottel 
(McAdams, 1954). Hottel’s table includes the following 
emissivities for steel: 


Mild steel (after cleaning) 0.20-0.32 
Rolled sheet steel 0.66 

Rough steel plate 0.94-0.97 


Numerous other tabulations are available. 

In most flame radiation applications it is assumed that 
the absorptivity of a target is equal to the emissivity. 

16.13.11 View factor 

The treatment of radiant heat transfer from a source to a 
target is based on the concepts of the enclosure and of the 
angle factor. Estimation of the radiation incident on a sur¬ 
face requires that account be taken of the radiation arriving 
on that surface from all directions. In order to do this use is 
made of the concept of an enclosure for each surface of 
which the radiation properties and thermal state are 
defined. An enclosure is not necessarily bounded by solid 
surfaces; some surfaces may be open. 

The other concept is that of the angle factor, also var¬ 
iously known as the shape, geometrical, configuration or 
view factor. Accounts of angle factors, or view factors, 
include those given by Hottel (1954), Hamilton and Morgan 
(1952), McGuire (1953), Sparrow and Cess (1978), Howell 
(1982) and Siegel and Howell (1991). 

An expression for the angle factor between two differ- 


ential surfaces cL4,- and d A, has been given i: 
16.13.38 and is 

n Equation 

= cos Pi cos Pj dAj/nr 2 

[16.13.89] 

Similarly 


AF MriA . = cos pj cos p { AAi/m 2 

[16.13.90] 

Hence from Equations 16.13.89 and 16.13.90 


dA,-dF^..^. = dA ; dF^._a^. 

[16.13.91] 


Equation 16.13.91 is one of three reciprocity rules.The other 
MF&At-M, = &Aj d FiA^iA. [16.13.92] 

A i F Ai _ Aj =A i F Aj _ Ai [16.13.93] 

A further property of angle factors which follows from the 
principle of energy conservation is 

= 1 [16.13.94] 

where Nis the number of surfaces in the enclosure. 

There are a number of methods for the derivation of 
angle factors. They include: 

(1) direct integration; 

(2) contour integration: 

(3) short-cut methods 

(a) angle factor algebra, 

(b) elongated surfaces, 

(c) string method. 


Angle factors have been derived for a large number of 
standard configurations. There are a number of tabulations 
available, including those of Hamilton and Morgan (1952), 
McGuire (1953), Stannard (1977), Sparrow and Cess (1978), 
Howell (1982) and Siegel and Howell (1991). 

It is usual to give for each case the configuration diagram 
together with the governing equation. Angle factor algebra 
may be applied to derive an angle factor for a non-standard 
case from that for a standard case. As an illustration con¬ 
sider the derivation of the angle factor F Al _ Ai for the system 
shown in Figure 16.82. Applying the principle of energy 
conservation 

44-4 = A 12 F Al2 _ Ai - A 2 F M _ Ai [16.13.95] 

where 

A 12 =A 1 +A 2 [16.13.96] 

Applying the principle further 

AuFau^ m A 12 F Ai2 _ Ah - A 12 F Al2 _ As [16.13.97] 



Figure 16.82 Configuration for illustrative example 
of angle factor algebra (Sparrow and Cess, 1978) 
(Courtesy of Brooks/Cole Publishers) 
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-A34 — 7I3 -)- A4 

and hence 


Then, since 9 + 0 = 90°, cos <j> = sin 9. Hence for these 
two cases, from Equation 16.13.103 

[16.13.98] 

F = -^cos9 Vertical target [16.13.104] 


A 2 F M _ Ai = A 2 F m _ Am - A 2 Fa 2 _ A3 [16.13.99] 


Substituting from Equations 16.13.97 and 16.13.99 in 
Equation 16.13.95 yields 


= — (A 12 F Al2 _ A3i + A2 F A2 _ Az 
-A 12 F Ai2 -a 3 -A 2 F A2 _ a J [16.13.100] 


All the angle factors on the right-hand side of Equation 
16.13.100 are obtainable from the single standard case of 
two adjacent surfaces at right angles to each other. 

Treatments of view factors specifically oriented to pro¬ 
cess plant problems include those by Crocker and Napier 
(1986,1988a,b) and B.C. Davis and Bagster (1989-). 

An common situation is radiation from a source, which 
can be treated as a point source. In this case the radiation at 
a spherical surface is 


Qr 
4 nr 2 


[16.13.101] 


where r is the radius of the spherical surface. Then, for 
simplicity, neglecting the absorptivity of the target and the 
atmospheric transmissivity, the heat radiation intensity 
received by the target is 


= FQr 
4nl 2 


[16.13.102] 


where l is the slant distance from the point source to the 
target. 

Then from Equations 16.13.101 and 16.13.102, with 
Equation 16.13.49 the view factor for this case is 


[16.13.103a] 


r 2 

F&^ x~\»r [16.13.103b] 

where / is the slant distance and x is the ground distance 
from the point source to the target. 

An important class of flame is elevated flames such as 
flares and fireballs. These are frequently treated as point 
sources using Equations 16.13.101-16.13.103. 

The view factor is affected by the orientation of the tar¬ 
get. The implicit assumption in Equations 16.13.102 and 
16.13.103 is that the surface of the target is normal to the line 
connecting it with the point source. For heat radiation from 
an elevated point source to a small, or differential, target, a 
correction is required if the target is, say, vertical or hor¬ 
izontal. For a target which is vertical, so that the line 
between the point source and the target makes an angle 9 
with the horizontal, the correction factor to be applied to 
the view factor is cos 9. For a target which is horizontal, so 
that the line between the point source and the target makes 
an angle </> with the vertical, the correction factor is cos (j>. 


F = ^sin9 Horizontal target [16.13.105] 

Equations for view factors are often expressed not in terms 
of the angle 9 but of the lengths of the two sides of the 
relevant triangle. 

The expressions just given apply to differential ele¬ 
ments, or, in practice, small objects.This is generally taken 
to include the human body. Larger objects, such as storage 
tanks, are finite surfaces. 

For the purposes of determining a view factor, there are a 
number of different ways of treating a flame. They include 
treatment as (1) a single point source, (2) multiple point 
sources, (3) an equivalent radiator or (4) a solid flame. The 
equivalent radiator (ER) model treats the flame as a two- 
dimensional surface. For example, the flame on a pool fire is 
represented as a vertical rectangle. In the solid flame (SF) 
model the flame is treated as a three-dimensional solid 
body. For example, the pool fire flame is represented as a 
vertical cylinder. The point source (PS) and multiple point 
source (MPS) models are self-explanatory. 

Table 16.60 gives references to certain standard view 
factors listed by Siegel and Howell (1991) which may be of 
use in work on radiant heat transfer in process plants. 
Relations for view factors for fireballs, pool fires, flares and 
jet flames are given in Sections 16.15 and 16.17-16.19, 
respectively. 


16.14 Vapour Cloud Fires 

A vapour cloud fire, or flash fire, occurs when a vapour 
cloud forms from a leak and is ignited, but without creation 
of significant overpressure. If such overpressure occurs, 
the event is a vapour cloud explosion (VCE) rather than a 
vapour cloud fire (VCF). 

16.14.1 vapour cloud fire incidents 

Release of flammable vapour from a process plant followed 
by ignition is a not uncommon occurrence. If the ignition 
is prompt, the cloud may be modest in size, but if the 
cloud has time to spread over an appreciable part of the site 
and is then ignited, a major vapour cloud fire may result. 
This occurs in only a very small proportion of ignited 
releases. 

Large and destructive vapour cloud fires occurred at 
Port Newark, New Jersey, in 1951 and at Mexico City, 
Mexico, in 1984. These and other incidents are described 
in Section 16.38 and Appendix 4. 

16.14.2 Experimental studies 

Early experimental work on the combustion of vapour 
clouds from spills on land has been described by Raj (1977) 
and work at China Lake in 1978 on spills on water has been 
described byA.D. Little (1979). 

Large-scale tests involving vapour cloud fires from 
spills of refrigerated liquefied gas on water have been con¬ 
ducted in association with other tests concerned with 
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Table 16.60 Some standard view factors that are 
potentially useful in process radiant heat transfer work 


Configuration Reference a 


Circular discs 

1. Plane differential element parallel with 

element: 

la. Normal to element passes 18 

through centre of disc 

lb. Normal to element does not pass 19 
through centre of disc 

lc. Planes containing element and 20 
disc intersect at 90° 

2. One disc to another parallel disc with 23 
centres of both discs along the 

same axis 

Right circular cylinders 

3. Plane differential element to cylinder 26 
of finite height with normal to element 
passing through one end of the cylinder 

and perpendicular to the cylinder axis 

4. Infinitely long line source to parallel 28 
infinitely long cylinder 

5. Infinitely long plane of finite width to 27 
parallel infinitely long cylinder 

6. Infinitely long cylinder to second 30 


infinitely long cylinder of same diameter 

7. Two concentric cylinders of infinite length 31 

8. Two concentric cylinders of finite length 32 

Spheres 

9. Spherical point source to sphere 35 

10. Plane differential element to sphere 

10a. Normal to element passes through 36 
centre of sphere 

10b. Tangent to element passes through 37 
centre of sphere 

11. Sphere to disc with normal to centre of 38 
disc passing through centre of sphere 

12. Two concentric spheres 41 


a References are to Siegel and Howell (1991), Appendix C. 


heavy gas dispersion.The vapour cloud dispersion and fire 
tests at Maplin Sands have been described by Blackmore, 
Eyre and Summers (1982) and Hirst and Eyre (1983), and 
those at China Lake in 1980-81 have been described by 
Ermak et al. (1983). An account of the dispersion tests has 
already been given in Chapter 15. 

The Maplin Sands trials involved the spillage onto the 
sea, dispersion and, in some cases, combustion of liquefied 
natural gas (LNG) and refrigerated liquid propane. Both 
quasi-instantaneous and continuous releases were made. 
In the trials involving combustion, seven were with LNG 
and four were with propane. Plate 9 shows the progress of 
Trial 27 at Maplin. 

Ignition was effected by spark igniters located on certain 
pontoons. In two of the LNG tests flame failure occurred 
soon after ignition. Moreover, infrared measurements 
indicated that in several tests, both with LNG and with 
propane, at least one and sometimes two ignitions were 
followed by flame failure before the bulk of the cloud 
ignited. These latter failures were not visible to the eye. 


Flame failure was attributed to inhomogeneities of the 
concentration in the cloud. 

The instantaneous and continuous releases differed in 
that, whereas in the latter a pool of liquefied gas was cre¬ 
ated which gave in effect a pool fire also, in the former there 
was no pool fire. 

The combustion of the vapour cloud involved first 
burning of the pre-mixed part and then diffusive burning 
of the fuel-rich part. The flame in the pre-mixed burning 
did not propagate quickly across the top of the cloud, but 
remained as a ‘wall of fire’. 

Expansion of the combustion products was principally in 
the vertical direction. The unburnt gas was not pushed 
ahead of the flame front to any significant extent. Where a 
pool fire occurred, the height of the flame was appreciably 
greater. 

The vapour clouds were made visible by the associated 
water fog. In the case of the LNG clouds the contour of the 
lower flammability limit (LFL) lay within that of the fog, 
and combustion was entirely within the visible fog; some 
of the visible cloud remained unburned. For the propane 
clouds the LFL contour lay outside the fog and combustion 
took place in part outside it. 

The flame speeds measured during the combustion were 
relatively low, and far removed from the figure of 150 m/s 
often quoted as necessary for the generation of appreciable 
overpressure. For LNG in Test 27 the flame speed averaged 
4 m/s with a maximum of 10 m/s, whilst for pronane inTest 51 
the corresponding figures were 12 and 20 m/s, respectively. 

Pressure deviations measured during the combustion 
were a maximum of 0.8mbar for LNG and 0.4mbar for 
propane. The maximum deviations were underpressures, 
the overpressures being rather less. The form of the decay 
of the overpressure was that the overpressure was inver¬ 
sely proportional to the distance. 

With regard to thermal radiation, the surface emissive 
power of the cloud fires was measured as 173 kW/m 2 for 
both LNG and propane. For the pool fires the values 
obtained were 203kW/m 2 for LNG but 43kW/m 2 for pro¬ 
pane. The authors suggest that a value of 200kW/m 2 may 
be representative for larger vapour cloud fires and for LNG 
pool fires. The lower value for propane pool fires is in 
accordance with results for pool fires of propane on land, as 
described below. 

The account of the combustion tests in the Coyote trials 
described by Ermak et al. (1983) gives broad confirmation 
of these findings. The tests involved 40 m 3 spills of LNG 
onto water. Again the flame velocities were modest. They 
lay in the range 11.9-18.9 m/s for wind speeds of 
4.6-10.0 m/s, the values of the flame speed less the wind 
speed being 6.4-12.9 m/s. The flame velocities appeared to 
be high near the ignition source, whether a flare or a jet, 
and fell off rapidly. There was no indication of significant 
flame acceleration. The flame heights were somewhat 
higher than in the Maplin tests. 


16.14.3 Empirical features 

The foregoing description indicates some of the empirical 
features of a vapour cloud fire. A further account is given 
by Crawley (1982). The conditions favouring a vapour cloud 
fire are a prolonged release in conditions of poor dispersion. 

Two main types of flame behaviour have been assumed. 
Raj and Emmons (1975) conceive the burning as a ‘wall of 
fire’, whilst Fay and Lewis (1977) propose the formation of 
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a fireball by the rising thermal. No fireball effect is men¬ 
tioned in connection with the tests just described. The wall 
of fire mode occurs in the combustion of the fuel-rich por¬ 
tion. Overall, the combustion is usually not especially 
rapid or violent, the flame progressing through the cloud at 
a speed of several metres per second. 

Strictly, a vapour cloud combustion which generates 
overpressure has to be classed as a vapour cloud explosion. 
In practice, the latter term tends to be reserved for cases 
where the explosion causes significant destruction. For 
vapour cloud fires, the overpressures vary from the 
imperceptible up to those which may cause some window 
damage. 

A vapour cloud fire may cover a wide area, perhaps some 
thousands of square metres. It results in scorching and 
depletion of oxygen, with potential for injury and damage. 
It may initiate BLEVEs and other releases of flammable 
material which then feed the fire. It also deposits soot. 

16.14.4 Modelling of vapour cloud fires 

The hazard from a vapour cloud fire is usually assessed by 
considering dispersion of the vapour cloud and ignition of 
this cloud and making some relatively simple assumption 
concerning the effects inside and outside the cloud. 

In many assessments no explicit model of a vapour cloud 
fire has been utilized. Instead it has been assumed that: the 
contours of the burning cloud are those of the lower 
flammability limit concentration; persons inside the cloud 
suffer a denned degree of injury, generally a fatal injury; 
and those outside the cloud are subject to a level of thermal 
radiation based on an assumed surface emissive power at 
the edge of the burning cloud. 

16.14.5 Eisenberg, Lynch and Breeding model 

An early model for a flash fire is the Vulnerability model by 
Eisenberg, Lynch and Breeding (1975). The vapour cloud is 
assumed to be a half ellipsoid with volume V T and area A r 
given by the equations 

■A + *£)(*? + *u) 


[16.14.1] 

[16.14.2] 




n = 2 In 



1/2 


[16.14.3] 


' i6j4 ' 4] 

where A r is the area of radiation of the hot gas layer (m 2 ), 
k\ is the concentration at the lower explosive limit (kg/m 3 ), 
k„ is the concentration at the upper explosive limit (kg/ 
nr), m is the total mass of vapour released (kg), r\ is a 
parameter of the cloud at the lower explosive limit, r u is a 
parameter of the cloud at the upper explosive limit, V r is the 
volume of the hot gas layer (m 3 ), and a x , o y and a z are dis¬ 
persion coefficients in the downwind, crosswind and ver¬ 
tical ( x, y and z) directions, respectively (m). 


The heat loss q from the gas is predominantly by radia¬ 
tion, so that 

q^A r a{t i T i g -tJ'l) [16.14.5] 

where q is the heat loss by radiation (W), T a is the absolute 
temperature of the environment (K), T s is the absolute tem¬ 
perature of the hot gas (K), e a is the emissivity of the 
environment, e g is the emissivity of the hot gas and e is the 
Stefan-Boltzmann constant (= 5.67 x 10 _8 W/m 2 K 4 ). 

The layer of radiating gas may be expected to be some tens 
or even hundreds of meters thick. Under these conditions the 
gas emissivity does not change much with layer thickness or 
temperature and has a value of about 0.5. The authors replace 
Equation 16.14.5 by the approximate relation 

q ss* A r a(T^ — T^) [16.14.6] 

The gas emissivity of unity in Equation 16.14.6 includes an 
allowance for the other modes of heat transfer. 

The heat loss is also given by 

q =~W V r^f I 16 - 14 -^ 

where c p is the specific heat of the hot gas layer (J/ kg K), the 
time (s) and p is the density of the hot gas layer (kg/m 3 ). The 
hot gas layer is nearly always mostly air. 

Equating the heat flows in Equations 16.14.6 and 16.14.7 
gives 

- It) [16.14.8] 


_ A r <r 
~c pP V r 


[16.14.9] 


Equation 16.14.8 has the solution 

-P®-i-(?:;? 


[16.14.10] 


where subscript i denotes the initial value. 

Equation 16.14.10 may be rewritten in terms of the half- 
life t \/2 of the fire, or the time at which 


T s = ~ 
Then 




16 14 1 L 



[16.14.12a] 


n the equivalent form given by the authors, 


(£HK?3)] 

[16.14.12b] 





FIRE 16/175 



Figure 16.83 Flame at the edge of a burning vapour cloud (after Raj and Emmons, 1975; CCPS, 1994/15) (Reproduced 
by permission of the American Institute of Chemical Engineers) 


P = r gi /T a [16.14.13] 

where 4/2 is the half-life of the flash fire (s). 

The effective thermal radiation intensity is given by 

I T = <r(7^ - 7/J) [16.14.14] 

where I T is the effective thermal radiation intensity of the 
flash fire (W/m z ). 

The effective time duration t eti is 

4ff = 3 1 1/2 [16.14.15] 

where / e ff is the effective time duration of the flash fire (s). 
The initial value of the absolute temperature of the hot gas 
T gi is taken as the adiabatic flame temperature. 

16.14.6 Raj and Emmons model 

Another flash fire model is that of Raj and Emmons (1975). 
This model takes into account the speed of the flame pro¬ 
pagating through the cloud. The assumptions made are 
that during the combustion of a vapour cloud there is a 
turbulent flame front propagating into the unburned cloud 
at a constant velocity which is roughly proportional to the 
wind speed, and that at high gas concentrations there is a 
tall flame plume at the edge of the unburned cloud. 


This model is represented in Figure 16.83 in which a 
flame front is propagating at constant velocity S into an 
unburned cloud of depth D with a flame base of width W 
and a flame height H above the top of the cloud. 

The treatment of flame height is based on the pool fire 
model of F.R. Steward (1964). The observed height of such 
flames is approximately twice that of the base (H/W = 2). 
Application of the conservation equations gives a relation 
between the flame height and the upward velocity of the 
gases. Then from a mass balance on the triangle formed by 
the flame and the base, a relation may be derived between 
the flame height H and the flame speed S. 

This treatment forms the basis of the semi-empirical 
equation given by Raj and Emmons for the flame height of 
a flash fire: 





S = 2.3U W [16.14.lfJ 


where D is the cloud depth (m), g is the acceleration due to 
gravity (m/s 2 ), H is the visible flame height (m), r is the 
stoichiometric air-fuel mass ratio, S is the flame speed, or 
‘burning speed’ (m/s), U w is the wind speed (m/s), w is a 
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parameter, p a is the density of air (kg/m 3 ) and p a is the 
density of the fuelair mixture (kg/m 3 ). 

The parameter w represents the inverse of the volumetric 
expansion due to combustion in the plume and is strongly 
dependent on the composition of the cloud. For a cloud of 
pure vapour, w «1/9, assuming the vapour is hydrocarbon, 
whilst for a cloud of stoichiometric composition or leaner, 
w = 0 . 

The application of the relation for w given by Raj and 
Emmons is somewhat complex. As described below, the 
Center for Chemical Process Safety (CCPS) has developed 
an alternative and more straightforward equation. 

The expression for the flame speed S is derived by Raj 
and Emmons from a limited number of experimental 
observations. 

The heat flux incident on a receptor may be estimated 
from Equation 16.13.49. 

16.14.7 CCPS model 

The set of hazard models given in the CCPS Fire and 
Explosion Model Guidelines (1994/15) includes a model for 
flash fires. The model is essentially that of Raj and 
Emmons with a modification of the expression for the 
parameter w. For this the CCPS gives 

w = 0 0 < 0 st [16.14.18a] 

* >K [16.14.18b] 

chiometric combustion, 0 is the volumetric concentration 
of fuel (v/v) and the subscript st denotes stoichiometric. For 
hydrocarbons the value of a is typically about 8. 

In applying the model for the estimation of thermal 
radiation the CCPS propose the use of the following two 
assumptions: (1) during the propagation of the flash fire, 
the cloud is stationary and is fixed and homogeneous 
in composition; and (2) the time-dependent flame surface 
is a plane cross-section moving through the cloud at the 
flame speed. 

16.14.8 Considine and Grint model 

Considine and Grint (1985) have given a model for a flash 
fire in the form of graphs of the distance to particular levels 
of fatal injury. This model is described in Section 16.39. 


16.15 Fireballs 

Another significant fire hazard is that from fireballs. 
Accounts of fireballs include those by Gayle and Bransford 
(1965), R.W. High (1968), Hardee and Lee (1973), Strehlow 
and Baker (1976), Fay and Lewis (1977), V.C. Marshall 
(1977a, 1987), Hardee, Lee and Benedick (1978), Hasegawa 
and Sato (1977,1978), Fay, Desgroseillers and Lewis (1979), 
Williamson and Mann (1981), A.F. Roberts (1981/82,1982), 
Crawley (1982), Lihou and Maund (1982), Moorhouse and 
Pritchard (1982), W.E. Baker et al. (1983), Pietersen (1985), 
Jaggers et al. (1986), Roper et al. (1986), D.M. Johnson and 
Pritchard (1991) and the CCPS (1994/15). 

Most treatments of fireballs relate to liquefied gas. Here a 
distinction needs to be made between a fireball resulting 
from the bursting of a pressure vessel and one resulting 
from the formation of a vapour cloud. In the first case the 
bursting may occur under fire conditions and be part of a 


BLEVE or it may occur in the absence of fire. Momentum 
forces predominate if a fireball is formed from the bursting 
of a vessel, and buoyancy forces predominate in one formed 
from a vapour cloud. 

There are two other types of event which may give rise to 
a ‘fireball’. One is the ignition of a release on a liquefied gas 
pipeline, where the jet flame is preceded by a fireball in 
which unignited gas is burned. The other is an eruption in 
hot oil giving rise to a release of burning vapour. This is 
exemplified by the event that occurs when water is added to 
burning fat in a chip pan. Eruptions of burning vapour 
have occurred in some storage tank fires. 

An instance has also occurred of a congested fireball 
following rupture and release of the flammable contents of 
a reactor into a building. 

The type of fireball of particular interest, however, is 
that which occurs as part of a BLEVE and it is this type 
which is mainly treated here. 

A quite different type of fireball is that associated with 
the explosion of a propellant or high explosive. Such fire¬ 
balls are discussed in the next section. 

Some studies on fireballs are given in Table 16.61. 

16.15.1 Fireball incidents 

Incidents involving fireballs are not uncommon. They 
usually occur as pan of a BLEVE when a vessel ruptures 
after it has been engulfed in fire or has been subjected to a 
directed flame. The vessels principally liable to such con¬ 
ditions are storage vessels, rail tank cars and road tankers. 

Fireball incidents are generally associated with BLEVE 
incidents. BLEVEs are considered in Chapter 17, which 
contains in Table 17.37 a list of incidents involving fireballs 
with and without BLEVE. 

A massive BLEVE fireball occurred at Crescent City, 
Illinois, in 1970 with an estimated diameter of 150-200 m 
(Case History A50). Other major BLEVE fireball inti-dents 
include those at Houston,Texas, in 1971 (Case History A53), 
Lynchburg, Virginia, in 1972 (Case HistoiyA59), Kingman, 
Arizona, in 1973 (Case History A63), Oneonta, New York, 
and West St Paul, Minnesota, in 1974, and Belt, Montana, in 
1976. The estimated diameters of the fireballs at Houston, 
Kingman and Belt were 300 m. The disaster at Mexico City 
in 1985, described in Appendix 4, involved a series of fire¬ 
balls from BLEVEs. Other fireball incidents have occurred 
at Eagle Pass,Texas, in 1975, Goldona, Virginia, in 1977, and 
Donnellson, Iowa (Case History A91) and Lewisville, 
Arkansas, in 1978. The estimated diameter of the fireball at 
Donnellson was 610 m and of those at Goldonna and 
Lewisville 320 and 310 m, respectively. 

16.15.2. Experimental studies 

Experimental research on fireballs has taken three main 
forms treating fireballs generated by: (1) explosives and 
propellants, (2) gas-filled bubbles and balloons and (3) 
containers undergoing BLEVE. 

Early experimental investigations of fireballs were con¬ 
cerned with fireballs from propellants. Gayle and Brans¬ 
ford (1965) obtained data from 47 tests and incidents with 
the mass of combined propellant (fuel + oxidizer) in the 
range 10-250,000 lb. 

A correlation for the diameter of the fireball of the pro¬ 
pellant of the Saturn rocket of NASA, based on tests, has 
been given by R.W High (1968). 

Taking first small scale tests. Fay and Lewis (1977) stu¬ 
died the fireball from hydrocarbon fuels held initially, 
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Table 16.61 Some studies of fireballs 


Experimental study on fireballs of propellants 
Theoretical study of fireballs of rocket propellants 
Theoretical study of fireballs of propellants 
Theoretical study of fireballs from bursting vessels 
Experimental and theoretical study of fireballs from a 
stationary vapour cloud 
Theoretical study of LNG fireballs 
Experimental and theoretical study of fireballs following 
liquid flash-off 

Experimental and theoretical study of fireballs 
from bursting vessels 

Review of experimental and theoretical work on 
fireballs and of case histories and assessment of hazard 
Experimental study on fireballs 
Review of experimental and theoretical work on fireballs 
and correlation of principal features of fireball behaviour 
Experimental and theoretical study of fireballs 
Review of experimental and theoretical work on fireballs 
Theoretical study of fireballs 
Experimental study of BLEVEs, including fireballs 


Gayle and Bransford (1965) 

R.W. High (1968) 

Bader, Donaldson and Hardee (1971) 
Hardee and Lee (1973,1975) 

Fay and Lewis (1977) 

Fay, Desgroseilliers and Lewis (1979) 
Hardee, Lee and Benedick (1978) 
Hasegawa and Sato (1977,1978) 

Maurer et al. (1977) 

Giesbrecht et al. (1980) 

VC. Marshall (1977a, 1987) 

A. Baker (1979) 

A.F. Roberts (1981/82,1982) 

Lihou and Maund (1982) 

Moorhouse and Pritchard (1982) 
Jaggers etal. (1986); Roper et al. (1986) 
D.M. Johnson and Pritchard (1991) 


inside soap bubbles with volumes in the range 20-190 cm 3 . 
Hasegawa and Sato (1977) carried out a series of 22 tests on 
fireballs of «-pentane held in glass spheres with a fuel mass 
in the range 3.1-6.2kg. These authors also performed a 
further series of 32 tests on fireballs with a fuel mass in the 
range 3.1-31.0 kg. Hardee, Lee and Benedick (1978) have 
described tests on fireballs of pure and pre-mixed methane 
held in balloons and polyethylene bags, with quantities in 
the range 0.1-10 kg. A.F. Roberts (1981/82) reports two 
unpublished tests byA. Baker (1979) with a fuel mass of the 
order of 10 kg. Lihou and Maund (1982) have described 
experiments on fireballs from hydrocarbons in bubbles 
with a fuel mass in the range 0.07-6 g. 

Of the larger scale tests, most have been associated with 
BLEVEs. C. Anderson et al. (1975) have described a test 
on a fully loaded 125 m 3 rail tank car which was made to 
suffer a BLEVE. A single fireball experiment with a fuel 
mass of 452 kg has been described by Maurer et al. (1977) 
and Giesbrecht et al. (1980). In the work at Bundesanstalt 
fiir Materialpriifung (BAM) on fire engulfed vessels, 
described by Schulz-Forberg, Droste and Charlett (1984), 
Droste and Schoen (1988) and Schoen, Probst and Droste 
(1989), several of the vessels were taken to the point of a 
BLEVE. Other larger scale experiments on BLEVEs have 
been reported by D.M. Johnson and Pritchard (1991). In this 
work the mass of fuel involved was of the order of 1-2 te. 


16.15.3 Empirical features 

A fireball from the bursting of a pressure vessel containing 
liquefied gas is observed to pass through a number of fairly 
well-defined phases. 

The development of a full-scale fireball is captured in 
the National Fire Protection Association (NFPA) film on 
BLEVEs. Crawley (1982) has described the development 
based on a frame-by-frame analysis of this film. The fire¬ 
ball passes through three phases: (1) growth, (2) steady 
burning and (3) burnout. The growth phase may be divided 
into two intervals, each of about 1 s duration. In the first 
interval the flame boundary is bright with yellowish-white 
flames indicating a flame temperature of about 1300°C. The 


fireball grows to about half its final diameter. Calculation 
indicates that fuel droplets of less than 4—5 mm diameter 
would vapoirize. This would give good mixing with air at 
the droplet scale. There would also be good bulk mixing. 

In the second interval of the growth phase, the fireball 
grows to its final volume, but about 10% of the surface is 
dark and sooty with the rest being white, yellowish-orange 
or light red, indicating flame temperatures in the range 
900—1300°C, with an estimated effective flame tempera¬ 
ture of 110-1200°C. 

In the second phase, which lasts some 10 s, the fireball, 
which is now roughly spherical, is no longer growing. At 
the start of this phase it begins to lift off. It rises and 
changes to the familiar mushroom-shape. The estimated 
effective flame temperature is 1100—1200°C. 

In the third phase, which lasts some 5 s, the fireball 
remains the same size, but the flame become less sooty and 
more translucent. 

Figure 16.84 illustrates the typical development of a 
fireball as a function of time. 

The experimental work has also yielded useful infor¬ 
mation on aspects such as the fraction of the fuel which 
participates in the fireball, the fireball diameter and dura¬ 
tion, the fraction of heat of combustion which is radiated, 
and the surface emissive power of the fireball. These 
aspects are discussed below. 


16.15.4 Modelling of fireballs 

The modelling of fireballs covers the following aspects: 
(1) the fireball regime, (2) the mass of fuel in the fireball, 
(3) the fireball development and timescales, (4) the fireball 
diameter and duration, (5) the heat radiated and (6) the 
view factor. 

The treatment of the heat radiated from a fireball is a good 
illustration of the different approaches which may be taken 
to the modelling of fires in process plants. Specifically, there 
are three different ways of determining the heat radiated. 
One is to assume that it is a given fraction of the heat 
released. Another is to assume a given value for the heat 
radiated from the flame surface, or surface emissive power. 
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Figure 16.84 Development of a typical fireball from a source at ground level 


The third is to estimate the heat radiated from the flame 
properties, such as flame temperature and emissivity. 

Models of fireballs are of two broad types: correlations of 
diameter and duration time, and fundamental models. 

In order to maintain some consistency with the notation 
of the original authors, the symbols M and Ware both used 
for mass. 


16.15.5 Fireball regimes 

As stated earlier, there are two basic scenarios for the fire¬ 
ball of a liquefied gas. The case of prime interest is a fireball 
resulting from the bursting of a pressure vessel. The other 
case is a fireball from the burning of a stationary vapour 
cloud at atmospheric pressure. 

These two situations constitute quite different regimes. 
The duration times for these are: for the bursting vessel 
where momentum forces dominate 

f d oc M 1 / 3 [16.15.1] 

and for a vapour cloud where buoyancy forces dominate 

t A oc M 1/6 [16.15.2] 

where M is the mass of fuel (kg) and t A is the duration 
time (s). 

For the situation where initially there is high momentum, 
a change of regime occurs as the momentum declines and 
gravity slumping begins. 

The case of prime interest here is the bursting of a vessel, 
but that of a stationary vapour cloud is also treated in 
Subsections 16.15.17 and 16.15.18. 

16.15.6 Mass of fuel 

The mass of fuel in the fireball depends on the fraction of 
fuel which flashes off and on the further fraction which 
forms liquid spray. 

For propane the relation between the theoretical adia¬ 
batic flash fraction and the liquid temperature and vapour 
pressure is shown in Figure 16.85 (A.F. Roberts, 1981/82). 
The 35% flash fraction occurs at 21°C and the 50% flash 
faction at 45° C. 

Hasegawa and Sato (1977) found that when the theore¬ 
tical adiabatic flash fraction reaches 35% virtually all the 
liquid released burns as a fireball. 

From this, A.F. Roberts (1982) derives the relations 

M 

#»—.«§ 4> = 0 [16.15.3a] 



Figure 16.85 Relation between the theoretical adiabatic 
flash fraction and temperature and vapour pressure prior to 
rupture for a fireball (A.F. Roberts, 1981/82). (Reproduced 
by permission of the Fire Safety Journal) 

/ = 1 <£>0.35 [16.15.3b] 

where/is the fraction of fuel released entering the fireball, 
M is the mass of fuel in the fireball (kg), M r is the mass of 
liquid released (kg) and <£ is the fraction of liquid vapor¬ 
ized. Hence by linear interpolation 

/ = 0^5 0< ^ <0 ' 35 [16.15.3c] 

This treatment is broadly equivalent to the rule of thumb 
commonly used for fireballs that the fraction of the fuel 
released which participates in the fireball is three times the 
flash fraction. This is the method used by the CCPS (1994/ 
15) to determine the mass of fuel in the fireball. 

Both the equations and the rule of thumb just quoted 
evidently derive from the Hasegawa and Sato’s work. An 
essentially similar approach is taken in the treatment given 
by VC. Marshall (1987), as described in Subsection 16.15.20, 
except that he makes a distinction between summer and 
winter conditions. Another commonly used, and con¬ 
servative, approach is to assume that all the fuel released 
enters the fireball. 

16.15.7 Fireball development and timescales 

A fireball is of relatively short duration, but it passes in its 
life cycle through several distinct stages which need to be 
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carefully defined if confusion is to be avoided. A discussion 
of these stages and of the associated time scales is given by 
A.F. Roberts (1981/82). 

He distinguishes three distinct stages of fireball devel¬ 
opment. Stage 1 involves the rapid mixing of the fuel with 
air and rapid combustion of the fuel and is dominated by 
the initial momentum of release. In Stage 2, the residual 
fuel is mixed with air already in the cloud or entrained into 
it and is burned; this stage is more affected by buoyancy 
and combustion effects and less by the initial momentum. 
In Stage 3, with combustion essentially complete the fire¬ 
ball rises due to buoyancy, entraining further air and cool¬ 
ing; in this stage the size may be increasing or decreasing 
depending on the relative rates of air entrainment and of 
heat loss. These stages of development are illustrated for a 
small fireball in Figure 16.86. 

Roberts defines five timescales. The time 4 is the duration 
of combustion in a system dominated by initial momentum 
effects. The time 4 is the duration of combustion in a system 
dominated by buoyancy effects, and 4 is the duration of 
combustion in a system dominated by deflagration effects; 
these are alternatives to time 4- The time 4 is that at which 
visible radiation from the fireball ceases. The time 4 is that 
at which fireball lift-off occurs. Of the three combustion 
times, that of prime concern here is 4 which is that appli¬ 
cable to a fireball following bursting of a vessel. 


16.15.8 Fireball diameter and duration 

Fundamental models of fireballs are given below. The most 
widely used models, however, are essentially correlations 
of fireball diameter and duration time, of which there are 
a considerable number. 

Various workers have correlated fireball diameter using a 
relation of the form 

D = k\M ni [16.15.4] 

where D is the diameter of the fireball (m), is a constant 
and is an index. 

An early correlation of fireball diameter is that of 
R.W. High (1968), who gives 

D = 9.82 IF 0320 [16.15.5a] 

where D is the diameter of the fireball (ft) and JFis the mass 
of propellant (fuel + oxidizer) (lb). Roberts converts this 
equation to 

D = 2.95 IF 0 - 320 [16.15.5b] 

where D is the fireball diameter (m) and IF is the mass of 
propellant (kg). 


Stage 1 Stage 2 Stage 3 



Figure 16.86 Timescales for the development of a small fireball (A. F. Roberts, 1981/82). (Reproduced by permission of 
the Fire Safety Journal) 
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Hasegawa and Sato (1978) give for their definitive corre¬ 
lation following their second series of tests 

D = 5.25 A/ 0 ' 314 [16.15.6] 

The available experimental data on, and correlations for, 

fireball diameters have been reviewed by A.F. Roberts 
(1981/82) who obtained for hydrocarbons the following 
relation: 

D = 5.8 Af 1/3 [16.15.7] 

This is now probably the mostly widely used correlation for 
fireball diameter. 

Most correlations of the duration time f d are of the form 
f d = k 2 M n ° [16.15.8] 

where k 2 is a constant and n 2 is an index. 

An early equation for duration time is that of R.W. High 
(1968) who gives the following equation for the persistence 


d = 0.232 W 0320 [16.15.9a] 

where d is the persistence time (s) and W is the mass of 
propellant (lb). Roberts converts this to the equivalent 
relation 

t d = 0.49 AT 0 - 320 [16.15.9b] 

Hasegawa and Sato give equations for the duration time 
of their first set of experiments with smaller fireballs 
(M < 6.1 kg) and for the combined sets of experiments with 
smaller and larger fireballs. The exponents in their equa¬ 
tions are 0.097 and 0.181, respectively. 

These two sets of correlations reflect, therefore, the dif¬ 
ference in the exponent discussed in Subsection 16.15.5. 

Here it is the fireball from the bursting of a vessel which 
is of prime interest. From a review of the experimental data 
and correlations for duration time, Roberts obtains 

t A = 0.45 A/ 1 / 3 16.15.10] 

Equation 16.15.10 is not applicable, however, to larger mas¬ 
ses, where the regime is dominated by buoyancy rather 
than momentum. These different regimes have been 


described in Subsection 16.15.5 and are treated again in the 
model of Jaggers, Roper et al. in Subsection 16.15.18. In the 
buoyancy-dominated regime, the index of M is approxi¬ 
mately 1/6 rather than 1/3 as in the momentum dominated 
regime. The Major Hazards Assessment Panel (MHAP) 
(1988 LPB 82) has therefore proposed the following 
modification: 


f d = 0.45itf 1/3 M< 30,000 [16.15.11], 

f d = 2.6Af 1/6 M > 30,000 [16.15.12] 

Pietersen (1985) gives for LPG fireballs the correlations 

D = 6.48 A/ 0 - 333 [16.15.13] 

t A = 0.852 A/ 0 ' 26 [16.15.14] 


A summary of correlations of fireball diameter and duration 
time is given in Table 16.62. Further compar isons of such 
correlations are given by Bagster and Pitblado (1989), Satya- 
narayana, Borah and Rao (1991) and the CCPS (1994/15). 

16.15.9 Heat radiated 

There are three methods of estimating the heat radiated by 
a fireball. These are based on (1) the heat evolved and radi¬ 
ated, (2) the surface emissive power and (3) the flame tem¬ 
perature and emissivity. 

The heat evolved may be obtained from the heat of com¬ 
bustion of the fuel. 

For the fraction of heat radiated Roberts states that the 
work of Hasegawa and Sato suggests a value of the order of 
0.25. He also proposes the following relation based on the 
results of these workers: 

F r = 0.27 P 0 32 1.35 < P 16.15.15] 

where F r is the fraction of heat radiated and P is the vapour 
pressure at the moment of release (MPa). He states that 
extrapolation up to P = 6 MPa, about the highest pressure 
of interest, gives F r = 0.48. A more refined treatment by 
Roberts is described below. 

Another rule of thumb for the fraction of heat radiated is 
that given by Hymes (1983, SRD R275) which is that the 
fraction of heated radiated for a vessel bursting below the 
set pressure of the pressure relief valve may be taken as 0.3 
and that for one bursting above this pressure as 0.4. 


Table 16.62 Some correlations of fireball diameter and duration time for hydrocarbons a 


Diameter D( m) 

Duration time, t A (s) 

Material 

Reference 

5.55 Af 0 ' 333 

- 

Propane 

Hardee and Lee (1973) 

6.36 A/ 0 ' 325 

2.57 Af 0 ' 167 

Hydrocarbons 

Fay and Lewis (1977); 

Hardee, Lee and Benedick (1978) 

5.25 A/ 0 ’ 314 

1.07 M °- 181 

w-Pentane 

Hasegawa and Sato b (1978) 

5.8 A/ 0-333 

0.45 A/ 0 ' 333 

Hydrocarbons 

A.F. Roberts (1981/82,1982) 

5.88 M 0333 

1.09 M °- 167 

Propane 

Williamson and Mann (1981) 

5.72 A/ 0 ' 303 

0.45 Af 0333 

Butane 

Lihou and Maund (1982) 

5.33 A/ 0 ' 327 

0.923 A/ 0303 

Hydrocarbons 

Moorhouse and Pritchard (1982) 

6.48 A/ 0325 

0.852 Af 026 

LPG 

Pietersen (1985) 

5.5 A/ 0333 

0.38 A/ 0033 

Hydrocarbons 

VC. Marshall (1987) 


a Sources: Lihou and Maund (1982); Bagster and Pitblado (1989); Satyanarayana, Borah and Rao (1991); and original papers. 
b These authors' earlier correlation (1977) was D = 5.28 M 0277 . 
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A commonly used value for the fraction of heat radiated 
from a fireball is 0.3. 

Several workers have quoted values of the surface emis¬ 
sive power. Estimates made by Roberts of the heat flux at 
the surface of the fireballs in the work of Hasegawa and 
Sato are in the range 141—196kW/m 2 with individual 
values up to 450 kW/m 2 . A review of the surface emissive 
power of fireballs by Moorhouse and Pritchard (1982) con¬ 
cludes that the realistic range is 150-300 kW/m. In large- 
scale experiments on BLEVEs, D.M. Johnson and Pritch¬ 
ard (1991) obtained surface emissive powers in the range 
250—350kW/m 2 . Considine, Grint and Holden (1982) use a 
value of 350 kW/m 2 for hazard assessment. These figures 
are appreciably higher than those for pool fires. 

Based on the work of Roberts, the MHAP give the fol¬ 
lowing relation for surface emissive power: 

E — 235 P 0 ' 39 P< 2 [16.15.16] 

where E is the surface emissive power (kW/m 2 ) and P is the 
pressure (MPa). The limit on pressure given is equivalent to 
a limit on the surface emissive power of 308 kW/m 2 . 

A surface emissive power commonly used for fireballs is 
350 kW/m 2 . 

The fraction of heat radiated is used in conjunction with 
the point source model of a fireball and the surface emissive 
power is used in conjunction with the solid flame model. 
The two quantities are not independent but are linked via 
the surface area of the fireball. Given a fireball diameter, 
and hence a surface area, a particular value of the surface 
emissive power implies a corresponding value of the frac¬ 
tion of heat radiated. 

With regard to fireball temperature, Roberts states that 
the values which he derives for the surface emissive power 
in the work of Hasegawa and Sato, just mentioned, are in 
the range consistent with flame temperatures of 
1000-1400°C, a flame emissivity of unity, and 50-100% 
excess air. As described in Subsection 16.15.3, Crawley 
(1982) has used film of an actual fireball to obtain estimates 
of effective flame temperature of the order of 1100-1200°C. 

The proportionalities between the diameter D, the dura¬ 
tion time 4 and the mass of fuel M given in Subsection 
16.15.8 have an important consequence. The heat generation 
is proportional to the mass M of the fireball, the heat loss 
per unit time is proportional to the surface area A, the heat 
loss at a given fraction of the duration time is proportional 
to the product At A , the surface area A is proportional to 
Af 2 / 3 and the duration time 4 is proportional to M 1 ? 3 . It fol¬ 
lows, according to this model, that for a given fuel the heat 
radiation and temperature at a given fraction of the duration 
time are the same for all masses of fuel, or, in other words, 
that there is a single heat radiation and temperature profile. 

16.15.10 Fireball scenarios 

Before considering the view factor it is necessary to say 
something about the scenarios usually considered in the 
modelling of thermal radiation from a fireball. The 
approach commonly taken is to assume that the fireball is a 
sphere with its base just touching the ground and that its 
diameter and duration are given by one of the sets of cor¬ 
relations just described. 

A target close to the fireball may be engulfed by it and it 
is of interest to know the furthest distance at which 
engulfment occurs. For this purpose there are two fireball 
geometries which may be used. One is that of a fireball 


which is essentially spherical but slightly settled on the 
ground. This corresponds to the shape of the fireball over 
most of its life and the engulfment distance approximates 
to the radius of the fireball. The other geometry is that of a 
hemispherical fireball.This corresponds to the shape of the 
fireball during its initial expansion and the engulfment 
distance then approximates to the radius of this hemi¬ 
spherical fireball, being greater than the spherical case hy a 
factor of about 1.25 (2 1 / 3 ). The period of engulfment in the 
hemispherical fireball is much shorter. 

In the near field estimates of the thermal radiation from a 
fireball are subject to some inaccuracy. 

The set of view factors available for fireballs covers both 
the near and far fields and includes view factors for targets 
beneath an elevated fireball. The more complex expressions 
for the view factor are those applicable to such near field 
situations. 


16.15.11 View factor 

For a spherical fireball the thermal radiation intensity at 
the surface is 


E 


Qr 
4 nr 2 


46.15.17] 


where E is the surface emissive power, Q r is the heat radi¬ 
ated and r is the radius of the fireball. 

The heat received I by a target normal to the surface of 
the fireball is 


/ = axFE 


axFQ T 

4nr 2 

axQ r 

4nP 


[16.15.18] 

[16.15.19] 

[16.15.20] 


where l is the distance between the centre of the fireball and 
the target, a is the absorptivity of the target and x is the 
atmospheric transmissivity. Hence from Equations 16.15.19 
and 16.15.20 the view factor Ffor such a target is 


[16.15.21] 


A set of view factors for fireballs covering other situations 
has been given by the CCPS (1994/15). For a horizontal 
surface at a ground distance x the view factor is 


F- 


i*h 

u’ - h>-) 31 


[16.15.22] 


where h is the height of the centre of the fireball (h > r) and 
x is the distance from the point directly beneath the centre 
of the fireball and the target, or the ground distance. 

The corresponding expression for a vertical surface is 
limited to the case where the surface is not directly beneath 
the fireball: 




r 2 * 

{x 2 + h 2 f 2 


[16.15.23] 


In the far field (x &l^>h) Equation 16.15.23 reduces to 
Equation 16.15.21. 
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B < rr/2 - <t> 0 < -rr/2 - <t> 

(a) (b) 

Figure 16.87 View factor for fireballs (after CCPS, 1994/15): (a) the target ‘sees’ the whole fireball; and 
(b) the target ‘sees’ only part of the fireball (Courtesy of the American Institute of Chemical Engineers) 


For the case where the surface is beneath the fireball 
expressions exist both for a vertical surface and for a sur¬ 
face of any inclination. The latter is given here as being the 
more general case. Here two situations have to be con¬ 
sidered, as shown in Figure 16.87. In Figure 16.87(a) the 
target ‘sees’ the whole fireball, whilst in Figure 16.87(b) it 
does not, the part of the fireball marked x being out of sight 
The expressions for the view factor in these two separate 


lin - 1 

it [ l sin 6 J 

r 


_^l(/2_ y 2)V2 (y 2_;2 cos 2 0) l/2 


[16.15.24] 


[16.15.25] 


The case to which these latter equations apply is a rather 
special one and, as indicated above, near field estimates are 
subject to some inaccuracy. 

Crocker and Napier (1988a) have given relations for 
the view factor for a spherical fireball just touching the 
ground for the three cases of (1) a large vertical target, 


(2) a differential vertical target and (3) a differential 
horizontal target. Their expressions are equivalent, res¬ 
pectively, to Equation 16.15.21, or Equation 16.13.103; 
Equation 16.13.104; and Equation 16.13.105. These authors 
also treat the case of an elevated fireball. 


16.15.12 Point source model 

One of the simplest practical models for a fireball is the 
point source model. For this model the heat received by the 
target is 


a xF r Q 


[16.15.26] 


where Q is the heat release rate (kW). 

Hymes (1983 SRD R275) has given a version of this model 
which effectively incorporates a combustion rate and an 
allowance for the effect on this of the mass of fuel. Intro¬ 
ducing the term a to put the model on the same basis as the 
previous equation gives 


2.2arF r AH c M 0£1 


[16.15.27] 


where AH C is the heat oc combustion (kj/kg). 


16.15.13 Solid flame model 

The other main alternative for practical use is the solid 
flame model 

/ = vxFE [16.15.28] 
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16.15.14 Fireball modelling 

Fireball models in the form of correlations of diameter and 
duration time have already been described. There are also a 
number of more fundamental models. Such models include 
those by Bader, Donaldson and Hardee (1971), Hardee and 
Lee (1973), Fay and Lewis (1977), Hardee, Lee and Benedick 
(1978), A.F. Roberts (1981/82,1982), Williamson and Mann 
(1981), Lihou and Maund (1982), Jaggers etal. (1986), Roper 
et al. (1986) and VC. Marshall (1987). Some of these models 
are now described. 

16.15.15 Bader, Donaldson and Hardee model 

An early fundamental model of a fireball is that by Bader, 
Donaldson and Hardee (1971). The model is for the fireball 
of a propellant such as the Saturn fireball. The fireball is 
assumed to be a homogeneous, isothermal body, which is 
spherical throughout. Other assumptions are that the rate 
of addition of propellant is constant, that no air enters the 
fireball either during or after the reaction period, that all 
the propellant participates in the reaction, and that the 
fireball radiates as a black body. For simplicity, it is 
assumed that the burnout and lift-off times coincide. 

For a high temperature fireball such that the difference 
Ap between the density of the air p a and the density of the 
fireball gas p is approximated by Ap « p the buoyancy 
force is 

= [16.15.29] 

and the fluid resistance force of the fireball gas is 


Combining Equations 16.15.32 and 16.15.33 gives for the 
burnout time 

t b = 0.572 W b 1/6 [16.15.35a] 

«0.6r* /e [16.15.35b] 

where t b is the burnout time (s). 

For the growth of the fireball 

R = W/t [16.15.36] 

* W h /t b [16.15.37] 

where R is the rate of addition of propellant (lb/s), W is the 
mass of the fireball (lb), t is time (s) and the subscript b 
denotes burnout. 

From Equations 16.15.35b and 16.15.37 
i? = ~IF b /6 [16.15.38] 

The radius of the fireball may then be written as 


''37? A 1/3 
K 4np) 


[16.15.39] 


where r is the radius of the fireball and p is its density. 
Utilizing Equation 16.15.38 


H” 1 * |© ! -S] i 161530 ' 

where F B is the buoyancy force (N/m 2 ), Fr is the resistance 
force (N/m 2 ), g is the acceleration due to gravity (m/s 2 ), r is 
the radius of the fireball (m), p is the density of the fireball 
(kg/m 3 ) and t is time (s). Equating these two equations 
yields 

W--r{$ +2e -° Im5 ' 311 

In this equation the first term is the inertia term and the 
second the added mass term due to the displacement of air 
by the gaseous products. The solution of Equation 16.15.31 


r = |f 2 [16.15.32] 

The radius of the fireball at burnout, and on lift-off, is 



1/2 

(1/3 


[16.15.40] 


16.15.16 Hardee and Lee model 

Another early fireball model is that by Hardee and Lee 
(1973). This model applies to the fireball following the rup¬ 
ture of a vessel containing a liquefied flammable gas. The 
assumptions made reflect those of the model of Bader, 
Donaldson and Hardee, with the changes necessary to treat 
the case in hand. It is assumed that a vapour cloud grows 
into which the rate of addition of fuel is assumed to be con¬ 
stant. Ignition occurs when the mixture is stoichiometric. 
The fireball is homogeneous, isothermal and spherical. 
Other assumptions are that all the available fuel is burned, 
that the fireball radiates as a black body, and that the 
burnout and lift-off times coincide. The model given is 
similar to that of Bader. Donaldson and Hardee and 
includes Equations 16.15.33, 16.15.35b, 16.15.38 and 
16.15.40. 

The authors obtain for a propane fireball a relation 
equivalent in SI units to 


/ O \l/3 

*-(5?) ^ /3 [16 - 15 - 33] 

where r b is the radius of the fireball at burnout (ft), W b is the 
mass of propellant, and therefore of the fireball, at burnout 
(lb) and p is the density of the fireball gas (lb/ft 3 ). Taking a 
value of p = 0.0055 lb/ft 3 yields 


D = 5.55 M 1 ' 3 [16.15.41] 

where D is the diameter of the fireball (m) and Mis the mass 
of fuel (kg). 

This model has been further developed by Hardee, Lee 
and Benedick (1978), who apply it to a fireball of LNG. 
Equation 16.15.35b may be rewritten in SI units as 


r b = 3.51W b 1/3 


[16.15.34] t b = 0.684 W b 1/6 


[16.15.42] 
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and then as 

% = 0.684( W b / Wf ) 1/6 W f 1/6 [16.15.43] 

where t b is the burnout time (s), W b is the mass of the fireball, 
including air, at burnout (kg), Wf is the mass of fuel (kg). For 
a stoichiometric mixture of methane and air W b /Wf = 18.3. 
Substituting this value in Equation 16.15.43 yields 


where, P is the entrainment coefficient. The order of 
magnitude of /J is one. 

Integrating Equation 16.15.52 with the boundary condi¬ 
tions r = 0; z = 0 yields 

r Pz [16.15.53] 


f b = 1.11 [16.15.44] 

Further, taking the density p as 0.160 kg/m 3 and the 
value of W b /Wf as 18.3, and utilizing Equation 16.15.44 in 
Equation 16.15.40 yields 



Equating the forces of buoyancy and of the rate of change of 
vertical momentum 


fht* 3.12 Wf /2 [16.15.45] 

where r is the radius of the fireball (m). 

The resulting correlations for fireball diameter and 
duration time are therefore 

D = 6.24 Af 0 ' 333 [16.15.46] 

f b = 1.11A/ 0167 [16.15.47] 

A critique of this model of an LNG fireball has been given 
by Gillette (1980), who makes detailed criticisms of the 
model itself and suggests that for LNG the occurrence of 
‘fireballs’ is a speculation. 


16.15.17 Fay and Lewis model 

The model by Fay and Lewis (1977) is applicable to the quite 
different situation of a fireball formed from a compact, 
stationary cloud of pure fuel vapour ignited at the edge. In 
this scenario, the combustion products move upwards, 
promoting mixing with the air. When the volume of these 
products becomes comparable with the initial volume of the 
vapour, the mixture of fuel, air and products begins to rise, 
burning more vigorously as it accelerates, consuming vir¬ 
tually all the fuel. 

In modelling the combustion, it is assumed that the 
volume of the unburned vapour is negligible compared 
with that of the products. Thus, for example, the volume of 
the products of the stoichiometric, adiabalic combustion of 
methane is 83 times that of the fuel vapour. 

The authors state that it can be shown by dimensional 
analysis that the following proportionalities hold; 



/pocl ^/g 1 ' 2 


[16.15.48] 

[16.15.49] 

[16.15.50] 

[16.15.51] 


where r is the radius of the cloud, t is the time, V t is the 
volume of the initial cloud of fuel, z is the height of the 
centre of the cloud and subscript p denotes the products. 

The growth of the cloud is modelled drawing on the 
entrainment hypothesis of B.R. Morton, Taylor and Turner 
(1956). The volumetric rate of growth is taken as being 
proportional to the product of the local surface area and the 
local rise velocity: 


i (S)] = 5^ (Pa - [16 - 15 - 5 ^ 

where is the density of air. 

Utilizing Equation 16.15.52 in the integration of Equation 
16.15.55 gives 



[16.15.56] 




[ U Pp ] 1/2 /3iV 6 
[gP(p^-Pp)\ Uv 


[16.15.57] 


where V is the volume of the fireball. 

The radius r, height z and duration t have their maximum 
values when the cloud volume Fequals the volume V p of the 
combustion products. For a hydrocarbon C n H m 


\m<p + 4.762(4w + rri) 

[ 40 


’](t> 


[16.15.58] 


where T p is the absolute temperature of the products, T r is 
that of the reactants, V t is the volume of the fuel, V p is that of 
the products and <f> is the equivalence ratio. 

The authors treat P and 0 as parameters to be deter¬ 
mined. From soap bubble experiments they obtain for the 
entrainment coefficient an average value of P = 0.285. 
This is in reasonable agreement with the values given by 
Morton, Taylor and Turner. For the equivalence ratio the 
average value is 0 = 0.217, which corresponds to about 
4.5 times the stoichiometric amount of air. 

16.15.18 Jaggers, Roper et al. model 

Studies of the conditions under which the buoyancy and 
momentum regimes apply have been described by Jaggers, 
Roper and co-workers (Jaggers et al., 1986; Roper et al., 
1986). 

Jaggers et al. (1986) give a set of relations based on dimen¬ 
sional analysis. For the case where the release velocity is 
low and buoyancy forces dominate those of momentum, 
they obtain 






[16.15.52] 


[16.15.59] 
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whilst for the other limiting case where the release 
velocity is high and momentum forces dominate those of 
buoyancy 




[16.15.60] 


Some typical values for this time are 


M(kg) 

a (m/s) 

m 

1,000 

220 

1.6 

100,000 

220 

7.4 


Hence 


fboc 


sr 


[16.15.61] 


where M is the mass of fuel, 4 is the burning time, v 0 is the 
mean release velocity and p a is the density of air. The mean 
release velocity v a is defined as the ratio of the initial 
momentum of the release to the mass of fuel released. 


16.15.19 Roberts model 

The fireball model which is most widely used is probably 
that of A.F. Roberts (1981/82,1982). The model comprises 
both fundamental and correlation models and covers the 
whole range of features of practical interest. 

Fireball development 

Roberts takes as his starting point for fireball growth the 
model by Hardee and Lee (1973). From this he obtains for a 
hemispherical fireball 


'-(^f 

5 -(« ^T rV ‘ |1615 ' 631 

'-T (“F 


where M is the mass of fuel released (kg), r is the cloud 
radius (m), t is the time (s), Fis the cloud volume (m 3 ), a is 
the momentum per unit mass (m/s) and p a is the density of 
air (kg/m 3 ). 

The concentration of the fuel may be determined from 
the mass released M and from the volume Fof the cloud. 

The term a is a function of the vapour pressure of the 
liquid in the vessel prior to failure. For a vapour pressure 
less than the atmospheric pressure, a = 0. For propane at 
28°C and a vapour pressure of 1 MPa, a = 220 m/s. 

For propane, the cloud volume given by Equation 
16.15.64 may be written as 


The time t g required for the transition from a regime domi¬ 
nated by momentum effects to one dominated by gravita¬ 
tional slumping is derived by Roberts from the work of 
Jagger and Kaiser (1981). The criterion given for transition is 


p a (dr/df) 


[16.15.67] 


where A p (= p T - p a ) is the density difference between of 
the vapour and the air (kg/m 3 ). 

For the Hardee and Lee model 


Pv 

Then for N = 1 


[16.15.68] 


[16.15.69] 


where t g is the time to the transition from control by 
momentum to control by gravity slumping (s). 

For propane from Equation 16.15.68 and with N = 1 


= 0.05a 


[16.15.7G] 


Fireball volume and diameter 

For the fireball volume and diameter Roberts gives the fol¬ 
lowing treatment. The volume Fof the fireball at the mean 
temperature T f is 


F m 


M a + Mf 
Pf 

(M a + Mj)Tt 


p 0 T 0 


[16.15.71] 

[16.15.72] 


and the enthalpy His 

H = c(M a + M f ) (T f - T 0 ) [16.15.73] 


where c is the specific heat (kj/kg K), H is the enthalpy 
rise of the fireball (kj), M a is the mass of air in the fireball 
(kg), Aff is the mass of fuel in the fireball (kg), T f is 
the absolute mean temperature of the fireball (K), T 0 is the 
absolute initial temperature of the reactants (K), p f is the 
density of the products at temperature T f (kg/m 3 ) and is 
the density of the products at temperature T 0 (kg/m 3 ). 

Then from Equations 16.15.72 and 16.15.73 


F-118(M) 3/4 [16.15.65] 

Since for propane at the lower flammability limit the 
volume of the cloud is approximately 30 M, the lime t! 
required for the cloud to fall below the lower flammability 
limit (s) is 

f = —M 1 ' 3 [16.15.66] 


A4+M _ H _1 

Po [ T 0 c(M a + Mi)\ 
and hence 


[16.15.74] 


T 0 c{M a +Mi)\ p 0 


M? 3 


where D is the diameter of the fireball (m). 
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Different relations are required for the enthalpy H, 
depending on whether the mixture is fuel or oxygen rich. If 
R is the value of the ratio MJM f for the stoichiometric 
mixture, then 

H = W <R ^ fuel ridl ^ [16.15.76a] 

M, 

H = rjMfQ ~ >R (oxygen rich) [16.15.76b] 

where Q is the heat of combustion (kj/kg) and t] the thermal 
efficiency. The thermal efficiency r\ takes account of heat 
losses during growth to the maximum diameter and losses 
due to unburned fuel. 

Roberts uses Equation 16.15.75 to explore the effect of the 
air/fuel ratio parameter MJRMf and the thermal effi¬ 
ciency r\ on the constant k\ in Equation 16.15.4 for fireball 
diameter. The value of this constant is 5.8 for MJRM t = 1 
and r\ = 1 and it is relatively insensitive to MJRMf over the 
range 0.8-3.0 and to r\ over the range 0.75-1.0. 

Duration time 

Roberts, argues that the behaviour of larger fireballs 
(M> 5 kg) appears to differ from that of smaller ones, and 
obtains for larger fireballs only the relation 

4 = 0.83 A/ 0316 [16.15.77] 

where f d is the duration time (s). 

The experimental correlations for duration time f d 
therefore lie between Equation 16.15.10 and the relation 

4 = 0.90 M 1 ' 3 [16.15.78] 

The data of Baker also lie between the lines given by 
Equations 16.15.10 and 16.15.78. The relation recommended 
by Roberts for the duration time f d is Equation 16.15.10. 

For the lift-off time 4 Roberts quotes the equation given 
by Hardee and Lee 

4 = l.lAf 1/6 [16.15.79] 

where 4 is the lift-off time (s). Lift-off is determined by 
buoyancy effects and the exponent of 1/6 is well established 
for such effects. 

The exponent of g in Equation 16.15.79 for lift-off time 4 
compares with that of j in Equation 16.15.10 for the 
duration time t d - Thus the lift-off time 4 may be less or 
greater than the duration time t d . Roberts quotes the 
following typical figures obtained from these equations: 


M(kg) 

4(s) 

4(s) 

200 

2.6 

2.6 

50,000 

16 

6.7 


Thus for smaller fireballs combustion will tend to be com¬ 
plete before lift-off occurs, while for larger ones lift-off will 
tend to occur while combustion is still taking place. It is the 
duration time 4 which is used to characterize the period 
during which the fireball radiates heat. 


Heat radiated 

In the model given by Roberts for heat radiation from the 
fireball, it is assumed that such radiation occurs as a 
square wave pulse of duration f d - The basic equation for 
heat radiation is 


[16.15.80] 


where Aff c is the heat of combustion (kj/kg), F r is the frac¬ 
tion of heat radiated and Q r is the heat radiation rate (kW). 

The intensity of thermal radiation at a target, neglecting 
target absorptivity and atmospheric transmissivity effects, 
is then 


[16.15.81] 


where I is the radiation intensity received by a target per¬ 
pendicular to the direction of radiation (kW/ m 2 ) and l is the 
distance from the centre of the fireball to the target (m). The 
relation between the term (l/Anl 2 ) in Equation 16.15.81 and 
the view factor is given in Subsection 16.15.11. 

Roberts’ treatment of the fraction F r of heat radiated has 
already been described, but for completeness is restated 
here. He quotes values in the range 0.2-0.4 as typical of 
both pool fires and fireballs. He also analyses the data of 
Hasegawa and Sato (1978), shown in Figure 16.88, and 
derives from these a relation between the heat radiation 
factor and the vapour pressure prior to rupture 


F t = 0.27 P 032 [16.15.82] 

where F r is the fraction of heat radiated and P is the vapour 
pressure just prior to rupture (MPa). 

Equation 16.15.82 is thus derived for data with vapour 
pressures up to 1.3 MPa, but Roberts suggests it may 
be extrapolated up to 6 MPa at which pressure the value of 
F t is 0.48. 

Summary 

Roberts’ model for a fireball from a bursting vessel may be 
summarized as follows. The mass of fuel in the fireball is 
given by Equation 16.15.3, the diameter of the fireball 
by Equation 16.15.7, the duration time of the fireball by 
Equation 16.15.10, the fraction of heat radiated by Equation 
16.15.82, the total heat radiated by Equation 16.15.80, and 
the thermal radiation received by the target (neglecting the 
target absorptivity and atmospheric transmissivity 
effects) by Equation 16.15.81. 

16.15.20 Marshall model 

Another model which is readily applied to practical situa¬ 
tions is that by V.C. Marshall (1987). This model is based 
essentially on correlations for diameter and duration time, 
but again deals with the other features of practical interest. 

The model may be summarized as follows. For the mass 
of fuel in the fireball 

M = 2<j>M s Winter [16.15.83a] 

M = 30 A/ s Summer [16.15.83b] 

where M is the mass of fuel entering the fireball (te), M s is 
the mass of fuel in the vessel (te) and </> is the theoretical 
adiabatic flash fraction (TAFF). 
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Figure 16.88 Relation between the fraction of heat radiated and the vapour pressure prior to rupture for a 
fireball (A.F. Roberts, 1981/82). Data from Hasegawa and Sato (1978); 6.2 kg of pentane in each test 
(Reproduced by permissionof the Fire Safety Journal) 


The radius and duration time of the fireball are 


The atmospheric attenuation is given by 


P FB = 27.5 M 1/3 [16.15.84] 

Pfb = 3.8 M 1/3 [16.15.85] 

where _D FB is the duration time of the fireball (s) and P FB is 
its radius (m). 

The heat released and fraction of heat radiated are 
E t = HM [16.15.86] 

where fJ T is the heat released (J) and H is the heat of 
combustion (J/te). The fraction P r of heat radiated is taken 
as 0.3. 

The radiative power and radiative power density are then 


tmX — 0.12 log 10 f? T [16.15.91] 

where r is the atmospheric transmissivity and X is a para¬ 
meter. The values of X are 1.0, 0.96 and 0.92 for relative 
humidities of 0.2,0.5 and 1.0, respectively. 

The thermal radiation received by the target is then 

Tta = t/t [16.15.92] 

where / T a is the thermal radiation received by the target, 
taking account of attenuation by the atmosphere (W/m 2 ). 

Taking for hydrocarbons a heat of ombustion of 47 MJ/kg 
yields 


Pf b = PtPr/Pfb [16.15.87] 

Pd = Pf b/Ffb [16.15.88] 


where P B is the radiative power density (W/m 3 ), P FB is 
the radiative power (W) and kp B is the volume of the fire¬ 
ball (m 3 ). 

The thermal radiation intensity is 


It 


Pf b 
4t iR* 


[16.15.89] 


where / T is the unattenuated thermal radiation at the radius 
where the target is located (W/m 3 ) and P T is the distance 
from the centre of the fireball to the target (m). The effective 
surface temperature is 


r £ T Fp l 1/4 

where T e effective fireball temperature (K) and a is the 
Stefan-Boltzmann constant. 


Er = 47 x 10 9 M [16.15.93] 

Pfb = 1-24 x 10 10 F r M 2/3 [16.15.94] 

It = 2.94 x 10 s M 2/3 /P| [16.15.95] 

As an illustration, consider the example given by Marshall 
of the fireball from a release of 20 te of propane. Then 

M= 20 te 
H = 47 x 10 9 J/te 
Pfb = 74.6 m 
Pfb = 10.3 s 
E r = 9.4 x 10 11 J 
F r = 0.3 

P FB = 2.73 x 10 10 W 
I T = 2.17 x 10 9 /P| 

16.15.21 CCPS method 

A model for a fireball was given in the CCPS QRA Guide¬ 
lines (1989/5). A summary of this model has been published 
by Prugh (1994). A more recent model is that included in the 
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CCPS Fire and Explosion Model Guidelines (1994/5), where it 
is included as part of the treatment of BLEVEs. 

The method covers the following features: (1) the mass of 
fuel participating in the fireball, (2) the diameter and 
duration of the fireball, (3) point source and solid flame 
models of the fireball, (4) the surface emissive power of the 
fireball, (5) the view factor and (6) the atmospheric trans¬ 
missivity. 

The mass of fuel in the fireball is taken as three times the 
flash fraction or, if this figure exceeds unity, the mass 
released. For the fireball diameter and duration, use is 
made of Roberts’ equations (Equations 16.15.7 and 16.15.11 
or 16.15.12). 

Both point source and solid flame models are used. For 
the point source method use is made of Hymes’ Equation 
16.15.2. For the solid flame method Equation 16.15.28 is 
used in conjunction with a surface emissive power of 350 
kW/m 2 . 

The view factors are those attributed to the CCPS in 
Subsection 16.15.11, especially Equation 16.15.23. 

The atmospheric transmissivity is taken in the sample 
problem as unity, although several relationships are given 
for it. 

The Guidelines give a sample problem involving BLEVE 
of a tank truck containing propane, for which two treat¬ 
ments are presented, one using the point source model and 
the other using the solid flame model. 

16.15.22 Congested fireballs 

A type of fireball which somewhat resembles one arising 
from a BLEVE is that which can occur following sudden 
rupture of a vessel, such as a reactor, with release of flam¬ 
mable contents and immediate ignition. An instance of this 
is given by Cates (1992), who terms the incident which he 
describes a ‘congested fireball’. Since such an event gives an 
appreciable overpressure, it is considered in Chapter 17. 

16.15.23 Fireballs on pipelines 

An account of a fireball and a subsequent jet flame 
resulting from the rupture of a pipeline containing lique¬ 
fied propane has been given by Hirst (1984, 1986). The 
photographs show at -10 s an unignited cylindrical cloud, 
at 1 s partial ignition, at 3 s a mushroom cloud and at 8 s an 
elongated jet flame. This work is described in IE. more 
detail in Section 16.19. 

16.16 Fireballs from Explosives 

The models just given are for fireballs of hydrocarbons. 
There may also be a requirement for a model of the fireball 
from a condensed phase explosive. There is a limited 
amount of information available on the fireballs from solid 
and liquid propellants and from high explosives. Accounts 
of work in this area are given by Jarrett (1952), Gayle and 
Bransford (1965), Rakaczky (1975), Stull (1977), Mallory 
(1980), Kovar et al. (1982), W.E. Baker et al. (1983) and 
Gilbert, Lees and Stilly (1994d). 

16.16.1 Fireball incidents 

Not surprisingly, data on the features of fireballs in inci¬ 
dents involving the explosion of high explosives are sparse. 
An exception is the explosion which occurred in Peter¬ 
borough in the United Kingdom in 1989 on a truck carrying 
commercial explosives. According to the report by the 
HSE (1990c) the load was essentially nitroglycerine-based 


explosives with a total mass of some 800 kg. From the fact 
that one fireman was engulfed in flames at a distance of 18 
m and another suffered slight burns at 25 m, the fireball 
diameter was taken as approximately 36 m. 

16.16.2 Experimental studies 

The experimental studies of main relevance here are the 
relatively large-scale tests done by Jarrett (1952) on fireballs 
from solid propellants and by Gayle and Bransford (1965) 
on fireballs from liquid propellants. This work is described 
below. There are also a number i of laboratory studies such 
as those by Mallory (1980) and Kovar et al. (1982). 

16.16.3 Empirical features 

Fireballs from high explosives tend to be of shorter dura¬ 
tion than those of hydrocarbons for a given mass. Further, 
the mass involved in accidents tends to be less. Generally, 
therefore, the duration time of the fireball is short. The 
fireball diameter also appears to be less than for the same 
mass of hydrocarbons. On the other hand, the fireball tem¬ 
peratures are appreciably higher, particularly in the early 
stages. 

16.16.4 Fireballs of munitions 

For munitions fireballs, W.E. Baker et al. (1983) quote the 
following model by Rakaczky (1975). For the diameter 

D = 3.76 A/ 0325 [16.16.1] 

and for the duration time 

t A = 0.258 Af 0349 [16.16.2] 

where D is the diameter of the fireball (m), M is the mass of 
chemicals (kg) and f d is the duration time (s). 

Baker et al. state that these relations were obtained by 
fitting data from the literature, but no limits of applicability 
are given and the equations should be used with caution. 

16.16.5 Fireballs of solid propellants 

An investigation of the fireball from solid propellants has 
been described by Jarrett (1952). The work was done in 
connection with the storage of explosives. Its purpose was 
to determine the maximum extent of flame travel at ground 
level when a store of propellant explodes. Experiments 
were conducted with quantities of cordite in the range 
50-175,000 lb. 

For the flame radius at ground level, correlations were 
obtained which may be written as 

D = 0.906 M 038 Peripheral ignition [16.16.3] 

D = 0.906 A/ 0,44 Central ignition [16.16.4] 

16.16.6 Fireballs of liquid propellants 

In another early study, Gayle and Bransford (1965) descri¬ 
bed an investigation of the fireballs from liquid propellants 
and from high explosives, based on a literature survey and 
measurements taken from photographs in experimental 
work. The propellents considered were RP-l/LOX, LH 2 / 
LOX, RP-1/LH 2 /L0X and N 2 0 4 /UDMH-hydrazine (LH 2 , 
liquid hydrogen; LOX, liquid oxygen). These liquid pro¬ 
pellants are therefore strictly bipropellants incorporating 
their own oxidizer for combustion. The high explosive tests 
are considered further below. 
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Gayle and Bransford comment that the fireball diameters 
for the liquid propellants were governed almost exclusively 
by the mass involved. The diameters effectively obeyed the 
cube root law. 

They state further that there was little difference in the 
diameters of the fireballs from the liquid bipropellants and 
from high explosives. They give separate equations for the 
diameter of the fireball for individual liquid bipropellants 
and the following equation for the combination of liquid 
bipropeliants and high explosives: 

d = 9.56 W°' 325 [16.16.5] 

where d is the diameter of the fireball (ft) and IFis the mass 
of material (fuel + oxidizer) (lb). In SI units 

D = 3.77 M 0 - 325 [16.16.6] 

The duration times of the fireballs were relatively variable. 
These authors attribute this partly to variations in photo¬ 
graphic variables and partly to the difficulty of defining 
the end of the visible fireball in an unambiguous manner. 
For the combined set of liquid bipropeliants V. they give for 
the duration time: 

f d = 0.196 IF 0 - 349 [16.16.7] 

where W is the mass of material (fuel + oxidizer) (lb). In SI 


ti = 0.258 A/ 0349 [16.16.8] 

where M is the mass of material (fuel + oxidizer) (kg). 

The duration times of the high explosive fireballs were 
appreciably shorter, but no correlation is given. 

For liquid bipropeliants, R.W. High (1968) has given the 
following model: 

d = 0.82 IF 0320 [16.16.9] 

t A = 0.232 IF 0 320 [16.16.10] 

where IFis the mass of bipropellant (lb). In SI units 
D = 3.86 M 0320 [16.16.11] 

ti = 0.299 M 0320 [16.16.12] 

High gives graphs showing experimental data for the dia¬ 
meter and duration time of a number of liquid bipropeliants 
together with his correlation lines.The data cover the range 
10—10 5 kg. 

Fireballs from liquid propellants are one of the hazards 
reviewed in the Hazards of Chemical Rockets and Propellants 
Handbook (Jensen, 1972). The authors quote Equations 

16.16.6 and 16.16.8 from the work of Gayle and Bransford 
and give some additional results, as described below. 

They make the point that the firebaH can be very asym¬ 
metrical. The Titan test with 100,000 lh of RP-l/LOX gave 
maximum horizontal dimensions of 800-1000 ft, whereas 
the equivalent diameter from Equation 16.16.5 is some 400 ft. 

They describe work on fireballs in Project Pyro and 
quote the following equations for the duration time of 
experiments done with 25,000 lb of liquid bipropeliants: 

t A = 0.113 IF 0 333 RP - 1/LOX [16.16.13] 

ti = 0.077 IF 0 ' 333 LH 2 /LOX [16.16.14] 


They also describe further work on fireballs of propellant 
ANB-3226, which has a mass fraction of 69% oxidizer and 
15% aluminium, in Project Sophy and give tabulated data. 

There are several points of interest in the data given. The 
ratio of the maximum height of the fireball to its maximum 
diameter is an indication of the extent to which it undergoes 
a transition from hemispherical to spherical shape. This 
ratio is in the range 1.5-2.4. In other words, in most cases 
the fireball grows to a nearly spherical shape. The times to 
maximum diameter and to maximum height, and the ratio 
of these to the duration time are also significant. The ratio 
of the time to maximum height to the time to maximum 
diameter is generally of the order of 3, but can vary between 
1.5 and nearly 10. If the ratio of the time to maximum dia¬ 
meter to the duration time is considered, this tends to be 
small, typically in the range 0.03-0.15. 

16.16.7 Fireballs of high explosives 

There is relatively little in the literature by way of models 
for high explosive fireballs. The high explosive experi¬ 
ments of Gayle and Bransford (1965), mentioned earlier, 
consisted of some 14 explosions involving TNT, Composi¬ 
tion C-4 and pentolite. For the fireballs from these explo¬ 
sions they obtained the following equation: 

d = 8.50 IF 0341 [16.16.15] 

where d is the diameter (ft) and IFis the mass of explosive 
(lb). The quantities of explosive were in the range 3-10 6 lb. 
In SI units 

D = 3.3 A/ 0341 [16.16.16] 

As stated above, Gayle and Bransford did not give a corre¬ 
lation for the duration time of a high explosive fireball. 
They give some limited data which indicate that for a mass 
of explosive of 23 kg the duration time obtained was 0.23 s. 
Stull (1977) quotes for TNT the following model: 

d = 0.5 IF 0 333 16.16.17] 

ti = 0.23 IF 0333 [16.16.18] 

He gives for these correlations two separate sources: for 
fireball diameter, the work of van Dolah and Burgess 
(1968); and for the fireball duration, that of Strehlow and 
Baker (1975). 

Not all the models quoted are original. High quotes the 
work of Gayle, prior to publication of the report by Gayle 
and Bransford, and his model, although not the same as 
that of the latter authors, appears to be based on some of 
their data. The model given by Rakaczky appears to be the 
one by Gayle and Bransford. The model of Stull also is very 
similar to that by Gayle and Bransford. 

16.16.8 Fireball temperature 

According to W.E. Baker et at. (1983), typical fireball tem¬ 
peratures are 

Hydrocarbons 1350 K 

Solid propellants 2500 K 

Liquid propellants 3600 K 

High explosives 5000 K 
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These authors suggest that the Rakaczky model is prob¬ 
ably applicable to fireballs with temperatures of 2500 K. 
They also state that a temperature of 2500 K is typical of 
gun propellant fireballs. Gilbert, Silly and Lees infer that 
Rakaczky’s model applies to gun propellant rather than 
liquid propellant or high explosive fireballs. 

The temperatures of fireballs of liquid bipropellants are 
discussed by R.W. High (1968). He gives as typical a tem¬ 
perature of 2400 K. He also quotes computed values of 2690 
and 2610 K, assuming unity and estimated emissivities, 
respectively The Rocket and Propellants Handbook (Jensen, 
1972) quotes temperatures of 2300 K obtained in Project 
Pyro for liquid bipropellants. 

The temperatures given by Baker et al. for propellants 
and high explosives appear high. 

16.16.9 Gilbert, Lees and Scilly model 

A model for the fireball from a high explosive has been 
given by Gilbert, Lees and Scilly (1995d). The model is 
based partly on theoretical and partly on empirical con¬ 
siderations. 

The combustion processes in the fireball pass through 
two stages: (1) detonation and (2) combustion of the deto¬ 
nation products. The first stage is very rapid. 

The growth of the fireball passes through several all 
stages: (1) expansion following detonation; (2a) growth to 
the maximum diameter as a hemisphere; (2b) formation of a 
sphere at ground level, lift-off and rise to maximum height 
as a sphere and (3) persistence at this height as a sphere 
until cooled. 

Following detonation, air is entrained in the fireball. For 
oxygen deficient explosives, this air provides the oxygen 
required for secondary combustion of the products. The air 
contributes to the growth of the fireball. 

It is assumed in the model that the time t c to complete 
combustion is equal to the time t s for the fireball to form the 
maximum size hemisphere on the ground. In other words, 
the end of Stage 2 of the combustion processes is taken as 
the end of Stage 2a of the growth process. 

The model consists of relations for the diameter and the 
duration time of the fireball and for the profile of shape and 
temperature with time, and has three stages. In Stage 1 the 
detonation reaction occurs and gives the gaseous detona¬ 
tion products without admixture of air. In Stage 2 the 
detonation products undergo complete combustion with 
entrained air, except that for oxygen deficient explosives 
some solid carbon survives, the amount being a function of 
the extent of the deficiency. In Stage 3 the air entrainment 
decreases gradually to zero and the fireball cools. The 
model gives the diameter of the fireball and its temperature 
from the end of the detonation stage onwards. 

The differences in the diameters of the fireballs in the 
hemispherical and spherical stages are not large. The tem¬ 
peratures range from approximately 2000-4200 K at the 
end of Stage 1 to 1150-2500 K in Stage 2. 

In the overall model, the relations for the diameter and 
the duration time are based on the empirical models 
described above. The relation for the diameter is cross¬ 
checked with the heat balance model. The relations given in 
the model for the diameter and duration time of the fireball 
of a high explosive are 

D = 3.5 A/ 0333 [16.16.19] 

f d = 0.3 M 0333 [16.16.20] 


Equation 16.16.19 is applicable to any high explosive. 
Equation 16.16.20 is specific to explosives similar in oxy¬ 
gen balance to TNT. 

For the profile of the shape and temperature the approach 
taken is as follows. The time required for the fireball to 
reach its maximum diameter is a small fraction of the total 
duration time. The authors define a time t s at which the 
shape of the fireball changes from the maximum diameter 
hemisphere to a sphere, still at ground level: 

4 = <£4 [16.16.21] 

where <f> is a fraction. They use a value for $ of 0.25. 

The temperature profile of the fireball is obtained from a 
heat balance model. In this model the detonation is taken as 
virtually instantaneous and the adiabatic flame tempera¬ 
ture is determined. For an explosive which is oxygen defi¬ 
cient it is assumed that the rate of release of the remaining 
energy and the rate of entrainment of air are constant from 
time zero to time t s . At time t s combustion ceases, although 
air continues to be entrained at a linearly diminishing rate 
falling to zero at f d . The temperature at the termination of 
the fireball 7) is taken as 1150 K. 

The authors give for four explosives the generalized 
temperature profiles shown in Figure 16.89. These profiles 
are expressed as functions of the duration time calculated 
from Equation 16.16.20. This equation applies to TNT, and 
for this explosive the duration time is used directly. For the 
other explosives, an effective duration may be obtained 
from the graphs using a suitable value of the termination 
temperature T f , taken as 1150 K. 

As stated earlier, it is an implication of the values of the 
indices in the pair of Equations 16.16.19 and 16.16.20 that for 
a given explosive the temperature and thermal radiation at 
a given fraction of the duration time are the same for all 
masses of explosive. 

The authors note that in the example which they give for 
a fireball of TNT that the fraction of heat radiated over the 
duration time is about 0.44. 

A comparison between the diameter of the fireball in the 
Peterborough incident with that predicted by the model, as 
given in Equation 16.16.19, gives a predicted value of 33 m 
(spherical) or 40 m (hemispherical) compared with an 
apparent observed value of 36 m. 

16.17 Pool Fires 

A pool fire occurs when a flammable liquid spills onto the 
ground and is ignited. A fire in a liquid storage tank is also 
a form of pool fire, as is a trench fire. A pool fire may also 
occur on the surface of flammable liquid spilled onto water. 

There is a considerable literature on pool fires, including 
the work of Burgoyne and Katan (1947), Rasbash, Rogowski 
and Stark (1956), Blinov and s Khudiakov (1957), Hottel 
(1959), Burgess and Zabetakis (1962 BM RI 6099), Welker 
and Sliepecevich (1965). P.M. Thomas (1963), P.H. Thomas, 
Pickard and Wraight (1963), A.F. Roberts (1966, 1971b), 
Werthenbach (1971a,b, 1973), Yumofo (1971b), A.R. Hall 
(1972,1973), de Ris and Orloff (1972), L.E. Brown, Wesson 
and Welker (1974a, b, 1975), Seeger (1974), Escudier (1975), 
Modak (1977, 1978, 1981), Raj, Moussa and Aravamudan 
(1979a,b), de Ris (1979), Orloff (1980), Mizner (1981), Mizner 
and Eyre (1982, 1983). Moorhouse (1982), Moorhouse and 
Pritchard (1982), Orloff and de Ris (1982), Babrauskas 
(1983, 1986b), Heskestad (1983a), Hirst and Eyre (1983), 
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Figure 16.89 Estimated temperatures of the fireballs of four explosives (Gilbert, Lees and Scilly, 1994e) NG, 
nitroglycerin; NM, nitromethane; PETN, pentaerythrito! tetranitrate; TNT, trinitrotoluene 


Considine (1984 SRD R297), Mudan (1984c), and Crocker 
andT. Napier (1986). 

Some studies of pool fires are given in Table 16.63. Most 
work on pool fires deals with circular pools. A particular 
type of circular pool fire is the storage tank fire, which is 
considered in Subsection 16.17.1. A non-circular pool fire is 
a slot fire, which is treated in Subsection 16.17.15. 


16.17.1 Experimental studies 

There is a considerable experimental literature related to 
pool fires. Apart from the large number of publications on 
pool fires themselves, there are many relevant studies 
on flames such as those on combustion processes in, and 
heat radiation from, flames. 

Much of the early work was done on relatively small 
diameter pool fires. Subsequent studies indicate that the 
effect of pool diameter is important and that it is preferable 
to carry out studies on large pool fires. 

This initial work tended to be concerned with the 
determination of the liquid burning rate, of heat transfer to 
the liquid surface and of the fraction of heat radiated. 
Experimental studies on these aspects were conducted by 
Rasbash, Rogowski and Stark (1956) and by Blinov and 
Khudiakov (1957). 

The work of Blinov and Khudiakov covered a wide range 
of pool diameters. Hottel (1959) analysed their data to 
show that, as the diameter of pool fire is increased, there is 
progression from a laminar to a transition and finally to a 
turbulent regime. 

Burgess and Zabetakis (1962 BM RI 6099) carried out 
experiments on small pool fires to determine the liquid 
burning rate and fraction of heat radiated. 


Yumoto (1971b) has done experiments to study the rela¬ 
tive contribution of radiation and convection to heat trans¬ 
fer to the liquid surface in large pool fires. 

Large-scale tests on pool fires of LNG have been under¬ 
taken as an American Gas Association (AGA) project as 
described by L.E. Brown, Wesson and Welker (1975), who 
give correlations for the liquid burning rate and the heat 
radiated. 

Experiments on pool fires of aviation fuels have been 
done by Fu (1972). 

Large-scale tests on pool fires of ethylene have been 
performed as part of the experiments done by the Ministry 
of International Trade and Industry (MITI), (1976) descri¬ 
bed earlier. 

Modak (1981) has reported experiments on pool fires of 
polymethylmethacrylate (PMMA). Tests on large pool fires 
of LPG and LNG have been described by Mizner and Eyre 
(1982). 

There is also a number of studies of fires in storage 
tanks. These include the work of Burgoyne and Katan 
(1947),Werthenbach (1971a,b, 1973), Seeger (1974), Lois and 
Swithenbank (1979) and Kobori, Handa and Yumoto (1981). 

Investigations have also been carried out of fires on 
spills of flammable liquids on water, particularly for LNG. 
Closely related to these are tests on the spread of liquids on 
water. Experimental studies of the spreading of LNG on 
water have been done by Burgess, Murphy and Zabetakis 
(1970 BM RI 7448). A model of fire on a spill of LNG has 
been derived from this work by Burgess, Biordi and 
Murphy (1972 BM PMSRC 4177). 

Large-scale tests of the spreading of spills and of fire on 
spills of LNG on water have been carried out as part of the 
Liquefied Gaseous Fuels (LGF) Spill Effects program by 
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Table 16.63 Some studies of pool i 


A General 


Experimental study of pool fires, including liquid burning rate 
and flame height 

Analysis of experimental work on pool fires, including combustion 
regimes, heat transfer to liquid surface, liquid burning rate and 
flame height 
Relation for flame height 
Relation for flame tilt 
Review of pool fire relations and models 
Experimental study of heat transfer to liquid surface 
Experimental study of pool fires 
Experimental study of pool fires of LNG 
Theoretical study of heat radiation from pool fires, including 
fraction of heat radiated and relative contribution of luminous 
and non-luminous radiation 

Review of relations and models for pool fires, including liquid 
burning rates 

Experimental study of pool fires, including liquid burning and 
heat radiation 

Theoretical model of a pool fire 

Experimental study of pool fires, including heat transfer to 
liquid surface and heat radiation 
Experimental study of pool fires of LPG and LNG 
Equations for pool fires, including flame length, tilt and drag 
Review of relations and models for pool fires 
Review of relations and models for pool fires 
Relation for liquid burning rate 
Review of relations and models for pool fires 
Review of relations and models for pool fires 
Theoretical model of a pool fire 
Theoretical model of a pool fire 

B Head radiation 


Rasbash, Rogowski and Stark (1956); 
Blinov and Khudiakov (1957) 

Hottel (1959) 


RH. Thomas (1963) 

Welker and Sliepcevich (1966) 
Atallah and Allan (1971) 
Yumoto (1971b) 

Fu (1972) 

May and McQueen (1973) 
Sibulkin (1973) 


Burgess and Hertzberg (1974) 

L.E. Brown, Wesson and Weiker (1975); 
Mizner (1981) 

Modak (1977) 

Modak (1981) 

Mizner and Eyre (1982) 

Moorhouse (1982) 

Moorhouse and Pritchard (1982) 
Dinenno (1982) 

Babrauskas (1983) 

Considine (1984 SRD R297) 

Mudan (1984c) 

Tune and Venart (1984/85a) 
Babrauskas (1986b) 


Model of heat radiation from soot, C0 2 and H 2 0 in 
hydrocarbon flames 

Theoretical study of heat radiation from soot, C0 2 and 

H 2 0 in hydrocarbon laminar diffusion flames 

Model of heat radiation from hydrocarbon flames 

PB. Taylor and Forster (1974,1975) 

Modak (1975,1979) 

Considine (1984 SRD R297) 

C Storage tank fires 

Experimental study of heat wave in tank fires 

Review of relations and models for tank fires 

Experimental and theoretical study of tank fires 

Experimental study of tank fires, including view factor 

Experimental study of fire spread between tanks 

Review of relations and models for tank fires, including 
view factor 

Burgoyne and Katan (1947) 

Atallah and Allan (1971) 

Werthenbach (1971a,b, 1973) 

Seeger (1974) 

Kobori, Handa and Yumoto (1981) 
Crocker and Napier (1986) 

D Fire on spills on water 

Experimental study of spreading of LNG on water 

Theoretical model of fire on LNG spill on water 

Theoretical model of fire on LNG spill on water 

Theoretical model of fire on LNG spill on water 

Review of models of LNG fires, including fire on LNG spill on water, 
vapour cloud fire and fireballs 

Experimental study of fire on propane and LNG spills on water 

Burgess, Murphy and Zabetakis (1970) 
Burgess, Biordi and Zabetakis (1972) 
Raj and Kalelkar (1973) 

Stannard (1977) 

Schneider (1980) 

Mizner and Eyre (1983) 
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Figure 16.90 A typical pool fire 


the Lawrence Livermore National Laboratory (LLNL) at the 
Naval Weapons Center, China Lake, California. The work 
has been described by Hogan, Ermak and Koopman (1981). 

Other large-scale tests on fire on spills of propane and 
LNG have been done by Shell at Maplin Sands as described 
by Blackmore, Eyre and Summers (1982) and Mizner and 
Eyre (1983). 

Figure 16.90 shows a typical pool fire. 


16.17.2 Empirical features 

A pool fire is a complicated phenomenon and the theoretical 
treatment is correspondingly complex. It is appropriate, 
therefore, to describe first some of the empirical features of 
pool fires. 

A pool fire burns with a flame which is often taken to be a 
cylinder with a height twice the pool diameter. In still air 
the flame is vertical, but in wind it tilts. Wind also causes 
the base of the flame to extend beyond the downwind edge 
of the pool, thus exhibiting flame drag.With some pool fires 
blowout can occur at a wind speed of about 5 m/s. 

The characteristics of a pool fire depend on the pool 
diameter. The liquid burning rate increases with diameter 
until for large diameters it reaches a fixed value. The heat 
radiated from the flame behaves similarly. 

Some fuels, such as LNG, burn with a relatively clear 
flame, while others, such as kerosene and LPG, give a 
smoky flame. The extent of the smoke affects the heat 
radiation. 


The fraction of heat radiated by a pool fire usually lies in 
the range 0.2-0.4. 

A few fuels do not burn stably but at a certain tempera¬ 
ture exhibit boilover. 


16.17.3 Modelling of pool fires 

The modelling of pool fires covers the following aspects: 
(1) flame geometry, (2) liquid burning rate, (3) flame char¬ 
acteristics, (4) heat radiated and (5) view factor. 

The approach to modelling the heat radiated from a pool 
fire is broadly similar to that taken for fireballs. Again, 
there are three different ways of determining the heat 
radiated: (1) the use of a value of the fraction of the heat 
radiated; (2) the use of a value for the surface emissivity; 
and (3) the estimation from the flame properties such as 
flame temperature and emissivity. 

Reviews of pool fire models have been given by several 
authors, including de Ris (1979), Considine (1984 SRD 
R297), Mudan (1984c) and Cracker and Napier (1986). 


16.17.4 Fire regimes 

As just mentioned, Hottel (1958) analysed the work of Bli¬ 
nov and Khudiakov and showed that as the pan diameter 
increases the fire regime changes from laminar to turbu¬ 
lent. He gave the graph shown in Figure 16.91, in which 
burning velocity and flame height are plotted against pan 
diameter. 
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Figure 16.91 Liquid burning rate and flame height as function of fire regime in pool fires (after Hottel, 1958; 
reproduced with permission) 


He defined a Reynolds number based on the vapour 
phase and related it to the parameters of the liquid phase 
as follows: 



uidpi 


[16.17.1a] 

[16.17.1b] 


where d is the pan diameter, u is the velocity, p is the visc¬ 
osity, p is the density and subscripts g and 1 refer to the 
vapour and liquid phases, respectively. The vapour phase 
Reynolds number was calculated using the cold gas values. 
The liquid velocity U\ is the liquid burning velocity v. Since 
the Reynolds number is proportional to the product vd, the 
lines of constant Reynolds number lie across the plot in 
Figure 16.91 from top left to bottom right with a slope of —1, 
as shown. 

At a Reynolds number of about 20 the regime is laminar 
and the burning velocity decreases with increasing pan 
diameter. In the transition regime between Reynolds num¬ 
bers of 20 and 200, the burning velocity first decreases, 
then increases and finally levels off with increase in pan 
diameter. Above Reynolds numbers of 500 the regime is 
turbulent and the burning velocity remains constant with 
increasing pan diameter. The pan diameter at which the 
regime becomes turbulent is about 1 m. 

The flame height decreases with increasing pan diameter 
in the laminar and transition regimes and then remains 
constant with pan diameter in the turbulent regime. 


16.17.5 Flame geometry 

The flame on a pool fire has often been assumed to be an 
upright cylinder, as shown in Figure 16.90, with a length L 
twice the diameter D. An L/D ratio of 2 is used, for example, 
by Hearfield (1970) and R.B. Robertson (1976b). The work 
of Blinov and Khudiakov (1957) described above and 
shown in Figure 16.91 includes measurements of this ratio. 
It can be seen that for large diameters the value obtained is 
approximately 2. 

Alternatively, the flame may be assumed to have a con¬ 
ical shape, but this assumption is less common and, unless 
otherwise stated, it is assumed in the following that the 
flame is treated as a cylinder. 

An equation for flame length in still air has been given by 
P.H. Thomas (1963). This is 



[16.17.2] 


where D is the flame diameter (m), g is the acceleration due 
to gravity (m/s 2 ), L is the flame height (m), m is the mass 
burning rate (kg/m 2 s) and p a the density of the ambient air 
(kg/m 3 ). Equation 16.17.2 is based on experiments on wood 
crib fires. 

Steward (1970) has given a similar equation which takes 
into account the properties of the fuel. 

Another expression for flame length is that of Heskestad 
(1983a). The basic relation is 


L 

D 


=f(N) 


[16.17.3] 
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where 
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B 2 


[16.17.4] 


where c p is the specific heat of air (kj/kg K), A H c is the heat 
of combustion of the fuel (kj/kg), N is a dimensionless 
group, Q is the total heat release rate (kW), r s is the stoi¬ 
chiometric air to volatiles mass ration, T a is the absolute 
temperature of the ambient air (K) and p a is the density of 
the ambient air (kg/m 3 ). 

The air/volatiles ratio r s for a fuel CJl/jO,, burning in 


a* = u/u c [16.17.12] 

u c = ' [16.17.13] 

where u is the wind velocity (m/s), u c is a characteristic 
velocity (m/s) and u* is a dimensionless wind velocity. The 
basis of Equation 16.17.11 is again experiments on fires on 
wood cribs. 

The AGA (1973) has given an equation of the same general 
form as Equation 16.17.11, but with different parameters: 


r s = 137.9 


12a + [} + 16y 


[16.17.5] 



[16.17.14] 


Heskestad has shown theoretically that for large values of 
N 


L 

D 


Ad/s 


[16.17.6] 


Equation 16.17.14 therefore exhibits behaviour different 
from that of theThomas equation 16.17.11. 

Moorhouse (1982) has made correlations of available 
data which yield 


and has correlated experimental data with the relation 

jp -1.02 + 15.6W 1/5 [16.17.7] 

The flame length in storage tank fires has been studied by 
Werthenbach (1971a,b, 1973). He gives an analysis, the point 
of departure of which is the ratio of the buoyancy to the 
momentum forces as given by the Archimedes number Ar: 



Cylindrical flame 
[16.17.15a] 
Conical flame 

[16.17.15b] 


Ar = ^y [16.17.8] 

where g is the acceleration due to gravity (m/s 2 ), u is the 
vapour velocity (m/s), p is the density of the vapour 
(kg/m 3 ) and A p is the difference between the density of the 
vapour and that of air (kg/m 3 ). Werthenbach correlates his 
results in terms of the Froude number Fr: 

g = AFr 0 ' 2 [16.17.9] 


with 

u \o = «io/«c [16.17.16] 

where u 10 is the wind speed at a height of 10 m and u\ Q is the 
dimensionless wind speed at that height. These equations 
are valid for wind speeds u m > u c , while for wind speeds 
«io < « c the dimensionless wind speed term is taken as unity. 

Considine (1984 SRD R297) gives an analysis in which it 
is shown that, given certain assumptions, the use of a con¬ 
stant fraction of heat radiated implies a constant L/D ratio. 
Thomas has also provided an equation for flame tilt 


_u 2 


[16.17.10] 


where A is a constant characteristic of the fuel. Values 
obtained for A were 29 for methane and natural gas and 40 
for propane and gasoline. The vapour velocities were of the 
order of 0.75—1.0 cm/s. The author comments that these 
values are much lower that those in burner flames and that 
an attempt to apply the correlation for such flames to those 
on pool fires may be misleading. 

Wind has several effects on the flame: it causes it to tilt, 
alters its length and extends it along the ground on the 
downwind side. 

RH. Thomas (1963) has provided an equation for flame 
length for a tilted flame also. This is 



cos 9 = 0.7 (u*)~ om [16.17.17] 

where 9 is the angle of tilt from the vertical (rad). The 
basis of Equation 16.17.17 is again experiments on wood 
crib fires. 

The AGA (1973) has given an equation of the same form 

cos 9 = («*)“ 6iS [16.17.18] 

This equation is based on tests on large LNG fires. 

Another correlation for flame tilt is that of Welker and 
Sliepcevich (1965) 




[16.17.19] 


1-55 


[16.17.11] where p a is the viscosity of air (kg/m s), and p s is the den¬ 
sity of the fuel vapour at the normal boiling point (kg/m 3 ). 
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Equation 16.17.19 is based on experiments on small pool 
fires. 

Moorhouse (1982) has correlated the available data to 
obtain equations of the form given by Thomas and of that 
given Welker and Sliepcevich. These are, respectively, 


cos 0 = 0.86(«] o ) 0-25 ° Cylindrical flame [16.17.20a] 

cos 0 m 0.87(«] o ) -0 ' 272 Conical flame [16.17.20b] 

and 

cos 0 = ^J)g) Cylindrical flame 

[16.17.21a] 



[16.17.21b] 

For flame drag, Welker and Sliepcevich (1966) give the 
following equation 




where D' is the elongated flame base (m). The experimental 
basis of Equation 16.17.22 is wind tunnel tests on small 
pool fires. 

Moorhouse (1982) has correlated the available data to 
obtain the equations 


S- u G0‘ 

£- 0 ‘ 


Cylindrical flame 


Conical flame 


[16.17.23a] 

[16.17.23b] 


of the flame, U is the heat transfer coefficient and a is the 
Stefan-Boltzmann constant. He considers heat transfer to 
a gasoline pool assuming F = 0.25, T t = 1100 K and U = T 
BTU/ft 2 h. 

For small pans q T i m will be large and the liquid burning 
rate will be high. For large pans q lim will be negligible, 
q c will be constant and q T will be dominant with large kd 
and hence a large and constant value of the term 
[1 — exp(-Ad)]. For intermediate size pans q rila will again be 
negligible, but q T will not be so large due to the thinness 
of the flame. Hence the liquid burning rate will pass 
through a minimum for intermediate pan diameters. This 
analysis agrees with the experimental results shown in 
Figure 16.91. 

An equation for the regression rate of a burning liquid 
surface under windless conditions has been given by 
Burgess and Zabetakis (1962 BM RI6099) as follows: 

v = ^[1 - exp(-M)] [16.17.27] 

i 16 - 17 - 28 ! 

where d is the diameter of the pool (cm), A H c is the net heat 
of combustion (negative) (kj/kmol), A H v is the total heat 
of vaporization (kj/kmol), v is the liquid burning rate 
(cm/min), v^ is the liquid burning rate for a pool of infinite 
diameter (cm/min), and ki, k 2 are constants ( k 2 = 0.0076). 

Liquid burning rate parameters for Equation 16.17.27 for 
selected substances are given in Table 16.64. For LNG the 
maximum liquid burning rate given in Table 16.64 is 0.66 
cm/min, but in further experimental work at Bruceton and 
Lake Charles described by these authors considerably 
higher values were obtained. In one experiment the burn¬ 
ing rate was 1.16 cm/min. 

Equation 16.17.27 also be written in the form 

m = m x , [1- exp(-M)] [16.17.29] 

m x = #oo pi [16.17.30] 


where D w is the maximum pool dimension in the direction 
of the wind (m). 


16.17.6 Liquid burning rate 

The review by Hottel (1959) of the work of Blinov and 
Khudiakov includes a simple analysis of the heat q trans¬ 
ferred from the flame to the pool, which may be written as 

? = ?c + Qr + ?rim [16.17.24] 

where q c is the heat transferred to the pool by conduction, 
q T is the heat transferred by radiation and q lila is the heat 
transferred by the pan rim. The heats transferred by con¬ 
vection and by radiation are 

q c = ~d 2 U(T i - T b ) [16.17.25] 

q T = ^d 2 aF(Tf - 7^||- exp(-M)] [16.17.26] 


where m is the mass liquid burning rate (kg/m z s), m a0 is 
the mass burning rate for a pool of infinite diameter 
(kg/m 2 s) and pi the liquid density (kg/m 3 ). 

Brown, Wesson and Welker used Equation 16.17.29 to 
correlate the mass burning rate for large LNG fires in the 
AGA tests. In British Units they give for the parameters 
a value of 0.6 (in./min) and h a value of 0.2 (ft -1 ). 

Work on the heat transfer from the flame to the liquid 
pool has been reviewed by Yumoto (1971b). This work was 
limited to smal-scale fires. He decribes experimental work 
on fires in pools up to 3 m diameter in which measurements 
were made of the relative contribution of convective and 
radiant heat transfer. As shown in Figure 16.92 the con¬ 
tribution of convection falls and that of radiation rises as 
the pool diameter increases, until both contributions reach 
a constant value. 

Sibulkin (1973) discusses the ratio q T lq c . He assumes in 
his analysis that q c is constant and that 

q r oc e [16.17.31] 


where d is the pool diameter, F is the view factor, k is the where 6 is the flame emissivity. He gives for the latter 

extinction coefficient, T b is the absolute temperature of 

the burning liquid surface, T t is the absolute temperature #» 1 — exp(— feLm) [16.17.32] 
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where L m is the mean beam length and k 3 is a constant. But 
for pools of intermediate diameter 

etxL^ 2 [16.17.33] 

Lm^D [16.17.34] 

e oc D 1 ' 2 [16.17.35] 

^ a D 1 ' 2 [16.17.36] 

For large diameter pools e m 1, and hence 

Y oc Constant [16.17.37] 

An extensive review of liquid burning rates is given by 
A.R. Hall (1973), who considers among other things the 
effects of (1) the fuel, (2) fuel mixtures, (3) fuel containing 
dispersed water, (4) the liquid surface temperature, (5) the 
liquid temperature distribution, (6) the pool diameter, 
(7) the heat transfer from the flame to the liquid and (8) the 
wind speed. 


Table 16.64 Parameters for liquid burning rate on pools 
of selected substances (Burgess and Zabetakis, 1962 BM 
Rl 6099) (Courtesy of the Bureau of Mines) 



Voq (cm/min) 

ki (cm b ) 

Hydrogen 

1.4 a 

0.07 a 

Butane 

0.79 

0.027 

Hexane 

0.73 

0.019 

Benzene 

0.60 

0.026 

Methanol 

0.17 

0.046 

LNG 

0.66 b 

0.03 b 


b Value calculated. 


Work on the burning rates of fuels of solid plastics has 
been reviewed by de Ris (1979) in the context of pool fires. 
He tabulated for the fuels including polymethylmeth¬ 
acrylate (PMMA), polypropylene (PP) and polystyrene 
(PS) a large number of potentially relevant variables and 
found that the actual volumetric heat release rate appears to 
be independent of the fuel. He explained this by the fact 
that the heat released per unit mass of oxygen consumed is 
essentially the same for most organic fuels, despite incom¬ 
plete combustion, whilst the rate of oxygen consumption is 
controlled by the overall rate of turbulent mixing, which is 
driven by temperature differences that are generally 
insensitive to the fuel. 

Babrauskas (1983, 1986b) distinguishes the following 
burning modes of pool fires: 


Pool diameter (m) 

Burning mode 

<0.05 

Convective, laminar 

<0.2 

Convective, turbulent 

0.2-1.0 

Radiative, optically thin 

>1.0 

Radiative, optically thick 


and uses the relations 


m = m oo[1 - exp (-kfiD)\ [16.17.38] 



where Ah s is the total heat of gasification (kj/kg), k is an 
absorption-extinction coefficient (m _1 ), T t is the absolute 
temperature of the effective equivalent gray gas (K) and 
P is a mean beam length corrector. He discusses whether 
the mean beam length corrector /) can be derived, and con¬ 
cludes that it cannot. He gives tabulations of m^ and (kfi) 
from work on large pool fires reported by some 20 authors. 
These data are given in Table 16.65. 



Figure 16.92 Liquid burning rate and heat transfer to the liquid surface in large pool fires (after Yumoto, 1971b): 
(a) gasoline fire; (b) hexane fire (Courtesy of Combustion and Flame) 
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Table 16.65 Pool fire parameters for selected substances (after Babrauskas, 1983) (Courtesy of Fire Technology) 

Material 

Pz(kg/m 3 ) 

m x (kg/m z s) 

kfl(m ’) 

Xr 

H 2 (liquid) 

700 

0.169 

6.1 

0.25 

LNG (mostly CH 4 ) 

415 

0.078 

1.1 

0.16-0.23 

LPG (mostly C 3 H 6 ) 

585 

0.099 

1.4 

0.26 

Butane 

573 

0.078 

2.7 

0.27-0.30 

Hexane 

650 

0.074 

1.9 

0.20-0.40 

Heptane 

675 

0.101 

1.1 


Methanol 

796 

0.017 


0.17-0.20 

Ethanol 

794 

0.015 


0.20 

Benzene 

874 

0.085 

2.7 

0.14-0.38 

Xylenes 

870 

0.090 

1.4 


Acetone 

791 

0.041 

1.9 


Diethyl ether 

714 

0.085 

0.7 


Gasoline 

740 

0.055 

2.1 

0.18 

Kerosene 

820 

0.039 

3.5 


JP-4 

760 

0.051 

3.6 

0.35 

JP-5 

810 

0.054 

1.6 


Transformer oil (hydrocarbon) 

760 

0.039 

0.7 


Fuel oil (heavy) 

940-1000 

0.035 

1.7 


Crude oil 

830-880 

0.022-0.045 

2.8 

0.18 


Babrauskas (1986b) also addresses some of the factors 
affecting the liquid burning rate, including (1) pool dia¬ 
meter, (2) lip effects and (3) wind speed. 

For very large pool fires with diameters greater than 
5-10 m, there is some evidence of a slight decrease in 
burning rate. This is presumably due to poor mixing with 
air. Babrauskas suggests that this effect is unlikely to 
reduce the burning rate by more than 20%. 

Effects of lip, or freeboard, on large pool fires involve all 
three modes of heat transfer. A lip can affect the tempera¬ 
ture distribution in the wall of a storage tank and hence 
heat transfer by conduction. It can promote turbulence and 
enhance heat transfer by convection. It tends to make the 
flame more stable and emissive, thus increasing heat 
transfer by radiation. Babrauskas quotes the following 
work of Orloff (1981), on fires of one fuel, PMMA, on the 
effect of the ratio d/D of the freeboard height to the pool 
diameter on the ratio 0 br of the liquid burning rate to it 
base value with no lip: 


d/D 

<£br 

0 

1.0 

0.07 

1.6 

0.2 

2.0 

>0.2 

Slow decrease 


With regard to wind speed there is some work showing an 
increase in burning rate and other work indicating a 
decrease. Relevant studies include those of Blinov and 
Khudiakov (1957) and Lois and Swithenbank (1978). 

Some spot values of the liquid burning rate are as fol¬ 
lows. In the experiments of Blinov and Khudiakov on 
gasoline, kerosene, diesel oil and solar oil, the liquid burn¬ 
ing rate in the turbulent regime was 0.5 cm/min. In one of 
the large-scale tests on the pool burning of ethylene con¬ 
ducted by MITI (1976) a liquid burning rate of 0.88 cm/min 
was obtained. Values of liquid burning rate are given in the 


ICI LFG Code (ICI/RoSPA 1970 IS/74) and by Hearfield 
(1970) and R.B. Robertson (1976b) and liquid burning rate 
is treated in Chapter 22 in relation to heat radiation from 
fires to storage tanks. 

A liquid burning rate of 0.75-1.0 cm/min is quoted in the 
fourth edition of the Dow Guide (Dow Chemical Company, 
1976). This value is given in relation to the fireproofing of 
structures as part of the ‘Recommended Minimum Fire 
Prevention and Protection Features’, which do not appear 
as such in later editions. 


16.17.7 Flame characteristics 

Important characteristics of the flame on a pool fire are the 
nature of the flame, its temperature and its emissivity. 

Some flammable liquids burn with a relatively clear 
flame, while others give a more smoky flame. The differ¬ 
ence is well illustrated by the work of Mizner and Eyre 
(1982) on LNG and LPG pool fires. The LPG flames were 
smoky, the LNG flames much less so. Figure 16.93 illus¬ 
trates the difference. The presence of carbon particles in the 
flames has several effects. One is that the soot enhances the 
emissivity of the flame. Another is that smoke may shroud 
the flame from the target. 

Several authors refer to a flame temperature of 1100 K. 
This is the typical value taken by Hottel (1959). Craven 
(1976) also mentions this figure, but states that this is not 
necessarily the maximum value which may be attained. 
Some data on pool fire flame temperatures given by 
Babrauskas are shown in Table 16.65 and further data on 
flame temperature and surface emissive power given by 
Mudan (1984c) are shown in Table 16.66. Further informa¬ 
tion on flame temperatures is given in relation to engulfing 
fires in Section 16.20. 

As far as emissivity is concerned, pool fires of most 
hydrocarbon fuels become optically thick when the dia¬ 
meter reaches about 3 m. For such fires it is often stated that 
the emissivity of the flame may be taken as unity. More 
refined estimates of flame emissivity may be made using 
the relations given in Section 16.13. 









FIRE 16/199 



(Courtesy of the Institution of Chemical Engineers) 


Table 16.66 Some data on the measured flame temperature and surface emissive power of flames of flames on pool 
fires (Mudan, 1984c)(Courtesy of Progress in Energy and Combustion Science) 


Material 

Poolfire 
dimensions 

Cm) 

Flame radiation 

temperature 

(K) 

Surface emissive 
power (kW/m 2 ) 

Reference 

LNG on water 

8.5-15 

1500 

210-280 

Raj, Moussa and Aravamudan (1979b) 

LNG on land 

20 

- 

150-220 

Mizner and Eyre (1982) 

LPG on land 

20 

- 

48 

Mizner and Eyer (1982) 

Pentane 

1.0 


61 

Modak (1978) 

Ethylene 

2.5 


130 

Modak (1978) 

Gasoline 

1.0-10 

1240 

60—130 (max) 

Hagglund and Persson (1976) 

Kerosene 

30-80 

1600 

10-25 (av.) 

Japan Institute for Safety Engineering (1982) 

JP-4 

5.8 

1200 


NASA (1979) 

JP-5 

1.0-30 


30-50 

Modak (1978) 


The conditions which give rise to smokiness in the flame 
are also given in Section 16.13. If the flame is smoky, the 
unobscured parts of the flame will emit radiation to the 
target, while the obscured parts will not. 

A method of taking account of obscuration of the flame 
has been given by Considine (1984 SRD R297). He divides 
the flame into unobscured section with a surface emissive 
power q and obscured sections with ‘blooms’ of radiation 
where the average emissive power is 0.3 q. From photo¬ 
graphs of flames the relative proportion of unobscured 
flame varied from about 30% for fires a few metres in dia¬ 
meter to zero for flames 50 m or more in diameter. He ana¬ 
lyses the following three cases: 

(1) flame radiating continuously over entire height; 

(2) flame radiating 30% continuously, 70% in blooms; 

(3) flame radiating in blooms over entire height. 


He suggests that for flames in the range 5-25 m diameter 
the bottom 30% be taken as radiating continuously and the 
rest radiating in blooms, and that flames >25 m diameter 
be taken as radiating in blooms over their entire height. 
The view factor for such a flame is considered below. 


16.17.8 Heat radiated 

There are three methods of estimating the heat radiated 
by a pool fire. These are based on: 


(1) heat evolved and radiated; 

(2) surface emissive power; 

(3) flame temperature and emissivity. 


The heat evolved in the flame may be determined from the 
liquid burning rate. The heat radiated from the flame is 
then usually calculated as a fraction of the heat evolved by 
using an empirical factor. Some data on this radiant heat 
factor have been given by Burgess and Zabetakis in the 
work already described and are shown in Table 16.67. They 
suggest that the fraction of heated radiated generally does 
not exceed half that evolved. 

It is stated by Roberts that the fraction of heat radiated 
both by fireballs and pool fires is typically in the range 
0.2—0.4. He suggests a value of 0.3 for this radiant heat 
factor. 

Large pool fires are affected by smoke blockage. The 
following data of Hagglund and Persson (1976) for the 
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Table 16.67 Fraction of heat radiated from flames 
burning on liquid pools (Burgess and Zabetakis, 

1962 BM Rl 6099) (Courtesy of the Bureau of Mines) 



Pool diameter 
(cm) 

Heat radiated 
(fraction) 

Hydrogen 

33 

0.25 

Butane 

76 

0.27 

Benzene 

122 

0.36 

Methanol 

122 

0.17 

LNG 

76 

0.23 


effect of pool diameter on the fraction of heat radiated in 
JP-4 fuel fires is quoted by Babrauskas: 


Pool 

diameter (m) 

Fraction of 
heat radiated 

1.0 

0.35 

1.5 

0.39 

2.0 

0.34 

3.0 

0.31 

5.0 

0.16 

10.0 

0.10 


He states, however, that similar information is not available 
for other fuels and suggests that a conservative estimate 
can be obtained by disregarding smoke blockage. 

The intensity of heat radiation may then be calculated by 
dividing the heat radiated by the area of the flame envelope. 

The second method is to use directly information on the 
heat radiation intensity, or emissive power, of the flame 
surface. Values of surface emissive power of hydrocarbon 
fires have been reviewed by P. Nash (1974a). He lists values 
of heat fluxes, extrapolated from experimental fires of dif¬ 
ferent sizes, in the range 30-189 kW/m 2 . 

In the context of safety distances, a value of 170 kW/m z 
has been suggested by law (1969). This aspect has also 
been discussed by Craven (1976), who concludes that the 
value of 170 kW/ m z given by Law provides a realistic initial 
estimate. 

Further data on surface emissive power are given by 
Mudan (1984c). His tabulated values are given in Table 
16.66; he also gives other values in the text. 

There are wide differences in surface emissive power, 
depending on the smokiness of the flame. Mizner and Eyre 
(1982) obtained in their work surface emissive powers of 
35 kW/m 2 for kerosene, 48 kW/m 2 for LPG but 153 kW/m 2 
for LNG. 

Reviewing work on pool fires on land and water, Moor- 
house and Pritchard (1982) conclude that for large pool 
fires of hydrocarbons, excluding liquefied gases, the sur¬ 
face emissive power is unlikely to exceed 60 kW/m 2 and 
state that for such fires the value of 170 kW/m 2 often quoted 
is based on small scale tests and is not appropriate. 

With regard to pool fires of LNG, small fires clearly burn 
with a particularly clean flame. Evidence of soot formation 
is found only when the pool diameter reaches about 10 m or 
when most of the fuel has been consumed and the propor¬ 
tion of higher hydrocarbons is rising rapidly. Optical 
thickness is approached only when the flame is some 
meters wide. Moorhouse and Pritchard quote for pool fires 


of LNG the surface emissivities of the order of 200 kW/m 2 
obtained by Raj, Moussa and Aravamudan (1979a). 

Values of the surface emissive power for pool fires on 
water obtained in the experiments on the dispersion and 
burning of vapour clouds at Maplin Sands have been given 
by Blackmore, Eyre and Summers (1982), Hirst and Eyre 
(1983) and Mizner and Eyre (1983). This work has been 
described in Section 16.14. Pool fires formed on the lique¬ 
fied gas spilled on the sea. The surface emissive power for 
these pool fires, as opposed to the vapour cloud fire, were 
203 kW/m 2 for LNG and 43 kW/m 2 for propane. The 
authors suggest a value of 200 kW/m 2 as being repre¬ 
sentative for LNG pool fires. 

Further indications of surface emissive power are 
provided in the work on engulfing fires described in 
Section 16.20. 

L.E. Brown, Wesson and Welker (1975), in the work on 
LNG fires described earlier, have derived for such fires the 
following equation for surface emissive power: 

q = qoo [1 - exp(M)] [16.17.40] 

where d is the diameter of the fire (ft), q is the heat flux from 
the surface (BTu/h ft 2 ), q 00 the heat flux from the surface of 
a ‘large’ fire (BTU/h ft 2 ) and k 4 a constant (ft - The values 
given for the parameter q x is and the constant k 4 are 45,000 
and 0.055, respectively. 

Mudan (1984c) suggests that for hazard assessment the 
surface emissive power be taken as a weighted value for the 
unobscured and obscured portions of the flame. For exam¬ 
ple, for a flame comprising 20% luminous spots and with 
80% obscured by smoke 

q = 0.2 x 130 + 0.8 x 20 = 42 kW/m 2 

Similarly, Considine (1984 SRD R297) proposes that for 
hydrocarbons, but not LNG, the surface emissive power of 
the flame be taken as 120 kW/m 2 over the part radiating 
continuously and as 0.3 x 120 = 36 kW/m 2 over the part 
radiating in blooms. 

A further discussion of the intensity of heat radiation is 
given in the ICI LFG Code and is described in Chapter 22 in 
relation to heat radiation from fires to storage vessels. 

The third method is to determine the heat radiated from 
the temperature and emissivity of the flame. The heat 
radiated is 

E = eaTf [16.17.41] 

where E is the surface emissive power (kW/m 2 ). The heat so 
radiated may be assumed to come either from a point source 
or from the flame surface. The estimation of the emissivity 
e is discussed in Section 16.13. 

In order to determine the heat incident on a target it is 
necessary to take into account the target absorptivity, the 
atmospheric transmissivity and the view factor. The 
determination of the latter is now considered. 


16.17.9 View factor 

The targets for heat radiated form a pool fire include both 
the liquid surface and objects outside the flame. There are 
therefore two different types of view factor relevant to 
relevant to pool fires. 
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As mentioned earlier, Hottel (1959) has used for the view 
factor of the liquid pool a value of 0.25. 

For an object outside the flame there are several different 
treatments. For heat radiation from a flame treated as a 
vertical or tilted cylinder to a target the three principal 
models are: 

(1) point source model; 

(2) solid flame model; 

(3) equivalent radiator model. 



These models and their application have been described by 
Crocker and Napier (1986). 

For a point source the radiation at a surface a distance r 
from the source is 



and the radiation incident on the target is 


[16.17.42] 


m 

m 47t/f 


[16.17.43] 


where E is the surface emissive power (kW/m 2 ), F is the 
view factor, I is the thermal radiation intensity (kW/m 2 ), Q r 
is the heat radiated (kW), r is a surface radius (m), 4 is the 
slant distance between the source and the target (m), a is 
the absorptivity of the target and x is the transmissivity of 
the atmosphere. 

Then from Equation 16.17.42 and 16.17.43 for a point 
source with a target surface normal to the line joining it to 
the source, as given in Equation 16.13.100 


F = J [16.17.44] 

The expressions for vertical and horizontal targets are 
given by Equations 16.13.101 and 16.13.102. 

The geometry of this model is shown both for pool fires 
and for storage tanks in Figure 16.94. This approach has 
been used by a number of workers (e.g. Hearfield, 1970) for 
pool and tank fires. The point source model is not accurate 
for a target close to the flame and for this situation other 
methods should be used. 

Of the more accurate methods, the more widely used 
appears to be the solid flame model. Methods for the cal¬ 
culation of the view factor for a vertical cylinder have been 
described by Hamilton and Morgan (1952) and Sparrow, 
Miller andjonsson (1962), and for a tilted cylinder by Rein, 
Sliepcevich and Welker (1970), Merriam (1972) and Raj and 
Kalelkar (1974). A collection of view factors is given by 
Howell (1982). 

For a vertical cylinder with a target with a vertical 
surface, as shown in Figure 16.95(a), the view factor given 
by Hamilton and Morgan (1952) (Howell, configuration 
B-29) is 



[16.17.45] 



Figure 16.94 View factor for pool and tank fires - point 
source model: (a) pool fire; (b) tank fire 

H r 

jm 


h— 

(a) 
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Figure 16.95 View factor for pool fires - solid flame 
model: (a) vertical cylindrical flame, vertical target; 

(b) vertical cylindrical flame, horizontal target; 

(c) tilted cylindrical flame, angled target 
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L = l/r 
X = x/r 

A=(x + 1 ) 2 + L 2 
B=[X-lf + L 2 


[16.17.46a] 

[16.17.46b] 

[16.17.46c] 

[16.17.46d] 


where r is the radius of the cylinder. 

For a vertical cylinder with a target with a horizontal 
surface, as shown in Figure 16.95(b), the view factor given 
by Sparrow, Miller and Jonsson (1962) (Howell, configura¬ 
tion B-27) is 


F 



\x tan(0.5 cos -1 7?) j 1 
|l + L 2 + R 2 — 2/?J J 


(1 + L 2 -R Z ) 
X 


[16.17.47] 


Hi = [(X 2 - 1) cos 2 0 + (1 - 1/X 2 ) sin 2 0] 1/2 [16.17.51e] 

r /2 

Ay m I f(v)dv 16.17.5 If] 

~ (1 +1? + X 2 - ZXL&in 0) + 2(7,sin 0 - X) sinv 

[16.17.51g] 


*-r 


' /2 (Xsiny — 1) dv 
(1 + X 2 - 2Xsinw) 


[16.17.51h] 


(Xsinw — 1) dv 

[(1 +L 2 +X 2 - 27. sin 0) + 2(1 sin 0 - X) sinu] 


16.17.5li] 


For a tilted cylinder with a target with a vertical surface 
(p = 90°), Equation 16.17.50 reduces to 


R = r/x [16.17.48a] 

Imifr [16.17.48b] 

X = [(1 + L 2 + R 2 ) 2 - 4ft 2 ] 1/z [16.17.48c] 

For a vertical cylinder, an expression based on the more 
approximate subtended solid angle method has been given 
by Stannard (1977) 

F = -sin -\r/x) sin{tan -\l/{x - r)]} [16.17.49] 

For a tilted cylinder with a circular base tilted at an angle 9 
to the horizontal and with the target having a surface at an 
angle /? to the horizontal, as shown in Figure 16.95(c), the 
view factor has been given by Mudan (1984c), following 
work by Raj and Kalelkar (1974), and is 

F = - [(cos P sin 9 - sin fi cos 0) (Mi cos <£ + LAy) 

+ cos p(A 3 -At)} [16.17.50] 


F = - cos 0(Ai cos <p + LA 2 ) [16.17.52] 

Stannard has given an expression based on the subtended 
solid angle method for a tilted cylinder also 



[16.17.53] 

The third approach is the equivalent radiator method. For 
a vertical cylinder the view factor has been given by 
Hamilton and Morgan (1952). For a target with vertical 
surface as shown in Figure 16.96(a) the view factor for a 
half-radiator is 

if R _! I"_ L _1 L 

2" f [(1 + S*) I/2 J + (lA-Uf i2 



and for a target with a horizontal surface as shown in 
Figure 16.96(b) the view factor for a half-radiator is 


L = l/r 

[16.17.51a] 1 ( 

in 1 

-if ^ 11 

X = x/r 

[16.17.51b] 2n 1 

in R (1+tf)V atan 



4> = sin -1 (l/X) [16.17.51c] 


< tan" 


~L — (X — 1/X) sin 0j 


R = r/x [16.17.56a] 

L = l/x [16.17.56b] 

Since the view factors given by Equations 16.17.54 and 
[16.17.51d] 16.17.55 are for half the radiator surface, they must be 

doubled to give the full view factors. 
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(b) 

Figure 16.96 View factor for pool fires - equivalent 
radiator model: (a) vertical cylindrical flame, vertical target 
and (b) vertical cylindrical flame, horizontal target 


The maximum view factor F m is the geometric mean of 
the view factor F v for a vertical surface and the view factor 
F h for a horizontal surface: 

F m = (F v +F h ) 1/2 [16.17.57] 

The application of the view factors just given to tank fires 
has been discussed by Crocker and Napier (1986). For a 
vertical flame and for targets with vertical surfaces three 
possible configurations are shown in Figure 16.97(a). Using 
the solid flame model for target 2 on a level with the base of 
the flame, the view factor for a vertical flame may be used 
as it is. For target 3 on a level with the centre of the flame the 
view factor for a vertical flame may again be used, but 
the value is doubled to take account of the two halves of 
the falme. For target 1 the view factor may be obtained as 
follows: 

F = F[(/ + h),x]~ F[h, x] [16.17.58] 

This view factor is therefore the difference between view 
factors. A similar approach may be used for view factors 
based on the equivalent radiator model. 

For a tilted flame with a target at ground level with a 
surface at an angle /i to the horizontal, the configuration is 
as shown in Figure 16.97(b). Using the solid flame model 
given in Equation 16.17.50 the view factor is 

F = F[(Z + 1'), xf] - F[l', **] [16.17.59] 

Further expressions for more complex situations are given 
by Crocker and Napier. 

A set of graphs for the view factors for pool fires of 
LPG are given in the IP LPG Code. Figure 16.98 (a) shows 
a vertical cylindrical flame and Figure 16.98(b) the 




Figure 16.97 View factor for tank fires - solid flame 
model: (a) vertical cylindrical flame, vertical target; and 
(b) tilted cylindrical flame, angled target 


corresponding maximum view factor, whilst Figure 
16.99(a) shows a tilted cylindrical flame and Figure 16.99(b) 
the maximum view factor for a cylindrical flame with an 
angle of tilt of 30°. 

The view factor for a flame partially obscured by smoke 
is given by Considine (1984 SRD R297). He also gives the 
view factor where there is obstruction by an obstacle. 


16.17.10 Pool fire models 

A review of pool fire models has been given by Mudan 
(1984c) who describes the principal elements of pool fire 
models, but does not present a preferred selection. An ear¬ 
lier review by de Ris (1979) concentrates particularly on 
flame emissivity. 

There are a number of Models of pool fires including 
those by R.O. Parker (1974), Modak (1977), Mizner and Eyre 
(1982), Moorhouse (1982), Ndubuzu et al. (1983), Considine 
(1984 SRD R297), Tunc and Venart (1984/85a) and Bab- 
rauskas (1986b). 

R.O. Parker (1974) describes a pool fire model said to give 
satisfactory results in accident investigation. 

Modak (1977) has described a relatively complex, model 
consisting of a fairly large set of equations. The model is 
capable of determining the heat radiation to the liquid sur¬ 
face and to objects outside the flame. Another relatively 
complex model is that by Ndubuzu et al. (1983). 

Considine (1984 SRD R297) proposes the use of the 
Thomas equation for flame height, the method for sur¬ 
face emissive power which takes account of smoke 
obscuration and appropriate view factors and atmospheric 
transmissivity. 
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(a) 



(b) 

Figure 16.98 View factor for pool fires: vertical cylinder - IP LPG Storage Code (Institute of Petroleum, 1987 MCSP 
Pt 9). (a) Flame and (b) view factor (Courtesy of the Institute of Petroleum) 
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Figure 16.99 View factor for pool fires: tilted cylinder - IP LPG Storage Code (Institute of Petroleum, 1987MCSPPt9): 
(a) Flame and (b) view factor. Angle of title 30° (Courtesy of the Institute of Petroleum) 
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Time and Venart (1984/85a) have given a model of the 
same general type intended for the estimation of the heat 
radiated to a cylindrical object, such as a rail tank car, 
inside the flame. 

Some of the other models mentioned are now described. 

16.17.11 Miznerand Eyre model 

Mizner and Eyre (1982) review the relations available for a 
pool fire. In particular, they quote for the length of flame 
Equation 16.17.2 and for the angle of tilt Equation 16.17.19. 
Their preferred values for the surface emissive power are 
given in Subsection 16.17.8. 

16.17.12 Moorhouse model 

The set of original correlations given by Moorhouse (1982) 
and Moorhouse andPritchard (1982) constitute another pool 
fire model. These authors emphasize that the flame may 
have a conical rather than cylindrical shape. Their model 
contains pairs of relations, one for a cylindrical and one for a 
conical flame. These are: for the length of flame, Equations 
16.17.15a and 16.17.15b; for the angle of tilt, Equations 
16.17.20a and 16.17.20b, or Equations 16.17.21a and 16.17.21b; 
and for flame drag, Equations 16.17.23a and 16.17.23b. 
Surface emissive powers are given in Subsection 16.17.8. 

16.17.13. Babrauskas model 

Another pool fire model is that given by Babrauskas 
(1986b). The model uses the author’s treatment of liquid 
burning rates described in Subsection 16.17.6. 

With regard to flame geometry Babrauskas argues that, 
given the approximation involved in treating the flame as a 
cylinder with uniform diameter, refined methods for flame 
height are not justified. In his model the flame is repre¬ 
sented as a cylinder with diameter D and height h, For a 
target on the ground at distance l the following quantities 
are defined: 

H = h/D [16.17.60] 

L= l/D [16.17.61] 

where D is the pool diameter (m), h is the height of the flame 
(m) and l is the distance from its centre to the target (m). For 
a flame with diameter D > 0.1 m it is sufficient to take 
H = 1.5. 

The heat radiated by the flame is expressed in terms of 
the radiative power P where 

P = & Ah c m [16.17.62] 

where Ah c is the heat of combustion (kj/kg), m is the mass 
burning rate (kg/m 2 s), P is the radiative power (kW) and x T 
is the fraction of heat radiated. 

The radiative power can also be expressed for the far 
field as 

P = ±nl 2 q { L> 4 [16.17.63] 

where qi is the thermal radiation incident on the target (kW/ 
m 2 ). Hence from Equations 16.17.62 and 16.17.63 

?i = ^ L> 4 [16.17.64] 


For the near field a more accurate estimate of the thermal 
radiation is 

qi = FeioT} 1/2 <L < 4 [16.17.65] 

where F is the view factor, T { is the absolute flame 
temperature (K) and e f is the emissivity of the flame. 

For the view factor Fa suitable approximation is 

F^H/nL 2 [16.17.66] 

Then from Equations 16.17.64-16.17.66 

«,«!? = [16.17.67] 

which for 77 = 1.5 and for D — ► oo reduces to 

)«.» MSlfcAftcmoo [16.17.68] 

Combining Equations 16.17.38,16.17.64,16.17.65 and 16.17.68 
yields the relations for thermal radiation 

,- ^ -egHW)] L> 4 [16.17.69] 

qi = jp(p.l31jc r A/jcjtnoo [1 - exp( -k{iD)\ ^ < /,< 4 

[16.17.70] 

where k is the extinction coefficient (m -1 ) and /i is the mean 
beam length corrector. 

For the fractuion of heat radiated Babrauskas refers to the 
data of Hagglund and Persson (1976) quoted inTable 16.65. 

16.17.14 Storage tank fires 

A type of pool fire which is of special interest is a storage 
tank fire. Such fires are usually treated as pool fires. The 
differences are that the liquid surface, and hence the base 
of the flame, is elevated and that it is surrounded by a metal 
wall. Another important feature is that the targets of 
interest usually include other storage tanks. This means 
that the targets may be close to the flame and that it may be 
necessary to consider targets at levels other than ground 
level and heat transfer by modes other than radiation. 

Burgoyne and Katan (1947) conducted experiments on 
the heat wave moving through the liquid in a tank fire. 

Tank fire experiments have been carried out at the 
Forschungsstelle fiir Brandschutztechnik described by 
Werthenbach (1971, 1971a,b, 1973) and Seeger (1974). 
Tank diameters up to 2 m were used. Agreement between 
theoretical estimates of heat radiated based on Equations 
16.17.41 and 16.17.42 was obtained using a flame tempera¬ 
ture and emissivity of 900°C and 0.9, respectively. 

Seeger also investigated numerically the view factor for a 
vertical cylindrical flame on a tank to a target with a vertical 
surface on a level with the base of the flame. The effect on 
the view factor of altering the height of the flame or of 
moving the target to a level halfway up the flame was slight. 

Lois and Swithenbank (1979) have used wind tunnel 
experiments to study fire in an array of tanks. Features 
considered include the effect of wind on the flame and the 
interaction of the wind with the tank array. 
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Kobori, Handa and Yumoto (1981) have studied the 
interactions between a tank that is on fire and a neigh¬ 
bouring tank that is not on fire, including heat transfer to 
the unignited tank by convection as well as radiation, for¬ 
mation of vapour in the unignited tank, induction into the 
fire of the vapour from that by the air drawn into flame, 
and flashback to the unignited tank. 

Crocker and Napier (1986) have reviewed the main ele¬ 
ments of pool fire models as they apply to tank fires, have 
listed the applicable view factors and have considered the 
implications for storage tank layout. 

16.17.15 Slot fires 

Another type of pool fire is the slot, trench or channel fire. 
Such a fire may occur on a spill of flammable liquid which 
has entered a trench or channel of any kind. A characteristic 
feature is that there is a high aspect ratio. One situation in 
which this type of fire may occur is the burning of a liquid 
spill directed to a high aspect ratio catchment area. 

Slot fires are discussed briefly by Moorhouse and 
Pritchard (1982). One approach is to treat the fire as a series 
of individual pool fires and then apply the relations for 
circular pools. This approach appears to fit the results of 
small-scale experiments described by Welker (1965) and 
Gollahalli and Sullivan (1974). Further, data reported by 
Alger and Capener (1972) on the burning rates of large- 
scale fires of JP- 5 on a pool of aspect ratio greater than 2 are 
consistent with those from circular pool fires. Moorhouse 
(1982) states that the work on LNG pool fires which he 
describes included some limited tests on LNG fires with an 
aspect ratio of 1 to 2.5. 

Work on trench fires of LNG with aspect ratios up to 30 
has been conducted by Mudan and Corce (1984) and is 
summarized by Mudan (1989b). The work indicates that in 
such fires the flame height is influenced more by the width 
than by the length of the trench and that the flame geo¬ 
metry is more sensitive to wind conditions than is the case 
in fires on circular pools. 

Mudan and Croce obtained for LNG the following corre¬ 
lations for flame height, angle of tilt and flame drag: 

~ = 2.2 Fr' > 0.25 [16.17.71a] 

~ = 0.88(Fr') -0 ' 65 0.1 < Fr' < 0.25 [16.17.71b] 

^ = 4.0 Fr' < 0.1 [16.17.71c] 

cos 6 = 0.56 Fr' > 0.25 [16.17.72a] 

cos 6 = 0.36(Fr') -0 ' 32 0.042< Fr' < 0.25 [16.17.72b] 

cos 6 = 1 Fr' < 0.042 [16.17.72c] 

= 3.5 Fr' > 0.25 [16.17.73a] 

= 23.3 (Fr') 1 ' 37 0.1 <Fr'< 0.25 [16.17.73b] 

™ - 1 Fr' < 0.1 [16.17.73c] 


Fr' = « w /2(grW) 1/z [16.17.74] 

where Fr' is a modified Froude number, g is the acceleration 
due to gravity (m/s 2 ), H is the length pf the flame, u w is the 
wind speed (m/s), Wis the width of the trench (m), W' is the 
extended width of the flame base (m) and 6 is the angle of 
tilt (°). For calm conditions, where the value of Fr' is very 
low, the flame geometry depends only on the trench width. 
For values of Fr' which are higher but still less than about 
0.25, the flame length decreases but the angle of tilt and 
flame drag increase with wind speed. For still higher 
values of Fr' the flame geometry is independent of wind 
speed. The correlations are not strictly applicable where the 
wind direction is parallel to the axis of the trench. 

The application of these relations to liquid fuels other 
than LNG is uncertain. 


16.18 Flares 

A jet flame occurs when flammable gas issuing from a 
pipe or other orifice is ignited and burns on the orifice. 
Historically, treatments of such flames have been con¬ 
cerned mainly with flames which are there by design, such 
as the flames on burners and flares. It is convenient, 
therefore, to start by considering flares. 

The fundamentals of combustion in flares have been 
studied by Brzustowski and co-workers (e.g. Bzrustowski, 
1973, 1977; Brzustowski and Sommer, 1973; Bzruztowski 
et al ., 1975) and by others. 


16.18.1 Experimental studies 

There is vast literature on flames. Discussion here is limited 
to some of the studies which have been concerned specifi¬ 
cally with flare systems. Some of the studies on flares are 
tabulated in Section 16.19. 

Conventionally, flares have been designed to give a flame 
which is vertical in still air. The use of flares on offshore oil 
production platforms, where helicopter access is necessary, 
has prompted the development of flares with an inclined 
flame. The models developed for inclined flares are relevant 
to jet flames arising from accidents. 

A series of experimental studies of flares has been 
reported by Brzustowski and co-workers. The correlations 
obtained by Brzustowski and Sommer (1973) are the basis 
of the more elaborate flare model given in API RP 521, as 
described below. 

Various workers have found that the API methods tend to 
overpredict the incident heat radiation. The need for tighter 
design of flares offshore, where space is limited, has given 
an incentive to obtain improved methods. 

Experiments on flares have been conducted by Shell and 
are described by Chamberlain (1987). Ranges of some of the 
parameters in these trials were as follows: gas molecular 
weight 16-44; pipe diameter 0.006-1.07 m; Mach number 
0.06-0.9; gas exit velocity 14-554 m/s; and wind speed 
2.7—13 m/s. This work is the basis of the Chamberlain flare 
model given below 

Chamberlain’s work has been extended in the model by 
A.D. Johnson, Brightwell and Carsley (1994), also described 
below. This work was on natural gas. The ranges of some of 
the parameters were: pipe diameter 0.02-0.152 m; gas mass 
flow 2.8—8.4 kg/s; and wind speed 0.3—6.9 m/s. 
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Other experiments have been carried out hy British Gas, 
as described by D.K. Cook, Fairweather, Hammonds and 
Hughes (1987). The experiments were on natural gas and 
the flows were both subsonic and sonic. Ranges of some of 
the other parameters in these trials were as follows: pipe 
diameter 0.051-0.59 m; gas exit velocity 89-402 m/s; and 
wind speed 1.0-13 m/s. 


16.18.2 Hajeck and Ludwig model 

An equation which has been widely used for the determi¬ 
nation of the thermal radiation from a flame on a flare stack 
is that of Hajek and Ludwig (1960) 


= f*Q 

47 zr 2 


[16.18.1] 


where F T is the fraction of heat released which is radiated, 
/ is the radiation intensity on the target (kW/m 2 ), Q is the 
net heat release rate (kW) and r is the radius from the centre 
of the flame (m). 

Combustion in the flare is a complex process. In Equa¬ 
tion 16.18.1 this complexity is subsumed in the factor F r 
This factor has traditionally been taken as a property of the 
fuel only. It has been shown, however, that the F r factor is 
discussed by Brzustowski (1977). and by Straitz etal. (1977) 
Some values of the fraction F r of heat radiated are given in 
Table 16.68. 

For the determination of radiation expsoure, the current 
version of API RP 521 gives Equation 16.81.1 in the form 


D = 


'iF r Q\ 1/2 
,4 kK) 


[16.18.2] 


where D is the distance from the centre of the flame to the 
target (m) K is the allowable radiation (kW/m 2 ) and t is the 
atmospheric transmissivity. 


Table 16.68 Fraction of heat radiated by a flare 


A Fraction of heat release F r \ overall values 

Gas 

F 

Reference 

Methane 

0.16 

Brzustowski and Sommer (1973) 

Propane 

0.33 

Kent (1964) 

Butane 

0.30 

Brzustowski and Somer (1973) 

Ethylene 

0.38 

Brzustowski and Sommer (1973) 


B Fraction of heat release F r : values as function of 
burner diameter 3 


Gas 

Burner 
diameter (cm) 

FA%) 

Hydrogen 

8.4 

0.16 


20.3 

0.15 


40.6 

0.17 

Butane 

8.4 

0.29 


20.3 

0.28 


40.6 

0.30 

Methane 

8.4 

0.15 

Natural gas 

20.3 

0.19 


40.6 

0.23 


a Zabetakis and Burgess (1961BM RI5707); quoted in API RPI521: 
1990. Also Burgess and Zabetakis (1962 BM RI 6099). 


16.18.3 API RP 521 models 

Flare models which have been widely used are those given 
in the successive aditions of API RP 521 Guide for Pressure- 
relieving and Depressuring Systems. API RP 521:1990 gives 
two models. The first is described as a simplified approach. 
The second is based on the method of Brzustowski and 
Sommer (1973). 

The simplified model is as follows. The Mach number Ma 
at the flare tip is 


„ W ( T \ 1/2 

Mas 11.61 Xl0- 2 ^y [16.18.3] 

where d is the flare diameter (m), k is the ratio of the specific 
heats of the gas, M is the molecular weight of the gas, P is 
the absolute pressure just inside the flare tip (kPa), T is the 
absolute temperature of the gas (K) and IFis the mass flow 
of gas (kg/s). 

The flare diameter is determined by setting a suitable 
value of the Mach number. The Guide gives as examples 
values of 0.2 and 0.5. 

The length of the flame is a function of the heat release 
and is determined from Figure 16.100. 

The distortion of the flame caused by the wind velocity is 
defined in terms of the horizontal deviation and the 
vertical deviation ^ Ay of the flame tip and is a function of 
the ratio of the velocity at the flare tip Uj to the wind velocity 
Moo. The flare tip exit velocity Uj is obtained as 



Uj = Ma m s [16.18.5] 

fkT\V 2 

“3 = 91-2 [16.18.6] 

where Uj is the exit velocity of the gas at the flare tip (m/s), 
u s is the velocity of sound (m/s), u x is the velocity of the 
wind (m/s), Fis the volumetric flow of gas (m 3 /s) and sub¬ 
script j denotes the flare tip exit. The co-ordinates of the 
flame tip are determined using Figure 16.101. 

This method does not give an explicit relation for the 
intensity of heat radiation on a target, but use may be made 
of Equation 16.18.2. 

16.18.4 Brzustowski and Sommer model 

In the second method given in API RP 521, the Brzustowski 
and Sommer model, the flare diameter is determined in the 
same manner by using Equation 16.18.3. The centre of the 
flame is then determined as follows. The horizontal dis¬ 
tance^ and the vertical distance y c from the flare tip to the 
centre of the flame are 

x c =f(C L ,djR) [16.18.7] 

y c =f(C L ,djR) [16.18.8] 
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Heat release (W) 


Figure 16.100 Flare flames: flame length (API RP 521: 1990; reproduced with permission). (Multiple points indicate 
separate observations or different assumptions of heat content) 




^ = Cl ;t§ [16 - ia9] 

U. (T M\ 1/2 

R = u\ t) [16.18.10] 

where Cl is the lower explosive limit (volume fraction), R is 
a parameter, T ^ is the absolute temperature of the air (K), x c 
andy c are the horizontal and vertical distances of the flame 
centre from the flame tip (m) and Cl is a modified lower 
explosive limit (volume fraction). The coordinates of the 
flame centre are determined using Figure 16.102. 

Equation 16.18.2 is used to determine the intensity of 
heat radiation incident on a target. 

16.18.5 de Faveri et al. model 

Another flare model is that by de Faveri et al. (1985). These 
workers performed wind tunnel experiments on small 
‘flares’ in a wind and obtained correlations for various 
features of the flare such as the downwind position of the 
flame tip and the axis of the flame. 

This model has been discussed by Crocker and Napier 
(1988b) in relation to multiple point source modelling of 
flare radiation. 


components of the model are (1) the effective diameter of the 
source D s (2) the length of the flame in still air L m (3) the 
length of the flame in the pertaining conditions L, (4) the 
angle between the axis of the orifice and that of the flame a, 
(5) the lift-off distance of the frustrum of the flame b, (6) the 
length of the frustrum i? L , (7) the width of the base of the 
frustrum Wi, (8) the width of the top of the frustrum W 2 and 
(9) the area of the flame A. 

The parameters which define the model geometry are 
determined as functions of the velocity ratio R 

R = v/ui [16.18.11] 

where u is the gas velocity (m/s), v is the wind velocity 
(m/s) and subscript j denotes the expanded jet. 

The model equations are as follows. As described in 
Chapter 15, use is made of D s for the source. For unchoked 
flow 

Ds = do ^y [16.18.12] 

with 


[16.18.13] 


16.18.6 Chamberlain model 

The flare model given by Chamberlain (1987) of Shell is 
based on the flame shown in Figure 16.103. The geometric 


where d„ is the throat diameter of an imagined flow nozzle 
(m), D s is the effective diameter of the source (m), Tj is the 
temperature of the gas in the expanded jet (K), p a is the 
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Figure 16.101 Flare flames: distortion due to wind (API RP 521: 1990; reproduced with permission). 14, Lateral wind 
velocity; U t exit gas velocity from the stack 


density of air (kg/m 3 ), p° is the density of the gas under 
standard conditions (kg/m 3 ) and pj is the density of the gas 
in the expanded jet (kg/m 3 ). For choked flow the jet expands 
to atmospheric pressure at a plane downstream of the 
exit hole, the plane then acting as a virtual source of dia¬ 
meter di. Then 


D ° = % 


s 1/2 


4 m fRoTjY' 
TtPoMaj \yMj 


R c is the universal gas constant (J/kmolK), Uj is the velocity 
of the gas in the expanded jet (m/s) and y is the ratio of the 
specific heats of the gas. 

For the length L Bo of the flame in still air the implicit 
equation of Kalghatgi (1984) is used: 



'F/Lbo) =0.2 + 0.024{(Lbo) 

[16.18.16] 

[16.18.14] 

with 




[16.18.17] 

[16.18.15a] 

"jir 

ii 

[16.18.18] 

[16.18.15b] 

>-my 

[16.18.19] 


where dj is the diameter of the virtual source (m), m is the 
mass flow of gas (kg/s), Mk is the kilogram molecular 
weight of the gas (kg/mol), Maj is the Mach number of the 
expanded jet, P 0 is the absolute atmospheric pressure (N/m 2 ), 


where g is the acceleration due to gravity (m/s 2 ), L Bo is the 
length of the flame in still air (m), M is the molecular weight 
of the gas,Tis the absolute temperature (K), u is the velocity 
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C L (Uj/U«0 (Mj/29.0) 

(b) 

Figure 16.102 Flare flames: location of flame centre (API RP 521: 1990; reproduced with permission): (a) Horizontal 
distance x c of the flame centre from the orifice and (b) vertical distance (m) of the flame centre from the orifice. 

C L , lower explosive limit; y c , volume fraction; d„ inside diameter of flare tip (m); Mj, molecular weight of the gas; 

7j, temperature of the gas (K); T x , temperature of the air (K); U v gas exit velocity (m/s); U^, average wind velocity (m/s) 
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For the angle a between the axis of the orifice and that of 
the flame 

a = -l-{8000i? + {(L B „)(0 jv - 90)[1 - exp(-25.6P)]} 

{(/'Bo) 

R < 0.05 [16.18.23a] 

a = 1 {1726(A* - 0.026) 1/2 + 134 + £(L B „)(0 jv - 90) 

{(/'Bo) 

x [1 —exp (—25.6/?)] R > 0.05 [16.18.23b] 

where a is the angle between the hole axis and the flame 
axis (°). 

For the lift-off distance b of the frustrum of the flame, by 
geometry 

b = Lb [16.18.24a] 


Figure 16.103 Flare flames: flame dimensions for 

Chamberlain model (Chamberlain, 1987). (Note that point or 

P is always at the intersection of the hole and frustrum . „ 

axes) (Courtesy of the Institution of Chemical Engineers) b = L s 81 . = [16.18.24b] 


of gas, JFis the mass fraction of the fuel in a stoichiometric 
mixture with air, and {is the Richardson number based on 
the flame length in still air. The subscript a denotes air, j the 
conditions in the expanded jet, p the mean product value 
and 1 adiabatic combustion conditions. 

For a paraffin of molecular weight M the mass fraction W 
of fuel in a stoichiometric mixture with air is 


W = 


M 

15.816M + 39.5 


[16.18.20] 


Typical conditions of M a «29.0, M p ss 28, T a xi 288 K and 
Ti = 2250 K yield 2.85. 

For a tilted jet, in which the hole axis is in the wind 
direction and at an angle dj to the horizontal, it has been 
shown by laboratory experiments that the flame length 
reduces as the jet is tilted into the wind, that is as % 
increases, because the air entrainment coefficient increases. 
A linear relation holds between L B /D S and 6 y Then for the 
actual length L B of the flame 


[16.18.21a] 


i B = 105.4D S [1 - 6.07 x lO" 3 ^ - 90)] [16.18.21b] 

On the assumption that L B scales similarly with 0j for 
all wind speeds and directions, the general correlation 
forL B is 


K asfcift [16.18.25] 

where b is the lift-off height (m) and at, is the angle between 
the hole axis and the line joining the top of the flame to the 
centre of the hole (°). 

A was correlated as follows: 

K = 0.185exp(—20/?) + 0.015 0.005<P<3 [16.18.26] 

For a = 0° or 180° 


b = KL b [16.18.27] 

For the length R L of the frustrum, by geometry 

R l = (L| - 6 2 sin 2 a) 1/2 - b cos a [16.18.28] 

For the width W\ of the base of the frustrum the following 
correlation was obtained: 

Wl = A[13.5exp(-6P) + 1.5] 

1< { 1 "[ i "b(«) / ]“ p( - 70J(o - )c ')} 

[16.18.29] 


L b = L Bo [ 0.51 exp(-0.4i>) + 0.49] [1 - 6.07 x lO- 3 (0 jv - 90)] C = 1000exp(-100P) + 0.8 [16.18.30] 

[16.18.22] 

where dj is the angle between the hole axis and the hor¬ 
izontal (°) and 6 jv is the angle between the hole axis and the 
wind vector in the plane containing the hole axis, the flame 

axis and the wind vector (°). where W\ is the width of the frustrum base (m). 
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For the width of the top of the frustrum W 2 , the correla¬ 
tion obtained was 

W 2 = Z*[0.18exp(-1.5ff) + 0.31][1 - 0.47 exp(-257?)] 

[16.18.32] 


where W 2 is the width of the frustrum top (m). 

For the surface area A of the flame, including the two end 
discs, by geometry 

A = J (W? + w£) + f (M + Wa) ^ ^ “ r, ) 2 j 

[16.18.33] 


where A is the surface area of the flame (m 2 ). 

The surface emissive power of the flame is then 


The length scale L is the length over which the buoyancy 
force acts and is taken as the flame length L bo for a vertical 
flame in still air. The value of L bo is given by a correlation 
derived by Khalhatgi (1984). L bo is obtained as the solution 
of the equations 

T = 0.2 + 0.024{(L bo ) [16.18.39] 


T =• 


^ 2.85 P s \ 2/3 

^LboWj 


[16.18.40] 


where D s is the effective source diameter (m), L b0 is the 
flame length in still air (m), Ms the mass fraction of the fuel 
in a stoichiometric mixture with air and is a parameter. 
The effective source diameter is the throat diameter of an 
imaginary nozzle from which air at ambient density issues 
with the same mass flow and momentum as the fuel: 


E = 1 -j^ [16.18.34] 

wherei^ is the fraction of heat radiated, E is the surface emis¬ 
sive power (kW/m z ) and Q is the net heat release rate (kW). 

The fraction F r of heat radiated was found to correlate 
with gas velocity Uj as follows: 

F t = 0.21 exp( -0.00323«j) +0.11 [16.18.35] 

The radiation incident on a target is then 

imtFE [16.18.36] 

where F is the view factor, 7 is the radiation incident on the 
target (kW/m 2 ) and x is the atmospheric transmissivity. 

Aversion of the Chamberlain model incorporated in the 
computer code SAFETI has been described by J Cook, 
Bahrami and Whitehouse (1990). 

16.18.7 Johnson, Brightwell and Carsley model 

A.D. Johnson, Brightwell and Carsley (1994) have described 
a model for a jet flame of natural gas issuing horizontally, 
which is an extension of the flare model of Chamberlain 
(1987), already described. The model was developed in con¬ 
junction with large-scale tests on natural gas flames. 

As in the original model, the flame is represented as the 
frustrum of a cone with the maximum width at the end 
furthest from the origin. For the flame shape the treatment 
is as follows. The momentum flux of the expanded jet is 



The authors indicate that range of validity of the relation 
for L bo is 2 < 4(7, bo ) < 20. 

The flame shape is defined relative to the x, y and z 
co - ordinates, where x, y and z are the distances in the release 
direction, the vertical direction and the crosswind direction, 
respectively. The position of the flame is determined by the 
relative effects of the initial jet momentum flux and the wind 
momentum fluxes in the x, or release, direction and in the z 
direction, perpendicular to the flame. The balance of these 
momentum fluxes is characterized by the two parameters 

n,= (^) 1/2 L b0 « a [16.18.42] 

= ^f\ 0 w a [16.18.43] 

where u a is the wind speed in the release direction (m/s), w a 
is the wind speed perpendicular to the release (m/s) and Q* 
and fi z are parameters. 

The end of the flame frustrum is correlated by a term 
defining the end of the flame in still air multiplied by a term 
allowing for the effect of the wind. It was found experimen¬ 
tally that a croswind had little effect on the position of the 
flame in the x direction so that the influence of the parameter 
fi z could be neglected. Then for the £l x position of the flameX 


G = 


npjt^d£ 


[16.18.37] 


[16.18.44] 


where dj is the diameter of the expanded jet (m), G is the 
initial momentum flux of the expanded jet (N), Uj is the 
velocity of the expanded jet (m/s) and pj is the density of 
the expanded jet (kg/m 3 ). The parameters dj, Uj and pj are 
as defined by Chamberlain. 

A Richardson number 4(7.) is defined as 

m = [16.18.38] 

where g is the acceleration due to gravity (m/s 2 ), L is a char¬ 
acteristic length (m) and p a is the density of air (kg/m 3 ). 


/( 4 ) = 0.55 + (1 - 0.55) exp( -0.1684) 4 < 5.11 

[16.18.45a] 

/(4) = 0.55 + (1 - 0.55) exp[—0.168{ - 0.3(4 - 5.11) 2 ] 

4 >5.11 [16.18.45b] 

K£)= 0 4 <3 [16.18.46a] 

r{i) = 0.82(1 - exp[—0.5(4 - 3.3)]} 4> 3 [16.18.46b] 
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where / and r are parameters. A limit is placed on the x 
position by setting a maximum value of X/L bo of 1.0. Simi¬ 
larly, for they position of the flame Y 

£ ) = /j(f)[l-c(f)nj [16.18.47] 

*({) = ( l + l/£r 8 ' 78 [16.18.48] 


c(f) = 0.02{ [16.18.49] 

The y position is confined within the range 0 < Y/L ho < 1.0. 

The maximum diameter of the flame, at the point 
furthest from the origin, is given by the correlation 

Wo „ c 

jjy- = -0.004 + 0.0396{ - Q*(0.0094 + 9.5 x KT 7 ? 5 ) 

[16.18.50] 

Lbxy = (X 2 + F 2 ) 1/2 [16.18.51] 

where W 2 is the maximum diameter of the flame (m) and 
Lb^ is a parameter (m). For a realistic flame shape, W 2 must 
be greater than W\ and less than Lb xy . 

The lift-off distance of the flame is 

b = 0.141(Gp a ) 1/2 [16.18.52] 

where b is the lift-off distance (m). The minimum diameter 
of the flame is 

Wi 

-y = -0.18 + 0.081{ [16.18.53] 

where W\ is the minimum diameter of the flame (m). The 
flame cannot become narrower than the forced convection 
limit and W\/b has a minimum value of 0.12. 

The 2 position of the flame is given by the correlation 

x = 0.178Q Z [16.18.54] 

This completes the model for the flame shape. For the 
thermal radiation, the surface emissive power is given by 

S = Soc [1 - exp( -kL)\ [16.18.55] 

Soo = Fs j^ [16.18.56] 

where A is the total surface area of the flame (m 2 ), F soo is the 
fraction of heat radiated for flames which emit black body 
radiation, k is a gray gas absorption coefficient (m _1 ), L is a 
length representing the emitting path length (m), Q is the 
net heat release rate (kW), S is the surface emissive power 


(kW/m 2 ) and S«, is the black body surface emissive power 
(kW/m 2 ). The value of k was found to be 0.4 nT 1 , whilst F soo 
was correlated as follows: 

F soo = 0.21 exp( -0.00323«j) + 0.14 [16.18.57] 

The thermal radiation on the target is then 

<7 = (FsiSsi + Fen Sen) r [16.18.58] 

where F is the view factor, q is the thermal radiation inci¬ 
dent on the target (kW/m 2 ) and t is the atmospheric trans¬ 
missivity. Subscripts en and sd denote the end and the side 
of the flame, respectively. 

Figure 16.104 shows a set of comparisons between 
the results obtained with the model and those obtained 
from the experimental tests for four standard trial condi¬ 
tions B—E. 

16.18.8 Cook etal. model 

A model for a flare of natural gas has been given by 
D.K. Cook etal. (1987).This model also is relatively complex. 

16.19 Jet Flames 

There is a wide variety of situations in which a jet flame, or 
ejected flame, can occur in the process industries, either by 
design or by accident. The principal situations in which 
flames occur by design are in burners and flares. Flames on 
burners are not treated here. Those on flares have been 
considered in Section 16.18. 

Ejection of flammable fluid from a vessel, pipe or pipe 
flange can give rise to a jet flame if the material ignites. An 
intermediate situation, and one which particularly con¬ 
cerns the designer, is where the jet flame results from igni¬ 
tion of flammable material vented from a pressure relief 
valve. 

Scenarios involving jet flames are not easy to handle, 
since a large jet flame may have a substantial ‘reach’, 
sometimes up to 50 m or more. 

Jet flames have been involved in a number of accidents. 
Perhaps the most dramatic were the large jet flames from 
the gas riser on the Piper Alpha oil platform, as described 
in Appendix 19. In other cases jet flames from pressure 
relief valves have caused adjacent vessels to overheat and 
burst, giving a boiling liquid expanding vapour explosion, 
or BLEVE. Such was the case at Mexico City, as described 
in Appendix 4. 

16.19.1 Experimental studies 

Much of the early experimental work relevant to jetflames 
was concerned with flares. An account of this work was 
given in Section 16.18. There is now, however, a growing 
interest in the jet flame in its own right. 

Table 16.69 lists some studies on flares and on jet flames. 
Investigations of the combustion of large-scale jet releases 
of liquefied flammable gas have been undertaken by Shell, 
BP and British Gas, both separately and in co-operation. 

The work done covers a variety of jet flames, including 
flames of natural gas and of LPG. Representative accounts 
of work using natural gas are those by Chamberlain (1987) 
and AD. Johnson, Brightwell and Carsley (1994) at Shell, 
and by D.K. Cook et al. (1987) at British Gas. 

Accounts of work on jet flames of LPG at Shell and 
British Gas have been given by Hirst (1984) and Tam and 
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Figure 16.104 Flare flames: flame dimensions for the 
model of Johnson, Brightwell and Carsley. Comparison 
between model predictions and experimental results (A.D. 
Johnson, Brightwell and Carsley, 1994): (a) Test 1040, 
Type B; (b) Test 1033, Type D; (c) Test 1083 Type C and 
(d) Test 1089, Type E 


Cowley (1989). The work on flames formed part of a study 
of emission and gas dispersion of jets as well as of 
combustion. 

Hirst (1984) describes experiments using liquefied pro¬ 
pane. Tests were carried out using orifices ranging from 9 to 
52 mm in diameter and pressures from about 6 to 20 bar. 
Both vertical and horizontal releases were studied. 

A series of tests were done with vertical releases. The 
liquid rose in a strongly divergent cone bending with the 
wind. The cone angle was typically 30° for the plume but up 
to 90° in the flash region. The releases usually reached a 
steady state before ignition. The visible clouds at ignition 
were large, extending up to 45 m vertically and 70 m 
downwind. In most cases a fireball formed and in several 
tests rose to 100 m; the most fully developed fireballs 
occurred at low wind speeds. 

The overpressures generated by the flames were also 
measured. The maximum observed overpressures fell from 
some 3 mbar at 20 m from the release point to about 0.8 
mbar at 100 m. 

Other tests were done with horizontal releases. One of 
features measured in these trials was the distance reached 
by the flame. Figure 16.105 gives for a 5 mm diameter pipe 
the relation between the mass flow and the impingement 
distance of the flame. 

One of the trials shows a 35 m long jet flame from a full 
bore release of 7.9 kg/s from a 50 mm pipe at a pressure of 
13 barg. The combustion energy was 365 MW The maxi¬ 
mum surface emissive power was 250 kW/m 2 and occurred 
25 m from the release point and just before the flame 
underwent transition from the momentum-dominated to 
the buoyancy-dominated condition. 

However, for such full bore discharges the heat radiation 
within the flame was complex and steady heat fluxes 
were mainly in the range 50-220 kW/m 2 and depended 
on the discharge conditions and the target distance. The 
maximum temperature occurred at a distance of 4 m and 
had a value of 1570 K. 

The problem of heat radiation from a flame on a pressure 
relief valve on a rail tank car onto the surface of the latter 
has been studied by Tunc and Venart (1984/85b). Experi¬ 
ments were conducted on ignited releases from pressure 
relief valves on tank cars. 


16.19.2 Empirical features 

A jet flame resulting from the ignition of a leak of flam¬ 
mable fluid at the leak aperture is a diffusion flame. The 
basic characteristics of such a flame have been outlined in 
Section 16.12. 

At low velocities the flame is generally attached to the 
point of release, but at higher velocities it becomes 
detached, the distance between the orifice and the flame 
increasing with velocity so that it may become unstable and 
lift off, thus being extinguished. If, however, the flame 
impinges on an obstruction, this may serve to stabilize it. 

As already stated, jet flames can have a considerable 
reach. The flame impingement distance can be up to 50 m or 
more. The reach is sometimes expressed in terms of the 
ratio of the flame length to the orifice diameter, and values 
of this lid ratio in excess of 300 are quoted. 

Generally, the length of a jet flame over the range of 
practical interest is approximately proportional to the 
square root of the mass flow. This is the implication of 
the API correlation for the flame length on a flare and of 
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Table 16.69 Some studies on flares and on jet flames 
A Studies of flares 


Experimental studies of heat radiation 
Experimental and theoretical studies of flare 
dimensions and heat radiation 
Experimental and theoretical studies of flare 
characteristics 

Theoretical model of flare dimensions and 
heat radiation 

Experimental and theoretical studies of flare 
dimensions and heat radiation 


Experimental and theoretical studies of flare 
dimensions and heat radiation 


Studies referenced in API RP 521:1990 
Brzustowski and Sommer (1973) 

de Faveri etal. (1985) 

Chamberlain (1987) 

D.K. Cook Fairweather, 

Hammonds and Hughes (1987); 

D.K. Cook, Fairweather, 

Hankinson and O’Brien (1987) 

D.K. Cook (1991a,b) 

A.D. Johnson, Brightwell and Carsley (1994) 


B Studies of jet flames 


Theoretical model of jet flame dimensions 
Theoretical model of jet flame dimensions 
Theoretical model of jet flame dimensions 
and heat radiation 

Experimental studies of jet flames of LPG 
Experimental and theoretical studies of jet 
flame dimensions and heat radiation 
Experimental and theoretical study of jet flames 
on rail tank cars 

Empirical model of jet flame dimensions and 
hazard range 

Empirical model of jet flame dimensions and 
heat radiation 

Experimental studies of jet flames of LPG 
Theoretical model of gas pipeline jet flame 
heat radiation 


Burke and Schuman (1928a,b) 
Hawthorne, Weddell and Hottell (1949) 
Craven (1972,1976) 

Hirst (1984) 

Sonju and Hustad (1984); 

Hustad and Sonju (1986) 

Tunc andVenart (1984/85b) 

Considine and Grint (1985) 

Clay etal (1988); Grint (1989) 

Tam and Cowley (1989) 

D.A. Carter (1991) 


the work on propane jet flames just described. It is also 
implied in a number of models. 

The graph given in Figure 16.105 is fitted approximately 
by the relation 

li&6m 0 - 5 0<m<50 [16.19.1] 

where k is the impingement distance (m) and m is the mass 
flow (kg/s). 

The fraction of heat radiated by a jet flame is a function 
of the fuel, being less for hydrogen and methane than for 
propane. It tends to increase and reach a maximum as the 
orifice diameter increases. It usually lies in the range 
0.15-0.3. 

For diffusion flames in general the flame temperatures 
have been discussed by Gugan (1976). He quotes values of 
some 1600°C for laminar diffusion flames and 2000°C for 
turbulent diffusion flames, the heat release in the latter 
being an order of magnitude greater. The maximum flame 
temperature in a gas jet flame is of the order of 2000°C. 

The maximum flame temperatures observed in the work 
on jet flames of liquefied propane were of the order of 
1300°C. Further, in this work on liquefied propane the 
values of the surface emissive power up to 250 kW/m 2 were 
observed, but these are spot values and do not occur over 
the whole flame. 


16.19.3 Modelling of jet flames 

By comparison with fireballs and pool fires, with jet flames 
the number of possible scenarios to be considered is much 
greater. The case mainly treated is that of a vertical flame 
on an upward pointing jet, In calm conditions or in wind. 
Another case occurs where the jet points upwards not ver¬ 
tically but at an angle. In this case there may be a variety of 
wind directions, confluent with, opposed to or across the 
jet. A third case is the horizontal jet, for which again the 
wind direction may be confluent, opposed or across. 

Different workers have assumed different geometries 
for the jet. These include a cone (e.g. Craven, 1972), a cylin¬ 
der (e.g. Croce and Mudan, 1986) and a frustrum (e.g. 
Chamberlain, 1987). One consequence of this is that there is 
no generally applicable view factor and that the view factor 
to be used has to be developed for the particular geometry, 
except in so far as the point source method is applicable. 

A model of a jet flame was formulated by Burke and 
Schumann (1928a,b) and was later taken up by Savage 
(1962). Another early model is that of Hawthorne, Weddell 
and Hottel (1949). Work on the modelling of jet flames has 
been done by Craven (1972), Bilger (1975,1976,1977,1979, 
1989), MITI (1976), H.A. Becker and Liang (1978, 1982), 
R. Becker (1980a,b), Kalghati (1981-1983,1984), de Faveri, 
Fumarola and co-workers (Fumarola et al., 1983; de Faveri 
et al., 1985), Peters and co-workers (Peters and Williams, 
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Figure 16.105 Jet flames: flame impingement distance i/'s mass flow for propane (Tam and Cowley, 1989) 
(Courtesy of Gastech) 



1983; Peters and Gottgens, 1991), Hustad and Sonju (Sonju 
and Hustad, 1984; Hustad and Sonju, 1986), Croce and 
Mudan (1986) and Duijm (1994). 

Work at Shell includes that by Chamberlain (1987) and 
A.D. Johnson, Brightwell and Carsley (1994). 

Birch and co-workers at British Gas have conducted a 
series of studies on unignited and ignited jets (Birch et al., 
1978, 1984, 1988, 1989). Also at British Gas, D.K. Cook, 
Fair weather and co-workers have modelled natural gas 
flares (D.K. Cook, Fairweather, Hammonds and Hughes, 
1987; D.K. Cook, Fairweather, Hankinson and O’Brien, 1987; 
D.K. Cook, 1991a,b; Fairweather et al., 1991; Fairweather, 
Jones and Linstedt, 1992). 

Models used by the HSE have been described by Clay 
et al. (1988), Grint (1989) and D. A. Carter (1991). 

The set of models of fire events given by Considine and 
Grint (1985) includes one for a jet flame. 

Many jet flame models derive from work on the model¬ 
ling of flares, and most models are for jet flames of gas, 
particularly natural gas. There are also a few models for 
jet flames of a flashing liquid such as LPG. 

Models for jet flames of LPG include those given by 
Clay et al. (1988), Grint (1989) and J. Cook, Bahrami and 
Whitehouse (1990). 

Some of the principal jet flame models are now described. 

16.19.4 Hawthorne, Weddell and Hottel model 

One of the first models of a jet flame was that given by 
Hawthorne, Weddell and Hottel (1949). They envisage 


the flame as an inverted cone with the apex on the orifice. 
The equations for the length of the flame and for the dia¬ 
meter at the top of the cone have been given above as 
Equations 16.3.3 and 16.3.4, respectively. 

16.19.5 Bzrustowski and Sommer model 

The model of Brzustowski and Sommer (1973), which is 
given in API RP 521 as an alternative to the simplified API 
method for flare design and has been described in Section 
16.18, is also used as a model for a jet flame. 

16.19.6 Craven model 

A model of a jet flame developed for the purpose of 
designing of emergency relief vents has been described by 
Craven (1972). He gives the following method of estimating 
the heat flux incident on a target near the flame. 

The flame model considered is shown in Figure 16.106. 
The dimensions of the flame are estimated using the cor¬ 
relation of Hawthorne, Weddell and Hottel given in Equa¬ 
tions 16.3.3 and 16.3.4. The flame temperature is assumed to 
be 2300 K, a value which is equal to or somewhat greater 
than adiabatic flame temperature for most hydrocarbons. 
The emissivity of the flame is taken as unity. The radiant 
heat flux E is then 

E = eaT* [16.19.2] 

where E is the radiant heat flux (W/cm 2 ), T is the absolute 
temperature of the flame (K), e is the emissivity of the 
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flame, and a is the Stefan-Boltzmann constant. The 
emissivity is assumed to be unity, so that for a flame 
temperature of 2300 K 

E = 160 W/cm 2 = 1600 KW/m 2 


viewed as a disc and the 
configuration B-ll) is 


factor F x (Howell, 1982- 


[16.19.3] 


The heat flux and view factors for targets at points X, Y 
and Z in Figure 16.106 are considered. At point X, which is 
directly beneath the vent, the emissivity may be taken as 
unity. For a horizontal target at this point the flame is 


where h is the height of the vent orifice (m), l is the length 
of the flame (m) and r is the radius of the flame at its tip (m). 

For radiation at point Z the flame is treated as a rectan¬ 
gular radiator ABCD with an emissivity of unity. For 



Figure 16.106 Jet flames: flame dimensions for the Craven model (after Craven, 1972) (Courtesy of the 
Institution of Chemical Engineers) 
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a horizontal target at this point the configuration factor 
Fz is 


m+x 2 ) (*I+* 2 )J 


[16.19.4] 




hi = h + l/2 [16.19.5a] 

h 2 = h + l [16.19.5b] 

where hi is the distance from the ground to the bottom of the 
radiator ABCD (m), h 2 is the distance from the ground to the 
top of the radiator (m) and x is the distance between points 
X and Z (m). The value of the view factor F z passes through 
a maximum as * increases. 

The radiation at point Y is more difficult to determine, 
but an estimate may be made as follows. At this point part 
of the radiation comes from the thin part of the flame. In 
this case the area of the radiator ABEJ is approximated by 
% rl and the view factor F Y is given very approximately by 
the expression 

F y w [16.19.6] 


Table 16.70 Thermal radiation from a flame on a vent: 
comparison of predicted and observed radiation fluxes to 
side-on targets (Craven, 1976) (Courtesy of the Institution 
of Chemical Engineers) 


Distance ratio a 

Heat radiation flux (W/cm 2 ) 

Predicted* 

Observed* 

3.3 

9.0 

7.0 

6.67 

2.3 

2.8 

10 

1.0 

1.37 

13.3 

0.6 

0.8 

16.7 

0.4 

0.51 


a Ratio of the distance from the flame to the target to the flame 


b Predicted using the method of Craven (1972), as described in 
the text. 

0 Observed data given by R.O. Parker (1974). 

Sonju correlate the flame dimension in terms of the Froude 
number Fr. Their equations are 

j = A Fr” 1 [16.19.8] 

^ = BFr m [16.19.9] 




with 


y »10D max [16.19.7] 

where D max is the maximum cone diameter (m) andy is the 
horizontal distance to the axis of the flame (m). 

Craven points out that, whilst the above treatment 
applies to the highly turbulent flame occurring during the 
main discharge, a different situation occurs as this dis¬ 
charge subsides. In this stage there may exist for a short 
period a flame which is much less turbulent. Such a flame 
will tend to be larger but its temperature will be much less 
and the net effect is that the heat radiated is also less. 

He also draws attention to the strong forces which can be 
exerted by a jet reaction when material under pressure is 
vented, and to the possibility that if the vent supports are 
inadequate, the vent pipe, and hence the flame, may be 
deflected from the vertical. 

The method described is not intended to be used for 
flames on flare stacks, which are not highly turbulent and 
are therefore cooler. 

Craven (1976) has compared estimates made by his 
method with observations given by R.O. Parker (1974) 
based on the ignition of an accidental discharge of natural 
gas. The results of the comparison of predicted and 
observed thermal radiation fluxes to targets side-on to the 
turbulent flame brush are given in Table 16.70. 

The method given by Craven is essentially intended for 
design rather than for hazard assessment. In particular, 
the value assumed for the flame temperature is at the upper 
end of the range that is likely to occur in practice. 

16.19.7 Hustad and Sonju model 

Another jet flame model is that of Hustad and Sonju (Sonju 
and Hustad, 1984; Hustad and Sonju, 1986). Following ear¬ 
lier work by Suris, Flankin and Shoring (1977), Hustad and 


Fr=^- [16.19.10] 

gd 

where d is the diameter of the orifice (m), D is the diameter 
of the flame (m), g is the acceleration due to gravity (m/s 2 ), 
H is the height of the flame (m), u is the gas velocity at the 
nozzle exit (m/s), A and B are constants and m is an index. 

For vertical flames they obtained values of A of 21 for 
methane and 27 for propane, and values of B of 2.5 for 
methane and 4 for propane. For both gases the value of m in 
both equations was 0.2 for Fr < 10 5 , but zero for Fr > 10 5 . 
Thus for both gases the value of the ratio H/D was con¬ 
stant, being 8.4 for methane and 6.75 for propane. 

For horizontal flames of propane Equations 16.19.8 and 
16.19.9 again applied. For Equation 16.19.8 the values of the 
constant just given were again applicable, but for Equation 
16.19.9 the values of B and m were 10 and 0.156, respectively. 

The height H * over which the flame radiates heat is 
given as 

H* = H - h [16.19.11] 

with 

5 = C (i) 1 [16.19.12] 

where h is the lift-off height (m), H* is the flame radiation 
height (m) and Cis a constant. The value of the constant Cis 
3.6xHrV. 

For the fraction of heat radiated, Hustad and Sonju give 
F = 4.74Q -0 - 2 + 11.6Q 0 ' 4 1<Q<7 [16.19.13] 
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where F is the fraction of heat radiated and Q is the heat 
release rate (MW). 

Thus, for example, for propane at heat release rates of 1 
and 7 MW the fractions of heat radiated are 0.163 and 0.285, 
respectively; 

16.19.8 Chamberlain model and Johnson, Brightwell and 
Carsley model 

The flare models of Chamberlain (1987) and A.D. Johnson, 
Brightwell and Carsley, described in Section 16.18, also 
have application as models for a jet flame in an accident. 
The latter model is for a horizontal flame, which is the 
orientation of most interest in that context. 

16.19.9 Cook, Bahrami and Whitehouse model 

J. Cook, Bahrami and Whitehouse (1990) have described 
the jet flame models incorporated in the computer code 
SAFETI. There are two such models. 

The first model is described as based on the API RP 521 
jet flame model. The relations given are 

L = 0.00326[m(—Aff c )] 0 ' 478 [16.19.14] 

R s = 0.29s[log 10 (AA)] a5 [16.19.15] 

where ( -AH C ) is the heat of combustion (J/kg), L is the length 
of the flame (m), m is the mass flow (kg/s), R s is the radius of 
the flame at distance s (m) along the centre line (m). 

It is assumed that the jet is emitted either vertically 
upwards or horizontally downwind. For a vertical jet which 
may be bent over by the wind, the trajectory is constructed 
using the API prescription according to the equation 

11619161 

where Dj is the diameter of the jet (m), tq is the velocity of the 
jet (m/s), u w is the wind velocity (m/s) and x and z are the 
distances in the horizontal and vertical directions (m). Then 
the trajectory of the centre line of the jet flame is 

= m — l05 [ i6 - i9 - i7 i 

Jo l + (dz/cte) 2 ' 


16.19.10 Carter model 

A model for the thermal radiation incident on a target from 
a jet flame on a gas pipeline has been given by D.A. Carter 
(1991). 

The flame assumed is as shown in Figure 16.107. Its 
dimensions are based on its state 30 s after release. Carter 
states that the model of the flame itself is based on that of 
Chamerlain, but otherwise gives no details. 

The flame is treated as a multiple source radiator. 
For each source in the flame the relation for the thermal 
radiation is 


_ F r (-AH c )mx 
9 inx 1 


[16.19.19] 

[16.19.20] 


where F r is the fraction of heat radiated, (-A H c ) is the 
heat of combustion (kj/kg), m is the mass flow (kg/s), q is 
the heat incident on the target (kW/m 2 ), x is the distance 
from the source to the target (m) and x is the atmospheric 
transmissivity. 

The flame model is embodied in the computer code 
SHELF and the heat radiation model in the code MAJESTIC. 

As an illustration of the model, consider the example 
given by Carter. The problem is the determination of the 
heat radiation contours for a release of ethylene from a 9 in. 
pipeline at 100 bar with a mass flow of 43.7 kg/s. The flame 
length is 39 m and the flame tilt from vertical 11.5°. The heat 
of combustion is 4.771 x 10 4 kj/kg and the fraction of heat 
radiated is 0.1284. Then from Equation 16.19.19 the con¬ 
tours of incident heat are as shown in Figure 16.108. 


16.19.11 MITI model 

Turning now to models for jet flames of flashing liquids, an 
equation for the length of a diffusion flame on the surface of 
an oil storage tank as a function of the Froude number has 
been given by Werthenbach (1971a,b, 1973). This equation 
has been adapted by the MITI (1976) for the jet flame 
formed if liquefied flammable gas blows a bursting disc 
and then ignites: 


<*)-[ 7 - 

h l + (t 


[16.19.18] 


The other jet flame model used is the Chamberlain model. 


q = 0.0006785Z, 25 [16.19.21] 

where L is the flame length (m) and q is the fuel flow (kg/s). 
The use of this equation to correlate the length of ejected 
flames from fire engulfed vessels is discussed below. 



Figure 16.107 Jet flames: flame dimensions for the Carter model of gas pipeline release (D.A. Carter, 1991) 
(Courtesy of Butterworth-Heinemann) 
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H > 200 kW/m 2 
| | >14.7 kW/m 2 

> 6.3 kW/m 2 

Figure 16.108 Jet flames: heat radiation contours for illustrative example of flame from gas pipeline release 
(D.A. Carter, 1991). A > 200 kW/m 2 ; B> 14.7kW/m 2 and C > 6.3 kW/m 2 (Courtesy of Butterworth-Heinemann) 


16.19.12 Considine and Grint model 

Considine and Grint (1985) have derived a model for a jet 
flame based on the work of the MITI (1976) on liquid ethyl- 
ene.The flame is assumed to be conical. The model equa¬ 
tions are 

L m 9.1w 0 ' 5 [16.19.22] 

W = 0.25 L [16.19.23] 


length from the origin. For the thermal radiation the relation 
used is 


_ fH c mrx 10~ 3 

® 47a 2 

with 

tm 1 - 0.0565 In* 


[16.19.25] 

[16.19.26] 


where L is the length of the flame (m), m is the mass flow 
(kg/s), and JFis the half-width of the flame tip (m). 

This model also includes relations for the hazard range 
of the flame. These are given in Section 16.39. 


16.19.13 Clay et al. model 

Clay et d. (1988) describe a set of models used by the HSE for 
hazard assessment, one of which is for a jet flame of LPG. 
The flame length is given as 


p (H c m)°- m 
161.66 


[16.19.24] 


where F is the flame length (m), H c is the heat of combustion 
(J/kg) and m is the mass flow (kg/s). 

The flame is modelled as a point source radiator with 
heat radiated from a point located 4/5 of the flame 


where / is the fraction of heat radiated, q is the thermal 
radiation received by the target (kW/m 2 ), x is the distance 
between the source and the target (m) and t is the atmos¬ 
pheric transmissivity. 

Graphs for the flame length and thermal radiation from a 
jet flame of LPG are given by Grint (1989) and appear to 
give results similar to those obtained with this model. 

16.19.14 Modified Cook, Bahrami and Whitehouse model 

J. Cook, Bahrami and Whitehouse (1990) state that for jet 
flames from a liquid or from a two-phase liquid-vapour 
mixture Chamberlain’s model can be adapted by the fol¬ 
lowing modification of the effective source diameter: 

Pa 


[16.19.27] 
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and the lift-off distance b modified as follows: 
b = 0.015 L [16.19.28] 

where p v is the density of the vapour (kg/m 3 ). 

16.19.15 Tunc and Venart model 

The problem of heat radiation from a flame on a pressure 
relief valve on a rail tank car onto the surface of the latter 
has been studied by Tunc and Venart (1984/85b). Vertical 
and tilted flames are considered. The flame is modelled as 
a radiating surface rather than a point source. The view 
factor for a tilted flame is given. 

16.19.16 View factors 

In some applications it is sufficient to treat the jet flame as a 
point source radiator. In other cases it may be necessary to 
use a more accurate view factor. For a view factor based on 
the point source method use may be made of Equations 
16.13.101-16.13.103. 

View factors for some of the jet flame models just 
described have been given by Crocker and Napier (1988a). 
For the model by Hawthorne, Weddel and Hottel (1949) of a 
vertical flame, Crocker and Napier refer to the work of Tunc 
and Venart (1984/85b), who treat the flame as conical, and 
quote for the view factor F in this case the following inte¬ 
gral equations given by Becker (1980a): 

f = 2 [1619 29] 

nJh (x z +z 2 ) 

Horizontal target 

F = l [ h+L {x - n)r t [*snn/> + (ztang - r t )^i\ ^ 

nJb ( x 2 +z 2 ) 2 

Vertical target [16.19.30] 

where h is the height of the jet above the ground (including 
any lift-off), L is the visible length of the flame, (z) is the 
radius of the flame at height z, x is the distance between 
the axis of the jet and the target, z is the height of the 
flame differential element, a is the half-angle of the flame 
and i l/(z) is the angular position of the flame differential 
element. 

In the model of Chamberlain (1987) for a flare, the jet 
flame is treated as a frustrum with the widest end furthest 
from the jet exit, as shown in Figure 16.103. For this case 
Crocker and Napier give the following expressions by Croce 
and Mudan (1986), in which the flame is treated as equiva¬ 
lent to a cylinder with diameter D e and length L: 


equal to the angle a B as defined in Figure 16.103, although 
the two become the same for a vertical jet.The view factor for 
this equivalent tilted cylinder is then obtained using the 
standard view factors for a tilted cylinder, as described in 
Section 16.17. 

Crocker and Napier also give the results of a numerical 
investigation of the values of the radiation intensity on a 
target for a propane jet flame burning at a vent, as obtained 
for vertical and tilted flames using for the vertical flame 
the model of Hawthorne, Weddell and Hottel and the Becker 
relations, and for the tilted flame a point source treatment 
based on the model of Brzustowksi and Sommer, a multiple 
point source treatment based on the model of de Faveri et al. 
and the solid flame model of Chamberlain with the Croce 
and Mudan view factor. They select the latter as the pre¬ 
ferred model for a tilted flame. 

A treatment of the view factor for a jet flame is also given 
in the IP LPG Storage Code. To the extent that a jet flame 
may be characterized as a cylinder, view factors for cylin¬ 
ders may be used. The Code gives view factors for vertical 
and tilted cylinders with target levels above and below. 


16.19.17 Application of models 

The model of Hawthorne, Weddell and Hottel was used in 
some early work. For example, Gugan (1976), in a discus¬ 
sion of the release at Flixborough, expressed the view that 
whilst this model had not been verified for large-scale 
situations, there was no fundamental reason why it should 
not apply, and stated that use of the model to correlate 
incidents had not revealed any defect. 

The model of Considine and Grint of SRD has been 
widely used by the HSE and others in hazard assessment 
work. The model is given in the CCPS QRA Guidelines 
(1989/5). 

The Chamberlain model has been used by Shell for the 
study of possible impingement of jet flames from gas risers 

as described by Chamberlain (1989) at the Piper Alpha 
Inquiry. 

The IP LPG Storage Code recommends for a jet flame of 
LPG the use of the Brzustowski and Sommer point source 
model provided that: (a) the target is at least one flame 
length away; (b) the fraction of heat radiated is taken as 
0.38 for exit velocities up to Mach 0.5 and 0.22 up to Mach 
0.9; (c) allowance is made for attenuation due to atmos¬ 
pheric transmittance and (d) the code calculation methods 
are used. The flame length is taken as twice the distance 
from the flame centre to the point of discharge. 

For the case where the target is less than one flame length 
away, the Code refers to the treatment of Chamberlain, 
whilst stating that this is not universally accepted. 


=2- ’\if - (w 2 - wor 

Lev sin q B 

sin(90 - a B ) sin(180 - 8) 


[16.19.31] 

[16.19.32] 


where the notation is as defined in Subsection 16.18.6 and 
Figure 16.103, except thatZ, BV is the height of the centre of the 
flame tip above the level of the jet exit (m) and a B is the angle 
between the vertical and the line joining the jet exit and the 
centre of the flame tip (°). In general, the angle a B is not 


16.19.18 Enclosed jet flames 

The work just described relates to jet flames in the open. In 
some instances, a jet flame may occur within an enclosure. 
This case is of particular relevance to ignited releases in 
offshore modules. 

Work on this aspect has been described by Chamberlain 
(1994). The experiments were conducted in an enclosure 
8 m long x 3.54 m wide x 3.91 m high. The enclosure con¬ 
tained a cylindrical target 0.27 m in diameter, and thermo¬ 
couples, radiometers and total heat flux gauges were 
located on the target and the enclosure walls. Propane was 
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released both as a vapour, in the subsonic and sonic 
flow regimes, and as a liquid at a flow which averaged 
0.21-0.3 kg/s. Both vertical and horizontal nozzle orienta¬ 
tions were used. Some trials were conducted with full 
end wall opening and others with partial wall opening 
(2.5 m x 2 m); one trial condition involved a partially open 
roof. Measurements were also made of the composition, 
particularly the carbon monoxide concentration, of the 
combustion products and of the size of and thermal radia¬ 
tion from the external flame from the enclosure. 

The situation investigated is strongly similar to the 
compartment fires which have been much studied in work 
on fires in buildings, as described in Section 16.36. In the 
ventilation-controlled conditions which occur in a com¬ 
partment the hot combustion products flow out through the 
top of the aperture and cold air flows in through the bottom, 
with a relatively well-defined boundary between the two. 
This has led to the three zone model of a compartment fire, 
the three zones being the fire plume itself and the hot and 
cold gas zones. The air flow in such a fire is normally mod¬ 
elled in terms of the ventilation factor AH^ 2 , where A is the 
area of the ventilation opening (m 2 ) and H is its height (m). 

However, a jet flame in an enclosure differs from the pool 
fire case in at least two important respects. One is the much 
greater degree of mixing and the other the absence of 
‘flashover’. 

Some of the findings from these tests were as follows. 
For ventilation-controlled fires with vertical apertures it took 
about 10 min to reach steady-state conditions. The boundary 
between the hot and cold layers occurred about halfway up 
the opening. The gas temperature in the upper layer was 
remarkably uniform and could reach about 1200°C. 

In addition to the heat effects on the wall and the contents 
of the enclosure, other hazards are the thermal radiation 
from the external flame and the generation of smoke and 
carbon monoxide. 

In some tests using propane gas from a vertical nozzle 
the heat flux at the impingement area on the roof reached 
over 300 KW/m 2 , rising to this value as radiation from the 
walls came into play. 

For the external flame the maximum vertical and hori¬ 
zontal extents measured were 6 and 3 m, respectively, for a 


trial using liquid propane, though two trials using propane 
gas gave comparable values of 5 and 3 m, respectively; 
there was no external flame in the two trials with full wall 
opening. 

It is the flame stoichiometry which governs the produc¬ 
tion of soot and carbon monoxide. This stoichiometry is 
a function of the fuel flow, the jet momentum and the 
vent opening. The experiments showed that the parameter 
0.5AH 1/2 tends to give an overestimate of the air flow. 
The author advises against its use for the determination of 
flame stoichiometry. 

Jet flames which were fuel rich gave much higher yields 
of soot and of carbon monoxide and larger external flames. 

When ventilation-controlled, roof ventilated jet flames 
were found to be unstable and to self-extinguish.With this 
geometry a stable two-way flow of air and combustion 
products is not established. 

16.20 Engulfing Fires 

The engulfment of vessels in fire may occur in various 
ways and the problem has been studied from several dif¬ 
ferent angles. Important distinctions relate to the container, 
which may be a fixed tank or vessel or pipework or a 
transport container, and to the fire, which may be a pool fire 
or a directed flame. 

There have been a number of experiments on rail tank 
cars and on fixed storage vessels engulfed in fire, and 
various models have been developed for heat transfer to 
such vessels, for the response of the temperatures and 
pressures in the vessel, for pressure relief of the vessel and 
for bursting of the vessel. Some studies of engulfing fires 
are given in Table 16.71. 

16.20.1 Fleat absorbed 

Relations for the heat absorbed by a vessel from a pool fire 
are given in API RP 520: 1976 Recommended Practice for 
Design and Installation of Pressure Relieving Systems in 
Refineries and API Std 2000:1982 Venting Atmospheric and 
Low-pressure Storage Tanks. It is convenient to consider 
first the relationships given in these publications and then 
the subsequent changes. 


Table 16.71 Some studies of engulfing fires 


Derivation of formulae for heat absorbed by a vessel exposed to fire 

Experiment on fire engulfment of a full-scale rail tank car vessel 
containing LPG 

Discussion of heat absorbed in fire engulfment 

Experiments on fire engulfment of 1/5 scale rail tank car vessels 
containing LPG 

Experiments on fire engulfment of small- and full-scale vessels 
containing LPG 

Theoretical studies of temperatures and pressures in vessels and pipes 
containing gas or liquid engulfed by fire 

Theoretical studies of temperatures and pressures in a vessel filled with 
gas engulfed by fire 

Theoretical models for heat transfer from pool fires and jet fires 
(relief valve flare) to a horizontal cylinder 

Theoretical model of temperatures and pressures in a vessel containing 
liquid engulfed by fire 


API RP 520:1976; 

API Std 2000:1982 

C. Anderson etal. (1974); 

Charles (1974) 

Craven (1976) 

Appleyard (1980) 

A.F. Roberts, Cutler and 
Billinge (1983); Moodie, 
Billinge and Cutler (1985) 
Solberg and Borgnes (1983) 

Nylund (1984) 

Tunc and Venart (1984/85a,b) 

D. L.M. Hunt and Ramskill (1985) 
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The two documents mentioned give for the heat absor¬ 
bed by the wetted surface area expressions of the engulfing 
general form 

Q = kA n [16.20.1] 

whereA is the wetted surface area, Q is the heat absorbed, k 
is a constant and n is an index. 

For the estimation of the heat absorbed for purposes of 
determining relief requirements, API RP 520 gives the 
equation 

Q = 21,000 FA™ 2 [16.20.2] 

where A is the wetted area (ft 2 ), F is an environment factor 
and Q is the heat absorbed (BTU/h). 

API RP 520 contains an appendix (Appendix A) in which 
theoriginofEquationl6.20.2isexplained.Itisbasedontests 
carried out in 1925 by Standard Oil of California. The tests 
were conducted on a small tank and were intended to give 
guidance on relief sizing for tank trucks.The tests indicated 
the maximum heat absorption rate to be expected in the 
worst case. There were also available data on cases where 
tanks had survived fire exposures. The available data were 
plotted by Stroop on log-log paper as a curve. This curve 
was intended to give guidance for small tanks and, by 
extrapolation, for tanks with wetted areas up to 10,000 ft 2 . It 
was subsequently observed by Maker that the data could be 
represented by a straight line and he proposed the equation 

q = 48,000 A” 1 / 3 [16.20.3] 

where q is the heat absorbed per unit area (BTU/h ft 2 ) and 
A is the wetted area (ft 2 ). Equation 16.20.3 became known 
as the Stroop-Maker formula and was applied not only to 
atmospheric storage tanks but also to pressure vessels. 

Another set of equations developed during the Second 
World War are the formulae of the Petroleum Administra¬ 
tion for War (PAW). These are 

q = 16,000 A -018 [16.20.4] 

Q= 16,000 A 082 [16.20.5] 

The Stroop—Maker and PAW formula have been widely 
used in the petroleum industry. 

API RP 520 gives a plot comparing the PAW and API 
fonnulae given here as Equations 16.20.2 and 16.20.5, 


respectively, with various additional data points obtained 
from tests carried out during the period 1925-1950. Some 
of the tests represent the worst conditions likely to occur, 
since they were delayed until calm conditions prevailed and 
plentiful fuel supplies were used. 

API Std 2000 quotes Equation 16.20.2 for use in deter¬ 
mining the venting requirements of atmospheric and low 
Pressure storage tanks for wetted areas greater than 
2800 ft 2 . It also gives tables for determining the venting 
requirements for wetted areas less than this. It is explained 
in an appendix (Appendix B) that the tables are based on 
the following equations: 

Q = 20,000 A 20 < A < 200 [16.20.6a] 

Q = 199,300 A 0566 200 < A < 1000 [16.20.6b] 

Q = 963,400 A 0338 1000<A<2800 [16.20.6c] 

The method used in earlier versions of API Std 2000 
was to assume a constant value of heat absorbed (q = 6000 
BTU/h ft 2 ), but tests conducted in 1961 on a horizontal tank 
led to a revision and development of the equations just 
quoted. 

A discussion of the heat absorbed by a vessel in an 
engulfing fire has been given by Craven (1976). He suggests 
that if a well-developed fire radiates heat at a given rate, 
then it could be argued that an object engulfed in a fire 
should receive heat at the same rate, since the view 
factor is unity. A large fire can radiate heat at a rate of some 
17 W/cm 2 (170 kW/m 2 ). In tests on small tanks the heat 
input rates recorded are, on average, about 11 W/cm 2 (110 
kW/m 2 ), while for large tanks they rarely exceed 7 W/cm 2 
(70 kW/m 2 ). The exponents in Equations 16.20.1, as given 
inTable 16.72, reflect this falling off in heat absorption with 
size. Craven argues, however, that there is no theoretical 
justification for an exponent less than unity and that in 
certain circumstances a vessel might receive a heat input 
nearer 17 W/cm 2 (170 kW/m 2 ). For the latter case he gives 
the equation 

Q = 54,000 A [16.20.7] 

where A is the wetted area (ft 2 ) and Q is the heat absorbed 
(BTU/h). 

Figure 16.109 (Crawley and Scott, 1984) shows a com¬ 
parison of the PAW and API formulae and some of the data 
points given in API RP 520. 


Table 16.72 Parameters for use in the equations given in API RP 520 and API Std 2000 for the heat absorbed 
in fire engulfment 



Wetted ai 

-ea.A 

Heat absorbed, Q 

Conditions 

(ft 2 ) 

(m 2 ) 

(BTU/h) 

(kW) 

API RP 520:1990 



21,000 A 082 

43.1 A a8Z 





34,500 A 0 ' 82 

70.8 A 082 

_ b 

API Std 2000:1992 

20-200 

1.86-18.6 

20,000 A 

6.31 A 



200-1000 

18.6-92.9 

199,300 A 0566 

224.1 A 0 ' 566 



1000-2800 

92.9-260 

963,400 A 0338 

632.0 A 0 ' 338 



>2800 

>260 

21,000 A 082 

43.1 A 0 - 82 



a Drainage and fire fighting equipment adequate. 
b Drainage and fire fighting equipment inadequate 
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Wetted surface area, A (ft 2 ) 


Figure 16.109 Comparison of the equations given by the API for the heat absorbed by a tank or vessel in a fire 
(Crawley and Scott, 1984) (Courtesy of the Institution of Chemical Engineers) 


The history of the API RP 520 treatment of heat absorp¬ 
tion is discussed by Heller (1983). 

API RP 520: Part 1: 1990 gives in Appendix D two 
equations for the heat absorbed, which differ in that they 
are based on the adequacy of drainage and fire protection. 
The first is Equation 16.20.2 and the second the equation 

Q = 34,500 FA 082 [16.20.8] 

Equation 16.20.2 is to be applied where adequate drainage 
and fire-fighting equipment exist and Equation 16.20.8 
where they do not. 

The API recommendations are therefore as follows. 
API RP 520:1990 and API Std 2000:1992 recommend the use 
of Equation 16.20.1 with the constants shown in Table 16.72. 

It should be borne in mind that the API RP 520 equations 
are given for the purpose of plant design rather than 
hazard assessment. 

Further information on the heat absorbed is given below 
in relation to particular studies of engulfing fires. 

16.20.2 General studies of engulfing fires 

A series of theoretical studies of the effect of engulfing 
fires on vessels and pipework with and without insulation 
has been carried out by Borgnes, Solberg and coworkers, as 
reported by Solberg and Borgnes (1983). The work was 
done using the Det norske Veritas (DnV)computer program 
NV613 for the determination of temperature profiles. 

The heat absorbed in an engulfing fire is not well 
defined, but at the flame surface a heat flux of about 
150kW/m 2 seems to be a reasonable value. Inside the 
flame the heat flux would be higher; how much higher is 
uncertain, but perhaps by some 50—100 kW/m 2 . There is 
also a convective heat flux. For pool fires a heat flux of 
30-40 kW/m 2 is a conservative estimate, but for jet fires it 
may be appreciably higher. The approach taken is therefore 


as follows. Heat transfer is assumed to be by radiation only, 
with the object engulfed in the flame so that the view factor 
is unity. The flame temperature of the engulfing fire is 
assumed to be 1525 K with the flame emissivity and target 
absorbtivity both taken as unity. The justification for the 
latter is that in such a fire the metal would soon be covered 
with a deposit of carbon. For an object at an initial tem¬ 
perature of 400 K the initial heat flux under these condi¬ 
tions is 310 kW/m 2 . 

The temperature at which steel suffers serious loss of 
strength, or the critical steel temperature, is taken as 675 K. 

The base case is a considered 2 m diameter vessel with 
20 mm wall thickness and 50 mm mineral wool insulation, 
containing gaseous propane at an initial temperature of 
400 K and at pressures of 5, 20 and 80 bar. Figure 16.110(a) 
shows the wall temperatures attained for different gas 
pressures after different time periods. For an uninsulated 
vessel the critical steel temperature is reached within a few 
minutes. For an insulated vessel at 5 bar pressure the time 
to critical steel temperature is less than 1.5 h, while for one 
at 80 bar pressure the steel reaches a temperature of 610 K 
after 2 h. 

Figure 16.110(b) shows, for a 0.2 m diameter uninsulated 
pipe, the times to different wall temperatures/or stagnant 
and flowing methane gas at 5 and 80 bar pressure. Figure 
16.110(c) shows, for uninsulated and insulated pipe of the 
same diameter, the wall temperature response for stagnant 
and flowing liquid methane at an initial temperature of 110 K. 

Figure 16.110(d) shows the wall temperature and gas 
pressure responses for 2 and 10 m uninsulated horizontal 
vessels partly filled with liquid propane, with fill ratios of 
0.625 and 0.88. Figure 16.110(e) shows the correspond¬ 
ing responses for insulated vessels. For the latter case the 
temperature profile in the vessel wall is shown in Figure 
16.110(f). This very steep temperature gradient may give 
rise to severe stresses in the vessel shell. 
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The authors also describe work on other aspects, such as 
the effect of defects in the insulation and unevenness in 
water sprays. 

16.20.3 Vessels filled with gas 

A theoretical study of the effect of an engulfing fire on a 
vessel filled with methane has been made by Nylund (1984). 

The vessel considered was 13 m long x 3 m diameter with 
a wall thickness of 53 mm, a working temperature of 300 k 
and a pressure of 8.2 MPa. 

Pool and jet fires were investigated. The flame tempera¬ 
ture for both fires was assumed to be 1500 k. The convective 
heat transfer coefficient was taken as 28 W/m 2 K for the 
pool fire and as 250 W/m 2 K for the jet fire. A model is given 
for vessel rupture as a function of vessel temperature and 
pressure and wall thickness. 

Some of the results obtained by Nylund are shown in 
Figue 16.111. Figure 16.111(a) shows the time response of 
the gas temperature, the gas pressure and the rupture 
pressure for a jet fire, for a jet with an effective diameter of 
1 m. The rupture pressure does not fall below the gas pres¬ 
sure. Figure 16.111(b) shows the response for a jet fire with a 
jet having an effective diameter of 4 m. In this case the 
rupture pressure does fall below the gas pressure, so the 
vessel would rupture. Rupture is predicted for jet fires with 
jets having an effective diameter of 2, 3 and 4 m for which 
the pressure crossovers occur at about 7.5, 7 and 5 min 
respectively. Figure 16.111(c) shows the response for a pool 
fire. In this case not only does the rupture pressure fall, but 


the gas pressure rises appreciably so that rupture occurs in 
somewhat less than 5 min. 

Nylund also discusses pressure relief and depressuriza¬ 
tion. In both types of fire rupture can occur within 5 min. 
For neither type does a pressure relief valve provide real 
protection. In the case of the jet fire the rupture occurs at 
gas pressures well below the relief valve set pressure. In the 
pool fire case the gas pressure does reach the set pressure, 
but the relief valve capacity is insufficient to vent the 
pressure quickly enough. 

Depressurization is capable of providing protection. 
Figure 16.111(d) illustrates a successful depressurization. 

16.20.4 Vessels part filled with liquid 

There have been several experimental investigations of the 
response of vessels containing liquefied flammable gas to 
an engulfing fire. 

A test on fire engulfment of a 64 te LPG rail tank car has 
been described by C. Anderson et al. (1974) and Charles 
(1974). Measurements were made of the heat flux from the 
fire, of the vessel wall temperatures in the liquid and 
vapour spaces and the relief valve flare. The relief valve 
opened at 1.96 MPa and remained open. The vessel rup¬ 
tured after some 24.5 min, propelling 63 fragments, some 
for considerable distances. The pressure at failure was 
24.1 bar and the wall temperature near the point where 
failure occurred had a maximum value of 650°C. The tem¬ 
peratures of and heat fluxes from the pool fire and the relief 
valve torch are given in Table 16.73. 


Pipe diameter 0.2 m, initial 
temperature 400 K, gas 

Steel vessel diameter 2 m velocit V < for ,lowin 9 9 as > 10 m/s 



(a) (b) 

Figure 16.110 Theoretical predictions of the temperatures and pressures in vessels and pipes containing gas and 
liquids engulfed in a fire (after Solberg and Borgnes, 1983). (a) temperature rise of the outside of the vessel wall for vessel 
filled with propane gas; (b) temperature rise of the pipe wall (uninsulated) for pipe filled with stagnant and flowing methane 
gas; (c) temperature rise of the pipe wall (uninsulated and insulated) for pipe filled with stagnant and flowing liquid 
methane; (d) maximum outside vessel wasll temperature and pressure in uninsulated vessel for vessel partly filled with 
liquid propane; (e) maximum vessel wall temperature and pressure in insulated vessel partly filled with liquid propane; 
(f) temperature profile of insulated vessel wall for vessel partly filled with liquid propane. (Courtesy of the American 
Institute of Chemical Engineers) 
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Pipe diameter 2 m 

Initial temperature 400 K 

Insulation: 25 mm cementitious mixture 


Filling ratic 

1 0.625 

2 0.625 

3 0.880 
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Figure 16.110 continued 
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Pi = vessel pressure at rupture 
Prv = vessel pressure at relief 
p, = vessel pressure 
Pvd = vessel pressure at depressuring 
T g = gas temperature 



Figure 16.111 Theoretical predictions of the temperatures and pressures in vessels filled with gas 
(after Nylund, 1984): (a) impingement of jet flame-1 m diameter; (b) impingement of jet flame 4 m diameter; 
(c) engulfing fire; (d) engulfing fire with depressurization (Courtesy of the Institution of Chemical Engineers) 


A series of tests on vessels for rail tank cars have been 
carried out at 1/5 scale by Appleyard (1980). One objective 
of these tests was to investigate the effectiveness of the 
internal thermal radiation protection Explosive. 

These and other tests have been reviewed by Tunc and 
Venart (1984/85b) and by Moodie, Billinge and Cutler (1985). 

Models for radiant heat transfer to a horizontal cylind¬ 
rical vessel from (1) an engulfing fire and (2) a relief valve 
flare have been given by Tine and Venart (1984/85a,b). 
Large-scale tests on the effect of fire around a liquid 
orage vessel have been carried out as part of the 
ts by the MITI (1976) described earlier. 

;e vessel with vacuum perlite insula- 
n diameter bursting disc and con- 
juid ethylene was subjected to a flame 
in with the water sprays on and 


tion fitted, with a 25 cm 
taining 718.5 kg of liquid 
from LPG burners for 15 


then for 15 min with the sprays off. The total quantity of 
LPG consumed in the fire was 80 kg and the total heat 
released was estimated as 960,000 kcal.The pressure in the 
vapour space in the vessel remained at about 1.0 kg/cm 2 g 
throughout the test. 

In another test the insulating vacuum of the vessel was 
broken and part of the perlite at the base of the vessel was 
removed. The vessel was subjected to a pool fire of kerosene 
which engulfed it. The water spray was not used on the 
vessel. The total quantity of heat released by the kerosene 
fire was estimated as 34,496,000 kcal. The bursting disc 
blew when the vapour pressure reached 8.3 kg/cm 2 g, 
which occurred 34 min after ignition. 

When the disc blew, some 620 kg of ethylene was ejected as 
a vapour-liquid mixture within about 6.5 s. The material 
ignited and gave a large flame which lasted about 8-9 s and 
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Table 16.73 Temperatures and heat fluxes in a full scale fire engulfment test on a rail tank car (Tunc and Venart, 1984/ 
85b; after Charles, 1974)(Courtesy of the Fire Safety Journal) 


Time (min) 

Recorded heat flux 
(kW/m 2 ) 

Temperature (°C) 

Heat flux (kW/m 2 ) 


Fire 

Torch 

Fire 

Torch 

5.0-11.5 

90.12 

871 

1120 

60.28 

171.8 

11.5-15.0 

68.7 

816 

1040 

49.4 

134.28 

15.0-24.5 

29.65 

802 

1090 

46.94 

159.22 

Maximum 
reading (6.5 min) 

104.8 

871 

1180 

60.28 

203.4 


was about 100 m long. The actual length of the flame agreed 
well with the value of 105 m calculated from Equation 
16.19.21 assuming that 620 kg was released over 8 s. 

Part of the flame formed a fireball. The diameter and 
duration of the fireball were calculated from the NASA 
formula (Equations 16.16.5 and 16.16.7). The total mass of 
the combustion reactants was taken to include the air 
required Jor combustion, so that 28 kg of ethylene require 
96 kg of oxygen, making a total mass of 124 kg. The 
observed fireball had a diameter of 40 m and persisted for 
about 3 s. According to Equations 16.16.5 and 16.16.7 this 
corresponds to about 324 kg of ethylene. Thus on the basis 
of this calculation about half the mass of ethylene ejected 
was involved in the fireball. 

Two series of tests on horizontal cylindrical vessels 
partly filled with liquid and engulfed in a pit fire have been 
carried out by the HSE. In the first series, described by 
A.F. Roberts, Cutler and Billinge (1983), 5001 vessels were 
used. A preliminary set of tests was done with vessels con¬ 
taining water; the main tests were then done with LPG. 

In the tests using water the vapour space heated up 
rapidly and caused boiling at the water surface at 4 min. 
The bulk water began to boil after 8 min. Between 4 and 
8 min the boiling reduced the temperature of the vapour but 
not that of the wall in the vapour space. After 8 min it 
reduced both these temperatures. 

The heat balance on the wall was expressed as 

pcd ^ = Q-eoTf- <rF7f [16.20.9] 

where the second and third terms on the right-hand side 
represent the heat radiated externally and that radiated 
internally, respectively. The equation is solved to give 



where c is the specific heat of the wall metal, d is the thick¬ 
ness of the metal wall, F is a factor (explained below), Q is 
the heat absorbed per unit area, T A is the asymptotic value 


of Ti, T 0 is the initial value of the wall temperature, 7i is the 
value of the wall temperature at time t, e is the emissivity of 
the external surface of the wall, p is the density of the metal 
and <j is the Stefan-Boltzmann constant. The factor F 
includes the emissivity of the internal surface of the wall, 
the absorptivity of the water surface and the view factor 
from the wall to the water surface. 

Equation 16.20.10 was used to obtain estimates of the 
heat absorbed Q and of the factor F from the wall tempera¬ 
ture data. The heat absorbed was estimated to have an 
average value of 134 kW/m 2 and the factor F a value of 
0.055, which is consistent with a wall emissivity of unity, a 
water surface absorptivity of 0.09 and the view factor of 
2/7t.The estimated average flame temperature was 1100°C. 

The calculated equilibrium conditions for the unwetted 
upper part of the vessel were a wall temperature of 950°C, 
a total heat transfer from the fire of 134 kW/m 2 , re-radiation 
from the vessel to the atmosphere of 127 kW/m 2 and internal 
radiation to the liquid layer 7 kw/m 2 . For the wetted lower 
part of the vessel the total heat transfer was estimated as 
124 kW/m 2 , giving an overall average heat flux of 13 0 kW/ m 2 . 

The main set of ten trials were then conducted using 
propane, one with an uninsulated vessel and nine with 
insulated vessels. A feature of these trials was the beha¬ 
viour of the pressure relief valves. The valves were set to 
open at 1.7 MPa, but in fact opened at pressures in the range 
0.7—1.8 MPa, due probably either to weakening of the 
spring or damage to the valve seat from the effects of the fire. 

In the water tests the boiling regime was nucleate boil¬ 
ing. In the propane tests the regime was film boiling in most 
cases, although nucleate boiling did occur. Figure 16.112(a) 
illustrates film boiling in which the wall temperature in 
the liquid space is close to that in the vapour space, while 
Figure 16.112(b) shows nucleate boiling when the liquid 
space wall temperature is much lower. The occurrence of 
film boiling, and the associated poor heat transfer, there¬ 
fore renders the walls vulnerable to thermal weakening. 

In the second series of fire engulfment tests by the HSE, 
described by Moodie, Billinge and Cutler (1985) the tanks 
used were 1/4 and 1 the uninsulated vessels part filled with 
propane. Five tests were carried out, two with 1/4 te vessels 
and three with 1 te vessels. In one of the former tests the 
pressure relief valve failed, so that there were four suc¬ 
cessful tests. Plate 13 shows a test in which the pressure 
relief valve is operating, giving a large jet flame. 

The vessels were instrumented for the measurement of 
temperatures in the tank wall, the vapour space and the 
liquid, as shown in Figure 16.113. 

In these larger-scale tests the fire was deficient in oxygen 
and gave a yellow, smoky flame. The flame temperatures 
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Figure 16.112 Temperatures in a 5001 vessel part filled with propane engulfed in fire (A.F. Roberts, Cutlerand Billinge, 
1983): (a) typical film boiling; (b) typical nucleate boiling (Courtesy of the Institution of Chemical Engineers) 




were900—950°C withamaximum of 1000°C.The maximum 
wall temperatures recorded were in the range 600-800°C, 
which is consistent with a flame emissivity of 0.56. 

The experimental conditions and heat fluxes are sum¬ 
marized in Table 16.74. 

Thus in the successful 1/4 te tank test the average heat 
flux before venting into the propane was estimated as 
73 kW/m 2 and that into the tank wall as 24 kW/m 2 giving a 
total of 97 kW/m 2 . During venting the heat flux into the 
propane was 80 kW/m 2 . 

The four successful tests, one with the 1/4 te tank and 
three with the 1 te tank, showed a similar pattern. The wall 
temperature of the vapour space rose almost linearly, while 
the wall temperature of the liquid space rose to a plateau, 
levelled out and then rose again. When the pressure relief 
valve opened giving a nearly constant pressure the liquid 
wall temperature settled just above the corresponding 
boiling point, until the wall became exposed due to evapo¬ 
ration of the liquid. Figure 16.114(a) shows for the success¬ 
ful 1/4 te test the temperatures of the walls in the liquid an 


vapour spaces and Figure 16.114(b) shows the temperatures 
of the vapour and liquid. 

The behaviour of the wall temperature in the liquid space 
in these tests points to nucleate rather than film boiling, 
and estimates of the heat flux indicate that the high heat 
fluxes necessary for film boiling did not occur. 

In all the successful tests the internal pressure rose to the 
relief valve set pressure within 3—5 min. The relief valves 
cycled at least twice, then remained open venting the 
pressure down eventually to atmospheric pressure. This 
behaviour was attributed to weakening of the springs or 
damage to the seats due to the fire. Although the vessel 
walls would be weakened by the high temperatures 
experienced, at no time did the internal pressure have a 
value which would have been likely to cause rupture. 

One of the tests on the 1/4 te tank with 40% fill was 
unsuccessful in that the relief valve, after opening cor¬ 
rectly, failed to do so subsequently. The vessel ruptured at 
an internal pressure of 35 bar and maximum wall tem¬ 
perature of 600°C. 
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Figure 16.113 Temperature measurement arrangements in fire engulfment tests on % and 1 te vessels part filled 
with propane (Moodie, Billinge and Cutler, 1985); (a) positions of the wall thermocouples; (b) positions of the internal 
thermocouples (Courtesy of the Institution Engineers). 


Table 16.74 Experimental conditions and heat fluxes in fire engulfment tests on vessels containing propane (after 
Moodie, Billinge and Cutler, 1985) (Courtesy of the Institution of Chemical Engineers) 


Test 


Tank si, 

je (te) 



1/4 

1/4 

1 

1 

Degree of fill (%) 

40 

80 

40 

20 

Mass of liquid (kg) 

100 

870 

420 

160 

Volume of liquid (m 3 ) 

185 

1635 

789 

308 

Tank pressure (bar) 

5.5 

6.1 

4.1 

4.1 

Ambient temperature (°C) 

5 

14 

-3 

-3 

Surface areas (m ): 

Total 

3.8 

10.4 

10.4 

10.4 

Wetted 

1.68 

6.28 

4.32 

3.02 

Average heat flux (kW/nr): 

To propane before venting 

73 

84 

59 

33 

To walls before venting 

24 

34 

16 

28 

To propane during early stages of venting 

85 

50 

54 

76 


Metallurgical examination revealed no indication of 
failure due to cracks and was consistent with failure by 
hoop stress in the wall. The authors suggest that the burst 
pressure may therefore be calculated from thick-walled 
cylinder theory and give the equation 

P b = ^rr y A\nK [16.20.12] 


with 

A = 2- a u /ff y 0< T <700 [16.20.13a] 

A » 1 T > 700 [16.20.13b] 

where if is the ratio of the outside to the inside diameter, P h 
is the burst pressure, T is the metal temperature (°C), a u is 
the ultimate tensile strength and rr y is the yield strength, 
both as measured at temperature T. 
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(a) 



Figure 16.114 Temperatures in the % te vessel part filled with propane engulfed in fire (Moodie, Billinge and Cutler, 
1985): (a) temperatures of walls in liquid and vapour spaces; (b) temperatures of vapour and liquid (Courtesy of the 
Institution of Chemical Engineers) 
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If the wall temperature in this test is taken as 600°C, the 
burst pressure calculated by Equation 16.20.12 is 38 bar, which 
is within 8% of the observed value. Moreover, application of 
Equation 16.20.12 to data given by C. Anderson etal. (1974) and 
Drosteefa/.(1984)predictsalltheburstpressureswithanerror 
of less than 18%. The authors also discuss the implications 
of the work for the pressure relief of vessels engulfed in fire. 

In association with these tests a theoretical model for the 
behaviour of a vessel engulfed in fire has been developed by 
D.L.M. Hunt and Ramskill (1985). Figure 16.115 shows the 
heat flows taken into account in the model. 


Some predictions given by the model for one of the 5001 
vessels in the first HSE series of tests are compared with 
the observed values in Figure 16.116. Figure 16.111(a) shows 
the wall temperatures of the vapour and liquid spaces and 
Figures 16.116(b) and (c) the temperatures of the vapour 
and liquid, respectively. 

16.20.5 Jet flame attack 

There is relatively little available data on the effect on 
equipment of jet flame attack, as opposed to pool fire 
engulfment, but the EC currently has in hand a major 
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-- Conduction heat transfer term 

-— Convection heat transfer term 
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(b) 

Figure 16.115 Heat flows in the theoretical model of heat transfer in a vessel engulfed in fire (D.L.M Hunt and Ramskill, 
1985): (a) the tank node scheme; (b) heat transfer within the tank (Courtesy of the Institution of Chemical Engineers) 
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Figure 16.116 Theoretical predictions of the temperatures in a 5001 vessel part filled with propane engulfed in fire 
(DLM. Hunt and Ramskill, 1985): (a) Outer wall (vapour space) temperature; (b) vapour temperature; 

(c) liquid temperature (Courtesy of the Institution of Chemical Engineers) 
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programme of work on this, an account of which is given by 
Duijm (1994). The objectives of the programme are (1) the 
modelling of unobstructed jet fires, (2) the modelling of 
obstructed jet fires, (3) the modelling of the thermal 
response of pressure vessels, (4) the assessment of mitiga¬ 
tion techniques and (5) the modelling of the failure modes 
of the pressure vessels. 

For unobstructed single-phase jet flames the work 
involves the development of the models incorporated in the 
UMPFIRE and TORCIA codes, as described by Crespo etal. 
(1991) and Bennett et al. (1991), with extension of the treat¬ 
ment to two-phase jet flames. For obstructed jet flames a 
distinction is made between small targets engulfed by the 
flame and large targets. For the latter the heat flux dis¬ 
tribution can be very non-uniform and can thus create 
thermal stresses. The heat fluxes shown in the figures 
given by Duijm vary between 40 and 300 kW/m 2 . Techni¬ 
ques such as CFD (Hernandez and Crespo, 1992) and wind 
tunnel tests (Verheij and Duijm, 1991) are used to model the 
heat transfer. The principal mitigation techniques investi¬ 
gated are insulation and water sprays. 

The cooling of vessels subject to an impinging jet flame 
is considered in Section 16.27. 


16.21 Effects of Fire: Damage 

Fire causes damage to property and injury to people. The 
statistics of fire damage and injury have been considered in 
Chapter 2. The modelling of fire damage is treated in this 
section and that of fire injury in the following one. 

Broadly, fire may be treated terms of ignition, steady- 
and unsteady-state combustion, an extinction, and of flame 
spread, both over surfaces and within buildings. An 
account of these aspects is given in An Introduction of Fire 
Dynamics (Drysdale, 1985). 

In this section the treatment is confined to (1) the ignition 
of liquids, (2) the ignition of wood and (3) the spread of 
flame. 

16.21.1 Ignition of liquids 

The susceptibility of a flammable liquid to ignition is 
related to the flashpoint. For high flashpoint liquids, the 
firepoint is also relevant. The flashpoint and firepoint of 
a liquid, and the methods of determination, have been dis¬ 
cussed in Section 16.2. The firepoint is the temperature at 
which the liquid not just ignites but also supports a flame 
and it is therefore a higher temperature than the flashpoint. 
Essentially, the flashpoint may be obtained by experiment 
using closed cup or open cup methods, or by calculation as 
the temperature at which the vapour pressure reaches the 
lower flammability limit. Data on the flashpoint are avail¬ 
able for a large number of substances. The firepoint is 
determined experimentally. Information on the firepoint of 
liquids is relatively sparse. 

It was found in the work of A.F. Roberts and Quince 
(1973) that for a flame to be sustained on the surface of the 
liquid, it is necessary for the vapour concentration to be 
above the stoichiometric value. An apparent exception is 
alcohols for which the flashpoint and firepoint measured 
using spark ignition are the same. The maintenance of the 
flame on a liquid surface has been interpreted by Rasbash 
(1975b) in terms of the flame heat balance. 

Traditionally, a liquid has been classed as highly flam¬ 
mable if it has a low flashpoint. Essentially the criterion 
value used in a particular country reflects the summer 


temperatures in that country. In the United Kingdom, the 
value taken has been a temperature of less than 32°C as 
measured by the Abel closed cup test. For a low flashpoint 
liquid the hazard is that a flammable mixture will form 
above the liquid surface and will be ignited. 

If the temperature of the liquid is high enough a vapour 
cloud may form. The evaporation and dispersion of such a 
cloud has been dealt with in Chapter 15. Vapour cloud fires 
have been considered in Section 16.14. 

For a high flashpoint liquid to be ignited it must he 
heated above its firepoint. This may occur due to the play of 
a flame on the surface of the liquid. It has been shown by 
Sirignano and Glassman (1970) that if such flame impinge¬ 
ment occurs, a surface tension effect occurs and convection 
currents are set up which have the effect of cooling the volume 
of liquid which is being heated.The liquid pool will eventually 
ignite but, as shown by Burgoyne and Roberts (1968a), only 
after the transfer of a substantial amount of heat. 

Ignition of a high flashpoint liquid occurs much more 
readily, however, if there exists at the surface of the liquid a 
wick. This may take the form of a porous material such as a 
cloth. The liquid layer held in such a wick is too thin for the 
heat to dissipate and there is a rapid increase in the local 
temperature. The effect has been studied by Burgoyne, 
Roberts and Quinton (1968). 

16.21.2 Ignition of solids 

In the ignition of combustible solids it is usual to distin¬ 
guish between (1) spontaneous, or unpiloted, ignition and 
(2) piloted ignition. With spontaneous ignition, also termed 
unpiloted ignition or autoignition, ignition occurs when 
the material has been heated up to the point where not only 
does it evolve vapours of volatile material but it is not 
enough to ignite these vapours. With piloted ignition, by 
contrast, ignition of these vapours is by the pilot flame. 

A further distinction may be made between the case 
where the pilot flame actually impinges on the surface of 
the solid and that where it does not. Simms (1962) refers to 
these situations as (1) piloted ignition (in the more restric¬ 
ted sense) and (2) surface ignition. This terminology is 
adopted here. 

In this section consideration is restricted to the ignition 
of wood. This is the solid combustible material principally 
studied and it is also that of prime interest on process 
plants. 

16.21.3 Ignition of wood 

A classic study of the ignition of wood by thermal radiation 
is that described by Lawson and Simms (1952a,b), who 
subjected samples of dry wood to thermal radiation from a 
heated panel, with and without a pilot flame playing half an 
inch from the surface of the sample. 

They first obtained for various kinds of wood critical 
values I„ of the thermal radiation intensity I below which 
ignition does not occur even at long exposure times. The 
woods used included oak, mahogany, red cedar and white- 
wood. For the minimum thermal radiation intensity for 
spontaneous ignition I s they obtained the range of values 
0.57-0.66 cal/cm z s with an average of about 0.62 cal/cm z s, 
and for the minimum thermal radiation intensity for pilo¬ 
ted ignition 7 P they obtained the range 0.30-0.36 cal/cm 2 s 
with an average of about 0.35 cal/cm z s. They also studied 
fibre insulation board, for which the critical values were 
0.57 and 0.15 cal/cm 2 s for spontaneous and for piloted 
ignition, respectively. 
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For thermal radiation intensities above these threshold 
values they obtained the following relations. For piloted 
ignition* 

(I - I f )t? /3 = A [16.21.1] 

A = 0.025 x 10 6 (kps + 68 x 10“ 6 ) [16.21.2] 


Simms and co-workers have also developed a number 
of models for ignition of a thin slab and of a semi-infinite 
solid by radiant heat. One standard heat transfer relation 
applicable to a semi-infinite solid is quoted by Drysdale 
(1985) as follows: 

^ — 1 — exp(/i 2 ) erfc (/?) [16.21.5] 


where A is a parameter (cal 2 /cm 4 (°C) 2 s), I is the thermal 
radiation intensity (cal/cm 2 s), 7 p is the minimum thermal 
radiation intensity for piloted ignition (cal/cm 2 s), k is the 
thermal conductivity of the wood (cal/cm 2 s (°C/cm)), s is 
the specific heat of the wood (cal/g°C), /,■ is the ignition time 
(s) and p is the density of the wood (g/cm 3 ). 

For spontaneous ignition they obtained* 

(. I-I s )ti /S =B [16.21.3] 


B = 0.05 x 10 \kps + 35 x lO" 6 ) [16.21.4] 

where 5 is a parameter (cal 2 /cm 4 (°C) 2 /s) and I s is the mini¬ 
mum thermal radiation intensity for spontaneous ignition 
(cal/cm 2 s). 

On the assumption that surface cooling occurs, there 
should be an effect of the thermal inertia kps (cal 2 /cm 4 
(°C) 2 s). This is the case, in that the parameters A and B are 
found to be linear functions of this quantity. Values of p, s 
and k for a number of materials are given in texts on heat 
transfer such as that by Carslaw and Jaeger (1959). 

Thus for oak the relations between thermal radiation 
intensity and exposure times for ignition were approxi¬ 
mately as follows: 


Ignition time, 
hi s) 

Thermal radiation intensity (cal/cm 2 s) 

Piloted ignition, 

I p 

Spontaneous ignition, 

k 

5 

1.45 


10 

1.10 

1.40 

25 

0.77 

1.05 

50 

0.65 

0.86 

100 

0.52 



From this work a minimum thermal radiation intensity for 
ignition of wood of 0.3 cal/cm 2 s (12 kW/m 2 ) has been used 
for building design. This figure was given, for example, in 
the Scottish Building Regulations 1971. 

Further work by Simms and co-workers (Simms, 1960, 
1961,1962,1963; Simms and Law, 1967) has shown that it is 
possible to determine for a given wood a minimum surface 
temperature for ignition. 


* In the first edition of the book SI versions of Equations [16.21.1] 
and [16.21.3] given by Eisenberg, Lynch and Breeding (1975) were 
quoted which are incorrect, evidently due to an error in the conver¬ 
sion. The latter work gives incorrect dimensions for the thermal 
conductivity k, as do the original authors, which may be the 
explanation. 


0 S = T s - T 0 
000 = %> - T 0 


ht 1 ' 2 


{kpcf* 


[16.21.6] 

[16.21.7] 

[16.21.8] 


where h is a heat transfer coefficient for convection (cal/ 
cm 2 s°C), t is the time (s), T is the surface temperature for 
ignition (K), T a is the initial surface temperature (K), T „ is 
the surface temperature for ignition at infinite time (K), P is 
a parameter, 9 S is the surface temperature difference for 
ignition (°C) and 0^, is the surface temperature difference 
for ignition at infinite time (°C). 

The parameter /} is known as the cooling modulus. It may 
be written in the alternative form 


p= 1 : 


[16.21.9] 


where is the thermal diffusivity (cm 2 /s). 

It may also be expressed in terms of the dimensionless 
groups 


[i = BiFo 1/2 


[16.21.10] 




Bi=(y) [16.21.1J§ 

Fo=^) [16.21.12] 


where L is a linear dimension, Bi is the Biot number and Fo 
is the Fourier number. 

It has been shown by Simms (1963) that Equation 16.21.5 
may be reformulated as follows. The surface temperature 
difference 0^ is related to the thermal radiation intensity I: 
he oo = a I [16.21.13] 

where a is the absorptivity. 

Then from Equations 16.21.5 and 16.21.13 

0 s = ^[l-exp(/? z ) erfc (/?)] 
which Simms recasts as 
y«/?[l-exp(/i 2 ) erfc (/?)]-* 

m 

7 pc(a k tf /2 0 s 

where y is a parameter known as the energy modulus. 


[16.21.14] 

[16.21.15| 

[16.21.16] 
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The cure is that given by Equation 16.21.15. (Courtesy of Combustion and Flame) 


Simms obtained for various woods the relation between 
the energy modulus y and the cooling modulus /i shown in 
Figure 16.117. 

Another form of the model given by Simms and Law 
(1967) is 


pc(ht) 1,2 % 1 - exp(/f 2 ) erfc (fi) 

These authors term the heat transfer coefficient, given 
above by the symbol h, the Newtonian cooling coefficient, 
but the two are identical. They also give values for the 
coefficient for various temperature differences. 

The work of Simms and others has shown that for a given 
wood it is also possible to correlate results in terms of the 
minimum ignition temperatures for spontaneous ignition, 
pilot ignition, and surface ignition. These temperatures are 
discussed by Simms (1962) and Simms and Law (1967). For 
piloted ignition without flame contact the results obtained 
tend to depend on the precise positioning of the flame, 
though they are reproducible for a given configuration. 

Further, for spontaneous ignition, woods exhibit a com¬ 
mon minimum ignition temperature of about 545°C. This 
does not apply, however, at very low rates of heating such 
that the volatile matter becomes exhausted without ever 
igniting. Likewise, there is a common minimum ignition 
temperature for piloted ignition of about 380°C. Taking an 
initial temperature of 20°C, these two minimum ignition 
temperatures correspond respectively to minimum igni¬ 
tion temperature differences 0 a of about 525°C and 360°C. 

The relation between the minimum thermal radiation 
intensity /„ and the minimum temperature difference 9 S for 
ignition is 

/„ = hO s [16.21.18] 

Thus, for example, for piloted ignition Simms and Law give 
avalueofAof 8.6 x 10 -4 cal/cm 2 s°C. Then for 9 S = 360°C, 
I 0 = 0.31 cal/cm 2 s. 

The results described were obtained in carefully 
controlled experiments using dry wood samples with spe¬ 
cified characteristics. It is known that there are effects of 


thermal inertia, water content, wood grain, etc., and sur¬ 
face absorptivity. 

A material with low thermal inertia ignites more readily 
than one with high inertia. This effect is taken into account 
in the correlations given above. 

The effect of water content has been studied by Simms and 
Law (1967). Water content influences ignition in several 
ways. It affects the thermal inertia of the wood through its 
effects on the individual properties, namely density, specific 
heat and thermal conductivity. In addition, it affects the 
overall heat transfer in two ways: heat transfer by molecular 
diffusion of water; and vaporization of water, which cools the 
hot zone, and condensation, which heats the cooler zones. 

The water content of the wood increases the minimum 
ignition energy, the minimum thermal radiation intensity 
and the ignition time for both spontaneous ignition and 
piloted ignition without contact. But for the latter it 
becomes significant only at water contents of 40 % or more. 
A water content of 60% doubles the minimum thermal 
intensity for piloted ignition. 

The properties of the wood itself affect thermal radiation 
ignition. These include the cut end, the direction of the 
grain and any knots. One effect of grain is on thermal con¬ 
ductivity. Another is on the flow of volatile matter. 

The absorptivity of the wood increases as charring 
occurs. 

With regard to the thermal radiation incident on the 
wood, it has been shown by Kashiwagi (1979a) that there 
can be a significant attenuation due to the volatile matter 
issuing from it. 

Further work on ignition of wood has been described by 
Wesson, Welker and Sliepcevich (1971). They use a correla¬ 
tion of the form 

4 = k lP ni (a/f’erf [L/2(a A f) 1/2 ]” 3 [16.21.19] 

where L is the thickness of the slab (cm), k x is a constant and 
»i-m 3 are indices. For wood tx h «1.5 x 10~ 3 cm 2 /s and for 
the wood samples used i « 2 cm. Using these values in 
Equation 16.21.19 the term erf [L/2(x h tj) 1/2 ] is approximately 
unity for t < 700 s. From experiments on a number of woods 
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the authors obtained values of the constant in Equation 
16.21.19 to yield 

4 = 35p 0S V)“ 2 ' 8 [16.21.20] 

A comparison of the minimum ignition temperature for 
heat transfer by radiation and convection has been made by 
Kanury (1972a), who quotes the following approximate 
values: 


Heat transfer mode 

Minimum ignition temperature (°C) 


Piloted ignition Spontaneous ignition 

Radiation 

Convection 

300-410 600 

450 490 


16.21.4 Flame spread 

The growth of fire is frequently governed, particularly 
in the early stages, by flame spread over the surface of 
solids or liquids. Flame spread itself is considered at this 
point. The spread of fire through buildings is discussed in 
Section 16.36. 

Accounts of flame spread include those given by 
P.H. Thomas, Simms and Wraight (1964,1965), Burgoyne, 
Roberts and Quinton (1968), de Ris (1969), MacKinven, 
Hensel and Glassman (1970), Sirignano and Glassman 
(1970), Magee and McAlevy (1971), W.J. Parker (1972), 
Fernandez-Pello and Williams (1974), R. Friedman (1977). 
F. A. Williams (1977), Quintiere (1981), Suzuki and Hirano 
(1982), Ray and Glassman (1983), Drysdale (1985) and 
Ishida (1986,1988). 

The two situations considered here are flame spread 
across (1) a liquid surface and (2) a solid surface. In both 
cases the spreading flame has two effects: it serves as a 
source of heat and it causes pilot ignition. 

In work on flame spread across a combustible liquid 
surface a distinction is made between a liquid which 
is below the fire point and one which is above it. If the liquid 
is below the fire point, it has first to be heated up. 
As described above, work by Sirignano and Glassman 
(1970) has demonstrated the role of surface tension effects 
in the circulation flows set up in the bulk liquid. Further 
work includes that by MacKinven, Hensel and Glassman 
(1970) on the effect of pool depth and width. 

If the liquid is above its fire point, the flame spread is 
governed by flame propagation through the flammable 
mixture above the liquid surface. It has been found by 
Burgoyne and Roberts (1968a) that for a stoichiometric 
mixture the apparent rate of spread reaches a limiting 
value of some 4-5 times the fundamental burning velocity 

Work on flame spread over ground soaked with fuel has 
been described by Ishida (1986,1988). 

Flame spread over solid surfaces is a function of (1) the 
orientation and geometry of the surface, (2) the direction of 
propagation, (3) the thickness of the combustible material, 
(4) the properties of the material and (5) the environment 
factors. 

The behaviour of a flame on a vertical surface differs 
from that of one on a horizontal surface. The direction of 
propagation also makes a radical difference. Flame spread 
is most rapid when propagation is upwards on a vertical 
surface. These differences are largely accounted for by dif¬ 
ferences in the extent to which the flame preheats the solid. 


The rate of upward flame spread on a vertical surface 
tends to increase exponentially. It can be characterized by 
the time taken for the rate of spread to double, or the dou¬ 
bling time, as described byAlpert and Ward (1984). 

For thin layers of combustible solid, the rate of flame 
spread has been shown by experiment and theory to be 
inversely proportional to the thickness of the bed. Relevant 
work has been described by Magee and McAlevy (1971) and 
Fernandez-Pello and Williams (1974). 

The rate of flame spread is also a function of the thermal 
properties of the material. The precise relations depend on 
the thickness of the surface. A critical thickness exists 
which is 

T cr = (a*L/F) 1/2 [16.21.21] 

where L is the ‘heating length’, Fis the rate of flame spread, 
ah is the thermal diffusivity of the material and t cr is the 
critical thickness. The heating length is the length of solid 
over which the material is heated to its fire point. It can 
be shown that for thin surfaces (r < T cr ) Foc (per) -1 and for 
thick surfaces (t > T cr )Foc ( kpc )~\ where c is the specific 
heat, k is the thermal conductivity, p is the density of the 
material and % is the thickness. Further, since the thermal 
conductivity k is approximately proportional to the den¬ 
sity, in this latter case F oc p 2 . Thus the rate of flame 
spread over the surface of a low density material can be 
very rapid. 

The geometry of the surface also affects flame spread. 
There have been a number of studies of features such as 
width and edge effects. 

Flame spread is also influenced by environmental fac¬ 
tors, including the initial temperature of the fuel, the air 
velocity over the surface, the imposed thermal radiation 
and an oxygen enriched atmosphere. 

Thermal radiation can cause a marked enhancement 
of the rate of flame spread, as evidenced by the work 
of Alvares (1975), Kashiwagi (1976), Fernandez-Pello 
(1977 a,b), Hirano and Tazawa (1978) and Quintiere (1981) 
and others. 

The effect of air velocity on flame spread depends on the 
direction of air flow. If the air flow is in the same direction 
as the flame spread, an increase in air velocity tends to 
increase the rate of spread, whilst if it is in the opposing 
direction the effect depends on the magnitude of the air 
velocity. A low air velocity tends to enhance the rate of 
flame spread but a high one tends to reduce it. Whichever of 
the two directions the air flow has, there will come a point at 
which a very high velocity results in flame extinction, or 
blow-off. 

The spread of flame across surfaces has been modelled 
by a number of workers. F.A. Williams (1977) gives the 
so-called ‘fundamental equation of fire spread’ 

pVAH = q [16.21.22] 

where AH is the enthalpy change per unit mass in raising 
the material to its fire point, q is the rate of heat transfer 
across the surface, Fis the rate of flame spread and p is the 
density of the fuel. 

The rather different problem of flame spread through 
open fuel beds has been studied by P.H. Thomas, Simms 
and Wraight (1964,1965), who conducted a classic set of 
experiments on wooden cribs. Their results have been 
applied by other workers to a variety of fire situations. 
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In practical cases some factors which are of particular 
importance in determining flame spread over a solid sur¬ 
face are the thickness and composition of the surface, the 
imposed thermal radiation and the air movement over the 
surface. 

16.21.5 Thermal radiation limits 

Thermal radiation limits are quoted in a number of codes 
and standards and in numerous papers. Many limits are 
given for the purposes of plant design and layout. Some are 
relevant to hazard assessment. Generally, such sets of lim¬ 
its include both limits related to damage and others related 
to injury. It is convenient, therefore, to defer consideration 
of such limits to the next section. 

16.22 Effects of Fire: Injury 

There is a requirement in hazard assessment for relation¬ 
ships which permit heat radiation intensity to be translated 
into the equivalent burn injury. Correlations for both fatal 
and non-fatal burn injury have been derived in the Vulner¬ 
ability model by Eisenherg, Lynch and Breeding (1975). A 
detailed review and additional information have been given 
by Hymes (1983 SRD R275). Further correlations are given 
in the Green Book (CPD, 1992b). 

16.22.1 Sources of thermal radiation 

The effect of thermal radiation on man depends very much 
on the source of radiation and it is therefore necessary to 
specify this. One source of thermal radiation which is of 
long-standing interest is a flare and some of the earliest 
thermal radiation limits relate to flares. 

Another source of thermal radiation which has received 
increasing attention is a fireball, typically as part of a 
BLEVE. A fireball is well defined relative to most other 
types of fire to which people may be exposed and it is one of 
the fire hazards most likely to give rise to a large number of 
serious injuries. 

16.22.2 Experimental studies 

Experimental work on injury from thermal radiation has 
been done on humans and on animals. The use of human 
subjects is limited to the lower levels of pain and injury. 

Henriques (1947) carried out experiments in redden¬ 
ing and blistering in man exposed to thermal radiation. 
Buettner (1951b) performed experimental work on man in 
which skin temperature and pain threshold were measured. 
Experiments on man were also conducted by Stoll and 
Greene (1959) to investigate skin temperature and thres¬ 
holds of pain and blistering. 

Experimental work on rats exposed to thermal radiation 
by NML, Brooklyn, and on rats exposed to direct flame 
contact by NADC, Johnsville, quoted by Stoll and Chianta 
(1971), provides a basis for comparing burn injury by these 
two modes. 

Hinshaw (1957) at the University of Rochester investi¬ 
gated the thermal radiation intensities required to produce 
second and third degree burns in pigs. Experiments on 
swine burn have also been performed by Hardee and Lee 
(1977/78). 

Tests on the response of fabrics to thermal radiation have 
been doneby Wulff and co-workers (Wulff, 1973;Wulff etal., 
1973; Wulff and Durbetaki, 1974), and work on heat transfer 
from burning clothing to the wearer has been done by 
Williams etal. (n.d.) at MITand by Arnold etal. (1973) at the 
Gillette Research Institute. 


16.22.3 Skin properties 

Human skin consists of two layers, the epidermis and the 
dermis. It ranges in thickness from some 5 mm on the back 
to some 0.5 mm on the eyelids. The area of skin on the 
average man is some 1.8 m 2 . The distribution of skin sur¬ 
face area is considered in Section 16.22.10. 

16.22.4 Pathology of burns 

Accounts of burns and burn treatment are given in Burns 
and TheirTreatment (I.K. Muir and Barclay, 1974), Burns: a 
Team Approach (Artz, Moncrief and Pruit, 1979), Clinical 
Bum Therapy (Hummel, 1982), Physiological Responses to 
Burn Injury (J.W.L. Davies), Burn Mortality (W. Clark and 
Fromm, 1987), Plastic Surgery (Goldin, 1987) and Plastic 
Surgery (McCarthy, 1990). Treatments of burn injuries of 
particular relevance here are those by Glasstone (1962) and 
Hymes (1983 SRD R275). 

The effects of incident heat radiation are, in order of 
increasing severity: 


Burn type 

Criterion 

First degree 

Persistent redness 

Second degree: 


Moderate 

Some blistering 

Deep 

Full blistering 

Third degree 

Charring 


A first degree burn involves the epidermis. There is red¬ 
dening but no blistering. A second degree burn may be 
superficial or deep. The former affects the epidermis and 
part of the dermis and involves some blistering, but with 
damage to the surface layers only. The latter penetrates 
further into the dermis and damages it more severely. A 
third degree burn destroys both the epidermis and the 
dermis. 

The terms second and third degree burn have largely 
given way to characterization in terms of the depth of burn, 
reference being made to full depth and other burns. 


16.22.5 Skin temperature 

Burn injury correlates closely with skin temperature. Pain 
is experienced at a temperature of 44°C and above this 
temperature injury occurs. 

Relations for the unsteady-state temperature profile of 
the skin suddenly exposed to a source of heat radiation 
have been given by Buettner (1951a) and by Stoll and 
Chianta (1971). The simplest of these is the equation given 
by Buettner for a non-penetrating constant source of ther¬ 
mal radiation. 


2 Qt 1 ' 2 
(nkpc) 1 ^ 2 


[16.22.1] 


where for the skin c is the specific heat, k is the thermal 
conductivity, Q is the net heat absorbed, t is the time, T a is 
the initial temperature throughout, T s is the surface tem¬ 
perature and p is the density. 

The thermal response is governed by the thermal inertia 
(kpc). Measurements of the thermal inertia were made by 
Stoll and Greene (1959), who found that it varied strongly 
with the thermal radiation intensity. 

Stoll and co-workers (Stoll and Greene, 1959; Stoll and 
Chianta, 1971) have studied the temperature at the basal 
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layer of skin, which is about 80 pm (0.08 mm) below the 
surface. They found that damage occurs at temperatures 
above 44°C. 

The temperature profile of skin at 80 pm subjected to 
thermal radiation sufficient to cause blistering given by 
these workers is shown in Figure 16.118(a). They give a 
model for the degree of tissue damage W due to heat 
radiation. Part of the damage occurs during the cooling 
period after the heat source is removed. 

The rate of injury above 44°C increases very rapidly 
indeed with temperature. The relation given by Stoll and 
Chianta is shown in Figure 16.118(b). There is an approx¬ 
imate trebling of the rate of injury for each 1°C temperature 
rise. Thus the injury rate at 50°C is some 100 times that at 
44—55°C. 

Stoll and Chianta describe work on burn in rats. The 
responses of rats to thermal radiation and to flame contact 
have been studied by NML, Brooklyn, and by NADC, 
Johnsville, respectively. Figure 16.118(c) gives a compar¬ 
ison of the two sets of results which shows that the 
responses are virtually identical. These results indicate 
that the dose-response relation is similar for thermal 
radiation and for flame contact. The results are usually 
regarded as applicable to man also. 

16.22.6 Injury factor 

Inquiry due to exposure to a short but strong pulse of 
thermal radiation may be correlated in several ways. The 
most convenient is to take the injury factor as the thermal 
dose which is the product of the thermal radiation intensity 
and time. The level of thermal radiation for a particular 
effect is often correlated in terms of the thermal dose. 


It is found, however, that this somewhat understates the 
effect of very high intensities of thermal radiation and that 
better correlation is obtained if these are more highly 
weighted. The empirical correlation for the injury factor 
which best fits the data is 


tl* = Constant [16.22.2] 

where /is the intensity of thermal radiation (W/m z ), t is the 
time (s) and n is an index. 

As described below, Equation 16.22.2 has been given by 
Eisenberg, Lynch and Breeding (1975) for the correlation 
of data on burn fatalities with a value of the index 
n = 4/3 = 1.33. For non-fatal burn injuries these authors 
use the slightly different exponent n = 1.15. It has been 
proposed by Hymes that the data for fatal and non-fatal 
injury are adequately correlated using a value oi n = 1.33 
for both. 

The term tl 4/3 is referred to here as the thermal load L to 
distinguish it from the thermal dose D = tl. It is conven¬ 
tional to express the thermal radiation intensity in kW/m 2 
but to use in probit equations an intensity expressed in 
W/m 2 . Since this latter practice gives rise to thermal loads 
which are large numbers, it is convenient to define also 
an alternative thermal load U. These quantities are thus 
defined as follows: 


D = tl [16.22.3] 

L = tl^ 3 [16.22.4] 


Irradiance = 100 mc/cm 2 s Irradiance = 400 mc/cm 2 s 

Nearly maximum 



(a) 

Figure 16.118 Effect of heat on skin (Stoll and Chianta, 1971): (a) heating and cooling of skin exposed to heat radiation 
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Figure 16.118 continued (b) rate of damage to skin exposed to heat radiation; and (c) burn injury to rats exposed to 
heat radiation and to flame contact (Courtesy of the New York Academy of Sciences) 
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where D is the thermal dose (kj/m 2 ), I is the thermal 
radiation intensity (kW/m 2 ), L is the thermal load 
(s (kW/m 2 ) 4/3 ) and / is the exposure time (s). Further 

If = tf^/lO 4 [16.22.5] 

where I is the thermal radiation intensity (W/m 2 ) and L' is 
the thermal load ((s (W/m 2 ) 4/3 )/10 4 ). 


16.22.7 Pain and blister thresholds 

A number of workers have correlated thresholds of pain and 
blistering. Table 16.75 shows some limits for pain and injury 
given in the literature, in terms of thermal radiation inten¬ 
sity in Section A and of thermal dose in Section B. 

Table 16.76, Section A, shows the results obtained for the 
time to the threshold of pain in man by Buettner (1961b), 
and by Stoll and Green (1959). Figure 16.119(a) (Mudan, 
1984c) is a plot of data reported by these and other workers. 

The threshold of pain may also be expressed in terms of 
the thermal load. Values given by Hymes based on the work 
of Stoll and Greene are shown in Table 16.76, Section C. 
Hymes gives as the approximate threshold of pain a value of 
92s(W/m 2 ) 4/3 /10 4 . 

Results for the time to the threshold of blistering in man 
by Stoll and Greene are shown in Table 16.76, Section B, 
whilst a plot by Mudan of these and other data is given in 
Figure 16.119(b). 


16.22.8 Second and third degree burns 

Several workers have investigated the degree of exposure 
of pigs to levels of thermal radiation which cause second 
and third degree burns. In work by Hinshaw (1957) at the 
University of Rochester, pigs were subjected to thermal 
radiation exposures of 210,420 and 670 kj/m 2 for periods of 
0.5,1,3,5,10 and 30s. 

At high thermal radiation intensities the heat is suffi¬ 
cient to vaporize the tissue fluids, an effect known as abla¬ 
tion. The burn injury occurring in these circumstances is 
termed a ‘steam bleb’. Histological examination in these 
experiments showed that the thermal radiation was suffi¬ 
ciently intense in some tests to cause steam ‘bleb’ formation 
and mitigation of the tissue damage. 

The data have been analysed by Hymes who has derived 
the results given in Table 16.77 correlated in terms of the 
heat injury factor. From these data Hymes estimates the 
threshold for steam bleb formation as a thermal load of 
some 4000-4500 s (W/m 2 ) 4 / 3 /10 4 . This is a very high level 
of thermal radiation which, according to the relations for 
fatality given below, would be lethal in some 90 % of cases. It 
is therefore thermal radiation intensity below the level of 
steam bleb formation which is of prime interest. 

The depth of skin burn in Hinshaw’s experiments at 
thermal radiation intensities below those which cause 
steam bleb has been correlated by Hymes, as shown in 
Figure 16.120(a). He takes the burn depths for the threshold 
of second degree burns and the onset of third degree burns 


Table 16.75 Some limits for pain and injury from thermal radiation 


A Thermal radiation intensity 


Thermal 

radiation 

(kW/nS 


Reference 

1.5 

Threshold of pain 

Atallah and Allan (1971) 

2.1 

Level at which pain is felt after 1 min 


1 

Level just tolerable to a clothed man 

HSE (1978b) 

8 

Level which causes death within minutes 


4.7 

Threshold of pain. Average time to experience pain, 14.5 s 

Crocker and Napier (1986) 

B Thermal dose 

Thermal dose (kj/m 2 ) 


Reference a 

40 

Second degree burns 

Williamson and Mann (1981) a 

125 

Third degree burns 


65 

Threshold of pain 

Rijnmond Public Authority (1982) 

125 

First degree burns 


250 

Second degree burns 


375 

Third degree burns 


c. 100 

Threshold of blistering 

Crossthwaite (1984) a 

200 

Blistering 


700 

50% fatality 


65 

Threshold of pain, no reddening or 
blistering of skin 

BS 5908:1990 

125 

First degree burns 


200 

Onset of serious injury 


250 

Second degree burns 


375 

Third degree burns 


a For thermal radiation from a fireball. 
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Table 16.76 Times to pain and blister thresholds 


A Time to threshold 
intensity 

of pain: thermal radiation 

Authors 

Thermal 
radiation 
intensity 
(kW/nr) 

Time (s) 

Stoll and Greene (1959) a 

4.2 

13.5 


5.2 

10.1 


6.3 

7.8 


8.4 

5.5 


12.6 

2.9 


16.8 

2.2 

Buettner (1951b) b 

3.7 

20 


6.2 

10 


9.7 

5 


18 

2 

API RP 521:1990 

1.74 

60 


2.33 

40 


2.90 

30 


4.73 

16 


6.94 

9 


9.46 

6 


11.67 

4 


19.87 

2 

B Time to threshold of blistering: thermal 
radiation intensity 


Authors 

Thermal 

radiation 

intensity 

(kW/m 2 ) 

Time (s) 

Stoll and Greene (1959) 

4.2 

33.8 


6.3 

20.8 


8.4 

13.4 

12.6 

7.8 


16.8 

5.6 


C Time to threshold of pain: thermal load 


Authors 

Thermal load, 
tT 113 (s(W/m 2 ) 4/3 /10 4 ) 

Time (s) 

Hymes (1983 SRD R275) 

86 

13.0 



10.0 


90 

8.0 


91 

5.5 


103 

3.0 


“Time to threshold of pain. 
b Time to unbearable pain. 


as 0.1 and 2 mm, respectively. The corresponding thermal 
loads are approximately 1200 and 2600 s (W/m 2 ) 4 / 3 /10 4 , 
respectively. 

Swine burn experiments have also been done by Hardee 
and Lee (1977/78), who have derived from their results 
considerably lower values for the levels of heat radiation 
intensity for given degrees of injury. According to Hymes, 
the reinterpretation of this work does not support these 
lower values. 



' 1 10 100 


Incident thermal flux (kW/m 2 ) 

o Buettner (1951b) 

• Hardy, Jacobs and Meixner (1953) 
o Stoll and Greene (1959) 

♦ Bigelow ef a/. (1945) 



Incident thermal flux (kW/m 2 ) 


■ Stoll and Greene (1959), threshold blister 
o Stoll and Greene (1959), full blister 
o Mehta, Wong and Williams (1973) 

• Mixter (1959) 

Figure 16.119 Time to threshold effects of heat 
radiation (Mudan, 1984c): (a) threshold of pain; and 
(b) threshold of blistering (Courtesy of Progress in 
Energy and Combustion Science) 
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Table 16.77 Second and third degree burn injury to 
pigs exposed to thermal radiation (after Hymes, 1983 
SRD R275) (Courtesy of the UKAEA Safety and 
Reliability Directorate) 


Thermal Time Thermal load Thermal Steam bleb 

dose (s) (s (W/m 2 ) 4/3 /10 4 ) damage 

(kj/m 2 ) (mm) 


Gas Company at Tewkesbury, Massachusetts, in 1972. 
One comment quoted contains two relevant points. The 
firefighters seem to have had ‘momentary warning’ of the 
impending BLEVE. Since the front of their clothing was 
not burned but the back was, they appear to have turned 
their backs very promptly, but since their faces were 
burned, it is believed that they tended to look round to see 
what was happening. 


210 0.5 1570 

1 1240 

3 860 

5 730 

30 400 

420 0.3 4680 

3 2170 

10 1450 

670 0.5 7385 

1 5860 

3 4065 

5 3430 

10 2720 

30 1890 


0.17 No 

0.16 No 

None No 

None No 

None No 

0.49 Yes 

0.72 No 

0.45 No 

0.9 Yes 

1.1 Yes 

1.4 Sometimes 

1.6 No 

1.6 No 

1.1 No 


As described above, work has been done at MIT and at 
the Gillette Research Institute on the heat transferred from 
burning clothing to the wearer. 

Figure 16.120(b) shows the relation between depth of 
skin burn and thermal load from these sources as given by 
Hymes. 

Another source of information on second and third degree 
burns is data on burn victims from the nuclear weapons 
dropped on Japan, which are given by Glasstone (1962). 

16.22.9 Human response to fire events 

Human response to a fire event depends on (1) the nature of 
the event and (2) the awareness of the person. 

The event primarily considered in relation to burn injury 
is a fireball. Another sudden event may be a rapid growth in 
the size of a flare. Other types of event such as a pool fire are 
generally considered to occur more gradually and to allow 
more time for escape, though this may not always be so. It is 
the fireball hazard which is primarily considered by Hymes 
and Marshall, and also here. 

Accounts of burn injury such as those by Hymes and 
in the Green Book quote a human response time of 5 s. The 
application of this reaction time to a fireball scenario is that 
the person faces the fireball for 5 s and then turns his back 
and seeks to escape. 

In an analysis of human exposure to a BLEVE, in the 
context of a discussion of the disaster at San Carlos, Hymes 
considers two situations. In Situation 1 with the lift-off time 
less than the reaction time, the first phase involves frontal 
exposure for the 5 s reaction time. The person then turns his 
back and seeks to escape. During this escape the fireball 
passes through three further phases: further growth at 
ground level, shrinkage just prior to lift-off, and rise. 
In Situation 2, the lift-off time equals the reaction time, so 
that there is no phase of further growth at ground level; 
otherwise the scenario is similar, with the period of frontal 
exposure again being 5 s. 

In practice, human behaviour tends to be more complex. 
Hymes gives an account of the BLEVE at the Lowell 


16.22.10 Protection by clothing 

The degree of protection offered by clothing depends on the 
fraction of the body which is so protected. Data on the 
fraction of the body area represented by the different parts 
of the body are given in the Green Book. An extract from 
this tabulation, giving the fraction of body area (%) for the 
parts of the body most likely to be exposed, is as follows: 


Fraction of body arei 

»(%) 






Part of body 


Age group (years) 


1 

1-4 

5-9 

10-14 

15 

Adult 

Head 

19 

17 

13 

11 

9 

7 

Neck 

2 

2 

2 

2 

2 

2 

Hands (each) 

2.5 

2.5 

2.5 

2.5 

2.5 

2.5 

Lower arms (each) 

3 

3 

3 

3 

3 

3 

Upper arms (each) 

4 

4 

4 

4 

4 

4 

Lower legs (each) 

5 

5 

5.5 

6 

6.5 

7 

Upper legs (each) 

5.5 

6.5 

8 

8.5 

9 

9.5 


The Green Book takes for the Dutch population a maxi¬ 
mum value of the body surface exposed of 20% in normal 
conditions. 

From the above data the following estimates of the frac¬ 
tions of body area (%) exposed for an adult may be obtained: 


Head 
Neck 
Hands 
Lower arms 
Total 


Fraction of body area (%) 


Front Back Total 


4 3 7 

1 1 2 

2.5 2.5 5 

3 3 6 

10.5 9.5 20 


If the thermal radiation is so intense as to ignite the cloth¬ 
ing, a different situation pertains. This is considered in 
Subsection 16.22.13. A detailed discussion of the protection 
afforded by clothing is given by Hymes. 

16.22.11 Protection by buildings 

The degree of protection afforded by a building to a person 
within it depends on the location of that person. In many 
cases this will be such that the building affords complete 
protection. Persons in buildings are liable to be exposed, 
however, to thermal radiation through glass windows. 
A person aware of an event outside may well move to view it 
through a window. 

Figure 16.121 from Hymes shows the transmissivity of 
window glass for thermal radiation from sources up to 
1200°C. 

















Thermal radiation load (s. (W/m 2 ) 4 
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Threshold second Third degree burn 

degree burn (assuming 2 mm dermis) 


Figure 16.120 Depth of skin bum due to heat radiation (Hymes, 1983 SRD R275): (a) sub-‘steam bleb’ burns 
in pigs obtained at University of Rochester by Hinshaw; and (b) comparison with results of other workers 
(Courtesy of the UKAEA Safety and Reliability Directorate) 
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Figure 16.121 Transmissivity of ordinary window glass for heat radiation (Hymes, 1983 SRD R275) 
(Courtesy of the UKAEA Safety and Reliability Directorate) 


16.22.12 Effective radiation intensity 

In estimating burn injury it is important to utilize an 
appropriate value of the thermal radiation. The effective 
intensity is determined by the atmospheric transmissivity 
and the geometry of the body as presented to the radiation 
source. The attenuation due to the atmosphere has been dis¬ 
cussed in Section 16.13 and is not considered further here. 

The importance of the geometry of the body has been 
emphasized by V.C. Marshall (1987). There is a tendency in 
hazard assessments to treat the whole of the exposed area 
of the body as subject to the radiation nominally incident at 
the particular point. If the body is treated as a thin object, 
the ratio of the surface to the projected area is approxi¬ 
mately 2. If it is treated as a long cylinder, the ratio is n. 
For a sphere the ratio is 4. The three-dimensional nature of 
the body is therefore significant. The thermal radiation 
incident on the exposed area is appreciably less than that 
calculated as falling on the projected area. 

A related aspect is that with a three-dimensional body 
the angle of incidence of the radiation varies from 90° to 
close to zero. Typically, the view factor used takes account 
of the angle of incidence in two dimensions, but not three. 

16.22.13 Ignition of clothing 

The protection afforded by clothing is limited by the fact 
that at thermal radiation intensities within the range of 
interest here it is prone to ignite. A distinction needs to be 
made between everyday clothing and fire fighters’ suits; 
the latter are naturally designed to resist ignition. It is 
primarily everyday clothing which is considered here. 

For clothing subject to thermal radiation, there is also a 
distinction to be made between spontaneous and piloted 
ignition. A similar distinction is made for ignition of wood 
by thermal radiation, as described in the previous section. 
Whilst spontaneous ignition may be regarded as the base 
case, Hymes suggests that in certain scenarios, notably a 
BLEVE, the probability of piloted ignition, for example, by 
burning paper or leaves, is quite high. 

As already stated, work on ignition of fabrics has been 
carried out by Wulff and co-workers. From this work Hymes 


has given relations for the determination of the times to 
unpiloted and to piloted ignition together with tables of 
parameters for common fabrics. 

For spontaneous ignition times are correlated by Hymes 
using the relation 


tP = Constant [16.22.6] 

where / is the thermal radiation intensity (W/m 2 ), t is the 
time (s) and n is index. The values quoted for n lie in the 
range 1.16-3.22. 

Using this equation, Hymes gives for one fabric subject 
to a thermal radiation intensity of 198 kW/m 2 the following 
estimate of the induction time for ignition. 


2.87 x 10 1S 
(198,000)®® 


For piloted ignition the approach is slightly different. 
In this case the time is taken as that required to heat the 
fabric from its initial temperature to its piloted ignition 
temperature: 


SC(T P - T 0 ) 
aW 


[16.22.7] 


where a is the absorptivity of the fabric, C its specific heat 
(J/g°C) and S its density (g/cm 2 ),f p is the time to piloted 
ignition (s), T a is the initial temperature of the fabric (° C), T p 
is the piloted ignition emperature (°C)and Wis the incident 
heat radiation (W/cm 2 ). It should be noted that the density 
is defined in terms of the mass per unit thickness. Values of 
the piloted ignition temperawre and other properties of the 
fabric are tabulated by Hymes. 

He gives as an example a fabric subjected to a thermal 
radiation intensity of 198 KW/m 2 , hence W = 19.8 W/cm 2 , 
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with the properties a = 0.19, C = 1.35 J/g°C; S = 0.024 g/ 
cm 2 , and at conditions T„ = 14°C and T p = 334°C, yielding 
f p = 2.75 s. 

Hymes states that for thermal radiation intensities 
greater than 75 kW/m 2 most clothing will undergo sponta¬ 
neous ignition within about 5 s. Under conditions such as 
a BLEVE, piloted ignition is probable and the time to igni¬ 
tion will tend to be even shorter. 

The Green Book refers to the work of Hymes and pro¬ 
poses for the ignition of clothing the following threshold 
relation 


tl 2 = D s [16.22.8] 

where D s is the clothing ignition load (s(KW/m 2 ) 2 ), I is the 
thermal radiation intensity (kW/m 2 ) and t is the time (s). 
It states that the value of D s lies approximately in the range 
2.5 x 10 4 and 4.5 x 10 4 s (kW/m 2 ) 2 

Ignition of clothing has two main effects. One is that it 
distracts the wearer. He May well stop running and try to 
douse the flames, with effects not only on the speed of 
escape but also on the orientation of the body. 

The other effect is to cause injury from burning cloth¬ 
ing. For the heat released by the burning of clothing, 
Hymes quotes the following figures for typical clothing 
such as cotton. The heat of combustion lies in the range 
5-20 kj/g Which translates to 1-4 J/mm 2 of fabric. When 
the clothing burns there is transfer of some 15-50% of 
the heat of combustion. The thermal does received would 
then be of the order of 105-356 kj/m 2 . He also refers to 
the medical adage that ‘one square centimetre of burnt 
skin’. 


Mortality from burning clothing is discussed in the next 
subsection. 

16.22.14 Mortality from burns 

Information of the mortality in persons admitted to hospi¬ 
tal with burn injuries has been given in a series of papers 
spanning some 40 years by Bull, Lawrence and co-workers, 
the first being that of J.P. Bull and Squire (1949) and the 
most recent that of J.C. Lawrence (1991), the intermediate 
publications being those of J.P. Bull and Fisher (1954) and 
J.P. Bull (1971). 

Table 16.78 from J.C. Lawrence (1991) shows the mortality 
among persons admitted with burns or scalds as a function 
of fraction of the body exposed and of age group. The total 
number of cases in the 7-year survey period was 3044. 

Analysis of the data given by Lawrence indicates 
the following breakdown of causes of burn injury in the 
admissions trated: 


Proportion (%) 



Admissions 

Fatalities 

Building fires 

3 

16 

Flammable liquids 

10 

21 

Space heating 

8 

19 

Electrical fire/flashover 

~20 


Chemicals 

~20 


Explosions, molten metal 

~25 


Hot objects, chemicals 

14 


and molten fats 

Other 

Total 

100 



Table 16.78 Mortality in cases admitted to hospital with bum and scald injuries as a function of body area exposed 
and age group (J.C. Lawrence, 1991) (Courtesy of the Fire Safety Journal) 


4 15-19 20-24 25-29 30- 34 35- 39 40-44 45-49 50-54 55- 59 60- 64 65- 69 70-74 75-79 80-84 85+ 


83-87 

78-82 

73-77 


0.7 0.7 0.7 
0.6 0.6 0.6 
0.5 0.5 0.5 


1-57 0.2 0.3 0.3 


0.4 0.5 0.5 0.6 0.6 0.7 


0.5 0.5 0.6 0.6 


0.2 0.2 0.2 0.3 0.3 0.4 0.4 0.5 0.5 0.7 0.9 

0.1 0.1 0.2 0.2 0.2 0.3 0.3 0.4 0.4 0.6 0.8 

0 0.1 0.1 0.1 0.2 0.2 0.2 0.3 0.3 0.5 0.7 
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The proportion of burn victims who die without ever 
being admitted is not stated, but it is probably small. 
An appreciable fraction of such cases is likely to be victims 
of building fires who have died from both smoke and burns. 
Table 16.78 takes account of vulnerable groups, the elderly 
being particularly at risk from this mode of injury. 

Burn injury is an area where there have been great impro¬ 
vements in medical treatment over the years. One aspect of 
this mentioned by Craven (1976) is the improvement in 
survival rates since 1965 due to silver nitrate prophylaxis. 

Lawrence states that over the 40-year period up to 1991 
deaths attributable to burns and scalds have halved. Since 
the situation reported by Bull in 1971, mortality has 
decreased by 19% .The data given in the table therefore take 
account of the effects of modem medical treatment. 

Work is available by Arnold et at. (1973) on the degree of 
incapacitation as a function of the fraction of body area 
burned. Graphs from this work are given by Hymes. 

With regard to fatal injury from ignited clothing, in a 
survey of five American hospitals by Schlapowsky (1967) 
of 179 people admitted to hospital suffering from burns 
from clothing, almost 40% had second degree burns or 
worse, requiring extensive surgery and skin grafts; 16% 
had third degree burns. 

In his survey, Lawrence states that there were 248 cases of 
ignition of ordinary clothing, excluding those involving flam¬ 
mable liquids, of whom 46 died, giving a mortality of 18.5%. 

16.22.15 Eisenberg, Lynch and Breeding models 

An early set of relations for thernlal injury were those 
given in the Vulnerability model by Eisenberg, Lynch and 
Breeding (1975). For fatal injury, these authors utilize an 
adaptation of data given by C.S. White (1971) for the thermal 
injuries caused hy nuclear weapons dropped on Japan. The 
data of the latter author for thermal radiation are based on 
the weapon yield. Using a formula given by Glasstone 
(1962) for the relationship between weapon yield and pulse 
duration, Eisenberg, Lynch and Breeding convert the 
original data to thermal radiation intensities over a defined 
pulse.The figures obtained are summarized in Section A of 
Table 16.79. 

From analysis of these data the authors obtain the data 
shown in the first four columns of Section B of Table 16.79. 
Further analysis indicated that the form of the causative 
factor, in this case a thermal load, should be the f 13 , which is 
confirmed by the relative constancy of the three sets of figures 
for 1, 50 and 99% mortality in the last column of Section B. 
The profit equation derived by these authors is then 

F = -14.9 + 2.56 In (f/ 4 / 3 x 10" 4 ) [16.22.9] 

where I is the thermal radiation intensity (W/m2), t is the 
time of exposure (s) and Y is the profit. 

Since Equation 16.22.9 is based on burn injuries to people 
going about their normal affairs, it applies to persons who 
are clothed. 

The same equation is applied by these authors to burn 
injury both from flash fires and pool fires. In their model 
system the values of thermal radiation intensity and of 
time are for flash fires the effective values and for pool fires 
the actual values. 

Eisenberg, Lynch and Breeding also give the following 
relation for the threshold of burns, or first degree burns, 


obtained from the values in Table 16.79: 

(7 US = 550 x 10 3 [16.22.10]; 


16.22.16 Hymes models 

The review of burn injury given by Hymes, which has 
already been extensively quoted, does not include any new 
model as such. For fatal injury Hymes utilizes Equation 
16.22.9 of Eisenberg, Lynch and Breeding. He also gives a 
number of thermal injury effects which arlfa.bk summar¬ 
ized in Table 16.80. 

The work of Hymes covers most of the relevant aspects of 
burn injury, including clothing ignition, thresholds of pain 
and blistering, and burn fatalities. 

Some of the heat radiation limits and dos-response 
relations given by Hymes are shown in Figure 16.122, and 
others are given in the tables in Subsection 16.22.20. 

16.22.17 Green Book models 

A set of relations for thermal injury are given in the Green 
Book. For fatal injury, use is made of an adaptation of 
Equation 16.22.9 by Eisenberg, Lynch and Breeding. The 
modification is based on the fact that thermal radiation 
from nuclear weapons is in the UV range, whereas that 
from hydrocarbons is in the IR range. 

Two relations are given, one for persons unprotected hy 
clothing and one for those so protected. These are: 

Y = -36.38 + 2.65 In (f/ 4/3 ) Unprotected [16.22.11], 

Y = -37.23 + 2.56 In (tl i/3 ^ Protected [16.22.12] 

where I is the thermal radiation intensity (W/m 2 ) and t is 
the time of exposure (s). 

The Green Book also gives relations for non-fatal injury. 
For first degree burns 

F = -39.83 + 3.02 ln(f/ 4 / 3 ) 
and for second degree burns 
F at -43.14 + 3.02 ln(tf 4 / 3 ) 

16.22.18 Lees model 

Another model for injury by thermal radiation has been 
developed by Lees (1994a). The model is essentially a set of 
relationships which may be combined in various ways 
depending on the scenario modelled and which have been 
utilized by the author to produce a relation for fatal injury 
from a sudden heat release such as a fireball, subject to 
defined assumptions. 

The causative factor is taken as the thermal load 
L' = tl 4 ! 3 ([s(W / m 2 ) 4 / 3 ]/10 4 ). 

For the severity of the burn injury use is made of the 
relation given in Figure 16.120(a) of Hymes between ther¬ 
mal load and burn depth <5, which is equivalent to 

d = 8.85 x 10- 4 (Z/ - 920) [16.22.15] 

For the relationship between burn injury and mortality the 
data of J.C. Lawrence (1991) given inTable 16.78 are utilized. 

The fraction of the body exposed depends on the scenario 
considered. The base case is taken as an adult wearing light 
clothing such that the head, neck, hands and lower arms are 
exposed. From the data given in Subsection 16.22.10, it can 


[16.22.13] 

[16.22.14] 
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Table 16.79 Estimated relations between thermal radiation intensity and burn injury (after Eisenberg, 
Lynch and Breeding, 1975) 


A Nuclear weapons: effects and thermal injury 


Thermal radiation intensity (cal/cm 2 s) 


Weapon yield 

Pulse duration 

Thermal injury 

First degree burn 

Second degree burn 

Lightly clothed (summer) 

Few, if any, injuries 

Significant injury threshold 

Lethality 

Threshold 

Near 50% 

Near 0% 

20 kt 

1.43 

1.75 

3.14 

1.75 

2.80 

3.50 

6.30 

14.0 

lMt 

10.1 

0.297 

0.643 

0.297 

0.594 

0.792 

1.385 

3.07 

20 Mt 
45.2 

0.0886 

0.221 

0.0886 

0.210 

0.243 

0.442 

0.952 

B Thermal radiation intensity and mortality 

Mortality % 

Duration (s) 

Thermal radiation intensity 

Thermal load. 
(/*' 3 (s(W/m^ 3 ) 

(cal/cm 2 s) 

(W/m 2 ) 

1 

1.43 

3.50 

146 x 10 3 

1099 x 10 4 

1 

10.1 

0.792 

33.1 x 10 3 

1073 x10 4 

1 

45.2 

0.243 

10.2 x 10 3 

1000 x10 4 

50 

1.43 

6.30 

263.6 x 10 3 

2471 x10 4 

50 

10.1 

1.385 

57.95 x 10 3 

2264 x10 4 

50 

45.2 

0.442 

18.5 x 10 3 

2210 x 10 4 

99 

1.43 

14.0 

586 x 10 3 

7008 x 10 4 

99 

10.1 

3.07 

128 x10 3 

6546 x10 4 

99 

45.2 

0.952 

39.8 x 10 3 

6149 x 10 4 


be seen that the fraction exposed is about 10.5% at the front 
and 9.5% at the back. The total bare skin, or nominal 
exposed, area is taken as 20%. The corresponding group¬ 
ing in Table 16.78 is an exposed fraction of 18-22 %. 

The population considered is that in the age range 10- 
69 years (12 groups). Then for 18-22% exposure the aver¬ 
age mortality P ma given burn injury is 


P ma 


(0T 


3) +0.3+ 0.5 
12 


Table 16.80 obviously applies to a wide range of burn 
depths. Since it is desirable to be able to reflect the severity 
of burns: a particular burn depth d a is selected as that 
corresponding to the average mortality P ma of 0.09 just 
quoted. 

It is reasonable to assume that most burns treated are 
the less severe end of the range of burn depths. For the 
case just considered the burn depth corresponding to the 
average mortality P ma = 0.09 is taken as d a = 0.25 mm, 
which from Equation 16.22.15 corresponds to a thermal 
load L a = 1200 (W/m 2 ) 4 ^ 3 s/10 -4 . This thermal load cor¬ 
responds to the value for second degree burns given in 
Table 16.80. The thermal load at which the burn depth 
and the mortality are zero is given by Equation 16.22.15 
as 920 s (W/m 2 ) 4 / 3 /10 4 . Then, by linear interpolation 
between these two points of burn depth vs thermal load, full 
depth burn with d = 2.0 occurs at a thermal load LI, of 3200s 


Table 16.80 Some limits and dose-response relations 
for heat radiation (after Hymes, 1983 SRD R275) 
(Courtesy of the UKAEA Safety and Reliability Directorate) 


Thermal load (s(W/m 2 ) 4 ' 

' 3 /10 4 ) Effect 

210-700 3 

Threshold of blistering 

1200 b 

Second degree burn 

2600 c 

Third degree burn 

1060 d 

l%mortality 

2300 d 

50%mortality 

1100-4000 

Piloted ignition of clothing 

3000-10,000 

Unpiloted ignition clothing 


a There is evidence for a region of constant injury between these limits. 
b Second degree burns with a burn depth of 0.1 mm. This value is 
approximately the same as that for 50% mortality.Bum depth 
increase linearly up to a thermal load value of 2600. 

“Third degree bums with a burn depth of 2 mm. This value is 
approximately the same as that for 50% mortality. 
d Values based on the profit equation of Eisenberg, Lynch and 
Breeding (1975). 


(W/m 2 ) 4 / 3 /10 4 . Similarly, linear extrapolation gives at 
this thermal load a mortality P m of 0.64. By further linear 
extrapolation, P m = 1.0 occurs at a thermal load L' of 
4500 s (W/m 2 ) 4 / 3 /10 4 and an extrapolated, or notional/burn 
depth’<5 of 3.17. 
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Figure 16.122 Time to various levels of burn discomfort and injury due to heat radiation (Hymes, 1983.SRD R275) 
(Courtesy of the UKAEA Safety and Reliability Directorate) 


The relations between thermal load, burn depth and 
mortality in this model are then: 


Thermal load, 

L' (s (W/m 2 ) 4 / 3 /10 4 ) 

Burn depth, 

8 (mm) 

Mortality, P m 

920 

0 

0 

1200 

0.25 MJ 

0.09 (=Pa) 

3200 

2.0 

0.64 

4500 

3.17 (notional) 

1.0 


The variation of the mortality P m with burn 5 depth may 
expressed in terms of the average burn depth S a using the 
relations 

* “ 5<S * [16.22.16] 

S 2 = ^^ d>S a 16 22 17? 

where <5 is the burn depth (mm) and subscripts a, 1, u, 1 
and 2 denote average, lower, upper, first coefficient and 
second coefficient, respectively. The mortality P m is then 
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obtained as 

P m = d 1 P rm 5<S a [16.22.18] 

P m = P ma + <5 2 (1 - P ma ) «5>,5 a [16.22.19] 

The thermal radiation intensity used is the value incident 
on the person after atmospheric attenuation. 

The exposure of the person to this radiation depends 
his behaviour. One model of response is that he faces event 
for the response time of 5 s and then turns his back and 
runs away. However, as described in Subsection 16.22.9, 
there is evidence, on the one hand, of shorter response 
times but, on the other, of a tendency to turn round to look at 
the event. From the data given above the fraction of the 
body exposed when facing the event is greater than that 
exposed when the back is turned to it, but the difference is 
not great. The base case adopted is, therefore, that, at least 
until any clothing ignition, the front and back are equally 
exposed. 

At this stage there are a number of corrections which 
might be applied. One is for the three-dimensional effect 
discussed in Subsection 16.22.12. Another is for the angle 
of incidence of the radiant heat on the body surface. In the 
base case a single factor <f> of 0.5 is used, which takes 
account of the fact that only about half the bare skin is 
exposed to the thermal radiation at a given time. This factor 
is applied to the time t in the thermal load expression, which 
thus becomes <ptl i/3 so that a given thermal load applied to 
half the exposed surface over a given time interval t is 
treated as equivalent to half that load applied to the 
whole exposed surface over the same time interval. 

For clothing ignition correlations have been developed 
using different ‘thermal loads’. One of those used by Hymes 
is the regular thermal load tl i/3 and it is this which is uti¬ 
lized. With respect to the load at which clothing ignition 
occurs, the value adopted corresponds to the middle value 
of the range of ‘load’ given in the Green Book. Thus from 
Equation 16.22.8 

tl 2 = 3.5 x 10 4 s(kW/m 2 ) 2 

which for a 5 s pulse gives an intensity I = 84 kW/m 2 and 
a thermal load 

l! = f/ 4 / 3 w 1800 s(W/m 2 ) 4/3 /10 4 

Clothing ignition is taken in the model as resulting in 
the doubling of the effective exposed area. Following such 
ignition, therefore, this area is taken as the nominal 
exposed area. Thus from this point the factor p has a value 
of unity. 

Table 16.81 shows for this model the burn depth and the 
mortality as a function of the thermal load. The profit 
equation for fatal injury obtained from these data is 

Y m -10.7 + 1.99 InL' [16.22.20] 

where L' is the thermal load ([s (W/m 2 ) 4 / 3 ]/10 4 ). 

This profit equation is based on the mortality values 
given in Table 16.81, except the last value of 1.0. A describ¬ 
ed above, in the model a thermal load of 4500 is taken as 
corresponding to a mortality of unity. Therefore the probit 
equation is used only up to a mortality of 70%, and the 


Table 16.81 Lees model for burn injury from a sudden 
fire event such as a fireball (Lees, 1994a): mortality as 
a function of thermal load (Courtesy of the Institution of 
Chemical Engineers) 


Thermal load, 

L' 

([s (W/m 2 ) 4 / 3 ]/10 4 ]) 

Burn depth, 
<5 (mm) 

Mortality, 
P m (%) 

Mortality 

(Eisenberg) 

(%) 

1000 

0.07 

0.025 

0.015 

1200 

0.25 

0.09 

0.04 

1400 

0.42 

0.14 

0.09 

1600 

0.60 

0.20 

0.16 

1800 

0.78 

0.26 

0.24 

2000 

0.96 

0.31 

0.33 

2500 

1.4 

0.45 

0.55 

3000 

1.84 

0.59 

0.73 

3200 

2.00 

0.64 

0.78 

4500 

3.17 

(notional) 

1.0 

0.95 


following relations are used thereafter: 

P m = 0.70 + 0.0003(L'- 3500) Z/<4500 [16.22.21a] 

P m = 1.0 L! > 4500 [16.22.21b] 

Also shown inTable 16.81 for comparison are the mortalities 
predicted by Equation 16.22.9 of Eisenberg, Lynch and 
Breeding. Apart from those at very high thermal loads, the 
values are not greatly different. The difference between 
the method of these authors and that of Lees lies in the 
treatment of the effective exposed area. 

In Section 16.15 an account has been given of the 16 fire¬ 
ball model by VG. Marshall (1987). Table 16.82 illustrates 
the application of Lees’ model to the case of the 20 te fireball 
considered by this author. For this fireball the spherical 
radius is 75 m, the hemispherical radius 95 m, the dura¬ 
tion 10.3 s and the crude thermal radiation intensity 
2.17 x 10 9 /x z W/m 2 , where x is the distance from the centre 
of the fireball to the target (m). In the calculation underlying 
the data in Table 16.82, use was made of the atmospheric 
attenuation factors given by Marshall and the fireball 
duration time was rounded to 10 s. Also shown in the table 
are the predictions of mortality from the Eisenberg probit 
applied to the unadjusted thermal loads for the full dura¬ 
tion time of 10 s. In his discussion of the rotational factor, 
Marshall suggests that whereas the Eisenberg probit gives 
for a such a fireball a distance of 170 m to 50% mortality, 
experience of incidents indicates this is much too far, and 
he tentatively suggests that the distance of about 90 m 
given by assuming rotation through 360° is closer to reality. 
From the table, Lees’ model gives a distance of 125 m. 

Lees states that his model, whilst not intended to be 
conservative and whilst less so than the Eisenberg relation, 
may nevertheless still be so. 

16.22.19 Prugh model 

A model for burn injury from exposure to a fireball 
has been given by Prugh (1994). He presents a summary of 
data on burn injury, which for fatality draws on the work 
of Eisenberg, Lynch and Breeding (1975), Lees (1980b), 
A.F. Roberts (1982) and the Society of Fire Protection 
Engineers (1988 NFPA/22). From these data he derives the 
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Table 16.82 Lees model for burn injury from a sudden fire event such as a fireball (Lees; 1994a): illustrative example of 
mortality from a 20 te LPG fireball (Courtesy of the Institution of Chemical Engineers) 


A Physical conditions 


Distance (m) 

Thermal radiation 
intensity (kW/m 2 ) 

Thermal load 
factor, L'It 
((W/m 2 ) 4 / 3 /10 4 ) 

Time to 
ignition, t (s) 


Thermal load 
(s (W/m 2 ) 4/3 /10 4 ) 


Crude, I 

Attenuated, I e 

Before ignition After ignition 

Total, L' 

75 a 

390 







95 b 

240 

173 

964 

3.73 

1800 

6044 

7844 

105 

197 

142 

738 

4.89 

1800 

3771 

5571 

115 

164 

118 

577 

6.24 

1800 

2169 

3969 

125 

139 

97 

444 

8.11 

1800 

839 

2639 

135 

119 

83 

361 

9.97 

1800 

54 

1854 

145 

103 

72 

298 

N 

(1490) 

N/A 

1490 


B Thermal injury 


Distance (m) 

Clothing 

ignition 

Mortality 

P»(%) 

Mortality 
(Eisenberg) (%) 

75 a 

Y 

1.0 

1.0 

95 b 

Y 

1.0 

1.0 

105 

Y 

1.0 

1.0 

115 

Y 

0.84 

0.99 

125 

Y 

0.49 

0.95 

135 

Y 

0.23 

0.86 

145 

N 

0.12 

0.72 


a Radius of spherical fireball. 
b Radius of hemispherical fireball. 


following correlation for the probability P of fatality: 

P = {1 + [1 - exp{-5.3[ln(£/53)] 2 }f s } x [1 - 2(£/53)] 
[16.22.22] 

where E is the thermal dose (J/m 2 ). He presents a graphi¬ 
cal comparison of this equation with the two Green Book 
relationships for unprotected and protected exposure, 
which shows that the mortalities predicted by his correla¬ 
tion are appreciably lower. 

With regard to the extent of the burns and to medical 
treatment, Prugh gives a graph of mortality vs fraction of 
the body with third degree burns, based on the data of 
J.W. Davies (1982), but states that such treatment is pre¬ 
sumably already taken into account in the basic mortality 
data which he uses. 

Combining the fireball model and the injury relation¬ 
ships, Prugh derives for a propane fireball a graphical 
correlation for mortality, which is a function of the mass of 
fuel and the distance of the person exposed. He also gives 
equations, which are considered in Section 16.39. 

16.22.20 Thermal radiation limit 

There are a number of empirical limits of thermal radiation 
which have traditionally been used in plant design. Other 
limits are quoted in work on hazard assessment. Some of 
these limits are quoted in Table 16.83. 

16.23 Fire Protection of Process Plant 

In general, fire prevention and protection measures 
constitute either (1) passive prevention and protection or 
(2) active protection. 


Reference has already been made to some principal 
publications on fire in relation to process plants, but it is 
appropriate to refer here to Practical Fire Protection 
(Underwood, 1971—) and Underwood’s Practical Fire 
Protection (Hirst; 1989), Fire Protection Manual for Hydro¬ 
carbon Processing Plants (Vervalin, 1964a, 1973a), Storage 
and Handling of Petroleum Liquids: Practice and Law 
(J.R. Hughes, 1970), to the NFPA codes and to BS 5908:1990 
Code of Practice for Fire Precautions in the Chemical and 
Allied Industries. 

16.23.1 Passive fire protection 

Passive prevention and protection comprises measures 
which are taken in order to prevent a fire occurring and to 
limit its spread. Measures of active protection comprise 
fixed and mobile fire fighting systems and emergency 
arrangements. 

As a broad generalization, passive fire protection has the 
great advantage that it is very much less dependent on the 
intervention of protective devices or of humans, both of 
which are liable to fail, and is therefore that much less vul¬ 
nerable to management failings. 

One of the principal passive fire protection measures is 
fireproofing. In general this has the advantages just men¬ 
tioned. But it also brings with it the risk that corrosion may 
occur under the fireproof coating and may be difficult to 
detect. Another problem with fireproofing is the fact that it 
may not withstand the action of the powerful water jets 
used in fire fighting. 

Insofar as management has some control over both these 
features - the avoidance of corrosion and of loss of coating 
by water jets - they illustrate the fact that even the use of 
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Table 16.83 Some limits for thermal radiation 
A Design guidance: IP LPG Storage Code 1987 

See Table 22.8 


B Design guidance: API RP 510:1990 


Thermal 
radiation 
intensity 
(kW/in ) 

“ 

15.6 

Intensity on structures where operators are 
unlikely to be performing and where 
shelter is available 

9.5 

Intensity at design flare release at locations 
to which people have access and where 
exposure would be limited to a few 
seconds for escape 

6.3 

Intensity in areas where emergency actions 
lasting up to 1 min may be required 
without shielding but with protective 
clothing 

4.7 

Intensity in areas where emergency 
actions lasting up to several 
minutes may be required 
without shielding but with 
protective clothing 

1.6 

Intensity at design flare release at 
locations where people are 
continuously exposed 

C Design guidance: Kletz (1980h) 

Thermal 

Limit 

radiation 

intensity 

(kW/nr) 

38 

Intensity on storage tanks 

12.5 

Intensity on wood or plastics 3 

5 

Intensity on people performing 
emergency operations 

D Design and assessment guidance BS 5980: 
199(r 

Thermal 

Limit 

radiation 

intensity 

(kW/m 2 ) 

37.5 

Intensity at which damage is caused to 
process equipment 

25 

Intensity at which non-piloted ignition of 
wood occurs 

12.5 

Intensity at which piloted ignition of wood 
occurs 

4.5 

Intensity sufficient to cause pain to 
personnel unable to reach cover in 20 s, 
though blistering of skin (first degree 
burns) unlikely 

1.6 

Intensity insufficient to cause 
discomfort 
for long exposures 


E Design and assessment guidance: Mecklenburgh 

(1985) 


Thermal 

radiation 

intensity 

(kW/m 2 ) 

Limit 

14 

Intensity which normal buildings should be 


designed to withstand 

10-12 

Intensity at which vegetation ignites 

6 

3 

Intensity tolerable to escaping personnel 
Intensity tolerable in infrequent emergency 


situations of up to 30 min duration 

1.5 

Intensity safe for stationery personnel and 


members of the public 

F Assessment guidance: Dinenno (1982) 

Thermal 

radiation 

Limit 

intensity 

(kW/m 2 ) 


30 

Spontaneous ignition of wood 

15 

Piloted ignition of wood 

20 

Ignition of No. 2 fuel oil in 40 s c 

10 

Ignition of No. 2 fuel oil in 120 s c 

18-20 

Cable insulation degrades 11 

12 

Plastic melts 6 

37.5 

Equipment damage 1 

9 

Equipment damage 1 


a Kletz comments that the implication of this limits that large storage 
tanks need to be located at least 200 m from public roads. 
b BS 5908:1990 also gives a thermal dose of 600-1800 kj/m 2 from a 
fireball as a criterion for the starting of secondary fires. 

C EPRI (1981a). 
d EPRI (1979b). 
e Gelderblom (1980). 

f Di Nenno comments that there is significant variation in the thres¬ 
holds for equipment damage. He gives the source of the value of 
37.5 kW/m 2 as Gelderblom (1980), and treats the value of 9.5 kW/m 2 
given by Tan (1967a), in relation to flare system design, as 


passive fire protection measures does not avoid the need for 
good management. 

The optimum solution to the fire protection problem 
is normally a combination of passive and active measu¬ 
res. Often passive fire protection can limit fire spread and 
can ‘buy time’ in which the firefighting resources can be 
mobilized. 

16.23.2 Active fire protection 

Active fire protection measures are also provided in the 
basic plant design, but are effective only when activated in 
response to a fire. Elements of active fire protection are: 

(1) fire warning systems; 

(2) fire detection systems; 

(3) firefighting agents; 

(4) fire water supply system; 

(5) fixed firefighting systems; 

(6) mobile firefighting systems. 
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Item (1) of these measures is described in Chapter 24 and 
item (4) in Chapter 10, while the other items are dealt with 
below. 

16.23.3 Fire detection and alarm 

The initiation of active fire protection measures, whether 
fixed systems or mobile firefighting systems, depends on 
the fire detection and alarm arrangements. 

Accounts of fire detection and alarm are given by Fry and 
Eveleigh (1975 BRE CP 32/75) and P. Nash and Young (1975 
BRE CP 29/75). Treatments of water sprinkler and water 
spray systems also frequently deal with detection systems. 

Relevant codes and standards are the NFPA 72 series, 
particularly NFPA 72E: 1990 Automatic Fire Detectors, 
BS 5445: 1977 — Components of Automatic Fire Detection 
Systems, BS 5839:1988 - Fire Detection and Alarm Systems 
for Buildings and, until recently, BS 6020: 1981 - Instru¬ 
ments for the Detection of Combustible Gases, now super¬ 
seded by the series BS EN 50054-50058 which has the 
general title Electrical Apparatus for the Detection and 
Measurement of Combustible Gases. 

When a fire occurs, two things which are of prime 
importance are to ensure the safety of personnel and the 
prompt initiation of action to deal with the fire. The most 
effective way of ensuring rapid action is generally the use 
of an automatic system. But in situations where personnel 
may be present the arrangements need to ensure that they 
are not put at risk by the action of the automatic system. 

There are several different types of system for the 
detection of leakage and/or fire. They may be classified 
according to whether they detect (1) leakage, (2) flame, 
(3) heat or (4) smoke. These systems and the devices used 
are listed in Table 16.84. 

In general, it is preferable to detect a leakage in its initial 
stages and before it ignites. On the other hand, some types 
of fire, such as lagging fires, are not preceded by readily 
detectable leakage. 

The alternative is to detect the fire itself. This is done 
most rapidly by flame detection. Detection of the heat and 
smoke from the fire is possible only after it has developed 
to some extent. 

Some important characteristics of detection systems are: 

(1) area covered; 

(2) response time; 

(3) reliability 

(a) fail-to-danger faults, 

(b) fail-safe faults (spurious alarms); 

(4) cost. 

The area covered by a detection device is important, 
because a small coverage leads to a complex and expensive 
system. The reliability is also important both in respect of 
fail-to-danger faults and of fail-safe faults which cause 
spurious alarms. 

Detection of abnormal conditions, including leakage and 
fire, is a basic function of the process operator. He is cap¬ 
able of detecting such conditions by all the modes describ¬ 
ed and gives wide coverage with high reliability and low 
cost. His great disadvantage is that he may not respond 
rapidly enough, not only in making the initial detection but 
also in initiating firefighting action. 

Instrument detection systems are therefore widely used. 
In many cases they are part of a fully automatic system 
which triggers protective devices such as steam curtains, 


Table 16.84 Some detection systems for fire protection 


Basis of detection 

Detector 

All modes 

Humans 

Leakage 

Flammable gas detector 

Flame 

Infrared detector 

Ultraviolet detector 

Heat 

Temperature measuring instrument 
Quartz bulb detector 

Gun cotton bridge and wire 

Fusible link and wire 

Temperature sensitive resistor 

Air line 

Smoke 

Smoke detector 


or releases firefighting agents. In other cases, however, the 
function of the detection system is limited to providing an 
alarm signal to the operator, which he then has to interpret. 
There are several reasons for not always making the sys¬ 
tem fully automatic. One is that detection systems are liable 
to give spurious alarms; another is that it is not always easy 
to define in advance precisely what is required. It is often 
difficult, for example, in an automatic water spray system 
to avoid wasting water in cooling plant where this is not 
really necessary. This is important, because the quantities 
of water required for water sprays are large. 

The most widely used type of system is the combustible 
gas detection method. Descriptions are given by several 
authors (e.g. Bossart, 1974; Dailey; 1976; Johnson, 1976). 
There are two main types of combustible gas detection. One 
consists of a number of devices which sample the atmos¬ 
phere at different points and pass the sample back to a 
common analyser. Typical sample pipe velocities are 3 m/s 
and sampling rates 10-30 s per point. 

There are a variety of instruments available for com¬ 
bustible gas analysis, based on the measurement of the 
heat produced by a catalytic reaction, radiant energy, 
absorption, ionization phenomena, electrochemical effects, 
colorimetric effects and gas chromatography. Details are 
given by Dailey. 

A single instrument system is, in general, most appro¬ 
priate where the analyser itself is very complex and 
expensive and where some time delay is acceptable. These 
characteristics appear to make it more suitable for detect¬ 
ing toxic gases which pose a long-term hazard, but less so 
for detecting flammable gases, where the analytical 
instruments are comparatively simple but fast response is 
important. Common analyser systems have in fact been 
subject to severe criticism by some users (e.g. Kletz, 1976i) 
as being excessively slow in response and liable to faults 
such as blockage. 

The other system, which is preferred by such users, 
utilizes an individual catalytic diffusion type detector at 
each detection point. Generally, a combustible gas detector 
is installed and calibrated for one particular hydrocarbon 
gas, but will respond to others. The instrument scale 
is usually calibrated as 0-100%of the lower explosive 
limit (LEL). The output of a detector calibrated on propane 
will read some 20% high on methane and some 20% low on 
propylene. 

Catalytic detectors are susceptible to poisoning. In 
particular, silicone grease and silicone rubber sealants 
have been found harmful. Combustible gas detector 






FIRE 16/255 


instruments should be regularly serviced. Portable detec¬ 
tors should be checked before use. 

There tends to be some trade-off between the speed of 
response and the number of spurious signals obtained. It is 
suggested by Johanson that the specification for response 
time is generally too tight and that an allowance of a few 
seconds delay reduces the number of false alarms. 

There are various approaches to laying out the detection 
points. Generally, it is desirable to have detectors around 
the periphery. Other detectors are then sited according 
to principles such as uniform coverage, location at leak 
sources, location between leak and ignition sources. 

The optimum height of the sample point depends on the 
density of the gas. Johanson suggests installation at iy 2 
and 6-8 ft heavy and light gases, respectively. It is also 
necessary to take into account depressions, roofed areas 
and other pockets. 

A combustible gas leakage detection system may be 
used to provide alarm signals in the control room or to 
initiate protective action by water sprays or by a steam 
curtain. 

Detection of a flame is done by infrared or ultraviolet 
detecting instruments. The response time of the former is 
generally about 10 s, while with the latter it is almost zero. 
The reliability of these relatively complex instruments is a 
problem, particularly, although not exclusively, because 
they tend to give frequent false alarms, but there has been 
considerable improvement in this aspect. The instruments 
are also comparatively expensive. Again a flame detection 
system may be used to give alarm signals or to trigger 
water sprays. 

There are a number of devices which detect heat. They 
include temperature measuring instruments, quartz 
bulbs, and devices which explode, melt or change char¬ 
acteristics when exposed to fire. The latter include gun¬ 
cotton bridges and wire, fusible links and wire, air lines 
which melt through and resistors which change resistance. 
Measuring instruments can be used to furnish alarm sig¬ 
nals or to set off water sprays, but the other devices are 
generally used for the latter purpose. Thus a simple detec¬ 
tion system might be based on an air line which can be 
melted through by a fire so that the air pressure in the line 
falls, allowing the drench valve on apply the water spray 
system to open. 

A quartz bulb detector figured prominently in the 
Flixborough inquiry (R.J. Parker, 1975, pp. 20-26, espe¬ 
cially paragraphs 137, 156, 157 and 160, and figure 8). 
According to the 8 in. pipe hypothesis, a fire occurred at a 
non-return valve in a lagging box. There was believed to be 
a quartz bulb some 12 in. above the top of the valve and 
some 18 in. to the east which was set to actuate a water 
spray system at a temperature of 68°C or above. It was 
a matter of dispute whether there could have been a fire 
at the lagging box without activation of this detector. 
Proponents of the 8 in. pipe hypothesis argued that either 
there was no quartz bulb or that it did not operate. Calcu¬ 
lations were done which were said to show that heat 
radiation from the assumed flame would not be enough to 
trigger the detector and that heat radiation from the pipe¬ 
work would be necessary to do this. The assessors con¬ 
sidered, however, that if the hypothesis were correct the 
sensor would have been triggered by other flames and 
radiating surfaces present. In any event, the water spray 
system apparently did not operate. These points are of 
some importance, because they bear on the effectiveness of 


detector systems. Further discussion of the matter is given 
byj.l. Cox (1976b). 

Another method of detecting fire is by smoke detectors. 
These are widely used in buildings, but appear likely to be 
less effective for fires on open plant. 

16.23.4 Emergency material transfer 

It is necessary to have arrangements so that in the event of 
fire it is possible to transfer flammable material away from 
the parts of the plant affected. Provision of a relief header 
leading to a vent stack or flare stack allows vapour to be 
vented safely from pressure vessels. The removal of liquid 
from a pressure vessel may be catered for by facilities for 
blowdown to a suitable receiver. Similarly, pumps may be 
installed on atmospheric storage tanks to allow liquid to be 
transferred out. 


16.23.5 Dow Fire and Explosion Index 

The Dow Fire and Explosion Index given in the Dow Guide 
has been described in Chapter 8, where the method of cal¬ 
culating the index was outlined. The purpose of the index 
is to assist in the selection of preventive and protective 
features. 

The following set of preventive and protective features 
are listed in the Fourth Edition of the Guide (Dow Chemical 
Company, 1976): (1) basic preventive and protective features 
and (2) recommended minimum preventive and protective 
features. The latter features are not given as such in the 
later editions, but the Fifth Edition introduces loss control 
credits, which cover similar ground, and also an engineer’s 
checklist. Table 16.85 lists the basic preventive and protec¬ 
tive features given in the Seventh Edition (Dow Chemical 
Company, 1994) and Table 16.86 lists the headings of the 
recommended minimum preventive and protective features 
in the Fourth Edition. 

The features shown in Table 16.85 should always be pro¬ 
vided, irrespective of the degree of hazard. If they are not, 
the hazard will be greater than that calculated by the index. 
Many of them apply in any plant, regardless of whether it 
contains flammable materials. 

It should be noted that the codes and electrical area 
classification mentioned in Table 16.85 are those applicable 
in the United States. 

Table 16.86 lists headings of the features which should 
always be considered where a fire or explosion hazard 
exists. The detailed measures under these headings 
are described in the Guide. The features are intended to 
reduce the magnitude and/or the probability of the loss. 
The need for a particular feature depends on the nature of 
the hazard. 

The Dow Fire and Explosion Index is widely used as 
an aid to the selection of fire preventive and protective 
features, and is therefore a relatively well-proven method. 
Nevertheless, it is a generalized method and, if used, it 
should be supplemented by specific hazard identification 
and assessment studies which may reveal the need for other 
preventive and protective features. 


16.24 Passive Fire Protection 

The previous section has given an account of the gen¬ 
eral nature and purpose of passive fire protection. In this 
section specific passive fire protection measures are 
considered. 
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Table 16.85 Dow Guide: Basic Preventive and 
Protective FeaturesfSeventh Edition) (Dow Chemical 
Company, 1994; reproduced with permission) 


A Adequate water supply for fire protection, This is 

determined by multiplying the water demand by the 
length of time for which the worst possible fire can be 
expected to last. The supply deemed adequate will 
vary with different authorities and may range from 
enough for a 2-h fire to enough for one lasting 8 h 
B Structural design of vessels, piping, structural steel, etc. 
C Overpressure relief devices 
D Corrosion resistance and/or allowances 
E Segregation of reactive materials in process lines and 
equipment 

F Electrical equipment grounding 
G Safe location of auxiliary electrical gear (transformers, 
breakers, etc.) 

H Normal protection against utility loss (alternate 

electrical feeder, spare instrument air compressor, 
etc.) 

I Compliance with various applicable codes (ASME, 
ASTM, ANSI, Building Codes, Fire Codes, etc.) 

J Fail-safe instrumentation 

K Access to area for emergency vehicles and exits for 
personal evacuation 

L Drainage to handle probable spills safely, plus 

firefighting water from hose nozzles and sprinkler 
heads and/or chemicals 

M Insulation of hot surfaces that heat to within 80 % of the 
autoignition temperature of any flammable in the area 
N Adherence to the National Electrical Code,The Code 
should be followed except where variances have been 
requested/ approved 

0 Limitation of glass devices and expansion joints in 
flammable and hazardous service, Such devices are 
not permitted unless absolutely essential. Where 
used, they must be registered and approved by the 
production manager and installed in accordance with 
Dow standards and specifications 
P Building and equipment layout. Separation of high- 
hazard area must be recognized especially as it 
relates to both property and interruption of business. 
Separation of tanks must be at least in accordance 
with NFPA 30 

Q Protection of pipe racks and instrument cable trays as 
well as their supports from exposure to fire 
R Provision of accessible battery limit block valves 
S Cooling tower loss prevention and protection 
T Protection of fired equipment against accidental 
explosion and resultant fire 
U Electrical classification. Division 2 electrical 

equipment will be required for outside flammable 
liquid handling where congestion is minimal and 
natural ventilation, is unobstructed, Division 1 
equipment is required only for special chemicals 
and/ or special building or process handling 
conditions or where ventilation is inadequate 
V Process control rooms shall be isolated by 1 fire walls 
from process control laboratories and/or electrical 
switchgear and transformers 
W A process review shall determine a need for reactive 
X A hazard and operability (hazop) review is 
recommended in high hazard areas 


Table 16.86 Dow Guide: Minimum Preventive and 
Protective Features (Fourth Edition) (Dow Chemical 
Company, 1976) - these features are listed in the 
Guide which gives a detailed description of them 


1 Fireproofing 

2 Water spray protection of equipment and area 

3 Foan or filming agents 

4 Monitor guns 

5 Dump, blowdown or spill contrl 

6 Combustible gas monitors 

7 Diking for storage tanks 

8 Buried tanks 

9 Foam on tanks 

10 Remote manual Control 

11 Special instrumentation 

12 Fire Walls and barrier walls/cubicles 

13 Building ventilation 

14 Dust explosion control 

15 Open explosin structure 

16 Emergency relief venting for buildings 


Measures of fire prevention and passive fire protection 
are built into the basic plant layout and design. They 
include such aspects as: 

(1) elimination of fires 

(a) leaks and spillages, 

(b) sources of ignition; 

(2) emergency material transfer 

(a) pressure relief and flaring, 

(b) blowdown, 

(c) dumping; 

(3) fire spread limitation; 

(4) fire protective insulation 

(a) fire resistant thermal insulation, 

(b) fire insulation; 

(5) storage tank layout. 

Of these measures, items (1) and (2) have been dealt 
with already in this chapter and item (5) is considered in 
Chapters 10 and 22. The Other items are described below. 

16.24.1 Fire spread limitation 

There are certain plant configurations which assist fire 
spread, By avoiding or modifying these configurations, 
fire spread may be limited. 

Two examples given by Klootwijk (1976) are shown in 
Figure 16.123. In a fire a chimney effect can develop in the 
space between a table top and a tall equipment or structure 
as illustrated in Figure 16.123(a). Such an effect tends to 
increase damage and to extend it to a higher level. Where a 
potential chimney cannot be avoided, it may be appropriate 
to install a water spray system to control fire in the area. 

A chimney effect can also occur between a table top and 
the bottom of a large column. In this case the opening 
should be closed off with a support skirt, as shown in 
Figure 16.123(b). 

Another way in which fire can spread is by the flow of 
a burning liquid. The plant layout with regard to this aspect 
should be carefully considered, It is normal practice to 
put bunds around storage tanks. But there may be other 
situations which can give rise to liquid flow, Drains, sewers 
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Figure 16.123 Fire spread and its limitation (Klootwijk, 1976): (a) chimney effect between table top and a tall structure; 
(b) elimination of the chimney effect between a table top and the bottom of a column by use of a steel support skirt 


and pipe trenches are features which are particularly liable 
to aggravate this hazard. 

16.24.2 Fire resistant thermal insulation 

Many items of equipment are fitted with thermal insula¬ 
tion. This is to be distinguished from fire insulation proper. 
Nevertheless, provided it is of the right type, thermal 
insulation can provide a degree of fire protection. Much 
process plant is thermal insulated, as are low temperature 
storage tanks. 

The fire resistant properties of regular thermal insula¬ 
tion are considered in Chapter 12. The fire protection 
offered by such insulation on storage tanks is discussed in 
Chapter 22. 

16.24.3 Fire insulation 

Some form of structural protection against fire, in the form 
of fire insulation or fireproofing, is normally provided for 


supporting members, and also for vessels and pipe work. A 
general account of fireproofing has been given by Waldman 
(1967). 

Factors which need to be taken into account in consider¬ 
ing such fireproofing include: 

(1) protection criteria 

(a) type of structure, 

(b) height of structure, 

(c) degree of protection; 

(2) fireproofing system. 

There are differences of practice in the types of structure 
which are fireproofed. The main emphasis is generally on 
the protection of supporting members. Fireproofing is 
sometimes limited to supports of major items such as large 
columns or vessels, but it is often extended to supports of 
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other items, such as heat exchangers and pipework. In some 
cases it is applied to the vessels and pipework themselves. 

The main object of fireproofing is to prevent the failure in 
a fire of items containing flammable material which can 
feed the fire. Fireproofing may not be needed, therefore, for 
items with a small inventory, unless failure could lead to 
large loss of containment from some other source. 

The height above grade, or ground level, to which the 
protection extends is also variable. Most fires do not reach 
much more than 10 m above grade, although there have 
been instances of damage at heights of 30 m or more. It 
is suggested Waldman that fireproofing should extend to 
35 ft (10m) above grade. 

It is also necessary to decide on the degree of protection 
required. A common criterion is that the steel member 
should not reach a temperature greater than 1000°F (538°C) 
under specified fire conditions. 

In deciding on the degree of protection required for fire¬ 
proofing, allowance may be made for other fire protection 
features, such as water sprays. It is the whole fire protection 
system which matters. In general, the aim should be to pre¬ 
vent a fire occurring at all near a vulnerable structure. It is 
better to provide drainage to take the flammable liquid away 

A fireproofing system normally consists of a bulk insu¬ 
lation material which gives protection against fire. This 
bulk fire insulation may be clad with aluminium, galva¬ 
nized or stainless steel sheet. Such fire insulation should he 
distinguished from conventional insulation which is used 
to reduce heat transfer between the plant and the atmos¬ 
phere. Such insulation mayor may not have fire resistant 
properties. Materials which are widely used as the bulk fire 
insulation include (1) concrete and (2) magnesium oxy¬ 
chloride cement. Concrete is often used in the form of 
lightweight aggregate concrete, or vermiculite cement. 

Protection against fire may also be obtained by the use of 
a mastic, which may be asphaltic or vinyl acrylic. Mastics 
are used to fireproof not only plant but also conventional 
insulations. 

Some materials used as the bulk fire insulation have 
special fire resistant properties. Magnesium oxychloride, 
for example, contains water of crystallization, which takes 
up heat when it is driven off. Similarly, some coating 
materials have properties which increase their effective¬ 
ness in fireproofing. Intumescent mastics swell in fire by a 
factor of 5-10 and this gives increased insulation. 

Some features of a fireproofing system include: 

(1) insulation properties; 

(2) mechanical strength; 

(3) corrosion 

(a) substructure, 

(b) reinforcing; 

(4) water penetration; 

(5) flexibility; 

(6) weight; 

(7) ease of installation; 

(8) cost. 

Fireproofing should provide sufficiently effective insu¬ 
lation to keep the temperature of the structural member to 
be protected below a specified temperature under defined 
fire conditions. It has been suggested by Kayser (1974) that 
the ideal system will hold the substrate below 1000°F 
(538°C) for iy 2 h while its surface is exposed continuously 
to a temperature of 1800°F (982°C).The maximum substrate 


temperature of 1000°F is that widely quoted, but the maxi¬ 
mum period of protection is generally less. Thus Waldman 
suggests, for example, that in order to allow for spray fail¬ 
ure protection is required for 1 h. This time period is also 
quoted by other workers, as described below. 

The mechanical strength of the fireproofing should be 
sufficient to offer reasonable resistance to damage both 
from normal plant activities and from water from fire hoses. 

The bulk fire insulation should not be corrosive to the 
substrate or to the reinforcing material. The substrate should 
he made clean and rust free before the insulation is put on. 

It is essential that water should not be allowed to penetrate 
the insulation and corrode the substrate or the reinforcing 
material. Corrosion of the steel structural members is diffi¬ 
cult to detect, but could have serious results. The coating or 
cladding used should therefore offer complete protection, 
particularly at horizontal surfaces where water may get in. 

The insulation should be able to accommodate, without 
cracking, the expansion and contraction of the structure 
protected. Other desirable features are light weight, ease of 
application and low cost. 

A fireproofing system which is widely used is concrete 
with galvanized steel sheet cladding (Klootwijk, 1976). Ver¬ 
miculite cement and magnesium oxychloride cements are 
also much utilized. 

Some illustrations of fireproofing of structural supports 
are shown in Figure 16.124. 

16.24.4 Tests for fire insulation 

There is frequently a requirement to test a proposed fire¬ 
proofing system. Unfortunately, there is no standard test 
appropriate to structural elements in a flammable liquid 
fire, which is the typical situation in process plant. Many 
experimenters have resorted, therefore, to the ASTM E-119 
standard time-temperature test, which was devised for 
building fires. The test involves maintaining the element 
in a standard fire in which the temperature rises along 
the standard curve shown in Figure 16.125, curve 1. The 
criterion of success is the ability of the element to carry out 
its original function, in this case fireproofing. The ASTM 
E-119 test is discussed further in Section 16.36 in relation to 
its original application to fires in buildings. Most workers 
have used as the criterion of success the ability of fire¬ 
proofing to keep the temperature of the steel protected 
below 1000°F (538°C) for a period of 1 h. 

It has long been recognized that the ASTM curve tends to 
underestimate the temperatures which occur in fires of 
hydrocarbons. An early proposal for a higher temperature 
relation was made by Waldman (1967), who gave two alter¬ 
native curves. 

The unsatisfactory nature of the ASTM E-119 test in 
this application has been demonstrated by Castle (1974). 
He emphasizes that in order to assure similarity of test con¬ 
ditions it is necessary to use not only the same temperature 
but also the same heat fluxes. He presents experimental 
results which illustrate this point. He also discusses the 
alternative pool and pit fire tests and states that a pit fire test 
is generally a more severe one than the ASTM E-119 test. 

Since then several other time—temperature curves have 
gained currency. Two of these are shown in Figure 16.125. 
Curve 2 is that of the Norwegian Petroleum Directorate 
(NPD). Curve 3 is generally known as the ‘Mobil curve’. 

The use of a standard time—temperature curve for 
hydrocarbon fires leads to an H rating, as opposed to the A 
rating obtained by using a curve suitable for building fires. 
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Figure 16.124 Fireproofing of structural supports (Klootwijk, 1976): (a-d) supporting structure of small storage v< 
(e-g) supporting structure of fin-fan cooler and (h) supporting structure of fin-fan cooler and overhead pipe track 
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Figure 16.125 Some time-temperature curves for fires in process plant. Curve 1, ASTM E 119-1988; Curve 2, 
Norwegian Petroleum Directorate; Curve 3, ‘Mobil’ curve (after Cullen, 1990) 


Another test which is utilized is the ASTM-84 surface 
burning test, in which a standard fire is used to evaluate the 
rate of flame spread across the surface of the element. The 
later is rated on a scale on which the points 0 and 100 cor¬ 
respond to asbestos cement and redwood, respectively. An 
index above 25 is generally regarded as unsatisfactory for 
fireproofing. The use of this test is described by Feldman 
(1974). 

Much equipment and pipework is provided with insula¬ 
tion which serves primarily to conserve heat or cold in the 
process. Such insulation is different from that used for 
fireproofing. But it is important to know what degree of 
protection against fire it offers. 

Experiments on insulations commonly used for pipe¬ 
work have been described by McMillan (1974). The test 
exposed five insulated pipes of 3 in. diameter to a flame 
area of approximately 30 ft 2 at temperatures corresponding 
to the ASTM E-119 time—temperature curve. The mini¬ 
mum fire resistance considered acceptable was taken 
as maintenance of the pipe temperature below 1000°F 
(538°C) for 1 h. 

Systems which met this criterion almost exactly 
included: a 1 in. calcium silicate insulation with a 10 mil 
(lmil = O.OOlin.) stainless steeljacket;a2in. ceramic foam 
insulation with vinyl acrylic mastic or asphaltic mastic 
coating or 10 mil cladding of aluminium or stainless steel; 
and a 3 in. rigid polyurethane foam insulation with 10 mil 
vinyl coated steel cladding. 

The behaviour of polyurethane foam insulation in fire 
has been a subject of some controversy. There are a number 
of different types of polyurethane foam. In a fire, some 
foams melt, some char, some both melt and char, and some 
char and rupture, leaving gaps. According to McMillan, 
however, a suitable polyurethane foam can give good 


fire resistance. Detailed experimental work on the behav¬ 
iour of polyurethane foams in fires is described by Boult, 
Gamadia and Napier (1972) and by Boult and Napier (1972). 

Fireproofing is discussed in the ICI LFG Code (ICI/ 
RoSPA 1970IS/74). For pressurized storage vessels the code 
suggests that one suitable form of fireproofing is vermicu- 
lite cement. For the 2 h protection which is commonly pro¬ 
vided, the minimum thickness of vermiculite cement 
required is 2 in. For refrigerated storage vessels the con- 
venstional insulations are cork, polyurethane and perlite 
powder. The Code discusses the degree of fire resistance 
offered by these materials and suggests that an additional 
fireproof finish may be required to give 2 h fire resistance. 

16.24.5 Reactive fire resistant coatings 

A quite different method of fireproofing is the use some 
form of a reactive coating. Accounts of reactive coatings 
include those by Feldman (1974), O’Rourke (1974), Kawaller 
(1980), R. James (1988), Gillon (1989) and Droste (1992). 

Reactive coating are of three main types: (1) magnesium 
oxychloride, (2) intumescent coatings and (3) subliming 
coatings. 

Magnesium oxychloride exposed to fire undergoes loss 
of its combined water so that a porous matrix is formed. It 
gives a light, hard covering that is resistant to impact, 
abrasion and weather and provides good fire resistance. A 
proper formulation should be used; home-made ones can be 
unsatisfactory. It does, however, have some drawbacks. One 
is that it requires metal lath reinforcement, another that it 
is somewhat corrosive so that the equipment needs to be 
protected, and a third that it tends to lack adhesion and 
requires a good ‘key’. 

Intumescent coatings were first used as paint to retard 
surface spread of flame. They were so successful that a fire 
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resistant coating was developed. In a fire an intumescent 
coating releases cooling gases and leaves a residue of thick 
insulating foam. Tests show that a l f\ in. layer can give a 1-h 
protection. Langer periods of protection can be obtained 
using thicker layers with reinforcement. 

With a subliming compound the principle of operation is 
that the coating sublimes so that as long as material 
remains on the surface the temperature of sublimation is 
not exceeded. The technique was initially developed for 
aerospace work. Thus subliming coating ThermoLag 330 
has been used to protect the structure holding the Saturn 
rocket at blastoff when temperatures reach 3000°F 
(1649°C). The coating material itself is expensive, but is 
relatively cheap to apply. 

The use of subliming coating is described by Feldman 
(1974). He quotes tests conducted on steel beams in an 
alcohol pit fire with exposure of 1800°F (982°C) for 2 h. An 
unprotected beam reached a temperature of 1000°F (538°C) 
in 10 min, whereas a beam protected by subliming coating 
rose to a maximum temperature of only 500°F (260°C) over 
the whole period. 

Droste (1992) describes two full-scale tests on a 3.6 m 3 
LPG vessel protected in one test by the subliming coating 
ThermoLag 440 and in the other by the intumescent coating 
Chartek III. The tests demonstrated satisfactory perfor¬ 
mance of both cotings for full fire engulfment over 90 min. 

Reactive coatings are lightweight and durable. The 
applications where they are most likely to be economic are 
those where alternative softer materials are less suitable. 
Some practicalities of the use of reactive materials are dis¬ 
cussed by Kawaller (1980). 

16.24.6 Fire protection of steelwork 

Turning to the passive fire protection of particular plant 
features, protection of structural steelwork is of some 
importance. Accounts of the fire protection of steelwork 
include those by Kayser (1974), Klootwijk (1976), Buck 
and Belason (1985), Latham, Kirby and Thomson (1987), 
Melinek and Thomas (1987), G.M.E. Cooke (1988) and 
Melinek (1980). 

From standard tests information is available on the time 
for steel configurations, either uninsulated or with insula¬ 
tion arrangements, to reach a given temperature (e.g. 
Franssen and Bruls, 1986; API RP 520:1990). A commonly 
used criterion temperature is 550°C. 

Design guidance for fire protection of steelwork is given 
in Designing Fire Protection for Steel Columns (American 
Iron and Steel Institute, 1980), Fire Protection for Structural 
Steel in Buildings (CONSTRADO, 1983) (the Yellow Book) 
and Design Manual on the European Recommendations for 
the Fire Safety of Steel Structures (ECCS, 1985) and by Law 
(1972,1991), Barnfield (1986) and Melinek (1980). 

There are a number of models for predicting the times 
required to attain particular temperatures for insulated 
steelwork in a fire, including those by the European Con¬ 
vention for Constructional Steelwork (ECCS) (1985) and the 
National Research Council or Canada (NRCC) and by 
Wickstrom (1981/82,1985) and Melinek (1980). 

In estimating these times it is also necessary to define 
the nature of the fire to which the steelwork might be 
exposed. 

16.24.7 Fire resistant valves 

Valves are another type of equipment for which good fire 
resistance is highly desirable. Fire resistant, or fire safe, 


valves are available. Accounts of fire resistant valves are 
given by J.B. Wright (1981) and Cory and Riccioli (1985). 

Relevant standards are API Std 589: 1993 Fire Test for 
Evaluation of Valve Stem Packing, API Spec. 6FA: 1994 Speci¬ 
fication for FireTestforValves and BS 6755: Testing of Valves, 
Part 2: 1987 Specification for Fire-Type Testing Require¬ 
ments, which replaces the earlier BS 5146:1974-. 

Interest centres particularly on the fire resistance of ball 
valves. 

Among the features listed by J.B. Wright (1981) as being 
evaluated in tests are: operability whilst hot, leakage behav¬ 
iour in a rapidly controlled fire and in a more prolonged one, 
and ability to withstand/relieve cavity pressure build-up. 

16.25 Fire Fighting Agents 

16.25.1 Types of firefighting agent 

The main types of firefighting agent are (1) water, (2) foam, 
(3) vaporizing liquids, (4) dry powders, (5) inert gases and 
(6) other agents. 

Accounts of firefighting agents are given in the Manual 
of Firemanship (Home Office, 1974-) and by Guise and 
Zeratsky (1965, 1982), the Factory Mutual Engineering 
Corporation (FMEC) (1967), J.R. Hughes (1970), Hearfield 
(1970), Harpur (1971), the Petroleum Industry Training 
Board (PITB) (1975/6), Riley (1983), Fuchs (1984), Welker, 
Martinsen and Johnson (1986), and Scheinson, Penner- 
Hahn and Indritz (1989) as well as the various contributors 
to the NFPA Handbook referred to below. 

The principal firefighting agents are discussed in 
Sections 16.26-16.33. 

16.25.2 Mechanism of fire extinguishment 

Firefighting agents have several different mechanisms of 
operation. These include: 

(1) cooling of flame; 

(2) reduction of fuel 

(a) cooling of liquid, 

(b) dilution of liquid, 

(c) emulsification of liquid, 

(d) blanketing of liquid; 

(3) reduction of oxygen; 

(4) interference with combustion reaction. 

The flame maybe cooled to render it unstable.The supply of 
fuel to the flame may be reduced by cooling the liquid, by 
diluting or emulsifying it and so reducing the partial 
pressure of the vapour, or by blanketing the liquid with 
some inert material. The partial pressure of oxygen at the 
flame may be reduced by diluting the atmosphere with 
inert gas.The combustion reaction may be disrupted by the 
use of an agent which interferes with the combustion chain 
reaction. 

16.25.3 Hazards of firefighting agents 

There are a number of hazards in the use of firefighting 
agents. They are associated primarily with (1) discharge of 
the agent, (2) incompatibility between the agent and the 
material on fire, (3) an electric shock from high voltage 
equipment and (4) toxic and asphyxiant effects from the 
agent or its breakdown products. 

A treatment of the toxic and asphyxiant hazards is given 
in GS 16 Gaseous Fire Extinguishing Systems: Precautions 
for Toxic and Asphyxiating Hazards (HSF, 1994). This deals 



6/262 FIRE 


with the hazards associated with systems using inert gases 
such as carbon dioxide and nitrogen and those using 
vaporizing liquids such as halons. 

These hazards and the precautions to be take against 
them are considered in more detail in the following sec¬ 
tions. Further discussion of the precautions advised in 
GS 16 is deferred to Sections 16.30 and 16.31 so that an 
account can first he given of the basic methods. 

16.25.4 Methods of delivery 

The principal methods of delivery of firefighting agents 
are, in broad terms, (1) fixed systems, (2) mobile systems 
and (3) portable systems. Fixed systems encompass both 
fixed systems consisting of nozzles and feeder pipework and 
fixed monitors. The following sections give a more de¬ 
tailed discussion of these different types of delivery system. 

16.25.5 Application of agents 

For fire extinguishment or control agents such as water, 
foam and dry chemicals are generally applied directly to 
the burning liquid surface, and fixed systems are arranged 
to do this. 

For agents such as dry chemicals, inert gases and 
vaporizing liquids, two widely used fixed systems are: 

(1) total flooding system; 

(2) local application system. 

A manual method applicable to the first two of these is 
the use of a 

(3) hand held hose line. 

A total flooding system is used to protect a space which is 
essentially enclosed, whilst a local application system is 
used for a particular hazard such as an open tank. A hand 
held hose line is used to direct a jet of the agent at the fire. 

Medium and high expansion foams may also be used in 
total flooding and local application systems. 

16.25.6 Compatibility of agents 

The compatibility of firefighting agents has two distinct 
aspects: (1) compatibility with the material and/or a fire of 
the material and (2) compatibility with other agents. 

Some firefighting agents are incompatible with some 
chemicals. Information on this aspect is given in Danger¬ 
ous Substances. Guidance on Dealing with Fires and Spillages 
(Home Office, 1972/4), in Hazardous Loads (IEF, 1972), Fire 
Protection Guide to Hazardous Materials (NFPA, 1991/27) 
and by various authors in the NFPA Handbook , as described 
below. 

The most widely used firefighting agent is water, but it is 
not suitable in all cases. For example, water reacts with 
aluminium alkyls, usually with some violence. In some 
cases the incompatibility is with the fire of the material 
rather than with the material as such. For example, water is 
not incompatible with bulk titanium, but it is unsuitable for 
a titanium fire. Water is not generally an appropriate agent 
for fires of alkali metals, sodium chlorate or sodium 
peroxide. Chemicals which are incompatible with water may 
generally be expected to be incompatible with water-based 
foam, particularly the low expansion variety. 

It is important that full information is available on the 
proper agents for fighting fires with the chemicals used in 
the process, that the right agents are selected and are 


available on the plant, and that personnel understand the 
nature of the agents and their use. 

The other type of incompatibility is that exhibited 
between two different agents. It is often desirable to use 
two agents, either together or in quick succession. An 
example is the use of dry chemicals to knock down a fire 
and then of foam to blanket the liquid and prevent reigni¬ 
tion. In such applications the agents must be compatible. 
This aspect is discussed further below in relation to spe¬ 
cific agents. Examples of work on the compatibility of 
foams and dry chemicals are the accounts by Hird and 
Fippes (1690), the Underwriters Laboratories (1963) and 
Jensen (1964). 

16.25.7 Selection of agents 

In firefighting there is no single aim, and the selection of 
firefighting agents reflects this. An agent may be required 
to effect (1) extinguishment, (2) control or (3) exposure 
protection. 

For fire extinguishment or control, the first considera¬ 
tion is usally given to water. Water is cheap and generally 
readily available. It is non-toxic and does not give rise in 
fire to toxic products. It has a large capacity to absorb 
heat, whether as sensible or latent heat. It vaporizes to 
give some 1700 times its own volume of steam, which acts 
as an inert vapour. Water is therefore particularly useful 
in fires where high cooling capacity is needed such as 
those involving solid materials and high flashpoint 
liquids, and where it is necessary to cool hot metal to 
prevent flashback. 

There are some disadvantages, however, in the use of 
water. Since water has a higher density than most flam¬ 
mable liquids, it does not generally float on the surface of a 
burning liquid and so blanket it. Instead it often displaces 
the liquid from any depression, bund or equipment con¬ 
taining it and may thus cause burning liquid to spread out. 

Its effectiveness against liquid fires depends on the type 
of liquid. This is discussed in more detail below. It is suffi¬ 
cient to note here that with some liquids water is not a very 
efficient extinguishant. 

There are some liquids where the use of water can be 
positively hazardous. This may be the case where there is 
an undesirable reaction between the liquid and the water so 
that an explosive or toxic hazard is created. This aspect has 
been discussed above. 

Where the liquid is a refrigerated liquefied gas, the use of 
water for firefighting is generally discouraged except for 
very small fires, since it has the effect of increasing 
the vaporization of the liquid. Further discussions of the 
use of water with LNG and with LFG fires are given in 
Section 16.35. 

Water conducts electricity in the solid stream condition 
and water jets should not be used against electrical fires. 
This aspect is discussed further in Section 16.34. 

Water is a relatively ineffective agent on a weight basis 
and is not very attractive for self-contained mobile, 
and particularly portable, equipment. This characteristic 
is less significant for use in fixed systems, where the 
quantities used are large. 

Fire extinguishment by blanketing may be achieved 
using foam. Foam is frequently the most effective agent 
for fire on liquids in spillages, bunds and storage tanks. 
Foam is essentially expanded water and, apart from its 
density, has the general characteristics of water. It is just as 
unsuitable as water for fighting fires involving electrical 
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equipment or substances which have undesirable reactions 
with water. The uses and limitations of foam are considered 
in Section 16.28. There are a number of different types of 
foam, each with its characteristic uses. 

The other principal agents are dry chemicals, vapor- 
izating liquids and inert gases. Their uses and limitations 
are treated below. 

It should be appreciated that where use is made of agents 
which are available in limited amounts only, it is essential 
to kill the whole fire first time. The supply of dry chemicals, 
for example, is usually sufficient to last only some tens of 
seconds. Unless the fire is completely extinguished, it 
is likely to reignite. On the other hand, foam forms a rela¬ 
tively long-lived blanket on the liquid and thus prevents 
reignition. This ability to hinder reignition makes foam an 
especially useful firefighting agent. 

It is necessary to establish that the firefighting agent 
selected is capable of extinguishing a fire on the particular 
chemical concerned and this may require that tests be con¬ 
ducted. As already mentioned, tests may be needed to 
check the effectiveness of foam; they may also be necessary 
to verify that of vaporizing liquids or dry powders. 

In selecting a firefighting agent, regard should be given 
to hazards to personnel. This aspect of selection is dis¬ 
cussed in GS16. 

16.26 Fire Protection Using Water: Extinguishment 
and Control 

Water is used in several distinct ways to fight fire. 
These are: 

(1) extinguishment of fire; 

(2) control of fire; 

(3) fire exposure protection; 

(4) fire and explosion prevention. 

The third application is discussed in the next section and 
the others in this section. 

Fire protection using water is treated in the NFPA 
Handbook by Hodnett (1986e). Two principal codes are 
NFPA 13:1991 Installation of Sprinkler Systems and NFPA 
15:1990 Water Fixed Systems. 

16.26.1 Water as a firefighting agent 

Some general characteristics of water as a firefighting 
agent have been outlined in the previous section. Further 
aspects are considred here, particularly in relation to fires 
of flammable liquids. 

Water is much the most widely used firefighting agent. 
The majority of fires which occur are fires in buildings or 
fires of other solid materials, and for these the most suitable 
agent is generally water. But water is also important as an 
agent for fighting fires, including liquid fires, in process 
plant. 

It is most effective against fires of high flashpoint 
liquids. The principal mechanism is the cooling of the 
liquid so that its vaporization is reduced. The cooling effect 
is strong, because water has a high latent heat. With fires 
of low flashpoint liquids, however, it becomes more diffi¬ 
cult using water to achieve a sufficient reduction in the 
vaporization. 

Another important mechanism by which water extin¬ 
guishes liquid fires is vaporization to form steam, which 
blankets the fire and cuts off the oxygen. 


In fires of particular liquids other mechanisms may be 
involved. If the liquid is miscible with water (e.g. ethylene 
oxide), addition of water reduces the vapour concentration. 
A similar result is obtained if the water added forms an 
emulsion on the surface of the liquid. If the liquid is denser 
than water (e.g. carbon disulfide), water floats on the sur¬ 
face and prevents vaporization altogether. 

On the other hand, if the liquid has a low boiling point, 
and particularly if it is a refrigerated liquefied gas, the 
effect of adding water is not to take heat away from the 
liquid as latent heat of vaporization of water, but to put heat 
in as sensible heat of cooling of water, and thus to increase 
the vaporization of the liquid. 

The water used to fight a fire may be large in volume and 
is liable to become contaminated. Its removal can pose a 
serious problem. This may well be a factor in the deciding 
whether water is the appropriate agent to use. 

The hazards associated with the use of water for certain 
types of fire are discussed in Subsection 16.26.3. 

16.26.2 Extinguishment of liquid fires 

Work has been done by Rasbash and co-workers on the 
extinction of liquid fires (e.g. Rasbash and Rogowski, 1957; 
Rasbash and Stark, 1960, 1962; Rasbash, Rogowski and 
Stark, 1960; Rasbash, 1962). The work has been reviewed in 
relation to water spray systems by P. Nash (1947b). For this 
purpose flammable liquids may be divided into three clas¬ 
ses, depending on the mechanism of extinction: 

(1) liquids not miscible with water and with a fire point 
>45°C; 

(2) liquids miscible with water and therefore capable 
of having their fire point raised above 45°C by the 
addition of water; 

(3) liquids not miscible with water and with a fire point 
<45°C. 

The first class of liquid may be extinguished by heat 
transfer from it to water drops which penetrate its surface 
until its temperature falls below the fire point. Such liquids 
include heavy fuel oil, diesel oil, gas oil, and, as a border¬ 
line case, kerosene. 

The water drops must enter the liquid in sufficient 
quantity despite the updraught of the flames and the eva¬ 
poration of the spray in the flames. Factors which assist in 
achieving this are positioning of the spray near the liquid 
surface, high spray impetus and large liquid drop size. The 
impetus of the spray depends on the reaction of the nozzle 
and the width of the spray. 

Figure 16.126 shows the results of some experiments of 
kerosene burning in a 30 cm diameter vessel with down¬ 
ward application of the spray (Rasbash, 1962). The ratio of 
the water actually penetrating the liquid surface to that 
expected to do so from geometrical considerations varied 
from about 10% to about 60%, depending on the thrust of 
the air current and the drop size of the spray. It was found 
that a mass median drop size above 0.4 mm is necessary to 
penetrate the flames effectively, but that at a drop size of 
about 0.8 mm the penetration becomes nearly independent 
of impetus and that above this size there begins to be a 
problem with splash fires caused by the larger drops 
splashing liquid from the surface so that burning continues 
even after the average liquid temperature has fallen below 
the fire point. 
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Figure 16.126 Effect of the mass median drop size on the penetration of a water spray into a flammable liquid 
surface (Rasbash, 1962): kerosene fire, 30 cm diameter; downward application of spray; pressure at spray nozzle 
0.35-2.1 bar (5-30 lbf/in. 2 ); flow rate to fuel surface in absence of fire 0.4-1.2 g/crrf min (Courtesy of the 
National Academy of Sciences) 


The work demonstrated that extinction can be achieved 
by application of water above a critical rate which is given 
by the equation 

I 16 ' 261 ! 

where D is the mass median drop size (mm), R c is the critical 
rate of water application (1/min), AT is the difference 
between the water temperature and the liquid fire point 
(°C), k\ is a constant, and «i and n 2 are indices. 

In practice it is necessary for the value of AT to be at least 
40°C if the critical rate is not to be excessive. The indices «i 
and « 2 are approximately unity. The constant k i is a func¬ 
tion of the flammable liquid, the area of the fire and the time 
for which the fire has already been burning. For a tray of gas 
oil of 8 ft diameter which has burned for 5 min before spray 
application, the value of k\ was approximately 1140. 

The time taken to extinguish the fire at rates of water 
application above the critical value is given by the equation 


f = 5.2 x10 s 


£0.85 


[16.26.2] 


where R is the rate of water application (l/m z s) and t is the 
time to extinguish the fire (s). 

Water spray systems for this liquid class typically use 
rates of water application in the range 0.16—1.2 l/m z s 


(9.6—72 l/m z min). High velocity nozzles are used with 
nozzle pressures of 2.75 bar (40 psig) or above and with a 
conical spray.The desirable mass median drop size is an even 
distribution in the range 0.4-0.8 mm and the drops should 
have a velocity sufficient to penetrate the liquid surf ace. 

When a deep pool of liquid in this class in burning, it may 
form after a period a ‘hot zone’ and water below the surface 
may then boil and cause a ‘slopover’, thus spreading the fire. 
This can heppen, for example, with fuel oil which has been 
burning in depth for 15-30 min. It is necessary, therefore, to 
try to detect and extinguish fires before a hot zone occurs. 

The second class of liquid may be extinguished by 
diluting the surface layer with water until the fire point of 
the mixture is raised sufficiently to cause extinction. 
Typical liquids are ethanol and acetone. 

Although in this case the basic requirement for extinc¬ 
tion is rather simple, there are certain problems. It is not 
always easy to tell when extinction has been achieved, 
since flames may continue to burn at some point and may be 
difficult to detect due to their low luminosity. Even if the 
fire is extinguished, the liquid remains flammable unless 
the whole bulk is diluted, and this may not be easy to 
achieve without spreading the spillage. Acetone, for 
example, requires a dilution of some 30 :1. 

The mass median drop size for a water spray for this 
liquid class should be less than 0.4 mm. 

Liquids which are only partially miscible with water and 
have a low fire point are difficult to extinguish with water 
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and generally their fires can only be controlled. Such 
liquids include ether and methyl ethyl ketone. 

For water spray systems for such partially miscible liquids 
rates of water application in the range 0.12-0.30 1/m 2 s 
(7.2-18 1/m 2 min) are normally required with nozzle pres¬ 
sures of 1.4 bar (20 psig) or above. 

The third class of liquid may be extinguished by cooling 
the flame by heat transfer to the water droplets falling 
through it. Such liquids include petrol and, again as a bor¬ 
derline case, kerosene. It has been estimated that to cool a 
kerosene flame to extinction it is necessary to remove about 
0.1 cal/cm 3 s if extinction is solely by steam formation and 
about 0.7 cal/cm 3 s if it is entirely by cooling. Thus the rate 
of heat removal to achieve extinction is of the order of 
0.1-1 cal/cm 3 s, depending on the conditions. 

The drop size required depends on several factors. In 
general, the extinction time falls sharply as drop size is 
reduced.With some liquids such as petrol it is essential that 
the drops penetrate to the lower part of the flames. There 
can be some ‘sputtering’ at the liquid surface, however, in 
the early stages of extinction if the drop size is too small. 
A mass median drop size of about 0.3 mm is usually 
suitable. Medium velocity nozzles of the open or closed type 
are used. 

Additional cooling is obtained from air entrained with 
the spray. This effect is increased by the use of high nozzle 
pressures and drop velocities. 

Water sprays are also used to deal with certain electrical 
fires, as described in Section 16.34. 

16.26.3 Hazards associated with water 

Although water is the most common firefighting agent, 
there are certain cases where it use is hazardous. One such 
case is where the material is incompatible with water, as 
discussed in the previous section. Another is where the fire 
is incompatible with water. This applies to in particular to 
metal fires, which are considered in Section 16.34. 

The use of water on live electrical equipment involves the 
hazard of electrical shock. The extent to which water can be 
used with electrical fires is discussed in Section 16.34. 

Also, as already mentioned, the use of water in large 
quantities and contamination of this water can pose a pro¬ 
blem of disposal. Uncontrolled release of such water can 
cause damage to the environment. 

16.26.4 Delivery systems for water 

Water is delivered to the fire mainly either by fixed systems 
such as water sprinkler and water spray systems and fixed 
water monitors or by mobile systems such as fire hoses. 
Little use is made of water in portable systems. 

Fixed water systems are used both indoors and outdoors. 
Indoors, widespread use is made of water sprinkler systems. 
Water spray systems may also be used indoors. Outside 
water spray systems and fixed water monitors predominate. 

16.26.5 Applications of fire extinguishment or control 

For most fire protection applications water is the agent of 
choice. 

Fixed water sprinkler systems are used to protect indoor 
areas. Fixed water spray systems are used indoors to protect 
specific equipment such as grinding mills or conveyors. 

Outdoors, fixed water spray systems are used to protect 
vulnerable items, loading and unloading facilities, including 
jetties, and storage vessels. Fixed water monitors are also 
provided for tank farms and jetties. 


Except where it is unsuitable, water is the main agent 
used in mobile equipment by the works and public fire 
services for fighting fire wherever it occurs. 

16.26.6 Fixed water sprinkler systems 

Fixed water delivery systems are widely used in process 
occupancies. Fixed water sprinkler systems are used for 
fire extinguishment by delivering specified quantities of 
water over the protected area, mainly in buildings and 
warehouses. Fixed water spray systems are used for fire 
extinguishment or control by delivering specified quan¬ 
tities of water spray, characterized by the nozzle used, onto 
the protected equipment or area. 

There is a considerable literature on fixed water sprink¬ 
lers systems. It includes treatments by O’Dogherty, Nash 
and Young (1966), the Fire Offices Committee (1968), 
Kalelkar (1971), P. Nash (1972a, 1973a, 1976,1975a,b, 1975 
BRE CP 79/75, 1977a,b, 1990), Nash, Bridge and Young 
(1974 BRE CP68/74), Leworthy (1975), Nash and Young 
(1975 BRE CP29/75, CP67/75, CP52/76, CP77/75, CP78/75), 
Rogers (1977 BRE CP9/77), Nicholls (1981), R. Young (1981), 
Theobald (1987a,b), Yao (1988), FMRC (1991) and Melinek 
(1993b). 

Fire protection by fixed water sprinkler systems is trea¬ 
ted in the NFPA Handbook by several authors, notably 
Hodnett who deals with automatic sprinklers (1986a), 
automatic sprinkler systems (1986b) and water supplies for 
sprinkler systems (1986d). 

Relvant NFPA codes are NFPA 13: 1991 Installation of 
Sprinkler Systems, NFPA 13A: 1987 Inspection, Testing and 
Maintenance of Sprinkler Systems, NFPA 16: 1991 Deluge 
Foam-Water Sprinter and Spray Systems and NFPA 16A: 
1988 Installation of Closed-Head Foam-Water Sprinkler 
Systems. Other NFPA publications on sprinklers include 
Automatic Sprinkler and Standpipe Systems (1990/25), 
Automatic Sprinkler Systems Handbook (1994/37) and 
Installation of Sprinkler Systems (1994/39). The relevant 
British Standard is BS 5306 Fire Extinguishing Installa¬ 
tions and Equipment on Premises, Part 2:1990 Specification 
for Sprinkler Systems. 

NFPA 13 is a large code, covering the use of sprinklers 
generally rather than in the process industries. 

The elements of a fixed water sprinkler system include 
the sprinkler alarms, the sprinkler heads, the water dis¬ 
tribution pipework, the valves and other fittings, and the 
water supply system and disposal arrangements. 

The NFPA gives a classification of occupancies relevant 
to sprinkler systems. Those with moderate or substantial 
amounts of flammable liquid fall into the group Extra 
Hazard (Group 2). 

A sprinkler system needs to respond rapidly so that 
the fire is extinguished before it can take hold. The 
time response of the sprinkler head is therefore crucial. 
Traditionally sprinkler heads have been classed according 
to the temperature at which they respond (e.g. 68°C). For fast 
response it is the time constant which matters. Fast response 
sprinklers are discussed by P. Nash (1972a), Watson (1984), 
Field (1985), Murrell (1988) and Mullhaupt (1986). 

The use of sprinkler systems as fire sensors is con¬ 
sidered by Nash and Theobald (1976 BRE CP50/76). 

A sprinker system needs to be designed so that each head 
is supplied with the intended water pressure. The hydrau¬ 
lics of sprinklers are treated in Hydraulics of Fire Protection 
Systems (FMEC, 1977) and Sprinkler Hydraulics (Wass, 
1983) and by Nickerson (1954), C.M. Wood (1961), Beyler 
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(1977), Ashfield (1979), Barris and Conte-Russian (1980), 
Bray (1980), Cresswell (1980), Kitson and Guy (1980) and 
Crowley (1982). 

One way of achieving a uniform distribution of water in a 
sprinkler system is the use of a balanced system in which 
this uniformity is assured by the similarity of the pipework 
from the source to the individual sprinkler heads. For a 
system which it not balanced in this way it is necessary to 
ensure uniform distribution by calculating the pressure 
drops between the source and the individual heads. 

16.26.7 Fixed water spray systems 

As just indicated, fixed water spray systems are dis¬ 
tinguished by the fact that the spray is characteristic of the 
type of nozzle used. 

Accounts of fixed water spray system are given by 
Rasbash and co-workers, as already described, and by 
P. Nash (1974b), Hems (1979, 1983), Fritz and Jack (1983), 
Angelini (1984), Lev and Strachan (1989a,b), McCaffrey 
(1989), Chow and Fong (1991) and Jackman and Nolan (1994). 

Fire protection by fixed water spray systems is treated in 
the NFPA Handbook by Hodnett (1986c). 

Relevent codes and standards are NFPA 15:1990 Water 
Spray Fixed Systems and NFPA 16: 1991 Deluge Foam- 
Water Sprinkler and Spray Systems. 

The elements of a fixed water spray system include the 
fire detection and alarm system, the spray nozzles, the 
water distribution pipework, the valves and other fittings, 
and the water supply system and disposal arrangements. 

16.26.8 Fixed water monitors 

For fire risks involving large quantities of flammable liquid, 
notably tank farms and jetties, fixed water monitors are 
generally provided. These monitors are generally dual pur¬ 
pose devices which canhe used to project water or foam. 

16.26.9 Water rates for extinguishment or control 

Recommended water rates for the extinguishment or con¬ 
trol of fire are given in the various codes and standards. 
Those recommended by the NFPA probably have the 
greatest currency. NFPA 15 distinguishes the four types of 
application, listed at the beginning of this section, and 
gives for each type a recommended approach. 

NFPA water rates for fire extinguishment 
For fire extinguishment, NFPA 15 states that water rates 
should be based on tests or experience. It gives a general, or 
default, range of water rates which applies to the protected 
surface for most combustible solids and flammable liquids. 
This is 0.2—0.5 USgal/ft 2 min (8.1-20.41/m 2 min). 

NFPA water rates for control of burning 
For control of burning, NFPA 15 states that the water rate 
on the probable surface of the spill should not be less than 
0.5 USgal/ft 2 min (20.41/m 2 min). 

Control rather than extinguishment of the fire implies that 
the water flow needs to be maintained. NFPA 15 requires 
that the system function at full effectiveness until there has 
been time for the flammable material to be consumed, for the 
leak to be shut off, for the assembly of repair forces, etc. 

NFPA water rates for exposure protection 
For exposure protection, or cooling, the water rates recom¬ 
mended in NFPA 15 vary according to the item protected. 
They are considered in the next section. 


NFPA water rates for fire and explosion prevention 
For fire and explosion protection NFPA 15 simply states 
that the water rate should be based on tests or experience. 

Critique of NFPA recommended water rates 
A critique of water rates traditionally recommended has 
been given by Fritz and Jack (1983). They take as their 
starting point the then current edition of NFPA 15 and deal 
both with water rates for extinguishment or cooling and 
rates for exposure protection. 

They refer in particular to work at the Rubber Reserve 
Company in the 1940s on horizontal cylindrical vessels 
containing fuel (gasoline, butane and butadiene- 
butylenes mixtures) and engulfed in fire. 

Fritz and Jack discuss the work of Rasbash and 
co-workers on fire extinguishment described above. They 
draw attention to the influence of the water nozzle and 
spray characteristics on the water rates needed for extin¬ 
guishment and to the fact that these characteristics are not 
specified in the NFPA codes. They consider the water rate 
required to effect extinguishment based on a heat balance 
model in which the total heat released by combustion goes 
to evaporate the water. They obtain from this a water rate of 
2.5 USgal/ft 2 min. On this basis they suggest that a water 
rate of 0.5 USgal/ft 2 min is no more than cosmetic. They 
also discuss the water rate for exposure protection, as dis¬ 
cussed in the next section. 

16.26.10 Fire water supply systems 

The amount of water needed for firefighting and cooling 
presents a considerable problem. Aspects where better 
understanding may lead to less onerous requirements 
include the heat flux from liquid fires, the reflectivity and 
wetability of tank surfaces, and methods of applying the 
water to the surfaces. 

Water spray systems both for firefighting and for cooling 
may be of two types. In a wet system the pipes are kept full 
of water under pressure, whereas in a dry system these 
pipes are normally empty and are filled by the opening of a 
master valve only when the system is to be activated. A dry 
system should be used where there is risk of freezing. It is 
therefore this type of system which is most suitable for 
process plants, particularly in the open. The pipework in a 
dry system needs to be arranged to allow complete drainage. 

There should be a secure water supply to the water spray 
system. This aspect is discussed in Chapter 10 in relation to 
plant layout. 

There are a number of ways in which a water spray sys¬ 
tem can be rendered ineffective. One of these is freezing up, 
as just mentioned. Another is leaving valves closed, par¬ 
ticularly after maintenance. The latter occurrence needs to 
be guarded against by specific procedures. 

In addition, it is not uncommon for a water spray system to 
be knocked out by an explosion. The Fourth Edition of the 
Dow Guide (Dow Chemical Company, 1976) states that where 
an explosion hazard exists, it is a recommended minimum 
prevention and protection feature that water spray piping of 
2i/ 2 in. diameter or above be welded or flanged, not threaded. 

16.26.11 Fire water disposal systems 

As already indicated, the disposal of fire water, particu¬ 
larly contaminated water, can be a serious problem, which it 
is sufficient here to highlight. As an aspect of plant layout, 
fire water disposal is treated in Chapter 10. A method 
of alleviating this problem which merits mention here, 
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however, is the use of foam to obtain a given degree of fire 
extinguishment or control with a smaller water usage. 

16.27 Fire Protection Using Water: Exposure 
Protection 

In the foregoing section an account has been given of the 
use of water to extinguish or control a fire. In this section 
consideration is given to its use for exposure protection by 
cooling of equipment exposed to fire. 

Accounts of fire exposure protection are given by Pettit 
(1945), Chaillot (1966), P. Nash (1973b, 1974a), Fritz and 
Jack (1983), Billings, Moodie and Beckett (1986), Lev and 
Strachan (1989b), Lev (1991) and Meiers and Jarman (1993). 

As indicated above, a relevant code for exposure pro¬ 
tection using water is NFPA15. 

16.27.1 Delivery systems for water 

The means of delivery of water for cooling are broadly 
similar to those used for extinguishment. Water is delivered 
to the protected surface by fixed systems such as fixed 
water spray systems and fixed water monitors or by mobile 
systems such as fire hoses. 

16.27.2 Applications of water cooling 

Essentially, exposure protection is provided for large 
flammable gas or liquid inventories which are liable to be 
exposed to a fire. For the most part such inventories occur 
in storage tanks and vessels, though protection may also be 
provided for certain process vessels and for road and rail 
tankers. 

The purpose of providing such protection is to cool the 
metal and so prevent loss of strength. It is normal to provide 
the tank or vessel with pressure relief but, even if the relief 
operators, it will not prevent failure if the wall temperature 
is allowed to rise too high. 

16.27.3 Water rates for cooling 
NFPA water rates for cooling 

For exposure protection by cooling, NFPA 15 treats the fol¬ 
lowing cases: vessels, structures and miscellaneous 
equipment, transformation and belt conveyors. 

For vessels, the code states that the rules given assume that 
there is a relieving capacity based on a maximum allowable 
heat input of 6000 BTU/ft* h (18.9 kW/m 2 ). If there is no such 
relief, the water rates should be increased accordingly. 

For a vertical or inclined vessel surface the water rate 
should not be less than 0.25 USgal/ft 2 min (10.2 1/m 2 min) 
of exposed uninsulated surface. Where on such a surface 
rundown is assumed, the vertical distance between nozzles 
should not exceed 12 ft (3.7 m). The horizontal extremities of 
the spray patterns should at least meet. 

For a vertical vessel the bottom and top surfaces should 
be completely covered by directed water sprays with a 
water rate of 0.25 USgal/ft 2 min (10.21/m 2 min) of exposed 
uninsulated surface. On the bottom surface the horizontal 
extremities of the spray patterns should at least meet. 

The surfaces below the equator of a spherical or hori¬ 
zontal cylindrical vessel cannot be considered to be wetted 
by rundown. 

The code also gives various other provisions. 

The structures and equipment considered are primarily 
horizontal and vertical structural steel members, pipework 
and pipe racks, and cable trays and cable runs. Water rates 
are given for each of these. 


Critique of NFPA recommended water rates 
Mention has already been made of the critique by Fritz and 
Jack (1983) of the water rates recommended in NFPA 15 for 
fire extinguishment or control. These authors also review 
the NFPA recommendations on water rates for exposure 
protection. 

The background to these recommended rates is work on 
heat fluxes to vessels engulfed in fire, such as the tests 
listed in API RP 520: 1990 and earlier editions, which 
include the Rubber Reserve Company tests mentioned in 
the previous section. 

In this case the authors base their estimate of the cooling 
water requirement on a heat removal rate of 20,000 BTU/ 
ft 2 h, effected by a rise in water temperature to a few 
degrees above the boiling point. On this basis they obtain 
an estimate of 0.04 USgal/ft 2 h for the required water 
rate. They suggest that the NFPA recommended value of 
0.25 USgal/ft 2 h is higher than it need it. 

Thus Fritz and Jack’s critique of the NFPA water rates 
recommended is that for fire extinguishment they are too 
low, but that for exposure protection they are too high. 

Other Recommneded Water Rates 

For the exposure protection of storage tanks containing low 
fire point liquids a rate of water application over the surface 
of the tank of 0.2 UKgal/ft 2 min (0.161/m 2 ) is recommended 
by P.H. Thomas and Law (1965 FRS Fire Res. Note 609). 

The Fourth Edition of the Dow Guide (Dow Chemical Com¬ 
pany, 1976) gives as a recommended minimum fire prevention 
and protection feature exposure protection a rate of 0.2-0.35 
USgal/ft 2 min (0.14-0.24 l/m 2 s) for directional sprays. The 
later editions give water rates as part of the loss control 
credits, but these refer to indoor sprinkler applications. 

For the exposure protection of LFG vessels the ICI LFG 
Code (ICI/RoSPA 1970 IS/74) recommends a rate of 
0.20 UKgal/ft 2 min (0.161/m 2 s), but allows a reduced rate if 
certain precautions are taken. This is discussed more fully 
in Chapter 22. 

16.27.4 Cooling of tank exposed to a pool fire 

A tank exposed to fire, including an engulfing fire, may be 
cooled by applying water. The water rates recommended 
have just been described. At these water rates the total 
water requirements may be very large. The requirements 
for exposure protection generally greatly exceed those for 
extinction of fire. 

This generalized requirement is not difficult to meet for 
small tanks, but becomes much more onerous for large 
ones. Thus, based on this criterion, the water requirement 
for an 80 m diameter tank is of the order of 150 t/min. The 
power required to lift and distribute the water is large also, 
being about 1 MW. 

The water needed for exposure protection is greatly 
reduced if application is restricted to the tank roof and ullage 
sections. Figure 16.127, given by R Nash (1973b, 1974a), 
illustrates this difference. The curves are based on the water 
rates recommended in the then current edition of NPFA15, 
which were 0.25 USgal/ft 2 min. Curves A1 and B1 give, 
respectively, the water requirements for extinction and 
exposure with coverage of the whole tank and with coverage 
of the roof and ullage sections only. Curves A2 and B2 give 
the corresponding water requirements for exposure only. 

A further discussion of the use of water sprays for pro¬ 
tection against fire exposure is given in relation to storage 
in Chapter 22. 
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Figure 16.127 Water requirements for protection against exposure to fire and for extinction of fire for a storage tank 
(P. Nash, 1974a): A h NFPA 15- extinction and exposure;A 2 , NFPA 15- exposure only; B h ‘economial’requirement- 
extinction and exposure; B 2 , ‘economical’ requirement - exposure only (Reproduced by permission of HM Stationery 
Office. Copyright. All rights reserved) 


16.27.5 Cooling of vessel exposed to 
an impinging jet flame 

A rather different, and stringent, fire protection require¬ 
ment arises where a jet flame impinges directly on a target. 
This problem has been studied by Lev and Strachan 
(1989b) and Lev (1991). 

The surface of a vessel exposed to a jet flame is likely to 
rise to a temperature of over 100°C very rapidly. A con¬ 
tinuous film of water over the metal surface is capable of 
intercepting radiant heat, but as the heat flux is increased 
the protection so afforded is gradually lost as the water 
film thins and then disintegrates. 

A model for a water spray system to protect against jet 
flames has been described by Lev (1991). It has three main 
elements which model: (1) the three-dimensional droplet 
trajectory, (2) the in-flight evaporation loss and (3) the heat 
transfer between the cooling water and the metal surface. 

For the droplet trajectory, the equation of motion of a 
droplet moving through a parallel gas stream is written as 

m % = CiP e( U ~ V W U ~ f “ m <& 


whereA is the surface area of the droplet (m 2 ), C d is the drag 
coefficient, g is the acceleration due to gravity (m/s 2 ), m A is 
the mass of the droplet (kg), t is the time (s), U is the gas 
velocity (m/s), v is the droplet velocity (m/s) and p g is the 
gas density (kg/m 3 ). 

The drag coefficient is taken as given by the following 
relations for a non-evaporating droplet, the correction for 
evaporation being small: 

C d = 24/Re Re <2 Stokes regime [16.27.2j 

Q = 10/(Re) 1,/z 2 < Re < 500 Intermediate regime 

[16.27.3] 

C d = 0.44 Re > 500 Newton’s regime 

[16.27.4] 

Re= m^t 


[16.27.1] 


[16.27.5] 
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where D is the droplet diameter (m) and v is the gas kin¬ 
ematic viscosity (nr/s). 

For the in-flight evaporation loss, use is made of the cor¬ 
relation of Ranz and Marshall (1952), with the correction for 
high stream temperatures given by Yuen and Chen (1978): 

Nu(l + B) = 2 + 0.6 Re°' 5 Pr 0 ' 33 [16.27.6] 

B=(h s -h i )/L [16.27.7] 

where B is a mass transfer number, hi is the surface 
enthalpy of the droplet (J/kg), h s is the free stream enthalpy 
(J/kg) and L is the latent heat of evaporation of the drop¬ 
let (J/kg). The properties are evaluated at the film 
temperature. 

Since the work of Yuen and Chen was done using streams 
of hot air, it is necessary also to introduce a term for 
absorbed radiant heat: 

Mr = cQAbt/L [16.27.8] 

where c is an absorption coefficient, M r is the rate of eva¬ 
poration loss due to thermal radiation (kg/s), Q is the heat 
flux to the droplets (W/m 2 ) and bt is the time of exposure of 
the droplet (s). 

For the heat transfer between the cooling water and the 
surface, the relation used is that of Yao and Choi (1987): 

Q = 29.5 x 10- 4 G° 76 [16.27.9] 

where G is the liquid mass flux (kg/m z s) and Q is the heat 
flux between the water and the surface (W/m 2 ). 

Information on the flame temperature and surface emis¬ 
sive power in jet flames has been reviewed by Lev (1991). 
A study by Blything (1983 SRD R263) quotes a flame 
temperature of about 1300°C and heat fluxes of about 300- 
400 kW/m 2 . Work on jet flames by Cowley and co-workers 
(Cowley, 1989; Tam and Cowley, 1989; Cowley and Pritchard 
1991) on several different configurations has shown heat 
fluxes in the range 50—250 kW/m 2 . 

The model described was used to obtain results relevant 
to spray system design. These showed that the heat transfer 
passes through a marked maximum with surface tempera¬ 
ture, this maximum occurring around 140-150°C. Thus 
the water mass flux to remove the heat from an incident 
heat flux of 250 kW/m 2 was 12 kg/m 2 min at 150°C but 
50 kg/m 2 min at 300°C. Due to instabilities, maintenance 
of conditions where the lower water rate is sufficient is 
dubious. Lev recommends, therefore, a design cooling 
water rate of some 60-120 kg/m 2 min. 

In order to deliver this cooling water under conditions 
where there is likely to be in-flight evaporation and cross- 
flow losses, the droplets need to be large and to be projected 
at high velocity. Lev presents results from the model 
showing the fraction of water droplets reaching the target 
as a function of crossflow velocity and droplet diameter. 
Droplets of less then 0.5 mm diameter are vulnerable 
and a droplet size of more than 1 mm diameter should be 
aimed for. 

Typical medium velocity (MV) nozzles tend to produce a 
high proportion of droplets less than 0.5 mm in diameter. 
They appear less suitable that high velocity (HV) nozzles. 


Alternative modes of water delivery are hand-held monitors 
and fixed monitors. Suitable HV nozzles mounted less 
than 1 m from the target are capable of delivering the 
60-120 kg/m 2 min required.There are hand-held monitors 
which from a distance of 16 m can deliver water at a rate of 
120 kg/m 2 min, wetting an area of 6 m 2 . 

The method just described is applicable to impining jet 
flames of LPG with stream temperatures of 500-1300°C 
and stream velocities up to 40 m/s with radiative heat 
fluxes of 50-250 kW/m 2 and for metal surface tempera¬ 
tures of 150-300°C. 


16.27.6 Fixed water cooling systems 

Exposure protection is effected using fixed water spray 
systems. Proper cooling requires that water be applied such 
that the whole surface protected is wetted by the water rate 
specified. The spray nozzles should be located so that the 
extremities of the spray pattern at least meet, and for wet¬ 
ting below a vessel equator reliance should not be placed on 
rundown. More detailed requirements have been given in 
the previous section. 

The relevant codes, notably NFPA 15, have been dis¬ 
cussed in the previous section. 


16.28 Fire Protection Using Foam 

A prime alternative to water, particularly for large fires, is 
foam. Accounts of foam are given by Burgoyne (1949a), 
Burgoyne, Katan and Richardson (1949a), the American 
Chemical Society (ACS) (1956), Burgoyne and Steel (1962), 
Vervalin (1964b,d), Meldrum and Williams (1965), Ashill 
(1966b), G. Nash (1966), Hearfield (1970), Hird, Rodrigues 
and Smith (1970), Meldrum (1972,1982), P. Nash (1973b), 
Corrie (1974, 1975 BRE CP25/75), Nash and Young (1975 
BRE CP42/75), Burford (1976), Gillespie and Dimaio (1977), 
Murphy (1981), Boughen (1983), J.L. Evans (1985, 1988), 
SKUM (1986), A.A. Briggs and Webb (1988),Tabar (1989), 
Waters (1990 LPB 91) and M. Clarke (1992). Fire protection 
using foam is treated in the NFPA Handbook by Lockwood 
(1986). 

Relevant codes and standards are NFPA 11: 1988 Low 
Expansion Foam and Combined Agent Systems, NFPA 11A: 

1988 Medium and High Expansion Foam Systems, NFPA 16: 
1991 Deluge Foam-Water Sprinkler and Spray System, 
NFPA 16A: 1988 Installations of Closed Head Foam-Water 
Sprinkler Systems, NFPA 11C: 1990 Mobile Foam Apparatus 
and BS 5306: 1976- Fire Extinguishing Installations and 
Equipment on Premises, Part 6: Foam, Section 6.1: 1988 
Specification for Low Expansion Foams and Section 6.2: 

1989 Specification for Medium and High Expansion Foams. 

16.28.1 Mechanisms of fire extinguishment 

Foams are widely used against liquid fires. Initially the 
foam acts as a blanketing agent and then, as the water 
drains from the foam, as a cooling agent. 

16.28.2 Types of foam 

Foams are water based and come in several kinds. These 
include: 

(1) chemical foam; 

(2) protein-based mechanical foam 

(a) standard, low expansion foam, 
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(b) high expansion foam, 

(c) medium expansion foam; 

(3) special foams 

(a) fluorochemical foam, 

(b) fluoroprotein foam; 

(4) detergent foam; 

There is now a large family of foams of different types 
and applications. One broad distinction is made on the 
basis of the viscosity of the foam. The blanket formed by 
the more viscous type is resistant to rupture by flame, 
but the less viscous type flows more readily over a liquid 
surface. Other relevant properties of foams are their resist¬ 
ance to oil and alcohols. 

Chemical foam 

Chemical foam is produced by reacting aqueous solutions 
of sodium bicarbonate and aluminium sulfate in the pre¬ 
sence of a foam stabilizer. The reaction generates carbon 
dioxide, which both forms foam and ejects the mixture 
from the apparatus. This type of foam may be regarded as 
obsolete, its use long having been almost entirely confined 
to mobile and portable equipment. 

Protein, or mechanical, foam (P) 

Mechanical foam is generated by mechanical aeration of 
aqueous solutions of certain chemicals, which usually have 
a protein base. One type is based, for example, on blood 
hydrolysed by caustic soda. Standard foam is made by 
introducing the foam compound into the water in the hose 
to give a 3-6% aqueous solution and then mixing the 
solution with air in an ejector nozzle to give an approxi¬ 
mately 10:1 expansion. This type of foam is the most 
widely used both for fixed and mobile apparatus. Such 
standard low expansion foam is very cheap. 

High expansion foam is generally similar to standard 
foam but has an approximately 1000:1 expansion.This type 
of foam contains little water so that it acts almost entirely 
by blanketing rather than by cooling. It is very light and is 
easily blown away, and is thus more suitable for fires in 
containers such as tanks or ships’ holds than for those in 
open situations such as in a bund. 

Medium expansion foam is again generally similar to 
standard foam, but has an approximately 100-150:1 
expansion. This type of foam is also light, but is not so 
easily blown away as high expansion foam. 

Both medium and high expansion foams have a good 
three-dimensional extinction capability and can be used 
against fires on piles of materials such as rubber. 

A disadvantage of protein foams is that if the foam 
blanket is broken the liquid may re-ignite and burn back the 
blanket. Low expansion foam, however, has reasonably 
good heat and ‘burnback’ resistance. 

Fluorochemical, or light water, foam 
Agents have been developed to overcome this problem. One 
type is fluorochemical foam. This includes ‘light water’ 
foam, which contains a straight-chain fluorocarbon sur¬ 
face active agent. This has the effect that as the water 
drains from the foam it spreads in a thin film over the liquid 
and seals it. Even if the film is disturbed by agitation, it 
reforms rapidly. Light water foam behaves differently, 
however, on different liquids, and it is not universally 
effective. The cost of light water foam is high. 


Fluoroprotein foam (FP) 

Another agent which works in a similar manner is fluoro¬ 
protein foam, which contains a branched chain fluoro¬ 
carbon. It is therefore a candidate where good burnback 
resistance is needed. It is less expensive and appears in 
many cases to be more effective than light water foam. 
Fluoroprotein foam is less prone to pick up oil particles 
when passed through oil. This ‘fuel-shedding’ property is 
useful in subsurface foam injection on storage tanks. This 
type of foam tends to have good compatibility with dry 
chemicals. 

Synthetic detergent foam (S) 

Synthetic detergent foam is generated by mechanical 
aeration of aqueous solutions containing 2-3% of deter¬ 
gent. This foam is less stable than protein-based foam. The 
most effective method of usage appears to be massive 
application is a knockout attack. Detergent foam has 
enjoyed some popularity, the attraction being that it is 
cheaper even than protein foam. 

Aqueous film forming foam (AFFF) 

AFFF has low viscosity and spreads easily over a liquid 
fires. Another useful property of AFFF is that does not 
need elaborate foaming devices and can be utilized in many 
water sprinkler and spray systems. 

Film forming fluoroprotein foam (FFFP) 

FFFP foam is another type of foam which has low viscosity 
and good spreading properties and can be used in many 
water spray systems. FFFP foam tends to drain rapidly and 
is therefore less reliable in maintaining a foam blanket. 

Alcohol resistant (AR) foam 

Regular air foams do not perform well on liquids which are 
of the polar solvent type, notably alcohols. For these AR 
foams have been developed. The first generation of AR 
foams were not entirely satisfactory, but effective foams 
have been developed. One type of AR foam is polymeric 
alcohol resistant AFFF. 

Low temperature foams 

Foams have been developmed for use at low ambient tem¬ 
peratures; one quoted temperature for such foams is 
-29°C. These foams come in both protein and AFFF types. 

16.28.3 Properties of foam 

A foam for firefighting should possess certain general 
properties, which include (1) expansion, (2) cohesion, 
(3) stability, (4) fluidity, (5) fuel resistance and (6) heat 
resistance. 

Clearly, the foam must have an appreciable expansion 
ratio, its bubbles must cohere together and form a blanket, 
it must retain its water and remain stable, it must flow 
freely over the liquid surface and around any obstacles, it 
must not pick up so much fuel that it is itself liable to burn 
and it must resist the heat of flames on the liquid. Foams for 
use on alcohols must also be alcohol resistant. 

Three quantitative criteria for foam are (1) the expan¬ 
sion, (2) the fluidity and (3) the drainage time. Expansion is 
measured by the expansion ratio. 

A measure of fluidity is the shear stress. A shear stress in 
the range 150-200 dyn/cm 2 , measured on a torsional visco¬ 
meter, is typical of a good foam. 
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The drainage of liquid out of the foam is usually 
expressed as the ‘25% drainage rate’, which is the time in 
minutes for 25% of the total liquid content to drain away 
under standard conditions. For a good foam this drainage 
time is typically 2-5 min. 

Foam can be affected by the quality of the water used. 
A study by Dimaio and Lange (1984) detected deleterious 
effects from contaminants such as corrosion inhibitors, 
anti-fouling agents, etc. In general, however, such effects 
were found to be much weaker if high application rates 
were used. 

Compatibility with other firefighting agents is another 
important property of foams. This aspect has been dis¬ 
cussed above and is considered further below. 

16.28.4 Tests for foam 

There are a number of standard tests to evaluate the per¬ 
formance of foam in extinguishing fire. Standard tests 
include the Underwriters Laboratories and Det norske 
Veritas (DnV) tests and those specified in the MIL Specifi¬ 
cation MIL-F.24385, the draft ISO/DP 7203 and, in the 
United Kingdom, Defence Standards 42—21,42-22,42 -24 
and BS 6535: Part 6: 1988-. Such tests are discussed by 
J.L. Evans (1988) who compares the performance of differ¬ 
ent foams in different tests. 

Tests may be required to establish the effectiveness of a 
foam in a particular application. Details of the conduct of 
tests to select a foam for methylisobutyl ketone (MIBK) 
have been given by Corrie (1974). 

16.28.5 Hazards associated with foam 

Foam is water based and, to this extent, hazards asso¬ 
ciated with water apply to foam also. They include 
increased vaporization of low boiling liquids, reaction with 
incompatible materials and electric shock from live 
wihe incompatible materials and electric shock from live 
electrical equipment. 

Another hazard is rupture of the foam blanket and 
burnback, which may put firefighters at risk. 

Hazard can arise from the use of a foam on a liquid at a 
temperature of 100°C or above. The formation of steam can 
cause a four-fold expansion of the foam with slopover of the 
burning liquid. 

In the case of the medium and high expansion foams 
used to fill spaces, there is the hazard of asphyxiation. 

16.28.6 Hazards associated with foam: static electricity 

Another hazard is ignition of hydrocarbons in a storage 
tank roof by static electricity from foam injection, as 
described by Howells (1993 LPB114). This author describes 
several incidents in which ignition of volatile refined pro¬ 
ducts in a floating roof storage tank appears to have been 
caused by foam injection. He suggests two possible modes 
of charge generation: (1) the settling of water droplets 
through the hydrocarbon liquid and (2) the streaming cur¬ 
rent of the foam mixture leaving the nozzle. 

Using Equation 16.7.173, Howells obtains for the case of a 
tank filled to a depth of 3 m with the bottom earthed, an 
estimated liquid surface potential of 27 kV, a value which 
has been shown in work on road tankers to be hazardous. 
He suggests that an even higher potential may occur if the 
foam jet is applied directly to the liquid surface so that 
the concentration of foam in the fuel is orders of magnitude 
higher than that used in this calculation. 


With regard to the second mechanism, aqueous foam 
systems, has a high conductivity and any charge generated 
at the nozzle would be quickly dissipated back to the branch 
pipe or the tank walls. However, if charged foam enters the 
liquid the charge could be retained. The streaming current 
of foam of foam is not readily calculable, so experimental 
work was undertaken. At the time of writing this work was 
inconclusive. 

16.28.7 Delivery systems for foam 

Foams is delivered to the fire by means essentially similar to 
those used for water. The means used are mainly fixed sys¬ 
tems such as foam-water spray systems and fixed foam- 
water monitors or mobile foam-water systems such as fire 
hoses. Little use is made of foam in portable devices. 

The delivery of foam involves three stages: (1) propor¬ 
tioning of the foam concentrate, (2) foam generation and 
(3) foam distribution. There are a number of methods for the 
proportioning of the foam concentrate. 

The devices for the generation of the foam are incorpo¬ 
rated in the devices used for its distribution, as just 
described. The basic method of generation is aspiration of 
air into the foam. 

A detailed account of methods of proportioning and dis¬ 
tribution is given by Lockwood (1986). 

16.28.8 Applications of foam 

Fire extinction by blanketing may be achieved using foam. 
Low expansion foam is mainly used to prevent, extinguish 
or control fires in storage tank tops and bunds and on spills. 

Foam should he used only if it is compatible with the 
hazardous liquid. In particular, foam is essentially ex¬ 
panded water and, apart from its density, has the general 
characteristics of water. It is just as unsuitable as water for 
fighting fires involving electrical equipment or substances 
which have undesirable reactions with water. 

Other conditions for the use of foam are that the liquid 
surface be horizontal and that the temperature of the liquid 
be not too high. The liquid temperature should be below the 
boiling point. If the liquid temperature is below the boiling 
point but above 100°C, water in the foam will turn to steam, 
which can result in a very large expansion of the foam. 

There are optimum rates of application of foam. For low 
expansion foam with an expansion ratio of 8 :1 an applica¬ 
tion rate of 0.1 USgal/ft z will give 0.8 USgal/ft 2 min of 
foam. Foam application rates are discussed by Lockwood 
(1986). The foam should be applied gently. 

Medium and high expansion foams are used to prevent, 
extinguish or control fire in spaces such as ships’ holds. 
Application systems for these foams comprise both (1) total 
flooding systems and (2) local application systems. 

16.28.9 Fixed foam systems 

For low expansion foam, one type of fixed foam system is 
the foam-water deluge system. Another type of system 
is the foam-water monitor. Fixed foam systems are used 
for fire prevention, extinguishment and control in bunds 

Relevant codes are NFPA11 for low expansion systems, 
NFPA11A for medium and high expansion systems, NFPA 
16 for deluge foam-water sprinkler and spray systems and 
NFPA 16A for closed head foam—water sprinkler systems. 

The fighting of a major fire requires a very large quantity 
of foam. An example quoted by G. Nash (1966) is a 
requirement of 300 x 5 UKgal drums for a 30 min foam 
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attack on a single 150 ft diameter oil storage tank. The 
supply, and disposal, of such a large number of drums in an 
area congested with fire appliances and hoses constitutes a 
major problem. He describes the alternative of providing a 
piped supply of foam concentrate. 

16.28.10 Fixed foam systems for storage tanks 

A particularly important application of foam is the protec¬ 
tion of storage tanks. Avariety of systems are used. Accounts 
of foam systems for storage tanks are given by E.M. Evans 
and Whittle (1974), P. Nash and Whittle (1978), Lockwood 
(1986) and SKUM (1986). A relevant code is NFPA11. 

For fixed roof tanks some principal arrangements are 
foam chambers, internal tank distributors and subsurface 
foam injection. Foam chambers are installed at intervals on 
the outside near the top of the tank wall, providing an over- 
the-top foam generation (OFG). An alternative is internal 
distributors fitted inside the tank. 

Application of foam at the top of the tank poses several 
problems. If the fire is initiated by an explosion, this may 
well also disable the foam system. The upward flow of air 
caused by the fire may interfere with the distribution of the 
foam. In a large tank the foam may not reach the centre. 

Subsurface foam injection is designed to counter these 
difficulties. Foam is injected under pressure up through the 
liquid in the tank. Injection may be through the product 
pipe or a dedicated line, Mobile foam trucks may be used to 
provide the foam supply. 

Floating roof tanks may be open top or closed. They have 
a good fire record so that foam systems are generally not 
required, with one exception, This is the need to cater for 
rim fires which can occur on either type. An open-type 
floating roof tank may be protected by a fixed foam system 
which pours foam into the annulus formed by the tank wall 
and a foam dam. A closed floating roof tank may be pro¬ 
tected using a top injection system similar to those used in 
fixed roof tanks. Subsurface foam injection is not generally 
used for floating roof tanks since a tilted or sunken roof can 
cause poor foam distribution. 

16.28.11 Mobile foam systems 

Foam trucks are the principal mobile mode of delivery for 
foam. The trucks are typically purpose built twin agent 
trucks with a capability of delivering dry chemicals also. 

Relevant codes are NFPA 1901 which covers basic water 
systems with a foam option, and NFPA 11C which covers 
foam trucks. 

Foam trucks carry a supply of foam concentrate and 
delivery hoses and can be equipped with telescopic booms 
of articulated towers. They have low clearances to allow 
passage under pipe bridges. A combined agent truck might 
typically carry AFFF and dry chemical. Monitor capacities 
are of the order of 500-1000 USgal/min. 

There are a variety of mobile devices that can be used to 
apply foam to the top of a storage tank which is on fire. They 
include mobile foam monitors and foam towers. There are 
a number of problems in using a foam monitor for this 
purpose, such as crosswinds and fire updrafts, and a sig¬ 
nificant proportion can be wasted. Lockwood advises 
making an allowance of 60% above the desired application 
rate to allow for such factors. 

16.28.12 Vapour suppression by foam 

Fire control and extinguishment is not the only use of 
foam. Another important application is the suppression of 


vaporization from toxic liquid spills. This use of foam is 
treated in ASTM-F-1129-88 Standard Guide for Using 
Aqueous Foams to Control the Vapor Hazard from Immiscible 
Volatile Liquids. Vapour suppression using foam is dis¬ 
cussed in Chapters 15 and 18. 


16.29 Fire Protection Using Dry Chemicals 

An alternative to water or water-based foam is dry chemi¬ 
cals, or dry powders. Accounts of dry chemicals include 
those by T.G. Lee and Robertson (1960), Vervalin (1964e), 
Laffitte etal. (1965), Emmrich (1971), Wesson (1972), Wool- 
house and Sayers (1973), Schweinfurth (1974), Stauffer 
(1975), MITI (1976) and Ewing et al. (1989a,b). Fire protec¬ 
tion using dry chemicals is treated in the NFPA Handbook 
by Haessler (1986). 

Relevant codes and standards are NFPA 17: 1990 Dry 
Chemical Extinguishing Systems and BS 6535:1989— Fire 
Extinguishing Media, Part 3:1989 Specification for Powder. 

The use of dry chemicals has been developed particu¬ 
larly in Germany, wher some large fixed and mobile sys¬ 
tems have been used. Since with dry chemicals it is 
essential to apply enough agent to extinguish the fire out¬ 
right, their use on large fires requires the availability of 
large quantities. 

16.29.1 Mechanisms of fire extinguishment 

The principal mechanism by which dry chemicals act 
against fire is to cause chain termination of the combustion 
reactions. There are several other less significant mech¬ 
anisms. The bicarbonate chemicals release carbon dioxide 
in an endothermic reaction. To some extent the gas evolved 
blankets the liquid and the gas evolution reaction has a 
cooling effect, whilst the particle cloud reduces the heat 
transfer between the flame and the liquid surface. 

Treatments of the inhibition mechanisms and general 
theory of dry chemicals are given by Laffitte et al. (1965), 
Laffitte and Bouchet (1959), Dewitte, Vrebosch and van 
Tiggelen (1964), Birchall (1970), Iya,Wohowitz and Kaskan 
(1975), McHale (1975), Spence and McHale (1975), Vanpee 
and Shirodkar (1975), Mitani (1981,1982,1983) and Mitani 
and Niioka (1982). 

The combustion chain reactions are broken by adsorption 
on solid surfaces. Thus for a given material a large powder 
specific surface enhances the effectiveness. Haessler (1986) 
states that best results are obtained with a particle size range 
of 10-75 pm with a median size of 20—25 pm. 

16.29.2 Types of dry chemical 

Some basic dry chemicals are (1) sodium bicarbonate 
(standard dry chemical), (2) potassium bicarbonate, 
(3) potassium chloride, (4) urea potassium bicarbonate 
(5) monoammonium phosphate. There are also the 
formulations (6) general purpose powder (ABC) and 
(7) Monnex powder. 

Standard dry chemical consists principally (over 90%) 
of sodium bicarbonate with additives to improve fluidity, 
non-caking and water repellent characteristics. Potassium 
bicarbonate formulation, however, are also used and are 
about iy 2 -2 times as effective as those with the sodium 
bicarbonate base. 

General purpose powder is a mixture of ammonium 
dihydrogen phosphate, diammonium hydrogen phosphate 
and ammonium sulfate. 
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Monnex is a potassium alkali based material. The parti¬ 
cles disintegrate in contact with the flames and thus give a 
greatly enhanced surface area. Its effectiveness is about 
5-6 times that of standard dry chemical. 

16.29.3 Properties of dry chemicals 

Dry chemical formulations may be ranked in respect of 
their effectiveness in extinguishing fires according to their 
performance in test. This performance is a function both of 
the chemical composition and the particle size. 

Some types of dry chemical based on sodium or potas¬ 
sium bicarbonate are not compatible with foam. The dry 
chemical, and particularly the additives, tend to break 
down the foam bubbles. However, foam-compatible forms 
for dry chemical are also available. 

In storage, dry chemicals are stable at normal and low 
temperatures but deteriorate at high temperature. Haessler 
quotes an upper temperature for storage of 120°C. Different 
dry chemicals should be segregated. Mixing of alkali and 
acid agents can result in release of carbon dioxide, and inci¬ 
dents have occurred where extinguishers have exploded. 

16.29.4 Hazards associated with dry chemicals 

One hazard from the use of dry chemicals is that due to the 
sudden release of the agent. Another hazard is unexpected 
reignition. The main toxic hazards following the use of dry 
chemicals will generally be those due to the combustion 
process. Dry chemicals themselves are non-toxic. 

16.29.5 Delivery systems for dry chemicals 

Dry chemicals are delivered to the fire mainly by fixed 
systems, from cylinders or by mobile systems. They are 
also on of the agents used in portable extinguishers. 
Delivery from cylinders is by hand held hose line. 

16.29.6 Applications of dry chemicals 

Dry chemicals are used to extinguish fire. They are utilized 
on class A fires (combustible materials), Class B fires 
(flammable liquids) and Class C fires (electrical equipment) 
in the NFPA classification. With regard to the latter, dry 
chemicals tend to be somewhat corrosive and to insulate 
contact surfaces. They are not suitable, therefore, for fires 
in delicate electrical equipment but can be used on fire of 
equipment such as transformers and circuit breakers. 

Dry chemicals are an extremely versatile type of agent. 
They are low hazard and non-toxic. They can deal with a 
wide range of fires. They find application to extinguish¬ 
ment of large outdoor fires, to protection of spaces indoors 
and in portable extinguishers. 

A dry chemical agent acts by extinguishing the fire in a 
single shot. In this it can be extremely effective. It is 
necessary, however, to use sufficient powder to ensure that 
the flame is completely extinguished. Otherwise once the 
powder is exhausted reignition is liable to occur. A dry 
chemical has little cooling effect and does not leave behind 
an inert atmosphere. 

There are also other potential causes of reignition when a 
dry chemical is used. Vapours from a flammable liquid may 
be reignited by a hot surface, a combustible solid may be 
reignited by smouldering material and an electrical fire 
may reignite due to continued arcing. 

If the fire is one in a combustible material and there is no 
reason why water should not be used, it may be advisable to 
use follow up with water to complete the extinguishment of 
the fire. 


16.29.7 Fixed dry chemical systems 

Fixed dry chemical systems may be (1) total flooding sys¬ 
tems or (2) local application systems. A fixed system may 
be supplemented by hand held hose lines from cylinders. 

16.30 Fire Protection Using Vaporizing Liquids 

Another type of firefighting agent is the vaporizing 
liquid. Accounts of vaporizing liquids include Haloge- 
nated Fire suppressants (Gann, 1976) and those by 
Burgoyne and Richardson (1949a), Rasbash (1968), Hirst 
(1974a,b), Boughen (1979,1982), Forrester (1982), Peissard 
(1982), Capper (1983), C.C. Grant (1985), Hoskins (1985), 
R.J. Martin, Shepherd and Hamlin (1986), Goodall (1988), 
Boyce (1990) and Senecal (1992a,b). Fire protection using 
vaporizing liquids is treated in the NFPA Handbook by 
DW Moore (1986). 

Relevant codes and standards are NFPA 12A: 1992 Halon 
1301 Fire Extinguishing Systems, NFPA 12B: 1990 Halon 
1211 Fire Extinguishing Systems, NFPA 2001: Clean Agent 
Fire Extinguishing Systems, BS 5306: 1976— Fire Extin¬ 
guishing Installations and Equipment on Premises, Part 5: 
1982- Hahn Systems and BS 6535: 1989- Fire Extingu¬ 
ishing Media, Part 2:1989- and Hahns, Section 2.1:1989 
Specification for Halon 1211 and Halon 1301 and Section 2.2: 
1989 Code of Practice of Safe Handling and Transfer 
Procedures. 

16.30.1 Mechanisms of fire extinguishment 

Vaporizing liquids act against fire by essentially the same 
two mechanisms of interruption of the chain reactions and 
of blanketing. Treatments of the inhibition mechanisms 
and general theory of vaporizing liquids are given by Belles 
and O’Neil (1975), Spence and McHale (1965), W.E. Wilson, 
O’Donovan and fristrom (1969), Dixon-Lewis and Simpson 
(1977), P.F. Thorne (1978b), Westbrook (1982c) and Mitani 
(1983). 

16.30.2 Types of vaporizing liquid 

The substances used as vaporizing liquids are halogenated 
hydrocarbons. They include the following classes: halon 
(H), hydrofluorocarbon (HFC), hydrochlorofluorocarbon 
(HCFC) and perfluorocarbon (PFC). The halons contain 
bromine and the perfluorocarbons contain fluorine as the 
only halogen. 

Prominent halons are: 

Halon 1211 Bromochlorodifluoromethane (BCF) CF 2 ClBr 
Halon 1301 Bromotrifluoromethane (BTM) CF 3 Br 
HCFCs include: 

HCFC-22 Chlorodifluoromethane CHC1F 2 
HCFC-124 Chlorotetrafluoroethane C 2 HF 4 C1 
Vaporizing liquids are available which are much more 
effective extinguishants than carbon dioxide. Table 16.87 
shows the relative effectiveness of various vaporizing 
liquids in extinguishing a hexane test fire (Hearfield, 1970). 
Whereas a concentration of 28% was required for carbon 
dioxide, the concentrations required with the vaporizing 
liquids were as shown in the table. 

One of the most efficient extinguishing agents is Halon 
1301. The relative fire extinguishing capability of other 
vaporizing liquids may be expressed in terms of the relative 
mass extinguishing efficiency (RMEE), defined as the 
ration of the mass extinguishing concentration of the agent 
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Table 16.87 Extinction of hexane test fire by 
vaporizing liquids (after Hearfield, 1970) 


Hexane fire 
extinction 
(%v/v) 

Bromochlorodifluoromethane 

CBrClF z 

5.2 

(BCF) 



Dibromodifluoromethane 

CBr 2 F 2 

3.6 

Trifluoromethyl bromide 

CF 3 Br 

4.2 

Chlorobromomethane 

CH 2 ClBr 

6.4 

Methyl bromide 

CH 3 Br 

7.7 

Carbon tetrachloride 

CC1 4 

9.9 


to that of Halon 1301 in a standard test. One such standard 
test is the ICI cup burner test. 

Halon 1211, or bromochlorodifluoromethane (BCF), is 
now the principal vaporizing liquid. A comparison at 20°C 
of Halon 1211 with carbon dioxide shows that the specific 
gravities relative to air are 6.35 and 1.52 and the vapour 
pressures 2.61 and 57.2 bar, respectively. Thus BCF gives a 
better blanketing action and does not require such high 
strength containers. 

Halon 1211 is a very effective extinguishing agent for 
flammable liquid and electrical fires. It is electrically non¬ 
conducting. Its cooling capacity, however, is low (latent heat 
134 kj/kg). It is capable, therefore, of dealing with a small 
solids fire but not with a large one. 

Most Halon 1211 and Halon 1301 systems are of the 
total flooding type used to protect an enclosed space. The 
concept is that the halon is injected into the space and 
develops an approximately uniform concentration capable 
of extinguishing a fire anywhere in the enclosure. The 
alternative method of deployment of halon systems in local 
application in which the jet of halon is directed at the seat of 
the fire. 

It is usually desirable to follow up the extinction of fire by 
Halon 1211 with water of foam cooling. This does not apply, 
however, to electrical fires or to situations where electrical 
equipment is near the seat of the fire. 


16.30.3 Properties of vaporizing liquids 

Vaporizing liquids may be ranked in respect of their effec¬ 
tiveness in extinguishing fires according to their perfor¬ 
mance in tests. There are numerous tabulations of relative 
effectiveness in particular tests. 

Properties of a vaporizing liquid which bear on its effec¬ 
tiveness as a fire fithting agent include (1) chemical action, 
(2) vapour pressure and (3) density. 

The ability to arrest combustion by interfering with the 
chain reactions is obviously a prime property. 

The vapour pressure is significant in several respects. 
It determines the ability of the agent to discharge under its 
own pressure, the extent to which the flow in the pipework 
is two-phase and the behaviour of jet. 

The density of the agent affects the mixing in the space 
into which is it discharged. 

Compatibility with foams is another relevant property 
of vaporizing liquids. 

In storage, early vaporizing liquids tended to give rise to 
corrosion problems. Halon 1301 and Halon 1211 have little 
corrosive action, provided that free water is not present. 


16.30.4 Hazards associated with vaporizing liquids 

There are certain toxic hazards associated with the use of 
vaporizing liquids. These include the toxic effects of (1) the 
agent, (2) the breakdown products of the agent and (3) the 
combustion products of the fire. 

The first vaporizing liquid used was carbon tetra¬ 
chloride, which is toxic. It was superseded by methyl bro¬ 
mide, which is highly toxic. Dibromofluoromethane is a 
convulsant. Chlorobromomethane is moderately toxic and 
produces narcosis. Bromochlorodifluoromethane (BCF) 
has a low acute toxicity. Bromotrifluoromethane (BTM) has 
an even lower acute toxicity, but also a very low boiling 
point (-58°C), so that contact can cause freezing of the skin 
and eyes by evaporation. 

Vaporizing liquids give rise to decomposition products in 
fires. Halon 1211 yields the products hydrogen chloride, 
hydrogen bromide and hydrogen fluoride, which are 
extremely irritating to the eyes, nose and throat. 

D.W. Moore (1986) gives the following approximate lethal 
concentrations of the natural vapour and of the decom¬ 
posed vapour for a 15 min exposure: 



Lethal concentration (ppm) 


Natural 

Decomposed 


vapour 

vapour 

Methyl bromide 

5,900 

9,600 

Bromochlorodifluoromethane 

324,000 

7,650 

Bromotrifluoromethane 

832,000 

14,000 


The toxicity of the combustion products of the fire is another 
significant factor in firefighting using vaporizing liquids. 


16.30.5 Delivery systems for vaporizing liquids 

Vaporizing liquids are delivered to the fire mainly by fixed 
systems. They are the agents used in portable extinguish¬ 
ers. Vaporizing liquids are less suitable for delivery from 
cylinders by hand held hose line or from mobile equipment. 
In addition, vaporizing liquids are used in fixed systems to 
suppress combustion inside plant. 

16.30.6 Applications of vaporizing liquids 

Vaporizing liquids are used to extinguish fires. They are 
utilized for this purpose in enclosed spaces, and in portable 
extinguishers. They are also used to suppress incipient 
combustion inside plant. 

16.30.7 Fixed vaporizing liquid systems 

Fixed vaporizing liquid systems may be (1) total flooding 
systems or (2) local application systems. 

The hydraulics of some vaporizing liquid systems 
may involve two-phase flow. Although Halon 1211 can 
usually be treated as a single liquid phase in the pipework, 
Halon 1301, which exists as a single liquid phase in stor¬ 
age, begins to vaporize as it travels down the pipe. The 
flow characteristics of halon systems are discussed by 
Williamson (1976) and Wiersma (1978). Computer programs 
for halon hydraulics have been developed by suppliers. 

Halon systems tend to be subject to corrosion. The prob¬ 
lem is discussed by Peissard (1982). 

16.30.8 Vapour retention tests 

A feature of interest for a space protected by a halon 
system is the retention time of the halon. A method for the 
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determination of this has been developed by the NFPA 
based on its Enclosure Integrity Test. In this integrity, or 
pressure, test, portable fan equipment is used to create a 
pressure difference between the protected volume and the 
surrounding space. Measurements are made from which 
the effective leakage area of the enclosure can be estimated. 
This is then used to calculate the halon retention time. 
Vapour retention tests are discussed by Genge (1989), 
Sreeves (1989) andWhiteley (1989). 

16.30.9 Precautions 

As stated earlier, guidance on the precautions to be taken to 
counter the toxic and asphyxiation hazards of halon and of 
inert gas extinguishing systems is given in GS16. There are 
a number of general precautions to be taken with any gas¬ 
eous extinguishing system. If the system is an automatic 
one activated by rapid response fire detectors, two separate 
detection signals should be provided in order to reduce the 
frequency of false activations. The space protected should 
be provided with warning signs at all entrances. There 
should be an indication as to whether the system is set for 
manual or automatic activation. 

If the system is a manually activated one, the release 
devices should he so located such that the person operating 
the device is not at risk from the fire or the discharge of 
the agent. For a total flooding system, activation of the 
system should be accompanied by an audible alarm dis¬ 
tinct from the fire alarm. The entrances should have con¬ 
tinuous warning signs which remain on until the space 
has been certified as fit to re-enter. There should be suit¬ 
able escape routes. The space should be provided with 
adequate means of ventilation after a fire and/or discharge 
of the agent. 

The installation should be covered by a safe system of 
work. The system should be subject to regular inspection 
by a competent person. GS 16 states that such an inspection 
should be done not less than twice a year and should result 
in an inspection report. It also details the precautions to be 
taken during maintenance. One measure required is the 
provision of a means of isolating the agent storage tank for 
maintenance or other circumstances where normal escape 
might be difficult. 

GS 16 gives guidance on the selection of the agent and the 
system. The choice should have regard to the hazards to 
personnel. A local application system tends to involve less 
risk of personnel being trapped and may be preferable in 
some circumstance. If a total flooding system is used, the 
volume of the space protected should be kept to a minimum 
and the design should avoid excessive concentrations of 
the agent. 

Account should be taken of the possibility that discharge 
of the agent may raise a dust cloud, with the attendant risk 
of a dust explosion. 

With regard to the precautions which relate specifically 
to the agent, for a total flooding system using Halon 1211 
the system should ensure that discharge does not occur 
whilst personnel are present. For a local application system 
for Halon 1211 the requirement is to design so that there is 
no foreseeable risk of a hazardous concentration being 
produced. 

For Halon 1301 the precautions required are related to the 
concentration of the agent which may be attained. GS 16 
states that, provided the concentration of this halon will not 
exceed 6%, and subject to certain other qualifications, an 
automatic total flooding system may be used to protect a 


normally occupied space. The space should be evacuated 
before the concentration of Halon 1301 exceeds 6%. It may 
be appropriate to incorporate a short time delay and pre¬ 
discharge alarm, but in order to ensure rapid response to 
the fire, the delay should not usually exceed 30 s. 

16.30.10 Halon phase-out 

The discovery by Molina and Rowland (1974) that chlorine 
can act as a catalyst for the conversion of ozone to mole¬ 
cular oxygen in the upper atmosphere initiated a growing 
concern for the state of the ozone layer. It was subsequently 
shown that halons have a particularly damaging effect. 

This has led to the Montreal Protocol on Substances 
that Deplete the Ozone Layer, 1987, which lays down a pro¬ 
gramme for the phasing out of halons. Amendments to 
the treaty have been made at meetings in 1990 and in 
November 1992. Accounts of the Montreal Protocol and its 
implications for halon systems are given by Senecal 
(1992a,b), Hough (1993) and Simmonds (1993). The halons 
discussed are primarily Halon 1211 and Halon 1301. The 
original Montreal Protocol provides that the production of 
halons be reduced to 50% of the 1986 level by 1994 and to 
0% by 1999. 

With regard to the continued use of existing halon sys¬ 
tems and to the recycling of halons for use in such systems, 
national policies vary. Germany has banned the use of 
halon firefighting systems. According to Simmonds, in the 
absence of a suitable halon destruction technology, it is 
current policy not to dismantle the systems or return them 
to the suppliers but to let them remain on site capped off. 

In the United States, it is government policy to permit 
continued use of existing systems and the recycling of 
halons for use in such systems. 

The United Kingdom also is evidently moving towards 
a policy of permitting continued use of existing systems, 
as evidenced by the HSE draft guidance on Gaseous Fire 
Extinguishing Systems. 

Amendments to the Montreal Protocol also cover HCFCs, 
the production of which is to be frozen at 1989 levels and 
phased out by 2030, or possibly earlier. 

16.30.11 Halon replacement and clean agents 

The demise of the use of halons has led to a search for 
alternatives. These alternatives include both other vapor¬ 
izing liquids and agents other than vaporizing liquids. 
Alternatives to halons have been reviewed by the Halons 
Tfechnical Options Committee (G. Taylor, 1991) of the UN 
Environment Programme (UNEP). Other accounts of 
alternatives include those by Senecal (1992a,b), Hough 
(1993), McKay (1993) and Simmonds (1993). NFPA 2001: 
1994 deals with clean agent alternatives to halons. 

A review of vaporizing liquids used or proposed for use 
as fire extinguishing agents is given by Senecal (1992b), 
who covers HCFCs, HFCs and PFCs as well as C0 2 , with a 
comparative tabulation of relevant properties and a 
detailed discussion of each agent. 

Hough (1993) also reviews alternatives, but ranges more 
widely, from designing out of the need, through other 
vaporizing liquids, notably HCFCs, to foam, dry powder 
and fogging systems. 

An account of work on the later has been given by McKay 
(1993). Building on research on burner nozzle technology, 
a fine water spray system has been developed which uses 
water droplets in the diameter range 80-200 pm and is 
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claimed to be a highly effective suppressant alternative to 
halons. 

16.31 Fire Protection Using Inert Gas 

The last of the principal firefighting agents is inert gas. 
Here a distinction needs to be made between the use of 
inerting of equipment to prevent internal fire or explosion, 
as described in Chapter 17, and the use of inert gas to 
extinguish fire, which is considered here. 

Accounts of the use of inert gas for fire extinguishment 
include those by Burgoyne, Katan and Richardson (1949b), 
McGuire (1864) and Bryant (1991). Fire protection using 
inert gas is treated in the NFPA Handbook by P.F. Johnson 
(1986) and, for carbon dioxide, by Williamson (1986). 

Relevant codes and standards are NFPA 12:1993 Carbon 
Dioxide Extinguishing Systems and BS 5306: 1976— Fire 
Extinguishing Installations and Equipment on Premises, 
Part 4:1986 Specification for Carbon Dioxide Systems and 
BS 7273: Code of Practice for the Operation of Fire Protection 
Measures, Part 1:1990 Electrical Actuation of Gaseous Total 
Flooding Extinguishing Systems. 

16.31.1 Mechanisms of fire extinguishment 

Extinguishment of fire by an inert gas is effected by redu¬ 
cing the concentrations both of the fuel and of oxygen. 
Design of an inert gas system is based on reducing the 
concentration of oxygen below that which will support 
combustion. A further, more recently favoured, mechanism 
is the reduction of the flame temperature below that 
necessary for combustion - the thermal ballast effect. 

Inert gas also has a cooling effect. A large mass flow of 
gas over a liquid surface can be beneficial in preventing 
ignition when the discharge ceases and the liquid again 
comes in contact with air. 

These latter mechanisms indicate that it is desirable that 
the inert gas have a high heat capacity. 

16.31.2 Types of inert gas 

The principal individual inert gases used in fire protection 
applications are carbon dioxide and nitrogen. Use is also 
made of inert gas mixture formulations. 

16.31.3 Properties of inert gas 

Properties of an inert gas relevant to its use fire protection 
include (1) its density, (2) its vapour pressure, (3) the mini¬ 
mum concentration required for extinguishment and (4) its 
gas specific heat. 

The density of the gas affects both its ‘throw’ and its 
subsequent flow. 

The vapour pressure is relevant to the ability of the gas 
itself to provide the pressure necessary for discharge. An 
advantage of carbon dioxide, for example, is that its vapour 
pressure at room temperature is high enough to give satis¬ 
factory discharge. 

The minimum concentration for extinguishment sets 
the lower limit of concentration of inert gas to be used. 
Information on this minimum concentration has been given 
by Coward and Jones (1952 BM Bull. 503), and has been 
widely reproduced. Values for carbon dioxide are tabulated 
by Williamson (1986). 

As just indicated, a high gas specific heat is beneficial 
in that it enhances the thermal ballast and cooling effects 
of the inert gas. This is one of the advantages of carbon 
dioxide with its high heat capacity. 


16.31.4 Hazards associated with inert gas 

The two principal inert gases used are carbon dioxide and 
nitrogen. Carbon dioxide is mildly toxic, but the main 
hazard with both gases is hat of asphyxiation. This hazard 
is present in all fire situations, but insofar as the extin¬ 
guishment of fire requires high concentrations of inert gas 
the hazard is enhanced. 

The density of the gas is relevant to the asphyxiation 
hazard; the density of nitrogen is close to that of air, whilst 
that of carbon dioxide is appreciably greater, so that it may 
accumulate in low lying spaces. 

16.31.5 Delivery systems for inert gas 

Inert gases are delivered to the fire by fixed systems, but 
not normally by mobile systems. The inert gas carbon 
dioxide is one of the agents used is portable extinguishers. 
In some cases hand held hose liens from cylinders are used 
to supplement a fixed delivery system. 

16.31.6 Applications of inert gas 

Inert gases are used to extinguish fires. They are utilized 
for this purpoe in enclosed spaces, and in portable 
extinguishers. 

16.31.7 Fixed inert gas systems 

Inert gases are used in (1) total flooding systems, (2) local 
applicaton systems and (3) hand held hose lines. 

In a total flooding system the inert gas is injected into an 
enclosure in sufficient quantity to ensure the minimum 
concentration for extinguishment. 

In a local application system a jet of inert gas is directed 
at the surface protected, which is typically a tank surface 
but may also include the adjacent floor area. There is a 
minimum discharge time for effective extinguishment, 
that recommended for carbon dioxide being 30 s. 

For carbon dioxide, hand held hose lines from cylinders 
are also used. 

16.31.8 Precautions 

The precautions given in GS 16 for halon and inert gas 
extinguishing systems have been outlined in the previous 
section. Those for an inert gas are broadly similar to those 
for Halon 1211. The essential requirement is to ensure that 
operation of the system does not expose personnel to 
hazardous concentrations. For a total flooding system this 
means that the arrangement should prevent the system 
from operating when personnel are present, whilst for a 
local application system the requirement is to design so 
that there is no foreseeable risk of a hazardous concentra¬ 
tion being produced. 

16.32 Fire Protection Using Special Methods 

In addition to the methods just described, there are also 
several special methods of fighting fires. They include the 
use of (1) solids and powders, (2) wet water or wet water 
foam and (3) combined agent systems. Fire protection using 
such special methods is treated in the NFPA Handbook by 
P.F. Johnson (1986). 

16.32.1 Solids and powders 

In addition to dry chemicals, use is also made of various 
kinds of dry powder, sand and other solid materials. One 
group of solid agents comprises those used for metal fires, 
for example, talc, soda ash and graphite. 
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Another solid agent is glass granules used for the control 
of LNG bund fires (Lev, 1981). The granules are stores 
within the bund and, when an LNG spill occurs, they float 
to the top. The mechanism of action is reduction of the 
radiation from the flame to the surface and thus of the 
evaporation of the fuel. 

A third solid agent is carbon microspheres used for extin¬ 
guishment of metal fires (McCormick and Schmitt, 1974). 

Treatments of the extinguishment mechanisms of dry 
powders, including inert particulates, are given by Dolan 
(1957), McCamy, Shoub and Lee (1957), Morikawa (1976) 
and G. Russell (1977). 

The provision of sand buckets for dealing with small fires 
has long been common practice on process plant. Sand is 
also used for diking in, and thus containing, liquid spillages. 

16.32.2 Wet water and wet water foam 

A second special method is the use of wetting agents to 
modify the properties of water, thus producing ‘wet water’. 
A relevant code is NFPA18:1990 Wetting Agents. 

In this context a wetting agent is one which, when added 
to water, effects a substantial change in its surface tension, 
thus increasing its ability to penetrate and spread. The 
wetting agent may also impart emulsifying and foaming 
characteristics. 

The use of a wetting agent makes the water more ‘effec¬ 
tive’ so that less is needed. This is of particular value in 
firefighting where water is in short supply. A typical 
application is to forest fires. 

If the wetting agent has suitable foaming qualities, a wet 
water foam is produced. 

Fixed water sprinkler and water spray systems, as 
described in NFPA 13 and NPFA 15, may be designed to 
operate on wet water. 

16.32.3 Combined agent systems 

A third special method is the use of a combination of 
agents. An early application of the combined agents tech¬ 
nique was the use during World War II of a combination of 
carbon dioxide and foam to attack a spill of aviation fuel 
from an aircraft and so rescue the aircrew. 

Some agent combination used are (1) water and foam, 
(2) carbon dioxide and foam and (3) certain dry chemicals 
and foam. Thus foam is prominent as one of the agents in 
such combinations. 

In some cases the agents are applied simultaneously, in 
others they are used in rapid succession. A typical case of 
the application of a dry chemical and foam combination 
might be to extinguish fire on a flammable liquid by a large 
but short discharge of dry chemical and then to blanket the 
liquid with foam to prevent reignition. 

16.33 Fire Protection Using Portable Extinguishers 

So far only passing reference has been made to portable 
fire extinguishers. These are, however, another important 
resource for fire protection. Accounts of portable fire 
extinguishers are given by Guccione (1961), Guise and 
Zeratsky (1965,1982) and P. Nash (1969,1991). Fire protec¬ 
tion using portable fire extinguishers is treated in the 
NFPA Handbook by M.E. Petersen (1986a,b). 

Relevant codes and standards are NFPA 10:1990 Portable 
Fire Extinguishers andBS 5423:1987 Specification for Port¬ 
able Fire Extinguishers with its associated standard BS 
6643:1985- Recharging Fire Extinguishers. There are also 
a number of Underwriters Laboratories (UL) standards. 


It is a fundamental principle of firefighting that a fire 
should be hit hard and quickly, preferably before it has a 
chance to take hold. Usually the time which elapses before 
the fire brigade arrives is measures in minutes, even tens 
of minutes, and by then the fire may be well developed. 
For some hazardous items prompt response can best be 
achieved by an automatic fire protection system. For others, 
portable fire extinguishers provide the necessary means. 

Conditions for success in the use of portable fire extin¬ 
guishers are that the fire be small, that extinguishers be 
accessible, that they be of the right type, that they operate 
when activated and that personnel capable of using them 
are present. 

These conditions have a number of implications. The 
potential sources of fire need to be idenftified and extin¬ 
guishers with appropriate agents located at suitable points. 
The selection and maintenance of the extinguishers should 
take account of any potential unrevealed failure. Personnel 
should be trained in their use. 

Fires of combustible materials (NFPA Class A), flam¬ 
mable liquids (Class B), electrical equipment (Class C) and 
metals (Class D) can all be dealt with by the use of suitably 
chosen portable fire extinguishers. 

Principal agents used in portable fire extinguishers are 

(1) water, (2) foam, (3) carbon dioxide, (4) dry chemicals, 
(5) vaporizing liquids and (6) dry powders. Broadly, water 
is used on Class A fires and foam (AFFF) on Class B fires. 
Carbon dioxide and suitable dry chemicals and vaporizing 
liquids (Halon 1211) are used on fires of Classes A-C and 
dry powder is used on Class D fires. Some dry chemicals 
are suitable for fire Classes B and C and others for Classes 
A-C. A detailed tabulation of agents and their applications 
is given by M.E. Petersen (1986b). 

There are several different principles of operation of a 
portable fire extinguisher. For water and foam extinguish¬ 
ers the three traditional types have been: (1) stored pres¬ 
sure, (2) pump tank and (3) inverting. In a stored pressure 
type the agent is expelled by an expellant gas held in the 
same chamber. In a pump tank type expulsion of the agent 
is effected by pressure generated by operation of the hand 
pump. The inverting type has been obsolete for some years; 
manufacture in the United States ceased in 1969. The 
agents used only in this type, soda acid and foam, have also 
become obsolete. 

Other portable extinguishers utilize (1) stored pressure, 

(2) cartridge or (3) self-expulsion methods. As just explained, 
in the stored pressure type, the agent and expellant gas are 
held in the same chamber, whilst in the cartridge type the 
expellant is held in a separate cartridge. Dry chemical extin¬ 
guishers use both stored pressure and cartridge methods. 
Halon 1211 extinguishers tend to use stored pressure. In 
carbon dioxide extinguishers the agent is self-expelling. 

16.34 Fire Protection Applications 

Firefighting applications in process plant may be classified 
according to the material on fire or according to the plant 
and storage protected. The applications considered here 
are, by material, (1) combustible solids fires, (2) flammable 
liquid fires, (3) electrical fires and (4) metal fires and, by 
plant or storage (1) storage tanks and (2) warehouses. 

16.34.1 Combustible solids fires 

A type of fire common in all occupancies is a combustible 
solids fire (NFPA Class A). In the process industries 
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combustible solids occur in bulk and powder forms both in 
process and in storage. Process operations which typically 
involve combustible solids include dust handing plant, 
conveyors and packaging plant. Storage sites such as silos 
and warehouses may contain large quantities of combus¬ 
tible solids. 

There are a number of NFPA codes covering particular 
solid materials. They include NFPA 43A (oxidizers), NFPA 
43B (organic peroxides), NFPA 490 (ammonium nitrate), 
NFPA 654 (powders and dusts) and NFPA 655 (sulfur). 
Other NFPA codes for metals are given in Subsection 
16.34.4. 

Fixed fire protection systems are provided in selected 
cases. The design options depend on the situation. For 
example, a total flooding design is practical only if the 
solids are being handled in an enclosure and it will not 
endanger personnel. 

Where solids are handled indoors, regard should be had 
to the potential difficulties of fighting the fire once it has 
taken hold and is producing large volumes of smoke. It may 
be only minutes before entry into the building becomes 
impossible. This implies that any fixed fire protection sys¬ 
tem should respond rapidly and strongly. 

The fire protection of warehouses is considered further 
in Subsection 16.34.7. 

16.34.2 Flammable liquid fires 

Another type of fire common in the process industries 
particularly is a flammable liquids fire (NFPA Class B). 
Process industry activities involve the processing and sto¬ 
rage of a wide variety of flammable liquids. Storages may 
contain large quantities of flammable liquids. 

Fixed fire protection systems are provided for process 
operations and areas vulnerable to releases and spills, for 
loading and unloading facilities and, above all, for storage 
tanks and vessels. Storage tanks are commonly provided 
with a bund. It is therefore necessary to protect not only 
against a fire in the tank itself but also against one in 
the bund. 

The fire protection of storage tanks in general is con¬ 
sidered further in Subsection 16.34.6. Further accounts of 
the protection of particular types of storage tank such as 
LPG, LNG and ammonia tanks are given in Chapter 22. 

16.34.3 Electrical fires 

There are also certain special types of fire that require 
treatment, once of which is the electrical fire (NFPA Class 
C). If electrical equipment is involved in a fire on a process 
plant, this is generally due to an explosion at the equipment 
itself or to a spread of a fire from the rest of the plant. If there 
is a fire at a piece of live electrical equipment, it is usually 
appropriate to de-energize the equipment, unless there are 
good reasons for not doing so. 

In respect of fire, electrical equipment may be divided 
into (1) equipment which has exposed contacts and 
(2) equipment such as transformers and circuit breakers. 

Among the agents used on electrical fires are water, dry 
chemicals, vaporizing liquids and inert gases, but not all 
agents are suitable for every type of electrical fire. 

Water as a continuous jet conducts electricity and should 
not be used in this form on electrical fires. In the form of 
spray, however, this hazard is much less and is generally 
negligible (O’Dogherty, 1965). 

Some electrical equipment is protected using a fixed 
water spray system. Water sprays are used, for example, to 


protect against fires in oil cooled electrical equipment such 
as transformers, Such a fire is generally the result of an 
electrical breakdown which causes an explosion. Such 
mixed fires of hot oil and hot metal are difficult to handle. 
Typically the oil is being pumped over metal surfaces 
which become hot and sustain the fire. It is important, 
therefore, to ensure that such situations are detected and 
dealt with as early as possible, The protection of such 
electrical equipment with water sprays is a specialist 
matter. It is discussed by P. Nash (1974a). 

Fixed systems for the protection of electrical equipment 
tend to use dry chemicals of carbon dioxide. As already sta¬ 
ted, the former is not suitable for equipment with exposed 
contacts which are liable to suffer adhesion and corrosion. 
Fires of electrical equipment are mainly fought using 
portable carbon dioxide or dry chemical extinguishers. 

16.34.4 Metal fires 

Another type of fire which requires special treatment 
is metal fires (NFPA Class D). Accounts of metal fires 
and methods of dealing with them are given by Reuillon 
et al. (1977), Sharma, Lai and Singh (1987), Varshney, 
Kumar and Sharma (1990), Cardillo and nebuloni (1992) 
and Sharma, Varshney and Kumar (1993). Metal fires are 
treated in the NFPA Handbook by Prokopovitsh (1986) and 
by P.F. Johnson (1986). 

The NFPA codes on the storage of certain metals are of 
some relevance. These are NFPA 48 (magnesium), NFPA 
481 (titanium) and NFPA 482 (zirconium). 

Metal fires involve a number of hazards. Characteristic 
hazards are (1) extremely high temperatures, (2) steam 
explosion and (3) hydrogen explosion, as well as the usual 
hazards of (4) toxic combustion products and (5) oxygen 
depletion. 

Extinguishment of a metal fire is not always achievable 
and it may be necessary to settle for control of the fire. 
The agent used should be matched to the metal: an agent 
suitable for dealing with a fire of one metal may be quite 
unsuitable for that of another. Water should not be used on a 
sodium fire, and a vaporizing liquid should not be used on a 
magnesium fire. That said, there are some powder agents 
which are suitable for fires of several metals, as described 
below. 

Combustible metal extinguishing agents are classified 
according to whether they are (1) approved or (2) propri¬ 
etary. Approved agents are those proprietary agents which 
are tested and approved by organizations such as the UL. 
There are also proprietary agents and non-proprietary 
agents. 

Prominent proprietary agents are Pyrex G1 powder, 
which is a coke powder with an organic phosphate additive. 
Metalguard powder has a similar formulation. Another 
agent is Met-L-X powder, which has a sodium chloride base, 
again with additives. Prokopovitsh gives a tabulation of the 
comparative capabilities of G1 and Met-L-X powders in 
dealing with fires of a number of metals, including alumi¬ 
nium, magnesium, sodium, potassium, titanium, zirco¬ 
nium and lithium. He also discusses the use of other 
proprietary agents and of non-proprietary agents such as 
talc powder, soda ash, salt and sand. 

16.34.5 Storage tanks 

Turning to the fire protection of particular plant and stor¬ 
age, protection of storage tanks is a prominent theme. 
Accounts of fire protection of storage tanks and bunds are 
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given by A.H. Warren (1966), Hearfield (1970), J.R. Hughes 
(1970),Vervalin (1973f). P. Nash and Young (1975 BRE CP42/ 
75), Peyton (1984) and M. Wilson (1993) Fire protection of 
storage tanks is treated in the NFPA Handbook for flam¬ 
mable liquids by M.F. Henry (1986) and for chemicals by 
Bradford (1986b). 

Relevant codes and standards for storage tanks, includ¬ 
ing low temperature storages, are NFPA 30:1990, API Std 
620:1990 and API Std 650:1993, and BS 799:1972-, BS 
2654:1989, Bs 4741:1971 and BS 5387:1976.There are also 
codes for the Storage of particular chemicals such as NFPA 
43A: 1990, which covers liquid oxidizers. 

Fire protection of a storage tank needs to address several 
different scenarios: (1) a fire near to the tank, (2) a fire in the 
top of the tank and (3) a fire in the bund. There are therefore 
requirements for exposure protection by cooling of the tank 
and for fire extinguishments and control in the tank itself, 
in the bund and of a liquid spill outside the bund. 

Among the facilities which may be provided for the fire 
protection of a storage tank are (1) fire resistant thermal 
insulation or fire insulation, (2) a fixed water system for 
cooling, (3) a fixed foam system for the tank top, (4) a fixed 
foam system for the bund, (5) fixed water/foam monitors 
and (6) mobile water/foam monitors, There may also be a 
role for fixed water spray systems for the extinguishments 
and control of liquid spills. 

Foam systems for storage tanks have been discussed in 
section 16.28. A further account of fire protection of storage 
tanks is given in Chapter 22. Firefighting on storage tanks 
is discussed in the next section. 


16.34.6 Storage vessels 

The fire protection of storage vessels, particularly those 
containing liquefied flammable gas, is equally important. 
Accounts of the fire protection of storage vessels are given 
by Petitit (1945), Bray (1964,1966), Chaillot (1966), the FPA 
(1966), ICI/RoSPA (1970IS/74), Eijnhoven, Nieuwenhuizen 
and Wally (1974), I.Williams (1984) and B.M. Lee (1989). Fire 
protection of storage vessels for LFG is treated in the NFPA 
Handbook by walls (1986). 

Relevant codes and standards for storage vessels for LFG 
are NFPA 54:1992, NFPA 58:1992, NFPA 50:1990, NFPA 
59A: 1990, the ASME Boiler and Pressure Vessel Code, Sec¬ 
tion VIII and BS 5500:1991. NFPA 50:1990 covers liquid 
oxygen and NFPA 50A: 1989 and NFPA 50B cover gaseous 
and liquid hydrogen, respectively. 

Among the facilities which may be provided for the fire 
protection of a storage vessel are (1) drainage, including 
sloped ground, (2) fire resistant thermal insulation or fire 
insulation, (3) a fixed water system for cooling and 
(4) depressuring facilities. 

A further account of the fire protection of storage vessels 
is given in Chapter 22. 

16.34.7 Warehouses 

Warehouses are another type of storage which contain large 
quantities of combustible material. The account here is 
limited to fire protection systems; a fuller account of ware¬ 
houses, including prevention of fire, is given in Chapter 22. 

Accounts of fire protection of warehouses include those 
by P. Nash (1972a, 1977), P. Nash, Bridge and Young (1974 
BRE CP68/74), Bridge (1977), Young and Nash (1977), 
Parnell (1979), Field (1985), Murrell (1988) and Murrell and 
Field (1990). 


Much of the work described by these authors was con¬ 
ducted at the Fire research Station, with one programme 
in the mid-1970s (e.g. FRS, 1972 Fire Res. Note 914,916,944; 
P. Nash, 1977) and another in the mid-1980s (e.g. Field, 1985; 
Murrell, 1988). 

A relevant code is NFPA 231C: 1991 Rack storage of 
Materials. 

The fire problem is particularly acute in automated high 
bay, or high rack, warehouses. The FRS work has shown 
that in such situations fire develops rapidly, with flames 
propagating upwards, mainly in the flues between adjacent 
pallets. The fire typically reaches the top of the rack within 
2 min. It becomes virtually impossible to fight the fire by 
conventional means. 

The earlier FRS programme also showed that conven¬ 
tional sprinklers with glass bulbs set to operate at 68° C do 
not respond quickly enough to counter the fire before it 
gains hold. An alternative system was developed in which 
the bays are zoned with setsof sprinklers dedicated to a 
zone and actuated by a fire detection wire ‘laced’ through 
the racking. This system was criticized as being too com¬ 
plex and liable to false alarms and was not taken up by 
industry. 

The later programme, described by Field (1985), con- 
centracted on the response of the sprinkler head. A solder- 
link sprinkler was identified which proved satisfactory. For 
a single localized ignition source the sprinkler system 
operated to extinguish the fire with a maximum water 
volume of 350 UKgal. 

16.35 Firefighting in Process Plant 

The foregoing account has described some of the passive 
measures used to prevent fire and to protect against it and 
some of the agents and equipment available for active 
measures of actual firefighting. It is now necessary to dis¬ 
cuss some of the general principles underlying fire fighting 
in process plants, hearing in mind the wide variety of types 
of fire which may be encountered. 

General accounts of firefighting are given in Manual of 
Firemanship (Home Office, 1974-), Fire fighting in Fur lanes 
(HSE, 1970 HSW Bklt 10) and Fire Attack, Fire Service 
Communications for Fire Attack and The Extinguishment of 
Fire (NFPA, 1966/4, 1972/8, 1974/11). Firefighting in the 
process industries and with chemicals is discussed in 
Fire Protection Manual for Hydrocarbon Processing Plants 
(Vervalin, 1964a, 1973a) and the Fire Training Manual 
(PITB, 1975/6) and by several other authors, particularly 
Risinger (1964b,c,f,g). 

In most firefighting operations on process plant it is 
necessary not only to fight the fire hut also to protect 
the vessels exposed to it. This second activity is just as 
important as the first. 

A fundamental principle of firefighting is to attack the 
fire at as early a stage as possible and to hit it hard. Once a 
fire is well established and has heated up large quantities of 
metal and liquids, it becomes much more difficult to con¬ 
tain it and prevent it growing. There are a number of case 
histories, described in Appendix 1, which illustrate the 
problems of firefighting in process plants. 

16.35.1 Liquid fires 

There are two important distinctions to be made in con¬ 
sidering firefighting of burning liquids. One is that 
between (1) contained fires and (2) uncontained fires. 
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A liquid fire is contained if the liquid is held in a well- defined 
container such as a storage tank, bund or deep depression. 
In other situations, such as spillages or pools, the liquid fire 
is uncontained. In some cases it may even be flowing. 

The other distinction is between fire of (1) high flash¬ 
point liquids and (2) low flashpoint liquids. A liquid with 
high flashpoint can generally be extinguished by cooling 
with water, whereas one with a low flashpoint usually 
needs to be blanketed by foam or dry chemicals. 

Contained fires of either high or low flashpoint liquids 
can normally be extinguished by foam. Fires of contained 
high flashpoint liquids can alternatively be extinguished 
by cooling with water. 

With a highflash point product, such as refined oil, the 
rise in liquid temperature is generally confined to a layer of 
about 2 in. (5 cm) below the liquid surface, even when the 
liquid has been burning for a long time. In consequence, 
when water or foam is added, the heat in the liquid is 
generally not sufficient to cause an oil-water slopover, 
unless the surface is very close to the top of the container. 

The fact that the bulk oil remains relatively cold means 
that it also possible to cool the surface layer by agitating the 
oil. This maybe done, for example, by directing a fire water 
jet down into the liquid. 

It sometimes occurs that a high flashpoint liquid is 
contaminated by error with some low flashpoint material. 
Usually the amount of contaminant does not exceed 5%. 
In such cases the more volatile material tends to burn off in 
the early stages of the fire, leaving an essentially high 
flashpoint liquid again. 

With uncontained fires the first step is generally not to 
extinguish the fire but to cut off the flow of liquid from the 
containment. If such a fire is merely extinguished without 
cutting off the flow of fuel, there is a serious risk that it will 
re-ignite and cause a much larger fire or possibly an 
explosion. It is difficult to overemphasize the importance of 
this point. To quote Risinger (1964g): ‘It is more important 
to know when not to put a fire out than to know the details 
of actual extinguishments.’ With low flashpoint liquids the 
risks include that of a vapour cloud explosion. 

Often the flow of liquid may be stopped by shutting off an 
emergency isolation valve. It is good practice that such 
valves should have remote operation for just this situation. 
Where it is necessary to approach the fire in order to close 
a valve, a water fog may be used to provide a shield from 
the heat. 

Another device which may be adopted where a flam¬ 
mable liquid which has a density below that of water is 
flowing from a pipe connected to the bottom of a tank, is to 
inject water into the tank and so replace the liquid flowing 
through the pipe with water. 

An uncontained fire of a high flashpoint liquid can 
generally be extinguished by the use of water. For a fire on 
a low flashpoint liquid, foam or dry chemicals should 
normally be used. 

Often where dry chemicals are used, it is necessary to 
use water also. Although the former are effective in putting 
out the fire, there is generally a high risk of re-ignition from 
the metal which has been heated by the fire. Typically, it is 
necessary to apply water to cool this metal, then use dry 
chemicals to extinguish the fire, and then apply water to 
cool the liquid. 

With dry chemicals the quantity which can be used and 
therefore the time of application are both strictly limited, 
the latter being generally of the order of some tens of 


seconds. It is essential, therefore, to put the fire out in the 
initial attack. 

In some cases there are simultaneous contained and 
uncontained fires. Atypical example is burning petroleum 
liquid flowing over the side of a storage tank. In such a case 
the procedure is to put out the uncontained fire first. If this 
is done, the uncontained part does not readily re-ignite 
because the more volatile components have already been 
burned off in the tank, whereas if the converse approach is 
taken, the spillage does tend to be re-ignited by flame travel 
over the liquid surface. 

It is not always either practical or desirable to extinguish 
a liquid fire. It is generally impractical, for example, to 
extinguish a very large fire of LPG in an open container or 
spillage. Moreover, even if it were, extinction of the fire 
would create the risk of a vapour cloud explosion. 

The procedure in such cases, therefore, is to cut off the 
flow of liquid to the fire, to cool the container and other 
exposed surfaces and to seek not to put out the fire itself but 
to control it. It is particularly important to cool the surface 
of tanks above the liquid level. If the fire is causing any 
blowtorch effect, the area affected by this should also be 
cooled. 

The use of large quantities of water, or to a lesser extent 
foam, involves the hazard of spreading the fire by dis¬ 
placing and/or floating the burning liquid. This hazard 
should be borne in mind in firefighting operations. 

Further information is given by Risinger (1964g). 

16.35.2 LFG fires 

Fires of liquefied flammable gas (LFG) are often fought 
using dry chemicals or foam, or both in combination. 
Although the extinction of fire is generally desirable, it may 
not always be appropriate or possible. It is nevertheless 
a worthwhile objective to control the fire and so reduce the 
heat radiation from it. 

Large-scale tests on the effectiveness of foam and of dry 
powder on fires have been carried out as part of the 
experiments by MITI (1976), described earlier. In one test 
liquid ethylene was poured into a 3 m diameter bund with a 
wire netting cover and ignited. An attempt was then made 
to extinguish the flame using high expansion foam with an 
expansion ratio of 500 from fixed foam generators with a 
combined output of 200 m 3 /min. The first foam generator 
was started 2 min after ignition and the second 1 min later. 
The rate of application of foam was 7.07 m 3 /m z min. The 
foam brought the fire about 50% under control within 
about 3% min after ignition, and 80% under control just 
over 6 min after ignition. Thereafter the effectiveness of 
control remained unaltered. It was concluded that liquid 
ethylene fires can be kept under control using high expan¬ 
sion foam. 

In another test the fire extinguishing agent used was 
dry powder of ammonium phosphate discharged from two 
vehicles near the bund. An initial discharge of dry powder 
for 7 s was observed to extinguish the fire, but a second dis¬ 
charge of 4 s was applied to make sure. The rate of discharge 
was 45 kg/s to an area of 20 m 2 and, assuming that 50- 80 % 
of the powder covered this area, the rate of application was 

1.3 -1.8 kg/m 2 s. This compares with a slightly higher rate 
of 2.4 kg/m 2 s reported from other Japanese work. 

16.35.3 LNG fires 

As already described, the quantities of LNG held in storage 
are very large. A fire on a large LNG spillage radiates 
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intense heat and can do extensive damage. The behaviour 
of LNG fires was discussed in Sections 16.11 and 16.17. 

As stated above, firefighting will often be conducted 
with the aim of controlling rather than extinguishing the 
fire. The control of LNG fires has been the subject of inves¬ 
tigations over a period of time and in a number of countries. 
Early work by Burgoyne and Richardson (1948) showed 
that foam forms a frozen blanket on burning liquid 
methane, leaving only small tears which can be readily 
extinguished with dry chemicals. 

Small LNG fires can in fact be extinguished by most 
firefighting agents. Thus water, foam, dry chemicals, 
vaporizing liquids and carbon dioxide are all effective on 
fires sufficiently small to allow the whole area of the fire to 
be extinguished simultaneously. 

With larger LNG fires the problem is more difficult. 
The feasibility of extinguishing large LNG fires has been 
a matter of doubt. Walls (1973), for example, states: ‘Foams 
and water will not extinguish LNG fires.’ 

Dry chemicals can extinguish an LNG fire, but only if 
extinction is complete in the short application period, 
which is difficult to achieve. He continues: ‘An LNG fire 
extinguishing system should be considered essentially as a 
fringe benefit which will be nice if it works but which a 
plant had better be able to do without.’ 

The limitation of the effects of LNG fires is described by 
Wesson etal. (1973a) as follows: 

Water has long been considered the prime - if not the 
only - agent suitable for controlling LNG fires. Water 
curtains and direct contact water sprays protect exposed 
structures until fire intensity is tolerable. However, for 
major LNG spills or tank fires the rate of water applica¬ 
tion required is unrealistic (30,000-50,000 gpm) if 
severalproximateexposuresrequiresimultaneousprotec- 
tion from the high radiant heat fluxes, which can reach 
lO.OOOBTU/hft 2 . 

The control of LNG fires by agents such as foam or dry 
chemicals has thus contined to appear attractive. 

Work at Lake Cahrles, Louisiana, in a 1961 on the 
extinction of LNG fires has been reported by Burgess and 
Zabetakis (1962 BM RI 6099). Tests were done using dry 
chemicals. The surface area of the burning liquid pools was 
400 ft 2 . Extinction was achieved using sodium and potas¬ 
sium bicarbonates at application rates of 0.14 lb/ft 2 s. In one 
test extinction was achieved in 3 s at this rate of application. 

More recently an extensive series of tests on the extinc¬ 
tion of large LNG fires conducted by the University 
Engineers has been sponsored by the American Gas 
Association (AGA) and has been reported by Wesson and 
co-workers. The control of LNG fires using foam is de¬ 
scribed by Wesson, Welker and Brown (1972) and Wesson 
et al. (1973a). Twelve tests were conducted, of which eleven 


were concerned with vaporization behaviour. The surface 
areas of the burning pools were in the range 400-1200 ft 2 . 
The fire conditions were steady state with an evaporation 
rate of approximately 0.5 in./min from the spillage surface. 
It was found that high expansion foam was effective in 
bringing the fire under control and thus reducing heat 
radiation, although in the majority of cases the fire was not 
actually extinguished, and that a foam with an expansion 
ratio of 500:1 was the most suitable. The foam quickly 
froze in open cellular form at the foam-LNG interface, and 
was light enough to float on the LNG, but had sufficient 
structural strength to support several feet of additional 
foam without collapsing. A fire control time was defined as 
the time for the heat flux sensors to reach a new, reduced 
reading after initial application of the foam and while the 
foam was still being applied. Using a high quality foam 
with a 500 :1 expansion ration, a fire control time of 120 s 
was achieved with a foam application rate of 8 cfm/ft 2 . 
Reduction in heat radiation up to 97% were measured at a 
distance of about one fire diameter from the fire edge. 

Wesson et al. (1973) also report work on the extinction of 
LNG fires using dry chemicals. The fire sizes were in the 
range 200-1200 ft. The dry chemical application rates 
and extinction times obtained for a 1200 ft 2 fire are given in 
Table 16.88. The work described applies to steady-state LNG 
fires with an evaporation rate of not more than 0.5 in./min. 
Immediately after a spillage the vaporization of LNG is very 
rapid. Even 1 min after the initial spillage and ignition, the 
evaporation rate could be 1 in/min on average dry soil, 
which is twice the long-term burning rate due only to heat 
transfer by flame radiation to the liquid surface. 

The effectiveness of the firefighting agents depends on 
the fire conditions, including the weather, the ground 
and the process plant. The foregoing account should be 
regarded, therefore, only as a guide. Further details are 
given in the original paper. 

16.35.4 Storage tank fires 

The occurrence of storage tank fires was discussed in 
Section 16.11 and the pool fire characteristics of such fire 
Section 16.17. A fire in a storage tank which has lost its roof 
may be dealt with in two ways. One is to try to extinguish it; 
the other is to let it burn itself out. Such a fire is normally 
extinguished by the use of water or foam. The blanketing 
action of the latter is particularly effective against fires in 
open storage tanks. 

There is a risk, however, that the addition of water or 
foam may cause a slopover of oil-water mixture. This can 
occur if there is a deep layer of hot oil at the burning liquid 
surface. Such a layer tends to develop in a crude oil but not 
in a refined one. The depth of the layer is greater after the 
fire has been burning some time. The hazard to slopover 
may be detected by such methods as the addition of small 


Table 16.88 Application rates for extinction of LNG fires by dry powders (after Wesson et al., 1973b) 



Threshold rate 

Optimum r 


Application 
rate (lb/ft 2 s) 

Extinction 
time (s) 

Application 
rate (lb/ft 2 s) 

Extinction 
time (s) 

Sodium bicarbonate (SB) 

0.012 

18 

0.0192 

9.0 

Potassium bicarbonate (PB) 

0.007 

30 

0.0125 

8.2 

Urea-potassium bicarbonate (U-PBP) 

0.00275 

25 

0.00417 

10.9 
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amounts of water to one edge of the tank or the use of a strip 
of water to one edge of the tank or the use of a strip of 
heat sensitive paint down the side of the tank. Methods of 
reducing the hazard include mixing the hot oil in the tank 
with cold oil, by pumping the liquid out and in again, or by 
using only small quantities of water or foam until frothing 
subsides. Alternatively, the fire may simple he allowed to 
burn itself out. Often it is possible to pump out most of the 
liquid in the tank to another receiver so that the scale and 
duration of the fire are much reduced. 

As described in Section 16.17, in a storage tank fire a heat 
wave moves down through the liquid. The fire is sustained 
by a zone of liquid at the top which is at a higher tempera¬ 
ture than the rest of the contents. This fact can be exploited 
to control a tank fire by agitating the liquid with air. 
The method is described by P.F. Johnson (1986). 

Other fires at storage tanks include a fire or a liquid 
spillage at the base of the tank. In this case it is generally 
appropriate to attempt to extinguish the liquid fire or to run 
the burning liquid off while cooling the tank to prevent its 
overheating. 

In general, the fighting of storage tank fires involved not 
only extinction of the fire itself but also protection of other 
exposed tanks. Suitable water application rates are given in 
Section 16.27. 

Storage tank fires are discussed by Risinger (1964b, f). 

16.35.5 Fog nozzles 

There is a wide variety of nozzles which can be fitted to fire 
hoses. Accounts of such nozzles are given by Purington 
(1986) and Rosenhahn (1986). 

In certain situations the requirement is not so much to 
project water onto the fire as to permit the firefighters to 
advance towards the fire. This might be the case, for 
example, where an attempt is to be made to shut a valve. In 
such cases use may he made of a fog nozzle, which is more 
fit for this purpose than a regular hose nozzle. 

16.35.6 Water curtains 

A technique which finds application in certain situations 
involving a leak or fire of a flammable material is the use of 
a water curtain. One application of a water curtain is to 
disperse a leak of flammable vapour, before it can ignite. 
This has been described by Beresford (1981) and is con¬ 
sidered in Chapter 15. Although not strictly a firefighting 
measure, the deployment of a such water curtain is likely to 
be the responsibility of the works fire service and to be 
made in a fire situation. 

Another use of water curtains is to attenuate the thermal 
radiation from a fire. Accounts are given by Stephenson 
and Coward (1987), Maini and Stephenson (1989) and 
Coppalle, Nedelka and Bauer (1993). The first two sets of 
authors describe a project to explore the use of water cur¬ 
tains to protect the crew of a tanker as they make their way 
to lifeboats during a shipboard fire. The design basis fires 
and heat fluxes are described by Stephenson and Coward 
and the modelling of and full scale experimental work on 
the water curtain is described by Maini and Stephenson. 

The issues to be determined were the stability of the 
curtain and its capability to attenuate thermal radiation. 
The aim was to design a curtain some 5 m high which 
would remain stable in a 6 m/s wind. The modelling 
showed that heat attenuation is effected by a curtain of 
small droplets, which thus has a large total surface area, 
falling at low velocity. Work on curtain stability showed 


that to obtain a stable curtain it was better to use narrow 
angle nozzles rather than wide angle nozzles. With the for¬ 
mer the droplets leave with a high initial velocity and then 
decelerate so that the velocity becomes such lower. There 
was relatively little difficulty in obtaining stability in the 
initial zone of 2—3 m, but below this the curtain can 
become unstable. It was found that in order to achieve a 
stable curtain it was necessary to obtain a sufficient 
momentum flow, where 

Momentum flow = Mass flow x Exit velocity 

and that for the nozzles used a minimum value of the 
momentum flow was some 60 Ns/s. Given a momentum 
flow in excess of this value, narrow angle nozzles provided 
a stable curtain. 

Work on attenuation of thermal radiation was performed 
using fires with surface emissive powers of the order of 
50 kW/m 2 . It should that in order to obtain adequate 
attenuation in the upper zone it was necessary to deploy, in 
addition, wide angle nozzles. One arrangement which gave 
good performance was narrow angle nazzles spaced at 1 m 
intervals with two wide angle nozzles in each interval. With 
this arrangement attenuation was effected in the upper 
zone by the small slow droplets from the wide angle nozzles 
and in the lower zone by the small, slowed droplets from the 
narrow angle nozzles. The fractional attenuations obtained 
ranged from 30% to 70%, being an approximately linear 
function of the optical thickness. Models were developed 
for the behaviour of the water curtain with respect to both 
stability and attenuation; the results for the latter show 
close agreement with the experimental values. 

Commenting on this work, the authors state that the 
essential requirement for such a water curtain is the com¬ 
bination of high momentum flow with small droplet size. 
The design which they favour is one with narrow and wide 
angle nozzles. They refer to the need for a water supply at a 
pressure of at least 5 barg. They indicate that the curtain 
should be stable in winds up to 6 m/s but not in very high 
winds. 

16.35.7 Flazards to fire fighters 

Firefighting is always a hazardous task, but this is par¬ 
ticularly so on a process plant. Some of the hazards 
encountered are: 

(1) heat and flames; 

(2) falling structures and brands; 

(3) flashback; 

(4) explosion; 

(5) toxic fumes; 

(6) asphyxiating fumes; 

(7) refrigerated liquids; 

(8) chemical hazards; 

(9) hazards due to firefighting activities 

(a) spread of burning liquids, 

(b) slopover due to foam, 

(c) fumes from vaporizing liquids, 

(d) discharge of dry chemicals. 

Many process plant fires involve liquids. These are dif¬ 
ficult to extinguish and tend re-ignite, particularly if there 
are areas of hot metal. There is a danger, therefore, that 
flashback of the fire may occur. 
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Fires often cause explosions in vessels, particularly 
those containing liquids. It is standard practice to cool 
vessels with water to lessen the chance of their rupturing or 
exploding, but nevertheless explosions do occur. Process 
plants also contain many other objects which may explode. 

Large quantities of toxic fumes are frequently involved in 
fires. They may come not only from process materials but 
also from lagging and from firefighting agents. In particular, 
hydrogen chloride and other acid gases are often produced. 

Some materials produce more insidious fumes. For 
example, the fumes of toluene diisocyanate not only cause 
euphoria and lead firemen to undertake rash actions but 
also attack the nervous system and can lead to permanent 
disability. Outright asphyxiation due to lack of oxygen is 
another hazard in such fires. 

Some liquid spillages involve refrigerated liquefied 
gases. Contact with these can cause freezing of and injury 
to parts of the body. 

Fire causes loss of containment of other chemicals, such 
as corrosive substances, which constitute further hazards 
to personnel. 

Some of the hazards arise from the firefighting activ¬ 
ities. The use of water may cause burning hydrocarbon 
liquids to spread, particularly into drains. The addition of 
foam to a tank where the fire has formed a hot zone can 
cause slopover. The fumes from vaporizing liquids tend to 
he highly toxic. The high velocity discharge of dry chemi¬ 
cals can cause injury. 

Although local authority firemen should be generally 
familiar with the hazards of process plants in their area 
though training and exercises, it is important for them to be 
fully informed of the particular hazards presented by a fire 
which they are called on to fight. 

16.35.8 Planning and training 

It is essential to plan for emergencies and fires and to 
train personnel in emergency procedures and firefighting. 
A detailed account of emergency planning is given in 
Chapter 24. This includes devising scenarios of accidents 
and conducting full-scale emergency and firefighting 
exercises. 

The FireTraining Manual of the Petroleum Industry Train¬ 
ing Board (PITB) (1975/6) givers guidance on training for 
firefighting related specifically to process plant fires. 

16.36 Fire and Fire Protection in Buildings 

The most serious fires, with respect both to loss of life and 
to damage, are those which occur in buildings. Although 
fire in buildings does not have the same relative signi¬ 
ficance for process plant, it is still important, because there 
are many plants which need to be housed in buildings and 
there are on virtually all sites a range of other buildings 
from laboratories, workshops and offices, to stores and 
warehouses. 

Accounts of fire and fire protection in buildings are 
given in Fire Safety in Buildings. Principles and Practice 
(Langdon-Thomas, 1972), Handbook of Industrial Loss 
Prevention (FMEC, 1967), Fire protection Handbook (NFPA, 
1991/28) and Background Notes on Fire and its control 
(FPA, 1971/14). Further information is available in the pub¬ 
lications of the FPA and NEPA, some of which are given in 
Appendix 28. 

The problem of fire in buildings falls under three main 
headings: (1) hazard to life, (2) hazard of damage to the 


building and (3) hazard of exposure of nearby buildings. 
Fire protection of buildings, as of plants, is based on a com¬ 
bination of passive measurers such as structural design, 
and active ones, such as firefighting systems. 

16.36.1 Fire load 

The maximum size of fire which can develop in a building 
depends on the amount of material available for combustion. 

The severity of a fire in a building is a function of the 
material available for combustion. In a classic study, 
described below, Ingberg (1928) put forward the concept of 
‘fire load’ as the determinant of the severity of a fire. 

The fire load is the total heat which can be generated 
by the combustible material within the building. It is the 
product of the mass of material and its heat of combustion, 
or calorific value. The fire load density is the heat per unit 
area of floor which can be generated. Alternatively, the fire 
load density may be expressed as the equivalent mass of 
wood per unit area of floor. A discussion of fire load is given 
by Langdon-Thomas (1972). 

Fire load density has been classified as follow (this table 
assumes a calorific value of 8000 BTU/lb for wood): 



Fire load density 

(lb/ft 2 ) (BTU/ft 2 ) 

Typical occupations 

Low 

12.5 

<1 x 10 5 

Dwellings, offices 

Medium 

12.5-25 

1-2 x 10 5 

Factories 

High 

25-50 

2-4 x 10 5 

Warehouses 


Langdon-Thomas comments that it is preferable to 
estimate the fire load density for the particular building 
under study. Generalized estimates are available but 
appear to vary widely. 

The calorific values of some common materials, as given 
by the FPA (1971/14), are shown in Table 16.89. Further data 
are given in the Association National pour la Protection 
centre l’Incendie (1972). 

16.36.2 The time-temperature curve 

It has been shown that under standard conditions there is a 
close relationship between the time for which a building 
fire burns and the temperature which it attains. This was 
first demonstrated in 1928 by Ingberg (1928), who carried 
out a series of test burns in an experimental building at 
the National Bureau of Standards (NBS). Similar work has 
been done by other investigators and has led to the devel¬ 
opment of a number of standard time-temperature curves. 


Table 16.89 Calorific value of some common materials 
(Fire Protection Association, 1971/14) 


(kj/kg) 


Paper 15,600-18,100 

Cotton 16,750 

Woods 17,500-21,000 

Coals 20,000-30,000 

Wool 20,700 

Rubber «40,000 

Petroleum products 43,000-48,000 
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A standard time-temperature curve which has been 
widely used is that of ASTM E-119 which has changed 
relatively little over the years. There is also a British Stand¬ 
ard curve, given formerly in BS 476: Part 8:1972 and now in 
Part 20:1987. 

The BS 476: Part 20: 1987 curve is defined by the 
following equation: 

T = 345 log 10 (8f + 1) + 20 t < 360 [16.36.1] 

where t is the time (min) and T is the temperature (°C) 
The ASTM E-119 curve is defined as a set of time- 
temperature values. These are given below together with 
values of the BS 476: Part 20:1987 curve calculated from 
Equation 16.36.1: 


£ 


Temperature (°C) 

ASTM E-119 

BS476: Part 20:1987 

5 

538 

576 

10 

704 

678 

30 

843 

842 

60 

927 

945 

120 

1010 

1049 

240 

1093 

1153 

360 

>480 

1260 

1214 


The ASTM and BS time-temperature curves are shown in 
Figure 16.128. 

A fire at 900°C appears cherry red, one at 1100°C orange, 
and one above 1400°C white. Building fires generally look 
orange or yellow, which suggests a temperature in the 
range 1100-1200°C.This has been confirmed in practice. 

The area under the time-temperature curve corre¬ 
sponds effectively to the fire load density. The greater the 


fire load density, the longer the duration of the fire and the 
higher its temperature. 

The standard time-temperature curves are widely used 
for the testing of structural components for fire grading. 
The component is put in a furnace and the temperature of 
the furnace is controlled to follow the curve. There is, 
however, a view that a test based on heat flux might be more 
satisfactory. 

16.36.3 Fire severity 

The fire load was used by Ingberg (1928) to define the 
severity of a potential fire. The time-temperature profile of 
a real fire exhibits a rapid rise to a maximum value, 
followed by a gentler decline. The fuel consumed is related 
to the area under the curve. The profile thus differs from 
that of a standard time-temperature curve. 

The proposition put forward by Ingberg is that two fires 
should be regarded as of equal severity if the area under the 
time-temperature curve, above a certain datum tempera¬ 
ture, is equal, a concept which has become known as the 
‘equal area hypothesis’. 

The relationship given by Ingberg between fire load and 
fire severity may be expressed as: 


Combustible content 
(kg/m 2 of wood 
equivalent) 

Thermal 

equivalent 

(GJ/m 2 ) 

Standard fire 
duration (h) 

49 

0.90 

1 

73 

1.34 

1.5 

98 

1.80 

2 

146 

2.69 

3 

195 

3.59 

4.5 

244 

4.49 

6 

293 

5.39 

7.5 


Here the thermal equivalent is based on the floor area and 
on a heat of combustion of wood of 18.4 MJ/kg. 



Figure 16.128 Standard time-temperature curves for building fires. ASTM E119: 1988; BS 476: Part 20: 1987 
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16.36.4 Fire grading of buildings 

A scheme for the fire grading of buildings in the United 
Kingdom which is based essentially on the concepts of fire 
load and the time-temperature curve was proposed in Fire 
Grading of Buildings, Part I, General Principles and Struc¬ 
tural Precautions (Ministry of Works, 1946). An outline of 
this system is given inTable 16.90. Buildings of Types 1 and 
2 have steel frames with concrete protection, brick walls 
and reinforced concrete or equivalent resistance floors. In 
Types 4 and 5 the buildings have load-bearing brick walls, 
timber floors and roofs, and fire-retardant roof covering; 
ordinary houses are of this type. AType 6 building is made of 
incombustible material, such as corrugated iron or asbestos 
cement. A Type 7 building is one of combustible material 
such as wood. Although the system was never adopted as 
such, it illustrates some general principles of fire grading. 

A different approach to fire grading is that developed by 
law (1971), who investigated the relation between fire 
severity and fire resistance. In this work a real fire was 
modelled as having a temperature equal to its peak tem¬ 
perature maintained for a period equal to the ratio M t jm, 
where m is the rate of mass loss and M t is the total mass of 
combustible material. Fire resistance of insulated columns 


Table 16.90 Minimum fire resistance requirement for 
types of construction (after Ministry of Works, 1946) 


Grading of construction 

Minimum 

fire 

resistance a 

(h) 

Type 1 

Incombustible fire resisting 
construction 

Fully protected in relation to high 
fire loads, e.g. warehouses 

4 

Type 2 

Incombustible fire resisting 
construction 

Fully protected in relation to 
moderate fire loads, e.g. shops 
and factories 

2 

Type 3 

Incombustible fire resisting 
construction 

Fully protected in relation to low 
fire loads, e.g. offices and 
residential buildings 


Type 4 

Fire resisting construction but not 
necessarily incombustible and 
may therefore include timber 
floors and timber roof 
construction. Partially 
protected only in relation to all 
fire loads 

% h 

Type 5 

Externally protected construction 
Fire resisting incombustible 
external walls, non-fire 
resisting internal construction 


Type 6 

Non-fire-resisting construction 
Incombustible 


Type 7 

Non-fire-resisting construction 
Combustible 



“This refers to floors and roofs and to columns and beams supporting 
them. Walls and columns and beams supporting them have a mini¬ 
mum fire resistance equal to or greater than this. 


was investigated using unsteady-state heat transfer models 
to determine the time to failure. The following relation was 
obtained: 


[16.36.2] 


where A T is the total area of the internal surface, excluding 
ventilation openings (m z ), A w is the area of the ventilation 
openings (doors, windows) (m 2 ), M t is the total combustible 
load (kg of wood equivalent), f f is the effective fire resis¬ 
tance time, or fire grading (min), and k t is a constant. With 
the units quoted, the value of the constant kf is approxi¬ 
mately unity. 


16.36.5 Fire growth in buildings 

Ignition is important not only in the initiation of fire 
but also for its spread. After the fire has started, its growth 
depends on the ease with which further combustible 
material is ignited. 

Solid materials do not have a well-defined ignition 
temperature, but they tend to ignite at relatively low tem¬ 
peratures. The ignition temperature for wood, for example, 
is generally taken as about 200°C. But if wood is left in 
contact with a hot surface such as a steam pipe for a long 
period, it can undergo chemical changes so that it ignites at 
a much lower temperature. The maximum temperature at 
which wood can be safely exposed for a long period has 
been given as 65°C (FPA1971/14). 

Once ignition has occurred, the immediate growth of the 
fire is affected by the form of the nearby materials. Here the 
surface area of the materials is important: 


Surface area (cm 2 /g) 

Tinder 

>20 

Kindling 

2-20 

Bulk fuel 

<2 


The fire then grows by heat transfer and flame spread. 

All three heat transfer modes (convection, conduction 
and radiation) contribute to fire growth. Convection within 
the space where the fire has started is important initially; 
so is conduction along burning objects. As the fire grows, 
convection to the ceilings and conduction through the wall 
become significant. When the fire is well developed and 
temperatures are high, the contribution of radiation 
becomes important. 

Fire spread can be considered as occurring in three ways: 
(1) flame spread across combustible surfaces, (2) fire spread 
through a continuous fuel bed and (3) fire spread through a 
discontinuous fuel bed. 

Flame spread across a combustible surface differs 
somewhat according to whether it is vertical or horizontal. 
Spread is more rapid in the vertical direction, because the 
surface is preheated by convection. However, in both cases 
flames can spread very quickly. 

Fire spread through a continuous fuel bed requires little 
explanation except that this description includes spread 
between any types of object which can act as a fuel, 
including whole buildings. The fuel bed is effectively con¬ 
tinuous if the flames pass right through it. 

With a discontinuous bed, by contrast, it is necessary for 
the fire to spread by one of the modes of heat transfer and to 
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cause ignition by heating other objects to their ignition 
temperature without the aid of direct flame contact. 

16.36.6 Flashover 

If a fire takes hold in a compartment, a point is reached 
when the fire is no longer localized, but spreads throughout 
the whole space. There is sudden propagation of flame 
through the unburned gas below the ceiling and all the 
combustible surfaces become involved in the fire. This 
condition is known as ‘flashover’. 

In this situation the rate limiting feature frequently is no 
longer the fuel but the air supply. If the air supply is sud¬ 
denly increased, as by the cracking of windows, the open¬ 
ing of a door or other means, there will be a sudden increase 
in the rate of burning. 

With flashover, the fire is fully developed. Flashover is 
discussed further in Section 16.36.10. 

16.36.7 Fire spread through buildings 

The spread of fire through a building depends on a number 
of factors. Staircases, lift shafts and open corridors 
encourage the rapid spread of flames. Features such as 
gaps in walls where pipes pass through or doors left open 
allow flames to bypass enclosing elements which are 
intended to be a barrier to fire. Fire spread is also strongly 
influenced by the surfaces in the building. Some surfaces 
support a very rapid passage of flame. 

16.36.8 Fire spread from buildings 

Fire spread from a building across an open space is gen¬ 
erally almost entirely by radiation, although there may 
sometimes be a contribution from convection and there 
may also be flying brands. Usually the object is heated by 
radiation to a temperature at which it is ignited by a small 
brand or spark. This is known as pilot ignition. Such pilot 
ignition of dry unpainted wood in the open can be obtained 
if the heat flux onto it is about 12.6 kW/m 2 . A lower value is 
sufficient to ignite the wood in a closed room. 

A method of calculating the heat radiation from the 
windows of a burning building has been developed by Law 
(1963 FRS Fire Res. Tech. Pap. 5) and has been used in con¬ 
junction with fire resistance data to determine suitable 
separation distances between buildings. The method is 
described in the original paper and in an explanatory 
memorandum to the Building Regulations 1965. 

The amount of heat radiated from a building is a function 
of the area radiating heat and of the heat flux per unit area. 
The assumption that there is fire at all windows is a con¬ 
servative one, particularly for larger buildings. The addi¬ 
tional radiation from flames outside the windows is not 
generally significant. 

The upper limit of the intensity of heat radiation from a 
fire in a room of a building can generally be taken as 
168 kW/m 2 , but a lower value applies for lower fire load 
densities (Langdon-Thomas, 1972). 

The spread of fire between buildings depends on the 
distance between them, the sizes and angles of the radiat¬ 
ing surfaces, the contents of the buildings and the con¬ 
struction of the buildings. The contents of the burning 
building determine the temperature reached and the extent 
to which flying brands are produced, and the materials of 
walls and roofs of the two buildings determine the extent to 
which the burning building radiates heat and produces 
brands and the extent to which the exposed building is 
vulnerable to them. 


16.36.9 Effects of fire in buildings 

Fire in a building presents three hazards to life: (1) toxic 
gas, (2) smoke and (3) heat. 

People may be overcome or may be burned. Most people 
who die in fires do so in the early stages of the outbreak, not 
infrequently before the alarm has been raised. Usually they 
are killed by toxic gases which arrive before the fire itself 
reaches that part of the building. Others are overcome by 
toxic gas or become trapped and then die in the fire itself. 

Toxic gases produced by building fires are principally 
the normal products of combustion, that is, carbon mon¬ 
oxide and carbon dioxide. The amount of carbon monoxide 
produced is increased if the air supply to the fire is limited. 
Carbon monoxide has almost the same density as air and so 
spreads easily through the building. It is odourless, and so 
is not readily detected. At a concentration of 1.3% it causes 
unconsciousness after a few breaths. 

Carbon dioxide is also toxic, but in building fires acts 
mainly as an asphyxiant. A concentration of about 9% is 
generally enough to cause unconsciousness within a few 
minutes. 

Other more toxic gases may be produced by the 
combustion of materials such as plastics and rubber. These 
include hydrogen chloride, sulfur dioxide, hydrogen 
cyanide and phosgene. 

Smoke has the effect of reducing visibility and hindering 
both escape and rescue. The quantity of smoke generated is 
greater if the air supply is restricted and the burning 
material is wet. 

It is often the case that smoke rising up a staircase causes 
people trying to escape to turn back, even though the route 
is actually passable. It is a prime function of fire doors, 
therefore, to prevent the spread of smoke. It is desirable that 
people in the building understand these points. 

The damage done to the building by fire is due partly to 
the fire itself and partly to smoke and water. Some estimates 
of fire damage attribute more than half to water damage. 


16.36.10 Modelling of building fires 

Some progress has been made in the modelling of fires in 
buildings. Accounts of the modelling of building fires are 
given by Drysdale (1985), Babrauskas (1986c), Budnick and 
Evans (1986), Budnick and Walton (1986) and Law (1991). 

Most modelling has been directed to the characterization 
of the fire in a compartment. There are also some models of 
other aspects such as fire spread along corridors. 

A compartment fire may (1) burn out, (2) self-extinguish 
due to lack of air or (3) progress to flashover. 

‘Flashover’ has been used with a number of meanings, as 
reviewed by RH.Thomas (1982).There are three in common 
use: (1) transition from a localized fire to a conflagration 
involving all the fuel surfaces in the enclosure; (2) transi¬ 
tion from fuel to ventilation controlled burning and 
(3) sudden propagation of flame through the unburnt vola¬ 
tiles collected under the ceiling. 

The modelling of a compartment fire proceeds broadly 
along the following lines. The fire load in and ventilation 
conditions of the compartment are determined. In the pre- 
flashover stage, the fire is modelled first under ‘free burn’ 
conditions. As the fire grows, a transition may occur from 
the regime of free burning to one of ventilation controlled 
burning. Prior to flashover, the features of interest include 
(1) the fire regime, (2) the rates of mass loss and heat release, 
(3) the upper gas temperature and (4) the radiant heat flux. 
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Determination of these variables permits an estimate to 
be made of the possibility that flashover will occur. There 
are a number of criteria for flashover, which utilize (1) the 
upper gas temperature, (2) the radiant heat flux and 
(3) the heat release rate. These variables are, of course, 
related. The various equations involve time in some way, 
and hence provide a means of estimating the time to flash- 
over, assuming that it does occur. 

For the post-flashover stage, the features of interest are 
(1) the rates of mass loss and heat release and (2) the com¬ 
partment temperature. Principal purposes of the modelling 
of compartment fires include determining whether flash- 
over will occur, the time to flashover and the temperature 
profile after flashover. 

Programmes of experimental work which have provided 
data for workers in the field include the Home Fire Project 
(Croce, 1975) and the project of the Conseil Internationale 
du Batiment (CIB) (Heselden and Melinek, 1975 FRS Fire 
Res. Note 1029). 

16.36.11 Models of pre-flashover compartment fire 

In the pre-flashover stage, the mass loss rate is at first 
relatively low. The fire regime is one of fuel controlled 
burning. As the fire grows, the quantity of air required 
increases markedly, and the regime becomes one of venti¬ 
lation controlled burning. 

The mass loss rate in the initial, free burning stage 
necessarily depends on the particular scenario, but the 
work of P.H. Thomas, Simms and Wraight (1964,1965) on 
the modelling of crib fires provides one approach. 

An equation for the mass loss rate under conditions of 
ventilation controlled burning has been given by Kawagoe 
(1958): 

m = k v A yi H 1/2 [16.36.3] 

where A w is the area of the ventilation opening (m 2 ), H 
is its height (m), m is the mass burning rate (kg/s) and k v 
is a constant (kg/m 3/2 s). The term A w 77 1/2 is referred to 
as the ‘ventilation factor’. The value given for k is 0.09, 
which is often rounded to 0.1. In another widely used form 
of the equation, m is expressed in kg/min and k v has the 
value 6. 

The heat release rate is 

q = mAH c [16.36.4] 

where AH C is the heat of combustion (kj/kg) and q is the heat 
release rate (kW). 

A number of equations have been given for the estimation 
of the upper gas temperature in pre-flashover conditions. 
One is that by Quintiere (1983), quoted by Babrauskas 
(1986c).The temperature is afunction of, among other things, 
the heat release rate, the ventilation conditions and time. 

Another model, described by Drysdale (1985), has 
been given by McCaffrey, Quintiere and Harkleroad 
(1981). 

P.H. Thomas (1974) and Ove Arup (1977) have developed a 
model, quoted by Budnick and Evans (1986) and Law 
(1991), which allows for limitation by fire load. It is 


= T ° + ^[ 1 - exp(-0.1)/)][l - exp(-0.5t)] 

[16.36.5] 
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[16.36.6] 

[16.36.7] 


where L is the mass of fuel (kg), q is a ventilation term 
and r a fire load term (kg/m 2 ). 

The radiant heat flux from the fire to the compartment 
boundaries is typically obtained by determining the 
radiative power of the flame and estimating the thermal 
radiation intensity as that at the surface of a hemisphere. 

There are a number of criteria for flashover in a compart¬ 
ment fire. One takes the form of a limiting value of the upper 
gas temperature. Hagglund, Jansson and Onnermark (1974) 
and Fang (1975) obtained in their work a value of 600°C. 
Other workers such as Lawson and Quintiere (1985) use 
500°C. Another criterion is the radiant heat flux to the floor 
of the compartment. Work by Waterman (1968) indicates a 
critical value of 20 kW/m 2 . Also relevant is that in his work 
flashover did not occur below a mass loss rate of 40 g/s. 

Since the upper gas temperature is related to the heat 
release rate, the flashover criterion can also be expressed in 
terms of a limiting heat release. One such relation, based 
on a flashover temperature of 600°C and enclosures with 
materialshavingadensitysimilartothatofgypsumboard,is 


? f0 = 378A w ff 1 / 2 + 7.8A T 


[16.36.8] 


where q to is the heat release rate at flashover (kW). Another 
such equation is that by Lawson and Quintiere (1985). 


16.36.12 Models of post-flashover compartment fire 

Flashover results in a rapid rise in temperature, possibly 
up to 1100°C. 

There are a number of models of the post-flashover 
compartment fire. It is usually assumed that the atmo¬ 
sphere in the compartment is perfectly mixed. The models 
differ in two main ways. One is in the terms which are 
included in the heat balance. The other is in the estimation 
of the individual terms, and particularly the rates of mass 
loss and hence heat release. 

Models for this stage include those by Kawagoe and 
Sekine (1963), Pettersson, Magnussson and Thor (1976), 
Babrauskas and Williamson (1978) and Babrauskas (1981). 
Expositions of these models have been given by Drysdale 
(1985) and Babrauskas (1986c). 

The general nature of the models is illustrated in the 
account given by the latter author, who describes his own 
model (Babrauskas, 1981) for the post-flashover upper gas 
temperature in a compartment fire: 

T a = T 0 + (T* - T o )0i0 2 636 4 0 5 [16.36.9] 

where T a is the ambient temperature (K), T u is the upper gas 
temperature (K),7 f is an empirical constant, and @i, 0 2 , d 3 , 
0 4 and 0 5 are factors which allow respectively for (1) the 
burning rate stoichiometry, (2) the steady-state heat loss 
through the wall, (3) the transient heat loss through the 
wall, (4) the effect of the height of the opening and (5) the 
combustion efficiency. 

A determining factor in such models is the expression 
used for the mass loss rate. As described above, there are 
two distinct regimes. At low ventilation rates the mass loss 
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rate is ventilation controlled, whilst at high ventilation 
rates it is fuel controlled. 

Under ventilation controlled conditions, the expression 
commonly used for the mass loss rate is that by Kawagoe, 
given above as Equation 16.36.3. The range of validity of 
this equation, however, is restricted. Its limitations are 
discussed by Drysdale. Work by Bullen (1978) points to a 
family of curves of the same general form as Equation 
16.36.3, but with different values of the constant and hence 
with different slopes. In other words the group (m/A w H k ) 
is not a constant. Rather it is a function of factors such as 
the heat of gasification of the volatiles and the heat flux to 
the burning surface. 

If the ventilation is increased, there comes a point at which 
the regime becomes fuel controlled. However, fuel control is 
appreciably more complex. The predominant factor is the 
geometry of the fuel, and above all its surface area. For this 
regime, therefore, there is no single criterion for transition 
and no single expression for the mass loss rate. 

There exist methods, such as that by Harmathy (1972), 
for the determination of the transition from ventilation to 
fuel control. The application of this criterion is discussed by 
Drysdale, who shows that there is appreciable scatter. 

In view of the variety of mass loss rates within the fuel 
control regime, the most widely applicable approach would 
appear to he to estimate the values of the mass loss rate using a 
correlation for each of the two regimes and to identify the 
transition point in this way. There is no generally applicable 
relation for the estimation of the mass loss rate m. Bullen and 
Thomas (1979) have obtained a correlation which includes 
some of the important variables. It may be expressed as 

m » IAf/Ly [16.36.10] 

where A f is the surface area of the fuel (m 2 ), I is the thermal 
radiation intensity (kW/m 2 ) and B, is the heat of gasifica¬ 
tion of the volatiles (kj/kg). 

Babrauskas (1986c) treats this aspect by utilizing for both 
regimes expressions for the burning rate stoichiometry fac¬ 
tor 0i which are a function of the ratio </> of the actual mass 
loss rate to that at stoichiometric air flow. Separate expres¬ 
sions are used for the fuel-rich and fuel-lean regimes, in 
other words for ventilation control and for fuel control. 

Treatments of a fully developed compartment fire fre¬ 
quently use Equation 16.36.3, which is applicable to the 
ventilation controlled regime. 

16.36.13 Models of flame projection 

Flame projected from an opening may cause fire to spread 
to the storey above. It may impinge on an object outside and 
is in any event a source of radiant heat. 

Flame projection has been correlated by P.H. Thomas and 
Law (1972) who obtained the equation 

z + H = 12.8(m/B) 2/3 [16.36.11] 

where 

x/H = 0.454 /n 0S3 [16.36.12] 

n = 2B/H [16.36.13] 

where B is the width of the window (m), H is its height (m), n 
is a shape factor, x is the horizontal reach of the flame (m) 
and z is the height of the flame up above the soffit, or top, of 
the window (m). Thus ( z+H) is the height of the flame 
above the base of the window. 


16.36.14 Models of fire spread 

The spread of fire from a compartment into other parts of a 
building has received less attention. Quintiere (1979) has 
reviewed work on this aspect. 

Tests in which fires were lit in buildings due for demoli¬ 
tion indicate that the volume of the fire tends to grow 
exponentially. 

A particular aspect which has been studied is fire spread 
from a room into a corridor.Work on this has been described 
by Quintiere, McCaffrey and Kashiwagi (1978). 

Another route for the spread of flames is through an 
opening and up to the next storey.Work on this indicates that 
such spread is influenced by the shape factor (2B/H), where 
B is the width of the opening and H is the height. For narrow 
windows and thus small values of this group, flame spread 
may occur with only a relatively small projection, whereas 
for wide windows a greater projection is required. 

16.36.15 Models of detector response 

A quite different type of fire model is that used to, investi¬ 
gate the response of temperature measuring devices used 
for fire detection. An account of such models is given by 
Budnick and Evans (1986). 

16.36.16 Models of smoke 

The agent responsible for the maj ority of deaths in building 
fires is smoke. The treatment of the production and move¬ 
ment of smoke in such fires is therefore a significant aspect. 

Smoke is produced by smouldering fires and by flaming 
combustion, but the types of smoke are very different. 
Smouldering tends to produce an oily smoke and flaming 
produces solid particles. Smoke generally contains 
unburned carbon and toxic gases. The carbon particles in 
smoke are the result of incomplete combustion, as is carbon 
monoxide. Other gases, such as hydrogen chloride or 
phosgene, may also be present, depending on the materials 
burned. Features of smoke which relevant here are that it 
reduces visibility and that it is toxic. 

Characterization of the yield and composition of smoke is 
difficult due to the wide variety of materials that become 
involved and the range of conditions that are prevalent in 
fires. From the practical viewpoint, the significant feature 
is the rate of production of smoke, which is governed by the 
burning rate. The use of a suitable model for the smoke 
production rate permits the determination of the rate of 
smoke extraction required to prevent the layer of the hot 
smoke under the ceiling exceeding a certain depth. 

One method of estimating of the rate of smoke pro¬ 
duction is to infer it from the rate of air entrainment. 
RH. Thomas et al. (1963) have described a model based on 
this approach. Another model on these lines is that by 
Butcher and Parnell (1979). 

The movement of smoke is governed by buoyancy and air 
movement effects. The fire itself generates hot gases and 
creates buoyancy effects, whilst the smoke itself has a 
temperature in excess of that of the atmosphere, creating a 
stack effect. Natural and forced ventilation are responsible 
for the air movement. 

16.36.17 Computer models 

A number of computer codes have been developed incor¬ 
porating models of fires in buildings. An account is given 
by Budnick and Walton (1986). These computer models are 
of two main types: (1) enclosure fire models and (2) special 
purpose models. 
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Enclosure fire models include not only deterministic 
models but also probabilistic ones. A large proportion of 
the former are zone models in which the enclosure is divi¬ 
ded into control volumes, or zones, and the conditions in 
each zone are simulated. Typically the enclosure might be 
divided into a lower and an upper zone. Probabilistic 
models deal with the transitions between different stages 
in the development of a fire, often using techniques such as 
Markov models. 

There are also a number of special purpose models which 
address topics such as detector actuation, smoke control, 
structural response and evacuation. 

Tabulations of the codes available are given by Budnick 
and Walton. 

16.36.18 Fire protection by structure 

The objectives of fire protection by means of the structural 
design of buildings are to (1) limit fire spread between build¬ 
ings, (2) limit fire spread within buildings, (3) facilitate 
escape, (4) facilitate firefighting and (5) limit water damage. 

The Building Regulations 1976, particularly Part E, con¬ 
tain requirements which deal inter alia with: restriction of 
the spread of flame; provision of compartment walls and 
floors; fire resistance of elements of the structure, floors and 
doors; fire protection of penetrations, cavities and shafts; 
and means of escape. These requirements cover both 
materials and construction. Other requirements are designed 
to limit fire spread between buildings and deal with dis¬ 
tances between other buildings and boundaries and with the 
construction and combustibility of external walls and roofs. 

These regulations were revoked by the Building Regu¬ 
lations 1985, which are much less detailed (31 pages as 
opposed to 295), though they retain in Schedule 1 certain 
minimum requirements. The provisions of the earlier regu¬ 
lations retain value as an indication of good practice. 

The material and component properties which are 
important are indicated by the tests specified in BS 476: 
1970- Fire Tests on Building Materials and Structures. 
These include: 


Part 3:1975 
Part 4:1970 
Part 5:1979 
Part 6: 1989 

Part 7:1987 
Part 8:1972 


Part 13:1987 
Part 20:1987 

Part 21:1987 

Part 24:1987 
Part 32:7W 


External Fire Exposure Roof Test 
Non-combustibility Testfor Materials 
Method of Test for Ignitability 
Method of Test for Fire Propagation for 
Products 

Method of Classification of the Surface Spr¬ 
ead of Flame of Products 
Test Methods and Criteria for the Fire Resist¬ 
ance of Elements of Building Construction 
(obsolescent, replaced by Parts 20-23) 
Method of Measuring the Ignitability of 
Products Subjected to Thermal Irradiance 
Method for Determination of the Fire 
Resistance of Elements of Construction 
(General Principles) 

Methods for Determination of the Fire 
Resistance of Load-bearing Elements of 
Construction 

Method for Determination of the Fire 
Resistance ofVentilation Ducts 
Guide to Full Scale FireTests within 
Buildings 


BS 476: Part 8:1972 is obsolescent, being replaced by BS 476: 
Parts 20-23: 1987, which cover, respectively, (1) general 


principles, (2) load-bearing elements, (3) non-loading bear¬ 
ing elements and (4) certain special components. 

The constructional features which are relevant to fire 
protection include: 

(1) compartmental construction; 

(2) fire resistance; 

(3) limitation of openings; 

(4) partitions and linings; 

(5) roofs; 

(6) vents; 

(7) escape routes. 

Compartments are spaces in buildings which are 
enclosed by fire-resistant walls and floors, and have all 
openings protected by fire-resistant construction. The 
object of compartmentation is to confine a fire to the com¬ 
partment where it originates and to control the movement 
of flames, smoke and heat. 

The maximum size of compartment is usually set by 
consideration of hazard to life and of ease of firefighting. 
The size should be kept to a minimum consistent with the 
basic purpose of the building. 

The fire resistance of the floors and walls should be 
capable of containing the most severe and prolonged fire 
which is likely to occur. The nature of such a fire depends 
on the likely contents of the compartment. 

The openings between compartments should be mini¬ 
mal. In some explosives factories openings are virtually 
eliminated. But, in general, openings are acceptable, pro¬ 
vided appropriate precautions are taken. All openings 
should be protected with fire-resisting doors or shutters. 
All vertical shafts such as staircases, lifts and hoists 
should have fire-resistant walls and fire-protected open¬ 
ings. All unnecessary openings should be closed, including 
those around services and pipework. 

Linings for walls and ceilings should be of non¬ 
combustible material or should have low flame spread 
characteristics. 

Roofs should be constructed so that fire does not spread 
either internally beneath the roof or externally over it. 
Flame spread beneath the roof is reduced by the use of 
incombustible or low flame spread materials and parti¬ 
tioning, and that above the roof is reduced by the use of 
incombustible materials and partition walls. 

Vents should be provided for the release of hot gases and 
smoke. These control the spread of fire and smoke and 
assist firefighting. The design of vents depends on the type 
of building. 

The Building Regulations 1976, Regulation E5, specify 
minimum periods of fire resistance which are a function 
of the type and size of building and the part of the building. 
The required minimum periods do not exceed 2 h, except 
for basements in large buildings and forlarge storage 
buildings. 

16.36.19 Fire protection by sprinklers 

As already mentioned in Section 16.26, the installation of 
fixed water sprinkler systems has proved very effective 
and is wholeheartedly supported by the insurance compa¬ 
nies. Sprinkler systems for buildings are usually automatic, 
with a detection system which actuates the sprinklers and 
sounds the fire alarm. 

Detection is usually based on heat or smoke. Heat 
sensitive detectors are dealt with in BS 5445: Part 5:1977. 
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Sprinkler heads are usually arranged to cover an area not 
exceeding 12 m 2 per head. The amount of water required 
depends on the risk protected. For storage, for example, 
water requirements in the range 0.041-0.514 1/m 2 s have 
been determined, the latter being for high stacked, closely 
packed materials in which water penetrates with difficulty 
(O’Dogherty, Nash and Young, 1966). 

In a large proportion of cases where a sprinkler installa¬ 
tion has not been effective in protecting a building, this has 
been due to the fact that it was disabled in some way. Often 
the main system valve was closed. It is necessary, therefore, 
to have specific procedures to prevent this. 

16.36.20 Smoke control 

Smoke control may be applied to a space where smoke from 
a fire may occur and also to escape routes. Methods of 
smoke control include removal by venting and exclusion 
by maintaining a positive pressure. 

The design of a smoke venting system has been treated 
by P.H. Thomas et al. (1963), P.M. Thomas and Hinckley 
(1964) and Butcher and Parnell (1979). Relevant factors are 
the height of the space, the size of the desig^i fire, the type 
of roof and the pressure at the roof. A positive pressure on 
the roof will reduce and may negate the effectiveness of a 
vent. The spread of smoke under the roof may be limited by 
installing smoke curtains hanging down from it. 

The use of smoke vents has certain drawbacks. One 
danger is that venting may hinder the operation of smoke 
detectors. Another problem is that venting of the smoke at a 
high level requires a compensating introduction of air at a 
low level, which may exacerbate the fire. Each case needs to 
be considered on it merits. 

An escape route may be protected from smoke by the use 
of closed doors, by applying positive pressure and/or by 
venting the smoke from the space where it is being pro¬ 
duced. Where reliance is placed on closed doors, it must he 
ensured by means of suitable measures, including training, 
that they remain closed in fire conditions. Where positive 
pressurization is used, air locks may be required to ensure 
that an adequate pressure is maintained. 

16.36.21 Other fire precautions 

Other fire precautions which should be taken in buildings 
include the following: 

(1) fire alarm system; 

(2) escape routes; 

(3) firefighting equipment; 

(4) fire notices; 

(5) fire drills. 

The building should be provided with a fire alarm system 
which can be heard in all parts of the building and which is 
tested regularly. There should be clearly marked escape 
routes from all parts of the building. Firefighting equipment 
such as portable fire extinguishers and hoses should be pro¬ 
vided, as appropriate. The fire extinguishers used should be 
suitable for the types of fire which are likely to occur. Notices 
on the procedures to be followed should be prominently 
posted. Fire drills should be practised regularly. 

16.37 Fire Protection in Transport 

The account so far has dealt with the fire protection of fixed 
installations. It is also necessary to give brief consideration 


to fire protection, and firefighting, in transport. The consid¬ 
eration here is confined to road, rail and marine transport. 

In large part, the fire hazard in road, rail and marine 
transport is addressed by measures to prevent accidents 
and to ensure appropriate design and maintenance. 

The principles of fighting fires arising from transport 
accidents are, in general, no different from those for build¬ 
ings, but two aspects are of particular importance. These 
are the wide variety of chemicals which are carried and 
the relative lack of familiarity of the local authority fire 
services with these chemicals. 

A considerable effort has been made, therefore, to fur¬ 
nish information to the fire services in advance about the 
hazards of chemicals which they may encounter. Dangerous 
Substances. Guidance on Dealing with Fires and Spillages 
(Home Office, 1972/4) and Hazardous Loads (IFE, 1972) 
provide some information on this aspect. 

Transport aspects are discussed in more detail in 
Chapter 23. 

16.37.1 Road transport 

Accounts of fire protection and firefighting in road trans¬ 
port are given in Transportation Fire Hazards (NFPA, 
1973/10), Hazardous Materials Response Handbook (NFPA, 
1992/30) and by Stillman (1971) and Ward (1978). Fire pro¬ 
tection in road transport is treated in the NFPA Handbook 
by McGinley (1986). 

Relevant codes for road transport are NFPA 385: 1990 
TankVehicles for Flammable and Combustible Liquids, NFPA 
1901: 1985 Automotive Fire Apparatus, NFPA 512: 1990 
Truck Fire Protection and NFPA 513: 1990 Motor Freight 
Terminals, and, for explosive materials NFPA 495: 1992 
Explosive Materials Code and NFPA 498: 1992 Explosives 
Motor Vehicles Terminals. 

Firefighting in road transport needs to be seen as one 
aspect of the wider topic of handling the emergency. With 
regard to firefighting proper, principal points are prompt 
action in using portable extinguishers, alerting of the fire 
services, alerting of the public and discouragement of 
spectators. The firefighting agents used should be compa¬ 
tible with the materials constituting the load. 

Where a road tanker contains LPG, a notable hazard of a 
fireisthatofaBLEVE. 

16.37.2 Rail transport 

An account of fire protection and firefighting in rail trans¬ 
port is given in Manual of Firemanship, Book 5, Incidents 
Involving Aircraft, Shipping and Railways (Home Office, 
1985). Fire protection in rail transport is treated in the 
NFPA Handbook by Fitch (1986). 

Fire arrangements for rail transport are not well served 
with national codes, the matter tending to be left to the 
carrier. As with road tankers, a fire on an LPG rail tank car 
involves the hazard of BLEVE. The risk of such an event is 
much increased if there are a number of such tank cars, 
perhaps with a flame from the pressure relief valve of one 
playing on another. 

16.37.3 Marine transport 

Accounts of fire protection and firefighting in marine trans¬ 
port are given in Fire Aboard (Rushbrook, 1979), Manual 
of Firemanship, Book 5 (Home Office, 1985), already referred 
to, and by Tanner (1976), Wynne (1986) and McKenna (1989). 
Fire protection in marine transport is treated in the NFPA 
Handbook by Keller, Kerlin and Loeser (1986). 
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Fire control is an important feature of the fighting cap¬ 
ability of a warship. An account is given by Dimmer (1986). 

A relevant code is NFPA 306: 1993 Control of Gas 
Hazards on Vessels. Other codes and standards, notably the 
IMO codes, are detailed in Chapter 23. 

The much larger storages of flammable materials in 
marine transport provide more scope for, and necessitate, 
fire protection arrangements more similar to those used in 
fixed installations. 

Fire protection measures include the use of inerting and 
operational procedures to counter static electricity. 

The fire protection arrangements on chemical tankers 
and gas carriers and the application of water sprinkler, 
mechanical foam, vaporizing liquid and carbon dioxide 
systems are discussed by Keller, Kerlin and Loeser (1986). 

Another aspect of fire protection in marine transport is 
that relating to jetties. Accounts are given by Dicker and 
Ramsey (1983) and Gebhardt (1989). 

Ship fire protection is considered in more detail in 
Chapter 23. 

16.38 Fire Hazard 

The types of fire typical of the process industries are those 
described above. The hazard of a large industrial fire may be 
assessed by consideration of the historical record of such fires 
and their effects and/or of assumed scenarios using appro¬ 
priate frequency estimates and hazard and effects models. 

The process industries also suffer the more common 
types of fire such as fires in warehouses and in buildings. 
Both types of fire may cause extensive damage and the 
latter may give rise to a high death toll. 

16.38.1 Historical experience 

Fire constitutes the largest proportion of major accidents 
involving property damage which have occurred in the 
process industries. However, most accidents involving 
large loss of life involve explosions. Frequently large fires 
are associated with explosions, either causing the fire or 
resulting from it. 

A classification of fires in the process industries has been 
given in Section 16.1. The main headings are (1) vapour 
cloud fires, (2) fireballs, (3) jet flames, (4) liquid fires, 
(5) solids fires, (6) warehouse fires and (7) fires associated 
with oxygen. These various types of fire are now con¬ 
sidered, except for jet flames and solid fires. 

In Section 16.1 vapour cloud fires are classified as:Type 1, 
fire with no explosion;Type 2, fire resulting from explosion; 
and Type 3, fire resulting in explosion. 

Taking these three types of fire in turn, it is not easy to 
identify major fires without explosion, partly because such a 
fire does usually result in some explosions, notably BLEVEs, 
and partly because even if no explosion has occurred, this is 
generally not stated in the account given. Major fires on 
large sites therefore tend to involve explosions. Major fires 
on cross-country pipelines which do not involve explosions 
are relatively more frequent for the simple reason that 
targets vulnerable to a BLEVE are generally absent. 

Thus aType 1 fire occurred on an NGL pipeline at Austin, 
Texas, in 1973 (Case History A62), The fire engulfed and 
killed people in the vapour rich zone formed before ignition 
occurred and then burned back to the pipeline; there were 
six deaths. 

With respect to Type 2 vapour cloud fires, such fires often 
occur following the explosive rupture of a vessel and 


release of its contents. One such fire was that at the camp¬ 
site at San Carlos, Spain in 1978, described in Appendix 16, 
which resulted from the rupture of a passing road tanker 
and caused some 216 deaths. 

It is common for the aftermath of a large vapour cloud 
explosion to involve extensive fires, particularly in the 
storage area of the site. Cases in point are those at refinery 
at Lake Charles, Louisiana, in 1967 (Case History A40) 
and at the chemical works at Flixborough, UK, in 1974, 
described in Appendix 2, which burned for 2 weeks and 
1 week, respectively. The fires on Piper Alpha following 
the gas explosion in C Module were Type 2 fires. 

An explosion characteristic of Type 2 vapour cloud fires 
is the BLEVE. Outstanding examples are the vapour cloud 
fire at Port Newark, New Jersey, 1951, in which more than 
70 horizontal bullet tanks on site were destroyed (Case 
History A19), and that at Mexico City, Mexico, 1984, 
described in Appendix 4, in which the entire storage area 
was destroyed, with some 15 explosions being recorded 
over a iy 2 h period. 

Turning to fireballs, these are generally associated with 
the BLEVE of a vessel containing liquefied gas, but a type 
of fireball occurs also on oil storage tanks. A large propor¬ 
tion of fireballs recorded have been on transport: pipelines, 
road tankers and, above all, rail tank cars. 

Fireballs at fixed installations include those occurring 
during the BLEVEs at Feyzin, France, 1966 (Case History 
A38), West St Paul, Minnesota, 1974, and Mexico City, 
Mexico, 1984, described in Appendix 4. 

Fireballs on rail tank cars occurred in the BLEVEs of: 
propane at Crescent City, Illinois, 1970 (Case History A50); 
VCM at Houston,Texas, 1971 (Case History A53); propane at 
Kingman, Arizona, 1973 (Case HistoryA63); and LPG at Belt, 
Montana, 1976. A fireball on a road tanker is exemplified 
by the propane fireball at Lynchburg, Virginia, 1972 (Case 
History A59). The radii of these fireballs have been estimated 
at 75—100,150,150,150 and 60 m, respectively. An even larger 
fireball occurred on an LPG pipeline at Donnellson, Iowa, 
1978, with an estimated radius of 305 m (Case HistoryA91). 

A type of liquid pool fire which figures prominently 
among the large losses is the tank fire. A prominent exam¬ 
ple is the fire on a 66 ft high x 256 ft diameter oil storage 
tank which occurred in the refinery at Milford as: Haven, 
UK, 1983 (Case History A106). 

A major running liquid fire involving oil froth occurred 
at the refinery at Signal Hill, California, 1958 (Case History 
A26). The oil froth eventually covered some 27 acres, caus¬ 
ing extensive damage and the loss of two lives. In 1970, in 
the refinery at Beaumont, Texas, lightning struck a 40 ft 
high x 60 ft diameter oil tank, causing a massive release of 
oil which spread to create a fire involving 16 nearby 
undiked tanks (Case HistoryA46). 

There have also been major running liquid fires involv¬ 
ing LNG and LPG. The fire at Cleveland, Ohio, 1944, 
followed the rupture of an LNG storage tank which dis¬ 
charged its entire contents over the plant and the nearby 
urban area (Case History A12). The LNG ignited and a 
major fire ensued. Some of the LNG flowed as liquid down 
storm sewers where it mixed with air, with consequent 
explosions. The death toll was 128. 

The release of a massive wave of liquid propane at the 
gas plant at Umm Said, Qatar, 1977, was, at least he pri¬ 
marily, a liquid fire (Case History A88). 

Warehouse fires constitute another category. These a can 
involve large loss, though the death toll is usually not great. 
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Examples are two warehouse fires in Britain, at Renfrew in 
1977 (Case History A85) and at Salford in he 1982, both of 
which involved explosions of stored sodium at chlorate. 

An example of a fire associated with an oxygen release is 
that at Brooklyn, New York, 1970, when the vessel of for a 
road tanker ruptured violently, releasing liquid oxygen 
(Case History A48). A number of fires broke out as the 
oxygen came into contact combustible materials, and two 
people were killed. 

There are also fires that occur during construction, 
maintenance and decommissioning operations. The Staten 
Island fire in 1973, in which 40 died, occurred in an empty 
LNG storage tank on which men were working (Case His¬ 
tory A67). The tank was insulated with he polyurethane 
foam with an aluminium—polyester lining. It was this 
insulation which was the main seat of the fire. 

The historical record indicates that large death tolls from 
process fires are relatively infrequent compared with those 
from explosions. However, it should be emphasized that, 
overall, process fires are responsible for a large proportion 
of fatalities and damage in the process industries. 

16.38.2 Hazard assessment 

Hazard assessment of fire on process plant generally 
involves: the development of a set of scenarios for fire, 
principally by release and ignition, and of the associated 
event trees; an estimation of the frequency/probability of 
the initial events and of the events in the branches in the 
event trees from a mixture of historical data and synthesis 
of values; and modelling of the outcome events in the event 
tree, including both physical events all and damage/injury. 

A hazard assessment involves, in principle, the for¬ 
mulation of a set of scenarios and a full assessment of the 
frequency and consequences of the events. An assessment 
which is confined either to the estimation of the frequency 
of the events or to the modelling of the consequences is a 
partial one. Hazard assessments may be generic or may 
relate to specific hazardous situations. 

Overviews of generic process plant fire scenarios have 
been given for LPG by Rasbash (1979/80) and for LNG by 
Napier and Roopchand (1986). Essentially, the principal 
scenarios involve various modes of release of vapour and 
liquid, including rupture of pressure vessels and storage 
tanks and releases from pipework, hoses, pumps, and so on. 

A large proportion of such releases will give rise to a 
vapour cloud. The assessment of this cloud involves: the 
modelling of cloud formation and of mixing with air during 
the initial release; any liquid flashing and evaporation; the 
dispersion of the cloud and the mass of fuel within the 
flammable limits; the ignition of the cloud; and the devel¬ 
opment of any overpressure. If the event gives no over¬ 
pressure, it is a vapour cloud, or flash fire. 

A jet, or torch, fire and an engulfing fire tend to be of 
interest primarily as events which may cause a vessel to 
suffer a BLEVE. Likewise, a fireball on a vessel are gen¬ 
erally considered as part of the BLEVE event. Separate 
treatment is given to a flame on, or fireball from, a pipeline. 

Some principal types of model used for the hazard 
assessment of fires on process plants are those for 
(1) vapour cloud fires, (2) fireballs, (3) jet flames, (4) pool 
fires (5) engulfing fires and (6) pipeline fires. Accounts of 
some of the models available have been given above. 

An early, essentially representative, hazard assessment 
of fire is that given in the vulnerability model by Eisenberg, 
Lynch and Breeding (1975), who studied among other 


things the area affected by a flammable vapour cloud and 
the lethality of flash fires from such a cloud. The events of 
principal interest which they consider are marine spillages 
of 20,750, 83 and 0.81 of LNG on water with drifting of the 
vapour cloud towards populated areas. For gas dispersion 
they use a modification of the Pasquill—Gifford model. For 
ignition of the cloud they assume that an ignition source is 
located at the centre of each population cell and that igni¬ 
tion occurs if a flammable mixture reaches such an ignition 
source. The type of ignition source is specified for each cell 
by the user, the two types giving fire or explosion, respec¬ 
tively. For thermal injury they utilize their own probit 
equation, as described in Section 16.22. The populations 
at risk are defined in terms of the cell model already 
described. Some results obtained are as tabulated below: 


LNG Wind Ignition Fatalities 


(t) towards Time of Distance Explosion Flash 

(°n travel travelled fire 

(min) (km) 


20,750 

50 

4.2 

1.01 

984 


20,750 

53 

4.2 

1.01 

1238 

534 

83 

50 

5.6 

1.35 

921 

617 

83 

53 

No ignition 





Both explosions and flash fires are considered. The 
results are sensitive to the location of the population cells 
relative to the wind direction, so that for the cases con¬ 
sidered the flash fire casualties for the 83 ton release were 
actually greater than those for the 20,750 ton one. For the 
83 ton release with flash fire the effective thermal radiation 
intensity and time duration were 124 kW/m 2 and 0.08 min, 
respectively and 58 % of the people in the cell affected were 
killed. 

The First Canvey Report (HSE, 1978b) included assess¬ 
ments of: the hazard at the specific installations at Canvey 
from oil spillage over the bund at storages; a vapour cloud 
fire from the British Gas LNG storage; and vapour cloud 
fires from several LPG storages. These assessments were 
refined in the second report (HSE, 1981a). An account of 
this work is given in Appendix 7. 

The RijnmondReport (Rijnmond Public Authority, 1982) 
gives hazard assessments for storages at Rijnmond of 
acrylonitrile, propylene and LNG. It considers vapour 
cloud fires, fireballs, jet flames and pool fires. An account 
of this work is given in Appendix 8. 

The hazard assessments of BLEVEs by Drysdale and, 
David (1979/80), Blything and Reeves (1988 SRD R488) and 
Selway (1988 SRD R492) include extensive treatment of fire 
events which could cause a BLEVE. 

A general account of hazard assessment for warehouses 
is described by G.T. Atkinson, Jagger and Kirk 1992). 

16.39 Hazard Range of Fire 

The hazard range of a fire depends on the type of fire con¬ 
cerned. Fires other than a vapour cloud, or flash fire occur 
at a fixed point, and therefore the range of the fire is 
essentially determined by radiant heat transfer. The inten¬ 
sity of thermal radiation from a fire decays according to the 
inverse square law. For a flash fire, it is also necessary to 
take into account the movement of the cloud, which is likely 
then to be the dominant factor. 








FIRE 16/293 


A set of relations for the hazard range of fire from 
LPG has been given by Considine and Grint (1985). Their 
treatment is based on combining models for various types 
of fire or flame with injury relations. The injury relations 
used are those of Hymes (1983 SRD R275). These give the 
1% and 50% lethality levels as a function of thermal toad. 
The relations cover flash fires, fireballs, pool fires and jet 
flames. 


16.39.1 Vapour cloud fires 

The relations given by Considine and Grint for the hazard 
range of a flash fire are based on their relations for dense 
gas dispersion, which are given in Chapter 15. These are 
used to determine the distance to the lower flammability 
limit (LFL) and the flammable mass in the cloud. 

The authors derive their results for a flash fire from a 
flash fire code in which the flame is assumed to travel 
radially away from the ignition source. The thermal load at 
a given location is then evaluated numerically. They pre¬ 
sent the results for a quasi-instantaneous release as the 
plots shown in Figure 16.129. Two pairs of graphs are given, 
one pair, those shown in Figure 16.129(a,b), for a cloud with 
concentrations between the upper flammability limit 
(UFL) and the LFL and another pair, shown in Figure 
16.129(c,d) for a cloud with concentrations above the UFL. 
Figure 16.129(a,b) give the hazard ranges for 1% and 50% 
lethality for the first type of cloud and Figure 16.129(c) and 
give the corresponding hazard ranges for the second type. 
Both types of cloud will burn: the first has the potential to 
give a vapour cloud explosion, whilst the second will burn 
by diffusion. 

For a quasi-continuous release, the authors state that the 
envelopes for 1% and 50% lethality do not cover an area 
significantly different from that covered by the flammable 
plume and suggest that engulfment in the burning plume 
be taken as the basis for evaluating fatality. 


16.39.2 Fireballs 

For fireballs, Considine and Grint use the model of 
A.F. Roberts (1981/82) described in Section 16.15. The 
lethality relations are then 

r 5 o = 22/ a379 M 0 - 307 ] 10 <M< 3000; [16.39.1] 

n = 30f a366 M a306 J 10 < f < 300; f < 4 [16.39.2] 

4 = 4.5 AT 0 ' 33 [16.39.3] 

where Mis the mass of LPG (te), r is the distance to a given 
lethality (m), t is the exposure time (s), 4 is the duration 
time (s) and subscripts 1 and 50 denote 1% and 50% lethal¬ 
ity, respectively. The distances r are measured from the 
centre of the release. The maximum exposure time is lim¬ 
ited to the duration time of the fireball. 

The CCPS QRA Guidelines (1989/5) give the hazard dis¬ 
tance for a fireball as 

r m = 38.9M? 432 [16.39.4] 

where M T is the mass of fuel (ton) and r is the distance to 
50% lethality (m). 


Another set of hazard distances are those given for 
a propane fireball by Prugh (1994), as described in 
Section 16.22: 

rw = 38Mp 46 [16.39.5] 

where Mr is the mass of fuel (ton) and r is the distance to 
50% lethality (m). He draws attention to the similarity 
between his model and that of the CCPS. 

Prugh also gives the following relations for lethal dis¬ 
tance 

% = 5.0 W% M [16.39.6] 

r 6 o = 3.6 W% M [16.39.7] 

r 99 = 2.5JF°- 46 [16.39.8] 

where r is the distance to the given lethality (ft) and it Wt 
is the mass of fuel (lb), and for second degree burns 

r 6 o = 5.3 W?- 46 [16.39.9] 

and first degree burns 

r 6 o = 3.6Wj M [16.39.10J 

where now r is the distance to the given degree of injury (ft). 

16.39.3 Pool fires 

For pool fires, the model used by Considine and Grint is 
that by Considine (1984 SRD R297) described in Section 
16.17. The treatment does not take into account flame tilt or 
trailing, and therefore is limited to conditions with little or 
no wind. Hazard range relations are given for the case of an 
unhanded quasi-instantaneous spill with immediate igni¬ 
tion and with a spreading, burning pool. The relations are 

r 5 o = 16.1M 0 - 38 [16.39.11] 

n = 21.7M 0 ' 38 [16.39.12J 

The distances r are measured from the centre of the pool. 
The exposure time is assumed to be equal to the total 
burning time, and therefore does not appear explicitly in 
the correlations. 


16.39.4 Jet flames 

For jet flames of LPG, the model used by considine and 

L = 9.1m 0 ' 5 [16.39.13] 

W = 0.25 L [16.39.14] 

Where L is the length of the flame (m). m is the mass release 
flow (kg/s) and Wis the half-width of the flame at the flame 
tip (m). 

Two sets of hazard range relations are given, one for 
persons end on and one for those side on to the flame. The 
end on relations are 

r 50 = 16 t° A m 0A7 1 1 < m < 3000; [16.39.15] 

n = 2.8f a38 «j 0 ' 47 J 10 < / < 300 [16.39.16] 

where r is the distance from the edge of the flame for a given 
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(c) 


<d) 


Figure 16.129 Hazard ranges of flash fires (Considine and Grint, 1985): (a) vapour clouds with concentrations above 
the upper flammability limit, 50% lethality; (b) vapour clouds with concentrations above the upper flammability limits, 

1% lethality; (c) vapour clouds with concentrations between the upper and lower flammability limits, 50% lethality; and 
(d) vapour clouds with concentrations between the upper and lower flammability limits, 1 % lethality (Courtesy of Gastech) 
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lethality (m).The side on relations are 
r 50 = 1.9 i° A m 0A7 ) l<m< 3000; [16.39.17] 

i 10 < f < 300; 

n - 2.8t 03S m 0A7 j r>W [16.39.18] 

where r is the distance from the axis of the flame for a given 
lethality (m). 

16.40 Notation 

Ar Archimedes number 

Bi Biot number 

Fo Fourier number 

Fr Froude number 

Le Lewis number 

Nu Nusselt number 

Re Reynolds number 

Pe Peclet number 

Pr Prandtl number 

g acceleration due to gravity 

P absolute pressure 

R universal gas constant 

T absolute temperature 

p density 

a Stefan—Boltzmann constant 

Subscript 

max maximum 

Section 16.2 

Subsections 16.2.1-16.2.7 

A area of flame front cone; constant (Equation 

16.2.12) 

A' area defined by Equation 16.2.9 

B constant 

E apparent activation energy 

h height of flame front cone 

A H c net heat of combustion (kcal/mol) 

kb k 2 constants 

l slant height of flame front cone 

L lower flammability limit (%v/v) 

n index 

r radius of flame front cone 

S u burning velocity 

t temperature (°C) 

u velocity of gas 

U upperflammabilitylimit(%v/v) 

V volumetric flow of gas 

y concentration of fuel component i (mole fraction) 

a half-angle of apex of flame front cone 

r time delay before ignition 

Subscripts 

i fuel component i 

t at temperature t 

25 at 25°C 

Subsection 16.2.8 
di constant for component! 

bi constant for component! 


Ci constant for component i 

di constant for component i 

c pi specific heat at constant pressure of component i 

c pm mean specific heat over range specified 

Cpmp mean specific heat of products 

C pmr mean specific heat of reactants 

A H c heat of combustion 

Affi enthalpy change between states 0 and 1 

A H 2 enthalpy change between states 1 and 2 

n number of moles per mole of fuel 

p number of products 

r number of reactants 


Subscripts 

i component i 

o standard state 

p products 

r reactants 

1,2 initial, final state 

Subsection 16.2.9 
D„ quenching diameter 

D|| critical slot width 

Section 16.3 

Subsection 16.3.3 

g boundry velocity gradient 

r diameter of tube 

V volumetric flow gas 

Subscripts 
B blow-off 

F flashback 


Subsection 16.3.4 
Equation 16.3.2 
d diameter of pipe (m) 

D diffusion coefficient (m 2 /s) 

L flame length (m) 

u fuel velocity (m/s) 

Equation 16.3.3-16.3.5 

Q concentration of fuel in stoichiometric mixture 

(mold fraction) 

D diameter of pipe (m) 

L flame length (m) 

M n molecular weight of fuel 

M s molecular weight of surrounding fluid 

(normally air) 

T t absolute adiabatic flame temperature (K) 

T n absolute temperature of fuel in pipe (K) 

W diamter at top of flame (m) 

x axial distance (m) 

Z flame diameter (m) 

(*t ratio of number of mole of unreacted and reacted 

gas in stoichiometric mixture 

Subsection 16.3.5 

c p specific heat of gas at constant pressure 

£b critical velocity gradient for blow-off 

k constant 

K Karlovitz number 
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S u burning velocity 

T u absolute temperature of unburned gas 

7i absolute temperature defined by Figure 16.17 

U flow line velocity 

x, y coordinates defined by Figure 16.17 

rj 0 width of wave 

Equations 16.3.11-16.3.13 
d diameter of sphere 

q 0 thickness of unburnt outer shell 

Subscripts 
b burnt 

u unbumt 

Subsection 16.3.5 
A pre-exponential factor 

c specific heat of reading mass 

E activation energy 

k thermal conductivity 

m number defining geometry of reaction volume 

Q heat released per unit volume 

O' heat of reaction per unit mass 

r semi-thickness or radius of reacting volume 

x,y,z distances in x,y,z directions 

5 dimensionless parameter defined by 

Equation 16.3.20 

t] dimensionless parameter defined by 

Equation 16.3.18 

C dimensionless parameter defined by 

Equation 16.3.21 

t dimensionless parameter defined by 

Equation 16.3.22 

Subscript 
o initial 

Subsection 16.3.9 

c p specific heat of gas at constant pressure 

S burning velocity 

Equations 16.3.27-16.3.29 
E apparent activation energy 

ki, k 2 constants 

p pressure 

r radius of vessel 

t ignition time delay 

Equations 16.3.30 and 16.3.31 
d critical diameter 

h excess enthalpy 

H minimum ignition energy 

K constant 

Tf absolute adiabatic flame temperature 

T a absolute temperature of unhurried 

gas mixture ahead of the flame front 
p density of gas mixture 

Equations 16.3.32—16.3.34 
d c width of spark kernel 

k thermal conductivity of gas 

l characteristic flame dimension 


a thermal diffusivity of gas 

5 width of flame zone 

p density of gas 

Subscripts 
L laminar 

T turbulent 

Equations 16.3.35 and 16.3.36 
A constant (Equation 16.3.25) 

A, B constant (Equation 16.3.36) 

E minimum ignition energy 

t excitation time 

a index 

j8 index 

Subsection 16.3.10 
Equation 16.3.37 

g acceleration due to gravity (cm/s 2 ) 

r radius of tube 

v a velocity of bubble (cm/s) 

Equations 16.3.38-16.3.48 and 16.3.50-16.3.52 
B constant 

m, n indices 

S t average velocity of displacement of 

turbulent wave 
S u burning velocity 

u' axial component of turbulence 

v' radial component of turbulence 

U average velocity 

y mol fraction 

ai ratio of mass of fuel component 

i + corresponding amount of oxidant to 
total mass of fuel + oxidant 
0i, 02 functions of turbulence 

Equation 16.3.40 

S u burning velocity (cm/s) 

T u absolute temperature of unburned gas (K) 

Subscripts 

i component i 

L laminar 

m mixture 

T turbulent 

Equation 16.3.49 
d burner diameter (cm) 

u n laminar burning velocity (cm/s) 

« t turbulent burning velocity (cm/s) 

Equations 16.3.53-16.3.62 
A constant 

c p specific heat of gas 

D diffusion coefficient of deficient reactant 

k thermal conductivity of gas 

K Karlovitz flame stretch factor 

L integral length scale of turbulence 

Rl turbulent Reynolds number 

unburnt gas Reynolds number 
u' r.m.s. turbulent velocity 
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U\ laminar burning velocity 

u t turbulent burning velocity 

«k' effective r.m.s. turbulent velocity acting on 

Flame 

U average velocity 

X Taylor miscoscale 

v kinematic viscosity 

Section 16.3.11 
A constant 

c specific heat of unburned gas 

d quenching diameter 

d 0 quenching diameter 

dp depth of penetration of quenching 

d q quenching distance 

4jj critical slot width 

/ geometrical factor 

g F critical boundary velocity for flashback 

k thermal conductivity of gas 

ki—k 3 constants 

L gap length 

Sl laminar burning velocity 

S u burning velocity 

T f absolute flame temperature 

Ti absolute ignition temperature 

T 0 absolute temperature of unburned gas 

u' r.m.s. turbulent velocity 

x half-width of slot 

a. thermal diffusivity 

Subscript 

u unburned 

Subsection 16.3.12 
c constant 

k constant 

m, n indices 

P c t absolute final pressure for cool flame 

AP d pressure rise for cool flame 

P 0 initial pressure 

AT cf temperature rise for cool flame 

x ignition delay 

Section 16.4 

Subsection 16.4.2 
d L diameter of droplet 

K burning constant 

m F mass burning rate of droplet 

p L density of liquid 

Subsection 16.4.3 

Cf flame front volumetric concentration 

Cy volumetric concentration 

V a downward velocity of air 

Vf upward velocity of flame through suspension 

F s sedimentation velocity of drops relative to air 

Subsections 16.4.4 and 16.4.5 

B Spalding mass transfer number 

c p specific heat of fuel 

c pa specific heat of air 

c pg specific heat of gas 


Ci ratio of surface mean area to Sauter mean dia- 

C 3 ratio of volume mean diameter to Sauter mean 

diameter 

d q quenching diameter 

D 32 Sauter mean diameter 

Emin minimum ignition energy 

/ swelling factor of fuel 

H heat of combustion 

k thermal conductivity of fuel 

L latent heat of vaporization 

q mass ratio of fuel to air 

S g laminar burning velocity of gases liberated from 

particles 

S u laminar burning velocity 

AT temperature difference 

a thermal diffusivity of particle 

ot g thermal diffusivity of gases 

8i thickness of reaction zone 

t emissivity of particle 

p density 

(p equivalence ratio 


Subscripts 

b boiling point of fuel 

f fuel 

g gas 

p fuel 

pr pre-reaction zone 

r reaction zone 

s surface of fuel 

st stoichiometric 


Section 16.6 

a volume coefficint of expansion 

A pre-exponential term 

B constant (Equations 16.6.31-16.6.33 only); 

dimensionless parameter (Equations 
16.6.86-16.6.90 only) 
c specific heat of material 

Ci —c 3 roots, solutions of equations 

C concentration of oxygen 

C 0 concentration of oxygen in air 

Ci, C2 constants 
d diameter of sphere 

D constant 

Dp diffusion coefficient in pores 

E activation energy 

F constant 

G constant 

h surface heat transfer coefficient 

h c convection heat transfer coefficient 

h T radiation heat transfer coefficient 

j shape index, or factor (= 0 for slab; 

=1 for cylinder; = 2 for sphere) 
k thermal conductivity 

M parameter defined by Equation 16.6.108 

n index 

P parameter defined by Equation 16.6.109 

q heat transferred by radiation 

Q heat released by reaction per unit volume 

<3(T a ) modified heat released by reaction per unit 
volume 
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Q' heat released by reaction per unit mass 

Q" modified heat released by reaction per unit 

volume 

Q* modified heat released by reaction per unit mass 

r radial distance, half-width 

inner radius of cylinder 
r 2 outer radius of cylinder 

R gas constant 

R a average radius 

S surface area 

T temperature 

AT temperature difference 

V volume 

x horizontal distance 

z dimensionless distance 

a Biot number 

P effective heat transfer coefficient 

5 dimesionless ignition parameter 

(5 C critical ignition parameter 

5* modified critical ignition parameter 

e dimensionless parameter 

6i emissivity of surface 

e 2 emissivity of surroundings 

9 dimensionless temperature difference 

v kinematic viscosity 

p density of material 

t dimensionless time 

{ dimensionless parameter defined by 

Equation 16.6.78 

1 dimensionless parameter defind by 

Equation 16.6.93 
4> fractional conversion 

ij>* small fractional conversion necessary to 

initiate autocataly tic reaction 
ip fractional temperature defined by Equation 

16.6.100 

i p(Q concentration function defined by Equation 

16.6.80 

ip' derivative of \j/ with respect to x 

co dimensionless concentration 

Subscripts 
a ambient 

c critical value 

cb critical value for cube 

f fluid 

i induction, initial value 

im initial value for medium 

o centre 

p hot face 

s surface 

sb critical value for slab 

Section 16.7 

a radius of sphere (m); half distance between axes 

of two parallel cylinders (m) (Equation 16.7.53 
only); length of tank (m) (Equations 
16.7.184-16.7.187,16.7.190 and 16.7.191 only) 

A area (m z ) 

A n parameter defined by Equation 16.7.185 

A p cross-sectional area of pipe (m 2 ) 

b radius of sphere (m); width of tank (m) (Equa¬ 

tions 16.7.184-16.7.187,16.7.190 and 16.7.191 only) 


B parameter defined by Equation 16.7.65; para¬ 

meter defined by Equation 16.7.185 
c concentration of ions (kmol/m 3 ); height of tank 

(m) (Equations 16.7.184-16.7.187 only) 
c constant 

c a concentration of ions in the bulk fluid (kmol /m 3 ) 

c s concentration of ions at the pipe wall (kmol/m 3 ) 

c* charging tendency (As/m 2 ) 

C capacitance (F) 

d diameter (m) 

d A diameter of droplet, particle (m) 

dp diameter of pipe (m) 

D displacement (C/m 2 ) 

An molecular diffusion coefficient (m 2 /s) 

e charge on proton (C) (=1.6 x 10~ 19 ) 

E field strength (V/m) 

A breakdown field strength (V/m) 

E e field strength for onset of incendive discharge 

(V/m) 

E{ field strength at surface of inner cylinder (V/m) 

Anf maximum field strength with tank full 

of liquid (V/m) 

Anh maximum field strength with tank half full of 
liquid (V/m) 

A field strength at surface of outer cylinder (V/m) 

A field strength in vapour space of tank (V/ m) 

A field strength at distance z below roof of tank (V/ 

m) 

E y field strength at fraction y of tank height (V/m) 

/ friction factor 

/ fraction of charge unrelaxed 

(Equations 16.7.161-16.7.162 only) 

F Faraday’s constant (C/kmol) (=9.65 x 10 7 ) 

A field applied in contact between surfaces (N) 

A force (VAs/m) 

g acceleration due to gravity (m/s 2 ) 

G parameter defined by Equation 16.7.142; 

conductance (S) (Equation [16.7.3] only) 
h height of liquid in tank (m) 

A height of liquid in tank (m) 

A height of vapour in tank (m) 

H height of tank (m) 

I current (A) 

h current at inlet of pipe (A) 

A leakage current (A) 

I 0 current at outlet of pipe, at inlet of tank (A) 

A streaming current in infinitely long pipe (A) 

j charge flux (A/m 2 ) 

/ current density (A/m 2 ) 

k Boltzmann constant (J/K) (=1.38 x 10 -23 ); 

constant (Equation 16.7.221 only) 
l length (m) 

L length of tank (m) 

m mass (kg) 

n number of ions per unit volume (ions/ m 3 ) 

n A number of droplets per unit volume (droplets/ 

m 3 ) 

«t transference number 

N Avogadro’s constant (molecules/kmol) 

(=6.02 x 10 26 ) 

p height of vapour space (m) 

P pressure (N/m 2 ) 

AP pressure drop (N/m 2 ) 

q charge (C) 

q' charge (on second body) (C) 
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q a charge in equilibrium with initial voltage (C) 

(charging); initial charge (C) (discharging) 

Q volumetric flow (m 3 /s) 

r radial distance (m); (with subscript) radius (m) 

r c radius of cylinder (m) 

r\ radius of inner cylinder (m) 

r a radius of outer cylinder (m) 

r p radius of pipe (m) 

R universal gas constant (VC/molK) 

R resistance (Q); gas constant 

(Equations 16.7.103-16.7.106 and 
16.7.133-16.7.136 only) 

R p resistance of liquid in pipe (fi) 

5 space charge density (C/m 3 ) 

mass charge density (C/kg) 
s m f space charge density with tank half full of 
liquid (C/m 3 ) 

s ms space charge density with tank full of mist (C/ 
m 3 ) 

s a space charge density of liquid entering tank (C/ 

m 3 ); initial space charge density (Equation 
16.6.202 
only) (C/m 3 ) 

s t space charge density of liquid in tank (C/m 3 ) 

S surface area (m z ) 

t time (s) 

fi/2 half-life (s) 

T absolute temperature (K) 

u liquid velocity (m/s); ionic mobility (m 2 /Vs) 

(Equations 16.7.85-16.7.113) 
u st Stokes’ velocity (m/s) 

v ionic velocity (m/s) 

V potential difference, potential above earth, 
voltage (V) 

Vpn volume of containment (m 3 ) 

7 d potential difference across double layer (V) 

V e volume of charge cloud (m 3 ) 

Vo initial voltage (V) 

F s streaming potential (V) 

7 se t settling potential gradient (V/ m) 

Wes volume of vessel (m 3 ) 

w fraction of height of tank filled with liquid 

W energy, work (J) 

* distance (m); half-distance between parallel 

plates (m) (Equation 16.7.56 only) 
x,y,z spatial coordinates (m) 

X volume fraction of dispersed phase (v/v) 

Y parameter defined by Equation 16.7.148 

z number of elementary charges per particle 

a. shape parameter defined by Equation 16.7.186; 

parameter defined by Equation 16.7.169 
P shape parameter defined by Equation 16.7.152; 

parameter defined by Equation 16.7.187; 
parameter defined by Equation 16.7.191 
y surf ace tension (N/m); fraction of tank height 

at which field strength is measured 
(Equation 16.7.184 only) 

<5 thickness of double layer (m) 

dm thickness of diffusion layer (m) 

c relative permittivity, dielectric constant 

£ a absolute permittivity (F/m) 

£ ar relative permittivity of air 

£ 0 permittivity of free space (F/m) (=8.85 x 10 -12 ) 

r\ viscosity (kg/m s) 


f zeta potential (V) 

k conductivity (S/m = Q^ 1 m' 1 ) 

k c effective conductivity (S/m) 

k t rest conductivity (S/m) 

X parameter defined by Equation 16.7.160 

v kinematic viscosity (m z /s) 

p volume resistivity, resistivity (n m) 

p e effective density of dust cloud or settled 

powder (kg/m 3 ) 

Pi density of liquid (kg/m 3 ) 

p s density of particle material (kg/m 3 ) 

Ap density difference between droplet and 

continuous liquid phase (kg/m 3 ) 
a surface charge density (C/m 3 ) 

t relaxation time, relaxation time constant (s) 

t 0 initial relaxation time (s) 

t s shear stress (N/m 2 ) 

t so shear stress at wall (N/m 2 ) 

</> potential (V) 

ip Euler’s constant (=0.577) 

Subscripts 

d droplet, particle 

fp fill pipe 

1 liquid 

lk leakage 

P pipe 

t tank 

v vapour 

ves vessel 

oo infinitely long pipe 

Units 

Units in this section are SI, as given above, 
with the following exceptions: 

Equations 16.7.123-16.7.150,16.7.152, 

16.7.154-16.7.156: cgs units 
Subsections 16.7.34 and 16.7.36: units defined locally 
For resistivity 
ohm -1 = n _1 = mho = S 
Units of surface resistivity: 

Units of volume resistivity: H m 
cu = conductivity units (pS/m) 

Section 16.10 

P probability of ignition 

P a probability of ignition by event itself 

P h probability of ignition by a specific ignition 

source 

P b i probability of ignition by a ignition source i 

Pb,i,i probability that ignition source i is present 
Pb,i,2 probability that flammable region of gas 
cloud reaches ignition source i 
Pb,i,3 probability that ignition source i if active is able 
to ignite gas 

Pb,i,4 probability that ignition source i is active 
P c probability of ignition by a background 

ignition source 
r distance 

6 direction 

9 S semi-angle of sector 

p density of ignition source 
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Subscript 

i ith. ignition source 

Section 16.11 

B rate of penetration of burning into fuel bed 

C mass of air required for complete combustion of 

unit mass of fuel 

d depth of fuel bed consumed by fire 

D duct diameter 

/ fraction of surface covered by lining 

L length of flame zone 

L* dimensionless parameter defined by 

Equation 16.11.1 

V velocity of advance of leading edge of flame 

V* dimensionless parameter defined by 

Equation 16.11.2 
V K velocity of air 

Pa density of air 

p f density of fuel bed 

Section 16.13 

A area 

A constant in Equation 16.13.59 

A; constant in Equation 16.13.55a 

B radiosity 

c velocity of sound 

c a velocity of sound in vacuum 

C c correction factor for emissivity of 

carbon dioxide 

C„ correction factor for emissivity of 

water vapour 
e emissive power 

F a angle factor 

F Al _ A2 angle factor between surfaced 
and surface A 2 
F a interchange factor 

F e emissivity factor 

h Planck’s constant 

H incident radiation 

i intensity of radiation 

I intensity of radiation 

I a intensity of radiation at surface of source 

/t thermal radiation flux (unattenuated) 

k Boltzmann constant 

ki constant in Equation 16.13.55 

ki, k 2 constants in Equation 16.13.52 

L mean path length 

n refractive index 

Pco 2 partial pressure of carbon dioxide 

Ph 2 o partial pressure of water vapour 

r distance 

R radiant heat factor 

V visual range 

to concentration of water in atmosphere (pr mm) 

(pr = precipitative water; see text) 
v>\ concentration of water in atmosphere which 

causes absorption in window i to 
go from weak band to strong band 
absorption (pr mm) 
x path length in flame 

X path length outside flame 

a. absorptivity 

P extinction coefficient 


pi constant in Equation 16.13.55b 

y scattering coefficient 

eco 2 emissivity of carbon dioxide 

£h 2 o emissivity of water vapour 

Ae emissivity correction 

<b radiant heat flux 

6 angle 

k absorption coefficient 

X wavelength 

v wave frequency 

p reflectivity 

r transmissivity 

Tai transmissivity based on absorption in window i 
t si transmissivity based on scattering in window i 

t T ; total transmissivity in window i 

a) solid angle 

Subscripts 

b black body 

i,j for surfaces/,;' 

s source 

t target 

X for wavelength X 

v for wave frequency v 

Section 16.14 

Subsection 16.14.5 

A r area of radiation of hot gas layer (m 2 ) 

c p specific heat of hot gas layer (J/kg K) 

/ r effective thermal radiation intensity (W/m 2 ) 

k parameter defined by Equation 16.14.9 

k\ concentration at lower explosive limit (kg/m 3 ) 

k u concentration at upper explosive limit (kg/m 3 ) 

m total mass of vapour released 

q heat loss by radiation (W) 

r x parameter of cloud at lower explosive limit 

parameter of cloud at lower explosive limit 
t time (s) 

f e ff effective duration of fire (s) 

fi/2 half-life of fire (s) 

T a absolute temperature of environment (K) 

T g absolute temperature of hot gas (K) 

V T volume of hot gas layer (m 3 ) 

x, y, z distance in downwind, crosswind, 

vertical directions (m) 

P parameter defined by Equation 16.14.13 

c a emissivity of environment 

e g emissivity of hot gas 

p density of hot gas layer (kg/m 3 ) 

a Stefan-Boltzmann constant (W/m 2 K 4 ) 

Ox, Gy, g z dispersion coefficients in downwind, 
crosswind, vertical directions (m) 

Subscript 
i initial 

Subsections 16.14.6 and 16.14.7 
D cloud depth (m) 

H visible flame height (m) 

r stoichiometric air—fuel mass ratio 

S flame speed (m/s) 

U w wind speed (m/s) 
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w parameter 

W width of pool fire 

a constant pressure expansion ratio for 

stoichiometric combustion 
p a density of air (kg/m 3 ) 

p 0 density of fuel—air mixture (kg/m 3 ) 

</> Volumetric concentration of fuel (v/v) 

Subscript 

st stoichiometric 

Section 16.15 


Subsections 16.15.5-16.15.9 
D diameter of fireball (m) 

/ fraction of fuel released entering fireball 

M mass of fuel (kg) 

M r mass of liquid released (kg) 

«i, «2 indices 

/ a duration of combustion in system dominated by 

initial momentum effects (s) 

4 duration of combustion in system dominated by 

buoyancy effects (s) 

4 duration of combustion in system dominated by 

deflagration effects (s) 

% duration time of fireball (s) 

4 time at which lift-off occurs (s) 

4> fraction of liquid vaporized 


Equation 16.15.9a 
d persistence time (s) 

W mass of propellant (lb) 

Equation 16.15.15 

P absoluter pressure at moment of release (Mpa) 

Equation 16.15.16 

E surface emissive power (kW/m 2 ) 

P absolute pressure (MPa) 

Subsections 16.15.11-16.15.13 

E surface emissive power 

F view factor 

h height of center of fireball 

A H c heat of combustion (kj/kg) 

I heat received by target 

l distance between center of fireball and target 

Q heat release rate (kW) 

Q r heat rediated 

r radius of fireball 

x distance from point directly beneath centre of 

fireball and target, or ground distance 

а. absorptivity of target 

r atmospheric transmissivity 

б, <j> angles defined in Figure 16.87 

Subsection 16.15.15 

F b buoyancy force (N/m 2 ) 

F r fluid resistance force (N/m 2 ) 

g acceleration due to gravity (m/s 2 ) 


r radius of fireball (m) 

t time (s) 

4 burnout time 

p density of fireball (kg/m 3 ) 

Equations 16.15.33-16.15.40 
r radius of fireball (ft) 

r b radius of fireball at burnout (ft) 

R rate of addition of propellant (lb/s) 

t times (s) 

W mass of fireball (lb) 

W b mass of propellant, and fireball, at burnout (lb) 

p b density of fireball at burnout (lb/ft 3 ) 

Subscript 

b burnout 

Subsection 16.15.16 
D diameter of fireball (m) 

M mass of fuel (kg) 

r radius of fireball (m) 

4 duration time of fireball (s) 

W b mass of fireball, including air, at burnout (kg) 

Wt mass of fuel (kg) 

Subsection 16.15.17 
r radius of cloud 

Vf volume of initial cloud of fuel 

z height of center of cloud 

fi entrainment coefficient 

p a density of air 

(p equivalence ratio 

Subscripts 
p products 

r reactants 

Subsection 16.15.18 

M mass of fuel 

4 burning time 

v 0 mean release velocity 

p a density of air 

Subsection 16.15.19 
c specif ic heat (kj/ kg ° C) 

D diameter of fireball (m) 

/ flash fraction 

F r fraction of heat radiated, heat radiation factor 

g acceleration due to gravity (m/s 2 ) 

H enthalpy of fireball (kj) 

A H c heat of combustion (kj/kg) 

I heat radiation intensity received by target (kW/ 

m 2 ) 

l distance from centre of fireball to target (m) 

M mass of fuel released (kg) 

-M a mass of air in fireball (kg) 

Mi mass of fuel in fireball (kg) 

N parameter governing transition from control by 

momentum to control by gravity slumping 
P vapour pressure (MPa) 

Q heat of combustion (kj/kg) 
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Q r heat radiation rate (kW) 

r radius of cloud (m) 

R stoichiometric value of MJMf 

t time (s) 

4 time for cloud to fall below lower flammability 

limit (s) 

4 duration time of fireball (s) 

4 lift-off time (s) 

t g time to transition from control by momentum 

to control by gravity slumping (s) 

Tf absolute mean temperature of fireball (K) 

T a absolute temperature of initial reactants (K) 

V volume of cloud (m 3 ) 

a. momentum per unit mass (m/s) 

11 thermal efficiency 

Ap density difference between vapour and 

air (kg/m 3 ) 

p a density of air (kg/m 3 ) 

p f density of products at temperature T f (kg/m 3 ) 

p 0 density of products at temperature T a (kg/m 3 ). 

p v density of vapour (kg/m 3 ) 

Subsection 16.15.20 

Z> FB duration time of fireball (s) 

Et heat released (J) 

F r fraction of heat radiated 

H heat of combustion (J/kg) 

I T unattenuated thermal radiation at radius 

of target (W/m 2 ) 

/ T a thermal radiation at radius of target, taking 
account of atmospheric attenuation (W/m 2 ) 

M mass of fuel in fireball (te) 

M s mass of fuel in vessel (te) 

P D radiative power density (W/m 3 ) 

.Pfb radiative power (W) 

/?fb radius of fireball (m) 

i? T distance from centre of fireball to target (m) 

T e effective absolute fireball temperature (K) 

Ffb volume of fireball (m 3 ) 

X parameter 

a Stefan-Boltzmann constant (W/m 2 K 4 ) 

t atmospheric transmissivity 

<j) theoretical adiabatic flash fraction 

Section 16.16 

Subsections 16.16.4 and 16.16.5 
D diameter of fireball (m) 

M mass of chemicals (kg) 

4 duration time of fireball (s) 

Subsection 16.16.6 
d diameter of fireball (ft) 

D diameter of fireball (m) 

M mass of material (fuel + oxidizer) in fireball (kg) 

fd duration time of fireball (s) 

W mass of material (fuel + oxidizer) in fireball (lb) 

Subsection 16.16.7 
d diameter of fireball (ft) 

D diameter of fireball (m) 

M mass of explosive (kg) 

4 duration time of fireball (s) 

W mass of explosive (lb) 


Subsection 16.16.9 
D diameter of fireball (m) 

M mass of explosive (kg) 

4 time to complete combustion (s) 

4 duration time of fireball (s) 

4 time for transition from hemispherical to sphe¬ 

rical shape (s) 

Tf absolute temperature of fireball at termination 

</> parameter defined by Equation 16.16.21 

Section 16.17 


Subsection 16.17.4 
d pan diameter 

u velocity 

v liquid burning velocity 

p density 

Subscripts 


Subsection 16.17.5 
c p specific heat of air (kj/kg) 

D flame diameter (m) 

D elongated flame base (m) 

D w maximum pool dimension in direction of wind 

(m) 

g acceleration due to gravity (m/s 2 ) 

A H c heat of combustion of fuel (kj/kg) 

L flame height (m) 

m mass burning rate (kg/m 2 s) 

N dimensionless parameter defined by Equation 

[16.17.4] 

Q total heat release rate (kW) 

r s stoichiometric mass air to volatiles ratio 

T 0 absolute temperature of ambient air (K) 

u wind speed (m/s) 

u* dimensionless wind speed 

u c characteristic wind speed (m/s) 

«io wind speed at height of 10 m (m/s) 

«fo dimensionless wind speed at height of 10 m 
a, fi, y number of carbon, hydrogen, oxygen atoms in 
fuel molecule 

8 angle of tilt from vertical (rad) 

p a viscosity of air (kg/ms) 

p a density of ambient air (kg/m 3 ) 

p g density of fuel vapour at normal boiling 

point (kg/m 3 ) 

Equations 16.17.5 and 16.17.6 
A constant 

u vapour velocity (m/s) 

p density of vapour (kg/m 3 ) 

Ap density difference between vapour and 

air (kg/m 3 ) 

Subsection 16.17.6 

d pool diameter 

F view factor 

k extinction coefficient 
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q heat transferred from flame to pool 

q c heat transferred from flame to pool by 

conduction 

q T heat transferred from flame to pool by radiation 

<7ri m heat transferred from flame to pool by pan rim 

T b absolute temperature of burning liquid surface 

T r absolute temperature of flame 

U heat transfer coefficient 


Equations 16.17.27 and 16.17.28 
A H c net heat of combustion (kj/kmol) 

A H y latent heat of vaporization (kj/kmol) 

k\, k 2 constants 

v liquid burning rate (cm/min) 

Vo,, liquid burning rate for pool of infinite 

diameter (cm/min) 

Equations 16.17.29 and 16.17.30 
m mass burning rate (kg/m z s) 

m so mass liquid burning rate for pool of infinite 

diameter (kg/m 2 s) 

£ flame emissivity 

pi density of liquid (kg/m 3 ) 


Equations 16.17.31-16.17.39 
Kh g total heat of gasification (kj / kg) 

k absorption-extinction coefficient 

k 3 constant 

L m mean beam length 

m mass burning rate (kg/m 2 s) 

mass liquid burning rate for pool of infinite 
diameter (kg/m 2 s) 

T f absolute temperature of effective equivalent 

gray gas (K) 

P mean beam length corrector 

£ flame emissivity 

Subsection 16.17.8 
Equation 16.17.40 
d diameter of fire (ft) 

£4 constant 

q heat flux from surf ace (BTU/ft 2 h) ^ 

q heat flux from surface of ‘large’ fire (BTU/ft 2 h) 

Equation 16.17.41 

E surfaceemissivepower(kW/m 2 ) 

T t absolute temperature of flame (K) 

£ emissivity of flame 

Subsection 16.17.9 

A, B parameters defined by Equations 16.17.46c 

and 16.17.46d, respectively 

Af — A 4 parameters defined by Equations 16.17.51d, 

16.17.51f, 16.17.51h and 16.17.51i, respectively 
Bi parameter defined by Equation 16.17.51e 

E surface emissive power (kW/m 2 ) 

f[v) parameter defined by Equation 16.17.51g 

F view factor 

h height of tank 

I heat radiation incident on target (kW/m 2 ) 

/, /' distances defined by Figures 16.94.95 and 97 

4 slant distance between heat source and target 


L parameter defined by Equations 16.17.46a, 

16.17.48b, 16.17.51a, 16.17.58b 
Q r heat radiation rate (kW) 

r radius of surface (m) 

R parameter defined by Equations 16.17.44a 

and 16.17.56a 

x ground distance between source and target (m) 

X parameter defined by Equations 16.17.46b, 

16.17.48c and 16.17.51b 
a absorptivity 

P angle of target surface to horizontal 

6 angle of tilt of cylinder 

r atmospheric transmissivity 

(/> parameter defined by Equation 16.17.51c 

Subscripts 

h horizontal surface 

m maximum 

v vertical surface 

Subsection 16.17.13 
D diameter of cylinder 

F view factor 

h height of flame (m) 

A h c heat of combustion (kj / kg) 

H dimensionless flame height 

k extinction coefficient 

l distance from centre of flame to target (m) 

L dimensionless distance to target 

m mass burning rate (kg/m 2 s) 

P radiative power (kW) 

qi thermal radiation incident on target (kW/m 2 ) 

Tf absolute temperature of flame (K) 

P mean beam length corrector 

£f emissivity of flame 

Xt fraction of heat radiated 

Subscript 

og pool of infinite diameter 

Subsection 16.17.15 

Fr' modified Froude number 

g acceleration due to gravity (m/s 2 ) 

H length of flame (m) 

« w wind speed (m/s) 

W width of trench (m) 

W extended width of flame base (m) 

9 angle of tilt of flame (°) 

Section 16.18 

Subsections 16.18.2-16.18.4 
C L lower explosive limit (v/v) 

C L modified lower explosive limit (v/v) 

d flare diameter (m) 

D distance from centre of flame to target (m) 

F r fraction of heat radiated 

I heat radiation intensity incident on 

target (kW/m 2 ) 

k ratio of specific heats of gas 

K allowable heat radiation incident on 

target (kW/m 2 ) 
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M molecular weight of gas 

P pressure just inside flare tip (kPa) 

Q net heat release rate (kW) 

r radius from centre of flame (m) 

R parameter defined by Equation 16.18.10 

T absolute temperature of gas (K) 

exit velocity of gas at flare tip (m/s) 
u s velocity of sound (m/s) 

u x wind velocity (m/s) 

V volumetric flow of gas (m 3 /s) 

W mass flow of gas (kg/s) 

£A* horizontal deviation of flame (m) 

x c horizontal distance from flare tip to centre of 

flame (m) 

£Ay vertical deviation of flame (m) 

y c vertical distance from flare tip to center of 

flame (m) 

x atmospheric transmissivity 

Subscript 

j flare tip 

Subsection 16.18.6 
A surface area of flame (m 2 ) 

b lift-off distance of flame frustrum (m) 

C parameter defined by Equation 16.18.30 

dj diameter of virtual source (m) 

d a throat diameter of imagined flow nozzle (m) 

D s etlective diameter of source (m) 

E surface emissive power (kW/m 2 ) 

F view factor 

F r fraction of heat radiated 

g acceleration due to gravity (m/s 2 ) 

I heat radiation incident on target (kW/m 3 ) 

K parameter defined by Equation 16.18.25 

Lb length of flame (m) 

L Bo length of flame in still air (m) 

m mass flow of gas (kg/s) 

M molecular weight 

M k kilogram molecular weight of gas (kg/mol) 

P Q atmospheric pressure (N/m 2 ) 

Q neat heat release rate (kW) 

R velocity ratio 

R c gas constant (J/molK) 

f?L length of flame frustrum (m) 

T absolute temperature (K) 

Tj absolute temperature of gas in expanded jet (K) 

W mass fraction of fuel in stoichiometric 

mixture with air 

W\ width of base of flame frustrum (m) 

Wz width of top of flame frustrum (m) 

u gas velocity (m/s) 

velocity of gas in expanded j et (m/s) 
v wind velocity (m/s) 

a angle between hole axis and flame axis (°) 

at angle between hole axis and line joining tip 

of flame to centre of hole plane (°) 
j? parameter defined by Equation 16.18.19 

y ratio of gas specific heats 

0j angle of flame to horizontal! 0 ) 

0 jv angle between hole axis and wind vector in plane 

containingholeaxis,flameaxisandwindvector(°) 
p a density of air (kg/m 3 ) 

p g ° density of gas at standard conditions (kg/m 3 ) 


Pj density of gas in expanded jet (kg/m 3 ) 

{ Richardson number based on flame length 

in still air 

r atmospheric transmissivity 

V P parameter defined by Equation 16.18.17 

Subscripts 

j expanded jet 

p mean product value 

1 adiabatic combustion conditions 

Subsection 16.18.7 

A total surface area of flame (m 2 ) 

b lift- off distance (m) 

c({) parameter defined by Equation 16.18.49 

dj diameter of expanded j et (m) 

D s effective source diameter (m) 

/({) diameter defined by Equation 16.18.45 

F view factor 

F soo fraction of heat radiated for flames which emit 

black body radiation 

g acceleration due to gravity (m/s 2 ) 

G initial momentum flux of expanded jet (N) 

L({) parameter defined by Equation 16.18.48 

k gray gas absorption coefficient (m _1 ) 

L characteristic length (m) (Equation 16.18.38); 

length representing emitting path length 
(Equation 16.18.55) 

Lb xy parameter defined by Equation 16.18.51 

L bo length of vertical flame in still air (m) 
q heat radiation incident on target (kW/m 2 ) 

Q net heat release rate (kW) 

r({) parameter defined by Equation 16.18.46 

S surface emissive power (kW/m 2 ) 

Soo black body surface emissive power (kW/m 2 ) 

« a wind speed in release direction (m/s) 

Uj velocity of expanded jet (m/s) 

w a wind speed perpendicular to release (m/s) 

W mass fraction of fuel in stoichiometric 

mixture with air 

W\ maximum diameter of flame (m) 

W 2 minimum diameter of flame (m) 

x, y, z distances in release, vertical, crosswind 

directions (m) 

X,Y,Z x,y,z positions of flame 

p a density of air (kg/m 3 ) 

Pj densityof expanded jet(kg/m 3 ) 

r atmospheric transmissivity 

f Richardson number 

'E parameter defined by Equation 16.18.40 

Q x , Qy parameters defined by Equations 16.18.42 
and 16.18.43 

Subscripts 

en end of flame 

j expanded jet 

sd side of flame 

Section 16.19 

Subsection 16.19.2 

li impingement distance (m) 

m mass flow (kg/s) 



FIRE 16/305 


Subsection 16.19.6 

Z> max maximum cone diameter (m) 

F x , F y , F x view factors defined by Equations 16.19.3,16.19.4 
and 16.19.6 

h height of vent orifice (m) 

h distance from ground to bottom of flame 

radiator (m) 

h 2 distance from ground to top of flame radiator (m) 

I radiant heat flux (W/m z ) 

l length of flame (m) 

r radius of flame at tip (M) 

T absolute temperature of flame (K) 

x, y distances defined in Figure 16.106 (m) 
e emissivity of flame 

Subsection 16.19.7 
A, B, C constants 
d diameter of orifice (m) 

D diameter of flame (m) 

F fraction of heat radiated 

g acceleration due to gravity (m/s 2 ) 

h lift-off height (m) 

H height of flame (m) 

H* flame radiation height (m) 

m index 

Q heat release rate (MW) 

u gas velocity at nozzle exit (m/s) 

Subsection 16.19.9 

Dj diameter of j et (m) 

A H c heat of combustion (J/kg) 

L length of flame (m) 

m mass flow (kg/s) 

R s radius of flame at distance s (m) 

s distance along centre line (m) 

Uj velocity of j et (m/s) 

u w wind velocity (m/s) 

x, z distances in horizontal, vertical directions (m) 

Subsection 16.19.10 

F fraction of heat radiated 

AH C heat of combustion (kj/kg) 

m mass flow (kg/s) 

q heat radiation incident on target (kW/m 2 ) 

x distance from source to target (m) 

r atmospheric transmissivity 

Subsection 16.19.11 
L flame length (m) 

q fuel flow (kg/s) 

Subsection 16.19.2 
L length of flame (m) 

m mass flow (kg/s) 

W half-width of flame at tip (m) 

Subsection 16.19.13 
/ fraction of heat radiated 

F flame length (m) 

H c heat of combustion (J/kg) 

m mass flow (kg/s) 

q heat radiation incident on target (kW/m 2 ) 


x distance between source and target (m) 

t atmospheric transmissivity 

Subsection 16.19.14 
As Subsection 16.18.6 plus 
b modified lift-off distance 

Dj jet diameter (m) 

D s effective source diameter (m) 

L flame length (m) 

p a density of air (kg/m 3 ) 

Pj initial density at j et (kg / m 3 ) 

p v density of vapour (kg/m 3 ) 

Subsection 16.19.16 

F view factor 

h height of j et above ground including any lift- off 

L visible length of flame 

r t radius of flame at height z 

x distance between axis of jet and target 

z height of flame differential element 

a half-angle of flame 

i/^ angular position of flame differential element 

Equations 16.19.31 and 16.19.32 
As Subsection 16.18.6 plus 
D c diameter of cylinder equivalent to flame 

L length of cylinder equivalent to flame 

Lev height of centre of flame tip above level of jet exit 
a B angle between vertical and line joining jet exit 

and centre of flame tip 

0 angle between vertical and flame axis 

Subsection 16.19.18 

A area of ventilation opening (m 2 ) 

H height of ventilation opening (m) 

Section 16.20 

Subsection 16.20.1 

A wetted surface area 

k constant 

n index 

Q heat absorbed 

Equations 16.20.2-16.20.8 
A wetted surface area (ft 2 ) 

q heat absorbed per unit area (BTU/ft 2 h) 

Q heat absorbed (BTU/h) 

Subsection 16.20.4 
c specific heat of wall metal 

d thickness of wall metal 

F parameter (see text) 

Q heat absorbed per unit area 

T a asymptotic value of Ti 

T 0 absolute initial wall temperature 

Ti absolute wall temperature at time t 

e emissivity of external surface of wall 

p density of wall metal 

a Stefan-Boltzmann constant 
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Equations 16.20.12 and 16.20.13 
A parameter defined by Equation 16.20.13 

K ratio of outside to inside diameter of wall 

P h burst pressure 

T wall temperature (°C) 

cr u ultimate tensile strength or wall metal 

<T y yield strength of wall metal 


Section 16.21 


Subsection 16.21.3 

I thermal radiation intensity (cal/cm 2 s) 

k thermal conductivity of wood 

(cal/cm 2 s(°C/cm)) 
t\ ignition time (s) 

a. thermal diffusivity (cm 2 /s) 

p density of wood (g/cm 2 ) 


Equations 16.21.1—16.21.4 
A parameter defined by Equation 16.21.2 

(cal 2 /cm 4 (°C) 2 ) 

B parameter defined by Equation 16.21.4 

(cal 2 /cm 4 (°C) 2 ) 

I p minimum thermal radiation intensity for 

piloted ignition (cal/cm 2 s) 

4 minimum thermal radiation intensity for 

spontaneous ignition (cal/cm 2 s) 
s specific heat of wood (cal/g °C) 


Equations 16.21.5-6.21.18 
c specific heat of wood (cal/g °C) 

h heattransfercoefficientforconvection 

(cal/cm 2 s°C) 

4 minimum thermal radiation intensity 

(cal/cm 2 s) 

L linear dimension (cm) 

t time (s) 

T 0 absolute initial temperature (K) 

T s absolute surface temperature for ignition (K) 

^ absolute surface temperature for ignition at 

infinite time (K) 

P cooling modulus 

y energy modulus 

d s absolute surface temperature difference for 

ignition (°C) 

0oo absolute surface temperature difference for 

ignition at infinite time (°C) 


Equations 16.21.19 and 16.21.20 
ki constant 

L thickness of slab (cm) 

%-« 3 indices 

Subsection 16.21.4 
c specific heat of material 

A H enthalpy change per unit mass in raising 

material to its f irepoint 
k thermal conductivity of material 

L ‘heating length’ 

q rate of heat transfer across surface 

V rate of flame spread 


a thermal diffusivity of material 

p density of material 

r thickness 

to- critical thickness 

Section 16.22 

Subsection 16.22.5 
c specific heat of skin 

k thermal conductivity of skin 

Q net heat absorbed 

T 0 initial temperature of skin 

T s surface temperature of skin 

p density of skin 

Subsection 16.22.6 
Equation 16.22.2 

I thermal radiation intensity (W/m 2 ) 

n index 

t time (s) 

Equations 16.22.3 and 16.22.4 
D thermal dose (kj/m 2 ) 

I thermal radiation intensity (kW/m 2 ) 

L thermal load ((skW/m 2 ) 4 / 3 ) 

L> thermal load ([s (W/m 2 ) 4 / 3 ]/10 4 ) 

t exposure time (s) 

Equation 16.22.5 

I thermal radiation intensity (W/m 2 ) 

L' thermal load ([s (W/m 2 ) 4 / 3 ]/10 4 ) 

t exposure time (s) 

Subsection 16.22.13 
Equation 16.22.6 

I thermal radiation intensity (W/m 2 ) 

n index 

t time (s) 

Equation 

C 
S 

tp 

T 0 
T p 
W 

Equation 16.22.8 

D s clothing ignition load (s (kW/m 2 ) 2 ) 

I thermal radiation intensity (kW/m 2 ) 

t time (s) 

Subsections 16.22.15 and 16.22.17 
I thermal radiation intensity (W/m 2 ) 

t time of exposure (s) 

Y probit 

Subsection 16.22.18 

IJ thermal load ([s ([W/m 2 ) 4 / 3 ]/10 4 ) 

P m mortality 

T ma average mortality 

Y probit 


16.22.7 

absorptivity of fabric 
specific heat of fabric (J/g °C) 
density of fabric (g/cm 2 ) 
time to piloted ignition (s) 
initial temperature of fabric (°C) 
piloted ignition temperature (° C) 
incident heat radiation (W/cm 2 ) 
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<5 burn depth (m) 

<5 a burn depth corresponding to average 

mortality (mm) 

Subscripts 
a average 

1 upper 

u lower 

1 first coefficient 

2 second coefficient 


Section 16.26 

D mass median drop size (mm) 

k\ constant 

»i, »2 indices 

R rate of water application (l/m z s) 

R c critical rate of water application (1/min) 

t time to extinguish fire (s) 

AT difference between water temperature 

and liquid fire point (°C) 


Section 16.27 

A surface area of droplet (m 2 ) 

B mass transfer number 

c absorption coefficient 

C d drag coefficient 

D droplet diameter (m) 

g acceleration due to gravity (m/s 2 ) 

G liquid mass flux (kg/m 2 s) 

h A surface enthalpy of droplet (J/kg) 

h s free stream enthalpy (J/kg) 

L latent heat of evaporation of droplet (J/kg) 

m A mass of droplet (kg) 

M r rate of evaporation loss due to thermal 

radiation (kg/s) 

Q heat flux droplets (W/m 2 ) (Equation 16.27.8); 

heat flux between water and surface (W/m 2 ) 
(Equation 16.27.9) 
t time (s) 

St time of exposure of droplet (s) 

U gas velocity (m/s) 

v droplet velocity (m/s) 

v gas kinematic viscosity (m 2 /s) 

p g gas density (kg/m 3 ) 


Section 16.36 

t time (min) 

T temperature (°C) 

Subsection 16.36.4 

A t total surface area of walls and ceilings, 

excluding ventilation openings (m 2 ) 
Av area of ventilation openings, including 

doors and windows (m 2 ) 
ki constant 


M t total mass of combustible material 

(kg of wood equivalent) 
m mass burning rate (kg /min) 

tf effective fire resistance time (min) 

Subsection 16.36.11 

Equations 16.36.3-16.36.4 

A w area of ventilation opening (m 2 ) 

H height of ventilation opening (m) 

AH C heat of combustion (kj/kg) 

& v constant (kg/m 3 ^ 2 s) 

m mass burning rate (kg /s) 

q heat release rate (kW) 

Equations 16.36.5—16.36.8 

A t total area of enclosure, excluding ventilation 
openings (m 2 ) 

Ayf area of ventilation openings (m 2 ) 

h height of opening (m) 

L mass of fuel (kg) 

q io heat release rate at flashover (kW) 

T a ambient temperature (°C) 

T n upper limit air temperature (°C) 

q ventilation parameter (m _V2 ) 

t fire load parameter (kg/m 2 ) 

Subsection 16.36.12 
Af surface area of fuel (m 2 ) 

I thermal radiation intensity (kW/ m 2 ) 

Ly heat of gasification of volatiles (kj/kg) 

m mass burning rate (kg/s) 

T* constant 

T 0 absolute ambient temperature (K) 

T n absolute upper gas temperature (K) 

0i -0 5 modification factors (see text) 

Subsection 16.36.13 
B width of window (m) 

H height of window (m) 

m mass burning rate (kg/s) 

n shape factor defined by Equation 16.36.13 

x horizontal reach of flame (m) 

z height of flame above top of window (m) 

Section 16.39 

L length of flame (m) 

m mass release flow (kg/s) 

M mass of LPG (te) 

r distance of specified lethality (m) 

t exposure time (s) 

fd duration time (s) 

W half-width of flame at flame tip (m) 

Subscripts 

1 1% lethality 

50 50% lethality 
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Preface to Third Edition 


The first edition of this book appeared in 1980, at the end of 
a decade of rapid growth and development in loss preven¬ 
tion. In the preface to the second edition, Frank P. Lees 
wrote, “After another decade and a half the subject is more 
mature, although development continues apace. In prepar¬ 
ing this second edition it has been even more difficult than 
before to decide what to put in and what to leave out.” Frank 
Lees’ statement in 1996 rings even truer today, another 
eight years later in 2004. Industrial advances and technol¬ 
ogy changes coupled with recent events have made it 
essential to focus on new topics while keeping a complete 
grasp of all of older technologies and learnings as well. 
Safety programs today must also consider issues such as 
chemical reactivity hazards, safety instrumented systems, 
and layer of protection analysis. In the post 9-11 world, 
process safety and loss prevention must also include con¬ 
sideration of issues related to chemical security and resi¬ 
lient engineering systems. 

The history of safety regulations in the United States can 
be traced back to the year before the beginning of the 
twentieth century. The River and Harbor Act, the first 
known federal legislation relevant to safety was promul¬ 
gated in 1899. Since then, the total number of legislations 
has steadily increased. In addition to the federal govern¬ 
ment, local entities such as the state, county, and cities have 
also promulgated regulations and ordnances, which 
impose safety requirements on process facilities. Varying 
degrees of similar legislative action has also occurred in 
the rest of the world. These legislation were all promulgated 
in response to some event, demographic changes, as well as 
changes in the industry. Also, as our understanding of the 
hazards associated with industrial processes developed, 
procedures and practices were put in place to limit or elim¬ 
inate the damage. Government programs and industry 
initiatives spurred improvements in the science and tech¬ 
nology needed for the recognition of hazards and asso¬ 
ciated risks. 

Management systems have been put in place to implement 
regulations and industry practices. Government regula¬ 
tions will continue to be a significant driver for safety pro¬ 
grams. As such, one of the main objectives of these 
management systems is to ensure compliance. However, it is 
also quite clear that profitability is directly related to safety 
and loss prevention. Thus the management systems for 
safety are intricately tied into the operational management. 

The industrial revolution brought prosperity and along 
with it the use of hazardous processes and complex tech¬ 
nologies. Growing economies and global competition has led 
to more complex processes involving the use of hazardous 
chemicals, exotic chemistry, and extreme operating condi¬ 
tions. As a result, a fundamental understanding of the 
hazards and associated risks is essential. Process safety and 
risk management requires the application of the basic sci¬ 
ences and a systematic approach. Recent advances, such as 
overpressure protection alternatives and reactive chemistry 
allow safer design and operation of processes. 

In the multiple barriers concept, plants are designed 
with several layers so that an incident would require the 


failure of several systems. Another novel approach to pro¬ 
cess safety and risk management is to consider various 
actions in a descending hierarchical order. Inherently safer 
design consideration should be first in the hierarchy fol¬ 
lowed by prevention systems, mitigation, and response. 
The success of these systems is dependent on the funda¬ 
mental understanding of the process and the associated 
hazards. Chronic as well as catastrophic consequences 
resulting from toxic and flammable substances can be 
reduced and/or eliminated through appropriate design and 
operating practices. 

Managing safety is no easy task, but it makes bottom- 
line sense. There is a direct payoff in savings on a company 
workers’ compensation insurance, whose premiums are 
partly based on the number of claims paid for job injuries. 
The indirect benefits are far larger, for safe plants tend to 
be well run in general and more productive. The recipe for 
safety is remarkably consistent from industry to industry. 
It starts with sustained support of top management fol¬ 
lowed by implementation of appropriate programs and 
practices that institutionalize safety as a culture as com¬ 
pared to add-on procedures. The ingraining of safety as 
second nature in day-to-day activities requires a paradigm 
shift and can only be accomplished when safety is viewed 
as an integral and comprehensive part of any activity as 
compared to being a stand-alone or add-on activity 

This third edition of Loss Prevention in the Process 
Industries represents a combination of appropriate revi¬ 
sions of the essential compilations put together by Frank R 
Lees, along with several new chapters and additions on 
new areas that deserve attention and discussion. The third 
edition includes five new chapters and three new appen¬ 
dices. The five new chapters address incident investigation, 
inherently safer design, reactive chemicals, safety instru¬ 
mented systems, and chemical security. The three new 
appendices address process safety management regulation 
in the United States, risk management program regulation 
in the United States, and incident databases. 

The chapter on incident investigation provides a sum¬ 
mary of incident investigation procedures that can be used 
not only to determine causes of incidents but also provides 
a primer on capturing and integrating lessons learned from 
incident investigations into design, operations, main¬ 
tenance, and response programs. Chemical process inci¬ 
dents can be accompanied by significant consequences, 
both in terms of human life and in financial impact. Many 
major chemical process incidents are the result of a complex 
scenario involving simultaneous failures of multiple safe¬ 
guards. A robust system for incident investigation is 
usually necessary to determine and understand the causes, 
as well as implement measures to prevent a repeat event. 
This chapter is intended to provide an overview of incident 
investigation by addressing major concepts, principles, 
and characteristics of effective incident investigations of 
chemical process events. The focus is on incidents per¬ 
taining to chemical processes and their associated hazards, 
and the associated investigation techniques appropriate for 
complex systems and scenarios. This chapter is based on 




best practices for incident investigation, and those com¬ 
mon concepts (i.e., tools, techniques, definitions) included 
in root cause investigation methodologies currently in the 
public domain in use in the process industry. It is not the 
intention to provide a stand-alone investigation methodol¬ 
ogy/guideline, nor address internal or proprietary investi¬ 
gation methodologies. 

The chapter on inherently safer design addresses 
options and issues that can be considered with regard to the 
design and operation of plants. Inherently safer design is a 
philosophy that focuses on elimination of hazards or 
reduction of the magnitude of hazards rather than the 
control of hazards. Many of the concepts of inherently safer 
design have been applied by engineers in a wide variety of 
technologies for many years, without recognizing the 
common approach. In the late 1970s, in the wake of many 
large incidents in the chemical industry, Trevor Kletz 
recognized the common philosophies of hazard elimination 
and hazard reduction, gave the philosophy the name 
“inherently safer design,” and developed a specific set of 
approaches to help engineers in the chemical process 
industries to design inherently safer processes and plants. 
Trevor realized that increased expectations for safety, from 
companies, regulatory bodies, and society in general, 
combined with the increased potential damage from inci¬ 
dents in the larger plants being built to meet increased 
demand and global markets, resulted in increased com¬ 
plexity and cost for the safety systems required to satisfy 
these demands. Furthermore, while hazard control systems 
can be made highly reliable, they can never be perfect and 
will always have some failure probability. While this prob¬ 
ability can be made very small, there is always some chance 
that all safety systems will fail simultaneously and the 
result would be a large incident. Also, the hazard manage¬ 
ment systems require ongoing maintenance, as well as 
management and operator training, for the life of the plant. 
This results in ongoing costs, and the potential for future 
deterioration of the safety systems. Deteriorated systems 
will have reduced reliability, increasing the potential for a 
catastrophic accident. Trevor Kletz suggested that in many 
cases, a simpler, cheaper, and safer plant could be designed 
by focusing on the basic technology, eliminating or sig¬ 
nificantly reducing hazards, and therefore the need to 
manage them. 

The chapter on reactive chemicals provides an overview 
of this critical issue and provides guidance on management 
systems as well as experimental and theoretical methods 
for analyses of chemical reactivity hazards. Serious inci¬ 
dents arising from uncontrolled reactivity have taken place 
since the inception of the chemical industry. The human toll 
of such incidents has been staggering. In recent decades, 
greater recognition and resources have been directed 
toward preventing and mitigating such occurrences. A 
number of incidents have been so severe as to prompt reg¬ 
ulatory initiatives to force better management of reactivity 
It is prudent for any company, organization, or other group 
to scrutinize the chemicals being handled and implement 
measures to limit the risk of a major reactive hazards event. 
A sampling of incidents that have substantially heightened 
concerns regarding reactive hazards in the general public, 
in governmental agencies, and in industry includes: 


• The 1976ICMESA incident in Seveso, Italy in which an 
uncontrolled chemical reaction generated pressure 


resulting in relief venting of a highly toxic dioxane into 
the neighboring villages and countryside. 

• The 1984 Union Carbide incident in Bhopal, India in 
which methyl isocyanate was contacted with water, 
generating highly toxic cyanide gas and leading to 
thousands of fatalities. 

• The 1994 NappTechnology incident in Lodi, Newjersey 
in which an uncontrolled reaction involving gold ore 
processing led to the deaths of five firefighters. 

• The 1999 Concept Sciences incident in Allentown, 
Pennsylvania in which an explosion arising from 
a process concentrating hydroxylamine resulted in five 
fatalities. Another event involving purified hydro¬ 
xylamine took place in a Nissin Chemical plant in 
Gunma Prefecture, Japan in 2000 and led to four 
fatalities. 

• The 2001 TotalFinaElf incident in Toulouse, France in 
which ammonium nitrate being processed for nitrogen 
fertilizers exploded leading to 30 fatalities. 

These events, as well as numerous others, have influenced 
the perception and approach to reactive hazards. 

The chapter on safety instrumented systems addresses 
systems and procedures that need to be in place with regard 
to this area of safety and instrumentation. In many pro¬ 
cesses, technical or manufacturing issues limit the engi¬ 
neer’s capability to design an inherently safer process. 
Further, there is generally a point where the required capi¬ 
tal investment is disproportional to the additional risk 
reduction provided by the process modification. In other 
words, the derived safety benefit is too low relative to the 
economic investment. When this occurs, protection layers 
or safeguards must be provided to prevent or mitigate the 
process risk. A Safety Instrumented System (SIS) is a 
protection layer, which shuts down the plant, or part of it, if 
a hazardous condition is detected. Throughout the years, 
SIS have also been known as Emergency Shutdown Sys¬ 
tems (ESD, ESS), Safety Shutdown Systems (SSD), Safety 
Interlock Systems (SIS), Safety Critical Systems (SCS), 
Safety Protection Systems (SPS), Protective Instrumented 
Systems (PIS), interlocks, and trip systems. Regardless of 
what the SIS may be called, the essential characteristic of 
the SIS is that it is composed of instruments, which detect 
that process variables are exceeding preset limits, a logic 
solver, which processes this information and makes deci¬ 
sions, and final control elements, which take necessary 
action on the process to achieve a safe state. 

The chapter on chemical security deals with this new 
and critical element of the management of a process facility 
following the events of September 11, 2001. Security man¬ 
agement is required for protecting the assets (including 
employees) of the facility, maintaining the ongoing integ¬ 
rity of the operation, and preserving value of the invest¬ 
ment. Process security and process safety have many 
parallels and make use of many common programs and 
systems for achieving their ends. Process security requires 
a management systems approach to develop a comprehen¬ 
sive security program, which shares many common ele¬ 
ments to process safety management. 

The new appendix on process safety management reg¬ 
ulation in the United States provides a summary of this 
regulatory requirement. The fourteen elements of the 
OSHA Process Safety Management (PSM) regulation (29 
CFR 1910.119) were published in the U.S. Federal Register 
on February 24,1992. The objective of the regulation is to 


prevent or minimize the consequences of catastrophic 
releases of toxic, reactive, flammable, or explosive chemi¬ 
cals. The regulation requires a comprehensive manage¬ 
ment program: a holistic approach that integrates 
technologies, procedures, and management practices. The 
process safety management regulation applies to processes 
that involve certain specified chemicals at or above 
threshold quantities, processes that involve flammable 
liquids or gases on-site in one location, in quantities of 
10,000 pounds or more (subject to few exceptions), and 
processes that involve the manufacture of explosives and 
pyrotechnics. Hydrocarbon fuels, which may be excluded if 
used solely as a fuel, are included if the fuel is part of a 
process covered by this regulation. In addition, the reg¬ 
ulation does not apply to retail facilities, oil or gas well 
drilling or servicing operations, or normally unoccupied 
remote facilities. 

The new appendix on risk management program reg¬ 
ulation in the United States provides a summary of this 
regulatory requirement administered by the U.S. Environ¬ 
mental Protection Agency. In 1996, EPA promulgated the 
regulation for Risk Management Programs for Chemical 
Accident Release Prevention (40 CFR 68). This federal reg¬ 
ulation was mandated by section 112(r) of the Clean Air Act 
Amendments of 1990. The regulation requires regulated 
facilities to develop and implement appropriate risk 
management programs to minimize the frequency and 
severity of chemical plant accidents. In keeping with 
regulatory trends, EPA required a performance-based 
approach towards compliance with the risk management 
program regulation. The EPA regulation also requires reg¬ 
ulated facilities to develop a Risk Management Plan 
(RMP). The RMP includes a description of the hazard 
assessment, prevention program, and the emergency res¬ 
ponse program. Facilities submit the RMP to the EPA 
and subsequently is made available to governmental 
agencies, the state emergency response commission, the 
local emergency planning committees, and communicated 
to the public. 

The new appendix on incident databases addresses 
compilations of incident databases that can used for 


improving safety programs, developing trends, perfor¬ 
mance measures, and metrics. Incident prevention and 
mitigation of consequences is the focus of a number of 
industry programs regulatory initiatives. As part of these 
programs and regulations, accident history data are often 
collected. There are two basic types of information. One is a 
database consisting of standardized fields of data usually 
for a large number of incidents. The second are more 
detailed reports of individual incidents. Analysis of these 
incident history databases can provide insight into incident 
prevention needs. While the analysis and conclusions 
obtained from the incident database are often limited by 
the shortcomings of the databases themselves, the fact 
remains that incident history databases are very useful and 
can be a powerful tool in focusing risk reduction efforts. 
The conclusions can be used to identify systematically the 
greatest risks to allow prioritization of efforts to improve 
process safety. At the plant level this might entail identify¬ 
ing certain processes, types of equipment, chemicals, 
operations and other factors most commonly associated 
with incidents. Databases that cover a very large number of 
facilities are likely to reveal trends and patterns that no one 
company or facility could determine from their own 
experience. Statistical knowledge of the likelihood of the 
release of certain types of chemicals could help emergency 
responders, state emergency response commissions, and 
local emergency planning committees determine the most 
likely and most serious chemical releases in their areas and 
plan appropriate chemical accident responses. Incident 
databases may also help identify technologies and prac¬ 
tices to prevent chemical accidents, or the need to develop 
them. For example, the data could indicate that inspection 
and preventive maintenance of equipment and instruments 
should become more thorough or more frequent. 


M. Sam Mannan 
College Station , 
Texas, USA 
2004 




Preface to Second Edition 


The first edition of this book appeared in 1980, at the end of 
a decade of rapid growth and development in loss preven¬ 
tion. After another decade and a half the subject is more 
mature, although development continues apace. In prepar¬ 
ing this second edition it has been even more difficult than 
before to decide what to put in and what to leave out. 

The importance of loss prevention has been underlined 
by a number of disasters. Those at San Carlos, Mexico City, 
Bhopal and Pasadena are perhaps the best known, but 
there have been several others with death tolls exceeding 
100. There have also been major incidents in related areas, 
such as those on the Piper Alpha oil platform and at the 
nuclear power stations at Three Mile Island and Chernobyl. 

Apart from the human tragedy, it has become clear that 
a major accident can seriously damage even a large inter¬ 
national company and may even threaten its existence, 
rendering it liable to severe damages and vulnerable to 
takeover. 

Accidents in the process industries have given impetus 
to the creation of regulatory controls. In the UK the Advi¬ 
sory Committee on Major Hazards made its third and final 
report in 1983. At the same time the European Community 
was developing its own controls which appeared as the EC 
Directive on Major Accident Hazards. The resulting UK 
legislation is the NIHHS Regulations 1982 and the CIMAH 
Regulations 1984. Other members of the EC have brought 
in their own legislation to implement the Directive. There 
have been corresponding developments in planning con¬ 
trols. 

An important tool for decision-making on hazards is 
hazard assessment. The application of quantitative meth¬ 
ods has played a crucial role in the development of loss 
prevention, but there has been lively debate on the proper 
application of such assessment, and particularly on the 
estimation and evaluation of the risk to the public. 

Hazard assessment involves the assessment both of the 
frequency and of the consequences of hazardous events. In 
frequency estimation progress has been made in the col¬ 
lection of data and creation of data hanks and in fault tree 
synthesis and analysis, including computer aids. In con¬ 
sequence assessment there has been a high level of activity 
in developing physical models for emission, vaporization 
and gas dispersion, particularly dense gas dispersion; for 
pool fires, fireballs, jet flames and engulfing fires; for 
vapour cloud explosions; and for boiling liquid expanding 
vapour explosions (BLEVEs).Work has also been done on 
injury models for thermal radiation, explosion over¬ 
pressure and toxic concentration, on models of the density 
and other characteristics of the exposed population, and 
on shelter and escape. 

Some of these topics require experimental work on a 
large scale and involving international cooperation. Large 
scale tests have been carried out at several sites on dense 
gas dispersion and on vapour cloud fires and explosions. 
Another major cooperative research programme has been 
that of DIERS on venting of chemical reactors. 

The basic approach developed for fixed installations on 
shore has also been increasingly applied in other fields. For 


transport in the UK the Transport Hazards Report of the 
Advisory Committee on Dangerous Substances represents 
an important landmark. Another application is in the off¬ 
shore oil and gas industry, for which the report on the Piper 
Alpha disaster, the Cullen Report, constitutes a watershed. 

As elsewhere in engineering, computers are in wide¬ 
spread use in the design of process plants, where computer 
aided design (CAD) covers physical properties, flowsheet¬ 
ing, piping and instrument diagrams, unit operations and 
plant layout. There is increasing use of computers for fail¬ 
ure data retrieval and analysis, reliability and availability 
studies, fault tree synthesis and analysis and consequence 
modelling, while more elusive safety expertise is being 
captured by computer-based expert systems. 

The subject of this book is the process industries, but 
the process aspects of related industries, notably nuclear 
power and oil and gas platforms are briefly touched on.The 
process industries themselves are continually changing. In 
the last decade one of the main changes has been increased 
emphasis on products such as pharmaceuticals and agro¬ 
chemicals made by batch processes, which have their own 
particular hazards. 

All this knowledge is of little use unless it reaches the 
right people. The institutions which educate the engineers 
who will be responsible for the design and operation of 
plants handling hazardous materials have a duty to make 
their students aware of the hazards and at least to make a 
start in gaining competence in handling them. 

I would like again to thank for their encouragement the 
heads of the Department of Chemical Engineering at 
Loughborough, Professors D.C. Freshwater, B.W. Brooks 
and M. Streat; our Industrial Professors T.A. Kletz and 
H. A. Duxbury and Visiting Professor S.M. Richardson; my 
colleagues, past and present, in the Plant Engineering 
Group, Mr R.J. Aird, Dr P.K. Andow, Dr M.L. Ang, 
Dr PW.H. Chung, Dr D.W. Edwards, Dr P. Rice and 
Dr A.G. Rushton - I owe a particular debt to the latter; the 
members of the ACMH, chaired by Professor B.H. Harvey; 
the sometime directors of Technica Ltd, Dr D.H. Slater, 
Mr P. Charsley, Dr P.J. Comer, Dr R.A. Cox, MrT. Gjerstad, 
Dr M.A.F. Pyman, Mr C.G. Ramsay, Mr M.A. Seaman and 
Dr R.Whitehouse; the members of the IChemE Loss Pre¬ 
vention Panel; the IChemE’s former Loss Prevention Offi¬ 
cer, Mr B.M. Hancock; the members of the IChemE Loss 
Prevention Study Group and of the Register of Safety Pro¬ 
fessionals; the editorial staff of the IChemE, in particular 
Mr B. Brammer; numerous members of the Health and 
Safety Executive, especially Dr A.C. Barrell, Mr J. Barton, 
Dr D.A. Carter, Mr K. Cassidy, Mr P.J. Crossthwaite, 
Dr N.W. Hurst, Dr S.F. Jagger, Dr J. McQuaid, Dr K. Moodie, 
Dr C. Nussey, Dr R.P. Pape, Dr A.F. Roberts and 
Dr N.F. Scilly; workers at the Safety and Reliability Direc¬ 
torate, particularly Dr A.T.D. Butland, Mr I. Hymes, 
Dr D.W. Phillips and Dr D.M. Webber; staff at Shell 
Thornton Research Centre, including Dr D.C. Bull and 
Dr A.C. Chamberlain; staff at British Gas, including 
Dr J.D. Andrews, Dr M.J. Harris, Mr H. Hopkins, 
Dr J.M. Morgan and Dr D.J. Smith; staff at the Ministry of 


Defence, Explosives Storage and Transport Committee, 
including Mr M.A. Gould, Mr J. Henderson and Mr P. Stone; 
and colleagues who have taught on post-experience courses 
at Loughborough, in particular Dr C.D. Jones, Dr D.J. Lewis 
and Mr J. Madden; BP International and Mr R. Malpas for 
allowing me to spend a period of study leave with the com¬ 
pany in 1985-86 and Mr F.D.H. Moysen, Mr G. Hately, 
Mr M. Hough, Mr R. Fearon and others in the Central Safety 
Group and in Engineering Department; the Honourable 
Lord Cullen, my fellow Technical Assessors on the Piper 
Alpha Inquiry, Mr B. Appleton and Mr G.M. Ford and the 
Cremer and Warner team at the inquiry, in particular 
Mr G. Kenney and Mr R. Sylvester-Evans; other profes¬ 
sional colleagues Dr L J. Bellamy, Professor B. A. Buffham, 
Dr D. A. Crowl, MrT.J. Gilbert, Mr D.O. Hagon, Dr D.J. Hall, 
Mr K.M. Hill, Professor T.M. Husband, Mr M. Kneale, 
Dr V.C. Marshall, Dr M.L. Preston, Dr J. Rasmussen, 
Dr J.R. Roach, Dr J.R. Taylor, Dr V.M. Trbojevic, Mr H.M. 
Tweeddale, Dr G.L. Wells and Dr A.J. Wilday; my research 


colleagues Dr C.P. Murphy, Mrs J.I. Petts, Dr D.J. Sherwin, 
Mr R.M.J. Withers and Dr H. Zerkani; my research students 
Mr M. Aldersey, Mr D.C. Arulanantham, Dr A. Bunn, Dr 
M.A. Cox, Dr P.A. Davies, Dr S.M. Gilbert, Mr P. Heino, Dr 
A. Hunt, Dr B.E. Kelly, Dr G.P.S. Marrs, Dr J.S. Mullhi, 
Dr J.C. Parmar, Mr B. Poblete, Dr A. Shafaghi and Dr A.J. 
Trenchard as well as colleagues’ research students Mr E.J. 
Broomfield, Mr R. Goodwin, Mr M.J. Jefferson, Dr F.D. 
Larkin, Mr S. A. McCoy, Dr K. Plamping, Mr J. Soutter, Dr P. 
Thorpe and Mr S.J. Wakeman; the office staff of the 
Department, Mrs E.M. Barradell, Mr D.M. Blake, Miss H.J. 
Bryers and Miss Y. Kosar; the staff of the University 
Library, in particular Miss S.F. Pilkington; and my wife 
Elizabeth, whose contribution has been many-faceted and 
in scale with this book. 

Frank P. Lees 
Loughborough, 

1994 


Preface to First Edition 


Within the past ten or fifteen years the chemical and pet¬ 
roleum industries have undergone considerable changes. 
Process conditions such as pressure and temperature have 
become more severe. The concentration of stored energy 
has increased. Plants have grown in size and are often sin¬ 
gle-stream. Storage has been reduced and interlinking with 
other plants has increased. The response of the process is 
often faster. The plant contains very large items of equip¬ 
ment. The scale of possible fire, explosion or toxic release 
has grown and so has the area which might be affected by 
such events, especially outside the works boundary. 

These factors have greatly increased the potential for 
loss both in human and in economic terms. This is clear 
both from the increasing concern of the industry and its 
insurers and from the historical loss statistics. 

The industry has always paid much attention to safety 
and has a relatively good record. But with the growing scale 
and complexity involved in modern plants the danger of 
serious large-scale incidents has been a source of increas¬ 
ing concern and the adequacy of existing procedures has 
been subjected to an increasingly critical examination. 

Developments in other related areas have also had an 
influence. During the period considered there has been 
growing public concern about the various forms of pollu¬ 
tion, including gaseous and liquid effluents and solid 
wastes and noise. 

It is against this background that the loss prevention 
approach has developed. It is characteristic of this 
approach that it is primarily concerned with the problems 
caused by the depth of technology involved in modern 
processes and that it adopts essentially an engineering 
approach to them. As far as possible both the hazards and 
the protection are evaluated quantitatively. 

The clear recognition by senior management of the 
importance of the loss prevention problem has been crucial 
to these developments. Progress has been made because 
management has been prepared to assign to this work 
many senior and capable personnel and to allocate the other 
resources necessary. 

The management system is fundamental to loss preven¬ 
tion. This involves a clear management structure with well 
defined line and advisory responsibilities staffed by com¬ 
petent people. It requires the use of appropriate procedures, 
codes of practice and standards in the design and operation 
of plant. It provides for the identification, evaluation and 
reduction of hazards through all stages of a project from 
research to operation. It includes planning for emergencies. 

The development of loss prevention can be clearly traced 
through the literature. In 1960 the Institution of Chemical 
Engineers held the first of a periodic series of symposia on 
Chemical Process Hazards with Special Reference to Plant 
Design. The Dow Chemical Company published its Process 
Safely Manual in 1964. The American Institute of Chemical 
Engineers started in 1967 an annual series of symposia on 
Loss Prevention. The European Federation of Chemical 
Engineers’ symposium on Major Loss Prevention in the 
Process Industries at Newcastle in 1971 and the Federation’s 
symposium on Loss Prevention and Safety Promotion in the 


Process Industries (Buschmann, 1974) at Delft are further 
milestones. 

Another indicator is the creation in 1973 by the Institu¬ 
tion of Chemical Engineers Engineering Practice Commit¬ 
tee of a Loss Prevention Panel under the chairmanship of 
MrT.A. Kantyka. 

In the United Kingdom the Health and Safety at Work etc. 
Act 1974 has given further impetus to loss prevention. The 
philosophy of the Robens Report (1972), which is embodied 
in the Act, is that of self-regulation by industry. It is the 
responsibility of industry to take all reasonable measures 
to assure safety. This philosophy is particularly appro¬ 
priate to complex technological systems and the Act pro¬ 
vides a flexible framework for the development of the loss 
prevention approach. 

The disaster at Flixborough in 1974 has proved a turning 
point. This event has led to a much more widespread and 
intense concern with the loss prevention problem. It has 
also caused the government to set up in 1975 an Advisory 
Committee on Major Hazards. This committee has made 
far-reaching recommendations for the identification and 
control of major hazard installations. 

It will he apparent that loss prevention differs somewhat 
from safety as traditionally conceived in the process 
industries. The essential difference is the much greater 
engineering content in loss prevention. 

This is illustrated by the relative effectiveness of 
inspection in different processes. In fairly simple plants 
much can be done to improve safety by visual inspection. 
This approach is not adequate, however, for the more tech¬ 
nological aspects of complex processes. 

For the reasons given above loss prevention is currently 
a somewhat fashionable subject. It is as well to emphasize, 
therefore, that much of it is not new, but has been devel¬ 
oped over many years by engineers whose patient work in 
an often apparently unrewarding but vital field is the 
mark of true professionalism. 

It is appropriate to emphasize, moreover, that accidents 
arising from relatively mundane situations and activities 
are still responsible for many more deaths and injuries than 
those due to advanced technology 

Nevertheless, loss prevention has developed in response 
to the growth of a new problem, the hazard of high tech¬ 
nology processes, and it does have a distinctive approach 
and some novel techniques. Particularly characteristic are 
the emphasis on matching the management system to the 
depth of technology in the installation, the techniques 
developed for identifying hazards, the principle and meth¬ 
ods of quantifying hazards, the application of reliability 
assessment, the practice of planning for emergencies and 
the critique of traditional practices or existing codes, 
standards or regulations where these are outdated by 
technological change. 

There is an enormous, indeed intimidating, literature on 
safety and loss prevention. In addition to the symposia 
already referred to, mention may be made of the Handbook 
of Safety and Accident Prevention in Chemical Operations by 
Fawcett and Wood (1965); the Handbook of Industrial Loss 


Prevention by the Factory Mutual Engineering Corporation 
(1967); and the Industrial Safety Handbook by Handley 
(1969, 1977). These publications, which are by multiple 
authors, are invaluable source material. 

There is a need, however, in the author’s view for a 
balanced and integrated textbook on loss prevention in the 
process industries which presents the basic elements of the 
subject, which covers the recent period of intense develop¬ 
ment and which gives a reasonably comprehensive biblio¬ 
graphy. The present book is an attempt to meet this need. 

The book is based on lectures given to undergraduate 
and postgraduate students at Loughborough over a per¬ 
iod of years and the author gladly acknowledges their 
contribution. 

Loss prevention is a wide and rapidly developing field 
and is therefore not an easy subject for a book. Never¬ 
theless, it is precisely for these reasons that the engineer 
needs the assistance of a textbook and that the attempt has 
been considered justified. 

The structure of the book is as follows. Chapter 1 deals 
with the background to the historical development of loss 
prevention, the problem of large, single-stream plants, and 
the differences between loss prevention and conventional 
safety, and between loss prevention and total loss control; 
Chapter 2 with hazard, accident and loss, including histor¬ 
ical statistics; Chapter 3 with the legislation and legal 
background; Chapter 4 with the control of major hazards; 
Chapter 5 with economic and insurance aspects; Chapter 6 
with management systems, including management struc¬ 
ture, competent persons, systems and procedures, stan¬ 
dards and codes of practice, documentation and auditing 
arrangements; Chapter 7 with reliability engineering, 
including its application in the process industries; Chapter 8 
with the spectrum of techniques for identifying hazards 
from research through to operation; Chapter 9 with the 
assessment of hazards, including the question of accep¬ 
table risk; Chapter 10 with the siting and layout of plant; 
Chapter 11 with process design, including application of 
principles such as limitation of inventory, consideration of 
known hazards associated with chemical reactors, unit 
processes, unit operations and equipments, operating con¬ 
ditions, utilities, particular chemicals and particular pro¬ 
cesses and plants, and checking of operational deviations; 
Chapter 12 with pressure system design, including prop¬ 
erties of materials, design of pressure vessels and pipe¬ 
work, pressure vessel standards and codes, equipment 
such as heat exchangers, fired heaters and rotating 
machinery, pressure relief and blowdown arrangements, 
and failure in pressure systems; Chapter 13 with design of 
instrumentation and control systems, including regular 
instrumentation, process computers and protective sys¬ 
tems; Chapter 14 with human factors in process control, 
process operators, computer aids and human error; Chap¬ 
ter 15 with loss of containment and dispersion of material; 
Chapter 16 with fire, flammability characteristics, ignition 
sources, flames and particular types of process fire, effects 
of fire and fire prevention, protection and control; 
Chapter 17 with explosion, explosives, explosion energy, 
particular types of process explosion such as confined 
explosions, unconfined vapour cloud explosions and dust 
explosions, effects of explosion and explosion prevention, 
protection and relief; Chapter 18 with toxicity of chemicals, 
toxic release and effects of toxic release; Chapter 19 with 
commissioning and inspection of plant; Chapter 20 with 
plant operation; Chapter 21 with plant maintenance 


and modification; Chapter 22 with storage; Chapter 23 
with transport, particularly by road, rail and pipeline; 
Chapter 24 with emergency planning both for works and 
transport emergencies; Chapter 25 with various aspects of 
personal safety such as occupational health and industrial 
hygiene, dust and radiation hazards, machinery and elec¬ 
trical hazards, protective clothing and equipment, and 
rescue and first aid; Chapter 26 with accident research; 
Chapter 27 with feedback of information and learning from 
accidents; Chapter 28 with safety systems, including the 
roles of safety managers and safety committees and repre¬ 
sentatives. There are appendices on Flixborough, Seveso, 
case histories, standards and codes, institutional publica¬ 
tions, information sources, laboratories and pilot plants, 
pollution and noise, failure and event data, Canvey, model 
licence conditions for certain hazardous plants, and units 
and unit coversions. 

Many of the matters dealt with, such as pressure vessels 
or process control, are major subject areas in their own 
right. It is stressed, therefore, that the treatment given is 
strictly limited to loss prevention aspects. The emphasis is 
on deviations and faults which may give rise to loss. 

In engineering in general and in loss prevention in par¬ 
ticular there is a conflict between the demand for a state¬ 
ment of basic principles and that for detailed instructions. 
In general, the first of these approaches has been adopted, 
but the latter is extremely important in safety, and a con¬ 
siderable amount of detailed material is given and refer¬ 
ences are provided to further material. 

The book is intended as a contribution to the academic 
education of professional chemical and other engineers. 
Both educational and professional institutions have long 
recognized the importance of education in safety. But until 
recently the rather qualitative, and indeed often exhorta- 
tory, nature of the subject frequently seemed to present 
difficulties in teaching at degree level. The recent quanti¬ 
tative development of the subject goes far towards remov¬ 
ing these objections and to integrating it more closely with 
other topics such as engineering design. 

In other words, loss prevention is capable of development 
as a subject presenting intellectual challenge. This is all to 
the good, but a note of caution is appropriate. It remains 
true that safety and loss prevention depend primarily on 
the hard and usually unglamorous work of engineers with 
a strong sense of responsibility, and it is important that 
this central fact should not be obscured. 

For this reason the book does not attempt to select parti¬ 
cular topics merely because a quantitative treatment is 
possible or to give such a treatment as an academic exer¬ 
cise. The subject is too important for such an approach. 
Rather the aim has been to give a balanced treatment of the 
different aspects and a lead in to further reading. 

It is also hoped that the book will be useful to practising 
engineers in providing an orientation and entry to unfa¬ 
miliar areas. It is emphasized, however, that in this subject 
above all others, the specialized texts should be consulted 
for detailed design work. 

Certain topics which are often associated with loss pre¬ 
vention, for example included in loss prevention symposia, 
have not been treated in detail. These include, for example, 
pollution and noise. The book does not attempt to deal in 
detail with total loss control, but a brief account of this is 
given. 

The treatment of loss prevention given is based mainly 
on the chemical, petrochemical and petroleum industries, 



but much of it is relevant to other process industries, such 
as electrical power generation (conventional and nuclear), 
iron and steel, gas, cement, glass, paper and food. 

The book is written from the viewpoint of the United 
Kingdom and, where differences exist within the UK, of 
England. This point is relevant mainly to legislation. 

Reference is made to a large number of procedures and 
techniques. These do not all have the same status. Some are 
well established and perhaps incorporated in standards or 
codes of practice. Others are more tentative. As far as pos¬ 
sible the attempt has been made to give some indication of 
the extent to which particular items are generally accepted. 

There are probably also some instances where there is a 
degree of contradiction between two approaches given. In 
particular, this may occur where one is based on engineer¬ 
ing principles and the other on relatively arbitrary rules-of- 
thumb. 

The book does not attempt to follow standards and codes 
of practice in drawing a distinction between the words 
should, shall and must in recommending particular prac¬ 
tices and generally uses only the former. The distinction is 
important, however, in standards and codes of practice and 
it is described in Appendix 4 a . 

An explanation of some of the terms used is in order at 
this point. Unfortunately there is at present no accepted 
terminology in this field. In general, the problems con¬ 
sidered are those of loss, either of life or property. The term 
hazard is used to describe the object or situation which 
constitutes the threat of such loss. The consequences which 
might occur if the threat is realized are the hazard potential. 
Associated with the hazard there is a risk, which is the 
probability of the loss occurring. Such a risk is expressed 
as a probability or as a frequency. Probability is expressed as 
a number in the range 0 to 1 and is dimensionless; fre¬ 
quency is expressed in terms of events per unit time, or 
sometimes in other units such as events per cycle or per 
occasion. Rate is also used as an alternative to frequency 
and has the same units. 

The analysis of hazards involves qualitative hazard 
identification and quantitative hazard assessment. The lat¬ 
ter term is used to describe both the assessment of hazard 
potential and of risk. The assessment of risk only is 
described as risk assessment. 

In accident statistics the term Fatal Accident Frequency 
Rate (FAFR) has some currency. The last two terms are 
tautologous and the quantity is here referred to as Fatal 
Accident Rate (FAR). 

Further treatments of terminology in this field are given 
by BS 4200: 1967, by Green and Bourne (1962), by the 
Council for Science and Society (1977) and by Harvey 
(1979b). 

Notation is defined for the particular chapter at the point 
where the symbols first occur. In general, a consistent 
notation is used, but well established equations from stan¬ 
dards, codes and elsewhere are usually given in the original 
notation. A consolidated list of the notation is given at the 
end of chapters in which a large number of symbols is used. 

The units used are in principle SI, but the exceptions are 
fairly numerous. These exceptions are dimensional equa¬ 
tions, equations in standards and codes, and other equa¬ 
tions and data given by other workers where conversion has 
seemed undesirable for some reason. In cases of conversion 

““Appendices 4, 5 and 12 in the first edition correspond to Appen¬ 
dices 27,28 and 30, respectively, in this second edition. 


from a round number it is often not clear what degree 
of rounding off is appropriate. In cases of description of 
particular situations it appears pedantic to make the 
conversion where a writer has referred, for example, to a 
1 inch pipe. 

Notes on some of the units used are given in Appendix 
12 a . For convenience a unit conversion table is included in 
this appendix. Numerical values given by other authors are 
generally quoted without change and numerical values 
arising from conversion of the units of data given by other 
authors are sometimes quoted with an additional sig¬ 
nificant figure in order to avoid excessive rounding of 
values. 

Some cost data are quoted in the book. These are given in 
pounds or US dollars for the year quoted. 

A particular feature of the book is a fairly extensive 
bibliography of some 5000 references.These references are 
consolidated at the end of the book rather than at the end of 
chapters, because many items are referred to in a number of 
chapters. Lists of selected references on particular topics 
are given in table form in the relevant chapters. 

Certain institutions, however, have a rather large number 
of publications which it is more convenient to treat in a 
different manner.These are tabulated in Appendices 4 a and 
5 a , which contain some 2000 references. There is a cross- 
reference to the institution in the main reference list. 

In many cases institutions and other organizations are 
referred to by their initials. In all cases the first reference in 
the book gives the full title of the organization. The initials 
may also be looked up in the Author Index, which gives the 
full title. 

A reference is normally given by quoting the author and, 
in brackets, the date, e.g. Kletz (1971). Publications by the 
same author in the same year are denoted by letters of the 
alphabet a, b, c, etc., e.g. Allen (1977a), while publications 
by authors of the same surname and in the same year are 
indicated for convenience by an asterisk against the year in 
the list of references. In addition, the author’s initials are 
given in the main text in cases where there may still be 
ambiguity. Where a date has not been determined this is 
indicated as n.d. 

In the case of institutional publications listed in Appen¬ 
dices 4 a and 5 a the reference is given by quoting the insti¬ 
tution and, in brackets, the date, the publication series, e.g. 
HSE (1965 HSW Bklt 34) or the item number, e.g. IChemE 
(1971 Item 7). For institutional publications with a named 
author the reference is generally given by quoting the 
author and, in brackets, the initials of the institution, the 
date and the publication series or item number, e.g. Eames 
(UKAEA1965 Item 4). 

The field of loss prevention is currently subject to very 
rapid change. In particular, there is a continuous evolution 
of standards and codes of practice and legislation. It is 
important, therefore, that the reader should make any 
necessary checks on changes which may have occurred. 
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the secretary Mr H.E. Lewis, my fellow group chairmen 
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J.F. Richardson, Mr J.R.H. Schenkel, Mr R. Sheath and 
Mr M.J. Turner, and also from my university colleagues 
Dr P.K. Andow, Mr R.J. Aird and Dr D.J. Sherwin and 
students Dr S.N. Anyakora, Dr B. Bellingham, Mr C.A. 
Marpegan and Dr G. A. Martin-Solis. I am much indebted to 
Professor T.A. Kletz for his criticisms and suggestions on 
the text. My thanks are due also to the Institution of Plant 
Engineers, which has supported plant engineering activ¬ 
ities at Loughborough, to the Leverhulme Trust which 
awarded a Research Fellowship to study Loss Prevention in 


the Process Industries and to the Science Research Council, 
which has supported some of my own work in this area. 
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Terminology 


Attention is drawn to the availability in the literature of a 
number of glossaries and other aids to terminology. Some 


Notation 


In each chapter a given symbol is defined at the point where 
it is first introduced.The definition may be repeated if there 
has been a significant gap since it was last used. The defi¬ 
nitions are summarized in the notation given at the end of 
the chapter. The notation is global to the chapter unless 
redefined for a section. Similarly, it is global to a section 
unless redefined for a subsection and global to a subsection 


British Standard glossaries are given in Appendix 27 and 
other glossaries are listed in Table 1.1. 


unless redefined for a set of equations or a single equation. 
Where appropriate, the units are given, otherwise a con¬ 
sistent system of units should be used, SI being the pre¬ 
ferred system. Generally the units of constants are not 
given; where this is the case it should not be assumed that 
a constant is dimensionless. 


Use of References 


The main list of references is given in the section entitled 
References, towards the end of the book. There are three 
other locations where references are to be found. These are 
Appendix 27 on standards and codes; Appendix 28 on 
institutional publications; and in the section entitled Loss 
Prevention Bulletin which follows the References. 

The basic method of referencing an author is by surname 
and date, e.g. Beranek (1960). Where there would otherwise 
be ambiguity, or where there are numerous references to the 
same surname, e.g. Jones, the first author’s initials are 
included, e.g. A. Jones (1984). Further guidance on names is 
given at the head of the section References. 

References in Appendices 27 and 28 are by institution or 
author. Some items in these appendices have a code number 
assigned by the institution itself, e.g. API (1990 Publ. 421), 
but where such a code number is lacking, use is generally 
made of an item number separated from the date by a slash, 
e.g. IChemE (1971/13). Thus typical entries are 


API Std 2000:1992 a standard, found in Appendix 
27 under American Petroleum 
Institute 

API (1990 Publ. 421) an institutional publication, found 

in Appendix 28 under American 
Petroleum Institute 

HSE (1990 HS(G) 51) an institutional publication, found 

in Appendix 28 under Health 


and Safety Executive, Guidance 
Booklets, HS(G) series 

Coward and Jones an institutional publication, found 
(1952 BM Bull. 503) in Appendix 28 under Bureau of 
Mines, Bulletins 

Institutional acronyms are given in the section Acronyms 
which precedes the Author Index. 

There are several points of detail which require mention 
concerning Appendix 28. (1) The first part of the appendix 
contains publications of a number of institutions and the 
second part those of the Nuclear Regulatory Commission. 
(2) The Fire Protection Association publications include a 
number of series which are collected in the Compendium of 
Fire Safely Data (CFSD). A typical reference to this is FPA 
(1989 CFSD FS 6011). (3) The entries for the Health and 
Safety Executive are quite extensive and care may be nee¬ 
ded in locating the relevant series. (4) The publications of 
the Safety and Reliability Directorate appear under the UK 
Atomic Energy Authority, Safety and Reliability Directo¬ 
rate. A typical reference is Ramskill and Hunt (1987 SRD 
R354). These publications are immediately preceded by the 
publications of other bodies related to the UK AE A, such as 
the Health and Safety Branch, the Systems Reliability 
Service and the National Centre for Systems Reliability. 

References to authors in the IChemE Loss Prevention 
Bulletin are in the style Eddershaw (1989 LPB 88), which 
refers to issue 88 of the bulletin. 
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17/2 EXPLOSION 


The second of the major hazards is explosion. Explosion in 
the process industries causes fewer serious accidents than 
fire but more than toxic release. When it does occur, how¬ 
ever, it often inflicts greater loss of life and damage than 
fire. Explosion is usually regarded as having a disaster 
potential greater than that of fire but less than that of toxic 
release. 

The First Report of the Advisory Committee on Major 
Hazards (ACMH) (Harvey, 1976) states 

In the case of flammable materials, the greatest threat 
arises from the sudden massive escape of those volatile 
liquids, or gases, which could produce a large cloud of 
flammable, possibly explosive, vapour. If the cloud were 
ignited, the effects of combustion would depend on many 
factors including wind speeds and the extent to which the 
cloud is diluted with air. The worst consequence could be 
large numbers of casualties and wholesale damage on site 
and beyond its boundaries. Nevertheless where combus¬ 
tion has taken place it has generally been on or in the 
immediate vicinity of the site. An important feature of 
this threat is the small time interval between the initial 
escape and the fire or explosion, which could be less than 
a minute. 

The Flixborough disaster was primarily due to a vapour 
cloud explosion. It was this explosion which caused most of 
the casualties. 

There is a considerable literature on explosions. Much of 
the information relates to chemical or nuclear explosions 
and to military applications. Reference can be made here 
only to a few selected texts. These are Explosions, Their 
Anatomy and Destructiveness (C.S. Robinson, 1944), Explo¬ 
sion and Combustion Processes in Gases (Jost, 1946), Super¬ 
sonic Flow and ShockWaves (Courant and Friedrichs, 1948), 
The Science of High Explosives (M.A. Cook, 1958), Combus¬ 
tion, Flames and Explosions of Gases (B. Lewis and von 
Elbe, 1961,1987), The Effects ofNuclearWeapons (Glasstone, 
1962; Glasstone and Dolan, 1980), Explosive Shocks in Air 
(Kinney, 1962; Kinney and Graham, 1985), Explosions in 
Air (W.E. Baker, 1973) and Explosion Hazards and Evalua¬ 
tion (WE. Baker et al., 1983). 

Selected references on explosion are given in Table 17.1 
and on detonation in Table 17.2. 


Table 17.1 Selected references on explosion (see 
also Tables 17.2, 17.29, 17.36 and 17.61) 


Explosion, deflagration, detonation 
D.J. Lewis (n.d.); Ministry of Defence, ESTC (n.d.); von 
Schwartz (1904-); Jouguet (1905,1917); Chapman (1921); 
Kratz and Rosencranz (1922); EW. Stevens (1928); Coward 
and Hersey (1935 BM RI3274); Milne-Thompson (1938-, 
1947-); C.S. Robinson (1944); Kirkwood and Brinkley 
(1945); Jost (1946); G.I. Taylor (1946); Brinkley and 
Kirkwood (1947,1949,1961); Smart (1947); Courant and 
Friederichs (1948); Doering and Burkhardt (1949); Bowden 
and Yoffe (1952); Zabetakis and Jones (1955); Burgoyne 
(1956); K.N. Palmer (1956); Glasstone (1957,1962,1964); 
Randall etal. (1957); Emmons (1958); Ghormley (1958); 
Brinkley and Lewis (1959); Penner and Mullins (1959); 
Pipkin (1959); Rinehart (1959); Anon. (1960a); M.W. Evans 
and Ahlow (1961); B. Lewis and von Elbe (1961,1987); 

J.K. Wright (1961); J.N. Bradley (1962); Kinney (1962,1968); 


Ginsburgh and Bulkley (1963,1964); Yakovlev (1963); 
Jacobs (1964); Jacobs, Blunk and Scheineman (1964); 
Markstein (1964); Muzzall (1964); Oswatitsch (1965); 
Zabetakis (1965); Fordham (1966); Kogarko, Adushkin and 
Lyamin (1966); Laderman (1966); Soloukhin (1966,1969); 
Urtiew and Oppenheim (1965,1966,1967,1968); Craven 
and Greig (1967); P. Gray and Lee (1967a,b); Liepman and 
Roshko (1967); Burgess etal. (1968 BM RI 7196); E. Cohen 
(1968); D.L. Jones (1968,1970); Lutzsky and Lehto (1968); 
Munday, Ubbelohde and Wood (1968); H.S. Robinson 
(1968); Strehlow (1968a,b); van Dolah (1969b); Nagy, Conn 
and Verakis (1969 BM RI 7279); van Dolah and Burgess 
(1968); Ubbelohde and Munday (1969); Pawel etal. (1970); 
Rashash (1969c, 1970a, 1976a,b); Furno etal. (1971); 
Gruschka (1971); Klaassen (1971); Munday (1971b); Nagy 
etal. (1971 BM RI 7507); Panton (1971); Cubbage and 
Marshall (1972,1973,1974); Alexander and Taylor (1973a,b); 
W.E. Baker (1973); W.E. Baker, Westine and Dodge (1973); 
Grein (1973); Guill (1973); Hatfield (1973); Sadee (1973a,b); 
Bartknecht (1974a, 1980,1981a); Hess, Hoffmann and 
Stoeckel (1974); W.G. High (1974,1976); NFPA (1974/12); 
Perlee, Fuller and Saul (1974 BM RI 7839); Raj and Kalelkar 
(1974); Sivashinsky (1974); WE. Baker etal. (1975); 
Eisenberg, Lynch and Breeding (1975); Groothuizen and 
Pasman (1975); Kanury (1975); Kassoy (1975); Swisdak 
(1975); MLTI (1976); Strehlow and Baker (1975,1976); 
AIChE (1976/69); J.W Watts (1976); Fiumara (1977); Kletz 
(1977c, 1977-78); Leiber (1977); VC. Marshall (1977a,b,d, 
1987,1990b); Stull (1977); W.E. Baker et al. (1978); HSE 
(1978b, 1981a); R. King and Magid (1979); Pohto (1979); 
Bartknecht etal. (1980); Bodurtha (1980);Yallop (1980); 
Croft (1980/81); J.G. Marshall and Rutledge (1982); 
Mecklenburgh (1982,1985); Pantony and Smith (1982); 
Ramsay, Sylvester-Evans and English (1982); Solberg 
(1982a, b); Zeeuwen (1982); W.E. Baker etal. (1983); Anon. 
(1984qq); J.R. Bowen etal. (1984a,b); J.F. Clarke and Kassoy 
(1984); Kinney and Graham (1985); Cruice (1986); Fordham 
Cooper (1986); Pasman and Wagner (1986); C.K. Chan and 
Greig (1989); FPA (1989 CFSD FS 6011); ILO (1989); 
Teodorczyk, Lee and Knystautas (1989); Lazari, Burley and 
Al-Hassani (1991); Makhviladze and Rogatykh (1991); 
Pineau etal. (1991); D.C. Bull (1992); CPD (1992a,b); 
Opschoor, van Loo and Pasman (1992); Lefebvre et al. 
(1993);Tang and Baker (1998,1999); Baker et al. (1997); 
Tang, Baker and Cao (1996) 

Explosion energy (see also Tables 17.29 and 17.36) 

Girdhar and Aurora (1977); Hardesty and Kennedy (1977); 
Kinney and Graham (1985); Crowl (1991,1992a); CCPS 
(1994/15) 

Gas-filled vessels: Erode (1955,1957,1959); Kinney (1962); 
Kiwan (1970a,b, 1971); W.E. Baker (1973); Strehlow and 
Ricker (1976); Pohto (1979); Polentz (1980); Aslanov and 
Golinsky (1989); Crowl (1992a); CCPS (1994/15) 

Explosion scaling 

Hopkinson (1915); C.J.M. van Wingerden (1989b); Catlin 
and Johnson (1992) 

Flame acceleration, deflagration to detonation 
transition (DDT) (see also Table 17.29) 

Markstein (1957);Thibault etal. (1982); Lee, ICnystautas 
and Freeman (1984); Stock, Schildknecth and Geier (1984); 
S.B. Murray and Lee (1984); Peraldi, ICnystautas and Lee 
(1986); Nettleton (1987); Lindstedt and Michels (1989); 
Moen etal. (1989); C.K Chan, Lau and Radford (1991) 
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Pipes, tubes: M.W. Evans etal. (1949); Holzapfel and Schon 
(1965); Craven and Greig (1967); Leyer and Manson (1971); 
Moen, Murray et al. (1982); Rinnan (1982); J.F. Clarke and 
Kassoy (1984); Picone etal. (1984);Taki and Fujiwara (1984); 
Lee, ICnystautas and Chan (1985); Dunn-Rankin, Barr and 
Sawyer (1986); Ungiit and Shuff (1989); Dupre et al. (1991); 
Phylaktou, Andrews and Herath (1990); C.KChan, Lau and 
Radford (1991); Phylaktou and Andrews (1991a,b); 
Phylaktou, Foley and Andrews (1993); CCPS (1994/15) 
Enclosures, modules: Urtiew (1981); Moen (1982a); 
Hjertager etal. (1984); J.R. Harris andWickens (1989); 
Hjertager (1991); K. vanWingerden,Visser and Pasman 
(1991) 

Vapour clouds: Urtiew (1982a); H.G. Wagner (1982); 
Nettleton (1987); CCPS (1994/15) 

Combustion in pipes 

Mason and Wheeler (1917,1920a-c); Chapman and Wheeler 
(1926,1927); Penning (1926); de C.O.C. Ellis and Wheeler 
(1925,1928a,b); Kirby and Wheeler (1931a,b); H. Robinson 
and Wheeler (1933); D.T. Williams and Bellinger (1949); 
Guenoche (1964); Gugan (1974b); Dorge, Pangritz and 
Wagner (1981); Moen, Lee etal. (1982); Hjertager (1984); 
J.H.S. Lee, ICnystautas and Chan (1985); Hjertager, 
Bjorkhaug and Fuhre (1988); Hjertager, Fuhre and 
Bjorkhaug (1988a) 

Combustion in partially confined spaces 

Abou-Arab, Erayet and Kamel (1991) 

Parallel plates: Moen, Donate, ICnystautas and Lee (1980); 
Moen, Donate, ICnystautas, Lee and Wagner (1980); C.J.M. 
vanWingerden and Zeeuwen (1983); Hjertager (1984); 
C.J.M. vanWingerden (1984,1989c) 

Channels: Urtiew (1981); C. Chan, Moen and Lee (1983); 
Elsworth, Eyre and Wayne (1983); Sherman etal. (1985); 
P.H. Taylor (1986) 

Spherical and cylindrical explosions (see also 
Tables 17.13 and 17.29) 

Cousins and Cotton (1951a,b); Crouch etal. (1952);Vance 
and Krier (1974); Frankel and Sivashinsky (1983) 
Explosions in vessels (see also Table 17.13) 

Creech (1940); G.F.P. Harris and Briscoe (1967); Perlee, 
Fuller and Saul (1974 BM RI7839); Sibulkin (1980); S.R. 
Moore and Weinberg (1981); Grewer and Klais (1987); Rota 
etal. (1987); Phylaktou, Andrews and Herath (1990); 
Phylaktou and Andrews (1991b, 1993); Checkel and 
Thomas (1994); Phylaktou, Andrews and Liu (1994) 
Spherical geometry, spherical vessels: Flamm and Mache 
(1917); Mache (1918); Grumer, Cook and Kubala (1959); 
Spalding (1960); Spalding and Jain (1961); Spalding, Jain 
and Samain (1961); Raezer (1961); Pliickebaum, Strauss and 
Edse (1964); G.F.P. Harris (1967); Nagy, Conn and Verakis 
(1969 BM RI 7279); D. Bradley and Mitcheson (1976); Groff 
(1982); Kumar,Tamm and Harrison (1983); McCann, 
Thomas and Edwards (1985); Champion etal. (1986); 
Hjertager, Bjorkhaug and Fuhre (1988); Cant and Bray 
(1989); A. A. Evans (1989,1990,1991,1992a,b); Tanaka 
(1989); CanuefaZ. (1990) 

Cylindrical geometry, cylindrical vessels: Jain and Ebenzer 
(1966);Vance and Krier (1974); Starke and Roth (1986,1989); 
Andrews, Herath and Phylaktou (1990) 

Pressure piling 

Beyling (1906); Grice and Wheeler (1929); Coward and 
Wheeler (1934); Gleim and March (1952 BM RI 4904); 

T.A.J. Brown (1959); K.C. Brown and Curzon (1963); 


Heinrich (1975); J. Singh (1977,1984,1994a); Bartknecht 
(1981a); Boyd etal. (1981); Fitt (1981a,b); Zeeuwen (1981); 
Phylaktou and Andrews (1993) 

Other enhanced pressure effects 
Kordylewski and Wach (1986,1988) 

Explosions in enclosures, modules 
Rasbash (1976b,d); DnV (1979 79-0483); Hirano (1984); 
Hjertager et al. (1984); Hjertager (1986,1991,1993); 
Hjertger, Bjorkhaug and Fuhre (1988); Catlin (1991); 
Takahashi etal. (1991); Catlin and Johnson (1992); 
Hjertager, Solberg and Nymoen (1992); Phylaktou etal. 
(1992); Catlin, Manos and Tite (1993); Samuels (1993); 
Phylaktou, Andrews and Liu (1994); K. vanWingerden, 
Pedersen and Wilkins (1994) 

Explosions in buildings 

Astbury et al. (1970); Cubbage and Moppett (1970); FRS 
(1971 Fire Res. Note 847,1974 Fire Res. Note 984,985); Fry 
(1971); Astbury,West andHodgkinson (1972,1973); Astbury 
and Vaughan (1972); W.B. Howard (1972); BRE (1973 CP 11/ 
73,1974 BR9, CP 45/74,1976 CP 24/76); Bartknecht (1981a); 
Buckland (1980); Zalosh (1980a); R.J. Harris (1983); Cleaver, 
Marshall and Linden (1994); Woodward,Thomas (2000) 
Ronan Point: H. Griffiths, Pugsley and Saunders (1968) 
Bursting vessels 

Boyer et al. (1958); M.P. Friedman (1961); Garrison (1975); 
Leslie and Birk (1991); Gelfand etal. (1992); Crowl (1999); 
Baker, Tang, Cao (1996) 

Vented explosions 

Hjertager (1982a, b, 1986,1991); P.H. Taylor (1986); 
Hjertager, Fuhre and Bjorkhaug (1988a,b); Bakke etal. 
(1989); van den Berg, vanWingerden and Verhagen (1989); 
P.H. Taylor and Bimson (1989); C.J.M. vanWingerden 
(1989c); Tamanini and Chaffee (1992) 

CLICHE: Catlin (1990);Tamanini (1990,1995,1996a, b); 
Tamanini andValiulis (1996) 

FLACS: Hjertager (1982a); Bakke, Bjerketvedt and 
Bjorkhaug (1990) 

Explosive loads 

ACDS (1991); Gilbert, Lees and Scffly (1994a-c) 

Particular types of explosion 

Adsorbers: Anon. (1986 LPB 69, p. 25); CCPS (1993/13) 

Air plants:Rotz\er et al. (1960); Matthews (1961); G.T. Wright 
(1961); Lang (1962,1965); Rendos (1963); Boyne (1966) 

Air systems, oil films: Mallow (1964a,b);Thoenes 1964; 
Sichel, Rao and Nicholls (1971); Burgoyne and Craven 
(1973); Fowle (1973) 

» i i titrate: Commentz etal. (1921); Kintz, Jones and 
Carpenter (1948 BM RI 4245); National Board of Fire 
Underwriters (1948); Hainer (1955); Sykes, Johnson and 
Hainer (1963); Sykes etal. (1963); van Dolah etal. (1966 BMI 
6747, RI 6773); HSE (1978b); Heemskerk and Schuurman 
(1989); ACDS (1991) 

Asphalt, bitumen tanks: Anon. (1986 LPB 71, p. 71); 
Trumbore,Williamson and Wolfsberger (1991); Davie, 
Nolan and Hoban (1993,1994); Davie, Nolan and Tucker 

Boilers: Ostroot (1976b); Hewison (1983); G.D. Davis (1987); 
Bond (1990 LPB 93) 

Centrifuges: Butterwick (1976); Funke (1976); Lindley 
(1987) 

Chlorine systems: Eichelberger, Smura and Bergenn (1961); 
Johnsen and Yahnke (1962,1973); Dokter (1985a,b);Tabata, 
Kodama and Kotoyori (1987); Bafflou et al. (1992) 
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Compressors: Gibbs (1960); Perlee and Zabetakis (1963 BM 
RI8187); Walton (1963); W.L. Ball (1964); Schmitt (1964); 
Strelzoff (1964);Thoenes (1964); J.A. Rogers (1965); 
Armistead (1973); Burgoyne and Craven (1973); Fowle 
(1973); Prentice, Smith and Virtue (1974); HSE (1978b); 
Anon. (1979 LPB 26, p. 51); Kolodner (1980) 

Cooling systems: Mansfield (1990 LPB 94) 

Crankcase: Burgoyne, Newitt and Thomas (1954); 
Burgoyne and Newitt (1955); Mansfield (1956); Freestone, 
Roberts and Thomas (1965); Rushbrook (1979) 

Diesel engines: Anon. (1970d) 

Distillation systems: Carrara (1973); Fire Journal Staff 
(1973a); Freeman and McReady (1971); Jarvis (1971); Keister, 
Pesetsky and Clark (1971); Griffith and Keister (1973); 
Kotoyori etal. (1976); Kroger (1979) 

Driers: K.N. Palmer (1973a); Reay (1977); Bartknecht 
(1981a); Abbott (1990); Schoofs (1992); Anon. (1994 LPB 
119, p. 5) 

Drums and small tanks: HSE (1970 Bklt 32); Pinsky,Vickery 
and Freeman (1990); Anon. (LPB 103, p. 31) 

Electrical. Benjaminsen and vanWiechen (1968); Fordham 
Cooper (1986); Bartels (1990) 

Ethylene: Martinet (1984); Vanderwater (1989) 

Ethylene oxide systems: Troyan and Levine (1968); Ogawa, 
Miyake and Matsuo (1992) 

Extruders: Anon. (1986 LPB 71, p. 31); Carter (1987 LPB 73); 
Anon. (1989 LPB 87, p. 3) 

Flare systems: Bluhm (1964b); Kilby (1968) 

Furnaces: P. Peterson (1967); Kletz (1972c); Ostroot 
(1972,1976b); Durrant and Lansing (1976); Anon. (1992 
LPB 108, p. 17) 

Gas distribution system (public supply): DoEn (1977b); 
Buckland (1980); R.J. Harris (1983) 

Heat exchangers: Zabetakis (1960 BM RI 5645); Bohlken 
(1961); Mesloh (1964); Lang (1965); Anon. (1987 LPB 74, 
p. 15); Anon. (1987 LPB 75, p. 22); Cullen (1990) 

Hydraulic accumulators: Pratt (1986) 

Hydrogen: Kolodner (1980); Anon. (1984x); Nordmo and 
Emblem (1989);Tamanini etal. (1989) 

Incinerators: Anon. (1988 LPB 81, p. 17,1990 LPB 92, p. 29) 
Liquefied natural gas: Anon. (1972f); HSE (1978b); 

ACDS (1991) 

Liquefied petroleum gas: HSE (1978b); Rasbash (1979/80); 
ACDS (1991) 

Low temperature fluids: Burgoyne (1965b) 

Lubricants'. Anon. (1960c); Burgoyne and Craven (1973); 
Hasegawa (1992) 

Mist and spray: Haber and Wolff (1923); Burgoyne and 
Richardson (1949b); Burgoyne (1957); Eichhorn (1964); J.R. 
Bowen etal. (1971);Vincent and Howard (1976);Vincent etal. 
(1976a,b); Gubin and Sichel (1977); Nettleton (1977b, 1987); 
Bar-or, Sichel and Nicholls (1981,1982); Dabora (1982); 
Sichel (1982a,b); Sichel and Palaniswamy (1985); Bothe, 
Brandes and Redeker (1986) 

Molten metal: Genco and Lemmon (1970) 

Molten metal-water: C.F. Epstein (1961); Lipsett (1966); 
Brauer, Green and Mesler (1968); Flory, Paoli and Mesler 
(1969); Konway, Mead and Page (1975); HSE (1977/8); 
Vaughan (1980 SRDR177) 

Nitrogen systems: Conklin (1961); Sanders and Nordop 
(1963); J.A. Rogers (1965); Anon. (1979 LPB 29, p. 151) 
Piping: J.B. Smith (1949); Ringer (1985); Anon. (1989 
LPB 88, p. 13) 

Pollution control equipment: K.N. Palmer (1973a); 
Bodurtha (1976) 


Pumps: Anon. (1987 LPB 74, p. 23) 

Rail tank cars: Vanderwater (1989) 

Ships: Burgoyne (1965a); Page and Gardner (1971); VJ. 
Clancey (1981); Blything and Edmonson (1984 SRD R292); 
ACDS (1991) 

Spray driers: Masters (1972—, 1979); N. Gibson and 
Schofield (1977); Bartknecht (1981a) 

Storage tank ‘pops ’: Anon. (1988 LPB 82, p. 12); Kletz (1988 
LPB 83) 

Superheat: D.L. Katz (1972); R. King (1975a-c, 1976a,b, 

1977) ; R.W. King (1976); Porteous and Blander (1975); Reid 
(1976) 

Tanks, including storage tanks: Kletz (1971); Leiber (1980); 
HSE (1981SHW 2125); McDaniel (1986); Anon. (1987 LPB 
73, p. 9) 

Vaporizers: Wright (1961) 

Vent flashback: Burgoyne (1986a); WB. Howard (1992a,b) 
‘Blameless’or ‘physical’explosions, LNG/water explosions, 
rapid phase transition explosions, steam explosions 
Witte, Cox and Bouvier (1970); D.L. Katz and Sliepcevich 
(1971); Enger and Hartman (1972a); D.L. Katz (1972); 

W Nelson (1973a,b); Yang (1973); Opschoor (1974); Porteous 
and Blander (1975); Porteous and Reid (1976); Reid (1976, 

1978) ; AGA (1977/26); Dincer, Drake and Reid (1977); 
Briscoe and Vaughan (1978 SRD R131); Witte and Cox (1978); 
Hogan (1982); Fauske and Henry (1983); McRae (1983); 
Ogiso, Fujita and Uehara (1986); Ogiso,Takagi and 
Katagawa (1986); D.C. Bull and Strachan (1992); Fletcher 
and Theofanous (1994) 


Table 17.2 Selected references on detonation 


B. Lewis and Friauf (1930); C. Campbell, Littler and 
Whitworth (1932); Payman and Titman (1935); Zeldovich 
(1940); von Neumann (1942); Doring (1943); Brinkley and 
Kirkwood (1947,1949); Ubbelohde (1949,1953); Berets, 
Greene and Kistiakowsky (1950); G.I. Taylor (1950); Fay 
(1952,1962); R. Friedman (1953); Hirschfelder, Curtiss and 
Campbell (1953); Manson and Ferri (1953); Oppenheim 
(1953,1969); Chester (1954); Gerstein, Carlson and Hill 
(1954); Weir and Morrison (1954); Zeldovich, Kogarko and 
Semenov (1956); Chisnell (1957); Adams and Pack (1959); 
Brinkley and Lewis (1959); M. A. Cook, Pack and Gey 
(1959); D.H. Edwards, Williams and Breeze (1959); Eisen, 
Gross and Rivlin (1960); Zeldovitch and Kompaneets 
(1960); Brinkley and Kirkwood (1961); M.W. Evans and 
Ablow (1961); Gvozdeva (1961); Randall and Ginsburgh 
(1961); Sommers (1961); Wehner and Phillips (1962); 
Boddington (1963); Freiwald and Koch (1963); Litchfield, 
Hay and Forshey (1963); Oppenheim and Rosciszewski 
(1963); Spalding (1963b); H.G. Wagner (1963); Mitrovanov 
and Soloukhin (1964); Monger et al. (1964); Dabora, 
Nicholls and Morrison (1965); J.J. Lee, Lee and Shanfield 
(1965); Strehlow and Fernandes (1965); Urtiew and 
Oppenheim (1965,1966,1967,1968); Litchfield and Hay 
(1966 BM RI 6840,1967 BM RI 7061); de Malherb etal. 
(1966); Solouokhin (1966,1969); Strehlow, Crocker and 
Cusey (1967); Strehlow et al. (1967); Skinner et al. (1968); 
Strehlow (1968,1971); Zeldovich and Raiza (1968); Brinkley 
and Seely (1969); E.L. Lee and Hornig (1969); Lundstrom 
and Oppenheim (1969); Strehlow and Bffler (1969); 
Strehlow and Engle (1969);Trezek and Balcerzak (1969); 
Ubbelohde and Munday (1969); Zajac and Oppenheim 
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(1969); J.W. Meyer, Urtiew and Oppenheim (1970); Pawel 
etal. (1970); Nagaishi.Yoneda and Hikita (1971); Panton 
(1971); Vasilev, Gavrilenko and Topchian (1972); Carlson 
(1973); Whitham (1974); Fry and Nicholls (1975); J.H. Lee, 
Knystautas and Guirao (1975,1982); Sloan and Nettleton 

(1975.1978) ;Takai, Yoneda and Hikita (1975); D.C. Bull etal. 
(1976); Chiu and Lee (1976); Knystautas and Lee (1976); 

J.H. Lee and Ramamurtha (1976); Matsui and Lee 

(1976.1979) ; J.H.S. Lee (1977,1980); J.H. Lee and Matsui 
(1977); Benedick (1979); D.C. Bull, Elsworth and Hooper 
(1979a,b); D.H. Edwards, Thomas and Nettleton 
(1979,1983); Fickett and Davis (1979); Knystautas etal. 
(1979); Mader (1979); van der Molen and Nicholls (1979); 
Nicholls etal. (1979); R. Atkinson, Bull and Shuff (1980); 
Moen etal. (1980); Sibulkin (1980); Bowers etal. (1981); 
Edwards etal. (1981); Eidelman and Burcat (1981); Moen 
et al. (1981); Oran et al. (1981); Urtiew and Tarver (1981); 
Wolanski et al. (1981); Abouseif and Toong (1982a,b, 1986); 
D.C. Bull etal. (1982); Burcat and Hasson (1982); Dabora 
(1982); Damamme (1982); Eidelman (1982); Guirao etal. 
(1982); Knystautas, Lee and Guirao (1982); Logan and Bdzil 
(1982); Moen, Lee et al. (1982); Moen, Murray et al. (1982); 
Oran etal. (1982);Tarver (1982);Westbrook (1982a,b); 
Westbrook and Urtiew (1982); J.R. Bowers et al. (1983); 
Elsworth and Eyre (1984); Elsworth, Shuff and Ungut 
(1984); Kailasanath and Oran (1984); Ohyagi.Yoshihashi 
and Harigaya (1984); Vandermeiren and vanTiggelen 
(1984); Westbrook, Pitz and Urtiew (1984); Kailasanath etal. 
(1985); Kuznetsov and Kopotev (1985); Moen, Bjerketvedt 
etal. (1985); Moen,Ward etal. (1985); Presles etal. (1985); 
Moen, Sulmistras etal. (1986);Weinberg (1986); Huang 
ZhongWei and Xu Bin (1987); Nettleton (1987); Linstedt 
and Michels (1988); Zerillief Z. (1988); Bauer et al. (1989); 
Knystautas etal. (1989); Moen etal. (1989); G.O. Thomas, 
Sutton and Edwards (1991); Bourlioux and Majda (1992); 
He and Clavin (1992); Lefebvre etal. (1993); Moen (1993) 


17.1 Explosion 

17.1.1 The explosion process 

An explosion is a sudden and violent release of energy. The 
violence of the explosion depends on the rate at which 
energy is released. The energy stored in a car tyre, for 
example, is capable of causing an explosive burst, but it can 
be dissipated by gradual release. 

There are several kinds of energy which may be released 
in an explosion. Three basic types are (1) physical energy, 
(2) chemical energy and (3) nuclear energy. 

Physical energy may take such forms as pressure energy 
in gases, strain energy in metals or electrical energy. Exam¬ 
ples of the violent release of physical energy are the explo¬ 
sion of a vessel due to high gas pressure and the sudden 
rupture of avessel due to brittle fracture. Another important 
physical form is thermal energy. In particular, superheat in a 
liquid under pressure causes flashing off of the liquid if it is 
let down to atmospheric pressure. However, this is generally 
important in creating the conditions for an explosion rather 
than as a source of energy for the explosion itself. 

Chemical energy derives from a chemical reaction. 
Examples of the violent release of chemical energy are 
explosion of a vessel due to combustion of flammable gas, 
and explosion of a reactor caused by decomposition of 
reaction products in a runaway chemical reaction. 


Chemical explosions are either (1) uniform explosions or 
(2) propagating explosions. An explosion in a vessel tends 
to be a uniform explosion, while an explosion in a long pipe 
gives a propagating explosion. 

Nuclear energy is not considered here. In the present 
context, it is chemical explosions, and in particular explo¬ 
sions resulting from combustion of flammable gas, that are 
of prime interest. 

17.1.2 Deflagration and detonation 

Explosions from combustion of flammable gas are of two 
kinds: (1) deflagration and (2) detonation. 

In a deflagration the flammable mixture burns at sub¬ 
sonic speeds. For hydrocarbon-air mixtures the deflagra¬ 
tion velocity is typically of the order of 300 m/s. 

A detonation is quite different. In a detonation the flame 
front travels as a shock wave followed closely by a combus¬ 
tion wave which releases the energy to sustain the shock 
wave. At steady state the detonation front reaches a velocity 
equal to the velocity of sound in the hot products of combus¬ 
tion; this is much greater than the velocity of sound in the 
unburnt mixture. For hydrocarbon—air mixtures the deto¬ 
nation velocity is typically of the order of 2000-3000 m/s. 
For comparison the velocity of sound in air at 0°C is 
330 m/s. 

A detonation generates greater pressures and is more 
destructive than a deflagration. Whereas the peak pres¬ 
sure caused by the deflagration of a hydrocarbon-air mix- 
air mixture in a closed vessel is of the order of 8 bar, a 
detonation may give a peak pressure of the order of 20 bar. 

A deflagration may turn into a detonation, particularly 
when travelling down a long pipe. Where a transition from 
deflagration to detonation is occurring, the detonation 
velocity can temporarily exceed the steady-state detonation 
velocity in so-called ‘over driven’ condition. Deflagration 
and detonation are discussed further in Sections 17.2,17.5 
and 17.6. 


17.1.3 Process industries explosions: explosions vs fires 

Some data on 83 large loss fires/explosions over a 5-year 
period have been given by WH. Doyle (1969) , and were 
reproduced in Table 2.14. These data have been expressed 
by Kletz (1977k) in terms of the proportion of fires and of 
explosions of different types: 



Proportion (%) 

Explosions inside equipment 
because air got in 

11 

Explosions inside 
equipment because of 

explosive decomposition 

23 

Explosions outside 
equipment but inside buildings 

24 

Explosions in the open 

3 

Vessels bursting 

overheating or overpressure) 

7 

Fires 

32 

Total 

100 
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17.1.4 Process industries explosions: classification of 
explosions 

Explosions in the process industries include the following 
types: 

(1) physical explosions 

(a) mechanical failure of pressure system (within 
design envelope), 

(b) overpressure of pressure system, 

(c) underpressure of pressure system, 

(d) overtemperature of pressure system, 

(e) undertemperature of pressure system; 

(2) condensed phase explosions 

(a) high explosives, 

(b) ammonium nitrate, 

(c) organic peroxides, 

(d) sodium chlorate; 

(5) vapour cloud explosions (VCEs); 

(6) boiling liquid expanding vapour explosions 
(BLEVEs); 

(7) confined explosions with reaction 

(a) explosion involving vapour combustion, 

(b) reactor explosions, 

(c) other explosions involving liquid phase 
reactions; 

(8) vapour escapes into, and explosions in, buildings 
(VEEBs); 

(9) dust explosions. 

17.2 Detonation 

A particularly severe form of explosion occurs when an 
explosive substance detonates. Detonation can occur in 
liquid and solid explosives, in explosive gas mixtures and 
in vapour clouds. These aspects of detonation are con¬ 
sidered in Sections 17.3,17.6 and 17.28. 

Accounts of detonation, and of shock waves, are given in 
Supersonic Flow and Shock Waves (Courant and Friederichs, 
1948), Tfeoryo/DcfoM0fo«(ZeldovichandKompaneets, 1960), 
ShockWaves in Chemistry and Physics (G.N. Bradley, 1962), Gas 
Dynamics of Combustion (Shchelkin andTroshin, 1965), Shock 
Waves and Detonations in Gases (Soloukhin, 1966), Funda¬ 
mentals of Combustion (Strehlow, 1968a), Detonation (Fickett 
and Davis, 1979), Unconfined Vapour Cloud Explosions 
(Gugan, 1979 ),The Effects of Nuclear Weapons (Glasstone and 
Dolan, 1980), Explosive Shocks in Air (Kinney and Graham, 
1985), Principles of Combustion (Kuo, 1986), Combustion, 
Flames andExplosions of Gases (B. Lewis and vonElbe, 1987) 
and Gaseous Detonations (Nettleton, 1987). 

The origins of work on detonations are to be found in 
explosion disasters, notably in coal mines, and in the 
mathematical theory of shock waves. Studies by Riemann 
showed that even starting from smooth initial conditions 
the movement of compressible gases can lead to formation 
of discontinuities with a sudden rise in pressure and tem¬ 
perature. The thermodynamics of shock waves were inves¬ 
tigated by Hugoniot (1887-89). The extension to reactive 
systems then led to the detonation theory of Chapman 
(1899) and of Jouguet (1905). 

The Chapman-Jouguet (CJ) equations, however, were 
consistent with a number of final states. The choice of final 
state was made by these workers on the basis of a minimum 
velocity criterion. Their studies provided a working model 
which in certain features gave good agreement with 
experiment and held the field for some 40 years. 


A further advance came with the concept of the initiation 
of combustion by a shock wave travelling ahead of the 
reaction zone, proposed independently by Zeldovich 
(1940), von Neumann (1942) and Db’ring (1943). This theory 
takes into account the finite rate of the chemical reactions. 

Later work has shown, however, that the Zeldovitch-von 
Neumann-Doring (ZND) model is unstable for the case where 
the reactions are strongly temperature dependent. There still 
exists, therefore, no comprehensive theory of detonations. 
Another aspect of interest here is the transition from defla¬ 
gration to detonation, to which a particular contribution has 
been made by Shchelkin (Shchelkin andTroshin, 1965). 

Much work on detonation utilizes mixtures of fuel with 
oxygen rather than air. Hence, care should be exercised in 
reading the literature to check the oxidant to which a par¬ 
ticular statement or correlation is applicable. 

Selected references on detonation are given in Table 17.2, 
and on detonability characteristics in Table 17.3. 


17.2.1 Detonation waves 

In a detonation, a detonation wave passes through the 
explosive substance. This detonation wave has certain well- 
defined properties. These are now considered. 

The detonation wave may develop by a process of tran¬ 
sition. This transition may be illustrated by considering the 
combustion in a tube of a flammable gas-air mixture 
which is initially at constant pressure. If ignition occurs 
and energy is released at one end of the tube, the burnt 
gases expand. The deflagration front moves at a flame 
speed which is the sum of the burning velocity and the 
velocity of the burnt gases. If the flame speed is low 
enough, the combustion continues at essentially constant 
pressure, but if the flame speed is sufficiently high for 
momentum changes to exercise a significant effect, pres¬ 
sure disturbances are created. In this latter case the flame 
front accelerates and travels as a combustion wave pre¬ 
ceded by a shock wave. Further acceleration of the flame 
front may cause the deflagration to turn into a detonation. 
The detonation wave then travels with a velocity greater 
than that of sound in the unburnt gas. 


Table 17.3 Selected references on detonability 
characteristics 


Explosibility, flammability (see Tables 8.1,16.3 and 
17.62) 

Detonation limits and velocity (also cell size, 
critical tube diameter, critical initation energy) 

Hirschfelder, Curtiss and Campbell (1953); Ghormley 
(1958); Belles (1959); Shchelkin (1959); B. Lewis and von 
Elbe (1961); Burgess etal. (1968 BM RI7196); Benedick, 
Kennedy and Morosin (1970); Michels, Munday and 
Ubbelohde (1970); Benedick, Morosin and Kennedy (1971); 
Munday (1971b); Carlson (1973); Nolan (1973); Strehlow 
(1973b); J.W.Watts (1976); Borisov and Loban (1977); J.H. Lee 
and Matsui (1977); Nettleton (1978a, 1979,1980a,b, 1987); 
Moen et al. (1981); J.H.S. Lee, Knystautas and Guirao (1982); 
Bauer, Brochet and Presles (1984); Kailasanath and Oran 
(1984); Vandermeiren and vanTiggelen (1984); Knystautas 
etal. (1984); Bauer, Presles and Heuze (1986); Michels and 
Rashidi (1992); Rashidi and Michels (1992) 
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17.2.2 Unidimensional models 

Analysis of the behaviour of shock waves with and without 
reaction was for many years conducted mainly in terms of 
models in one dimension. Although the deficiencies of 
these unidimensional models are now recognized, they 
have been very successful in describing some important 
properties of the waves. 

17.2.3 Non-reactive shock wave Rankin-Hugoniot 
conditions 

It is convenient to consider first the unidimensional model 
of a planar shock wave in a non-reactive medium. Con¬ 
ventionally, the model is derived for a shock wave acting 
like a piston compressing the gases before the wave front. It 
is expressed first with a coordinate system moving with the 
wavefront as stated by Lewis and von Elbe (1987, p. 535). 
The basic equations are 


and from this equation and Equation 17.2.6 



The internal energy change Ae is 

Ae = e 2 - e\ [17.2.11] 

= c t (7' 2 -T 1 ) [17.2.12] 

where c v is the mean specific heat at constant volume. The 
particle velocityis w is 

w = ui- u 2 [17.2.13] 

and it may be written, utilizing Equations 17.2.1 and 17.2.10, 


G = — = — conservation of mass flux [17.2.1] 

pi + ^ conservation of momentum [17.2.2] 

hi + i = h 2 + ^ «2 conservation of energy [17.2.3] 




h = e+pv [17.2.4] 

pv = RT [17.2.5] 

»=l/p [17.2.6] 

where e is the specific internal energy of the gas, h is its 
specific enthalpy, p is the pressure, u is the velocity of the 
gas, v is its specific volume, T is its absolute temperature, p 
is its density and the subscripts 1 and 2 refer to the gas 
entering and leaving the shock wave, respectively. From 
Equations 17.2.1-17.2.4 


Another parameter of interest is the ‘impulse force’ k, 
which is a measure of the pressure exerted by the shock 
wave as it strikes an obstacle. The velocity heads pressure 
(kinetic energy) exerted is p 2 w 2 . Then, substituting for this 
term using Equations 17.2.6 and 17.2.14 and adding the 
static term [p 2 -pi, the net pressure i is 

k = ~(p2-pi) [17.2.15a] 


The impulse force should be distinguished from the 
impulse, i, which has units of force times the duration the 
force is applied, which also equals a change in momentum. 
The value of i from a blast wave is the area under the posi¬ 
tive overpressure portion of the blast wave. For a detonation 
wave, the positive pressure portion is well approximated as 
a triangle with a peak pressure^ and a plateau pressure p 3 : 


Ah = h 2 - hi = i (p 2 - pi) (vi + v 2 ) [17.2.7] 

Ae = e 2 -ei=^(pi+pi)(vi-Vi) [17.2.8] 

Equations 17.2.7 and 17.2.8 comprise the Rankine- 
Hugoniot (R-H) equation which replaces the integral 
/" 2 P dF of isentropic compression. It can be shown, taking 
a perfect gas for example, that for the same volume change, 
Equation 17.2.8 will lead to a larger Ae and therefore a higher 
temperature than isentropic compression provides. For a 
very small volume change the RH equation reduces to 
AE = — P AV which is valid for piston velocities up to the 
velocity of sound. When the piston velocity becomes on the 
order of magnitude of molecular velocities, the degradation 
of the kinetic energy of the piston into random molecular 
motion, that is, thermal energy, makes a significant addi¬ 
tional contribution to the increase of internal energy of the 
compressed gas. 

Other useful relations are, from Equations 17.2.1,17.2.2 
and 17.2.6, 


#BP(fe-ih) [17.2.15b] 

For the case where the coordinates of the system are with 
respect to a fixed frame of reference, rather than moving 
with the shock wave, the velocity of the shock wave is 

D=Vi + Ui [17.2.16] 

where D is the velocity of the shock wave and Vi is the velo¬ 
city of the gas entering the shock wave, both in the fixed 
frame of reference. But since for the unburned gas Vi = 0, 

D = ui [17.2.17] 

The two coordinate systems are discussed by Kuo (1986) 
and B. Lewis and von Elbe (1987, p. 535). 

From Equations 17.2.10 and 17.2.17 

D = Vi [17.2.18] 


[17 2 91 Values of the shock wave parameters for air calculated by 
1 '' J Becker (1922) are shown in Table 17.4. 
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For the case of detonation, in which a reaction occurs in 
the shock wave and the energy conservation equation is 
augmented by a heat input term, as discussed below, D 
becomes the detonation velocity. 

17.2.4 Rankin-Hugoniot curves for ideal gases 

The R-H equations show the relation between the initial 
and final states for a given change of enthalpy across 
the shock front. For an ideal gas with a constant ratio 
of specific heats 7, Equation 17.2.7 may be reformulated as 


Equation 17.2.19 (Nettleton) yields in the p—v plane a curve 
which is a rectangular hyperbole. Such a curve is known as 
an R—H curve. Various forms of the curve are shown in 
Figure 17.1. Figure 17.1(a) shows for comparison an R-H 
curve and a curve for an isentropic process pv y = constant. 
Equation 17.2.9 gives a line between a pair of points on the 
R—H curve which is known as a Rayleigh line. Figure 17.1(a) 
also shows such a line. 

On the assumption that there is no change in the mole¬ 
cular weight or ratio of specific heats of the gas, Equations 
17.2.1-17.2.3,17.2.5 and 17.2.6 yield 


—j (P2V2 - Pm) =^{p2-Pi){y 1 + v 2 ) 


[17.2.19] 


Table 17.4 Some shock wave parameters for 
air (after Becker, 1922) 


P2IP1 

Vi]v 2 D w 

(m/s) (m/s) 

T 2 shock 
wave( K) 

T 2 adiabatic 
compression (K) 

i/Pi 

2 

1.63 

452 

175 

336 

330 

1.63 

5 

2.84 

698 

452 

482 

426 

11.4 

10 

3.88 

978 

725 

705 

515 

34.9 

100 

7.06 

3020 

2590 

3860 

950 

699 


P2 (y-1) 

Pi 7 + 1 

p 2 _ (7 + 

Pi (y - l)Ma^ + 2 

T 2 [yMa* 2 - (7 -1)/2] [((7 - l)/2)Ma s 2 +1] 

IS- ((7 + l)/2)Ma| 

Mas = «i/«i [17.2.23] 

where a is the velocity of sound, Ma is the Mach number and 
the subscript s is the shock wave. 


[17.2.20] 

[17.2.21] 

[17.2.22] 



Figure 17.1 Rankin-Hugoniot diagram: (a) R-H curve, isentropic curve and Rayleigh line; (b) family of R-H curves 
for different fractions \ of completion of reaction; (c) detonation and deflagration regions of the R-H curve; and (d) the 
Chapman-Jouget state 
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A detailed discussion of the properties of the R-H curve 
is given by Kuo (1986). 

17.2.5 Reactive shock wave 

Moving on to modelling of a planar shock wave in a reactive 
medium, or detonation wave, the introduction of a heat 
input term q into Equation 17.2.7 gives 

h 2 -hi-q = ^{p 2 -p\)(vi + v 2 ) [47.2.24] 

where q is the energy addition per unit mass, or specific 
energy input, in the flow behind the shock front. As 
before, Equation 17.2.24 can be rewritten in the alternative 
form 

-P2V2) — 9 = 2^P 2 ~Pi)i v i+ v 2) [17.2.25] 

As shown in Figure 17.1(b), this equation gives a family of 
R—H curves for q = 0 and a family of R—H curves for vari¬ 
ous fractions of completion of the combustion reaction, f. 
At f = 1, the full value of q is released, so these curves also 
represent fractions of q as 

17.2.6 Chapman-Jouguet model 

The CJ model explains why detonations for a given fuel 
travel at a constant velocity. Equation 17.2.24 is the basis of 
the CJ model. Equation 17.2.25 is an alternative form for 
ideal gases. 

Figure 17.1(c) shows the regions of the R—H curve for a 
finite value of q. There are two broad regions. The first, 
where p 2 >pi and v 2 < fi, is the region of detonation with a 
compression wave and the second, where p 2 <p\ and 
v 2 < Vi, is the region of deflagration with a rarefaction wave. 
The combustion conditions along the curve pass from 
strong detonation, through weak detonation, then weak 
deflagration, to strong deflagration. 

The CJ equation has not one but a set of solutions. The 
solution to which its authors came, namely that the 
velocity of the shock front is the minimum consistent 
with the conservation laws, is embodied in the CJ hypo¬ 
thesis that 

a + u 2 = m 117.2.26; 

The CJ hypothesis may be explained by reference to 
Figure 17.1(d). The initial state of the gas is represented by 
the point 0.Three possible final states are shown at S,Wand 
J together with the lines OWS and OJ, the latter being the 
line of the tangent from 0. In the region of S the sum of the 
velocity of sound and that of the gas exceeds the velocity of 
the front ( a +u 2 > wj so that any rarefaction occurring in 
the flow behind the front tends to overtake and weaken it, 
and thus this state is unstable. The velocity of the front 
tends towards point J. In the region of W the sum of the 
velocity of sound and that of the gas is less than the velocity 
of the wave (a + u 2 < «j) so that any energy release occur¬ 
ring in the flow behind the front is not available to sustain 
it, and thus this state also is unstable. Again the velocity of 
the front tends towards point J. Hence J is the only stable 
state in the detonation region. It can also be shown that in 


the deflagration region the only stable state is D, where the 
line OD is that of the tangent from 0. Points J and D are 
known as the upper and lower CJ points. 

The angle a of the line OJ is given by tan a = (p 2 —p{)/ 
C V1—V2 ) and from Equation 17.2.9 

ui = vi^ v 1 (tan a) 1 / 2 [17.2.27] 

In this model the pressure p 2 , the velocity «i and the Mach 
number Mai are frequently referred to as the CJ pressure 
pc j, the CJ velocity u c j or D c j and the CJ Mach number 
Ma C j. 

More detailed accounts of the full CJ model equations are 
given by B. Lewis and von Elbe (1987, p. 538) and Kuo 
(1986). The latter also gives a calculation scheme for the 
determination of the CJ parameters. 

Work by von Neumann (1942) showed that at the instant 
when the front arrives there is a sharp, higher pressure, the 
von Neumann spike. 

The shock wave profile yielded by the CJ model is illus¬ 
trated in Figure 17.2. The shock wave travels as a sharp 
front. At the instant when the front arrives there occurs 
the von Neumann spike (point A). Very close to this in 
time is a lower pressure peak at the CJ plane (point B). 
Following this the pressure decays to a plateau value 
(point C). 

There are a number of relations which may he used to 
obtain approximate estimates of the CJ parameters. Avery 
simple equation is the Zeldovich approximation (Zeldovich 
and Kompaneets, 1960) relating the CJ pressure p 2 to the 
pressure p v of constant volume combustion: 

p c} « 2 p v [17.2.28] 

Another equation for the CJ pressure is that given by Weir 
and Morrison (1954): 

P M ^ 1+jjMag, 

Pi l + 7z 



Figure 17.2 Detonation front in a pipe: A, von Neumann 
spike; B, CJ peak; C, plateau pressure 
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The following approximate equations 
Nettleton (1987): 

„ ... frfa-i) 

Vi 

P2^nH 

pi~ n 

[2?(?!-l)] 1/2 


given by 

[17.2.30] 

[17.2.31] 

[17.2.32] 


These relations are applicable for Ma C j > 4, which for sys¬ 
tems of interest is generally the case. 

Some data of Strehlow on the specific heat input and 
ratio of specific heats y for stoichiometric mixtures of vari¬ 
ous fuels for use in CJ model calculations are given by 
W.E. Baker et al. (1983). The data for ethylene are a specific 
heat input of 3.834 MJ/kg of the mixture and a ratio of 
specific heats of 1.188. The CJ pressure, temperature and 
velocity quoted, obtained from relations given by these 
authors rather than from those quoted above, are 18.63 bar, 
2929 K and 1822 m/s, respectively. 

The behaviour of detonation waves from combustion of 
hydrocarbon gases has been investigated by Burgess et al. 
(1968 BM RI 7196) in experiments in pipes of up to 24 in. 
diameter. An illustration of a detonation in a stoichiometric 
acetylene-air mixture is described in detail. The von 
Neumann spike pressure is 34 atm with an ignition delay 
time of 10 -6 s. The decay from the von Neumann spike 
pressure to the CJ, or detonation, pressure of 19 atm occurs in 
about 10 -5 s, giving an impulse of (34+19)/2x 
14.7 x 10 -5 = 4 x 10 -3 psi. The von Neumann spike is 
described as toofastto detect by instrumentation, buttheCJ 
peak is detectable. The decay from the CJ pressure to the 
plateau pressure of 6.7 atm occurs in about 8.5 ms, giving an 
impulse of about 1.6 psi s. 

The experiments confirmed the Zeldovich approxima¬ 
tion. Also, the experimental plateau pressure p pi was about 
40% of the CJ pressure: 


Ppi ~ 0.4/> C j 


[17.2.33] 


Equations are given for the calculation of the plateau 
pressure. 

The CJ model has proved relatively successful in pre¬ 
dicting the detonation pressure, density and velocity in 
readily detonable mixtures in straight pipes. 

Comparisons based on experimental data obtained by 
B. Lewis and Friauf (1930) for mixtures of hydrogen, oxy¬ 
gen and other gases have been widely quoted. Other work 
includes that of Berets, Greene and Kistiakowsky (1950) 
and that of D.G. Edwards, Williams and Breeze (1959). For a 
2:1 mixture of hydrogen and oxygen the latter obtained the 
following values of the detonation parameters: 


Pressure (atm) 

Velocity (m/s) 

Observed CJ model 

Observed CJ model 

18.6 18.6 

2825 2853 

The observed pressure was 

i the average pressure 

20—80 ps. 



infinitely fast. Afurtheradvance camewiththe development 
of a model which takes account of the finite rate of reaction, 
and of heat release. The model was formulated indepen¬ 
dently by Zeldovitch(1940),vonNeumann(1942)andDoring 
(1943), and is known as the ZND model. In this model there is 
no reaction immediately behind the shock wave and there is 
an incubation period before the reaction begins. The frac¬ 
tional completion of the reaction is characterized by the 
parameter {, and there is therefore a family of R-H curves 
for values of { between 0 and 1 as in Figure 17.1(b). 

The ZND model is more realistic and provides a firmer 
basis for the development of unidimensional models. One 
particular use is in predicting the pressure—time profile of 
the detonation, including the von Neuman spike. Consider¬ 
able effort was expended from1950 to 1970 to test the validity 
of the ZND model. While ZND corrected values were most 
frequently below the CJ value, they were occasionally larger 
(Brochet, Manson; Roye and Struck 1963). However, the dis¬ 
crepancies between theory and experiment are less than 1%, 
which is adequate for engineering predictions. 

17.2.8 Taylor expansion wave 

TheproductgasesbehindtheCJplaneexpandisentropically 
and accelerate, so that there is a distribution of particle 
velocities. This distribution was investigated by G.I. Taylor 
(1950). The Taylor expansion wave theory provides predic¬ 
tions for the velocity decay behind the CJ wave front. 

17.2.9 Deflagration and detonation 

Deflagrations are defined by uja\ < 1; for detonations «i/ 
fli > 1. Some typical characteristics of deflagrations and 
detonations have been listed by R. Friedman (1953): 


Characteristic Deflagration 

Detonation 

ui/a! 

0.0001-0.03 

5-10 

«2/*t 

4-6 

0.4—0.7 


(acceleration) 

(deceleration) 

P2IP1 

0.98 

13-55 


(slight expansion) 

(compression) 

mti 

4-16 

8-21 


(heat addition) 

(heat addition) 

pdpi 

0.06-0.25 

1.7-2.6 


17.2.10 Detonation wave structure 

The account of detonation waves which has just been given is 
a simplified one. In particular, it does not take account of the 
unsteady and multidimensional features of such waves. In 
some cases, the detonation wave exhibits behaviour which 
results in pressures higher than those predicted by uni¬ 
dimensional theories. A case in point is spinning detonation 
fronts. In certain media the detonation front passing down a 
tube exhibits a stable spin. A spinning detonation front may 
be characterized in terms of the wavelength X of the spin, or 
ratio of the pitch p of the spin to the diameter d of the tube: 

k - % p/d [17.2.34] 

It has been shown by Fay (1952) that 


17.2.7 Zeldovich-von Neumann-Doring model . , , ^ 

A weakness of the CJ model is the assumption that the ^ = Sa/ l [17.2.35] 

chemical reaction which is the source of the heat release is ® 7o 
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where y a is the ratio of specific heats of the detonation pro¬ 
ducts and k n is a Bessel function derivative. The values of 
range between 1.2 and 1.4 and k n has the value 1.841. 
Equation 17.2.35 may be reformulated as 


p _ nd 




[17.2.36] 


where a Q is the velocity of sound in the burned gas. 

Experimental evidence indicates that in a spinning 
front, local pressure ratios occur which are in excess of 
those predicted by unidimensional theories. Pressure 
ratios as high as 160 have been obtained in some work. 

Another, related behaviour is that of galloping detona¬ 
tion fronts. These show regular oscillations in the velocity 
of the leading front. The phenomenon appears to be an 
extension of that of spin occurring in mixtures too close to 
the limit of detonability for a single transverse front to be 
supported. The regular peak velocities can exceed the CJ 
velocity by up to 35%, and the peak pressures shows a 
similar enhancement. The overdriven phase can persist 
over the relatively extended length of 0.1 m. 

In marginally detonable mixtures, detonations are mul¬ 
tidimensional. Several different types of front have been 
identified. They include equilibrium fronts, which have 
both constant time-averaged properties and a regularly 
recurring structure; other fronts which have the first but 
not the second of these features and transient fronts. 

The spinning detonation front is now regarded as a limit¬ 
ing form of multidimensional front. The leading front con- 
sistsofanumberofbulgesformedbyMachstems.Therearea 
number of transverse waves orthogonal to the leading front 
which start at the depressions bet ween the bulges and which 
reflect from each other and from the walls. There are reaction 
zones at the leading front and at the transverse waves. 


17.2.11 Detonation wave cells 

A gas detonation possesses a three-dimensional structure 
made up of ‘cells’, a regular pattern of diamond shapes. A 
good deal of work has been done to characterize these cells 
and to relate to them the principal features of detonations. 

Experimentally the cell structure may be studied from 
soot patterns formed on smoked foil on the inner surface of 
the tube. It is found that typically for a cell 
S « 0.6L C [17.2.37] 

where L c is the length of the cell and S its width. 

Related variables are the induction zone length Lj and the 
induction time tj. The induction zone length is the distance 
between the shock front and the reaction zone front and the 
induction time the interval between the passage of these 
two fronts, the relation between the two is 
Lj = t; Mas a 0 [17.2.38] 

where a 0 is the speed of sound in the mixture and Ma s the 
Mach number of the shock wave. 

With regard to the form of the relation between L c and Lj, 
work by Vasiliev, Gavrilenko and Topchian (1972), and oth¬ 
ers, on fuel-oxygen mixtures indicates that 
L c = 10«Lj 5 < n < 10 [17.2.39] 

in other words, 50Lj<L c <100Lj, where n is a constant. 
Nettleton (1987) describes the use of hydrocarbon-oxygen 
mixtures of the value 


and of hydrocarbon-air mixtures, except acetylene, of the 

L c ss 15Lj [17.2.41] 

The induction length Lj increases as tube diameter increases. 
Nikuradse (1933) has shown that in pipe explosions the 
distance to the establishment of fully developed turbulence 
is about 60 diameters. A similar proportionality to dia¬ 
meter might be expected for the induction length. The 
question is discussed by Lewis and von Elbe (1987). The 
evidence is that the proportionality holds in some cases but 
not in others. 

The cell width S is equivs dent to the spacing of the 
transverse waves. For this spacing, Nettleton (1987) gives 
the following estimates for mixtures at atmospheric pres¬ 
sure: 1-10 mm for near stoichiometric fuel-oxygen mix¬ 
tures; 10-100 mm for near stoichiometric fuel—air 
mixtures and 0.1-1.0 m for lean fuel—air mixtures. 

The cell length L c is related to the critical diameter d c for 
transmission of a detonation in a tube, and also across an 
abrupt expansion. Detonations do not develop in a tube of 
diameter less than d c , where d c depends on fuel composi¬ 
tion. In a classic study, Zeldovich, Kogarko and Semenov 
(1956) found that d c /Lj = constant for all the gases which 
they tested. 

Further work on this feature has been done by Gvozdeva 
(1961) and Mitrovanov and Soloukhin (1964). Using 
acetylene-oxygen mixtures, the latter obtained the 
relationships 

dc = 13S circular tubes [17.2.42a] 

d c = 10S planar channels [17.2.42b] 

Additional work includes that of D.H. Edwards, Thomas 
and Nettleton (1979), who have shown that the two results 
are equivalent and suggested that they are of general 
applicability to detonations. 

D.C. Bull et al. (1982) have studied the cell length, and the 
factors influencing it, for a number of gases. For stoichio¬ 
metric mixtures with air at atmospheric pressure they give 
the following values of L c : methane 310 mm, ethane 54 mm, 
propane 46 mm, w-butane 54 mm, acetylene 9.2 mm, eth¬ 
ylene 24 mm and hydrogen 10 mm. 

These authors also discuss the relevance of cell size. A 
planar detonation wave cannot propagate in a channel of 
width substantially smaller than the half-width of a cell. 
This feature is relevant to the quenching of detonations. 

In the transition from a planar to a spherical detonation 
wave at an abrupt expansion there is a critical number of 
cell widths in the planar front to sustain the detonation. For 
a circular tube this number is 13. 

Equation 17.2.42a is a statement of this fact. This feature 
also is relevant to quenching. 

There is a close connection between the cell size and the 
critical energy E c for initiation of a spherical detonation. 
Thus, Zeldovich, Kogarko and Semenov (1956) give the 
relation 

Ec oc A 3 [17.2.43] 

where A is an induction length, which is related to the 
cell size. 


Lc 50L; 


[17.2.40] 
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In the transition from deflagration to detonation there is 
some indication that the critical turbulent length scales 
may be of the same order as detonation cell lengths and that 
systems of different reactivity have a rank order similar to 
that for cell sizes. 

17.2.12 Detonability characteristics 

The detonability of fuel—air mixtures is characterized in 
terms of detonability limits and ignition sources. 

There has been some debate about the existence of deto¬ 
nation limits separate from flammability limits, as illus¬ 
trated in the following comment by Burgess et al. (1968 BM 
RI7196): A consensus has gradually developed that almost 
any gas mixture that is flammable is also detonable if 
initiated with a sufficiently strong ignition source’. How¬ 
ever, the existence of separate detonability limits is now 
recognized. 

Compilations of data on the flammability of fuels gen¬ 
erally do not include detonation limits, although a con¬ 
siderable amount of data are available scattered in the 
literature. 

There are certain features which cast a degree of uncer¬ 
tainty over detonation limits. One is the phenomenon of 
cool flames. Another is the existence of compounds which 
are capable of detonation in the absence of an oxidant. 
Further, a distinction is made in respect of detonation 
between confined and unconfined situations. Separate 
detonation limits are quoted for these two situations. 

For detonation limits for confined situations measure¬ 
ments are made in tubes. Accounts of such work include 
those of Michels, Munday and Ubbelohde (1970) and 
Borisov and Loban (1977). The measurement of detonation 
limits in unconfined gas clouds is more difficult. 

Features of such work have included the use of a con¬ 
tainment such as a balloon, a very high energy ignition 
source and oxygen-enriched mixtures, the results being 
extrapolated back to the composition of air. Work in this 
area has been described by Benedick, Kennedy and 
Morosin (1970) and D. C. Bull, Elsworth and Hooper (1979a,b). 

Table 17.5 from Nettleton (1980b) gives detonation limits 
for a number of fuels in air for confined and unconfined 
situations. The author’s original table gives limits for a 
large number of compounds and also the limits for mix¬ 
tures with oxygen. In general, the detonation limits of a 
particular fuel are narrower than its flammability limits, 


with the exception of compounds which can detonate in the 
absence of an oxidant. 

There are a number of compounds which can detonate in 
the absence of an oxidant. One such substance is gaseous 
acetylene, and extensive precautions are necessary when 
handling it industrially. Other self-decomposing chemicals 
include ethylene at pressures in excess of 7 MPa, hydrogen 
peroxide and ozone. Information on such compounds is 
given by Bretherick (1985). 

Nettleton suggests that any self-decomposing compound 
should be considered as possibly capable of detonation, but 
also adds that there is no well-established example of 
unconfined detonation of a self-decomposing substance. 

In view of the relative paucity of data on detonation 
limits, it is attractive to be able to derive them from the 
flammability limits. Some correlations have been given by 
Nettleton (1987, p. 77) for both confined and unconfined 
detonations. For a number of fuels, which include alkanes 
and alkenes, he gives the following relations for the lower 
and upper limits of detonation in a confined situation. 
Define <j> as the fuel-air ratio and the subscripts 1, st and u 
to denote the lower limit, stoichiometric and upper limit, 
respectively. For mixtures with air 


logio = 1-08 log 10 4>st - 0.84 [17.2.44] 

logio </> u = 1-06 log 10 4> s t + 0.64 [17.2.45] 

and for mixtures with oxygen 

log 10 </>i = 0.60 log 10 <p st - 0.78 [17.2.46] 

logic <t >u = 4.13 logic - 0.56 [17.2.47] 


The stoichiometric mixture is defined in terms of water 
and carbon dioxide as the products. For unconfined situa¬ 
tions there is a single correlation for mixtures with air or 
with oxygen. This is 

log 10 = 0.51 log 10 4> st - 0.81 [17.2.48] 

logio <£u = 1-17 logic 0st + 0.60 [17.2.49] 

These correlations do not apply to acetylene, for which 
the detonation limits are wider. Another approach to the 


Table 17.5 Some data on detonation limits in mixtures with air for confined and unconfined situations 
(after Nettleton, 1980b) (Courtesy of Fire Prevention Science and Technology) 


Compound Detonation limits (%) Flammability Emits (%) 


Confined tube Unconfined Lower Upper 



Lower 

Upper 

Lower 

Upper 



c 2 h 6 

2.87 

12.20 

4.0 

9.2 

3.0 

12.4 

C 3 H g 

2.57 

7.37 

3.0 

7.0 

2.1 

9.5 

C 4 Hio 

1.98 

6.18 

2.5 

5.2 

1.8 

8.4 

w-C g H lg 

1.45 

2.85 



0.95 


C2H4 

3.32 

14.70 



2.70 

36.0 

c 3 h 6 

3.55 

10.40 

3.5 

8.5 

2.4 

11.0 

C 2 H 2 

4.20 

50.0 



2.5 

80.0 

c 6 h 6 

1.60 

5.55 



1.3 

7.9 

c 2 h 5 oh 

5.1 

9.8 



3.3 

19.0 

h 2 

18.3 

58.9 



4.0 

75.0 
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Pipe diameter (m) 


Figure 17.3 Effect of pipe diameter and pressure on 
detonability of pure acetylene (after Sargent, 1957) 


prediction of detonation limits is in terms of homologous 
series. 

There is relatively little information available on the 
influence of initial pressure and initial temperature on 
detonation limits, in confined situations. The general effect 
of an increase in initial pressure is to widen the detonation 
limits, and the same applies to an increase in initial tem¬ 
perature. The widening is more marked for the upper limit. 

For acetylene, however, there exists a good deal of infor¬ 
mation on the effect of initial pressure. For this gas there is 
a pipe diameter below which only deflagration occurs, but 
above which detonation is possible, and this diameter is a 
function of the initial pressure. The correlation for this, 
which has been widely used in plant design, is shown in 
Figure 17.3. There is less information on the effect of initial 
temperature on acetylene, but at temperatures much in 
excess of 100°C there are likely to be present decomposition 
products which will affect the detonation limits. 

The influence of additives, whether inert gases such as 
nitrogen or chemically active additives such as halohydro- 
carbons, presents a complex picture. The general effect 
of a diluent such as nitrogen is to narrow the detonation 
limits, particularly the upper limit. The amount of diluent 
required to suppress detonation tends to be large, but falls 
off sharply for mixtures close to the detonation limits. With 
regard to chemically active additives, the action of such 
additives may be rather specific, and there is some evi¬ 
dence, for example, that an additive effective as a fire 
extinguishant may not suppress a detonation. 

The foregoing account has been concerned with the lim¬ 
its of detonation. However, whereas a mixture close to stoi¬ 
chiometric is, comparatively, readily detonable, one at the 
limits of detonation is only marginally detonable. 

17.2.13 Initiation of detonation waves 

The modes of initiation of a detonation differ somewhat 
from the modes of initiation of a deflagration. In both cases 
the process may be initiated by a suitable ignition source, 
but in the case of detonation other important mechanisms 


to be considered are initiation of a detonation by shock 
waves and acceleration of a deflagrative combustion into a 
detonation. It is also necessary to consider the distinction 
already made between confined and unconfined situations. 

A further relevant distinction is that between readily 
detonable and marginally detonable mixtures. It is by no 
means clear that the mechanisms of detonation in readily 
detonable media are those operating in marginally deton¬ 
able media. 

In addition, there is some evidence that detonation may 
be a stochastic process (Terao, 1977). 

In treating detonation by an ignition source, it is usual to 
speak of strong and weak sources. The terms are con¬ 
venient but often not well defined. Nettleton (1987) treats as 
strong those ignition sources which produce a shock or 
blast wave of velocity greater than the CJ velocity, asso¬ 
ciated particularly with marginally detonable media and 
with unconfined systems. These strong ignition sources 
can range in strength from <10 J from sparks up to some 
50 kj from high explosives. 

There is a considerable literature on the initiation of 
detonations in confined systems, but a large variety of 
methods have been used, and the interpretation of the 
findings is not straightforward. A greater degree of uni¬ 
formity is now obtained by the adoption of standard meth¬ 
ods, notably that of Zeldovitch and Kompaneets (1960). In 
this method a readily detonable mixture and a driving 
mixture are held in a tube separated by a diaphragm, which 
is removed seconds before detonation is initiated in the 
driving mixture. This technique allows the parameters of 
the driving mixture such as composition and initial pres¬ 
sure to be varied and the effect of the strength of the trig¬ 
gering wave to be investigated. The technique has been 
adapted to the study of unconfined detonations using an 
expansion nozzle. 

Dealing first with initiation by ignition sources, for con¬ 
fined systems the quantity of interest is the minimum 
ignition energy for detonation. In principle, this is meas¬ 
ured as a spark energy. However, data on this parameter are 
sparse and generally there is no alternative but to resort to 
the value of the regular minimum ignition energy (MIE), 
that for ignition of a flammable mixture. 

A large amount of work has been done on initiation of 
detonation in unconfined vapour clouds by ignition sources 
such as sparks and high explosives. Here, the ignition 
energy for detonation is generally expressed as the critical 
energy for a spherical detonation. The critical energy E c 
varies with the concentration of the fuel and has a mini¬ 
mum value E*. 

Work on spark initiation of detonation of unconfined 
clouds has shown that, as in similar work on ignition of 
flammable mixtures, the results obtained depend on fac¬ 
tors such as the spark gap width and efficiency and the rate 
of energy deposition. 

With regard to the strength of the explosive ignition 
source necessary to induce detonation, work by Bach, 
Knystautas and Lee (1971) has shown that for direct initia¬ 
tion of spherical detonation waves the rate of deposition of 
energy into the gas is critical. Reviewing this work, Strehlow 
(1973b) suggests that charge geometry is probably very 
important and that this factor may account for the apparent 
discrepancies in the quantities of explosive required to 
initiate detonation in the work which he quotes. 

In considering the initiation of detonation in an uncon¬ 
fined cloud, the mechanism by which this occurs is of some 
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relevance. It is now believed that when initiation occurs by a 
source with relatively low energy such as an electrical spark 
or 10 g of high explosive, the velocity of the initial blast wave 
decays below the CJ value before significant chemical reac¬ 
tion occurs in the flow, and there may be a propagation as 
quasi-steady-state velocity before acceleration sets in again 
and leads to detonation. For the size of charge quoted, the 
distance over which this overall processoccursisofthe order 
of 10 cm. For larger charges the distance is correspondingly 
greater, and may thus be appreciable. 

Critical energies for initiation of spherical detonation 
have been obtained by a number of workers. Reviewing 
these, Nettleton (1987) quotes in particular data given by 
Carlson (1973) for mixtures of fuel and oxygen. The fuel 
concentrations in the most readily detonable mixtures lie in 
the range 20-40% and the values of the critical energy E c 
obtained range over two orders of magnitude from <0.11 J 
for acetylene to 12.5 J for acetaldehyde. He comments that 
the chemical nature of the fuel strongly influences deton- 
ability but that the effect is more complex than one of sim¬ 
ple bond strength. 

The critical energy E c for detonation in a spherical cloud 
is related to the critical diameter d c for transmission of a 
detonation from a tube across an abrupt enlargement of 
area as described below. The determination of d c therefore 
provides a means of estimating E c . Matsui and Lee (1979) 
use the relation 
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[17.2.50] 


where a is the velocity of sound, p is the absolute pressure 
and u is the particle velocity and the subscript D denotes 
the detonation, or CJ, state. 

These authors also give a detonation hazard parameter 
Z> H , which they define as 


El (acetylene) 


[17.2.51] 


where E* is the minimum critical energy determined. 

Work on the critical energy for detonation of fuel-air 
mixtures using high explosives has been described by 
D.C. Bull, Elsworth and Hooper (1979a). Figure 17.4 shows 
their results for the initiation of detonation in mixtures of 
ethane and air using charges of tetryl. As the graph shows, 
the mass m of explosive required to give initiation increases 
rapidly as the ratio of fuel concentration to stoichiometric 
ratio (j) diverges from the value for minimum critical energy. 

A second mode of initiation of detonation in confined 
systems is by shock waves. This is amenable to study in 
shock tubes, and is thus a relatively well-defined situation 
and has been widely investigated. A shock wave entering a 
flammable mixture compresses and heats it, typically 
creating hot spots. The mechanisms involved in the transi¬ 
tion to detonation have been elucidated by Oppenheim and 
coworkers (Urtiew and Oppenheim, 1966,1968; Lundstrom 
and Oppenheim, 1969), who found that intense reaction 
occurs in the highly turbulent region between the leading 
shock front and the flame, in effect an ‘explosion within an 
explosion’, so that the compression fronts created overtake 
and merge with the leading front, forming a detonation 

The third mode of initiation is acceleration of deflagra¬ 
tion up to detonation, or ‘run up’. Consideration is given 



Figure 17.4 Energy for initiation of explosion in 
ethane-air mixtures (D.C. Bull, Elsworth and Hooper, 
1979a) (Courtesy of the Combustion Institute) 

first to the general phenomenon and then to run-up 
distances in confined and unconfined situations. 


17.2.14 Deflagration to detonation transition 

The deflagration to detonation transition (DDT) has been 
the subject of a considerable amount of work. 

Considering first conditions in confined systems, eluci¬ 
dation of the mechanisms of the DDT in tubes owes much to 
the work of Oppenheim and co-workers. Accounts include 
those of Laderman, Urtiew and Oppenheim (1963), Urtiew 
and Oppenheim (1965, 1966, 1967) and Lundstrom and 
Oppenheim (1969). 

If a flammable mixture is ignited at the open end of a pipe 
with the other end closed and if the pipe is of sufficiently 
small diameter for the flow of the unburned gas to be stabi¬ 
lized by viscous drag at the wall, the flame does not accel¬ 
erate. Outside this laminar steady-state regime, however, 
the propagation of the flame is always self-accelerating. 

The flame acceleration is caused by a number of factors. 
As the flame moves down the pipe, the turbulent boundary 
layer grows until it occupies the whole cross-section of the 
pipe, so that there is a growth in turbulence. As the flame 
elongates, there is an increase in flame area. The flame 
creates pressure waves. There is precompression and pre¬ 
heating of the unhurned gas ahead of the flame. Shock 
waves form and a turbulent flame brush is created. At some 
point, burnout of this turbulent flame brush occurs which 
intensifies the shock waves. These processes can be suffi¬ 
cient to cause the shock waves to coalesce and form a shock 
front and for this then to escalate into a detonation. 

Another mechanism which can cause the DDT is the 
impact of a shock wave on the accelerating flame. Studies 
have been conducted by Markstein (1957) on the effect of 
the impact of a shock wave meeting a laminar flame head- 
on. These showed that a rarefaction wave travelled back 
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through the unburned gas and a jet of unburned gas 
developed which penetrated deeply into the burned gas. 
The shear between the burned and unburned gas resulted 
in extreme turbulence and a massive increase in the burn¬ 
ing rate. Such an effect may occur when a shock wave tra¬ 
vels ahead of the flame and is then reflected back into it. 

The sequence of events in the DDT is summarized by Kuo 
(1986) as follows: (1) an accelerating laminar flame, with 
flame wrinkling and compression waves; (2) formation of a 
shock front; (3) creation of a turbulent flame brush; (4) onset 
of an explosion within an explosion, with transverse waves; 
(5) development of a spherical shock behind the shock 
front; (6) interactions of the transverse waves with the 
shock front, retonation wave and reaction zone and 
(7) establishment of a steady wave, leading to a shock- 
deflagration ensemble, or detonation. 

Kuo distinguishes four modes of transition, classified 
according to the location of the explosion within an explo¬ 
sion. Since generation of any particular pattern depends on 
minute inhomogeneities, the detailed sequence of events in 
the DDT is not reproducible. 


roughness may be greater. It is clear from experiments that 
the run-up distance increases as the diameter increases, 
but the precise form of the relationship obtained varies. 
Nettleton quotes three sets of results, one in pipes of diameter 
d < 102 mm showing X 6 tx d 0M , one in pipes of d < 51 mm 
showing X d ex d 0 5 and one withX d tx d 125 , but states that 
there is general agreement that for large pipesX d tx d. 

Another factor which affects the run-up distance is the 
surface roughness of the pipe. Essentially, any feature 
which promotes turbulence will tend to reduce the run-up 
distance. Such features include internal welds and bellows. 

There is relatively little information available on the 
influence on run-up distances of initial pressure, initial 
temperature or additives. However, evidence confirms that 
run-up distance decreases with increasing pressure with 
X d oc pm where —0.4 < m < —0.8 except for materials that 
decompose in the absence of oxygen. 

Attention is drawn by Nettleton to the fact that where 
pressure piling may occur, the probability of occurrence 
increases with the induction distance. 


17.2.15 Run-up distances in confined situations 

There is a good deal of information on run-up distances for 
particular mixtures and pipes, but a general correlation 
has been lacking. 

An attempt to remedy this deficiency has been made by 
Nettleton (1987, p. 119), in terms of the distance X s between 
the origin of the flame and the position at which shock is 
produced. He gives for this 

X s = p(y + l)X i [17.2.52] 


{y + 1 ) fgt 

gf =f(eS a ) 


[17.2.53] 

[17.2.54] 


where c is the speed of sound in the uncompressed gas, g f is 
the acceleration of the flame, S u is the maximum funda¬ 
mental burning velocity, Xf is the distance from the origin 
of the flame to its position at the time at which the shock 
first forms, X s is the distance from the origin to the position 
at which the shock is produced, /J is the ratio of the velocity 
of the flow just ahead of the flame to that of the flame, y is 
the ratio of specific heats of the reactants and c is the 
expansion ratio. The value used for /? is 0.9. 

Nettleton gives a number of graphs comparing predic¬ 
tions of the distance X s for shock formation with experi¬ 
mental values of the run-up distance X d . The curves given 
by the model appear to have the general shape of, but do not 
always coincide with, the experimental ones. Specifically, 
the model predicts correctly the marked increase in run-up 
distance near the detonation limits. 

It is suggested by Nettleton that if use is made of a run-up 
distance determined experimentally, this should be divided 
by a safety factor of 2 to allow for possible differences 
between the pipe used in the experiments and that on the 
plant. With regard to the factors which influence the run-up 
distance, one of the most important is pipe diameter. Here, 
there are a number of features which influence run-up but 
which vary with diameter. Thus, for example, in larger 
pipes the effect of viscous drag will be less but the surface 


17.2.16 Run-up distances in unconfined situations 
TUrning now to acceleration of deflagration to detonation in 
unconfined systems, it is appropriate at this juncture to 
point out that the occurrence of a detonation in a vapour 
cloud which is truly unconfined has been a matter of some 
debate. The nature of, and models for, vapour cloud explo¬ 
sions are discussed in Section 17.28. Here, consideration is 
confined to the process of flame acceleration in the cloud. 
This is closely linked to the question of the minimum size of 
cloud for a detonation to occur. 

A model for the direct formation of a spherical detona¬ 
tion has been given by J.H.S. Lee and Moen (1980). This is 
the shock wave amplified coherent energy release (SWA- 
CER). The energy from the ignition source is assumed to 
create a gradient of temperature and of active species such 
that as the wave expands, each successive shell has a dif¬ 
ferent induction time. Where there exists a suitable relation 
between this gradient and that of the decaying blast, the 
reaction zone couples to the leading front and a detonation 
wave forms. 

There are certain features of combustion in a vapour 
cloud in the open which have been identified as possibly 
capable of promoting flame acceleration. One is heat 
radiation from the burning part of the cloud. It has been 
shown experimentally that heat flux can be such as to heat 
up incombustible particles ahead of the flame front so that 
they become ignition sources. Another is inhomogeneities 
in the cloud. 

More importantly the interaction of flame fronts with 
plant structure is widely recognized as the key factor in 
flame acceleration to destructive deflagrations or detona¬ 
tions. This is treated in Section 17.2.19. It is also of interest 
to know whether there is a minimum diameter d min of a 
vapour cloud to support a detonation. Nettleton (1987) 
states that experience of deflagration in vapour clouds 
indicates that <4iin > 50 m. 

Moen, Donate et al. (1981), in work directed to the meas¬ 
urement of detonation limits, have studied the effect of tube 
diameter on the fuel concentration at the limit of deton- 
ability, which they take as the occurrence of single-head 
spin. They give results showing for ethylene—air mixtures 
the variation of the tube diameter for the transition from 
multiheaded detonation to single-head spin. They take the 




17/16 EXPLOSION 


cell length L c as proportional to the tube diameter, and 
express the correlation in terms of cell length also. 

They then equate the above diameter to the critical dia¬ 
meter d c and propose that this be taken as an indication of 
the minimum cloud diameter d min for detonation. Thus for 
the stoichiometric concentration of 6.5% ethylene, they 
obtain L c = 46 mm and, using Equations 17.2.37 and 
17.2.42a, S = 28 mm and d c = 359 mm = 0.36 m. Similarly 
for a 3% concentration they obtain L c = 0.9 m, S = 0.54 m 
and d c =7 m. 

17.2.17 Interaction between detonation and 
confinement 

The foregoing has given an account of the general behav¬ 
iour of detonations, essentially in tubes. It is now necessary 
to consider the interaction of a detonation wave with con¬ 
finements in general. 

There is no comprehensive theory for the interaction of a 
detonation wave with a confinement of arbitrary geometry. 
It is possible that a deterministic theory may be precluded 
by the stochastic properties already referred to. 

The pressure profiles occurring in confined detonations 
have a number of characteristic features. The pressures 
generated exhibit wide variations in magnitude and dura¬ 
tion. Anomalously high pressures can be generated by 
reinitiation of combustion in previously quenched regions 
of the gas. 

Treatments of the interaction between a detonation wave 
and its confinement are mainly for non-reactive shock 
waves. Two principal theoretical descriptions are the two- 
shock theory and the method based on the work of Chester 
(1954), Chisnell (1957) and Whitham (1974), known as 
Chester-Chisnell-Whitham (CCW) analysis. 

In general, theory in its current state is not able to predict 
peak local pressures or pressures on confining surfaces, 
but is helpful in understanding how interaction with con¬ 
finements can result in fronts with properties different 
from those predicted by unidimensional models. 

Models of a number of standard cases occurring with a 
confined detonation wave are treated by Nettleton (1987), 
using mainly CCW theory. These cases include (1) diffrac¬ 
tion of a shock wave at an isolated wall, (2) normal reflec¬ 
tion of a shock wave, (3) transmission of a detonation wave 
through an abrupt expansion and (4) propagation of a 
detonation through a bend or junction. 

For diffraction at an isolated wall, the situation con¬ 
sidered is a shock wave travelling parallel to a horizontal 
surface and then encountering another surface, or wall, at 
an angle 0 W to the horizontal. At some critical angle 0 cr 
there occurs transition to regular reflection. Three cases 
are treated: case 1, a wall at a negative angle with 0 W < 0; 
case 2, a wall at a positive angle less than the critical, hence 
0 < 0 W < 0 cn and case 3, a wall at a positive angle greater 
than critical but less than perpendicular, hence 
0 cr <0 w <9O°. 

Normal reflection of a detonation wave may occur in 
various configurations. These include reflection at a sharp 
90° bend and at the wall of a spherical vessel. Essentially, 
the situation is that the use of unidimensional theory tends 
to overpredict the pressures generated, but that multi¬ 
dimensional theory is difficult to apply. 

The transmission of a detonation wave through an 
abrupt expansion is a case of some importance. It con¬ 
stitutes a symmetrical, and therefore relatively simple, 
instance of a change from a planar front to a curved one and 


involves progression of the detonation from the pipe into a 
hemispherical detonation. It is therefore relevant to the 
critical diameter d c of the pipe for the establishment of a 
hemispherical detonation and thus to the quenching of 
detonations and to the critical energy for the initiation of 
hemispherical detonations. 

Nettleton gives a treatment of this case involving a com¬ 
bination of CCW analysis and Shchelkin (1959) instability 
theory. 

He also describes a number of theoretical approaches to 
the derivation of a relation between the critical diameter d c 
for quenching and the critical energy E c for spherical 
detonation. Sloan and Nettleton (1975) have studied the 
case of a planar non-reactive shock wave emerging from a 
nozzle into a large space. Within the decaying shock envel¬ 
ope there exists a truncated cone, the front edge of which is 
travelling at the velocity of the incident front and which 
does work on the surrounding gas. A similar situation per¬ 
tains for a detonation emerging from the nozzle. This case 
has been treated by Urtiew and Tarver (1981), who equate 
the work done with the critical energy. The work done Wis 


W = J puqA t dt [17.2.55] 

where A t is the area of truncation, p the pressure of the 
planar detonation, t c the time at which the heads of the 
expansion fan cross the axis of symmetry and u c j the gas 
velocity behind the CJ front. But 


L c (d c -d 0 )/2 


[17.2.56] 


where d is a diameter of the nozzle, Z> C j is the CJ velocity, L c 
is the length of a detonation cell, S is the width of the cell 
and the subscripts c and o denote critical and actual, 
respectively. Then, integrating Equation 17.2.55 using 
Equation 17.2.56 and noting that for spherical symmetry 
£ C =2W 
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Equation 17.2.57 gives a relationship between the critical 
diameter d c and the critical energy E c . It has been shown by 
Nettleton (1987) that the equation gives a good fit to the 
data for mixtures of hydrocarbons with air and with oxy¬ 
gen obtained by Matsui and Lee (1979). 

The propagation of a detonation through a bend is 
another case which is important but which has received 
rather less attention. There has been some success with 
CCW analysis of the early stages of the propagation of non¬ 
reactive shock waves round the bend, but rather less in the 
later stages as the process becomes more complicated due 
to interactions of wave systems set up at opposing walls. 

Where the shock wave is in a reactive medium, the 
situation is yet more complex. Experimental work on deto¬ 
nation entering bends by Edwards, Nettleton and 
coworkers (D.H. Edwards et al., 1981; D.H. Edwards, 
Thomas and Nettleton, 1983) has shown that steady deto¬ 
nation is re-established, but the distances at which re¬ 
establishment occurs and the locations of pressures higher 
than the CJ pressure depend on the configuration. 
Figure 17.5 by D.H. Edwards et al. (1981) shows a sketch 
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Figure 17.5 Sketch of a smoke foil record of re-establishment of detonation in a sharp bend (D. H. Edwards et al., 
1981). Steady front formed some diameters downstream of bend, following reflection of triple point, trajectory 0 1 0 2 0 3 at 
inner wait..., shock profile in reactive medium (Courtesy of Archivum Combustions) 


from this work of a smoke-foil record of the re-establishment 
of a detonation in a sharp bend. 

The patterns on, and damage to, the inner surface of such 
bends are characteristic, and thus in incident investigation 
may provide evidence of the occurrence of a detonation. 

In addition to the interaction of a detonation wave with a 
confining envelope, the detonation wave may also interact 
with an adjacent gaseous medium. Some situations of 
interest are those where the adjacent medium is (1) an inert 
gas, (2) a gas mixture of uniformly decreasing concentra¬ 
tion and (3) a gas mixture with concentration variations. 
The first case is relevant to any use of devices containing 
inert gas for the suppression of detonations. The other two 
cases have relevance to possible detonations in vapour 
clouds, which will in general have both concentration gra¬ 
dients and pockets of high and low concentration. Nettleton 
(1987) gives an account of some research findings which 
bear on these phenomena. 

In the absence of an adequate treatment of the interaction 
between the detonation wave and its confinement, the 
common practice of comparing predicted pressures and 
static strength is likely to continue. 


17.2.18 Damage caused by detonation to confinement 

The treatment of the damage caused by detonations differs 
depending on whether the detonation is confined or 
unconfined. The effects of explosions in the open, whether 
fast deflagrations or detonations, are considered in 
Sections 17.31-17.42. The account here is limited to con¬ 
fined detonations. 

The general effects of confined detonations are evident 
from the explosions which have occurred inside plant over 
the years. A review has been given by Strehlow and Baker 
(1976). Accounts of some of these incidents are given in 
Appendix 1. 

One classic case is the explosion at Whiting, Indiana, in 
1955 described by Jacobs et al. (1957) and Randall et al. 
(1957) (Case History A22). 

Generally, the amount of information which can be 
gleaned from an incident of detonation inside plant is lim¬ 
ited, because crucial items of data are missing. 

Two general points on damage caused by detonations 
may be noted. One is that the evidence indicates that the 
damage done by a dynamic loading is no greater than that 
which would be expected from the corresponding static 
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loading. The other is that ductility appears to have little 
effect on the dynamic bursting pressure. 

The present state of knowledge does not permit a fun¬ 
damental prediction of the damage to plant by a detonation 
occurring in it. As already described, there is no compre¬ 
hensive theory to support the reliable estimation of the 
pressures generated in complex plant. Further, under¬ 
standing of the mechanisms and modes of damage caused 
by confined detonations is imperfect. 

Some general guidance is provided by the work which 
has been done to determine the effective pressures gener¬ 
ated in a detonation. C. Campbell, Littler and Whitworth 
(1932) carried out experiments in which a copper disc at the 
end of a tube was sheared by a detonation in the tube. They 
found that the pressure at which failure occurred was close 
to the CJ pressure. In other words, it was less than the 
pressure spike and still less than the reflected pressure. 

Approaches to the prediction of the pressures occurring 
in a detonation have been described above. Then, given an 
estimate of this pressure, an attempt may be made to esti¬ 
mate the damage either from theoretical models or experi¬ 
mental correlations. 

It can be shown that the force exerted by a suddenly 
applied load of a duration much longer than the time con¬ 
stant of the object impacted can be up to twice that pro¬ 
duced by the corresponding load slowly applied. This 
provides a general theoretical indication of the force which 
a detonation may be expected to exert. 

The behaviour of the wall of a pipe as a detonation passes 
along it has been modelled in terms of the acceleration, 
velocity and deformation, both elastic and plastic, of the 
wall. Some simplified models are given by Nettleton (1987), 
drawing on work such as that of Randall and Ginsburgh 
(1961) and de Malherbe et al. (1966). 


17.2.19 Effect of congestion on explosions 

The effect of turbulence and turbulence-generating obsta¬ 
cles and structure can be a dominant factor in determining 
the flame speed and peak overpressure in a deflagration. 
Rasbash et al. (1976e) suggest that for indoor explosions, the 
turbulent flame speed is typically 1.5-5 times the laminar 
flame speed. For enclosures of a room or laboratory size, 
where turbulence is developed by furniture or similar 
objects, they suggest a factor of 1.5. For large enclosures 
where explosions propagate through large openings con¬ 
necting parts of the structure, a factor of 5 is likely and 
appropriate. With a high-pressure jet discharging indoors, 
the authors advise that a turbulence factor might be as high 
as 8 or 10. 

For outdoor or partially confined deflagrations, empiri¬ 
cal estimation methods developed by Baker et al. (1994, 
1997) and the multienergy method by van den Berg (1985) 
and van Wingerdon et al. (1989) apply a similar factor to 
account for congestion. These factors range over three 
orders of magnitude to predict the peak overpressure. Risk¬ 
planning studies usually incorporate a detailed determi¬ 
nation of the congestion and turbulence-inducing structure 
in a plant setting. These effects are discussed further in 
Section 17.28.4. 


17.3 Explosives 

Although the properties, manufacture, handling, storage 
and transport of high explosives are outside the scope of 


this book, it is necessary to make some brief mention 
of them. 

Accounts of explosives are given in Explosives, Their 
Anatomy and Destructiveness (C.S. Robinson, 1944), The 
Science of High Explosives (M. A. Cook, 1958), Prevention of 
and Protection against Accidental Explosion of Fuel and 
Other Hazardous Mixtures (E. Cohen, 1968) and Detonics of 
High Explosives (Johansson and Persson, 1970). 

Explosives are relevant to loss prevention in two areas in 
particular. These are (1) estimation of effects of explosions 
and (2) control of manufacture, handling, storage and 
transport of explosive materials. 

Many of the data available on explosions and their effects 
and many of the methods of estimating these effects relate 
to explosives. In particular, the methods developed for cal¬ 
culating the effects of explosions are based mainly on the 
high explosive trinitrotoluene (TNT). 

The hazard of explosives has long been recognized, and 
an approach has been developed for their control. Some 
aspects of this approach are applicable in the chemical 
industry also. 

Selected references on explosives are given in Table 17.6. 


Table 17.6 Selected references on explosives 


MoD, ESTC (n.d.); Upmann (1878); Berthelot (1892); 
Assheton (1930); Thomson (1941); Read (1942); T.L. Davis 
(1943); M. Meyer (1943); Lothrop and Handrick (1949); 

E. Fisher (1950,1953a, b); Jarrett (1952,1968); J. Taylor 
(1952); H.Watts (1954); Johansson, Persson and Selberg 
(1957); M.A. Cook (1958,1960); Home Office (1958/7, 
1972/3);Tomlinson (1958); US Army, Ordnance Corps (1958, 
1960); Federoff (1960); ICI (1961); Deb, Evans and Yoffe 
(1962); M.H. Friedman (1963a,b); Langefors and Kihlstrom 
(1963); Urbanski (1964-, 1983); Freytag (1965); Lenz 
(1965); D. Levine and Boyars (1965); D. Price and Wehner 
(1965); Fordham (1966,1980); Gould (1966); Ornellas, 
Carpenter and Gunn (1966); Department of the Army 
(1967); Ornellas (1967,1968); R.F. Fletcher (1968); Kamlet 
and Jacobs (1968); Napadensky (1968); Roylance (1968); 
WI. Taylor (1968); Wieberson et al. (1968); Dremin (1969); 
Fauquignon and Cheret (1969); Johansson and Persson 
(1970); Porzel (1972,1974,1980); R. Meyer (1973,1977); 
Woolfolk and Ablow (1973); Darling (1974); Filler (1974); 
Lovold (1974); Sablon (1976); R.L. Allen (1977a); Gregory 
(1977); C.M. Anderson and Pakulak (1978); HSE (1978b); 
Medard (1979); Dupont Co. (1980); Short et al. (1981); Kuo 
and Summerfeld (1983); Urbanski (1983); C.Tayler (1986a); 
Yinon and Zitrin (1987); Ijsselstein and van Steen (1988); 
J.H. Johnson et al. (1988); Doherty et al. (1989); Ho and Fong 
(1989); Ho, Fong and Hamshere (1989); E. Meyer (1989); de 
Yong and Campanella (1989); Meyers and Shanley (1990); 
Moran (1992); NFPA (1992 NFPA 495);Twisdale et al. (1992); 
P.A. Davies (1993); Kohler (1993) 

Initiation of explosives 

Bowden (1949,1953); Bowden, Stoke and Tudor (1947); 
Bowden etal. (1947); Bowden and Yoffe (1949,1952,1958); 
A.J.B. Robertson (1949); Kistiakowsky (1949); Bowden and 
Tabor (1954); Bowden and Thomas (1954); Johansson, 
Persson and Selberg (1957); Johansson, Lundborg and 
Sjolin (1962); Rindner (1968); Chaudhri (1976); Berger 
(1977);W.H. Andersen (1979); Bauer (1982); Bless (1982); 
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Erikson (1982); Nellis, Seaman and Graham (1982); Vantine, 
Chan and Erickson (1982);Vorthman (1982); Ho (1992); 

P.A. Davies (1993); Raha and Chhabra (1993) 

Sympathetic detonation: van Dolah (1966 BM RI6903) 
Explosives testing (see Table 8.1) 

Fireballs from explosives: Jarrett (1952); Gayle and 
Bransford (1965); Rakackzy (1975); Stull (1977); Kovar et al. 
(1982); W.E. Baker et al. (1983); Gilbert, Lees and Scffly 
(1994e) 

Fireballs from nuclear weapons: Glasstone(1962);TellerefZ. 
(1968); Ramsey (1983) 

Munitions, weapons 

MoD, ESTC (n.d); Rohne (1895); Gurney (1943,1944,1946); 
Christopherson (1946); Mott (1947); Dunn and Stern (1952); 
E. Fisher (1953); Tomlinson (1958); G.I. Taylor (1963a,b); 
Lenz (1965); Pollard and Arnold (1966); Department of the 
Army (1967); I.G. Henry (1967); Held (1968,1979,1990, 
1991); Roylance (1968); Draper and Watson (1970); Filler 
(1974); Karpp and Predebon (1974); SIPRI (1978); Kamlet 
and Finger (1979); G.E. Jones, Kennedy and Bertholf (1980); 
Grady (1982a,b); C.E. Anderson, Predebon and Karpp 
(1985); E. Hirsch (1986); Massa (1987); McCleskey 
(1988a—c, 1992); Burman (1989); Helwig, Klee and Hubner 
(1989); Jagusch (1989); Naz (1989) 


17.3.1 Explosions of high explosives 

In an explosion caused by a high explosive the rate of 
energy release is particularly rapid, and the explosion has 
high shattering power, or ‘brisance’. 

A high explosive produces, therefore, a quite distinct 
type of explosion. The shock wave from such an explosion 
has a very short duration time. Differences in the types of 
explosion are a weakness in the application of correlations 
based on explosions of high explosives to other explosion 
situations. 

Nevertheless, theTNTequivalent model is widely used in 
explosion calculations for estimating the effects of explo¬ 
sion on process plant. 


17.3.2 Scaling laws 

The effects of the explosion of a high explosive are gen¬ 
erally determined using a scaling law. A principal para¬ 
meter which characterizes an explosion is its overpressure. 
The overpressure generated by the explosion of a explosive 
is discussed in detail in Section 17.25. It is shown there that 
overpressure p° is a function of scaled distance z. 

P° =m [17.3.1] 





where p° is the peak overpressure, r is the distance, W is 
the mass of explosive and z is the scaled distance. 
Equation 17.3.2 implies that for a given overpressure the 
distance is related to the mass of explosive by a cube root law: 

r oc W V 3 [17.3.3] 


Damage done by the explosion of an explosive has been 
correlated mainly by insurance companies in terms of 
damage circles within which defined degrees of damage 
occur. The radius R of such a damage circle is related to the 
mass Wof explosive approximately by a cube root law: 

R tx W 1 ! 3 |17.3.4] 

Another effect of an explosion of a high explosive is the 
formation of a crater. A cube root law applies to the relation 
between the radius r c of the crater and the mass W of 
explosive: 

r c oc W 1 ' 3 [.17.3.5] 

In the storage of explosives the limit of distance between 
one store of explosive and the next is set by the risk of 
sympathetic detonation. A mean detonation distance r 50 
can be defined at which there is a 50% chance of sympa¬ 
thetic detonation occurring. It is found that this mean 
detonation distance 750 is also related to the mass W of 
explosive by a cube root law: 

r 5 o oc W 1/3 (17.3.6] 

17.3.3 Housing damage 

A scaling relation for blast damage to housing has been 
given by Jarrett (1968): 



where R is the distance (ft), W the mass of explosive (lb) and 
k a constant. The constant k defines the degree of damage 
which may be expected to the average British dwelling 
house. It is based on the analysis of damage in 24 well- 
documented explosions and in wartime bombing. The fol¬ 
lowing categories of damage are defined: 




k 

A 

Almost complete demolition 

9.5 

B 

50-75% external brickwork destroyed or 
rendered unsafe and requiring demolition 

14 

Cb 

Houses uninhabitable - partial or total 
collapse of roof, partial demolition of one or 
two external walls, severe damage to Load- 
bearing partitions requiring replacement 

24 

Ca 

Not exceeding minor structural damage, and 
partitions and joinery wrenched from 
fittings 

70 

D 

Remaining inhabitable after repair - some 
damage to ceilings and tiling, more than 
10% window glass broken 

140 


For damage to process buildings, the Center for Chemical 
Process Safety (CCPS) of the American Institute of 
Chemical Engineers (AIChE) defines the following levels 
(1996). 
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Level 

Building Damage 

1 Minor 

Onset of visible damage. 

Repairs are only needed for cosmetic 
reasons. Building is reusable 
following an explosion 

2 A Moderate 

Localized building damage. 

Building performs function and can 
be used: however, major repairs are 
required to restore integrity of 
structural envelope. Total cost of 
repairs is moderate 

2B Moderate 

Widespread building damage. 

Building cannot be used until major 
repairs are completed. Total cost 
of repairs is significant, approaching 
replacement cost of building 

3 Major 

Building has lost structural integrity 
and may collapse due to environmental 
conditions (i.e. wind, snow or rain). 

Total cost of repairs exceeds replacement 
cost of building 

4 Collapse 

Building fails completely. 

Repair is not feasible 


17.3.4 Quantity-distance relations 

In the handling of explosives separation distances are 
governed by quantity-distance relations. An account of 
the quantity-distance relations used in Britain has been 
given by Jarrett (1968). 

The principal explosion effects of the different cat¬ 
egories of explosive are: 

Category X: missiles and slight blast effects, projected 
ammunition; 

Category Y: radiant heat; 

Category Z: missiles and major blast effects, cratering, 
earth shock; 

Category ZZ: major blast effects, cratering, earth shock. 


sympathetic detonation. For this case Jarrett gives the 
relation 

R = 12JF 1/3 [17.3.9] 

where R is the distance (ft) and W the mass of explosive (lb). 

For intraline and public buildings distances for category 
Y explosive the basis of separation is heat radiation. For 
these cases the relations given by Jarrett are, respectively, 

R = m 1 ! 3 [17.3.10] 

and 

R = 3.2JF 1 / 2 , W < 10,000 [17.3.11a] 

R = 16JF 1 / 3 , W > 10,000 [17.3.11b] 

For intraline and public building distances for category Z 
explosive the basis of separation is blast effects. The rele¬ 
vant relation is Equation 17.3.7. 

17.3.5 Sympathetic detonation 

Explosives are normally stored in separate stacks with a 
separation distance between each stack so as to reduce the 
probability of detonation of one stack as a result of detona¬ 
tion of an adjacent one. The effect is known as sympathetic 
detonation. 

A model for the propagation of an explosion by sympa¬ 
thetic detonation has been described by Masso and Rudd 
(1968). The blast effect B is assumed to be given by the 
relation 



where B is the blast effect, r is the distance, Wis the mass of 
explosive, k is a constant and n x and n 2 are indices. The 
probability p of further detonation of the pressure- 
sensitive material is taken as 


The quantity-distance relations are used for (1) storage 
distances, (2) process building distances, and (3) public 
building and traffic distances. The process building dis¬ 
tances are also known as intraline distances. 

The storage of explosives involves the hazard of explo¬ 
sion of the stored material. Explosives tend to be sensitive 
to shock. They also tend to deteriorate in storage. In par¬ 
ticular, there is the hazard of sympathetic detonation of 
one store of explosives by another adjacent store. 

Although sympathetic detonation is important, it is not 
the only explosion effect which has to be taken into 
account. Other effects include flame spread, heat radiation, 
missiles and blast. Jarrett quotes a number of quantity- 
distance relationships of the general form 


p = B/B* [17.3.13] 

where B* is the blast effect required for certainty of deto- 
nation.Then, a general model for propagation of detonation 


p = 0, p'<T 
p = pf, T<p'< 1 
p = 1, otherwise 





[17.3.14a] 

[17.3.14b] 

[17.3.14c] 


[17.3.15] 




kW” 


[17.3.8] 


where R is the distance, W is the mass of explosive, k is 
a constant and n is an index. The index n lies in the range 


For storage distances for category Z explosive in shells 
filled with RDX/TNT explosive the basis of separation is 


where T is the threshold of p' below which no propagation 
occurs. 

The simplest model described by the authors consists of 
a linear array of explosive components in n sites. The 
probability that the detonation reaches the Jth site but does 
not continue to the (j + l)th site is as follows. The compo¬ 
nent of the initiating site detonates with certainty. The 
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probabilities of detonation of components in the second, 

third and/th sites ar ep,p 2 . p’~ 1 . If the component at the 

;'th site has detonated, the probability that the component at 
the (j + l)th site does not detonate is This yields the 

following relation for P(j), the probability that j sites are 
involved in the detonation chain: 

P(f) = (1 - P)P’-\ -l $i < (n-l) [17.3.16a] 

P(j)=P j -\ j = n [17.3.16b] 

Various more complex models are also given by these 
authors. 

17.3.6 Controls on explosives 

The explosives industry has no choice but to exercise the 
most stringent controls to prevent explosions. Some of the 
basic principles which are applied in the management of 
hazards in the industry have been described by R.L. Allen 
(1977a). There is an emphasis on formal systems and pro¬ 
cedures. Defects in the management system include: 

A defective management hierarchy... Inadequate 
establishments... Separation of responsibilities from 
authority, and inadequate delegation arrangements.... 
Inadequate design specifications or failures to meet or to 
sustainspecificationsforplants.materialsandequipments. 

Inadequate operating procedures and standing 
orders_Defective cataloguing and marking of equip¬ 

ment stores and spares.... 

Failure to separate the inspection function from the 
production function.... 

Poor inspection arrangements and inadequate powers 
of inspectorates.... 

Production requirements being permitted to over-ride 
safety needs.... 

The measures necessary include: 

The philosophy for risk management must accord with 
the principle that, in spite of all precautions, accidents are 
inevitable. Hence the effects of a maximum credible 
accidents at one location must be constrained to avoid 
escalating consequences at neighbouring locations.... 
Siting of plants and processes must be satisfactory in 
relation to the maximum credible accident_Inspector¬ 

ates must have delegated authority — without reference 
to higher management echelons - to shut down hazard¬ 
ous operations following any failure pending thorough 
evaluation.... 

No repairs or modifications to hazardous plants must 
be authorized unless all materials and methods employed 
comply with stated specifications— Components cru¬ 
cial for safety must be designed so that malassembly 
during production or after maintenance and inspection is 
not possible.... 

All faults, accidents and significant incidents must be 
recorded and fed back without fail or delay to the 
Inspectorate.... 

A fuller checklist is given by Allen. 

R.L. Allen (1977b) also discusses the relevance of these 
principles to the chemical industry, and to Flixborough in 
particular. He suggests that the probability of such acci¬ 
dents can be greatly reduced if the chemical industry uses 
these well-proved methods. The principles are essentially 
those described elsewhere in this book. 


In addition to these basic management aspects, the spe¬ 
cial precautions necessary in the manufacture and storage 
of explosives are instructive in relation to process plant 
hazards. Here, some basic principles are (1) minimization of 
inventory, (2) minimization of exposure, (3) use of blast 
walls and (4) separation by distance. 

In explosives manufacture and storage the scale of the 
potential accident is reduced by minimizing the inventory 
of material and the number of people. The application of 
these concepts to process plant is discussed in Chapters 11 
and 20. 

Much use is made in the explosives industry of blast 
walls, cubicles and barricades. An account of their design 
has been given by Callahan (1968). 

The only completely reliable protection with explosives, 
however, is distance. It is normal practice, therefore, to 
allow generous distances in both manufacture and storage. 
The principle of separation is applicable to process plant 
also, as described in Chapter 10, although it should be 
added that it does not necessarily follow that it is economi¬ 
cally justifiable to require separation to be such as to give 
absolute protection. 

There is much to learn from the explosives industry in 
managing the hazards on process plant, but, as always, 
methods developed for a similar, but not identical, problem 
need to be adapted to the needs of the process industries. 


17.4 Explosion Energy 

As already stated, an explosion is a sudden and violent 
release of energy. Discussions of explosion energy are given 
in the High Pressure Safety Code (B.C. Cox and Saville, 1975) 
and by Kinney (1962), Kinney and Graham (1985), Burgess 
et al. (1968 BM RI 7196), Eisenberg, Lynch and Breeding 
(1975), W.E. Baker ef al. (1983), Crowl (1991,1992a,c) and the 
(1994/15). 

The energy released in an explosion on a process plant is 
normally one of the following: (1) chemical energy (2) fluid 
expansion energy and/or (3) vessel strain energy. 

The distribution of energy between the blast wave and 
missiles and any crater formation needs also to be con¬ 
sidered as does the effect of the height above ground at 
which the explosion occurs. 


17.4.1 Chemical energy 

In considering the energy release in a chemical explosion, it 
is convenient to consider first condensed phase explosives, 
or high explosives, and then flammable gases and liquids. 

The energy release in a chemical explosion is a function 
of the nature and state of the reactants and of the products. 
In general, the explosion products are not well defined. As 
the gas mixture cools, the chemical equilibrium shifts and 
the transient products disappear. 

A condensed phase explosive contains its own oxygen so 
that it can explode even in the absence of air. It is conven¬ 
tional to assume certain nominal products of explosion. 
Explosives may be classified on the basis of nominal oxy¬ 
gen distribution. An oxygen-rich explosive has excess 
oxygen and the nominal products contain molecular oxy¬ 
gen and incombustible gases such as C0 2 and H 2 0. An 
oxygen deficient explosive gives combustible gases such as 
CO and H 2 among the nominal products. The actual gases 
generated by explosives contain a mixture of all these 
products. 
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A flammable organic gas or vapour which explodes in 
excess air is normally assumed to yield incombustible 
gases such as C0 2 and H 2 0. The same applies to a con¬ 
densed phase explosive which undergoes combustion in 
excess air. Accurate distribution of products can be pre¬ 
dicted using chemical equilibrium programs such as the 
one developed for rocket exhausts by NASA (McBride and 
Gordon, 1991). 

The quantities which characterize a high explosive are 
discussed by Kinney and Graham (1985). Those of interest 
here are (1) the energy of explosion, (2) the heat of explosion 
and (3) the heat of combustion. 

The energy in an explosion is of two different kinds: 
(1) thermal energy and (2) work energy. That part of the 
energy transferred due to temperature difference is termed 
the heat of explosion. 

The differences between the heat of explosion, the energy 
of explosion and the heat of combustion may be explained 
by reference to the methods by which they are measured for 
an explosive, as described by Kinney and Graham.The heat 
of combustion is determined by causing the substance to 
burn in air in a bomb calorimeter and measuring the heat 
evolved. 

The heat of explosion is determined in a similar manner, 
but using inert gas instead of air. The substance is placed in 
a bomb calorimeter, air is replaced with inert gas, the sub¬ 
stance is initiated and the heat evolved is measured. 

Measurement of the energy of explosion is carried out by 
encasing the substance in a heavy sheath of metallic gold. 
The explosion flings the gold casing against the bomb wall, 
where it gives up its kinetic energy as heat, so that in this 
case the heat measured now includes this energy as well as 
that transferred by temperature difference. 

The relative magnitude of these quantities may be illus¬ 
trated by considering the values for TNT as given by 
Kinney and Graham (1985): heat of combustion = 15,132 J/g, 
energy of explosion = 4850J/g, heat of explosion = 2710J/g. 

The heat of explosion corresponds to the internal energy 
change for the explosion A E. In order to estimate the effects 
of an explosion it is necessary to know the energy of 
explosion. This is the work energy, or work. This work is 
done by the expansion of the gas and is given by 

W - PdV [17.4.1] 

where P is the absolute pressure, V is the volume and W is 
the work of expansion. This is the energy transferred in the 
explosion as work done on the blast wave and missiles. The 
integral of Equation 17.4.1 is difficult to evaluate, and it is 
more convenient to work directly in terms of the initial and 
final values of the thermodynamic properties. The quan¬ 
tity generally used is the Helmholtz free energy change AA: 

- £ P AV ~ AA 117.4.2] 

Treatments of the relationship between the work and the 
Helmholtz free energy change are given by Kiefer, Kinney 
and Stuart (1954) and W.J. Moore (1962). 

The actual energy released in an explosion tends to be 
somewhat less than the Helmholtz free energy change. One 
reason is that the process is not reversible. Another is that 
the products of combustion of the explosion are usually at a 
temperature higher than ambient. 


Often, data are not available on the Helmholtz free ener¬ 
gy change for a compound, but are available for the Gibbs 
free energy change. For many substances, including 
hydrocarbons, the difference is not great and the error 
involved in using the Gibbs instead of the Helmholtz free 
energy is small. 

The following thermodynamic relations, which apply 
to a reversible process at constant temperature and pres¬ 
sure, are useful in explosion calculations. For absolute 
quantities 


H = E + PV 

[17.4.3] 

A = E — TS 

[17.4.4] 

For isothermal change in a system 

AH = AE + A(PV) 

[17.4.5] 

AA = AE - TAS 

[17.4.6] 

AF = AH- TAS 

[17.4.7] 


where AA is the Helmholtz free energy change, A E is the 
internal energy change, AFis the Gibbs free energy change, 
AH is the enthalpy change, AS is the entropy change and 
T is the absolute temperature. 

The energy of explosion is usually calculated at standard 
conditions of 25°C and atmospheric pressure. 

The internal energy change for the explosion reaction is 

A E = [Apfj - [AEf) [17.4.8] 

where the superscript o denotes the standard state and the 
subscript / the formation value, p the products and r the 
reactants. The enthalpy change for the reaction is 

AH = (A H^j - [AHfj [17.4.9] 

The entropy change for the explosion reaction, or entropy 
of explosion, is 

AS = (S) p - (S) r [17.4.10] 

The Helmholtz free energy change AA for the explosion 
reaction is given by Equation 17.4.6, or alternatively by 

AA = (Ai4/) p — (AA/) r [17.4.11] 

For the entropy and Helmholtz free energy per mole of the 
reactants and products, assuming ideal gases, 

S = S° — R In p [17.4.12] 

A = A 0 + RT In p [17.4.13] 

where R is the universal gas constant. For liquids and 
solids, the second term on the right-hand side of Equations 
17.4.12 and 17.4.13 is negligible. 

The Helmholtz free energy change may be calculated 
from thermodynamic data in several ways. One is to calcu¬ 
late A E from Equation 17.4.8 and AS from Equation 17.4.10 
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using Equation 17.4.12 to obtain S, and then to calculate AA 
from Equation 17.4.6. Alternatively, A A may be calculated 
from Equation 17.4.11, using Equation 17.4.13 to obtain AA f . 

The entropy term TAS is significant where there is a 
large difference between the number of moles of the reac¬ 
tants and of the products. This is the case for condensed 
phase explosives, but usually not for flammable gases and 
vapours. Where the change in the number of moles is not 
significant 

AA^AE [17.4.14] 

the enthalpy change may also be written as 

AH = AE + AnRT {17.4.15] 

where An is the change in the number of moles. Where the 
change in the number of moles is not significant 

AH « AE [17.4.16] 

Thus, for explosions of flammable gases and vapours it is 
often possible to make certain approximations which sim¬ 
plify the task of obtaining the necessary data on thermo¬ 
dynamic properties. 

For the explosive combustion of hydrocarbon clouds the 
method generally used is to determine the enthalpy change 
AH, which is usually obtained from the heat of combustion 
Aff c , and to apply to this an ‘explosion efficiency’, or yield 
factor, as discussed below. 

The enthalpy change of the reaction AH may be calcu¬ 
lated from the standard enthalpies of formation using 
Equation 17.4.9. Alternatively, it may be obtained from the 
heat of combustion. 

If the heat of combustion is that of a gas and if the final 
water product is also gaseous, then the enthalpy change for 
the reaction is equal to the heat of combustion. Generally, 
however, the heat of combustion is given for a final water 
product which is a liquid. In this case the standard heat of 
combustion with liquid water product Aff° lw should be 
corrected by a term which allows for the latent heat of 
vaporization of water Aff vw , to give the standard heat of 
combustion with water product as vapour Aff° vw . 

Aff° vw = A/i” lw + « w Aff vw [17.4.17] 

where Aff cvw is the heat of combustion with the final water 
product as vapour, Aff clw is the heat of combustion with the 
final water product as liquid, A H vw is the latent heat of 
vaporization of water and n w is the number of moles of 
water. This correction is usually of the order of 5—10% for 
hydrocarbons. 

Sometimes the heat of combustion is given for a liquid 
rather than a gas. In this case the standard heat of com¬ 
bustion for a liquid A H° { should be corrected by a term 
which allows for the latent heat of vaporization of the liquid 
A H v to give the standard heat of combustion for the vapour: 

A H° y = AH° x - AH w [17.4.18] 

where A H cl is the heat of combustion with initial reactant as 
liquid, Aflcv the heat of combustion with initial reactant as 
vapour and AH V the latent heat of vaporization. 

As an illustration of the calculation of the energy of 
explosion of an explosive, consider the calculation of the 


energy of explosion of TNT in the absence of air. Following 
Kinney (1962) the explosion reaction is assumed to be 

C 7 H 5 0 6 N 3 -4 C + 6CO + 2.5H 2 + 1.5N 2 [17.4.19] 

The thermodynamic data are 



(kcal/mol) 

S° (cal/mol K) 

C 7 H 5 06N 3 

-13.0 

65 

c 

0 

1.361 

CO 

-26.722 

47.301 

h 2 

0 

31.211 

n 2 

0 

45.767 


The molecular weight of TNT is 227. 

Then, the internal energy of explosion from Equation 
17.4.8 is 

A E = (AS;) p - (AE?) r 

= {(1 x 0) + [6 x (-26.722)] + (2.5 x 0) 

+ (1.5x0)}-[lx (-13.0)] 

= -147.3 kcal/mol 
= -147,300 cal/mol 
* -147,000/227 
= -649 cal/g of TNT 

The entropy of explosion from Equations 17.4.10 and 17.4.12 

AS = (S° - 7? In p) v - (S°) r 
The entropy of mixing terms is: 



P 

-R In p 

CO 

0.6 

1.016 

h 2 

0.25 

2.753 

N z 

0.15 

3.767 


Then, the entropy of explosion is 

AS = {(1 x 1.361) + [6 x (47.301 + 1.016)] 

+ [2.5 x (31.211 + 2.753)] 

+ [1.5 x (45.767 + 3.767)]} - (lx 65) 

= 385.5 cal/mol K 

Hence, the energy of explosion from Equation 17.4.6 is 
given by 

AA = AE — TAS 
" ^15^-147,300 - (298 x 385.5) 

«s^262,180 cal/mol 
Sips <4-262,180/227 
<--1155 cal/g of TNT 

The experimental value of the energy of explosion of TNT 
is quoted by Kinney as 1120 cal/g. Kinney gives an 
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alternative calculation which utilizes instead Equations 
17.4.11 and 17.4.13, but gives an identical result. 

Other values of the energy of explosion of TNT have been 
discussed by Burgess et al. (1968 BM RI7196). 

An alternative explosion reaction without air given by 
Ornellas (1967) is 

C 7 H 5 0 6 N 3 — 3.7C + 2CO + I.3CO2 + O.ICH4 + 0.5H 2 

+ 1.6H 2 0 + 1.3N 2 + O.2NH3 [17.4.20] 

For this reaction the energy of explosion given is 1093 cal/g. 

If the combustion of TNT takes place in the presence of 
excess air, the conventional explosion reaction is 

C 7 H 5 0 6 N 3 + 0 2 (excess) -» 7C0 2 + 2.5H 2 0 + 1.5N 2 

[17.4.21] 

For this reaction the energy of explosion, or rather com¬ 
bustion, given is 3600 cal/g. 

The energy of explosion of TNT is widely utilized as a 
reference value. The energy used is normally that for 
explosion in the absence of air. The value of this energy of 
explosion which is used here is 1120 cal/g of TNT, as given 
by Kinney. 

As an illustration of the calculation of the enthalpy 
change in the explosion of a flammable gas, consider the 
calculation of that for an acetylene—air mixture. The 
explosion reaction is assumed to be 

C 2 H 2 + 2.50 2 —> 2C0 2 + H 2 0 [17.4.22] 

The thermodynamic data are 


AH} (kcal/mol) 

c 2 h 2 

54.194 

o 2 

0 

C0 2 

-94.052 

H 2 0 (g) 

-57.798 


Then, the enthalpy change for the explosion from Equa¬ 
tion 17.4.9 is 

A/7 = (AH f °) p - (AHf), 

= {[2 x (-94.052)] + [(1 x (-57.798)]} 

- [(1 x 54.194) + (2.5 x 0)] 

= -300.096 kcal/mol 

Alternatively, the heat of combustion may be used. The 
standard heat of combustion of acetylene is 

A77° w = -310.615 kcal/mol 

This value is for acetylene gas, so no correction is required 
for the state of the reactant, hut the value assumes that the 
final water product is liquid. The latent heat of water is 

A H wv = 9.7 kcal/mol 


Hence the corrected standard heat of combustion of acety- 


Aff° vw =-310.615+ 9.7 

= -300.915 kcal/mol 

AH is then equal to this value of AH} and agrees well with 
that calculated earlier. 

These methods of calculating the energy of explosion of 
flammable gases and vapours are those which are normally 
used for industrial explosion calculations. 

The foregoing methods assume that the hot product 
gases are cooled back to standard conditions. The effect on 
the enthalpy change in the explosion of assuming other 
termination conditions is illustrated by the calculations 
given by Burgess et al. (1968 BM RI7196) for the combus¬ 
tion of a stoichiometric acetylene-air mixture. Some cases 
are considered in Table 17.7. For the bomb calorimeter the 
final mixture composition is C0 2 16.1%, H 2 0 8.1% and N 2 
75.8%, but for the other cases there are other products 
present such as CO, H 2 ,0, H and OH. 

Calculations of this kind are relevant to the estimation of 
the energy available in explosion processes in process plant 
and pipelines. 

There are available extensive tabulations of thermo¬ 
dynamic properties at standard conditions (25°C, 
atmospheric pressure). Tabulations of thermodynamic 
properties are given in National Bureau of Standards 
(NBS) Circular 461 Selected Values of Properties for 
Hydrocarbons (1947), NBS Circular 500 Selected Values of 
Chemical Thermodynamic Properties (1952) and NBS Cir¬ 
cular 270-3 Selected Values of Chemical Thermodynamic 
Properties (1969), in the NBS JANAF Thermochemical 
Tables (Stull and Prophet, 1971) and in American Petroleum 
Institute (API) Research Project 44 Selected Values of 
Hydrocarbons and Related Compounds (Rossini, 1952; C.C. 
Williams, 1975). Thermodynamic properties of explosives 
are listed by Kinney (1962) and Kinney and Graham (1985). 

Thermodynamic properties may also be estimated by 
theoretical methods, which are generally based on group 
contributions. A number of methods are described by Reid 
and Sherwood (1958,1966), Reid, Prausnitz and Sherwood 
(1977) and Reid, Prausnitz and Poling (1987). 


Table 17.7 Characteristics of four combustion 
processes for acetylene in air a,b (after Burgess et al., 
1968 BM RI 7196) 



Final 

pressure 

(atm) 

Final 

temperature 

(K) 

-AH 

(cal/g of initial 
mixture) 

Bomb calorimeter 

1 

298 

842 

Open flame 

1 

2537 

692 

Constant volume 

9.78 

2918 

630 

explosion 

Detonation 

19.56 

3230 

550 


a The legend to the authors’ table refers to ‘stoichiometric 
acetylene-air’. 

b The original table gives the heat released in terms of the enthalpy 
change (-AH), as shown here. The heat released at constant pressure, 
as in the open flame case, is an enthalpy change, that released at con¬ 
stant volume, as in the bomb combustion cases, is an internal energy 
change. 
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Thermodynamic properties of selected substances are 
given in Table 17.8. 


where U\ is the liquid strain energy, V is the volume of the 
vessel and fl is the bulk modulus of the liquid. 


17.4.2 Gas expansion energy 

Explosions can also be caused by gas or liquid under high 
pressure. The energy released in an explosive expansion of 
a compressed gas is again given by Equation 17.4.1. 

Considering an ideal gas, for 1 mol of the gas, the limiting 
value of the energy of explosion, assuming an ideal gas and 
isothermal expansion, is 

P 6V ~ TAS = RT ln(Pi/P 2 ) [17.4.23] 


where the subscript 1 denotes the initial state and 2 the final 
state. 

Assuming isentropic expansion, the limiting value of the 
energy of explosion is 


w = ™- p * v > 

y-l 

or eliminating V 2 using PV* = constant 



where y is the ratio of the gas specific heats. 


[17.4.24] 


[17.4.25] 


17.4.3 Liquid expansion energy 

The energy released in an explosive expansion of a liquid is 


U x = \f>P 2 V 


[17.4.26] 


17.4.4 Vessel metal strain energy 

The elastic strain energy in a cylindrical vessel neglecting 
the ends is given by Manning and Labrow (1971) as 


TT P 2 V [3(1 —2v) + 2K 2 (l + v)] 
Um ~ m [ k 2 — i \ 


[17.4.27] 


where E is Young’s modulus, K is the diameter ratio, U m is 
the metal strain energy and v is Poisson’s ratio. The elastic 
strain energy of the metal is usually small compared with 
the chemical and fluid expansion energies. 


17.4.5 Vessel burst energy: ideal gas 

For the energy of explosion in the bursting of a vessel con¬ 
taining fluid under pressure, it is necessary to distinguish 
between cases where the fluid can be treated as an ideal gas 
and those where it cannot. 

Taking the ideal gas case first, there are a number of 
treatments available. Accounts include those of Erode 
(1955,1959), Kinney (1962), W.E. Baker (1973), Adamczyk 
(1976), Strehlow and Ricker (1976), W.E. Baker et al. (1983), 
the CCPS (1994/15) and Crowl (1999). 

The literature reveals a variety of approaches based on 
different treatments of the thermodynamics. The two most 
widely used relations appear to be those of Erode (1959) 
and of W.E. Baker (1973). 

In the treatment given by Erode (1959) the energy of 
explosion is the energy required to raise the pressure of 
the gas at constant volume from atmospheric pressure to 
the initial, or burst, pressure. It is thus the difference in the 


Table 17.8 Thermodynamic properties of selected substances 



State 

A E° 

(kcal/mol) 

AH? 

(kcal/mol) 

AA° 

(kcal/mol) 

AF? 

(kcal/mol) 

S° 

(cal/molk) 

AE°a 

(kcal/mol) 

C (graphite) 

s 

0 

0 

0 

0 

1.3609 

-94.052 

CO 

g 

-26.722 

-26.416 

-33.104 

-32.808 

47.301 

-67.636 

C0 2 

g 

-94.052 

-94.052 

-94.260 

-94.260 

51.061 


H, 

g 

0 

0 

0 

0 

31.211 

-68.317 

H 2 0 

g 

-57.502 

-57.798 

-56.339 

-54.636 

45.106 

- 

n 2 

g 

0 

0 

0 

0 

45.767 

— 

0, 

g 

0 

0 

0 

0 

49.003 

- 

Cl 2 

g 

0 

0 

0 

0 

53.286 

- 

Acetylene 

g 


54.194 


50.000 

47.997 

-310.615 

Benzene 

g 


19.820 


30.989 

64.34 

-789.08 

w-Butane 

g 


-30.15 


-4.10 

74.12 

-687.982 

Cyclohexane 

g 


-29.43 


7.59 

71.28 

-936.88 b 

Ethane 

g 


-20.236 


-7.860 

54.85 

-372.820 

Ethylene 

g 


12.496 


16.282 

52.45 

-337.234 

Methane 

g 


-17.889 


-12.140 

44.50 

-212.798 

Propane 

g 


-24.820 


-5.614 

64.51 

-530.605 

Propylene 

g 


4.879 


14.990 

63.80 

-491.987 

Styrene 

g 


35.22 


51.10 

82.48 


Toluene 

g 


11.950 


29.228 

76.42 

-943.58 

TNT 

s 

-13.0 




65 



a Final products C0 2 (g), H 2 0 (1). 
b Heat of combustion value is for liquid. 

Notes: g, gas; 1, liquid; s, solid. 

Sources ; First eigtht items and last item, all properties except A H°: Kinney (1962). Other etems, AH?, A FJ, S°: C.C.Williams (1975). All items, AH°: 
Washburn (1926); Rossini (1952); Perry (1950) (quoted by Hougen, Watson and Ragatz, 1954). 
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internal energies of the gas at the initial and final pres¬ 
sures. The internal energy is 


E 


PV 

7-1 


[17.4.28] 


A third relation for the energy of explosion is that given by 
Kinney (1962). This is based on work done in isothermal 
expansion and is 

E k j = nRT ln(Pi/P 0 ) [17.4.32] 


where E is the internal energy, P is the absolute pressure in 
the vessel and V is the volume of the vessel. Brode’s equa- 


£ B r 


(Pi-P„)V 
ft — 1 


[17.4.29] 


where £ki is Kinney’s energy of explosion and n is the 
number of moles. 

Other expressions for the energy of explosion include 
those of Adamczyk (1976) and Aslanov and Golinsky (1989). 

Aslanov and Golinsky (1989) extend Baker’s approach to 
take into account the internal energy of the air displaced by 
the expanding gas. Their expression, which contains an 
additional term to allow for this effect, is 


where E Bi is Brode’s energy of explosion, P is the absolute 
pressure, Fis the volume of the vessel and the subscripts 1 
and o denote ‘initial vessel’ and ‘atmospheric’, respectively. 

The treatment of W.E. Baker (1973) is based on the work 
done on the surroundings in an isentropic expansion. 
Baker’s equation is 


_PiV 1 -P 0 V 2 
ft — 1 


[17.4.30] 


where E Ba is Baker’s energy of explosion and the subscripts 
1 and 2 denote the initial and final conditions. For an isen¬ 
tropic expansion ( PV y =constant). Equation 17.4.30 can be 
written as 



[17.4.31] 


c- n v 
Eag = - 


Pq(F 2 -Fi) 

Vo-1 


[17.4.33] 


where E AG is the Aslanov—Golinsky energy of explosion. 
Comparisons of the expressions for energy of explosion 
have been given by Strehlow and Ricker (1976) and the 
CCPS (1994/15). The former define a scaling radius 




[17.4.34] 


where R a is the scaling radius (m). 

They then compare the results given by the equations for 
the energy of explosion of Erode, Baker and Kinney at a 
given actual distance r a and dimensionless distance RJr 0 
as shown in Figure 17.6(a). At higher pressure ratios the 
results given by the Kinney equation diverge from those 




Figure 17.6 Energy of explosion in a vessel burst (a) Comparison by Strehlow and Ricker (1976): curve 1, model of 
Srode (1955), curve 2, model of W.E. Baker (1953); and curve 3, model of Kinney (1962) (Courtesy of the American 
Institute of Chemical Engineers), (b) Comparison by Crowl (1992a) (Courtesy of Butterworth-Heinemann) 
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given by the other equations. They recommend the use of 
the Erode equation. 

The CCPS (1994/15) give plots of the ratio of the energies 
of explosion given by Baker, byAdamczyk and by Aslanov 
and Golinksy to that given by Erode. This comparison 
indicates that the values yielded by the other expressions 
tend to those of the Erode equation at higher pressures, but 
there is a considerable divergence at lower pressures. 
For the latter they state that the ratio of values obtained 
from the different models is as high as 4. In the method 
given for vessel bursts the CCPS uses the Erode equation. 

The preferred method for the estimation of the explosion 
energy of gas-filled vessels appears to be that of Erode. The 
main alternative is that of Baker. The method of Kinney 
considerably overestimates the explosion energy. 

The following version of the Erode equation in terms of 
TNT equivalence has been given in the Second Canvey 
Report (HSE, 1981a): 

E = 1.43 x 117.4.35] 

where E is the explosion energy (te of TNT), Pi the initial 
pressure in the vessel (kPa), P a is the pressure of the sur¬ 
roundings (kPa) and Fis the volume of the vessel (m 3 ). 

As an illustration, consider the energy of explosion of 
1 kmol of air at 100 bar and 20°C. The volume Fof the gas is 

F = znRT/P 

•m 0.970 x 10 3 x 8.314 x 293/(100 x 10 5 ) 
fc 0.236 m 3 

with the compressibility factor, z, by the Peng-Robinson 
equation of state = 0.970. Using the Erode Equation 17.4.29, 
the explosion energy E ex is 

£ ex = 1(100 - 1) x 10 5 x 0.236]/(1.4 - 1) 

= 0.584 x 10 7 J 
= 5.84 x 10 3 kj 
= 1.39 x 10 6 cal 

The energy in this explosion is thus equivalent to the 
following quantity of TNT: 

_ 1.39 x 10 6 
“ 1120 
= 1243 g of TNT 

The distribution of this energy is discussed below. 

17.4.6 Vessel burst energy: non-ideal gas, vapour, 
flashing liquid 

For the energy of explosion in the bursting of a vessel con¬ 
taining fluid under pressure which is not an ideal gas but a 
non-ideal gas, vapour or flashing liquid, the foregoing 
approach is not suitable. 

In this case the energy of explosion is obtained as the 
difference in the internal energy between the initial and 
final states assuming an isentropic expansion, using suit¬ 
able thermodynamic diagrams or tables. 

Since it is the specific internal energy e which is of 
interest and since thermodynamic data tend to be given in 
terms of specific enthalpy, use may be made of the relation 

§17.4.36] 


where e is the specific internal energy, h is the specific 
enthalpy, p is the absolute pressure and v is the specific 
volume. 

The initial condition of the fluid is defined in terms of the 
variables Pi, Vi, Si and H\ and the final condition in terms of 
the variables P 2 , v 2 , S 2 and H 2 , where S is the specific entropy 
and the subscripts 1 and 2 denote the initial and final states. 
An isentropic expansion is performed from P 2 to Pi, where 
the latter equals atmospheric pressure P Q , so that 

S 2 = Si [17.4.37] 

The enthalpy change (hi - h 2 ) is obtained, and from this the 
internal energy change (ei-e 2 ) using Equation 17.4.36. 
Then 

E eyL =n(Ei-E i ) [17.4.38] 

where _E ex is the energy of explosion and n the number of 
moles. 

For expansion of a vapour there are several different 
cases which may arise. The fluid may be (1) a vapour 
superheated in both states, (2) a vapour wet in both states or 
(3) a vapour superheated in state 1 but wet in state 2. 

The vapour mass fraction may be expressed as 



where <p is a variable, and the subscripts f and g denote 
saturated liquid and saturated vapour, respectively. In this 
equation the variable </> may be replaced by s, e or h, 
depending on the thermodynamic path (s = constant 
entropy, etc.). 

The following equation given by the CCPS is useful in 
interpolating in thermodynamic tables: 

e 2 =s (1 — x)h{ + xh g - (1 — x)poVf - ;rp 0 % [17.4.40] 

The CCPS gives data on the work of expansion for a limited 
set of fluids, namely ammonia, carbon dioxide, ethane, 
isobutane, nitrogen, oxygen and propane. 

17.4.7 Energy distribution in an explosion 

The energy distribution in an explosion is shown sche¬ 
matically in Figure 17.7. Only a fraction of the total energy 
in the explosion appears in the blast wave or the missiles. 
Some is dissipated as radiation and thermal energy. Other 
energy appears as potential and kinetic energy, in the 
explosion products and, eventually, in the fragments. 

17.4.8 Energy distribution in a vessel burst explosion 

For vessel rupture the effects of an explosion with a given 
energy release depend on the way in which the energy is 
distributed. 

The total energy E s in a system is the sum of the chemical 
energy E lt the fluid expansion energy E 2 and the vessel 
strain energy E 3 : 

E s = E 1 +E 2 +E 3 [17.4.41] 

For a catastrophic or near-catastrophic failure of a vessel 
the High Pressure Safety Code gives the energy distribution 
shown in Table 17.9. The energy in the shock, or blast, wave 


h = e+pv 
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Kinetic energy in fragments 
Kinetic energy in products 


Far field 
wave energy 


Figure 17.7 Schematic energy distribution in a chemical explosion (after Strehlow and Baker, 1976; Stull, 1977) 


Table 17.9 Approximate distribution energy of explosion 
of a bursting vessel (after B.G. Cox and Seville, 1975) 



Shock wav 
energy 

e Fragment 
kinetic 
energy 

Complete shattering of 
vessel due to brittle failure 

0.8 E s 

0.2 E s 

Ejection of a major vessel 
section such as an end closure 
of a short, large bore vessel 

0AE s 

0.6£ s 


is given for this case as between 40% and 80% of the 
explosion energy. Avalue of 50% is often used. The energy 
in the fragments is given for the case considered as 
between 20% and 80%. 

The explosion energy in vessel rupture and its partition 
between blast and missiles is discussed further in Section 
17.27.The energy imparted to missiles in also considered in 
Section 17.34. 

17.4.9 Energy of a vapour cloud explosion: yield factor 

In a vapour cloud explosion the energy in the blast wave is 
generally only a small fraction of the energy theoretically 
available from the combustion of all the material in the 
cloud. The ratio of the actual energy in the explosion to that 
theoretically available is variously termed the ‘explosion 
efficiency’,‘yield factor’ or simply ‘yield’. 

This ratio is referred to here as the yield factor, or yield, 
and has a value less than unity. It is to be distinguished 
from the yield ratio, described in the next subsection. 

If it is assumed that all the flammable material in the 
cloud is available for combustion, the combustion energy 


theoretically available is the product of the total mass of 
flammable material and the heat of combustion. This gives 
a ‘gross’ efficiency. On this basis, explosion efficiencies are 
typically 1-10%. 

Typically, however, only the part of the cloud which is 
within the flammable range is considered giving rise to a 
‘net’ efficiency. 

Often, the fraction of mass in the flammable range is up 
to an order of magnitude less than the total cloud. Conse¬ 
quently, explosion efficiencies calculated on this basis tend 
to be as much as an order of magnitude greater than those 
based on combustion of the whole cloud. 

The energy of vapour cloud explosions is discussed fur¬ 
ther in Section 17.28. 


17.4.10 Blast energy of ground level explosion: yield ratio 

A large proportion of explosions of interest in process 
plants occur at ground level. For such an explosion the 
ground forms a barrier to the explosion. For an explosion at 
ground level the blast wave has a strength that corresponds 
to an apparent energy of explosion which exceeds that for 
a free-air explosion by a yield ratio lying between 1 and 2. 
In other words, for a ground level explosion the apparent 
energy to be used in the correlations for the blast wave 
parameters is multiplied by the yield ratio, typically 2. 

In general, the yield ratio is determined by two factors. 
These are: 

(1) explosion symmetry; 

(2) crater formation. 

A free-air explosion has spherical symmetry, whilst a 
ground level explosion with three degrees of freedom to 
expand has hemispherical symmetry. On the basis of 
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symmetry alone, the apparent energy in the blast wave 
from a ground level explosion will be twice that in the blast 
wave from a free-air explosion. In other words, the yield 
ratio of the ground level explosion will be 2. 

If, however, energy is expended in crater formation the 
yield ratio will be less. This is typically the case with 
ground level explosions of condensed phase explosives. 
Thus, for example, yield ratios for TNT explosions at or 
near ground level frequently lie in the range 1.5-2. A typi¬ 
cal value of the yield ratio for high explosives at ground 
level is 1.8. 

On the other hand, vapour cloud explosions tend not to 
give a crater. There was no crater formed, for example, at 
Flixborough. Thus, for a vapour cloud explosion at ground 
level the yield ratio approaches. 

As already described, the effective energy release in a 
vapour cloud explosion is only a small fraction of the total 
energy theoretically available and the ratio of these two 
energies is expressed as an explosion efficiency. If an 
explosion efficiency is utilized, it should be used in con¬ 
junction with the same yield ratio as was used in its original 
derivation. Frequently this yield ratio is not stated, but it 
appears in many cases to be unity. 

For an explosion such as the bursting of a pressure vessel 
due to high gas pressure at ground level the explosion 
energy absorbed by the ground is generally smaller than 
for a condensed phase explosion. Again the value of the 
yield ratio lies nearer to 2. 

It is not always clear what assumption should be made 
concerning the yield ratio, and it may be necessary to 
exercise judgement. For the calculation of the maximum 
peak overpressure from an explosion the conservative 
assumption is a yield ratio of 2. 

The term‘yield ratio’ is used in work on condensed phase 
explosives (e.g. Kinney and Graham, 1985) and is therefore 
retained here, despite its similarity to the yield factor 
described in the previous subsection. The yield ratio has a 
value greater than unity. However, where only symmetry 
and not cratering is in question, use is also made here of the 
alternative term ‘symmetry factor’. This is identical to the 
yield ratio if cratering is disregarded and has a value 
greater than unity. 

These considerations relate solely to the method of esti¬ 
mating the energy imparted to the blast wave. The actual 
energy of explosion remains the same whether the explo¬ 
sion is in free air or at ground level. In particular, the energy 
imparted to fragments is unaffected. 

In some cases, equations for energy of explosion are 
quoted with a factor of 2 already incorporated. These 
equations are solely for use in estimating the blast wave 
parameters. 


17.4.11 Energy of explosion from 
thermodynamic availability 

As indicated, the energy of explosion obtained from the 
Helmholtz free energy change is an approximation. Its use 
has been criticized by Crowl (1991) on the grounds that it 
applies to a constant temperature process, whereas in a real 
explosion the initial state of the substance may be at some 
higher temperature and/or pressure. 

Accounts of the concept of availability are given by 
Keenan (1941) and Vogler and Weissman (1988). It has been 
applied by Crowl to the energy of explosion in general and 
in particular to explosions associated with combustion of 


gases (Crowl, 1991,1992a) and with vessel bursts (Crowl, 
1992a,c). 

The treatment here is confined to its application to the 
estimation of the energy of explosion in the cases of a vessel 
burst explosion and a chemical explosion Crowl (1992a). 

For a vessel burst the explosion energy is the change in 
batch availability. Assuming ideal gas behaviour, 



where AS is the change in batch availability (kcal/mol), C p 
is the specific heat at constant pressure (kcal/mol K), P is 
the absolute pressure (Pa), R is the universal gas constant 
(kcal/molK), T is the absolute temperature (K) and the sub¬ 
scripts a, 1 and 2 denote ambient, initial state and final 
state, respectively. 

For the case where the initial and final temperatures are 
equal to the ambient temperature (7i =T 2 = T a ), Equation 
17.4.42 reduces to 

ABm—RT a [ InQ) - (l - £*)] [17.4.43] 

Crowl compares the energy of explosion in a vessel burst, 
obtained from the isentropic and isothermal expansion 
treatments of Baker and of Kinney, given above as 
Equations 17.4.31 and 17.4.32, with his values from his 
method, in Figure 17.6(b). The graph indicates that com¬ 
pared with the thermodynamic availability method the 
isentropic expansion method generally underestimates 
the energy of explosion, whilst the isothermal expansion 
method always overestimates it. In an isentropic expansion 
the final temperature is in fact not the ambient temperature 
but a much lower temperature. He advises against the use 
of the isentropic expansion method for the determination of 
the energy of explosion in vessel bursts. 

As an illustration, consider the case given by Crowl. 
This is the determination of the energy of explosion of a 
cylinder containing 45.4 kg of nitrogen at 1.53 x 10 4 kPa at 
298 K with an ambient pressure of 100 kPa.The mass of gas 
is thus 1.621 kgmol (45.5/28). Then, from Equation 17.4.43 

AS = *-2.39 kcal/mol = -1621 x 2.39 = -3870 kcal 

For a chemical explosion the explosion energy is the change 
in batch availability. For the energy change where the initial 
conditions of a gas/air mixture are ambient temperature 
and pressure, 

AS = (S) pr - (S) r [17.4.44] 

where 

S = £ «,(</>„• + RT a In Xi ) [17.4.45] 

where S is the batch availability (kcal/mol), «,• is the num¬ 
ber of moles of species i, m is the number of species, x,- is 
the mole fraction of species i, </> D is the standard batch 
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availability (kcal/mol) and subscripts pr and r denote the 
products and reactants, respectively. 

If the gas/air mixture is at a pressure other than ambi¬ 
ent, the batch availability of the reactants is adjusted by the 
addition of the term 

SB = nRT a [in ^ - (l - Q ] [17.4.46] 

For the special case of explosion of a substance in stoi¬ 
chiometric combustion in pure oxygen at standard tem¬ 
perature and pressure the energy of explosion is simply the 
batch availability p a of the substance. 

Two cases of chemical explosion given by Crowl are con¬ 
sidered by way of illustration. The first is the calculation of 
the energy of explosion for the stoichiometric combustion 
of methane in air: 

CH4 + 20 2 -» C0 2 + 2H 2 0 (g) 

The energy of explosion is obtained from Equation 17.4.44 
using Equation 17.4.45 for the batch availability B. Con¬ 
sidering 1 mol of methane: 


Initial state 


Species 

Moles, 

Mole 

fraction, 

Standard 

availability 

Batch 

availability 




Po i 

(cal/mol) RT a \nXi 

B 

(cal/mol) 

ch 4 

0 2 

n 2 

1.00 

2.00 

7.52 

0.0951 

0.1901 

0.7148 

195,500 -1,393 

0 -983 

0 -199 

194,107 

-1,966 

-1,496 

Total 

10.52 



190,645 

and 





Final state 




Species Moles, 

Mole 

fraction, 

Standard 

availability 

Batch 

availability 




<j> oi RTJnXi B 

(cal/mol) (cal/mol) (cal/mol) 

co 2 

H 2 0 

n 2 

1.00 

2.00 

7.52 

0.0951 

0.1901 

0.7148 

0 -1,393 

2,054 -983 

0 -199 

-1,393 

2,142 

-1,496 

Total 

10.52 



-747 


Then, 

AB = (—747) -(190,645) 

= -191,392 cal/mol of methane 

The second case is the energy of explosion of a mixture 
of 85% methane and 15% oxygen initially at 1 atm and 
298 K. The stoichiometry for the combustion products is 
as follows: CH 4 77.5%, 0 2 0%, C0 2 7.5% and H 2 0 15%. 
Proceeding as before and considering 1 mol of mixture. 


Initial state 


Species 

Moles, 

Mole Standard 

fraction, availability 

Batch 

availability 

' </>„,• RT 3 \nXi B 

(cal/mol) (cal/mol) (cal/mol) 

ch 4 

0.85 

0.85 195,500 -96.2 

166,096 

0 2 

0.15 

0.15 0 -1,123 

-168 

Total 

1.00 


165,925 

and 




Final state 



Species Moles, 

Mole Standard 

Batch 


m 

fraction, availability 

availability 



X ’ Pot RTAnxi 

B 



(cal/mol) (cal/mol) (cal/mol) 

ch 4 

0.775 

0.775 195,500 150.7 

151,396 

0 2 

0 

0 0 


C0 2 

0.075 

0.075 0 -1,535 

-115 

h 2 

0.15 

0.15 2,054 -1,123 

-140 

Total 

1.000 


151,141 


Further, from Equation 17.4.46 
SB = 830 cal 


Then, 

AS = (151,374) - (165,925 + 830) 

—15,381 cal/mol of mixture 
Crowl states that the energy of explosion computed using 
the thermodynamic availability method is always less than 
that obtained from the heat of combustion method. For 
stoichiometric mixtures the difference is of the order of 
5-10%, but for other conditions such as non-stoichiometric 
mixtures and higher initial pressure and temperature the 
difference can be substantial. 

The application of the method requires the use of data on the 
standard availability, which is not one of the thermodynamic 
quantities normally listed. Crowl (1992a) provides a table of 
standard availabilities for quite a large number of substances. 

The following values are given for the standard avail¬ 
ability of some common gases at standard conditions (1 atm, 
298 K) and final state (H 2 0 (1)): 


Substance 

Standard availability, 
p 0 (kcal/mol) 

Methance 

195.5 

Ethane 

350.73 

Propane 

503.93 

«-Butane 

656.74 

Ethylene 

318.18 

Propylene 

467.81 

Acetylene 

295.21 

Hydrogen 

56.69 

0 2 (g) 

0 

C0 2 (g) 

0 

H 2 0(1) 

0 
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17.5 Deflagration inside Plant 

The explosion of a flammable mixture in a process vessel or 
pipework may be a deflagration or a detonation. These two 
types of explosion differ fundamentally and require dif¬ 
ferent countermeasures. Both types, but particularly 
detonation, can be very destructive. 

The conditions for a deflagration to occur are that the gas 
mixture is within the flammable range and that there is a 
source of ignition or that the mixture is heated to its auto¬ 
ignition temperature. 

The conditions for a detonation to occur are similar except 
that in this case the mixture should be within the detonable 
range. If the source of ignition is sufficiently strong, deto- 
nationmayheinitiateddirectly. Alternatively, adeflagration 
may undergo transition to a detonation. This transition 
occurs in pipelines but is most unlikely to occur in vessels. 

17.5.1 Sources of ignition 

The sources of ignition usually considered are those out¬ 
side the process plant, but ignition sources can occur inside 
vessels and pipework also. These include: 


mixture, P is the absolute pressure, T is the absolute tem¬ 
perature and the subscripts 1 and 2 denote the initial and 
final states, respectively. 

For deflagration of hydrocarbons the ratio of the maxi¬ 
mum explosion pressure to the initial pressure is quoted as 
being approximately 8 for hydrocarbon-air mixtures and 
16 for hydrocarbon—oxygen mixtures (Zabetakis, 1965 BM 
Bull. 627; W.G. High, 1976). These values apply for initial 
pressures in the range 1-40 bar, for initial temperatures in 
the range 0—300°C and for relatively small volumes of a 
few cubic metres. 

However, as described in Section 17.7, the values quoted 
for the final pressure attained in deflagration in a closed 
vessel are often underestimated due to the use of constant 
pressure rather than constant volume assumptions. On 
the correct basis of constant volume combustion, for 
hydrocarbon-air mixtures the ratio of the maximum 
explosion pressure to the initial pressure is approximately 
as follows: 

P7.5.3] 


(1) flames and hot surfaces; 

(2) sparks; 

(3) chemicals 

(a) unstable compounds, 

(b) reactive compounds and catalysts, 

(c) pyrophoric iron sulphide; 

(4) static electricity; 

(5) compression. 

This list is sufficient to show that there is no shortage of 
possible ignition sources inside the plant. The wide variety 
of conditions which can cause ignition is illustrated by the 
fact that compressed air at 60 psig striking a suitably 
shaped depression in the end of a piece of wood can ignite 
the latter (WG. High, 1976). 

If a flammable mixture may be present, precautions 
should be taken to eliminate all ignition sources. But it is 
prudent to assume that, despite these efforts, a source of 
ignition will at some time occur. 

Ignition can also occur if the flammable mixture is 
heated to its autoignition temperature. 

17.5.2 Deflagration in vessels 

For a deflagration at constant volume in a sphere the maxi¬ 
mum explosion pressure is 





E = nJT, 
n\T\ 
_ M l T 2 
M 2 T! 


[17.5.1] 


[17.5.2a] 

[17.5.2b] 


where E is the expansion ratio, M is the molecular weight 
of the gas mixture, n is the number of moles in the gas 


This is the order of pressure rise in deflagrative combus¬ 
tion, for example, in the results given in Table 17.7. 

For conventionally designed pressure vessels the burst¬ 
ing pressure P b is of the order of 

p^4-5 [17.5.4; 

Hence in the absence of explosion relief the deflagration of 
a hydrocarbon-air mixture is easily capable of bursting a 
pressure vessel. 

If the explosion relief is to be effective, it must act within 
a period which is generally much less than 1 s. Methods of 
explosion relief are available which do this and are dis¬ 
cussed in Section 17.12. 

17.5.3 Pressure piling 

If an explosion occurs in a compartmented system in which 
there are separate but interconnected spaces, a situation 
can arise in which the pressure developed by the explosion 
in one space causes a pressure rise in the unburnt gas in an 
interconnected space, so that the enhanced pressure in the 
latter becomes the starting pressure for a further explo¬ 
sion. This effect is known as pressure piling, or cascading. 

The type of system geometry in which pressure piling is 
liable to occur is illustrated in Figure 17.8(a). If the initial 
explosion occurs in space A, this may cause pressure piling 
in space B. If the final pressure in A is £ times the initial 
pressure, a simplified argument would suggest that the 
final pressure in B might in the worst conceivable case be 
two times the initial pressure in both spaces. 

An account of pressure piling has been given by Fitt 
(1981a,b). The phenomenon of pressure piling was first 
detected by Beyling (1906) in work on flameproof electrical 
equipment and has subsequently been studied by a number 
of workers. Table 17.10 lists some of the experimental work 
done on pressure piling. 

Fitt distinguishes between studies done on compart¬ 
mented tube systems and linked tube systems, as shown in 
Figures 17.8(a) and (b), respectively. He also points out that 
there are two separate effects, which he calls flame front 
projection (FFP) and peak pressure enhancement (PPE). 
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The first causes a very rapid rise of pressure, the second an 
enhanced final pressure. 

Fitt states that in compartmented systems, pressure pil¬ 
ing is observed with low compartment volume ratios (W1/V2) 
and high connecting orifice-to-enclosure diameter ratios, 
whereas in link tube systems a volume ratio of at least 5 :1 
appears to be required for peak pressure enhancement. He 
suggests that there is a mechanism of pressure piling in 
compartmented systems which is suppressed in link tube 
systems. 

The enhancement of pressure is limited by the fact that 
the total pressure volume energy cannot exceed that which 
would arise in an uncompartmented enclosure. If pressure 
piling occurs in one space, the maximum pressure in the 
remaining space must be reduced. At some stage the pres¬ 
sure differential will cause back venting, which lowers the 
peak value. 

For hydrocarbon-air mixtures the maximum pressure 
obtained in combustion is at least eight times the initial 


-CXH>IcHX- 


Figure 17.8 Plant configuration to illustrate pressure 
pilling: (a) compartmented tube system and (b) linked tube 
system 


pressure. Thus, taking a peak pressure enhancement factor 
of 4, the maximum pressure obtained with pressure piling 
would be of the order of 30. Pressure piling can therefore 
give a very large increase in the maximum pressure rise in 
the plant. 

With regard to design to avoid pressure piling, Fitt states 
that in link tube systems the peak pressure enhancement is 
unlikely to exceed a factor of 4. This is the maximum 
enhancement obtained in the experiments given in 
Table 17.10. The peak pressure enhancement in compart¬ 
mented tube systems is less predictable, and such systems 
should be avoided. Pressure piling may be significant 
not only in the main process plant but in other equipment 
also. As already mentioned, much of the work on pressure 
piling has been concerned with flameproof equipment. 
This aspect is considered further in Chapter 16. 


17.5.4 Deflagration in pipes 

Whereas in a vessel, deflagration results in a pressure rise 
which is uniform throughout the vessel, this is not so in a 
pipe, where the explosion velocity and explosion pressure 
can change along the length of the pipe. 

An account of deflagration in pipes has been given by 
Bartknecht (1981a). He defines three cases: 

Case 1: pipe open at one end, ignition at open end; 

Case 2: pipe open at one end, ignition at closed end; 

Case 3: pipe closed at both ends. 

In order to understand the phenomena involved, it is 
necessary to consider all three cases. The explosion veloc¬ 
ity is given by the relation 

u ex = <l>Un + «d [17.5.5] 


Table 17.10 Some experiments on pressure piling (after Fitt, 1981a) 


Worker(s) 

Apparatus 


Compartment 
volume ratio 

Beyling (1906) 

Beyling (1906) 

Grice and Wheeler (1929) 

Coward and Wheeler (1934) 

Gleim and March (BM1952 RI4908) 
T.A.J. Brown (1959) 

J. Singh (1977) 

Bartknecht (1981a) 

Compartmented pipe 

Linktube 

Link tube 

Compartmented pipe 
Compartmented pipe 

Link tube 

Link tube 

Link tube 

2 

11.7 

12 and 16.7 

Many compartments 
1.0—7.0 

13.5 

5.0-32.0 

5.0 


Larger compartment 

Conneting passage 

Maximum observed 


diameter or side (cm) 

diameter (cm) 

peak pressure 




enhancement ratio 

Beyling (1906) 

33.5 

3.0 

1.3 

Beyling (1906) 

33.5 

2.0 

2.3 

Grice and Wheeler (1929) 

45.8 a and 50 

2.5 

2.0 

Coward and Wheeler (1934) 

30.6 

2.5 

Not studied b 

Gleim and March (BM 1952 RI 4908) 

30.6 a 

5.1-25.4 

4.0 

T.A.J. Brown (1959) 

15.2 

0.6-2.5 

4.0 

J. Singh (1977) 

30.5 

1.3—5.1 

3.7 

Bartknecht (1981a) 



3.1 


a Square section. 
b Flame front projection. 
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where « d is the displacement velocity, z/ ex is the explosion 
velocity, u n the normal burning velocity and </> the ratio of the 
area of the flame front to the cross-sectional area of the pipe. 
The displacement velocity « d is the velocity of the unburned 
mixture, and the explosion velocity is the visible flame veloc¬ 
ity. The equation applies to all three cases, but for that of an 
open pipe with ignition at the open end the displacement 
velocity is zero. For ignition at the closed end (case 2) it 
is high, being some 80—90 % of the explosion velocity. In this 
latter case only part of the gas mixture, theoretically 1/7, 
is burned within the pipe, the rest being ejected from the 
open end and burned outside. The high displacement 
velocity also results in much higher turbulence, a higher 
flame front area and a higher value of </>, in this latter case. 

For an open pipe with ignition at the closed end with 
large diameter pipes (>400 mm) the explosion velocity 
exhibits an approximately linear increase along the length 
of the pipe. With smaller diameter pipes this continuous 
increase is no longer observed. As the pipe diameter is 
decreased, a critical diameter is reached at which the flame 
propagation no longer occurs. 

For an open pipe with ignition at the closed end the 
explosion pressure P ex increases linearly with the logarithm 
of explosion velocity, as shown in line 1 of Figure 17.9(a). This 
effect is independent of pipe diameter. 

Thus, in the case of a 1600 mm diameter pipe, 10 m long, 
open at one end, Bartknecht quotes, for ignition at the open 
end, values of « ex and P ex of 4 m/s and 0.02 bar and, for 
ignition at the closed end, values of 150 m/s and 0.2 bar, 
respectively. 

If the flow is highly turbulent and if the pipe is long 
enough, the explosion velocity can reach a value such that 
detonation, or quasi-detonation, occurs. The reference to 
quasi-detonation applies particularly to methane. It is dif¬ 
ficult to cause methane to detonate, and although it exhi¬ 
bits detonation-like behaviour, the flame front and shock 
wave can separate, whereas in a normal detonation they are 
coupled. 

Table 17.11 shows the pipe lengths required for run-up to 
detonation for the three gases methane, propane and 
hydrogen with flame jet ignition in pipes of 100, 200 and 
400 mm diameter. Section 17.2.15 treats run-up distance for 
weaker ignitions. 

Turning to the case of a pipe closed at both ends (case 3), 
and considering first a quiescent gas mixture, experi¬ 
mental results given by Bartknecht show that the explosion 
velocity initially increases along the length of the pipe due 
to a high displacement velocity, but since the gas is con¬ 
fined, the displacement velocity and the explosion velocity 
then decrease. For gases such as methane and propane, the 
net effect is to cause the explosion velocity to pass through 
a maximum, and for the value of that maximum to be less 
than that attained in an open pipe with ignition at the 
closed end. There is in effect a braking action. Hydrogen 
constitutes an exception: the explosion velocity is the 
same in both configurations and does not pass through a 
maximum. 

If the gas mixture is turbulent, however, there is no such 
braking action. In this case in a pipe closed at both ends all 
three gases will run up to detonation, or quasi-detonation. 
The distance required to do this is longer than for a pipe 
with one end open, but is less than 30 m. 

For a pipe closed at both ends, the explosion pressure 
again increases linearly with the explosion velocity, but 
since all the gas is burned the explosion pressure is several 


bar higher than for the open pipe case, as shown in line 2 in 
Figure 17.9(a). 

The pressures developed in detonation, or quasi¬ 
detonation, of the three gases mentioned in pipes of 100 and 
200 mm diameter with flame jet ignition are shown inTable 
17.12. There are several points worthy of note. The pressures 
tend to be higher in the small diameter pipe. The pressures 
on the end flange P vt are some three times those on the pipe 
wall P pw . And the pressures given by hydrogen are less 
than those given by the other two gases. 

Considering the simple case of a flame accelerating down 
a pipe closed at the end distant from the ignition source, the 
pressure in the gas ahead of the flame may rise due not only 
to a shock wave close to the flame front but possibly also 
due to a shock wave reflected from the end of the pipe. It is 
estimated by Nettleton (1987) that the pressure in the 
unburned gas may rise by a factor of 2—5. 

A separate but related phenomenon is wave interactions 
associated with the advancing detonation wave. An example 
is the retonation wave in a pipe closed at the end where igni¬ 
tion occurs. This retonation wave is created at the same time 
as the detonation wave itself. It travels back through the 
burned gas, is reflected and then travels forwards again and, 
since the velocity of sound in the burned gas is much higher 
than intheunburnedgas, overtakes thedetonationwave.The 
latter thus becomes overdriven for a short distance, before it 
becomes attenuated by theTaylor expansion effect. 

17.5.5 Plant design 

The hazard of an explosion should in general be minimized 
by avoiding flammable gas—air mixtures inside a plant. It 
is bad practice to rely solely on elimination of sources of 
ignition. 

If the hazard of a deflagrative explosion nevertheless 
exists, the possible design policies include (1) design for 
full explosion pressure, (2) use of explosion suppression or 
relief, and (3) the use of blast cubicles. 

It is sometimes appropriate to design the plant to with¬ 
stand the maximum pressure generated by the explosion. 
Often, however, this is not an attractive solution. Except for 
single vessels, the pressure piling effect creates the risk of 
rather higher maximum pressures. This approach is liable, 
therefore, to be expensive. 

An alternative and more widely used method is to pre¬ 
vent overpressure of the containment by the use of explo¬ 
sion suppression or relief. This is discussed in more detail 
in Section 17.12. 

In some cases the plant may be enclosed within a blast 
resistant cubicle. Total enclosure is normally practical for 
energy releases up to about 5 kgTNTequivalent. For greater 
energy releases a vented cubicle may be used, but tends to 
require an appreciable area of ground to avoid blast wave 
and missile effects. 

It is more difficult to design for a detonative explosion. 
A detonation generates much higher explosion pressures. 
Explosion suppression and relief methods are not normally 
effective against a detonation. Usually, the only safe policy 
is to seek to avoid this type of explosion. 

Direct initiation of detonation in ordinary flammable 
gas-air mixtures is generally improbable. Avoidance 
of detonation depends mainly, therefore, on elimination of 
conditions under which transition from deflagration to 
detonation can occur in equipment such as pipelines. 

Where a significant explosion hazard exists, the possible 
consequences of explosion should be reviewed. 
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Explosion velocity, v ex (m/s) 
(b) 


Figure 17.9 Explosion pressure in pipes (after Bartknecht, 1981a). (a) Flammable gas: line 1, flammable gas in a 
pipe of diameter 100-400 mm and length 30 m open at one end; line 2, flammable gas in a pipe of the same dimensions 
closed at both end. (b) Flammable dusts: dusts with K st values of 85-550 bar m/s in a pipe of diameter 400 mm length 
40 mm open at one end with ignition at the closed end (Courtesy of Elsevier Science) 


17.6 Detonation inside Vessels and Pipes 

Detonation of a flammable gas-air mixture may occur by 
direct initiation of detonation by a powerful ignition source 
or by transition from deflagration. 

The transition from deflagration to detonation requires 
a strong acceleration of the flame front. It occurs in pipe¬ 
lines but is very improbable in vessels. The transition 
from deflagration to detonation is a complex process. The 
properties of the detonation, however, are fairly well 


defined and depend essentially on the properties and 
condition of the unhurnt gas. 


17.6.1 Detonation in vessels 

A general account of the pressures which may be generated 
by detonation inside a plant has been given in Section 17.2. 
In practical terms, the peak pressure ratio P2IP1 resulting 
from a detonation of a hydrocarbon-air mixture in a 
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Table 17.11 Pipe lengths (m) for acceleration to 
detonation (after Bartknecht, 1981a) (Courtesy of 
Springer-Verlag) 


Gas 

Pipe diameter (mm) 

100 

200 

400 

Methane 

12.5 

18.5 

>30 

Propane 

12.5 

17.5 

22.5 

Hydrogen 

7.5 

12.5 

12.5 


Table 17.12 Some pressures (bar) in a pipeline closed at 
both ends following a detonation, or quasi-detonation 
(after Bartknecht, 1981a) (Courtesy of Springer-Verlag) 


Gas 

Pipe diameter, 

100 mm 

Pipe diameter, 
200 mm 

P pw 

P p f 

P pw 

Ppf 

Methane 

32 

100 

25 

80 

Propane 

35 

95 

25 

75 

Hydrogen 

23 

56 

23 

40 


containment such as a vessel is about 20: 

[17.6.1] 

This is the order of pressure rise, for example, in the 
experiment reported in Table 17.7. 

17.6.2 Detonation in pipes 

The transition from deflagration to detonation was dis¬ 
cussed in Sections 17.2 and 17.5, where information was 
given on the run-up length to detonation and on the pres¬ 
sures exerted both on the pipe wall and on the end flange. 

Accounts of detonation in pipes have been given by a 
number of workers, including Craven and Greig (1967), 
Munday (1971b) and Bartknecht (1981a). 

Craven and Greig describe experimental work on the 
pressure generated by the detonation of ammonia-nitrous 
oxide mixtures in 3 and 4 in. pipes initially at atmospheric 
pressure. Determinations were made of the incident pres¬ 
sure and of the reflected pressure. The latter was deter¬ 
mined from the distortion suffered by test plates bolted to 
the end of the pipe. It was found that the velocity, the inci¬ 
dent pressure and the reflected pressure all rose rapidly 
with distance from the ignition source to a peak value and 
then fell to a lower, plateau value. Thus, the transition from 
deflagration to detonation was associated with high but 
unstable velocities and pressures. In the 3 in. pipe with a 
50 : 50 ammonia-nitrous oxide mixture the incident pres¬ 
sure peak and plateau values were about 1250 and 370 psi, 
and the reflected pressure peak and plateau values were 
about 4800 and 1100 psi, respectively. 

The effects of detonation in a pipe system vary. In 
some cases damage is confined to blank ends and sudden 
changes of direction. In other cases the pipe may be ripped 
open from end to end. 

17.6.3 Pressure piling 

The phenomenon of pressure piling has been discussed in 
Section 17.5. 


17.6.4 Plant design 

Essentially, the preferred approach in plant design to the 
hazard of detonation in vessels and pipes is prevention 
rather than protection. 

Where an estimate is to be made of the ability of a plant 
to withstand detonation, the approach generally adopted 
is to use a unidimensional method such as the CJ model. 
Such models work reasonably well in the simple case of a 
readily detonable mixture in straight pipe. In any event, 
there is a lack of a more comprehensive treatment adapted 
to design. 

The traditional approach has been to compare the pres¬ 
sures obtained from a unidimensional model with the static 
pressures which the plant can withstand. Some of the 
weaknesses of this approach have been described in Sec¬ 
tion 17.2. The pressures predicted by unidimensional mod¬ 
els are well below those produced by real detonation waves. 
The method does not take into account the difference 
between rapidly and slowly applied loads nor the interac¬ 
tion between the shape of the pressure profile and the 
response time of the confining structure. 

The pressures predicted for detonations inside plant 
tend to be so high that containment is impractical except for 
certain limited cases such as straight pipes which are of 
small diameter and/or are open-ended. 

However, from an assessment of the limited experi¬ 
mental evidence, Nettleton (1987) concludes that the tradi¬ 
tional approach just described appears to be a safe one. The 
tests were conducted, conservatively, with stoichiometric 
mixtures for which the detonation pressures are relatively 
predictable. 

With regard to mechanical design, the velocity of an 
elastic wave in a metal usually exceeds the detonation 
velocity. This points to separate treatment of the arrivals of 
the elastic wave and of the detonation wave itself. 

In designing against explosions, an approach usually 
considered is to accept a degree of plastic deformation. A 
discussion of the planned deformation approach and of the 
practical problems in implementing it is given by Nettleton 
(1987). Essentially, it is limited to the early stages of flame 
acceleration. Nettleton also gives guidance on the local 
strengthening of plant at vulnerable points. 

17.6.5 Protection against detonation 

Where protection against detonation is to be provided, the 
preferred approach is to intervene in the processes leading 
to detonation early rather than late. 

Attention is drawn first to the various features which 
tend to promote flame acceleration, and hence detonation. 
Minimization of these features therefore assists in inhibit¬ 
ing the development of a detonation. To the extent practical, 
it is desirable to keep pipelines small in diameter and short; 
to minimize bends and junctions and to avoid abrupt 
changes of cross-section and turbulence promoters. 

For protection, the following strategies are described by 
Nettleton (1987): (1) inhibition of flames of normal burning 
velocity, (2) venting in the early stages of an explosion, (3) 
quenching of flame-shock complexes, (4) suppression of a 
detonation, and (5) mitigation of the effects of a detonation. 

Methods for the inhibition of a flame at an early stage are 
described in Chapter 16. Two basic methods are the use of 
flame arresters and flame inhibitors. 

Flame arresters are described in Section 17.11. The point 
to be made here is that although an arrester can be effective 
in the early stages of flame acceleration, siting is critical 
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since there is a danger that in the later stages of a detona¬ 
tion it may act rather as a turbulence generator. 

The other method is inhibition of the flame by injection 
of a chemical. Essentially, this involves detection of the 
flame followed by injection of the inhibitor. At the low 
flame speeds in the early stage of flame acceleration, there 
is ample time for detection and injection. This case is taken 
by Nettleton to illustrate this is a gas mixture with a burn¬ 
ing velocity of about 1 m/s and expansion ratio of about 10, 
giving a flame speed of about 10 m/s, for which a separa¬ 
tion between detector and injection point of 5 m would give 
an available time of 0.5 s. 

In the early stage of an explosion, venting may be an 
option. The venting of explosion in vessels and pipelines is 
discussed in Sections 17.12 and 17.13, respectively. 

It may be possible in some cases to seek to quench the 
flame-shock complex just before it has become a fully 
developed detonation. The methods are broadly similar to 
those used at the earlier stages of flame acceleration, but the 
available time is drastically reduced; consequently, this 
approach is much less widely used. Two examples of such 
quenching given by Nettleton are the use of packed bed 
arresters developed for acetylene pipelines in Germany, and 
widely utilized elsewhere, and the use in coal mines of 
limestone dust which is dislodged by the flame—shock 
complex itself. 

The suppression of a fully developed detonation may be 
effected by the use of a suitable combination of an abrupt 
expansion and a flame arrester. As described earlier, there 
exists a critical pipe diameter below which a detonation 
is not transmitted across an abrupt expansion, and this 
may be exploited to quench the detonation. Work on the 
quenching of detonations in town gas using a combination 
of abrupt expansion and flame arrester has been described 
by Cubbage (1963). 

An alternative method of suppression is the use of water 
sprays, which may be used in conjunction with an abrupt 
expansion or without an expansion. The work of Gerstein, 
Carlson and Hill (1954) has shown that it is possible to stop 
a detonation using water sprays alone. 


17.6.6 Some limitations 

There are two principal mechanisms which create pres¬ 
sures which exceed those predicted by the unidimensional 
models and against which it is difficult to design. One is the 
pressure piling and wave interaction effects described 
above which occur during the development of the detona¬ 
tion wave. The other, which applies to the detonation con¬ 
dition itself, arises from instabilities in the combustion 
behind the leading front. The effects are enhanced in mar¬ 
ginally detonable mixtures and by interactions with the 
confinement. 


17.7 Explosions in Closed Vessels 

The deflagration of a flammable gas mixture in a closed 
vessel is important in itself and in relation to venting of the 
vessel. It is closely related to the combustion of a flammable 
dust mixture in a vessel. Quantification requires the meas¬ 
urement of flame speed and burning velocity. The two 
parameters of main interest in explosion in a closed vessel 
are the maximum pressure P m and the rate of pressure 
rise, particularly the maximum rate (dP/dt) ma3c . 


17.7.1 Energy release and final conditions 

As described in Section 17.5, for a deflagration at constant 
volume, in a sphere, the maximum explosion pressure is 


Pi 

Pi 


W2?2 

Mi7i 


[17.7.1] 


where n is the number of moles in the gas mixture, P is 
the absolute pressure, T is the absolute temperature 
and the subscripts 1 and 2 denote the initial and final 
state, respectively. The determination of the maximum 
pressure therefore involves the calculation of the final 
temperature. 

Combustion in a closed vessel is a constant volume pro¬ 
cess. The heat of reaction and the gas specific heats 
applicable to it are those at constant volume. The relevant 
thermodynamic quantity is the internal energy. Thus, the 
final temperature should he obtained by equating the 
internal energy of the products to the internal energy of 
the reactants and the heat of reaction at constant volume. 

The computation of the final temperature is frequently 
done making the incorrect assumption of constant pressure 
conditions. The problem is discussed by S.M. Richardson, 
Saville and Griffiths (1990). It is a common, but incorrect, 
practice to take the final temperature as the adiabatic flame 
temperature. This is incorrect because the adiabatic flame 
temperature is a constant pressure quantity. The constant 
volume flame temperature is appreciably higher. 

The aforementioned authors give an example which 
illustrates the extent of the error. For a stoichiometric mix¬ 
ture of propane and air, which contains 3.98% propane, at 
initial conditions of pressure 1 bara and temperature 290 Iv 
(17°C), the calculated final conditions for adiabatic con¬ 
stant volume combustion are pressure 10.2 bara and tem¬ 
perature 2850 K (2577°C). This compares with values 
quoted in the literature of final pressure 7.6 bara and tem¬ 
perature 2198 K (1925°C). 

The authors state that the difference between the heat of 
reaction at constant volume and that at constant pressure is 
not great. The main source of error lies in the difference 
between the gas specific heat at constant volume and that 
at constant pressure. 

Thus, in constant volume combustion both the final 
temperature and the final pressure are considerably higher 
than for combustion at constant pressure. 


17.7.2 Experimental studies 

There have been a large number of experimental studies of 
combustion in vessels, both closed and vented. Many of 
these have been concerned with the venting process, but 
the proportion of the total work done on closed vessels is 
appreciable. 

Research on combustion in closed vessels has been 
undertaken for a number of purposes, of which three may 
be mentioned here. One is the determination of burning 
velocity. Burning velocity and its measurement have been 
discussed in Chapter 16. Some models incorporating burn¬ 
ing velocity which may be used for its determination are 
described in this section. Experimental work related to 
burning velocity includes that of Fiock and Marvin 
(1937a,b), Fiock et al. (1940), Manton, von Elbe and Lewis 
(1953) and Eschenbach and Agnew (1958). 

The second area of work is the investigation of the vari¬ 
ous factors which influence explosion development in 
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a closed vessel. Here, particular mention needs to be made of 
the extensive programme of work undertaken at the Bureau 
of Mines (BM), an account of which is given by Nagy and 
Verakis (1983). It is illustrated by the work of Nagy et al. 
(1971 BM RI7507) on the effect of variables such as initial 
pressure, initial temperature and vessel size and shape. 
Other work includes that of Kratz and Rosecrans (1922), 
Ellis and Wheeler (1925, 1928b), Fenning (1926), Rallis, 
Garforth and Steinz (1965) and G.F.R Harris (1967). 

The third area is studies of detonation, as opposed 
to deflagration. The BMis again well represented in work in 
this area, by investigations such as that of Burgess et al. 
(1968 BM RI 7196). Other work includes that of Manson and 
Ferri (1953) and Pliickebaum, Strauss and Edse (1964). 

An account of the findings concerning the effects of the 
various influencing factors investigated in this work is 
given below. 

One particular outcome of the experimental work may 
be mentioned at this point. When the flame front reaches 
a certain radius there is a marked increase in its velocity. 
At this point the ratio of the pressure to the initial pressure 
P/P 0 becomes strongly influenced by the expansion ratio E. 

Plate 15, from the work of R.J. Harris (1983), shows the 
development of the flame within a vessel with the latter 
stages influenced by the presence of a vent. 

17.7.3 Factors influencing closed vessel explosions 

The maximum pressure and the rate of pressure rise in a 
closed vessel explosion are affected by a number of factors. 
These are discussed by Bartknecht (1981a), R.J. Harris 
(1983), Nagy and Verakis (1983) and Lunn (1984b, 1992). 
They include: 

(1) vessel size and shape; 

(2) fuel; 

(3) fuel-air ratio; 

(4) vessel fractional fill; 

(5) initial pressure; 

(6) initial temperature; 

(7) initial turbulence; 

(8) ignition source. 

A factor which may affect both explosion parameters is heat 
transfer from the flame and thehot gas to the vessel wall. This 
can be significant if the vessel has a high aspect, or length/ 
diameter, ratio or if the combustion is relatively slow. 

The vessel shape to which most treatments apply is a 
compact vesselwith a length/diameter ratio not exceeding 3. 
For a compact vessel, maximum pressure is theoretically 
independent of vessel size and shape if heat transfer is 
neglected. In practice, maximum pressures tend to show 
some scatter, but this is random. Maximum pressure may 
be less than theoretical if the mixture is slow burning. 
Mixtures close to the lower explosibility limit tend to burn 
relatively slowly. The rate of pressure rise depends on vessel 
size and shape. The effect of vessel volume is illustrated in 
Figure 17.10. 

In one series of tests it was found that for cubical, rec¬ 
tangular and spherical vessels the rate of pressure rise was 
proportional to the ratio of the vessel surface S to its volume 
V. If the vessel shape is such as to promote heat transfer, the 
rate of pressure rise is reduced. 

In an elongated vessel the flame front travels along the 
axis compressing the unburned gas. The rate of pressure 
rise is increased compared with that in a more compact 



Figure 17.10 Explosions in closed vessels: effect of 
vessel volume (Bartknecht, 1981a). Propane atstolenio- 
metric concentration (Courtesy of Elsevier Science) 



Figure 17.11 Explosions in closed vessels: effect 
of gas concentration (Bartknecht, 1981a) (Courtesy of 
Springer-Verlag) 


vessel. The maximum pressure, though, tends to be less. 
However, for initial pressures greater than atmospheric, 
both parameters are enhanced by elongation, as described 
below. 

If the initial pressure is atmospheric, most fuels give a 
maximum explosion pressure of 8-9 bara. 

Both the maximum pressure and rate of pressure rise 
have maximum values at a fuel concentration close to the 
stoichiometric value, and decrease as the concentration 
moves away from this towards the explosibility limits. The 
effect is shown in Figure 17.11. 
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If the vessel is only partially filled by the fuel-air mix¬ 
ture, the maximum pressure varies in an approximately 
linear manner with the fractional fill. 

In compact vessels over a limited range of initial pres¬ 
sure the maximum pressure increases linearly with the 
initial pressure. The rate of rise of pressure is a function of 
the initial pressure. One set of relations for this are those of 
Nagy and Verakis which are given below. 

In elongated vessels the effect of initial pressure is dif¬ 
ferent, as shown in Figure 17.12, smaller for a spherical 
vessel and larger for an elongated one. At atmospheric 
pressure the maximum explosion pressure in the larger 
vessel is slightly less than that in the smaller one, but at 
higher initial pressures it is much greater. The maximum 
rate of pressure rise should be less in the larger vessel, but it 
is actually higher. 

The initial temperature affects the maximum pressure, 
the rate of pressure rise and the final temperature. The 
maximum pressure decrease as the initial temperature 
increases is due to the decrease in density of the fuel-air 
mixture. The following equation has been used to fit some 
experimental results 



where P is the absolute pressure and T is the absolute tem¬ 
perature, the subscripts m and o denote maximum and 




Figure 17.12 Explosions in closed vessels: effect of initial 
pressure (Bartknecht, 1981a): methane in a 11 spherical 
vessel and in a 541 elongated vessel (HID = 6) (Courtesy of 
Springer-Verlag) 


initial, respectively, and ki and k 2 are constants. The rate of 
pressure rise is essentially independent of the initial tem¬ 
perature, because there are two opposing effects, the lower 
expansion ratio and the faster burning rate. The final tem¬ 
perature T e increases linearly with the initial temperature: 

T e = k 3 + hT 0 [17.7.3] 

where k 3 and ki are constants. 

For compact vessels the initial turbulence has only a 
slighteffectonthemaximumpressure,buthasastrongeffect 
on the rate of pressure rise.This is illustrated in Figure 17.13. 
Turbulence increases the flame speed. Nagy and Verakis 
describe experiments on methane-air mixtures where tur¬ 
bulence was created by injecting the fuel—air mixture. In 
the concentration range 8 -12 % the effective burning veloc¬ 
ity increasedbyafactorof5.Thisfactorisgenerallyknownas 
the coefficient of turbulence a. At lower concentrations a 
value of 8 was obtained for a. For elongated vessels initial 
turbulence can affect the maximum pressure. 

Scheuermann (1994) has described work on the model¬ 
ling of turbulence relevant to explosions of gas or dust in 
closed or vented vessels. He correlates the ratio of the 
laminar and turbulent burning velocities in terms of the 
velocity component u'. 

In a spherical vessel the location of the ignition source 
has a slight effect on the maximum pressure, but a marked 
effect on the rate of pressure rise. The rate of pressure rise is 
greatest for central ignition. The rate of pressure rise 
increases with the strength of the ignition source. 

17.7.4 Modelling of closed vessel explosions 

The principal case considered is deflagration in a closed 
spherical vessel. Treatments of the problem typically pro¬ 
duce relations for the pressure P, the rate of change of pres¬ 
sure (d-P/df), the radius r h of the burned gas core, the rate of 
change of this radius (dr b /df) and the burning velocity S u . 


17.7.5 Elementary relations 

These treatments make use of certain common relations 
and before describing the principal models it is convenient 



Figure 17.13 Explosions in closed vessels: effect of initial 
turbulence (Nagy and Verakis, 1983) 
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to give some of these relations. For combustion of a flam¬ 
mable gas mixture in a spherical vessel 


v 0 = v n + v b 

[17.7.4] 

m 0 = m u + m b = + m b n b 

[17.4.5] 

Wo = V o p 0 

[17.7.6] 

mu = V„p u 

[17.7.7] 

m b = Vb p h 

[17.7.8] 

^ = Wu 

[17.7.9] 

m b 

Kb ~ M b 

[17.7.10] 

AV h = -dF u 

[17.7.11] 

d mb = -Amu 

[17.7.12] 

V 

3 

117.7.13] 


[17.7.14] 


[17.7.15] 

_ m b 
~ m 0 

[17.7.16] 

* n m 0 

[17.7.17] 

1 

o^UT! 

lii 

Al-^' 

[17.7.18] 

dw b _ mu Anu 

At m b df 

[17.7.19] 

Since some authors work in mass terms and others in 
molar terms, the gas laws are needed in both forms. For 
mass specific volume v and molar specific volume v 

M 

[17.7.20] 

= R g T 

[17.7.21] 

S *-H 

[11-7.22] 

Pv = RT 

[17.7.23] 

For the total volume F 


ha 

if 

N! 

[17.7.23] 

PV = mR g T 

[17.7.24] 

PV = ttjRT 

[17.7.25] 


and specifically 


PV 0 = nJiT 

[17.7.26] 

PV U = nuRTu 

[17.7.27] 

PVb = n b RT b 

[17.7.28] 

P i 

[17.7.29] 

For the compression of gas 


Pv y = constant 

[17.7.30] 

Ppm. constant 

[17.7.31] 

= constant 

[17.7.32] 

RTP&~$fe = constant = F 

[17.7.33] 

PV l h — constant = F 

[17.7.34] 

For a spherical flame front 


A n = Anri 

[17.7.35] 

^ Ai 
d r h 

[17.7.36] 

dm h 

~AT = AfPaSa 

[17.7.37] 

dr b „ 
dF = S 

[17.7.38] 

SP 

II 

+ 

[17.7.39] 

SP 

I 

bi 

[17.7.40] 

P b «u Tf 

[17.7.41a] 


where a is the radius of the spherical vessel, A f is the area 
of the flame front, E is the expansion ratio, m is the mass of 
gas, M is the molecular weight, r] is the fractional degree 
of combustion, n (with subscript) is the number of moles of 
gas, P is the absolute pressure, r is the radius, R is the uni¬ 
versal gas constant, R g is the mass basis gas constant, S f is 
the flame speed, S u is the burning velocity, t is time, T is the 
absolute temperature, m n is the velocity of the unburned 
gas into the flame front, v is the specific mass volume of the 
gas, Fis the total volume, y is the ratio of gas specific heats, 
v is the specific molar volume of the gas, p is the mass 
density and the subscripts b, o and u denote burned, initial 
and unburned, respectively. Vo is the volume of the vessel 
and mo the mass of gas in the vessel. The subscript i refers 
to the initial state of the burned gas and j to any gas state. 
The area A n is the ideal (geometric) area normal to the 
flame direction. The actual flame area of the wrinkle and 
folding flame front, Af, is a multiple a (where a > 1) of A n . 
Expanding the definition of the expansion ration, E, 
Equation 17.7.41 using Equation 17.7.7 and 17.7.8: 




17/40 EXPLOSION 


Substituting for volume from the ideal 
17.7.23 

Vb_ mbTbMaPo 
V u ~ «u T a M b P b 


law, Equation 


[17.7.41c] 


17.7.8 Flock and Marvin model 

Fiock and Marvin (1937a,b) derived the following equation 
for the burning velocity: 


_ d r b a 3 - ^ dP 
“ df 3 PyX df 


[17.7.50] 


F = MuTbPo 
M b T u P b 


[17.7.41d] 


In an unconfined explosion, approximated by a vented 
enclosed explosion, the pressure ratio P 0 /P b is approxi¬ 
mately unity and E is approximately: 


E 


Mi 7b 
M b T u 


[17.7.41e] 


17.7.9 Lewis and von Elbe model 

Another early treatment was that of B. Lewis and von Elbe 
(1951) (also Manton, von Elbe and Lewis, 1953). Starting 
with Equation 17.7.33 and the relation 

V° = * (n e £ T bP dn + noT u ( 1 - »)) [17.7.51] 


The molecular weights of burned and unburned gases are 
constant, as are the initial temperature and adiabatic flame 
temperature, so the expansion ratio is constant in a con¬ 
stant pressure explosion. 

Use is also made of the approximations 
r b = Sft [17.7.42] 

[17.7.43] 


17.7.6 Zabetakis model 

Zabetakis (1965 BM Bull. 627) has given the following 
equation for the pressure rise resulting from combustion in 
a closed spherical vessel: 


AP _ KS*t 3 

P 0 = _ r 


[17.7.44] 


A P = P-P 0 

where A is a constant. Hence, 
P i 

Po V 


[17.7.45] 

[17.7.46] 


According to Nagy and Verakis, Equation 17.7.44 is in the 
first instance an empirical one, but both they and other 
workers have derived it theoretically, as described below. 
Differentiating Equation 17.7.46 gives 


dP _ 3KP 0 $f 
df 

For a given explosion pressure f tx F 1/3 and hence 


[17.7.47] 


F 1 / 3 = constant 


[17.7.48a] 

[17.7.48b] 


Equations 17.7.48 are usually applied to (dP/dt) max but are 
strictly applicable only where (dP/df) is measured at the 
same pressure in each volume. 


17.7.7 Flamm and Mache model 

In one of the earliest treatments of the problem, Flamm and 
Mache (1917) derived the equation 


RT 0 P e -P 

P7u(y b — 7 u )/(y u — 1) +K(y b — 1) P 0 


[17.7.49] 


where A is a constant and the subscript e denotes the end. 


where T bP is the absolute temperature corresponding to 
pressure P, they derive Equation 17.7.49 of Flamm and 
Mache. 

Then, from Equation 17.7.49 for n = 0,7], =T a and P = P 0 
and noting that for practical cases 


RT 0 (y b - y u )/(y a - l)«K(y b - 1) [17.7.52] 


they derive the following approximation 
_ P-P 0 
” " P e - Po 


[17.7.53] 


Equation 17.7.53 is often used in the differential form 


dw _ 1 dP 

df “ P e - Po df 


[17.7.54] 


For the burned gas core they define two radii: r { the radium 
before ignition of the gas and r b the radius after expansion. 
Then utilizing Equation 17.7.19 for the radius before 
expansion 


[17.7.55] 


and utilizing Equations 17.7.17 and 17.7.27 for the radius 
after expansion 

n 0 RT u (l - n) 
p 


[17.7.56] 

(i P ° T »n 

n, PTo (' 

-«)* 

[17.7.57] 

Fi p ° r u ff 
r * pt 0 [p, 

S)] W 

[17.7.58] 

with 



1 


[17.7.59] 

For the burning velocity, the volume of a: 

n element of the 


shell of the burned gas core before expansion is 


Anrf dr; 


[17.7.60] 


at P; and T;, and the volume after expansion is 


-HW) 


[17.7.61] 
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But this volume is also equal to 

inr^Sa At [.17.7.62’ 


Equating Equations 17.7.61 and 17.7.62 and applying 
Equation 17.7.59 




[17.7.63] 


17.7.10 O’Donovan and Rallis model 

The following treatment by O’Donovan and Rallis (1959) 
supplements those of the last two sets of workers. From 
Equations 17.7.17,17.7.24 and 17.7.32 

V, = V 0 (1 -«)(5) V,U [17.7.64] 

From Equations 17.7.15 and 17.7.64 

7 b = 7o [l-(!-«)(J) VrU ] [17.7.65] 

r /p\ v-tA 1/3 

* = « 1-(1 "«)(/) [17.7.66] 

or rearranging Equation 17.7.66 

Equating the volume rate of change of the unburned gas 
passing through the flame front with that of the unburned 
gas in its actual state of adibiatic compression 


4 ^ = 4^(5)(tS) 

|17.7.68] 

Hence 


*-s mr 

[[17.7.69] 

Also from Equation 17.7.19 


d n 3rf dr; 
df a 3 d t 

[17.7.70] 

From Equations 17.7.69 and 17.7.70 


a 3 (P 0 \ llr ‘dn 
^~3*i\p) dt 

[17.7.71] 


Then noting that in Equation 17.7.67 both r h and P are 
functions of time and differentiating n in that equation 
with respect to t and substituting for dn/dt in Equation 
17.7.71 gives Equation 17.7.50 of Fiock and Marvin. 


17.7.11 Nagy and Verakis model 

Nagy and Verakis (1983) give treatments for both ideal gas 
and adiabatic expansion. Their starting point is the rate of 
production of the burned mass. Assuming M b = M a , 


dw b 
~dt 


a AAP 
RT U 


[17.7.72] 


where a is a flame area factor which allows for the differ¬ 
ence between the nominal area of the flame front and 


the actual area, which is higher due to flame wrinkling. 
Also 


M b T u _ P 0 

Mn%~¥ e 


[17.7.73] 


From Equations 17.7.27 and 17.7.28, differentiating with res¬ 
pect to t and assuming M b = M u so that dnjdt = -dn b /dt 

V%-^f(Rn-RT n ) [17.7.74] 

From Equations 17.7.72-17.7.74 

i™* 

In order to integrate Equation 17.7.75 it is necessary to 
express A t as a function of P. From Equations 17.7.15 and 
17.7.35 


/3K\ 2/3 

* = [17 - 7 - 7 ^ 

and from Equations 17.7.5,17.7.9,17.7.10, 17.7.27 and 17.7.28 
and again assuming M h = M u so that n 0 = Wu+ n h 
l-PJP 

Vh=v Wm [17 - 7 - 77 i 

From Equations 17.7.75,17.7.76 and 17.7.77 

dP = (pe _ Po)1/3(1 _ p o/p) 2/ 3p [17.7.7a] 

Integration of Equation 17.7.78 is difficult, but an approx¬ 
imate solution over a limited range is 


P = P„+(P e -Po) 

Po<P< 2/’,. 




[17.7.79] 


Equation 17.7.79 is similar to Equation 17.7.46 of Zabetakis. 
Equating the two equations gives the value of the constant 
K in the latter equation as 


[17 - 7 - 80] 

The authors also treat the adiabatic case, which leads to 
rather complex relationships. 


17.7.12 Model of Perlee, Fuller and Saul 

Perlee, Fuller and Saul (1974 BM RI 7839) have derived 
Equation 17.7.46 and have determined the value of the con¬ 
stant K. Differentiating Equation 17.7.27 with respect to n b 
and Equation 17.7.28 with respect to n b 

V u dP + P dV u = RT U d» u + Rn u dT u [17.7.81] 


V b dP + P dF b = RT h dn h + Rn h dT b [17.7.82] 


dP[7 0 (l-a u ) + F b (a u -a b )] 

*-ir[r h -T a (g]«to u [17.7.83] 
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y u — 1 

[17.7.84] 

7b 

[17.7.85] 

But from Equations 17.7.9,17.7.12,17.7.35 and 17.7.37 

— - -4;t^^ 
df ^ M a 

[17.7.86] 

Then from Equations 17.7.83 and 17.7.86 


dP 3y u P(P - l)S^g 

[17.7.87] 

with E as defined by Equation 17.7.41 or alternatively 

F M u T h 

M b T n 

[17.7.88] 

then from Equations 17.7.40,17.7.42 and 17.7.87 


dlnP 3y u P(E-l) (S u Ety s 

[17.7.89] 

Integrating Equation 17.7.89 


ln(£) =^-l)(!)^ 

[17.7.90] 

Introducing the approximation 


, (P 0 + AP\ AP 

ln (—j"TV 

[17.7.91] 


[17.7.92] 

KS 3 P 

JT* F 

[17.7.93] 

with 


K = ^nE\E- l)y u 

[17.7.94] 

17.7.13 Harris model 

An alternative relation for the rate of pressure rise is 
derived by R.J. Harris (1983). From Equations 17.7.8 and 
17.7.37 where is the radius of the vessel 

t/ ^Pb | dVb /i n 

[17.7.95] 

dV], dF b dr b ,dr b 

W = ^ b ^t =An ^ = A ^ 

[17.7.96] 

Then from Equations 17.7.36,17.7.38, and 17.7.95 


V b ^ + Pb A n S i =A fPu S a 

[17.7.97] 

But initially dP/df is small and so is dp b /df. Hence Equation 
17.7.97 reduces to 

of 

.Tlj 

II 

[17.7.98] 

s= txESv 

[17.7.99] 


which relates the flame speed to the burning velocity. The 
coefficient of turbulence, a, relates A f to A n . 

Initially, when the pressure rise is low, it is possible to make 
the assumption that T u and T b are constant, termed by the 
author the isothermal assumption. Then differentiating 
Equations 17.7.27 and 17.7.28 and adding the resulting 
equations and utilizing Equation 17.7.4 and 17.7.12 gives 


dIP (RT h RT u \Am b 
d t VM> Ma) At 


[17.7.100] 


From Equations 17.7.7,17.7.37,17.7.27,17.7.98 and 17.7.100 


V^ = A f P(E-l)S u 

[17.7.101] 

From Equations 17.7.35,17.7.40,17.7.42 and 17.7.101 


dP 4nPS 3 E 2 (E - l)f 2 
df “ V 

[17.7.102] 

Integrating Equation 17.7.102 


P A^ 2 (P-l)(a^f) 3 \ 

|y _exp l 3v j 

[17.7.103] 


For a spherical vessel of radius a: 



[17.7.104] 


17.7.14 Bradley and Mitcheson model 

D. Bradley and Mitcheson (1976) derive what they call a 
universal expression for the rate of pressure rise. From 
Equations 17.7.8, 17.7.12, 17.7.35 and 17.7.37 they obtain for 
the unburned gas 

-3t%p a Su [17.7.105; 

and for the burned gas 

= 3^p u S„ [17-7.106] 

From Equations 17.7.31 and 17.7.105 it can be shown that 


d P _ 3rgy u P /dr^ \ 


[17.7.107] 


which can be rearranged to give Equation 17.7.50 of Fiock 
and Marvin (1937a,b). 

From Equations 17.7.4,17.7.5,17.7.7,17.7.12,17.7.27,17.7.31, 
17.7.35 and 17.7.37 Bradley and Mitcheson derive 


dP 
At ' 




y^Pe-pf 3 

Pe-PoJ 


[17.7.108] 


They also give Equation 17.7.108 in dimensionless uni¬ 
versal equation. 


17.7.15 Morton and Nettleton model 

Morton and Nettleton (1977) give the following treatment. 
Consider an element of the burned gas shell of inner radius 
r and outer radius r + 8r. If the shell is moving with velocity 
u{r), then after time 8t the inner radius is equal to 


■ + « df 


[17.7.109] 
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and the outer radius is equal to 
^ dr') dt 


( dw 

l A“ + ** 


The initial volume of the element is 

V = 4nr 2 dr [17.7.111] 

After time dt the area of the shell is 

4n(r + u dt) 2 [17.7.112] 

and the thickness is 

jr + $r[» + ^,5r)Jdfj —(r+«df) [17.7.113a] 


K 1 + S d/ 


P fdu 2 u\ 
U = -\dr + T) 


_ 1 /a 3 - 

‘ 1_ 3y : H r 

-r dP 
12 3-/ 2 P dt 


From Equations 17.7.118-17.7.120 
dP = Zy^SniE- 1) 

Equating Equations 17.7.122 and 17.7.123 gives 

dr ES u la > -(l + y 1 /Ey 2 )r> 
dt' jaP - (1 - 

Then, from Equations 17.7.123 and 17.7.124 
■jy-^Pr 2 dr 


dP = /E-iy 
dt \ E ) 


[17.7.125] 


-(l-y/Ey 2 y\dt 
Integrating Equation 17.7.125 with the boundary condition 
■pm 0; P = P„ [17.7.126] 


Subtracting the initial volume given by Equation 17.7.111 
from the volume after the time increment dt given by 
Equations 17.7.112 and 17.7.113 gives 

By logarithmic differentiation of Equation 17.7.30 

' 177115 i 

Hence, from Equations 17.7.114 and 17.7.115 
ldP^ 

Pdt ~ 

Integrating Equation 17.7.116 with the boundary conditions 
r = a; m = 0 [17.7.117a] 


where the subscripts 1 and 2 denote unburned gas and 
burned gas, respectively, gives 


Po sp’-a- 


71 /Ey 2 yj 


[17.7.127] 


[17.7.118] 

[17.7.119] 


Now consider a stationary flame front with a flow of 
unburned mixture into the front and of burned mixture 
away from the front. By conservation of mass 
u 1 -u 2 = {E-l)S a [17.7.120] 

From the definition of burning velocity S u 


The authors point out that their model is not formulated 
in terms of the rate of flame spread. It gives the maximum 
pressure as a function of the expansion ratio, but not 
explicitly of the burning velocity. However, the expansion 
ratio increases with burning velocity, since it increases 
with flame temperature, which in turn increases with 
burning velocity. 

17.7.16 Fairweather and Vasey model 

The Fairweather and Vassey model (1982) develops a full 
treatment of a transient explosion in a totally confined or 
vented enclosure. It treats spherical, cubical or rectangular 
enclosures. The authors’treatment of venting and transient 
pressure build-up with incomplete venting typifies an 
approach generally adapted subsequently (for example Yao, 
1974). Although the model is thorough, it is not yet suitable 
as a basis for explosion vent sizing because it depends on an 
empirical treatment of flame speed and flame acceleration 
(Harris, 1983, p. 77). 

The treatment by Fairweather and Vasey (1982) makes 
allowance for two features not usually taken into account. 
One is the fact that due to the existence of dissociation 
reactions the polytropic assumption, though valid for 
the unburned gas, is not valid for the burned gas. The other 
is heat loss to the vessel by radiation. They give the heat 
balance 

m u U a + m h U b -Q= m 0 C n - [17.1.128] 

with 

R(T U - T 0 ) 


U n = 


(7u-1)Mu 


[17.7.129] 


From Equations 17.7.118 and 17.7.121 


[17 - n21] u =h M Tb ^4 
b b 


[17.7.130a] 


d P _ ■jyjr 2 (dr \ 
df ~ a 3 - r 3 [dt V 


[17.7.122] 


where C n is the calorific value of the mixture, h is the 
enthalpy, Q is the thermal energy lost from the burned 
products and [/is the internal energy. 
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The heat loss, Q, is found by assuming that the gases and 
the surface of the vessel are grey bodies. The rate of heat 
loss as given by Hottel and Sarofim (1967) is: 


dQ 

df 


a s A h c{T * - Ip 

[j+fKi- 1 )] 






2E b -E w 


[17.7.130b] 


[17.7.130c] 


where E b , E u , and E w are the emissivities of the burned 
gases, the unburned gases and the wall respectively and a is 
the Stephan Boltzman constant. Equation 17.7.131 is inte¬ 
grated numerically and the heat balance Equation 17.7.128 
is solved implicitly for the burned gas temperature, T B . 

The vent rate of burned and unburned gas is found from 
the ideal gas venting equations. At low pressure (when 
venting is adequate), P/P a is less than the choke pressure 


P 

P a 


[17.7.130d] 


and venting flow m, (split between burned, m bY and 
unburned gases, w uv ) is subsonic and: 


cylindrical symmetry. This approach was used also by 
Chappell (1973) who maintained the flame radius constant 
at the point where the geometry changes. This procedure 
leads to a discontinuity in the pressure profile. This dis¬ 
continuity need not occur if the burned volume is kept 
constant instead of the flame radius. 

Treating the flame geometry as a truncated sphere 
allows finding the area burned and unburned gases pas¬ 
sing the vent area. This is used to find the relative vent 
volume of burned and unburned gases. 


17.7.17 Singh model 

The foregoing models are for spherical vessels. A treatment 
which covers cylindrical geometries also has been given by 
J. Singh (1988b). From Equations 17.7.7,17.7.12 and 17.7.37 


d P 
d t 


VudPvY 1 

P a dPJ 


[17.7.131] 


By logarithmic differentiation of Equation 17.7.31 


d P = P_ 
d P fP 

Hence from Equations 17.7.131 and 17.7.132 


[17.7.132] 


dP * c (Vu dF u V 
d*" ' AfSa {y u P + 6Pj 


[17.7.133] 



[17.7.130e] 

In the event that venting area is inadequate and the pres¬ 
sure in the enclosure exceeds the choke pressure; flow is 
sonic and: 


Equations 17.7.6,17.7.7,17.7.17 and 17.7.31, writing the latter 
in the form 





[17.7.130f] 


[17.7.135] 


The mass remaining in the enclosures at any time is: 

Wu + m b = m 0 - (m m + w bv ) [17.7.130g] 


K=F 0 (1 -»)(J)‘ 


[17.7.136] 


The pressure in the vessel is assumed equal for the burned 
and unburned gases. The pressure of the unburned gases is 
compressed isentropically from its original volume using: 

Fu=F 0 ^(£) 1/r " [17.7.130h] 


'P\m^v 0 m» 

So) %m 0 


[17.12.152] 


Differentiating Equation 17.7.136 with respect to P and 
combining the result with Equation 17.7.133 gives 


dP_ AA fP o y tt fdny' 
d t V 0 [PJ ^dpj 


[17.7.137] 


In order to solve Equation 17.7.137 it is necessary to have 
a relation between P and n. A simple approach is to use 
Equations 17.7.4,17.7.6,17.7.8 and 17.7.16, which gives 

F u = F„(l - n/a) [17.7.138] 


The model is completed using the ideal gas equation of 
state 17.7.23 for the burned and unburned gases. 

In order to determine the mass burning rate, the model 
must calculate the flame area, A ir from the volume of burnt 
gas at each time step. Inside a rectangular box enclosure, 
when the spherical flame reaches the enclosure walls, the 
volume takes the form of a sphere minus truncated spheri¬ 
cal caps. Once the flame reaches an enclosure edge where 
the walls join, the flame may be assumed to expand in 


« = Pb/Po 

Then, from Equations 17.7.136 and 17.7.138 


.( (p/PqT- i 

MP/Po) a - a 


;) 


[17.7.139] 


[17.7.140] 
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There remains, however, a difficulty in that p b , and hence a, 
varies throughout the burnt gas region. Again, it is neces¬ 
sary to adopt a simplified approach. From Equations 
17.7.23b for the burnt gas 


_ ( M bP\ 

’ b - \R7tJ 

-(t) 


at the end of combustion 


-(* 


%p\ 


Then, from Equations 177140 and 177145 




r b s|[l-(l-») 
From Equation 17.7137 
Su 




\d P) UtJ 

Then, from Equations 17.7.148 and 17.7.149 


r s (P 0 /PY‘ 


3[1 - (1 - n)(P 0 /P) a f 3 Vd P)\At 




a cylindrical vessel with central ignition he gives the 
following treatment. Initially, the flame expands symmet¬ 
rically in all directions. When the radius r b , of the flame is 
approximately equal to the radius r c of the vessel, the 
flames begins to distort. It is assumed that the flame front 
then separates into two parts and that these two parts of 
the flame front then travel as two hemispherical shells 
of radius r c in opposite directions until they reach the ends 
of the cylinder. For the first stage of this process substitut¬ 
ing for n from Equation 17.7.146 into Equation 17.7.150 gives 


where M is the mean molecular weight. 

Hence from Equation 17.7.139 and noting that for a closed 
volume pb = Pe 

-m) 

One simplification of Equation 17.7.143, where M b a 






Vd Pj 

[17.7.151] 




a(P - P/P e )P( a ~ 1 '> - (P 8 - lXaPt 8 - 1 ) - 1/P e l 

(P«-P/P e ) 2 J 




In fact the values of n obtained from Equation 17.7.144 differ 
only slightly from those obtained from the further simpli¬ 
fication 


So far the treatment is general with respect to vessel 
geometry. For a specific geometry it is necessary to char¬ 
acterize the area of the flame front A t . Consider first com¬ 
bustion in a spherical vessel. For this case 

(~f- (t) I 17 - 7 - 14 ^ 

Combining Equations 17.7.4,17.7.136 and 17.7.147 

/ §) a ] ^ [17.7.148] 


P = y o [17.7.153] 

Pc = p o [17.7.154] 

7 = ^ [17.7.155] 

Gi = 3 [17.7.156] 

where the overbar denotes ‘dimensionless’. Transition from 
the first stage to the second stage occurs at pressure P x such 


\P°-P X /PJ 


[17.7.157a] 

[17.7.157b] 


(h - .1 [17.7.158] 

where now r s is the radius of the sphere equal in volume to 
the cylinder. Hence 


[17.7.149] 


For combustion in a cylindrical vessel Singh considers a 
vessel length Land radius r c , where Z, > r c . He distinguishes 
between central ignition and end ignition, and for each of 
these cases takes a two-stage approach. For combustion in 


-(If 

For the second stage the total flame area is 

A t = in r* c [17.7.160] 

Also 

V 0 = nrfL [17.7.161] 

Then, from Equations 17.7.53,17.7.137,17.7.160 and 17.7.161 

dP_4^ ? 






[17.7.159] 


[17.7.162] 
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Integrating Equation 17.7.162 gives 
(L/r.)Pfl-> , Sift 


[17.7.163] 


G = 4 [17.7.164] 

for central ignition. The constant K x satisfies the condition 
that transition occurs at time f x where the latter is obtained 
from Equation 17.7.151. The treatment for a cylindrical ves¬ 
sel with end ignition is similar. In this case 

(sHf) 

and hence 

Equations 17.7.151 and 17.7.157 apply but with 
G = 3/2 1 / 3 
G = 2 1 / 3 

For the second stage the total area of the flame is 

Ai = 2%^ [17.7.169] 


[17.7.165] 

[17.7.166] 

[17.7.167] 

[17.7.168] 


dP 

At 


2Su 

L 


(Pe-Po) 


[17.7.170] 


Analyses of the factors bearing on gas explosions in 
buildings have been given by Mainstone (1973 BRE CP 
11/73,1976 BRE CP 24/76) and Taylor and Alexander (1974 
BRE CP 45/74). 

17.8.2 Ventilation of buildings 

Movement of air in a building may be due to natural or 
forced draught ventilation. Natural draught ventilation 
may be either thermal driven or wind driven. In the former 
case the movement of air is caused by the temperature dif¬ 
ference between the inside and the outside of the building, 
while in the latter it is caused hy the pressure of the wind on 
the side of the building. 

General guidance on natural ventilation is given in BS 
5925: 1991 Code of Practice: Ventilation Principles and 
Designing for Natural Ventilation. Typical natural ventila¬ 
tion rates are in the range 0.5-3 air changes per hour. 

Guidance on ventilation in relation to flammable and 
toxic gases is given by Leach and Bloomfield (1973,1974 
BRE CP 36/74). 

For forced draught ventilation, guidance is given in BS 
5720: 1979 Code of Practice for Mechanical Ventilation and 
Air Conditioning in Buildings. Forced draught ventilation is 
provided by fans. With forced draught ventilation rates can 
be not only higher but more dependable. 

Human comfort sets a limit to the ventilation rate which 
can be used under normal conditions. A typical rule of 
thumb is that the upper limit of the air velocity for comfort 
is about 0.5 m/s. 

There is no reason, however, why the ventilation rate 
should be limited to a low level in an emergency. In such a 
situation additional ventilation may be brought into play. 

A more detailed discussion of ventilation is given in 
Chapter 10. 


For transition, Equation 17.7.163 applies but with 
G = 2 [17.7.171] 


17.8 Explosions in Buildings 

Many process plants are in buildings. It is also necessary, 
therefore, to consider explosions occurring inside buildings. 

A leak of flammable gas or liquid may create a flammable 
atmosphere inside a building and give rise to an explosion. 
Such leaks may occur from plant processing flammable 
fluids, from activities involving such fluids or from fuel gas 
supplies. In enclosed conditions, dispersion of the leaked 
gas is poor and the hazard is therefore much enhanced. 

An area of prime concern in respect of explosions in 
buildings is the hazard of gas explosions in dwellings, and 
much of the work done relates to this. An account is given in 
Gas Explosions in Buildings and Heating Plant (R.J. Harris, 
1983). 

17.8.1 Building explosion incidents 

Statistical information on the hazard of explosions in 
buildings has been given by F. Morton (1970), Mainstone 
(1973 BRE CP 11/73,1974 BRE BR9,1983 BRE CP 2/83) and 
Taylor and Alexander (1974 BRE CP 45/74). 

A number of case histories of building explosions have 
been described by Mainstone (1976 BRE CP 24/76). One of 
the most severe building explosions was that at Ronan 
Point in 1968, which was the subject of an official report 
(H. Griffiths etal., 1968). 


17.8.3 Gas accumulation and mixing in buildings 

If a leak occurs, the part of the enclosure which is affected 
depends on the density of the gas, the height of the 
leak source and the ventilation pattern. The normal venti¬ 
lation pattern is upward flow. Harris describes experi¬ 
mental work which shows that with this ventilation 
pattern for a gas with a density lighter than air, such as 
methane, a high gas concentration tends to build up in the 
space above the leak source. This situation is illustrated in 
Figure 17.14. 

If the ventilation pattern is downward flow, which is 
rather unusual, this situation no longer pertains, and high 
gas concentration can occur below the leak source. 

For a gas with a density heavier than air with an upward 
ventilation pattern the buoyancy and the ventilation act in 
oppositive directions, and in this case a high concentration 
will tend to build up in the whole space. 

Thus, for the normal arrangement of upward flow ven¬ 
tilation the space liable to have a high gas concentration 
should be taken as the space above the leak for a light gas 
and as the whole space for other gases. 

For practical purposes, the space liable to have a high 
concentration may be assumed to be perfectly mixed, and 
the gas concentration in the space may be determined from 
the equation for a single, perfectly mixed stage, which may 
be written for this case as 

t^ = Q-C [17.8.1] 
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Figure 17.14 Concentration from a leak of gas lighter 
than air under conditions of upward ventilation (after 
R. J. Harris, 1983) (courtesy of British Gas) 


Q = Q g /Q [17.8.2] 

Q = Qg + Qa [17.8.3] 

f.ss V/Q [17.8.4] 

where C is the volumetric concentration in the space, C; is 
an effective inlet volumetric concentration defined by 
Equation 17.8.2, Q is the total volumetric flow rate, Q a is the 
volumetric flow of air, Q s is the volumetric flow of con¬ 
taminant gas, t is the time, Fis the volume of the space and 
t is the volume/throughput ratio, or time constant. 

Then for an increase in concentration starting from the 
time of release 

C c a-exp(.;) [17.8.5] 

and for a decrease in concentration starting from cessation 
of the release with a concentration C 0 at that time 



In this latter case the value of Q to be used in Equation 

17.8.3 is Q = Q a , since Q g = 0. 


17.8.4 Some structural features of buildings 

Much of the work done on explosions in closed contain¬ 
ments applies to vessels. There are some significant differ¬ 
ences between vessels and buildings. 

A building is generally rectangular in shape and the 
volume enclosed is relatively large. The increase in size and 
in aspect ratio compared with a vessel can create difficul¬ 
ties in scaling up correlations developed for small compact 
vessels. Moreover, phenomena which are relatively insig¬ 
nificant on the smaller scale can become important on the 


The space in a building tends to contain obstructions. 
There are usually multiple compartments which are con¬ 
nected to each other. The presence of obstacles will tend to 
increase turbulence. So also will the existence of multiple 
compartments, since gas flowing through open internal 
doorways will generate turbulence. 

The building itself is generally not very strong. An 
explosion pressure of 7 N/m 2 (1 psi) is often quoted as that 
at which a typical brick building may be destroyed. On the 
other hand, a normal building will have walls which con¬ 
tain weaker members which will fail and in so doing pro¬ 
vide vents so that the explosion pressure does not rise as 
high as it otherwise would. 

The static pressures at which certain building compo¬ 
nents fail have been given by Rasbash (1969c) and Astbury 
et oL (1970) and are quoted by Lunn (1984b). Some typical 
values are: 


Failure pressure (kN/m 2 ) 


Windows (normal) 

3-4.6 


Windows (strained) 

1, or even 

0.2 

Chipboard (19 mm) 

7 


Brick wall (114 mm) 

Survived 

at 23, destroyed at 35 

Brick wall (228 mm) 

Survived 

at 70, destroyed at 105 


It has been suggested by Buckland (1980) that the explo¬ 
sion pressure should not exceed 21 kN/m 2 if the building is 
to avoid serious damage. 

Another relevant feature is the natural period of the 
building. Rasbash (1969c) quotes a value of 40 ms as a 
typical natural period for the slabs and floors of a building. 
W.B. Howard and Karabinis (1980) give further details of 
natural periods. See also TNO Green Book (1989, p. 34). 
Structural damage to buildings from explosions is con¬ 
sidered in more detail in Section 17.32. 

17.8.5 Gas explosions in buildings 

Some features of gas explosions in buildings have been 
discussed by Rasbash (1969c). The maximum unvented 
pressure created in an unvented building by the explosion 
of the most explosive gas mixture is of the order of 7 bar. 
A 30 m 3 room requires about 2.5 kg of fuel to give such a 
mixture. The energy of this fuel is equivalent to some 20 kg 
of TNT. 

The pressure from such an explosion will build up rela¬ 
tively gradually, giving a duration of several hundred milli¬ 
seconds compared with about 1 ms for a condensed phase 
explosion. Rasbash quotes for a vented explosion with low 
turbulence a typical duration of 300 ms. But he also gives 
for the explosion of the most explosive mixture of town gas 
with high turbulence a duration in the range 20-150 ms. 

An account of experimental work on venting of gas 
explosions in buildings has been given by WB. Howard and 
Karabinis (1980,1982). They state that the durations of the 
explosions were in the range 40-150 ms. Experimental 
pressure-time profiles showed that the pressure impulse is 
well approximated by a triangle with equal rise and decay 
times. 

17.8.6 Modelling of gas explosions in buildings 

The pressure in deflagrations in a closed system was con¬ 
sidered in Section 17.7. The treatment given there is applic¬ 
able in broad outline to an explosion in a building, but, as 
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indicated above, there are some important differences. The 
model of R.J. Harris (1983) described in that section is for 
explosion in a building, and gives the pressure and rate of 
pressure rise during the initial stages of the explosion. 

Most of the models available for explosions in buildings 
are for vented explosions. These are considered in Section 
17.14. One of these is the model of Runes (1971,1972). The 
Runes equation is intended for the design of explosion relief 
for a building. It has been used, however, by W.B. Howard 
(1972) to estimate the explosion effects in an explosion 
incident in a building with open vents. 

17.8.7 Condensed phase explosions in buildings 

Experiments in whichTNTcharges were detonated inside a 
chamber have been described by Weibull (1968). The work 
was done to develop a nuclear blast simulator in which it 
would be possible to obtain arbitrary values of peak pres¬ 
sure and duration of the blast wave. The chambers used 
were provided with a variable vent opening. 

Weibull states that in this system the peak pressure 
would be determined mainly by the mass of the explosive 
and the duration mainly by the area of the vent opening. 

The pressure measured showed several very high initial 
spikes of very short duration which were reckoned to have 
minimal effect on the heavy walls of the chamber. The 
pressure, which had a long duration relative to the period 
of the walls, was taken as the blast load acting on them. 
The area of the vent opening had insignificant effect on the 
smoothed peak pressure. This pressure was given by the 
equation 

p = K{m/V) a 117.8.7} 

where p is the peak pressure (bar), m is the mass of explo¬ 
sive (kg), V is the volume of the chamber (m 3 ), if is a con¬ 
stant and a is an index. The value of K is 22.5 and that of a 
is 0.72. Further information on pressures in enclosures 
estimated as a function of aTNTequivalent charge is given 
in Section 17.26 in the context of design of barriers. 


17.9 Explosions in Large Enclosures 

The type of large enclosure which is envisaged here is 
exemplified by an offshore module. It is with such enclo¬ 
sures that the account given in this section is primarily 
concerned. 

An offshore module tends to have a high aspect, or 
length/diameter ratio, and to contain a number of obstruc¬ 
tions in the form of equipment and pipework. 

The overpressure generated in the combustion of a 
vapour cloud is due to two effects. One contribution to the 
overpressure comes from the production of a large quantity 
of hot burned gas, the volume production. The other is due 
to the effect of the flame speed. The overpressure which 
might occur due to the volume production would be up to 
about 8 bar, whereas the overpressure due to the flame 
speed effect might have any value up to that associated 
with a detonation. 

Much work has been done on the development of explosion 
overpressures in vapour clouds. This work has shown that 
in the part of the cloud that is free of obstacles the flame 
speed is relatively low. If the flame passes first through a 
region which is unobstructed, then through one which is 
obstructed and finally through one which is unobstructed, 
the flame accelerates on entering the obstructed region and 


decelerates on leaving it. The flame speed in the obstructed 
space can reach quite high values. 

Merc X (1992,1998) conducted experiments in which two 
congested areas, each 2 m wide, are separated by an open, 
uncongested area of width 0.5,1 and 2 m. He found that if 
mostly small-sized piping creates the turbulence, the decay 
is rapid and the flame speed reaches a low level within a few 
metres. Otherwise, more than 3—5 m may be needed for the 
flame speed to slow to non-damaging levels. 

17.9.1 Experimental studies 

Work on the generation of overpressures in vapour clouds 
has been done primarily in connection with the explosion of 
vapour clouds in the open. This work is described in Sec¬ 
tion 17.28. Most accounts of explosion in semi-confined 
spaces derive from, or are closely related to, this work. 

An account of the experiments to determine the over¬ 
pressures which might be generated in an offshore module 
was given by Vasey (1989) in evidence to the Piper Alpha 
Inquiry. The experimental rig used consisted of an enclo¬ 
sure 46.5 m long, 5 m wide and 4 m high with one end con¬ 
sisting of a confined section, a long box, with an open end, 
and then an open section, a gallery enclosed only by 
transparent polyethylene sheet to contain the gas mixture. 
Obstacle array supports were located every 1.5 m along 
both the confined and the open sections. The obstacles 
consisted of 3 m lengths of 0.18 m pipes or 0.18 m wide 
planks. The flame speed was sufficiently high so that 
venting to the side through the sheet did not occur and high 
overpressures were attained. 

Work was done using both natural gas—air and 
propane-air mixtures. With a natural gas mixture a flame 
speed of 500 m/s was obtained and the overpressure was 
several bar. With a propane mixture the flame accelerated 
to detonation, and the overpressure, both measured and 
calculated, was about 18 bar. 

17.9.2 Simulation models 

Several models have been developed to simulate the devel¬ 
opment of an explosion in a semi-confined space such as an 
offshore module. 

The FLACS model of the Christian Michelsen Institute 
(CMI) is a computational fluid dynamics (CFD) model 
which solves the fundamental equations of fluid flow tak¬ 
ing account of turbulence and combustion. The three- 
dimensional Navier-Stokes equations, suitably amplified 
to include the effects of turbulence and combustion, are 
cast in discrete form, employing a finite volume technique, 
and are solved implicitly. Thrbulence is modelled in terms 
of eddy viscosity, and combustion in terms of turbulent, 
mixing-limited reaction. The space modelled is divided into 
a grid of ‘boxes’ of volume 1 m 3 . Normal assumptions are 
that the flammable gas cloud is a quiescent homogeneous 
stoichiometric mixture so that the effects of any con¬ 
centration differences within the gas cloud, any ventilation 
air flow or a continuing leak source are neglected. Ignition 
is modelled as a weak ignition source by assuming that at 
time 0 half of the flammable mixture in one of the boxes 
has undergone combustion so that the temperature of the 
gas in the box is correspondingly increased. Accounts of 
the model have been given by Hjertager (1982a) and by 
Bakke, Bjerkevedt and Bjorkhaug (1990). 

The CLICHE model of British Gas is based on a spherical 
flame front. It was originally intended for use in simulating 
explosions in vessels with a high degree of confinement and 
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low flame speeds, but has been extended to allow simula¬ 
tion of different geometries and flow conditions. It has been 
used to investigate flame acceleration through obstacles 
and the generation of overpressures much higher than 
those for which it was originally intended. An account of 
the model has been given by Catlin (1990). 

CFD modelling is discussed further in Section 17.28 in 
relation to vapour cloud explosions. 

17.9.3 Computer codes 

There are several computer codes based on simulation 
models of the type just described. 

These codes include FLACS at the CMI (Bakke, Bj erkevedt 
and Bjorkhaug, 1990), EXSIM (Hjertager etal., 1994), CLICHE 
at British Gas (Catlin, 1990) and, at theTNO, BLAST (van 
den Berg, 1980) and REAGAS (van de Berg, 1989). 

The FLACS suite of codes comprises a front end program 
CASD which captures details of the structure of the module 
and the equipment in it, a program which processes this 
information into a form in which it can be utilized by the 
main program, the FLACS code proper. 

The FLACS code has been validated by comparison of 
the results of code simulations with measurements made 
in experiments on explosions in scale models of modules 
with 1: 33 and 1: 5 scale. The overpressures predicted 
by the code lie within ±30% of those in the model experi¬ 
ments with perhaps 1 case in 20 lying outside this range, 
corresponding to a confidence level of some 95%. The 
variability of the model experiments themselves is of the 
same order. 

The FLACS code was used at the Piper Alpha Inquiry to 
investigate the overpressures which would have resulted 
from an explosion in one of the modules, as described 
in Appendix 19. Results from CLICHE were also given in 
evidence. 

Plate 28 illustrates typical output from the FLACS code, 
showing the contours of the unburnt fuel, the burnt com¬ 
bustion products and the overpressures and the wind 
velocity vectors. 


17.10 Explosion Prevention 

Prevention of gas and vapour explosions in general 
depends on (1) avoidance of flammable mixtures and 
(2) elimination of sources of ignition. These general 
requirements for explosion prevention have already been 
discussed. 

For plant, or closed, systems an important method of 
eliminating flammable mixtures which merits further 
consideration is (3) atmosphere control. This is discussed 
below. 

Other aspects of explosion prevention which have 
already been discussed include avoidance of runaway 
chemical reactions and excessive fluid pressures. 

Selected references on explosion prevention, protection 
and relief are given in Table 17.13. 

17.10.1 Atmosphere control 

The hazard of explosion can be much reduced by control of 
the atmosphere to render it non-flammable. This control is 
often effected by the use of an inert gas. 

The atmosphere control of process plant has been dis¬ 
cussed by Craven (1975). An account of inerting in tankers 
has been given by Halvorsen (1975). 


Table 17.13 Selected references on explosion 
prevention, protection and relief 


SMRE (Explosion 4); J.H.F. Smith (1956): Maisey (1957); 
Ghormley (1958); Burgoyne (1961); Grabowski (1964); 
Adcock and Weldon (1967a); Charney (1967); Allan and 
Athens (1968); Bartknecht (1968,1974a, 1981a); Callahan 
(1968); E. Cohen (1968); Jarrett (1968); Constance (1971b); 
Conrad (1973); Donat (1977b); Grein (1973); K.N. Palmer 
(1973a); Franke etal. (1975); Funke (1976); R.L. Allen 
(1977a); Carver etal. (1977); Glatt (1977); Rogowski (1977); 
Schampel and Steen (1977); Ray (1978); P.E. Moore (1982a,b, 
1990); IBC (1983/41,1984/47,49 Pt 1); Haessler (1986); Huff 
(1988); Nazario (1988); I. Swift (1988c); FPA (1989 CFSD FS 
6012); Haverstad (1989);Tuhtar (1989);Vodyanik (1990); 
NFPA (1992 NFPA 69,1994 NFPA 68) 

CCPS guidelines: Huff (1992) 

Flame arresters 

FRS (n.d.. Fire Res. Note 1037,1967 Fire Res. Note 658,1972 
Fire Res. Notes 931,945,1973 Fire Res. Notes 964,974); 
Radier (1939); Egerton, Everett and Moore (1953); Cubbage 
(1959,1963); K.N. Palmer (1959,1960); Joint Fire Research 
Organization (1960); Quinton (1962); K.N. Palmer and 
Tonkin (1963); HSE (1965 HSW Bklt 34); Litchfield (1965); 
K.N. Palmer and Rogowski (1967); Leineman (1970); 

H. Phillips (1972b); J.P Davies, Palmer and Rogowski (1973); 
Barton, Carver and Roberts (1974);W.B. Howard, Rodehorst 
and Small (1975); Rogowski (1975,1980); BRE (1978/8); 

R.P. Wilson and Flessner (1979); Worrell (1979); Amal Ltd 
(1980); Borger et al. (1980); HSE (1980 HS(G) 11); Peter 
(1980); Anon. (1981 LPB 41, p. 13); Bjorklund, Kshida and 
Flessner (1982);W.B. Howard (1982,1988 LPB 79,1992a,b); 
Kletz (1982c);Thorne (1982); Broschka etal. (1983); 

O.W. Johnson (1983); Lietze (1983); IMC (1984); UL (1984 UL 
525); Lunn and Przybylski (1985); H. Phillips and Pritchard 
(1986);Wilkie (1987b); Fellensiek etal. (1987); Stalder 
(1987);Watson (1988 LPB 79); Overhoff et al. (1989); Babkin, 
Korzhavin and Bunev (1991); Piotrowski (1991); Roussakis 
and Lapp (1991); Capp (1992,1994); S.P. Cooper et al. (1992); 
Rubach, Schecker and Onken (1992); Bishop and Knittel 
(1993); Mendoza, Smolensky and Straitz (1993); Siwek and 
Wegmuller (1993); G.O. Thomas and Oakley (1993 BS 7244: 
1990) 

Explosion protection 

Grabowski (1958,1968); Rentsch (1971); Yasuhara, Kita and 
Hiki (1978); Woods and Speechly (1979); Maisey (1980); J.M. 
Wilson and Tyrer (1980); Kirby (1985a); Altorfer (1992); 
Cadeddu et al. (1992); S.P. Cooper and Moore (1993); BS 
(Appendix 27 Explosion Protection) 

Pipes: HSE (1965 HSW Bklt 34); Flessner and Bjorklund 
(1980,1981); Bartknecht (1981a); O.W Johnson (1983); Steen 
and Schampel (1983); Chatrathi (1992b,c) 

Buildings: K.N. Palmer and Tonkin (1980); C.J.M. van 
Wingerden and Zeeuwen (1983); Mercx, vanWingerden 
and Pasman (1992) 

Jetties: Dicker and Ramsey (1983) 

Design against explosion 
Grein (1973); Guill (1973) 

Explosion containment 

Bartknecht (1981a); Donat (1982); Noronha, Merry and Reid 
(1982); Kirby (1985a); Kirby and Siwek (1986); Wilday 
(1991) 
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Explosion prevention by inerting 

Penland (1967); Kletz (1971); Craven (1975); Halvorsen 
(1975); O’Shea (1983); Blakey and Orlando (1984) 

Explosion isolation 

Chatrathi (1991); Chatrathi and Degood (1991) 

Explosion suppression 

Merewood (1958); Lafltte and Boucher (1959); Hammond 
(1961); Grabowski (1964,1965); Graviner (Colnbrook) Ltd 
(1966); Charney and Lawler (1967); Charney (1969); FPA 
(1974 CFSD FS 6015); P.E. Moore (1979b, 1981,1982b, 1984, 
1986,1990); J. Singh (1979c); Maisey (1980); S.R. Moore and 
Weinberg (1981); Westbrook (1982c); Hertzberg etal. (1985); 
P.E. Moore and Bartknecht (1986); P.E. Moore and Cooper 
(1993) 

Explosion suppression in modules, including water 
sprays 

G.O. Thomas, Edwards and Edwards (1990); G.O. Thomas, 
Jones and Edwards (1991); A. Jones and Thomas (1992, 
1993); Catlin etal. (1993) 

Explosion venting 

G. W Jones, Harris and Beattie (1933 BM Tech. Pap. 553); 
Bonyun (1935,1945); Creech (1941); Murphy (1944a,b); 

H. Brown (1946); Coffee, Raymond and Crouch (1950); 
Benson and Burgoyne (1951); Cousins and Cotton (1951a,b); 
Cubbage and Simmonds (1955a-c, 1957a-c); Gas Council 
(1955 GC 23,1957 GC 43); Schmidt, Haberle and 
Recklinghausen (1955); FRS (1956 Fire Res. Note 248); 
Burgoyne and Wilson (1957,1960); Grumer, Cook and 
Kubala (1959); Rasbash and Rogowski (1960a, b); 
Simmonds and Cubbage (1960); Spalding (I960); 
Westenberg and Favin (I960); D.S. Davis (1961); Raezer 
(1961); Spalding and Jain (1961); Spalding, Jain and Samain 
(1961); Block (1962); Munday (1963,1974); Philpott (1963); 
Rogowski and Rasbash (1963); Salter, Fike and Hansen 
(1963); W.H. Doyle (1964); Pliickenbaum, Strauss and Edse 
(1964); Maisey (1965); Heinrich (1966,1974); Charney 
(1967); Grein and Donat (1967); G.F.P. Harris (1967); 

G.F.P. Harris and Briscoe (1967); Woods and Thornton 
(1967); Bartknecht (1968,1972b, 1974a, 1975,1977a, 1981a); 
FMRC (1969/1,1973/ 2);Yao etal. (1969);Walker (1970); 
Decker (1971); R.L. Miller and Howard (1971); Donat 
(1971a,b, 1973a-c, 1977a,b); Cubbage and Marshall (1973, 
1974); Institution of Gas Engineers (1973 Comm. 926); 

WW. Russell (1973); Butlin and Tonkin (1974 FRS Fire Res. 
Note 1019); W.B. Howard and Russell (1974); Yao (1974,1982); 
Nettleton (1975,1978b); D. Bradley and Mitcheson 
(1976,1978); Guirao, Bach and Lee (1976); Sapko, Furno and 
Kuchta (1976 BM RI8176); Anthony (1977b, 1977-78); 
Chappell (1977); Fiumara (1977); N. Gibson (1977); Hattwig 
(1977); M.R. Marshall (1977); VM. Morton and Nettleton 
(1977); Crescitelli, Russo and Tiifano (1979a, 1980); 

J.G. Marshall (1979); Monk and Davis (1979); Rust (1979); 

J. Singh (1979b, 1984,1988a,b, 1989); O.K. Burchett (1980); 
Hattwig (1980); HSE (1980 HS(G) 11); Solberg, Skramstad 
and Pappas (1980); Zalosh (1980b, 1982); Solberg, Pappas 
and Skramstad (1981);Tufano, Crescitelli and Russo (1981); 
Fairweather and Vasey (1982); Hirano (1982,1984); 

J.H.S. Lee and Guirao (1982b); Noronha, Merry and Reid 
(1982); Porter (1982); Fearnley and Nettleton (1983); 

J.H.S. Lee (1983a); I. Swift (1983,1984,1988a,b, 1989); 
Thorne, Rogowski and Field (1983); Chippett (1984); 
Cummings et al. (1984); Eckhoff et al. (1984); Llewellyn 


(1984); Hart (1985); McCann,Thomas and Edwards (1985); 
Champion etal. (1986); M.G. Cooper, Fairweather andTite 
(1986); Degood (1986); M. Epstein, Swift and Fauske (1986); 
D.J. Lewis (1986a); Seifert and Giesbrecht (1986); Simpson 
(1986); Starke and Roth (1986,1989); I. Swift, Batz and 
Degoode (1986); Schwab (1987); I. Swift and Epstein (1987); 
de Groot and Heemskerk (1989); Kumar, Dewit and Greig 
(1989); M. Epstein et al. (1990); Itagaki, Miyake and 
Ogawea (1990); Phylaktou, Andrews and Herath (1990); 
WE. Baker, White and Hokanson (1991); Cates and Samuels 
(1991); Degood and Chatrathi (1991); Makhviladze and 
Phillipov (1991); Rota et al. (1991); Santon et al. (1991); 
Chathrathi (1992a); K. Bell and Morris (1992); Chaineaux 
and Danin (1992); Haaverstad (1992); Mercx, van 
Wingerden and Pasman (1992,1993): Parry (1992); Rota 
etal. (1992); Skouloudis (1992);Wu and Swithenbank (1992); 
Anon. (1994a); Scheuermann (1994); NFPA (1994 NFPA 68). 
Module venting: Committee for Explosion Research (1958); 
Hirano (1982); Hjertager (1982a); Moen (1982a); Solberg 
(1982a); P.F. Thorne (1982) 

Effects in outside vent system, acoustic coupling and 
instabilities: Wiekema, Pasman and Groothuizen (1977); 
K.N. Palmer and Tonkin (1980); Zeeuwen (1982); 
Kordylewski and Wach (1986,1988); A.J. Harrison and Eyre 
(1987b); I. Swift (1988c); C.J.M. van Wingerden and 
Zeeuwen (1988); Frolov, Gelfand andTsyganov (1990); 
Tamanini and Chaffee (1992a,b); Ural (1993) 

Reactor venting 

Tangren, Dodge and Seifert (1949); Gasche (1956); Block 
(1962); Sestak (1965); Boyle (1967); Harmon and Martin 
(1970); Schlegel (1972); W.B. Howard (1973); Huff (1973, 
1977a,b, 1982a,b, 1984a,b, 1985,1987,1988,1990,1992); 
Duxbury (1976,1979a,b, 1980); W.E. Baker, Esparza and 
Kulesz (1977); Kneale and Binns (1977); Gartner, 
Giesbrecht and Leuckel (1978,1980); BPF (1979); IChemE 
(1979/117); Karmarkar (1979); VC. Marshall and Cockram 
(1979); Minors (1979); J. Singh (1979a, 1988a, 1989,1990a,b, 
1992a); Townsend and Pantony (1979); Booth etal. (1980); 
Fauske et al. (1980); de Groot, Groothuizen and Verhoeff 
(1980); Mejdell (1980); Mayinger (1981); Friedel and Lohr 
(1982); Solberg, Pappas and Skramstad (1982); Friedel and 
Purps (1983,1984a,b); Steen and Schample (1983); Barton 
and Nolan (1984); Binns and Barrett (1984); Harmon and 
Stuper (1984); Quinn,Weir and Hoppe (1984); PW. Thomas 
(1984); I. Swift (1985); Giesbrecht and Seifert (1986); Schulz 
and Schoft (1986); Duxbury and Wilday (1987,1989,1990); 
Friedel and Kissner (1988); Nolan and Proctor (1988); First 
and Huff (1989); D.P. Mason (1989);Tharmalingam (1989a); 
Wilday (1989,1989 LPB 89); Banerjee, Prandini and 
Patroncini (1990); Gustin (1990); Oster, Bell and Koltowski 
(1990); Sumapathala.Venart and Steward (1990a,b); 

H.G. Fisher (1991); Skouloudis and Kottowski (1991); K Bell, 
Morris and Oster (1993); Friedel and Schmidt (1993); 
Duffield and Nijsing (1994); Goetz and Sawrey (1994); Snee 
and Hare (1994); Waldram (1994). 

Particular reactions: Crowley and Block (1989); J. Singh 
(1992a, 1994); Gustin etal. (1993); Whitmore, Cutler and 
Gladwell (1994); Yue, Sharkey and Leung (1994) 

Reactor venting: DIERS 

Fauske, Grolmes and Henry (1983); I. Swift, Fauske and 
Grolmes (1983); Fauske (1983,1984a-c, 1985a, 1987a,b, 
1988a, 1989a, 1990); I. Swift (1984); Anon. (1985g); Fauske, 
Grolmes and Leung (1984); Fauske and Leung (1985); 

H.G. Fisher (1985,1986,1989,1991); Grolmes and Leung 
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(1985); Grolmes, Leung and Fauske (1985,1989); Klein 
(1986); Leung (1986b, 1987,1992b); Leung, Fauske and 
Fisher (1986); Noronha (1986); N. Gibson, Maddison and 
Rogers (1987); Leung and Fauske (1987); Wilday (1987); 
Leung and Epstein (1988); J. Singh (1988a); M. Epstein, 
Fauske and Hauser (1989); Fauske, Clare and Creed (1989); 
Fauske, Grolmes and Clare (1989); Gustin (1989b); Leung, 
Creed and Fisher (1989); Leung and Fisher (1989); Leung, 
Stepaniak and Cantrell (1989); Noronha, Seyler and Torres 
(1989); Skouloudis et al. (1989); Creed and Fauske (1990); 
M. Epstein et al. (1990); Kirch, Magee and Stuper (1990); 
Skouloudis, Bell and Kotowski (1990); Friedel and 
Wehmeier (1991); Grossel (1991); DIERS (1992); Prugh 
(1992d); C.M. Sheppard (1992,1993,1994); Grolmes and Yue 
(1993) 

Reaction forces 

Faber (1982); Porter (1982); Beveridge (1984); Huff (1990); 
Parry (1992) 

Disposal of vented material 

Kneale (1984,1989); Faukse (1986a, 1990,1992); Grossel 
(1986,1990b); Muschelknautz and Mayinger (1986,1990); 
Keiter (1989,1992); Fauske and Grolmes (1992); Friedel, 
Schmidt and Wehmeier (1992); Hermann, Schecker and 
Schoft (1992); Parry (1992); Rupert, Muschelknautz and 
Klug (1992); J. Singh (1992b); Spatz, Drees and Schoft 
(1992); Lindsay and Rogers (1994) 

Building venting 

FRS (Fire Res. Note 820,1969 Fire Res. Note 759,760,1975 
Fire Res. Note 1026); Rasbash (1969c); Astbury et al. (1970); 
Mainstone (1971); Runes (1971,1972); Astbury,West and 
Hodgkinson (1972,1973); Dragosavic (1972a,b, 1973); W.B. 
Howard (1972,1980); Butlin (1975 FRS Fire Res. Note 1026); 
Naidus (1976,1981a,b); Rasbash, Drysdale and Kemp 
(1976); Anthony (1977/78); WB. Howard and Karabinis 
(1980,1982); Cummings et al. (1984); NFPA (1994 NFPA 68) 


In general, the use of atmosphere control is a much more 
reliable method than the elimination of sources of ignition, 
which is very difficult to achieve. Craven comments: 

The elimination of ignition sources is often promoted as 
an alternative to atmosphere control to prevent explo¬ 
sions. There are few situations in the process industries 
today in which this philosophy can be seriously defended. 

Only in the simplest situations - such as isolated 
liquid storage - can the elimination of ignition sources 
seriously compete with atmosphere control as the first 
line of defence. 

For an atmosphere which may contain flammable gas, air 
and inert gas, Craven distinguishes four regions. These are: 

Region I: flammable mixture; 

Region II: fuel-lean mixture; 

Region III: oxygen-deficient mixture; 

Region IV: fuel-rich mixture. 

The atmosphere is non-flammable in all but the first of 
these regions. Atmosphere control is often effected by the 
use of inert gas, but this is not the only option. In some cases 
it is more appropriate to operate in the fuel-rich region. 

Some operations and equipments in which atmosphere 
control is practised are (1) reactors, (2) storage tanks, 


(3) head tanks, (4) centrifuges, (5) driers, and (6) pneumatic 
conveyors. 

Generally, in an oxidation reactor the off-gas is deficient 
in oxygen. The oxygen concentration is usually analysed, 
and action is taken if it rises. This action may be to shut off 
an air or oxygen feed to the reactor or to inject inert gases. 

Such trip systems are required to act very rapidly, and time 
delays can be aproblem. There may also be difficulties in gas 
sampling due to vapour drops or solid particles. In some 
cases, therefore, other measurements, such as reactor tem¬ 
perature, may be used to complement the oxygen measure¬ 
ment by giving advanced warning of abnormal conditions. 

Storage tanks containing flammable liquids are often 
blanketed with inert gas. The quantity of inert gas required 
can be large due to the movements of the liquid surface. An 
economical system is the use of breather vacuum valves 
which admit inert gas only when the liquid level falls. 

The effectiveness of inerting in reducing the probability 
of storage tank fire/explosion has been discussed by Kletz 
(1971). 

Inert gas blanketing is also frequently provided in con¬ 
stant head tanks for flammable liquids. Difficulties are 
often experienced, however, in maintaining an inert atmos¬ 
phere in a head tank fitted with an overflow, because the 
return pipe from the overflow tank tends to act as an air 
entrainment pump. This problem can be eliminated by fit¬ 
ting suitable gas balance lines. 

An inert atmosphere is necessary in centrifuges hand¬ 
ling flammable liquids as described in Chapter 11. Again, 
the consumption of inert gas may be high due to air ingress 
during operation, but the use of gas balance lines can effect 
appreciable reductions. 

The provision of inert atmospheres in dust-handling 
plant is considered in Section 17.46. The quantity of inert 
gas used must not be excessive if inerting is to be economic. 
It is important, therefore, to seek to minimize inert gas 
consumption. 

For a perfectly mixed system the concentration changes 
effected by a ventilating air or purge gas flow are given by 
the equation 



where c is the volumetric concentration of the component in 
the system atmosphere, Q is the volumetric flow of gas 
through the vessel, t is the time, Vis the volume of the vessel 
and the subscript o denotes the initial value. Equation 
17.10.1 may be rewritten as 

logi °(£) =- fi [ma2] 

with 

E = Qt/V [17.10.3] 

where E is the number of changes of atmosphere. Thus, the 
concentration of a component in the system atmosphere can 
be reduced by a factor of 10 by 2.3 changes and by a factor 
of 100 by 4.6 changes. 

Purging can be effected more economically, however, if 
the flow regime is plug flow rather than perfect mixing. 
Plug flow can often be achieved if the vessel is one with 
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a very high aspect ratio, such as a tall column or a pipeline. 
Other situations which allow plug flow are buoyant dis¬ 
placement with a cold gas and gravitational displacement 
of a heavy vapour. 

If the density difference between the atmosphere to be 
purged and the purge gas is small, turbulent mixing is 
usually achieved. For a simple vessel such as a storage tank 
without baffles, Craven states that such mixing should be 
enhanced by the use of gas jets directed across the tank 
with final velocities in the remote corners of 300 ft/min. He 
gives the following equation for the nozzle velocity 
required to give an air velocity of 300 ft/min along the jet 
axis in the remote corners 



where D is the diameter of the jet orifice (ft), u a is the nozzle 
velocity (ft/min), u K is the required velocity (ft/min) 
(=300), X is the distance from the jet to the most remote 
corner (ft) and if is a constant (=6). 


17.11 Explosion Protection 

Explosion protection and relief include the following 
aspects: 

(1) containment; 

(2) separation; 

(3) flame arresters; 

(4) automatic isolation; 

(5) automatic explosion suppression; 

(6) explosion venting of vessels; 

(7) explosion venting of pipes and ducts; 

(8) explosion relief of buildings; 

(9) explosion relief of large enclosures; 

(10) venting of chemical reactors. 

Deflagration and detonation inside plants has been dis¬ 
cussed in Sections 17.5 and 17.6, and explosion in closed 
vessels specifically in Section 17.7. 

Protection by containment of the explosion is a potential 
design option, but as discussed in Section 17.5, it is usually 
not practicable except for small-scale plants. 

Another method of containment is the use of blast walls 
and barricades, and of blast cubicles. The design of such 
blast protection is described in the High Pressure Safety 
Code (B.C. Cox and Saville, 1975) and by W.G. High (1967) 
and CaUahan (1968). 

Separation as a method of protection is discussed in 
relation to plant siting and layout in Chapter 10 and in 
relation to storage in Chapter 22. It is also considered 
in Section 17.3 in terms of the quantity-distance relations 
used for storage of explosives. 

Methods of explosion protection and relief are described 
in Dust Explosions and Fires (K.N. Palmer, 1973a) and 
Explosions (Bartknecht, 1981a). Health and Safety Execu¬ 
tive (HSE) guidance is given in Guide to the Use of Flame 
Arresters and Explosion Reliefs (the HSE Explosion Relief 
Guide) (1965 HSW Bklt 34). Relevant US codes are NFPA 
69:1992 Explosion Prevention Systems and NFPA 68:1994 
Deflagration Venting. 

Selected references on explosion prevention, protection 
and relief are given in Table 17.13. 


17.11.1 Flame arresters 

A flame arrester, or flame trap, is a device used to prevent 
the passage of a flame along a pipe or duct. 

A flame arrester is generally an assembly of narrow 
passages through which gas or vapour can flow, but which 
are too small to allow the passage of flame. 

Typical applications of flame arresters are on vents of 
storage tanks containing flammable liquids, on pipe sys¬ 
tems supplying fuel gas to burners, on certain pipelines 
conveying flammable gases within the plant and on flare 
stacks. Flame arresters are also used on exhausts of 
engines working in atmospheres with a flammability 
hazard and on crankcases of small engines. 

Accounts of flame arresters include those given in the 
CCPS Guidelines book by Grossell (2001), in the HSE Explo¬ 
sion Relief Guide (1965 HSW Bklt 34) and by H. Phillips 
(1972b), Barton, Carver and Roberts (1974), WB. Howard, 
Rodehorst and Small (1975), W.B. Howard (1982,1992a,b), 
Kletz (1982c), Thorne (1982), Lunn and Przybylski (1985), 
H. Phillips and Pritchard (1986), Capp (1992,1994) and G.O. 
Thomas and Oakley (1993). 

An extensive programme of work on flame arresters 
was conducted in the 1960s by the Joint Fire Research 
Organization (JFRO) at the Fire Research Station at 
Borehamwood. Accounts of this work have been given by 
K.N. Palmer and co-workers (e.g. K.N. Palmer and Tonkin, 
1963; K.N. Palmer and Rogowski, 1967; J.P. Davies, Palmer 
andRogowski, 1973; Rogowski, 1980). 

The United Kingdom has had certain long-standing but 
limited legal requirements for the use of flame arresters, on 
diesel engines in mines and on equipment using acetylene 
above 0.62 barg. Their use is recommended in codes. 


17.11.2 Flame arresters: modes of combustion 

In general, combustion may take the form of a deflagration 
or a detonation. The characteristics of these two forms of 
combustion have been described above. 

A deflagration has a flame speed of 3-500 m/s and 
generates overpressures of 8-11 bara. A detonation has 
flame speeds of 500-2000 m/s and overpressures of 
11-100 + bara. 

Flame arresters are generally distinguished as end-of- 
line or in-line arresters. An end-of-line arrester is designed 
to prevent the passage of a deflagration from the down¬ 
stream to the upstream side. 

An in-line arrester should be able to stop either a defla¬ 
gration or a detonation passing in either direction. Although 
it is often assumed that detonation presents the more 
difficult duty, this is not necessarily so. Some detonations 
are overdriven (meaning the flame speed temporarily 
exceeds the coustic speed), and if this is a possibility the 
arrester needs to be able to handle this form of detonation. 

Definition of the nature of the flame with which an 
arrester may have to cope is difficult, so that in principle it 
may be necessary to allow for both deflagration and deto¬ 
nation, possibly including overdriven detonation. 

It should be appreciated that even if a flame arrester 
prevents the passage of the detonation flame, it does not 
stop the detonation shock wave. 


17.11.3 Flame arresters: types of arrester 

The types of flame arrester used are described in the HSE 
Guide and FPA FS 6012 in Grossell (2001) and by H. Phillips 
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and Pritchard (1986) and WB. Howard (1992a)., Grossed 
defines three types of arrester: 

Type 1 arresters with multiple small channels; 

Type 2 hydraulic devices; 

Type 3 velocity flame stoppers. 

Some principal type 1 flame arresters are 

(1) sheet metal arresters 

(a) planar sheet metal arresters, 

(b) cylindrical sheet metal arresters (crimped ribbon 
arresters); 

(2) perforated plate arresters; 

(3) perforated block arresters; 

(4) sintered arresters; 

(5) expanded metal arresters; 

(6) parallel plate arresters; 

(7) wire gauze arresters; 

(8) wire pack arresters; 

(9) packed bed arresters. 

Figure 17.15 illustrates some of these types of arrester. 

The operation of a type 1 arrester is generally treated in 
terms of the mechanism of quenching and heat loss. These 
are a large part of the story, but not the whole, as discussed 
by H. Phillips and Pritchard (1986). 

Desirable properties of a flame arrester are high free 
cross-sectional area available for flow, low resistance to 
flow and freedom from blockage; a high capacity to absorb 
the heat of the flame and the ability to withstand mechani¬ 
cal shock, including explosion. 

Sheet metal arresters are of two main types. The planar 
type consists of thin, planar sheets with corrugations or 
protuberances stacked in a block. The cylindrical type is 


constructed by winding a thin corrugated metal ribbon to 
form a cylindrical assembly. This type is also known as a 
crimped ribbon arrester. 

Crimped ribbon arresters are an important type of 
arrester and are available in a range of designs. These 
arresters have about 80% free cross-sectional area, can be 
manufactured to close tolerances, are robust enough to 
withstand mechanical and thermal shock and can be made 
to quench violent explosions. 

Wire gauze arresters have a lower free area, which with 
fine gauzes is less than 50%. They also tend to be less 
effective and less robust. They have a limited ability to 
quench flame and are not suitable for violent explosions. 
A limited enhancement of arrester effectiveness can be 
obtained by using a number of wire gauze arresters in 
series as a combined pack. 

Perforated plate arresters have a lower free area than 
gauzes, but higher heat capacity and greater mechanical 
robustness than wire gauzes, but they are little more effec¬ 
tive and again are not suitable for violent explosions. 

Perforated metal blocks can also be used as arresters. 

Sintered arresters again have a low free area and high 
flow resistance. Their main use is on flammable gas detec¬ 
tors and on welding equipment. 

Parallel, or stacked, plate arresters have a low free area 
and high flow resistance, but can be designed to quench 
violent explosions. They are used particularly on the 
exhausts of internal combustion engines. 

Wire pack arresters are made by compressing a pack of 
wire which has been knitted or assembled at random. This 
type of arrester tends not to have very reproducible char¬ 
acteristics. 

Packed bed arresters are vertical containers fitted with 
pebbles, Raschig or Pall rings or similar packings. The 
packing may be irrigated with water or oil. The size of the 



Figure 17.15 Some type of flame arrester (after Fire Protection Association, 1989 FS 6012): (a) crimpled ribbon arrester; 
(b) perforated metal sheet; (c) perforated metal block; (d) box of pebbles or ceramic rings; (e) wire gauzes; and 
(f) construction of a gauze arrester 
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passages is not well defined. This type of arrester has high 
flow resistance. Such an arrester can quench a violent 
explosion, but movement of packing due to such an explo¬ 
sion can result in arrester failure. A more detailed account 
of packed bed arresters is given by W.B. Howard (1992a). 

The design of a flame arrester depends on the combus¬ 
tion properties of the flammable mixture and on the func¬ 
tion and location of the arrester. 

The size of the aperture through the arrester is deter¬ 
mined by the quenching distance of the flammable mix¬ 
ture. Quenching distances have been discussed in Chapter 
16. The diameter of the aperture of an arrester should 
be smaller than the quenching diameter by at least 50%. 
The performance of an arrester is affected by the tempera¬ 
ture. The quenching distance increases as the temperature 
increases. It is approximately inversely proportional to the 
square root of the absolute temperature. 

In general, such flame arresters are cheap, can be easily 
installed and are readily replaced if damaged. They do 
present some problems, however, due to their fine struc¬ 
ture. These include high pressure drop and blockage. They 
are not suitable, therefore, in dusty or polymerizing gases. 
The maintenance of an arrester is relatively simple, but it is 
essential that it should not be neglected if the device is to 
function properly when required. 

17.11.4 Flame arresters: hydraulic devices 

Hydraulic, or liquid seal, arresters contain a liquid, usually 
water, which serves to break up the gas stream into bubbles 
and so prevents passage of the flame. This type of arrester 
operates on a quite different principle from that of the other 
types described. The arrester is effective only if the liquid 
level is maintained and the gas flow is kept within the range 
in which it is broken into bubbles. 

Hydraulic arresters exist which are reported to be effec¬ 
tive in preventing flame propagation in both directions. 
Tests to establish this on a particular arrester design have 
been described by Flessner and Bjorklund (1981). 

A particular kind of hydraulic arrester is the linde 
hydraulic valve developed for acetylene duty. This is 
described by Flessner and Bjorklund (1981). 

Hydraulic arresters are discussed further by W.B. 
Howard (1992a), with comments on the extent to which the 
various kinds of arrester are in general use. 

17.11.5 Flame arresters: velocity flame stoppers 

Avelocity flame stopper is an arrester used in end-of-line 
applications. Its function is to prevent a flame passing from 
the downstream to the upstream side. 

It operates on a quite different principle from other types 
of arrester. This principle is to ensure that the velocity of the 
upstream gas passing through the arrester is sufficiently 
high to prevent a flame propagating through the arrester 
from the downstream side. 

The velocity flame stopper is discussed by W.B. Howard 
(1992a). For the velocity necessary to prevent flashback 
through apertures larger than those which would give 
quenching, Howard quotes the equation of Hajek and 
Ludwig (1960): 

« T = 0.2015g L L> [17.11.1] 

where D is the internal diameter of the pipe (m), g L is the 
laminar velocity gradient (m/s)/m and Ut the turbulent 


flashback velocity (m/s). The parameter g L is also termed 
the critical boundary velocity gradient. This parameter is a 
function of the gas and of its concentration. It tends 
to have a maximum value at a concentration somewhat 
above the stoichiometric. The following maximum values 
are based on the work of Grumer, Harris and Rowe (1956 
BMRI5225): 


Gas 

Maximum laminar 
velocity gradient, g L (s 1 ) 

Methane 

400 

Ethane 

650 

Propane 

600 

Ethylene 

1,500 

Propylen 

700 

Hydrogen 

10,000 


Howard recommends that for normal design the minimum 
velocity through the holes of a velocity flame stopper 
should be four times the turbulent flashback velocity given 
by Equation 17.11.1. 

A velocity flame stopper is effective only as long as 
there is a sufficient gas flow through it. Ensuring a reli¬ 
able gas flow may not be a simple matter, and in such 
cases a regular flame arrester may be a more attractive 
alternative. 

Velocity flame stoppers are used particularly on certain 
gas flows to furnaces. 

17.11.6 Flame arresters: conservation vents 

Storage tanks are commonly provided with conservation 
vents to allow them to ‘breathe’. Over the years there has 
been some debate as to whether it is necessary to incor¬ 
porate a flame arrester in such a vent. The question is 
discussed in Chapter 22. The view has emerged that a 
conservation vent acts, in effect, as a velocity flame stop¬ 
per and that a separate flame arrester is not necessary. 

17.11.7 Flame arresters: critical flame speed 

It was shown by Palmer at the Fire Research Station (FRS) 
that a crucial variable in the performance of flame arresters 
is the flame velocity incident on the arrester, or critical 
flame speed. The critical flame speed is discussed by H. 
Phillips and Pritchard (1986), drawing largely on the FRS 
work on propane-air mixtures at atmospheric pressure. A 
simple model based on heat abstraction from the flame 
yields the following relation: 

u = 0.95^ [17.11.2] 

where n is the number of apertures per unit area of arrester 
surface (cm -2 ), p is the explosion pressure at the arrester, p a 
is atmospheric pressure, u is the flame speed at the arrester 
(m/s) and y is the thickness of the arrester elements (cm). 
This equation includes the term (p 0 /p), which takes into 
account the explosion pressure. The authors state that for 
the system considered this equation gave reasonable 
agreement, with a number of qualifications, including the 
facts that it applies only to crimped ribbon arresters of 
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a particular design and to propane-air mixtures. They also 
quote the following empirical equation: 

u = 0.38 ^ [17.11.3] 

where a is the fractional free area of the arrester, d is the 
diameter of the apertures (cm), u is the flame speed at the 
arrester (m/s) andy is the thickness of the arrester elements 
(cm). This equation applies to crimped ribbon, wire gauze 
and perforated plate arresters. For the former, d is taken as 
the hydraulic mean diameter. The equation does not taken 
into account the explosion pressure and is therefore limited 
to applications where the pressure does not rise sub¬ 
stantially above atmospheric; the authors instance a short 
length of straight pipe. 

17.11.8 Flame arresters: minimum effective safe gap 

The selection of flame arresters is largely based on the 
minimum effective safe gap (MESG) of the fuel. This is 
defined as the smallest gap between parallel metal surfaces 
that will not allow propagation of an ignition. The theory of 
suppression by narrow gaps is discussed by Phillips (1972). 
Compilations of MESG are provided by the National 
Academy of Sciences report to the US Coast Guard (1975), 
the National Materials Advisory Board (1982), NFPA 497 
(1997) and Britton (2000). 

The purpose of MESG measurement is to specify the 
degree of integrity required for ‘explosion proof’ electrical 
equipment. See NFPA 70 (2002), National Electrical Code 
(NEC) and NFPA 497 (1997). A classification of flame 
arrester specifications was introduced into the US National 
Electrical Code (NEC) Article 500 in 1935, in four groups, 
A, B, C, D, ranging from Class D suitable for relatively 
unreactive fuels to Class A suitable for very reactive fuels. 
The four fuel groups ‘complemented the design of electrical 
equipment used in hazardous (classified) locations and 
were defined based on the level of hazard associated with 
explosion pressures of specific atmospheres and the like¬ 
lihood that the effects of that explosion could be transmitted 
outside the enclosure’ (NFPA 497). The typical materials 
for each group as defined in the NEC are listed below. 


Flame 

arrester 

class 

Typical 

materials 

Upper 

limit 

defining 

material 

US 

Coast 

Guard 

MESG 

(mm), 

Westerberg 

apparatus 

NFPA 

497 

D 

Acetone a 


1.02 

n/a 

1.02 

D 


Propane 

0.90 

0.92 

0.97 

C 

Diethyl 

Ether 


0.86 

0.30 

0.83 

C 


Ethylene 0.71 

0.69 

0.65 

B 

Hydrogen 


0.10 

0.08 

0.28 

A 

Acetylene 


<0.02 

0.08 

0.25 


“Naphtha, gasoline, petroleum, alcohols, acetone, lacquers, solvent 
vapours, natural gas. 


Differences in measured values of MESG arise between 
measurement devices. The values listed above are from 
Britton (2000), who discusses the reasons for differences, 
as does Phillips (1981). 

Considerable use has been made of the MESG for key 
compounds to separate chemicals into the groups. There is 
some variability in the choice of the ‘border material’. For 


example, the National Materials Advisory Board originally 
selected gasoline to define the border between Classes C 
and D. Gasoline has an MESG by theWesterberg apparatus 
of 0.74 mm (0.029 in.), but is a poorly defined mixture and 
MESG measurements of gasolines vary. Propane has since 
become the NEC border material for Groups C and D. 
Ethylene is currently the NEC border material for Groups C 
and B. However, the US Coast Guard’s demarcation between 
Groups C and D is 0.90 mm and is inconsistent with the NEC 
demarcation of only 0.75 mm. The NFPA 497 has ‘grand¬ 
fathered’ certain gases under their original NEC groupings. 
For example, diethyl ether continues to be listed as NEC 
Group C even though it would be NEC Group D based on 
its listed MESG (0.83 mm using the IEC apparatus). Britton 
(2000) has suggested revisions in the present grouping 
system. 

The 1997 revision of NFPA 497 provides an equation 
for estimating the MESG of mixtures (Breisch, 2000). The 
equation is described as a ‘form of Le Chatelier’s equation’ 
although there is a distinct difference in application with 
respect to the treatment of inert components. 

17.11.9 Flame arresters: applications and requirements 

The duty which the arrester performs depends on the nat¬ 
ure of the system and on the location of the arrester. 

One basic distinction is between (1) end-of-line and (2) in¬ 
line arresters. The typical application of an end-of-line 
arrester is on the vent of an atmospheric storage tank. The 
function of such an arrester is primarily to stop a flame 
arising from ignition of vapour vented. The flame is thus of 
low speed and at atmospheric pressure. 

In-line arresters are used in plant pipework and the 
demands placed on them are much more severe and varied. 
They may have to deal not only with deflagrations but also 
with detonations. 

Some of the differences in application which arise from 
the location of the arrester and of the ignition source are dis¬ 
cussed in the HSE Guide , which distinguishes the following 
three standard situations: (1) ignition at the open end of a 
duct, (2) ignition at the closed end of a duct, and (3) ignition 
near the arrester.These situations are shown in Figure 17.16. 

Another minor distinction is between a stationary and a 
flowing mixture. Consider first a stationary mixture. If 
ignition occurs at the open end of the duct, the arrester is 
required only to quench the flash of flame. This requires 
absorbing the heat from the hot gases. If ignition occurs at 
the closed end of the duct, the arrester must quench the flame 
and withstand the pressure created by combustion within 
the duct, some cooling of the hot gases occurs by the duct 
walls. 

Now consider a flowing mixture. Assume that in Figure 
17.16 the flow is from left to right. If ignition occurs in the 
open end and the gas velocity is high, the flame may be 
swept out of the duct or may stabilize on the end of the duct 
or at a restriction in the duct. In either case the arrester is 
unaffected. But if the gas velocity is low, the flame will 
stabilize on the arrester. If ignition occurs at the closed end 
of the duct or near the arrester, the flame may again stabi¬ 
lize on the arrester and eventually allow a temperature and 
ignition breakthrough. 

Thus, if a flame arrester is installed in a system in which 
the gas mixture is flowing, there is a risk of stabilization 
of the flame and overheating of the arrester. It is necessary, 
therefore, to arrange for this condition to be detected and 
for the gas flow to be shut off when it occurs. 
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(c) 


Figure 17.16 Ignition situations relevant to the design of 
flame arresters (after Health and Safety Executive, 1965 
HSW Bkk 34): (a) ignition at open end of duct; (b) ignition at 
closed end of duct; and (c) ignition near arrester (Courtesy 
HM Stationery Office) 


The function which a flame arrester is required to per¬ 
form therefore varies. In some cases it is required only to 
prevent simple flashback, but in others, where hot gases 
may be forced through it or where flame may stabilize on 
or near the arrester, it must also be capable of absorbing 
a considerable quantity of heat. For the latter duties it 
is necessary not only that the arrester have apertures 
smaller than the quenching diameter but also that it have 
sufficient mass and suitable material of construction to 
absorb heat. 

In many applications a flame may arrive at the arrester 
from either direction and the arrester needs to be capable of 
stopping the flame in both cases. 


17.11.10 Flame arresters: HSE Guide 

It is convenient at this juncture to consider the guidance on 
flame arresters given by the HSE Explosion Relief Guide. 
This guide is based on the work in the 1950s and in 1960 at 
the FRS. Unless otherwise stated, it applies to gas mixtures 
at atmospheric pressure. 

For crimped metal, wire gauze and perforated plate 
arresters the following equation is given in the HSE Guide 
for the calculation of the maximum flame speed for a 
deflagration at atmospheric pressure which can be 
quenched by an arrester: 

u = 0.5^ [17.11.4] 

where a is the fractional free area, d is the diameter of the 
aperture (in.), u is the flame speed (ft/s) andy is the thick¬ 
ness of the arrester (in.). 

Equation 17.11.4 is applicable to deflagration but not to 
detonation. The value of the flame speed u includes a safety 
factor which takes account of experimental scatter. For 
non-circular apertures the equivalent hydraulic diameter 
should be used. 


For crimped metal arresters, the equivalent diameter for 
a right angle isosceles triangle is 0.83 times the crimp 
height. The thickness of a crimped metal arrester should be 
at least 0.5 in. For a wire gauze arrester, Equation 17.11.4 
applies only to a single layer of gauze. For a single layer of 
gauze the thickness y is twice the wire diameter. 

An increase in allowable flame speed of about 20% of the 
original value may be obtained for each additional layer up 
to a maximum of 5, but further increase gives no additional 
advantage. 

For detonations, only crimped metal arresters are con¬ 
sidered by the HSE Guide. It quotes the following equation 
for the maximum flame speed obtained by Cubbage (1959) 
for the stoppage of town gas-air mixture detonations by 
arresters with crimp height of 0.017 in.: 

y=1.3« 1/5 -4.4 [17.11.5] 

The HSE Guide emphasizes the limited amount of work 
then available on the arrest of detonations. 

The use of these equations requires data on flame 
speeds. Flame speed is a function not only of the flammable 
mixture but also of the system geometry. In particular, 
there exists a ‘run-up’ length over which there is a con¬ 
siderable acceleration of flame speed. The HSE Guide gives 
data on flame speed for several gas-air mixtures as a 
function of the run-up length in straight smooth pipes of up 
to 12 in. diameter. 

For propane-air mixtures, the flame speeds given for 
run-up lengths of 1, 5,10 and 35 ft are 16, 230, 330 and 330 
ft/s, respectively, for ignition near the open end of the pipe, 
and 110,380,420 and 490 ft/s, respectively, for ignition near 
the closed end of the pipe. For other run-up distances the 
higher neighbouring flame speed value should be used. 

These flame speeds for propane are typical of saturated 
hydrocarbons. There are, however, a number of substances, 
for example, ethylene, which have higher flame speeds. 

The HSE Guide also recommends that for certain sub¬ 
stances, for example, hydrogen, and for all substances in 
pipe lengths greater than 35 ft, detonations giving pres¬ 
sures up to 500 psig should be assumed. 

For propane-air mixtures, the detonation velocity is 
about 5800 ft/s. For town gas-air mixtures it is about 
7000 ft/s. The HSE Guide gives the following equation for 
detonation velocity: 

u = 300[(y 2 - 1)<3] 1/Z [17.11.6] 

where Q is the heat of detonation (cal/g) of the gas mixture, 
u is the detonation velocity (ft/s), and y is the ratio of 
specific heats of the gas mixture at the combustion 
temperature. 

Equations 17.11.5 and 17.11.6 apply to gas mixtures at 
atmospheric temperature and pressure. At higher pres¬ 
sures flame speed is not greatly affected, but the volu¬ 
metric heat release increases in proportion to absolute 
pressure. The effect of higher temperature is more complex. 
An increase in temperature raises the burning velocity but 
reduces the volumetric heat release. 

If the flammable gas is mixed not with air but with oxygen 
or even oxygen-enriched air, there is a strong possibility of 
detonation. Such mixtures can give detonation velocities up 
to 12,000 ft/s and detonation pressures up to 1,000 psig. 
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The basic design options are to keep the pipe length 
below 35 ft or to design for detonation. The former option 
includes the use of explosion relief vents to eliminate pipe 
runs of more than 35 ft. 

If the pipe is not a straight smooth duct, but contains bends 
or obstacles, much higher flame speeds may be reached. A 
single right angle bend can cause a substantial increase in 
flame speed. In such cases it is necessary to use explosion 
relief much more liberally or to design for detonation. 

17.11.11 Flame arresters: environment 

As described above, flame arresters differ in their applica¬ 
tions. Arresters also differ considerably in the environment 
in which they are required to function, particularly in-line 
arresters but also end-of-line arresters. 

In discussing the environment of a flame arrester, 
H. Phillips and Pritchard (1986) consider (1) the upstream 
volume, (2) the arrester matrix, and (3) the downstream 
volume.They define these regions in terms of the direction of 
flame propagation, which is not necessarily that of gas flow. 
This terminology is followed here, but in this section only. 

The ignition source is by definition located in the 
upstream volume. The properties of the flame arriving at 
the arrester are determined by conditions in this space. 
These include the pressure, temperature and gas mixture 
composition. They also include the shape of the space, the 
run-up distance and, of great importance, features that 
affect the flow into the arrester. The authors cite cowls on 
end-of-line arresters and bends and obstacles in the pipe¬ 
work upstream of an in-line arrester. 

Even if the arrester stops the flame from passing 
through, the hot gases leaving the arrester may reignite. 
Whether they do so depends on the conditions in the 
downstream volume. Reignition is governed by the balance 
between the heat generated by reaction of the hot gases 
leaving the arrester and the cooling due to mixing with cool 
gas or air. This mixing will depend on features tending to 
promote turbulence in the downstream space. 

17.11.12 Flame arresters: testing 

An account of British practice in the testing of flame 
arresters is given by H. Phillips and Pritchard (1986). 

They classify tests into (1) tests on end-of-line arresters, 
(2) deflagration tests on in-line arresters, (3) detonation 
tests on in-line arresters and (4) endurance burning tests. A 
similar account of US practice is given by the US Coast 
Guard. 

One issue in the testing of arresters is definition of the 
conditions for which the arrester is to be tested. An arrester 
at a particular location may be required to deal with a 
number of different flame conditions. 

Another issue is the selection of test gas mixtures which 
are representative of other mixtures of interest to the 
designer. One approach to this is to utilize the gas groups 
as defined in the standards on hazardous area classification, 
described in Chapter 16 or the US Coast Guard classification. 

Athirdissueis the definitionof the‘worst case’conditions. 

The test conditions for end-of-line arresters typically 
involve low flame speeds and atmospheric pressure. Use is 
made of the hazardous area classification (HAC) gas 
groups, except for endurance burning. 

The deflagration testing of in-line arresters is compli¬ 
cated by the fact that performance depends not only on 
flame speed but also on pressure. A typical test sequence is 
to increase the run-up distance in lengths of straight pipe 


and determine the flame speed at which failure occurs. 
This procedure does not, however, take account of pressure, 
and experience indicates that it is not necessarily sufficient 
to use a safety factor based solely on the relation between 
run-up distance and flame speed at atmospheric pressure. 
In view of these problems, the authors recommend that an 
arrester be tested under conditions which approximate as 
closely as possible those under which it is to be used. 

The detonation testing of in-line arrester is usually based 
on a steady-state detonation, with CJ velocity. This does not 
allow for the possibility that the detonation may be over¬ 
driven. In a practical application it may be uncertain 
whether an overdriven detonation could occur. The authors 
emphasize that an in-line arrester should be tested for both 
deflagration and detonation conditions. It should not be 
assumed that if the arrester is satisfactory for detonation, it 
will be so for deflagration also, since cases have occurred 
where this was not the case. 

With regard to overdriven detonations, they state that it 
is uncertain whether flame arresters are effective against 
such detonations. 

The arrester should be tested for its ability to stop a 
flame travelling from either direction. 

A flame arrester must also pass an endurance burning 
test to ensure that it will not fail if a flame becomes stabi¬ 
lized on it. In this test the gas mixture is adjusted to obtain a 
maximum value for the flame temperature and the endur¬ 
ance period of the arrester is then determined. Flashback of 
the flame should not occur during the test when the gas is 
turned off. 

For this type of test the use of the HAC gas groups, based 
on the maximum experimental safe gap (MESG) and the 
minimum igniting current (MIC), is unsatisfactory. The 
authors discuss alternative approaches. 

The testing of arresters is also discussed by W.B. Howard 
(1992a). He instances the case of a flame arrester which was 
found to be satisfactory for detonations of mixtures of 
air with propane but not with propylene, despite the fact 
that the fundamental burning velocities of these two gases 
are comparable, being 46 and 52 cm/s, respectively. The 
MESG for propane and propylene are, respectively, 0.97 and 
0.91 mm (NFPA 97, Britton, 2000). 

The test procedures for in-line arresters utilize straight 
pipes. In practical applications the pipework is likely to 
contain features such as bends and valves. 

Both sets of authors emphasize the unsatisfactory state 
of the art in the testing of flame arresters. There are a large 
number of arrester designs and a wide range of applica¬ 
tions, with variations in system geometry, gas mixtures 
and ignition sources. There is a paucity of published sci¬ 
entific work on which general design methods might be 
based. The message is therefore that if there is doubt as to 
the suitability of an arrester in a particular application, 
tests should be conducted which simulate as closely as 
possible the set of worst case conditions in that application. 

17.11.13 Flame arresters: codes and standards 

Flame arresters are the subject of a number of codes and 
standards in different countries. These are reviewed by 
H. Phillips and Pritchard (1986), WB. Howard (1992a) and 
Britton (2000). 

In the United Kingdom BS 7244:1990 covers the testing 
of arresters, as described in the next subsection. In the 
United States the Underwriters Laboratories standard UL 
525-1984 deals with construction and testing. Germany 
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has legally backed standards on the same aspects, as 
described by Leineman (1970). 

The International Maritime Organization (IMO) also has 
requirements for flame arresters (1984 MSC Circ. 373). 

The testing of flame arresters is covered by BS 7244: 
1990 Specification for Flame Arresters for General Use. 
The standard requires that an arrester withstand a fixed 
number of flame and detonation tests without flame pro¬ 
pagating through the arrester. 

An account of the practicalities of testing against this 
standard is given by G.O. Thomas and Oakley (1993). 

17.11.14 Flame arresters: design features 

There are a number of design features which are crucial 
to the effectiveness of a flame arrester. These relate to 
(1) mechanical strength, (2) flame endurance, (3) instru¬ 
mentation, and (4) blockage avoidance. 

For an in-line application, the arrester, its housing and 
the adjacent pipework should be able to withstand the 
shock from a detonation. This is a prime requirement in the 
selection of the type of arrester to be used. 

The arrester element itself needs to have adequate 
mechanical strength. Use may he made of additional 
strengthening in the form of reinforcing grids across both 
faces of the arrester. 

One expedient which is sometimes used to reduce the 
impact on the arrester is to set the arrester in a holder of 
enlarged cross-section. It has been found in practice that 
this does not always provide the degree of reduction of 
impact expected. 

Another measure taken by some manufacturers is the 
provision of baffles to break up the detonation wave as it 
approaches the arrester, but there is little published on the 
performance of these devices. 

An in-line arrester generally presents an appreciable 
resistance to flow. Data on pressure drop through arresters 
have been correlated by Quinton (1962). 

Both end-of-line and in-line arresters are subject to block¬ 
age. Both types are vulnerable to dust and corrosion pro¬ 
ducts. An end-of-line arrester may also suffer blockage 
from sand, fibres and crystallized or polymerized vapours. 
There may also be more exotic forms of blockage such as 
birds nests. 

Some protection may be afforded by the use of a screen 
on an end-of-line arrester or a filter for an in-line arrester. 

An arrester, whether end-of-line or in-line, should be able 
to withstand a flame stabilized on it. An endurance burn¬ 
ing test may be required to confirm this. 

The instrumentation of arresters is discussed in the fol¬ 
lowing section. 

In some installations the end-of-line arrester is heated to 
prevent blockage by condensed products. Where this is 
done it should be confirmed, by tests if necessary, that the 
arrester operates satisfactorily at the higher temperature. 

With an end-of-line flame arrester there may be a risk to 
the plant from impingement of the flame. 

A short vent pipe is sometimes used to prevent this. 
W.B.Howard(1992a)recommendsthatthearrestershouldbe 
no more than five pipe diameters from the end of the pipe. 

17.11.15 Flame arresters: instrumentation 

An in-line flame arrester should be provided with instru¬ 
mentation which will give an alarm to signal the 
presence of a flame and to take any appropriate protective 
action. 


A common arrangement is two temperature sensors, one 
on each side of the arrester and close to it. The sensors 
should have rapid response and the trip level should be low 
enough to ensure effective protective action. If the sensors 
are sufficiently accurate, their response sequence can also 
indicate in which direction the flame has travelled. 

The protective action might consist of the operation of 
fast-response isolation valves. It is desirable to detect the 
presence of flame on an end-of-line arrester also, again 
using temperature sensors. 

17.11.16 Flame arresters: inspection and maintenance 

As a protective device, a flame arrester should be entered in 
the inspection schedule and inspected at suitable intervals. 

It should have pressure tappings either side to allow the 
pressure drop across it to be measured. There should be 
adequate access to allow this to be done and to permit 
removal if necessary. 

In general, a blocked arrester should be cleaned by 
blowing air or steam through it or by washing. It should not 
be cleaned, however, in any way which is liable to enlarge 
the apertures, such as rodding out. 

17.11.17 Flame arresters: alternatives to arresters 

It should not be assumed that a flame arrester is neces¬ 
sarily the right solution. Depending on the situation, it may 
be preferable to consider an alternative approach such as 
the use of automatic isolation or explosion suppression. 

These alternatives are now briefly considered. They find 
application particularly in protection against dust explo¬ 
sions and a fuller account is given in Section 17.47. 

17.11.18 Automatic isolation 

In some systems, the passage of an explosion from one 
section to another may be prevented by automatic high 
speed isolation. An account of this method is given in FPA 
FS 6012: 1989 Flammable Liquids and Gases: Explosion 
Control and NFPAI2A (1997). 

A typical installation is illustrated in Figure 17.17. Very 
rapid detection and valve closure are necessary. 

The design of such a system requires information on the 
rate of pressure rise caused by the expected explosion. This 
information is also required for the design of automatic 
explosion suppression systems and is discussed below in 
relation to the latter. From the data on the rate of pressure 
rise a suitable high speed detector can be chosen. The shut¬ 
off valve must also operate very quickly. One method of 
achieving rapid closure is the use of explosives. 



Figure 17.17 System for automatic isolation installed in 
a pipe 
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Controls 



Figure 17.18 System for automatic explosion suppression installed in a pipe 


Isolation protects only the section isolated and not the 
section in which the explosion occurs. The application of 
automatic high speed isolation appears to be fairly limited. 

17.11.19 Automatic explosion suppression 

A developing explosion may be detected and suppressed 
using an automatic high speed suppression system. 

Accounts of automatic explosion suppression are given 
in FPA FS 6012:1989 and FS 6015:1974 Explosible Dusts, 
Flammable Liquids and Gases: Explosion Suppression and 
by Grabowski (1965) and K.N. Palmer (1973a). 

Atypical explosion suppression system in a pipe is illus¬ 
trated in Figure 17.18. 

An explosion suppression system for a vessel, and the 
principles of operation of such a system, are shown in 
Figure 17.19. Again, very rapid detection and suppression 
are required. 

The basic data for the design of an explosion suppression 
system are given by the explosion pressure curve for the 
gas. A typical curve is shown in Figure 17.20 as curve 1. 

This information is used to estimate the required 
response time of the detector and of the suppressant in 
order to limit the explosion pressure to a specified value. 
The pressure response typically obtained with explosion 
suppression is shown in curve 2 of Figure 17.20. 

Broadly, the rate of rise of pressure follows the cube law 
given in Equation 17.7.48, as described in Section 17.6, but 
factors such as vessel geometry and turbulence effects 
make prediction difficult. 

The main suppressants used to be halons such as bromo- 
chlorodifluoromethane and chlorobromomethane. Now, 
with environment restraints on the use of chlorofluoro¬ 
carbon substitutes are used, as discussed in NFPAI2A 
(1997). The quantity of liquid agent commonly specified is 
2.141/m 3 of protected space. The suppressant is discharged 
by an electrically fired detonator within 1ms of the closure of 
the detonator contacts. 

The size and shape of vessel to which explosion sup¬ 
pression can be effectively applied is not unlimited. FS 
6015: 1974 stated that explosion suppression is applicable 
to vessels with a volume of up to 115 m 3 and for flammable 
gas mixtures for which the maximum explosion pressure is 
generated in not less than 40 ms. 

Developments in technology have tended to expand these 
limits, as described in relation to dusts in Section 17.47. 

With an automatic explosion suppression system oper¬ 
ating, the maximum pressure of the suppressed explosion 
is typically reached in about 10 ms. 


Suppressors 



W 



(c) 


Figure 17.19 System for automatic suppression of an 
explosion in a vessel (after Fire Protection Association, 
1974 FS 6015): (a) initial ignition; (b) suppressors 
activated; and (c) suppression nearly complete 


A potential disadvantage of automatic explosion 
suppression is the risk of spurious trips. This has not 
proved sufficiently serious, however, to discourage its use. 
Automatic explosion suppression systems are widely used. 
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Figure 17.20 Typical explosion pressure curves for an 
automatic suppression system: curve 1, explosion pres¬ 
sure in absence of suppression; cure 2, explosion pressure 
with suppression operating 


17.11.20 Explosion relief and venting 

A quite different approach is to relieve the explosion by 
venting. Explosion venting is applied to (1) vessels, (2) pipes 
and ducts, (3) buildings, (4) large enclosures, (5) reactors 
and (6) storage vessels. 

If this option is adopted, it is necessary to consider not 
only the venting itself, but also the disposal of the material 
vented, which may not be a trivial problem. 

Explosion relief of vessels is treated in Section 17.12, of 
pipes and ducts in Section 17.13, of buildings in Section 
17.14, of large enclosures in Section 17.15 and of reactors in 
Sections 17.16-17.23. 

17.12 Explosion Venting of Vessels 

One of the options for the protection of a vessel against a 
gas explosion is the use of explosion venting, also referred 
to as explosion relief. 

Accounts of explosion venting are given in Explosions 
(Bartknecht, 1981a), Development and, Control of Dust 
Explosions (Nagy and Verakis, 1983), Gas Explosions in 
Buildings and Heating Plants (R.J. Harris, 1983) and Venting 
Gas and Dust Explosions - A Review (Lunn, 1984b, 1992). 
All of these except the book by Harris also deal with dust 
explosions. 

Explosion venting is also dealt with in NFPA 68: 2002 
Deflagration Venting. 

The notation used in explosion venting is particularly 
liable to cause confusion. The term ‘maximum explosion 
pressure’ refers generally to a closed, or unvented, explo¬ 
sion, but occasionally it refers to a vented explosion. Pres¬ 
sure is defined sometimes as an absolute pressure, 
sometimes as a gauge pressure and sometimes as a pres¬ 
sure in excess of the initial pressure. Explosion venting of 
vessels is a topic in which there are a large number of 
empirical equations in particular sets of units. Some 
equations are quoted here in their original form in British 
units, but generally the use of SI units is preferred. How¬ 
ever, with the latter, unless otherwise stated, where units 
are given, the common practice of giving pressure in kilo- 
pascals has been followed. In some subsections equations 
are given without units, and in these cases any consistent 


set of units is applicable. Further information on the units 
used is given in the Notation. 

In the account given here, the maximum pressure in a 
vented system is referred to as the reduced pressure, P lei . 

The definition of reduced pressure P red as absolute or 
gauge is not always clearly stated in the original papers and 
sometimes has to be inferred. 

17.12.1 Factors influencing explosion venting 

The various factors which influence the maximum pres¬ 
sure and the rate of rise of pressure in an explosion in a 
closed vessel were described in Section 17.7. They are rel¬ 
evant to vented explosions also. 

One factor which assumes particular significance for a 
vented explosion is the location of the ignition source. Dif¬ 
ferent models have been developed for vented explosions 
with different locations of the ignition source, as described 
below. 

17.12.2 Experimental studies of venting 

There have been a number of experimental studies of 
explosion venting. Some of the principal studies are listed 
in Table 17.14. 

Early work on explosion relief was done by Cousins and 
Cotton (1951a,b), who studied a range of containers with 
LID ratios varying from 1.41 to 22.1. The relief was a burst¬ 
ing disc. The gases used were propane and hydrogen. 

Another early study was carried out at the Midlands 
Research Station (MRS) of the Gas Council by Cubbage and 
Simmonds (Cubbage and Simmons, 1955a,b; Simmonds 
and Cubbage, 1960). Their work was concerned with the 
explosion venting of industrial drying ovens. The experi¬ 
ments were done on ovens which were approximately cubi¬ 
cal and with a variety of vent conditions. The principal gas 
used was town gas. The pressure profile resulting from an 
explosion with explosion relief was of the form shown in 
Figure 17.21. The initial pressure peak at Awas followed by 
a second, higher peak at B 

Other experimental studies which have yielded data sets 
against which correlations can be tested include those of 
Burgoyne and Wilson (1960), G.F.P. Harris and Briscoe 
(1967), Yao and co-workers (Yao et al., 1969; Yao, 1974) and 
Zalosh (1980b). 

Experimental studies on larger containments which are 
often referred to in relation to explosion venting of vessels 
include those of the Committee for Explosion Research 
(1958) in Sweden, Dragosavic (1973), Solberg, Pappas and 
Skramstad (1980,1981) and Buckland (1980). 

17.12.3 Phases of vented explosion 

A vented explosion passes through three phases: the initial 
confined explosion phase, the vent removal phase and the 
venting phase. 

The pressure-time profiles obtained in venting experi¬ 
ments may exhibit as many as three peaks, although in 
many cases one or more of these peaks is absent or runs into 
another peak. Explanations of this multiple-peak behav¬ 
iour have been given by Anthony (1977/78), R.J. Harris 
(1983) and Lunn (1984b). 

The first peak occurs when the vent opens. The magni¬ 
tude of this peak is a function of the vent opening pressure 
P w and the vent inertia w. 

The second peak is associated with an increase in the 
rate of combustion as the burned gas core grows. The 
magnitude of this peak is a function of two factors. One is 
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Table 17.14 Explosion venting of vessels: some experimental studies 

Investigator(s) 

Vessel or enclosure 



Type and dimensions (m) 

Volume 

(m 3 ) 

Relief 

Gas 

mixture 

Cousins and Cotton (1951a) 

(1) Drum, 0.59 diam. x 0.84; L/D 1.41 

0.215 


Propane, 


(2) Tank, 0.36 diam. x 0.823 length; LID 2.3 

0.085 


hydrogen 


(3) Vessel, 0.305 diam. x 0.469 height 

0.032 




(4) Pipe, 0.28 diam. x 6.22 length 

0.40 



Cubbage and Simmonds 

Cubical drying ovens 

<14 

Vent 

Town gas, 

(1955a-c) 




methane 

Burgoyne and Wilson (1960) 

Cylindrical chamber, 1.27 diam. 

1.7,5.7 

Bursting 

Pentane 




disc 


G.F.P. Harris and Briscoe 

Vessel, 1.37 diam. x 1.45 length 

1.7 



(1967) 





Yao etal. (1969); Yao (1974) 

(1) Cubical chamber, 0.91 x 0.91 x 0.91 

0.765 

Open vent 

Propane, 


(2) Cylindrical chamber, 0.91 diam. x 0.91 length 

0.786 

Bursting 

hydrogen 


(3) Cylindrical chamber, 0.91 diam. x 2.74 length 

2.36 

diaphragm 


Zalosh (1980b) 

Rectangular enclosures: 


Vent 

Methane, 


(1) 0.92x0.61x0.31 

0.17 


propane, 


(2) 0.56x 0.56x0.56 

0.18 


ethylene 


(3) 0.71x0.71x0.37 

0.19 




(4) 1.47 x 0.91 x 0.43 

0.58 




(5) 1.80x2.00x3.10 

11.2 




(6) 5.40x2.00x3.10 

33.5 





Figure 17.21 Explosion venting of vessels: typical 
explosion pressure curve obtained in explosion venting of 
an enclosure in work of Cubbage and Simmonds (1960) 
(courtesy of the Institution of Chemical Engineers) 


the features which may give an enhanced combustion rate. 
These include shear turbulence and stretching of the flame 
towards the vent. The other factor is the flow resistance, 
which depends on the vent size and on any vent ducting. 

The third peak is associated with the venting of burned 
gas. When the burned gas starts to vent, the volumetric flow 
increases markedly, since the burned gas density is much 
less than that of the unbumed gas. 

The first peak may be weak or absent if the vent is an 
open one. It tends to be large if the vent opening pressure or 


vent inertia is high. But if the vent area is small so that 
there is little vent outflow before the second peak arrives, 
the first peak merges into the second one. This may also 
occur if the vent opening pressure is sufficiently high. 

The second peak may be weak if the rate of combustion is 
slow or the vent area large. Conversely it is large if the rate 
of combustion is high and the vent area is small. In the for¬ 
mer case the second peak may merge into the first one. 

In the later stages of venting the explosion may exhibit 
various types of oscillatory behaviour as evidenced by the 
pressure trace. 

Some typical pressure profiles are illustrated in 
Figure 17.22. Other examples of the multiple peaks 
obtained in explosion venting are given in Section 17.15. 

Another feature of the venting process is the effect of 
the vent pressure on the combustion process. For a vessel 
with a relatively low vent area, if the vent pressure is set at a 
low value, the explosion pressure tends to exceed the vent 
pressure. The phenomenon has been studied by G.F.P. 
Harris and Briscoe (1967), who attribute it to a large 
increase in the flame area when the vent is opened. This is 
illustrated in Figure 17.23. 

17.12.4 Oscillatory behaviour 

Pressure-time profiles of a vented explosion often show 
marked oscillatory behaviour in the later stages. The sig¬ 
nificance of this is that combustion oscillations can greatly 
increase the combustion rate, particularly in the later 
stages, and can result in higher pressures. The effect 
becomes relatively more important as the scale increases, 
but it may not be negligible even for vessels. Oscillation in 
explosion venting was described by Zalosh (1980b), who 
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obtained high, delayed, oscillatory second peaks in the 
pressure-time profile using propane. 

Oscillatory behaviour in explosion venting of a spherical 
vessel with a vent tube attached has been investigated by 
Kordylewski and Wach (1988). 

One type of oscillatory behaviour is that due to acoustic 
oscillation. For an acoustic oscillation Kordylewski and 
Wach used the relation 

' m2j i 

where c is the speed of sound in the medium, / a is the fre¬ 
quency of the oscillation, r s is the radius of the spherical 
vessel and Hi is a constant. The value of Hi is 4.4934. 



Figure 17.22 Explosion venting of vessels: generalized 
explosion pressure curves for closed and vented vessels 
(Field, 1982; reproduced by permission of Elsevier Science 
Publishers) 



Explosion vented in its early stages 
(low pressure disc) 


Formulae for this and other geometries are given in For¬ 
mulas for Natural Frequency and Mode Shape (Blevins, 
1979). 

Another type of oscillatory behaviour is that due to 
Helmholtz oscillation. For Helmholtz oscillation Kordylewski 
and Wach used the relation 





a = 0.255 D [17.12.3] 

where A v is the vent area, D is the duct diameter, / H is the 
frequency of Helmholtz oscillation, L is the length of the 
duct, V is the volume of the vessel and a is a correction 
factor. 

The occurrence and strength of combustion oscillations 
depend on the concentration of the gas mixture. Thus, in 
the work of Zalosh (1980b) just described, oscillations were 
observed for propane concentrations only in the range 
5.0—5.5%. 

The oscillations tend to be more marked just on the fuel- 
rich side of the stoichiometric ratio. C.J.M. vanWingerden 
(1989c) found, using 9.5 and 10% methane—air mixtures, 
that whilst the former was the stoichiometric concentration 
it was the latter which was more sensitive to oscillatory 
combustion. 

17.12.5 Empirical and semi-empirical methods 

As already indicated, the venting of an explosion is a com¬ 
plex process. It is therefore difficult to model theoretically. 
This has led to the development of a number of empirical 
and semi-empirical methods and scaling laws. 

17.12.6 Vent ratio and vent coefficient 

Work on explosion venting makes frequent use of two 
quantities, the vent ratio and the vent coefficient. The vent 
ratio / is defined as the ratio of the vent area A, to the 
volume vented V. 

f = A r /V [17.12.4] 



Figure 1 7.23 Explosion venting of vessels: distortion of flame front on opening of vent (G. F. P. Harris and Briscoe, 1967) 
(Courtesy of the Combustion institute) 
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The vent coefficient K is defined; 
A = A C /A V 


In subsequent work, Rasbash, Drysdale and Kemp (1976) 
modified Equation 17.12.9 to include a term for the vent 
[17.12.5] inertia 




P lei = AP v + P l + BK 


[17.12.11] 


A c =L l L l [17.12.6] 

where A c is the area of the smallest cross-section of the 
enclosure (m z ), A v is the vent area (m 2 ), Li and L 2 , for a rec¬ 
tangular enclosure, are the dimensions of the two smallest 
sides (m). 

The vent coefficient is therefore dimensionless, but the 
vent ratio is not. 

These two quantities are discussed further below, par¬ 
ticularly in relation to scaling methods. 

17.12.7 Rasbash method 

An early equation for the reduced pressure P red in a vented 
explosion, or vented explosion pressure, was that of 
Rasbash (1969c), who gave the following equation for the 
maximum pressure in a vented explosion in a building: 




a* 


020Kw +1.17 

p|8T 


[17.12.12] 


W = Wy/Ay [17.12.13] 

where Pi is the back pressure due to the inertia of the vent 
(gauge) (kPa), w is the inertia of the vent (kg/m 2 ) and W v is 
the mass of the vent cover (kg). The values of the constants 
given are 1-1.5 kPa for A and 2.5 kPa for B; the value com¬ 
monly used for A is 1.5. 

The authors then generalize Equation 17.12.11 to make it 
applicable to other flammable gases: 

P red = 1.5P V + S^(Pi + 2.5 K) /0.45 [17.12.14] 


P red = 1.5P V + 0.5 K [17.12.7] 

K = A c /A v [17.12.8] 

where A c is the area of the smallest cross-section of the 
enclosure (ft 2 ), A v is the total area of combustion vents (ft 2 ), 
K is the venting ratio, P red is the reduced pressure, or maxi¬ 
mum pressure reached during the venting of combustion 
(gauge) (lbf/in 2 ) and P v is the pressure within the building 
space at which the vent opens (gauge) (lb f /in. 2 ). In SI units 
these equations become 

P red = 1.5P V + 3.5 K [17.12.9] 


where S u is the maximum fundamental burning velocity 
(m/s). The constant 0.45 represents the maximum funda¬ 
mental burning velocity of propane. 

Finally, Rasbash, Drysdale and Kemp introduce a tur¬ 
bulence factor/so that Equation 17.12.14 becomes 

P red = 1.5P V + fSn(Pi + 2.5K)/0.45 [17.12.15] 

They suggest for/a value of 1.5 for a single room, but modify 
this considerably for certain conditions. For a situation 
where the explosion propagates from one room to another 
they propose for /a value of 5, and for a high pressure leak 
of liquid petroleum gas (LPG) values of 8 or even 10. 

For comparison with equations derived by other workers it 
is helpful to combine Equations 17.12.11 and 17.12.12, to give 


where P red is the reduced pressure (gauge) (kPa) and P, is 
the pressure within the building space at which the vent 
opens (gauge) (kPa). 

Rasbash stated that Equation 17.12.9 was based on a col¬ 
lation of information on experimental work on venting 
using particularly propane and referred to work on explo¬ 
sion relief of ducts (Rasbash and Rogowski, 1960b). 

There are a number of restrictions on the use of Equation 
17.12.9. They may be summarized as 


-Pred 


Q.iOKwSy 1.175; 2.5S U P 
L5n + 0.45 F 1 / 3 + 0.45 F 1 / 3 + 0.45 


[17.12.16] 


The relative importance of the terms in Equation 17.12.16 
may vary If P v is high, P red approximates to it, whilst if P v 
is low, P red may be appreciably higher than P v If K is low 
(high A,), P red approximates to P v whilst if K is high, P red 
may again be higher than P T . 

Equation 17.12.11 has been widely used for the explosion 
relief of buildings. It is considered further in Section 17.14. 


L/D< 3; 1 < K < 5; w < 24; P v < 7 [17.12.10] 

where w is the inertia of the vent (kg/m 2 ). In addition, the 
pressure should be virtually exhausted after the vent has 
moved a few millimetres. 

Equation 17.12.9 applies to propane. For natural gas and 
for town gas which contains 60% H 2 , the pressures reached 
are, respectively, about 0.8 and 2.5 times that given by 
Equation 17.12.9 (Mainstone, 1971). 

If the flammable mixture is turbulent when ignited or 
becomes turbulent during the combustion, pressures con¬ 
siderably higher than those given in Equation 17.12.9 may 
be generated. 


17.12.8 Cubbage and Simmons method 

The pressure profile obtained by Cubbage and Simmonds 
in their work on drying ovens was described above. The 
relation obtained by these authors for the first pressure 
peak (peak A in Figure 17.21) is 


0.437&>S U 2.817Su 

pH ~ 1/1/3 


[17.12.17] 


and that for the second peak (peak B in Figure 17.21) is 
P 2 = 5.8 SuK [17.12.18] 
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where/fis thevent coefficient,Pi andP 2 are, respectively, the 
first and second pressure peaks (gauge) (kPa), S u is the maxi¬ 
mum fundamental burning velocity (m/s), V is the volume 
of the vessel (m 3 ) and w is the inertia of the vent (kg/m 2 ). 

In contrast to Rasbash’s method, Cubbage and 
Simmonds’s method is based on separate equations for the 
two pressure peaks. The first of their equations depends 
only on the inertia w of the vent panel, the second only on 
the vent coefficient K, whilst the vent opening pressure P v 
does not appear. 

17.12.9 Runes method 

In contrast to the two empirical correlations just described, 
the equation given by Runes (1972) for the vent area of a 
large container or building has some theoretical basis. It is 
based on equating the volume production rate and the 
volumetric vent outflow. The volume production rate is 

Qm = A m U{(E - 1) [17.12.19] 


The value of the constant C is discussed in more detail 
in Section 17.14 on explosion venting of buildings. Runes 
himself did not assign a value to the constant, though from 
Equation 17.12.25 C= 0.108«f. As described in Section 17.14, 
W.B. Howard (1972) assigned a value to Cof 1.2 by inserting 
the value for propane of u t = 11 ft/s. However, in the same 
paper Howard also made his own calibration of the 
constant based on an incident involving ethanol for which 
he took tif = 24 ft/s and thus obtained a value of C=2.6 
(1.2 x 24/11). 

The constant C is best regarded as an empirical one 
which allows for the actual flame speed under the condi¬ 
tions of turbulence in the enclosure. NFPA 68:1978 gives 
for C in British units for use in Equation 17.12.24 a value of 
2.6 for gases such as propane and other gases with a similar 
burning velocity. A higher value is recommended for gases 
with a higher burning velocity. The suggested value for 
ethylene is 4 and that for hydrogen 6.4. 

In SI units Equation 17.12.24 is 




A v 


r L 1 L 2 

AP>/2 


[17.12.26] 


A m = 7tLiL 2 [17.12.20] 

where A m is the maximum area of the flame front (ft 2 ), E is 
the expansion ratio, Pi and P 2 , are the two smallest dimen¬ 
sions of the enclosure (ft), Q m is the rate of volume produc¬ 
tion (ft 3 /s) and Uf is the flame speed (ft/s). The volumetric 
vent outflow is 

Qy = YC&Ay{2g x 144AP/p) 1/2 [17.12.21] 

where C d is the coefficient of discharge, g is the acceleration 
due to gravity (ft/s 2 ), A P is the vented explosion pressure 
(gauge) (lbf/in. 2 ), equivalenttoP red ,Q v is thevolumetricvent 
outflow (ft 3 /s), F is a constant which takes account of the 
expansion of the gas as it discharges and p is the density of 
the gas (lb/f t 3 ).The value of C d is 0.6, and Fis usually unity. 

Runes takes F=l, C d = 0.6, g= 32.2 and p = 0.085, and 
obtains 


Qy = 200A V AP 1 / 2 [17.12.22] 

(Equation 17.12.22 is obtained from Equation 17.12.21 by 
substituting the numerical values given by Runes. He 
actually gives not Equation 17.12.21 but one in which the 
right-hand side is FC d A v 2g(144AP) 1/2 /p, but this is evi¬ 
dently a typographical error. This error has caused some 
confusion in the expressions quoted in the literature for the 
Runes constant C, described below.) Then, from Equations 
17.12.19,17.12.20 and 17.12.22 


nLiLiUi{E - 1) 
v - 200APV2 

CL,L 2 

“A PW 


[17.12.23] 

[17.12.24] 


where A v is the necessary building vent area (m 2 ), Pi is the 
smallest dimension of the rectangular building enclosure 
to be vented (m), P 2 is the second smallest dimension of that 
building (m), P is the maximum internal building pressure 
(gauge) (kPa) and C is a constant. 

NFPA 68: 1978 gives for C in metric units for use in 
Equation 17.12.26 a value of 6.8 for gases such as propane 
and others gases with a similar burning velocity, whilst 
the suggested value for ethylene is 10.5 and that for 
hydrogen is 17. 

Equation 17.12.26 has been widely used for the explosion 
relief of buildings. It is considered further in Section 17.14. 
NFPA 68: 1994 gives a relationship similar to Equation 
17.12.26; this is described in Section 17.14. 


17.12.10 Decker method 

The method described by Decker (1971) is based on some¬ 
what similar considerations to that of Runes. The approach 
is again to equate the volume production rate and the volu¬ 
metric vent outflow; 



[17.12.27] 

[17.12.28] 


where P is the pressure (lb f /in 2 ), P v is the vent pressure 
(lbf/in. 2 ), Q v is the volumetric vent outflow (ft 3 /s), t is time 
(s) and Fis the volume of the vessel (ft 3 ). For the vent area 
he then obtains 


Ay 


r(f) 


1/2 1 
E, 


[17.12.29] 


^ nut(E -1) 

"200 

where C is a constant. 


where A v is the vent area (ft 2 ), M is the mean mole¬ 
cular weight of the gas, T is the absolute temperature of 
I-, 7 i n oci the burnt gases (°R) and k is a constant. The temperature 

^ ' Toi the burnt gases is of the order of 3600°R. The treat¬ 
ment by Lowenstein (1958) is rather similar. The value of 
the constant k is 1/132. 
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17.12.11 Dragosavic method 

Dragosavic (1973) has given equations for the first and 
second peak pressures in explosions in rooms in dwellings. 
For the first peak pressure 

P 1= P V + C [17.12.30] 

and for the second peak pressure 

P 2 = AP V + B/f 2 + C [17.12.31] 

f = A v /V [17.12.32] 

where Pi and P 2 are, respectively, the first and second 
peak pressures (gauge) (kPa), P v is the vent opening 
pressure (kPa), f is a vent ratio (nr 1 ) and A, B and C are 
constants. The values of A, B and C for natural gas-air 
mixtures are 0.5, 0.04 and 3.0 kPa, respectively. Equation 
17.12.30 applies to enclosures with open and closed vents. 
Equation 17.12.31 represents an envelope of the experi¬ 
mental values and therefore overestimates the second 
peak pressure. 


17.12.12 Cubbage and Marshall method 

Cubbage and Marshall (1973) have obtained the relation 

P red = P v + 2M{KwSl/ 7 1/3 ) [17.12.33] 

where K is the venting coefficient, F red is the reduced 
pressure (gauge) (kPa), P v is the vent opening pressure 
(gauge) (kPa), is the maximum fundamental burning 
velocity (m/s), Pis the volume of the vessel (m 3 ) and w is the 
inertia of the vent (kg/m 2 ). 

17.12.13 Other methods 

The following further equations for explosion venting are 
quoted by Lunn. Rasbash has given the two equations 

P red = P v + 7.76 SuK [17.12.34] 

P red = (P v + 7.76 iq^K [17.12.35] 

where K is the venting coefficient, P red is the reduced 
pressure (gauge) (kPa), P v is the vent opening pressure 
(gauge) (kPa) and S u is the fundamental burning velocity 
(m/s). 

Burgoyne and Wilson (1960) have given the following 
equation for their work on pentane-air systems: 

P red = 68 log 10 (A) - 28.6 [17.12.36] 

where K is the venting coefficient and P re( j is the reduced 
pressure (gauge) (lb f /in. 2 ). 


17.12.14 Scaling methods 

Empirical equations have the limitation that they cannot be 
used with confidence outside the range of experimental 
data on which they are based. An alternative empirical 
approach is the use of scaling laws validated over a wide 
range of experimental conditions. 

There are two principal methods based on scaling laws 
which are used for gas explosion venting: the vent ratio 
method and the vent coefficient method. Traditionally, in 
Britain the vent coefficient method has been used for vent¬ 
ing of gas explosions and the vent ratio method for venting 
of dust explosions, but there is no logical basis for this. 


17.12.15 Vent ratio method 

The vent ratio/is defined as 

f = A v /V [17.12.37] 

where A v is the vent area, / is the vent ratio and V is the 
volume of the enclosure. 

The simple application of the vent ratio method is the use 
of a constant vent ratio. 

It is found in practice that in scaling up from small scale 
tests, the use of a constant vent ratio tends to overestimate 
the vent area required. The following alternative treatment 
given by Lunn addresses this problem. The relationship 
between the rate of pressure rise and the volume of the 
vessel is given by the cube root law (17.7.48) 

y 1 / 3 = constant = Kq [17.12.38] 

Following an approach similar to that of the Decker 
method, as given in Equation 17.12.29, but using P red rather 
than P w the volumetric venting flow and hence the vent 


area required, is 


A * APV 
v d/F red 

[17.12.39] 

Hence, for the vent ratio 


/y 1 / 3 = constant 

[17.12.40] 


This approach implies that the cube root law is applicable to 
vented vessels also. It is the basis of the Bartknecht nomo¬ 
graph method described below 
Acommon method of characterizing the vent area required 
is to plot the reduced explosion pressure as a function of vent 
ratio. Numerous such plots are given by Lunn. 

17.12.16 Vent coefficient method 

The vent coefficients is defined as 

K=A C /A W [17.12.41] 

A c =L 1 /L 2 [17.12.42] 

where A c is the area of the smallest cross-section of the 
enclosure, K is the vent coefficient and Li and L 2 are the two 
smallest dimensions of the enclosure. 

For a cubical enclosure of volume V if Li =L% = (n/6) 1/3 , 
D=0.80D 

A c = y 2 / 3 [17.12.43a] 

UU = V 2/3 [17.12.43b] 

The following treatment by Lunn gives the relation 
between the vent coefficient and the reduced pressure. 
Again, following Decker and using Equation 17.12.29 with 
Fred together with Equations 17.12.38,17.12.41 and 17.12.43 

F red « K [17.12.44] 

The characteristics of the vent ratio and vent coefficient 
methods have been explored by N. Gibson and Harris 
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(1976), as shown in Figure 17.24.Their experimental results 
for pentane, and also those for class St 2 dusts, are well 
fitted using the vent coefficient with K= 3. Also shown are 
curves for various vent ratios. The two methods exhibit an 
increasing divergence in the predicted vent areas as the 
vessel volume increases. 

A critique of vent coefficient scaling has been given by 
Zalosh (1980b). He carried out experiments with a range of 
containment volumes from 0.17 to 33.5 m 3 , and found that 
such scaling is valid for volumes up to 12 m 3 but that for 
larger volumes the relationship breaks down due appar¬ 
ently to effects related to flame speed. 

17.12.17 The K q method 

The K g method developed by Bartknecht is based on the 
cube root law given in Equation 17.12.38. The cube root law 
in terms of the maximum rate of pressure rise is 

O vV3 = K s [17.12.45] 

and in terms of the rate of pressure rise with venting 

VV3 =Kg [1712.46] 

Thus, for the same reduced pressure the vent ratio / also 
follows the cube root law 

fV 1/3 = constant [17.12.47] 

As described by Bartknecht (1981a), Donat and 
Bartknecht have carried out extensive experimental work 
on vented explosions using the Ciba-Geigy 20 1 sphere. 
They apply the cube root law of Equation 17.12.45 and 


determine the value A w for values of the gas factor K G , the 
vent opening pressure P atat and the reduced explosion 
pressure P red . 

The results of their work are given in the form of a series 
of nomographs for the determination of the vent area A, for 
particular values of the vessel volume V, the initial pressure 
P 0 and the vent explosion pressure P rel i. Each nomograph is 
for a particular value of K G degree of initial turbulence and 
strength of ignition source. For gases the values given for 
K g are as follows: 


Kq (bar m/s) 

Methane 

55 

Propane 

75 

Coke gas 

140 

Hydrogen 

550 


For solvents the value used is that for propane. The nomo¬ 
graphs give the vent area A v as 

A v * f(V, K g , P stat , P red ) [17.12.48] 

where P red is the reduced pressure and P stat the vent open¬ 
ing pressure and Fis the volume of the vessel. 

The derivation of these nomographs has been described 
by Lunn, Brookes and Nicol (1988) and in NFPA 68:1994, 
and is discussed further in Section 17.48. 

There is a separate nomograph for each of the four gases 
mentioned. The vent opening pressure P stat is given as a 
parameter. The three values of P sta t are 0.1,0.2 and 0.5 barg. 
The range of values of P red is 0.2-2.0 barg. 

The nomographs are valid within a limited range of 
conditions. They are for a quiescent mixture and a weak 



Figure 17.24 Explosion venting of vessels: some vent ratio and vent coefficient predictions (N. Gibson and Harris, 
1976): (1) Donat’s results for St 2 dust; (2) Donat’s results for organic pigment; (3) results for pentane with vent coefficient 
K- 3; (4) vent ratio 1/6.2 rrf/m 3 ; and (5) vent ratio 1/3.1 rrf/m 3 . Maximum pressure rise 48 kPa and vent rupture pressure 
7-14 kPa (courtesy of the American Institute of Chemical Engineers) 
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ignition source (10 J). Their use is not recommended for 
V > 1000 m 3 , P stat < 0.1 barg and P red < 0.2 or >2.0 barg. 

Experiments have shown that above a reduced pressure 
P red of 2.0 barg, a well-defined correlation of P red cannot be 
obtained, which is the reason for the upper limit in the 
nomographs. 

The Kq nomograph method was adopted in NFPA 68: 
1988, and the nomographs in Figure 17.25 are those given in 
the 1994 version NFPA 68. 

The use of the nomographs is illustrated in Figure 17.26. 
For a vessel of volume V, enter on the right-hand graph, 
move up to the desired value of the reduced pressure P red , 
move left on the left-hand graph to the desired value of the 
vent opening pressure P stat and then move down to the 
required vent area A v 

The vent area given by the nomographs is illustrated in 
Figure 17.27 for aim 3 vessel with a vent opening pressure 
Pstat = 0.1 barg. 

The nomographs may be used for other gases by inter¬ 
polation of the K g values. They may be used for stronger 
ignition sources if the K G value for the gas with that igni¬ 
tion source is known. 

In Bartknecht’s method, if the mixture is not quiescent, 
the effect of turbulence must be taken into account. The 
information available on this is limited. But for large vent 
area A v and low reduced pressure P re d (<2 bara) turbulence 
has little effect and the nomographs may be used as they 
stand. For small A v and high P red (>2 bara) A v should be 
increased by a correction term AA„ where 

AA v = 0.08 F 2 / 3 [17.12.49] 

Bartknecht states that this treatment is applicable only to 
methane, propane and solvent vapours and for P stat < 0.1 
barg. This correction is not accepted yet by NFPA 68. 

The initial, or operating, pressure on which the nomo¬ 
graphs are based is 1 bara, but they may be used without 
correction up to a value of 1.2 bara. Data outside this 
range were not available when the nomographs were for¬ 
mulated, but Bartknecht states that for higher operating 
pressures it should be assumed that for a given vent area the 
reduced explosion pressure is proportional to the operating 
pressure. 

An equation equivalent to the Bartknecht nomographs 
has been given by Simpson (1986). His equation is 

= aF b exp(cP sta t)Pre d [17.12.50] 

where the units are A v (m 2 ), P lei (barg), P stat (barg) and V 
(m 3 ). The range of validity of the equation is 

1 * ¥ < 1000; 0.1 < P sta , < 0.5; P stat + 0.1 < P red < 2 

Values of the constants in Equation 17.12.50 are given in 
Table 17.15. Equation 17.12.50 is quoted in NFPA 68:1994. 

17.12.18 Experimental studies of venting relations 

A review of experimental studies comparing the predic¬ 
tions of empirical and semi-empirical equations with 
experimental results is given by Lunn. 

The equations recommended by Lunn as the most ver¬ 
satile are Equation 17.12.11 of Rasbash and Equations 
17.12.17 and 17.12.18 of Cubbage and Simmonds. The Runes 
equation (Equation 17.12.22) contains the constant C, which 
is too dependent on the particular conditions from which it 


was derived. The Decker equation (Equation 17.12.29) gives 
upper limits of P red which are often reasonable but in 
other cases are overestimates. The Dragosavic equations 
(Equations 17.12.30 and 17.12.31) are limited to methane- 
air mixtures, and the Burgoyne and Wilson equation 
(Equation 17.12.36) to pentane—air mixtures. Rasbash’s 
other equations (Equations 17.12.34 and 17.12.35) are limited 
to low turbulence, and of the two relations Equation 17.12.34 
is superior to Equation 17.12.35 in all cases. The Cubbage 
and Marshall equation (Equation 17.12.33) is limited to 
methane-air mixtures as the dependency on the square of 
the burning velocity tends to give overestimates of P red for 
gases with high burning velocity. 

17.12.19 Modelling of explosion venting 

The modelling of combustion in an unvented vessel was 
described in Section 17.7. Models have also been devel¬ 
oped on similar lines for combustion in vented vessels. 

17.12.20 Vent outflow equations 

The outflow from a vented vessel may be subsonic or sonic. 
Equations for both types of flow were given in Chapter 15. 
As the absolute pressure P in the vessel increases relative 
to atmospheric pressure P a the ratio r\ (= PJP) decreases. 
Whenthisratiofallsbelowacritical value r) c ( = 2/(y + l)F(r+ 1 )) 
sonicflowoccurs.ThemassoutflowperunitareaG v from the 
vessel is then 


G v = Cd/y [17.12.51] 

with 

A mfa [17.12.52] 

ft i =/ V sbi subsonic flow [17.12.53a] 

= / vsl sonic flow [17.12.53b] 


subsonic flow 

T / ? \b+i)/b-i)T 1/2 

sonic flow [17.12.55] 

where C d is the coefficient of discharge, y is the ratio of gas 
specific heats and p is the density of the gas. An alternative 
form of these equations utilized in some models is 

f = (Ppy) 1 / 2 f y2 [17.12.56] 

f w 2 =/ V sb2 subsonic flow [17.12.57a] 

fa / vs2 sonic flow [17.12.57b] 

with 

/vsM — subsonic flow [17.12.58] 

(Ppyf p 

= /vsl ., 9 sonic flow [17.12.59] 

(Ppy) 

For common gases such as air (y = 1.4) the value of rf c is 
about 0.5. 
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Figure 17.25 Explosion venting of vessels: nomographs for vent area (NFPA 68: 1994) (a) methane, (b) propane, (c) coke gas, and (d) hydrogen. See text for details 
(reproduced with permission from NFPA 68 Deflagration Venting, Copyright © 1994, National Fire Protection Association, Quincy, MA 02269). Note: This reprinted 
material is not the complete and official position of the National Fire Protection Association on the referenced subject which is represented only by the standard in 
its entirety) 
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Figure 17.25 Continued 
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Figure 17.25 Continued 











































































































(d) 



Figure 17.25 Continued 
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Figure 17.26 Explosion venting of vessels: nomographs for vent area - use of nomograph (Bartknecht, 1981a) 
(Courtesy of Springer-Verlag) 



Relief area, A, (m 2 ) 


Figure 17.27 Explosion venting of vessels: vent area recommendations for 1 m 3 vessel with P stat =0.1 barg (Bartknecht, 
1981a): (a) K G , K st = 200 bar m/s and (b) K G , K st = 300 bar m/s (Courtesy of Springer-Verlag) 


Two other vent outflow relations which are sometimes 
used for small pressure drops in the subsonic flow range, 
for which near-isothermal conditions apply, are 

/ v3 = [2p 0 (P-P a )] 1/2 

(17.12.62] 

/v=/v3 

[17.12.60] 

/ v4 = [2p a P a ln(P/P a )] 1/2 

(17.12.63] 

/v=/v4 

[17.12.61] 

where p a is the density of the gas 
pressure. 

at atmospheric 
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Table 17.15 Explosion venting of vessels: values of 
parameters for an equation equivalent to the Bartknecht 
nomographs (after Simpson, 1986) (Courtesy of American 
Institute of Chemical Engineers) 


Gas 


Parameter 


a 

b 

t 

d 

Methane 

0.105 

0.770 

1.23 

-0.823 

Propane 

0.148 

0.703 

0.942 

-0.671 

Coke gas 

0.150 

0.695 

1.38 

-0.707 

Hydrogen 

0.279 

0.680 

0.755 

-0.393 


17.12.21 Benson and Burgoyne model 

In an early treatment of the problem, Benson and Burgoyne 
(1951) gave the following model for combustion venting of a 
spherical vessel. From Equation 17.7.15 the rate of increase 
of the volume V b , of the burned gas expanding as a sphere 
of radius r b is 


[17.12.64] 


The flame speed is 


17.12.22 Yao model 

A numerical model for explosion venting of vessels has 
been given by Yao and co-workers (Yao et al., 1969; Yao, 
1974). The method is intended for venting of low pressure 
explosions. 

The explosions are characterized by a pressure—time 
profile with two peaks. The model can be made to fit these 
two peaks fairly well, but to do so requires the use of a tur¬ 
bulence correction factor % which allows for effects which 
enhance theburning velocity or the flame area and is in effect 
a parameter that can be tuned to fit the experimental results. 
Yao (1974) defines a venting parameter a such that 

(2qjA T a ) 1/z (P 0 \ 1/2 / Pbo\ 7/6 

S*V \pj \pj 

and a venting area parameter G, 

G = aAy/V 

where a is a characteristic length (which for a spherical 
vessel is the radius), p bo is the density of the burned gas at 
the initial pressure and p uo is the density of the unburned 
gas at the initial pressure. 

Then for a given maximum explosion pressure A P m 


[17.12.71] 

[17.12.72] 


d/b 
d t 


EW 


[17.12.65] atx G 


[17.12.73] 


where E is the expansion ratio defined by Equation 17.7.41, 
lYis the mass rate of combustion and p u the density of the 
unburned gas. It is pointed out by Lunn that according to 
Bradley and Mitcheson E in Equation 17.12.65 and the fol¬ 
lowing equations should be replaced by E - 1. Hence, from 
Equations 17.12.64 and 17.12.65 


and for varying maximum explosion pressure 
A P m = /(a) [17.12.74] 

Yao gives plots of AP m for the second peak as a function of 
a showing both experimental and theoretical results. 


dF b Ant b W(E — 1) 

~dT“ 


[17.12.66] 


The rate of increase of the burned volume is at a maximum 
when r b = f* the radius of the vessel, so that 


YlViA _ 4izrfW(E - 1) 

V At /ma”"" K 


[17.12.67] 


The volumetric vent flow Q v at the venting pressure P re d 
through a vent area A v is 


Qv - 


CdAr/v 


[17.12.68] 


Then, equating the maximum rate of increase of the 
burned volume given by Equation 17.12.67 with the volu¬ 
metric vent outflow in Equation 17.12.68 


17.12.23 Bradley and Mitcheson method 

D. Bradley and Mitcheson (1978) have given two models for 
combustion venting of a spherical vessel, one an analytical 
model and the other a numerical, or computer, model. They 
treat both subsonic and sonic flow and both venting of 


unburned gas and venting of burned gas. 
They define the following parameters: 


i - c t- 

[17.12.75] 


[17.12.76] 


[17.12.77] 




t-d/v 

The density of the unburned gas p u is obtained assuming 
adiabatic compression: 




[17.12.70] 


«uo = (PoyJPvof 2 [17.12.78] 

where a is the velocity of sound, A is the vent area ratio, A s 
is the surface area of the spherical vessel, A, is the vent 
area, C d is the coefficient of discharge, P is the pressure, 
S is the burning velocity, p is the gas density, the subscripts 
b, o, u and v denote burned, initial, unburned and at 
vent conditions, respectively, and an overbar denotes 
dimensionless. 
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The authors state that on the assumption that the initial 
pressure in the vessel and the external pressure are equal, it 
can be shown that 


The vent area A v is that which is just sufficient to vent the 
volume of gas. 

Bradley and Mitcheson give the following volume bal¬ 
ance on the gas. The volumetric rate of increase of burned 


m&A— [17.12.80] 

Pbv 

The volumetric rate of decrease of unburned gas is 
= SyA s [17.12.81] 

Hence, the net rate of increase of gas volume is 


- .S v /h 




[17.12.82] 


^>/v 2? 


So(Puo/Pbo - 1) \Pj 

for the venting of unburned gas and 


fb 


Ww 


[17.12.8i 


17.12.24 Rust model 

Rust (1979) has derived the following model for explosion 
venting of a spherical vessel: 

Vami/3-m 3 p7.12.89] 


V t =EV n 

E = Pmax/Po 
= Vi/V 

P _ Vt 
P 0 ~ V 


[17.12.92] 

[17.12.93; 


[17.12.94] 


The mass rate of venting is 

^ = C d A(PvPuv7) V2 /v2 [17.12.83] 

where nu, is the mass vented and P v the pressure at the vent. 
Although not given by Bradley and Mitcheson, the further 
steps in the derivation are evidently as follows. The volu¬ 
metric rate of venting is 

dE, /Pv\ 1/2 

dt =QAy {p) /v2 [17.12.84] 

where V v is the volume vented. But 

^ ^ [17.12.85] 

where fly is the velocity of sound at the vent conditions. 
Then, equating the net rate of increase of gas volume given 
by Equation 17.12.82 with the volumetric rate of venting 
given by Equation 17.12.84 together with Equation 17.12.85 
yields the relation given in Equation 17.12.79 but with an 
equality. These authors also give the relation 


where E is the expansion ratio, P is the absolute pressure, 
Pmax is the absolute maximum pressure of the unvented 
explosion, P 0 is the absolute initial pressure, r is the radius 
of the burned gas before expansion, t is time, u is the veloc¬ 
ity of the flame front, V is the volume of the sphere, Vi is the 
volume of burned gas after expansion at the end of com¬ 
bustion, V a is the volume of burned gas before expansion 
and V t is the volume of burned gas after expansion. Then, 
from Equations 17.12.89-17.12.92 


[17.12.86] 


= 4/3 nip ft 

But from Equations 17.12.92,17.12.93 and 17.12.94 

^ i 

Then, from Equations 17.12.95 and 17.12.97 

P = 4/3ra<¥ i ^p 


[17.12.95 
[17.12.96] 


P M 


r 


K = 4/37ra 3 P max 
From Equation 17.12.99 

, (PV) 1/3 


[17.12.98] 

p7.12.99] 

[17.12.100] 

[17.12.101] 


for the venting of burned gas, where C is the vent flow 
coefficient. The value of y in the term f v2 in Equation 
17.12.86 should also be the appropriate one for unburned 
or burned gas as the case may be. 


and from Equations 17.12.96 and 17.12.100 
Vt =iff 3 /P 0 
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Equating the volume production rate AV t /At with the vent final, initial and unburned. Also, from Equations 17.12.108 
outflow Q v and 17.12.109 


Q y =^ t [17.12.103] 

differentiating Equation 17.12.102 with respect to t and 
substituting for t from Equation 17.12.101 gives 


3 (PV) 2/3 KV 3 
Q '~~ />,- 


[17.12.104] 


T b -T u 

T u 


P m -P 0 


[17.12.112] 


For the vent gas outflow the authors use the following 
equations: 


^ = %7iT ( P “ P “) 1/Z subsonic flow [17.12.113] 




For the volumetric vent outflow Rust uses the relation for a™ k„->A„ 

subsonic flow ^t~~T son i c fl° w [17.12.114] 


Q oc AyAP 1 / 2 [17.12.105] 

where A P is the pressure difference. Rust sets P in 
Equation 17.12.104 equal to P msx to give a maximum flow 
requirement and AP in Equation 17.12.105 equal to the 
reduced explosion gauge pressure P red and introduces a 
shape factor F to take account of non-spherical vessels, 
defined as 

P = A F /A S [17.12.106] 


where A, is the vent area (ft 2 ), P a is the atmospheric 
pressure (lbf/in. 2 ), k w \ (mol in.°R 1/2 /lb 1/2 ft 2 s) and k V 2 (mol 
in.°R 1/2 /lb 1/2 ft 2 s) are constants and the subscript e denotes 
the end of combustion. The values of the constants in these 
units are k v i = 20.6 and k,2 = 2.63. These values incorporate 
a mean molecular weight for the vented gas, the value 
used being that of air (M= 29). The mass balance is 


d« u 

"dT 


dWb d«e 

HF + dF 


[17.12.115] 


where A F is the largest spherical surface in the enclosure 
and A s the surface area of the sphere having the same 
volume as the enclosure. Then, from Equations 17.12.104 
and 17.12.105 the vent area is 


A v 


kF(P max V) 2 / 3 kV 3 

P red 


[17.12.107] 


The rate of pressure rise is obtained by differentiating 
Equations 17.12.110 and 17.12.111 with respect to/and add¬ 
ing them to give 

Then, combining Equations 17.12.115 and 17.12.116 gives 


where P red is the reduced pressure (gauge) and k a 
constant. 

In British units, A v (ft 2 ), A(Ib f ft/s 3 ), P ma x(lb f /ft 2 ), 
P red (lbf/ft 2 ) and F(ft 3 ), the value of k is 8.35 x 10“ 5 . 

17.12.25 Nagy and Verakis model 

Nagy and Verakis (1983) have derived models for the 
following cases: 

(1) venting of cylinder 

(a) ignition at closed end, 

(b) ignition at vent end, 

(c) ignition at center; 

(2) venting of sphere 

(a) ignition at centre. 


dP 

At 


f iT "] 


[17.12.117] 


The rate of burned gas production is 
d«b _ oiAPSu 
T RT a 


[17.12.118] 


where A is the area of the flame front (ft 2 ), S u is the burning 
velocity (ft/s) and a is the coefficient of turbulence. 

The treatment for the individual cases, which is for an 
open vent, is then as follows. The case of subsonic flow is 
considered first. 


Venting of cylinder, ignition at closed end 

For venting of a cylinder with ignition at the closed end, 

Equations 17.12.113,17.12.117 and 17.12.118 yield 


The gas laws are used in the form 


P 0 V =noRT u [17.12.108] 

p m V = n 0 RT h [17.12.109] 

PV b =« b PPb [17.12.110] 

P(V - F b ) = nJtT u [17.12.111] 


where n is the number of moles (lb mol), P is the absolute 
pressure (lb f /in. 2 ), R is the universal gas constant (lb ft 3 / 
in. 2 mol °R), T is the absolute temperature (°R) and Fis the 
volume (ft 3 ) and the subscripts b, m, o and u denote burned, 


dP ccPSu fP m — P 0 \ RT u kn(A v /V) /n n a/2 
At L \ P 6 ) , 

[17.12.119] 


where L is the length of the cylinder (ft). 

Setting API At = 0 for the vent condition and also setting 
P as the vent pressure P red and rearranging gives 


Pred _PPAiP 0 P(A v /F) 
(Pred-Po) 1/2 _ Pu /2 aS u (P m -P 0 ) 


[17.12.120] 
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Equation 17.12.120 is sometimes referred to as the 
Pittsburgh method. For venting of burned gas the term 
replaces T^ 2 , in the denominator of the term on the right- 
hand side to give 


P red _RT u k ll P 0 L(A w /V) 
(P«d - Po) V ~ ~ T b 1/z oeS;(P m - P 0 ) 


[17.12.121] 


The relations for sonic flow may be obtained in a similar 
manner using Equation 17.12.114. 

Summarizing the various cases, Nagy and Verakis state 
that the most representative relationship for venting is 
Equation 17.12.121 for the venting of a cylinder with igni¬ 
tion at the closed end. It is that equation which is referred to 
by Lunn as the Pittsburgh method. 


Venting of cylinder, ignition at vent end 

Venting of a cylinder with ignition at the vent end differs in 

that burned gas is vented from the start so that 


lm2122i] 

f,: 1 - [17.12.122b] 

and hence 

d P _ aPSu f P m -P 0 \ 
df L \ P„ ) 

- RThkl ^^ (P - P„) 1/2 [17.12.123] 

Venting of cylinder, ignition at centre 
Venting of a cylinder with ignition at the centre is rather 
more complex in that there are two flame fronts travelling 
out from the centre. For the rate of rise of pressure Pi on the 
closed end side 

dPj _ y.pS u (P m - P 0 \ RT u kyi(A v /V ), D D , 1/s£ 
df L \ P 0 ) 7-1/2 ri 

[17.12.124] 

and for the rate of rise of the pressure P 2 on the vent end side 
dP 2 a P 2 S u (P m -Po\ RT u kyi(A v /V), n , 1/2 

d, = 'L [ p 0 r ^r ( P2 ~ Po) 

[17.12.125] 

Summing these two rates of pressure rise gives 


dP _ 2aPS u f P m - P 0 \ 

P J 

- R ( T'f + )MA V /F)(P - Po) V2 [17.12.126] 


Venting of sphere, ignition at centre 
It might be thought that venting of a sphere is a simple case, 
but this is not so, since the flame front distorts as the gas 
flows through the vent. The rate of rise of the pressure is 
considered in two stages. For the period before the burned 
gas reaches the vent 

dP _ aPASu (P m — P 0 \ RT a k wl {A v /V) , D 

df V \ P 0 J T l J 2 

[17.12.127] 

and for the period after T^ 2 replaces Ta 2 in the denomi¬ 
nator of the second term on the right-hand side. 


Effect of vent opening pressure 

The effect of the vent opening pressure P v has been allowed 
for by Nagy and Verakis by modifying Equation 17.12.121 
to give 


P red + AP V _ RT a k v \PoL{A v / V) 
(p«d - P Q ) 1/4 r b /z «Sta(P m - P 0 ) 


[17.12.128] 


where AP v is the overpressure at which the vent opens 
(lbf/in. 2 g). 


17.12.26 Singh method 

J. Singh (1979b, 1988b) has described a method of vent siz¬ 
ing based on the venting parameter (A/S 0 ) of Bradley and 
Mitcheson described above. 

These latter workers defined a maximum pressure 
rise AP m above the initial pressure and gave a number of 
plots of AP m vs (A/S 0 ) The plot given by Singh is shown in 
Figure 17.28.The full lines represent sets of data reportedby 
various workers, the dashed lines approximate upper and 
lower limits on these data. The change of slope in the lines is 
due to the transition from subsonic to sonic flow as the 
pressure rises. 

The equations given by Singh for the two sets of lines are 
as follows. The basic equation is 

AP m = k(A/S o y n [17.12.129] 

with for the upper limit lines 



Figure 17.28 Explosion venting of vessels: effect of 
normalized vent ratio on maximum pressure rise (J. Singh, 
1979b) (Courtesy of Chemical Engineering) 
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k = 12.32, n = 2, AP m < 1 

k = 2.4, « = 0.7, A P m > 1 

and for the lower limit lines 
k = 0.77, n = 2, AP m < 1 

k = 0.91, n = 0.7, AP m > 1 

where A is the dimensionless vent area, AP m is the maxi¬ 
mum pressure rise (atm), S ? is the dimensionless burning 
velocity at the initial conditions and k is a constant. 

The lower limit lines correspond to situations with 
essentially zero turbulence. If the burning velocity term in 
the venting parameter is adjusted to allow for an enhance¬ 
ment of burning velocity by turbulence by a factor of about 
4 the upper limit lines are obtained. In other words, the 
difference in the two sets of lines is mainly due to turbu- 

The burning velocity term of the venting parameter 
is defined in Equation 17.12.77. The density ratio term may 
be approximated by the relation 

= Ill [17.12.130] 

Pbo 1 UO 

where T t is the adiabatic flame temperature (K), p is the 
density of the gas (kg/m 3 ) and the subscripts b, o and u 
denote burned, initial and unburned, respectively. The 
density ratio tends to lie in the range 7.5-8.5 for most fuels. 

J. Singh (1988b) has extended his treatment to non- 
spherical vessels. From Equation 17.7.137 the rate of 
pressure rise dP/dt is proportional to the area A t of the 
flame front. The following areas apply to different vessel 


geometries: 

Af = An rf sphere j|7.12.131a] 

fe As [17.12.131b 

Af = Anri long cylinder with fl7.12.132a] 

central ignition 

= 4/1 x fL7.12.132b] 

Af = Anri long cylinder with end ignition [17.12.133a] 

= 2A x ijl7.12.133b] 


whereA f is the area of the flame front (m 2 ), A s is the surface 
area of the sphere (m 2 ), A K is the cross-sectional area of 
the cylinder (m 2 ), r c is the radius of the cylinder (m) and r s is 
the radius of the sphere (m). 

Singh’s method is to treat A s in the venting parameter as 
equivalent to A± and to adjust it for non-spherical vessels 
according to the above relations. 

The results of the method are illustrated in Table 17.16. 


17.12.27 Method of Epstein, Swift and Fauske 

Epstein, Swift and Fauske (1986) have developed a model 
for explosion venting of a spherical vessel on the following 
lines. The mass balance is 


d t 


d«b d m e 
dt + d t 


[17.12.134] 


Table 17.16 Explosion venting of vessels: overpressures 
(pressure above vent opening pressure, A P m ) in non- 
spherical vessels using Singh’s method (after J. Singh, 
1988b) (Courtesy of Butterworth-Heinemann) 


Vent area 
(m z ) 

Experimental 

(bar) 

Theoritical (bar) 

Unmodified 1 

Modified* 

0.2 

0.048 

1.85 

0.054 

0.1 

0.24 

3.01 

0.22 

0.067 

0.37 

4.0 

0.48 

0.02 

1.22 

9.31 

1.81 


a Calculated using Equation 17.12.129, unmodified. 
b Calculated using Equation 17.12.129, modified by using Equation 
17.12.132 or 17.12.133. 


and the mass vent outflow is 

^ = A V G V [17.12.136] 

where </> is a turbulence correction factor. The densities of 
the unburned and burned gas are 


P u 



GET 

(r 


The volume of the closed vessel is 


[17.12.137] 

[17.12.138] 


«u + «b 

Pu Pb 


[17.12.139] 


Then substituting for p u and p b from Equations 17.12.137 
and 17.12.138 in Equation 17.12.139 and then differentiating 
the latter with respect to t, eliminating dmjdt and dmjdt 
using Equations 17.12.135 and 17.12.136, solving for dP/dt, 
setting 7u = 7b and applying Equation 17.12.139 again yields 


7 dlnP _ 

7b dt 


[17.12.140] 


Combining Equations 17.12.135 and 17.12.138, differentiat¬ 
ing with respect to time and combining the result with 
Equation 17.12.140 to eliminate dP/dt yields 



[17.12.141] 

Dividing Equation 17.12.140 by Equation 17.12.141 gives 


1 d In P _ B(pjp h - 1)Z 2 / 3 - 1 
7 b dt ~ B[p u / p b — (p u /p b — 1)Z\Z 2 / 3 + Z 


[17.12.142] 


The mass production of burned gas is 


with 


B= Ay G v 


^ = 4argMS, 


[17.12.135] 


[17.12.143] 
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[17.12.144] 


where B is a dimensionless burning number and Z a 
dimensionless burned volume. For sonic flow Epstein, 
Swift and Fauske use 


G v = (2Pp u ) 1/Z [17.12.145] 

Making a number of additional assumptions the authors 
derive 


Pi _P m a X //t + By- 
. = (Pset/Po) Vn 1 

(Pmax/Po) 1 ^ ~ 1 


[17.12.146] 


[17.12.147] 



Figure 17.29 Explosion venting of vessels: variation of 
pressure with flame radius in a spherical vessel (V.M. 
Morton and Nettleton, 1977) (Courtesy of the Combustion 
Institute) 


where P aet is the vent opening pressure and X is a dimen¬ 
sionless vent opening pressure. 

The vent area A v may be obtained from the burning 
numberB defined by Equation 17.12.143. 

The model contains a number of approximations. The 
authors compared their results with results given from the 
computer model of Bradley and Mitcheson and obtained a 
good fit, leading them to conclude that the approximations 
were justified. 

This model has been extended by Swift and Epstein 
(1987) for subsonic flow. For subsonic flow they use 

G y = C d [2Pp u (l - {P a /P)] 1/2 [17.12.148] 


The model of Fairweather and Vasey (1982) for explosion 
in a closed vessel was described in Section 17.7. The 
treatment given by these authors also extends to explosion 
venting. The mass production of burned gas is given by 
Equation 17.7.37. The mass vent outflow of gas is obtained 
fromEquation 17.12.51.The mass of unburned gas is givenby 

+ «b = m 0 - m e [17.12.151] 

The volume of unburned gas is obtained assuming adia¬ 
batic compression of the initial gas: 



where P a is atmospheric pressure. They derive an equation 
equivalent to Equation 17.12.146 for sonic conditions as 

S = 1+ [fe) V,b_1 ] 52 [17 ' 12149] 

where P t is the absolute final pressure of the vented explo¬ 
sion, or the reduced pressure. 

Then rearranging Equation 17.12.149 and substituting 
for B from Equation 17.12.143 gives 


AsPufiSu [(Fm a x/F > o) 1/l ’ b — 1] 

QGy (H/Po - fP 


[17.12.150] 


17.12.28 Other models 

Morton and Nettleton’s model for explosion in a closed 
vessel was described in Section 17.7. The model may be used 
to determine the vent opening pressure for a given propor¬ 
tion of burned gas in the total gas vented. 

As an illustrative example, consider the plot of the pres¬ 
sure ratio P/P 0 vs the radius ratio r/a shown in Figure 17.29. 
From this figure a spherical vessel of 5 m radius (520 m 3) 
with a vent designed to open at 1 barg (P/P 0 = 2) will have a 
value of rja of 0.77. Hence, the volume of unburned gas will 
be 280 m 3 and that of burned gas 240 m 3 at the start of 
venting. 


The volume of burned gas is obtained from Equation 17.7.4. 
The temperatures of the unburned and burned gases 
are obtained from Equations 17.7.9, 17.7.10, 17.7.27 and 
17.7.28. 

17.12.29 Elongated vessels 

Vessels which have a length/diameter (L/D) ratio of 3 or less 
may be regarded as compact, those with an L/D greater 
than that as elongated. 

For L/D ratios greater than 6, the usual practice is to 
install one vent for each section divided lengthwise to 
lengths Li such that each L,/D is approximately 3. 

In their early studies of venting, Cousins and Cotton 
(1951a) investigated a range of L/D ratios from 1.41 to 22.1. 
The systems which they studied are given in Table 17.14. 

They did experiments with 5% propane—air and 40% 
hydrogen-air mixtures, with open vents and with initial 
pressures of 0,15 and 45 psig and measured the maximum 
pressure of the vented explosion. They expressed their 
results in terms of plots of this maximum pressure against 
the vent ratio. Some of the results are shown in Figure 17.30. 
They show that there is a reasonable correlation with vent 
ratio across the L/D range investigated. 

The work of Singh, described above, also covers elon¬ 
gated vessels with an L/D ratio up to 30. 

Further treatment of venting of high L/D containers is 
given in Section 17.13 on the explosion venting of pipes 
and ducts. 
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(a) 


(b) 




Figure 17.30 Explosion venting of vessels: effect of vessel aspect ratio on maximum explosion pressure (Cousins and 
Cotton, 1951a): (a) 5% propane-air mixture in a tank (UD= 2.30) and (b) 40% hydrogen-air mixture in a drum 
(L/D- 1.44), tank (LYD= 2.30), and pipe (LVD= 22.1) (Courtesy of Chemical Engineering) 


17.12.30 Critique of available methods 

The methods available for the prediction of the vented 
explosion pressure have been reviewed by Lunn. Of the 
empirical methods, his preferred methods are those of 
Cubbage and Simmonds and of Rasbash. 

For the Cubbage and Simmonds method to be applicable 
it is necessary that the vent opening pressure should not 
exceed 7 kPa and that the vent panel have a low inertia. 
For these conditions the second peak equation of these 
authors gives good results. For finite vent opening pres¬ 
sure the results are not so good, since the method does not 
take vent opening pressure into account. 

For finite vent opening pressures up to 7 kPa Lunn states 
that the first three terms of the Rasbash equation give good 
results for the first peak. 

For high vent opening pressures, Lunn recommends 
the use of the data given by Cousins and Cotton or the 
Bartknecht K c method for good results. 

Lunn states that the methods of Cubbage and Marshall, 
Runes, Decker, Dragosavic and Burgoyne and Wilson are 
not recommended for general use. 

Of the theoretical methods which he reviews, that of 
Bradley and Mitcheson gives an upper bound. 

17.12.31 Venting phenomena 

If the vent is an open one, venting will result in the emer¬ 
gence of flame. The flame may be substantial. C.J.M. van 
Wingerden (1989c) has reported a jet flame 18 m long. 

If the vent has a duct, there is potential for unburned gas 
to undergo further combustion in the duct, possibly 
resulting in overpressure in the duct. The ducting needs 
to be designed to avoid this. 

17.12.32 Reaction force due to venting 

Venting causes a back reaction on the vessel. The determi¬ 
nation of this force may be approached by considering the 
flow from the vessel or the pressure in the vessel. 

A fundamental treatment based on the flow is given by 
Duncan,Thorn and Young (1960) and by Leung (2002). The 
mass vent flow from the vessel is A^pu, the mass vented in 
time t is A,put, its momentum is A w pu 2 t and the rate of 


change of momentum is A,pu z . The force is equal to the rate 
of change of momentum thus 

F r = A v pu 2 [17.12.153] 

where A v , is the vent area, F r is the force due to back reac¬ 
tion, t is the time, u is the velocity of the fluid and p is the 
density of the fluid. 

Alternatively, the force may be obtained from the maxi¬ 
mum pressure P led in the vessel during venting. 

The reaction force has also been measured in tests. NFPA 
68: 1994 gives the following empirical equation for the 
reaction force, applicable only to enclosures without ducts: 
F t = 1.2 A v P Iei [17.12.154] 

where A v is the vent area (in. 2 ), F T is the reaction force (lb f ) 
and P re d is the reduced pressure (gauge) (lb f /in. 2 ). 

NFPA 68 states that the reaction force can be considered 
as equivalent to a force applied at the geometric centre of 
the vent. It warns, however, against assuming that the 
forces on two opposing vents will cancel out, since one 
vent may open before the other. 

It further states that equivalent static force on the struc¬ 
ture supporting the vented enclosure is given by Equation 
17.12.154 but with the constant 1.2 replaced by 0.62. 

Back reaction forces due to venting are also discussed in 
Chapter 12. 

17.12.33 Vent ducting effects 

It has been found that the presence of a vent duct can have 
a marked effect on the maximum pressure in a vented 
explosion. 

Figure 17.31 is a graph from the work of Pineau, Giltaire 
and Dangreux (1978), showing the pressure in the vessel 
and in the duct as a function of duct length for a 10 m 3 
vented vessel. 

Typically, the maximum pressure rises rapidly with the 
initial increase in the length of the tube and then reaches 
a plateau or increases or decreases at a much slower rate. 
This effect was described by Sagalova and Resnick (1962) 
for dust explosions and has been observed by Kordylewski 
and Wach (1986,1988) for gas. 
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Figure 17.31 Explosion venting of vessels: effect of 
vent duct on pressure in a 10 m* vessel (Cross and Farrer, 
1982; after Pineau, Giltaire and Dangreaux, 1978) 


The latter conducted experiments using a 221 vessel with 
vents and vent tubes of 21,25 and 35 mm diameter.The gas 
used was town gas. They were unable to account for the 
increase in the maximum pressure by the flow resistance of 
the duct and instead considered turbulence, secondary 
explosions, acoustic oscillations and Helmholtz oscilla¬ 
tions to be responsible. They found that acoustic oscilla¬ 
tions can increase the maximum overpressure by 203 times 
for tube length in the range 0-20 diameters. 

17.12.34 Vent design 

Design of a vent system based on a vent panel includes 
consideration of the following features: (1) reduced explo¬ 
sion pressure, (2) vent opening pressure, (3) vent area, 
(4) vent distribution, (5) vent opening, and (6) vent panel. 

The reduced explosion pressure for a vented explosion 
will be determined by the mechanical strength of the con¬ 
tainment. Explosion venting is used for low-strength as 
well as high-strength equipment. 

The vent opening pressure also needs to be set before the 
vent area can be calculated. The values of the vent opening 
pressure P st at to which the Bartknecht nomographs apply 
are 0.1 < P slat < 0.5 barg. 

The distribution of the vent area determined is generally 
not critical for vessels, though it may be more important for 
buildings and modules. 

The time of opening of the vent can affect the pressure 
developed. A sudden opening, such as occurs with a 
bursting disc, tends to increase turbulence. A smooth 
opening is desirable to minimize turbulence. 

The design of the vent panel itself is important. 


17.12.36 Vent panel dynamics 

The static pressure required to move a vent panel slowly 
may be quite low, but the pressure needed to impart a high 
acceleration to the panel so that it moves rapidly may be 
much higher. Thus 

F = Ma [17.12.155] 

and hence dividing by the area A of the panel 
P = wa [17.12.156] 


w = M/A [17.12.157] 


where a is the acceleration of the panel, Fis the force on the 
panel, Mis the mass of the panel, P is the pressure and w is 
the weight per unit area of the panel. 

An analysis of vent panel dynamics has been given 
by Rust (1979). He considers the following five situations: 

(1) Panel moves by translation; vertical panel; horizontal 
translation. 

(2) Panel moves by translation; horizontal panel; vertical 
translation. 

(3) Panel hinged along width; vertical panel; horizontal 
rotation. 

(4) Panel hinged along width; horizontal panel; vertical 
rotation against gravity. 

(5) Panel hinged along width; horizontal panel; vertical 
rotation with gravity. 

Figure 17.32 illustrates cases (1) and (3). 

For a panel of width W and length L which moves by 
translation a distance S to give a peripheral area WL equal 
to the vent area A v the peripheral area is 2S( W+L). Equat¬ 
ing these two areas 


S 


WL 

2(W +L) 


[17.12.158] 


At pressure P the acceleration a of the panel is 
a = PA V /M [17.12.159] 


where Mis the mass of the panel. From Equations 17.12.99 
and 17.12.159 


[17.12.160] 


17.12.35 Vent panel design 

Some features which need to be taken into account in the 
design of the vent panel itself are (1) panel material, (2) 
panel inertia, (3) relieving fasteners, (4) panel restraint 
system, (5) guarding, and (6) maintainability. 

Detailed guidance on vent panel design is given in the 
HSE Guide and in NFPA 68:1994. 

The guidance given by W.B. Howard and Karabinis 
(1980) for vent panels for explosion venting of buildings is 
outlined in Section 17.14. 


Integrating Equation 17.12.160 to obtain the velocity v 
attained by the panel with the initial condition t=t„v= 0, 
where t, is the time of start of venting, and integrating 
again to obtain the distance s travelled by the panel with the 
initial condition t=t„s = 0, substituting at t=t v pressure 
P=Py, the vent opening pressure, and defining a panel 
‘density’D, 

D = Mg/A w [17.12.161] 
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Figure 17.32 Explosion venting of vessels: movement of vent panels for release of gas (Rust, 1979) (Courtesy of 
Chemical Engineering) 


where g is the acceleration due to gravity, yields 


S: 




2/ 3 £ 

D 


[17.12.162] 




p5/3 p 4 / 3 pl/3 p 5 / 3 

C = ^0 3 + IT 


[17.12.163] 


where P is the pressure (gauge) (lbf/ft 2 ) and P w is the vent 
opening pressure (gauge) (lbf/ft 2 ). Relations for the other 
cases are derived in a similar manner. For cases of rotation, 
the angle 9 to give the vent area is 


[17.12.164] 


and an additional constant E is obtained, 


E = ^ - Pl /3 P 1,3 +^2T [17.12.165] 

Table 17.17 summarizes Rust’s equations for vent panel 
dynamics. In his worked example, in Equations 17.12.163 
and 17.12.165 Rust uses a corrected vent opening pressure 
P„ = (P Y +D), where D is the ‘density’ of the vent panel 
(lb/ft 2 ) and K is the corrected vent opening pressure 
(gauge) (lbf/ft 2 ), instead of P v 


Table 17.17 Explosion venting of vessels: equations for 
vent panel dynamics given by Rust (after Rust, 1979) 
(Courtesy of Chemical Engineering) 


Horizontal translation 
Horizontal rotation 


Vertical translation upward 

Vertical rotation against 
gravity 

Vertical rotation with gravity 


m 2/3 c 

D 

e = ^(V\ 2 ' 3 C 
° 2 L\KJ D 



17.12.37 Vent details 

Guidance on details of vents for enclosures, both buildings 
and equipment, is given in NFPA 68:1994. The vents con¬ 
sidered are (1) open or unobstructed vents and (2) closed or 
sealed vents. 

Open vents are applicable to buildings rather than 
equipment.With a building it is often not practical to have a 
completely open aperture, but there are various arrange¬ 
ments which can provide good vents. They include louvres, 
open roof vents and hangar-type doors which can be moved 
to one side when an operation which may need to be vented 
is in progress. 

Closed vents may be used for either buildings or equip¬ 
ment. Features which can constitute a vent closure for a 
building or room include a door, window, movable sash, 
roof or wall panel or skylight. On equipment a vent closure 
may take the form of a charging door or inspection port, 
a dedicated venting device or a diaphragm. Diaphragm 
materials described include paper, cloth, plastic and metal. 
The diaphragm may be provided with a cutter. 

17.12.38 Vent duct design 

The effect of a vent duct on the reduced explosion pressure 
has already been mentioned. There is available guidance to 
assist in allowing for this effect. 

Correlations due to Bartknecht are shown in Figures 
17.33 and 17.34. Figure 17.33, given originally by Bartknecht 
(1981a), gives therelationshipbetweenthereducedexplosion 
pressure with the duct and that without a duct.There are two 
lines, the parameter being the duct length. Figure 17.34gives 
a further correlation for the same relationship, but in this 
case the parameter is the gas velocity. 

Both correlations were given in NPFA 68:1988, but only 
the first is retained in NFPA 68:1994. 

17.12.39 Safe discharge 

Explosion venting gives rise to three effects: a pressure 
wave, and discharges of flame and unburned material. All 
three effects need to be handled safely. 

If the material discharged is sufficiently toxic, this may 
invalidate the venting option. 

17.13 Explosion Venting of Ducts and Pipes 

In general, where combustion of a flammable gas mixture 
occurs in a duct or pipe, there is a possibility that if the duct 
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P rea without duct (barg) 


Figure 17.33 Explosion venting of vessels: effect of 
length of vent duct on reduced pressure (NFPA 68: 1994). 
See text for details (reproduced with permission from 
NFPA 68 Deflagration Venting, © 1994, National Fire 
Protection Association, Quincy, MA 02269). See note to 
Figure 17.25 



Figure 17.34 Explosion venting of vessels: effect of 
velocity in vent duct on reduced pressure (NFPA 68:1994). 
See text for details (reproduced with permission from 
NFPA 68 Deflagration Venting, © 1994, National Fire 
Protection Association, Quincy, MA 02269). See note to 
Figure 17.25 


is long enough the flame front will accelerate to the point 
where the deflagration turns into a detonation. Detonation 
is considered in Section 17.6 and is not considered further 
in this section, which deals with the explosion venting of 
deflagrations. 

The venting of elongated vessels was described in 
Section 17.12. The methods given there cover the venting of 
containers with length/diameter (L/D) ratios up to 30. 


Accounts of explosion venting of ducts are given in the 
Guide to the Use of Flame Arresters and Explosion Reliefs 
(HSE, 1965 HSW Bklt 34), Explosions (Bartknecht, 1981a), 
Venting Gas and Dust Explosions (Lunn, 1984b) and in 
NFPA 68:1994 Deflagration Venting. 

17.13.1 Experimental studies 

The design methods for explosion relief of ducts have 
tended to draw heavily on experimental work at the JFRO 
by Rasbash and Rogowski (Rasbash and Rogowski, 
1960a,b; Rogowski and Rasbash, 1963). 

The duct dimensions used in the experiments were from 3 
in. (76 mm) and 6 in. (152 mm) diameter to 12 in. (305 mm) 
square section and from 6 to 30 ft (1.8—9 m) long. Most of the 
experiments were done using propane-air and pentane- 
air mixtures. 

The results of the work are summarized by Lunn (1984b) 
as follows. For a base case in which a single open vent was 
located at one end of a straight, unobstructed duct with the 
ignition source either 15 cm from the closed end or a quarter 
of the way along the duct and with the most explosive con¬ 
centration of the gas-air mixture, the vented explosion 
pressure P lei at any position along the duct was propor¬ 
tional to the ratio of the vent area to the cross-sectional area 
of the duct, or vent coefficient, K, the constant of pro¬ 
portionality ranging from 5.6 to 12.6 for the conditions 
6< LjD <30 and 2<K< 32. For a vent coefficient K of 
unity, the maximum explosion pressure P max was propor¬ 
tional to L/D, the constant of proportionality being 0.49 for 
the conditions 6 < L/D < 48. The pressure and proportion¬ 
ality constants in the relations just described are in SI units 
(kPa). Lower vented explosion pressures were obtained 
when the ignition source was located near the vent or 
when a given vent area was provided by distributing a 
number of small vents along the duct. 

More recent work is that described by Bartknecht 
(1981a). The account given by Bartknecht of explosions, 
both deflagrations and detonations, was summarized in 
Section 17.5. His recommendations for protection of pipes, 
which are a combination of containment and relief, are 
described below. 

Work on combustion in pipes has drawn attention to 
several distinguishing phenomena which are relevant to 
the design of explosion venting for such systems. If a 
flammable mixture is ignited in a vessel and then enters 
an attached pipe, the flame front at the point of entry is 
fully developed and turbulent. It propagates much more 
strongly than one arising from spark ignition in the pipe 
itself. 

A flame front travelling down a pipe tends to accelerate, 
with possible run-up to detonation. In addition, turbulence 
promoters such as bends and valves can cause sudden 
accelerations of the flame front. 

If a flame front travels down an inadequately vented 
pipe and then enters a vessel containing a flammable 
mixture, it does so as a jet flame which constitutes a mas¬ 
sive ignition source, which can cause a violent explosion 
in the vessel. 

17.13.2 HSE Guide method 

The methods given in the HSE Guide are based on the work 
of Rasbash and Rogowski just described. Essentially, the 
same methods were used in NFPA 68: 1978, which was 
superseded by a revision in 1988. Since the methods in the 
revision of NFPA 68 are a development from this work, 
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although the link is no longer so clear, the HSE Guide 
method is described first. 

Unless otherwise stated, HSE Guide methods are 
applicable to gas mixtures at atmospheric pressure. They 
are applicable to ducts with an L/D ratio of 6 or more. Other 
methods are available for vessels with an LID ratio of 3 or 
less. For containers with an L/D ratio greater than 3 but 
less than 6 the use of methods for vessels with an L/D ratio 
of 3 or less is increasingly conservative as the Z./Z) ratio 
approaches 6. 

In designing explosion vents for ducts the following 
cases are distinguished: 

(1) Gas velocity < 10 ft/s 

(a) straight unobstructed ducts with L/D < 30, 

(b) straight unobstructed ducts with L/D> 30, 

(c) ducts containing obstacles; 

(2) Gas velocity 10- 6 0 ft/s 

(a) unobstructed ducts, 

(b) ducts containing obstacles. 

The design of vent areas is essentially based on the rela¬ 
tions between the maximum pressure P and the vent coef¬ 
ficient FT. 

If the gas is stationary or has a velocity less than 10 ft/s, 
the duct is straight and unobstructed and the L/D ratio is 
less than 30, only one relief opening is generally sufficient. 
The maximum pressure is given by the equation 

P k\ - k/K [17.13.1] 

where D is the diameter of the duct (ft), K is the ratio of the 
cross-sectional area of the duct to the vent area, or vent 
coefficient, L is the length of the duct (ft), Pis the maximum 
pressure (lb f /in. 2 ) and k i and k 2 are constants. The values of 
the constant ki and k 2 are: 


K h k 2 


1 0.07 0 

1- 2 0.035 0.9 

2- 23 0 1.8 


If a single vent is used, it should be placed as near as pos¬ 
sible to the most probable location of the ignition source, 
but if this latter is uncertain, the vent should be placed near 
the centre of the duct. 

For this vent system, a vent weighing not more than 2 lb/ 
ft 2 and held by springs or magnets is suitable. An alter¬ 
native relief is a bursting disc designed to burst at a pres¬ 
sure one half of the maximum pressure given in Equation 
17.13.1. 

If the gas has a velocity less than 10 ft/s and the duct is 
straight and unobstructed, but the LID ratio is greater than 
30, it is necessary to have more than one relief opening. The 
maximum pressure is given by the equation 

P = k 3 ^ + h [17.13.2] 

where Li is the distance between relief openings (ft) and k 3 
and &4 are constants. The values of the constants k 3 and k± 


and the maximum value of the distance between relief 
openings Li max (ft) are: 


K 

Z-imax (diameters) 

k 3 

k 4 

1 

60 

0.04 

0 

2 

30 

0.06 

0.1 

4 

20 

0.07 

0.2 

8 

15 

0.08 

0.3 


The open end of a long duct may be regarded as an explo¬ 
sion relief opening. In this context an open end is an end 
leading without restriction to atmosphere or to a vessel 
which is itself provided with explosion reliefs or to a room 
of volume 200 times greater than that of the duct. For such 
an open end A=1. 

If the end of a duct is not open or if it may be regarded as 
restricted, an explosion relief should be located as near as 
possible to the end. For this vent system also, vents weigh¬ 
ing not more than 2 lb/ft 2 of vent area and held by springs 
or magnets are suitable. 

If at a gas velocity of less than 10 ft/s the duct contains 
obstacles or features such as sharp right angle elbows or 
tees, the maximum pressure resulting from an explosion 
is greatly increased. An obstacle blocking only 5% of the 
cross-sectional area of the duct can increase the maximum 
pressure by a factor of 2-3, whilst an orifice blocking 30% 
of the duct area can increase the pressure by a factor of 10. 

Any bend sharper than a long, sweeping, smooth bend 
and any obstruction blocking more than 5% of the cross- 
sectional area of the duct should be regarded as an obstacle. 

If there is a long straight duct connected to an obstacle, 
then to reduce the maximum pressure to 2 lb f /in. 2 , explo¬ 
sion relief openings of size K= 1 should be located as near 
as possible to the obstacle and at 6 diameters on either side 
of it. Thereafter, the straight unobstructed section of the 
duct may be treated in the usual way. 

For a vent system around an obstacle, a vent weighing 
not more than 3 lb/ft 2 and held by springs or magnets is 
suitable. 

If the gas has a velocity of 10-60 ft/s and the duct is 
straight and unobstructed, the explosion relief openings 
required to limit the maximum pressure resulting from an 
explosion to 2 lb f /in 2 . are as follows: 


D (ft) 

Li/D 

K 

<1.5 

12 

1 

- 

6 

2 

1.5—2.5 

9 

1 

- 

5 

2 


For this vent system, the weight of vents depends on the 
velocity of the gas. For gas velocities of 25 and of 25— 
60 ft/s, the vents should weigh not more than 10 and 5 lb/ft 2 , 
respectively. The vents may be held by springs or magnets. 

If at a gas velocity of 10—60 ft/s the duct contains 
obstacles, additional explosion relief openings are 
required. If there is a long straight duct connected to an 
obstacle, explosion reliefs of size A=1 should be located at 
3 diameters on either side of the obstacle and again at 6 
diameters on either side of it. Thereafter, the straight 
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unobstructed section of the duct may be treated in the 
usual way. 

For this case, the maximum duct diameter for which 
information was available is 1.5 ft. 

For this vent system, the weight of the six vents nearest 
the obstacle again depends on the velocity of the gas. For 
gas velocities below 25 and of 25-60 ft/s, the vents should 
weigh not more than 3 and 1.5 lb/ ft 2 , respectively The vents 
may be held by springs or magnets. 

For gases other than propane, the maximum pressure 
may be calculated from the maximum pressure for propane 
using the relation 

= [17.13.3] 

where Pi is the maximum pressure resulting from an explo¬ 
sion for propane (Ibf/in 2 .), P 2 is the maximum pressure 
resulting from an explosion for a gas other than propane 
(lbf/in. 2 ) and S u is the maximum fundamental burning 
velocity of the gas other than propane (ft/s). The value of 
2.2 derives from the square of the maximum fundamental 
burning velocity of propane, which is 1.5 ft/s. 

Alternatively, for a given maximum pressure the dis¬ 
tance between neighbouring vents L x may be calculated 
using the relation 

[17.13.4] 

where Li is the distance between relief openings for pro¬ 
pane (ft) and L 2 is the distance between relief openings for 
a gas other than propane (ft). 


Vent closures should be designed so that a degree of 
deterioration or lack of maintenance does not cause the 
design maximum pressure resulting from the explosion to 
be exceeded. Closures should be robust and leak-tight. 
Methods of holding vent closures include springs, magnets 
and hinges. Further details of vent closure are given in the 
HSE Guide. 

It is pointed out by Lunn (1984b) that the experimental 
data on which these recommendations are based are sparse. 
He suggests that the maximum pressure correlates as well 
with vent ratio A v /Fas with vent coefficient K. Figure 17.35 
shows the data given by Lunn for vented ducts in support of 
this argument. 

He is also critical of the use of Equation 17.13.3 to extra¬ 
polate from propane to other gases. Figure 17.35 shows a 
curve for the maximum pressure in hydrogen—air mixtures 
calculated from Equation 17.13.3 which differs appreciably 
from the experimental curve also shown in the figure. 

On the basis of the work of Cousins and Cotton (1951a) he 
suggests as an alternative that if explosion pressures for a 
particular gas have been measured in a compact enclosure, 
then for a duct with L/D < 30 and with the same vent ratio 
these pressures represent upper bounds on the pressures 
likely to occur in the duct. 


17.13.3 Bartknecht method 

Bartknecht states that experience has shown that explo¬ 
sions may cause considerable damage in pipes even if 
reliefs are installed. 

He suggests that the effectiveness of such reliefs is 
doubtful, that if they are used they need to be installed every 
1-2 m and that such a design is suitable only for use on 
pipes which are outdoors. 



Figure 17.35 Explosion venting of ducts and pipes: maximum explosion pressure ir 
ratios (Lunn, 1984b) (Courtesy of the Institution of Chemical Engineers) 


of different aspect 
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He recommends instead that the pipe should be designed 
to contain the explosion, which means in practice that it 
should have a design pressure of at least 10 bar. Such a pipe 
will withstand even the very high but very short peak 
pressures associated with detonations. 

In this design approach, reliefs are still required but are 
limited to handling the much higher pressures which occur 
at end flanges or bends. These must be provided with vents 
if they are not to be destroyed. 

The venting must occur along the axis of the pipe. Relief 
which is based on flow at right angles to the axis gives much 
higher pressures for deflagrations and is quite ineffective 
for detonations. Further, the whole cross-sectional area of 
the pipe must be utilized for the vent. 

As described in Section 17.5, the explosion velocity and 
explosion pressure developed in a pipe open at one end 
tend to be higher than in a closed pipe. It follows that if 
the vent opens too soon, it may aggravate the situation. 
Therefore, the vent opening pressure should be set suffi¬ 
ciently high to prevent the development of excessive 
explosion pressure. 

One way of achieving this is to use an activated vent in 
which the explosion pressure is detected by a suitable sen¬ 
sor which causes the vent to open. 

Relief devices which can be used include bursting discs 
and vent doors. The latter have the advantage that they seal 
the vent opening after effecting relief. However, relief of a 
pipe is a more demanding duty for a vent door and experi¬ 
ence shows that it is not easy to get a suitable design. Many 
of those tested have either blown off or failed to reseat to 
give a tight closure. 

Another device which might in principle be used is the 
spring-loaded valve. The explosion pressure forces the 
valve cover outwards against the force of the springs and 
the gas vents through the annulus so formed. However, 
there has been a problem in obtaining a satisfactory 
design of valve. 


17.13.4 NFPA 68 method 

As already mentioned, the method of explosion venting for 
ducts given in NFPA 68: 1988 and 1994 differs from that 
given in the 1978 edition, which essentially followed the 
HSE Guide. 

The method given in NFPA 68:1994 which is described 
here is that for the explosion venting of pipes, ducts and 
elongated vessels operating at or near atmospheric pres¬ 
sure. The pressure is given in the code in terms of the 
reduced pressure P le d, which is expressed as a gauge pres¬ 
sure. The treatment applies to pipes in which the reduced 
pressure P re a is limited to 0.2 barg. 

For ducts of non-circular cross-section, the relevant dia¬ 
meter is taken as the hydraulic mean diameter. 

Two basic situations are distinguished: (1) a pipe with a 
single vent consisting of an open end and (2) a pipe with 
multiple vents. 

NFPA 68 gives several graphs to assist in the design of 
vents for the relief of deflagrations in pipes. The figures 
apply to flow in smooth, straight pipes. Some are applicable 
only to propane, but a formula is given which permits them 
to be applied to certain other gases also, as described below. 
They are also applicable to dusts, but with restrictions on 
the St class. 

Figure 17.36 is used to determine the maximum allowable 
length of smooth, straight pipe or vessel which is closed at 
one end and vented at the other. If the L/D ratio is greater 
than that shown, there is a risk of detonation. The graph is 
applicable to propane and to dusts, a distinction being 
made between dusts with <200 and K st > 200. 

Figure 17.37 gives the reduced pressure P red for defla¬ 
gration of propane in a pipe with a single vent at one end 
and with an initial velocity <2 m/s. 

Figure 17.38 gives the reduced pressure for deflagration of 
gases and dusts in a pipe with multiple vents for an initial 
velocity <2 m/s. The limits for gas are a burning velocity 
< 1.3 times that of propane and for dusts K st <300. 



Figure 17.36 Explosion venting of ducts and pipes: maximum allowable length of a pipe vented at one end, or 
maximum allowable distance between vents, for gases and dusts (NPFA 68: 1994): (1) dusts with K s ,< 200 bar m/s and 
(2) propane, dust with K st > 200 bar m/s. See text for details (reproduced with permission from NPFA 68 Deflagration 
Venting, © 1994, National Fire Protection Association, Quincy, MA 02269). See note to Figure 17.25 
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Figure 17.37 Explosion venting of ducts and pipes: reduced explosion pressure in deflagration of propane-air mixtures 
in a smooth, straight pipe or duct closed at one end (NPFA 68: 1994). Initial flow velocity <2 m/s. See text for details 
(reproduced with permission from NFPA 68 Deflagration Venting, © 1994, National Fire Protection Association, Quincy, 
MA 02269). See note to Figure 17.25 



Distance between vents 
Diameter of pipe or duct 

Figure 17.38 Explosion venting of ducts and pipes: 
reduced explosion pressure in pipe with multiple vents for 
deflagration of gases and dusts (NPFA 68: 1994). Initial 
flow velocity <2 m/s, gas burning velocity< 1.3 x burning 
velocity of propane, dust K st < 300 bar m/s. See text for 
details (reproduced with permission from NFPA 68 Defla¬ 
gration Venting, 1994, National Fire Protection Associa¬ 
tion, Quincy, MA 02269). See note to Figure 17.25 


Figure 17.39 gives the spacing of multiple vents for the 
particular case where, for deflagration of gases and dusts, 
it is required to limit the reduced pressure to 0.2 bar and 
where the initial velocity is in the range 2—20 m/s. The 
limits for gas are a burning velocity <1.3 times that of pro¬ 
pane and for dusts K st < 300. 

For gases other than propane which have a burning 
velocity not exceeding 1.3 times that of propane the follow¬ 
ing formulae are given: 

[17.13.5] 



Figure 17.39 Explosion venting of ducts and pipes: vent 
spacing to prevent reduced explosion pressure exceeding 
0.2 barg for deflagration of gases and dusts (NPFA 68: 
1994). Initial flow velocity between 2 and 20 m/s; propane 
gas, dust K st < 300 bar m/s. See text for details (repro¬ 
duced with permission from NPFA 68 Deflagration Venting, 
© 1994, National Fire Protection Association, Quincy, MA 
02269). See note to Figure 17.25 



where L is the maximum distance between vents, P Tei is the 
reduced pressure, S is the maximum fundamental burning 
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velocity and the subscripts p and x denote propane and the 
gas in question. 

When the initial velocity exceeds 20 m/s, the gas burn¬ 
ing velocity exceeds 1.3 times that of propane or the dust 
K st value exceeds 300, the distance between vents should 
not exceed 1-2 m. 

Further, for gases, there is additional guidance in respect 
of obstacles, which include an elbow, tee, flow splitter, ori¬ 
fice or valve, or any feature which blocks more than 5% of 
the cross-sectional area of the pipe. In such cases in 
designing for a reduced pressure of <0.2 bar, there should 
be placed on each side of the obstacle two vents, at dis¬ 
tances from the obstacle of 3 and 6 diameters. If the design 
is for a reduced pressure >0.2 bar, it is sufficient to use on each 
side of the obstacle one vent at a distance of 3 diameters fromit. 
The code states that there is insufficient information to 
allow corresponding guidance to be given for dusts. 

With regard to the vents, the total vent area at each loca¬ 
tion should be at least equal to the cross-sectional area of 
the pipe. This area may be provided by one or more vents. 
For an individual vent, an area exceeding the cross- 
sectional area of the pipe is not effective in further reducing 
the pressure of a deflagration. 

The release pressure of the vents should be set as far 
below the reduced pressure P red as practical, but in any 
event should not exceed half the reduced pressure. The 
mass of the vent closures should not exceed 2.5 lb/ft 2 . 

NFPA 68 gives a number of worked examples illustrating 
the application of the above guidance. These include an 
example involving the specification of the vents on a drier 
system consisting of the drier itself and a dust collector. 


17.14 Explosion Relief of Buildings 

An account was given in Section 17.8 of explosions in 
buildings. In this section explosion relief of such buildings 
is considered. The relief of dust explosions in buildings is 
considered in Section 17.48. 

Accounts of explosion relief of buildings are given in Gas 
Explosions inBuildings and Heating Plants (R.J. Harris, 1983) 
and Venting Gas and Dust Explosions (Lunn, 1984b) and by 


Rasbash (1969c), Runes (1972) and WB. Howard (1972). A 
relevant code is NPFA 68:1994 Deflagration Venting. 

A building is usually too weak to withstand a high 
explosion pressure and may be blown apart by a sustained 
pressure of 1 psig (0.07 bar) or even less. Nevertheless, for 
buildings containing flammable materials it is often 
appropriate to provide explosion venting. This gives the 
building a degree of protection against explosions result¬ 
ing from such causes as leaks and spillages. 

Explosion relief of buildings may be regarded as inter¬ 
mediate between explosion relief of vessels and explosion 
relief of large enclosures such as offshore modules. 

17.14.1 Relief by failure of weak components 

Most buildings have a number of weaker components such 
as windows and doors which will fail at a lower pressure 
than the main structure and to this extent will act as vents. 

The designer may take advantage of this fact to provide 
at least part of the vent area in the form of regular openings 
with the components deliberately designed to fail at pres¬ 
sures which make them an integral part of the total venting 
arrangements. 

17.14.2 Experimental studies 

There have been a number of experimental studies of 
explosion venting of buildings and large enclosures. Some 
of the principal studies are listed in Table 17.18. 

Reviews on work on explosion relief of buildings have 
been given by Rasbash (1969c), Butlin (1975 FRS Fire Res. 
Note 1026) and R.J. Harris (1983). 

Early work on explosion relief of a large enclosure 
of 200 m 3 was carried out by the Committee for Explosion 
Research (1958) in Sweden. This work is described in 
Section 17.15. It was particularly valuable in that it was an 
early contribution and was done on a large scale so that it 
has provided evidence on scale-up and on phenomena of 
large scale. 

Work at Potters Marston on the characteristics of and 
damage done by vented explosions in buildings has been 
described by Astbury et al. (1970) and Astbury, West and 
Hodgkinson (1972,1973). 


Table 17.18 Explosion venting of buildings and modules: some experimental studies 


Investigator(s) 


Vessel or enclosure 



Type and dimensions 
(m) 

Volume 

(m 3 ) 

Relief 

Gas mixture 

Committee for Explosion 

Research (1958) 

Rectangular enclosure, 

8.8 x 5.8x3.7-4.15 height 

199 



Dragosavic (1973) 

Rectangular enclosure, 

4 x 3 x 2.6 

20.8 

Vents 

Methane 

Solberg, Pappas and 

Skramstad (1980,1981) 

Rectangular enclosure, 

4 x 3.5 x 2.5 

35 

Open vents 

Propane 

WB. Howard and Karahinis (1980) 

Rectangular building 

81 


Propane 

Buckland (1980) 

Rectangular enclosure, 

3.7 x 3.0 x 2.4 height 


Vents 

Natural gas 

A.J. Harrison and Eyre (1986,1987a,b) 

Rectangular enclosure, 

5.92 x 2.38 x 2.16 

30.4 

Open vents? 

Natural gas 
equivalent, 
propane 

C.J.M. vanWingerden (1989c) 

Rectangular enclosure, 

4.0 x 3.7 x 2.6 

38.5 

Open vents? 

Methane 
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Dragosavic (1972a,b, 1973) has described work at TNO, 
and has given an equation correlating the results, as 
described in Section 17.12. 

Following an explosion incident in a process plant 
building, reported earlier by W.B. Howard (1972), explosion 
relief experiments were performed by W.B. Howard and 
Karabinis (1980, 1982) on a test building 5.5 x 4.5 x 3 m 
high. The building contained obstacles to simulate process 
plant equipment. The tests provided information on poten¬ 
tial for structural damage, on explosion venting, and par¬ 
ticularly on the Runes constant, and on vent system design. 

17.14.3 Empirical and semi-empirical methods 

The methods available for the explosion relief of buildings 
are essentially a subset of those already given for explosion 
venting of vessels. 

Two methods which have been widely used are those of 
Rasbash (1969c) and Runes (1972). Both methods were 
in fact developed in the first instance for the relief of 
buildings. 

The methods preferred by R.J. Harris (1983) are those of 
Cubbage and Simmonds (Cubbage and Simmonds 
1955a-c; Simmonds and Cubbage 1960) and Cubbage and 
Marshall (1973). Harris gives a theoretical model for the 
initial rate of pressure rise and initial pressure in an 
explosion in a building, but not for a vented explosion in a 
building; for the latter he refers to the model of Fairweather 
and Vasey (1982). These methods have all been developed 
by British Gas and thus may be considered to constitute a 
coherent set of methods for this problem. 

17.14.4 Rasbash method 

An equation for the maximum pressure in a vented explo¬ 
sion in a building has been given by Rasbash (1969c). This 
equation has been described in Section 17.12. 

In the form given by Rasbash, Drysdale and Kemp (1976) 
the equation is 


equation also has been described in Section 17.12. The 
Runes equation is 


, CP1P2 

T APV2 

[17.14.4] 

with 


nu f (E -1) 

=?EE ' rr 200 

[17.14.5] 

where A, is the vent ar 

ea (ft 2 ), E is the expansion ratio, Pi 


and P 2 are the two smallest dimensions of the building (ft), 
AP is the vented explosion overpressure (lbf/inA u t is the 
flame speed (ft/s), p is the density of the gas (lb/fr) and C is 
a constant ((lbf/in. 2 ) 1/2 . Runes did not actually give a value 
of the constant C beyond that which can be calculated for 
specific cases using Equation 17.14.4. 

Runes considered that his equation gives conservative 
but reasonable vent areas. He presented several worked 
examples showing that by comparison with the then cur¬ 
rent version of NFPA 68 his equation gave reasonable 
values and avoided the more extreme vent areas which the 
latter sometimes gave. He also gave a comparison with the 
results of the Bromma explosion venting tests. 

Following an explosion incident, W.B. Howard (1972) 
made proposals for modification of the Runes equation. The 
explosion occurred in a building which contained process 
plant equipment and had an area of 5335 ft 2 of open win¬ 
dows and of weak components which would act as vents. 
The end wall was estimated to be able to withstand a static 
pressure of 7 kPa. This wall was blown off, some portions 
falling as integral sections, but not forming missiles. Part 
of the side walls were also blown out and the other end wall 
was cracked. 

Howard first took one of Runes’s examples and sub¬ 
stituted numerical values to obtain for the case of a gas mix¬ 
ture with a nominal flame speed Uf of 11 ft/s the equation 


P red = 1.5 P v +fS u (P 1 + 2.5K) /0.45 [17.14.1] 


Pi m 


0.20& + U7 


K = AJAy 


[17.14.2] 

[17.14.3] 


whereA c is the smallest cross-sectional area of the building 
space (m 2 ), A v is the total area of combustion vents (m 2 ),/is 
a turbulence factor, if is the venting ratio, Pi is the back 
pressure due to inertia of the vent (gauge) (kPa), P red is the 
maximum pressure reached during the venting of combus¬ 
tion, or reduced pressure (kPa), P T is the pressure within 
the building space at which the vent opens (gauge) (kPa), S u 
is the maximum fundamental burning velocity of the gas 
(m/s), V is the volume of the enclosure (m 3 ) and w is the 
inertia of the vent (kg/m 2 ). 

A fuller account of Equation 17.14.1, including details 
of the parameters and range of validity, is given in 
Section 17.12. 

Equation 17.14.1 has been widely used for the explosion 
relief of buildings. 


17.14.5 Runes method 

Another equation which has been widely used for the 
explosion relief of buildings is that of Runes (1972). This 


Ay 


I.2L1L2 

AP'P 


[17.14.6] 


thus giving by comparison with Equation 17.14.4 a Runes 
constant of 1.2. He substituted the values of A v and AP for 
the explosion incident, and obtained for the flame speed « f 
a value of 24 ft/s. Then, taking the ratio of the two flame 
speeds (24/11) he proposed that the value of the Runes 
constant be increased to 2.6 (1.2 x 24/11), in effect calibrat¬ 
ing the Runes constant from this incident. 

In SI units Equation 17.14.4 becomes 



where Ay is the vent area (m 2 ), Pj is the smallest dimension 
of the rectangular building enclosure to be vented (m), L 2 is 
the second smallest dimension of that building (m), P is the 
maximum internal building pressure (kPa) and C is a con¬ 
stant. The maximum internal building pressure P is that 
which can be withstood by the weakest building member 
which it is desired should not vent or break. 

Equation 17.14.7 is believed to apply to buildings with a 
nominal length/width, or P/P, ratio up to 3. In a rectan¬ 
gular building where Pi and L 2 are unequal, D should be 
taken as (PiP 2 ) 1/2 .For a building in which the P/P ratio is 
greater than 3, the space should be divided into units each 
of which has an P/P ratio of not more than 3. 
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The basis of the Runes constant has been explained in 
Section 17.12. It is discussed by Lunn (1984), who regards it 
as conservative. The value of the constant was obtained by 
Howard. The flame speed originally used by Runes was 
3.35 m/s for propane-air, whereas that quoted by Howard 
for ethanol—air is 7.31 m/s, which introduces a factor of 2.2 
on Runes’ original formulation. 

NFPA 68:1978 gives for C a value in metric units of 6.8 
for gases such as propane and others with a similar burn¬ 
ing velocity, but a higher value for gases with a higher 
burning velocity. The suggested value for ethylene is 10.5 
and that for hydrogen is 17 


17.14.6 Harris methods 

The method used by R.J. Harris (1983) is based on the 
Cubbage and Simmonds equations given earlier as Equa¬ 
tions 17.12.17 and 17.12.18, 


(4.3Kw + 28) S u 
J 1 T F>/3 
P 2 = 58S u iK 


[17.14.8] 

[17.14.9] 


K = A S /A W [17.14.10] 

where A s is the area of the side of the enclosure (m 2 ), A„ is 
the vent area (m 2 ), K is the venting ratio, Pi is the first peak 
pressure (mbar), P 2 is the second peak pressure (mbar), S u 
is the burning velocity (m/s) and 7 is the volume of the 
enclosure (m 3 ). 

Harris also utilizes the Cubbage and Marshall equation 
given earlier as Equation 17.12.33, 


P m = P v + 23 Ku ^f [17.14.11] 


P v = a/A v [17.14.12] 

where P m is the maximum pressure reached during venting 
(mbar), P v is the pressure at which the vent opens (mbar), S u 
is the maximum fundamental burning velocity of the gas 
(m/s) and w is the inertia of the vent (kg/m 2 ).The constant a 
is numerically equivalent to the failure pressure of a panel 
of unit area. 

As an illustration of the use of these two equations, Harris 
gives the example of the calculation of the explosion relief 
for a furnace 5 x 5 x 5 x 5 m fired by natural gas with a limit 
of 3 m 2 on the size of any one vent panel. The maximum 
pressure rise is to be limited to 250 mbar, and the panel 
inertia is 10 kg/m 2 . The burning velocity is taken as 
0.45 m/s, the turbulence factor as 3, and the constant a is 40. 

Then, by the method of Cubbage and Simmonds, taking 
the maximum pressure as that occurring in the second 
pressure peak as given by Equation 17.14.9 


„ 58 x (3 x 0.45) x 5 2 

“ 250 

s= 7.83 m 2 
K = 5 z /7.83 
A# 3.2 

This indicates the need for three panels. 


For the method of Cubbage and Marshall, Harris recast 
Equation 17.14.11 in the following forms. For a relief panel in 
the side with the largest cross-section: 

A v =i[a + 23A sM ;/ 2 S 2 /7 1/3 ]; K = ^ 

and for panels on any other side 


A r m i- [a + 237 1 'V 2 S 2 ]; k = ~ 

Av = 2^0 [4 ° + 23 X (52)1/3 x 10 x ( 3 x °- 45 )1 = 8 - 5 
K = (5 3 ) 2/3 /8.5 = 2.9 

This again indicates the need for three panels. 

17.14.7 NPFA68 method 

Explosion relief of buildings is treated in NFPA 68: 2002. 
The approach adopted has evolved over the years. That 
used in the 1974 edition was to calculate the vent area 
using both the Rasbash and the Runes equations and to 
take the larger of the two areas. The 1978 edition gave only 
the Runes equation. 

For the venting of low strength enclosures, including 
buildings, NFPA 68: 2002 gives the following equation: 

A v m jg^p, P kA < 0.1 [17.14.13] 

where A s is the internal surface area of the enclosure (m 2 ), 
A v is the vent area (m 2 ), P le is the maximum internal over- 
presssure which can be withstood by the weakest struc¬ 
tural element not intended to fail (bar) and C is a venting 
constant (bar 1/z ). 

For the venting constant the code gives in metric units 
a value of 0.045 bar 1 / 2 for gases which have a fundamental 
burning velocity less than 1.3 times that of propane. 
The value of the constant for methane is 0.037 bar 1/2 . 

NFPA 68:1994 gives an illustrative example of the use 
of Equation 17.14.13 involving a building of fairly complex 
shape. 


17.14.8 Relief of multiple compartments 

It is possible that the leak of flammable gas enters more 
than one compartment of the building and that an explo¬ 
sion in one compartment may propagate to another. An 
event in which explosions propagate in this way is known 
as a cascade explosion. 

There are several factors which may cause the pressure 
in the second compartment to be higher than that in the 
first. The explosion in the first compartment may cause 
compression of, and turbulence in, the gas in the second 
compartment. 

Cubbage and Marshall (1973) performed experiments 
using two interconnected rooms each of which had a 
volume of 28 m 3 . They derived the following equation for 
the vented explosion pressure P 2 in the second compart¬ 
ment following ignition: 

P 2 = (k 2 P 1 +k 2 Pff 5 


[17.14.14] 
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k = ^ (^6(Kw).^^pj [17.14.15] 



where K\, K\ 2 and K 2 are the vent coefficients for compart¬ 
ment 1, between compartments 1 and 2 and for compart¬ 
ment 2, (&) 2av is the average value of Kw for compartment 
2, P 1 and P 2 are the vented explosion pressures of compart¬ 
ment 1 and of compartment 2 (mbar), Vi and V 2 are the 
volumes compartment 1 and compartment 2 (m 3 ), respec¬ 
tively and ki and k 2 are constants. 

The experiments were done with large vent openings. It 
is uncertain how far the results can be extrapolated. Harris 
recommends against their general use. 

17.14.9 Vent design 

It is preferable that the vent areas should be located on dif¬ 
ferent walls of the building rather than concentrated all on 
one wall. 

Vent panels for buildings should have the lowest prac¬ 
ticable inertia. The release pressure for a vent panel 
should be as low as possible relative to the expected wind 
pressures. An appropriate value is usually in the range 
1-1.5 kPa. 

A vent panel should be restrained by a device such as a 
hinge or chain to prevent it flying off the building if it does 
open. Consideration should be given to the space into which 
the panel is to open. 

Materials which shatter into pointed fragments should 
not be used for vent panels. In particular, asbestos cement- 
type board is unsuitable. 

It may be necessary to provide railings along the edge of 
the floor near a vent panel to prevent people accidentally 
knocking the panel open and falling out. 

An account of the guidance in NFPA 68 on design of 
vents for enclosures generally, including buildings, has 
been given in Section 17.12. 


17.15 Explosion Relief of Large Enclosures 

An account was given in Section 17.9 of explosion in a large 
enclosure such as an offshore module. In this section 
explosion relief of such an enclosure is considered. 

17.15.1 Relief by structural collapse 

Explosion relief of a large enclosure may occur in two ways. 
The relief may take place exclusively through vent aper¬ 
tures which already exist and which are intended as vents 
or it may also take place through apertures which are cre¬ 
ated by the explosion itself. In the latter case the extent of 
the relief opening will depend on the degree of structural 
collapse and hence on the strength of the explosion. 

Such relief may be investigated using one of the compu¬ 
ter codes for simulation of a semi-confined explosion. In 
this case it will usually be necessary to adopt an iterative 
procedure, calculating initially the strength of the explo¬ 
sion without structural collapse, determining the degree of 
collapse for this maximum strength explosion and gradu¬ 
ally adjusting the strength of the explosion and the degree 
of structural collapse until a match is obtained. 


17.15.2 Experimental studies 

Experiments on large vented explosions using a steel 
module of dimension 2.5 x 3.5 x 4 m, and hence 35 m 3 
volume, were performed by Solberg, Pappas and Skramstad 
(1981). Vent openings extended all the way along the front 
wall and could be varied in steps of 0.25 nr. A propane-air 
mixture was used. 

Tests were done with the ignition source at three differ¬ 
ent locations: at the centre of the module, at the vent open¬ 
ing and at the rear wall. In all cases the overpressure 
gave two peaks. Typical overpressure traces are shown 
in Figure 17.40. 

With central ignition the overpressure rose until the hot 
burned gas began to flow through the vent. The volumetric 
flow then increased, the density of the gas being less. The 
pressure rise was arrested. This effect also inhibited the 
backward propagation of the flame front towards the rear 
wall. The arrest of this flame front created just the condi¬ 
tions which favour Taylor instability. Under these condi¬ 
tions the flame front breaks up into a large number of fronts 
propagating in many directions. There is a massive 
increase in the rate of combustion and a large increase in 
the overpressure. This is illustrated in Figure 17.41. 

This phenomenon was not limited to the case of central 
ignition. It occurred with ignition at the vent opening also. 
For Taylor instability a major part of the flame must be 
able to propagate away from the vent opening, but the dis¬ 
tance between the ignition source and the opening is not 
important. 

With the ignition source at the rear wall the course of 
the explosion was different. In this case there was less 
scope for Taylor instability. However, there was still a strong 
second peak. This was thought to be due probably to the 
shear between the high-velocity burned gas and the low- 
velocity unburned gas and the consequent enhancement 
of turbulence at the flame front. This is illustrated in 
Figure 17.42. 



Figure 17.40 Explosion venting of large enclosures: 
profiles of overpressure for explosions with different loca¬ 
tions of the ignition source -1: (a) rear wall ignition, 

(b) central ignition, and (c) front wall ignition (Solberg, 
Pappas and Skramstad, 1981). P, pressure; t, time 
(Courtesy of the Combustion Institute) 
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Figure 17.41 Explosion venting of large enclosures: 
development of a vented explosion with central ignition 
showing Taylor instability (schematic) (Solberg, Pappas 
and Skramstad, 1981). P, pressure; t, time (Courtesy of the 
Combustion Institute) 

The authors also explored the validity of vent coefficient 
scaling (A v /V z,3 = constant). They found that for large 
volumes such scaling was not valid and was not con¬ 
servative. They concluded that whereas combustion in 
small volumes is characterized by a small, spherical flame 
front, in larger volumes combustion instabilities dominate. 

Experiments on generation of overpressures in vapour 
clouds have been described by A.J. Harrison and Eyre 
(1986, 1987a,b). This work included investigation of the 
ignition of a vapour cloud by a jet flame issuing from a 
vented chamber. In this work it was observed that 
when unburned gas displaced from the chamber was 
ignited by the emerging flame, there occurred a rapid 
combustion of the displaced gas, near spherical in form and 
located a few metres from the vent opening. They termed 
this an ‘external explosion’. They noted that a similar phe¬ 
nomenon had been reported by Solberg, Pappas and 
Skramstad (1980). 

Overpressure traces showing the external explosion are 
given in Figure 17.43. Figure 17.43(a) shows the over¬ 
pressure at the rear wall of the chamber and Figure 17.43(b) 
that just outside the chamber. The peak caused by the 
external explosion occurs first. 

The blast wave from the external explosion is shown in 
Figure 17.44. The overpressure is constant for some dis¬ 
tance from the vent opening to a virtual centre and then 
falls off, the decay being proportional to the reciprocal of 
the distance from that centre. 

C.J.M. vanWingerden (1989c) has reported experiments 
to investigate the various effects which may enhance the 
overpressures obtained in large vented explosions. He lists 



Figure 17.42 Explosion venting of large enclosures: 
development of a vented explosion with rear wall ignition 
(schematic) (Solberg, Pappas and Skramstad, 1981). 

P, pressure; t, time (Courtesy of the Combustion Institute) 


(a) 



Figure 17.43 Explosion venting of large enclosures: 
profiles of overpressure inside and outside the enclosure 
showing effect of external explosion: (a) overpressure at 
rear wall and (b) overpressure just outside enclosure 
(A.J. Harrison and Eyre, 1986; reproduced with 
permission) 
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Distance from ignition point (m) 


Figure 17.44 Explosion venting of large enclosures: 
decay of overpressure outside enclosure (A.J. Harrison 
and Eyre, 1987a) (Courtesy of Combustion Science 
Technology) 


as possible enhancing mechanisms shear turbulence, 
oscillatory combustion and Taylor instability. 

The tests were performed using a chamber 2.6 x 3.7 x 
4.0 m, and hence a volume of 38.5 m 3 , and methane-air 
mixtures. Features investigated included vent area, vent 
shape, ignition source location, effect of an obstacle and 
gas concentration. 

The overpressure traces obtained had two peaks. Van 
Wingerden attributes the first to opening of the vent cover 
and the second, which was generally larger than the first, 
to oscillatory combustion. An acoustic wave generated 
during the combustion process enhances combustion 
and creates higher overpressures. A frequency analysis 
showed a maximum at a frequency of 120 Hz, correspond¬ 
ing to the fundamental mode of the chamber with the wave 
standing between the two side walls. The repeatability of 
this mechanism was low, however, and the overpressures 
obtained varied by a factor of nearly 2. 

An external explosion occurred and had the effect of 
making the pressure peaks rather sharp. 

Overpressures measured with vent areas <5.2 m 2 were 
low, but high overpressures were obtained with vent areas 
>5.2 m 2 . No explanation was found for this anomalous 
effect. Vent shape and vent opening pressure had little 
effect. There was a wide scatter of overpressures for differ¬ 
ent vent opening pressures. 

The location of the ignition source affected the over¬ 
pressure traces but had little influence on the maximum 
overpressures obtained. Central ignition and ignition at the 
vent opening gave a maximum overpressure due to oscil¬ 
latory combustion, whilst rear wall ignition gave a maxi¬ 
mum overpressure due to the external explosion. 

Tests were done with a single obstacle which, depending 
onitsorientationblockedl2or23%ofthecross-sectionofthe 
chamber. With this configuration, overpressure traces with 
three peaks were obtained. Van Wingerden attributes the 


first to the opening of the vent, the third to oscillatory 
combustion and the second to turbulent combustion in the 
wake of the obstacle proceeding outside the enclosure. This 
second peak increased as the distance between the ignition 
source and the obstacle increased. The peak was at a maxi¬ 
mum when this distance was large. 

Gas concentrations used were 9.5 and 10% methane- 
air mixtures. Oscillatory behaviour was obtained more 
readily with the latter and this was used in most of the work. 

The venting of the explosion gave rise to long flame jets, 
up to 18 m in length. 

The overpressure due to the blast wave outside the 
chamber was also measured. There were two pressure 
peaks, the first due to the external explosion and the sec¬ 
ond due to the internal explosion. With central ignition the 
two peaks were comparable, whilst with rear wall ignition 
the external explosion effect was dominant. Essentially, 
the strength of the blast wave depended on the external 
explosion. The overpressure was constant for some dis¬ 
tance from the vent opening and then decayed inversely 
with the distance as seen in Figure 17.44. 

A review of the experimental evidence on the over¬ 
pressures which might occur due to an explosion in a 
vented module was given to the Piper Alpha Inquiry by 
Chamberlain (1989). He drew attention to the complexity of 
the phenomena involved and illustrated this by reference 
to the overpressure traces shown in Figure 17.45. Figure 
17.45(a) is for a case with central ignition and exhibits five 
peaks: peak 1 at vent panel rupture, peak 2 at flame emer¬ 
gence from the vent, peak 3 at the moment of external 
explosion, peak 4 due to Helmholtz oscillations and peak 5 
due to acoustic coupling oscillations. The maximum peak 
pressure is at peak 5 at about 200 mbar. Figure 17.45(b) is 
for rear wall ignition. With ignition near the wall the oscil¬ 
lations are severely damped and peaks 2 or 3 dominate. 
In this particular case, the maximum peak pressure is at 
peak 3 at about 550 mbar. 


17.15.3 Influencing factors 

Some of the factors which influence the severity of a large 
vented explosion have been described by Chamberlain 
(1989). They include the fuel, the fuel/air ratio, the initial 
turbulence, the location of the ignition source, the size of 
the enclosure, the degree of obstruction and the vent area. 
The severity is increased if the fuel is a reactive one and if 
the fuel-air mixture is near stoichiometric. Initial turbu¬ 
lence will enhance the severity, but the effect is not readily 
quantifiable. The location of the ignition source has a 
strong effect. For a space with only one vent, locating 
the ignition source furthest from the vent will tend to give 
the highest overpressures. The severity tends to increase 
with the volume of the enclosure and to decrease with 
the vent area. 

Obstacles tend to have a very strong effect on the severity 
of the explosion. The effect depends on the number, 
dimensions and profile of the obstacles and on the resultant 
blockage ratio. Considering an obstructed region of grid 
arrays, the overpressure increases exponentially with the 
number of arrays. For obstacle dimensions a worst case 
diameter of between 5 and 25 cm has been observed in 
experiments. The effect of an obstacle having a sharp pro¬ 
file is about twice that of one with the same cross-section 
but with a rounded profile. The overpressure increases 
exponentially with blockage ratio. As far as the scale of the 
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(b) 



Figure 17.45 Explosion venting of large enclosures: profiles of overpressure for explosions with different locations of the 
ignition source -2 (Chamberlain, 1991; after A.J. Harrison and Eyre, 1987b) (Courtesy of the Institution of Chemical 
Engineers) 
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obstacles is concerned, large scale obstacles have a 
considerably smaller effect than corresponding configu¬ 
rations of small scale obstacles. 

The initial temperature has only slight influence as 
does the strength of the ignition source, leaving aside flame 
jet ignition. 

17.15.4 External explosion 

The occurrence of an external explosion has already been 
mentioned. The effect has been discussed by Chamberlain 
(1989). 

The external explosion occurs because the advancing 
flame front expels unburned fuel from the vent. The exter¬ 
nal flow has a large and strong coherent structure and 
entrains a considerable quantity of air. When the flame 
emerges it constitutes a strong ignition source for this 
external flammable cloud and the external explosion can be 
severe. Its magnitude depends on the mass of fuel expelled, 
which in turn depends on the location of the ignition 
source. If all the fuel in the internal space is consumed 
before the flame reaches the vent, an external explosion will 
not occur. The external explosion will be weakened if the 
gas cloud is displaced far from the vent or if it is strongly 
diluted with air. 

The influence of the external explosion on the internal 
overpressures is negligible where the latter exceeds 1 bar. 
At lower internal overpressures, however, the external 
explosion can have a marked effect. The larger the vent 
area and the lower the internal overpressure, the larger 
the relative contribution of the external explosion. Thus, 
the external explosion is a factor which works against the 
attempt to limit the internal overpressures. There is some 
evidence that the importance of the external explosion 
increases with scale. 

17.15.5 Computer codes 

The computer codes available for the simulation of an 
explosion in a semi-confined enclosure were described in 
Section 17.9.These codes may be used, as there indicated, to 
investigate the course of an explosion with little or no 
venting, but their main application is to study situations in 
which there is appreciable venting. 

There also exist codes designed specifically for venting 
calculations. One of these is the VENTEX code of Shell. 
This incorporates a semi-empirical model based on exten¬ 
sive experimentation. The code is used mainly for pre¬ 
liminary screening to investigate the effect of different 
parameters prior to use of more fundamental models. The 
VENTEX code calculates first the overpressure in an 
empty enclosure at the instant when the flame reaches the 
vent, then the amplifying effect of obstacles and finally the 
effects of the external explosion. 

17.15.6 Design methods 

There is no full satisfactory fundamental method of pre¬ 
dicting the overpressure from an explosion in a large 
vented enclosure. The available empirical equations are of 
limited use. They have usually been derived for empty 
vessels and tend not to take into account complicating fac¬ 
tors such as internal obstacles or external explosions. 

More useful are computer codes and model experiments. 
The former include the fundamental models incorporated 
in computer codes such as FLACS and CLICHE and the 
semi-empirical models of codes such as VENTEX. The use 
of the large CFD codes tends to be expensive. 


Scale model experiments provide an alternative, or 
complement, to computer codes. This approach also is 
expensive. 

Both computer codes and model experiments tend to 
involve a degree of extrapolation. It needs to be borne in 
mind that some phenomena become more significant as 
scale increases. 

17.16 Venting of Reactors 

The reactors which are considered here are liquid-phase 
reactors, essentially those capable of an exothermic reac¬ 
tion runaway. 

It has long been the practice to protect such reactors 
against overpressure by the use of some form of relief 
such as a bursting disc or pressure relief valve. The over¬ 
pressure protection of reactors was described in Chapter 11. 

In this section an account is given of methods of sizing 
the vent for a reactor. Methods have progressed from early 
empirical correlations to methods based on various types of 
model, both simplified analytical models and full unsteady- 
state models embodied in computer codes. 

One point is worth emphasizing at the outset. This is 
that in reactor venting it is the volumetric flow which is 
important. 

The need for adequate vent sizing methods is evidenced 
by a number of incidents of reactor overpressure which 
have been attributed to the undersizing of the reactor vent. 

Vent sizing of reactors is a complex and specialist matter. 
The account given here is no more than an overview. 

17.16.1 Venting scenarios 

The vent system for a reactor should be designed for the 
worst case scenario which is reasonably foreseeable. The 
scenarios considered should include fire engulfment as 
well as reaction runaway. 

17.16.2 FIA method 

An early method of vent sizing was the Factory Insurance 
Association (FIA) method, described by Sestak (1965). The 
method is an empirical one in which vent area is plotted 
as a function of reactor volume and reaction class. The 
graphical relations may be represented by the following 
approximate equation: 

A = KV 092 [17.16.1] 

where A is the vent area (in. 2 ), V is the reactor capacity 
(US gal) and k is a constant. The constant k has the 
approximate values 0.0056,0.021 and 0.095 (V < 10,000) for 
exothermic reactions, categories A-D, with very low, low 
and moderately high heat releases, and 0.48 (V < 4000) 
for reactions with extraordinarily high heat releases. 
The value of k of 0.0056 is also used for endothermic reac¬ 
tions. The vent areas are given not as single lines but as 
bands of approximately ±50% about the values given by 
Equation 17.16.1. 

The FIA method is relatively simple to apply and has 
been widely used. Examples of its use have been given by 
Harmon and Martin (1970). 

A number of authors have discussed the method, 
including Duxhury (1976,1980) and Fauske (1984a,b). 

Fauske (1984b) has given the quantification of the FIA 
chart shown in Figure 17.46. This interpretation is based on 
the equation given by Fauske for the vent area of a vapour 
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Figure 17.46 Venting of chemical reactors: interpretation 
of FIA vent sizing method (Fauske, 1984b); q, energy 
release rate (Courtesy of the American Institute of Chemi¬ 
cal Engineers) 


pressure system, given below as Equation 17.19.3, with 
properties of water ( p 1 =1000 kg/m 3 , C= 4.18 kj/kg K and 
T = 373 K) and for an overpressure of 20%. The heat release 
rate q for the reaction categories A-D is quantified as 
shown in the figure. 

Industrial Risk Insurers (IRI), the successor to FIA, 
withdrew the FIA method from its engineering procedures 
in the 1970s and recommended the use of other methods 
(Davenport, 1977c). 

17.16.3 Monsanto correlation 

Another simple method of vent sizing is the Monsanto cor¬ 
relation (W.B. Howard, 1973). This method is one of those 
included in a review given by Fauske (1984a). The correla¬ 
tion is used for sizing vents for runaway phenol- 
formaldehyde reactions. It is 

D = 0.37 1/2 [17.16.2] 

where D is the diameter of the vent (in.) and Fis the volume 
of the reaction mass (US gal). The correlation is applicable 
for a self-heat rate of the order of 6.5°C/min and a set 
pressure of 15-16 psia. This implies a horizontal vent 
line to prevent build-up of static pressure due to liquid head. 
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Figure 17.47 Venting of chemical reactors: typical pres¬ 
sure curves for a runaway reaction (after Harmon and 
Martin, 1970): (a) vent area inadequate; (b) vent area 
adequate (Courtesy of the American Institute of Chemical 
Engineers) 


The problem is complicated by the fact that it is difficult 
to predict whether the fluid discharged will be (1) a vapour, 
(2) a liquid or (3) a two-phase vapour-liquid mixture. 
Methods have been developed based on each of these 
assumptions. In general, the assumption of a single phase 
yields a simpler treatment, but the assumption of two- 
phase flow is more realistic. 

It has often been observed that in practice the fluid 
vented from a reactor is not a vapour, but is either a liquid or 
a vapour-liquid mixture. Descriptions of incidents in which 
the charge was vented as either a liquid or a vapour-liquid 
mixture are given by Boyle (1967), Harmon and Martin 
(1970), Huff (1973,1977a) and Duxbury (1976). 

The general shape of the pressure curve for the venting 
of a runaway reaction as given by Harmon and Martin 
(1970) is shown in Figure 17.47. Figure 17.47(a) shows the 
curve for a runaway polymerization of ethyl acrylate with a 
vent of inadequate area and Figure 17.47(b) that for a run¬ 
away polymerization of methyl methacrylate with an 
adequate vent area. 


17.16.4 Vent flow 17.16.5 All vapour venting method 

The venting of a liquid-phase reactor is generally treated An approach to reactor venting which has frequently been 
by determining (1) the flow of material which must be adopted is that based on venting of the vapour from the 
vented to prevent excessive overpressure and (2) the vent boiling liquid reaction mass. This involves calculating the 
area required to effect this discharge. maximum allowable liquid temperature, which is related by 
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the vapour pressure to the maximum allowable pressure, 
and then determining the rate of reaction and of heat 
generation at this temperature, the rate of vapour evolution 
and hence the flow of vapour to be generated. The vent 
area is then 

A = W/G [17.16.3] 


w _ r(-AH r )V 

AHy 


[17.16.4] 


where A is the vent area (m 2 ), G is the mass flux (kg/m 2 s), 
A H r is the heat of reaction (negative for exothermic reac¬ 
tion) (kj/kg), AH y is the latent heat of vaporization(kJ/kg), r 
is the rate of reaction (kg/m 3 s), Fis the volume of the reac¬ 
tion mass (m 3 ) and IF is the mass flow (kg/s). 

The vent mass flux G is determined by standard methods 
for vapour flow. 

17.16.6 All liquid venting method 

As mentioned above, however, it is known that in some 
cases the fluid is vented as a liquid or a vapour-liquid 
mixture. 

An alternative approach, therefore, is to size the vent on 
the basis of discharging the whole reaction mass as a 
liquid. The required flow is calculated from the rate of 
reaction and of heat generation at the maximum liquid 
temperature and the time required to heat the reaction 
mass to this temperature. 

Then 


W = m,,/At [17.16.5] 


A statement of the Boyle model has been given by Leung 
(1986b) as follows: 

W = ^ [17.16.7] 

where Af p is the emptying time (s). 

Leung also refers to the relation given by Fauske (1984b) 
for the emptying time 


At — 

P ~ (dT/di), 


[17.16.8] 


where AT is the temperature rise corresponding to the 
overpressure AP (°C) and (dT/df) s is the self-heat rate at the 
set pressure (°C/s). 

Boyle recommends that the vent area be calculated by 
both the all vapour venting and the all liquid venting 
methods, that the larger area be used and that a factor of 
safety of 2-3 be applied to the area so obtained. 

A critique of Boyle’s method is given by Duxbury (1980). 
In general, provided the flow is single phase the method 
tends to give vent sizes on the high side and thus to be 
conservative. 

There is evidence from the work of Harmon and Martin 
(1970) that Boyle’s method may underestimate the vent 
areas for larger reaction vessels. It gives for such vessels 
vent areas which are in some cases considerably less than 
those obtained by the FIA method. Further evidence is 
given by Huff (1973,1977a). 

The method given by Boyle is not conservative for 
situations in which two-phase flow occurs. It is still possible, 
however, to use the first part of the method to calculate the 
flow to be vented, but to use two-phase flow methods 
for the vent sizing. 

A modified Boyle method which takes account of two- 
phase flow has been described by Duxbury (1976). The 
two-phase flow calculations are performed using a fluid 
flow code. 


[17.16.6] 


where C is the specific heat of the reaction mass (kj/kg K), 
m Q is the initial mass in the vessel, or the reaction mass (kg), 
At is the time interval to the maximum allowable pressure 
(s) and AT is the temperature difference at equilibrium 
between the initial pressure and the maximum allowable 
pressure (K). 

The vent area is again determined from Equation 17.16.3. 
The vent mass flux G is determined by standard methods 
for liquid flow. 

It is found that in some cases the all vapour venting 
method gives the larger area and in others the all liquid 
venting method does. 


17.16.7 Boyle method 

A method based on the all liquid venting approach has been 
described by Boyle (1967). The method given by Boyle is 
based on the pressure—time curve for the reactor. This may 
be obtained from the reaction rate or by experiment. 
Effectively, the method separates the calculation of the vent 
area from that of the vent flow. The latter is determined 
from the time for the reactor pressure to rise to the maxi¬ 
mum allowable pressure. The former is estimated using the 
pressure in the reactor at the relief point. 


17.16.8 Huff method 

A method of vent sizing based on a much more compre¬ 
hensive reactor model, including reaction kinetics and two- 
phase flow relations and embodied in a computer code, has 
been described by Huff (1973). 

Huff also gives a comparison of the different methods of 
calculating vent sizes for liquid-phase reactors. For the 
case which he considers the two-phase flow model is more 
conservative that the FIA method or the all vapour venting 
and all liquid venting methods. 

This model has undergone further development as 
described by Huff (1977a,b, 1982a,b, 1984a). 

One version of this model (Huff 1977a,b, 1982a,b) has 
come to be known as the pseudo-steady-state model (e.g. 
Duxbury and Wilday, 1989). 

Duxbury (1980) describes this model as a two-phase 
venting method for reactions in which pressure and tem¬ 
perature peak simultaneously. Huff states that it is con¬ 
servative for reactions in which pressure peaks first. 

A statement of the Huff model has been given by Leung 
(1986b) as follows: 

[( 1+4 T 1171691 
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hf„V 

j3 = -*L [17.16.10] 

9mVig 

x t = At p + ^(x m -x 0 ) [17.16.11] 


_ V/m m - v f 
Vfg 

m m = m 0 -W zt 


[17.16.12] 

[17.16.13] 


where h lg is the latent heat of vaporization (kj/kg), m is the 
reaction mass in the vessel (kg), q is the heat release rate per 
unit mass (kW/kg), x is the mass fraction of vapour, or 
quality, v t is the specific volume of the liquid (m 3 /kg), v ig is 
the specific volume change between the vapour and liquid 
phases (m 3 /kg), /? is a parameter, x t is the turnaround time 
for temperature (s) and the subscripts m and o denote peak 
and initial pressure (or temperature), respectively. 


17.16.9 BPF method 

Another full unsteady-state model is that developed for 
phenolic resin reactors by the British Plastics Federation 
(BPF) and described by Booth et al. (1980). 


Definition of the source term for the flow entering the 
vent is therefore of some importance. This is considered in 
Chapter 15 by a so-called coupling equation. 

17.16.14 Relief devices 

The relief devices normally used for venting of liquid- 
phase reactors are bursting discs or pressure relief valves. 

It is necessary to allow for two-phase flow through these 
devices. This is dealt with in Chapter 15. 

17.16.15 Relief disposal 

The material vented must be disposed of safely. Relief dis¬ 
posal is considered in Sections 17.22 and 17.23. 

17.16.16 Containment 

In certain cases, as discussed by Duxbury (1976), contain¬ 
ment of a possible runaway reaction may be an attractive 
alternative to venting. This may be so, for example, if the 
peak pressure attainable is close to the working pressure or 
if it is less than the minimum design pressure for a vessel of 
that size or if there are special venting problems such as 
blockage of the vent lines. 

The application of this concept to reactors has 
been developed by Wilday (1991). An account is given in 
Chapter 12. 


17.16.10 Scale-up methods 

An alternative approach to the vent sizing of liquid phase 
reactors is scale-up from experimental tests. Such extra¬ 
polation is valid, however, only if similarity exists between 
the test and full-scale systems. 

Some of the conditions which must be met before simi¬ 
larity can be assumed are listed by Duxbury (1976). Thus, 
for polymerization reactions he suggests that the basis for 
scaling up, though not for scaling down, might be a con¬ 
stant ratio of vent area to reactor volume. This accords quite 
well with the FI A method in which vent area increases with 
reactor volume to the power 0.92. 

17.16.11 ICI methods 

Reviews of methods of vent sizing used in ICI have been 
given by Duxbury (1976,1980) and by Duxbury and Wilday 
(1987,1989,1990). An account of the ICI scheme is given in 
Section 17.21. 


17.16.12 Reaction parameters 

As already indicated, there are a number of reactor para¬ 
meters which are relevant to reactor venting. They include: 
P s , set pressure (Pa); (dT/df) s self-heat rate, at set pressure 
(°C/s); Q g , volumetric gas evolution rate (m 3 /s); volu¬ 
metric vapour evolution rate (m 3 /s). 

17.16.13 Source term 

The flow entering the vent may be a homogeneous 
vapour-liquid equilibrium mixture or, if vapour disen¬ 
gagement occurs, a vapour. The size of vent required is 
different for the two cases. 

When the reactor pressure is reduced due to venting, the 
liquid becomes superheated and vapour bubbles are 
formed, causing liquid swell. Unless vapour disengage¬ 
ment occurs, a two-phase mixture will enter the vent. 
Vapour disengagement does tend to occur in non-foamy 
system, though not in foamy ones. 


17.16.17 Instrumented systems 

Another design option for reactor venting is the use of an 
instrumentation and control system designed to ensure 
that overpressure does not occur and thus to eliminate 
the need for venting. This approach is discussed in 
Chapters 11-13. 

17.16.18 Design conservatism 

It is generally desirable in design to adopt a conservative 
approach, but in reactor venting, care is needed in defining 
what this means. A low mass velocity through the vent is 
conservative with regard to determination of the vent area. 
But it is not conservative with respect to pressure drops in 
the system, reaction forces caused by the venting or load on 
the relief system. 

17.17 Venting of Reactors and Vessels: DIERS 

17.17.1 DIERS 

It was recognized towards the end of the 1970s that under¬ 
standing of reactor relief was deficient and that methods of 
vent sizing were inadequate and a major international 
cooperative project, DIERS, was initiated to remedy this. 
This project is now described. 

17.17.2 DIERS project 

A major project on reactor venting was undertaken during 
the mid-1980s by the Design Institute for Emergency Relief 
Systems (DIERS) of the American Institute of Chemical 
Engineers (AIChE) with sponsorship from a large interna¬ 
tional group of companies. The main contractor was Fauske 
and Associates Inc., and results from the project and its 
aftermath have been the subject of a series of publications 
by Fauske and co-workers, notably Epstein, Grolmes, 
Leung and Swift. Overviews of the project have been given 
by H.G. Fisher (1985,1991). 

The work is described in the DIERS Project Manual, 
which gives an overview and contains chapters on the fol¬ 
lowing aspects: vapour disengagement; relief system flow; 
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large scale tests; high viscosity flashing flow; mechanical 
design, containment and disposal; bench-scale apparatus 
and the SAFIRE computer code. 

Some principal elements of the work are given in the 
Technology Summary. This deals with the behaviour of 
the vapour in the vessel and with vapour—liquid flow in the 
vent line and gives emergency relief system (ERS) design 
methods. It also deals with fire relief of storage vessels. 

The DIERS project involved an extensive investigation 
of the behaviour of the fluid venting through the vent line. 
It included study of the vapour disengagement in the vessel 
and of the fluid flow through the vent. The work showed 
that there are different types of reaction systems and that 
the behaviour of these systems is different. A major finding 
was that the flow at the vent tends to be a two-phase 
vapour-liquid flow. Methods of ERS design were devel¬ 
oped for the different systems. These included simplified 
methods, a computer model and a scale-up method. A 
bench-scale apparatus was designed capable of determin¬ 
ing the principal design parameters. 

There is a DIERS Users Group which is described by 
H.G. Fisher (1989). A newsletter of the group has been car¬ 
ried in Plant/Operations Progress. 

17.17.3 Influencing factors 

The overall venting behaviour of reaction system depends 
on a number of factors. They include (1) reaction regime, 
(2) vapour disengagement, (3) fluid viscosity and (4) vent 
line length. It is necessary to allow for these factors in 
design, and in particular to take them into account in scale- 
up from bench scale to full scale. 

17.17.4 Reaction regimes 

The different types of reaction system, or reaction regimes, 
distinguished in the work are 

(1) vapour-generating system; 

(2) gas-generating system; 

(3) hybrid system. 

A vapour-generating system is one in which the total pres¬ 
sure is the system vapour pressure. In other words, the 
system contains one or more high vapour pressure compo¬ 
nents. When the vent opens, tempering of the reaction 
occurs due to the cooling associated with the latent heat of 
vaporization. Such a system is also referred to as a high 
vapour pressure, or vapour pressure, system or a tempered 
system. 

In a gas-generating system, by contrast, there is no high 
vapour pressure component, and the total pressure is that 
of the gaseous components. The reaction is not tempered 
and its course is essentially independent of the venting 
process. Such a system is also referred to as a gassy system 
or a non-tempered system. 

The intermediate case is that of a hybrid system, and its 
behaviour is intermediate between that of a pure vapour 
pressure system and a pure gassy system. A degree of 
tempering occurs. 

17.17.5 Vessel behaviour 

The nature of the fluid which enters the vent depends on 
the flow regime in the vessel when the vent opens, and the 
vessel is depressurized. There are two flow regimes, the 
bubbly, or foaming, regime and the churn turbulent regime. 
In the former there is little vapour disengagement and the 


vapour-liquid mixture entering the vent line is essentially 
the same as that in the vessel itself. In the latter regime 
there is significant vapour disengagement. 

Methods exist which allow an estimate to be made for 
vapour disengagement in systems with pure substances, 
but not in reacting systems. 

In practice, therefore, for venting of a reaction mass it 
is generally necessary to fall back on the default assump¬ 
tion that there is no vapour disengagement and that the 
fluid entering the vent is a homogeneous two-phase 
vapour-liquid mixture. 

A considerable amount of work was done, however, to 
increase understanding of liquid swell and vapour dis¬ 
engagement. An account of these aspects is given in 
Chapter 15. 

17.17.6 Bench-scale equipment: apparatus 

As already indicated, it is sometimes preferable to base the 
vent design on experimental tests. There are, however, cer¬ 
tain pitfalls in scale-up from bench to full scale. A suitable 
design of test apparatus provides a safeguard against 
these. The design of such apparatus was another task 
undertaken in the DIERS project. 

A low heat capacity test cell was designed with a capacity 
of 120 ml and a <j> factor of about 1.05. As stated in Chapter 
11, the <p factor is the ratio of the heat capacity of the sample 
plus cell to that of the sample alone, and a value close to 
unity means that the temperature rise measured is close to 
the actual temperature rise of the sample. This equipment 
is generally referred to as the bench-scale apparatus and is 
also known as the vent sizing Package (VSP). This appara¬ 
tus is shown in Figure 17.48. It has been described by 
Fauske and Leung (1985) and Fauske (1988a). 

Another apparatus, distinct from the VSP and developed 
later, is the reactive system screening tool (RSST), described 



Figure 17.48 Venting of chemical reactors: Vent Sizing 
Package (Fauske and Leung, 1985) (Courtesy of the 
American Institute of Chemical Engineers) 
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by Creed and Fauske (1990). The RSST is a test cell with a 
capacity of about 10 ml and a </> factor of about 1.04. The 
authors state that the ease of use approaches that of DSC 
and the accuracy that of the VSP. The RSST may be used for 
the measurement of the rate of temperature rise, and hence 
the energy release rate in a vapour pressure system, or to 
determine the rate of pressure rise, and hence the gas 
evolution rate in a gassy system. It may alsobe used for direct 
scale-up. 

17.17.6 Bench-scale equipment: application 

For a vapour pressure system, it is necessary for vent sizing 
to know the rate of temperature rise, or self-heat rate, and 
hence the energy release rate. This may be measured using 
the VSP. 

In addition, if the reaction mixture is highly viscous and 
the vent flow likely to be laminar, the apparatus may be 
used to determine the vent flow. 

For a gassy system, the information required is the rate 
of pressure rise and hence the peak gas evolution rate. The 
VSP may be used to measure this. It may also be used to 
obtain the vent flow, though generally gassy systems are 
not particularly viscous. 

These reaction parameters are then used in the appro¬ 
priate vent sizing relationships. 

Alternatively, the VSP may also be used to carry out 
direct scale-up. 

The application of the bench scale equipment, and the 
relationships with which it is used, are described further in 
Section 17.19. 

17.17.7 Vent flow models 

A number of models for vent flow were developed by 
DIERS. These are given in the Technology Summary and 
have been described in papers by Fauske and co-workers. 
An account of these models is given in Section 17.18. 

17.17.8 Vent area 

DIERS developed methods for the sizing of vents for 
vapour pressure, gassy and hybrid systems. These are 
outlined in the Technology Summary and described by 
Fauske and co-workers. Section 17.19 gives an account of 
these methods. 

In some cases it may be possible to use vent sizing cor¬ 
relations without resort to experimentation, but in other 
cases experimental work is essential. 

17.17.9 Scale-up 

The bench-scale equipment may be used to determine the 
vent area by vent area/reaction mass scaling using direct 
scaling relationships. This approach is to be distinguished 
from the use of the apparatus to determine parameters such 
as self-heat rate or gas evolution rate which are then uti¬ 
lized in vent sizing equations which require these para¬ 
meters. 

17.17.10 Numerical model 

The DIERS project also involved the development of a 
numerical model of the venting of a reactor based on a full 
set of differential equations for the reaction kinetics 
and thermal and fluid flow effects. The model is essentially 
an unsteady-state heat balance with supporting equations. 
This model is referred to as the integral model and is the 
basis of the computer code SAFIRE described below. 


An account of the model has been given by Grolmes and 
Leung (1985). 

17.17.11 SAFIRE code 

The integral model is the core feature of the computer pro¬ 
gram SAFIRE (System Analysis for Integrated Relief 
Evaluation) developed as part of the project. This has been 
described by Grolmes and Leung (1985). 

The program requires as input, data on the physical and 
thermodynamic properties of the mixture, the reaction 
stoichiometry and kinetics, the vessel and vent line geo¬ 
metry and selection of the flow model assumptions. 

The vessel geometries handled are a vertical cylinder, a 
horizontal cylinder and a sphere. The vent entry location 
can be at the top or bottom of the vessel. The vent may bean 
effectively frictionless nozzle, a nozzle fitted with a safety 
relief valve or a vent line in which friction is significant. 
The latter may have a single segment, two segments with a 
change of cross-section or three segments with a safety 
relief valve followed by a change in cross-section. 

Vessel flow regimes incorporated are all vapour, all 
liquid, homogeneous mixture and partial disengagement 
regimes.Vent line flow models are as follows. There are both 
all vapour flow and all liquid flow models. Nozzle models 
include the ERM, the homogeneous equilibrium flashing 
model and the frozen homogeneous model. For long vent 
lines the models are the homogeneous equilibrium model 
and the slip equilibrium model. 

The program may be run in three modes: pre-relief, post¬ 
relief or combined. 

The authors describe the use of the code to simulate a 
number of experimental tests on styrene and ethylbenzene. 

17.17.12 Experimental tests 

The DIERS programme included a series of experimental 
tests, both at laboratory scale and on a larger scale. An 
account of the larger scale tests in Phase III of the project 
has been given by Grolmes, Leung and Fauske (1985). 

The test vessels used were a 321 vessel and a 22001 ves¬ 
sel. The latter had a 12,0001 catchtank. 

A set of 70 tests were performed, including 25 with the 
larger vessel. Water was used in 15 tests with the smaller 
vessel and 20 tests with the larger one. Using ethylbenzene, 
four tests were performed in the smaller vessel and none in 
the larger, whilst using styrene 16 tests were done in the 
smaller vessel and five in the larger. 

The configurations studied included both top and bot¬ 
tom vent locations and both nozzles and long vent lines. 

The systems tested were all vapour pressure systems. 
The principal feature investigated in the tests was vapour 
disengagement. The work showed that vapour disengage¬ 
ment and the associated churn turbulent regime were con¬ 
fined to non-foaming and non-viscous systems. 

17.17.13 Non-Arrhenius behaviour 

The low heat capacity test cell was used to investigate a 
number of systems. One of the effects observed is note¬ 
worthy. 

As described by Fauske (1985a), tests were performed on 
a 50/50 mixture of zinc peroxide/zinc oxide at two different 
heating rates. The test at the lower heating rate obeyed the 
classic Arrhenius relation between temperature and reac¬ 
tion rate as evidenced by the pressure rise, that at the 
higher heating rate did not, but gave a much sharper pres¬ 
sure rise, presumably due to a hot spot. 
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17.18 Venting of Reactors and Vessels: Vent Flow 

A general account of two-phase flow models was given 
in Chapter 15. The account given here is confined to 
those models used for the venting of reactors and storage 
vessels. 

There are a number of relations used in the DIERS work 
for the mass flux of fluid flowing out of the vent and down 
the vent line. Accounts are given by Fauske (1984b,c, 
1985a), Grolmes and Leung (1985) and Leung (1986b) and 
in the Technology Summary. 

Leung (1986b) has reviewed flow models for venting of a 
vapour pressure, or tempered, system. He considers fric¬ 
tionless flow and a short vent line (L/Z) < 50). The models 
include: 


where K is the discharge coefficient, L is the length of the 
vent pipe (m), APis the total available pressure drop (Pa),Tis 
the absolute temperature (K), pj is the density of the liquid 
(kg/m 3 ) and Nis a non-equilibrium parameter. For a sharp- 
edged orifice K is 0.61 and C is the system heat capacity. 

For no vent line (L = 0) Equation 17.18.1 reduces to 

G = K(2AP p i) 1/2 [17.18.3] 

For a vent line long enough for equilibrium conditions to 
apply (L > 0.1 m) the parameter N is unity, and Equation 
17.18.1 becomes 



(1) the non-flashing liquid flow; 

(2) the homogeneous equilibrium model; 

(3) the equilibrium rate model; 

(4) the homogeneous non- equilibrium model; 

(5) the slip equilibrium model. 

For a simple orifice in the side of a vessel the outflow may be 
determined by treating the fluid as a non-flashing liquid. 

For other cases the homogeneous equilibrium model 
(HEM) is generally the most appropriate. It gives lower 
flows over the entire two-phase region and is to this extent 
conservative for ERS design. However, it is realistic rather 
than overly conservative and agrees well with experi¬ 
mental data.The original HEM model is somewhat complex 
and requires extensive thermodynamic data, but a more 
convenient version requiring only stagnation properties 
has been developed by Leung (1986a). 

An alternative model is the equilibrium rate model 
(ERM) of Fauske (1985b), who has developed the model to 
deal with a number of different situations. 

For the all-liquid inlet condition, Leung has given a ver¬ 
sion of his approximate HEM model which is similar in 
form to the ERM model, as described below. 

The equilibrium condition is closely approached for 
pipes longer than 0.1 m. Where the vent line is shorter 
than this, the homogeneous non-equilibrium model of 
R.E. Henry and Fauske (1971), the HFM model, may be used 
to estimate the flow. 

Leung also discusses the use of the slip equilibrium 
model (SEM) of F.J. Moody (1965). 

Some of the principal flow models are now described. An 
account of those used in the DIERS work is given in the 
Technology Summary. 

17.18.1 Vapour pressure systems 

A family of flow models for venting of vapour pressure 
systems has been described by Fauske (1984a,b, 1985a,b) in 
the context of DIERS, in particular the ERM. The base case 
is choked non-equilibrium flashing frictionless flow. For 
this case Fauske gives 


There is an alternative formulation of Equation 17.18.4 
based on the relation between vapour pressure P and 
temperature T: 

‘-SGf 


Equation 17.18.5 implies 

/dpy r = Afg\ 2 j_ 

\dTj C \vj TC 


Equations 17.18.4 and 17.18.5 are the ERM. For venting the 
rate of change of pressure with temperature is AP/AT. In 
Fauske’s work for this model the mass flux is frequently 
written as Germ so that 


_ A PfT\ Vi 
M ~Af\Cj 


[17.18.7] 


where AP is the overpressure (Pa) and AT is the tempera¬ 
ture rise corresponding to overpressure AP(°C). Further, it 
is assumed in the model that the flow is turbulent. Where 
this aspect is emphasized the mass velocity is written as 
Gp so that 


, _AP/WV /: 
t ~AT^cJ 


[17.18.8] 


Equation 17.18.8 is used where there is homogeneous 
equilibrium flow, there is a moderate overpressure («20%) 
and the flow is turbulent. 

Normally the vent line will be long enough for equili¬ 
brium flow to be assured. For the case where there is a very 
short vent line (0 <L < 0.1 m), the mass flow may be obtained 
by interpolation between Equations 17.18.3 and 17.18.8. 

For a long vent line Fauske (1989a) introduces into 
Equation 17.18.8 a correction factor F to give 

AP fT \ 1/2 

^ “ f 'at (c) t 17 - 18 - 9 ! 
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F =f(L/D) 


[17.18.10] 


with the dimensionless quantity N: 


N 


m 

2AP P] fC^ g TC 


+ 10 L 


where D is the diameter of the vent line (m) and F is a cor¬ 
rection factor for vent line length. 

The flow correction factor Fis a function of the length/ 
[17.18.2] diameter ratio L/D. Slightly different correlations have 
been given in different papers. That currently used for 
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vapour pressure systems is that given by Fauske, Grolmes where P g is the partial pressure of the gas (Pa) and P w is 
and Clare (1989), and is: the partial pressure of the vapour (Pa). 
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The original values of Fwere 0.85,0.75,0.65 and 0.55 at L/D 
ratios of 50,100,200 and 400, respectively (Fauske, 1989a). 

If the flow is highly viscous, it may be laminar. The 
relation given by Fauske (1987b, 1989a) for the mass veloc¬ 
ity Gl for this case is 



— — Ti- 

TC 32/u L 

2 t^ d d 

C 32p, L 


[17.18.11] 

[17.18.12] 


where D is the diameter of the vent line (m) and n is the 
viscosity (kg/ms). 

In practice the liquid viscosity for the reaction mixture is 
generally not known. In this case, therefore, the bench- 
scale apparatus may be used to determine the mass flow. 
Relations for this case are given by Fauske (1989a) in terms 
of the required vent diameter and are therefore described in 
Section 17.19. 


17.18.4 Storage vessels 

For flow of a flashing liquid from the liquid space of a stor¬ 
age vessel, Fauske (1985b) distinguishes between a satu¬ 
rated liquid and a subcooled liquid. For a saturated liquid 
he gives 

G = 0.6[2(P„ - P a )Pi] 1/2 , L= 0 17 18 1/1 

Cerm = ^M , i>0.1m [17.18.18] 

where P a is the absolute stagnation pressure (Pa). For a 
subcooled liquid Fauske gives 

G = 0.6[2(P o - P a ) ft ] 1/2 , L = 0 [17.18.19] 

G = [2(P 0 - P(r„))ft + G| rm ] 1/2 , L > 0.1 m [17.18.20] 
where T„ is the absolute stagnation temperature (K). 

17.18.5 Vapour pressure systems: homogeneous 
equilibrium model 

The family of flow relations given above is that of Fauske 
and the principal model is the ERM. An alternative model 
for equilibrium flow is the HEM. 

This model has been formulated in convenient form by 
Leung (1986b), who gives the following relations. For the 
high and low quality regions, respectively, the equations 


17.18.2 Gassy systems 

For gassy systems one DIERS approach is to utilize the 
bench-scale apparatus to determine the flow. 

Leung and Fauske (1987) have used for such systems 
the method of Tangren, Dodge and Seifert (1949). Leung 
(1992b) has also given a method of his own. 

Fauske (1985a) gives as a reasonable upper bound for 
the mass velocity the relation 

G = [2(P S - P a ) Pl (l - <x)] 1/2 [17.18.13] 

where P a is the atmospheric pressure (Pa), P s is the set 
pressure (Pa) and a is the initial vapour fraction. Equation 
17.18.13 is suitable for use where some overestimation of 
flow may be acceptable such as in sizing of the relief 
equipment. 

17.18.3 Hybrid systems 

For hybrid systems there is again no entirely satisfactory 
flow relation, and one DIERS approach is to utilize the 
bench-scale apparatus to determine the flow. 

For a hybrid system Fauske (1985b) gives the following 
approximate relations: 

G«(2P gPl + (4 RM ) 1/2 [17.18.14] 

with 
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[17.18.21b] 
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[17.18.22] 

[17.18.23] 


where P is the pressure (Pa), v is the specific volume of 
the mixture (nP/kg) and co is the critical flow scaling 
parameter. 

For an all liquid inlet flow, Equation 17.18.21 may be 
approximated by 


g “ 0 - 9 5 ( tc ) V! 117 18 241 

This equation is similar in form to Equation 17.18.4 except 
for the factor 0.9. The flow given by it is termed by Grolmes 
and Leung (1984) the limiting flow. 

Leung (1986b) has given a set of models for vent sizing 
for vapour pressure systems, which is described in Section 
17.20.These models are independent of the expression used 
for the mass velocity G, but the flow model quoted in that 
account is the HEM as just outlined. 








17/102 EXPLOSION 


17.19 Venting of Reactors and Vessels: Vent Sizing 

Some of the methods available for vent sizing prior to the 
DIERS project were described in Section 17.16. An account 
is now given of methods developed in DIERS. 

The bench-scale apparatus used in some of the methods 
is described in Section 17.17. 


17.19.1 Vapour pressure systems 

For a vapour pressure system, it is necessary to know the 
self-heat rate. One option for obtaining this is the use of the 
bench-scale apparatus. But it may be possible to determine 
it without resort to experiment. 

Given the self-heat rate, the following simplified method 
has been described by Fauske (1984b) for the vent area: 


[17.19.1] 




[17.19.2] 


where g s is the energy release rate at the set pressure 
(kW/kg), At v is the venting time (s) and p is the density of 
the reaction mass (kg/m 3 ). 

Combining Equations 17.19.1 and 17.19.2 with Equation 
17.18.7 gives 

A=V„(TC)- 1/2 ^ [17.19.3] 

Equations 17.18.7 and 17.19.3 are based on the assumption 
that the flow in the vent line is homogeneous equilibrium 
flow and that it is turbulent and intended for use where 
there is a modest overpressure in the range 10-30%, 
say 20%. 

For a frictionless vent line, Equation 17.19.3 predicts 
a vent area larger by a factor of less than 2 than that given 
by the integral model, assuming homogeneous vessel 
behaviour and homogeneous equilibrium flow. 

The mass flow is relatively insensitive to the length/ 
diameter ratio L/D. It varies by less than a factor of 2 for 
L/D up to 400. Most vent lines are 5-10 m in length. 


17.19.2 Vapour pressure systems: high viscosity systems 

For a high viscosity system, the flow in the vent line is likely 
to be laminar. The bench-scale apparatus may be used to 
determine an actual flow. Then, as described by Fauske 
(1989), the diameter of the full scale vent line may be 
obtained from the relations 

Dl=7>t G 0 (Dt/D 0 ) > Gt [17.19.4a] 

« ( ; ^ /V G») : G 0 (Dt/D 0 ) <Gt [17.19.4b] 

where Dl is the diameter of the full scale vent line for 
laminar flow (m), D a is the diameter of the vent line in 
the bench-scale apparatus (m), Dr is the diameter of the 
full-scale vent line for turbulent flow (m), G a is the mass 
velocity in the bench-scale apparatus (kg/m 2 s), G T is 
the mass velocity at full scale in turbulent flow (kg/m 2 s). 


According to the Technology Summary, viscous effects 
on level swell are generally not important if the liquid 
viscosity is below 100 kPa s. 


17.19.3 Vapour pressure systems: Fauske nomograph 

For a vapour pressure system, a generalized vent sizing 
nomograph based on Equation 17.19.3 was published in 
1984 by Fauske (1984a). A revised nomograph, given below, 
was published in 1988. 

This initial nomograph was based on the assumptions of 
turbulent flow and a modest overpressure. 

Fauske (1984a) has compared the nomograph method 
with some of the earlier methods of vent sizing described 
above. He considers three different duties, one for the 
Monsanto method, one for the BPF and Huff methods, and 
one for the SAFIRE method. His results may be summar¬ 
ized as follows: 


Method 

Vent area 

(m 2 ) from: 


Method named 

Nomograph 

Monsanto 

Area = 0.0125 

Area = 0.012 

BPF 

m 2 /1000 kg 
Area = 0.026 

m 2 /1000 kg 

Area = 0.0145 

Huff code 

m 2 /1000 kg 
Diameter = 33.7 

m 2 /1000 kg 

cm Diameter 34 cm 

SAFIRE 

Diameter = 15.8 

cm Diameter rm 18.5 cm 

code 

(L/D xi 100) 

= 18 cm (L/D: 

«400) 


17.19.4 Vapour pressure systems: revised Fauske 
nomograph 

A revised method for vapour pressure systems, and an 
associated nomograph, have been given by Fauske, Grolmes 
and Clare (1989).The relation given for the vent area is 


A '<Qv 

2 F(TC? /2 P s 1 - “o 


[17.19.5] 


where a is the void fraction and the subscripts d and o 
denote the disengagement and initial, or freeboard, value, 
respectively. 

The flow reduction factor Fused in Equation 17.19.5 is 
given in Table 17.19, column 1. 

Figure 17.49 is a nomograph based on Equation 17.19.5. 
The nomograph is for the following conditions: C = 2500 
J/kg K, T = 400, ad = 1 and L/D = 0. It is therefore 
applicable to the case of no vapour disengagement. 

17.19.5 Vapour pressure systems: extended method for 
vapour disengagement 

As described by Grolmes, Leung and Fauske (1983), inter¬ 
pretation of the DIERS data has shown that during two- 
phase venting relatively large deviations in the equilibrium 
between the vapour and the liquid may exist. 

The implications are discussed by Fauske (1989a). It is 
virtually impossible to predict the vapour/liquid ratio 
entering the vent line. The absence of equilibrium means 
that following actuation of the relief the temperature con¬ 
tinues to rise, but without a corresponding overpressure. In 








EXPLOSION 17/103 


due course a ‘turnaround’, or ‘turnover’, of temperature 
occurs. 

Fauske states that in most practical systems there is 
likely to be only modest superheating (10-20°C) and that 
temperature turnaround should he assured before the 
onset of vapour disengagement. The rate of loss of reac¬ 
tion mass can be assumed to be largely independent 
of the vapour/liquid ratio of the mixture entering the 
vent line. 

On these assumptions, an extension of the method 
was developed which takes into account vapour disen¬ 
gagement, as described by Fauske (1987a,b). The exten¬ 
sion requires information on the self-heat rate. The 


Table 17.19 Venting Chemical reactors: flow 
reduction factor F in Fauske vent sizing correlations 
(Fauske, Grolmes and Clare, 1989) (Courtesy of 
American Institute of Chemical Engineers) 


LID 

All vapour 
flow 

I 

Vapour pressure 
system, two-phase 
flashing flow 

II 

Gassy system, 
two-phase 
non-flashing flow 

III 

0 

1.0 

1.0 

1.0 

50 

0.8 

0.8 

0.71 

100 

0.7 

0.7 

0.58 

150 

0.65 

0.65 

0.50 

200 

0.60 

0.60 

0.45 

250 

0.58 

0.58 

0.41 

300 

0.55 

0.55 

0.38 

350 

0.52 

0.52 

0.35 

400 

0.50 

0.50 

0.33 


relation given for the vent area, assuming turbulent 


A I "Wd T 

. ? 2f(T/C) V2, &&(1 - 


[17.19.6] 


where APis the overpressure (Pa). 

The loss of reaction mass at time of turnaround, given 
by Fauske (1988a, 1989a), is 



where At, is the time to temperature turnaround (s), given 

by 


v (dT/dfe) 


[17.19.8] 


17.19.6 Gassy systems 

For gassy systems, it is necessary to know the peak gas 
generation rate. It is usually necessary to use the bench- 
scale apparatus to obtain this. 

Then, as given in the Technology Summary (Equation 


, 0.(1-«)A 

Q t m 

”'W 


[17.19.9] 

[17.19.10] 


where m is the mass of mixture in the vessel (kg) and Q s is 
the peak volumetric gas evolution rate (m 3 /s). 



Figure 17.49 Venting of chemical reactors: nomograph for vent sizing for a vapour pressure system (Fauske, Gmimes 
and Clare, 1989) (Courtesy of the American Institute of Chemical Engineers) 
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17.19.7 Gassy systems: Fauske nomograph 

A method for gassy systems, and an associated nomo¬ 
graph, have been given by Fauske, Grolmes and Clare 
(1989). The relation given for the vent area is 



Tempered hybrid systems may be treated as tempered 
systems, provided it is assured that the system really is 
tempered and will continue to be so until the reaction is 
complete. 

Effective tempering can occur well before the peak 
volume generation rate. 

Leung and Fauske (1987) have described the application 
of Leung’s method to a tempered hybrid system. 


where Pis the absolute pressure (Pa) and P a is the absolute 
atmospheric pressure (Pa). (In the authors’ paper the term 
P - P a is written as P where the latter is a gauge pressure.) 

The flow reduction factor Ffor use in Equation 17.19.11 is 
given in Table 17.19, column 3. 

Figure 17.50 is a nomograph based on Equation 17.19.11. 
The nomograph is for the following conditions: pi = 
1000 kg/nrand LjD = 0. 


17.19.8 Hybrid systems 

For hybrid systems, the situation is more complex. The 
behaviour of the system depends on whether it is tempered 
or non-tempered. 

Untempered hybrid systems have generally to be treated 
as gassy systems. 

A relation for the vent area at initiation of homogeneous 
two-phase venting, reflecting the worst case, is given in the 
Technology Summary (Equation 2.5) as follows: 


(Qg + Qv) Pl (1 

G 


«) 


[17.19.12f 


where Q g is the peak volumetric gas evolution rate (m 3 /s) 
and Q T is the peak volumetric vapour evolution rate (m 3 /s). 


17.19.9 Bench-scale equipment 

As already described, the bench-scale equipment may be 
used in three different ways: (1) to determine the required 
flow, (2) to determine the parameters for the calculation of 
flow, and (3) to effect direct scale-up. 

There are certain pitfalls in the use of bench-scale 
apparatus. These are described in the accounts given by 
Fauske and co-workers together with the precautions 
necessary to avoid them (Fauske, 1984a, 1985a). 

The inaccuracies due to high thermal inertia, or <p value, 
are minimized in the DIERS apparatus by its design. 

The viscosity of the reaction mass is often not known and 
the possibility may exist that the vent flow will be not tur¬ 
bulent but laminar. This can be checked by measuring the 
vent flow in the bench-scale test. 

An important feature for both vapour pressure and 
gassy systems is the effect of reactor height, since the 
superficial velocity is a function of height and is therefore 
much larger at the full scale than at bench-scale. 

There is a possibility that with vapour pressure systems 
the volumetric vent flow may be high at bench-scale 
because the flow is all vapour rather than two-phase and/or 
because it is non-equilibrium due to insufficient relaxation 
length. 



Figure 17.50 Venting of chemical reactors: nomograph for vent sizing for a gassy system (Fauske, Grolmes and Clare, 
1989) (Courtesy of the American Institute of Chemical Engineers) 
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With a vapour pressure or hybrid tempered system it is 
necessary to ensure that the system remains tempered 
throughout by running the reaction to term. It is also 
necessary to confirm that there are no further reaction 
exotherms. 

17.19.10 Direct scale-up 

A method for direct scale-up from the bench-scale appara¬ 
tus, applicable only to vapour pressure systems, has been 
described by Fauske (1984c). An experiment is performed 
with bottom venting and with a vent line long enough to 
ensure equilibrium flow (L>0.1 m) and the adiabatic rise 
time At A and vessel emptying time A t E are determined. The 
vent area of the full scale reactor is then obtained as 

117,9,31 

where A is the vent area (m 2 ), At a is the measured adiabatic 
rise time (s), Af E is the measured vessel emptying time (s) 
and the subscripts LS and T denote large scale and test, 
respectively. 

For gassy systems Fauske (1985a) states that use of top 
venting on the bench-scale apparatus and direct scale-up 
on a vent area/reactor volume basis is suitable. 

17.19.11 Validation 

The DIERS project and the subsequent work have included 
a number of validation exercises. 

The Technology Summary describes the validation of the 
method for vapour pressure systems against incidents 
described by Burchett (1980) and a large-scale styrene/ 
ethylbenzene test. 

The Burchett incidents involved runaways of chloro- 
prene reactions. The first was in a 11,355 litre vessel with a 
0.010 m bursting disc set at 0.3 MPa and an equivalent-sized 
vent pipe, which vented safely. The second incident was in a 
7570 litre vessel with a bursting disc of the same size, but 
set at 0.61 MPa, which resulted in vessel rupture. On the 
assumption of churn turbulent flow it is predicted that both 
vessels should vent safely, whilst on the assumption of 
homogeneous venting (homogeneous vessel behaviour and 
homogeneous equilibrium vent flow), the prediction is that 
the first vessel would vent safely but that the second would 
not, which is what happened. 

These incidents are also treated by Fauske (1984c). 

The method for vapour pressure systems has also been 
compared by Fauske (1984a) with the results from a number 
of methods, as described in Section 17.19.2. 


Test data for some 55 systems, tempered and non- 
tempered, have been given by Leung and Fauske (1987). 
They give comparisons with the vent area predicted by the 
FIA method. 

Fauske (1989a) gives some experimental data obtained 
on both bench-scale and large scale equipment, as shown in 
Table 17.20. The table shows the measured mass velocities 
together with the values obtained by calculation from 
Equation 17.18.12 and by scale-up. 

Kirch, Magee and Stuper (1990) compare the DIERS 
method with a method used by their company based on 
scale-up using a constant ratio of the vent area to the charge 
volume. 

17.19.12 Illustrative examples 

Avariety of illustrative examples are given in the Technol¬ 
ogy Summary and by Fauske and co-workers. 

The main examples in the Technology Summary are in 
Appendix D, which gives calculations for determination of 
the flow regime into the vent and of the mass velocity with 
homogeneous flow and with partial vapour disengagement 
for a nozzle vent and for a long line vent. 

Leung (1986b) gives two examples: one is the styrene 
polymerization described by Huff (1982b) and the other a 
phenolic reaction described by the BPF (1979) and Booth 
etal. (1980). 

Leung and Fauske (1987) deal with the following types of 
system: type la, a vapour pressure, tempered system; type 
lb, a gassy tempered system and type II a non-tempered 
system. These are illustrated by a phenol-formaldehyde 
reaction, a hydrogen peroxide reaction and a hypothetical 
gassy reaction, respectively. They give illustrative exam¬ 
ples for all three cases. 

Examples illustrating the application of the methods to 
check existing plant are given by Fauske (1988a), who deals 
with a vapour pressure system for three cases: (1) without 
vapour disengagement, (2) with disengagement, and (3) 
check for potential viscosity effect (none found). 

Fauske and Leung (1985) describe a study of the reaction 
runaway for an 80% styrene/20 % ethylbenzene reaction 
which combines elements of validation and illustration. 
This system is a vapour pressure system and is foamy. The 
mass velocity was calculated from Equation 17.18.5, which 
requires no experimental data. The vent area was obtained 
from the model of Leung, Equation 17.20.18 with its sup¬ 
porting Equation 17.20.19, described below. This requires 
the self-heat rates at the set and turnaround temperatures. 
The bench-scale apparatus was used to obtain these self¬ 
heat rates. It was also used to check the mass velocity 
determined from Equation 17.18.5. This agreed within 10% 


Table 17.20 Venting of chemical reactors: some experimental data, bench-scale and large scale, on the venting of 
runaway reactions of polystyrene/ethylbenzene (Fauske, 1989a) (Courtesy of American Institute of Chemical Engineers) 


Vent 

diameter (m) 

Vent length/ 
vent diameter 


Stagnation conditions 



Mass velocity (kg/m 2 s) 

Pressure 

(Pa) 

Temperature 

(K) 

AP/AT 

(Pa/°C) 

Viscosity 

(kg/ms) 

Measured Calculated? 

Scaled up 

0.0525 

100 

5.8 x 10 5 

498 

11.35 x 10 5 

0.45 

1296 

974 

1258 

0.0525 

175 

5.3 x 10 5 

493 

10.58 x 10 5 

0.50 

407 

496 

452 

0.00457 

100 

5.1 x 10 5 

480 

10.14 x 10 5 

0.55 

71 

55 


0.00457 

175 

5.03 x 10 5 

490 

10.14 x 10 5 

0.55 

33 

31 



a Equation 17.18.12. 
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Table 17.21 Venting of chemical reactors: illustrative 
calculation of vent sizing for reactor with vapour pressure 
system (after Fauske and Leung, 1985) (Courtesy of 
American Institute of Chemical Engineers) 

A Scenario 


Liquid specific head C = 2520 kj/kg K 

Initial reaction mass m 0 = 5000 kg 

Reactor volume V = 7.78 m 3 

Set pressure P s = 5.15 x 10 5 Pa 

Set temperature T s = 491K 

dP/dT = 8246 Pa/K 

(dT/dt) s = 0.25°C/s 

(dT/dfJm = 0.33°C/s 

Mass velocity G = 3640 kg/m 2 , s 


B Vent sizing 

Using Equation 17.20.19: 

q = 12520(0.25 + 0.33) = 0.735 kW/kg 

Using Equation 17.20.18 

. 5000 x 735 

A - • - - ~ - —jg - 

3640 [([7.78/5000] (491 x 8546) 1/z +(2520 x 11.6) 1/2 ] 

= 0.016 m 2 


confirming the validity of Equation 17.18.5 which assumes 
turbulent flow. 

Estimates of vent size were made for a range of over¬ 
pressures using Equation 17.20.18. Estimates were also 
made using SAFIRE. There was excellent agreement 
between the two. 

Table 17.21 shows the calculations given by the authors 
for the vent area using Equation 17.20.18 for this case. 

In addition, a kinetic model for this reaction, given 
by Husain and Hamilec (1978), was used to predict the 
temperature and pressure profiles of the reaction. The pre¬ 
dictions agreed well with the profiles measured in the 
bench-scale apparatus. 


17.19.13 Safety factors 

Whatever method of vent sizing is used, a safety factor 
should be applied, having regard to the accuracy of the 
method itself and of the data used. 

There is relatively little guidance given on this by Fauske 
and co-workers or by DIERS, but the problem has been dis¬ 
cussed by Duxbury and Wilday (1990). These authors 
describe several methods for vent sizing and mention certain 
safety factors. The safety factor to be applied is specific to the 
particular method and in each case the safety factor should 
be applied before a choice is made between the methods. 

Safety factors are discussed further in Section 17.21 
and Appendix 13. 


17.20 Venting of Reactors and Vessels: Leung Model 

Another model for vent sizing both of reactors and of stor¬ 
age vessels which has found wide acceptance has been 
given by Leung (1986b). 

The model gives relations for vent sizing. The equations 
for vent area contain the vent flow mass velocity, but the 


model may be regarded as independent of the vent flow 
correlation used. The author does, however, state his own 
homogeneous equilibrium model (Leung, 1986a). 

The model applies to vapour pressure systems, which 
give the tempering effect. It includes relations for the fol¬ 
lowing cases: 

(1) reactors 

(a) homogeneous venting, 

(b) all vapour or all liquid venting; 

(2) storage vessels 

(a) homogeneous venting, 

(b) all vapour or all liquid venting. 

The basic relations of the model and the treatments of 
these cases are now described. 


17.20.1 Elementary relations 

The unsteady-state mass and energy balances for the ves¬ 
sel, reactor or storage vessel are 


TT" 

|I720 - 21 

where P is the absolute pressure, Q is the heat generation or 
input rate, T is the absolute temperature, u is the specific 
internal energy, 7is the volume of the vessel, Wis the mass 
flow from the vessel, p is the density and the subscript 1 
denotes vent inlet. Combining Equations 17.20.1 and 17.20.2 
leads to 


= I 17 ”' 


But 


p = l/v 

Mmvi+xvfg 
U = U{ + XUfg 

h = u + Pv 


[17.20.4] 

[17.20.5] 

[17.20.6] 

[17.20.7] 

[17.20.8] 


where h is the specific enthalpy, hf g is the latent heat of 
vaporization, m is the mass of material in the vessel, * is the 
mass fraction of the vapour, or quality, and the subscript 
f denotes liquid and fg liquid-vapour transition. Then, 
from Equations 17.20.3 and 17.20.4—17.20.8 

m {w + ‘w) W‘- Q ~ "'«» ■—**£ 

[17.20.9] 

Noting that dV/dt =0, Equation 17.20.1 may be expressed as 


[17.20.10] 
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With constant phase properties Equation 17.20.10 becomes 


6x_Wv 
df mv f g 


[17.20.11] 


For an ideal gas and a nearly full vessel a practical 
approximation is obtained by reformulating the left-hand 
side of Equation 17.20.9 to give 


fc Q - W[(x i - x)tng + Pv J - mutg ^ [17.20.12] 


pressure, respectively. For zero overpressure, Equation 
17.20.18 reduces to 


4, d 


moQsVig 

Gvhig 


[17.20.20] 


whereto is the area of the vent for zero overpressure. 


17.20.3 Reactor venting: all vapour or all liquid venting 

For a reactor with all vapour or all liquid venting 


Vj = v g all vapour venting [17.20.21] 

n* Vf all liquid venting [17.20.22] 


where C„ t is the specific heat at constant pressure of the 
liquid, C pg is the specific heat at constant pressure of the 
vapour and R is the gas constant. Then, from Equations 
17.20.11 and 17.20.12 

m C A ^- = Q-Wh f g(x 1 + V ^) [17.20.13] 

df V %/ 


where the subscript i denotes phase (either g or f). Hence 
Equation 17.20.13 becomes 

mcM- = mq - GA Vi ^ [17.20.23] 

df v ig 

This equation can be integrated to give 


where Cis the specific heat at constant volume of the liquid, 
the assumption being made that Q,f « G,t « C. m ~ 

Equation 17.20.13 is used to derive expressions for the 
vent area for the specific cases. 

The vent area is given by the relation 


m 0 q 

GAG 


[17.20.14] A o = c 




[17.20.24] 


[17.20.25] 


where A is the area of the vent and G is the mass velocity of 
the vent flow. 


For zero overpressure, Equation 17.20.24 reduces to the 
correct limit with A = j 4 d . 


17.20.2 Reactor venting: homogeneous venting 

For a reactor with homogeneous venting 

xi=x [17.20.15] 

;|| mitmV/m [17.20.16] 

Hence, Equation 17.20.13 becomes 

mC^- = mq-GA-^ [17.20.17] 

dr yyi Vfg 

where q is the heat release rate per unit mass. 

On certain assumptions and utilizing Equations 17.20.1 
and 17.20.14, Equation 17.20.17 can be integrated to yield 

A = -^-2 [17.20.18] 

g [(SF +( “ t),, 1 


17.20.4 Storage vessel venting: homogeneous venting 

For a storage vessel with homogeneous venting 

Q=Qt [17.20.26] 

where Q T is the total heat input. Hence, Equation 17.20.13 
becomes 


m C^ = Q T -GA^ [17.20.27] 

This equation can be integrated to give 

Tm _ Ts = _5l_ L Ox Vj _ jl + Vh^_ 

GAG [ \V GAhig) \ m 0 Cvtg 

[17.20.28] 

For zero overpressure, Equation 17.20.28 reduces to the 
correct limit 


with arbitrary average 


GVhtg 

A comparison of the reactor and storage vessel cases may 
be made by setting Q T = m a q and v=V/m 0 . Equations 
17.20.20 and 17.20.29 are then equivalent. 

Leung refers to the work of Forest (1985), who has given 
a relationship which is equivalent to, hut differs slightly 
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in form from, Equation 17.20.29 and which has found 
application to the fire exposure of storage vessels. 

17.20.5 Storage vessel venting: all vapour or all liquid 
venting 

For a storage vessel with all vapour or all liquid venting, 
utilizing again v { = v s and Vi = v f for the two cases, respec¬ 
tively, Equation 17.20.13 becomes 

mC 6 ^ = Qr - GAv^ [17.20.30] 

For all vapour venting, it is assumed that the design is for 
no overpressure. The right-hand side of Equation 17.20.30 
is set to zero to yield 



For all liquid venting, it is assumed that temperature turn¬ 
around occurs at a point where the vessel contains 10% of 
its initial inventory. Equation 17.20.30 can then be inte¬ 
grated to yield 


17.21.2 Vent sizing methods 

Duxhury and Wilday (1989) give a list of vent sizing 
methods. This list is given in Table 17.22. All the methods, 
except method M, may, in appropriate circumstances, be 
applicable to vapour pressure systems. 

17.21.3 Vent flow 

The methods used for estimation of vent flow described 
by Duxbury and Wilday (1990) are those applicable to 
vapour pressure systems. Use is made of the ERM given in 
Equations 17.18.4 and 17.18.5 where it is applicable.Where it 
is not applicable, a fluid flow code is utilized. 

If venting is through a safety valve, it is usually sized 
using the ERM, but where the pipework is significant, a 
fluid flow code is used to check pressure drops upstream 
and downstream. If venting is through a bursting disc the 
vent line flow correction factor provided for use with the 
ERM model is used for preliminary estimates, but since it is 
applicable only to a vent line with constant diameter and no 
static head changes, the final calculation is done using the 
fluid flow code. 


A = 



[17.20.32] 


where e is the base of natural logarithms (= 2.303). For 
zero overpressure, Equation 17.20.32 reduces to 


A 0 


Qt% 

G Vg hs g 


[17.20.33] 


17.20.6 Illustrative examples 

Leung gives illustrations of the effect of these different 
assumptions on the vent areas required for venting of 
reactors and storage vessels. His results are shown in 
Figure 17.51. Figure 17.51(a) shows an example for a reactor 
with a phenolic reaction and Figure 17.51(b) one for an LPG 
storage vessel. 


17.21 Venting of Reactors and Vessels: ICI Scheme 

Accounts of the approach to vent sizing for reactors used in 
ICI have been given by Duxbury and Wilday (1987, 1989, 
1990). These provide a useful insight into the way in which 
one company has integrated the DIERS methods with other 
methods. The description given here is based unless other¬ 
wise stated on the most recent paper. The basic notation is 
the same as that used in Section 17.20. 

17.21.1 Set pressure and overpressure 

An effective, or redefined, set pressure is defined as the 
pressure at which the relief device is known to be fully open. 
For a bursting disc this will correspond to the nominal set 
pressure plus any tolerances or to the maximum specified 
bursting pressure. For a safety valve the redefined set 
pressure will often be 10% above the nominal set pressure. 
Similarly, an effective, or redefined, overpressure is 
defined as the difference between the redefined set pres¬ 
sure and the maximum pressure attained during the vent¬ 
ing process. These definitions differ from those in some 
standards, including the British Standards, but are impli¬ 
cit in much of the DIERS work. 


17.21.4 Vapour pressure systems 

For vapour pressure systems, use is made of Leung’s 
method, as given in Equation 17.20.18. The assumption of 
homogeneous equilibrium flow is safe and generally real¬ 
istic and the method gives a safe and usually acceptable 

An alternative and sometimes more convenient for¬ 
mulation of Equation 17.20.18, 




[17.21.1] 


where subscript m denotes the mean value between the set 
pressure (as redefined) and the maximum allowable 
pressure. 

The authors term this the Leung long-form equation 
(method J). 

Where it is suitable, use is also made of Fauske’s method 
for vapour pressure systems. This is the enhanced method 
which takes account of vapour disengagement, as given in 
Equation 17.19.6 (method K). 

The Fauske method is used in conjunction with the 
Leung method. In the first instance it provides a check. If 
the two methods are significantly different, the calcula¬ 
tions are reviewed. A significantly smaller answer from the 
Fauske method would not be accepted without rechecking 
the conditions for applicability and checking that the vent 
is large enough for all vapour venting. 

Appropriate safety factors are then applied for each 
method. One safety factor is associated with the uncer¬ 
tainties in the data. If ‘safe’ values have been used, this 
safety factor is taken as unity. Another safety factor is 
associated with uncertainties in the vent flow calculation. 
Typically, this safety factor is in the range 1-2 on flow, 
or area, the larger values being typical for two-phase flow 
in long lines. A detailed treatment of safety factors by 
Duxbury is given in Appendix 13. 

The vent sizes from the two methods so obtained are then 
compared. The final vent size is taken as the smaller of 
the two. 
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Figure 17.51 Venting of chemical reactors: effect of vent fluid phase on vent area (Leung, 1986b): (a) phenolic reaction and (b) propane storage 
(Courtesy of the American Institute of Chemical Engineers) 
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Table 17.22 Venting of chemical reactors: some vent sizing methods (after Duxbury and Wilday, 1989) 
(Courtesy of American Institute of Chemical Engineers) 


Reference 


A 

All gas/vapour venting 

Duxbury (1980) 

B 

Two-phase venting to maintain pressure constant 

Duxbury (1980); Duxbury and Wilday (1989) 

C 

Modified Boyle method 

Boyle (1967); Duxbury (1980) 

D 

Vent area/vessel volume scale-up 

Duxbury (1980) 

E 

Full dynamic simulation 

Duxbury (1980); Huff (1984a); 

Grolmes and Leung (1985); Klein (1986) 

F 

Huff’s pseudo-steady-state method 

Duxbury (1980) 

G 

Fauske short-form equation 

Fauske (1984a) 

H 

Fauske nomograph 

Fauske (1984b) 

J 

Leung long-form equation 

Fauske and Leung (1985); Leung (1986b); 
Leung and Fauske (1987) 

K 

Fauske revised method 

Fauske (1987a,b) 

L 

Fauske revised nomograph for tempered systems 

Fauske, Grolmes and Clare (1988) 

M 

Fauske nomograph for gassy/untempered systems 

Fauske, Grolmes and Clare (1988) 

N 

Leung’s method taking account of disengagement 

Leung (1987) 

P 

Wilday’s method for homogeneous venting until disengagement 

Duxbury and wilday (1989) 

Q 

Wilday’s method for homogeneous venting at high overpressure 

Duxbury and Wilday (1989) 


This hand calculation method is generally both con¬ 
venient and sufficient. The main effort required is asso¬ 
ciated with definition of the worst case conditions and 
gathering of data rather than with the vent sizing as such. 
Othermethodsareusedonlyifbothmethodsarejudgedtobe 
inapplicable or if the vent size obtained is unacceptably 
large. 

Before applying either method it is necessary to review 
its applicability. 

The DIERS documentation states that Leung’s method is 
limited to effective overpressures of 0—50%. It tends in fact 
to overestimate the vent size for higher overpressures. In 
order to permit integration, the model assumes constant 
various quantities such as physical and thermodynamic 
properties, heat evolution rate and vent capacity per unit 
area. The values of the parameters at the set pressure and 
maximum allowable pressure may be compared in order to 
assess the error and the extent to which the model may tend 
to oversize the vent. 

The Fauske method is based on the ERM with a correc¬ 
tion factor for vent line length. It is limited to overpressures 
in the range 10-30% and to turbulent flow. 

In most cases the Fauske method is used without taking 
vapour disengagement into account and thus with a d set 
equal to unity. 

For those cases where credit is to be taken for vapour 
disengagement, it is necessary to perform the following 
check. The Fauske method is regarded as potentially 
unsafe if early vapour disengagement occurs, which in 
this context means disengagement occurring before the 
pressure would otherwise have turned around during two- 
phase venting. The method is therefore used only if disen¬ 
gagement would have occurred after the turnaround. 
Duxbury and Wilday (1989) have derived the following 
criterion which must be satisfied for safe use of the method: 


Vv tg (l - a d ) z 


[17.21.2] 


17.21.5 Vapour pressure systems: enhancements 
of Wilday 

Duxbury and Wilday (1989) describe two enhancements to 
the Leung method (method J) for vapour pressure systems 
developed by Wilday. 

The first of these (method P) is for the case where there is 
vapour disengagement part-way through the venting, with 
two-phase flow in the early part and all vapour flow in the 
later part and, further, the disengagement occurs before 
the pressure would have turned around during homo¬ 
geneous venting. It is based on an adaptation of Leung’s 
model. The following additional equations may be written: 

m=V( 1-«)/«* [17.21.3] 

and, neglecting the vapour phase mass, 

m 0 =V{l-a 0 )/v i [17.21.4] 

where a is the void fraction and a Q is the initial void 
fraction. 

Then, combining Equations 17.20.1 and 17.20.17 of 
Leung and Equations 17.21.3 and 17.21.4 gives 


.1 - 


Gvf 


QV(*-«o) 


+ CAT) 


[17.21.5] 


This method is valid only if vapour disengagement occurs 
before the point at which pressure turnaround would have 
occurred in homogeneous venting. Otherwise it gives too 
small a vent area and is unsafe. Before pressure turnaround 
the rate of temperature rise dT/dt in a vapour pressure 
system is positive, and hence from Equation 17.20.17 


where a d is the void fraction at disengagement. 


mvfg 


[17.21.6] 
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which with Equation 17.21.3 gives the criterion 


7 % (l-a d ) 2 


[17.21.7] 


The second method given by Wilday (method Q) is based on 
Leung’s model for homogeneous venting (method J). The 
assumption underlying this model is that the physical 
properties, heat release rate and mass velocity are constant. 
Wilday’s method involves dividing the available pressure 
range into stages in which it is more reasonable to assume 
these quantities constant. Again, criteria are given for the 
applicability of the method. 


17.21.6 Gassy systems 

For gassy systems, the principal method of vent sizing is 
based on maintaining the pressure constant. 

The vent is sized so that the two-phase volumetric flow at 
the maximum allowable pressure exceeds the peak volu¬ 
metric gas generation rate at that pressure. The vent sizing 
equation given is Equation 17.19.9. An appropriate safety 
factor should then be applied as described in Section 
17.21.4. 

Use of the Fauske nomograph for gassy systems, Figure 
17.50, would be limited to making preliminary estimates. 
Mention is also made of the treatment of gassy systems by 
Leung and Fauske (1987). 

For gassy systems, use may also be made of direct scale- 
up, which may well give a smaller vent area due to early loss 
of reactant. Alternatively, the vent may be sized by simula¬ 
tion using a numerical model. Again, for the reason just 
given, this may give a smaller vent. 

A note of caution is sounded in that for gassy systems it 
may he unsafe to make the assumption of homogeneous 
two-phase venting. This assumption gives the maximum 
rate of emptying the reactor. If some disengagement 
occurs, liquid will remain in the reactor and the peak gas 
generation rate may be reached. A larger vent may then be 
required than for the relatively low gas generation rate 
occurring earlier in the relief process. 


17.21.7 Hybrid systems 

For hybrid systems, the appropriate method depends on 
whether the reaction is tempered. For tempered hybrid 
systems, it is first necessary to check that the reaction 
will remain tempered throughout. Reference is made to 
the treatment of such systems by Leung and Fauske 
(1987). 

Untempered hybrid systems usually have to be treated as 
gassy systems. Use would be made of Equation 17.19.9 pro¬ 
vided the vent size obtained is not excessive. The flow Q g to 
be used in that equation is the total volumetric evolution of 
both gas and vapour. 


17.21.8 Illustrative examples 

The illustrative examples of vent sizing for a vapour pres¬ 
sure system and a gassy system given by Duxbury and 
Wilday (1990) are summarized in Table 17.23. 


17.22 Venting of Reactors: Relief Disposal 

17.22.1 General considerations 

The problem of reactor relief does not stop with the venting. 
There remains the question of the disposal of the vented 


materials, which is often not trivial. The engineering of 
relief disposal is therefore a topic in its own right. An 
account is given by Kneale (1984). 

The legal requirement is that any venting should be to ‘a 
safe place’. Discharge to atmosphere may meet this require¬ 
ment, but such discharge is increasingly constrained. 

The options for disposal are (1) discharge and disper¬ 
sion, (2) destruction, and (3) containment. 

A full definition of the relief requirements is as impor¬ 
tant for the design of the disposal system as for that of the 
relief device itself. Cases which should be considered 
include cooling failure during normal reaction, runaway of 
reaction for other reasons, explosion due to runaway or 
thermal instability, fire, overpressure by gas and over¬ 
filling by liquid. 

The relieving process may be violent, and all equipment 
connected to the relief device, however remotely, should be 
designed for the hydraulic and mechanical forces released. 
This includes not only the inlet and outlet lines to the 
device but vessel and line supports, foundations and foun¬ 
dation bolts, and building structures. 

Some common causes of deficiencies in relief disposal 
systems include failure to allow for (1) the presence of 
another phase, (2) the presence of fine particles, and 
(3) variation in emission with time. 

A general strategy for relief disposal is shown in 
Figures 17.52 and 17.53. Liquid and solid are to be treated or 
contained and treated later, whilst liquid is contained and 
treated later. 

Gas should be discharged to atmosphere only if it can be 
dependably diluted below any flammable and/or toxic lim¬ 
its which have to be met. Relations for the dispersion of 
such discharges are given in Chapter 15. 

A study by Gerardu (1981) concluded that it is often sim¬ 
pler and safer to vent a pressure relief valve directly to the 
atmosphere, provided the hazard of ignition is allowed for. 

It should be appreciated, however, that emergency 
discharge from a reactor is a transient process and that 
towards the end of this process the discharge will lose 
momentum and will tend to slump. This stage may well 
be the most hazardous, but also the most difficult to 
model. 

Vents for the discharge of flammable gas to the atmos¬ 
phere may be equipped with flame arresters, but where it is 
considered that the maintenance of such arresters cannot 
be guaranteed, they are often omitted. 

Gas relieved is often sent to flare. The efficiency of 
destruction of combustible gas in a flare can be high; stud¬ 
ies have shown combustion efficiencies well in excess of 
99% (B.C. Davis, 1983 ). An alternative means of dealing 
with gas is scrubbing. A major factor in the choice of sys¬ 
tem is whether the scrubber has the function of handling a 
normal process gas stream or of treating the emergency 
vent gas only. In the latter case the options are to run with 
liquid constantly circulating or to start up automatically 
when venting starts. The cost of continuous circulation can 
be high, but it is not usual to rely on automatic start-up. 
Problems which can occur with scrubbers are boiling due 
to the high heat load imposed by the vent gas and carryover 
of spray. 

Another option for handling the vented material is con¬ 
tainment in a separate containment vessel, or catchtank. If 
the vent stream contains liquid or solid this is the appro¬ 
priate design. Systems vary widely in complexity depend¬ 
ing on the duty. 
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Table 17.23 Venting of chemical reactors: illustrative calculations of vent size for reactors with (A) a vapour 

pressure system and (B) a hybrid system treated as a gassy system (after Duxbury and Wilday, 1990) 


(Courtesy of Institution of Chemical Engineers) 




A Example of vapour pressure system 



Reactor pressure (bara) 



3.2 

4.2 

Average 

Bubble point temperature (°C) 

110 

120.5 

115.3 

Liquid density (kg/m 3 ) 

Vapour density (kg/m 3 ) 

847 

835 

841 

3.75 

4.62 

4.19 

Liquid specific heat (J/kg K) 

1960 

1960 

1960 

Latent heat (J/kg) 

6.749 x 40 5 

6.630 x 10 5 

6.690 x 10 5 

dP/dT(Pa/K) 

8300 

9500 


Vfg (m 3 /kg) 

0.2655 

0.2153 

0.2404 

Heat release rate (W/kg) 

1150 

1660 

1405 

Reactor volume = 2.1 m 3 




Reaction mass = 1500 kg 

Vessel design pressure = 2.86 barg 

Bursting disc pressure 3 = 3.20 bara 

Vent line length/diameter = 200 




Maximum allowable pressure = 1.1 x 2.86 = 3.15 barg = 4.16 bara 
Allowable overpressure = 4.16 - 3.20 = 0.96 bar 





= 0.65 x 


= 1907 kg/m 2 s 

estimates is appreciable, a rigorous fluid flow method •< 


For mass velocity at 3.2 bara, using Equation 17.18.9 with a correction factor F = 0.65: 
/ 383 \ 1//2 

G = 0.65 x 8300 x (— J = 2385 kg/m 2 s 

Alternatively, using Equation 17.18.4: 

^ 6.749 x 10 s / 1 

” 0.2655 1,1960 x 383, 

Since the difference between these b 
following estimate: 

G = 2264kg/m 2 s 

A similar calculation for the mass flux at 4.16 bara gave 
G= 2688 kg/m 2 s 

The average of these two mass fluxes is: 

G = (2264 + 2688)/2 = 2476 kg/m 2 s 
Applying a safety factor of 2 on mass flux: 

G = 2476/2 = 1238kg/m z s 
Allowable temperature rise A T =120.5 —110 = 10.5 K 
(1) Using Leung’s method, Equation 17.20.18: 

1500 x 1405 
x 6.690 x 10 5 \ 

1500x 0.2404 ) 


A = — 


1238 


[m 


+ (1960 x 10.50) 0 ' 6 


Alternatively, using Equation 17.21.1: 

. 1500 x 1405 


*[(- 


3 = 0.0372m 2 ; D v = 0.218 m 


i obtain the 
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Table 17.23 (continued) 


(2) Using Fauske’s method, Equation 17.19.6; assume no vapour disengagement so that a D =s 1 




For vent line L/D = 200 with a correction factor F= 0.65 


1 _ 1500 x 0.587 (1 - flt 0 ) 

2 0.65(383/1960) 1/2 x 0.96 x 10 5 (1 - «o) 


= 0.016 m 2 


Applying a safety factor of 2 on vent area: 

A =2 x 0.016 = 0.032m 2 ; D v = 0.202m 

The difference between the vent area given by Leung’s method and that given by Fauske’s method, after application of the 
safety factor of 2, is some 20%. 


B Example of hybrid system treated as gassy system 


Molecular weight of liquid 65 

Liquid density at 95°C (kg/m 3 ) 800 

Latent heat (J/kg) 2.76 x 10 5 

Heat release rate (W/kg) 53 

Temperature for peak reaction rate (°C) 95 

Peak gas evolution rate (1/kg s) b 0.146 

Reactor volume (m 3 ) 5.0 

Reaction mass (kg) 3200 

Maximum allowable pressure (bara) 4.8 


From a separate calculation, the mass velocity, including the safety factor, is found to be 2400 kg/m 2 s: 
3200 x 53 

Vapour evolution rate = g 7g x -[qs = 0.614 kg/s 


Volumetric vapour evolution rate at 4.8 bara and 95°C: 
0.614 00 , 368 1.013 


Volumetric gas evolution rate at 4.8 bara and 95°C: 

1.013 n1no 3; 


« 0.146 x 10“ 3 x 3200 > 


298 4.8 


Liquid volume in reactor = 3200/800 = 4.0: 
Void fraction a = (5.0 - 4.0)/5.0 = 0.2 
Using Equation 17.19.9: 

(0.060 + 0.122) x 800(1-0.2) 

2400 


A = ^ 


= 0.0485m 2 ; D v = 0.249m 


a Maximum specified bursting pressure. 
b Volume (1) measured at atmospheric pressure and 25°C. 


Apart from the cost, some problems which arise with 
containment are (1) reaction forces, (2) undetected leakage, 
(3) testing, and (4) plugging of lines. 

The reaction forces affect the containment vessel as they 
do the whole system. A leak occurring undetected across 
the relief system may fill the containment. Testing of the 
system requires careful thought. 

A review of reaction forces has been given by Woods and 
Thornton (1967) and Leung (2002). 

Studies have also been made on particular configura¬ 
tions. The forces on a system consisting of a reactor and a 


containment vessel separated by a bursting disc have been 
analysed by Porter (1982), and the interactive effects of 
bursting discs in a relief manifold by Beveridge and Jones 
(1984). 

Relief venting can give rise to appreciable noise. Sonic 
flow across a pressure relief device is a very efficient noise 
generator. The tall vertical stack frequently used for disper¬ 
sion tends to broadcast noise. Work by Shearer (1969) has 
shown that at a distance of 200 ft from a vent the noise level in 
decibels for a wide range of vent flows can be approximated 
by 25 logio K where V is the volumetric discharge (scfh). 
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Figure 17.52 Venting of chemical reactors: a taxonomy for relief disposal (Kneaie, 1984) (Courtesy of the Institution 
of Chemical Engineers) 


Thiswasconfirmedexperimentallyforarangeofflowsfrom 
1 to 3000 scfh regardless of the initial pressure and tem¬ 
perature. See also Perry and Green (1997 pp. 8—74). 

In view of the problems associated with venting, the 
alternative of containment within the reactor vessel should 
be considered. Kneaie suggests that if vacuum collapse 
may occur, the vessel should preferably be designed for full 
vacuum. As far as concerns overpressure he proposes that 
the vessel design criterion should depend on the expected 
frequency of overpressure. If overpressure is expected to be 
a very rare event (say once in 100-10,000 years) the vessel 
may be designed for overstress beyond the yield point but 
within the bursting strength, whereas if it is expected more 
frequently (say once in 10-100 years), a stronger design is 
appropriate. 

Kneaie describes a number of incidents arising from 
reactor venting. 

17.22.2 Two-phase relief flows 

As already described, there has been growing appreciation, 
further stimulated by the DIERS work, that it is generally 
necessary that the relief disposal system for a reactor he 
capable of handling a two-phase vapour-liquid mixture. 


Discussions of the implications of the need to dispose of 
two-phase mixtures and proposals for dealing with the 
problem have been given by Fauske (1986a, 1987b), H.G. 
Fisher (1991) and Fauske and Grolmes (1992). 

In particular, more guidance has become available on 
knockout and catchment facilities. 

17.22.3 Knockout drums and catchtanks 

Treatments of the design of knockout drums and catch- 
tanks are given in API RP 521:1990, by the BPF (1979) and 
by Grossel (1986,1990b). Further references are given in 
API RP 521 and in Fthenakis (1993, Chapter 14). 

API RP 521 gives a method for the sizing of a knockout 
drum which has been widely used. The basis is the provi¬ 
sion of a cross-sectional area sufficient to ensure that the 
liquid droplets are not entrained in the vapour. The relation 
given is 

«d = 1-15 g ~ Pt) ) V [17.22.1] 

where d is the particle diameter (m), g is the acceleration 
due to gravity (m/s 2 ), u& is the dropout velocity (m/s), pi is 
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Figure 17.53 Venting of chemical reactors: decision tree for relief disposal (Kneale, 1984). LEL, lower explosive 
limit (Courtesy of the Institution of Chemical Engineers) 


the density of the liquid (kg/m 3 ), p v is the density of the 
vapour (kg/m 3 ) and C is the drag coefficient. 

The drag coefficient C is given by Figure 17.54 in which 

C(Re) 2 = 0.13 x [.17.22.2] 

where p is the viscosity of the gas (cP). 

The selection and design of knockout drums and catch- 
tanks has been described by Grossel (1986). There are a 
number of reasons why such devices may be needed. In a 
large proportion of cases the fluid entering the relief dis¬ 
posal system is a two-phase mixture, so that it is necessary 


to separate the vapour from the liquid, and the liquid is hot 
and flammable, toxic and/or corrosive. 

Grossel describes the following types of knockout and 
catchtank systems: (1) horizontal drum plus catchtank, 
typical of a refinery or petrochemical plant where space is 
not restricted; (2) cyclone separator plus catchtank, typical 
of chemical plant with less space available; (3) cyclone 
separator with integral catchtank, capable of handling a 
large vapour flow; (4) open tank; (5) quencher knockout 
drum/catchtank; (6) multi-input knockout drum/catch- 
tank, with connections from a group of reactors; and 
(7) cyclone knockout drum. The first two of these systems 
are shown in Figure 17.55. 
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Figure 17.54 Venting of chemical reactors: drag coefficient for knockout drum design (API RP 521: 1990) (Courtesy of 
the American Petroleum Institute) 


The open tank system may be used where the relief fluid 
contains an explosive mixture which it is judged better to 
release direct to atmosphere than to contain. The quencher 
knockout drum/catchtank system is used to condense out 
condensable vapour. 

Principal factors in the design of such systems are a 
volume sufficient to hold the liquid and, for non-cyclone 
systems, a cross-sectional area sufficient to prevent liquid 
entrainment. 

Expressions are given for the allowable vapour velocity 
u of the general form 



where k is a constant. 

For cyclone separators the design requirement may 
diverge somewhat from that for conventional applications. 
For a high flow, short duration emergency relief, some mist 
may be tolerable in the outlet, and a high vapour velocity 
may be acceptable. 

For quench tanks critical features are the suppression 
pool and quencher arm. The quench liquid should be com¬ 
patible with the reaction mass to be quenched. The quantity 
of quench liquid in the pool should he sized so that its 
temperature rise after condensation of the condensable 
vapour does not exceed a suitable value. Grossel gives two 
further rules-of-thumb for the quench fluid. One is that 
the quantity should be some 2-3 times by volume that of 
the reaction mass and the other that the exit temperature of 
the vapour leaving the pool should be at least 10°C below its 
saturation temperature. 

The design of the quench arm is also important. The 
device is prone to water hammer. Grossel gives several 
rules-of-thumb for this feature also. One is the limitation of 
the size of the holes to 1/4 in., since high hole velocities are 
desirable and large holes may result in water hammer. The 


other is that the hole area should be at least as great as 
the cross-sectional area of the inlet pipe from the relief 
device. 

The relief pipework should be as short and as straight as 
possible. An account of the design of such piping has been 
given by Chambard (1980). 

Consideration should be given to the pressure drop 
through the relief disposal train and its effect on the back¬ 
pressure at the reactor vent. 

Guidance is also given by Grossel on mechanical design 
of the catchtank. He suggests a minimum design pressure 
of 50 psig. The tank should be able to withstand a defla¬ 
gration without rupture, though it may deform. Some 
companies use a design pressure of 125-150 psig. 

The blowdown loads should be taken into account. 
Operation of a relief device creates reaction and impact 
forces. The reaction vessel is subject to reaction force and 
impact force due to slugs. Both reactor vessel and piping 
are affected by fluid acceleration wave forces. A quasi¬ 
steady state jet force occurs at the containment vessel. 

Further, a quencher vessel is subject to impact force, 
condensation vibrations and final water hammer. The 
impact force is due to the impact of the fluid. The final water 
hammer occurs at the end of blowdown, when, if the reactor 
has been vented through a bursting disc, condensation can 
lead to a high flow back into the vent line and reactor vessel. 

Grossel states that the catchtank should itself be pro¬ 
vided with a bursting disc relieving into the catch-tank 
vent line to handle continued reaction and fire engulfment, 
but also that this device is not necessary if its size turns out 
to be less than that of the aforementioned vent line. 

Another design of separator is the vortex separator of 
Muschelknautz and Mayinger (1986,1990) described in the 
CCPS Guidelines for Vapor Release Mitigation (1988/4). This 
separator may be mounted directly above the reactor and 
may be used to separate the liquid from the vapour prior to 
the relief device. 
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Vent to atmosphere 
or flare stack 
or scrubber 



Vent to atmosphere 
or flare stack 
or scrubber 




Figure 17.55 Venting of chemical reactors: blowdown 
systems (Grossel, 1986): (a) horizontal blowdown drum 
and (b) knockout drum with separate catchtank (Courtesy 
of the American Institute of Chemical Engineers) 


17.22.4 Quench systems 

The handling of a two-phase mixture in the relief disposal 
system poses a number of potential problems which have 
been discussed by Fauske (1986a). 

The typical relief train consists of a separator, a scrubber 
and a flare. A two-phase relief requires a separator, but the 
typical system has these defects: (1) the relief is liable to be 
foamy and difficult to separate; (2) the size of the separator 
is often larger than that of the reactor; (3) the potential may 
exist for reaction runaway in the separator; and (4) the 
instantaneous flow may be very high and the flow of 
scrubbing fluid needs to be correspondingly high. 

The method of disposal which Fauske favours to 
overcome these difficulties is the use of a suitable 
quench system. This should quench the vapour so that 
scrubber and/or flare are eliminated, apart from any 
arrangements needed to deal with small amounts of non¬ 
condensables. The selection of the quench fluid is critical, 
particularly if the reaction mixture has potential for 
explosive decomposition. 


17.23 Venting of Reactors: CCPS Work 

The CCPS has done work with a view to providing guid¬ 
ance on relief disposal. An outline of draft Guidelines for 
Effective Handling of Emergency Release Effluents has been 
given by Huff (1992). He describes a methodology for 
characterizing and handling the relief flow. 

The purpose of the guidelines is to provide sufficient 
information to allow the non-specialist to do the design of 
the relief disposal system in more than nine cases out of 10 
and to be able to identify those which need to be handled by 
a specialist. Such cases are typically systems which are 
chemically reactive, contain fractionating multicomponent 
systems or fluids near their critical point or involve relief 
from distributed systems such as long pipe heaters. 

The main heads of the guidelines may be summarized as: 

(1) relief scenarios; 

(2) characterization of flow from protected system; 

(3) applicable standards and codes; 

(4) relief devices; 

(5) flow through relief devices; 

(6) installation of relief devices; 

(7) disposal scenarios; 

(8) disposal strategies; 

(9) characterization of flow in relief system. 


Guidance is given on the formulation of the relief sce¬ 
narios and identification of a credible worst case. The prob¬ 
lem of scenarios with a high degree of uncertainty is 
highlighted. Approaches to reducing the relief require¬ 
ment, such as elimination of aggravating features and the 
use of alternatives to relief, are described. A checklist is 
given of events for which relief may be required. 

Events in the protected system which may need relief 
include for non-reactive fluids shut-in pipework and ther¬ 
mal expansion, excess of heating or lack of cooling, and fire 
exposure, and for reactive fluids runaway reactions. 

The characterization of the flow to be handled con¬ 
centrates particularly on two-phase flow. The mixture 
vented may be two-phase or it may be superheated so that it 
becomes two-phase in the relief system. During venting, 
two-phase flow may stop and start. Information is provided 
on fluid properties, including mixture properties and 
phase equilibrium. 

The terminology and requirements of standards and 
codes relevant to relief are summarized, both in respect of 
the relief pressures and the relief devices. The relief devices 
recognized in the American National Standards Institute 
(ANSI) system are described. Guidance is given on sizing 
and on sources of data. Auxiliary components are also 
described such as block and diverting valves, bleed system 
components and non-bleed relief monitors. 

The guidelines deal with the selection of relief devices, 
calculation of the flow through relief devices, sizing of the 
associated pipework and definition of the flow through the 
relief disposal system. Methods are given for the calcula¬ 
tion of the flow through relief devices, both nozzles and 
piping, starting with the fundamental equations and fol¬ 
lowing through with working forms of these equations. 
Devices dealt with include gas safety valves, liquid relief 
valves, low pressure devices, bursting discs and open 
vents. Fluids considered include compressible gases and 
vapours, subcooled liquids, two-phase gas-liquid mix¬ 
tures and two-phase flashing vapour-liquid mixtures. 
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The installation of relief devices is treated, including 
pressure drops in the pipework, provisions to ensure drain¬ 
age and prevent freezing, static head and siphoning for low 
pressure devices and backflow from header connections. 
Mechanical aspects are also considered, including reaction 
forces. 

Guidance is given on the formulation of the disposal 
scenarios and identification of a credible worst case, which 
need not necessarily be the same as the worst case for relief. 
The potential for vent flows in each phase should be con¬ 
sidered and a worst case identified for each phase. The 
maximum flows and volume to be handled should be 
determined. 

The strategies for relief disposal and the various options 
are described. 

The characterization of the flow in the relief system is 
considered, including volatility, foaming behaviour and 
state of aggregation of phases. 


17.24 Venting of Storage Vessels 


The limiting value of the velocity u in Equation 17.24.1 for 
an atmospheric storage tank is the entrainment velocity Me: 

m — Mg [17.24.2] 

The relation given for the entrainment velocity is that of 
Kutateladze (1972): 



where g is the acceleration due to gravity, pi is the density of 
the liquid and a is the surface tension of the liquid. 

Fauske (1987a) states that a safety factor of 2 on the vent 
area determined from Equations 17.24.1-17.24.3 should be 
adequate even for a foamy liquid. 

A criterion for the onset of liquid entrainment in a stor¬ 
age vessel exposed to fire has been given by Epstein, 
Fauske and Mauser (1989). They consider a hemispherical 
surface centred on a vent at the centre of the top of a vertical 
cylindrical vessel. The velocity across this surface is 


It is necessary to protect storage vessels against over¬ 
pressure and this is done by fitting vents. Principal sources 
of overpressure are operational deviations and fire, but 
there are numerous other sources, as described in Chapter 
20. The fire protection of storage vessels is discussed in 
Chapter 16. 

Fire is not the sole potential source of heat input to a 
storage vessel. Many chemicals held in storage have the 
potential to undergo exothermic reaction. Any external 
heat source, including fire, may act as an initiator. Addition 
of water may be another. This effect should be taken 
account of in considering the venting requirements for 
storage. 


17.24.1 Fire behaviour of atmospheric storage tanks 

Work on the fire behaviour and on vent sizing for storage 
vessels has been described by Fauske, Epstein, Grolmes 
and Leung (1986) and Fauske (1987a). 

Vent sizing for atmospheric storage tanks has tradition¬ 
ally been based on all vapour flow. The aim of the study was 
to check whether this approach is adequate. The implication 
of the need to consider two-phase flow would be a large 
increase in vent size. As a first approximation the increase in 
vent area required would be of the order of the square root of 
the ratio of the vapour and liquid densities (p g /pi) 1/z . 

This concern was addressed in an extension of the 
DIERS project. The work is described in Chapter 15. It was 
concluded that liquid swell in an externally heated storage 
tank is essentially limited to the boiling two-phase 
boundary layer and that for a non-foaming liquid all 
vapour venting would appear adequate, provided the tank 
is not completely filled with liquid. 

However, for an atmospheric storage tank, it is necessary 
to avoid entrainment of liquid in the vapour vented. The 
relation given for the vent area is 



H7.24.4I 

where a is the radius of the vent, s is the radius of the 
hemisphere, u s is the velocity across the hemispherical 
surface and u a is the velocity up the vent. Onset of entrain¬ 
ment occurs when the velocity u s attains a critical value M scr 
at the height/z = s.Then, from Equation 17.24.4 



The authors state that this work indicates that rather small 
freeboard volumes can be tolerated without the occurrence 
of two-phase venting. 

For vessels which can withstand substantially higher 
pressures, the approach given by Fauske is to take the 
velocity u in Equation 17.24.1 as 

M 2AP/p g [17.24.6] 

where AP is the pressure drop through the vent system. He 
states that a factor of 2 on the vent area determined from 
Equations 17.24.1 and 17.24.6 is generally consistent with a 
modest overpressure of some 10-30% above the relief 
pressure even for a foamy liquid. 

Further relationships for the vent area for storage vessels 
with non-foamy liquid have been given by Fauske, Grolmes 
and Clare (1989). For an atmospheric storage tank 


a — - ... \U.£A.I\ 

3F/z fg [^(p 1 -p g )] 1 / 4 pg /2 

where F is the flow reduction factor and Q v is the energy 
release rate. This equation is based on all vapour flow with 
no entrained liquid. 

For a storage vessel capable of withstanding sub¬ 
stantially higher pressure 


where A is the area of the vent, hf g is the latent heat of q rg w/2 

vaporization, Q T is the total heat input to the tank and u is A = ■ T;.jrgjr; [17.24.8] 

the velocity of vapour through vent. U.62F /z fg F' s 
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where P s is the absolute set pressure, i? m is the mass basis 
gas constant and T is the absolute temperature. This equa¬ 
tion is based on all vapour critical flow. 

Fauske, Grolmes and Clare (1989) describe an approach 
to vent sizing for storage tanks based on relating the external 
heating rate to an equivalent self-heat rate and give a 
graph for checking uninsulated and insulated vessels. 

17.24.2 Designs for protection of storage vessels 

Fauske (1988b, 1989b) has described a number of designs 
for the protection of atmospheric storage tanks and pres¬ 
sure storage vessels against fire and the hazard of BLEVE. 

For atmospheric storage tanks, two designs are given, 
both involving double wall construction. In one design the 
intermediate space is filled with water. In the other design 
there is an air space with facility to inject heating or cooling 
medium through the space. 

For pressure storage vessels, the vessels considered are 
spheres and there are again two design proposals. The first 
has an internal spherical baffle so that on fire engulfment 
the liquid swell would occur in the annulus between the 
outer wall and the baffle, with liquid being ‘pumped’ from 
the bottom to the top of the baffle and then falling down into 
the centre of the vessel while the vapour is vented. In the 
other design there is a double wall construction with the 
vessel held inside a tank, the intermediate space being fil¬ 
led with water. 

17.25 Explosive Shock in Air 

One of the main effects of an explosion is the creation of a 
shock wave, or blast wave. This blast wave generates over¬ 
pressures which may injure people and damage equipment 
and buildings. 

Accounts of explosive shock in air are given in The 
Effects of Nuclear Weapons (Glasstone, 1962) and its later 
edition (Glasstone and Dolan, 1980), Explosive Shocks in Air 
(Kinney, 1962) and its later edition (Kinney and Graham, 
1985), Explosions in Air (W.E. Baker, 1973) and Expbsion 
Hazard and Evaluation (WE. Baker et al., 1983). 

The situation of prime interest here is that of a chemical 
explosion at the ground surface and it is this which is 
mainly considered. 

The description given of the explosion is based, unless 
otherwise stated, on an explosion of high explosive such 
as TNT. 

17.25.1 The blast wave 

An explosion in air is accompanied by a very rapid rise in 
pressure and by the formation of a shock wave. An account 
of the phenomena involved is given by Glasstone (1962). 

The shape of the pressure profile near the centre 
depends on the type of explosion involved. The initial 
shape differs for explosions of high explosives, nuclear 
weapons and flammable vapour clouds. 

The initial pressure profile for nuclear explosions is 
probably the most readily defined. The pressure at the edge 
of the fireball is approximately twice that at the centre. 

With detonations the shock wave travels outwards with 
the higher pressure parts moving at higher velocities. After 
it has travelled some distance the shock wave reaches a 
constant limiting velocity which is greater than the veloc¬ 
ity of sound in the air, or in the unburnt gas in the case of a 
vapour cloud. The shock wave has a profile in which the 
pressure rises sharply to a peak value and then gradually 


tails off. As the shock wave travels outwards the peak 
pressure at the shock front falls. 

At some distance from the explosion centre the region of 
positive pressure, or overpressure, in the shock wave is 
followed by a region of negative pressure, or under¬ 
pressure. The underpressure is quite weak and does not 
exceed about 4 psi. 

An idealized representation of the blast wave is given in 
Figure 17.56. This shows the pressure pulse as a function of 
distance from the explosion centre with time as the para¬ 
meter. The shock wave reaches points A,B,C and D at times 
1, 2, 3 and 4, respectively, and at these times its pressure 
profile is as illustrated. The shape of the curve at point A is 
not shown, since it depends on the type of explosion. As the 
wave moves outwards, however, the influence of the nature 
of the explosion declines and the wave establishes a profile 
which is common to all types of explosion. The curves at 
points B-D and times 2-4 show the decrease in peak 
overpressure. The curve at point D and time 4 shows both 
positive and negative pressures. 

The variation of overpressure with time at such a point is 
illustrated in Figures 17.57(a) and (b). Important para¬ 
meters are the peak overpressure/) 0 , the arrival time f a , the 
duration time f d , which is the duration of the positive phase, 
and the decay parameter a, which defines the shape of 
the decay curve in the positive phase. For a deflagration the 
rising pressure is gradual and for a detonation it is abrupt. 

The peak overpressure/) 0 is more correctly described as 
thepeakside-onoverpressureorpeakincidentoverpressure, 
in order to distinguish it from other peak overpressures 
such as the peak reflected overpressure described below. 
The peak side-on overpressure is the peak overpressure 
occurring at the side of a structure being passed by the 
blast wave. 

There are several equations which are used to describe 
the positive phase of the overpressure decay curve of 
Figure 17.57. Awidely used one is the modified Friedlander 
equation (Kinney, 1962) 

/> = />°( 1 - t/ti exp( —at/tf) [17.15.1] 

where p is overpressure, p° is the peak overpressure, t is the 
time, f d is the duration time and a is the decay parameter. 
Another common equation applicable at or below about 



Figure 17.56 Idealized representation of development of 
detonation blast waves 
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Figure 17.57 Variation of overpressure from a blast 
wave with time at a fixed point 


10 psi is Equation 17.25.1 with the decay parameter set equal 
to unity. Information on the decay of overpressure is given 
by Glasstone (1962, p.124). 

Other important properties of the blast wave, described 
by Glasstone (1962), are the shock velocity, the particle 
velocity, or peak wind velocity, behind the shock wave, the 
peak dynamic pressure and the peak reflected over¬ 
pressure. The shock velocity is given by 

,i7 - 25 - 2ai 

where c 0 is the velocity of sound in air, p a is the absolute 
ambient pressure (ahead of the shock front), U is the shock 
velocity and y is the ratio of specific heats of air. For air 
y m 1.4 and hence 


The particle velocity is given by 

c 0 p° / y + 1 j>°\ ~ 1/2 

ypA V 2y pj 

where u is the particle velocity. For y = 1.4 
_ 5c 0 p° ( 6p°\~ 1/2 

IP, l 7 pj 

The peak dynamic pressure q° is defined as 


[17.25.2b] 


[17.25.3a] 


[17.25.3b] 


For y — 1.4 

|17 25 5b| 

The peak reflected overpressure p°, which occurs if the 
blast wave strikes a flat surface at normal incidence, is 

p° = 2p° + (7 +1)<7° [17.25.6a] 


Then, substituting for q° from Equation 17.25.5b 



As stated earlier, the distinction between the peak incident 
overpressure, or simply the peak overpressure, p° and the 
peak reflected overpressure p° is important, and it should 
alwaysbe made clear which overpressure is being referred to. 

The peak dynamic pressure is less than the peak over¬ 
pressure at low values of these two pressures, but greater at 
higher values. Equation 17.25.5b shows that the cross-over 
point is about 70 psi (4.83 bar). 

The peak reflected overpressure is shown by Equation 
17.25.6b to approach a value of twice the peak overpressure 
for weak shocks in which the peak dynamic pressure is 
negligible, but to approach a value of eight times the peak 
overpressure for strong shocks in which the peak dynamic 
pressure is dominant. 

This maximum factor of 8 by which the peak reflected 
pressure exceeds the peak overpressure is frequently 
quoted. It depends, however, on the validity of the assump¬ 
tions underlying Equation 17.25.6b. 


17.25.2 Blast scaling 

The characteristics of the blast wave produced by an 
explosion are generally determined by the application of 
scaling laws. 

As described in Section 17.3 in relation to explosives, 
there are a number of scaling laws which relate explosion 
effects such as overpressure, damage circle radius, crater 
radius and sympathetic detonation distance. 

For the blast wave from an explosion the scaling relation 
which is much the most widely used is the ‘cube root’ law, 
which was first enunciated by Hopkinson (1915). This law 
states that when two charges of the same explosive and 
geometry but of different size are detonated in the same 
atmosphere, self-similar shock waves are produced at the 
same scaled distances. The scaled distance is defined as 


1 ° 


9 ^ 


[17.25.4] 


where q° is the peak dynamic pressure and p is the density 
of air (behind the shock front). This can be shown to be 


4 A, — 1 — n/>° 


[17.25.5a] 


[17.25.8] 


where r is the distance, IFis the mass of explosive and z is 
the scaled distance. It should be noted that the Hopkinson 
scaled distance is not dimensionless. 

Strictly, the relevant scaling variable is the energy E 
rather than the mass of explosive W, but for a particular 
explosive it is usual to assume that the energy released is 
proportional to the mass of explosive. 
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The cube root index in the scaling law is related to the 
fact that energy is deposited into a spherical, or hemi¬ 
spherical, region, the volume of which varies with the cube 
of the radius. Other scaling laws are described by W.E. 
Baker (1973). 

Another parameter which may be used in blast scaling is 
the yield factor X, which is defined as 




[17.25.9] 


and the subscript o denotes the reference value. 

Since from Equation 17.25.8 self-similar shock effects 
occur at the same scaled distance 


jpi/3 


[17.25.10] 


where t 0 is a reference time. The scaled arrival time and the 
scaled duration time are thus 


and 


k 

ww 


[17.25.16] 


[17.25.lll 


where f a is the arrival time, r a is the scaled arrival time and 
T d the scaled duration time. 

In terms of the yield factor X 


[17.25.18] 


or, introducing the yield factor from Equation 17.25.9, 

r = lr 0 [17.25.11] 

where r a is the reference distance. 

If in Equation 17.25.9, H4 = 1, then X is numerically equal 
to IE 1/3 ; and Equation 17.25.11 reduces to Equation 17.25.8 
with r a numerically equal to z. 

The application of the Hopkinson scaling laws to the 
principal blast parameters is now considered. 

17.25.3 Peak overpressure 

An important parameter of theblast wave isthepeakside-on 
overpressure/) 0 . The scaling relation for this parameter is 

P° =f{z) [17.25.12] 


where f a is a reference time. 

17.25.5 Dynamic pressure 

Another important parameter of the blast is the peak 
dynamic pressure q°. This is defined by Equation 17.25.4 
and may be obtained from Equation 17.25.5. 

Information on the decay of the dynamic pressure is 
given by Glasstone (1962). 

17.25.6 Overpressure impulse 

Further important parameters of the blast are the over¬ 
pressure and dynamic impulses. The positive phase over¬ 
pressure impulse, overpressure impulse, or simply 
impulse, i„ is the integral of the overpressure during the 
positive phase: 


Equation 17.25.12 states that a given peak overpressure 
occurs at a given scaled distance. 

This scaling law implies, for example, that for a given 
peak overpressure an increase in the mass of explosive by a 
factor of 1000 corresponds to an increase in the distance 
from the explosion by a factor of 10. 

The decay of the peak overpressure is given by Equation 
17.25.1. 

The peak overpressure is frequently presented in the 
form of the ratio 


[17.25.13] 




[17.25.19] 


Substituting Equation 17.25.1 in Equation 17.25.19 gives 
b = P°k Q - t 1 - exp(-a)]) [17.25.20] 


The simplifying assumption is sometimes made that the 
impulse takes the form of a triangle. In this case it may be 
approximated by 


where p a is the ambient pressure and p s is the scaled ^ py l/2/>% [17.25.21] 

pressure. 


17.25.4 Arrival and duration time 

Blast scaling applies to the time parameters arrival time and 
duration time. The Hopkinson scaled time t is defined as 


The overpressure impulse i p is another parameter of the 
blast wave to which scaling is applied. The Hopkinson 
scaled impulse 4 is defined as 


[17.25.14] 


where t is the time and r is the scaled time. It should be 
noted that scaled time is not dimensionless. Then, from 
Equation 17.25.14 



17.25.7 Dynamic pressure impulse 

The dynamic pressure impulse i q is 


[17.25.22] 




[17.25.15] 




q d t 


[17.25.23] 
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As for the overpressure impulse, it is often assumed that 
the dynamic pressure impulse takes the form of a triangle 
so that it may be approximated by 

4 »1/2?% [17.25.24] 


In this section consideration is given primarily to the 
characteristics of the explosion itself. The effects of the 
explosion are considered in detail later. However, an 
account is first given of some incidents involving high 
explosives. 


Information on the impulse and duration time for the 
dynamic pressure is not as readily available as for the cor¬ 
responding parameters for overpressure. The following 
empirical relation is given for the dynamic pressure 
impulse by Richmond and Fletcher (1971): 


_ 5.4054+1.1067 In W-lni q 
2.3201 


where « q is the dynamic pressure impulse (psi s), R is the 
distance (ft) and W is the mass of explosive (lb) as TNT 
equivalent. 


17.25.8 Air bursts 

So far the account given of the blast wave is a general one, 
and no distinction has been made between a burst occur¬ 
ring in free air and one occurring on the ground surface. 

If the explosion is an air burst, or an explosion which 
occurs at some height above ground level, the behaviour of 
the shock waves on reaching the ground surface is rather 
more complex. The situation may be explained by reference 
to Figure 17.58. As shown in Figures 17.58(a) and (b), the 
incident shock I strikes the ground and gives rise to a 
reflected shock wave R. The reflected shock wave passes 
through an atmosphere which has already been heated and 
compressed by the incident wave. It therefore travels faster 
and tends to overtake the incident wave. Where this hap¬ 
pens, the two waves fuse at the triple point T and form a 
Mach system M below this point, as shown in Figure 
17.58(c). The Mach stem is a shock front similar to that 
generated by ground level explosions. 

For moderate heights the Mach stems forms at a distance 
from the ground which is approximately equal to the height 
of the explosion (Glasstone, 1962, figure 3.67a). 


17.26 Condensed Phase Explosions 

An explosion of a high explosive is referred to as a con¬ 
densed phase explosion. The explosive which serves as the 
reference standard is TNT. 


17.26.1 Condensed phase explosion incidents 

Condensed phase explosions include explosions of muni¬ 
tions, commercial explosives and ammonium nitrate. An 
account of early accidental condensed phase explosions is 
given in History of Explosions (Assheton, 1930). Some fur¬ 
ther incidents are detailed in Darkest Hours (Q.R. Nash, 
1976) and Handbuch Storfalle (Kier and Mffller, 1983). Apart 
from this, information has to be sought mainly in the 
accounts of individual explosions. Incident data are also 
available from the Explosions Incidents Data Service 
(EIDAS) data bank of the Safety and Reliability Directorate 
(SRD). 

Appendix 1 includes a section devoted to accidental 
condensed phase explosions. Some principal explosions 
are given in Table 17.24, with incidents involving munitions 
and commercial explosives listed in Section A and those 
involving ammonium nitrate in Section B. Further informa¬ 
tion on these incidents is given in Table A1.2 in Appendix 1. 
The criteria for inclusion of condensed phase explosion 
incidents in both these tables is that the incident is a major 
one, that it is of technical interest and/or that it is fre¬ 
quently referenced. The tables give only a small sample of 
the condensed phase explosions which have occurred. 

In the early years of the chemical industry, many of the 
worst incidents involved condensed phase explosives, 
including ammonium nitrate. 

Incidents involving munitions and commercial explo¬ 
sives include the explosion of the munition ship Mont Blanc 
in the harbour at Halifax, Nova Scotia, in 1917, in which 
1963 people were killed (Case History A3). Within a radius 
of about three quarters of a mile, destruction was almost 
complete. It was estimated that 95% of the glass in the city 
was broken. 

Also in 1917 there was an explosion at a munitions works 
in Silvertown, London, and another, less well-known, 
explosion at a chemical works at Ashton, Manchester (Case 
Histories A4 and A2, respectively). 

In 1989 there was an explosion of a load of commercial 
explosives on a road vehicle at Peterborough in the United 
Kingdom (Case History A125). This incident has sig¬ 
nificance for the transport of explosives. 



Figure 17.58 Blast waves produced by an air burst: (a) development of blast wave; (b) incident and reflected waves; and 
(c) development of Mach stem. I, incident wave; R, reflected wave; M, Mach stem; T, triple point 
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Table 17.24 Some condensed phase explosion incidents 

Date 

Location 

Explosive a 

Plant/transport 

Deaths /injuries 

A Munitions and commercial explosives 

1913 

Mexico city 

Dynamite 

Road vehicle 

41+,~100i 

1917 

Ashton, UK 





Halifax, Nova Scotia 

Munitions 

Ship 

1963d, «8000i 


Silvertown, UK 

TNT 

Munitions works 

69d, 426i 

1944 

Fauld.UK 

Munitions 

Munitions store 

68d, 22i 

1956 

Cali, Columbia 

Munitions, dynamite 

Seven road vehicles 

«1200d 

1971 

Waco, GA 

Explosives 

Road vehicle 

5d, 33i 

1985 

Checotah, OK 

Munitions 

Road vehicle 

0d,49i 

1989 

Peterborough, UK 

Explosives 

Road vehicle 

Id,107i 

1990 

Meerut, India 

Explosives 

Road vehicle 

50d 

1991 

Thung Maproah, Thailand 

Dynamite 

Road vehicle 

123d 

B Ammonium nitrate 

1918 

Morgan, NJ 



64d 

1921 

Oppau, Germany 


Chemicals works 

561d 

1942 

Tessenderloo, Belgium 



>100d 

1944 

Bombay Docks, India 


Ship 

>350d, 1800i 

1947 

Brest, France 


Ship 

21d 

1947 

Texas City, TX 


Two ships 

552d, «3000i 


a Only the main item of the load is given. In some cases there were other items such as detonators, boosters, etc. 


Turning to ammonium nitrate, the explosion at Oppau in 
1921 resulted from the use of blasting powder to break up 
stored piles of the material (Case History A5). It created a 
crater 250 ft in diameter and 50 ft deep, destroyed hundreds 
of houses and killed 561 people. 

The explosions at Texas City in 1947 occurred in two 
ships, the Grandcamp and the High Flyer, both of which 
were carrying ammonium nitrate (Case HistoryA16).They 
damaged thousands of buildings, hurled missiles several 
miles and killed 552 people. The fires burned for nearly 
a week. 

17.26.2 TNT explosion model 

The blast characteristics of aTNTexplosion are important 
in their own right and are also sometimes used in modelling 
other types of explosion. There is available much more 
information on explosions of explosives, particularly TNT, 
than for other cases. 

Sources of information on the blast characteristics from 
the explosion of TNT charges include Structural Defence 
(Christopherson, 1946), The Effects of Nuclear Weapons 
(Glasstone, 1962; Glasstone and Dolan, 1980), Explosive 
Shock in Air (Kinney, 1962; Kinney and Graham, 1985), 
Hazards of Chemical Rockets and Propellants Handbook 
(Jensen, 1972), Explosions in Air (W.E. Baker, 1973) and 
Explosion Hazard and Evaluation (W.E. Baker et al., 1983) 
and work by Hoffman and Mills (1956), Goodman (I960), 
Kingery and Pannill (1964), Kingery (1966), Swisdak (1975) 
and Kingery and Bulmash (1984). 

In principle, the blast characteristics of aTNTexplosion 
depend on the mass and shape of the charge and also on 
the point(s) of ignition. 

For aTNTexplosion the two standard types of reference 
data are those for explosions from a point source and from a 


spherical charge. The blast parameters for the two explo¬ 
sions are slightly different. For overpressure, for example, 
the initial effect of a finite charge size is to reduce the 
overpressure very close to the charge relative to that from a 
point source. This effect holds for a distance of some five 
charge diameters. At greater distances, however, the over¬ 
pressure from a spherical charge is greater, being approxi¬ 
mately equivalent to that from a point source with one-third 
greater energy release. 

Other features which affect the blast characteristics 
include the location relative to sea level and the meteoro¬ 
logical conditions. 

There is a degree of scatter in the experimental results 
for condensed phase explosions, includingTNTexplosions. 
W.E. Baker et al. (1983, figures 2 and 3) give for high 
explosives a plot of peak overpressure vs scaled distance 
for which the highest and lowest curves of peak over¬ 
pressure differ in parts by almost an order of magnitude. 
The most recent data on the plot was from W.E. Baker 
(1973). On the other hand, work on the measurement of peak 
overpressure fromTNTexplosions has continued, and it is 
to be expected that the more recent results are more 
accurate. 

The two reference standards for data on aTNTexplosion 
are a free air burst (where the blast wave is not affected 
by interaction with the ground), which has spherical 
symmetry, and a surface burst, which has hemispherical 
symmetry. 

The principal parameters of the blast wave from a TNT 
explosion are the peak side-on overpressure p°, the impulse 
of the positive phase i, the duration of the positive phase t A 
and the arrival time f a . Values of these parameters may be 
presented in scaled or unsealed form. The scaled forms are 
those given in Equations 17.25.13, 17.25.22, 17.25.17 and 
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17.25.16, respectively. Thus, the unsealed and scaled forms 
of the parameters in SI units are: 



Unsealed 

Scaled 

Peak overpressure 

P°( Pa) 

Ps = P° /Pai ) 

Impulse 

ip (Pa s) 

4=f p /W 1 / 3 (Pas/kg 1/3 ) 

Duration time 

4i(s) 

r d = td/W 1 ^ (s/kg 1 / 3 ) 

Arrival time 

Us) 

T a = 4/IT 1 / 3 (s/kg 1 / 3 ) 


where p a is atmospheric pressure (Pa) and ITis the mass of 
explosive (kg). 

Values for TNT explosion parameters which appear to 
have gained general acceptance are those determined at the 
Ballistics Research Laboratory, Aberdeen Proving Ground, 
Maryland, by Kingery and co-workers (Kingery and 
Pannill, 1964; Kingery, 1966). A review of the data from this 
and other work has been made by Kingery and Bulmash 
(1984), who give data and correlations both for free air 
bursts and surface bursts. 

Figure 17.59(a) is a plot of the four parameters mentioned 
for a free-air burst (spherical symmetry) based on the data 
of Kingery and Bulmash. The graph is plotted in terms of 
the scaled parameters p s , i s , r d and r a . Figure 17.59(b) is the 
corresponding plot for a surface burst (hemispherical 
symmetry), again from Kingery and Bulmash. 

Other widely used values forTNTexplosions are those of 
W.E. Baker et al. (1983) and Kinney and Graham (1985). 
Baker et al. give a graph (their figure 2.45) for free-air 
bursts which is broadly similar to Figure 17.59(a), but 
which also includes several other parameters. Kinney and 
Graham give a graph for peak overpressure and data in 
tabular form for all four parameters treated here. 

Work quoted by Kingery and Bulmash includes that of 
Goodman (1960), Kingery (1966),WE. Baker (1973), Swisdak 
(1975) and Reisler, Pettit and Kennedy (1976,1977), and that 
quoted by Kinney and Graham includes that of Hoffman 
and Mills (1956), Goodman (1960), Keefer et al. (1966) and 
Kingery (1966). 

Table 17.25 shows a comparison of the values for free-air 
bursts by Kingery and Bulmash with those of Kinney and 
Graham. 

As an illustration of the use of the Figure 17.59, consider 
the determination from Figure 17.59(a) for a free-air burst of 
the values of the peak overpressure p° and the impulse i p for 
a charge weight Wof 8 kg of TNT at a distance of 10 m with 
ambient pressure 1.01 xlO 5 Pa. Then 


The original graphs given by Kingery and Bulmash are 
plots showing the unsealed parameters p°, i p , f d and t a for 
an explosion involving 1 kg of TNT (W= 1). The graphs 
given in Figure 17.59 are the same plots but with the para¬ 
meters shown as scaled. 

Also shown on the full curve in Figure 17.59(a) are the 
effects on the peak overpressure, in the far field of surface 
temperature inversion, labeled 1, and unstable atmosphere, z. 
Under surface temperature inversion conditions there can 
be a two- or three-fold increase in peak overpressure. 

The variation of the blast parameters may also be expres¬ 
sed in the form of equations. Kingery and Bulmash use for 
the peak overpressure/) 0 , impulse i p , duration time t A and 
arrival time t s of a 1 kg explosion of TNTcorrelations of the 
following form. For a given parameter </> the relations are 

U - « - /)!og,„z [17.26.1] 


logio <j> = Y^CiUi [17.26.2] 


The values of the constants in these equations given by 
these authors are shown in Table 17.26. In these equations 
the units of the parameters are as shown in the table. 

Kinney and Graham have given their values of the peak 
overpressure, impulse and duration time from an explosion 
of 1 kg of TNT in the form of network equations. In SI units 
for the scaled peak overpressure p s 

_ 808[1 + (z/4.50) 2 ] _ 

S [1 + (z/0.048) 2 ] 1/2 [1 + (z/0.32) 2 ] 1/2 [1 + (z/1.35) 2 ] 1/2 
[17.26.3] 


for the impulse 

. + (z/0.23) 4 ] 1 ^ 

* P_ z 2 [l + (z/1.55) 3 ] 1/2 

and for the scaled duration time 


[17.26.4] 


Jd___ 980[1 + (z/0.54) 10 ] _ 

W 1/3 “ [1 + (z/0.02) 3 ] [1 + (z + 0.74) 6 ] [1 + (z/6.9 ) 2 ] 1/2 

[17.26.5] 


z = 10/8 1/3 
*= 5 m/kg 1 / 3 
p s = 0.31 
P°=Ps*Pa 

m 0.31 x 1.01 x 10 5 
m 0.313 x 10 5 Pa 
i = 3.6xlO“ 4 Paskg 1/3 
tp = 4 x W 1 ' 3 
= 3.6 x 10“ 4 x 8 1 / 3 
= 7.2 x 10 _4 Pas 


where/) s is the scaled peak overpressure, i p is the impulse 
(bar ms), t d is the duration time (ms), W is the mass of 
explosive (kg) and z is the scaled distance (m/kg 1 / 3 ). 

It has already been mentioned that the blast parameters 
for a surface burst (hemispherical symmetry) can be 
obtained from those for a free-air burst (spherical sym¬ 
metry) by using in the relations for the latter a charge 
weight suitably modified to account for the concentration 
of energy into the hemisphere rather than the sphere. The 
presumption is that this yield ratio, or symmetry factor, 
should be 2, and it is this value which is commonly used. 

Table 17.27 gives a comparison between values of the 
peak overpressure, impulse and duration time for a surface 
burst calculated directly from the surface burst model and 
values calculated from the free-air burst model using a 










Figure 17.59 Some side-on blast parameters for a TNT explosion (after Kingery and Bulmash, 1985): (a) free air burst (spherical symmetry and (b) surface burst 
(hemispherical symmetry) 
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Table 17.25 Some values a of the side-on blast parameters for a free-air explosion of TNT 


Scaled distance, z 
(m/kg 1 / 3 ) 

Peak overpressure, p° (Pa) 

Impulse, i 

p (Pa s) 

Duration time, f d (s) 

K&B 

K&G 

K&B 

K&G 

K&B 

K&G 

0.5 

38.8 x 10 s 

39.0 x 10 5 

1.41 x 10 2 

1.07 x 10 2 

3.20 x 10“ 4 

0.84 x 1 

1.0 

9.35 x 10 5 

9.83 x 10 5 

1.75 x 10 2 

1.02 x 10 2 

1.79 x 10“ 3 

0.52 x 1 

5 

0.313 x 10 5 

0.285 x 10 5 

4.06 x 10 1 

3 x 10 1 

3.33 x 10“ 3 

2.47 x ) 

10 

0.111 x 10 5 

0.097 x 10 5 

2.11 x 10 1 

1.51 x 10 1 

4.20 x 10“ 3 

3.47 x 1 

40 

0.017 x 10 5 

0.021 x 10 5 

5.30 

4.0 

6.16 x 10“ 3 

4.15 x ] 


a K&B, Kingery and Bulmash (1985); K&G, Kinney and Graham (1985). 


Table 17.26 Constants in correlations of side-on blast parameters for an explosion of TNT of Kingery and Bulmash 


Range constant 


Parameter 


p° (kPa) ip (kPa ms) t A (ms) 4 (ms) 

A Free air burst 


-0.080 922861988 8 


-0.008 008637189 01 


c e -0.004785 07266747 


0.00314819515931 


0.00793030472242 


0.001 520 447 833 82 


0.000 768 446973 5 


0.147 < z < 0.888 
0.888 <z< 2.28 
2.28 <£<40 

2.26367268496 
-1.333 612 06714 
-3.130 058 05346 

5.115 885 543 05 
9.299 628 8611 
3.152472 5364 

-0.686 608 550419 
0.23031841078 
0.621036276475 

-0.164953 518 069 
-0.029 794426896 9 
0.0967031995552 

0.127788499497 
0.030 632 9542941 
-0.008 013 020 59667 

0.002 91430135946 
0.018 340 557 407 4 
0.00482705779732 

0.001879574 49227 
-0.017396 466 628 6 
0.001875 87272287 

0.0173413962543 
-0.001063219 63576 
0.002467385 09321 

0.002 697397580 43 
0.005 620 6003128 
-0.000 841116 668 

-0.003 619 765 027 98 
0.000161821749 9 
0.000 6193291052 


0.000 747 026 589 9 


0.0531 <2 <40 

-0.253273111999 

1.37407043777 

0.072 070 778763 7 

1.36456871214 

-0.057003 5692784 

-0.182832224796 

0.011885143 6014 

0.0432648687627 

-0.0007997367834 

-0.004360 735 55033 
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Table 17.26 

( continued ) 




B 

Surface burst 




1 


-0.0674 <z< 40 

0.0674 <z< 0.955 

0.178 <z<1.01 

0.0674 <z< 40 

2 


- 

0.995 <z< 40 

1.01 <z < 2.78 

- 

3 


- 

- 

2.78<z<40 

- 

2 

a 

-0.214362 789151 

2.067619 08721 
-1.947088 46747 

1.929 461540 68 
-2.124925 25216 

0.202 425716178 

3 


- 

- 

-3.536 262180 91 

- 

1 

b 

1.350 342 499 93 

3.076 032 966 6 

5.250 99193925 

1.377842 236 35 

2 


- 

2.406 977454 06 

9.299 628 8611 

- 

3 


- 

- 

3.463 49745571 

- 

1 

Co 

2.780 769 165 77 

2.524 556 209 25 

-0.614 227603 559 

0.059163 428 804 6 

2 


- 

1.672 816 458 63 

0.315 409 245 784 

- 

3 


- 

- 

0.686 906 642 409 

- 

1 

Cl 

1.695 898 8741 

-0.502 992 763 686 

0.130143 717675 

1.357 064 962 58 

2 



0.384 519 026 965 

-0.029 794 426 8976 


3 


- 

- 

0.093 303 530 400 9 

- 

1 

c 2 

-0.154 159 376 846 

0.171335 645 235 

0.134 872 511954 

0.052 492 798 645 

2 


- 

-0.026 081 670 6301 

0.030 632 954 288 

- 

3 


- 

- 

-0.000 584942 088 3 

- 

1 

c 3 

0.514 060 730 593 

0.045 017696 3051 

0.039157427690 6 

-0.196 563 954 086 

2 



0.005 957 987 538 22 

0.018 340 557408 6 


3 


- 

- 

-0.002 268 849 95013 

- 

1 

c 4 

0.098 853 436 5274 

-0.011896 462 640 2 

-0.004759 336 64702 

-0.060177005 228 8 

2 


- 

0.014 544 526107 

-0.017396 466 6211 

- 

3 


- 

- 

-0.002 959 085 915 05 

- 

1 

c 5 

-0.293 912 623 038 

_ 

-0.004 281445 980 08 

0.069 636 0270891 

2 


- 

-0.006 632 893 347 34 

0.001063 219 636 33 

- 

3 


- 

- 

0.001480 298 689 29 

- 

1 

CO 

-0.026 811234 5019 

_ 

_ 

0.021529 749 0092 

2 


- 

-0.002 841893 272 04 

0.005 620 600 309 77 

- 

3 


- 

- 

- 

- 

1 

Cl 

0.109 097496 421 

_ 

_ 

-0.016 165 893 078 5 

2 


- 

0.001364 481622 7 

0.000161821749 9 

- 

3 


- 

- 

- 

- 

2 

CO 

0.001628 467 56311 

- 

-0.000 686 018 894 4 

-0.002 325 319 702 94 

3 


- 

- 

- 

- 

1 

Co 

-0.021463103 024 2 

- 

- 

0.001477 520 675 24 

2 






3 


- 

- 

- 

- 

1 

Clo 

0.000145 672 338 2 

- 

- 

- 

2 


— 

— 

— 

— 

3 


- 

- 

- 

- 

1 

Cu 

0.001678 477522 66 

- 

- 

- 

2 






3 


- 

- 

- 

- 
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Table 17.27 Comparison of the side-on blast parameters for a surface explosion calculated (1) from a surface 
explosion relation and (2) from a free-air explosion relation 


Scaled distance, z 
(m/kg 1 / 3 ) 

Hemispherical model 

Scaled distance, z 
(m/kg 1/3 ) 

Spherical model using yield factor of 2 

P° 

(Pa) 

(Pas) 

k 

(s) 

P° 

(Pa) 

(Pas) 

k 

(s) 

0.5 

48.7 x 10 5 

1.66 x 10 2 

2.81 x 10“ 4 

0.4 

57.4 x 10 s 

1.73 x 10 2 

2.87 x 10“' 

2.5 

1.72 x 10 s 

1.09 x 10 2 

2.36 xl0“ 3 

2 

1.95 x 10 5 

1.16 x 10 2 

2.33 x 10“ : 

5 

0.432 x 10 5 

5.93 x 10 1 

3.79 x 10“ 3 

4 

0.465 x 10 5 

6.27 x 10 1 

3.86 x 10“ : 


yield ratio of 2, based on the Kingery and Bulmash data for 
these two cases. Thus, in using the free-air burst model, 
the modified charge weight used is 2 W, which introduces 
a correction factor of 2 1/3 (= 1.26). The scaled distance to be 
used for the free-air burst case is therefore that for the 
surface burst case divided by 1.26. The scaled parameters 
are then obtained. No further correction is required for the 
peak overpressure, which is scaled not by charge weight 
but by ambient pressure, but for the two parameters for 
which charge weight (or rather its cube root) is the scaling 
factor, the impulse and the duration time, the scaled values 
are multiplied by 1.26 to convert them to the unsealed 
values. 

17.26.3 TNT explosion model: methods of Baker et al. 

Work on the correlation of blast parameters which is fre¬ 
quently utilized is that of W.E. Baker et al. (1983). Some 
discussion of their treatment is therefore necessary. 

Using Hopkinson scaling Equation 17.25.8 the authors 
presentTNTgraphs for (1) side-on blast parameters, (2) nor¬ 
mally reflected blast parameters and (3) additional side-on 
blast parameters (their figures 2-45,2-46 and 2-47, respec¬ 
tively). These graphs cover a large number of blast para¬ 
meters and a wide range of scaled distance. 

In the second method or energy scaling described earlier 
in W.E. Baker et al. (1975), the scaled distance is expressed as 



where E ex is the explosion energy (J), p 0 is the absolute 
pressure of the ambient air (Pa), r is the distance (m) and R 
is the scaled distance.The scaled overpressure is defined as 

P s =^~l [17.26.7] 

where p s is the absolute peak side-on pressure (Pa) and P s is 
the scaled peak side-on overpressure.The scaled impulse is 
defined as 



where a 0 is the speed of sound in the gas (m/s), 4 is the 
side-on impulse (Pa s) and I is the scaled side-on impulse. 

Figures 17.60 and 17.61 show the curves for scaled peak 
side-on overpressure and scaled impulse given by W.E. 
Baker et al. (1975) for pentolite. 


The actual peak side-on overpressure P s and side-on 
impulse T are then obtained from Equations 17.26.7 and 
17.26.8. 

This second method, utilizing Equations 17.27.7-17.27.9, 
is also that used by Baker and co-workers for the treatment 
of vessel burst explosions and vapour cloud explosions, as 
described in Sections 17.27 and 17.28, respectively. 

17.26.4 TNT equivalent model 

In the absence of models for other types of explosion, such 
as vessel burst or vapour cloud explosion, it has frequently 
been the practice to model such explosions by estimating 
the energy of the explosion, calculating theTNTequivalent 
and then treating the explosion as if it were one from aTNT 
charge, aTNTequivalent model. 

For example, the TNT equivalent model was used by 
Brasie and Simpson (1968) in an investigation of vapour 
cloud explosions. 

However, the characteristics of the blast from the explo¬ 
sion of aTNTcharge are significantly different from those 
given by other explosions.The pressure developed by aTNT 
explosion confined within the boundaries of the charge is of 
the order of half a million bar, which is very much higher 
than that within a bursting vessel or vapour cloud. 

Comparing the profile of the peak overpressure from a 
TNT explosion with that from a vapour cloud explosion, in 
the near field the peak overpressure of theTNTexplosion is 
higher, in the far field it is less. One consequence of this is 
that the use of theTNTequivalent model is not conservative 
in the far field. 

The duration time of aTNTexplosion is relatively short. 
This contrasts with a vapour cloud explosion, for which the 
duration time, and hence the impulse, is longer. This is 
another feature which is not conservative in the use of the 
TNT equivalent model. 

A further discussion of the application of the TNT 
equivalent model to vapour cloud explosions is given in 
Section 17.28. 

17.27 Vessel Burst Explosions 

Turning now to types of explosion more typical of process 
plant, consideration is given first to vessel bursts in which 
the energy of explosion derives from the pressure in the 
vessel and the explosion is essentially physical rather than 
chemical. 

17.27.1 Experimental studies 

Only a small amount of experimental work on the bursting 
of gas-filled vessels is reported in the literature. Boyer et al. 
(1958) performed tests on the bursting of small gas-filled 
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glass spheres. Another set of small scale experiments 
using such apparatus is that of Esparza and Baker (1977). 
In this latter work the spheres ranged up to 102 mm in dia¬ 
meter and the burst pressures up to 5.25 MPa. 

Experiments with metal containers were conducted by 
Pittman (1972a,b), using volumes up to 0.17 m 3 . The burst 
pressures were about 4 MPa for cylindrical vessels and 
55 MPa for spherical ones. Subsequently, Pittman (1976) 
carried out tests on 0.28 m 3 metal spheres with burst pres¬ 
sures up to 100-345 MPa. 


17.27.2 Empirical features 

This work brings out several relevant empirical features. 

The work of Pittman (1972a,b), which involved high 
pressures, demonstrates the need to take into account in 
estimating the energy of explosion for such cases the non¬ 
ideal behaviour of the gas. The differences between the 
behaviour of the blast wave from a condensed phase 
explosion and that from a vessel burst are illustrated in the 


work of Esparza and Baker (1977), who found that for the 
latter the blast wave tended to have a lower overpressure, a 
longer positive phase duration, a larger negative impulse 
and a stronger second shock. 

17.27.3 Vessel burst pressure 

The explosion energy in a vessel burst is a function of the 
initial pressure, which in turn depends on the failure sce¬ 
nario. The higher the pressure, the larger the explosion. 

Three cases may be distinguished: (1) overpressure, 
(2) mechanical failure and (3) fire engulfment. 

If the vessel fails because it is exposed to a high operat¬ 
ing pressure and because the pressure relief has failed, the 
vessel will burst at a pressure which is some factor of the 
design pressure, typically for mild steel a factor of 4. This is 
the worst case. 

If a mechanical failure of the vessel occurs, which may be 
due to a metallurgical defect, corrosion or impact, the burst 
pressure will be the operating pressure. 
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If the vessel fails due to fire engulfment, but with the 
pressure relief operating, the pressure at burst will be the 
accumulation pressure. This is the typical scenario of a 
BLEVE. 


17.27.4 Vessel burst energy distribution 

The estimation of the energy of the explosion in a vessel 
burst is discussed below, but it is appropriate first to con¬ 
sider briefly the distribution of this energy. 

In principle, the energy available will be partitioned as 
energy in (1) vessel expansion, (2) vessel rupture, (3) blast 
and (4) fragments. 

If failure is due to high operating pressure, some expan¬ 
sion of the vessel occurs. However, this can be neglected 
both because the energy is provided to the system prior to 
the burst and because it is very small anyway. 

Some energy is required to rupture the vessel, but this 
too is very small. The Centre for Chemical Process Safety 
(CCPS) gives a value of 1-10 kj for the rupture of a pressure 
vessel; an explosion with 100 times this energy would still 
be regarded as small. 


Essentially therefore, the energy available goes into the 
blast and the fragments. The proportion which goes as 
kinetic energy in the fragments has been briefly discussed 
in Section 17.4 and is considered again in Section 17.34. 

17.27.5. Vessel burst modelling 

There have also been studies involving the numerical and 
analytical modelling of vessel bursts. In some cases the 
main interest of the work has been with other types of 
explosion for which the bursting of a gas-filled sphere 
serves as a limiting case. 

Investigations involving numerical and parametric 
modelling have been described by W.E. Baker et al. (1975), 
Erode (1955), Adamczyk (1976), Guiraio and Bach (1979), 
Chushkin and Shurshlov (1982) and Raju and Strehlow 
(1984). 

The study most relevant here is that of W.E. Baker 
et al. (1975), who conducted a parametric exploration of 
vessel bursts and developed a method of estimating the 
blast parameters analogous to that for a condensed phase 
explosion. 
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Also of interest is the work of Adamczyk (1976) which 
indicates that vessel burst explosions approximate in the 
far field to condensed phase explosions only for high pres¬ 
sure and temperature ratios. 

The investigation by Guiraio and Bach (1979) was con¬ 
cerned with fuel-air explosions. They studied cases of a 
combustion process in which the reactants are converted 
instantaneously to products and found that for such cases 
only some 27—37% of the combustion energy was con¬ 
verted to work. 

Raju and Strehlow (1984) studied the effect of a non- 
spherical source in the form of a combustible gas mixture. 
The initial gas cloud had the form of an ellipse rotated 
on its major axis, or spheroid oriented with its major 
axis perpendicular to the ground. The lead shock wave 
was elliptical but tended towards sphericity as the 
wave moved out. This is explained by the facts that the 
strength of the initial shock wave varied with the direc¬ 
tion and that strong shock waves tend to travel faster than 
weak ones. 


17.27.6. Model of Baker et al.\ basic method 

A method for the estimation of the blast parameters for the 
bursting of a gas-filled pressure vessel is now described. 
The method is that of W.E. Baker et al. (1975), and relates to a 
free-air burst of a massless spherical vessel containing 
an ideal gas. The background to this method has just 
been described and the account here concentrates on its 
application. 

The explosion energy is obtained from the Erode model 
given as Equation 17.4.29. 

Applying the second method of Baker and co-workers, 
based on Equations 17.26.6-17.26.8, the scaled distance R 
is calculated, using Equation 17.26.6. 

The scaled peak overpressure is then obtained from 
Figure 17.62(a), using the curve for high explosive, and the 
scaled impulse from Figure 17.63, or from Figure 17.61, 
which covers a wider range. 

The actual peak side-on overpressure p s and side-on 
impulse 4 are then obtained from Equations 17.26.7 and 
17.26.8. 



Figure 17.62 Scaled peak side-on overpressure for a 


' burst explosion (W.E. Baker etal., 1975) 
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This method is oriented to the estimation of the blast 
parameters in the far field, and its accuracy in the near field 
is limited. There are two checks which should be made with 
regard to the latter. 

The first check is on the value of the scaled distance R. 
If this is less than 2, use should be made of a modification 
to the method appropriate for the near field, which is de¬ 
scribed below. The other check is on the value of the peak 
side-on overpressure p s , discussion of which is deferred. 

The near field modification is as follows. First an effec¬ 
tive radius for the equivalent hemisphere formed by the 
initial gas volume is calculated: 



where r 0 is the effective radius of the equivalent hemi¬ 
sphere (m) and V t is the volume of the gasified vessel (m 3 ). 
The corresponding scaled distance R a is then calculated 
using Equation 17.26.6. The peak side-on overpressure is 


then determined using, in conjunction with Equation 
17.26.7, the relation 


h 

Po 


(Pso + 1) 


{2y n [2y 0 + (y a + il^ 1 } 1 ' 2 ] 

[17.27.2] 


where a is the velocity of sound (m/s), p a is the absolute 
pressure of the ambient air (Pa), pi is the absolute initial 
pressure of the jjas (Pa), P so is the scaled peak side-on 
overpressure at R 0 , y is the ratio of the specific heats and 
subscripts o and 1 denote ambient air and compressed gas in 
the vessel, respectively. 

Equation 17.27.2 is an implicit equation. It may he solved 
by the usual methods for such equations. Alternatively, use 
may be made of graphs given for convenience by the 
authors. One of these is shown in Figure 17.64. 

The method then proceeds as follows. The pair of values 
of R and P so is used to locate the ‘starting point’ on 
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Figure 17.64 Scaled peak side-on overpressure in the near field for a vessel burst explosion (W.E. Baker et al., 
1975). y, = 1.4 


Figure 17.62. This identifies a particular curve in the family 
of curves on Figure 17.62 and this curve is then used in 
making further estimates of the scaled peak overpressure. 

As indicated earlier there is a further check to be made, 
on the value of the peak side-on overpressure p s . It is pos¬ 
sible that the value calculated for p s exceeds the initial 
pressure in the vessel. If so, p s should be set equal to this 
initial pressure. 

17.27.7 Model of Baker et air. extensions of method 

As already stated, the method just described applies to the 
free-air burst of a massless spherical vessel containing 
an ideal gas. There are several extensions which may be 
needed in practical cases. These relate to (1) non-ideal 
fluids, (2) energy imparted to fragments, (3) bursts at 
ground level and (4) other vessel geometries. 

For the ideal gas case, the energy of explosion is obtained 
from the Erode model as given in Equation 17.4.29. For the 
cases of non-ideal gas, vapour or flashing liquid use should 
be made of the alternative method described in Section 17.4. 

This gives the total energy available. Any energy 
imparted to the fragments should then be subtracted from 
this value to obtain the energy participating in the blast. 

For the case of a burst at ground level, this blast energy is 
then multiplied by the usual factor of 2 before it is used in 
Equations 17.26.6 and 17.26.8 to obtain the blast wave 
parameters. Baker et al. have given sets of adjustment fac¬ 
tors for two types of departure from the basic model. One 
set is for use with cylindrical as opposed to spherical ves¬ 
sels. The other set is for a spherical vessel slightly elevated 
above the ground. These are shown in Table 17.28. 

17.27.8 COPS method 

The CCPS Fire and Explosion Model Guidelines (1994/15) 
include as part of the method for a BLEVE a method for 


Table 17.28 Method of Baker et al. for blast 
parameters from a vessel burst: adjustment factors 
(W.E. Baker et al., 1975) 


A Adjustment factors for cylindrical vessels 

R 

Multiplier for: 



h 

I 

<0.3 

0.3 <R< 1.6 

4 

1.6 

2 

1.6 < R < 3.5 

1.6 

1 

>3.5 

1.4 

1 

B Adjustment factors for spherical vessels 
slightly elevated above the ground 

R 

Multiplier for: 



h 

I 

<1 

2 

1.6 

>1 

1.1 

1 


vessel burst explosions. The energy of the explosion is 
obtained using the CCPS method for that described in 
Section 17.4. The blast parameters are then obtained using 
the method of Baker and co-workers described in Section 
17.27.6 with the extension given in Section 17.27.7. The 
Guidelines give sample problems for BLEVEs in which use 
is made of the vessel burst model. These problems are 
described in Section 17.3.2. 
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17.28 Vapour Cloud Explosions 

When a cloud of flammable vapour burns, the combustion 
may give rise to an overpressure or it may not. If there is no 
overpressure, the event is a vapour cloud fire, or flash fire, 
and if there is overpressure, it is a vapour cloud explosion 
(VCE). 

A VCE is one of the most serious hazards in the process 
industries. VCEs do occasionally occur and they tend to be 
very destructive. 

A feature of a vapour cloud is that it may drift some dis¬ 
tance from the point where the leak has occurred and may 
thus threaten a considerable area. 

The relative importance of the VCE hazard has grown in 
recent years. Whereas in the early days of the chemical 
industry the largest disasters tended to be those caused by 
explosives, including ammonium nitrate, many of the larg¬ 
est disasters are now due to VCEs. 

Accounts of VCEs include those given in Unconfined 
Vapour Cloud Explosions (Gugan, 1979), Explosion Hazard 
andEvaluation (W.E. Baker etal. 1983), Fuel-Air Explosions 
(Q.H.S. Lee and Guirao, 1982a) and Major Chemical Hazards 
(V.C. Marshall, 1987) and those by Brasie and Simpson 
(1968), Strehlow (1973b), Strehlow and Baker (1976), 
V.C. Marshall (1976a,c,d), Davenport (1977b, 1983), Kletz 
(1977d), J.H.S. Lee etal. (1977), Slater (1978a),Wiekema (1980, 
1983a,b, 1984), J.H.S. Lee (1983), Pikaar (1983) and Rasbash 
(1986b). 

Until the early 1980s a VCE was generally referred to as 
an unconfined vapour cloud explosion (UVCE). However, 
since in combustion of a vapour cloud the occurrence of 
overpressure tends to occur due to the presence of struc¬ 
tures and obstacles and of partial confinements, the term 
‘unconfined’ is now generally omitted. 

There are many gaps in the state of knowledge on VCEs 
and there is no completely satisfactory theoretical model, 
although much progress has been made in modelling. The 
practical approaches tend to combine theoretical and 
empirical inputs. 

In this section consideration is confined to the char¬ 
acteristics of the explosion itself. The effects of the explo¬ 
sion are considered below. 

The energy of the explosion of a vapour cloud is normally 
computed as the product of the heat of combustion and a 
yield factor, as described in Section 17.4 and discussed 
further below. In this section the energy of explosion, or 
explosion energy, is used in this sense. 

Selected references on VCEs are given in Table 17.29. 


17.28.1 Vapour cloud explosion incidents 

There are a number of compilations of major VCEs. 
V.C. Marshall (1987) gives details of some 11 such compi¬ 
lations. The principal lists are those of Strehlow (1973b), 
Davenport (1977b, 1983), Gugan (1979), the ACMH 
(Harvey, 1979b), Wiekema (1983a,b, 1984) and Lenoir and 
Davenport (1992). The account by Davenport (1977b) also 
lists incidents in which a vapour cloud formed but did not 
explode. 

It is emphasized by their compilers that the lists may be 
incomplete, since the extent to which incidents are 
reported varies between different countries. Where the 
lists include unignited vapour clouds, these are particu¬ 
larly likely to be incomplete, since such clouds are often 
not reported. 


Table 17.29 Selected references on vapour cloud 
explosions 


HSE/SRD (HSE/SRD/WP28); Ministry of Defence (n.d.); 
Stokes (1849); Sachs (1944); G.B. James (1947—49);Whitham 
(1950);Toland (1957);Thornhill (1960); Glasstone (1962); 
Laderman, Urtiew and Oppenheim (1963); Reider, Otway 
and Knight (1965); Urtiew, Laderman and Oppenheim 
(1965); F.A.Williams (1965,1976a, 1983); Bulkley and Jacobs 
(1966); Struck and Reichenbach (1967); Brasie and Simpson 
(1968); Strehlow (1968a,b, 1971,1973a,b, 1975,1981); Bach, 
Knystautas and Lee (1969,1971); Benedick, Morosin and 
Kennedy (1971); D J. Lewis (1971,1980c,d); R.P. Anderson 
and Armstrong (1972,1974); Ford (1972); Oppenheim, Kuhl 
andKamel (1972a,b); J. A. Brown (1973); Kuhl, Kamel and 
Oppenheim (1973); Strehlow, Savage and Vance (1973); 
Beaubois and Demand (1974); Coevert etal. (1974); Collins 
(1974); Decker (1974); Geiger (1974,1982,1983,1986,1987); 
Monday and Cave (1974);Tanimoto (1974); Anon. (1975d); 
Eisenberg Lynch and Breeding (1975); Kletz (1975c,e, 1977], 
1979b, 19861); J.H.S. Lee, Knystautas and Guirao (1975); 
J.H.S. Lee etal. (1975); Leyer, Guerraud and Manson (1975); 
Lind (1975); Lind and Strehlow (1975); VC. Marshall (1975d, 
1976a-d, 1977a,b,d, 1982d, 1987);Monday (1975a,b, 1976a,b, 
1979); R.J. Parker (1975); Sadee (1975); Samuels and O’Brien 
(1975); Strehlow and Baker (1975,1976); D.C. Bull etal. (1976); 
Gugan (1976,1979,1980a,b); Guirao, Bach and Lee (1976); 
Harvey (1976,1979b); W.G. High (1976); Nettleton (1976, 
1977c, 1980a,b, 1987); Sadee, Samuels and O’Brien 
(1976-77); Strehlow and Ricker (1976); Anthony (1977a); 
Chiu, Lee and Knystautas (1977);VJ. Clancey (1977a,c); 
Davenport (1977a,b, 1983); Eichler and Napadensky (1977); 
Fay andLewis (1977); Hertzbergef al. (1977); Kolodner 
(1977a); J.H.S. Lee (1977,1980,1983b); J.H.S. L eeetal. (1977); 
J.G. Marshall (1977,1980); Maurer etal. (1977); Auton and 
Pickles (1978,1980); HSE (1978b, 1980 TP 7,1981a); Slater 
(1978a); M.W.Taylor, Lind and Cece (1978); Benedick (1979, 
1982); D. Bradley (1979); D.C. Bull (1979,1982a,b, 1992); 
Girard etal. (1979); Nicholls etal. (1979); Strehlow, Luckritz 
etal. (1979);TNO (1979); Ale andBurning (1980); van den 
Berg (1980,1982,1985); Cronenberg and Benz (1980); 
Diaconicolaou Mumford and Lihou (1980); Fumarola etal. 
(1980); Geiger and Synofzyk (1980a,b); Giesbrecht etal. 
(1980); Houweling (1980); J.H.S. Lee and Moen (1980); 
Wiekema (1980,1983a,b, 1984); C.W.Wilson andBoni (1980); 
Zalosh (1980a, 1982); Zeeuwen and Schippers (1980); 
Considine (1981); R. A. Cox (1981); Eidelman etal. (1981); 
Fishbum, Slagg and Lu (1981); Oran, Boris etal. (1981). 
Phillips (1981b, 1982,1986,1987,1989); Scilly (1981); Ebert 
and Becker (1982); Funk etal. (1982); Geiger (1982,1987); 
J.H.S. Lee and Guirao (1982a); Leyer (1982); Moen (1982b, 
1993); Moen, Murray etal. (1982); Oran, Boris etal. (1982); 
Oran,Young etal. (1982); A.F. Roberts and Pritchard (1982); 
Urtiew (1982a,b); H.G. Wagner (1982); D.G. Bowen (1983); 
CEC (1983 EUR 8482 EN, 1984 EUR 8955 EN, EUR 9593 EN, 
EUR 9541EN/I and EN/II, EUR 9592 EN); Elsworth, Eyre 
and Wayne (1983,1984); Fredholm (1983); Hasegawa and 
Sato (1983); Hertzberg and Lamrevik (1983); Mackenzie 
(1983 SRD R262); Nikodem (1983); Pickles and Bittleston 
(1983); Pikaar (1983,1985); Schildknecht and Geiger (1983); 
Spalding (1983); Urtiew, Brandeis and Hogan (1983); C.J.M. 
vanWingerden and Zeeuwen (1983,1986); Benedick, 
Knystautas and Lee (1984); J.R. Bowen etal. (1984a,b); 
Brossard etal. (1984); Fry and Book (1984); M.R.O. Jones 
(1984); J.H.S. Lee, Kynstautas and Freiman (1984); Moen etal. 
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(1984); Raju and Strehlow (1984); Schildknecht, Geiger and 
Stock (1984); Ungut, Schuff and Eyre (1984); Brandeis 
(1985); Catlin (1985); Prugh (1985-, 1987a-c); P.H.Taylor 
(1985a,b); Elsworth andEyre (1986); A. Evans and Puttock 
(1986); Jaggers etal. (1986); Mudan (1986); Ogiso, Fujita and 
Uehara (1986); Ogiso etal. (1986); Pasman and Wagner 
(1986); Rasbash (1986b); AIChE (1987/66); van den Berg etal. 
(1987); Nettleton (1987); Skarka (1987); Giesbrecht (1988); 
Zeeuwen and vanWingerden (1988); Lannoy and Leroy 
(1989); J.B. Moss (1989); Pu, Mazurkiewicz etal. (1989); 
Puttock (1989); C .J.M. vanWingerden (1989a,b); C.J.M. van 
Wingerden, van den Berg and Opshoor (1989); C.J.M. van 
Wingerden, Opschoor and Pasman (1990); Q. A. Baker and 
Baker (1991); van den Berg, vanWingerden and The 
(1991a, b); Carnasciali etal. (1991); Clerehugh (1991); D.M. 
Johnson, Sutton and Wickens (1991); C.R. Kaplan and Oran 
(1991); K.G. Phillips and Henshelwood (1991); Pineau etal. 
(1991); Sawides and Tarn (1991); J.E. Shepherd, Melhem and 
Athens (1991);Tieszen etal. (1991); K. vanWingerden,Visser 
and Pasman (1991); Buckmaster and Lee (1992); Giesbrecht 
etal. (1992); Mancini (1992); van den Berg and Lannoy (1993); 
Kinsella (1993); Lenoir and Davenport (1993); Leyer etal. 
(1993); Mercx, van den Berg andThe (1993); Mercx, van Wees 
and Opschoor (1993); Madsen and Wagner (1994); K. van 
Wingerden, Pedersen and Wilkins (1994) 

Selected experimental work 

Fuel air explosions: Kiwan (1970a,b, 1971) 

Early field trials of combustion in unconfined 
vapour clouds: Lutzke (1971); Humbert-Basset and Mon- 
tet (1972); AGA (1974); MITI (1976); Raj, Moussa and Ara- 
vamuden (1979a,b) 

Early work on detonation in unconfmed vapour clouds: Lind 
(1975); D.C. Bull, Ellsworth and Hooper (1979a,b) 
Combustion in unconfined vapour clouds — closely 
controlled tests: Lind and Whitson (1977); Deshaies and 
Leyer (1981); Okasaki, Leyer and Kageyama (1981); 
Schneider and Pfortner (1981); Brossard et al. (1985); 

R.J. Harris and Wickens (1989) 

Combustion in unconfined vapour clouds — field trials: 

Blackmore, Eyre and Summers (1982); MIT-GRI Safety and 
Res.Workshop (1982); Goldwire etal. (1983); Hirst and Eyre 
(1983); Zeeuwen, vanWingerden and Dauwe (1983) 
Combustion in vapour clouds with obstructions — closely 
controlled tests: Dorge, Pangritz and Wagner (1981); C.J.M. 
vanWingerden and Zeeuwen (1983); A.J. Harrison and 
Eyre (1986,1987a); R.J. Harris and Wickens (1989) 
Combustion in vapour clouds with obstructions — field 
trials: Zeeuwen, vanWingerden and Dauwe (1983) 

Jet ignition of vapour clouds: Schildknecht and Geiger 
(1982); Schildknecht (1984); Schildknecht etal. (1984); 
Stock and Geiger (1984); Moen etal. (1985); A.J. Harrison 
and Eyre (1987a); McKay etal. (1988) 

Combustion of turbulent jets: Seifert and Giesbrecht (1986); 
Stock (1987) 

Combustion following vessel burst: Giesbrecht etal. (1981) 
Combustion of a pipeline leak: Hoff (1983) 

Hydrogen explosions 

Bulkley and Jacobs (1966); Berman (1982);Tamm, Harrison 
and Kumar (1982); L. Thompson (1982); Hawksley (1986 
LPB 68); VC. Marshall (1987) 

Suppression by water sprays 

Acton, Sutton and Wickens (1990); D.C. Bull (1992); 

Brenton,Thomas and Al-Hassan (1994) 


As mentioned above, VCEs have come to increasing pro¬ 
minence. Strehlow (1973b) lists the numbers of vapour 
cloud explosions as follows: 


1930-39,4 
1940-49,12 
1950-54,17 
1955-59,17 
1960-64,18 
1965-69,25 
1970-72 (Jan.), 15 

The Second Report of the ACMH (Harvey, 1979b) refers to 
Strehlow’s work and to more recent data and comments that 
the frequency of VCEs has increased from about four per 
decade to a rate of over 60 per decade. 

Some principal VCE incidents are given in Table 17.30. 
The estimates of the quantities released in the table are 
given as quoted in the literature; most appear to refer to the 
total quantity originally in the containment, but may in 
some cases refer to the flammable vapour in the cloud. 
Other incidents are given inTable A1.2. Further lists of VCE 
incidents illustrating particular points are given in Tables 
17.33 and 17.34 below. Experimental work on VCEs is listed 
inTable 17.31. 

Four VCEs in particular have been particularly influen¬ 
tial. In 1967 a very destructive VCE occurred at the refinery 
at Lake Charles in Lousiana after an escape of liquid iso¬ 
butylene due to a valve failure; there were seven deaths 
(Case History A40). The fires burned for 2 weeks. In 1968 a 
slops tank in the refinery at Pernis in the Netherlands 
boiled over and the explosion of the resultant vapour cloud 
killed two people and destroyed an appreciable fraction of 
the refinery (Case History A41). Another massive VCE took 
place in 1970 at Port Hudson, Missouri, where liquid pro¬ 
pane leaked from a pipeline into a valley; on this occasion 
there were no fatalities (Case HistoryA52). 

In 1974 in Flixborough in the United Kingdom a large 
escape of cyclohexane from a temporary pipe on a train of 
reactors gave rise to a vapour cloud which exploded with a 
TNT equivalent of some 16 te. The explosion demolished 
much of the works and killed 28 people, and the fires 
burned for over a week. This incident, which is described in 
Appendix 2, was particularly influential in the develop¬ 
ment of major hazard controls in the United Kingdom and 
in the EC. 

These were not, however, the first major VCEs.Two major 
explosions which occurred earlier at Ludwigshafen, 
Germany, in 1943 and 1948, were more destructive of 
human life, resulting, respectively, in 57 and 207 deaths. In 
the second incident the explosion was caused by an escape 
of dimethyl ether when a rail tank car overheated in the sun 
and burst (Case History A17). For this explosion the TNT 
equivalent has been estimated as 20 te. 

VCEs have continued to occur. Also, in 1974, only a few 
months after Flixborough, there was an escape of propane 
following a rail tank car accident in a marshalling yard at 
Decatur, Illinois, which caused seven deaths and did 
extensive damage (Case History A71). 

In 1975 at Beek in the Netherlands an escape of 
propylene, apparently from brittle fracture of a feed 
drum on a depropanizer, gave rise to a VCE which kil¬ 
led 14 and caused extensive damage to the works (Case 
History A75). 
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Table 17.30 Some incidents involving vapour cloud fires and VCEs 



Date Location a Chemical 

Mass released' (te) 

TNT equivalent c (te) 


1939 

Newark, NJ 

Butane 



1943 

Ludwigshafen, Germany 

Butadiene, butylene 

16.5 d 


1945 

Los Angeles, CA 

Butane 



1948 

Ludwigshafen, FRG 

Dimethyl ether 

30 

20 

1949 

Detroit, IL 

Propane, butane 

1.6 


1951 

Baton Rouge 

HCs 



1953 

Campana, Argentina 

Gasoline 



1954 

Portland, OR 

LPG 

250 m 3 


1955 

Freeport,TX 

Ethylene 

0.68-1.36 



Wilmington, CA 

Butane 



1956 

Baton Rouge, LA 

Butylene 

10 



NorthTonawanda, NY 

Ethylene 

2.5 


1957 

Sacramento, CA 

LPG 



1958 

Ardmore, OK 

Propane 




Augusta, GA 

LPG 



1959 

Meldrin, GA 

LPG 

18 


1961 

Freeport,TX 

Cyclohexane 

18 

0.025 


Lake Charles, LA 

Butane 



1962 

Berlin, NY 

Propane 

14.3 



Fawley, UK 

Houston, TX 

Gasoline 




RasTanura, Saudi Arabia 

Propane 

1.1 


1963 

Plaquemine, LA 

Ethylene 


0.9 

1964 

Jackass Flats, NV 

Hydrogen 

0.09 

0.027 


Liberal, KS 

Propane 


1.0 


Orange, TX 

Ethylene 

0.18 

0.27 

1965 

Baltimore 

Benzene 




Baton Rouge, LA 

Ethyl chloride 

19.3 

135-180 


Escambia, USA 

Hydrogen, carbon 

(0.070) 

(0.012) 



monoxide 




Lake Charles, LA 

Methane or ethylene 



1966 

Raunheim, FRG 

Methane 

1-1.5 

2.7 


Scotts Bluff, LA 

Butadiene 

0.45 


1967 

Lake Charles, LA 

Isobutylene 

9 

12 

1968 

Pernis, Netherlands 

Light HCs 

55-110 

20 

1969 

Escombreras, Spain 

Propane 


(0.012) 


Fawley, UK 

Hydrogen, naphtha 

23 



Glendora, MS 

VCM 




Houston, TX 

Natural gas 




Texas City,TX 

Butadiene 



1970 

Big Springs, TX 

Linden, NJ 

Hydrogen, HCs 

114 

45 


Port Hudson, MO 

Propane 

27-55 

45 

1971 

Baton Rouge, LA 

Ethylene 

3.6 

0.45 


Houston, TX 

Butadiene 

12 



Longview,TX 

Ethylene 

0.45 

0.5 

1972 

East St Louis, IL 

Propylene 

53.5 

2.5 

1973 

Gladbeck, FRG 

Noatsu, Japan 
St-Amand-les-Eaux, France 

VCM 

4.2 

0.2 


Tokuyama, Japan 

Ethylene 



1974 

Beaumont, TX 

Isoprene 

7.6 

0.9 


Climax,TX 

VCM 

110 



Cologne, FRG 

VCM 




Decatur, IL 

Isobutane 

69 

20-125 


Fawley, UK 

Ethylene 

0.9—2.7 



Flixborough, UK 

Cyclohexane 

36 

18 


Holly Hill, FL 

Propane 




Houston, TX 

Butadiene 

<80 

20-57 


Petal, MO 

Butane 




Roumania 

Ethylene 




Zaluzi, Czechoslovakia 

Ethylene 
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Table 17.30 (continued) 

Date 

Location a 

Chemical 

Mass releasee (te) 

TNT equivalent 0 (te) 

1975 

Antwerp, Belgium 

Ethylene 

2.5 



Beek, Netherlands 

Propylene 

5.5 

2.2 


Cologne, FRG 

Hydrogen, naphtha 




Eagle Pass, TX 

LPG 

18.2 



Rosendaal, Netherlands 

Gasoline 

25-50 

1.0 


Watson, CA 

Hydrogen 

0.3 

0.018 

1976 

Longview, TX 

Ethylene 



1977 

Baytown,TX 

Gasoline 

300 



Brindisi, Italy 

Light HCs 




Dallas, TX 

Isobutane 

68.2 

1.6 


Port Arthur, TX 

Propane 



1978 

Abqaiq, Saudi Arabia 

Methane, then LPG 


24 


Denver, CO 

Propane 




Immingham, UK 

Syngas 

0.2-0.3 

0.03 


Pitesti, Roumania 

Propane, propylene 




PobladoTres, Mexico 

Natural gas 



1979 

Texas City, TX 

Propane 

3.1 

0.9 


Torrance, CA 

C3-C4S 




Ypsilanti, MI 

Propane 



1980 

Borger, TX 

Light HCs 




Enschede, Netherlands 

Propane 

0.11 



New Castle, DE 

Hexane, propylene 

12.7 


1981 

Czechoslovakia 

Syngas 




Gothenburg, Sweden 

Propane 

30-40 m 3 


1982 

Philadelphia, PA 




1983 

Port Newark, NJ 

Gasoline 



1984 

Romeoville, IL 

Propane 




Sarnia, Ontario 

Hydrogen 

0.03 

0.91 

1985 

Cologne, FRG 

Ethylene 


4.1 


Edmonton, Alberta 

NGL 

4900 m 3 



Lake Charles, LA 

Propane 




Mont Belvieu, TX 

Ethane, propane 



1987 

Pampa.TX 

Acetic acid, butane 




RasTanura, Saudi Arabia 

Propane 

300 m 3 

0.9 

1988 

Beek, Netherlands 

Ethylene 



1988 

Norco, LA 

Light HCs 

9 



Raines, Norway 

VCM 

25 




Ethylene dichloride 

30 


1989 

Baton Rouge, LA 

Ethane, propane, butane 


11-14 


Minnebeavo, USSR 

Propane 




Pasadena,TX 

Isobutane 

37.8 



Ufa, USSR 

NGL 


10,000 

1990 

Cincinnati, OH 

Xylene, solvent 




Maharastra, Bombay 

Ethane, propane 




Porto de Leixhas, Portugal 

Propane 




Tomsk, USSR 

Gas 



1991 

Kensington, GA 

Butadiene 




Pajaritos, Mexico 

Propane 




Seadrift, TX 

Ethylene oxide 




a Further details are given in Appendix 1, including Table A1.2. 
b Source: Lenoir and Davenport (1992). 

c Source: Lenoir and Davenport (1992), supplemented (values in parentheses) by values from Gugan (1979). 
d YC. Marshall (1987). 


One of the most serious VCEs in recent years, however, 
has been that of a cloud of isobutane vapour at Pasadena, 
Texas, in 1989, which caused 23 fatalities and resulted in as 
serious a business loss as Piper Alpha. This incident, is 
described in Appendix 6. 

Also, in 1989 there occurred at Ufa in the Soviet Union a 
vapour cloud explosion much more disastrous in human 
terms (Case History A127). 


17.28.2 Empirical features 

Some observations and generalizations can be made by 
analysing explosion incidents. 

A compilation of VCE incidents and corresponding 
statistical data has been presented by Davenport (1977b). 
These data relate to 43 incidents where overpressures 
were created, of which 32 were in industrial plant, 8 in 
transport and 3 elsewhere. Of those in industrial plant, 
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Table 17.31 Some experimental work on vapour cloud explosions 


Investigators 


System 


Gas 


A Combustion of dispersed vapour clouds 


Al. Work on fud—air explosions 
Kiwan (1971a,b, 1971) 

A2. Early field trails of combustion in unconfined vapour clouds 

Liitzke (1971) Field test site 

Humbert-Basset and Montet (1972) Field test site 

AGA (1974) Field test site 

Raj, Moussa and Aravamuden (1979) Field test site 

MITI (1976) Field test site 

A3. Early work on detonation in unconfined vapour clouds 

Lind (1975) Balloons 

D.C. Bull, Elsworth and Hooper (1979a.b) Field test site 

A4. Combustion in unconfined vapour clouds: closely controlled tests 

Deshaies and Leyer (1981) Soap bubbles 

Okasaki, Leyer and Kageyama (1981) Soap bubbles 

Lind and Whitson (1977) Hemispherical balloons 


Brossard et al. (1985) 
Schneider and Pfortner (1981) 
R.J. Harris andWickens (1989) 


Spherical balloons 
Hemispherical balloons 
Tent-type rig, 45 m long 


A5. Combustion in unconfined vapour clouds: field trials 
Blackmore, Eyre and Summers (1982); Field test site 

Hirst and Eyre (1983) 

MIT-GRI (1982); Goldwire etal. (1983) Field test site 

Zeeuwen, van Wingerden and Dauwe (1983) Field test site 
A6. Combustion in vapour clouds with obstructions: closdy controlled tests 
Dorge, Pangritz and Wagner (1981) Apparatus with wire mesh 


A.J. Harrison and Eyre (1986,1987a) 

R.J Harris and Wickens (1989) 

C.J.M. van Wingerden and Zeeuwen (1983) 


Cylindrical sector, see 
Figure 17.65 

Tent-type rig, 45 m long 
Single plate supporting 
1 cm vertical obstacles 


LNG 

LNG 

LNG 

Ethylene 

Methane, propane 
Methane, ethane 

Methane, propane, ethylene 
Ethylene 

Various, including 
methane, acetylene 
Ethylene, acetylene 
Hydrogen 

Natural gas, propane, 
cyclohexane, ethylene 

LNG, propane 

LNG 

Propane 

Methane, propane, 
acetylene 

Natural gas, propane 

Natural gas, cyclohexane 
Methane, propane, 
ethylene, acetylene 


A 7. Combustion in vapour clouds with obstructions: field trials 

Zeeuwen, van Wingerden and Dauwe (1983) Vertical sewer pipes, diameter Propane 

1 m, height 2 m 


A8. Combustion in partially confined vapour clouds without or with obstructions: work using tubes 


Chapman and Wheeler (1926,1927) 
Dorge, Pangritz and Wagner (1981) 

C. Chan et al. (1980) 

Moen, Lee etal. (1982) 

Hjertager (1984) 

J.H.S. Lee, Knystautas and Chan (1984) 
Hjertager, Bjorkhaug and Fuhre (1988b) 


Pipe, 50 mm diam., 2.4 m Methane 

length, with orifice plates 

Pipe, 40 mm diam., 2.5 m Methane 

length, with orifices 

Pipes: (1) 63 mm diam., Methane 

0.45 length; (2) 152 mm 
diam., 1.22 m length; both 
with orifices 

Pipe, 2.5 m diam., 10 m Methane 

length 

As Moen, Lee et al. (1982) Propane 

Pipe, 50 mm diam., 11 m Hydrogen 

length 

As Hjertager (1984) Propane 


A9. Combustion in partially confined vapour clouds without or with obstructions: work using parallel plates 
Moen, Donato, Knystautas and Lee (1980); Two plates, 2.5 m diam., Methane, 

Moen, Donato, Knystautas, Lee and Wager (1980) with tube obstacles Hydrogen sulphide 

C.J.M. van Wingerden and Zeeuwen (1983) Two plates 0.6 x 0.6 m, with Methane, propane 

‘forest’-type obstacles 
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Table 17.31 (continued) 




Hjertager (1984) 

Disc, 1 m diam., with flat and 

Methane, propane 


C.J.M. vanWingerden (1984) 

pipe-type obstacles 

Two plates 2 x 4 m, with 

Ethylene 


cylindrical obstacles 

A10. Combustion in partially confined vapour clouds without or with obstructions: work using channels 


Urtiew (1981) 

Open channel, with baffles 

Propane 


C. Chan, Moen and Lee (1983) 

Channel, variable top opening, 

Methane 


Elsworth, Eyre and Wayne (1983) 

Sherman etal. (1985) 

with obstracles 

Open channel, some work with 
baffles 

Channel, variable top opening, 

Propane 

Propane 


P.H. Taylor (1986) 

with obstacles 

Channel, variable top opening, 

Propane 


All. Jet ignition of vapour clouds 

Schildknecht and Geiger (1982); Schildknecht 

with obstacles 

Enclosure, 1 x 1 x 4 m: 

Ethlyene, hydrogen 


(1984); Schildknecht etal. (1984); Stock and 
Geiger (1984) 

Moen etal. (1985) 

(1) tent-type enclosure; 

(2) open top channel 

Ballon 

Acetylene 


A.J. Harrison and Eyre (1987a) 

Cylindrical sector, 

Natural gas 


McKay et al. (1988) 

see Figure 17.65 



B Combustion of turbulent jets 

Seifert and Giesbrecht (1986) 

Jet 

Natural gas, hydrogen 

Stock (1987) 

Jet 

Propane 


C Combustion following vessel burst 

Giesbrecht etal. (1981) 

Vessels, 0.226-' 

L.01 

Propylene 

D Combustion of a pipeline leak 




Hoff (1983) 

Gas pipeline 


Natural gas 


8 were in refineries and 24 in the petrochemical 
industries. 

The sources of spill material in the industrial plant inci¬ 
dents were: 

Process equipment 24 
Storage tank 4 

Transportation vehicle within plant 3 
Unknown 1 

The modes of release for all incidents were: 

Vessel failure 13 

Piping, valves or fittings failure 26 
Release from venting facilities 3 
Unknown 1 

In a further paper, Davenport (1983) has given additional 
incidents but without statistical data. 

Some questions which are capable of resolution by an 
empirical approach are 

(1) frequency of release; 

(2) quantity of material released; 

(3) fraction of material vaporized; 

(4) probability of ignition of cloud; 

(5) distance travelled by cloud before ignition; 

(6) time delay before ignition of cloud; 


(7) probability of explosion rather than fire; 

(8) existence of a threshold quantity for explosion; 

(9) efficiency of explosion. 

Early discussions of these problems were given by 
Strehlow (1973b), VC. Marshall (1976a) and Kletz (1977j). 

An early but fairly comprehensive treatment of the 
empirical features of vapour cloud explosions was given by 
Kletz (1977j), and this is now described. He gives estimates 
of the frequency of such explosions as shown in Table 17.32. 
A special pipeline is one on which special care can be taken, 
such as a short pipe without pumps or other intervening 
equipment between two vessels. A severe duty pump is one 
on a very hot or very cold liquid. The figure for pressure 
vessel failure is based on the data of Phillips and Warwick 
(1968 UKAEA AHSB(S) R162) and Engel (1974). 

On items where the frequency of leaks is high there is a 
strong case for emergency isolation valves. The fitting of 
emergency isolation valves on a normal pipeline is usually 
impractical, but may well be justified on a pump. Kletz 
suggests that if a remotely controlled emergency isolation 
valve is fitted, it may be assumed that it will be operated 
within 5 min, but that if only a local isolation is available, it 
should be assumed that it will not be operated and that the 
leak continues until it is isolated by other means or until all 
the inventory has leaked out. 

The material escaping may be a gas, or a volatile liquid, 
superheated or subcooled. Flashing superheated liquids 
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tends to give rise to the largest vapour clouds. Most VCEs 
have been caused by such flashing liquids. It is suggested 
by Kletz that the fraction vaporized be obtained from the 
common rule of thumb that the amount of liquid spray 
formed equals the amount of vapour formed by adiabatic 
flash. Thus, if the fraction of liquid vaporized is as high as a 
half, this assumption implies that all the liquid turns into 
vapour and spray. 

There are few data from which the probability of ignition 
can be estimated. Kletz suggests that for large leaks (>101) 
this probability is greater thanlinlOandperhapsashighasl 
in 2. For small leaks the probability of ignition is much less. 
Kletz quotes a value of 10 -4 for small leaks on polyethylene 
plants, where the high pressure causes good j et mixing. 

The distance drifted by a cloud of flammable vapour 
depends on the situation. The drift determines the explo¬ 
sion centre and the blast intensity near this. It has less 
effect on the blast intensity further away. Kletz states that 
there is no reported case of a cloud drifting a significant 
distance in a factory before exploding. He suggests that the 
assumption of no drift is probably good enough for most 


Table 17.32 Estimated frequencies of VCE 
(after Kletz, 1977j) 


Frequency 

(explosions/ 

plant-year) a 

(1) 

Caused by failure of pressure vessel 

10-5t, 


Pipeline — special pipeline 

io- 5 -io~ 4 


-normal pipeline 

l(T 4 -l(r 3 


Pump - normal pump 

10“ 2 


- severe duty pump 

KT 1 


Reciprocating compressor 

HT 1 

(2) 

Caused by leak from 

htMo- 1 


Batch reactor 



Tanker-filling house 

lO^-KT 1 


a Plant is defined as a major unit such as ethylene or aromatics plant 
or collection of smaller units - something smaller than a typical UK 
works or US plant. 

b The estimated failure rate of a pressure vessel is 10 5 / vessel-year. 


calculations but that a drift of 100 m may occur in 1 case in 5 
or 10. The distance drifted by the cloud before ignition is 
unlikely to be great in any industrial or urban area. 

In open situations with few sources of ignition the 
vapour cloud may drift much further. In the Port Hudson 
explosion (NTSB 1972 PAR-72-01) the cloud travelled 
1500 ft in a long plume before igniting. In the flash fire at 
Austin (NTSB 1973 PAR-73 - 04), ignition did not occur until 
the cloud had travelled 2400 ft. Data on the distance trav¬ 
elled by the vapour cloud in 81 rail tank car spills have been 
given by G.B. James (1947-48), who states that 58 % found 
a source of ignition within 50 ft and 76 % within 100 ft and 
all which ignited did so within 300 ft. 

A separate but related question is the time delay before 
ignition. Strehlow (1973b) states that a delay as long as 
15 min has been reported. The quantity of material which 
can accumulate inthistime may be very large.The explosion 
can be a large one, however, even if the time delay is short. 
The delay before ignition at Flixborough was probably in the 
range 30- 90 s. An estimate of 45 s has been widely quoted. 

In many instances the cloud is formed from a turbulent 
momentum jet. This was the case at Flixborough. In such 
situations the cloud may reach an equilibrium size within 
about 10-20 s. Once such a steady state has been reached, 
the mass of material available in the cloud for combustion 
does not increase, even if there is an appreciable delay 
before ignition. 

The probability that ignition will cause an explosion 
rather than a flash fire depends on complex factors, some of 
which are discussed below. Kletz states that there is about 
one serious VCE every 2 years; Strehlow reports about five 
VCEs/flash fires per year and these two factors in combi¬ 
nation perhaps support the view that about one vapour 
cloud ignition in 10 gives an explosion. 

A number of vapour releases have been analysed by 
VC. Marshall (1976a), as shown in Table 17.33. The table 
indicates that whereas the larger releases have resulted in 
explosions, the smaller ones have produced fires instead. 
The data given show no explosions in clouds of less than 
15 t. Marshall has also pointed out, however, that the 
explosion at Beek in 1975 involved a release of only about 
5.5 t and therefore tends to undermine this argument. In 
addition, the data of Davenport (1977b) include a number of 


Table 17.33 Some data on quantity released and on occurrence of fire or explosion in vapour clouds 
(after V.C. Marshall, 1976a) 


Location 

Date 

Chemical (t) 

Quantity 

Deaths 

Nature of incident 

Further details 

Pernis, Netherlands 

1968 

Mixture of 

140 

2 

Explosion 

Slopover 



hydrocarbons 





Butane 

77 


Explosion 




LNG 

53 


Explosion 



Lake Charles, LA 

1967 

Isobutane 

46 

7 

Explosion 

Accidental opening 







of large valve 


Propylene and 40 


Explosion 




propane 






Port Hudson, MI 

1970 

Propane 

29 

0 

Explosion 

Pipeline break 

Flixborough, UK 

1974 

Cyclohexane 

25 

28 

Explosion 

Process pipe break 



Butane 

15.5 


Fire 




Butane 

7.7 


Fire 


Los Angeles, CA 


Butane 

2.0 


Fire 




Methane 

1.0 


Fire 




Propane 

0.06 


Fire 
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explosions of vapour clouds containing less than 15 t of 
flammable material. 

The question of whether there is a minimum size of cloud 
below which an explosion will not occur has been much 
discussed, and a threshold quantity of 10-151 has been 
suggested. 

It is argued by Kletz that there is no theoretical basis and 
no detailed survey to support the assumption that there is a 
threshold quantity for an explosion to occur. In one well- 
attested case a fraction of a ton of methane exploded, 
causing serious damage. Moreover, there have been a 
number of experiments with balloons filled with flammable 
mixtures in which violent explosions have been obtained 
with quantities of less than 1 t. Kletz concludes that 
although it may not be correct to assume a threshold quan¬ 
tity, the probability of an explosion certainly appears to be 
much less if the quantity is small. He suggests that if there 
are 101 of vapour, the probability of explosion is at least 1 in 
10, whereas if there is 11 or less the probability of explosion 
is of the order of 1 in 100, or, more likely, 1 in 1000. 

The ratio of the energy in the blast wave to the energy 
theoretically available from the heat of combustion, or effi¬ 
ciency of explosion, is another quantity about which much 
uncertainty exists. The fraction of the heat of combustion 
that is used to produce the blast wave usually lies between 1 
and 10% based on the total mass released. 

The Bureau of Mines is sometimes quoted as recom¬ 
mending the use of an explosion efficiency of 10%. Kletz 
points out, however, that this should be taken in conjunc¬ 
tion with another recommendation that the quantity of 
material considered should be that leaking within 30 s. 

Kletz suggests that is the release is fairly rapid, it is rea¬ 
sonable to assume an explosion efficiency of 1%, whereas if 
it is not, an overall efficiency becomes meaningless and it is 
necessary to attempt to calculate the amount within the 
flammable range and within congested regions. 

Burgess and Zabetakis (1973 BM RI 7752) have given 
such a calculation for the Port Hudson explosion (Case 
History A52). 

In some cases a much higher explosion efficiency has 
been reported. Davenport gives an explosion efficiency of 
25-50% for a vapour cloud explosion at Decatur, Illinois, 
in 1974 but this value may well be anomalous; it is dis¬ 
cussed in the account of the incident (Case History A71). 

Values of the explosion efficiency, or yield factor, are not 
always quoted on the same basis, and this is a cause of 
variation in the figures. Sometimes the value quoted is 
based on the total amount of vapour in the cloud and 
sometimes on that part of the vapour which is within the 
flammable range. The two may differ by a factor of 10 or 
more. Thus, Kletz points out that although the yield factor 
at Port Hudson is widely quoted as being 20%, this is based 
on the part of the cloud which was within the flammable 
range. Based on the whole cloud the value is 7.5%. Further 
variability is introduced by the fact that the total quantity 
of vapour released is generally subject to uncertainty. A 
typical factor of uncertainty is 2. 

Kletz’account of the empirical features of VCEs is intended 
primarily as a guide to plant design. It may be regarded as an 
integrated treatment such that using the various empirical 
values given the result obtained is reasonable. The applica¬ 
tion of the values maybe less valid if used as part of an eclectic 
approach. 

Kletz (1979b) has applied this approach to obtain guid¬ 
ance on plant layout. This was described in Chapter 10. 


More recently, Wiekema (1984) has carried out a statis¬ 
tical study on some 165 vapour cloud ignitions. Incidents 
were not included where no ignition occurred or where 
ignition was virtually simultaneous with the release, as in a 
BLEVE. On the other hand, no incident was excluded sim¬ 
ply because some information on it was lacking. The study 
is based on reported incidents and, as the author points out, 
is therefore a biased sample. 

The features selected for analysis are given under the 
following headings: (1) mass, (2) reactivity, (3) ignition 
source, (4) drift, (5) explosion, (6) location, (7) delay, 
(8) fatalities, (9) injured, and (10) domino effects. The gas is 
classed as being of high, medium or low reactivity; the 
ignition sources as continuous or non-continuous; the 
combustion as a flash fire or explosion; the location as 
containing obstacles and therefore being semi-confined or 
as being free from obstacles and not semi-confined; and the 
situation as one where vulnerable objects were absent and a 
domino effect was not possible, where such objects were 


Table 17.34 Some principal statistical features of ignited 
vapour clouds of material of medium reactivity (after 
Wiekema, 1984) (Courtesy of Elsevier Science Publishers) 




Explosion 


Flash fire 


No. 

Percentage 

No. 

Percentage 

Mass (kg) 

<1(T 

0 

3 

1 

4 

10 2 -10 3 

6 

14 

3 

12 

10 3 -10 4 

15 

43 

10 

38 

10 4 -10 5 

12 

31 

7 

27 

>10 5 

3 

9 

5 

19 

Ignition 

Continuous 

13 

65 

12 

55 

Not continuous 

7 

35 

10 

45 

Drift (m): 

<10 2 

16 

55 

19 

61 

10 z -10 3 

12 

41 

11 

35 

>10 3 

1 

4 

1 

4 

Location 

Semiconfined 

37 

100 

15 

65 

Unconfined 

0 

0 

8 

35 

Delay (min) 

<1 

5 

25 

3 

14 

1-5 

7 

37 

10 

48 

6-15 

5 

25 

3 

14 

16-30 

3 

16 

0 

0 

>30 

0 

0 

5 

24 

Fatalities 

0 

21 

39 

24 

50 

1-5 

19 

35 

17 

36 

6-15 

8 

15 

5 

10 

16-50 

5 

9 

2 

4 

>50 

1 

2 

0 

0 

Injured 

0 

7 

15 

15 

44 

1-5 

10 

22 

12 

35 

6-15 

9 

20 

3 

9 

16-50 

11 

24 

3 

9 

>50 

9 

20 

1 

3 
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present and a domino effect occurred and where such 
objects were present but no domino effect occurred. 

The results of the survey are shown in Figure 17.69. Since 
for many incidents some information was lacking, the 
number of cases given for each of the subfigures varies. 
Most of the releases were of medium reactivity materials. 
For these the analysis gave the results shown in Table 17.34. 

Wiekema draws from his analysis the following con¬ 
clusions: 

(1) In 87 out of 165 incidents the distance within which 
ignition occurred was known. More than 60% of these 
87 vapour clouds were ignited within 100 m from the 
location of the spill. In only 2% of these cases did the 
vapour cloud drift more than 1 km before ignition took 
place. 

(2) In 150 out of 165 incidents it was known whether an 
explosion or flash fire occurred. In nearly 60% of 
these cases the ignition resulted in an explosion; in the 
other cases a flash fire occurred. 

(3) In 143 out of 165 incidents the number of fatalities was 
known. In about 40% of these cases there were no 
fatalities and in 25% no one was hurt. 

(4) The amount spilled did not influence the probability 
of an explosion for the investigated incidents in the 
spill range 1-100 te. 

(5) Explosions occurred only in semi-confined situations 
and never in unconfined situations. 

(6) A short delay time to ignition enhanced the prob¬ 
ability of an explosion. 

(7) For delay times to ignition larger than half-an-hour 
only flash fires occurred. 

(8) Outside the combustible cloud no one was killed due to 
primary blast effects. 

(9) For flash fires the number of injured was of the same 
order as the number of fatalities. For explosions the 
number of injured was one order of magnitude larger 
than the number of fatalities. 

VCE is one of the hazards considered in the two Convey 
Reports. The treatment given in these reports is described 
in Appendix 7. 

17.28.3 Combustion in vapour clouds 
The combustion of vapour clouds in the open air was 
already a subject of research before the four major explo¬ 
sions just mentioned, but their occurrence provided a fur¬ 
ther stimulus to work on what was then generally referred 
to as unconfined VCEs. 

Fundamental aspects of VCEs have been discussed by 
various authors, including Brasie and Simpson (1968), 
Strehlow (1973b), Gugan (1976, 1979), Munday (1976a,b), 
Anthony (1977a), VJ. Clancey (1977a), J.H.S. Lee et al. (1977), 
W.E. Baker et al. (1983), J.H.S. Lee (1983b), Pikaar (1983) 
and D.C. Bull (1992). 

‘Open-air’ explosions usually occur with at least part of 
the vapour cloud in a congested region of a processing 
plant. Except in rare instances these explosions are defla¬ 
grations. Deflagrations can be highly damaging. 

In the early work much attention centred on the question 
of detonation of the vapour cloud. Detonations are more 
damaging than deflagrations, but the distinction can often 
be expressed as detonations produce smaller fragments. 

It is known that flame speeds obtained in vapour clouds 
are greater than the normal burning velocity. Strehlow 


quotes a burning velocity of 9 m/s for stoichiometric 
hydrogen-oxygen mixtures as measured on a bunsen 
burner and velocities of 68-120 m/s obtained using bal¬ 
loons. These velocities are typical of a flash fire rather than 
an explosion. The acceleration of the flame in a vapour 
cloud and the influence of factors such as apertures and 
turbulence has been the subject of many experiments. A 
major focus is to determine what degree of turbulation 
induction will accelerate flame speed to a deflagration let 
alone a detonation. Some of the problems associated with 
detonation are: 

(1) which fuels have a high reactivity leading to detona¬ 
tions; 

(2) existence of detonability limits; 

(3) occurrence of unconfined detonation; 

(4) direct initiation of detonation; 

(5) characteristics of flame propagation; 

(6) transition from deflagration to detonation. 

Only a few fuels are considered highly reactive and can 
detonate lacking confinement. These include ethylene, 
acetylene, ethylene oxide and methyl nitrate. 

There are in the literature statements to the effect that 
the limits of detonability are essentially the flammability 
limits. Thus, Burgess et al. (1968 BM RI7196) state: ‘A con¬ 
sensus has gradually developed that almost any gas mix¬ 
ture that is flammable is also detonable if initiated with a 
sufficiently energetic source.’ 

It has been shown, however, that detonability limits are 
in fact distinct from flammability limits, but they are more 
complex and more difficult to measure. Information on 
detonability limits for spherical detonation is especially 
sparse and the limits are a function of the strength of the 
ignition source. Detonability limits were discussed in 
Section 17.2 and are considered further below. 

The violence of some VCEs suggests that they might well 
be detonations, but the occurrence of detonation as 
opposed to deflagration in an unconfined vapour cloud was 
for a long time considered to be highly unlikely, even 
impossible. However, in an account of the Port Hudson 
explosion Strehlow (1973b) stated: ‘The Port Hudson 
explosion is a proven example of an accidental vapour- 
cloud detonation’. And again: ‘There is no question but that 
detonation has occurred in accidental explosions, or that 
detonation can be initiated without delay in an unconfined 
cloud using a sufficiently strong ignition source.’ He also 
stated: ‘More commonly, the vapour cloud simply defla¬ 
grates. However, deflagration velocities are commonly 
observed to be quite high and extensive blast damage can 
occur even for this type of vapour-cloud combustion, par¬ 
ticularly if the cloud contains a sufficiently large volume of 
combustible mixture at the time of ignition’. 

The problem which concerned workers in this area, 
however, was the initiation of detonation. As Munday 
(1976a) commented: ‘It seems highly unlikely that detona- 
tive combustion occurs in unconfined conditions unless a 
priming confined or condensed explosive source is ignited’. 

In the Port Hudson explosion it is believed that the cloud 
may have been ignited by a strong ignition source in a 
building enveloped by the cloud. 

As the debate developed in the mid-1970s there was some 
reversion to the view that detonation in vapour clouds is 
highly unlikely. There are difficulties in envisaging the 
mechanism by which the flame speed in an unconfined 
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cloud can accelerate to such a degree as to reach the speeds 
characteristic of detonation.The consensus view developed 
that if detonation occurs, it is likely to be associated with 
special circumstances, such as the occurrence of an initi¬ 
ating detonation within the cloud or interaction of the blast 
wave with structures, resulting in flame acceleration and 
higher local pressures. 

The Second Report of the ACMH (Harvey, 1979b) prob¬ 
ably represented current opinion in stating in its discus¬ 
sion of the Port Hudson incident: ‘Since no other single case 
is on record, and many deliberate attempts to detonate 
unconfined hydrocarbon/air clouds have failed, it would 
seem more justifiable to regard the occurrence of true 
detonation in an unconfined vapour cloud as so improbable 
as to be disregarded for design purposes’. 

As far as direct initiation of detonation is concerned, 
Strehlow states that direct initiation of detonation in a 
vapour cloud can occur if the ignition source is sufficiently 
strong, and quotes experiments which demonstrate this. 
This has since been confirmed by further research, 
including both work directed to determination of deton- 
ability limits and other work directed to vapour cloud 
detonation as such. 

It is possible that a deflagration may turn into a detona¬ 
tion. The dominant view has been that this is difficult to 
envisage in a truly unconfined situation, but the shock 
waves to promote the transition might arise from interac¬ 
tion with structures. 

Although much work has been done, and continues to be 
done, on the detonation of vapour clouds, the focus of 
attention has gradually shifted to the effect of confinement 
on the flame and, in particular, on the conditions which 
promote its acceleration to very high flame speeds. 

The view which emerges from this work is that sig¬ 
nificant overpressure in vapour cloud combustion tends to 
be associated with a degree of confinement and that the 
extent of this overpressure is highly dependent on the 
details of the confinement. 

With this model the mass of flammable gas available to 
participate in the explosion is not the total flammable mass 
but that part which is within the confinement. 

Another feature which is better appreciated is the 
importance of the initial combustion zone. This may be 
envisaged as a spherical zone in which the flame front 
expands until it breaks through the envelope of the cloud. 
Once this happens, relief occurs and the pressure falls. 
It follows from this that the overpressure developed 
depends on features such as cloud height and vertical 
confinement. 

Traditionally, vapour clouds have been treated as hemi¬ 
spherical, but in practice many vapour clouds are pancake 
shaped. Increasingly, this feature is being taken into 
account in studies of vapour cloud combustion. 

It will be apparent from the foregoing that VCEs are not 
yet well understood. Experimental studies have therefore 
been undertaken to improve understanding, while design 
approaches have been developed based on correlation of 
empirical features. These aspects are now described. 

17.28.4 Experimental studies 

There is now a considerable body of experimental work on 
VCEs. Reviews include those of J.H.S. Lee (1983b), Pikaar 
(1985), D.C. Bull (1992) and the CCPS (1994/15). 

Some experimental studies of vapour cloud fires and 
VCEs are given in Table 17.31. A listing of experimental 


work suitable for the testing of VCE models is given by 
Madsen and Wagner (1994). 

The review by Pikaar (1985) covers (1) release phenom¬ 
ena, (2) vapour cloud generation and dispersion, (3) vapour 
cloud combustion, and (4) interactions. Vapour cloud 
combustion is divided into (1) combustion of premixed 
clouds and (2) combustion of fuel-rich clouds. The com¬ 
bustion of premixed clouds covers (1) combustion in open 
terrain, (2) influence of partial confinement and obstacles, 
and (3) pressure waves. The interactions considered are 
(1) the effect of deliberate dispersion by water sprays 
and (2) the effective lower flammability limit following 
dispersion. 

In his review, D.C. Bull (1992) covers large scale work on 
both vapour clouds in the open and vapour mixtures in 
large enclosures such as modules, and gives the following 
classification of the research done: 


State 


Single 

Aerosol 

+hybrid 

‘Unconfined’ 

Intially quiescent 

A 

B 


Initially turbulent 

C 

D 

With congestion 

Intially quiescent 

E 

(F) 


Initially turbulent 

G 

(H) 

With congestion 

Intially quiescent 

I 

J 


Initially turbulent 

K 

(L) 

With congestion 

Intially quiescent 

M 

(N) 

and confinement 

Initially turbulent 

0 

(P) 


No large scale work was found in the classes shown in par¬ 
entheses. 

The review by the CCPS (1994/15) is under the following 
headings: (1) unconfined deflagration under controlled 
conditions, (2) unconfined deflagration under uncontrolled 
conditions and (3) partially confined deflagration. 

A. Combustion of dispersed vapour clouds 

Al. Work on fuel-air expbsions. Much research has been 
done on the use of fuel-air explosion (FAE) weapons. 
Although this work is mainly in the military domain and 
unpublished, some accounts are available (e.g. Kiwan 
1970a,b, 1971). Fuels used include ethylene oxide, propylene 
oxide, w-propyl nitrate and methyl acetylene/ propadiene/ 
propylene (MAPP). Further information is given by 
W.E. Baker et al. (1983). 

A2. Early field trials of combustion in unconfined vapour 
clouds. Early work on the combustion of unconfined 
vapour clouds includes the field trials on liquified natural 
gas (LNG) described by Liitzke (1971), Humbert-Basset and 
Montet (1972), the American Gas Association (AGA) (1974) 
and Raj, Moussa and Aravamudan (1979a,b) and those on 
ethylene by the Ministry of International Trade and Indus¬ 
try (MITI) (1976). 

The large scale tests on LNG carried out by Gaz de 
France (Humbert-Basset and Montet, 1972), described 
earlier, included experiments in which ignition sources 
were disposed at the edge of the cloud. The main pur¬ 
pose in this case was to obtain a cross-check on the cloud 
concentrations. 
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Tests on the explosion of ethylene-air mixtures in the 
open were carried out as part of the experiments, described 
earlier, conducted by MITI (1976) in Japan. In one test an 
ethylene-air mixture containing 4.08 kg of ethylene and 
giving a 7% mixture in air was held in a polyvinyl chloride 
tent and exploded by a detonator. The blast pressure was 
4.9 bar at 5 m and 0.49 bar at 20 m distance. It was correlated 
by a straight line on a log-log plot of peak overpressure vs 
scaled distance. The TNT equivalent of the explosion was 
estimated as 49.2 kg. The duration time was 10 ms at 10 m 
distance. It was concluded that for flammable gas explosions 
theTNTequivalent model fits reasonably well for the peak 
overpressure, but that the duration time is rather longer. 

A3. Early work on detonation in unconfined vapour 
clouds. A major theme in early research on VCEs was the 
definition of the conditions under which detonation might 
occur. 

It is known that the transition from deflagration to deto¬ 
nation is difficult to induce in an unconfined vapour cloud, 
and investigations have concentrated on features which 
promote defregration to detonation transition (DDT), such 
as obstacles and partial confinement. 

The problem was approached from two directions. 
One was the study of flame speeds in unconfined clouds. 
Work by Lind (1975) indicated early on that flame speeds, 
and overpressures, in truly unconfined vapour clouds are 
very low. 

Other work was directed to the study of the potential 
modes of detonation and the conditions for their occur¬ 
rence. This includes research on (1) the direct initiation of 
detonation, (2) the deflagration to detonation transition 
(DDT), (3) the effect of obstructions and of partial con¬ 
finement, and (4) the minimum size of cloud for detonation. 


Work on direct initiation of explosions has frequently 
utilized an explosive charge. Typical is the work of Bull, 
Elsworth and Hooper (1979a) on the detonation limits of 
ethane-air mixtures. A review of work in which detonation 
has been induced using an explosive charge is given by Bull 
(1979). 

A small amount of research has been done to establish 
the size of cloud in which overpressures can be induced. 
Thus, Maurer et al. (1977) have shown that overpressures 
can occur in even very small clouds of mass 0.5-500 kg. 
Fundamental approaches to the estimation of the minimum 
size of cloud in which detonation might occur have been 
described in Section 17.2. Some fundamental aspects of 
detonation in vapour clouds have also been discussed in 
Section 17.2, including DDTand minimum cloud size. 

The consensus which emerged from this work on deto¬ 
nation in vapour clouds was that it is more fruitful to focus 
attention primarily on the conditions associated with high 
flame acceleration and high deflagration overpressure 
rather than on detonation as such. 


A4. Combustion in unconfined vapour clouds: closely con¬ 
trolled tests. A number of workers have performed 
experiments on combustion of gas-air mixtures inside 
soap hubbies or balloons. They include Lind and Whitson 
(1977), Deshaies and Leyer (1981), Okasaki, Leyer and 
Kageyama (1981), Schneider and Pfortner (1981), Brossard 
et al. (1985), A.J. Harrison and Eyre (1986, 1987) and 
R.J. Harris and Wickens (1989). The flame speeds for gases 
of moderate or low reactivity obtained were low (<24 m/s) 
as were the overpressures (<0.06 bar), where measured. 

The rig used by A.J. Harrison and Eyre (1986,1987) is 
shown in Figure 17.65. It represents a sector of a pancake¬ 
shaped vapour cloud. For natural gas and propane the 



Figure 17.65 Experimental work on vapour cloud explosions: rig representing a sector of a shallow, cylindrical cloud 
(A.J. Harrison and Eyre, 1986) (Courtesy of Institution of Chemical Engineers) 







EXPLOSION 17/145 


flame speeds and overpressures obtained in the absence of 
a high-energy ignition source or obstructions were low. 

R.J. Harris and Wickens (1989) conducted tests in a tent- 
type rig of rectangular cross-section and 45 m long with 
a plywood floor and with polyethylene sheeting on the 
sides and roof. The gases used were natural gas, propane, 
cyclohexane and ethylene. The basic experiment was to 
fill the rig with a stoichiometric mixture, ignite it at one 
end and measure the flame speeds and overpressures 
generated. 

One set of experiments was conducted without any 
obstruction of the space in the rig and without confinement 
of the ignition region. For this base condition the flame 
speeds observed were about twice those measured in the 
laboratory. The authors give the following data: 


Gas 

Laminar 
burning 
velocity (m/s) 

Flame speed (m/s) 



Laboratory tests 

Rig tests 

Natural gas 

0.45 

3.1 

8 

LPG 

0.52 

3.6 

10 

Cyclohexane 

0.52 

3.6 

10 

Ethylene 

0.83 

5.8 

19 


Thus, without obstructions the flame speeds obtained were 
low. 

The last two sets of investigators also performed 
experiments using obstructions, as described below. 

This research has thus provided further confirmation 
that the flame speeds in unconfined vapour clouds of 
moderate or low reactivity substances are not such as 
to give high overpressures and deflagrations, let alone 
detonations. 

In balloon tests, high reactivity gases gave rather higher 
flame speeds (acetylene 38 m/s and hydrogen 84 m/s), still 
less than the deflagration range. 


A5. Combustion in unconfined vapour clouds: field 
trials. The early 1980s saw a number of large scale field 
trials on dense gas dispersion, some of which were sup¬ 
plemented by trials involving cloud ignition. 

Accounts of this work are given by Blackmore, Eyre and 
Summers (1982) for trials with LNG and propane at the 
Maplin Sands site, Hogan (1982), MIT-GRI (1982) and 
Goldwire et al. (1983) for LNG trials at China Lake and 
Zeeuwen, van Wingerden and Dauwe (1983) for propane 
trials at Musselbanks. 

For LNG the maximum flame speed observed was 
13.3 m/s at China Lake, and for propane 28 m/s at Maplin 
Sands and 32 m/s at Musselbanks. 

Field trials on combustion of vapour clouds are also 
considered in Chapter 16 in relation to flash fires. 


A6. Combustion in vapour clouds with obstructions: closely 
controlled tests. The absence of evidence in work on 
unconfined vapour clouds of flame speeds sufficiently high 
to give high overpressures has led to investigation of the 
effect of obstacles in promoting flame acceleration. 

Controlled tests using obstacles have been conducted by 
Db’rge, Pangritz and Wagner (1981), C.J.M. van Wingerden 


and Zeeuwen (1983), AJ. Harrison and Eyre (1986,1987) 
and RJ. Harris and Wickens (1989). 

The apparatus in the work of Db’rge, Pangritz and 
Wagner (1981) contained a wire mesh, whilst that of 
C.J.M. van Wingerden and Zeeuwen (1983) consisted of a 
60 x 60 cm plate with 1 cm vertical obstacles placed on it. 

Using in their rig a blockage ratio of 40% with six grids 
of pipe-type obstacles, A.J. Harrison and Eyre (1986,1987) 
obtained in one test on natural gas a flame speed of 119 m/s 
and an overpressure of 0.21 bar. They observed that the 
flame accelerated on entering the obstructed region and 
decelerated on leaving it. The tests showed that with nat¬ 
ural gas a high degree of congestion is required to obtain 
high flame speeds and overpressures. 

R.J. Harris and Wickens (1989) utilized the 45 m long 
tent-type rig already described. Again the gases used were 
natural gas, propane, cyclohexane and ethylene. The 
obstructions were placed in the central portion of the rig. 
The effect of these was to cause the deflagration flame to 
accelerate. On entering the subsequent unobstructed por¬ 
tion the flame decelerated again. This is illustrated in 
Figure 17.66(a), which shows results for cyclohexane. The 
flame speeds obtained were up to 10 times higher than for 
the unobstructed case. 

Both of the last two sets of investigators studied 
the effect of a strong ignition source. A.J. Harrison and 
Eyre (1987) utilized a jet flame emerging from a partially 
confined region. Using natural gas, they observed in 
one test a flame speed of 170 m/s and an overpressure of 
0.71 bar. 

R.J. Harris and Wickens (1989) conducted tests with a 
strong ignition source using cyclohexane and propane. 
The tests involved the use of a central obstructed region 
and a modified method of ignition, obtained by confining 
the end region in which ignition took place. In experi¬ 
ments on cyclohexane the flame emerged from this region 
with a flame speed of about 150 m/s. The results obtained 
are illustrated in Figure 17.66(b), which shows that the 
flame ran up to detonation in the obstructed portion and 
that the detonation was maintained when it entered the 
subsequent unobstructed portion. The detonation velocity 
was 1700 m/s. The corresponding velocities for propane 
were 300 m/s leaving the confined region and 1800 m/s for 
detonation. 

Overall, the work of Harris and Wicken illustrated the 
effect of a combination of fuel reactivity, ignition condi¬ 
tions and an obstructed region. It showed that with an 
obstructed region and an ignition source giving a high 
initial flame speed more reactive fuels can run up to deto¬ 
nation. On the other hand it also confirmed the much lower 
flame speeds associated with natural gas. 


A7. Combustion in vapour clouds with obstructions: field 
trials. Experiments on the effect of obstacles on the 
course of VCEs have also been carried out on the field scale. 
Zeeuwen, van Wingerden and Dauwe (1983) have described 
work at TNO on field trials using obstacles which comple¬ 
ment the small scale work described earlier. Tests were 
conducted both without and with partial confinement. For 
the former, two types of obstacle were used: a set of large 
horizontal pipes and a set of sewer pipes, each 1 m in dia¬ 
meter and 2 m high, stood on end. The latter system, shown 
in Figure 17.67, consisted of seven rows of 10 pipes on a 3 m 
pitch. In some tests this array was open at the top and in 
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Figure 17.66 Experimental work on vapour cloud explosions: effects of obstructions and of jet flame ignition 
(R.J. Harris and Wickens, 1989): (a) flame acceleration on entering obstructed region and flame deceleration on leaving 
it and (b) flame acceiertion on entering obstructed region with transition to detonation, following jet flame ignition. 
Cyclohexane in both cases (Courtesy of the Institution of Gas Engineers) 


others it was partially or totally covered. The vapour clouds 
consisted of 1000 kg of propane, which was introduced over 
a period of some 1—2 min through a water pond 15 m in 
diameter and 1 m high. The dimensions of the cloud within 
the flammable limits were estimated as 130 m long, 75 m 
wide and 2 m high. In the tests without obstacles the flame 
speed was generally low at 3-10 m/s, although one case 


was recorded of 32 m/s, and no overpressure was meas¬ 
ured. In the tests with horizontal pipes the flame acceler¬ 
ated to 16 m/s at the pipes and then fell again. 

In the tests with the vertical pipes uncovered the flame 
speed was similar to the unconfined case. In the tests with 
cover, the area covered was 7 x 7 m 2 , then 13 x 13 m 2 and 
finally the whole array. In all but the first of these tests the 
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Figure 17.67 Experimental work on vapour cloud 
explosions: obstacle array lor field trials (Zeeuwen, 
van Wingerden and Dauwe, 1983) (Courtesy of the 
American Institute of Chemical Engineers) 


flame speed increased in the covered area and decreased 
beyond it. With the array completely covered the flame 
accelerated continuously, and flame speeds of 50-66 m/s 
were obtained, as were maximum overpressures of 20 mbar 
in the cloud and 6 mbar 75 m away. 

A8. Combustion in partially confined vapour clouds without 
or with obstructions: work using tubes. The foregoing 
account indicates that the flame speed in a vapour-air 
mixture is affected by partial confinement as well as 
by obstacles. Investigators have studied a number of dif¬ 
ferent geometries, notably (1) tubes, (2) parallel plates, and 
(3) channels, the first two being representative, respec¬ 
tively, of one- and two-dimensional flame propagation. 

Work on the behaviour of flames in tubes antedates inter¬ 
est in VCEs. Early work on this topic was carried out by 
Chapman and Wheeler (1926,1927) and their co-workers, 
using both empty tubes and tubes containing obstacles. An 
account of this work has been given in Chapter 16. 

Combustion in tubes, especially shock tubes, is the sta¬ 
ple of research on detonation and has been the subject of 
innumerable studies. 

A series of investigations using tubes specifically relat¬ 
ed to vapour cloud explosions has been described by Lee, 
Moen, Hjertager and co-workers (C. Chan etal., 1980; Moen, 
Lee et al., 1982; Hjertager, 1984; J.H.S. Lee, Knystautas and 
Chan, 1985). Other work includes that of Wagner and co¬ 
workers (Db’rre, Pangritz and Wagner, 1981) and Andrews 
and co-workers (Andrews, Herath and Phylaktou, 1990; 
Phylaktou and Andrews, 1991a,b). 

Moen, Lee et al. (1982) and Hjertager (1984) carried out 
experiments in a pipe 2.5 m in diameter and 10 m long con¬ 
taining obstructions. The former obtained for methane 
overpressures of 4 bar and the latter for propane pressures 
of 13.9 bar. 

Subsequently, Hjertager and co-workers (Hjertager, 
Bjorghaug and Fuhre, 1988; Hjertager, Fuhre and 
Bjorghaug, 1988a) performed similar experiments with 
a non-homogeneous mixture more representative of that 
from a plant leak. For non-stoichiometric mixtures the 
pressures obtained tended to be less than those with a stoi¬ 
chiometric homogeneous mixture. For non-homogeneous 
mixtures the pressures were equal to or less than those for 
homogeneous mixtures. 


A9. Combustion in partially confined vapour clouds without 
or with obstructions: work using parallel plates. The second 
widely used system is a pair of parallel plates. Among the 
investigators who have studied this configuration are 
Moen, Donate, Knystautas and Lee (1980), Moen, Donate, 
Knystautas, Lee and Wagner (1980), C.J.M. van Wingerden 
and Zeeuwen (1983), Hjertager (1984) and C.J.M. van 
Wingerden (1984,1989). 

Moen, Donate, Knystautas and Lee (1980) used plates 
60 cm in diameter with obstacles, and obtained for methane 
flame speeds up to 130 m/s, whilst further work by 
Moen, Donate, Knystautas, Lee and Wagner (1980) using 
2.5 x 2.5 m plates, again with methane, gave flame speeds 
up to 400 m/s and overpressures of 0.64 bar. 

In the work of C.J.M. van Wingerden and Zeeuwen (1983), 
already mentioned, experiments were carried out in a 
closed vessel using a configuration consisting of vertical 
sticks held either on a single plate or between two plates. 
Enhancements of flame speed were observed in the con¬ 
fined volume, but these were much greater where the space 
was confined by the second, top plate. The increases in 
flame speed were attributed to two mechanisms. One is the 
stretching of the flame front as it passes through the open¬ 
ing between the obstacles and the other is the folding and 
wrinkling of the flame front due to turbulence. The authors 
discuss the relative importance of these two factors, which 
is somewhat complex. 

Using a 0.5 m disc with obstructions Hjertager (1984) 
obtained a flame speed of 160 m/s and an overpressure of 
0.8 bar for methane and a flame speed of 225 m/s and 
overpressure of 1.8 bar for ethylene. 

In work by C.J.M. van Wingerden (1984 CEC EUR 9541 
EN/II) on ethylene using 4 x 4 m plates with obstacles a 
flame speed of 420 m/s and an overpressure of 0.7 bar were 
obtained. 

C.J.M. van Wingerden (1989) also used a plate apparatus 
to perform experiments with a range of gases of differing 
reactivity: methane, propane, ethylene and acetylene. He 
showed that reactivity can be related to the laminar flame 
speed and that this can be used as the basis for a method of 
scaling inVCE work. 

A10. Combustion in partially confined vapour clouds without 
or with obstructions: work using channels. The third con¬ 
figuration to have attracted investigation is the channel on 
which work has been reported by Urtiew (1981), C. Chan, 
Moen and Lee (1983), Elsworth, Eyre and Wayne (1983), 
Sherman etal. (1985), RH.Taylor (1986) and P.H.Taylor and 
Bimson (1989). 

Working with ethylene in an open channel containing 
baffles Urtiew (1981) obtained a flame speed of 20 m/s. 

C. Chan, Moen and Lee (1983) also used a channel with 
baffles and with a top containing perforations such that the 
degree of top confinement could be varied. For methane with 
highconfinementaflamespeedofl20m/swasobserved,but 
with only 10% confinement this figure fell to 30 m/s. 

The experiments by P.H. Taylor (1986) also involved a 
perforated duct top in which the top confinement could 
be varied. Working with propane he obtained a flame 
speed of 80 m/s with a 50% blockage ratio and an 88% 
confinement. 

Elsworth, Eyre and Wayne (1983), in tests relevant to a 
spill between a vessel and a jetty, investigated using an 
open channel the behaviour of propane systems both pre¬ 
mixed and simulating a liquid propane spill, using baffles 
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in some tests. The maximum flame speed in the premixed 
tests was 12.3 m/s. 

The work on channels brings out the effect of top venting 
in reducing the flame speeds in vapour-air mixtures. 

All. Jet ignition of vapour clouds. Other work on VCEs 
includes studies of the effect of a strong ignition source in 
the form of a flame jet issuing into the cloud. 

Work on this form of strong ignition source by 

A. J. Harrison and Eyre (1987) and R.J. Harris and Wickens 
(1989) has been described above. It was shown to yield high 
flame speeds and even detonation. 

B. Combustion of turbulent jets. Leaving now the combus¬ 
tion of dispersed vapour clouds to consider that in other 
vapour-air release scenarios, another important case is 
that of the turbulent free jet. It was ignition of such a jet 
which gave rise to the explosion at Flixborough. 

Work on this problem has been described by Seifert and 
Giesbrecht (1986) and Stock (1987). The former workers 
studied ignition of jets of methane and of hydrogen. Meas¬ 
urements were taken of the flame velocities and of the 
overpressures and duration times at different distances 
from the cloud. 

Stock (1987) investigated jets of propane and measured 
overpressures within the cloud. The work included inves¬ 
tigations of the effect of obstacles and partial confinement. 


For the particular configurations studied, partial confine¬ 
ment with 0.5 m high obstructions within 2 m high parallel 
walls, the overpressure in the cloud increased by a factor of 
about 4. 

C. Combustion following vessel burst. Another release sce¬ 
nario is that of the rupture of a vessel, reported in accounts 
by Maurer, Giesbrecht, Seifert and co-workers. The account 
by Maurer et al. (1977) was concerned primarily with 
experiments on the dispersion aspects but included some 
results for the overpressure from the physical burst. Gies¬ 
brecht et al. (1981) have described the explosion resulting 
from ignition of the flammable vapour cloud formed. 

The experiments were done using vessels ranging in size 
from 0.226 to 1.0 1, containing propylene at 40—60 bar. 
Figure 17.68 shows a plot of the variation of the principal 
variables with the initial mass in the vessel. Also shown on 
the plot are the extrapolations for the VCEs at the BASF 
works at Ludwigshafen in 1943 and 1948 and at Flixbor¬ 
ough in 1974. 

D. Combustion of a pipeline leak. Another scenario investi¬ 
gated is that of the ignition of a leak of flammable vapour 
from a pipeline.Work on this has been done by Hoff (1983). 

His tests involved full bore ruptures of a 10 cm diameter 
gas pipeline operating at 60 bar. Ignition was effected by 
firing a bullet at the gas jet. The flame speeds observed 



Vessel contents, M vES (kg) 


Figure 17.68 Experimental work on vapour cloud explosions: flame velocity, peak overpressure and duration time ir 
explosions of flammable vapour cloud formed following vessel burst (Giesbrecht et al., 1981) (Courtesy of German 
Chemical Engineering) 
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were of the order of 15 m/s, and the overpressure at a dis¬ 
tance of 50 m was measured as 1.5 mbar. 

E. Some factors affecting combustion of dispersed vapour 
clouds. It is useful at this stage to summarize some of 
the salient points on the combustion of dispersed 
vapour clouds brought out by the experimental work just 
described. The summary is mainly confined to qualitative 
observations. 

Fuel reactivity. One important factor which determines 
the flame speeds and overpressures attained is the reac¬ 
tivity of the fuel. 

Fuels are generally classed as being of low, moderate or 
high reactivity. Methane may be considered of low reactiv¬ 
ity, propane of moderate reactivity and acetylene of high 
reactivity. 

A classification developed by the Factory Mutual 
Research Company (FMRC) (1990) from the work of 
D.J. Lewis (1980d) is given in Section 17.28.9. In this classi¬ 
fication, although more reactive than methane, propane 
and butane are classed as low reactivity fuels. 

Cloud inhomogeneity: flame speed and overpressure. 
The standard vapour-air mixture used in most work on 
VCEs has been stoichiometric and homogeneous. Only a 
small amount of work has been done involving more real¬ 
istic vapour-air mixtures. The work appears to indicate 
that whilst flame speeds tend to be lower in mixtures which 
depart significantly from the stoichiometric, in spaces 
where the mass of vapour is such that good mixing would 
give a mixture close to stoichiometric it is unwise to assume 
that the flame speed will be much reduced by a degree of 
inhomogeneity. 

Cloud inhomogeneity: effective lower flammability 
limit. It has long been appreciated that due to concentration 
fluctuations pockets of flammable vapour-air mixture of a 
concentration above the lower flammability limit (LFL) 
may occur beyond the nominal envelope bounded by the 
concentration corresponding to the LFL. 

It is conventional to take this effect into account by using 
an effective LFL and to treat that part of the cloud calcu¬ 
lated to be within this effective LFL as potentially flam¬ 
mable. A common practice has been to take the effective 
LFL as half the actual LFL, in other words taking a peak-to- 
average, or P/A, ratio of 2. This is illustrated in the work of 
Feldbauer et al. (1972) used in the hazard assessment done 
for the First Canvey Report, as described in Appendix 7. 

The problem has been discussed by Pikaar (1985), who 
points out that it may be approached either from the 
standpoint of gas dispersion or that of combustion. As 
regards dispersion, there is no doubt that the P/A con¬ 
centration ratio can be high. On the other hand, combustion 
of vapour clouds in large field trials such as those at Maplin 
Sands indicates that pockets of gas can be ignited without 
igniting the main cloud. 

On the basis of such considerations, Pikaar proposes the 
use of a P/A ratio of 1.4. 

A discussion of this problem from the viewpoint of gas 
dispersion is given in Chapter 15. 

Cloud shape. The typical vapour cloud formed by disper¬ 
sion of a dense gas is pancake shaped. This has a sig¬ 
nificant effect on combustion in the cloud. 

One consequence of this cloud geometry is that the gas is 
able to expand, or vent, through the top of the cloud, so that 
there is less compression of the unburned gas ahead of the 
flame front and the flame speed is correspondingly lower. 


The same thing has been found for aspect ratio, with long, 
narrow vapour clouds, overpressures are lower because 
energy escapes out the sides of the congested area as the 
flame progresses. 

Another effect relates to the possibility of detonation in 
the cloud. There is a minimum cloud thickness for detona¬ 
tion to occur, this thickness being a function of the cell size, 
which is characteristic of the gas. For the fully unconfined 
case the thickness needs to be of the order of 10-13 cell 
sizes, whilst for the practical case of a cloud bounded by the 
ground it is about 5-6.5 cell sizes. 

Obstructions and partial confinement. The experimental 
work described demonstrates that the flame speed is 
enhanced by the presence of obstructions, but it also indi¬ 
cates that the extent of this enhancement varies. For a low 
reactivity gas without even partial confinement the 
increase may be relatively limited. 

The addition of partial confinement in combination with 
obstructions can result in a much greater enhancement of 
flame velocity. 

Obstruction configuration. One type of obstruction which 
has been used by several workers is a series of grids set one 
behind the other at regular intervals and consisting of 
horizontal cylinders simulating pipework. For the particu¬ 
lar experimental set-up, correlations have been obtained of 
the effect on flame speed of variables such as the blockage 
ratio, the spacing and the construction of the grid. 

Ignition source strength. Another enhancing factor is the 
strength of the ignition source. The strong ignition sources 
principally investigated are explosives and jet flames. The 
latter are regarded as a credible ignition source. 

Experiments on jet flame ignition have involved obsta¬ 
cles and some partial confinement also. They have shown 
that in combination with these other factors this form of 
ignition can give high flame speeds and in some cases 
detonation. 

Combination of enhancing effects. The principal enhancing 
effects mentioned are fuel reactivity, obstacles, partial 
confinement and jet flame ignition. The experimental evi¬ 
dence suggests that these factors are most effective in pro¬ 
ducing high flame speeds, even detonation, where they are 
present in combination. 

Water sprays. There have been a number of studies on the 
use of water spray to mitigate the effects of a flammable gas 
release by dispersing it. 

Pikaar (1985) sounds a note of caution on the use of water 
sprays, in so far as they increase the turbulence in the cloud 
and could thereby make things worse. He refers to the work 
of Eggleston, Herrera and Pish (1976), in which flame 
speeds were apparently increased, although opinions dif¬ 
fer on the interpretation of this work. 

17.28.5 Vapour Cloud Explosion modelling 

Although there are many gaps in the understanding of 
VCEs, considerable progress has been made in modelling 
such explosions. 

Work on fundamental models has been described 
by a number of authors, including G.I. Taylor (1946), 
F.A. Williams (1965), Kuhl, Kamel and Oppenheim (1973), 
Strehlow (1975, 1981), Munday (1975a,b, 1976a,b), Gugan 
(1979),Wiekema (1980), W.E. Baker et al. (1983) and van den 
Berg (1985). 

Other work has been directed to the correlation of 
experimental results and to the development of semi- 
empirical models. This includes the work of C.J.M. van 
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Wingerden (1989), C.J.M. van Wingerden, van den Berg 
and Opschoor (1989), C.J.M. van Wingerden, Opschoor 
and Pasman (1990) and K. van Wingerden, Pedersen and 
Wilkins (1994). 

Some of the approaches to modelling have been described 
by Munday (1976a). These are: 

(1) point source models 

(a) TNTequivalent model, 

(b) self-similarity model; 

(2) fuel-air cloud model; 

(3) bursting vessel model; 

(4) piston model 

(a) constant velocity piston model, 

(b) accelerating piston model. 

In the TNT equivalent model the explosion is taken to be 
equivalent to that of aTNTexplosion with the same energy 
of explosion. This model is therefore an empirical one, but 
it was for some time virtually the only practical model 
available. It was considered in Section 17.26 and is dis¬ 
cussed further below. 

The TNT equivalent model has a single parameter, the 
mass of TNT. It can be made more flexible by the introduc¬ 
tion of a second parameter, the height above ground zero at 
which the explosion occurs. The effect of increased height 
is to reduce the overpressures near the centre. The use of an 
arbitrary assumed explosion height is useful in obtaining 
better fits to overpressures assessed from damage in actual 
explosions. 

In the self-similarity model, the blast parameters such as 
peak overpressure are correlated in terms of the ratio of 
radial distance to time. In its simplest form the model gives 
a power law relation for the variation of peak overpressure 
with distance. 

In the fuel-air cloud model it is assumed that a detona¬ 
tion propagates through the fuel-air mixture without any 
expansion of the cloud. However, there is some expansion 
of a burning cloud during a deflagration. A shock wave 
with a high peak overpressure is produced at the cloud 
boundary. With combustion thus complete, subsequent 
decay of the shock wave is similar to that for the point 
source models. 

Another approach is to assume that the fuel-air mixture 
undergoes combustion in a hemispherical vessel, defined 
by the cloud boundary, and that when combustion is com¬ 
plete, the vessel bursts. The state of the gas, after combus¬ 
tion but before bursting, is determined by standard 
methods. Subsequent decay of the shock wave may he 
calculated by numerical solution of wave propagation 
equations. 

A widely used method has been to treat the flame front as 
a constant velocity piston. Early work on the piston model 
was done by G.I. Taylor (1946). This approach has been 
taken forward by Kuhl, Kamel and Oppenheim (1973), 
Strehlow (1981),Tang and Baker (1999) and other workers. 

Figure 17.70 illustrates the variation of the overpressure 
with time in the TNT equivalent model and constant veloc¬ 
ity piston models of aVCE. 

The constant velocity piston approach has also been 
used by Wiekema (1980) atTNO. His model is a practical one 
and is quite widely used. It is described below. 

Van den Berg (1985) at TNO has developed this work to 
produce a multienergy (ME) model, also described below, 
which reflects the fact that the main energy release is from 
the confined parts of the cloud. 


Finally, TNO have presented an empirical model for the 
damage circles caused by a VCE. 

Before considering these models, however, mention 
should be made of several other concepts which are impor¬ 
tant in modelling. 

One of these is that of flame acceleration. Some of 
the factors which influence this have been considered by 
C.J.M. van Wingerden and Zeeuwen (1983) in their work 
on the influence of obstacles. They describe two effects 
which enhance flame speed. One is the stretching of the 
flame front as it passes through an opening. The flame 
front velocity 7 f is 
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[17.28.1a] 

[17.28.1b] 


where A f is the disturbed flame surface area, A a is the 
undisturbed flame surface area, S is the burning velocity, 
Sl is the laminar burning velocity, p is the gas density and 
the subscripts b and u denote burned and unburned, 
respectively. For the case where this effect, rather than that 
of turbulence, is the dominant factor a simple relation may 
be derived for the flame acceleration. If the flame front 
velocity is 7 fo before an obstacle and 7^ after it, then 


7 fl =7 fo (l + A A/A) 


[17.28.2] 


where M/A is the relative increase in flame surface area. 
Hence, the flame front velocity 7 fn after n obstacles is 

7fn = 7 f0 (l + A A/A) n [17.28.3] 

with n in terms of flame front radius, r, and pitch, p : 


n = r/p [17.28.4] 

or, if the flame front velocity 7f 0 entering the obstacles is 
some multiple a of the base value 7l. 

X{r) = <1 + A A/A) [17.28.5] 


where r„ is the radius at the entry to the obstacles. 

Another basic concept is the relation between the flame 
velocity, u, and the overpressure generated, A P. This has 
been derived by several workers in the form APaTpu 2 , 
where p is the density of the unburned vapour. Figure 17.71 
shows a typical plot of this relation. 

17.28.6 Mass of fuel 

The estimation of the mass of fuel within the flammable 
range in the vapour cloud is not entirely straightforward. 
For a defined release scenario the mass of fuel within the 
flammable range may be estimated using gas dispersion 
models. This is discussed in Chapter 15 and has been 
reviewed by a CCPS book (Woodward, 1997). 

Many of the expressions given are based on models for 
neutral density gas. Treatments used on such models have 
been given by Burgess et al. (1975), Eisenberg, Lynch and 
Breeding (1975), VJ. Clancey (1977a), van Buijtinen (1980), 
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Figure 17.69 Histograms showing selected features of a vapour cloud explosion (Wiekema, 1984) (Courtesy of 
Elsevier Science Publishers) 
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Figure 17.70 Variation of overpressure with time in TNT 
equivalent and constant velocity piston models of an 
vapour cloud explosion (after Munday, 1976a): (a) TNT 
equivalent model and (b) constant velocity piston model 
(Courtesy of the Institution of Chemical Engineers) 



Figure 17.71 Overpressure in a vapour cloud deflagra¬ 
tion as a function of flame speed (R.J. Harris and Wickens, 
1989; after Kuhl, 1981) (Courtesy of the Institution of Gas 
Engineers) 


J.G. Marshall (1977,1980), Hesse (1991) and theTNO Yellow 
Book (1997). 

Generally, dense gas dispersion models will be more 
appropriate. The typical dense model is a box or slab model 
in which the gas cloud is defined in terms of its radius and 
height. For an instantaneous release box model the gas 
concentration within the cloud is assumed to be uniform. In 


such a model the available mass of fuel remains constant, 
until at some time the concentration falls below the lower 
flammability limit. Or for a continuous release a slab model 
takes the variation of concentration with distance into 
account so that the available mass of fuel changes with 
distance. 

Some problems concerning the definition of the mass of 
fuel have been identified and discussed by R. A. Cox (1981). 
He reviews the merits of basing estimates on the mass 
within the flammable range, or flammable mass, or the 
total mass released. The ratio of the flammable mass to the 
total mass released is likely to be highly variable. It will 
be small for a large inventory escaping through a small 
hole, but may be as high as half for an instantaneous 
burst. In view of this variability the blanket application of a 
single explosion efficiency is not likely to give accurate 
results. 

Cox discusses hut dismisses suggestions that there may 
be lower and upper limits to the size of cloud which can 
explode. He draws attention to the Badische Anilin und 
Soda Fabrik (BASF) work, mentioned above, which shows 
that overpressures can be induced in clouds of 0.5 kg mass. 
As for the suggestion of an upper limit of 50 te, he con¬ 
cludes that there is no real evidence for this either. 

Cox draws attention to the fact that where the release is a 
turbulent jet there may be entrainment into the jet of fuel 
from outside the flammable envelope. In the absence of 
such entrainment the mass in the cloud is often quite mod¬ 
est, hut it can be appreciably enhanced by entrainment. 

Various authors have developed procedures for the 
determination of the size of the vapour cloud, generally for 
design purposes and frequently for use with a TNT equi¬ 
valent model. Some of these are described in Chapter 15. 

17.28.7 Energy of explosion 

The energy of explosion in a VCE is usually only a small 
fraction of the energy available as calculated from the heat 
of combustion. This point has already been discussed in 
Section 17.4. As stated there, the explosion efficiency, or 
yield factor, may be quoted on the basis of the total mass 
released or of the flammable mass. Although the latter is 
the more fundamental basis, the former is the more con¬ 
venient and the more common. 

Values of the yield factor in VCEs discussed by Kletz 
were quoted in Section 17.27.5. 

The Second Report of the ACMH (Harvey, 1979b) dis¬ 
cusses the location and design of works buildings, and in 
this context suggests that a yield factor of 3% be provi¬ 
sionally assumed. In some cases a much higher yield factor 
has been reported. Davenport gives a yield factor of 
25—50% for a VCE at Decatur, Illinois, in 1974. Similarly, 
Gugan (1979) quotes for this case a yield factor of 32-65%. 
This anomaly has been examined by V.C. Marshall (1980d), 
who concludes that the TNT equivalent quoted is not well 
founded, being based on a small number of damage points 
which lie well within the scatter of points obtained for the 
Flixborough explosion. He presents evidence of damage 
to support the view that the strength of the explosion at 
Decatur was not more, and was probably less, than that at 
Flixborough. 

The yield factor is discussed further in Section 17.28.14. 

17.28.8 TNT equivalent model 

The TNT equivalent model has been widely used to 
model VCEs. The TNT equivalent model has been widely 
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applied to VCEs, as described by van den Berg (1985). It is 
one of the types of model used in the CCPS methodology. It 
also has its critics, who regard it as obsolete. An example of 
this viewpoint is the account by Pasman and Wagner 
(1986). 

An early application was that of Brasie and Simpson 
(1968), who used it to study the damage from three acci¬ 
dental explosions. 

The TNT equivalent model was also used by Sadee, 
Samuels and O’Brien in their investigation of the VCE at 
Flixborough. In this case a two-parameter model was used, 
utilizing the height of the explosion as well as the mass of 
TNT. This work is described in Appendix 2. 

There are, however, important features of a VCE which 
differentiate it from one of TNT. These include (1) the large 
volume of the cloud, (2) the lower overpressure at the 
explosion centre, (3) the different initial shape of the 
blast wave, and (4) the longer duration time of the blast 

A discussion of these characteristics has been given by 
Baxen and Baker (1991) and in the Second Report of the 
ACMH (Harvey, 1979b). The report gives the following 
estimate for the size of the vapour cloud in the Flixborough 
explosion: 

Flixborough 0.5 x 10 6 m 3 

St Paul’s Cathedral (internal volume) 0.2 x 10 6 m 3 

The overpressure at the explosion centre of a vapour cloud 
is much less than at that of a TNT explosion. The report 
suggests that a theoretical upper limit might be calculated 
related to the pressure which would be achieved if the 
equivalent mass of TNT after detonation were confined 
within particular boundaries under adiabatic conditions. 
For a TNT explosion the boundaries would be those of the 
TNT charge and the pressure developed would be about 
0.5 million bar. For a VCE the boundaries would be those of 
the cloud and the pressure developed would be about 8 bar. 
In both cases the practical upper limit of overpressure 
would be some fraction of the theoretical maximum value, 
particularly for a vapour cloud. The report suggests that on 
the basis of the rather meagre data available the prac¬ 
tical upper limit is probably about 1 bar at the centre and 
about 0.7 bar at the boundary of the cloud. 

The overpressure at the explosion centre at Flixborough 
may have been about these values, as discussed in 
Appendix 2. 

In a VCE the shape of the initial blast wave is different 
from that in aTNTexplosion. But it is frequently assumed 
that after the blast wave has travelled a certain distance it 
becomes indistinguishable in form from the wave of a TNT 
explosion. In other words, it assumes the shape shown in 
Figure 17.57. 

The shape of the overpressure profile according to the 
TNT equivalent model and to some possible models of 
VCEs is shown in Figure 17.72. 

The apparent TNT equivalence of a VCE changes with 
distance. In the far field the quantity of TNT required to 
obtain a fit for the overpressure tends to be appreciably 
higher than in the near field. 

The blast wave from aVCE also differs from that of aTNT 
explosion in duration time. The duration time of a VCE is 
generally considered to be appreciably longer than that of 
the equivalent TNTexplosion. 



Figure 17.72 Overpressures given by the TNT equiva¬ 
lent model and by some possible models of vapour cloud 
explosion (V.C. Marshall, 1976c) (Courtesy of the 
American Institute of Chemical Engineers) 


Thus, TNT gives a ‘hard’ explosion with high over¬ 
pressure and short duration time, whilst a vapour cloud 
gives a ‘soft’ explosion with low overpressure and long 
duration time. The lower overpressure reduces the rela¬ 
tive destructiveness but the longer duration time 
increases it. 

There is, however, little information on the duration 
time for VCEs. This is a serious deficiency, because a 
knowledge of duration time is needed for the design of 
works buildings. 

The Second Report of the ACMH suggests, in the con¬ 
text of the design of works buildings and in conjunction 
with the assumed overpressure of 1 bar at the cloud cen¬ 
tre, that a duration time of 30 ms be provisionally 
assumed. 


17.28.9 TNT equivalent models: influencing factors and 
special features 

Some of the variousTNTequivalent models developed tend 
to emphasize a particular influence on or feature of VCEs. 
These include (1) the reactivity of the fuel, (2) the effect of 
cloud size, (3) the effect of obstructions, (4) the variation of 
TNT equivalence with distance, and (5) the peak over¬ 
pressure at the edge of the cloud. The treatments of these 
factors are of value quite apart from their use in the par¬ 
ticular models. 
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For the reactivity of the fuel, the FMRC (1990) has 
developed the following classification, based on the work 
of D.J. Lewis (1980d): 


Brasie and Simpson also gave a graph and a table of 
damage vs peak overpressure, and made proposals for 
damage estimation. 


Class 


TNT equivalence 
(%) 

I 

Relatively unreactive materials 
(e.g. propane, butane and 
ordinary flammable materials) 

5 

II 

Moderately reactive materials 
(e.g. ethylene, diethyl ether, 
acrolein) 

10 

III 

Highly reactive materials 
(e.g. acetylene) 

15 


In the method given by Prugh (1987a) the effect of cloud 
size is taken into account by making the yield of the explo¬ 
sion a function of the mass of fuel in the cloud. 

Two different approaches to the effect of obstructions are 
used in the methods of Exxon (n.d.) and R.J. Harris and 
Wickens (1989). In the Exxon method a distinction is made 
between a cloud in the open and one in partially obstructed 
terrain. In that of Harris and Wickens the mass participat¬ 
ing in the explosion is limited to that in the part of the cloud 
in the obstructed area. 

The variation of TNTequivalence with distance is taken 
into account by Prugh (1987a) by the use of a virtual dis¬ 
tance method in which the virtual distance is a function of 
the mass of fuel involved in the explosion. The effective 
distance is then the sum of the virtual distance correction 
and the actual distance; by this expedient he obtains a 
single curve to fit the far field overpressures and approxi¬ 
mate those in the near field. 

The concept of virtual distance is also utilized by 
R.J. Harris and Wickens (1989), but in this case to obtain a 
match for the peak overpressure at the edge of the cloud. 

All these approaches have something to offer, but there 
does not appear to be any single method which incorporates 
them all. 

17.28.10 TNT equivalent models: Brasie and Simpson 
model 

The basic TNT equivalent model was stated in a classic 
paper by Brasie and Simpson (1968). Their expression for 
theTNTequivalent is now generally written in the form 


Wtnt 


WAH C 

£tnt 


[17.28.6] 


where E ? NT is the energy of explosion of TNT (kj/kg), A H c is 
the heat of combustion of the hydrocarbon (kj/kg), JVis the 
mass of hydrocarbon (kg), W TNT is the equivalent mass of 
TNT (kg) and a is the yield factor. 

Brasie and Simpson noted that the values quoted for the 
energy of explosion of TNT varied between 1800 BTU/lb 
(4190 kj/kg) and 2000 BTU/lb (4650 kj/ kg), and adopted 
the latter. 

From analysis of three VCE incidents they obtained 
values of the yield factor of 0.03-0.04, and on this basis 
proposed for use tentative values, intended to be con¬ 
servative, of 0.02 in the near field and 0.05 in the far 
field, taken as that where the peak overpressure is 1 psi 
or less. 


17.28.11 TNT equivalent models: ACMH model 

The Second Report of the ACMH (Harvey, 1979b) discusses 
the problem of VCEs. In particular, it gives an equation 
for the cloud size, a suggested value for the explosion effi¬ 
ciency and an overpressure curve based on the TNT 
equivalent model.This information taken as awhole maybe 
regarded as a form of model. 

The relation for cloud size was quoted as equation 
15.46.47, and the suggested value of the yield was given as 
0.03, as described in Section 17.27.7. The curve for peak 
overpressure is reproduced in Figure 17.73. The curve uti¬ 
lizes a damage classification based on bomb damage to 
dwelling houses in the Second World War. The classes given 
in the report as most relevant are: 


Damage 

classification 

Damage 

A 

Almost complete demolition 

B 

So severe as to necessitate demolition 

Cb 

House uninhabitable but not totally 


irreparable 


is damage’ is expressed: 


i the percentage of windows 


17.28.12 TNT equivalent models: Harris and Wickens 

The experimental work of R.J. Harris and Wickens (1989) 
has been described in Section 17.28.3. These authors also 
present a model of the TNT equivalent type. In the Harris 
and Wickens model, the mass of gas participating in the 
VCE is restricted to the confined and congested part of the 
plant, and that in the unconfined part of the cloud is 
neglected. The yield on this more limited mass is taken as 
0.20. The energy of explosion of TNT is taken as 4.6 MJ/kg 
and the heat of combustion of the hydrocarbon as 46 MJ/kg, 
a difference of a factor of 10. Then, from the relation 


M TN t = 


M gas £ gas 


the authors obtain 


[17.28.7] 


MrNT = 2/Wg as 


[17.28.8] 


where E gas is the heat of combustion of the hydrocarbon 
(MJ/kg), TStmt is the energy of explosion of TNT (MJ/kg), 
M gas is the mass of gas (in the confined/congested region) 
(te), M TN t is the mass of TNT (te) and a is the yield 
factor. Equation (17.28.8) is obtained from Equation 17.28.7 
with E gas /TTtnt = 10 and a = 0.20. Then, taking for the 
density for the hydrocarbon-air mixture a low value of 
0.08 kg/m 3 (normal densities at 20 C are around 1.3 kg/m 3 ), 
yields from Equation 17.28.8 


M T nt = 16x10- 5 F [17.28.9] 

where V is the volume of gas (in the confined/congested 
region) (m 3 ). 

The blast correlation used is that of the ACMH as given 
in Figure 17.73 (TNTcurve). 
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Figure 17.73 Peak side-on overpressure for a vapour cloud explosion: ACMH correlation (Harvey, 1979b) (Reproduced 
by permission of HM Stationery Office. Copyright. All rights reserved) 


As already described, these authors obtained for the 
peak overpressure at the edge of the vapour cloud a value 
of 4 bar, rather than the value of 1 bar proposed by 
the ACMH. They take this finding into account by deter¬ 
mining the scaled distance for an overpressure of 4 bar on 
the ACMH graph, which is 16 (m/te 1/3 ) and proposing the 
use of an effective scaled distance of 


17.28.13 TNT equivalent models: other models 

In addition to those just described, several other TNT 
equivalent models for VCEs have been developed, pub¬ 
lished or unpublished. They include those of Exxon (n.d.), 
Eichler and Napadensky (1977), Prugh (1987a), the FMRC 
(1990) and IRI (1990). These are reviewed by the CCPS 
(1994/15). 

As already indicated, such models tend to differ in the 
methods used for (1) the mass of vapour participating in the 
explosion and (2) the yield factor of the explosion. Other 
differences relate to (3) the value used for the energy of 
explosion of TNT and (4) the correlation used for the peak 
overpressure of TNT. 
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Several of these models include a procedure for estimat¬ 
ing the mass of flammable vapour which participates in the 
explosion. This aspect of the models is considered in 
Chapter 15. 

The other main distinguishing feature of the models is in 
the estimation of the yield factor. This is considered in the 
next section. 

The CCPS states that values used for the explosion 
energy of TNT lie in the range 4140—4650 kj/kg, the same 
as that considered by Brasie and Simpson. 

The blast correlations used in the models are given in 
Section 17.28.15. 

The methods described are coherent procedures con¬ 
sidered by their authors to give reasonable results. It is not 
appropriate to abstract particular features and use them 
indiscriminately. Each model is a‘package deal’. 

It should also be borne in mind that models are developed 
for different purposes. The majority are essentially guides 
to the plant designer, particularly in relation to plant layout 
and control room design. Care should be exercised in 
applying such a model to hazard assessment or incident 
investigation. 

17.28.14 TNT equivalent models: yield factor 

The values used in the models mentioned for the yield 


Method 

Scenario 1 comment 

Yield factor 

Brasie and 

Near field 

0.02 

Simpson 

Far field 

0.05 

ACMH 


0.03 

Exxon 

Open terrain 

0.03 


Partially confined 

0.10 

Eichler and 

and obstructed terrain 

0.02-0.40 

Napadensky 

Prugh 

Mass of vapour 

0.02 


cloud = 100 kg 

Mass of vapour 

0.70 

Harris and 

cloud = 10 6 kg 

Mass in obstructed 

0.20 

Wickens 

region only 


FMRC 

Relative non-reactive 

0.05 


material 

Moderately reactive 

0.10 


material 

Highly reactive 

0.15 

IRI 

material 

0.02 


The model of Eichler and Napadensky is for safe separation 
distances between nuclear power plants and transport 
routes and refers to the far field (peak overpressure 1 psi 
(0.07 bar)) and is evidently conservative. The higher of the 
two values given by Prugh refers to a very large cloud. 

17.28.15 TNT equivalent models: blast correlation 

The graphical correlations used for the peak overpressure 
from a TNT explosion are principally the following: 
Glasstone (1962) (Brasie and Simpson) and Glasstone and 
Dolan (1980) (IRI); V.C. Marshall (1976c) (ACMH); ACMH 
(Harris and Wickens); Kingery and Panill surface bursts 


(1964) (Exxon); and the US Army, Navy and Air Force 
(1990) (the Tri-Service Manual) (FMRC). 

The ACMH correlation is based on that of VC. Marshall 
(1976c). This has been reproduced in the literature with 
different scaled distances. In the ACMH graph the mass 
used in the scaled distance is in tonnes, in the graph given 
by the CCPS (1994/15) the mass is explicitly stated to be in 
kilograms. 

17.28.16 TNT equivalent models: yield ratio 

For completeness in the treatment of the TNT equivalent 
model, it is convenient to deal at this point with the ques¬ 
tion of the yield ratio, or symmetry factor. 

As explained earlier, if a free-air burst correlation is used 
for the blast parameters, but the application is to a ground 
burst, an appropriate yield ratio is applied to the actual 
energy of explosion, or equivalent mass of TNT, to obtain 
an effective energy, or mass, for use in calculation of the 
scaled distance. 

The simple, and conservative, approach is to take this 
yield ratio as 2. 

The value of the yield ratio is discussed by the CCPS 
(1994/15). It suggests that the value of the yield ratio will 
generally lie in the range 1.7—2. The lower value may be 
preferred if the epicentre of the explosion is slightly above 
the ground. 

17.28.17 Taylor model 

An early model of a VCE was given in a classic paper by G.I. 
Taylor (1946). He considers small pressure disturbances, as 
in acoustics, so that the system equations can be linearized. 
The treatment which he describes is in terms of an expand¬ 
ing piston for which from the conservation equations in 
spherical geometry he obtains the wave equation 



with the velocity potential 4> such that 



[17.28.12] 

[17.28.13] 


where a B is the speed of sound, p is the absolute pressure, 
p„ is the ambient pressure, r is the radial distance, t is the 
time, u is the velocity, p a is the density of the ambient gas 
and (j) is the velocity potential. The term (p -p a ) is thus the 
overpressure. 

The boundary condition used is such that the velocity of 
the medium is equal to that of the piston. From this Taylor 
obtains the velocity potential as 


<P 


M% ( r-aptf 
r 


[17.28.14] 


and hence 

P mi5] 


[17.28.16] 
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where M p is the Mach number of the piston, p is the dimen¬ 
sionless overpressure and y is the ratio of the specific heats. 

Equating the mass within the piston flow field and that 
within the flame flow field yields the following relation 
between the piston and flame Mach numbers: 

Mp = Mf [17.28.17] 

where Mf is the flame Mach number and a is the expansion 
ratio. 

17.28.18 Strehlow model 

The VCE model given by Strehlow (1981) also follows the 
acoustic approach, but utilizes a constant velocity piston. 

It was shown by Stokes (1849) that a source of mass with 
mass flow m(t) generates a sound wave in three dimensions 
which has an overpressure that is proportional to the mass 
addition acceleration m(t). Lighthill (1978) gave this con¬ 
cept the specific formulation 


Then, for spherical geometry, utilizing in Equation 
17.28.23 the relations for the area, radius and velocity of 
the flame front 

Af = A%r\ [17.28.24] 

[17.28.25] 

S b = S a |^ [17.28.26] 

and the definition of q, applying the constant velocity flame 
relation 

r { = Stf [17.28.27] 

and substituting for t the term (f - r/a 0 ), yields 

'*■“ 2y t 1 ~ @ © 2 (r - 0 [17 ' 2a28] 


[17.28.18] 


where a a is the velocity of sound, p is the absolute over¬ 
pressure, p 0 is the ambient pressure and r is the character¬ 
istic radius of the source region. Here, m(t) is replaced by 
m(t-r/a 0 ) because the wave is propagating away from the 
source at the velocity of sound. 

Then, for deflagrative combustion the effective rate of 
volume addition v(t) is related to that of mass addition m(t ): 


m(t)=p 0 V(t) 


[17.28.19] 


where p a is the initial density of the gas. 

The acceleration of volume addition can be expressed in 
terms of the rate of change of the flame surface. Hence 


mf) = ypo ©[ 17 . 28 . 20 ] 


whereof is the effective frontal area of the flame, S u is the 
burning velocity, V h is the specific volume of the burned 
gas and V u the specific volume of the unburned gas. 

Then, from the expression for the velocity of sound in an 
ideal gas a\ = p 0 /p 0 and from Equations 17.28.18 and 
17.28.20 


q dM/il-l/V 
Awra^} dt 


[17.28.21] 




where M su is the Mach number in the unburned gas. 

The relation between this model and that of Taylor at low 
flame speeds may be demonstrated as follows. Using 
Taylor’s relation between the flame and piston Mach num¬ 
bers, Equation 17.28.17, and the relations 

a=V h /V u [17.28.29] 


[17.28.30] 


where Uf is the velocity of the flame front. If M p <C 1 or for 
low values of the flame Mach number M { , the denominator 
in Equation 17.28.15 is approximately unity and Equation 
17.28.28 is equivalent to Equation 17.28.15. 

Equation (17.28.23) is a general relation which may be 
applied to vapour clouds of different geometries. The dif¬ 
ferent cases may be examined by substituting different 
expressions forylf and hence dA f /dt. For spherical geo¬ 
metry utilizing forAf Equation 17.28.24 gives 


2 psinv h 

p= ^Tv n ’ 


[17.28.31] 


Using alternative expressions for the flame area A t and the 
rate of change of the flame radius dr f /df, Strehlow obtains 
expressions for the overpressure in explosions of vapour 
clouds of other geometries and other points of ignition. 
These include an ellipsoid, a cigar-shaped cloud with end 
point ignition and pancake clouds with centre and with 
edge ignition. Thus, for a pancake cloud 


Vh - V , 

9 = 1 [17.28.22] 

where p is the dimensionless overpressure, q is the dimen¬ 
sionless rate of energy addition and y is the ratio of specific 
heats. 

Foraconstantvelocityflame,Equationl7.28.21 reduces to 


P = 


9 o dA f (Q 
Anraly u dt 


[17.28.23] 


A t = 1% r f H 


[17.28.32] 


where H is the height of the cloud. Then 

p 2a§f obs F u 


[17.28.33] 


where z D b s is the distance of the observer from the centre of 
the cloud. 

Strehlow also obtains an order of magnitude estimate of 
the effect of cloud size. For an overpressure of 0.1 bar at a 
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Table 17.35 Strehlow model for VCE: effect of burning 
velocity and flame area (after Strehlow, 1981) (Courtesy 
of American Institute of Chemical Engineers) 


A dS u /df = 0 

S u (m/s) 

4A f /df(m z /s) 

1 

1.7 x 10 7 

10 

1.7 x 10 6 

100 

1.7 x 10 5 

B dAf/df=0 

A f (m z ) 

dS u /df(m/s 2 ) 

10 2 

1.7 x 10 5 

10 4 

1.7 x 10 3 

10 6 

1.7 


distance 100 m from the cloud centre and with a velocity of 
sound of 350 m/s Equation 17.28.21 reduces to 

A { IF + ^ IF = 1-6 X 1()7m3 / s2 [17.28.34] 

Then, the use of the alternative limiting assumptions d SJ 
df = 0 and cL4f/df=0 allows values of cL4 f /df and dS u /df, 
respectively, to be calculated. Table 17.35 shows the values 
given by Strehlow. The table shows that even for a high 
flame velocity the rate of increase of flame area must also 
be very high to generate even a weak blast wave, while only 
a very large flame area, with a very large acceleration, is 
able to produce a weak blast wave. He concludes that for a 
significant overpressure to be generated by deflagrative 
combustion alone a very large cloud is required. 

Further development of this approach for clouds of dif¬ 
ferent aspect ratios has been described by Raju and 
Strehlow (1984). 


17.28.19 Model of Kuhl, Kamel and Oppenheim 

In another classic paper, Kuhl, Kamel and Oppenheim 
(1973) presented an ‘exact’ similarity solution for the con¬ 
servation equations which they give in the form 


F 6F _Z — - F) 2 + (y — 1)(1 — F)F 

2ZdZ~ 3Z — (1 — E) 2 


[17.28.35] 


Their model is based on a constant velocity piston. The 
leading shock travels ahead of the piston with the flame 
front in between. 

In the form given, the model has to be solved numerically. 

The authors explored the implication of their model for 
flame speeds ranging from 0.5 to 120 m/s. The maximum 
overpressure ratio obtained was 6, with flame speeds of 
5-10 m/s being associated with overpressure ratios of the 
order of 0.05-0.10. They give a set of curves showing the 
strong increase of overpressure with flame speed. 


17.28.20 Williams model 

A number of workers have obtained approximate analytical 
solutions of the constant velocity piston case based on self¬ 
similarity. The model of F.A. Williams (1976), also dis¬ 
cussed by Anthony (1977a), is illustrative of this approach. 

In the model it is assumed that ignition occurs at a point 
source, that the flame front which develops travels out from 
the ‘core’ at a flame speed S and that the pressure waves 
produced by the flame generate a weak shock which travels 
ahead of the flame at a velocity V(t) which varies with time. 
It is also assumed that the pressure and density in the ‘shell’ 
between the flame and shock fronts are constant. 

Then, for spherical symmetry the model equation for 
conservation of momentum across the shock wave is 

)Vt) iim4 ° i 

or in dimensionless form 

p = l+(l-K)^ [17.28.41] 


The other basic equations, also in dimensionless form, are 
for conservation of mass for a sphere of radius R, 

Opr* + ( y3 ~* 3 } = f [17.28.42] 

and for conservation of mass for the burned core, 

3 ^ = ±(8px s /3) [17.28.43] 

The similarity solution is 


Kq0p(p-\) l/2 

(1-K6P) 1/3 (1~K) 1/6 


[17.28.44] 


F dX _ —Z + (1 - F) 2 
XdF~ 3Z— (1 — Ff 


[17.28.36] 


P=Pl/Po 





Z :■ 


s = S/a 0 

[17.28.37] 

x = r/R 0 

[17.28.38] y = R/R 0 


X = - [17.28.39] 

where a is the speed of sound, r is the radial distance, r s is 
the radial distance of the leading shock, u is the particle 
velocity and U B is the velocity of the leading shock. 


K r 0 /n 
fJ a„t/R„ 


[17.28.45a] 

[17.28.45b] 

[17.28.46a] 

[17.28.46b] 

[17.28.47a] 

[17.28.47b] 

[17.28.47c] 
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where a 0 is the speed of sound (= ( pj p 0 ) v6 ).f , i is the absolute 
pressure in region i, r is the flame radius, R is the shock 
radius, R a is the initial value of the shock radius, S is the 
flame speed, t is the time, T, is the absolute temperature in 
region i, is the gas density in region i and x is the 
dimensionless time.The subscripts o, 1,2 of p, Tand p refer, 
respectively, to conditions in the undisturbed gas, the 
shocked gas (shell) and the burnt gas (core). The variables 
K, 9 and p are time dependent. 

The model yields a number of interesting results. One is 
that from Equation 17.28.40 the shock wave pressure has a 
well-defined upper limit. Another is that for transition to 
detonation the flame speed must be an appreciable fraction 
of the speed of sound: 

s>(K/3)[(p-l)(l-K)] 1/2 [17.28.48] 

17.28.21 Other similarity models 

The model just described is one a number of approximate 
analytical models. 

A review of this work is given by the CCPS (1994/15), 
which presents for some of the models a set of graphs of 
the flow field parameters, in each of which the curves of 
particular workers are compared with those of the ‘exact’ 
solution. 


and alternative relations derived by the author, provide the 
value of the term p c t in Equation 17.28.49 and allow esti¬ 
mates to be made of the pressure profile. 

The author compares the relation which he derives for 
the pressure profile from a VCE with that from a condensed 
phase explosion. These relations indicate that for the same 
energies and distances, the amplitude of the shock wave 
from a condensed phase explosion exceeds that from aVCE 
by one or two orders of magnitude. Yet the shock waves 
from VCEs are very destructive. He concludes that this is 
due to the longer duration time of the positive phase in 
VCEs and suggests that the factor of 2, which is sometimes 
given for the ratio of the duration time in a VCE to that in a 
condensed phase explosion, is probably an underestimate. 
Gugan defines an explosion efficiency 77: 

r, = E e /Ea [17.28.51] 

where E e is the explosive energy release and E u is the 
vapour cloud energy release. For the latter 

Ea = mAH c [17.28.52] 

where A H c is the heat of combustion and m is the mass of 
fuel in the cloud. He obtains for the explosion efficiency 
expressions of the general form 


17.28.22 Gugan model 

In his review of VCEs, Gugan (1979) includes a model based 
on self-similarity which he uses to examine the character¬ 
istics of such explosions.This model is not in the mainstream 
of VCE models, but constitutes an interesting approach, 
particularly to behaviour in the near field. 

The blast wave from a VCE is inherently unstable, and at 
a point quite close to the centre of the explosion it trans¬ 
forms into a shock wave. Beyond this transformation point, 
in the far field, no distinction can be made between a con¬ 
densed phase explosion and a VCE on the basis of the shock 
wave. But between the explosion centre and the transfor¬ 
mation point, in the near field, some interesting features 
emerge. 

Gugan uses the following relation for the pressure 
profile: 

i«~[l + cosQ], 0<r < at [17.28.49] 

where a is the velocity of sound in the normal atmosphere, p 
is the pressure, p c is the pressure at the centre of the 
explosion, r is the distance from the centre of the blast 
symmetry and t is the time. The term p c t is therefore the 
pressure at the centre of the explosion. The form of curve 
given by this equation is the ‘companion to the cycloid’. 

Utilizing the relations for the energy E contained in the 
compressed gases E = fV dp and for the relation between 
the pressure/) and the volume Ffor an isentropic expansion 
fVdp = y fV dp (where y is the ratio of the gas specific 
heats) together with Equation 17.28.49, Gugan obtains for 
the pressure at the centre of the explosion 


kt 


.IS 

fti ?(atof 


[17.28.50] 


where E„ is the total energy release and t a is the time of 
termination of the rapid energy release. Equation 17.28.50, 


f{m-,AH c -M\e;v) 

W) 


[17.28.53] 


where M is the molecular weight of the vapour, n is the 
stoichiometric ratio and v is the flame speed. 

The expression for the explosion efficiency shows the 
efficiency as a function of various characteristics of the 
fuel. In the near field it falls off rapidly with distance R, 
being inversely proportional to f? 3 . 

This model proved controversial and was criticized by 
Ale and Bruning (1980). One feature is the decay of effi¬ 
ciency, which did not appear to sit well with the effects of 
actual explosions. A review has been given by H. Phillips 
(1981b). 


17.28.23 Baker-Strehlow model 

Strehlow, Luckritz and co-workers conducted numerical 
studies, using the CLOUD code, exploring for spherical 
geometry the characteristics of flames travelling at con¬ 
stant velocity and with acceleration (Luckritz, 1977; 
Strehlow et al., 1979) and obtained relationships for the 
blast wave parameters. This work was extended by 
W.E. Baker et al. (1983) to yield the Baker-Strehlow method 
for VCEs. 

The scaled peak overpressure and the scaled impulse 
given by this method are shown in Figures 17.74 and 
Figure 17.75, respectively. The scaled variables are given by 
Equations 17.26.7-17.26.9. The graphs are for spherical 
symmetry 

Figures 17.74 utilizes two Mach numbers, M w , which 
relates to fixed coordinates, and Af su , which is relative to the 
gases moving ahead of the flame front. The relationship 
between these two Mach numbers is discussed by Strehlow 
et al. (1979). At high Mach numbers M su -+M w . The solid 
lines in the figure represent numerical calculations, and the 
broken lines extensions of Taylor’s model to the very low 
Mach number range. Also shown in the figure are curves 
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Figure 17.74 Scaled peak side-on overpressure for a 
vapour cloud explosion (Strehlow et al., 1979). Curves and 
Mach numbers are explained in the text (Courtesy of the 
Combustion Institute) 


the unburnt gas is assumed to be added by a hemispherical 
piston, this process effectively replacing the combustion 
process. This energy E„ is 


=r>> 

}17.28.54a] 

*Po( Vl-Vo) 

jl7.28.54b] 

= mR g T\ — n 0 R g T 0 

[17.28.54c] 


jl7.28.54d] 


where E 0 is the total energy of the explosion (J), n is the 
number of moles, p is the absolute pressure (Pa), R s is the 
universal gas constant (J/mol K), T is the absolute tem¬ 
perature (K), Fis the volume (m 3 ) and the subscripts o and 1 
denote initial and final conditions, respectively. But 

E„ -rcRjfe [17.28.55] 

where E c is the energy of combustion per unit volume 
(J/m 3 ) and R 0 is the radius of the initial cloud (m). 

A characteristic explosion length L is defined as 

[17.28.56a] 

= ' [17.28.56b] 

where L is the characteristic length (m), and a parameter 
X as 

Imh {17.28.57] 


for pentolite, for a bursting sphere and for detonation (CJ 
curve). 

The method requires values of the energy of explosion 
and the flame speed. The explosion energy may be deter¬ 
mined using one of the methods described in Sec¬ 
tion 17.28.14 in relation to the TNT equivalent model. The 
flame speed is estimated by considering the effect of the 
combination of factors known to influence it: the reactivity 
of the fuel, the strength of the ignition source and the 
degree of confinement and congestion. 


where fb is the time (s) at which the expansion process is 
incomplete. A reduced distance R, reduced overpressure 
P, reduced time t and reduced duration time T are then 
defined as follows: 

= | P7.28.58] 

P^ p ~ p " P7.28.59] 


17.28.24 Wiekema model (TNO shock wave model) 

Three models of VCE have been developed by TNO. The 
first of these is the shock wave model described in the 
Yellow Book and by Wiekema (1980). The model is also 
known as the expanding piston or piston blast model. It 
allows the peak overpressure and the duration time of the 
explosion to be estimated. 

The model is a composite one derived from separate 
models for deflagration and detonation in the cloud. Con¬ 
sidering first the model for deflagration, it has been shown 
by Strehlow, Savage and Vance (1973) that given the 
pressure-time prof ile it is possible to derive the energy of an 
explosion. Wiekema uses this result, inverting it to obtain 
the pressure-time profile from an arbitrary energy release. 

The cloud is assumed to be a hemisphere of unburnt gas 
volume V D which expands during the combustion process to 
a hemisphere volume Fl. In this process the energy added to 


[17.28.60] 

% 


L + ° [17.28.61] 

where c 0 is the local velocity of sound (m/s), R is the dis¬ 
tance (m) and t + is the duration time (s). 

The reduced overpressure is taken as inversely propor¬ 
tional to the reduced distance: 

[17.28.62a] 

[17.28.62b] 
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Figure 17.75 Scaled side-on impulse fora vapour cloud explosion (Strehlow et al., 1979) (Courtesy of the 
Combustion Institute) 


where A is a constant. From shock wave theory 


«-S 

[17.28.63a] 

= < 1+ TT ? ) 

[17.28.63b] 

where t/ sw is the velocity of the shock v 
ratio of specific heats for air. Taking y = 

rave (m/s) and y the 
= 1.4, 

df ^ ( 7 J 

[17.28.64a] 

A 3AL\ 

H 1+ wj 

[17.28.64b] 


The duration time is determined as the difference between 
the arrival times of the shock wave and the sound wave and 
at the radius of the burnt cloud it is 

H) p 7 - 28 - 6 ^ 


where Vf\ is the average flame speed (m/s). 

The velocities of the shock wave and sound wave in the 
cloud and beyond are shown in Figure 17.76. 

Integrating Equation 17.28.64b gives 


— Inf 

-o V 


1 + 7R/3AL\ 

1 +• 7R\12ALJ ’ 


R>Ri 

[17.28.66] 
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Figure 17.76 TNO shock wave model for vapour cloud 
explosions: propagation of flame front and sound wave 
(Wiekema, 1980) (Courtesy of Elsevier Science 
Publishers) 


At the cloud boundary (R=R0, Equation 17.28.66 
reduces to Equation 17.28.65. The reduced duration time 
is then 


T 


Ri 

L 


+ | 4 H 


'1 + 7R/3AL\ 
v l + 


R>R! 

Itl7.28.67a] 


In evaluating Equation 17.28.67 use is made of the relation 


Hence, from Equation 17.28.67a: 

7, = 0.4567 
%= 0.456 x 418 
= 191m 


From Equation 17.28.58 

£ = 500/418 
m 1.2 

From Equation 17.28.62, taking the value of A correspond¬ 
ing to the average flame speed vn of 80 m/s, 

£ = 6x10“ 2 /1-2 
* 0.05 


Hence, from Equation 17.28.59 the peak overpressure 
(p -p 0 ) for an initial pressure p 0 of 10 5 Pa (1 bar) is 

p-p Q = 0.05 x 10 s Pa = 0.05 bar 


And from Equation 17.28.67a 

-f (7 x 1.2)/(3 x 6 x IQ" 2 ) > 


x In | 
= 1.45 


(n 


+ (7 x 0.456)/(3 x 6 x 1(H) J 


R 1 /L = 0.456 [17.28.67b] 

derived from the definitions given in the work. 

The following numerical values are assumed in the work: 



E c = 3.5 x 10 6 J/m 3 

The energy added per unit volume, which is the energy 
available for shock wave formation, is 6 x 10 s and is thus 
some 17% of the available combustion energy, assuming a 
stoichiometric mixture. The velocity of sound c 0 in air may 
be taken as 330 m/s. 

The method involves selecting an assumed flame speed. 
The set of flame speeds vr quoted are 40, 80 and 160 m/s, 
and the corresponding values of the parameter A are 
2 x 10 _z , 6 x 10 -2 and 15 x 10~ 2 , respectively. 

_ Thexeduced overpressure P and reduced duration time 
T are both functions of the reduced distance P, as shown in 
Figure 17.77. 

As an illustration of the method, consider the estimation 
of the peak overpressure and duration time at a distance P 
of 500 m for a VCE in a hemispherical cloud of initial radius 
R 0 of 100 m assuming an average flame speed of 80 m/s. 
Then, from Equation 17.28.56b 




Hence, from Equation 17.28.61 
4 = 1.45 x 418/330 
= 1.83 s 


The model just described is applicable to a deflagration. For 
the case of detonation in a vapour cloud Wiekema utilizes 
results obtained by Kogarko, Adushkin and Lyamin (1966), 
from which he obtains the following relations for the 
reduced overpressure and reduced duration time: 

P - • 0.518R ! / , 0.29 <J?<1.088 [17.28.68a] 

fcO.2177^- 1 , £>1.088 [17.28.68b] 

T = 0.1853/? 1/2 , 0.36 < £ < 12.6 [17.28.69a] 

4=0.20 +0.0933 ln(l + 10.7£), £>12.6 [17.28.69b] 

Since in the detonation work no results are given for T 
for R > 12.6, Equation 17.28.69b is based on the deflagra¬ 
tion work. 

Wiekema then consolidates these two models, for defla¬ 
gration and detonation in a vapour cloud, into a single VCE 
model. The reduced overpressure P and reduced duration 
time T are shown as functions of the reduced distance R in 
Figure 17.78. 

The lines shown in Figure 17.78 are the boundaries of 
materials of low, medium and high reactivity. Reactivity is 
essentially sensitivity to flame acceleration. For each class 
the lower boundary is used unless there is reason to expect 
a relatively high flame acceleration. 
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L = (~ir Rl f)''\ with E c = 3.5 10 6 J/m 3 




Figure 17.77 TNO shock wave model for vapour cloud explosions - peak overpressure and duration of the blast 
wave, as a function of flame speed (Wiekema, 1980): (a) scaled peak overpressure and (b) scaled duration time 
(Courtesy of Elsevier Science Publishers) 


The reduced overpressure P is again inversely propor¬ 
tional to the reduced distance R, except at the upper 
boundary for high reactivity materials. Wiekema states 
that methane is considered as a fuel of low reactivity, 
ethane and butane as fuels of medium reactivity and 
hydrogen, ethylene oxide and acetylene as fuels of high 
reactivity. 


17.28.25 TNO correlation model 

The second TNO VCE model is the correlation model; this 
too is described in the Yellow Book. The model allows an 
estimate to be made of the radius of defined damage circles. 
It does not give explosion parameters such peak over¬ 
pressure or duration time. 

The model is based on a correlation for VCE incidents of 
damage effects outside the gas cloud. 

The correlation is based on the energy content E of the 
part of the cloud within the explosive range. This energy is 

E = M e AH c [17.28.70] 

where E is the energy content of the part of the cloud within 
the flammable range (J), M e is the mass of fuel in the cloud 
within the flammable range (kg) and AH C is the heat of 
combustion (J/kg). 

If the energy content is<5xl0 9 , corresponding to 
approximately 100 kg of hydrocarbon, the cloud is so small 
that no serious damage would be anticipated, while if 


E> 5 x 10 12 the cloud is so large that no data are available 
on which to base a correlation. The model is applicable only 
to clouds with an energy content within those bounds. 

The energy actually released is only a fraction »/ of the 
energy content £. This fraction, or efficiency, is the product 
of two separate efficiencies: 

n = %?b. [17.28.71] 

where rj c is a yield factor which takes account of the fact 
that the flammable part of the cloud is not a stoichiometric 
mixture and »/ m is another yield factor which gives the 
mechanical energy yield of the combustion. The factor >/ m is 
given different values, depending on whether combustion 
is at constant pressure or constant volume: 

Constant pressure combustion t/ m = 0.18 
Constant volume combustion f/ m = 0.33 
Since combustion of a VCE tends to be associated with a 
degree of confinement, the constant volume value of r/ m 
(= 0.33) is recommended. The relation for the radius of the 
damage circles is 

R(S) = C(S)(riE) 1/3 [17.28.72] 

where C(S) is a constant which is a function of the degree 
of damage S (m/J 1/3 ), E is the energy content (J), R(S) is 
the radius of the damage circle (m) and r] is the explosion 
efficiency. 









17/164 EXPLOSION 



Figure 17.78 TNO shock wave model for vapour cloud 
explosions - peak overpressure and duration of the blast 
wave, as a function of fuel reactivity (Wiekema, 1980): (a) 
scaled peak overpressure and (b) scaled duration time 
(Courtesy of Elsevier Science Publishers) 

The values of the constant C(S) are as follows: 


Damage 

C(S) (m/J 1/3 ) 

Heavy damage to buildings and to 

0.03 

processing equipment 

Repairable damage to buildings 

0.06 

and facade damage to dwellings 

Glass damage causing injury 

0.15 

Glass damage (»10% of panes) 

0.4 


17.28.26 van den Berg model (TNO multienergy model) 

The third TNO VCE model is the ME model described by 
van den Berg (1985). This model allows the peak over¬ 
pressure, peak dynamic pressure and duration time to be 
estimated. 

The starting point for this model is recognition of the 
role of partial confinement in VCEs. It is assumed in the 


model that the explosion in those parts of the cloud which 
are confined is of much higher strength than in those where 
it is unconfined. The method involves estimating the com¬ 
bustion energy available in the various parts of the cloud 
and assigning to each part an initial strength. 

This initial strength is denoted by a number in the range 
1-10, where 1 applies to an explosion of insignificant 
strength and 10 to a detonation. Confined parts of the cloud 
are usually assigned a strength greater than 6 or 7. 

The peak overpressure, peak dynamic pressure and 
duration time are estimated using Figure 17.79. For a given 
part of the cloud the energy of explosion in that part is 
determined, an initial strength is estimated and the blast 
parameters are then calculated. 

The simplest case is that of a cloud with a single high 
strength source of reasonable size. The situation is more 
complex if this high strength source is small or if there are 
multiple high strength sources. Some judgement is 
required, therefore, in applying the method. 

van den Berg gives as an illustration of the method the 
estimation of the peak overpressure and duration time of 
the VCE at Flixborough. 

17.28.27 Numerical modelling 

An alternative approach to the modelling of VCEs is the use 
of computational fluid dynamics (CFD) codes. An account 
of their application is given by the CCPS (1994/15). 

The CFD modelling of VCEs is not entirely straightfor¬ 
ward. There is a difficulty due to discontinuities, both 
contact discontinuity between the burned and unburned 
gases and shock discontinuity. For a blast flow field con¬ 
ventional numerical methods tend to yield inaccurate 
results. 

In order to overcome these problems researchers have 
resorted to two devices. One is the use of artificial viscosity 
and the other the use of flux-corrected transport (FCT).The 
former was introduced by von Neumann and Richtmyer 
(1950) and the latter is described by Boris (1976) and Boris 
and Book (1976). 

Both Eulerian and Langrangean formulations are used. 
The difference between these in their application to gas 
dispersion is touched on in Chapter 15 and discussed in 
standard texts (e.g. Meteorological Office, 1972). 

Many workers have used the artificial viscosity method 
with the gas dynamics in Lagrangean form. They include 
Fishburn (1976), van den Berg (1984) and vanWingerden 
(1984 CEC EUR 9541EN/II). 

The use of artificial viscosity tends, however, to intro¬ 
duce some inaccuracy. Other workers have therefore used 
the FCT method with Eulerian gas dynamics. Amongst 
these are van den Berg (1980), with the BLAST code, and 
Guirao, Bach and Lee (1979) and H. Phillips (1980). 

This work on numerical simulation of VCEs has pro¬ 
duced a number of significant results. One concerns the 
fraction of the heat of combustion which is converted into 
blast energy, or mechanical work done on the surrounding 
gas/air, in other words, the yield factor of the explosion. In 
the work of Fishburn (1976) this fraction was found to be 
38%. Guiraio, Bach and Lee (1979) performed a study in 
which they compared a volumetric fuel—air explosion and 
a fuel-air detonation, and confirmed the finding of 
Oppenheim etal. (1977) that the difference in the fraction of 
energy converted to blast is small. 

Strehlow et al. (1979) made an extensive numerical study 
of the properties of a blast wave for constant velocity 
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Combustion energy-scaled distance ( R ) 


Figure 17.79 TNO multienergy model for vapour cloud explosions (van den Berg, 1980): (a) peak overpressure; 

(b) dynamic pressure; and (c) duration. C 0 , ambient velocity of sound; E, combustion energy; P d , dynamic pressure; P 0 , 
ambient pressure; R 0 , fuel-air charge radius; t + , duration time; P d , P d /P d ; A P s , A P s /P 0 ; R, R(P 0 /E) 1/3 . t + , t+C 0 (P 0 /E) 1/3 
(Courtesy of Elsevier Science Publishers) 


flames over a wide range of flame speeds in spherical 
symmetry. They found that the calculated blast effects from 
the simulation, using as the constant flame speed the 
highest value observed, did not exceed the observed blast 
effects. This work was the basis of the Baker-Strehlow 
model, as already described. 


The basic approach in this work has been to treat com¬ 
bustion as a fixed addition of energy at the particular flame 
speed. This does less than justice to the interaction of flow, 
combustion and turbulence and the associated positive 
feedback which occurs. The work of Hjertager (1982) 
advanced the art with a more fundamental treatment of 
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transient compressible turbulent flow with reaction. It has 
given rise to two major CFD codes, FLACS and EXSIM. 

An illustrative example of the use of the EXSIM code is 
given in Appendix F of the CCPS Fire and Explosion Model 
Guidelines (1994/15). The problem considered is combus¬ 
tion of a vapour cloud released amongst items of equipment 
on a plant in the open. The results include pressure vs time 
and flame speed vs distance profiles and contours of gas 
concentration, overpressure and wind velocity broadly 
similar to those shown in Plate 28. 

Other codes include REAGAS, described by van den 
Berg (1989), Auto REAGAS, described by van den Berg 
(1995) and CLICHE, described by Catlin (1990). 

17.28.28 Hydrogen explosions 

Vapour clouds of hydrogen are somewhat unusual and need 
separate treatment. An account of hydrogen VCEs has been 
given by Bulkley and Jacobs (1966). 

These authors describe a number of incidents in which 
hydrogen-air explosions have occurred. Of particular 
importance is an explosion which took place during the 
intentional release of hydrogen from Los Alamos Scientific 
Laboratory at Jackass Flats, Nevada, in 1964 and which has 
been described by Reider, Otway and Knight (1965). The 
incident was recorded by high speed photography. The 
discharge rate had been at a peak of 430,000 lb/h but had 
been cut back to 125,000 lb/h when spontaneous ignition 
occurred. The resulting explosion was estimated to have 
caused a pressure wave of 0.5 psi at buildings less than 
200 ft way. From the photographs it was estimated that the 
cloud of hydrogen-air mixture which took part in the 
explosion was 30 ft in diameter and 150 ft high and con¬ 
tained 200 lb of hydrogen and that the flame speed reached 
100 ft/s. The flame speed was thus considerably above the 
normal burning velocity but had not reached detonation 
velocity. 

On the assumption that one-fifth of the heat released is 
converted to blast energy, Bulkley and Jacobs calculate that 
1 lb of hydrogen can give a blast effect equivalent to 5 lb of 
TNT, provided detonation occurs. 

They state, however, that if a detonation does not 
occur, then the results from the Jackass Flats incident indi¬ 
cate that the distances for a particular blast intensity calcu¬ 
lated using thisTNTequivalent are overestimated by a factor 
of about 4. 

Hydrogen is frequently vented to the atmosphere. 
Bulkley and Jacobs present results of calculations on the 
flow rates which might give rise to 10 lb of hydrogen in the 
flammable range. They estimate that the detonation of 10 lb 
of hydrogen could cause severe structural damage at about 
150 ft and moderate structural damage at about 300 ft. 
Assuming that the exit velocity is of the order of 1000 ft/s, 
calculations for free jets indicate that the inventory of 
hydrogen in the flammable range would be equivalent to 
2-8 s of flow and that therefore the hydrogen flow should 
not exceed 4000-18,000 lb/h if excessive damage is to be 
avoided. The account of the Jackass Flats explosion by 
Reider, Otway and Knight mentions that the hydrogen is 
normally flared off if the release flow exceeds 3600 lb/h. 

Emergency releases of hydrogen-rich streams of 
50,000-150,000 lb/h are not uncommon. 

Many releases are not pure hydrogen, but also contain 
hydrocarbons. The addition of hydrocarbons narrows the 
flammable range and reduces the burning velocity. It may 
also increase the volume of flammable mixture necessary 


for detonation. On the other hand, it also increases the 
molecular weight, which means that the jet maintains its 
integrity longer, so that the volume of flammable mixture is 
greater, and it increases the energy per unit volume. The 
overall result is uncertain, but Bulkley and Jacobs suggest 
that it is prudent to assume that a hydrogen-rich stream has 
the same hazard potential as one of pure hydrogen. 

The authors discuss hydrogen venting, and suggest that 
emergency venting flows be reviewed and that if high vent 
flows may occur they should either be released directly to 
the atmosphere via multiple vents or should be flared. 

Other incidents described include two disasters with 
hydrogen-filled dirigible airships. These are the disaster of 
the R-38 at Hull in 1921, in which there was an explosion, 
and that of the LZ-19, the Hindenbttrg, at Lakehurst, New 
Jersey, in 1937, in which the hydrogen burned with no over¬ 
pressure. The fatalities in these two accidents were 44 and 
36, respectively. 

A method of estimating the peak overpressure from 
hydrogen explosionshasbeengivenbyHawksley(1986LPB 
68). The method is applicable to a typical, relatively small 
release. The two scenarios considered are a j et and a buoyant 
plume. The mass of fuel in the vapour cloud is determined 
using modifications of the equations given by J.G. Marshall 
(1980). The peak overpressure is then obtained from the 
TNTequivalent model using an explosion yield of 4%. 

Hydrogen explosions are also discussed by VC. Marshall 
(1987), who deals particularly with hydrogen-filled air¬ 
ships. He gives data showing the ultimate fate of some 129 
airships. Of these, 41 (33.5 %) caught fire or were set on fire 
by enemy action, 20 (15%) in flight and 21 (16%) in their 
sheds, whilst three (2.5%) exploded in flight. 

17.28.29 Methane and LNG combustion 

Large quantities of methane are handled as LNG, and the 
behaviour of methane and LNG vapour clouds is therefore 
of particular interest. 

There is now considerable evidence that vapour clouds of 
methane at normal temperatures burn, but do not readily 
explode. Many experiments have been done in which 
attempts have been made to initiate explosions in methane 
clouds, but in which no explosion occurred. 

The occurrence of VCEs involving methane has been 
reviewed by V.C. Marshall (1987). He cites expert opinion to 
the effect that there has been no case of an unconfined VCE 
with natural gas, but also the account given by Gugan 
(1979) of an explosion involving methane at Raunheim.West 
Germany, in 1966. 

It may be noted that in the First Canvey Report (HSE, 
1978b) it was conservatively assumed that a vapour cloud 
of LNG might explode. 

17.28.30 Explosion yield limit 

As already stated, in VCE work the fraction of the energy of 
combustion which is converted to blast energy is frequently 
expressed as aTNTequivalent. 

The generally quoted limit for this fraction is about 40 %. 
This is the value given, for example, by the CCPS (1994/15), 
which also refers to numerical simulation work in which the 
highest fraction obtained was 38%, as described above. 

In his work on VCEs, Gugan (1979) gave equations and 
listed incidents for which the TNT equivalent was cited as 
above 50%. Ale and Bruning (1980) took issue with this 
on the basis that it violated the law of thermodynamics 
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governing the conversion of energy into mechanical work. 
The matter was further considered by H. Phillips (1981b). 

The difficulty appears to lie in the use of the TNT 
equivalent. In an investigation of an explosion incident the 
equivalent mass of TNT is obtained by examining the 
damage effects. It does not follow, however, that for a given 
level of damage the explosion energies in a TNTexplosion 
and aVCE are the same. A TNT explosion involves a very 
high drop in overpressure in the near field and a shorter 
impulse. In other words, the energy released in a TNT 
explosion may be less effective in causing damage than that 
inaVCE. 

Further, there are uncertainties in the peak overpressure 
for aTNTexplosion and in the correlation of damage effect 
with peak overpressure. Phillips states that differences in 
blast correlations can introduce a factor of as much as an 
order of magnitude. 

AVCE may therefore have an apparent TNT equivalent 
greater than 40 % even if the actual fraction of the energy of 
combustion converted to blast energy does not exceed that 

17.28.31 CCPS method 

The CCPS Fire and Explosion Guidelines (1994/15) include a 
set of methods for VCEs. BothTNTequivalent and fuel—air 
models are given. For the TNT equivalent method use is 
made of Equation 17.28.6. The sample problem utilizes an 
energy of explosion of TNTof 4650 kj/kg and ayield of 0.03. 
The fuel—air models used are the Baker—Strehlow model, 
the Wiekema expanding piston model and the van den Berg 
ME model. 

The Guidelines give two sample problems, one a hazard 
assessment of a VCE at a storage site and the other an 
assessment of the overpressure at Flixhorough. To each of 
these they apply both theTNTequivalent model and the ME 
model. 

17.28.32 Plant design 

The VCE hazard may be mitigated by plant design. Two 
aspects which have been considered particularly are lim¬ 
itation of the size of potential releases and the layout of 
plant to deal with the effects of any explosion. 

For some plants handling flammable liquids the avoid¬ 
ance of large-bore pipes which could, if ruptured, give a 
large release has been a specific design objective. 

In plant layout, suitable separation distances may be 
used to decrease the likelihood of unacceptable damage, 
while buildings such as control rooms which may be affected 
can be suitably designed. The effect of a possible VCE in a 
works may be explored by assuming the explosion of 
vapour clouds of different sizes and degrees of drift and 
constructing diagrams showing the areas affected by blast, 
or ‘petal diagrams’. A petal diagram given by Kletz (1977J) 
is shown in Figure 17.80. Guidelines on plant layout for VCE 
hazard are given in Chapter 10. 

17.29 Boiling Liquid Expanding Vapour Explosions 

Another of the most serious hazards in the process indus¬ 
tries is the BLEVE. Generally, this occurs when a pressure 
vessel containing a flammable liquid is exposed to fire so 
that the metal loses strength and ruptures. 

Accounts of BLEVEs have been given by Kletz (1977J), 
Reid (1979), A.F. Roberts (1981/82, 1982), Manas (1984), 
Pietersen (1985), Skandia International (1985), Blything 


and Reeves (1988 SRD R488), Selway (1988 SRD 
R492), D.M. Johnson and Pritchard (1991) and the CCPS 
(1994/15). 

When a vessel containing liquid under pressure is 
exposed to fire, the liquid heats up and the vapour pressure 
rises, increasing the pressure in the vessel. When this 
pressure reaches the set pressure of the pressure relief 
valve, the valve operates. The liquid level in the vessel falls 
as the vapour is released to the atmosphere. The liquid is 
effective in cooling that part of the vessel wall which is in 
contact with it, but the vapour is not. The proportion of the 
vessel wall which has the benefit of liquid cooling falls as 
the liquid vaporizes. After a time, metal which is not cooled 
by liquid becomes exposed to the fire; the metal becomes 
hot and weakens and may then rupture. This can occur 
even though the pressure relief valve is operating correctly. 
A pressure vessel is designed to withstand the relief valve 
set pressure, but only at the design temperature conditions. 
If the metal has its temperature raised, it may lose strength 
sufficiently to rupture. 

Most BLEVEs involve a pressure storage vessel, rail tank 
car or road tanker containing a flammable liquid, typically a 
liquefied flammable gas, which becomes exposed to a fire or 
flame, and in due course ruptures, often giving a fireball. 
Another common situation which gives rise to a BLEVE is a 
derailment. The development of the BLEVE is illustrated in 
Figure 17.81. Apressure reliefvalve on one tank car operates, 
the release ignites and the flame plays on another tank car. 
The liquid in this vessel heats up, the pressure rises and 
the relief valve operates, the release being ignited by the 
flame play ing on the vessel. For a time the metal of this vessel 
is kept cool by liquid in contact with it, but the level falls 
as the liquid is vaporized, metal cooled only by vapour 
is exposed, becomes hot, weakens and ruptures. A large 
fraction of the flammable liquefied gas released, vaporizes 
and forms a burning vapour cloud, often a fireball. 

A BLEVE of a vessel containing a flammable liquid gives 
rise to the following effects: (1) blast wave, (2) fragments, 
and (3) fireball. 

Following Flixborough much attention was focused on 
VCEs. It was pointed out by Kletz (1977J) that BLEVEs can 
cause as many casualties as VCEs and that by comparison 
they were being relatively neglected. This view has been 
amply justified by the subsequent record. 

Selected references on BLEVEs are given in Table 17.36. 

17.29.1 BLEVE incidents 

Compilations of BLEVE incidents are less numerous and 
comprehensive than those for VCEs. The principal lists are 
those of Pietersen (1985), Skandia International (1985) and 
Selway (1988 SRD R492). Incident data are also available 
from the MHIDAS databank of the SRD. 

Some principal BLEVE incidents are given in Table 17.37. 
Other incidents are listed in Table A1.2. 

The BLEVE at Feyzin on 1966 has received particular 
attention (Case History A38). In this incident an operator 
draining water from the bottom of a propane sphere 
lost control. A vapour cloud formed, ignited and flashed 
back to the vessel. The pressure in the vessel rose and 
the relief valve lifted, but the metal of the vessel lost 
strength and some 90 min after ignition the vessel burst. 
The death toll was 18. Plate 32 shows one of the fire 
engulfed spheres. 

A remarkably similar event took place at the Duque de 
Caxais refinery at Rio de Janeiro in 1972 (Case History A61). 
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Figure 17.80 Petal diagram showing areas affected by possible vapour cloud explosions (Kletz, 1977J) (Courtesy of the 
Institution of Chemical Engineers) 


Again an operator lost control of a draining operation on an 
LPG sphere, a vapour cloud formed, ignited and flashed 
back to the sphere, engulfing it in fire, so that after about 
15-20 min it suffered a BLEVE. 

In these incidents the release at, and BLEVE of, the ves¬ 
sel was the initial event. There have also been instances 
where a release from one storage vessel has led to a fire 
which has caused BLEVE of an adjacent one. Such was the 
case at Montreal, Quebec, in 1957, when overfilling of a 
butane sphere caused a release which led to a pool fire (Case 
History A25). 

In 1978 at Texas City, Texas, overfilling of an LPG sphere 
led to a fire which caused the BLEVE of an adjacent sphere. 

In other cases BLEVEs have occurred due to engulfment 
in a vapour cloud fire. Such a fire occurred at Port Newark, 
New Jersey, in 1951 and led to the destruction of over 
70 bullet tanks, many by BLEVE (Case History A19). 

Engulfment in a vapour cloud fire was also the cause of 
destruction, largely by BLEVE, of four storage spheres and 
48 cylindrical vessels holding LPG at Mexico City, Mexico, 


in 1984. Some 500 people were killed. This incident, shown 
in Plate 35, is described in Appendix 4. 

BLEVEs also occur in transport, typically when flam¬ 
mable material is released and ignited following an acci¬ 
dent, so that a transport tank becomes engulfed in fire. 
They have occurred particularly on rail tank cars, often 
when a jet flame from the relief valve on one tank has 
played on another. 

A derailment of nine rail tank cars at Crescent City, 
Illinois, in 1970 caused a release of propane which led to a 
fire and caused a succession of tank car BLEVEs (Case 
History A50). 

The BLEVEs were accompanied by large fireballs and 
missiles, including rocketing tanks. One of the fireballs is 
shown in Plate 33. 

Other rail tank car BLEVEs include those at Laurel, 
Mississippi, in 1969 (Case HistoryA44), Houston,Texas, in 
1971 (Case History A53), Kingman, Arizona, in 1973 (Case 
History A63), Oneonta, New York, and West St. Paul, 
Minnesota, in 1974, Des Moines, Iowa, in 1975, Belt, 
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Jet flame on 



Figure 17.81 A BLEVE event 


Table 17.36 Selected references on boiling liquid 
expanding vapour explosions (BLEVEs) 


CEC (n.d./l); Exxon (n.d.); C. Andersen and Morris (1974); 
Hess, Hoffman and Stoeckel (1974); M.R. Johnson et al. 
(1974); Kletz (1977d, 1981n); Maurer et al. (1977); Buivid and 
Sussman (1978); Walls (1978,1979); R.C. Reid (1979,1980); 
A.F. Roberts (1981/82,1982); Considine, Grint and Holden 
(1982); Crawley (1982); Pantony and Smith (1982); Blything 
(1983 SRD R263,1986); A.F. Roberts, Cutler and Billinge 
(1983); Solberg and Borgnes (1983); Manas (1984); 
Martinsen (1984); Tune and Venart (1984/85a,b); D.L.M. 
Hunt and Ramskill (1985); D.J. Lewis (1985); Pietersen 
(1985,1986a,b); Skandia (1985); Johannson (1986); 
Martinsen et al. (1986); Pitblado (1986a); McDevitt, 
Steward and Venart (1987); Skarka (1987); Blything and 
Reeves (1988 SRD R488); Holden (1988 SRD R477); 

Nazario (1988); Selway (1988 SRD R492); J.B. Moss (1989); 
Lemoff (1989); Johnson et al. (1990); McDevitt et al. (1990); 
Venart (1990a); D.M. Johnson and Pritchard (1991); 

Pineau etal. (1991); Prugh (1991); Stilly and Crowther 
(1992); Melham, Croce and Abraham (1993); Venart et al. 
(1993); Birk and Cunningham (1994); Martinsen and 
Marx (1999) 


Montana, in 1976 and Livingston, Louisiana, in 1982 (Case 
History A103). Road tank car BLEVEs include those at 
Lynchburg, Virginia, in 1972 (Case History A59) and Los 
Angeles, California, in 1979. 

17.29.2 The BLEVE event 

An account oftheoriginofthe term ‘BLEVE’ is given by the 
CCPS (1994/15), which states that the term was introduced 
by workers at the FMRC. An early account of the phenom¬ 
enon was that of Walls (1979) at the National Fire Protection 
Agency (NFPA). A review of events which can lead to a 
BLEVE has been given by Prugh (1991), who gives the term 
a fairly wide interpretation and lists the following: (1) fire 
exposure, (2) mechanical damage, (3) overfilling, (4) run¬ 
away reaction, (5) overheating, (6) vapour space explosion, 
and (8) mechanical failure. 

The essential features of a BLEVE are that (1) the vessel 
fails, (2) the failure results in flash-off of vapour from the 
superheated liquid, and, if the liquid is flammable, (3) the 
vapour ignites and forms a fireball. 

The accompanying effects are (1) blast, (2) fragments, 
and, for flammable liquids, (3) a fireball. 

The BLEVE creates an overpressure. The phenomena 
associated with this are (1) the expansion of the vapour, 
(2) the flash vaporization of the liquid, and, for flammable 
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Table 17.37 Some BLEVE incidents 


Date Location Material Plant/transport involved Deaths/ Fireball 

injuries - 

Quantity Radius 
released (m) 

(te) 


A BLEVE incidents 


1951 

Port Newark, NJ 

LPG 

Storage cylinder (70 on site) 

14i 


1955 

Ludwigshafen, FRG 


Rail tank car 

2i 



Cottage Grove, OR 

LPG 

Storage vessel 

12d, 12i 


1958 

Celle, FRG 


Rail tank car 



1957 

Montreal, Quebec 

Butane 

Storage sphere 

Id 


1959 

McKittrick, CA 

LPG 

Storage cylinder (six on site) 

2i 


1966 

Feyzin, France 

LPG 

Storage sphere (eight on site) 

18d, 81i 


1968 

Dunreith, IN 

Ethylene oxide 

Rail tank car 

5i 


1969 

Laurel, MS 

LPG 

Rail tank car (derailment, 15 cars) 

2d, 976i(?) 


1970 

Crescent City, IL 

Propane 

Rail tank car (derailment, nine cars) 

66i 75 

75-100 

1971 

Houston, TX 

VCM 

Rail tank car (derailment, 18 cars) 

Id, 50i 165 

150 

1972 

Lynchburg,VA 

Propane 

Road tanker 

2d, 5i 9 

60 


Rio de Janeiro, Brazil 

LPG 

Storage spheres (five on site) and 

37d, 53i 





cylinders 



1973 

Kingman, AZ 

Propane 

Rail tank car 

13d, 95i 45 

150 

1974 

Bielefeld, FRG 


Rail tank car (derailment, 36 cars) 




Oneonta, NY 

LPG 

Rail tank car 

25i 



West St. Paul, MN 

LPG 

Storage vessel 

4d 10 

50 

1975 

Des Moines, IA 

LPG 

Rail tank car 

3i 


1976 

Belt, MN 

LPG 

Rail tank car 

22i 80 

150 

1977 

Dallas,TX 

Isobutane 

Rail tank car 

li 


1978 

Texas CityTX 

LPG(?) 

Storage vessel 

7d, lOi 



WaverlyTN 

Propane 

Rail tank car 

16d, 43i 


1979 

Paxton, TX 

Chemicals 

Rail tank car 

8i 



Los Angeles, CA 

Gasoline 

Road tanker 

2d, 2i 


1982 

Livingston, LA 

Flammables 

Rail tank car 

Od, Oi 


1984 

Romeoville, IL 

Propane 

Process vessel 

15d, 22i 


1985 

Mexico City, Mexico 

LPG 

Storage spheres and cylinders 

«650d, ~6400i 



B Fireball incidents 


1956 

Amarillo,TX 

Oil 

Storage tank 

20d, 32i 



1974 

Aberdeen, UK 

Butane 

Road tanker 


2 

35 

1975 

Eagle Pass,TX 

LPG 

Road tanker 

17d, 34i 



1976 

Gadsden, AL 

Petrol 

Tank farm 

4d, 28i 



1977 

Goldona.VA 

LPG 

Rail tank car 

2d, 9i 

70 

160 

1978 

Donnellson, IA 

LPG 

Pipeline 

2d, 2i (?) 

435 

305 


Lewisville, AR 

VCM 

Rail tank car 

2i 

110 

155 


liquids, (3) the combustion of the vapour. These events are 
not completely simultaneous, but have been measured as 
separate effects. 

A BLEVE usually generates missiles. These may be 
fragments created by the rupture event and also the body of 
the vessel itself. The pressure at the instant of burst is high 
and the reaction force is often large enough to cause the 
main part of the vessel to rocket. 

A BLEVE resulting from the fire engulfment of a 
vessel containing a flammable liquid also gives rise to a 
fireball. 

Although most BLEVEs of interest here involve a liquid 
which is flammable, this is not a necessary feature of a 
BLEVE. The rupture of a vessel containing superheated 
water can constitute a BLEVE. Likewise, although engulf¬ 
ment in fire is the common cause of BLEVE, it too is not a 


necessary feature. Any rupture of a vessel containing a 
superheated liquid may be termed a BLEVE. 

It is possible, therefore, though not common, for a 
BLEVE event not caused by an engulfing fire to provide 
the source for a large vapour release, leading to a flash 
fire orVCE. 

17.29.3 Experimental studies 

As described in Chapter 16, there have been a number of 
experimental studies of fireballs. The BLEVE event as a 
whole has not been so well served. 

C. Anderson et al. (1975) describe work at the Association 
of American Railroads (AAR) on fire engulfment of a 
125 m 3 rail tank car which suffered a BLEVE. 

Experimental work on BLEVEs has been described by 
Hardee and Lee (1975), who did tests involving 420 kg of 
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propane and modelled the processes of bursting and mix¬ 
ing with air. 

Tests on vessel bursts directed to the same end are given 
by Maurer etal. (1977), but these authors also report meas¬ 
urements of the overpressure associated with the burst, as 
described in Chapter 15. 

Work in the same series is that described by Giesbrecht 
et al. (1980), who used 450 kg of propylene and modelled the 
bursting, mixing and combustion processes. 

Work at the Bundesansalt fur Materialpriifung (BAM) on 
fire engulfed vessels containing liquid propane, described 
by Schulz-Forberg (1984), Droste and Schoen (1988) and 
Schoen, Probst and Droste (1989), involved tests on 4.84 m 3 
tanks with generation of fireball and fragments. 

Further larger scale experiments have been performed at 
British Gas by D.M. Johnson and Pritchard (1991). Their 
base case was a 5.66 m 3 vessel containing 2 te of butane at a 
pressure of 15 barg. They performed five tests, with the 
base case and with the following four variations: (1) lower 
mass, (2) lower pressure, (3) different vapour/liquid ratio, 
and (4) using propane. Vessel failure was effected by 
explosive charges and ignition was by propane lances. 

The purpose of this BG work was to investigate the 
overpressure and thermal radiation. With regard to over¬ 
pressure, the authors state that the vapour expansion and 
flash vaporization tended to merge. The overpressure from 
vapour expansion agreed well with predictions for over¬ 
pressure from a bursting vessel. The overpressure from 
flash vaporization was substantially less than that pre¬ 
dicted, apparently because the liquid temperature was 
below that required to give homogeneous nucleation, or 
superheat limit. 

The overpressure from the combustion came somewhat 
later and had a much longer duration, of the order of 
100—300 ms. The overpressure trace which the authors 
give shows the maxima of the two overpressure pulses to be 
comparable. These traces show the overpressures meas¬ 
ured at 150 m from the vessels to have been of the order of 
4 mbar. The authors state, however, that the combustion 
overpressure was often greater. 

With regard to the fireball, this showed in some tests an 
appreciable degree of asymmetry. For the mass of fuel in the 
fireball, the authors quote the limit of 35 % theoretical flash 
vaporization above which flash-off of the whole contents is 
often assumed. The theoretical flash in their work was over 
45% and complete flash-off was assumed. This was sup¬ 
ported by the visual records, which showed only small 
amounts of liquid fuel burning on the ground. 

The fireball diameter and duration were broadly as pre¬ 
dicted by models such as that of A.F. Roberts (1981/82). 
Except in one test the height of the centre of the grounded 
fireball was between 0.8 and 1.35 times the equivalent 
maximum diameter, which compares with the suggestion 
by Moorhouse and Pritchard (1982) that it be taken as the 
maximum diameter. 

For the thermal radiation from the fireball, the surface 
emissive power was somewhat higher than the values 
commonly quoted, with peak values up to 500 kW/m 2 and 
the remainder in the range 250—350 kW/m 2 . 

The CCPS (1994/15) describes one of the BAM and one of 
the British Gas tests and states that the liquid temperature 
exceeded the superheat limit in the former but not in the latter. 

Melham, Croce and Abraham (1993) describe a series of 
BLEVE tests carried out by the NFPA in conjunction with 
the production of a successor to its earlier film ‘BLEVE’, 


entitled ‘Bleve Update’. The purpose of the tests was to 
establish a database of experiments and to obtain film of 
BLEVE events. There were six tests, two each with a 
simulated pool fire, an impinging gas jet flame and an 
impinging liquid jet flame. The vessels tested were 1.89 m 3 
propane tanks. In these tests peak overpressures up to 
37 kPa were measured at a distance of 15 m from the tanks. 

17.29.4 Empirical features 

It is also helpful to consider some features of BLEVEs from 
an empirical viewpoint. Those discussed here are (1) the 
time to BLEVE, (2) the mode of rupture, (3) the blast effects, 
(4) the fireball, (5) the missiles, and (6) the release of flam¬ 
mable fluids. Time to BLEVE is treated in the following 
subsection and the other items here. 

With regard to the mode of rupture, cylindrical tanks 
usually rupture longitudinally, though some rupture cir¬ 
cumferentially. The latter particularly tend to take off like 
rockets and may travel long distances. This was true of 
some of the cylindrical tanks at Mexico City. Spheres often 
explode, but in some cases may simply split at the top as 
occurred both at Feyzin and Mexico City. 

The pressure at the instant of rupture must approximate 
to that in the vessel. Generally, therefore, it will be appreci¬ 
ably greater than that at the centre of a VCE, which is com¬ 
monly estimated to have a maximum overpressure of about 
1 bar. Thus, in a BLEVE the overpressure at the vessel at 
the instant of rupture may be an order of magnitude higher 
than that at the centre of a VCE. The blast wave from a 
BLEVE can cause damage. At Feyzin the blast wave caused 
extensive though minor damage in a village 500 m away and 
broke some windows at a distance of 3 km. 

The flammable vapour released forms a fireball. The 
fireball can be large and it can rise to an appreciable height. 
Fireball diameters at Mexico City are estimated from film 
records to have been of the order of 200 or 300 m with a 
duration time of some 20 s. The fireball at Crescent City rose 
to a considerable height, as shown in Figure A1.4 (see 
Appendix 1). 

At Mexico City there was also a fire column which 
resembled a huge flare rather than a fireball and which film 
records show to have lasted 90 s. 

The maximum distances at which injury due to heat 
radiation has been reported are 300 m at Feyzin and 400 m 
at Mexico City, while the maximum distance at which death 
has been reported is 300 m at Kingman. 

Survivals have been reported at distances compar¬ 
able with the estimated radius of the fireball. At Belt the 
reported fireball diameter was 1000 ft. The calculated dia¬ 
meter is 540 ft, based on the 80 te of flammable material 
believed to have been involved, though there is some doubt 
on this quantity. Firemen within 200 ft survived (Kletz 
1981n). Further details of survival at this distance and of 
fireballs are given by Crawley (1982). 

BLEVEs tend to generate massive missiles, including 
the main part of the vessel. Missiles from BLEVEs are 
considered in more detail in Section 17.34, but a brief men¬ 
tion is made here. At Feyzin the sphere BLEVE generated 
five large fragments, of which three each had a mass of over 
100 te and were thrown distances of 150-350 m. One piece 
knocked over another sphere which itself in due course 
underwent a BLEVE. 

The BLEVEs which occurred in the vapour cloud fires at 
Port Newark in 1951,Texas City in 1978 and Mexico City in 
1984 all generated large missiles. At Port Newark one large 
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tank section about 17 m long was hurled over half a mile 
and demolished a petrol filling station. At Mexico City the 
spheres generated 25 major fragments which travelled 
100-590 m, whilst one bullet tank was propelled 1200 m. 
This latter appears to be the maximum distance travelled 
by a BLEVE missile. 

The liquid in the vessel does not necessarily vaporize 
completely. At Tewkesbury Massachusetts, in 1972 some 
35% of the propane flashed off, the remaining liquid being 
scattered in all directions. 

BLEVEs do not generally give rise to VCEs. But they may 
scatter flammable liquid spray which gives a spray fire and / or 
falls on people and property, rendering them more flammable 
and liable to ignition. Hot missiles may also cause fires. 

17.29.5 Time to BLEVE 

The time between the occurrence of an engulfing or torch 
fire and BLEVE is of significance not just for the general 
characterization of BLEVEs but for the design of fire sys¬ 
tems to protect against them and for fire fighting. 

For the sphere at Feyzin in 1966 the time between ignition of 
the leak and vessel rupture was about an hour and a half.This 
time to BLEVE is much longer than in most other incidents. 

More commonly, for storage vessels the time to BLEVE 
has been of the order of 5-30 min. A period of 3—10 min 
was observed for some vessels at Montreal, McKittrick and 
Mexico City. A time of some 30 min was observed for other 
vessels at these three incidents. 

Hazard assessments of storage vessels in respect of 
BLEVE have been made by Bly thing and Reeves (1988 SRD 
R488) and Selway (1988 SRD R492). Blything and Reeves 
studied a horizontal cylindrical storage vessel holding 
butane, with a nominal capacity of 100 te and actually 
holding 85 te, being thus 75% full. They considered sce¬ 
narios involving (1) partial fire engulfment and (2) jet flame 
impingement, and obtained time to BLEVE estimates of 
between 4 and 48 min. 

Selway describes an equivalent study for a 2000 m 3 stor¬ 
age sphere containing some 1000 te of LPG when full. For 
scenarios of total fire engulfment, partial fire engulfment 
and jet flame impingement he obtained times to BLEVE of 
7-11, 25-38 and 5.5-7 min, respectively. These times are 
a function of the degree of fill. Avessel which is empty has a 
much shorter time, whereas the difference in times between 
a vessel which is half full and one which is full is small. 
Thus, for example, for the partial engulfment case, the 
times to BLEVE given for the states virtually empty, half 
full and full are 25,36 and 38 min, respectively 

Times to BLEVE for tanks in transport accidents, par¬ 
ticularly rail tank cars, have also been mainly in the range 
5-30 min. 

17.29.6 Vessel burst pressure 

The explosion energy released in BLEVE is a function of 
the initial pressure. 

The various different scenarios for vessel burst pressure 
havebeendiscussedinSectionl7.27,whereadistinctionwas 
made between the following causes: (1) operating over¬ 
pressure, (2) mechanical failure, and (3) fire engulfment. 

17.29.7 Liquid superheat limit 

The energy of the explosion which is part of the BLEVE 
event depends on the conditions in the vessel. In particular, 
under certain conditions, explosive flashing of the super¬ 
heated liquid can occur, giving a large release of energy. 


The explanation of what happens which has received 
most acceptance is the liquid superheat limit theory of Reid 
(1976, 1979, 1980). If a liquid has a sufficient degree of 
superheat and the pressure on it is suddenly removed, 
microscopic vapour bubbles form and a large fraction 
flashes off within milliseconds. 

The degree of superheat necessary for this effect to 
occur is determined by the homogeneous nucleation tem¬ 
perature, or superheat limit temperature. There are a num¬ 
ber of correlations for this, which differ according to the 
equation of state used. Using van der Waals’s equation of 
state, Opshoor (1974) obtained 

T s \ = 0.84 T c [17.29.1] 

whilst using the Redlich—Kwong equation of state Reid 
(1976) obtained 

T sl = 0.895 T c [17.29.2] 

where T c is the critical temperature (K) and T sl the super¬ 
heat limit temperature (K). 

Reid also confirmed that for a wide range of industrial 
substances the coefficient in Equation 17.29.2 lies within 
the range 0.89-0.90. 

Reid studied particularly the superheat limit tempera¬ 
ture of propane, for which the value generally quoted is 
53°C. The values given by Equations 17.29.1 and 17.29.2 are 
38 and 58°C, respectively. 

Data on the liquid superheat limit temperature are given 
by Lide (1994). Where it is necessary to predict it, use is 
generally made of Equation 17.29.2. 

Other mechanisms to explain explosive flashing have 
been suggested. Board et al. (1975) apply the superheat 
limit concept in conjunction with that of atomization of the 
liquid by shock waves at the vapour-liquid interface, 
whilst Venart (1990a) combines the concept with the effect 
of the depressurization-repressurization cycles asso¬ 
ciated with the operation of a pressure relief valve. 

If the degree of superheat is not sufficient to promote 
explosive flashing, the energy release in a BLEVE is that 
due to the pressure energy in the vapour space, which is 
generally an order of magnitude less. 

The superheat limit model of a BLEVE is discussed fur¬ 
ther in Section 17.29.9. 


17.29.8 Modelling of BLEVEs 

There are several different approaches to the modelling of 
BLEVEs. They include (1) the superheated liquid explosion 
model, (2) the cloud formation model, and (3) the bursting 
vessel model. 

The modelling of a BLEVE is closely related to the mod¬ 
elling of a fireball, as described in Chapter 16. 

17.29.9 Superheated liquid explosion model 

The superheated liquid explosion model is that of Reid, 
which has been outlined in Section 17.29.7. Reid suggests 
that this theory may explain the behaviour of the liquid at 
the moment of BLEVE. 

The application of the theory to a BLEVE may be 
explained by considering the specific case of the depres¬ 
surization of a vessel containing propane. The vapour 
pressure and superheat limit lines for propane are given in 
Figure 17.82. The superheat limit is the limit to which pro¬ 
pane may be heated before spontaneous nucleation occurs, 
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Figure 17.82 Vapour pressure and superheat curves for 
propane (R.C. Reid, 1997) (Courtesy of Science) 


giving a vapour explosion. Prior to the accident the propane 
is at an absolute pressure of 8—9 atm and ambient tem¬ 
perature at point A on the graph. In the accident conditions 
the liquid is heated up by the fire on the vessel. The behav¬ 
iour of the liquid then depends on the temperature which it 
has reached when rupture and sudden depressurization 
occur. If depressurization occurs when the temperature is 
that corresponding to point B, the pressure will fall to 
atmospheric pressure at point E. There will be violent 
boiling but no vapour explosion, since the superheat limit 
line has not been reached. If depressurization occurs at 
point C with fall in pressure to point D, the superheat limit 
line is reached at about 3.3 atm, and a vapour explosion 
could occur. The superheat limit temperature at atmos¬ 
pheric pressure is thus a limit below which a superheated 
liquid explosion will not occur. For propane this is 53°C. 

In support of this hypothesis Reid quotes experiments 
by C. Anderson etal. (1974) and Hess, Hoffman and Stoeckel 
(1974) and a number of industrial accidents as being con¬ 
sistent with the hypothesis. 

The theory has implications for prevention of super¬ 
heated liquid explosions under these conditions. Such an 
explosion will not occur if depressurization occurs at a 
pressure corresponding to a temperature below the super¬ 
heat limit temperature. The pressure relief valve may be set 
to operate below this pressure and thus to protect against 
the explosion. Another possible measure is to seed the 
liquid with solid particles to assist nucleation, but experi¬ 
mental work on these lines has not been encouraging. The 
measures described are addressed specifically to the miti¬ 
gation of the problem of superheated liquid explosions and 
will not prevent explosion from other causes such as the 
pressure of the vapour in the vessel. 

17.29.10 Cloud formation models 

Models for vapour cloud formation following depressuri¬ 
zation have been given by Hardee and Lee (1975), Maurer 
et al. (1977) and Giesbrecht et al. (1980) and have been com¬ 
pared by A.F. Roberts (1982). The first model is based on 
conservation of momentum with the momentum created by 
the liquid release appearing explicitly as a function of the 
initial conditions; the second model is based on turbulent 


diffusion and the initial conditions do not appear explicitly 
Both models give similar predictions of cloud growth for 
releases of the order of 100 kg and have been verified 
experimentally at this level, but diverge for larger releases. 
Roberts bases his treatment on the model of Hardee and Lee. 

A model by Martinsen and Marx (1999) makes use 
of experiments by Johnson et al. (1990) to predict time- 
varying cloud development and buoyant lift-off. 

17.29.11 Bursting vessel model 

The overpressure created by a BLEVE is complex, since, as 
discussed above, it is in principle caused by three distinct 
phenomena. 

The aspect where the most progress appears to have 
been made is in estimating the overpressure associated 
with the expansion of the vapour. It is suggested by 
W.E. Baker et al. (1983) that as a first approximation the 
blast wave from a vessel which undergoes BLEVE may be 
estimated by applying to the vapour space in the vessel the 
method, described in Section 17.27, for the bursting of a 
vessel filled with gas. 

This approach appears to give reasonable predictions, as 
now described. 

In order to apply this latter method it is necessary first to 
determine the pressure at which the vessel will burst. The 
following formula is quoted by Selway (1988 SRD R492) as 
that used in the ENGULF code for the burst pressure of a 
sphere: 

P b = 2o y In R ^1 — [17.29.3] 

R = r 0 /n [17.29.4] 

where P b is the burst pressure, r is the vessel radius, R is the 
radius ratio, a u is the ultimate tensile strength, <r y is the 
yield strength and the subscripts i and o denote inner and 
outer, respectively. 

Pietersen (1985) has applied the method of W.E. Baker 
et al. (1983, p. 149), based on the Erode equation, for the 
energy in, and overpressure generated by the bursting of, a 
gas filled vessel to obtain the overpressure caused by 
the vapour expansion phase of a BLEVE, utilizing the 
volume of the vapour space and taking as 40% the fraction 
of the pressure energy which enters the blast wave. He 
obtains the following peak overpressures (bar) for vessels 
with a bursting pressure of 13.4 bar and different vapour 
space volumes: 


Distance (m) 

Vapour space volume (m 3 ) 

20 

100 

800 

1200 

10 

0.44 

1.0 

2.3 

2.6 

50 

0.04 

0.08 

0.23 

0.29 

100 

0.018 

0.033 

0.09 

0.10 

200 

0.0075 

0.012 

0.033 

0.04 


Some experimental confirmation is provided by the finding 
of D.M. Johnson and Pritchard (1991) that the overpressures 
predicted using a model based on that for the bursting of a 
gas filled vessel were in reasonable agreement with those 
measured in their tests for the vapour expansion phase. 
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17.29.12 BLEVE method 

An integrated BLEVE model should comprise models for 
the main effects of (1) blast, (2) fragments, and (3) fireball. 
Treatments covering these aspects are given in 
Sections 17.27 and 17.34 and Chapter 16, respectively. The 
model may also include a model for fire engulfment, which 
is treated in Chapter 16. 

17.29.13 COPS method 

The CCPS Fire and Explosion Model Guidelines (1994/15) 
give a method for the treatment of the various effects of a 
BLEVE. The treatment covers (1) blast, (2) fragments, and 
(3) fireball. 

For the blast the Guidelines method utilizes the CCPS 
vessel burst model, essentially that of W.E. Baker et al. 
(1975), given in Section 17.27. 

The energy of explosion for use in this model is obtained 
by first determining whether the liquid temperature is 
greater than the superheat limit. Then, if the superheat 
limit temperature is not exceeded, use is made of the Erode 
equation, whilst if it is, use is made of the method for 
flashing liquid given in Section 17.4.6. The fraction flashing 
off is taken as the equilibrium value yielded by the isen- 
tropic expansion. 

For the fragments the Guidelines use the CCPS fragments 
model given in Section 17.33. 

For the fireball the Guidelines use the CCPS fireball 
model given in Chapter 16. 

The Guidelines devote a chapter to worked examples of 
BLEVE calculations. These include a problem on a fireball 
from a propane tank truck; problems on blast from a pro¬ 
pane storage vessel, from a propane tank truck and at 
Mexico City and problems on fragments from overpressure 
of a gas filled pressure vessel and from fire engulfment of a 
propane storage vessel. 

17.29.14 Energy release and overpressure 

The foregoing models provide the background for the esti¬ 
mation of the energy release and blast overpressure in a 
BLEVE. The two principal sources of energy are the com¬ 
pressed vapour in the vapour space and the superheated 
liquid as it undergoes flashing. The estimation of the 
energy release from these two sources has been discussed 
in Section 17.4. The superheat limit temperature model 
provides guidance on the extent to which liquid flashing is 
a significant contributor. A further discussion of the ener¬ 
gy release in a BLEVE is given by Prugh (1991). 

Given an estimate of the energy release, the overpressure 
from a BLEVE may be estimated using the methods out¬ 
lined in Section 17.27. 

It has been suggested by Venart et al. (1993) that in certain 
circumstances there may occur an event in which the energy 
release and explosion overpressure are much higher than in a 
regular BLEVE. This is discussed in Section 17.29.15. 

17.29.15 Boiling liquid collapsing bubble explosions 

The interaction between homogeneous nucleation and the 
vessel itself has been further investigated by Venart and 
co-workers (Venart, 1990a; Venart et al., 1993), who have 
developed the concept of the boiling liquid collapsing bub¬ 
ble explosion (BLCBE). 

The BLCBE has three aspects, involving the behaviour 
of (1) the liquid, (2) a crack in the vessel wall, and (3) the 
liquid -vessel system. If the vessel wall in the vapour space 
is subject to heating by a flame, a crack may develop. The 


behaviour of this crack then depends on the degree of fill. If 
the fill is high, the crack may be arrested, still in the vapour 
space section of the wall, by plastic blunting. If the fill is 
lower, there may be sufficient energy in the vapour to cause 
the crack to propagate plastically to the cold metal, where it 
can then propagate elastically without restraint and with 
only minimal energy requirement. 

This second case, with the lower fill, corresponds to the 
regular BLEVE. The first case has the potential for a much 
greater release of physical energy associated with homo¬ 
geneous nucleation. If the fill is high, one of two effects 
may occur: (1) a massive two-phase jet or (2) a violent vessel 
failure with total loss of containment caused by a homo¬ 
geneously nucleated liquid. 

It is this second type of event in a vessel with high fill 
which constitutes a BLCBE. It occurs with a liquid homo¬ 
geneous in temperature and depressurizing. The sequence 
of events is envisaged to be typically as follows. The liquid 
is depressurized, say by operation of the pressure relief 
valve, and due to this becomes nucleated. When the crack 
occurs, there is an almost instantaneous swell of low-void 
liquid which chokes in the crack. There is a rapid repres¬ 
surization of the vessel contents. The resultant liquid shock 
pressures are very high (1-3 kbar). The crack propagates 
elastically through the now cooled wall of the vapour space 
and on to the wall of the liquid space. The vessel fails and 
the highly compressed two-phase contents are again 
depressurized. Expansion of the high pressure vapour 
bubbles shatters the liquid and results in ejection of the 
whole of the superheated liquid as a fine aerosol. If flam¬ 
mable, this aerosol may then be ignited. 

Venart et al. (1993) describe tests in which prenucleated 
R112 and R123 were used and events of the type just 
described were observed, with destruction of the vessel in 
times as short as about 200 ps. They give details of the 
pressure effects in the vessel, including measurement of 
the rapid pressure transient below the liquid in excess of 
the static pressure in the vessel and an estimate of the 
instantaneous overpressure at the crack. The vessel static 
pressure was some 790 kPa (100 psig), the average excess 
pressure 490 kPa (70 psi) and the estimated overpressure at 
the crack itself some 62 bar (900 psig). These authors also 
give estimates of the diameter of the bubbles (1 -3 mm), the 
diameter of the resultant aerosol droplets (100 pm) and the 
evaporation time of the droplets (40 ms). They state that 
there were significant blast overpressures. 

These effects were obtained with a liquid temperature 
more than 50°C below the superheat limit temperature. 

Venart et al. suggest that all three types of event 
described (regular BLEVE, two-phase jet and BLCBE) 
occurred at Mexico City. 

They draw attention to the fact that a BLCBE may be 
caused by a leak, and discuss the implications of this for the 
leak-before-break philosophy. 

17.30 Explosions in Process Plant 

Some of the principal types of explosion which occur on 
process plant have already been described. These are 
(1) explosions in chemical reactors, (2) explosions of high 
pressure gases inside plant, (3) explosions of flammable 
gas-air mixtures inside plant and in buildings, (4) VCEs, 
and (5) BLEVEs. 

In addition, there are certain types of explosion which 
may occur in particular processes, operations or equipment. 
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Some of these have already been mentioned, such as 
explosions in driers, centrifuges and vaporizers, and in 
oxygen and chlorine plants. 

Other explosion hazards include (1) aerosol explosions, (2) 
crankcase explosions, (3) superheated liquid explosions, (4) 
air system explosions, and (5) molten metal-water explo¬ 
sions. These various types of explosion are now discussed. 

17.30.1 Explosions of aerosols 

Under the conditions of an accident, a cloud of finely divi¬ 
ded drops of flammable liquid in air, in the form of a mist or 
spray, may be produced which has many of the character¬ 
istics of a flammable gas—air mixture and which can burn 
or explode. 

The combustion of such aerosols has been discussed in 
Chapter 16, which includes treatment of flame propagation, 
minimum ignition energy and burning velocity. Here, con¬ 
sideration is given to the extent to which combustion of 
such clouds has the propensity to generate overpressure, 
and, more specifically, to undergo detonation. 

As described in Chapter 16, if the droplet size of the cloud 
is sufficiently small, the lower flammability limit, mini¬ 
mum ignition energy and burning velocity are essentially 
the same as those of a vapour—air mixture of the same 
concentration, measured in mass per unit volume. 

The problem of crankcase explosions, described below, 
indicates that confined hydrocarbon mists can undergo 
explosions. 

The detonation of aerosols has been discussed by 
Nettleton (1977b, 1987). The information available is rather 
limited. It has been shown that some aerosols of hydro¬ 
carbons are detonable under confined conditions.The work 
has been done using hydrocarbon-oxygen mixtures and 
there is little on mixtures with air. Information is also 
lacking on detonability limits, as distinct from the flam¬ 
mability limits, which are treated in Chapter 16. 

When detonation occurs in an aerosol the detonation 
waves cause disintegration of the droplets. It is known that 
it is not necessary for the fuel to be present in extremely 
finely divided form for detonation to occur. 

It is known also that with an aerosol the reaction zone is 
wider than in a homogenous mixture with consequent 
effects on peak pressure and duration time. 

A particular type of aerosol explosion is the ‘smoke 
explosion’. An account is given by Croft (1980/81). In this 
case the flammable aerosol cloud is formed by smouldering 
combustion in a confined space such that low volatility, 
flammable aerosol is released. The aerosol cloud is liable to 
ignite suddenly. This type of explosion is therefore a par¬ 
ticular hazard to fire fighters. One such incident occurred 
in a warehouse fire at Chatham dockyard involved smoul¬ 
dering mattresses, and two men were killed. The phenom¬ 
enon is sometimes known as a ‘Chatham mattress’ fire. 


17.30.2 Heavy aerosol explosions 

The work of Burgoyne and co-investigators on the com¬ 
bustion of flammable mists and spray, described in 
Chapter 16, was undertaken in large part in relation to the 
problem of mist explosions in crankcases. This has been 
investigated by Burgoyne, Newitt and Thomas (1954) and 
Burgoyne and Newitt (1955). 

Heavy aerosol explosions are relatively rare, but a 
marine crankcase explosion in 1947, which claimed 28 lives, 
showed that a serious hazard existed and led to the 


initiation of research. Leaks at hydraulic fluids have also 
caused explosions. 

The suspension of oil in air in an engine crankcase dur¬ 
ing normal running is a mechanical spray with some con¬ 
densed mist from the lubricated parts which are at 
temperatures above the average in the crankcase. If there is 
serious overheating, however, condensed mist formation is 
accelerated, a condition often referred to as ‘smoke’. 

Measures which may be taken to avoid a crankcase 
explosion are ventilation to keep the atmosphere below the 
lower flammability limit, or injection of inert gas to sup¬ 
press flammability, and explosion relief. The design of the 
latter requires a knowledge of the burning velocity. 

As described earlier, the work on condensed oil mists 
demonstrated that these have flammability characteristics 
similar to those of the mixture given by the same amount of 
substance wholly in vapour form at the somewhat higher 
temperature necessary for vaporization. The lower flam¬ 
mability limit was 0.049 g/1. Flammability was suppressed 
when the air contained 28.3% of carbon dioxide. 

It is now usual to fit crankcases with explosion relief 
devices. 

17.30.3 Superheated liquid explosions: explosions in plant 

A liquid may become superheated in various ways. It may 
be heated while under hydrostatic pressure or it may be 
heated in aboiling regime which favours superheating.The 
superheat energy may then be released. 

Normally, superheat is released without great violence by 
the generation of nucleated bubbles.This occurs, for exam¬ 
ple, in normal heat transfer to a boiling liquid. 

In some cases the release of vapour is rather more vio¬ 
lent. A layer of water at the bottom of the tank of hot oil, for 
example, may become superheated so that there is a sudden 
evolution of vapour. 

It has been suggested by R. King (1975a-c, 1976a,b, 1977, 
1990) that such an occurrence may have contributed to the 
Flixborough disaster. Atemporary 20 in. pipe was installed 
between reactor Nos. 4 and 6. Reactor No. 4 was fitted with 
an agitator, but this had not been in use for some time. It is 
possible that in the absence of agitation a layer of water may 
have built up in the bottom of the reactor and, on being 
heated up during start-up, may have caused a sudden evo¬ 
lution of vapour sufficient to rupture the pipe assembly. 
During a tank fire, the hydrocarbon layer in the tank can 
conduct heat to a water layer below. When the water layer 
heats above its boiling point, it can suddenly boil and dis¬ 
place hot burning hydrocarbon. 

Another type of superheat explosion can occur when a 
refrigerated liquid hydrocarbon mixture such as LNG is 
poured on to water. This type of explosion is considered in 
Section 17.29.7. 

17.30.4 Air system explosions 

Explosions in compressed air system have been reported 
over the years in coal mines and, more recently, in the pro¬ 
cess industries also. An explosion in a compressed air line 
in Germany in 1963 killed 19 people. 

Accounts of the explosion hazard in compressed air 
systems have been given by Mallow (1964a,b), Fowle (1973) 
and Burgoyne and Craven (1973). 

Characteristically, a compressed air system explosion 
occurs on the air line from a reciprocating compressor with 
oil lubricated cylinders. Often the compressor has a record 
of faulty operation and high outlet temperature prior to the 
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explosion. Carbonaceous residues are frequently found 
just downstream of the compressor outlet. 

Explosions in compressed air systems are essentially oil 
mist explosions. The thickness of the oil film capable of 
giving a flammable mist is given by Burgoyne and Craven 
as follows: 



where C is the concentration of oil mist in air necessary to 
produce an explosive mixture at atmospheric pressure (g/ 
m 3 ), p is the density of the oil (g/m 3 ), D is the diameter of the 
pipe (m), P is the absolute pressure (atm) and t is the thick¬ 
ness of the oil film (m). The minimum value of C is the lower 
flammability limit, which for hydrocarbons in general is 
about 49 g/m 3 , but work by Loison (1952) indicates that the 
practical value is about 138 g/m 3 , which is about 2.8 times 
the theoretical value. 

If this oil film is dispersed into an oil mist by some pri¬ 
mary shock or explosion, the conditions are created for a 
more powerful secondary explosion. High outlet tempera¬ 
tures (>250°C) of the compressed air can vaporize and 
ignite the oil. Sudden release of high pressure can cause 
simultaneous mist formation and ignition. Carbonaceous 
residues can undergo self-heating and give ignition. 

It should be emphasized that fires are more common than 
explosions in compressed air systems, but the fire creates 
an explosion hazard. 

The oil film explosion which occurs in a compressed air 
line with a thin film of flammable oil is somewhat unique. 
Typically, during a detonation in the line the air line is 
ruptured at intervals over its length. The problem has been 
discussed by Burgoyne and Craven. 

A number of oil film explosions have occurred in the 
compressed air starter systems of large diesel engines. In 
these cases, the explosion generally appears to have been 
initiated by the diesel engine rather than by the air 
compressor. 

There are a number of measures which can be taken to 
prevent air system explosions. One is to use oils which are 
non-flammable or have reduced flammability. The oils 
available and the problems associated with their use are 
discussed by Burgoyne and Craven. 

It is usually suggested that the risk of explosion can be 
reduced if high oil usage is avoided. This is not a complete 
answer, however, as explosions have occurred in systems 
where oil usage was not abnormally high. 

The deposition of oil can be minimized by the design of 
the air compressor. The air velocity in the outlet pipe should 
be high, although a velocity which might cause vibration 
should be avoided. The air flow in the aftercooler should be 
downwards so that it is in the same direction as the oil film 
flow. There should be drain points so that oil can be 
removed from the system. 

In operating the compressor, particular attention should 
be paid to the air outlet temperature. Various authors have 
suggested outlet temperature maximum limits in the 
region of 140-150°C. 

In Germany the maximum air outlet temperature of air 
compressors is determined by law. The maximum tem¬ 
perature was set at 160°C in 1934, but explosions continued 
to occur. In 1963 it was reduced to 140°C. 

It has been suggested by Burgoyne and Craven, however, 
that for pressures above 10 atm this may still not be the safe 


working temperature. They recommend a maximum nor¬ 
mal working temperature of 145°C for a final stage outlet 
pressure of 10 atm gauge, but one of 124°C for a pressure of 
100 atm gauge, with automatic cut-off temperatures 10°C 
higher in both cases. A more detailed table of values is 
given by these authors. 

It is also important for there to be a high standard of 
maintenance both of the air compressor and also of the rest 
of the air system. 

Other detailed precautions are described by the authors 
quoted. 

17.30.5 Molten metal-water explosions 

A violent explosion can occur if water comes into contact 
with molten metal. This hazard is of particular concern in 
the nuclear and metallurgical industries, but may some¬ 
times occur in the process industries. 

Molten metal-water explosions can occur either where 
water is added to molten metal or where molten metal is 
added to water. 

There are a number of theories of molten metal-water 
explosions, including theories of superheat not unlike 
those described in Section 17.29.7, but the phenomenon is 
not well understood. 

An investigation of molten metal-water explosions with 
special reference to continuous casting is given in A Study 
of the Causes of Molten Metal and Water Explosions by the 
HSE (1977/18). This report describes the various theories of 
such explosions. 

A molten-metal water explosion was the cause of the 
Scunthorpe disaster in 1975 in which a large leak of water 
from the cooling water pipe ran down into a torpedo ladle of 
molten iron (Case History A78). 

17.30.6 Superheated liquid explosions: explosions on 
water 

As mentioned above, one form of superheated liquid 
explosion is that occurring inside plants. Another is that 
which can occur when a refrigerated liquefied hydrocarbon 
is spilled onto water. 

Accounts of this type of explosion have been given by 
Katz and co-workers (Katz and Sliepcevich, 1971; Katz, 
1972), R.P. Anderson and Armstrong (1972, 1974), Enger 
and Hartman (1972a,b) and Reid, Drake and co-workers 
(Drake, Jeje and Reid, 1975; Reid, 1976, 1978; Drake and 
Reid, 1977; Reid and Smith, 1978). 

Attention was drawn to the potential for such an explo¬ 
sion during work on the hazards associated with the 
transport of LNG and involving its spillage onto water at 
the Bureau of Mines (BM) (Burgess, Murphy and 
Zabetakis, 1970 BM S 4105; Burgess, Biordi and Murphy, 
1972 BM PMSRC 4177). In the 56th test of an otherwise 
uneventful series, a sharp explosion destroyed the experi¬ 
mental water tank. Later, a similar but larger explosion was 
experienced when 0.25 m 3 of LNG was spilled on a pond in 
the open. 

Explosions of this kind are variously known as physical 
vapour explosions, flameless vapour explosions, or simply 
vapour explosions, and as rapid phase transition (RPT) 
explosions. 

A theory to explain such explosions is given by Reid 
(1976). The explosion is a form of superheated liquid 
explosion and is governed by the superheat limit tempera¬ 
ture. An explosion of this kind can occur in a BLEVE, and 
the phenomenon is considered as an aspect of BLEVE in 
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Section 17.29. As stated there, Reid’s expression for the 
superheat limit temperature (SLT) is 

T* = 0.895 T c [17.30.2] 

where T c is the critical temperature (K) and T s i is the 
superheat limit temperature (K). If a liquid is heated above 
its SLT, rapid vapour bubble nucleation occurs followed by 
an explosive evolution of vapour. 

According to this theory, spillage of a cold liquid onto a 
hotter one can result in a superheat limit explosion. As the 
BM work indicates, this occurs only in a few of cases. 

The limiting conditions for occurrence of an SLT are 
discussed by Reid with reference to those for propane. The 
SLT of propane is 326 K (53°C). The range of water tem¬ 
peratures within which vapour explosions of propane of 
any violence occur is 326—344 K. Below 326 K the water 
temperature is less than the SLT of propane whilst above 
344 K the phenomenon appears to be suppressed by the 
film boiling regime. 

For small temperature differences the heat transfer 
regime is nucleate boiling, but as the temperature differ¬ 
ence increases film boiling takes over. The heat transfer in 
this latter regime is reduced so that the cold liquid then has 
only a thin film above the SLT. Limited to this thin film, the 
violence of the SLTexplosion is much less. 

Thus, although liquefied gases such as ethane and 
methane have lower SLTs, they do not in their pure form 
give vapour explosions. 

The same applies to LNG which is essentially pure 
methane. However, it is found that if an LNG contains a 
sufficient proportion of higher hydrocarbons a vapour 
explosion can occur. A vapour explosion is thus a credible 

The proportion of higher hydrocarbons in an LNG which 
would not undergo a vapour explosion may be increased by 
ageing or by differential vaporization of the methane to the 
point where it would. 

The initial vapour explosion may be followed by a more 
violent one; the primary explosion may result in further 
contacting of the cold and hot liquids due to the pressure 
wave and to droplet formation. 

Several groups of workers have reported research on the 
industrial aspect of the hazard from such explosions. In 
addition to the BM work they include R.R Anderson and 
Armstrong (1972,1974) and Enger and Hartman (1972a,b). 

Enger and Hartman consider particularly the situation 
where LNG is subject to depletion of the methane content to 
the point where a vapour explosion is possible. They point 
out that in these circumstances the weathering is likely to 
be uneven so that in any given instant an explosion would 
occur only at part of the interface. 

These workers estimate the mechanical energy release as 
some 0.5 cal/m 2 of interface area. 

The consensus view which appears to have emerged is 
that such vapour explosions are not a prime cause of 
concern. 

17.31 Effects of Explosions 

An explosion may give rise to the following effects: (1) blast 
damage, (2) thermal effects, (3) missile damage, (4) ground 
shock, (5) crater, and (6) injury. 

Not all these effects are given by every explosion. An 
aerial blast, for example, tends not to form a crater. 


Many of the data on the effects of explosions come, not 
surprisingly, from studies of military and industrial 
explosives, but an increasing amount of information is 
available from the investigation of process plant 
explosions. 

Information on the effects of explosions has been given 
in Explosions, Their Anatomy and Destructiveness (C.S. 
Robinson, 1944), Structural Defence (Christopherson, 1946), 
the Textbook of Air Armaments (Ministry of Supply, 1952), 
The Effects of Nuclear Weapons (Glasstone, 1962; Glasstone 
and Dolan, 1980), Hazards of Chemical Rockets and Pro¬ 
pellants (Qensen, 1972), Workbook for Predicting Pressure 
Waves and Fragment Effects of Exploding Propellant Tanks 
and Gas Storage Vessels (W.E. Baker et al., 1975), Handbook 
for Estimating the Effects of Accidental Explosions in Pro¬ 
pellant Handling Systems (W.E. Baker e/ al., 1978), Explosion 
Hazard and Evaluation (W.E. Baker et al., 1983), Methods for 
the Determination of Possible Damage to People and Objects 
Resulting from Releases of Hazardous Materials (the Green 
Book) (CPD, 1992b) and by Jarrett (1968), Brasie and 
Simpson (1968),V.J. Clancey (1972b), Eisenberg, Lynch and 
Breeding (1975) and Gilbert, Lees and Scilly (1994a—i). 

Selected references on the effects of explosions are given 
in Table 17.38. 


Table 17.38 Selected references on effects of explosions 


Blast effects, blast theory, blast scaling laws 

MOD, ESTC (n.d.); Hugoniot (1887-89); Christopherson 
(1944,1946); C.S. Robinson (1944); Sachs (1944); E. Fisher 
(1950,1953a,b); Los Alamos Scientific Laboratories (1950); 
von Neumann and Richtmyer (1950); Weibull (1950); 
Prentiss (1951); Goldstein and von Neumann (1953); Erode 
(1955,1957,1959); Hoffman and Mills (1956); Hoerner 
(1958); Shear and Day (1959); Ericsson and Edin (1960); 
Goodman (1960); Shear and McCane (1960); Glasstone 
(1962); Kinney (1962); Langefors and Kihlstrom (1963—); 
Kingery and Pannill (1964); Office of Civil Defense (1965); 
Wistoski and Snyer (1965); Keefer et al. (1966); Kingery 
(1966); Brasie and Simpson (1968); Callahan (1968); E. 
Cohen (1968); Dobbs, Cohen and Weissman (1968); Jarrett 
(1968); D.L. Jones (1968,1970); Masso and Rudd (1968); 
Petes (1968); Staggand Zienkiewicsz (1968);Telleref a/. 
(1968); Lehto and Larson (1969); Penney, Samuels and 
Scorgie (1970); Stephens (1970); Zimmer, McDevitt and 
Dale (1970); Woolfolk (1971); Anon. (1972e); V.J. Clancey 
(1972b, 1982); Jensen (1972); Pittman (1972a,b, 1976); 
Westine (1972,1977); W.E. Baker (1973); J.W Reed (1973); 
Rindner and Wachtel (1973); Woolfolk and Ablow (1973); 
Geiger (1974); W.G. High (1974,1976); W.E. Baker et al. (1975); 
Eisenberg, Lynch and Breeding (1975); K. Kaplan, 
Gahrielsen and von Horn (1975); Strehlow and Baker (1975, 

1976) ; Swisdak (1975); Reissler, Pettit and Kennedy (1976, 

1977) ; Strehlow and Ricker (1976); W.E. Baker et al. (1978); 
M.R. Baum (1979); Department of Energy (USA) (1980); 
Glasstone and Dolan (1980); Zeeuwen and Schippers 
(1980); W.E. Baker et al. (1983); Held (1983a,b); Hannum 
(1984); Kingery and Bulmash (1984); Dowding (1985); 
Kinney and Graham (1985); MHAP (1986 LPB 68,1989); 
Cruice (1986); Dangreaux (1986); Esparza (1986); E.G. Bell 
(1987); van Loo and Opschoor (1989); PA. Davies (1993) 
Explosions in confined spaces: W.I. Taylor (1968); Weibull 
(1968); Stretch (1969); Slack (1971); Lazari, Burley and Al- 
Hasani (1991) (see also Table 17.13) 
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Vapour cloud explosions: J.H.S. Lee (1977); A.F. Roberts 
and Pritchard (1982); S.F. Hall etal. (1982); Zeeuwen, 
van Wingerden and Dauwe (1983); Giesbrecht (1988); 
Pritchard (1989); C.J.M. van Wingerden, van den Berg 
and Opschoor (1989); Guibert etal. (1992); CCPS 
(1994/15) 

Effect of blast on structures 

Ministry of Home Security (Appendix 28, n.d.b); Philip 
(1945); Christopherson (1946,1949); R.F. Meyer (1957); 
Healy (1959); Stretch (1969); Alexander and Hambly (1970); 
F. Morton (1970); Slack (1971);Wiehle and Bockholt (1971); 
Mainstone (1972); Alexander and Taylor (1973a,b); ASCE 
(1974/3,1985/21,1986/26); Westine and Baker (1974); FRS 
(1976 Fire Res. Note 1054); W.E. Baker et al. (1983); Jowett 
(1984 SRD R295); D.M. Brown and Nolan (1985,1987); 
Cruice (1986); Jowett and Byrne (1986 SRD R376); Jowett, 
Byrne and Roberts (1986 SRD R377); Scilly and High 
(1986); Weerheijm (1988); US Army, Navy and Air Force 
(1990); Mercx, Weerheijm and Verhagen (1991); Baker, 
Spivey, Baker (1991); Opschoor, van Loo and Pasman 
(1992); van Wees and Mercx (1992); Whitney, Barker and 
Spivey (1992); Barker, Whitney and Waclawczyk (1993) 
Brickwork: Astbury etal. (1970); Sinha and Hendry (1970); 
Paterson and Rowe (1970); Hendry and Sinha (1971); Hendry, 
Sinha and Maurenbrecher (1971); J. Morton, Davies and 
Hendry (1971); Astbury and Vaughan (1972); Astbury, West 
and Hodgkinson (1972,1973); J. Morton and Hendry (1973); 
H.WH.West, Hodgkinson and Webb (1973); Beak etal. (1994) 

Blast resistant structures 

Samuely and Hamann (1939); Christopherson (1946); 

J.F. Baker,Williams and Lax (1948); Earthquake 
Engineering Research Institute (1952); Newmark (1956a,b); 
Porter etal. (1956); Loving (1957); US Army, Corps of 
Engineers (1957); Norris etal. (1959); Browne etal. (1961); 
Rebenstorf (1961); Weber eta/. (1961); Glasstone(1962); 
Kinney (1962); R.G. Rose and Howell (1962); ASCE (1963); 
J.B. Martin and Symonds (1966); AIA (1967);W.G. High 
(1967,1974); C.V. Moore (1967); E. Cohen (1968); E. Cohen and 
Dobbs (1968a,b); Dobbs, Cohen and Weissman 
(1968); H.G. Johnston (1968); R.Y. Levine (1968a); Ruyters 
(1968); Sewell and Kinney (1968); Department of the 
Army, the Navy and the Air Force (1969); Alexander and 
Hambley (1970); Allgood and Swihart (1970); Recht (1971); 
C.E. Reynolds (1971); Granstrom (1972); Whitman (1973); 
W.E. Lawrence andjohnson (1974);Westine and Baker (1974); 
E.G. Cox and Saville (1975); Langeveld (1976); Balemans and 
van de Putte (1977); D.K. Pritchard (1981,1983,1989); Forbes 
(1982); Pritchard (1983);Tunkel (1983); D.M. Brown and 
Nolan (1985,1987); Nolan and Brown (1986); Power and Krier 
(1986); Bailly etal. (1989); D.M. Brown (1986). 

Vapour cloud explosions: Geiger (1987) 

Effect of blast on plant and equipment 

J.R. Wilson (1968); F.E. Walker (1969); M.M. Stephens (1970, 
1973); Pickering and Bockholt (1971); Weldon (1972); Hymes 
(1984); D.M. Brown and Nolan (1985,1987); Nolan and 
Brown (1986); Dangreaux (1986); Scilly and High (1986); 
Verheij (1988) 

Missiles, including generation, characteristics and 
flight 

Didion (1860); Helie (1884); Petry (1910); Cranz and Becker 
(1921); Cranz (1926); Gurney (1943,1946); Christopherson 


(1946); Anon. (1951); I.G. Bowen, Strehler and Wetherbe 
(1956); J.N. Nielsen (1960); Synge and Griffiths (1960); I.G. 
Bowen, Albright etal. (1961); E. R. Fletcher, Albright etal. 
(1961); Shapiro (1961); I.G. Bowen etal. (1963a,b); 
Grodzovksy and Kukanov (1965); E.R. Fletcher and Bowen 
(1968); Gwaltney (1968); Rindner (1968); R.C. Smith and 
Smith (1968); B. Brown (1969); D.E. Taylor and Price (1971); 
Zaker (1971,1975a,b); Pittman (1972a,b, 1976); WE. Baker, 
Cox et al. (1973); Bessey (1974); W.E. Baker et al. (1975); 
Clancy (1975); Bessey and Kulesz (1976); Ardron, Baum and 
Lee (1977); W.E. Baker,Westine and Cox (1977); Westine 
(1977); W.E. Baker et al. (1978); W.E. Baker, Cox et al. (1978); 
HSE (1978b); SIPRI (1978); M.R. Baum (1979,1984,1988, 
1989,1991,1993); J.H. Bowen (1980); Munday (1980); Porter 
(1980);Tulacz and Smith (1980); WE. Baker etal. (1983); 
Holden and Reeves (1985); Hunt and Wood (1985 SRD 
R341); Pietersen (1985); Hart and Croft (1988); McCleskey 
(1988a,b, 1992); Naz (1989); de Mestre (1990); M.C. Miller 
(1990); Pineau etal. (1991); Scilly and Crowther (1992); 
Twisdale and Vickery (1992); Twisdale et al. (1992); CCPS 
(1994/15) 

Missiles from craters: Henny and Carlson (1968) 

Missile impact and impact effects 

NDRC (1946); Duwez, Clark and Bohnenblast (1950); 
Parkes (1955); Loving (1957); Ezra (1958); Zabel (1958); 
Goldsmith (1960); Kolsky (1963); R.W. White andBotsford 
(1963); Cottrell and Savolainen (1965); C.V Moore (1967); 
E.R. Fletcher, Bowen and Ferret (1965); Gwaltney (1968); 
Symonds (1968); Kinslow (1970); Calder and Goldsmith 
(1971); A.J. Morris and Calladine (1971); W. Johnson (1972); 
W.G. High (1974,1980); Linderman (1974); B.C. Cox and 
Savffle (1975); N. Jones (1976,1983); R.P. Kennedy (1976); 
Berriaud etal. (1978); HSE (1978b) SIPRI (1978); Barr etal. 
(1980); Bokor (1980); J.H. Bowen (1980); I.L. Davies (1980); 
Hopkirk, Lympany and Marti (1980); A.J. Neilson (1980); 
Porter (1980); Porter et al. (1980); Tulacz and Smith (1980); 
Woisin (1982); WE. Baker etal. (1983); Hunt and Wood (1985 
SRD R341); ASME (1986 PVP106,1989/173); Jowett (1986 
SRD R378); Wierzbicki and Myung Sung Suh (1986); Barr 
(1987 SRD R439); Ciolek (1988); Vazques-Sierra, Marti and 
Molina (1988); Lu (1989); A.C. Palmer (1989); Scilly and 
Crowther (1992) 

Windows, glass fragments 

Beckett (1937,1958); Preston (1942); C.S. Robinson (1944); 
T.C. Baker and Preston (1946); N.J. Thompson and Cousins 
(1949); Charles (1958); Iverson (1968); J.W. Reed etal. (1968); 
Mainstone (1971); E.R. Fletcher, Richmond and Jones 
(1973,1976); H.W.H.West (1973); E.R. Fletcher (1974); 

E.R. Fletcher and Richmond (1974); Eisenberg, Lynch and 
Breeding (1975); E.R. Fletcher, Richmond and Richmond 
(1974); Ministry of Social Affairs (1976); M.R. Marshall, 
Harris and Moppett (1977); Harvey (1979b); E.R. Fletcher, 
Richmond and Yelverton (1974); J.W Reed (1980,1992); 
Pritchard (1981); W.E. Baker etal. (1983); Dangreaux (1986); 
Harmanny and Opschoor (1986); Scilly and High (1986); 
CPD (1992a,b); Baker (1994); Baker and Doolittle (1996) 

Effect of explosions on people, explosion injury 

Ministry of Home Security (Appendix 28); Zuckerman 
(1940,1941a,b); Blocker (1949); Blocker and Blocker (1949); 
Surgeon General (1950); Ministry of Supply (1952); 
C.S.White (1963,1965,1968a,b, 1971,1974); C.S. White, 
Bowen and Richmond (1964); E. Cohen (1968); von Gierke 
(1968); A.E. Hirsch (1968); R.K. Jones and Richmond (1968); 
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Richmond, Damon etal. (1968); Department of the Army 
(1969); Richmond and Fletcher (1971); Fugelso,Weiner and 
Schiffman (1972); E.R. Fletcher, Bowen etal. (1972); 

E.R. Fletcher, Richmond and White (1974); Eisenberg, Lynch 
and Breeding (1975); Fricke (1975); WE. Baker etal. (1978); 
HSE (1978b, 1981a);V.C. Marshall (1978); Crawley (1982); 
Hymes (1984); Cruice (1986); Dangreaux (1986); Hadjipavlou 
and Carr-Hffl (1986); MHAP (1986 LPB 68,1989);Withers 
(1988); Mercx (1990); Pineau etal. (1991);Withers andLees 
(1991); CPD (1992b); Opschoor, van Loo and Pasman (1992); 
Sorenson, Carnes andRogers(1992); Gilbert, Lees andScilly 
(1994a—i); Oswald and Baker (2000) 

Direct blast effects — lung haemorrhage: Zuckerman (1940, 
1941); O’Reilly and Gloyne (1941); Stewart, Russel and Cone 
(1941); Krohn,Whitteridge and Zuckerman (1942); 
Clemedson (1956); Richmond,Taborelli etal. (1957); 
Richmond,Wetherbe etal. (1957); C.S.White (1959,1961); 
C.S.White and Richmond (1959,1960); Richmond, Clare 
etal. (1961); Richmond and White (1962a, b); C.S. White, 
Bowen and Richmond (1965); Betz etal. (1965); Damon etal. 
(1966); I.G. Bowen, Fletcher and Richmond (1968); 

I.G. Bowen, Fletcher et al. (1968); Damon et al. (1968); 
Richmond, Damon etal. (1968); E.R. Fletcher and 
Richmond (1971); C.S.White, Jones etal. (1971); E.R. Fletcher, 
Bowen et al. (1972); C.S. White, Jones et al. (1972); Coppell 
(1976); Rawlins (1977-78); Stapczynski (1982); Y.Y. Phillips 
(1986); Zheng (1990) 

Direct blast effects — eardrum rupture: Zalewski (1906); 
Vadala (1930); Blake etal. (1941); Zuckerman (1941); 

G.A. Henry (1945); F.G. Hirsch (1968); Reider (1968); 

C.S. White, Bowen and Richmond (1970); Kerr and Byrne 
(1975a, b) 

Bodily translation, tumbling: Gurdjian,Webster and Lissner 
(1949); Taborelli and Bowen (1957); Taborelli, Bowen and 
Fletcher (1959); Swearingen etal. (1960); I.G. Bowen, 
Woodworth it a her and Ferret 

(1965); E.R. Fletcher and Bowen (1968); A.E. Hirsch (1968); 
E.R. Fletcher and Richmond (1970); E.R. Fletcher, 
Richmond and Jones (1971a,b); E.R. Fletcher, Richmond 
etal. (1971); Richmond (1974); E.R. Fletcher,Yelverton etal. 
(1975); R.K. Jones, Richmond and Fletcher (1975) 

Injury by building debris: Bowles etal. (1991); Gilbert, Lees 
and Scilly (1994h) 

Crushing-. Burzstein (1989) 

Injury by missiles, wound ballistics 

Bircher(1899);Joumee(1907);Gurney(1944);Grundfestefa/. 
(1945); Anon. (1947); Andrus etal. (1948); Harvey (1948); 
Goldizen, Richmond and Chiffelle (1957); Goldizen etal. 
(1961); Beyer (1962); French and Callender (1962); A. Palmer 
(1962); Sperraza and Kokinakis (1967,1968); Clemedson, 
Hellstrom and Lindgren (1968); Mattoo,Wani and Askegar 
(1974); R.C. Gray and Coppell (1975); Zaker (1975a,b); di Maio 
(1981); di Maio etal. (1982); Neades and Rudolph (1983); 
Trunkey (1983); J.H. Lewis etal. (1987); McCleskey, Needes 
and Rudolph (1990);Timberwolf Consulting Services (1991); 
Gilbert, Lees andScilly (1994f-i) 

Injury by flying glass 

R.C. Bell (1944); LG. Bowen, Richmond et al. (1956); 
Sperrazza and Kokanis (1967,1968); E.R. Fletcher (1974); 
E.R. Fletcher and Richmond (1974); E.R. Fletcher, 
Richmond and Yelverton (1980); W.E. Baker et al. 

(1983); Connell (1983,1992); Gilbert, Scilly and Lees 
(1994h) 


Injury inside buildings 

C.S. White (1957); Department of the Army, the Navy and 
the Air Force (1969); Richmond (1971,1972); Richmond and 
Kilgore (1971); Fricke (1975); Withers and Lees (1991); 
Hewkin (1992); Gilbert, Lees and Scilly (1994a-d,h,i); 
Oswald and Baker (2000) 

Dust injury, asphyxiation: Ministry of Supply (1952); C.S. 
White (1957) 

Crush injury: Michaelson,Taitelman and Burstein (1984); 
Michaelson etal. (1984); Ron etal. (1984); Burstein (1989) 

Combined injuries 

R.K. Jones (1971); Schildt (1972); CPD (1992b); Gilbert, Lees 
and Scilly (1994h) 

Injury by weapons, including wartime air raids and 
terrorist bombs 

Anon, (n.d.b); Blake and Douglas (n.d.); Lyons and Gardner 
(n.d.a-c); Zuckerman (1940,1941); Payne (1941); Osborn 
(1943); R.C. Bell (1944); Commissioner of Police (1945); 
Public Record Office (1945a-e); Anon. (1946); Howgrave- 
Graham (1947); Dunn (1952); Ministry of Supply (1952); 
Home Office (1953); O’Brien (1955); Collier (1957); Healy 
(1959); Irving (1963); MacNalty and Mellor (1968); Blocker 
etal. (1969); Mellor (1972); Rutherford (1972 -73); Caro and 
Irving (1973); Ramsey (1974,1983,1987); Fricke (1975); 

R.C. Gray and Coppell (1975); T.L. Kennedy and Johnson 
(1975); Tucker and Lettin (1975);Waterworth and Carr 
(1975); J. Reed (1977); Sainsbury (1977); Lord Baker (1978); 
Madden, Rutherford and Merett (1978); J.F. Hill (1979); 
Longmate (1981,1985); Brismar and Bergenwald (1982); 
R.V. Jones (1982); Pyper and Graham (1982-83); G.J. Cooper 
etal. (1983); Rely (1987); Fryckberg andTepas (1988); 
Patience (1989); Neville (1990); Moran (1992); Baker and 
Bennett (2001) 


17.31.1 Blast damage 

One of the principal effects of an explosion is the creation of 
a blast wave, and much of the energy of the explosion is 
expended on this. 

A description of blast effects must take into account both 
the nature of the blast wave and the damage caused by the 
blast to structures. The energy entering the blast wave was 
considered in Section 17.4 and the characteristics of the 
blast wave in Section 17.25 and its damage effects are 
described in Sections 17.32 and 17.33. 


17.31.2 Missile damage 

Another principal effect of an explosion is the generation of 
missiles, and this takes up most of the energy not trans¬ 
mitted to the blast wave. 

A description of missile damage involves both the gen¬ 
eration and flight of missiles and the damage caused by 
missiles to structures. The energy imparted to missiles was 
considered in Section 17.4 and the generation and flight of 
missiles and the damage done by them is described in 
Sections 17.34 and 17.35. 

17.31.3 Thermal effects 

The combustion process involved in a chemical explosion 
can give rise to intense local heat radiation, which may 
cause damage or injury. 
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Information on the effects of thermal radiation in explo¬ 
sions, mostly derived from nuclear explosions, was given in 
Chapter 16. 

17.31.4 Ground shock 

In industrial explosions ground shock effects are usually 
small and less than those due to blast and assessment of 
such effects is generally not undertaken. 

The effects of ground shock may, however, furnish useful 
information in accident investigation. An account of 
ground shock in this context has been given by V.J. Clancey 
(1972b). 

The ground shock produced by an explosion may be 
regarded as a sinusoidal disturbance and may be char¬ 
acterized by its frequency and amplitude and thus also by 
its maximum velocity and maximum acceleration: 

F m ax = 2 nfA [17.31.1] 


a max = 4rc 2 / 2 M [17.31.2] 

where a is the acceleration, A is the amplitude,/is the fre¬ 
quency, Fis the velocity and the subscript ‘max’ denotes the 
maximum value. 

For a charge exploded at the ground surface the ground 
shock depends mainly on the quantity of explosive and the 
nature of the ground. 

An equation widely used to determine the amplitude of 
ground shock is 


A = 0.001—^— [17.31.3] 

where A is the amplitude (in.), d is the distance (ft), E is the 
mass of explosive (lb) and A is a constant. The constant K 
depends on the nature of the ground. It may be taken as 100 
for hard rocks and 300 for clay. 

In order to avoid damage to a building owned by others, 
the amplitude should be limited to a value of 0.008 in. for an 
average structure or 0.003 in. for a delicate one.The persons 
responsible for the blast hazard may, however, opt to take 
the risk of some damage to their own Wilding and allow an 
amplitude of 0.016 in. 

For comparison, an amplitude of 0.001 in. is detectable 
by someone who is on the lookout for a tremor and one of 
0.003 in. may he produced by heavy traffic nearby. 

The frequency of the ground shock maybe as low as 3—5 Hz 
in soft or loose soil and as high as 30-100 Hz in rock. 

The damage done by ground shock to normal houses has 
been correlated by Langefors and Kihlstrom (1963) in 
terms of the quantity 



where Q is the mass of explosive (kg) and R is the 
distance (m). 

Some data on damage to normal houses caused by 
ground shock are given by Langefors and Kihlstrom for 
hard rock, and further derived data are given by Clancey 
for soft rock, as shown in Table 17.39. The relationshipis not 
valid for distances less than 2-3 times the depth at which 
the explosion takes place. The values given are for damage 


Table 17.39 Some data on damage to normal houses 
by ground shock 



Q/R 3 ' 2 

Damage to normal houses 

Hard rock Soft rock 


(kg/m 3/ ' 

1 (kg/m 3/ ) 


0.008 

0.02 

Fall of plaster, no cracking 

0.06 

0.25 

Insignificant cracking 



(threshold value) 

0.12 

0.50 

Cracking 

0.25 

1.0 

Major cracking 


Sources: Hard rock: Langefors and Kihlstrom (1963). Soft rock: 
Clancey (1972b). 

Data in this table from Rock Blastingby U. Langefors and B. Kihlstrom, 
1963, are reproduced with permission of the authors and of the pub¬ 
lishers, Almqvist & Wiksell Forlags. 

to normal houses built on the rock in which the explosion 
occurs. For concrete structures the/value needed to give 
the same degree of damage is 2-4 times greater. 

For an explosion at or near the surface, damage by blast 
will extend to a much greater distance than damage by 
ground shock. 

17.31.5 Crater 

A condensed phase explosion tends to give rise to a crater. 
For industrial explosions this effect is not usually assessed 
beforehand, but may provide information useful in acci¬ 
dent investigation. 

Accounts of cratering are given by C.S. Robinson (1944) 
and V.J. Clancey (1972b, 1977d). 

The factors which affect the crater produced by an 
explosion are the position of the charge relative to the 
ground surface, the nature of the ground and the type and 
quantity of explosive. A charge exploded at the ground 
surface gives a wider and shallower crater than one exploded 
just beneath the surface. 

The crater is larger in rock than in soft sand. In the latter 
there is very little shock transmission; in the former, how¬ 
ever, the initial shock propagates and produces cracks as 
the pressure wave passes. The expanding gases enter the 
cracks and accelerate the fragmented rock. 

It may be noted that understanding of the effects of the 
nature of the soil on crater size has developed over the years 
and the effects just outlined differ from those described by 
Robinson. 

A high brisance explosive generally gives a large crater, 
and a low brisance explosive a small one or none at all.VCEs 
tend not to give craters; there was no crater at Flixborough. 

An equation for crater size which applies to the explosion 
of dynamite, a high brisance explosive, at the ground sur¬ 
face on average soil is the Olsen formula 

F = 0.4Q 8 / 7 [17.31.5] 

where Q is the mass of explosive (lb) and Fis the volume of 
the crater (ft 3 ). 

Robinson gives the experimental data on crater size 
shown in Table 17.40. The third case is the explosion at 
Oppau in 1921 (Case History A5). The corresponding crater 
volumes calculated from Equation 17.31.5 are 3200 and 
75,000,000 ft 3 , respectively. Thus, the low brisance ammo¬ 
nium nitrate gave a crater size considerably smaller than 
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Table 17.40 Crater dimensions (after C.S. Robinson, 
1944) 


Explosive 

Crater dimension 

Type 

Charge 

(lb) 

Diameter 

(ft) 

Height 

(ft) 

Volume 

(ft 3 ) 

Dynamite 

50 

6 

2 

30 

Dynamite 

2,400 

31 

9 

3,200 

Ammonium 

nitrate 

9,000,000 

400 

90 

10,000,000 


that calculated by the equation derived for the high bris- 
ance explosive. 

An equation relating the diameter of a crater to its 
volume has been given by VC. Marshall (1987). He obtains 
from Robinson’s figures the relation 


D - 3-jp {17.31.6] 

where D is the diameter of the crater (m), h is its depth (m) 
and Vis its volume (m 3 ). Then, utilizing the rule-of-thumb 
attributed by Robinson to Olsen that the height of the crater 
is on average half its diameter (h = D/2), he gives 

D = 6F°' 25 [17.31.7] 

Assuming that crater volume is proportional to the cube of 
the radius, Equation 17.31.5 is broadly consistent with the 
other main relation used to describe crater dimensions 

r oc TV 1 / 3 [17.31.8] 

where r is the radius of the crater and W the mass of 
explosive. 

As mentioned in Section 17.3, there is a reasonably good 
correlation between the crater radius and the mean deto¬ 
nation distance for ground surface explosions, so that 
relation 17.31.8 is similar to Equations 17.3.5 and 17.3.6. 

Cratering can occur even without an explosion. The V-2 
rockets, which had very high kinetic energy, were capable 
of giving a large crater even when not armed. 

17.31.6 Injury 

The effects of an explosion on people include injury caused 
by (1) blast, (2) missiles, (3) thermal effects, and (4) toxic 
effects. These injury effects are described in Sections 17.38 
and 17.39. 


17.32 Explosion Damage to Structures 

17.32.1 Air blast loading 

The general nature of the air blast from an explosion has 
been discussed in Section 17.25, where the blast character¬ 
istics were described essentially in terms of an ideal con¬ 
densed phase explosion such as that of TNT, while the 
differences in the blast between a condensed phase explo¬ 
sion and aVCE were considered in Sections 17.26 and 17.28. 

The loading of structures by air blast is described by 
Glasstone (1962) and Glasstone and Dolan (1980). 
In general, the effective pressure p e on a given face of a 


structure is the sum of the overpressure p and the drag 
pressure p A : 

Pe(t) =P(t ) +p A {t) [17.32.1] 

The drag pressure p A is a function of the dynamic pressure 


p i (t)=C D q(t) [17.32.2] 

where C D is the drag coefficient. Glasstone and Dolan treat 
various structures, including (1) a closed, box-like struc¬ 
ture, (2) a partially open, box-like structure, (3) an open 
frame structure, (4) a cylindrical structure, and (5) an 
arched structure. 

For the case of a closed, box-like structure, it is possible 
to determine (1) the average front face loading, (2) the aver¬ 
age side and top loading, (3) the average back face loading, 
and (4) the net horizontal loading. 

If a blast wave reaches the structure and its incidence on 
the front face is normal, the overpressure p f at that face 
rises very rapidly to the peak reflected overpressure p°. As 
the wave moves around the structure, the front face pres¬ 
sure falls rapidly to the stagnation pressure p s at the stag¬ 
nation time 4, 

Pi =Ps=P(ts) +Pi(ts) [17.32.3a] 

ej>:{4)+ff(4) [17.32.3b] 

since for this face C D is unity. The stagnation time is 

4 = 3S/U [17.32.4] 

where S is the distance through which pressure relief is 
obtained and (7is the shock velocity. S is the height Hot the 
half-breadthB/2, whichever is smaller. Thereafter, the front 
face pressure falls: 

p t =p(t)+q(t) [17.32.5] 

The front face pressure is shown in Figure 17.83(a). 

The average side face and top pressure is obtained from 
Equations 17.32.1 and 17.32.2 as follows. The side face is 
fully loaded when f = L/ U, where L is the structure length, 
and at this time the pressure reaches a maximum value p 0 
corresponding to that at / = L/2U. Thereafter the average 
pressure is that corresponding to t — L/2U, until it falls to 
zero at t = t A + L/2U. The drag coefficient is approxi¬ 
mately -0.4. The average side face and top pressure is 
shown in Figure 17.83(b). 

The average back face pressure is obtained from 
Equations 17.32.1 and 17.32.2 as follows. The shock front 
reaches the back face at time t = L/U, but it requires an 
additional time of 4S/U for the average pressure to build 
up to the maximum value p b corresponding to that at t m 
(L + 45)/ U. Thereafter, the average pressure is that corres¬ 
ponding to t-L/U, until it falls to zero at t = fa+L/KThe 
drag coefficient is approximately —0.3. The average back 
face pressure is shown in Figure 17.83(c). 

The net horizontal loading is the front face loading less 
the back face loading. This is shown in Figure 17.84. 

The response of the walls depends primarily on the 
loadings on the individual faces, while the response of the 
frame depends on the net loading. For the shock strengths 
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Time 


Figure 17.84 Blast loading of structures - net pressure 
loading on a closed cuboid structure (Glasstone and Dolan, 
1980): net horizontal loading (Courtesy of Castle House 
Publications) 


of interest here the values required for the drag coefficient 
C D are those applicable to the subsonic range. Some values 
of the drag coefficient are given inTable 17.41. 

17.32.2 Diffraction and drag loading 

In the air blast loading of structures a distinction is made 
between diffraction loading and drag loading. Diffraction 
loading is determined primarily by the peak overpressure, 
drag loading by the dynamic, and hence the drag, pressure. 

There are two types of diffraction loading. One is that 
due to the pressure differential between the front and back 
faces. Except for long structures this load is short-lived. 
The other loading is that due to the pressure differential 
between the inside and outside of the building. This 
approximates a static load and is more prolonged. With 
diffraction loading the damage potential is a function of 
the peak overpressure and the duration. 


Table 17.41 Drag coefficients (W.E. Baker et at., 1983 
after Hoener, 1958) 


Sphere 
Rod, end-on 
Disc, face-on 
Cube, face-on 
Cube, edge-or 


Long rectangular member, 
edge-on 





Drag loading is due to the drag pressure on the structure. 

The loading is a function both of the air blast and the 
structure. A given structure may display diffraction- 
or-drag-type behaviour, depending on the duration. A short 
duration tends to load by diffraction, a long one by drag. 

For a closed structure the duration of diffraction loading 
is approximately the time for the wave to pass from front to 
back, which is a relatively short period. Drag loading exists 
for the whole duration of the positive phase and for a short 
time thereafter. This is a long period compared with that of 
diffraction loading. 






















EXPLOSION 17/183 


Certain types of structure are more prone to damage by 
diffraction, others by drag. Diffraction-type targets tend to 
be closed or semi-closed structures such as buildings with 
small window areas and storage tanks. Drag-type targets 
tend to be tall, thin objects such as telegraph poles and lamp 
posts. Buildings with large window areas may also con¬ 
stitute drag-type targets. 

Drag loading is relatively more important for explosions 
which give long duration times, such as nuclear explosions, 
than for those giving short duration times, such as TNT. 

17.32.3 Structure response 

A typical load-displacement diagram is illustrated in 
Figure 17.85(a) and other related diagrams are shown in 
Figures 17.85(b)—(d). 


The response of a structure is usually modelled by 
treating it as a lumped system. The simplest model is the 
one-mass model. The one-mass system is illustrated in 
Figure 17.86(a). The general equation of motion is 

m^ + c f t + R (x)= F (t) [17.32.6] 

where c is the damping factor, F is the applied force, m is the 
mass, R is the restoring force, t is the time and x is the dis¬ 
placement. It is usual to assume zero damping. Hence, 
Equation 17.32.6 becomes 

m d J-R{x) F(l) [17.32.1]! 




Figure 17.85 Blast loading of structures: load-displacement and related diagrams: (a) load-displacement diagram; 
(b) resistance-displacement diagram; (c) load-time diagram; and (d) displacement-time diagram. 1-4, rise times 
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F(0 F(0 



Figure 17.86 Blast loading of structures - one-mass 
representation of a structure: (a) undamped elastic spring 
system (linear oscillator); (b) damped elastic spring system 
(viscous damping); and (c) rigid-plastic system (Coulomb 
friction) 


where £ is the damping factor, x the natural period and co n 
the natural frequency. 

If there is no damping, the one-mass vibrator becomes an 
elastic oscillator, as shown in Figure 17.86(b). The behav¬ 
iour of the elastic oscillator gives important insight into the 
response of structures. If the system is subject to an applied 
force which decays exponentially such that 
F(t)=Fexp(-t/T) [17.32.16] 

where T is the time constant of the decay of the force, 
Equation 17.32.9 becomes 

+ kX = F 6Xp( _ ^ T) [17.32.17] 

The general solution of Equation 17.32.17 is 
4=/N,^) ftf.32.18] 


For a system in the elastic regime the retarding force R is 
proportional to the displacement x. Hence, Equation 17.32.6 
becomes 


and the solution x m for maximum values of x is 


F/k 


= f(«nT) 


[17.32.19] 


m w +c % +kx=m [17 ' 32 ' 8] 

Or neglecting damping, as illustrated in Figure 17.86(b) 


where x m /(F/k) is the amplification factor and cu n T the 
duration ratio. The relation between these two quantities is 
given in the oscillator diagram shown in Figure 17.87. The 
asymptotes of the curve given in Figure 17.87 are 


m^ + kx = F(t) [17.32.9] 

where k is the elastic constant. 

For a system in the plastic regime the retarding force is 
the Coulomb friction, or retarding, force/. Hence, as illus¬ 
trated in Figure 17.86(c), Equation 17.32.9 becomes 

m W +f = m [17.32.10] 

In this case motion occurs only if F >/. 

Considering first the one-mass vibrator, shown in 
Figure 17.86(a), the equation of motion may be written as 


T = m v T, co n T<0A impulsive loading 

[17.32.20a] 

= 2® n T>40 quasi-static loading [17.32.20b] 

s* f(m n T) 0.4 < co n T < 40 dynamic loading 

[17.32.20c] 

In sketching the curve it is also helpful to note that at the 
value of co n T where the asymptotes intersect the value of x m / 
(F/k) on the actual curve is approximately half that at the 
point of intersection.Then, in the impulsive loading domain 


id 2 * 2fd* 
mldf (O n dt 

F* =F/k 



Xm oc FT = I [17.32.2 r 

[17.32.11a] w k ere j j s i m p U i se| w hilst in the quasi-static loading 
domain 


[17.32.11b] *m = 2 F/k [17.32.22] 

Equation 17.32.22 means that the dynamic displacement, or 
deflection, is twice the static displacement. This dynamic 
[17 09 191 ' oac * ^ actor °f 2 is widely used in structural engineering. It 
L ' ' ‘ is also of interest to consider the corresponding energy 

relations. For impulsive loading the maximum strain ener- 
r 39 i „ gy may be equated with the initial kinetic energy. The 
[1/.32.13J initial velocity is 


[17.32.14] 



and the initial kinetic energy E ko is 


[17.32.23] 


f c2 y 

V4 mkl 




[17.32.15] 


[17.32.24] 
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Figure 17.87 Blast loading of structures response of an elastic structure: (after W.E. Baker et al., 1983) (Courtesy of 
Elsevier Science Publishers) 


The maximum strain energy E sla is 

= 1/2 kjfa [17.32.25] 


Equating the two energies to obtain the asymptote 

=1 I 17 - 32 - 20 ] 


Similarly, for quasi-static loading the maximum strain 
energy may be equated with the maximum work W m . The 
latter is 


W m = Fx m [17.32.27] 

Equating the two energies 
2 F 

k ^ =1 [17 ' 32 ' 28] 

as in Equation 17.32.22. 

These relationships may be represented graphically in 
the form of a force-impulse, or F-I, diagram, as illus¬ 
trated in Figure 17.88, which shows again the three 
domains of impulsive loading and quasi-static loading 
separated by dynamic loading. 

The force-impulse diagram is readily converted to a 
pressure-impulse, or P—I diagram, as described below. 

A similar treatment may be applied to the plastic regime. 
In this case the maximum strain energy is 


E sm =fx m [17.32.29] 

Equating energies as before gives 

fc 1 [17.32.30] 


(2 mfcaf' 2 


[17.32.31] 


An account of the practical application of these concepts 
to the buildings typical of chemical plants has been given 
by Whitney, Barker and Spivey (1992). The work included 
investigations of the structural damage in a number of 
plant accidents and covered peak reflected overpressures 
of 0.1—15 psi and duration of 5-100 ms. The authors dis¬ 
tinguish three types of blast load: impulsive, quasi-static 
and dynamic. They classify the loads as low, moderate and 
high, defined in terms of the combination of peak over¬ 
pressure and duration. They then tabulate for each load 
class the typical damage to frames, purlins, girts and 
joists, metal decking and windows, and they indicate the 
level of protection afforded by the structure and make 
recommendations for design. 

The response of buildings to blast is generally analysed 
using a static load of long duration. The authors state that 
the metal frame buildings common in chemical plant tend 
to have greater impulsive and dynamic resistance than the 
static analysis indicates. It is quite common for plant 
buildings to experience a dynamic response in which the 
duration of the load is close to the natural period of the 
structure. The conventional plant buildings which perform 
best are those which allow plastic response without failure. 
The thrust of the design recommendations is to enhance 
this plastic behaviour. 

17.32.4 Structure parameters 

Some parameters which govern the structure response are 
(1) the natural period, (2) the elastic limit, (3) the ductility 
ratio, and (4) the resistance function. 

The elastic behaviour of a structure may be described in 
terms of the following parameters: 

T n = l// n [17.32.32] 

= 2n/co n [17.32.33] 

= 2 n(m/k) 1/2 [17.32.34] 


There are also more complex multiple-mass models of where/ n is the natural cyclic frequency, T n the natural period 

structural response. and cu n the natural frequency. 
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Figure 17.88 Blast loading of structures: force-impulse (F-l) diagram of a structure (Strehlow and Baker, 1976) 
(Reprinted from R.A. Strehlow and W.E. Baker, Progress in Energy and combustion Science, 2, 27, © 1976, with 
permission from Pergamon Press) 


Equation 17.32.34 may be used to determine the elastic 
constant from the natural period, and vice versa. Some 
typical values of the natural period given by R.J. Harris 
(1983) are brick walls 20-40 s, concrete walls 10-15 s con¬ 
crete floors 10—30 s. 

A table of equations for the determination of the natural 
period is given by W.E. Baker et al. (1983). The following 
empirical equation is given by Kinney (1962) for the esti¬ 
mation of the natural period of a reasonably modern 
building: 

T = 0.05i [17.32.35] 

where B is the breadth of the building (ft), H is its height (ft) 
and T is its natural period (s). The natural frequencies of 
buildings is given for a number of common building types 
in theTNO Green Book (1989). 

The extent of elastic behaviour is determined by the 
elastic limit, which is essentially the limit for a static load. 
Information on the elastic limit is available for most mate¬ 
rials of interest. For structural response, where the time of 
application of the load may be very short, the relevant limit 
may be the dynamic elastic limit. Some approximate data 
on the elastic limit for structural materials have been given 
by Kinney (1962). According to these data the ratio of the 
dynamic to the static resistance for structural steel is about 
1.58 up to a time to yield of 5.5 ms and that for reinforced 


concrete is about 1.38 up to a time to yield of 10 ms. For 
both materials the ratio falls to about 1.15 at a time to yield 
of 100 ms. 

Kinney states that the time to reach the maximum elastic 
displacement, or time to yield 4, has been investigated 
using the equation of motion, and may be approximately 
represented by the relation 

4 = t(t') ' [17.32.36] 

where /> m is the blast pressure (N/m 2 ), r e is the maximum 
elastic resistance per unit area (N/m 2 ), 4 is the time to yield 
(s) and T is the natural period (s). 

The ductility ratio/), is the ratio of the total sustainable 
deformation to the elastic deformation: 



where x e is the displacement at the elastic limit and x t is that 
at the failure limit. A material with a low ductility ratio is 
brittle, one with a high ratio ductile. 

The behaviour of a structure under load is given by 
the load-displacement curve, which was illustrated in 
Figure 17.85(a). If this curve is treated as a resistance- 
displacement curve, the resistance function R may be 
obtained from it by approximating the curve by two 
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straight lines, as shown in Figure 17.85(b). Atthe maximum 
elastic displacement x e there is a maximum elastic resist¬ 
ance R e , or yield resistance. 

17.32.5 Component failure 

The behaviour of a structural component may be illus¬ 
trated by considering that of a brick wall. Work on the 
response of load-bearing brick structures to gas explosions 
has been described byAstbury etal. (1970), and their report 
contains an appendix by Paterson and Rowe (1970) on 
experimental work on the dynamic loading of brick panels. 

Figure 17.89 shows the load-displacement diagram for 
brick panels of varying thickness. There is a rise to a 



Figure 17.89 Blast loading of structures: 
load-displacement diagram for brick panels (after Astbury 
et al., 1970) (Courtesy of the British Ceramics Research 
Association) 



maximum load F m with a given central deflection x m . The 
load decays to zero at a failure deflection Xf. These three 
parameters are functions of the bricks, the mortar, the 
panel thickness, the aspect ratio and the edge-fixing con¬ 
ditions. The failure deflection x f is usually somewhat more 
than the panel thickness. From other work the ratio of cen¬ 
tral to average deflection is taken as 1:0.44. 

From experimental work several simple rules have been 
derived for scaling load-deflection curves. It is found that if 
the linear dimensions of a panel are altered by a uniform 
scaling factor, the lateral strength remains constant. It is 
also found that the strength is proportional to the square of 
the thickness. Further, comparing a square with a rectangle 
comprising two such squares, it is found that the strength 
of the latter is half that of the former, that for intermediate 
values of the aspect ratio it is possible to interpolate and 
that for greater values the strength remains constant at the 
value for the rectangle. 

Although the elasticity of brickwork is very limited, for 
rapidly applied loads the dynamic strength is somewhat 
greater than the static strength. In other words, there is 
some increase in maximum deflection with increase in rate 
of pressure rise. This is illustrated for a 9 in. brick wall in 
Figure 17.90. 

There is a marked increase in dynamic deflection as the 
failure loading is approached. This is illustrated for a 4.5 in. 
brick wall in Figure 17.91, which shows that at explosions 
with maximum pressure P m of 4 lbf/in. 2 the deflection is 
slight, but that at a pressure of 4.2 lb f /in. 2 there is a large 
deflection, failure finally occurring at 5.1 lb f /in. 2 . 

Some information is available on the failure pressures of 
building components. Tables are given by Astbury et al. 
(1970) and R.J. Harris (1983). 


17.32.6 Overpressure damage data 

Structural damage caused by blast waves from explosions 
has traditionally been correlated in terms of the peak over¬ 
pressure of the explosion. There are available a large 



Figure 17.90 Blast loading of structures-effect of rapidly applied loads on a 9 in. brick wall (after Astbury et al., 1970): 
(a) applied load and (b) average lateral deflection. Curve parameters on both figures are fractions of longest rise time 
200 ms (Courtesy of the British Ceramics Research Association) 
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Figure 17.91 Blast loading of structure: effect of rapidly applied loads on a 4.5 in. brick wall as failure loading is 
approached (after Astbury et at., 1970). F m ultimate strength; P m maximum explosion pressure (Courtesy of the British 
Ceramics Research Association) 


number of tables and graphs giving damage levels in terms 
of the peak overpressure. 

The applicability of such data is greater for quasi-static 
loading than it is for impulsive loading. In the latter regime 
this approach is liable to result in considerable overestimate 
of the damage. 

Thus,W.E. Baker et al. (1983) recommend against the use 
of simple overpressure damage data. Preferred methods 
are the use of pressure-impulse, or P-I, diagrams and 
distance-charge, or R-W correlations. 

However, useable data in these alternative forms 
are often not available. In addition, some refinement of 
the overpressure approach has been effected. It still 
appears worthwhile, therefore, to consider first this 
approach. 

A survey of damage effects caused by accidental explo¬ 
sions has been made by C.S. Robinson (1944), who also 
gives graphs of the limits of serious damage, minor 
damage, glass breakage and missile flight vs charge for 
both barricaded and unbarricaded installations. The data 
given by Robinson for unbarricaded installations are plot¬ 
ted in Figure 17.92. 

A large amount of information on blast damage is given 
by Glasstone (1962) and Glasstone and Dolan (1980). These 
include buildings of various kinds, gas works, oil storage 
tanks, LPG installations, electrical transmission systems, 
gas, water and sewage systems and vehicles and ships. 
These data are based mainly on blasts caused at Hiroshima 
and Nagasaki by the explosion of a nuclear bomb of 
approximately 20,000 t TNT equivalent over each city in 


1945 and by tests conducted at the Nevada Test Site, sup¬ 
plemented by data from accidental explosions. 

Some of the damage effects described by Glasstone are 
as follows. In the Texas City explosion in 1947, oil storage 
tanks were severely damaged out to the overpressure 
region of 3-4 psi. 

In the Nevada tests in 1955 a complete 18,000 US gal bulk 
storage plant containing propane with pump, compressor, 
piping, valves and fittings, and with a cylinder filling 
building, was located at the point where the overpressure 
was 5 psi. The building was demolished and the filling line 
was broken at the point where it entered the building, but 
otherwise the installation received only superficial 
damage. 

In the Nagasaki explosion in 1945 the water supply sys¬ 
tem suffered extensive damage, so that it became virtually 
impossible to extinguish fires. Breakage of pipes occurred 
almost entirely in or at the entrance to buildings and 
structures rather than underground. The exception was a 
12 in. cast iron water main 3 ft below ground which did 
break, but this was in a filled area where the ground was 
irregular. There appeared to have been little effect on 
underground gas mains. 

Glasstone gives a large amount of data on levels of 
damage to both diffraction- and drag-type structures, 
including a number of tables and nomograms. In par¬ 
ticular, the data shown in Table 17.42 have been widely 
quoted. The data given in Table 17.42(A) are from an original 
table of Glasstone. Those given in Table 17.42(B) are 
quoted together with the data from section A by Brasie and 
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Figure 17.92 Damage effects of explosions: limits of serious damage, missile flight and glass damage for accidental 
explosions for unbarricaded installations (after C.S. Robinson, 1944): x, severe damage; • , missile flight; □, glass 
breakage. The full and broken lines give, respectively, the average and the outer limits for serious damage (Reproduced 
with permission from Explosions: their Anatomy and Destructiveness by C.S. Robinson, © 1944, McGraw-Hill 
Book Company) 


Table 17.42 Some damage effects produced by a blast wave - 1 (after Glasstone, 1962; Brasie and Simpson, 1968) 

Structural element Failure Peak side-on overpressure 

(approximate) (psi) 


A Original data of Glasstone a 


Glass windows, large and small 

Corrugated asbestos siding 
corrugated steel or asbestos panelling 
Brick wall panel, 8 or 12 in. thick, 
not reinforced 

Wood siding panels, standard house 
construction 

Concrete or cinder-block wall panels, 

8 or 12 in. thick, not reinforced 

Shattering usually occasionally frame 
failure 

Shattering 

Connection failure followed by buckling 
Shearing and flexure failures 

Usually failure occurs at the main 
connections, 

allowing a whole panel to be blown in 
Shattering of wall 

0.5—1.0 

1.0-2.0 

1.0—2.0 

3.0-10.0(7-8) 

1.0—2.0 

1.5-5.5 (2-3) 

B Additional data of Brasie and Simpson 13 

Self-framing steel panel building 

Collapse 

3-4 

Oil storage tanks 

Rupture 

3-4 

Wooden utility poles 

Snapping failure 

5 

Loaded rail cars 

Overturning 

7 


a Glasstone and Dolan (1980), table 5.145. in parentheses are from Brasie and Simpson (1968). 
b Brasie Simpson (1968), table 3. 


Simpson (1968), and are possibly taken from the text of 
Glasstone. The table given by Brasie and Simpson has fre¬ 
quently been quoted. 

Another damage table is that given by VJ. Clancey 
(1972b) in the context of accident investigation and repro¬ 
duced in Table 17.43. 


Commenting on these tables, Scilly and High (1986) state 
that both the tables of Brasie and Simpson and that of 
Clancey are largely derived from the nuclear weapons data 
and theoretical analyses in Glasstone together with some 
additional data for condensed phase explosives from 
Robinson. 
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Table 17.43 Some damage effects produced by a blast wave - 2 (after V.J. Clancey, 1972b) 



Peak side-o; 

n overpressure 


(psi) 

(kPa a ) 

Annoying noise (137 dB), if of low frequency (1—15Hz) 

0.02 


Occasional breaking of large glass windows already under strain 

0.03 

0.2 

Loud noise (143 dB); sonic boom glass failure 

0.04 


Breakage of windows, small, under strain 

0.1 

0.7 

Typical pressure for glass failure 

0.15 

1.0 

‘Safe distance’ (probability 0.95 no serious damage beyond this value) 

Missile limit 

Some damage to house ceiling; 10% window glass broken 

0.3 

2.0 

Limited minor structural damage 

0.4 

2.8 

Large and small windows usually shattered; occasional damage to window frames 

0.5—1.0 

3.5-6.9 

Minor damage to house structures 

0.7 

4.8 

Partial demolition of houses, made uninhabitable 

1.0 

6.9 

Corrugated asbestos shattered 

Corrugated steel or aluminium panels, fatenings fail, followed by buckling 

Wood panels (standard housing), fastening fail, panels blown in 

1-2 

6.9-13.8 

Steel frame of clad building slightly distorted 

1.3 

9.0 

Partial collapse of walls and roofs of houses 

2 

13.8 

Concrete or cinder block walls, not reinforced, shattered 

2-3 

13.8-20.7 

Lower limit of serious structural damage 

2.3 

15.9 

50% destruction of brickwork of house 

2.5 

17.3 

Heavy machines (3000 lb) in industrial building suffer little damage 

Steel frame building distorted and pulled away from foundations 

3 

20.7 

Frameless, self-framing steel panel building demolished 

Rupture of oil storage tanks 

3-4 

20.7-27.6 

Cladding of light industrial buildings ruptured 

4 

27.6 

Wooden utilities poles (telegraph, etc.) snapped 

Tall hydraulic press (40,000 lb) in building slightly damaged 

5 

34.5 

Nearly complete destruction of houses 

5-7 

34.5-48.3 

Loaded train wagons overturned 

7 

48.3 

Brick panels, 8—12 in. thick, not reinforced, fail by shearing or flexure 

7-8 

48.3-55.2 

Loaded train boxcars completely demolished 

9 

62.1 

Probable total destruction of buildings 

Heavy (7000 lb) machine tools moved and badly damaged 

Very heavy (12,000 lb) machine tools survived 

10 

69.0 

Limit of crater lip 

300 

2000 


a These SI values are given by Gugan (1979). 


A damage classification which is widely quoted is that by vulnerability model by Eisenberg, Lynch and Breeding 
Stephens (1970), who defines the following categories: (1975) from this work: 


Zone 

Damage 

level 

Peak side-on 
overpressure (kPa) 

A 

Total destruction 

>83 

B 

Severe damage 

>35 

C 

Moderate damage 

>17 

D 

Light damage 

<3.5 


The damage levels typical of these zones are such that in A 
the building may be damaged beyond economical repair, in 
B it suffers partial collapse and/or failure of some struc¬ 
tural members, in C it is still usable but structural repairs 
are required and in D damage includes broken windows, 
light cracks in walls and damage to wall panels and roofs. 

Fugelso, Weiner and Schiffman have described damage 
to frame structures from an explosion equivalent of 5001 
TNTequivalent. The following data have been quoted in the 


Structural damage (%) Peak overpressure 

(psi) (N/m 1 2 ) 

1 (threshold) 0.9 6,200 

50 3.0 20,700 

99 5.0 34,500 


They derive from these data a probit equation relating 
structural damage to peak overpressure: 

Y = -23.8 + 2.92 In p° [17.32.38] 


where p° is the peak overpressure (N/m z ) and Y is the 
probit. 

In further development of the vulnerability model, 
Rausch, Eisenberg and Lynch (1977) have dealt with the 
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disintegration of walls and the resultant flying debris. 
Rausch, Thao and Rowley (1977) review explosion damage 
to various types of structure, including frame structures, 
low office blocks and warehouses. They also give data from 
Pickering and Bockholt (1971) on explosion damage to 
process storage such as floating roof tanks, vertical pres¬ 
sure vessels and spherical tanks. The damage levels are 
quoted at 20% (structural damage) and 99% (total 
destruction): 


Damage level (%) 

Peak overpressure 


(psi) 

(N/m 2 ) 

Steel floating roof petroleum tank 


20 

3.5 

24,132 

99 

20.0 

137,895 

Vertical cylindrical steel pressure vessel 


20 

12.0 

82,737 

99 

14.0 

96,527 

Spherical steel petroleum tank 
20 

8.0 

55,158 

99 

16.0 

110,316 


A description of the effects of the overpressure in the 
Flixborough explosion has been givenby Sadee, Samuels and 
O’Brien (1976-77). Among the installations at Flixborough 
were some storage tanks which were situated about 250 m 
from the epicentre of the explosion and were severely 
damaged. It is estimated in the First Canvey Report (HSE, 
1978b) that, assuming an explosion equivalent to 20-30 t 
of TNT, the tanks would have been subjected to an 


overpressure of about 0.1 bar. This overpressure for tank 
failure is used in the report. 

A further account of overpressure damage to various 
items of plant and transport equipment is given in the 
study by Gugan (1979). 

There is a considerable amount of other data on the effect 
of air blast on buildings. An overpressure of 1 psi is suffi¬ 
cient to cause partial demolition, whilst one of 10 psi 
usually causes total destruction. 

Table 17.44 is another damage table, given by Scilly and 
High (1986) for use in estimating damage for explosions 
with yields in the range 1 —100 te TNT equivalent. The pre¬ 
ferred approach of these authors is use of R-W or P-I 
methods, but the table is given for use where data in those 
forms are not available. The provision of separate data for 
explosions of different sizes makes some allowance for 
factors other than overpressure. 

A further damage table is given by the CCPS (1994/15). 


17.32.7 R-W correlations 

An approach to the correlation of structural damage from 
blast waves now increasingly preferred is the use of a 
distance-charge, or R-W, correlation. Discussions of the 
use of the R-W method are given by W.E. Baker et al. (1983) 
and Scffly and High (1986). 

The R—W method was effectively used by C.S. Robinson 
(1944) in his correlation of damage effects. He gives various 
limits of damage for the explosion of a 100,000 lb charge of 
high explosive. Some of these are shown in Table 17.45 
together with the equivalent scaled distance R/W 1/3 . 

Extensive work on the correlation of structural damage 
to buildings has been done by the Explosives Storage and 
Transport Committee (ESTC) in the United Kingdom. The 
aim of the work was the setting of safety distances for the 


Table 17.44 Some damage effects produced by a blast wave - 3 (Scilly and High, 1986) (Courtesy of Societe de 
Chimie Industrielle; reproduced with permission) 


Structural element 

Failure mode 

Peak side 

lte 

-on overpressure a (approximate) (psi) 
at different explosive charge 

10 te 100 te 

Window frames 

5% broken 

0.15 

0.1 

0.1 


50% broken 

0.36 

0.24 

0.21 


90% broken 

0.9 

0.6 

0.54 

Houses 

Tiles displaced 

0.64 

0.42 

0.38 


Doors and window frames 

Frames may be blown in 

1.3 

0.86 

0.77 


Category D damage 

0.71 

0.44 

0.42 


Category Ca damage 

1.8 

1.15 

1.10 


Category Cb damage 

4.0 

2.4 

2.3 


Category B damage 

11.5 

5.2 

5.0 


Category A damage 

26.5 

11.5 

11.0 

Telegraph poles 

Snapped 

52 

26 

24 

Large trees 

Destroyed 

57 

26 

24 

Primary missiles 

Limit of travel 

0.2 

0.14 

0.12 

Rail wagons 

Limit of derailment 

26.5 

11.5 

11.0 


Bodywork crushed 

20 

8.7 

8.4 


Damaged but easily 
repairable 

11.5 

5.7 

5.5 


Superficial damage 

4.6 

2.6 

2.5 

Railway line 

Limit of destruction 

205 

97 

93 


a All distances (and equivalent overpressures) are measured to the furthest point of the structure from the explosion source. 
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storage of explosives. The work has been described by 
Jarrett (1968). 

The classification of housing damage used by Jarrett is 
shown in Table 17.46(B). Jarrett gives the following equation 
for the determination of the average circle radius for each 
damage category: 


kW V 3 

,[.i 4- (jmjWff 6 


[17.32.39a] 


Table 17.45 Some limits of the effects of the explosion 
(charge weight 100,0001b) of a high explosive charge (after 
C.S. Robinson, 1944) 


Effect 

Limit of 
effect (ft) 

Scaled 
distance 
r/W 1 ' 3 
(ft/lb 1/3 ) 

Minor damage, inner zone 

1,000 

21.5 

Average serious damage 

1,180 

25.4 

Earthquake damage, normal 

2,100 

45.2 

ground 



Average missile flight 

5,000 

108 

Minor damage outer zone 

10,000 

215 

Average glass breakage limit 

100,000 

2150 


where R is the average circle radius for the specified 
damage category (ft) and JTis the mass of explosive inTNT 
equivalents (lb). The constant k has the values shown in 
Table 17.47(A). An alternative formulation is to express the 
circle radius in terms of the RB value, or ratio of the radius 
to the radius PB for the B damage category, and these ratios 
also are given in Table 17.47(A). In SI units, Equation 
17.32.39a becomes 


kW 1 / 3 

'I + (3173, W i' Kv 


[17.32.39b] 


where R is the distance (m) and W is the mass of explo¬ 
sive (kg). The corresponding values of k are given in 
Table 17.47(B). 

The average circle radii define idealized circles for which 
for a particular damage category the area of houses which 
suffer that damage outside the circle is balanced by the 
area of those which do not suffer such damage inside the 
circle. Definitions of housing damage circles are con¬ 
sidered further in Section 17.33. 

The use of the R-W method for the correlation of blast 
damage fromVCEs in theTNO correlation model has been 
described in Section 17.28. 


17.32.8 P-l diagrams 

The other preferred approach to the correlation of blast 
damage is the use of the pressure-impulse, or P-I, diagram. 


Table 17.46 Housing damage categories 


A Wartime damage categories (Ministry of Home Security, 1945) 

A Complete demolition 

B Partial demolition - houses not repairable and will need to be demolished 

C Houses so badly damaged as to be uninhabitable, but are repairable 

D Houses not so badly damaged as to be uninhabitable, but sufficiently so as to cause appreciable discomfort 
or inconvenience 

Beyond D damage area, there will be considerable amount of minor damage to roof coverings, odd windows, etc. 

B Jarrett damage categories (Jarrett, 1968) 

A Almost complete demolition 

B 50-75% external brickwork destroyed or rendered unsafe and requiring demolition 

Cb Houawa uninhabitable - partial or total collapse of roof, partial demolition of one to two external walls, severe 
damage to load-bearing partitions requiring replacement 

Ca Not exceeding minor structural damage, and partitions and joining wrenched from fittings 

D Remaining inhabitable after repair - some damage to ceilings and tiling, more than 10% window panes broken 

C Damage categories given by Scilly and High (1986) 

A House completely demolished, i.e. with over 75% of the external brickwork demolished 

B Houses so badly damaged that they are beyond repair and must be demolished when opportunity arises. Property is 

included in this category if 50-75% of the external brickwork is destroyed, or in the case of less severe destruction 
the remaining walls have gaping cracks rendering them unsafe 

Cb Houses which are rendered uninhabitable by serious damage, and need repairs so extensive that they must be 

postponed until after the war. Examples of damage resulting in such conditions include partial or total collapse 
of roof structures, partial demolition of one or two external walls up to 25% of the whole, and severe damage to 
load-bearing partitions necessitating demolition and replacement 

Ca Houses that are rendered uninhabitable, but can be repaired reasonably quickly under wartime conditions, the 
damage sustained not exceeding minor structural damage, and partitions and joinery wrenched from fixings 

D Houses requiring repairs to remedy serious inconveniences, but remaining habitable. Houses in this category may 
have sustained damage to ceilings and tilings, battens and roof coverings, and minor fragmentation effects on 
walls and window glazing. Cases in which the only damage amounts to broken glass in less than 10% of the 
windows are not included 
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Table 17.47 Constants and RB distances for the 
Jarrett equation 


Damage category Constant, k 

RB ratio 

A 

Eauation constants (British units) and RB 
ratios (Jarrett, 1968) 

A 

9.5 

0.675 

B 

14 

1 

Cb 

24 

1.74 

Ca 

70 

5 

D 

140 

10 

B 

Equation constants (SI units) and RB ratios 
(after Jarrett, 1968) 

A 

3.8 

0.675 

B 

5.6 

1 

Cb 

9.6 

1.74 

Ca 

28 

5 

D 

56 

10 

C 

Equation constants (SI units) and RB ratios 
(Gilbert, Lees and Scilly, 1994c) 

A 

4.8 

0.675 

B 

7.1 

1.00 

Cb 

12.4 

1.74 

Ca 

21.3 

3.0 

D 

42.6 

6.0 


A P-I diagram given by W.E. Baker etal. (1983) for some 
of the Jarrett damage categories is shown in Figure 17.93. 
This diagram is considered further in Section 17.33. 

The use of the P-I diagram method is inhibited by 
the fact that there are few P-I diagrams available in the 
literature. 

17.32.9 Window damage 

The shattering of glass is an important blast damage effect, 
since flying glass can cause severe injury. It is considered 
in Section 17.40. 


17.33 Explosion Damage to Housing 

Explosion damage to housing is usually expressed in the 
form of distance-charge, or R-W, relations or of pressure- 
impulse, or P-I, relations. In the description just given of 
these two methods the application considered is housing 
damage. 

The ESTC, or Jarrett, equation (Equation 17.32.39a) has 
for some decades held the field as the principal method of 
determining housing damage, but within the last decade 
several proposals have been made for the modification of 
this basic R-W correlation or its associated P-I diagram, 
including the work of Scilly and High (1986) and Gilbert, 
Lees and Scilly (1994b,c). 

Before considering this more recent work it is appro¬ 
priate to consider the background to the Jarrett equation. 

17.33.1 Housing damage categories 

During the Second World War it became the practice in the 
United Kingdom to assign air raid housing damage to the 
categories A, B, Cb, Ca and D. 


There are several definitions of these categories, as 
shown in Table 17.46. Table 17.46(A) gives the definitions 
used in report S104, one of the wartime reports of the Min¬ 
istry of Home Security (1945). A slightly different set of 
definitions is given in the paper byjarrett (1968) describing 
explosives safety distances as shown inTable 17.46(B). Table 
17.46(C) from Scilly and High (1986), contains further 
amplification of the definitions. 

Some wartime reports use an undifferentiated C damage 
category to describe Cb damage. 


17.33.2 Philip equation 

In an analysis of wartime damage the following equation 
was derived in a Ministry of Works report REN 558 by 
Philip (1945) for the distance pb lor B category damage. In 
the original British units the equation is 


14 W 1 / 3 

[1 + (7000/ PEfp 


[17.33.1a] 


where R is the distance (ft) and ITis the mass of explosive 
(lb). In SI units this equation is 


5.61F 1 / 3 

[1 + (3175/JE) 2 ] 1/6 


[17.33.1b] 


where R is the distance (m) and ITis the mass of explosive 
(kg). The mass of explosive is quoted as theTNTequivalent. 
This equation was adopted as a standard. 

Gilbert, Lees and Scilly (1994c) have reviewed the basis 
of Equation 17.33.1a as described by Philip (1945). They 
conclude that although she referred to the mass of explo¬ 
sive in several weapons and incidents in terms of the TNT 
equivalent, she appears to have used in the equation a mass 
of explosive W which is the actual mass of explosive and to 
have based the equation on data for SC bombs, all of which 
had the same charge/weight ratio, so that strictly speaking 
the equation is applicable only to this family of weapons. 
For other weapons she gives a set of calibration constants, 
or correction factors. 

Equation 17.33.1a was effectively endorsed in a report to 
the ESTC by Healy (1959), who applied it to a large number 
of incidents. 


17.33.3 Jarrett equation 

The paper by Jarrett (1968), already mentioned, was the 
first open publication of, and gave wider currency to, 
Equation 17.33.1a. He also gave explicit constants for the A, 
Cb, Ca and D damage categories. In British units, Jarrett’s 
equation is 


kW V 3 

[l + (7000/Jfjy 


[17.33.2a] 


where R is the distance (ft) and IEis the mass of explosive 
(lb). In SI units this equation is 


kW V 3 

'I-MSI75 fti’’ 6 


[17.33.2b] 


where R is the distance (m) and W is the mass of explosive 
(kg). Equation 17.33.2a is frequently referred to as the 















17/194 EXPLOSION 



T type 3 
■ type 4 


Figure 17.93 Damage effects of explosions: P-i diagram for housing damage - 1 (after W.E. Baker etal., 1983; Merck, 
Weerheijm and Verhagen, 1993). Curves are those given by the first set of authors and are as follows: curve 1, threshold 
for minor structural damage; curve 2, threshold for major structural damage; and curve 3, threshold for partial demolition. 
Experimental points are those given by the second set of authors and refer to the percentage damage (expressed as 
building costs) for house types 1-4: type 1, two-floor wooden house; type 2, two-floor masonry house; type 3, single-floor 
wooden house; and type 4, two-floor masonry house 


Jarrett equation. The values of the constant k given in 
British units by Jarrett and the SI equivalents are given in 
Table 17.47 (A) and (B) respectively. The RB ratios are also 
given. 

Equation 17.33.2a was given by Jarrett in a paper on explo¬ 
sives safety distances. He states that his equation is derived 
from an analysis by the ESTC of 24 well-documented explo¬ 
sions and from the study of records of explosions dating 
from 1871 and from the experience of enemy bombing in the 
United Kingdom. He also mentions another examination hy 
the ESTC of 110 reports of accidental explosions. He further 
states that the quantity of explosive involved ranged from 
300 lb to 5.3 million lb, and the types of explosive included 
dynamite, TNT, Torpex and guncotton. However, Jarrett 
seemingly overlooked the fact that Equation 17.33.1a was 
derived for the specific case of SC bombs. The effect of this 
is that Equation 17.33.2a purports to apply to weapons in 
general but does not in fact allow for the effect of the weapon 
casing on the blast potential. 

With regard to the constants quoted by Jarrett, these 
appear to derive from the paper by Healy. Copies of this 
paper contain hand-written notes suggesting values of the 
constants for all the damage categories (A-D). For A, B and 
Cb damage these values are those of Philip. The latter 
does not, however, give values for Ca and D damage. 
The values for Ca and D damage of R B = 5 and i? B = 10, 


respectively, quoted by Jarrett, are evidently taken from the 
hand-written notes in Healy’s paper. In the text of this 
paper, however, these R B values refer to window breakage 
rather than housing damage. 

Summarizing, the Jarrett equation - Equation 17.33.2a - 
is in effect the Philip equation - Equation 17.33.1a - as 
endorsed by Healy, but with extensions to other damage 
categories as just described. 

17.33.4 Housing damage circles 

The radius used in Equation 17.33.2 is the average circle 
radius (ACR) for the damage category. It is defined as 
the radius of the circle such that the number of houses 
inside the circle which do not suffer the defined degree of 
damage is balanced by the number outside which do; this 
radius is denoted here as Rioo/o- Use is sometimes made of 
another radius, R 50 , the radius at which there is a 50% 
probability of a defined degree of damage. Conceptually, 
these two radii are quite distinct. In practice, they will 
often have similar numerical values. They converge where 
the intensity of the physical phenomenon decays rapidly 
and where its effect on the target passes through a narrow 
zone from 0 to 100% effect. A quantitative treatment has 
been given by Lees, Poblete and Simpson (1986). 

It is convenient to mention at this point another method 
of expressing housing damage. This is the use of the 
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following relation to obtain from the observed values of R A , 
Rb and Rc an average value Rb: 


3 \0.6: 


[17.33.3] 


17.33.5 Model of Gilbert, Lees and Scilly 

A revision of the Jarrett equation has been undertaken by 
Gilbert, Lees and Scilly (1994b,c), based on analysis of the 
original wartime documents for damage from bombs, V-l 
flying bombs and V-2 rockets. 

These authors first analyse the effective charge of the 
various weapons used, allowing for the particular explo¬ 
sive filling and for the effect of the casing. They then ana¬ 
lyse the damage done by each type of weapon. 

From this analysis they conclude that for B category 
damage the value of the constant k to be used in Equation 
17.33.2b in SI units should be 7.1 instead of 5.6. They also 
give revised values of the constant for the other damage 
categories, as shown in Table 17.47(C). 

It may be noted that whereas the k values for A, B and Cb 
category damage are somewhat higher than those given by 
Jarrett, the values for Ca and D damage are less. The KB 
values for A, B and Cb damage are the same but those for Ca 
and D damage are less. These latter values agree with those 
proposed by Scilly and High (1986) in an earlier critique. 

The model of Gilbert, Lees and Scilly is therefore 
Equation 17.33.2b with the constants given inTable 17.47(C). 
In terms of the Rb distance this equation is 


7.1JT 1 / 3 

§t+ (3175/flW* 


[17.33.4] 


where R is the distance (m) and W is the mass of explo¬ 
sive (kg). 

Some characteristics of the revised equation are illus¬ 
trated inTable 17.48. 


17.33.6 P-I diagrams 

The housing damage correlations just given are R—W cor¬ 
relations. As described above, it is also possible to correlate 
housing damage in terms of a P-I diagram. 

The P-I diagram for housing damage based on the 
Jarrett equation given by W.E. Baker et al. (1983) has been 
given above as Figure 17.93. This diagram is reproduced in 
the Green Book. 

This same diagram has been quoted by Mercx, 
Weerheijm and Verhagen (1991), who have plotted on it data 


from experimental tests detailed by Glasstone and Dolan 
(1980).These data also are shown in Figure 17.93.The figure 
shows iso- damage curves for B, Cb and Ca category damage. 

The corresponding P-I diagram given by Gilbert, Scilly 
and Lees, constructed from the data inTable 17.48, is shown 
in Figure 1794. The figure shows iso-damage curves for A, 
B and Cb category damage. 

In Figure 17.94, the influence of the two variables, peak 
overpressure and impulse, may be examined by moving 
orthogonally from a curve for a category of less severe 
damage to that for the next most severe category. The iso¬ 
damage curves have peak overpressure and impulse 
asymptotes. On the right-hand side of the diagram, in the 
region of lower charge weights, the curves exhibit impulse 
symptotes. In moving orthogonally from a lower damage to 
a higher damage curve, there is an increase in impulse but 
not in overpressure. In other words, in this region an 
increase in damage occurs due to an increase in impulse. By 
contrast, in the top left region of the diagram, that of higher 
charge weights, the curves exhibit overpressure asymp¬ 
totes. In moving orthogonally from a lower damage to a 



Figure 17.94 Damage effects of explosions: pressure- 
impulse (P-I) diagram for damage - 2 (Gilbert, Lees and 
Scilly, 1994c) 


Table 17.48 Housing damage model of Gilbert, Lees and Stilly: some characteristics of the model a (Gilbert, Lees and 
Scilly, 1994c) 


Effective charge (kg) 

Rb distance (m) 

Scaled distance (m/kg 1/3 ) 

Peak overpressure (Pa) 

Impulse (Pa s) 

100 

10.4 

2.24 

2.19 x10 s 

606 

200 

16.5 

2.82 

1.32x10® 

609 

500 

30.3 

3.82 

0.717x10® 

614 

1,000 

47.6 

4.76 

0.473x10® 

623 

2,000 

72.5 

5.76 

0.340x10® 

650 

5,000 

115 

6.71 

0.266x10® 

759 

10,000 

151 

6.99 

0.250x10® 

917 

20,000 

192 

7.07 

0.245x10® 

1140 


1 Revised equation for 


of damage circle equation for B damage. 
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higher damage curve, there is an increase in overpressure 
but not in impulse. In other words, in this region an 
increase in damage occurs due to an increase in over¬ 
pressure. Transition occurs in the region where the charge 
weights are between 2000 and 5000 kg. 

Thus, for many charge weights of interest both peak 
overpressure and impulse are relevant. For this reason 
housing damage is correlated by Gilbert, Lees and Stilly 
directly in terms of charge weight rather than in terms of 
overpressure. 

For the same reason they take the scaled distance 
appropriate to housing damage as 

s! =s ——- * [17.33.5] 

W 1 ' 3 [l+ (3175/JF) 2 ] 176 

where z' is a modified scaled distance (m/kg 1/3 ). 

17.34 Explosion Damage by Missiles 

If the explosion occurs in a closed system, fragments of the 
containment may form missiles. In addition, objects may 
also be turned into missiles by the blast. 

Accounts of missiles are given in Explosions, Their 
Anatomy and Destructiveness (C.S. Robinson, 1944), Struc¬ 
tural Defence (Christopherson, 1946), the Textbook of Air 
Armaments (Ministry of Supply, 1952) and Explosion 
Hazards and Evaluation (W.E. Baker et al,. 1983) and by 
V.J. Clancey (1972b), Jensen (1972), W.E. Baker et al. (1975, 
1978), Holden and Reeves (1985) and Pietersen (1985). 

Brown (1985) reviewed studies on blast and fragmenta¬ 
tion of pressurized vessels. 

Much of the early work on missiles relates to artillery 
and other projectiles. Basic work in the field is described 
by Didion (I860), Helie (1884), Petry (1910) and Cranz 
and Becker (1921). Further work by the military on ballis¬ 
tics includes that of Gurney (1943,1946). Other data derive 
from civil defence work such as that of Christopherson 
(1946). 

Studies have also been made of missiles from the burst¬ 
ing of gas filled vessels in relation to aerospace systems and 
nuclear power plants. These include work by D.E. Taylor 
and Price (1971), Pittman (1972a,b, 1976), Bessey (1974), 
Bessey and Kulesz (1976), W.E. Baker et al. (1975,1978) and 
Garrison (1975). 

A significant source of large missiles in process plant 
incidents is BLEVEs. Studies of the missiles from such 
sources have been described by Holden and Reeves (1985) 
and Pietersen (1985). 

17.34.1 Some incidents involving missiles 

The generation, size and range of missiles, and the damage 
which they can cause, have already been discussed to some 
extent above, mainly in relation to BLEVEs. 

Table 17.49 gives some major incidents which involved 
either escalation by missiles or near misses. 

17.34.2 Sources, types and generation of missiles 

Missiles are generally classified as primary and secondary. 
Primary missiles are those resulting from the bursting of a 
containment so that energy is imparted to the fragments 
which become missiles. Secondary missiles occur due to 
the passage of a blast wave which imparts energy to objects 
in its path, turning them into missiles. Missiles from the 


bursting of a wall due to an internal explosion are treated 
here as primary missiles. 

Accounts of the source, types and generation of primary 
missiles include those of Ardron, Baum and Lee (1977), 
J.H. Bowen (1980), Munday (1980), Porter (1980),Tulacz and 
Smith (1980) and WE. Baker et al. (1983). 

As far as concerns primary missiles from plant, three 
cases are commonly distinguished: case 1, bursting of a 
vessel into a large number of relatively small fragments; 
case 2, separation and rocketing of a vessel or vessel end; 
case 3, ejection of a single item. 

17.34.3 Vessel burst pressure 

The explosion energy imparted to fragments in a vessel 
burst is a function of the initial pressure. The various dif¬ 
ferent scenarios for vessel burst pressure have been dis¬ 
cussed in Sections 17.27 and 17.29. 


17.34.4 Number and size of missiles 

The number of missiles formed in an explosion involving 
rupture of a containment varies widely. At one extreme is 
the bursting of a weapon such as high explosive shell or 
grenade which normally gives a large number of fragments. 
Large numbers of missiles are also produced by fragmen¬ 
tation of a gas filled pressure vessel. At the other extreme is 
the ejection of a single item such as a valve component due 
to failure in a high pressure system. 

Of particular interest here is rupture of a pressure vessel. 
This may involve either brittle or ductile fracture. The dif¬ 
ferences between these two modes of failure are discussed 
by Tulacz and Smith (1980). In general, failure is more likely 
to be ductile. Ductile failure does not usually produce mis¬ 
siles, but if it does they are likely to be small in number but 
may have potential to do severe damage. It is brittle fracture 
which is most likely to produce failures in which quite a 
large number of fragments are generated. 

Failure of a vessel may occur under normal pressure 
loading due to an existing defect or to weakening or it may 
occur under abnormal pressure such as excessive gas 
pressure or hydrostatic pressure due to liquid expansion or 
explosion pressure due to combustion or reaction runaway. 

In a cylindrical vessel the initiating crack is typically in 
the axial direction, but there is a tendency for this crack to 
turn and propagate circumferentially. 

As already stated, for rupture of a gas filled vessel, two 
main modes are distinguished: (1) bursting into a large 
number of fragments and (2) separation into two parts. In 
the former case it is a common assumption that the frag¬ 
ments all have the same mass. 

If more refined information is available, it may be corre¬ 
lated as a fragment mass distribution. Methods of correla¬ 
tion are discussed in Section 17.36. 

There is some limited information available on the num¬ 
ber of fragments formed in the bursting of pressure vessels. 
W.E. Baker et al. (1978) have compiled data on the number 
and size distribution of fragments for 25 accidental bursts 
as shown in Table 17.50. The corresponding fragment mass 
distributions for some of the event groups are shown in 
Figure 17.95. 

Another such compilation is that of Stilly and Crowther 
(1992). This work is described in Section 17.34.21. 

For BLEVEs, Schulz-Forberg, Droste and Charlett (1984) 
have described tests on fire engulfed vessels, one output 
from which is plots of the fall of fragments. 
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Table 17.49 Some incidents involving escalation, or near misses, by missiles 


Marrietta, OH, 1962 

Benzene vapours from a 6 in. relief valve on a phenol plant ignited and an explosion occurred. Flying debris ruptured 
pipework, releasing flammable liquids. 

Louisville, KY, 1965 

A compressor circulating gaseous monovinylacetylene exploded. Fragments from the explosion, together with jet flames 
and transmission through piping, led to a series of further explosions. 

Feyzin, France, 1966 

A refinery storage sphere suffered a BLEVE, throwing pieces of steel up to 100 tons some three quarters of a mile. One 
fragment cut the legs from under an adjacent sphere, toppling it and breaking its 8 in. connecting pipe. Another landed 
on a pipeway and severed 40 lines. 

Texas City, TX, 1969 

A100 ft high refinery column disintegrated, apparently due to detonation of vinyl acetylene. Pieces were distributed 
uniformly over a radius of 1500 ft. One section weighing some 800 lb travelled 3000 ft. 

Romeoville, IL, 1977 

Roof fragments from an exploding cone roof tank in a refinery struck a covered floating roof tank and a floating roof tank, 
both of which ignited. 

Abqaiq, Saudi Arabia, 1978 

Jetting effects of gas escaping from a pipeline threw a 22 ft pipe section 400 ft, where it struck the vapour space of a storage 
spheroid and released further flammable vapour. 

Texas City, TX, 1978 

Rupture of a refinery storage sphere due to overpressure led to a large vapour cloud fire. This set off a series of BLEVEs 
which generated numerous missiles, causing further vessel failures. In addition the original sphere, two further 
spheres, five horizontal bullets and four vertical bullets were destroyed. 

BantryBay, Eire, 1979 

Explosions on an oil tanker at the jetty generated numerous missiles. One fragment weighing 1000II was found at the foot 
of a large crude oil storage tank 1800 ft from the ship. 

Linden, NJ, 1979 

Avapour cloud entered an unused control room. When the cloud exploded, debris from this building severed pipes, 
releasing more hydrocarbons. 

Ponce, Puerto Rico, 1979 

A 13 ft diameter dimerizer vessel suffered massive failure. The 15 ton steel end travelled 1900 ft and struck an adjacent 
paraxylene plant, setting it on fire. 

Mexico City, Mexico, 1984 
See Appendix 4. 

Romeoville, IL, 1984 

A massive failure occurred of a 55 ft high x8 ft diameter refinery absorption column. Most of the vessel was propelled 
3500 ft where it struck and toppled a 138 kV power transmssion tower. Later in the incident, a piece of a vessel which had 
suffered a BLEVE travelled 500 ft. shearing off pipes. 

Pascagoula, MS, 1986 

Fragments, from an explosion in the area of a batch still, punctured two atmospheric storage tanks and a pressure storage 
vessel, releasing flammable material. 

Grangemouth, UK, 1987 

Overpressure of a low pressure separator due to gas ‘breakthrough’ caused the 30 ft high times 10 ft diameter vessel to 
disintegrate. One piece weighing 3 tons was thrown 3300 ft. 

Torrance, CA, 1987 

A propane treater vessel failed and rocketed into a central pipe rack, cutting several pipes, including the refinery flare 
lines. 

Antwerp, Belgium, 1989 

An explosion on an ethylene oxide distillation column caused a large fire and generated missiles which caused extensive 
damage throughout the plant 
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Table 17.50 Behaviour of fragments in some vessel explosions - 1 (W.E. Baker et al., 1978) 


group 

No. of 
events 

Material 

Source 
energy (J) 

Vessel details 


No. of 
fragments 



Shape 

Mass (kg) 

i 

4 

Propane, anhydrous 
ammonia 

1.49-5.95 x 10 5 

Rail tank car 

25,542-83,900 

14 

2 

9 

LPG 

3814-3921 

Rail tank car 

25,464 

28 

3 

1 

Air 

5.2 x 10 11 

Cylinder pipe and spheres 

145,842 

35 

4 

2 

LPG, propylene 

550 

Semitrailer (cylinder) 

6,343-7,840 

31 

5 

3 

Argon 

244-1133 x 10 10 

Sphere 

48.3-187 

14 

6 

1 

Propane 

24.8 

Cylinder 

512 

11 


(a) 



Mass, M (kg) 


(b) 



Mass, M (kg) 


Figure 17.95 Missile effects of explosions - fragment mass distribution from some accidental events (W.E. Baker etal., 
1978): (a) event groups 2 and 3 and (b) event group 6 
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A specific study of fragments from BLEVEs has been 
made by Holden and Reeves (1985). For non-fire events they 
found that there were three events which gave one fragment, 
one giving two fragments, one giving three fragments, two 
giving four fragments and one giving seven fragments. 
Further information is given in Section 17.34.19. 

17.34.5 Initial velocity of missiles 

There are a number of different approaches to the estima¬ 
tion of the initial velocity of a missile. They include con¬ 
sideration of (1) the force or pressure on the missile, (2) the 
transfer of momentum to the missile, and (3) the transfer of 
energy to the missile. 

The force acting on a missile depends on the scenario. 
Considering first the rupture of a pressure vessel contain¬ 
ing gas, the overpressure may occur due to a slow applica¬ 
tion of pressure or due to an explosion which gives a very 
high rate of pressure rise. The bursting of the vessel gives 
rise to a shock wave. In principle, there are two forces which 
act to accelerate the fragments from the vessel. One is the 
differential between the gas pressure and the ambient 
pressure. The other is the dynamic pressure, or wind. In 
practice, as described below, the pressure differential acts 
only for a very short time, and the acceleration of the frag¬ 
ments is due essentially to the dynamic pressure. 

Another scenario is the rupture of a partition wall by an 
explosion. Again, the forces acting on the fragments from 
the wall are the pressure differential between the front face 
of the wall and the ambient pressure and the dynamic 
pressure. In principle, if the pressure incident on the wall is 
that of a rapidly rising blast wave and the wall configura¬ 
tion is such that the pressure differential across it persists 
until the wall ruptures, the relevant pressure is the reflected 
pressure. If, on the other hand, the pressure on the wall 
rises relatively slowly, the pressure differential is simply 
that between that pressure and the ambient pressure. In 
practice, in either case, the pressure differential again 
usually acts only for a very short time and the acceleration 
of the fragments is due mainly to the dynamic pressure. 

Another approach for the bursting of a gas filled vessel is 
to estimate the fraction of the available energy which is 
converted into the kinetic energy of the fragments. This 
approach echoes that used in the treatment of fragments 
from weapons. 

For the ejection of an item such as a valve spindle by a 
high pressure jet of fluid, an approach based on conserva¬ 
tion of momentum is convenient. 

Some of the methods for the estimation of missile accel¬ 
eration and initial velocity are now considered. 

17.34.6 Initial velocity of missiles: fragmentation of a 
gas filled vessel 

For missile acceleration and initial velocity, the first case 
considered (case 1) is that of the bursting of a gas filled 
vessel into a large number of fragments. Accounts of this 
include those of C.V. Moore (1967), D.E. Taylor and Price 
(1971), Ardron, Baum and Lee (1977), Munday (1980) and 
Baum (1984, 1987). Experimental work is described by 
Glass (1960) and Pittman (1972a,b). 

An account of the initial velocity of fragments from ves¬ 
sels has been given by Ardron, Baum and Lee (1977). They 
distinguish two main fundamental treatments, one based 
on the stored energy and the other on fluid mechanics. The 
models of C.V. Moore (1967) and Munday (1980), given in 
Sections 17.34.7 and 17.34.8, respectively, exemplify these 


two approaches. Another family of methods, also based on 
fluid mechanics, has developed from a model of D.E. Taylor 
and Price (1971), who studied the rocketing of the two 
hemispheres from the symmetrical rupture of a sphere. 
This work was developed by Bessey (1974), Bessey et al. 
(1976) and W.E. Baker et al. (1978), who extended it, respec¬ 
tively, to cases of spheres giving more than two equal 
fragments, cylinders giving multiple equal fragments 
and both spheres and cylinders giving multiple unequal 
fragments. 

This work has indicated that the fraction of the energy of 
explosion which translates to kinetic energy of the frag¬ 
ments is relatively low. A more realistic model of this energy 
has been developed by Baum (1984), as described in 
Section 17.34.9. 

A variant of the problem of the bursting of a gas filled 
vessel is the rupture of a pipe. Since the pipe is usually part 
of a pressure system to which it is connected, it is much 
less easy in this case to define the relevant available fluid 
energy. 


17.34.7 Initial velocity of missiles: Moore model 

In the stored energy, or energy partition, method the initial 
kinetic energy, and velocity, of the fragments is obtained 
from the energy stored in the vessel. This method has been 
used by CV Moore (1967).The stored energy is obtained by 
methods such as those given in Section 17.4. Then 

^ = EfM t [17.34.1] 

where E t is the energy stored in the vessel per unit mass of 
fluid, Mf is the mass of fluid stored, M w is the mass of the 
vessel itself and U\ is the initial velocity of the fragment. 
Then 


«i = (2E[Mi/M w ) 1/2 [17.34.2] 

The assumption underlying Equation 17.34.1 is that all the 
fragments have the same velocity. Some support for this is 
given in the observations of Glass (1960) and Pittman 
(1972a) that when a vessel breaks into many pieces, frag¬ 
ments moving in different directions attain comparable 
terminal velocities. 

Moore has also given for the initial velocity of fragments 
from vessels semi-empirical formulae which are extensions 
of the well-known formula of Gurney (1946) for the initial 
velocity of fragments from a cased explosive. His formula is 


m ; = IliEtK ) 1 ' 2 
with 

K M i 

ikfv(l + 3Mf/5M v ) 


sphere 


[17.34.3] 

[17.34.4] 


where A is a geometric factor. 
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Ardron, Baum and Lee have compared the predictions 
of Equations 17.34.2 and 17.34.3 with experimental results 
for the bursting of a sphere containing superheated water. 
For this case, Equations 17.34.2 and 17.34.3 overestimate 
the measured fragment velocities by factors of 5 and 4, 
respectively. In other words, in this case only about 3% of 
the fluid energy is imparted to the fragments. 

The relations for the available energy of fluid filled ves¬ 
sels given in Section 17.4 yield results which show that the 
available energy of a gas filled vessel exceeds by an order of 
magnitude that of a similar liquid filled vessel. Hence, the 
above result for the water filled vessel is not unexpected. 
However, Ardon, Baum and Lee also report that even for a 
gas filled vessel agreement between the measured veloc¬ 
ities and the predictions of Equation 17.34.2 was only 
slightly better than for the water filled case. It would seem, 
as the authors suggest, that Equation 17.34.2 should be 
regarded as giving an upper bound on the initial velocity. 

17.34.8 Initial velocity of missiles: Munday model 

An alternative approach based on the fluid mechanics of 
the shock wave has been described by Munday (1980). In 
this model the process of acceleration is envisaged as 
occurring in the following way. When the vessel ruptures, 
there is a phase in which the fragment is accelerated by the 
pressure differential between the gas and the surrounding 
air, but the duration of this phase is very short, being 
related to the time for a sound wave to traverse the frag¬ 
ment. Thus, the fragment is surrounded by moving gas 
before an appreciable increase in velocity has occurred. 

The acceleration is caused by the dynamic pressure, 
or wind. The equation of motion of the fragment may be 
written as 

m^ = CoAp e {u g -u) 2 [17.34.6] 

where A is the mean presented area of the fragment, C D is 
the drag coefficient, m is the mass of the fragment, u is the 
velocity of the fragment, u g is the velocity of the surround¬ 
ing gas and p g is the density of that gas. 

The velocity of the surrounding gas is related to that of 
the shock front. This latter velocity is determined using an 
empirical model. The velocity of the surrounding gas is 
then obtained assuming that it falls linearly from that at 
the shock front to 0 at a distance halfway between the shock 
front and the centre of the vessel. 

Methods are available for the characterization of the 
shock front in the bursting of a vessel. Brinkley and 
Kirkwood (1961) have given a theoretical model. Ardron, 
Baum and Lee (1977) have plotted the experimental results 
on bursting of gas filled vessels of Larsen and Olson (1957) 
and Pittman (1972a) to show the extent to which they fit a 
TNT equivalent model; the fit is fair with considerable 
scatter. 

17.34.9 Initial velocity of missiles: explosion energy 

Expressions for the energy of explosion in a vessel burst are 
given in Section 17.4. The two principal relations are the 
Erode equation (Equation 17.4.29) and the Baker equation 
(Equation 17.4.31). 

However, it is apparent from the foregoing that only a 
fraction of the energy of explosion appears as kinetic 
energy of the fragments. This has long been appreciated. 


Various estimates of this fraction are available in the 
literature. Those given in the High Pressure Safely Code 
have been quoted in Section 17.4. Another value given by 
Porter (1980) is some 5-10%. 

The above problem has been addressed by Baum (1984), 
who takes as his starting point the Baker equation 
(Equation 17.4.31), written in the form 

P, V, 

E k = fjAlLl [17.34.7] 

7i-l 

with 

*«=!-(£) [ 17 - 34 . 8 ] 

whereE k is the explosion energy imparted to the fragments 
and k is a parameter. Baum then treats k as a constant to be 
evaluated. From experimental data reported in the litera¬ 
ture he found the value of k to vary between 0.2 and 0.5. On 
this basis the CCPS (1994/15) proposes that for rough initial 
calculations a value of k = 0.2 be used. 

As stated, the foregoing applies to a vessel filled with an 
ideal gas. As described in Section 17.4, if this is not the case, 
the energy of explosion is affected. If the fluid is not an 
ideal gas but is instead a non-ideal gas, vapour or flashing 
liquid, the energy of explosion should be obtained 
from thermodynamic data using the method given in 
Section 17.4. 

The CCPS refers to work by Wiederman (1986a,b) on 
cases involving non-ideal gases and vapour and 
vapour-liquid systems. In general, the effect of gas non¬ 
ideality is to reduce somewhat the initial velocity of the 
fragments. In some limited tests, the effect of a flashing 
liquid was found to cause some increase in fragment veloc¬ 
ity compared with an ideal gas fill. For this case the CCPS 
quotes the fraction of the energy of explosion, estimated 
from thermodynamic data, which translated to kinetic 
energy of fragments as some 20% 

17.34.10 Initial velocity of missiles: separation and 
rocketing of a gas filled vessel 

The second case (case 2) is that of the separation of a gas 
filled vessel into two parts and the rocketing of one or both 
of these. 

The two parts which separate may be two equal halves 
such as the two hemispheres of a spherical vessel or two 
unequal ones such as the end and body of a cylindrical 
vessel. In either case the rapid discharge of fluid results in a 
strong reaction force on the separating parts of the vessel. 

Models for this situation have been given by D.E. Taylor 
and Price (1971) and Tulacz and Smith (1980). 

The model of "IUlacz and Smith (1980) is a single equation 
for conservation of momentum. The authors give the fol¬ 
lowing illustration of the results obtained. For an autoclave 
of volume 0.238 m 3 and mass 3131 kg at a pressure of 
41.3 8 bara, from which the head, with area 0.114 m z and mass 
598 kg, blows off the initial discharge produces a rapid 
initial acceleration but the velocity attained is only 12m/s. 

17.34.11 Initial velocity of missiles: model of Baker et al. 

As already mentioned, another method of estimating the 
initial velocity of fragments from a vessel burst has been 
developed byW.E. Baker et al. (1975,1978), and is described 
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Figure 17.96 Missile effects of explosions - generation of missiles from vessels (W.E. Baker et al., 1983): (a) sphere 
bursting into two equal fragments; (b) cylinder bursting into two equal fragments; (c) sphere bursting into n equal 
fragments; and (d) cylinder bursting into n equal strip fragments (Courtesy of Elsevier Science Publishers) 


by W.E. Baker etal. (1983). The method covers spherical and 
cylindrical vessels breaking into two equal fragments or 
into n equal fragments as shown in Figure 17.96.The veloc¬ 
ities are obtained from a parametric study based on the 
equations of motion of the fragments, solved using a com¬ 
puter code. The results are correlated in terms of a dimen¬ 
sionless pressure P defined as 


a (P-P 0 )V° 
M ctk 


[17.34.9] 


and a dimensionless initial velocity U\ 


empirical correlations. He treat the following cases: (1) end 
cap breaking from a cylindrical vessel, (2) cylindrical vessel 
breaking into two parts in a plane perpendicular to its axis, 
(3) disintegration of a spherical or cylindrical vessel into 
multiple fragments, and (4) a single small fragment ejected 
from a vessel. The first three of these are considered here, 
and the last in the next section. 

The relations given by Baum utilize a parameter F which 
is defined as 

F = ^ .y** large no. of fragments [17.34.12] 





[17.34.10] 


p (Pi~Po)Ar 


small no. of fragments 


[17.34.13] 


flg = ( yR m T ) lf2 [17.34.11] 

where is the velocity of sound in the gas, M c is the mass 
of the vessel, p is the pressure in the vessel, p„ is atmos¬ 
pheric pressure, i? m is the mass basis gas constant, T is the 
absolute temperature of the gas, m ; is the initial velocity of 
the fragment, V a is the volume of the vessel, Fis the ratio of 
the gas specific heats and if is a constant. 

For equal-sized fragments, K is unity. The correlation 
obtained is shown in Figure 17.97(a). 

These authors also give a method of estimating the 
initial velocity of a fragment from a cylindrical vessel with 
a length/diameter, or L/D, ratio of 10 breaking into two 
unequal parts. For this case the constant K is determined 
using Figure 17.97(b). The initial velocity is then obtained 
as before from Figure 17.97(a) with this value of K and tak¬ 
ing was 2. 

The CCPS (1994/15) draws attention to some apparent 
discrepancies which cast doubt on the factor K. 

17.34.12 Initial velocity of missiles: Baum model 

Another method for the initial velocity of fragments from a 
vessel burst is that of Baum (1987), who gives a set of 


where a„ is the speed of sound, A is the area of the detached 
portion of the vessel wall, m is the mass per unit area of the 
vessel wall, m t is the mass of the fragment, P Q is the atmos¬ 
pheric pressure, Pi is the absolute initial pressure in the 
vessel and r is the radius of the vessel. 

The correlations for the three cases referred to are then 

U\ = 2aoF 0 - 5 [17.34.14] 


= 2.18a 0 [P(PA) 1/2 ] 2/3 [17.34.15] 


Mi = 0.88 floP 055 [17.34.16] 

where L is the length of the cylinder. In Equation 17.34.15 
F is obtained using A = m 2 . 


17.34.13 Initial velocity of missiles: ejection of a 
plant fitting 

The third case considered here (case 3) is the ejection of a 
fitting such as a valve stem by a high pressure jet of gas. 
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Figure 17.97 Missile effects of explosions - initial velocity of fragments from a bursting vessel (W.E. Bakeretai., 1983): 
(a) initial velocity correlation and (b) velocity adjustment factor for unequal masses (Courtesy of Elsevier Science 
Publishers) 


This is a relatively well-defined situation, and modelling 
based on fluid mechanics is appropriate. Models have been 
developed by a number of workers, including Cottrell and 
Savolainen (1965), Gwaltney (1968) and Ardron, Baum and 
Lee (1977). 

The usual approach is based on momentum transfer. The 
momentum of the jet is assumed to be transferred to the 
missile and the residual momentum of the jet is neglected. 

Gwaltney (1968) has given a number of simple analytical 
methods for particular cases of ejection of fittings by a jet 
of gas. 

Ejection of a small fragment from a cylindrical vessel 
is one of the cases treated by Baum as described in the 


previous section. For this case he gives 

/fe\ 038 

m = 2a 0 ( — j s < 0.3r; y = 1.4; 20 < Pi/P 0 < 300 

[17.34.17] 

where s is the dimension of the fragment. 

17.34.14 Initial velocity of missiles: comparison of 
methods 

The comparison of methods made by Ardron, Baum and 
Lee (1977) has already been mentioned. Another more 
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recent comparative study is that of Baum (1984). This is 
discussed and extended by the CCPS (1994/15). 

The following are some of the findings of the CCPS 
comparative study. 

In comparing models, use is made of the scaled energy, 
which is defined as 


ballistic range. At very low velocities, below the ballistic 
range, the resistance is proportional to the velocity. At bal¬ 
listic but subsonic velocities the resistance is proportional 
to the square of the velocity. At supersonic velocities the 
resistance is a complex function. 



where E is the scaled energy, A ex is the energy released in 
the explosion and Mis the mass of the vessel. 

An upper limit to the initial velocity of the fragments is 
set by the case of a hypothetical massless fragment for 
which the velocity is the maximum velocity of the expand¬ 
ing gas, or peak contact surface velocity. This velocity is a 
function of the pressure ratio Pi/P 0 . 

Differences between models tend to become significant 
for small values of the scaled energy. 

The Moore model, which is based on high explosion 
energies, whilst tending to give an upper limit value, 
nevertheless compares quite favourably with other models 
for both low and high energies. 

In the lower energy range the CCPS discusses the relative 
merits of the models of Baum and Baker et al. For certain 
specific comparisons Baum’s model yielded higher veloc¬ 
ities for spheres but lower ones for cylinders. 


17.34.17 Flight of missiles 

The flight of a projectile is a standard problem in mechanics 
and is treated in texts on this topic (e.g. Synge and Griffiths, 
1960; R.C. Smith and Smith, 1968; B. Brown, 1969). 

Three cases are considered here: case 1, no air resistance, 
case 2, air resistance proportional to the velocity and case 3, 
air resistance proportional to the square of the velocity. The 
first case is not realistic and results in gross overestimates 
of velocity and range, but provides a useful illustration of 
the general approach. The third case is realistic for ballistic 
velocities in the subsonic range. 

Considering first the flight of a projectile in the absence 
of air resistance (case 1), the equations of motion are 


J = 0 [17.34.19] 

0 [17.34.20] 


17.34.15 Angle of departure of missiles 

In order to determine the flight of a missile it is necessary 
also to have information on the angle of departure. The 
extent to which this is known depends on the particular 
case. For ejection of a fitting, the direction of the gas jet 
and, hence, the angle of departure of the fitting is usually 
defined. Likewise, this will generally be so for the two parts 
in the separation and rocketing of a gas filled vessel. 

The angles of departure in the case of the bursting of a 
gas filled vessel into a large number of fragments are less 
well defined. The common assumption is that the frag¬ 
ments are projected uniformly in all directions. Alter¬ 
natively, the more conservative approach maybe adopted in 
which the spatial density of the fragment is assumed to be 
greater in the direction of the vulnerable targets. 

For some methods the results for an individual fragment 
can be sensitive to the angle of departure. The CCPS 
(1994/15) report this to be the case for the model of rock¬ 
eting fragments. 


where g is the acceleration due to gravity, t is the time and 
x and y are the distances in the horizontal and vertical 
directions, respectively. 

Since there is no horizontal component of acceleration, 
in the x direction, both at t =0 and subsequently 


^ = m cos a [17.34.21] 

where u is the velocity along the line of flight, a is the angle 
of departure and the subscript i denotes initial. Integrating 
with initial conditions t = 0, x = 0 

x= «i(cos a)t [17.34.22] 


In they direction, at t =0 
d/ 1 


[17.34.23] 


17.34.16 Shape and air resistance of missiles 

The behaviour of the fragment in flight depends on its 
shape. Some fragments are chunky, with dimensions simi¬ 
lar along the three main axes, while others are less sym¬ 
metrical, with dissimilar lengths along these axes. 

A fragment in flight is acted on by a lift force normal to 
the trajectory and a drag force along the trajectory. These 
forces are defined in Equations 17.34.47 and 17.34.48 below 
in terms of a lift coefficient C L and a drag coefficient Cd. 

In ballistic terms a fragment may be characterized as a 
drag-type fragment if it is chunky so that for any orienta¬ 
tion C D > C L and as a lifting type fragment if it is such that 
for some orientation Cl > Cd. 

The force resisting the flight of the missile is a function 
of its velocity, but the relationship is not a simple one. 
The velocity range of interest for projectiles is termed the 


Integrating Equation 17.34.20 with initial conditions t= 0, 
dy/dt = Uj sina 

| = «i(sina)-£f [17.34.24] 

Integrating again with initial conditions t = 0, y = 0 
y = M;(sin a)t - -gt 2 [17.34.25] 

For t from Equation 17.34.22 

*~«cosa [17.34.26] 
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For the relation between x and y, eliminating / from Following an approach similar to that for the first model, it 
Equations 17.34.22 and 17.34.25 can be shown that 




j& _ 

cos 2 a 


[17.34.27] dt = Ui cos a ex P( ~kt) 


[17.34.37] 


For the distance travelled, 
Equation 17.34.27 

2 uf cos a sin « 


range, setting y = 0 in 

[17.34.28] 


For the velocity u 



[17.34.29] 


Then, from Equations 17.34.21,17.34.24 and 
«=[«?- 2«i(sin a)gt +g 2 t 2 ] 1/2 [17.34.30] 


| = ~(tei sin a +g) exp(-W) -f [17.34.38] 

x = “i C ° S g [1 - exp(—£/)] fl7.34.39] 


y = gsin a +|) [1 - e*p(-«)] - f fl7.34.40] 

For a projectile subject to a resistance proportional to the 
square of the velocity (case 3), the equations of motion are 


d 2 * 
d f 


[17.34.41] 


For the angle of approach to earth, or angle of return, B , 2 ,,,2 

h,f 


0 


[17.34.42] 


tan p = 


dr 


dyd/ 
d/d x 


from Equations 17.34.21 and 17.34.24 



[17.34.31] Beyond this point, the attempt to apply to cases 2 and 3 the 
treatment used for case 1 becomes increasingly intractable. 

However, there is an alternative approach which for case 
3 yields much simpler results. This involves working in 
terms not of the velocity u along the flight path but of the 
[17 34 32] velocity v relative to the ground. The relation between the 
two initial velocities is 


For the time of return to earth from Equation 17.34.25 with 

y =0 


[17.34.33] 


Note that return to earth distance is the horizontal velocity 
times the time in flight. 

The maximum range, which occurs at a projection angle 
of 45°, is 

x r = t r Ui cos a [17.34.34] 


Vi = m cos a [17.34.43] 

The relevant equation of motion is 

^ + Aw = 0 [17.34.44] 

which is obtained from Equation 17.34.41 utilizing dx/ 
d/= v. Integrating with initial conditions 


[17.34.45] 


For the angle of approach /? at the point of return to earth, 
or angle of return, from Equations 17.34.32 and 17.34.34 
tan p = —tan a. For the velocity at return to earth from 
Equations 17.34.30 and 17.34.34 u = 

For a projectile subject to a resistance k proportional to 
the velocity (case 2), the equations of motion are 


[17.34.35] 


An empirical formula which allows for air drag quoted by 
VJ.Clancey (1972b) is 

v- t'i exp(-kcax/m 1/<3 ) [17.34.46] 


with 

k = 0.002 velocity supersonic 
m 0.0014 velocity subsonic 


[17 34 36] where is the drag coefficient, v is the velocity of the pro¬ 
jectile (ft/s), Vi is the initial velocity of the projectile (ft/s), 
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m is the mass of the projectile (oz), x is the distance trav¬ 
elled hy the projectile (ft) and k is a constant. The drag 
coefficient c A is a function of fragment shape but is gen¬ 
erally approximately 1.5—2. 

Equation 17.34.46 is of the same form as Equation 
17.34.45. It also appears to be related to the equations for the 
flight of fragments from exploding weapons given by 
Christopherson and quoted in Section 17.36. 

17.34.18 Range of missiles 

The range of a missile in the absence of air drag is given by 
Equation 17.34.28 and the maximum value of that range for 
an angle of departure of 45° by Equation 17.34.34. 

However, these relations greatly overstate the actual 
ranges obtained. For example, using the initial velocities 
from TNT charges given by V.J. Clancey (1972b) as quoted 
in Section 17.36, ranges of 5 x 10 5 ft and upwards are 
obtained. Therefore, it is clearly necessary to take air drag 
into account. 

Clancey also gives a relation for the maximum horizontal 
range of fragments from a cased charge of TNT on the 
ground surface as shown in Figure 17.98. The correlation is 
based on experimental determination with TNT in light¬ 
weight containers. Most of the fragments do not travel the 



maximum distance, but fall at distances between 0.3 and 
0.8 of the maximum. 

The probability that there would be at least one fragment 
which travels the maximum distance increases with the 
number of fragments and is therefore greater for a large 
explosion. 

As stated above, a fragment in flight is acted on by a lift 
force, which is normal to the trajectory and opposes grav¬ 
ity, and a drag force, which is along the trajectory. These 
forces are 

E l = C l A l ^| 2 [17.34.47] 


E d = C d A d ^ [17.34.48] 

where j4 d is the drag area, A h is the lift area, C D is the drag 
coefficient, Cl is the lift coefficient, F D is the drag force, F L 
is the lift force, u is the velocity of the fragment and p is the 
density of air. 

A fundamental approach to the estimation of fragment 
range has been developed by W.E. Baker et al. (1975,1978) 
and is described by W.E. Baker et al. (1983). The range is 
obtained by solving the equations of motion for accelera¬ 
tion of the fragment in the horizontal and vertical direc¬ 
tions, utilizing for the drag and lift forces Equations 
17.34.47 and 17.34.48. The results are correlated in terms of 
the dimensionless iq,velocity defined as 


_ _ CdAdp 0 m„ 
u - 

and the dimensionless ranged 
= CqAqPqR 

and the lift/drag ratio 

CiA 

CdA d 


[17.34.49] 


[17.34.50] 


[17.34.51] 


where g is the acceleration due to gravity, M is the mass of 
the fragment, R is its range, u a is its initial velocity and p a is 
the density of air. The treatment is based on the assumption 
that the fragment is spinning and applies to fragment 
velocities up to Mach 1 or about 340 m/s. The equations 
were solved using the computer code FRISB. 

The correlation obtained is shown in Figure 17.99. For 
values of the lift/drag ratio not given, interpolation can be 
used, but it becomes inaccurate on the steep portions of the 
curve. 

Many fragments from explosions are chunky and have a 
lift coefficient C L , and hence a lift/drag ratio, of 0. Other 
fragments may be pieces of plate for which the lift/drag 
ratio is more complex. A method of estimating the lift/drag 
ratio for these latter is given in appendix E of W.E. Baker 
etal. (1983). 

Data on missile flight are available in many descriptions 
of accidental explosions. Jacobs et al. (1973) state that in 
the explosion at the American Oil Company refinery at 
Whiting, Indiana (Case History A22): 

The vessel fragments were scattered for several hundred 
feet away from the unit site. One 60-t piece landed on a 
tank of gasoline, smashing it severely and igniting and 
scattering its contents. 
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Figure 17.99 Missile effects of explosions: distance 
travelled by missiles (W.E. Baker etal., 1983) (Courtesy of 
Elsevier Science Publishers) 



(b) 



Figure 17.100 Missile effects of explosions: fragment 
range distribution from some accidental event (W.E. Baker 
et al., 1978): (a) event groups 1 and 2 and (b) events 
groups 3-6 


The investigation of the explosion at the Dow Chemical 
Company’s works at King’s Lynn by the HSE (1977b) gives 
a map of the fragments from the explosion (Case History 
A81). In one ship explosion investigated by V.J. Clancey 
(1976b) a deck cover of 4001 was thrown 100 ft. 

The study of accidental explosions by WE. Baker et al. 
(1978) referred to in Section 17.34.4 and tabulated in Table 
17.50 also yielded data on fragment range. The graphs of 
fragment range for the different event groups are shown in 
Figure 17.100. 

An absorber column exploded from a hydrogen-rich fuel 
and air mixture that skattered 16 large fragments. The 
energy of the explosion was evaluated by three alternative 
methods by Woodward and Ketchum (2001). Fragment 
range analysis, using Figure 17.99, gave 30-83 kg TNT 
equivalence. Modelling the fuel combustion energy gave 
78-96 kg TNT equivalence. Window breakage analyses 
gave 37 kgTNTequivalence. 

17.34.19 Missiles from BLEVEs 

A particular type of explosion which is prone to generate 
missiles is the BLEVE. A study of missiles from BLEVEs 
has been described by Holden and Reeves (1985). 

Much of the information obtained in the work relates to 
vessels used in transport, but no reason was seen why it 
should not apply to fixed plant also. A distinction is made 
between cylindrical and spherical vessels, which are treated 
separately. For cylindrical vessels information was obtained 
on (1) probability of fragment generation, (2) number of 
fragments, (3) range of fragments, and (4) direction of frag¬ 
ments, and for spherical vessels on the last three features. 

For cylindrical vessels there were 113 events involving 
fire on which sufficient information was available and of 
these 89 involved fragment generation. The probability of 
fragment generation was estimated from this as 0.8. 

The number of fragments generated by a cylindrical 
vessel was obtained for 27 events involving LPG vessels 
and ranged from one to four. The number of events gen¬ 
erating one, two, three and four fragments were 8,7,10 and 
4, respectively. This excluded a fire engulfment test at 
White Sands reported by C. Anderson and Morris (1974), in 
which 10 fragments were generated and which appears to 
be anomalous in comparison with the accident data. 

The range of fragments was taken as the ultimate end 
point after landing and travelling across the ground, through 
structures, etc. The range for fragments from LPG vessels is 
shown inFigurel7.101.Figurel7.101(a) gives therangefor all 
events together with a comparison with data from an earlier 
study by WE. Baker et al. (1978). Figure 17.101(b) shows the 
effect of vessel size and Figure 17.101(c) the difference 
between end tub fragments and other fragments. There is a 
clear tendency for fragments from vessels with a capacity 
<90m 3 and for end tubs to travel further. Figure 17.101(d) 
gives the range for fragments from spherical vessels. A fur¬ 
ther graph is given for the range of fragments from vessels 
containing ammonia, ethylene oxide and vinyl chloride. 

The authors comment that the ranges found tend to be 
much less than those obtained from theoretical estimates of 
maximum range using the corresponding launch angle, 
which can exceed 3 km to first ground impact, that launch 
angle is important, and that their empirical data include 
implicit allowance for factors such as launch angle, inventory, 

With regard to direction of fragments from cylindrical 
vessels, for some 11 incidents involving 15 vessels, 
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(b) 





Figure 17.101 Missile effects of explosions: distance travelled by missiles from bursting of LPG vessels (Holden and 
Reeves, 1985): (a) all events; (b) effect of vessel size; (c) end tub and other fragments and (d) spherical vessels (BLEVEs) 


(Courtesy of the Institution of Chemical Engineers) 

mainly LPG, about half the fragments were projected 
into about a third of the total area, in arcs of 30° to either 
side of the vessel front and rear axial directions. The 
correlation given for LPG vessel fragments is shown in 
Figure 17.102. 


For spherical vessels the sample of events was only 
seven. The number of fragments generated in these vents 
was 3,4,5,5,6,16 and 19, giving an average of 8.3 fragments 
per event. This number is appreciably higher than for 
cylindrical vessels. 
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Figure 17.102 Missile effects of explosions: direction of travel of missiles bursting of LPG vessels (Holden and Reeves, 
1985) (Courtesy of the Institution of Chemical Engineers) 


Figure 17.101(d) shows that the range of the fragments 
from spherical vessels is marginally higher than for 
cylindrical vessels. 

Fragments from spherical vessels tend to be projected in 
a non-uniform distribution of directions. Taking the 
favoured direction in each incident and treating this as an 
arbitrary 0° and then overlaying the plots for the individual 
incidents to give an overall plot divided into 30° sectors, it 
was found that a fragment is 17 times more likely to be 
projected in the favoured direction than in the least 
favoured. 

The authors describe a number of incidents where frag¬ 
ments from BLEVEs have caused damage or injury. At 
Crescent City a propane rail tank car exploded, generating 
two main fragments, one of which punctured the head of 
another such tank and the other sheared the housing and 
valves off a third tank (Case History A50). 

Similarly, at Laurel a fragment from the BLEVE of a tank 
car pierced another propane tank car (Case History A44). 
Escalation may also occur by disablement of other equip¬ 
ment. At Laurel a fragment from one of the rail tank cars 
hit a pumphouse and cut an 8 in. water main, reducing the 
fire water pressure. At Puebla, Mexico, in 1977 a fragment 
from the BLEVE of a vinyl chloride storage sphere hit the 
main site water tank and carried it across the perimeter 
fence (Case History A87). At Texas City in 1978 a fragment 
from the BLEVE of an LPG sphere travelled 210 m and 
hit the site fire water tank. 

Fragments from BLEVEs are also a cause of injury. In the 
LPG road tanker BLEVE at Deer Lake, Pennsylvania, in 
1959 it was a rocketing fragment which was responsible for 
most of the 11 dead and 10 injured. These bystanders were at 
a distance of more than 200 m and beyond the range of 
thermal hazard in that case. At West St. Paul, Minnesota, in 
1974 fragments from the BLEVE of an LPG storage vessel 
were held responsible for the deaths of three fire fighters 
and a bystander. 

A further study of missiles from BLEVEs is that of 
Pietersen (1985), who investigated the disaster at Mexico 


City, Mexico, in 1984, described in Appendix 4. For 44 
cylindrical bullet tanks he found that 4 were still on their 
supports and a further 11 still in their original bund, and 
that of the remaining 29, the distribution of bullets and end 
tubs was as follows: 


Distance 

(m) 

No. of fragments 
from bullets 

No. of fragments 
from end tubs 

<100 

17 

3 

100-200 

4 

4 

200-300 

3 

3 

300-400 

2 

2 

400-700 

1 

1 

700-1000 

1 

1 

1000-1200 

1 

1 

Total 

29 

15 


For the spheres, 25 major fragments were collected lying as 
follows: six within 100 m, six between 100 and 200 m, seven 
between 200 and 300 m, one between 300 and 400 m, three 
between 400 and 500 m, one between 500 and 590 m and 
one at 590 m. 

Pietersen discusses the mechanism of rocketing of part 
of a cylindrical bullet. He takes as the energy transferred to 
the missiles 60% of the total available energy of a gas filled 
vessel as given by the Erode equation and then utilizes a 
relation equivalent to Equation 17.34.1. On this basis he 
obtains for the larger vessels on the site 


Vessel 

Vessel 

Initial velocity 

volume (m 3 ) 

mass (kg) 

of missile (m/s) 

270 

70 

149 

1600 

215 

206 

2400 

300 

214 
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which gives maximum velocities of about 150 m/s for 
cylinders and 200 m/s for spheres. He also quotes a velocity 
of 60 m/s for the vapour of the LPG in the cylinder under¬ 
going flash vaporization. He states that calculations based 
on these figures indicate that without lift the maximum 
range of the fragment is of the order of 360 m, though the 
figure is not very accurate. It is sufficient to show, however, 
that lift must play a significant role. 

17.34.20 CCPS method 

The CCPS Fire and Explosion Model Guidelines (1994/15) 
include as part of the treatment for BLEVEs a method for 
fragments. 

The method used for the estimation of the energy of 
explosion used has been described in Section 17.27. 

For the number of fragments the value of the scaled 
energy given by Equation 17.34.18 is used to discriminate 
between the case where the fragments are few and that 
where they are numerous. The region where the scaled 
energy lies between 0.1 and 0.4 is one where the number of 
fragments generated tends to be small. 

Use is also made of Baker’s event groups as described in 
Section 17.34.4. An event group is selected which approxi¬ 
mates the case in hand, and the event group data are then 
used to obtain an estimate of the expected number of frag¬ 
ments and of their mass distribution. 

For the initial velocity of the fragments three methods 
are given. Method 1 is to obtain the energy of explosion 
using the methods given in Section 17.34.9 and to apply to 
it a factor of 0.2 to obtain the kinetic energy available to 
the fragments and then to assume this is distributed 
equally among the fragments as in Equation 17.34.1. 
Method 2 is that of Baker et al. outlined in Section 17.34.11. 
Method 3 is that of Moore, which is given here as Equation 
17.34.3. The choice of method to use is governed by the 
scaled energy relation 17.34.18. 

For the range distribution of the fragments use is made 
of the method of Baker et al. which is described in Section 
17.34.18. 

Ranges may also be estimated using the event group 
data. 

17.34.21 Missile damage method of Scilly and Crowther 

A method for assessment of the risk of missile impact on 
a process plant site has been described by Scilly and 
Crowther (1992). 

These authors give data on the fragments generated in 
eight incidents, as shown in Table 17.51. 

The method which they describe involves for a given 
target estimation of the following features: (1) the number 
of fragments, (2) the range distribution, (3) the mass dis¬ 
tribution, (4) the orientation factor, (5) the effective range 
interval, and (6) the probability of a strike. 

They illustrate the method by reference to the case of 
a distillation column 50 m high, 2.4 m in diameter and 
12.5 mm thick subject to a sudden pressure increase due 
to a rapid decomposition. 

In general, the number N of fragments depends on a 
variety of factors, including the vessel size and shape, the 
material of construction, the operating temperature 
and the rate of pressure rise. The authors obtain the 
estimate of the number of fragments N by inspection of 
Table 17.51. For their illustrative example they take Mas 35. 

As already described, the distribution of fragments may 
exhibit directionality. The authors suggest there is some 


justification for allowing for this by the use of a correction 
factor of 2, applied to N. 

For the distribution of the ranges of the fragments, they 
utilize not the fragment with maximum range i? max but that 
with the next farthest range, or penultimate range, R pen , 
arguing that the latter is more meaningful. The range dis¬ 
tribution is found to be log-normal, and is fitted by the 
authors using a probit equation. They give the following 
tentative relations: 

P med = 2.8P v [17.34.52] 


f?pen 


m 4.1P med 


[17.34.53] 


where P v is the vessel pressure (barg), P med is the median 
range (m) and P pen is the range of the penultimate fragment 
(m). A probit equation for the probability P of a fragment 
falling at a range R may then be constructed from the pair 
of points (P=0.5, P me d) and ( P=N pe JN, R pen ), where 
N pen =N-l. 

Given that for vessels of size exceeding 20 m 3 the great 
majority of fragments will have energy sufficient to pen¬ 
etrate steel containments, which are unlikely to have a wall 
thickness greater than 15 mm, the distribution of mass is 
much less important. However, for the case where it is 
desired to estimate the mass distribution for vessels of such 
size, the authors propose that the median mass of the 
fragmentsbe taken as that of the vessel divided by 73 and that 
the slope of the associated probit equation be taken as 1.5. 

The orientation factor F or is 


[17.34.54] 


where R is the range of the fragment (m) and ITis the com¬ 
bined width of the target and the fragment (m). The width 
of a fragment is taken in the illustrative example as 4 m. 

The target is vulnerable to any fragment falling between 
a minimum range R and a maximum range R + L, where L 
may be termed the effective range interval. For a target 
consisting of a sphere supported on legs the authors derive 
by geometry for fragments directed, respectively, at the 
midpoint and at the edge of the sphere 


L = (H — r + r sec 6) tan 0 + r sphere midpoint 

[17.34.55] 

= (H - r)tan 8 + r sphere edge [17.34.56] 


where H is the height of the top of the sphere (m), L is the 
effective range interval (m), r is the radius of the sphere (m) 
and 8 is the angle of descent (°). For the angle of descent the 
authors suggest 45° as a conservative value. They use 60° 
in their illustrative example. 

The probability P Ti that a fragment falls within the 
effective range interval L is then determined from the pro¬ 
bit equation for the range distribution by taking the dif¬ 
ference between the probabilities of a fragment reaching 
R + L and of one reaching R. 

The probability of a strike P st is then 

P st = ForNPri [17.34.57] 

As already stated, the authors effectively take as unity the 
probability of puncture of the target given a strike. 

For an explosion in the vessel used to illustrate the 
method, described above, and for a target consisting of a 



Table 17.51 Behaviour of fragments in , 


- 2 (after Scilly and 
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sphere 12 m in diameter supported on 3 m legs at 150 m 
distance from the exploding vessel, the authors obtain a 
calculated burst pressure P v = 45 barg, a number of frag¬ 
ments N = 35, a range of fall between 150 and 199 m, the 
range probit Y = -1.44 + 3.066 logi 0 R, a probability that 
a fragment falls within the effective range interval of 0.14, 
an orientation factor F or = 0.016, and a probability of strike 


17.34.22 Flying glass 

Glass fragments from the breaking of windows are sig¬ 
nificant for injury of personnel. This effect is considered in 
Section 17.40. 

17.34.23 Falling masonry and glass 

Another form of missile which is relevant particularly to an 
explosion in a built-up area is falling masonry and glass. 

A model for this hazard is included in the set of sub¬ 
models in the model for a condensed phase explosion in a 
built-up area given by Gilbert, Lees and Stilly (1994h). A 
person in the street near a building is vulnerable to falling 
masonry and glass. The extent of the hazard from these two 
sources will vary. The relative importance of falling glass 
may be expected to rise where the buildings in question are 
large city skyscrapers. 

Casualties occurred from falling masonry in air raids, 
but the interpretation of such data needs to take account of 
the fact that in many cases the weapons exploded inside 
buildings. 

The model tentatively proposed by Gilbert, Lees and 
Stilly (1994h) for the estimation of the risk from falling 
masonry and glass is as follows. The approach used is to 
designate a band of specified width on the pavement beside 
the building and to assume that persons in this band do not 
survive. The width of the band is intended to allow both for 
the density and size distribution of falling debris within 
a wider band and for the probability of a fatality given a 
hit. The default value used for the width of the band is 1 m. 
This value is for use where the height of the building does 
not exceed 15 m. 

17.34.24 Crater ejecta 

Some explosions create a crater and in this case fragments 
are ejected. Craters have been treated in Section 17.31. The 
account here is confined to the crater ejecta. 

A treatment of the fragments from cratering has been 
given by Richmond and Fletcher (1971). These authors base 
their work on data given by Henny and Carlson (1968) for 
crater ejecta from explosions in rock and in soil. The 
charges were half buried in the ground. The missiles consid¬ 
ered are those with a mass exceeding 0.5 lb. 

For the maximum range of fragments Richmond and 
Fletcher give the following equations: 


Rmax = 70W 0 ' 4 rock 
m, 30W 0 ' 4 soil 


where a is the projected area of the body (ft 2 ) and A is the 
specific area, or surface hemispherical area per missile 
(ft 2 /missile). The projected area a is taken as 6.2 ft 2 . 

The authors deal primarily with fragments from crater¬ 
ing in rock and consider particularly the conditions for 
50 and 1% probability of being struck. The fragment spe¬ 
cific areas at these levels of probability are 9 and 600 ft 2 / 
fragment, respectively. 

For cratering of rock the authors give a graph showing 
curves for the 50 and 1% probability of being hit as a 
function of mass of explosive and distance, but give no 
guidance on obtaining other values. However, their data 
may be correlated approximately by the following relations: 


A- 


A h 


[17.34.61 


[17.34.58a] 

[17.34.58b] 


where R is the range (ft) and IFis the mass of explosive (lb) 
(of TNT equivalent) and the subscript max denotes maxi- 


«e = </> K »w [17.34.61] 

4, m% R< 200 [17.34.62] 

4>„ = 3.46 - 0.466 Ini?, 200 < R < 900 [17.34.63] 

where A h is the area of the hemisphere on the surface of 
which the human target is standing (ft 2 ), m is the mass of 
explosive (tons), n is the near field number of missiles per 
ton of explosive (missiles/t), n e is the number of missiles 
at distance R (missiles/t), R is the distance (ft) and </>„ is 
a correction factor which allows for the reduction in 
the number of missiles with distance. The value of n is 
230 missiles/t. 

The authors state that the average mass of the missiles is 
well above 0.5 lb and argue that the probability of serious 
injury given a hit is likely to be high. 

The application of this work to the cratering caused by an 
explosive load in a street has been discussed by Gilbert, 
Lees and Stilly (1994h). From an analysis of the crater in 
the Peterborough explosion (HSE, 1990c), which involved 
an explosive load equivalent to some 800 kg of TNT on a 
vehicle in a built-up area, they conclude that it is probably 
not necessary to make any correction for the height of the 
load above ground or for the nature of the ground, but 
suggest that some correction seems appropriate for the fact 
that in the experimental work described the charges were 
half buried and suggest a reduction in the near field num¬ 
ber n of fragments from 230 to 150 missiles/t. 


17.34.25 Impact effects 

There are available a number of empirical equations for 
estimating the penetration of fragments in various types of 
target. However, it is pointed out by W.G. High (1980) that 
most of these relations are for fragments from high energy 
density sources, where the sources of interest in process 
plant, such as high pressure vessels, are of relatively low 
energy density. 

It is convenient to quote first some of the empirical 
equations for determining fragment penetration given in 
the High Pressure Safety Code by E.G. Cox and Saville 
(1975),* which may be regarded as a coherent set selected 
by the authors for plant design purposes. Other individual 


[17.34.59] Association. 


* Reproduced with permission of the High Pressure Technology 


P = 1 — exp(-a/A) 
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formulae for penetration into reinforced concrete and into 
steel plate are given in Sections 17.34.26 and 17.34.27. 

A treatment of the impact of missiles on pipework is 
given in Section 17.35. 

The equations quoted in the High Pressure Safety Code 
assume penetration normal to the surface. They are valid 
for projectile velocities not exceeding 1000 m/s, above 
which there is often a quite different mechanism in which 
target and projectile are melted by the impact energy. 

For penetration by small fragments, the depth of pen¬ 
etration is given by the relation 

t = Km ni V 2 [17.34.64] 

where m is the mass of the fragment (kg), t is the thickness 
of the barricade needed just to stop the fragment (m), V is 
the velocity of the fragment (m/s), A is a constant and «i 
and » 2 are indices. The values of the constant K and the 
indices »i and n 2 for different target materials are: 



K 

% 

«2 

Concrete (crushing 

18 x 10“ 6 

0.4 

1.5 

strength 35 MN/m 2 
Brickwork 

23 x 10“ 6 

0.4 

1.5 

Mild steel 

6 x 10“ 5 

0.33 

1.0 


Equation 1734.64 is valid for compact blunt steel frag¬ 
ments such as solid cylinders with the length equal to the 
diameter with a mass of not more than 1 kg. 

For penetration by larger fragments the depth of pen¬ 
etration may be calculated from 

t = ^log 10 (l + 5 x 10~ 5 V 2 ) [17.34.65] 

where A is the presented area of the fragment (m 2 ) and C 
is a constant. The constant C has the following values: 


C 


Concrete (unreinforced, 

10 x 10“ 4 

crushing strength 15 MN/m 2 ) 

Concrete (1.4% reinforcement, 

3.5 x 10“ 4 

crushing strength 40 MN/m 2 ) 

Brickwork 

25 x 10“ 4 

Mild steel 

0.5 x 10“ 4 

Alloy steel 

0.3 x 10“ 4 


Equation 17.34.65 applies for large blunt fragments with 
a mass exceeding 1 kg. 

For penetration by rod shaped missiles for concrete 
t -2x10 7 ^ [17.34.66] 

and for mild steel plate 
/ a mV 2 \ ylM 

t = (0.33 x 10“ 9 di J [17.34.67] 

where d is the diameter of the fragment (m). 


Fragments of irregular shape, such as are usually 
produced by the bursting of a pressure vessel, have 
much lower penetrating power, often only half, than com¬ 
pact blunt fragments, while pointed projectiles have 
appreciably more. 

Further relations for impact of fragments on various 
types of target have been given by WE. Baker et al. (1983). 
They consider the following targets: (1) thin metal plates 
and sheets, (2) roofing materials, and (3) reinforced con¬ 
crete. For the latter the treatment includes steel pipe, utility 
pole and rod missiles. 

The impact relations given by these authors are corre¬ 
lated in terms of a non-dimensional projectile velocity, a 
non-dimensional target deflection and non-dimensional 
target thickness. 

As the size of the projectile increases, the response of the 
target becomes more significant. Work by R.P. Kennedy 
(1976) has shown that the target response may be modelled 
by assuming it to be subject to a rectangular pulse forcing 
function. With this assumption it is then possible to apply 
conventional structural response techniques. 

Another aspect of fragment impact on concrete targets 
is spalling and scabbing, and correlations are available 
for the threshold and for depth attained. 

17.34.26 Impact effects: penetration of reinforced 
concrete 

There has been a considerable amount of work on the 
penetration of reinforced concrete by missiles. Accounts 
are given by Chelapati, Kennedy and Wall (1972), 
R.P. Kennedy (1976), Barr et al. (1980), Porter (1980) and 
Tulacz and Smith (1980). 

Some principal correlations are those of Petry (1910), the 
Army Corps of Engineers (ACE), the Ballistics Research 
Laboratory (BRL) and the National Defense Research 
Committee (NDRC) (1946). These correlations are given by 
Tulacz and Smith (1980). 

Of these models, the modified NDRC correlation (NDRC, 
1946) particularly appears to have found widespread 
acceptance. It is applicable to a flat-faced cylindrical mis¬ 
sile. The equation is given in SI units by Barr et al. (1980) as 
follows: 


G(x/d) = 2.74 x 10- B (prf a2 /(r“- 5 )p L8 

JJ7.34.68] 

with 


G(x/d) = {x/2df, x/d < 2 

fL7.34.69] 

G{x/d) ={x/d)- 1, x/d>2 

f7.34.70] 

P = m ,d* 

f7.34.71] 


where d is the diameter of the missile (m), p is its calibre 
density (kg/m 3 ), m is its mass (kg), p is its velocity (m/s), 
x is the penetration depth (m) and cr c is the compressive 
strength of concrete (Pa). The limits of applicability of 
Equation 17.34.68 are discussed by Gwaltney (1968) and 
Tulacz and Smith (1980). 
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Equation 17.34.68 is a penetration correlation. NDRC has 
also developed perforation formulae for use in conjunction 
with this equation. These are 

£-3.19i-0.718g) ! , i<3 117.34.72, 


2= 1.32 + 1.24^, 3 < | < 18 [17.34.73] 

where e is the perforation thickness (m). This is the thick¬ 
ness of target which the missile will just perforate. Another 
model for penetration by a flat-nosed cylinder, again based 
on extensive testing, is the Commissariat a l’Energie 
Atomique/Electricite de France (CEA/EDF) formula, 
described by Berriaud et al. (1978) and discussed by Barr 
etal. (1980): 



where p p is the perforation velocity (m/s) and p is the den¬ 
sity of the concrete (kg/m 3 ); the other symbols are as 
defined above. 

The limits of applicability of Equation 17.34.74 are dis¬ 
cussed by Berriaud and Barr et al. 

A three-dimensional computer code, CRASH, for the 
investigation of impact effects on various types of target, 
including reinforced concrete and steel plate, has been 
described by Hopkirk, Lympany and Marti (1980). 

17.34.27 Impact effects: penetration of steel plate 

There has also been a good deal of work on the penetration 
by missiles of steel plate. Accounts are given by Neilson 
(1980) and TUlacz and Smith (1980). 

Some principal correlations are those of Christopherson 
(1946), Stanford Research Institute (SRI), the Ballistics 
Research Laboratory (BRL) and the NDRC. 

Of these models, that of SRI, described by R.W White 
and Botsford (1963), appears to have found wide accept¬ 
ance. It is given in SI units by Neilson as 

ir = mk {42 - 7h2+wh) [17 - 3475] 

where d is the diameter of the missile (m), E c is its critical 
impact energy (J), h is the thickness of the target panel (m), 
S u is the ultimate tensile strength of the panel (Pa) and w 
is the width of the panel (m). 

Equation 17.34.75 was derived originally for relatively 
long missiles striking thin panels (<7 mm thick). The limits 
of applicability and behaviour of the equation are dis¬ 
cussed by Neilson and by Tulacz and Smith. 

The latter also give the BRL and NDRC formulae and 
discuss the comparative behaviour of the three models. 

Mention has already been made of the general impact 
computer code CRASH, which can be used for steel plates. 
Neilson also describes the use for this purpose of the codes 
EURDYNandCADROS. 

17.34.28 Impact effects: impact on a storage sphere 

A treatment of the impact of a fragment from a BLEVE on 
a storage sphere has been given by Pietersen (1985). The 


method involves calculating (1) the force at the point of 
impact to deform the sphere up to the yield point, and the 
corresponding energy Ey, and (2) the energy E r to deform 
the sphere in the plastic region between yield and rupture. 
Utilizing relations given by Roark and Young (1975) and 
taking the impact area as five times the vessel wall thick¬ 
ness, these two energies are found to heEy = 7kJandE r m 
64 kj. Assuming that plastic deformation of the impacting 
fragment uses up an amount of energy equal to that used in 
the sphere itself the total energy required for rupture is 
135 kj. From simple kinetic energy considerations, for a 
fragment of mass 20 te (l/10th of a sphere) the velocity 
required to effect rupture is then 3.7 m/s and for one of 2 te 
(l/100th of a sphere) it is 11.6 m/s. This calculation indicates 
that the velocities to cause rupture are well below the initial 
velocities of fragments from a sphere undergoing BLEVE, 
which have been discussed above, and therefore that rup¬ 
ture of a sphere close by is to be expected. 

17.34.29 Barricade design 

In some cases use is made of barricades around a potential 
source of explosion. Barricades are utilized particularly in 
work with explosives, but may also be used around other 
potential explosion sources such as high pressure equip¬ 
ment. There is also considerable interest in barricades in 
the nuclear industry. 

Accounts of the design of barricades include those 
given in the High Pressure Safety Code by E.G. Cox and 
Saville (1975) and by Loving (1957), WG. High (1967) and 
C.V. Moore (1967). 

The essential first step in design of a barricade is to 
determine the failures against which protection is req¬ 
uired. In other words, it is necessary to start with 
hazard identification. 

In barricade design, provision of protection against an 
explosion of flammable gas is generally treated as a special 
case. Excluding this, the design resolves into provision of a 
barricade which offers resistance to (1) blast and (2) frag¬ 
ments. Broadly, design against blast is often based on an 
equivalent static pressure approach and design against 
fragments on fragment penetration correlations. 

Design methods for barricades to protect against vessel 
rupture are discussed in the High Pressure Safely Code. It is 
relatively easy to provide a barricade for vessels with 
energy contents in the range 10 3_ 10 5 J, but it becomes pro¬ 
gressively more difficult as the energy content rises, and 
for energy contents capable of giving a shock wave of 50 x 
10 6 to 100 x 10 6 J it is usually impractical. 

The preferred method is a closed cubicle. For protection 
against blast using the equivalent static pressure method 
the Code gives the relevant pressure as 

P = 7.6[(£ x 10- 6 )/y] 0 ' 72 , P < 70 [17.34.76] 

where E is the shock wave energy (J), P is the equivalent 
static pressure (bar) and V is the volume of the enclosure 
(m 3 ). Equation 17.34.76 is applicable where the ratio of the 
maximum to the minimum dimension of the enclosure does 
not exceed 2. 

Cylindrical cubicles can be designed as thin-walled 
pressure vessels. Small cubicles can be made of angle iron 
and steel plate. Large cubicles should be of reinforced 
concrete. Since the shock wave has positive and negative 
phases, reinforcement is required on both inner and 
outer faces. 
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Some transmission of the shock wave occurs through the 
walls of the cubicle. This creates the hazard that persons 
outside may be injured by eardrum rupture. The Code gives 
the following method of estimating this. The impulse inci¬ 
dent on an isolated wall is given as 

I = 0.008£ 1/3 (f?/£ 1/3 r 1/2 , 0.004 < (R/E 1 ' 3 ) < 0.2 

[17.34.77] 

where I is the impulse per unit area (N s/m 2 ) and R is the 
distance (m). Also for an isolated wall the initial velocity of 
the wall, assumed unconstrained, is 

u = I/m [17.34.78] 

where m is the mass of the wall per unit area and u is the 
velocity (m/s). For the wall of a cubicle the impulse is taken 
as three times the value given by Equation 17.34.77 and the 
initial velocity of the wall is then that given by Equation 
17.34.78. 

If the value of the initial velocity u so calculated is less 
than 10 m/s, the shock wave generated outside should be 
too small to cause eardrum rupture. 

If the plant in the cubicle contains flammables or toxics 
an opening may be necessary to allow dispersion of small 
leaks by ventilation. The Code states that the design of a 
vented cubicle is essentially the same as that for a closed 
cubicle. 

With a vented cubicle, however, the escaping shock wave 
will tend to cause overpressure similar to that which would 
exist if there was no cubicle and the explosion was in the 
open. The Code gives the following equation for the esti¬ 
mation of the peak incident overpressure: 

P = 8.45 x 10- 5 (EV 3 /?) 23 _ 0.16(i?/£ 1/3 ) ^ 

+ 0.06, 0.004 < (R/E 1 ' 3 ) < 0.2 

where P is the peak incident overpressure (bar). 

The cubicle should also withstand the fragments gener¬ 
ated. Since the distances are usually short, such a fragment 
will tend to be at its initial velocity. Much of the work on 
fragment penetration, described above, has been done to 
assist with barricade design. 

Safety walls may be used instead of a cubicle. For a 
safety wall the impulse from the blast wave is as given by 
Equation 17.34.77 without application of the factor of 3 and 
the initial velocity as given by Equation 17.34.78.There will, 
however, be diffraction of the shock wave around the wall 
which is difficult to estimate. 

The thickness of the barricade should he such as to 
enable it to withstand both shock wave and fragment 
penetration. 

The barricade may be required to survive the simulta¬ 
neous assault of the shock wave and of fragments. This 
problem is discussed in the Code and also by Moore. 

Information on viewing ports for cubicles is given by 
Moore (1967). 


17.34.30 Plant design 

The hazard from missiles has not generally been a major 
factor in plant design, but rather more attention is now 


Design of plant for the hazard of missiles may focus on 
the source or on the target. On the whole it makes more 
sense to concentrate on the source, since the probability 
that a given plant item will be the target of a missile, even if 
a missile-generating explosion occurs, is very low. 

Attention should be paid in design to features such as 
doors, vents and other fixtures on plant which may become 
missiles and measures should be taken to minimize this. 

Where a serious missile hazard exists, use may be made 
of barricades and safety walls as described above. 

17.35 Explosion Damage to Plant by Missiles 

The treatment just given of missile impact effects con¬ 
stitutes a rather general account, with emphasis on pen¬ 
etration of concrete walls and steel plates. This is now 
supplemented by consideration of a particular problem, 
taken as representative for missile impacts on plant, that 
of damage to pipework. 

The account given draws particularly on evidence given 
to the Piper Alpha Inquiry by A.C. Palmer (1989), which 
considered the mechanisms of, and potential for, damage to 
a 4 in. high pressure gas condensate line in B Module from 
fragments from the firewall between B and C Modules set 
in motion by an explosion in C Module. 

17.35.1 Fragment velocity and energy 

The velocity and energy of fragments has been considered 
in the previous section. Essentially, a fragment is acceler¬ 
ated by a force which will vary with the circumstances. The 
point which is relevant here is that in a large proportion 
of cases, the principal force causing acceleration is that 
due to the dynamic pressure, or wind. The acceleration of 
the fragment up to its maximum velocity then requires a 
finite distance, which may be several metres. This fact can 
be significant if the target is close to the source of the 
fragments. 

17.35.2 Distribution of energy 

Only a part of the kinetic energy of the fragment is trans¬ 
ferred to the target and is available to cause damage. Some 
of the energy goes into the deformation, and possible dis¬ 
integration, of the fragment itself. The distribution of 
energy between the fragment and the target depends on 
their relative stiffness and is highly variable. If the frag¬ 
ment is more readily deformed than the target, it absorbs 
more energy than it transmits. 

The relative stiffness is itself a function of the velocity of 
impact. If the impact velocity is low, the relative stiffness is 
governed by the overall deformation of the two objects, 
whilst if it is high deformation may be localized and the 
energy distribution may alter. 

The energy transferred to the target is itself divided into 
that energy which causes local damage and that which 
causes the whole target to respond. This latter energy is 
taken into account in some treatments but not in others. 

17.35.3 Impact effects 

Before considering damage caused by the fragment, it is 
appropriate to mention several effects associated with the 
impact of a high velocity object on a steel target. 

Accounts of impact and its effects include Impact by 
Goldsmith (1960) and Impact Strength of Materials by 
W. Johnson (1972). 
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The impact effects of principal interest here are those 
which bear on the effective force exerted, the effective 
strength of the material and the nature of the target 
response. 

The force exerted by a rapidly applied load is twice that 
of a slowly applied load. Thus, consider, as an approximate 
treatment, a vertical rod with a disc at the bottom and with 
an annular weight around the rod of the same radius as the 
disc and of mass m. Let this weight be suddenly applied 
from effectively zero height, to the disc so that it produces 
in the rod an extension x. Then, by energy balance the force 
Fexerted on the disc is 

mgx = ^-Fx 

Hence 

F=2mg 

This is twice the force exerted by a static load for which 
F = mg. 

If a load is applied very rapidly to a steel object so that the 
strain rate is high, there is an increase in the effective 
strength of the material. This may be expressed as the ratio 
of the yield stress to the static yield stress, the ratio 
increasing with the strain rate. From the work of N. Jones 
(1983) this dynamic strength factor is of the order of 2 at a 
strain rate of 10 2 and 3 at one of 10 3 . 

The nature of the impact also affects the response of the 
target and the mode of deformation. If the load is applied 
slowly, quasi-static failure modes apply, whilst if it is 
applied very rapidly, dynamic failure modes come into play. 
Further, if the velocity of impact is very high, the effect may 
be intense, but localized. 

The rapidity of loading at which these different effects 
come into play varies with the effect. 

17.35.4 Modes of damage 

Some modes of damage to pipework are exemplified by 
those considered in relation to the 4 in. condensate line 
mentioned. This pipe passed through the firewall from C 
Module into B Module, took a 90° bend and ran parallel to 
the wall, then took another 90° bend and ran away from the 
wall, into the main oil line. The pipe was understood to have 
had an outside diameter of 114 mm and a wall thickness of 
11.1 mm (revised from an initial value of 8.6 mm) and to 
have been operating at a pressure of about 62 bar. In the 
analysis the steel was treated as having a yield stress of 
260 N/mm 2 , an elastic modulus of 210 N/mm 2 , a Poisson 
ratio of 0.3 and a density of 7850 kg/m 3 . 

The modes of damage considered by Palmer are listed in 
Table 17.52. 


17.35.5 Models for damage 

In general, the energy absorbed, or work done, during 
deformation caused by a slowly applied load is obtained 
from the relation 

U = \fS [17.35.1] 

[17.35.2] 


Table 17.52 Estimated minimum energy or velocity 
requirements for failure of the 4 in, condensate line on 
Piper Alpha (after A.C. Palmer, 1989) 


Mode of deformation 

Estimated minimum 
values 

Energy Velocity 

(kj) (m/s) 

Loads applied relatively slowly 

1. Tensile failure 

112 


2. Bending failure 3 

82 


3. Shear failure 11 

9 


4. Cutting 

(a) Cutting to leak c 

11 


(b) Cutting off 

143 


5. Denting 

(a) Denting by a concentrated 

36 


force 

(b) Denting by an edge: 

Dent 14 diameter deep 

26 


Dent 1 diameter deep 

70 


Loads applied very rapidly 

6. Dynamic tensile failure 

19 

60 

7. Dynamic puncturing 

7 

40 


a Bending through a 90° angle. 

b Unlikely to occur without bending. 

c Pipe severed over one eighth of circumference. 


where e is the strain, Fis the force applied (N), l is the length 
of pipe stretched (m), U is the energy absorbed (J) and 8 is 
the resultant elongation (m). As shown above, for a load 
applied rapidly, as in impact, the force is twice the static 
force. 

Considering first the failure modes for a load applied 
relatively slowly, the tensile failure mode involves failure of 
a section of the pipe under tension due to application of a 
load which causes the ultimate tensile stress to be exceeded. 
For this mode, the model for energy absorbed, or work 
done, is given by Equation 17.35.1 using the impact force 
value. 

For bending, two regimes were considered: elastic bend¬ 
ing and plastic bending. When a pipe is bent, it first 
responds elastically and then starts to yield. Once yielding 
has begun, an increasing proportion of the cross-section 
deforms plastically, in compression on one side of the pipe 
and in tension on the other. The pipe cross-section becomes 
oval and then a buckle forms on the compression side. For 
this mode, the model for energy absorbed, which is that 
applicable to the plastic regime, the energy absorption in 
the elastic regime being negligible, is essentially 

U = <t>d [17.35.3] 

where 0 is the angle of the bend (rad) and tj) is the plastic 
moment (Nm). 

For shear, the limiting shear force depends on the details 
of the loading. One approach is to assume that the 
distribution of the shear stress is similar to that in a cir¬ 
cular tube acting as a beam. An estimate may then be made 
of the energy for the shear displacement of one pipe wall 
thickness. 

For cutting, two distinct modes are considered: cutting 
to leak and cutting off. The first involves cutting through to 


5 = le 
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the extent that a leak occurs and the second cutting to the 
extent of a complete guillotine break. For this mode, the 
model used for energy absorbed is that of Lu (1989). This 
model is based on measurement of the energy absorbed 
when a sharp rigid wedge is pushed through a flat steel 
plate. This energy is 

^j = 3y, j small [17.35.4] 

= 2.50^ , 5 < y < 100 [17.35.5] 

where L is the length of the cut (m), t is the thickness (m) 
and (7 y is the yield stress (N/m 2 ). The length of the cut is 
taken for cutting to leak as part of the circumference and 
for cutting off as the whole circumference. 

For denting, again two modes are considered: denting by 
a concentrated force and denting by an edge. These evi¬ 
dently correspond to denting by a blunt and by a sharp- 
edged object, respectively. For the first mode, in which the 
load is assumed to be a radial force applied over a circular 
area of the pipe, the model for energy absorption used is 
that of A.J. Morris and Calladine (1971). The force for plastic 
collapse is determined and the energy absorbed is obtained 
from this force and the depth of the dent, using Equation 
17.35.1. 

For the second mode of denting, in which the load is 
assumed to be applied by a sharp-edged object at right 
angles to the pipe, the model for energy absorption used is 
that of Wierzbicki and Myung Sung Su (1986). 

Moving on to the failure modes for a load applied very 
rapidly, these modes occur only if at impact the fragment 
has a certain minimum velocity as well as the requisite 
minimum energy. For these modes, therefore, Table 17.52 
gives minimum values for both velocity and energy. 

Dynamic tensile failure is caused by the very sudden 
application of a tensile load. For the minimum velocity, the 
model used is based on the work of Kolsky (1963) on tensile 
plastic waves in a bar whose end is suddenly given a veloc¬ 
ity v. It applies to the case where the velocity thus imparted 
exceeds that at which the steel just becomes plastic. The 
velocity v is related to the strain e p behind the plastic 
wave front set up by the impact. If the velocity is high 
enough for this strain to reach the ultimate tensile strain, 
failure occurs. The relation between the velocity v and the 
strain e p is 

» = pWt(e)/p] 1/2 de [17.35.6] 

where e is the strain, e p is the strain behind the plastic wave 
front, v is the imparted velocity (m/s), p is the density of 
steel (kg/m 3 ) and <r t is the tensile stress (N/m 2 ). 

For the minimum energy for dynamic tensile failure, the 
approach is similar to that for the quasi-static tensile fail¬ 
ure described above, except that a factor, taken as 3, is 
applied to the yield stress to allow for the suddenness of the 
application of the load, or dynamic effect. 

Dynamic puncturing is gouging caused by high velocity 
impact. For the minimum velocity the model used is based on 
the velocity required to raise the local compressive stress to 
the yield point and thus just to enter the plastic regime and is 

ffc = pcv [17.35.7] 


where c is the velocity of elastic compression waves in steel 
(m/s), v is the velocity of impact of the missile (m/s) and a c 
is the compressive stress caused by the impact (N/m). 

For the minimum energy for dynamic puncturing, the 
model used is that of W. Johnson (1972). This model gives 
the energy required to gouge out a cavity and is 

U - 3oy V c [17.35.8] 

where V c is the volume of the cavity (m 3 ). The yield stress 
used here is again enhanced by a factor of 3 to allow for the 
dynamic effect. 

17.36 Explosion of a Cased Explosive 

Another event which can give rise to missiles is the explo¬ 
sion of a cased explosive. This is considered in this section. 
Whilst the discussion has most relevance to an explosion 
involving munitions, there are features which have wider 
application. 

There is obviously a large volume of work done by the 
military dealing with the various aspects of this problem. 
In particular, the accounts given in Structural Defence by 
Christopherson (1946) and in the Textbook of Air Arma¬ 
ments (referred to below as th eTextbook) by the Ministry of 
Supply (1952) provide a basic starting point, though this 
needs to be supplemented by more recent work on the spe¬ 
cific aspects. 

A model for an exploding object which draws on this 
work has been given by Gilbert, Lees and Stilly (1994f,g), 
and the account here is based mainly on this. 

In addition to the models specifically for fragments from 
cased explosives described below, further material on mis¬ 
siles is given in Section 17.34. 

17.36.1 Exploding object 

The exploding object primarily considered is a cased high 
explosive, typically a shell or bomb. The explosive could be 
some combination of TNT and RDX. The following treat¬ 
ment, therefore, is in terms of weapons. 

17.36.2 Fragment mass distribution 

The fragmentation behaviour of a cased explosive varies 
depending on the nature of the casing. A plain casing 
will undergo natural fragmentation. An armament such 
as a shell may be high explosive or shrapnel. In the latter 
case the casing is designed to give a particular pattern of 
fragments. 

The fragment mass distribution of this latter type of 
casing is obtained experimentally by conducting an 
explosion and collecting the fragments formed. In 
some cases information is also obtained on the fall of the 
fragments. 

Work on fragment mass distribution (FMD) includes 
that of Mott (1947), Held (1968,1979,1990), Grady (1982a,b), 
C.E. Anderson, Predebon and Karpp (1985), Burman 
(1989), Helwig, Klee and Hubner (1989) and Jagusch (1989). 

An early method of representing the FMD was that of 
Mott (1947). That described here is the method developed 
by Held (1968,1979,1990). The correlation is 

M{n) = M 0 [ 1 - exp(-Sw J -)] [17.36.1] 

where M(ri) is the cumulative fragment mass, or overall 
mass of the fragments of number n, starting with the 
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largest fragment, M 0 is the total mass of fragments, n is 
the number of the «th largest fragment, or cumulative 
fragment number, and B and X are constants. 

The mass m of the «th fragment is obtained from 
Equation 17.36.1 by differentiation: 

m = = MoBXn*- 1 exp( -Bn*) [17.36.2] 

Held (1990) gives as an example the fragment mass dis¬ 
tribution of the Hispanic Suiza 30 x 170 mm incendiary 
high explosive projectile.The parameters which he obtains 
for this weapon are M 0 = 288.7 g, B = 0.511 and X m- 
0.7318. 

In some cases an improved fit for higher values of n is 
obtained by replacing M a with a modified mass M aB 
defined as that value which best fits the set of equations 


Equation 17.36.1 then becomes 
M{n) = Af oB [l - exp(-H B n AB )] 


[17.36.3] 


[17.36.4] 


that for a weapon on its side, fragments of the cylindrical 
part of the casing are ejected in two broad sectors, whilst 
for a weapon standing vertically the fragments are ejected 
in all directions; in both cases the end cap and base can be 
taken as travelling along the axis of the weapon. 

It is also necessary to consider the angle of elevation. In 
principle, for the case of an exposed person standing ver¬ 
tically, three cases need to be considered, as illustrated in 
Figure 17.103. In the near field, shown in Figure 17.103(a), 
the fragments hitting the human target are those projected 
at low angle a; the fragments approach the target with near 
normal incidence. In the medium field, shown in Figure 
17.103(b), the target is struck by some fragments of low 
trajectory issuing at angle P±S 1 and others of high trajec¬ 
tory issuing at angle y ± <5 2 ; in both cases the fragments 
approach the target obliquely. Finally, at the limit of the 
fragment range, shown in Figure 17.103(c), these two tra¬ 
jectories combine; again the fragments approach the target 
obliquely. This is an idealized model. In practice, due to air 
drag, fragments slowing below a critical velocity will tend 
to stall. 

Frequently weapons are in an ordered stack. Alter¬ 
natively, in an accident, they may be in a disordered pile. In 
each case there is an effect on the angle of projection. Stack 
effects on projection angle are discussed in Section 17.36.11. 


where B b and X B are constants. 

The risk from explosion of a cased explosive depends on 
the number and size of the fragments. As the number of 
fragments increases, the risk initially increases but even¬ 
tually decreases as the fragments become too small to 
cause injury. 

Often it is a stack of weapons which is of interest. Stack 
effects on FMD are considered in Section 17.36.11. 

17.36.3 Projection angle of fragments 

Methods exist for the estimation of the angle at which the 
fragments from a single weapon are projected. Treatments 
include those of Christopherson (1946), G.I. Taylor 
(1963a,b) and Karpp and Predebon (1974). 

A discussion of the direction in which fragments are 
projected is given by Christopherson (1946). He states, 
‘Fragments of the case are, in general, projected normally 
to the inner surface on which the pressure of the explosive 
gases acts at the moment of break-up.’ 

Weapons such as bombs have some curvature along their 
length, which tends to spread fragmentation over a wider 
zone. If detonated at one end the casing becomes conical 
rather than cylindrical, directing fragments away from the 
initiating end. 

A study of the fragmentation of tubular bombs was con¬ 
ducted by G.I. Taylor (1963a,b). He gives the following 
equation for the angle </> formed by the deforming case 
relative to the direction of the detonation wave: 


17.36.4 Initial velocity of fragments 

Methods of determining the initial velocity of the frag¬ 
ments from a weapon include those given in the Textbook, in 
Structural Defence and by Gurney (1943), VJ. Clancey 
(1972b), Kamlet and Finger (1979) and E. Hirsch (1986). 

One approach to the estimation of the initial velocity of 
fragments is the use of empirical rules. The Textbook sug¬ 
gests values for the initial velocities of 4000 ft/s for bomb 
fragments and 3000 ft/s for shell fragments. 

For fragments from the bursting of a cased TNT charge 
the following empirical values of initial velocity have been 
given by V.J. Clancey (1972b) in the context of incident 
investigation: 

Thin case 8000 ft/s 

Medium case 6000 ft/s 
Thick case 2000 ft/s 

This approach provides a useful guideline, but as Clancey 
points out, it assumes that any size charge will propel 
fragments the same distance, which is not the case - larger 
explosions tend to project fragments further. 

One equation for the initial velocity of the fragments 
is that given in Structural Defence by Christopherson 
(1946): 

V 0 = {8.22 x 10 7 [1 - exp(-0.69E/C)]} 1/z [17.36.6] 


2 sin (j> = u 0 /D [17.36.5] 

where D is the velocity of detonation (VOD), u a is the initial 
velocity of the fragment (VOF) and <j> is the angle to the axis 
of the tube at which fragments are projected. (j> is known as 
the Taylor angle. 

In practice, these models of projection angle appear of 
limited use in accident modelling, where the appropriate 
approach depends on the particular case. Considering the 
plan view, it will be sufficient in many scenarios to assume 


where C is the mass of the uniform cylindrical case per unit 
length (lb), E is the mass of charge per unit length (lb) and 
V 0 is the initial velocity (ft/s). Equation 17.36.6 is a gen¬ 
eralization of an empirical equation obtained by Payman 
for small tetryl filled bombs. Christopherson states, ‘for a 
medium case bomb, the initial velocity of fragments will 
not exceed approximately 7500 ft/s.’ 

The correlation for initial velocity which appears to be 
most widely used is that of Gurney (1946). The Gurney 
model is based on a fundamental energy balance. The sum 
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Figure 17.103 Angle of projection in the vertical plane of missiles from a cased explosive: (a) near field (b) medium field 
and (c) limit of range (Gilbert, Lees and Scilly, 1994f) 

of the kinetic energy of the fragments and the energy of the the gaseous explosion products increases from 0 at the 
expanding explosion products is equated to the internal centre of the mass of the explosive to a maximum which is 
energy of explosion. It is assumed that all the fragments are also the velocity of the fragments at the moment of break- 
projected out at the same velocity and that the velocity of up of the casing. 
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The equation given by Gurney for the initial fragment 
velocity u a is 

[I736 ' 71 

Cb »[2(—AB)] 1/2 [17.36.8] 

where C is the mass of explosive (kg), AE is the internal 
energy of explosion per unit mass of explosive (J/kg), M is 
the mass of the cylindrical section of the casing, and hence 
of the sidewall fragments (kg), u a is the initial fragment 
velocity (m/s) and C G is the Gurney constant (m/s). C G is 
also commonly known as the Gurney velocity. 

The Gurney constant is one of the standard parameters 
of an explosive. Values for a number of the more common 
explosives are given by Kinney and Graham (1985). 

The use of the Gurney equation to determine the velocity 
of fragments from an explosion is known as a Gurney 
analysis. Accounts of such analysis have been given by 
G.E. Jones, Kennedy and Bertholf (1980) and Kinney and 
Graham (1985). 

Further treatments of the Gurney method have been 
described by Kamlet and Finger (1979) and E. Hirsch 
(1986). Kamlet and Finger give for the Gurney constant the 
following relation: 

Cb = O.8870 as p®- 4 [17.36.9] 

</> = NM°- 5 QP- 5 [17.36.10] 

where C G is the Gurney constant (km/s), M is the average 
molecular weight of the products of explosion, N is the 
number of moles of gas produced by the explosion, Q is the 
heat of detonation (cal/g), p a is the explosive loading den¬ 
sity (g/cm 3 ) and </> is a parameter. Stack effects on initial 
velocity are considered in Section 17.36.11. 

17.36.5 Flight of fragments 

Treatments of the flight and retardation of fragments 
include those in the Textbook and in Structural Defence and 
by Zaker (1971) and Naz (1989). For the retardation of frag¬ 
ments the Textbook gives 

u = u 0 exp( -s/284 m 1 ^ 3 ) [17.36.11] 

where m is the mass of the fragment (oz), s is the distance 
travelled (ft), u is the velocity of the fragment (ft/s) and u a is 
its initial velocity (ft/s). 

In his account in Structural Defence, Christopherson 
states: 

Immediately after the case has broken up, the shock 
front expands more rapidly than the case, and thus at this 
stage the fragments are surrounded by air moving out¬ 
wards , at a velocity comparable to their own. It is not long, 
however, before the rapid deceleration of the shock front 
due to the falling shock-wave pressure allows the frag¬ 
ments to overtake it and pass through it into the zone of 
undisturbed air beyond. As soon as this happens - and it 
happens within a few feet of the bomb — the fragments 


are retarded by a force which is proportional to the square 
of their velocity, and to the area presented. Under these 
conditions, it is easy to show that the velocity at a distance 
x ft from the origin is given by an equation of the form 

u = u 0 exp {-kxA/m) [17.36.12] 

whereA is the area of the fragment, u is the velocity of the 
fragment, u a is the velocity of the fragment at the com¬ 
mencement of retardation by air drag, m is the mass of the 
fragment, x is the distance and k is a constant. 

It should be noted that Christopherson’s statement that 
the drag force is proportional to the square of the velocity 
applies to the subsonic regime only. 

Christopherson quotes the following relations for the 
velocity of a fragment in air, based on a generalization of an 
equation given by Payman for tetryl filled tubes 


u = u 0 exp( -0.00204*a/m 1/3 ), u > u s 

[17.36.13a] 

u = u a exp(-0.00137 xa/nf^) u<u s 

[17.36.13b] 

with 


a = A m /Q?' 3 

[17.36.14] 


where a is the dimensionless coefficient of area, A m is the 
mean area presented by the fragment in flight (ft 2 ), Q is the 
fragment volume (ft 3 ), u is the velocity of the fragment 
(ft/s), u Q is the initial velocity of the fragment (ft/s), u s is 
the velocity of sound (ft/s), m is the mass of the fragment 
(oz) and x is the distance (ft). The value quoted for the 
velocity of sound is 1100 ft/s. 

For natural fragmentation Christopherson quotes work 
at the Safety in Mines Research Station to the effect that 

a = 1.93 + 1.3m [17.36.15] 

Christopherson states that for a cube the value of a is 1.5, 
but that for natural fragments it is higher. He argues that 
there will be very few fragments for which the term a/m 1/3 
is less than 2. Equation 17.36.15 gives for a/m 1/3 a minimum 
value of 3.2 at m = 0.75 oz. 

A large fragment tends to retain its velocity. Such a 
fragment will travel some hundreds of feet before its velocity 
is halved. 

The model for fragment flight given by VJ. Clancey 
(1972b) and quoted in Section 17.34 appears very similar to 
that of Christopherson. 

Another relation for the flight of a fragment from a 
weapon is that given by Naz (1989): 

« = «„exp^- C ^ s p a ^ [17.36.16] 

where A s is the effective area of the fragment (m 2 ), C x is the 
drag coefficient, m is the mass of the fragment (kg), u is the 
velocity of the fragment (m/s), u D is its initial velocity (m/s), 
x is the distance (m) and p a is the density of air (kg/m 3 ). For 
the effective area A s Naz gives 

A s = (w/4)fl 2 sphere [17.36.17a] 

A s = (3/2)fl 2 cube [17.36.17b] 
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where a is the diameter of the sphere or the side of the 
cube (m). 

For the coefficient C* Naz gives relations from the work of 
Suterlin (1966), which show the coefficient for spheres, 
cubes and cylinders as a function of Mach number. He 
also quotes work by McCleskey (1988a) which shows that 
there is a considerable scatter in observed values of the 
coefficient. 

17.36.6 Range of fragments 

The account of fragment flight given by Christopherson in 
Structural Defence also includes a treatment of the maxi¬ 
mum range of a fragment. From Equation 17.36.13a and 
taking a/m 113 as 2, 

u = u 0 exp(-0.00409x) [17.36.18] 


in bomb disposal work. This is given by Kinney and 
Graham (1985), quoting Lenz (1965), as follows: 

r = 120 W V3 [17.36.23] 

where r is the safety distance (m) and W is the mass of 
explosive (kg). There is a minimum distance of 90 m. How¬ 
ever, since this is a safety formula it may be expected to 
incorporate a safety factor. 

17.36.7 Mean presented area of fragments 

The mean presented area (MPA) of the fragments is rel¬ 
evant both to their flight and to their injuring power. In the 
treatment just given, which is concerned with flight, the 
MPA is given by Equations 17.36.14 and 17.36.15. 


Then, from this equation the distance at which the velocity 
u falls to the velocity of sound u s is 


17.36.8 Number of fragments hitting target 

Following the Textbook, the number n of incapacitating 
fragments is 


x= [ln(« o /«s)]/0.00409 [17.36.19] 

For an initial velocity of 7500 ft/s Christopherson obtains 
a distance of 475 ft. 

Then, noting that u = dxfdt and integrating Equation 
17.36.18 with respect to time gives 

* = [b(l + 0.00409«„/)] /0.00409 [17.36.20] 


t = [exp(0.00409x) - l]/(0.00409tt„) [17.36.21] 

From Equation 17.36.21 the time for transition to subsonic 
velocity is only 0.2 s. This is a negligible proportion of the 
total flight time. 

Utilizing Equation 17.36.13b again with a value of 
the term a/m 113 of 2 and integrating as before, taking the 
initial velocity now as that of sound gives 

* = [ln(l + 0.00273« s f)] /0.00273 [17.36.22] 

Christopherson obtains a maximum value of the flight 
time of 330 s, on the basis that the flight time is necessarily 
less than the flight time to maximum range in the absence 
of air resistance, which is V v /2g, where V w is the initial ver¬ 
tical velocity (ft/s), and that the value of this term for 
maximum range is necessarily less than V 0 /2 112 . Then, 
substituting this flight time of 330 s in Equation 17.36.22 
gives a travel distance of 2530 ft, which together with the 
distance of 475 ft travelled in the supersonic range yields 
for the maximum range of the fragment a total distance of 
3005 ft. He compares this with the distance of 1000 yards 
usually taken as the danger area for a 1000 lb medium 
capacity (MC) bomb and comments that the latter is cer¬ 
tainly on the safe side, though not so grossly as might be 
expected in view of the crudeness of the method adopted. 

There is also available some empirical guidance on the 
range of fragments from cased explosives. The empirical 
correlation for the maximum horizontal range of fragments 
from a cased charge given by V.J. Clancey (1972b) has been 
described in Section 17.4. 

Guidance is also available from relationships for safety 
distances. A formula of this type is the US safety distance 




q(v, x)r(x)dv 


[17.36.24] 


where n is the number of incapacitating fragments, q is the 
number of fragments of equivalent velocity v at a distance 
x, r is the proportion of fragments of equivalent velocity v at 
a distance x capable of causing incapacitation, v is the 
velocity of the fragment (ft/s) and x is the distance (ft). 

The density of incapacitating fragments over the area of 
a sphere centred on the exploding object is 


N(x) n(x) 
s/tj,. ' Anx 2 


[17.36.25] 


where A p is the projected area of the exposed person (ft 2 ) 
and N is the average number of incapacitating fragments 
at a distance x. Hence 


N(x) = 


n{x)A? 

Anx 2 


[17.36.26] 


The value of the projected area A p does not appear to be 
given explicitly in th eTextbook, but a value of 2.8 ft 2 may be 
inferred. 

The probability p of being hit by one or more incapaci¬ 
tating fragments is taken as given by the Poisson dis¬ 
tribution and is therefore 

p = 1 - exp[-A(x)] [17.36.27] 

A vulnerable area M v may be defined as the equivalent 
ground area in which probability of incapacitation is unity. 
This vulnerable area is 

M v m f p(x)x dx [17.36.28] 

whereM T is the vulnerable area (ft 2 ). 

The vulnerable area so defined takes no account of any 
hard cover which may provide protection from the frag¬ 
ments. 

The Textbook gives as an illustrative example the deter¬ 
mination of the fragments from a British 20 lb bomb. The 
example is described by Gilbert, Lees and Stilly (1994f). 
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17.36.9 Textbook model 

The model of an exploding weapon given in the Textbook 
utilizes the framework relations Equations 
17.36.24-17.36.27 together with the following supporting 
equations. The FMD is obtained from experimental values 
for the particular weapon. The fragments are evidently 
assumed to be projected equally in all directions with an 
initial velocity obtained from the empirical values quoted. 
The flight and retardation of the fragments are given by 
Equation 17.36.11. As described in Section 17.42, the Text¬ 
book also includes an injury model. 

17.36.10 Model of Gilbert, Lees and Scilly 

In the model of Gilbert, Lees and Scilly (1994f) use is again 
made of Equations 17.36.24-17.36.27 as the framework, but 
with a different set of supporting relations. The FMD is 
based on fitting the experimental values for the weapon to 
Equation 17.36.1 of Held. The angles of projection in plan 
and elevation depend on the problem considered and guid¬ 
ance is given on this aspect. For the initial velocity use is 
made of the Gurney equation (Equation 17.36.7) with the 
Gurney constant given by Equation 17.36.9 of Kamlet and 
Finger. The flight and retardation of the fragments is 
described by Equation 17.36.13 of Christopherson, which 
covers both sonic and subsonic regimes. 

The model is used in conjunction with the model for 
injury from penetrating fragments given by the authors 
and described in Section 17.42. 

Gilbert, Lees and Scilly (1994g) also describe a computer 
program EXFRAG which gives for an exploding weapon 
the probability of defined degrees of injury as a function 
of distance and give an illustration of the results obtained. 

17.36.11 Stack effects 

In the foregoing treatment the exploding object is taken as 
a single weapon. In many situations of practical interest it 
is likely to be a stack of weapons. There is a potential stack 
effect on each of the following features: (1) the number of 
fragments, (2) fragment mass distribution, (3) the projec¬ 
tion angle of the fragments, and (4) the initial velocity of the 
fragments. 

There is little published information which can be used 
to quantify these effects, but the following qualitative 
comments can be made. In a stack explosion, a significant 
proportion of the fragments hit other objects within the 
stack and do not leave the stack. This potentially affects not 
only the number but also the mass distribution of frag¬ 
ments leaving the stack. The angle of projection of the 
fragments depends on the nature of the stack, which may 
be an ordered stack or a disordered pile. The former has to 
bedealtwithonacasebycasebasis, whilst for the latter the 
common assumption is that the fragment density is the 
same in all directions. There may also be stack effects on 
the initial velocity in so far as fragments may be further 
accelerated by the hot gases from the explosion. 

17.37 Explosion of an Explosive Load 

Another situation which it may be necessary to model is the 
explosion of a load of condensed phase explosives, either 
uncased or cased. The former might typically he blasting 
explosives, the latter munitions. 

Models for the explosion of a condensed phase explosive, 
particularly in a built-up area, have been given by Withers 
and Lees (1991) and Gilbert, Lees and Scilly (1994a—i). The 


model of the latter is encoded in the program EXMOD, 
which incorporates the program EXFRAG. 

The following account of the modelling of this situation 
is based on the work described by the latter authors. Using 
appropriate physical models, it is possible to estimate as a 
function of distance the intensity of the various physical 
effects and hence, using the corresponding injury rela¬ 
tions, the probability of defined types of injury for defined 
types of exposure. Then, using a suitable model for the 
numbers with each type of exposure as a function of dis¬ 
tance, an estimate can be made of the numbers suffering 
each type of injury. Where the explosion occurs not at the 
start but during the course of an incident, separate esti¬ 
mates can be made for different times into the incident. 

17.37.1 Exploding object 

The exploding object is envisaged as a load of explosives, 
typically uncased civil explosives or cased explosives in 
the form of munitions such as shells, bombs, etc. 

17.37.2 Explosion scenario 

The elements of the scenario are the events prior to the 
situation of imminent risk; the explosion itself; the persons 
at risk; the physical characteristics of the location and the 
human behaviour prior to the explosion. 

The most common scenario for the realization of the 
hazard is that of engulfment of the explosive load in a fire 
which lasts long enough to initiate an explosion. This sce¬ 
nario is important not only by virtue of its relative fre¬ 
quency, but also because all the features just mentioned are 
relevant, which is not the case for every scenario. 

The approach to scenario development takes as its 
starting point the persons at risk, in other words the tar¬ 
gets of the explosion. Categories of persons exposed are 
defined which are intended to be exhaustive over the whole 
course of the scenario and estimates made of the numbers 
in each category at the start of the scenario and of the 
change in these numbers with time until the explosion 
occurs. 

If the explosion is caused by a sudden event such as 
impact, the start is the explosion itself. If it is caused by a 
more gradual event such as fire, the start is the occurrence 
of an event observable either by the vehicle crew or the 
public. 

17.37.3 Explosion effects 

The principal effects of a condensed phase explosion such 
as the explosion of a load of cased explosives on a lorry are: 

(1) blast; 

(2) fireball; 

(3) missiles 

(a) primary fragments, 

(b) secondary missiles; 

(3) crater; 

(4) building damage. 

Primary fragments include those generated by the disin¬ 
tegration of the casing and are also taken to include those 
from the vehicle. Secondary fragments include fragments 
from the crater and objects set in motion by the blast wave, 
not only objects travelling in a more or less horizontal 
direction, but others such as glass, falling vertically. The 
blast wave may also cause translation of the human body, 
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causing it to fly through the air or to tumble along the 
ground, and possibly to impact with some hard object. 

There may also be other effects. For example, in some 
large explosions of explosives in ships at docks, hot frag¬ 
ments have been ejected which then caused secondary 
fires. These effects are not, however, considered in the 
model. 

17.37.4 Population exposure 

These explosion effects act on an exposed population. For 
this particular type of incident it is necessary to model this 
population in some detail. The exposure model used covers 
the population density, the population’s disposition 
indoors and outdoors, the categories of exposure, the inci¬ 
dent scenarios and the vulnerabilities of persons in each 
exposure category in given scenarios. 

For exposure a basic distinction is between persons 
indoors and those outdoors, since this affects vulnerability 
to the individual injury mechanisms. For example, persons 
outdoors are more vulnerable to fragments from the casing 
and those indoors to building collapse. 

For each of these groups further distinctions are made 
based on situation or behaviour. For those indoors the 
classification used is: 

11 Persons unaware or aware of the incident who go about 

their normal business 

12 Persons aware of the incident who observe it through 

a window (or those unaware who happen to be close 
to a window). 

The classification used for those outdoors is: 

01 Persons on foot unaware or aware of the incident who 
go about their normal business. 

02 Persons occupying vehicles near to the scene. 

03 Persons on foot aware of the incident who have come 
to the scene as spectators. 

04 Members of the emergency services who have come to 
the scene. 

As stated above, the numbers of persons in each category 
will in principle change with time, but the scope for such 
change will depend on the interval between the start of the 
scenario and the explosion. 

At the start of the scenario, there are persons in cat¬ 
egories II, 12, 01 and 02 but, by definition, in no other 
category. Persons in 01 are essentially pedestrians who are 
passing by or gathered for some purpose such as an open 
market. 

If the scenario takes a finite time to develop, the numbers 
in each indoor category may be expected to change. Per¬ 
sons indoors may observe the scene through windows. 
Alternatively, they may take evasive action against the risk 
of an explosion, either by moving further away or by chang¬ 
ing posture. Some pedestrians may continue about their 
business, but others will take evasive action, essentially by 
quitting the scene. Those who by contrast are attracted to 
the scene are classed as spectators. Likewise, the occu¬ 
pants of vehicles may continue on their journey or may stay 
near the scene, possibly as spectators, but more probably 
owing to obstruction of the traffic. In due course, members 
of the emergency services will arrive. The total number 
exposed is not assumed to be constant; it may decrease or 
increase. 


The model therefore gives the number of persons 
exposed in each category at the start of the scenario and 
over its course. It may be used to obtain an instantaneous 
picture, or ‘snapshot’, of these numbers at any time up to 
the explosion. 

17.37.5 Blast 

The blast effects for a condensed phase explosive used in 
the blast submodel are the peak incident overpressure and 
impulse and the peak dynamic pressure and dynamic 
pressure impulse, obtained from the relations given in 
Section 17.26. 

Eardrum rupture is a function of peak incident over¬ 
pressure. Lung injury is a function of peak incident over¬ 
pressure and, for some postures, of peak dynamic pressure 
and of impulse. Whole body displacement is a function of 
peak dynamic pressure and dynamic impulse. The relevant 
injury relations are given in Section 17.38. 

17.37.6 Fireball 

The fireball from a condensed phase explosive is described 
by a submodel different from that for a hydrocarbon fire¬ 
ball. The relevant model is given in Chapter 16. Injury from 
the fireball occurs due to engulfment in the fireball or 
thermal radiation from it. It is assumed in the model that a 
person engulfed in the fireball is killed. The injury rela¬ 
tions for thermal radiation are those given in Chapter 16 
and are the same as those for injury by radiation from 
hydrocarbon fireballs or pool fires. 

17.37.7 Missiles 

The missile submodel treats six types of missile: (1) pri¬ 
mary fragments from the casing, if any; (2) fragments from 
the vehicle; (3) fragments ejected from the crater; (4) sec¬ 
ondary missiles set in motion by the blast; (5) falling 
masonry and glass; and (6) flying glass. 

The prime application of these models is to persons out¬ 
doors. However, they are also applicable to persons indoors 
who are near windows; the effect of falling masonry on 
persons indoors is taken into account in the separate 
housing damage model given in Section 1739. 

An outline of the model used for fragments from the 
casing and the vehicle has been given in Section 1736. The 
models for crater ejecta and for falling masonry and glass 
are described in Section 1734 and that for flying glass in 
Section 17.40. 

No separate model is used for the effects of secondary 
missiles on persons outdoors; the effect of such missiles 
indoors is taken into account in the housing damage model. 

17.37.8 Building damage 

The building damage submodel used is actually a housing 
damage model. 

The housing damage submodel used is the correlation 
between category of housing damage and mass of explosive 
as given by the revision by Gilbert, Lees and Stilly (1994c) 
of the Jarrett equation. This model is described in 
Section 17.33. 

17.37.9 Injury to persons outdoors 

The model for explosion injury outdoors is therefore based 
on four separate broad causes of injury: (1) blast causing 
eardrum rupture and lung injury, (2) blast causing injury 
by whole body displacement, or bodily translation, (3) 
injury from the fireball, and (4) injury from the following 
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types of missile: (4a) primary fragments from the casing, if 
any, (4b) fragments from the vehicle, (4c) crater ejecta, (4d) 
falling masonry and glass, and (4e) flying glass. The mod¬ 
els for injury from these various causes have just been 
described. The probability of injury outdoors is estimated 
by applying each of these submodels in turn. 

The model gives the probability of lethal injury for all 
the injury modes mentioned; in some cases it also gives 
the probability of sublethal types of injury, e.g. eardrum 
rupture. 

Allowance is made in the model for multiple injury, as 
described in Chapter 9 and in Section 17.38. 

17.37.10 Injury to persons indoors 

The model for explosion injury to person indoors is based 
on the correlation between category of housing damage and 
probability of injury described in Section 17.39.The latest is 
the model of Oswald and Baker (2000). 

This correlation gives the probability not only of lethal 
injury but also that of severe injury and light injury 

This model for injury to persons indoors includes injury 
from flying glass, but, where appropriate, this latter may be 
accorded separate treatment, using the model for injury 
from flying glass given in Section 17.40. 

17.37.11 Large targets 

The model also includes an estimate of the probability that 
an explosion occurring at random in a built-up area will 
find a target comprising a large number of people, such as a 
block of flats or a large store or market. The estimate is 
based on the size distribution of targets hit by V-2 rockets. 
From these data the authors give the following estimates of 
incident size versus probability of occurrence: 


Deaths 

Probability 

>10 

0.089 

>33 

0.014 




It should be borne in mind that the data include a number of 
cases where there was a direct hit and that the population 
densities in wartime London were much higher than they 
are today, by a factor in the range 1.5—2. 

17.38 Explosion Injury to Persons Outdoors 

For persons in the open there is a large amount of informa¬ 
tion available on specific explosion injury causes and 
modes. Accounts are given in The Effects of Nuclear Weap¬ 
ons (Glasstone, 1962; Glasstone and Dolan, 1980) and in 
Explosion Hazards and Evaluation (W.E. Baker et al., 1983). 

Much of the data on injury from explosions derives from 
the work of Zuckerman and co-workers in the 1940s, from 
work on the effects of nuclear weapons described by 
Glasstone (1962) and Glasstone and Dolan (1980) and from 
an extensive programme of research at the Lovelace Foun¬ 
dation in the 1960s, 1970s and 1980s, which has been 
reported by Bowen, Fletcher, Richmond, White and other 
workers. Some of this latter work is listed in Appendix 28. 

A set of correlations of explosion injury is given in the 
Green Book. 

The causes of explosion injury to a person in the open 
include the following: (1) blast, (2) whole body displace¬ 
ment, (3) missiles, (4) thermal effects, and (5) toxic effects. 


The modes of explosion injury due to these causes 
include (1) eardrum rupture, (2) lung haemorrhage, 
(3) whole body displacement injury, (4) missile injury, 
(5) burns, and (6) toxic injury. 

In the case of outdoor exposure, it is generally possible 
to apply the injury relations for the individual physical 
causes, provided that where applicable due allowance is 
made for the effects of more than one cause. 

There are several ways in which injury may be corre¬ 
lated. One is in terms of single values of the injurious 
physical effect, of which the threshold value and the value 
for 50% probability of injury are particularly impor¬ 
tant. Another is a probit equation, which also generally 
correlates the probability of injury with a single physical 
effect, typically overpressure. A third is in the form of a 
P-I diagram. 

Data in forms such as threshold and 50% probability 
values are illustrated by those given in Table 17.53 from the 
work of Glasstone and of White. 

Probit equations have been widely used to express injury 
relations. The use of probit equations is illustrated by the 
many correlations of injury given by the Lovelaci Founda¬ 
tion workers which are cast in this form. 

The probit equation form is also that used in the vulner¬ 
ability model described by Eisenberg, Lynch and Breeding 
(1975). Much of the data on which these relations are based 
derives from the work of Fugelso, Weiner and Schiffman 
(1972). These relations have beer quite widely used, mainly 
for lack of other data, and some are described below, but 
comparison with the other relations given indicates that 
they generally predict considerably higher levels of injury 
than those by other researchers. 


Table 17.53 Some data on the injury effects of 
explosions: direct blast effects 


Effect 

Effective peak overpressure a (psi) 



Duration 



Glasstone b 

White c 


‘Long’* 5 

3ms c 

400 ms 

Eardrum rupture 
Threshold 

5 

5 

5 

50% (>20 years old) 

15-20 

15-20 

15-20 

50% (<20 years old) 

30-35 



Lung damage 
Threshold 

12 (8-15) 

37-49 

12-15 

Severe 

25(20-30) 

>98 

>37 

Lethality 

Threshold 

40(30-50) 

112-156 

37-52 

50% 

62(50-75) 

156-217 

52-72 

100% 

92(75-115) 

217-302 

72-100 


a This overpressure is described as the maximum effective over¬ 
pressure. It is stated that this may be one of the three defined over¬ 
pressure, one of which is the maximum incident overpressure for 
free-stream exposure if the axis of the subject is parallel to the direc¬ 
tion of travel of the blast wave. 

b Tentative criteria for some injury effects applicable to a fast-rising, 
long-duration overpressure (after Glasstone, 1962). 
c Tentative criteria for some injury effects in young adults applicable 
to fast-rising, short- or long-duration overpressure (after C.S. White, 
1968b). 
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The third form of P—I diagram is illustrated by those 
given by W.E. Baker et al. (1983). 

17.38.1 Eardrum rupture 

The data for eardrum rupture given by Glasstone (1962) 
and by C.S. White (1968b) are shown in Table 17.53. 
Both sets of data apply to rapidly rising overpressure. In 
general, White distinguishes between short- and long; 
duration overpressures, but his data for eardrum rupture 
are identical. 

Relations for eardrum rupture are given in the vulner¬ 
ability model described by Eisenberg, Lynch and Breeding. 
They quote the following data from Fugelso, Weiner and 
Schiffman: 


Probability of 
eardrum rupture (%) 

Peak overpressure 

(psi) 

(N/m s ) 

1 (threshold) 

2.4 

16,500 

10 

2.8 

19,300 

50 

6.3 

43,500 

90 

12.2 

84,000 


They derive from these data a probit equation relating 
eardrum rupture to peak overpressure: 


Y = -15.6 +1.93 In p° [17.38.1] 

where p° is the peak overpressure (Pa) and Fis the probit. 

Eardrum rupture has been discussed by F.G. Hirsch 
(1968), who reviews the physiology of the ear and injury to 
it and summarizes the available data on the blast condi¬ 
tions causing rupture. 

The ear responds to sound waves, and a blast wave is 
physically the same phenomenon. For sound waves the ear 
responds over the frequency range 20-20,000 Hz and at 
very low energy levels. It is unable, however, to respond 
faithfully to a pulse with a period of less than 0.3 ms, and 
the attempt to do so results in a single, large excursion, and 
it is this which causes rupture.The response is governed by 
the peak overpressure and the rise time of the overpressure. 

Hirsch states that it has been established that there is a 
direct relation between peak overpressure and eardrum 
rupture. 

He states further that there is evidence that other para¬ 
meters such as rate of rise and positive and negative dura¬ 
tion also have an influence. Rapid rise of overpressure 
tends to increase the probability of rupture. Hence, data 
from loading by explosion overpressures is more applicable 
than data from loading by static pressures. 

Zalewski (1906) performed tests in which cadavers were 
subjected to static pressures. He obtained a mean pressure 
for rupture of 22.9 psi. Zuckerman and co-workers (Blake 
et al., 1941) did work on cadavers, but used slow rising over¬ 
pressures from explosions. They found for 50 % probability 
an overpressure of about 1 atm (14.7 psi). In other studies 
on air raid casualties they obtained for 50% probability of 
rupture a lower limit of 15 psi and an upper limit of 50 psi. 

G.A. Henry (1945) studied 292 men who had been sub¬ 
jected to a landmine explosion, 52 % of whom had suffered 
eardrum rupture. He estimated the overpressure as 17 psi. 
Other data reported on eardrum rupture are those of Vadala 
(1930) for anti-aircraft gun blast and those of Reider (1968) 


for two industrial explosions. These data have been plotted 
by Hirsch as shown in Figure 17.104. 

Hirsch reviews the data for threshold and 50% prob¬ 
ability of eardrum rupture and obtains for a fast rising 
overpressure, pulse estimates of 5 and 15 psi, respectively. 

The probit equation for eardrum rupture obtained from 
Figure 17.104 is 

Y = -12.6 + 1.524 In p° [17.38.2] 

Equation 17.38.2 is that given for eardrum rupture in the 
Green Book. 

On the basis of the data given by Hirsch, WE. Baker et al. 
(1983) have derived a P-I diagram for eardrum rupture. 
The lines for the threshold and 50% probability values are 
horizontal lines and correspond to peak overpressures of 
5 and 15 psi, respectively. 


17.38.2 Lung injury 

Direct blast effects, particularly lung haemorrhage, have 
been studied by a number of workers, including Zuckerman 
(1940, 1941), Krohn, Whitteridge and Zuckerman (1942), 
Glasstone (1962), I.G. Bowen, Fletcher and Richmond 
(1968), Richmond, Damon et al. (1968), C.S. White (1968b) 
and C.S. White et al. (1971). 

Early work on direct blast effects was carried out by 
Zuckerman (1940), who combined experimentation on the 
exposure of tethered goats to explosions with analysis of air 
raid casualties. In the experiments he used 70 lb charges, 
giving an overpressure of about 15 psi at 30 ft with a dura¬ 
tion time of about 5 ms. Zuckerman estimated that for a 
500 lb bomb the lethal overpressure for man is between 
400 and 500 psi (between 27.6 and 34.5 bar). 

The data of Glasstone and of White are shown in 
Table 17.53. These data indicate for long overpressure 
pulses a 50% lethality at an overpressure of about 60 psi 



Figure 17.104 Injury effects of explosions: eardrum 
rupture (after F.G. Hirsch, 1968) (Courtesy of the New York 
Academy of Science) 
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(4.1 bar), but for short pulses much higher values of 
overpressure. 

Work by Withers and Lees (1991) suggests that the over¬ 
pressure for 50% lethality increases from about 10 bar for 
charges of 10 kg TNT to 4 bar for charges of 1000 teTNT. 

Relations for death due primarily to lung haemorrhage 
are given in the vulnerability model by Eisenberg, Lynch 
and Breeding. They quote the following data from Fugelso, 
Weiner and Schiffman: 


Probability of facility 

(psi) 

Peak overpressure 

(N/m 2 ) 

1 (threshold) 

14.5 

100,000 

10 

17.5 

120,000 

50 

20.5 

140,000 

90 

25.5 

175,000 

99 

29.0 

200,000 


They derive from these data a probit equation relating death 
primarily from lung haemorrhage to peak overpressure: 

Y = -77.1 + 6.91 In p° [17.38.3] 

Extensive work on direct blast effects was conducted in 
the 1950s and 1960s at the Lovelace Foundation and has 
been reported by Bowen, Fletcher, Richmond, White and 
co-workers (e.g. I.G. Bowen, Fletcher and Richmond, 1968; 
Richmond, Damon etal., 1968; C.S.Whiteefa/. 1971). 

This work has yielded a large amount of data on blast 
effects. The effects were studied for a variety of positions of 
the subject (standing, lying, etc.) and of situations of the 
subject (free stream, near wall, etc.). It was therefore 
necessary to correlate the results not only in terms of the 
peak incident overpressure, but also of various peak 
reflected overpressures. 

J.G. Bowen, Fletcher and Richmond (1968) distinguish 
between the cases shown in Figure 17.105. Figure 17.105(a) 
shows the case where the longitudinal axis of the body lies 



(b) 




Figure 17.105 Injury effects of explosions - postures determining lung injury (I.G. Bowen, Fletcher and Richmond, 
1968): (a) long axis of body parallel to the direction of the blast wave; (b) long axis of body perpendicular to the direction of 
the blast wave; (c) thorax near a surface against which the blast wave reflects at normal incidence 
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in the direction of the shock wave. For this case the peak 
applicable overpressure is 

Pl = p° [17.38.4] 

where p° is the peak incident overpressure (Pa) and p a ° is 
the peak applicable overpressure for lung injury (Pa). In 
Figure 17.105(b) the longitudinal axis of the body is per¬ 
pendicular to the shock wave. The peak applicable over¬ 
pressure is in this case 

Pl=p° + <f [17.38.5] 

where q° is the peak dynamic pressure (Pa). The dynamic 
pressure is given by the Green Book as q° = 5Ff/ 
(2 p s + 14 x 1(P) for p s in p a . The case where the body is in 
any arbitrary position in front of a surface on which the 
shock wave reflects is shown in Figure 17.105 (c). In this case 
the peak applicable overpressure is 
Pl = Pl [17.38.6] 

where />“ is the peak reflected overpressure. Expressions 
for the peak dynamic pressure and peak reflected 
overpressure are given in Equations 17.25.5 and 17.25.7, 
respectively. 

One of the correlations for lung injury caused by the peak 
applicable overpressure is shown in Figure 17.106. 

These injury relations have been converted by WE. 
Baker et al. (1983) to the alternative form of a P-I diagram 
as shown in Figure 17.107. The definition of the scaled peak 
applicable overpressure and scaled impulse for use in this 
figure are 

Pl = ~ [17.38.7] 


pl /2 mV 3 


[17.38.8] 


where i is the impulse (Pa s), i is the scaled impulse (Pa 1/2 s/ 
kg 1/3 ), m is the mass of the body (kg), / a is the atmospheric 
pressure (Pa) and is the scaled peak applicable over¬ 
pressure. These authors recommend the following values 
for body mass: babies 5 kg, small children 25 kg, adult 
women 55 kg and adult men 70 kg. These correlations of 
Bowen, Fletcher and Richmond and of Baker et al. are 
referred to in the Green Book, which gives a P-I diagram 
broadly similar to Figure 17.107 together with the following 
associated probit equation: 

Y = 5 —5.741nS [17.38.9] 


S 


4.2 1.3 

Pl + "i 


[17.38.10] 


where S is a ‘damage number’ and Y the probit for fatal 


17.38.3 Whole body displacement 

Another blast effect is bodily translation, or whole 
body displacement. Accounts of whole body displace¬ 
ment are given by Glasstone (1962), Clemedson, Hellstrom 
and Lindgren (1968), C.S. White (1968b, 1971), Richmond 
and Fletcher (1971),WE. Baker etal. (1983), Hadjipavlou and 
Carr-Hill (1986) and in the Green Book. 

The data of Glasstone (1962), Clemedson, Hellstrom and 
Lindgren (1968), C.S. White (1968b, 1971) and Richmond 
and Fletcher (1971) are shown in Table 17.54. 

The treatment for body translation in the vulnerability 
model by Eisenberg, Lynch and Breeding is somewhat 
complex. They derive a probit equation relating lethality for 
body translation to impulse: 

Y = -46.1 + 4.82 In/ [17.38.11] 



Figure 17.106 Injury of explosions: lung injury - 1 (I.G. Bowen, Fletcher and Richmond, 1968). Survival curves for a 
70 kg man in a free-stream situation with the long axis of the body perpendicular to the direction of the blast wave 
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Scaled impulse, / (Pa v - s/kg' ’) 

Figure 17.107 Injury effects of explosions: lung injury - 2 (W.E. Baker etal., 1983). P-1 diagram for survival applicable 
to all three standard postures and to different body weights (see text) (Reproduced by permission of Elsevier Science 
Publishers) 


[17.38.12] 

where/is the impulse (Pa s), p is the incident overpressure 
(Pa) and f d is the duration time (s). They also derive a probit 
equation relating serious injury for body translation to 
impulse: 

Y = -39.1 + 4.45 In / [17.38.13] 

A fundamental treatment of whole body displacement of 
a person standing involves consideration of the following 
effects: (1) displacement from the upright to the prone pos¬ 
ture, (2) bodily translation followed by impact of the skull, 
(3) bodily translation followed by impact of the whole, body 
and (4) tumbling across open terrain, or decelerative tum¬ 
bling. In the first three cases, injury is due mainly to 
impact, whilst in the fourth flailing of the limbs is a sig¬ 
nificant contributor. 

Considering these effects in turn, the treatment of dis¬ 
placement from upright is broadly as follows. It is first 
necessary to consider the force acting on the body. An 
account of the force acting on structures and objects of 
different configurations is given in Section 17.32. If the 
human body is treated like an element in an open structure, 
the relevant force is that due to the dynamic pressure. Then 
the force acting on the body initially is 

[17.38.14] 


where A is the projected area of the body (m z ), C D is 
the drag coefficient and F is the force acting on the 
body (N). The dynamic pressure decays from the peak 
dynamic pressure to 0 over the period of the dynamic 
pressure duration f q . Assuming that the shape of the 
dynamic pressure impulse z q can be approximated by a 
triangle, 

i q = i<7% [17.38.15] 

where z q is the dynamic pressure impulse (Pa s) and t q is 
the dynamic pressure duration (s). Neglecting deceleration, 
the velocity u attained by a body of mass m due to this 
impulse is given by 



where m is the mass of the body (kg) and u is the velocity 
imparted to the body (m/s). 

Relations for the peak dynamic pressure and dynamic 
pressure impulse are given in Section 17.25. These in com¬ 
bination with the equations just given allow the velocity 
imparted to the body to be estimated. 

A more refined model for bodily translation is given by 
Hadjipavlou and Carr-Hill (1986), which they term the 
‘centre-of-mass’ model. This model is 

g-«L0)-F(f) 


F = Cvq°A 


[17.38.17j 
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Table 17.54 Some data on the injury effects of explosions: whole body displacement 
A Data in terms of body velocity (Glasstone, 1962) 

Impact velocity 

(ft/s) (m/s) 


Standing stiff legged impact 
Mostly ‘safe’ 


No significant effect 

<8 

<2.44 


Severe discomfort 

8-10 

2.44-3.05 


Injury: 




Threshold 

10-12 

305-3.7 


Fracture threshold (heels, feet, legs) 

13-16 

4.0-4.9 


Seated impact 




Mostly ‘safe’ 




No significant effect 

<8 

<2.44 


Serve discomfort 

8-14 

2.44-4.3 


Injury: 




Threshold 

15-26 

4.6-79 


Skullfractures a 




Mostly ‘safe’ 

10 

3.0 


Threshold 

13 

4.0 


50% 

18 

5.5 


Near 100% 

23 

7.0 


Total body impact' 




Mostly ‘safe’ 

0 

3.0 


Lethality threshold 

21 

6.4 


Lethality 50% 

54 

16.5 


Lethality near 100% 

138 

42 


B Data in terms of dynamic impulse (Richmond and Fletcher, 1971) 


Dynamic pressure 

Peak horizontal body 


impulse (psi ms) 


velocity 



(ft/s) 

(m/s) 

No personnel blowdown 

1.25 

0.3 

0.092 

50% personnel blowdown 

8.3 

2.0 

0.61 

1% serious injury from being blown down c 

54 

13 

4.0 


a Data quoted by Clemedson, Hellstrom and Lindgren (1968); C.S.White (1968b, 1971). 

b Earlier data were given by C.S. White (1968b). The values given here are later, revised values given by C.S. White (1971). 
c Serious injury such as bone fracture or rupture of internal organs could occur from impact with the ground; high probability of minor injuries 
such as bruises and lacerations. 

The authors use for the loading an effective pressure 
which includes an overpressure as well as a dynamic pres¬ 
sure term. They give values of the acceleration coefficient a 
for a number of postures. That for a person standing with 
the body square on to the blast wave is 0.052 ft 2 /lb. Then 
from Equation 17.38.19 for a body area A of 8.9 ft 2 and mass 
m of 165 lb, the corresponding value of the drag coefficient 
C D is about 1.0. They quote for the deceleration of the body 
the following equation of E.R. Fletcher and Bowen (1968): 

F(t) = 8.9a(/) 0 ' 383 117.38.2 L 

This centre-of-mass model may be rewritten as 


m-^ + m<p b (t) = L(t) [17.38.22] 

wherei is the loading (N), m is the mass of the body (kg), t is 
the time (s), u is the velocity of displacement (m/s) and </> fr is 


[17.38.18] 

[17.38.19] 


L(t)=P e (t) 


[17.38.20] 


where A is the projected area of the body (ft 2 ), Cd is the 
drag coefficient, Fis the deceleration due to friction (ft/s 2 ), 
L is the loading on the body (lb f ), m is the mass of the body 
(lb), P e is the effective pressure on the body (lbf/ft 2 ), t is 
the time (s), u is the velocity of the body (ft/s), x is the dis¬ 
tance travelled by the body (ft) and a is the acceleration 
coefficient (ft 2 /lb). 
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the deceleration due to friction (m/s 2 ). If the load is taken as 
due only to the dynamic pressure 

Ut) = C D ?(f) [17.38.23] 

The deceleration term is obtained, with suitable change of 
units, from Equation 17.38.21. 

Hadjipavlou and Carr-Hill give an extensive treatment of 
the velocity attained by a body subject to a blast wave. 

The inj ury effects arising from whole body displacement 
may then he determined from the data given in Table 17.54. 

Several authors have given probit equations for such 
injury effects. For lethal injury due to body translation with 
impact of the skull on a hard surface the following equation 
is given by Hadjipavlou and Carr-Hill (1986) based on the 
data of Gurdjian, Webster and Lissner (1949): 

Y = —6.04+ 7.11 In m [17.38.24] 

where u is the velocity of the body (m/s). For lethal injury 
due to body translation with impact of the whole body on a 
hard surface, R.K. Jones, Richmond and Fletcher (1969) 
give 

Y = -2.14 + 2.54 In u [17.38.25] 

E.R. Fletcher, Yelverton et al. (1975) also give an equation for 
serious injury due to impact on a hard surface: 

Y = 0.82 + 2.697 In u [17.38.26] 

The basis of this equation is unclear, but it is suggested by 
Hadjipavlou and Carr-Hill that it appears to be based on 
Equation 17.38.25 of Jones, Richmond and Fletcher with a 
reduction in the severity of the effect considered and a cor¬ 
responding reduction in velocity. 

A treatment of injury by whole body displacement is 
given by WE. Baker etal. (1983) utilizing P-I diagrams. 

The Green Book gives the following equations for lethal 
injury due to body displacement followed by impact with a 
hard surface. For skull impact 

Y - 5 — 8.49 In 8' [17.38.27] 


animal species, including sheep and goats, were dropped 
from the back of a vehicle travelling at speeds of between 10 
and 60 mph (4.5 to 27 m/s). All the animals assumed a roll¬ 
ing posture along their long axis regardless of initial 
orientation. One conclusion of this work was that a person 
tumbling over a smooth surface might survive even if the 
initial velocity were high provided head injury and flailing 
of the limbs were avoided. Another was that injury is 
likely to result not so much from the initial impact of the 
blast wave as from impact of the body with a hard object in 
its path. 

Glasstone gives a graph for 50% casualties in decel- 
erative tumbling over (a) open terrain and (b) terrain with 
structures for a 1 kt explosion. Casualties of 50% occur at 
550 ft (168 m) and 680 ft (207 m), respectively. He also pro¬ 
poses the scaling law 

d = drW° A [17.38.31] 

where d is the distance for 50% casualties (ft), d T is the 
distance for 50% casualties for a 1 kt TNT explosion (ft) 
and W is the mass of TNT (te). Equation 17.38.31 gives for 
this size of explosion a 50% probability of casualty at 222 
and 274 m for open terrain and terrain with structures, 
respectively 

E.R. Fletcher and Bowen (1968) have given for the decay 
of velocity in decelerative tumbling Equation 17.38.21 
above. 

An alternative treatment is that described by W.E. Baker 
et al. (1983). The work of W.E. Baker et al. (1975) is used to 
predict the translation velocity of the human body, the cor¬ 
relation being in the form of a P-I diagram with transla¬ 
tional velocity as the parameter. Use is then made of data on 
the relation between level of injury and impact velocity 
given by Clemedson, Hellstrom and Lindgren (1968) and by 
C.S. White (1968b, 1971) as shown in Table 17.54. The authors 
state that there is some debate as to whether skull fracture 
or whole body injury is more important. They therefore 
present data for both injury modes. 

17.38.4 Flying glass 

Blast generates missiles, the main type of missiles con¬ 
sidered in treatments of blast injury being fragments of 
flying glass. The injury caused by flying glass is con¬ 
sidered in Section 17.40. 


where i is the overpressure impulse (Pa s), p° is the peak 
incident overpressure (Pa) and S is an injury factor. For 
whole body impact 

Y = 5 — 2.44 In S [17.38.29] 

7.3Sxlff Uxjff 

P° P‘1 y 1 J 

The Green Book also gives the corresponding P-I 
diagrams. 

Turning to decelerative tumbling, Glasstone (1962) 
describes experimental work in which cadavers of several 


17.38.5 Thermal and toxic effects 

An explosion, like a fire, gives rise to thermal and toxic 
effects. These effects have been dealt with in Chapter 16 on 
fire and are not considered further here. 

17.38.6 Distribution of injury modes 

The correlations just given may be used to obtain an esti¬ 
mate of the relative probabilities of injury in the different 
modes, or injury mode distribution. The distribution of 
injury modes for both outdoor and indoor exposure is con¬ 
sidered in Section 17.39. 

17.38.7 Combination of injury effects 

In some cases there are finite probabilities of injury in more 
than one injury mode and/or injury by more than one item 
within a given mode. For example, a person may be exposed 
to injury by blast and by missiles. He or she may also be 
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exposed to injury by several items within one mode such as 
multiple fragments or different toxic gases. 

The problem of multiple injuries and of double counting of 
injuries, including injuries from explosions, is discussed in 
Chapter 9. 

17.39 Explosion Injury to Persons Indoors 


2.5 persons/house. Some results given by their model for 
an explosion of TNT occurring at random and without 
warning in a built-up area are: 


Mass of Primary Secondary Total 

explosive fatalities fatalities fatalities 

(te) 


For persons indoors, information on the specific explosion 
injury causes and modes applicable to persons in the open 
has some limited use, but for the most part it is necessary to 
rely on the correlation of injury with damage to structures, 
principally housing. Accounts of the latter are given in the 
Green Book and by Withers and Lees (1991), Gilbert, Scilly 
and Lees (1994h) and Oswald and Baker (2000). 

The causes of explosion injury to a person indoors 
include those causing injury to a person in the open, 
namely, (1) blast, (2) whole body displacement, (3) missiles, 
(4) thermal effects, and (5) toxic effects but, in addition, 
(6) falling masonry and (7) asphyxiating dust. 

There are also certain differences between the outdoor 
and indoor situations which modify the effect of some of 
these causes. Indoors the distances which the body can 
travel before impact are short and there are many more 
objects which can become missiles, including walls and 
windows. 

The modes of explosion injury due to these causes 
include, for the causes common to outdoors and indoors, 
(1) eardrum rupture, (2) lung haemorrhage, (3) whole body 
displacement injury, (4) missiles injury, (5) burns, and 
(6) toxic injury and, for those specific to indoors, (7) 
crushing and (8) asphyxiation. 

A large proportion of indoor casualties are due to the two 
causes specific to the indoor situation, falling masonry and 
asphyxiating dust, and a large proportion of the casualties 
are therefore in the two injury modes of crushing and 
asphyxiation. Injury due to these two causes, and in these 
two modes, is difficult to model by any means other than by 
correlation with structural damage. 

17.39.1 Models based on housing damage 

Hence, for the indoor situation the prime approach to esti¬ 
mation of injury is by correlation with structural damage. 
This may be complemented to some degree by appropriate 
application of the outdoor injury correlations. 

It is convenient here to base the treatment on damage to, 
and injury to persons in, housing, followed by some limited 
discussion of the treatment for other structures. 

Withers and Lees (1991) have analysed various events 
which have caused housing damage and associated fatal¬ 
ities, including tornadoes, earthquakes, air raids and 
chemical and gas explosions. They utilize two categories of 
injury. Primary injuries are those due to blast effects other 
than housing damage such as lung haemorrhage, whole 
body displacement, etc., and secondary injuries those due 
to housing damage such as falling masonry and asphyxi¬ 
ating dust. They define an additional category of housing 
damage U, uninhabitable, which is intermediate between 
the Cb and Ca damage categories. By reference to the origi¬ 
nal Jarrett equation, Equation 17.33.2, for which in British 
units the values of the constant k are 24 for Cb damage and 
70 for Ca damage, they give a value of 33 for U damage. 
They estimate the number of fatalities by determining the 
area within the U damage circle and then taking a fatality 
rate of 0.1 persons per house, based on an occupancy of 


0.07 0.009 0.079 

0.45 0.19 0.62 

2.46 3.9 6.2 

11.3 33 44 

80.4 186 263 


Gilbert, Lees and Scilly (1994h) give a model for several 
different degrees of injury which they define as follows: K, 
killed; SI, serious hospital casualty; LI, slight hospital 
casualty and U, no injury requiring hospital treatment. 
They also define the following probabilities of injury: P{ K) 
probability of fatal injury, P(K + SI) probability of fatal or 
serious injury and P(K + SI + LI) probability of fatal, seri¬ 
ous or light injury. Further, they subdivide the A housing 
damage category into two further categories, Ab and Aa, 
where Ab corresponds to complete demolition and Aa 
almost complete demolition. Then, to obtain the numbers 
with each degree of injury they utilize their revised Jarrett 
equation, Equation 17.33.2 again, but with the revised 
values of the constant k, to determine the housing damage 
and the correlation given in Table 17.55 for injury as a 
function of housing damage. The latter is based on data 
giving the probabilities of injury in 12 V-2 rocket incidents. 

Figure 17.108 shows the number of casualties predicted 
by the model of Gilbert, Lees and Scilly for the explosion of 
a charge of TNT located at random on a built-up area with a 
population density of 4000 persons/km 2 . 

By comparison with a load on a road vehicle, for which in 
most instances the road and its verges provide a degree of 
separation, the figures overestimate the casualties. 

Oswald and Baker (2000) have developed a more general 
simplified vulnerability model primarily for industrial 
buildings that predicts the percentage of building occu¬ 
pants with serious, life-threatening injuries. Acta (2001) 
has developed a similar simplified model that predicts 
building damage and percentages of occupants with seri¬ 
ous and fatal injuries in blast-loaded industrial buildings. 
W.S. Atkins has developed a more detailed model that 


Table 17.55 Injury as a function of housing damage for 
a condensed phase explosion occurring at random and 
without warning in a built-up area (Gilbert, Lees and Scilly, 
1994h) 


Housing damage 
category 


Probability of injury 

P(K) 

.P(K-t-SI) 

P(K + SI + LI) 

Aa 

0.96 

1.0 

1.0 

Ab 

0.57 

0.66 

0.82 

A 

0.62 

0.71 

0.84 

B 

0.086 

0.15 

0.38 

Cb 

0.009 

0.043 

0.13 

Ca 

0 

0.002 

0.006 

D 

0 

0 

0 
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Figure 17.108 Injury effects of explosions: number of injuries from explosion of a condensed phase explosive in a built- 
up area (Gilbert, Lees and Scilly, 1994h). Total injuries indoors and outdoors. Charge located in area at random. 
Population density 4000 persons/krrf. K, killed; SI, seriously injured; LI, lightly injured 


predicts the percentage of fatalities among occupants of 
blast-loaded buildings (HSE, 1997), including typical 
industrial buildings in the United Kingdom. This report 
was critiqued using available injury data in a subsequent 
HSE publication (HSE, 1998). Oswald (2003) also presents 
an overview of available injury data on occupants of blast- 
loaded buildings including some recent terrorist bombing 
events. 

The treatment of injury due to building damage in the 
Green Book refers to building collapse and is based pri¬ 
marily on information relating injury to building collapse 
in earthquakes. It refers to the work of Blume (1971), who 
estimates that building collapse in an earthquake results 
in the death of 50% of the occupants, and to that of the US 
Department of Commerce (1973), which gives for these cir¬ 
cumstances an estimate of 20% dead and 80% injured.The 
authors of the Green Book conclude from these and other 
data that building collapse in an earthquake causes 
between 20 and 50% dead and adopt the same figures for 
explosions. Building collapse is not defined, at least not at 
this point in the text. 

It may be noted that the estimates of the Green Book and 
of the model of Gilbert, Scilly and Lees become consistent if 
building collapse is taken as a degree of housing damage 
somewhat more severe than A category but much less 
severe than B category damage. 

17.39.2 Injury inside other structures 

Information on the casualty rate in Britain in the Second 
World War was expressed in terms of standardized cas¬ 
ualty rates. One such was the Standardized killed and 


hospitalized casualty rate (SKHCR). The following data are 
given in th eTextbook for all weapons used in air raids: 


In 

In 

In other 

In 

All 

open 

dwellings 

buildings 

shelters 

exposures 

SKHCR 18.85 

5.31 

5.45 

1.94 

5.07 

Ratio 3.55 

1.00 

1.03 

0.37 

0.95 


where the ratio is that of the SKHCR in question to the 
SKHCR for dwellings. 


17.39.3 Distribution of injury modes 

There is available some information on the distribution of 
injury modes from explosions for persons outdoors and 
indoors. 

There are available a number of accounts of the casual¬ 
ties from explosions, both military and industrial. 
Descriptions of the casualties admitted to individual hos¬ 
pitals in the Emergency Medical Services (EMS) system for 
handling air raid casualties have been given by Payne 
(1941) for bomber raids and by R.C. Bell (1944) for V-l flying 
bomb raids. 

Bell gives an analysis of 259 flying bomb casualties. The 
breakdown of injuries is shown in Table 17.56. Some of the 
casualties had more than one type of injury so that the total 
number of entries is greater than 259. Theatre treatment 
was required in 83 cases. 

Although these air raid data provide an indication of the 
injury modes, there are inevitable biases. They usually 
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exclude casualties who died on the spot, including those 
who died from asphyxiation by fumes and dusts. 

More detailed information is given in the Textbook. 
Table 17.57 gives a breakdown of injuries to persons 
outdoors and persons indoors and overall, by cause in 
section A and by mode in section B. The data in Table 17.57 
show that a large proportion of injuries indoors were 
caused by falling debris and asphyxiating dust. 

Table 17.56 Distribution of injuries in casualties requiring 
surgery a admitted to a London hospital during the V-1 
flying bomb raids (after R.C. Bell, 1944) (Courtesy of the 
British Medical Journal) 




Cases 


Deaths 

No. 

% 

No. 

% 

Glass 

100 

47.4 

1 

6.3 

Bomb splinters 

24 

11.4 

3 

18.7 

Masonry 

52 

24.6 

9 

56.2 

Blast 

26 

12.3 

2 

12.5 

Burns 

9 

4.3 

1 

6.3 

Total surgical 

211 





a There were 259 casualties admitted,but some are classified in more 
than one category, so that there were 211 surgical cases. 


A study of 81 chemical and gas accidents has been des¬ 
cribed by Settles (1968). Of these, 44 involved fire and explo¬ 
sion, 23 fire only and 14 a detonation reaction. Settles states: 
The 14 accidents in which detonating forces were 
presentresultedininjuriesto35personsand34fatalities.lt 
appears from information available that only one of 
these 34 deaths resulted from blast overpressures 
that are associated with a detonating reaction. However, 
this one fatality was not the result of blast damage to 
human tissue. Rather, the blast pressure caused this indi¬ 
vidual to be propelled as a projectile. The other 33 persons 
who died in these 14 accidents were located at points where 
thedensityofflyingfragmentsandinsomecases.thelethal 
searing of radiant heat, were so great that their deaths 
were certain, even though there were no blast effects. 

17.39.4 Models based on injury modes 

An alternative approach to models based on housing damage 
is to try to estimate the overall probability of injury from the 
individual modes. Correlations for injury to persons out¬ 
doors which may he relevant here are those for lung haemor¬ 
rhage, whole body displacement injury, missile injury, 
including that from flying glass, and thermal and toxic 
injury. However, models are lacking for two of the principal 
modes, crushing and asphyxiation. This makes it difficult 
to construct a satisfactory model of indoor injury in this way. 


Table 17.57 Causes and modes of injury (proportion, %) by bombs in Second World War air raids (Ministry of 
Supply, 1952) 


A Injury causes 3 



In dwellings 



Outdoors 



All exposures 


Fatal 

Hospitalizing 

Total 

Fatal 

Hospitalizing 

Total 

Fatal 

Hospitalizing 

Total 

Bomb fragments 

14.1 

4.7 

9.1 

38.5 

32.8 

34.9 

19.7 

13.7 

16.3 

Burns 

2.7 

1.2 

1.9 

4.4 

1.1 

2.4 

3.8 

1.5 

2.5 

Blast 

2.4 

0.2 

1.3 

1.3 

0.2 

0.6 

1.8 

0.2 

0.9 

Flying glass 

0.2 

10.6 

5.8 

0 

2.7 

1.7 

0.4 

6.2 

3.7 

Flying debris 

16.3 

19.5 

18.0 

17.6 

32.6 

26.9 

16.0 

24.2 

20.6 

Falling debris 

46.1 

45.4 

45.7 

10.9 

7.3 

8.7 

36.0 

34.5 

35.2 

Falls, etc. 

5.8 

11.7 

8.9 

13.5 

19.0 

16.9 

9.5 

13.8 

11.9 

Other/unknown 

12.3 

6.6 

9.2 

13.8 

4.2 

7.9 

12.9 

5.8 

8.9 

Total injuries 

439 

498 

937 

160 

261 

421 

850 

1,117 

1,967 

Total casualties 

353 

303 

656 

122 

159 

281 

680 

684 

1,364 

B Injury modes 



In dwellings 


Outdoors 


All exposures 



Fatal 

Non-fatal 


Fatal 

Non-fatal 


Fatal 

Non-fatal 

Asphyxia 


21 

- 


4 

- 


17 

- 

Gross injuries 3 


20 

1.5 


17.5 

1.6 


18 


Penetrating injuries 


9 

24 


22 

47 


11 

30 

Fractures 


19 

50 


28.5 

38 


23 

47.2 

Crush injuries 


14 

1.6 


9 

0.8 


12 

1 

Bruises/abrasions 


- 

8 


- 

4 


- 

4.4 

Eye injuries 


- 

5 


- 

2 


- 

5 

Other/unknown 


17 

9 


19 

8.2 


19 

11 

Total injuries 


439 

196 


158 

126 


850 

483 

Total casualties 


353 

122 


122 

77 


680 

306 


a Gross injuries include cases where the victim was blown to bits. 
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17.39.5 Models based on total injury 

The foregoing account has given information on individual 
modes of injury. Studies have also been done to assist in the 
determination of total injury by all modes. 

Rausch, Eisenberg and Lynch (1977) have described 
studies in support of the vulnerability model in which an 
attempt has been made to assess total injury. They deal in 
particular with the disintegration of walls and the result¬ 
ant flying debris, other flying objects and bodily transla¬ 
tion. They also refer in particular to work by Longinow etal. 
(1973) and Fricke (1975) on injury from nuclear explosions 
and from low yield nuclear explosions, respectively. These 
authors have studied total injury by all the principal modes 
for people in the open and indoors in various types of 
building. The work on low yield explosions is of particular 
relevance and although the work was classified some 
information was released. 

The estimates of the overpressures associated with 50% 
probability of fatality for people outdoors and indoors 
for such low yield explosions are shown in Figure 17.109. 
The yields are for nuclear weapons and should be divided 
by 2 obtain theTNTequivalent. Figure 17.109(a) shows the 
basic injury mode curves from which the other graphs are 
derived. Figure 17.109(b) shows the curves for injury to 
persons outdoors in the open and outdoors in a built-up 
area and Figure 17.109(c) to persons indoors in housing. 
Figure 17.109(d) shows the curves for all situations. There is 
one curve for injury by all modes to persons outdoors in the 
open and one for injury by all modes to persons outdoors 
in a built-up area or indoors in housing. The figures also 
gives curves for 50% probability of burdening injury. For 
persons subject to injury by glass fragments, however, the 
peak overpressures for 50% probability of fatality and 
burdening injury are taken as 11 and 1 psi, respectively. 

17.40 Explosion Injury from Flying Glass 

The shattering of window glass is an important blast 
damage effect, since flying glass can cause severe injury. 

17.40.1 Experimental studies 

There have been a number of experimental studies of the 
behaviour of, and injury by, flying glass and also studies of 
glass breakage following accidental explosions and of 
injury by flying glass in accidents and air raids. 

Experiments on the breaking of glass windows by inter¬ 
nal gas explosions have been described by Mainstone (1971 
BRE CP 26/71) and M.R. Marshall, Harris and Moppett 
(1977). 

The Eskimo series of trials, which involved the breaking 
of windows using large external charges of TNT, have been 
described by E.R. Fletcher, Richmond and Jones (1973) and 
E.R. Fletcher, Richmond and Richmond (1974). In Eskimo II 
the charge was 12.6 te and in Eskimo III 159 te. 

Window breakage is among the damage effects of the 
explosion of 5001 TNT equivalent referred to by Fugelso, 
Weiner and Schiffman (1972). 

There are also a number of accounts of the extent of 
window breakage following accidental explosions. Window 
breakage is one of the explosion effects analysed by 
C.S. Robinson (1944). Healy (1959) deals with window 
breakage in air raids. 

The window breakage resulting from a large accidental 
explosion at Medina, San Antonio, Texas in 1963 has 
been described by Reed and co-workers (Q.W Reed et al. 


1968; J.W. Reed, 1980, 1992). The explosion involved 111, 
500 lb of high explosive, equivalent to 145,000 lb of TNT. 

A review of window breakage is given by D.K. Pritchard 
(1981). 

17.40.2 Flying glass models 

A model for the behaviour of flying glass should cover the 
following features: (1) breaking pressure, (2) fragment 
characteristics, (3) velocity of fragments, (4) spatial den¬ 
sity, and (5) distance travelled by fragments. These features 
are now considered in turn. 

17.40.3 Breaking pressure 

The pressure at which windows break is generally quoted 
in terms of the peak side-on overpressure. 

The force acting on the window is that of the peak 
reflected pressure. For a window directly facing the source 
of the explosion, the peak reflected pressure is some two 
times the peak side-on overpressure. For random orienta¬ 
tion of windows J.W. Reed (1992) estimates an average 
reflection factor not of 2 but of 1.32. 

The strength of window glass is very variable. It is not 
uncommon for an explosion to cause isolated window 
breakages at very considerable distances, and correspond¬ 
ingly low overpressures, while bangs from supersonic air¬ 
craft sometimes break windows at overpressures much less 
than those usually regarded as necessary to cause damage. 
Such instances, however, rarely cause injury. 

Estimates of the peak side-on overpressure which causes 
window breakage have been given by a number of authors. 
Brasie and Simpson (1968) quote for the breaking pressure 
of glass windows a typical pressure of 1 kPa (0.145 psi). 
They also refer to breakage at low pressures of 0.2 kPa 
(0.029 psi) by sonic boom. Iverson (1968) gives the range of 
breaking pressures as 1-10 kPa (0.145—1.45 psi). 

Some information on window breakage has already been 
given in Figure 17.92 and in Tables 17.43-17.44. Robinson’s 
data show that for large explosions glass breakage can 
occur at great distances, of the order of 20 miles. The aver¬ 
age glass breakage limit given in Table 17.44 is estimated by 
Brasie and Simpson (1968) to correspond to an over¬ 
pressure of 0.006 psi, and they suggest that this is unre¬ 
alistically low for estimation purposes. 

Healy (1959) correlates window breakage in terms of the 
RB distance, and gives the following estimates: 


RB distance 

Window breakage 
(%) 

5 

90 

10 

50 

20 

5 


These same estimates are given by Scilly and High (1986). 

Glasstone (1962) gives the peak overpressure for window 
breakage as 0.5—1.0 psi (0.34—0.068 bar), as shown in 
Table 17.43, but without defining the proportion of windows 
broken. 

Fugelso, Weiner and Schiffman (1972) give for the 
5001 TNT equivalent explosion described above data 
on glass breakage also. These data have been analysed 
by Eisenberg, Lynch and Breeding (1975). The threshold or 
1% level of glass breakage was 0.25 psi. They assume 
that the threshold level of structural damage corresponds 
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Figure 17.109 Continued 
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Figure 17.109 Injury effects of explosions: lethal effects of low yield nuclear explosions (see text) (Fricke, 1975) BD 50 , LD 50 , load for 50% probability of burdening, lethal 
injury, respectively, (a): O, LD S0 for first three floors of buildings with weak walls, brick buildings and residences. A, LD 50 for basements of wood-frame and brick-veneer 
residences; basements of steel and reinforced concrete framed buildings with flat plate ground floor. □, LD 50 for first three floors of building with ‘strong walls’; basements 
and sub-basements of steel and reinforced concrete framed building having flat slab or slab and beam ground floor construction, (d): 1, home basements; basements and 
sub-basements of multi-storey buildings; first three floors of strong-walled multi-storey buildings. 2, outside, in the open. 3, outside, built-up area; residence, above ground; 
first three floors of weak-walled multi-storey buildings. 4, fourth or higher floors of muiti-storey buildings. 5, outside, in the open. 6, outside, built-up area; residences, above 
ground; multi-storey buildings, above ground. 7, basements 
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to the 90% level for glass breakage and thus obtain the 
following data: 


Glass breakage 

Peak overpressure (%) 


(psi) 

(N/m 2 ) 

1 (threshold) 

0.25 

1700 

90 

0.9 

6200 


They derive from these data a probit equation relating glass 
breakage to peak overpressure: 


Y - —18.1 • 2.79In/) 0 [17.40.1] 

where/) 0 is the peak incident overpressure (Pa) and Fis the 

In the Eskimo trials described by E.R. Fletcher, 
Richmond and Jones (1973) and E.R. Fletcher, Richmond 
and Richmond (1974), the thickness of the panes tested 
ranged from 0.08 to 0.128 in. (from 2 to 3.25 mm) and from 
0.203 to 0.264 in. (from 5.16 to 6.7 mm). All the windows 
were positioned directly facing the blast wave and 
the peak effective overpressure was taken as the peak 
reflected pressure, or twice the peak incident over¬ 
pressure. Although the duration times in Eskimo II were 
significantly shorter than in Eskimo III, this did not sig¬ 
nificantly alter the breaking pressure, indicating that 
for such large explosions at least the breaking pressure is 
essentially independent of duration. Some results from 
these trials are as follows: 


Window size 


Breaking pressure 


(m) 

Eskimo II 

Eskimo III 


(Pa) 

(psi) 

(Pa) 

(psi) 

1.14 x 1.14 

4830 

0.70 

4830 

0.70 

0.86 x 1.22 

5930 

0.86 

5860 

0.85 


Window breakage in the Medina explosion has been 
analysed by Reed and co-workers (Q.W. Reed et al., 1968; 
J.W. Reed, 1980, 1992). The typical window is given by 
J.W. Reed (1992) as single-strength glass 2 ft x 2 ft x 2 mm 
thick. He gives a graph showing the probability of breaking 
vs the peak incident overpressure. Gilbert, Lees and Stilly 
(1994h) found that the relationship is a log-normal one, and 
give the following probit equation for breaking of a ‘Reed’ 
window: 

Y = -4.77 + 1.09 ln/>° [17.40.2] 

where/) 0 is the peak effective overpressure (Pa) and Fis the 
probit. These authors also give the following relation for the 
determination of the peak effective overpressure for other 
windows for use in the above equation: 



where A is the area of the pane (m 2 ), p° is the peak incident 
overpressure (Pa), pi is the peak effective overpressure for 


use in Equation 17.40.2 (Pa) and t is the thickness of the 
glass (m). 

As already mentioned, experimental work on window 
breakage from internal gas explosions has been described 
by Mainstone (1971BRE CP 26/71). Figure 17.110 shows the 
pressure for breakage for sheet glass panes of various 
thicknesses. 

W.E. Baker et al. (1983) suggest that these data of Main- 
stone be treated as the quasi-static regime asymptote 
values. 

Further experimental work on window breakage in 
internal gas explosions has been done by M.R. Marshall, 
Harris and Moppett (1977). Results from this work are 
given in Figure 17.111(a)-(d), showing breaking pressure 
as a function of glass thickness and window area. 

These workers also investigated the behaviour of Georgian 
wired glass and glass treated with shatter resistant film, with 
the results shown in Figure 17.111. 

Gilbert (1994) has analysed the results of Marshall, 
Harris and Moppett for plain glass windows as follows: 


Window 

thickness 

(mm) 

Window 

(nr) 

Breaking 

pressure 

Ratio of 
thickness 

fn nrpn 

Range 

(kPa) 

Average (1/m) 
(kPa) 

5 

1.0 x 1.0 

1.03 

6.2—7.6 

6.9 

0.00471 


1.0 x 0.5 

0.515 

8.3-11.7 

10.0 

0.0189 


0.48 x 0.48 0.233 

15.2-20.7 

18.0 

0.0921 

3 

1.0 x 1.0 

1.03 

3.5—5.2 

4.35 

0.00283 


1.0 x 0.5 

0.515 

6.9—8.3 

7.6 

0.0113 


0.48 x 0.48 0.233 

10.3-12.4 

11.35 

0.0553 

4 (32 oz) 

1.0 x 1.0 

1.03 

4.8 

4.8 

0.00377 


and derives from them the relation 

/>£ r = 132^+ 5.43 [17.40.4] 

where p bl is the breaking pressure (kPa) and t is the thick¬ 
ness of the pane (m). 

The overpressures necessary to cause window breakage 
have been reviewed in the Second Report of the ACMH 
(Harvey, 1979b). The report quotes for a typical dwelling 
house window of 24 oz glass of area 1 nr the work of 
Marshall, Harris and Moppett, indicating that a peak 
overpressure between about 0.03 and 0.05 bar is needed to 
break it. It concludes that for typical dwelling house win¬ 
dows the peak overpressures at which 50 and 90% window 
breakage is likely to occur are 0.016 and 0.038 bar, respec¬ 
tively, but emphasizes that the breaking pressure is a 
function of a large number of variables. 


17.40.4 Fragment characteristics 

I.G. Bowen et al. (1963b), cited by Hadjipavlou and Carr-Hill 
(1986), have given correlations for the mass and initial 
velocity of fragments from window breakage, though it is 
unclear under what conditions. They found that the mass 
distribution was log-normal and gave the following probit 
equation: 

F =5.97 + 0.86 In m [17.40.5] 
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Figure 17.110 Window breakage and flying glass from an internal gas explosion - breaking pressure of sheet glass 
panes (Mainstone, 1971): (a) sheet glass panes; and (b) plate glass panes (Courtesy of the Building Research 
Establishment) 
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(b) 



Figure 17.110 Continued 
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Figure 17.111 Window breakage and flying glass - breaking pressure of windows and characteristics of flying 
(M.R. Marshall, Harris and Moppett, 1977): (a) breaking pressure as function of glass thickness; (b) breaking pressure as 
function of window area; (c) velocity of glass fragments, plain glass; (d) velocity of glass fragments, Georgian wired glass; 
and (e) distance traveled by glass fragments (Courtesy of the Institution of Chemical Engineers) 
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where m is the mass of the fragment (g) and Fis the probit. 
The median value of the mass (F = 5) is thus 0.324 g. 

E.R. Fletcher, Richmond and Richmond (1974) char¬ 
acterize glass fragments in terms of the mean mass m 50 and 
mean frontal area A so . Their expression for the latter, in the 
form given by E.R. Fletcher, Richmond and Yelverton 
(1980), is 

InAjo = 4.2643 - (12.5 + 0.003 43/>°» z ) 1/2 [17.40.6] 

where A50 is the mean frontal area (cm 2 ) and/>e* the peak 
effective overpressure (kPa). 

The mean mass m 50 may be then obtained as 

W50 = A^p g it [17.40.7] 


In the work described earlier, I.G. Bowen et al. (1963b) 
found that the velocities of fragments from window break¬ 
age had a log-normal distribution, and gave the probit 
relation 

F = -11.7 + 4.41 In u [17.40.11] 

where u is the velocity of the fragment (m/s). The median 
value of the fragment mass was 0.324 g and the median 
value of the velocity from Equation 17.40.11 is 44 m/s. 

A correlation of the initial velocity in the Eskimo trials is 
given by E.R. Fletcher, Richmond and Richmond (1974). 
Their expressions for the latter, in the form given by 
E.R. Fletcher, Richmond and Yelverton (1980), are as fol¬ 
lows. A scaled velocity F50 is defined as 


whereA 50 is the mean frontal area of the fragment (m z ), m 50 
is the mean mass of the fragment (kg), f is the thickness of 
the fragment (m) and p s \ is the density of glass (kg/m 3 ). 

This mean frontal area is not necessarily the mean pre¬ 
sented area (MPA) on impact. This latter depends on the 
behaviour of the fragment during flight. Consider a frag¬ 
ment of rectangular cross-section and uniform thickness 
with a length: width ratio of 2 :1. If the length of the long 
side is 1 and the thickness is /, the width is 1/2 and the area 
A 50 is l 2 12. For a fragment approaching a target square on 
there are three possible MPAs: l 2 12, It and lt/2. Taking the 
second of these, or the intermediate case, the MPA is then 

Am P = (2A 50 ) 1/2 f [17.40.8] 


-—-(Tw) [17.40.12] 

y0.833 + 0.04465(/* - 0.0762) -°' 92 y 

where /* is the thickness of thej>ane (cm), F 50 is the geo¬ 
metric mean velocity (m/s) and F 50 is the scaled geometric 
mean velocity (m/s). The correlation is 

In F50 = 1.5241 + 0.547 In/>°* [17.40.13] 

where p%* is the peak effective pressure (kPa). 

E.R. Fletcher, Richmond and Yelverton (1980) also give 
data on average impact velocity of fragments from which 
the following relation may be inferred: 


where A mp is the MPA of the fragment on impact (m 2 ) l is 
the length of the fragment (m) and t is the thickness of the 
fragment (m). 

A further treatment of fragment characteristics is given 
in Section 17.40.6. 


17.40.5 Velocity of fragments 

A treatment of the velocity of glass fragments is given by 
Glasstone (1962). He gives a correlation in terms of the 
geometric mean velocity F50, or antilogarithm of the mean 
of the logarithms of the velocities. He uses a scaled geo¬ 
metric mean velocity F50, which allows for the thickness of 
the glass and which is defined as 

VLpmM - ^[17.40.9] 

0.83 + 0.019(/' — 0.03) _a93 

where t is the pane thickness (in.), F 50 is the geometric 
mean velocity (ft/s) and F50 is the scaled geometric mean 
velocity (ft/s). The correlation relates the scaled geometric 
mean velocity to the peak effective overpressure applicable 
to conventional explosions of 15—500 t. Glasstone states 
that the correlation is based on experiments with various 
types of glass ranging from 0.25 in. thick plate glass, 
through various standard thicknesses of single- and double¬ 
strength glass, to non-standard glass panes 0.064 in. thick. 
This correlation may be represented as 

In Fg 0 = 3.746 + 0.546 In p'° [17.40.10] 

where/)' 0 is the peak effective overpressure (kPa). 


In u = 1.5241 + 0.55 ln/>°* [17.40.14] 

where/)”* is the peak effective overpressure (kPa) and Fis 
the average velocity (m/s). 

For an internal gas explosion the velocity of fragments 
from a breaking window is given by M.R. Marshall, Harris 
and Moppett (1977) in the work described earlier, as shown 
in Figure 17.111 (c). The velocity concerned is the average 
velocity over the first 6 m of travel. The mean values of the 
velocities in Figure 17.111(c) are in the range 35-40 m/s. 

These data have been analysed by Gilbert, Lees and 
Scilly (1994h). The data for untreated unwired windows 
show wide scatter, but from those for wired glass there 
appears to be a factor of about 1.38 between the velocities 
from untreated and treated windows. Applying this same 
factor to the velocities from treated, unwired windows gives 
for untreated, unwired windows 


u = 11.57 


0.001/ 


[17.40.15] 


where />tj r is the breaking pressure (kPa), / is the thickness 
of the glass (m) and u is the average velocity of the frag¬ 
ments (m/s). 


17.40.6 Velocity of fragments: method of Baker et al. 

W.E. Baker et al. (1983) give the following treatment for the 
velocity of fragments from breaking windows based on the 
work of E.R. Fletcher, Richmond and Jones (1973,1976). An 
effective peak overpressure P e is defined, which for win¬ 
dows side-on or back-on to the blast wave is equivalent to 
the peak incident overpressure P s and for those face-on, to 
the peak reflected overpressure P r . 
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The latter may be obtained as follows: 


p t = 2P S + + p 3 < 3.5 

0 - ljft + 2/ 

[17.40.16] 

with 


P S =P S /P 0 

[17.40.17] 

P r = P I /P 0 

[17.40.18] 


where P a is atmospheric pressure (Pa), P e is the peak effec¬ 
tive overpressure (Pa), P T is the peak reflected overpressure 
(Pa), P T is the dimensionless peak reflected overpressure, 
P s is the peak side-on overpressure (Pa), and P a is the 
dimensionless peak side-on overpressure. For P s > 3.5 the 
authors give an alternative equation (their Equation 3.5). 

On the assumption that all the fragments are square, the 
mass of a fragment is 

M=y l tp gl =Atp gi [17.40.19] 

where Af is the mass of the fragment (kg), t is the thickness 
of the glass (m), y is the length of the square edge (m) and 
p g i is the density of glass (kg/m 3 ). The density of glass may 
be taken as 2471 kg/m 3 . 

The geometric mean frontal area A50 of the fragments is 
given by the equation 

A' so = 6.45 x 10“ 4 exp {2.4 - [12.5+ (5.86 x 10- 5 P e ) Z ] 1/2 } 
x 0 < P e < 96,500 [17.40.20] 

where Ag 0 is the geometric mean frontal area (m 2 ). 

If all the fragments travel with the flat face forward, the 
presented area A of the fragments is 

A - A! i0 [17.40.21] 

while if all fragments travel edge forward 
A = tA 1 ^ 2 [17.40.22] 

where A is the presented area of the fragment (m 2 ). 

The ratio A/M for these two cases is, respectively 


M 


Pgl A 5< 


, 1/2 


17.40.7 Spatial density of fragments 

A correlation for the spatial density of glass fragments 
from window breakage based on the Eskimo trials is given 
by E.R. Fletcher, Richmond and Richmond (1974). Their 
expression for the latter, in the form given by E.R. Fletcher, 
Richmond and Yelverton (1980), is as follows. A scaled 
spatial density p^a is defined as 

Psd = 4.91 exp(—51)121) + 22.28 [17.40.26] 

and gives the correlation 

Inp' d = 3.1037 + 0.058 57 p° e * [17.40.27] 

where pi* is the peak effective overpressure (kPa), p sd is 
the spatial density (fragments/m 2 ) and t is the glass 
thickness (cm). 

17.40.8 Range of fragments 

For an internal gas explosion the distance travelled by frag¬ 
ments from a breaking window is given by M.R. Marshall, 
Harris and Moppett (1977) in the work already described, 
as shown in Figure 17.111(e). 

17.40.9 Injury relations 

Glasstone (1962) gives the data on injury effects caused by 
glass fragments of different impact velocities shown in 
Table 17.58. 

Methods for the estimation of serious injury from 
flying glass have been given in the vulnerability model by 
Eisenberg, Lynch and Breeding (1975) and by W.E. Baker 
et al. (1983). These are described in Sections 17.40.10 and 
17.40.11, respectively. 

Hadjipavlou and Carr-Hill (1986) have analysed data 
from animal experiments and have proposed the following 
probit equations for laceration and for penetration: 


Y m +12.23 + 0.83 In m 
Y= —8.35 + 0.61 In mu 


laceration 

penetration 


[17.40.28] 

[17.40.29] 


Table 17.58 Some data on injury effects caused by 
glass fragments (after Glasstone, 1962) 

A Penetration of abdomen wall: impact velocity 


[17.40.24] 


The lower value of AjM given by these two alternative 
equations is selected. 

The geometric mean velocity 7 5 o of the fragments is 
given in SI units by the equation 

Fso = [0.2539+ (1.86 x 10“ 4 )(f- 7.62 x lO” 4 )- 0 - 928 ] 
x (0.344if 547 )690 <P e < 689,000; t > 7.62 x 10“ 4 

[17.40.25] 

where 7 50 is the geometric mean velocity (m/s). 


Mass of glass fragment 

Probability of penetration (%) 

(g) 




1 

50 

99 

0.1 

235 

410 

730 

0.5 

160 

275 

485 

1.0 

140 

245 

430 

10.0 

115 

180 

355 

B Injury from penetrating 10 g fragments 

Effect 


Impact velocity (ft/s) 

Skin laceration 

Threshold 

Serious wounds 


50 


Threshold 


100 


50% 


180 


Nearly 100% 


300 
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where m is the mass of the fragment (g) and u' is its 
velocity (ft/s). 

A method of determining the probability of fatality for a 
person standing behind a window is given in the Green 
Book and is described in Section 17.40.12. 

Gilbert, Lees and Stilly (1994f) have given a model for 
fatal and non-fatal injury by any potentially penetrating 
fragment. This is applicable to flying glass, as described in 
Section 17.42. 

17.40.10 Injury relations: vulnerability model method 

The treatment of injury by flying glass in the vulnerability 
model described by Eisenberg, Lynch and Breeding is as 
follows. The impact velocity of a missile Vj is related to the 
impulse /by the equation 

MV i = CoAJ [17.40.30] 

where A is the presented area of the missile (m 2 ), C D is the 
drag coefficient,/is the impulse (Pa s), Mis the mass of the 
missile (kg) and V-, is the impact velocity (m/s). The value of 
the drag coefficient C D is taken as unity. 

For injury from flying glass they consider a 10 g 
fragment and quote the data given in the second and 
third columns of the following table, which are derived 
from information given by the Department of the Army 
(1969): 


Injury 

Peak 

overpressure 

(psi) 

Impact 

velocity 

(m/s) 

Impulse 


(psi ms) 

(Pas) 

Skin laceration 

Threshold 

1-2 

15 

74.2 

512 

Serious wound 

Threshold 

2-3 

30 

148.4 

1024 

50% 

4-5 

55 

272.1 

1877 

Near 100% 

7-8 

90 

445.3 

3071 


They derive from this the impulse values given in columns 
four and five of the above table and hence a probit equation 
relating serious injury from missiles, particularly glass, to 
impulse: 

Y = -27.1 + 4.26 In / [17.40.31] 

It is assumed in the application of Equation 17.40.31 that all 
personnel not inside buildings who are in the region trav¬ 
ersed by a blast wave of sufficient strength suffer injury 
from missiles. The density of flying fragments and the 
target area presented by people are not factors affecting the 
probability of injury in this analysis. Thus, the equation 
overestimates by a considerable factor the extent of injury 
by flying fragments. This particular prohit equation, 
therefore, should be regarded as representing an upper 
bound. 

17.40.11 Injury relations: method of Baker etal. 

The treatment for injury by glass fragments given by 
W.E. Baker et al. (1983) is based on the work of Sperrazza 
and Kokinakis (1967,1968), but is essentially similar. For 
the fragment velocity they use the correlations obtained by 
Fletcher and co-workers and described in Section 17.40.6. 


Sperrazzo and Kokinakis carried out experiments on the 
perforation of the skin of animals. Baker et al. give a 
straight-line graph of the results of this and other work, 
including that quoted by Glasstone, to which they fit with 
the relation 

7 50 = 22.30 +1247.1 ^ < 0.09; M < 0.015 

[17.40.32] 

where A is the presented area of the fragment (m 2 ), Mis its 
mass (kg) and V 50 is the velocity for 50% probability of 
perforation (m/s). 

It is assumed by Sperrazzo and Kokinakis that if a frag¬ 
ment perforates the skin, its residual velocity will be suffi¬ 
cient to do severe injury. Baker et al. suggest that this 
assumption incorporates a margin of safety. 


17.40.12 Injury relations: Green Book method 

The Green Book gives a probit equation for fatality due to 
impact of glass fragments on the head of a person standing 
1.75 m behind the window pane. The equation is 

F = 2.67 + In [17.40.33] 

where/ d] is the dynamic load factor, P° is the peak incident 
overpressure (Pa) and P st is the static strength of the 
pane (Pa). 

The basis of this equation is tests in which the peak 
reflected pressure was twice the dynamic failure load Pa of 
the panes and in which the probability of fracture of the 
skull was estimated as 94%. Then, for these conditions 
P*= PJf ai and P° = 2P st /f m . Hence, P°/(PJM = 2. It 
was assumed that for 1% lethality P°/(P s tlf<s) = V The 
probit equation is derived from these two values. 

The static strength of the pane is obtained from the 
relations 

2 x 10 s 

ft 40.18^.7 117-40.34] 

$ = 0.225 pj^ [17.40.35] 

where a is the smaller of the two dimensions of the pane (m), 
A is the area of the pane (m 2 ), d is the thickness of the pane 
(m) and f t is the tensile strength of the pane (Pa). 

Thus, awindowl.5 xl.O x 0.005 m has a tensile strength 
ft = 75.9 x 10 6 Pa and a static strength P st = 8.43 x 10 3 Pa. 

The dynamic load factor/ dl is a function of the ratio f d /T 
of the duration time / d to the natural period of vibration T. It 
has a value less than 1 for a short duration (f d < T) and of 2 
for a long duration (f d > T). 


17.40.13 Flying glass: model of Gilbert, Lees and Stilly 

Gilbert, Lees and Stilly (1994f) have given a model for the 
probability of incurring various degrees of injury due to 
impact of a potentially penetrating fragment. This model is 
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described in Section 17.42. It is applicable to injury by 
fragments from window breakage. 

In another paper, Gilbert, Lees and Stilly (1994h) have 
used this model in combination with some of the relations 
given above to provide an integrated treatment for the 
estimation of injury from flying glass. The model is 
applicable to the explosion of a condensed phase explosive 
external to the building. 

The approach used in this integrated model is as follows. 
The characteristics of the window typical of the scenario 
considered are determined. Following Reed, the average 
peak reflected overpressure is taken as 1.32 times the peak 
incident overpressure. From Equation 17.40.3 the peak 
incident overpressure to produce an equivalent load on a 
‘Reed’ window is estimated. Using Equation 17.40.2, the 
probability of window breakage is estimated. Given that the 
window is broken, Equations 17.40.6, 17.40.7, 17.40.14 and 
17.40.27 are used to obtain the mean frontal area, mass, 
velocity and spatial density of the fragments. Then, using 
the fragment injury model of the authors, the probability of 
fatal and non-fatal injury is determined. 

17.40.14 Flying glass hazard 

The question of injury from flying glass is considered in 
the Second Report of the ACMH (Harvey, 1979b). The report 
is particularly concerned with the risks from a VCE. 

In general, much of the concern about possible injury 
from flying glass relates to injury to people indoors. The 
shattering of glass as a result of an explosion has occurred 
at distances up to 20 miles. In such cases, however, the 
energy of the fragments is very low. The evidence appears 
to indicate that there are surprisingly few injuries to people 
from glass fragments even in buildings where most of the 
windows have been shattered by blast. 

The report describes first the historical record. A large 
number of windows were broken in the VCEs both at 
Flixborough and at Beek. At Beek there were 2508 cases of 
damage outside the factory and these were almost entirely 
glass breakage (Case History A75). One person was injured 
by glass. 

The report refers to the experimental work M.R. Marshall, 
Harris andMoppett (1977) on the breakage of glass windows 
by explosions inside buildings. In this work the peak over¬ 
pressure was in the range 0.03-0.25 bar (0.44-3.6 psi). 
The fragment velocities measured were high, being of the 
orderof40m/s, and variedrelativelylittle.Thereport argues, 
however, that these results are not applicable to the very dif¬ 
ferent conditions of explosions outside buildings. 

This latter situation is then considered. It is estimated in 
the report that the overpressures required to effect 50 and 
90% breakage of windows are about 0.016 bar (0.23 psi) and 
0.038 bar (0.46 psi), respectively. Abreakage of 50% implies 
a non-breakage of 50% of the windows, which suggests 
that the fragment velocity is likely to be low. 

The report quotes experimental work in the United 
States in which windows 1/8 in. (3.17 mm) and 1/4 in. 
(6.35 mm) thick were mounted at various distances from 
large masses of TNT so that overpressures of 0.3 psi 
(0.02 bar), 0.5 psi (0.035 bar) and 0.6 psi (0.04 bar) with a 
duration time of 250 ms were applied to them, and fragment 
masses and velocities were determined. Separate experi¬ 
ments were conducted to find the probability that such 
fragments would penetrate bare skin, or clothed skin, or 
1 cm of soft tissue. Only one fragment, out of 90, from the 
thicker windows broken at the highest pressure was found 


to have a 10% probability of penetrating 1 cm. No other 
fragment had even 1% probability of this degree of 
penetration. 

It is concluded in the report that there is ample justifica¬ 
tion for regarding as negligible the risk of injury from 
flying fragments of window glass for an explosion which 
gives a peak overpressure outside the building of 0.6 psi 
(0.04 bar) or less. 


17.41 Explosion Injury from Penetrating Fragments 

One of the principal modes of injury from an explosion is 
wounding by penetrating fragments. In this section the 
information available on the wounding and incapacitating 
power of fragments is reviewed and several criteria and 
models for injury by a penetrating fragment are given. A 
further model for such injury by Gilbert, Lees and Stilly 
(19940 is described in the next section. 

This problem is of particular interest to the military, and 
much of the data are from military sources. These include 
the Textbook and the work of Gurney (1944), Dunn and 
Sterne (1952) and Beyer (1962). The work of the Stockholm 
International Peace Research Institute (SIPRI) (1978) is 
also relevant. 

17.41.1 Definition of injury 

The degree of injury of prime interest to the military is 
incapacitation, and much of the information available on 
injury by penetrating fragments relates to this. An account 
of the incapacitating power of weapons has been given in a 
review by SIPRI (1978). 

This review emphasizes that the interpretation of inca¬ 
pacitating power is not straightforward. The military 
interest is in the ability of a projectile to cause rapid inca¬ 
pacitation, in other words its stopping power. Stopping 
power, however, is not synonymous with wounding power. 

Work in the United States during and after the Second 
World War showed that immediate incapacitation is 
obtained only by severe injury to parts of the spinal column 
or brain. It is harder to achieve than fatal or severe injury, 
which results from injury to major organs or blood vessels. 

Dunn and Sterne (1952) carried out experiments in which 
projectiles were fired at goats. They found that the prob¬ 
ability of incapacitation was much less than for ultimate 
fatal or severe injury. SIPRI summarize their work to the 
effect that even for the most effective projectile the prob¬ 
ability of fatal or severe injury is three to four times greater 
than the probability of immediate incapacitation. 

The main sources of data on the injuring power of frag¬ 
ments refer to incapacitation, but in order to be able to uti¬ 
lize them it is necessary to be able to interpret 
incapacitation and to relate it to fatal and severe injury. 

The meaning of incapacitation is discussed in the Text¬ 
book. It states: 

Despite the shortcomings of the available information, it 
is safe to conclude, from the data that have been sum¬ 
marized here, that any penetrating splinter wounds of 
the head, neck and trunk are highly dangerous, and that 
almost any wound may be regarded as incapacitating 
(which for convenience may be defined as a wound 
necessitating medical attention), provided that the mis¬ 
sile concerned gets through the skin into the underlying 
tissues. In the case of limbs, single splinter wounds are 
not as dangerous, and the relative number of hits by small 
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splinters which would prove incapacitating is clearly 
smaller. 

The Textbook then discusses wounds by small splinters, 
treating separately the head and neck, the thorax and 
abdomen, and the limbs. The criteria used for incapacitat¬ 
ing wounds are: 

Head: perforation of the skull; 

Thorax and abdomen: perforation of trunk; 

Limbs: penetration to half-depth and hitting central sup¬ 
porting bone. 

The Textbook states that a rough estimate of the proportion 
of the total projected area of the body which represents the 
vital organs, where a battle injury due to a small missile 
would result in almost certain death, is roughly 10-15%. 

The most vulnerable parts of the body are the head and 
neck and the thorax and abdomen. These account for some 
39% of the projected area of the body. 

17.41.2 Causative factor 

There are two basic types of relation which are used for the 
damaging, or injuring, power of a fragment, or projectile. 
One is the relation for kinetic energy 

E = mu 2 /2 [17.41.1] 

where E is the kinetic energy (J), m is the mass of the frag¬ 
ment (kg) and u is the velocity (m/s). This equation also may 
be written in the alternative form 

«« oi = constant [17.41.2] 

or more generally 

um c = constant [17.41.3] 

where c is an index. 

It is now recognized that the mean presented area (MPA) 
of the fragment is also relevant. This is discussed in 
Section 17.42. 

17.41.3 Incapacitation criteria 

At the turn of the last century the German army adopted a 
projectile kinetic energy of 78 J (58 ft lb) as incapacitating 
to military personnel. This is also the value which has 
traditionally been used in Britain and the United States. 

Other criterion values quoted by SIPRI are the French, 
Swiss and Russian values of 39,62 and 235 J, respectively. 

According to Beyer (1962) this type of criterion has 
proved a better indicator of incapacitating power than 
measures such as penetration into solid objects such as 
pine boards. 

The 78 J criterion has been discussed by Gurney (1944), 
who states that it is valid for fragments in the range 50 mg 
to 30 g. 

More sophisticated criteria have since been developed for 
weapons design, based on actual casualty data and taking 
into account the different areas of the body hit. 

A computer code for the estimation of incapacitation by 
bullets, COMPUTER MAN, has been developed by the US 
Army. In this code the human body is divided into small 
sections (5 x 5 x 25 mm) with the tissue type within the 
each section specified. The model is then utilized in con¬ 
junction with information on the impact points of bullets, 


their ballistic properties, etc., to obtain a ranking on a 
relative incapacitation index (RII). 

A commercial computer code, WBD2, is also available, 
developed by Timberwolf Consulting Services (1991), 
which embodies a wound ballistics simulation model. 

An interpretation of the 78 J incapacitation criterion has 
been given by Gilbert, Lees and Stilly (1994f), who con¬ 
clude that in terms of the Textbook incapacitation model, 
described below, the criterion corresponds approximately 
to a 90% probability of incapacitation. 

17.41.4 Textbook model 

A model for the incapacitating power of a penetrating 
fragment is given in the Textbook. The basic relation used is 
the penetration equation 

P = ku b m c [17.41.4] 

where m is the mass of the fragment (mg), P is the pen¬ 
etration (ft) and u is the velocity (ft/s), k is a constant and 
b and c are indices. It follows from Equation 17.41.4 that for 
a given incapacitating power 

u b m c = constant [17.41.5] 

or 

v^u(m/mr) c/b [17.41.6] 

where m r is the mass of a reference fragment (mg) and v is 
the equivalent velocity (ft/s). The values given for b and c 
are 1 and 0.4, respectively. 

A standard fragment is defined for which the value of m T 
is 52 mg. The Textbook gives probit relations for incapacita¬ 
tion by 52 mg fragments of different shapes. The relations 
are formulated in terms of velocity as the causative factor. 
The probability of incapacitation by a fragment of given 
mass and velocity is then obtained by determining the 
equivalent velocity from Equation 17.41.6 and using this 
value in the probit relations. 

It may be noted that this standard fragment size of 52 mg 
is small but that a large proportion of the fragments are of 
this size or below. However, some doubt must attach to 
extrapolation of the correlation to much larger fragment 

This model applies to a soldier wearing the full comple¬ 
ment of land service clothing and equipment, including a 
helmet. 

Th eTextbook model has been cast in convenient form by 
Gilbert, Lees and Stilly (1994f). For a 52 mg cuboid frag¬ 
ment the probit relation in terms of the velocity u is 

Y =-8.25 + 1.96 In u [17.41.7] 

where u is the velocity of the fragment (m/s). 

As just indicated, Equation 17.41.7 is specific to a 52 mg 
fragment. Generalizing for other fragments, by using the 
causative factor um 0A used in the Textbook, these authors 
obtain 

Y = -0.51 + 1.961n(«m a4 ) [17.41.8] 

where m is the mass of the fragment (kg). 
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Gilbert, Lees and Scilly have also adapted the Textbook 
model to the estimation of fatal and serious injuries (K + 
SI). This is based on equating a 10% probability of inca¬ 
pacitation to a 30% probability of fatal or serious injury, 
whilst retaining the slope of the probit equation. The 
equation obtained is 

Y = 0.24 +1.96 In (um 0A ) [17.41.9] 

17.42 Explosion Injury from Penetrating Fragments: 
Model of Gilbert, Lees and Scilly 

A model for injury from fragments and missiles generated 
by an explosion has been given by Gilbert, Lees and Scilly 
(1994f,g). The model is applicable to the assessment of 
injury caused by impact of any missile which has the 
potential to penetrate the skin; it is not intended for the 
assessment of impact by blunt objects. It was developed 
primarily with reference to the hazard of fragments from 
the casing of munitions. 

17.42.1 Classification of injury 

The injury classification used is: 

K Injury which is fatal, either immediately or in hospital. 
S Injury which is serious, involving perforation of the 
skin, and which necessitates medical attention, imply¬ 
ing hospitalization. 

M Injury which is generally not serious, involving per¬ 
foration of skin, but which deserves medical attention. 
T Injury which is trivial, possibly penetrating the skin 
but not perforating it, or no injury at all. 

A serious injury is defined more specifically as one involv¬ 
ing the following: 

Head and neck: perforation of the skull; 

Thorax: penetration of the ‘vulnerable area’; 

Abdomen: penetration of the ‘vulnerable area’; 

Limbs: penetration of the ‘vulnerable area’. 

The abdomen is taken to mean the abdomen proper and that 
part of the thorax which is not protected by bone, whilst the 
thorax is taken as that part of the chest which is so protected. 

17.42.2 Probability of injury 

The following probabilities are defined: 

P(H) probability of hit by fragment; 

P(H ; ) probability of hit by fragment in body region i; 
P(K) probability of fatal injury; 

P(K;) probability of fatal injury in body region i; 

P(S) probability of serious injury; 

P(Si) probability of serious injury in body region i; 

P(Pvui,i) probability of penetration of vulnerable area of 
body region i, equal to probability of fatal or 
serious injury in that region; 

P(Pskin) probability of perforation of skin; 

P(Pskuii) probability of perforation of skull; 

P(Pthor) probability of penetration of vulnerable area of 
thorax; 

P(Pabd) probability of penetration of vulnerable area of 
abdomen; 

P(Plimb) probability of penetration of vulnerable area 
of limb. 


Use is also made of the subscripts lwlimb and uplimb to 
denote lower and upper limbs, respectively. The last four 
probabilities are conditional probabilities, as defined 
below. 

It is assumed that if the body is hit at all by a fragment, 
the effect is classified using one of the four categories. 
The trivial injury category covers the cases where the 
injury is trivial or where no injury is sustained, so that 
the sum of the probabilities of injury in these four 
categories is always unity. 

The probability of a hit on body region i is 

P(H{) = A-JA [17.42.1] 

where A is the total MPA of the body and A t is the MPA 
attributable to region i. 

The probability of perforation of the skin is a function of 
fragment mass, projected area and velocity. It is assumed 
that perforation of the skin by a fragment will result in 
fatality, serious injury or medium injury (K, S or M). 

The probability of penetration to a vulnerable area in a 
particular region i of the body is 


P( J Pvul,i)=i 5 (Pvul,i|Pskin)P(Pskin) 

[17.42.2] 

Specifically, for each region considered, 


^(Pvui,i|Pskin) = P(P s kuii) head and neck 

[17.42.3] 

= P(Pthor) thorax 

[17.42.4] 

= P(Pabd) abdomen 

[17.42.5] 

= P{ Plimb) limb 

[17.42.6] 

Then, for the head and neck 


/>(PvuW) - P(Pskull) P(Pskin) 

[17.42.7j 

for the thorax 


P( Pvuy) =P(lPth„r)P(Pskin) 

[17.42.8] 

for the abdomen 


P(P V «y) =P(Pabd)P(Pskin) 

[17.42.9] 

and for the limbs 


P(Pvull) =P(Pltob)P(P S kin) 

[17.42.10] 

In this model, the probability of fatal or serious injury (K or 
S) in body region i is defined by P(P V ui, i). The probability of 
fatal injury is 

P(K i )=P(K i |P vul , i )P( vul , i ) 

[17.42.llJ 

The probability of serious injury in body region i is then 

P( Sj) =P(P vuM )-P(K i ) 

[17.42.12] 

The overall probability of fatal injury is 


P(K) = ^P(Ki) 

[17.42.13] 
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and that of serious injury is 

P(S) = £P( S;) [17.42.14] 

The overall probability of trivial or no injury is 

P(T) = 1 - P(P skin ) [17.42.15] 

and that of medium injury is simply the residue 

P(M) = 1 - [P(K) + P(S) + P(T)] [17.42.16] 

The probabilities which need to be estimated for this model 
are therefore for the perforation of the skin P( P s ki n ) and the 
following probabilities for each body region i: P(P vu i i |P s kin) 
andP(if|P vu i,i). 

17.42.3 Causative factor 

Traditionally the criterion for military incapacitation has 
been expressed in terms of a kinetic energy. Later it became 
recognized that the presented area of the fragment was also 
relevant. 

It has become usual to work, therefore, in terms of the 
following causative factor X: 

X = mu 2 1 A [17.42.17] 

where A is the projected area of the fragment (m z ), m is its 
mass (kg), u is its velocity (m/s) and X is the causative 
factor (J/m 2 ). 

17.42.4 Perforation of skin 

A distinction is made between skin penetration, or epi¬ 
dermis perforation, and skin perforation, or full-depth 
perforation. 

The problem of skin perforation is relatively complex. In 
a review of work on this topic Di Maio (1981) makes a dis¬ 
tinction between experiments carried out on samples of 
skin with, and without, subcutaneous tissue attached. Skin 
seems to be more resistant to fragment penetration when it 
is in situ, with underlying muscle and fat still attached. 

Some information on the properties of the skin is pro¬ 
vided by Mehta and Wong (1967). Experimental work on 
skin perforation using unattached skin has been described 
by Grundfest et al. (1945) and Sperrazza and Kokinakis 
(1968). Accounts of experiments on attached skin have been 
given by Journee (1907), Mattoo,Wani and Askegar (1974) 
and Di Maio et al. (1982). A review of work on penetrating 
trauma has been given by Neades and Rudolph (1983) as 
part of an attempt to improve on the widely used criterion 
for incapacitation of 78 J. 

The model adopted by Gilbert, Lees and Stilly is that of 
J.H. Lewis et al. (1987). These latter authors give an empiri¬ 
cal formula for the probability of complete skin perforation 
(full-thickness skin laceration) which is said to apply to 
both primary and secondary fragments (debris). 

Experiments were performed using goat skin to simulate 
human tissue. This approach follows the work of Sperraza 
and Kokinakis (1968), who found no significant difference 
between goat and human skin in this respect. 

The results were correlated using the logistic equation 

P(P skin ) = -7-—r-TTTTT [17.42.18] 

v J 1 + exp [~a + bmu 2 /A)\ 


where A is the projected area of the fragment (cm 2 ), m is its 
mass (g), u is its velocity (m/s) and a and b are constants. 

Values of the constants given for bare skin and for two- 
layer and six-layer uniforms are: 


Target 

Constant 

b 

Bare skin 

-28.42 

2.94 

Two-layer uniform 

-49.47 

4.62 

Six-layer uniform 

-50.63 

4.51 


The corresponding probit equation for bare skin is 

Y = —20.5 + 1.541n(«M 2 /A) bare skin [17.42.19] 

where A is the projected area of the fragment (m 2 ), m is its 
mass (kg) and u is its velocity (m/s). 

Analysis by the authors of the data for skin in situ indi¬ 
cated that there is strong evidence to support the adoption 
of the following thresholds for skin penetration and skin 
perforation: 

mz/ 2 /A = 3 x 10 5 J/m 2 skin penetration 
= 3.6 x 10 5 J/m 2 skin perforation 

On the basis of these findings a revision was made to the 
correlation of J.H. Lewis et al. (1987). The threshold was 
taken to be equivalent to a probability of 1%. The probit 
equation of Lewis et al. given in Equation 17.42.19 was 
revised by adjusting the intercept but retaining the slope. 
The result for bare skin is 

T(Pskin) = -17.0 + 1.54 In {mu 2 /A) p7.42.20] 

The model assumes that on perforation of the skin there is a 
reduction in the causative factor (mu 2 /A) of 360,000 J/m 2 , 
the threshold value for skin perforation. The residual 
energy is then available for further penetration of the body 
region in question. 

17.42.5 Penetration to vulnerable areas 
Head and neck 

Information on penetration of the skull by fragments is 
given in the Textbook. A series of 54 shots were made using 
eight fresh skull caps obtained at autopsy at velocities in 
the range 280-960 m/s. The data given are for penetration 
by a 53 mg fragment, and are shown in Table 17.59(A). It is 
recommended in the Textbook that the crude data for the 
normal velocity be increased by 10% to allow for experi¬ 
mental error and this adjustment is shown in the second 
column of the table. The probit equation obtained from 
Table 17.59(A) is 

P(Pskuii) = -40.5 + 3.03 ln(w« 2 /A) P7/12.2L 

Thorax 

An essentially similar treatment is available for penetra¬ 
tion of the sternum, the information again deriving from 
the Textbook. A series of 56 shots were made using 13 fresh 
sterna obtained at autopsy at velocities in the range 
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Table 17.59 Penetration of vulnerable areas by fragments 


A Skull a 


Normal impact 
velocity (ft/s) 

Adjusted impact 
velocity ; b (ft/s) 

Causative factor, 
mu 2 jA (J/m 2 ) 


Probability of 
perforation, P(P sk uii) (%) 

312 

343 


1.40 x 10 6 


0 

408 

449 


2.40 x 10 6 


12.7 

507 

558 


3.70 x 10 6 


75.2 

591 

650 


5.03 x 10 s 


82.1 

769 

846 


8.52 x 10 6 


100 

B Sternum 3 

Normal impact 

Adjusted impact 

Causative factor, 


Probability of perforation, 

velocity (ft/s) 

velocity, 

. (ft/s) 

mu 2 /A( J/m 2 ) 


P( Pstem)(%) 

173 

190 


0.431 x 10 6 


42.1 

220 

242 


0.697 x 10 6 


77.0 

295 

325 


1.25 x 10 6 


77.0 

373 

410 


2.03 x 10 6 


91.6 

519 

571 


3.88 x 10 6 


100 

C Limb 

Limb 

Bone (ft 2 ) 

MPAVessels 

Vulnerable 

Total 

Conditional probability of 



and nerves (ft 2 ) 

parts (ft 2 ) 

(ft 2 ) 

penetration, P(P vu i|P S km) 

Upper limb 

0.31 

0.12 

0.43 

0.92 

0.467 

Lower limb 

0.55 

0.22 

0.77 

1.65 

0.467 


a Source: Textbook of Air Armament (Ministry of Supply, 1952): table Cl. Data for a 3/32 in. sphere, of mass 53 mg. 
b Adjusted as explained in text. 


153- 530 m/s. The data given are for penetration by a 53 mg 
fragment and are shown in Table 17.59(B). It is recom¬ 
mended in the Textbook that the crude data for the normal 
velocity be increased by 10% to allow for experimental 
error, and this adjustment is shown in the second column of 
the table. 

The vulnerability of the thorax, given penetration of the 
skin, is obtained in the model from the vulnerability to 
perforation of the sternum. A fraction, say two thirds, of 
the thorax may be considered to be protected by the ster¬ 
num or other bones. The remaining one third is treated as 
unprotected and is lumped with the abdomen. This redis¬ 
tribution is effected by adjusting the values of the MPA A 
used for these two parts of the body. 

Then, applying to the thorax the probit equation 
obtained for the sternum from Table 17.59(B) 

Y(P thol ) ® -7.37 + 0.948 In(ma 2 /A) [17.42.22] 

Abdomen 

Data given below indicate that 84% of the injuries to the 
abdomen result in death or serious injury This value is 
taken as the probability P(P a bd) of penetration to a vulner¬ 
able area given perforation of the skin. 


17.42.6 Fatal injury 
All parts of the body 

An approximate estimate of the probability of fatality given 
fatal or serious injury may be obtained from the data on 
civilian air raid casualties given in theTextbook and shown 
in Table 17.60(A). This table gives the overall probability of 
fatality as 0.26, which may be compared with the value of 
0.27 given in theTextbook for ‘all regions’. 

It should be noted that the probability given in this table 
is the probability of fatality given a hit, not the probability 
of fatality given penetration to a vulnerable area. 

The Textbook also gives information on British military 
casualties in the First World War as given in Table 17.60(B). 
These data have been used in relation to fatal injuries of the 
trunk, as described below. 

Head and neck 

Further information on fatal injuries arising from penetra¬ 
tion of the skull is given by A. Palmer (1962). He gives data 
on the mass distribution of flak fragments in 30 cases 
recovered from fatal and non-fatal fracture wounds to the 
skull. The proportion of the cases which were fatal is 77%. 
On this basis the probability of fatality given perforation of 
the skull P(K|P vu i iSku u) is taken as 0.8. 


The vulnerable parts of the limbs are bones and vessels 
and nerves outside the bone area. The Textbook gives the 
MPA of these vulnerable areas and the probability P(Pii m b) 
is then simply the ratio of the vulnerable area of the limb to 
its total MPA. The data are shown in Table 17.59(C). 


Thorax and abdomen 

For fatal injuries involving the thorax and abdomen use has 
been made of data given in theTextbook on military casual¬ 
ties in the First World War shown in Table 17.60(B). The 
effect of an injury to the trunk tends to be serious. From 
the data in the table the probability P(K|P vuUhor ) of fatal 
injury given penetration to the vulnerable area for the 
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Table 17.60 Fatal injury by a fragment penetrating to a vulnerable area 

A British ai 

r raid casualties ii 

a the Second World War 3 



Region, i 



Proportion of MPA, 


Conditional probability 




P(HilH) 


of fatal injury P (Ki/Hj) 

Head and neck 



0.12 


0.60 

Thorax 



0.16 


0.40 

Abdomen 



0.11 


0.56 

Upper limb 



0.22 


0.07 

Lower limb 



0.39 


0.14 

B British military casualties i 

n the First World War 3 





Proportion of effective wounds 

Proportion of fatal or 

Conditional probability 



in each part of body (%) 

serious injury (%) 

of fatal injury, P(Ki|P vul p) 


Dead, 

Seriously wounded Slightly wounded 



Head and neck 

25.8 

27.8 

46.4 

53.6 

0.481 

Thorax 

59.6 

20.7 

19.7 

80.3 

0.782 

Abdomen 

61.1 

23.1 

15.7 

84.2 

0.726 

Upper limb 

3.0 

36.3 

60.7 

39.3 

0.076 

Lower limb 

3.9 

44.4 

51.7 

48.3 

0.081 


a Source: Textbook of Air Armament (Ministry of Supply, 1952). Section A: table 3; section B: table 2. 


thorax is taken as 0.75 and similarly for the probability 

P( K|P vu t, ab d). 


Limbs 

Palmer also gives information on fatal injuries arising from 
penetration of vulnerable parts of limbs. He gives data on 
the mass distribution of flak fragments recovered from 
fatal and non-fatal extremity fracture wounds. The pro¬ 
portion of the cases which were fatal for the upper limb is 
5.9% and for the lower limb 15.4%. 

An alternative approach is to utilize the Second World 
War data given in Table 17.59(C) and Table 17.60(A). From 
these tables it may be inferred that for the upper limb 

^(K|P vu i, U pi to b) = 0.07/0.467 
== 0.15 


and for the lower limb 

P(K|P vu i,iwiimb) = 0.14/0.406 
e 0.345 

17.42.7 Effect of advances in medicine 

Surveys of battle casualties generally conclude that rapid 
first aid, medical treatment and modern surgery can 
greatly reduce mortality from wounds to the extremities, or 
limbs, although this is of little help in the case of wounds to 
the head. This is supported by statistics which show that 
US battle deaths from extremity wounds were reduced 
from about 13% of all deaths in the Second World War to 
7.4% in Vietnam. 

The probability of fatality given penetration to a vul¬ 
nerable part of a limb P(K|P vul i imb ) during the Second 
World War is therefore reduced in the model to half its crude 
estimated value by taking credit for medical advances. 

No other credit for medical advances is taken in the 


17.42.8 Effect of clothing 

Clothing may in principle affect the probability of skin 
perforation. The work of French and Callender (1962) indi¬ 
cates that although exhibiting a finite threshold velocity for 
perforation, light clothing is much less resistant than skin. 
It is assumed in the model that the type of clothing worn by 
civilians offers very little protection against missiles and 
hence bare skin criteria are used. 

17.42.9 Injury model 

The model of injury by fragments may be summarized as 
follows. The adjusted values of proportion AJA of MPA 
assigned to body region i are: 


Body region 

Ai/A 

Head and neck 

0.12 

Thorax 

0.11 

Abdomen 

0.16 

Upper limb 

0.22 

Lower limb 

0.39 


P(Pskin) Equation 17.42.20 for bare skin. 

Following skin perforation, Xis reduced by 360,000 J/m 2 to 
account for the energy expended: 


^(Pskull) 

P(Pthor) 

P(Pabd) 

P(Plwlbnb) 

P(Puplimb) 

P(K|P sM i) 

P(K|P,bor) 

P(K|P ab d) 

P(K U plimb |Pvul,uplimb) 
P(Kl w , imb |Pvul,lwlimb) 


Equation 17.42.21; 

Equation 17.42.22; 

= 0.84; 

= 0.467 from Table 17.59 (C); 
= 0.467 from Table 17.59 (C); 


= 0.75; 
= 0.75; 
= 0.15; 
= 0.345. 
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If allowance is made for medical advances since the Second 
World War, the last two values become 0.07 and 0.15, 
respectively. 

17.43 Dust Explosions 

Another explosion hazard in the process industries is the 
explosion of flammable dusts. Explosions of dust suspen¬ 
sions have characteristics in common with gas explosions, 
but there are also some important differences. Fire and 
explosions can also occur in dust layers. Legal requirements 
for plant handling flammable dusts are given in the Factories 
Act 1961, section 31.This section includes the following: 

(1) Where, in connection with any grinding, sieving or 
other process giving rise to dust, there may escape 
dust of such a character and to such an extent as to 
be liable to explode on ignition, all practicable 
steps shall be taken to prevent such an explosion by 
enclosure of the plant used in the process, and by 
removal or prevention of accumulation of any dust 
that may escape in spite of the enclosure, and by 
exclusion or effective enclosure of possible sources 
of ignition. 

(2) Where there is present in any plant used in any 
such process as aforesaid dust of such a character 
and to such an extent as to be liable to explode on 
ignition, then, unless the plant is so constructed as 
to withstand the pressure likely to he produced by 
any such explosion, all practicable steps shall be 
taken to restrict the spread and effects of such an 
explosion by the provision, in connection with the 
plant, of chokes, baffles and vents, or other equally 
effective appliances. 

There are other statutory requirements relating to parti¬ 
cular flammable dusts. 

Accounts of dust explosions are given in Dust Explosions 
in Factories (HSE, 1970 HSW Bklt 22), Dust Explosions 
and, Fires (K.N. Palmer, 1973a), Explosions (Bartknecht, 
1981a), Dust Explosions (Cross and Farrer, 1982), Dust Exp¬ 
losions (Field, 1982), Development and Control of Dust 
Explosions (Nagy and Verakis, 1983), Venting Gas and Dust 
Explosions (Lunn, 1984b, 1992), Dust Explosions (Bart¬ 
knecht, 1989), Dust Explosions in the Process Industries 
(Eckhoff, 1991) and by Wilkes (1948), Maisey (1965), H.E. 
Rose (1970, 1975), K.N. Palmer (1971, 1974a-c, 1975a,b, 
1975-76, 1977, 1981a, 1982, 1983, 1990), O’Reilly (1972), 
Schwab (1986) and Lunn (1989a,b, 1990). 

Relevant codes are NFPA 68: 1994 Explosion Venting and 
NFPA 69:1992 Explosion Prevention Systems. In addition, there 
are a number of codes relevant to particular industries which 
deal with dusts such as NFPA 61 series (foodstuffs), NFPA 654 
(chemicals, dyes, pharmaceuticals and plastics), NFPA 
655 (sulphur) and NFPA 651 (aluminium and magnesium). 

Selected references on dust explosions are given in 
Table 17.61 and on dust explosibility in Table 17.62. 

17.43.1 Industrial dusts 

Many industrial materials are at some stage handled as 
dusts or powders and many final products are in dust/ 
powder form. Some typical industrial dusts/powders are 

(1) wood; 

(2) coal; 


(3) food (e.g. starch, flour, sugar, cocoa, feedstuffs); 

(4) chemicals (e.g. drugs, dyestuffs); 

(5) plastics (e.g. urea formaldehyde resin, polyethylene, 
polystyrene); 

(6) metals (e.g. aluminium, magnesium). 

Some of the operations in which such dusts are produced 
are considered in Section 17.49. 


Table 17.61 Selected references on dust explosions 


W.M. Jones (1940a,b); Burgoyne (1945); Wilkes (1948); 
Hartman (1948a, 1950,1957); Drinker and Hatch (1954); 
Fishkin and Smith (1964); Schwab and Othmer (1964); 
Nagy and Surincek (1966 BM RI6811); Eggleston (1967); 
Essenhigh (1967); Vegter (1969); HSE (1970 HSW Bklt 22, 
1975 SHE 830); H.E. Rose (1970,1975); FPA (1974 CFSD 
6015,1989 CFSD FS 6021,6023,6023,6024); Kuhnen (1971); 
Bartknecht (1971,1972a,b, 1973,1974a, 1975,1980,1981a, 
1989); Clague (1972); O’Reilly (1972); Ritter (1972); 

Hess (1973); Nettleton and Stirling (1973); K.N. Palmer 
(1973a, 1981a, 1990); FRS (1973 Fire Res. Note 992); Suchan 
(1973); Anon. (1976 LPB 8, p. 7); Griffith (1978); BRE (1979 
TIL 63); Cardfflo and Anthony (1979); Deasy (1979); Clavel 
and Estrabaud (1980); CMI (1980 CMI790750-1); P.E. 
Moore (1980); Cross (1981); IBC (1981/13,1982/23,1984/49 
Pt 2); Jacobsen (1981); Napier (1981); Tait (1981); Cross and 
Farrer (1982); Field (1982); Moen (1982b); Siwek (1982); 
Tamanini (1982); Thorne (1982);Wolanski (1982a, b); 
Zeeuwen (1982,1988); Nagy and Verakis (1983); Boiko et al. 
(1984); Kauffman etal. (1984);Wolanski et al. (1984); 

N. Gibson, Harper and Rogers (1986); Schwab (1986); 
Cartwright (1987,1990); NFPA (1989 NFPA 61A, 61B); 

W.E. Baker,White and Hokanson (1991); Eckhoff (1991, 
1993); Godbey (1991); Cashdollar etal. (1992); Ural (1992); 
Anon. (1993 LPB 113, p. 0) 

Ignition 

Blactin and Robinson (n.d.); Morse (n.d., 1958); Boyle and 
Llewellyn (1950a,b); Underwriters Laboratories (1953); 
K.N. Palmer (1957,1973a, 1976b, 1981b); K.N. Palmer and 
Tonkin (1957); Chauvin (1973); Eckhoff (1976a,b, 1991); 
Eckhoff and Enstad (1976); J.F. Hughes and Bright (1979); 
Anon. (1980 LPB 35, p. 1); Cross (1980); Department of 
Agriculture (1980); N. Gibson and Rogers (1980); Glor and 
Boschung (1980); Krishna and Berland (1980); Leuschke 
(1980,1981); Dahn (1981); Petino (1981); Cross and Farrer 
(1982); Zeeuwen (1982); Borisov etal. (1984); Hertzberg, 
Conti and Cashdollar (1985); Pedersen and Eckhoff (1987); 
Tyler and Henderson (1987); Anon. (19881); Henderson 
and Tyler (1988); Bruderer (1989b); FPA (1989 CFSD FS 
6023); Schuber (1989); Amyotte, Baxter and Pegg (1990) 

Combustion 

Cassel, Das Gupta and Guruswamy (1949); Cassel, 
Liebman and Mock (1957); Essenhigh and Woodhead 
(1958); Cassel and Liehman (1959); Butlin (1971); Rae (1971); 
Ishihama and Enomoto (1973,1975); Eckhoff (1977); 
Liebman, Conti and Cashdollar (1977); Eckhoff and 
Mathisen (1978); N. Gibson and Rogers (1980); Kansa and 
Perlee (1980); Pineau (1982);Tulis and Selman (1982,1984); 
Ballal and Lefebvre (1983a, b); Veyssiere (1984); Kauffman 
etal. (1985); Pineau, Chaineaux and Ronchail (1986); 
Bao-Chun, Fan and Sichel (1988); Proust and Veyssiere 
(1988); Amyotte and Pegg (1989); D. Bradley, Chen and 
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Swithenbank (1989); Britton and Chippett (1989); Fan and 
Sichel (1989); Pu, Jarosinksi etal. (1989); Pu, Marunkiewicz 
etal. (1989); Aldis and Gidaspow (1990); Zhang and 
Gronig (1991); Hertzbergef a/. (1992); Kumar, Bowles and 
Mintz (1992); Eidelman and XiaolongYang (1993); Seung 
Wook Back, Kook Young Aim and Jong Uck Kim (1994) 
Particular materials: Underwriters Laboratories (1953); 
K.N. Palmer (1982); Ogle etal. (1988) 

Hazardous area classification 
Moodie (1971); ICI/RoSPA (1972IS/91) 

Dust fires 

K.N. Palmer (1957,1973a, 1981b, 1983); K.N. Palmer and 
Tonkin (1957); Verkade and Chiotte (1978a); Leisch, 
Kauffman and Sichel (1985) 

Process plant handling 

EEUA (1968 Hndbk 19); R.W. Nelson (1972); K.N. Palmer 
(1973a, 1975a,b, 1984 LPB 54); Schafer (1973b); 

Theimer (1973); Pollock (1975); Dressier (1977); Aldis and 
Lai (1979); J.F. Hughes and Bright (1979); Gillis and Dale 
(1980); N. Gibson (1981); Hoenig (1981,1989); Anon. (19881); 
Bartknecht (1989); FPA (1989 CFSD FS 6024); Gelfand et al. 
(1989); Siwek (1989b); Eckhoff (1991); Siwek and 
Cesana (1993); Maddison (1994) 

Bags: Bruderer (1993) 

Bucket elevators: K.C. Brown (1951); Gillis and Dale (1980); 
Gillis (1981); Kossebau (1982) 

Driers: Reay (1977,1979 LPB 25); Bartknecht (1981a); 
Schmalz (1982); Bruderer (1989a); Crowhurst (1989); 
Abbott (1990) 

Dust collectors, filters: K.N. Palmer (1974a); J. Palmer 
(1980); Bartknecht (1981a); Frank (1981); Reinauer (1981); 
Cairns (1984); N. Bennett, Cairns and Cooper (1986); van 
Laar (1993) 

Grinding mills: Schmalz (1982) 

Silos: Themier (1973); Bartknecht (1981a, 1985); CMI (1982 
CMI813307-1); E c khoff (1982,1984,1991); Eckhoff et al. 
(1982,1988); Radant (1982); Britton and Kirby (1989) 

Metal dusts: H. Brown (1941BM 1C 7148) 

Explosion prevention and protection 
SMRE (Explosion 4);W.M. Jones (1940b); Valentine and 
Merrill (1942); Burgoyne and Fauls (1963); Burgoyne 
(1967a); Craven and Foster (1967); K.N. Palmer (1967b, 
1973a, 1973 FRS Fire Res. Note 961,1974a); Coffee (1968); 
Bartknecht (1971,1972a,b, 1973,1974a, 1975,1977,1981a, b, 
1989); R.W Nelson (1972); N. Gibson (1973a); Hess (1973); 
FPA (1974 CFSD FS 6015,1989 CFSD FS 6022); Cocks 
(1979); S. Clark (1981); P. Moore (1981); Brennecke (1982); 

IB (1982/23,1984/49 Pt 2,1988/74,1992/90); Rickenbach 
(1982); Ritter (1982); Stalder (1982); Wetterich (1982); 
Wiemann (1982); Ebert (1982/83); Nagy and Verakis (1983); 
European Information Centre on Explosion Protection 
(1984); Janssens (1984); Lunn (1984b, 1988a, 1992); 
Schofield (1984); Butters (1985 LPB 66); BSI (1986); NFPA 
(1988 NFPA 654,1992 NFPA 69); Schofield and Abbott 
(1988); Hoenig (1989); Anon. (1990 LPB 95, p. 7); 
Amrogowicz and Kordylewski (1991); Amyotte, Mintz 
and Pegg (1992); Amyottte and Pegg (1992); Ebadat (1993) 
VDI2263:1990- 
Explosion relief 

FRS (Fire Res. Note 830,1973 Fire Res. Note 961); Hartmann 
(1946); Hartmann and Nagy (1946 BM RI3924,1957); Nagy, 
Zeilinger and Hartmann (1950 BM RI 4636); K.C. Brown 
(1951); K.C. Brown and Curzon (1962,1963); K.C. Brown 


etal. (1962); Maisey (1965); Heinrich (1966,1972,1974, 
1975); K.N. Palmer (1967b, 1971,1973a, 1974a-c, 1975/76, 
1977); Donat (1971a, 1977a); Heinrich and Kowall (1971, 
1972); Pineau (1973); Bartknecht (1974a, b, 1977a, 1981a, 
1985,1986,1989); Pineau, Giltaire and Dangeaux (1974, 
1976,1978); Matsuda and Naito (1975); N. Gibson and Harris 
(1976); Burgoyne (1977); Hattwig (1977); Nettleton (1977a); 
Rust (1979); WE. Baker, Hokanson and Kulesz (1980); 

M.R. Marshall (1980); BRE (1981N81/81, N101/81); Eckhoff 
(1982,1989,1990,1991); Field (1982,1984); Scholl (1982); 
Eckhoff and Fuhre (1983); Lunn (1984b, 1989a,b, 1990, 
1992); Schofield (1984); IBC (1985/63,1987/72); Lunn and 
Cairns (1985); Eckhoff, Fuhre and Pedersen (1986,1987); 
Pineau, Chaineaux and Ronchail (1986); Simpson and 
Woinsky (1986); Eckhoff et al. (1988); Lunn, Brookes and 
Nicol (1988); Lunn, Crowhurst and Hey (1988); Zeeuwen 
(1988); P. Moore (1990); Siwek (1989a, 1994); M. Epstein etal. 
(1990);Tamanini (1990); Hey (1991); IChemE (1992/33); 
Siwek, Glor and Torregiani (1992); K. van Wingerden 
(1993); Scheuermann (1994); NFPA (1994 NFPA 68) VDI 
3673:1979 

Disposal of vented material: K.N. Palmer (1973a); 
Bartknecht (1981a, 1989) 

Explosion suppression 

Bartknecht (1971,1973,1977b, 1981a,b); Rae and Thompson 
(1979); P. Moore (1982b, 1984,1986,1990); P. Moore and 
Bartknecht (1986); Senecal (1989a,b); Kordylewski and 
Amrogowicz (1992) 

Hybrid explosions 

Cardfflo and Anthony (1978); Pellmont (1979,1982); 
Kauffman etal. (1984); Senecal (1989b);Torrent, Fuchs 
and Fernandez (1990); Torrent, Fuchs and Borrajo (1991); 
W.E. Baker, White and Hokanson (1991) 

Grain elevators, inc. explosions 
Morse (1958); Anon. (1978f); Verkade and Chiotte (1978a,b); 
Anon. (1979 LPB 27, p. 76); Aldis and Lai (1979); Atallah 
(1979); Anon. (1980q);Tait, Repucci andTou (1980); 

Brasie (1981); Kauffman (1981,1982,1986); W.E. Phillips 
(1981); Winsett (1981); Pedersen and Eckhoff (1987); NFPA 
(1989 NFPA 61B) 

Hazard assessment 
Brasie (1981) 


Table 17.62 Selected references on dust flammability 
and explosibility 


Wheeler (1935a); Hartmann, Nagy and Brown (1943 BM RI 
3722); Hartmann and Nagy (1944 BM RI 3731, RI 3751,1949, 
1957); Underwriters Laboratories (1944); Hartmann and 
Greenwald (1945); Bowes, Burgoyne and Rasbash (1948); 
Hartmann (1948a, 1957,1958); Hartmann, Cooper and 
Jacobsen (1950 BM RI 4725); Hartman, Nagy and Jacobsen 
(1951 BM RI 4835); Hartman, Jacobsen and Williams (1954 
BM RI 5052); Carpenter (1957); Carpenter and Davies 
(1958); Dorsett etal. (1960 BM RI 5624); Jacobsen etal. (1961 
BM RI 5753); Nagy and Portman (1961 BM RI 5815); 
Jacobsen, Nagy and Cooper (1962 BM RI 5971); Maguire, 
Slack and Williams (1962); Cassell (1964 BM RI 6651); 
Jacobsen, Cooper and Nagy (1964 BM RI 6516,1965 BM RI 
6851); W.F. Marshall, Palmer and Seery (1964); Nagy, 
Cooper and Stupar (1964 BM RI 6561); Nagy, Dorsett and 
Jacobsen (1964 BM RI 6543); Singer (1964 BM RI 6369); 
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Nagy, Dorsett and Cooper (1965 BM RI6597); Leuschke 
(1966); Craven and Foster (1967); WE. Mason and Wilson 
(1967); K.N. Palmer (1967a, 1973a,b); Singer, Cook and 
Grumer (1967 BM RI 6931); Dorsett and Nagy (1968 BM RI 
7132); Gillis (1968); HM Factory Inspectorate (1968); Nagy, 
Cooper and Dorsett (1968 BM RI 7208); Schwab (1968, 
1986); Singer, Bruzsak and Grumer (1968 BM RI 7103); 
Grumer (1971 BM RI 7552); Fris (1972); N. Gibson (1972); 
Heinrich (1972); Kohlschmidt (1972); Lutolf (1972); 
Mintschew etal. (1972); Novotny, Pantoflicek and Lebr 
(1972); Raftery (1972,1975 FRS Fire Res. Tech. Pap. 21); 
Ishihama and Enomoto (1973); Mitsui and Tanaka (1973); 
CMI (1975 CMI72001-12,1987 CMI77005-2); Eckhoff 
(1975,1976a,b, 1985,1991); Tonkin (1975 FRS Fire Res. Note 
1028); Eckhoff and Enstad (1976); Kelley and Forkner (1976 
BM RI 8201); Lovachev (1976,1978b); Napier (1977b); 
Burgoyne (1978); Eckhoff and Mathisen (1978); Nettleton 
(1978a); Hertzberg, Cashdollar and Opferman (1979 BM RI 
8360); P.E. Moore (1979a); Scholl et al. (1979); Kalkert and 
Schecker (1980); Nomura and Tanaka (1980); Sinclair and 
Sweis (1980); Bartknecht (1981a, 1989); Cocks and 
Meyer (1981); Deguingand and Galant (1981); Hertzberg, 
Cashdollar and Lazzara (1981); Jacobson (1981); I. Swift 
(1981,1982); BRE (1982 CP5/82,1983 SO 37); Field (1982, 
1983,1985 LPB 66); Hertzberg (1982); Hertzberg etal. 
(1982); Siwek (1982); Zeeuwen (1982,1988); Felstead, 
Rogers and Young (1983); Nagy and Verakis (1983); 
Nomura, Torimoto and Tanaka (1984);Tulis and Selman 
(1982,1984); Sweis and Sinclair (1985); Dahn, Ashum and 
Williams (1986); N. Gibson etal. (1986); Sweis (1987); 

Lunn (1988b); Cashdollar, Hertzberg and Zlochower (1989); 
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Dusts may be formed by condensation from vapours of 
materials which condense to form solids directly or by 
mechanical size reduction of solid materials. In the former 
case the particle size tends to be much smaller. 

The terms ‘dust and powder’ tend to be used inter¬ 
changeably and have no agreed definition. It is desirable, 
however, to set some limits to the particle size of materials 
under consideration. BS 2955: 1958 defines as ‘powder’ 
material with a particle diameter of less than 1000 pm (16 
BS mesh size) and as ‘dust’ material with a particle dia¬ 
meter of less than 76 pm (200 BS mesh size). K.N. Palmer 
(1973a) takes a somewhat wider definition and does not 
exclude from his treatment information on materials with a 
particle diameter coarser than 1000 pm. 

17.43.2 Dust explosions 

The hazard of a dust explosion or fire exists wherever 
flammable dusts are handled. Generally, a dust explosion 
occurs only if the dust is dispersed in air, but transition 
from a fire to an explosion can occur, and vice versa. If a 
burning dust is disturbed, a dust suspension may be 
formed and ignited. This initial explosion may generate 
further dust clouds, which in turn explode. On the other 


hand, burning particles from an explosion may act as 
the source of ignition for a fire of other flammable 
materials. 

The explosive effect of a dust explosion is caused by the 
rapid release of heat and the accompanying rapid pressure 
rise or expansion of the hot gases. 

In dust explosions the combustion process is very rapid. 
The flame speed is high, comparable with that in gas def¬ 
lagrations. Maximum explosion pressures are often close to 
the theoretical values calculated assuming no heat loss 
during the explosion. 

It is uncertain whether detonation can occur in dust 
explosions in industrial plant. The flame speed in dust 
explosions is high and in some cases has been reported 
as approaching that found in detonations. Most of the evi¬ 
dence for detonations in dust suspensions relates to coal 
mine galleries where the explosion was initiated by a 
strong ignition source. It is not clear whether detonations 
can develop from weak ignition sources in industrial plant. 

As far as explosion protection is concerned, K.N. Palmer 
(1973a) states: 

It is general practice in considering protection against 
dust explosions, in industrial plant, to assume that 
deflagrations rather than detonations occur. This proce¬ 
dure has proved to be satisfactory in practice, which is 
fortunate, because deflagrations are simpler to deal with 
than detonations. 

The sequence of events in a serious industrial dust 
explosion is often as follows. A primary explosion occurs in 
an item of plant. The explosion protection is not adequate to 
prevent the flame issuing from the plant, due either to 
rupture of the plant or to poor explosion venting. The air 
disturbance disperses the dust in the work room and causes 
a secondary explosion. The quantity of dust in the second¬ 
ary explosion often exceeds that in the primary one. More¬ 
over, the building in which the secondary explosion occurs 
may be weaker than the plant itself. The secondary explo¬ 
sion is thus often more destructive than the primary one. 

In some cases the primary explosion also occurs in the 
open and disturbs dust deposits, and this causes a second¬ 
ary explosion. In other cases the primary explosion occurs 
in one unit of the plant and the explosion propagates within 
the plant to other units. 

The possibility of a highly destructive secondary explo¬ 
sion makes dust explosions rather unpredictable. 

It is characteristic of plant handling dusts that it is gen¬ 
erally very weak relative to the stresses exerted by a dust 
explosion. Frequently, it can withstand pressures of only 
7-15 kPa (1-2 psi).This compares with the pressures of up 
to 1000 kPa (140 psi) which have been reported for dust 
explosions under the most unfavourable conditions. 

Similar considerations apply to buildings containing 
plants handling dusts. Generally, buildings cannot with¬ 
stand more than about 7 KN/m 2 (1 lbf/in. 2 ) pressure. 

Some very destructive dust explosions have occurred in 
multi-storeyed buildings. The failure of walls on a lower 
floor has led to collapse of floors and walls on higher stor¬ 
eys. A particular hazard in multi-storeyed buildings is 
vertical bucket elevators handling dust. A bucket elevator 
may allow an explosion to propagate through many storeys 
of the building. 

The dust explosion problem is aggravated by the 
increasing size of plants. The damage caused by an explo¬ 
sion in a large volume may be more than proportionately 
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greater than that resulting from a small volume explosion, 
because the larger unit is frequently relatively weaker. 

Aparticular problem arises where it is desired to use plant 
designed for a low explosibility dust to handle a high explo- 
sibility one. In this case it is essential to check very carefully 
whether the plant is suitable or needs modification. 


17.43.3 Dust explosion incidents 

Accounts of dust explosion accidents have been given in 
Dust Explosions (D.J. Price and Brown, 1922), Report of 
Important Dust Explosions (NFPA, 1957/1) and Dust Exp¬ 
losions in Factories (HSE, 1970 HSW Blkt 22) and by 
K.C. Brown and James (1962), Beach (1964), K.N. Palmer 
(1973a) and Kaufman (1986). 

The HSE booklet lists a wide range of industries and 
operations in which serious dust fires/explosions have 
occurred. Beach gives a detailed analysis of dust explo¬ 
sions, excluding those in coal mines, in the period 
1900-59. He lists 1110 explosions and 648 fatalities. 

Some principal dust explosions are given in Table 17.63. 

Historically, industries particularly affected by dust 
explosions have been flour milling, grain storage and coal 
mining. A classic flour mill explosion was that in a flour 
mill in Turin in 1785 (Morozzo, 1795). Serious flour mill 
explosions have occurred in the United Kingdom, includ¬ 
ing one at Bow, London, in 1965 which killed five people. 

An explosion in a starch/corn plant at Cedar Rapids, 
Iowa, in 1919 killed 43 people and one at a similar plant in 
Peking, Illinois, in 1924 resulted in 42 deaths. 

Grain storage facilities are liable to serious dust explo¬ 
sions. In 1977 a series of dust explosions occurred in a set of 
grain silos at Westwego, near New Orleans, Louisiana, 
which killed 35 people (Case History A89). This disaster 
was thus on the same scale as that of Flixborough. 

Many severe dust explosions have also occurred in coal 
mines, but these are not considered here. 


324 non-fatal injuries, and in the period 1962 -79 there 
were 474 explosions reported with 25 fatalities and 633 non- 
fatal injuries; 10 of the 25 fatalities in this latter period 
occurred in two incidents. 

Lunn also quotes two other surveys. One is by the HSE 
covering the periods 1979-84 and 1985-88, and gives 
breakdowns by type of event, dust involved, equipment 
involved and ignition source. In the total period 1979-88 
there were 36 dust fires with injury, 123 fires with no injury, 
41 explosions with injury and 95 explosions with no injury. 
Principal items of equipment involved were mills, grin¬ 
ders, filters, driers, silos/hoppers and ducts with 51 (17%), 
47 (16%), 43 (14%), 19 (6%) and 15 (5%) events, respec¬ 
tively; 95 (31%) events were classified in the category 
‘other’. The second survey is by the Berufsgenoss- 
enschaftliches Institut fur Arbeitssicherheit (BIA) and 
gives breakdowns by plant group, equipment involved and 
ignition sources. 

17.44 Dust Explosibility Characteristics 


(1) explosibility classification; 

(2) minimum explosive concentration; 

(3) minimum ignition temperature; 

(4) minimum ignition energy; 

(5) maximumpermissibleoxygenconcentrationtoprevent 
ignition; 

(6) explosion pressure characteristics 

(a) maximum explosion pressure, 

(b) maximum rate of pressure ri 

(c) average ra 


An account is given first of the factors which influence 


Some statistical data on dust explosions are given by dust explosibility, then of the tests used to determine the 
Lunn (1992). In the United Kingdom in the period 1958-67, explosibility parameters and then of the explosibility 
there were 247 reported explosions with 9 fatalities and parameters themselves. 

Table 17.63 Some dust explosion incidents 

Date 

Location 

Material 

Plant/building 

Deaths/injuries 

1911 

Glasgow, UK 



5d,8i 


Liverpool, UK 



37d, lOOi 


Manchester, UK 



3d, 5i 

1913 

Manchester, UK 



3d, 5i 

1919 

Cedar Rapids, IA 

Corn starch 

Starch plant 

43d 

1924 

Peking, IL 

Corn starch 

Starch plant 

42d 

1930 

Liverpool, UK 



lid, 32i 

1941 

Liverpool, UK 



6d,40i 

1944 

Kansas City, KS 

Grain dust 

Corn mill 

4d, 20i 

1955 

Waynesboro, GA 

Grain dust 

Feed plant 

3d, 13i 

1962 

St Louis, MO 

Grain dust 

Feed plant 

2d, 34i 

1964 

Paisley, UK 



5d, 2i 

1965 

Bow, London, UK 

Flour 

Flour mill 

5d 

1970 

Kiel, FRG 

Grain dust 

Grain silo 

6d, 18i 

1977 

Galveston,TX 

Grain dust 

Grain silo 

15d 

1977 

Westwego, LA 

Grain dust 

Grain silo 

36d, lOi 

1979 

Hamburg, FRG 

Grain dust 

Grain silo 

2i 

1979 

Lerida, Spain 

Grain dust 

Grain silo 

7d 

1980 

Naples, Italy 

Grain dust 

Grain silo 

8i 
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17.44.2 Factors influencing dust explosibility 

The explosibility of dust suspensions in air is character¬ 
ized by parameters similar to those which define the fla¬ 
mmability of gas-air mixtures as described in Chapter 16, 
but there are some significant differences. 

The explosibility of a dust may be regarded as increasing 
as the minimum explosible concentration, the minimum 
ignition temperature and the minimum ignition energy 
decrease and the burning velocity and maximum rate of 
pressure rise increase. 

The characterization of particles is a complex matter, but 
general characteristics which affect the behaviour of par¬ 
ticles include those of the individual particle itself such as 
particle composition, density, size, shape, surface proper¬ 
ties and moisture content and those of the bulk powder 
such as bulk density and flow properties. 

Some factors which influence dust explosibility are: 

(1) chemical composition; 

(2) particle size; 

(3) moisture content; 

(4) oxygen concentration; 

(5) inert gas; 

(6) admixed inert dust concentration. 

Nagy and Verakis (1983) give a large number of plots 
showing the effect of these factors on the dust explosibility 
parameters, mainly for particular dusts. 

There are certain chemical groups such as COOH, OH, 
NH 2 , N0 2 , C=N, C=N and N=N which tend to be asso¬ 
ciated with higher dust explosibility and certain others 
such as Cl, Br and F with lower explosibility. 

Dusts of pure metals generally react with air to form 
metallic oxides. In this case the explosive increase in pres¬ 
sure is due to expansion of the nitrogen of the air caused by 
the heat release. In some cases metals actually react vio¬ 
lently with the nitrogen itself to form a metallic nitride. 

Volatile matter in the dust tends to enhance the explosi¬ 
bility, although there is generally little increase for volatile 
contents below 10%. Coal dust in particular can contain a 
high proportion of volatile matter. 

Interestingly, according to Nagy and Verakis, pure car¬ 
bon dust does not explode. They speculate that the reaction 
rate of pure carbon with oxygen is too low. But carbon dust 
containing 8% volatile matter is explosive. 

If the dust contains inert material this reduces its explo¬ 
sibility. This includes coal dust with clay and some poly¬ 
meric materials that contain inert fillers. 

Dust explosibility is strongly affected by particle size. 
Particle size is usually defined in terms of an equivalent 
particle diameter. Generally, a dust with a particle diameter 
greater than 500 pm is unlikely to be responsible for 
initiation of an explosion, though it may undergo combus¬ 
tion in one already occurring. At the other end of the range, 
reduction in particle size below about 50-74 pm does not 
normally result in any significant increase in explosibility. 
The particle diameter of dusts used in dust explosibility 
testing normally does not exceed 75 pm. 

A dust usually contains a range of particle sizes. A rela¬ 
tively small proportion of fine particles enhances the 
explosibility of a dust. Moreover, attrition caused by hand¬ 
ling the dust tends to generate fine particles. 

Figure 17.112 illustrates the effect of particle size on 
some of the more important dust explosibility parameters. 
These results are for atomized aluminium, which is a rather 


extreme case, but nevertheless they illustrate general 
trends. 

Moisture content has a strong effect on dust explosi¬ 
bility, although the effect is generally weak for moisture 
contents below 10%. At the other end of the range, dust 
with a moisture content greater than 30% is unlikely to be 
responsible for initiation of an explosion. 

The oxygen concentration in the surrounding atmo¬ 
sphere has a strong effect on dust explosibility, which inc¬ 
reases as the oxygen concentration increases. Conversely, 
the explosibility decreases as the oxygen concentration 
decreases and the inerts concentration increases. 

Dust explosibility is affected by the concentration of any 
admixed inert dust, although the effect is generally weak 
for inert dust concentrations below 10—20%. 

17.44.3 Dust explosibility tests 

The tests which are carried out on dust explosibility vary 
between countries and a large variety of tests are in use. 
It is convenient to start with those developed at the Bureau 
of Mines (BM) in the United States, since these have 
also been widely used in other countries, including the 
United Kingdom. 

Accounts of the various tests in the Bureau of Mines 
scheme have been given in a series of reports, in particular 
that by Dorsett et al. (1960 BM RI 5624). A summary has 
been given by Nagy and Verakis. Some of the apparatus 
used in these tests is illustrated in Figure 17.113. 

Dust explosibility is determined in the Hartmann 
apparatus, shown in Figure 17.113(a). The Hartmann appa¬ 
ratus is a vertical tube of volume 1.21. The dust is dispersed 
by an air blast. The ignition source is a hot wire or spark 
igniter. If any flame propagation is observed, the dust is 
explosible. 

Two other types of apparatus which are also used to 
determine whether a dust is explosible are the horizontal 
tube apparatus and the inflammator apparatus, shown in 
Figures 17.113(b) and (c), respectively. In the horizontal tube 
apparatus, the dust is dispersed by an air blast. The igni¬ 
tion source is a hot coil. In the inflammator apparatus, the 
dust suspension is injected into the apparatus against a 
deflector plate and falls onto the ignition source a hot wire 
or spark igniter. The apparatus is useful for dusts which are 
not readily dispersed. 

The minimum ignition temperature for explosion of a 
dust suspension is measured in the Godbert-Greenwald 
furnace, shown in Figure 17.113(d). A dust suspension is 
injected into a vertical tube held in a constant temperature 
furnace and the appearance of flame at the open bottom 
mouth of the furnace is observed. 

A separate determination is made of the minimum 
ignition temperature of a dust layer, which in general 
differs from that of the dust in suspension. Again, the 
Godbert-Greenwald furnace is used, but in this case 
the dust is held in a wire mesh basket 1 in. in diameter and 
V2 in. deep. Another method which is also used is ignition of 
the layer on a hot plate. 

The minimum ignition energy for explosion of a dust 
suspension is measured in the Hartmann vertical tube 
apparatus. The dust is dispersed by an air blast. The igni¬ 
tion source is a capacitor discharge spark igniter. Any 
propagation of flame is observed. 

The maximum oxygen concentration to prevent ignition 
is measured in the open Hartmann vertical tube using 
spark ignition and in the Godbert-Greenwald furnace. 
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The pressure-time profile is measured in a closed 
Hartmann vertical tube apparatus, or Hartmann bomb. The 
explosion pressure characteristics are obtained from this. 

The Hartmann test for the pressure-time profile is the 
subject of ASTM E789-811981 Test for Pressure and Rate 
of Pressure Rise for Dust Explosions in a Closed Vessel 
(Hartmann test). 

In the United Kingdom dust explosibility testing is done 
at the Fire Research Station (FRS), Borehamwood, and the 
test scheme covers the explosibility characteristics listed 
above. These tests have been described by K.N. Palmer 
(1973a), Raftery (1975 FRS Fire Res. Tech. Pap. 21) and 
Field (1982). 

Dust explosibility classification is performed using the 
vertical tube, the horizontal tube and the inflammator 
apparatus. The dust is classed as explosible if a positive 
result is obtained in any one of the three types of test. The 
minimum explosive concentration is measured in the ver¬ 
tical tube apparatus, the minimum ignition temperature in 
a modified form of the Godbert-Greenwald furnace and 
the minimum ignition energy in a modified form of the 
vertical tube apparatus. 

The maximum permissible oxygen concentration to 
avoid ignition used to be measured in the Godbert- 
Greenwald furnace but is now measured in the vertical tube 
apparatus at ambient temperature. The dust is dispersed 
by a blast of the reduced oxygen mixture. The ignition 


source is a hot coil or spark igniter. Any propagation of 
flame is observed. 

The explosion pressure parameters are obtained by mea¬ 
suring the pressure-time profile in a stronger form of the 
vertical tube apparatus. A typical pressure-time curve, 
given by K.N. Palmer (1973a), is shown in Figure 17.114. The 
pressure pi is caused by the entry of dispersing air into the 
vessel. The maximum explosion pressure p max is normally 
calculated as 


Pmax = p2 ~Pl 
An alternative definition is 


[17.44.1] 


[17.44.2] 


where p max is the maximum explosion pressure, p 0 is the 
atmospheric pressure, pi is the small initial pressure rise 
andp 2 is the pressure defined in Figure 17.114. 

Since pi is usually about 40 kPa, the values of p max 
calculated from Equation 17.44.2 differ by about 40% from 
those calculated from Equation 17.44.1. In using values of 
maximum explosion pressure given in the literature, care 
should be taken to check the definition used. 

The maximum rate of pressure rise (dP/df) max is deter¬ 
mined from the maximum slope of the pressure rise curve 
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(a) 

'Perspex' combustion 



operated valve 



source 

Figure 17.113 Dust explosibility characteristics - Bureau of Mines test apparatus (Cross and Farrer, 1982): 

(a) Hartmann vertical tube apparatus; (b) horizontal tube apparatus; (c) inflammator apparatus; (d) Godbert-Greenwald 
furnace (Courtesy of Plenum Publishing Corporation) 


a/b and the average rate of pressure rise (dP/df) av is calcu¬ 
lated as (p2-pdl(t 2 -td. 

Another important dust explosibility test scheme is that 
developed in Switzerland by Bartknecht. Accounts are 
given by Bartknecht (1981a) and Field (1982). Various 
workers have shown that the Hartmann vertical tube test 
involves wall effects and gives less than ideal dust disper¬ 
sion. In this scheme, therefore, basic test for dust explosi¬ 
bility is performed in a 20 1 spherical vessel, shown in 


Figure 17.115. This test is an alternative to the Hartmann 
vertical tube test in the BM scheme. 

In the 201 sphere test the dust is injected into the sphere 
from a separate container. The ignition source is located in 
the centre of the sphere and is usually a chemical igniter 
with an ignition energy of 10 kj. A standard time delay is 
used between injection and ignition. 

The 20 1 sphere test is used, like the Hartmann vertical 
tube, for both qualitative and quantitative determinations. 
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Figure 17.114 Dust explosibility characteristics: 
explosion pressure curve in a vertical tube apparatus 
(K.N. Palmer, 1973a) (Reproduced with permission from 
Dust Explosions and Fires by K.N. Palmer, 1973, 
Chapman and Hall) 



Figure 17.115 Dust explosibility characteristics: 201 
sphere test apparatus (Field, 1982; reproduced by per¬ 
mission of Elsevier Science Publishers) 


It is used both to determine whether a dust is explosible and 
to measure the maximum explosion pressure and the max¬ 
imum rate of pressure rise. 

Use is also made of a 1 m 3 sphere as an alternative to the 
201 sphere. 


The general approach taken in this scheme is to use these 
spheres to determine also the other explosibility character¬ 
istics. Thus, the spheres are used to determine the mini¬ 
mum explosible concentration and the minimum ignition 
energy. 

The analysis of the results is similar to that used for gas 
explosions. The cube root law is written in the form 

(f) m ax Fl/3=i?St [17.44.3] 

where K st is the dust explosibility constant (or K st value), P 
is the absolute pressure, t is the time and V is the volume 
of the vessel. The K st value is the basis of the dust explo¬ 
sibility classification and is a measure of the maximum 
rate of pressure rise. It corresponds to theff G value for gases. 

Another dust explosibility test scheme is that developed 
by Eckhoff at the Christian Michelsen Institute (CMI) in 
Norway. An account is given by Field (1982). Eckhoff has 
shown that the minimum ignition energy obtained in a test 
apparatus depends critically on the ignition source used. 
He has developed for this test an ignition source with a 
long duration spark which is a particularly efficient igniter 
for dusts. 

Dust explosibility testing in Germany is performed by 
the Bundesanstalt fur Materialprufing (BAM). Accounts 
of the test scheme have been given by Leuschke (1966) 
and Field (1982). For dust explosibility use has been made 
of the vertical tube and inflammator types of apparatus, 
but increasing use is made of the 20 1 and 1 m 3 spheres. 
Other parameters such as minimum explosive concentra¬ 
tion and minimum ignition energy are determined in 
relatively large (~1 m 3 ) vessels. 

Turning to the background, and interpretation, of these 
various tests, the two main apparatus for dust explosibility 
testing are the Hartmann vertical tube and the 201 sphere. 
The Hartmann tube is liable not to give uniform conditions 
for dust dispersion and turbulence. Further, it is subject to 
wall effects. After initial spherical expansion the flame 
travels as two fronts up and down the tube. These condi¬ 
tions give a lower rate of combustion and of pressure rise. 
Consequently, the strength of the pressure rise in the 
Hartmann bomb is less than that in the 201 sphere. 

These problems are largely overcome by the use of a 
sufficiently large spherical test vessel. The two principal 
vessels adopted are 201 and 1 m 3 spheres. It has been shown 
that the former is close to the critical size below which 
effects of vessel size occur and above which they do not. 
This is illustrated in Figure 17.116. 

A large amount of the earlier work on dust explosibility 
was done at the Bureau of Mines using the Hartmann 
apparatus. Much recent work has been done using the 201 
vessel. Moreover, methods have been developed for dust 
explosion venting which depend on experimental data for 
one or other apparatus. It is therefore of some interest to be 
able to relate the results obtained in one apparatus to those 
obtained in the other. Unfortunately, the results often do 
not agree and may even give different rankings. 

The problem of relating results for the two methods 
has been examined by Field and Abrahamsen (1981 BRE 
N81/81). They conclude that there is no simple relation, 
although Field (1982) does quote the table given in NFPA 68: 
1978 relating the dust class to the maximum rate of pressure 
rise in the Hartmann apparatus; this relation is given below. 
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Surface/volume ratio (cm 2 /cm 3 ) 


Figure 17.116 Dust explosibility characteristics: effect of 
test vessel size on K st value (Bartknecht, 1981a) 
(Courtesy of Springer-Verlag) 


The furnace apparatus for the determination of the 
minimum ignition temperature gives a relatively short 
residence time. Cross and Farrer comment that a lower 
minimum ignition temperature may be possible if the dust 
suspension is held at an elevated temperature for a pro¬ 
longed period. 

With regard to the minimum ignition energy, it has 
gradually become clear that the Hartmann vertical tube 
has a number of deficiencies. The test appears to over¬ 
estimate the minimum ignition energy by a factor of 
between 2 and 5, and is therefore not conservative. 

The ignition source in the Hartmann vertical tube test is 
a capacitive spark igniter. This has two disadvantages. One 
is that the spark energy tends to be less than the theoretical 
energy (V2 CV z ) due mainly to loss in the transformer. The 
other is that it is not possible to control the duration of the 
spark, which is a significant variable. 

An alternative igniter is the direct capacitive spark, 
which uses a circuit without a transformer, and the induc¬ 
tive spark, developed by Eckhoff. Both these igniters give 
much lower values of the minimum ignition energy than 
the Hartmann apparatus. Thus, the Hartmann apparatus, 
the direct capacitance and Eckhoff igniters give the value 
of the minimum ignition energy of wheat dust as 40,25 and 
7 mj and that of fine aluminium powder as 1—15, 7.5 and 
1 mj, respectively. 

All early data on minimum ignition energy are likely 
to have been determined using the Hartmann vertical 
tube test. 

The maximum oxygen concentration to prevent ignition 
was originally measured, as stated above, using the 
furnace test, but since the operating temperature of the 
furnace is high and since this concentration is a function of 
temperature, the values obtained were excessively low. In 
the United Kingdom the measurement is now made using 


the vertical tube apparatus at ambient temperature. Typical 
values of the maximum oxygen concentration obtained 
using the furnace test are 4—7% compared with 10—15% 
using the vertical tube test. 

17.44.4 Dust explosibility classification 

In the United Kingdom the dust explosibility classification 
used over a number of years is: 

Group A: Dusts which ignited and propagated flame in 
the test apparatus. 

Group B: Dusts which did not propagate flame in the test 
apparatus. 

Tests are made using all three types of apparatus described, 
and the dust is classified as Group A if flame propagation 
occurs in any one apparatus. 

Group A dusts should be regarded as capable of causing 
a dust explosion. Group B dusts are non-explosible, but 
can burn. 

The classification into Groups A and B applies only to 
dust dispersions at near atmospheric temperature. At 
higher temperatures some dusts in Group B may be capable 
of causing a dust explosion. 

This classification system replaced an earlier scheme in 
which dusts were classified as Class I, II or III. Broadly, 
class I corresponds to Group A and Classes II and III to 
Group B. 

In the United States the NFPA classification of hazardous 
materials is Class I for gases and vapours and Class II 
for dusts. The latter are subdivided into E, metal dusts, F, 
carbonaceous dusts, and G, flour dusts. 

The Bureau of Mines has developed an index of explo¬ 
sibility which ranks dusts relative to Pittsburgh coal. The 
index of explosibility IE is the product of the explosion 
severity ES and the ignition sensitivity IS 

IE = IS x ES 

(MIT x MIE x MEC) Pc 
S " (MIT x MIE x MEC) sample 
(MEP x MRPR) Pc 
b “ (MEP x MRPR) sample 

where MEC is the minimum explosive concentration, MEP 
is the maximum explosion pressure, MIE is the minimum 
ignition energy, MIT is the minimum ignition temperature 
and MRPR is the maximum rate of pressure rise, and 
the subscripts Pc and sample denote Pittsburgh coal and 
sample. 

The index of explosibility is a relative one, and is to this 
extent less dependent on the apparatus used, but its deter¬ 
mination requires the conduct of the full range of tests. 

The K st method has already been described. The actual 
K st classification, its relationship to Hartmann bomb data 
and to some typical industrial dusts are given inTable 17.64. 

17.44.5 Minimum explosive concentration 

A dust suspension in air is usually explosible only within 
certain concentration limits. The upper concentration 
limit, however, is ill-defined. The lower limit is known as 


[17.44.4] 

[17.44.5] 

[17.44.6] 
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Table 17.64 Dust explosibility characteristics: the K st 


classification 

A Dust explosion classes 

Dust explosion 
class 

K a t (bar m/s) Explosion features 

StO 

0 No explosion 

Stl 

>0-200 Weak 

St 2 

201-300 Strong 

St 3 

>300 Very strong 

B Relation of K s , 

and Hartman bomb data b 

K st a (bar m/s) 

Hartman bomb, (dP/df) max (psi/s) 

<200 

<7300 

201-300 

7300-22000 

>300 

>22000 

C Typical dusts 

Dust explosion class 

Typical dust 

StO 

Non-explosive dust 

Stl 

Grain dust 

St 2 

Organic pigment 

St 3 

Fine metal dust 


a These figures are for a strong ignition source (10,000 J). For a weak 
ignition source (10 J) the corresponding figures are given by NFPA 
68:1978as: 0, >0-100,101-200and >200, 
b NFPA 68:1978. 

the minimum explosive concentration or the lower explo¬ 
sive limit (LEL), the two terms being interchangeable, and 
the upper as the upper explosive limit (UEL). 

It is found empirically that for a large number of dusts 
the lower explosive limit lies in the range 20-60 g/m 3 and 
the upper explosive limit in the range 2—6 kg/m 3 . 

Some progress has been made in the theoretical estima¬ 
tion of the explosive limits for dusts. 

The minimum explosive concentration decreases as 
the particle size decreases and the volatile matter content 
and oxygen concentration increase and increases as the 
moisture content and concentration of admixed inert dust 
increase. 

Dust suspensions in industrial plant are often above the 
upper limit, but it is not generally practical to use this as a 
design parameter. For design it is the minimum explosible 
concentration which is of prime interest. 

17.44.6 Minimum ignition temperature 

The minimum ignition temperature decreases as the 
particle size decreases and the volatile matter content 
and oxygen concentration increase and increases as the 
moisture content and concentration of admixed inert dust 
increase. 


17.44.7 Minimum ignition energy 

The minimum ignition energy decreases as the particle 
size decreases and the volatile matter content and oxygen 
concentration increase and increases as the moisture con¬ 
tent and concentration of admixed inert dust increase. 


17.44.8 Maximum permissible oxygen concentration 

There appears to he relatively little data on the variation of 
the maximum oxygen concentration to prevent ignition 
with the various influencing factors. As already described, 
the maximum oxygen concentration decreases as tempera¬ 
ture increases. 

17.44.9 Maximum explosion pressure 

The maximum explosion pressure increases as the particle 
size decreases, but the effect is relatively weak. There does 
not appear to be much data on the effect of the other influ¬ 
encing factors. 

17.44.10 Maximum rate of pressure rise 

The maximum rate of pressure rise increases as the particle 
size decreases and the volatile matter content and oxygen 
concentration increase and decreases as the moisture con¬ 
tent and concentration of admixed inert dust increase. 

An investigation of the relationship between the initial 
and maximum rates of pressure rise in dust explosibil¬ 
ity testing using aim 3 vessel has been described by 
Chathrathi (1994). No such relationship was found. 

17.44.11 Burning velocity 

Another parameter of interest in relation to dust explosions 
is the burning velocity. Knowledge of this parameter would 
allow the use of the large number of methods and models 
developed for gas explosions and gas explosion venting. 
The burning velocity is not the subject of standard tests, 
but some work hasbeendoneto estimate burning velocities 
of dusts. 

Maisey (1965) has used an ‘equivalent burning velocity’ 
for dust mixtures. His basic approach is to compare the 
maximum rate of pressure rise for dust mixtures with that 
obtained for gases with known burning velocity and thus to 
calibrate the dusts. 

Burgoyne (1967a, 1978) has tabulated for gases maxi¬ 
mum rates of pressure rise determined in the Hartmann 
bomb and burning velocities for gases. His data are shown 
in Table 17.65. These data have then been used by Field 
(1982) to give the relation between maximum rate of pres¬ 
sure rise in the Hartmann bomb and burning velocity 
shown in Figure 17.117. 

Nagy and Verakis (1983) have given values of the burn¬ 
ing velocity of dust mixtures obtained by applying 
Equation 17.7.77, which gives a relation between the rate of 
pressure rise and the burning velocity, to the experimental 
data on the rate of pressure rise of such mixtures deter¬ 
mined in work at the Bureau of Mines. 


Table 17.65 Dust explosibility characteristics: relation 
between maximum rate of pressure rise in Hartmann bomb 
and burning velocity (after Burgoyne, 1978) (Courtesy of 
the Society of Chemical Industry) 


Gas 

Maximum rate 
of pressure rise (bar/s) 

Maximum burning 
velocity (m/s) 

Methane 

181 

0.37 

Propane 

248 

0.46 

Ethylene 

536 

0.70 

Hydrogen 

1,276 

3.35 
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Figure 17.117 Dust explosibility characteristics: 
relationship between maximum rate of pressure rise in the 
Hartmann bomb and burning velocity (Field, 1982; 
reproduced by permission of Elsevier Science Publishers) 


17.44.12 Minimum ignition temperature of dust layer 

The minimum ignition temperature of a dust layer is a 
function both of the dust and of the thickness of the layer, 
the ignition temperature decreasing as the thickness of the 
layer increases. 

The two methods of measurement, by furnace and by hot 
plate, give results which differ by up to about 30°C. 

The layer ignition temperature decreases as the particle 
size decreases and the volatile matter content and oxygen 
concentration increase. 

In Germany, use is made of a maximum permissible sur¬ 
face temperature (MPST) for equipment on which dust 
may settle. An account of work related to this is given by 
Hensel et al. (1994). The MPST is established by determin¬ 
ing the glow temperature of the dust and substracting a 
safety margin, set at 75°C. The glow temperature is the 
temperature at which a 5 mm dust layer is ignited in a hot 
plate test. As indicated, a dust layer thicker than 5 mm may 
give a lower glow temperature. The authors describe work 
on models based on constant surface temperature and the 
alternative of constant surface heat flux, utilizing thermal 
explosion theory 


and at a gas concentration below the normal lower explo¬ 
sive limit for the gas. Another important effect is to make 
explosive a dust with a particle size large enough to keep it 
normally non-explosive. 

For such hybrid dust -gas mixtures Cardillo and Anthony 
(1978) have applied Le Chatelier’s equation in the form 



where c is the concentration (g/m 3 ) and l is the lower 
explosive limit (g/m 3 ) and subscripts d and g denote 
dust and gas, respectively. They modify this relation 
empirically to give 

~ + ^ = 0.8 [17.44.8] 

k k 

An alternative relation has been given by Pellmont (1979) as 
follows: 

[17.44.9] 

where / dh is the lower explosive limit of the dust given the 
presence of flammable gas. 

Where the hybrid mixture rises due to contamination of a 
dust by solvent, it is convenient to be able to express 
Equation 17.44.8 in terms of the mass of solvent con¬ 
taminated dust and of the mass fraction of solvent in that 
dust. Thus, following Field (1982), Equation 17.44.8 can be 
rearranged to yield 


Wsd = 


0.8/d 

1 + oji/, y-i 


[17.44.10] 


where m si is the mass concentration of solvent con¬ 
taminated dust (g/m 3 ) and p s is the mass fraction of solvent 
in that dust. 

As already mentioned, the presence of flammable gas 
also affects the other explosibility characteristics. In par¬ 
ticular, it affects the maximum rate of pressure rise and 
hence the K st value. Bartknecht gives data showing the 
effect of different concentrations of methane and propane 
on the dust explosion class of polyvinyl chloride dust. Dust 
of class St 0 changes to classes St 1,1/2,2 and 3 at methane 
concentrations of 1,3,5 and 7 %, respectively, and to classes 
1,2/3 and 3 at propane concentrations of 0.9, 2.7 and 4.5%, 
respectively. 

For hybrid mixtures the minimum ignition energy is also 
lower than that of the dust alone. 


17.44.13 Hybrid dust-gas mixtures 

If flammable gas is present in addition to the dust, the 
explosibility of the dust is enhanced. Increase in the con¬ 
centration of flammable gas results in decrease in the 
minimum explosive concentration, minimum ignition tem¬ 
perature, minimum ignition energy and increase in the 
maximum rate of pressure rise. 

The presence of flammable gas can therefore render 
explosive a dust-gas mixture at a dust concentration 
which is below the normal lower explosive limit for the dust 


17.44.14 Dust explosibility data 

There are available a number of compilations of dust 
explosibility data. Most of these data derive either from the 
work of the Bureau of Mines or from that of Donat and 
Bartknecht. 

The explosibility classification of a number of dusts is 
given in SHW 830 Dust Explosions in Factories. Classifica¬ 
tion List ofDustsThat Have BeenTested in the form ofaDust 
Cloudhy HM Factory Inspectorate (1968). 
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Compilations of data have been given by Maisey (1965), 
K.N. Palmer (1973a), Cross and Farrer (1982), Field (1982) 
and Nagy and Verakis (1983). Field gives two tables, one for 
data obtained in tests in small scale apparatus and one for 
data from large apparatus. 

Some explosibility properties of selected dusts in air are 
given in Table 17.66. 

The more modern apparatus such as the 201 vessel tends 
to yield much higher values for the maximum explosion 
pressure and the maximum rate of pressure rise. A com¬ 
parison of values is given by Nagy and Verakis (1983). 

An account of current results from dust explosibility 
testing at the BM, using the 201 vessel and covering a wide 
and representative range of dusts, has been given by 
Cashdollar (1994). 

17.44.15 Variability of dust explosibility data 

Like the data on flammability characteristics, data on dust 
explosibility exhibit considerable variability. Nagy and 
Verakis (1983) begin their account with a table of data to 
emphasize the point. Another set of data illustrating the 
data variability are those given by Cross and Farrer (1982) 
on polyethylene. 

It may be expected that the considerable progress made 
in dust explosibility testing has reduced this variability, 
but it should always be borne in mind, particularly in 
assessing data for early work. 

17.45 Dust Ignition Sources 

An account of ignition sources was given in Chapter 16 with 
particular reference to ignition of gases. The ignition 
sources for dusts are broadly similar, although there are 
certain points specific to dusts and dust-handling plant. 
The account given here is therefore relatively brief. 

Discussions of ignition for dusts are given by K.N. Palmer 
(1973a), Field (1982), Cross and Farrer (1982) and Eckhoff 
(1991). 

Some principal ignition sources for dusts include: 

(1) flames and direct heat; 

(2) hot work; 

(3) incandescent material; 

(4) hot surfaces; 

(5) electrostatic sparks; 

(6) electrical sparks; 

(7) friction sparks; 

(8) impact sparks; 

(9) self-heating; 

(10) static electricity; 

(11) lightning. 

As with gases, it is not easy to compare ignition effects. 
Different ignition sources are naturally characterized by 
different quantities such as temperature, energy and power, 
as reflected in the laboratory tests performed, so that com¬ 
parison of different ignition sources is difficult. However, 
in general terms, dusts can be ignited by low energy as well 
as high energy ignition sources. 

Ignition sources which can occur inside the plant are of 
particular importance.They include incandescent material, 
hot surfaces, sparks, self-heating and static electricity. 

Some account of the control of ignition sources for dusts 
is given in this section. A further discussion is given in 
Section 17.46. 


17.45.1 Flames and direct heat 

Incident statistics show that a large proportion of dust 
ignitions are caused by flames. A flame is a very effective 
source of ignition for dust suspensions. 

One source of flames is direct fired equipment. This 
source may be eliminated by the use of indirect heating 
using hot water or steam. If this course is adopted, the basis 
of safety should not be negated by any additional means of 
heating provided as a standby. 

17.45.2 Hot work 

Another principal ignition source for dusts is hot work 
such as welding and cutting. Again a welding flame is a 
very effective source of ignition. 

In this case it is frequently a dust layer inside equipment 
which is ignited. Such a dust layer may have an ignition 
temperature in the range 100-200°C and is readily ignited 
by hot work. Incidents occur because this hazard is not 
appreciated and the dust is not cleaned out of the equip¬ 
ment before work is started. 

17.45.3 Incandescent material 

Burning dust, or other incandescent material, is another 
important ignition source. Considerable efforts are made to 
prevent ignition by burning dust. 

Burning dust is an ignition source which can occur 
inside dust-handling equipment. One consequence of this 
is that it may travel through the plant. Another is that it 
may remain undetected. 

A direct firing system is one potential source of incan¬ 
descent particles. In direct-fired driers the air inlet is pro¬ 
tected by a fine screen to prevent ingress of such 
incandescent material. 

17.45.4 Hot surfaces 

Hot surfaces are another important ignition source. One 
type of hot surface is equipment with a hot surface such as 
a steam pipe or electric lamp. Another is overheated moving 
equipment such as a distressed bearing. 

Ignition due to a hot surface is particularly likely to 
occur with dust layers. As already mentioned, the surface 
temperature which can cause ignition of a dust layer is fre¬ 
quently no more than 100-200°C.The ignition temperature 
of a dust layer decreases as the thickness of the layer 
increases. It is frequently found in investigations of igni¬ 
tion that a dust layer has ignited at an unexpectedly low 
temperature. 

Bowes and Townshend (1962) have applied self-heating 
theory to the prediction of the temperature at which a dust 
layer is liable to ignite. 

Practical considerations should also be borne in mind. 
For example, contamination with oil may effect an appre¬ 
ciable reduction in the ignition temperature of a dust layer. 
Another factor which may lead to a lower ignition tem¬ 
perature is thermal degradation of the material. 

The dust itself may contribute to its own ignition. Dust is 
a poor conductor of heat and a layer of dust on equipment 
may reduce heat loss to atmosphere and thus cause the 
surface to be hotter than it would be otherwise. Or again, 
dust may enter a bearing and cause it to run hot. 

Hot surface ignition is a particular problem with driers 
of various types. A discussion of the problem with different 
types of drier is given by Field (1982) and detailed guidance 
is given in the IChemE Drier Guide (Reay, 1977; Abbott, 
1990). Field summarizes the general recommendations of 



Table 17.66 Some explosibility properties of selected dusts (K.N. Palmer, 1973a) (data in this table from Dust Explosions and Fires by K.N. Palmer, are 
reproduced with permission of the author and of the publishers, Chapman & Hallf 


Dust 

Minimum 

explosible 

concentration 

(g/1) 


Minimum 

ignition 

temperature 

Minimum 

ignition 

energy 

(mj) 

Maximum permissible 
oxygen concentration 
to prevent ignition 
(% v/v) 

Maximum 

explosion 

pressure 

(lbf/in. 2 ) 

Maximum 
rate of 
pressure rise 
(lbf/in. 2 s) 

Average rate 
of pressure rise 
(lbf/in. 2 s) 

Cloud (°C) Layer if C) 

Aluminium, atomized 

0.045 

650 

760 

50 

- 

84 

>20,000 

3,500 

Carbon, activated 

0.100 

660 

270 

- 

- 

92 

1,700 

- 

Cellulose acetate 

0.035 

340 


20 

5 

114 

6,500 

2,800 

Coal, 37% volatile 

0.055 

610 

170 

60 

- 

90 

2,300 

- 

Magnesium 

0.030 

560 

430 

40 

- 

116 

15,000 

- 

Nylon 

0.030 

500 

430 

20 

6 

95 

4,000 

- 

Phthalic anhydride 

0.015 

605 

Melts 

15 

11 

72 

4,200 

1,300 

Polyethylene 

0.020 

390 

- 

10 

- 

80 

7,500 

- 

Polystyrene 

0.020 

500 

500 

15 

- 

100 

7,000 

2,400 

Sawdust 


430 



- 

97 

2,000 


Sugar 

0.045 

370 

400 

30 

- 

109 

5,000 

1,600 

Sulphur 

0.035 

190 

220 

15 

- 

78 

4,700 

1,700 

Trinitrotoluene 

0.070 


— 

75 

- 

63 

2,100 

- 

Urea formaldehyde resin 

0.020 

430 

- 

34 

- 

110 

1,600 

- 

Wheat flour 

0.050 

380 

360 

50 

- 

109 

3,700 

- 

Wood flour 

0.050 

430 

- 

20 

7 

94 

8,500 

- 


Sources: All properties except average rate of pressure rise: K.N. Palmer (1973a). Average rate of pressure rise: HSE (1970 Bklt 22). 

a See text for discussion of higher values of parameters such as maximum explosion pressure and maximum rate of pressure rise obtained in modem test apparatus. 


O 

m 
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the latter to the effect that inlet temperatures should be at 
least 50°C below the minimum ignition temperature of the 
dust suspension and 20°C below that of any dust layer 
likely to form. 

Electric lamps give hot surfaces which may ignite dust 
suspensions. There are available lamps with special pro¬ 
tection for use in dusty atmospheres. Alternatively, areas 
which may contain dust suspensions, may be illuminated 
by lamps which are separated on the other side of an 
armoured glass panel. 

A number of incidents have occurred, particularly in 
silos, involving the use of wander lamps supplied by the 
mains. These should be avoided and portable battery lamps 
used instead. 

Hot surfaces may also occur as a result of distress 
in machinery such as pumps and motors. It may be neces¬ 
sary in some cases to monitor features such as bearing 
temperatures. 

17.45.5 Electrostatic sparks 

As stated in Chapter 16, there are three main types of spark 
which may serve as an ignition source: (1) electrostatic 
sparks, (2) electrical sparks, and (3) friction/impact 
sparks. The first two involve an electrical discharge, but 
the difference is that the first is a capacitive or inductive 
discharge spark and the second a spark from a voltage 
source. 

The standard minimum ignition energy tests use an 
electrostatic ignition source and are therefore most directly 
applicable to electrostatic spark ignition, but less so to elec¬ 
trical sparks. 

An electrostatic spark may occur due to a discharge from 
electrical equipment. Protection against such discharges is 
based on hazardous area classification and the associated 
safeguarding of electrical equipment. Intrinsically safe 
equipment is designed so that incendive capacitative or 
inductive discharges cannot occur. 

17.45.6 Electrical sparks 

Electrical sparks occur in the normal operation of certain 
equipment such as switches and relays and may occur in 
electrical equipment generally as a result of malfunction. 

Again, protection against electrical sparks is based on 
hazardous area classification and safeguarding. In particu¬ 
lar, flameproof equipment is used. Where dust is present 
this equipment should exclude dusts. A distinction may be 
drawn between equipment which is dust tight and excludes 
dust entirely and equipment which is dustproof and lets in 
only an insignificant amount of dust. An account of the two 
types of equipment is given by Field (1982). 

A more detailed discussion of hazardous area classi¬ 
fication and of safeguarding of electrical equipment, 
including equipment for use in dusty conditions, is given in 
Chapter 16. 

17.45.7 Friction sparks 

Another important contributor to incidents is frictional 
sparks associated with rubbing or grinding. These can 
occur in plant handling dust in several ways. The dust itself 
may block the equipment and cause overloading, leading to 
spark generation. Preventive measures include control of 
dust flow and machine overload trips. Foreign materials 
such as tramp iron can cause sparks. Removal of such 
objects can be done by magnetic or pneumatic separation. 


and is especially desirable if the material is to pass through 
a mill. Failure of equipment can also give rise to sparks. 

17.45.8 Impact sparks 

Much concern has centred around the potential of hand 
tools to create an incendive impact spark, although there is 
little evidence from incidents of single impact ignition. 

There has, however, been a good deal of work done on the 
potential of hand tools as an ignition source. Most of the 
work on this has been done on gases and an account is given 
in Chapter 16. 

As described there, the incendive potential of an impact 
such as that of a metal tool on a metal surface arises from 
the heating of that surface. In other words, the ignition 
source is not the spark itself but the heated surface. The 
problem is the transfer of the heat from the metal surface to 
the dust. 

Experimental work on impact ignition of dusts has been 
performed by Morse (n.d.), Brown (1941 BM 1C 7148) and 
N. Gibson, Lloyd and Perry (1967).The work is summarized 
by Cross and Farrer (1982) to the effect that dust ignitions 
havebeenobtained either if the dust was asensitive one, such 
as aluminium, magnesium, zinc or sulphur, or if the thermite 
reaction occurred, but no ignition of a non-sensitive dust in 
the absence of the thermite reaction has been obtained. 

17.45.9 Self-heating 

An account of self-heating was given in Chapter 16, where 
the general features and quantitative aspects where dis¬ 
cussed. Consideration here is limited to a few basic points. 

Self-heating, or spontaneous combustion, is another 
significant ignition source. 

There are a wide variety of reactions which can give rise 
to self-heating. They include not only oxidation reactions 
but reactions with water or wood. For many reactions the 
reaction rate accelerates with temperature, according to the 
Arrhenius equation. But there are also autocatalytic reac¬ 
tions which may accelerate due to production of a catalyst 
or removal of an inhibitor. Induction times may be long and 
the self-heating may be slow to start but may then proceed 
undetected for a long period. Account should also be taken 
of the effect of contaminants such as oil and of thermal 
degradation. It follows that the first step is screening of the 
dust to determine whether it is liable to self-heating. 

Control of the temperature of dust in process and in 
storage is another means of preventing self-heating. One 
aspect of this is control of hot surfaces, which may arise in 
normal operation or due to fault conditions. 

In general, situations in which there is a large mass of 
dust stored at a high initial temperature tend to present the 
greatest hazard. Dust in a pile has a high surface area and 
sufficient air circulation, both of which favour self-heating. 

Measures should be taken to avoid unintended accumu¬ 
lation of deposits of dust which could undergo self-heating. 

A situation which has frequently led to trouble is the 
discharge of hot dust from a drier into a hopper. It may 
be necessary to cool the dust prior to storage. Another 
measure which is sometimes used is to recirculate dust 
from storage through a cooling system. 

Another precaution which is taken is the monitoring of 
the temperature of dust in storage. 

17.45.10 Static electricity 

Static electricity is a further significant ignition source for 
dusts. This too has been treated in Chapter 16 so that again 
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consideration here is limited to a fewbasics. A more detailed 
discussion is given by Cross and Farrer (1982). 

In general terms, the static charge on dusts is a function 
of the work done on them. Hence, the charge tends to be a 
stronger function of the process than of the material. This 
is illustrated by the data on charges for different dust¬ 
handling processes given in Chapter 16. For sieving and 
pouring the charges are low, but for size reduction they are 
much higher. 

It is not easy to screen for situations where static elec¬ 
tricity might present a hazard in dust handling. Laboratory 
tests for this are not well developed. 

There are certain types of dust-handling plant in which 
static electricity is readily generated. These include mills, 
conveyor belts and pneumatic conveying systems. The 
hazard in such equipment should therefore be carefully 
considered. 

As with liquids, static charge can accumulate at the cen¬ 
tre of a large storage hopper; it may then be discharged 
by an earthed probe. But there is also a hazard unique to 
dusts, that of sliding of highly charged material towards an 
earthed container wall. 

Plastic surfaces such as those used in chutes may give 
rise to sparks. Bags used for transporting dusts can also 
create sparks. A detailed discussion of these is given by 
Cross and Farrer. 

An operation which has resulted in a number of incidents 
is the pouring of powder from a polyethylene bag into a 
flammable solvent. 

The human body can carry a charge sufficient to make it 
a potential ignition source. In the manual handling of 
dusts, the hazard of static electricity from the human body 
becomes significant if the dust has a minimum ignition 
energy less than 25 mj. 

As far as the human body is concerned, the main pre¬ 
caution is the use of conducting footwear or antistatic 
footwear and conductive flooring. 

If the minimum ignition energy is less than 10 mj, it is 
advisable to provide antistatic flooring and to use antistatic 
clothing and footwear. 

Factors which tend to reduce the hazard of dust explo¬ 
sions from static electricity are the relatively high mini¬ 
mum ignition energy of dusts and the tendency of dusts to 
give corona discharge. 

Measures to counter static electricity include modifica¬ 
tion of the processing conditions and of the plant. The 
reduction of static electricity by controlling the atmos¬ 
phere at a higher relative humidity is particularly rel¬ 
evant to handling dusts. 

In storage bins use may be made of earthed wire meshes 
on the wall and of earthed rods in the bulk powder. These 
do, however, have the disadvantage that if they lose their 
connection to earth, they may aggravate the situation. 
Another measure which is particularly relevant to storage 
bins is the use of passive dischargers on the material 
entering. 

17.45.11 Ignition incidents 

Some information on ignition sources in dust explosion 
incidents is given in Table 17.67. Apart from the usual pro¬ 
blem of consistency of classification, the data show that 
different studies tend to highlight different ignition 
sources. For example, the proportion of incidents attrib¬ 
uted to welding and cutting in the three sections of the table 
is 10,3 and 24.3%, respectively. 


Another important point which is illustrated particu¬ 
larly by Table 17.67(C) is the multiplicity of situations which 
can give rise to ignition. This reinforces the point often 
made that it is prudent to assume that the necessary 
attempt to eliminate all ignition sources may not be com¬ 
pletely successful. 

Further statistical data on ignition sources for dust 
explosions are given by Lunn (1992), as mentioned in 
Section 17.43. The HSE survey for 1979-88 gives the prin¬ 
cipal ignition sources as friction/mechanical failure, over¬ 
heating/spontaneous heating, flames/flaming material, 
trampmaterialandwelding/cutting,with56(18%),51(17%), 
44 (15 %), 21 (7%) and 20 (7 %) events, respectively; 83 (27 %) 
events were classified in the category ‘unknown’. In the 
BIA survey, the main ignition sources were mechanical 
sparks, smouldering clumps, mechanical heating and 
electrostatic discharge, with 26.1,11.3,8.9 and 8.7% events, 
respectively; 16% of events were classified in the category 
‘unknown’. 

17.46 Dust Explosion Prevention 

As for flammable gases, control of dust explosions may be 
approached by way of prevention or protection. 

Accounts of dust explosion prevention include those 
given in Dust Explosions in Factories (HSE, 1970 HSW Bklt 
22) (the HSE Dust Explosion Guide), Guide to Dust Explosion 
Prevention and Protection. Part 2: Ignition Prevention, Con¬ 
tainment, Inerting, Suppression and Isolation by Schofield 
and Abbott for the IChemE (1988/30) (the IChemE Dust 
Explosion Protection Guide), EPA FS 6022:1989 Explosible 
Dusts: Control of Explosions, FS 6023: 1989 Explosible 
Dusts: Elimination of Ignition Sources and NFPA 69:1992 
Explosion Prevention Systems and by K.N. Palmer 
(1973a), Bartknecht (1981a, 1989) and Eckhoff (1991). 

There are several approaches to the prevention of dust 
explosions. They include (1) use of a dust-free process, 
(2) avoidance of flammable dust suspensions, (3) elimina¬ 
tion of sources of ignition, and (4) inerting. 

17.46.1 Dust-free processes 

A fundamental solution to the dust explosion problem is to 
use a dust-free process. In particular, it may be possible 
to process the materials wet rather than dry, so that dust 
suspensions do not occur at all. This approach is in effect an 
application of the principle of inherently safer design. 
Where it is applicable, it is one of the most satisfactory 
methods. 

17.46.2 Dust control 

If flammable dust has to be handled dry, it is generally not 
possible to prevent the occurrence of dust concentrations 
above the lower explosive concentration in some parts of 
the plant. Nevertheless, much can be done to minimize the 
volume of any dust clouds formed and to reduce the prob¬ 
ability of formation. 

Where dust suspensions may occur, large volumes 
should be avoided as far as practicable. Often it may be 
appropriate to have several smaller volumes rather than 
one large one. Overdesign of a unit, such as a hopper, 
should be avoided so that it does not operate empty all 
the time. 

Situations should be avoided which encourage dust 
cloud formation such as the free fall of dust from a height 
into a hopper. 
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Table 17.67 Ignition sources for dust explosions 


A Ignition sources for primary dust explosion 3 


Ignition source 

Proportion (%) 

Welding and cutting 

10 

Friction in bucket elevator 

8.5 

Fire (other than welding) 

7.8 

Electrical 

4.3 

Lightning 

2.8 

Motors 

2.1 

Static electricity, foreign material, 
spontaneous heating, other 

4.5 

Unknown 

60 


B Ignition sources for dust explosions’ 3 

Ignition source 

All dusts 

1860-1957 

Grain elevators, 
1958-75 

Feed mitts, 
1958-75 

Total 


No. 

(%) 

No. 

(%) 

No. 

(%) 

No. 

(%) 

Foreign material 

209 

18.66 

- 

- 

16 

32.00 

225 

17.22 

Fire or flame 

179 

15.98 

11 

8.03 

6 

12.00 

196 

15.00 

Friction 

157 

14.02 

12 

8.76 

2 

4.00 

171 

13.08 

Hot sparks, overheating 

78 

6.96 

- 

- 

- 

- 

78 

5.97 

Electrical equipment 

54 

4.82 

9 

6.57 

2 

4.00 

65 

4.97 

Welding and cutting 

20 

1.79 

14 

10.22 

6 

12.00 

40 

3.03 

Static electricity 

25 

2.23 

- 

- 

- 

- 

25 

1.91 

Spontaneous combustion 

16 

1.43 

2 

1.46 

1 

2.00 

19 

1.45 

Lightning 

4 

0.36 

4 

2.92 

— 


8 

0.61 

Unknown 

378 

33.75 

85 

62.04 

17 

34.00 

480 

36.73 

Total 

1,120 

100 

137 

100 

50 

100 

1,307 

100 


C Probable ignition sources ii 

n elevator incidents 3 

Ignition source 

Number 

Proportion (%) 

Welding and cutting 

16 

24.3 

Hot bearings 

7 

10.6 

Tramp metal 

6 

9.1 

Electrical 

4 

6.0 

Explosive vapour 

2 

3.1 

Heating system 

2 

3.1 

Dust system 

2 

3.1 

Lightning 

1 

1.5 

Static electricity 

1 

1.5 

Blockage in leg 

1 

1.5 

Extraction of oil from corncake 

1 

1.5 

Switch engine on rail dump 

1 

1.5 

Choked leg 

1 

1.5 

Electrical cord in leg 

1 

1.5 

Volatile solvent escaped from 

1 

1.5 

processing of soybeans 

Grain hung up in drier 

1 

1.5 

Fan blade caused spark 


1.5 

Unknown 

17 

25.7 

Total 

66 

100 


a After Spiegelman (1981). 

b K.N. Palmer (1891a) after Jacobsen (1981). Original sources: NFPA (1957) for all dusts; Verkade and Chiotti (1987b) for grain elevator and mills. 
c After Cross and Farrer (1982). Original source: Department of Agriculture (1980). 
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Dust should be removed from suspension at as early a 
stage as process considerations permit. Thus, if dust has to 
be removed from a gas stream, it is better to do this as soon 
as practicable as the gas leaves the plant rather than to 
transfer it down long ducts to a central cleaning point. 

Buildings which contain plant handling flammable dusts 
should be designed to minimize the accumulation of dust 
deposits and to facilitate cleaning. 

Avoidance of dust suspensions depends as much on 
operation as on design. Dusts should not be allowed to acc¬ 
umulate at the gas cleaning plant, but should be removed 
regularly in accordance with the design. Buildings which 
have plant handling dust should be cleaned to prevent 
accumulation of dust deposits. 

It should be borne in mind that even if a dust suspension 
within the explosive range is not present in normal opera¬ 
tion, it may be so during start-up, shut-down or fault 
conditions. 


17.46.3 Control of ignition sources 

Measures should be taken to eliminate ignition sources 
which could give rise to a dust explosion. 

Control of ignition sources needs to be addressed both in 
the design and operation of the plant. Measures which can 
be taken in design include the location or elimination of 
direct firing and the avoidance of situations where static 
electricity can give rise to incendive sparks. 

Measures to ensure close control of operations is par¬ 
ticularly necessary for activities such as welding and cut¬ 
ting. Training to ensure that personnel understand the 
reasons for the precautions is an integral part of this. 

Good housekeeping, and particularly avoidance of 
accumulation of dust deposits, has a role to play which is 
especially important in plants handling dusts. 

Hazardous area classification provides a formal frame¬ 
work for the control of ignition sources. An account of 
hazardous area classification, including that for areas 
where combustible dusts may occur, was given in 
Chapter 16. Two points made there merit repetition. First, 
although hazardous area classification was originally con¬ 
cerned primarily with ignition by electrical sources, it 
has developed into a comprehensive system for the control 
of all ignition sources which might ignite a release outside 
the plant. Second, the effectiveness of hazardous area 
classification depends as much on operation as on design. 

However, hazardous area classification is concerned es¬ 
sentially with releases from plant rather than with ignition 
within plant. Dusts particularly are prone to ignition from 
ignition sources within the plant. It is necessary, therefore, 
to complement the measures taken by hazardous area 
classification with other measures to eliminate in-plant 
ignition sources. 

Maintenance of equipment to minimize the fault condi¬ 
tions which could constitute ignition sources is another 
significant aspect of control of ignition sources not only 
outside but inside equipment. 

The IChemE Guide gives detailed measures for the con¬ 
trol of ignition sources covering the following operations/ 
equipment: (1) size reduction, (2) pneumatic conveying, 
(3) screw conveyors, (4) drag link and mass conveyors, (5) belt 
conveyors, (6) bucket elevators, (7) storage bins and silos, 
and (8) dust filters. 

It is generally imprudent, however, to assume that an 
ignition source will not occur. 


17.46.4 Inerting 

The suspension of a flammable dust in air may be rendered 
non-explosive by the addition of inert gas. 

Guidance on inerting of dust-handling plant is given in 
the NFPA 69 and the IChemE Guide. 

The main gases used for inerting of dust-handling plant 
are nitrogen, carbon dioxide, flue gas and inert gas from a 
generator. The IChemE Guide gives guidance on the factors 
governing selection of a suitable gas. 

One factor is any hazards associated with the use of 
the gas. One such hazard is reaction with the dust: carbon 
dioxide can react violently with aluminium dust, and 
nitrogen can react at high temperature with magnesium 
dust. Carbon dioxide can also generate static electricity, as 
described in Chapter 16. 

Other relevant factors are the availability and cost of 
supply. 

In using inerting, complete replacement of oxygen by 
inert gas may be uneconomic. An alternative approach in 
such cases is to keep the oxygen content well below the 
maximum permissible oxygen concentration to prevent 
ignition. This concentration is obtained using the test 
referred to earlier. 

The IChemE Guide also cites certain rules-of-thumb 
relating the maximum permissible oxygen concentration 
for carbon dioxide C a and that for nitrogen N„: 

N 0 = C 0 - 2 


N 0 = 1.3C 0 - 6.3 

These rules are attributed to Germany and NFPA 
69:1978, respectively. 

The maximum permissible oxygen concentrations to 
prevent ignition which are reported in the literature are 
normally measured at ambient temperature. If it is pro¬ 
posed to use inerting for dust at high temperatures (say 
>100°C), the maximum permissible oxygen concentration 
to prevent ignition should be determined by tests. Likewise 
tests are called for if there is a hybrid vapour-dust 
mixture. 

With regard to the safety margin to be employed, the 
IChemE Guide suggests a minimum margin of 2 %. Thus, if 
the maximum permissible oxygen concentration to prevent 
ignition is 11%, the oxygen concentration should be kept 
below 9%. It also recommends a larger margin where there 
are large plant volumes, extended hot surfaces or high 
explosibility dusts (St 3). 

There will be a certain out-leak of inert gas from the plant 
and a certain in-leak of air, and this needs to be taken into 
account, by design measures to minimize these leaks and 
by monitoring the oxygen concentration. 

Often the plant is totally enclosed and dust is added and 
removed through valves which give only a small loss of 
inert gas. Inert gas is supplied to make up these losses. 
Where the inert gas is recycled through the plant, it is 
important to avoid the accumulation in the gas of fine 
particles which are not removed by gas cleaning equip¬ 
ment and which constitute a much increased hazard if 
ignition occurs. 

Careful design and testing of the plant is necessary to 
ensure that the concentration of oxygen is below the maxi¬ 
mum permissible oxygen concentration throughout. Dead 
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spots where there is no gas circulation should be elimi¬ 
nated, and low pressure points where air could leak in 
should be checked. Usually it is necessary to distribute the 
inert gas to a number of different points on the plant. 

The inert gas demand is liable to vary due to causes 
such as material flows in the plant, materials withdrawal, 
temperature changes and leaks. The supply of inert gas 
should be sufficient to meet peak demands. It should also 
be reliable. 

The gas should be free of moisture, rust and noxious 
gases. There should be controls to ensure a balanced supply 
to the different parts of the plant. There should be non¬ 
return valves to prevent the entry of dust into the inert gas 
system. It is usual to provide means of cleaning inert gas 
leaving the plant. 

There should be continuous monitoring of the oxygen 
content of the gas in the plant and a trip system to shut the 
plant down if the concentration rises towards a hazardous 
level. Since the gas contains dust, there may be problems in 
the measurement of the oxygen level. 

The inerting solution is particularly useful in handling 
dusts of very high explosibility (K st >600 bar/s). 

Inerting is not necessarily effective in eliminating dust 
fires. 

The IChemE Guide gives examples of the application of 
inerting to grinding and spray drying operations. 

It is also possible with dust suspensions to use inert dust 
to effect inerting. This method is utilized in certain spe¬ 
cialized applications, of which the principal example is coal 
mining. Thus, in the United Kingdom, limestone dust is 
used on the floor of mine roadways to prevent a coal dust 
explosion propagating. The use of inert diluent dusts is 
discussed in the IChemE Guide. The proportions of inert 
dust quoted as necessary to provide effective inerting are 
high, generally more than 60%. 

Inerting may be used in combination with dust explosion 
suppression or venting. This is an approach which may be 
considered where complete elimination of combustion by 
inerting is judged uneconomic. In such circumstances 
the effect of partial inerting is to reduce the strength of 
the explosion to be handled by the suppression or venting 
system. 

17.47 Dust Explosion Protection 

Accounts of dust explosion protection include those given 
in FS 6015: 1974 Explosible Dusts, Flammable Liquids and 
Gases: Explosion Suppression, theHSE Dust Explosion Guide 
(1970 HSW Bklt 22), Explosions (Bartknecht, 1981a), the 
IChemE Dust Explosion Protection Guide (1988/30), Dust 
Explosions (Bartknecht, 1989), EPA FS 6022: 1989 Explo¬ 
sible Dusts: Control of Explosions, Dust Explosions in the 
Process Industries (Eckhoff, 1991) and NFPA 69: 1992 
Explosion Prevention Systems and by KN. Palmer (1973a), 
P.E. Moore (1979b, 1981,1982b, 1984,1986,1990), J. Singh 
(1979a), Maisey (1980), Kirby (1985a), Kirby and Siwek 
(1986),P.E.MooreandBartknecht(1986),Chatrathi(1992b,c) 
and P.E. Moore and Cooper (1993). 

A relevant standard is BS 6713:1986 Explosion Protection 
Systems. 

Methods of protection against dust explosions include 
(1) explosion containment, (2) explosion isolation, (3) ex¬ 
plosion suppression, and (4) explosion venting. The first 
three methods are considered in this section and the fourth 
in the following section. 


17.47.1 Explosion containment 

The first option for dealing with a dust explosion is total 
containment. 

A general discussion of pressure containment as 
opposed to pressure relief has been given by Wilday (1991), 
as described in Chapter 12. Accounts of the containment 
method for dust explosions include those given in the 
IChemE Guide and by Bartknecht (1981a), Kirby (1985) and 
Kirby and Siwek (1986). 

In some ways containment is an attractive option, since it 
is an essentially passive method and avoids the problem of 
relief disposal. It is not usually practicable, however, to 
design the whole of a dust-handling plant so that it can 
withstand the pressures generated by dust explosions.This 
is particularly the case with large plants. Normally, it is 
preferable to use some other method of protection. Con¬ 
tainment may be practicable, however, on small scale units 
and on particular equipments. Thus, a grinding mill, for 
example, may be made strong enough to withstand a dust 
explosion. 

The maximum explosion pressure for most flammable 
gases and dusts is given by Bartknecht (1981a) as about 
7 barg. The IChemE Guide quotes for dusts the range 
7-10 barg. 

The static pressure is not, however, the sole criterion.The 
rate of pressure rise in a dust explosion is high, and the 
vessel must be able to withstand this dynamic loading. 

The IChemE Guide distinguishes two basic options for 
containment: ‘pressure resistance’ and ‘pressure shock 
resistance’. In the first the vessel is designed to withstand 
the explosion without deformation, whilst in the second 
some deformation is allowed provided the explosion is 
contained. If using this latter method an explosion occurs 
which is sufficiently severe, it may not be possible to reuse 
the vessel, but experience shows that generally the vessels 
are reusable, presumably because the explosions are not 
especially severe. 

The use of containment raises the issue of its coverage 
within pressure vessel codes. Companies using the 
technique have tended to develop their own codes. In the 
United Kingdom the matter has been considered by the BSI 
Pressure Vessel Technical Committee (PVTC) (BSI, 1986). 
The IChemE Guide summarizes its findings to the 
effect that a vessel designed to BS 5500 should have 
sufficient reserve of strength to withstand quite rapid 
rates of pressure rise up to the design pressure on a one-off 
basis. 

There are a number of engineering issues involved in 
the use of pressure vessels for containment of dust explo¬ 
sions. They include pressure piling and modes of failure, 
including brittle fracture. Such design is therefore a 
specialist matter. 

One basic principle is to use rotational symmetry and to 
avoid large flat surfaces and angular parts. 

In designing to contain a dust explosion, particular 
attention should be paid to the points at which dust is 
fed or withdrawn from the plant and to connections bet¬ 
ween units. 

An alternative to full containment is partial contain¬ 
ment. This involves the use of a stronger vessel combined 
with explosion relief. 

17.47.2 Explosion isolation 

Another option for dealing with a dust explosion is 
isolation. 
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The three basic methods of isolation are (1) automatic 
isolation, (2) automatic explosion suppression, and 
(3) material chokes. 

Taking these in turn, automatic isolation is applied to a 
pipe and involves the use of a quick acting shut-off valve. 
The general arrangement is similar to that used for flam¬ 
mable gases, as described in Section 17.11. 

Details of this type of explosion isolation are given in the 
IChemE Guide. Detection of the explosion is by means of 
pressure and/or optical sensors. The former are usually 
preferred, since an optical detector can be blinded. On the 
other hand, a pressure sensor may not detect a weak pres¬ 
sure wave. A common threshold pressure setting is 0.1 bar. 

Typically, the quick acting isolation valve is located 
about 5-10 m along the pipe from the detectors and has a 
closure time of some 25 ms. 

Bartknecht (1981a) states that rapid action barrier 
devices can be used to protect against explosions of dust 
and hybrid dust—gas mixtures, but that for dusts, rapid 
action slide valves are preferable to rapid action valves with 
moving parts in the cross-section of the pipe. 

The second type of isolation is automatic explosion 
suppression applied to a pipe. Again the general arrange¬ 
ment is similar to that used for flammable gases, as de¬ 
scribed in Section 17.11. 

The explosion is detected by instrumentation similar to 
that just described for automatic isolation. The suppressant 
barrier is located some 5-10 m from the detectors. 

Quick acting valves operate most effectively on pipes up 
to about 0.5 m in diameter. Suppressant barriers have been 
found effective in pipes up to 2.5 m in diameter. 

With both techniques the pipe should be designed to 
withstand the local pressure, given in the Guide as up to 
lObarg. 

The third type of isolation is the use of a material choke. 
This is applicable where it is necessary to have a flow of 
dust between units. A treatment of this method is given in 
theHSE Dust Explosion Guide. 

Two commonly used types are rotary valves and worm 
conveyors, as shown in Figure 17.118. A variety of other 
types are illustrated in FS 6022. 

A rotary valve, which is installed vertically and is driven 
by a motor, is generally designed to act as a dust explosion 
choke even in the absence of a head of dust above it. 

There have not been many tests of the effectiveness of 
rotary valves as dust explosion chokes. It has been found, 
however, in one test, with an explosion above the valve, 
that the explosion was transmitted by the valve unless 
arrangements were made to trip the motor within 0.5 s of 
the detection of the explosion. 

If a rotary valve is installed on the inlet of a hopper, 
there should be arrangements to prevent it from continu¬ 
ing to turn if the hopper becomes overfilled, since this 
could cause ignition by overheating the dust or overloading 
the motor. 

A worm conveyor, which may be installed horizontally, 
vertically or inclined and is driven by a motor, is an alter¬ 
native type of dust explosion choke. One turn of the helix is 
removed to prevent the choke emptying if the feed is inter¬ 
rupted. If the conveyor is mounted horizontally, a baffle 
plate is also necessary. 

The motor on a worm conveyor is rather liable to be 
overloaded and should be provided with an overload trip. 
A worm conveyor is not suitable for dusts which flow less 
freely when heated. 


Dust 

flow 



Figure 17.118 Chokes for the isolation of sections of 
dust-handling plant: (a) rotary valve and (b) worm conveyor 


Again there have been few tests on the effectiveness of 
worm conveyors. Since the residence time in a worm con¬ 
veyor is much longer than that in a rotary valve, the former 
may be expected to be more effective as a dust explosion 
choke, but smouldering dust could still pass through unless 
the motor is tripped. 

The choke should prevent the passage of the dust ex¬ 
plosion and of any burning material. There should be 
arrangements to trip the motor. Depending on the applica¬ 
tion it may be appropriate to provide inerting or suppression. 


17.47.3 Explosion suppression 

Explosion suppression is the third option. Its application to 
explosion isolation in a pipe has been described above. 
Here, consideration is given to its use against explosion in 
vessels. 

Accounts of explosion suppression include those given 
in FS 6015 and the IChemE Guide and by P.E. Moore (1979b, 
1981, 1982b, 1984, 1986, 1990), Bartknecht (1981a), 
P.E. Moore and Bartknecht (1986), Chatrathi (1992) and 
P.E. Moore and Cooper (1993). 

Also relevant is BS 6713:1986 Explosion Protection Sys¬ 
tems. Part 4: Method for Determination of Efficacy of Explo¬ 
sion Protection Systems. 

The general principle is similar to that for suppression of 
explosions of flammable gases, described in Section 17.11. 
Most published work on explosion suppression refers, 
however, to dusts, and a fuller account is given at this point. 

Design of an explosion suppression system is based on 
the maximum rate of pressure rise in the explosion. This 
parameter has been discussed in detail in Section 17.44. It 
may be characterized in terms of the dust St class. In 
applying the basic data, account should be taken of the 
features of the particular application, in the light of 
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knowledge of the factors which influence the violence of 
such an explosion. These include the initial pressure and 
turbulence and the vessel aspect ratio. 

Explosion suppression requires the use of a control sys¬ 
tem, which has several functions. These are (1) to detect the 
explosion and inject suppressant, (2) to shut-down the 
plant, and (3) to prevent restart of the plant unless it is safe 
to do so. 

Detection of the explosion is generally by means of a 
pressure sensor. Detectors are available which are robust to 
most materials, to condensation and corrosion, and to 
shock. In some cases use is made of two detectors oriented 
in different planes. Activation occurs when the pressure 
reaches its threshold value, typically of the order of 
0.05 bar. In some systems use is also made of the rate of 
pressure rise. 

The mechanisms of suppression of the explosion are 
(1) quenching, (2) free radical scavenging, (3) wetting, and 
(4) inerting. Of these the principal mechanism is quench¬ 
ing, or abstraction of heat. The contribution of free radical 
scavenging is specific to the particular explosion reaction. 
Wetting of unburned particles is applicable to liquid sup¬ 
pressants. There is also some inerting effect. 

The principal suppressants used are halons, dry pow¬ 
ders and water. The general characteristics of these have 
been outlined in Chapter 16. The halons used are princi¬ 
pally Halon 1011 (chlorobromomethane), which is effective 
but toxic, and the less toxic Halons 1211 and 1301. The dry 
powder most widely used is ammonium phosphate based. 

With regard to dry powder, the point has been made 
earlier that its effectiveness depends on complete extinc¬ 
tion of the flame in the initial discharge. Reignition, 
whether due to incomplete extinction or to hot surfaces, is 
therefore a potential problem characteristic of this type of 
suppressant. 

Another issue in the selection of suppressants is con¬ 
tamination. With halons the problem is minimal, but with 
dry powders it can be significant. Water may constitute a 
contaminant in some cases. 

The IChemE Guide gives guidance on selection of sup¬ 
pressants. The use of halons is mainly confined to dust 
class St 1, whilst dry powders are used for both St 1 and St 2. 
Water is used for hydrophilic St 1 and St 2 dusts. 

The effectiveness of suppression depends in large meas¬ 
ure on the injection system. The requirement on this is that 
it be capable of injecting a large quantity of suppressant in 
a very short time and with adequate reach to all parts of the 
space protected. An injection system should be capable of a 
high mass discharge rate, a high discharge velocity and 
hence good ‘throw’ and good angular coverage. 

The response time of the sensor to the explosion depends 
on the size of the vessel. The explosion will propagate at the 
speed of sound, giving a delay, or equalization time, of the 
order of 4 ms/m distance between the ignition source and 
the detector. The response of the suppression system is 
very rapid. The time taken for the suppressant to reach the 
flame depends on the discharge velocity, which initially is 
of the order of 40 m/s. 

Two injection devices are in common use. One is a hemi¬ 
spherical suppressor with chemical detonator installed 
inside the vessel. This type is used with a liquid sup¬ 
pressant, usually halon. It has a limited throw, about 2.5 m, 
and contains only a small quantity of suppressant. The 
time to complete discharge is about 10-30 ms. It is suitable 
for protection of smaller vessels. 


The other injection device is the high discharge rate 
(HDR) bottle, installed on the outside of the vessel and 
pressurized with nitrogen at 20-100 bar. This type is much 
more versatile, being able to handle most common sup¬ 
pressants and available in capacities from 0.003 to 0.1 m 3 . 
The time to complete discharge is about 100 ms. 

The size of vessel which can be protected by suppression 
is limited by the factors described. Over the years various 
figures have been quoted for the limiting size. The figure 
given in FS 6016: 1974 was 115 m 3 . That quoted in the 
IChemE Guide is 1000 m 3 . Relevant work is described by 
P.E. Moore (1986). 

An effective suppression system requires rapid detec¬ 
tion, rapid injection and an adequate quantity of sup¬ 
pressant. The IChemE Guide gives a number of graphs of 
the course of failed suppressions which illustrate these 
points. 

Extinction of the flame is not, however, the only 
requirement of the suppression system. Its other function 
in respect of the explosion itself is to limit the pressure 
developed. Factors affecting this pressure are the dust St 
class and the detection and injection times. 

One measure which may be taken to limit the pressure is 
the use of multiple injection points. 

BS 6713: Part 4 gives the criteria to be applied in deter¬ 
mining the safe operating regime of an explosion suppres¬ 
sion system. 

Various applications of explosion suppression are 
described in the IChemE Guide, which treats (1) mills, 
(2) bunkers, (3) mixers, (4) elevators, and (5) spray driers. 


17.48 Dust Explosion Venting 

The use of explosion venting is generally an effective and 
economic method of providing protection against dust 
explosions, and is the method normally considered. 

Dust explosion venting is dealt with in most of the pub¬ 
lications referred to at the start of Section 17.43, and par¬ 
ticularly in Dust Explosions in Factories (HSE, 1970 HSW 
Bklt 22), Dust Explosions and Fires (K.N. Palmer, 1973a), 
Dust Explosions (Field, 1982), Development and Control of 
Dust Explosions (Nagy and Verakis, 1983) and Dust Explo¬ 
sions in the Process Industries (Eckhoff, 1991). 

The set of monographs on gas and dust explosions pub¬ 
lished by the IChemE includes the following on dust 
explosion venting: A User Guide to Dust and Fume Control 
by C.R. Smith (1981) with a second edition by D.M. Muir 
(1985) and a revised second edition by Lunn (1992a) and 
Guide to Dust Explosion Prevention and Protection (the 
IChemE Dust Explosion Protection Guide), in three parts: 
Part 1, Venting by Schofield (1984) with a second edition 
by Lunn (1992b) (the IChemE Dust Explosion Venting 
Guide)', Part 2, Ignition Prevention, Containment, Inerting, 
Suppression and Isolation by Schofield and Abbott (1988) 
and Part 3, Venting of Weak Explosions and the Effect of Vent 
Ducts by Lunn (1988). 

Further guidance is given in NFPA 68:1994. Much of the 
literature refers to the earlier 1974 edition (reaffirmed 1978). 

Venting is suitable only if there is a safe discharge for the 
material vented. Preferably the plant should be in the open. 
If it is in a building, it should be possible to effect a dis¬ 
charge through a short duct. Any such duct will have an 
effect on the maximum vented pressure and the whole 
problem should therefore be considered at an early stage of 
the design. 
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The venting solution is not appropriate if the plant con¬ 
tains toxic dusts, or other associated toxic substances, 
which cannot be vented to atmosphere, or is awkwardly 
sited so that safe discharge is not possible. 

17.48.1 Dust explosion venting of vessels 

Theventing of gas explosions wasdealtwithinSectionl7.12. 
For dust explosion venting, the general approach and some 
of the methods are similar, but there are also some important 
differences. 

A dust explosion can occur only if the dust is dispersed. 
It follows, therefore, that one of the conditions for a dust 
explosion is a degree of turbulence. A gas explosion on the 
other hand may occur with a gas mixture which is initially 
quiescent. 

Another difference is that the dust cloud tends not to be 
uniform, although a high degree of turbulence tends to 
promote uniformity. 

The comments made in Section 17.12 concerning the 
definitions and units used in explosion venting of gases 
apply equally to dust explosion venting. The definitions 
and units used here are summarized in the Notation. 

17.48.2 Factors influencing dust explosions 

An account of the factors which affect dust explosibility 
was given in Section 17.44. There are in addition other fac¬ 
tors which influence the strength of an explosion of a dust 
of given explosibility. 

The maximum explosion pressure and maximum rate of 
pressure rise are affected by a number of factors. These are 
discussed by Cross and Farrer (1982), Field (1982) and Nagy 
and Verakis (1983). They include 

(1) vessel size and shape; 

(2) dust concentration; 

(3) initial pressure; 

(4) initial temperature; 

(5) initial turbulence; 

(6) ignition source; 
and the presence of 

(7) flammable gas; 

(8) inert gas or dust. 

The maximum explosion pressure is essentially independ¬ 
ent of vessel size provided heat effects are disregarded. 

Experimental measurements of maximum explosion 
pressure tend to show considerable scatter. Data given by 
Nagy and Verakis show scatter with most points lying 
within the ±15% band. 

For elongated vessels the heat loss tends to be more sig¬ 
nificant and the maximum explosion pressure less. 

The maximum rate of pressure rise is affected by vessel 
size and shape. Equation 17.7.48 shows that the maximum 
rate of pressure rise follows the cube root law and is 
inversely proportional to F 1/3 . Equation 17.7.75 shows that 
it is proportional to the surface area/volume ratio S/V. 

The dust concentration with the highest explosibility, 
as measured by the characteristics described earlier such 
as minimum ignition temperature, minimum ignition 
energy and maximum rate of pressure rise, tends to be 
several times greater than the stoichiometric concentra¬ 
tion. This contrasts with gas mixtures where the most 
explosive concentration is usually close to, though not at, 



Figure 17.119 Dust explosion pressure: effect of dust 
concentration (Bartknecht, 1981a) (Courtesy of Springer- 
Verlag) 


the stoichiometric value. The effect of dust concentration is 
illustrated in Figure 17.119. 

There is surprisingly little information on the effect of 
initial pressure. One reason may be that most plant hand¬ 
ling dusts operates close to atmospheric pressure. The 
account of the effect of this parameter given by Nagy and 
Verakis is in fact relative to gas explosions. According to 
Field, whereas in a gas explosion the maximum explosion 
pressure is proportional to the initial pressure, the effect is 
less for dust explosions. However, data given by Bartknecht 
for starch dust show maximum explosion pressure propor¬ 
tional to initial pressure for initial pressures up to 2 bara. 
The same data set shows that the maximum rate of pres¬ 
sure rise is also proportional to initial pressure for the same 
range of initial pressures. 

The initial temperature may have several effects. These 
include reduction of the mass of air available for combus¬ 
tion and reduction of the moisture content of the dust. 
The net effect of an increase in initial temperature may 
therefore be to reduce rather than increase the maximum 
explosion pressure. An increase in initial temperature 
does, however, increase the maximum rate of pressure rise 
through its effect on the combustion rate, and also through 
any reduction in moisture content. 

As already indicated, it is difficult to envisage a dust 
explosion without a degree of initial turbulence. Turbu¬ 
lence tends, however, to be non-uniform and difficult to 
measure or quantify. In general terms, an increase in 
initial turbulence will have only a weak effect on the max¬ 
imum explosion pressure, but a strong effect on the 
maximum rate of pressure rise. Situations associated with 
high turbulence include grinding operations. 

The effect of the ignition source on the strength of the 
explosion is complex and depends essentially on the nature 
as well as the strength of the ignition source. This aspect 
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was discussed in Section 17.44. In brief, some experiments 
have shown that similar K st values are obtained for ignition 
by condenser discharge with an ignition energy in the 
range 0.005-8J and by chemical detonator with an ignition 
energy of 10,000 J. 

The effects of the presence of flammable gas and/or inert 
gas or inert dust have already been described in discussing 
dust explosibility. 

17.48.3 Experimental studies 

There have been a number of experimental studies of dust 
explosion venting of vessels. Some of the principal studies 
are listed in Table 17.68. 

Early work on dust explosion relief was done at the Bureau 
of Mines by Hartmann, Cooper and Jacobsen (1950 BM RI 
4725) using corn starch and by Hartmann and Nagy (1957) 
using cellulose acetate. According to Nagy and Verakis 
(1983), the Bureau of Mines has performed some 10,000 
experiments on vented explosions.The principal enclosures 
used were 0.32,1,64 and 216 ft 3 in size, the first being cylin¬ 
drical, the second cubical and the others rectangular gal¬ 
leries. 

Schwab and Othmer (1964) carried out experiments 
using plastics and metallic stearate dusts. 

Donat (1971b) has carried out experiments in 1 and 30 m 3 
vessels on coal, organic pigment, dextrin and aluminium 
dusts. 

Bartknecht (1981a) has described experiments, includ¬ 
ing those of Donat, in a 20 1 sphere and a/m 3 sphere on a 
number of parameters for a wide variety of dusts. 

The HSE has carried out experiments on a 20 1 sphere 
and an 18.5 m 3 cylindrical vessel to investigate a number of 
features of venting, including extension of the K st method 
(Lunn, Brookes and Nicol, 1988) and the effect of vent ducts 
(Lunn, Crowhurst and Hey, 1988). 

Experimental studies of dust explosion relief of silos 
have been performed by Eckhoff and co-workers (e.g. 
Eckhoff etal., 1982,1984; Eckhoff and Fuhre, 1983; Eckhoff, 
Fuhre and Pedersen, 1986, 1987) and Radant (1982), as 
described below. 


17.48.4 Empirical methods 

In contrast to the situation with gas explosion venting there 
is a lack of empirical methods which do not rely on experi¬ 
mental data. This is not surprising in view of the difficulty 
of characterizing dust explosibility other than by test data 
and the complexity of dust explosions. 

17.48.5 Scaling methods 

The empirical approach used for dust explosions is the use 
of scaling laws validated over a wide range of experimental 
conditions. 

The three scaling methods used are similar to those used 
for gas explosion venting: the vent ratio method, the vent 
coefficient method and the K st method. 

In dust explosion venting, the traditional approach has 
been to express the venting requirement as a vent area per 
unit volume of space protection, the vent ratio approach. 
This contrasts with the approach which has developed in 
gas explosion venting where the venting requirement is 
generally expressed as a vent area per unit cross-sectional 
area of space protected, the vent coefficient approach. 

17.48.6 Vent ratio method 

The vent ratio/is defined as for gas explosions as 

f = A y /V [17.48.1] 

where A w is the vent area, / is the vent ratio and V is the 
volume of the enclosure. 

As already mentioned, a common method of character¬ 
izing the vent area required is to plot the reduced explosion 
pressure as a function of vent ratio. Such a plot for dusts 
given by Hartmann, Cooper and Jacobsen for data covering 
a range of volumes from 1 to 216 ft 3 is shown in Figure 
17.120. Numerous other plots for dusts are given by Lunn. 

Recommended values of the vent ratio have been 
given by various sources. Table 17.69 gives some values 
which have been available for some time, but which are also 
quoted by Lunn. Table 17.69(A) gives values recommended 
for volumes up to 1000 ft 3 by K.N. Palmer (1973a) on the 


Table 17.68 Dust explosion venting: some experimental studies 


Investigators 

Vessel or enclosure type 

Volume 

Dust 

Hartmann, Cooper and Jacobsen 

Galleries 

1,64, 216 ft 3 

Corn starch 

(BM 1950 RI 4275) 

Hartmann and Nagy (1957) 

Gallery 

1ft 3 

Cellulose acetate 

Schwab and Othmer (1964) 

Cylindrical chamber 

0.0461ft 3 

Plastics dusts, metallic 

Donat (1971b) 

Sphere 

lm 3 

stearate dusts 

Coal dust, dextrin, 

Eckhoff and Fuhre (1983) 

Silo 

500 m 3 

organic pigment, 
aluminium dust 

Eckhoff, Fuhre and Pedersen 

Silo 

236 m 3 

Maize starch 

(1986,1987); Eckhoff 
etal. (1988) 

Radant (1982) 

Silo 

20 m 3 


Nagy and Verakis (1983) a 

Galleries 

0.32,1,64,216 ft 3 

Various b 


a Account based essentially on earlier work at the Bureau of Mines. 

b Dusts tested comprised some 19 dusts including atomized aluminium, cellulose acetate, chromium dust, coal dust, cornstarch, magnesium 
dust, wheat starch, several plastics dusts and several flours. Not all of these were tested in each chamber. 
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basis of the Hartmann bomb maximum rate of pressure 
rise values. Table 17.69(B) gives values recommended by 
NFPA 68: 1978 without reference to dust explosibility 
measurements. 

Palmer states that dusts with a very high maximum rate 
of pressure rise (say >12,000 lb f in. 2 s) should be treated 
with particular caution. For these, venting may not be suf¬ 
ficient or even appropriate. 

17.48.7 Vent coefficient method 

The vent coefficient K is likewise defined as for gas explo¬ 


it: = A C /A W [17.48.2] 



Figure 17.120 Dust explosion venting: effect of vent ratio 
on reduced explosion pressure (Hartmann, Cooper and 
Jacobsen, 1950 BM PI 4725) 


A c = L1L2 [17.48.3] 

where A c is the area of the smallest cross-section of the 
enclosure, K is the vent coefficient and L d and L 2 are the two 
smallest dimensions of the enclosure. 

N. Gibson and Harris (1976) have shown that a vent coef¬ 
ficient K= 3 gives good agreement with Donat’s data for 
organic pigment and for St 2 dust. Their results have been 
given in Figure 17.24. 


17.48.8 K st method 

The K st method developed by Bartknecht is based on the 
cube root law given in Equation 17.44.3. The cube root law in 
terms of the maximum rate of pressure rise is 

(^) Vll3 = K ** [17.48.4] 

and in terms of the rate of pressure rise with venting 


(w) vV3 = K <* [17.48.5] 


Thus, for the same reduced pressure the vent ratio/also 
follows the cube root law: 


fV 1 ' 3 = constant [17.48.6] 

Bartknecht gives a set of nomographs for the vent area 7L V 
where 


A v m f(V, K sU P stat , P red ) [17.48.7] 

where P red is the reduced pressure and P stat the vent open¬ 
ing pressure. 


Table 17.69 Dust explosion venting: vent ratio recommendations 


A Smaller volumes (<1000 ft 3 ) (K.N. Palmer, 1973a) 

Maximum rate of pressure rise in 

Hartman bomb, (dP/dt) max (lb f /in. 2 s) 

Vent ratio (ft 2 /ft 3 ) 


<5000 

1/20 


5000-10,000 

1/15 


>10,000 

1/10 


B Large volumes (NFPA 68:1978; Lumm 1984b) 

Volume (ft 3 ) 

Other details 

Vent ratio 
(ft 2 /ft 3 ) 

1000-25,000 


1/30-1/50 

>25,000 

Small fraction obstructed, and 



Heavy reinforced concrete construction 

1/80 


Light reinforced concrete construction 

1/60-1/80 


Lightweight construction 

1/50-1/60 


Large fraction obstructed 

1/10-1/50 


a An attempt should be made to predict the location of the ignition source and the volume of the dust suspension. 
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The derivation of these nomographs has been described 
by Lunn, Brookes and Nicol (1988). The equation from 
which the nomographs are derived is that of Heinrich, 
derived in Section 17.48.13. 


Figures 17.121(a)-(c) are given in terms of the K st value. 
NFPA 68:1994 also provides nomographs in terms of the 
K st value. For the latter it gives the following equation, 
attributed to Schwab: 


7 2 / 3 7 L 1/3 (dPex/d/)p red , n 

Ci(2RT/M) 1/2 P^(P lei - P a ) 1/Z 


log A v + C = a log V + —|- 


with the following values of the constants: 


[17.48.11] 


where C d is the coefficient of discharge, M is the molecular 
weight of the vented gas, P a is the atmospheric pressure, 
P red is the reduced pressure, (dP e Jdt)p M , Vl is the maxi¬ 
mum rate of pressure rise in the test vessel, R is the uni¬ 
versal gas constant, T is the absolute temperature of the 
vented gas, V is the volume of the vessel and Vl is the 
volume of the test vessel. The derivation of this equation is 
given below. 

Bartknecht has given the correlations for dust explosion 
venting in nomograph form. His nomograph method is that 
adopted in VDI 3673: 1979 The Pressure Relief of Dust 
Explosions, NFPA 68 and the IChemE Dust Explosion Vent¬ 
ing Guide. 

The nomographs were adopted in NFPA 68: 1988, are 
given in the 1998 edition of NFPA 68 and are shown in 
Figurel7.121.Thenomographsareforahighenergy(10,000J) 
ignition source, and there is a separate nomograph for each 
value of the vent opening pressure P stat . The three values of 
P stat are 0.1,0.2 and 0.5 barg and that of P red is 0.2-2.0 barg. 

NFPA 68: 1978 gave two separate sets of nomographs, 
for strong (high energy) and weak (low energy) ignition 
sources. Only the first set is given in the later editions. 

The nomographs apply to dusts with K st < 300 bar m/s 
and with maximum explosion pressure P max up to 10 barg 
and to dusts with K st > 300 bar m/s and with _P max up to 
12 barg. 

The nomographs are valid within a limited range of 
conditions. Their use is not recommended for V > 1000 m 3 , 
K st <50 bar m/s and the values of P stat and P red just stated. 

The vent area given by the nomographs for both 
gases and dusts in a vessel of volume 1 m 3 was given in 
Figure 17.22. 

Bartknecht distinguishes between small and large ves¬ 
sels, defining the latter as V> 30 m 3 . He states that the 
nomographs tend to oversize the vent area for large 
volumes. 

An equation equivalent to the Bartknecht nomographs 
shown in Figures 17.121(a)-(c) has been given by Simpson 
(1986) and is quoted in NFPA 68:1994. It is 


A v = aF 2 / 3 A*P r c ed 

[17.48.9] 

with 


a = 0.000571 exp(2P stat ) 

[17.48.10a] 

b = 0.978 exp(-0.105P stat ) 

[17.48.10b] 

C= -0.687 exp(0.226P stat ) 

[17.48.10c] 


where the units are as follows: A v (m 2 ), K st (bar m/s), P red 
(bar), P stat (barg) and V (m 3 ). The range of validity of the 
equation is 


1 < V < 1000; 50 < K st < 600; 

0.1 < Pstat < 0.5; P stat + 0.1 < P red < 2 


Pstat 

(barg) 


C 


b 

d 

Stl 

St 2 

St 3 

0.1 

1.88854 

1.69846 

1.50821 0.67005 

0.96027 

0.2119 

0.2 

1.93133 

1.71583 

1.50115 0.67191 

1.03112 

0.3 

0.5 

1.94357 

1.69627 

1.50473 0.65925 

1.20083 0.3916 


where the units are A y (m 2 ), P red (barg), P stat (barg) and 
V (m 3 ). 

Extension and extrapolation of the nomographs is dis¬ 
cussed in NFPA 68:1994. 

The Bartknecht nomographs have been extended by 
Lunn, Brookes and Nicol (1988). The extrapolation is based 
on Equation 17.48.8. This equation does not include P sta t 
explicitly. But the experiments of Donat give values of 
(dP ex /d t)p ni V L for the three values of P stat . The authors plot 
(dP ex /df)p' 4 , Vl vs (dP/dt)p ni , Vl for the three P sta t values. 
Then, applying the cube root law (Equation 17.44.3) and 
taking V L = 1 m 3 yields 

pmi2 ' 

The values of B are 0.283,0.333 and 0.5 for values of P ?ta t 
1.1,1.2 and 1.5 bara, respectively. They take B as a function 
of P stat so that the effect of P stat enters Equation 17.48.8 via 
the term (dPex/df)^, Vl. 

The extended nomographs given by these authors are 
shown in Figure 17.122. The nomographs show extension 
down to As t = 10 bar m/s, P stat <Ll bara and P red = 
1.02 bara. The authors recommend that for 1.05 < P red <1.2 
the lower limit of P sta t be taken as P sta t < [1 + (P re d -1)/2]. 

The nomographs have been validated by tests with low 
K st dusts in a 18.5 m 3 vessel. Like the original nomographs 
they incorporate a safety factor. However, where the K st 
value is low, it is important that it be determined accurately 
and that in using the nomograph the next highest value of 
K st be used. The detailed limitations of the extended 
nomographs are discussed by the authors. 

The IChemE Dust Explosion Protection Guide Part 3 gives 
detailed guidance on the application of venting to weak 
explosions and on the effect of vent ducts. It contains a 
large number of graphs for the estimation of the reduced 
explosion pressure in vent ducts which are straight 
(Appendix 1) or have a single, sharp 45° bend (Appendix 2) 
or a single sharp 90° bend (Appendix 3). 

The 2002 edition of NFPA 68 does not offer nomographs, 
but rather plots of the following equation for vent area and 
dust explosions: 

n - R\ V 2 

A v = (8.535 x 10“ 5 )(1 + 1.75P s , a t)KstF° 75 (-^-J 

[17.48.13] 
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Maximum pressure during venting 




Maximum pressure during venting 
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Figure 17.121 Continued 
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100 10 1 0.1 1 10 100 1000 
Vent area (m 2 ) Vessel volume (m 3 ) 


Figure 17.121 Dust explosion venting: nomographs for vent area for high energy ignition source (NFPA 68: 1994). 

(a) Pstat - 0.1 barg; (b) P stat =0.2 barg; and (c) P stat =0.5 barg; see text for details and note to figure 17.25 (Reprinted with 
permission from NFPA 68 Deflagration Venting, © 1994, National Protection Association, Quincy, MA 02269) 


where A v = vent area (m 2 ), P stat = static burst pressure of 
the vent (bar), K st = deflagration index (bar m/s), 
F=volume of room (m 3 ), R=P Ie ilP mayi , P Te & = reduced 
pressure after venting (bar) and P max = maximum pressure 
of a deflagration (bar). 

For L/D values greater than 2 and less than 6, the vent 
area, A v calculated by Equation 17.48.13 is increased by 
adding the area A A as calculated from: 

AA = 1.56A V [JL - ^-| “'log - l] [17.48.14] 

where L = longest dimensions of enclosure (m), D = 2(A*/ 
7i) 1/2 and A* = cross-sectional area normal to the longi¬ 
tudinal axis of the space (m 2 ). 

The 2002 edition of NFPA 68 also treats partial volume 
explosions that apply when dust concentrations in some 
process equipment and buildings are inherently limited to 
only a fraction of the enclosure volume. When the volume 
fill fractions, X„ can be determined, the minimum required 
vent area is calculated from the following equation: 
r y _ d-i 1/2 

A v = AyoX^ 1 ' 3 l^-^l [17.48.15] 

where A vo = vent area for full volume deflagrations deter¬ 
mined from Equations 17.48.13 and 17.48.14, and the other 
terms are as used in these equations. 


17.48.9 Schwab and Othmer method 

Schwab and Othmer (1964) presented an empirical corre¬ 
lation of experimental tests performed using a Hartmann 
bomb type of apparatus of volume 1.3 1. The dusts tested 
included powders of polymers and metal stearates. They 
expressed their results in the form 



where /is the vent ratio, P Iei is the reduced pressure and S 
is a constant. 

For the rates of pressure rise, Schwab and Othmer gave 
the equations 
dP\ 5500 

df ) m „~ WM3K 

dP\ _ 2700 
dFjav^lO 2 - 443 ^ 
where (dP/df) max and (dP/df) av are the maximum and 
average rates of pressure rise (psi/s), respectively. These 
equations are equivalent to 

(fL'iW l 17 ' 4818 "' 

(s),.-iw |17 ' 4818b| 

where k av and & max are constants. 


[17.48.17a] 

[17.48.17b] 
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K s , (bar m/s) 



Figure 17.122 Dust explosion venting: nomographs for vent area extended to lower reduced pressure 
(Lunn, Brookes and Nicol, 1988): (a) P staf <1.1 bara; (b) Pst at = 1.2 bara; and (c) P s tat= 1-5 bara (Courtesy of 
Butterworth-Heinemann) 


The authors give a nomograph for the determination of 
the vent ratio/. This is shown in Figure 17.123. 

17.48.10 Runes method 

The method of Runes was described in Section 17.12. 

The Runes equation is 



where AP is the explosion overpressure and C is the Runes 
constant. 

NFPA 68: 1978 gives values of the Runes constant C in 
metric units as 6.8 for organic dusts and 10.5 for high flame 
speed metal dusts. These compare with values of 6.8 for 
propane and 10.5 for ethylene. 

NFPA 68:1994 gives a relationship similar to Equation 
17.48.16 and containing a constant C. It is described in 
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Pmax= maximum explosion pressure (psi) (enclosed vessel) 

70 60 50 40 IdfJmax lIff, 




Figure 17.123 Dust explosion venting: Schwab and Othmer nomograph for vent area (Lunn, 1984b; after Schwab 
and Othmer, 1964) (Courtesy of the Institution of Chemical Engineers) 


Section 17.14. The code gives the following value of C for 


Dust class 

C(bar 1/Z ) 

Stl 

0.026 

St 2 

0.030 

St 3 

0.051 


17.48.11 Critique of empirical methods 

A review of experimental studies comparing the predic¬ 
tions of empirical methods with experimental results is 
given by Lunn. 

Comparison of the empirical correlations for gas explo¬ 
sion venting of Cubbage and Simmonds, Rasbash, Decker, 
Dragosavic, Cubbage and Marshall and of Runes with the 
experimental work of Hartmann, Cooper and Jacobsen and 


of Donat gave generally poor agreement. The Schwab and 
Othmer method gave excellent agreement with the results 
of Hartmann, Cooper and Jacob. 

The methods considered by Lunn are primarily the vent 
ratio, vent coefficient and K st methods and the methods 
of Heinrich and Rust. He gives a set of graphs comparing 
the predictions given by these methods with the results of 
Donat for 1 and 30 m 3 spheres. One of these graphs is 
shown in Figure 17.124. The vent coefficient and vent ratio 
methods were assessed by scaling up the results on the 
smaller vessel to the larger vessel, so that predictions were 
available only for the 30 m 3 vessel. The vent ratio method 
consistently overestimated the explosion pressure. The 
vent coefficient method gave closer agreement, but tended 
to underestimate the explosion pressure. Predictions for 
the K st method were made for both sizes of vessel. For the 
1 m vessel the low ignition energy source nomographs gave 
good predictions for dusts in classes St 1-3. For the 30 m 3 
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vessel the low ignition energy source nomographs again 
gave reasonable agreement, but always tended to under¬ 
estimate the explosion pressure, sometimes substantially. 

Overall, Lunn recommends the use of the K st method. It 
generally tends to overestimate the vent area and will nor¬ 
mally give adequately sized vent areas. He points out, 
however, that the method can give underestimates, as 
shown by the work of Eckhoff on silos. 

Lunn also states that if reliable Hartman bomb data are 
available, the Schwab and Othmer method yields good 
results. 


refer to venting at reduced pressure and in volume V, 
respectively The right-hand side of Equation 17.48.20 
represents the rate of pressure increase due to the explo¬ 
sion, and the left-hand side represents the rate of pressure 
decrease due to venting. The terms are equal at dP/df= 0 
and P= P red , where P red is the absolute reduced pressure. 

The rate of pressure rise in the actual vessel is related to 
that in a test vessel by use of the cube root law 



17.48.12 Modelling of dust explosion venting 

In principle methods developed in the modelling of gas 
explosion venting given in Section 17.12 may be used for 
dust explosion venting also, but in practice there are diffi¬ 
culties. These arise mainly because the models involve 
the use of the burning velocity and a turbulence factor 
which are difficult to specify for dust explosions. There¬ 
fore, models for dust explosion venting tend to be con¬ 
structed so that they can incorporate experimentally 
measured parameters. 


where Fis the volume of the actual vessel, Fl is the volume 
of the test vessel and the subscript V L refers to the test 
vessel volume. 

The volume rate of generation of burned gas is 


F dP 
Pdf 


[17.48.22] 


17.48.13 Heinrich method 

One of the first methods to use this approach was that of 
Heinrich (1966,1974). The method is discussed by Matsuda 
and Naito (1975), Lunn (1984b) and Nicol (1988). 

Heinrich made the assumption that the condition for 
effective relief is 




where P is the absolute pressure, P ex is the pressure due to 
the explosion, f is the time and the subscripts P red and F 


VpdP 
P df 


[17.48.23] 


where p is the density of the burned mixture. 

The mass velocity of vent outflow for the isothermal case 
is given by Equation 17.12.62. Then, equating the mass rate 
of generation of burned gas given by Equation 17.48.23 to 
the mass vent outflow obtained from Equation 17.12.62 and 
utilizing Equation 17.48.21 gives for the vent area 


FW* /3 (dP ex /df) WL 

C A (2RT/M) 1/2 ljl d (P red - P a ) 1/2 


[17.48.24] 



Figure 17.124 Dust explosion venting: comparison of selected methods of vent area prediction with experimental 
results of Donat (Lunn, 1984b). The curve is Donat’s experimental results for organic pigment in a 30 m 3 vessel (Courtesy 
of the Institution of Chemical Engineers) 
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where P a is the atmospheric pressure. From this equation 
the pressures are evidently absolute pressures. 

A corresponding equation may be derived for the adia¬ 
batic case using Equation 17.12.55. 

The method requires the specification of a suitable value 
of (dP ex /df) P , Vl for use in Equation 17.48.24. In general, 
this term is a function of the maximum rate of pressure rise: 

where Kf is a constant. The values of K t recommended for 
use in Equation 17.48.25 are given in Table 17.70. 

The nomograph due to Heinrich for the estimation of 
vent areas is shown in Figure 17.125. 

As stated earlier, the Bartknecht nomograph method 
draws on this work. 


17.48.14 Palmer method 

The method given by K.N. Palmer (1974c) takes as its 
starting point experimental measurements on the maxi¬ 
mum closed explosion pressure and rate of pressure rise for 
the dust mixture. He considers two cases: a low pressure 
case where the venting pressure is close to atmospheric and 
a high pressure case. 

For the low pressure case the venting pressure is close to 
atmospheric: 


P/P 0 sa 1 [17.48.26] 

where P D is atmospheric pressure. For this case Palmer uses 
Equation 17.12.63 for the mass velocity G v of vent outflow. 
Then, utilizing relation 17.48.26 

G v » C d [2P 0 p 0 ln(P/P 0 )] 1/z [17.48.27] 

where C d is the coefficient of discharge and p Q is the density 
of the gas at atmospheric pressure. From these equations 
the pressures are evidently absolute pressures. In the 
closed vessel at the point where the rate of production of 
burned gas is at a maximum, the rate of pressure rise is (d P/ 
d/)max, the corresponding pressure is P c and the rate of 
volume production is 



He takes account of the fact that with venting, combustion 
conditions approximate to constant pressure rather than 


constant volume. By introducing the ratio of specific heats 
y, then writing 

p = Po P/P 0 p7.48.29] 

the maximum mass rate of production is 

35(2L-MT 

Then, equating this rate of mass rate of production with the 
mass vent outflow given in Equation 17.48.27 and utilizing 
the relation 


P = PoP'JPc 

and the empirical relation 





[17.48.31] 

[17.48.32] 


[17.48.33] 


where A w is the vent area and the subscript c refers to the 
point at which the maximum rate of pressure rise occurs. 
Palmer defines the density p a as the density of the 
unburned gas at P a and as that of the combustion products 
p c at P c . Equation 17.48.33 is the equation for the low pres- 


For the high pressure case the mass velocity of venting is 
given by Equation 17.12.55. Then, utilizing relation 17.48.26 
and rearranging, 



[17.48.34] 

= KP 

[17.48.35] 

with 



[17.48.36] 

Also for this case the author takes the mea 
venting as 

n mass flux of 

G v ,av=f(P-Po) 

[17.48.37] 


Table 17.70 Dust explosion venting: the Heinrich K 
parameter 


Vent opening 
pressure (bar) 

Maximum rate of 
pressure rise in 
closed vessel, 

(dP ex /d/) max , Vl (bar/s) 

K f 

1.15 

1000 

0.5 


2000 

1.0 

1.6-1.8 

1000 

0.5 


1000-2000 

0.67 


2000 

1.0 


The duration of the explosion in the closed vessel, from 
ignition to maximum pressure, is 


Pmax - Po 
(dP/df) av 


[17.48.38] 


where P max is the maximum unvented explosion pressure 
and the subscript av denotes average. Then, from Equa¬ 
tions 17.48.37 and 17.48.38 the total mass vented is 


KA V (P - P„)(P max - P„) 

2 1 XdP/d*)^ 


[17.48.39] 
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(dP/df) max V=t) (bar/s) P red (bar) 



-4 V (m 2 ) V (m 3 ) 

(c) 

Figure 17.125 Dust explosion venting: Heinrich nomographs for vent area (Lunn, 1984b; after Heinrich, 1974) (Courtesy 
of the Institution of Chemical Engineers) 


The total mass originally present was Vp c . Hence, the frac¬ 
tion of the mass remaining is 


KAy (P - P 0 )(Prnax - Po) 
2 FpeCdP/ifl^ 


[17.48.40] 


Utilizing the empirical relation 


At P max 

f»P 0 

So Equations 17.48.42 become 
1 _ 1 fL4 v P max 

P~Po~ Pmax -Po + 0.87p c (dP/d/)„ 


[17.48.43] 


[17.48.44] 


[17.48.41] 


Equation 17.48.40 gives for the fraction of mass remaining 


t—KAy 


(P-Po)(Pmax-Po) 

OWpcidP/dt)^ 


[17.48.42a] 


Equation 17.48.44 is the equation for the high pressure case. 


17.48.15 Rust method 

Another method described in Section 17.12 is that of Rust 
(1979). This method was in fact derived originally for the 
venting of dust explosions in low-strength plants. For a 
dust mixture initially at atmospheric pressure 


P 


Kyi 3 

V 


[17.48.42b] 


[17.48.45] 















7/280 EXPLOSION 




Kn = *nu 3 P max [17.48.46] 

where K 0 is an explosion parameter, P is the absolute pres¬ 
sure, /is the time, u is the velocity of the flame front, Fis the 
volume of the vessel and the subscript max denotes maxi¬ 
mum. Then, as before, the vent area is 

[17.48.47] 

where P red is the reduced pressure (gauge) and k is a con¬ 
stant. The value of k is given in Section 17.12. 

The parameter K D may be determined from the pressure 
rise in tests. Thus, differentiating Equation 17.48.48 gives 


dP _ 3gp/ 2 
d t~ V 


[17.48.48] 


17.48.16 Nagy and Verakis method 

The model given by Nagy and Verakis (1983), described in 
Section 17.12, is applicable to dust explosions. Using the 
notation given in Section 17.12, for explosion venting of a 
cylinder with an open vent, with ignition at the closed end, 
with subsonic flow and with venting of burned gas 


p red _ pt^pma/V) 
(P rcd ~ Po) V2 ~ P b 1/Z oeS u (P m - P„) 


[17.48.49] 


The left-hand side term in Equation 17.48.49 is termed the 
pressure coefficient. For dust explosions it may be meas¬ 
ured directly. 

For venting with an initially closed vent, Equation 
17.48.49 becomes 


Pred + Pv _ RT n k vl PoL(A y /V) 
PW ~P^ SS Tl /2 oiS u (P m - P 0 ) 

where AP T is the vent overpressure 
opens (lbf/in. 2 ). 


[17.48.50] 
which the vent 


than for St 2 and 3 dusts, and can be highly inaccurate in 
some cases. The Pittsburgh method requires information 
on the burning velocity and turbulence factor which are 
generally not available and is of limited application. 

For silos Lunn states that the only available method is 
that given inVDI 3673, which tends to overestimate the vent 
area. He suggests that the Rust method may also be used for 
quiescent conditions. 

In his later treatment, Lunn (1992) concentrates on the 
Bartknecht nomograph, the vent ratio and venting coeffi¬ 
cient, or if factor, methods. 

17.48.19 Venting of low-strength plants 

The maximum safe pressure for many plants handling 
dusts is 15 kPa (2 lb f /in. 2 ), and this maximum pressure is 
used in some of the design methods. Dust-handling plants 
are often constructed, however, in thin metal sheet which is 
unable to withstand pressures of more than 7 kPa (1 lb f / 
in. 2 ), even if the large flat sections of plant are provided 
with additional stiffening. 

There is some difference of practice between the United 
Kingdom and the United states on the one hand and con¬ 
tinental Europe on the other. Plant in the latter tends to be 
designed to a somewhat higher pressure rating. 

Several authors have addressed the problem of dust 
explosion venting for low-strength plant .The method given 
by Rust (1979) is explicitly intended for this application. 
The worked example given by Rust is for a filter with a 
maximum allowable pressure of 23.9 kPa (3.47 psi). 

The lowest reduced pressure for which the Bartknecht 
nomographs apply is 0.2 barg, but, as already described, 
Lunn, Brookes and Nicol (1988) have extended the nomo¬ 
graph method down to reduced pressures of 0.05 barg, or 


17.48.20 Venting phenomena 

If the vent is an open one, venting will result in the emer¬ 
gence of a flame. With a dust the flame tends to be con¬ 
siderably larger than with a gas. This is illustrated by the 
series of photographs given by Bartknecht (1981a) for gas 
and dust explosion venting. 

If the vent has a duct, there is the potential of unburned 
dust to undergo combustion, possibly resulting in over¬ 
pressure in the duct. 


17.48.17 Elongated vessels 

There is relatively little information available on the dust 
explosion venting of elongated vessels. Most treatments are 
either for compact vessels or for pipes. 


17.48.21 Vent design and details 

In general terms, the design of vents for dust explosion vent¬ 
ing and the details of the vents are similar to those used for 
gas explosion venting. Details are given in NFPA 68:2002. 


17.48.18 Critique of available methods 

The methods available for the estimation of the vent 
area for a given reduced explosion pressure have been 
reviewed by Lunn (1984b). Of the empirical methods, his 
preferred methods are the K st nomograph method and, 
where suitable data are available, the Schwab and Othmer 
method. 

The theoretical methods all rely more or less heavily on 
experimental data. Lunn finds that the Heinrich method 
gives upper limits of the reduced pressure for St 1 and 2 
dusts, but should not he used for St 3 dusts. The Palmer 
method gives good predictions for St 1 and 2 dusts, but 
tends to underestimate the reduced pressure for St 3 dusts 
in larger vessels. The Rust method is better for St 1 dusts 


17.48.22 Vent ducting effects and design 

As described in Section 17.12, the vent duct can have 
a marked effect on the maximum pressure in a vented 
explosion. 

Figurel7.126givenbyBartknecht(1981a)showstheeffect 
of dust class, dust concentration and duct length on the 
reduced pressure in a 2 m 3 vessel with a vent area of 0.13 m 3 . 

The general recommendations given by Bartknecht for 
vent ducts apply to gases and dusts. The vent duct should 
be straight, as short as practicable and preferably cylin¬ 
drical. It should have the same pressure rating as the vessel. 
Since detonations may develop in pipes of 10—30 m in 
length, the vent duct should be limited to 10 m. Reaction 
forces should be allowed for. 
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Figure 17.126 Dust explosion venting: effect of dust explosibility and concentration and of length of duct on reduced 
pressure (Bartknecht, 1981a). Vessel volume 2 m 3 , vent area 0.13 m 2 (Courtesy of Springer-Verlag) 


A graph to determine the maximum allowable length of 
smooth, straight pipe or vessel which is closed at one end 
and vented at the other which is applicable to propane and 
to dusts is given in NFPA 69:1994 and has been given as 
Figure 17.36. If the L/D ratio is greater than that shown, 
there is a risk of detonation. There are separate curves for 
dusts with K st < 200 and K st > 200 bar m/s. 

There are available several correlations to assist in 
allowing for the effect of the vent duct. Figure 17.127 given 
by Bartknecht (1981a) gives the relationship between the 
reduced pressure with the duct and that without the duct. 
There are two lines, the parameter being the duct length. 
Figure 17.128 gives a further correlation for the same rela¬ 
tionship, but in this case the parameter is the gas velocity. 
Both correlations were given in NFPA 68: 1988, but only 
the first is retained in NFPA 68:1994. 

The correction given in the NFPA 69: 2002 edition for 
ducts of lengths 2-6 m (10-20 ft) is: 

P reA = 0.172(P red ) 1 ' 936 

where P) ei is the reduced pressure resulting with a vent 
duct (bar or psi). 

Figure 17.129, also given in NFPA 68: 1994, shows the 
maximum explosion pressure developed in deflagration of 
dust in a smooth, straight pipe open at one end with an 
initial flow velocity of less than 2 m/s. 

17.48.23 Safe discharge 

Explosion venting gives rise to three effects: a pressure 
wave and discharges of flame and unburned material. It is 
essential that all three effects be handled safely. 

The discharge of unburned dust can be particularly strong 
and can result in a large flame. With dusts the problem of the 
toxicity of the vented material can be particularly severe. 

17.48.24 Dust explosion venting of ducts and pipes 

The gas explosion venting of ducts and pipes was con¬ 
sidered in Section 17.13. There is relatively little guidance 
available on dust explosion venting of ducts and pipes. 


Early work by K.C. Brown (1951) on elevator casings 
showed a general similarity between gas explosions and 
dust explosions and the value of vents near the point of 
ignition. 

In his discussion of explosion venting of pipes, Bartknecht 
(1981a) states explicitly that the course of gas and dust 
explosions in pipes is similar and that his recommendations 
for explosion venting apply to all combustible materials. 

Lunn (1984b) recommends that in the absence of specific 
information for dusts the guidelines for gas explosion 
venting be used. 

Dust-carrying pipelines will generally require multiple 
vents. NFPA 68:1988,1994 and 2002 gives guidance on the 
spacing of vents. This is shown in Figures 17.38 and 17.39, 
which apply to propane and dusts. 

The treatment given in the IChemE Dust Explosion Vent¬ 
ing Guide is based on these graphs. 

17.48.25 Dust explosion venting of buildings 

The strength of buildings is discussed in Section 17.8. A 
pressure of 7 kPa (1 psi) is often quoted as sufficient to 
destroy a typical brick building. 

Methods for the explosion venting of buildings are dis¬ 
cussed in Section 17.14. The two principal methods for the 
gas explosion venting of buildings are those of Rasbash 
and of Runes. The Runes method is that most often men¬ 
tioned for the dust explosion venting of buildings and is 
that given for that purpose in NFPA 68:1978. The use of the 
Runes equation for the explosion venting of buildings was 
described in Section 17.14 and the values of the Runes 
constant Cfor dusts were given in Section 17.48.10. 

17.49 Dust-handling Plants 

Operations in which dusts are generated or handled include 

(1) size reduction; 

(2) conveying 

(a) manual, 

(b) mechanical, 
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P red without duct (barg) 


Figure 17.127 Dust explosion venting: effect of length of vent duct on reduced pressure (NFPA 68: 1994). See text for 
details and note to Figure 17.25 (reprinted with permission from NFPA 68 Deflagration Venting, © 1994, National Fire 
Protection Association, Quincy, MA 02269) 



Figure 17.128 Dust explosion venting: effect of velocity in vent duct on reduced pressure (NFPA 68:1988). See text for 
details and note to Figure 17.25 (reprinted with permission from NFPA 68 Deflagration Venting, © 1988, National Fire 
Protection Association, Quincy, MA 02269) 


(3) 


(4) 


(c) pneumatic; 

(d) pneumatic driers, 

separation 

(e) spray driers; 

(a) settling chambers, 

(5) screening and classifying; 

(b) cyclones, 

(6) mixing and blending; 

(c) filters, 

(7) storage; 

(d) scrubbers, 

(8) packing; 

(e) electrostatic precipitators; 
driers 

(9) fired heaters. 

(a) tray driers, 

In many cases, there is a choice of different methods of 

(b) rotary driers. 

carrying out a particular operation. The hazard of a dust 

(c) fluidized bed driers, 

explosion should be a factor in selecting a suitable method. 
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Figure 17.129 Dust explosion venting: reduced explosion pressure in deflagration of dust/air mixture in a smooth, 
straight pipe or duct closed at one end (NPFA 68: 1994). See text for details and note to Figure 17.25 (reprinted with 
permission from NFPA 68 Deflagration Venting, © 1994, National Fire Protection Association, Quincy, MA 02269) 


All plants handling flammable dusts should have a 
combination of sufficient strength and explosion protec¬ 
tion to withstand a dust explosion safely. 

Some other basic principles in the design and operation 
of dust-handling plants are (1) minimization of space filled 
by dust suspensions, (2) maintenance of design operating 
conditions, (3) minimization of mechanical failure and 
overheating, (4) precautions against static electricity and 
(5) precautions against passage of burning dust. 

Some particular types of dust-handling plants, namely, 
grinding mills, conveyors, dust separators, driers and 
storages, are considered below. 

Operations involving screening and classifying or mix¬ 
ing and blending tend to create dust suspensions. Plants for 
such operations should be enclosed and preferably run 
under a slight vacuum. Precautions should be taken 
against static electricity and explosion protection should 
be provided. 

Where dusts such as pulverized coal are used as fuels for 
fired heaters or furnaces, an explosive dust suspension is 
burned under controlled conditions. As with other fuels the 
principal hazard is loss of ignition followed by reignition 
and explosion. 

Accounts of the safe design of dust-handling plants 
are given by K.N. Palmer (1973a), Bartknecht (1981a) and 
Field (1982). 

17.49.1 Grinding mills 

There is a large variety of size reduction equipment from 
jaw crushers to micronizers. In equipment which produces 
powders or dusts by size reduction, there is inevitably a real 
possibility of a dust explosion. The dust concentrations 
in a mill may be in the explosive range and the grinding 
elements in the mill, or possibly foreign bodies, may act 
as sources of ignition. 

There are various steps which can be taken to minimize 
the dust explosion hazard in a mill. The free volume should 
be kept low so as to avoid a large volume of dust of explo- 
sible concentration. Large free volumes can occur if the mill 
is oversized or the feed to the mill is too low. 


Overloading of or blockage in the mill can cause it to run 
hot and give ignition. The motor should be protected with 
an overload trip. 

In general, mills are relatively robust. Even the larger 
mills with a volume of some tens of cubic metres can be 
designed to withstand pressures up to 350 kPa (50 lb f /in. z ). 
However, explosion relief should be provided if necessary. 

Bartknecht (1981a) gives three designs for complete 
grinding mill systems, with inerting, explosion suppres¬ 
sion and explosion venting. 

17.49.2 Conveyors 

Dust may be conveyed by manual methods or by mechani¬ 
cal or pneumatic conveyors. 

Applications of manual dust handling are restricted 
largely to operations such as bagging up of dust products 
or removal of unwanted dusts in limited quantities. There 
should be good local ventilation at places where dust may 
be generated such as bagging points and there should be a 
high standard of housekeeping on the plant. 

Methods of mechanical conveying include screw and 
drag-link conveyors, belt conveyors and bucket elevators. A 
screw conveyor has minimal free volume and is an effective 
conveyor for dusts. So also is a drag-link conveyor, 
although the return leg contains free space which usually 
requires explosion protection. A belt conveyor is suitable 
for dusts only if enclosed. The free volume within the 
enclosure is likely to be larger than for a drag-link conveyor 
and the hazard correspondingly greater. If a belt conveyor 
is used, the enclosure should have explosion protection. 

All mechanical conveying methods involve the risk of 
overheating due to mechanical failure, and appropriate 
steps should be taken in design and operation to minimize 
this hazard. In addition, belt conveyors are particularly 
liable to generate static electricity, and suitable safeguards 
should be provided. 

17.49.3 Bucket elevators 

The use of a bucket elevator to convey dust involves severe 
hazards unless there are suitable safeguards. There have 
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been a number of explosions in bucket elevators and, as 
already mentioned, one of the few pieces of work on dust 
explosions in ducting is the work of K.C. Brown (1951) on 
elevator casings. Precautions for bucket elevators are dis¬ 
cussed by K.N. Palmer (1973a) and Field (1982). 

A bucket elevator tends to have a dust suspension vir¬ 
tually continuously, particularly at the boot and the head. 
The ignition source for an explosion is commonly a slip¬ 
ping belt or impact of the buckets on the casing. 

Features of design to minimize the hazard include the 
provision of separate delivery and return legs, making the 
casing dust tight and able to contain fire, provision of iso¬ 
lation chokes at both ends and location of the elevator out¬ 
side the building. 

Explosion suppression may often be a suitable option, 
particularly if the elevator is inside a building. For explo¬ 
sion venting, Field recommends a vent ratio of % m 2 /m 3 
with vents at the boot and head and, if the elevator is longer 
than 6 m, vents at intervals along it. 

17.49.4 Pneumatic conveying 

There are two basic systems for pneumatic conveying 
described by K.N. Palmer (1973a). These are (1) low volume/ 
high pressure air and (2) high volume/low pressure air. The 
high pressure system uses relatively strong piping. It may 
be possible, therefore, to design it to withstand a dust 
explosion. There may be a risk, however, of erosion and 
consequent thinning of the pipe wall. The low pressure 
system utilizes weaker pipework and usually requires 
additional explosion protection such as vents. 

Field (1982) states that in most pneumatic conveying 
systems the dust concentration is normally operated well 
above the upper explosive limit, though this may not apply 
at start-up and shut-down, and that the pipework is of a 
sufficient rating to withstand the full explosion pressure. 
The application of explosion protection is therefore mainly 
to the plant connected to the conveying system. 

Precautions against ignition by static electricity or 
burning dust are particularly important in pneumatic 
conveying systems. 

Further aspects of dust explosion hazards in pneumatic 
conveying systems are described by Palmer and Field. 

17.49.5 Dust separators 

In selecting a method of separation of a dust from a gas an 
important factor as far as dust explosions are concerned is 
the free volume. A settling chamber tends to involve a 
rather large free volume and usually is not a very desirable 
method. 

Two of the main types of dust separator are dust filters 
and cyclones, which are considered below. 

For both types of separator, precautions against igni¬ 
tion by static electricity or burning dust are especially 
important. 

An alternative type of separator, in which the dust 
explosion hazard is much reduced, is the wet scrubber. 
Thus,in the United kingdom the use of wet scrubbers has 
been a statutory requirement in the grinding of magne¬ 
sium. Wet scrubbers are used mainly to remove unwanted 
materials. 

High efficiency cleaning of gases is often effected by an 
electrostatic precipitator. Although the inlet concentration 
of dust is normally below the explosive limit, mechanical 
rapping of the electrodes can create an explosive dust 


concentration. Electrostatic precipitators are not generally 
very suitable for removal of flammable dusts. 

17.49.6 Dust filters 

A widely used separation device is the bag filter. Such fil¬ 
ters may be fitted after a cyclone or on their own. An 
explosive concentration of dust is liable to arise in bag fil¬ 
ters which are cleaned by mechanical shaking and occurs 
during the cleaning operation. Again the ignition source 
may be dust ignited elsewhere. 

Precautions for dust filters are discussed by K.N. Palmer 
(1973a), Bartknecht (1981a) and Field (1982). 

Explosion suppression is an option which may have 
merit for a dust filter. For explosion venting, Field indicates 
that the volume on which the venting is based should be the 
free volume, or total volume less the volume of the filter bag 
assembly. Where the filter is lightly constructed, he states 
that the vent ratio method is suitable for smaller volumes 
(<30 m 3 ), but that the vent coefficient method is preferable 
for larger volumes, whilst where the filter is able to with¬ 
stand a reduced explosion pressure of 0.2 barg, the regular 
K a t nomograph method is suitable. He also says that there is 
evidence that the nomograph method may overestimate the 
vent area, absorption of heat by the filter bags being a 
possible factor in this. The location of the vent is important 
in the case of dust filters. For the filter configuration which 
he considers, vents on the top tend to be less effective 
probably due to the obstacle-induced turbulence as flame 
propagates through the filter assembly. His recommenda¬ 
tion is for vents located near the bottom of the rear side. 

Bartknecht gives an account with detailed design of 
several filters. 

17.49.7 Cyclones 

Another common means of separation is the cyclone. 
Explosions in plant handling dusts occur not infrequently 
at a cyclone. Often the source of ignition is not at the 
cyclone itself but dust ignited elsewhere in the plant. 

Precautions for dust cyclones are discussed by 
K.N. Palmer (1973a), Bartknecht (1981a) and Field (1982). 

In a cyclone there is a concentration gradient of dust with 
a very low concentration at the wall. At some intermediate 
point the dust concentration is in the explosive range. This 
unique pattern of dust concentration could mean that the 
usual correlations for dust explosion venting may be less 
applicable. On the other hand, the explosion pressure in a 
cyclone may well rise due to ignition elsewhere in the plant 
and in this case the normal dust pattern in the cyclone may 
be disturbed. 

For cyclones with the product offtake connected to other 
plant as in a spray drier system, Bartknecht recommends 
an isolation choke on product offtake. 

Explosion suppression is an option which can be con¬ 
sidered for cyclones. For explosion venting, Field refers to 
work by K.N. Palmer (1974b) and Tonkin and Berlemont 
(1972 FRS Fire Res. Note 942) showing that the vent ratio 
method tends to overestimate the vent area. Cyclones are 
often of too light a construction for the regular K st nomo¬ 
graph method to be applicable. The vent is most effective if 
located on the top of the cyclone. 

17.49.8 Driers 

There are a large number of different types of drier, but 
there are certain common hazards. These types include 
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(1) tray driers, (2) rotary driers, (3) fluidized bed 
driers,(4) pneumatic driers, and (5) spray driers. 

Precautions for driers are discussed by K.N. Palmer 
(1973a), Bartknecht (1981a) and Field (1982). The IChemE 
Drier Guide also gives detailed guidance. 

In many driers, the liquid driven off is itself a flammable 
vapour and constitutes an explosion hazard. The main 
method of prevention is to use ventilation to keep the 
vapour concentration well below its lower flammability 
limit. 

Direct firing of driers creates a strong ignition source 
and for this reason indirect heating is often used instead. 

Other hazards in driers arise if the plant is not operated 
according to design conditions. Thus, if the feed rate is low, 
the material may become overheated and may ignite. 
Overheating may also occur if material from a previous 
batch is exposed to hot air on start-up. Similar hazardous 
conditions can arise in shut-down or emergency situations. 
The control of drier operating conditions is therefore par¬ 
ticularly important. 

The hot product from a drier is another hazard. It may be 
necessary to cool it before storage if self-heating is to be 
avoided. 

17.49.9 Fluidized bed driers 

Fluidized bed driers may be batch or continuous. Accord¬ 
ing to Bartknecht, incidents in such driers have mainly 
been with hybrid dust-gas mixtures. 

The explosion suppression option is more difficult to 
apply to fluidized bed driers, because it is hampered by the 
high air velocities. Nevertheless, Bartknecht gives an 
account of its application. 

For explosion venting, Field states that any of the three 
main methods, vent ratio, vent coefficient or regular K st 


nomograph, may be used. He gives details of the optimum 
vent location. 

Bartknecht gives an account with detailed design of sev¬ 
eral fluidized bed driers, including explosion suppression 
and explosion venting. Figure 17.130 shows one of his graphs 
for explosion venting, illustrating the effect of locating the 
explosion relief on the clean side of the dust filters. 

17.49.10 Spray driers 

In spray driers the dust concentration is usually calculated 
to be below the lower explosive limit, but air currents may 
create higher concentrations. Deposits of dried product 
may build up and may undergo thermal degradation or 
become contaminated with oil so that the ignition 
temperature is lowered. Ignition may occur if the air inlet 
temperature is too high or if part of the high speed atomizer 
breaks off and causes an incendive spark. 

Precautions for spray driers are discussed by Bartknecht 
(1981a) and Field (1982). 

These precautions include ensuring that the air inlet 
temperature is below the decomposition temperature of the 
product and that the product does not form layers which 
may undergo thermal degradation. 

The atomizer should be regularly serviced. Other pre¬ 
cautions against its acting as an ignition source are to 
monitor its vibration and the bearing temperature as well 
as the power consumption of its motor. 

Inerting, explosion suppression and explosion venting 
are all options which may be used with spray driers. 

Field states that if flammable solvents are present, the 
only suitable option is inerting. Explosion suppression is a 
suitable option for smaller volumes but he does not recom¬ 
mend it for larger ones. For explosion venting, he states that 
any of the three main methods, vent ratio, vent coefficient 




Relief area /4 V (m 2 ): transformed to V - 1 m 3 

Figure 17.130 Dust explosion venting: vent area requirement for a fluid bed driver (Bartknecht, 1981a) (Courtesy 
of Springer-Verlag) 
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or regular K st nomograph, may be used, although the vent 
ratio method overestimates the vent area for large volumes. 

Bartknecht gives detailed designs for three complete 
spray drier systems, based on inerting, explosion sup¬ 
pression and explosion venting. 

In the particular design which he considers for the sec¬ 
ond of these options, explosion suppression is used in the 
drier and the cyclones and an extinguishing barrier in the 
pipe between the drier and the cyclones. All three are acti¬ 
vated independently, and activation of anyone causes shut¬ 
down. He states that design of an explosion suppression 
system for a volume >100 m 3 is a specialist matter. 

In the design based on explosion venting, he considers 
first driers with H/D < 5. He states that for dusts a vent area 
may be used which is less than that given by the K st nomo¬ 
graph method, since this tends to oversize the vent area for 
larger volumes. Moreover, the drier will never be full of an 
explosive dust suspension. For driers processing material 
with flammable solvents and thus containing hybrid 
dust-gas mixtures the nomograph for propane should be 
used, but the design is a specialist matter. For driers with 
H/D > 5 the vent area should be the whole roof. 

For explosion venting, Bartknecht uses rapid action 
valves for isolation between the drier and the air heater and 
between the drier and the cyclones, and a rotary choke 
valve at the product offtake. Likewise, he gives isolation 
arrangements for the explosion suppression case. 

He also emphasizes that in the event of an explosion there 
should be automatic shut-down and water sprinklers 
should be available to deal with the resultant dust fire. 

17.49.11 Silos 

As already described, a number of the principal dust 
explosions have occurred in silos. In a silo it is virtually 
inevitable that a dust suspension will exist in at least part 
of the space. 

Precautions for silos are discussed by Bartknecht 
(1981a), Field (1982) and Eckhoff (1991). 

A silo should he provided with feed arrangements which 
minimize the formation of dust suspensions. A silo may be 
filled by letting the dust fall from the roof or by introducing 
it down a vertical feeder duct so that it flows sideways onto 
the existing dust pile, the latter minimizing dust cloud 
formation. 

The explosion suppression option is applicable to silos. 
Field states that it can be used effectively for volumes up to 
60 m 3 , but that beyond this careful consideration needs to 
be given to the dust explosibility and to the ability of the 
suppressant to fill the volume rapidly 

For explosion venting, Field states that the vent coeffi¬ 
cient and regular K ?t nomograph methods are applicable, 
but that the vent ratio method overestimates the vent area, 
and that none of the methods works well for H/D ratios 
greater than 3—5. 

The explosion venting of silos has been considered in 
detail by Bartknecht. He treats it as an example of an 
elongated vessel and applies to it the principles which 
govern the venting of a pipe at one end. As with that case, 
the vent needs to be along the axis and to utilize the whole 
cross-sectional area of the end, which in this instance is 
the roof. 

Bartknecht considers in particular the allowable height 
of the silo. This is essentially governed hy two principles. 
One is that the cross-sectional area defines the maximum 
volume which can be vented and the other is that the 


maximum volume should be limited to 1000 m 3 . Figures 
17.131 and 17.132 illustrate the limits on the allowable height 
of a silo based on these principles. 

17.49.12 Grain elevators 

Other storages which have been the site of some of the main 
dust explosions are grain elevators. In consequence, there 
have been a number of studies of grain elevator explosions 
and of the precautions which should be taken. 

In many incidents, poor standards of training, house¬ 
keeping and maintenance appear to have been major 
contributors. 

The ignition sources identified in grain elevator explo¬ 
sions were given in Section 17.45. 

Two of the principal components of grain elevators are 
the silos and the bucket elevator, both of which have just 
been discussed. Another main component is the horizontal 
conveyor, which conveys grain from the receiving point to 
the boot of the bucket elevator and from the offtakes of the 
silos to the loading point. 

17.50 Dust Fires 

It is convenient to deal at this point with dust fires. An 
account of dust fires is given by K.N. Palmer (1973a). 

Dust fires occur in dust deposits and are of two types - 
laming and smouldering fires. 

The type of fire that is produced by a particular dust is 
not predictable and can only be determined by experiment, 
but some general guidelines can be given. A flame can be 
sustained only if sufficient volatile matter is evolved from 
the dust. If the dust is able to smoulder, the volatiles may be 
produced by this smouldering, otherwise they must be 
generated by the flame itself. 

Characteristics of the dust which particularly affect this 
combustion process are volatile content, melting point and 
particle size. 

The flame may spread across the surface of the dust or 
may burn down from the surface into the dust layer. If the 
flame is able to release sufficient volatiles, it may travel 
quite rapidly across the surface. Otherwise, its propagation 
over the surface is determined by the smouldering rate. 
Smouldering combustion may continue into the dust layer 
with the flame burning on the surface. 

If the particle size of the dust is sufficiently large, the 
flame may propagate through the dust layer. In this case 
combustion is likely to be rather rapid. 

On the other hand, a large particle size tends to give a low 
smouldering rate. In the limit the particle size may be too 
great for smouldering to persist. 

Another feature which favours rapid combustion is an 
air flow caused by ventilation or by convection currents, 
including those arising from the combustion process itself. 

If a smouldering fire starts below the surface of the dust 
and works its way up, it may burst into flame and spread 
more rapidly when it reaches the surface. 

Smouldering rates are commonly determined by meas¬ 
uring the rate of travel of smouldering combustion along a 
‘dust’ train of stated dimensions. Typical smouldering rates 
for dusts are about 5 cm/h for wood and about 20 cm/h for 
coal with a bed depth of 1 cm. An extreme value is given by 
magnesium dust with a smouldering rate of 14 m/h. 

There is a minimum depth of dust layer for sustained 
smouldering. Minimum depths typically range from 
approximately 2 mm upwards. 
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f, 1981a). The figure is based on 


Detection of dust fires is difficult. There are no special 
types of detector for dust fires. The effects given by 
smouldering are usually weak and difficult to detect 
with the sensors normally used in automatic fire protec¬ 
tion systems. It may be appropriate, however, to monitor 
the temperature in the interior of large dust piles with 
thermocouples. 

A dust deposit can undergo smouldering for a long period. 
It is not unknown for large dust piles to smoulder for a matter 
of years. Both air access and heat loss are restricted so that 
combustion is very slow, but is sustained. Such smouldering 
may not give rise to readily detectable effects. In particular, 
there may be no smoke or smell from the burning. 

This delay between ignition and outbreak of flaming 
can create hazards. Fire may break out unexpectedly in a 
factory shut-down overnight or at the weekend, or the cargo 
of a ship may be discovered to be on fire when it is being 
unloaded. 

Hazards of dust fires include those of a dust explosion 
resulting from the formation and ignition of a dust sus¬ 
pension, of the ignition of other flammables and of the 
evolution of toxic combustion products. 


In general, dust deposits around the factory should be 
minimized by good housekeeping. As already indicated, 
the dust layer does not need to be very thick to sustain 
smouldering. 

Extinction of the dust fire may be effected by letting the 
fire burn itself out, by applying extinguishing agents or by 
starving the fire of oxygen. 

Whichever approach is used, however, it is essential to 
avoid disturbing the dust in such a way as to allow a sus¬ 
pension to form and ignite. 

Water is the usual extinguishing agent and is suitable 
unless it reacts with the dust or electrical equipment is 
involved. The water should not be applied, however, as a 
high pressure jet, which could raise a dust cloud, but as 
a low pressure spray which simply dampens the dust 
deposit. The penetration of this water into the dust layer 
can be assisted by the addition of about 2% of a wetting 
agent such as a detergent. 

The use of fire fighting foam generally offers little 
advantage over water. Foam has the additional capability of 
cutting off air to the fire, but this is unlikely to have much 
effect in a slow smouldering combustion which requires very 
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Dust explosion class St 1 Dust explosion class St 2 Dust explosion class St 3 

K s , 200 bar m/s 200 bar m/s < K st s 300 bar m/s K s , > 300 bar m/s 



Figure 17.132 Dust explosion venting: allowable height of silo - 2 (Bartknecht, 1981a). The figure is based on the 
use of Bartknecht nomographs, P s tat— 0.1 bar; P re a= 0.4 bar (Courtesy of Springer-Verlag) 


little air anyway. Since the foam is largely water, it should 
not be used in applications where water is unsuitable. 

The other non-gaseous fire fighting agents are of limited 
application. Dry powder is appropriate if the dust is one 
which reacts with water, as do some metal dusts. Vaporizing 
liquids are appropriate if electrical equipment is involved, 
but should not be used on reactive metal dusts. 

Inert gases may be used as extinguishing agents and can 
be effective if the dust is held in a relatively gas tight con¬ 
tainer such as a hopper or a ship’s hold. It is necessary, 
however, not only to cut off the supply of oxygen, but also to 
effect sufficient cooling to prevent reignition when the air 
supply is restored. Thus, the inerting may need to be 
maintained for a long period. 

In some situations, however, the fire cannot be extin¬ 
guished sufficiently rapidly by fire extinguishing agents 
alone. A smouldering fire in a ship’s hold, for example, could 
immobilize the whole ship. In such cases it may be necessary 
to dig the material out.This involves a numberof hazards and 
suitable precautions should be taken against them. The 
operations should be conducted in such a way as not to 
raise a dust cloud.The atmosphere should be monitored and 
any necessary breathing equipment worn. The danger of 
subsidence of the dust due to the creation of burnt-out 
hollows beneath the surface should be allowed for. 

In other instances a more gradual extinction of the fire is 
acceptable. This might be the case, for example, with a fire 
smouldering inside a tip. The methods used in such situa¬ 
tions are generally based on excluding air and include 
covering the heap with a layer of non-combustible such as 
earth or pumping a limestone slurry into fissures in the 
heap. A hazard in the first method is subsidence due to 
hollows, and in the second, movement in the tip due to the 
slurry. Alternatively, but generally as a last resort, the heap 
may be dug out. 


17.51 Explosion Hazard 

The types of explosion typical of the process industries are 
those described above. The hazard of a large industrial 
explosion may be assessed by consideration of assumed 
scenarios using appropriate hazard and effects models or of 
the historical record of explosions and their effects. 


17.51.1 Historical experience 

A large proportion of the major accidents which have occur¬ 
red in the process industries have involved explosions. In 
particular, explosions account for the preponderance of 
cases where there has been substantial loss of life. 

A classification of process industries explosions has 
been given in Section 17.1. The main headings are (1) physi¬ 
cal explosions, (2) condensed phase explosions, (3) VCEs, 

(4) BLEVEs, (5) confined explosions with reaction, 

(6) vapour escape into, and explosions in, buildings and 

(7) dust explosions. Some principal condensed phase 
explosions have been listed in Table 17.24, VCEs in 
Table 17.30, BLEVEs in Table 17.37 and dust explosion 
in Table 17.63. A fuller listing of all types of explosion 
with references is given in Table A1.2. The statistical 
features have been given in Chapter 2 and Section 17.1. 

The process industries have suffered major explosions in 
virtually all the categories of the classification in Section 
17.1. Considering these in turn, and starting with physical 
explosions, these may occur as (1) a mechanical failure, 
(2) overpressure, (3) underpressure, (4) overtemperature or 

(5) undertemperature of the system. The essential distinc¬ 
tion is that in the first case the failure occurs whilst the 
process conditions are within the design envelope, so that 
the failure is due to a mechanical defect, and in the other 
cases it occurs because the process conditions have been 
taken outside the design envelope. 
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A failure of a pressure system due to mechanical defects 
occurred in 1984 at a refinery at Romeoville, Illinois, where 
a 55 ft high x 8 ft diameter absorption column suffered 
massive failure such that most of the 201 vessels rocketed 
about 3500 ft and struck and toppled a 138 kV power 
transmission tower (Case History Alll). 

Overpressure of a pressure system is exemplified by the 
explosion at Grangemouth in Britain in 1987 when gas 
‘breakthrough’ caused the disintegration of a 30 ft high x 
10 ft diameter low pressure separator (Case History A116). 
One 31 missile from this explosion travelled 3300 ft. 

Condensed phase explosions in the process industries 
include explosions of (1) high explosives, (2) ammonium 
nitrate, (3) organic peroxides, and (4) sodium chlorate. An 
account of condensed phase explosions has been given in 
Section 17.26. 

With regard to high explosives, the explosion of the 
munitions ship Mont Blanc at Halifax, Nova Scotia, in 1917 
destroyed a large part of the town and killed 1963 people 
(Case History A3). An explosion of TNT at a munitions 
factory in Silvertown, London, in 1917 caused 69 deaths 
(Case History A4). 

Many of the large explosions in the early years of the 
chemical industry involved ammonium nitrate (AN). The 
AN explosion at Oppau, Germany, in 1921 destroyed hun¬ 
dreds of houses and killed 561 people (Case History A5). 

The explosions at Texas City in 1947 occurred in two 
ships, the Grandcamp and the High Flyer, both of which 
were carrying AN (Case History A16). They damaged 
thousands of buildings, hurled missiles several miles and 
killed 552 people. 

Major explosions involving organic peroxides occurred 
atTonawanda, New York, in 1953 and at Los Angeles in 1974 
(Case History A72). 

Two warehouse fires in Britain, at Renfrew in 1977 and 
Salford in 1982, resulted in large sodium chlorate explo¬ 
sions (Case History A85). 

In recent years, the most destructive explosions in the 
process industries have tended to beVCEs or BLEVEs. 

Some of the principal VCEs have been described in 
Section 17.28. They include those at the Ludwigshafen 
works in 1953 and 1958, the refinery at Lake Charles in 
1967, the refinery at Pernis in 1968, a pipeline at Port 
Hudson in 1970, a rail tank car at East St Louis in 1972, the 
works at Flixborough in 1974, the rail tank car at Decatur 
in 1974, a petrochemical plant at Beek in 1975 and a petro¬ 
chemical plant at Pasadena in 1989. Flixborough and 
Pasadena are described in Appendices 2 and 6, respec¬ 
tively, and the other incidents in Appendix 1, as referenced 
in Section 17.28. 

Some of the principal BLEVEs have been described in 
Section 17.29. Major incidents in which the BLEVE occurred 
due to release from the vessel involved or a similar, adjacent 
vessel include those at a storage in Montreal in 1957, the 
refinery at Feyzin in 1966, a rail tank car at Crescent City in 
1970, a refinery in Rio de Janeiro in 1972 and a storage at 
Texas City in 1978. Those at Feyzin, Crescent City and Rio 
are described in Appendix 1, as referenced in Section 17.29. 

In other instances, BLEVEs have occurred as a result of 
engulfment in a major vapour cloud fire. Incidents where 
this was the case include those at the storage in Port 
Newark in 1951 (Case History A19) and at Mexico City in 
1984 (Appendix 4). 

Turning to confined explosions with reaction, these 
include (1) explosions involving vapour combustion, 


(2) reactor explosions and (3) other explosions involving 
liquid phase reactions. In the first category is the detona¬ 
tion in a 127 ft high x 22.5 ft diameter reactor at Whiting 
1955 (Case History A22). The vessel disintegrated, hurling 
one 60 te fragment onto a tank farm 1200 ft away and 
causing two deaths. 

There have been a large number of reactor explosions, 
usually incurring a medium level of casualties and loss. 
One of the more serious occurred at Geismar in 1976, when 
a large polygylcol ether reactor exploded, throwing the 
reactor head 1400 ft (Case HistoryA80). 

Liquid phase reactions occurring in other equipment 
have also led to major incidents. One such occurred at Doe 
Run in 1962, when backflow of ammonia from a reactor into 
an ethylene oxide feed tank resulted in a severe explosion 
(Case History A31). 

Incidents of vapour escapes into, and explosions in, 
buildings (VEEBs) are exemplified by those at St Paul in 
1951 and Attleboro in 1964 (Case History A33). In the first 
an escape of LPG at a loading terminal caused an explosion 
which killed 14 people. In the second a massive leak of vinyl 
chloride from a reactor into the building resulted in an 
explosion which led to seven deaths. 

The explosion on Piper Alpha, which occurred in a par¬ 
tially confined module, might also be regarded as falling in 
this category (Appendix 19). 

Finally, there have also been a number of serious dust 
explosions inside (1) plant and (2) buildings. An explosion 
inside a grain silo at Westwego in 1977 resulted in 36 deaths 
(Case History A89). 

Most, though not all, of the incidents just described are 
in the M&M Large Loss List. Details of casualties and loss 
are given in Table A1.2. 

17.51.2 Mortality index for explosions 

The relation between the size of an explosion and the number 
of people killed has been investigated by VC. Marshall 
(1977b), who has developed a mortality index (deaths/t) for 
explosions. 

Data on the relation between the size of the explosion and 
the number of fatalities, and on the mortality index, are 
plotted in Figure 17.133. The solid squares which do not 
have a specific reference are accidental explosions. The full 
line is the best fit for these accidental explosions. 

Mortality data on the number of casualties by shell 
explosions are available from the First World War. Accord¬ 
ing to one account, the belligerents used 2.23 x 10 6 1 of high 
explosive in 1.39xl0 9 shells and caused 10 7 casualties. The 
latter figure includes wounded as well as dead, and the 
deaths are estimated at 2.4 x 10 6 . Thus, on average a shell 
contained 1.6 kg of explosive. Allowing for 10% dud shells, 
the fatalities per shell are approximately 0.0019, which 
gives a mortality index of 1.2. 

The Second World War data for conventional bombing give 
mortality indices between 0.96 for Germany and 3.40 for 
Japan. This is no doubt influenced by factors such as popu¬ 
lation density, construction of houses and degree of shelter. 

The mortality indices for the nuclear bombs at Hiroshima 
and Nagasaki are 2.05 and 1.0, respectively. The bombs 
were assumed to have a nominal yield each of 20, 000 t 
of TNT. 

The mortality indices of the Halifax explosion in 1917 and 
the Oppau explosion in 1921 are 0.64 and 0.25, respectively. 

For accidental explosions the data used are the data 
given by C.S. Robinson (1944) and some unpublished data 
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Figure 17.133 Mortality index for explosions (after V.C. Marshall, 1977b) (Courtesy of the Institution of Chemical 
Engineers) 


by Healy (1965), and they have been grouped by Marshall in 
size intervals. 

As Figure 17.133 shows, the mortality index decreases as 
the size of the explosion increases. The line has a slope of 
about —0.5. This differs somewhat from the slope sug¬ 
gested by theoretical considerations. From the blast scaling 
laws the radius r at which a given blast intensity occurs is 
related to the mass of explosive W by the relation 

r oc WV s [17.51.1] 

The number of fatalities/is proportional to the area: 

/ cx r 2 tx W 2/3 [17.51.2] 

The mortality index MI is the ratio of the number of fatal¬ 
ities to the mass of explosive: 

MI cx ^ cx W~ 1/z [17.51.3] 

Marshall suggests that a possible explanation is that small 
explosions which do not kill people tend not to be well 
reported, which has the effect of exaggerating the mortal¬ 
ity index for small explosions. VCEs are also considered by 
Marshall, as shown inTable 17.71. Since for such explosions 
the TNT equivalent is generally unknown, the mortality 
index in this case is based on the mass of vapour involved. 

Other aspects of historical experience with explosions 
are discussed in Sections 17.28—17.30 and 17.31—17.34. 


17.51.3 Hazard assessment 

Hazard assessment of explosion on process plants tends 
to be rather more varied than that of fire. As stated in 
Section 17.1, explosions in the process industries include 
(1) physical explosions, (2) condensed phase explosions, 
(3) VCEs, (4) BLEVEs, (5) confined explosions with reac¬ 
tion, (6) vapour escape into, and explosions in, buildings, 
and (7) dust explosions. The extent to which these different 
types of explosion are represented in the hazard assess¬ 
ment literature varies. 

In principle, a hazard assessment involves formulation of 
a scenario and a full assessment of the frequency and con¬ 
sequences of the event. An assessment which is confined 
either to the estimation of the frequency of the event or to 
the modelling of the consequences is a partial one. Hazard 
assessments may be generic or may relate to a specific 
situation. 

The scenario which has received most attention is the 
release and ignition of a vapour cloud, which may result 
either in a vapour cloud fire or a VCE. Thus, the hazard 
assessment of VCEs involves the development of a set of 
scenarios for explosion, by release and ignition, and of the 
associated event trees; the estimation of the frequency/ 
probability of the initial events and of the events in the 
branches of the event trees from a mixture of historical data 
and synthesis of values, often using fault trees, and the 
modelling of the outcome events in the event tree, including 
both physical events and damage/injury. 

Up to the point of damage and injury, the assessment of a 
VCE involves essentially the same set of models as those 
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Table 17.71 Some data on the relation between size of flammable release and number of fatalities (after 
V.C. Marshall, 1977b) (Courtesy of the Institution of Chemical Engineers) 


Date 

Location 

Chemical 

Material released 

Nature of 
incidents 

Fatalities 

Mortality index 
(deaths/t) 




Liquid 
spilled (t) 

Vapour 
involved (t) 


1943 

Los Angeles, CA 

Butane 


14 

Fire 

5 

0.35 

Jan.18 

1944 

Cleveland, OH 

LNG 


180 

Fire 

213 

1.18 

Nov. 15 

1959 

June 28 

Meldrin. GA 

LPG 


18 

Explosion 
and fire 

23 

1.27 

1962 

July 26 

New Berlin, NY 

LPG 


17 

Explosion 
and fire 

10 

0.58 

1967 a 

Lake Charles, LA 

Isobutane 


13 

Explosion 

7 

0.53 

Aug. 6 

1968 

Jan. 20 

Pernis, 

Netherlands 

Hydrocarbon 

vapour 


50 

Explosion 

2 

0.04 

1970 

Port Hudson, MO 

Propane 


27 

Explosion 

0 

0 

Dec. 9 

Oct. 23 

Hull, UK 

Propane 

4 

0.20 

Fire 

2 

10.0 

1971 

Pensacola, FA 

Cyclohexane 


30 

No ignition 

0 

0 

July 11 

1972 

East St. Louis, IL 

Propylene 


70 


0 

0 

Jan. 22 

Mar. 19 

Lynchburgh,VA 

Propane 

9 

1.5 

Fire 

2 

1.33 

Sep. 21 a 

New Jersey 

Propylene 


18 

Pressure 
rupture 
followed 
by fire 

2 

0.11 

1973 

Feb. 23 

Austin, TX 

Natural 
gas liquids 

720 

70 

Fire 

8 

0.11 

1974 

Flixborough, UK 

Cyclohexane 

125? 

40 

Explosion 

28 

0.70 

June 1 

June 29 

Climax,TX 

Vinyl chloride 


75 

Explosion 

0 

0 

1975 Beek, Netherlands 

Nov. 7 

Total of 16 incidents 

Mean of 16 incidents 

Propylene 


5.5 

630 

39.4 

Explosion 
and fire 

14 

316 

19.7 

2.54 

0.49 


a Date quoted in the original paper have been corrected (F.P.L.). 


used for the modelling of vapour cloud fires, as described 
in Chapter 16. If the event gives an overpressure, it is aVCE, 
otherwise it is a vapour cloud fire. 

A hazard assessment of the kind just described con¬ 
stitutes a full hazard assessment. The types of explosion 
which are most fully represented are high explosives and 
ammonium nitrate explosions, VCEs and BLEVEs. 

Overviews of generic process plant explosion scenarios 
have been given for LPG by Rasbash (1979/80) and Crocker 
and Napier (1988a) and for LNG by Napier and Roopchand 
(1986). 

Some principal types of model used for hazard assess¬ 
ment of explosions on process plants are those for (1) con¬ 
densed phase explosions, (2) explosions of vessels, (3) VCEs, 
(4) BLEVEs and (5) dust explosions. 

An early, essentially generic, hazard assessment of explo¬ 
sion is that given in the vulnerability model by Eisenberg, 
Lynch and Breeding (1975), who studied the area affected 
by a flammable vapour cloud and the lethality of a VCE in 
such a cloud. The events of principal interest which they 


consider are marine spillage of 20,750,83 and 0.8 te of LNG 
on water with drifting of the vapour cloud towards populated 
areas. Their treatment of these scenarios is described in 
Chapter 16. For explosion injury they utilize their own probit 
equations described in Section 17.38. The populations at 
risk are defined in terms of the cell model already described. 
Some results obtained have been given in Chapter 16. 

The First Convey Report (HSE, 1978b) included assess¬ 
ments of the hazard at the specific installations at Canvey 
from an explosion of ammonium nitrate; a VCE from the 
British Gas LNG storage and VCEs from several LPG 
storages. 

These assessments were refined in the second report. An 
account of this work is given in Appendix 7. 

The Rijnmond Report (Rijnmond Public Authority, 1982) 
gives specific hazard assessments for storages of acrylo¬ 
nitrile, propylene and LNG. It considers VCEs and 
BLEVEs. An account of this work is given in Appendix 8. 

The Transport Hazard. Report of the Advisory Committee 
on Dangerous Substances (ACDS) (1991) gives hazard 
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assessments for the transport of hazardous substances in 
ports, by road and by rail which are applicable to transport 
nationwide, although based in some cases on generali¬ 
zation from a sample of specific situations. The hazards 
covered include explosion of high explosives and of 
ammonium nitrate and VCEs and BLEVEs from LPG and 
flammable liquids. 

For physical explosions, hazard assessments have been 
mainly treatments of the frequency of explosion without 
modelling of the consequences. Studies of this type on 
specific plant have been described for overpressure of a 
storage tank by gas breakthrough by Kletz and Lawley 
(1982), overheating of a distillation column by Lawley and 
Kletz (1975) and undertemperature of a pipeline by Lawley 
(1980). 

For condensed phase explosions, the hazard assess¬ 
ments of explosions of high explosives are represented by 
those in the ACDS study and of ammonium nitrate explo¬ 
sions by those in the Canvey Reports and the ACDS study. 
These are for specific situations, although in the ACDS 
study the results are then generalized. 

For VCEs and BLEVEs, there are a number of hazard 
assessments which cover these events. They include a 
generic study of storage installations by Considine, Grint 
and Holden (1982) and studies of specific installations by 
Panthony and Smith (1982) and Ramsay, Sylvester-Evans 
and English (1982). 

There are also generic assessments of the frequency of 
BLEVEs by Drysdale and David (1979/80), Blything and 
Reeves (1988 SRD R488) and Selway (1988 SRD R492). 

For confined explosions with reaction, hazard assess¬ 
ment of explosions involving vapour combustion include 
the estimations of explosion frequency for an ethylene 
oxide reactor system by R.M. Stewart (1971) and for a 
hydrocarbon sweetening plant by Kletz (1972a) and of 
explosion involving liquid phase reactors by Roy, Rose and 
Parvin (1984). 

Vapour escapes into, and explosions in, buildings and 
dust explosions are not well represented in the hazard 
assessment literature. 


17.52 Hazard Range of Explosions 

The estimation of the hazard range of an explosion depends 
on the type of explosion considered. 

The two main types of explosion of interest here are 
condensed phase explosions such as those of TNT, together 
with explosions which can be characterized in terms of 
TNTequivalent, and VCEs. 

17.52.1 Condensed phase explosions 

The blast wave from a condensed phase explosion is 
characterized by the peak side-on overpressure and the 
impulse. 

The variation of peak overpressure of a condensed phase 
explosion with distance is given by the scaling law and 
values of the overpressure may be obtained from graphs 
such as those given in Section 17.26. Thus 

P° =f{z) [17.52.1] 


where/) 0 is the peak overpressure, r is the distance, WTs the 
mass of explosive and z is the scaled distance. Over a lim¬ 
ited range the curve of p° vs z may be approximated by a 
straight line so that 

^=( 7 )” [17.52.3] 

where n is an index and subscript r is reference value. From 
the Baker curve for the overpressure range 1.0-0.1 bar the 
index n is approximately 1.7. A similar approach may be 
used for the determination of the impulse. 

The effects of the explosion may then be determined 
from the overpressure and impulse utilizing the methods 
given in Sections 17.31-17.35. 

For housing damage, the variation of the degree of 
damage, or damage category, with distance may be 
obtained from the revision by Gilbert, Lees and Scilly of the 
Jarrett equation; this revision is given by Equation 17.33.2b 
with revised values of the constant k. 

The graph given by C.S. Robinson (1944) and reproduced 
as Figure 17.92 summarizes in convenient form the range of 
many of the principal damage effects. 


17.52.2 Vapour cloud explosions 

For aVCE, it is necessary to take into account the movement 
of the cloud, which is likely then to be the dominant factor. 

The variation of cloud size with distance may be esti¬ 
mated from gas dispersion relations given in Chapter 15. 
An account is given there of the method of Considine and 
Grint (1985) which allows an estimate to be made of the size 
of the cloud for an LPG release. 

Considine and Grint have also given for LPG methods for 
estimating the hazard range for fires and explosions. For a 
VCE they use the ACMH method based on the TNTequiva¬ 
lent. They give for the overpressure the relations 

p° = 138 r<r c ; 0.05<p°<l 

p° = 138 r>r c \ 0.05<p°<l 

where I is the mass of vapour in the cloud (te), p° is the peak 
overpressure (bar) and r c is the radius of the cloud (m). 

These authors quote from the First Canvey Report the 
estimates of 50 and 1% fatalities at overpressures of 0.36 
and 0.18 bar, respectively.Within the cloud, 100% fatalities 
are assumed. 

For a quasi-instantaneous release, the cloud range R and 
the cloud radius r c vary with time. The mass m of vapour in 
the cloud may be taken as the total mass released. The cloud 
is flammable, however, only whilst its concentration is 
within the flammable range. 

For a quasi-continuous release, the approach taken is to 
treat the plume as if it were fully established. In this case 
the cloud is non-circular and the following relation is given 
for the equivalent value of cloud radius r c : 


[17.52.4a] 

[17.52.4b] 
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[17.52.5] 
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where /? L fl is the distance to the LFL (m) and k * is a con¬ 
stant defining crosswind range. This constant is described 
in Chapter 15. 

The TNT equivalent method for a VCE is obsolescent. 
More modern methods, particularly the TNO and Baker 
Strenlow methods, are available, as described in Section 
17.28, and may be preferred. However, the method of deter¬ 
mining the cloud size may still be found useful. 

In reality, for a VCE the peak overpressure is inversely 
proportional to the distance, and this is reflected in the 
more modern models. An illustration is the decay of the 
peak overpressure with distance shown in Figure 17.79(a). 

17.53 Notat 

Ma 
Re 
g 
t 
T 
y 

Superscripts 


Subscript 


Note: 

(a) Some of these variables have different local definitions, 
for example: t (thickness of glass), T (time constant, natural 
period), 

(b) The symbol R generally denotes the universal gas con¬ 
stant but is also used for distance, range. It is therefore not 
defined globally for the chapter. 

Section 17.2 


Mach number 
Reynolds number 
acceleration due to gravity 

absolute temperature 
ratio of gas specific heats 


time derivative 
second time derivative 


maximum 


Subsections 17.2.3-17.2.9 
a velocity of sound 

c y mean specific heat at constant volume 

D velocity of shockwave 

d c critical tube diameter 

(mm for detonatation) 

Hh ratio of E * for a fuel to that of acetylene 

e specific internal energy 

E c critical (minimum) energy for initiating 

spherical detonation 
E£ minimum value of E c 

Ae specific internal energy change 

h specific enthalpy 

I impulse 

Li induction zone length 

L c length of cell 

Ma Mach number 

p absolute pressure 

p p i plateau pressure 

p v pressure of constant volume 

combustion 

q energy addition per unit mass 

S width of cell 

T temperature 

71 induction time 


u velocity 

v specific volume 

Fi velocity of gas entering shock wave 

w particle velocity 

a angle defined in Figure 17.1(d) 

{ fractional completion of reaction 

A induction length for detonation 

p density 

Subscripts 

CJ Chapman-Jouguet condition 

s shock wave 

1 entering shock wave 

2 leaving shock wave 

Ql, Qu fuel mole frequency to stoichiometric 

mole frequency at lower and upper 
limits for detonation 


Subsection 17.2.10 

a a velocity of sound in burned gas 

d diameter of tube 

k n Bessel function derivative 

p pitch of spin 

y 0 ratio of specific heats of detonation 

products 

X wavelength of spin 

Subsections 17.2.11 and 17.2.12 

a 0 velocity of sound in mixture 

d c critical diameter for transmission of 

detonation 

E c critical energy for initiation of spherical 

detonation 

L c length of detonation cell 

Li length of induction zone 

n constant 

S width of detonation cell 

A induction length 

t ; induction time 

<j) fuel-air ratio 

Subscripts 

1 lower limit 

st stoichiometric 

u upper limit 


Subsection 17.2.13 
c velocity of sound 

d c critical diameter for transmission of 

detonation 

D h detonation hazard parameter 

E c critical energy 

iJ* minimum critical energy 

p absolute pressure 

u particle velocity 

X stoichiometric ratio 

Subscript 

D detonation state 


Subsections 17.2.15-17.2.17 

c velocity of sound in uncompressed gas 

d diameter of tube 
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d c critical diameter for transmission of 

detonation 

d min minimum diameter of vapour cloud 

to support detonation 
gf acceleration of flame 

L c length of detonation cell 

S u maximum fundamental burning 

velocity 

X A run-up distance 

X f distance from origin of flame to 

its position at time when shock 
first forms 

X s distance from origin to position 

at which shock is produced 

P ratio of velocity of flow just ahead of 

flame to that of flame 

y ratio of specific heats of reactant 

t expansion ratio 

0cr critical angle for transition to regular 

reflection 

0 W angle between shock wave traveling 

horizontally and a surface 


Equations 17.2.56—17.2.57 


area of truncation 
diameter of nozzle 
C-J velocity 
critical energy 
length of detonation cell 
pressure of planar detonation 
width of detonation cell 
time at which heads of expansio 
fan cross axis of symmetry 
gas velocity behind C—J front 
work done 


Subscripts 

c critical 

CJ C-J 

o actual 


Section 17.3 


Subsection 17.3.2 

p° peak overpressure 

r distance 

r c radius of crater 

r 50 distance at which there is 50 % chance 

of sympathetic detonation, mean 
detonation distance 
R radius of damage circle 

W mass of explosive 

z scaled distance 

Subsection 17.3.3 
k constant 

R distance (ft) 

W mass of explosive (lb) 


R distance 

W mass of explosive 

Equations 173.9-17.3.11 
R distance (ft) 

W mass of explosive (lb) 


Subsection 17.3.5 


B 
B * 


k 

» 1 , «2 

P 

P' 

P(J) 

T 

W 


blast effect 

blast effect required for certainty of 
detonation 
site counter 
constant 
indices 

probability of further detonation 
parameter defined by Equation 17.3.15 
probability that; sites are involved in 
detonation 
distance 

threshold of p' below which no 
propagation occurs 
mass of explosive 


AH clw 

AH cy 


A H w 
AH VW 

P 

R 

S 

T 

V 

W 

y 


Helmholtz free energy 
internal energy 
Gibbs free energy 
enthalpy 

heat of combustion 

heat of combustion with initial reactant 
as liquid 

heat of combustion with final water 
product as liquid 

heat of combustion with initial reactant 
as vapour 

heat of combustion with final water 
product as vapour 
latent heat of vaporization 
latent heat of vaporization of water 
number of moles 
absolute pressure 
universal gas constant 
entropy 

absolute temperature 
volume 

ratio of gas specific heats 


Superscript 

o standard state 


Subscripts 


2 


formation 
products 
reactants 
initial state 
final state 


Subsection 17.3.4 

Equation 17.3.8 
k constant 


Subsection 17.4.3 

Ui liquid strain energy 

V volume of vessel 

P bulk modulus of liquid 
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Subsection 17.4.4 


Young’s modulus 
diameter ratio 
metal strain energy 
volume of vessel 
Poisson’s ratio 


Equation 17.4.34 

R a scaling radius (m) 


Equation 17.4.35 

E 

P 0 

P 1 

V 


explosion energy (te of TNT) 
pressure of surroundings (kPa) 
initial pressure in vessel (kPa) 
volume of vessel (m 2 ) 


$ species i 

pr products 

r reactants 


Section 17.5 

E 

M 

P 


expansion ratio 
molecular weight 
number of moles 
absolute pressure 


Subscripts 

b bursting 

1 initial 

2 final 


Subsection 17.4.5 

E 

V 

y 

Subscripts 

internal energy 
volume of vessel 
ratio of gas specific heats 

Subsection 17.5.4 

P ex 

Vd 

absolute explosion pressure 
displacement velocity 
explosion velocity 
normal burning velocity 


Aslanov—Golinsky 

Baker 

£ 

ratio of area of flame front to 

AG 

Ba 


cross-sectional area of pipe 

Br 

Erode 



ex 

explosion 

Section 17.6 


Ki 

Kinney 

P 

absolute pressure 

0 

atmospheric 

Subscripts 


Subsection 17.4.6 

specific internal energy 

1 

2 

initial 

final 

£ex 

energy of explosion 



H 

specific enthalpy 

Section 17.7 


P 

S 

absolute pressure 
specific entropy 

A t 

radius of spherical vessel 
area of flame front 

4> 

specific volume 
mass fraction of vapour 
dummy variable 

c„ 

E 

F 

calorific value of gas mixture 

expansion ratio 

constant 



Gi-Gi 

constants 

Subscripts 


h 

enthalpy 

f 

saturated liquid 

ki-h 

constants 

g 

saturated vapour 

K 

constant 

0 

atmospheric 

Kg 

constant 



Ki 

constant 

Subsection 17.4.8 


L 

length of cylinder 

E s 

total energy in system 

m. 

mass of gas 

Ei 

chemical energy 

m a 

mass of gas in vessel 

e 2 

fluid expansion energy 

M 

molecular weight 

e 3 

vessel strain energy 

M 

mean molecular weight 



n 

fractional degree of combustion 

Subsection 17.4.11 

n 

(with subscript) moles of gas 

B 

batch availability (kcal/mol) 

P 

absolute pressure 

AS 

batch availability correction term 

A P 

pressure rise 

c P 

(kcal/mol) 

Q 

heat lost from burned products 

specific heat at constant pressure 


radius 


(kcal/mol) 


radius of burnt core of gas 

m 

number of species 

(after combustion) 

P 

absolute pressure (Pa) 

r c 

radius of cylinder 

R 

universal gas constant (kcal/mol/K) 

r i 

radius of burnt core of gas 

T 

absolute temperature (K) 


(before ignition) 


mole fraction 

R 

universal gas constant 

4>o 

standard batch availability (kcal/mol) 

R g 

mass basis gas constant 



S 

surface area of vessel 

Subscripts 


St 

flame speed 

a 

ambient 

S„ 

burning velocity 
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V 

v„ 


Superscript 


absolute temperature corresponding to 
pressure P 
velocity 

velocity of unburnt gas into flame front 
internal energy 
mass specific volume 
volume 

volume of vessel 
coefficient of turbulence 
molar specific volume 
mass density 


normalized 


Equation 17.10.4 
D 
K 
% 

7 X 

A 


diameter of jet orifice (ft) 
constant 

nozzle velocity (ft/min) 
required velocity (ft/min) 
distance from jet to most remote 
corner (ft) 


Section 17.11 


Subsection 17.11.5 

D internal diameter of pipe (m) 

g L laminar velocity gradient (s -1 ) 

ut turbulent flashback velocity 


Subscripts 

b burned 

e end value (after combustion) 

i initial state of burned gas 

(before ignition) 
j gas state/ 

m maximum 

o initial value (before ignition) 

u unbumed 

1 unburned 

2 burned 

Equations 17.7.72-17.7.78 
a flame area factor 

Equations 17.7.131 -17.7.171 


Subsection 17.11.7 

a fractional free area of arrester 

d diameter of arrester apertures (cm) 

n number of apertures per unit area of 

arrester surface (cm -2 ) 

p explosion pressure at arrester 

p 0 atmospheric pressure 

V flame speed at arrester (m/s) 

y thickness of arrester elements (cm) 


Subsection 17.11.9 

a fractional free area of arrester 

d diameter of arrester apertures (in.) 

V flame speed at arrester (ft/s) 

y thickness of arrester (in.) 


a — i /y u 

r s radius of spherical vessel; 

radius of burned gas at end of 
spherical stage 

a parameter defined by 

Equations 17.7.143-17.7.145 


Equation 17.11.6 

Q heat of detonation of gas mixture (cal/g) 

V detonation velocity (ft/s) 

y ratio of specific heats of gas mixture 

at combustion temperature 


Section 17.8 

C 


Q 

Co 

Q 

Qo 

Q g 

V 


volumetric concentration 
effective inlet volumetric concentration 
concentration on cessation of release 
total volumetric flow 
volumetric flow of air 
volumetric flow of contaminant gas 
volume of space 
volume/throughput ratio, 
or time constant 


Subsection 17.8.7 


index 

constant 

peak pressure (bar) 
mass of explosive (kg) 
volume of chamber (m 3 ) 


Section 17.10 

E 

Q 


volumetric concentration of component 
number of changes of atmosphere 
volumetric flow of gas through vessel 


Subscript 


Section 17.12 

(See text for units in particular equations) 

a-d constants 

A,B constants (Equation 17.12.11) 

A, B, C constants (Equation 17.12.31) 

A c cross-sectional area of volume vented 

A m maximum area of flame front 

A v vent area 

AA V correction term for A, 

C Runes constant 

Ca coefficient of discharge 

E expansion ratio, expansion factor 

/ vent ratio 

g acceleration due to gravity 

k constant 

K vent coefficient 

K g K g value 

L length of enclosure 

L h L 2 two smallest dimensions of enclosure 

m mass of gas 

M mean molecular weight 

n (with subscript) moles of gas 

P pressure 

A P vented explosion pressure 

P a atmospheric pressure 

Pi back pressure due to the inertia of 

the vent 


initial value 
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P m final pressure 

P max maximum pressure in an unvented 

explosion 

P re d actual, or reduced, pressure in 

a vented explosion 

P sta t vent opening pressure 

P v vent opening pressure 

Pi pressure of first peak 

P 2 pressure of second peak 

Q m rate of volume production 

Q v volumetric vent outflow 

r b radius of burned gas 

R universal gas constant 

S u burning velocity 

V volume of vessel; volume of gas 

Vf flame speed 

w inertia of vent 

W v mass of vent cover 

Y constant 

a coefficient of turbulence 

p density of gas 

i jt vent ratio 


Subscripts 

b burned 

e vented 

f flame 

o initial 

P re d pressure in vented enclosure 

u unburned 

v vent conditions 


Subsection 17.12.4 

c speed of sound 

D duet diameter 

/ a frequency of oscillation 

/h frequency of Helmholtz oscillation 

L length of duct 

r a radius of spherical vessel 

a correction factor 

Hi constant 

Subsection 17.12.7 
f turbulence factor 

Subsection 17.12.10 

T absolute temperature of burnt gas 

Subsection 17.12.20 

fy vent outflow parameter 

fy i —fy 4 vent outflow parameters 

f vs i vent outflow parameter for sonic flow 

fvsbz vent outflow parameter for subsonic 

flow 

Gy vent mass velocity 

P absolute pressure 

P a absolute atmospheric pressure 

w pressure ratio 

w c critical pressure ratio 

p 0 density of gas at atmospheric pressure 

Subsection 17.12.21 

a radius of spherical vessel 

W mass rate of combustion 


Subsection 17.12.22 

a characteristic length (for a sphere, 

the radius) 

G venting area parameter 

AP m maximum explosion pressure 

a venting parameter 

Pb o density of burned gas at initial pressure 

p uo density of unburned gas at initial 

pressure 

X turbulence correction factor 


Subsection 17.12.23 


A 

C d 

/v2 


velocity of sound 
vent area ratio 

surface area of spherical vessel 

coefficient of discharge 
vent outflow parameter 
mass vented 
absolute pressure 
burning velocity 
dimensionless burning velocity 
at vent conditions 
dimensionless burning velocity 
at initial 
conditions 
volume vented 
vent flow coefficient 
density of gas 


b burned 

o initial 

u unburned 

v vent conditions 

Subsection 17.12.24 

A f largest spherical surface in enclosure 

A s surface area of sphere having 

same volume as enclosure 

E expansion ratio 

F shape factor 

K parameter defined by 

Equation 17.12.100 

P absolute pressure 

AP pressure difference 

P max absolute maximum pressure of 

unvented explosion 

P Q absolute initial pressure 

P re d reduced pressure (gauge) 

Qy volumetric vent outflow 

r radius of burned gas before expansion 

u velocity of flame front 

V volume of sphere 

Vf final volume of burned gas after 

combustion 

Vfi time-dependent volume of fuel 

consumed, 

of burned gas before combustion 
Vf time-dependent volume of burned gas 

after combustion 
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Subsection 17.12.25 

P m ax 

absolute maximum pressure of 

A 

area of flame front (ft 2 ) 


unvented 

A, 

vent area (ft 2 ) 


explosion 

ky! 

vent outflow constant 

Po 

absolute initial pressure 


(mol in. °R/lb 1/2 ft 2 s) 

P set 

absolute vent opening pressure 

k v 2 

vent outflow constant 

ri 

radius of burned gas 


(molin. 2 °R 1/2 /lbft 2 s) 

So 

burning velocity 

L 

length of cylinder (ft) 

V 

volume of vessel 

n 

number of moles (lb mol) 

z 

dimensionless burned volume 

P 

absolute pressure (lbf /in. 2 ) 

X 

dimensionless vent opening pressure 

Pm 

absolute maximum pressure of 

p 

density of gas 


unvented explosion (lbf/in. 2 ) 


turbulence correction factor 

p a 

atmosphere pressure (lb f /in. 2 ) 



P re d 

absolute reduced pressure (lb f /in. 2 ) 

Subscripts 


A P Y 

overpressure at which vent 

banned 

R 

opens (lbf/in. 2 ) 

gas constant (lb ft 2 /in. 2 mol°R) 

e 

outflow 

S 

t 

burning velocity (ft/s) 
time (s) 

u 

unburned 

T 

absolute temperature (°R) 



V 

volume (ft 3 ) 

Section 17.12.28 


01 

coefficient of turbulence 

As Section 17.7.5 


Subscripts 


Subsection 17.12.32 

b 

burned 

Ay 

vent area 

e 

end of combustion 

F r 

force due to back reaction 

m 

final 

Prod 

reduced pressure (gauge) 

o 



velocity of fluid 

1 

unbumed 
closed end side 

P 

density of fluid 

2 

vent end side 

Subsection 17.12.36 



a 

acceleration of vent panel 

Subsection 17.12.26 

A 

area of vent panel 

A 

dimensionless vent area 

C 

parameter defined by 

A t 

area of flame front (m 2 ) 


Equation 17.12.163 

A s 

surface area of sphere (m 2 ) 

D 

‘density’ of vent panel 

A, 

vent area (m 2 ) 

E 

parameter defined by 

A x 

cross-sectional area of cylinder (m 2 ) 


Equation 17.12.165 

k 

constant 

F 

force on vent panel 



g 

acceleration due to gravity 

AP m 

maximum pressure rise (atm) 

K 

parameter defined by 

r c 

radius of cylinder (m) 


Equation 17.12.100 

?J3 

radius of sphere (m) 

L 

length of vent panel 

S 0 

dimensionless burning velocity 

M 

mass of vent panel 


at initial conditions 

P 

pressure (gauge) 

Tt 

adiabatic flame temperature (K) 

Py 

vent opening pressure (gauge) 

Subscripts 

b 

density of gas (kg/m 3 ) 

s 

ty 

distance travelled by vent panel 
distance defined by Equation 17.12.158 
time of start of venting 

burned 

W 

velocity of vent panel 
vent inertia 

o 

initial 

w 

width of vent panel 

u 

unburned 

9 

angle of rotation of vent panel 

Subsection 17.12.27 

Section 17.13 


A, 

vent area 

Ay/V 

vent ratio 

B 

dimensionless burning number 

D 

diameter of duct (ft) 

c d 

coefficient of discharge 

h-ki 

constants 

Gy 

vent mass velocity 

K 

vent coefficient 

m 

mass 

K s t 

dust K st value 

P 

absolute pressure 

L 

length of duct (ft) 

P a 

atmospheric pressure 

h 

distance between relief openings (ft) 

P f 

absolute final pressure of vented 

ilmax 

maximum distance between relief 


explosion, reduced pressure 


openings (ft) 
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L 2 distance bet ween relief openings for gas 

other than propane (ft) 

P maximum pressure (lbf/in. 2 ) 

Pi maximum pressure resulting from 

explosion of propane (lbf/in. 2 ) 

P 2 maximum pressure for gas other than 

propane (lb f /in. 2 ) 

S u maximum fundamental burning 

velocity for gas other than 
propane (ft/s) 

Equations 17.3.5—17.13.6 

L maximum distance between vents 

P re d reduced pressure 

S maximum fundamental burning 

velocity 


P m maximum pressure reached during 

venting (mbar) 

P T pressure at which vent opens (mbar) 

Pi first peak pressure (mbar) 

P 2 second peak pressure (mbar) 

S u burning velocity (m/s) 

V volume of enclosure (m 3 ) 

w vent inertia (kg /m 2 ) 

Subsection 17.14.7 

A s internal surface area of enclosure (m 2 ) 

A, vent area (m 2 ) 

C venting constant (bar 1/2 ) 

P re d maximum pressure which can be 

withstood by weakest structural 
element not intended to fail (bar) 


Subscripts 

p propane 

x gas other than propane 

Section 17.14 


Subsection 17.14.4 


smallest cross-sectional area of 
building space (m 2 ) 
total area of combustion vents (m 2 ) 
turbulence factor 
venting ratio 

back pressure due to inertia of vent 
(gauge) (kPa) 

maximum pressure reached during 
venting, reduced pressure (gauge) (kPa) 
pressure with building space at which 
vent opens (gauge) (kPa) 
maximum fundamental burning 
velocity (m/s) 


Subsection 17.14.5 


Equations 17.14.1-17.14.6 


A, 

C 

E 


Li,L 2 
AP 


vent area (ft 2 ) 

Runes constant ((lbf/in. 2 ) 1/2 ) 
expansion ratio 

two smallest dimensions of building (ft) 
vented explosion overpressure (lbf/in. 2 ) 
flame speed (ft/s) 
density of gas (Ib/ft 3 ) 


Equation 17.4.7 

A 

C 

l A ,L 2 

P 


building vent area (m 2 ) 
constant 

two smallest dimensions of 
building (m) 

maximum internal building 
pressure (kPa) 


Subsection 17.14.6 

a constant 

A s area of side of enclosure (m 2 ) 

A vent area (m 2 ) 

K venting ratio 


Subsection 17.14.8 
f turbulence factor 

ki, k 2 constants 

Ki vent coefficient for compartment 1 

K 2 vent coefficient for compartment 2 

K\ 2 vent coefficient between compartments 

land 2 

(Kw) 23V average value of Kw for compartment 2 

Pi vented explosion pressure of 

compartment 1 (mbar) 

P 2 vented explosion pressure of 

compartment 2 (mbar) 

S u maximum fundamental burning 

velocity (m/s) 

Vi volume of compartment 1 (m 3 ) 

V 2 volume of compartment 2 (m 3 ) 

Subsections 17.16-17.19 
A vent area (m 2 ) 

A a vent area for zero overpressure (m 2 ) 

C specific heat of reaction mass (kj/kg) 

D diameter of vent line (m) 

D a diameter of vent line in bench-scale 

apparatus (m) 

F flow correction factor for vent line 

G mass velocity (kg/m 2 /s) 

G 0 mass velocity in bench-scale apparatus 

(kg/m 2 /s) 

h specific enthalpy (kj/kg) 

hf g latent heat of vaporization (kj/kg) 

A H t heat of reaction (kj/kg) 

AH, latent heat of vaporization (kj/kg) 

k constant 

K discharge coefficient 

L length of vent line (m) 

m mass in vessel (kg) 

m a initial mass in vessel (kg) 

N non- equilibrium parameter defined by 

Equation 17.18.2 

P absolute pressure (Pa) 

AP overpressure (Pa) 

P a atmospheric pressure (Pa) 

P g absolute partial pressure of gas (Pa) 

P Q absolute stagnation pressure (Pa) 

P s absolute set pressure (Pa) 

P v absolute partial pressure of vapour (Pa) 

q heat release rate per unit mass (kW/kg) 

Q heat release or input rate (kW) 
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Q g volumetric gas evolution rate (m 3 /s) 

Q, volumetric vapour evolution rate (m 3 /s) 

r rate of reaction (kg/m 3 /s) 

/ time (s) 

At time interval (s) 

A/p emptying time (s) 

A/ v venting time (s) 

T absolute temperature (K) 

T„ absolute stagnation temperature (K) 

A T temperature rise (° C) 

(dT/d/) s self-heat rate at set pressure (°C/s) 

u specific internal energy (kj/kg) 

v specific volume (m 3 /kg) 

V volume of vessel (m 3 ) 

W mass flow (kg/s) 

x mass fraction of vapour, or quality 

a void fraction 

P parameter defined by Equation 17.16.10 

H viscosity 

p density (kg/m 3 ) 

it turnaround time for temperature (s) 

co critical flow scaling parameter 


Subscripts 

a atmospheric 

d at disengagement 

ERM equilibrium rate model 

f liquid 

fg liquid-vapour transition 

g gas or vapour 

1 liquid 

L laminar 

m peak pressure 

o initial 

s set point 

T turbulent 

v vapour 


Equation 17.16.6 

At time interval to maximum allowable 

pressure (s) 

A T temperature difference at equilibrium 

between initial pressure and 
maximum allowable pressure (°C) 


Equation 17.16.8 

A T temperature rise corresponding to 

overpressure AP (° C) 

Equations 17.18.2-17.18.3 

AP total available pressure drop (Pa) 

Equation 17.18.7 

A T temperature rise corresponding to 

overpressure AP (°C) 

Equation 17.19.1 

p density of reaction mass (kg/m 3 ) 

Equations 17.19.5 and 17.19.7 

a,j void fraction at disengagement 

a Q initial void fraction 

Equations 17.19.7 and 17.19.8 

At, time to temperature turnaround (s) 


Equation 17.19.12 

Q s peak volumetric gas evaluation rate 

Q, peak volumetric vapour evaluation rate 


Subsection 17.19.10 

At A measured adiabatic rise time (s) 

A/ e measured vessel emptying time (s) 


Subscripts 

LS large scale 

T test 


C pt 

Cpz 

c vt 


Q 

Qt 


W 

P 


vent area 

vent area for zero overpressure 
specific heat of liquid at 
constant volume 
specific heat of liquid at constant 
pressure 

specific heat of gas at constant pressure 
specific heat of liquid at constant 
volume 

base of natural logarithms 

mass velocity of vent flow 

specific enthalpy 

latent heat of vaporization 

mass of material in vessel 

initial mass of material in vessel 

absolute pressure 

heat release rate per unit mass 

heat generation or input rate 

total heat input 

universal gas constant 

volume of vessel 

specific internal energy 

specific volume 

mass flow from vessel 

mass fraction of vapour, or quality 

density 


liquid 

liquid-vapour transition 

vapour 

phase/ 

peak pressure or temperature 
initial 

relief set pressure 
vent inlet 


Section 17.21 

As Section 17.20, plus 

Qg volumetric gas generation rate at 

temperature and pressure in 
reactor during relief 

AT difference in saturation temperature 

between set pressure (as redefined) 
and maximum allowable pressure 
a void fraction 

a d void fraction at disengagement 

a Q initial void fraction 
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Subscript p 

m mean value between set pressure r 

(as redefined) and maximum r a 

allowable pressure x A 


density of air (behind shock front) 
scaled time 
scaled arrival time 
scaled duration time 


Section 17.22 

C 

d 


g 

k 


u A 


Pi 

Pv 

Section 17.24 


A 

F 


g 

h 


Qt 

Q v 


Ps 

Pi 


drag coefficient 
particle diameter (m) 
acceleration due to gravity (m/s 2 ) 
constant 

vapour velocity (m/s) 
dropout velocity (m/s) 
viscosity of gas (cP) 
density of liquid (kg/m 3 ) 
density of vapour (kg/m 3 ) 


radius of vent 
vent area 

flow reduction factor 
acceleration due to gravity 
height 

latent heat of vaporization 

pressure drop through vent system 

set pressure 

total heat input to tank 

energy release rate 

radius of hemisphere 

velocity of vapour through vent 

entrainment velocity 

velocity up vent 

velocity across hemispherical surface 
critical velocity across hemispherical 
surface 

density of vapour 
density of liquid 
surface tension 


Equation 17.24.8 

f? m mass basis gas constant 

Section 17.25 

c„ velocity of sound in air 

i p positive phase overpressure impulse, 

impulse 

z' q dynamic pressure impulse 

4 scaled impulse 

p overpressure 

p a absolute ambient pressure 

(ahead of shock front) 
p° peak overpressure 

p° peak reflected overpressure 

p s scaled pressure 

q dynamic pressure 

q° peak dynamic pressure 

r distance 

4 arrival time 

4 duration of positive phase, duration tin 

4 dynamic pressure duration time 

u particle velocity 

U shock velocity 

W mass of explosive 

z scaled distance 

a decay parameter 

y ratio of specific heats of air 

X yield factor 


Subscripts 

o reference value 


Equation 17.25.5 

4 dynamic pressure impulse (psi/ms) 

R distance (ft) 

W mass of explosive (lb) 


Section 17.26 

h 


P° 

P* 




impulse (Pas) 
scaled impulse (Pas/kg 1/3 ) 
peak overpressure (Pa) 
atmospheric pressure (Pa) 
scaled peak overpressure 
arrival time (s) 
duration time (s) 
mass of explosive (kg) 
scaled distance (m/kg 1/3 ) 
scaled arrival time (s/kg 1/3 ) 
scaled duration time (s/kg 1/3 ) 


Equations 1726.1 and 1726.2 
a, b constants 

Ci constants 

ip impulse (kPa ms) 

p° peak side-on overpressure (kPa) 

4 arrival time (ms) 

duration time (ms) 


U 


parameter defined by Equation 1726.2 


Equations 1726.3-1726.5 
ip impulse (bar/ms) 

p s scaled peak overpressure 

4 duration time (ms) 

W mass of explosive (kg) 

2 scaled distance (m/kg 1/3 ) 


Equations 1726.6-1726.8 
a„ speed of sound in gas (m/s) 

7? ex explosion energy (J) 

4 side-on impulse (Pas) 

7 scaled side-on impulse 

p° absolute pressure of ambient air (Pa) 

p s absolute peak side-on overpressure (Pa) 

Ps scaled peak side - on overpressure 

r distance (m) 

R scaled distance 


Section 17.27 


«i 

Po 

Pi 
Ps 
P s o 


speed of sound (m/s) 
speed of sound in air (m/s) 
speed of sound in compressed gas (m/s) 
absolute pressure of ambient air (Pa) 
absolute initial pressure of gas (Pa) 
absolute peak side-on pressure (Pa) 
scaled peak side-on overpressure at R 0 
effective radius of equivalent 
hemisphere (m) 
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R 0 

Fi 

7i 


scaled distance u 

volume of gas-filled vessel (m 3 ) a 

ratio of specific heats of air p a 

ratio of specific heats of compressed gas <f> 


velocity 
expansion ratio 
density of ambient gas 
velocity potential 


Subscripts 

0 ambient air 

1 compressed gas in vessel 


Section 17.28 

R gas constant 


Subsection 17.28.5 

AAI A relative increase in flame surface area 

Af disturbed flame surface area 

A a undisturbed flame surface area 

n number of obstacles 

p pitch 

r radius of flame front 

r a radius for flame front at entry to 

obstacles 

S burning velocity 

S L laminar burning velocity 

Vf flame front velocity 

Ffi flame front velocity after one obstacle 

F fn flame front velocity after n obstacles 

F fo flame front velocity at entry to obstacles 

F l base value of flame front velocity 

a multiplier 

p gas density 


Subscripts 

b burned 

u unburned 


Subsection 17.28.10 

£tnt energy of explosion of TNT (kj/ kg) 

AH C heat of combustion of hydrocarbon 

(kj/kg) 

W mass of hydrocarbon (kg) 

JFtnt equivalent mass of TNT (kg) 

a yield factor 


Subsection 17.28.17 

a a velocity of sound 

A f effective frontal area of flame 

H height of cloud 

m rate of mass addition 

m rate of change of mass addition rate 

M t flame Mach number 

Af su Mach number in unburned gas 

p absolute pressure 

p dimensionless overpressure 

p 0 ambient pressure 

q dimensionless rate of energy addition 

r characteristic radius of source region 

r t radius of flame 

r obs distance of observer from centre 

of cloud 

S b flame speed 

S u effective burning velocity 

Of velocity of flame front 

F rate of volume addition 

F b specific volume of burned gas 

F u specific volume of unburned gas 

a expansion ratio 

p 0 initial density of gas 

Subscript 

su unburned gas 


Subsection 17.28.18 
a speed of sound 

F parameter defined by Equation 17.28.3 

r radial distance 

r s radial distance of leading shock 

u particle velocity 

U s velocity of leading shock 

X parameter defined by Equation 17.28.3 

Z parameter defined by Equation 17.28.3 


Subsection 17.28.12 

Elgas heat of combustion of hydrocarbon 

(MJ/kg) 

Etnt energy of explosion of TNT (MJ/kg) 

Afg as mass of gas (in confined/congested 

region) (te) 

M tnt mass of TNT (te) 

R distance (m) 

F volume of gas (in confined / congested 

region) (m) 

a yield factor 

Subsection 17.28.16 
a 0 speed of sound 

Mf flame Mach number 

M p piston Mach number 

p absolute pressure 

p dimensionless overpressure 

p 0 ambient pressure 

r radial distance 


Subsection 17.28.19 
a a speed of sound 

K parameter defined by 

Equation 17.28.47b 
p parameter defined by 

Equation 17.28.45 

pi absolute pressure in region i 

r flame radius 

R shock radius 

R 0 initial value of shock radius 

s parameter defined by 

Equation 17.28.45b 
S flame speed 

Ti absolute temperature in region/ 

F velocity 

x parameter defined by Equation 17.28.46 

y parameter defined by 

Equation 17.28.46b 

9 parameter defined by Equation 17.28.47 

Pi density in region i 
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dimensionless time defined by Subscripts 

Equation 17.28.47c 0 initial 

1 final 


Subscripts 

0 undisturbed gas 

1 shocked gas (shell) 

2 burnt gas (core) 


Subsection 17.28.21 

a velocity of sound in normal 

atmosphere 

E energy 

E e explosive energy release 

E„ total energy release 

E„ vapour cloud energy release 

A H c heat of combustion 

m mass of fuel in cloud 

M molecular weight of vapour 

p pressure 

p c pressure at centre of explosion 

r distance from centre of blast symmetry 

R distance from centre of explosion 

to time of termination of rapid energy 

release 

V volume 

e stoichiometric ratio 

r\ explosion efficiency 

v flame speed 


Subsection 17.28.22 

M su Mach number with coordinates relative 

to gases moving ahead of flame front 
M w Mach number with fixed coordinates 


a s) 

parameter (m/J 1/3 ) 

E 

energy content of part of cloud within 
flammable range (J) 

A H c 

heat of combustion (J/kg) 

M e 

mass of fuel in cloud within flammable 
range (kg) 

R(S) 

radius of damage circle (m) 

S 

degree of damage 

n 

fraction of energy released, explosion 
efficiency 

tic 

yield factor relating to stoichiometry 

rim 

yield factor relating to mechanical 
energy 

Section 17.29 

Subsection 17.29.7 

T c 

absolute critical temperature (K) 

T a i 

absolute superheat limit 
temperature (K) 

Subsection 17.29.11 

Pb 

burst pressure 


vessel radius 

R 

radius ratio 

(T u 

ultimate tensile strength 

ay 

yield strength 


Subscripts 



Subsection 17.28.23 
A constant 

c 0 local velocity of sound (m/s) 

E c energy of combustion per unit 

volume (J/m 3 ) 

E„ energy added to unbumed gas during 

combustion process (J) 

L characteristic length (m) 

n number of mols 

P absolute pressure (Pa) 

PS reduced overpressure 

R distance (m) 

R reduced distance 

R g universal gas constant (J/mol K) 

i?o radius of initial cloud (m) 

i?i radius of burned cloud 

t + duration time (s) 

t reduced time 

fb time at which explosion process is 

complete (s) 

T absolute temperature (K) 

TS reduced duration time 

Ugw velocity of shock wave (m/s) 

Ufi average flame speed (m/s) 

V volume (m 3 ) 

y ratio of specific heats of air 

X parameter defined by Equation 17.28.57 


Section 17.30 
Subsection 17.30.4 

C mass of oil mist in air necessary to 

produce explosive mixture at 
atmospheric pressure (g/m 3 ) 
d densityofoil(g/m 3 ) 

D diameter of pipe (m) 

P absolute pressure (atm) 

t thickness of oil film (m) 

Subsection 17.30.6 
As Section 17.29.7 

Section 17.31 

Subsection 17.31.4 
Equations 17.31.1 and 17.31.2 
a acceleration 

A amplitude 

/ frequency 

V velocity 

Equation 17.31.3 

A amplitude (in.) 

d distance (ft) 
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E mass of explosive (lb) 

K constant 

Equation 17.31.4 

Q mass of explosive (kg) 

R distance (m) 

4> 4> value 


Subsection 17.31.5 


diameter of crater (m) 
depth of crater (m) 
mass of explosive (kg) 
volume of crater (m 3 ) 


Equation 17.31.8 

r radius of crater 

W mass of explosive 


Section 17.32 


Subsection 17.32.4 
R resistance function 

R e maximum elastic resistance 

Equations 17.32.32-17.32.34 
/ n natural cyclic frequency 

k elastic constant 

m mass of system 

T n natural period 

co n natural frequency 

Equation 17.32.35 

B breadth of building (ft) 

H height of building (ft) 

T natural period of building (s) 


Equation 17.32.36 
Pm 


T 


blast pressure (N/m z ) 
maximum elastic resistance per 
unit area (N/m 2 ) 
time to yield (s) 
natural period (s) 


Subsection 17.32.1 

B breadth of structure 

C D drag coefficient 

H height of structure 

L length of structure 

p overpressure 

p a maximum value of average side and top 

pressure 

pb maximum value of average back face 

pressure 

Pi drag pressure 

p e effective pressure 

pi overpressure at front face 

p° peak reflected overpressure 

p s stagnation pressure 

q dynamic pressure 

S distance through which pressure relief 

is obtained 

t time 

4 stagnation time 

U shock velocity 


Equation 17.32.37 

x e displacement at elastic limit 

Xf displacement at failure 

H ductility ratio 

Subsection 17.32.5 
F m maximum load 

P m maximum pressure 

x e displacement at elastic limit 

Xf displacement at failure 

x m central deflection 

Subsection 17.32.6 

p° peak overpressure (N/m 2 ) 

Y probit 

Equation 17.32.39a 
k constant 

R average circle radius for specified 

damage category (ft) 

W mass of explosive (lb) 


Subsections 17.32.2 and 17.32.3 
c damping factor 

E k o initial kinetic energy 

E sm maximum strain energy 

/ Coulomb friction force 

/ n natural cyclic frequency 

F applied force 

F* parameter defined by 

Equation 17.32.12 
I impulse 

k elastic constant 

m mass of system 

R restoring force 

T time constant for force decay 

T n natural period 

W m maximum work 

x displacement 

x m maximum displacement 

f damping factor 

t natural period 

o) n natural frequency 


Equation 17.32.39b 
k constant 

R average circle radius for specified 

damage category (m) 

W mass of explosive (kg) 

Section 17.33 


Subsection 17.33.2 
Equation 17.33.1a 

7?b distance for B category damage (ft) 

W mass of explosive (lb) 

Equation 17.33.1b 

7?b distance for B category damage (m) 

W mass of explosive (kg) 

Subsection 17.33.3 

Equation 17.33.2a - as Equation 17.33.1a, 

Equation 17.33.2b - as Equation 17.33.1b 
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Subsection 17.33.4 F 

Ra average circle radius for 

A category damage L 

R n average circle radius for m 

B category damage m t 

i?B average circle radius defined by P a 

Equation 17.33.3 Pi 

R c average circle radius for r 

C category damage s 


Subsection 17.33.5 “ 

Equation 17.33.4 - as Equation 17.33.1b 

Subscript 

Subsection 17.33.6 i 

I impulse 

P pressure Subsection 17.34. 


Equation 17.33.5 — as Equation 17.33.1b plus 
z' modified scaled distance (m/kg 1/3 ) 

Section 17.34 


a„ 

E 

Pex 

M 

P 

Pi 


Subsection 17.34.7 


Mt 

energy stored in vessel per i 


mass of fluid 

K 

geometric factor 

M t 

mass of fluid stored 

M, 

mass of vessel 

u 

velocity of fragment 


Subscript 

i initial 


Subsection 17.34. 

C D 

C l 

Subsection 17.34. 

g 

k 


Subsection 17.34.8 

A mean presented area of fragment 

C D drag coefficient 

m mass of fragment 

u velocity of fragment 

u s velocity of surrounding gas 

p g density of surrounding gas 

Subsection 17.34.9 
As Section 17.4.5 plus 

E k explosion energy imparted 

to fragments 

k parameter defined by Equation 17.34.8 


P 

Subscript 


Equation 17.34.46 

Cd 

k 


Subscript 


Subsection 17.34.11 

a s velocity of sound in gas 

K constant 

M c mass of vessel 

p pressure in vessel 

p a atmospheric pressure 

P m mass basis gas constant 

T absolute temperature of gas 

u velocity of fragment 

Vo volume of vessel 

y ratio of gas specific heats 

Subsections 17.34.12 and 17.34.13 
a 0 speed of sound 

A area of detached portion of vessel wall 


Subsection 17.34. 


parameter defined by 
Equations 17.34.12 and 17.34.13 
length of cylinder 
mass per unit area of vessel wall 
mass of fragment 
atmospheric pressure 
absolute initial pressure in vessel 
radius of vessel 
dimension of fragment 
velocity of fragment 
dimensionless velocity of fragment 


14 

speed of sound in gas at failure 
scaled energy 

energy released in explosion 
mass of vessel 
atmospheric pressure 
absolute initial pressure in vessel 

16 

drag coefficient 
lift coefficient 

17 

acceleration due to gravity 
constant 

velocity along line of flight 
velocity relative to ground 
distance in horizontal direction 
distance in vertical direction 
angle of departure 
angle of return 


initial 


drag coefficient 
constant 

velocity of projectile (ft/s) 
mass of projectile (oz) 
distance travelled by projectile (ft) 


initial 

18 

drag area 
lift area 

drag coefficient 
lift coefficient 
drag force 
lift force 

acceleration due to gravity 
mass of fragment 
range of fragment 
dimensionless range 
velocity of fragment 
dimensionless velocity of fragment 
initial velocity of fragment 
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p density of air 

p 0 initial density of air 

Subsection 17.34.21 

F OI orientation factor 

H height of top of sphere (m) 

L effective range interval (m) 

N number of fragments 

iVpen »N-1 

P probability 

P ri probability that fragment falls within 

effective range interval L 
P st probability of a strike 

P v vessel pressure (barg) 

r radius of sphere (m) 

R range(m) 

P me d median range (m) 

Rpen range of penultimate fragment (m) 

W combined width of target and 

fragment (m) 

Y probit 

9 angle of descent (°) 

Subsection 17.34.24 

a projected area of body (ft 2 ) 

A area per missile (ft 2 /missile) 

A h area of hemisphere on surface of which 

human target is standing (ft 2 ) 
m mass of explosive (ton) 

n near field number of missiles per ton of 

explosive (missiles/ton) 

n e number of missiles at distance R 

P probability of being struck by missile 

R distance (ft) 

W mass of explosive (lb) 

4> 0 correction factor 


h thickness of target panel (m) 

S u ultimate tensile strength of panel (Pa) 

w width of panel (m) 

Subsection 17.34.28 

E r energy to deform sphere in plastic 

region between yield and rupture (kj) 
Et energy to deform sphere up to 

yield point (kj) 

Subsection 17.34.29 

E shock wave energy (J) 

P equivalent static pressure (bar) 

R distance (m) 

Equation 17.34.76 

V volume of enclosure (m 3 ) 

Equations 17.34.77 and 17.34.78 
I impulse per unit area (N/s/m 2 ) 

m mass of wall per unit area (kg/m 2 ) 

V velocity (m/s) 

Equation 17.34.79 

P peak incident overpressure (bar) 


Section 17.35 


Subsection 17.35.3 
F force on disc 

g acceleration due to gravity 

m mass of disc 

x extension 


Subsection 17.34.25 

A presented area of fragment (m 2 ) 

C constant 

d diameter of fragment (m) 

K constant 

m mass of fragment (kg) 

«i, w 2 indices 

t thickness of barricade to just stop 

fragment (m) 

u velocity of fragment (m/s) 

Subsection 17.34.26 

d diameter of missile (m) 

D calibre density of missile (kg/m 3 ) 

e perforation thickness (m) 

G parameter defined by 

Equations 17.34.68—17.34.70 
m mass of missile (kg) 

V velocity of missile (m/s) 

F p perforation velocity (m/s) 

x penetration depth (m) 

p density of concrete (kg/m 3 ) 

<s c compressive strength of concrete (Pa) 

Subsection 17.34.27 
d diameter of missile (m) 

E c critical impact energy of missile G) 


Subsection 17.35.5 
e strain 

U energy adsorbed (G) 

p density of steel (kg/m 3 ) 

ay yield stress (N/m 2 ) 

Equations 17.35.1—17.35.3 
F applied force (N) 

l length of pipe stretched (m) 

U energy absorbed G) 

d elongation (m) 

9 angle of bend (rad) 

<p plastic moment (N/m) 


Equations 17.35.4 and 17.35.5 
L length of cut (m) 

t thickness (m) 


Equation 17.35.6 

e p strain behind plastic wave front 

v imparted velocity (m/s) 

o-g tensile stress (N/m 2 ) 


Equation 17.35.7 


velocity of elastic compression wave in 
steel (m/s) 

velocity of impact of missile (m/s) 
compressive stress caused by 
impact (N/m 2 ) 
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Equation 17.35.8 

V c volume of cavity (m 3 ) 


Section 17.36 

Subsection 17.36.2 

B, R r constants 

m mass of nth fragment 

M(n ) cumulative mass of fragments 

M 0 total mass of fragments 

M oB modified total mass of fragments 

n number of nth largest fragment 

X, X B constants 

Subsection 17.36.3 

D velocity of detonation 

« 0 initial velocity of fragments 

<j) angle beween initial trajectory of 

fragment and axis of tube, 
Taylor angle 


Equations 17.36.13-17.36.15 
A coefficient of area 

A m mean area presented by fragment 

in flight (ft 2 ) 

Q fragment volume (ft 3 ) 

u velocity of fragment (ft/s) 

u a velocity of fragment at commencement 

of air drag (ft/s) 

« s velocity of sound (ft/s) 

w mass of fragment (oz) 

* distance (ft) 

Equations 17.36.16 and 17.36.17 

a diameter of sphere or side of cube (m) 

A s effective area of fragment (m 2 ) 

C a drag coefficient 

m mass of fragment (kg) 

u velocity of fragment (m/s) 

u 0 initial velocity of fragment (m/s) 

x distance (m) 

p a density of air (kg/m 3 ) 


Subsection 17.36.4 
Equation 17.36.6 

C mass of cylindrical case per unit 

length (lb) 

E mass of charge per unit length (lb) 

V 0 initial velocity of fragments (ft/s) 

Equations 17.36.7 and 17.36.8 
C mass of explosive (kg) 

Cg Gurney velocity, Gurney constant (m/s) 

A E internal energy per unit mass of 

explosive (J/kg) 

M mass of cylindrical section of 

casing (kg) 

u a initial velocity of fragments (m/s) 

Equations 17.36.9 and 17.36.10 
C G Gurney velocity (km/s) 

M average molecular weight of products of 

explosion 

N number of moles of gas produced 

by explosion 

Q heat of detonation (cal /g) 

p 0 explosive loading density (g/cm 3 ) 

4> parameter defined by Equation 17.36.10 


Subsection 17.36.5 
Equation 17.36.11 


mass of fragment (oz) 
distance travelled (ft) 
velocity of fragment (ft/s) 
velocity of fragment at commencement 
of air drag (ft/s) 
velocity of sound (ft/s) 


Equation 17.36.12 

A 

k 


area of fragment 
constant 

velocity of fragment 
velocity of fragment at commencement 
of air drag 
mass of fragment 
distance 


Equation 17.36.23 

r safety distance (m) 

W mass of explosive (kg) 

Subsection 17.36.8 

A p projected area of exposed person (ft 2 ) 

A v vulnerable area (ft 2 ) 

n number of incapacitating fragments 

N average number of incapacitating 

fragments at distance* 

p probability of being hit by one or more 

incapacitating fragments 

q number of fragments of equivalent 

velocity v 
at distance* 

r proportion of fragments of equivalent 

velocity v at distance * capable of 
causing 
incapacitation 

u velocity of fragment (ft/s) 

* distance (ft) 


Section 17.38 

C D drag coefficient 

i impuse (Pas) 

i scaled impulse (Pa 1/2 s/kg 1/3 ) 

m mass of body (kg) 

p° peak incident overpressure (Pa) 

p 3 atmospheric pressure (Pa) 

PI peak applicable overpressure for lung 

injury (Pa) 

PI scaled peak applicable overpressure for 

lung injury 

p° peak reflected overpressure (Pa) 

q dynamic pressure (Pa) 

q° peak dynamic pressure (Pa) 

Y probit 

Equations 17.38.9 and 17.38.10 
S damage number 


Equations 17.38.11 and 17.38.13 
/ impulse (Pa s) 
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p incident overpressure (Pa) 

ti duration time (s) 

Equations 17.38.13-17.38.16 
A projected area of body (m z ) 

F force acting on body (N) 

fq dynamic pressure impulse (Pas) 

l q dynamic pressure duration (s) 

V velocity imparted to body (m/s) 


Equations 17.40.5 and 17.40.6 

7lj 0 mean frontal area fragment (cm 2 ) 

m mass of fragment (g) 

PI* peak effective overpressure (kPa) 

Equation 17.40.8 

A mp mean presented area of fragment on 

impact (m 2 ) 

t thickness of glass, fragment (cm) 


Equations 17.38.17-17.38.21 
A projected area of body (ft 2 ) 

F deceleration due to friction (ft/s 2 ) 

L loading on body (lbf) 

M mass of body (In) 

P e effective pressure on body (lb f /in. 2 ) 

t time (s) 

u velocity of body (ft/s) 

x distance travelled by body (ft) 

a acceleration coefficient (ft 2 /lb) 

Equations 17.38.22 and 17.38.23 
L loading (N) 

m mass of body (kg) 

t time (s) 

u velocity of displacement (m/s) 

fa deceleration due to friction (m/s 2 ) 


Equations 17.40.9 and 17.40.10 

p° e ' peak effective overpressure (psi) 

V thickness of pane (in.) 

Eg 0 geometric mean velocity of 

fragment (ft/s) 

Eg 0 scaled geometric mean velocity of 

fragment (ft/s) 

Equations 17.40.12 and 17.40.13 
t* thickness of pane (cm) 

%o scaled geometric mean velocity of 

fragment (m/s) 

Equation 17.40.14 

PI* peak effective overpressure (kPa) 

u average velocity of fragments (m/s) 


Equations 17.38.24—17.38.30 
S injury factor 

Equation 17.38.31a 

d distance for 50% casualties (ft) 

d T distance for 50% casualties for 1 kt 

explosion (ft) 

W yield of a nuclear explosion (kiloton) 

Equation 17.38.31b 

d distance for 50% casualties (m) 

d T distance for 50% casualties for a 1 kte 

explosion (m) 

W mass of explosive (te) 


Section 17.40 


Subsections 17.40.3-17.40.5 

;a of pane (m 2 ) 


presented area of fragment (m 2 ) 
mean presented area of fragment (m 2 ) 
mean frontal area of fragment (m 2 ) 
length of long side of fragment (m) 
mean mass of fragment (kg) 
breaking pressure (kPa) 
peak incident overpressure (Pa) 
peak effective overpressure (Pa) 
thickness of glass, fragment (m) 
velocity of fragment (m/s) 
velocity of fragment (ft/s) 
probit 

density of glass (kg/m 3 ) 


Equation 17.40.15 

t thickness of glass, fragment (m) 

u average velocity of fragments (m/s) 

Pg r breaking pressure (kPa) 


Subsection 17.40.6 

A presented area of fragment (m 2 ) 

^50 geometric mean frontal area of 

fragment (m 2 ) 

M mass of fragment (kg) 

P e peak effective overpressure (Pa) 

P a atmospheric pressure (Pa) 

P r peak reflected overpressure (Pa) 

P s dimensionless peak reflected 

overpressure 

P s peak side-on overpressure (Pa) 

P s dimensionless peak side-on 

overpressure 

t thickness of pane, fragment (m) 

u 50 geometric mean velocity of 

fragment (m/s) 

y length of square edge of fragment (m) 

p g i density of glass (kg/m 3 ) 


Subsection 17.40.7 

PI* peak effective overpressure (kPa) 

p si spatial density of fragments 

(fragments/m z ) 

p' d scaled spatial density of fragments 

t glass thickness (cm) 


Superscripts 

50 geometric mean 

~ (overbar) scaled 


Subsection 17.40.9 

m mass of fragment (g) 

u' velocity of fragment (ft/s) 

Y probit 
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Subsection 17.40.10 

A presented area of missile (m 2 ) 

C D drag coefficient 

/ impulse (Pa s) 

M mass of missile (kg) 

Ui impact velocity (m/s) 

Y probit 


Subsection 17.40.11 

A presented area of fragment (m 2 ) 

M mass of fragment (kg) 

u 50 velocity for 50 % probability of 

perforation (m/s) 


Subsection 17.40.12 

a 

smaller of two dimensions of pane (m) 

A 

area of pane (m 2 ) 

d 

thickness of pane (m) 

hi 

dynamic load factor 

ft 

tensile strength of pane (Pa) 

po 

peak incident overpressure (Pa) 

Pdf 

dynamic failure load (Pa) 

p st 

static strength of pane (Pa) 

td 

duration time (s) 

T 

natural period of vibration (s) 

Section 17.41 

Subsection 17.41.24 

c 

index 

E 

kinetic energy (J) 

m 

mass of fragment (kg) 

u 

velocity of fragment (m/s) 


Subsections 17.42.4 and 17.42.5 
Equation 17.42.18: 


a, b constants 

A proj ected area of fragment (cm 2 ) 

m mass of fragment (g) 

u velocity of fragment (m/s) 

Equations 17.42.19 -17.42.22 
A proj ected area of fragment (m 2 ) 

m mass of fragment (kg) 

u velocity of fragment (m/s) 


Section 17.44 


ES 

IE 

IS 

K a 


K st 

l 

m si 


MEC 

MEP 

MIE 

MIT 

MRPR 

P 

Pm ax 
Po 

Pi 

P2 

V 

<Ps 


concentration (g/m 3 ) 
explosion severity 
index of explosibility 
ignition sensitivity 
gas explosibility constant, if G value 
dust explosibility constant, K st value 
lower explosive limit (g/m 3 ) 
mass concentration of 

solvent-contaminated dust (g/m 3 ) 
minimum explosive concentration 
maximum explosion pressure 
minimum ignition energy 
minimum ignition temperature 
maximum rate of pressure rise 
absolute pressure 
maximum explosion pressure 
atmospheric pressure 
small initial pressure rise 
pressure defined in Figure 17.114 
volume of vessel (m 3 ) 
mass fraction of solvent in 
solvent-contaminated dust 


Subsection 17.41.4 
b, c indices 

k constant 

m mass of fragment (mg) 

m r mass of reference fragment (mg) 

P penetration (ft) 

u velocity of fragment (ft /s) 


Subscripts 

d 

dh 


dust 

dust in presence of flammable gas, 
hybrid 

Pittsburgh coal 
sample 


Equations 17.41.7 and 17.41.8 
m mass of fragment (kg) 

u velocity of fragment (m/s) 

Y probit 

Section 17.42 

See notation lists given in text, plus: 
i body region counter 


Section 17.46 

C 0 maximum permissible oxygen 

concentration for carbon dioxide 
inerting 

N 0 maximum permissible oxygen 

concentration for nitrogen inerting 

Section 17.48 

(See text for units in particular equations) 


Subsection 17.42.2 

A total mean presented area of body 

Ai mean presented area of body 

attributable to region i 


Subsection 17.48.6 

A vent area 

/ vent ratio, Ar/F 

V volume of enclosure 


Subsection 17.42.3 

A projected area of fragment (m 2 ) 

m mass of fragment (kg) 

u velocity of fragment (m/s) 

X causative factor (G/m 2 ) 


Subsection 17.48.7 

A c area of smallest cross-Section of 

enclosure 

K vent coefficient, AJ A v 

Li, Z-2 two smallest dimensions of enclosure 
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Subsection 17.48.8 


A, 

c d 

coefficient of discharge 

K st 

dust explosibility constant, K st value 

M 

molecular weight of vented gas 

P 

pressure 

P a 

atmospheric pressure 

(diWdfWvL 

maximum rate of pressure rise in 
unvented test vessel 

(dPex/d/J^VL 

maximum rate of pressure rise in 
vented test vessel 

Pred 

reduced pressure 

P s tat 

vent opening pressure 

R 

universal gas constant 

T 

absolute temperature of vented gas 

V 

volume of vessel 

v L 

volume of test vessel 

Subscripts 


reduced 

VL 

test vessel 

Equations 17.48.9 and 17.48.10 


constant 

A w 

vent area (m 2 ) 

b,c 

indices 

K st 

dust explosibility constant, 

K st value (bar m/s) 

Pred 

reduced pressure (barg) 

P s tat 

vent opening pressure (barg) 

V 

volume of vessel (m 3 ) 

Equation 17.48.11 

a, b 

constants 

C 

constant 

d 

index 

Pred 

reduced pressure (barg) 

Pstat 

vent opening pressure (barg) 

V 

volume of vessel (m 3 ) 

Equation 17.48.12 

B 

parameter 

K st 

deflagration index (bar m/s) 

Pred 

reduced pressure after venting (bar) 

V L 

volume of test vessel 


Subsection 17.48.9 

Equations 17.48.13a, 17.48.14a and 17.48.14b 
A maximum pressure in unvented 

explosion (psi) 

K slopeof lineof-AvsX 

(dP/df) max maximum rate of pressure rise 

(AP/df) av average rate of pressure rise 

X vent ratio (ft/100 ft 3 ) 

Y reduced pressure in vented 

explosion (psi) 

Equations 17.48.13b, 17.48.15a and 17.48.15b 

/ vent ratio 

k av constant 

& max constant 


P red 

P max 

(dP/df) av 

(dP/df) max 

S 


maximum pressure invented explosion, 
reduced pressure 
maximum pressure in unvented 
explosion 

average rate of pressure rise 
maximum rate of pressure rise 
constant 


Subsection 17.48.10 

A c 

area of smallest cross-Section of 
enclosure 

A r 

vent area 

C 

Runes constant 

A P 

explosion overpressure 

Subsection 17.48.13 

K f 

constant 

P 

absolute pressure 

Pa 

atmospheric pressure 

(dP ex /df)p irf , v 

maximum rate of pressure rise in 
vented vessel 

(dP ex /df) Pica , VL 

maximum rate of pressure rise in 
vented test vessel 

V 

volume of vessel 

V L 

volume of test vessel 

P 

density of gas mixture 

Subscripts 

ex 

closed vessel explosion 

Pred 

reduced pressure 

V 

vessel 

VL 

test vessel 

Subsection 17.48.14 

A v 

vent area 

Cd 

coefficient of discharge 

Gy 

mass velocity through vent 

K 

constant 

p 

absolute pressure 

Po 

atmospheric pressure 

Pc 

absolute pressure when rate of pressure 
rise is at its maximum 

V 

volume of vessel 

p 

density of gas 

Pc 

density of unburned gas at P 0 or 
density of combustion products at P c 

Po 

density of gas at atmospheric 
pressure 

Subscripts 


average 

c 

at maximum rate of pressure rise 

Subsection 17.48.15 

A v 

vent area 

F 

shape factor 

k 

constant 

Kb 

explosion parameter 

P 

absolute pressure 

Pmax 

absolute maximum explosion 
pressure 

Pred 

reduced pressure (gauge) 
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u velocity of flame front 

V volume of vessel 


W mass of explosive 

2 scaled distance 


Subsection 17.48.16 

As Section 17.12.25 


Subscript 

r reference value 


number of fatalities 
mortality index 
radius 

mass of explosive 

Section 17.52 


Subsection 17.52.2 

I mass of vapour in cloud (te) 

k* constant 

p° peak overpressure (bar) 

r distance (m) 

r c radius of cloud (m) 

7?lfl distance to LFL (m) 


Section 17.51 

/ 

MI 

W 


Subsection 17.52.1 
n index 

p° peak overpressure 

r distance 
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The third of the major hazards, after fire and explosion, is a 
release of a toxic chemical. The hazard presented by a toxic 
substance depends on the conditions of exposure and on 
the chemical itself. It ranges from a sudden brief exposure 
at high concentration to prolonged exposure at low con¬ 
centrations over a working lifetime. 

Both these situations present serious hazards. A very 
large release of a toxic chemical such as chlorine under the 
most unfavourable conditions is usually regarded as hav¬ 
ing a disaster potential greater than that of fire or explo¬ 
sion. However, a large toxic release is a much less frequent 
occurrence than a large fire or explosion. 

The First Report of the ACMH (Harvey, 1976) states: 

With toxic materials, the sudden release of very large 
quantities could conceivably cause even larger numbers 
of casualties than a flammable escape. In theory such a 
release could, in certain weather conditions, produce 
lethal concentrations in places 20 miles from the point of 
release but the actual number of casualties (if any) would 
depend on the population density in the path of the cloud 
and the effectiveness of the emergency arrangements 
that might include evacuation. 

In a quite different way the long-term toxic effects of 
exposure at even low concentrations of certain chemicals 
over a working lifetime can also affect large numbers of 
people. 

The aspects of the problem considered here are the 
general effects of toxic substances, the limit values set for 
these, the effects of particular toxic chemicals and the 
assessment and control of the hazard of toxic releases. The 
treatment here is complemented by the account of occupa¬ 
tional health given in Chapter 25. 

Reference was made in Chapter 3 to the establishment by 
the Government of the Advisory Committees on Dangerous 
Substances (ACDS) and on Toxic Substances (ACTS) to 
advise the Health and Safety Commission (HSC). The terms 
of reference of both committees include toxic substances. 

It cannot be too strongly emphasized that the assessment 
of the effect of toxic chemicals is a medical matter and that 
it is essential that the engineer seek expert advice on medi¬ 
cal aspects such as interpretation of limit values and 
assessment of long-term effects. 

Selected references on toxicology and toxic chemicals 
and on toxic release are given in Tables 18.1 and 18.2, 
respectively. 


18.1 Toxic Effects 

The treatment of toxic effects given here deals both with 
acute and chronic effects, but it is necessarily a brief one. 
Sources of information on the toxicity of chemicals are 
given in Section 18.3, and for carcinogens, in Section 18.7. 

The effects of toxic substances are described in treat¬ 
ments of occupational diseases such as Occupational Dis¬ 
eases and Industrial Medicine (R.T. Johnson and Miller, 
1960), Diseases of Occupations (Hunter, 1975), National 
Occupational Exposure Survey (NIOSH, 1974—/3), Occupa¬ 
tional Diseases — A Guide to Their Recognition (NIOSH, 
1977/4), A Guide to Work-relatedness of Disease (NIOSH/5, 
1979), Recognition of Health Hazards in Industry (Burgess, 
1981 ACGIH/5), Chemical Exposure and Disease by 
Sherman (1988 ACGIH/16) and Work Related Lung Disease 
Surveillance Report (NIOSH, 1991/20). 


Table 18.1 Selected references on toxicology and 
toxic chemicals 


MCA (SG-1); Anon. (1948); J.H.F. Smith (1956); Hunter 
(1959,1975); H.H. Fawcett (1965f, 1982f,g); Watkins, Cackett 
and Hall (1968); Kinnersly (1973); Presidents Science 
Advisory Committee, Panel on Chemicals and Health 
(1973); Stellmann and Daum (1973); Gadian (1974,1978); 
HSE (1977 EH 18); M.L. Miller (1977); Lippmann and 
Schlesinger (1979); Shapo (1979); D.J. Hughes (1980) 

Toxicology, toxicity assessment 
Lehmann and Flury (1938); Gilman and Cattell (1948); 
Patty (1948—); Hodge and Sterner (1949); Brodie (1956); 
Specter (1956a); Fairhall (1957); Elkins (1959); W.M. Grant 
(1962); Warren etal. (1963); E. Browning (1965); 

H.H. Fawcett (1965d,f); Foulger (1965); Deichman and 
Gerarde (1969); Sunshine (1969,1978); Paget (1970,1978); 
Wilcox (1970); Ames (1971); Havener (1971); Ames etal. 
(1973); P. Cooper (1974); Hemsworth (1974); Loomis (1974); 
Stolz etal. (1974); Casarett andDoull (1975); Hunter (1975); 
Blackadder (1976); J.T. Carter (1976,1980); Plunkett (1976); 
Duncan (1977); Funes-Cravioto etal. (1977); Clayton and 
Clayton (1978,1981,1982); Food Safety Council (1978); 

The Royal Society (1978); M. Sherwood (1978); M.J. Wallace 
(1978); WHO (1978); Cralley and Cralley (1979,1983); 
Patrick (1979); Eschenroederef«/. (1980); M. Stephenson 
(1980); Neuman and Benashki (1981); A.L. Reeves (1981); 
H.J. Rogers, Spector and Trounce (1981); Tu (1981 -); Wands 
(1981); Anon. (1982a); Crouch and Wilson (1984); Hymes 
(1984); Jameson and Walters (1984); Walters and Jameson 
(1984); Albert (1985); Baxter (1985); Environ Corporation 
(1986,1989); Klaassen, Amdar and Doull (1986); 
Matthiessen (1986); Klimisch etal. (1987); Springer (1987); 
ACGIH (1988/26,1990/46); Hayes (1989); T. Robinson and 
Yodaiken (1989); R.M. Turner and Fairhurst (1989a); 
Alexeeff, Lewis and lipsett (1992); Bosch (1992) 

Toxicity testing 

WHO (EHC 6); Goldberg (1974); Christopher (1978); Dewey 
(1978); M. Sherwood (1978); Smythe (1978); Anon. (1982a); 
Kolbere/aZ. (1983); Patrick (1983); Rodricks andTardiff 
(1984a);Walters and Jameson (1984); Anon. (1986a); 
ten Berge, Zwart and Appelman (1986); Kletz (1987e); 
ten Berge and Zwart (1989) 

Epidemiology 

Acheson (1967,1979); J.P Fox, Hall and Elvaback (1970); 
Lowe and Kostrzewski (1973);Tsuchiya, Okubo and Ischizu 
(1975); Alderson (1976); Duncan (1977,1979); Wynder and 
Gori (1977); Registrar General (1978); Harrington (1979, 
1980a); Lawther (1979); Monson (1980); Acheson and 
Gardner (1981); A.J. Fox (1981); Ryan (1981); Clary, Gibson 
and Waritz (1983); Leese and Jones (1983); Neal and Gibson 
(1984); CONCAWE (1991,91/53); ACGIH (1992/79) 

Toxic load-response 

Bryan and Shimkin (1945); B.C. King (1949); J.M. Brown 
(1976); Liddell, McDonald and Thomas (1977); Hewitt (1978); 
M.W. Anderson, Hoel and Kaplan (1980); Krewski and van 
Ryzin (1981); Hoel, Kaplan and Anderson (1983); C.C. Brown 
(1984); Ride (1984b); Snyder (1984); Anon. (19861); 
ten Berge, Zwart and Appelman (1986); Zwart etal. (1988) 

Toxicokinetic modelling 

Dominguez (1933); E. Nelson (1961); J.G. Wagner (1975); 
Tuey (1980); Muller and Barton (1987) 
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Human and animal physiology 

Oilman etal. (1948); Farris and Griffiths (1949); Specter 
(1956b); R.T. Williams (1959); Oser (1965); Altaian and 
Dittmer (1961,1968,1971,1974); Weibel (1963); Munro 
(1969); Zenz (1975); Mitruka and Rawnsley (1977); Parke 
and Smith (1977); J.B.West (1977); Altaian and Katz (1979); 
Waldron (1979,1989); Harrington and Waldron (1980); 
Schroter and Lever (1980); Waldron and Harrington (1980); 
Ganony (1983); Lindberg, Dolata and Merke (1987) 

Statistical interpretation 

Trevan (1927); Bliss (1934,1935,1952,1957); Bliss and 
Cattell (1943); Finney (1971) 

Animal models, extrapolation between species 

Freirech etal. (1966); Rail (1970); S.B. Baker,Tripod and 
Jacob (1970); Hushon and Ghovanlou (1980); Paddle (1980); 
Purchase (1980); Oser (1981);Task Force of Past Presidents of 
the Society of Toxicology (1982); C.C. Brown (1984); Menzel 
and Smolko (1984); N. Nelson (1984); Rousseaux (1987) 

Toxic risk assessment 

NAS/NRC (1973b); Zeller (1979); Ruschena (1980); 

US Congress, OTA (1981); Totter (1982); Rodricks and 
Tardiff (1984b); Bridges (1985); Clayson, Krewski and 
Munro (1985) 

Toxics control policy 

Anon. (1981k); Pittom (1978); Relio (1978); C.R. Pearson 
(1982); Barnard (1984); Corn and Corn (1984); Deisler 
(1984a,b); Gough (1984); Karrh (1984); Lowrance (1984); 
Neal and Gibson (1984); Rijkels (1984); Rodricks and 
Tardiff (1984); Doull (1987); Rodricks and Taylor (1989); 
Cote and Wells (1991); Fairhurst and Turner (1993) 

Process design and handling 

Halley (1965); Prugh (1967); J.R. Hughes (1970); Constance 
(1971a); Gage (1972); Schaper (1973); Kusnetz (1974);Wirth 
(1975); J.T. Carter (1976,1980); Garner (1976); Weissbach 
(1976);Toca (1977); Payne (1978); S.D. Green (1980); IBC 
(1982/27); Cralley and Cralley (1983); First (1983); Kusnetz 
and Phillips (1983); Kusnetz and Lynch (1984); Carson and 
Mumford (1986 LPB 67); Anon. (1989 LPB 86, p. 19); Jackson 
(1989 LPB 87); Desai and Buonicore (1990); Grossel (1990a); 
Doerr and Hessian (1991); Chadha and Parmele (1993) 

Workplace exposure, environmental control, 
exposure monitoring; analytical methods (see 
Table 25.1) 

Toxics detection and alarm 

D. Doyle (1971); ACGIH (1972); Eckstrom (1973); Blears and 
Coventry (1974); Johanson (1974,1976); Visanuvinol and 
Slater (1974); Dailey (1976);Thain (1976); Lichtenberg and 
McKerlie (1979); Warncke (1977); Ricci (1979a); Ellgehausen 
(1980); Cullis and Firth (1981); Rooney (1986); J.M. Rogers 
(1988); Thompson, Sekula and Whitson (1992) 

Hygiene standards, threshold limit values, 
occupational exposure limits 

ACGIH (n.d./l-3,1992/78,80); Elkins (1939);Bowditch etal. 
(1940); Anon. (1962a); Associated Octel Co. (1972 Bull. 24); 
ASTM (1973 DS 48); Levinson (1975); Ferguson (1976); HSE 
(1976 TDN2/73,1993, EH 64, EH 65/4, EH 65/6,1994 EH 40); 
Henschler(1979);Lauwerys(1983);IBC(1984/56);CIA(1985 
PA23); P. Lewis (1985a, 1986a,b); Skinner (1985); AIH A 
(1987/12); Anon (1990h); ILO (1991/2);Weisburger (1994) 


MAKWerte: Henschler (1979); Deutsche Forschungsgemein- 
schaft (1982); German Commission for Investigation of 
Health Hazards in the Workplace (1994) 

Emergency exp !>);Siccama 

(1973); CPD (1974); Balemans (1975); Eisenberg, Lynch and 
Breeding (1975); AIHA (1988-/13); ECIETOC (1991); 
Rusch (1993) 

HSE limit system: Fairhurst and Timer (1993) 

Dow Chemical Exposure Index: RA Smith and Miller 
(1988); Dow Chemical Co. (1994a) 

(ASTM 164,1973 DS 48); Leonardos, Kendall and Barnard 
(1969);Turk (1969); ASTM (1973 DS 48);Turk, Johnston and 
Moulton (1974); Cheremisinoff and Young (1975); Fazzalari 
(1978); Eugen (1982); Polak (1983); Lynskey (1984 LPB 60); 
J.C. Stevens, Cain and Weinstein (1987); AIHA (1989/17); 
CCPS (1989/4); R.M. Turner and Fairhurst (1989a); 
MacFarlane and Ewing (1990); ACDS (1991); deWeger, 
Pietersen and Reuzel (1991); CPD (1992b) 

Toxicity of chemicals 

Browning (n.d.a.b, 1965); HSE (Appendix 28 inc. 
Toxicology of Substances, MS,TON and TR series, SIR 21); 
MCA (1952—, SD series, 1972/21); Merck (1889); Flury and 
Zernick (1931); Brookes (1948); Patty (1948-); Sax (1957-); 
Matheson Co. (1961); C.H. Gray (1966); BCISC (1968/8); 
Skinner (1962); Braker and Mossman (1970); G.D. Muir 
(1971); Kinnersly (1973); National Library of Medicine 
(1974); Sumi andTsuchiya (1976); Binns (1978); Skole (1978); 
Sittig (1979,1981,1994); Deutsch (1981); CONCAWE (1984 
84/54,1986 86/69); A. Allen (1988); Walsh (1988); van Loo 
and Opschoor (1989); Merck Co. (1989); Meyer (1989); 
NIOSH (1990/18); Franklin (1991); OSHA (1991/7); Kellard 
(1993); Tyler et al. (1994) 

Carcinogens 

HSE (TON series, 1973 TON 3,1983 MS(B) 5); OSHA 
(n.d./2, OSHA 2220,1977); Public Health Service (1941-); 
Bryan and Shimkin (1945); MCA (1952-, SD series); 
Hunter (1959,1975); Mantel and Bryan (1961); Munn (1963); 
Surgeon Generals Advisory Committee on Smoking and 
Health (1964); J.A. Miller (1970); Ames (1971); J.G. Wilson 
(1971); Ad Hoc Committee on the Evaluation of Low Levels 
of Environmental Carcinogens (1972); Gadian (1972); IARC 
(1972—, 1979a, 1980); Abelson (1973); Ames etal. (1973); 
Hollaender (1973); Goldberg (1974); Ricci (1974,1976a,b, 
1977a); Tso and di Paulo (1974); Cairns (1975,1981); 

R. L. Carter and Roe (1975); Environmental Mutagen 
Society (1975); Fraumeni (1975); Hoover and Fraumeni 
(1975); McCann etal. (1975-); Cinkotai etal. (1976); A.J. Fox 
and Collier (1976); Mehlman, Shapiro and Blumenthal 
(1976); Searle (1976-); Baxter etal. (1977); Boyland (1977); 
Doll (1977,1979); Kraybill and Mehlman (1977); Schirripa 
(1977); Wynder and Gori (1977); Ashby and Styles (1978); 

S. S. Epstein (1978); Rawson (1978); Tarr and Damme (1978); 
Bowman (1979,1982); B.E. Butterworth (1979); Doll and 
McLean (1979); Fairchild (1979); Fishbein (1979); Garner 
(1979); Grasso (1979); Higginson and Muir (1979); OSTP 
(1979); Peto (1979,1980); P.P. Scott (1979); Sullivan and 
Barlow (1979,1982); Vogel (1979); M.W. Anderson, Hoel and 
Kaplan (1980); ASTM (1980); Purchase (1980); Cairns (1981); 
CIA (1981,1992 RC45); Doll and Peto (1981); S.E. Epstein 
and Swartz (1981); IBC (1981/14); A.E. M. McLean (1981); 
Sax (1981); C.R. Shaw (1981); Sontag (1981); Squire (1981); 
US Congress, OTA (1981); Anon. (1982n); Magnus (1982); 
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de Serres and Shelby (1982); Soderman (1982); Stich 
(1982—);Totter (1982); Bootman (1983); CBI (1983); Doyal 
and Epstein (1983); Hoel, Kapland and Anderson (1983); 
Barnard (1984); Corn and Corn (1984); Deisler (1984a,b); 
Gough (1984); Higginson (1984); Karrh (1984); Kirsch- 
Volders (1984); Kusnetz and Lynch (1984); Lowrance (1984); 
Neal and Gibson (1984); Rijkels (1984); Sagan and Whipple 
(1984); Crump and Crockett (1985); Wolf (1985); Blackburn 
and Kellard (1986); Anon. (19861); CIA (1987 RC5); 
Tancrede et al. (1987); HSE (1990 EH 58,1992 EH 62) 
Benzene: Thorpe (1974,1978a,b); NIOSH (1976 Publ. 
74-137); Infante et al. (1977a,b); Laskin and Goldstein 
(1977); Kohn (1977b); Tabershaw and Lamm (1977); 
Pagnotto, Elkins and Brugsch (1979); Cahan (1980); 
Rushton and Alderson (1981); HSE (1982 TR 4); M.C.White, 
Infante and Chu (1982); ACGIH (1989/28); Foo (1990); HSE 
(1992 MS (A) 13); IP (1993 TP 25,26) 

Formaldehyde: HSE (1981 TR 2); Clary, Gibson and Waritz 
(1983); Starr (1983) 

Vinyl chloride: OSH A (OSH A 2225); Viola (1970); Schaper 
(1973); Anon. (1974j); HM Chief Inspector of Factories 
(1974); BCISC (1974/14); Creech and Johnson (1974); Anon. 
(1975o); CIA (1975/8); Creech and Makk (1975); EPA 
(1975b,c); HSE (1975b, 1992 EH 63); Heath, Falk and Creech 
(1975); Lilis etal. (1975); Maltoni and Lefemine (1975); 
Nicholson etal. (1975); Selikoff and Hammond (1975); 
Veltman etal. (1975); Baxter etal. (1977); H.M. Clayton 
(1977); Meade and Press (1977); Stafford (1977);Tarpa 
(1977); Atherley (1978); Doniger (1978); Gehring,Watanabe 
and Park (1979); McPherson, Starks and Fryar (1979); 
Anon. (1980x); Conaway, Davenport and Norstrom (1980); 
Anon. (1984z); Rijkels (1984); Barr (1986);Wolf, Holl a nd 
Rajaratnam (1987) 

Dusts 

HSE (TON 14,1976 TON 1,1979 EH 21,1990 EH 46,1991 EH 
44,1992 EH 59,1993 EH 66,1994 CRR 62); Stairmand 
(1951); C.N. Davies (1954); Bamford (1961); Owen (1974); 

T. Allen (1975); Batel (1976); Munns (1977); Kaye (1981); 
Vincent and Marks (1981); Bridgwater (1983); Orleman etal. 
(1983); Sexton, Spengler and Treitman (1984); BOHS (1985 
TG5,1987 TG7); D.M. Muir (1985); ACGIH (1987/13, 
1988/18); Lloyd (1987); Mody and Jakhete (1988); Rood 
(1992a,b); Stanley-Wood and Lines (1992) 

Silica dusts: HSE (1992 MS (A) 15) 

Organic dusts: HSE (1977 MS 4); VDI2263 Pt 1:1990 
Asbestos: HSE (Appendix 28 Asbestos, MA 4,TON 42,1970 
HSW Bklt 44,1974 TON 13,1975 TON 24,35,1982 RP18, 
1984 IND(G) 17(L), 1985 EH 41,1986 Research Review 3, 
1988 EH 50, MS 13,1989 EH 35,37,51,1990 EH 10,36,47, 
1993 EH 57); Oliver (1902); Doll (1955); J.C. Wagner (1960); 
Gadian (1967); Elmes and Simpson (1971,1977); Langlands, 
Wallace and Simpson (1971); Wallace and Langlands (1971); 
DoEm (1974/4); Parliamentary Commissioner (1975-76); 
Edge (1976); Fulmer Research Institute (1976); Harries 
(1976); W.P. Howard (1976); Kinnersly (1976); Lumley (1976); 
D.C.F. Muir (1976); Selikoff, Churg and Hammond (1976); 
Tait (1976); European Commission (1977); NIOSH (1977 
Crit. Doc. 77-169); Woolf (1977); Cavaseno (1978c); HSC 
(1978a,b); Peto (1978); Savage (1978); British Society for 
Social Responsibility in Science (1979); Pye (1979); Carton 
and Kauffer (1980); Gee (1980); J.W. Hill (1980); Basta 
(1981a); Gentry etal. (1982);T. Nash (1982); ASTM (1984 
STP 834); J.Bell (1984); Ouellette etal. (1986); WHO (1986 
EHC 53); Holt (1987); ACGIH (1989/33,1990/39) 


Dust-fume mixtures: HSE (1994a) 

Welding fumes: AWS (Appendix 28); Welding Institute 
(1981/35,36,1986/38,1991/43); HSE (1990 EH 54, EH 55) 

Aerosols 

C.N. Davies (1961,1967); Vincent (1980); Hinds (1982) 

Metals 

HSE (Appendix 28 EH series,Technical Data Notes); 

A. Tucker (1972); Goyer and Mehlman (1977); A. Williams 
(1977); Cohn and Linnecar (1979) 

Arsenic: HSE (TON 9,1990 EH 8); Lederer and Fensterheim 
(1983); OSHA (1983) 

Cadmium: HSE (1975 TON 11,1986 EH 1, MS(A) 7); 
Mennear (1979) 

Chromium: HSE (1991 EH 2, MS(A) 16) 

Lead, lead additives: API (69-7, EA 7102); HSE (TON 16, 
EH 3, MA 3,1986 BPM16, EH 28, MS(A) 1); OSHA (OSHA 
2230); WHO (EHC 3); Cremer (1959,1961); Cremer and 
Callaway (1961); R.K. Davis et al. (1963); Bryce-Smith (1971, 
1982); Hepple (1971); Associated Octel Co. (1972 Bull. 24); 
NAS/NRC (1972b); DoEm (1973/3); Gething (1975); HSE 
(1978b); NIOSH (1978 Crit. Doc. 78-158); Anon. (1982d); 
Chamberlain (1983); Killington (1983); E. King (1983); 
ACGIH (1991/75); Sweetland (1993) 

Mercury, including methyl mercury: WHO (EHC 1); OSHA 
(OSHA 2234); Katsuna (1968); Hartung and Dinman (1972); 
Bakir etal. (1973); OECD (1974); HSE (1978 MS 12); D. Taylor 
(1978); P.R. Edwards and Pumphrey (1982) 

Inhalation toxicity 

Barcroft (1918,1920); Waldron (1980a); Hardy and Collins 
(1981); Witschi and Nettesheim (1981-); Fiserova- 
Bergerova (1983); ASTM (1985 STP 872) 

Respiratory physiology: Krogh (1914—15); Forbes, Sargent 
and Roughton (1945); Forster (1957,1964a,b); Ogilvie et al. 
(1957); Weibel (1963,1973); Fenn and Rahn (1964); J.B. West 
(1965,1977); Lippold (1968); Altaian and Dittmar (1971, 
1974); Comroe (1974); Lambertsen (1974); Mountcastle 
(1974); Cotes (1979); Pickrell (1981); Keele, Neil and Joels 
(1982); Bramble (1983);Whipp and Wiberg (1983); Phalen 
(1984); Nixon (1985, SRDR 327); Vouketal (1985) 

Lung diseases 

Parkes (1974); C.K.W.M. Morgan and Seaton (1975); HSE 
(1977 MS 5); Khogali (1977) 

Toxic gases 

McEwen, Theodore and Vernot (1970); McEwen and Vernot 
(1972,1974,1976); Perry and Articola (1980); Buckley et al. 
(1984); CCPS (1989/4); R.M. Turner and Fairhurst (1989a); 
MacFarlane and Ewing (1990); ACDS (1991); deWeger, 
Pietersen and Reuzel (1991); CPD (1992b) 

Gas warfare, war gases: Hendry and Horsburgh (1915); 

R. Parker (1915a,b); Sieur (1915);Wainwright (1915); 
Haldane (1917,1919,1925); Chemical Warfare Medical 
Committee (1918-); Edkins and Tweedy (1918); Hunt and 
Price Jones (1918); Parsons (1918); Baskervffle (1919); Carr 
(1919); Lidbetter and Monk-Jones (1919); Kerschbaum 
(1920);Tatham and Miles (1920); Lefebure (1921,1928); 
Winternitz, Smith and McNamara (1920); Winternitz etal. 
(1920); Oudry (1924); Serrant (1924); Vedder (1925); Walton 
(1925); Le Wita (1925); Bloch (1926); Bressou (1926); 
Sesselberg (1926); von Deimling (1931); Hanslian (1931, 
1934); T.J. Mitchell and Smith (1931); Abbott (1933); 
Dautrebaude (1933); Fessler, Gebele and Prandtl (1933); 
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Leroux (1933); Mordaq (1933); Zernik (1933); 
Heeressanitatsinspektion (1934); vonTschischwitz etal. 
(1934); Ferry (1935); Noskoff (1935); Prentiss (1937); 
Gerchik (1939); National ARP Animal Cttee (1939); 

G. W. Young (1953); O.K. Clark (1959); McNalty and Mellor 
(1968); Haber (1975,1986); McWffliams and Steel (1985); 
Finch (1986); Withers and Lees (1987b); R.F. Griffiths and 
Fryer (1988); Butcher (1989a); V.C. Marshall (1989b); 

Lees and Withers (1992) 

Aerosols: C.N. Davies (1961,1966,1967); Walton (1971,1977) 
Acrylonitrile: Dudley and Neal (1942); Dudley, Sweeney and 
Miller (1942); Ministry of Social Affairs (1972); Solomon, 
Rubin and Okrent (1976); Bochinski, Schoultz and Gideon 
(1979); HSE (1981 EH 27); EPA (1983); WHO (1983 ECH 28); 
R.M. Turner and Fairhurst (1989b) 

Ammonia: Underwriters Laboratories (n.d.a);WHO 
(EHC 54); NIOSH (1974 Crit. Doc. 74-136); Lehmann (1886, 
1899a); Hess (1911); Flury (1921a, 1928); Haggard (1924); 
Slot (1938); McCallan and Setterstrom (1940);Thornton and 
Setterstrom (1940);Weedon, Hartzell and Setterstrom 
(1940); Caplin (1941); Boyd, MacLachan and Perry (1944); 
Silver and McGrath (1948); Carpenter, Smyth and Pozzani 
(1949); Silverman, Whittenberger and Muller (1949); Ting 
(1950); Weatherby (1952); von Meythaller and Gross (1957); 
Derobert (1964); Gaultier (1964); Levy etal. (1964); 
Saifutdinouv (1966); Mulder and van der Zalm (1967); 
Niden (1968); Osmond and Tallents (1968); Zygadowski 
(1968); McGuiness (1969); Coon etal. (1970);Voison etal. 
(1970); Helmers,Top and Knapp (1971); E.S. White (1971); 
Kass etal. (1972); NAS-NRC (1972a); Pernot etal. (1972); 
Prokopeva, Yushkov and Ubasheev (1973); Slack and James 
(1973); Walton (1973); Eisenberg, Lynch and Breeding 
(1975); Prokopeva and Yushkov (1975);Taplin etal. (1976); 
Sobonya (1977); Verberk (1977);Vernot etal. (1977); Dalton 
and Bricker (1978); HSE (1978b); Hilado and Cumming 
(1978); Kondrasuov (1978); Richard, Bouley and Boudene 
(1978); Richard, Jounay and Boudene (1978); Hatton et al. 
(1979); Kane, Barrow and Alarie (1979); Alarie (1980); 
Montague and MacNeil (1980); Hofer, Reindle and Hruby 
(1981); Appelman, ten Berge and Reuzel (1982); Kapeghian 
etal. (1982); Flury etal. (1983); O’Kane (1983); S.K. Price etal. 
(1983); K. Ward, Murray and Costello (1983); R.F. Griffiths 
and Megson (1984); Arwood, Hammond and Ward (1985); 
Engelhardt and Holliday (1985); Lessenger (1985); WHO 
(1986 ECH 54);Withers (1986a); Markham (1987a,b); MH AP 
(1988); Pedersen and Selig (1989); Sakurai (1989); Payne, 
Delic and Turner (1990); Ryer-Powder (1991); Brockhoff, 
Petersen and Haastrup (1992) 

Aniline: Anon. (LPB 301979, p. 165) 

Bromine: Lehmann (1887,1893); L.Hill (1915); Symes 
(1915a,b); Haggard (1924); Chlopin (1927-); Jolles (1966); 
Schlagbauer and Henschler (1967); Bitron and Aharonson 
(1978); Withers and Lees (1986b, 1987a); PC. Davies and 
Purdy (1987) 

Carbon monoxide: Lewin (1920); NIOSH (1972 Crit. Doc. 
73-11000); OSHA (OSHA 2224); HSE (HSW Bklt 29,1984 
EH 43); WHO (EHC 13); Drescher (1920); API (1972 Publ. 
4131); Connor (1984); Esposito and Alarie (1989); Sakurai 
(1989) 

Carbon disulfide: WHO (EHC 10);Teissinger and Soucek 
(1949) 

Chlorine: HSE (HSW Bklt 37); WHO (EHC 21); Lehmann 
(1887,1899a,b); Anon. (1915a-g); Broadbent (1915); 

H. Campbell (1915); Golla and Symes (1915); Hake (1915); 
Klotz (1917); Anon. (1918); Anon (1919); Anon (1920); 


Underhill (1920); Anon. (1923); Vedder (1925); Anon. (1926); 
McCord (1926); Chlopin (1927—); Walton and Eldridge 
(1928); Anon. (1930); Anon. (1933c); David (1933a,b); 
Skljanskaia, Klaus and Ssidorowa (1935); Skljanskaia and 
Rappoport (1935); Arloing, Berthet and Viallier (1940); 
McCallan and Setterstrom (1940); Thornton and 
Setterstrom (1940); Weedon, Hartzell and Setterstrom 
(1940); Silver and McGrath (1942); Silver, McGrath and 
Ferguson (1942); Malone and Warm (1945);Tatarelli (1946); 
Chasis et al. (1947); Baader (1952); Joyner and Durel (1962); 
Gervais etal. (1965); Kowitz etal. (1967); C.G. Kramer (1967); 
Schlagbauer and Henschler (1967); Dixon and Drew (1968); 
Krause, Chester and Gillespie (1968); Capodaglio et al. 
(1969); Stahl (1969a); Weill etal. (1969); Patil etal. (1970); 
Sessa et al. (1970); Urogoda (1970); Zielhuis (1970); Adelson 
and Kaufman (1971); Leube and Kreiter (1971); NAS-NRC 
(1973a, 1976); BCISC (1975/1); Eisenberg, Lynch and 
Breeding (1975); T.B. McMullen (1975); Ministry of Social 
Affairs (1975); NIOSH (1976 Crit. Doc. 76-170); Schwartz 
(1976); Solomon, Rubin and Okrent (1976); Barrow et al. 
(1977); Bitron and Aharonson (1978); HSE (1978b); 
Dewhirst (1981a—c); Anon. (1984f); Chlorine Institute (1985 
Publ. 63); P. Davies and Hymes (1985); Dokter etal. (1985); 
McWilliams and Steel (1985); MHAP (1985 LPB 64,1987); 
Withers (1985,1988); Withers and Lees (1985a,b, 1987b, 
1992); Nussey, Mercer and Fitzpatrick (1986); R.F. Griffiths 
and Fryer (1988); Holton and Montague (1988); Zwart and 
Woutersen (1988); CIA, Chlorine Sector Group (1989); 

V.C. Marshall (1989b, 1990a); Sakurai (1989); R.M. Turner 
and Fairhurst (1990a); Brockhoff, Petersen and Haastrup 
(1992); Anon. (1993 LPB 113, p. 26) 

Dimethylformamide: Bauer (1980) 

Ethylene dichloride: Heppel etal. (1946) 

Ethylene oxide: CISHC (1975/2); NIOSH (1978 Crit. Doc., 
77-200); CIA (1979 RC14); Flores (1983); Desai and 
Buonicore (1990) 

Halogenated hydrocarbons: Lehmann and Schmidt-Kelh 
(1936); von Oettingen (1937) 

Hydrogen chloride. WHO (ECH 21); Lehmann (1886); Leites 
(1929); Machle etal. (1942); Efflmova (1959,1964); 
Jacobziner and Raybin (1962); Stahl (1969b,c); Nagoa etal. 
(1972); Hilado and Furst (1976); NAS/NRC (1976); Barrow 
etal. (1977); Hilado and Gumming (1978); Barrow, Lucia and 
Alarie (1979); Alarie (1980) 

Hydrogen cyanide: Geppert (1889); Hess (1911); Flury and 
Heubner (1919); Fiihner (1919); Drescher (1920); Koelsch 
(1920); Reed (1920); Hasselmann (1925a,b); Chlopin 
(1927-); Schutze (1927); Dschang (1928); Flury (1928); 
Walton and Witherspoon (1928); Schwab (1929); Barcroft 
(1931); Hug (1932); Wirth and Lammerhirt (1934); Wirth 
(1935,1937); Prentiss (1937); Kendall (1938); McCallan and 
Setterstrom (1940); Thornton and Setterstrom (1940); 
Weedon, Hartzell and Setterstrom (1940); Wachtel (1941); 
Waitt (1942); Wood (1944); British Intelligence Objective 
Subcommittee (1946); Brophy, Miles and Cochrane (1959); 
Hilado and Furst (1976); McNamara (1976); NIOSH (1977 
Crit. Doc. 77-108);Vernot etal. (1977); Hilado and Gumming 
(1978); Ride (1984a); Holton and Montague (1988); Esposito 
and Alarie (1989); Sakurai (1989) 

Hydrogen fluoride: Ronzani (1909); Muehlberger (1928); 
Simons (1931); Machle etal. (1934); Machle and Kitzmiller 
(1935); Machle and Scott (1935); Stokinger (1949); 
Rushmere (1954); Rosenholtz etal. (1963); McEwen and 
Vernot (1970); Darmer, Haun and MacEwan (1972); Hilado 
and Furst (1976); NIOSH (1976 Crit. Doc. 76-143); Vernot etal. 
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(1977); CIA (1978); Hilado and Cumming (1978); Valentine 
(1988); Mudan (1989a); HSE (1990 MS(A) 12); R.M. Turner 
and Fairhurst (1990b) 

Hydrogen sulfide: Biefel and Poleck (1880); Lehmann (1892, 
1893,1899a); Haldane (1896); Hess (1911); Haggard and 
Henderson (1922); Sayers, Mitchell and Yant (1923 BM RI 
2491); Haggard (1925); Sayers etal. (1925 BM Bull. 231); 
Gerbis (1927); Schutze (1927); Flury (1928); Walton and 
Witherspoon (1928); Aves (1929); Yant (1930); 
Scheidemantel (1933); McCallan and Setterstrom (1940); 
Thornton and Setterstrom (1940); Weedon, Hartzell and 
Setterstrom (1940); Slater (1950); Ahlbrog (1951); Kaipainen 
(1954); Hurwitz and Taylor (1954); Breysse (1961); Milby 
(1962); Kleinfeld, Geil and Rosso (1964); Kemper (1966); 
C.L. Evans (1967); Prouza (1970); Simpson and Simpson 
(1971); Anon. (1975 LPB 3, p. 17); Thorn and Douglas (1976); 
Archibald (1977); NIOSH (1977 Crit. Doc. 77-158); Vernot 
etal. (1977); NRC (1979); R.P Smith and Gosselin (1979); 
WHO (1983 ECH19); HSE (1985 LPB 63); Lynskey (1985 
LPB 63); Amman (1986); Holton and Montague (1988); 
Kohout etal. (1988); R.M.Turner and Fairhurst (1990c) 
Methyl isocyanate: Kimmerle and Eben (1964); ten Berge 
(1985) 

Phosgene: Lehmann (1893); Muller (1910); Hess (1911); 
Dunn (1918); Meek and Eyster (1920); Underbill (1920); 
Winternitz etal. (1920); Flury (1921a, 1928); Laqueur and 
Magnus (1921); Zeehuisen (1922); Haggard (1924); Chlopin 
(1927—); Anon. (1928); Hegler (1928); Zangger (1932); 
Loschke (1933); Prentiss (1937); Kendall (1938); Sartori 
(1939); Cameron, Courtice and Foss (1941); Wachtel (1941); 
Waitt (1942); Boyland, McDonald and Rumens (1946); 
Courtice and Foss (1946); Weston and Karel (1946,1947); 
Bickenbach (1947); Box and Cullumbine (1947); Karel and 
Weston (1947); Gilman etal. (1948); A.T. Jones (1952); Suess 
and Lerner (1956); Henschler and Laux (1960); Ardran 
(1964); Zielhuis (1970); Kawai (1973); NIOSH (1976 Crit. Doc. 
76 -137); de Rooij, van Eick and van de Meent (1981); Diller 
and Zante (1982); Diller (1985); Mulder etal. (1986); 
Mehlman (1987); Zwart (1987); MHAP (1993) 

Sulfur dioxide, sulfuric acid: API (75-25); WHO (ECH 8); 
Ogata (1884); G.W. Jones, Capps and Katz (1918); Zeehuisen 
(1922); Haggard (1924); Kennon (1927); Flury (1928); Kehoe 
etal. (1932);Weedon, Hartzell and Setterstrom (1939, 

1940); McCallan and Setterstrom (1940); Thornton and 
Setterstrom (1940); Amdur, Silverman and Drinker (1952); 
Amdur, Schulz and Drinker (1952); Logan (1953); C.A. Mills 
(1957); Amdur (1958); Leong, MacFarland and Sellers 
(1961); Anon. (1953); Zielhuis (1970); NIOSH (1977 Crit. Doc. 
74-111); Amdur, Dubriel and Creasia (1978); Bitron and 
Aharonson (1978); Hilado and Cumming (1978); Alarie 
(1980); Silbaugh etal. (1981); Grint and Purdy (1990); 

R.M. Turner and Fairhurst (1992) 

Ozone: Slater (1974); BOHS (1979Monogr. 3); HSE 
(1983 EH 38) 

Toxic fumes from burning materials, fire extinguishants: 
BRE (1974 CP 5/74, CP 11/74, CP 12/74); Underwood (1971); 
H.L. Kaplan and Hartzell (1984); Hartzell, Packham et al. 
(1985); Hartzell, Stacy etal. (1985); Hartzell, Priest and 
Switzer (1985); Alexeeff et al. (1986); Doe et al. (1986); 
Hartzell, Grand and Switzer (1987);Tsushiya and Nakaya 
(1986); Hartzell (1989); G.T. Atkinson, Jagger and Kirk 
(1992); Babrauskas etal. (1992); D.A. Carter (1992); 
Babrauskas (1993) 

Ultratoxics (see also Table A3.1) Lamanna (1959) 


Table 18.2 Selected references on toxic 


Plant design and operation (see also Table 18.1) 

Crocker (1970); AlChE (1972/65); H.M. Chief Alkali 
Inspector (1974); Chementator (1975, Apr. 14,33; Jul. 7,34; 
1977, Jan. 3,37); Kiang (1976); Archibald (1977); Mukerji 
(1977); Payne (1978); Buxton (1980); Hewitt (1980); 

D. Hughes (1980); G.A. Hunt (1980); IChemE (1980/120); 
Lamb (1980); A. Price (1980); Mecklenburgh (1982); Prugh 
(1985-); Zanetti (1986a,b); ILO (1989); Grigoriev, Polyakov 
and Artemev (1990); Sutherland (1990); N.C. Harris (1991); 
Kuryla (1993) 

Toxic gas detectors (see also Table 18.1) 

R. Zanetti (1986b); Atallah and Guzman (1987) 

Toxic release mitigation 

N.C. Harris (1987); Hiltz and Brugger (1989); Fthenakis and 
Zakkay (1990); Schatz and Koopman (1990); van Zele and 
Diener (1990); Diener (1991); Porter (1991) 

Foam: Dimaio and Norman (1988,1990); B.C. Norman and 
Swihart (1990) 

Emergency planning 

Duff and Husband (1974); Zajic and Himmelman (1978); 
Purdy and Davies (1985 LPB 62) 

Shelter 

D.J.Wilson (1987,1990,1991b); Glickman and Ujihara 
(1990); D.J. Wilson and Zelt (1990); Zelt and Wilson (1990); 
McQuaid (1991); Kakko (1992) 

Protective clothing 

Daugherty, Watson and Vo-Dinh (1992) 

Decontamination 

W.L. Owen, Sartor and van Horn (1960); Ayers (1964); 

P.E. James and Wilkin (1969); PE. James and Menzel (1973); 
AEC (1975) 

Hazard assessment 

G.D. Bell (n.d.); Howerton (n.d., 1969); Simmons, Erdmann 
and Naft (1973,1974); Dicken (1974,1975); J.D. Reed (1974); 
van Ulden (1974); Westbrook (1974); Eisenberg, Lynch and 
Breeding (1975); Simmons and Erdmann (1975); Hewitt 
(1976); Setters (1976); Solomon (1976); Solomon, Rubin and 
Okrent (1976); Lautkaski and Mankamo (1977); 

VC. Marshall (1977d, 1982b); HSE (1978b); Zajic and 
Himmelman (1978); Napier (1979a); N.C. Harris (1982,1985); 
Mecklenburgh (1982); Pantony and Smith (1982); Fiksel 
(1985); Pape and Nussey (1985); IChemE (1986/128); 
Pietersen (1986c); Withers and Lees (1986a); Baldini and 
Komosinsky (1988); Thomson and Nightingale (1988); 
Boykin and Levary (1989); J.K.W. Davies (1989a); Egol 
(1989a); Gephart and Moses (1989); Vergison, van Diest and 
Easier (1989); G.T. Atkinson, Jagger and Kirk (1991); Biitzer 
and Naef (1991,1992); Grint and Purdy (1990); Nussey, 
Mercer and Clay (1990); R.F. Griffiths (1991a,b);Touma and 
Stroupe (1991);Touma etal. (1991); Geeta,Tripathhi and 
Narasimhan (1993); Goldsmith and Schubach (1993); 
Dunbar et al. (1994); Tyler et al. (1994) 

Particular chemicals 

Acrylonitrile: Siccama (1973); Solomon, Rubin and Okrent 
(1976) 

Ammonia: Resplandy (1967); W.L. Ball (1968b); Inkofer 
(1969); Medard (1970); Comeau (1972); MacArthur (1972); 
J.D. Reed (1974); Eisenberg, Lynch and Breeding (1975); 





TOXIC RELEASE 18/7 


Lonsdale (1975); Luddeke (1975); VC. Marshall (1977b); 
HSE (1978b); Harvey (1979b); Baldock (1980); R.F. Griffiths 
(1981a); Raj (1982); R.H. Roberts andHandman (1986); 
Markham (1987b); Gephart and Moses (1989); Fallen 
(1990); Sutherland (1990); Langeluedecke (1991) 

Chlorine: G.D. Bell (n.d.); Howerton (n.d., 1969); Hanslian 
(1937); Prentiss (1937); Romcke and Evensen (1940); 
Simmons, Erdmann and Naft (1973,1974); Dicken (1974, 
1975); Westbrook (1974); Eisenberg, Lynch and Breeding 
(1975); Chlorine Institute (1975 MIR-71,1982 Pmphlt 74); 
Haber (1975,1986); Setters (1976); Solomon, Rubin and 
Okrent (1976); VC. Marshall (1977b); HSE (1978b); Harvey 
(1979b); Meslin (1981); Emerson, Pitblado and Sharifi 
(1988); J.L. Woodward and Silvestro (1988); Anon. (1989 
LPB 86, p. 1); Deaves (1989); Gephart and Moses (1989); 
Lin and Shroff (1991); Anon. (1993 LPB 113, p. 26) 
Hydrogen cyanide: Solomon, Rubin and Okrent (1976) 
Hydrogen fluoride: Crocker (1970); HSE (1978b); Hague and 
Pepe (1990); Schatz and Koopman (1990);Tilton and Farley 
(1990); van Zele and Diener (1990); Diener (1991) 

Hydrogen sulfide: Echols (1976); Linskey (1985 LPB 63); 
Anon. (1989 LPB 87, p. 1); D.J. Wilson (1991a) 

Phosgene: VC. Marshall (1977b) 

Sulfur dioxide: Sumner and Pfann (1976); Nyren and 
Winter (1987) 

Vinyl chloride: McKinnon (1974); Kiang (1976); Mukerji 
(1977) 

Indicators of cloud contour, including vegetation 
damage 

Fryer and Kaiser (1979 SRD R152); Arner, Johnson and 
Skovronski (1986); R.F. Griffiths and Smith (1990) 

Simulation of accidents 

M.P. Singh, Kumar and Ghosh (1990) 


18.1.1 Modes of exposure 

Toxic chemicals enter the body in three ways: (1) inhalation, 

(2) ingestion and (3) external contact. Generally, gases, 
vapours, fumes and dusts are inhaled and liquids and 
solids are ingested. Entry may also occur through the 
intact skin or the mucous linings of the eyes, mouth, throat 
and urinary tract. 


18.1.2 Effects of exposure 

Exposure to some chemicals results in temporary or per¬ 
manent damage to organs of the body, that is, poisoning. 
There is a wide variety of types of damage caused by toxic 
substances. 

The effects of exposure to toxic chemicals may be acute 
or chronic. Acute effects result from a single exposure to 
a high concentration of the chemical; chronic effects 
result from exposure to low concentrations, perhaps over a 
large part of a working lifetime. With the latter type of 
exposure the effects may be latent and may show them¬ 
selves only after many years. It is also possible for the 
effects of a single exposure to a high concentration to be 
latent. 

A toxic chemical may induce a graded or a quantum 
response. A graded response refers to the symptoms shown 
by an individual, which become progressively more severe 
as the dose in increased. Exposure to carbon monoxide, 
for example, results in a set of symptoms of increasing 


severity. The graded responses for this and other gases are 
shown in Table 18.3. 

A quantum response, on the other hand, refers to the 
effect of a toxic chemical on a population, in which some 
individuals suffer the defined injury and others do not. 
A person either has or does not have mesothelioma from 
crocidolite (‘blue’) asbestos. In this case it is the proportion 
of cases in the population that rises with an increasing 
dose level. 

The effects of acute exposure to toxic chemicals include: 

(1) irritation - 

(a) respiratory, 

(b) skin, 

(c) eyes; 

(3) narcosis; 

(4) asphyxiation - 

(a) simple, 

(b) chemical; 

(2) systemic damage. 

Inhalation of some substances (e.g. chlorine) causes 
respiratory irritation. This irritation can serve as a warn¬ 
ing. There are some chemicals, however, which reach a toxic 
level before they cause appreciable irritation and thus give 
no warning. 

Some substances (e.g. hydrocarbon vapours) have nar¬ 
cotic effects so that the person’s responses are affected 
and he may become exposed to an accident. With certain 
chemicals (e.g. toluene diisocyanate) the effect is that the 
person becomes euphoric and oblivious of danger so that he 
is liable to perform hazardous acts. 

Gases which act as simple asphyxiants (e.g. nitrogen and 
helium) merely displace oxygen in the atmosphere so that 
the concentration falls below that needed to maintain 
consciousness. But there are also chemical asphyxiants 
(e.g. carbon monoxide and hydrogen cyanide) that have a 
specific blocking action and prevent a sufficient supply of 
oxygen from reaching the tissues. 

The effects of chronic exposure to toxic chemicals tend to 
be induction of injury or disease. One of the most important 
of these diseases is cancer. Some chemicals induce cancer. 
In addition to these carcinogens there also mutagens, 
which induce gene changes, and teratogens, which induce 
birth defects. 

Some chemicals are much more liable than others to 
accumulate in the body over the long term. Such bioaccu- 
mulative chemicals are particularly harmful. 

Different toxic chemicals affect different sites in the 
body. The effect of such chemicals depends on the target 
organ. 

It will be apparent, therefore, that it is difficult to express 
the toxicity of different chemicals in terms of a common 
equivalent. Use is sometimes made of the term ‘chlorine 
equivalent’. This is discussed in the First Report of the 
ACMH, which makes the following observations: 

Toxicity depends on a number of factors and no simple 
hard and fast rules can be laid down. The mode of action 
depends not only on the nature of the chemical but upon 
the dose received and the time scale of exposure. Strictly 
speaking the term ‘chlorine equivalent’ can be given 
relevance only in connection with slow, corrosive irritant 
chemicals having similar solubility in inhalation. 
Chemicals such as sulphur dioxide, ammonia, acrolein 
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Table 18.3 Effects of different concentrations of some toxic gases 


Gas 

Concentration (ppm) 

Reference a 

Ammonia 

TLV C 

25 

ACGIH 

Concentration detectable by odour 

20 

Matheson 

Concentration causing severe irritation of throat, nasal passages and 

400 

Matheson 

upper nasal tract 

Concentration causing severe eye irritation 

700 

Matheson 

Concentration causing coughing, bronchial spasms, possibly fatal for 

1700 

Matheson 

exposure of less than 30 min 

Concentration causing oedema, strangulation, asphyxia, fatal almost 

5000 

Matheson 

immediately 

Carbon monoxide 

(%v/v) 


TLV 

0.005 (50 ppm) 

ACGIH 

Concentration inhale for 1 h without appreciable effect 

0.04-0.05 

Matheson 

Concentration causing a just appreciable effect for exposure of 1 h 

0.06-0.07 

Matheson 

Concentration causing unpleasant symptoms but not dangerous for 

0.1-0.12 

Matheson 

exposure of 1 h 

Concentration dangerous for exposure of 1 h 

0.15-0.2 

Matheson 

Concentration fatal for exposure of less than 1 h 

0.4 

Matheson 

Chlorine 

TLV 

1 

ACGIH 

Minimum concentration detectable by odour 

1 

Chlorine Code 


3.5 

Matheson 

Maximum concentration inhalable for 1 h without damage 

4 

Matheson 

Minimum concentration causing throat irritation 

15 

Matheson 

Minimum concentration causing coughing 

30 

Matheson 

Concentration dangerous for exposure of 30 min 

40-60 

Matheson 

Concentration probably fatal after a few deep breaths 

1000 

Matheson 

Hydrogen sulfide 

TLV 

10 

ACGIH 

Concentration causing slight symptoms after exposure of 

70-150 

Matheson 

several hours 

Maximum concentration inhalable for 1 h without serious effects 

170-300 

Matheson 

Concentration dangerous for exposure of 0.5-1 h 

400-700 

Matheson 

Phosgene 

TLV 

0.1 

ACGIH 

Minimum concentration detectable by odour 

0.5-2 

Phosgene Code 


5.6 

Matheson 

Maximum concentration for exposure of 15 min 

1 

Phosgene Code 

Minimum concentration affecting throat 

3.1 

Matheson 

Concentration probably fatal for exposure of 30 min 

5 

Matheson 

Concentration dangerous for exposure of 0.5-1 h 

25 

Matheson 

Concentration rapidly fatal for short b exposure 

50 

Phosgene Code 

Concentration capable of causing lung injury in 2 mm 

167 

Matheson 


a ACGIH—Threshold Limit Values for 1976 (HSE, 1977 EH 15). 

Matheson -Matheson Gas Data Book (Matheson Company, 1961). 

Chlorine Code-Code of Practice for Chemicals with Major Hazards: Chlorine (BCISC, 1975/1). 
Phosgene Code-Code of Practice for Chemicals with Major Hazards: Phosgene (CISHC, 1975/3). 
b Presumably several minutes; this code defines 15 min as a prolonged exposure. 

°TLV threshold limit value. 


and nitrogen dioxide are all irritant yet have such differ¬ 
ent sites of action and variable effects as to make even an 
approximate calculation of a ‘chlorine equivalent’ diffi¬ 
cult. The problem becomes even more difficult when one 
considers the potential toxicity of chemicals such as 
carbon monoxide that are not predominantly irritant. 
Mechanisms of toxicity are almost as varied as the 
classes of chemical that could be released. 


18.2 Toxic Substances 

Some factors relevant to toxic substances include: 


(1) generation of the substance; 

(2) toxic concentrations; 

(3) effects of exposure; 

(4) detectability by odour; 
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(5) precautions in handling; 

(6) leak detection; 

(7) first aid. 

Most toxic substances that present a hazard in the 
chemical industry are chemicals that are deliberately pro¬ 
duced, but some are generated as by-products by accident. 
Carbon monoxide and carbon dioxide are generated by 
combustion processes either in the process itself or in fires. 
Nitrogen oxides may be given off in welding. Ultratoxics 
may arise from side reactions. 

The number of chemicals used in industry is very large 
and grows each year. Various figures have been quoted for 
the number of chemicals involved. According to Langley 
(1978) in the decade prior to 1978 approximately 4 million 
new chemicals had been identified, although at least 75% 
of these had been cited only once in the literature. Of more 
practical relevance is the estimate of the UK Chemical 
Information Centre (UKCIS), also quoted by Langley, that 
there are some 20,000-30,000 chemicals manufactured in 
quantities greater than 1 te per annum. 

For the number of new chemicals coming into use each 
year in the United Kingdom at this level of output, Langley 
gives an estimate of some 300-400. For the United States 
the annual number of new chemicals has been estimated as 
about twice this value. 

The problems posed by toxic chemicals have generally 
been perceived primarily in terms of noxious effects 
resulting from chronic exposure to chemicals that possess 
a degree of toxicity which has not been appreciated. More 
recently, there has been increased concern over the threat of 
large scale acute poisoning from the accidental release of 
toxic chemicals. 

Early instances of the discovery of the noxious proper¬ 
ties of substances include those of radium, phosphorus, 
lead, asbestos and naphthylamines. More recent examples 
include: polychlorinated biphenyls (PCBs), vinyl chloride 
and benzene. Even if the toxicity of a particular substance 
has been established, instances of exposure may still occur. 

Some examples of the discovery of toxic effects or of 
instances of exposure to a substance with known toxic 
effects that have made impact in the United Kingdom have 
been given by Pittom (1978) and include: 

1965 Bladder cancer from antioxidants (rubber industry) 
1972 Lead poisoning (Avonmouth, Isle of Dogs) 

1974 Angiosarcoma from vinyl chloride (polyvinyl chloride 
(PVC) plants) 

1975 Asbestos related diseases (Hebden Bridge) 

1976 TCDD (2,3,7,8-tetrachlorodibenzo-/>-dioxin) (Seveso) 

The dates refer to the years when publicity was at its height. 

It is necessary, therefore, to take measures to ensure that 
the long-term, or chronic, toxic hazard is kept under good 
control. Of particular importance is the control of exposure 
to carcinogens. One of the principal means of control is the 
establishment of exposure limits, or hygiene standards. 
Over the years these limit values have tended to be reduced, 
and in some cases the reductions have been dramatic. For 
example, in the United States the limits for asbestos were 
reduced over the period 1938-83 as follows (Corn and 
Corn, 1984): 1938, 30 fibres/cm 3 ; 1970,12 fibres/cm 3 ; 1971, 
2 fibres/cm 3 ; and 1983,0.5 fibres/cm 3 . 

There have also been occasional large releases of toxic 
chemicals of which the escape of methyl isocyanate at 


Bhopal in 1984 was much the worst. Good control of the acute 
toxic hazard posed by a large release is equally important. 


18.3 Toxicity Assessment 

18.3.1 Toxicity data 

Comprehensive accounts of occupational health risks 
involving toxic hazards are given in a number of texts, 
including the following: Toxicity of Industrial Metals 
(Browning, n.d.a),Toxicity of Industrial Organic Chemicals 
(Browning, n.d.b), Industrial Hygiene and Toxicology 
(Patty, 1948-), with its later edition Patty’s Industrial Hygiene 
and Toxicology (Clayton and Clayton, 1991 ACGIH/73); 
Dangerous Properties of Industrial Materials (Sax 1957-), 
with its later edition-Sa/fs Dangerous Properties of Industrial 
Materials (Lewis, 1992 ACGIH/89); Toxicity and Metabolism of 
Solvents (Browning, 1965); Toxicology of Drugs and Chemicals 
(Deichmann and Gerarde, 1969); Hazards in the Chemical 
Laboratory (G.D. Muir, 1971-); Registry of Toxic Effects of 
Chemical Substances 1981-82 (Tatken and Lewis, 1984); 
Rapid Guide to Hazardous Chemicals in the Workplace (Sax and 
Lewis, 1986), with its later edition (Lewis, 1990 ACGIH/49); 
Toxicology: the Basic Science of Poisons (Casarett and Doull, 
1975), with its later edition (Amdur, Doull and Klaassen, 1991, 
ACGIH/54); Chemical Hazards in the Workplace (Scott, 1989 
ACGIH/29); Neurotoxicity Handbook (Singer, 1990 ACGIH/ 
46); Chemical Hazards of the Workplace (Hathaway etal., 1991 
ACGIH 55); I - ,i an (Lewis. 

1991, ACGIH/60); and Handbook of Toxic and Hazardous Che¬ 
micals and Carcinogens (Sittig, 1991/ACGIH/59). 

The American Conference of Government Industrial 
Hygienists (ACGIH) and the American Industrial Hygiene 
Association (AIHA) issue a number of publications on 
exposure limits for toxic chemicals. These are considered 
in Section 18.5. 

The National Institute for Occupational Safety and 
Health (NIOSH) issues Criteria Documents for a large 
number of chemicals and also several other series: Occu¬ 
pational Hazard Assessments, Joint Occupational Health 
Recommendations and Special Hazard Reviews. Other pub¬ 
lications include Occupational Health Guidelines for Chemi¬ 
cal Hazards (NIOSH, 1981/6) and Pocket Guide to Chemical 
Hazards (NIOSH 1990/18). The Occupational Safety and 
Health Administration (OSHA) also issues the Chemical 
Information Manual (OSHA, 1991/1). 

Chemical Safety Data Sheets on toxic chemicals were 
formerly issued by the Manufacturing Chemists Associa¬ 
tion (MCA), but many of these have been withdrawn. 

Information on toxicity is given in a number of publica¬ 
tions by the Health and Safety Executive (HSE). EH 40/94 
Occupational Exposure Limits 1994 (HSE, 1994) is sup¬ 
ported by EH/64 Occupational Exposure Limits: Criteria 
Document Summaries (HSE, 1992). Series relevant to tox¬ 
icity are the Environmental Hygiene (EH) series, the Med¬ 
ical (MS) series and theToxicity Review (TR) series. 

There are a number of databases for the toxicity of 
chemicals, many of which are available on computer. They 
include the following: 


CHRIS Chemical Hazard Response Information 
System (US Coast Guard) 

OHMTADS Oil and Hazardous Materials Technical 
Assistance Data System (Environmental 
Protection Agency (EPA)) 
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RTECS Registry of Toxic Effects of Chemical Sub¬ 
stances (NIOSH) 

TOXLINE National Library of Medicine toxic sub¬ 
stances database 

HSELINE HSE toxic substances database 

An account of these and other systems is given in Chapter 2 9. 

There is a good deal of guidance available on the hand¬ 
ling of individual toxic substances. An early compilation 
was the Gas Data Book (Matheson Company, 1961). This 
deals with toxic concentrations, symptoms of exposure, 
precautions in handling and first aid. 

Much relevant information is given in materials safety 
data sheets (MSDSs), which are described in Chapter 8. 
There are a number of MSDS compilations. They include 
Compilation of Safety Data Sheets for Research and 
Industrial Chemicals (Keith and Walters, 1985-), Chemical 
Safety Data Sheets (Walsh, 1988, vol. 1; A. Allen, 1988, vols 
2—5; Kluwer Publishers, 1992) and Croner’s Substances 
Hazardous to Health (Kellard, 1993). 

Other guidance is given in codes such as Codes of Practice 
for Chemicals with Major Hazards by the Chemical Indus¬ 
tries Association (CIA) and intheEH series of theHSE. 

The toxicity of chemicals is a field in which, at present, 
the situation changes particularly rapidly and the impor¬ 
tance of seeking the most up-to-date information cannot be 
too strongly emphasized. 

18.3.2 Toxicity testing 

Information on toxicity is often incomplete or non-existent. 
This is not surprising, since the number of chemicals used 
in industry is so large. Therefore, in some cases it is neces¬ 
sary to conduct tests in order to obtain information on 
toxicity. Toxicity testing is now a well-established activity 
which is conducted to ensure safety not only in the manu¬ 
facture of chemicals but also in the use of food, drugs and 
cosmetics. General accounts are given by Hemsworth 
(1974), J.T. Carter (1976) and Neal and Gibson (1984). 

Methods that are used to assess toxicity include 
(1) micro-organism tests and (2) animal experiments. The 
object of toxicity testing is to obtain quantitative informa¬ 
tion on toxic effects. The simple classification of substances 
as ‘toxic’ or ‘non-toxic’ is of little value. 

Toxicity testing is expensive. According to C.R. Pearson 
(1982) the cost of the Base Set of tests required under the 
EEC Sixth Amendment to the Dangerous Substances 
Directive is £25,000-50,000. Detailed information on cost 
of specific tests for the United States is given by A.S. West 
(1986). He also estimates the costs of the EEC Pre¬ 
manufacturing Data Set of tests and of the Level 1 and 
Level 2 sets as $100,000, $500,000 and several million dol¬ 
lars, respectively. 

The assessment of toxicity is a matter for experts. There 
are a number of organizations which specialize in toxicity 
testing and assessment, as described below. 

18.3.3 Micro-organism tests 

Accounts of micro-organism tests are given in In Vitro 
Toxicity Testing of Environmental Agents (Kolber et al. 
1983) and by Neal and Gibson (1984). Studies of the effects 
of chemicals on micro-organisms are used for screening 
chemicals, particularly for possible carcinogenic, mutagenic 
or teratogenic effects. Developments in this area include, 
in particular, the tests used by Ames and co-workers 
(Ames, 1971). 


18.3.4 Animal experiments 

The other main type of test is experimentation on animals. 
This allows the use of the normal techniques of controlled 
experimentation. Although some earlier work made use of 
other animals such as monkeys, dogs, cats and rabbits, the 
animals now almost universally used are mice and rats. 

The testing is done according to a strict protocol. The 
animal is given a fixed dose of chemical or is exposed to a 
gas of a given concentration for a fixed time and its health 
is then monitored for a defined observation period. Patho¬ 
logical investigation may also be performed. For certain 
types of test, such as those on inhalation toxicity, the 
observation period may be 10—14 days. For other types, 
such as those on carcinogens, it may extend to 2 or 3 years. 

For many tests the objective is to determine the dose or 
concentration which is lethal to 50% of the animals. This is 
the lethal dose LD 50 for an orally administered substance 
and the lethal concentration LD 50 for an inhaled gas (see 
Section 18.11). In the latter case the period of exposure must 
alsobe defined. Frequently there is a legislative requirement 
for the determination of the LD 50 as an index of toxicity. The 
corresponding index of aquatic toxicity is the median toler¬ 
ance limitTL m x, which is the concentration lethal to 50% of 
the test species for an exposure period of x hours. 

There are various problems in the use of animal experi¬ 
ments. The first of these is the ethical problem. For this 
reason there are increasing pressures to limit such experi¬ 
ments to those for which high priority can be established. 

Animal experiments are also both expensive and time- 
consuming. As already mentioned, experiments on the 
long-term effects of exposure to low concentrations of 
chemicals may involve extensive observation periods. 

In order to obtain statistically valid results it is neces¬ 
sary to use quite large numbers of animals. This is a prob¬ 
lem in almost all instances, but particularly so where the 
level of risk which is of interest is low. There is then the 
further problem of interpreting the results obtained and 
extrapolating them from other species to man. 

18.3.5 Epidemiology 

Another approach to the assessment of toxicity is epi¬ 
demiology. Epidemiological studies are based on compari¬ 
sons of disease or abnormality between the group under 
study and a control group. This approach is applicable to 
situations where a number of people have been exposed, 
often, though not always, over a period of years. 

Accounts of epidemiology are given in Medical Record 
Linkage (Acheson, 1967), Epidemiology and Disease (Q.R Fox, 
Hall and Elvaback, 1970), An Introduction to Epidemiology 
(Alderson, 1976), Guide for the Management, Analysis and 
Interpretation of Occupational Mortality Data (NIOSH, 
1990/19), Exposure Assessment for Epidemiology and Hazard 
Control (Rappaport and Smith, 1991 ACGIH/56), and by 
Harrington (1980a) and Neal and Gibson (1984). 

There have been a number of important epidemiological 
investigations of toxic substances, including those of 
radium, /i-naphthylamine, lead, asbestos and vinyl chloride. 

Epidemiological studies have the great drawback that, 
by their nature, they yield information on the existence of a 
toxic effect only after people have fallen victim to it. This 
drawback is most serious where the effects are latent rather 
than acute, because in this case even the initiation of con¬ 
trol measures cannot prevent disease, due to the backlog of 
previous exposure. This problem of lag has become much 
more important as the rate at which new substances are 
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introduced has increased. Despite this, epidemiology is an 
important tool for toxicity assessment, as evidenced hy the 
number of chemicals that have been identified as noxious 
by this means. 

There are certain methodological problems in the epi¬ 
demiological approach. One is the difficulty of determining 
the degree of exposure. In some cases, for example, the best 
estimate which investigators have been able to make of the 
level of exposure has been the threshold limit value current 
in the period concerned. Another difficulty is in defining 
the control group. 

In practice, where a positive correlation is obtained 
between exposure and disease, this tends to be in cases in 
which a relatively small number of people have been 
exposed to quite high concentrations. Conversely, cases 
where a large number of people have been exposed to low 
concentrations tend to yield negative results. 

The epidemiological approach has certain limitations. It 
is relatively easy to show a correlation between an agent and 
a disease, but it may only be possible to establish a causal 
relation by experiments that cannot normally be justified. 
Another is that, whereas a rare disease can be detected as a 
relative excess of the disease among small numbers of peo¬ 
ple, the demonstration of a common disease as a relative 
excess requires the investigation of a large population. 

The epidemiological method may be modified by inves¬ 
tigating not only overt manifestations of the disease but 
also pre-disease phenomena such as those revealed by 
urine tests or radiography. 

18.3.6 Toxic load 

The correlation of toxicity data requires the definition of 
the toxic load. This is the independent variable in terms of 
which toxic injury is expressed. Toxic load is thus a form 
of injury factor. 

In the case of an orally administered dose, the toxic load 
L is simply the dose d : 

hmg [18.3.1] 

In the case of an inhaled gas the toxic load is, in general, 
some function of concentration c and the time t: 

L =f[c, t) [18.3.2] 

This function may simply be the product 

L = ct [18.3.3] 

but it may alternatively be of the form 

£ = cr [18.3.4] 

For acute inhalation toxicity of irritant gases the value of 
m for animals tends to be less than unity and is often of the 
order of 0.5 (Doe and Milburn, 1983). 

18.3.7 Toxic load-response relation 

Given the form of the toxic load, a correlation may be sought 
between the toxic load and the proportion of the population 
suffering a defined degree of injury. This correlation is the 
toxic load-response relation. This term is preferred here to 
the more usual dose-response relation, since toxic load is a 
more general term than dose. 


A distribution that is widely used to correlate data for 
toxic injury, as for injury of other kinds, is the log-normal 
distribution. Associated with the log-normal distribution 
is the probit equation. 

A particular problem arises at low levels of toxic load, 
because the precise relationship between toxic load and the 
proportion affected is a critical issue in setting exposure 
limits. Figure 18.1 illustrates two possible relations. With 
the linear relation A there is no lower limit below which 
there is no noxious effect, whereas with the sigmoidal 
relation B, there may be said to be a ‘threshold’ below which 
the effect of the toxic load is negligible. 

It is frequently difficult to distinguish between these two 
types of curve and to establish whether there is or is not a 
threshold. This is the case particularly where the numbers 
of workers involved are small and the conditions of expo¬ 
sure are variable. 

There are relatively few toxic load-response relations 
established for toxic substances. Apart from those for 
tobacco, alcohol and certain drugs, Acheson and Gardner 
(1981) recognize for cancer only two such relations: one for 
chrysotile asbestos and one for ionizing radiation. The for¬ 
mer is that given in the work of Liddell, McDonald and 
Thomas (1977) in a study of the effect of chrysotile asbestos 
dust on some 11,000 workers in Quebec, which gives a lin¬ 
ear relation passing close to the origin and is interpreted by 
these authors as indicating no safe threshold. 

Further discussions of the toxic-load response are given 
by C.C. Brown (1984) and Snyder (1984). The latter 
describes different ways of plotting the load-response 
curve and gives a number of such curves obtained in ani¬ 
mal experiments. 

Various equations have been developed for the toxic load- 
response relations at low levels of toxic load, and statistical 
methods have been applied to obtain fits to the data. There 
are deficiencies, however, in a purely statistical approach 
and it may be more fruitful to support such work with 
exploration of the toxicokinetics. An example of work on 
these lines is that of Gehring, Watanabe and Park (1979), 
who studied the load-response relation for vinyl chloride by 
modelling the metabolism of the chemical in the body and 
examining different empirical equations for this relation in 
the light of the model. A further treatment of the relation 



Figure 18.1 Some idealized load-response relations 
for quantum response 
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between load-response curve and toxicokinetic modelling 
is given by C.C. Brown (1984). 

18.3.8 Toxicokinetic modelling 

The unsteady-state modelling of the effects of chemicals in 
the body is widely practised by pharmacologists, who have 
developed a number of pharmacokinetic models. The typi¬ 
cal model is for a drug which is taken in a single dose. 
Accounts of such models include those given for E. Nelson 
(1961), Casarett and Doull (1975), Tuey (1980), Rogers, 
Specter and Trounce (1981) and Albert (1985). 

One of the simplest models is the one-compartment 
model with finite rate elimination, which is illustrated in 
Figure 18.2. For this model the two cases commonly treated 
are the impulse and the step response, the first corre¬ 
sponding to the instantaneous introduction of the chemical 
and the second to the constant input of the chemical into the 
body, the prior concentration being zero in both cases. For 
the first case 

^=~keX |18.3.5] 

X(0) = Do J18.3.6] 

where D 0 is the dose of the chemical, k e is the elimination 
constant and X is the mass of chemical in the body. For the 
second case 


= D — k<X |18.3.7] 

where D is the dose rate. The concentration C is given by 

C = X/V& J18.3.8] 

where F d is the apparent volume of distribution of the 
chemical in the body. The chemical is distributed between 
the bloodstream and other body matter, both aqueous and 
non-aqueous, and the total effective capacity constitutes 
the apparent volume of distribution. For elimination after 
an instantaneous input of the chemical 

C = C(0) exp (~k e t) J18.3.9] 

From Equation 18.3.5 the half-life of the chemical in the 
body is 0.693/& e . Some typical half-lives of drugs in the 
body, as given by Albert (1985), are aspirin 0.3 h, morphine 
3 h, quinidine 6 h, diazepam 50 h and phenobarbital 86 h. 

The model describes the variation of concentration with 
time of the chemical in the body and is based on the assump - 
tion that the body has a mechanism for elimination of the 
chemical. Elimination occurs by metabolism or secretion. 


D/V d 


k e X(t) 


X(t) 



Figure 18.2 One compartment model of a toxic 
chemical in the human body 


Similar models may be used to explore toxic effects, and 
are then termed toxicokinetic models. Toxicokinetic models 
provide valuable guidance on the interpretation of empiri¬ 
cal results, both in applying the results of animal experi¬ 
ments to man and in assessing the shape of the toxic 
load-response curve at low toxic loads. 

18.3.9 Statistical interpretation 

Statistical methods have an important part to play in the 
design and interpretation of animal experiments, in the 
interpretation of toxic load-response data and in estimating 
the parameters of correlations. 

Accounts of the application of statistics to these pro¬ 
blems are given in The Statistics of Bioassay (Bliss, 1952) 
Probit Analysis (Finney, 1971). 

For obvious reasons the number of animals, which can be 
used in gas toxicity experiments has to be kept as low as 
possible and the statistical interpretation of the results is 
therefore crucial. It has been shown by Trevan (1927) that 
for a particular dose-mortality determination the con¬ 
fidence level depends on the number of animals and on the 
mortality. He applied the binomial expansion 

(p + qf = 1 [18.3.10] 

where p and q are the probabilities of death and survival, 
respectively, and N is the number of animals in the experi¬ 
ment. Then for the distribution 

Mean = Np 

Standard deviation a = (pqN )^ z 
Confidence limits = Np + zo 

where z is the number of standard deviations correspond¬ 
ing to the confidence level. 

Applying Trevan’s method with a 95% confidence level, 
the results given in Table 18.4 and Figure 18.3 are obtained. 
It can be seen that for experiments with small numbers of 
animals the confidence limits for 50% mortality are wide 
and those for other mortalities such as 25% (or 75%) and 
10% (or 90%) they are even wider. 

Thus for a given confidence level it is necessary to use 
more animals to determine an LCio or LCgo than an LC 50 


Table 18.4 Expected numbers of deaths in experimental 
animals (Withers and Lees, 1985a; after Trevan, 1972) 
(Courtesy of Elsevier Science Publishers) 


Mortality (%) 

N 

a 

» 

Np 

Range 

50 

10 

1.581 

3.099 

5 

2-8 


20 

2.236 

4.383 

10 

6-14 


30 

2.739 

5.368 

15 

10-20 


40 

3.162 

6.198 

20 

14-26 


50 

3.536 

6.931 

25 

18-32 


60 

3.873 

7.591 

30 

22-38 


70 

4.183 

8.199 

35 

27-43 


80 

4.472 

8.765 

40 

31-49 


100 

5.000 

9.800 

50 

40-60 

25 

30 

2.372 

4.649 

7.5 

3-12 


100 

4.330 

8.487 

25 

17-33 

10 

30 

1.643 

3.220 

3 

0-6 


100 

3.000 

5.880 

10 

4-16 
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Figure 18.3 Expected numbers of deaths in experimental 
animals (Withers and Lees, 1985a; after Treven, 1927) 
(Courtesy of Elsevier Science Publishers) 


(see Section 18.11). Alternatively, and this is the more usual 
case experimentally, for a given number of animals the confi¬ 
dence in the LCio and LC go values islessthanthatintheLC 50 . 

A method widely used for determining the lethal toxicity 
parameters and confidence limits in a study where groups 
of animals are exposed to different concentrations for a 
fixed period is that of Litchfield and Wilcoxson (1949). The 
method requires information on the numbers of animals 
and the numbers of concentrations and yields the LC 50 , the 
LCi6 and the LCs4 and the confidence limits. 


18.3.10 Extrapolation between species 

The application to man of results from experiments on 
animals is an area of considerable difficulty and uncer¬ 
tainty. With many substances different species exhibit 
similar reactions and extrapolation to man may be made. 
But there are also many examples of different reactions to 
the same chemical in different species. For example, peni¬ 
cillin causes lethal haemorrhage enteritis in guinea pigs, 
but is used medically in man, while /i-napthylamine, which 
is carcinogenic to man, does not cause bladder cancer in rats. 

Accounts of the principles underlying the extrapolation 
of empirical results between species are given in Detoxifi¬ 
cation Mechanisms (R.T. Williams, 1959), Hawk’s Physiolo- 
gicalChemistry(Oser,1965),MammalianProteinMetabolism 
(Munro, 1969) and Drug Metabolism: From Microbe to Man 
(Parke and Smith, 1977) and by Freireich et al. (1966), 
S.B. Baker, Tripod and Jacob (1970), Rail (1970), F.J. Miller, 
Menzel and Coffin (1978), Paddle (1980), Purchase (1980), 
Oser (1981), Menzel and Smolko (1984) and ten Berge and 
Zwart (1989). 

One general principle is that the toxic effect is likely to 
be similar only if the target organ is the same in the two 


species. Another general principle is that what matters is 
the quantity of the toxin which reaches the target organ, 
rather than simply the quantity which enters the body. 
These two principles are applicable in the interpretation of 
the chronic effects of chemicals such as carcinogens. 

The extent to which extrapolation can be made between 
two species is illustrated by the data given by Purchase 
(1980). He examined data on 250 chemicals tested for car¬ 
cinogenicity on rats and mice and found the following 
results: 

126 chemicals positive for cancer in rats; 87% positive for 
mice also 

119 chemicals negative for cancer in rats; 82% negative for 
mice also 

130 chemicals positive for cancer in mice; 84% positive for 
rats also 

115 chemicals negative for cancer in mice: 85% negative for 
rats also 

A widely used rule-of-thumb in toxicology is that if con¬ 
sistent results are obtained for three animal species, they 
may be treated, with caution, as applicable to humans. 

For the inhalation toxicity of irritant gases, the target 
organ is the respiratory system and the quantity of toxic 
gas reaching the organ is relatively well defined. In this 
case the specific loads of toxic gas on the respiratory sys¬ 
tem of each species may be compared. 


18.3.11 Toxic risk assessment 

The information obtained from toxicity assessments of the 
kind just described may be used to make a toxic risk 
assessment for a particular chemical or plant. There are 
two rather different kinds of toxic risk assessment. One is 
the risk assessment undertaken by the regulatory agency 
in order to determine the precautions to be taken and to set 
the hygiene limits. The other is that carried out by a 
manufacturer in order to define the requirements for plant 
design and operation. 

Accounts of toxic risk assessment are given in Risk 
Assessment in the Federal Government: Managing the Pro¬ 
cess (NAS/NRC, 1983), Assessment and Management of 
Chemical Risks (Rodricks and Tardiff, 1984a), Toxicological 
Risk Assessment (Clayson, Krewski and Munro, 1985), The 
Risk Assessment of Environmental Hazards (Paustenbach, 
1989 ACGIH/37) and by Bridges (1985). 

The National Academy of Sciences (NAS) report con¬ 
siders toxic risk assessment as involving four stages: 
(1) hazard identification, (2) dose-response assessment, 
(3) exposure assessment and (4) risk characterization. 

Some of the problems of dose-response, or toxic load- 
response, assessment have already been considered. 
Clearly the existence or otherwise of a threshold value 
below which any noxious effect is negligible is a key issue. 
The definition of the level of exposure to be expected is also 
difficult but important. Once the risks have been assessed, 
they may be evaluated using suitable risk criteria. 

In the United States, toxic risk assessment has been used 
in the setting of hygiene standards. Thus for inorganic 
arsenic, the OSHA estimated, using a linear dose-response 
model, that for 1000 workers over a working lifetime there 
would be 8 excess deaths at a level of 10 mg/m 3 ,40 at 50 mg/ 
m 3 and 400 at 500 mg/m 3 , and on the basis of this assess¬ 
ment reduced the hygiene standard from 500 to 10 mg/m 3 . 
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In justifying this decision, the OSH A stated 
The level of risk from working a lifetime of exposure at 
10 mg/m 3 is estimated at approximately 8 excess lung 
cancer deaths per 1000 employees. OSHA believes that 
this level of risk does not appear to be insignificant. It is 
below risk levels in high-risk occupations but it is above 
risk levels in occupations with average levels of risk. 

18.3.12 Relevant organizations 

There are a rather large number of organizations involved 
in the assessment of toxic hazards, as regulatory bodies, 
research institutes, industrial groupings and so on. Some 
of these are listed in Table 18.5. Brief accounts of the func¬ 
tion and activities of many of these organizations are given 
by Deisler (1984b), as shown in the table. 

18.4 Control of Toxic Hazard: Regulatory Controls 

There is a worldwide trend towards much stricter regu¬ 
latory control of toxic chemicals. Elements of such control 
include determination of the properties of the substances, 
limitation of emissions to the atmosphere, setting of limits 
for airborne concentrations, monitoring and control of 
airborne concentrations, monitoring of health of workers 
and assessment of risk to workers. The legislation in the 
European Commission, the United Kingdom and the 
United States on toxic chemicals has been outlined in 
Chapter 3. This section gives further details. 

18.4.1 Control strategies 

The control of the chronic toxic hazard needs to be based on 
a coherent strategy. The outline of such a strategy is given 
by Lowrance (1984), in a review which is concerned speci¬ 
fically with carcinogens, but which is of wider applic¬ 
ability. He argues that there is need for a framework that 
allows different risks to be compared and that the approach 
taken should be more explicit. 

18.4.2 Regulatory controls in Europe 

In the European Commission, the Sixth Amendment to the 
Dangerous Substances Directive (79/831/EEC) creates 
requirements for the notification and testing of new 
chemicals. Existing chemicals are listed in the European 
Core Inventory of Existing Substances (ECOIN) and the 
European Inventory Existing of Commercial Chemical 
Substances (EINECS). 

For new chemicals a manufacturer is required to submit 
a premarketing notification (PMN). The information 
required covers the chemical and its chemical and physical 
properties, the health effects, the ecological effects, the 
production volume and major uses, and the storage, trans¬ 
port and ultimate disposal. The level of manufacture that 
attracts notification is 1 te per annum. Intermediates for 
use only on site and polymers are excluded from the noti¬ 
fication requirements. The inventory of chemicals is a 
static one. A manufacturer of a chemical must notify a new 
chemical that is not on the list, even if this has already been 
done by another manufacturer. 

The information required on the properties of the 
chemical was originally defined in the Base Set given in 
the Sixth Amendment and subsequently specified in the 
minimum premarketing data (MPD) set shown inTable 18.6. 

For chemicals to be manufactured in quantities larger 
than 1 te per annum further tests are required. The trigger 
levels are: 


Table 18.5 Some organizations involved in 
assessment of toxic hazards 


Reference a 

A EEC 


Advisory Committee on Safety, Hygiene 

201 

and Health at Work (to Council of 


Ministers) 


Association of Plastics Manufacturers in 

208 

Europe 


European Federation of Chemical 

205 

Engineering (CEFIC) Committees 


CONCAWE 

208 

European Industry Ecology and 

206 

Toxicology Centre (ECETOC) 


B UK 

Health and Safety Executive (HSE) 

208 

Advisory Committee on Toxic Substances 


British Industrial Biological Research 


Association (BIBRA) 


Chemical Industries Association 


Huntingdon Research Centre 


Medical Research Council (MRC), 


Toxicology Unit 


C USA 

Consumer Products Safety Commission 

226 

(CPSC) 


Department of Agriculture 

238 

Department of Health and Human Services 

88 

Environmental Protection Agency (EPA) 

26 

Food and Drug Administration (FDA) 

218 

National Institute for Occupational 

87 

Safety and Health (NIOSH) 


Occupational Safety and Health 

25 

Administration (OSHA) 


American Conference of Government 

107 

Industrial Hygienists (ACGIH) 


American Industrial Health Council 

131 

American Industrial Hygiene Association 

102 

(AIHA) 


Chemical Industry Institute of Toxicology 

130 

(CUT) 


Chemical Manufacturers Association 


(CM A) 


Interagency Regulatory Liaison Group 

238 

(IRLG) 


Interagency Testing Committee (ITC) 

A.S.West 


(1986) 

National Academy of Sciences (NAS) 

92 

National Cancer Institute 

86 

National Center for Health Statistics 

88 

National Center of Toxicogical Research 

82 

(NCTR) 


National Institute for Environmental 

239 

Health Sciences 


Office of Science and Technology 

93 

Policy (OSTP) 


Office of Technology Assessment (OTA) 

93 

Society of Toxicology (SOT) 

219 
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Table 18.5 (continued) 


Programs 

Health Interview Survey (HIS) 8 

Health and Nutrition Examination Survey 88 

(HANES) 

National Cancer Program 70 

National Toxicology Program (NTP) 78 

Surveillance, Epidemiology and End 87 

Results Program (SEER) 


a References are to page numbers in Deisler (1984b), unless otherwise 


Marketing level (te/year) Tests required 


1-10 MPD set 

10-100 Some Level 1 testing may 

be required 

100 (or 500 te total) Level 1 

1000 (or 5000 te total) Level 2 


The Level 1 and Level 2 sets comprise further toxicology 
and ecotoxicology tests. 

Accounts of the Sixth Amendment have been given by 
Langley (1978), C.R. Pearson (1982) and A.S.West (1986). 
An account by Rijkels (1984) on the control of carcinogens 
in Europe gives additional background. Further directives 
cover exposure to toxic chemicals (89/677/EEC) and car¬ 
cinogens (90/394/EEC). 

18.4.3 Regulatory controls in the United Kingdom 

In the United Kingdom, the control of toxic substances has 
been primarily through the Health and Safety at Work etc. 
Act 1974 (HSWA) with the HSE as the enforcing authority. 
In particular, these arrangements have applied to control of 
toxic substances in the workplace and to hygiene standards. 

The EC Sixth Amendment is implemented by the Noti¬ 
fication of New Substances Regulations 1982. The require¬ 
ments are essentially as described in the previous section. 


Table 18.6 EC minimum premarketing data set 


Physical!chemical data 

Melting point 

Octanol/water partition 
coefficient 

Boiling point 

Flashpoint 

Density 

Flammability limits 

Vapour pressure 

Explosive properties 

Surface tension 

Auto-flammability 

Water solubility 

Oxidizing properties 

Fat solubility 

UVand visible spectra 

Toxicity data 

Acute oral toxicity 

Eye irritation 

Acute dermal toxicity 

Repeated dose (28 day) 

Acute inhalation toxicity 

Mutagenicity (bacterial) 

Skin irritation 

Skin sensitization 

Mutagenicity (non-bacterial) 

Exotoxicity data 

Fish acute toxicity 

Daphnia toxicity 

Degradation (biotic and 
abiotic) 


An account of the background to these regulations has been 
given by C.R. Pearson (1982). 

The Control of Substances Hazardous to Health Regula¬ 
tions 1988 (COSHH) creates a comprehensive system of 
controls. HSE guidance is given in an associated ACOP L5 
Control of Substances Hazardous to Health and Control of 
Carcinogenic Substances (HSE, 1988). The occupational 
exposure limits t hrupatiimul 

Exposure Limits 1994 (HSE, 1994). The COSHH Regula¬ 
tions cover carcinogens and dusts. HSE guidance on car¬ 
cinogens is given in the ACOP L5, as just described. 

There are also regulations dealing with certain specific 
substances.They include the Lead at Work Regulations 1980 
and the Control of Asbestos Regulations (CAWR) 1987. 
These are described below. More detailed accounts of the 
COSHH Regulations and the CAWR are given in Chapter 25. 

The control of plants with major inventories of toxic 
chemical is exercised under the Control of Major Accident 
Hazards (CIMAH), Regulations 1984 as described in 
Chapters 3 and 4. 

Requirements for the reporting of toxic releases are 
given in the Reporting of Injuries, Diseases and Dangerous 
Occurrences Regulations 1985 (RIDDOR), as described in 
Chapter 3. 

18.4.4 Regulatory controls in the United States 

In the United States, the OSHA has responsibility for the 
control of toxic substances in the workplace. It promulgates 
and enforces hygiene standards under the Occupational 
Safety and Health Act 1970. The OSHA may adopt by 
administrative action any health and safety standards in 
federal legislation or in codes or guidelines produced by 
consensus groups. It has in fact adopted various American 
National Standards Institute (ANSI) standards and many 
ACGIH threshold limit values (TLVs). 

The OHSA issues Permanent Health Standards. The list 
of standards, as of 1983, is shown in Table 18.7. 

The Toxic Substances Control Act (TSCA) 1976 provides 
a framework for the control of toxic chemicals in manu¬ 
facture and transport. The enforcing authority is the EPA, 
which has extensive duties and powers under the act. The 
TSCA has been described in a series of papers by A.S.West 
(1979,1982,1986). 

TheTSCA lays down requirements for the notification of 
new chemicals, and is in this respect the equivalent of the 
EC Sixth Amendment, but it also contains requirements 
for existing chemicals. Some principal sections of the 
TSCA are listed in Table 18.8. Existing chemicals are listed 
in the TSCA Chemical Substance Inventory (EPA, Office of 
Toxic Substances, 1979,1982). 

For new chemicals a manufacturer is required under 
Section 5 to submit a premanufacture notice (PMN). The 
information required covers the chemical, the health effects, 
the exposure of workers, the major uses and production 


Table 18.7 OSHA Permanent Health Standards 1983“ 


Acrylonitrile 

Coke-oven emissions 

Arsenic 

Cotton dust 

Asbestos 

1,2 -Dibromo- 3 - chloropropane 

Benzene 

Lead 

14 Carcinogens 

Vinyl chloride 


a Standards promulgated in accordance with the Occupational Safety 
and Health Act, Section 6(b). 
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Table 18.8 Some principal sections of the Toxic 
Substances Control Act 1976 


Section 


4 Issue of testing rules for selected substances 
4(e) Establishment of priority list of chemicals 

5 Premanufacture notices 

6 Regulation of selected substances 

7 Regulation of imminent hazards 

8 Reporting and retention of information 

8(a) Reporting on existing chemical substances 
8(e) Notice of substantial risks 


volumes, the by-products and the ultimate disposal of the 
main product and by-products. There is no requirement for 
a base set of toxicity data, but an assessment is required of 
the health risk. 

Notification is attracted at any level of manufacture. 
Intermediates used only on site are included, as are poly¬ 
mers, with some exceptions, but chemicals in research and 
development are excluded. Once a chemical has been noti¬ 
fied by a single manufacturer, it is added to the TSCA 
Inventory, which is therefore a dynamic inventory. 

While the TSCA is broadly similar to the Sixth Amend¬ 
ment, there are some important differences. The TSCA 
covers existing as well as new chemicals and it has no 
threshold level for notification, but there is no requirement 
for abase set of toxicity data and the inventory of chemicals 
is dynamic. Detailed comparisons are given by Doyal and 
Epstein (1983) and A.S.West (1986). 

Under Section 4 of the TSCA the EPA is both empowered 
and required to initiate toxicity testing of existing chemi¬ 
cals. Recommendations for such testing are made by the 
Interagency Testing Committee (ITC), which issues peri¬ 
odic lists. The EPA is required to initiate testing or show 
cause why it has not done so, and it also issues periodic lists 
of chemicals for priority testing. 

The factors which the EPA is required to take into 
account in regulating a chemical and in establishing a rule 
for testing a chemical are specified in Section 6 of theTSCA 
and are listed in Table 18.9, Sections A and B, respectively. 

There have been a number of important legal cases that 
have influenced the control of toxic chemicals in the United 
States. The Delaney Amendment to the Federal Food, Drug 
and Cosmetic Act in 1958 banned the deliberate addition 
to food of any additive that is carcinogenic as determined 
from animal experiments or human response. This abso¬ 
lute requirement was subsequently modified on appeal to 
the effect that the Food and Drug Administration (FDA) 
was not required to bar containers in which very small 
amounts of a carcinogen, actually acrylonitrile monomer, 
were liable to migrate into the food. 

In 1977, the OSH Apromulgated an EmergencyTemporary 
Standard for benzene, followed by apermanent rule, after an 
epidemiological study that seemed to show that benzene 
was more toxic than previously supposed. In the Benzene 
Case (Industrial Union Department vs American Petroleum 
Institute) in 1980, the Supreme Court set aside the benzene 
standard and ruled that the OSHA could not adopt a stan¬ 
dard unless it finds both that there is a significant risk and 
that the standard will significantly reduce that risk. 

The Formaldehyde Case (Gulf South Insulation vs 
United States Consumer Product Safety Commission) in 


1983 involved a ban by the Consumer Product Safety 
Commission (CPSC) on urea formaldehyde foam insulation 
in homes and schools. The case centred on the interpreta¬ 
tion of epidemiological data. The court took the view that 
the methodology and data used in extrapolating to low 
exposure levels were unsatisfactory and did not meet the 
substantial evidence criterion. 

The control of major chemical hazards is exercised 
through Title III of the Superfund Amendments and Reau¬ 
thorization Act (SARA) 1988, enforced by the EPA, as 
described in Chapters 3 and 4. SARA Title III, Section 6, 
requires the EPA to create a toxic chemicals inventory, the 
toxic release inventory (TRI). 

These and other developments in the control of toxic 
chemicals in the United States may be followed through the 
references given in Table A1.4. 

18.5 Hygiene Standards 

There are two main types of toxic limit. For exposure over 
a working lifetime there are hygiene standards in the form 
of OELs, whilst for emergency exposure there are emer¬ 
gency exposure limits. Occupational hygiene standards 
are considered in this section and in Section 18.7, and 
emergency exposure limits are considered in Section 18.10. 

Three principal sets of occupational hygiene standards 
are theTLVs used in the United States, the OELs used in the 
United Kingdom and the MAK-Werte used in Germany. 

18.5.1 US threshold limit value system 

A set of threshold limit values (TLVs) is published in the 
United States by the ACGIH. The TLV system is widely 
used, not only in the United States but also in many other 
countries. 

The US TLVs are given in the Threshold Limit Values and 
Biological Exposure Indices 1992-1993 (ACGIH, 1992/80). 
Other related documents are the Guide to Occupational 
Exposure Values - 1992 (ACGIH, 1992/78), which also gives 
the German MAK-Werte; Documentation of Threshold 
Limit Values and Biological Exposure Indices (ACGIH/3); 
and Documentation for the Biological Exposure Indices 
(ACGIH/1). 

There are a number of critiques of the TLV system, 
including that by Doyal and Epstein (1983). 

18.5.2 Former UK TLV system 

As far as concerns the limits for workplace exposure to 
toxic chemicals in the United Kingdom, for many years use 
was made of a modified version of the US TLV system. This 
replaced an earlier system based on maximum allowable 
concentrations (MACs). In 1980, the United Kingdom 
moved to a system of OELs. The latter system is described 
in the following section. 

Since the TLV system has now been superseded, it is not 
appropriate to give a detailed description here. On the other 
hand, the TLV system is referred to frequently in the litera¬ 
ture and is still in widespread use in many countries. The 
general nature of the system is indicated by the following 
information taken from EH 15 TLVs for 1976 (HSE, 1977). 

In order to avoid misuse, the nature and limitations of 
TLVs need be appreciated. Some principal features are: 

(1) a TLV is not a sharp dividing line between ‘safe’ and 
hazardous concentrations; 
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Table 18.9 Factors to be considered by EPA under the Toxic Substances Control Act 1976 in regulating and in 
establishing a rule for testing a chemical 


A Regulation of a chemical 


1 Effects on health and magnitude of exposure of human beings 

2 Effects on the environment and magnitude of exposure of the environment 

3 Benefits of various uses and the availability of substitutes for each use 

4 Reasonably ascertainable economic consequences of regulation after consideration of the effect on the national 
economy, small business, technological innovation, the environment and public health 

B Rule for testing a chemical 


1 The relative costs of the various test protocols and methodologies 

2 The reasonably foreseeable availability of facilities and personnel to perform such tests 

Health and environmental effects for which standards for development for test data may be prescribed include: 

1 Carcinogenesis 

2 Mutagenesis 

3 Teratogenesis 

4 Behaviour disorders 

5 Cumulative or synergistic effects 

6 Any other effect related to unreasonable risk of injury to health or the environment 
Characteristics for which standards may be prescribed include: 

1 Persistence 

2 Acute toxicity 

3 Subacute toxicity 

4 Chronic toxicity 

5 Any other characteristic which may present such a risk 


(2) the absence of a substance from the list does not mean 
that it is necessarily safe; 

(3) the best practice is to keep the concentration of a sub¬ 
stance in the atmosphere to a minimum, regardless of 
whether it is known to present a hazard and whatever 
the value of theTLV; 

(4) the application of aTLV to a particular case is a spe¬ 
cialist matter. 


There are three categories of TLV: (1) threshold limit 
value, time-weighted average (TLV-TWA); (2) threshold 
limit value short-term exposure limit (TLV-STEL) and 
(3) threshold limit value-ceiling (TLV-C). 

The TLV-TWA is the time-weighted average (TWA) con¬ 
centration for a normal 8-h workday or 40-h workweek to 
which nearly all workers may be repeatedly exposed, day 
after day, without adverse effect. Excursions above the 
limit are allowed, provided they are compensated by other 
excursions below the limit. There is also a limit on the 
maximum concentration. In some cases it may be permis¬ 
sible to use the average concentration over a workweek 
rather than over a workday. 

The TLV-STEL is the maximum concentration to which 
workers can be exposed for a period of 15 min continuously 
without suffering from (1) intolerable irritation, (2) chronic 
or irreversible tissue change, or (3) narcosis of sufficient 
degree to increase accident proneness, impair self-rescue or 
materially reduce work efficiency, provided that no more 
than four excursions per day are permitted, with at least 
60 min between exposure periods, and provided that the 
daily TLV-TWA is not exceeded. 

The TLV-C is the concentration that should not be 
exceeded even instantaneously. Substances that are given a 


TLV-C are those that are predominantly fast-acting and 
require a limit related to this aspect. 

The TLVs on the list are expressed in two units: ppm 
(parts of gas or vapour per million parts of contaminated air 
at 25°C and 760 mmHg) and mg/m 1 2 3 4 5 6 (milligrams of sub¬ 
stance per cubic metre of air). For particulate materials the 
unit is mppcf (millions of particles per cubic foot of air). 

TLVs are based on the best available information from 
industrial experience and from experimental studies of 
humans and animals and, where possible, from all three. 
The basis of the values thus varies. In some cases it is 
freedom from irritation, narcosis or other stress, in others it 
is the absence of effects impairing health. 

The limits based on physical irritation should be 
regarded as equally binding as those based on health 
impairment, since there is increasing evidence that irrita¬ 
tion can initiate or promote impairment. 

There is a wide variation in the susceptibility of individ¬ 
uals to low levels of airborne contaminants. A small pro¬ 
portion may be seriously affected. 

The nature and amount of information on which aTLV is 
based varies widely and the degree of confidence that can 
be placed in a particularTLV is therefore variable. 

TLVs are intended for use in industrial hygiene and their 
interpretation is a specialist matter. They should not be 
used or adapted for other purposes, in particular not (1) as 
a relative index of toxicity, (2) for air pollution work or 
(3) for the assessment of toxic hazard from a continuous, 
uninterrupted exposure. They should also not be used 
as proof or disproof of an existing disease or physical 
condition or in countries where working conditions differ 
substantially from those in the United States. 

The use of aTLV implies that there must be a system for 
monitoring the concentration of the substance in the air 
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and that the measurements must be, if not continuous, at 
least frequent enough for the purpose. 

In addition to giving TLVs, EH15 also deals with the 
following: 

(1) skin effects; 

(2) mineral dusts; 

(3) nuisance particulates; 

(4) simple asphyxiants; 

(5) carcinogens. 

18.5.3 Other OSHA limits 

There are a number of other limit values. Some that are 
used by the OSHA include: 

STEL Short-term exposure limit: maximum exposure 
concentration for a period of exposure less than a 
workshift. 

MAC Maximum acceptable ceiling: maximum exposure 
concentration regardless of period of exposure. 
PEL Permissible exposure limit: applied variously to 
theTLV, STEL or MAC. 

AL Action level: one-half the PEL; the concentration 
below which additional measurements of the same 
exposure will probably not exceed the PEL. 

18.5.4 MAK-Werte limit system 

The German system of hygiene standards is the MAK- 
Werte system. As stated above, values of the MAK-Werte 
are included in Guide to Occupational Exposure Values - 
1992 (ACGIH, 1992/78). The MAK-Werte and also the 
Technische Richtskonzentrazionen (TRK) systems are 
described by Rijkels (1984). 

18.5.5 International exposure limits 

An international set of OELs are the Occupational Exposure 
Limits for Airborne Toxic Substances, published by the 
International Labour office (ILO, 1991/2). 

As already mentioned, many countries use the US TLV 
system, with or without modifications. An account of the 
limits adopted is given in Occupational Exposure Limits - 
Worldwide (Cook, 1987, AIHA/12). 

18.6 Hygiene Standards: Occupational Exposure 
Limits 

The system of OELs now used in the United Kingdom is 
described, as stated above, in EH 40/94 Occupational 
Exposure Limits 1994 (HSE, 1994). Two sets of limits are 
used. These are (1) the maximum exposure limits (MELs) 
and (2) the occupational exposure standards (OESs). The 
difference between these two types of limit is that, whereas 
an OES is set at a level at which there is no indication of 
risk to health, for an MEL a residual risk may exist. 

These OELs are to be viewed in the context of the regula¬ 
tions governing occupational health, specifically the COSHH 
Regulations 1988 and the accompanying Approved Code 
of Practice ACOP L5 Control of Substances Hazardous to 
Health and Control of Carcinogenic Substances (HSE, 1988). 
These regulations are discussed in detail in Chapter 25, the 
discussion here being confined to the OELs themselves. 

18.6.1 Maximum exposure limits 

A MEL is the maximum concentration, averaged over a 
reference period, to which an employee may be exposed 


by inhalation in any circumstances. MELs are listed in 
Schedule 1 of the COSHH Regulations 1988 and also in EH 
40/94, which also give the reference periods. 

There are two reference periods, a long-term period and a 
short-term period. The long-term period is an 8-h TWA 
period. The short-term period given in EH 40/94 is 15 min. 
This is a recent change from a previous value of 10 min. 
Selected values of the MEL from EH 40/94 are given in 
Table 18.10, Section A. 

18.6.2 Occupational exposure standards 

As already stated, an OES is a concentration at which there is 
no indication of risk to health. OESs are listed in EH 40/94, 
which is referred to in the COSHH Regulations as the list of 
Approved OESs. The reference periods are the same as for 
the MELs, the long-term one being an 8-h TWA and the 
short-term one being 15 min. Selected values of the OES 
from EH 40/94 are given inTable 18.10, Section B. 

18.6.3 Occupational exposure limit system 

Maximum exposure limits and OESs are set by the HSC 
on the recommendations of the ACTS, following assess¬ 
ment by the Working Group on the Assessment of Toxic 
Chemicals (WATCH). 

A substance is assigned an OES if it meets all three of 
the following criteria: 

Criterion 1: the available scientific evidence allows for the 
identification, with reasonable certainty, of a con¬ 
centration averaged over a reference period, at which 
there is no indication that the substance is likely to be 
injurious to employees if they are exposed by inhala¬ 
tion day after day to that concentration; and 
Criterion 2: exposure to concentrations higher than that 
derived under criterion 1 and which could reasonably 
occur in practice, are unlikely to produce serious 
shorter long-term effects on health over the period of 
time it might reasonably take to identify and remedy 
the cause of excessive exposure; and 
Criterion 3: the available evidence indicates that com¬ 
pliance with the OES, as derived under criterion 1, is 
reasonably practicable. 

A substance is assigned an MEL if it meets either of the 
following criteria: 

Criterion 4: the available evidence on the substance does 
not satisfy criterion 1 and/or 2 for an OES and expo¬ 
sure to the substance has, or is liable to have, serious 
health implications for workers; or 
Criterion 5: socio-economic factors indicate that although 
the substance meets criteria 1 and 2 for an OES, a 
numerically higher value is necessary if the controls 
associated with certain uses are to be regarded as 
reasonably practicable. 

The setting of an OES proceeds, in principle, by identi¬ 
fying the critical health effect, determining a no observable 
adverse effect level (NOAEL) and determining a limit. 
Generally the data available are from animal experiments, 
and judgement has to be exercised with respect to con¬ 
fidence levels and extrapolations. 

A substance is assigned an MEL only if there are serious 
health implications for workers, which may be serious 
effects for a small number of workers or less serious effects 
for a large number. Most substances to which MELs have 
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Table 18.10 Occupational exposure limits (OELs) of some chemicals (HSE, 1994 EH 40) (Courtesy of 

HM Stationery Office) 

A Maximum exposure limits 

(MELs) 












(8-hTWA reference period) 

(15-min reference period) 


(ppm) 

(mg/m 3 ) 

(ppm) 

(mg/m 3 ) 

Acrylonitrile 

2 

4 



Sk a 

Asbestos 

See EH 40 





Benzene 

5 

16 




Buta-1,3-diene 

10 

22 




Carbon disulfide 

10 

30 



Sk 

Ethylene oxide 

5 

10 




Formaldehyde 

2 

2.5 

2 

2.5 


Hydrogen cyanide 



10 

10 

Sk 

Isocyanates, all (as NCO) 


0.02 


0.07 

Sen b 

Lead compounds 

See EH 40 





Silica 


0.4 




Styrene 

100 

420 

250 

1050 


Trichloroethylene 

100 

535 

150 

802 

Sk 

Vin^ chloride c 

7 





B Occupational exposure sta 

ndards (OESs) 





Acetone 

750 

1780 

1500 

3560 


Ammonia 

25 

17 

35 

24 


Carbon dioxide 

5000 

9000 

15000 

27000 


Carbon monoxide 

50 


300 

330 


Carbon tetrachloride 

See EH 40 





Chlorine 

0.5 

1.5 


3 


Ethylene glycol, vapour d 


60 


125 


Hydrogen chloride 



5 

7 


Hydrogen fluoride (as F) 



3 

2.5 


Hydrogen sulfide 

10 

14 

15 

21 


Isopropanol 6 

400 

980 

500 

1225 

Sk 

LPG f 

1000 

1800 

1250 

2250 


Methanol 

200 

260 

250 

310 

Sk 

Naphthalene 

10 

50 

15 

75 


Nitric acid 

2 

5 

4 

10 


Nitrobenzene 

1 

5 

2 

10 

Sk 

Nitrogen dioxide 

3 

5 

5 

9 


Nitrogen monoxide 

25 

30 

35 

45 


Ozone 

0.1 

0.2 

0.3 

0.6 


Phenol 

5 

19 

10 

38 


Phosgene 8 

0.1 

0.4 




Sulfur dioxide 

2 

5 

5 

13 


Toluene 

50 

188 

150 

560 

Sk 



threshold of effect can be identified and for which there is 
doubt about the seriousness of exposure. 

In setting OESs account is taken of the indicative limit 
values given in EC Directive 91/332/EEC. 


4 Occupational Expo 
varies (HSE, 1992), w 


d in setting limits are given ir 


ir, either ppm or mg/m 3 ; for airborne 
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particles (fume, dust, etc.), mg/m 3 ; and for fibres, either 
mg/m 3 or fibres/ml. For dusts, limits are given as ‘total 
inhalable’ fraction unless specified as ‘respirable’ fraction. 

The treatment of substances assigned an MEL under the 
COSHH Regulations, specifically Regulation 7(4), differs 
from that of those assigned an OES. 

The lists of OESs and MELs are updated annually in 
EH 40. This publication also includes a table of new or 
revised entries in the list and a table showing substances 
which are under review. 

18.6.4 Long- and short-term exposure limits 

The basic OEL is the long-term, 8-hTWA limit, which is 
intended to control effects caused by prolonged or accu¬ 
mulated exposure. Where a substance has effects which 
occur after only a brief exposure, a short-term, usually 
15-min, limit is applied. Some substances have only a long¬ 
term limit, others have both a long-term and a short-term 
limit, and others again have only a short-term limit. Where 
a substance is governed by both types of limit, the short¬ 
term limit restricts the extent of any excursion above the 
average concentration during longer exposures. Where 
there is no short-term limit, EH 40 recommends that 
short-term excursions should not exceed three times the 
long-term limit. For some substances the effects of a brief 
exposure may be critical, and for these a short-term limit is 
used; a separate long-term limit is considered unnecessary 
and the short-term limit is applied throughout the shift. 
The period to which the limits apply are termed the refer¬ 
ence periods, the periods being, as stated, 8 h and 15 min for 
long- and short-term limits, respectively. 

18.6.5 Application of occupational exposure limits 

An MEL is a maximum limit. The long-term, 8-h limit 
attracts requirements for monitoring under the COSHH 
Regulations, unless an assessment shows such monitoring 
to be unnecessary. The Regulations also require that the 
exposure of personnel be kept as far below this level as 
reasonably practicable. The short-term, 15-min, MEL 
should never be exceeded. 

Control to or below an OES can always be regarded as 
adequate under the COSHH Regulations. However, it is still 
incumbent on the occupier to follow good occupational 
hygiene practice and it is prudent to reduce exposure 
below the OES to allow for concentration fluctuations in 
the workplace. There are certain circumstances in which 
control may still be deemed adequate even if an OES is 
exceeded; these are described in Chapter 25. 

18.6.6 Limitations of occupational exposure limits 

Occupational exposure limits are intended to be used for 
normal working conditions in factories and other work¬ 
places. Their application is not to be extended to other 
situations, and specifically they should not be used as 
limits either for emergencies or for pollution. 

18.6.7 Mixed exposures 

The majority of OELs are for individual substances, 
although a few relate to complex mixtures such as white 
spirit. In some situations workers are exposed to a mixture 
of substances. In some instances, an OEL for a mixture 
may be already established. In this case it can be used, but 
should it not be extrapolated to situations where the con¬ 
centrations are different. 


For mixtures, three different situations are recognized: 
(1) synergistic substances, where the presence of one 
substance causes another to produce a much greater toxic 
effect; (2) additive substances, where the effects of the 
substances are additive and (3) individual substances, where 
there are no known or likely synergistic or additive effects. 

Synergistic effects may arise because one substance 
enhances the toxicity of another, or because it potentiates 
the other, causing it to act in a qualitatively different way. 
Where effects are additive, EH 40 gives the following 
formula for the overall OEL: 

L =Ylj. L<1 i 18 - 6 - 1 ] 

where C, is the TWA of the zth component, L,- its OEL and L 
the overall OEL. Where effects are individual, it is suffi¬ 
cient to comply with each OEL separately. 

It will be apparent that in many situations involving 
mixtures expert advice is required. 

18.6.8 Skin effects 

For certain substances there exists the hazard of absorp¬ 
tion through the skin as well as by inhalation. EH 40 uses 
the skin notation ‘Sk’ against the substance in the lists. For 
these substances special precautions should be taken to 
prevent skin contact. 

18.6.9 Sensitizer effects 

Certain substances act as sensitizers in that they may cause 
sensitization of the respiratory tract if inhaled or of the 
skin if contact occurs. Respiratory sensitizers can cause 
asthma and other conditions, skin sensitizers cause allergic 
contact dermatitis. Individuals exposed may react even to 
minute amounts of the sensitizing substances. EH 40 uses 
the sensitizer notation ‘Sen’ against substances in the lists 
that are in certain defined categories and which have been 
identified as respiratory sensitizers. For these substances 
particular care should be taken to minimize airborne 
concentrations and to prevent their spread to other areas. 

18.6.10 Asphyxiants 

Some gases and vapours act as simple asphyxiants. They 
are hazardous insofar as they may reduce the oxygen con¬ 
tent in the workplace. They include acetylene, argon, 
ethane, ethylene, helium, hydrogen, nitrogen, propane and 
propylene. Many of these substances are colourless and 
odourless and are thus not readily detected. 

As the list just given shows, many asphyxiants are also 
flammable, and the concentration at which they present a 
fire or explosion hazard (the lower flammability limit) is 
generally lower than that at which they cause asphyxiation. 
It may be noted that many hydrocarbons are not classed as 
simple asphyxiants, but have an OEL value. Butane is one 
example. 

Asphyxiants do not rank as substances hazardous to 
health for the purposes of the COSHH Regulations. 

18.6.11 Carcinogens 

As described earlier, some carcinogenic substances are 
prohibited. Other substances that have or may have car¬ 
cinogenic potential are listed in Appendix 9 of EH 40/ 94 
and are assigned the ‘Risk phrase’ ‘R45; may cause cancer’ 
in the current edition of the Authorised and Approved 
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List: Information Approved for the Classification, Packaging 
and Labelling of Dangerous Substances for Supply and 
Conveyance by Road (the Approved List). 

Some substances listed in EH 40/94, Appendix 9, and 
assigned the ‘Risk phrase’ are given an MEL. They include 
acrylonitrile, benzene, ethylene oxide and vinyl chloride. 
Other substances are simply listed in the appendix. 

Guidance on carcinogens under the COSHH Regulations 
is given in the second of the two ACOPs in L5 Control of 
Substances Hazardous to Health and Control of Carcino¬ 
genic Substances (HSE, 1988). 

18.6.12 Dusts 

For dusts a distinction is madebetween'totalinhalable dust’ 
and ‘respirable dust’. The former approximates to the frac¬ 
tion of the airborne material that enters the mouth and nose 
during breathing and is therefore available for deposition in 
the respiratory tract. The latter refers to the fraction that 
penetrates to the gas exchange region of the lung. Details 
are given in MDHS 14 General Method for the Gravimetric 
Determination of Respirable and Total Inhalable Dust (HSE, 
1989). Some dusts are assigned an OEL. EH 40/94 gives 
OELs for a number of dusts, including grain dust and silica 
(crystalline), which have an MEL, and emery, graphite, 
limestone, silica (amorphous) and starch, which have an 
OES. Dust of crystalline silica, or quartz, is of particular 
importance as the cause of silicosis and attracts a low OEL. 
It has a long-term MEL for the respirable dust of 0.4 mg/m 3 . 

The former TLV system used in the United Kingdom 
identified some dusts as toxic and assigned a TLY but 
treated other dusts as nuisance dusts, which were not con¬ 
sidered toxic, although they could be unpleasant to breathe 
and could cause irritation by abrasive action. 

In the current system there are dusts that do not attract 
an OEL. EH 40/94 states that in the absence of a specific 
limit and of any indication for the need for a lower limit, 
exposure should be controlled below 10 mg/m 3 for an 8-h 
TWA. A concentration at this level or above is to be taken as 
a ‘substantial concentration’ for the purposes of Regulation 
2 of the COSHH Regulations and as rendering the dust a 
substance hazardous to health under those regulations. 

18.6.13 Asbestos 

Asbestos is controlled by the CAWR1987. It is considered in 
Section 18.8. 

18.6.14 Lead 

Lead is controlled by the Control of Lead at Work Regula¬ 
tions 1980, which is complemented by COP2 Control of 
Lead at Work (HSE, 1985). The lead-in-air standards given 
in this ACOP, and in EH 40/94, are as follows. The 8-h TWA 
(as Pb) is 0.15 mg/m 3 for lead and lead compounds other 
than tetraethyl lead, and 0.10 mg/m 3 for tetraethyl lead. 

18.6.15 Working conditions 

In applying OELs regard should be had to working condi¬ 
tions that may impose additional stress and may enhance 
toxic effects. These include exposure to high temperature, 
high humidity or UV radiation. 

18.7 Carcinogens 

18.7.1 Cancer risk 

There are a number of accounts of the contribution of 
cancer to mortality. They include The Causes of Cancer 


(Doll and Peto, 1981) and other treatments by Doll (1979), 
Peto (1979), A.E.M. (McLean 1979) and (Higginson 1984). 

As infectious diseases have declined as a cause of death, 
the proportion of deaths attributable to cancer has tended 
to rise. Cancer is now a major cause of death. In developing 
countries it accounts for some 20% or more of deaths. This 
is also the case for the United Kingdom and the United 
States. The numbers of people who die of cancer are there¬ 
fore large. In 1980, in England and Wales, the number of 
deaths from cancer was 130,000 and the proportion 22 %. In 
1977, cancer caused 382,000 deaths in the United States. 

The factors that cause cancer are physical, biological and 
cultural as well as chemical. Two of the principal factors are 
cultural. One of these is smoking, which is perhaps the 
most generally accepted major cause of cancer.There is also 
strong evidence that diet is another major cause. Estimates 
of the proportions of avoidable cancers given by Higginson 
and Muir (1979) in a case study done in England are given 
in Table 18.11, together with figures quoted by Doll and Peto 
(1981) in a study done in the United States. 

The trend in cancer mortality has been reviewed by Doll 
(1979), who found that over the 40-year period 1931—35 to 
1971-75, for 26 sites in the male body and 28 sites in the 
female body the age standardized mortality at 45- 
64 years of age showed less than 1% variation at 25 sites, a 
progressive decrease of more than 1% at 16 sites and a pro¬ 
gressive increase of more than 1% at 13 sites. He concludes 
that where increases in cancer rates have occurred this is 
due mainly to personal and dietary habits rather than to 
exposure to chemicals. 

The proportion of cancer deaths that are attributable to 
occupational exposure, that includes exposure to chemi¬ 
cals at work, is estimated by many authorities as about 5 %. 
In this respect the estimates given inTable 18.12 are typical. 
A review of these estimates has been given by Corn and 
Corn (1984). 

This view is strongly disputed by certain workers, who 
believe that the contribution of chemicals, in the workplace, 
in food and in the environment, is underestimated by 
‘establishment’ workers, and they represent a ‘radical’ view. 
Statements of this viewpoint are given in The Politics of 
Cancer (S.S. Epstein, 1978) and Cancer In Britain. The Poli¬ 
tics of Prevention (Doyal and Epstein, 1983). It is argued by 
these workers that exposure to chemicals may account for 
some 40% of cancer deaths. 


Table 18.11 Estimates of the proportion of avoidable 
cancers a (after Higginson and Muir, 1979) 


Feature 

Proportion of avoidable deaths (%) 

Male 

Female 

Tobacco 

30 

7 

Alcohol 

5 

3 

Life-style 

30 

63 

Occupation 

6 

2 

Iatrogenic 

1 

1 

Geophysical 

11 

11 

Congential 

2 

2 

Unknown 

15 

11 


“Figures given by Doll and Peto (1981) for the United States include 
the following proportions for both sexes: tobacco 30%; alcohol 3%; 
life-style 42%; infection 10%; and occupation 4%. 
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Table 18.12 Estimates of cancer deaths attributable to occupational exposure (after US Congress, Office of 


Technology Assessment, 1981) 


Preferred estimate (%) 

Period to which estimate applies 

Reference 

Male incidence, USA 

4 

1976 

Wynder and Gori (1977) 

Female incidence, USA 

2 

1976 


Male cancer, England 

6 

1968-72 

Higginson and Muir (1979) 

Female cancer, England 

2 

1968-72 


Male mortality, USA 

6.8 

1977 

Doll and Peto (1981) 

Female mortality, USA 

1.2 

1977 



These critics (e.g. S.S. Epstein, 1978) argue that there is a 
tendency to estimate the proportion of cancers attributable 
to chemicals as the residue remaining after estimates have 
been made of those attributable to other causes and that 
this approach is unsound. On the other hand, it is argued 
(e.g. Peto, 1980) against these critics that they tend to make 
their estimates of potential cancer mortality from a par¬ 
ticular chemical by combining the numbers exposed to any 
level of the chemical with the risk attributable to persons 
exposed to very high levels. 

The authors of the Health and Safety Statistics 1990—91 
(HSE, 1992b) discuss the number of premature deaths from 
cancer. On the basis of the work of Doll and Peto it might 
be estimated that about 4% of cancers are work-related, 
which would give some 5000 premature deaths. A death 
from cancer might be avoided by the removal of any one of 
a number of contributing factors, of which workplace 
exposure is only one. The only hard statistics given are 
that there were some 78 cases of awards for occupational 
cancer other than mesothelioma (from asbestos). 

18.7.2 Regulatory controls in Europe 

The Sixth Amendment to the EC Directive on Dangerous 
Substances (79/831/EEC) creates controls on the introduc¬ 
tion of new chemicals and thus of potential carcinogens. 
There is, in addition, a specific Directive that deals with 
carcinogens (90/394/EEC). 

There is also an ILO Convention on Carcinogenic Sub¬ 
stances and Agents. An account of the European arrange¬ 
ments for the regulation of carcinogens is given by Rijkels 
(1984). 

18.7.3 Regulatory controls in the United Kingdom 

The Carcinogenic Substances Regulations 1967 prohibit 
the use of certain human carcinogens and the Carcinogenic 
Substances (Prohibition of Importation) Order 1967 pro¬ 
hibit their importation. 

As stated earlier, the COSHH Regulations 1988 cover 
carcinogens. HSE guidance is given in the associated 
ACOP L5 Control of Substances Hazardous to Health and 
Control of Carcinogenic Substances (HSE, 1988). The OELS 
are given in EH 40/94 Occupational Exposure Limits 1994 
(HSE, 1994). Carcinogens are one of the categories of sub¬ 
stance given in the MEL list. 

The control of one particular important carcinogen, 
asbestos, is effected through the CAWR1987. 

18.7.4 Regulatory controls in the United States 

In the United States the framework legislation for the con¬ 
trol of carcinogens, as for other toxic chemicals, is the 
Occupational Safety and Health Act 1970 administered by 


OSHA, but other legislation of particular relevance is the 
TSCA 1976 administered by the EPA. The control of car¬ 
cinogens in the workplace is effected through the system 
of standards set by the OSHA. 

The standards that may now be adopted are constrained 
by the results of the Benzene Case and the Formaldehyde 
Case, described above. Between 1977 and 1980, the OSHA 
attempted in the document Identification, Classification and 
Regulation of Occupational Carcinogens (OSHA, 1977) to set 
a generic standard for carcinogens. The Benzene Case 
increased the difficulty of creating such a standard and a 
generic standard was not adopted. 


18.7.5 Carcinogenic chemicals 

Some information on the toxicity of carcinogens is given in 
works on the toxicity of chemicals in general, of which 
carcinogenic chemicals are a subset, but there are also a 
number of specific treatments. Accounts of carcinogenic 
substances are given in Cancer Causing Chemicals (Sax, 
1981), CarcinogenicallyActive Chemicals: A Reference Guide 
(Lewis, 1991 ACGIH/53) and Handbook of Toxic and Haz¬ 
ardous Chemicals and Carcinogens (Sittig, 1991ACGIH/59). 

The identification of chemicals that are carcinogenic is 
one of the main tasks of the International Agency for 
Research on Cancer (IARC). By 1979 the IARC (1979a) had 
identified 16 chemicals and industrial processes, as well as 
soot and vinyl chloride, for which there is sufficient epi¬ 
demiological evidence to indicate a link between exposure 
and excess cancer in man. It has also identified a further 18 
chemicals which the epidemiological evidence indicates as 
being probable human carcinogens. 

According to Corn and Corn (1984), there are some 350 
chemicals that are suspected of being human carcinogens. 
A list of carcinogens regulated hy the OSHA for airborne 
concentrations in 1980 is given in Table 18.13. 


18.7.6 Benzene 

Benzene is an important chemical in the petroleum and 
petrochemical industries and the numbers of people who 
have been exposed to it in some degree is large. For many 
years it was regarded as not particularly toxic. The attitude 
to exposure both in industry and in laboratories was rela¬ 
tively relaxed. More recently the long-term effects of ben¬ 
zene on the blood and bone marrow and its carcinogenic 
properties have been better appreciated and the hygiene 
limits have been greatly reduced. 

Reviews of toxicity are given in Criteria Document Publ. 
74-137 Benzene (NIOSH, 1974), TR 4 Toxicity Review: 
Benzene (HSE, 1982), Benzene: Occupational and Environ¬ 
mental Hazards (Mehlman, 1989 ACGIH/28) and EH 64 
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Table 18.13 OSHA list of carcinogens for airborne 
concentrations 1980 


2 - Acetylaminof luorene a 
Acrylonitrile 3 
4-Aminodiphenyl a 
Arsenic 3 

Asbestos 3 
Benzene 3 
Benzidine 3 

Bis(chloromethyl)ether 3 
Chromic acid and 
chromates’ 5 
Coke-oven emissions 3 
l,2-Dibromo-3- 
chloropropane 

a Permanent standards promulgated after Administrative Procedures 
Act rule-making. 
b From the ANSI list. 


Occupational Exposure Limits: Criteria Document Summaries 
(HSE, 1992). 

The development of controls on benzene is described by 
Thorpe (1978a,b) and by Barnard (1984). The following 
extracts from a table by Thorpe (1978a) illustrate the tight¬ 
ening of exposure standards in the United States: 


Year 

(ppm) 

Standard 

1946 

100 

ACGIH TLV 

1947 

50 

ACGIH TLV 

1957 

25 

ACGIH TILV-TWA 

1963 

25 

ACGIH TLV-C 

1969 

10 

ANSI TLV-TWA, with ceiling of 25 ppm 

1976 

1 

OSHA (proposed) with 5 ppm excursion 


The HSE paper reviews the toxicity of benzene and micro¬ 
organism tests, animal experiments and epidemiological 
data. Benzene affects the formation of blood cells in bone 
marrow. It may reduce the number of red cells, white cells 
or platelets, or all three. It may cause anaemia or leukaemia. 

Although in all three types of toxicity investigation there 
are many studies that have given negative results, some 
have demonstrated injurious effects. Carcinogenic, muta¬ 
genic and teratogenic effects have all been demonstrated 
for benzene in animal experiments. The review describes a 
number of epidemiological studies of workers exposed to 
benzene. A study by Infante et al. (1977a,b) of 748 workers 
on rubber film in Ohio found a significant increase in 
leukaemia. The authors quote low levels of exposure, below 
15 ppm in most cases, but have apparently subsequently 
accepted that the levels may have been 100 ppm or more. 
Another study in which a significant increase in leukaemia 
was found is that by Pagnotto, Elkins and Brugsch (1979) 
on 549 workers at a Dow Chemical plant in the United States 
with very low exposures, about 2 ppm, but the workers 
concerned had a varied history of exposure to chemicals 
and there was no significant increase in leukaemia among 
other workers exposed to higher concentrations. Other 
studies that either are inconclusive or have shown no 
significant increase in leukaemia include those by Thorpe 


(1974) on 38,000 workers exposed to petroleum products, 
and Rushton and Alderson (1981) on 35,000 oil refinery 
workers. 

The HSE review concludes that there is considerable 
evidence that exposure to high concentrations of benzene 
may eventually cause leukaemia, but that there is no 
conclusive evidence of leukaemia in workers exposed to 
lower concentrations. The only work reviewed in which 
there was an increase in leukaemia among workers exposed 
to less than 100 ppm was the Dow Chemical study just 
described. Increasing awareness of the toxicity of benzene 
has led to a progressive reduction in the hygiene limits. 
This is illustrated by the data given earlier. There has also 
been a corresponding tightening of the regulatory controls. 
As described above, in the United States this led to the 
attempt by the OSHA to introduce a very low benzene 
standard and the rejection of this by the courts in the 
Benzene Case. In the United Kingdom benzene has a long¬ 
term MEL of 5 ppm. 

18.7.7 Vinyl chloride 

Vinyl chloride monomer (VCM) is manufactured on a large 
scale and polymerized to give PVC, which is one of the most 
common plastics. It has a boiling point of -13°C and 
therefore is a gas at ambient temperatures. 

Accounts of the toxicity of vinyl chloride are given in 
Criteria Document Publ. 78-205 (NIOSH, 1978), EH 64 
Occupational Exposure Limits: Criteria Document Sum¬ 
maries (HSE, 1992), and in the other references quoted 
below. 

Until the mid-1970s, vinyl chloride was regarded as a 
mild narcotic less harmful than chloroform. The ACGIH 
TLV was 500 ppm and the UK TLV was 200 ppm (HSE, 1972 
TON 2/72). 

It was also well known that vinyl chloride could give rise 
to acro-osteolysis, which involves deterioration of thebones, 
particularly the fingers, and certain other conditions. These 
diseases have been found mainly in PVC workers in cir¬ 
cumstances where the exposure may well have been at con¬ 
centrations appreciably above 1000 ppm. However, in 1974 it 
was found, that vinyl chloride is a carcinogen. 

Accounts of the development of the vinyl chloride prob¬ 
lem are given in the Annual Report ofHM Chief Inspector of 
Factories 1974 (HMFI, 1974) and by Atherley (1978), Doyal 
and Epstein (1983) and Corn and Corn (1984). 

Indications of the carcinogenicity of vinyl chloride were 
given by animal experiments conducted by Viola (1970), but 
the first widespread impact was made by a report from a 
BE Goodrich plant in the United States that three cases of a 
rare liver cancer, angiosarcoma, had been discovered and 
were probably associated with exposure to high levels of 
vinyl chloride. The men concerned had been autoclave 
cleaners in plant polymerizing vinyl chloride to PVC. The 
average time for the condition to develop after first expo¬ 
sure was 19 years. 

It is noteworthy that the cancer associated with vinyl 
chloride is a rare one. The discovery of a carcinogenic effect 
could have been much more difficult if the cancer had been 
of a type that also has other causes, such as the lung cancer 
that can be caused by cigarette smoking. It is probably fair 
to say that this discovery has had as great an impact in the 
area of chronic toxic exposure as the Flixhorough disaster 
has had in the area of fire and explosion. 

By the end of 1974, some 25 cases of angiosarcoma in 
workers exposed to vinyl chloride had been established 


3.3 -Dichlorbenzidine 3 

4 -Dimethylaminoazobenzene 3 
Ethyleneimine 3 

4.4 -Methylene-bis 
(2-chloronile) 

/3-Naphthylamine 3 
Nickel (and salts) 
4-Nitrobiphenyl 3 
A-Nitrobiphenyl 3 
Propiolactone 3 

Soots, tars, and mineral oils 
Vinyl chloride 3 
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worldwide. These were mostly in the United States and 
mostly in one company. 

In the United States, the OSHA reduced the standard 
from 500 ppm to an interim standard of 50 ppm and then to 
aTLVof 1 ppm and a maximum of 5 ppm. It was envisaged, 
however, that it might be necessary to rely on the extensive 
use of respirators to meet these levels of exposure. 

In the United Kingdom, the HSE issued Vinyl Chloride 
Code of Practice for Health Precautions (HSE, 1975b), 
which gave as an interim standard aTLVof 25 ppm and a 
maximum of 50 ppm. 

Guidance to industrial users of the monomer was given 
in Vinyl Chloride Monomer. Advisory Notes for PVC Pro¬ 
cessors (BCISC, 1974/14). Notes on best practicable means 
for PVC polymer plants were given in the Annual Report on 
Alkali, etc. Works 1974. The publication Vinyl Chloride and 
You was issued to workers. 

The monitoring of very low concentrations of vinyl 
chloride requires sensitive analytical methods. In the 
1970s, there was intense activity in this area. Methods of 
analysis were described in The Determination of Vinyl 
Chloride -A Plant Manual (CIA, 1975/7). 

Various other countries adopted very low standards for 
vinyl chloride. The United Kingdom approach was based on 
the argument that it is preferable to devote effort to reduc¬ 
ing the concentration of vinyl chloride in the atmosphere by 
improved engineering than to rely on respirators, which 
may well not be used. 

The reduction of concentrations of vinyl chloride to very 
low levels is a difficult engineering problem. Early experi¬ 
ence was that it was more difficult to eliminate occasional 
peaks over 50 ppm than to achieve theTWA of 25 ppm. 

A survey of the atmospheric concentrations of vinyl 
chloride at plants in the United Kingdom was made in 1974 
by the CIA (quoted by McKinnon, 1974). The survey estab¬ 
lished that the approximate exposure levels in the plant 
atmosphere were: 


Explosure level 
(ppm) 

Plants polymerizing VCM to PVC 

50 

Plants producing VCM 


5 

Plants fabricating PVC 


0-5 

The survey obtained the following figures for the weekly 

average gas concentration in 

the seven polymerization 

plants in the United Kingdom: 



Plant 


Weekly average 
concentration 
(ppm) 

A 


25 

B 


10 

C 


10 

D 


25 

E 


20 

F 


40 

G 


30 


The CIA stated that the ultimate for most existing plants 
is 10 ppm and that entirely new plants with the most mod¬ 
ern techniques might achieve 5 ppm. 


Accounts are also available of measures taken at that 
time to reduce exposure at plants in the United States and 
elsewhere (e.g. Chementator, 1975 Apr. 14,33; Jul. 7,34; 1977, 
Jan. 3, 37). Indications were that the achievement of low 
levels of exposure did not prove as difficult as was some¬ 
times anticipated (e.g. Meade and Press, 1977). 

Information on plant emissions of vinyl chloride has 
been given by Sittig (1978), who quotes vent and fugitive 
emission rates. The development of controls on vinyl chlo¬ 
ride in the United States may be followed through the 
references given in Table A1.4. 

In the United Kingdom vinyl chloride has a long-term 
MEL of 7 ppm with an overriding annual MEL of 3 ppm. 

18.7.8 Acrylonitrile 

In 1977, several animal and epidemiological studies were 
published which showed carcinogenic effects from acrylo¬ 
nitrile. One of these was an epidemiological study by 
Dupont on 470 workers in an acrylic fibre plant in South 
Carolina, which showed the incidence of excess cancers. 

As described by Karrh (1984), the company made its 
data, interpretation and recommendations available to the 
OSHA that accepted these and based a standard on them. 
The standard set by the OSHA was 2 ppm. This case is 
therefore an interesting example of co-operation between 
industry and the regulatory authorities. The author adds 
that, to his knowledge, this is the only OSHA health 
standard which has not been the subject of litigation. 

In the United Kingdom, the practicality of the 2 ppm 
standard was a matter of some debate, but by 1981 this level 
was accepted, as described by Doyal and Epstein (1983). 
Acrylonitrile now has a long-term MEL of 2 ppm. 


18.7.9 Other substances 

Other substances with carcinogenic potential include bis{- 
chloromethyl) ether (BCME), formaldehyde, inorganic 
arsenic and asbestos. 

For BCME the toxicity and development of controls are 
described Doyal and Epstein (1983) and by Kusnetz and 
Lynch (1984). 

Chloromethyl ether (CME) is manufactured by reacting 
formaldehyde and hydrogen chloride. BCME is an inter¬ 
mediate and a contaminant in the CME. BCME has long 
been known to be a highly toxic irritant gas, but awareness 
of its carcinogenic properties dates from various epi¬ 
demiological and animal studies done in the 1960s and 
1970s. In 1982, the ACGIH classified BCME as a carcino¬ 
gen. In the UK BCME has a long-term MEL of 0.001 ppm. 

For formaldehyde a review of toxicity is given in TR2 
Toxicity Review: Formaldehyde (HSE, 1981). The toxicity and 
the development of controls on formaldehyde are described 
by Neal and Gibson (1974), Doyal and Epstein (1983), 
Barnard (1984), and Gough (1984). 

Formaldehyde has been shown to be carcinogenic to 
rodents, but there is disagreement among experts on the 
extent of its human carcinogenicity. In the Formaldehyde 
Case the CPSC used some of the animal experiments and 
interpretations in support of its ban on urea formaldehyde 
insulation, but its assessment was not accepted by the 
court. Following a further expert review under the aegis of 
the National Center of Toxicological Research (NCTR), the 
OSHA decided not to alter its standard for formaldehyde. 
In the United Kingdom, formaldehyde has long- and short¬ 
term MELs that are both 2 ppm. 
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For inorganic arsenic the toxicity and development 
of controls are described by Lowrance (1984), Neal and 
Gibson (1984) and Sagan and Whipple (1984). There is 
epidemiological evidence of the human carcinogenicity 
of inorganic arsenic (OSHA, 1983). In 1983, on the basis of 
this evidence, the OSHA adopted a standard of 10 pg/m 3 . 
As described above, the reasoning given by the OSHA 
in support of this standard, though not necessarily the 
numerical values, is commended by Lowrance (1984) as 
a model. In the United Kingdom, inorganic arsenic has 
a long-term MEL of 0.1 mg/nr. 

Asbestos is a carcinogenic dust and is considered in 
Section 18.8. 

18.8 Dusts 

There are many industrial chemicals that are used in 
powder form and can give rise to dust in the atmosphere. 
Dust may also be generated by the attrition of materials. 

Dusts are covered by the OEL system, and OELs for 
dusts have been described in Section 18.6. 

Some dusts are not classified as having any specific 
toxic effect, but can cause irritation. Excessive quantities 
of such dust are unpleasant to inhale, can deposit in the 
eyes and ears, and can injure the skin or mucous mem¬ 
branes by chemical or mechanical action or through the 
cleaning procedures necessary to remove them. 

Other dusts can cause injurious effects. One such dust 
is silica in the crystalline, or quartz, form. A well-known 
example is the silica dust produced in coal mining, which 
causes pneumoconiosis, a progressive fibrosis of the lung 
tissue. 

Fibrosis can also be caused by asbestos dust. In addition, 
this dust is a carcinogen. Asbestos is considered in more 
detail below. 

Metal dusts that are sufficiently fine can enter the lungs 
and give rise to the toxic symptoms associated with the 
parent metal. 

Other dusts which are themselves non-fibrogenic may 
produce an allergic response in the lungs that leads even¬ 
tually to fibrosis. Such conditions are ‘farmer’s lung’ and 
byssinosis, an asthmatic condition prevalent in the cotton 
industry. Process workers involved with enzyme washing 
powders have experienced similar asthmatic conditions. 

The control of dust in the workplace is considered in 
Chapter 25. 

18.8.1 Asbestos 

‘Asbestos’ is a generic term that is applied to a number of 
naturally occurring, hydrated mineral silicates. More than 
90% of the world production of asbestos is as is chrysotile 
(‘white’) asbestos. Virtually all the rest is amosite (‘brown’) 
and crocidolite (‘blue’) asbestos. 

Accounts of the toxicity of asbestos include Criteria 
Document Publ. 77-169 Asbestos (NIOSH, 1977), Asbestos: 
Medical and Legal Aspects (Castleman, 1990 ACGIH/39), 
EH 64 Occupational Exposure Limits: Criteria Document 
Summaries (HSE, 1992) and the other references quoted 
below. Other HSE publications on asbestos are given in 
Chapter 25. 

Asbestos has been in widespread use as a material for 
building products, fireproofing, lagging, brakes, glands 
and many other purposes. Asbestos dust is generated to 
some degree in many of these applications, particularly in 
cutting and demolition operations. 


There are two injurious effects caused by asbestos dust, 
the fibres of which enter the lung. One is asbestosis, a 
fibrosis of the lung. The other is mesothelioma, a rare can¬ 
cer of the lung and bowels, of which asbestos is the only 
known cause. 

Evidence of the hazard of asbestos appeared as early as 
the 1890s. Of the first 17 people employed in an asbestos 
cloth mill in France, all but one were dead within 5 years. 
Oliver (1902) describes the preparation and weaving of 
asbestos as ‘one of the most injurious processes known 
to man’. 

In 1910, the Chief Medical Inspector of Factories, 
Thomas Legge, described asbestosis. A high incidence of 
lung cancer among asbestos workers was first recognized 
in the 1930s and has been the subject of continuing 
research. The synergistic effect of cigarette smoking, which 
greatly increases the risk of lung cancer to asbestos 
workers, was also discovered (Doll, 1955).The specific type 
of cancer, mesothelioma, was identified in the 1950s 
(Q.C. Wagner, 1960). 

In the United Kingdom, an Act passed in 1931 introduced 
the first restrictions on the manufacture and use of asbes¬ 
tos. It has become clear, however, that the concentrations of 
asbestos dust allowed by industry and the Factory Inspec¬ 
torate were too high. In consequence, numbers of people 
have been exposed to hazardous concentrations of the dust 
over long periods. 

The problem was dramatically highlighted by the tragedy 
of the asbestos workers at Acre Mill, Hehden Bridge. The 
case was investigated by the Parliamentary Commissioner 
(Ombudsman, 1975-76). It was found that asbestos dust 
had caused disease not only to workers in the factory but 
also to members of the public living nearby 

Although all types of asbestos can cause cancer, it is held 
that crocidolite, or blue asbestos, is the worst offender. 

By the late 1960s, growing concern over the asbestos 
hazard in the United Kingdom led to action. The building 
industry virtually stopped using blue asbestos in 1968 and 
the Asbestos Regulations 1969 prohibited the import, 
though not the use, of this type of asbestos. 

The problem of asbestos continued to be a subject 
of controversy (e.g. Kinnersley, 1976; W.P. Howard, 1976). 
Criticisms included the failure of industry and government 
to act earlier, the adequacy of current concentration stand¬ 
ards, the particular hazard of blue asbestos, and the effect 
of ‘casual’ exposures. Obviously the problem is more diffi¬ 
cult if it is not confined to blue asbestos and if even occa¬ 
sional exposure can cause cancer. 

Most cases of disease from asbestos are associated 
with exposure over a period of years and often in high 
dust concentrations, but several cases have been quoted of 
contraction of the cancer after apparently very short 
exposure. However, in some of these at least, it has been 
shown that the exposure, though short, was in fact quite 

As a result of continuing concern, in 1976 the Govern¬ 
ment set up an Advisory Committee on Asbestos (ACA). 
The asbestos industry also set up its own Asbestos Advi¬ 
sory Committee. In contrast to most of the other chemicals 
discussed earlier, and in particular to VCM, asbestos is a 
material widely used by the public. The industry was 
therefore faced with the problem of allaying the fears of 
numerous and relatively unsophisticated users. 

The Asbestos Regulations 1969 were followed by further 
legislative requirements. These include The Asbestos 
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(Licensing) Regulations 1983 and the Asbestos 
(Prohibition) Regulations 1985. 

The CAWR1987, which revoke the Asbestos Regulations 
1969, now provide a comprehensive set of controls on 
asbestos. The corresponding ACOP is L27 The Control of 
Asbestos at Work (HSE, 1988). 

The CAWR 1987 set control limits for asbestos. These 
limits are reproduced in EH 10 Asbestos - Exposure Limits 
and Measurement of Airborne Dust Concentrations (HSE, 
1990) and in EH 40/94. They are given in Chapter 25 where 
the CAWR 1987 are discussed in more detail. A more 
stringent limit is applied for crocidolite or amosite 
asbestos. 

Although there is now much more stringent control of 
asbestos dust, the backlog of exposure in previous years is 
likely to claim victims for some time to come. The Health 
and Safety Statistics 1990-91 (HSE, 1992b) give, for 1990, 
882 deaths recorded as due to mesothelioma and another 
163 deaths recorded as due to asbestosis (excluding those 
where mention is made of mesothelioma). 

18.8.2 Dust and fume atmospheres 

Not infrequently, dusts occur as part of a mixture of 
dusts, fumes, gases and vapours. This is the situation, 
for example, in ferrous foundries. A recent review of air¬ 
borne ferrous foundry particulates (HSE, 1994a) has 
highlighted the enhanced risk of lung cancer from such 
atmospheres. 

18.9 Metals 

The toxic effects of metals and their compounds vary 
according to whether they are in inorganic or organic 
form, whether they are in the solid, liquid or vapour phase, 
whether the valency of the radical is low or high and 
whether they enter the body via the skin, lungs or alimen¬ 
tary tract. 

Some metals that are harmless in the pure state form 
highly toxic compounds. Nickel carbonyl is highly toxic, 
although nickel itself is fairly innocuous. The degree of 
toxicity can vary greatly between inorganic and organic 
forms. Mercury is particularly toxic in the methyl 
mercury form. 

The wide variety of toxic effects is illustrated by the 
arsenic compounds. Inorganic arsenic compounds are 
intensely irritant to the skin and bowel lining and can 
cause cancer if exposure is prolonged. Organic compounds 
are likewise intensely irritant, produce blisters and damage 
the lungs, and have been used as war gases. Hydrogen 
arsenic, or arsine, is non-irritant, but attacks the red cor¬ 
puscles of the blood, often with fatal effects. 

Hazard arises from the use of metal compounds as 
industrial chemicals. Another frequent cause of hazard is 
the presence of such compounds in effluents, both gaseous 
and liquid, and in solid wastes. Fumes evolved from the 
cutting, brazing and welding of metals are a further 
hazard. Such fumes can arise in the electrode arc welding of 
steel. Fumes that are more toxic may be generated in work 
on other metals such as lead and cadmium. 

The HSE has issued a number of Guidance Notes on 
metals and their hazards, including notes on cadmium 
(EH 1), chromium (EH 2), arsenic (EH 8), beryllium (EH 13), 
mercury (EH 14), antimony (EH 17) and lead (EH 29). There 
are also notes on the compounds arsine (EH 11), stibine 
(EH 12) and phosphine (EH 20). 


18.9.1 Lead 

One of the metals most troublesome in respect of its tox¬ 
icity is lead. Accounts of the toxicity of lead are given in 
Criteria Document Publ. 78-158 Lead, Inorganic (NIOSH, 
1978) and EH 64 Occupational Exposure Limits: Criteria 
Document Summaries (HSE, 1992). 

The toxicity of lead and its compounds has been known 
for a long time, since it was described in detail by 
Hippocrates. Despite this, lead poisoning continues to be a 
problem, particularly where cutting and burning opera¬ 
tions, which can give rise to fumes from lead or lead paint, 
are carried out. Fumes are emitted above about 450- 
500°C. These hazards occur in industries working with 
lead and in demolition work. 

Legislation to control the hazard from lead includes 
the Lead Smelting and Manufacturing Regulations 1911, 
the Lead Compounds Manufacture Regulations 1921, and the 
Lead Paint (Protection against Poisoning) Act 1926 and the 
Control of Lead at Work Regulations 1980. The associated 
ACOP is COP 2 Control of Lead at Work (HSE, 1988). 

The limits for lead, which is referred to as the ‘lead-in-air 
standard’, are given in COP 2 and in Appendix 5 of EH 40. 
They have been given in Section 18.6. 

Monitoring of lead in the working environment is dealt 
with in EH 28 Control of Lead: Air SamplingTechniques and 
Strategies (HSE, 1986). 

TheAnnual Report of HM Chief Inspector of Factories 1974 
records 36 cases of lead poisoning in that year. Also, 154 
employees were removed from lead work because of 
increased lead absorption. The number of cases of lead 
poisoning was 82 in 1972 and 59 in 1973. The Health and 
Safety Statistics 1990-91 (HSE, 1992b) do not quote cases 
of lead poisoning but the statistics given show that in 
1990—91 some 258 male workers and 26 female workers 
were suspended from work due to the levels of lead in their 
blood. 

18.9.2 Mercury 

Another highly toxic substance is mercury. This is used on 
a large scale in the chemical industry in the manufacture of 
chlorine by the mercury cell process. 

Mercury is particularly toxic in the organic form, and 
especially as methyl mercury. Organic mercury was 
responsible for the tragedy at Minimata, Japan, where 
many members of the public were poisoned and deformed 
by liquid effluent containing mercury. 

Mercury vapour from spillage of the metal should also 
be treated as hazardous. 

Industrial use of mercury is dealt with in EH 17 Mercury - 
Health and Safety Precautions (HSE, 1977). 

18.10 Emergency Exposure Limits 

Limits for occupational exposure are complemented by 
limits for emergency exposure. A number of types of limit 
for exposure in an emergency have been defined by various 
bodies, but it is fair to say that there is no system with a 
status comparable to that of theTLVor OEL systems. 

Some emergency exposure limits, emanating from vari¬ 
ous bodies, include the following: 

EEGL Emergency exposure guidance level 

EEI Emergency exposure index 

EEL Emergency exposure limit 

ERPG Emergency response planning guideline 
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IDLH Immediately dangerous to life and health (limit) 

PEEL Public emergency exposure limit 

SPEGL Short-term Public Emergency Guidance Level 

The National Research Council (NRC) Committee on 
Toxicology has, since the 1940s, submitted to the Department 
of Defense EEGLs for toxic chemicals. An EEGL is a con¬ 
centration that is judged acceptable and which will permit 
exposed individuals to perform specified tasks during 
emergency conditions lasting from 1 to 24 h. The NRC has 
also developed SPEGLs. These are acceptable concentra¬ 
tions for exposures of members of the general public. Some 
early limits were those given in the Guides for Short Term 
Exposure of the Public to Air Pollutants (NAS/NRC, 1972a, 
1973). More recent publications are the Guidance Levels for 
Emergency and Continuous Exposure to Selected Airborne 
Contaminants (NAS, 1984-). 

A number of EELs were developed in the early 1970s in 
the Netherlands, as described by the Committee for the 
Prevention of Disasters (CPD) in the Netherlands (1974) and 
by Zielhuis (1970), Siccama (1973) and Balemans (1975). 

The NIOSH has published a set of IDLH limits. NIOSH 
data are given in the Pocket Guide to Chemical Hazards 
(NIOSH, 1990/18). 

The AIHA publishes a series Emergency Response Plan¬ 
ning Guidelines (AIHA, 1988-/13). An ERPG is the maxi¬ 
mum airborne concentration below which, it is believed, 
nearly all individuals could be exposed for up to 1 h without 
experiencing or developing certain defined effects. Three 
ERPGs are used, the defined effects being as follows: 

ERPG-1 Effects other than mild transient adverse health 
effects or perception of a clearly defined objec¬ 
tionable odour. 

ERPG-2 Irreversible or other serious health effects or 
symptoms that could impair an individual’s 
ability to take protective action. 

ERPG- 3 Life threatening health effects. 

So far some 40 ERPGs have been published. The ERPG-2 is 
broadly similar to the EEGL. 

Another emergency limit is the EEI given in Emergency 
Exposure Indices for Industrial Chemicals (ECETOC, 1991). 
Three EEIs are defined, namely EEI-1, EEI-2 and EEI-3, 
which separate four zones of effect: detection, discomfort, 
disability, and permanent incapacity/death. 

Another limit used is the PEEL. This is a maximum air¬ 
borne concentration to which a member of the public may 
be exposed without significant adverse effects. 

Critical reviews of emergency exposure limits are given 
in the QRA Guidelines (CCPS, 1989/4) and by Franklin 
(1991). 

18.10.1 Dow Chemical Exposure Index 

There are also indices for acute toxic exposures that are not 
a simple concentration value, but take account of other 
parameters also. One such is the Chemical Exposure Index 
(CEI) developed by the Dow Chemical Company (1994a) 
and described by R.A. Smith and Miller (1988). 

The CEI takes account of (1) toxicity, (2) quantity, (3) dis¬ 
tance, (4) molecular weight and (5) process variables, and 
the index is computed as the product of a set of ‘scale fac¬ 
tors’ which allow for these features. The authors give full 
details, including proformas and credit factors. 


18.11 Gas Toxicity 

18.11.1 Industrial gases 

Some of the principal toxic gases which are handled in the 
chemical industry and the toxic effect which each exerts are: 


Gas 

Toxic effect 

Ammonia 

Irritant 

Bromine 

Irritant 

Chlorine 

Irritant 

Hydrogen chloride 

Irritant 

Hydrogen cyanide 

Systemic 

Hydrogen fluoride 

Systemic (fluoride poisoning), 
irritant 

Hydrogen sulfide 

Systemic irritant 

Phosgene 

Irritant 

Sulphur dioxide 

Irritant 


All except one of these gases are irritants. In this context 
‘irritation’ is a technical term: the effect ranges from mild 
discomfort to death. An irritant gas attacks the respiratory 
tract and the lungs. The locus of action depends mainly on 
the solubility of the gas, the more soluble gases attacking 
the respiratory tract and the less soluble the lungs. The 
action of irritant gases has been described by Haggard 
(1924) as follows: 

Ammonia produces intense congestion of the upper 
respiratory passages and immediate death from lar¬ 
yngeal spasm or oedema; on the other hand phosgene and 
nitrogen peroxide cause little irritation of the upper 
respiratory tract but induce pneumonia or lung oedema 
through their action upon the lung alveoli; chlorine in its 
action is intermediary between ammonia on the one hand 
and phosgene and nitrogen peroxide on the other. 

Of the irritant gases, ammonia and hydrogen fluoride are 
miscible with water. Bromine is more soluble than chlorine, 
which in turn is more soluble than phosgene. As indicated, 
ammonia and hydrogen fluoride attack the upper respira¬ 
tory tract. The main action of chlorine is on the lungs, but 
there is some effect on the respiratory tract. Bromine, being 
more soluble than chlorine but less soluble than ammonia, 
attacks both the respiratory tract and the lungs. Phosgene, 
being less soluble than chlorine, enters deep into the lungs 
where its action occurs. 

Hydrogen sulfide is an irritant gas, but also attacks the 
nervous system and causes respiratory paralysis. It is oxi¬ 
dized in the blood stream to pharmacologically inert com¬ 
pounds. Hydrogen fluoride is again an irritant gas but also 
gives rise to fluoride poisoning in the body. 

Hydrogen cyanide is the only one of the gases listed 
which is not an irritant; it causes cyanide poisoning. The 
most important effect of this is probably the inhibition of 
cytochrome oxidase, which in turn prevents the utilization 
of molecular oxygen by the cells. The cyanide is excreted in 
the urine. 

18.11.2 Lethal concentration and load 

In general, the injurious effect of the inhalation of a toxic 
gas is a function of concentration and of time that may be 
expressed by the relation 

iff = Constant [18.11.1] 
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where c is the concentration, t is the time, and m and n are 
indices. 

If the exposure time is constant, a lethal concentration 
LC, may be defined such that for this exposure time Q is the 
concentration that is lethal at the z'% level. Widespread use 
is made of the LC 50 value and also of other values such as 
LCio, LC05 and LCoi. 

If the exposure time is not constant, but the injurious 
effect is proportional to the product ct of the concentration 
and time (m = n = 1), and hence to the dosage D, a lethal 
dosage LD,- may be defined with 

D = ct [18.11.2] 

If the injurious effect is proportional to some other func¬ 
tion (m^n), it is necessary to use the concept of toxic load L 
and to define a lethal load LL,-with 

L = cr [18.11.3] 

An alternative toxic load, L* may also be defined 

L* = (ft [18.11.4] 

with m = 1 In. This second form of the lethal load is that 
most often used in hazard assessment studies. 

In such studies it is usually necessary to estimate mor¬ 
tality for exposures at a number of different combinations 
of concentration and time and in this case the lethal load 
function is usually expressed in the form 

[18.11.5] 

where C is the concentration (ppm) and T is the time (min). 
The lethal load function in the form of Equation 18.11.5 has 
been widely used in hazard assessment. 

For the case where n = 1 so that the load becomes L = ct, 
it is possible to define the LCt value. In particular, use is 
made of the LCt 5 o. 

The relation between toxic load and mortality is usually 
a log-normal distribution and may therefore be plotted on 
log-probability paper. It may also be expressed as a probit 
equation 

Y = k\ + k2 InL* [18.11.6] 

where Y is the probit and hy k 2 are constants. 

It is a matter of indifference which expression, Equa¬ 
tion 18.11.3 or Equation 18.11.4, is used to define the toxic 
load that causes a specified degree of injury; both give the 
same numerical results. In principle, it would be possible to 
distinguish between the two forms if one fitted better than 
the other the load-mortality distribution generally used, 
but in fact the distribution almost universally used for 
intensity-injury relationships in hazard assessment, not 
just for toxic gases but also for fire and explosion, is the 
log-normal distribution. With this distribution, if L is 
log-normally distributed, so is L*. 

Similarly, in the corresponding probit equation use of L* 
instead of L is equivalent to multiplying the constant k 2 bym. 
Thus it is not possible to distinguish between the two forms. 

There are, however, other arguments. From the point of 
view of hazard assessment, in which it is usually necessary 


to integrate the lethal load function, the definition of load 
given in Equation 18.11.4, or its discrete form Equation 
18.11.5, is the more convenient. 

There are also arguments, however, for the alternative 
form. Here toxicokinetic models appear relevant. For 
example, a one-compartment model for the body fluid 
concentration of the toxin with first-order excretion and 
constant gas concentration is equivalent to a first-order 
exponential stage with a step input, which gives a con¬ 
centration rise of the form [l-exp(— kt)\, where k is a 
constant. It may be significant that this exponential rise 
may be approximated by a suitably scaled expression in t 1/2 . 

18.12 Gas Toxicity: Experimental Determination 

The main source of information on the lethal toxicity of 
gases is experimentation on animals, particularly mice. In 
a typical study, groups of mice are exposed to different 
concentrations of gas for a single exposure period and the 
mortality is determined over a given period of observation 
after the exposure is over. 

For a particular gas, assuming there are any data, there 
will typically be between one and half a dozen studies 
quoted in the literature that appear applicable. There may 
be one or two in which the exposure period has been varied. 
There may also be one or two studies with other species 
such as rats, guinea pigs, rabbits, and, in older work 
mainly, cats and dogs. 

The determination of the lethality of a toxic gas by 
inhalation experiments with animals is a difficult under¬ 
taking and is subject to various sources of error. In addition 
to the concentration of the gas and the exposure time, other 
important variables are the caging conditions, the breed, 
sex, age and health of the animals, and their behaviour, 
including their breathing rate. The animals may not die 
immediately and it is necessary to observe delayed deaths 
over a period of time, usually 10 days, and to record both 
immediate and delayed deaths. A sufficient number of 
animals needs to be used to obtain results with a high level 
of confidence, and pathological examinations should be 
conducted. The toxicity data sought are usually for a given 
exposure time and comprise the LC 50 together with suit¬ 
able values nearer the extremes of mortality such as the 
LCio and LCgo. 

18.12.1 Statistical interpretation of experiments 

The statistical interpretation of experiments in toxicology 
was discussed in Section 18.3. 

The method of Litchfield and Wilcoxon (1949) is con¬ 
venient for the statistical treatment of results on inhalation 
toxicology. The application of this method to concentration 
mortality data for dogs exposed to chlorine is given in 
Section 18.18. 

The lethal toxicity estimates required for hazard 
assessment are essentially the LC 5 o, the slope of the con¬ 
centration mortality line, which may be expressed in terms 
of the ratio LC 90 /LCi 0 , and the toxic load function, which 
defines the equivalence between concentration and time. 

18.12.2 Estimation of lethal toxicity to animals 

Usually, if there are any data at all, there will be enough to 
permit some estimate to be made not only of the LC 5 o but 
also of the ratio LC 90 /LCio, but the latter estimate will gen¬ 
erally he such as to yield much less confidence in the LCi 0 
than in the LC 5 o. 
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For some gases there may be a single set of experiments 
on one species, for others several sets on one species and for 
others again several sets on different species. 

In the first case the estimate is straightforward, but 
where there are several sets of experiments on one species, 
there may be appreciable differences, say a factor of 2, in the 
LC 50 reported by different authors, even though each group 
of workers reports relatively narrow confidence limits for 
its results. 

In the second case where there are differences in the LC 50 
reported, it is necessary to decide whether to average the 
results or to select those that appear of highest quality. 
Each case must be treated on its merits. 

The third case, where different species are involved, is 
discussed below. 

In general, the lethal toxicity is a function of concentra¬ 
tion and time. Although concentration may sometimes be 
completely dominant, there tends to be a trade-off between 
the two, so that at a particular value of the toxic load there 
is a given degree of lethality. 

The experimental data from which to determine the 
index m in Equation 18.6.3 or n in Equation 18.6.4 are often 
sparse and in weak agreement. Work by Doe and Milburn 
gives a value for n of about \ for many of the irritant gases 
but about 1 for some other gases. 

18.12.3 Extrapolation between species 

Extrapolation of results obtained on one particular species 
to another species is beset with many difficulties, but it is 
an unavoidable step in the estimation of toxicity Some 
accounts of the principles were mentioned in Section 18.3. 
In relation to inhalation toxicity specifically, reference may 
also be made to the accounts given by Flury and Zernik 
(1931) and Wachtel (1941), who worked on the toxicity of war 
gases, and to the Major Hazards Assessment Panel (MHAP) 
monographs (MHAP, 1987,1988,1993) described below. 

The crucial question is whether or not the toxic effects are 
the same, or at least sufficiently similar, in the two species, 
thus providing a basis for extrapolation. Other important 
features are the relative modes and rates of inhalation and 
the mechanisms and rate of elimination, or metabolism. 

In the case of irritant gases the toxic effects in the main 
laboratory animals and in man appear to be broadly simi¬ 
lar, in that gas attacks the respiratory system. The fact that 
for these gases it is, the respiratory system that is the target 
means that metabolism is not significant. It is necessary to 
consider, however, the locus of action for each gas in each 
species, bearing in mind the solubility of the gas and the 
anatomy and respiratory behaviour. 

18.12.4 Animal physiology 

In many cases extrapolation from animals to humans 
is supported by an argument based on the ratio of physio¬ 
logical quantities such as the minute volume or body 
weight. 

Information on animal physiology is given in The Rat - 
Data and Reference Tables for the Albino Rat (Donaldson, 
1924), The Rat in Laboratory Investigation (Farris and Grif¬ 
fiths, 1949), Handbook of Biological Data (Spector, 1956a), 
Blood and Other Body Fluids (Altaian and Dittmer, 1961), 
Metabolism (Altaian and Dittmer, 1968), Respiration and 
Circulation (Altaian and Dittmer, 1971), Biology Data Book 
(Altman and Dittmar, 1974), Clinical, Biochemical and 
Hematological Reference Values in Normal Experimental 
Animals (Mitruka and Rawnsley, 1977) and Inbred and 


Genetically Defined Strains of Laboratory Animals. Part 1, 
Mouse and Rat (Altman and Katz, 1979). 

Data on some of the principal parameters of animal 
physiology relevant here are given in Table 18.14. 


18.12.5 Vulnerable populations 

Extrapolation from animals to man is usually done in the 
first instance for healthy young adults. It may be necessary, 
however, to allow for vulnerable members of the population. 

It is commonly assumed in hazard assessment that a 
section of the population, including young children and old 
people, is particularly vulnerable. In the case of toxic gas 
hazard, those with respiratory disease are also included. 
However, this is an aspect on which very little work has 
been done. 

It may be preferable to derive separate estimates of the 
lethal toxicity for the regular and vulnerable populations. 
This makes it possible to allow for differences in the 
numbers and composition of the exposed population at 
different times of day. 


18.13 Gas Toxicity: Physiological Factors 

18.13.1 Respiration 

Any attempt to model the toxic effects of inhaled gases 
requires some understanding of the respiratory process. 

Accounts of the respiratory system, the effects of gases 
on this system and the absorption of gases into the blood 
include those given in: standard texts on general physiol¬ 
ogy, such as Handbook of Physiology (Fenn and Rahn, 1964), 
Medical Physiology (Mountcastle, 1974) and Samson Wrights 
Applied Physiology (Keele, Neil and Joels, 1982); texts on the 
respiratory system, such asThe Morphometry of the Human 
Lung (Weibel, 1963), Ventilation Blood Flow and Gas 
Exchange (Q.B. West, 1965), Human Respiration (Lippold, 
1968), Physiology of Respiration (Comroe, 1974), Lung Func¬ 
tion (Cotes, 1979), Lung Connective Tissue (Pickrell, 1981), 
Modelling and Control of Breathing (Whipp and Wiburg, 
1983), Inhalation Studies (Phalen, 1984) and MS 5 Lung 
Function (HSE, 1977); and in texts on the inhalation of 
gases, such as Modeling of Inhalation Exposure to Vapor 
(Fiserova-Bergerova, 1983). 

The account given here describes in outline the respira¬ 
tory process and some of the quantitative data and rela¬ 
tions in respiratory physiology. This information is the 
starting point for modelling the effect of toxic gases, both 
irritant gases that attack the lungs and other gases which 
enter the blood. The data given are taken mainly from 
Mountcastle (1974) and apply to a young adult male, unless 
otherwise stated. 

The respiratory system is illustrated in Figure 18.4. Air 
entering the lung passes through the trachea, then down 
the bronchioles and through the alveolar duct into the 
alveolar sac. Interchange between the air and the blood 
occurs at the surface of the alveoli. 

The walls of the capillaries lining the alveoli are ex¬ 
tremely thin. The equilibrium partial pressure of a solute 
gas in the alveoli is effectively the same as that above the 
blood, neglecting the membrane. Mass transfer between 
the air and the blood is very rapid. 

The volume of air moved in one respiratory cycle is less 
than the total capacity of the lungs. Moreover, not all the 
air moved enters the alveolar space, since there is dead 
space. It is necessary, therefore, to define a number of 
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Table 18.14 Some principal physiological parameters of animals, including humans, relevant to respiration 
(Withers a nd Lees, 1986a) (Courtesy of the Institution of Chemical Engineers) 

A Animals, including man (after Altman and Dittmer, 1974) 




Species 



Mouse 

Rat 

Rabbit 

Dog 

Man 

Body weight (kg) 

0.023 

0.14 

3.6 

22.8 

75.0 

Lung volume (ml) 

0.74 

6.3 

79 

1501 

7000 

Alveolar surface area (m 2 ) 

0.068 

0.39 

5.9 

90 

82 

Minute volume (at rest) (ml/min) 

24 

84 

1042 

2923 

6000 

Minute volume/body weight (ml/min kg) 

1043.5 

600 

289.4 

128.2 

80 

Minute volume/lung volume (ml/min ml) 

32.4 

13.3 

13.2 

1.95 

0.86 

Minute volume/alveolar surface area (ml/min m 2 ) 

352.9 

215.4 

176.6 

32.5 

73.2 

Lung volume/alveolar surface area (ml/m 2 ) 

10.9 

16.2 

13.4 

16.7 

85.4 

B Man (after Mountcastle, 1974) 

Reference a 

Body weight (kg) 


75 


1009 


Lung volume (ml) 


6000 


1367 


Tidal volume (ml) 


500 


1382 


Alveolar volume (ml) 


350 


J.B. West (1965) 

Anatomical dead space (ml) 


150 


J.B. West (1965) 

Breathing rate (at rest) (breaths/min) 


12 


1382 


Minute volume (at rest) (ml/min) 


6000 


1382 


Alveolar surface area (m 2 ) 


70 


1387 


Pulmonary diffusion capacity for carbon monoxide, 


61 


1391 


Dlco (ml/min mm Hg) 






Mean thickness of alveolar capillary tissue 


1.7 


Altman and Dittmar 

barrier (pm) 




(1974) 


Volume of lung capillaries (ml) 


140 


1387 


Residence time of blood in lung capillaries (s) 


0.75 


1387 


Volume of blood (ml) 


5000 


844 


Volume of plasma (ml/kg body weight) 


45 


1020 


Volume of cell fluid (ml/kg body weight) 


30 


1020 



a Page number in Mountcastle (1974), unless otherwise noted. 


components of lung volume as shown in Figure 18.5. These 
include: 


Tidal volume (TV) 


Inspiratory reserve 
volume (IRV) 

Expiratory reserve 
volume (ERV) 

Residual volume (RV) 


Vital capacity (VC) 


Inspiratory capacity (IC) 


Functional residual 
volume (FRV) 


Volume of air entering and 
leaving the lungs in one 
natural respiratory cycle. 
Volume of air additional to 
the tidal volume that can be 
inhaled by maximum effort. 
Volume of air additional to 
tidal volume which can be 
exhaled by maximum effort. 
Volume of air remaining in 
lungs after exhalation with 
maximum effort. 

Sum of tidal, inspiratory 
reserve and expiratory 
reserve volumes. 

Volume of air which can be 
inhaled with maximum eff¬ 
ort; sum of tidal volume and 
inspiratory reserve volume. 
Volume of air left in lungs at 
end of natural exhalation. 


Total lung capacity (TLC) Sum of vital capacity and 
residual volume. Also sum 
of inspiratory capacity and 
functional residual capacity. 

Thus 

TLC = VC + RV = IRV + TV + ERV + RV 
= IC + FRC 

VC = IRV + TV + ERV 
IC = IRC + TV 
FRC = ERV + RV 

The tidal volume consists of the alveolar space and the 
anatomical dead space. Some typical values are: 

Tidal volume, Ft = 500 ml 
Alveolar space, Fa = 350 ml 
Anatomical dead space, Fb = 150 ml 

The typical respiration rate at rest is 
Respiration rate, / = 12 breaths/min 











TOXIC RELEASE 18/31 



Figure 18.4 The structure of the respiratory tree in the lung (after Weibel, 1973) 
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Figure 18.5 Components of lung volume (after Lambertsen, 1974; Cotes, 1979) 
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The product of the tidal volume and the respiration rate 
is termed the minute volume, Ft and that of the alveolar 
space and the respiration rate the alveolar ventilation, V A . 
Typical values of these two quantities are 

Minute volume, Ft = 12 x 500 = 600ml/min 
Alveolar ventilation, Fa = 12 x 350 = 4200ml/min 

The lungs contain some 3 x 10 8 alveoli with an alveolar area 
of about 70 m 2 . The thickness of the capillary membrane 
is about 0.3-2.5 gm. The capillary volume is some 140 ml 
and the transit time of the blood is some 0.75 s at rest and 
0.34 s during exercise. 

The flow of blood through the capillaries of the lung 
depends on the cardiac output, which is a function of the 
heart rate and the stroke volume. The heart rate is typically 
75 strokes/min and the stroke volume some 77 ml, and the 
cardiac output about 5000 ml/min. 

It is the function of the lung to absorb oxygen from the 
air into the blood and to desorb carbon dioxide from the 
blood into the air. The measure of the ability of the lung to 
do this is pulmonary diffusion capacity D L . The pulmonary 
diffusion capacity for oxygen is defined by the relation 

^ 02= ^w [18131] 

where A.02 is the pulmonary diffusion capacity for oxygen 
(ml/min mmHg), P AQ2 is the partial pressure of oxygen in 
the alveolar space (mmHg), P A02 ' is the equilibrium partial 
pressure of oxygen in the alveolar space and above the 
pulmonary capillaries (mmHg) and F02 the rate of absorp¬ 
tion of oxygen (ml/min). The diffusion capacity for carbon 
dioxide D LC0 2 is defined in a similar way. 

In practice, the principal measured values relate to the dif¬ 
fusion capacity of carbon monoxide Dlco- Carbon monoxide 
has a very high affinity for haemoglobin, some 210 times 
that of oxygen, so that the equilibrium partial pressure of 
carbon monoxide in the alveolar space is very small and may 
be neglected in estimating the diffusion coefficient. 

The diffusion capacity of a gas is proportional to its 
solubility and inversely proportional to the square root of 
its molecular weight. The solubilities of oxygen and carbon 
dioxide at 37°C are for water 2.386 and 56.7 ml gas/100 ml 
fluid atm and for plasma 2.14 and 51.5 ml gas/100 ml fluid 
atm, respectively. The diffusion capacity for oxygen D L02 
is 1.23xDlco and that for carbon dioxide is 24.6xZ?lco- 
The ratio DLC02/A.02 is 20. 

The value of A.02 at rest is about 75 ml/min mmHg. 


Partial pressure of oxygen 
(mmHg) 

Ambient air 

158 

Tracheal air 

149 

Alveolar air 

100 

Exhaled air 

116 


The partial pressure of the exhaled air is the weighted 
average of the tracheal and alveolar air. The equilibrium 
partial pressure of oxygen above arterial blood P 02a ' is 
about 95 mmHg and that above venous blood Po2v' about 
40mmHg. 


Blood comprises plasma and cells.The volume of plasma is 
some 45 ml/kg body weight and that of cells some 30 ml/kg 
body weight. For a man of 70 kg the volume of plasma is 
therefore about 3150 ml and that of blood about 5250 ml. 

Extracellular fluid comprises some 20% and plasma 
some 5 % of body weight. Thus extracellular fluid other than 
plasma has a volume some 3 times that of the plasma. All but 
a very small fraction of this extracellular fluid is in diffusion 
equilibrium. The specific gravity of plasma is 1.026. 

Some principal relations for lung volumes, ventilation 


rates and partial pressures are 

F t = F e = F a + F D [18.13.2] 

Fa = Fa/ [18.13.3] 

Fe = F e / [18.13.4] 

Fi = ^F e [18.13.5] 

V02 = F1E102 - F e Feo 2 [18.13.6] 

Few = (FiwVv +F A02 V A )/V E [18.13.7] 

F02 = A.02CPA02 - Paw) [18.13.8] 

Pao2'~P 0 2A' [18.13.9] 

Pq2' = Co 2 /H 02 [18.13.10] 


where C02 is the concentration of oxygen in the liquid phase 
(ml 0 2 /ml fluid), Z>lo 2 is the pulmonary diffusion capacity 
for oxygen (ml/min mmHg), F A q 2 is the concentration of 
oxygen in alveolar space (ml 0 2 /ml space), F EN2 is the con¬ 
centration of nitrogen in the exhaled air (ml N 2 /ml air), F E0 2 
is the concentration of oxygen in the exhaled air (ml 0 2 /ml 
air), F W2 is the concentration of nitrogen in the exhaled air 
(ml N 2 /ml air), F102 is the concentration of oxygen in the 
inhaled air (ml 0 2 /ml air), H Q2 is Henry’s law constant for 
oxygen (ml 0 2 /ml fluid (mmHg 0 2 )), P A o2 is the partial 
pressure of oxygen in the alveolar space (mmHg), P A 02' is 
the equilibrium partial pressure of oxygen at the capillary 
membrane (mmHg), P Q2 / is the equilibrium partial pressure 
of oxygen (mmHg), P 0 2 a ' is the partial pressure of oxygen 
above arterial blood (mmHg), V A is the alveolar volume (ml), 
is the alveolar minute volume (ml/min), F D is the ana¬ 
tomical dead space (ml), F E is the volume exhaled (ml), 
F E is the exhaled minute volume (ml/min), F x is the inhaled 
minute volume (ml/min), F 02 is the oxygen consumption 
minute volume (ml/min), V T is the tidal volume (ml), and 
/is the respiration rate (breaths/min). 

Some principal physiological parameters in man rel¬ 
evant to respiration have been given in Table 18.14. Further 
data on the lung in man are summarized in Table 18.15. 

18.13.2 Toxicokinetic models 

The treatment just given of the respiratory system provides 
the front-end part for a toxicokinetic model describing the 
absorption and distribution of the toxin in the body. 

Such toxicokinetic models for an inhaled gas may be 
developed by modelling the absorption of gas in the lung 
into the bloodstream. The difference between the mass 
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inhaled and that exhaled equals the mass transferred 
across the membrane of the lung and this in turn equals the 
mass deposed in the body. Then if the chemical enters the 
main bloodstream, its concentration in the blood will be a 
function of the rates of absorption and of elimination. In 
simple terms, this situation may be modelled as a single 
exponential stage with a time constant that is a function 
of the apparent volume of distribution. The equilibrium 
back pressure of the chemical at the lung surface will 
depend on the concentration in the blood. 

A toxicokinetic model of this general type is applicable 
where the toxic gas does not attack the respiratory system, 
but enters into the bloodstream and attacks some other 
organ in the body. There is, however, a lack of models rel¬ 
evant to hazard assessment. 

18.13.3 Irritant gases 

Such models are, in any case, less applicable to the impor¬ 
tant class of irritant gases, which act directly on the surface 
of the respiratory tract and/or lung rather than by accu¬ 
mulation in the body fluids. In this case the respiratory 
system acts as a sink for the chemical. This clearly requires 
a different model but, again, models suitable for hazard 
assessment are lacking. 

18.13.4 Inhalation rates 

In most cases the inhalation rate is a dominant factor in the 
entry of toxic gas into the system. It is therefore of great 
importance both in modelling the effects of and in extra¬ 
polating from experiments on toxic gases. 

In applying to man the results of animal experiments on 
gas toxicity it is necessary to make allowance for the effect 
of inhalation rate. If the base case for comparison between 
animals and man is that each has the inhalation rate which 
is normal at rest, there are two separate allowances, or fac¬ 
tors, which need to be applied. The first is between the 
inhalation rate of the animal at rest and in the experiment, 


Table 18.15 Some principal parameters of the lung in 
man (after Mountcastle, 1974) (Courtesy of CV Mosby 
Company) 


A Lung volumes 


Volume 

(ml) 


Total lung capacity 

5970 

Tidal volume 

500 

Expiratory reserve volume 

980 

Residual volume 

1190 

Vital capacity 

4780 

Inspiratory capacity 

3790 

Functional residual volume 

2180 

Anatomical dead space 

150 a 

Alveolar volume 

350 a 

B Respiration rate 

Rate 

(breaths/min) 

At rest 

12 

a J.B. West (1965). 


the second between that of man at rest and in the accident 
conditions envisaged in the hazard assessment. It can be 
seen from Table 18.14 that there are appreciable differences 
in the inhalation rates, as related to features such as body 
weight and lung surface area. 

Information on the breathing of animals during exposure 
is recorded in some experiments, although quantitative 
data appear to be relatively rare. By contrast, the variation 
of the inhalation rate of man with different degrees of 
exercise is well documented. Some data given by 
Henderson and Haggard (1943) are shown in Table 18.16. 

18.13.5 Other factors 

The respiratory system is not the only organ that is a target 
for toxic gases. The eyes and the skin may also be affected. 
Accounts of the eye relevant here are given in Toxicology 
of the Eye (Grant, 1962) and Synopsis of Ophthalmology 
(Havener, 1971). 

18.14 Gas Toxicity: Toxicity Data 

Before considering the toxicity of some of the principal 
industrial gases, attention is drawn to some of the general 
sources of data on toxicity, particularly toxicity to humans. 

Sources of toxicity data have been described in 
Section 18.3. Some texts which deal particularly with gas 
toxicity include: Kompendittm der praktischen Toxikologie 
(Robert, 1912); Industrial Poisoning (Rambousek, 1913); 
Kurzes Lehrbuch derArbeits- und Gewerbehygiene (Lehmann, 
1919); Industrial Poisons in the United States (Hamilton, 
1925); Lehrbuch der Toxikologie (Flury and Zanger, 1928), 
Noxious Gases (Henderson and Haggard, 1943); Industrial 
Hygiene and Toxicology (Patty, 1948—), with its later editions 
(Cralley and Cralley, 1978; Wands, 1981; Clayton and 
Clayton, 1991 ACGIH/73); Dangerous Properties of Indus¬ 
trial Materials (Sax, 1957-), with its later edition (Lewis, 
1992 ACGIH/89); Toxicology of Drugs and Chemicals 
(Deichman and Gerarde, 1969); and Toxicology: the Basic 
Science of Poisons (Casarett and Doull, 1975), with its later 
edition (Amdur, Doull and Klaassen, 1991ACGIH/54). 

At the turn of the century an appreciable amount of 
research was done in Germany by Lehmann and others on 
the effects on humans of many gases of industrial interest. 
This includes work by Lehmann himself (Lehmann, 1886, 
1887, 1893, 1899a) and by Matt (1889); there is also later 
work by Hess (1911), Drescher (1920), Dschang (1928) and 
Beck (1959). 


Table 18.16 Inhalation rate for various levels of 
activity for man (after Henderson and Haggard, 1943) 


Activity 

Inhalation 
rate a (1/min) 

Oxygen consumption 
rate b (1/min) 

Rest in bed, fasting 

6 

0.240 

Sitting 

7 

0.300 

Standing 

8 C 

0.360 

Walking, 2 mile/h 

14 

0.650 

Walking, 4 mile/h 

26 

1.200 

Slow run 

43 

2.000 

Maximum exertion 

65-100 

3.000-4.000 


a Measured at 0°C and 760 mmHg. 
b Measured at 20°C. 

c This value is quoted by A. Meyer (1938) and also by Prentiss (1937). 
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Many of the main industrial gases have also been used in 
warfare, particularly in the First World War. Accounts of the 
military use of these gases do not generally provide usable 
quantitative data, but some give pointers to the effects of 
the gases on humans that constitute a collateral check on 
data from animal experiments, which is the main source. 

Accounts of the gas warfare are given in The Poison War 
(A. A. Roberts, 1915), Reports of the Chemical Warfare Medi¬ 
cal Committee (1918—), Atlas of Gas Poisoning (MRC, 1918), 
The Lethal War Gases (Underbill, 1920), Chemical Warfare 
(Fries and West, 1921), History of the Great War, Medical 
Services, Diseases of the War, vol. II (Macpherson et al., 
1923), Gas Warfare (Fischmann, 1924), Poisoning Warfare 
Gases (Gilchrist, 1924), Fitnf Vortrage aus den Jahren 
1920-1923 (F. Haber, 1924), La Guerre Chimique (Le 
Wita, 1925), The Medical Aspects of Chemical Warfare 
(Vedder, 1925), The Medical Department of the United States 
Army in the World War, vol. 14: Medical Aspects of Gas 
Warfare (Ireland, 1926), Der Gaskampfund die chemischen 
Kampfstoffen (J. Meyer, 1926), History of the War: Military 
Operations in France and Belgium (Edmonds and Wynne, 
1927), A Comparative Study of World War Casualties from 
Gas and Other Weapons (Gilchrist, 1928), Manual of Treat¬ 
ment of Gas Casualties (Anon., 1930), Schadtiche Case (Flury 
and Zernik, 1931), Grun und Gelbkreuz (Buscher, 1932), Die 
wichtigsten Vergiftungen (Loschke, 1933), Die Gasschutzfrage 
(Zangger, 1932), Gas. The Story of the Special Brigade 
(Foulkes, 1934), Leitfaden der Pathologie und Therapie 
der Kampjgaserkrankungen (Muntsch, 1935), Die Tiere im 
chemischen Krieg (Richters, 1936b), Der chemische Kreig 
(Hanslian, 1937), Chemicals in War (Prentiss, 1937), Breathe 
Freely (Kendall, 1938), Gaz de Combat (A. Meyer, 1938), The 
War Gases (Sartori, 1939), ChemicalWarfare (Wachtel, 1941), 
United States Army in World War II: The Technical Services: 
Chemical Warfare Service (Brophy, Miles and Cochrane, 
1959), The Problem of Chemical and Biological Warfare, vol. 1: 
The Rise of CB Weapons (Q.P. Robinson, 1971) and The 
Poisonous Cloud. Chemical Warfare in the First World War 
(L.F. Haber, 1986). Other work on war gases is described 
by L. Hill (1915, 1920), Haldane, Meakins and Priestley 
(1918a,b, 1918/19), Herringham (1919,1920), Flury (1921a,b), 
Haggard (1924), Chlopin (1927-) and Richters (1936b). 

Accounts of the physiological and medical aspects of gas 
poisoning are given in Respiratory Function of the Blood 
(Barcroft, 1925), Respiration (Haldane and Priestley, 1935), 
and Pulmonary Oedema and Inflammation (Drinker, 1945). 

Some authors have dealt in a single publication with a 
number of different gases. They include Lehmann (1893, 
1899a), Ronzani (1908,1909), Hess (1911), Zeehuisen (1922), 
Haggard (1924), Schutze (1927), Walton and Witherspoon 
(1928), Carpenter, Smyth and Pozzani (1949), Smyth and 
Carpenter (1949), Zielhuis (1970), Higgins et al. (1972), 
MacEwen and Vernot (1972), Vernot et al. (1977) and ten 
Berge, Zwart and Appelman (1986). 

Setterstrom and co-workers (McCallan and Setterstrom, 
1940; Thornton and Setterstrom, 1940; Weedon, Hartzell 
and Setterstrom, 1940) have studied ammonia, chlorine, 
hydrogen cyanide, hydrogen sulfide and sulfur dioxide. 

A somewhat separate area of work that also yields toxicity 
data is that on the toxicity of combustion products. Accounts 
of research in this area, notably by Hilado and co-workers 
and by Hartzell and co-workers, are given in Section 18.22. 

An early collection of gas toxicity data for hazard 
assessment is that given in the Vulnerability model of 
Eisenberg, Lynch and Breeding (1975), and extended by 


Perry and Articola (1980). Their work is discussed below. 
Another collection of data on gas toxicity is that made by 
Back,Thomas and MacEwen (1972). 

8.15 Gas Toxicity: Vulnerability Model 

18.15.1 Initial model 

As just stated, some of the first correlations for the toxicity 
of industrial gases relevant to major releases were those 
given in the vulnerability model by Eisenberg, Lynch and 
Breeding (1975). These workers analysed data for the tox¬ 
icity of chlorine and ammonia and obtained probit equa¬ 
tions for the lethality of these two gases. For chlorine they 
found that the line for composite lethality in animals passes 
through the following points: 


Arbitrary units 

Percent affected 

0.54 

3 

0.59 

5 

1 

50 

1.5 

90 

1.8 

97 (extrapolated) 


They also refer to the Guide for Short-Term Exposure for 
Chlorine (NAS/NRC, 1973), which describes an exposure of 
14-21 ppm for 0.5-1 h as ‘dangerous’and one of 34-51 ppm 
for 1—1.5 h as ‘lethal’. They suggest that the terms ‘danger¬ 
ous’ and ‘lethal’ might be interpreted as 5 % and 90 % lethal. 

Eisenberg, Lynch and Breeding quote limit values given 
in the Guides for Chlorine (NAS/NRC, 1973) and ammonia 
(NAS/NRC, 1972b). At the short-term exposure limit (STEL), 
there is mild odour, minimal irritation and no health 
hazard. The STEL values for chlorine and ammonia are: 


Time (min) Concentration (ppm) 


Chlorine Ammonia 


10 1 20 

30 0.5 10 

60 0.5 10 


At the public emergency limit (PEL), there is strong odour 
and some irritation.The PEL values, which are ceilings, not 
averages, for chlorine and ammonia are: 


Time (min) Concentration (ppm) 


Chlorine Ammonia 


10 3 100 

30 2 75 

60 2 50 


In addition, they quote for chlorine the EEL suggested by 
Zielhuis (1970): 


Time (min) Concentration (ppm) 


5 7 

15 5 

30 4 

60 3 
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On the basis of such arguments the authors give for 
chlorine the following response relations: 


Chlorine Time of Effect 

concentration exposure 

(ppm) 


3 

Any 

No risk, but some 
harassment 

7 


Strong to intolerable 
irritation, with some risk 
to highly susceptible 
individuals 

20 

Severals hours 

50% lethal (their 
estimate) 

33 

c.lh 

50% lethal (estimate 
based on 

NAS/NRC report) 

60 

c.10 min 

50% lethal (their 
estimate) 


Eisenberg, Lynch and Breeding took the causative factor 
yin the probit equation for chlorine as 


V = Y J C?T i [18.15.1] 

where C is the concentration (ppm), T is the time interval 
(min), and n is an index. From analysis of the data, they 
obtained a value of n = 2.75. The probit equation for chlor¬ 
ine lethality derived by these authors is then 

F = -17.1 + 1.69 ln(^Cf 75 T,) [18.15.2] 


where Fis the probit. 

A similar treatment was applied to ammonia. For this 
gas the authors give the following response relations: 


Ammonia 

concentration 

(ppm) 

Time of 
exposure 

Effect 

20 

Any 

Odour detected by majority of 
population 

100 

Any 

Irritation and complaint 

500 

Any 

Strong to intolerable irritation, 
with some risk to highly 
susceptible individuals 

2500-5000 


Fatalities mostly from a few in 
the first 5 min to 90-100% 
after 1 h, depending on 
concentration 

>5000 


100% fatal. Heavy casualties 
in 5-10 min, and shorter 
exposures are unlikely in practice 


and derive the following probit equation for ammonia 
lethality: 


Y = -30.57 + 1.3851n(^Cf 75 r,-) [18.15.3] 

The relationships described apply to healthy adults. The 
population also includes more susceptible individuals 


such as infants, old people and people with advanced 
pulmonary/cardiovascular disease. The authors propose 
for such high risk populations the scaling shown in 
Table 18.17, which is applied to specific concentrations and 
exposure times for chlorine and ammonia. 

Eisenberg, Lynch and Breeding also consider non-lethal 
injury from chlorine. They give the following estimated 
response: 


Chlorine concentration (ppm) 

Percent affected 

6 

1 

10 

25 

13 

50 

20 

90 


In this case the causative factor is taken simply as V = C. 
The probit equation for non-lethal injury from chlorine 
is then 


F= -2.40 + 2.90 In C [18.15.4] 

Non-lethal injury is here taken to mean hospitalization 
without or with lasting impairment of health. 

The authors discuss the possible long-terms effects of 
exposure to chlorine.They state: 

The most recent paper seen was Weill etal. (1969). They say 
that their data for subjects seven years after an accidental 
exposure to chlorine ‘are consistent with the prevailing 
clinical view that significant permanent lung damage does 
not result from acute exposure to chlorine gas’. Reports 
referenced in their paper support this finding: for example, 
‘no evidence that chlorine intoxication produced residual 
pulmonary disease’ in the 33 most severely affected victims 
of a major accident; a large survey of industrial exposures 
did not find ‘any evidence of permanent damage to the 
respiratory tract’ another study including war casualties 
found that ‘permanent pulmonary injury was rare’. 

18.15.2 Development of model 

A further set of probit equations for lethality for use in the 
Vulnerability model was derived by Perry and Articola 
(1980). For chlorine the authors quote without reference a 
set of ‘best estimates’ which seem close to the data set given 
by Eisenberg, Lynch and Breeding (Table 6-4) but use a 
slightly different value of n (2.64 instead of 2.75). For 
ammonia, they refer again to the data set given in Eisenberg, 
Lynch and Breeding (Table 6-4). They use in this case an 
appreciably different value of n (1.36 instead of 2.75). 


Table 18.17 Relation between the lethal concentration 
of chlorine for the general population and a vulnerable 
population (Eisenberg, Lynch and Breeding, 1975) 


Level of effect 

Deaths (%) 


General 

High risk 


population 

population 

Severe harassment with 

0 

25 

some risk 



Lethal 

3 

50 

Lethal 

50 

100 
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For hydrogen cyanide the authors use estimates made by 
McNamara (1976) based on animal data. They also adapt 
these data for two other gases, acrylonitrile and hydrogen 
sulfide, having found no suitable data for these substances. 
In the latter case they quote C.L. Evans (1967) on the simi¬ 
larities between the effects of the two gases. For acrylo¬ 
nitrile they use the same lethal dose values and probit 
equation as for hydrogen cyanide, whilst for hydrogen 
sulfide they double the lethal dose values compared 
with hydrogen cyanide and thus obtain a different probit 
equation. 

For hydrogen fluoride they utilize data from an earlier 
study for the Vulnerability model by Rausch, Tsao and 
Rowley (1977) based on data from Braker and Mossman 
(1970), Darmer, Haun and MacEwen (1972), Higgins et al. 
(1972), MacEwen and Vernot (1974) and Wohlslagel, 
DiPasquale and Vernot (1976). They adopt the same value 
of n namely n = 1; in other words, Haber’s law. 

For hydrogen chloride, Perry and Articola utilize data 
from another previous study for the Vulnerability model by 
Rausch, Eisenberg and Lynch (1977). The value of n is 1.0. 
They use same lethal dose values and value of n for sulfur 
dioxide (in mg/m 3 ), the difference in the probit equations 
being due to the conversion to parts per million. 

For phosgene, the authors again utilize data from 
Rausch, Eisenberg and Lynch. The value of n is 1.0. 

Two probit equations for non-lethal injury are also given: 
by Eisenberg, Lynch and Breeding for chlorine and one 
derived by the authors themselves for hydrogen fluoride. 

The values of the parameters in the probit equations 
obtained by Perry and Articola are given in Section 18.20. 

The support for the probit equations in the Vulnerability 
model is in some cases rather slight and the level of physical 
activity to which they are applicable is not well defined. 

18.16 Gas Toxicity: Major Industrial Gases 

The toxicity of a number of major industrial gases is now 
considered in more detail. In general, toxic hazard from 
these gases arises from their manufacture, storage and use 
in the manufacture of other chemicals. In some cases, 
hazard arises from another cause. For example, a common 
cause of gassing by hydrogen sulfide is its presence as an 
impurity in crude oil and in confined spaces. The overview 
of the physiological effects of the main industrials gases 
given in Noxious Gases (Henderson and Haggard, 1943) 
provides a useful introduction to this aspect. 

For irritant gases, an important parameter is the sol¬ 
ubility in water, which largely determines the part of the 
respiratory system attacked. Haggard (1924) gives the fol¬ 
lowing relative figures for the solubility of such gases in 
water at 40°C: ammonia, 444 (extrapolated); hydrogen 
chloride, 385; sulfur dioxide, 18.7; bromine, 9.4; and chlo¬ 
rine, 1.4. No value is given for phosgene, which decomposes 

Incidents involving toxic gases are described in Section 
18.27. 

18.16.1 Chlorine 

There are two industrial toxic gases which in liquefied 
form are handled on a large scale and are readily dispersed 
and which therefore present a major toxic hazard. Chlorine 
is one, and ammonia the other. 

Chlorine is a highly toxic gas. The long- and short-term 
OESs are 0.5 and 1 ppm, respectively. The values represent 


a small reduction from the TLV (TWA) of 1 ppm that 
held for many years. Physiologically, chlorine is an irritant 
gas. The effects of a single exposure include irritation of 
the mucous membranes, attack of the respiratory tract 
and pulmonary oedema. A fuller account is given in 
Section 18.18. 

Early work on chlorine includes that Eulenberg (1865), 
Lehmann (1887,1899a,b) and Hess (1911). Chlorine was the 
first gas used in major gas attacks and is treated in vir¬ 
tually all the war gas texts referred to in Section 18.14, and 
in particular in Underbill (1920), Winternitz, Lambert et al. 
(1920), Gilchrist (1924), F. Haber (1924),Vedder (1925), Flury 
and Zernik (1931), Prentiss (1937), and by Black, Glenny 
and McNee (1915), Bradford and Elliott (1915-16), L. Hill 
(1915,1920), Schafer (1915), Kramer (1917), Haldane, Meakins 
and Priestley (1918a,b, 1918-19), Schultz (1918a,b), Schultz 
and Hunt (1918), Achard (1919), Barbour (1919), Barbour 
and Williams (1919), Baskervffle (1919), Burrell (1919), 
Herringham (1919,1920), Hjort and Taylor (1919), Meakins 
and Priestley (1919),Vinet (1919), Gunn (1920), Flury (1921a, 
1928), Chlopin (1927-), Flury and Zernik (1932), Abbott 
(1933), Gilchrist and Matz (1933) and Freitag (1940). More 
recent work includes that by Ceiling and McLean (1941), 
Cralley (1942), Silver and McGrath (1942), Silver, McGrath 
and Ferguson (1942), Fowell (1949), A.T. Jones (1952), Elmes 
and Bell (1963), Gay (1963), Flake (1964), D.P. Bell and 
Elmes (1965), Kowitz etal. (1967), C.G. Kramer (1967), Rupp 
and Henschler (1967), Schlagbauer and Henschler (1967), 
Krause, Chester and Gillespe (1968), Beach, Jones and 
Scarrow (1969), Chester, Gillespie and Krause (1969), 
Sartorelli (1969), Faure et al. (1970), Sessa et al. (1970), 
Kaufman and Burkons (1971), Leube and Kreiter (1971), 
Barrow and Smith (1975), Colardyn etal. (1976), Barrow etal. 
(1977), Chester et al. (1977), Bitron and Aharonson (1978), 
Barrow and Dodd (1979), Barrow et al. (1979), Withers and 
Lees (1985a,b), Withers (1986a) and Zwart and Woutersen 
(1988). Work on chlorine is also included in treatments 
dealing with a number of gases, including those by 
Zeehuisen (1922), Haggard (1924), Setterstrom and co¬ 
workers (McCallan and Setterstrom, 1940; Thornton and 
Setterstrom, 1940;Weedon, Hartzell and Setterstrom, 1940), 
Carpenter, Smyth and Pozzani (1949), Beck (1959), and 
Buckley etal. (1984). 

The toxicity of chlorine has been reviewed in Chlorine 
and Hydrogen Chloride by the (WHO, 1982 EHC21) and in 
the Chlorine Toxicity Monograph (MHAP, 1987); an account 
from the latter work has been given by Withers (1985). The 
Monograph estimates that in the absence of any subsequent 
medical treatment the LC 50 for 30 min for healthy adults is 
of the order 400 ppm. 

Probit equations for chlorine have been given by 
Eisenberg, lynch and Breeding (1975), Perry and Articola 
(1980), ten Berge and van Heemst (1983), Withers and Lees 
(1985b), and ten Berge, Zwart and Appelman (1986), in the 
Rijnmond Report (Rijnmond Public Authority, 1982), and 
by the Center for Chemical Process Safety (CCPS) and 
the CPD. Dangerous dose values are given by the HSE, as 
described below. 

Chlorine is one of the gases considered in the hazard 
assessment study of Back, Thomas and MacEwen (1972). 
The evidence is that serious long-term effects of non-lethal 
single exposure to chlorine are rare. This aspect is dis¬ 
cussed in Section 18.15. 

A fuller treatment of chlorine toxicity is given in Sec¬ 
tion 18.18. 
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18.16.2 Ammonia 

The other principal industrial toxic gas is ammonia. Like 
chlorine, it is a severe toxic hazard because it is handled on 
a large scale, it is a liquefied gas and is therefore readily 
dispersed, and it is highly toxic. Ammonia has long- and 
short-term OESs of 25 and 35 ppm, respectively. 

Physiologically, ammonia is an irritant gas. The effects 
of a single exposure include irritation of the mucous mem¬ 
branes, attack of the respiratory tract and pulmonary 
oedema. Ammonia is very much more soluble in water than 
chlorine, and therefore tends to attack particularly the 
upper respiratory tract, stripping the lining, and inducing 
laryngeal oedema. 

Early work on ammonia includes that by Lehmann (1886, 
1893), Matt (1889), Hess (1911) and Ronzani (1908,1909). 
Ammonia does not appear to have been a candidate war 
gas, but it is discussed by Flury (1921a, 1928), Flury and 
Zernik (1931) and Henderson and Haggard (1943). More 
recent work includes that by Boyd, MacLachlan and 
Perry (1944), Silver and McGrath (1948), Silver-man, 
Whittenberger and Muller (1949), Alpotov and Michailov 
(1963), H.A. Mitchell (1963), Alpotov (1964), Helmers,Top 
and Knapp (1971), Mayan and Merilan (1972), Hilado, Casey 
and Furst (1977), Verberk (1977), Richard, Jounay and Bou- 
dene (1978), Dodd and Gross (1980), Appelman, ten Berge 
and Reuzel (1982), Kapeghian et al. (1982), ten Berge and 
van Heemst (1983), Withers (1986b) and Pedersen and Selig 
(1989). Work on ammonia is also included in treatments 
dealing with a number of gases, including those by 
Haggard (1924), Setterstrom and co-workers (McCallan 
and Setterstrom, 1940; Thornton and Setterstrom, 1940; 
Weedon, Hartzell and Setterstrom, 1940), Carpenter, Smyth 
and Pozzani (1949), Coon et al. (1970), Stupfel et al. (1971), 
Vernot et al. (1977) and Buckley et al. (1984). 

The toxicity of ammonia in the specific context of 
process plants has been considered by D.P. Wallace (1979). 

The toxicity of ammonia has been reviewed in Ammonia 
(WHO, 1986 EHC54) and in Ammonia Toxicity Monograph 
(MHAP, 1988). 

Probit equations for ammonia have been given by 
Eisenberg, Lynch and Breeding (1975), Perry and Articola 
(1980), ten Berge, Zwart and Appelmann (1986), the CCPS 
and the CPD. Dangerous dose values are given by the HSE, 
as described below. 

Ammonia is one of the gases considered in the hazard 
assessment study done by Back, Thomas and MacEwen 
(1972). 

There is little evidence of serious long-term effects of 
non-lethal single exposure, except where the exposure has 
been so serious that death has been prevented only by 
medical attention, when respiratory deficiencies may 
occur. 

18.16.3 Acrylonitrile 

Acrylonitrile is an irritant gas and is also assigned the ‘risk 
phrase’ R45. It has a long-term MEL of 2 ppm, but no 
quoted short-term limit. 

Physiologically, acrylonitrile vapour causes various 
irritant effects including pulmonary oedema. Various other 
effects such as vomiting, convulsions and incoordination 
have been reported in animals. 

Most work on the toxicity of acrylonitrile has been 
carried out since 1940. Studies include those of Dudley and 
Neal (1942), Dudley, Sweeney and Miller (1942), R.H. Wilson 
(1944), R.H. Wilson, Hough and McCormick (1948), 


Carpenter, Smyth and Pozzani (1949), McOmie (1949), 
Smyth and Carpenter (1949), Brieger, Rieders and Hoders 
(1952), Knobloch et al. (1971), Rogaczewska (1975), 
McNamara (1976), Appel, Peter and Bolt (1981) and ten 
Berge, Zwart and Appelman (1986). 

Probit equations for acrylonitrile have been given by 
Perry and Articola (1980), ten Berge, Zwart and Appelman 
(1986), the CCPS and the CPD. Dangerous dose values are 
given by the HSE, as described below. 

18.16.4 Bromine 

Bromine is a highly toxic gas. It has long- and short-term 
OESs of 0.1 and 0.3 ppm, respectively. The toxic properties 
of bromine are somewhat similar to those of chlorine, but 
there are also significant differences. 

Physiologically, bromine is an irritant gas. The effects of 
a single exposure include irritation of the mucous mem¬ 
branes, attack of the respiratory tract and pulmonary 
oedema. Bromine is less soluble than ammonia, but more 
soluble than chlorine. It tends to attack the upper respira¬ 
tory tract as well as the lungs, stripping the lining and, 
inducing suffocation. It also tends to cause more severe 
sublethal injury than chlorine. 

Most work on bromine has been conducted in conjunc¬ 
tion with work on chlorine, which has led experimenters to 
compare the toxicity of the two gases. Early work on bro¬ 
mine was carried out by Lehmann (1887,1893) and Hess 
(1911). Experiments conducted during the First World War 
are described by L. Hill (1915,1920), Symes (1915a,b) and 
Chlopin (1927-). More recent work includes that by Rupp 
and Henschler (1967), Schlagbauer and Henschler (1967) 
and Bitron and Aharonson (1978). Work on bromine is also 
included in treatments dealing with a number of gases, 
including that of Haggard (1924). 

From this work Withers and Lees (1986b) concluded that 
bromine is some 1.5 times as toxic as chlorine. Adopting 
essentially the same methodology as in their work on 
chlorine, described below, they give for the standard level 
of activity for the regular population the following probit 
equation for the lethality of bromine: 

Y = -9.04 + 0.92 InL* [18.16.1] 

U = ^C 2 T [18.16.2] 

where C is the concentration (ppm), L* is the toxic load 
(ppnrmin) and T is the exposure time (min). This probit 
equation is discussed by P.C. Davies and Purdy (1987) and 
Withers and Lees (1987a). 

Further probit equations for bromine have been given by 
ten Berge, Zwart and Appelman (1986), the CCPS and the 
CPD, as described below. 

18.16.5 Carbon dioxide 

Carbon dioxide is an asphyxiant, but also atoxic gas. It has 
long- and short-term OESs of 5,000 and 15,000 ppm, 
respectively. At a concentration of 10% it can cause uncon¬ 
sciousness within 1 min. It is odourless. 

Hazard from the use of carbon dioxide in manufacturing 
arises where it is used in processes or where it is generated 
by combustion. 
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18.16.6 Carbon monoxide 

Carbon monoxide is a chemical asphyxiant. It combines 
with haemoglobin in the blood, thus displacing the oxygen. 
It has long- and short-term OESs of 50 and 300 ppm, 
respectively It is odourless. 

Hazard from carbon monoxide arises where it occurs as 
a process gas or where it is generated, as in combustion 
processes. Carbon monoxide is responsible for a significant 
proportion of deaths from gas poisoning. 

18.16.7 Hydrocarbons 

Hydrocarbons vary in toxicity. Some are asphyxiants, for 
example, propane; others are assigned an OES, for exam¬ 
ple, butane, which has long- and short-term OESs of 600 
and 750 ppm, respectively. 

18.16.8 Hydrogen chloride 

Hydrogen chloride has a short-term OES of 5 ppm with no 
quoted long-term value. Physiologically, hydrogen chloride 
is an irritant gas. The effects of a single exposure include 
irritation of the mucous membranes, attack of the respira¬ 
tory tract and pulmonary oedema. 

Early work on hydrogen chloride includes that by 
Lehmann (1886) and Hess (1911). Hydrogen chloride does 
not appear to have been a serious candidate war gas. More 
recent work includes that by Machle etal. (1942), Greenfield 
et al. (1969), Darmer, Kinkead and Dipasquale (1972,1974), 
Nagao et al. (1972), Hilado and Furst (1976), Barrow et al. 
(1977), Hilado and Gumming (1978), Barrow, Lucia and 
Alarie (1979), Hartzell etal. (1985) and Hartzell (1989).Work 
on hydrogen chloride is also included in treatments dealing 
with a number of gases, including those of Haggard (1924), 
Higgins et al. (1972), MacEwen and Vernot (1972), Vernot 
etal. (1977) and Buckley etal. (1984). 

The toxicity of hydrogen chloride has been reviewed in 
Chlorine and Hydrogen Chloride (WHO, 1982 EHC21). 

Probit equations for hydrogen chloride have been given by 
Perry and Articola (1980), ten Berge, Zwart and Appelman 
(1986), the CCPS and the CPD, as described below. 

Hydrogen chloride is one of the gases considered in the 
hazard assessment study of Back, Thomas and MacEwen 
(1972). 

18.16.9 Hydrogen cyanide 

Hydrogen cyanide has a short-term MEL of 10 ppm with no 
quoted long-term value. Physiologically, hydrogen cyanide 
is chemical asphyxiant. It causes cyanide poisoning, which 
is a form of asphyxia caused by the arrest of internal 
respiration. Its action can be very rapid. 

Early work on hydrogen cyanide includes that by 
Geppert (1889), Matt (1889), Ahlmann (1905), Hess (1911), 
Fiihner (1919), Drescher (1920), Koelsch (1920), Reed (1920), 
Hasselmann (1925a,b), Dschang (1928), R. Schwab (1929), 
Hug (1932), Wirth and Lammerhirt (1934) and Wirth (1935, 
1937). Hydrogen cyanide was considered for use, but found 
little application, as a war gas, and its toxicity is dealt with 
in some of the texts on war gases, including those of F. 
Haber (1924), Vedder (1925), Ireland (1926), Flury and 
Zernik (1931), Foulkes (1934), Muntsch (1935), Hanslian 
(1937), Prentiss (1937),Wachtel (1941), Henderson and Hag¬ 
gard (1943) and by Flury (1921,1928) and Chlopin (1927-). 
More recent work includes that of MacNamara (1976), 
Hilado and Furst (1976), Hilado and dimming (1978), Hart¬ 
zell, Priest and Switzer (1985) and Hartzell (1989). Work on 
hydrogen cyanide is also included in treatments dealing 


with a number of gases, including those of Schutze (1927), 
Walton and Witherspoon (1928) and Setterstrom and co¬ 
workers (McCallan and Setterstrom, 1940; Thornton and 
Setterstrom, 1940;Weedon, Hartzell and Setterstrom, 1940), 
Higgins etal. (1972) and Vernot etal. (1977). 

Probit equations for hydrogen cyanide have been given by 
Perry and Articola (1980), ten Berge, Zwart and Appelman 
(1986), the CCPS and the CPD, as described below. 

Hydrogen cyanide is one of the gases considered in the 
hazard assessment study done by Back, Thomas and 
MacEwen (1972). 

18.16.10 Hydrogen fluoride 

Hydrogen fluoride has a short-term OES (as F) of 3 ppm, 
with no quoted long-term value. Physiologically, hydrogen 
fluoride is an irritant and also has systemic effects. The 
irritant effects of a single exposure include irritation of the 
mucous membranes, attack of the respiratory tract and 
pulmonary oedema. There is also evidence of systemic 
effects on organs including the liver, kidney, heart, spleen 
and thymus. 

Hydrogen fluoride is subject to oligomerization, the 
extent depending on the pressure and temperature. At 
typical atmospheric conditions the apparent molecular 
weight is in the range 68—78. 

Accounts of the properties of hydrogen fluoride are 
given by Muehlberger (1928), Simons (1931), Rushmere 
(1954), Maclean et al. (1962), Schotte (1987) and Clough, 
Grist and Wheatley (1987). 

Early work on hydrogen fluoride includes that by Matt 
(1889), Ronzani (1908, 1909), Kehoe et al. (1932), Machle 
et al. (1934), Machle and Kitzmiller (1935) and Machle and 
Scott (1935) and Stokinger (1949). Hydrogen fluoride does 
not appear to have been a serious candidate as a war 
gas, but it is discussed by Flury and Zernik (1931) and 
Henderson and Haggard (1943). More recent work on the 
gas includes that by Rosenholtz et al. (1963), MacEwen and 
Vernot (1970), Darmer, Haun and MacEwen (1972), Hilado 
and Furst (1976), Hilado and Cumming (1978), Valentine 
(1988) and Mudan (1989a). Work on hydrogen fluoride 
is also included in treatments dealing with a number of 
gases, including those of Higgins etal. (1972),Wohlslagel, 
DiPasquale and Vernot (1976) and Vernot etal. (1977). 

Probit equations for fatal injury by hydrogen fluoride 
have been given by Perry and Articola (1980), ten Berge, 
Zwart and Appelman (1986), Mudan (1989a), the CCPS and 
the CPD. Dangerous dose values are given by the HSE, as 
described below. 

Mudan (1989a) derives his probit equation as follows. He 
utilizes primarily the more recent work of Rosenholtz etal., 
MacEwen and Vernot, Darmer, Haun and McEwen, Higgins 
et al., Wohlslagel, DiPasquale and Vernot, and the pre¬ 
liminary results of Valentine; MacEwen and Vernot give 
raw data, some of which is used by Darmer, Haun and 
MacEwen. From the results of these various workers he 
first establishes, using four data sets, that Haber’s law 
applies, namely, ct= Constant. He then obtains LCt 50 
values of 26,880 ppm min for mice, 46,900 ppm min for 
small rats, 84,000 ppm min for large rats, 64,900 ppm min 
for guinea pigs and 106,440 ppm min for monkeys. Apply¬ 
ing the toxicologist’s rule-of-thumb that consistent results 
from three animal species may be applied to humans, he 
obtains for the latter the estimated LCt 50 of 59,200 ppm 
min. Next he obtains separate prohit equations for each 
of the species and from these a median best estimate 
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of the slope of 4.853, thus yielding the desired probit 
equation: 

Y = -48.33 + 4.853 In L* [18.16.3] 

Where 

L* = Ct [18.16.4] 

where C is the concentration (ppm) and t is the time (min). 
Mudan also determines the 90% confidence limits on the 
slope as 2.854 and 8.348. Using the lower value of the slope 
he obtains the further ‘90% slope probit’ equation: 

Y = -26.36 + 2.854 In L* [18.16.5] 

The mortality given by these two probit equations is shown 
together with the experimental values in Figure 18.6. 

Hydrogen fluoride is one of the gases considered in the 
hazard assessment study done by Back, Thomas and 
MacEwen (1972). 


18.16.11 Hydrogen sulfide 

Hydrogen sulfide has long- and short-term OESs of 10 and 
15 ppm, respectively. Physiologically, hydrogen sulfide is 
an irritant and a chemical asphyxiant. The irritant effects 
of a single exposure include irritation of the mucous mem¬ 
branes, attack of the respiratory tract and pulmonary 
oedema. It also has an asphyxiant effect, caused by 
inhibition of cytochrome oxidase and resulting in arrest 
of respiration at the brain. 

The gas can be detected at low concentration, but the 
sense of smell is lost after 2-15 min exposure, thus 
making it impossible to detect dangerous concentra¬ 
tions. Moreover, the odour of hydrogen sulfide can be 
masked by the presence of other chemicals: tests have 
shown that concentrations below 1 ppm could be detected 
by odour in air, but in the presence of light hydrocarbons 
such as propane or butane even 5-10 ppm could not 
be smelt. 

Early work on hydrogen sulfide includes that by Biefel 
and Pollock (1880), Lehmann (1892, 1893, 1899a), Hess 
(1911), Haggard and Henderson (1922), Haggard (1925), 
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Figure 18.6 Mortality- toxic load response from best estimate probit for hydrogen fluoride (Mudan, 1989a) (Courtesy of 
the American Institute of Chemical Engineers) 
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C.W. Mitchell and Yant (1925), Gerbis (1927), Flury (1928), 
Aves (1929) and Yant (1930). Hydrogen sulfide was con¬ 
sidered for use, but found little application as a war gas, 
and its toxicity is dealt with in some of the texts on war 
gases, including those of Vedder (1925), Flury and Zernik 
(1931), Foulkes (1934), Muntsch (1935), Hanslian (1937), 
Henderson and Haggard (1943) and by Flury (1928). More 
recent work on the gas includes that by Rubin and Arieff 
(1945), Adelson and Sunshine (1966), Lund and Wieland 
(1966), Kosmider, Rogala and Pacholek (1967), Hays (1972), 
Archibald (1977), Beck, Cormier and Donini (1979), NRC 
(1979), Tansy et al. (1981), Ammann (1986), Lopez et al. 
(1987), Prior et al. (1988) and Lopez et al. (1989). Work on 
hydrogen sulfide is also included in treatments dealing 
a number of gases, including those of Schutze (1927), 
Walton and Witherspoon (1928) and Setterstrom and co¬ 
workers (McCallan and Setterstrom, 1940; Thornton and 
Setterstrom, 1940;Weedon, Hartzell and Setterstrom, 1940) 
and Vernot et al. (1977). 

The toxicity of hydrogen sulfide has been reviewed in 
Hydrogen sulphide (WHO, 1983 EHC19). 

Probit equations for hydrogen sulfide have been given by 
Perry and Articola (1980), ten Berge, Zwart and Appelman 
(1986), the CCPS and the CPD. Dangerous dose values are 
given by the HSE, as described below. 

Hydrogen fluoride is one of the gases considered in the 
hazard assessment study done by Back, Thomas and 
MacEwen (1972). 

18.16.12 Methyl isocyanate 

Methyl isocyanate (MIC) has, like all isocyanates, long- and 
short-term MELs (as NCO) of 0.02 and 0.07 mg/m 5 , respec¬ 
tively. Physiologically, MIC is an irritant and its effects 
include pulmonary oedema. 

MIC came to prominence as the gas responsible for the 
toxic gas disaster at Bhopal, described in Appendix 5. 

Prior to Bhopal, there seems to have been relatively little 
work published on the toxicity of MIC, with the exception of 
a study by Kimmerle and Eben (1964). Subsequent work 
has been done by ten Berge (1985). Probit equations for MIC 
have been given by ten Berge (1985), the CCPS and the CPD, 
as described below. 

18.16.13 Oxides of nitrogen 

Oxides of nitrogen are toxic gases. They have little irritant 
effect, but inhalation can cause death some hours later. 
Nitrogen monoxide has long- and short-term OESs of 25 
and 35 ppm, respectively. Nitrogen dioxide has long- and 
short-term OESs of 3 and 5 ppm, respectively. 

Hazard from oxides of nitrogen arises from their use in 
the manufacture of sulfuric and nitric acids and from their 
generation in welding. 

18.16.14 Phosgene 

Phosgene has long- and short-term OESs of 0.02 and 0.06 
ppm, respectively. Until recently the gas had a long-term 
OES of 0.1 ppm, with no quoted short-term value (see 
EH 40/92). The current values therefore represent a sig¬ 
nificant reduction. 

Physiologically, phosgene is an irritant. The effects of a 
single exposure include pulmonary oedema. Phosgene is 
less soluble than chlorine, attacks the respiratory tract less, 
but passes deep into the lung. Its effects may not be felt 
immediately, but may develop some hours later. 


Early work on phosgene includes that of Lehmann 
(1893), Matt (1889) and Hess (1911). Phosgene followed 
chlorine as a prime war gas, generally as a phosgene- 
chlorine mixture. Its toxicity is dealt with in most of the 
main texts on war gases including Underbill (1920), Fries 
and West (1921), Gilchrist (1924), F. Haber (1924), Vedder 
(1925), Ireland (1926), Flury and Zernik (1931), Foulkes 
(1934), Muntsch (1935), Hanslian (1937), Prentiss (1937), 
Wachtel (1941), Henderson and Haggard (1943), Courtice and 
Foss (1916), Dunn (1918), Eyster and Meek (1920), Herringham 
(1920), L. Hill (1920), Winternitz et al. (1920), Flury (1921a, 
1928), Laqueur and Magnus (1921), Chlopin (1927—), Flury 
and Zernik (1932) and Richters (1936a,b). More recent 
work includes that by Cameron, Courtice and Foss (1941), 
Boyland, McDonald and Rumens (1946), Weston and Karel 
(1946,1947), Box and CuUumbine (1947), Karel and Weston 
(1947), Gerard (1948), Suess and Lerner (1956), Henschler 
and Laux (1960), Ardran (1964), deRooij, van Eick and van de 
Meent (1981), Diller and Zante (1982), Diller (1985), Mulder 
et al. (1986) and Zwart (1987). Work on phosgene is also 
included in treatments dealing with a number of gases, 
including those by Zeehuisen (1922) and Zielhuis (1970). 

The toxicity of phosgene as a war gas has been the 
subject of extensive study It was evidently his work on 
phosgene which led Haber to formulate his law that 
ct =Constant. He expressed the toxicity of gases in terms of 
a mortality product, or lethal index. Haber (1924) himself 
gave for cats a value of 450 mg/m 3 of this index, whilst 
Wachtel gives a value of 900 mg/m 3 . From analysis of com¬ 
ments by Flury and Zernik (1932),Withers and Lees (1985a) 
conclude that the value of 900 mg/m 3 is equivalent to the 
LCt 50 . This corresponds to LCt 50 = 220 ppm min. They also 
quote Wachtel to the effect that cats are particularly sensi¬ 
tive to toxic gases and that as a rough approximation the 
corresponding value for man is twice as great, in other 
words LCt 50 = 440 ppm min. 

Experience of phosgene in war shows that personnel 
who have been gassed by it have often not felt immediate 
effects and have continued working, only to fall dead some 
hours later. The toxicity of phosgene has been reviewed in 
PhosgeneToxicity Monograph (MHAP, 1993). 

Probit equations for phosgene have been given by Perry 
and Articola (1980), the CCPS and CPD, as described below. 

Phosgene is one of the gases considered in the hazard 
assessment study done by Back, Thomas and MacEwen 
(1972). 

18.16.15 Sulfur dioxide 

Sulfur dioxide has long- and short-term OESs of 2 and 
5 ppm, respectively. Physiologically, sulfur dioxide has 
various irritant effects. 

Early work on sulfur dioxide includes that of Ogata 
(1884), Lehmann (1893) and Ronzani (1908,1909). Sulfur 
dioxide does not appear to have been a serious candidate as 
a war gas. More recent work on sulfur dioxide includes that 
of Leong, McFarland and Sellers (1961) and Bitron and 
Aharonson (1978). Work on sulfur dioxide is also included 
in treatments dealing with a number of gases, including 
those of Zeehuisen (1922), Setterstrom and co-workers 
(McCallan and Setterstrom, 1940; Thornton and Setterstrom, 
1940; Weedon, Hartzell and Setterstrom, 1940), Zielhuis 
(1970) and Buckley et al. (1984). 

Sulfur dioxide is a principal lethal component of smog 
such as that which was once prevalent in London. A thick 
fog which covered the Meuse Valley in Belgium in 1930 
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resulted in several hundred cases of severe respiratory dis¬ 
turbance, followed shortly after by 63 deaths which were 
attributed to it (Weedon, Hartzell and Setterstrom, 1939; 
Logan, 1953). The lethality of the four day London smog of 
December, 1952,hasbeenstudiedbyAnon.(1953)andLogan 
(1953). The latter attributes to the fog some 4000 deaths. 
The Los Angeles smog is described by A. Mills (1957). 

Probit equations for sulfur dioxide have been given by 
Perry and Articola (1980), the CCPS and the CPD, as 
described below. An account is also given below of the HSE 
dangerous dose values for sulfuric acid mist. 

Sulfur dioxide is one of the gases considered in the hazard 
assessment study of Back,Thomas and MacEwen (1972). 

18.16.16 Toluene diisocyanate 

Toluene diisocyanate (TDI), like all isocyanates, has long- 
and short-term MELs (as NCO) of 0.02 and 0.07 mg/m 3 , 
respectively. 

Physiologically, TDI has a systemic effect, attacking the 
nervous system. It is a sensitizer, carrying the notation 
‘Sen’. The effects of exposure may be immediate and/or 
delayed. Exposure to TDI can cause firefighters to become 
euphoric and disregard danger. Delayed effects include 
nervous disorders. 

Hazard arises from its manufacture and use, and from its 
generation from polyurethane foam or in hot cutting 
operations. 

18.17 Gas Toxicity: MHAP Studies 

The toxicity of three gases - chlorine, ammonia and 
phosgene - is the subject of a set of monographs by the 
MHAP, convened under the auspices of the Institution of 
Chemical Engineers (IChemE). 

18.17.1 Chlorine 

The Chlorine Toxicity Monograph (MHAP, 1987) is in two 
parts: the First Report of the Working Party and an account 
by Davies and Hymes of the HSE of the approach by that 
body to the development of criteria for hazard assessment. 

The working party reviews the data on chlorine toxicity. 
Many of the data quoted for humans are derivative and 
appear poorly founded. It is therefore necessary to resort to 
the use of animal data. The authors present data for the 
LC 50 for different exposures and for a number of species. 
These animal data indicate a mean lethal concentration for 
a 30 min exposure of LC 50 = 400 ppm and a concentration¬ 
time relation of the form ct ¥2 = Constant, or, alternatively 
c 2 /= Constant. 

In respect of the concentration lethal to man, the authors 
find that: the effects of acute inhalation of chlorine are 
similar in animals and humans, the prime lethal effect 
being pulmonary oedema; the factors bearing on differ¬ 
ences between species may be divided into those which 
govern delivery of the chemical to the target organ and 
those which govern the effect on this and other organs; and 
that the effect of chlorine is to cause damage to the 
respiratory system itself, so that metabolic factors do not 
come into play. 

The dose per unit body weight is some ten times greater 
for animals such as mice and rats than for humans at com¬ 
parable levels of physical activity, but whereas humans are 
likely to respond to exposure to chlorine with a high level of 
activity, experimental animals are very passive. There is 
also the fact that rodents are obligatory nose breathers, 


which results in a degree of filtering and reduces somewhat 
the concentration reaching the respiratory tract, though the 
authors do not attach great importance to this feature. 
They conclude that there is little basis for supposing that 
the sensitivity of humans to chlorine is significantly 
different from that of small animals. 

The working party suggest, therefore, that the relations 
for the lethal toxicity of chlorine quoted above for animals 
can be applied to humans also, namely for a 30 min exposure: 

LC50 = 400 ppm 
C 2 t = Constant 

where C is the concentration (ppm) and t is the time (min). 
They consider, however, that the data do not justify the 
derivation of a probit equation for the lethality of chlorine 
to humans. 

The monograph also gives an account of medical meas¬ 
ures for handling cases of gassing by chlorine and sum¬ 
maries of some 11 papers on its toxicity. 

The contribution by Davies and Hymes states the, then 
developing, HSE view that for the purpose of land use 
planning a toxic load criterion corresponding to a much less 
severe level of injury than 50% lethality is appropriate and 
quotes the Major Hazards Assessment Unit (MHAU) as 
using for this purpose the criterion 

C 2n t = 3.2 x 10 6 [18.17.11 

where C is the concentration (ppm) and t is the time (min). 
This echoes the views expressed earlier by the same 
authors (P. Davies and Hymes, 1985) and foreshadows the 
development of the HSE specified level of toxicity (SLOT) 
values described in Section 18.21. 

18.17.2 Ammonia 

The Ammonia Toxicity Monograph (MHAP, 1988) follows a 
broadly similar format. The data on ammonia toxicity are 
reviewed and animal data are presented for the LC 50 for 
different exposures and for a number of species. These 
animal data indicate a lethal concentration for a 30 min 
exposure of LC 50 = 11,500 ppm and a concentration-time 
relation of the form ef V4 =Constant. The authors consider 
that for ammonia the animal data available are of higher 
quality than those for chlorine. 

With regard to the applicability of these data to man, the 
authors advance the following argument. Like chlorine, 
ammonia has an irritant action, but due to its solubility the 
relative effect on the tracheal as opposed to that on the 
bronchial region is much more marked. They identify two 
opposing factors. On the one hand, there is the much higher 
dose per unit body weight in animals than in humans, but 
on the other, due to the less effective filtering in humans, 
a greater proportion of the gas will reach the trachea. 
The authors conclude that taking these factors into account, 
it is reasonable apply the animal data to humans. 

They therefore propose that the relations for the lethal 
toxicity of ammonia quoted above for animals can be 
applied to humans also, namely: 

LC50 = 11,500 ppm for a 30 min exposure 

C 2 t = 6.3 x 10 4 [18.17.2] 
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They derive from this the probit equation for the lethality 
of ammonia 

Y = -35.9 +1.85 In C 2 t [18.17.3] 

where C is the concentration (ppm) and t is the time (min). 
They advise caution, however, in the application of this 
relation outside the limits of 20-80% lethality. 

The monograph also gives an account of medical mea¬ 
sures for handling of cases of gassing by ammonia, brief 
descriptions of case histories involving the gas and sum¬ 
maries of some 24 papers on its toxicity. 

18.17.3 Phosgene 

Th ePhosgeneToxicity Monograph (MHAP, 1993) again rejects 
many of the data quoted for humans as being second-hand 
and unreliable. The same applies to many of the animal data, 
but a small number of data sets are considered to be of high 
quality. These animal data indicate a lethal concentration- 
time relation of the form ct= Constant, or Haber’s law, and 
a lethal load of 

LCt5o = 570 ppm min 

The authors also refer to work on the gassing of human 
subjects by phosgene given in evidence by Bickenbach 
(1947). The experiments were barbarous, but the data exist 
and cannot be neglected. The median lethal concentration 
for a 25 min exposure was 22.8 ppm, yielding 

LCtso = 570 ppm min 

In respect of the application of the animal data to 
humans, the authors argue that the main acute effect of 
phosgene for both animals and humans is on the lung, that 
large differences in response between species would not be 
expected and that this is borne out by the similarity of the 
results obtained for the various species, including man. 
They conclude that the animal data may be applied to 
humans. 

Utilizing the most appropriate sets of animal data and 
applying these to man, they obtain for the lethal toxicity of 
phosgene for humans 

LCtso = 552 ppm min 

and the probit equation 

Y= -27.2 + 5.1 In Ct [18.17.4] 

where C is the concentration (ppm) and t is the time (min). 

The monograph also gives an account of medical mea¬ 
sures for handling of cases of gassing by phosgene and 
brief descriptions of case histories involving the gas. 

18.18 Gas Toxicity: Chlorine 

A further account is now given of the toxicity of chlorine, 
based on the work of Withers and Lees (1985a,b). This work 
is described in some detail, both because the hazard of 
chlorine is important in its own right and because the work 
illustrates the problems of and possible approaches to the 
toxicity of irritant gases. 


There are in the literature a number of estimates of 
chlorine toxicity that vary widely. Generally, individual 
estimates are not well supported by critical review and the 
choice of a particular value has often tended to be arbitrary. 

An estimate of chlorine toxicity that has had consider¬ 
able currency in hazard assessment is that of Eisenberg, 
Lynch and Breeding (1975), who gave in the Vulnerability 
model a probit equation for chlorine. The LC 50 for a 30 min 
exposure given by this probit equation is about 35 ppm for 
healthy adults. More recent estimates tend towards a 
considerably higher figure. 

Withers and Lees review information on the lethal toxi¬ 
city of chlorine and present a model for its toxicity to 
humans.The model gives values of 500 and 250 ppm for the 
LC 50 for 30 min for base and standard cases for healthy 
adults. 


18.18.1 Experimental work on and estimates of toxicity 

Data on chlorine toxicity are given by Flury and Zernik 
(1931). Many of the values quoted are attributed to Lehmann, 
who published a series of papers over the period 1887-99 
(e.g. Lehmann, 1887,1883,1899a,b) and to Hess (1911). 

Chlorine was the first main toxic gas used in the First 
World War and work on chlorine toxicity was carried out by 
the principal combatants, particularly the Germans. The 
German work is described by F. Haber (1924), Flury and 
Zernik (1931), Muntsch (1935) and Wachtel (1941). 

Haber’s work, apparently that on phosgene in particular, 
seemed to indicate for lethality the relation 


ct = Constant [18.18.1] 

which became known as Haber’s law and gave rise to the 
concept of a lethal dosage, also known as the mortality 
product or lethal index. 

Values of the lethal index are quoted by military authors 
such as Hanslian (1937),Vedder (1925) and Prentiss (1937). 
There are considerable variations in the values given. 
Withers and Lees suggest that values refer variously to the 
LCio, the LC 50 and the LC 50 , and quote comments by Flury 
and Zernick (1932) in support of this. 

An important series of experiments on dogs was carried 
out towards the end of the war by Underhill (1920). For 
chlorine he used some 112 animals in seven groups ranging 
in size from 9 to 23. The exposure period was 30 min. The 
results of this work are shown inTable 18.18 and are plotted 
in Figure 18.7. The figure shows the best line through the 
points and the 95% confidence limits obtained from the 
method of Litchfield and Wilcoxson (1949). The LC 5 o for a 
30 min is 650 ppm. 

Since 1918 there have been a number of studies on chlor¬ 
ine toxicity, using mainly rodents. Some of the principal 
sets of experiments are briefly described here. 

More detailed accounts are given by Withers (1986) and 
Withers and Lees (1985a). 

Weedon, Hartzell and Setterstrom (1940) carried out 
experiments in which mice and rats, in groups of 4 and 8, 
respectively, were exposed to concentrations of chlorine of 
16,63, 250 and 1000 ppm for periods of 1,4,15,60,240 and 
960 min until they died, or for a maximum period of 960 
min. The three latter concentrations corresponded to the 
LC 50 for mice at exposure periods of >960,440 and 28 min, 
respectively, and to that for rats at exposure periods of 
>960,440 and 53 min, respectively. 
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Lipton and Rotariu (1941), in a report by Ceiling and 
McLean, describe experiments in which mice in groups 
of 20 were exposed to concentrations of chlorine ranging 
from 310 to 2357 ppm for a period of 10 min with an obser¬ 
vation period of 10 days. The LC 50 obtained was 628 ppm. 

Silver and McGrath (1942) carried out experiments on 
49 groups of mice, 45 groups of 20 and 4 groups of 40, in 
two series. In the first series certain sources of error were 
revealed which were corrected in the second series. In the 
two series of experiments mice were exposed to con¬ 
centrations of chlorine in the range 252-1139 ppm for 


10 min with a 10-day observation period. In the first series 
the LC 5 o was 524 ppm and in the second series 597 ppm. 
Most of the deaths occurred within the first 24 h. 

Silver, McGrath and Ferguson (1942) carried out further 
experiments on 15 groups of 20 mice. Again they used a 
10 min exposure time and a 10-day observation period. 
In this third series the concentrations of chlorine used were 
in the range 379-890 ppm and the LC 50 was 676 ppm. Out 
of 154 deaths, one was due to mild oedema and congestion, 
and two to pneumonia; the rest were due to severe oedema. 
Most of the deaths occurred within the first 24 h. 


Table 18.18 Concentration of chlorine lethal to dogs in Underhill’s work (Withers and Lees, 1985a; after Underhill, 
1920). Exposure time 30 min (Courtesy of Elsevier Publishing Company) 


Concentration a 



(mg/1) 

(ppm) 

0.16-0.80 

50-250 

1.27-1.58 

400-500 

1.58-1.90 

500-600 

1.90-2.22 

600-700 

2.22-2.53 

700-800 

2.53-2.85 

800-900 

2.85-6.34 

900-2000 

Deaths within 3 days 


0 

1 

2 

9 

9 

20 

13 

Delayed deaths 


1 

4 

2 

5 

2 

1 

0 

Total deaths 


1 

5 

4 

14 

11 

21 

13 

Total No. of animals 


9 

17 

10 

21 

18 

23 

14 

Overall mortality (%) 


11 

29 

40 

67 

61 

91 

93 


a The conversion of concentrations from mg/1 to ppm by Underhill in this table corresponds to a temperature of 0°C. Henceforth, these 
concentration values in ppm have been recalculated to a temperature base of 25°C. 
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Figure 18.7 Concentration of chlorine lethal to dogs in Underhill’s work (withers and Lees, 1985a; after Underhill, 1920). 
Exposure time 30 min. Dotted lines are 95% confidence limits (Courtesy of Elsevier Science Publishers) 
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Schlagbauer and Henschler (1967) carried out 
experiments in which mice in groups of 10 were exposed 
for 30 min to concentrations of chlorine of 55, 62, 69, 110, 
125,132,145,160 and 179 ppm. The deaths occurring in the 
intervals 0-2 and 2-4 days after exposure were recorded. 
There were no deaths later than 4 days after exposure. The 
LC 5 o obtained was 127 ppm. 

These authors also report work at lower chlorine con¬ 
centrations and longer exposure periods. They carried out 
experiments in which 10 mice were exposed for 3 h to con¬ 
centrations of chlorine of 10 and 22 ppm with an observa¬ 
tion period of 4 days. The mortality of the mice at these two 
concentrations was 8/10 and 10/10, respectively. 

Experiments were carried out by Bitron and Aharonson 
(1978) in which mice in groups of 16 were exposed to con¬ 
centrations of chlorine of 170 and 290 ppm for periods 
of 15-160 and 5-30 min, respectively. The times of death 
after exposure were recorded over an interval of 30 days. 
The LC 50 values obtained were 170 and 290 ppm for expo¬ 
sures of 55 and 11 min, respectively. 

The LC 5 o values obtained by these and certain other 
authors are shown in Table 18.19. The concentration lethal 
to various animal species, based on the research just 
described and on other work, is shown in Figure 18.8. 

In addition to the LC 50 , it is desirable also to be able to 
estimate the LCi 0 and LC 90 or the ratio LC 90 /LCi 0 , which is 
the slope of the concentration-mortality line. There are 
three data sets, those of Underhill, of Silver, McGrath and 
Ferguson and of Schlagbauer and Henschler, from which 
estimates of this ratio may be obtained. 

Underhill’s work yields values of the LCi 0 and LC 90 of 
334 and 1,266 ppm, respectively, and hence a value of the 
ratio LC90/LC10 of 3.8. 

There are two sets of experiments, those of Weedon, 
Hartzell and Setterstrom and of Bitron and Aharonson, in 


which the exposure time was varied and which may there¬ 
fore be used to estimate the trade-off between concentra¬ 
tion and time. These two data sets are shown in Table 18.20. 

Then using Equation 18.11.3 for the lethal toxic load, the 
data in Table 18.20 suggest that the best estimate of the 
index n is 0.5 so that 


L=CT° 5 [18.18.2] 

The range of concentrations and time covered by the data 
on which this equation is based are 170-1,000 ppm and 
11-440 min. 

Equation 18.18.2 maybe used to convert different sets of 
experiments to a common exposure time. Such sets may 
also be normalized with respect to the LC 50 found in each 
case to give a set of data that may be used to determine the 
slope of the concentration-mortality line. Three such sets 
of data are shown in Table 18.21. 

Information on acute and delayed deaths is also relevant. 
In the work of Lipton and Rotariu and of Silver, McGrath 
and Ferguson most of the deaths occurred within the first 
24 h. Likewise, in Schlagbauer and Henschler’s work 
almost all the deaths occurred in the interval 0-2 days 
after exposure. The only deaths in the interval 2—4 days 
were at a concentration of 132 ppm, for which two of the six 
deaths were in this interval. In Bitron and Aharonson’s 
work, by contrast, most of the deaths were delayed deaths, 
the mortality being only 10% or less during the day after 
exposure and most of the deaths occurring in the interval 
5—7 days after exposure. 

Further information on acute deaths is given by the work 
of Underhill on dogs. He defines acute death as a death 
occurring within the first 3 days after exposure. Figure 18.9(a) 
and (b) shows the proportion of acute deaths in his work as 


Table 18.19 Concentrations of chlorine that are lethal to rodents, as given by various authors (Withers and 
Lees, 1985a) (Courtesy of Elsevier Publishing Company) 


Author(s) 

Species 

Concentration lethal to 50% 
(ppm) 

Exposure time 

Zeehuisen (1922) 

Guinea pigs, white rats 

>3330 

30 

Weedon, Hartzell and 


1000 

28 

Setterstrom (1940) 


250 

440 



63 

>960 


Rats 

1000 

53 



250 

440 



63 

>960 

Lipton and Rotariu (1941) 

Mice 

628 

10 

Silver and McGrath (1942); Silver, 

Mice 

618 a 

10 

McGrath and Ferguson (1942) 




Elmes and Bell (1963); 


117 b 

1800 

Bell and Elmes (1965) 




Schlagbauer and Henschler (1967) 

Mice 

127 

30 

Back, Thomas and Macewen (1972) 

Mice 

137 c 

60 


Rats 

293 c 

60 

Bitron and Aharonson (1978) 

Mice 

290 d 

11 



170 

55 

Alarie (1980) 

Mice 

302 

10 


a Value obtained by averaging values of 524 and 597 ppm and then averaging again with value of 676 ppm. 
b Exposure of 30 h limited to 3h/day. 
c These values are also given by Vernot et d. (1977). 
d These values are for a 30 day observation period. 
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Figure 18.8 Concentration of chlorine that is lethal to various animal species at the 50% level (Withers and Lees, 
1985a). Dotted line has slope of-0.5. (O) Weedon et at. (1940), mice; (*) Upton and Rotariu (1941), mice; (A) 
Schlagbauer and Henschler (1967), mice; (sy) Back, Thomas and MacEwen (1972), mice; (*) Bitron and Aharonson 
(1978); mice (it) Ala rie (1980), mice; (%) Weedon etal. (1940), rats; (M) Bell and Elmes (1965), rats; (Y) Back, Thomas 
and MacEwen (1972), rats; (x) Underhill (1920), dogs; (+) Chlopin (1927-), horses (fatal concentration, not necessarily 
LC S0 ) (Courtesy of Elsevier Science Publishers) 


Table 18.20 Concentrations of chlorine lethal to rodents at the 50% level as a function of time (Withers and Lees, 
1985a) (Courtesy of Elsevier Publishing Company) 


Author (s) 

Species 

C (ppm) 

T (min) 

CT 

CT 04 

CT° 5 

CT o- 6 

Weedon, Hartzell and Setterstrom (1940) 

Mice 

1000 

28 

28,000 

3792 

5292 

7384 



250 

440 

110,000 

2853 

5244 

9639 


Rats 

1000 

53 

53,000 

4895 

7280 

10,828 



250 

440 

110,000 

2853 

5244 

9639 

Bitron and Aharonson (1978) 

Mice 

290 

11 

3190 

757 

962 

1222 



170 

55 

9350 

844 

1261 

1882 


a function of the concentration and as a function of the 
mortality, respectively. 

18.18.2 Physiology and pathology of poisoning 

The physiology and pathology of chlorine gas poisoning 
have been studied by a number of workers, including many 
of those already mentioned. 

Many of those who have done experimental work on 
animals have discussed this aspect. Lehmann gives a 
wide-ranging discussion of the topic. Accounts by German 
workers active around the time of the First World War 
include those by Flury and Zernik (1931) and Wachtel (1941) 
and among American workers those of Underhill (1920) and 
Winternitz et al. (1920). The overall picture that emerges is 
that while chlorine attacks the whole of the respiratory 
system, the cause of death is lung oedema. 


There is also a large amount of information that is 
directly applicable to man. There are a number of accounts 
of the treatment of chlorine gas casualties by British 
doctors. The Chemical Warfare Committee of the Medical 
Research Council did extensive work, including that of 
Gunn (1920) on the action of chlorine on the respiratory 
system. The official military account is given in Diseases 
of the War (Macpherson etal., 1923). 

The extensive American workfromthattime is described 
by Underbill andWinternitz etal., while the official military 
account is given by Ireland (1926). Additional information 
is given by Haggard (1924) and by Henderson and Haggard 
(1943). Further accounts are given by other military authors 
such asVedder (1925) and Prentiss (1937). 

Investigations of the long-term effect of gas warfare 
exposure are described by Meakins and Priestley (1919), 
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Table 18.21 Mortality of animals exposed to chlorine, adjusted to an exposure period of 30 minutes and 
normalized with respect the LC 50 (Withers and Lees, 1985a) (Courtesy of Elsevier Publishing Company) 


Author(s) 

Species 

LC 50 (ppm) Concentration Normalized Mortality 

(ppm) concentration (%) 

Underhill (1920) 

Dogs 

650 

164 a 

0.25 

11 




491 

0.76 

29 




600 

0.92 

40 




710 

1.09 

67 




819 

1.26 

61 




928 

1.43 

91 




1583 

2.44 

93 

Silver and McGrath (1942); Silver, 

Mice 

388 

219 b 

0.56 

10 

McGrath and Ferguson (1942) 



317 

0.82 

45 




317 

0.82 

25 




337 

0.87 

5 




364 

0.94 

40 




368 

0.95 

45 




398 

1.03 

15 




408 

1.05 

60 




410 

1.06 

55 




430 

1.11 

70 




458 

1.18 

75 




486 

1.25 

40 

Schlagbauer and 

Mice 

131 

62 

0.47 

10 

Henschler (1967) 



69 

0.53 

10 




110 

0.84 

30 




125 

0.95 

30 




132 

1.01 

60 




143 

1.09 

60 




160 

1.22 

80 

a Converted from 0°C to 25°C. 
b Converted from original data for 10 min ex 

posure period. 






Vedder (1925), Gilchrist and Matz (1933) and Penington 
(1954). 

Chlorine is a strong oxidizing agent. A number of dif¬ 
ferent explanations have been given of the way in which it 
causes damage. An early suggestion was that its effect is 
through the formation of hydrochloric acid. Another early 
suggestion was that it gives rise to nascent oxygen. More 
recent suggestions are the action of hypochlorous acid and 
of chlorine itself. 

Chlorine is an irritant gas and the most serious effect 
of acute chlorine poisoning is damage to the respiratory 
system. Another important irritant gas that was also used 
as a war gas is phosgene and many discussions of gas 
poisoning treat the two gases together, although there are 
differences. The symptoms of chlorine poisoning are: at 
a concentration of about 15 ppm, irritation of the nose, 
throat and eyes with cough and tears; at about 30 ppm, 
restriction of breathing and chest pain; and from about 
50 ppm, development of pulmonary oedema. Other symp¬ 
toms are described in some of the accounts given below. 

The description by Haggard (1924) of the action of irri¬ 
tant gases on the respiratory tract has already been quoted. 

In the present context it is severe acute poisoning that is 
of primary interest. Herringham (1920) states: 

The whole course of events, and the various degrees of 

severity, are all due to but one cause, the want of oxygen in 


the blood due to the wall of oedema interposed between 
the air and the blood vessels. 

An extensive discussion of chlorine poisoning is given 
in Diseases of the War and the following extracts give an 
overview of the principal aspects. The threat to life is due 
almost entirely to pulmonary oedema and other effects 
are relatively unimportant, but later infection can also be 
dangerous: 

The respiratory organs, eyes and skin, bore the brunt of 
the attack. Yet even if one recognizes this, one must be 
prepared for serious effects that are secondary to these 
primary lesions. Severe though temporary shortage of 
oxygen, resulting from acute pulmonary oedema or 
interference with the oxygen-carrying power of the 
blood, may exercise lasting effects on the heart, the cen¬ 
tral nervous system, or other organs of the body, while 
secondary bacterial infection may delay recovery or even 
be the prelude to a fatal termination. 

The points where the gases classed as acute lung irritants 
exercise their most pronounced effect are the alveoli of 
the lungs and the smaller bronchial tubes, and the great 
danger to be feared, which is common to them all, is the 
onset of acute pulmonary oedema. It is in the main this 
oedema which, in the acute stage of poisoning, threatens 
the life of the subject, for if abundant it causes death by 
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Figure 18.9 Proportion of acute deaths by chlorine poisoning in Underhill’s work (Withers and Lees, 1985a). 
Exposure time 30 min, (a) Proportion of acute deaths as a function of concentration; (b) proportion of acute deaths 
as a function of mortality (Courtesy of Elsevier Science Publishers) 


asphyxiation, the patient being in fact drowned by his 
own eduction. 

The rate of onset and the degree of oedema are dependent 
on the particular gas and on its concentration, and, 
though in some cases to a less degree, on the duration of 
exposure. 

Any pathological changes found in organs of the body 
other than the lungs are really attributable to changes 
resulting secondarily from the gross damage in the res¬ 
piratory apparatus, and from the consequent asphyxia, 
and that the direct effects of the gas are limited to the 
lungs and bronchial tubes. 


The effect of oedema is to cause a reduction in the supply of 
oxygen to the blood: 

These gross changes in the lungs are responsible for 
serious interference with the gaseous exchange between 
blood and air, and the indications for asphyxia were 
obvious in all severe cases of poisoning by the acute lung 
irritant gases. The cases fell into two categories: the one 
was characterized by intense florid and deep cyanosis, 
with vascular congestion and engorgement of the veins, 
the other exhibited no venous engorgement but pallor akin 
to that seen in collapse, with grey or lilac-coloured lips 
and tongue. Both classes had the common feature that the 
colour of the blood indicated a grave deficiency of oxygen. 
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The symptoms tended to follow a common pattern: 

All the men gave a similar description of what they felt as 
the greenish-yellow fumes enveloped them. Immediate 
choking, coughing, gasping for breath and inability to 
speak proved the irritation and spasm of the respiratory 
tract. In many the eyes smarted and ran with water. 
Retching was at once experienced by some, but many did 
not vomit until an hour or two later. There was severe pain 
behind the sternum, which soon radiated outward on 
each side into the chest and added greater suffering to the 
distressed breathing. The throat burned and the dry 
mouth produced an intense sensation of thirst. 

Very soon the developing pulmonary oedema led to the 
phenomenon of oxygen shortage, with headache, a sense 
of weakness in the legs, and suchl lassitude that the men 
dropped prone upon the ground, the spasmodic violence 
of their respiratory efforts being then largely quietened. 

Milder cases in areas where the concentration of chlorine 
in the air was relatively low, suffered chiefly from lassi¬ 
tude and a great sense of fatigue. 

The complete arrest of breathing due to spasm was not 
observed and is not regarded as an important factor: 

The question has often been discussed as to whether a 
man might be killed by immediate asphyxiation on the 
field through such a spasmodic closure of his larynx and 
bronchi that respiration was completely arrested. Sudden 
shock and collapse from extreme sensory irritation has 
been noted in animals immediately upon exposure to 
chloropicrin; and it might be that this factor would also 
play its part in determining early death upon the field. 
But no proof was ever obtained that a man has thus been 
choked to death on the field. If it ever did happen, it was 
of little practical importance. No medical officer in the 
trenches ever had the chance of attempting to treat 
such a case. 

Pulmonary oedema and its effects are therefore the impor¬ 
tant factors: 

A rapid development of pulmonary oedema, interfering 
with gaseous respiration and also with the circulation 
itself, was probably always the actual cause of death. 

It is thought that the entire action of pulmonary irritants 
is exercised solely upon the surface layers of the body 
with which the gases come into contact, the early circu¬ 
latory failure being caused only the influence of pul¬ 
monary oedema upon gaseous respiration and blood-flow 
and by ‘shock’. 

A similar picture emerges from the accounts of their 
work given by Underbill and by Winternitz et al. Acute 
death is associated with oedema and blood changes. 
Underhill attributes the effects of oedema not so much to 
the blockage of oxygen transfer in the lung as to a decrease 
in the fluid content of the blood and a consequent increase 
in the solids content and viscosity and a reduction in the 
oxygen-carrying capacity. 

Physical exertion following gassing can be dangerous, 
even for men apparently unaffected: 

When the tension of a gas attack had passed way, it 
sometimes happened that, among those who had been 
exposed to the irritant vapour but who had not reported 
sick, a man would stop working, complain that he felt 


done in, and die in a few minutes. Others might survive 
for an hour or two after a similarly sudden collapse. Their 
deaths were at first thought to have been caused by heart 
failure due to a direct intoxication by the gas. Autopsies, 
though not made in the dramatic cases of abrupt death, 
always proved the existence of advanced pulmonary 
oedema, the condition being really identical with that of 
‘grey’ collapse as seen after the ordinary acute onset. 

The effect of exertion after exposure appears, however, to 
have been observed mainly with phosgene rather than with 
chlorine. 

There has been some expression of doubt about the pre¬ 
valence of pulmonary oedema among those who have 
treated people gassed by chlorine in industrial accidents. 
Thus A.T. Jones (1952) states that in the period 1932-48 he 
and his colleagues dealt with 820 such cases, of which 
9 were severe, but even in these cases neither pulmonary 
oedema nor pneumonia ensued, although he indicates 
awareness of pneumonia in other cases. Industrial gassing 
is also discussed by Haggard, who states 

Even an exposure insufficient to induce the acute symp¬ 
toms of lung irritation may lead to the development of 
pneumonia and under industrial conditions the infec¬ 
tions thus produced constitute a greater cause of death 
than primary oedema. 

Although the descriptions quoted on the effect of irritant 
gases are undoubtedly strongly influenced by experience 
with phosgene, the account of Black, Glenny and NcNee 
(1915), who treated 685 cases of poisoning from chlorine 
between 2 and 7 May, 1915, before phosgene had been used, 
shows clearly that the acute deaths involved pulmonary 
oedema. This was confirmed by 210 post-mortems carried 
out by these doctors. 

If acute death does not occur, there is still the danger of 
delayed death. The cause of delayed death is described 
variously as bronchitis, bronchial pneumonia or pneumo¬ 
nia. Black, Glenny and McNee state that the acute stage 
passes off in about 36 h, that there is then a quiet stage of 
some 12 h and that the bronchial infection is then liable to 
develop. Underbill found that the dogs which survived 
gassing were liable to die of pneumonia, and set 3 days 
after gassing as the dividing line between acute and 
delayed deaths. 

The mortality from chlorine gassing may be reduced by 
appropriate medical treatment. It is not clear how much can 
be done to increase the chances of survival of acute cases, 
but for the delayed cases the prospects appear much better. 
There are descriptions of the treatment given and of its 
effects in many of the accounts already quoted. 

The long-term effects of chlorine gassing are also impor¬ 
tant. Broadly speaking, both the statistical and clinical 
evidence suggest that these effects are not great. Weill et al. 
(1969) studied 12 people who were severely gassed in an 
accidental chlorine accident near La Barre in 1961. All had 
pulmonary oedema when examined just after the accident, 
but when examined 3 and 7 years after the event showed 
little long-term damage. 

A summary of the findings of these authors given by 
Eisenberg, Lynch and Breeding (1975) has been quoted in 
Section 18.15. The evidence from this work is that persons 
who survive acute exposure to chlorine gas tend not to 
suffer significant permanent lung damage. 
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18.18.3 Concentrations intolerable to humans 

Some values given in the literature for chlorine concen¬ 
trations tolerable and intolerable to humans are shown in 
Table 18.22. 

At concentrations of about 4 ppm irritation is said to be 
experienced and normal work to be impossible. Dangerous 
concentrations are variously given as 14-21 and 40- 
GO ppm for 0.5-1 h, but the degree of danger is ill defined. 
A concentration of about 50 ppm is said to cause loss of 
fighting efficiency and one of 100 ppm to incapacitate and 
to be intolerable. The data were apparently obtained by 
observation of the effects of chlorine on man. The basis of 
the data is different, therefore, from those for the lethality 
to man derived from animal experiments. They include, 
presumably, the effects of any enhancement of activity 
which may have occurred. 

18.18.4 Concentrations lethal to humans 

Some values given in the literature of chlorine concentra¬ 
tions lethal to humans are shown in Table 18.23. 

18.18.5 Limit values for humans 

TheTLV for chlorine recommended by the ACGIH has for 
many years been 1 ppm. In the United Kingdom the OES is 
now an 8-hTWA of 0.5 ppm. 


Zielhuis (1970) has made proposals for EELs for chlorine. 
His values are 7,5,4 and 3 ppm for exposures of 5,15,30 and 
60 min, respectively. The proposals of the NAS-NRC 
(1973a) for public emergency limits (PELs) are 3, 2, and 
2 ppm for exposures of 10,30 and 60 min, respectively. 

18.18.6 Probit equations given in literature 

Probit equations both for lethality and non-lethal injury 
due to chlorine were given by Eisenberg, Lynch and 
Breeding (1975) in the Vulnerability model. The probit 
equation for the lethality of chlorine is 

Y = -17.1 + 1.69 In C 2J5 t) [18.18.3] 

And that for non-lethal injury due to chlorine is 
Y= -2.40 + 2.90 In C [18.18.4] 

where C is the concentration (ppm) and T is the time (min). 

Equation 18.18.3 gives an LC 50 for 30 min of some 
35 ppm. It is apparently derived from a graph consisting of 
an arbitrary concentration scale vs a percentage mortality 
scale on which various sets of experimental results for 
animals are plotted as straight lines. The LL 50 points on 
these lines are: for dogs, 70; for rats, 3.5 and 1.4; for mice, 20, 


Table 18.22 Concentrations of chlorine tolerable and intolerable to man (Withers and Lees, 1985b) (Courtesy of 
Elsevier Publishing Company) 


Author(s) 

Effect 

Concentration 

(ppm) 

Exposure 

Source 

Rupp and Henschler 

Odour threshold 

0.02-0.05 



(1967) 





ACGIH 

Robert (1912) 

Threshold limit value 

Minimum concentration to detect odour 

3.5 



Concentration which causes immediate 

14 




irritation 

Concentration which causes coughing 

28 




Dangerous concentration 

40 

lh 


Flury and Zernick 

Concentration tolerable without 

3.5 

0.5-1 h 

Lehmann-Hessa 3 

(1931) 

immediate or later consequences 





Concentration at which work can be 

1-2 


Matt(1889) 


continued without interference 
Concentration at which work becomes 

4 


Matt (1889) 


impossible 

Dangerous concentration 

14-21 

0.5-1 h 

Lehmann-Hessa 3 

Henderson and 

Maximum concentration allowable for 

0.35-1 



Haggard (1943) 

physical exertion 

Minimum concentration to detect odour 

3.5 




Maximum concentration allowable for 

4 

0.5-1 h 



short exposure 

Dangerous concentration for short 

40-60 




exposure 




Vedder (1941) 

Concentration which incapacitates man 

100 




(crying, coughing) in a few seconds 




Wachtel (1941) 

Concentration which causes severe 

3 




irritation 

Concentration which causes loss of 

47 




fighting capacity 




Patty (1962) 

Concentration which causes irritation 

3-6 




Intolerable concentration 

100 

1 min 



a Quoted without reference by Flury and Zernik (1931). 
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15, 3.5 and 0.7; composite for all animals, 1; and for man, 
0.25. It is not clear what the justification is for this low value 
for man, but the choice appears to be a conservative one. 

In a further development of the Vulnerability model, 
Perry and Articola (1980) give revisions of the Eisenberg 
equations. Their equation for the lethality of chlorine is 


Y = -36.45 + 3.13In (E C 2M T) [18.18.5] 

and that for chlorine injury is again Equation 18.18.4. 

The industrial comment on the Rijnmond Report 
(Rijnmond Public Authority, 1982) proposes the equation 


Y = -11.4 + 0.82 In (EC 275 T) [18.18.6] 

This equation is also recommended by N.C. Harris and 
Moses (1983). ten Berge and van Heemst (1983) propose the 
equation (in the units used here) 

Y = -5.04 + 0.5 In (EC 275 T) [18.173J 


Harris and Moses effectively argue that there is no justifi¬ 
cation for taking a low value of the ratio of the lethal load 
for man to that of animals, or for assuming a very narrow 
spread of response, and set the parameters in Equation 

18.18.6 accordingly, ten Berge and van Heemst apparently 
derive their parameters from the work of Bitron and 
Aharonson (1978), together with information on the con¬ 
centrations causing irritation in man. 

The probit equations given in the literature for the lethal 
toxicity of chlorine are summarized in Table 18.24. Further 
probit equations produced subsequent to this study are 
described below. 

18.18.7 Toxicity values used in hazard assessments 

Some values of the lethal concentration or dosage of chlo¬ 
rine used in a number of hazard assessments are given in 
Table 18.25. Most correspond to an LC 50 for 30 min of about 
35 ppm. The much higher value of 430 ppm used by Meslin 
(1981) is an exception. 

18.18.8 Model for humans 

On the basis of the information just described, Withers and 
Lees (1985b) have derived for chlorine a model for the lethal 


Table 18.23 Lethal concentrations of chlorine quoted in standard toxicology texts (Withers and Lees, 1985b) 
(Courtesy of Elsevier Publishing Company) 


Author(s) 

Effect 

Concentration 

(ppm) 

Exposure time 

Source 

Flury and 

Lethal concentration for man 

900 

Immediate 


Zernik (1931) 

Lethal concentration for man 

(2.5mg/l) 

35-50 

(0.1-0.15 mg/1) 

0.5-1 h 

Hess* 


Dangerous concentration for mar 

i 14-21 

(0.04—0.06mg/l) 

0.5-1 h 

Hess* 


Lethal concentration for man 

1000 

Short exposure 

Robert (1912) 


Dangerous concentration for mar 

i 40-60 

Short exposure 

Robert (1912) 

Patty (1962) 

Lethal concentration for large 

1000 

After brief 

Flury and 


animals 


exposure 

Zernik (1931) 


Concentration which may be 

300 

60 min 



lethal to cats 

Concentration which is rarely 

650 

30 min 



lethal to dogs 

Concentration which is never 

280 

30 min 



lethal to cats 

Dangerous concentration for mar 

i 14-21 

0.5-1 h 


Tatken and 

LCL 0 mam b 

500 

5 min 

Flury (1928) 

Lewis (1984) 

LC 50 mus (mouse) 

137 

lh 

Back,Thomas and 





MacEwen (1972) 


LC 50 rat 

293 

lh 

Back,Thomas and 





MacEwen (1972) 


LCL 0 gpg (guinea pig) 

330 

7 h 

Lehmann (1887) 


LCL 0 cat 

660 

4h 

Lehmann (1887) 


LCL 0 dog 

800 c 

30 min 

Barbour (1919) 


LCL 0 hmn (man) 

873 

30 min 

Prentiss (1937) 

Sax (1984) 

As Tatken and Lewis (1984) 




Henderson and 

Lethal concentration 

1000 

Short exposure 


Haggard (1943) 
Matheson Co. (1961) 

Lethal concentration 

1000 

After a few breaths 


Stahl (1969) 

Dangerous concentration 

20 

30 min 


a Quoted without referent 

:e by Flury and Zernik (1931). 




b Lowest lethal concentra 

tion recorded. 





c A death was recorded in the concentration range 50-250 ppm (his values) at a 30 min exposure in Underhill’s work (1920). 
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toxicity to humans. The model is based on estimates for 
humans of the LC 50 , the slope of the concentration- 
mortality line, or ratio LCg 0 /LCi 0 , and the lethal load func¬ 
tion together with factors for inhalation rate and for 
medical treatment, and involves a separate treatment of 
the vulnerable population. Before considering the model 
proper, it is convenient to consider these latter aspects. 

18.18.9 Physical activity 

It is to be expected that man will not simply remain passive 
in the face of a toxic threat but will react by some form of 
physical activity such as seeking to escape or to obtain 
shelter. 

There are two main effects of such activity. The first is 
that larger volumes of contaminated air are inhaled. Data 
on inhalation rates were given inTable 18.16. It is clear from 
these data that the inhalation rate is greatly increased by 
activity and that the factor can be as high as 15. The injury 
suffered as a result of more rapid inhalation is likely to be 
increased, and allowance needs to be made for this. 

The other effect of enhanced activity is that larger 
amounts of oxygen are required by the body. Data on this 
aspect also were given inTable 18.16. This increased oxygen 
demand may occur during exposure and/or after exposure. 

The level of physical activity is taken into account by 
defining a base level of activity, which corresponds to rest, 
and a standard level of activity that corresponds to a 
normal mixture of sitting, standing and moving about and 
for which the inhalation rate is twice that of the base level. 

18.18.10 Inhalation rate 

The effect of inhalation rate on the injury caused by a given 
concentration of chlorine in air is not obvious, but it is 


important because it is quite conceivable that high inhala¬ 
tion rates will increase the injury several-fold. The assump¬ 
tion made in the model is that over a given inhalation period 
injury is a function of the mass of chlorine absorbed. 

The rate of absorption of chlorine in the lung is a mass 
transfer process and this process may be modelled. An 
account of the respiratory system, including quantitative 
data, was given in Section 18.13. The amount of chlorine 
absorbed is the product of the alveolar ventilation rate 
and the difference in the inhaled and exhaled chlorine 
concentrations. It is also equal to the product of the pul¬ 
monary diffusion capacity and the difference between the 
actual and equilibrium partial pressures of chlorine at the 
alveolar membrane wall. Finally, it is also equal to the sum 
of the amount of chlorine transported out of the lung 
capillaries by the blood and of that reacted in the alveolar 
tissue. 

The situation with respect to the solubility of chlorine is 
complicated by the hydrolysis of chlorine to hypochlorous 
acid. The solubility of chlorine and its hydrolysis have been 
extensively studied and data are available on the solubility 
of unhydrolysed chlorine and on the equilibrium and rate 
constants for the hydrolysis. There do not appear to be any 
data on the solubility of chlorine in blood plasma, but the 
solubility of other gases such as oxygen, carbon dioxide 
and nitrogen is some 10% less in plasma than in water. 

If it is assumed that the chlorine is simply absorbed into 
the blood, there will be a gradual accumulation of chlorine 
in the blood that will exert a corresponding equilibrium 
partial pressure at the alveolar membrane so that the 
concentration of chlorine in the blood will rise exponen¬ 
tially to an equilibrium value and absorption will tail off. 
However, this model does not appear to be consistent with 


Table 18.24 Some probit equations for chlorine given in the literature (Withers and Lees, 1985b) (Courtesy of 
Elsevier Publishing Company) 


A Equations for fatality 




Lethal concentration for 30 mi 
exposure period (ppm) 




LCio 

LC 50 

LG, o 

Eisenberg, Lynch and 

Breeding (1975) 

Y = -17.1 + 1.691n(EC 275 T) 

26 

34 

44 

Perry and Articola (1980) 

Y = -36.45 + 3.131n(EC 2 - 64 T) 

36 

42 

49 

Rijnmond Report 

Industrial Comment 
(Rijnmond Public 

Authority, 1982); N.C. 

Harris and Moses (1983) 

Y = -11.4 + 0.84 ln(£C 2 ' 75 T) 

237 

418 

738 

ten Berge and van Heemst 3 
(1983) 

Y= -5.04 + 0.5 ln(SC 2 ' 75 T) 

170 

430 

1093 

B Equations for injury 

Eisenberg, Lynch and 

Breeding (1975); Perry 
and Articola (1980) 

Y = -2.40 + 2.90 In C 





a Original equation: 

Y = —6.5+0.5 ln(Jj)C z ' 75 T) 

where C is concentration (mg/m 3 ) and T is time (min). 
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Table 18.25 Values of the lethal concentration of chlorine used in various hazard assessments (Withers and Less, 
1985b) (Courtesy of Elsevier Publishing Company) 

Author(s) 

Effect 

Concentration (ppm) 

Exposure time (min) 

Source 

Howerton 

Dangerous 

35 

Not defined 


(n.d., 1969) 

concentration 3 




Dicken 

Fatal 

90 b 

10 


(1974,1975) 

concentration 3 

70 

30 




40 

100 



Dangerous 

30 

10 



concentration 3 

15 

100 


Simmons, Erdmann 

ld 50 

1000 ppm min 


Chlorine 

and Naft (1973,1974) 


(say, 35 ppm 


Institute 



for 30 min) 



Eisenberg, Lynch and 

Lethal concentration 

35 

30 

Self 

Breeding (1975) 

lc 50 




Solomon, Rubin and 

ld 50 

40-60 

30-60 


Okrent (1976) 





Meslin (1981) 

Lethal dose 

430 

30 

NIOSH 

Rijnmond Public 

Lethal concentration 

35 

30 

Eisenberg, Lynch 

Authority (1982) 

lc 50 



and Breeding (1975) 


b Approximate values read from graph. 


the information available on the damage done to the body 
by chlorine. The evidence indicates that the damage is 
essentially confined to the lung. 

A more appropriate assumption appears to be that the 
lung is a sink for the chlorine, which reacts with the alveo¬ 
lar tissue. This means that the venous hlood entering the 
lung capillaries will contain very little chlorine. The maxi¬ 
mum concentration of chlorine in the blood leaving the lung 
may then be obtained by solving the mass balance. Simple 
calculations based on the physiological parameters and the 
solubility of unhydrolysed chlorine indicate that for a man 
at rest the concentration of exhaled chlorine will be less 
than half the inhaled concentration. The actual value will 
be less than this maximum, since the concentration in the 
blood will be reduced both by hydrolysis and by reaction 
with the tissues. Thus even at rest almost all the chlorine 
inhaled will be absorbed. This will also be true for moder¬ 
ate increases in physical activity, since the increase in 
inhalation rate is accompanied by an increase in the circu¬ 
lation of blood through the lungs. 

Further support for this interpretation is afforded 
by experiments by Lehmann (1893), who measured the 
inlet and outlet concentrations of chlorine in chlorine- 
contaminated air breathed by men. The inlet concentration 
was 2 ppm, the outlet concentration was undetectable, 
the absorption thus being total. This evidence is not con¬ 
clusive, since the chlorine concentration was low, but it 
points in the right direction. 

As a first approximation, therefore, the inhalation rate is 
taken into account by defining a factor that is applied 
directly to the concentration in order to correct for inhala¬ 
tion rate. 


18.18.11 Medical treatment 

Appropriate medical treatment may effect a reduction in 
the mortality from exposure to chlorine. It is likely to be 
much more effective in preventing delayed deaths than 
acute deaths. 


As described above, the proportion of acute deaths is a 
function of mortality. From analysis of war gas casualties 
the proportion P a of acute to total deaths, or the acute death 
factor, is 

P a = 0.8 + 0.2P [18.18.8] 

where P is the total mortality. 

The effect of medical treatment is taken into account 
by defining a factor i/f 2 that is applied to the proportion of 
delayed deaths, or rather, in this context, potential delayed 
deaths, to yield the proportion of recoveries. 

18.18.12 Vulnerable populations 

So far consideration has been limited to the effect of toxic 
gas on healthy adults. A significant proportion of the 
population, however, is more vulnerable. It is necessary to 
distinguish, therefore, between the less vulnerable, or 
regular, population and the more vulnerable, or simply 
vulnerable, populations, which together make up the gen¬ 
eral, or average, population. 

The principal categories of people vulnerable to chlorine 
gas are children, old people and people with respiratory or 
heart disorders. The less vulnerable members of the popu¬ 
lation are healthy youngsters and adults. The estimate 
given by Hewitt for the proportion of vulnerable people was 
given in Table 9.26. A rough value is some 25% of the 
population. 

One approach that has been used in hazard assessment is 
that of Eisenberg, Lynch and Breeding, who used for 
chlorine and ammonia the relations between the general 
population and the vulnerable population given in 
Table 18.17. There are several points that should be noted in 
connection with this table. The general population is not 
well defined, particularly as to whether or not it includes 
the vulnerable population. Also it has been shown by 
Withers and Lees that the relations given imply a lower 
spread of lethal concentrations for the vulnerable than for 
the regular population. 
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The vulnerability of part of the population may be han¬ 
dled either by treating the whole population as a single 
homogeneous population with vulnerable members or by 
treating the regular and vulnerable sections as two popu¬ 
lations. In the first approach there is a single distribution, 
whereas in the second there are two separate distributions 
with distinct modal values. It is not self-evident which 
approach is most likely to fit such data as may exist, but it is 
clear that for hazard assessment it is more convenient to 
handle the vulnerable population separately and to have a 
separate distribution applicable to that population. This is 
therefore the approach adopted. It may be noted, however, 
that if two distinct distributions are used, they do not 
in general yield a distribution of the same type for the 
average population. Specifically, if the distributions for the 
regular and vulnerable populations are both log-normal, 
that for the average population cannot be expected to be 
log-normal. 


18.18.13 Lethal load 

The different forms of the lethal load function have been 
described in Section 18.11. The lethal load functions used in 
the model are 


^mCF* [18.18.9] 


L* = £ C"T [18.18.10] 

Equation 18.18.9 is the natural form for the correlation of 
the basic data, but Equation 18.18.10 is the more convenient 
for hazard assessment. 

The animal experiments indicate for m a value of 0.5 and 
this is used in the model for humans. The corresponding 
value of n is 2. 


18.18.14 Lethal concentration: regular population 

In the model the estimate of the LC 50 is based primarily on 
the judgement that the most weight should be given to the 
work on dogs by Underbill, and this is then interpreted in 
the light of the other animal experiments. 

The animal experiments described above give average 
LC 50 values for 30 min exposures of 256,414 and 650 ppm 
for mice, rats and dogs, respectively. The LC 50 used in the 
model for man is 500 ppm for 30 min for the regular popu¬ 
lation at the base level of activity. 

The high weight given to Underbill’s work on dogs is 
based on a number of factors. One is the similarity of the 
respiratory systems of dog and man. Another is the quality 
of the experimental work. 

In Underbill’s work, the dogs tended to lie passively with 
their paws folded so that movement was minimal. This 
behaviour has been taken as corresponding to the base 
level of activity. 

This estimate of the LC 50 for man is intended to be a best 
estimate rather than a conservative one. 

The slope of the concentration-mortality line, or ratio 
LCgo/LCio, which is used in the model is 4. This also 
is based primarily on the value of 3.8 obtained from 
Underbill’s work on dogs. The two other values obtained 
from the animal work are 4.4 (Silver and McGrath, 1942; 


Silver, McGrath and Ferguson, (1942) and 1.9 (Schlagbauer 
and Henschler, 1967) on mice. 

The lethal load at the base level of activity then follows 
directly. For 50% mortality at a 30 min exposure 

LL 50 = CT 0 ' 5 = 5000 x (30) 0 ' 5 

= 2,739 ppm min 1 / 2 [18.18.11] 

Similarly, the lethal loads for 10% and 90% mortality are 
1,369 and 5,477 ppm min 0 ' 5 , respectively. 

18.18.15 Lethal concentration: vulnerable population 

The lethal concentrations for the vulnerable population are 
based on an estimate that the LCi 0 for a 30 min exposure for 
the vulnerable population at the base level of activity is 
100 ppm. This estimate is derived partly from information 
derived from the animal experiments and partly from the 
concentrations reported as intolerable to man. In the 
experimental work on animals there was no fatality at a 
concentration below 50 ppm for a 30 min exposure. The 
nearest approach was a single fatality at 62 ppm in 
Schlagbauer and Henschler’s work. A concentration of 
100 ppm is shown in Table 18.22 as being some four times 
that which causes coughing and equal to that which is 
intolerable or incapacitating. 

It is also assumed in the model that the slope of the con¬ 
centration mortality line, or ratio LC90/LC10, is same as for 
the regular population. This gives for the vulnerable 
population values of 200 and 400 ppm for the LC 50 and 
LC go for 30 min. 

18.18.16 Inhalation rate factor 

The inhalation rate factor t/q used in the model is the ratio of 
the inhalation rate at the actual level of activity to that at the 
base level, which corresponds to rest in bed and for which 
the inhalation rate is 61/min.This factor is applied directly 
to the inhaled concentration. 

The normal, or standard, level of activity involves 
some movement and for this the inhalation rate is about 
121/min. Thus for the standard level of activity i/q = 2. 

It is intended in the model that for the regular population 
the default level of activity be taken as the standard level, 
unless there is a reason to take some other level. For the 
vulnerable population the level of activity for old people 
and young children may approximate to the base level and 
the standard level, respectively. 

18.18.17 Medical treatment factor 

In the model the proportion of delayed deaths is estimated 
from Equation 18.18.8 and the effectiveness of medical 
treatment in converting delayed deaths into recoveries is 
accounted for using the medical treatment factor i j/ 2 - This is 
taken as 0.9 and 0.7 for the regular and vulnerable popula¬ 
tions, respectively, which means that for these populations 
some 90% and 70% of the potential delayed deaths convert 
to recoveries. These are necessarily approximate estimates, 
but their overall effect on the mortality is not great, since 
most deaths are sudden rather than delayed. 

It is not appropriate to claim credit for the mitigating 
effect of medical treatment unless there exist the organi¬ 
zation, the expertise and the facilities commensurate with 
the accident envisaged. 
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18.18.18 Probit equations 

From the foregoing the following probit equations may be 
derived: 

Regular population 
Base level of activity: 

Y = -9.57 + ln(EC 2 T) 18.18.12; 

Standard level of activity: 

Y = -8.29 + 0.92 ln(EC 2 T) [18.18.13] 

Vulnerable population 
Base level of activity: 


of activity may be obtained using Equations 18.18.13 and 
18.18.15, respectively. 

If it is desired to derive an estimate that takes account of 
other conditions and makes at least some allowance for the 
other factors discussed, the approach is as follows: 

(1) Estimate the inhalation rate factor and apply it to the 
concentration; 

(2) estimate the toxic load using the corrected concen¬ 
tration; 

(3) calculate the uncorrected mortality, estimate the acute 
deaths factor and apply it to this mortality; 

(4) estimate the medical treatment factor and apply it to 
the proportion of potential delayed deaths; 

(5) calculate the corrected mortality. 


Y m -7.88 + 0.92 ln(E C 2 T) [18.18.14] 

Standard level of activity: 

Y = -6.61 + 0.92 ln(EC 2 T) [18.18.15] 

The lethal concentrations for exposure times of 10 and 30 
min for the regular and vulnerable populations given in the 
model, as expressed in these probit equations, are shown in 
Tables 18.26 and 18.27, respectively. 

18.18.19 Overall methodology 

The overall methodology used in the model for the estima¬ 
tion of the mortality from an accidental chlorine release 
given the concentration-exposure time profile may be 
summarized as follows. 

A straightforward estimate of the mortality for the 
regular and vulnerable populations with the standard level 


Table 18.26 Concentrations of chlorine proposed as 
lethal to humans for an exposure time of 10 min (Withers 
and Lees, 1985b) (Courtesy of Elsevier Publishing 
Company) 


A Regular population: standard level of physical 
activity 

Cocentration 

Mortality 

Toxic load, 
CT° 5 

(ppm) 

(%) 

(ppm min 0 ' 5 ) 

217 

10 

685 

433 

50 

1369 

866 

90 

2739 

B Vulnerable population: standard level of 
physical activity 

87 

10 

274 

173 

50 

548 

346 

90 

1095 

C Average population: standard level of physical 
activity 

139 

10 

438 

364 

50 

1150 

805 

90 

2547 


18.18.20 Gas warfare cross-checks 

Since chlorine was the first major war gas, attempts have 
been made to cross-check estimates for the lethal toxicity of 
chlorine against the effects of gas attacks. One such 
attempt is that by Nussey, Mercer and Fitzpatrick (1986). 
Another is that by Withers and Lees (1987b, 1992) to check 
the model just described. Critiques of this work by 
R.F. Griffiths and Fryer (1988) and V.C. Marshall (1989b) 


Table 18.27 Concentrations of chlorine proposed as 
lethal to humans for an exposure time of 30 min (Withers 
and Lees, 1985b) (Courtesy of Elsevier Publishing 
Company) 


A Regular population: base level of physical activity 

Concentration Mortality Toxic load, CT 05 

(ppm) (%) (ppm min 0 ' 5 ) 


250 10 1369 

500 50 2739 

1000 90 5477 


B Vulnerable population: base level of physical 
activity 


100 10 548 

200 50 1095 

400 90 2191 


C Regular population: standard level of physical 
activity 


125 10 685 

250 50 1369 

500 90 2739 


D Vulnerable population: base level of physical 
activity 


50 10 274 

100 50 548 

200 90 1095 


E Average population: standard level of physical 
activity 


80 10 438 

210 50 1150 

465 90 2547 
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have held that the uncertainties surrounding these attacks 
are simply too great to make a cross-check. 

18.19 Gas Toxicity: Green Book Relations 

Another, more recent, treatment of the toxicity of industrial 
gases is that given in Methods for the Determination of 
Possible Damage by the CPD in the Netherlands (1992b) 
(the Green Book) based on research by TNO. An account is 
given by deWeger, Pietersen and Reuzel (1991). 

This work was preceded by the study of probit equations 
for individual species by ten Berge of Dutch State Mines 
(DSM) and Zwart and van Heemst of TNO (ten Berge, 
Zwart and Appelman 1986), to which reference has already 
been made. 

In this methodology a distinction is made between locally 
acting substances and systemically acting substances. 

18.19.1 Locally acting substances 

For a locally acting substance the specific dose D" is 
defined as 

D r ' = D/A [18.19.1] 

where A is the surface area of the lungs (m z ), D is the 
inhaled dose (mg) and D" is the inhaled dose per unit area 
of lung (mg/m 2 ). The dose D is taken as 
D = (Fa/lOOOJCf [18.19.2] 

where C is the concentration of gas in the atmosphere 
(mg/m 3 ), t is the exposure time (min) and V a is the minute 
volume (1/min). From empirical physiological relations 

F a a IF 070 [18.19.3] 

A cx IF 0 92 [18.19.4] 

where IF is the body mass (kg). 

Then from Equations 18.19.2—18.19.4 

D" cx W~ 0 - 22 [18.19.5] 

The body masses of man, the rat and the mouse are 70,0.3 
and 0.03 kg, respectively. It follows then from relation 
18.19.5 that the load on a rat and on a mouse are, respec¬ 
tively, some 3.3 times and 5.5 times that on a man. 

This treatment has not allowed for absorption of gas in 
the air passages. Such absorption hardly occurs in 
humans, but most test animals are nose breathers and 
absorption occurs to a much greater degree. 

There is considerable uncertainty as to whether the same 
dose per unit area of lung has the same effect on humans 
and animals. A safety factor,/, of 5 is applied to allow this. 

18.19.2 Systemically acting substances 

For a systemically acting substance the specific dose D 
is defined as 

Lf=D/W [18.19.6] 

where Lf is the inhaled dose per unit body mass (mg/kg). 
In this case the mass absorbed is proportional to the oxy¬ 
gen consumption rather than the minute volume. Oxygen 
consumption is in turn, a function of body weight, being 
proportional to W 0 ' 7 as in relation 18.19.3. Hence from 
relations 18.19.2,18.19.3 and 18.19.6 


Lf a TF” 0 - 3 [18.19.7] 

Then using the same body masses as before, relation 18.19.7 

tively, some 5.1 times and 10.2 times that on a man. 

There is uncertainty as to whether the same dose per unit 
body mass has the same effect on humans and animals. In 
this case a safety factor,/, of 10 is applied. 

18.19.3 Extrapolation factor 

The foregoing treatment incorporates certain safety fac¬ 
tors, of 5 for locally acting substances and 10 for systemi¬ 
cally acting ones. The dose values apply to inhalation rates 
for persons at rest. A further safety factor of 2 is then 
applied which allows for increased inhalation rates in the 
population during a toxic gas emergency. 

An extrapolation factor f A is now determined for extra¬ 
polation of results from each species to humans. Thus, for 
example, for a rat: 


Load animal 
/ d =Load man 

Safety factor Extrapolation factor 

Local effect 
Systemic effect 

3.3 5x2 0.33 0.25 \ n?[ - 

5.1 10x2 0.26 0.26 J 


The LC 50 value for humans is obtained by multiplying the 
LC 50 value for the test animal by the extrapolation factor. 
Values of the extrapolation factor/ d are as follows: rat, 0.25; 
mouse, 0.5; guinea pig, 0.2; and hamster, 0.3. 

18.19.4 Probit equations 

Probit equations for use in hazard assessment are then 
derived as follows. The basic approach is to assume a value 
for k 2 in Equation 18.11.6 and, if necessary, a default value of 
n, and to determine the constant ki from animal LC 50 data. 

The constant k 2 is assigned a value of 1.0 in all cases. This 
corresponds to a high value of the ratio LC95/LC05, and for 
concentrations below the LC 50 is the conservative 
assumption. For the index n the default value used is 2. 

Then starting from an animal LC50 value for some time t, 
the first step is to obtain the LC 50 for 30 min. This is then 
converted to a 30 -min LC 50 for humans by application of the 
extrapolation factor/ d . 

Where there are data for more than one animal species, a 
further step is taken. This is to obtain the average animal 
30-min LC50 and to multiply it by a factor of 2 before 
applying the extrapolation factor / d to obtain the 30-min 
LC 50 for humans. This has the effect of reducing the overall 
safety factor that is applied. 

The probit equations obtained are considered further in 
Section 18.20. 


18.20 Gas Toxicity: Probit Equations 

As described above, probit equations are available for a 
number of the toxic gases of industrial interest. They 
include in particular the collections given for the Vulner¬ 
ability model by Perry and Articola (1980), in the QRA 
Guidelines by the CCPS (1989/4) and in the Green Book by the 
CPD (1992b). The limitations of probit equations have been 
discussed in Chapter 9 and need not be rehearsed here. 

In addition to the inherent limitations of probit equa¬ 
tions, it is also necessary to consider in each particular case 
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both the situation to which it is intended to apply and the 
degree of conservatism incorporated. The basic data are 
generally obtained from experiments on animals that tend 
to remain passive, but the use of the correlation is pre¬ 
sumably for humans in an emergency situation. In some 
cases the probit equation is explicitly conservative, whilst 
in others it is not, reflecting a difference of philosophy as to 
the point at which any safety factor should be applied. 

Table 18.28 gives the parameters for probit equations for 
industrial toxic gases. 


18.21 Gas Toxicity: HSE Dangerous Dose 

As described in Chapter 9, the HSE use for the purpose of 
land use planning the concept of a ‘dangerous dose’. 

For toxic substances the interpretation of the dangerous 
dose concept and the methodology by which a value is 
derived is described in Assessment of the Toxicity of Major 
Hazard Substances (R.M. Turner and Fairhurst, 1989a). 

The authors discuss the paucity of data on the effect of 
toxic gases on man and the problems of probit equations. 
They propose for land use planning the use not of probit 


equations but of a toxic load value that they call the SLOT. 
This is expressed in the form of an equation for the dan¬ 
gerous toxic load (DTL) and of a set of values for the SLOT 
computed from this relation. 

The SLOT is defined as a value associated with a situa¬ 
tion in which: (1) almost all persons suffer severe distress; 
(2) a substantial fraction require medical attention; (3) some 
persons are seriously injured, requiring prolonged treat¬ 
ment; or (4) any highly susceptible person might be killed. 
Typically the SLOT used corresponds to a mortality of 
1-5%. The SLOT selected depends, however, on the 
substance, and in some cases it may be appropriate to use 
several SLOTs. 

Essentially the SLOT is a criterion for individual risk. 
For societal risk the authors refer to the use of the method 
described by Poblete, Lees and Simpson (1984) and 
extended by Lees, Poblete and Simpson (1986), which is 
described in Chapter 9. 

The methodology described by Turner and Fairhurst for 
the derivation of a SLOT is broadly as follows. Since there is 
a lack of toxicity data for humans, it is necessary to resort 
to the use of data from experiments on animals. The most 


Table 18.28 Parameters in probit equations for lethality for some principal industrial toxic gases 

Substance Probit equation parameters a 


CCPS b CPTf 



h 

k 2 

n 

h 

n 

30-minLC 50 

Acrolein 

-9.931 

2.049 

1 

-4.1 

1.0 

304 

Acrylonitrile 

-29.42 

3.008 

1.43 

-8.6 

1.3 

2533 

Ammonia d 

-35.9 

1.85 

2 

-15.8 

2.0 

6164 

Benzene 6 

-109.78 

5.3 

2 




Bromine 6 

-9.04 

0.92 

2 

-12.4 

2.0 

1075 

Carbon monoxide 6 

-37.98 

3.7 

1 

-7.4 

1.0 

7949 

Carbon tetrachloride 

-6.29 

0.408 

2.5 




Chlorine d 

-8.29 

0.92 

2 

-14.3 

2.3 

1017 

Ethylene oxide 6 

- 

- 

- 

-6.8 

1.0 

4443 

Formaldehyde 6 

-12.24 

1.3 

2 

- 

- 

- 

Hydrogen chloride 

-16.85 

2.0 

1.00 

-6.7 

1.0 

3940 

Hydrogen cyanide 

-29.42 

3.008 

1.43 

-9.8 

2.4 

114 

Hydrogen fluoride 

-35.87 

3.354 

1.00 

-8.4 

1.5 

802 

Hydrogen sulfide 

-31.42 

3.008 

1.43 

-11.5 

1.9 

987 

Methyl bromide 

-56.81 

5.27 

1.00 

-7.3 

1.1 

3135 

Methyl isocynate 6 

-5.642 

1.637 

0.653 

-1.2 

0.7 

57 

Nitrogen dioxide 6 

-13.79 

1.4 

2 

-18.6 

3.7 

235 

Phosgene 

-19.27 

3.686 


-0.8 

0.9 

14 

Propylene oxide 

-7.415 

0.509 

2.00 

- 

- 

- 

Sulfur dioxide 

-15.67 

2.10 

1.00 

-19.2 

2.4 

5784 

Toluene 

-6.794 

0.408 

2.5 

- 

- 

- 

a Both sets of parameters a 

re for toxic gas fata 

lity probit equation 

s of the form 





Y = k i + Mft) 

where t is the time (min). In the CCPS equation (and in those of Perry and Articola (1980)) the units of concentration c are ppm, whilst in the CPD 
equation the units are mg/m 3 . 

b CCPS QRA Guidelines (1989/5). Except as described in (d) and (e) below, these are the values given by Perry and Articola (1980), who discuss the 
derivations. 

c CPD Green book (1992b); deWeger, Pietersen and Reuzel (1991). In all cases £ 2 = 1. 
d Perry and Articola give: 

Ammonia: h = -28.33; k 2 = 2.27; n= 1.36; 

Chlorine: h — —36.45; k 2 — 3.13; n —2.64; 

Hydrogen fluoride: h = -25.87; k 2 = 3.354; n = 1.00. 
e Perry and Articola do not give values for these substances. 
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reliable data generally relate to the LC 50 values and the 
associated exposure times, and it is this that is taken as the 
starting point. Data are gathered for a number of species 
and usually the data adopted are those for the most sensi¬ 
tive species. Next, estimates are made of the LC 50 or LC 0 i 
values. In some cases the data available permit an extra¬ 
polation based on probits. If this is not possible, an alter¬ 
native approach is to use an empirical value of the ratio 
LC50/LC05, or LC50/LC01, as the case may be. 

At this stage, therefore, the method yields a single value 
of the SLOT LC 50 or LC 0 i with an associated exposure time. 
It is then necessary to determine the trade-off between the 
concentration c and the time t, or, in other words, the value 
of the index in the toxic load eft. Essentially this requires 
data on concentration vs time for a given level of effect, such 
as the LC 5 o. The authors warn against the use for this pur¬ 
pose of values from different sets of experiments on dif¬ 
ferent species, since the results may then owe more to 
differences between species than to differences in expo¬ 
sure time. 

The SLOTs obtained are then correlated as a DTL equa¬ 
tion. These SLOTs and the DTL are applicable to an animal 
species. Collateral evidence may then be sought to confirm 
that it is reasonable to apply the relation to humans. 

One feature of this approach is that the use of an LC 50 or 
LC 0 i rather than an LC 50 value means that there is more 
likely to be some data on humans that can be used as col¬ 
lateral evidence. Another feature is that, insofar as the 
animal data used are generally for the most sensitive spe¬ 
cies, the approach may be regarded as conservative. 

The application of this methodology is now illustrated for 
a number of industrial toxic gases. Table 18.29 shows for 
these gases some physico-chemical properties and the 
SLOTand DTL values. Each of the studies described gives a 
table detailing results of single exposure inhalation studies 
in animals and a table of LC 50 values for different species. 

The accounts given below are necessarily brief summa¬ 
ries; the arguments adduced in support of the values 
chosen are much fuller in the original references and these 
should be consulted. 


18.21.1 Acrylonitrile 

The SLOT values for acrylonitrile are derived in Toxicology 
of Substances in Relation to Major Hazards: Acrylonitrile 
(R.M. Turner and Fairhurst, 1989b). The gas has an irritant 
effect. 

The experimental data for animals are sparse and most 
are for long exposures; none were found for exposure peri¬ 
ods of less than 30 min. The more sensitive species were 
dogs, in work by Brieger, Rieders and Hoders (1952), and 
mice, in work by Knobloch et al. (1971). From the data for 
these species the authors derive the single SLOT value of 
40 ppm for 4 h. They do not give a precise interpretation of 
this SLOT, but it would appear to correspond to a value 
of the order of LC 0 5 to LC 0 i. They make use of several 
studies which bear on the relation between concentration 
and time and settle on a value of n = 1. The resultant SLOTs 
and DTL equation are then as given in Table 18.29. 

18.21.2 Ammonia 

The SLOT values for ammonia are derived in Toxicology 
of Substances in Relation to Major Hazards: Ammonia 
(Payne, Delic and Turner, 1990). Ammonia is an irritant gas 
which, being highly soluble, tends to attack the upper 
respiratory tract, causing laryngeal oedema, as well as 
pulmonary oedema. The authors suggest that reported 
cases of laryngeal spasm probably involved laryngeal 
oedema. The essential toxic effect is therefore irritation. 

For ammonia there is a considerable amount of experi¬ 
mental data on animals. The most sensitive species is the 
mouse, but the authors also make some use of data for rats. 
For mice, the work of Silver and McGrath (1948) yields an 
LC 50 of 10,150 ppm for a 10 min exposure and that of 
Kapeghian et al. (1982) an LC 50 of 4230 ppm for a 60 min 
exposure. From work on rats by Appelman, ten Berge and 
Reuzel (1982) a value of the index n = 2 may be obtained. It 
happens that this value of n = 2 is also consistent with the 
two LC50 values just mentioned. Data from these same 
studies were used to estimate values of the LC 0 s and LC 0 i. 
The resultant values for the LC 0 i are 6,129 and 3,296 ppm, 
respectively Adopting the former and utilizing the value of 


Table 18.29 HSE DTL and SLOT values for some principal industrial gases 



Acrylonitrile 

Ammonia 

Chlorine 

Hydrogen 

fluoride 

Hydrogen 

sulfide 

Sulfuric 
acid mist 

MW 

53.06 

17.03 

70.9 

20.0 

34.1 

98.1 

Boiling point (K) 

350.3 

-33.42°C 

328.4 

292.5 

211.2 

563-603 

Freezing point (K) 

189.5 

—77.74° C 

172 

190 

187.5 

283° 

Conversion factor 

2.2 

0.7 

2.9 

0.83 

4.4 


(ppm—mg/m 3 ) a 







DTL 

9600 

3.76 xlO 8 

108,000 

2,400,000 

2xl0 12 

2.16 xlO 5 


ppm min 

ppm 2 min 

ppm 2 min 

ppm 2 min 

ppm 4 min 

(mg/m 3 ) min 

SLOT values (ppm) b 







5 min 

1920 

8670 

147 

693 

800 d 

208 mg/m 3 

10 min 

960 

6130 

100 

490 

669 

147 mg/m 3 

30 min 

320 

3540 

60 

283 

508 

85 mg/m 3 

60 min 

160 

2500 

42 

200 

427 

60 mg/m 3 

120 min 

80 

1770 

30 

141 

359 

42mg/m 3 

240 min 

40 




302 


480 min 






21mg/m 3 


a Conversion factor for vapour at 25°C and pressure 1.0133 x 10 5 Pa, except for hydrogen fluoride for which the conversion is based on 0°C. 
b Units for all gases except for sulfuric acid mist, for which the units are mg/m 3 . 

'Value for 100% acid. 

d Ceiling value for exposure period 0-5 min. 






8/58 TOXIC RELEASE 


n quoted yields the SLOTs and DTL equation given in 
Table 18.29. 

18.21.3 Chlorine 

The SLOT values for chlorine are derived in Toxicology 
of Substances in Relation to Major Hazards: Chlorine 
(R.M. Turner and Fairhurst, 1990a). The gas has an irritant 
effect. 

For chlorine there is a considerable amount of experi¬ 
mental data on animals. The mouse appears the most sen¬ 
sitive species. For mice, the work of Schlagbauer and 
Henschler (1967) gives an LC S o of 127 ppm for a 30 min 
exposure. Data from this study were used to estimate 
values of the LC 0 s and LC 0 i for this exposure time, the 
values obtained being 70 and 56 ppm, respectively. The 
index n is obtained from a critical review of the large vari¬ 
ety of values quoted in the literature, the authors settling 
on n = 2. The resultant SLOTs and DTL equation are then 
as given in Table 18.29. 

The generally conservative nature of the approach taken 
is illustrated in this case. The LC 50 value derived from the 
work of Schlagbauer and Henschler on which the SLOTs are 
based towards the lower end of the range of LC 50 values for 
animals given in the literature. 

18.21.4 Hydrogen fluoride 

The SLOT values for hydrogen fluoride are derived in 
Toxicology of Substances in Relation to Major Hazards: 
Hydrogen Fluoride (R.M. Turner and Fairhurst, 1990b). 

Hydrogen fluoride is an irritant gas, but it also has some 
systemic effects. Whilst there is little information on the 
long-term effects of a single non-lethal exposure, the gen¬ 
eral toxicological properties of the gas point to the pos¬ 
sibility of permanent injury. 

For hydrogen fluoride there is a limited amount of 
experimental data on animals, the most sensitive species 
being the mouse. The work of Wohlslagel, DiPasquale and 
Vernot (1976) gives for mice an LC 50 of 342 ppm for a 60 min 
exposure. Using data from this same study, Timer and 
Fairhurst obtain for the LC 0 s and LC 0 i at this same expo¬ 
sure time values of 230 and 205 ppm, respectively. From 
work on rats by Rosenholtz et al. (1963) they derive a value 
of the index n = 2. This then yields the SLOTs and DTL 
equation given in Table 18.29. 

18.21.5 Hydrogen sulfide 

The SLOT values for hydrogen sulfide are derived in Toxi¬ 
cology of Substances in Relation to Major Hazards: Hydrogen 
Sulphide (R.M. Turner and Fairhurst, 1990c). 

In addition to being an irritant gas hydrogen sulfide also 
causes inhibition of intracellular respiration. The second 
of these effects grows in relative importance as the con¬ 
centration increases. 

For hydrogen sulfide the limited amount of experimental 
data on animals available show reasonable consistency. 
Turner and Fairhurst distinguish several concentration 
regions: 750—100 ppm; 450—750 ppm and 200-350 ppm. 
High concentrations, in the range 750-1000 ppm, cause 
rapid unconsciousness and death within a few minutes. 
The authors therefore take 800 ppm as a ceiling value, 
independent of exposure time. From examination of data on 
a number of species, including work by Prior et al. (1988) 
and Tansy et al. (1981), the authors obtain the following LC 50 
estimates: 300 ppm for 4 h; 400 ppm for 60 min; and 500 
ppm for 30 min. This set of values corresponds to a value of 


the index of n = 4. In the study by Prior et al. for an exposure 
time of 4 hours the LC 50 was 501 ppm and the LCio was 422 
ppm, giving an LC 50 /LCi 0 ratio of 1.19, which was then 
used to obtain the SLOTs. The resultant SLOTs and DTL 
equation are then as given in Table 18.29. 

18.21.6 Sulfuric acid mist 

The SLOT values for sulfuric acid mist are derived in Toxi¬ 
cology of Substances in Relation to Major Hazards: Sulphuric 
Acid Mist (R.M. Turner and Fairhurst, 1992). 

Sulfuric acid mist is an irritant that has two main 
effects. One is constriction of the airways (bronchiocon- 
striction and possibly laryngeal spasm). The other is 
damage to the respiratory tract accompanied by oedema 
and haemorrhage. These toxic effects depend on the size of 
the droplets. 

Sulfuric acid mist is formed from releases of sulfur tri¬ 
oxide or oleum, a mixture of sulfuric acid and sulfur tri¬ 
oxide. On release these react with water in the atmosphere 
and form a dense cloud of mist. The mist is likely to contain 
submicron droplets that remain airborne until they absorb 
additional water and rain out or are deposited onto sur¬ 
faces. In an accident, the size of the droplets inhaled can be 
expected to exceed that on release and the authors assume a 
droplet size of 1 pm. As it happens, this is the size for which 
most of the data are available. 

For sulfuric acid mist the bulk of data on animal experi¬ 
ments relates to guinea pigs. This is also the most sensitive 
species. From the work of Amdur, Schulz and Drinker 
(1952) the authors obtain an estimate of the LC 50 of 
60 mg/m 3 for a 60 min exposure. For the index w Turner and 
Fairhurst use the values of the LC 50 at an 8 h exposure of 
18, 30 and 50 mg/m 3 reported by Amdur, Schulz and 
Drinker andby Wolff e/a/. (1979), and obtain the value n = 2. 
These data form the basis of the SLOTs. There is no explicit 
recourse to LC 0 5 or LC 0 i values, but the LC 50 is that for the 
experiments in which the animals were most sensitive; in 
other work by Treon et al. (1950) and Amdur (1958) no 
deaths were recorded at concentrations up to 42 and 121 
mg/m 3 for an exposure time of 60 min. The resultant SLOTs 
and DTL equation are then as given in Table 18.29. 

18.22 Gas Toxicity: Combustion Gases 

A somewhat separate problem concerns the toxicity of 
combustion products. Much of the research interest in such 
gases centres on the combustion of furnishings, but work 
in this area is also relevant to toxic clouds from combustion 
of materials on plant and in storage, particularly ware¬ 
houses. 

Work on the toxicity of combustion products has been 
described in a number of publications. This includes work 
described in Smoke and Products of Combustion (Hilado, 
1973) and by Hilado and co-workers (Hilado and Furst, 
1976; Hilado, Casey and Furst, 1977; Hilado, Cumming and 
Casey, 1978; Hilado and Cumming, 1978; Hilado and 
Huttlinger, 1980,1981b,c), Hartzell and co-workers (Kaplan 
and Hartzell, 1984; Hartzell, Packham et al., 1985; Hartzell, 
Priest and Switzer, 1985; Hartzell, Stacy et al., 1985; 
Hartzell, 1987, 1989; Hartzell, Grand and Switzer, 1987), 
Underwood (1978), Alexeeff et al. (1986), Tsuchiya and 
Nayaka (1986) and the CPD (1992b). 

The toxicity of combustion products in the context of 
hazard assessment has been considered by D.A. Carter 
(1989), G.T. Atkinson, Jagger and Kirk (1992) and 
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G.T. Atkinson and Jagger (1994). The toxicity of the break¬ 
down products of the fire extinguishant bromochlorodi- 
fluoromethane (BCF) has been studied by Doe et al. (1986). 

18.23 Ultratoxic Substances 

The Seveso disaster in 1976 showed that there is a serious 
hazard from small quantities of ultratoxic substances. At 
Seveso some 2.5 kg of 2,3,7,8 -tetrachlorodibenzoparadioxin 
(TCDD) were released to the atmosphere. Abnormal reac¬ 
tion conditions occurred in a chemical reactor, the pressure 
rose and the relief valve operated. The TCDD was not a 
normal reaction product but the product of a side reaction 
that occurred at an appreciable rate only under abnormal 
conditions. The toxicity of TCDD is such that it is more akin 
to a chemical warfare agent than an industrial chemical 
and it has been called the most poisonous substance in 
existence. The surrounding area was contaminated and 
had to be evacuated. People in the area at the time of the 
incident suffered rashes. But, more seriously, there were 
expected to be long-term carcinogenic, teratogenic and/or 
mutagenic effects. Further details of the Seveso incident 
are given in Appendix 3. 

A further disaster involving a very highly toxic, if not 
ultratoxic, chemical occurred at Bhopal in 1984, where a 
reaction occurred in a storage tank containing methyl iso¬ 
cyanate (MIC), the relief valve lifted and released a cloud of 
the gas onto housing, killing a large number of people, the 
official death toll being now 4,000, but other estimates 
being rather higher. This was much the worst accident 
experienced at a chemical plant. Further details of the 
Bhopal incident are given in Appendix 5. 

18.24 Plant Design for Toxic Substances 

Plants handling toxic substances need to be designed to 
minimize both large accidental releases and fugitive emis¬ 
sions. An overview of the design of plant for the handling of 
toxic substances is given by S.D. Green (1980). He deals 
with: the collection and assessment of toxicological infor¬ 
mation; process reviews covering random leaks and 
intermittent releases; design strategies of substitution, 
prevention and containment; ventilation; separation dis¬ 
tances; and protection measures. 

18.24.1 Design against large releases 

As far as concerns large toxic releases, this is not solely a 
matter of the mechanical design of the plant, important 
though that is. Inherently safer design also has an impor¬ 
tant part to play, in minimizing the effects of any failure 
through the choice of the substances used in the in process 
and the operating conditions. 

The mechanical design of plants, and particularly pres¬ 
sure systems, to high standards of integrity is treated in 
Chapter 12, and is not considered further here. 

18.24.2 Design against fugitive emissions 

There are a number of accounts, both by plant designers 
and occupational hygienists, of the design and operation of 
plant handling toxic substances to counter fugitive emis¬ 
sions and the resultant chronic toxic hazard. These include 
Fugitive Emissions of Vapours from Process Equipment 
(Jones et al., 1984, BOHS TG3), (the BOHS Fugitive Emis¬ 
sions Guide), Health Hazard Control in the Chemical Process 
Industry (Lipton and Lynch, 1987) and Handbook of Health 


Hazard Control in the Chemical Process Industry (Lipton and 
Lynch, 1994) and by Payne (1978), S.D. Green (1980), 
Kusnetz and Phillips (1983), Kusnetz and Lynch (1984), 
Whitehead (1987) and Crowl and Louvar (1990). 

Other potential sources of guidance are design practices 
for chemical plant under vacuum and for nuclear plant. 

Emissions of toxic substances to the atmosphere are not 
confined to continuous leaks from the plant. They also 
occur as a result of operations carried out on the plant, 
particularly those involving purging or breaking into 
equipment for operations or maintenance purposes. The 
design of plants to minimize exposure to toxic substances 
is essentially a two-pronged one, based on the reduction of 
fugitive emissions and the provision of ventilation. 

The problem of fugitive emissions on process plants is 
discussed in Chapter 15. There has been a growing concern 
over the emission of hydrocarbons and of volatile organic 
compounds (VOCs).Two points made there bear reiteration. 
One is that there is considerable variability between plants 
in the levels of emission, and the other that it is possible for 
plants to achieve very low levels of emissions, though as 
always this is easier in the design of a new plant. 

Most of the data on fugitive emissions relate to hydro¬ 
carbons and VOCs. They provide a useful initial indication, 
but in view of the wide differences in the results obtained 
and the rather different nature of the problem in the case of 
toxic materials, care should be exercised in applying them 
to toxic emissions. 

The BOHS Fugitive Emissions Guide provides guidance 
on the main leak sources: flanges and seals, with applica¬ 
tions of the latter on valves, agitators, pumps and 
compressors. 

The topics treated by Lipton and Lynch (1987) are 
(1) occupational health hazards, (2) sources of exposure, 
(3) exposure evaluation, (4) fugitive emissions, (5) hazard 
control, (6) rotating equipment, (7) valves and flanges, 
(8) sampling, and (9) drains, sewers and wastewater 


18.24.3 Ventilation 

Design to minimize fugitive emissions is complemented by 
provision of good ventilation. Ventilation is discussed in 
Chapter 10 in relation to plant layout, and again in Chapter 
25 in relation to occupational hygiene, and is therefore not 
treated at this point. 

18.24.4 Material transfer 

On plants handling toxic materials, transfer systems such 
as pumps are one of the main sources of emissions, which 
can occur either as random leaks or in the course of activ¬ 
ities such as maintenance. An account of this problem and 
measures to deal with it has been given by Grossel (1990a). 

This author considers centrifugal pumps, positive dis¬ 
placement pumps, sealless pumps, jet pumps, pressurized 
gas and vacuum systems. He describes centrifugal pumps 
for toxic-liquids which are fitted with double mechanical 
seals, in double inside or tandem arrangement, and with a 
seal failure alarm. A buffer liquid may be used, which may 
have to be cooled to remove heat or heated to reduce its 
viscosity. A minimum flow bypass is often desirable and 
may need to be provided with a cooler. For a heat sensitive 
toxic liquid it may be necessary to provide the pump with a 
high temperature trip. 

For low flows, positive displacement pumps are fre¬ 
quently used. Diaphragm metering pumps or air-operated 
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diaphragm pumps have no seals and are able to operate at 
low flow without excessive temperature rise. For highly 
toxic liquids, Grossel advises double diaphragm pumps. 
The space between diaphragms can he monitored. For 
rather higher flows use may be made of rotating positive 
displacement pumps such as the gear, vane, lobe or screw 
types, fitted with double mechanical seals or using mag¬ 
netic drives. Positive displacement pumps require pressure 
relief to an external source. Grossel emphasizes the need 
for such external relief even where the pump is equipped 
with an internal relief valve. 

Sealless pumps such as canned pumps and magnetic 
drive pumps are another option, but these also are not 
without problems. One weak point may be the shell, which 
may be relatively thin so as not to impede the magnetic 
field. Another may be the bearings which are lubricated by 
the pumped fluid. Failure of a bearing can cause the rotor to 
rub against the can and rupture it. Manufacturers offer 
various arrangements to overcome these problems, such as 
secondary containment with monitoring of the intervening 
space or monitoring of the bearings. Operating problems 
include flashing of low-boiling liquids, dry running and 
blockage by solids. 

Grossel also gives details of systems for transfer by 
pressurized gas or by vacuum, and discuss other aspects 
such as plant layout, equipment installation, remotely 
operated isolation valves and ventilation hoods. 

18.25 Toxic Gas Detection 

A release of toxic gas may be detected by the visual 
appearance of the cloud, by its odour or by instrumenta¬ 
tion. Detection by these means is discussed in the Vapor 
Release Mitigation Guidelines (CCPS, 1988/3). 

18.25.1 Colour 

Some gases have a characteristic colour. Chlorine gives a 
gas cloud of greenish-yellow colour, bromine one of 
reddish-orange colour, and so on. Even if there is no such 
colour, the gas may well form a visible fog. Some gases tend 
to form a fog by taking up moisture from the air to form an 
aerosol. Such gases include ammonia, hydrogen chloride, 
hydrogen fluoride and sulfur trioxide. Liquefied gases 
such as Liquefied natural gas (LNG), liquefied petroleum 
gas (LPG), liquid ethylene and liquid ammonia cause water 
in the atmosphere to condense and create a fog. 

18.25.2 Odour 

Many gases give a characteristic odour. The concentrations 
at which such an odour is detectable vary by orders of 
magnitude. 

Accounts of odour are given in Human Responses to 
Environmental Odors (Turk, Johnston and Moulton, 1974), 
Industrial Odor Technology and Assessment (Cheremisinoff 
and Young, 1975), The Identification and Measurement of 
Refinery Odours (CONCAWE, 1975 8/75), Compilation of 
Odor and Taste Threshold Values Data (Fazzalari, 1978), The 
Perception of Odors (Eugen, 1982) and Odor Thresholds for 
Chemicals with Established Occupational Standards (AIHA, 
1989/17), and by Leonardos, Kendall and Barnard (1969), 
Amoore and Hautala (1983), Polak (1983), Lynskey (1984 
LPB 60) and J.C. Stevens, Cain and Weinstein (1987). 
Odours are also discussed in Appendix 11. 

Some odour thresholds (OTk) are very low indeed. The 
threshold for hydrogen sulfide is given in the CONCAWE 


document as 0.001-0.014 ppm and in the CCPS Guidelines 
as 0.0002 ppm. The latter give data on the relation between 
the OT and the immediately dangerous to life and health 
(IDLH) limit. These include the following: 


Gas 

OT (ppm) 

IDLH (ppm) 

IDLH/OT 

Carbon monoxide 

(none) 

1500 

N/A 

Phosgene 

0.47 

2 

4.3 

Ammonia 

21 

500 

25 

Chlorine 

0.31 

25 

80 

Hydrogen sulfide 

0.0002 

300 

1,500,000 


In some cases a person can become desensitized to an 
odour. The classic case is hydrogen sulfide. This is dis¬ 
cussed in Section 18.16. 

18.25.3 Instrumentation 

In some cases it is appropriate to install toxic gas detectors. 
Accounts of toxic gas detectors and detection are given in 
Detection and Measurement of Hazardous Gases (Cullis and 
Firth, 1981) and by Dailey (1976), Johanson (1976), Warncke 
(1977), Lichtenberg and McKerlie (1979), Harbert (1983, 
1984), Krigman (1984), Zanetti (1986b) and Atallah and 
Guzman (1987). 

Whereas much flammable gas detection is based on 
combustible gas detectors, toxic gas detection tends to uti¬ 
lize a wider variety of detectors, corresponding to the 
variety of toxic gases. Some principles of operation in the 
sensors used include (1) hot wire combustion, (2) catalytic 
combustion or reaction, (3) some other chemical reaction, 
(4) electrical effects, and (5) absorption and scattering 
effects. Use is also be made of closed circuit TV monitors. 
Details of sensors and their response times are given in the 
CCPS Guidelines. 

The purpose of a toxic gas detection system should be 
clearly defined. One purpose may be to give a rapid warn¬ 
ing of a major release. Another may be to detect fugitive 
emissions of a toxic gas for occupational hygiene purposes. 
It is the former that is considered at this point. 

In locating the detectors there is a choice between moni¬ 
toring specific potential leak sources and giving good area 
coverage. For the monitoring of a leak source Johanson 
(1976) suggests an angular separation between detectors of 
10° and a separation between detectors of no more than 
30 ft (10 m). He recommends detector heights of 1.5 ft (0.5 m) 
and of 6-8 ft (2-2.5 m) for buoyant gases. 

The CCPS Guidelines emphasize that a toxic gas detec¬ 
tion system with an insufficient number of detectors or 
inadequate maintenance may be worse than no system at 
all, particularly if it leads to less human surveillance or to 
confusion arising because a field report of a leak is not 
confirmed by the detection system. 

Guidance is available on gas detection systems for spe¬ 
cific toxic gases. For chlorine information is given in the 
Chlorine Manual (Chlorine Institute, 1986 Pmphlt 1). The 
monitoring of ammonia is discussed by Lichtenberg and 
McKerlie (1979). 

18.26 Toxic Release Response 

Essentially the control of the toxic release hazard means, 
on the one hand, the prevention of serious loss of contain¬ 
ment and, on the other, the elimination of hazardous 
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concentrations in the environment. There are also the 
intermediate problems of dealing with small quantities of 
toxic materials arising mainly from leaks and spillages and 
from maintenance operations. 

Aspects of the process and plant design and of the stor¬ 
age and transport of toxic chemicals are described in 
Chapters 11,12, 22 and 23, respectively. Another aspect is 
planning for toxic emergencies, which is described in 
Chapter 24. The assessment of the hazard of large toxic 
releases is dealt with in Sections 18.28—31. 

Elimination of hazardous concentrations in the working 
environment requires assessment of leaks and other 
sources of toxic substances. Engineering measures can 
then be taken to improve the leak-tightness of plant. 

It is also necessary to have ventilation and monitoring of 
the atmosphere and medical checks on personnel. These 
latter aspects comprise industrial hygiene and are dis¬ 
cussed in Chapter 25. 

In addition, there should be procedures for the handling 
of abnormal leaks and spillages. 

18.26.1 Leaks and spillages 

If the plant is in the open, small leakages from the plant 
may be dispersed by the wind. If the plant is in a building, 
mechanical ventilation is necessary. The toxic hazard 
should be a principal consideration in deciding whether to 
put a plant in a building or in the open. 

Provision should be made for handling larger emissions. 
It may be necessary to have emergency isolation valves and 
relief, blowdown and gas absorption facilities in order to 
reduce the amount likely to escape. 

Methods of dealing with liquid spillages vary with the 
chemical concerned. Thus, for example, the treatments 
recommended in the respective codes are different for 
chlorine and for phosgene. In both cases the principle 
applies of restricting by containment the area available for 
evaporation. But, whereas the evaporation of chlorine can 
be reduced by applying mechanically produced water- 
based protein foam, this should not be utilized for phos¬ 
gene, for which the use of kerosene impregnated with dry 
sawdust is suggested. 

In dealing with spillages, actions should be avoided 
which actually increase the rate of evaporation. For exam¬ 
ple, water should not he sprayed on a chlorine spillage. In 
contrast, a spillage of ethylene oxide, which is miscible 
with water, may be diluted and rendered more safe by the 
addition of large quantities of water. Restricted amounts of 
water, however, may only serve to increase the vaporization. 

The handling of toxic liquids spilled into bunds, and the 
use of foams, is considered in more detail in Chapter 15. 

18.26.2 Emergency action 

The effect of a large toxic release can be greatly mitigated if 
the people exposed take the right action. In plant handling 
toxic materials workers have protective buildings and 
equipment and are trained in emergency procedures. It is 
commonly considered that, provided these precautions are 
taken, workers in the factory itself are at no more risk than 
members of the public. 

In order to prepare instructions to be issued to the public 
in the event of a large release, it is necessary to decide 
whether it is safer for a person to flee from the gas cloud or 
to stay indoors taking measures to prevent ingress of the 
chemical. Methods are available for the calculation of the 


rate at which a toxic gas diffuses into buildings. An account 
of these methods was given in Chapter 15. 

The usual practice in assessing a toxic release hazard is 
to consider a range of scenarios. For some scenarios the 
best course of action may be to evacuate, while for others it 
may be to stay indoors. It should be borne in mind, however, 
that any instruction to be issued to the public should be 
simple and clear. In most cases the preferred advice to the 
public is to stay indoors and shut doors and windows. 

Emergency procedures for toxic releases are treated in 
more detail in Chapters 20 and 24. 

18.27 Toxic Release Case Histories 

By far the worst accident in the history of the process 
industries occurred on 3 December 1984 at Bhopal, where 
water entered a storage tank of methyl isocyanate, causing 
overheating and release of methyl isocyanate vapour which 
spread over a shanty town close to the works and killed 
some 4000 people.This incident is described in Appendix 5. 

There have been a number of major accidents involving 
chlorine. A list of major chlorine accidents worldwide has 
been given by Simmons, Erdmann and Naft (1974) and is 
reproduced in Table 18.30. Another list of chlorine accidents 
has been given by VC. Marshall (1977b) and is shown in 
Table 18.31. 

In 1939, failure of a chlorine storage tank at Zarnesti, 
Romania, resulted in the death of about 60 people. This is 
the largest death toll from any industrial chlorine accident. 

As the tables show, tank failures were also the cause of 
two other major chlorine accidents: at St. Auban, France, in 
1926, for which the death toll is given variously as 19 and 40; 
and at Rauma, Finland, in 1947, where 19 died. 

An explosion in a rail tank car at Mjodalen on 26 January 
1940 resulted in a chlorine release of 7-8 te and caused the 
gassing of 85 people, of whom three died (Romcke and 
Evensen, 1940; Hoveid, 1966). 

A large release of chlorine occurred at Baton Rouge, 
Louisiana, on 10 December 1976 (Case History A79), which 
the Second Report of the ACMH (Harvey, 1979b) described 
at the time as believed to be the largest civil chlorine release 
recorded. An explosion occurred which is thought to have 
dislodged a chlorine tank and caused it to fall on a pro¬ 
truding object and to puncture. Approximately 90 te of 
chlorine escaped, but there were no deaths. 

Another smaller but more lethal chlorine release occurred 
from a derailed rail tank car at Youngstown, Florida, on 26 
February1978 (Case HistoryA94). Seven people were killed. 

Another large release of chlorine occurred on 1 August 
1981 when a train derailment near Montana, Mexico (Case 
History A100), resulted in the rupture of two 55 te chlorine 
tankers. The gas spread through a narrow valley and 
caused the deaths of 17 people. 

A derailment of a chlorine train at La Barre, Louisiana, 
on 31 January 1961 (Case HistoryA29) gave rise to a release 
of chlorine. There was a house occupied by a family only 
50 yd from the crashed chlorine rail tank car. A child taken 
out of doors died, but an infant who remained in the 
house survived. The incident is of interest, therefore, in 
relation to the protection provided by buildings. 

There have also been a number of non-fatal chlorine 
releases. The chlorine accidents at Cornwall, Ontario, in 
1962, at Philadelphia, Pennsylvania, in 1963, and at Los 
Angeles, California, in 1966, resulted in the gassing, but 
not the deaths, of quite large numbers of people. 
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Table 18.30 Significant chlorine accidents (after Simmons, Erdmann and Naft, 1974) (Courtesy of the American Institute 
of Chemical Engineers) 


Date 

Location 

Chlorine 
release (ton) 

Fatalities 

Comments 

Storage tanks 

1926 Dec. 13 

St. Auban, France 

25 

19 

Tank burst 

1929 May 10 

Syracuse, NY 

25 

1 

Tank burst, H 2 -C1 2 explosion 

1939 Dec. 24 

Zarnesti, Roumania 

25 

c. 60 

Tank burst 

1947 Nov. 5 

Rauma, Finland 

30 

19 

Tank burst from overfilling 

1952 Apr. 4 

Wilsum, Germany 

15 

7 

Tank failed (a converted old boiler) 

Barges 

1960 Apr. 13 



1 

Loading hose ruptured 

1961 Feb. 23 

- 

0 


Wychem 112 sinking, no leak 

1965 Sep. 12 

Nr. Baton Rouge, LA 

0 


Sunk during Hurricane Betsy, no leak 

1970 Jul. 28 

- 


1 

Unloading pump break 

1972 Mar. 19 

Nr. Louisville, KY 

0 


Broke from tow and rested 

Rail tank cars 

1934 Feb. 28 

Niagara Falls, NY 

16 


on dam, no leak 

Anchor failure 

1935 Mar. 13 

Griffith, IN 

30 


Anchor failure 

1947 Feb. 4 

Chicago, IL 

18 


Release caused by heat from fire 

1961 Jan. 31 

La Barre, LA 

30 

1(114 ‘gassed’) 

Train wreck, tank punctured 

1962 Nov. 30 

Cornwall, Ont. 

30 

(89 gassed) 

Anchor failure 

1963 Apr. 28 

Brandtsville, PA 

9 


Valves sheared off in wreck 

1963 Aug. 9 

Philadelphia, PA 


(430+ gassed) 

Loading line broken when tank 

1967 Nov. 8 

Newton, AL 

55 


was rammed 

Tank punctured in wreck 

Truck tanks 

No significant accidents 
1-ton containers 

1928 Jul. 7 

1928 Jul. 13 

1969 May 8 

Asbokan, NY 
Asbokan, NY 
Cleveland, OH 


2 

Exploded, contamination with NCI3 
Exploded, contamination with NC1 3 

Pipelines 

1936 Nov. 12 

Johnsonburg, PA 

3 

1 

Transfer line broken by housing 

1949 Sep. 1 

Freeport,TX 

5 


8 in. line burned in attempted welding 

1964 Jul. 12 

Mobile, AL 


1 

- 

Cylinders 

1920 

Niagara Falls, NY 


3 

150 lb cylinder burst 

1925 

De Noya, OK 


1 

Suckback of gasoline 

1947 Jan. 13 

Natrium, VA 


2 

150 lb cylinder exploded 

1954 Jun. 25 

Montreal, Quebec 


1 

Cylinder fell into hold of steamship 


Three chlorine releases from pipelines at Dominguez, 
California, in 1966 and 1967, are recorded by Solomon, 
Rubin and Okrent (1976). In each instance the amount of 
chlorine released was 500 lb. In one case the pipe was 
accidentally cut by a welder, in the other two it was acci¬ 
dentally dug up. 

The release of 100 lb of chlorine from a cylinder into the 
subway system of Brooklyn, New York, in 1944, which is 
described by Chasis etal. (1947), resulted in the gassing, but 
not the deaths, of 208 people. It illustrates the effect of an 
escape in a confined space. 

Another chemical that presents a serious toxic 
release hazard is ammonia. A list of ammonia accidents 
has been given by V.C. Marshall (1977b), as shown in 
Table 18.31. 


A road tanker crash that released ammonia at Lieven, 
France, in 1968 resulted in five deaths (Medard, 1970), and 
an ammonia release from a crashed rail tank car at Crete, 
Nebraska, in 1969 killed eight people. 

There was a release of 160 ton of ammonia from a storage 
tank at Blair, Nebraska, in 1970 (Case History A47), but 
there were no casualties. 

The ammonia accident at Potchefstroom, South Africa, 
on 13 July 1973 (Case History A65), in which 18 people were 
killed when an ammonia storage tank failed and released 
an estimated 39 ton, appears to be the worst accident 
involving ammonia for which details are available. 

In 1976, a road tanker crashed on the Southwest Freeway, 
Houston, Texas (Case History A84), and released 19 te of 
ammonia which killed six people. 
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Table 18.31 Some data on the relation between size of toxic release and number of fatalities (after 


V.C. Marshall, 1977b) (Courtesy of the Institution of Chemical Engineers) 



Date 

Location 

Equipment 

Material released (t) 

Fatalities 

Mortality 
index (deaths/t) 

Chlorine 

1947 Nov. 5 

Rauma, Finland 


30 

19 

0.63 

1939 Dec. 24 

Zarnesti, Roumania 


25 

c.60 

c.2.40 

1926 Dec. 13 

St. Auban, France 


25 

40 a 

1.60 

1929 May 10 

Syracuse, NY 


22.5 

1 

0.004 

1952 Apr. 4 

Wilsum, Germany 

Storage tank 

15 

7 

0.46 

1917 

Wyandotte, MI 


13.6 


0.073 

1956 Mar. 10 

Lake Charles, LA 


2.7 

0 

0 

1967 Nov. 8 b 

Newton, AL 


50 c 

0 

0 

1935 Mar. 13 

Griffith, IN 


27.5 C 

0 

0 

1961 Jan. 31 

La Barre, LA 


27.5 C 

1 

0.036 

1962 Nov. 30 

Cornwall, Ont. 


27.5 C 

0 

0 

1947 Feb. 4 

Chicago, IL 


16.3 C 

0 

0 

1973 Mar. 5 

Loos, BC 


15.5 

0 

0 

1934 Feb. 28 

Niagara Falls, NY 


14.5 C 

0 

0 

1963 Apr. 28 

Brandtsville, PA 

Rail tank car 

8 C 

0 

0 

1940 Jan. 26 

Mjodalen, Norway 


8 

3 

0.375 

1914? 

Chrome, NJ 


7 

0 

0 

1966 Jun. 14 

La Spezia, Italy 


7 

0 

0 

1957 Oct. 19 

Runcorn, UK 


2-3 

0 

0 

1928 Jul. 7,13 

Asbokan, NY 


2 

0 

0 

1950 Jul. 20 

Billingham, UK ' 


0.5 

0 

0 

1969 May 8 b 

Cleveland, OH \ 

, Two 1-ton containers 

1 

1 

1 

1961 Feb. 23 

Billingham, UK 


12 

0 

0 

1949 Sep. l b 

Freeport,TX 

l 

5 

0 

0 

1936 Nov. 12 b 

Johnsonburg, PA 1 

[ Pipeline 

3 

1 

0.33 

1970 Oct. 19 

Javle, Sweden 1 

1 

2 

0 

0 

1920 

Niagara Falls, NY 


0.066 

3 

45 

1947 Jan. 13 

Natrium,WV 1 

| 

0.066 

2 

30 

1925 

De Noya, OK 

> Cylinder 

0.066 

2 

30 

1954 Jun. 25 

Montreal, Canada J 

1 

0.066 

1 

15 

Total of 30 incidents 



271 

142 


Mean of 30 incidents 



9.03 

4.73 

0.52 

Ammonia 

1970 Nov. 16 

Blair, NE J 


145 

0? 

0? 

1973 Jul. 13 

Potchefstroom, SA J 

^ Storage tank 

38 

18 

0.71 

1969 Feb. 18 

Crete, NE J 


64 

6 

0.094 

1968 Aug. 21 

Lievin, France J 

Rail tank car 

15? 

5 

0.33? 

1971 Jun. 5 

Floral, AR J 


570 

0 

0 

1973 Dec. 6 

Kansas City, d KS J 

^ Pipeline 

210 

0 

0 

Total of 6 incidents 



1042 

29 


Mean of 6 incidents 



173 

4.83 

0.027 

Phosgene 

1928 May 20 

Hamburg, Germany 

Storage tank 

10? 

10 

1.0? 


a This value differs from that given by Simmons, Erdmann and Naft (1974). 
b The date quoted in the original reference has been corrected (F.P.L.). 
c This value is about 10% less than that given by Simmons, Erdmann and Naft (1974). 
d This incident is referred to elsewhere in this book as McPherson, Kansas. 


An ammonia release at Cartegena, Columbia, in 1977, is 
reported to have caused a death toll which is now set at 21 
(MH AP, 1988). This is the largest number of deaths from an 
industrial ammonia accident. 

On 20 March 1989 a refrigerated atmospheric ammo¬ 
nia storage tank containing some 7,000 te of liquid 
ammonia failed at Jonova, Lithuania (Case History 128). 


The ammonia ignited and an ammonium nitrate storage 
caught fire. It is estimated that some 1400 te of ammonia 
evaporated and that a further 700 te of ammonia and 
nitrous fumes participated in the toxic fire plume. The 
plume is described as spreading some 35 km and 
affecting an area of some 400 knr. Seven people were 
killed. 








8/64 TOXIC RELEASE 


There have also been a number of non-fatal releases of 
ammonia. A release of about 600 ton of ammonia occurred 
from a pipeline in Floral, Arkansas, in 1971 (Chementator, 
1971 Jul. 26,55). There was a fish kill, but no injuries. There 
was an escape of some 230 ton of ammonia on a pipeline at 
McPherson, Kansas (Case History A64), in 1973. 

Further incidents involving ammonia release are related 
by Slot (1938), Caplin (1941) and Trotter (1983). Other 
accounts are referenced by Payne, Delic and Turner (1990). 

In general, the recorded releases of ammonia usually 
involve larger quantities than those of chlorine, but are not 
more lethal. As Table 18.31 shows, there are a number of 
recorded ammonia releases in excess of 100 te. 

The toxicity of ammonia is appreciably less than that of 
chlorine and, although it behaves on release as a heavy gas, 
it has a molecular weight (MW 17), less than that of air, 
which eventually aids dispersion. 

Some other major toxic release accidents include those 
tabulated below: 


Date 

Location 

Chemical 

Deaths/injuries 

1928 

Hamburg, 

Germany 

Phosgene 

10 d 

1930 

Liittich, 

Belgium 

Hydrogen 
fluoride, 
sulfur dioxide 

63 d 

1950 

Poza Rica, 
Mexico 

Hydrogen 

sulfide 

22 d, 320 i 

1978 

Chicago, IL 

Hydrogen 

sulfide 

8d, 29 i 


The phosgene release in Hamburg in 1928 (Case History 
A6) was due to a pressure vessel failure. It caused the gas¬ 
sing of some 300 people and resulted in 10 deaths. 

A gassing incident involving hydrogen sulfide at Poza 
Rica, Mexico, in 1950, is described by McCabe and Clayton 
(1952). There are numerous accounts of lesser hydrogen 
sulfide gassing incidents, including those by Haldane 
(1896), Poda (1966) and Burnett etal. (1977). Other accounts 
are referenced by R.M. Turner and Fairhurst (1990). 

There have also been several fire incidents, described by 
the MHAP (1993), in which significant quantities of phos¬ 
gene are said to have been generated. More generally, large 
fires are a source of toxic products. A fire in a fertilizer 
warehouse at Nantes in 1987 led to the evacuation of some 
40,000 people (Pietersen, 1988b). The decision to evacuate 
was made on the basis of one measurement, taken inside a 
car, and may well have been unnecessary. 

A even larger evacuation was that at Mississauga, 
Toronto, in 1979 (Case History 97), when a holed chlorine 
rail tank car led to an extended emergency in which some 
215,000 people were evacuated. This incident is also 
described in Chapter 24. 

Another major evacuation occurred at Glendora, 
Mississippi, in 1969 (Case History A43), where a ruptured 
rail tank car of VCM caused some 30,000 people to be 
evacuated. 

In some cases the material release is flammable as well as 
toxic. The ignition of the ammonia release at Jonova has 
already been described. Another case where a toxic release 
was ignited occurred at Nuremburg in 1980, when vinyl 
chloride issuing from a large hole in a derailed rail tank car 
found a source of ignition within seconds (Ernst, 1983). 


Another type of toxic incident is the release of an ultra¬ 
toxic substance, such as TCDD. Case histories involving 
TCDD are given in Appendix 3 on Seveso in 1976. 

18.28 Toxic Release Risk 

18.28.1 Historical experience 

Only a small proportion of the major accidents listed in the 
loss prevention literature are toxic releases. Many toxic 
releases disperse rapidly, causing relatively few casualties. 

In general, for all three major hazards - fire, explosion 
and toxic release - the large number of fatalities given by 
some theoretical estimates, assuming the most unfavour¬ 
able and improbable circumstances and using models 
which may prove to be based on pessimistic assumptions, 
has been in contrast with the small number of fatalities 
shown by the historical record. Until 1984, this discrepancy 
was particularly striking for toxic releases. However, in 
that year the disaster at Bhopal demonstrated that, very 
rarely, an event occurs which gives some credence to the 
more pessimistic estimates. 

Of the incidents described in Section 18.27, the worst 
accidents for particular major industrial toxic gases 
have been: 


No. of deaths 

Bhopal 

Methyl isocyanate 

c.4000 

Liittich 

Hydrogen fluoride, 
sulfur dioxide 

63 

Zarnesti 

Chlorine 

60 

Poza Rica 

Hydrogen sulfide 

22 

Cartegena 

Ammonia 

21 

Hamburg 

Phosgene 

10 


Prior to Bhopal, the most serious toxic incidents involved 
mainly chlorine and or/ammonia. 

Analysis of chlorine incidents has indicated that, with 
one exception, fatalities occur within about 400 m of the 
release, and generally within 250 m (MHAP, 1987). 

In the United Kingdom there have been very few fatal 
accidents in chlorine factories and, as far as is known, none 
to the public, if such accidents as those arising from misuse 
of chemicals such as sodium hypochlorite are excluded. 

The relation between the size of toxic release and 
the number of people killed has been investigated by 
VC. Marshall (1977b), who has developed a mortality 
index (deaths/te) for toxic releases similar to that for 
explosions described in Chapter 17. 

The list of toxic accidents given by V.C. Marshall (1977b), 
which is similar to but not identical with that given by 
Simmons, Erdmann and Naft (1974) and which also 
includes ammonia and phosgene accidents, has been given 
in Table 18.31. The table shows the number of fatalities and 
the mortality index. 

In addition to the overall mortality index for chlorine, 
which is given inTable 18.31 as 0.52, the mortality index for 
chlorine storage tanks is also of interest. The value 
obtained for this from the incidents listed in Table 18.31 
is 0.96. 

Some values of the mortality index from the table are 
plotted in Figure 18.10. This figure may be compared with 
Figure 17.133, which gives a mortality index for explosions; 
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the broken line in Figure 18.10 is that given for explosions in 
Figure 17.133. 

Of these industrial releases those from cylinders tend to 
have a high mortality index. The amount of gas released is 
generally small, but the release probably often occurs in a 
building. A few deaths from such a release are sufficient to 
give a high value of the index. 

It should be emphasized, however, that whereas in the 
case of explosions there is a well-established relationship 
between the quantity of material and the explosion over¬ 
pressure from which lethal effects can be estimated, there is 
at present no such relation for toxic releases. 


18.28.2 Hazard assessment 

The alternative approach to the determination of the risk 
from a large toxic release is the use of hazard assessment 
involving assumed scenarios of release and with appro¬ 
priate estimates of emission, dispersion and toxic effects. 
The hazard assessment may be generic or may address a 
particular situation, whether at a fixed site or in transport. 

The largest number of hazard assessment studies has 
been done for chlorine. A large chlorine release has gen¬ 
erally been regarded as one of the most serious hazards. 
The following account deals principally with chlorine, but 
some mention is made of other toxic substances, notably 
the other main toxic gas, ammonia. 


Some early generic studies were those by Howerton (n.d., 
1969) and Simmons, Erdmann and Naft (1974) on chlorine; 
Eisenberg, Lynch and Breeding (1975) on the vulnerability 
model on chlorine and ammonia; and Solomon, Rubin and 
Okrent (1976) on a variety of chemicals. 

These studies had a number of features that would now 
be regarded as inappropriate. They generally made very 
pessimistic assumptions, as the authors emphasize. Two 
points may be noted in particular. Some of the release rates 
assumed are extraordinarily high, and in most cases no 
credit is given for mitigation. In addition, the studies used 
passive gas dispersion models. 

Studies were also made for specific situations. These 
include a study of chlorine releases from a factory by 
Dicken (1974,1975) and Sellers (1976) and a study of the 
modes of transport for chlorine by Westbrook (1974). 

The next stage in hazard assessment of toxic releases is 
exemplified by the two Canvey Reports (HSE, 1978b, 
1981a) and the Rijnmond Report (Rijnmond Public 
Authority, 1982). The Canvey Reports gave hazard assess¬ 
ments for ammonia and hydrogen fluoride, and the 
Rijnmond Report for acrylonitrile, ammonia, chlorine, and 
hydrogen sulfide, from a hydrodesulfurizer. These reports 
are described in Appendices 7 and 8, respectively. These 
studies are characterized by a more detailed treatment of 
the emission scenarios and flows, the use of heavy gas 
dispersion models and, to some extent, an allowance for 



Figure 18.10 Mortality index for Releases (after V.C. Marshall, 1977b) (Courtesy of the Institution of 
Chemical Engineers) 
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mitigating factors. Subsequent work on the hazard 
assessment of toxic releases has generally retained 
the basic approach, but has significantly refined the 
methodology. 

A further stage is the hazard assessment of toxic gases is 
the work described in the ACDS Transport Hazards Report 
(1991), which covers chlorine and ammonia and which is 
described in Chapter 23 and Appendix 17. 

Accounts are given in Sections 18.29 and 18.30 of some of 
the hazard assessments just mentioned and in Section 
18.31 of developments in the methodology. These should be 
taken in conjunction with the accounts in the Canvey 
Reports, the Rijnmond Report and the ACDS Transport 
Hazards Report. 


18.29 Chlorine Hazard Assessment 

18.29.1 Fixed installations 

A major study of the assessment and control of the hazard 
of chlorine release from a large chlorine factory in the 
United Kingdom has been described by Dicken (1974,1975), 
Sellers (1976) and Hewitt (1976). The chlorine factory con¬ 
cerned is shown in outline in Figure 18.11. It includes cell- 
rooms, compression plant, liquefaction plant, gas 
absorption plant and distribution to user plants. The study 
falls into three parts: the development of risk criteria, the 
assessment of the hazards and the recommendations for 
improvements. 

Four categories of hazard were defined. Category 0 
involves no nuisance to the public, whereas Categories I-III 
do involve such a risk. Category I is the least serious and 
constitutes a nuisance to the public, but no more. Category 
II is a more severe release that could cause distress to people 
and damage to vegetation, and could give rise to claims for 


compensation. Category III is a major emission which, in 
addition, could result in injury or loss of life.The maximum 
frequencies suggested for events in Categories I and II were 
once in 1 and 10 years, respectively. A Category III release 
was considered acceptable once in 100 years, which was 
estimated to be roughly equivalent to a risk to the public of 
10 _7 /year per person. 

Information on the toxicity of chlorine was studied and 
the relations between toxicity and exposure shown in 
Figure 18.12 were produced. The hazard categories were 
then defined more closely in terms of the toxic effects and 
the relations shown in Figure 18.13 were derived. 

In assessing the effects of toxic substances, considera¬ 
tion needs to be given to members of the public who may be 
more susceptible than the average adult worker. Some 
relevant data quoted by Hewitt (1976) in this study were 
given in Table 9.22. 

The historical data on chlorine releases throughout the 
works were also collected. These are shown in Table 18.32. 
Using these data as a guide, the works was divided into 
some 23 units and each unit was allocated a proportion of 
the target level of risk for the whole works. This allocation 
is shown in Table 18.33. Three two-man teams were then set 
up to study the 23 units, using in particular the hazard 
and operability study method. 

With the situations leading to release thus identified, 
quantitative assessments were made of the frequency, size 
and effect of such releases. Estimates of frequency were 
based on reliability calculations and data, those on size on 
emission calculations, and those on effects on dispersion 
calculations, and toxicity data. These methods have been 
described in Chapters 7—9 and 15. 

Extensive gas dispersion calculations were carried 
out using a specially developed computer program. The 



Figure 18.11 Chlorine production, liquefaction and distribution system (Dicken, 1974) (Courtesy of the Electrochemical 
Society) 
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Figure 18.12 Effects of exposure to different 
concentrations of chlorine vapour (Dicken, 1974) (Courtesy 
of the Electrochemical Society) 



Figure 18.13 Categories of chlorine release (Dicken, 
1974) (Courtesy of the Electrochemical Society) 


dispersion equation quoted is that formulated by Pasquill 
(1961) and used by Bryant (1964 UKAEA AHSB(RP) R42): 


with 

F = exp( -2.303# 2 /fe 2 ) [18.29.2] 

where C is the ground level concentration on the axis of the 
plume (m 3 /m 3 ), d is the downwind distance (m), F is the 
stack correction factor, h is the vertical spread of the plume 
at distance d (m), His the effective height of the stack (m), Q 
is the gas release rate (m 3 /s), u is the wind speed (m/s); and 
9 is the lateral spread of the plume (°). The lateral spread 6 
and the vertical spread h are both functions of the atmos¬ 
pheric stability. Equation 18.29.1 is discussed in more detail 
in Chapter 15. 

It is also stated that both instantaneous and continuous 
releases were studied. For a given emission point the investi¬ 
gation covered 18 wind directions, 6 wind speeds and 6 stabil¬ 
ity categories, making 648 permutations. Other factors taken 
into account were plume rise from the stack (where applic¬ 
able), downwash from neighbouring buildings and multi¬ 
point sources such as ventilation ducts on the cellroom roof. 

For a given emission situation and one permutation of 
weather conditions the maximum concentration at or out¬ 
side the works boundary was computed and converted to a 
hazard of Category 0,1, II or III. From all the permutations 
the probabilities of hazards in the different categories were 
determined. Some examples of the results obtained are 
given in Table 18.34. 

The validity of the assessment procedure was checked 
by comparison with historical data. Normally the ratio of 
the predicted to the observed frequency of release was in 
the range 1-2. 

The study made recommendations for improvements 
both of hardware and of software, although not all proved 
practical. Some £1 m capital was spent, of which about a 
third was on the emergency absorption plant. 

Hardware changes included the installation of additional 
equipment, such as stand-by power supplies or duplicate 
pumps, and of extra instrumentation. The availability of 
the equipment has sometimes been poor. Changes in soft¬ 
ware covered areas such as operating instructions and 
inspection and test methods. It is claimed that the work has 
resulted in a 40% reduction in the number of chlorine 


Table 18.32 Chlorine releases at a major works in the UK - period 1966-70 
(Dicken, 1974) 

Source 

(%) 

Prime cause 

(%) 

Chlorine cellroom 

15 

Instrument/control failure 

17 

Dechlorination of brine 

13 

Human error 

12 

Hypochlorite tower 

12 

Machine failure 

9 

Tail gas treatment plant 

11 

Leaks 

8 

Drains 

10 

Maintenance / start-up 

6 

Chlorinated organic plants 

7 

Service failure 

5 

Chlorine filling/loading 

6 

Miscellaneous 

18 

Cell gas treatment plant 

6 

Unknown/not recorded 

25 

Others 

20 




Source: Originally presented at the 145th Spring Meeting of the Electrochemical Society in San Francisco, CA, 
and are reproduced by permission of the author and of the Society. 






























8/68 TOXIC RELEASE 


releases recorded in the areas covered and in an increase in 
plant availability. 

Similar investigations have been carried out for other 
gases such as bromine, hydrogen chloride, hydrogen 
fluoride and phosgene. Another study in this area is the 
assessment of the hazard from acrylonitrile storage tanks 
described by Siccama (1973). 

18.29.2 Transport 

Howerton (n.d., 1969), in a generic study of the hazards of 
chlorine handling and transport, gives estimates of the 
areas affected by different chlorine releases based on cal¬ 
culations of (1) liquid and vapour discharges from contain¬ 
ers, (2) flash-off and evaporation from liquid chlorine, and 
(3) dispersion from instantaneous and continuous point 
sources at ground level. 

He considers both instantaneous and continuous releases 
and uses the Pasquill-Gifford equations. The equation 
used for a continuous point source is Equation 15.16.41 that 
gives the concentration profiles. The values of the disper¬ 
sion coefficients used are those given by Singer and Smith 
(1966). 

The scenarios considered are an instantaneous release of 
25,000 lb and continuous releases of 1, 5 and 10 lb/s of 
chlorine in a 5 mile/h wind in both moderately stable and 
moderately unstable conditions. The dangerous chlorine 
concentration is taken as 35 ppm. Graphs are given 


Table 18.33 Allocation of proportion of works chlorine 
releases between works units (Sellers, 1976) (Courtesy of 
the Institution of Chemical Engineers) 


Percentage of works 
acceptable level 

Major cellrooms 

20 

Emergency absorption plant 

10 

Compression and 

10 

liquefaction plant 


Small cellrooms 

10 

Liquid storage and pipelines 

7 

Container filling 

4 

Drum, cylinder and 

1 

hypochlorite users 


User plants (6 at 5% each) 

30 


showing the lines of constant chlorine concentration, or 
chlorine isopleths, for these eight cases. For the instanta¬ 
neous release the cloud is hemispherical in shape and tra¬ 
vels with the speed of the wind. The cloud first expands in 
size and then contracts. But, whereas under stable condi¬ 
tions the cloud is continuing to expand even at a distance of 
10 miles, under unstable conditions it starts to contract 
again after some 1.5 miles, as shown in Figures 18.14(a) and 
18.14(b), respectively. In both cases the envelope of the area 
swept by the cloud is cigar shaped, but for stable conditions 
Figure 18.14(a) shows only the expanding part of the 
envelope, while for unstable conditions Figure 18.14(b) 
shows the envelope terminating within about 2.5 miles. The 
time of passage of the cloud in stable conditions is quite 
short, about 5-15 min. For the continuous release of 10 Ib/s 
the isopleth under stable conditions is approximately cigar 
shaped and reaches about 3 miles as shown in Figure 
18.14(c), while under unstable conditions it is ovoidal and 
reaches only about 1/8 mile as shown in Figure 18.14(d). 

The conditions under which the highest gas concentra¬ 
tion can occur at large distances are those of an instanta¬ 
neous release under stable weather conditions at low (but 
not zero) wind speeds. In this sense, this is the worst sce¬ 
nario. In such a case, however, the cloud travels slowly and 
the warning time is long. 

Simmons, Erdmann and Naft (1974) in another generic 
study of the hazards of chlorine transport have estimated 
the area affected by a chlorine release. They consider an 
instantaneous release and use the Pasquill-Gifford equa¬ 
tions. The equation used is Equation 15.16.66a, which gives 
the dosage profiles. The values of the dispersion coefficient 
oy used are those given by D.B. Turner (1970). They are fit¬ 
ted to the following equation: 

cr y = **» [18.29.3] 


Pasquill category 

k = 0.20 

C 

k = 0.13 

D 

k = 0.078 

E, F 

n = 0.91 



Table 18.34 Predicted chlorine releases and their consequences (Sellers, 1976) (Courtesy of the American Institute of 
Chemical Engineers) 


Incident 

Frequency 

(events/year) 

Release 
rate (m 3 /h) 

Release 

duration 

Severity of event 





Percentage in 
class (%) 

Frequency of 
class (events/year) 





I II III 

I II III 


Cell offtake shut 

0.7 

70 

5 

30 

2 

0 

0.21 

0.014 

0 

Cell explosion 

1.5 

2 

5 

11 

0 

0 

0.17 

0 

0 

Control fails but relief operates 

0.95 

60 

3 

29 

0 

0 

0.28 

0 

0 

Control fails and relief fails 

0.011 

840 

2 

16 

39 

13 

0.002 

0.004 

0.001 

Total 







0.7 

0.02 

0.001 
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Figure 18.14 Concentration profiles for chlorine release from a point source at ground level (after Howerton, 1969): 
(a) instantaneous release of25,000 lb in stable conditions; (b) instantaneous release of25,000 lb in unstable conditions; 
(c) continuous release of 10 Ib/s in stable conditions; (d) continuous release of 10 tb/s in unstable conditions (Courtesy of 
American Institute of Chemical Engineers) 


where x is the distance in the downwind direction (m), cr y is 
the dispersion coefficient in the crosswind direction (m), 
k is a constant, and n an index. It is assumed that the 
dispersion coefficient <x z is 

<r z = 0.2(7y [18.29.4] 

where o z is the dispersion coefficient in the vertical direc¬ 
tion (m). 

The relation between dosage and fatalities is taken to be 
as follows. For chlorine vapour in air 

1 ppm = 2.9 mg/m 3 = 2.9 x 10 -6 kg/m 3 

The lethal dosage LCt 50 is taken as 

LCtgo = 1000 ppm min = 0.17 kg s/m 3 

The scenario considered is the initial flash vaporization of 


15.7 ton of chlorine from a spillage of 90 ton of chlorine, this 
being the capacity of a standard chlorine rail tank car. The 
area of lethal dosage LCt 50 is a function of wind speed and 
stability conditions and maybe represented by the equation 

A : ku *' [18.29.5] 

where A is the area of lethal dosage (km 2 ), u is the wind 
speed (m/s), P is a constant, and n' is an index. For the case 
considered: 


Pasquill category 

k! = 1.72 

A-C 

K = 2.83 

D 

h! = 4.92 

E, F 

n = 1.06 
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The areas of lethal dosage for this case are shown in 
Figure 18.15. 

The conditions under which the area of lethal dosage 
from an instantaneous spillage is greatest are again those 
of release under stable weather conditions at low wind 
speeds. In this sense, this is again the worst case. 

The authors compare their method of calculating the 
area of lethal dose with that of Howerton. For the 25,000 lb 
instantaneous release considered by Howerton the area of 
4 km 2 calculated by him is greater by a factor of almost 
4 than that obtained by their method. This is attributed to 
the use of different values of the dispersion coefficient. 

The estimate of the area of lethal dosage is then used by 
Simmons, Erdmann and Naft in conjunction with data on 
the frequency of particular meteorological conditions and 
on population densities to calculate the potential fatalities 
for transport accidents, as described below. These are pre¬ 
sented as histogram data for a range of accidents of 
increasing severity. The most severe accident calculated 
involved 5000-20,000 deaths with a frequency of 
2.6xl0 _4 /year. 

Eisenberg, Lynch and Breeding (1975) in the vulner¬ 
ability model work already described have studied among 
other things the area affected by, and the lethality of, 
chlorine and ammonia releases. 

They consider any instantaneous release from a marine 
spillage and use the Pasquill-Gifford equations.The equa¬ 
tion used for an instantaneous release is Equation 15.16.40. 

For chlorine the scenarios considered are instantaneous 
releases of 0.9,15 and 1090 te of chlorine. The latter corre¬ 
sponds to the load of a large barge. The relation between 
dosage and fatalities is that given in the probit Equation 
18.15.2. The populations at risk are defined in terms of the 
cell model already described. 

Some results obtained are given in Table 18.35. These 
results indicate that the conditions under which the calcu¬ 
lated lethality of the release is highest depend on the size of 
the release. For the small release of 0.9 te the lethality is 
higher under neutral conditions. With unstable conditions 
the gas is more rapidly diluted below its lethal concentration. 


For the large release of 1090 te the lethality is higher under 
unstable conditions. With unstable conditions the gas is 
more rapidly dispersed, but remains above its lethal con¬ 
centration. The authors draw attention to the need to use 
short time steps in the calculation of £ CW, in Equation 
18.15.2 if accurate results are to be obtained. 

For ammonia the scenarios considered are instantaneous 
releases of 8.2, 251 and 16,340 te. The relation between 
dosage and fatalities is that given by the probit Equa¬ 
tion 18.15.3. 

Some results obtained are as follows: 


Ammonia 
spillage (t) 

Time of 

travel 

(min) 

Distance 

travelled 

(km) 

Fatalities 

8.2 

Any 

Any 

0 

251 

10 

2.4 

921 


30 

7.2 

8,033 

16340 

10 

2.4 

2,177 


30 

7.2 

18,151 


The wind speed was 4 m/s.Toxic injuries were not assessed. 

Major assessments of the hazard of chlorine transport 
have been described by Simmons, Erdmann and Naft (1974) 
and Westbrook (1974). Simmons, Erdmann and Naft have 
reviewed the methods used for the transport of chlorine in 
the United States, the historical experience of accidents 
involving chlorine and the hazards arising from its transport. 
They found that chlorine ranked sixth among chemicals in 
terms of the quantity produced. Some 4.4x10 s ton of liquid 
chlorine were transported in 1972 and this amount was 
expected to rise to about 10 x10 s ton by 1990. Transport of 
chlorine is important, because accidents to carriers are rela¬ 
tively frequent, population densities along the main trans¬ 
port routes are relatively high, and the substance is very toxic. 

The sizes of chlorine containers are basically as follows. 
Storage is typically in large pressure vessels or refrigerated 
atmospheric tanks containing 1000 or 2000 ton each. 



Figure 18.15 Areas of lethal dose for initial flash vaporization from a 90 ton chlorine spill (Simmons, Erdmann 
and Naft, 1974) Courtesy of the American Institute of Chemical Engineers) 
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Table 18.35 

Effects of marine spillages of chlorine (after Eisenberg, Lynch and Breeding, 1975) 



Chlorine 
spillage (t) 

Stability 

condition 

Wind 

speed (m/s) 

Time of 
travel (min) 

Distance 
travelled (min) 

Distance 
travelled (km) 

Fatalities 

Injuries 

0.9 

Neutral 


4 

10 

2.4 

277 

645 


Unstable 

5 

8 

2.4 

0 

0 



Neutral 


4 

30 

7.2 

277 

5748 


Unstable 

5 

24 

7.2 

0 

2 


15 

Neutral 

4 

4 

10 

2.4 

921 

0 


Unstable 

4 

10 

2.4 

921 

0 



Unstable 

5 

8 

2.4 

0 

921 



Neutral 


4 

30 

7.2 

9,995 

865 


Unstable 

4 

30 

7.2 

1,020 

6,334 



Unstable 

5 

24 

7.2 

340 

7,425 


1090 

Neutral 

4 

4 

10 

2.4 

921 

0 


Unstable 

5 

8 

2.4 

1,823 

5,734 



Neutral 


4 

30 

7.2 

13,628 

937 


Unstable 

5 

24 

7.2 

18,152 

4,946 



Barges usually carry four pressure vessels each containing 
275 ton, making 1,100 ton total capacity. Rail tank cars are 
pressure vessels ranging in size from 16 to 90 ton, but only 
the latter size is now made. Road tankers are also pressure 
vessels and normally have a capacity of 16 ton. Cylinder 
sizes are usually 1 ton, 150 lb or smaller. 

All containers for chlorine transport are pressure vessels 
made in steel and equipped with safety devices such as pres¬ 
sure relief valves and excess flow valves, and are regularly 
inspected and pressure tested. Details of chlorine containers 
are given in the publications of the Chlorine Institute. 

Chlorine is also transported hy pipelines. Such pipelines 
range from 1 to 6 in. in diameter. The longest run quoted is 
10,000 ft of a 4 in line. 

The authors’ tabulation of chlorine accidents has already 
been given in Table 18.30. Storage of chlorine had not 
resulted in a single accident in the United States in the 
40 years up to 1974. There have been several accidents in 
small storages in Europe, but it is possible that these have 
been due to the presence of water and the resultant corro¬ 
sion; this is avoided in good modern practice. 

Barge accidents are few, possibly because the barge 
structure forms a means of protection for the chlorine 
tanks, in contrast to the situation on petroleum barges, 
where the barge shell is also the containing wall. 

Rail tank car accidents have been more frequent. One 
major cause of these, the cracking of the tank at the anchor, 
which is the attachment of the tank body to the frame, has 
been largely eliminated by replacing forged anchors with 
welded ones, but accidents still occur, mainly by derailments 
and collisions. Department of Transportation (DOT) statis¬ 
tics indicate that there are approximately five rail tank car 
accidents per year that result in the release of chlorine, but 
only a small proportion of these involves a multiton release. 

Road tanker transport is less significant and gives rise to 
fewer accidents. 

Accidents with containers of 1 ton or less are important. 
As Figure 18.10 shows, some of the worst accidents have 
resulted from releases from cylinders and other small con¬ 
tainers. This is probably because the releases took place in 
buildings and other confined spaces. It is considered by the 
authors that the dominant hazard is transport of chlorine 
by rail tank car. Some chlorine transport accidents are 
described in Case Histories A94, B66 and B67. 


It was estimated by the Chlorine Institute that the pro¬ 
portions of chlorine distributed by the different modes of 
transport in the years 1965 and 1966 were: rail, 70% pipe¬ 
line, 20%; and barge, 7%. Thus, assuming the same divi¬ 
sion, some 3.1 xlO 6 ton of chlorine were transported by rail 
in 1972 and this figure was expected to grow to about 
7.2xlO 6 ton by 1990. It is clear from these data that rail 
transport is the dominant mode of distribution. 

The problem principally considered by Simmons, 
Erdmann and Naft, therefore, is incidents involving rail 
tank cars carrying 90 ton of chlorine. Their treatment con¬ 
sists of the determination of (1) the frequency of accidents 
involving chlorine spillage and (2) the number of fatalities 
resulting from spillage. 

Statistics kept by the Railroad Administration of the 
DOT and by the Chlorine Institute showed that there are 
some 7,000 chlorine rail tank cars in service, that each 
tank car makes an average six trips a year and that the 
average length of journey is 250 miles. Since 1930 there 
have been seven accidents in which most or all of the con¬ 
tents of a tank car have been lost, although three of these 
were due to the failure of a forged tank anchor, a cause 
presumably now eliminated. On the other hand, the amount 
of traffic is increasing. On balance, therefore, the best 
estimate of accident frequency from these data is once in 
10 years. 

Other data are available on accidents to the same type of 
rail tank car as is used for chlorine in the transport of liquid 
ammonia and LPG. In a study covering 1966-70 the Asso¬ 
ciation of American Railroads (AAR) found that for this 
type of rail tank car and for all cargoes, including chlorine, 
the accident rate was 2.3 xl0~ 5 per trip. Applied to the 
approximately 40,000 trips (7,000 tank carsx6 trips/year) 
made by chlorine tank cars these data would give an acci¬ 
dent rate of once per year. The order of magnitude differ¬ 
ence between this and the previous figure remains an 
unresolved discrepancy, but the authors suggest that it 
may be due to the way in which chlorine shipments are 
handled. They tentatively adopt the lower figure of 0.1 
accidents per year. 

The determination of the area of lethal dosage for spil¬ 
lage from a 90 ton tank car with flash vaporization of 17.5 % 
of the tank contents, or 15.7 ton, was described above. This 
calculation is then combined by Simmons, Erdmann and 
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Naft with the above estimate of frequency and with data on 
the frequency of meteorological conditions to obtain esti¬ 
mates of potential casualties. 

The population density assumption made is that a large 
spill is equally likely anywhere along the rail shipping 
route. This assumption is not conservative, since data for 
all rail accidents indicate a somewhat higher frequency in 
urban areas, the higher speeds in rural areas presumably 
being more than balanced by the higher density of traffic 
and switching activities in towns. 

Estimates of potential fatalities were made for some 13 
different weather conditions and 9 population densities, 
making 117 permutations in all. Accidents were then divi¬ 
ded into 7 size ranges and a histogram was constructed. 
There were some 75 accidents involving 50 or more poten¬ 
tial fatalities and the average number of fatalities was 13 
per year.The histogram data are approximately as shown in 
Table 18.36. 

From these histogram data the authors derive for the 
number N of fatalities the density function/(AO 

/(AO = 0.15AT 1 - 61 [18.29.6] 

Simmons, Erdmann and Naft quote unpublished work by 
G.D. Bell (n.d.) on toxic releases that likewise gives an 
exponent of —1.6 for Equation 18.29.4, although in this lat¬ 
ter case there were insufficient data to determine a realistic 
value of the constant factor. 

The fatalities calculated in this work are described as 
‘potential’, because no allowance is made for the effective¬ 
ness of any post-accident action to limit the effects. In fact, 
public warning and evacuation would probably greatly 
reduce the number of deaths. 

It should be noted in particular that the conditions that 
give the highest number of fatalities are those in which the 
wind speed is low and the time available for evasive action 
is relatively long. In such cases, therefore, it is more prob¬ 
able that evacuation will be effective and that the ratio of 
actual to potential deaths will be relatively low. 

For the 40 -year period covered by the data given in Table 
18.30,204 people were gassed and one killed (excluding the 
small release in the Philadelphia incident) in railroad 
chlorine accidents. This compares with a value from the 
histogram data and equation 18.29.4 of 570 persons 
expected to be killed. The comparison indicates, on the one 
hand, support for Equation 18.29.6, in that the figures for 
people affected agree quite well, and on the other the 
effectiveness of evacuation, in that people fled and were 
gassed, but were not killed. 


Table 18.36 Accident scale-frequency relationship 
for chlorine rail transport accidents (after Simmons, 
Erdmann and Naft, 1974) 


Accident size 
(Potential deaths) 

Frequency 

(events/year) 

50-100 

1.4xl0“ 2 

100-250 

1.0 xlO -2 

250-500 

4.0 xlO -3 

500-1000 

1.5xl0“ 3 

1,000-2,500 

1.2xl0“ 3 

2,500-5,000 

7.2xl0 -4 

5,000-20,000 

2.6 xlO -4 


It is emphasized by the authors, however, that estimates 
of this kind involve many unknown factors, particularly in 
respect of accident frequency, and that the associated 
uncertainty is estimated to be a factor of 10. 

The method described uses a mixture of historical data 
for accident frequency and estimation of the scale and 
frequency of the results of the accident. 

As the authors point out, in some cases the historical 
data may be too sparse or non-existent, and then the acci¬ 
dent frequency must also be estimated. 

Simmons, Erdmann and Naft compare the risk to the 
whole US population from chlorine railroad accidents of 13 
potential fatalities per year with other risks to which the 
public are exposed. These include estimated risks in the 
range of 10-100 fatalities per year from the failure of dams 
and in the same range for aircraft crashes (persons on the 
ground only). 

Westbrook (1974) has made a comparative study of the 
relative hazards of the transport of chlorine by rail, road 
and pipeline by the principal UK producer, ICI. 

Much of the work was concerned with the determination 
of accident data. Here difficulties were experienced 
because data tend to be reported in forms that are not 
readily convertible, for example ton-miles, vehicle-miles, 
train-miles. The approach adopted, therefore was to con¬ 
sider the transport of the entire amount shipped (200,000 
ton/ year) by each mode in turn. 

The investigations involved the determination of (1) the 
frequency of significant accidents, (2) the probability that a 
significant accident results in a spillage and (3) the number 
of fatalities resulting from a spillage. 

The frequency of accidents was determined from acci¬ 
dent records. The accidents referred to are ‘significant’ 
accidents. For rail, such an accident is the one that is judged 
to be potentially most dangerous, and includes all derail¬ 
ments and most collisions. Such accidents represent 32 % of 
all reported train accidents. For road, a significant accident 
is one that results in injury or death and is what the police 
call a ‘reportable’ accident. 

The relevant accident data for rail for 1971 were: 

Capacity of rail tank car = 28 ton 
Number of rail tank cars in chlorine train = 4 
Number of rail journeys = 200,000/(4 x 28) = 1786 
Distance travelled per train journey = 160 mile 
Total distance travelled as train journeys = 1786 x 160 m 
286,000 train-mile/year 

Accident frequency for goods trains = 3.79 x 10 -6 acci¬ 
dents/train-mile 

Accident frequency for chlorine trains = 286,000 x 3.79 
x 10 -6 = 1.08 accidents/year 

The data for road were: 

Capacity of road tanker = 19 ton 
Number of vehicle journeys = 200,000/19 = 10,526 
Distance travelled per journey=160 mile 
Totaldistancetravelled = 10,526 x 160 = 1.684 x 10 6 vehicle- 
mile/year 

Accident frequency for goods vehicles = 2.03 x 10 -6 
accidents/vehicle-mile 

Accident frequency for chlorine vehicles = 1.684 x 10 6 
x 2.03 x 10 _ ® = 3.42 accidents/year 

The above data refer to all journeys, but on average half the 
journeys made are with empty tanks. Thus the numbers of 
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significant accidents by the two modes of transport 
become: 

Accident frequency for rail transport (loaded) 

= 0.54 accidents/year 

Accident frequency for road transport (loaded) 

= 1.71 accidents/year 

The probability that a significant accident results in a 
spillage was estimated from consideration of mechanical 
strength of the tank and of the force of impact. It was 
thought initially that at normal road tanker speeds of about 
30 mile/h there might not be sufficient energy to puncture 
the pressure vessel. It was shown, however, by tests and 
calculations, that puncture can occur under expected acci¬ 
dent conditions and that all road tanker accidents should be 
assumed to be potential spillage accidents. 

The probability of puncture is a function of kinetic energy. 
It was found, however, that the average speeds of chlorine 
rail tank cars and road tankers are almost equal. Thus it 
was possible to consider damagelevels in terms of mass only. 

A rail tank car in a train is subject to wagon-to-wagon 
collisions. A relation was derived for the damage to a wagon 
in a train involved in a front-end collision with an immov¬ 
able object. It is assumed that the damage is proportional to 
the mass of the wagon involved and that it is shared equally 
between the wagons. Then for the first wagon behind the 
engine the damage D is proportional to its own mass W for 
the first collision, which is with the engine, to for the 
second collision, which is between the first and second 
wagons, to |Wfor the third collision, which is between the 
first three wagons, and so on. Thus: 

Dl=lf ( 1 + ^ + i + "') [18.29.7a] 

where A is the damage to wagon i (mass units) and Wis the 
mass of a single wagon (mass units). For the second wagon 

*+|+-") [18.29.7b] 

And for the nth wagon in a train of A wagons 



A group of m adjacent chlorine rail tank cars can occupy 
N—tn+1 positions in the train. Then, assuming W=l, the 
average damage per train A n is 


°tn= N _ 1 m + 1 ff (A,+A, + l + A+2+A, +3 ) 

[18.29.8] 

and the average damage per rail tank car Ac is 

Ac = ^ [18.29.9] 

The probability that the rail tank car will be punctured is 
proportional to the average damage. 


If the train has 25 wagons ( N= 25) and if there are four 
chlorine rail tank cars (m = 4) 

A = 3-82 mass units 
A = 2.82 mass units 
A = 2.32 mass units 
As = 0.04 mass units 

An = 3.645 mass units 
Ac = 0.911 mass units 

A chlorine road tanker and a rail tank car have a mass of 30 
and 40 ton, respectively. Thus on the assumption that the 
probability of puncture is proportional to the mass, the 
ratio r of the probability of puncture for a rail tank car to 
that for a road tanker is as follows: 

First position behind engine r = x 40 = 5.1 



« 1.22 for one tank car 
.*= 4 x 1.22 
= 4.86 for train 

The analysis is relevant to the positioning of chlorine rail 
tank cars in the train in that it indicates that for a front-end 
collision the least desirable position is immediately behind 
the engine. 

Collisions other than front-end collisions are also con¬ 
sidered by Westbrook. A head-on collision of two trains is 
considered no worse since, although more energy is 
involved, it is distributed among more wagons. On the 
same argument, a back-end collision of two trains is less 
serious, since the energy involved is no greater than a front- 
end collision, but it is distributed among more wagons. 

An absolute estimate of the probability of a spillage 
given a significant accident was made from the North 
American data for rail furnished by the Chlorine Institute 
and shown in Table 18.37. Over the period 1960-72 there 
were 67 accidents to chlorine trains, of which six resulted in 
spillage of chlorine. The probability of chlorine spillage in a 
significant rail accident in North America was therefore 
taken as 6/67 = 0.09. 

This use of North American data was necessary, because 
equivalent data for the United Kingdom were lacking. 
American conditions differ, however, in a number of respects: 



UK 

North 

America 

Rail tank car mass 

40 ton 

87 ton 

Average No. of goods 

25 

100 

Wagons 

Average No. of chlorine 

4 

2 

Rail tank cars 

Average speed 

15 mile/h 

23 mile/h 


The American pressure vessel is 0.753 in thick compared 
with the British 0.526 and requires 26% more energy to 
pierce it. 
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Table 18.37 Accidents in bulk carriage of chlorine in the USA and Canada (Westbrook, 1974) (Courtesy 
of Elsevier Publishing Company) 


Significant 
leakage - no 
accident 

Accident 

Accident, Accident, fire Accident, Accident, 

leakage leakage, fire leakage, death 

1961 


3 

1 

1962 

1 

1 

1 

1963 


1 

1 

1964 


4 

1 

1965 

1966 


8 

1 

t j 

1967 


7 

1 

1968 

1969 

1970 


7 

6 

8 

1 

1971 

1 

8 

1 

1972 


4 

1 

Total 

2 

58 

3 4 2 1 


Since under American conditions there are two rail tank 
cars in a 100-wagon train 

An = 1-967 mass units 

But the mass units in this case are greater than those for 
the British case by the following factor, which takes into 
account the different kinetic energy: 



Then the probability of chlorine spillage in a significant 
rail accident in the United Kingdom is estimated as 

Probability of chlorine spillage for rail transport 

= 0.09 x x yip = 0.041 occasions/accident 
1.967 4.05 

Frequency of chlorine spillage for rail transport 
= 0.041 x 0.54 = 0.022 spillages/year 

and the probability of chlorine spillage in a significant road 
accident in the United Kingdom is 

Probability of chlorine spillage for road transport 
= 0.041/4.86 = 0.0084 occasions/accident 
Frequency of chlorine spillage for road transport 
= 0.0084 x 1.71 = 0.0144 spillages/year 

The number of fatalities resulting from a spillage depends 
on the following factors listed by Westbrook: (1) warning 
time; (2) emission from the tank; (3) dispersion over the 
downwind area; (4) population density in the area affected; 
(5) chance of escape. 

The time elapsing before warning is given was estimated 
as 24 min for rail and for road. A random sample of 17 
accident reports from the files of British Rail headquarters 
at Marylebone indicated that it took, on average, 12 min for 
the first public aid vehicle (police, fire or ambulance) to 
arrive at the scene of a rail crash. It was considered that this 
delay was no longer than might be expected for a road 
accident. The figure of 12 min was then doubled to allow for 
the communication of an effective warning to the public. 


For emission it was assumed that the initial temperature 
in the tank was 38°C, that the puncture holes in the vapour 
space were 19 in. and those in the liquid space were 7 in., 
and that the latter hole was at a level that allowed only 
one-third of the tank contents to remain in the tank. Under 
these conditions it was estimated that some two-thirds of 
the chlorine liquid would flash off or form spray and 
vaporize within the first 4 min and that the remaining 
liquid would boil off over a period of about 2 h. 

The situation for dispersion is intermediate between an 
instantaneous and a continuous release. At a given point 
downwind there is a distance/velocity lag before the cloud 
arrives, then the concentration rises rapidly to amaximum as 
the instantaneous release cloud passes and then falls to a 
steady value as the continuous release plume becomes 
established. Dispersion calculations were done using the 
Pasquill method assuming a 5 mile/h wind speed and a 
dangerous chlorine concentration of 20 ppm. On the 
assumption that 24 min would elapse before effective warn¬ 
ing would be given, the chlorine cloud would have drifted 
2 miles. Then the areas in which a dangerous chlorine con¬ 
centration would exist were estimated to be: 


Area of dangerous chlorine concentration for rail spillage 
& 0.076 mile 2 

Area of dangerous chlorine concentration for road spillage 
== 0.052 mile 2 

Estimates of population density were made on the rail 
and road routes to one of the principal customers for chlor¬ 
ine. Estimates of the number of people within, on average 
100 ft, of an accident were made by travelling the road route 
by car and the rail route by brake van. The numbers 
obtained were three and five persons on the rail and road 
routes, respectively. But, since road accidents tend to give 
rise to congestion, the figure for the road case was 
increased to 20. Other coarser scale surveys of the routes 
were made using maps, but in this case there was little 
difference in population density, and the average value of 
700 persons/mile 2 applicable to Great Britain was taken. 
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Then, applying this population density to the areas at risk 
from spillage and including those people within 100 ft: 

Number of people at risk from rail spillage 
= 0.076x 700 + 3 = 56 
Number of people at risk from road spillage 
= 0.052x700 + 20 = 56 

The chances of escape were estimated as follows. The 
Chlorine Institute data given in Table 18.37 indicate that 
there were eight substantial chlorine spillages in North 
America in the period 1960-72. If on each occasion two- 
third of the tank contents had been released, then calcula¬ 
tions show that the area affected within a 24 -minute period 
would have been 0.133 mile 2 . With an average population 
density of 60 persons/mile 2 the number of people at risk 
from the eight incidents would have been 

8 x 0.133 x 60 = 64 

But in fact in these incidents 156 people received medical 
treatment and one person died. These figures suggest that 
the population density at the scene of the accidents may 
have been higher than average and that the assumed 
warning period of 24 min may be too low. Press reports of 
the incidents suggest that a high proportion of those at risk 
received medical attention. 

Applying a ratio of 1 death in 156 to the number of people 
at risk from either a rail or a road spillage gives: 

Frequency of fatalities from rail or road spillage 
= 1 x — = 0.359 deaths/spillage 

Then: 

Frequency of fatality from rail transport 
= 0.022 x 0.359 = 0.0079 deaths/year 
Frequency of fatality from road transport 
= 0.0144 x 0.359 = 0.0052 deaths/year 

Westbrook also discusses the sensitivity of the calculations 
to changes in the assumptions. He considers three such 
changes: 

A Rail and road tankers both suffer one significant acci¬ 
dent per year more than the national average. 

B Damage estimate in rail crashes is pessimistic and is 
reduced by factor of 2. 

C Estimate of number of people at risk in road accidents is 
optimistic and is increased by 50. 

The frequency of fatalities then becomes 


Case 

Frequency of fatalities 

(rail deaths/year) 

(road deaths/year) 

A 

0.023 

0.0082 

B 

0.0039 

0.0052 

C 

0.0079 

0.0098 


These calculations suggest that neither rail nor road has a 
marked advantage over the other from the point of view of 
safety in the transport of chlorine. 

The study also considered the distribution of chlorine by 
pipeline and by vehicles with refrigerated atmospheric 
tanks. For the pipeline the case considered was a line of 4 in. 
diameter and 20 mile long carrying 25 ton/h of chlorine at 
15°C for 2,000 h/year. From a study of pipeline records in 
the United Kingdom and the United States, it was con¬ 
cluded that a pipeline of this length might sustain damage 
once in 10 years and that on one occasion in 10 there would 
be a massive release of chlorine. The fracture was assumed 
to occur between excess flow valves 2 miles apart, 1.5 miles 
from one valve and 0.5 mile from the other, allowing emis¬ 
sion of chlorine from both ends. It was further assumed 
that the excess flow valves would take 30 s to close. The 
calculations involved the difficult problem of emission 
under two-phase flowconditions.The results obtained were 

Initial flow rate of chlorine = 60.3 ton/h per 4 in. orifice 
= 120.6 ton/h total 

Total quantity of chlorine emitted in 24 min = 28.4 ton 

Size of cloud of dangerous concentration = 0.101 mile 2 

Number of people at risk = 74 

Frequency of fatalities from pipeline break 
= 0.48 deaths/break 

0.48 

*10 x 10 

= 0.0048 deaths/year 

The pipeline conveys 50,000 ton/y of chlorine over 20 
miles. Comparison with rail or road transport requires that 
they be put on the same basis. If this is done, the frequency 
of fatalities is 0.0005 and 0.00032 deaths/year for rail and 
road transport, respectively. Therefore rail and road trans¬ 
port appear to be an order of magnitude safer than a pipe¬ 
line. 

It may be noted, however, that the assumption made by 
Westbrook on the frequency of damage to a chlorine pipe¬ 
line is perhaps pessimistic. Information on pipeline failure 
rates is given in Chapter 23. 

The transport of chlorine using refrigerated vehicles has 
not been studied so thoroughly at the time of writing. Pre¬ 
liminary work suggests that low temperature transport 
would be safer, perhaps by a factor of about 4, but it would 
not affect the choice between rail and road. 

This work of Westbrook illustrates an approach to the 
assessment of the hazards of transport of toxic substances. 
Many assumptions and uncertainties are involved and the 
results are both approximate and tentative. It should be 
emphasized that the study is concerned with a comparative 
assessment of the different modes of transport, particu¬ 
larly rail and road. Such comparative assessment is diffi¬ 
cult and demands accurate estimates if the results are to 
be meaningful in discriminating between transport modes. 


18.30 Other Chemicals Hazard Assessment 

Solomon, Rubin and Okrent (1976), from a study on the 
hazards of the storage of chemicals, give estimates of the 
areas affected by and the lethality of releases of chlorine, 
acrylonitrile, hydrogen cyanide and parathion. Parathion 
has the formula (C2H 5 0)2PS0C 6 H 4 N02 and is much 
heavier than air. 







18/76 TOXIC RELEASE 


They consider both instantaneous and continuous 
releases and use the Pasquill-Gifford equations. The equa¬ 
tions used are, for instantaneous and continuous releases, 
Equations 15.16.40and 15.16.41, respectively, and for dosage, 
Equation 15.16.66a. The values of the dispersion coefficents 
used are those given by Equations 18.29.3 and 18.29.4. 

The relations assumed between dosage and fatalities or 
injuries for the chemicals studied are given in Table 18.38. 
The lethal dosages used are as follows: 


Chlorine 
Acrylonitrile 
Hydrogen cyanide 
Parathion 


40-60 ppm for 30-60 min 
200-400 ppm for 30 min 
100 ppm for 1 min 
30 mg (dermal) 


The authors refer to these as LD 50 lethal doses, but in terms 
of the terminology used here the first three are strictly 
LCt 5 o lethal dosages. 

The base scenario considered for all the chemicals is a 
release rate of 100 kg/s with 20% flash-off for 30 min 
exposure in an area of a population density of 1000 
persons/km 2 under stability conditions Pasquill category 
A and at a wind speed of less than 2.5 m/s. For parathion it 
is assumed that there is no deposition from the air to the 
ground. 

Cases without and with evacuation are considered. With 
evacuation the evacuation half-time was 30 min. Some 
results obtained are shown in Table 18.39. Of the 12,000 


Table 18.38 Assumed relationship between dosage 
and fatality for toxic releases (after Solomon, Rubin and 
Okrent, 1976) 


Lethal Assumed Assumed 

dosage (%) mortality (%) decrease in life 

expectancy (years) 


<10 0 
1-10 5 0.08 

10-25 10 0.25 

25-50 20 1 

50-100 40 1 

100-200 65 10 

>200 95 20 


Table 18.39 Effects of releases of some toxic chemicals 
without and with evacuation (after Solomon, Rubin and 
Okrent, 1976) 


Chemical release 

Evacuation 

Fatalities 

Chlorine 

No 

12,000 


Yes 

9,800 

Acrylonitrile 

No 

5,500 

Acrylonitrile 

No 

5,500 


Yes 

4,600 

Hydrogen cyanide 

No 

49,000 


Yes 

39,000 

Parathion 

No 

9,600 


Yes 

6,600 


deaths calculated for chlorine, about 3000 occur as a result 
of the initial flash-off and the remainder as the result of the 
subsequent steady flow. 

Assuming a tank rupture rate of 1 x 10 -6 /tank-year and 
the probability of the assumed meteorological conditions 
as 5 x 10 -2 , the frequency of the maximal chlorine accident 
considered is estimated by the authors as 5 x 10 8 /year for 
such a storage tank in such an area. 

18.31 Hazard Assessment Methodology 

Developments in the methodology for the hazard assess¬ 
ment of toxic releases have occurred in a number of areas, 
including the following: (1) source term, (2) heavy gas dis¬ 
persion, (3) concentration fluctuations, (4) mitigation by 
barriers and sprays, (5) mitigation by shelter and evacua¬ 
tion, (6) toxicity relations, (7) degree of injury, (8) specific 
gases, (9) population exposure, (10) plant layout, (11) ware¬ 
house fires and (12) computer aids. 

18.31.1 Source term 

One area in which the hazard assessment of toxic releases 
has become much more realistic is in the handling of the 
source term. Much early work was based on the outright 
failure of a pressure vessel and, often, the ejection of its 
entire contents. 

It is recognized that the total failure of a pressure vessel 
is very rare. Better estimates are available of lesser failures 
such of those of pipework. Allowance is made for emer¬ 
gency action such as the closure of emergency isolation 
valves. 

As described in Chapter 15, methods have been developed 
to guide the choice between continuous and quasi-instanta- 
neous release models, and thus reduce the proportion of 
cases where the more pessimistic quasi-instantaneous case 
is assumed. 

Progress has been made in the modelling of the release of 
pressurized or refrigerated fluids. Models are available for 
the behaviour of the inventory on rupture of a pressure 
vessel and for two-phase flow from leaks on pipework. The 
models for evaporation from the pool formed following 
emission of a liquid are also much improved. 


18.31.2 Gas dispersion 

In most cases, the vapours of the principal toxic liquids 
exhibit heavy gas behaviour and great strides have been 
made in heavy gas dispersion modelling. The methods now 
available, which include models for manual use such as the 
Workbook models, computer codes such as HEGADAS and 
the three-dimensional models as well as physical model¬ 
ling using wind tunnels, provide a set of tools capable of 
handling not only dispersion over flat, unobstructed ter¬ 
rain, but also the effects of slopes, buildings, barriers and 
water sprays. The concentration estimates yielded by these 
heavy gas models tend to be quite different from those of 
passive gas dispersion models. 

18.31.3 Concentration fluctuations 

It has long been appreciated that there are considerable 
fluctuations in the concentrations at a fixed point in a gas 
cloud. Methods are now available which allow estimates to 
be made of these concentration fluctuations. It is also 
appreciated that these fluctuations must have some influ¬ 
ence on the effective toxic load, as pointed out by 
R.F. Griffiths and Harper (1985). Methods of treating this 
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aspect are given by D.J. Wilson and Sims (1985), D.J. Wilson 
(1991a) and J.KW. Davies (1987,1989a). 

18.31.4 Mitigation: terrain, barriers and sprays 

As just stated, the heavy gas dispersion models available 
can now treat situations where mitigatory features exist. 
Since the typical release occurs in a works, the gas disper¬ 
sion will be strongly affected by the presence of buildings, 
which tend to enhance the dispersion. An illustration of a 
hazard assessment of a toxic release in the presence of 
buildings is given by Deaves (1987b). 

Further mitigation can be obtained by the use of 
barriers and sprays, and models are available to allow these to 
be taken into account in the assessment (e.g. Meroney, 1991). 

18.31.5 Mitigation: shelter and evacuation 

Another major form of mitigation occurs where the 
exposed population remains indoors and thus benefits 
from shelter. Methods have been developed to estimate the 
indoor concentration-time profile, and hence toxic load, 
given the profile of the outdoor concentration. The devel¬ 
opment of models for the effect of shelter is illustrated by 
the work of P.C. Davies and Purdy (1986) and D.J. Wilson 
(1987,1990,1991b). 

18.31.6 Toxicity relations 

The form of injury relation generally used in the hazard 
assessment of toxic releases has been the probit equation. 
An account has been given above of the development of 
probit equations for this purpose. 

The use of probit equations involves a number of pro¬ 
blems. In large part these reflect the basic difficulty of 
determining the human response to a toxic load. One pro¬ 
blem is that a probit equation is available only for a rela¬ 
tively small proportion of toxic gases. Even where a probit 
equation exists, it may be subject to considerable uncer¬ 
tainty. The accuracy of the relation can be expected to be 
highest close to the LC 50 , but relatively low when extended 
to an LCos or LC 0 i level. Yet in many cases the number of 
persons exposed to these lower loads is much higher than 
that for those exposed to the higher load; where there is a 
cordon sanitaire around the site, as there usually is to some 
degree, the difference is increased. 

There has been some exploration of alternatives to probit 
equations. The use of the IDLH value as an alternative to 
the probit equation in hazard assessment has been 
explored by MacFarlane and Ewing (1990). 

Particularly where the purpose of the hazard assessment 
is to identify the contour for a particular level of toxic 
effect, as in land use planning, use may be made not of a 
probit equation but of some fixed toxic load, such as the 
HSE SLOT value. 

18.31.7 Degree of injury 

Whereas the effect commonly estimated in hazard assess¬ 
ments of toxic releases has tended in the past to be the 
number of fatalities, there is some trend to estimate lesser 
degrees of injury. Thus the HSE SLOT value is a toxic load 
that is estimated not to be fatal to the vast majority of per¬ 
sons exposed. However, this type of criterion tends to be 
used not to determine the total number of persons exposed 
to the toxic load but the location of the contour around the 
site where the load will occur. 


18.31.8 Specific gases 

There have also been significant advances in the char¬ 
acterization of the toxicity of a number of common indus¬ 
trial gases, as described in Sections 18.15-18.21. In 
particular, reference may be made to the CPD Green Book 
probit equations, the HSE SLOT values and the toxicity 
estimates and probit equations of the MHAP. 

18.31.9 Population exposure 

Another area that has become more sophisticated is the 
characterization of the exposed population. As described 
in Chapter 9, there now exist what are, in effect, population 
exposure models, such as those given by Petts, Withers and 
Lees (1987) and in the Green Book (CPD, 1992b). 

18.31.10 Plant layout 

Increasingly, the effect of flammable and toxic releases is 
taken into account in plant layout, although the extent to 
which this is practical is greater for flammable and explo¬ 
sive materials than for toxic ones. An account of the work of 
Mecklenburgh (1985) on the use of hazard assessment in 
plant layout is given in Chapter 10. 

18.31.11 Warehouse fires 

Another type of toxic hazard is that arising from ware¬ 
house fires. Most work on the quantitative treatment of this 
hazard is relatively recent. It includes the work of D.A. 
Carter (1989), G.T. Atkinson, Jagger and Kirk (1992) and 
G.T. Atkinson and Jagger (1994). 

18.31.12 Computer aids 

The computation either of the consequences of a toxic 
release or of the risk to the population around an industrial 
site or along a transport route is a natural application for 
computer codes, and a considerable number of codes are 
available. Accounts of certain codes such as WHAZAN, 
SAFETI and RISK ATare given in Chapters 9 and 29. 


18.32 Notation 

C concentration 

ki, k 2 constants 

LC, concentration lethal at i% level 

LCt,- concentration-time product lethal at * % level 

LD, dose lethal at * % level 

LL, toxic load lethal at i % level 

T exposure time interval 

Y probit 


Section 18.3 

c concentration 

d dose 

D dose rate 

D„ dose 

k e elimination constant 
L toxic load 

m index 

t V2 half-life 

V apparent volume of distribution of chemical in body 

X mass of chemical in body 
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Section 18.6 

Ci time-weighted average concentration of ith 

component 

L overall occupational exposure limit 

Li occupational exposure limit of ith component 


Section 18.11 

c concentration 

C concentration (ppm) 

D dosage 

k constant 

L toxic load 

L* toxic load (alternative formulation) 

m, n indices 

t time 

T time interval (min) 


Section 18.13 

C02 concentration of oxygen in liquid phase 
(mol 02/ml fluid) 

Dl pulmonary diffusion capacity (ml/min (mmHg)) 

Dlco pulmonary diffusion capacity for carbon monoxide 
(ml/min (mmHg)) 

A.C02 pulmonary diffusion capacity for carbon dioxide 
(ml/min (mmHg)) 

Dlo 2 pulmonary diffusion capacity for oxygen 
(ml/min (mmHg)) 

ERV expiratory reserve volume (ml) 

/ respiration rate (breaths/min) 

F a02 concentration of oxygen in alveolar space 
(ml 0 2 /ml air) 

F EN2 concentration of nitrogen in exhaled air 
(mlNa/mlair) 

F eo 2 concentration of oxygen in exhaled air 
(ml 0 2 /ml air) 

F IN2 concentration of nitrogen in inhaled air 
(mlNa/mlair) 

F I02 concentration of oxygen in inhaled air 
(ml 0 2 /ml air) 

FRV functional reserve volume (ml) 

H oz Henry’s law constant for oxygen (ml 0 2 /ml fluid 
(mmHg 0 2 )) 

IC inspiratory capacity (ml) 

IRV inspiratory reserve volume (ml) 

Faoz partial pressure of oxygen in alveolar space 
(mmHg) 

Fao 2' equilibrium partial pressure of oxygen in alveolar 
space and above pulmonary capillaries (mmHg) 

P 02 ’ equilibrium partial pressure of oxygen (mmHg) 

Po2a' equilibrium partial pressure of oxygen above 
arterial blood (mmHg) 

Po2v' equilibrium partial pressure of oxygen above 

venous blood (mmHg) 

RV residual volume (ml) 

TLC total lung capacity (ml) 

TV tidal volume (ml) 

V A alveolar space (ml) 

Va alveolar minute volume, alveolar ventilation 

(ml/min) 

F D anatomical dead space (ml) 

Ve volume exhaled (ml) 

V E exhaled minute volume (ml/min) 

K inhaled minute volume (ml/min) 


V o2 rate of absorption of oxygen, oxygen consumption 
minute volume (ml/min) 

Ft tidal volume (ml) 

F t minute volume (ml/min) 

F c vital capacity (ml) 

Section 18.15 

C concentration (ppm) 

n index 

T time interval (min) 

F causative factor 

Section 18.16 

C concentration (ppm) 

L* load (ppm min) 

T time interval (min) 

Section 18.16.10 

t time (min) 

Section 18.17 

C concentration (ppm) 

t time (min) 

Section 18.18 

P probability of death 

P a probability that death is acute 

1 pi inhalation rate factor 

i// 2 medical treatment factor 

Section 18.19 

A surface area of lungs (m 2 ) 

C concentration of gas in atmosphere (mg/m 3 ) 

D inhaled dose (mg) 

D inhaled dose per unit body mass (mg/kg) 

D" inhaled dose per unit area of lung (mg/m 2 ) 

/ safety factor 

/ d extrapolation factor 

t exposure time (min) 

14 minute volume (1/min) 

W body mass (kg) 

Section 18.29 

Equations 18.29.1 and 18.29.2 

C ground level concentration on axis of plume (m 3 /m 3 ) 

d downwind distance (m) 

F stack correction factor 

h vertical spread of plume at distance d (m) 

H effective height of stack (m) 

Q gas release rate (m 3 /s) 

u wind speed (m/s) 

9 lateral spread of plume (deg) 

Equations 18.29.3-18.29.6 
A area of lethal dosage (km 2 ) 

/(AO density function for fatalities 

k, P constants 

n, n' indices 

N number of fatalities 

u wind speed (m/s) 

x distance in downwind direction (m) 
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Gy, g z dispersion coefficients in cross-wind, vertical 
directions (m) 


Equations 18.29.7-18.29.9 
D n damage to wagon n (mass units) 

A-c average damage per rail tank car (mass units) 


D ta c average damage per train (mass units) 

m number of adjacent chlorine rail tank cars 

n wagon counter 

N number of wagons in train 

r ratio of probability of puncture of rail tank car to 
probability of puncture of road tanker 
W mass of wagon (mass units) 
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19.1 Plant Commissioning 

The commissioning, or initial start-up, is a period when the 
plant is particularly at risk. It is also a time when equip¬ 
ment may be maltreated or damaged so that its subsequent 
operation is affected. Moreover, delays in bringing the 
plant up to full output can have a marked effect on the 
economics of the plant. For all these reasons it is essential to 
organize the commissioning of the plant efficiently and to 
allocate sufficient resources to it. 

An account of plant commissioning is given in Process 
Plant Commissioning (Horsley and Parkinson, 1990), Pro¬ 
cess Plant Design and Operation (D. Scott and Crawley, 1992) 
and by Troyan (1960), Finlayson and Cans (1967), Kingsley, 
Kneale and Schwartz (1968—69), Gans and Benge (1974), 
Unwin, Robins and Page (1974), Fulks (1982), Gans, Kiorpes 
and Fitzgerald (1983), Fraylink (1984), Ruziska et al. (1985) 
and Smet (1986). 

In the following sections an account is given of plant 
commissioning and of some of its problems and hazards. It 
should be said at the outset, however, that in many cases 
these have been very successfully overcome by good organi¬ 
zation and engineering so that, for example, large ethy¬ 
lene plants have been brought up to full output within 
about 3 days (Chementator, 1977 6 June, 67; 24 October, 73). 
Selected references on plant commissioning are given in 
Table 19.1. 

Extensive use is made during plant commissioning of 
checklists. It is common for a writer on the topic to include 
one or two such checklists. A rather comprehensive set is 
given by Horsley and Parkinson, both in the text and the 
appendices, as indicated in Table 19.2. 

19.1.1 Contract 

The responsibility for the construction and commissioning 
of the plant is normally shared between the user company 


Table 19.1 Selected references on plant commissioning 


Ames, Sturgis and Weeks (1959);Troyan (1960,1961b,c); 
Lieber and Herndon (1965,1973); Loen (1966,1973); 
Bacchetti (1967); J.E. Baker and Burt (1967); Bopp (1967); 
Finlayson and Gans (1967); Garcia (1967); Holroyd (1967); 
Murray and Wright (1967); de Regules (1967); J.R. Bradley 
and Nimmo (1968); Finneran, Sweeney and Hutchinson 
(1968); Kingsley, Kneale and Schwartz (1968-69); 
MacNeish (1968); Feldman (1969); Lofthouse (1969); Matley 
(1969);Tucker and Cline (1970,1971); Whyte (1970); Andrew 
(1971); Bacchelli and Bianco (1971); Clifton, Vinci and Gans 
(1971); McCallister (1971); Murphey (1971); Parsons (1971b); 
Swain and Hopper (1971); R.G.Wright (1971); Buyers (1972); 
Goldman (1972); G.M. Miller (1972); Ryan (1972); BCISC 
(1973/12); Galluzzo (1973); Godard (1973); A.J. Morton 
(1973); Asquith (1974); J.D. Baker (1974); Barnes (1974); 
Gans and Benge (1974); IChemE (1974/32); Mackey (1974); 
T. Robbins (1974); PC. Russell and Herbert (1974); Spearing 
(1974); Turnbull, Buyers and Smith (1974); Unwin, Robbins 
and Page (1974); Voss andLudbrook (1974); Gans (1976a); 
Anon. (1977 LPB18, p.2); L. Pearson (1977a,b); Whiston 
(1977); British Gas (1978 Comm. 1104); Puckorius (1978); 
Vincent and Gent (1978); API (1981 Publ. 700); Westerman 
(1981); Fulks (1982); Cans, Kiorpes and Fitzgerald (1983); 
Fraylink (1984); Kletz (1984k); Ruziska etal. (1985); Smet 
(1986); Horsley and Parkinson (1990); Kingsley (1990) 


and its contractors, but the division of responsibility may 
vary considerably. The different types of contract are 
discussed by Horsley and Parkinson. The project may 
be predominantly in-house, utilizing a small number of 
subcontractors, or it may be undertaken as a ‘turnkey’ 
by a contractor. The contract may be fully reimbursable 
or fixed cost. 

It is essential that the conditions of contract use unam¬ 
biguous terminology and give clear guidance on the 
responsibilities of the parties for the various stages of the 
commissioning and for the associated documentation. 
Model conditions of contract for different types of contract 
are available and those of the Institution of Chemical 
Engineers (IChemE) are widely used for process plants, as 
described in Chapter 11. 

The procedure developed by one UK process plant con¬ 
tractor to define responsibilities is illustrated in Table 19.3 
(from Horsley and Parkinson). These authors give further 
demarcation schedules governing phases A-G of the 
project. 


Table 19.2 Some checklists for plant commissioning 
(after Horsley and Parkinson, 1990) 

A Appendices 


Appendix i 


Demarcation of 

2.1—2.5 

construction and 


commissioning tasks 


Reservation checklist: 

3.1 

pipelines and pipework 


Reservation checklist: 

3.2 

chemicals and 


hydrocarbons in 


Modifications assessment 

3.3 

Mechanical commissioning 

5.2.1 

Packed columns 

5.2.2 

Control panels 

5.3.1 

Orifice plates 

5.3.2 

Relief valves 

5.3.3 

Piping systems 

5.3.4 

Electrical systems 

5.4.1 

General electrical 

5.4.2 

installation 


Control loop 

6.1 

Sequence operation 

6.2 

(batch process) 


Instrument loop 

6.3.1 

Storage tank 

7 

B Text 

Page no. 

Pre-process commissioning 

44 

Instrument checking 

36; table 6.1 

Instrument documentation 

42 

Computer commissioning 

Figure 6.1 

Continuous reactor process 

49 

commissioning 















PLANT COMMISSIONING AND INSPECTION 


1 9/3 


Table 19.3 Demarcation between contractor and client of work and responsibility in construction and commissioning 
(Horsley and Parkinson, 1990) (Courtesy of the Institution of Chemical Engineers) 


Construction and pre-commissioning: 

PHASE A Prepare plant/equipment for pre-commissioning/mechanical testing 

PHASE B Prepare services: clean and pressure test systems 

PHASE C Check and prepare major mechanical equipment, instrumentation and protection systems 

PHASE D Final preparations for start-up 


Commissioning: 

PHASE E Charge with feedstock, etc. Start-up plant and operate 

PHASE F Performance test and plant acceptance 

PHASE G Remainder of maintenance period 


PHASE 

A 

B C D E F G 

1 Control of 
works by: 


Contractor construction Client 

2 Basic respor 

Construction 

isibilitii 

:s and phases for various categories of sta 
Site manager and team of 
construction specialists 

if at site 

Defects correction 
under contractor’s 
direction 

for 

corrective 

work 

Contractor 

Comm 


Witnessing inspection & testing 

Advising 

operation 
of plant 

Witnessing 

performance 

test 




Training client’s 
operators 

Client 


Witnessing inspection & testing 

Plant maintenance and normal adjustments 
by client 



Operators receiving 
training 

Preparing for start-up: 
staring up and operating plant 

Equipment 

vendors 


Testing and commissioning presence on site On-call to site to 

end of maintenance period 

3 On completion of construction CERTIFICATE OF MECHANICAL 

COMPLETION/TAKING OVER 

CERTIFICATE 

CERTIFICATE OF 
ACCEPTANCE 

OF PLANT 
PERFORMANCE 

FINAL CEI 

iTIFICATE 


In the account that follows, it is convenient to assume 
that, unless otherwise stated, the project is a turnkey one 
undertaken by a major contractor. 


19.1.2 Commissioning phases 

The overall process of plant commissioning passes through 
a number of phases. It starts with the completion of 
erection. This term covers the end of installation of the 
equipment and is used sometimes, but not here, to cover 
also pre-commissioning. There then follows the phase of 
pre-commissioning. During this period there occurs 
mechanical completion and pre-commissioning; installa¬ 
tion and checking of the control system and process 
commissioning. 

By the end of process commissioning the various sec¬ 
tions of the plant have been operated with process fluids. 


There then follows the performance testing in which the 
plant is operated and, if it meets its specification, accepted. 

The activities during these phases may be illustrated by 
considering those in phases A—E of the contract scheme 
just mentioned. In broad terms, these are: 

A Safety precautions; preparation of utilities; gland 
packing; preparation for line flushing. 

B Commissioning utilities; machine rotation; pressure 
and leak testing; vessel cleaning; line flushing; relief 
value testing and re-installation. 

C Chemical cleaning; machine alignment; lubrication 

systems; machine short running tests; instrumenta¬ 
tion checks. 

D Final preparations for performance testing. 

E Charging of feedstock. 

F Performance testing. 
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In the scheme described, the three areas of responsibility 
are supervision, trades and labour and inspection. Essen¬ 
tially, the responsibility for the first lies with the con¬ 
tractor, and in phase C the vendor also; responsibility for 
the second is with the contractor up to phase D, when the 
client has a roughly equal input and responsibility for the 
third passes increasingly from the contractor to the client 
over phases A to E. It is the client who carries out the 
performance testing of phase F. 

19.1.3 Organization 

It is important to organize the commissioning thoroughly 
and to provide the appropriate personnel. There is no sim¬ 
ple model for the organization and personnel for commis¬ 
sioning. These depend on the nature of the process, the size 
of the plant, the involvement of other parties, such as 
licensors and contractors and so on. What is essential is 
that the management allocate sufficient resources to do the 
job efficiently. The commissioning of a large plant is a 
major enterprise and failure to recognize this is likely to 
increase costs and hazards. 

The main conditions for success in commissioning, as 
listed by Kingsley (1990), are: an ably led, well balanced, well 
trained and committed commissioning team; a well struc¬ 
tured relationship at senior level with site construction 
management and future operational management; thor¬ 
ough planning and implementation of preparations; ade¬ 
quate involvement in design stages and safety studies; 
meticulous attention to hazards and safety; ready avail¬ 
ability of assistance from supporting disciplines and an 
expeditious approval system for plant modifications. 

Some aspects of the organization of plant commis¬ 
sioning are 

(1) regulatory and code requirements; 

(2) contractual arrangements; 

(3) quality assurance; 

(4) safety; 

(5) personnel and other resources; 

(6) budgetary control; 

(7) planning and scheduling; 

(8) modification arrangements; 

(9) communications; 

(10) documentation. 

The design, construction and operation of the plant are 
subject both to regulatory requirements and to the 
requirements of the codes and standards adopted. The 
latter should be clearly specified and there should be 
full information available about both sets of requirements. 

The regulatory constraints on the discharge of gaseous 
effluents to the atmosphere and of liquid effluents to drains 
are generally of particular importance in commissioning. 

The design, construction and operation of process plant 
are governed by quality assurance (QA). The extent of the 
QA system and its requirements varies between compa¬ 
nies, but the trend is towards a formal system. The QA 
requirements need to be clearly laid down and arrange¬ 
ments put in place to ensure compliance. The QA system 
will generally cover the quality of the equipment and ser¬ 
vices supplied by the contractors and subcontractors and 
the installation and testing of the equipment. Where a full 
QA system is in operation, it will generally cover many of 
the aspects of plant commissioning discussed below. 


Similarly, the plant design, construction and operation 
have to conform to the safety system and requirements. 
These too need to be clearly laid down and arrangements 
made to ensure compliance. 

The definition of the relative responsibilities of con¬ 
tractors and the user needs to be particularly clear in both 
areas of QA and safety. 

Plant commissioning requires the deployment of a con¬ 
siderable resources of various kinds and its organization is 
in large part concerned with ensuring that they are avail¬ 
able in sufficient quantity and at the right time. Foremost 
among these resources is a wide range of personnel, who 
are considered below. 

The various activities which have to be performed as 
part of the commissioning should be reviewed and 
arrangements made to furnish the necessary resources, 
of personnel, equipment or services. Mechanical pre¬ 
commissioning, process commissioning and performance 
testing are phases that may well require special resources. 

A budget needs to be prepared for the cost of these 
resources. Full allowance should be made both for extra 
costs incurred by the main categories of personnel 
involved, such as overtime, travel and accommodation, and 
for costs of back-up services. It may he necessary to sepa¬ 
rate the costs of pre-commissioning from those of commis¬ 
sioning. In some cases, the two sets of costs are on a 
different basis, with the former being fixed price and the 
latter reimbursable. 

Plant commissioning involves the planning and sched¬ 
uling of a large number of activities. This aspect is treated 
in Section 19.1.5. 

Arrangements need to be made to handle the plant modi¬ 
fications that are almost invariably required during com¬ 
missioning. These should ensure that proposals to modify 
the plant are subject to review and that, where appropriate, 
the proposal is referred back to the design authority. Steps 
should be taken to ensure that this process is rapid and does 
not cause undue delay in the commissioning. This aspect is 
treated in Section 19.1.10. 

Communications between the parties involved are 
always important in process plants and never more so than 
during plant commissioning. The information needs and 
the communication arrangements should be reviewed. 
Relevant aspects include documentation, written commu¬ 
nications and meetings. 

It should be arranged that the necessary documentation 
is available throughout the various stages of the project 
and that at termination of the commissioning the project is 
adequately documented. 

It has been not uncommon that the commissioning period 
involves a series of crises, but this is not the most efficient 
way of doing it. As it has been put by Horsley (1974): 

It is also evident that the fun and personal satisfaction of 
being in the thick of things, having a tremendous degree 
of responsibility, working long hours and so on, are not 
efficient ways to start-up a plant. In fact, an efficient 
start-up without the emergence of numerous challenging 
technical problems would probably be slightly dull and 
disappointing to technologists and experts. 

19.1.4 Personnel 

Responsibility for the commissioning should rest with a 
single individual. It is normal to appoint a commission¬ 
ing manager who has this responsibility. For the case 



PLANT COMMISSIONING AND INSPECTION 


1 9/5 


considered, that of a turnkey project, the commissioning 
manager is appointed by the contractor. 

The typical composition of a contractor’s commissioning 
team for a large ammonia plant is given by Horsley and 
Parkinson as a commissioning manager and deputy, four 
shift leaders, four assistants, a chemist and mechanical, 
electrical and instrument specialists. 

Where the project is done in-house, a common practice is 
to appoint a plant manager for the new plant some time in 
advance to let him familiarize himself with it, and to make 
him the commissioning manager. The job of the project 
manager is normally a separate one. Experience indicates 
that it is usually not good practice to attempt to combine 
the roles of project manager and commissioning manager. 
The commissioning team for an in-house project should be 
a strong one, with good technical capability and relevant 
experience. The team may consist of the personnel 
assigned to the plant supplemented by others who are 
brought in for the limited period of the commissioning only. 
It is necessary that the commissioning manager should be 
able to command the resources necessary to carry through 
the commissioning. Unforeseen problems can often result 
in considerable demands on resources. It may be desirable, 
particularly on large projects, to create an additional 
troubleshooting team. The organization of an extra field¬ 
work team for this purpose has been described by Horsley 
(1974). Some of the many variations in commissioning team 
composition are described by Troyan (1960), Finlayson 
and Cans (1967) and Garcia (1967). 

There are many variations in the ways of organizing the 
management team for commissioning. One is to design and 
impose the organization. An alternative, described by 
Horsley (1974), is to let this evolve by negotiation of roles 
among the managers with division of ‘ownership’ of parti¬ 
cular features among them. 

During commissioning there is likely to be conflict 
between individuals. This may be due, to some extent, to 
clashes of personality, but it is generally due mainly to 
differences of role and hence viewpoint which are inherent 
in the situation. 

There is also a need for specialists, particularly with 
regard to proprietary items such as rotating machinery. 
Many problems which would otherwise prove difficult and 
time-consuming can be resolved if an expert is present at 
the right time. 

The workload of individuals should be checked to ensure 
that it is not extreme. If someone is excessively overloaded 
and tired, he tends to become both less effective and more 

19.1.5 Planning and scheduling 

Plant commissioning requires the coordination of a large 
number of activities carried out by many different people. 
Some aspects for which planning is particularly important 
include: 

(1) commissioning activities - 

(a) pre-start-up activities, 

(b) initial start-up; 

(2) budgets; 

(3) documentation; 

(4) recruitment; 

(5) training. 

The design and construction of a large process plant is 
normally scheduled using such methods as the project 


evaluation and review technique (PERT) and critical path 
scheduling (CPS). Usually these methods are implemented 
on a computer. 

The scheduling of commissioning may be done as a 
separate exercise. An account of such scheduling has been 
given by Cans and Benge (1974), who quote typical figures 
of effort required of 1000 man-hours for a major project, or 
alternatively, 3 man-hours per major piece of equipment. 

The method of scheduling is broadly as follows. All 
activities are broken down into their constituent parts. The 
man-hours and machine-hours needed to perform each 
activity are determined. The length of time required to 
perform the activity is calculated on the basis of the avail¬ 
ability of men and machines. The duration of the activity is 
then assessed, taking account of such factors as running-in 
time. The conditions at which work can begin on the activ¬ 
ity are then determined. 

Again methods such as PERTand CPS may be used, but 
it is more common with commissioning than it is with 
design to do the scheduling by hand, using aids such as bar 
charts and arrow diagrams. 

Modifications are then made such as speeding up an 
activity or paralleling activities. When this has been done, 
it is possible to calculate the slack, which is the difference 
between the earliest and latest time at which an activity 
can start, to work out programmes for a day or a week, to 
determine the resources of men and machines required and 
to assess the expenditures involved. 

In many large plants, critical path features are the reac¬ 
tors or the instrumentation. 

It is easy to incur extra expenditure during commis¬ 
sioning and it is necessary to exercise close control on costs 
by controlling budgets for the various cost centres. 

The communication of information is crucial in 
commissioning and it is essential to ensure that adequate 
documentation is available at the time when it is needed. 
Planning should include, therefore, a review of the docu¬ 
mentation required. 

The recruitment of personnel needs to be carefully 
planned. There is usually some uncertainty about the pre¬ 
cise start time of various activities and this makes recruit¬ 
ment something of a problem. The problem is aggravated if 
there are difficulties at the recruitment end. In view of the 
uncertainties, recruitment in advance of requirement may 
be necessary, but it should be borne in mind that an exces¬ 
sive period waiting to start work can be demoralizing. 

The training of both the management and the workforce 
needs to be planned. Important aspects are the scheduling 
and documentation of training. 

19.1.6 Management preparation and training 

The effectiveness of the commissioning depends to a con¬ 
siderable extent on the thoroughness of preparation by 
management. The commissioning manager normally 
prepares himself by studying the process and the plant, 
by visiting or working on similar plants, by involvement 
in the project through work on design committees, by 
preparing plant documentation and operator training 
schemes, and so on. 

There are some particular aspects on which he is well 
advised to brief himself thoroughly. One is process infor¬ 
mation and know-how which has been purchased from 
outside. If problems arise in a bought-in process, it tends 
to be more difficult to put them right. Somewhat similar 
considerations apply to proprietary equipment, such as 
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package units and complex machinery; It is also desirable 
for him to have a good grasp of the general economics and 
contractual features of the project. These range from raw 
material supply contracts to acceptance conditions for 
equipment. 

It should not be assumed that it is only the process 
operators who need preparation and training for commis¬ 
sioning. These are required by management also. Some of 
the training requirements of the plant manager, and in 
particular the safety aspects, are discussed in Chapter 6. 

19.1.7 Operations preparation and training 

The operation of process plant requires the creation of a 
large number of systems and procedures. Many of these 
have to be formulated by the plant manager prior to and 
during commissioning. 

The operating instructions are particularly important. 
These should be drafted early on, so that they can be used 
for operator training, but they are likely to need some 
modification in the light of operating experience. 

It is also necessary to create a system of process records. 
The process log kept by the operator is one element in this, 
but there are numerous other records required for man¬ 
agement purposes. 

A process plant often receives its raw materials from or 
sends its products and/or by-products to other plants. The 
commissioning of such a plant tends to involve some degree 
of disruption of these plants. There is need, therefore, to 
coordinate the initial start-up so as to minimize such dis¬ 
ruption. It may also be necessary to make arrangements to 
deal with unusable materials produced during the start-up, 
such as off-specification product. 

Another feature that requires consideration is laboratory 
analysis and quality control. Safe operation requires a 
capability to analyse the material in the plant and ensure 
that it is within acceptable limits. This means working out 
methods of sampling and analysis, devising suitable tests 
and setting acceptance levels for raw materials, inter¬ 
mediates and products. It is also necessary to specify the 
associated paperwork. 

The main training of the process operators is usually 
carried out jointly, during commissioning, by the training 
department and the plant management. The principal 
objectives of the training are to familiarize the operators 
with the chemicals handled, with the nature of the equip¬ 
ment and its location on the plant and with the procedures 
for operating the plant. A more detailed account of some 
of the principles and content of the training is given in 
Chapters 14 and 28 and a list of some of the documentation 
required for training is given in Chapter 6. Specific train¬ 
ing in safety and loss prevention should be worked in with 
the other training material. 

It may be appropriate to use lectures for the commu¬ 
nication of certain basic information, but in general parti¬ 
cipative methods are likely to be more effective, and the 
commissioning situation lends itself well to the use of such 
methods. Workshops may be used to familiarize personnel 
with the hazards and with precautions and procedures. In 
some cases, use is made of a simulator to provide training 
in normal operating and emergency procedures. 

Further training is obtained on the plant itself, where the 
trainees become familiar with the layout and learn to 
operate equipment and instrumentation. Testing with safe 
fluids provides particularly valuable experience. Often a 
strong team spirit develops during this period of training. 


The operators should become familiar at an early stage 
with the hazards of the materials, the plant and the process 
and the alarm, fire and emergency systems. There should 
be drills for evacuation and fire fighting. 

The commissioning environment is one where partici¬ 
pation by the whole workforce is natural. It offers the 
opportunity, if management is so minded, to build the par¬ 
ticipative culture required for total quality management. 

Generally, the training activities reveal certain inade¬ 
quacies in the procedures and these should be rectified. The 
appropriate changes should be made in the documentation. 

Usually much of the instruction is done by managers and 
supervisors who can benefit greatly from this, since 
instructing others is an effective way of learning. It is 
necessary to allow a sufficient number of management 
personnel to ensure that training is effective. It is a not 
uncommon experience that the level of training achieved at 
the end of the commissioning period is not bettered during 
the subsequent life of the plant. 

Further accounts of process operator training during 
commissioning are given by Finlayson and Gans (1967), de 
Regules (1967), Kingsley, Kneale and Schwartz (1968—69) 
and R. Parsons (1971a). 

19.1.8 Maintenance preparation and training 

Prior to and during commissioning the maintenance engi¬ 
neer should set up the appropriate maintenance systems 
and documentation. Each major item of equipment should 
be given an identification code, which should he marked on 
the equipment itself. 

The maintenance manuals for the equipment should be 
obtained from the manufacturer and reviewed. Sometimes 
the manuals will he considered inadequate in some respect. 
If so, the manufacturer should be contacted concerning 
modification. More often, however, problems arise because 
the manuals have not been consulted. 

The maintenance of the equipment, both preventive and 
breakdown maintenance, should be planned. Schedules for 
regular preventive maintenance should be drawn up. 
A system of maintenance records should be instituted, 
containing details of the equipment in the plant and of 
the maintenance and modification work done. Details of the 
records required for pressure vessels, for example, are 
given in Section 19.3, but the records should not be limited 
to such equipment. The quality of the data available for 
analysis for reliability, availability and maintenance of the 
plant depends critically on these records. It is far easier to 
create an effective system initially than to try to improve a 
defective one. It is particularly important to obtain good 
information on the symptoms and causes of faults, and on 
the action taken. 

A system of spares holdings should be created. Impor¬ 
tant features of such a system are that it show clearly what 
spares are available, what spares are being consumed and 
what the delivery situations are. Only if this information is 
available, is it possible to make rational decisions on the 
spares holdings. 

A system for the control of slip plates should be devised 
so as to ensure that at each stage, such as normal operation 
or shut-down, all the slip plates required, but no others, are 
in position. The system should include provisions to pre¬ 
vent confusion with contractors’ slip plates. 

Maintenance personnel should check the plant during 
construction for accessibility and ease of maintenance. It 
may be necessary to make some alterations to the layout, to 
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the equipment or to the lifting arrangements. The mainten¬ 
ance function is also involved in many of the pre-start-up 
activities such as checking and testing, and suitable pre¬ 
parations need to he made for this. 

Maintenance personnel typically serve a number of 
plants and generally receive only limited instruction in 
respect of a particular plant, but they do need to be trained 
in the hazards of the materials, in the alarms and emer¬ 
gency procedures and in the maintenance of equipment 
specific to the plant. This may include some training at the 
vendor’s works. 

19.1.9 Pre-commissioning documentation 

It is difficult to overemphasize the importance of having a 
comprehensive and up-to-date set of documentation. The 
documentation as a critical feature of the management 
system was described in detail in Chapter 6. 

It is appropriate here, therefore, only to re-emphasize 
certain aspects that are of particular importance in com¬ 
missioning. The documentation available at the pre¬ 
commissioning stage should include: 

(1) operating manual; 

(2) operating instructions; 

(3) safety instructions; 

(4) permit system documents; 

(5) pressure vessel register; 

(6) pressure piping systems register; 

(7) protective device register; 

(8) maintenance systems and documents; 

(9) checklists. 

The plant should be covered by a comprehensive system of 
permits-to-work as described in Chapter 21. These are 
needed during the commissioning as much as during 
operation and should be developed in good time. 

The registers for pressure vessels, pressure piping sys¬ 
tems and protective devices should be established before 
commissioning. Details of individual items can then be 
entered as they are installed and examined. The registers 
are described more fully in Sections 19.3 and 19.4. 

There are several systems of documentation required for 
maintenance, as already described. 

A major part of commissioning is the checking of sys¬ 
tems, both of hardware and of software. This is greatly 
assisted if suitable checklists have been prepared. 

19.1.10 Modification control 

There should be a system for the control of modifications 
during commissioning, as described in Chapter 21, so as to 
ensure that a safe design is not rendered unsafe by a modi¬ 
fication. The system should ensure that proposed changes 
are identified and routed to the design authority and that 
there is a prompt response. 

There should be a single channel through which modifi¬ 
cations are communicated to the contractor, so that there is 
less risk of confusion. On a large proj ect, this may require the 
appointment of a commissioning modifications engineer. 

Any modification arising from the commissioning 
should be referred for examination by a hazard and oper¬ 
ability (hazop) study in a manner akin to that pertaining 
during design and using similar criteria to decide whether 
such a study is necessary. 

A modification proposed may be to an existing 
plant rather than to the plant or plant section being 


commissioned, in which case there will be additional 
matters to allow for. A major consideration is whether the 
modification is to be done during a plant shut-down or with 
the plant in operation. In either case, it is necessary to take 
account of the hazards, to see that the plant is in a stable 
operating condition and to ensure that contractors are 
aware of the hazards. 

19.1.11 Mechanical completion and pre-commissioning 

A particular aspect of pre-commissioning is mechanical 
completion. The term is applied to individual items of 
equipment and is used to cover the activities between 
installation and process commissioning. 

Mechanical completion ensures that the installed equip¬ 
ment is ready for commissioning and involves checking 
that it is installed correctly, that the component parts 
operate as specified and that any ancillary equipment is 
installed and working. Some typical checks and tests car¬ 
ried out on process equipment and machinery are listed 
in Table 19.4. 

The plant should be given a thorough visual inspection. 
A check should be made on all plant equipment and pipe¬ 
work to ensure that it is installed in accordance with the 
engineering drawings. Any discrepancies should be 
marked on drawings to show the ‘as built’ condition. These 
discrepancies should be reviewed and corrected if neces¬ 
sary. In one instance, for example, a safety shower was 
found to contain not water but caustic soda. The inspection 
should check for items such as loose bolts or missing valve 
wheels and for construction aids or debris left in the plant. 

The plant layout should be checked with respect to fea¬ 
tures such as: means of access and escape routes; floors, 
stairs and handrails; lighting; fire equipment and safety 
equipment. 

Mechanical equipment should conform to the specified 
codes and standards, should be installed in accordance 

Table 19.4 Some checks and tests carried out on 
process equipment and machinery during plant 
commissioning 

Pre-installation inspection, checking and testing of: 
pressure vessels 
process machinery 

Plant checking against piping and instrument diagram 
Checks on materials of construction 
Pressure vessel and system tests: 
inspection 
pressure tests 
leak tests 

protective devices tests 
Process machinery tests: 
inspection 
dry runs 
load runs 
performance runs 
Subsystem and system tests: 

dynamic safe fluid test (water test) 
dynamic process fluid test 
Also tests on: 
utilities 

instrumentation 
unit operations 
simulated faults 
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with the relevant drawings and should meet the perfor¬ 
mance tests specified. 

Each item of equipment received should be checked for 
compliance with specification. In some cases, this may 
mean witnessing aspects such as examination or testing at 
the manufacturer’s works. 

Errors in the materials of construction actually installed 
are quite common. A check should be made, therefore, on the 
materials. In critical applications it may be appropriate to 
carry out a 100 % check using a device such as a Metascope. 

The installation of internal fittings, such as trays, weirs, 
downcomers and thermocouple pockets in distillation col¬ 
umns, should be checked. It is important that these internal 
fittings have the right dimensions, are correctly located 
and are firmly secured. 

For rotating equipment, checks are required on founda¬ 
tions, lubrication systems, other ancillary systems, align¬ 
ment and vibration-related features. 

Piping systems should be checked for: conformity with 
pipework isometric and other drawings; the presence of 
fittings such as isolation valves, drain and sample points, 
etc; the orientation of fittings such as non-return valves, 
where applicable; satisfactory making of joints; adequate 
pipework supports and for satisfactory installation of 
expansion joints and bellows. A test sheet for piping sys¬ 
tems given by Horsley and Parkison is shown in Table 19.5. 
Much use is made of checklists in assuring mechanical 
completion. Many of the checklists given inTable 19.2 apply 
to this phase. 

For virtually all the features mentioned there are asso¬ 
ciated documents and/or drawings. The process of check¬ 
ing involves the marking up of drawings and the 
completion of test certificates and various forms of con¬ 
tractual certificate. 

There are also a number of pre-commissioning activities 
to be carried out on the mechanical systems. These activ¬ 
ities need to be coordinated both with the site construction 
manager and with the plant operations and maintenance 
management. 

Typically the pre-commissioning activities include: first, 
commissioning of the utilities so that services are available; 
checks on the individual equipments and systems for 
mechanical completeness and listing of missing items; pres¬ 
sure tests on pressure vessels and defined pressure piping 
systems; cleaning of vessels and flushing out of pipework; 
loading in of catalysts and packings and leak testing. 

The inspection and testing of pressure vessels is 
described in Section 19.3. 

At the same time, rotating machinery is run off-load and 
instrumentation is set up, calibrated and given functional tests. 

A list of some of the checks and tests carried out on pro¬ 
cess machinery such as pumps, compressors and cen¬ 
trifuges, is given inTable 19.6. 

It is common practice to fit start-up filters on rotating 
equipment to protect it from debris which could cause 
damage. Sensitive instrumentation that could be damaged 
is also temporarily removed. 

Subsystems are frequently tested using a safe medium, 
usually air or water, prior to testing with the process fluid. 
Compressors may be run on air on open circuit, and pumps 
may be run on water. 

19.1.12 Control systems 

The installation of the instrument and control system can¬ 
not be completed until most of the mechanical equipment is 


installed. Its installation tends to overlap with the com¬ 
missioning of the rest of the plant. 

Guidance on the installation and testing of instrument 
and control systems is given in BS 6739: 1986 Code of 
Practice for Instrumentation in Process Control Systems: 
Installation Design and Practice. 

Most control systems are now based on some form of 
computer control, and this is assumed in the account given 
here. The computer is first tested at the supplier’s works. 
These tests cover the computer hardware, the input/output 
equipment and any non-standard software. The functions 
to be performed through the configurable software are 
entered, such as signal conditioning, trend records, over¬ 
view displays, alarms, control algorithms, etc., and are 
then tested. Likewise, applications software for functions 
such as sequential control or fault diagnosis is entered and 
tested. 

Table 19.6 shows some of the checks carried out on 
instruments. Acheck should be made that the instrument is 
installed in accordance with the drawings and with the 
manufacturer’s instructions. It should also be checked that 
shipping restrictions have been removed. Usually parts 
and springs are wired down, critical parts are covered with 
protective coating and leads may be plugged; all these 
restrictions need to be taken out. 

Installation of the instrumentation is followed by check¬ 
ing. The responsibility for this normally lies with the con¬ 
tractor, but involvement of the user’s instrument personnel 
assists familiarization. 

Circuits should be checked for continuity from the panel 
to the instrument, and back. The movement of a control 
valve should be checked by ‘stroking’ it and that of a con¬ 
troller by observing its response to the output of the meas¬ 
uring element. The response of the alarms and interlocks to 
the measuring elements should be checked, as should the 
alarm settings and the actions of devices actuated by the 
interlocks. Similar checks should be made on trip systems. 

Instrumentation received will have been calibrated by 
the manufacturer but some degree of recalibration on 
site may be required, whether as a result of damage ELD, 
engineering line diagram; GA, general arrangement; NDT, 
non-destructive testing; NR, non-return; RV, relief valve 
sustained or as a matter of policy, and this necessitates 
appropriate test equipment. 

These checks are then followed by functional testing. 
Some functions are commonly executed by the main, 
computer-based system and some by separate systems. 

Early installation of the computer system allows pro¬ 
gress to be made with the testing of the instrumentation 
connected to it and of the functions allocated to it, in par¬ 
ticular of non-standard systems software, configurable 
software and applications software. 

Some common functions that are often separate from the 
computer system are (1) management information, (2) spe¬ 
cialized instruments, (3) packaged units, (4) control loops, 
(5) trips, (6) sequence control, (7) emergency shut-down 
and (8) stand-by supplies. 

Checklists for the functional testing of a control loop and 
of a sequence are given by Horsley and Parkinson (1990). 
The headings of the checklist for a control loop are (1) input 
channel, (2) faceplate/bar display, (3) trend display, (4) archi¬ 
ving, (5) alarm handling, (6) control functions, (7) output 
channel and (8) documentation. Those for a sequence are 
(1) declarations, (2) structure, (3) timing, (4) contention 
handling, (5) operator access, (6) recovery options, (7) recipe 



PLANT COMMISSIONING AND INSPECTION 


Table 19.5 Typical pressure piping test sheet (Horsley 
and Parkinson, 1990) (Courtesy of the Institution of 
Chemical Engineers) 


Design and Test Data 


Availability of the 
following data relevant 
to the piping systems 

Engineering line diagram 


Piping test schedule 


Piping arrangement drawing 


Pipe, line schedule 


Piping and valve 


Piping isometrics 


Piping test procedure 


Piping fabrication and 


Pipe support details and 
schedule 


Test certificates for 

Off-site fabricated piping 


Heat treatment or other 


Process/Utility valves, 
control valves, etc. 


NDT(X-or 7-ray, etc.) 


In-line process equipment 


Piping and valve material analysis certificates 


Welders qualification certificates 


Pre-test Visual Inspection 


Routing and size correct to ELD arrangement drawing/ 
piping isometric 


Installation of piping 
and piping components 
complete 

Joints bolts nuts and 
gaskets expansion loops and 
bellows 


Fixed anchors, sliding 
supports, guides spring or 
fixed hangers 


Jacket/jumpers, tracing 
conductive bolts/ 


Installation/orientation 
with respect to flow 

Process and utility valves, 

NR valves process control 
valves orifice plates and 
flowmeters 


Location of in line components for access, operation 
maintanence and safety of operatives 


Location and 
installation of 

Vents, drains, drip legs, drip 
rings, utility station 
connections, steam traps, 
filters, strainers line blinds, 
spectable plates, bypasses, 
instrumenttapping points 
for pressure, temperature 
and flow, plugs, rodding out 
points 



Installation of field mounted instruments that is 
Thermowells, pressure guages, etc. 


Check and ensure system devoid of insulation and paint 


Pre-test Preparation 


Prepare a written test plan and mark ELD/GAwith 
location of all spools, spades, blanks, vent valves, 
strainers, etc., agree with site manager and initiate 


Obtain spades, blanks, strainers, vent valves, bolts, 
nuts, gaskets and fabricate pipe spools 


Remove RVs for bench, testing and orifice plates for 
checking, make good joints or blank off 


Remove or spade off any control valve or instrument liable 
to damage under test pressure, replace with spool or make 
good joint and open any bypass valves 


Spade off or isolate process equipment with lower 
allowable pressure than test pressure 


Spade off all overflows, close drains, fit vent valves, 
ensure test medium available 


Calibrate test gauge and check range adequate for test 
pressure and detect pressure loss 


Define testing fluid 


Pressure Test Procedure 


Site manager’s clearance obtained, other contractors 
informed and safety notices positioned 


Ensure all test personnel are competent and briefed 
regarding extent, duration and limits of test 


Open up system, flush or blow through to remove mill 
scale/rubbish, fit temporary strainers and close 


Hook up test pump to line and test medium, open vents 
and commence filling system 


Conduct test per test procedure, attend to remedial 
works and bring to test pressure and hold 


Invite client’s representative to witness test 


Prepare test certificate 
and record 

System title, line numbers, 
plant reference 


Numbers, date, time and 
duration of test 


Pressure, test certificate 
number and obtain client’s 
signature 


Post-test Procedure 


Open up, drain down, remove and account for all spades, 
blanks, spools, plugs, vent valves, strainers and test 
equipment, flush or blow through and dry out 


With new gaskets, re-install at bench tested RVs, orifice 
plates, control valves, thermowells, flowmeters pressure 
gauges and remove safety notices, etc. 


Check installation complete and purge or chemically 
clean if part of take-over procedure 


Complete construction works, for example paint, 
insulate, colour code. etc. 
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Table 19.6 Some elements of the checking and testing of 
process machinery and instruments (after Gans and 
Benge, 1974) (Courtesy of the Institution of Chemical 
Engineers) 


Process machinery: 

Field disassembly and reassembly 
Lubrication system: cleaning and check on circulation 
(flow, temperature) 

Cooling water system: cleaning and check on circulation 
(flow, temperature) 

Pre-commissioning of instruments 
Check on free and unhindered rotation 
Check on anchor bolts 

Disconnection of piping to check that it does not stress 
equipment 

Installation of temporary filter 

Setting of system for ‘no load’ running 

Running of motor uncoupled 

Coupling of motor 

Check on alignment 

Check on vent system 

Check on seal system 

Dry run: check on vibrations and overheating of bearings 
Load run 
Performance run 

Instruments: 

Instrument checking against drawings and manufacturer’s 
requirements 

Removal of shipping restrictions 

Calibration 

Continuity check 

Movement check 

Alarms check 

Interlocks check 

Analysers check 


handling, (8) firmware interface, (9) sequence display and 
(10) batch logging. 

The pre-commissioning of the control system should be 
governed by formal procedures. Test forms should be spe¬ 
cified for each system to be tested. Guidance and model 
forms are given in BS 6739:1986. 

Proposals for modification to functional specifications 
or to the computer software should be referred for review 
by a hazop study in a manner similar to that pertaining in 
design. There should be a formal system to ensure that 
changes made to the computer software are recorded and 
that development of the software proceeds by way of dis¬ 
crete, identifiable and documented versions. 

It is necessary to ensure by formal means that the seg¬ 
regation of signals is not compromised by modification. 
Segregation of signals may be according to signal type, 
plant area and process function, and has implications for 
features such as intrinsic safety, electrical isolation and 
emergency shut-down. 

Formal control should be exercised over access to the 
computer system. Parties requiring access are control engi¬ 
neers commissioning the control system and process engi¬ 
neers commissioning the plant. Levels of access should be 
defined and controlled by means such as passwords or key 
switches. 


The checks on the instrumentation should be extended 
where practical to cover operation with process fluids and 
conditions that are realistic but nevertheless safe. 

Documentation for the instrument and control system 
should include: the system manuals; piping and instru¬ 
ment diagram; loop diagrams; wiring/circuit diagrams; 
termination rack layouts; tag number lists; database tables; 
sequence flow diagrams; etc. 

19.1.13 Process commissioning 

Process commissioning is begun only when the pre¬ 
commissioning is complete and the defects identified have 
been corrected to the extent judged necessary. This com¬ 
missioning may be undertaken on equipments or sections of 
plant as they become available, but only under close control 
so as to prevent hazardous interaction between the two 
activities of plant construction and process operation. One 
method of control is to require for the equipment a formal 
handover certificate verifying mechanical completion, 
with minor deficiencies listed. Before the process commis¬ 
sioning starts, it is usual to carry out a final check. Check¬ 
lists applicable at this stage are one of those most 
commonly given. 

The order in which the process commissioning is done 
may vary. The typical sequence cited by Horsley and 
Parkinson (1990) is (1) utilities, (2) laboratory, (3) raw 
material storage, (4) ancillary equipment, (5) reaction sys¬ 
tem, (6) work-up system and (7) product storage. Where 
there is no reaction system, the overall process system may 
be substituted for stages (5) and (6). 

The quality control laboratory needs to be in a position 
to take samples from the plant and conduct analyses as 
specified. If there is any deficiency in its ability to do this, 
which is sufficiently serious, commissioning should not be 
started. The laboratory needs also to be prepared to handle 
the augmented number of analyses likely to be required 
during the commissioning period. 

Ancillary equipment can often be commissioned sepa¬ 
rately from the equipment that it serves. Where this is pos¬ 
sible, it is prudent to do this, so that when commissioning 
of the main equipment is begun, the ancillary equipment is 
ready for use. 

A supply of raw materials is necessary for the process 
commissioning. These may come from a bulk storage or 
from other containments such as drums or transportable 
containers. Bulk raw materials storage will normally 
be commissioned some time in advance. It is also necessary 
to commission the intermediates and products storage, 
which is generally bulk storage. A checklist for the com¬ 
missioning of a storage tank is referenced in Table 19.2. 

The reaction section may be continuous or batch. Since 
this section is generally a critical one, its commissioning 
should be prepared with particular care. The commission¬ 
ing team should be at full strength and fresh. 

For a continuous reactor, the commissioning will aim to 
start-up and achieve a steady state as smoothly as possible. 
Critical features in achieving this are the utilities, the 
feeds, the machinery and the control system. A checklist 
for the commissioning of a continuous reactor is referenced 
in Table 19.2. 

It may well happen that the conditions obtained are not 
those desired or that some fault occurs and the product 
produced is off specification. Horsley and Parkinson 
advise that, provided it is safe to do so, it may be better to 
continue running until it is established that the desired 
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product quality can be made before shutting down, thus 
avoiding repetition of start-up and shut-down. 

For a batch reactor the problems are rather different. 
Here the requirement is to ensure that correct charges are 
made, that the desired sequence is followed, and that at 
each stage the process is controlled as specified. Critical 
features in this case are the charging, the control system for 
the sequences and the process conditions. 

For both types of reactor a full record of the trials should 
be kept to allow the design to be checked and any defi¬ 
ciencies experienced corrected. 

19.1.14 Handover: contractor project 

The conditions for acceptance of the plant from the con¬ 
structor by the operator are normally specified in the con¬ 
tract. A handover certificate is usually issued which 
contains a list of reservations of items on which further 
work is required. The handover needs to be carried out 
formally and with particular regard to safety. The plant 
should be in a safe condition when it is handed over. 

With a large plant it may be desirable to have selective 
handover of plant systems as they are completed. This 
applies particularly to such systems as steam-raising 
plant, steam pipework and cooling water systems. 

If parts of the plant are to be operated while other plants 
are still under construction, it is essential to take steps to 
ensure that these two activities do not interact in such a way 
as to create a hazard. The problem is similar to that arising in 
a major plant extension, and this is discussed in Chapter 21. 

A typical reservations checklist is given by L. Pearson 
(1977b) and is shown in Table 19.7. The checklist referenced 
in Table 19.2 is similar. 

19.1.15 Start-up and performance testing 

With the end of the process commissioning, the next stage 
is to charge the feedstocks and start-up and operate the 
whole plant and subject it to performance testing in order to 
determine whether it meets its specification. This initial 
start-up of the plant should be thoroughly prepared. It 
should be recognized that the start-up may be prolonged 
and arrangements made to relieve personnel so that they do 
not have to work excessively long hours. It is valuable to 
keep fairly comprehensive records of the start-up, and per¬ 
sonnel should be briefed on the recording requirements. 

All the formal systems for control of hazards and errors 
should be operational. These include in particular the 
permit-to-work systems as well as the systems for the con¬ 
trol of slip plates and of vents and drains. 

Before start-up, a careful check should be made by 
‘walking the plant’. The inspection should include a check 
on the state of all valves, which may be assisted by use of 
marked drawings and a register. Likewise, a check is 
required to ensure that all slip plates that need to be 
removed have been removed; again this can be done, using 
drawings and a register. 

It may be necessary during start-up to use filling and 
bypass lines that need to be closed again when the plant is 
operating. A register of such lines is needed to ensure that 
this action is taken. 

The disarming of certain trips may also be necessary 
during start-up, particularly those for low flow, pressure 
and temperature. There should be a formal system to cover 
this which ensures that such disarming occurs only as 
authorized and that the instruments are restored again 
when the need for disarming has passed. 


Checklists given by L. Pearson (1977b) of measures to be 
taken before process fluids are admitted are given in Table 
19.7. The checklists referenced in Table 19.2 are similar. 
Start-up procedures are described further in Chapter 20. 

The purpose of performance testing is to confirm that the 
plant can be operated at design conditions and that with a 
specified rawmaterials quality and at these conditions it will 
perform to specification in respect of throughput, yield and 
productquality.Theremayalsobespecificationsforfeatures 
such as utility usage, effluent quantities and compositions 
and reliability. A schedule of performance tests will have 
been drawn up and the levels of performance that the plant 
must meet specified. 

The feedstocks are charged to the plant and it is started up 
and operated to determine whether it meets these perfor¬ 
mance criteria. The outcome of the performance testing 
may be: (1) that the plant performs satisfactorily; (2) that 
the plant does not perform satisfactorily and there is mini¬ 
mal prospect that it ever will or (3) that the performance of 
the plant, whilst falling short of specification, can be 
remedied. In case (3) the contractor may either putthe matter 
right at his own expense or agree compensation with the 
client, whilst in case (2) the contractor has a financial liability. 

19.1.16 Handover: in-house project 

For a turnkey contract, the system of formal handover sets 
a term to the commissioning period. For an in-house pro¬ 
ject, the possibility exists that the commissioning period 
will become unduly extended. 

The commissioning period should not be terminated 
until the plant is giving reasonably satisfactory operation. 
The rate of improvement inevitably slows down when the 
additional support of the special commissioning team is 
withdrawn. On the other hand, the development of a plant is 
a continuing process and the commissioning cannot be 
allowed to drag on indefinitely. 

Some criteria for termination are given by Kingsley, 
Kneale and Schwartz (1968-69) as follows: (1) competence 
of operating staff; (2) reasonable level of plant reliability; 

(3) attainment of acceptable quality standards; (4) satisfac¬ 
tory use of resources (staff, materials, utilities, throughput) 
and (5) acceptable level of maintenance. 

19.1.17 Safety audit 

The plant should be given a comprehensive safety audit 
during the commissioning period. The audit should cover 
both hardware and software aspects. Details of such a 
safety audit have been given in Chapter 8. 

19.1.18 Commissioning problems 

Many of the problems associated with commissioning have 
been mentioned explicitly or are implicit in the comments 
made, but it is appropriate at this point to give a further review 
of some of the problem areas in commissioning.These include: 

(1) lack of process information; 

(2) design changes; 

(3) unsuitable equipment; 

(4) lack of expert advice; 

(5) lack of spares and supplies; 

(6) construction and maintenance errors; 

(7) safe fluid testing; 

(8) water traces; 

(9) operating errors. 
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Table 19.7 Checklists of measures to be taken before process fluids are admitted on a chemical plant (L. Pearson, 
1977b) (Courtesy of Hydrocarbon Processing) 


(а) Pipelines and pipework checklist 

(1) Screwed plugs in pipes, only permissible on air, 
water, nitrogen under 100 psi, 1| in. NB and below 

(2) Faulty welding 

(3) Correct joints 

(4) Odd sized bolts 

(5) Black bolts in cold joints 

(б) Faulty pipeline supports 

(7) Pipe not resting on supports 

(8) Are expansion slippers safe (e.g. will they push off 
structure when line is hot?) 

(9) Check spring hanger settings 

(10) Faulty spring hangers 

(11) Low point drains fitted where necessary, and 
high points vents 

(12) Lagging - missing, damaged, loose, etc. 

(13) Vent and drain blanks fitted where necessary 

(14) ‘Weep holes’ in relief valve exhaust lines, only on 
non-H/C or atmospheric, RVs 

(15) Have all slip plates been removed and spectacle 
plates turned? 

(16) Spring hangers - have restraining pins been 
removed? 

(17) Make sure pipework is up to the piping and 
instrument diagram specification 

(18) Necking-off hazard - is there any equipment or 
small bore pipe projection that can be accidentally 
broken off? 

(19) Are small branches, that is drains, sufficiently 
clear of pipe supports? 

(20) Do drain lines run to underground drains? 

They should not flow over paved areas 

(21) Flanges lagged up 


(b) ‘Chemicals and hydrocarbons in’checklist (jobs to be 
done before chemicals or hydrocarbons can be safely brought 
into the plant) 

(1) Complete all necessary reservations 

(2) Nitrogen purge systems prepared and leak tested 

(3) Blowdown system ‘live’ 

(4) Oil/water separator in commission 

(5) New perimeter fence erected, with'dematched area’ notices 

(6) Dematching hut in position and gateman available 

(7) Brief all construction people on consequence of plant 
becoming a ‘dematched area’ 

(8) Fire alarm I/C and all position tested 

(9) Compressed air sets in position 

(10) Fire extinguishers in position 

(11) Eye wash bottles in position 

(12) Personnel showers in position and checked 

(13) Fire hoses in position 

(14) Fire main 1/ C and check that hoses fit hydrants 

(15) Drench water sprays tested 

(16) Fire steam hoses in position and check they 
connect securely 

(17) Fire permits in use 

(18) Flush drains to prove them free from obstructions 

(19) Plant areas clean (fire hazards removed - rags, paper, 
wood, etc.) 

(20) Check plant lighting 

(21) Remove contractors’ buildings, tarpaulins, etc. 

(22) Remove non-flameproof equipment 

(23) Nominate shift fire teams and arrange practice alarm 

(24) List all possible welding jobs - get most done 
beforehand 

(25) Check that welding sets pass works electrical 
inspection 

(26) Check gas detectors 

(27) Hazard and safety notices to be in position 

(28) Obtain ‘means of escape’ certiciate 

(29) Check that segregation plates can be easily removed 
(3 0) Inform fire station 

(31) Invite safety department to inspect and pass comment 

(32) Carry out through search for matches 

(33) Make sure that neighbouring plants know how 
this affects them 

(34) Inform services (affect their drains) 

(35) Inform Factory Inspector and Alkali Inspector 

(36) Inform local authorities 

(37) Inform records sections 


H/C, hydrocarbon; I/C, in commission; NB, nominal bore; RV, relief valve. 


The difficulties inherent in a situation where basic infor¬ 
mation about the process is inadequate have already been 
mentioned. This is due sometimes, but by no means always, 
to the purchase of know-how from outside. 

Although some modifications of the original design are 
almost inevitable, they tend to be disruptive and expensive, 
and should be kept to a minimum. 

Unsuitable equipment can be a source of much trouble. It is 
sometimes suggested that equipment that comes as a package 
unit or is purchased from the main contractor can be trouble¬ 
some. It may well be, however, that in many cases the problem 
lies with the user. Certainly, it is essential that he gives a full 
specification for such equipment as for other items. 


The need for expert advice has already been mentioned. 
The behaviour of equipment during the running-in period 
may be different from that in normal operation. In one case, 
for example, commissioning was delayed because the 
lubricating oil from the bearing of a ball mill was found to 
contain a high concentration of metal particles: the vendor 
then confirmed that this was normal during running-in. 

Shortages of spares and other materials can result in 
delays. The need for an adequate spares system has already 
been emphasized, but provision of other items is equally 
important. 

Mistakes in construction are commonplace. In addition 
to the use of incorrect materials of construction for the 
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main equipments and pipework, errors often occur in 
minor items such as bolts or gaskets. For example, mild 
steel bolts may be fitted where stainless steel bolts have 
been specified, which in a low temperature application is a 
serious hazard. Likewise, a hazard can be introduced by the 
use of a wrong gasket. 

Safe fluid testing can sometimes introduce its own pro¬ 
blems. The use of water instead of a hydrocarbon means 
that the weight of the fluid is greater. There may be a risk of 
overpressuring the base of tall columns or of overstressing 
vessel supports. 

Likewise, it is not unknown for damage to be done to 
compressor systems by an air inlet line choked by poly¬ 
ethylene bags. 

Certain plants, notably cryogenic plants, are sensitive to 
even small quantities of water. Ice and hydrates can cause 
numerous problems, particularly on instrumentation. It 
may be necessary to remove water by blowing through the 
drains and by a warm air purge of the plant. 

Inexperience on the part of the process operators can 
result in maloperation that does considerable damage to the 
plant. For example, a pump may be allowed to run dry or to 
pump against a closed valve. 

Operation of equipment at higher temperatures than 
intended so that the creep rate is greatly increased can 
be particularly serious. It is quite possible to use up a 
large proportion of the creep life, say 30%, during the com¬ 
missioning. It is important, therefore, that this be avoided as 
far as possible and that the records be kept such as to 
allow an estimate of creep effects during commissioning to 
be made. 

Some specific problems arising during commissioning 
have been reviewed by Kingsley, Kneale and Schwartz 
(1968-69) and are summarized in Table 19.8. Design errors 
do occur, but are most frequent in detailed rather than 
fundamental aspects. Emulsions and foams may occur on 
the full-scale plant, even though these have not shown up 
in the pilot plant. Gas phase balancing errors can lead to 
difficulties with levels and flows. Lack of a net positive 
suction head causes pumps to cavitate. Heat transfer phe¬ 
nomena that can be troublesome include polymerization 
and scaling up. The former occurs more frequently than is 
admitted. Separation operations, especially those invol¬ 
ving particulate systems, give rise to many difficulties. 

Automatic control problems include measurement of 
unusual variables, the oversizing of control valves and the 
control of non-linear variables and of loops with large time 
lags and/or dead time. 

19.1.19 Commissioning hazards 

The process and plant designs should already have been 
subjected to the various checks described in Chapter 8. In 
particular, the hazop study conducted should have covered 
operations that are carried out only in commissioning. 
There are certain specific hazards associated with com¬ 
missioning. 

The pressure testing of equipment, which is described in 
Section 19.7, is a hazardous operation. The hazard is mini¬ 
mized by the use of hydraulic rather than pneumatic test¬ 
ing, but the energy released if the vessel fails is appreciable 
even with a hydraulic test, and it is important to ensure that 
the correct test procedure is followed and that personnel 
not involved in the test are cleared from the area. 

Many of the test and other operations carried out during 
commissioning require the use of temporary connections. 


Table 19.8 Some typical problems arising during plant 
commissioning (after Kingsley, Kneale and Schwartz, 
1968-69) (Courtesy of the Institution of Mechanical 
Engineers) 


Design errors: 
emulsions and foams 
venting arrangements 
liquid head arrangements 
Heat transfer phenomena: 
polymerization 
scaling up 

Separation operations: 

liquid-liquid separation, for example centrifuges 
liquid-solid separation, for example filtration 
gas-liquid separation, for example demisting 
gas-solid separation, for example gas filtration 
Automatic control: 
long time lags, dead time 
valve sizing 

control of non-linear variables, for example pH 
unusual measurements 
unsuitable equipment 
Leaks: 
sudden leaks 

leaks in vacuum equipment 
Vibration phenomena 
Mounting errors 
Mechanical handling equipment 
Materials of construction 


These are often hoses. Hose connections have been 
responsible for many accidents and particular care should 
be exercised with them. 

Plant are tested for leaks, but, even so, leaks tend to 
develop due to features such as loose joints, open valves, 
gasket and seal failures, vibration, thermal expansion and 
contraction and corrosion. It is important, therefore, to 
keep a lookout for such leaks. Leaks from high pressure 
plant can cause direct injury to personnel, leaks of flam¬ 
mable materials can cause a fire or explosion and leaks of 
flammable liquids can contaminate lagging, creating a 
further fire hazard. 

Nitrogen purging is a frequent operation in commis¬ 
sioning. The use of nitrogen for large-scale purging opera¬ 
tions involves the hazard of asphyxiation of personnel. 

Commissioning requires the use of utilities in large 
quantities. It is important to ensure that other plants are 
not run short of essential utilities and so put at risk. There 
is the further hazard of contamination of the utilities by 
fluids from the plant being commissioned. 

19.1.20 Post-commissioning documentation 

During the commissioning a large amount of information 
is generated which needs to be properly documented. 
Modifications are made to the plant; a wide variety of tests 
and examinations are performed on individual items 
of equipment and on the plant as a whole; the computer 
software is modified and parameters entered; modifica¬ 
tions are made to the systems and procedures and the 
associated documentation; reviews are made of safety and 
environmental features and there are matters to be carried 
forward. 
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Some principal features of the post-commissioning 
documentation are: 

(1) modifications records; 

(2) equipment examination records - 

(a) pressure vessels, 

(b) pressure piping, 

(c) protective devices; 

(d) equipment test records - 

(a) pressure and leak tests, 

(b) pressure relief valve tests, 

(c) rotating machinery tests, 

(d) instrument tests, 

(e) computer system tests; 

(f) computer records; 

(g) spare inventories; 

(h) safety reviews records - 

(a) hazop follow-up, 

(b) safety audit, 

(c) environmental review records; 

(d) reservation list. 

There should be records of any modifications made to the 
plant and also to the process. This aspect has already been 
discussed. 

The registers for the pressure vessels, pressure piping 
systems and protective devices should have been prepared 
prior to commissioning, but much information on the 
equipment and on its initial examination and testing will 
be entered at the commissioning stage. 

Records should be kept of the tests done on the whole 
range of equipment, including pressure vessels and the 
pressure piping system, pressure relief valves, rotating 
machinery, instruments and the computer system. Any 
modifications made to the computer software or to the 
parameters entered should be recorded. 

It is common practice to hold an inventory of commis¬ 
sioning spares. With the end of commissioning this should 
be replaced by the regular spares inventory, which should 
be documented. 

There should be records of any safety and environmental 
reviews conducted. The safety reviews should include any 
matters requiring follow-up consequent on the main hazop 
study or any further hazop studies performed as a result of 
commissioning modification and the post-commissioning 
safety audit. 

There will also have been modifications made to the 
various types of documentation such as operating instruc¬ 
tions, test procedures, etc., and these changes should now 
be incorporated and tidy documents produced. 


19.2 Plant Inspection 

Plant inspection is an essential aspect of the fabrication, 
construction, commissioning and operation of pressure 
systems. Accounts of plant inspection are given in Pressure 
Vessel Systems (Kohan, 1987) and Inspection of Industrial 
Plant (Pilborough, 1989) and by Erskine (1980). 

Relevant codes are the Pressure Vessel Examination Code 
(IP, 1993 MCSP Pt 12) and the Pressure Piping Systems 
Examination Code (IP, 1993 MCSP Pt 13). These are codes 
with international application but are aligned with the 
Pressure Systems and Transportable Gas Containers 
Regulations 1989. 


Another code is the Registration and Periodic Inspection 
of Pressure Vessels Code (ICI/RoSPSA 1975IS/107) (the ICI 
Pressure Vessel Inspection Code). This is now out of print but 
remains a good illustration of the fundamental principles 
of such codes. 

In the United States, the Guide for Inspection of Refinery 
Equipment by the API (1962—) has long been a principal 
inspection code but is now out of print. The Guide has some 
20 chapters that are listed in Appendix 27. It is being 
replaced by other publications. One of these is API RP 510: 
1989 Pressure Vessel Inspection Code: Inspection, Rating, 
Repair and Alteration. 

The following description is concerned mainly with the 
inspection of pressure vessels, pipework and protective 
devices, but it illustrates general principles for inspection 
which are relevant also to many other types of equipment. 

Selected references on plant inspection, testing and 
monitoring are given in Table 19.9. 

19.2.1 Regulatory requirements 

The statutory requirements for inspection of pressure ves¬ 
sels and the legislative background to these were described 
in Chapter 3. The basic position in the United Kingdom is 
that until 1989 there were statutory requirements covering 
the construction and maintenance, including inspection of 
steam boilers and receivers, air receivers, gasholders and 
gas cylinders and containers for transport, hut not for 
other pressure vessels. Thus, many pressure vessels con¬ 
taining hazardous substances were not subject to specific 
statutory controls. Moreover, the pressure system compo¬ 
nents which were the subject of statutory requirements 
were strictly limited. Principally they were the protective 
devices associated with steam boilers and receivers and air 
receivers. Thus many pressure system components con¬ 
taining hazardous substances, including pipework and 
other components listed in Section 19.3, were not subject to 
specific statutory requirements. However, although many 
pressure systems were not covered by specific statutory 
controls, the general duty to provide safe equipment, which 
is strengthened by the Health and Safety at Work etc. Act 
1974, might be considered to require that the integrity of 
pressure systems handling hazardous substances should 
not be less than that of systems handling steam and air. 

The Pressure Systems and Transportable Gas Contain¬ 
ers Regulations 1989 (the Pressure Systems Regulations), 
described in outline in Chapter 3, have introduced compre¬ 
hensive controls on pressure systems as well as pressure 
vessels. Guidance on these regulations is given in HS(R) 30 
A Guide to the Pressure Systems and Transportable Gas 
Containers Regulations 1989 (HSE, 1990). The regulations 
are supplemented by COP 37 Safety of Pressure Systems 
(HSE, 1990). The scope and general requirements of the 
Pressure Systems Regulations are described in Chapter 12 
and the those for inspection are described here. 

It is normal industrial practice to exercise close control of 
all parts of a pressure system, including both pressure 
vessels and other components, and to do this throughout 
the life of the system, starting with design and continuing 
through fabrication, installation, commissioning, opera¬ 
tion, inspection, maintenance and modification, by means 
of external and in-house standards and codes. The inspec¬ 
tion system is the main means of exercising this control 
after the design stage. 

Nevertheless, in the United Kingdom there have in the 
past been some differences between pressure vessels that 
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Table 19.9 Selected references on plant inspection, 
testing and monitoring 


API (Appendix27,1967 -RefineryInspection Guide, 1984 
Publ. 2002,2004,1990RP 574,1991RP 573,1992 RP 510,572); 
NRC (Appendix 28 Inspection)', Welding Institute (Appendix 
27,28); BCISC (1959/3); Honeyman (1960); Barnhart (1963); 
Kirchner (1967); ASME (1979- Pressure Piping Code, 1992 
Boiler and PressureVessel Inspection Code); Ministry of 
Technology (1969a); Kobrin (1970); Pilborough (1971,1989); 
Welding Institute (1972 Item 22); M.J. Neale (1974,1980); 
Collacott (1975,1976a, b, 1977a,b, 1985); ICI/RoSPA (1975 IS/ 
107); IMechE (1975/18); Dickenson (1976); Edeleanu (1976, 
1981); Fromme (1976); IChemE (1976/63); IP (1976,1993 
MCSP Pt 12,14); R. James and Bloch (1976); Harvey (1976, 
1979b); R. Morris (1976); Filetti andTrumpler (1977); 
NationalVulcan(1977); R.L. Clark (1978); Himmelblau (1978); 
HSE (1978b); R. King and Magid (1979); Czaga and Drury 
(1981); Kister (1981b); Marre and Reichert (1979); Sims 
(1980); London (1982); Anon. (1983f );Wamsley (1983); Coley 
(1985); Chowdhury (1986); Erskine (1986); Conroy (1987); 
Krisher (1987); R.L.White (1987); Plant Safety Ltd (1990); 
Depue (1991);Witherill (1991) BS (Appendix 27 Test 
Methods), BS 5500:1991 

Fault diagnosis 

Pau (1975,1981a,b); R. Morris (1976); Anon. (1977 LPB14, 
p. 17); Chamberlain (1980); Schweitzer (1982); Edgar etal. 
(1984); M.WJ. Lewis (1984); Marney and Foord (1984); 

M.J. Lewis (1993) 

Pressure vessels, piping, fittings 

Gibbs and White (1961); Buhrow (1971); O’Neill and Jordan 
(1972);Toogood (1972);Whenray (1972); Lautzenheiser 
(1974); ICI/RoSPA (1975IS/107); Dunt (1976); Erskine 
(1976b, 1980); Kussmaul, Blind and Ewald (1977); Ludwig 
(1978); IP (1979); Nichols (1979b); Jessop (1980); Kussmaul 
etal. (1980); McDermod (1982); Baker-Counsell (1985f); 
Guth and Clark (1985);Tayler (1985c); Burke and Moore 
(1990); K.P. Singh (1990); IMechE (1991/132,1993/154) 

BS 3889:1966-, BS 470:1984 

Columns: Bowman (1991) 

Tanks 

Truscott and Livingstone (1978); Hallan (1994) 

Glass equipment 

Lofberg (1965) 

Berger (1983) 

Rotating machinery 

Sela (1978); E.R. Bowen, Rotondi and Reid (1980); Finley 
(1980); B.R. Singh and Thomas (1980); Godse (1990,1991); 
R.F. Wong (1992) 

Pipelines 

AGA (Appendix 28); British Gas (Appendix 27 
Commissioning and On-Line Inspection, 1989 Comm. 1409); 
Holm (1984); Clerehugh, Shannon and Jackson (1983); 
Braithwaite (1985); Gordon, Murphy and Dean (1985); 

L. Jackson, Shannon and Adley (1985); Jamieson (1985); 
Watanabe and Himmelblau (1986); IGasE (1987IGE/ 
SR/10); Weisweiler and Sergeev (1987); Ellul (1989); 
Clerehugh (1991); Stouffs and Giot (1993) 


Pipeline location detection: British Gas (1987 Comm. 
1345,1989 Comm. 1410) 

Ammonia plants 

Truscott and Livingstone (1978); Madhavan and Sathe 
(1987); Prasek (1988); Burke and Moore (1990) 

Test procedures 

Shaw, Sykes and Ormsby (1980); British Gas (1986 Comm. 
1305); G.J. Gibson (1987); ASME (1991PTC1-1991) 

Structures: Collacott (1985) 

Steam plant: ASME (1980 PTC 39.1-1980); van Kapel 
(1990) 

Centrifuges: AlChE (1980 E-21) 

Driers, including spray driers: AlChE(1985E-23,1988E-26) 
Mixers: AlChE (1965 E-7,1986 E-25) 

Pressure vessels: API (1967- Refinery Inspection Guide, 
1992 RP 510,572); T.E. Taylor (1968-69); ASME (1992 
Boiler and Pressure Vessel Code) 

Distillation columns: AlChE (1962 E-10,1986 E-24) 

Heat exchangers: AlChE (E-15) 

Tanks: Truscott and Livingstone (1978); Briggs, Richards 
and Fiesinger (1986) 

Pipelines: British Gas (Appendix 27 Testing); ASME 
(1979- Pressure Piping Code); API (1991 RP 1110) 
Welds: Bartholome and Vasoukis (1975); Eisenberg (1975) 
Steam traps: ASME (1980 PTC 39.1) 

Valves: API (1992 RP 574); BS 6755:1986- 

Fired heaters: AlChE (1977 E-16,1989 E-27); API (1991 

RP 573) 

Steam turbines: ASME (1976 PTC 6—1976) 

Compressors: ASME (1974 PTC 10-1974); BS 1571:1975, BS 
3122:1990- 

Pumps: AlChE (E-5,1968 E-14,1984 E-22), Shull and 
Church (1991), BS 599:1966, BS 5316:1976- 
Fans: BS 848:1980 

Pressure relief devices: API (1960 RP 525,1974 Refinery 
Inspection Guide Pt 16,1992 RP 575); ASME (1988 PTC 
25.3-1988) 

Incinerators: ASME (1978 PTC 33) 

Other process equipment: AlChE (1977 E-18,1978 E-19, 
1980 E-20) 

Fire protection equipment: MCA (SG-13); P. Nash (1975b,c); 
R. Phillips (1981); NFPA (1994/41) 

Visual inspection 

Pilborough (1971,1989); Elliott (1976); Keymed Industrial 
(1983); Dooner (1986) 

Pressure testing 

Ferge (1972); Anon. (1979 LPB 26, p. 39); Hearfield (1980b); 
AGA (1981/36,1984/40); Kiefner and Forte (1985); Anon. 
(1986 LPB 72, p. 7); Kletz (1987d); Gwynn (1988); Dooner 
and Marshall (1989 LPB 86); HSE (1992 GS4) 

Leak testing 

Rubin (1961); Graham (1964); Roehrs (1967); Pilborough 
(1971,1989); Blackmar (1973); Bloomer and Smalley (1975); 
Leslie and Ferguson (1985); Anon. (1987t); Palluzzi (1987) 
BS 3636:1963 

Leak monitoring 

British Gas (Appendix 27 Leakage Control ); NRC 
(Appendix 28 Leak Detection); CONCAWE (1973 5/73); 

D. Harrison and Watkins (1983); Watanabe and Himmelblau 
(1986); Saiga etal. (1991); Stouffs and Giot (1993) 




19/16 PLANT COMMISSIONING AND INSPECTION 


Non-destructive testing 

ASTM (STP112,145, 213,1965 STP 371,1977 STP 624); 
NRC (Appendix 28 Nondestructive Examination)', Welding 
Institute (Appendix 27,28,1972/19,1974/27); McMaster 
(1959); Hogarth and Blitz (1960); D.M. Lewis (1961); 
Gleekman (1966); Nittinger (1966); Parrish (1966); Birchon, 
Bromley and Wingfield (1967); Ostrofsky (1968); Egerton 
(1969); D.J. Evans (1970);Welding Institute (1972/19,1973/23, 
1974/27); Birchon (1975,1988); Detlor (1975); Holloway and 
Kellum (1975); Callister (1976); Erskine (1976b); Gumm and 
Turner (1976); L M. Rogers (1976); British Gas (1979 BGC/ 
PS/CP/SND1,1987 Comm. 1346); Stinchcomb (1980); 
Buhrow (1983); Laskowski (1984); Nichols (1984); AGA 
(1986/45); R.K. Miller and McIntyre (1987); Weisweiler and 
Sergeev (1987); Institute of Materials (1989 B447); Kletz 
(1989d); Sattler (1989a-d, 1990); Dressel, Heinke and 
Steinhoff (1991); Sadler and Matusz (1994) BS (Appendix 
27 Non-DestructiveTesting) 

Radiography 

ASTM (STP 28A); Wiltshire (1957); L.A.White (1963); 
Rockley (1964); Halmshaw (1971); Welding Institute 
(1973/23); Dishart and Bruce (1975); Chynoweth (1986) BS 
2600:1973—, BS 5288:1976, BS 5650:1978, BS 2910:1986 

Dye penetrant methods 

BS 6443:1984 

Magnetic particle methods 

ASTM (STP 62,85,1965 STP 371); British Gas (1992 
DAT43) BS 6072:1981, BS 4069:1982 

Eddy current methods 

NRC (Appendix 28 Eddv Current Inspection)', G. Johnson 
and McFarlan (1978); ASTM (1981 STP 722); Holloway, 
Bauer and Pittman (1981); AGA (1989/64,1990/70,1992/87) 

Non-destructive identification 

Feigel (1958); Imgram and McCandless (1972); ASTM (1973 
STP 550); Duff (1976); Ostrofsky (1980-); M.J. Bowen and 
Campbell (1986); Anon. (1989 LPB 86, p. 23); R.J. Sherwood 
(1989) 

Condition monitoring, performance monitoring 

Collacott (1976b, 1977b); de Guerin (1977); Henry (1979); 

M. Neale and Associates (1979); M.J. Neale (1980); Sims (1980); 
B. Stephenson (1981); Stewart Hughes (1981); D.W. Butcher 
(1983); Ghia etal. (1983); D. Harrison and Heath (1983); 
R.M. Stewart (1983); Thomson and Deans (1983); Dodd 
(1984); Grantom (1985); Meeker (1985); D. Thomas (1985); 

P. Cooper (1986-); Pocock and Allen (1986); R. Smith 
(1986); Chesterton Int. (1987); English (1987); J.B. Smith 
(1987); G. Baker (1989); IMechE (1990/120); AGA (1991/16); 
Darling (1991); Rao (1991) BS (Appendix 27 Condition 
Monitoring ) 

Vibration monitoring 

Rathbone (1939); Collacott (1947,1975,1976a, 1977a,b); Yates 
(1949); Blake (1964,1966); Nittinger (1964); Buscarello 
(1968); Maten (1967,1970); C. Jackson (1969,1972b, 1974, 
1975—); Bently (1970); Fieldhouse (1970); R.L. Martin (1970); 
R.H.Wallace (1970); Beranek (1971); Tustin (1971); D. Wright 
(1971); Borhaug and Mitchell (1972); PJ. Brown (1972); 
Erskine (1973,1976a); Maddox (1973,1977); Bentley (1974); 
Black etal. (1974); Diehl (1974,1975); Lorio (1974); Nicholls 
(1974); Prentice, Smith and Virtue (1974); ASME (1975/34); 
Harry and Shipp (1975); IMechE (1975/24,1977/43); 


R.S. Morrow (1975); O’Dea (1975); Pekrol (1975); 
Schanzenbach (1975); Beebee (1976); Biggs (1976); Harker 
(1977); M.H. Price (1977); Irwin and Graf (1979); Broch 
(1980); Kitchen (1980); J.H. Maxwell (1980,1981); API (1981 
Std 678,1986 Std 670); Crawley and Erskine (1981); 

L. L. Fisher (1981);Tan and Dawson (1983); Goldman (1984, 
1986); Spencer andHansen (1985); Barratt (1986); Gorter 
and Klijn (1986); Leblanc (1986); Goggin (1987); G.R. Kent 
(1989); Serridge (1990); Scheithe (1992); B. Sheppard (1992); 
Haq (1993); Heckman (1993); Hussain (1993); ANSI S series, 
ANSIS2.2-1959,ANSIS2.5-1962,ANSIS2.10-1971,ANSI 
S2.4—1976; BS 4675:1976—;VDI2056:1964,VDI2062:1976 
Vibration: Morse (1936-); Collacott (1947); Jacobsen and 
Ayre (1958); C.T. Morrow (1963); Crede (1965); R.H.Wallace 
(1970); Cremer and Heckle (1973);Timoshenko, Young and 
Weaver (1974); Meirovitch (1975); C.M. Harris and Crede 
(1976); Bishop and Johnson (1979); Lalanne, Berthier and 
der Hagopian (1983) ISO 3945:1985 

Loose parts monitoring 

NRC (Appendix 28 Loose Parts Monitoring) 

Balancing and alignment 

C. Jackson (1971a,b, 1976a,b); Sandner (1978); Broch (1980); 

M. G. Murray (1980a); Bloch (1991) ANSI S2.7-1982; ISO 
2371:1974, ISO 2953:1985; VDI2060:1966 

Ultrasonics 

ASTM (STP 101,1986 E100); Filipczynski (1960);Tribolet 
(1964); Krautkramer and Krautkramer (1969); Newman, 
Ryden and Lamb (1970); Ostrofsky and Heckler (1970); 
Welding Institute (1971/15); Marlow (1975); Weatherburn 
and Clinck (1976); Browne and Constantinis (1983); Fousek 
(1983); Crocker (1985); Schmer and Goodman (1990); AGA 
(1991/71) BS 3923:1972-, BS 4331:1972-, BS 4124:1991 

Thermal image monitoring, thermography 

Prescott (1972); H.C. Wright (1973); Bichard and Rogers 
(1976a,b); Norda (1976,1977); Weismantel and Ramirez 
(1978); Lister (1980); Imgram and McCandless (1982); 

B.G. Jones and Duckett (1985); Tuss (1985); Anon. (1986m); 
Baker-Counsell (1986c); Anon. (1990a); Miljure (1992); 

B. Smith (1992) 

Risk-based inspection 

Ichikawa (1985,1987); Research Task Force on Risk-Based 
Inspection Guidelines (1992) 

Underwater inspection 

Bayliss, Short and Bax (1988) 

Acoustics, acoustic emission monitoring 

NRC (Appendix 28 Acoustic Emission Monitoring)', Witt 
(1971a); ASTM (1972 STP 505,1975 STP 571,1979 STP 697, 
1987 E1211,1989 E610-89A, E1062,1991E569-91E1); 
ASME (1975/56,128,1982,1983,1989); Diehl (1975); 
Koerner, Lord and Deisher (1976); Nichols (1976a); Parry 
(1976,1980); Bloch (1977b); Anon. (1979 LPB 27, p. 59); 
Fowler (1980,1986,1987,1988,1992); Fowler and 
Scarpellini (1980); Adam (1982); Cole (1983,1988,1990, 
1992); L.M. Rogers and Alexander (1983);Treleaven (1983); 
Wylde and Shaw (1983); International Study Group on 
Hydrocarbon Oxidation (1985); M.P. Kelly (1985); Pollock 
(1986); L.M. Rogers (1986); Clough (1987); Heiple and 
Carpenter (1987); SPI (1987); Frieshel and Jones (1988); 
Prasek (1988); Zhang (1988); AGA (1989/62,63); 
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Monsanto Corp. (1990); AAR (1991); Cole and Hunter 
(1991); Hewerdine (1991,1993); Vahaviolos, Pollock and Lew 
(1991); Gandy and Bailey (1992); Bouchard, Payne and 
Szysko (1994) 

Strain measurement 

Shannon (1973); L.M. Rogers (1976) 

Electrical resistance measurement 

Moreland (1976) 

Holography 

Butters (1971); H.M. Smith (1975) 

Wear monitoring, oil analysis, debris examination 

Bond (1965); A.E. Davies (1972); Drust (1972); M.G. Murray 
(1975); D. Scott (1975); Collacott (1976a,b, 1977b); Ricca and 
Bradshaw (1984); Wilkie (1987a); Rudston (1989) 

Radioactive tracers 

Brennan (1962); Charlton (1976) 

Corrosion monitoring 

Ailor (1971); R. Lee (1972); Luddeke (1975); Hancock and 
Clifton (1976); Rowlands and Moreland (1976); Arnold 
(1978); Harrell (1978); Hines (1978); Moreland and Hines 
(1978); Rak (1978); Whitney (1978); Rothwell (1979); Anon. 
(1981d); Strutt, Robinson and Turner (1981); Biarnes (1982); 
Sague and Davis (1982); Asher etal. (1983); Dawson, Eden 
and Hladky (1983); Diacci, Rizzi and Ronchetti (1983); 

M.J. Robinson and Strutt (1983); Baker-Counsell (1985b,g); 
Gregory (1985); M. Turner and King (1986). 

External corrosion: Batterham (1985) 

Interpretation 

Welding Institute (1969,1972/19); D. Scott and Smith (1975); 
Bellingham and Lees (1976a,b); Boogaard (1976); IMechE 
(1976/31); Collacott (1977b) 


were covered by specific regulations and those that are not. 
In general, with the former the letter of the law applied, 
whilst with the latter the degree of flexibility based on 
engineering judgement was rather greater. 

One aspect that is of particular importance is the 
inspection interval. Basic statutory inspection intervals 
were 14 months for steam boilers and 26 months for large 
steam boilers, steam receivers and air receivers. In princi¬ 
ple, dispensations for longer intervals might be granted by 
the Health and Safety Executive (HSE), but these were 
difficult to obtain and it remained the case that the statu¬ 
tory inspection intervals for these items are an inhibiting 
factor in industry. 

As described in Chapter 12, the Pressure Systems 
Regulations extend the scope of pressure systems to cover 
essentially all systems that depart significantly from 
atmospheric pressure. They create a requirement for a for¬ 
mal system of records and examinations. Regulation 5 
requires that certain information be provided about the 
pressure system, Regulation 8 that there be a written 
scheme of examination, Regulation 9 that examinations be 
conducted in accordance with this written scheme and 
Regulation 13 that records be kept. 

Regulation 5 requires that sufficient information be 
provided about the pressure system in respect of design, 
construction, examination, operation and maintenance, and 
about any repairs or modifications made to it. 


Regulation 8 requires that there be a written scheme for 
the periodic examination by a competent person of 

(a) all protective devices; 

(b) every pressure vessel and every pipeline in which (in 
either case) a defect may give rise to danger; and 

(c) those parts of the pipework in which a defect may give 
rise to danger. 

It states that such a scheme shall not be drawn up unless it 
is suitable and 

(a) specifies the nature and frequency of examination; 

(b) specifies any measures necessary to prepare the 
pressure system for safe examination other than those 
it would be reasonable to expect the user (in the case of 
an installed system) or owner (in the case of a mobile 
system) to take without specialist advice; and 

(c) where appropriate, provides for an examination to be 
carried out before the pressure system is used for the 
first time. 

Before the regulations were made, there was much discus¬ 
sion as to how ‘pipework’ should be covered. The term has 
been widely defined but the Guidance states that the effect 
of Regulation 8 and of COP 37 is to exclude most ‘pipework’ 
from the written scheme. 

In contrast to the legislation which they replace, the 
regulations do not give specifed intervals for any equip¬ 
ment; the intervals formerly specified for steam boilers 
and for steam and air receivers are not carried forward. In 
practice, however, these intervals are often retained 
in examination schemes. 

Regulation 9 requires that the examination be performed 
by a competent person and that a written report be pro¬ 
duced of the examination. The report should: state which 
parts have been examined, the condition of the parts and 
the results of the examination; specify any repairs or 
modification required and the date by which they should be 
done; give the date beyond which the equipment should not 
be operated without further examination and state whether 
the scheme of examination is suitable or whether it needs 
modification, and if so why. 

Regulation 13 requires that records be kept which 
include: the basic information specified in Regulation 5; 
the report of the last examination; the previous reports 
where they contain information on whether the system is 
safe to operate or whether any repairs or modifications to 
the system can be carried out safely and information on 
any postponement of an inspection beyond the previously 
specified date. 

The statutory controls are not the only external influence 
which industry has to consider. Adherence to a system 
similar to the statutory one is generally a condition of 
obtaining insurance. Much inspection of process plant is in 
fact carried out by insurers. 

19.2.2 Inspection bodies 

There are a number of parties who may conduct inspection 
of a pressure vessel during its manufacture. They include 
(1) government, (2) the manufacturer, (3) the user, (4) an 
insurer and (5) a consultant. The same set of parties, except 
for the manufacturer, may undertake inspection during 
operation. 
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Government inspection may be undertaken for two 
rather different purposes. One is to assure the quality of the 
government’s own purchases, and the other is for regu¬ 
latory purposes. 

In the United Kingdom, the requirements of government, 
particularly in defence, have greatly influenced the evolu¬ 
tion of inspection systems. Mention should be made in 
particular of the Aeronautical Inspection Directorate 
(AID), renamed in 1969 the Aeronautical Quality Assur¬ 
ance Directorate (AQD), which has developed an inspection 
system which is the basis of many contracts by government 
and by other organizations. Some basic principles of the 
system are that: there must be verification that every 
requirement of every specification and drawing has been 
met; there is a complete chain of responsibility for inspec¬ 
tion at every stage and there are full inspection records.The 
manufacturer’s inspection system has to be approved. His 
subcontractors also have to be approved or else special 
arrangements made. The full requirements of the system 
are expensive, however, so that a user who does not require 
this degree of control may adopt a modified system. 

It will be apparent that this system was a forerunner of 
the QA systems, based on BS 5750 and ISO 9000, which are 
now becoming widespread throughout industry. 

A different type of government involvement is inspec¬ 
tion by government inspectors in relation to statutory 
requirements under such legislation as the Factories Act 
1961 or the Nuclear Installations Act 1959. 

The manufacturer usually has his own inspection sys¬ 
tem to assure quality. In some cases, the user may be 
involved in specifying the type of inspection system which 
the manufacturer should operate. Often the user sends his 
inspectors to carry out inspections of the equipment dur¬ 
ing its manufacture. This is routine procedure with large oil 
and chemical companies. 

Pressure vessels are often built to the survey of insurers, 
particularly in the oil and chemical industries. The oldest 
and best known insurance organization is Lloyds of 
London and the certification 100 A1 at Lloyds is an accepted 
cachet of high quality. 

Inspection is also carried out by consultant engineers, 
some of whom specialize in this work. 

19.2.3 Approval organizations 

In the United Kingdom, the Report of the Committee of 
Enquiry on Pressure Vessels (Ministry of Technology, 1969a) 
led to the setting up of the Pressure Vessel Quality Assur¬ 
ance Board (PVQAB) in 1981. The PVQAB operates a sys¬ 
tem of approval for inspection organizations. 

In the United States, an approval system is operated by 
the National Board of Boiler and Pressure Vessel Inspectors 
(the National Board). 

19.2.4 Inspection organization 

Within the company, it is essential to have a management 
system which ensures effective control of all aspects of the 
plant, and in particular of the pressure system, throughout 
all the stages of its life. Such a management system was 
described in Chapter 6. 

The inspection organization plays a key role in this sys¬ 
tem. It is responsible for the initial inspection of new 
equipment during its fabrication and construction, and for 
the periodic inspection of operating equipment throughout 
its working life. 


The framework within which the inspection organiza¬ 
tion operates is determined by the design and operating 
authorities. The design authority should determine the 
parameters within which the plant is to operate, should 
specify the design codes and should carry out the actual 
design. It should also specify the standards for fabrication, 
construction and testing and should prescribe the docu¬ 
mentation required on these aspects. The operating 
authority should provide a code for the regular inspection 
of the plant. In addition, it should create a system to control 
both plant and process modifications. 

The inspection organization may be a part of the design 
authority or it may be an external body such as an engi¬ 
neering inspection agency or an insurance company, but 
whatever arrangement is adopted the inspection organiza¬ 
tion should be independent of the operating authority. 

In many cases, the inspection work is divided between 
the company’s own inspection organization and an exter¬ 
nal inspection agency. In particular, outside inspectors are 
commonly used to carry out the statutory inspections of 
steam boilers and receivers and air receivers. 

The inspection organization is concerned normally with 
pressure vessels, pipework and protective devices. The 
inspection of many other types of equipment such as 
rotating machinery or instrumentation is carried out by the 
appropriate specialists, who are usually not part of the 
inspection organization. 

19.2.5 Competent persons 

Inspection is a specialist matter andshouldbedone only by a 
qualified inspector. For statutory equipment such as steam 
boilers, the competence of the inspector has been a specific 
requirement of the Factories Act 1961, section 33(9). 

The question of the competent person for the inspection 
of boilers and pressure vessels was considered in the Report 
of the Advisory Committee on the Examination of Steam 
Boilers in Industry (Honeyman, 1960) (the Honeyman 
Report). The report states in connection with the require¬ 
ment for a competent person: 

What appears to be contemplated is that the person 
should have such practical and theoretical knowledge 
and actual experience of the type of machinery or plant 
which he has to examine as will enable him to detect 
defects or weaknesses which it is the purpose of the 
examination to discover and to assess their importance 
in relation to the strength and functions of the particular 
machinery or plant. 

The Pressure Systems Regulations 1989 require that cer¬ 
tain functions such as approval of the scheme of examina¬ 
tion for pressure vessels be done by a competent person. 
This is discussed further in Section 19.3. 

19.2.6 Inspection in manufacture and operation 

Inspection activities cover the stages of (1) manufacture, 
(2) commissioning and (3) operation. It is hardly necessary 
to emphasize that the existence of an inspection system and 
the presence of an inspector has an important influence on 
the quality of the work done. Frequently the function of 
inspection is combined with that of progressing the work, 
since this has been found to be an effective way of reducing 
lead times. 

An important aspect of inspection is planning. Specifi¬ 
cations and drawings should be made available to the 
inspector as early as possible so that he can plan the stages 
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of inspection. The inspector should try to make sure that 
the manufacturer’s personnel are fully informed of the 
inspections required at the different stages of fabrication. 
The inspection of features such as the base metal proper¬ 
ties and the dimensions of components should be timed to 
fit in with the overall fabrication schedule. 

The results of inspections should be recorded as detailed 
inspection/test reports, but in addition it is normal to issue 
release notes or inspection statements, which are less 
detailed, or, in the case of non-acceptance, a rejection note. 

The inspection of welds and other features is discussed 
below. 

Inspection of pressure vessels during commissioning 
covers essentially similar features together with pressure 
and leak tests and other commissioning tests as described 
in Sections 19.7 and 19.8. 

Inspection of pressure vessels during operations is car¬ 
ried out regularly according to a system such as that 
defined in Section 19.3. This relies basically on visual 
examination supplemented by other methods of non¬ 
destructive examination and non-destructive testing 
(NDT) and by condition monitoring methods. In some 
cases, pressure testing is necessary. 

The basic principles of inspection apply also to the 
inspection of other equipment such as rotating machinery. 
In this case, however, the inspection is particularly con¬ 
cerned with checking the condition of the main compo¬ 
nents of the machine, the performance of the machine 
under the various test conditions specified and the align¬ 
ment and balancing of the installed machine, as well as the 
condition and performance of ancillary equipment such as 
lubrication systems. 

A certain amount of information is available in the 
human factors literature on errors in inspection. The 
main finding is that the probability of detecting a defect 
decreases as the probability of the defect decreases. 

19.2.7 Inspection of welds 

One of the most important aspects of the inspection of 
pressure vessels is checking the quality of welds. The 
methods of welding were described in Chapter 12. Mini¬ 
mum inspection requirements for the fabrication of welds 
are laid down in BS 5500:1991 and other standards. Welds 
are also one of the main aspects inspected in regular 
inspections during operation. 

An inspection system exercises control of weld quality by 

(1) approval of welders, (2) specification of welding materi¬ 
als, (3) specification of welding methods, and (4) exami¬ 
nation/testing of welds. 

There are standard qualifications and tests for various 
classes of welder, including BS 1295:1987, BS 4872:1976- 
and the American Society of Mechanical Engineers 
(ASME) Boiler and Pressure Vessel Code, Section IX. In 
general, a welding method is specified, giving details of 
electrodes, welding rods, flux, shielding, metal prepara¬ 
tion, actual welding, heat treatment and testing. 

Visual examination of a weld should ensure (Pilborough, 
1971): 

(1) freedom from undercut, cracks, craters, blowholes 
and marked irregularities; 

(2) correct profile; 

(3) good appearance - a smooth even finish and freedom 
from pockets will avoid the possibility of stress con¬ 
centrations leading to cracking; 


(4) smooth joints where new electrodes have been started; 

(5) good penetration at the root of the weld, as judged 
from the bead on the underside (in the case of a butt 
weld) prior to the application of the sealing run. 

Illustrations of typical weld defects are given in BS 499: 
1980 - Welding Terms and Symbols. 

In some cases pressure vessels are fabricated on site, 
because they are too large to he transported.The conditions 
of site fabrication often make it advisable to carry out more 
comprehensive checks on materials and welds than the 
minimum code requirements. 

19.2.8 Inspection of other features 

Other features that are examined in pressure vessel 
inspection include: 

(1) equipment dimensions; 

(2) base metal; 

(3) surface condition; 

(4) wear situations; 

(5) high stress situations; 

(6) dissimilar metals; 

(7) stray electric currents; 

(8) gaskets, seals and joints; 

(9) lagging; 

(10) protective finishes; 

(11) venting and draining; 

(12) access. 

The inspection should check that the dimensions of the 
equipment are within the permitted tolerances, that the 
base metal used is that specified, and that it has met 
the requirements. The condition of the metal surface 
should be inspected for defects that may give rise to crack 
growth. A check should be made on assemblies which 
may be subject to wear and on stress raisers such as sharp 
angles, changes of section and attachments such as noz¬ 
zles or lugs. The presence of dissimilar metals and stray 
electric currents that may give rise to corrosion should be 
considered. The suitability of joints, gaskets and seals 
should be checked, as should that of the lagging and 
protective finishes. The adequacies of the vents and 
drains on the vessel should be confirmed and the means 
of access reviewed. 

Other aspects of inspection, such as tests during com¬ 
missioning and pressure and leak testing, are considered in 
Sections 19.1,19.7 and 19.8, respectively. 

19.2.9 Inspection register and records 

It is essential to keep a register of the equipment to be 
inspected and records of the results of the inspections. 
The precise contents of the register depend on the item 
concerned, but in general should include: 

(1) identification number, order number and drawing 
number; 

(2) specification, design parameters, process fluids; 

(3) inspection/test reports during manufacture; 

(4) inspection category, interval, method; 

(5) special features relevant to deterioration, failures; 

(6) materials/parts list; 

(7) design life/remnant life prediction; 

(8) date of entry into service. 



9/2 0 PLANT COMMISSIONING AND INSPECTION 


Such a register is equally appropriate to pressure vessels, 
protective devices, rotating machinery or instrumentation. 

The specific information requirements given in the 
Institute of Petroleum (IP) Pressure Vessel Examination 
Code for the registration of pressure vessels are described 
in Section 19.3. 

For a pressure vessel there should be full information on 
the inspections/tests done during its manufacture, 
including reports on tests on the material of construction, 
radiographs or other records of tests on welds, and reports 
on pressure and leak tests. 

Reports of the regular inspections/tests on the equip¬ 
ment should be prepared and filed in the register. These 
reports should generally cover the results of the main 
inspection/ test and of any additional monitoring and tests, 
any deterioration or failure detected and repairs carried 
out, and any modifications or changes of duty. 

19.3 Pressure Vessel Inspection 

The inspection of pressure vessels and their protective 
devices is crucial to the maintenance of the integrity of the 
pressure system and is a principal activity of the inspection 
authority. 

Pressure vessels come within thePressureSystems Regu¬ 
lations 1989 and are covered in the guidance HS(R) 30 and in 
COP 37. A relevant code is the Pressure Vessel Examination 
Code by the IP (1993 MCSP Pt 12). The account of pressure 
vessel inspection given here is based primarily on this code. 

19.3.1 Competent person 

The IP Pressure Vessel Examination Code defines the 
competent person as the person or body authorized by the 
user to draw up or approve the scheme of examination 
and to perform the examination. In the United Kingdom, 
the competent person may be company personnel or an 
external body specializing in the inspection of pressure 
vessels. The attributes of the competent person are given 
in COP 37. 

19.3.2 Design authority 

The design of the pressure vessel is the responsibility of the 
design authority. The IP Pressure Vessel Examination Code 
states that the design authority may be a vessel design 
group responsible to the user, an authorized design con¬ 
tractor, an independent design consultant, the engineering 
authority or the competent person. In some countries, the 
design authority is a state agency. 

19.3.3 Engineering authority 

The engineering authority is responsible for the main¬ 
tenance of the pressure vessel and is authorized to do this 
by the user. 

19.3.4 Definition 

In considering an inspection scheme, it is necessary first to 
define the equipment which is to be brought within the 
scope of the pressure vessel inspection system. The IP 
Pressure Vessel Examination Code defines a pressure vessel 
as follows: 

A closed vessel consisting of one or more independent 
chambers, any or each of which may be subject to an 
internal pressure greater than 0.5 barg, or as defined by 
National Legislation. 


The code explicitly excludes vessels subject to pressure 
solely by static head and storage tanks designed and con¬ 
structed to codes and standards such as BS 2654 and 
BS 2594. 

This definition of a pressure vessel supersedes that given 
in the previous Pressure Vessel Inspection Safely Code by the 
IP (1976 MCSPPt 12) which was: 

(i) A closed vessel of not less than 0.1 m 3 capacity con¬ 
sisting of one or more independent chambers any or each 
of which may be subject to an internal pressure greater 
than 70 mbar gauge or less than 930 mbar absolute or 

(ii) A closed vessel wherein Px7>l where P is the 
internal pressure in bars and 7is the enclosed volume in 
cubic metres. 

Also of interest is the definition given in the ICI Pressure 
Vessel Inspection Code for vessels falling within the scope of 
that code: 

A pressure vessel is a closed vessel of any capacity con¬ 
sisting of one or more independent chambers, any or each 
of which is or may be subjected to internal pressure 
greater or less than atmospheric. 

This definition includes: 

(a) Vessels not normally subject to internal pressure but in 
which internal pressure would occur in the event of a 
failure of any part, maloperation, isolation or other cir¬ 
cumstances, for example, the failure of an internal steam 
coil in a vessel not adequately vented to prevent a pres- 

(b) Vessels in which vacuum can develop, for example, 
steam receivers, steam condensers and other vessels 
containing condensable gases and vapours. 

For other equipment the code states: 

Consideration should also be given to the registration and 
routine inspection of other items which although not 
normally classified as pressure vessels may give rise 
to hazardous situations, e.g. fired equipment, large 
diameter piping, expansion bellows, and pressurized 
equipment subjected to erosive or corrosive conditions. 
Where cross-country pipelines are employed special 
arrangements will be necessary for their routine exami¬ 
nation. 

The IP Pressure Vessel Examination Code defines a protec¬ 
tive device as: 

A device designed to protect the pressure system against 
system failure and certain devices designed to give 
warning that system failure might occur, safety valves, 
bursting discs or combination of both. 

The definition of a protective device given in the ICI 
PressureVesselInspection Code is: 

Any automatic device which protects equipment from 
over-pressure, over-temperature, over-filling, corrosion, 
explosion or other hazardous conditions; including 
atmospheric vents, lutes, flame traps, deadweight flaps, 
some non-return valves, relief valves, fusible plugs, 
bursting discs and instrumental trip systems, many of 
which incorporate an advance alarm indication. 
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The ICI Code also lists equipment which, subject to 
approval, may be excluded from the requirements of the 
code itself, although it may still require some degree of 
inspection. Some important items in this list are vessels 
subject to static head only or to applied pressure not 
exceeding +0.07 bar (+1 lbf/in. 2 ) and not subject to corro¬ 
sive risks; parts of prime movers and machines driven by 
them; protective devices whose failure does not result in a 
hazard. 

19.3.5 Registration 

A pressure vessel identified as such should be registered 
before it is brought into service. The system given by the IP 
Pressure Vessel Examination Code is broadly as follows. 

The vessel should be given an identification number and 
there should be created for it a records file and, where 
applicable, a scheme of examination. 

The required contents of a records file as described in the 
IP Code are essentially similar to those given in the ICI 
Pressure Vessel Inspection Code, which are as follows: 

For equipment the file shall include its identification 
number, the order number, the drawing reference, speci¬ 
fications, materials lists, inspection reports during 
manufacture, test certificates relating to the material and 
tests on the completed equipment. It shall also contain 
details of the design conditions, the process fluids, of the 
expected operating conditions, and the date of entry into 
service. In addition, the file shall include a note of any 
special kinds of deterioration - for example, stress 
corrosion - to which the equipment maybe subject. 

The IP Code requires that the information include the safe 
operating limits of the vessel and, where available, the limit 
criteria for its retirement with notes on their derivation. 

The record file should give the equipment classification 
and inspection categories. It should specify the initial and 
subsequent inspection intervals, the type of inspection to 
be done and, where appropriate, the inspection acceptance 
standards. 

To this initial information should be added other relevant 
information generated during the life of the equipment. 
This includes: reports of periodic inspections and tests; 
reports of failures, failure examinations and repairs; 
records of corrosion and other condition monitoring and 
details of modifications or changes of duty. Where a docu¬ 
ment cannot be kept in the record file itself, there should be 
a cross-reference to it. 

The registration of protective devices is along broadly 
similar lines. The IP Code requires that its record file con¬ 
tain information on its function and operation, including 
drawings, a specification of the duty, supplier’s details on 
the style and type of device, materials of construction and 
any special features, together with reports of examinations 
and tests. 

19.3.6 Classification 

A pressure vessel is generally classified according to 
whether or not it is subject to legal requirements for inspec- 
tion.ThelP Pressure Vessel Examination Code assigns aves- 
sel to Classification A or B. Class A includes all vessels and 
their protective devices that are subject to periodic examina¬ 
tion in accordance with national or regional legal require¬ 
ments. The extent of the classification is therefore a 
function of the country or state where the vessel istobeused. 
Class B includes all vessels and their protective devices not 


assigned to Class A. It covers all vessels which are not 
subject to legal requirements. 

Where the legal requirements permit, Class A pressure 
vessels and protective devices should be further allocated 
to a grade, namely to Grade 0,1, 2 or 3, as described in 
Section 19.3.7. 

The code states that the regulatory requirements in the 
United Kingdom are primarily aimed at ensuring the peri¬ 
odic examination of equipment which contains significant 
quantities of stored energy from compressible fluids and 
that many items of equipment which contain flammable or 
toxic liquids are effectively exempt, but that such exami¬ 
nation is nevertheless beneficial, and it suggests that the 
inspection philosophy described for Class A equipment be 
applied to Class B equipment also. 

19.3.7 Grading 

As stated above, the IP Pressure Vessel Examination Code 
requires that, where legal requirements permit, the pres¬ 
sure vessel and its protective device be allocated to a grade. 
The grade indicates the maximum interval that may elapse 
between major examinations. 

The principles of grading are that: the vessel receives a 
pre-commissioning examination before entering service; it 
is initially allocated to Grade 0 and is given a first thorough 
examination after a relatively short period of service; it is 
then either retained in Grade 0 or allocated to Grade 1 or 2; 
subsequently, after a second thorough examination, it is 
allocated to Grade 1, 2 or 3 and, as it approaches the end 
of its design life or predicted remaining life, it is reallocated 
to a lower grade if necessary. 

Equipment is allocated to Grade 0 when it first enters 
service and also where the foreseeable deterioration is at a 
fairly rapid rate, but still consistent with this grade, or 
where there is insufficient knowledge of operational effects 
to predict its behaviour in service. 

Equipment is allocated to Grades 1 or 2 where deteriora¬ 
tion is at a rate that is predictable and consistent with the 
grade, the knowledge of its actual behaviour justifies allo¬ 
cation to the grade or where there are reliable means of 
assessing the operational effects and/or the associated 
deterioration. 

Equipment is allocated to Grade 3 where deterioration is 
at a rate that is low and consistent with the grade, or the 
knowledge of actual service conditions justifies allocation 
to the grade. 

Transfer between grades, either upwards or downwards, 
is made on the basis of the examinations. 

Avariation to this procedure may be used where a group 
of vessels are substantially the same with regard to design 
and construction and to conditions of service so that they 
may reasonably be expected to deteriorate in a similar way 
and, where the appropriate grade is Grade 1 or above, 
grading may be based on sample examinations of vessels in 
the group. The IP Code gives the rules governing this pro¬ 
cedure. 

Another permitted variation applies where a sub¬ 
stantially new vessel is the same with regard to design and 
construction as an existing vessel and is to be used under 
the same, known conditions of service. In this case, the 
vessel may be allocated the same grade as the existing 
vessel. 

A grading review of a vessel is required in any one of the 
following circumstances: (1) there is a significant change in 
its conditions of service; (2) an abnormal incident has 
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occurred which could affect its deterioration; (3) on-line 
inspection indicates a significant change in its condition or 
(4) it is approaching its design life, or it is proposed to 
extend its service life beyond the design value. 

The grading of protective devices is subject to two gen¬ 
eral principles. The interval between examinations for the 
device should not exceed that for the vessel protected and it 
should not exceed that given in Section 19.3.8. Factors 
which govern the inspection interval are discussed in 
Chapter 13. 

19.3.8 Examination intervals 

The maximum examination intervals given in the IP Pres¬ 
sure Vessel Examination Code are shown in Table 19.10, 
Section A.The longest of these maximum intervals is there¬ 
fore 144 months, or 12 years. On the basis of the classification 
of equipment it is possible to specify inspection categories 
that define the interval between inspections. 

19.3.9 Examination principles 

The IP Pressure Vessel Examination Code states that the 
purpose of examination is: 

To ensure that equipment remains in a satisfactory 
condition for continued operation consistent with the 
prime requirements of safety, compliance with statutory 
regulations and economic operation until the next 
examination. 

The code distinguishes between the pre-commissioning 
examination, the first examination (after the vessel has 
been put into service) and subsequent examinations. The 
purpose of the pre-commissioning examination is to ensure 
that the examination and tests specified for the manu¬ 
facture of the equipment have been done, that the docu¬ 
mentation is in place with a record of any significant 
defects, that there is a basis for the assessment of deterio¬ 
ration in future examinations and that a check is made to 
ensure that no damage has occurred since the examination 
during manufacture. The first in-service examination 
is done to ensure that any defect in design or materials 
is detected and that suitable components are selected, 


examined and measured, so as to form the basis for the 
assessment of corrosion or wastage in future examinations. 

The ICI Pressure Vessel Inspection Code defines the 
objectives of inspection as follows: 

The objective of vessel inspection is to detect any deterio¬ 
ration such as corrosion, cracking or distortion indi¬ 
cating possible weaknesses that may affect the continued 
safe operation of the vessel. Primarily inspection should 
be visual, but it shall be supplemented by other tech¬ 
niques and measurement when necessary to determine 
the extent of any losses of thickness, pitting, cracking, etc. 
Resorting to a pressure test as the sole method of periodic 
inspection is an inferior alternative to examination and 
should be used only when examination is not practicable 
or the findings of the visual examination are incon¬ 
clusive. 

The inspection should also include an examination of 
protective devices. 

19.3.10 Examination practices: pressure vessels 

The maximum interval between examinations is set by the 
grade to which the vessel is allocated. The IP Pressure Vessel 
Examination Code gives a number of additional factors that 
are to be taken into account in deciding on the actual inter¬ 
val. These include: any regulatory requirements; the works 
policy; the severity of the duty; the performance of other 
vessels on similar duty; the ability to carry out meaningful 
on-stream inspection and the remaining design life and the 
predicted remaining life. Other factors in particular appli¬ 
cations are catalyst life and regeneration intervals, and 
performance of internal linings. It is also necessary to 
consider the consequences of failure. 

The IP Code also refers by way of caution to three aspects 
that may require special attention: (1) lined vessels; (2) inter¬ 
nal fittings and (3) external lagging, cladding and fire¬ 
proofing. Lining failure may cause a vessel to deteriorate 
rapidly and this should be taken into account in setting the 
examination interval. Internal fittings hinder inspection 
and are often difficult to remove, but may also promote 
deterioration; they should be removed as necessary to 
permit adequate examination. Parts of the outer shell and 


Table 19.10 Maximum examination intervals for pressure vessels, protective devices and piping systems (Institute of 
Petroleum, 1993 MCSP Pts 12 and 13) (Reproduced by permission) 


A Pressure vessels and protective devices 


Equipment 


Recommended maximum examination period (months) 



Grade 0 

Grade 1 

Grade 2 

Grade 3 

Process pressure vessels and 

36 

48 

84 

144 

heat exchangers 

Process storage vessels 

60 

72 

108 

144 

Protective devices 

24 

36 

72 

- 

B Piping systems 

Equipment 


Recommended maximi 

im examination period (months) 



Grade 0 

Grade 1 

Grade 2 

Grade 3 

Piping systems 

36 

48 

84 

144 
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features such as anchor bolts, skirt attachments and saddle 
support surfaces may need to be checked at each examina¬ 
tion. Sections of lagging or fireproofing may need to be 
removed for examination where conditions favourable to 
external corrosion exist. 

There are various preparatory measures that need to be 
taken before an inspection is carried out. The inspector 
should brief himself on the history of the vessel and, where 
applicable, on that of other similar vessels. 

The vessel is normally taken out of service, isolated, 
emptied and cleaned. The surfaces of the vessel are then 
exposed and prepared for examination. This may involve 
such measures as cleaning of internal surfaces, the removal 
of some internal fittings and the removal of lagging from the 
outside of the vessel. These activities should be covered 
by appropriate procedures and permit-to-work systems, as 
described in Chapter 21.The examination is then carried out. 

The matters to be recorded following the examination 
are given in the IP Code. They should cover: the scope of the 
examination; the items examined and the examination 
techniques used; a qualitative description of the findings 
backed up by a quantitative measure; a specification of any 
repairs or modifications required; relevant repair and non¬ 
destructive examination procedures; a note of any changes 
to the safe operating limits or any remaining life predic¬ 
tions; a review of the scheme of examination and the grad¬ 
ing previously selected and a date for the next examination. 
The Code gives an appendix containing examples of 
examination reports. 

The IP Code recognizes the value of on-stream methods 
of examination, but states that in general they complement 
rather than replace visual examination. 

19.3.11 Examination practices: protective devices 

The IP PressureVesselExamination Code divides protective 
systems into pressure-actuated devices and other devices. 
In the former category it discusses regular safety valves, 
pilot-operated safety valves and bursting discs. 

For a safety valve, the code requires that the valve be 
removed, immediately tested on a suitable test rig to deter¬ 
mine the pressure at which the valve would have lifted in ser¬ 
vice and the results recorded. The valve should then he 
dismantled, cleaned, repaired, restored, lapped and reset 
tothecorrectcolddifferentialtestpressure.Forpilot-operated 
safety valves, where it is not normally practical to remove the 
main valve, the testing is confined to the pilot valve. 

In the second category the IP Code deals with: fusible 
plugs; thermal sensors, alarms and trips; sensors and 
alarms on other variables and non-return valves. 

The Code also discusses the need to maintain adequate 
overpressure protection of the vessel at all times and the 
isolation practices necessary to achieve this. 

19.3.12 Modification and repair 

The IP Pressure Vessel Examination Code requires that any 
modification necessary on a pressure vessel should be 
approved by the design authority and the competent per¬ 
son, and that the design and execution of any modification 
or repair be under the control of the latter. The effect on any 
protective devices on the piping system of any modifica¬ 
tions or repairs on that system should be considered. 

Records should be kept of any modifications or repairs 
carried out, and should include the original approval pro¬ 
cedure documents together with details of materials and 
techniques, drawings and test certificates. 


Where a vessel has been subject in its construction to 
stress relief or heat treatment, welding should not be under¬ 
taken without the approval of the competent person. 

19.3.13 Vessel testing 

The IP Pressure Vessel Examination Code discusses five 
forms of testing: (1) strength testing, (2) leak testing, (3) NDT, 

(4) destructive testing and (5) materials analysis. Any of 
these may be used at the various stages of the vessel’s life, 
but the last two are used mainly at the construction stage or 
in connection with modification or repair. 

Pressure and leak testing are considered in Sections 19.7 
and 19.8, respectively. 

19.3.14 Defects and failures 

An account of defects and failures in pressure vessels is 
given by Pilborough (1989). Some of the features that may 
be revealed by an inspection are: 

(1) internal corrosion; 

(2) surface defects; 

(3) weld defects; 

(4) wear defects; 

(5) deposits and debris; 

(6) high stress situations; 

(7) inadequate drainage; 

(8) external corrosion. 

Some of the types of internal corrosion that occur in pro¬ 
cess plant were described in Chapter 12. Corrosion may 
reduce not only the thickness of the metal but also its 
strength. Methods of detection include visual examination, 
thickness measurement, including measurements by 
ultrasound and corrosion monitoring. Changes to a base 
metal such as graphitization or hydrogen embrittlement 
may be detected by metallurgical examination. 

Surface defects such as cracks or pitting arising from 
such causes as corrosion, erosion or crack growth may be 
detected by visual examination or by methods such as 
magnetic particle or dye penetrant techniques. The avoid¬ 
ance of surface defects is particularly important where 
there is a risk of fatigue failure, since a rough surface can 
greatly reduce the fatigue strength of steel. 

These methods of crack detection may also be used to 
find weld defects. The latter include weld deterioration, 
which may arise due to the roughness of the weld, or weld 
decay, which is intergranular corrosion and occurs in aus¬ 
tenitic stainless steels. 

Cracks may be particularly serious as they can grow and 
leadtofailure.Itisoftenpossibletoremoveacrackfromaweld 
by chipping it out and depositing fresh weld metal. Small 
cracks may sometimes be stopped by drilling small holes at 
the extremity, which reduces the stress concentrations. 

Wear on moving parts is normally found by visual 
examination and may result in failure if not rectified. 

The build-up of deposits of materials and/or debris can 
create a hazard if equipment such as pipes and valves, or 
devices such as vents, pressure relief valves or instruments 
become blocked. Such deposits are revealed by visual 
examination. 

There are certain undesirable features which, insofar as 
is practicable, are eliminated in the original design of 
equipment, but which may be reintroduced by plant modi¬ 
fications. High stress situations may have been created at 
vessel connections or at lugs. There may be elements that 
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are under stress due to the limitation of thermal expansion 
or contraction. Similarly, modifications may have been 
made which impede complete drainage.Visual examination 
may detect these facts. 

External corrosion of the plant is detected by visual 
examination. It can be severe and can lead to serious loss of 
metal thickness. 

19.4 Pressure Piping Systems Inspection 

Most releases occur not from pressure vessels but from the 
associated piping systems. Inspection of piping systems is 
therefore important. Pressure piping systems come within 
the Pressure Systems Regulations 1989 and are covered in 
the guidance HS(R) 30 and in COP 37. A relevant code is 
Pressure Piping Systems Examination Code (IP, 1993 MCSP 
Pt 13). The account of pressure piping systems inspection 
given here is based primarily on this code. The provisions 
of this code largely mirror those of the Pressure Vessel 
Examination Code (IP, 1993 MCSP Pt 12), and to the extent 
that this is so they are not repeated here. 

The definitions of the competent person, the design 
authority and the engineering authority for piping systems 
are essentially the same as those for pressure vessels, with 
the former term being substituted for the latter one. 

19.4.1 Selection 

The process of selecting pipework for registration in the 
inspection system is the equivalent to the definition of 
pressure vessels. The IP Pressure Piping Systems Examina¬ 
tion Code states that pipework need not be physically 
identified on site by an identification number provided the 
major plant items are so marked that pressure piping 
attached to them can be identified. 

The criteria for selecting piping for registration are that 
there is a legal requirement or that the piping is known or 
suspected to deteriorate and its failure would give rise to an 
unacceptable situation. 

19.4.2 Registration 

For new piping the IP Pressure Piping Systems Examination 
Code recommends that the records file contain the identi¬ 
fication number, the drawing references, the isometric 
drawing, specifications, materials lists, the material 
specification, the constructional acceptance and test 
certificates, the design data/safe operating limits, the 
scheme of examination and the retirement limit criteria. 

For existing piping the Code states that where some of 
the above information is not available, the recommended 
records are the identification number, the drawing refer¬ 
ences, an up-to-date drawing/sketch defining the extent of 
the system, the piping specification to which repairs or 
modifications should conform, the design data/safe oper¬ 
ating limits, the scheme of examination and a recent 
assessment report. 

For piping systems there is no process corresponding to 
that of the classification of pressure vessels, but it is 
necessary to make arrangements to ensure that unregis¬ 
tered piping systems are nevertheless examined so that 
they remain fit for continued service. 

19.4.3 Grading 

The IP Pressure Piping Systems Examination Code states 
that, where legal requirements permit, a registered piping 
system should be allocated to a grade. 


The principles of grading are that: the piping system 
receives a pre-commissioning examination before entering 
service; it is allocated to Grade 0 unless knowledge of ser¬ 
vice conditions is such that it can be allocated to Grade 1 
or 2; subsequently, following the first and second thorough 
inspections and on the basis of knowledge of service condi¬ 
tions and of the condition of the piping system, it is allo¬ 
cated to Grade 1, 2 or 3 and as it approaches the end of its 
design life or predicted remaining life it is reallocated, 
where necessary, to a lower grade. 

The detailed rules for grade allocation and grading 
review of piping systems given in the Code are essentially 
similar to those for pressure vessels. For protective 
devices, the code refers to the IP Pressure Vessel Examina¬ 
tion Code. 

19.4.4 Examination intervals 

The maximum examination intervals prescribed by the IP 
Pressure Piping Systems Examination Code are given in 
Table 19.10, Section B. The longest of these intervals is thus 
144 months, or 12 years. 

19.4.5 Examination principles 

The purpose of the examination of piping systems given by 
the IP Pressure Piping Systems Examination Code is essen¬ 
tially the same as for pressure vessels. 

The Code distinguishes between the pre-commissioning 
examination, the first examination (after the piping system 
has been put into service) and subsequent examinations. 
For the former it also draws a distinction between new and 
existing installations. For new installations the purpose of 
the pre-commissioning examination is to ensure that the 
examination and tests specified have been done and that 
the documentation is in place, whilst for an existing 
installation it is to establish any history of deterioration and 
to ensure that the condition of the pipework is surveyed. 
The first in-service examination is done to ensure that 
any defect in design, fabrication or materials is detected 
and that suitable components are selected, examined and 
measured, and the results recorded, so as to form the 
basis for the assessment of corrosion or wastage in future 
examinations. 

19.4.6 Examination practices 

The maximum interval between examinations is set by 
the grade to which the piping system is allocated. The IP 
Pressure Piping Systems Examination Code gives in Appen¬ 
dix A a number of additional factors which are to be taken 
into account in deciding on the actual interval. They include: 
any regulatory requirements; the age and general condition; 
the severity of the duty, in terms of corrosion, erosion and 
vibration; the proximity to systems containing corrosive 
fluids; any abnormal flows; any vulnerable components 
such as bellows and expansion joints and small bore con¬ 
nections; the pipework supports; any special features and 
the ability to carry out meaningful on-stream inspection. It 
is also necessary to consider the consequences of failure. 

Any necessary preparatory measures should be taken 
before an examination is carried out.These may include the 
provision of a means of access and lighting and preparation 
of surfaces. 

The matters to he recorded following the examination 
are given in the IP Code. They should cover: the scope of the 
examination; the items examined and the examination 
techniques used; a qualitative description of the findings, 
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backed up by a quantitative measure; a specification of any 
repairs, renewals or modifications required; the relevant 
repair and NDE procedures; any changes to the safe oper¬ 
ating limits or any remaining life predictions; a review of 
the scheme of examination and of the grading previously 
selected and a date for the next examination. 

The IP Code also refers by way of caution to several 
aspects that may require special attention: (1) lined pipes; 
(2) external lagging and fireproofing; (3) valves and fit¬ 
tings; (4) buried piping and (5) bellows. The considerations 
relevant to lined pipe and external lagging and fire¬ 
proofing are broadly similar to those pertaining to pres¬ 
sure vessels. Valves and fittings need special consideration 
on account of possible casting defects, regions of high 
turbulence, local stress concentrations due to thermal 
expansion and other stresses and vibration. Buried pipe¬ 
lines are usually protected from external corrosion by 
cathodic protection (CP), but there are vulnerable areas 
near ground level where protection can break down and 
corrosion occurs. The CP systems themselves should be 
subject to periodic examination and a record kept of the CP 
potentials. Consideration should be given to the inspection 
of the inside of the pipeline by an ‘intelligent pig’. Bellows 
should be examined immediately after commissioning to 
check: that the relative movement is being absorbed as 
intended and examined periodically to look for cracks or 
leaks; for any distortion or yielding of anchors or seizing or 
binding of guides; for any unanticipated movement of the 
parent piping and for any permanent distortion of thebellows. 

If the pipework has been subjected to any abnormal 
operating conditions or other abnormal conditions such as 
fire, appropriate checks should be made. Possible causes 
of deterioration may be: damage to bellows; cracking of 
ferritic alloy or austenitic stainless steels; hardening of 
air-hardening ferritic alloy steel or zinc embrittlement 
of stainless steel. 

The examination practices for protective devices are 
essentially as given in the IP PressureVessdExamination Code. 

19.4.7 On-stream examination methods 

The IP Pressure Piping Systems Examination Code states 
that some piping systems may be satisfactorily examined 
by means of on-stream methods and gives in Appendix B 
guidance on methods that may be applied. 

The methods described are: (A) walking the main; 
(B) selective and (C) extensive non-destructive testing 
(NDT) for thickness gauging; (D) selective and (E) exten¬ 
sive removal of insulation and external examination; 
(F) monitoring by indirect measurement; (G) use of thermal 
indicators and thermal imaging; (H) profile radiography 
and (I) flash radiography. The methods of indirect meas¬ 
urement cited include corrosion probes and coupons and 
pH recording. The thermal indicators mentioned are tem¬ 
perature sensitive paints or crayons. Profile radiography 
involves firing a beam tangential to the wall of the pipe and 
produces a profile image of the internal and external profile 
of the pipe. Flash radiography is similar but gives infor¬ 
mation on the external surface. 

Features to be checked in walking the main include: 
damage to the pipe; damage to insulation; the condition of 
joints, valves and fittings; lack of adequate support; lack of 
ground clearance; vibration or excessive movement; leaks 
from or onto the pipe and abuse of the pipe. 

The Code also gives in the same appendix the following 
off-stream methods: (J) hammer testing; (K) pressure testing; 


(L) internal examination; (M) interval viewing and 
(N) special techniques. 

19.4.8 Modification and repair 

The IP Pressure Piping Systems Examination Code requires 
that any modification made to a registered pressure system 
should be approved by the design authority and any repair 
be subject to the approval of the competent person. 

The effect on any protective devices on the piping system 
of any modifications or repairs on that system should be 
considered. Following modification or repairs a grading 
review should be carried out. 

Records should be kept of any modifications or repairs 
carried out, and should include the original approval pro¬ 
cedure documents together with details of materials and 
techniques, drawings and test certificates. 

Where there may have been in the original construction 
of piping system a requirement for heat treatment, a check 
should he made and, if it was required, reference should be 
made to the engineering authority or competent person 
who should then define any requirements. 

19.4.9 Piping system testing 

The account of testing given in the IP Pressure Piping Sys¬ 
tems Examination Code follows essentially that given in the 
IP Pressure Vessels Examination Code, and deals mainly 
with strength testing by hydraulic or pneumatic pressure 
tests and with leak testing. 

19.5 Non-destructive Testing 

Non-destructive testing techniques are used to detect 
defects in equipment such as pressure vessels and pipe¬ 
work during both its construction and its operational life. 

Equipment is tested by NDT testing methods during 
fabrication. Pressure vessel codes such as BS 5500: 1991 
lay down detailed NDT requirements. These are minimum 
requirements. For some pressure equipment, it may be 
necessary to carry out more extensive testing. This is 
particularly the case where equipment has been fabricated 
on site. 

It may be necessary to carry out further NDT of some 
equipment during construction and commissioning. 

The condition of the equipment during the operation of 
the plant is checked by NDT, particularly, but not exclu¬ 
sively, during plant shut-down. 

Once the plant is operational, it becomes difficult to 
obtain access for visual examination of some parts of the 
equipment, for example the internal surface of a refrig¬ 
erated storage tank, so that NDT techniques that can be 
used externally become very attractive. 

Accounts of NDT are given in Non-Destructive Testing 
(Hinsley, 1959), Techniques of Non-Destructive Testing 
(Hogarth and Blitz, 1960), Principles and Practice of Non- 
Destructive Testing (Lamble, 1962), Non-Destructive Testing 
(Birchon, 1975), Pressure Vessel Systems (Kohan, 1987), Non- 
Destructive Testing of Large Diameter Pipe for Oil and Gas 
Transmission Lines (Weisweiler and Sergeev, 1987) and 
Inspection of Industrial Plant (Pilborough, 1989). 

Some NDTand monitoring methods are: 

(1) visual inspection - 
(a) horoscopes; 

(2) radiography - 

(a) X-rays, 

(b) y-rays; 
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(3) ultrasound; 

(4) magnetic methods - 

(a) magnetic particles, 

(b) magnetic prints, 

(c) eddy currents; 

(5) dye penetrant methods; 

(6) stress wave emission monitoring; 

(7) holography; 

(8) electrical measurements - 

(a) resistivity, 

(b) capacitance. 

These methods are now described in more detail. 


19.5.1 Visual examination 

Visual examination is the original and most widely used 
method of inspection and is non-destructive. Accounts are 
given in Visual Examination (Keymed Industrial, 1983) and 
by Elonka (1975), Kohan (1987) and Pilhorough (1989). 

Visual inspection is effective in detecting surface defects 
ranging from cracks to corroded areas, and defective 
assemblies. 

The range of visual examination can be extended by the 
use of aids such as periscopes or horoscopes. Boroscopes 
are available with lens or fibre optics. They are used to 
examine the condition of internal components such as the 
blades of turbines and compressors. 

BS 5500 requires only visual examination for Category 3 
pressure vessels. 

19.5.2 Radiography 

An important NDT method is X-ray radiography. Radio- 
graphic examination is covered by BS 2600: 1973- General 
Recommendations for the Radiographic Examination of 
Fusion Welded Butt Joints in Steel and in various other 
British Standards, some of which are given in Appendix 27. 
Accounts are given by Kohan (1987) and Pilborough (1989). 

X-ray radiography is used during fabrication to detect 
internal defects, principally in welds but also in the parent 
material. 

BS 5500 requires NDT by radiography and/or ultra¬ 
sound for welded joints on Category 1 and 2 pressure ves¬ 
sels. Details are given below. 

The X-rays used are produced by an X-ray machine 
which is relatively immobile and expensive. X-rays are 
recorded on a photographic plate. In X-ray radiography it is 
important that there be a high quality image. Standards 
generally call for a technique which is capable of recording 
deviations from the normal of not more than 2% of the 
maximum thickness of the item under test and specify the 
use of image quality indicators, or penetrameters. Image 
indicators are dealt with in BS 3971:1980. 

The interpretation of X-ray radiographs is a skilled 
matter and contains a considerable subjective element. The 
first step is to identify the type of defect and the second is to 
quantify it, if quantification is appropriate. The terminol¬ 
ogy and symbols for weld defects are given in BS 499:1980 
and BS 4727: Part 5, Group 01:1985. Some of the principal 
defects that occur in welds are: 

(1) planar defects- 

(a) cracks, 

(b) lack of fusion (side, root, interrun), 

(c) lack of root penetration; 


(2) cavities — 

(a) porosity (isolated, localized, linear), 

(b) wormholes (isolated, aligned), 

(c) crater pipes, 

(d) surface cavities; 

(3) slag inclusions; 

(4) other solid inclusions - 

(a) tungsten, 

(b) copper. 

Once a defect has been identified, it is necessary to decide 
whether it is sufficiently serious to require that the weld 
be rejected. This has again tended to be a subjective matter 
and has therefore caused considerable difficulty. In con¬ 
sequence, much work has been done to develop acceptance 
standards. BS 5500 contains a list of defects similar to that 
given above, together with corresponding acceptance levels. 

X-ray radiography is used to detect internal defects in the 
parent metal, such as in pressure vessel walls, pipework or 
castings, as well as in welds. 

y-rays are also used for radiography. They are produced 
by a radioactive isotope source such as cobalt-60. Equip¬ 
ment using y-rays is portable and relatively cheap. It is used 
particularly for the radiography of castings. The method is 
to arrange the castings in a circle with the y-ray source in 
the centre and with photographic plates behind the cast¬ 
ings. Isotope sources have a relatively large area emitting 
radiation (usually about 2-6 mm diameter) and therefore 
tend not to give such good definition as X-rays. 

If a permanent record is not required, X-rays may be used 
with a fluorescent screen instead of a radiographic plate. 
X-ray fluoroscopy is widely used for the rapid inspection of 
components on conveyor belts in order to detect coarse 
defects and unwanted objects. Another technique for 
rapid inspection is nucleonic gauging of the thickness of 
materials by passing [I -rays through the material. 

19.5.3 Ultrasonics 

Ultrasonics is another important NDT technique. This is 
dealt with in BS 3923: 1972— Methods for Ultrasonic 
Examination of Welds, and the terminology is given in 
BS 3683: Part 4: 1985. Accounts are given by Birchon 
(1975), Kohan (1987), Weisweiler and Sergeev (1987) and 
Pilborough (1989). 

Ultrasonics is used during fabrication as an alternative 
to radiography, to detect internal defects in parent metal 
and in welds. It is also used to measure thickness. BS 5500 
generally gives ultrasonics as an acceptable alternative to 
radiography for examining welded joints on Categories 1 
and 2 pressure vessels. 

Ultrasonic waves are generated by a transmitter and 
detected by a receiver and are usually displayed on an 
oscilloscope or recorder. Two basic techniques in ultra¬ 
sonics are (1) transmission and (2) reflection. 

In a transmission method the ultrasonic waves are gen¬ 
erated by a transmitter on one side of the item under test 
and are detected by a receiver on the other. The method is 
shown in Figure 19.1 (a). 

The reflection method generally uses pulsed waves that 
are generated by a transmitter and detected by a receiver on 
the same side of the item. One way in which the method may 
be applied is shown in Figure 19.1(b), which is known as the 
A scan. Another application is the B scan, which is shown 
in Figure 19.1(c). Both these methods give the depth of the 



PLANT COMMISSIONING AND INSPECTION 


1 9/27 


(a) 


Echo from 



Echo from 



Figure 19.1 Some ultrasonic testing methods: (a) transmission method; (b) reflection method - A scan; 
(c) reflection method - B scan; (d) reflection method - C scan 


defect. A third method is the C scan, shown in Figure 19.1 
(d), which does not show the depth. 

A number of other arrangements for the application of 
ultrasonics are described by Weisweiler and Sergeev (1987). 

The beam of waves produced in ultrasonics is not a 
simple parallel bundle of uniform intensity over the cross- 
section, and some expertise is required in the interpreta¬ 
tion of ultrasonic measurements. 

With regard to the choice between radiographs and 
ultrasonic techniques for welded joints, BS 5500 states: 

Radiographic and ultrasonic methods both have advan¬ 
tages and disadvantages in so far as flaw detection, 
identification and sizing are concerned. Radiography is 
particularly suitable for the detection and identification of 
Volume’ defects such as cavities and solid inclusions and 
incomplete penetration where a gap exists. Ultrasonic flaw 
detection is very suitable for the detection and sizing 
of planar defects such as cracks, lack of fusion and 
‘tight’ incomplete penetration in ferritic steels. The two 


techniques are therefore to he regarded as complementary 
and the method chosen which is most suited to the partic¬ 
ular application and material. An important consideration 
is joint geometry that may have an overriding influence 
on the choice of method. In exceptional cases it may be 
necessary to employ both methods on the same seam. 

Ultrasonics is also used during operational inspections to 
detect weld defects and to measure thickness. 

19.5.4 Magnetic particle methods 

A method applicable mainly to surface defects is magnetic 
particle inspection. This is treated in BS 6072:1981 Method 
for Magnetic Particle Flaw Detection and in several other 
British Standards, some of which are listed in Appendix 27. 
The terminology is given in BS 3683: Part 2: 1985. 
Accounts are given by Birchon (1975), Kohan (1987) and 
Pilborough (1989). 

Magnetic particle methods are applicable to ferromag¬ 
netic materials and are used to detect surface and some 




















9/2 8 PLANT COMMISSIONING AND INSPECTION 


subsurface defects. BS 5500 gives magnetic particle tech¬ 
niques as an acceptable method for the testing of welds for 
surface defects. 

There are various methods of magnetic particle test¬ 
ing, but the basic principle is to magnetize the item and 
coat it with a dry powder of iron or iron oxide particles, 
or, more usually, a wet powder or ‘ink’ of particles sus¬ 
pended in kerosene. The particles concentrate at places 
where there is no continuous magnetic path such as 
cracks. Defects may then be detected visually. As a fur¬ 
ther aid to visual detection, a fluorescent substance may 
be added to the particles and an ultraviolet lamp used. 
Defects show up best when they are at right angles to the 
lines of magnetic flux, and it is usual to test the compo¬ 
nent in two different planes. It is often necessary to 
demagnetize the item, which is usually done by subject¬ 
ing it to a magnetic field in the reverse direction to that 
of the initial one and then gradually reducing the field 
strength. 

19.5.5 Eddy current methods 

Magnetic particle methods are applicable only to ferro¬ 
magnetic materials. An alternative that can be used for the 
detection of defects in conducting materials, ferrous and 
non-ferrous, is eddy current testing. 

Eddy current testing is dealt with in BS 3889: 1966 
Methods for Non-destructive Testing of Pipes and Tubes and 
terminology is given in BS 3683: Part 5:1965. Accounts are 
given by Birchon (1975), G. Johnson and McFarlan (1978), 
Holloway, Bauer and Pittman (1981), Kohan (1987 and 
Pilborough (1989). 

In eddy current testing the item is subjected to an alter¬ 
nating magnetic field that induces eddy currents in it. These 
induced currents are measured and defects are detected 
from variations in the current. 

Eddy current testing is used principally for the detection 
of flaws in tubes, both in production lines and on plant. 
Figure 19.2 shows a defect in a brass tube which passed a 
1000 lb/in. 2 hydraulic test but was detected by eddy cur¬ 
rent testing. 

In the process industries, eddy current testing is used 
particularly on heat exchanger tubes. An account of this 
application is given by G. Johnson and McFarlan (1978), 
who describe the testing of tubes by the insertion of a 
probe. Defects that can be detected include pitting corro¬ 
sion and wall thinning. 



Figure 19.2 Defect in the wall of a brass tube which had 
passed a hydraulic test but which was found by an eddy 
current test (Pilborough, 1989) (Courtesy of Gower Press) 


An account of eddy current testing of furnace and 
reformer tubes with emphasis on the metallurgical aspects, 
is given by Holloway, Bauer and Pittman (1981). 

19.5.6 Dye penetrant methods 

Another method for the detection of surface flaws is dye 
penetrant testing. This is covered in BS 6443:1984 Method 
for Penetrant Flaw Detection and the terminology is given in 
BS 3683: Part 1: 1985. Accounts are given by Birchon 
(1975), Kohan (1987) and Pilborough (1989). 

BS 5500 gives dye penetrant methods as an acceptable 
method of testing welds for surface defects, and requires 
this method, rather than magnetic particle testing, to be 
used for austenitic steels. 

The original dye penetrant method was to immerse the 
item in a heated mixture of paraffin and oil, dry it and clean 
it, and then dust it with chalk. On cooling, the oil seeps out 
of any cracks in the article and stains the chalk. More 
modern methods use variations on this, such as special 
white developer and red dye. 

19.5.7 Other methods 

There are a growing number of other NDTmethods, such as 
stress wave emission analysis, holography and electrical 
resistance methods. In some cases these techniques are 
used for inspection mainly during fabrication, but in oth¬ 
ers their application is to operational inspection. Some of 
the latter are considered in Section 19.11. 

19.5.8 Non-destructive testing of welds 

The distinction between different categories of pressure 
vessel is largely based on the extent of the NDTof welds. For 
vessels in Category 1, BS 5500 gives the following require¬ 
ments for the examination of internal flaws: 

The full length of all Type A welds shall be examined by 
radiographic or ultrasonic methods. Unless otherwise 
agreed between the purchaser and the manufacturer 
(see table 1.5), the full length of all welded joints of Type B 
in or on pressure parts shall be examined by ultrasonic 
and/or radiographic methods where the thinnest part 
to be welded exceeds the limits given in table 5.6.41.1. 

For the examination of surface flaws, the Standard states: 
The full length of all Type B and all other attachment 
welds shall be examined by magnetic particle or pen¬ 
etrant methods. Type Awelds shall be examined by these 
methods when agreed between the manufacturer, the 
purchaser and the Inspection Authority (see table 1.5). 

For vessels in Category 2 the requirements of the Standard 
for internal flaws are radiographic and/or ultrasonic 
examination of 10% of the welds at certain defined loca¬ 
tions, the minimum length of weld to be examined at each 
location being 200 mm or the length of the weld, whichever 
is the lesser. There are also certain requirements for par¬ 
ticular features. For surface flaws the Standard requires 
examination by magnetic particle and/or dye penetrant 
methods and states that examination is to be conducted on 
both of the following: 

(a) the full length of welds attaching nozzles, branches 
and compensating plates, to shell and end plates; (b) at 
least 10% of the length of all other attachment welds to 
pressure components. 





PLANT COMMISSIONING AND INSPECTION 


1 9/29 


For vessels in Category 3 the Standard does not require 
NDTfor internal flaws unless details producing significant 
thickness tensile stress are used. Magnetic particle or dye 
penetrant methods may be used as an aid to visual exami¬ 
nation, which is required. 

19.5.9 Acceptance standards 

It is difficult to overemphasize the importance of accept¬ 
ance standards. Unless the increasing number of tech¬ 
niques that are capable of detecting defects is matched by 
the development of standards that define levels of defects 
below which no action is necessary, there is an obvious 
danger of unnecessarily frequent rejection. 

Much work has been done on the problem by bodies such 
as the Welding Institute and the American Welding Society, 
and there is an increasing amount of guidance available. 

As mentioned above, BS 5500 lists acceptance levels for 
certain defects. BS PD 6493:1980 Guidance on Some Methods 
for the Derivation of Acceptance Levels for Defects in Fusion 
Weldedjoints gives an approach based on fracture mechanics. 

19.6 Materials Verification 

The fact that, not infrequently, an incorrect material is used 
in the construction of the plant creates a requirement 
for inspection to identify such situations. Accounts of 
material verification are given by Ostrofsky (1980-) and 
R.J. Sherwood (1989). 

The range of tests and instruments available to identify 
materials is described by Ostrofsky.They include (1) chemi¬ 
cal and acid spot tests, (2) tests with tools such as a ham¬ 
mer and chisel or a file, (3) fracture tests, (4) eddy current 
tests, (5) thermoelectric characterization, (6) spark tests, 
(7) optical emission spectroscopy and (8) X-ray emission 
spectroscopy. 

The author describes a number of spot tests. A more 
detailed account is given in Spot Tests (Feigel, 1958). Spot 
tests are also the subject of ASTM STP 550. Ostrofsky also 
gives details of spark tests, with an illustration of the 
characteristic sparks obtained with materials such as low 
carbon steel, high carbon steel and nickel, and of instru¬ 
ments for field testing which are based on some of these 
techniques. There are several which utilize optical 
emission spectroscopy. These include the Metascope refer¬ 
red to earlier. 

A programme for verifying the materials installed in the 
piping of some ten plants is outlined by R.J. Sherwood 
(1989). Plant sections where the design required materials 
other than carbon steel were identified; marked-up draw¬ 
ings, pipework tables and inspection procedures were 
done; access was gained and surfaces prepared and tests 
were made using ultrasonics, magnetic particle detection 
and field analysis instruments. 

19.7 Pressure Testing 

It is normal to carry out a pressure test on a pressure vessel 
in order to check that it can be safely operated at the design 
pressure, but such testing is a potentially hazardous 
operation. Pressure testing is covered in BS 5500, in the 
Pressure Vessel Examination Code and the Pressure Piping 
Systems Examination Code by the IP (1993 MCSP Pts 12,13), 
and also in the ICI Pressure Vessel Inspection Code (ICI/ 
RoSPA, 1975IS/107) and is discussed by Pilborough (1989). 
Safety precautions are given in these sources and in GS/4 


Safety in Pressure Testing (HSE, 1992). Also relevant is A 
Guide to the Pressure Testing of In-service Equipment 
(EEMUA, 1990 Publ. 168). 

BS 5500 requires that a pressure test be carried out on any 
vessel constructed in accordance with the Standard and that 
the first test should be carried out in controlled conditions 
with appropriate safety precautions. Adherence to BS 5500 
is given in the guidance to the Pressure Systems Regulations 
1989 by the HSE (1990 HS(R) 30) as a means of compliance. 

The Standard requires that the pressure test 
procedure should be agreed at the design stage. The test 
should be performed in the presence of the Inspecting 
Authority. 

19.7.1 Types of pressure test 

The types of pressure test given in BS 5500 are: 

(1) standard hydraulic acceptance test; 

(2) pneumatic acceptance test; 

(3) hydraulic proof test; 

(4) combined hydraulic/pneumatic test. 

A‘standard’ test for acceptance is carried out on a pressure 
vessel where the required thickness of all pressure parts can 
be calculated. The object of the test is to confirm that the 
calculated design pressure is a safe work-ing pressure. 

If it is not possible to calculate the strength of a vessel 
satisfactorily, a ‘proof’ test for acceptance may be con¬ 
ducted to establish a design pressure. In this case, the pur¬ 
pose of the test is to determine whether the expected design 
pressure is a safe working pressure. 

In addition to these tests, which are carried out just 
before or after installation, there are periodic routine tests 
that are carried out during the operational life of the vessel. 

BS 5500 gives certain basic requirements for any type of 
test. Factors to be considered in the choice of test method 
include the test fluid and the size and location of the vessel. 
The procedure should define any areas at risk and the 
controls to be applied to these. 

19.7.2 Standard test pressure 

The standard test pressure for a hydraulic, pneumatic or 
hydraulic/pneumatic test given in BS 5500 is for Category 1 
and 2 vessels 


p! - l - 25 f t (t-c) [19 ' 713; 

where c is the corrosion allowance,/ a is the nominal design 
strength at the test temperature, / t is the nominal time- 
independent design strength, or its nearest equivalent, at 
the design temperature (or the highest temperature at 
which time-independent strengths are given in the stand¬ 
ard, if this is lower than the design temperature), p is the 
design pressure, p t is the test pressure, and t is the nominal 
thickness of the section under consideration. For Category 3 
vessels the standard test pressure is that given by Equation 
19.7.1 or by 

pt = 1.5 p [19.7.2]; 

whichever is the higher. Various qualifications to these test 
pressures are given in the standard. Other test pressures 
are given for proof tests. 
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19.7.3 Basic test method 

Before any test is carried out, the vessel should be given as 
thorough a visual inspection as is practicable. It may also 
be desirable to carry out a leak test and, provided that the 
pressure is not raised to more than 10% of the design 
pressure, this may be done without the full set of precau¬ 
tions otherwise required for a pneumatic test. 

The basic test method described in BS 5500 is to raise the 
pressure in the vessel gradually to 50 % of the specified test 
pressure and thereafter to increase it in stages of approxi¬ 
mately 10% until the test pressure is reached. The test 
pressure is to be maintained for 30 min, except for certain 
smaller vessels. 

The vessel should be inspected during the test for 
defects, but this needs to be done with care. BS 5500 states: 
At no stage shall the vessel be approached for close 
inspection until the pressure has been positively 
reduced to a level lower than that previously attained. 
The pressure (s) at which the vessel will be approached 
for close inspection shall be specified in the test pro¬ 
cedure. Such pressure (s) need not exceed design pres¬ 
sure but, if in excess of this figure, shall not exceed 
95% of the pressure already obtained and held for at 
least 15 min. 

During the test, the vessel should exhibit no sign of 
plastic yielding. 

The test is normally carried out at about ambient 
temperature. The risk of brittle fracture should be 
assessed at the design stage. This may affect the choice 
of material and/or of the temperature at which the test is 
performed. 

There are special test requirements for vessels with 
multiple compartments. 

19.7.4 Hydraulic test 

The method of pressure testing preferred in the Standard is 
the hydraulic rather than the pneumatic method. In the 
latter, the energy available is large and any failure during 
the test is likely to be highly explosive. This aspect is dis¬ 
cussed in Chapter 17. 

For a hydraulic test, the test fluid should normally be 
water, but other liquids may be utilized instead if neces¬ 
sary. If another liquid is used, any appropriate precautions 
should be observed. 

Where hydraulic testing with water is not used, the 
reasons are generally that the vessel and the structure can¬ 
not withstand the weight of water, that the water may 
be difficult to remove completely or that it may freeze. 

19.7.5 Pneumatic test 

BS 5500 states that pneumatic testing should only be 
carried out 

Either on vessels of such design and construction that it is 
not practicable for them to be filled with liquid, or on 
vessels for use on processes that cannot tolerate trace 
liquids and where the removal of such liquids is imprac¬ 
ticable. 

Testing should only be carried out in consultation with the 
Inspecting Authority. 

Before a pressure test is performed, BS 5500 requires 
that all welds that have not already been non-destructively 
tested should be tested by magnetic particle and/or dye 
penetrant methods. 


All suitable precautions should be taken against the 
hazard of vessel failure. BS 5500 refers in particular to: 

(1) The adequacy of blast protection; (2) the extent of area 
cleared for test safety purposes; (3) the degree of con¬ 
fidence in stress analysis of vessel details; (4) the 
adequacy of any non-destructive testing carried out 
before the test; (5) the resistance of the vessel material to 
fast fracture; (6) the procedure to prevent local chilling 
during filling and emptying of the vessel and (7) the 
extent of remote monitoring provided during the test. 

BS 5500 states that it is permissible to carry out pressure 
testing with air or gas up to 1.1 times the design pressure 
on any vessel that has satisfactorily withstood the 
standard hydraulic, pneumatic or combined hydraulic/ 
pneumatic test. 

19.7.6 Proof hydraulic test 

In a proof hydraulic test the vessel normally is equipped 
with strain gauges or is covered with a strain-indicating 
coating. The pressure is increased gradually until either 
the standard test pressure for the expected design pressure 
is reached or significant yielding of some part occurs. From 
this test the design pressure and a corresponding standard 
test pressure can be determined. Further details are given 
in BS 5500. 

19.7.7 Pressure testing: safety precautions 

The safety precautions to be taken in the pressure testing 
of pressure vessels are described in GS 4. 

The test should be conducted by a competent person. 
There should be safe systems of work covering inter alia the 
conduct of the test itself and the regular examination of the 
equipment used in testing, using, respectively, suitable 
permit-to-work systems and inspection systems. GS 4 
details a number of features that should be included in 
these systems. 

All personnel should be kept out of the test area by a 
system for the control of access. Personnel conducting the 
test should do so at a suitable distance and with facilities 
for remote viewing of the vessel. 

Hazards which should be considered are the explosion of 
the vessel and ejection of blanks and plugs, of high velocity 
fluid jets and of dirt. 

Increasingly, pressure vessels under test are monitored 
for acoustic emissions (AEs), this being a prime application 
of the technique. Further details of the method are given in 
Section 19.14. 

19.7.8 Hydraulic testing: safety precautions 

There are various precautions that should be taken before 
doing a hydraulic test using water. Checks should be made 
on the effects of static head, on the ability of the vessel and 
the structure to withstand the weight of water, and on the 
strength of any temporary pipes, connections or blanks. 

The hazard of brittle fracture should be considered. In 
order to avoid the risk of freezing, the temperature of the 
water should be not less than 7°C. 

If water is used with austenitic stainless steel, it is 
essential to control the chloride and alkali content. The ICI 
Code specifies the use of demineralized or clean condensate 
with a chloride content less than 1 ppm. 

Measures should be taken to prevent overpressure of the 
vessel during the test. Accurate and reliable means of 
measuring the pressure should be provided in the form of a 
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pressure gauge that is freshly calibrated and preferably 
duplicated. The possibility of overpressure due to water 
temperature rise and expansion should be considered and, 
if necessary, a liquid relief valve should be provided. The 
vessel should have suitable vents so that air can be com¬ 
pletely removed. Pockets of air left in the vessel constitute a 
pneumatic explosion hazard. All filling lines and other 
equipment that are not intended to be subject to the test 
pressure should be disconnected before that pressure is 
applied. Any blanking off devices should be secured so 
that they will not be ejected during testing. 

If a test liquid other than water is used, the hazards 
should be reviewed. With regard to the choice of liquid, the 
ICI Code states that the liquid should be well below its 
boiling point and, if flammable, should have a flashpoint 
above 45°C. The precautions described for water testing are 
applicable to testing with other liquids. 

The test pressure to be applied should be such as not to 
overstress the vessel. It is normally specified in standards 
and codes. GS 4 states that in the absence of such guidance 
the test pressure should be limited to 90% of the proof, or 
yield, strength. It should be applied gradually in 10% 
increments. 

The vessel under test should not be subject to any form 
of shock loading such as hammer testing. 


19.7.9 Pneumatic testing: safety precautions 

As stated, pneumatic testing should be employed only 
where hydraulic testing is impractical. In particular, 
pneumatic testing should be avoided if the vessel is con¬ 
structed of a material that is liable to brittle fracture. Where 
the system consists of a number of items that can be tested 
separately, this is good practice insofar as it minimizes the 
volume under test, and thus the energy release potential. 

If a pneumatic test is to be conducted, a review of the 
hazards should be undertaken. The vessel should be 
inspected in accordance with the Code requirements, as 
described above. Inspection requirements are also detailed 
in GS 4. 

Consideration should be given to the possibility of con¬ 
densation in the vessel, which can defeat the purpose of 
using pneumatic testing which has been chosen in order to 
exclude water. 

Local chilling effects should be minimized in order 
to reduce the risk of brittle fracture. A gas let down from 
high pressure may undergo a significant temperature drop 
due to the Joule-Thomson effect. A pneumatic test should 
be carried out in such a way that the temperature of 
the gas entering the vessel does not fall below the test 
temperature. Similar considerations apply to gas flows out 
of the vessel. 

If the source of pressure is higher than the test pressure, 
the vessel should be provided with protection against 
overpressure by the use of suitable reducing valves, pres¬ 
sure gauges and pressure relief valves. 

Where pneumatic testing is conducted using a range of 
air pressures, positive measures may be taken to ensure 
that the correct test pressure is applied by arranging that 
there is for each pressure a different type or size of con¬ 
nection on the air supply, with a corresponding connection 
on the vessel. 

Flexible connections used in pneumatic testing should 
be firmly secured. Safety restraints may be used to reduce 
the risk to persons nearby. Equipment used in pneumatic 


testing, such as pressure relief devices and flexible 
connections, should be subject to regular examination. 
Details are given in GS 4. The vessel under test should 
not be subject to any form of shock loading. 

The personnel carrying out the test should he provided 
with a safe place from which the progress of the test can be 
observed and controlled. On completion of the test the ves¬ 
sel should be emptied in such a way as not to cause under¬ 
pressure and collapse. 

Underwater pneumatic testing may be employed as a 
form of a combined pressure test/leak test. The precautions 
required in such a test are detailed in GS 4. 

19.7.10 Multi-compartment vessels 

The testing of multi-compartment vessels involves addi¬ 
tional hazards and gives rise to fatalities. These tend to 
occur when a person enters the vessel to inspect leaks from 
the compartment walls before the strength of the latter 
is fully tested. Walls may collapse at quite low pressure 
differentials. Entry should not be made into a multi¬ 
compartment vessel for the purpose of leak inspection 
until the integrity of the compartments has been estab¬ 
lished by appropriate pressure testing. 


19.8 Leak Testing and Detection 

19.8.1 Leak testing 

Leak testing is carried out to check that a pressure vessel 
does not have significant leaks at the design operating 
conditions. 

Leak testing is described in BS 3636:1963 Methods for 
Proving the Gas Tightness of Vacuum or Pressurized Plant, 
the Pressure Vessel Examination Code and the Pressure 
Piping Systems Examination Code of the IP (1993 MCSP 
Pts 12,13), the ICI Pressure Vessel Inspection Code and by 
Troyan (1960) and Pilborough (1989). Safety precautions 
in leak testing are given in these sources and in GS 4 
(HSE, 1992). 

19.8.2 Pressurization for leak testing 

Most leak testing methods involve pressurizing the equip¬ 
ment, although the pressure used may be well below the 
design pressure. In general, pneumatic leak testing should 
not be performed until the integrity of the vessel has been 
established by pressure testing. 

It is sometimes desirable, however, to leak test a vessel 
before a pressure test. As stated above, BS 5500 allows this 
to be done without observing the requirements for a pneu¬ 
matic test, providing the pressure during the leak test does 
not exceed 10% of the design pressure.The guidance given 
in GS 4 is similar. 

Once a pressure test has been carried out, leak testing 
may be done at pressures in excess of 10% of the design 
pressure. Nevertheless, the pressure used in leak testing 
should be kept as low as possible. There is usually little to 
be gained by the use of high pressures. 

The vessel to be leak tested should first be inspected. 
GS 4 advises that visual examination may need to be sup¬ 
plemented by inspection using NDT methods. 

If a pressure leak test is used and if the source of pressure 
is higher than the test pressure, the vessel should be pro¬ 
vided with protection against overpressure by the use of 
suitable reducing valves, pressure gauges and pressure 
relief valves. 
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As described below, there are methods of leak 
testing available which do not involve pressurizing the 
vessel. 

19.8.3 Leak location methods 

Leak testing is performed for two distinct, but related, 
purposes: to locate the leak and to determine the leak rate. 
The main methods used for leak location are: 

(1) pressure testing; 

(2) search gas methods. 

There are a number of leak location methods which involve 
pressurizing the vessel and then detecting leaks visually. 
The equipment may be pressurized hydraulically and 
liquid leaks observed. Detection of leaks may be assisted by 
the use of some kind of coating which shows them up more 
clearly Alternatively, pressurization may be pneumatic and 
detection effected using a soap bubble or similar technique. 
If the vessel is sufficiently small to be immersed in a liquid, 
the evolution of air bubbles may be used to detect leaks in a 
manner similar to that used in repairing a bicycle inner 
tube puncture. 

Another group of methods is based on the use of a search 
gas. The gas is introduced into the air pressurizing the 
vessel and is detected by a suitable device. Some commonly 
used combinations are: 


Search gas 

Detector 

Halogen gas 

Halide torch 


Halogen diode detector 

Hydrogen 

Thermal conductivity detector 

Helium 


Nitrous oxide 

Infrared absorption detector 


A variation of this method is to use not a search gas but a 
radioactive tracer. 

Some practical aspects of leak detection are discussed 
by Troyan (1960). 

19.8.4 Leak rate 

The leak rate may be defined in terms of the fall in pressure 
in the vessel 

J19.8.1] 

where L is the leak rate (Pa m 3 /s), P is the pressure (Pa), 
Vis the volume of vessel (m 3 ) and t is the time (s). 

Until quite recently, the internationally agreed unit of 
leak rate has been the torr 1/s (=0.133 Pa m 3 /s). Thus in 
Equation 19.8.1 if, instead of the units given, V = 11 and 
dP/dt = ltorr/s,theni = 1 torr 1/s. Since this unit is rather 
large, use has also been made in the United Kingdom of the 
lusec(llusec = 0.001 torr 1/s). An account of leak rate units 
is given by Pilborough (1989). 

Since the leak rate depends on the difference between 
the vessel pressure and atmospheric pressure, this 
should be specified when quoting leak rates. Where the 
leak rate is for a vacuum plant and the difference is not 
specified, the assumption is that the pressure difference 


Typical leak rates are given by Pilborough (1971) as 
follows: 


Leak rate (lusec) 

Water can 

10 

Chemical plant 

1 

Vacuum plant 

0.01 


19.8.5 Leak rate methods 

The main methods for leak rate determination are: 

(1) pressure decay method; 

(2) flow method; 

(3) search gas flow method. 

The pressure decay method is to pressurize the system, 
isolate it and measure the rate of pressure decrease. 

The flow method involves measuring the inlet flow 
required to maintain the pressure constant. 

In the search gas flow method, air is passed over the 
surface of the equipment and through some form of hood or 
containment and the flow of air and concentration of search 
gas in the air are measured. 

19.8.6 Leaks in vacuum plant 

Leaks are particularly important in vacuum plant. Their 
detection and measurement is a specialist activity. 
Accounts are given in texts on vacuum technology and by 
Pilborough (1989). 

19.8.7 On-line leak detection 

Methods are also required for the detection of leaks in 
operating plant. In some cases it is possible to utilize the 
techniques just described such as the soap bubble, pressure 
decay and search gas methods. 

For high pressure leaks, use may be made of AE moni¬ 
toring, as described in Section 19.14. For leaks in pipelines 
another form of acoustic monitoring may be used, as 
described in Section 19.16. 

19.9 Plant Monitoring 

The plant equipment, including the pressure vessels and 
pipework and the process machinery, may be monitored 
during commissioning and over its operational life. 

The monitoring of the state of the equipment may be 
based on (1) performance or (2) condition. The difference is 
self-explanatory. Performance monitoring is able to detect 
faults which have an effect on performance, but there are 
many others which have little effect until failure actually 
occurs. The latter may often be detected, however, by moni¬ 
toring the condition. 

The monitoring of instrument performance and condi¬ 
tion has been discussed in Chapters 13 and 14 and such 
monitoring of other equipment is discussed below. 

19.9.1 Monitoring strategy 

Plant monitoring can yield great benefits, but it can con¬ 
sume appreciable resources. It is essential, therefore, to 
define clearly the purposes for which such monitoring is to 
be carried out and to adopt a coherent monitoring strategy. 
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This is particularly relevant with some types of moni¬ 
toring, of which AE monitoring is one, and the point 
is discussed further below in relation to this type of 
surveillance. 


19.9.2 Monitoring interval 

The interval between condition monitoring checks 
depends on the nature of the signal. If the development of a 
failure is shown by a slow and reproducible increase in 
signal level over a long time interval, periodic monitoring 
may be sufficient, but if the failure gives little advance 
warning and the signal level is liable to rise from a low to 
a high level suddenly, then continuous monitoring is 
necessary. 

The problem is one of information sampling and is in 
many ways similar to that considered in Chapter 14, in 
relation to the sampling of information by the process 
operator. Continuous monitoring is generally more expen¬ 
sive and the choice of monitoring interval is usually a 
compromise between these factors. 

Where the quantity monitored is not the state of the plant 
but changes in that state, as in AE monitoring, different 
considerations apply. In this case, periodic monitoring, 
undertaken during changes in the plant state, is the norm. 

19.9.3 Action level 

The problem of acceptance standards in inspection and 
NDT is paralleled by that of the action level for condition 
monitoring. The decision has two dimensions, since it is 
necessary to decide not only whether to take action but also 
whether action must be immediate or whether it can be 
deferred. 

A condition monitoring device produces a signal which 
varies with time. The signal characteristic of normal 
operation tends to be specific to the individual equipment 
monitored. It is a deviation from the equipment’s own nor¬ 
mal signal rather than from some ideal signal which indi¬ 
cates its abnormal condition. 

In many cases, there is a fairly reproducible and unam¬ 
biguous increase in signal level when a failure is imminent. 
In others, however, the signal is liable to fluctuate, rising to 
quite high levels and then subsiding, and/or to increase 
suddenly to failure. There is a considerable problem in 
these latter situations in deciding whether to take action. 

The methods of reliability engineering have been applied 
to the treatment of the results from condition monitoring. 
Bellingham and Lees (1976b) describe a method of using 
the monitor signal to make a running estimate of the prob¬ 
ability of survival, that is the reliability of the equipment. 
The method assumes that a priori information is available 
on (1) the failure density function of the equipment and 
(2) the probability density function of the signal, and uses 
the signal to condition this information to give the reli¬ 
ability estimate. 

An illustrative example of the type of information 
obtained is shown in Figure 19.3. In the case considered, the 
failure distribution of the equipment is assumed to be 
exponential. Curve 1 gives the reliability calculated from 
the failure distribution without using the signal informa¬ 
tion. Curves 2 and 3 show the reliability estimated from 
the a priori information and the signal for the cases 
where the signal level is low and high, respectively. 
The former case indicates a healthy condition and the 
reliability in the immediate future is high, while the latter 



Figure 19.3 Use of monitor signal to condition the 
estimate of equipment reliability (Bellingham and Lees, 
1976b): curve 1, no monitor signal; curve 2, monitor signal 
healthy; curve 3, monitor signal unhealthy (Horsley and 
Parkinson, 1990; reproduced by permission of the 
Institution of Chemical Engineers) 


case indicates an unhealthy condition and the reliability 
falls off rapidly. 

Applications of the extreme value distribution to the 
interpretation of results from ultrasonic survey have been 
described by Wylde and Shaw (1983). One application given 
is the estimation of the remaining life of a tank wall from 
measurements of the wall thickness at various points on a 
corroded band of the wall. Another example quoted is the 
estimation of the number of deep pits per unit length of 
pipe from measured values of pit depth. 

19.9.4 On-condition maintenance 

The various techniques of non-destructive examination 
and condition monitoring may be used to determine when 
maintenance should be done on an equipment, as an alter¬ 
native to either breakdown or scheduled maintenance. This 
policy is known as on-condition maintenance. An account 
of on-condition maintenance as a maintenance policy is 
given in Chapter 7. 

19.9.5 On-condition maintenance: illustrative example 

Some of the condition monitoring techniques described 
below involve specialist equipment and sophisticated 
inter-pretation. But, as the following example shows, on- 
condition maintenance may also be based on some very 
simple measurement. 

A maintenance policy for a paper machine has been 
described by A. Kelly (1981). One component which was 
prominent in the maintenance was a rotary joint, the main 
failure being that of one of the seals, which had a life 
varying between 6 and 30 months. It was realized that the 
wear on this seal could be determined by measuring the 
movement of the housing relative to the rotating part of 
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the joint. Thus, the condition of the seal could be monitored 
using a simple measurement of position. 

19.10 Performance Monitoring 

One basic approach to the surveillance of the health 
of equipment is to monitor its performance. Typically, 
performance monitoring is based on the use of a model of 
the equipment performance with ranges of values of the 
parameter in the healthy state. These parameters are 
monitored to detect excursions into unhealthy states. The 
technique tends to involve the measurement of a number 
of parameters and to require fairly high measurement 
accuracy. 

Some performances which may be monitored include: 

(1) the equipment pressure drop; (2) heat exchanger effi¬ 
ciency; (3) the pump characteristic and efficiency and 
(4) the compressor, turbine characteristic and efficiency. 

Performance monitoring is carried out on large machines 
such as turbines and compressors in the aerospace, marine, 
power and process industries. It is usually done not only to 
detect failures but also to obtain improved performance. 
Since performance monitoring generally requires multiple 
measurement, computation and display facilities, it is a 
natural task for a process computer. 

The performance monitoring of reciprocating com¬ 
pressors by computer has been described by Gallier (1968). 
The monitoring covered changes in compressor leakage 
and volumetric efficiency, in compressor and driver power 
efficiency and in loading capability. 

Thus leakage was determined by measuring tempera¬ 
tures and using the equations 


T s — T 0 

(To + ATnj-Ti 
T 0 _ 

T s UJ 


[19.10.1] 

[19.10.2] 


where L is the fraction of gas leaking, pi is the suction 
pressure, p a is the discharge pressure, AT H is the correction 
for Joule—Thomson effect, 7] the inlet temperature (before 
the addition of bypass gas),T 0 is the discharge temperature, 
T s is the suction temperature, and p is a constant, approxi¬ 
mately equal to the ratio of the gas specific heats. 

Collacott (1976b) has described the monitoring of a more 
complex set of ‘gas path’ relations in a single spool com¬ 
pressor. A simplified form of the model described is 
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whereA is thejet nozzle exhaust area, G a the compressor air 
pumping capacity, A the compressor speed, P d is the com¬ 
pressor discharge pressure, T d is the compressor discharge 
temperature, 7] is the turbine inlet temperature, W f is the 
fuel flow, r\ is the compressor efficiency, and A is the nor¬ 
malized increment of the variable (change in value/ 
absolute value). 

The performance of the machine is monitored by observ¬ 
ing changes in the A values of the variables. The method 
may be summarized as follows. First the coefficients 


811-844 in Equation 19.10.3 are evaluated in healthy opera¬ 
tion. Then to make a check of machine performance the 
dependent variables P d , T d and W f are measured at constant 
speed and the normalized increments AP d , AT d and A Wf 
are calculated. Since the speed is constant, AN = 0 and 
equation 19.10.3 can be evaluated by considering first the 
top left-hand, third-order matrix. Thus the normalized 
increments of the independent variables AT;, AG a and At] 
are determined. The normalized increment AA is then 
calculated. 

If all the normalized increments are close to zero, there is 
no performance change. If there is a deterioration, however, 
AG a , At] and A7j; normally rise. An increase in AA indicates 
erosion of the nozzle. 

Collacott describes the performance monitoring of a 
power station steam turbine in which there was a sudden 
reduction in the load, first stage pressure, intercept valve 
pressure and feedwater flow of about 4% in each case. It 
was decided that there was a restriction at the front end of 
the turbine. In fact, the stem of one of the four control 
valves had broken so that the sequence of valve opening 
was interrupted. 


19.11 Condition Monitoring 

The alternative to performance monitoring is condition 
monitoring, for which a variety of techniques are available. 

Accounts of condition monitoring have been given in 
Mechanical Fault Diagnosis (Collacott, 1977b) and On-line 
Monitoring of Process Plant (D.W. Butcher, 1983) and by 
Kobrin (1970), Trotter (1973) and D. Neale (1974). 

An account of the application of a number of NDT and 
condition monitoring techniques to ammonia plants has 
been given by Madhavan and Sathe (1987). 

There are a large and growing number of condition 
monitoring methods. Some of these are as follows: 

(1) vibration monitoring; 

(2) corrosion monitoring; 

(3) acoustic emission monitoring; 

(4) ultrasonics; 

(5) infrared thermography; 

(6) strain measurement; 

(7) debris analysis; 

(8) magnetic signature monitoring; 

(9) temperature measurement; 

(10) position measurement; 

(11) speed measurement; 

(12) torque measurement. 

There is, therefore, no shortage of methods for condition 
monitoring. The problem is rather to select the appropriate 
technique, inspection interval and action level. 

The inspection interval depends on the rate at which the 
fault monitored can develop. There are some faults that can 
occur within a matter of minutes, while others take weeks 
or months to develop. Continuous monitoring is necessary 
to detect faults that develop rapidly. 

Whereas NDT methods are well established and are for¬ 
mally recognized in pressure vessel construction codes 
such as BS 5500, the role of condition monitoring tech¬ 
niques in inspection codes is generally less well defined. 

The use of the process computer for monitoring perfor¬ 
mance and condition is discussed in Chapter 30. 
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19.11.1 Vibration monitoring 

Awidely used method of condition monitoring is the moni¬ 
toring of vibrations. This is applied mainly to rotating 
process machinery, but also to static plant equipment. For 
rotating machinery in particular, it is often possible to 
relate the vibrations obtained to specific faults in the 
machine. Since large rotating machines are often critical to 
the operation of process plants, vibration monitoring has 
proved an especially valuable aid. It is described in more 
detail in Section 19.12. 

19.11.2 Corrosion monitoring 

Another widely practised form of monitoring is corrosion 
monitoring, which is applied principally to static plant. 
Corrosion monitoring may he used to track corrosion pro¬ 
gressing at a relatively uniform rate and also to identify 
bursts of intense corrosion activity and to relate these to 
particular process conditions. The monitoring of corrosion 
is described further in Section 19.13. 

19.11.3 Acoustic emission monitoring 

Another monitoring technique which is finding growing 
application is AE monitoring, which is applied to static 
plant and also to leaks. This method is based on the detec¬ 
tion of the AEs that occur as defects undergo changes, 
notably those accompanying crack growth. It thus differs 
from most other techniques for monitoring static plant in 
that it is not the steady state of the defects that are meas¬ 
ured but the dynamic changes. A fuller account of AE 
monitoring is given in Section 19.14. 

19.11.4 Ultrasonics 

Ultrasonics is widely used not only for the initial exami¬ 
nation of plant equipment, as described in Section 19.5, but 
also for on-going monitoring. In particular, it is extensively 
used to determine metal thickness and to identify and 
characterize cracks in metal structures. 

19.11.5 Infrared thermography 

An infrared camera can be used to detect differences in the 
surface temperature of, and hence heat radiation from, 
plant. The different temperatures may be displayed as dif¬ 
ferent colours or shades of black and white on a cathode ray 
tube or on a photograph. The technique is known as infra¬ 
red thermography or thermal image monitoring. Accounts 
are given by Norda (1976, 1977), L.M. Rogers (1976), 
Weismantel and Ramirez (1978), Imgram and McCandless 
(1982), E.G. Jones and Duckett (1985), Tuss (1985) and 
Baker-Counsell (1986c). Plate 18 shows the thermal image 
of a distillation column. Some applications of thermo¬ 
graphy are: 

(1) refractory and lagging deterioration - 

(a) refractory wear, 

(b) lagging loss, 

(2) furnace tube deterioration- 

(a) hot spots, 

(b) coking, 

(3) process flow abnormalities — 

(a) heat exchangers, 

(b) steam traps, 

(c) relief valves, 

(4) electrical equipment faults — 

(a) cable terminations, 

(b) cable splicing faults, 


(5) machinery faults - 

(a) gearboxes, 

(b) couplings, 

(c) corrosion. 

Thermography has long been used by electrical engineers 
to detect faults in electrical power systems, but there are 
now numerous applications in the process industries. Wear 
of refractories, loss of lagging or moisture penetration of 
lagging shown up as hot or cold spots. In furnaces, corro¬ 
sion or other thinning of tubes and coking up of tubes are 
revealed by temperature changes. The deterioration of flow 
patterns in a heat exchanger gives a changed temperature 
pattern. Leaks in steam traps and relief valves which dis¬ 
charge into closed pipelines are shown by a change in the 
temperature of these lines. Defects in electrical equipment 
such as bad terminations or cable splicing faults often show 
up as hot spots. Deterioration of machinery such as cou¬ 
plings or gearboxes tends to generate heat. It is even pos¬ 
sible to detect some forms of corrosion. 

Figure 19.4 shows a pair of normal and thermographic 
photographs of refractory lined vessels. The arrows in 
Figure 19.4(b) indicate areas of one of the vessels where the 
refractory is wearing thin. 

A number of routine applications of thermography in one 
company are described by Weismantel and Ramirez (1978). 
These include the detection of leaking steam traps, faults 
in gearboxes and couplings, and electrical cable splicing 
defects. Another use described by these authors is to detect 
leaks beneath the insulation on liquefied natural gas 
(LNG) tanks. 

Imgram and McCandless (1982) describe the use of 
thermography to detect leaking pressure relief valves. 
They also describe applications to the deterioration of a 
catalytic cracker refractory lining wear, a crude heater 
insulation loss and furnace tube coking. Plates 17 (a) and 
17(b) show an application similar to the one described by 
these authors; of the pair of pressure relief valves shown, 
the one on the right-hand side is leaking. 

The application of thermography to the identification of 
blockages in the relief header of a synthetic rubber plant is 
described by E.G. Jones and Duckett (1985). The technique 
used was to pass steam along the line and to observe the 
thermal transient, blockage points appearing initially as 
cold spots. 

The applications mentioned by Baker-Counsell (1986c) 
include the use of thermography to detect hydrogen 
corrosion. The blisters formed cause a decrease in heat 
transfer and hence, when steam is used, a cold spot. 

The main application of thermography is as a method for 
the normal inspection of the plant, but it may also be used 
for other purposes such as the acceptance testing of new 
equipment. 

The distances between the thermal camera and the 
object may be as much as 100 m or more. Coverage of the 
temperature range —30°C to 2000°C and accuracies within 
1°C are claimed. Thermographic equipment is relatively 
expensive. 

19.11.6 Strain measurement 

There are a number of methods of measuring strain in 
plant equipment. They include 

(1) displacement measurement; 

(2) strain gauges; 
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Figure 19.4 Normal and thermographic photographs of a refractory lined vessel (A GA Ltd): (a) normal photograph; 
(b) thermographic photograph, with arrows indicating thin spots 


(3) lacquers and coatings; 

(4) X-ray diffraction; 

(5) interferometry - 

(a) Moire grid, 

(b) speckle, 

(c) holographic. 


Strain may be measured by mechanical displacement or by 
electrical strain gauges. The latter are widely used as a 
means of measuring strain in a laboratory, but are rather 
less suitable for site work. A strain gauge measures strain 
in one direction only and has relatively low sensitivity. The 
application of the strain gauge method to the monitoring of 
steam pipework has been described by Ghia et al. (1983). 

Photoelastic coatings and brittle lacquers may be used to 
give an indication of the existence of strain. 

Interferometric techniques are available which show a 
two-dimensional strain pattern and are more sensitive. In 
the Moire grid method a linear grid is applied to the object 
and distortions of the grid are measured. 

If the diffusely reflecting surface of an object is illumi¬ 
nated by a laser beam, a speckle pattern is produced. This 
pattern undergoes regular changes if the surface is dis¬ 
placed by strain. Oxidation of the surface may affect the 
pattern, but special coatings are available to deal with this 
problem. 

The procedure in the holographic method involves tak¬ 
ing a silicone replica of the strained surface and analysing 
it in a laboratory using a fairly powerful laser (> 1 W). 


Figure 19.5 shows a crack around a fatigue specimen 
obtained by the Optecord holographic method. 

19.11.7 Debris analysis 

The debris produced by process machinery in distress may 
be used to obtain information about the wear which is 
occurring by using the techniques of debris analysis. 
Accounts are given byA.E. Davies (1972), Collacott (1975), 
Wilkie (1987a) and Rudston (1989). The fundamentals of 
wear are treated by M.C. Shaw (1971). 

Debris analysis techniques have been developed pri¬ 
marily in the aerospace and defence fields. Their applica¬ 
tion is widespread in the transport industry, where debris 
analysis is utilized for aircraft, marine, rail and road 
equipment, but its exploitation in the process industries 
has been somewhat slower. 

Debris analysis is closely related to lubrication technol¬ 
ogy and is also referred to as lubricant monitoring. A 
monitoring package generally includes analysis of the 
lubricant itself as well as of the debris which it contains. 

The lubricant tests in such a package are fairly standard. 
They include measurements of: the density of the oil; 
the viscosity of the oil; the breakdown products of the 
oil; the contaminants in the oil, such as water and insol¬ 
ubles; the total base number and the characterization of the 
metal particles. 

The fate of metal particles in the system depends on 
their size. In essence, large particles (0.1 to <0.5 mm) settle 
out in the lubricant return tank; medium sized particles 
(10—50 pm) circulatebut maybe trapped by a filter; and small 
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Figure 19.5 Holographic investigation of a fatigue crack: (a) specimen; (b) holographic photograph (Reproduced with 
permission of Scottish Technical Development Ltd and the University of Strathclyde) 


particles (1-5 pm) also circulate, but pass through any filter. 
The filtering arrangements are generally designed to mini¬ 
mize abrasion and erosion from metal particles. 

There are two main methods for the analysis of the metal 
particles: spectrometry and ferrography. 

Spectrometric oil analysis involves the analysis of the 
chemical elements in the oil itself. The method was origin¬ 
ally developed by the US Navy Air Force and has been 
known in the United Kingdom as the spectrometric oil 
analysis programme (SOAP). The method is claimed to be 
able to detect wear debris at the level of one part in 10 12 
(Collacott, 1975). 

Figure 19.6 (A.E. Davies, 1972), shows the wear rates of an 
Olympus engine in the Concorde prototype aircraft as 
measured by spectrometric oil analysis. Stripping of the 
engine revealed heavy fret wear on the port gearbox-driven 
bevel splined location on the lay shaft. 

For ferrography, metal particles may be obtained by 
magnetic chip detection or filter collection. Magnetic chip 
detection is used in lubricating or hydraulic oil systems to 
collect debris from ferromagnetic materials. The detector is 
periodically examined and the debris analysed. The use of 
magnetic chip detectors is quite widespread in the process 
industries. Filters in oil systems are also used to collect 
debris particles for analysis. 

In the aircraft industry the analysis of debris is a well 
developed technique. Filter elements are removed under 
conditions of almost clinical cleanliness and the debris is 


examined by microscope and analysed chemically. Sam¬ 
ples of filter washings are preserved under transparent 
covers on record cards. 

Some typical normal and alert wear/corrosion ranges 
given by Rudston (1989) are as follows: 



Spectroscopic metals 

Ferrographic 

readings 

Ferrous 

Non-ferrous 

Large 

debris 

Small 

debris 

Rotating 

>8 

>8 

>15 

>2 

Machinery 

(0-5) 

(0-5) 

(0-5) 

(0-5) 

Reciprocating 

>150 

>20 

>120 

>40 

Machinery 

(0-100) 

(0-15) 

(0-100) 

(0-30) 


The values shown without brackets are alert values and 
those shown in brackets are normal values. These provide a 
general guide, but monitoring of a given machine is usually 
based on deviations from the previous pattern shown by 
that machine. 

Particular wear processes tend to give characteristic 
particle shapes and much can be learned by examining the 
particles under a microscope. Some typical debris char¬ 
acteristics are shown in Table 19.11. 
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Figure 19.6 Trend record of a spectrometric oil analysis on an Olympus 59332 engine in the Concorde prototype aircraft 
(A.E. Davies, 1972) (Courtesy of the Institution of Marine Engineers) 


Table 19.11 Some typical characteristics of metal particle debris in lubricating oil 


A 

Conditions 

Particle appearance 


Running in 

Roller bearing distress 

Ball bearing distress 

Feathery or flaky 

Heavy rectangular shape with regular crossing marks (team lines) 

Shiny, roughly circular, petalled chips 

B 

Damage process 

Particle type 

Surface appearance 

Mild wear (delamination) 
Adhesion/scuffing 

Abrasion/cutting 

Fatigue 

Erosion 

Fretting 

Corrosive wear 

Small flat reflective flakes 

Larger ragged flakes often 
with temper colours 

Bright slivers and curls 

Sharp metallic chunks and 
small spheres 

Bright chunks or spheres 

Fine red-brown iron oxide 

Powdery non-reflective deposit 

As machined but with more plateau area 
Rough and torn 

Scratched and scored 

Cracked and spalled 

Pits or grooves with rough surface 
Localized staining or indentation 

Fitted and discoloured 


Sources: Collacott (1975); Rudston (1989). 


19.11.8 Other general methods 

Other methods that are used to monitor condition include 
the measurement of conventional variables such as tem¬ 
perature, position, speed and torque, and magnetic field 
measurements. 

Temperature is used in particular to monitor plain bear¬ 
ings. It is not so good an indication for ball bearings, however. 

Blades of rotating machinery such as turbines or fans 
may be magnetized or, if made of non-magnetic material, 
may be seeded with a magnetic implant. The ‘magnetic 
signature’ caused by the rotation of the magnetized part 
may then be monitored by a magnetic sensor. 

There are numerous other physical phenomena that may 
be made the basis of a method of condition monitoring. 


Barnhart (1963) has listed some 387 physical laws and 
effects. 

19.11.9 Specific ad hoc methods 

In addition to the general methods described, there are a 
number of ad hoc methods for monitoring specific items of 
equipment. A good illustration of such methods is the 
rotary joint application described in Section 19.9. 

Two further examples will suffice, one on pumps and one 
on valves. The first is the work of D. Harrison and Watkins 
(1983) on instability in pump mechanical seals, prompted 
by severe difficulties on main oil line pumps offshore. The 
problem involves vaporization between the seal faces of 
the pumped fluid that normally lubricates the seals. The 
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authors describe the measurement of the seal leak chamber 
pressure as an indicator of the onset of instability. 

D. Harrison and Heath (1983) have described work on the 
use of changes in valve torque as a measure of incipient 
failure to achieve the fully open or closed position. 

19.11.10 Adaptive noise cancellation 

In many monitoring applications there is an appreciable 
degree of background noise. One technique which has been 
developed specifically to deal with this problem is that of 
adaptive noise cancellation (ANC), described by Widrow 
etal. (1975). 

An account of the application of ANC to the monitoring 
of rolling element bearings has been given by Tan and 
Dawson (1983). 

19.12 Vibration Monitoring 

Vibration monitoring is described in Mechanical Fault 
Diagnosis (Collacott, 1977b) and Mechanical Vibration and 
Shock Measurements (Broch, 1980) and by Fieldhouse 
(1970), Tbstin (1971), F.G. Jones (1971), C. Jackson (1975-), 
Erskine (1976a,b), Goldman (1984) and Goggin (1987). 

19.12.1 Machine vibration 

Much information on the condition of machinery can be 
obtained by monitoring vibrations. Monitoring needs to be 
combined with a theoretical analysis of the vibration 
modes so that particular faults can be distinguished. 

Accounts of vibration include Vibration and Sound 
(Morse, 1936), Mechanical Vibrations (den Hartog, 1956), 
Engineering Vibrations (Jacobsen and Ayre, 1958), Shock 
and Vibration Engineering (C.T. Morrow, 1963), Structure- 
Borne Sound (Cremer and Heckl, 1973), Vibration Problems 
in Engineering (Timoshenko, Young and Weaver, 1974), 
Elements of Vibration Analysis (Meirovitch, 1975), Shock 
and Vibration Handbook (C.M. Harris and Crede, 1976) 
and Mechanics of Vibration (Bishop and Johnson, 1979). 

Broch gives an account of vibration and shock that covers 
its characterization, the response of mechanical systems 
to it, its effect on mechanical systems, its measurement, 
its analysis, and its use for machinery health monitoring. 

As an illustration, consider the pinion gear assembly 
described by Fieldhouse (1970) and shown in Figure 19.7. 


The analysis given by this author of some of the fre¬ 
quencies of vibration generated by this mechanism is 
summarized in Table 19.12. 

Numerous other analyses of the modes of machine 
vibration are available. 


19.12.2 Vibration quantities 

Vibration quantities that are measured are (1) displace¬ 
ment, (2) velocity and (3) acceleration. Each quantity is 
measured using a different type of transducer. 

Displacement measurement is utilized for detecting the 
change in clearances. It is particularly useful on recipro¬ 
cating machines. It discounts and is not suitable for high 
frequencies (> 1000 Hz). 

Velocity measurement is a commonly used method 
for both machines and structures. It gives equal weighting 
to both low and high frequencies, since it is the product 
of the displacement and frequency of each harmonic 

C °Acceleration measurement is useful for detecting impact 
effects. It discounts and is not suitable for low frequencies. 

The choice of vibration quantity and measurement 
device is discussed by Broch (1980). There has been a trend 
towards higher frequencies, and measurements may be 
made at 10 Hz or higher. Broch’s account emphasizes the use 
of accelerometers, with velocity or displacement obtained 
by integration. 

The units of measurement commonly used are 
Displacement pm mil 

Velocity mm/s in./s 

Acceleration m/s 2 ft/s 2 

There are also several different signal quantities that 
may be measured. These are (1) peak, (2) peak-to-peak, 
(3) average and (4) root mean square (rms). All these quan¬ 
tities are used in the various instruments currently avail¬ 
able for the measurement of the vibration quantities 
(displacement, velocity and acceleration). 

The peak and peak-to-peak values give, respectively, the 
peak vibration loading and the swing in loading; the aver¬ 
age and rms values give, respectively, the average vibration 
loading and the power in the loading. The peak and peak-to- 
peak values are dependent on the waveform, but the aver¬ 
age and rms values are not. 


31.2 Hz (order 47) 



Figure 19.7 Pinion gear assembly (Fieldhouse, 1970) (Courtesy of Sound and Vibration) 
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Table 19.12 Some frequencies arising from a pinion gear assembly (after Fieldhouse, 1970) (Courtesy of Sound 

and Vibration) 




Assembly parameters: 




No. of teeth on input gear, Ni 

29 



No. of teeth on output pinion, N 2 

62 



Diameter of inner race, d\ 

3 in. 



Diameter of outer race, d 2 

4 in. 



Diameter of balls, d 3 

0.5 in. 



Number of balls, N 

18 



Speed of rotation of input shaft, n 3 

4000 rev/min 



Constant D\ (= d\j(d\ -yd^)) 

0.428 



Constant D 2 (= d 2 \(d-± -Fd 2 )) 

0.572 





Hz 

Order 

Assembly frequencies: 


Frequency of rotation of input shaft, f nl 


66.7 

1 

Fundamental gear mesh frequency, f gm ( =f„iN() 


1934.3 

29 

Frequency of rotation of output shaft, f n2 (= f gm / N 2 ) 


31.2 

0.47 

First upper sideband of gear mesh frequency, f u (= f» m +/»i) 

2001 

30 

First lower sideband of gear mesh frequency, /*( = f gm 

-/„i) 

1867.6 

28 

Differential frequency of rotation of inner and outer n 

ices ,f r (=f n 0 

66.7 

1 

Frequency of ball spm,f s (=f r Di(d 2 /d3)) 


228 

3.4 

Frequency of ball train passage, f t (= f r Dj) 


28.5 

0.43 

Frequency of flaw on inner race, j/i( = f r ND 2 ) 


687 

10.2 

Frequency of flaw on outer race, f f2 ( = f r NDj) 


514 

7.7 

Frequency of flaw on ball, f f3 ( = 2/ s ) 


456 

6.8 


The peak vibration velocity is the quantity generally 
considered to be the most useful signal by some authors 
(e.g. Erskine, 1976a). If a peak value is required, it is 
important to ensure that a true peak reading meter is used, 
as described below. 

Alternatively, the full power spectrum of the signal may 
be produced. Spectral analysis instruments are available 
to generate the power spectrum. 

An illustrative example showing the value of signal 
filtering is given by Goldman (1984). He considers the 
monitoring of a gearbox which has a mesh frequency of 
1 Hz and an outer race ball pass frequency of 236 Hz. Typi¬ 
cal signals might be: 


Velocity (in./s) 

Week 

Overall 

Mesh (1 Hz) 

Bearing (236 Hz) 

1 

0.1 

0.1 

0.01 

2 

0.1 

0.1 

0.02 

3 

0.1 

0.1 

0.03 

4 

0.1 

0.1 

0.04 

5 

0.11 

0.0 

0.05 


Measurement of the strength of the overall signal would 
show relatively little change, but separate measurement of 
the mesh and bearing signals would show the bearing 
beginning to fail at about week 3 and being close to failure 
by week 5. 

19.12.3 Vibration measurement 

The instrumentation used for vibration monitoring con¬ 
sists of a transducer, a signal conditioning amplifier and a 
readout meter. The transducer may measure displacement, 


velocity or acceleration directly. Alternatively, acceleration 
may be integrated to give velocity, and velocity to give 
displacement. An account of vibration measurement is 
given be Broch (1980). 

The function of the amplifier is to give a larger power 
signal and to transform it into the signal quantity required. 
Many instruments scaled for peak, peak-to-peak or rms 
values in fact read the average value. The different types 
of circuitry are described by Erskine (1976a). 

There are a number of practical aspects that need to be 
observed if satisfactory results are to be obtained in vibra¬ 
tion monitoring work. On each occasion, the measurement 
should be taken at the same point and in the same direction. 
Therefore, if a portable monitor is used it is useful to indi¬ 
cate the point with a small circle of white paint with a small 
hole drilled in the centre. The tendency for a portable 
transducer to bounce can be overcome by the use of a ‘mole’ 
wrench as a clip. The same instrument should always be 
used to take a given reading, since instruments which 
ostensibly read the same parameter may in fact have dif¬ 
ferent internal circuitry. The transducer should be cali¬ 
brated at intervals of 18 months or less and the instruments 
at intervals of 3 months. 

As far as possible vibration measurements should be 
made under the same machine conditions. Some variable 
speed machines have a rotor critical speed within the 
operating range, although the machine should not be 
operated at this speed. If it is being so operated, the addi¬ 
tional vibration detected is an indication of maloperation 
rather than malfunction. 


19.12.4 Vibration criteria 

For rotating process machinery such as turbines, com¬ 
pressors, pumps and fans there are some general guidelines 
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available to determine the level of vibration at which action is 
required, that is the vibration criteria. Early vibration cri¬ 
teria were those proposed by Yates (1949) and Rathbone 
(1963). A widely used set of vibration criteria is that of the 
IRD, the details of which are quoted by Collacott (1977b). 

One of the most widely used guidelines for general pro¬ 
cess machinery is that given inVDI 2056:1964 Standards 
for Evaluation of Mechanical Vibration of Machines. 

Criteria for the balancing of machines are given in 
ISO 1940: 1986-Mechanical Vibration-Balance Quality 
Requirements for Rigid Rotors, ISO 2371:1974 Field Balanc¬ 
ing Equipment: Description and Evaluation, ISO 2953: 
1985 Balancing Machines: Description and Evaluation and 
ISO 3945: 1985 Mechanical Vibration of Large Rotating 


Machines with Speed Range from 10 to 20 r/s: Measurement 
and Evaluation of Vibration Severity in situ. 

Vibration criteria, both for independent bearings and for 
bearing housings in barrel casings, which have been devel¬ 
oped from the VDI method and used in ICI, have been 
described by Erskine (1976a) and are given in Figure 19.8 The 
quantity used is the peak vibration velocity, which has the 
advantage that it is independent of the machine speed and 
vibration frequency. Experience also indicates that Figure 
19.8 canbe used for gearboxes if they are treated as GroupT. 

These vibration criteria provide general guidance. In 
practice, it is usual to take an initial baseline set of meas¬ 
urements on the particular machine and thereafter to 
monitor the trend on that machine. 



To use chart: 

(a) decide machine group 

(b) divide readings by service factor 

(c) determine from chart the region in 
which corrected readings fall 

(d) for barrel casings divide by 1.5 

Figure 19.8 Vibration criteria for process machinery (Erskine, 1976a) (Courtesy of the Institution of Chemical Engineers) 
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Another useful source of information for comparison 
may be the vibration levels on similar machines in a group. 

Use may be made of certain rules of thumb. Goldman 
refers to the rule that a doubling of the signal strength is 
an indication of trouble, whilst a trebling is cause for 
concern. 

19.12.5 Shock pulse monitoring 

A particular type of vibration monitoring which is based 
on selective filtering is shock pulse monitoring. The shock 
pulse meter (SPM) exploits two facts. One is that at the 
natural frequency of a mounted accelerometer a large elec¬ 
trical output can be obtained from a small excitation. The 
other is that an instantaneous impact gives a signal that 
contains all frequencies at equal amplitude, in other words 
white noise. Thus, the signal given by an impact will con¬ 
tain the frequency required to excite the accelerometer. In a 
SPM, the signal at this frequency is amplified by the 
accelerometer, filtered and then measured. 

The main application of the SPM is the monitoring of 
faults in ball bearings. If, for example, a single spall devel¬ 
ops in the outer race, an impulse occurs each time a ball 
passes over the spall. As deterioration occurs, the level of 
white noise, and the signal from the meter, should increase. 

In practice, there are certain problems which can arise. 
There may be sources of white noise which are unrelated to the 
defect and, as the defect grows, the signal generated may no 
longer be white noise.The situation can occur where the meter 
signal actually reduces as the deterioration progresses. 

An enhancement of the SPM technique is the use of a 
stress wave analyser (SWAN), which exploits the fact that 
the amplitude of the impulse is proportional to the relative 
velocity between the two bearing surfaces and to the depth 
of the imperfection, and gives a signal proportional to the 
area of the bearing fault. 

19.12.6 Plant applications 

Vibration monitoring can be applied both to rotating 
machines and to static plant. The quality of information 
that can be obtained goes far beyond the detection of the 
fact that something is wrong, and it is often possible to 
pinpoint the fault quite precisely. 

Some typical information given by vibration fre¬ 
quencies, particularly those that are multiples of the speed 
of rotation, is shown in Table 19.13. 

Figure 19.9 illustrates time histories and power spectra 
of vibration signals for some typical rotating machine 
conditions. 

Vibration methods can also be applied to static plant 
such as distillation and gas absorption columns and heat 
exchangers. Figure 19.10 shows the power spectrum of a 
heat exchanger under normal and abnormal conditions. 

In many cases, the level of vibration at a particular fre¬ 
quency or frequency range is low, unless there is an abnor¬ 
mal condition. In such cases, arrangements can be made to 
filter out all other frequencies so that the level of signal 
retained is an unambiguous indication of the abnormality. 
Thus for the heat exchanger shown in Figure 19.10 a suit¬ 
able filter is one which retains only frequencies in the range 
250—750 Hz. The resultant signal can then be used to indi¬ 
cate heat exchanger rattling. 

19.12.7 Monitoring policy 

There is now considerable vibration monitoring activity in 
process plants. Some machine conditions are monitored by 


Table 19.13 Frequencies detected for some common 
process machinery faults 


Fault 

Frequency 1 

Oil whirl 

I xN 

Unbalanced, eccentric journals 

i xN 

Misaligned shaft 

1 xJV 

Aerodynamic forces (fan) 

1 xN 

Reciprocating forces 

l,2...xlV b 

Bent, cracked shaft 

1, 2 x N c 

Misalignment of couplings or 
bearings 

1, 2,3 x N d 

Mechanical looseness 

1, 2,3,4 x N 6 

Defective gear 

n s xN 

Blade defect 

n t xN 

Failing coupling 

n c xN 

Defective belt drive 

1, 2,3,4xK b 

Defective bearings 

Very high, several 
times N 

Defective mountings (soft foot) 

1,2 x/V f 

Structural resonance 

1 xiV B 


Sources: Lees (1980b); Goldman (1984); Goggin (1987). 

a lV, the rotational speed of the machine (rpm); « b , the rotational speed 

of the complete belt; n g , the number of gear teeth; rq, the number of 

blades. 

b 1,2 x Wand higher orders. 

c Goldman gives 2 xJV; Goggin usually gives 1 x N, or 2 x N if bent 
at coupling. 

d Goldman gives 2x N\ Goggin usually gives lxiV, sometimes 
2,3 xN. 

e Goldman gives 1,2,3,4 x iV; Goggin gives 1,2,3 x N. 
f Usually 1 x N, sometimes 2 x N. 

8 1 xN, but often odd non-synchronous frequency. 

permanent instruments, others are checked by portable 
meters. On critical items such as turbines, compressors and 
large pumps there is a high proportion of continuous moni¬ 
toring with alarms and trips. These machines are also the 
subject of further spot checks and of sophisticated spectral 
analysis by specialist staff. For other less critical machines, 
spot checks by less skilled personnel using portable meters 
are often sufficient. 

An account of monitoring policy is given by Goldman 
(1984). Continuous monitoring is likely to be appropriate if 
(1) the machine is critical to production, (2) it is costly to 
replace and/or (3) its failure would be hazardous. Periodic 
monitoring may be carried out on machines where (1) the 
machine is moderately important for production, (2) its 
replacement is costly, (3) it is a major machine but is spared 
or (4) it has a poor operating history. 

The vibration criteria at which action is required depend on 
the application. For meter checks by unskilled people it is 
essential to have very simple criteria, while specialist person¬ 
nel may base their decisions on much more complex analysis. 


19.13 Corrosion Monitoring 

There are available a number of methods for the moni¬ 
toring of corrosion, both on-line and otherwise. Accounts 
of corrosion monitoring are given in Industrial Corrosion 
Monitoring (Hines, J.G. (chrmn) (1978) and by Harrell 
(1978), Rothwell (1979), Strutt, Robinson and Turner (1981), 
Asher et al. (1983), Dawson, Eden and Hladky (1983), 
Robinson and Strutt (1983) and M. Turner and King (1986). 
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Figure 19.9 Trend records and power spectra of some typical machine conditions (Collacott, 1975): 
(a) normal operation; (b) imbalance; (c) shock; (d) impending major failure 


Corrosion monitoring may be undertaken for a variety of 
reasons. It may be used to (1) inspect for corrosion and, in 
particular, give early warning of severe corrosion, and to 
(2) diagnose a problem, (3) monitor a solution to a problem, 
(4) correlate the corrosion regime with the plant operating 
conditions, (5) monitor the operation of the plant and 
(6) control the operation of the plant. 

Corrosion is a complex phenomenon. This is so even 
under the controlled conditions of the laboratory and even 
more so on an operating plant. Corrosion has a number of 


causes and it is not advisable to place total reliance on a 
single method. 

Some corrosion monitoring techniques identify the cor¬ 
rosion regime in the plant, whilst others indicate or 
measure the corrosion actually occurring. Taking the 
latter first, some principal methods are visual inspection, 
coupon testing and sentinel holes. 

Visual examination requires access and is used particu¬ 
larly at shut-downs. There are a variety of aids to visual 
examination, including closed circuit TV and optical 
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Figure 19.10 Power spectrum of a heat exchanger (Erskine, 1976a): curve 1, exchanger quiescent; curve 2, exchanger 
rating (Courtesy of the Institution of Chemical Engineers) 


techniques. Coupon testing involves locating a sample 
element in the equipment and measuring the degree of cor¬ 
rosion of the element. A sentinel hole is a hole drilled through 
from the outside to a point close to the internal surface, 
so that it will leak if significant internal corrosion occurs. 

Some authors include among the techniques of corrosion 
monitoring NDT methods such as radiography, ultrasonics, 
eddy current testing, AE testing and thermography. 

Electrochemical methods of corrosion monitoring are 
described hy Strutt, Robinson and Turner (1981). These 
methods are used for investigating the corrosion regime 
and include (1) chemical analysis, (2) the corrosion poten¬ 
tial method, (3) linear polarization resistance (LPR), 
(4) electrochemical impedance, (5) potentiodynamic scans 
(PDSs) and (6) electrochemical noise. 

The LPR, electrochemical impedance and PDS tech¬ 
niques all involve the investigation of current and voltage 
using a set of probes. The main difference between them is 
the form of input signal to the probe and the analysis per¬ 
formed on the output. 

Electrochemical methods are best suited to providing 
early warning of corrosion behaviour and to correlating the 
corrosion regime with the operating conditions. 

The control of electrochemical corrosion measurements 
and the display of data in various forms is a natural appli¬ 
cation for a microprocessor. The authors illustrate a num¬ 
ber of plots that may be displayed, including trend charts, 
scatter diagrams, control charts, polarization diagrams 
and Nyquist diagrams. A polarization diagram is a plot of 
potential vs current and a Nyquist diagram a plot of resist¬ 
ance vs reactance over a range of frequencies. 

An overview of corrosion monitoring methods is given by 
Rothwell (1979), who tabulates for each technique the type of 
information which it yields, the type of corrosion for which it 
is suitable, the environment in which it may be used, the time 
taken for the measurement to be made, the response to 
changes in corrosion, the application of the technique to an 
operating plant, and the ease of interpretation. 

A method widely used to measure the actual rate of cor¬ 
rosion is coupon testing. The corrosion of the coupon may 
be measured gravimetrically by periodically removing and 
weighing it. It is important to locate the coupon so that it is 
representative of the corrosion to be monitored. It should 
generally be flush and in continuity with the vessel or 
pipe unless it is specifically desired to measure local cor¬ 
rosion/erosion effects. The choice of element size is a 
compromise between measurement sensitivity and replace¬ 
ment frequency. 


The coupon testing method may be adapted to form the 
basis of an instrument for the measurement of the corro¬ 
sion rate. The electrical resistance of the sample element 
increases as its cross-sectional area decreases and thus 
provides a measure of the cross-section remaining. Since 
the electrical resistance is sensitive to temperature, corro¬ 
sion meters need to be temperature-compensated by using 
a reference element that is not exposed to corrosion. The 
corrosion rate is obtained by differentiating the reading of 
a corrosion meter. 

The current in an electrical resistance corrosion meter is 
appreciable. For use in a hazardous area the intrinsic safety 
of the system may need to be checked. 

Another technique for the measurement of the corrosion 
rate is radioactivation, as described by Baker-Counsell 
(1985g). This involves making mildly radioactive the sur¬ 
face which is subject to corrosion and measuring the 
change in radioactivity. In the thin layer activation version 
of this method, only a thin layer at the surface is activated. 
This has the advantages that the sensitivity of the meas¬ 
urement is high and the radioactivity so low as to obviate 
the need for taking any special precautions against it. 

Typical corrosion rates are of the order of 10 mil/year 
(1 mil = 0.001 in.), but rates can vary widely and, in par¬ 
ticular, under certain process conditions may accelerate 
dramatically. 

Examples of the use of corrosion monitoring are given by 
Rothwell (1979). Case histories are described by Harrell 
(1978). A detailed account of the monitoring of a standard 
corrosion experiment, the corrosion behaviour of 316 
stainless steel in 0.1 M NaCl, is given by Strutt, Robinson 
and Turner (1981). 

Another method of monitoring corrosion and erosion is 
to measure the wall thickness by using ultrasonics.The use 
of ultrasonics in this application, and in particular as a 
method of obtaining results reproducible enough to track 
the progress of any thinning, is described by Browne and 
Constantinis (1983). 

19.14 Acoustic Emission Monitoring 

Many physical phenomena are associated with the emis¬ 
sion of noise. Examples are the creaking of the branch of a 
tree and the ‘cry’ of tin. AEs may be picked up by a micro¬ 
phone and used to monitor both pressure vessels and 
process machinery. 

AE monitoring is dealt with in Mechanical Vibration 
and Shock Measurements (Broch, 1980), the two IChemE 
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guides described below, and by McFarland (1970), Witt 
(1971a), Fowler and Scarpellini (1980), Cole (1983, 1988, 
1990, 1992), LM. Rogers and Alexander (1983), Treleaven 
(1983), Fowler (1986, 1987, 1988, 1992), Pollock (1986), 
Clough (1987), Heiple and Carpenter (1987), Frieshel and 
Jones (1988), Prasek (1988), Zhang (1988) and Hewerdine 
(1991). 

The earlier guide published hy the IChemE, Guidance 
Notes on the Use of Acoustic Emission Testing in Process 
Plants, was prepared by a working party of the Interna¬ 
tional Study Group on Hydrocarbon Oxidation (ISGHO) 
(1985), and the current guide, Plant Integrity Assessment by 
Acoustic Emission Monitoring (Hewerdine, 1993) (the 
IChemE AE Monitoring Guide), was prepared by the 
International Process Safety Group (IPSG), the successor 
to the ISGHO. 

19.14.1 AE sources 

When a defect undergoes change, such as a crack experi¬ 
encing growth, there is a release of energy, part of which is 
converted to elastic waves. This acoustic energy may be 
detected, and this forms the basis of AE monitoring. Some 
principal AE sources are crack growth, corrosion product 
fracture and local yielding. 

19.14.2 AE signals 

An AE occurs when a defect in a metal plate is put under 
stress. An elastic stress wave travels through the plate. The 
measurement of this wave is the basis of the AE technique. 
The emissions of interest occur in‘bursts’, each burst being 
known as an event. Figure 19.11 illustrates a typical AE 
event. The start of the event occurs with the initial signal at 
arrival time t a . There then occur a number of excursions, or 
counts, outside the set threshold. The event is characterized 
by the arrival time, the duration, the number of counts and 
the amplitude of the largest count, or maximum amplitude. 

An AE is not emitted on all occasions when a defect is put 
under stress. It was held in early work that an emission 
occurs only when the stress is taken to a value higher than 
that previously applied. This is the Kaiser effect and it 
assumes that the energy release is irreversible. Later work 
showed that this was not the whole story, and that if a suf¬ 
ficient recovery period is allowed the emissions can again 
be obtained at lower stresses. This disappearance of the 
Kaiser effect is known as the Felicity effect. The sig¬ 
nificance of this is that if the fading of the Kaiser effect did 
not occur, it would be possible to use AE monitoring only 
for applications where a vessel was subject to successively 
higher pressures, which would be a severe limitation. 

Different materials exhibit different AE characteristics 
and in order to apply the technique it is necessary to 
establish these. AE monitoring has been applied inter alia 
to carbon steel, stainless steel and fibre reinforced plastic 
(FRP) equipment. 

19.14.3 AE measurement 

A typical set-up for the AE monitoring of a vessel is a set of 
three or more probes. By using a set of three probes to give 
‘triangulation’ and utilizing the travel times of the emission 
waves measured hy the probes, it is possible, in principle to 
locate the source of the emission. 

There are in fact a number of practical problems in doing 
this: the level of background noise; interference between 
one event and another; the assumption that the stress wave 


travels at a constant, known velocity and the calibration of 
the AE equipment. 

The assumption of a constant stress wave velocity 
applies to flat steel plate. There are differences in velocity 
for waves in flat steel plate and in the curved walls of ves¬ 
sels. Also, the different frequency components travel at 
different velocities. 

An approach based on zone location rather than source 
location, described by Fowler (1987), attempts to overcome 
some of these difficulties. 

19.14.4 AE signal analysis 

Early approaches to AE monitoring concentrated primarily 
on the location of defects. More recent work has extended 
this to the characterization of the parameters of the signal 
and of the defects. To this end extensive use is made of 
computer processing of the signals obtained. 

19.14.5 AE monitoring characteristics 

AE monitoring is therefore a technique for detecting the 
occurrence, and measuring of the magnitude of, dynamic 
changes occurring in defects rather than of the static 
defects. This is a fundamental difference between AE 
monitoring and conventional NDT methods. It has a num¬ 
ber of implications. 

One is that AE signals occur only whilst changes are 
taking place. Thus AE monitoring is typically conducted 
on a periodic basis, when plant loading is being altered, 
rather than continuously. 

Another consequence is that a site which gives a signal 
detectable by AE monitoring may not give one detectable by 
NDT methods, and vice versa. AE monitoring can detect 
cracks that are growing, even though they may still be 
small, whereas NDTdetects only larger cracks. On the other 
hand, the AE technique may not detect even such larger 
cracks unless they are experiencing growth at the time 
when the measurements are made. 

Since AE methods give information on defect changes 
they complement well the techniques of fracture mechanics 
described in Chapter 12. 

AE has the advantage that it is a global monitoring 
technique that allows the whole of a structure or vessel to be 
monitored. This distinguishes it from many NDT methods, 
such as ultrasonics or eddy current testing, which inspect a 
limited area. Furthermore, AE monitoring requires only 
limited access to the equipment and allows remote detec¬ 
tion and location of flaws. 

Limitations of AE monitoring are that: the structure has 
to be loaded; the source activity is highly dependent on the 
material; there may be interference from noise; the inter¬ 
pretation of the results can be difficult; the location of the 
flaw may not be very accurate; and identification of the 
type of defect may not be readily made. 

19.14.6 AE monitoring standards and codes 

There are a number of standards and codes applicable to 
AE monitoring. ASTM standards include: ASTM E 
569-91E1, giving general guidance; ASTM E1067-89, on 
FRP tanks and vessels and ASTM E 1211-87, on leak 
detection. 

Treatments proposed by the ASME include those on the 
use of AE in lieu of radiography (1982), FRP vessels (1983) 
and on metallic pressure vessels (1989). 

The Society of the Plastics Industry (SPI) (1987) has also 
issued a recommended practice for FRP tanks and vessels. 
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Figure 19.11 A typical signal from an acoustic emission test 


Rail tank car monitoring is covered by a procedure of the 
Association of American Railroads (AAR) (1991). 

With regard to the status of AE monitoring as a recog¬ 
nized method in pressure vessel codes, the technique has 
not achieved this status. The testing of new vessels is 
adequately covered by existing NDT techniques. Where AE 
has found a niche is: in the testing of new FRP vessels, 
where conventional NDT methods are less effective; as a 
complement to hydrostatic testing and in the operational 
monitoring of critical vessels. Since AE is a global inspec¬ 
tion method, it appears a strong contender to satisfy any 
code requirements that may be developed for the inspection 
of pipework. 

19.14.7 AE monitoring procedures 

The effective application of AE monitoring requires 
adherence to a properly formulated procedure. A widely 
used procedure is MONPAC, developed in and licensed by 
Monsanto (1990). The procedure specifies the material and 
equipment covered, the maximum background noise, and 
the maximum sensor spacing. 

The results obtained in the procedure are allocated to one 
of five grades, from A indicating minor source/no action, to 
E indicating intense source/immediate action. An account 
of the use of MONPAC is given by Cole (1990). 

19.14.8 AE monitoring applications: FRP vessels 

AE monitoring was applied early to the testing of new 
metal pressure vessels, but at first with limited success. It 
was found, however, that AE monitoring was of particular 
value in the testing and monitoring of FRP pressure 
vessels. 

The use of AE for the testing and monitoring of FRP 
vessels has been described by Fowler and Scarpellini 
(1980) and Fowler (1987,1988), who give an account of its 
development in one company. Initially the failure rate of 
FRP vessels, both new and in service, was unacceptable, 
some of the failures being total ruptures. Many of the con¬ 
ventional NDT techniques are not, however, applicable to 
FRP. It was therefore attractive to use AE, provided it could 
be made to work. In fact some problems which occur with 


the use of the technique on metal vessels, such as back¬ 
ground noise, are less severe with FRP. The method proved 
successful to the extent that there is no record of any sig¬ 
nificant FRP defect escaping AE testing, and that it became 
possible to prevent catastrophic failures of FRP vessels. 
The technique has been adopted within the FRP industry 
in the United States. 

Some relevant standards and codes are given Section 
19.14.6. 

19.14.9 AE monitoring applications: metal equipment 

Despite initial difficulties, AE monitoring of metal equip¬ 
ment has been developed and now constitutes the main area 
of use. The applications of AE to metal equipment are 
principally for the monitoring of pressure vessels during 
hydrostatic pressure testing and of operating pressure 
vessels, particularly during the transients that occur dur¬ 
ing start-up and shut-down. 

AE monitoring is also used in the testing of certain 
equipment such as large field-erected storage tanks and 
vessels in certain special materials such as titanium. 

Since it is defect changes that AE monitoring detects, 
continuous monitoring is less common, but is practised in 
some instances. In some cases, vessels are fitted with per¬ 
manent equipment for AE monitoring. 

The use of AE monitoring during the hydrostatic testing 
of pressure vessels has been described by McFarland 
(1970). Adam (1982) has given an account of its use on 
ammonia storage spheres. Its application to large, refrig¬ 
erated storage tanks for liquid ammonia, which are diffi¬ 
cult to inspect internally, is described by Prasek (1988). 
Parry (1980) has given an account of its use to investigate 
potential problems on ammonia converters, including 
stress corrosion cracking and fretting of shrunk-on bands. 

Some applications of AE monitoring to process equip¬ 
ment have been described by Cole (1983). These include a 
jacketed reactor, a reactor train, a multi-wall high pressure 
vessel and storage tanks, as well as FRP vessels. For the 
jacketed reactor, the technique was able to detect defects in 
the inaccessible space between the shell and the jacket (the 
20 min period following admission of steam to the jacket 
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giving strong AEs) and associate with thermal stress and 
corrosion. The reactor train exemplifies early detection of 
stress corrosion cracking. The multi-layer reactor is an 
illustration of an equipment that is difficult to inspect by 
conventional means. The application to storage tanks 
exploits the technique’s ability to give good volumetric 
coverage. 

The application of AE monitoring to propagating fatigue 
cracks in node joints and crane pedestals on offshore 
structures is described by L.M. Rogers (1983). Of particular 
value is the ability of the technique to give global coverage 
of all welded joints, including those that are otherwise 
inaccessible. 

An application of continuous AE monitoring is that on 
the blast furnace stove domes at Redcar, described by Cole 
(1983). Other applications are described in the IChemE 
AE Monitoring Guide. 

19.14.10. AE monitoring applications: leaks 
High pressure and high velocity leaks give characteristic 
noise, as does pump cavitation, and the detection of these is 
another application of AE monitoring. The use of this 
method to detect tube failures in heat exchangers and 
boilers has been described by Ghia et al. (1983). 

19.14.11 IChemE AE Monitoring Guide 

The IChemE AE Monitoring Guide deals with the tech¬ 
nique under the following headings: (1) scope, (2) role in 
structural integrity assessment, (3) applicability to process 
vessels and pipework, (4) practical requirements, (5) spe¬ 
cific examples and (6) practical experience, as given by a 
user survey. It includes appendices on (1) AE basics, (2) AE 
test and report specifications, (3) standards and codes, 
(4) survey returns, (5, 6) questionnaires and (7) biblio¬ 
graphy. 

The Guide emphasizes the importance of defining the 
purpose for which AE monitoring is to be conducted and 
gives a flow diagram for the development of the monitoring 
strategy. The work should be undertaken only if both the 
plant and the technique are suitable, the level of back¬ 
ground noise is not excessive and the exercise is economic. 

Under practical requirements the Guide deals with the 
definition of the responsibilities of the operator and the AE 
contractor, the establishment of the feasibility of AE test¬ 
ing, the experience and qualifications of the contractor, the 
essential information on the containment, and the test 
specification, covered in Appendix 1. 

The practical applications described cover a liquefied petro¬ 
leum gas (LPG) storage sphere, an ammonia storage sphere, 
an ethylene storage bullet, a refrigerated ammonia storage 
tank and storage tank floor; a nitric acid column, a stainless 
steel column and an insulated carbon steel and stainless steel 
columns; a Hastelloy B reactor; a boiler drum; a deaerator; 
glass reinforced plastic storage tanks for sulfuric acid and 
hypochlorite; pipework; a crane and bearings. 

Detailed results are given from the user survey, the sec¬ 
tions of which cover the number of tests done by the parti¬ 
cipant companies, the types of test done, the types of 
structure tested, the materials of construction of these 
structures, the perceptions of success and the future 
intentions. It contains in Appendix 4 single-sheet sum¬ 
maries of individual applications. 

The survey indicates that the majority of applications are to 
metal structures and use commercial packages, principally 
MONPAC. The main use is for in-service testing of pressure 


storage vessels and other vessels and storage tanks. More 
experienced users also conduct pre-service tests. 

The Guide gives recommendations on the use of AE 
monitoring. 


19.15 Plant Monitoring: Specific Equipment 

As the foregoing account indicates, monitoring techniques 
can be applied to a wide range of plant equipment. 

For defects in rotating equipment, prime techniques 
are performance monitoring and vibration monitoring. 
Another important method is debris analysis. 

For static equipment such as tanks, vessels, columns and 
pipework, widespread use is made of ultrasonics. Such 
NDT methods are increasingly being complemented by AE 
monitoring. Corrosion monitoring is another technique 
that is widely applied, to static plant particularly. 


19.16 Pipeline Inspection and Monitoring 

19.16.1 Pipeline inspection 

Pipelines present a rather different inspection problem 
from that posed by regular process plant in that they are 
outside the factory fence, are very long, are usually bur¬ 
ied, and are normally required to operate without shut¬ 
down. 

Traditional methods of inspection include liaison with 
local farms through whose land the pipeline passes, walk¬ 
ing the pipeline and aerial survey of the pipeline. In some 
cases, bar holes may be sunk near the pipeline to take gas 
detectors. Use may be made of a search gas or radioactive 
tracer. 

Inspections may also be made of the CP of the pipeline 
such as checking on coupons of the material and on the pH 
of the electrolyte in contact with the protected surface. 

19.16.2 Inspection vehicles 

The alternative to these conventional, and rather limited, 
methods is the use of an inspection vehicle, or ‘intelligent 
pig’. This device is now routinely used by British Gas for the 
inspection of its pipeline grid. An account has been given by 
Braithwaite (1985).The company operates some 17,000 km of 
high pressure natural gas transmission pipeline in Britain. 
Atypical line interval for inspection is about 80 km. 

The inspection specification for the pig required that it 
should detect, locate and size defects and distinguish 
defects from other features with a low incidence of spurious 
indications. Three types of defect were of interest. One is 
geometric damage, which includes ovality, dents and wrin¬ 
kles. Another is metal loss due to corrosion or impact. The 
third is crack-like defects such as plate rolling laminations, 
stress corrosion cracks and fatigue cracks. The avoidance 
of spurious indications is of some importance, because 
frequent spurious indications leading to the excavation of 
the pipeline would rapidly cause a loss of credibility. 

The engineering specification required that it be capable 
of passing through the line without sudden changes of 
speed and without jamming in the line. 

The pig is designed to operate in pipelines containing 
gaseous or liquid hydrocarbons. The pig contains three 
principal systems: the NDTequipment, the electronics and 
the power pack. There are three NDTsystems: one surveys 
the geometry of the pipe, another detects metal loss, 
and the third inspects for cracks. 
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The quantity of data generated by the inspection equip¬ 
ment is very large. An area of 1 cm 2 is significant in defect 
terms and a typical line section of 80 km has an area of 
some 3 x 10 9 cm 2 . It is not practical to store all the data 
generated and a computer is included to perform on-board 
data handling. 

Braithwaite also describes the selection of the maximum 
inspection intervals, the field operations and the reporting 
and rectification procedures. 


19.16.3 Pipeline leak monitoring 

There are a number of methods available for monitoring the 
detection of leaks in pipelines. An account is given by Ellul 
(1989). 

One approach is the use of acoustic monitoring. When a 
leak occurs, the sudden pressure drop creates a rarefaction 
wave that propagates away from the leak point at thespeed of 
sound.This wave canbe detected by acoustic monitoring. 

Acoustic monitoring gives information on the existence 
and location of a leak, but little on its size. In ideal conditions 
it can detect very small leaks, but it is less effective against a 
background of noise from compressors and valves. 

An alternative approach is to monitor the behaviour of the 
pipeline using some form of model. One technique is to 
determine a line volume balance model over some fixed 
period.This involves calculating the difference between the 
inflow and outflow, or net inflow. Different balance intervals 
are appropriate for different purposes. For a typical pipe¬ 
line, a short-term balance over 1—2 h is suitable for relatively 
rapid detection of the leak, whilst a long-term balance over 
3 - 6 h gives greater accuracy. Detection of a leak as small as 
0.5% of throughput may be achieved. 

Use may also be made of a more sophisticated model 
incorporating values of the pressure, temperature, flow 
and density at various points in the pipeline. The operation 
of the line is monitored by comparing the measured and the 
model values. The occurrence of a leak should cause 
excursions of some of these parameters outside their 
control limits. Criteria can be devised to flag the existence 
of a leak. 


19.17 Notation 

Section 19.7 

c corrosion allowance 

/ a nominal design strength at test 

temperature 

ft nominal time-independent design strength (see text) 

p design pressure 

pt test pressure 

t nominal thickness of section under consideration 


Section 19.8 

L leak rate (Pa m 3 /s) 

P pressure (Pa) 

t time (s) 

V volume of vessel (m 3 ) 

For alternative units see text 


Section 19.10 

Equations 19.10.1 and 19.10.2 
L fraction of gas leaking 

pi suction pressure 

p a discharge pressure 

Ti inlet temperature (before addition of bypass gas) 

T a discharge temperature 

T s suction temperature 

AT h correction for Joule-Thomson effect 
p constant, approximately equal to ratio of gas specif ic 

heats 

Equation 19.10.3 
A jet nozzle exhaust area 

G a compressor air pumping capacity 

N compressor speed 

P d compressor discharge pressure 

T d compressor discharge temperature 

Ti turbine inlet temperature 

Wf fuel flow 

A normalized increment of variable 

r\ compressor efficiency 
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Accidents on process plants arise as often from deficiencies 
of operations as from those of design. It is difficult, there¬ 
fore, to overstress the importance of plant operations in 
safety and loss prevention. 

Accounts of plant operation include Process Plant Design 
and Operation (D. Scott and Crawley, 1992) and those by 
E. Edwards and Lees (1973) and London (1982). Some 
reference to plant operation is also made in many of the 
Chemical Industries Association (CIA) codes and guide¬ 
lines and the Health and Safety Executive (HSE) guidelines 
mentioned in Chapter 11. Selected references on plant 
operation are given inTable 20.1. 

Many aspects of operation are dealt with in other chapters. 
In particular, these include: plant management (Chapter 6); 
hazard identification (Chapter 8); pressure systems (Chap¬ 
ter 12); process control (Chapter 13); human factors (Chapter 
14); fire protection (Chapter 16); plant inspection (Chapter 
19); plant maintenance and modification (Chapter 21); 
emergency planning (Chapter 24); personal safety (Chapter 
25); and information feedback (Chapter 27). 

The present chapter deals with some important aspects 
of operation which are not treated elsewhere. These are: 

(1) operating discipline; 

(2) operating procedures; 

(3) emergency procedures; 

(4) handover and permit systems; 

(5) operator training; 

(6) plant patrols; 

(7) modifications to the process; 

(8) operation and maintenance; 

(9) start-up and shut-down; 

(10) start-up of refinery units; 

(11) shut-down of refinery units; 

(12) operation of fired heaters; 

(13) operation of driers; 

(14) operation of storage; 

(15) operational activities and hazards; 

(16) sampling; 

(17) trip systems; 

(18) identification measures: 

(19) exposure of personnel; 

(20) security. 

Before considering these detailed aspects, however, it is 
emphasized again that the safe operation of hazardous 
plants requires in particular competent and experienced 
managers and formal, well considered and fully understood 
systems of work. The aspects of operation mentioned are 
now discussed. 

20.1 Operating Discipline 

The safe operation of a process plant requires adherence to a 
strict operating discipline. This discipline needs to be for¬ 
mulated, along with the safety precautions, during design 
and then enforced in operation. An account of operating 
discipline is given by Trask (1990). 

The impetus for the development of operating disciplines 
in the author’s company came in the 1960s from the per¬ 
ceived need to ensure that the technology was uniformly 
applied in all the company’s plants, both in the United 
Kingdom and overseas, and in the 1970s from the need to 
ensure that human technical skills were maintained in the 
face of increasing automation. 


The steps involved in developing the operating discipline 
are: (1) to identify the important operating parameters, 
specify operating limits on these parameters, and arrange 
for them to be measured, controlled and monitored, using 
both trend records and alarms; (2) to ensure mass and 
energy balances and (3) to develop and document operating 
procedures, safety precautions and remedial actions. 

20.1.1 Operating envelope 

The design of the plant specifies the conditions at which it is 
to operate. In some cases, such as operation at different 
throughputs, it may specify several sets of conditions. 
There is, however, a degree of latitude in operation, and 
some divergence from the nominal design conditions is 
acceptable. In fact, since the design embodies inaccuracies 
of various kinds, it is inevitable. 

It is necessary, therefore, to define the envelope of condi¬ 
tions within which variations are allowed but across which 
excursions are not permitted. In the first instance, this 
envelope is defined by the designer in terms of constraints 
related to the pressure envelope, such as vessel design 
pressure and temperature limits, and also to the process 
conditions such as flow limits related to static electricity or 
temperature limits related to freezing or hydrate formation. 
The envelope may subsequently be modified to some degree 
on the initiative of the plant management, but in consulta¬ 
tion with the design function. At any given time, however, 
the operational envelope should be clearly defined and 
strictly enforced. 


20.2 Operating Procedures and Instructions 

Fundamental to the safe operation of plant is the develop¬ 
ment of suitable operating procedures. The procedures are 
normally formulated during the plant design and are modi¬ 
fied as necessary during the plant commissioning and 
operation. 

20.2.1 Regulatory requirements 

In the UK the provision of operating procedures is a reg¬ 
ulatory requirement. The Health and Safety at Work etc. Act 
(HSWA) 1974 requires that there be safe systems of work. A 
requirement for written operating procedures, or operating 
instructions, is given in numerous codes issued by the HSE 
and the industry 

In the USA the Occupational Safety and Health Admin¬ 
istration (OSHA) draft standard 29 CFR: Part 1910 on pro¬ 
cess safety management (OSHA, 1990b) states: 

(1) The employer shall develop and implement written 
operating procedures that provide clear instructions 
for safely conducting activities involved in each pro¬ 
cess consistent with the process safety information 
and shall address at least the following: 

(i) Steps for each operating phase: 

(A) initial start-up; 

(B) normal operation; 

(C) temporary operations as the need arises; 

(D) emergency operations, including emer¬ 
gency shut-downs, and who may initiate 
these procedures; 

(E) normal shut- down and 

(F) start-up following a turnaround, orafteran 
emergency shut-down. 
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Table 20.1 Selected references on plant operation 


NRC (Appendix 28 Nuclear Power Plant Operation, 
Operational Safety Reliability Program, Operation)', 
American Oil Company (n.d./l—10); MCA (SG-2); 

J.R. Howard (1959); Steinhoff (1959,1973); Anon. (1961a); 
Gimbel (1965a); WH. Richardson (1966); Holroyd (1967); 
Badger (1968); Lofthouse (1969); O.M. Allen and Hanna 
(1971); E. Edwards and Lees (1973,1974); IP (1973 Eur. 
MCSP Pt 1); Kauber (1973); API (1975 RP 50); Neal (1976); 
Anon. (1977 LPB14, p. 2); Blair (1977); Chemical 
Engineering Staff (1980); IBC (1981/21); Kister (1981a,b, 
1990); London (1982); Roodman (1982); H.W. Martin (1983); 
Kolff and Mertens (1984); Burgoyne (1985c);Thyler (1985d); 
Rausch (1986); G.K. Chen (1987); AGA (1988/55); Cloke 
(1988); EPA (1988/1); Trask (1990); McConnell (1992); 

D. Scott and Crawley (1992); R.E. Sanders (1993b) 

Site register: RoSPA (IS/77) 

Communications: Bach (1968); Anon. (1976 LPB 10, p. 4) 
In-plant chemicals labelling: Kmetz (1990) 

Production control, material balance, quality control: 
Tingey (1962); Hearfield (1975); Oakland (1981) 

Start-up and shut-down, turnarounds 

American Oil Company (n.d./4); Anon. (1960f); Ballmer 
(1964); Bonnel and Burns (1964); Hayes and Melaven 
(1964); Lieber and Herndon (1965,1973); Loen (1966,1973); 
Nobles (1967); Luus (1971); EPA (1972/16); Barnett (1973); 
H.S. Moody (1974); Kister (1979,1981a); API (1982 Refinery 
Inspection Guide Ch. 18); Bauman (1982); H.V Bell (1982); 
Rattan and Pathak (1985); Feuless and Madhaven (1988); 
Butler, Nayar and Wheeler (1993); Nimmo (1993) 

Boilers, burners, furnaces, flares ( see a/soTable 12.3) 
S.R. Green (1952); Bluhm (1961,1964b); PW Taylor (1964); 
FMEC (1967); OIA (1971 Bull. 501); Charlton (1973); HSE 
(1975 TON 25); NEPA (1990 NEPA 86) 

Storage, terminals 

H.T. Fuller and Bristline (1964); J.R. Hughes (1970); PITB 
(1973/5); Hearfield (1975); MCA (1975 TC-8,TC-27,TC-28, 
TC-29); Anon. (1976 LPB 9, p. 1); Chlorine Institute (1979 
Pmphlt 9,66,1982 Pmphlt 5,1984 Pmphlt 78,1986 Pmphlt 
1); API (1982/5); NEPA (1990 NEPA 307) 

Operating activities 

Purging: AGA (1954,1975); Constance (1980); Anon. (1989 
LPB 90, p. 1); Levinson (1989); Schneider (1993) 

Sampling: MCA (SG-16); Ducommun (1964a,b); ICI/RoSPA 
(1970IS/74); Gitzlaff and Batton (1979); Lovelace (1979); 
Chlorine Institute (1984 Pmphlt 77); Anon. (1989 LPB 88, 
p. 1); Anon. (1990 LPB 92, p. 27); Anon. (1992 LPB 106, p. 19) 
Draining: Klaassen (1980b); Anon. (1991k) 

Additives, catalysts: W.S.Wood (1963); Brand and 
Burgess (1973) 

Operating procedures, instructions, manuals (see 
Table 14.2) 

Leaks and spillages 

ICI/RoSPA (1970 IS/74); Bess (1972); Home Office (1972/9); 
MCA (1973/22); AIChE (1974/99,1988/100); Kletz (1975b, 
1981g, 1982i); Anon. (1987 LPB 74, p. 1) 

Winter conditions 

IRI (n.d./l); Buehler (1967); House (1967); API (1983/8) 


Security 

EPA (CFSD SEC series, 1972/19); NRC (Appendix 28 
Security); IRI (n.d./4); Hamilton (1967); NEPA (1971/7); 
Payne (1971); IMechE (1972/5); Oliver and Wilson (1972); 
K.G. Wright (1972); C.Ward (1973); G. Green and Faber 
(1974); Flood (1976); Atallah (1977); W. Price (1978); D.L. 
Berger (1979); Spranza (1981,1982,1991,1992); Bailey 
(1983); Lobel (1985); Anon. (1987 LPB 77, p. 17); Pitt (1987) 


(ii) Operating limits: 

(A) consequences of deviation; 

(B) steps required to correct and/or avoid 
deviation; and 

(C) safety systems and their functions. 

(iii) Safety and health considerations: 

(A) properties of, and hazards presentedby, the 
chemicals used in the process; 

(B) precautions necessary to prevent exposure, 
including administrative controls, engi¬ 
neering controls, and personal protective 
equipment; 

(C) control measures to be taken if physical 
contact or airborne exposure occurs; 

(D) safety procedures for opening process 
equipment (such as pipe line breaking); 

(E) quality control of raw materials and control 
ofhazardouschemicalinventorylevelsjand 

(F) any special or unique hazards. 

(2) A copy of the operating procedures shall be readily 
accessible to employees who work in or maintain a 
process. 

(3) The operating procedures shall be reviewed as often as 
necessary to assure that they reflect current operating 
practice, including changes that result from changes in 
process chemicals, technology and equipment; and 
changes to facilities. 

20.2.2 Operating procedures 

Accounts of the generation of operating procedures and 
instructions have been given by R. King (1990) and I.S. 
Sutton (1992). 

In designing a plant, the designer necessarily has in 
mind the way in which it is to be operated. It is desirable 
that this design intent be explicitly documented, otherwise 
it has to be inferred from the equipment provided. In 
the case of batch and other sequential processes the 
designer normally defines the operations required to 
execute the sequence. 

Practice in the formulation of operating procedures var¬ 
ies. The lead is normally taken by the plant manager. In the 
case of a new plant the commissioning manager is often 
the prospective plant manager, and will therefore undertake 
the task. 

Operating procedures may be developed using a team 
of experienced people who examine successively the pro¬ 
cedures necessary for testing and pre-start-up activities, 
normal start-up, normal shut-down, emergency shut¬ 
down, etc. 

The information required in order to formulate pro¬ 
cedures includes: the order in which operations should be 
carried out; the valve states and valve changes associated 
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with each operation; the time required to perform the 
operation; and the operations which have to be completed 
before another operation can be initiated. 

For a new plant an initial set of operating procedures is 
devised, but these are likely to be modified as the result of 
experience during the commissioning. Likewise, pro¬ 
cedures for an existing plant will undergo changes based on 
operating experience, as well as changes due to process or 
plant modifications. 

The extent to which process operators are involved in the 
formulation of operating procedures varies. Some operat¬ 
ing procedures are modelled on the practice of the ‘best’ 
operator. Operators also devise short cuts. These should be 
examined, and accepted or rejected, as appropriate, with 
reasons given. 

A formal method of analysing the operator’s task is 
available in task analysis, which is described in Chapter 14. 

It is the task of management in formulating operating 
procedures to clear up muddled thinking, to identify incor¬ 
rect assumptions, to resolve differences and to eliminate 
inconsistencies. The ultimate responsibility for the operat¬ 
ing procedures rests with the plant manager. 


20.2.3 SRDA Operating Procedures Guide 

A systematic approach to the development of operating 
procedures is given in Developing Best Operating Procedures 
(Bardsley and Jenkins, 1991 SRD SRDA-R1) (the SRDA 
Operating Procedures Guide). 

The SRDA Guide distinguishes between two basic 
types of documentation to support operator performance: 
(1) manuals and (2) job aids. Essentially a manual is a 
resource, which is a store of information to which managers, 
engineers and trainers may refer. The information con¬ 
tained in it, however, is usually not in a form best adapted 
for direct use by the operator. What he requires for immedi- 

Operator support documentation may take the form of 
(1) procedures, (2) checklists or (3) decision aids. The 
simplest form of procedure is a set of actions which are per¬ 
formed in sequence with a minimal feedback requirement. 
More complex procedures involve actions which are depend¬ 
ent on a lapse of time and/or the state of the process, or 
which involve sets of actions other than a straightforward 
sequence. The typical checklist is an aide memoire used to 
check the state of items on the plant, notably valves, prior to 
undertaking some operation such as start-up. Decision 
aids, in the form of decision trees, or flowcharts or algo¬ 
rithms, guide the operator through the decision pathways. 
There are also other types of decision aids, used particu¬ 
larly for fault diagnosis, such as functional diagrams. In 
addition to these specific forms, documents often contain 
explanations. 

The Guide poses six basic questions to be asked con¬ 
cerning the operator’s use of a support document. The wri¬ 
ter needs to ask how the operator decides when to use the 
document, how he locates the document itself and how he 
locates the required help within it. Furthermore, the writer 
must ask whether the document provides the information 
sought in a form such that appropriate action is selected, 
whether it indicates the circumstances in which an alter¬ 
native course of action is required and whether it states 
how the action is to be controlled. Finally, the writer should 
check that the document has been successful by means 
such as monitoring of feedback. 


In addressing the question of operator support docu¬ 
mentation, the first step is to establish that there really is 
need for it. One general justification is compliance with 
regulatory requirements or company policy. Another justi¬ 
fication is the nature of the task. 

On this the Guide both gives some general pointers and 
also outlines some specific techniques. With regard to the 
former, some task characteristics that may indicate the need 
for job aids are that: it is critical; it is difficult, for example 
fault diagnosis; it is performed infrequently, for example 
an emergency procedure; and/or it is long and involves 
memory load. If a job aid is to be provided, there must be 
time for it to be located and used. 

It needs tobeborne in mind that ajob aid may not prove as 
effective as expected. Some reasons for this are that it 
remains unused, that it is seen as taking the skill from 
the task and that it may restrict the choices available to a 
skilled person. 

The specific techniques referred to are those of task 
analysis and human reliability analysis. 

The Guide describes the process of designing and imple¬ 
menting an operating support document in terms of the 
following stages: (1) the definition of the purpose and scope 
and the selection of a format (manual or job aid), (2) the 
establishment of collaboration with sources of information, 
(3) the establishment of information content, (4) the proto¬ 
typing, (5) the preparation of a draft, (6) a review of the draft 
both for technical content and usability, (7) implementation 
and (8) maintenance. 

An account is given of hierarchical task analysis and of 
human reliability analysis, both of which have been descri¬ 
bed in Chapter 14. In respect of the latter, the two techniques 
considered are SHERPA and CADA. 

The writing of an operating support document which can 
be understood requires careful attention both to the written 
text and to the alternatives to such text. Aspects of the 
written text treated in the Guide are: the use of a compre¬ 
hensive vocabulary, supported if necessary by a glossary, 
and of conventional terms as opposed to jargon; the use of 
the active rather than the passive tense; care with the use of 
negatives; retention of the definite and indefinite articles; 
the use of short sentences; the presentation of instructions 
as a sequence; and an indication of any applicable pre¬ 
conditions. The Guide gives detailed guidance on charac¬ 
ter style, punctuation and layout. 

The Guide also describes the use of tables and figures. 
Tables provide a good format for stating the courses of 
action to be taken in different situations. The types of tables 
given are the condition-action table and the decision table, 
both akin to a truth table, and the look-up table. The types 
of figures described are decision aids in the form of flow¬ 
charts, and various kinds of equipment diagrams, includ¬ 
ing photographs. Equipment diagrams include: drawings, 
or sketc-hes, of single equipments or ensembles, which 
are useful for identifying and locating components; line 
diagrams showing the main items of equipment and the 
connections between them; and functional flow diagrams 
giving the functional as opposed to the physical structure 
of the system. 

Guidance is also given on document organization and 
layout. A hierarchical organization is recommended and 
aids to moving around the document are described. The 
need for consistency is emphasized. 

Finally, the Guide discusses the tools available for the 
production of the document such as word processors, desk 
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top publishing packages, object oriented drawing packages 


20.2.4 Operating instructions 

Accounts of the writing of operating instructions from 
the practitioner’s viewpoint are given by Kletz (1991e) and 
I.S. Sutton (1992). 

Operating instructions are commonly collected in an 
operating manual. The writing of the operating manual 
tends not to receive the attention and resources which it 
merits. It is often something of a Cinderella task. 

As a result, the manual is frequently an unattractive 
document. Typically it contains a mixture of different types 
of information. Often the individual sections contain indi¬ 
gestible text; the pages are badly typed and poorly photo¬ 
copied; and the organization of the manual does little to 
assist the operator in finding his way around it. 

Operating instructions should be written so that they are 
clear to the user rather than so as to absolve the writer of 
responsibility. The attempt to do the latter is a prime cause 
of unclear instructions. 

A set of instructions which illustrates the above princi¬ 
ples has been given by Kletz, as shown in Figure 20.1. 
Further examples are given by Sutton. 

This latter author describes a method of writing the 
operating instructions, and of creating the operating man¬ 
ual. Basic requirements for the operating instructions are 


that they should be complete, up-to-date, properly indexed 
and easy to use. 

The operating manual is organized in the format of a 
tree that is developed from the top down. It starts with 
broad categories of procedure such as start-up, normal 
operation, normal shut-down, etc., and is developed until 
it reaches, at the bottom level, the sets of specific operat¬ 
ing procedures, or modules. It may be noted that this 
layout conforms closely to the tree structure used in task 
analysis. 

A distinction is made between information, rules, pro¬ 
cedures and checklists. Information is provided for refer¬ 
ence, but selectively. Rules are stated, although these are 
likely to be of more interest to managers and supervisors 
than to operators. Checklists are given as appropriate. 

Instructions are given for each procedure. The procedure 
may be based on a generic procedure, such as that for 
pump start-up, but with specific modifications for the 
operation in question. The level of the instructions should 
be such as to allow an experienced operator to run the plant 
with minimal reference to the supervisor. Each instruction 
should have an imperative verb in the active tense. 
Warnings, cautions and notes are inserted in the text of the 
procedure, as appropriate; a warning should precede the 
procedure. 

As described by Sutton, a module may be referenced in 
any part of the manual and by any writer, but only by its 
title; reference should not be made to the content of the 


ACTION TO TAKE WHEN A-SIDE ID FAN TRIPS 

1 CHECK A SIDE FURNACES HAVE TRIPPED 

2 ADJUST KICK-BACK ON COMPRESSORS TO PREVENT 
SURGING 

3 REDUCE CONVERTER TEMPERATURES 

4 CHECK LEVEL IN STEAM DRUMS TO PREVENT CARRYOVER 

Panel Operator 

1 Shut TRCs on manual 

2 Reduce feed rate to affected furnaces 

3 Increase feed to Z furnace 

4 Check temperature of E54 column 

Furnace Operator 

1 Fire up B side and Z furnaces 

2 Isolate liquid fuel to A side furnaces 

3 Change over superheater to B side 

4 Check that output from Z furnace goes to B side 

Centre Section Operator 

1 Change pumps onto electric drive 

2 Shut down J43 pumps 

Distillation Operator 

1 Isolate extraction steam on compressor 

2 Change pumps onto electric drive 


Figure 20.1 Format of operating instructions: extract from a plant instruction showing the action to be taken by an 
operating team of one supervisor and four operator when the induced draught (ID) fan providing air to a row of furnaces 
(known as A side) stops (Kletz, 1991e) (Courtesy of the Instituition of Chemical Engineers) 
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module. This discipline, which has much in common with 
that followed for computer program subroutines, facilitates 
the updating of the manual by allowing a single module to 
be replaced at any time. 

The manual is more readable by basing it on graphics 
rather than text so that the text supports the graphics rather 
than vice versa. Modules are written in a two-page format, 
which is what the user actually sees at a given time. 

The manual should define clearly the authorization for 
particular actions. 

Commonly the manual contains a section on trouble¬ 
shooting. This activity is quite different from that of fol¬ 
lowing a procedure for normal operation. Such a procedure 
is a closed activity and the instructions for it are intended to 
be followed without deviation. Troubleshooting, by con¬ 
trast, is open-ended and creative. The procedures for it are 
not definitive and do no more than offer guidance. 

The creation of the operating manual involves, first, the 
definition of the manual structure, then the collection of the 
information and, finally, the writing of the modules. Sutton 
estimates that his method may involve an effort which is an 
order of magnitude greater than the conventional approach. 
A further account of the creation and contents of the oper¬ 
ating manual is given by R. King (1990), with a detailed 
discussion of suitable contents. 

Commonly the operating manual is a hard copy document. 
It should be available on the plant. Some personnel may he 
given a personal copy. Authority to make modifications to 
the manual should be clearly defined. The manual should 
be kept up to date, including personal copies where issued. 

The advent of computer aids such as word processing and 
graphics packages opens up an alternative approach in 
which the master version of the operating manual is kept in 
the computer with various options for hard copy. 

In addition to the treatment given by these three authors 
the following comments may be made. Regard should be 
had to the intended users of the operating instructions. 
These include (1) novice operators, (2) operators whose 
experience has been on other plants but who are being 
trained for the plant in question and (3) operators experi¬ 
enced on that plant. The organization of the operating man¬ 
ual into successively more detailed levels goes some way 
towards meeting their different needs. An experienced op¬ 
erator may require operating instructions mainly for safety 
critical operations or operations performed only rarely. 

The simplest operating instruction is a linear sequence of 
actions. There is a limit to the degree to which an operating 
instruction may be extended to include decision trees, 
branches and loops. Generally these are avoided if possible, 
except for diagnosis. On the other hand, it is common to 
include general advice about and/or specific instructions 
for recovery from potential problem situations. 

Practice with regard to use of graphics appears to vary. 
As stated, Sutton’s approach is that the text is there to sup¬ 
port the graphics. At the other end of the spectrum operat¬ 
ing instructions are written which make minimal use of 
graphics. 

Operators are typically provided with operating 
instruction sheets/checklists which may well be reproduc¬ 
tions of sheets in the operating manual and which they can 
take out onto the plant. It may also be appropriate to provide 
other aids such as a list of alarms and trips. 

The writing of the operating instructions is a significant 
task. Some principal sources of information are the quan¬ 
tities flowsheet, the engineering line diagram, the design 


manual and vendors’ manuals. The contractors may provide 
very little and vendor information may become available 
only late in the day. The situation is eased if an operating 
manual is available from a previous plant. 

The first task faced by the person charged with produc¬ 
ing operating instructions tends actually to be the provision 
of instructions for commissioning. This can be as large a 
task as the creation of the instructions for normal operation. 
Commissioning activities for which instructions may need 
to be provided include plant water testing, control loop 
testing, load cell testing and checks on vessel fill times, 
completeness of vessel emptying, and heating and cooling 
rates. The instructions should also cover checks to ensure 
that before an equipment is brought into use each of its 
instruments is operational. 

Many operations involve the reading of instruments. 
The instructions need to specify the readings at which 
action must be taken. A considerable part of the effort 
required to write the instructions may have to be devoted 
to specifying these readings and the writer may have to 
search through a number of documents. In addition, water 
testing requires some readings to be specif ied also for water 
as the fluid. 

In devising operating instructions regard should be had 
to the practicality of the individual actions and sequence of 
actions required. It is not desirable, for example, to create a 
sequence of actions in which one has to be performed at the 
top of a tower, the next back down at ground level and the 
next up at the tower top again. Another area where thought 
is necessary is the response to alarms and the settings on 
alarms. For example, the implications of and the response 
times available for a particular fractional fill may be dif¬ 
ferent from one vessel to another. 

If the plant is a computer-controlled batch plant the num¬ 
ber of operator interventions may be quite small and may 
involve relatively little decision-making. In this case the 
proper operating instructions are likely to be a mix of com¬ 
puter sequences with occasional manual operations such 
as additions and instructions on recovery from problems. 

The operators will require training in the operation of the 
plant based on the operating instructions. It is necessary, 
therefore, to provide a training manual. This may draw on 
the operations manual. Typically it contains an operating 
instruction section together with other material such as a 
training plan, workbook exercises, an assessment plan and 
performance criteria. The need for a training manual may 
be regarded as a principal justification for the creation of 
the operating manual. Training in operating procedures is 
discussed in Chapter 14 and is mentioned in many other 
chapters. 


20.3 Emergency Procedures 

A set of operating procedures of particular importance are 
the emergency procedures. It is generally recognized that it 
is not possible to provide detailed procedures for all possible 
emergency scenarios. In the Guide to Safe Practice in the Use 
and Handling ofHydrogen Fluoride (CIA, 1978) the following 
two-pronged approach is recommended: 

Firstly, careful consideration should be given to what 
major emergencies can be reasonably foreseen, and the 
detailed procedure for tackling these (few) serious situa¬ 
tions should be dealt with specifically both by training 
sessions and special instructions. 
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Secondly, since it is impossible to cover all eventua¬ 
lities by instructions which will be effectively remem¬ 
bered or found for reference during an emergency, it is 
advisable to give a series of general instructions, amply 
backed by training, which will provide guidance for 
the correct action in those emergency or potential emer¬ 
gency situations which have not been dealt with by 
specific cases. Such aspects as equipment isolation, the 
recognition of hazardous conditions, and communica¬ 
tions are fundamental matters which can be treated in 
this way. 

Emergency procedures are commonly treated in codes 
under the following headings: (1) leak detection and char¬ 
acterization; (2) raising the alarm and associated actions; 
(3) isolation of leaks; (4) handling of leaks and spillages; 
(5) action against fire; (6) emergency equipment and 
(7) special features of particular chemicals. 

These topics are considered at this point, except that 
raising the alarm and associated actions are treated in 
Chapter 24 and the treatment of action against fire is lim¬ 
ited - the main account being given in Chapter 16. 

20.3.1 Emergency equipment 

Emergency equipment commonly listed in codes includes 
(1) protective clothing, (2) breathing apparatus, (3) emer¬ 
gency tool kits and (4) fire fighting equipment. 

20.3.2 Leaks and spillages 

Leaks and spillages are a relatively common occurrence on 
process plants and it is necessary to have procedures for 
dealing with them. Discussions of leaks and spillages have 
already been given in Chapters 10,15,16 and 18 in relation 
to plant layout, dispersion, fire and toxic release. It is 
appropriate here, however, to review some of the more 
general aspects of the problem from the operational point 


The emergency services should be alerted as appropriate. 

After the incident is over, any record required by the 
reporting system should be made. 

20.3.3 Leaks and spillages: detection and characterization 

For large releases, detection of a leak and characterization of 
the resultant cloud are important. These are discussed in 
the CCPS Guidelines for Vapor Release Mitigation (1988/3). 

For detection the first line of defence is gas detectors. The 
Guidelines discuss the detectors available and their posi¬ 
tioning. Accounts of detectors for flammable and toxic 
gases are given in Chapters 16 and 18, respectively. 

In most plants there are personnel who may detect the 
presence of the gas. Detection by humans is discussed in 
The Perception of Odors (Eugen, 1982) and data on odour 
thresholds are available in texts such as Compilation of Odor 
and Taste Threshold Value Data (Fazzalari, 1978). Selected 
data are given in the Guidelines. Appendix 11 contains a 
further discussion of odours. 

If a leak occurs, which gives rise to a large vapour cloud, it 
assists in handling the emergency if personnel are able to 
estimate the size and movement of the cloud.Their ability to 
do so depends on its visibility. A small number of sub¬ 
stances yield, at a sufficiently high concentration, a vapour 
cloud which is visible by virtue of its colour. Principal 
examples are chlorine and bromine, which give a greenish- 
yellow and a reddish-orange cloud, respectively. 

A more common form of visible cloud is that caused by fog 
formation. Liquefied flammable gases and other liquefied 
gases such as ammonia, hydrogen chloride and hydrogen 
fluoride may give rise to fog, depending on the conditions of 
release and the atmospheric humidity. The Guidelines 
devote an appendix to fog correlations and give the follow¬ 
ing relation for the concentration at the interface between 
the regions where fog is and is not generated 


of view. 

Plant management should formulate procedures for 
dealing with leaks and spillages. The range of actions 
required varies with the nature and size of the leak. In all 
cases personnel handling the leaks should wear any neces¬ 
sary protective clothing and breathing apparatus. 

A small leak may often be stopped relatively easily. If the 
leak is more serious, other measures are required. The ICI 
LFG Code (ICI/RoSPA 1970 IS/74) lists these for liquefied 
flammable gases. If it is practical to do so, the leak should be 
isolated. This is not always possible with manually operated 
valves that may be enveloped in the gas cloud. Remotely 
operated isolation valves may be used if installed. Instruc¬ 
tions should take account of possible difficulties in effect¬ 
ing isolation. Other measures to reduce leakage include 
depressurizing and blowdown. 

Personnel involved in controlling the situation should 
avoid entering the vapour cloud. The leak should be approa¬ 
ched only from upwind. Other personnel should not be 
allowed in thearea.There shouldbe some method of warning 
and evacuating them, and also of sealing of f the area. 

Measures should be taken as appropriate to disperse or 
contain the leakage.This aspect is discussed in Chapters 15 
and 16. 

The area to which a flammable vapour cloud is likely to 
spread should be cleared of sources of ignition, which 
include not only activities such as hot work but also traffic. 
It may be necessary to close roads and railways that the 
vapour could reach. 


C = kl n(l/i/0 


k = 


1.75 x 10 6 

af~ s 


[20.3.1] 


[20.3.2] 


where C is the interface concentration (ppm), H s is the 
heat of solution (cal/gmol), ip is the fractional humidity 
(% relative humidity/100) and k is a constant. 

20.3.4 Leaks and spillages: water and foam 

One method of dealing with a liquid spillage is the applica¬ 
tion of foam. Regular foam is mainly water and its use will 
often actually increase the rate of vaporization of the spilled 
liquid, thus making the situation worse. On the other hand, 
there are legitimate uses of foam. The use of foam on liquid 
spillages is discussed in Chapter 15. Some limited com¬ 
ments are given below. 

If the chemical is completely miscible with water, water 
may be applied to dilute it. However, the number of indus¬ 
trial chemicals which pose a significant hazard and which 
are water miscible are limited. 

20.3.5 Leaks and spillages: particular chemicals 

The response to a leak or spillage emergency depends also 
upon the specific characteristics of the chemical released. 



20/8 PLANT OPERATION 


For hydrocarbons the main hazard is that of fire or 
explosion, and also that of injury by freezing due to contact 
with cold liquefied gas. The best way of dealing with an 
unignited leak of hydrocarbon is to shut it off by isolation. 
A spillage of liquid hydrocarbon should be contained to 
the extent possible. This is principally a matter of plant 
layout and the operational measures which can be taken are 
fairly limited. 

The CIA codes and guidelines give some guidance on 
handling leaks and spillages of other substances. Mention 
is made here of just one or two of these to illustrate the 
principles involved. 

An acrylonitrile spillage should be contained with sand 
or earth and covered with a 150 mm layer of mechanical 
foam and an emulsifying agent or absorbent material. 
Aqueous solutions may be treated with calcium or sodium 
hypochlorite in appropriate proportions. Where these 
treatments are not readily available, surface spillages may 
be diluted with large quantities of water. 

A spillage of ethylene oxide may be handled by diluting 
it with a quantity of water sufficient to render it non¬ 
flammable. This may be done using water sprays or, where 
available, water monitors. It may be noted, however, that in 
discussing the disposal of the contents of a storage tank the 
guidelines state that it is not usually practical to dilute 
liquid ethylene oxide to the point of non-flammability and 
that liquid which has not been rendered non-flammable 
needs to be treated as a flammable liquid. 

For a vinyl chloride spillage the preferred method of con¬ 
trol is the use of high expansion mechanical foam. For this 
not to aggravate the situation, the pool needs to be not still 
spreading but contained and at least 2 in. deep. 

20.3.6 Action against fire 

A large proportion of plant fires are due to hydrocarbons. If 
the fire consists of an ignited leak burning as a jet flame on 
the plant, the usual practice is to let it burn. It is generally 
not desirable to seek to extinguish the flame on such a leak, 
since this risks creating a vapour cloud, which might then 
explode. The other main form of hydrocarbon fire is a pool 
fire. The fighting of hydrocarbon fires is discussed in 
Chapter 16. 

There is a limited amount of guidance in the CIA codes 
and guidelines on action against fire of other substances. 
The guidance given for pool fires of vinyl chloride (CIA, 
1978 PA15) illustrates some of the principles. For a large 
pool fire, foam can be effective in limiting vaporization and 
thus in controlling the fire. There is an option to seek to 
extinguish the fire by using a larger quantity of foam but, 
unless there are pressing reasons for doing otherwise, it is 
preferable to let the fire burn out under controlled conditions. 

Vinyl chloride also illustrates the problem of toxic com¬ 
bustion products, the products in this case being hydrogen 
chloride and carbon monoxide. Use may be made of water 
sprays to disperse and absorb some of the hydrogen chlor¬ 
ide. But in any event, persons downwind should be evac¬ 
uated. 


20.3.7 Case history 

A case history has been described which illustrates the 
value of good emergency procedures (Anon., 1991 LPB 98 
p. 25). In the course of a stress relieving operation on a 
50 mm pipe on a chlorine storage module, a 0.5 m section 
was burned away by an iron-chlorine fire. The leak was 


picked up by the gas detectors, the gas alarms operated and 
the operator went to investigate. He called on the lead 
operator to sound the chlorine alarm, donned a breathing 
apparatus set and went and closed the appropriate valves. 
The site emergency teams arrived and within 3 minutes set 
up water curtains, but these were not needed as the leak had 
already been isolated and the cloud was dispersing. 


20.4 Handover and Permit Systems 

20.4.1 Handover systems 

Most large process plants operate round the clock on a shift 
system. It is essential that information on the state of 
the plant be communicated by the outgoing shift to the 
incoming shift. A formal handover system is necessary to 
ensure this. 

The lack of such a system was held to have been a cause of 
the Piper Alpha disaster. As described in Appendix 19, the 
operating crew attempted to start-up a pump which was 
actually under maintenance and thus initiated the leak. The 
lead maintenance hand told the Inquiry that there were no 
written procedures for handover and no specification of the 
information to be communicated at handover. Thus main¬ 
tenance work was not always covered in the operator’s log. 
He stated: ‘There were always times when it was a surprise 
when you found out some things that were going on’. As it 
happens, the Piper Inquiry also heard evidence that shortly 
before the disaster a fatal incident had occurred in which 
there had been inadequate communication of information 
from the day shift to the night shift. 

There should be a formal and detailed procedure for shift 
handover. It should cover both operating and maintenance 
personnel. On the operating side these will normally 
include the lead operator, the control room operator and 
other operators who are normally out on the plant, and the 
lead maintenance hand. There should be a formal logbook 
that is signed by the incoming person responsible for the 
particular function. Such a system requires that sufficient 
time be allowed for the handover to take place and for the 
outgoing shift to brief fully their counterparts on the 
incoming one. 

An aspect of handover which is of particular importance 
is the status of permits-to-work. Much of the information 
which needs to be communicated at handover is likely to 
relate to such permits. 

20.4.2 Permit systems 

Another important form of communication is the permit-to- 
work system just mentioned. Permits are raised mainly in 
connection with maintenance work and discussion is 
deferred to Chapter 21. Here it is sufficient to note that the 
actions of handing over a section of plant to maintenance, 
and receiving it back, are important not only for main¬ 
tenance but also for the operating function. 


20.5 Operator Training 

The process operator runs the plant and deals with the 
faults which arise in it. He has many training needs which 
must be met if he is to do the job properly. An account of the 
principles underlying the training of process operators has 
been given in Chapter 14. This chapter also discusses some 
of the specific topics in the area of process operation on 
which the operator requires training. Safety training of 
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operators is considered in Chapter 28. Other references to 
operator training are given throughout the text. 

As regards the content of operator training, considera¬ 
tion needs to be given not just to the operating procedures 
and safety training, but also to other topics where the 
operator has some responsibility. These include, for exam¬ 
ple, plant maintenance and modification and plant security. 

The training of process operators should not be a once- 
and-for-all exercise, but should involve updating as appro¬ 
priate .There may also be special additional training such as 
that associated with the commissioning of a new plant. 

20.6 Plant Patrols 

One of the principal functions of operators on process 
plants is the detection of faults. The detection of faults by 
the process operator in the control room has already been 
discussed. Other faults, particularly leaks, are detected by 
operators during routine patrols. 

In one study of the detection of nearly 400 abnormal 
occurrences, analysis showed that some 40 % were detected 
by routine patrols and another 5 % by people who were in the 
plant area. 

An investigation of pipework failures by Bellamy, Geyer 
and Astley (1989) found the following pattern of detection: 



No. of 
incidents 

Proportion of 
incidents (%) 

Alarm 

12 

26 

Automatic detection 

4 

8.5 

Human 

27 

57 

Delayed 

4 

8.5 

Total 

47 

100.0 


Routine patrolling is therefore important and specific 
arrangements need to be taken to ensure that it is carried 
out. In particular, steps may be taken to ensure that certain 
vulnerable features are regularly passed by an operator. 
Thus in design certain instruments may be located at points 
which cause the operator to pass by such features, whilst in 
operation, instructions may be issued for the taking of 
regular readings from such instruments. 

20.7 Modifications to the Process 

Aprocess rarely operates for long without undergoing some 
modification. There are almost always changes in raw 
materials, in the operating conditions, such as flows, pres¬ 
sures and temperatures, concentrations, or in other aspects. 
The Flixborough disaster has drawn attention to the 
potential hazards of modifications to the plant. But 
modifications made to the process are also potentially 
hazardous. 

As it happens, Flixborough provides an illustration of a 
process modification also. The reactors were provided with 
agitators, but at the time when the explosion occurred the 
agitator in No. 4 Reactor was not in use. The absence of agi¬ 
tation is a crucial point in the hypothesis advanced by 
R. King (1975c, 1977,1990) that there was a sudden evolution 
of water vapour in that reactor. 

There is clearly little point in paying meticulous attention 
to ensuring close control of plant modifications so that the 
pressure system retains its capability to handle the design 
conditions for the operating variables, if there is no check on 


changes made to these parameters. A system is required, 
therefore, for the management of change in the process as 
well as in the plant. A system for the control of both process 
and plant modifications is described in Chapter 21. 


20.8 Operation and Maintenance 

Maintenance and modification work may present hazards 
both to the plant and to the workers involved. It is important, 
therefore, for the plant manager to give full consideration to 
the implications of such work being carried out on his plant 
and for him to take appropriate precautions. As a minimum 
these precautions should be the operation of a suitable 
permit-to-work, as described in Chapter 21, but in addi¬ 
tion some operations require extra measures. 

The types of precaution which may be required are illu¬ 
strated by those described by Hahn (1975) for hot tapping. 
This is a potentially hazardous operation involving drilling a 
hole into and fitting abranch on apipe while it is still on line; the 
technique is described more fully in Chapter 21. The aspects 
requiring consideration include (1) pipeline fluid conditions, 
(2) elimination of leaks, (3) local hazards, (4) emergency isola¬ 
tion, (5) warning system, (6) access and escape routes, (7) fire 
and rescue services, (8) welders’protective clothing, (9) weld¬ 
ing supervision and (10) operations supervision. 

The plant manager should check the pipeline fluid con¬ 
ditions, such as flow, pressure and temperature, under nor¬ 
mal operation, should agree with the welding manager the 
conditions to be held during the hot tapping operation and 
should take steps to ensure that these are maintained. The 
drains in the area of the welding operation should be sealed 
off and a review made of sources of flammable or obnoxious 
materials such as leaking joints or lutes. Any local hazards, 
including those not connected with the welding operation, 
should be considered and the personnel involved should be 
fully briefed about these hazards. Arrangements should be 
made to isolate the pipeline and affected areas in the event of 
an emergency. A warning system should be set up to inform 
plant personnel and emergency services if an emergency 
occurs. Access should be checked so that emergency ser¬ 
vices can reach the tapping point and the plant, and the 
areas sealed off to other traffic if necessary. A check should 
also be made on escape routes, which at night may need 
additional illumination. A rescue man from the works fire 
service should stand by during the operation with a radio 
link to the fire station to summon the fire rescue services in 
an emergency. He should he prepared for fire fighting and 
should have the necessary equipment. A plant fireman 
should also stand by. A check should be made that the 
welders have the appropriate protective clothing. The work 
should be supervised by personnel from both the welding 
and the plant functions. If possible, the plant manager 
should be present. 

The arrangements described indicate that some main¬ 
tenance or modification work requires the rather close 
involvement of the operations side. 


20.9 Start-up and Shut-down 

As take off and landing are more hazardous operations for 
an aircraft, so on a process plant the hazard is greater dur¬ 
ing start-up and shut-down. General principles of plant 
start-up and shut-down are discussed by D. Scott and 
Crawley (1992). The procedures for the start-up, operation 
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and shut-down of particular types of plant are considered 
in the following sections. 

Most accounts of the operation of process plants distin¬ 
guish the following modes: 

(1) normal start-up; 

(2) normal operation; 

(3) normal shut- down; 

(4) emergency shut-down. 

Shut-down is not always total. Sometimes there is a par¬ 
tial shut-down to a condition of ‘hot standby’. This avoids 
the need to go through the full sequence of shut-down and 
start-up operations, and allows operation to be resumed 
more quickly. 

Thereare, however, further relevant distinctions. Leaving 
aside the initial start-up when the plant is commissioned, 
there are variations in start-up depending on the condition 
of the plant prior to start-up. Some distinctions are: 

(1) normal shut-down condition; 

(2) hot standby condition; 

(3) emergency shut-down condition; 

(4) major scheduled shut-down, or turnaround, condition; 

(5) prolonged shut-down, or mothballing condition. 

The condition of the plant following emergency shut¬ 
down depends on the cause of the shut-down, and hence 
this category actually includes a whole set of different pre¬ 
start-up conditions. 

The start-up considered here is not the initial commis¬ 
sioning, which is dealt with in Chapter 19, but the resump¬ 
tion of operation after a shut-down. 

The actual procedures for start-up and shut-down depend 
on the process, and vary somewhat. Start-up of a plant with 
a low temperature section, for example, has special features. 

20.9.1 Normal start-up 

Start-up requires that the plant he taken through a pre¬ 
determined sequence of stages. It is important that this 
sequence be planned so that it is safe and avoids damage to 
the plant and so that it is flexible enough to handle difficul¬ 
ties which may arise.The conceptual and detailed design of 
the start-up sequence is discussed in Chapter 11. The per¬ 
sonnel involved in the start-up should understand the rea¬ 
sons for the sequence chosen and should adhere to it. 

The extent to which detailed procedures can be formul¬ 
ated for start-up depends on the condition prior to start-up. 
For start-up following a major scheduled shut-down it 
may not be practical to provide fully comprehensive 
instructions and it may be necessary to rely instead on the 
use of checklists for equipment and activities. On the other 
hand, for start-up from hot standby or a short shut-down it 
may be possible to provide relatively complete procedures. 

Start-up is an operation which needs to be properly plan¬ 
ned so that all the resources are available when required. 
This applies particularly to personnel, for example instru¬ 
ment fitters, and to utilities, for example inert gas. 

Start-up should be preceded by a series of pre-start-up 
checks. These should be governed by a formal system. The 
plant is first checked to ensure that it is mechanically 
complete, that there are no missing items such as valves, 
pipes or instruments, that the status of vent, drain and 
sample points is correct and that slip plates have not been 
erroneously left in pipework. A check is then made to ensure 


that the instruments are working. The availability of the 
utilities is confirmed. The hand valves are then checked to 
ensure that the status of each is correct. 

In many cases the plant is linked through flows of pro¬ 
ducts and by-products to other plants and the start-up 
needs to be co-ordinated with the operation of these inter¬ 
linked plants. Similar considerations apply to the utilities. 

Many plants generate services such as fuel gas, steam or 
electricity which they reuse and recover heat through com¬ 
plex heat exchange arrangements. Features of this sort add 
considerably to the complications of start-up. 

The start-up period is one when serious damage can be 
inflicted on plant equipment. Thus mention has already 
been made of the danger of using up a large proportion of 
the creep life during commissioning. Similar damage can 
be inflicted in regular start-ups. 

Start-up is a time when there is a much higher than aver¬ 
age risk of getting unwanted materials such as air or water 
into the plant. It is necessary to pay particular attention to 
these hazards. 

Instruments are of particular importance during 
start-up, but unfortunately are likely to be less accurate or 
reliable than during normal operation. This should be 
borne in mind if an instrument failure could give rise to a 
hazardous condition. 

It is an essential requirement, therefore, that there be a 
formal but practical system to control start-ups, that there 
be proper documentation and that the personnel be fully 
trained in the procedures. 

20.9.2 Normal operation 

The normal operation of the plant is discussed in Chapter 13 
and is not considered in detail in this section, but there are 
several points that may be restated. 

The plant management should ensure that the objectives 
of, and constraints on, the operation of the plant are clearly 
defined and well understood by the process operators. 

There should be a full understanding of the relative roles 
of the operator and the trip system in the face of a developing 
abnormal condition. In essence, it is the function of the 
operator to try to prevent this condition developing to the 
point where a parameter goes outside its permitted envelope 
and that of the trip system to shut- down if such an excursion 
is imminent. 

It is desirable that there be holding states, or fail-back 
positions, short of full shut-down, to which the operator can 
move the plant while a problem is sorted out. 

In any event, management must make it clear beyond 
doubt that any conflict between production and safety is to 
be resolved in favour of the latter. 

20.9.3 Normal shut-down 

Normal shut-down starts from the condition of normal 
operation and its preceding condition is therefore relatively 
well defined. This makes it practical to formulate shut- down 
procedures more fully than for some of the start-up situa¬ 
tions mentioned. 

Many of the features of start-up mentioned earlier, such 
as the effect on other plants and on utilities, apply mutatis 
mutandis to shut-down. 

20.9.4 Emergency shut-down 

Emergency shut-down may be effected by an automatic 
protective system or by the operator. In the first case the 
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operator’s function is to forestall the activation of the 
automatic system by averting the threatened parameter 
excursion, whilst in the second he has the additional func¬ 
tion of performing the shut-down if it becomes necessary. 

In some systems an intermediate case occurs, where the 
automatic system shuts down part of the plant but it is left 
to the operator to shut-down other parts. This is the case, 
for example, on some oil production platforms, where the 
main oil line may be shut-down automatically but the gas 
lines to and from the platform, which are linked to other plat¬ 
forms, are shut-down manually, thus allowing a degree of co¬ 
ordination with other platforms which would be affected. 

The emergency shut-down procedure is generally 
designed so that the conditions which should trigger it are 
unambiguously identified and the actions to be taken are 
clearly defined. A typical shut-down condition is the immi¬ 
nent excursion of a parameter. Typical shut-down actions 
are shutoff of heat input and depressurization of vessels. 

For emergency shut-down by the operator, emergency 
shut-down procedures should be provided, in the form of a 
general emergency shut-down procedure. There may be 
some variability in this procedure depending on the event 
forcing the shut-down, but an excessive number of varia¬ 
tions should be avoided. 

These emergency shut-down procedures are to be dis¬ 
tinguished from the procedures required to deal with 
escapes from the plant, which are generally referred to as 
emergency procedures. 

Emergency shut-down is discussed further in Chapters 
13 and 14. 

20.9.5 Prolonged shut-down 

If shut-down is prolonged, precautions should be taken to 
prevent deterioration of the plant. Typical examples are 
inspection of equipment to check for external corrosion and 
‘turning over’of pumps to avoid‘brinelling’. Prolonged shut¬ 
down, and start-up from this condition, is discussed further 
in Chapter 10. 

20.9.6 Restart after discovery of a defect 

If it is necessary to shut the plant down on account of a fault, 
the cause and implications of the fault should be established 
and any necessary measures taken before the plant is 
started-up again. This situation should be covered by a 
procedure which details the steps to be taken after such a 
fault is discovered and before the plant is restarted. 

At Flixborough it was found that No. 5 Reactor had devel¬ 
oped a crack 6 ft long, but the plant was put back on stream 
without a thorough examination of the other reactors, 
an omission which is criticized in the Flixborough Report. 

20.10 Start-up of Refinery Units 

Accounts of the start-up and shut- down of refinery units are 
given in Safe Ups and Downs (American Oil Company, 
Amoco/4) and by Hayes and Melaven (1964). Some principal 
hazards are: 

(1) mixing of air and hydrocarbons; 

(2) contacting of hot oil and water; 

(3) water shots and water freezing; 

(4) over- and underpressuring of equipment; 

(5) thermal and mechanical shock to equipment; 

(6) corrosive and poisonous fluids; 

(7) pyrophoric iron sulfide. 


The last item is a hazard mainly during shut-down, but 
the other hazards occur during both start-up and shut¬ 
down. Fired heaters present particular hazards and are 
dealt with in Section 20.12. Start-up should include the 
following phases: 

(1) preparatory activity; 

(2) removal of air; 

(3) leak testing; 

(4) disposal of purge material; 

(5) removal of water; 

(6) bringing on stream. 

The plant should be inspected to check that it is ready for 
start-up. The auxiliary systems such as the utilities, 
instruments and gland oil systems should be activated. 
Shut-down blinds should be removed and running blinds 
installed. 

There are various hazards associated with the activation 
of the steam system, including water hammer, over¬ 
pressuring, and thermal and mechanical shock. Steam 
should be introduced into the unit gently, with vents and 
drains open. When the unit is up to temperature, the vents 
and drains should be closed and the steam traps commis¬ 
sioned. Measures should be taken to avoid collections of 
condensate which may give rise to water hammer or may 
freeze. 

The activation of the water system presents the hazards 
of introducing water where it is not wanted and of its freez¬ 
ing. Water connections used only for washing down during 
shut-down should be blinded off. 

There should be a formal procedure with proper doc¬ 
umentation for the installation and removal of blinds, so 
as to ensure that all blinds installed for shut-down pur¬ 
poses are removed and all blinds required for running are 
installed. 

Air should be removed by purging with a suitable 
material. This is commonly done using water or steam. Use 
is also made of inert gases such as nitrogen, carbon dioxide 
or gas from an inert gas generator. 

Steam is an effective material for purging. Besides 
removing air, it vaporizes water, melts ice and reveals 
blockages in vents and drains. The purging should be done 
with high-point vents and low-point drains open, but with 
instrument connections closed except on pressure gauges. 
The steam should generally be introduced at the bottom of 
the unit, not only because it is lighter than air and tends to 
rise but also because this gives a refluxing and cleaning 
action which is not otherwise obtained. 

Purging may also be carried out by filling with water. 
High-point vents should be opened and the unit filled until 
the water flows out of the top.Water purging may be done by 
filling several equipments simultaneously. This method is 
suitable, however, only if the water will do no damage to 
process features, for example catalysts, and if the equip¬ 
ment is capable of supporting the weight of water. 

Another method of purging is the use of inert gas. The 
purging should be done with vents and drains open. 
The pressure should be kept positive, but low so as not to 
waste gas. 

If an inert gas generator is used, the quality of the gas 
should be monitored. It is necessary for the oxygen content 
of the gas to be kept well below the target value for the 
atmosphere in the unit in order to avoid using excessive 
quantities of the gas. 



20/12 PLANT OPERATION 


Closed systems, such as flare and blowdown systems 
into which relief valves discharge, should also be purged 
with inert gas. This may require special purge connections. 

With steam or inert gas, purging should be continued 
until analysis shows that the oxygen content is below the 
desired level. This is typically 0.5% v/v or less. 

The vent and drain points at which analytical tests are to 
be made should be specified and records kept of the tests. 

Vacuum equipment may be freed of air by evacuating and 
refilling with inert gas, this cycle being repeated two or 
three times. 

The equipment should then be raised to a suitable pres¬ 
sure to allow testing for leaks. The testing is carried out by 
closing the vents and drains after purging and admitting 
more steam, water or inert gas until the required pressure is 
reached. All joints and connections should then be inspec¬ 
ted for leakage. Leak testing is considered in more detail in 
Chapter 19. 

The positive pressure should be maintained in the 
equipment after the test. With steam or water a few high- 
point vents may be opened and a small flow maintained. 
Condensate should be drawn off periodically from 
low-point drains.With inert gas, vents and drains should be 
kept closed. 

Vacuum equipment should be given a leak test under 
pressure, as just described, followed by a vacuum test. 

It is then necessary, except for vacuum equipment, to 
remove the purge materials. This is normally done using 
fuel gas, which is an essentially hydrocarbon material, is 
readily available and can be returned to the fuel gas system. 

If steam is the purge material, there should be a gradual 
and simultaneous opening of the fuel gas valve and closing 
of the steam valve. Drains should be cleared of conden¬ 
sate and both vents and drains closed when the fuel 
gas flows out. 

It is important to allow sufficient fuel gas in the unit to 
maintain a positive pressure and avoid either allowing air in 
if the vents are open or underpressuring the unit if the vents 
are closed. 

If the purge material is water, the vents should be closed, 
the fuel gas admitted at the high point, the drains opened, 
and the water gradually displaced. Drains should be closed 
when the fuel gas comes out. 

If inert gas purging is used, the fuel gas should be allowed 
to flow in and mix with the inert gas. 

In all cases the fuel gas flow should be maintained until 
the required pressure is reached. If this is the normal fuel 
gas line pressure, the unit may be left connected to the line, 
while if it is some lower pressure, the unit should be shut off 
or left connected but under pressure control. 

With vacuum equipment the purge gas is removed by 
evacuation. 

Residual water should now be removed before hot oil is 
introduced. This is done by circulating oil which is initially 
cold (10-40°C) and is then heated to warm(40-80°C) or hot 
(80-175°C or above). Generally, the oil used is that normally 
charged to the unit, but suitable low pour point gas oil can be 
utilized. 

While the cold oil is circulating, water should be drained 
from the system. Since a water-oil emulsion may form, the 
circulation should be interrupted every 30-40 minutes to 
let the emulsion break and the water settle so that it can be 
drained off. 

When water is no longer draining, the oil temperature 
should be raised to warm. This may release some more water 


by melting ice and breaking emulsions. This water also 
should be drained away. 

If the unit normally operates below the boiling point of 
water, it is not usually necessary to raise the oil temperature 
further, but if it operates at higher temperatures, then the 
oil temperature should be raised to hot. 

Usually at this stage the oil flow is changed from circula¬ 
tory to once-through, the oil being pumped to specified 
receivers. 

Units which operate at higher temperatures often have 
their own fired heaters and these can be started up and used 
to heat the oil. 

The instrumentation should be brought into service as 
far as is possible during these operations. 

Additional flushing of sections of the unit such as reflux 
lines and drums and blowdown lines should also be carried 
out using warm oil. There should be frequent draining of 
water to prevent violent contact with hot oil. The exact pro¬ 
cedures depend on the type of unit. 

Finally, the unit should be brought on stream by making 
the specified staged adjustments to the main parameters, 
such as flow, pressure and temperature, until the normal 
operating conditions are reached. This is generally 
straightforward, but certain hazards may occur. The 
equipment may lie subjected to overpressure or thermal or 
mechanical shock. Common causes are too rapid changes in 
operating parameters or a lack of appreciation of the tem¬ 
perature relations between different parts of the system. 
Water and air may again find their way into the plant from 
various sources. 

20.11 Shut-down of Refinery Units 

The same sources also describe the shut-down of refinery 
units. Shut-down should include the following phases: 

(1) cooling and depressurizing; 

(2) pumping out; 

(3) removal of residual hydrocarbons; 

(4) removal of corrosive or toxic materials; 

(5) removal of water; 

(6) blinding activities; 

(7) removal of pyrophoric iron sulfide. 

The heat input to the unit should be stopped and fired hea¬ 
ters shut-down. The feed flow should be reduced and then 
cut off. Excess pressure should be relieved by releasing the 
hydrocarbon gases to the gas collecting system. 

If cooling might cause underpressure, inert gas should be 
introduced to maintain the pressure close to atmospheric. 

Vacuum units should be cooled, the vacuum-producing 
equipment shut off and the vacuum broken by introducing 
inert gas. 

When the unit is cooled and depressurized, the materials 
should be pumped out to specified receivers. 

Care should be taken that during pumping out cen¬ 
trifugal pumps are not allowed to lose suction completely, 
since even a short period of running dry can do serious 
damage. Reciprocating pumps are less susceptible. 

The oil pumped out should be cooled so that it is below its 
flashpoint and is sufficiently cold not to cause trouble if it 
contacts water in the lines. 

The pressure in the unit should be maintained during 
pumping out by admitting inert gas so that under-pressure 
and air inleak are avoided. 
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Residual hydrocarbons should then be removed by purg¬ 
ing with steam, water, or water followed by steam. Details of 
shut-down purging methods are given by Hayes and Mela- 
ven (1964). 

After purging, air should be allowed into the unit. The 
inflow of air should be sufficient to prevent under-pressure. 

Residual corrosive or toxic materials that may be present 
should likewise be removed. Essentially similar purge 
materials and methods may be used. A further discussion of 
equipment purging and cleaning for maintenance is given 
in Chapter 21. 

Water left in the unit from normal operations or from 
purging should be removed to prevent damage during the 
downtime and start-up. Freezing of water in the equipment 
can do serious damage and should be avoided. The water 
should be completely drained from the unit and blocked 
drains identified and cleared. 

The installation of shut-down blinds and the removal of 
running blinds should then be carried out under the control 
of a proper procedure with appropriate documentation, as 
already described. The methods of isolation and line break¬ 
ing are described in Chapter 21. 

If there is a possibility that pyrophoric iron sulfide might 
be present, men should stand by ready to spray the sulfide 
when the equipment is opened up. The fluid used may be 
water or a suitable light oil.The latter wets more thoroughly 
and evaporates less rapidly, and may be preferable unless it 
constitutes a further fire hazard. Complete mechanical 
removal of the sulfide should then be carried out. 


20.12 Operation of Fired Heaters 

The operation of a rather different item of plant is illu¬ 
strated by that of fired heaters. Some of the hazards of fired 
heaters and some features of their design relevant to safety 
are discussed in Chapter 12. Here consideration is given to 
the safe start-up and operation of such units. 

Safe operation of fired heaters is dealt with in Safe Fur¬ 
nace Firing (American Oil Company, Amoco/3), Handbook of 
Industrial Loss Prevention (FMEC, 1967) and the CCPS 
Engineering Design Guidelines (1993/13) and in the codes 
and other publications cited in Chapter 12. 


20.12.1 Burner start-up 

The essential features of the safe start-up of burners 
have been described above, but some of these may be 
re-emphasized in relation to operation. 

Every effort should be made to prevent the leakage of fuel 
into the firing space. Shut-off valves should be checked for 
leak tightness. Double block and bleed valves should be 
operated as intended, with the bleed valve open when the 
block valves are closed. 

It should be appreciated that it may not take long for fuel 
sufficient to create a flammable atmosphere to pass into the 
firing space. With oil firing the quantity flowing in the few 
seconds between the flame extinction and shut-off valve 
may be enough, while with gas firing a flammable mixture 
may form by leakage through a shut-off valve during the 
few minutes which it takes to remove a slip plate. Partly for 
this reason slip plates are not considered a good means of 
isolation for gaseous fuel. Leakage flows of gas through 
shut-off valves are often in the range 1—101/min. 

The air flow should be established and the firing space 
purged by opening the dampers and starting the fans. 


The atmosphere in the firing space should be tested 
before ignition is attempted. Delay between this test and the 
ignition should be avoided. If time does elapse, a repeat test 
should be made. 

If a separate device such as a pilot burner is used to effect 
ignition, this should be lit before the fuel to the burner is 
turned on. A check should be made that the pilot light is 
established. The check should be on the flame itself rather 
than on some quantity from which the presence of the flame 
might be inferred. 

If the main flame goes out, the proper start-up procedure, 
including purging and testing of the firing space, should be 
carried out. Short cuts such as simply attempting to relight 
the burner should not be taken. 

The presence of a flame should be monitored by a flame 
failure device. The device should ‘see’ the flame to be moni¬ 
tored and not other flames such as the pilot light. 

If there are multiple burners, it should be borne in mind 
that fuel may leak through from burners which are shut off 
so that a flammable mixture is formed and is then ignited by 
an operating burner. In some circumstances, it may be 
appropriate to avoid this by firing with all the burners. 

The flame is normally extinguished by shutting off the 
fuel and injecting snuffing steam. 

The possibility of interactions between furnaces linked 
by common headers should be borne in mind. 


20.12.2 Tube failures 

Overheating of furnace tubes can result in rapid or delayed 
failure. Rapid failure can occur if the flow of feed through 
the tubes is too low or is lost altogether, or if there is direct 
flame impingement on the tubes. Failure can also result 
from less intense overheating over long periods. It is very 
easy to cause a drastic reduction in the creep life of tubes by 
maloperation. 

Typically a furnace tube has a creep life of 10 years at 
500°C. Then its creep life will be reduced approximately as 
follows by operation at higher temperatures: 


Temperature (°C) 

Creep life 

506 

6 years 

550 

3 months 

635 

20 hours 


The reduction in creep life is pro rata. Thus, for example, 
the creep life for a tube with the characteristics just given 
will be used up by operation for 5 years at 500°C and 1| h 
months at 550°C. 

The measurement of the furnace tube temperature is 
difficult, but temperature measuring devices are available 
for this duty. It is now normal practice to measure the tube 
temperature. The measurements may be used to generate 
alarms to warn the process operator and/or to initiate trips 
which shut the furnace down. Atrip system may be effective 
against gross overheating, but is less appropriate to prevent 
overheating which is not so severe, but which can never¬ 
theless cause a serious reduction in creep life. 

It is essential, therefore, for the process operator to 
understand the penalties of overheating and, in particular, 
those arising from the relatively small increases 
of tube temperature that he may otherwise regard as 
insignificant. 
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20.13 Operation of Driers 

An item of equipment which has much in common with a 
fired heater but is rather more complex is a drier. An account 
of the start-up, operation and shut-down of a drier is given 
in Prevention of Fires and Explosions in Driers (the IChemE 
Drier Guide) (Abbott, 1990). 

There are a number of different types of drier. Abbott 
gives first a general account of the operation of a drier, 
which, broadly, is applicable to any type, and then considers 
the variations applicable to particular types of drier. The 
account given here is based on this general account and 
assumes that inerting is used. 

20.13.1 Pre-start-up checks 

Before the drier is started up, checks should be made on the 
mechanical condition of the plant, its internal state, its 
instrumentation and the control settings. There should be 
no leaks of fuel or lubricating oil and the air filter should be 
clean. Explosion vents should be intact and clear to operate. 
The plant should be free of spillages and deposits and of 
maintenance equipment. The instrument should be opera¬ 
tional, as should explosion suppression devices. The dam¬ 
per settings should be correct. It should also be checked 
whether there has been any modification to the plant or the 
material to be dried. 

20.13.2 Normal start-up 

Essentially, the operation of a drier involves steering a 
course between overheating or underdrying the product. 
The product temperature must not be allowed to rise to a 
point where a runaway reaction can occur and deposits in 
the drier must not reach their self-ignition temperature. On 
the other hand, the product must not be underdried which, 
besides giving off-specification material, can cause block¬ 
age in the discharge system and caking in conveying and 
storage. 

It is also necessary to ensure that the exhaust gas tem¬ 
perature remains above its dewpoint in the dust recovery 
equipment. The exhaust gas temperature is controlled by 
manipulating (1) the heat input, (2) the feedf lowand/or (3) the 
evaporative load. The heat input is the variable principally 
used, but the response may be slow due to large time lags. 

The plant should be started up by starting the product 
discharge valves and conveyors and the fans. On an indir¬ 
ectly heated drier the heating medium should then be 
admitted. Assuming, as stated, that the system is operated 
under inert gas, it should be purged until the outlet oxygen 
concentration has fallen to the operating value. Assuming 
also that the heater is fired by gas or oil, it should be started 
up using a safe fired heater start-up procedure. Once the 
exhaust gas temperature has reached its operating value, 
the feed of wet material should be started. 

The drier is then gradually brought up to full load, within 
the constraints mentioned. This is generally the stage of the 
process that is most difficult to control. 

20.13.3 Normal operation 

In normal operation the same control objectives apply, that 
is to avoid overheating or underdrying the product, and the 
same means of control are available. The operation of the 
heater should be closely monitored. The product should be 
checked for specks of burned, charred or discoloured 
material, signs of a smouldering or burning deposit in 
the drier. 


20.13.4 Normal shut-down 

The same control objectives apply for normal shut-down. 
Again the process passes through a critical stage as condi¬ 
tions pass through a transient. 

The shut-down is initiated by shutting off the feed. Then 
the heater is shut off. Purging with inert gas is continued 
until all the product material has left the drier. The inert gas 
is then purged from the drier with air. The fan, discharge 
valves and conveyors can then be switched off. 

The inside of the drier should be inspected under a 
permit-to-work system. Potential hazards include a low 
oxygen content and smouldering material. 

20.13.5 Emergency shut-down 

The appropriate procedure for emergency shut-down 
depends on the condition causing the emergency. This may 
be a material blockage, an equipment failure, or a fire or 
explosion. 

For either of the first two events, the objective should be to 
prevent overheating of the product. Methods available are to 
shut off the heat input, to get the material out of the drier and 
to maintain the evaporative load. One way of effecting the 
latter is the use of a water spray. 

The emergency procedures for dealing with a fire or 
explosion are given in the Drier Guide. 


20.14 Operation of Storage 

A large number of incidents occur associated with the 
bursting or collapse of atmospheric storage tanks due to 
maloperation. 

An atmospheric storage tank is typically designed to 
withstand an internal pressure of 8 in. WG (20 mbar) or a 
vacuum of 2\ h in.WG (6 mbar).These are very lowpressures, 
which it is easy to exceed unless there is careful operation. 

If the pressure inside the tank is not kept within these 
limits, the failure of the roof or of the side walls may occur. 
Two principal modes of failure are overstressing of the roof 
due to excessive internal pressure and instability of the side 
walls due to excessive vacuum. 

Generally a roof fails under internal pressure either at the 
seams between the roof and the side walls or along the dia¬ 
metral seams in the roof itself. The failure typically has 
a cod’s mouth appearance. Large tanks are particularly 
vulnerable. 

For internal pressure the shear stress <r s in the seam 
between the roof and the wall is proportional to the pressure 
p and the diameter d and inversely proportional to the 
thickness of the tank wall t: 


o s oc pd/t [20.14.1] 

The bending stress c b in the roof itself is proportional to 
the internal pressure and the square of the diameter and 
inversely proportional to the square of the thickness: 


<r b oc p(d/tf [20.14.2] 

The side walls are designed to withstand the maximum 
head of liquid which can occur in the tank. The internal 
pressure is thus relatively less important in this case. But, 
again, the hoop stress in the side wall a- h due to the internal 
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pressure is proportional to the pressure and the diameter 
and inversely proportional to the thickness: 

<x h tx pd/t [20.14.3] 

The vulnerability of large storage tanks to overpressure 
may be illustrated by considering the relative stresses in the 
roof and side walls of (1) a baked bean tin and (2) a 1000 m 3 
fixed roof storage tank. It is assumed that thebaked bean tin 
has a diameter of 7.5 cm and a thickness of 0.25 mm, and that 
the storage tank has a diameter of 12 m and a thickness of 
5 mm. Then the ratios of the stresses in the tin and in the 
storage tank are as follows: 



Stress in storage tank 


Stress in baked bean tin 

Side wall, a h 

8 

Roof, <r b 

64 


Similarly, for vacuum the stresses are much greater in large 
tanks. 

The effect of vacuum on the side walls of a storage tank is 
to induce instability. The analysis of tank instability is 
complex, but some understanding may be obtained by con¬ 
sidering the effects of slight distortions in the shape of the 
tank. These effects may be summarized by saying that for 
internal pressure small changes in shape do not tend to 
cause the side walls to fail, but for vacuum such changes do 
tend to cause failure. 

This situation may be explained by the following simpli¬ 
fied argument (Aird, 1977b). Consider a small element of the 
wall of the storage tank, as illustrated in Figure 20.2(a), 
where r is the radius of the tank, t is the thickness of the wall, 
<5 is the width of the element and the angles a and 4> and the 
vectors of forces Ft and F 2 are as shown. Then with an 
internal pressure p and an external pressure of zero 


Fi = J pSr cc 

>s9 dd 

[20.14.4a] 

= 2pSr since 


[20.14.4b] 

= 2pSroc 

a«l 

[20.14.4c] 

F 2 = (T h tS 


[20.14.5] 

where a b is the hoop stress. 



The vector of forces £F in the vertical direction in Fig¬ 
ure 20.2 (a) is thus 

£F = Fi - 2F 2 sin [20.14.6a] 

At equilibrium this vector of forces must be zero 

£F = 0 [20.14.6b] 

For the case where there is no distortion of the element 

0 = a [20.14.7] 

Hence from Equations 20.14.4-20.14.7 

<th = j [20.14.8] 


F 2 = prb [20.14.9] 

Now consider the cases where distortion occurs. For a 

small inwards distortion 

4><a [20.14.10] 

and hence 

£F = 2pSr(sm a - sin </>) > 0 [20.14.11] 

Thus the net resultant force due to distortion tends to move 
the element outwards and so to return it to its original 
shape. For outwards distortion 

</> > a [20.14.12] 

and hence 

£F<0 [20.14.13] 


Thus the resultant force due to distortion tends to move the 
element inwards and so again to return it to its original 
shape. These effects are shown in Figure 20.2(b). 

Conversely, with an internal vacuum the vector of forces 
in the vertical direction is 

£F 11 -F, + 2F 2 sin 0 [20.14.14] 

For inwards distortion relation 20.14.10 applies and hence 

£F<0 [20.14.15] 

Thus the resultant force due to distortion tends to move the 
element inwards and so reinforce the distortion. For out¬ 
wards distortion relation [20.14.12] applies, and hence 

£F>0 [20.14.16] 

Thus the resultant force due to distortion again tends to 
move the element outwards and so reinforce the distortion. 
These effects are shown in Figure 20.2(c). 

A fuller treatment is given by den Hartog (1952, p. 274). 

Atmospheric pressure is maintained in a storage tank by 
a vent to the atmosphere. The tank may be subjected to 
pressure or vacuum which it cannot withstand, not only if 
this vent is blocked, but also if it does not have the capacity 
to handle the flows required to equalize the pressure. 

Some ways in which overpressure can occur include 
(1) pumping in liquid too fast, (2) an increase in the tem¬ 
perature of the liquid contents, (3) pumping hot liquid into 
water and (4) blowing in air, steam or gas. 

An increase in the temperature of the liquid in the tank 
can occur due to pumping in hot liquid or to a high ambient 
temperature. For many substances a temperature rise of 
6°C is enough to give an increase in vapour pressure of 
8 in. WG. Pumping hot oil into water raises the water 
temperature and causes it to exert a higher vapour pressure, 
or even to boil off as steam. 

Similarly, ways in which vacuum can occur include 
(1) pumping out liquid or emptying liquid under gravity too 
fast, (2) a decrease in the temperature of the liquid contents 
and (3) condensation of the steam or vapour contents or a 
depletion of the gas content. 
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(a) 



Figure 20.2 Forces acting on the side wall of an 
atmospheric storage tank: (a) element of side wall; 

(b) positive internal pressure - resultant forces tend to 
correct distortion; (c) negative internal pressure - resultant 
forces tend to reinforce distortion 


Condensation of steam or vapour in the tank can occur as 
a result of a sudden shower of rain. 

Vents on tanks are liable to blockage by debris or by 
polymerization or crystallization of the liquid. The vent 
normally has a flame arrester, which is particularly liable to 
blockage. Vents are sometimes blanked off to allow main¬ 
tenance work to be done. 

It is emphasized, however, that it is not necessary for a 
vent to be blocked for a tank to burst or collapse. All that is 
required is for the vent capacity to be insufficient to handle 
the flow required to equalize the pressure. 

The systems to which an atmospheric storage tank is 
likely to he connected mostly are at, or can generate, pres¬ 
sures sufficient to overpressure the tank. This applies to 


equipment such as transfer pumps and to services such as 
steam, air or nitrogen. 

Some situations which can lead to the bursting or collapse 
of a storage tank are shown in Figures 20.3 and 20.4. Burst¬ 
ing or collapse may result from a combination of the vent 
conditions shown in Figure 20.3 and the operations or 
situations shown in Figure 20.4. 

As an illustration of storage tank collapse, consider the 
following case. Welding had to be done near the roof of a 
storage tank containing a volatile flammable liquid soluble 
in water. The tank had an open vent with a flame arrester on 
it. The maintenance supervisor connected a flexible tube to 
the flame arrester and immersed the other end of the tube in 
a drum filled with water. When liquid was run out of the tank 
a vacuum developed and the tank, designed to withstand 
2\ in.WG, collapsed inwards. Moreover, if instead liquid had 
been run into the tank, overpressure would have developed 
corresponding to the depth of immersion of the tube and the 
tank, designed for 8 in.WG internal pressure, would have 
burst. 

Other examples of storage tank collapse are described in 
Case Histories B44—B48. 

20.15 Operational Activities and Hazards 

20.15.1 Water hammer 

The term ‘water hammer’ is applied to two somewhat dif¬ 
ferent phenomena, both of which generate forces sufficient 
to rupture the pipeline. 

One kind of water hammer, or hammer blow, results from 
the sudden closure of a valve in a long pipeline filled with 
water. The force on the valve is then proportional to the rate 
of dissipation of the momentum of the fluid. Such water 
hammer is familiar in domestic water systems, where its 
effects are usually not serious. On an industrial scale, 
however, hammer blow can be very destructive. The phe¬ 
nomenon is considered in more detail in Chapter 12. 

The other kind of water hammer occurs when a slug of 
condensate is flung against the pipework by steam. Typical 
features of a situation giving rise to this effect are as follows. 
The steam main is not used for some time, but the steam 
pressure is maintained. Condensate collects at low points. 
The steam traps and drains that should drain the con¬ 
densate out are not working. The steam flow is suddenly 
increased and water hammer occurs. Again the effect can be 
highly destructive. 

Steam mains should be designed to allow condensate to 
be drained from low points by steam traps and drains.These 
traps and drains need to be maintained so that they work 
effectively. It is a help if they are so installed that they can be 
drilled through under pressure if they get blocked. 

It is also essential to exercise care when it is necessary to 
make large alterations to steam flows, particularly in 
situations such as start-up. Suitable precautions are checks 
on condensate accumulation and on the operation of steam 
traps, and slow operation of the steam valves. It should 
be appreciated that alteration of the opening of a valve in 
a steam ring main can have a great effect on the flows in 
that main. 

Both kinds of water hammer, but particularly the first, 
can occur with fluids other than water. 

20.15.2 Slopover 

If hot oil is brought into contact with water, there is liable to 
be a rapid evolution of water vapour and the formation of a 
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Figure 20.3 Some vent conditions which can lead to the bursting or collapse of an atmospheric storage tank: 

(a) vent blanked off; (b) plastic bag over vent; (c) vent choked; (d) flame trap choked; (e) vent connected to water seal; 
(f) vent too small; (g) flexible tubing connected to vent; (h) vent modified 




Figure 20.4 Operations and situations which can lead to the bursting or collapse of an atmospheric storage tank: 

(a) overpressure - pumping in liquid too fast; (b) overpressure - increase in the temperature of liquid contents; 

(c) overpressure - pumping hot oil into water; (d) overpressure - blowing in air, steam or gas; (e) vacuum - pumping out 
liquid too fast; (f) vacuum - decrease in the temperature of liquid contents; (g) vacuum - condensation of steam or 
vapour; (h) vacuum - depletion of oxygen 
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large volume of foam. This condition typically occurs when 
oil with a water layer is heated up or when hot oil is run into a 
vessel containing water, or oil and water. The effect is simi¬ 
lar to that occurring when wet chips are put into boiling fat 
in a chip pan. It is variously known as ‘slopover’,‘boilover’, 
‘foamover’ and ‘puking’. 

The effect created when water is vaporized is illustrated 
by the eruption of the volcano Krakatoa in 1883. A cubic 
mile of water was vaporized and a cubic mile of rock was 
thrown into the air. Rock fragments travelled to a height of 
14 miles and the sound was heard 3000 miles away. 

Incidents involving slopover are quite frequent and can 
be serious. Slopover is one of the hazards described in 
Hazard of Water (American Oil Company, Amoco/1). 

Although it is water which is most commonly involved, 
a similar phenomenon can occur with a volatile oil. A ser¬ 
ious accident which was probably caused by this effect 
occurred at the Shell refinery at Pernis in 1968 (Fontein, 
1968). Hydrocarbons in a slops tank boiled over. Avapour 
cloud formed, found a source of ignition and exploded vio¬ 
lently, causing extensive blast damage and a large fire. 
Owing to cold weather, it had been necessary during the two 
previous weeks to heat the oil in the tank. It is believed that 
the steam coils had become covered in a water-in-oil emul¬ 
sion which reduced the heat transfer to the supernatant oil, 
so that the two oil layers were at substantially different 
temperatures, and that vapour formation at the interface 
between the oil layers initiated mixing, causing further 
vapour evolution so that the tank overflowed, the hydro¬ 
static pressure at the bottom of the tank was reduced and 
violent boil-up occurred. The incident is described in Case 
History A41. 

20.15.3 Water draining 

In the storage of liquefied petroleum gas (LPG) small 
amounts of water usually accumulate in the vessel. This 
water is commonly removed by the periodic action of an 
operator who drains it off manually. If for any reason the 
operator loses control, a hazardous situation is liable to arise 
in which the fluid issuing from the drain point is no longer 
water but LPG. 

This hazard was realized in the Feyzin disaster in 1966, 
described in Case History A38, where an operator found 
himself unable to shut off the valves at the bottom of a pro¬ 
pane storage sphere and a large vapour cloud formed, 
ignited and caused a series of BLEVEs. 

As described in Chapter 22, the preferred arrangement is 
the use of a drain line with two valves. The method of 
operation of these valves is described in The Storage of LPG 
at Fixed Installations (HSE, 1987 HS(G) 34) as follows: 

Particular care should be taken when draining storage 
vessels in service in order to minimize the escape of LPG. 
Of the two drain valves, that nearer the vessel, should be 
fully opened first and draining then controlled by gradu¬ 
ally opening the second valve. If, on opening the second 
valve, no flow occurs, both valves should be closed imme¬ 
diately to allow subsequent investigation. On completion 
of the draining operation, the valve furthest from the sto¬ 
rage vessel should be closed first, then the other valve. 


20.15.4 Gas cylinders 

There are a number of hazards that can arise from the use 
of gas cylinders. One of the most frequent types of incident 


is misidentification of the gas in the cylinder. Thus, for 
example, oxygen may be used in an application where an 
inert atmosphere is required. Gas cylinders are marked 
with an identifying colour code. Common causes of inci¬ 
dents are that the coloured paint has been rubbed off or that 
people handling the cylinders are not familiar with the 
code. Cylinders on which the code is not clear should be 
taken out of service and personnel should be trained to 
recognize the identification scheme. 

Overfilling of cylinders sometimes occurs. This may be 
due to a defective filling machine or to the use of a machine 
too small for the cylinder, so that only part of the cylinder 
rests on the machine. 

Cylinders are sometimes heated to give a steady gas sup- 
ply.There is then the hazard that the isolation valve is turned 
off and the cylinder explodes. It may be possible, however, to 
design a cylinder heating system that will not allow the 
cylinder to overheat sufficiently to cause an explosion, even 
if the isolation valve is closed accidentally. A suitable sys¬ 
tem is heating with warm air, the air itself being heated by 
steam or electricity. Heating of a cylinder by steam or a heat 
transfer medium is best avoided, because these methods are 
more liable to cause not only overheating but also corrosion 
of the cylinder. 

The correct method of drawing gas from a cylinder is to 
set the pressure regulator screw to zero and then to open the 
isolation valve. Failure to observe this procedure on an 
oxygen cylinder, for example, can lead to rupture of the 
regulator diaphragm and an explosion/fire. 

With oxygen there is the hazard of igniting materials, 
such as the plastic caps used to cover the nozzle. Such caps 
should be entirely removed before the valves are opened. 

Another hazard with gas cylinders is that the isolation 
valve may be damaged in such a way as to allow a rapid flow 
of gas from the cylinder. In such circumstances the cylinder 
can become a projectile propelled by the escaping gas. 

20.16 Sampling 

Sampling is a common cause of accidents to personnel in 
the chemical industry. It needs to be addressed by the pro¬ 
vision of suitable equipment and of formal systems of 
operation. Accounts of sampling have been given by 
Ducommun (1964a,b) and Lovelace (1979) and in the ICI 
LFG Code. 

Sampling is carried out to monitor product quality, the 
material balance or equipment operation, or for the pur¬ 
poses of troubleshooting. 

A sampling technique should aim to minimize the risk of 
leakage from the sample point, to safeguard the person 
taking the sample, to provide a safe means of carriage of the 
sample to the laboratory and to protect the laboratory per¬ 
sonnel handling the sample. 

Two principal problems are corrosive liquids and flam¬ 
mable gas and liquids. Before considering these, conside¬ 
ration is given to some general points on liquid sampling. 

20.16.1 Liquid sampling 

An approach to the safe sampling of liquid streams has been 
described by Lovelace (1979). He utilizes a proforma for the 
specification of liquid sampling which covers: the hazards; 
the sampling conditions, including the frequency of sam¬ 
pling and the size of sample required; any special con¬ 
siderations; the equipment, both installed and portable; 
and the details of the installed equipment. 
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The sample point should be treated as a piece of equip¬ 
ment in its own right and designed accordingly. There is no 
single system that is suitable for all applications. 

Sampling systems may be classified as direct or indirect 
line systems. An ordinary sample valve is a direct line sys¬ 
tem. Another device is the piston-type sampling valve, in 
which the sample offtake is set at a 45° angle and is normally 
kept closed by a piston that moves along the axis of the main 
sample line. This gives a positive rodding out action and is 
used in applications where blockage may occur. 

In an indirect line system the sample is trapped in a fixed 
volume and then withdrawn. A simple device which effects 
this is a sampling plug valve which is installed in line in a 
pipe. This is a type of ball valve with a sample offtake line 
and a vent line located in thebody of the valve perpendicular 
to the main pipe, so that when the valve is rotated, the sam¬ 
ple trapped in the plug can flow down the sample line. In 
another type of device the sample is withdrawn using a 
piston. 

A sample chamber is attached directly to the line to be 
sampled and the liquid is admitted to it by a valve system. 
One system which minimizes leaks is a double block and 
bleed valve arrangement. 

For syringe sampling use may be made of a septum. 

Where sampling can give rise to hazardous fumes, good 
ventilation is essential. Another method of protection 
against fumes and leaks is the use of a sampling enclosure, 
essentially a simple box with the sample pipe entering 
through the top and the sample bottle connection through 
the bottom. Details of the design of such an enclosure are 
given by Lovelace. 


20.16.2 Corrosive liquids 

The following procedure may be used for the sampling of 
corrosive liquids.The person taking the sample should wear 
the appropriate protective clothing such as goggles and 
gloves. The sample bottle should not be held in the hand but 
on a stand. It is desirable that the sample point be provided 
with remote operation or with a protective covering around 
the sample point. The sampler should stand as far as possi¬ 
ble from the sample point. If there is no remote operation, he 
should turn the sample valve using an outstretched arm. 
The sample bottle should be carried in a bottle carrier. 



20.16.3 Flammable fluids 

Flammable gases and liquids are usually sampled using a 
metal bomb. Typical sampling methods are described in the 
ICI LFG Code. For a liquefied flammable gas (LFG) the 
bomb is a stainless steel cylinder as shown in Figure 20.5(a). 
A liquid sample is taken as follows. The ullage end of the 
bomb is connected to the sample point, the bomb is held 
vertically with the ullage end at thebottom, and both the top 
and the bottom valves are fully opened. The needle valve is 
then opened slowly and the bomb is filled. When it is full, 
liquid emerges from the top valve and all the valves are 
closed. The bomb is then disconnected from the sample 
point and inverted so that the ullage end is at the top. The top 
valve is opened so that liquid issues out until the level in the 
bomb falls below the bottom of the ullage pipe. When vapour 
starts to come out instead of liquid, the valve is closed. The 
ullage for LFG is 20%. 

Methods of sampling LFG as gas include (1) evacuation of 
the bomb before sampling, and (2) purging of the bomb 
with the gas sampled, the purge being passed to the vent 
system. Suitable bombs for these two methods are shown in 
Figures 20.5(b) and 20.5(c), respectively. The ICI LFG Code 
should be consulted for full details of these sampling 
procedures. Failure to vent a bomb after sampling LFG may 
result in an explosion if the liquid warms up by heat transfer 
from the atmosphere. A sample bomb explosion from this 
cause has been described by Ducommun (1964a). 

Ducommun (1964b) also describes a system for avoiding 
such incidents. The bomb itself is effectively treated as a 
small pressure vessel, is of special design and is regularly 
inspected. There is a requirement that the bomb be vented 
immediately after sampling to give the specified ullage and 
that this be checked by weighing or other means. The sam¬ 
pling procedure is simple and standardized, personnel are 
well trained in it and notice of sampling operations is given 
to the process personnel. The sampling operations are 
monitored and documented by the laboratory. 


20.16.4 Particular chemicals 

Certain chemicals require special sampling methods. Tech¬ 
niques for particular chemicals are given, for example, in 
some of the Codes of Practice for Chemicals with Major 
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Figure 20.5 Some sample ‘bombs’ for liquefied flammable gases (LFGs) (Imperial Chemical Industries Ltd, ICV 
RoSPA 1970IS/74; reproduced by permission): (a) sample bomb for liquids; (b) sample bomb for gases (inlet only); 
(c) sample bomb for gases (inlet and outlet) 
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Hazards by the CIA, such as those for ethylene dichloride 
and phosgene. 

20.17 Trip Systems 

Trip systems are provided to protect the plant against cer¬ 
tain hazardous situations by shutting it down if particular 
parameters go outside the specified limits. 

There are differences, however, in the extent to which it is 
essential to provide trip protection with no disarming 
allowed and in the level to which trip systems can be 
economically engineered to ensure this. Some trip systems 
are very sophisticated and provide protection not only dur¬ 
ing normal operation but also during other conditions such 
as start-up. In other cases, however, it is necessary to dis¬ 
arm the trip system temporarily to allow the plant to be 
started up. 

Disarming of trips is a permissible practice provided that 
it is done in accordance with the design intent and with 
proper procedures. Otherwise, it is an extremely dangerous 
practice. Probably the most common error is to disarm a 
trip temporarily, usually during start-up, and to forget to 
restore it. 

The Flixborough Report (R.J. Parker, 1975, para. 40) 
revealed that an automatic system, which initiated safety 
actions such as shut-off of the air supply and initiation of a 
nitrogen purge if the level of liquid nitrogen supply fell too 
low, could be readily overridden by setting to zero the timer 
for fixing the duration of the purge. Although such action 
does not appear to have contributed to the explosion, such 
disarming is a hazardous practice. 

If the disarming of trips is to be practised, there should be 
a procedure that ensures that the trip is correctly restored. 
Methods used to ensure that disarming is done safely 
include both key interlocks and permit systems. 

If spurious trips occur due to trip initiator unreliability, 
the operator has an incentive to disarm the trip in order to 
continue operating, and incidents occur in which operators 
disarm trips for this reason. Again hardware or software 
methods may be used to prevent disarming. But it is 
highly desirable in such cases to improve trip system relia¬ 
bility. 

Disarming is not the only way in which a trip can be ren¬ 
dered ineffective. A similar result is often achieved by 
an alteration of the trip setting. It is equally essential, 
therefore, to ensure that there is no interference with trip 
settings. 

A trip system should be designed so that it does not reset 
itself when the trip condition disappears, for example 
valves closed by the trip action should not reopen. It is 
important, however, that the operations side appreciate the 
hazards that can arise if the trip system does reset itself. 
A typical hazard in this case might be the entry of atmo¬ 
spheric air into a vessel filled with hydrocarbon vapours so 
that an explosive mixture is formed. 

20.18 Identification Measures 

It is essential, if errors are to be avoided, that plant vessels 
and equipment be given appropriate marking so that they 
are readily identified and any hazards associated with them 
are understood. Equipment identification is of particular 
importance for maintenance work and is considered in 
Chapter 21. Here consideration is confined two aspects 
that particularly concern process operators. These are the 


identification of hand valves and the labelling of in-plant 
containers. 

20.18.1 Valve identification 

One of the principal ways in which the plant is affected by 
operator actions is through the opening and closing of iso¬ 
lation valves, or hand valves. It is not uncommon for the 
operator to have difficulty in identifying the right valve, as 
described in Chapter 14. Yet an error in the identification of a 
valve can have serious results. 

The identification of hand valves is discussed by R. King 
(1990). A hand valve should be identified on the piping 
and instrument diagram (P&ID), in the operating manual 
and on the plant. The P&ID should allow space for the 
hand valve identification numbers to be inserted; it is often 
difficult to insert such numbers due to lack of space. The 
operating instructions should identify hand valves by 
number. 

On the plant a problem arises in maintaining permanent 
identification of a hand valve. A tag may be put on the valve, 
but a valve tends to lose its tag or, if it does retain it, it may be 
removed and put back at some other point. A method that 
overcomes these difficulties is the marking of the valve 
number on the pipework, or insulation, with an arrow 
pointing to the valve in question. 

20.18.2 In-plant container labelling 

The operation of a process plant can involve the transfer 
within the plant of a number of chemicals and it is necessary 
to ensure that these are correctly identified at all times. 
A programme for the in-plant labelling of containers for 
such substances has been described by Kmetz (1990). 

These containers are those entering the plant, those 
generated within and retained with the plant, and those 
leaving the plant. Each container is required to have three 
pieces of information: the name of the substance, the hazard 
warning and the party responsible for it. 

Employees are responsible for checking that an incoming 
chemical is labelled. The party initiating shipment is 
responsible for seeing that an outgoing chemical is labelled 
and has a material safety data sheet. For in-plant labelling 
some latitude is allowed. A container used by one person 
within one shift does not have to be labelled. 


20.19 Exposure of Personnel 

Of the two main ways of reducing the size of a potential 
disaster, mention has already been made of one, that is the 
limitation of inventory in the process design. The other is 
the limitation of exposure of personnel in plant operation. 

The First Report of the Advisory Committee on Major 
Hazards (ACMH) (Harvey, 1976) suggests that limitation 
of exposure should be an explicit objective. The Second 
Report (Harvey, 1979b) gives guidelines for the limitation 
of exposure. 

The hazard to which personnel are exposed may be a 
large fire, an explosion or a toxic release. Various scenarios 
for such hazards should be reviewed so that zones in which 
exposure is controlled can be delimited on a rational basis. 

Exposure is most simply limited by not having people 
there in the first place. For those whose presence is essen¬ 
tial much may be done to provide protection, particu¬ 
larly through the siting and design of buildings. This 
latter aspect is discussed in Chapters 10 and 24. Only the 
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reduction in the numbers present by management control is 
considered here. 

Typically, a large process plant has a number of shift 
process operators who man the control room and work about 
the plant opening and closing valves, changing pumps, 
replacing filters, taking samples and performing various 
other tasks. Some operators spend most of their time in the 
control room, others are mainly out on the plant. There are 
also several shift mechanical and instrument maintenance 
fitters. All these personnel patrol the plant and observe any 
abnormalities such as leaks or spillages and they are avail¬ 
able to deal with plant upsets. Laboratory personnel also go 
out on to the plant to take samples for analysis. 

In general, the numbers of shift operating and main¬ 
tenance personnel on modern process plants are already at 
the minimum level consistent with safe and efficient 
operation. In most cases further reduction would make it 
difficult to deal with emergency situations. 

During the day there is a rather larger number of main¬ 
tenance personnel on the plant. The plant manager and the 
plant engineer are also on the plant during the daytime. In 
addition, there are often other technologists concerned with 
carrying out investigations of all kinds. 

If a plant extension is being carried out, there will also be 
a fairly large number of construction personnel on the plant 
or very near it. 

The numbers of men on a large process plant might be 
expected to be approximately as follows: 


Shift operating personnel 5—25 

Shift maintenance personnel 0-5 

Day maintenance personnel 10-100 

Managers, technologists 2-10 

Construction workers 10-50 


In the event of an emergency, the shift personnel have 
specific instructions on the action which they should take 
and on the alarm or other instruction at which they should 
evacuate. The order to leave the plant is given to the day 
maintenance personnel and to construction workers on the 
appropriate alarm signal or on instruction from their 
respective supervisors. 

For the purposes of limitation of exposure, personnel may 
be divided into the following categories of exposure in the 
hazard area: 

Category 1 Continuous exposure (e.g. process operator). 

Category 2 Intermittent exposure: 

(a) short periods (e.g. technologist); 

(b) infrequent long periods (e.g. fitter). 

Category 3 Infrequent exposure (e.g. accounts clerk). 

The works site may be divided up into areas of (1) major 
hazard, (2) intermediate hazard and (3) low hazard. 

The limitation of exposure of personnel is effected by 
controlling (1) permanent location and (2) movement. 

The number of people permanently located in a major 
hazard area should be kept to a minimum consistent with 
safe and efficient operation. In particular, personnel 
in Category 2 should be there only if their presence is 
essential, as opposed to merely convenient. Examples of 
such personnel include technologists, training officers, 
maintenance planners, laboratory analysts and clerical 
assistants. 


Personnel usually located in the intermediate hazard area 
include maintenance and other services. Again the number 
should be kept as low as is reasonably practicable. 

Personnel should be given protection by suitably 
designed buildings, as described in Chapter 10. In the major 
hazard area the main protective building is the control room. 
The type of protection afforded by this will depend on the 
nature of the hazard (fire, explosion or toxic release). 
Buildings in the intermediate hazard area should also offer 
some protection. The ACMH suggests that personnel 
exposed to this intermediate level of hazard should have a 
work base such that they would not expect to be seriously 
hurt. Buildings such as the site office should be in the low 
hazard area, but should still be designed to minimize injury. 

The other main control is on movement. There should be 
formal procedures, including a permit system for entry into 
the major hazard area. This permit system should be 
enforced and audited.The procedure should ensure that the 
number of people in the major hazard area is considered and 
that their identity is known at any given time. 

It is particularly important for the system to afford good 
control of situations such as major plant construction and 
modification, in which there may be quite large numbers of 
people in the major hazard area. It should be borne in mind 
that the presence of a large construction team, who are 
relatively unfamiliar with the plant, is in itself a further 
cause of hazard. 


20.20 Security 

Another important aspect of plant operation is security. 
This is treated ^Vandalism (C.Ward, 1973), Introduction to 
Security (G. Green and Farber, 1974) and Industrial Security 
(D.L. Berger, 1979). The Compendium of Fire Safely Data 
(FPA, 1992) contains a section on security precautions (the 
SEC series). Accounts are also given by Hamilton (1967), 
Oliver and Wilson (1972), K.G. Wright (1972), Spranza (1981, 
1982,1991,1992) and Pitt (1987). 

Security systems management is described by Spranza 
as being essentially a blend of traditional security concepts 
and modern management methods. 

The management system should include an explicit 
requirement for a review of the security system. This review 
should cover both hardware and software aspects and 
should involve a critical examination in which problems are 
identified, alternative solutions are generated, and a suit¬ 
able approach is selected and implemented. 

In assessing the security problem the categories of per¬ 
son who need to be considered include employees, visitors 
and intruders; the types of behaviour to be considered 
include innocent actions, theft and malicious acts. 

Central to security is control of access. The security sys¬ 
tem should ensure that unauthorized persons do not have 
access to the site, whether or not they have hostile intent. 
The minimum requirement is a formal pass system that 
covers employees and visitors. There then needs to be phy¬ 
sical arrangements to ensure that access to the site is con¬ 
trolled at all points.This aspect of security is clearly related 
to plant layout and is considered in Chapter 10. The Flix- 
borough Report found that, although in general proper 
attention was paid to security, there were two unguarded 
gates through which it was possible for anyone at anytime 
to gain access to the site. 

In addition, it may be necessary to exercise control of 
access to particular areas within the site. 
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It is also desirable for the operational system to be capable 
of detecting the presence of any unauthorized persons who 
do get onto the plant. The patrolling of the plant by the pro¬ 
cess operators is relevant here. So also are formal arrange¬ 
ments for the limitation of exposure of personnel by the 
control of access to major hazard plant. 

With regard to intruders, there are available various 
devices which maybe used to give warning. Good lighting is 
one obvious feature. Other measures include detectors 
buried in the earth between two fences, heat sensitive 
detectors and closed circuit TV cameras. The use of some 
devices may, however, encounter difficulties on process 
plant, such as those due to heat radiation from the plant 
itself. 

Another basic principle of security is to create conditions 
that assist in the rapid detection of any unauthorized 
deviation. A simple illustration is the maintenance of tidy 
storage of laboratory chemicals, so that a missing item is 
readily detected. But the principle is of much wider appli¬ 
cation. 

Some facilities have their own characteristic problems 
with regard to security. Those of storage are described by 
Pitt (1987). One common defect is access by unauthorized 
vehicles. Other defects occur in drum and cylinder storage, 
where drums are often placed too close to the boundary 
fence and cylinders are left all over the place.The particular 
problems of security in laboratories, also discussed by Pitt, 
are considered in Appendix 9. 

The most difficult security problem is a deliberate attack 
by well trained and organized saboteurs. Defence against 
such an attack is a matter for the military which is outside 
the scope of this book. There are several things, however, 
which can be done to make such an operation more difficult. 
The potentially more vulnerable units can be sited away 
from the periphery and can, to some extent, be designed to 
limit the damage caused by explosives, and an effective 
security system can reduce the amount of material which a 
saboteur can bring in and the time which he can spend on 
his task. 

The security problem is not confined to outsiders, how¬ 
ever; the threat not infrequently comes from the company’s 


own employees. Theft by employees can in some cases pose 
a threat to the plant, particularly where there are high 
priced materials which it may be attractive to steal. The 
sort of incident which occurs and which may have safety 
implications is the theft of sections of copper cabling car¬ 
rying the power supply to electric motors while the plant is 
shut down. 

More serious interference by employees may involve 
sabotage or arson. Arson is one of the causes of fire on pro¬ 
cess plants considered in Chapter 2. The Compendium of 
Fire Safety Data (FPA, 1992) contains an‘arson dossier’ (the 
AR series). Arson is one of the topics dealt with in the NFPA 
Handbook (Cote and Linville, 1986). 

The effective operation of a security system requires that 
all involved are fully trained so that they understand what 
the functions of the system are, how it works, what their 
own role is and how they should discharge it. 

20.21 Notation 

Section 20.3 

C interface concentration (ppm) 

H s heat of solution (cal/gmol) 
k constant 

4> fractional humidity (% relative humidity/100) 

Section 20.14 

d diameter of tank 

F lt F 2 forces defined in Figure 20.2(a) 

£F vector of forces defined in Figures 20.2(b) and 
20.2(c) for positive and negative internal pressures, 
respectively 
p pressure 

r radius of tank 

t thickness of tank wall 

a angle defined in Figure 20.2(a) 

5 width of element in Figure 20.2(a) 
o b bending stress in tank roof 
cr h hoop stress in tank wall 

o s shear stress bet ween tank roof and wall 

</> angle defined in Figure 20.2(a) 
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21.1 Management of Maintenance 

The need for maintenance of equipment implies some 
abnormality and often some change or increase in hazard. 
The conduct of the maintenance work may also introduce 
its own hazards to the equipment. In addition, the main¬ 
tenance activities may be a hazard for the personnel 
involved in them. Careful control of maintenance work 
must be exercised in order to eliminate hazards to the 
equipment and to the personnel. 

The consequences of failure to exercise this control can 
be serious. The Piper Alpha disaster was caused by failures 
in isolation procedures, the permit system and the hand¬ 
over system associated with maintenance work. 

Some work constitutes change rather than maintenance. 
In previous chapters emphasis has been placed on the need 
to maintain the integrity of the equipment. This integrity 
may be degraded by equipment modifications unless they 
are closely controlled. The Flixborough disaster was 
judged to have been caused by a change which reduced 
equipment integrity. 

Thus, both equipment maintenance and equipment 
modification require systems of control with a fairly high 
degree of formality. Equipment maintenance needs to be 
administered through some kind of permit system, while 
equipment modification requires a system to manage 

Maintenance activities are regulated by numerous 
codes, standards and guidelines. Some of which are: 
Occupational Safety & Health Administration (OSHA), 
Environmental Protection Agency (EPA), Department of 
Transportation (DOT), Department of Energy (DOE), 
Nuclear Regulatory Commission (NRC), National Institute 
for Occupational Safety & Health (NIOSH), National Fire 
Protection Association (NFPA), American Society of 
Mechanical Engineers (ASME), American Institute of Che¬ 
mical Engineers (AIChE), National Association of Corrosion 
Engineers (NACE), Institute of Electrical & Electronics 
Engineers (IEEE), International Electrotechnical Commi¬ 
ssion (IEC), American Society of Testing & Materials (ASTM), 
American National Standards Institute (ANSI), National 
Board Inspection Code (NBIC) and American Petroleum 
Institute (API). 

The safe maintenance of process equipment is dealt with 
in Safety in Inspection and Maintenance of Chemical Plant 
(BCISC, 1959/3), Safety and Management (ABCM, 1964/3), 
Permit Systems (CAPITB, 1977 Inf. Pap. 16A), Refining 
Safety Code (IP, 1981MCSP Pt 3), Deadly Maintenance (HSE, 
1985b), Liquefied Petroleum Gas: vol. 1, Large Bulk Pressure 
Storage and Refrigerated LPG (IP, 1987 MCSP Pt 9) (the IP 
LPG Code), Guidance on Permit Systems in the Petroleum 
Industry (01 AC, 1991) (the 01 AC Permit Systems Guide) and 
Maintenance of Process Plant (the IChemE Maintenance 
Guide) (Townsend, 1992). Selected references on equipment 
maintenance are given in Table 21.1. 

21.1.1 Safe systems of work 

The US Occupational Safety and Health Act of 1970 
requires employers to provide a workplace free from recog¬ 
nized hazards that are causing or likely to cause death or 
serious physical harm to employees. Employees are also 
required to comply with Occupational Safety and Health 
Standards (29CFR1910) promulgated under the Act of 1970. 

The requirement of the UK Health and Safety at Work 
Act (HSWA) 1974, for safe systems of work is particularly 


Table 21.1 Selected references on equipment 
maintenance 


Plant maintenance, general (see also Table 7.1) 

NRC (Appendix 28 Maintenance)', NSC (Safe Practice 
Pmphlt 70); L.C. Morrow (1957); F.L Evans (1962); MCA 
(1962-/1-4); J.E. Miller and Blood (1963); H.V Stewart 
(1963); Goldman and Slattery (1964); Newborough (1967); 
Blanchard and Lowery (1969); IMechE (1969/2,1975/19); 
Iron and Steel Institute (1969); J.R. Hughes (1970); HSE 
(HSW Bklt 28); Jardine (1970a,b, 1973); Cunningham and 
Cox (1972); G.H. Mitchell (1972); Gradon (1973); B.J. Lewis 
and Low (1973); D.J. Smith and Babb (1973); E.N. White 
(1973); Clifton (1974); Priel (1974); Elonka (1975); Lees 
(1975); Corder (1976); Husband (1976); Higgins and Morrow 
(1977); A. Kelly and Harris (1978,1983); Nertney (1978); 
Buffa (1980); Worrall and Mert (1980); D.J. Smith (1981, 
1991); API (1982/3); Blackney (1982); Rosaler and Rice 
(1983); Hickman and Moore (1986); A. Kelly (1986); Langley 
(1986); McAlister (1986); G.T. Edwards (1987c); A. Hunt 
(1989); Dunlop (1990); T. A. Henry (1990); Hirata (1990 
LPB 96); File (1991); Parkinson (1991) 

Human factors in, and training for, maintenance 

NRC (Appendix 28 Maintenance Personnel Reliability 
Model)', Landeweerd and Rookmaaker (1980); Nawrocki 
(1981); Spiker, Harper and Hayes (1985); Salvendy 

Terotechnology 

Dol (n.d./l, 1975/2-6,1976/7,1977/8,9); IMechE (1973/6, 
1975/21); Tracht (1964); R.P. Reynolds (1974,1976); 

J. A. Richardson (1976); Berg (1977); Rappini et al. (1977); 
Parkes (1978); K. Lewis (1979); Partington (1980) 

Design-out of maintenance, design for 
maintenance 

Alford (1965); Constable and Parkes (1979); 

Lieberman (1997) 

Plant maintenance, process industries 

BCISC (1959/3); Staniar (1959); Signorini (1961); F.L. Evans 
(1962,1967,1969); Dodds (1963); Roughley (1963); ABCM 
(1964/3); Stratmeyer (1964); Alford (1965); Elgee (1965); 

D. T. Smith (1965b); Verseput (1965); H.R. Carter (1966); 

E. Johnson (1966); Matley (1970); Trotter (1970,1973); Cason 
(1971); Hodnick (1971); Jumper (1971); Virgils (1971); Anon. 
(1972d); Finley (1972,1973,1978,1987); C.F. King and Rudd 
(1972); Nowlan (1972); Chemical Engineering (1973b); 
McCullough (1973); Husband (1974,1976); A. Kelly (1974, 
1980,1981,1986); H.S. Moody (1974); Snyder (1974); 
Warburton (1974); Anon. (1975 LPB 39, p. 8); Anon. (1975 
LPB 4, p. 9); Goyal (1975); Harris and Kelly (1975); Roseman 
(1975); Bosselaar (1976); Husband and Basker (1976); Piper 
(1976); Anon. (1977 LPB 14, p. 2); Balaam (1977); Bellinger 
and Wright (1977); Innes (1977); Mann (1977); Wanner 
(1977); Buttery (1978); A. Davies (1978); R. King and Magid 
(1979); Marre and Reichert (1979); Vargas (1979,1980a,b); 
Chamberlain (1980); Chemical Engineering Staff (1980); 
J.D. Edwards (1980); Iverstine and Sturrock (1980); Schmid 
(1980); Chandler and Brooks (1981); Creaney (1981); 
Hellhake (1981); Seddon and Kelly (1981); Hay (1982); Kirby 
(1982); de Matteis (1982); D.T. Smith (1982); API (Publ. 
2007); Charlton and Huitson (1983); A. Kelly and Harris 
(1983); Wilkie (1985b); Baguley (1986); Langley (1986); 
Wireman, Saletan (1994); ASTM (1986,1996);Tropp (1986); 
Deacon (1988); Riance (1988); T. A. Henry (1990,1993a,b); 
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Hirata (1990); NgTong Leng (1990); Cans, Kohan and 
Palmer (1991); FM Int. (1991a); Godse (1991); Moubray 
(1991); Snow (1991); M. Taylor (1991); Anon. (1992 LPB104, 
p. 12); Crawley (1992 LPB 102); Mundy (1992); Townsend 
(1992); Vouets (1992); S.C. Leonard (1993);Worledge (1993); 
Hulme (1994) 

Contract maintenance 

J.H. Jordan (1968); Sarappo (1969); C.J. Carter (1980); 
Whitaker (1993); API RP 2220 (1991); RP 2221 (1996) 

Life cycle costing, replacement decisions 

Anon. (1961c); Fisher (1963); Munro (1963); J.P. Epstein 
(1967); J.R. Hughes (1970); Maristany (1968); Jelen and Cole 
(1971); Fair (1973,1974); Finley (1973); Anon. (1974f); 
Perkins (1975); Jelen and Yaws (1977); Parkes (1978); 

J.L James (1979); Lees (1983b); Grundfos Pumps (1984); 
Hudson (1997); ASME (1998); Frenning (2001) 

Revalidation, remaining life assessment 

ASME (1980/81,1983/89,1986 PVP112,1987 PVP129,1988 
PVP138,1989 PVP 171,1991B31G); Zeis and 
Eschenbrenner (1980); Baker-Counsell (1987b); 
Grosshandler (1987a); British Gas (1990 Comm. 1438, 
1439); Baas and Warner (1992) 

Computer-based systems 

Eason and White (1977); Beatson (1978); Trotter (1979); 
Redding (1980); McChrystal (1982); Anon. (1987c); 
Grosshandler (1987a); Collington (1989); Anon. (1990b); 
Project Software and Development Inc. (1991); Wireman 
(1994); Mather 

Particular equipment 

Foundations: Renfro (1975,1978,1979); Vick, Witthaus and 
Mayo (1980) 

Gas plant: IGasE (1987IGE/TD/11) 

High pressure equipment: McClelland (1968); Andrews and 
Weber (1993) 

Electrical equipment: Autenriet (1962); Erb (1975); HSE 
(1980 HS(G) 13); NEPA (1990 NFPA 70B); API RP 500 
(1997), RP 505 (1997), RP 540 (1999), Std 546 (1997) 
Piping: McNaughton (1979); Lee (1999); API RP 570 (1998), 
RP 574 (1998), RP 578 (1999), RP 581 (2000), Rp 591 (1998), 
RP 751 (1999) 

Heat exchangers: Yoked (1983); Stegelman and Renfftlen 
(1983); Fijas (1989); Pugh etal. (1993); API RP 510 (1997), 
RP 572 (2001), RP 581 (2000), RP 751 (1999), Std 661 (2002), 
Std 662 (2002) 

Fin Fans: API RP 572 (2001), RP 751 (1999) 

Steam traps: Isles (1977) 

Valves: Kletz (19841); Charbonneau (1985); Irhayem (1985); 
Anon. (1989 LPB 85, p. 1 and 3); Anon. (1989 LPB 87, p. 9); 
Anon. (1992 LPB 103, p. 25 and 29); Anon. (1992 LPB 107, 
p. 27); API RP 591 (1998) 

Heaters: Goyal (1967); Sharp (1977); API 531 (1980), RP 536 
(1998), RP 573 (2003), Std 530 (2003), Std 560 (2001) 
Boilers: API 573 (2003), NB23 
Combustion systems: R. Fletcher (1979) 

Flare stacks: Anon. (1992 LPB 107, p. 23), API 521 (1997) 
Machinery: W.E. Nelson (1974,1980); L.D. Martin,Young 
and Banks (1977); Houghton (1979); Vargas (1982); Murray 
(1983); Parry (1990); Gresh (1992); Rutan (1993): API RP 
686(1996), Std 614 (1999) 

Pumps: Love (1972);Yedidiah (1974,1977); R. James (1976); 
Grundfos Pumps (1984); French (1992); Bitterman (1993); 


Pradhan (1993); API Std 610 (2003), Std 671 (1998), Std 674 
(1995), Std 675 (1994), Std 676 (1994) 

Power transmission: G.W. Howard (1971,1977) 

Pressure relief valves and systems: Lortz (1966);Woolfolk 
and Sanders (1984,1987); J.K. Rogers (1988); Duckworth 
and McGregor (1989); Coulston (1993); API RP 510 (1999), 
RP 520 (2000), RP 521 (1997), RP 576 (2000), RP 751 (1999), 
Std 526 (2002), Std 527 (1991) 

Instrumentation: Sherman (1960); Upfold (1971); Barbin 
(1973); IP (1980 MCSP R14); Hasselbaum (1992); API 553 
(1998), 554 (1995), 555 (2001); ISA 20 (1981) 

Vessels: Megow and Dawson (1977); Snow (1979); 

R.S. Brown (1982); Quraidis (1982); Pritchard (1983); Guth 
and Clark (1985); API RP 510 (1997), RP 572 (2001), RP 579 
(2000), RP 580 (2002), RP 581 (2000), RP 751 (1999), Pub 
939-B (2002) 

Tanks: H.V Bell (1982); Shtayieh (1983a,b): Huston (1983); 
API RP 575 c(1995), RP 2350 (1996), Spec 12D & F (1994), 
Std 620 (2002), Std 650 (1998), Std 653 (2001), Std 2601, Pub 
850 (997), Pub 2026 (1998) 

Compressors: API Sts 617 (2002), Std 618 (1995), Std 619 
(1997), Std 671 (1998), Std 672 (1991), Std 681 (1996) 

Gears: API Std 613 (1995), Std 677 (1997) 

Turbines: API Std 611 (1997), Std 612 (1995), Std 616 (1998) 
Chlorine systems: BCISC (1975/1); Chlorine Institute (1975 
Publ. 41,1981 Publ. 42,1982 Publ. 39) 

LPG systems: LPGLTA (1984 LPG Code 14,1986 LPG 
Code 1, R 3) 

Fire protection equipment: MCA (SG-13); FMEC (1986 
LPB 71); NFPA (1987 NFPA ISA, 1993/33); API 2001 (1998) 
Pipelines: McNaughton (1979); P.M. Scott and Kiefner 
(1984); AGA (1990/69); IGasE (1990IGE/SR/18, IGE/ER/1); 
API RP 2200 (1993), API 1130 (2002) 

Used equipment 

J.P. Epstein (1967,1978); C. Butcher (1992d, 1993a) 

Unused equipment, dead ends 

Anon. (1983 LPB 49, p. 28); Kletz (1989 LPB 87) 

Mothballing 

Twigg (1985); R.G. Miller and King (1987); Savage, Portnoy 
and Parkinson (1988) 

Permit systems 

ROSPA (n.d./l); BCISC (1959/3); ABCM (1964/3); O’Driscoll 
(1965); J.R. Hughes (1970); CAPLTB (1977 Inf. Pap. Suppl. 
16A); IP (1981 MCSP R 3,1987 MCSP R 9,1993 TP 11); Kletz 
(1982f); Anon. (1984 LPB 55, p. 11); HSE (1986 IND(G) 
39(L), 1992 IND(G) 98(L));VC. Marshall (1986b); 
Trowbridge (1987); OIAC (1986,1991); Anon. (1989 LPB 85, 
p. 3); FPA (1989 CFSD GP 3); Anon. (1990 LPB 92, p. 7,10,18 
and 21); Anon. (1990 LPB 93, p. 32 and 35); British Gas 
(1990 BG/PS/G11); Cullen (1990); Anon. (1992 LPB 104, 
p. 5); Anon. (1992 LPB 107, p. 27); S. Scott (1992);Townsend 
(1992); Anon. (1993 LPB 112, p. 20); Butler and Bonsai 
(1993) 

Interlocks 

Anon. (1983 LPB 49, p. 7); ISA 84.01 (1996), 91.00 (2001) 

Maintenance activities 
Bolting: NRC (Appendix 28 Bolts); British Gas (1979 
TIN10); K. Gibson (1986); Bett (1989); Davie (1989); Ritchie 
(1989); Standen (1989); Whalley (1989); Garner (1993) 
Equipment isolation: Anon. (1990 LPB 91, p. 17); Anon. 
(1990 LPB 92, p. 19) 
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Line breaking: BCISC (1959/3) 

Blockage clearing: Anon. (1990 LPB 92, p. 9); Anon. (1991k) 
Lifting, rigging: N.L. Owen (1965); van Amerongen (1968, 
1970); Mallinson (1968); EEMUA (1984 Publ. 101) 
Manholes: Bond (1987 LPB 78) 

Vessel entry, entry into confined spaces: MCA (SG-10, 
1962-/1-4); SMRE (Gas detection 1,2,4,10); BCISC 
(1959/3); ABCM (1964/3); Wareing (1969); DoEm (1971/1); 
Huggett (1973); HSE (1974 TON 46,1975 TON 47,1977 GS 5, 
1991 Construction Sheet 15); Anon. (1975 LPB 3, p. 8); FRS 
(1975 Fire Res. Note 1044); NIOSH (1979 Crit. Doc. 80-106, 
1987 Publ. 87-113); Anon. (1980 LPB 31, p. 11); Burnett 
(1980); Anon. (1983 LPB 53, p. 15); Anon. (1984 LPB 56, 
p. 26); API (1984 Publ. 2217,1987 Publ. 2217A); Bond (1984 
LPB 59); Anon. (1985 LPB 63, p. 31); Kletz (1985b); Keller 
(1987); IGasE (1987IGE/SR/5); Anon. (1988 LPB 81, p. 29); 
Anon. (1991 LPB 98, p. 19); Anon. (1992 LPB 102, p. 27); 
Crawley (1992 LPB 104); NFPA (1993 NFPA 326); Suruda 
etal. (1994); OSH A (1999) 

Tank cleaning, repair and demolition: Anon, (n.d.a); API 
Publ. 2013 (1991), Publ. 2015 (2001), Publ. 2026 (1988), Publ. 
2027 (2002), Publ. 2202 (1991) Std 653; HSE (1970 HSW Bklt 
32,1975 TON 18,1985 CS15); Barrell (1971); Associated 
Octel Co. (1972 Bull. 20,1975); Luckritz and Schwing (1973); 
(1075 Bull. 28), FRS (1975 Fire Res. Note 1044,1977 Fire Res. 
Note 1074); Savage (1975); Fardell and Houghton (1976); 
Amey (1977a, b); A. A. Briggs (1979); Vick, Witthaus and 
Mayo (1980); IP (1989 MCSP Pt 16); Jacob (1990); Moros, 
Howells and Ryall (1993); NFPA (1993 NFPA 327) 

Welding, hot work: AWS (Appendix 28,1976/1,1978/2, 
1992/13); ASTM (STP11,494); IRI (n.d./2); NSC (Safe 
Practice Pmphlt 105); Welding Institute (Appendix 28, 
1981/35,36,1986/38,1991/43); API (1988 Publ. 2009,1991 
RP1107); BCISC (1959/3); Voelker (1965,1973); Sanderson 
(1969); HSE (1970 HSW Bklt 38,1978M15,1979c, 1979 
HS(G) 5, IND(G) 35 (L), 1986 PM 64,1989f); Voelker and 
Zeis (1972); Bales (1977a); A.J.Williams and Mallone (1977); 
Eutectic and Castolin (1979); R. King and Magid (1979); 
Schell and Matlock (1979); Anon. (1980 LPB 32, p. 15); CGA 
(1981 SB-8); AIHA (1984/6,8); Nock (1985); NIOSH (1988 
Crit. Doc. 88-110); FPA (1990 CFSD GP 2); Gregory (1990); 
Balchin (1991 Welding Institute/12); Stippick (1992); ANSI 
Z49.1-1988; BS (Appendix 27 Welding) 

Onstream repairs: API (1978 Publ. 2209); Bloom and 
Pebworth (1979); G.W. Harrison (1980); Anon. (1981); 
Pennington (1992); API RP 2009 (2002) 

Leak repair: Hutton (1973); Stroud (1981); Bareness (1982); 
Maushagen (1984 LPB 55); Anon. (1986n); Bond (1986 LPB 
69); J.K Rogers (1988) 

Hot tapping: Hahn, Brownlee and Thompson (1969); 
de Hertogh and Illeghems (1974); Britt (1975); Elder and 
Batten (1975); Hahn (1975); W.B. Howard (1975a); Howden 
(1975); Letchford (1975); Warren (1975a); API (1985 Publ. 
2201,1991/19); AGA (1988/57,1989/61) 

Cleaning with water, chemicals: C.T. Fox (1967); Engle 
(1971); Loucks (1973);Vanmatre (1977); Roebuck (1978); 
Anon. (1980 LPB 35, p. 7); Anon. (1981 LPB 38, p. 23); 
Shorthouse (1983); Hyde (1985); Donaldson (1986); HSE 
(1988 PM 29); Junique (1988); J.O. Robinson (1993) 
Cleaning in place: Kirkland (1986); Someah (1992) 

Water jetting: High Pressure Water Jetting Contractors 
(1982) 

Decontamination: Dransfield and Greig (1982); EEMUA 
(1989 Publ. 154) 


Maintenance equipment 

HSE (Appendix 28 GS, PM series) 

Tools: EEUA (1958 Doc. 4); Anon. (1962e); IGasE (1970/9); 
FPA (1975 Sll); Kletz (1977i); HSE (1978 PM 14,1990 PM 32); 
R. King and Magid (1979); Anon. (1984J); API (1989 Publ. 
2214) 

Lifting equipment: ICI/RoSPA (IS/102); SMRE 
(Engineering Metallurgy 2,3,5); Bates (1992); BS 
(Appendix 27 Lifting Equipment) 

Scaffolding: DoEm (1974/5); Anon. (1989 LPB 89, p. 9 and 
18); BS 5973:1990 

Cranes: RoSPA (IS/29); HSE (1973 TON 26,1974 TON 27, 
1976 PM 3,1979 PM 9,1980/11,1985/17); Aitken (1987); BS 
(Appendix 27 Cranes), BS COP 3010:1972 
Forklift trucks, power trucks: MCA (SG-6); RoSPA (IS/38; 
Rochester (1969); Partridge (1977); HSE (1979 HS(G) 6); 
NFPA (1992 NFPA 505) 

Engine-driven equipment: API (1987 Publ. 2203) 

Robots: Collins (1982); IMechE (1982/62);T.J.Williams 
(1983); Siddle (1986b); R.M. Taylor and Lewis (1987); HSE 
(1988 HS(G) 43); NIOSH (1988 Publ. 88-108); Mitler (1989) 

Maintenance hazards 

HSE (1985 PML 7,1985/16,1987/20,1992 HA 1,1992/30); 
API 750 (1990), 751 (1999), 752 (1995) 

Construction, demolition 

Construction: HSE (HSW Bklts 6A-6F, 1983 GS 24,1984 
GS 28,1985 GS 33, IND(G) 30(L), 1991 Construction Sheet 
15, GS 6); Hayward (1969); Oil and Chemical Plant 
Constructors Association (1974); National Federation of 
Building Trades Employers (1975); RoSPA (1975IS/13); 

ES 6187:1982 

Construction equipment: HSE (1981 PM 27,28,1982 GS 15, 
1983 PM 30,1984 GS 31,1987 G5 42) 

Demolition: Stuart (1974); Oberhansberg (1977); HSE (1989 
GS 29); Anon. (1992 LPB 104, p. 10); BS 6187:1982 

Construction, demolition hazards 

HSE (1981/2) 


relevant to the maintenance of process equipment, where 
there are many jobs which involve degree of potential 
hazard, but which can be done safely provided proper 
control is exercised. It is also characteristic of mainte¬ 
nance that it often involves quite a large number of people 
and that systems to ensure good communications are 
important. 

Basic elements of the overall safe system of work are: 
equipment documentation - written procedures for non¬ 
trivial tasks; permit and handover systems; systems for 
control of a large workforce and for dealing with con¬ 
tractors and supervision and training. 

21.1.2 Equipment documentation 

Critical information on all equipment must be documented 
so the design basis, operating parameters and materials 
of construction are known. The primary document is a 
piping and instrument diagram for mechanical equipment 
and electrical one-line diagrams for electrical equipment. 
Various other sources like equipment specification sheets, 
equipment drawings, instrument loop diagrams, pump 
curves, relief system design, safety system documen¬ 
tation and material certifications will provide detailed 
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information. The documentation must be kept accurate and 
up to date. 

21.1.3 Maintenance procedures 

Any regular maintenance task which is non-trivial should 
be governed by a formal written procedure. This procedure 
should address the specific task and should complement 
the general permit and handover systems described 
below. In particular, there should be formal procedures 
for the installation and removal of slip blinds and blind 
flanges. The principles underlying the writing of operating 
procedures are applicable in large part to maintenance 
procedures also. 

21.1.4 Permit system 

Maintenance work should be governed by a formal permit 
system. The purposes of such a system are: to see that 
proper consideration is given to the job, its hazards and the 
precautions required; to ensure that these are understood 
by all persons involved; and to facilitate effective commu¬ 
nication between the parties concerned. 

The permit system is intimately bound up with the 
hazards of maintenance and with the various preparations 
and precautions required to make a plant safe for main¬ 
tenance work. These are therefore described first and the 
permit thereafter in Section 21.8. 

21.1.5 Handover system 

The permit system should be complemented by formal 
shift handover procedures. These procedures are described 
in Chapter 20 with particular reference to handover between 
operators, but essentially similar considerations apply to 
the maintenance function. 

21.1.6 Control of workforce 

The workforce involved in maintenance and related work 
may he quite large and varied. The core maintenance 
workforce of company employees may be supplemented by 
contractors working on routine maintenance and on 
equipment testing and recertification. In addition to the 
workforce thus engaged, there may well be extended peri¬ 
ods when other plant modification or expansion work is 
going on involving a considerable number of people. All 
this work needs to be controlled through the permit system. 
The need to exercise control may in some cases set a limit 
on the volume of work which can be undertaken. 

21.1.7 Contractors 

A portion of the workforce engaged in maintenance work 
may be contractors. The trend in recent years has been 
towards increasing use of contractors, not only on con¬ 
struction work but also on more routine jobs such as 
equipment testing and recertification. The reasons for the 
use of contract maintenance are discussed by C.J. Carter 
(1980) and the identification and control of contractor 
hazards are described by Whitaker (1993). 

There should be a system of quality assurance for work 
to be bid out. It is normal to require the contractor to pro¬ 
vide evidence of the quality and safety of his work, super¬ 
vision and training, and of his own quality assurance and 
safety procedures. The OSHA process safety management 
standard requires employers to obtain and evaluate infor¬ 
mation regarding contractor’s safety performance and 
programmes. The standard defines employer and contrac¬ 
tor responsibilities. A sample contractor pre-qualification 


form was jointly created by the Chemical Manufacturers 
Association (CM A) and the API. 

In some cases a contractor’s personnel may work on a site 
for years on end and become as familiar with the systems 
as company personnel, but in others they may be there for 
quite a short time. In any event, it is necessary that before 
new personnel from a contractor start work they are prop¬ 
erly trained in these systems. Contractor safety orienta¬ 
tions should be held for all contract employees highlighting 
the plant safety requirements and hazards. 

The need for this was highlighted by the Piper Alpha 
disaster, where a two-man team of contractors was carrying 
out testing and recertification work on pressure relief 
valves on the platform, but the senior of the two was on his 
first tour as supervisor and had not received adequate 
instruction in the permit system. 

21.1.8 Supervision and training 

It will be evident that supervision and training are essen¬ 
tial in ensuring that maintenance work is done safely. The 
permit and handover systems provide a structure for the 
supervision of maintenance work, but by no means exhaust 
the contribution of supervision. 

With regard to training, maintenance personnel should 
be trained not only in their own craft, but also in the 
hazards of the chemicals and the equipment, the jobs which 
they do such as isolation and vessel entry, in the permit 
and handover systems, and in making the distinction 
between a routine maintenance task and a modification. 
The training of maintenance personnel is considered 
further in Chapter 27. 

21.2 Hazards of Maintenance 

As already stated, maintenance work on process equipment 
involves a number of hazards. An account of maintenance 
hazards and accidents is given in Deadly Maintenance the 
(HSE, 1985b), Dangerous Maintenance (HSE, 1987a) and 
HS(G) 49 Human Factors in Industrial Safety (HSE, 1989) 
and by Deacon (1988). 

The first of these is a study by the Accident Prevention 
Advisory Unit (APAU) of the Health and Safety Executive 
(HSE) of maintenance accidents in British industry dur¬ 
ing the period 1980-82. In this period, there were over 
100 deaths per year caused by maintenance work, and over 
the 3-year period there were a total of 106 deaths (33%) 
associated with the maintenance of equipment and 
machinery. The fatalities were assigned to the following 
categories: breakdown and scheduled maintenance work, 
66%; cleaning, 25%; and examination, lubrication, paint¬ 
ing, 9%. A feature of these statistics is the prominence of 
accidents in cleaning. 

Although maintenance craftsmen comprised the largest 
single category of deaths (37 %), fatalities to operators were 
almost as numerous (33%). Other groups included labour¬ 
ers (7%), service engineers (6%), and managers, super¬ 
visors and proprietors (13%). The relatively large number 
of deaths among operators is accounted for only in part by 
cleaning operations. 

The accidents were classified by equipment type, acci¬ 
dent type and major cause. There were 66 accidents 
assigned to identified categories of machinery and 32 to 
identified categories of equipment, the balance of 8 being 
assigned to machinery and equipment in general. Of the 
machinery accidents, 23 were caused by conveyors and 
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elevators, but few of the others identify process machinery. 
The breakdown of plant accidents is: storage tanks, 7; fur¬ 
naces and associated equipment, 6; boilers, heating and 
ventilation equipment, 5; chemical, gas, oil, process 
equipment, 5; dust or fume extraction equipment, 5; and 
degreasing equipment 4. 

The classification by accident type is: machinery, 50, of 
which 17 involved entanglement and the rest some form of 
crushing; falls, 21; burns, 10; gassing, 9; electrocution, 
6; asphyxiation, 5; and struck by falling materials or 
equipment, 5. 

By major cause, the classification is: absence or failure of 
system of work, 35; absent or defective equipment, guards 
or working platforms, 23; failure of management organi¬ 
zation or supervision, 11; inadequate or lack of training, 
instruction or information, 8; human error, 10; unauthor¬ 
ized activity, 5; defective design of equipment or machin¬ 
ery, 5; and unknown or unforeseeable incident, 9. 

The authors present three case studies of generic types 
of accident, associated with (1) conveyors and elevators, 
(2) overhead travelling cranes and (3) confined spaces. 

The APAU publication also contains some 99 case his¬ 
tories of accidents in maintenance work. Other specialized 
collections include Safety in Maintenance (API, 1981 Safety 
Digest 4) and that given by Kletz (1982f), whose other work 
is also replete with maintenance case histories. Complete 
maintenance work also features strongly in many general 
collections of case histories. 

Confined spaces present a number of hazards, and these 
are described in Section 21.7. Other hazards are mentioned 
throughout this chapter. 


21.3 Preparation for Maintenance 

There are a number of preparatory measures which may 
need to be taken before maintenance work is started. The 
principal means of control of such work is the permit sys¬ 
tem. The preparatory measures to be taken should be spe¬ 
cified on the permit. 

Many of these measures are aimed at allowing work 
inside equipment to be done safely. If work is to be done 
internally on an item of equipment, it should be prepared by 
the following operations: (1) depressurization, (2) cooling 
down, (3) isolation, (4) removal of contents (gas, liquid, 
solids) and (5) cleaning. 


21.3.1 Identification of equipment 

Many incidents occur on process equipment due to errors in 
the identification of the equipment on which work is 
required. Plants can often seem a confusing maze of vessels 
and piping, much of it lagged, and it is often difficult to 
identify equipment unaided simply by tracing the course of 
piping or by the use of other clues. This point has already 
been made in Chapter 14 in relation to the work of the pro¬ 
cess operator. It is necessary, therefore, to adopt a more 
positive policy for the identification of equipment. 

One method which may be used is to attach a permanent 
identification to a particular equipment. This is an effective 
system provided precautions are taken against certain 
types of error which can occur. 

There are certain standards and codes of practice for the 
identification of equipment. In particular, mention may be 
made of BS 1710: 1984 Specification for Identification of 
Pipelines and Services. 


Identification should be consistent and should agree 
with reasonable expectations. It is asking for trouble to 
number equipment unsequentially, when it forms a natural 
sequence, such as pumps in parallel or reactors in series. 
Another situation to be avoided is ambiguity as to which of 
two adjacent pieces of equipment an identifier refers to. 

Much maintenance work involves breaking into pipe 
joints. Permanent identifiers are not as suitable in this case. 
An identification tag can be used. 

The identification of pipe joints is particularly impor¬ 
tant, because incidents are frequent in which the wrong 
joint is broken. Many such occurrences could be avoided by 
a positive system in which the identification tag is put on 
the joint to be broken. 

For the type of work described, a permit is required. The 
identification of the equipment, whether permanent or tem¬ 
porary, should be given on the permit form. Awalk down by 
the operator issuing the permit and the maintenance 
technicians to physically locate the equipment is beneficial. 

The system described is not foolproof, of course. The 
person putting the identification tag on the equipment can 
make a mistake. But, in general, it does appear to be an 
effective system in practice. 

The use of the identification tag system is preferable to 
merely pointing out to the maintenance fitter the equip¬ 
ment to be repaired. Incidents have occurred which suggest 
that this is not always adequate. 

21.3.2 Depressurization 

If the equipment contains liquid heated above its boiling 
point under pressure, it may be necessary to let it cool down 
prior to depressurization in order to avoid excessive flash- 
off. Depressurization should be performed in accordance 
with the design intent. For flammable or toxic gases this 
should preferably be to another part of the process. Alter¬ 
natively, it may be to flare, to a scrubber system, or in some 
cases to the atmosphere. For inert gases venting is often to a 
vent stack or vent pipe. 

21.3.3 Cooling 

If the equipment has not already been cooled down suffi¬ 
ciently prior to depressurization, it should now be cooled 
down. Cooling involves the hazard of vacuum collapse. This 
may be guarded against by inert gas injection to maintain 
the internal pressure at atmospheric pressure. 

21.3.4 Isolation 

When the equipment has cooled down, the equipment to be 
worked on should be isolated. This includes isolation of 
vessels and piping from process and utilities, isolation of 
machinery from its power sources (electric, hydraulic, 
pneumatic) and isolation of electrical equipment. Isolation 
is crucial both to the safety of the equipment and to that of 
the personnel. It is considered in detail in Section 21.4. 

21.3.5 Emptying of liquids 

Once the equipment has been isolated, the next step is to 
remove its contents. If it contains liquid, this is usually 
pumped away to another part of the equipment or to storage, 
or, if non-hazardous, to drain. The liquid may leave behind 
hazardous residues, which are considered inSection 21.3.7. 

21.3.6 Gas freeing 

If the contents of the equipment are gas or vapour, there are 
a number of methods of gas freeing which may be used to 
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replace them with air. These methods include (1) forced 
ventilation, (2) flushing with water and forced ventilation, 
(3) purging, (4) steaming and (5) chemical cleaning. 

Equipment often contain flammable or toxic residues. If 
these are sufficiently volatile, they may constitute a con¬ 
tinuous source of contamination. 

The choice of method of gas freeing depends on the type 
of equipment, on its initial contents, including residues, 
and on the work to be done. Where steaming is used for 
cleaning, gas freeing occurs at the same time. 

Purging is discussed in Section 21.5. Other methods of 
gas freeing are described in relation to tank cleaning in 
Section 21.12. An account of the gas freeing of crude oil 
storage tanks is given by Moros, Howells and Ryall (1993). 

21.3.7 Removal of solids 

Solid process materials include raw materials and final 
products, and catalysts and adsorbents. Raw materials are 
often removed by continuing to run the process until they 
are exhausted. Products, catalysts and adsorbents are 
generally transferred to suitable containers. 

There are a number of hazards associated with solid 
process materials which need to be guarded against. Solid 
materials may be flammable, toxic or pyrophoric. Flam¬ 
mable dusts may give rise to a dust explosion. Adsorbents 
may give off flammable or toxic material, and in some cases 
ignite spontaneously in the presence of air. 

The other type of solid is residues in the form of deposits 
and sludge. These also may be flammable or toxic. It is 
generally necessary to remove these by cleaning, although 
for certain activities there may be alternative sale methods 
of working, as described below. 

A particular pyrophoric material often encountered in 
refinery processes is iron sulfide. If dry, this will burst into 
flames on contact with air, but if wet it is harmless. It may 
be dealt with by injecting inert gas and soaking the iron 
sulfide with water. 

Oil soaked insulation, removed while it is still hot, can 
behave like a pyrophoric material and burst into flames on 
contact with air. 

21.3.8 Cleaning 

There are a number of methods available for cleaning. The 
choice of method of cleaning depends on the type of 
equipment, on its initial contents, including residues, and 
on the work to be done. The methods are described in 
Section 21.6. 

21.4 Isolation 

As already described, much maintenance work is subject to 
potential hazards from noxious materials, energy sources, 
rotating equipment and electrical power. Where work is to 
be done, the necessary isolations should be made to ensure 
that it can be done safely. Accounts of isolation are given in 
the IP Refining Safety Code , the IP LPG Code , the OIAC 
Permit Systems Code, the IChemE Maintenance Guide and 
by Kletz (1982f). 

Isolation is governed by OSHA standards 1910.147 The 
Control of Hazardous Energy (Lockout/tagout) and 1910.146 
Permit Required Confined Spaces. Isolation may be required 
prior to installation, inspection, repair, cleaning or dis¬ 
mantling. Where a job involves isolation of equipment, there 
should always be a permit for the job. Permit systems are 
described in Section 21.8. 


21.4.1 Isolation of vessels and pipes 

The methods available for isolating a vessel or pipe are, in 
ascending order of effectiveness, the use of (1) a closed and 
locked valve, or valves, (2) a double block and bleed valve 
system, (3) a blind and (4) physical disconnection. 

The least effective of these methods of isolation is the use 
of a closed and locked isolation valve. There have been 
numerous incidents in which either the valve has corroded 
or jammed and has passed fluid or it has been opened in 
error. Even two isolation valves in series do not always 
prevent the passage of fluid. 

More positive isolation is obtained by the use of a double 
block and bleed valve system as shown in Figure 21.1(c) 
The two block valves are closed, the bleed valve is open and 
all three are locked. If the fluid passes through the first 
block valve, it is vented by the bleed valve so that no pres¬ 
sure should build up which would allow the material to pass 
through the second block valve. A build-up of pressure can 
occur if the bleed line is too small or too long, or if it dis¬ 
charges into a vent system in which there may be a back 
pressure. 

As shown in Figure 21.1(a), isolation may be accom¬ 
plished by the insertion into the line of a slip blind. In the 
system shown, the valve is first closed and locked and the 
slip blind is then inserted. If a spacer blind or figure 8 blind 
is installed, it may be used instead of a slip blind. 

The most positive method of all, shown in Figure 21.1(b), 
is complete physical disconnection of the line, with a blind 
flange, or blank, put on the ‘live’ line. 

Where isolation is by means of a closed valve, this should 
be an isolation valve rather than a control valve, unless the 
latter can be tightly shut, disconnected from any power 
source, locked in the closed position and the isolation tested 
as being effective. 

Isolation valves should be locked and tagged. The pre¬ 
ferred arrangement is a valve which can be locked with a 
captive key system or which has lugs for padlocking. The 
alternative is the use of a chain and padlock. A tag should be 
securely attached to the valve, stating whether it is locked in 
the open or closed position and prohibiting unauthorized 
movement of it, and showing the equipment identification 
number, the isolation lock number and the isolation permit 
number. 

On systems containing hazardous fluids such as hydro¬ 
carbons under pressure, the arrangements for closing off 
the end of a line with a blind flange should ensure that the 
joint is leak tight. The fixed flange and the blind flange 
should be inspected for deterioration, a ring-joint blank 
should be fitted with a new ring and the bolts should be 
properly tightened. 

The blind used should be strong enough to withstand the 
highest pressure which may occur in the main if the shut¬ 
off valves are opened accidentally. The blind must be thick 
enough to withstand hydrotest pressure if the system iso¬ 
lated has to be hydrotested. Each blind should have an 
identification tag. 

Where there is to be work on a pressurized hydrocarbon 
system or entry into a vessel, physical disconnection is the 
recommended method of isolation. If this method is not 
reasonably practicable, the next best method is the inser¬ 
tion of a blind. 

The closed and locked isolation valve method should be 
used only for the isolation of low hazard fluids. Another 
principal use is to effect preliminary isolation while a blind 
is inserted. 
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Figure 21.1 Some methods of isolation of piping - 1: (a) locked valve with slip blind; (b) locked valve with blind 
flange and with section removed; (c) locked double block and bleed valves 


The double block and bleed system is more effective 
than a closed isolation valve and is used for more hazar¬ 
dous fluids. It does not, however, provide adequate isola¬ 
tion for long periods. This method also finds a principal 
use in effecting preliminary isolation while a slip plate is 
inserted. 

Figure 21.2 shows the methods of isolation given in the 
IChemE Maintenance Guide. In addition, there are certain 
preferred arrangements for isolation in specific cases. For 
entry into a vessel or confined space, isolation should be by 
physical disconnection. 

For the isolation of relief valves and vent lines, physical 
disconnection is again the preferred method. Where this is 
not possible, the relief valve or vent line should be blinded 
off first and deblinded last. 

The need should be considered for isolation of drains and 
sewers through which hazardous materials may spread to 
other sections of the plant. 

The equipment should be designed to facilitate isolation, 
particularly at points where isolations are likely to he 
frequent. A pressure gauge and drain point can be pro¬ 
vided downstream of an isolation valve which is used to 
provide preliminary isolation for the insertion of a blind. 
A double block and bleed valve system can be installed to 
provide more positive isolation for the same purpose. 


Spectacle blinds can be provided. All critical valves should 
be identified with a permanent marking. 

There should be a system for the identification and con¬ 
trol of blinds and blind flanges for different duties. The 
system should ensure that blinds are correctly identified 
and that they do not become mixed up. It should also ensure 
that blinds are neither left in when they should be taken out 
nor left out when they should be inserted. For equipments 
where a number of blinds need to be inserted for isolation, it 
is helpful to have a blind list and a diagram showing the 
insertion points. Permanent blinds should also be labelled 
and shown on P&IDs. 

21.4.2 Isolation of machinery 

Where work is to be done on powered machinery, the source 
of power should first be isolated. Sources of power include 
electrical, hydraulic and pneumatic power, and engines. 

A hydraulic or pneumatic supply should be isolated as 
follows. First, preliminary isolation should be completed 
by closing a valve. Then the supply and return pipes should 
be disconnected, or otherwise made safe. The isolation of 
electrical supplies is described below. 

Isolation of an engine-driven system should be done by 
shutting off the engine fuel supply and then isolating and 
disconnecting all starting systems. 
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Figure 21.2 Some methods of isolation of piping - 2 (Townsend, 1992) (Courtesy of the Institution of Chemical 
Engineers) 


It may sometimes be possible for the machinery to move 
even though it is disconnected from its power source, and in 
such cases it should be secured to prevent such movement. 

A lockout/tagout system should be used based on 
principles similar to that for the isolation of equipment. 

21.4.3 Isolation of electrical equipment 

Electrical isolation may be required either to immobilize 
machinery or to protect personnel working on electrical 
equipment. 

Situations involving electrical isolation include work on 
powered equipment, including rotating machinery and 


machinery with moving parts, and entry into vessels which 
contain stirrers or agitators. 

Where isolation of fluids is required, electrical isolation 
should be a complement to, but not a substitute for, 
mechanical isolation. 

OSHA standards 1910.147 and Subpart S, govern main¬ 
tenance work on electrical systems. The isolation of elec¬ 
trical equipment is governed by the UK Electricity at Work 
Regulations 1989 and advice is given in the associated 
Memorandum of Guidance (HSE, 1989 HS(R) 25). Electrical 
isolation should be performed only by an electrically 
competent person. 
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Two methods of isolating electrical equipment are to 
withdraw the fuses and to lock-out the breaker. There is 
evidently some difference of view on the merits of the two 
methods. Some references describe systems based pri¬ 
marily on breaker lock-out. The IChemE Maintenance 
Guide describes fuse withdrawal as suitable where breaker 
lock-out is not available, as with instruments, heaters, 
lighting circuits. Anon. (1983 LPB 49, p. 7) argues that a 
fuse is always liable to be replaced. On the other hand, Kletz 
(1982f) states that experience has shown that breaker lock¬ 
out is not always effective. He recommends fuse with¬ 
drawal where the work to be done is on electrical circuitry. 
A system of electrical isolation based on breaker lock-out is 
described by Anon. (1983 LPB 49, p.7). 

A lock-out device is a mechanism or arrangement which 
allows the use of key operated padlocks to hold a switch 
lever or handle in the ‘off’ position. The lock-out procedure is 
to switch off or de-energize electric power, lock-out, tagout 
and confirm lock-out by checking that the equipment will not 
restart. The lock-out should be applied to the breaker or 
disconnect switch itself and not to some remote stop/start 
button, selector switch or interlock. Where there is more 
than one power source, all should be locked out and tagged. 

The lock-out system is as follows. For operations, each 
padlock should be issued through the operations foreman 
and should he capable of being opened only by the one key 
issued with it. There should be a lock-out log for recording 
the identification of the locked-out equipment, the date and 
time of application of the padlock and the operator apply¬ 
ing it, and the date and time of its removal and the operator 
removing it. The maintenance craftsman applies his own 
lock to the breaker before starting work and removes it 
when they are finished. Where the equipment is to be 
worked on by several crafts, each craftsman applies this 
procedure. If a shift change occurs, the outgoing craftsman 
removes his lock and the relieving one applies his own lock. 
When the job is complete, the last lock to be removed is that 
of the operator. 

With regard to the isolation of electrical systems, to pro¬ 
tect personnel working on or near them, guidance is given 
in the relevant OSHA standards, API recommended prac¬ 
tices and British Standards. 

All items of electrical equipment should have permanent 
labels, and their separate parts should be identifiable. For 
a prime mover, the IChemE Guide gives these as the drive 
unit, the breaker/disconnect and the stop/start button. 
A system of warning tags should also be used. 


21.5 Purging 

Purging involves replacing one gas or vapour with another. 
It is performed for a variety of purposes and using a num¬ 
ber of different purging media. Guidance on purging is 
given in Purging Principles and Practice (AGA, 1975) (the 
AGA Purging Guide). Further accounts of purging are 
given in the IP Refining Safety Code, CS15 (HSE, 1985), the 
IP LPG Code, the IChemE Maintenance Guide, and by Kletz 
(1982f). 

Purging may be used to take a unit out of service by 
replacing flammable or toxic process gas with an inert 
medium and then with air. It may be used to bring a unit 
back into service by replacing air with an inert medium and 
then with the process gas. 

The AGA Purging Guide gives purging end-points for a 
number of different cases. The end-point data cover two 


purge gases: nitrogen and carbon dioxide. Values are 
quoted for the concentration which will just render a 
mixture non-flammable and for that which allows a 20% 
‘safety factor’. Selected purge end-points taken from the 
guide, are shown in Table 21.2. Section A gives inert gas 
end-points for purging into service (i.e. purging air out of a 
system subsequently to be filled with flammable gas), 
together with an alternative set of oxygen end-points which 
may be more convenient to use. Section B of the table gives 
inert gas end-points for purging out of service (i.e. purging 
flammable gas out of a system subsequently to be filled 
with air), together with an alternative, and often more 
convenient, set of combustible gas end-points. The values 
given without brackets are the concentrations required to 
just render the mixture non-flammable, while those in 
brackets give the 20% safety factor. 

Further details of the purging of equipment prior to 
entry or hot work, including sources of purge gas, purge 
end-points and precautions, are given in Section 21.12. The 
purging of refinery units is described in Chapter 20. 

21.6 Cleaning 

There is a wide variety of methods of cleaning equipment. 
They include (1) water washing, (2) chemical cleaning, 
(3) steaming, (4) water jetting, (5) solvent jetting, (6) shot 
blasting and (7) manual cleaning. 

The choice of cleaning method depends on the type of 
equipment and on the nature of the material to be cleaned 
out. Most of these methods are described in CS 15 and/or 
the IChemE Maintenance Guide. 

Some methods of cleaning are now described. Further 
details of cleaning of tanks prior to entry or hot work are 
given in Section 21.12. 

21.6.1 Water washing 

In some instances, adequate cleaning may be obtained by 
flushing with water. In most cases, however, something 
more is required. 

Washing with cold water, or even purging with air, have 
sometimes been used in an attempt to remove oil, but these 
are generally not effective methods for this purpose and 
reliance on them has been the cause of many accidents. 

Another process, also referred to as water washing, 
comprises immersion of the article in a boiling aqueous 
caustic or detergent solution. This may be used for small 
equipment which can be completely immersed. It is neces¬ 
sary to select the cleaning agent so as to avoid chemical 
attack, to exclude air and to boil for at least 30 min. 

Another form of water washing is the use of a high 
pressure jet of hot detergent solution directed onto the 
interior surfaces. This latter method is used in combination 
with steaming to clean drums. 

21.6.2 Chemical cleaning 

Equipment may be cleaned by chemical cleaning using 
special chemicals. Surfactants can be used as a general 
cleaning agent. Some forms entrain hydrocarbon. Chemi¬ 
cals such as acids can be circulated through equipment to 
clean the system. All chemical cleaning solutions and 
by-products must be disposed of properly. 

21.6.3 Steaming 

Steam cleaning is used particularly for fixed and mobile 
equipment. The basic procedures is as follows. Steam is 
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Table 21.2 Selected end-points for purging (after 
American Gas Association, 1975) 


A Inert gas and oxygen end-points for purging 

Gas 

Concentration of gas to render 


mixture n< 

on-flammable (% v/v) a 


Nitrogen 

Oxygen 

Hydrogen 

71 (77) 

5.0 (4.0) 

Methane 

36(49) 

12.1 (9.7) 

Propane 

42(54) 

11.4(9.1) 

Butane 

40(52) 

12.1 (9.7) 

Ethylene 

49(59) 

10.0(8.0) 

Propylene 

42(54) 

11.5(9.2) 

B Inert gas and combustible gas end-points for 

purging out of service 


Gas 

Concentration of gas to render 
mixture non-flammable (% v/v) a 


Nitrogen 

Combustible gas 

Hydrogen 

95(96) 

5(4) 

Methane 

86(89) 

14(11) 

Propane 

94(95) 

6(5) 

Butane 

95(96) 

5(4) 

Ethylene 

94(95) 

6(5) 

Propylene 

96(97) 

4(3) 

a Values witl 

lout brackets are the conce 

nitrations to just render the 

mixture nor 

i-flammable, those in brackets are the concentrations 

which give a 

20% safety factor. 



added to the equipment, taking care that no excess pressure 
develops which could damage it. Condensate should be 
drained from the lowest possible point, taking with it the 
residues. The temperature reached by the equipment walls 
should be sufficient to ensure removal of the residues. A 
steam pressure of 30 psig (2 barg) is generally sufficient, 
and this temperature is held for a minimum of 30 min. 
The progress of the cleaning may be monitored by the oil 
content of the condensate. 

There are a number of precautions to minimize the risk 
from static electricity. There should be no insulated con¬ 
ductors inside the equipment. The steam hose and equip¬ 
ment should be bonded together and well grounded; it is 
desirable that the steam nozzle have its own separate 
ground. The nozzle should be blown clear of water droplets 
prior to use. The steam used should be dry as it leaves the 
nozzle; wet steam should not be used, as it can generate 
static electricity even in small equipment, but high super¬ 
heat should also be avoided, as it may damage equipment 
and even cause ignition. The velocity of the steam should 
initially be low, though it may be increased as the air in the 
equipment is displaced. Personnel should wear conducting 
footwear. 

Consideration should be given to other effects of steam¬ 
ing. One is the thermal expansion of the equipment which 
may put stress on associated piping. Another is the vacuum 
that occurs when the equipment cools again. Equipment 
openings should be sufficient to prevent the development of 
a damaging vacuum. 


Truck tankers and rail tank cars may be cleaned by 
steaming in a similar manner. Steaming may also be 
used for large tanks, but in this case the supplies of 
steam required can be very large. There is also the hazard 
of static electricity, and in some companies it is policy 
for this reason not to permit steam cleaning of large 
storage tanks which have contained volatile flammable 
liquids. 

21.6.4 Water jetting 

Another method of cleaning is high pressure water jetting. 
A high pressure water jet can cut through most metals and 
polymers and can clean a surface of paint or deposits. 
Accounts of water jetting are given by Donaldson (1986) 
and Jacob (1990). The relevant code is Code of Practice for the 
Use of High Pressure Water Jetting Equipment (High Pres¬ 
sure Water Jetting Contractors, 1982). 

The technique is widely used for a variety of purposes, 
varying from the cleaning of buildings, roads and drains to 
the removal of spalled concrete. It is now being increasingly 
used in the process industries. One application is the removal 
of deposits from equipment such as heat exchangers and 
tanks. Another is the cutting of metal, which is used for the 
cutting up structural steel, equipment and piping during 
demolition. 

In water jetting, the jet is held quite close to the sur¬ 
face, about 3-4 in. (75-100 mm). A water jet can remove 
material from a surface if the energy transferred per unit 
area exceeds a threshold value which is characteristic of 
the material. Since the energy is a function of the jet velo¬ 
city and this in turn is a function of the pressure, this 
threshold energy can be specified in terms of the nozzle 
pressure for typical practical flows. The pressures used in 
water jetting have risen from about 3000 psi (200 bar) 
through 15,000 psi (1000 bar) and are now up to 30,000 psi 
(2000 bar). 

A 30,000 psi (2000 bar) jet may operate with a flow as low 
as 2.5 gpm (101/min). At this flow, the reaction force is of the 
order of 33 lbf (15 kgf), which is manageable for an operator. 
A maximum recommended value is 1055 lbf (25 kgf). The 
cutting rate is controlled by adjusting the flow rather than 
the nozzle pressure and any increase in flow results in an 
increase in reaction force. One hazard of water jetting is the 
loss of control of the jet. Numerous incidents have occurred 
where water jet operators have injured themselves with the 
high pressure water. 

Another potential hazard is the aerosol produced, which 
can be harmful, depending on the material involved. The 
use of protective clothing is necessary. 

In addition to manual cleaning operations, water jetting 
is used in fixed systems for cleaning tanks and vessels. A 
typical arrangement is a set of four jets set at right angles to 
each other on the same plane and mounted on a head which 
itself rotates to give coverage in all directions. In such 
equipment cleaning applications, the travel distance for the 
jets is much greater, and their removing power corre¬ 
spondingly less. 

Static electricity hazard can be a hazard in water jetting. 

21.6.5 Solvent jetting 

Another method used for cleaning is high pressure sol¬ 
vent jetting, with recirculation of the solvent. The 
method is promoted for difficult residues. The solvents 
used are flammable and create a flammable atmosphere 
inside the equipment. It is necessary to take precautions 
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against static electricity and to undertake gas freeing 
afterwards. 

21.6.6 Shot blasting 

A quite different method of cleaning is the use of shot 
blasting, or grit blasting. In this method a stream of fine 
abrasive particles is directed at the surface to be cleaned in 
a jet of air. The method is widely used for cleaning surfaces, 
particularly for painting. Walnut shell blasting has been 
used to clean rotating machinery internals. 

21.6.7 Manual cleaning 

In some cases it is necessary to resort to manual cleaning. 
This method may have to be used, for example, where a 
equipment contains residues which are difficult to shift in 
any other way but physically removing them. A typical 
case is the removal of flammable residues or solids in a 
large equipment in preparation for hot work. Manual 
cleaning is generally a last resort; it is laborious and 
unpleasant, and requires full precautions against flam¬ 
mable, toxic and asphyxiation hazards. Proper protective 
equipment must be worn. 

21.6.8 Cleaning in place 

A method of cleaning which is now a standard one in the 
pharmaceutical, as well as the food industry, is cleaning in 
place (CIP), using detergents. Accounts are given by Hyde 
(1985) and Kirkland (1986). 

CIP systems offer a number of advantages. They mini¬ 
mize downtime by more rapid cleaning and generate less 
effluent, and can be less costly. They minimize manual 
operations and hence, both safety and health problems. In 
particular, hazards of vessel entry and slippery surfaces 
are reduced. 

CIP systems come both as systems dedicated to par¬ 
ticular units and as mobile systems which can be used on a 
number of units. They may operate under manual control or 
under automatic control, with a program sequence. 

The equipment to he cleaned may be closed or open. 
For open equipment, Kirkland describes the use of a spray 
ball, custom-designed by computer, for the particular 
vessel. 

A typical CIP sequence is: (1) a water pre-rinse, to 
remove gross material; (2) detergent circulation, to remove 
debris and scale; (3) an intermediate water rinse, to 
remove detergent; (4) sterile circulation, to destroy residual 
organisms; and (5) a final water rinse, to remove CIP 
solutions. 

There are various techniques for water recovery and for 
minimizing the quantity of solutions used. 

21.6.9 Line clearing 

It is often necessary to remove debris, as distinct from 
shifting a complete blockage, from a line by flushing with 
water or blowing it with air. 

A treatment of the effectiveness of this operation has 
been given by Junique (1988). This is based on the following 
simple model of flushing or blowing: 

Ftxpu 2 [21.6.1] 

where F is the drag force on the particle, u is the fluid 
velocity relative to the particle and p is the density 
of the fluid. He defines a cleaning disturbance factor 


such that 



where C is the cleaning disturbance factor and sub¬ 
scripts 1 and 2 denote cleaning and operating conditions, 
respectively. The condition for effective flushing or blow¬ 
ing is C>1. 

The author gives an example of the application of the 
method. 

21.6.10 Waste minimization 

Cleaning operations generate an appreciable fraction of the 
liquid effluents from process equipments and measures to 
reduce effluents from this source can contribute sig¬ 
nificantly to waste minimization. This aspect is considered 
in Appendix 11. 

21.7 Confined Spaces 

Accidents associated with entry into and work in confined 
spaces and vessels have occurred with depressing regu¬ 
larity. This activity is recognized as presenting particular 
potential hazards and is governed by a statutory require¬ 
ment for a permit. Permits as such are considered in 
Section 21.8. The account given here is confined to the 
hazards of confined spaces and to precautions which 
should be taken. Accounts of these hazards and precautions 
are given in the IChemE Maintenance Guide, in a series of 
articles in the Loss Prevention Bulletin (Anon., 1975 LPB 3, 
p. 8; Anon., 1980 LPB 31, p. 11; Anon., 1983 LPB 53, p. 15; 
Anon., 1984 LPB 56, p. 24; Anon., 1985 LPB 63, p. 31), in 
the work of Kletz (notably Kletz, 1982f, 1985b), and by 
Arney (1977a,b), Bond (1984 LPB 59), Keller (1987) and 
Trowbridge (1987). 

Requirements for confined spaces are governed by 
OSHA 1910.146 Permit Required Confined Space, NIOSH 
Recommended Standard for Working in Confined Spaces, 
API 2217A Guidelines for Confined Space Work in the 
Petroleum Industry and ANSI Z117.1 Safety Requirements 
for Confined Spaces. Current guidance for the United 
Kingdom is given in Construction Sheet 15 Confined Spaces 
(HSE, 1991). 

21.7.1 Confined spaces 

In some cases it is fairly obvious what constitutes a ‘con¬ 
fined space’, in others it is less so. OSHA 1910.146 defines 
confined space as: 

(1) large enough and so configured that an employee can 
bodily enter and perform assigned work; 

(2) limited or restricted means for entry and exit; 

(3) is not designed for continuous employee occupancy 

1910.146 further defines a ‘permit-required confined space 
(permit space)’ as a confined space that has one or more of 
the following characteristics: 

(1) contains or has a potential to contain a hazardous 
atmosphere; 

(2) contains a material that has the potential for engulfing 
an entrant; 

(3) has an internal configuration such that an entrant 
could be trapped or asphyxiated by inwardly converging 
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walls or by a floor which slopes downwards and tapers 
to a smaller cross-section; 

(4) contains any other recognized serious safety or health 
hazard. 

Permit spaces must be labelled with appropriate signage. 
The HSE (1991 Construction Sheet 15) defines a confined 
space in the following terms: 

A closed equipment with restricted access may be the 
obvious example of a confined space, but it also includes 
open manholes, trenches, pipes, flues, ducts, ceiling 
voids, enclosed rooms such as basements, and other 
places where there is inadequate natural ventilation. 

Open top tanks, furnaces and ovens, even those with a 
large aperture open to the atmosphere, are confined spaces. 

21.7.2 Flammable substances 

It is frequently necessary for personnel to enter a equip¬ 
ment or vessel which has contained flammable materials. 
Before this is done, it is obviously necessary to empty the 
equipment and to purge and clean it so that flammable 
materials are no longer present. Despite this, incidents 
occur in which a flammable atmosphere builds up and is 
ignited. Other incidents occur in which the flammable 
residues are ignited when hot work is done. 

If a flammable mixture is ignited inside an equipment or 
vessel, the resultant explosion is likely to destroy it, since 
even pressure vessels are not generally designed to with¬ 
stand an explosion. Unburned and burned gases and 
burning liquid may be expelled and missiles generated 
from the disintegration of the equipment. 

There are several situations which can lead to the exist¬ 
ence of a flammable atmosphere in the equipment. One is 
simply that flammable vapour which was originally pre¬ 
sent has not been completely removed. Another is that 
flammable residues remain in the equipment and evapo¬ 
rate. In some cases, the residues are trapped in structural 
members. In other cases, there may be solid residues 
which vaporize when heat is applied such as from welding. 
Another way in which flammable gases may build up 
again is through isolations which are not leak-tight. In 
particular, the use of a single closed isolation valve is 
an unreliable means of isolation and there have been 
many instances where flammable fluid has entered a 
equipment through a passing isolation valve. A fourth way 
is the generation of a flammable gas by chemical reactions, 
for example the action of water on steel can generate 
hydrogen. 

Liquid residues should be drained, while solid residues 
should be removed by cleaning. Fluid leakage into 
equipment should be prevented by positive isolation, as 
described in Section 21.4. 

Prior to entry into equipment, a gas test should be done 
to confirm that the space is free of flammable gas. In some 
incidents there has been a failure to free the equipment 
completely of flammable gas and to test for this. More 
commonly, however, incidents occur because flammable 
gasbuildsupinthe equipment atmosphere after it has been 
checked and found to be free of flammables. 

Even if gas tests show the equipment atmosphere to be 
essentially free of flammables, however, there may still 
be flammable residues or deposits which can be ignited 
by hot work. It is necessary, therefore, to check separately 


for these and to clean them away before hot work is 
undertaken. 

21.7.3 Toxic substances 

There is a parallel hazard with toxic substances. The pre¬ 
cautions taken to ensure that the equipment atmosphere is 
free of toxic gas are essentially similar to those taken from 
flammable substances. The equipment should be emptied, 
purged, cleaned and tested for the relevant toxic gases. But 
a toxic atmosphere may still arise from residues remain¬ 
ing in the equipment or from leaks through inadequate 
isolation. 

21.7.4 Hazardous atmospheres 

Hazardous atmospheres may expose employees to the risk 
of death, incapacitation, impairment, injury, or acute ill¬ 
ness from one or more of the following causes: 

(1) flammable gas, vapour or mist in excess of 10% of its 
lower flammable limit (LFL); 

(2) airborne combustible dust at a concentration that 
meets or exceeds its LFL; 

(3) atmospheric concentration below 19.5 % orabove23.5%; 

(4) atmospheric concentration of any substance for which 
a dose or a permissible exposure limit is published and 
which could result in employee exposure in excess of 
its dose or permissible exposure limit; 

(5) any other atmospheric condition that is immediately 
dangerous to life or health. 

21.7.5 Oxygen-deficient atmospheres 

The removal of flammable gas from a equipment is often 
accomplished by purging with nitrogen. This inert gas is 
then replaced with air by purging or ventilation so as to 
give a breathable atmosphere. Incidents occur in which 
workers are asphyxiated because the atmosphere is defi¬ 
cient in oxygen. 

An oxygen-deficient atmosphere may arise in several 
ways. The original purging or ventilation may be inade¬ 
quate. Alternatively, the purge may have been conducted 
inadvertently using nitrogen instead of air. One way in 
which such inadvertent use of nitrogen in place of air may 
occur is where the air line has been connected to a nitrogen 
supply line. Another is the use of a cylinder which is sup¬ 
posed to contain air, but contains some other mixture. 

An atmosphere can also be rendered oxygen deficient if 
there is some process occurring which consumes the oxy¬ 
gen present, such as the rotting of vegetation or the rusting 
of metal. Oxygen may be adsorbed on steel surfaces, espe¬ 
cially where these are damp. 

Where the hazard of an oxygen-deficient atmosphere 
exists, a test of the oxygen content should be done. 

Requirements for the oxygen content of breathable air 
vary. The oxygen content of air at sea level is 21%, but at 
high altitudes it can fall to 19.5%. The concentration 
usually quoted to sustain life is 16%. OSHA 1910.146 quotes 
a minimum of 19.5% oxygen by volume. CS 15 quotes a 
minimum oxygen concentration of 19%. 

21.7.6 Oxygen-enriched atmospheres 

In some cases, an oxygen-enriched atmosphere may occur 
in a confined space. Such an atmosphere is hazardous 
because it can enhance strongly the flammability of cloth¬ 
ing. Oxygen-enriched atmospheres contain more than 
23.5% oxygen by volume. 
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One way in which the atmosphere may become oxygen 
rich is by leakage of oxygen from an oxygen cylinder used 
in cutting or welding operations. 

Another way is where the atmosphere is originally a 
mixture of nitrogen and oxygen which is nitrogen rich 
compared with air and where oxygen has been added in an 
attempt to raise the concentration to that present in air. This 
is poor practice because it involves this hazard. 

21.7.7 Noxious fumes 

There are a number of other ways in which noxious fumes 
may enter a confined space. One is from processes being 
carried out in that space. A common source is the fumes 
arising from welding. Another source is an adjoining space 
which has not been isolated. Other sources of noxious 
fumes are sludge and residues and combustion products. 

Trenches, tunnels and manholes can fill with carbon 
dioxide. Other fumes may occur where the ground is 
contaminated. Where these spaces are connected even 
temporarily to sewers, the atmosphere may become con¬ 
taminated with flammable and/or toxic gases or rendered 
oxygen deficient. 

21.7.8 Atmosphere gas tests 

Prior to entry into equipment, internal atmospheres shall 
be tested foroxygen content, flammable gases and vapours 
and for potential toxic air contaminants. The gas tests 
which are commonly done are for hydrocarbons, carbon 
monoxide and hydrogen sulfide and oxygen, together with 
tests for any toxic substance which has been contained in 
the equipment. 

21.7.9 Air supplies 

Measures to ensure that nitrogen is not supplied when it is 
intended to supply air to render an atmosphere breathable 
are described by Anon. (1975 LPB 3, p. 8). Incidents have 
occurred where an air line has been connected to a nitrogen 
supply, a nitrogen cylinder has been used instead of an air 
cylinder, and where an air cylinder has contained an oxy¬ 
gen deficient mixture. 

There are certain precautions which may be taken to 
ensure that an air line is not connected in error to a nitrogen 
supply line. One is to put an identification sign at each 
nitrogen take-off point. A more positive measure is to 
ensure that the connections for nitrogen and air lines are 
different and that their designs are such as to prevent an air 
line from being connected to a nitrogen line. 

Measures should also be taken to ensure that where air is 
to be supplied from a cylinder, the gas obtained actually is 
air. A positive means of preventing inadvertent use of a 
nitrogen cylinder instead of an air cylinder is the provision 
of different connections on the two types of cylinder, 
though this is outside the authority of the user company. 
Otherwise, procedures should he established to avoid 
identification errors. 

Cylinders of breathable air should be analysed at a fre¬ 
quency that is sufficient to ensure the contents meet the 
specifications. 

It is preferable not to use reconstituted air, made by blend¬ 
ing nitrogen, oxygen and other gases, for breathing pur¬ 
poses, but if this is done each cylinder should be analysed. 

21.7.10 Entry into confined spaces 

It will be apparent that entry into a confined space or vessel 
needs to be governed by procedures which ensure that 


the hazards are identified and precautions taken. This is 
accomplished by the permit system, which is now consid¬ 
ered. Entry procedures are a prime example of the appli¬ 
cation of a permit system. 

21.8 Permit Systems 

Maintenance work on process equipments should be 
controlled by a formal permit system. Accounts of such 
systems are given in Permit Systems (CAPFTB, 1977 
Inf. Pap. 16A), Guidance on Permit Systems in the Petroleum 
Industry (OIAC, 1991) (the OIAC Permit Systems Guide) 
and the IChemE Maintenance Guide, and by Kletz (1982f), 
VC. Marshall (1986b), S. Scott (1992) and Butler and 
Bonsall (1993). 

21.8.1 Regulatory requirements 

US companies use a work permit system to control main¬ 
tenance activities in process units and entry into equip¬ 
ment. The United Kingdom uses a similar system of 
permits-to-work (PTWs). 

In the United States of America, OSHA 1910.146 Permit 
Required Confined Spaces defines the requirements for 
entering in confined spaces. OSHA Process Safety Man¬ 
agement Standard 1910.119k addresses hot work permit 
requirements. The OSHA Occupational Safety and Health 
Act of 1970 requires safe work places. 

In the United Kingdom, there has long been a statutory 
requirement for a permit system for entry into vessels or 
confined spaces under the Chemical Works Regulations 
1922, Regulation 7. There is no exactly comparable statu¬ 
tory requirement for other activities such as line breaking 
or welding. The Factories Act 1961, Section 30, which 
applies more widely, also contains a requirement for certi¬ 
fication of entry into vessels and confined spaces. Other 
sections of the Act which may be relevant in this context 
are Sections 18, 31 and 34, which deal, respectively, with 
dangerous substances, hot work and entry to boilers. The 
requirements of the Health and Safety at Work etc. Act 1974 
to provide safe systems of work are also highly relevant. 

21.8.2 Objectives of permit system 

In essence, the objectives of the permit system are to exer¬ 
cise control over the maintenance activities by assigning 
responsibilities, ensuring communication between inter¬ 
ested functions, and requiring that proper consideration be 
given to the job, its hazards and the precautions required. 
More explicitly, the objectives are to ensure that: 

(1) there is a system of continuous control of the work to 
be done; 

(2) the persons responsible for overall control of the 
work and for its execution are identified; 

(3) the person responsible for the operation of the equip¬ 
ment is aware of the work; 

(4) the other functions with an interest in the work are 
identified and communications with them are estab¬ 
lished and maintained; 

(5) the work is properly defined; 

(6) the work is properly authorized by the person 
responsible; 

(7) the person responsible for the operation of the 
equipment is aware of what is going on; 

(8) the personnel involved in doing the work understand 
its exact nature and extent, the hazards involved, 
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any limitations on the extent, and the time allotted 
for the work; 

(9) the isolations and de-isolations required are properly 
performed; 

(10) the precautions to be taken are specified and under¬ 
stood; 

(11) the equipment is available and the arrangements are 
in place to support these precautions; 

(12) there is cross-referencing of permits where there is 
interaction between jobs; 

(13) the permits are suitably displayed; 

(14) there is a formal handover procedure from opera¬ 
tions to maintenance; 

(15) there is a formal handback procedure from main¬ 
tenance to operations; 

(16) there is a procedure covering situations where the 
work extends beyond a single shift; 

(17) there is a procedure covering situations where the 
work has to be suspended; 

(18) there is a record showing that the nature of the work 
and the precautions necessary were checked by the 
appropriate person(s). 

21.8.3 Issuing and performing authorities 

It is a principal objective of the permit system to define the 
responsibilities of all concerned. In the normal system 
there is an issuing authority and a performing authority. 
The issuing authority is the operations supervisor. The 
performing authority is usually the maintenance crafts¬ 
man who is to do the work, but may sometimes be the 
maintenance supervisor. 

It is the responsibility of the issuing authority to ensure 
that the equipment is safe for the work to proceed. The per¬ 
forming authority is responsible for ensuring that the fur¬ 
ther working precautions are taken. In certain cases, such as 
maintenance work on switchgear, the operations supervisor 
is not competent to give clearance, and so the maintenance 
supervisor has a greater degree of responsibility than usual. 

It is the responsibility of these same two authorities to 
terminate the permit. The normal system is that on com¬ 
pletion of the work, the performing authority signs that the 
work is complete and the issuing authority, after inspecting 
the work site, signs that the permit is complete. 

There may be a requirement that in certain defined 
cases, where work at a particular unit may affect an adja¬ 
cent unit, the operations supervisor on the latter should 
countersign the permit. 

21.8.4 Types of permit 

There is a variety of types of permit, some of which have 
special names, for example clearance certificates, fire per¬ 
mits, etc. Permits may be classified by reference to the 
operation to be performed, the equipment to be worked 
on, the classification of the areas where the work is to be 
done, the special hazards which may be encountered, the 
equipment to be used or the time of day specified for the 
work. A list of typical permits, which illustrates all these 
categories, is as follows: 

Operations 
Equipment removal 
Excavation 
Hot work 
Leak sealing 
Line breaking 


Vessel entry 
Waste disposal 

Equipment worked on 
Electrical equipment 
Interplant pipelines 
Sprinkler system 

Area classification 
Flammable area 

Special hazards 
Corrosive substances 
Fire 

Toxic substances 
Ionizing radiations 

Equipment used 
Mobile crane 

Time of day 
After-hours work 

A common basic set of permits covers entry, cold work, hot 
work and electrical work. Some companies use a single 
permit system to cover all work activities. The IP Refining 
Safety Code gives model permit forms for the following: 
general work, electrical work, hot work and work involving 
ionizing radiations; line disconnecting and vessel opening; 
entry; and excavation. 

21.8.5 Permits for isolation 

Isolation before a job and de-isolation after it should be 
treated as separate activities in their own right. Thus, for 
a job which requires isolation there may he permits for 

(I) isolation, (2) the main job and (3) de-isolation. 

Some equipment is isolated and de-isolated solely by 
operations. Operations work is typically not permitted, so 
the only permit required would be for the maintenance 
work. Some systems cover the entire job from isolation to 
de-isolation using a single permit. 

21.8.6 Contents of permit 

The contents of a permit need to be carefully defined. 
Accounts of permit contents are given in the OIAC Permit 
Systems Guide, the IChemE Maintenance Guide and by 
S. Scott (1992). Such accounts usually distinguish between 
features which are essential and those which are desirable. 
The essential features of a permit are: 

(1) company name and address; 

(2) permit title; 

(3) permit number; 

(4) period of validity; 

(5) location of work (unit, equipment); 

(6) description of work; 

(7) isolation; 

(8) hazard identification; 

(9) precautions required; 

(10) protective equipment required; 

(II) authorization; 

(12) expansion; 

(13) handback; 

(14) cancellation. 

The period of validity, in terms of the date, start time and 
end time, should be entered, as an elementary requirement 
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for control. The location of the work should be specified in 
terms of the unit, area or building and vessel or equipment. 
Proper titles should be used, not informal names. 
The equipment may be identified by an identification tag / 
name and this should be cross-referenced on the permit. 
The description of the work should state the work to be 
done, the reason for it and the method to be used and any 
limitations on the extent of the work. There should be con¬ 
firmation that the isolation required has been accom¬ 
plished. The potential hazards should be identified. In 
some cases these may be partially covered by a checklist of 
actions to be taken such as depressurization, cleaning, etc., 
in which case it is the residual hazards which are entered. 
The precautions already taken and those still to be taken 
should be stated. The protective clothing and equipment to 
be used should be specified. The issuing authority should 
sign that the work is authorized to start and the performing 
authority should sign that the permit is accepted. On com¬ 
pletion, the performing authority should sign to indicate 
that the work is complete and the issuing authority should 
sign to show that the permit is completed. 

Particular types of permit require additional features. 
For example, a hot work permit should contain an entry for 
the hazardous area classification of the location of the work 
and gas test results. 

The IChemE Maintenance Guide gives a number of 
additional desirable features. It is desirable to include a 
caution to the effect that the permit is a legal document; a 
caution to the issuing authority that, although work may 
be delegated, responsibility remains with them; an indica¬ 
tion of the levels of hazard, so that high hazard situations 
are highlighted and those involved are prompted to 
consider whether there are other parties who should be 
consulted; an indication of work progress, so that cases are 
identified where the work is tending to expand beyond that 
originally envisaged and those involved are prompted to 
reappraise it. 

21.8.7 Design of permit forms 

Sample permit forms are given in a number of publications, 
including the IP Refining Safety Code, the IP LPG Code and 
the IChemE Maintenance Guide. 

A typical permit, referred to by the company concerned 
as a clearance certificate, is shown in Figure 21.3. This 
permit dates from 1977, but still provides a clear illustration 
of many of the basic principles. 

Figure 21.4 shows the typical entry permit given in the 
IChemE Maintenance Guide. 

21.8.8 Entry permits 

Entry into vessels and other confined spaces has resulted 
in numerous accidents. As a result this operation has had a 
unique status. 

OSHA 1910.146 defines entry permit requirements. The 
entry permit identifies: 

(1) permit space to be entered; 

(2) purpose of entry; 

(3) date and authorized duration of the entry permit; 

(4) authorized entrants by name; 

(5) personnel, by name, serving as attendants; 

(6) individual, by name, currently serving as entry 
supervisor; 

(7) hazards of permit space to he entered; 


(8) measures used to isolate the permit space and to 
eliminate or control permit space hazards before 
entry; 

(9) acceptable entry conditions; 

(10) results of initial and periodic gas tests; 

(11) rescue and emergency services that can be sum¬ 
moned and the means for summoning those services; 

(12) communication procedures used by authorized 
entrants and attendants to maintain contact during 
the entry; 

(13) equipment such as personal protective equipment, 
testing equipment, communications equipment, 
alarm systems and rescue equipment to be provided; 

(14) any other information necessary to ensure employee 
safety; 

(15) any additional permits such as hot work that have 
been issued to authorize work in permit spaces. 

Vessel and confined space entry have a specific legal 
requirement for a permit system. This requirement is given 
in the Chemical Works Regulations 1922, Regulation 7, 
now superseded, and in the Factories Act, Section 30. It is 
appropriate, therefore, to describe this permit in some 
detail as an illustration. In order to avoid repetition it is also 
convenient to describe here the associated hazards and 
procedures. 

Entry permits are dealt with in Safety and Management 
(ABCM, 1964/3), Permit Systems (CAPFTB, 1977 Inf. Pap. 
16A) and by Kletz (1982f). Early HSE guidance was given in 
TON 47 Entry into Confined Spaces: Hazards and Precau¬ 
tions (HSE, 1975) and GS 5 Entry into Confined Spaces (HSE, 
1977) and current guidance in Construction Sheet 15 
Confined Spaces (HSE, 1991). The hazards of work in a 
vessel or confined space are described in Section 21.7. 

A significant proportion of accidents in vessels or con¬ 
fined spaces are fatal and some involve multiple deaths. 
OSHA 1910.146 and The Factories Act 1961, Section 30, 
describes precautions which have to be taken where work 
has to be done inside equipment in which the atmosphere is 
liable to be such as to involve the risk of people being over¬ 
come by dangerous fumes or lack of oxygen. 

The requirements of the Act are summarized in TON 47 
for atmospheres in which dangerous fumes are liable to be 
present: 

No - one may enter or remain for any purpose in a confined 
space which has at any time contained or is likely to con¬ 
tain fumes liable to cause a person to be overcome unless 

(1) He is wearing a suitable breathing apparatus. 

(2) He has been authorized to enter hy a responsible 
person. 

(3) Where practicable, he is wearing a belt with a rope 
securely attached. 

(4) A person keeping watch outside and capable of pulling 
him out is holding the free end of the rope. 

Alternatively, a person may enter or work in a confined 
space without breathing apparatus provided that 

(1) Effective steps have been taken to avoid ingress of 
dangerous fumes. 

(2) Sludge or other deposits liable to give off dangerous 
fumes have been removed. 

(3) The space contains no other material liable to give off 
such fumes. 




Figure 21.3 Clearance certificate (Imperial Chemical Industries Ltd, 1977; reproduced by permission) 
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(4) The space has been adequately ventilated and tested 
for fumes. 

(5) There is a supply of air adequate for respiration. 

(6) The space has been certified by a responsible person 
as being safe for entry for a specified period without 
breathing apparatus. 

The person who enters the confined space must be warned 
when the safe period specified in (6) above will expire. In all 
cases a sufficient supply of approved breathing apparatus, 
belts and ropes, and suitable reviving apparatus and oxy¬ 
gen must be kept readily available, properly maintained 
and regularly examined. 

The requirements for oxygen-deficient atmospheres are 
summarized in TON 47 as follows: 

No-one may enter or remain in a confined space in which 
the atmosphere is liable to be deficient in oxygen unless 
either he is wearing a suitable breathing apparatus, or the 
space has been and remains adequately ventilated and a 
responsible person has tested and certified it as safe for 
entry without breathing apparatus. 

The same section of the Act also requires confined 
spaces to be provided with manholes and specifies mini¬ 
mum dimensions. Circular manholes, for example, should 
not be less than 18 in. in diameter or, on tank wagons and 
mobile plant, 16 in. in diameter. Manholes larger than these 
minimum sizes should be provided wherever possible. In 
particular, practical tests have shown the minimum size on 
mobile equipment to be barely negotiable by men of average 
build. 

The control of work in vessels and confined spaces is 
described in TON 47, which lists the following features: 

(1) assessment; 

(2) withdrawal from service; 

(3) isolation; 

(4) cleaning and purging; 

(5) testing,- 

(6) certification; 

(7) precautions during work 

(a) entry without breathing apparatus, 

(b) entry where breathing apparatus is necessary, 

(c) rescue; 

(8) cancellation of permit; 

(9) return to service. 

The issuance of the permit should he done by the 
responsible person in accordance with the procedures 
described in Section 21.8.3. The issuing authority should 
have a sufficient familiarity with both the chemistry and 
the engineering aspects of the situation and should check 
personally the actions required. 

The need for entry should be considered carefully and 
entry should not be made unless it is essential. The hazards 
of vessel entry should be reviewed, paying particular 
attention to any hazard arising from nearby plant and to 
any special circumstances or precautions. 

Withdrawal from service should be a formal procedure. 
Operating personnel should be informed and warning 
notices displayed. 

The isolation of the vessel should be completed in accord¬ 
ance with the procedures described in Section 21.4. The 
recommended method of isolation for vessel entry is 


physical disconnection. A closed and locked valve is not an 
adequate method. 

If there is machinery inside the vessel, such as an agi¬ 
tator or mixer, it should be isolated by electrical isolation or 
by physical disconnection. In addition, if necessary, it 
should be secured to prevent its moving. There may also be 
pumps which should be isolated electrically. The vessel 
should then be emptied. 

Cleaning of the vessel may be accomplished in several 
ways. Steaming out is a common method. This may be pre¬ 
ceded by washing with water, solvent or neutralizing agent. 
The steaming itself should be continued long enough to 
clean the vessel thoroughly. The steaming time is often 
determined by experience, but it is essential to continue 
steaming until the vessel is clean rather than simply for a 
predetermined time. It is important to ensure that equip¬ 
ment attached to the main vessel is also cleaned thoroughly. 
The period of steaming and the completion of steaming 
should be checked by the responsible person. If several 
hours elapse after steaming, it is advisable to steam the 
vessel again immediately before entry. It should be ensured 
that the steaming is done safely and without either over¬ 
pressuring the vessel with steam or causing it to collapse 
under the vacuum created by steam condensation. 

Other cleaning methods include thorough washing with 
cold or hot water or with solvents or neutralizing agents 
and boiling with water. Some cleaning agents such as sol¬ 
vents can create a secondary hazard and may need to be 
removed by steaming. Boiling water cleaning requires 
precautions against overpressure and vacuum collapse of 
the vessel. 

It is sometimes necessary to resort to hand cleaning to 
remove sludge and residues. In such cases, it is essential to 
work with the full precautions of breathing apparatus, a 
safety line, and rescue equipment and personnel. 

On the completion of cleaning all liquid should be run out 
and the manholes opened for ventilation. If steam cleaning 
has been used, opening of the manholes while the vessel is 
hot assists air circulation by natural convection. It may be 
necessary, however, to use forced ventilation from a blower 
or compressed air line. 

If the vessel is hot, it should be allowed to cool before any 
entry is made. 

If the vessel has contained a flammable gas or vapour, 
it may he purged with an inert gas such as nitrogen or 
carbon dioxide. This then creates, however, an asphyxiation 
hazard. It is thus necessary to purge the inert gas with air. 

Testing of the atmosphere in the vessel must be carried 
out before it is certified as safe to enter or before the safety 
precautions for entry are specified. The tests should check 
the presence of toxic and/or flammable fumes and, if 
necessary, the adequacy of the oxygen content. The tests 
should be conducted by a competent person. If the work is 
at all prolonged, the tests should be repeated. Continuous 
gas testing may be required throughout the work and must 
be noted on the permit. 

The general testing of working atmospheres is dealt 
with in Chapter 25 and is therefore not considered here. As 
far as testing in vessels is concerned, entry into the vessel 
should be avoided if possible. Instead, samples should be 
drawn from inside the vessel through sample tubes. It is 
essential, however, to test throughout the vapour space; 
factors which may cause this not to be homogeneous 
include release of fumes from sludge or residues and 
layering of inert gases. 
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If entry into a vessel for testing is unavoidable, this 
should be done with breathing apparatus, a safety line, and 
rescue equipment and personnel. 

With regard to the permissible concentration of toxic 
materials, it has been common practice for many years to 
use the threshold limit value (TLV). 

When the above stages have been completed, the 
responsible person can decide on the precautions to be 
taken on entry and, in particular, whether (1) entry is safe 
for a specified period without breathing apparatus or 
(2) entry requires breathing apparatus, a safety line and 
other precautions. 

The permit can then be issued detailing the safety meas¬ 
ures already taken (e.g. isolation, cleaning and purging, 
testing), those to be taken (e.g. ventilation, repeat testing, 
breathing apparatus, a safety line, and rescue equipment 
and personnel) and the period of validity 

Precautions during the work depend on whether the 
method of entry involves the use of breathing apparatus or 
not. If breathing apparatus is not used, good ventilation is 
essential. This means at least several changes of air per 
minute. If there are sufficient top and bottom openings, 
natural ventilation may suffice, but more usually forced 
ventilation is necessary using compressed air or blowers. 
The air line or blower piping should extend to the bottom of 
the vessel to assure the removal of heavy fumes and give 
good air circulation. If there is a static electricity hazard, it 
may be necessary to bond the air line or piping to the metal 
of the vessel. Gaseous oxygen should not be introduced into 
the vessel to increase the oxygen content of the atmosphere, 
since it creates the hazard of an oxygen-enriched atmos¬ 
phere. 

If breathing apparatus has to be used, it should be either 
the self-contained breathing apparatus type or the air line 
type. Canister respirators should not be used, because they 
do not provide adequate protection against high con¬ 
centrations of toxic flumes and are useless in atmospheres 
deficient in oxygen. 

The person entering the vessel should also wear a safety 
harness and lifeline wherever practical. The free end of the 
line should be held by a person outside. The harness should 
be worn so that the worker can be pulled head first up 
through the opening. 

It is the duty of the person outside, or safety watch, to 
keep hold of the safety line and observe the person working 
inside the vessel. They should have a means of summoning 
assistance rapidly. If possible, there should also be other 
workers nearby. 

If the person in the vessel is overcome, the safety watch 
should raise him head first through the opening. An uncon¬ 
scious man is a heavy weight and the safety watch should 
have both adequate strength and training for his task. 

There should be rescue equipment, such as additional 
breathing apparatus and safety lines and reviving equip¬ 
ment and medical oxygen. 

The restrictions on entry apply also to entry for rescue. 
In addition, if entry has been permitted without breathing 
apparatus and the person inside has been overcome, 
entry for rescue should be made only wearing breathing 
apparatus and a safety line and with other personnel 
available to give assistance. Multiple fatalities have occur¬ 
red where men have gone in to rescue their fellows without 
proper protection. 

When the work is finished, the equipment used should be 
removed, the work site should be inspected and the permit 


completed in accordance with the procedures given in 
Section 21.8.3. 

Personnel should be warned that the vessel is no longer 
safe for entry. Accidents occur due to persons entering ves¬ 
sels which are no longer safe in order to recover tools, etc. 

The de-isolation of the vessel should be done in accord¬ 
ance with the procedures described earlier and the vessel 
returned to service. 


21.8.9 Types of permit system 

The normal permit system is a single permit issued by the 
issuing authority to the performing authority. As stated 
earlier, the norm is that the issuing authority is the opera¬ 
tions supervisor and the performing authority the person 
who is to do the work, but in some cases the performing 
authority is the maintenance supervisor. 

There are, however, variations on this system. In some 
companies, certain permits are issued by the safety officer. 

In a particular permit system, a given job may require 
more than one document. There may well be other certifi¬ 
cates which are necessary before the main permit can be 
issued. One example is an isolation permit, in a system 
where separate permits are used for isolation, and 
de-isolation. Another is a test certificate for analysis of 
the working atmosphere. 

Some types of permit relate to higher levels of hazard 
than others, so that there can be a hierarchy of permits. 

21.8.10 Design of permit systems 

The effectiveness of a permit system depends in large part 
on the way in which the system is designed and operated. 

Aspects of the design of a permit system include (1) stand¬ 
ardization, (2) the personnel involved, (3) scope, (4) cross- 
referencing, (5) display, (6) multiple jobs, (7) change of intent, 
(8) suspension, (9) handback, (10) training and (11) moni¬ 
toring, auditing and review. 

It is desirable that the permit system used within a com¬ 
pany be as uniform as is practicable. This applies not just to 
the design of permit forms but to the whole system. A stand¬ 
ard system eases the problem of training and reduces the 
probability of confusion and hence error. 

There are constraints, however, on complete standardi¬ 
zation. A permit system is a means of communication 
between the interested parties and must, therefore, reflect 
the organizational structure. It is also a formalization of the 
operating and maintenance procedures. While uniformity 
is desirable, a mismatch between the permit system and 
either this structure or the procedures is too high a price to 
pay, in that it is likely to undermine acceptance of the per¬ 
mit system and hence compliance with it. 

The personnel involved in the issue of a permit should be 
identified. In some systems, the number may be quite large, 
perhaps as high as 15-20. 

There may be a requirement that in certain defined cases, 
where work at a particular unit may affect an adjacent unit, 
the operations supervisor on that unit should countersign 
the permit. 

The permit should ensure that the scope of the work to be 
done is fully defined. 

The design of the permit form should allow for the 
necessary cross-referencing. There should be cross- 
references to: other jobs, by description of job as well 
as permit number; isolations and the associated permit 
numbers; and equipment identification tags. In particular, 
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the cross-referencing should cover the case where isolation 
is common to more than one job. 

A copy of the permit should be clearly displayed in the 
control room. 

Another copy should be displayed at the work site, 
except when the job is done at a number of locations, in 
which case it should be kept by the person in immediate 
charge of the work. If this person is not also the performing 
authority, the latter should also have a copy. 

For given equipment, there should be only one permit, 
but it may cover work by more than one trade. 

Sometimes there is a change of intent while the job is 
being done. An example is a change from work on pump 
seal flush lines which does not involve breaking into the 
process line, to a pump overhaul which does. If such a 
change of intention occurs, a separate permit may be issued. 

It may well happen that it is necessary to suspend the 
work. This can occur because: work is carried out only for 
one shift each day; spares are on order; the activity is 
incompatible with another which has higher priority, as 
with suspension of hot work while a flammable gas sample 
is taken; or there is an emergency. 

One option is that the permit is cancelled so that 
resumption of the work requires a new permit. This may 
well be the best policy if the work is being suspended for an 
undefined and possibly extended period and the equip¬ 
ment can be rendered safe. Alternatively, the permit itself 
may be suspended. If this option is taken, the permit 
should be clearly displayed in a suitable place and clearly 
marked as suspended; the condition in which the equip¬ 
ment has been left and the consequences for other activities 
should be stated; and prior to reactivation the issuing 
authority should verify that it is safe for the work to pro¬ 
ceed. The OIAC Permit System Guide gives further guid¬ 
ance on the procedures for the suspension of a permit. 

A suspended permit was at the centre of the events which 
led to the Piper Alpha disaster and the view was then urged 
that the suspension of a permit should not bean option. The 
Inquiry recognized the dangers but did not recommend 
prohibition. 

The procedures for handback of the permit, described 
earlier, should be clear. 

The permit system should ensure that both operations 
and maintenance personnel, company employees as well as 
contractors are trained in the system which applies at the 
actual plant where they work. It is not enough to have 
instruction in the general principles of a permit system; 
personnel must be clear about the details of the operation, 
and the reasons for, the particular permit system govern¬ 
ing their own work. 

There should be built into the permit system arrange¬ 
ments to ensure that the operation of the system is moni¬ 
tored regularly and is subject to a more searching audit at 
specified intervals, and that a review of the appropriateness 
of the system is undertaken at specified, longer intervals. 


21.8.11 Operation of permit systems 

If the permit has been well designed, the operation of the 
system is largely a matter of compliance. If this is not the 
case, the operations function is obliged to develop solutions 
to problems as they arise. 

As just stated, personnel should be fully trained so that 
they have an understanding of the reasons for, as well as the 
application of the system. 


It is the responsibility of management to ensure that the 
conditions exist for the permit system to be operated 
properly. An excessive workload on the plant, with numer¬ 
ous modifications or extensions being made simulta¬ 
neously, can overload the system. The issuing authority 
must have the time necessary to discharge his responsi¬ 
bilities for each permit. 

In particular, he has a responsibility to ensure that it is 
safe for maintenance to begin and to visit the work site on 
completion to ensure that it is safe to restart operation. 

Where the workload is heavy, the policy is sometimes 
adopted of assigning an additional supervisor to deal with 
some of the permits. However, a permit system is in large 
part a communication system, and this practice introduces 
into the system an additional interface. 

The communications in the permit system should be 
verbal as well as written. The issuing authority should 
discuss, and should he given the opporutnity to discuss, 
the work. It is bad practice to leave a permit to be picked up 
by the performing authority without discussion. 

The issuing authority has the responsibility of enforcing 
compliance with the permit system. He needs to be watch¬ 
ful for violations such as extensions of work beyong the 
original scope. 

21.8.12 Deficiencies of permit systems 

An account of deficiencies in permit systems found in 
industry is given by S. Scott (1992). As already stated, some 
30% of accidents in the chemical industry involve main¬ 
tenance and of these some 20% relate to permit systems. 

The author gives statistics of the deficiencies found. 
Broadly, some 30—40% of the systems investigated were 
considered to be deficient in respect to system design, form 
design, appropriate application, appropriate authorization, 
staff training, work identification, hazard identification, 
isolation procedures, protective equipment, time limita¬ 
tions, shift change procedure and handback procedure, 
while as many as 60 % were deficient in system monitoring. 

21.8.13 Audit of permit systems 

It is not enough to create a permit system to control main¬ 
tenance work. There should also be a routine audit of the 
system to ensure that it is operating properly. These may 
consist of a specific instruction to the plant manager to 
check each week a portion of the permits issued. 

21.8.14 Checklist for permit systems 

The OIAC Permit Systems Guide gives a checklist for permit 
systems.This is shown inTable 21.3. 

21.9 Maintenance Equipment 

21.9.1 Tools 

Tools such as hammers and wrenches have been considered 
a possible source of ignition, and so-called non-sparking 
tools have been developed. Materials used in such tools are, 
typically: aluminium, bronze or monel, for tools that have 
to withstand impact or torque such as hammers, wrenches 
and crowbars; copper-beryllium alloy, for tools requiring 
a cutting edge or gripping teeth such as knives, chisels, 
saws, drills, pliers and shears; and plastics, leather, fibre 
and wood, for shovel and scraper tools. 

These tools have a number of disadvantages. Generally, 
they are more expensive and they are softer and tend 
to burr. Moreover, particles can more easily become 



Table 21.3 A checklist for permit-to-work systems (Oil Industry Advisory Committee, 1991) (Courtesy of HM Stationery Office. Copyright. All rights reserved) 


The purpose of this checklist is to help 
everyone concerned with the preparation of 
permit-to-work systems to decide whether a 
particular example covers all the points 
which are considered essential. If the answer 
to any of the questions below is ‘no’, the system 
may need to be reconsidered and 
changed. 

The system 

1. Does the permit system in force satisfy all the 
legal requirements applying to that site or 
installation? 

2. Is the permit system recognized throughout 
the site or installation as being essential for 
certain types of work? 

3. Are the types of work, types of job or areas 
where permits must be used clearly defined 
and known to all concerned? 

4. Does the permit system extend to contractors 
and their employees? 

5. Is it clearly laid down who may issue 
permits? 

6. Is it clearly laid down how permits should be 
obtained for specific jobs? 

7. Is the permit system flexible enough to allow it 
to be applied to other potentially hazardous 
work, apart from that which may have been 
specifically identified when the system was 
established? 

8. Is the issue of a permit by a person to 
themselves prevented? 

9. Does the system provide both for the recipient 
to retain the permit and for a record of live 
permits and suspended permits to be 
maintained at the point of issue? 

10. Does the system require a copy of the permit to 
be displayed at the workplace? 

11. Does the system require the display of live and 
suspended permits so that process operating 
staff can readily see and check plant status? 

12. Is there a set of properly documented isolation 
procedures for working on potentially 
dangerous items of plant and does it provide 
for long term isolation? 


Training and competence 

13. Is the permit system clearly covered during site 
or installation safety induction training? 

14. Are personnel who have special 
responsibilities under the permit system, e.g. 
issuing and isolating authorities, properly 
authorized and trained to undertake the duties 
required of them? 

15. Do these people have sufficient time to carry 
out these duties properly? 

16. Does the system require formal assessment of 
competence of personnel before they are given 
responsibilities under the permit procedure? 

17. Is a record of training and assessment 
maintained? 

18. Do training and competence requirements 
include contractors? 

19. Are individuals provided with written 
confirmation of successful completion of 
relevant training and are these documents 
checked before appointments are made within 
the permit-to-work system? 

The permit 

20. Is there a clear requirement for work being 
done under a permit to be stopped if any new 
hazards have arisen or old hazards recurred? 

21. Does the permit contain clear rules about how 
the job should be controlled or abandoned in 
the event of an emergency? 

22. Do permits specify clearly the job to be done? 

23. Do permits specify clearly to whom they are 
issued? 

24. Does the system require the potential hazards 
at the work site to be clearly identified and 
recorded on the permit? 

25. Does the permit clearly specify the 
precautions to be taken by the issuing and 
performing authorities? 

26. Do permits specify clearly the plant or 
geographical area to which work must he 
limited? 

27. Does the recipient have to sign the permit to 
show that they both read the permit and 
understood the conditions laid down in it? 


28. Do permits specify clearly a time limit for 
expiry or renewal? 

29. Does the permit include a handover 
mechanism for work which extends beyond a 
shift or other work period including work 
which has been suspended? 

30. Is a handback signature required when the job 
is complete? 

31. Is there a procedure to bring to the attention of 
the site manager tasks which require 
inhibiting safety devices, e.g. fire detectors, to 
ensure that contingency plans and precautions 
are in place? 

Co-ordination 

32. Are copies of permits issued for the same 
equipment/area kept and displayed together? 

33. Is there a means of co-ordinating all work 
activities to ensure potential interactions are 
identified? 

34. Is there provision on the permit form to cross- 
reference other relevant certificates and 
permits? 

35. Is there a procedure to ensure that the 
agreement of others who could be affected by 
the proposed work is obtained before starting 
the work or preparations for it? 

36. Where there are isolations common to more 
than one permit, is there a procedure to prevent 
the isolation being removed before all the 
permits have been signed off? 

Monitoring 

37. Is there a system of spot checks to ensure that 
permits are being followed? 

38. Is there a procedure for reporting any 
incidents that have arisen during work carried 
out under a permit and for reviewing 
procedures as necessary? 

39. Are audits carried out on the permit-to-work 
system at least once a year, preferably by 
people not normally employed at that site or 
offshore installation? 
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embedded in them, thus reducing their non-sparking 
qualities. 

The American Petroleum Institute (API) has issued a num¬ 
ber of reports over a period of years on the appropriateness 
of using non-sparking tools in petroleum operations. The 
general conclusion is that an incendive spark of steel would 
be unlikely to be produced manually and that power 
operation would be needed. Its current position is stated in 
API Publ. 2214:1989: 

The Institute’s position is that the use of special non- 
ferrous hand tools, sometimes referred to as nonsparking 
tools, is not warranted as a fire-prevention measure 
applicable to petroleum operations. 

Certain gases handled in the chemical industry are par¬ 
ticularly susceptible to spark ignition, notably hydrogen, 
acetylene, ethylene and carbon disulfide. One policy 
described on non-sparking tools in this industry is that 
instead of utilizing all types of non-sparking tool in flam¬ 
mable areas a more limited use is made, restricting their 
application to the use of non-sparking hammers (though 
not wrenches) for the hardening up of joints on lines con¬ 
taining the above four gases. 

The extent to which tools may act as ignition sources is 
discussed in more detail in Chapter 16. 

21.9.2 Lifting equipment 

Liftingequipmenthasbeenthecauseofnumerousaccidents. 
There have long been statutory requirements, therefore, for 
the registration and regular inspection of equipment such 
as chains, slings and ropes. Extreme care should be taken 
with handling and storage of lifting equipment to prevent 
damage. It should never be modified and repair work should 
be performed by manufacturer or qualified personnel. 

The rated capacity of lifting equipment must never be 
exceeded. Charts are available from the manufacturer, pub¬ 
lished standards and numerous professional organizations. 
Before each use, lifting equipment should be examined 
and verified that it is capable of handling its intended 
function. 

Lifting equipment is governed by OSHA 1910.184 Slings 
and 1926.251 Construction Rigging Equipment. UK require¬ 
ments are given in the Factories Act 1961, Sections 22-27, 
and in the associated legislation, including the Chains, 
Ropes and Lifting Tackle (Register) Order 1938, the Con¬ 
struction (Lifting Operations) Regulations 1961 and the 
Lifting Machines (Particulars of Examination) Order 1963. 
Some of these regulations are superseded by the consoli¬ 
dating Provision and Use of Work Equipment Regulations 
1992. 

In process plant work incidents sometimes occur in 
which a lifting lug gives way. This may be due to causes 
such as incorrect design or previous overstressing. Ultra¬ 
sonic testing or X-ray of lifting lugs may be necessary if 
there is concern over its integrity. 

21.9.3 Lift plans/permits 

Critical or major lifts should have a detailed lift plan pre- 
pared.This includes detailed drawings of the lift and swing, 
calculations on lifting equipment and crane(s), certification 
of lifting equipment, review of matting and ground condi- 
tions(surfaceandunderground)aswellaspotentialhazards. 

The use of lift permits is required by some companies. 
This requirement documents the lift to be made and enables 
a review by the appropriate personnel. 


21.9.4 Mobile cranes 

Mobile cranes present several different types of hazard. 
One is that of collision with process equipment, particularly 
pipe racks, when the crane is on the move. A minimum 
measure to prevent this is clear identification of pipe racks 
including labelling with clearance height. A spotter should 
be used to walk mobile equipment when it is being moved. 
A positive protection is the installation of a crossbeam in 
front of the pipe rack. 

Another type of hazard is the overloading or overturning 
of the crane onto process equipment. Each crane must have 
a capacity chart for lifting over the rear and over the side 
either posted on the crane or available in the cab. For a given 
crane, there is a maximum safe load and maximum safe 
radius. There is normally a safe load indicator, but nothing 
to indicate the safe radius. If either is exceeded, the poten¬ 
tial for an incident exists. If the radius is exceeded, the 
crane may topple. Numerous crane failures are in the lit¬ 
erature. It is equally important that personnel performing 
the rigging and lifting are trained in determining capacity 
of lifting equipment and cranes. They also must know 
proper set-up and limitations of lifting. It is important for 
crane drivers to be well trained in the operation and limi¬ 
tations of their cranes and in the special hazards of process 
equipment. 

Another hazard with crane operation is overhead 
electrical lines. A minimum 10 ft separation distance is 
required. Additional guidance is provided in OSHA 
1910.333. A rather less obvious hazard in cranes hired from 
outside contractors is the use of cab heaters which are not 
suitable for hazardous areas. A heater is needed, but it 
should be of an appropriate type. 

Regulatory reference is OSHA 1910.180 Crawler Loco¬ 
motive and Truck Cranes, 1926 (Construction) Subpart N, O 
and 1926.952. 

21.9.5 Lift trucks 

Lift trucks, including forklifts, present another set of 
hazards. One is the hazard due to any moving vehicle, 
especially in a relatively congested plant area. A specific 
aspect of this is impact on equipment. Incidents are 
numerous in which lift trucks are driven into and damage 
buildings and equipment; pipe racks are particularly at 
risk. Impact is more likely if the truck is travelling with 
arms extended. A lift truck may also run over and crush 
pipe or cabling. 

Overturning is another hazard, the causes of which 
include misleading, sudden braking or sharp turning and 
traversing of rough or sloping terrain. 

Personnel operating lift trucks should be well trained in 
the operation and limitations of their cranes and in the 
special hazards of process equipment. 

A lift truck is a vehicle with projecting and moving parts. 
It, therefore, has some of the characteristics of a machine. 
The power source, batteries or engine, on a lift truck may 
act as a source of ignition. 

Guidance on lift trucks is given in OSHA 1910.178 
Powered Industrial Trucks, HS(G) 6 Safety in Working with 
Lift Trucks (HSE, 1992). HS(G) 6 states that lift trucks are 
responsible for about one-third of the 20,000 reportable 
injuries each year which involve transport. In the period 
1986-1991,112 people were killed in accidents involving 
lift trucks. 

Prevention of lift truck accidents requires attention to 
(1) equipment layout, (2) working practices and (3) training. 
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Specific preventive measures fall mainly under the follow¬ 
ing headings: (1) traffic, (2) imbalance, (3) impact and 
crushing and (4) moving parts. 

Measures which address the traffic aspects include the 
layout of the lift truck workplace, use of driving practices 
which specifically address lift truck dangers, limitation of 
driving to trained personnel, avoidance of obscuration of 
the driver’s view by the load and removal of people from the 
vicinity of the truck, using both segregation and warning 
devices. Prevention of imbalance requires the application of 
loading rules and avoidance of unsuitable terrain. Meas¬ 
ures to prevent impact include use of layout and barriers 
and travelling with lift arms lowered. The danger from 
working parts may also be minimized by suitable layout 
and working practices. 

21.9.6 Manlifts 

Manlifts are used to hoist personnel. They provide quick 
access for work at elevated heights. Personnel operating the 
manlift must exercise care so as not become entangled in 
the work area. They should never exit the manlift platform. 

It is important for manlift operators to be well trained in 
the operation and limitations of their manlifts and in the 
special hazards of their use. 

OSHA 1910.68 governs manlifts. 

21.9.7 Scaffolding 

Scaffolding is used as a temporary platform for work. It 
should be constructed by qualified personnel. Before initial 
use, scaffolding should be inspected by a competent person 
and certified as safe for use. A tagging system is commonly 
used to indicate that the scaffold is safe for use or that it is 
being built and should not be used. 

Scaffolding is governed by OSHA 1910.28 Safety Require¬ 
ments for Scaffolding. 

21.9.8 Robots 

A less conventional form of equipment is a robot. The use 
of robots in relation to process equipment is most developed 
in the nuclear industry and in offshore activities, but 
a gradual growth of their use in special applications on 
conventional process plants can be envisaged. 

Accounts of robots are given by Collins (1982), 
T.J. Williams (1983), Siddle (1986b) and R.M. Thylor and 
Lewis (1987). HSE guidance on robots is given in 
HS(G)43 Industrial Robot Safety (1988) (the HSE Robot 
Safety Guide). 

The term ‘robot’ has been used to describe a variety of 
devices. The definition given by the Robot Institute of 
America (RIA) is a ‘reprogrammable’, multifunctional 
manipulator designed to move materials, parts, tools or 
specialized devices through variable preprogrammed 
motion for the performance of a variety of tasks’. The Japa¬ 
nese Industrial Robot Association defines four levels of 
complexity in robots. The first level is a manual manip¬ 
ulator which performs preset sequences; a typical applica¬ 
tion is as a means of remote manipulation in hazardous 
environments. The other three levels are playback robots, 
numerically controlled robots and intelligent robots. A 
robot is distinguished from a manual manipulator by its 
program, and from the single-task devices used in much 
factory line production by its flexibility. 

Features of a robot are the program, the control system, 
the power, the sensors, the axes of movement and the lifting 
capacity. A common form of control system is one in which 
the robot is taken through a sequence under manual gui¬ 


dance, the sequence is repeated automatically to check it 
out and it is then committed to memory. 

Industrial applications include robots which perform the 
operations of pick-and-place, spraying and painting, resis¬ 
tance welding, continuous path welding, and assembly. 

The more advanced applications of robots depend heav¬ 
ily on the availability of suitable sensors, both contact and 
non-contact types. 

The use of robots to reduce exposure of personnel at 
a nuclear plant is described by R.M. Taylor and Lewis 
(1987). They use the term ‘robot’ to include non-program- 
mable remotely operated manipulators and a large propor¬ 
tion of the robots used are evidently of this type. Three 
applications are described. One is a bagout facility robot 
and another is a sampling aisle robotic system. In both 
cases the point-to-point movement is programmed while 
the operator selects and monitors the sequence of moves. 
The third application is a large robotic system used to dis¬ 
mantle obsolete equipment. This consists of a five-axis 
manipulator integrated with a three-axis gantry serving a 
70x20x20ft work area. The operator can operate the 
manipulator by remote control as well as carry out 
sequences under automatic control. 

Robots may be used to relieve humans of tasks which 
involve a degree of hazard, and this is likely to be a princi¬ 
pal use in the process industries. They do, however, bring 
their own hazards in that a robot is both powered and cap¬ 
able of movement. 

HS(G) 43 deals primarily with the fixed ‘teach and play 
back’ type of robot. For the purposes of the treatment given, 
the guide takes the term to mean ‘ a manipulating device 
which is automatically controlled, is reprogrammable and 
is capable of serving a number of different purposes’. It 
deals with robot safety under the following headings: 
(1) safeguarding robot systems, (2) safety in design and 
manufacture, (3) safety during installation and commis¬ 
sioning, (4) safety during use, (5) safety during program¬ 
ming and (6) safety during maintenance. It also deals with 
training for robot safety and gives a number of appendices 
which cover inter alia hazard identification and risk 
assessment, safeguarding methods and case studies. 

The hazards posed by a fixed robot are those of a 
machine, essentially striking and trapping and entangle¬ 
ment. The characteristic problem with a robot is the reali¬ 
zation of these hazards due to aberrant behaviour. Two 
potential causes of such behaviour are power transients 
and program errors. 

The approach to the safeguarding of robot systems 
described in HS(G) 43 is based on: hazard identifica¬ 
tion, including failure modes and effects analysis; 
formulation of strategies of hazard elimination and miti¬ 
gation; definition of levels of integrity for the safety con¬ 
trols and interlocks; and risk assessment for the system as 
a whole. 

The conventic 

bed in BS 5304 and also BS 2771 and BS 6491 and PM 41, 
are in large part applicable to robots also. Their application 
is considered in Appedix 2 of the Guide. 

These may be complemented by critical examination of 
the need for close approach to the robot and the develop¬ 
ment of a suitable strategy for situations where close 
approach is unavoidable, the principal elements of which 
are that the robot should be operated at low speed and that 
its control should rest in the hands of the person who is to 
approach it. 
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There are a number of features which can be incorpo¬ 
rated in the design of a robot to minimize hazards. Trapping 
points should he avoided. Variable speed controls and a 
facility for single stepping should be provided and the 
control pendant ergonomically designed. The robot should 
have brakes and/or hydraulic stop valves to arrest move¬ 
ment. The arcs of movement of the robot’s arms should be 
restricted, and suitable stops, fixed or adjustable, provided. 
Another precaution is limitation on the forces which can be 
exerted by the arms. A gripper should be designed so that it 
can cope with the static and dynamic forces created by the 
load, including emergency stop, and so that it does not 
release the load on power failure. The design should pro¬ 
vide a parking position and should cater for the return of 
the robot to normal operation after different types of inter¬ 
ruption, with movement always being by a specified tra¬ 
jectory. The Guide also details numerous aspects of the 
design of the control pendant. The robot should be supplied 
with high quality documentation. Design aspects of the 
overall robot system include a layout to facilitate viewing 
and the use of interlocks. 

The robot system should be subject to suitable methods 
of hazard identification and risk assessment, as described 
in Appendix 1 of the Guide. The hazard identification 
should include a review of the states of the robot, its func¬ 
tions and its interaction with the plant. 

With respect to installation and commissioning aspects 
of robot safety, HS(G) 43 deals mainly with the develop¬ 
ment of safe working procedures. The safe use of a robot 
largely centres around control of access. A fixed robot 
generally operates in a ‘cell’, the access to which is con¬ 
trolled using appropriate methods of safe-guarding 
Appendix 2 of the Guide describes the various options. 
The approach taken follows that of BS 5304, which details 
the methods and gives an approach to selection based on the 
level of risk. Basic protection is provided by perimeter 
fencing and interlocks. Electrosensitive safety systems are 
available uitlizing various forms of proximity sensor such 
as photoelectric (PE) devices, capacitance devices and 
pressure sensitive mats. Other safety devices include: trips 
and emergency stops; brakes; positive stops; and enabling 
controls, or devices working on the dead man’s handle 
principle. A form of the latter suited to robots is the two- 
hand control, requiring the use of both hands, which it thus 
protects. 

Safety is also consideration in the programming of the 
robot. For this HS(G) 43 refers to the guidance given in the 
HSE PES Guide. 

Safe maintenance of a robot requires well thought-out 
maintenance procedures and precautions to prevent sud¬ 
den, unpredictable movements. 

Robot case studies given in HS(G) 43 include a robot 
serving in a machine installation, robot arc welding and 
robot water jetting. 


21.10 Flanged Joints 

21.10.1 Making joints 

The normal pipe joint on a process plant is the flanged joint, 
as described in Chapter 12. The two main varieties are the 
gasketed joint and the ring-type joint. For high pressures, 
the ring-type joint is used. 

Accounts of the making up of flanged joints, and in 
particular of bolt tightening, are given by Graves (1966), 
Briscoe (1976), K. Gibson (1986) and Garner (1993). 


The joint to be made up may be between two sections of 
pipe, between a section of pipe and equipment such as a 
vessel, valve or pump or between a section of pipe and a 
blind flange, closing off the end of the pipe. 

If the joint is a gasketed one, the surfaces of the flanges 
should be free of deterioration, clean, and the gasket used 
should be of the correct type. Metallic spiral wound gaskets 
are the most common type used. When a flanged joint is 
opened, the gasket should be not be reused. A new gasket 
should always be installed. 

In the case of a ring-type joint, the surfaces of the flanges 
should again be free of deterioration, clean, and the ring 
used should be of the correct type. New rings should 
always be used whenever the joint is opened. 

The bolts or studs used should be those specified in 
all relevant respects. They should be of the correct diameter, 
length and material of construction. The nuts likewise 
should be of the right material. Short bolting is not acceptable. 

The pipe or other equipment to which the flanges to be 
joined are attached should be properly supported and 
aligned so as to facilitate the making of the joint. 

In making up a flange, it is bad practice to tighten all the 
bolts on one side, then the bolts on the other side. The proper 
procedure is sequence tightening, which involves gradual 
tightening of the bolts following a criss-cross pattern. 

There are a number of methods of tightening the bolts. 
Taking the case of a ring-type joint, one is to screw the nuts 
on until they are finger tight. This method is suitable for 
attaching a blind flange for the purpose of keeping out dirt, 
but not as a method of making up a leak-tight flange. A 
flange may be made up hand tight by tightening with a 
wrench, a hammer wrench and hammer or with an impact. 

The bolt tightness obtained by such methods are vari¬ 
able and there is a trend to the use of more sophisticated 
methods, as described by K. Gibson (1986). Three basic 
methods are available, two involving cold tightening and 
one hot tightening. The first cold tightening method is the 
regular one of rotating the nut against the thread helix 
angle. The other is to stretch the bolt longitudinally, index 
the nut and release the stretching load. The hot tightening 
method is to heat the bolt, causing it to undergo thermal 
expansion, index the nut and let the bolt cool down. 

There are a variety of tightening tools available. They 
include: traditional wrenches and torque wrenches, where 
the applied torque varies with the length of the lever arm; 
impact wrenches, either hydraulic or pneumatic; pneu¬ 
matic torque multipliers; and hydraulic torque wrenches. 
There are various bolt stretching devices, notably direct- 
acting bolt tensioners. Likewise, there are a variety of 
techniques for measuring bolt stress. One of the simplest is 
the micrometer, which measures strain, from which stress 
may then be calculated. 

In order to stretch a bolt accurately by a torque method, it 
is necessary to exercise accurate control of the torque and 
to know the coefficient of friction of the thread and nut-set 
interfaces. Alternatively, the tension may be determined by 
measurement as just described. 

As indicated, a bolt or stud has a design pre-tension or 
pre-stress. This pre-stress should be such that the bolt is 
not stretched beyond the elastic limit. In this condition, the 
bolt acts like a spring. It then exerts on the flange the rated 
damping force. If the pre-stress is too low, the bolt may 
work loose. If it is too high, the bolt may yield or fracture. 

The pre-stress is obtained by the application of torque. 
However, as indicated, a large proportion of the torque is 
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lost in friction of the thread, under the bolt head and/or the 
seating surface of the nut. Garner (1993) estimates this 
proportion as 60-90%. The bolt manufacturer provides 
data on the relation between torque and pre-stress, 
but these are necessarily based on average values for the 
friction. 

Lubrication may be used to reduce the friction and to give 
more uniform tensioning. The lubricant should be matched 
to the application, selection being a specialist matter. 

A particular problem in bolt tightening is that of leaks 
on heat exchangers, which is discussed by Briscoe (1976). 
He quotes the results of experiments using both hand 
wrenches and hammer wrenches, showing the unreliability 
of standard torque-tension relations. On one of his graphs 
the lowest stress is 43,000 psi and the highest 120,000 psi. 
He indicates that in heat exchanger work for studs larger 
than 1 in. diameter the only method found to be reliable is 
hydraulic stud tensioning. 

There are a number of problems with studs on heat 
exchanger flanges. One is differential expansion of the 
flange itself and of the stud, equivalent in the example 
quoted to a differential force of 21,000 psi. Another is the 
difference in the temperatures of studs at different posi¬ 
tions on the flange, with the air beneath the flange cold but 
that above it hot; in one case quoted, the temperatures of 
the studs at the 6 and 12 o’clock positions were 220°F and 
440°F, respectively, which is equivalent to a differential 
force of more than 45,000 psi. Another feature is the effect 
of insulation on stud temperature. 

Live loading of flanged joints has become a common 
practice to maintain the required bolt tension to keep the 
gasket seal pressure substantially above the required 
minimum. Live loading prevents flange leakage due to high 
temperatures and varying pressure and temperature. On 
26 May 1983 at Bloomfield, New Mexico, a compressor head 
gasket ruptured, resulting in a gas leak and an explosion in 
the compressor house (Case History A105). The investiga¬ 
tion report (NTSB, 1983 PAR-83-04) found that the bolts 
on the compressor head flange had been improperly tight¬ 
ened and that there were wide variations in the bolt tight¬ 
ness. One of the potential leak scenarios considered at this 
inquiry was a leak due to failure of bolts on the reciprocat¬ 
ing compressors (Bett, 1989). Inspections in the first half 
of 1988 revealed that on one cylinder on the A machine, 
7 stud bolts out of 16 had failed. The condition was 
described by the expert witness as potentially serious. 
An inspection of a cylinder on the B machine 4 months 
later found 5 failed bolts. 

The leak-tightness of a blind flange on the end of a pipe 
was a key issue at the Piper Alpha Inquiry (Cullen, 1990). 
Evidence given included: an account of the making up of a 
joint, and in particular the different methods of bolt tight¬ 
ening (Ritchie, 1989; Whalley, 1989); experimental meas¬ 
urements of bolt stretch vs torque, which illustrated the 
variability of the bolt extensions (Davie, 1989); and mea¬ 
surement of the torques obtained by hand tightening and 
by hammering up (Standen, 1989). 

Defects in flanged joints include: the use of incorrect or 
defective bolts, studs or nuts; the use of incorrect or defec¬ 
tive gaskets or rings; undertightening of the bolts so that 
the joint is not leak-tight; overtightening of the bolts so that 
they are overstretched; and subjecting the bolts to addi¬ 
tional stresses. 

It is not unusual for a flanged joint to leak. A common 
response is to tighten the bolts. This may be effective if the 


bolts were loose in the first place. However, further tight¬ 
ening of bolts which were correctly tensioned originally is 
bad practice. The National Transportation Safety Board 
(NTSB) report states: 

Bolted assemblies should not be tightened under pres¬ 
sure. Never ‘tighten down’ a leaking gasket in an assem¬ 
bly that is properly torqued. The assembly should be 
taken apart and inspected for causes of the leak and a new 
gasket installed on reassembly. 

Another incorrect response to a leaking flange is the use 
of larger, strong bolts. As explained by Graves (1966), this 
is liable to make the flange bow and to exacerbate the leak. 

21.10.2 Breaking joints 

Breaking into a line can involve a number of hazards 
and it is necessary to exercise considerable care. OSHA 
Process Safety Management 1910.119(o) requires safe work 
practices for opening process equipment or piping. Safe 
methods for the breaking of pipelines are described in 
Safety in Inspection and Maintenance of Chemical Plant 
(BCISC, 1959/3). 

For the breaking of a line there should be clear instruc¬ 
tions on the work and on the area in which it is to be done. 
Information should be given on the material in the line and 
its hazards, and on the precautions to be taken. The joint to 
be broken should be indicated by an identification tag. The 
work is normally covered by a permit. 

Some preliminary measures and precautions include: 

(1) isolation of the working area and posting of warning 
notices; 

(2) provision of safe access; 

(3) support of the pipe on either side of the joint; 

(4) isolation of the pipe section; 

(5) release of pressure from the pipe section; 

(6) draining of the pipe section and disposal of the fluid 
drained; 

(7) precautions against fire; 

(8) protection of personnel. 

The joint to be broken should be isolated. Pumps and 
other devices which could put the joint under pressure 
should be switched off and locked out. Measures should be 
taken to release the pressure in the line. 

It should be assumed, however, that the pipe may be full 
and under pressure, and precautions should be taken 
accordingly. In particular, it may be necessary to use pro¬ 
tective hoods or equivalent equipment. 

There is a correct way to break a joint. The principle is 
to loosen adjacent nuts and bolts first so that they can be 
retightened quickly if necessary. The loosening should be 
done slowly and continuously. The preferred sequence is 
shown in Figure 21.5. Bolt 1, which is the furthest away, 
is slackened first, then bolts 2 and 3. Bolt 4, which is the 
nearest, should not be slackened until the wedge has been 
used to open the joint and drain the line completely. 

Some joints are difficult to break and thus constitute a 
potential hazard. A persistently troublesome joint should 
be reported by the maintenance personnel. An alert super¬ 
visor will recognize such a joint as a problem. 

The piping designer also has a contribution to make by 
building into the design enough ‘spring’ to facilitate the 
breaking of joints which must be broken frequently. Alter¬ 
natively, a swing blind may be installed. 
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Figure 21.5 Sequence of operations in breaking 
a flanged joint 


It can occur that a bolt, or stud, breaks while it is being 
undone. The correct procedure for dealing with a broken 
bolt, in a single isolation situation, is to replace it with a 
new one before proceeding. 

The danger of not following this procedure is illustrated 
by the following incident (Anon., 1977 LPB14, p. 2), which 
occurred during the breaking of a flange on a liquefied 
petroleum gas (LPG) main at 200 psig. As the joint was 
being broken, a first stud snapped, the opposite one was 
tried and also snapped. A third one was attempted but 
broke also, whereupon the fourth stud sheared. The single 
isolation, which had been tested and was thought to be 
good, did not prevent a release of liquid. 

After breaking, a line is sometimes found to be plugged. 
The blockage may be removed by means such as digging it 
out. It is not good practice to clear blockages by using air or 
gas pressure. The danger here is that the plug of material 
will be ejected as a projectile. 

After breaking, the ends of lines should be blinded off. 

21.10.3 Breaking joints on valves 

A particular hazard occurs on certain types of valve, where 
a joint containing the process fluid is liable to be broken in 
error. An account of this hazard is given by Kletz (1982f, 
19841). 

Some situations where this hazard has been realized are 
shown in Figure 21.6. In the incident on the valve shown in 
Figure 21.6(a), the fitter was required to remove the valve 
actuator, secured on a stud which also held in place the 
valve bonnet; the latter was removed by mistake. Figure 
21.6(b) illustrates the valve involved in another incident. In 
this case, it was intended that the air motor should be 
removed, but the joint on the valve itself was undone. In the 
third incident, on the valve shown in Figure 21.6(c), the fit¬ 
ter removed a piece which he thought was an adaptor but 
which was in fact a integral part of the valve itself. 

21.11 Hot Work 

Hot work such as welding and cutting is a common activity 
on process equipment, but involves potential hazards 
both to equipment and personnel, and needs to be closely 
controlled. OSHA 1910.119(k) requires a hot work permit 
and 1910 Subpart Q provides general requirements for 
welding, cutting and brazing operations. Additional guid¬ 
ance is provided by API RP 2009: Safe Welding, Cutting and 


other Hot Work Practices in the Petroleum and Petrochemical 
Industries, API Publ. 2201: Procedures for Welding or Hot 
Tapping on Equipment in Service, API RP 1107:1991 Pipe¬ 
line Maintenance Welding Practices and NFPA 51B: 1999 
Cutting and Welding Processes. Also relevant is HS(G) 5 Hot 
Work (HSE, 1979) (the HSE Hot Work Guide). 

The HSE Hot Work Guide deals with hot work opera¬ 
tions under the following headings: (1) general principles, 
(2) environment, (3) equipment, (4) methods, (5) operations 
in buildings, (6) limitation of operations, (7) prohibited opera¬ 
tions, (8) welding technology, (9) control of operations 
and (10) procedure. It includes appendices on the regula¬ 
tory requirements, various types of seal plug, welding on 
water-sealed and waterless gas holders and flammable gas 
detectors. 

The Guide deals particularly with welding operations 
on equipments containing flammable fluids, which is 
also the aspect of hot work of principal concern here. The 
welding should be confined to manual electric arc methods. 

The welding methods described in the Guide require for 
their safe performance strict adherence to the procedures 
laid down. The account given here draws on the Guide, but 
is no more than an outline. The Guide itself should be con¬ 
sulted for the conduct of such welding operations. 

Welding as such is treated in Chapter 12 and the personal 
safety aspects of welding are discussed in Chapter 25. 

21.11.1 Regulatory requirements 

Welding operations are covered by Section 31(4) of the 
Factories Act 1961, which states: 

No plant, tank or vessel which contains or has con¬ 
tained any explosive or inflammable substance shall 

be subjected 

(a) to any welding, brazing or soldering operation; 

(b) to any cutting operation which involves the appli¬ 
cation of heat; 

(c) to any operation involving the application of heat for 
the purpose of taking apart or removing the plant, 
tank or vessel or any part of it; until all practicable 
steps have been taken to remove the substance and 
any fumes arising from it, or to render them non¬ 
explosive or non-inflammable; and if any plant, 
tank or vessel has been subjected to any such 
operation, no explosive or inflammable substance 
shall be allowed to enter the plant, tank or vessel 
until the metal has cooled sufficiently to prevent 
any risk of igniting the substance. 

Section 31(5) provides that, where he is satisfied that 
compliance is unnecessary or impracticable, the Chief 
Inspector may grant exemption from any of the above 
requirements by the issue of a certificate, which may con¬ 
tain conditions. 

21.11.2 Control of welding operations 

The welding operations should be controlled by a permit 
system. The general arrangements of a permit system are 
described in Section 21.8, but certain points of particular 
relevance to welding merit mention. 

The issuing authority should have both the knowledge 
required to appreciate the hazards of the work and the pre¬ 
cautions to be taken and the authority necessary to draw 
on and coordinate specialist expertise. The permit should 
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Figure 21.6 Some valve types involved in joint breaking incidents (Kletz, 19841): (a) valve and actuator, held 
by same bolts; (b) valve and actuator, held by separate bolts; (c) valve with adaptor - an integral part of 
valve (Courtesy of the Institution of Chemical Engineers) 
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specify clearly, and in detail, the date and time authorized 
for hot work, the equipment on which the work is to be done, 
the precise nature of the operation, the weld point, and fire 
prevention and protection requirements. The issuing 
authority should inspect the work site to ensure that 
all necessary precautions are in place. A full explanation of 
the work, the hazards and the precautions to be taken 
is particularly necessary where the work is to be done by 
contractors. 

21.11.3 Precautions for welding operations 

A principal hazard of welding is that it introduces a source 
of ignition. If the work is to be done at a location where this 
fact is significant, and particularly within a classified 
hazardous area where sources of ignition are normally 
excluded, this should be entered on the permit and special 
precautions taken. 

The welding site should be free of flammables, whether 
gases, liquids or solids. The atmosphere to a radius of 45 ft 
(15 m) and to a height of 6 ft (2 m) above ground level or 
above the point at which welding is to be done, whichever is 
the greater, should be free of flammable gas. The surfaces 
of the surrounding equipment should be free of flamm¬ 
able deposits. There should be no flammable liquids on 
the ground within a radius of 45 ft (15 m). Drains over the 
same area should be covered. It may also be necessary to 
provide shielding to contain weld spatter. 

The equipment to be worked on should normally be 
isolated, emptied and cleaned, tested for flammables and 
inspected before welding is undertaken. There are certain 
procedures which are exceptions, as described below, but 
they in no way weaken this general rule. 

There should be good access to the welding site for the 
welders and equipment and also for emergency services. For 
elevated locations, suitable staging and scaffolding should 
be provided, again with good access. There should be ade¬ 
quate lighting. For welding on underground pipelines, an 
excavation should be made of sufficient size, with adequate 
shoring, ladder access and secondary means of escape. 

For welding in any confined space, including an excava¬ 
tion, there should be ventilation sufficient to ensure dis¬ 
persion of fumes. 

Suitable protective clothing should be provided for all 
persons involved in the welding operation. There should 
be present as a'fire watch’at least one person, who should be 
provided with fire extinguishers, the dry powder typebeing 
generally used. First aid equipment such as breathing 
apparatus and resuscitation equipment should be to hand. 

Personal safety in welding operations is considered in 
Chapter 25. 

21.11.4 Welding on equipment containing 
flammable fluids 

The conditions under which welding may be carried out on 
equipment containing flammable fluids are defined in API 
2201 and HSE Hot Work Guide. 

For welding on the external surface of equipment 
containing a flammable liquid, the metal at the location of the 
weld should be wetted by liquid. For welding on the external 
surface of a tank, the weld should be below the liquid level 
and for welding on a pipeline, the pipeline should be full of 
liquid. In the latter case it is also necessary to ensure that 
abnormal pressures cannot arise due to the generation of 
vapour or expansion of the liquid. The usual method of 
avoiding this is to maintain a liquid flow that is high enough 


topreventoverheatingbutnotsohighasto cause overcooling; 
a liquid velocity of at least 3 ft/s (1 m/s) is usually required. 
Measures should be taken to ensure that penetration of the 
metal does not occur. These include ensuring that the 
thickness of the metal in the area of the weld is sufficient 
and that the welding is performed properly. 

Where welding is to be done on the internal surface of 
equipment, which has contained a flammable liquid, pre¬ 
cautions should be taken to ensure that the surfaces are 
free of deposits and that no liquid is trapped in hollow mem¬ 
bers or behind metal linings or wear plates. Trapped liquid 
should be released by drilling suitable holes and the space 
purged with steam, air or inert gas, as appropriate. 

Welding on the equipment containing a flammable gas 
involves a higher potential hazard in that the gas has a 
much lower capacity for the removal of heat than does 
liquid. There is, thus, a greater risk of overheating which 
may result in penetration by the welding operation or rup¬ 
ture due to the internal pressure. The operating pressure 
and temperature should he adjusted to allow for this. 

21.11.5 Methods of temporary isolation 

Some of the welding operations described below require 
the temporary isolation of a section of pipe. Where possible, 
isolation should be accomplished by conventional means, 
but in some cases it is necessary to use seal plugs or 
bag seals. 

Four types of seal are used. These are (1) atmospheric 
seal plugs, (2) high pressure stopple or seal plugs, (3) frozen 
product seal plugs and (4) bag seals. 

An atmospheric seal plug is inserted into the open end of 
a pipe which has been isolated by other means, drained and 
cold cut, but which has not been cleaned along its entire 
length and into which flammable liquid or gas may leak. It 
consists of a rubber sealing ring compressed between two 
discs so as to provide a peripheral seal against the inside of 
the pipe. It provides isolation between the welding point 
and the empty line. 

A high pressure stopple is inserted into an operating 
pipeline, usingastoppleinsertionunit.Thereareanumberof 
designs of such seal plugs. The insertion of two highpressure 
stopples allows a section of pipe to be isolated. 

A frozen product seal plug is created by freezing the 
liquid in a section of the line, using a freezing mixture, 
commonly of solid carbon dioxide and isopropanol. Where 
the liquid cannot be frozen in this way, it may be possible to 
use the alternative method of replacing it with water which 
can then be frozen. 

A bag seal is inserted into an operating gas pipeline 
through a bag tube. The bag consists of an inflatable rubber 
bladder with an outer fabric cover. Bag seals are used only 
for pipelines containing gases at low pressure. 

Full details of each of these seal methods, of their 
applicability and limitations, and of the precautions to be 
taken in their use are given by numerous companies sup¬ 
plying these services and in the HSE Hot Work Guide. 

21.11.6 Welding on operating pipes/pipelines 

API 2201,1107 and the HSE Hot Work Guide describes the 
method to be followed in welding operations on pipelines 
carrying flammable fluids. They deal primarily with weld¬ 
ing on a pipeline for the purpose of replacing a length of 
pipe. It treats both the case where the pipeline has to remain 
in operation and that where it can be taken out of service. 



21/30 EQUIPMENT MAINTENANCE AND MODIFICATION 


For the former case, the method described is to isolate the 
section of pipeline on either side of the pipe section to be 
replaced. If the isolations cannot be achieved by conven¬ 
tional means, use may be made of a suitable seal plug. This 
will often be a high pressure seal plug. The method of 
inserting such a seal plug is broadly as follows. A stub 
connection is welded to the pipeline, a special valve is 
mounted on the connection and the drill is mounted on the 
valve. A check is made to ensure that the fittings and welds 
can withstand the pipeline pressure. The valve is then 
opened, the drilling is done, the drill is withdrawn again, 
the valve is closed and the drill is removed. The stopple 
insertion unit is mounted and the stopple inserted. If the 
flow is to be maintained, this may be done by putting in 
first a temporary bypass, again by welding on stub con¬ 
nections and tapping in a similar manner, and joining the 
bypass pipe on by a flanged or welded joint. Further stubs 
are welded on to the pipe section to take vent and drain 
connections and these are tapped. The arrangement is 
illustrated in Figure 21.7. The pipe section is drained and 
vented and a check is made that the stopples are making 
satisfactory seals. The pipe section is then removed, which 
should be done by cold cutting; this does not include the use 
of an abrasive wheel. The pipe ends are cleaned and the new 
section of pipe is then fitted, either with flanged or welded 
joints. If there is to be a delay before the pipe section is fit¬ 
ted, the open ends should be sealed with atmospheric seal 
plugs or bag seals and the space behind these seals vented 
by flexible hose to a safe area. 

A permanent branch connection may he installed to an 
operating pipeline in a manner essentially similar to that 
just described for installing a temporary bypass, and a 
valve or flowmeter may be installed in a manner similar to 
that described for installing a new section of pipe. 

Another case is where the pipeline can be taken out of 
service and the section of pipeline isolated and drained, but 
it is not practical to clean and purge it over its whole length. 
In this case, the isolations should be checked and the 
line drilled to ensure it is depressurized to atmospheric 
pressure. The pipe section is then removed by cold cutting. 
As before, the pipe ends are cleaned and the new section of 
pipe is then installed, with fitting of seals and venting 


of the space behind them if installation of the new pipe 
section is to he delayed. 

Yet another case is where it is necessary to make a repair 
on an operating pipeline to counter internal or external cor¬ 
rosion. It is sometimes possible to use a mechanical clamp, 
but often the only recourse is to weld over the affected area 
a patch or leak box. 

21.11.7 Limitations and prohibitions on welding 
operations 

There are a number of limitations on the welding opera¬ 
tions on equipment containing flammable fluids. Welding 
should not generally be carried out on equipment where the 
metal thickness is less than 0.2 in. (5 mm); on the external 
surface of a tank at a point less than 3 ft (1 m) below the 
liquid surface, or on equipment at a temperature below 
45°F (7°C), unless it can be shown to be safe to do so. 

Welding on a pipeline should not be undertaken where 
the operating pressure and temperature exceed those 
which ensure that the thickness and strength of the metal 
are such as to preclude failure and that the strength 
remains unaffected on cooling. 

Welding should not be done on the vent and blowdown 
systems of operating equipment, unless it can be shown to 
be safe to do so. Such systems should not be isolated while 
the equipment is operating unless alternative arrange¬ 
ments have been made. 

There are also a number of prohibitions on welding 
operations on equipment containing flammable fluids. 
Welding should not be carried out where: either the equip¬ 
ment contains a flammable mixture or the welding itself 
may create one; the equipment contains a substance liable 
to undergo reaction or decomposition; or the equipment con¬ 
tains either compressed air or an oxygen-enriched mixture 
together with hydrocarbons deposited on internal surfaces 
or otherwise present. 

Furthermore, welding should not be carried out on: 
equipment in ferritic steel containing gas in which the 
partial pressure of hydrogen exceeds 100 psi (7 bar), unless 
it can be shown by tests to be safe to do so; equipment in a 
material susceptible to stress corrosion cracking, unless 
appropriate stress relief treatment can be given; equipment 



Figure 21.7 Arrangement for welding on an operating pipeline (HSE, 1979 HS(G) 5) (Courtesy of HM Stationery 
Office. Copyright. All rights reserved) 
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for which post-weld heat treatment is necessary; equip¬ 
ment designed to advanced, or high stress, codes; or any 
part of a flare system over which effective control cannot 
be exercised. 

There is an extreme hazard of welding on equipment 
containing pure liquid or gaseous oxygen. For equipment 
containing high purity ethylene gas it had been demon¬ 
strated that welding may be safely done at pressures up to 
400 psi (28 bar) and temperatures up to 300°F (150°C) and 
that work was continuing on this topic. 

21.11.8 Procedures for welding operations 

The HSE Hot Work Guide gives the procedures to be fol¬ 
lowed in welding operations on a pipeline in the form of 
a checklist, under the headings of: (1) initial planning of 
operations, (2) site preparations, (3) stand hy services, 
(4) pipeline preparation, (5) fitting alignment, (6) welding 
procedure, (7) action immediately prior to welding, (8) act¬ 
ion during welding, (9) integrity of the completed weld and 
(10) final completion. 

The initial planning covers: inspections on regulatory 
requirements and company codes; notifications to external 
interested parties; reviews of the process conditions, of the 
condition the pipeline, of the fittings and consumables and 
of the site conditions; lists of the fittings, equipment, and 
services required, plans of the site; sketches of the work; 
a list and plan of emergency procedures; and preparation for 
the issue of the permit. The site preparations are essentially 
the precautions given in Section 21.11.3, but include also the 
provision of adequate supports for the pipeline, fittings and 
any other equipment, and removal of groundwater where 
necessary, likewise, the stand by services to be provided as 
appropriate are those mentioned in that section. 

The pipeline preparations include checking the material 
of construction of the pipeline, removing insulation, clean¬ 
ing the surface, checking the roundness, measuring the 
wall thickness, examining the external condition, investi¬ 
gating where necessary the internal condition, and grind¬ 
ing flush any external weld which might interfere with a 
flush fitting. 

The fittings alignment requires that the fittings be cor¬ 
rectly positioned and aligned, the pipeline and fittings 
adequately supported, and the weld preparation and the 
clearances checked. The welding procedures cover the 
competence and approval testing of welders, the routing of 
the welding cables though areas free of flammable gases 
and liquids, the condition of these cables, and the clamping 
of the return current cable close to the weld point. 

The actions immediately prior to welding are to confirm 
the identity of the pipeline to be welded, the pipeline oper¬ 
ating conditions, the welder and welding supervisor’s 
understanding of the work to be done, the temperature of 
the pipe wall and fitting, the welding current and com¬ 
pliance with the permit. The actions during welding are to 
monitor the pipeline operating conditions and the absence 
of flammables in the environment. 

The integrity of the completed weld should be such that it 
is able to withstand any operating conditions to which the 
pipeline may be subject, after heat treatment where neces¬ 
sary. The integrity of the weld should be checked by some 
suitable means. Reference is made to hydraulic pressure 
testing, pneumatic leak testing and non-destructive testing. 
Where the latter is used, the acceptance standards utilized 
should be stated.Where pressure testing is used, care should 
be taken to avoid over pressurizing the pipeline itself. 


The final completion consists of the usual termination 
procedures: a check that the site is left free of hazards, 
notification to interested parties that the work is complete 
and signoff of the permit. 

21.11.9 Hot tapping 

The procedure of fitting a branch onto a pipeline which is 
still operational is known as hot tapping. This procedure 
has already been described in outline but is of sufficient 
importance to merit further discussion. As already stated, 
guidance is available in API RP 2201, RP1107 and the HSE 
Hot Work Guide. 

Several of the accounts on hot tapping published in the 
mid-1970s provide useful background information. They 
include those of Elder and Batten (1975), Hahn (1975), 
W.B. Howard (1975a), Howden (1975), Letchford (1975) and 
Warren (1975a). Howden (1975) describes a long-term pro¬ 
gramme of work on hot tapping in the American Gas 
Association (AGA) line Pipe Research programme at the 
Battelle Columbus Laboratories. Guidelines produced by 
the American Society of Mechanical Engineers (ASME) 
Gas Piping Standards Committee are outlined by Elder 
and Batten (1975). The development of a code of practice 
for hot tapping has been described by Letchford (1975) of 
British Gas. 

It is expensive to shut-down units or equipment and 
there is a strong economic incentive to make the modifica¬ 
tion when the equipment is in service. Nevertheless, hot 
tapping should be avoided as far as possible and should 
only be done in essential cases. 

The Factories Act 1961, Section 31(4), quoted above, for¬ 
bids work on plant, tanks or vessels containing any explo¬ 
sive or flammable substance which entails the application 
of heat until all practicable steps have been taken to remove 
the substance and any fumes arising from it and to render it 
non-explosive or non-flammable. 

If air or other oxidizing substance is excluded from 
equipment which contains a fluid that can burn or explode 
when mixed with air, then the fluid may be regarded as non¬ 
explosive and non-flammable. Such exclusion is the basis 
for the justification of hot tapping as an industrial practice 
(Hahn, 1975). 

There are several hazards in hot tapping. One is that 
there will be a leak during the hot tapping operation itself. 
This is most likely to result from welding, but could also 
occur if the hot tap valve or tapping machine were to fail or 
if the tapping machine were to pierce the pipe on the far 
side. Another hazard is the explosive decomposition of the 
fluid in the pipe due to the heat applied during the welding. 
A third hazard is the failure of the modified equipment at 
some later date. There are also the usual hazards of welding 
on the equipment. 

The normal hot tapping arrangement is shown in 
Figure 21.8. A branch is welded onto the pipe, a valve is put 
on the branch and a tapping machine is used to drill via the 
valve and branch into the pipe. 

Hot tapping requires careful preparation, including 
consideration of the following factors: 

(1) the process fluid and the process design operating 
conditions in the pipeline; 

(2) the process operating conditions at the start of work; 

(3) the material of construction, the dimensions and the 
condition of the pipeline; 

(4) welding constraints, preparations and procedures; 
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(5) the fittings and equipment required for the work; 

(6) the services required for the work; 

(7) theequipmentoperationalproceduresandprecautions; 

(8) the permit systems, notification to third parties and 
emergency arrangements. 

If possible, the pipeline should be taken out of service to 
make the hot tap. Where this cannot be done, the operating 
pressure above atmospheric should be reduced as far as 
possible while the work is being done so that the hazard is 
also reduced. 

The material of construction, the thickness and the 
condition of the pipe to be welded should be thoroughly 
checked. The material of construction is important for 
strength calculations and for the selection of welding elec¬ 
trodes. There is a minimum thickness below which the pipe 
should not be welded. Welding should not be carried out if 
the condition of the pipe has deteriorated so as to make 
operation unsafe, and the pipeline should be thoroughly 
checked by non-destructive testing (NDT). 

Some guidelines on what is and what is not permitted in 
one company, ICI, have been given by Hahn (1975). Basi¬ 
cally, these restrict hot tapping to the following conditions: 

(1) pipelines to be made of specified grades of steel; 

(2) pipe wall thickness to be not less than 0.22 in.; 

(3) process fluid pressure to be not greater than 550 psig 
and not less than atmospheric; if hydrogen is present, 
the partial pressure to be not greater than 100 psig; 

(4) process fluid temperature to be between 7°C and 370°C 
throughout the operation; preheating by steam or 
electrical methods, but not flame heating, to be used as 
necessary to achieve this; 

(5) welding not to be done on lines containing 

(a) oxygen (except under 1%), 

(b) compressed air, 

(c) decomposables, 

(d) caustic soda, 

(e) process materials which could cause hardening 
by reaction with hot metals to a dangerous degree. 

Hahn also discusses the extent to which these basic 
restrictions can be modified and states the conditions 
under which his company would do hot tapping on low 


alloy steels, on thinner pipes, at higher pressures and 
outside the given temperature range. On the other hand, he 
also gives certain limits which would not be overridden: 
welding would not be done on oxygen or chlorine pipes, 
because steel can burn in these materials, nor on com¬ 
pressed air lines, which often contain oil or carbon deposits 
that might ignite if heat were applied to the pipe. Areas 
of doubt which he discusses are pipelines containing 
ethylene and those containing hydrogen above 100 psig 
partial pressure. 

The problem of ethylene decomposition during welding 
on ethylene pipelines is considered by W.B. Howard (1975a), 
who describes experiments to determine the process 
conditions under which hot tapping may be regarded 
as safe. Hahn states that his company has gone from a 
policy of permitting such work to a complete ban and thence 
to a partial relaxation of the ban. It is of interest that during 
the period of the complete ban, a method was developed 
for bonding fittings in place using epoxy resins. 

With regard to hydrogen, Hahn suggests that the hazard 
which is a greater limitation than that associated with 
hydrogen partial pressure is that the red hot part of the 
heat-affected zone may reach the pipe internal surface with 
the result that the hydrogen diffuses rapidly through the 
weld pool, so that weld cracking occurs. 

The welding work has several important aspects. The 
welding is done by the electric arc method. The welding 
procedure should be defined in respect of the electrode 
selection, the welding technique, the preheat and the post¬ 
weld treatment, if any. 

Preheat may be provided by steam or electrical methods. 
Different views have been expressed on the advisability of 
flame heating. The ICI instructions described by Hahn state 
that it should on no account be used. On the other hand, 
Letchford describes its use in British Gas. 

The surfaces to be welded should be uniform and free 
of pipe coating, rust, scale, oilandmoisture.Thepipeshould 
be supported on both sides of the section to be welded. 

The welding current should be checked. The ammeter on 
the welding set is not always reliable. It is usually required 
that the meter be checked using scrap material. The pipe 
should he completely grounded and the risk of arcing at the 
ground clamp eliminated. 

The welders should be fully qualified, experienced and 
reliable, and should wear appropriate protective clothing. 

If the weather conditions are bad, the welding should be 
stopped. 

There can be a significant cooling effect from the gas 
flow. This may require the use of higher welding current 
to overcome this cooling effect. It can also result in cra¬ 
cking due to the quench effect when the source of heat is 
removed. 

The hot tap valve requires special attention. Such a valve 
may be subjected to pressure and temperature shocks and 
its integrity should be assured. The valve should be new. It 
should be given NDT, pressure and leak tests. 

The hot tapping equipment should also be carefully 
checked. This check should again include NDT and pres¬ 
sure testing and tests on the cutter teeth and pilot drive. 

The equipment operational procedures and precautions 
which should be taken during hot tapping were described 
in Chapter 20 as an illustration of the role of plant man¬ 
agement during plant work. 

Hot tapping is a complex operation which is potentially 
hazardous, but which can be done safely if the correct 
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practices are followed. It is emphasized, however, that hot 
tapping is a matter for specialists. 

21.12 Tank Cleaning, Repair and Demolition 

A set of operations of some importance in the maintenance 
of equipment is the cleaning, repair and demolition of tanks 
for storage of flammable liquids. Guidance is given in 
OSH A 1910.146: Permit Required Confined Space, API Std 
2015: Requirements for Safe Entry and Cleaning of Petroleum 
Storage Tanks, API Std 653: Tank Inspection, Repair, 
Alteration, and Reconstruction, NFPA 326: Safeguarding of 
Tanks and Containers for Entry, Cleaning and Repair, CS15 
The Cleaning and Gas Freeing of Tanks Containing Flam¬ 
mable Residues (HSE, 1985). 

21.12.1 Preparation for entry or hot work 

Two principal purposes for which entry into a tank is 
required are inspection and repair or modification, which 
usually involves hot work. 

It cannot be assumed that a tank which has been emptied 
and gas freed, or even one which has been cleaned with 
a water wash, is completely free of flammable or toxic 
gas. Before entry, ventilation of the tank should be estab¬ 
lished, the atmosphere should be gas tested to be free of 
flammable or toxic gas, and repeat gas tests should be made 
at intervals to confirm that the atmosphere is still gas free. 
On entry, a check should be made for potentially hazardous 
residues. 

Ventilation and monitoring of the atmosphere in the tank 
should continue and personnel should not remain inside if 
the concentration of flammables rises to over 25% of the 
lower flammability limit. The source of the vapours must 
be located and controlled. 

If it is not possible to establish a safe atmosphere in the 
tank, entry may be made using breathing apparatus. 

Before hot work is undertaken, a thorough inspection 
should be made for hazardous residues and any such resi¬ 
dues first removed by cleaning. Gas testing should also be 
performed. 

It may be possible, particularly for smaller tanks, to 
avoid the need for hot work by cold repair techniques such 
as the use, where suitable, of materials based on epoxy 
resins, fibre glass or elastomers. Care should be taken not to 
incorporate into the tank structure elements which 
increase the hazard from static electricity. 

21.12.2 Gas freeing of tanks 

Methods of gas freeing are described in Section 21.6. They 
are forced ventilation, water washing and steam cleaning. 
Particularly with large tanks, the gas freeing or cleaning 
operation may involve the venting of quantities of flam¬ 
mable or toxic vapour, which is often denser than air, and 
therefore liable to collect at low points and poorly venti¬ 
lated areas. Such operations should not be performed 
unless suitable precautions have been taken to disperse the 
gas and exclude ignition sources. 

In some cases the operations will evolve quantities of 
flammable vapour sufficient to require measures to control 
its dispersion. Flammable purge gas mixture is sometimes 
burned off at an elevated vent stack, fitted with a pilot 
flame and a flame arrester to prevent flashback. Where 
large equipment, and therefore large volumes of flammable 
vapour, are involved, the dispersion of the vapour should 
be monitored, by measurement if necessary, and venting 


suspended if the vapour fails to disperse. Other precau¬ 
tions required include the covering off of drains and sewers 
to prevent ingress of vapours and restriction of access to 
the area. It may also be necessary to take measures to pre¬ 
vent ingress of vapour into buildings. 

21.12.3 Emptying of liquid from equipment 

Liquid should be emptied into a suitable receiver. Large 
equipment is typically pumped out, while small vessels 
may be drained. 

A particular technique used to flush out light hydro¬ 
carbons from a tank bottom is to introduce water and raise 
the hydrocarbons to the level of the suction line so that they 
can be pumped out. Care is needed to avoid generating static 
electricity either by high fluid velocities or by splashing, 
bearing in mind the enhancing effect of the water content on 
the generation of static electricity in liquid hydrocarbons. 

Where a vessel has an external jacket for the circulation 
of a flammable heat transfer liquid, it is suggested that this 
may be drained out and replaced with water, maintaining a 
vent open to the atmosphere to prevent any pressure build¬ 
up during hot work. 

Suitable measures should be taken to ensure that ancil¬ 
lary equipment does not constitute a hazard. Ionizing 
radiation sources should be locked out and removed by a 
competent person. Stirrers and heaters should be isolated. 
Cathodic protection should have its power supply isolated 
12 hours in advance so that depolarization occurs. Where it 
is necessary to maintain heating from steam coils or an 
electric immersion heater in order to assist pumping out of 
the liquid, the heat input should be isolated before the 
liquid falls to within 1.5 ft (0.5 m) of the heating surfaces or 
temperature sensors. 

21.12.4 Ignition at equipment 

Precautions should be taken to ensure that ignition of flam¬ 
mables does not occur. The main precautions are the elim¬ 
ination of a flammable mixture and the avoidance of hot 
work where there may be flammable residues; but where 
there are flammables which might be ignited, control of 
ignition sources should be exercised. Ignition sources and 
situations which are particularly relevant to equipment are: 
direct flames from hot work; hot surfaces occurring due to 
hot work; self-heating of oil-soaked insulation; and pyr¬ 
ophoric iron sulfide. Hot surfaces may cause ignition either 
by hot surface ignition or by raising the temperature of the 
bulk gas to its autoignition temperature. There is a volume 
effect for autoignition, the autoignition temperature 
decreasing with an increase in volume, and since the volume 
differences are large between the volumes in which deter¬ 
minations havebeen made and those of large equipment, it is 
prudent to assume that any significant rise in the wall tem¬ 
perature may ignite a flammable mixture in a large tank. 

21.12.5 Gas freeing and cleaning of small equipment 

For small equipment, drums and other small containers, 
use should be made of positive gas freeing methods and 
reliance should not be placed on natural ventilation. One 
positive method of gas freeing is forced ventilation. Gas 
freeing also occurs as a result of cleaning by water washing 
or steam cleaning. 

Methods of cleaning small equipment are water washing, 
steam cleaning and solvent jetting. An account of the use of 
these methods for the cleaning of small equipment is given 
in Section 21.6. 
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21.12.6 Gas freeing and cleaning of mobile tanks 

Mobile tanks are those on truck tankers and rail tank cars. 
Positive methods should be used for gas freeing. One such 
method is thorough water washing and forced ventilation 
by the use of an air eductor or air mover. Another is to do 
gas freeing as part of steam cleaning. The usual method of 
cleaning, and thus of gas freeing, is the use of steam clean¬ 
ing. The procedure is similar to that for small equipment. 

Before hot work is undertaken on a multi-compartment 
tank vehicle, the design of the tank should be reviewed and 
a check made that there is no flammable material trapped in 
the bulkheads or other cavity. 

21.12.7 Gas freeing and cleaning of large equipment 

The usual method of gas freeing large equipment is by 
forced ventilation using air eductors or air movers. The 
eductor or blower is lowered to the equipment bottom and 
the equipment is freed of gas through the roof manholes. 
The opening of manholes in the side of the equipment 
may release dense vapour creating a potential hazard, as 
described above. Precautions should be taken against 
ignition. 

Ventilation should be continued until the concentration 
of vapour falls to less than 5% of the lower flammability 
limit. At this point, the risk of an outflow of flammable 
mixture is minimal and all the manholes may be opened. 
The flammable concentration should be allowed to fall to 
zero and to stay there for at least 30 min. 

Methods of cleaning large equipment are steam cleaning, 
water jetting, solvent jetting and manual cleaning. An 
account of the use of these methods for the cleaning of large 
equipment is given in Section 21.6. 

In many cases, the bottoms of large tanks are covered 
with sludge, residues and corrosion products, and are per¬ 
forated to some degree. There may be hazardous residues in 
defective seams or in voids. It is necessary to check on, and 
deal with, such residues before hot work is undertaken. 

Relevant advice is given in API Publ. 2207: 1999 
Preparing Tank Bottoms for Hot Work. If there is flammable 
liquid under the tank bottom, one technique of dealing 
with it is to drill and flood the bottom with water to displace 
the liquid. 

21.12.8 Hot work on outside of equipment 

If it is required to carry out hot work on the outside of a 
equipment, which for some reason cannot be gas freed and 
cleaned, an alternative procedure is to inert the equipment. 
This method is not suitable if the product concerned is one 
which decomposes, such as ethylene oxide. Another pro¬ 
cedure is to fill the equipment with the flammable liquid 
and then perform the hot work, as described in Section 21.11. 

21.12.9 Inerting of equipment 

Inerting may be accomplished by filling with water or with 
an inert gas such as nitrogen, carbon dioxide or combus¬ 
tion gas. A simple method of inerting for small equipment 
is filling with water. Any necessary check should be made 
on the load created by the water on the equipment and its 
supports. 

The inert gas method requires that the gas be mixed 
effectively. Mixing is promoted by the introduction of the 
inert gas at a number of points and with high velocity. 
Failure to achieve good mixing creates various problems. It 
is difficult to monitor the uniformity of mixing and it may 


be necessary to maintain the gas flow throughout the 
period of the hot work. 

Nitrogen is less reactive than carbon dioxide and may be 
used where products might be adversely affected by the 
latter. It is available as compressed gas in cylinders or as 
the bulk liquid. Where the latter is used, the vaporizers 
should be large enough to ensure an adequate supply and 
should be able to warm the gas to at least 14°F (-10°C) to 
guard against low temperature embrittlement. Using 
nitrogen inerting, which gives a mixture of hydrocarbons, 
nitrogen and oxygen, the limiting concentration of oxygen 
for combustion is about 12% and it is usual to purge down 
to below 5% to allow an adequate safety margin. 

Carbon dioxide is more reactive than nitrogen. It too is 
available as compressed gas in cylinders or as the bulk 
liquid. Carbon dioxide has a tendency to form solid parti¬ 
cles. In the case of cylinders, this creates a risk from static 
electricity. The use of the cylinder gas is not ad vised for this 
reason. Discharge from the bulk liquid should be designed 
to prevent the formation of ‘snow’. It should be checked that 
the equipment can withstand the low temperature caused 
by liquid or solid carbon dioxide. Precautions should be 
taken to protect personnel from ‘cold burns’. Using carbon 
dioxide inerting, the limiting concentration of oxygen for 
combustion is about 14%, and for safety it is usual to purge 
to below 5%. 

A third type of inert gas is combustion gas obtained from 
the controlled combustion of hydrocarbons in gas gen¬ 
erators, followed by purification. The resultant mixture 
typically contains 12-15% carbon dioxide, 12% oxygen 
and the remainder nitrogen. 

Another inerting technique involves the use of foam. The 
foam may be an air foam or a nitrogen foam. High expansion 
foam blown with air has been used to inert equipment 
which have held high flashpoint liquids, but there is some 
doubt whether air foam will prevent flame propagation if 
vapour is evolved in any quantity and it should not be used 
for liquids with a low flashpoint <90°F (<32°C). Instead 
use may be made of nitrogen foam. The principal advantage 
of using nitrogen in foam form is economy in the use of the 
gas. Since the gas in the equipment is displaced by the foam 
rather than removed by completing a number of purge gas 
changes. 


21.12.10 Demolition of equipment 

Methods for the demolition of equipment are given in API 
Std 653: Tank Inspection, Repair, Alteration and. Recon¬ 
struction and GS 29/3 Health and Safety in Demolition Work. 
Part 3: Techniques (HSE, 1984). 

A demolition survey should be made and the demolition 
procedures defined. The equipment should be emptied 
and gas freed. Ignition sources should be controlled. The 
roof should be removed by cold cutting. If a power tool is 
used, precautions should be taken to avoid its acting as 
an ignition source. Before any hot work is done, the equip¬ 
ment should be cleaned from the outside, by use of steam 
hoses, washing with water or water sprays. Washing with 
a high flashpoint oil is another method, but the oil should 
not be sprayed. The wash fluid should be collected and 
pumped away. 

If steam is used, the usual precautions should be taken, 
the steam pipe being grounded and bonded to the equip¬ 
ment. The equipment should be allowed to cool and the 
atmosphere tested before entry is made. 
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In some cases, the technique is used of covering the bot¬ 
tom sludge with about 6 in. (0.15 m) of water. 

Further details of equipment demolition are given GS 29/3, 
which also describes specific methods for the demolition of 
various types of equipment, including small and large 
fixed roof tanks, floating roof tanks and leaded petroleum 
tanks. It also deals with tank walls and tank floors. 

21.13 On-Line Repairs 

There has been a steady growth in the development of tech¬ 
niques for on-line, or on-steam repair and in their application. 
An account of on-line repair methods in general is given by 
G.W. Harrison (1980). 

The growth of such techniques has been driven by a 
number of factors, including general economic pressures 
and the need to accommodate the lengthening of times 
between scheduled shut-downs, or turnarounds; to keep 
major pipelines operating; to economize on energy and 
reduce steam leaks; and to reduce hydrocarbon emissions. 

One family of on-line repair methods is that con¬ 
cerned with carrying out hot work on operating pipelines, 
including hot tapping. This has already been described in 
Section 21.11. 

Among the applications of on-line repair described by 
Harrison are the use of: drill-and-tap methods to repair 
packing on leaking valves and also on pumps and agita¬ 
tors; leak sealing methods to eliminate flanged joint leaks, 
piping and fitting leaks, vessel leaks and compressor and 
turbine case joint leaks; hot tapping and line stopping 
on pipelines; various leak sealing methods for heat 
exchangers; and the crimping of deteriorated reformer 
tubes. 

An account of on-line repair of insulation is given by 
Bloom and Pebworth (1979). 

21.13.1 General leak sealing 

One of the most common types of on-line repair is the seal¬ 
ing of a leak. A variety of simple methods are used to seal 
leaks such as steam leaks, including clamps and various 
forms of enclosure or box. These may often be applied 
without the need to weld on an operating line. 

21.13.2 Compound leak sealing 

A specialized leak repair technique is that of on-line com¬ 
pound leak sealing. One of the main points where a leak is 
liable to occur is at a flanged joint. If the leak is severe, there 
may be no choice but to shut-down and repair it, unless it 
can be repaired on line with the equipment still operating. 
Accounts of compound leak sealing are given by Stroud 
(1981), Maushagen (1984 LPB 55), Bond (1986 LPB 69) and 
J.K. Rogers (1988). 

Compound leak sealing of a flanged joint involves put¬ 
ting a containment around the joint and injecting a sealant 
under pressure. J.K. Rogers (1988) describes the Furmanite 
system of leak sealing. This is applicable over the pressure 
range vacuum to 5000 psi (350 bar) and the temperature 
range cryogenic to 1000°F (600°C). A family of sealing 
compounds is used, depending on the application. The 
applications quoted are not only to flanged joints on pipes 
but to various other types of equipment, including riveted 
joints, welded joints, screwed couplings, valves and heat 
exchangers. 

An investigation of the hazards associated with this 
technique is described by Maushagen (1984 LPB 55). In 


essence, the process of leak sealing tends to lead to an 
increase in the stress on the flange and on the bolts. There is 
thus, a potential hazard of rupture at the flange, which is 
particularly likely to be realized if the flange assembly has 
a burst pressure below the nominal value due to incorrect 
design, incorrect materials or deterioration. The author 
defines a factor relating the stress on the bolts after sealing 
to that on the bolts as installed, and quotes values of up to 
2 for this factor. Each application needs, therefore, to be 
assessed before sealing is undertaken. 

He also describes a number of case histories of flange 
rupture during leak sealing. In one case in Czechoslovakia 
in 1981, al2 in. (300 mm) diameter pipe at 4350 psi (300 bar) 
pressure containing synthesis gas for an ammonia plant 
developed a leak at a ring joint. A leak sealing opera¬ 
tion was undertaken by non-specialists. During the injec¬ 
tion of the sealant there was a massive failure of the 
flange, resulting in a fire and explosion which killed four 
people. 

Further leak sealing incidents are described by Bond 
(1986 LPB 69). Nevertheless, he argues that leak sealing is 
not a particularly risky operation. In the United Kingdom, 
some 25,000 leaks are sealed each year by some 100 
technicians. 

Bond outlines the precautions required to minimize 
the risks of leak sealing. Where possible, it is preferable to 
use conventional means of repair, such as repair or renewal 
of components, rejointing of flanges and repacking of 
glands. 

If leak sealing is to be undertaken, it should be assessed 
by a competent engineer and a formal work plan agreed, 
covered by a permit. The assessment should cover: the 
hazard of a major release; the residual thickness of the pipe, 
including the method of, and apparatus for, its measure¬ 
ment, the bolts, including materials, deterioration, initial 
and final stresses; the external loads on the pipe and 
flange; the record of past injections; the maximum injec¬ 
tion pressure to be used; the design codes and procedures 
for the boxes and clamps; the possibility of internal block¬ 
age of the pipe by the sealing compound; the access to 
the site; the personal protection required; and the expected 
life of the temporary repair. The temporary repair should 
be dismantled and a conventional repair performed at the 
earliest opportunity. 

The work should be done by a competent contractor. The 
author highlights in particular, competence in the design of 
boxes and clamps. Once the method to be used has been 
decided, no deviation should be permitted. 


21.13.3 Pipeline repair 

On-line repair methods have been used for many years for 
pipeline repair. The methods of hot tapping were developed 
in this application. 

An account of the technique of half-soling is described 
by RM. Scott and Kiefner (1984). This consists of welding 
to the pipeline a curved plate which is concentric with, and 
extends around, one-half the circumference of the pipe. 
The half-sole may be cold formed from steel plate or 
obtained by splitting a segment of pipe longitudinally, the 
former being the more usual. It is attached to the pipeline 
by a fillet weld. The technique is used both for leaking and 
non-leaking defects. 

Numerous pipe wrap materials are also available. These 
are pliable woven material that can be wrapped around the 
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pipe sealing a leak or preventing one from happening on 
thin lines until the pipe can be replaced. 

21.14 Maintenance of Particular Equipment 

The deterioration and failure of equipment, which is dealt 
with by maintenance, has causes in design and installa¬ 
tion as well as operation, and has first to be detected by 
inspection. The intimate links between maintenance and 
these other activities may be illustrated by considering the 
maintenance of some particular types of equipment. OSHA 
PSM standard 1910.119 (j) Mechanical Integrity requires 
programs to maintain the integrity of various types of 
process equipment. These include: pressure vessels, and 
storage tanks, piping systems including components, relief 
and vent systems and devices, emergency shut-down sys¬ 
tems, controls and pumps. Accounts of maintenance of 
particular equipment are given in the Standard Plant 
Operators Manual (Elonka, 1975), Pressure Vessel Systems 
(Kohan, 1987) Plant Engineers Reference Book (Snow, 1991) 
and Marks Handbook. 

21.14.1 Pressure vessels 

The assurance of the integrity of pressure vessels depends 
largely on inspection and pressure relief. Pressure vessel 
maintenance and inspection guidance is provide API RP 
510: Pressure Vessel Inspection Code, RP 572: Inspection of 
Pressure Vessels, RP 579: Fitness-for-Service, RP 580: Risk 
Based Inspection, RP 573: Inspection of Fired Boilers and 
Heaters, RP 570: Inspection, Repair, Alteration, and Rerat¬ 
ing of In-Service Piping Systems. 

The maintenance function should maintain a general 
oversight of pressure vessels, focusing on external corro¬ 
sion, support defects, stress inducing features, disabled 
relief protection and disabled instrumentation. 

The ancillary features of a pressure vessel should he 
maintained in good condition. The condition and tension of 
the bolts on flanged joints should be correctly maintained. 
The relief system of the vessel should be maintained, as 
described below. 

Where it is necessary to carry our repairs on a pressure 
vessel, this should be done in accordance with the appro¬ 
priate codes and systems. In the United States of America, 
the code is the ASME Boiler and Pressure Vessel Code. The 
National Board of Boiler and Pressure Vessel Inspectors 
(NB) certifies organizations for the repair of pressure ves¬ 
sels and issues the National Board Inspection Code, which 
gives guidance on pressure vessel repair. In the United 
Kingdom, the relevant code is BS 5500. 

Some of the problems which may occur in field repairs of 
pressure vessels by welding are discussed by Kohan (1987). 
They include: incomplete removal of the defect being 
repaired; increased stress and distortion; slag inclusions; 
undercut, overlap and incomplete joint penetration; weld 
porosity; weld cracks; and unfavourable access and envi¬ 
ronmental conditions. 

Repairs described by Kohan include: pitting repair; 
repair of wasted or general corroded areas; flush-welded 
inserts; repair to cracks, including weld cracks and lap 
cracks; repairs to heat exchangers; repairs to stainless 
steel; and repairs to dissimilar metals. 

21.14.2 Pressure relief devices 

Pressure relief systems provide essential protection for 
pressure systems and much effort goes into their design. 
This is negated if the relief system is not properly 


maintained. Guidance on inspection of pressure relief 
systems is provided in API RP 576: Inspection of Pressure 
Relief Devices. Accounts of the maintenance of relief sys¬ 
tems are given by Anon. (1977 LPB 14, p. 2; 1977 LPB 17, 
p. 15),Woolfolk and Sanders (1984,1987), J.K. Rogers (1988) 
and Duckworth and McGregor (1989). The account by 
Duckworth and McGregor covers the maintenance of relief 
devices along with their installation and inspection. 

The maintenance of relief devices such as pressure relief 
valves and bursting discs requires suitable training. 
Maintenance personnel need to understand the reasons for 
the use of such devices, the types of device, the methods 
of installation and the methods of testing. They should 
appreciate that these are delicate items of equipment and 
should be treated on a par with, say, instrumentation. 

When installing a relief device, attention should be paid 
to the orientation, the alignment, the gaskets and the bolt 
torquing. A bursting disc assembly may be rendered use¬ 
less if it is incorrectly assembled, installed upside down or 
interfered with by an unsuitable gasket. 

Before removing a relief device for testing, a check 
should be made on its general condition to see whether it 
has suffered damage or interference, whether it has suf¬ 
fered excessive corrosion or whether there is any process 
fluid or deposit which could affect its operation. In the 
shop, inspections should be made as to whether the set 
pressure is correct and whether there is any wear, damage, 
corrosion or restriction which could affect its operation. 
Where relapping of a relief valve seat is required, this 
should be done on a proprietary lapping machine or a good 
quality lapping plate. 

A large site will generally have a large number and 
wide variety of types, duties and settings of pressure 
relief valves. There is considerable potential for incorrect 
installation. One measure to prevent this is to mark the 
valve location with a permanent code number and to put the 
same number on the valve itself. 

An account of a program for the maintenance of safety 
relief valves (SRVs) on a 688-acre site with 20 separate 
units has been given by Woolfolk and Sanders (1987). The 
program described covers relief at 2200 locations with 
valves ranging in size from 1/4 in. to 12 in. and made by 
25 different companies. The SRVs are tested, disassembled, 
cleaned, examined, repaired, lubricated, reassembled, 
retested and sealed. 

The original test equipment utilized a low air volume. 
The testing of SRVs on this was not satisfactory and it was 
replaced by a system of larger volume, which proved more 
suitable. The authors comment that it is sometimes claimed 
that where an SRV has a bursting disc installed below it, it 
can be tested in situ , but that since the volume between the 
disc and the valve is small, this is equivalent to the use of a 
low air volume test system. 

In SRV testing, the valve seat usually receives attention 
to ensure that the valve is leak-tight. Woolfolk and Sanders 
also place emphasis on the guide area. This should be 
cleaned, polished and lubricated. 

Woolfolk and Sanders give details of the test intervals 
which they generally use, which are as follows. A 12-month 
interval is used for boilers (local legal requirement), pro¬ 
cess vessels with heat sources, vessels containing corrosive 
chemicals, and positive displacement pumps or com¬ 
pressors; a 24-month interval is used for process steam 
headers and storage; vessels with no heat sources; and a 
36-month interval is used for instrument air manifolds 
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within dehumidified control rooms and lubricating relief 
valves on enclosed systems. 

Methods have been developed for the in situ testing of 
pressure relief valves, as described by J.K. Rogers (1988). 
The principle is to overcome the closing force of the valve 
spring by the application of an external hydraulic force. 
Then from knowledge of the valve seat area and line pres¬ 
sure at the valve, the set pressure of the valve may be deter¬ 
mined. The test can also determine whether the valve has 
been fully stroked. 

A critique of in situ testing is given by Woolfolk and 
Sanders, who express the view that it has limitations where 
there are aggressive fluids and that it could fail to detect 
corrosion, partly bent or galled stems, partially plugged 
nozzles and certain misadjustments. 

Some case histories of relief valve maintenance are 
described by Anon. (1977 LPB14, p. 2). 

21.14.3 Storage tanks 

The maintenance of atmospheric storage tanks presents a 
quite different set of problems. Guidance on inspection of 
storage tanks is provided in API RP 575: Inspection of 
Atmospheric and Low-Pressure Storage Tanks, RP 653: Tank 
Inspection, Repair, Alteration, and Reconstruction. Accounts 
are given by Huston (1983) and Shtay ieh (1983a,b). 

Maintenance of storage tanks often involves entry into 
the tank. In this case, a large part of the maintenance 
activity is the purging and cleaning required before entry 
can be gained. This aspect is described in Section 21.12 and 
is not, therefore, repeated here. 

The ancillary features should be maintained in good con¬ 
dition. In particular, the tank vent system should be main¬ 
tained by a system similar to that applied to relief valves 
on pressure vessels. 

Most descriptions of storage tank maintenance are con¬ 
cerned with leaks. The case described by Huston involved a 
storage tank with a leaking floor, a not uncommon occur¬ 
rence. The identification of leaks, which may be no more 
than 3/16 in. (5 mm) diameter, is usually difficult due to the 
poor lighting in the tank and to the state of the tank floor. 
The author describes a method of improving the detection 
of the leaks by forcing water under the tank and filling the 
underside of the floor with water, so that water comes up 
through the leaks. 

An account of leak detection and repair in a refrigerated 
propane tank is given by Shtayieh (1983b). The tank was of 
double wall construction with insulation between the inner 
and outer walls. Monitoring of the gas space between the 
two walls showed the presence of hydrocarbons at a con¬ 
centration of 15-20%, indicating the existence of leaks. A 
thermographic survey was carried out on the outside wall 
which showed two cold spots at a temperature 35°F (1.5°C) 
lower than the rest of the wall. The tank was entered and 
eventually leaks were found. The main leak was on a man¬ 
hole, where there was a faulty gasket and a badly machined 
blind flange gasket face and cover. There were two lesser 
leaks at the two 2 in. diameter nozzles of the level indicator, 
due again to damaged flanges. No leaks were found at the 
points suggested by the thermography. This example 
demonstrates the trouble caused by deficiencies in common 
installation activities, in this case the making up of flanges. 

21.14.4 Ammonia storage spheres 

The occurrence of stress corrosion cracking in ammonia 
storage spheres has created a considerable problem in 


the maintenance of such storages. Accounts are given by 
R.S. Brown (1982) and Guth and Clark (1985). They illus¬ 
trate both the procedures for isolation, emptying, purging 
and entry, and for bringing back on stream for such storages 
and the procedures for inspection and repair. This work is 
discussed further in Chapter 22. 

21.14.5 Heat exchangers 

Heat exchangers are pressure vessels, but in addition their 
maintenance is affected by certain characteristic features 
of their own. Accounts are given by Yokell (1983) and Fijas 
(1989). 

Where a heat exchanger is delivered to a construction site 
and is left in the open for sometime before it is installed, it 
may well suffer deterioration even before it begins opera¬ 
tion. In order to avoid this, it should be stored carefully 
before installation and its surfaces cleaned periodically. 
The necessary measures are described by Fijas. 

Heat exchanger tubes are liable to leak or even rupture 
and these faults may be induced by maintenance activities. 
One such activity is tube bundle withdrawal. There should 
be procedures for bundle withdrawal. The bundle should be 
supported on the tube sheets, baffles or blocks contoured to 
the bundle, but not on the tubes themselves. 

It is usually necessary to clean the tubes to remove scale. 
If cleaning is deferred too long, maldistribution may occur 
in some tubes and the resultant differential thermal 
expansion of these tubes can cause damage and leaks. 

Methods of cleaning heat exchangers are described by 
Fijas. Soft deposits may often be removed from the shell or 
tube sides of a heat exchanger by washing with hot oil and 
soft salt deposits by washing with hot fresh water. More 
stubborn deposits may be removed by chemical cleaning. 
He recommends against cleaning tubes by blowing steam 
through them, since it is liable to cause overheating and 
thermal expansion and thus induce tube leaks. Nor should 
tubes be hammered with a metallic tool. If they must be 
scraped, the tool should not be sharp enough to cut them. 

Heat exchanger tubes are subject to vibration, which is 
liable to cause leaks. One cause of tube vibration is opera¬ 
tion at too high a fluid velocity. Another is vibrations 
transmitted from a pump or compressor. A pulsation dam¬ 
per may be used to reduce vibrations from such a source. 

When starting up and shutting down a steam heated 
exchanger, condensate should be drained out as a precau¬ 
tion against water hammer. If shut-down is at all prolonged, 
it may be necessary to drain the fluids from the exchanger 
to prevent freezing or corrosion. 

21.14.6 Equipment supports 

Equipment supports provide another illustration of the 
interaction between design, inspection and repair. An 
account of the maintenance of such supports is given by B.N. 
Pritchard (1983).The types of support which he considers are 
concrete supports and steel supports fireproofed by encasing 
them in concrete. Causes of deterioration include corrosion, 
overstressing, frost damage and also fire or explosion. 

Concrete protects buried steel against corrosion partly 
by constituting a physical barrier to oxygen and moisture 
and partly by passivation of the steel by water made alka¬ 
line by the concrete. This latter effect decreases as the 
alkalinity falls off. 

If the steel under the concrete does corrode, corrosion 
products are formed which have eight times the volume of 
the steel which they replace. This creates stresses which 
result in cracking and spalling of the concrete. 
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The author reviews the effects on the corrosion of steel 
encased in concrete of chlorides, sulfates and acids. In rare 
cases it may be promoted by a cement aggregate reaction. 

Corrosion of steel encased in concrete may be reduced by: 
the use of dense concrete; good steel - concrete bonding; 
shaping the concrete so as to exclude rainwater, or the use 
of rainwater flashings; and the application of a suitable 
coating to the outside of the concrete. The author states that 
for fireproofing cast in situ concrete appears superior to 
gunnite, though the reason is unclear. 

Paint applied to the steel provides a degree of protection 
not only for bare steel but also for steel encased in concrete 
or provided with lightweight fire-proofing. 

Corrosion occurring inside the concrete casing may he 
detected by visual examination, and also by tapping. In 
general, hairline cracks are tolerable but stained cracks 
may indicate a more serious situation. For certain cases, the 
use of more sophisticated inspection may be justified. 
Early detection is highly desirable. Suitable timings for 
inspection are at lyear after commissioning or after a mate¬ 
rial change of duty or environment, and at 4 year intervals 
thereafter. Formal records should be kept of the supports 
and their inspection. 

Factors which govern the repair of supports are the fea¬ 
tures which have caused the deterioration, the further 
deterioration expected, the effects of the damage on the 
structure, the importance of the structure, the operating 
history of the equipment and the cost of repairs. The repairs 
should incorporate measures to remove the causes of the 
deterioration. Repair techniques include the sealing of 
cracks, cutting back to sound concrete and cutting back to 
the steel. Temporary supports may be necessary while 
repairs are being completed. 

21.14.7 Foundations and dikes 

Foundations and dikes also may require repair. Accounts of 
the repair of foundations are given by Renfro (1978,1979). 
Containments are discussed by Hazen (1991). 

21.15 Equipment Removal 

The removal of equipment from the unit to the shop can 
create a hazard if flammable or toxic material are trapped 
inside it. It is necessary to have some procedure to deal with 
this problem. 

21.15.1 Unused equipment 

Equipment which is installed but is no longer required 
should normally be removed. This applies to all kinds of 
equipment whether it he vessels, pumps, pipes, instru¬ 
ments, etc. Unused and often disconnected equipment is a 
fertile source of accidents. 

21.15.2 Equipment sent off site 

Where equipment is sent away from the plant, whether for 
repair or because it is no longer required, the state of the 
equipment should be reviewed, any hazard identified and 
appropriate measures taken. In particular, there is the 
potential hazard that equipment may still contain residues 
of flammable or toxic material. Equipment should be tag¬ 
ged indicting its prior usage and potential hazards. 

21.16 Deteriorated Equipment 

The equipment on the plant starts to deteriorate from the 
first day of operation, and sometimes earlier if it has been 


neglected prior to installation. As the plant ages, it becomes 
necessary to take a view on the continued operation of some 
equipment. 

21.16.1 Remaining life assessment 

Some equipment is designed to have a limited life. The 
prime example here is equipment with a limited creep life. 
Creep is described in Chapter 12 and the shortening of creep 
life by abuse during operation is discussed in Chapter 20. 
Where there is reason to think that the latter has occurred, 
it may be necessary to attempt an assessment of the 
remaining life. 

Another major form of deterioration is corrosion and, 
insofar as a particular corrosion allowance is made, in this 
case also the design implies a limit to the life of the equip¬ 
ment. The possibility of periods of corrosion at rates much 
higher than average means that here too there is a need for 
life assessment. 

The assessment of the remaining useful life of equip¬ 
ment, or the remaining life assessment (RLA), is an 
established activity. API RP 579 provides guidance on 
evaluating the present integrity of the equipment and 
the projected remaining life. RLA is described by Baker- 
Counsell (1987b) and Grosshandler (1987a). If the equip¬ 
ment is nearing the end of its life, RLA provides the 
necessary wanting, while if it still has an appreciable 
fraction of its life left, the RLA provides assurance that it 
can continue in operation. 

Much work in RLA is concerned with creep effects. Some 
techniques used are metallography, strain measurement, 
accelerated creep testing and stress analysis. The results of 
RLA may be expressed as a cumulative probability of fail¬ 
ure, which allows the company to make its own judgement 
on how much longer to continue to operate the equipment. 

A specific example of the application of RLA to corro¬ 
sion of a pressure vessel and its nozzle is described by 
Grosshandler (1987a). Further accounts of obsolescence 
include those of Munro (1963) and Baas and Warner (1992), 
who describe the assessment of the remaining useful life of 
an ethylene plant. 

21.16.2 Used equipment 

The situation can arise where it is necessary to consider 
either the purchase or the sale of used equipment. Some of 
the considerations which arise have been described by 
J.P. Epstein (1967,1978) and C. Butcher (1992d). 

For purchase, three approaches may be taken: purchase 
‘as is’, on approval, and rebuilt and guaranteed. Most equip¬ 
ment is bought ‘as is’. 

When purchasing equipment, inspections should be 
made on: the dimensions of equipment; the pressure 
integrity of pressure vessels; the wear sustained by moving 
parts of machinery; any ancillary equipment; and con¬ 
formance to any regulatory requirements. Useful informa¬ 
tion can often be obtained by inspecting the equipment 
while it is still on site and in use. Equipment allowed to 
stand idle even for a short time can deteriorate or take on a 
bad appearance. 

Specialist companies exist which deal with used equip¬ 
ment and it may be beneficial to use their expertise. 

21.16.3 Fire damaged equipment 

In the aftermath of a large fire, there may be equipment 
which has been in the fire. The question then arises as to the 
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continued safe use of the equipment. In all such cases an 
inspection should be made. Pressure system integrity is of 
particular importance and should be investigated by 
experts. 

A case history of the assessment of fire damage of a vessel 
is described by Dooner (1986). The vessel was to be used in a 
low temperature application down to —19 6° C. It hadbeen in a 
fire which lasted some 2 hours and subject to an estimated 
temperature in the range 400-600°C. A metallurgical 
investigation showed that no significant deterioration had 
occurred and the vessel was put into service. 


21.17 Some Maintenance Problems 

21.17.1 Materials identification 

Misidentification of materials is a significant problem. 
Mentionhas already been made in Chapter 19 of errors during 
the construction and commissioning stages, particularly in 
the materials used in piping. Materials errors also occur in 
maintenance work. Situations in which they are particularly 
likely are those where materials look alike, for example low 
alloy steel and mild steel, or stainless steel and aluminium 
painted steel. It is necessary, therefore, to exercise careful 
control of materials. Methods of reducing errors include 
marking, segregation and spot inspections. 

Positive Material Identification efforts have been used on 
piping systems. It is not uncommon to find that 20% of the 
components are not the proper material. 

21.17.2 Component identification 

Another problem is mistakes in identifying components 
or equipments. Confusion can arise, for example, over 
pressure relief valve components, with the result that a 
relief valve may be put back with too high a setting. This 
type of error can readily occur with similar components 
made by the same manufacturer. Similarly, it is easy for 
blinds to become mixed up so that a slip blind suitable 
only for a low pressure duty is used on a high pressure 
application. 

A particular type of component identification error is 
installing a component that alters equipment performance. 
Thus, the capacity of a control valve may be increased by 
putting in the wrong trim, or the delivery pressure of a 
pump may be increased by installing the wrong impeller. 

21.17.3 External corrosion 

External corrosion beneath insulation is a considerable 
problem on process equipment. It has already been 
described in Chapter 12. It is important that the mainte¬ 
nance system should check on external corrosion. 

Such corrosion occurs particularly on steel equipment in 
the temperature range 32—257°F (0—125°C). Below 0°C, the 
surface is protected by ice, while over 125°C water evapo¬ 
rates. Use of types of mineral wool insulation that are acidic 
can exacerbate the problem. 

There are various forms of corrosion which can occur due 
to agents other than water. Chloride attack occurs from 
chlorides which are leached out of some insulation materi¬ 
als. It can also arise from thermal decomposition of poly¬ 
vinyl chloride (PVC) labels on very hot pipe surfaces. 
Nitrate attack arises from the use of nitrite treated water on 
equipment surfaces. 

Supports for storage tanks and vessels are a common site 
of external corrosion. 


21.17.4 Pumps and other equipments 

Pumps are the source of a large proportion of leaks and 
fires. A common fault is seal failure with resultant leakage. 
The leakage often ignites and causes a pump fire. Another 
frequent fault is a bearing failure, which can induce a 
seal failure. After a pump fire it is not always easy to tell 
whether the seal or bearing has failed first. 

Reduction of pump failures is partly a matter of design 
and selection, but maintenance aspects are also important. 
Many faults can be prevented by a careful overall check 
when a pump is taken out for other maintenance work. 

In addition, it is not uncommon for faults to be intro¬ 
duced in the course of maintenance work. A simple 
example is misalignment of the impeller shaft when the 
pump is reassembled. Faults of this kind point to the need 
for proper systems of work for maintenance and for ade¬ 
quate training. Similar problems arise with other types of 
equipment. 

21.17.5 Small bore connections 

Small bore connections are another source of leaks and 
fires. Such connections are often abused. Heavy pressure 
gauges or valves may be fitted to them without adequate 
support. They are frequently over tightened, sometimes 
with a pipe wrench. People may stand on them to reach 
isolation valves. 

21.17.6 Dead legs 

Dead legs in piping systems are where no flow occurs. This 
can lead to internal corrosion from stagnation or freezing 
during inclement weather causing leakage. Dead legs 
should be removed. 


21.18 Major Shut-Downs 

Two particular kinds of shut-down merit specific mention. 
These are major scheduled shut-downs and mothballed 
shut-downs. 

21.18.1 Scheduled shut-downs 

Most units require a periodic major scheduled shut-down, 
or turnaround, in order to carry out maintenance and other 
jobs which cannot be done while the unit is operating. 
Accounts of turnarounds are given by Vargas (1979), 
Tropp (1986) and Feuless and Madhaven (1988). 

The turnaround arrangements described are broadly as 
follows. The responsibility for the turnaround is assigned 
to a turnaround manager. The turnaround passes through 
four stages: (1) formulation, (2) planning, (3) implementa¬ 
tion or execution and (4) start-up. 

In the formulation stage, the turnaround manager solic¬ 
its job requests from the interested parties. Each job is 
defined, given a priority rating and assigned to a person 
who is responsible for it. Three levels of priority may he 
used: (1) the job can be done only during turnaround and 
has high priority; (2) the job can only be done during turn¬ 
around, but is not critical; and (3) the job can, if necessary, 
be done outside turnaround. The responsibilities for the 
total set of jobs are spread widely, but for each job there is 
only one person responsible. A deadline is set a few weeks 
before the turnaround start date, and thereafter only 
priority jobs are accepted. A master job list is drawn up and 
a critical path network developed for each job. The parts 
and special tools required for each job are identified and the 
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process is begun of obtaining them and transferring them 
to the tool room or warehouse storage. 

Tropp (1986) states that the two faults to which turn¬ 
arounds are most subject are unsuitable assignment of 
responsibilities and inadequate exchange of information. 
The normal roles which people play are often not appro¬ 
priate to a turnaround. Failure to recognize this is a main 
cause of communication failures. 

He describes a system of categorization of jobs by logical, 
chronological and priority groups. With regard to the first 
two, the logical group covers categories such as time, 
information, safety, manpower, materials, tools, etc., and 
the chronological group covers those of preparation, 
implementation and review. He gives detailed respon¬ 
sibility charts for the preparation and implementation 
stages. Entries in the chart are R, I, C and N for responsible, 
implement, consult and notify, respectively. 

In the planning stage, the overall critical path network is 
developed together with a bar chart showing the start and 
end time of each job and the personnel required. A man¬ 
power requirements list is drawn up. Computer aids are 
available to assist in such planning. The plan needs to be 
flexible and able to accommodate unexpected jobs. Work 
continues to ensure that the parts and tools required are 
moved to storage and a parts review is carried out to ensure 
that nothing is missing. 

Throughout the formulation and planning stages, there 
should be meetings to ensure that all interested personnel 
understand their role and make an appropriate contribu¬ 
tion to the plan. 

The job times should be the subject of detailed review by 
planners/estimators. Planning norms or a library of time 
estimates may be used. In estimating job, times allowance 
should be made for the fact that the time spent on turn¬ 
around jobs tends to be rather longer than that spent on 
equivalent routine jobs, and the fact that time is required to 
obtain materials, to purge and clean, and to await support¬ 
ing functions such as safety or inspection. 

Some of the worksheets developed are illustrated by 
Vargas (1979) and Feuless and Madhaven (1988).The former 
also gives a detailed account of the critical path scheduling. 

The management of the implementation stage needs to 
be sufficiently flexible to accommodate the facts that some 
jobs may reveal problems, that some may take longer than 
planned, or require parts other than those expected, or that 
some completely new jobs may need to be done. It is not 
uncommon for 25% of the jobs done in a turnaround to be 
identified during execution. A meeting of those concerned 
is normally held daily to report progress and to modify 
plans as necessary. 

There needs to be a procedure for dealing with those 
cases where the parts or materials specified are not avail¬ 
able and the use of some alternative is proposed. Manage¬ 
ment of change procedures must be followed. For example, 
piping in some special steel may be on too long a delivery 
and there may be an intention to use a substitute material, 
or the type of pressure transducer specified may be un¬ 
available but another type may be used which is equivalent. 

The purpose of the turnaround is to get the work 
completed and the unit started up again. The emphasis, 
therefore, should be on the start-up, rather than simply 
completion of the turnaround. 

When the start-up is over, the personnel involved should 
be debriefed and a report written while matters are still 
fresh in the mind. In particular, note should be made of 


times actually taken and the resources used for various 
jobs and activities, of problems encountered, equipment 
required, techniques developed or lessons learned, and of 
jobs which will need to be done in the next turnaround. 

As soon as the turnaround is over, preparation for the 
next one should begin. Many of the jobs for the next turn¬ 
around will be based on the work just completed. 


21.18.2 Mothballed shut-downs 

During an economic recession, the decision may be made to 
take a unit out of commission and to ‘mothball’ it, with the 
intent to recommission it when times are better. Accounts 
of mothballing, and de-mothballing, are given by Twigg 
(1985), R.G. Miller and King (1987) and Savage, Portnoy and 
Parkinson (1988). 

Mothballing is applied to a variety of installations and 
equipment, including oil field production systems, refin¬ 
eries, chemical plants, drilling rigs, oil tankers and special 
equipment. It is much used for military equipment, 
including vehicles, ships and aircraft. 

The mothballing of entire plants or units is not an exer¬ 
cise to be undertaken lightly and the alternatives of selling 
or scrapping it should be carefully considered. The cir¬ 
cumstances which make decommissioning necessary are 
attended by a number of problems. Personnel may well be 
somewhat demoralized. There is uncertainty as to how long 
the plant will be out of action. There is likely to be pressure 
to do a cheap job. The staff concerned will generally lack 
experience of laying up a full installation. The compilation 
of a complete set of documentation for the equipment is an 
unattractive chore. 

There are a number of factors that affect the way in which 
the mothballing is done. The length of the shut-down is 
relevant, since the measures required to preserve the 
equipment for a few months differ from those required 
preserving it for 10 years, but is often unknown. The loca¬ 
tion affects factors such as the climatic conditions and 
vandalism. A hot, humid site promotes corrosion. A run¬ 
down urban area is more prone to theft and damage by 
outsiders. Some fluids such as seawater and sour gas are 
more corrosive and some materials of construction such as 
stainless steel have particular vulnerabilities. 

It may not be appropriate to mothball every item. 
Some items of equipment and much instrumentation 
are particularly prone to obsolescence. For other items, 
such as small bore piping and valves, it may be more eco¬ 
nomic to let them go and replace them when the unit is 
recommissioned. 

There are a number of methods used to guard the 
equipment against corrosion and other deterioration while 
it is mothballed. Items of equipment may be removed from 
the unit and stored after suitable treatment in a warehouse. 
Measures may be taken to ensure that the fluids in the 
equipment are benign. Examples are replacing seawater by 
fresh water, purging with nitrogen and adding an inhibitor 
to condition vapours. The equipment can be isolated from 
its environment by the use of various forms of barrier such 
as: paint, greases and waxes, boxes or bags, or cocoons. 
Other anticorrosion measures maybe taken, such as the use 
of cathodic protection. Some parts of the unit may be kept 
in continued operation and some items may be periodically 
stroked or rotated, as the case may be. Methods particu¬ 
larly favoured by the military are the use of greases and 
waxes, and of cocooning. 
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Corrosion is liable to be much higher during a prolonged 
shut-down than in normal operation. R.G. Miller and 
King (1987) contrast a storage tank corrosion loss of 3 mpy 
(thousandths of an inch per year) in normal operation with 
one of 100 mpy in the shut-down condition, with an asso¬ 
ciated change from general to pitting corrosion. Corrosion 
may be worst in summer as warm air is driven out of 
equipment during the day and cold air with high humidity 
is drawn back in at night. 

Cooling water systems can be troublesome unless suit¬ 
able precautions are taken. Failure to protect adequately 
can result in rust and scale blocking of the tubes of heat 
exchangers all over the plant for months, or even years, 
after restart. 

One form of internal corrosion which often occurs is 
microbiological corrosion. Precautions against this involve 
the use of good quality water and of organic biocides. 
Chlorination of the water tends to be ineffective. 

If equipment becomes severely corroded, the penalty can 
be high. A case is quoted by Miller and King where break¬ 
ing the line at a spool piece with corroded bolts took a team 
of 5 men using heavy equipment 5 days. 

Two widely used methods of reducing corrosion are the 
use of dry inert atmospheres in vessels and the coating of 
surfaces with oil. Corrosion is reduced by the exclusion of 
oxygen, and filling vessels with nitrogen is an effective 
anticorrosion measure. The gas should be dry, with a dew 
point at least 40°F (5°C) below that of the lowest expected 
ambient temperature. 

Oils or oil-based products can be used to reduce corro¬ 
sion. Refinery equipment is frequently protected by filling 
it with oil and then running the oil out again. The thin film 
of oil gives protection until it eventually drains down. 
Alternatively, surfaces may be coated in oil or grease. Small 
items may be dipped in oil. Vapour phase inhibitors may be 
used for areas which are not readily wetted by oils. 

The type of protection provided against corrosion may 
be matched to the intended period of shut-down, if this is 
known. Twigg suggests that for short period shut-downs, it 
may often be sufficient to flush and drain, while for longer 
ones greasing or painting may be necessary. Similarly, 
Miller and King suggest that for some equipment washing 
down and coating with diesel oil may suffice for a shut¬ 
down of 18 months, while shot blasting and painting may be 
preferable for one lasting 5 years. 

External corrosion is liable to occur under insulation and 
on equipment supports. Features which promote such cor¬ 
rosion are damage to the insulation and chlorides from the 
insulation. One policy sometimes adopted to combat 
external corrosion during mothballing is to remove the 
insulation completely. Alternatively, if the insulation is not 
removed, any damage to it should be made good and it 
should be sealed. 

Cocooning involves the use of strippable plastic coatings 
and gives an enclosure not dissimilar to vacuum packing. It 
can be very effective provided that moisture is excluded but 
moisture can pass through due to the breathing of the 
membranes and corrosion can occur unless the dew point of 
the air inside is kept low. The coatings have a tendency to 
come off in high winds. 

Valves left unused for long periods are liable to seize up 
due to the hardening of lubricants. One solution is to 
remove them to store. Another is to leave them in but 
maintain and operate them occasionally 


Some parts of the unit may best be preserved by operat¬ 
ing themperiodically. Savage, Portnoy andParkinson(1988) 
describe the preservation of a cooling system by running 
a high chromate solution through the system once every 
2 weeks throughout the mothball period. 

Rotating equipment should be turned at intervals 
to avoid ‘brinelling’. Frequencies recommended are typi¬ 
cally in the range 1-6 months, depending on the type of 
bearings. 

Cannibalization of the plant or units should not be per¬ 
mitted. Where there is a protective envelope, breaking in 
can negate it and lead to severe corrosion. The loss of parts 
is liable to be disproportionately disruptive when the time 
comes to recommission the equipment. Moreover, when 
equipment is removed in this way, damage is frequently 
done to other items. 

The mothballing of equipment does not remove the need 
to inspect and maintain, or even to operate parts of it. 
Inspection is still required, but the techniques involved are 
somewhat different. There is also a need for some degree of 
maintenance. 

A full set of documentation on the plant, and on its 
operating and maintenance procedures, needs to be com¬ 
piled. Such documentation is necessary for any equipment, 
but it is crucial for one which is to be recommissioned at 
some date in the future by personnel who are likely to be 
unfamiliar with it. The documentation should include full 
details of the mothballing itself, of any items removed from 
the unit and the state of the remaining equipment. 

The methods of protection used in mothballing may also 
be applicable where equipment arrives on site but cannot be 
installed immediately. Heat exchangers, in particular, are 
prone to deteriorate rapidly if left unprotected prior to 
installation. 

The problems which arise when demand turns up and 
de-mothballing can be considered are discussed by Savage, 
Portnoy and Parkinson. Again, there are often alternatives 
such as debottlenecking and revamping existing units 
or building new units, and in view of the problems likely 
to be encountered in recommissioning, these should be 
given full consideration. If recommissioning is decided on 
it may well be combined with modifications to the equip¬ 
ment to achieve better product quality, higher output or 
improved efficiency. A prerequisite for recommissioning 
is the retrieval of a full set of documentation on the 
equipment. 

Some items or systems are likely to have suffered con¬ 
siderable deterioration. Some equipment, such as valves, 
may well need to be reconditioned and some, such as small 
bore piping, may need to be replaced. Other equipment may 
need replacement due to obsolescence, which is particu¬ 
larly rapid in some instances, such as the instrument sys¬ 
tems, including computers. 

It will be apparent from the account just given that in 
addition to all the usual measures necessary for a commis¬ 
sioning, a recommissioning after mothballing needs to be 
preceded by an extremely thorough inspection of the 
equipment and review of the documentation if hazards are 
to be minimized. 


21.19 Maintenance Information Systems 

21.19.1 Maintenance information system 

Information on equipment failures, repairs, and incidents 
is needed both for maintenance and safety and loss 
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prevention (SLP) purposes. It should be a specific objective 
of the maintenance system to generate such information. 

The principal data required are those for failure, repair 
and availability. The data are more valuable if they are of 
good quality. Failure data should preferably give for each 
equipment the time to failure in each failure mode rather 
than overall failure rates. Availability data should give 
throughput density rather than a single downtime figure. 
There are also other data which are needed. These include 
data on leaks and fires and on human errors. 

Data on failure and related aspects are essential to the 
loss prevention approach. The maintenance engineer, 
therefore, has a crucial role to play here. They should make 
it their business to have an information system which gen¬ 
erates the data. Such data are equally useful, of course, to 
the maintenance engineer. They normally monitor failures 
and failure modes at least in a semi-quantitative way, but 
if higher quality data is available they can analyse it to 
obtain additional information. Thus an early failure 
(Weibull parameter, /J < 1) may point to the need for better 
supervision or training of maintenance workers or for the 
work to be done under less dirty conditions, while wear 
out failure (p > 1) may indicate the possibility of preventive 
replacement. 

21.19.2 Maintenance information feedback 

The requirement for failure data is one aspect of the more 
general need for feedback of information from the main¬ 
tenance to the design function. This is the theme of tero- 
technology, which is discussed in relation to maintenance 
by Husband (1976). Again the maintenance engineer can 
play a key role in ensuring effective feedback of informa¬ 
tion and so reducing unreliable and hazardous features, 
and he should make this a definite objective. 

21.19.3 Maintenance policies and effectiveness 

The maintenance policies which are followed in a process 
plant can have a marked influence on its reliability, and 
availability, and hence its safety and economics. There is, 
however, no universally applicable policy. The policy 
appropriate in a given case depends on the failure pattern 
and the overall situation. Traditional policies have been 
based on breakdown maintenance and/or scheduled main¬ 
tenance, and also opportunity maintenance, which are 
supplemented increasingly by on-condition maintenance 
and reliability-centred maintenance. 

The effectiveness of the maintenance should be moni¬ 
tored using measures suitable for the policy adopted. 
Maintenance policies and effectiveness have been dis¬ 
cussed in more detail in Chapter 7. 

21.19.4 Maintenance of protective devices 

Maintenance of the protective devices on the equipment is 
particularly important and should be covered by a formal 
system with full documentation. 

Some of the principal protective devices are: 

(1) pressure relief valves; 

(2) bursting discs; 

(3) tank vents and filters; 

(4) other pressure relief devices; 

(5) non-return valves; 

(6) mechanical trips and governors; 

(7) instrument trips; 

(8) other instrumentation; 


(9) alarm systems; 

(10) fire and gas detection systems; 

(11) sprinkler systems; 

(12) fire water systems. 

This list includes not only the more obvious protective 
devices, such as pressure relief valves, but also some other 
critical items which are not always thought of as protective 
devices, such as tank vents. 

The maintenance of instrument trip systems is very 
important. The design of such systems is based on the 
assumption of proof testing at fixed intervals and is 
invalidated if this is not done correctly. 

It is also important that the other instrumentation be 
maintained to a high standard. If the general instrument 
system is allowed to degrade with numerous incorrect 
measurements, false alarms and control loops on manual, 
the probability of control errors is greatly increased. 

Fire protection equipment should be well maintained so 
that it is available when required. There have been many 
instances where equipment has failed to operate, often with 
serious consequences. Maintenance of such equipment is 
dealt with in NFPA 25: Inspection, Testing and Maintenance 
ofWater-Based Fire Protection Systems. 

21.20 Spares Inventory 

The control of the spares inventory, or stock control, is of 
particular importance on process equipments, where the 
cost of downtime is generally very high. Accounts are 
given by Alford (1965), Corder (1976), Husband (1976), 
A. Kelly and Harris (1978), Vargas (1980b) and D.J. Smith 
(1985a). Generally, the proportion of management effort 
devoted to spares inventory control is small relative to that 
given to control of the workforce. 

21.20.1 Spares holdings 

Policy on the spare parts to be held in stock has to be a 
compromise between holding a large number of parts in an 
attempt to provide for virtually every contingency and 
holding only a small number in order to keep holding costs 
down. Some studies of maintenance systems have high¬ 
lighted spares, or lack of them, as the main problem faced 
by the maintenance function. 

Standard methods of stock control are the maximum- 
minimum level and the economical order quantity meth¬ 
ods. The former sets minimum and maximum stock levels 
together with a reorder level. The economical order quan¬ 
tity for an item is given by the relation 

Q = (2 RP/H) 1/2 [21.20.1] 

where H is the annual cost of holding the item, P is the cost 
of procuring it, Q is the optimal order quantity and R is 
the annual requirement. This formula takes no account of 
the criticality of the item, the lead time for its delivery or of 
the relationship between the item and other items. 

The methods of reliability engineering may in certain 
cases be used to determine the spares holdings. Some 
reliability models which may be used for this purpose are 
described by D.J. Smith (1985a). For an equipment which 
has n identical parts and a spares holding of r parts and for 
which the failure rate of these parts is known, the Poisson 
distribution may be used to determine the probability that 
over a specified period a situation will arise where the 
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spares have run out. This model assumes that the equip¬ 
ment is a series system with respect to the n parts; it does 
not take account of any redundancy in the equipment 
involving some of the n parts or of the time to replace a part. 
These and other features may, however, be taken into 
account by the use of Markov models. 

It is concluded by Husband that the soundest approach to 
the use of models may often be to base the holding on Pareto 
analysis of the main relevant features such as usage, criti¬ 
cality, lead time and cost. 

Guidance on spares holdings may be available from the 
equipment manufacturer in the form of a recommended list 
of parts to maintain the equipment for a specified period. 
Such a list will generally be based on the manufacturer’s 
experience and judgement. It may also utilize information 
on the number of parts which have been supplied to users 
on request. This information is hard data, but is liable to be 
incomplete, because many parts are either ordered from 
other suppliers or fabricated by the user company itself. It 
may well be, therefore, that better information even on the 
frequency of demand for particular parts is generated by 
the maintenance function itself. Certainly, maintenance is 
in a better position to assess the criticality of items and the 
lead times. 

The level of spares will be affected by the degree of 
standardization. Indeed, it is a principal aim of standardi¬ 
zation to reduce spares holdings. 

Another feature affecting spares holdings is the least 
replaceable assembly. This is the module or part at which 
during maintenance the process of fault diagnosis termi¬ 
nates and a replacement is made. 

Some of the factors relevant to the setting of spares 
holdings which are unique to a single equipment are the 
tolerable unavailability of the equipment, the failure fre¬ 
quency of the parts, the lead time and the costs of the parts. 

Where spares are common to a number of equipments, 
the situation may become either more complex or simpler. 
If the number of other equipments is small and the failure 
frequency of the parts is low, it may be necessary to con¬ 
sider the set of equipments as a whole and the interaction 
between them. But if the frequency of demand for the parts 
becomes high, the simpler treatments such as the Poisson 
model may well become applicable. 

Many accounts of spare holdings treat the demand for 
spares as a random process. In fact, where preventive 
maintenance (PM) is practiced, the demand for spares for 
PM work is more predictable. PM will also identify cases 
where parts will be needed in the near future. 

Management should assess the need to hold slow-moving 
but critical items, and unjustified pressure to reduce the 
holding of such an item should be resisted. It may be pos¬ 
sible to quantify the probability of requiring such an item 
and of not having it in stock and the consequences and costs 
of such a situation. But in any event it may be regarded as 
an insurance spare. 

The spares holdings will be strongly affected by the 
extent to which a ‘just-in-time’ policy is practiced. While, in 
principle, many of the factors just described still apply, the 
actual values of the optimum spares holdings may be 
appreciably different. 

21.20.2 Stores organization 

Features of the spares organization are the stores layout, 
the stores documentation, the coding system, policies on 
aspects such as used parts and cannibalization of parts and 


access to the store. An explicit policy should be formulated 
for the stores and their organization. 

Equipment spares may be grouped either by equipment 
or by common items, the latter being common to a number 
of plant equipment, for example bearings and seals. 
The system may well be a hybrid. There are three main 
types of item held in a store: equipment spares, consum¬ 
ables and tools. 

The stores documentation should be designed to imple¬ 
ment the stores policy. An account of typical stores records 
is given by Corder (1976). Since the use of computer systems 
is virtually universal in maintenance, the documentation 
must be compatible. 

The system for coding of items is liable to become extre¬ 
mely cumbersome unless it is well designed. Corder gives 
the example of a bearing made by three bearing manu¬ 
facturers and installed in the machines of six machine 
manufacturers, which then may well have 18 different code 
numbers. He discusses the method of classification and 
coding designed to overcome this. 

It is necessary to establish a policy with respect to used 
parts. Parts may be reconditioned and returned to the store, 
but the mixing of used and deteriorated parts with new or 
as-new parts is not good practice. 

A policy is also required on cannibalization. This can be 
extremely disruptive, which is an argument for prohibiting 
it. On the other hand, situations are likely to arise where a 
rigid ban could not only be very costly but could bring the 
policy into disrepute. It may be judged preferable to have a 
policy to control it. 

Access to the store should be controlled, but in some 
cases it is policy to provide an open store with free access 
for minor items, where the cost of wastage is less than that 
of the control paperwork. 

Materials for a major project should be treated separately 
from those for normal maintenance. Failure to do this can 
cause considerable disruption to the maintenance spares 
inventory. In this context a turnaround may count as a 
major project requiring its own dedicated store, as already 
described. 


21.21 Computer Systems 

The use of some form of computer system is virtually uni¬ 
versal for maintenance systems on process equipment. 
Accounts are given by Trotter (1979), Redding (1980), 
McChrystal (1982), Collington (1989) and Project Software 
and Development Inc. (PSDI, 1991) and M. Taylor (1991). 

Some functions which a computer-based maintenance 
information system may perform include (1) work orders, 
(2) planning and scheduling, (3) failure analysis, (4) cost 
and (5) budget. 

Many computer-based systems have started as accounting 
systems dealing with the costs of maintenance work. Such 
systems may or may not adapt readily to a wider variety of 
functions. The constraints which may be posed by an exist¬ 
ing system are not considered fur ther here. The maintenance 
system will link closely with the accounting system. 

Another system with which the maintenance system 
should link, and with which it may well be integrated, is the 
system for equipment inspection and inspection records. 

The design of a computer-based system should start 
by trying to ensure that the source of data fed to it is of 
high quality. This is both important and difficult. The 
people who have most of the information required are 
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the maintenance craftsmen. The problem has traditionally 
been that these craftsmen are reluctant to spend time on 
paperwork. 

With a manual system, it is difficult to give maintenance 
personnel much incentive to furnish high quality informa¬ 
tion. A computer-based system, however, does provide 
the means of offering such an incentive by creating a sys¬ 
tem where they have access to information which is useful 
to them. 

The basic building element of a computer-based system, 
as of a manual one, is the work order. Work orders for regu¬ 
lar jobs can be held and orders for new jobs entered. The 
work order for a particular job will generally contain a wide 
range of information such as resources (labour and equip¬ 
ment, spares, timing and costs). This provides the basic 
data for the other features of the system. 

Closely linked with the work order is the detailed plan for 
performing the work. The system facilitates the generation 
of job plans which give a complete description of the work to 
be done. This makes it easier to ensure that nothing is 
missed and that even small issues are corrected before they 
escalate. 

A computer-based system is a natural tool for the planning 
and scheduling of the work orders. This includes orders both 
for breakdown maintenance and for PM. Resources such 
as labour and equipment can be scheduled. Work can be 
held until material is on-site. Schedules can be developed to 
accommodate backlogs and priorities. 

Failure analysis is another widely utilized function, but 
the meanings attached to this term vary. It may involve an 
analysis of the causes, frequency and cost of repairs. Or it 
may extend to more sophisticated analyses such as Weibull 
analysis to determine the failure regime. 

As already mentioned, cost was one of the first func¬ 
tions. There are a variety of features which come under 
this heading. Basic features include the cost of labour 
and parts. For routine jobs, standard cost estimates may 
be used. More advanced cost features include the hand¬ 
ling of depreciation and assisting decisions on repair vs 
replacement. 

Budgetary control is a standard feature, which facilitates 
not only determination of the budget for some forthcoming 
period, but control of day-to-day expenditure. 

It may be advantageous to order items in a hierarchy 
within the system so that an overview can be obtained not 
only of basic elements but also of aggregations which con¬ 
stitute complete equipments or plant functions. 

There are a number of pitfalls in the implementation of a 
computer-based system. One is the input of the initial data. 
One strategy to ease this task is to identify critical features 
and enter them, and then to build up the rest as particular 
jobs arise. 

Experience of computer-based systems indicates a num¬ 
ber of beneficial effects. One is that effort is freed so that 
more attention can be devoted to planning and to preventive 
work. A simple example cited is a reduction in the ratio of 
breakdown to PM jobs from 0 :1 to 2.5 :1. The reduction in 
the proportion of breakdown jobs means that the main¬ 
tenance function gets more on top of its work and enters 
a virtuous circle. As preventive work becomes relatively 
more prevalent, the timing of such work becomes less cri¬ 
tical, since the equipment is a better state of maintenance. 

Another important benefit is in increase in the cred¬ 
ibility of the maintenance function, because the data is 
available to support reliable operation. Improved relations 


with the operations function is another gain, signalled 
when production take the initiative in asking for equipment 
to be included in the PM schedule. More generally, an 
effective computer-based maintenance system becomes an 
important resource for many other functions, notably those 
of design and SLP 

The use of a computer-based system to handle the prob¬ 
lem of a half-yearly PM whose schedule has slipped is out¬ 
lined by Collington (1989). He describes in effect the 
creation of a form of expert system to assist with the cur¬ 
rent and future decisions. 

A description of a particular computer-based system for 
an LPG terminal has been given by the PSDI (1991). 

21.22 Modifications to Equipment 

Some work goes beyond mere maintenance and constitutes 
modification or change. Such modification involves a 
change in the equipment and/or process and can intro¬ 
duce a hazard. The outstanding example of this is the 
Flixborough disaster. The Flixborout Report (R.J. Parker, 
1975, para. 209) states: ‘The disaster was caused by the 
introduction into a well designed and constructed plant of a 
modification, which destroyed its integrity’. 

It is essential, for there to be a system of identifying 
and controlling changes. Changes may be made to the 
equipment or the process, or both. It is primarily equip¬ 
ment changes which are discussed here, but some con¬ 
sideration is given to the latter. 

OSHA PSM 1910.119 (1) requires a written program to 
manage changes to process chemicals, technology, equip¬ 
ment, procedures and facilities. OSHA PSM 1910.119 (i) 
also requires a pre-start-up safety review. The control of 
plant expansions is dealt with in Major Hazards. Memor¬ 
andum of Guidance on Extensions to Existing Chemical 
Plant Introducing a Major Hazard (BCISC, 1972/11). The 
hazards of equipment modification and systems for then- 
control are discussed by, Henderson and Kletz (1976) and by 
Heron (1976). Selected references on equipment modifica¬ 
tion are given in Table 21.4. 

21.22.1 Types of changes 

Changes may be classified according to the stage at which 
they are made: 

(1) design; 

(2) commissioning; 

Table 21.4 Selected references on equipment modifi¬ 
cation 


IChemE (1966/43,1985/125); FPA (1970/10,11); K.Wood 
(1971); BCISC (1972/11); Booth (1976); Cannon (1976); 
Henderson and Kletz (1976); Heron (1976); Kletz (19761, 
19821,1984d, 1985g, 1991d); WW. Russell (1976); Anon. 
(1980 LPB 34, p. 1); van den Berg etal. (1980); R.E. Sanders 
(1983,1992,1993b); Wang and Patel (1984); Baker-Counsell 
(1985e); Sha and Bohlinsky (1985); Speedie (1985); 
MacFarlane (1986); R. Atkinson (1987); Eishout and 
Kilstrom (1988); Kesler (1988); Ramsay (1990);Tian and 
Wang (1990); Anon. (1994 LPB 119, p. 17); Anon. (1994 LPB 
120, p. 13); Turney (1994 LPB 120) 

Modification chains: Kletz (1986f) 

Plant retrofitting, updating: NRC (Appendix 28 
Retrofitting); Kletz (1981e,h) 
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(3) operating. 

They may be distinguished by the degree of permanence: 

(1) temporary; 

(2) permanent. 

These different situations tend to have their own char¬ 
acteristic hazards. Some of these are illustrated by Case 
Histones B52-B56. 

Changes made during the design process really fall 
outside the present discussion, which is mainly concerned 
with the stages of commissioning and operation. It is suf¬ 
ficient here to re-emphasize the points already made 
concerning the need to ensure that at the design stage 
there is an adequate system of identifying and document¬ 
ing any changes made. The commissioning stage, and 
the immediately preceding pre-commissioning stage, is 
often a period when large numbers of changes are 
made, frequently under intense pressure. Commissioning 
changes tend to be aimed at making the equipment work. 


In the operations stage, the object is rather to keep the 
equipment going. But again changes may be done under 
considerable stress. 

The scale of changes and the level at which expenditure 
is approved vary greatly. At one extreme there are minor 
changes with minimal approval but documentation 
required by the individual making the change. At the other 
end are changes requiring approval by senior management. 
For major changes, project approval is required to control 
costs and change approval is required to ensure safety. All 
changes must be managed properly. 

21.22.2 Pressure relief and blowdown hazards 

A major hazard which is liable to arise as a result of change 
and one which is particularly dangerous is the pressure 
relief and blowdown invalidation. Some illustrations of the 
way in which this can occur have been given hy Henderson 
and Kletz (1994) and are shown in Figures 21.9—21.11. The 
situations are self-explanatory. 

Another type of change is the de-rating of a equipment to 
a lower operating pressure. In this case, while the need to 





lief 


Figure 21.9 Modifications invalidating pressure relief arrangements - 1 (Henderson and Kletz, 1976) 
(Courtesy of the Institution of Chemical Engineers) 
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vessel 

Figure 21.10 Modifications invalidating pressure relief arrangements - 2 (Henderson and Kletz, 1976) (Courtesy 
of the Institution of Chemical Engineers) 


alter the pressure relief valve setting is usually appre¬ 
ciated, it is sometimes forgotten that it is necessary also to 
check the relief valve capacity, which is reduced by the 
de-rating. Similarly, an increase in equipment throughput 
may require a change in pressure relief valve capacity. 

The ease with which hazards associated with pressure 
relief arise mean that the review of pressure relief is par¬ 
ticularly important. 


21.22.3 Other hazards of changes 

Other hazards which can arise due to changes are exem¬ 
plified by the case histories given in Appendix 1. Some of 
the general features from these are considered here. 


Changes can invalidate not only pressure relief but also 
instrument systems. In particular, a situation may be cre¬ 
ated where an important measurement signal is degraded 
by the interposition of a restriction, filter, etc. This is illus¬ 
trated by Case History B52. 

A common change is the temporary replacement or 
bypassing of equipment such as a reactor or heat 
exchanger with a length of pipe. This appears to be a simple 
matter, but it is still necessary to design the pipe properly 
and to provide supports. The hazard is shown by the 
Flixborough disaster. 

An alteration of a device which in some way limits flow 
or pressure can create a hazard. Examples include the 
removal of a regulator, orifice, etc. installed specifically to 
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Figure 21.11 Modifications in validating pressure relief arrangements - 3 (Henderson and Kletz, 1976) (Courtesy 
of the Institution of Chemical Engineers) 


restrict flow, and the increase in the size of a valve trim or 
installation of a pump impeller capable of a greater head. 

Changes which appear quite minor can nevertheless 
introduce hazards. Other hazards are listed in the form for 
the control of modifications shown in Figure 21.12. 

21.22.4 Changes to the process 

The lesson commonly drawn from the Flixborough disaster 
is the importance of maintaining the integrity of the 
equipment and of avoiding degradation due to an equip¬ 
ment change. The equipment can also be put at risk, how¬ 
ever, by the operation of the process outside the envelope 
of operating conditions for which the pressure system is 


designed. It is essential, therefore, to control such process 
changes as well. 

Moreover, even if the envelope of operating conditions 
remains the same, a change in operating practice may 
affect features such as inspection and test intervals, which 
tend to be based on historical equipment experience. 

21.23 Managing Change 

The elements of a system for managing change are (1) pro¬ 
cedures, (2) assessment, (3) inspection, (4) documentation 
and (5) training. 

There should be a formal procedure which requires all 
modifications to be authorized by competent persons and a 
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standard method of making the safety assessment; there 
should be a system of inspection of changes by a competent 
person to make sure the work has been done as intended 
and is complete; there should be a system of documentation 
to record the change; and there should be adequate training 
so that all personnel concerned understand the system of 
control. 

OSHA PSM Standard requires a written procedure to 
manage changes. Several considerations must be addressed: 

(1) technical basis; 

(2) impact of change on safety and health; 

(3) modifications to operating procedures; 

(4) necessary time period for the change; 

(5) authorization requirements. 

Additional management of change (MOC) requirements are: 

(1) employees involved in operating and maintaining the 
equipment shall be informed of, and trained in, the 
change prior to implementation of the change; 

(2) process safety information shall be updated; 

(3) operating procedures or practices shall be updated. 

21.23.1 Identification of changes; 

The identification of changes is a crucial problem. It is 
necessary, but not always easy, to identify items which in 
fact constitute changes. This requires that a change be 
defined. A simple definition of change is any addition, 
modification or replacement that is not a replacement- 

The following two-part definition is given by Henderson 
and Kletz: 

(1) Any change in the equipment, temporary or perma¬ 
nent, which may affect the safety of the process or 
safety and integrity of the equipment. It does not 
include changes in engineering equipment which are 
not in contact with the process and cannot affect 
the safety of the process or the safety and integrity of 
the equipment. 

(2) Any change in process materials, services, operating 
conditions or operating procedures, and including 
experimental programmes, which fall outside estab¬ 
lished practice. 

The first part of this definition covers those equipment 
changes which are normally understood as equipment 
modifications. The second part brings in the process modi¬ 
fications also. 

In the system described by these authors, it is the 
responsibility of the plant manager and plant engineer to 
identify modifications. 

21.23.2 Authority for changes 

Systems for managing change and the levels at which par¬ 
ticular types of change can be authorized vary somewhat, 
but the basic principles are quite clear. There should be a 
well defined and understood system of authorization. 

The system described by Henderson and Kletz (1976) is 
that any change to equipment or process must be authorized 
in writing by a competent manager and engineer. This 
applies to any change, however inexpensive and temporary, 
as well as permanent changes. The level of authorization is 
usually the lowest level of technical management. It is 
important that a proper review is held on every change. 


Avarying group of individuals will be required based on the 
change being proposed. At a minimum, the operation, pro¬ 
cess and mechanical personnel should review and approve 
changes. If the change involves instruments or electrical 
modifications, an instrument and electrical engineer 
should also review and approve. The review team should be 
comprised of the personnel necessary to adequately review 
the change being proposed. It is essential that these per¬ 
sonnel be capable of recognizing problems which lie outside 
their area of competence and be willing to consult other 
resources. Modifications proposed are not always neces¬ 
sary. Sometimes the proposal is a symptom of a problem 
which is better dealt with in some other way. The technique 
of critical examination, described in Chapter 11 in relation to 
design, is applicable to modifications also. Questions which 
may be asked concerning a modification are: Is it neces¬ 
sary? Is it economic? Is there a better alternative? 

21.23.3 Design authority 

Some changes require complete design by a specialty 
engineering group. There is a problem area here. Many 
plants are designed and built by outside contractors, who 
initially have the greatest expertise about the process and 
equipment, but also eventually lose touch with it. There is, 
therefore, typically a transfer of expertise to a design 
authority within the organization and often outside the 
company. Plant personnel must assure that design groups 
adhere to the safety requirements and change policy. 

21.23.4 Procedure for changes 

The procedure given by Henderson and Kletz requires that 
before authorizing a modification particular attention 
should be paid to ensuring that: 

(1) The number and size of relief valves required are not 
changed (or any necessary changes are specified). 

(2) The electrical area classification is not changed (or 
any necessary changes to the electrical equipment are 
specified). 

(3) There are no effects on trips or alarms (or any neces¬ 
sary changes are specified). 

(4) There are no other effects which might reduce the 
standard of safety. 

(5) The appropriate engineering standards are followed. 

(6) The right materials of construction and fabrication 
standards are used. 

(7) Existing equipment is not subjected to conditions 
beyond the design basis without checking that it can 
withstand the new conditions. 

(8) Any necessary changes in operating conditions 
are made. 

(9) Adequate instruction and training are provided to 
operating and maintenance teams. 

21.23.5 Safety assessment of modifications 

The above procedures need to be supplemented by a system 
for the identification of hazards in the modification. The 
method described by Henderson and Kletz makes use of the 
safety assessment form shown in Figure 21.12. The form is 
best completed not by a single individual but by two or 
three people working together. The top half of the form 
provides check words which form the basis for a hazard and 
operability study and the bottom half gives a more con¬ 
ventional checklist. A similar assessment checklist and 
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guidance is provided in CCPS, AIChE: Guidelines for 
Hazard Evaluation Procedures. 

It is found helpful in making the safety assessment to 
assume that, until it is shown otherwise, any isolation valve 
or other restriction will isolate an equipment from its pro¬ 
tective device, for example a vessel from its relief valve, 
and that any new line will introduce some unwanted con¬ 
tamination, overpressure of some equipment or more flow 
into some equipment than its outlet pipes can handle. 

This procedure, therefore, makes use of a standard form 
to initiate a safety assessment which goes beyond the use of 
a checklist. 

21.23.6 Inspection of modifications 

It is the responsibility of the person authorizing a modi¬ 
fication to carry out a pre - commissioning inspection of that 
modification and to satisfy himself that it is in accordance 
with the design intent, that the standards for design, con¬ 
struction and testing have been followed, that the provi¬ 
sions of the safety assessment have been met and that the 
work is complete. 

21.23.7 Documentation of modifications 

It is essential that equipment documentation be kept up to 
date and therefore that any modification be recorded. This 
requirement may be met by the use of a formal change 
procedure. If the modification requires alterations to oper¬ 
ating or inspection practices, it is necessary that the 
appropriate changes be made in the documentation cover¬ 
ing these aspects. 

21.23.8 Training on modification systems 

A system for the control of modifications can only work if 
all the personnel involved are aware of and have an under¬ 
standing of the system through training. The process opera¬ 
tor who may turn off an agitator, the maintenance fitter who 
may blind off a vent, and the instrument technician who may 
alter a trip setting, all need to be aware of the hazards which 
these types of modification may involve and of the system 
of control of modifications. 

The plant supervisors and engineers who authorize 
modifications need to have the theoretical knowledge, 
general practical experience and experience of the parti- 
cularprocess and equipmenttorecognizepotential hazards, 
and also to appreciate situations where they should call in 
expert assistance. 

21.23.9 Commissioning modifications 

The commissioning stage tends to involve numerous mod¬ 
ifications at a time when the plant staff are heavily loaded. 
It may be appropriate, therefore, to appoint special per¬ 
sonnel to check these modifications. People who have been 
involved in hazard identification during the design stage 
may well be suitable for this task. It is also advisable to 
conduct a post-commissioning check of the pressure relief 
and blowdown arrangements about a year after start-up. 

21.23.10 Variations in modification control 

The system for control of modifications just outlined is 
essentially that described by Henderson and Kletz, and is 
intended primarily for larger continuous petrochemical 
plants. Other systems may be more appropriate for other 
types of equipment, although the basic principles remain 
applicable. 


21.24 Some Modification Problems 

21.24.1 Design codes and standards 

Like equipment design, change should be done in accord¬ 
ance with applicable standards or codes. Design standards 
or codes are not applied retrospectively to existing equip¬ 
ment and its changes. 

There is a problem, however, which arises from the nat¬ 
ure of the advanced codes such as the ASME Boiler and 
Pressure Vessel Code, Section VIII, Division 2, BS 5500, 
and earlier BS 1515. The design criteria in such codes are 
quite complex, may require analysis of stress concentration 
sites, of fatigue and creep and assume finite equipment life. 
Design according to these codes is a specialist matter. 
Expert advice is necessary for any change to equipment 
designed to codes. Moreover, such advice may well be 
required in some cases for repairs on such equipment. 

21.24.2 Repair and modification codes 

The main guide for equipment repairs and modifications is 
API RP 510: Inspection, Rating and Repair of Pressure Ves¬ 
sels in Petroleum Refinery Service. API RP 510 gives an 
account of its origin as a complement to the ASME Boiler 
andPressureVessel Code before SectionVIII of the latter was 
split into two divisions. The ASME Code is written for new 
construction.With respect to repair or modification, RP 510 
states that where due to its new construction orientation the 
ASME Code cannot be followed, RP 510 has precedence. 

21.24.3 Materials aspects 

The materials for changes or repair should be ‘suitable’ and 
should have properties at least equal to that of the parent 
material originally used. If the codes apply, the materials 
should have guaranteed minimum properties and should 
be so certified. It is also necessary that both parent and 
replacement materials should be capable either of with¬ 
standing the fabrication processes without losing their 
required properties or of having these properties restored. 

The availability of suitable materials may be a problem, 
either because a material is no longer made or because 
delivery times are long. 

The parent material is sometimes degraded and may 
require treatment before welding can be done on it. Thus, 
for example, if there is surface sulfur contamination, it may 
be necessary to remove the contamination by grinding and 
then to preheat to allow welding. In some cases, the parent 
metal may have been rendered unweldable by high tem¬ 
perature exposure or hydrogen attack. 

The application of quality control procedures can give 
rise to difficulties. There has been continuous progress in 
the measurement of defects in materials and in acceptance 
standards. The situation can easily arise, therefore, where 
the quality demanded for the replacement materials far 
exceeds that of the original equipment material. 

The properties of both parent and replacement materials 
may be affected by activities such as cold working, pre¬ 
heating or welding. Material properties may be restored 
to some extent by suitable heat treatment, but the heat 
treatment operations which can be carried out are strictly 
limited. 


21.25 Major Plant Expansions 

Major plant expansions are in large part covered by the 
procedures for design, on one hand, and for change on the 
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other. Nevertheless, such major expansion merits at least 
brief consideration in its own right. Reference has already 
been made to the British Chemical Industry Safety Council 
publication on plant extensions (BCISC, 1972/11). The con¬ 
trol of major extensions is discussed by K. Wood (1971). 

21.25.1 Design of changes 

A maj or expansion involves changes on a greater scale than 
a normal equipment modification. This means that it is 
particularly necessary to check on the various facilities 
which may become inadequate or overloaded as a result of 
the expansion. Some features of the design which should be 
checked with this in mind are: (1) pressure relief valves; 
(2) vent, flare, blowdown and absorption systems; (3) drains 
and sewers and (4) safety trip systems. 

The design, location and capacity of the pressure relief 
valves should be checked and sufficient spares provided. A 
review should also be made of the need for liquid thermal 
relief on long sections of off-site piping which could be 
blocked in. 

The facilities for gas and vapour relief, for flaring, for 
liquid blowdown and for emergency absorption should be 
checked. 

The check on sewers and drains should cover not only 
the capacity of the underground sewers, but also that of the 
surface drainage so as to ensure disposal of fire water. 

A major expansion also involves more extensive changes 
of equipment configuration. It is particularly important, 
therefore, to check not only that there are suitable safety 
trip systems on the expansion itself, but that those on the 
existing equipment are also still appropriate. 

21.25.2 Layout for expansions 

The problems of piping work during the expansion should be 
given special attention. The number of live pipelines passing 
through the non-operating areas should be kept to a mini¬ 
mum. Despite the best safe-working procedures, incidents 
are frequent in which live lines are broken or cut open by 
construction personnel. 

Utilities lines should be isolated from the non-operating 
area by block valves. Sewers should also be isolated from 
the non-operating area, since they present the hazard that 
flammable gas may flow through them from the operating 
into the non-operating area. Sewers should be isolated 
completely. 

There should be adequate provision of blind points to 
permit pre-commissioning testing of equipment such as 
compressors on air or gas recycle, while maintaining isola¬ 
tion of the non-operating areas from flammable gas and 
utilities. 

21.25.3 Safe-working procedures 

A major expansion usually means that there are on site a 
large number of contractors’ personnel. This situation is a 
particularly severe test of the safe working procedures and 
the normal procedures should be reviewed to check that 
they are adequate. 

The original equipment usually continues in operation 
while construction work is in progress on the expansion. It 


then shuts down so that it can be tied in to the expansion 
facilities. It is necessary to control work in the non-operating 
area closely, so as not to interfere with the operating unit, 
and it is desirable that if it is necessary to carry out 
gas-freeing operations on shut-down, then hot work in the 
non-operating area should cease until this has been done. 

The permit system is usually that in normal use. But the 
number of permits issued is likely to increase greatly and 
operations personnel may need to be assigned full time to 
analytical testing of atmospheres and issuing of permits. 

In these circumstances, the identification of equipment 
becomes even more important. Permits should specify 
clearly the equipment to be worked on and there should be 
positive identification of equipment. A colour code agreed 
with the contractors may be used as an additional means 
of identification. Pipelines and equipment in the non¬ 
operating area which are live should be clearly marked with 
an agreed code, colour and tags. 

It is necessary to ensure that the contractors’ blinds are 
kept separate. The contractors blinds should be uniquely 
identified (physical features, colour, etc.) to distinguish them 
from normal facility blinds. Furthermore, there should be 
an instruction that neither party must remove the other’s 
blinds. Incidents occur in which contractors’ personnel 
remove Winds from live lines. As mentioned earlier, in some 
permit systems a separate permit is needed for the inser¬ 
tion or removal of blinds. This is particularly appropriate 
for work on major expansions. 

There is need for an alarm system to cover the hazard of 
flammable gas release from an operating unit while hot 
work is being done in the non-operating area. Personnel in 
the non-operating area should be instructed to stop hot 
work when the alarm is raised. The normal alarm system 
should also be explained to them. 

The hazard of illicit smoking should be reduced by the 
only effective means available, which is the provision of 
smoking areas. 

The personnel involved in the expansion should be given 
training on the hazards and procedures. 


21.26 Notation 


cleaning disturbance factor 
drag force on particle 
fluid velocity relative to particle 
density of fluid 


Subscripts: 

1 cleaning 

2 operating 


annual cost of holding item 
cost of procuring item 
optimal order quantity of item 
annual requirement for item 
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22/2 STORAGE 


By far the largest quantities of chemicals are found in 
storage facilities, which may be at chemical plants or in 
other storage terminals. The prevention of loss in storage is 
therefore extremely important. 

It has long been appreciated that loss of containment 
from storage of toxic chemicals could have particularly 
serious consequences. The hazard of toxic release has been 
considered, therefore, in some detail in Chapter 18. The 
hazard was realized at Bhopal, which was the worst dis¬ 
aster which has ever occurred in the chemical industry. 
A toxic release with consequences on this scale, or any¬ 
thing approaching it, is extremely rare and stringent meas¬ 
ures are taken to avoid it. 

Losses through fires in storage, on the other hand, con¬ 
stitute a major part of the losses sustained by the industry. 
Mostly these result in financial loss rather than loss of life 
and tend to make relatively little public impact. But there 
are exceptions such as the disasters at Feyzin, Caracas and 
Mexico City. 

Some idea of the potential for fire loss may be obtained 
by considering the value represented by a single storage 
tank. A‘jumbo’ tank might contain 500,000 barrels of oil 
worth US$10 per barrel and might itself be worth US$4 per 
barrel capacity, making a total value of US$7 million 
(OIA, 1975 Loss Control Bull. 400—1). Jumbo tanks of from 
300,000 to 1,000,000 barrels capacity are currently being 
used to store not only crude oil but also flammable inter¬ 
mediate and finished products. 

Storage is one of the areas in which there is a good deal of 
legislation. This was described in Chapter 3. 

Much storage is sited in or near urban areas. It is gen¬ 
erally reckoned to be relatively safe and unlikely to cause 
large loss of life, but it is nevertheless a source of some 
public concern. There is, therefore, the problem of siting 
and of the relation between siting and preventive measures. 
This aspect is considered in Chapter 4. Storage is fre¬ 
quently one of the topics dealt with under the headings of 
plant siting and layout, and some aspects of storage have 
been considered in Chapter 10. 

The location of storage in relation to the process is also 
important. Storage is most likely to be put at risk by a pro¬ 
cess. It is necessary, therefore, for the two to be segregated. 
This reduces the risk of a process incident hazarding the 
very large inventory in storage. It also makes it less likely 
that a minor incident in storage will put the process at risk. 

There are numerous standards and codes of practice 
which are applicable to storage. The treatment of storage 
given here attempts to outline some of the principles 
described in the codes. There are differences, however, 
between codes and there are critics of the codes, and some 
of these points are mentioned also. The practices described 
should be regarded only as typical. In particular, the codes 
themselves should be used for design work. 

Safety in storage is as much a matter of operation and 
maintenance as of design. Some aspects of operation and 
maintenance of storage were discussed in Chapters 20 
and 21, respectively. 

Good operation and maintenance depend on an effective 
management system. While it should be possible to assume 
that such a system exists in a large chemical works, there is 
potentially a problem in situations where products such as 
liquefied petroleum gas (LPG) or chlorine are stored and 
used in non-chemical and low technology industries. In this 
case, a particular responsibility rests on the supplier of the 
chemical to advise the user. 


There is no UK code specifically for the storage of 
chemicals in general except insofar as these are covered 
by codes for petroleum products, flammable liquids, LPG 
and liquefied flammable gas (LFG), but there are codes 
for a number of individual chemicals. 

The treatment given here deals in turn with the storage of 
flammable materials, the storage of toxic materials, load¬ 
ing and unloading facilities, drum and cylinder storage and 
warehouses. It also describes case histories and hazard 
assessments of storage. 

Selected references on storage of hazardous materials 
are given in Table 22.1. 


Table 22.1 Selected references on the storage of 
hazardous materials 


Aldrich (1960a,b); Grover and Wilson (1960); Hower (1961); 
Leach (1962); Duggan (1964b); Fuller and Bristline (1964); 
Risinger (1964h); Zick and Clapp (1964); Hughson (1965); 
IP (1980 Fur. MCSP Pt 2,1981MCSP Pt 3,1987 MCSP Pt 9); 
Redington (1965);Voegelen (1965); IChemE (1966/44); 
FMEC (1967); Salot (1967);Wardale and Todd (1967); Cotton 
and Denham (1968); Denham, Russell and Wills (1968); 
Home Office (1968/1,1971/2); Zick and McGrath (1968); 
D.M. Johnson (1969); Boberg (1970); FPA (1970/12,1972/17, 
1989 FS 6011,6012); Hearfield (1970); J.R. Hughes (1970); 
ICI/RoSPA (1970IS/74); J.S. Clarke (1971); Simpson (1971); 
McGrath (1973,1975,1976); Mecklenburgh (1973,1976, 
1985); R.C. Ross (1973); Shinnar (1973);Vervalin (1973a,f); 
Chicago Bridge and Iron Co. (1974,1975a,b, 1976a,b); 
Unwin, Robins and Page (1974); Walsham (1974); OIA (1975 
Loss Control Bull. 400-2); HSE (1977 CS/2); Wafelman 
and Burhmann (1977); Ghali (1979); Santi (1979); Malina 
(1980); API (1981 Refinery Guide ch. 13,1982/5,1984 
Publ. 2008,2001 Std 620,1998 Std 650); Burk (1981); Anon. 
(1982 LPB 47, p. 26); Doi and Osawa (1983); Gallagher 
(1983); Giger, Gygax and Hoch (1983); Petherbridge and 
Kinder (1983); Prieto (1985); Ackermann (1986); AlChE 
(1986/85); Anon. (1987w); Frey and Handman (1987); 

Sims (1987); Nazario (1988); ILO (1989); Sanders, Haines 
and Wood (1990); ACGIH (1991/4,1987/15); Seton, 

Fitterer and Harris (1992); Bartlett, Hall and Gudde 
(1993); Rorty and McLearn (1993); Shah, Shah and Mody 
(1993); ANSI MH5.1.3M-1982 BS (Appendix 27 Pressure 
and Other Vessels), BS 4994:1987; NFPA (2002/NFPA13, 
2003/NFPA 230) 

Low temperature storage 

H.V Bell (1982); Pieper, Zick and Fave (1982); Aarts and 
Morrison (1981); EEMUA (1986 Publ. 147); CGA (2002 CGA- 
341); Anon. (1988 LPB 79, p. 25) BS 4741:1971, BS 5387:1976 

High temperature storage 

Karcher (1978,1981) 

Atmospheric tanks (see also Particular chemicals, 
below) 

Ulm (1963); Zick and McGrath (1968); Anon. (1975 LPB 0, 
p. 3); McGrath (1976); CIA (1978/11); H.I. Epstein and Buzek 
(1978); Morgenegg (1978); Anon. (1980 LPB 32, p. 1); 
Winegar (1980); G. Allen (1984); API (1985/15, 2001 Std 
620,1998 Std 650); C. Clark (1987); Kletz (1988m); ASME 
(1999 B96.1); IGasE (IGE/SR/7); HSE (1991 HS(G) 52); 
Hassan (1992); W.B. Howard (1992a); BS 799 Pt 5:1987, 

BS 2654:1997 
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Overfill protection: API (1996 RP 2350) 

Tank stability, collapse: McGrath (1963); Anon. (1975 LPB 0, 
p. 3); Cuperus (1979,1980); Skowronski (1980);Winegar 
(1980); Anon. (1981 LPB 37, p. 1); J.C. Thompson (1985); 
Anon. (1988m);Trbojevic and Gjerstad (1989);Trbojevic 
and Slater (1989); Neville and White (1991); Peters and 
Hansel (1992) 

Layering, rollover: Chatterjee and Geist (1972); Sarsten 
(1972); Drake, Geist and Smith (1973); Germeles 
(1975a,b); Drake (1976); Bellus etal. (1977); Anon. (1979 LPB 
29, p. 124); Heestand, Shipman and Meader (1983); 

Nakano etal. (1983);Takao and Suzuki (1983); Anon. (1992 
LPB 107, p. 1) 

Tank foundations, settling 

WW Moore (1963); Rinne (1963); Morrison and Marshall 
(1970); C.C. Hale (1974); Esrig, Ahmad and Mayo (1975); 
Comeau and Weber (1977); Lichtenberg (1977); BRE (1978 
CP14/78); Vick,Witthaus and Mayo (1980); Russo and 
Haydel (1983); Martinez, Madhavan and Kellett (1987) 

Tank linings 

Sumbry and Bogner (1993) 

Concrete storage tanks 

E.L. Smith (1966); Edmondson (1984 LPB 54) 

Secondary containments, bunds 

Comeau (1972); MacArthur (1972); C.C. Hale (1974); J.D. 
Reed (1974); CIA (1975/8); Anon. (1978 LPB 24, p. 164); 
Anon. (1979 LPB 26, p. 52); Koerner and Lord (1987); 
Barnes (1990 SRD R500); FPA (1990 CFSD FS 6027); 
Wilkinson (1991 SRD R530); Rakoczynski and Long 
(1993) 

Bund overflow: Greenspan and Young (1978); Greenspan 
and Johansson (1981); Michels, Richardson and Sharifi 
(1988); Barnes (1990 SRD R500); Wilkinson (1991 SRD 
R530) 

Impounding basins: Roopchand and Moderegger (1993) 

Vents, reliefs, flame arresters 

Cinnamon and Myers (1965); HSE (1965 HSW Bklt 34); API 
(1966 Bull. 2521,1982 PSD 2210,2000- RP 520,1997 RP 
521,1991 Publ. 2028,1998 Std 2000); Anon. (1972k); G.F. 
Bright (1972); Cude (1974a,b); Gustin and Novacek (1979); 
Anon. (1980 LPB 36, p. 1); Gerardu (1981); Anon. (1986 LPB 
72, p. 1); Forster, Schampel and Steen (1986); Kletz (1986 
LPB 67); Leung et al. (1988); W.B. Howard (1992a,b); NFPA 
(1994NFPA68) 

Evaporation, vapour recovery 

Zabaga (1980); Beychok (1983); Laverman (1984); Rapp 
(1984); Durr and van Laerhoven (1985) 

Tank inerting 

Kletz (1971); Craven (1975); Forster, Schampel and Steen 
(1986); W.B. Howard (1992a) 

Tank insulation 

Leach (1962); Adorjian, Crawford and Handman (1982); 
Huther, Zehri and Anslot (1985); Kaups (1985); Krause 
(1985) 

Heat gain, loss: Falicoff and Popovich (1981); Kumana and 
Kothari (1982); Scheirman and Rogers (1985) 

Tank farms 

D.M. Johnson (1969); OIA (1975 Loss Control Bull. 400-2); 
Burk (1981); Ahmed (1984) 


Gas storage, gasholders 
IGasE (n.d./l, 1986IGE/SR/14) 

Above ground storage 

AGA (1981/37,1986/47); UL (1987 UL142); API (1997 
RP 651,652,1991 Publ. 301) 

Leak detection: API (1991 Publ. 306,307) 

Underground storage 

Scisson (1969); J.R. Hughes (1970); ICI/RoSPA (1970IS/74); 
Sherman (1970);Temple (1973); Beam and Giovannetti (1975); 
Weismantel (1978); Dwyer (1985); UL (1985 UL 58,1986 UL 
1316); Russell and Hart (1987); Schwendeman and Wilcox 
(1987); K.W. Brown and Thomas (1988); Haxo (1988); Anon. 
(1989c); Darilek and Parra (1989); Higgins and Byers (1989); 
E. Johnson (1989a); Lindblom (1989); Semonelli (1990); 
Chidambariah etal. (1991); Bellani, Cannalire and Beltrame 
(1992); Geyer (1992); NFPA (1992 NFPA 328,329); IBC (1993/ 
107); Maresca etal. (1993); J.E. Robinson (1993) 

In-ground barriers 

API (1993 Publ. 315); Khinnavar et al. (1991) 

Frozen earth storage 

Massey (1964); Ferguson (1975); HSE (1978b, 1981a); 
Boulanger and Luyten (1983a,b) 

Loading and unloading facilities 

OIA (Publ. 711); Herzog, Ballard and Hartung (1964); 
ICI/RoSPA (1970 IS/74); API (1986Bull. 1003); Houghton, 
Simmons and Gonso (1976); Anon. (1977 LPB 15, p. 2); Rees 
(1981); Ackermann (1986); Lichtenberg (1987); Anon. (1992 
LPB 103, p. 24) 

Hoses: CGA (1983 TB-3,1985 P-7); UL (1984 UL 536,1985 
UL 1,1986 UL 21); BS (appendix 27 Hoses and Hose Couplings) 

Filling ratios 

ICI/RoSPA (1970 IS/74) BS 5355:1976 

Marine terminals 

J.R. Hughes (1970); NFPA (2000 NFPA 307) 

Container storage 

HSE (1991 HS(G) 51); NFPA (2003 NFPA 55) 

Drum storage: Anon. (1979 LPB 27, p. 68); Anon. (1979 LPB 
28, p. 115); Anon. (1985cc) 

Intermediate bulk container storage: Spivey (1992) 
Cylinder storage: Home Office (1973/4); Anon. (1978 LPB 20, 
p. 45); BCGA (1988 GN2) 

Warehouses (see also Tables 16.1 and 16.2) 

FPA (1970/9,13); HSE (1971 HSW Bklt 47); Mecklenburgh 
(1973,1985); CIA (1983 RC28); Sims (1987); Heels (1988 LPB 
84); C.R. Pearson (1988); Anon. (1989 LPB 88, p. 9); HSE 
(1991 HS(G) 64,1992 HS(G) 71); NFPA (2003 NFPA 230); 

R. Gibson (1992); ANSI MH21.1-1974 

Fire, explosion (see also Table 16.2) 

Vervalin (1964a, 1973a); Hearfield (1970); Simpson (1971); 
Kovacs and Honti (1974); OIA (1974 Loss Inf. Bull. 400-1); 
R.B. Robertson (1976b); Kobori, Handa and Yumoto (1981); 
Fauske (1989b) 

Fire protection (see also Table 16.2) 

FPA (S9,1986 CFSD GP 7,1988 CFSD GP 6); Bray (1964, 
1966); Allinson (1966); Chaillot (1966); J.R. Hughes (1970); 
ICI/RoSPA (1970 IS/74); Kletz (1971,1974e, 1975b,d, 1976g, 
1977d); Craven (1975); Zuber (1976); Anon. (1978 LPB 20, 
p. 20); Anon. (1978 LPB 22, p. 114); Bly thing (1983 SRD R263); 
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British Gas (1984 BGC/PS/SFP1); Williams (1984); Raine 
(1986); Fullam (1987); IBC (1988/75); Nazario (1988); 
Schoen and Droste (1988); Schoen, Probst and Droste 
(1989); NFPA (1993/34); BS 5908:1990 
Insulation: Feind (1978); Katzler (1980); Uppal (1980); 
Anon. (1985q) 

Particular chemicals 

Ammonia (anhydrous): American Oil Co. (n.d./9); HSE 
(HS(G) 30);W.L. Nelson (1948); T.J. Dawson (1956); Jenkins 
(1962); Applegate (1965); Crowley (1965); Husa and Bulkley 
(1965); Laing and Henderson (1965); G.O. Morgan and Reed 
(1965); Eddy, Schroedter and Strauch (1966); J. A. Lawrence 
(1966); Hoffman (1967); Resplandy (1967);W.L. Ball (1968b); 
Scisson (1969); Morrison andMarshall (1970); A. Nielsen 
(1971); Comeau (1972); Lichtenberg(1972); MacArthur (1972); 
C.C. Hale (1974,1980,1982,1984,1987); J.D. Reed (1974); 
Vidalin and Bertram (1974); CIA (1975/8); Esrig, Ahmad and 
Mayo (1975); Lonsdale (1975); van Grieken (1976); Arup 
(1977); Comeau and Weber (1977); Feind (1978);Truscott and 
Livingstone (1978); Gustinand Novacek (1979); C.C. Hale and 
Lichtenberg (1980,1990); Hendriks (1980); Vick,Witthaus 
and Mayo(1980);Winegar (1980); Aarts and Morrison (1981); 
Blanken (1982,1984,1987); R.S. Brown (1982); Shah (1982); 
Anon. (1984 LPB 58, p. 13); Guth and Clark (1985); Badame 
(1986); P.P. Briggs, Richards and Fiesinger (1986); Josefson 
(1987); Shah (1987); J.L.Woodward and Silvestro (1988); 
Stephens and Vidalin (1988); Byrne, Moir and Williams 
(1989); CGA (1989 TB-2); ILO (1989);W.G. Jonesef al. (1989); 
J.R.Thompson and Carnegie (1989); Appl etd. (1990); Burke 
and Moore (1990); Selva and Heuser (1990); J.H.Thompson 
(1990); Conley, Angelsen andWilliams (1991); Squire (1991); 
Herbertsson (1992);Tilton etal. (1992); ANSI K61.1-1999 
Ammonia (aqueous): Henderson (1975) 

Asphalt, bitumen: API (1988 Publ. 2023); IP (1990 MCSP 
R11); Davie, Nolan and Hoban (1993,1994); Davie etal. 
(1993); Davie, Nolan and Tucker (1993) 

Chlorine: BCISC (n.d./l); HSE (HSW Bklt 37,1985 
CS16,1986 HS(G) 28,1987 HS(G) 40); CIA (1980/13); 
Chlorine Institute (1982 Pmphlt 5,1986 Pmphlt 1); ILO 
(1989) 

Hydrogen: A.D. Little (1960); Vander Arend (1961); Cassut, 
Madocks and Sawyer (1964); Scharle (1965); Stoll (1965); 
Angus (1984); NFPA (1989 NFC 50A, 50B) 

LNG (see Table 11.23) 

LPG (see also Table 11.22): IGasE (n.d./5); FPA (1964/1); 
Sommer (1965); J.R. Hughes (1970); ICI/RoSPA (1970IS/74); 
Home Office (1971/2,1981 HS(G) 15,1987 HS(G) 34); 
LPGITA (1972- Codes 1,3,7,9,12,14,19,22); Considine, 
Grint and Holden (1982); HSE (1973 Bklt 30,1981 CS 5, CS 6, 
1986 CS 4); Blything (1983 SRD R263,1986); Lindblom and 
Quast (1983); Nozaki etal. (1983); I.Williams (1984); Howell 
and Schuller (1985); Morand, Claude and Herbreteau 
(1985); Sugawara and Minegishi (1985); Ackermann (1986); 
Davenport (1986,1988); van der Schaaf (1986); IP (1987 
MCSP Pt 9); Blomquist (1988); API (1989 Std 2510); Droste 
and Mallon (1989); ILO (1989); Lindblom (1989); NFPA 
(1992 NFPA 58,59); Paff (1993); British Gas (1994 GBE/ 
DAT27) 

Monomers (see also Styrene monomer and Vinyl chloride 
monomer, below): Shelley and Sills (1969); Bond (1985 LPB 
65); Anon. (1992 LPB 106, p. 14); Chakravarty, Fisher and 
Voyt (1993) 

Petroleum: H.Watts (1951); Home Office (1968/1); 

J.R. Hughes (1970); IP (1990 Eur. MCSP R 2,1981 MCSP R 3) 


Particular chemicals: other chemicals 
Acrylic acid: Wampler (1988) 

Ammonium nitrate: American Oil Co. (n.d./9); HSE (1986 
CS 18); NFPA (1993 NFC 490) 

Carbon dioxide: HSE (1985 CS 9); Coleman (1989) 
Corrosive chemicals: Anon. (1977 LPB 16, p. 21); Anon. 
(1979 LPB 26, p. 31) 

Ethylene: Litchfield et al. (1959); Frank and Wardale (1970); 
Wardale and Frank (1970); Anon. (1985q) 

Ethylene oxide: CISHC (1975/2); Curtis (1990) 

Explosives: Home Office (1972/3) 

Hydrogen chloride: BCISC (1975/2) 

Liquefied gas: Dharmadhikari and Heck (1991) 

Organic peroxides: HSE (1991 CS 21); NFPA (1993NFPA43B) 
Oxidizing materials: NFPA (1986 NFPA 43C, 1990NFPA 43A) 
Oxygen: HSE (1977a); NFPA (1990 NFC 50) 

Plastics, plastic foams: MCA (SG-5); HSE (1975 TON 29) 
Shock sensitive materials: MCA (SG-7) 

Sodium chlorate: HSE (1985 CS 3) 

Styrene monomer: Shelley and Sills (1969) 

Toxic chemicals: Ecology and Environment Inc. (1985); 
Croce etal. (1988); Drake and Croce (1988) 

Vinyl chloride monomer: Shelley and Sills (1969); Unwin, 
Robins and Page (1974); Mukerji (1977); CIA (1978/12) 

Hazard assessment (see also Table 9.1) 

Husa and Bulkley (1965); Resplandy (1967); Siccama 
(1973); Solomon, Rubin and Okrent (1976); HSE (1978b, 
1981a); Drysdale and David (1979/80); Considine, Grint and 
Holden (1982); R. Davies (1982); Suokas (1982); Drivas, 
Sabnis andTeuscher (1983); Lees (1983d);T.A. Smith (1985, 
1986 SRD R314);Trbojevic and Maini (1985); Blything 
(1986); Blything and Reeves (1988 SRD R488); Clay et al. 
(1988); Selway (1988 SRD R492); Smith-Hansen (1988); 
Boykin and Levary (1989); Ziomas, Zerefos and Bais 
(1989); Haastrup and Brockhoff (1990); Khan (1990); 

P. Roberts (1990); Chidambariah etal. (1991); Nejedly, 
Topinka and Skarka (1992) 


22.1 General Considerations 

22.1.1 Purpose of storage 

The purpose of storage is to smooth fluctuations in the 
flows in and out. If the quantity in stock does not vary, 
there is no point in having storage. The exception is where 
the storage is held purely as an insurance. 

Thus, there maybe various ways of satisfying the design 
objective. The types of storage, which are economic in these 
alternative designs, may be different and may have differ¬ 
ent safety implications also. There may be considerable 
differences, for example, in the pressure and in the inven¬ 
tory. An account which illustrates the interaction between 
storage requirements and storage method is given by 
Hower (1961). 

22.1.2 Storage conditions 

The main sets of conditions for gas or liquid storage are 

(1) liquid at atmospheric pressure and temperature 
(atmospheric storage); 

(2) liquefied gas under pressure and at atmospheric tem¬ 
perature (pressure storage); 
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(3) liquefied gas under pressure and at low temperature 
(refrigerated pressure storage, semi-refrigerated 
storage); 

(4) liquefied gas at atmospheric pressure and at low tem¬ 
perature (fully refrigerated storage); 

(5) gas under pressure. 

The fluids so stored are referred to for convenience as 

(1) volatile liquids, (2) flashing liquefied gases, (3) semi¬ 
refrigerated liquefied gases, (4) refrigerated liquefied gases 
and (5) gases under pressure, respectively. 

The characteristics of these different types of storage 
have been discussed in Chapter 15. A leak of volatile liquid 
held at atmospheric temperature andpressure results only in 
a relatively slow evaporation of the liquid. Escape of a refrig¬ 
erated liquefied gas at atmospheric pressure gives some 
initial flash-off and then an evaporation which is relatively 
slow but faster than the first case. Loss of containment of a 
liquefied gas under pressure and at atmospheric tempera¬ 
ture, however, causes immediate flashing of a large propor¬ 
tion of the gas, followed by a slower evaporation of any 
residue, and is usually much the most serious case. The 
hazard from a gas under pressure is normally much less in 
terms of the amount of material held, but the physical energy 
released if a confined explosion occurs is large. 

The economics of storage of liquefied gases are that it is 
usually attractive to use pressure storage for small quan¬ 
tities, pressure or semi-refrigerated storage for medium to 
large quantities and fully refrigerated storage for very 
large quantities. 

It is generally considered, however, that there is a greater 
hazard in storing large quantities of liquefied gas under 
pressure than at low temperature, so that the trend is 
towards replacing pressure storage by refrigerated storage 
for large inventories. 

22.1.3 Storage capacity 

Methods of the estimation of the capacity of particular 
types of tank or vessel are given by Santi (1979) and 
Gallagher (1983). 

22.1.4 Storage hazards 

The hazards presented by storage depend on the material 
and on the type of storage. In broad terms, the principal 
hazardous events are as shown in Table 22.2, Section A. 
Some principal initiating events are given in Section B of 
the table. 

On very rare occasions, a vessel or tank fails catastrophi¬ 
cally. This may occur due to mechanical or metallurgical 
defects. The vessel or tank may be overpressured by over¬ 
filling. A tank may be overpressured by too rapid filling 
and underpressured by too rapid emptying. Other causes of 
tank failure are given in Chapter 20. 

More commonly, release occurs from other equipment or 
from pipework or fittings. Equipment which may leak 
includes, in particular, pumps. Release from pipework may 
occur due to a crack or pinhole or by full bore rupture, or by 
a leak or failure at a flange, gasket or valve. 

Release may occur due to an explosion in the tank or 
vessel. There are various ways in which this can happen. 
One is physical overpressure which causes the vessel or 
tank to burst. Another is the ignition of a flammable mix¬ 
ture. Another is evolution of gas due to the reaction of an 
impurity, material of construction, etc. A fourth is a run¬ 
away reaction within the vessel or tank. 


Fire at a vessel or tank can cause it to fail. The fire may be 
a fire beneath it or a jet flame playing on it. 

An operational activity which may cause either direct 
release or vessel or tank rupture is overfilling. Other 
operational events which may give rise to a release include 
draining and sampling operations. Maintenance activities 
may result in a release, generally by admission of fluid to a 
section which is not fully isolated. 

Impact events which may cause loss of containment from 
a storage include impact from a carried item, a dropped 
load, a vehicle or an aircraft. A missile from an explosion is 
another form of impact, but is primarily an escalating 
rather than a true initiating event. 

Natural events which may cause loss of containment 
include high winds, rainstorms, flooding, tsunamis and 
earthquakes, whilst lightning may start a fire. 

Arson or sabotage are other causes of hazardous events. 
Sabotage may take the form of interference with the plant 
or direct initiation by impact, fire or explosion. 

22.2 Petroleum Products Storage 

It is convenient to start with a consideration of the storage 
used in the oil industry for crude oil and petroleumproducts. 

There exist a number of standards and codes for the stor¬ 
age of petroleum products and flammable liquids generally. 
Standards and codes include API Std 620:1990 Design and 
Construction of Large, Welded, Low-pressure Storage Tanks 
and Std 650:1988 Welded Steel Tanks for Oil Storage, NFPA 
30:1990 Flammable and Combustible Liquids Code and the 
Refining Safety Code of the IP (1981MSCP Pt 3). HSE guid¬ 
ance is given in HS(G) 50 The Storage of Flammable Liquids 
in Fixed Tanks (up to 10,000 m 3 Total Capacity) (1990) and 
HS(G) 52 The Storage of Flammable Liquids in Fixed Tanks 
(Exceeding 10,000 m 3 Capacity) (1991). 

Storage of petroleum is discussed here under the follow¬ 
ing headings: 

(1) storage tanks and vessels; 

(2) storage layout; 

(3) venting and relief; 

(4) fire prevention and protection. 

These are now considered in turn. 


22.3 Storage Tanks and Vessels 

The main types of storage tanks and vessels for liquids and 
liquefied gases are (1) atmospheric storage tanks, (2) low 
pressure storage tanks, (3) pressure or refrigerated pres¬ 
sure storage vessels and (4) refrigerated storage tanks. 

The API standards for storage tanks are API Std 620: 
1990 Design and Construction of Large, Welded, Low-pressure 
Storage Tanks and Std 650:1988 Welded Steel Tanks for Oil 
Storage. Relevant British Standards are BS 2594: 1975 
Specification for Carbon Steel Welded Horizontal Cylindrical 
Storage Tanks and BS 2654: 1989 Specification for Manu¬ 
facture of Vertical Steel Welded Non-refrigerated StorageTanks 
with Butt-welded Shells for the Petroleum Industry. 

Some of the main types of storage tanks and vessels are 
shown schematically in Figure 22.1 and are illustrated in 
Figures 22.2-22.5. Fuller descriptions and illustrations of 
storage tanks and vessels are available in various sources 
(e.g. J.R. Hughes, 1970; API, 1981 Refinery Inspection Guide, 
ch. 13; HSE, 1973 HSW Bklt 30). Tanks and vessels for the 
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Table 22.2 Some principal hazardous events and initiating events for storage 


A Hazardous events 


Materials 

State 

Storage 

Hazardous events 

Flammable 

Liquid 

Atmospheric 

Liquid release, then 

Tank or bund fire 

Tank explosion, then 

Tank or bund fire 


Liquefied gas 

Pressure 

Flashing liquid release - flammable vapour 
cloud, liquid pool, then 

Pool fire 

Running liquid fire 

Jet fire 

Vapour cloud fire 

Vapour cloud explosion 

Fire engulfed vessel, then 

BLEVE 


Liquefied gas 

Refrigerated 

Flashing liquid release - flammable vapour 
cloud, liquid pool, then 

Tank or bund pool fire 

Running liquid fire 

Vapour cloud fire 

Vapour cloud explosion 

Fire engulfed tank, then 

Tank or bund pool fire 

Running fire 

Toxic 

Liquid 

Atmospheric 

Liquid release, then 

Toxic gas cloud 

Tank explosion, then 

Toxic gas cloud 


Liquefied gas 

Pressure 

Flashing liquid release - flammable vapour cloud, 
liquid pool, then 

Toxic gas cloud 

Fire engulfed vessel, then 

BLEVE 

Toxic gas cloud 


Liquefied gas 

Refrigerated 

Flashing liquid release - flammable vapour cloud, 
liquid pool, then 

Toxic gas cloud 

Fire engulfed tank, then 

Toxic gas cloud 


B Initiating events 


Catastrophic failure of vessel or tank 

Failure of or leak from other equipment, pipework or fittings 

Explosion in vessel or tank 

Fire engulfing vessel or tank 

Jet flame playing on vessel or tank 

Overfilling of vessel or tank 

Release occasioned by operations 

Release occasioned by maintenance 

Impact event 

Natural event 

Arson, sabotage 


storage of LPG, liquefied natural gas (LNG), ammonia and 
chlorine are considered further below. 

22.3.1 Atmospheric storage 

Some typical atmospheric storage tanks are shown in 
Figures 22.1(a-f). Figure 22.1(a) is a horizontal cylindrical 


tank. These tanks usually have riveted flat or welded dished 
ends. Figures 22.1 (b) and 22.1 (c) are vertical cylindrical 
fixed tanks with coned and domed roofs, respectively. 
Figures 22.1(d) and 22.1(e) are, respectively, another larger 
fixed roof tank and a large floating roof tank. Figure 22.1 (f) is 
a vapour dome tank with a flexible diaphragm in the dome. 
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Figure 22.1 Storage tanks and vessels: (a) horizontal cylindrical atmospheice tank; (b) vertical fixed roof atmospheric 
tank (coned roof); (c) vertical fixed roof atmospheric tank (domed roof); (d) vertical fixed roof atmospheric tank (large 
coned roof); (e) vertical floating roof atmospheric tank; (f) vapour dome atmospheric tank; (g) horizontal cylindrical low 
pressure tank; (h) vertical cylindrical hemispheroidai low pressure tank; (i) spheroidal low pressure tank; (j) horizontal 
cylindrical pressure vessel; (k) spherical pressure vessel (Horton sphere); (I) vertical fixed roof refrigerated atmospheric 
tank (domed roof) 


Atmospheric tanks are designed to withstand an internal 
pressure/vacuum of not more than 1 psig (70 mbar). Further 
details are given below. 

Horizontal cylindrical tanks have a relatively small capac¬ 
ity. Domed roof tanks go up to about 60 ft (20 m) diameter. 
Coned roof tanks are built up to 250 ft (76 m) diameter and 
60 ft (20 m) height. Floating roof tanks may be 250 ft (76 m) 
in diameter and 72 ft (22 m) high. 

In a floating roof tank, the roof floats on the surface of 
the liquid. There are different kinds of floating roof such as 
the pan, annular pontoon and double-deck types. The two 
latter have a double layer at the annulus and over the whole 
area, respectively, and therefore have greater buoyancy 
than a pan roof. Sealing between the floating roof and the 
tank wall is effected by a number of means such as spring- 
loaded fabric or rubber tube seals. In addition, a floating 
deck may also be used inside a fixed roof tank. Its main 
purpose is the reduction of vapour loss. 

A traditional divide between the different sizes of storage 
tank is a nominal capacity of12,000 UKgal (55m 3 ), which has 
corresponded to the approximate limit of shop fabrication. 
The design of petroleum storage tanks up to this capacity is 
governedbyBS799:1972-OilBurningEquipment. Another 
applicable standard is BS 2594: 1975, which covers tank 
sizes both below and above 12,000 UKgal. 

Large petroleum storage tanks are normally site erected 
and of mild steel welded construction. The design, fabrica¬ 
tion, erection, inspection and testing of these tanks is spe¬ 
cified in API Std 650:1988 and BS 2654:1989. 

Forfixed roof tanks, atraditionaldistinction(seeBS2654: 
1961; J.R. Hughes, 1970) has been between ‘non-pressure’ 


and ‘pressure’ tanks. For tanks up to 128 ft diameter, non¬ 
pressure tanks were designed for an internal pressure of 3 in. 
WG (7.5 mbar) and a vacuum of 2y2 in.WG (6 mbar) and pres¬ 
sure tanks for an internal pressure of 8 in.WG (20 mbar) and 
2Vz in.WG (6 mbar) plus superimposed load. The user was 
allowed to specify, however, an internal pressure greater 
than 8 in.WG. Pressure tanks up to 64 ft could be designed up 
to 2m in.WG (54 mbar) provided the allowable stress did 
not exceed that given in the standard. 

The designation of atmospheric storage tanks with a 
design pressure well below 1 psig as ‘pressure’ tanks is a 
possible source of confusion. As described below, there are 
other tanks designed for the low pressure range 0.5-15 psig 
which are termed Tow pressure’. 

Non-pressure tanks are normally vented by an atmos¬ 
pheric vent and pressure tanks by a breather vent, as 
described below. Non-pressure tanks tend to have relatively 
high vapour losses from the ‘breathing’of the vent. Pressure 
tanks withbreather vents reduce these losses but are limited 
in diameter. Floating roof tanks provide an alternative 
which has low vapour losses and is available in large sizes. 

The definitions of storage tanks now recognized in BS 
2654:1989 are somewhat different. The standards defines 
three categories of tank: (1) ‘non-pressure’ tanks designed 
for an internal pressure of 7.5 mbar (4 mbar for column- 
supported roofs) and a vacuum of 2.5 mbar; (2) ‘low-pressure’ 
tanks designed for an internal pressure of 20 mbar and a 
vacuum of 6 mbar and (3) ‘high-pressure’ tanks designed for 
an internal pressure of 56 mbar and a vacuum of 6 mbar.The 
maximum design pressure covered by the standard is thus 
56 mbar (0.81 psi). BS 2654 also covers floating roof tanks. 
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Figure 22.2 Atmospheric storage tanks (Chicago Bridge and Iron Co.): (a) 


roof tank; (b) floating roof tank 
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(b) 

Figure 22.3 Pressure storage vessels (a) horizontal cylindrical vessels for LPG (Health and Safety Executive); 
(b) spherical vessels for liquid propane/butane (Horton spheres) (Whessoe Ltd) 
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Figure 22.4 Large storage complexes, including: (a) cone roof and floating roof tanks and spherical pressure 
vessels (Chicago Bridge and Iron Co.); (b) cone roof tanks, spheroidal vessels and cylinderical pressure vessels (Chicago 
Bridge and Iron Co.) 
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Atmospheric tanks are used for the storage of liquids at 
ambient temperature and also for the storage of refrigerated 
storage liquids, as described below. 

22.3.2 Low pressure storage 

Some typical low pressure storage tanks are shown in 
Figures 22.l(g- i). Figure 22.1(g) shows ahorizontal cylindrical 
tank with dished ends. Figure 22.1(h) shows a vertical cylin¬ 
drical hemispheroidal tank. Figure 22.1(i) shows a spheroidal 
tank which has the shape of a squashed sphere. The two latter 
types are also made in noded as well as plain versions. 

Low pressure tanks are designed to withstand internal 
pressure in the range 0.5—15 psig. The design of low pres¬ 
sure tanks is governed by API Std 620. 

Low pressure tanks are suitable for the storage of liquids 
which are too volatile for atmospheric storage. Gasoline is a 
typical petroleum product to which this applies. Use is also 
made of low pressure tanks in refrigerated storage, as 
described below. 


22.3.3 Pressure and refrigerated pressure storage 

Some typical pressure storage vessels are shown in 
Figures 22.1(j) and 22.1(k). Figure 22.1© shows a hori¬ 
zontal cylindrical pressure vessel and Figure 22.1(k) a 
spherical pressure vessel, or Horton sphere. 

Pressure storage vessels are regular pressure vessels 
and can be designed to high pressures as required. The 
lower end of the scale for pressure storage is 15 psig. 

In the United States, the design of pressure vessels is 
governed by the American Society of Mechanical Engi¬ 
neers (ASME) Boiler and Pressure Vessel Code, Section VIII 
(1991) and by API Std 2510:1989 Design and Construction of 
Liquefied Petroleum Gas Installations (LPG). The British 
Standards for pressure vessel design were BS 1500: 1958 
and BS 1515: 1965-, which have been superseded by BS 
5500:1991, introduced in 1976. Pressure vessels have been 
discussed in Chapter 12. Horizontal cylindrical vessels 
have a relatively limited capacity and for large quantities 
spheres are used. 



Figure 22.5(a) Refrigerated atmosphere storage tank for liquid propane (Whessoe Ltd) 




22/12 STORAGE 



Loose fill 
perlite 
insulation 


Suspended 

insulating 

deck 


Figure 22.5(b) Refrigerated atmospheric dome roof double wall tank for LNG (Chicago Bridge and Iron Co.) 


Spherical pressure vessels have a number of advantages. 
The surface to volume ratio is minimal and only 88% of 
that of a vertical cylindrical tank, which reduces heat leak. 
The foundation structure is simpler and there is no danger 
of soil freezing. The stresses under low temperature condi¬ 
tions are easily determined. 

Pressure storage vessels are suitable for the storage of 
liquefied gases such as LPG and ammonia. Pressure stor¬ 
age vessels are also used for refrigerated pressure, or semi¬ 
refrigerated, storage. 


22.3.4 Refrigerated storage 

Atypicalrefrigerated storage tankis shown in Figure22.1(l). 
This is a domed roof, flat bottomed tank. It is essentially 
an atmospheric tank, with a design pressure below 1 psig. 
Low pressure tanks may also be used for refrigerated 
storage. 


22.3.5 Concrete storage tanks 

The need for very large storage capacities for LNG has led 
to the development of pre-stressed concrete storage tanks 
which are protected by an earthen embankment, or berm, 
and are internally insulated. 


22.3.6 Underground cavity storage 

Underground cavities may also be used for storage. Natural 
gas has been stored for many years in underground reser¬ 
voirs, which are frequently depleted oil or gas fields. Use 
may also be made of such man-made cavities as worked-out 
salt formations or mined cavities to store gases. The well 
is usually operated with a brine system, but dry wells are 
possible also. 

22.3.7 Earth pit storage 

A method of storing LNG in pits, where a hole was exca¬ 
vated and the surrounding earth then frozen, was devel¬ 
oped and used but the operating problems were such that it 
has fallen into disuse. 

22.3.8 Gas storage 

Gasholders are used to store gases such as hydrogen and 
acetylene close to atmospheric pressure. Storage of gas 
under pressure is usually done in gas cylinders or hori¬ 
zontal cylindrical pressure vessels. As already mentioned, 
gas may also be stored in underground cavities. 

22.3.9 Glass reinforced plastic tanks 

Widespread use is now made of vessels and tanks made of 
glass fibre reinforced plastic (GFRP), also known as glass 
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reinforced plastic (GRP), fibre reinforced plastic (FRP) or 
fibreglass. GRP tanks are widely used to store corrosive 
materials. They are considered further in Section 22.23. 


22.4 Storage Layout 

The siting and layout of storage in relation to the process 
are discussed in Chapter 10. Here the layout within the 
storage area is considered. 

As mentioned in Chapter 10, the storage, process and 
terminals should be suitably arranged relative to one 
another, an appropriate layout being one in which the stor¬ 
age is located between the process and the terminals. The 
storage should be built on ground able to support the heavy 
load involved and with ground contours and wind char¬ 
acteristics which minimize the hazard of flammable liquid 
or vapours from storage collected in hollows or flowing 
across to the process and finding an ignition source. 


22.4.1 Segregation 

The segregation and separation of materials within the 
storage area is largely based on classification of the 
materials stored, on secondary containment, on hazardous 
area classification (HAC) and on fire protection measures. 


The classification of liquids is described in Chapter 10. Prin¬ 
cipal classifications are those given in the IP Refining Safely 
Code and in National Fireprotection Association (NFPA) 30. 

Traditionally, the flashpoint classification has been used 
as a guide to segregation of liquids in storage. Using the 
earlier classification into classes A, B and C, the main dis¬ 
tinction was between Classes A/B and C.This was the basis 
of the system used in the 1965 version of the IP Refining 
Safety Code. The current code places less emphasis on this 
type of distinction as far as concerns segregation. 

It is convenient to segregate materials which require 
secondary containment such as bunding, from those which 
do not. Where the requirements for HAC are different, it 
may be convenient to segregate on this basis. 

The fire protection which needs to be provided is a 
fourth means of classification. Fire protection is considered 
below. 

22.4.2 Separation distances 

Minimum recommended separation distances for storage 
are given in various codes and other publications. These 
were listed in Chapter 10. The separation distances for 
petroleum products given in the IP Refining Safety Code are 
shown in Table 22.3. The code gives a number of layouts 
illustrating these separation distances. 


Table 22.3 Minimum recommended separation distances for the storage of petroleum products: IP Refining Safety 
Code (Institute of Petroleum, 1981 Refining Safety Code) 


Factor 


Type of tank roof Recommended minimum distance 


(1) Within a group of small tanks 


Fixed or floating 


(2) Between a group of small tanks and another Fixed or floating 

group of small tanks or other larger tanks 

(3) Between adjacent individual tanks (a) Fixed 

(other than small tanks) 

(b) Floating 


(4) Between a tank and the top of the inside of the Fixed or floating 

wall of its compound 


(5) Between any tank in a group of tanks and the 
inside top of the adjacent compound wall 

(6) Between a tank and a public boundary fence 

(7) Between the top of the inside of the wall of 

a tank compound and a public boundary fence 
or to any fixed ignition source 

(8) Between a tank and the battery limit of 
a process plant 

(9) Between the top of the inside of the wall of 
a tank compound and the battery limit of 


Fixed or floating 
Fixed or floating 


Fixed or floating 


Determined solely by 
construction/maintenance/ 
operational convenience 
10 m minimum, otherwise 
determined by size of the larger 
tanks (see (3) below). 

Half the diameter of the larger 
tank, but not less than 10 m and 
need not be more than 15 m 
0.3 times the diameter of the larger 
tank, but not less than 10 m and 
need not be more than 15 m a 
Distance equal to not less than half 
the height of the tank (Access 
around the tank at compound 
grade level must be maintained) 
Not less than 15 m 

Not less than 30 m 
Not less than 15 m 


Not less than 30 m 
Not less than 15 m 


a In the case of crude oil tankage this 15 m option does not apply. 

Notes: (1) Small tanks are those of up to 10 m diameter; (2) a group of small tanks with a total capacity of 8000 m * * 3 may be treated as one tank; 

(3) where future changes of service are anticipated, the layout should be designed for the most stringent case; (4) in order to allow access for fire 
fighting, the number of rows of tanks between adjacent access roads should be limited to two; (5) fixed roof tanks with internal floating covers 
should be treated for spacing purposes as fixed roof tanks; (6) where fixed roof tanks and floating roof tanks are adjacent, the spacing should be 
designed for the most stringent case; (7) where tanks are erected on compressible soils, the spacing should be such as to avoid excessive dis¬ 
tortion; (8) for Class III(l) and Unclassified petroleum liquids, spacing of tanks is governed only by constructional and operational convenience. 
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Separation distances for flammable liquids are given 
in HS(G) 50 and HS(G) 52. Figure 22.6 shows a general 
layout given in HS(G) 52 and Table 22.4 lists the separation 
distances given in this guide. These separation distances 
are for flammable liquids with flashpoints up to 55°C. 
There are, however, certain relaxations for liquids with a 
flashpoint in the range 32-55°C, which are described in 
the guide. 


22.4.3 Separation distances: fire models 

An alternative approach is to base separation distances 
on engineering principles. Two main factors which should 
determine separation are (1) the heat from burning liquid 
and (2) the ignition of a vapour escape. These principles and 
their application were discussed in Chapter 10. 

The application of such engineering calculations to 
the separation distances for storage tanks has been treated 
by Hearfield (1970) and R.B. Robertson (1976b). Calcula¬ 
tions on separation distances related to heat effects are 
usually based on direct flame impingement and on heat 
radiation. 

It is commonly assumed that in a storage tank fire, the 
tank is effectively a pool of liquid with a flame burning on 
this liquid and that on a tank of diameter D the height of the 
flame in still air is 2D. 

If there is a wind, however, the flame is distorted. At a 
wind speed of 2 m/s it has been observed that the flame is 
deformed to an angle of 45° to the horizontal and that on the 
downward side of the fire the flame hugs the ground for a 
distance of about 0.5K. 

For the heat radiated from the flame, it is usually 
assumed, for simplicity, that still-air conditions prevail.The 
heat radiated is calculated and compared with limit values. 


An equation given by Hearfield and by Robertson for the 
heat radiated from the envelope of a flame burning on a 
liquid pool in a storage tank is: 

Q = faArpC [22.4.1] 

where A is the surface area of the pool (m 2 ), C is the calorific 
value of the liquid (kj/kg), Q is the heat radiated from the 
flame envelope (kW), r the liquid burning rate (m/s), p is the 
density of the liquid (kg/m 3 ) and fa is a constant. 

The value of the constant fa generally used by these 
authors is 0.3. Robertson gives liquid burning rates of 
0.083—0.17 mm/s (5—10 mm/min). Hearfield gives liquid 
burning rates of 0.1, 0.3 and 0.4 in./min for 1, 7 and 35 ft 
diameter pools, respectively. 

The application of Equation 22.4.1 is described by 
Robertson as follows. It is assumed that the heat is radiated 
from the envelope of a cylinder diameter D and height D, 
and that in turn this is equivalent to radiation from a radiat¬ 
ing area which is a vertical rectangular plane of width D 
and height 2D. The heat flux received by another storage 
tank is obtained from the view factor method. He states that 
for most hydrocarbon flames, the heat radiation from the 
surface of the cylinder is approximately 170-240 kW/m 2 
and suggests that a suitable limit for the heat received by 
an adjacent storage tank is 37.8 kW/m 2 . Other limit values 
for heat radiation which are relevant to separation were 
given in Chapter 10. 

It is pointed out by Robertson that the separation dis¬ 
tances in some storage installations are less than ideal. For 
example, on many small chemical plants storage tanks 
approximately 6 m diameter and 6 m high are spaced 2 m 
apart. If a fire occurs when the wind direction is along the 
line of the tanks and the wind speed is 2 m/s, the fire would 
spread rapidly by direct flame impingement. It may not 



Figure 22.6 Layout for storage of flammable liquids (Health and Safety Executive, 1991 HS(G) 52). The distances 
shown by dotted lines should be as in the text and Tables 1 or 2 of HS(G) 52. (Courtesy of HM Stationery Office 
© All rights reserved) 
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Table 22.4 Minimum recommended separation distances for the storage of flammable liquids: HS(G) 52 (Health and 
Safety Executive, 1991 HS(G) 52) (Courtesy of HM Stationery Office © All rights reserved) 


A 

Fixed roof tanks 


Factor 

Minimum separation distance from any part of the tank (m) 

(a) 

Between groups of small tanks a 
(see note below) 

15 

(b) 

Between a group of small tanks and 
any tank outside the group 

15 

(c) 

Between tanks not being part of 

Half the diameter of the larger tank, the diameter of the smaller 


a group of small tanks 

tank, or 15 m, whichever is least, but never less than 10 m 

(d) 

Between a tank and any filling point, 
filling shed or building, not containing 
a possible source of ignition 

15 

(e) 

Between a tank and outer boundary of the 
installation, any designated non-hazardous 
area, or any fixed source of ignition 

15 

B 

Floating roof tanks 


Factor 

Minimum separation distance from any part of the tank (m) 

(a) 

Between two floating roof tanks 

10 m for tanks up to and including 45 m diameter; 15 m for 
tanks over 45 m diameter. The size of the larger tank should 
govern the spacing 

(b) 

Between a floating roof tank and 

Half the diameter of the larger tank, the diameter of the smaller 


a fixed roof tank 

tank or 15 m, whichever is least, but never less than 10 m 

(c) 

Between a floating roof tank and any filling 
point, filling shed or a building not 
containing a possible source of ignition 

10 

(d) 

Between a floating roof tank and outer 
boundary of the installation, any 
designated non-hazardous area or 

15 


any fixed source of ignition 


C LPG storage 11 


Distance from flammable 

Distance outside bund wall around 


liquid tank (m) 

a flammable liquid tank (m) 

LPG cylinders 

3(3) 

3(0) 

(> 50 kg total capacity) 



LPG vessel 

6(6) 

6(3) 


a A group of small tanks, 10 m in diameter or less, may be regarded as one tank. Such small tanks may be placed together in groups, no group 
having an aggregate capacity of more than 8000m 3 .The distance between individual tanks in the group need be governed only by constructional 
and operating convenience but should not be less than 2 m. 
b The figures in brackets relate to liquids with a flashpoint greater than 32°C. 


always be possible to have the ideal separation, but the 
decision on the separation distance should be made with full 
awareness of the implications. A similar approach may be 
taken using the more recent models given in Chapter 16. 


22.4.4 Secondary containment 

Some types of liquid storage tank are normally surrounded 
by a bund, or dike, and/or provided with a pit to retain any 
spillage of the liquid, or impounding basin. Bunds are 
made of earth or concrete. 

In general, bunds are provided for atmospheric storage 
tanks and for fully refrigerated storage tanks of liquefied 
gas, but not for pressure or semi-refrigerated storage of 
liquefied gas or for acid or alkali storage, although this 
generalization needs some qualification. 


The object of bunding is to retain the liquid so that it can 
be dealt with in a controlled manner, by evaporation from a 
specially designed catchment/evaporation area, by foam 
blanketing or other measures. 

Thus, the relatively weak atmospheric storage tanks are 
generally provided with full bunds, while pressure storage 
vessels may not be. Bunds tend not to be used for pressure 
vessels because these rarely fail, the emission when it does 
occur is mainly in vapour/spray form and the dispersion of 
small leaks and spillages is hindered. Even where a full bund 
is not used, however, a low wall maybe provided which gives 
the vessel some protection from damage by vehicles. Low 
walls may also be used to keep flammable liquids from some 
external source from reaching a storage vessel. 

It may be noted that experience shows that in most 
cases of tank rupture only a proportion of the liquid in the 
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tank is lost and in many other cases most of the liquid is 
retained in the tank. 

Some practical aspects of the design of bunds for flam¬ 
mable liquids have been discussed by Hearfield (1970). He 
draws attention to the fact that a leak in the side of a tank 
may form a horizontal jet and may jump the bund if the 
latter is too close to the tank, an effect known as spigot flow. 
The bund wall should he far enough from the side of the 
tank to prevent a jet jumping over or, alternatively, the bund 
should be surrounded by an impervious surface sloped 
inward to the bund drain area. The corners of the bund 
should be rounded and not at a right angle. It is difficult to 
extinguish a fire in a 90° angle corner because of the air 
compression effect. 

The IP Refining Safety Code gives requirements for 
tank compounds. It states that Class 1,11(1), 11(2) and 111(2) 
petroleum liquids should be completely surrounded by a 
wall or walls. Alternatively, the ground should be so sloped 
that spillages are directed to an impounding basin. 

The Code gives the following restrictions on the total 
capacity of tanks in one bunded area: (1) single tanks: no 
restriction; (2) groups of floating roof tanks, 120,000 m 3 
maximum; (3) groups of fixed roof tanks, 60,000 m 3 maxi¬ 
mum and (4) crude tanks, not more than two tanks of 
greater individual capacity than 60,000 m 3 . The figures for 
(2) and (3) may be exceeded for groups of not more than 
three tanks where conditions are suitable, that is there is no 
hazard to the public or risk of pollution. 

The Code states that the net capacity of a tank compound 
should generally be equivalent to the capacity of the largest 
tank, but that a capacity of 75 % will provide reasonable pro- 
tectionandmay beused where conditions aresuitable.Thenet 
capacity of the compound should be calculated by deducting 
from the total capacity the volume of all tanks, other than the 
largest, below the top of the compound wall and the volume of 
all intermediate walls within the compound. 

For Class III(l) and Unclassified petroleum liquids, the 
code states that a low wall, which need not be more than 
0.5 m high, should be constructed around the tankage, 
where conditions are such that the liquid could escape and 
cause damage or pollution. 

Guidance on bunding for flammable liquids is given in 
HS(G) 50 and HS(G) 52. In respect of the restrictions on 
tankage within one bund and of bund capacity, the require¬ 
ments are consistent with, but less detailed than, those of 
the IP Code. 

HS(G) 52 states that the height of the bund wall should be 
restricted in order to ensure good ventilation, access for fire 
fighting and means of escape. It should not normally 
exceed 1.5 m, though it may go up to 2 m provided these 
factors have been taken into account. 

For removal of rainwater, HS(G) 52 requires that where a 
bund drain is used it should have a valve on the outside of 
the bund with a system of work to ensure that the valve 
remains closed, and preferably locked, except when water 
is being removed. If the liquid stored is immiscible with 
water, there should be an interceptor to prevent flammable 
liquid entering the main drainage system. If the liquid is 
miscible with water, special arrangements are needed. 

Guidance on bunds is also given in NFPA 30 and BS 5908. 
A further discussion of bunding is given in Section 22.21. 

22.4.5 Hazardous area classification 

Control of ignition sources in storage areas is exercised 
through the system of hazardous area classification (HAC). 


The principles of HAC have been described in Chapters 10 
and 16. 

Guidance on HAC for refineries, including storage, is 
given in API RP 500:1991 Recommended Practice for Clas¬ 
sification of Locations for Electrical Installations at Petro¬ 
leum Facilities. This supersedes the separates RPs 500A, 
500B and 500C, which covered refineries, offshore rigs and 
platforms, and pipelines, respectively. Guidance on HAC 
for storage is given in the Area Classification Code for Petro¬ 
leum Installations of the IP (1990 MCSP Pt 15) (the IP Area 
Classification Code). The guidance of the Health and Safety 
Executive (HSE) is given in HS(G) 50 and HS(G) 52. 

Figure 22.7 shows some HAC classification diagrams for 
petroleum storage tanks given in the IP Area Classification 
Code. Table 22.5 from HS(G) 52 gives some principles for the 
delineation of the zones around storage tanks in the HAC. 

22.5 Venting and Relief 

22.5.1 Atmospheric vents 

A fixed roof atmospheric storage tank is connected to the 
atmosphere by some form of a vent, generally either a simple 
free flow atmospheric vent or apressure/vacuum (PV) valve. 

Vents for atmospheric storage tanks are dealt with in BS 
2654: 1989 in appendix F and in API Std 2000: 1992 
Venting Atmospheric and Low Pressure Storage Tanks 
(Non-refrigerated and Refrigerated). 

Since atmospheric tanks can withstand pressure/vacuum 
of only a few inches WG, it is essential that atmospheric vents 
should remain free. Blockage can occur accidentally due to 
debris, icing up, solids formation, polymerization, etc. 

A flame arrester on the end of a vent also serves to keep 
out debris. If there is no arrester, a coarse wire mesh guard 
is usually provided. But there is a danger of blockage of 
flame arresters and guards. The use of flame arresters is 
considered further below. 

The tank may also suffer overpressure or underpres¬ 
sure if the capacity of the vent is not sufficient. Pressure 
changes occur mainly during filling and emptying, but 
also in other circumstances. 

Situations in which tank failures tend to occur due to 
accidental blockage or deliberate sealing off of a vent, or to 
lack of capacity in the vent, were described in Chapter 20. 

22.5.2 Pressure/vacuum valves 

A PV valve, also called a breather valve or conservation vent, 
actually has two vent valves — a pressure valve which opens 
to let vapour out and a vacuum valve which opens to let air in. 

A fixed roof tank tends to breathe fairly heavily and 
appreciable vapour loss can occur through an atmospheric 
vent, particularly for a volatile liquid. A PV valve is effec¬ 
tive in reducing this loss. 

Avoidance of blockage and provision of adequate capac¬ 
ity are important for PV valves also. PV valves are subject 
to failure from icing up and deposition of material on the 
valve diaphragms or in the branch on the tank. The danger 
of ice formation is usually most severe just after the tank 
has been water tested, and the valve diaphragms are often 
removed for about 2 weeks until the water content of the 
liquid has reduced to normal, although the problem is less 
with newer diaphragm materials such as PTFE. 

22.5.3 Flame arresters 

If the vapour space above the liquid in a fixed roof atmos¬ 
pheric storage tank contains a flammable mixture, there is 
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a possibility that it will be ignited via the vent. A flame 
arrester may be used to prevent this. 

Flame arresters have already been discussed in Chap¬ 
ter 17. General accounts are given in Guide to the Use of 
Flame Arresters and Explosion Relief by the HSE (1965 HSW 
Bklt 34) and API Publ. 2028:1991 Flame Arresters in Piping 
Systems. The discussion here is limited to the question of 
their use on storage tank vents. 


The obj ect of a flame arrester is to prevent a flame passing 
back through a vent to ignite a flammable mixture in the 
vapour space of the tank. Consideration needs to be given, 
therefore, to the conditions under which a flammable mix¬ 
ture can exist. The range of materials stored is such that for 
some the vapour mixture is below the lower flammability 
limit, while for others it is above the upper flammability 
limit, but for others again it is in the flammable range. 




m z ° ne 1 



Figure 22.7 Hazardous area classification of petroleum storage tanks: (a) cone or dome roof tank - Classes 1,11(2) 
and 111(2); (b) floating roof tank, where roof will not be grounded on its leg during operational cycle; (c) floating roof 
tank with outer protective wall; (d) cone roof tank with outer protective wall, for (a), because of the possibility of mist, 
spray or foam formation the ullage space of Class 11(1) and 111(1) tanks should also be regarded as Zone 0. It is 
recommended that the area surrounding any vents or openings on the roof of such a tank be regarded as Zone 
1 to a diameter of 1 m (Institute of Petroleum, 1987 LPG storage Code; reproduced by permission) 
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Table 22.5 Guidelines for the hazardous area classification of the storage of flammable liquids 
(Health and Safety Executive, 1991 HS(G) 52) (Courtesy of HM Stationery Office. © All rights re 


Item 

Extent of area 

Classification 

Above-ground tanks 

(a) Vertically from ground level to the height of the bund 
wall, and horizontally from the tank shell to 1 m outside 
the bund wall 

Zone 2 


(b) Within 2 m of the tank shell 

Zone 2 

Underground tanks 

Within any manhole chamber containing filling connections 

ZoneO 

Tank connections (all tanks) 

Within a horizontal radius of 4 m from tank filling 
connections, and vertically from ground level up to 1 m 
above the connections 

Zone 2 

All tanks 

Within the vapour space 

ZoneO 

Vent pipes 

(a) Within a radius of 3 m in all directions of the open end of 
any vent pipe 

Zonel 


(b) The area below the Zone 1 area of any vent pipe, for a 
radius of 3 m around the discharge point and down to 
ground level 

Zone 2 

Pumps and sample points 

Within a horizontal radius of 4 m and vertically from ground 
level to 2 m above the unit 

Zone 2 

Road and rail tankers 

(a) Withn 300 mm in any direction of any opening on the 

Zonel 

(at loading/unloading points) 

tanker, and down to ground level 



(b) Within 2 m of the shell of the tanker 

Zone 2 


(c) Within a horizontal radius of 4 m from tanker discharge 
connections and vertically from ground level up to 1 m 
above the connections 

Zone 2 


(d) Within a radius of 1.5 m of any opening on the tank top, 
and down to ground level 

Zonel 


(e) On the top of the tank within the valence 

Zonel 


(1) Where an area is classified under more than one heading the more stringent classification should be adopted. 

(2) Any pit, trench or depression in a Zone 1 or Zone 2 area should be considered a Zone 1 area throughout. 

(3) Where tanks are mounded or buried in a hillside, etc., and access is by means of a tunnel or adit, typically 2 m or more in height, the space in 
the tunnel should normally be considered a Zone 1 area. 


The situation is also affected by the use of a floating deck. 
This reduces the concentration of vapour, but does not 
necessarily eliminate flammable mixtures. The vapour 
space above the floating deck may in fact go from a mixture 
above the upper flammability limit near the deck to one 
below the lower flammability limit near the fixed roof. 

It is also necessary to consider the conditions under 
which a flame can occur at the vent outlet. For this to hap¬ 
pen the vent must be exhaling vapour. It may be assumed 
that it does this, on average, half the time. The situations 
which give rise to exhalation of vapour are, in particular, 
filling operations and temperature rises. Thus the condi¬ 
tions under which a flame may flash back and cause an 
explosion are when the vapour space in the tank contains 
an explosive mixture and the vent is exhaling vapour. 

The desirability of using flame arresters has been a 
matter of some debate. Insurance companies have often 
recommended their use. Thus the Factory Mutual Engi¬ 
neering Corporation (FMEC, 1967) recommends their use 
on atmospheric vents for liquids with flash points below 
110°F (43°C) and for liquids which may be heated above 
their flashpoints. 

A discussion of the problem is given in API Publ. 2210: 
1982 Flame Arresters for Vents of Tanks Storing Petroleum 
Products, though this is no longer listed. Flame arresters 
are a potential cause of vent blockage and tank collapse and 
their use needs to be justified. 


The case for the use of a flame arrester in addition to a PV 
valve is less than clear. API Publ. 2210 suggests that where 
a PV valve is used, there is no good reason to put a flame 
arrester on. 

The argument supporting this view is broadly on the 
following lines. Tank fires caused by lightning were a pro¬ 
blem on the older wooden-roofed tanks, but with the advent 
in about 1920 of truly gas-tight steel roofs combined with 
PV valve, such fires are rare. The probability of tank fires 
via vents is low, because most oil industry stocks do not 
give a vapour mixture in the flammable range above the 
liquid, and ignition sources are excluded from the vicinity 
of vents. Moreover, it is notoriously difficult to keep flame 
arresters well maintained and this introduces the hazard of 
vent blockage and tank collapse. 

API Publ. 2210 concludes: ‘There is no supportable basis 
for requiring that an outdoor above-ground tank provided 
with a pressure-vacuum valve must also be equipped with 
a flame arrester. The use of flame arresters is discouraged 
unless the user is able to institute the maintenance neces¬ 
sary to ensure that the required venting capacity is main¬ 
tained.’ 

API Std 2000: 1992 takes a similar stance, stating: 
‘A flame arrester is not considered necessary for use in 
conjunction with a PV valve because flame speeds are less 
than vent velocities through PV valves’. It does, however, go 
on to say: ‘Open vents with a flame-arresting device may be 
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used in place of PV valves on tanks in which oil with a flash 
point below 100°F (37.78°C) is stored and on tanks contain¬ 
ing petroleum and petroleum products where the fluid 
temperature may exceed the flash point’. 

The IP Refining Safety Code states that fixed roof tanks 
for Class I and II liquids are usually fitted with PV valves 
and tanks for Class III and Unclassified liquids with open 
vents. It further states that PV valves or open vents should 
not be fitted with fine mesh gauze, which is liable to clog. 

HS(G) 50 and HS(G) 52 state that a flame arrester should 
normally be installed on an open vent on a fixed roof tank 
storing liquid with a flash point below 21°C. But a flame 
arrester is not necessary on a PV valve and should not be 
used where the liquid is liable to block the arrester by 
polymerization or otherwise. 

22.5.4 Fire relief 

It is also necessary for fixed roof storage tanks to provide 
for the effect of fire which heats the liquid, increases its 
vaporization and causes a rise in pressure. Tanks can nor¬ 
mally withstand a pressure of only a few inches WG. It is 
normal not to size atmospheric vents or PV valves for fire 
relief but to provide for this by separate emergency venting. 

Methods of providing emergency venting for fire are 
described in API 2210. They include larger or additional 
open vents, larger or additional PV valves, lifting manhole 
covers or hatches and a weak roof-to-shell connection. 

This latter arrangement involves the use of a weak roof- 
to-shell attachment, otherwise known as a frangible joint or 
rupture seam. This involves making the seam between 
the shell and the roof deliberately weak so that it is the first 
to rupture, thus ensuring that the shell stays intact and 
contains the liquid. The incorporation of such a frangible 
joint as an emergency vent in accordance with API 2210 is 
allowed for in API Std 650. Not all companies consider it 
good practice to rely on a rupture seam for fire relief, 
although one may still be used to relieve explosions. 

The methods given in API Std 2000 for the determination 
of the heat input into storage tanks in a fire, and hence of 
the venting capacity required, are described in Chapter 16. 

22.6 Fire Prevention and Protection 

Accounts of fire prevention and protection of petroleum 
storage are given in Storage and Handling of Petroleum 
Liquids byJ.R. Hughes (1970) and Fire Protection Manualfor 
Hydrocarbon Processing Plants by Vervalin (1964a, 1973a). 
Relevant standards and codes are API RP 2001: 1984 
Fire Protection in Refineries, the IP Refining Safety Code, 
NFPA 30: 1990 Flammable and Combustible Liquids 
Code, BS 5306:1976- Fire Extinguishing Installations and 
Equipment on Premises and BS 5908:1990 Code of Practice 
for Fire Precautions in the Chemical and Allied Industries. 
HSE guidance is given in HS(G) 50 and HS(G) 52. 

Fire prevention in and protection of storage has several 
objectives. These are (1) to minimize the risk to personnel, 
(2) to minimize loss due to the initial fire, and (3) to prevent 
the spread of fire to other vessels and equipment. Personnel 
are at risk principally from an explosion or sudden spread 
of fire. 

Implementation of fire protection for storage takes the 
two forms (1) fighting the fire and (2) protecting the storage 
vessels. Methods of fire prevention and protection in gen¬ 
eral have been described in Chapter 16. The discussion 
there includes some treatment of storage, including the 
application rates of fire-fighting media. 


A major contribution to fire prevention in storage is made 
by layout, as described in Section 22.4. Important aspects 
of storage layout are the practice of segregation, the provi¬ 
sion of separation distances and HAC. 

22.6.1 Inerting of storage tanks 

An effective method of fire prevention in storage is inert¬ 
ing. This is widely used to reduce the hazard of fire in 
atmospheric storage tanks. The value of inerting in reduc¬ 
ing fire/explosion in storage tanks was discussed in 
Chapter 16 and methods of inerting were described in 
Chapter 17. 

22.6.2 Fire protection of storage tanks 

There are two main effects of fire on an atmospheric stor¬ 
age tank. One is that those parts of the tank which are not 
cooled by the liquid inside may become hot and weaken. 
The other is that the liquid inside the tank is heated up and 
its vaporization is increased. In a fixed roof storage tank, 
this results in a pressure rise and, as explained earlier, 
relief of such pressure is now normally effected by the use 
of some form of emergency vent. 

Fire protection for atmospheric storage tanks is provided 
by fixed water or foam sprays, which may be supplemented 
by fireproof thermal insulation, and by mobile water and 
foam sprays. 

Fixed water sprays are effective in giving immediate 
cooling of exposed surfaces and are particularly useful 
where manpower is limited or access for mobile equipment 
is difficult. But the main water sprays are normally pro¬ 
vided by mobile equipment and are used both to fight the 
fire and to cool exposed surfaces. There are also mobile 
water curtains which can be interposed to protect vessels if 
sufficient manpower is available. 

For cooling of an unwetted tank surface a rate of appli¬ 
cation of water of 0.2 UKgal/ft 2 min (101/m 2 min) has been 
found satisfactory. It is desirable to cool the wetted surface 
also to minimize the rise in pressure, but the effectiveness 
of water cooling then depends on the boiling point of the 
stored liquid. If this is below the boiling point of water, the 
water does not vaporize and the cooling due to the latent 
heat effect is not obtained. If, however, the boiling point of 
the liquid is above that of water, then the water does 
vaporize and is much more effective. 

Foam is used to extinguish fires rather than to cool sur¬ 
faces. The type of foam used is normally mechanical foam. 
Fixed foam pourers are used to direct foam to the inside of 
the tank shell so that the foam flows over the liquid surface. 
Another fixed device which puts foam on the liquid surface 
is the Swedish semi-subsurface foam system. This consists 
of a hose which is connected through the tank shell to a 
foam supply and is normally at the bottom of the tank. 
Injection of foam inflates the hose, the top end of which 
rises to the liquid surface and sprays the foam. 

Mobile foam-spraying equipment consists of mobile 
monitors and portable foam towers. A monitor projects jets 
of foam in a manner similar to that of conventional fire water 
jets. A portable tower is a light tube which is put upon the 
side of the tank and pours foam on the top of the liquid. There 
are various types, some assembled manually and others of 
telescopic design extended mechanically or hydraulically. 

Mobile foam monitors are available with a foam output of 
5000 UKgal/min and a range of 60 m (200 ft) in still air. 
For extinguishing fire, a rate of application of foam of 
0.1 UKgal/ft 2 min (4.5 l/m z min) has been found necessary. 
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Fixed equipment such as foam pourers is very vulner¬ 
able to damage by explosion. 

The application of foam from foam monitors requires 
some skill. An experienced operator can project foam so 
that it hits the inside of the tank on fire and runs down and 
blankets the burning liquid. 

The amount of foam used is large and it is necessary to 
make arrangements for adequate supplies. 

22.6.3 Pipework and fittings 

Fire can also have a very damaging effect on pipework, 
which sometimes may withstand the fire for only about 
10 min. Pipework is very vulnerable to fire and should be 
protected as far as possible. Fireproof insulation on pipe¬ 
work near storage vessels may be appropriate. 

A small fire at a leaking flange can have a torch effect and 
this possibility should be borne in mind in designing 
pipework. A fire of this type was one of the causes con¬ 
sidered at the Flixborough Inquiry. 

22.7 LPG Storage 

Some aspects of the storage of other fuels and chemicals 
are now considered, starting with LPG. The handling and 
processing of many of these substances were treated in 
Chapter 11 and the design of pressure systems in Chapter 
12, and these topics are therefore not discussed here. How¬ 
ever, attention is drawn to the fact that aspects such as the 
materials of construction, the pipework, the valves and the 
pumps are particularly important for these chemicals. 

Propane and butane are referred to as LPG. They are 
described in An Introduction to Liquefied Petroleum Gas 
(LPGITA, 1974/1). A general account of LPG is given in 
Chapter 11. 

Codes and standards for LPG were given in Chapters 10 
and 11. HSE guidance on LPG storage is given in HS(G) 34 
The Storage of LPG at Fixed Installations (1987). Other rel¬ 
evant codes are Design, Installation and Maintenance of Bulk 
LPG Storage at Fixed Installations (LPGITA, 1991 COP 1 
Parti) (theLPGALPG Storage Code), NFPA 58:1989 Storage 
and Handling of Liquefied Petroleum Gases (also published as 
theLiquefiedPetroleum Gases Handbook) and NFPA 59:1989 
Storage and Handling of Liquefied Petroleum Gases at Utility 
Plants. The code Liquefied Flammable Gases Storage and 
Handling (ICI/ RoSPA 1970 IS/74) (the ICILFG Code), though 
out of print, contains much valuable guidance. 

LPG is stored at petroleum storage terminals, at chemical 
works and at many non-chemical factories. 

22.7.1 Regulatory requirements 

The storage of LPG is governed by the Notification of 
Installations Handling Hazardous Substances (NIHHS) 
Regulations 1982 and the Control of Industrial Major Acci¬ 
dent Hazards (CIMAH) Regulations 1984. The NIHHS 
notifiable inventory is 25 te for pressure storage and 50 te 
for refrigerated storage. The CIMAH inventory for either 
type of storage for which demonstration of safe operation 
may be required (Regulation 4) is 50 te and that which 
attracts a safety case (Regulation 7) is 200 te. An account of 
the regulatory requirements for LPG in Germany has been 
given by Ackermann (1986). 

22.7.2 Storage conditions 

Fully refrigerated storage is essentially at atmospheric 
pressure and at the boiling points of the substances 


concerned. For pressure storage, the temperature follows 
the ambient temperature and the pressure is the correspond¬ 
ing vapour pressure of the substance. The boiling point of 
pure propane is -42°C and that of pure w-butane is 0°C. 
The boiling point of commercial propane is -45°C and that 
of commercial butane is -2°C. At a pressure reference 
temperature of 38°C the vapour pressure exerted by 
commercial propane is 4.83 barg and that exerted by com¬ 
mercial butane is 14.5 barg. 

22.8 LPG Storage: Pressure Storage 

22.8.1 Storage vessels 

Pressure storage of LPG is in horizontal cylindrical or 
spherical pressure vessels. The former are used for smaller 
quantities and the latter for larger ones. 

The design of pressure vessels for LPG pressure storage 
is discussed in the Liquefied Petroleum Gas Association 
(LPGA) LPG Storage Code. The design pressures and tem¬ 
peratures should take into account the extreme ambient 
and service conditions to which the storage may be subject. 
The Code states that the design conditions should not be 
less onerous than the following: 


Commercial Commercial 

butane propane 




Liquid 

offtake 

Vapour 

offtake 

Maximum 

38 

38 

38 

temperature (°C) 

Maximum 

4.83 

14.5 

14.5 

pressure (barg) 

Minimum 

-18 

-18 

-40 

temperature (°C) 

Minimum 

-524 

Zero 

Zero 

pressure (mbarg) 


gauge 

gauge 


The values given for the maximum temperature, or 
pressure reference temperature, are for a vessel finished in 
white; a higher maximum design temperature and pressure 
should be used for a vessel in a finish which reduces normal 
reflection of solar radiation. A higher minimum tempera¬ 
ture should be used only for dedicated service where con¬ 
trols are provided to limit the lowest fluid temperature to a 
value higher than that shown. A higher minimum pressure 
for butane should be used only if means are provided to 
ensure that an unacceptable vacuum does not occur or if the 
ambient temperature is such as to ensure that the fluid 
temperature will be higher than -18°C. 

As the LPGA Code indicates, more stringent design 
pressures and temperatures may be appropriate. Some of 
the factors which bear on this are discussed in the ICI LPG 
Code. For the maximum reference temperature in the 
United Kingdom the Code suggests that the following tem¬ 
peratures be assumed for a hot summer day: 


Temperature 

Tank capacity (m 3 ) 

47.5 

<5 

42.5 

5-30 

41 

30-100 

40 

>100 
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The Code states that the design pressure at the top of the 
vessel should be set equal to the greater of (1) 110% of the 
maximum operating pressure or (2) the maximum operat¬ 
ing pressure plus 1 bar (14.5 psi), and that the design pres¬ 
sure at the bottom of the vessel should be set equal to that at 
the top plus the static head of the product or water, which¬ 
ever is the greater. 

The choice of design pressure should also be considered 
in conjunction with relief and blowdown arrangements, 
since these can be expensive, and it may be economic to 
increase further the design pressure. 

The maximum design temperature for pressure storage 
vessels is determined by the loss of strength in the metal at 
high temperatures. Increased temperature always leads to 
loss of strength, but the fall-off is much greater for a vessel 
designed to an advanced code rather than a conventional 
one. The ICI code states, for example, that the design stress 
for a vessel designed to BS 1500 does not reduce sig¬ 
nificantly until 400°C, whereas that for a vessel designed to 
BS 1515 falls off rapidly above 50°C, so that the maximum 
design temperature needs to be considered particularly 
carefully when using BS 1515. The maximum temperature 
reached by the metal is likely to be during a fire. The tem¬ 
perature of unprotected metal rises rapidly in a fire, but 
there are several features which may mitigate this. The 
metal is normally protected by fire insulation and water 
sprays, and metal in contact with the liquid inside is cooled 
by the liquid boil-off. 

The minimum design temperature for pressure storage 
vessels is normally set by the loss of ductility and hence 
brittle fracture in the metal at low temperatures. There are 
several ways in which a low metal temperature may occur. 
The ambient temperature may be low, although in this case 
there is normally a time lag due to insulation. The metal 
may come in contact with low temperature liquid due to 
abnormal operating conditions in the process or loss of 
pressure and liquid boil-off in the vessel. This latter effect, 
however, is likely to signal its presence and the Code sug¬ 
gests that it may be assumed that for a vessel of reasonable 
size action would be taken before the temperature has fallen 
to that corresponding to atmospheric pressure. 

The combinations of pressure and temperature which 
may occur should also be considered. 

The material of construction of most storage vessels is 
carbon steel, but other materials may be used. 

A classic set of general arrangements for pressure 
storage vessels is given in the ICI LPG Code. Figure 22.8(a) 
shows those for a horizontal cylindrical vessel and 
Figure 22.8 (b) shows those for a spherical vessel. Another 
set of general arrangements for such vessels given by 
Nazario (1988). Figure 22.9 shows the arrangements for 
horizontal cylindrical storage vessels given in HS(G) 34. 

22.8.2 Separation distances 

Separation distances for pressurized LPG storage are given 
in HS(G) 34, the IP LPG Code and NFPA 58. 

Minimum separation distances for LPG pressure storage 
vessels given in HS(G) 34 are shown inTable 22.6. Guidance 
is also given on separation distances between LPG and 
storages of flammable liquids, toxic substances, LPG 
cylinders and cylinder filling buildings. For flammable 
liquids, the separation distance is 6 m to the bund wall for 
liquids with a flashpoint<32°C or 6 m to the tank and 3 m 
to the bund wall for liquids with a flashpoint of 32-65°C. 
For toxic or hazardous substances the separation distance 


is as given in Table 22.6 for buildings, etc., subject to a 
minimum value of 15 m. HS(G) 34 also gives the separation 
distances between LPG and liquid oxygen storages. 

The approach to minimum separation distances in 
NFPA 58 is broadly similar. This code also gives separation 
distances between LPG and both oxygen and hydrogen 
storages. 

The approach to minimum separation distances in 
Germany is described by Ackerman (1986). 

22.8.3 Separation distances: fire models 

As described earlier, an alternative approach to the setting 
of minimum separation distances is the use of models for 
vapour dispersion and fire radiation. An account of the 
application of this approach to petroleum storage is given in 
Section 22.4. 

The separation distances for LFG given in the ICI LPG 
Code, and shown in Table 22.7, owe something to this 
approach, and are an early, if implicit, example of its use. 
Two methods of determining the heat received by pressure 
vessels are also presented in this Code, but these are not 
used there to determine separation distances, which are 
obtained from Table 22.7. The two methods are used to cal¬ 
culate the requirements for pressure relief and for drench 
water as described below. The modelling approach to 
separation distances is now entering mainstream codes. 
The minimum separation distances given in the IP LPG Code 
for LPG pressure storage are specif ied in terms of the thermal 
radiation flux from certain defined fires. These fires are jet 
fires from the vessel relief valve and spillages from the 
vessel, its associated equipment and other identified leak 
sources, with spillage possibly forming apool in the bund or 
impounding basin. The Code gives guidance on potential 
leak sources and emission rates and on the thermal radiation 
from jet and pool fires. The minimum separation distances 
given in the code are shown inTable 22.8. 

22.8.4 Secondary containment 

For pressure storage vessels containing LFG a full bund is 
not used. It is true that an appreciable proportion of a spil¬ 
lage remains as liquid after the initial flashing off of 
vapour. For example, if liquid propane at 16°C escapes to 
atmosphere the theoretical proportion of liquid remaining 
after flashing off is 67%. 

However, complete loss of containment from a properly 
designed, maintained and operated pressure vessel is rare, 
material is in any case ejected mainly as vapour/spray, and 
smaller spillages from valvework can be dealt with by other 
means. Moreover, it is essential to allow free circulation of 
air so that small leaks and spillages are safely dispersed. 

The arrangement recommended in the ICI LFG Code is 
that there should be a diversion wall with only the vessel on 
one side and all the joints and valvework on the other. 
The only requirement on the vessel side of the wall, where 
the risk of spillage is remote, is that the ground should 
slope away from the vessel, but on the other side there 
should be not only sloped ground and a catchment area but 
also such diversion walls as are necessary to ensure that a 
spillage flows into the latter. In an existing installation or 
other installation in which it is not possible to eliminate 
joints and valvework under the vessel, these diversion 
walls should be put around the vessel. 

The vessel and its pipework should also be protected 
against damage by vehicles, by the use of some form of crash 
barrier if necessary. 
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Figure 22.8 General arrangement of LPG pressure storage vessels with special reference to piping: (ICI/RoSPA 1970 
IS/74; reproduced by permission): (a) horizontal cylindrical vessel; (b) spherical vessel 


HS(G) 32 adopts a broadly similar approach, based on 
the principles of sloping the area under pipework connec¬ 
tions, the use of diversion walls and an evaporating area, 
and the provision of a crash barrier against vehicle impact. 
It requires that the ground be impervious beneath the 
pipework connections, that the height of diversion walls 
should not exceed 0.5 m and that the evaporation area 
should be not less than 3 m from the vessel. 

The IP LPG Code explicitly states that a bund is not 
normally required and its provisions are in line with the 
approaches just described. 

The ICI LFG Code also considers pressure storage of non¬ 
hydrocarbon LFGs which are miscible with water and which 


it may be desirable to dilute. Thus, if the liquid can be 
rapidly diluted with water and rendered harmless, this is 
appropriate, and it is then not necessary to provide a 
catchment area for spillage. But some materials may need to 
bedilutedforotherreasons,forexampletoxicity. In this case, 
a full bund should be provided sufficient to take both the 
spillage and the dilution water. Walls should not exceed 
2m (6 ft 6 in.) in height and they should have at least two 
access points. 

22.8.5 Diversion walls and fire walls 

Diversion walls can be used to divert large vapour flows to 
areas where they can be dealt with more safely. 
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Figure 22.9 General arrangement of LPG horizontal pressure storage vessels (Health and Safety Executive, 1987 
HS(G) 34) (Courtesy of HM Stationery Office © All rights reserved) 


Table 22.6 Minimum recommended separation distances for LPG pressure storage: HS(G) 34 
(Health and Safety Executive, 1987 HS(G) 34) (Courtesy of HM Stationery Office © All rights reserved) 


Vessel capacity (te) 

Distance (m) a 


Single vessel 

All vessels 

From buildings, boundary, property 

With fire wall 

Between vessels 


in a group 

line or fixed fire source of ignition 



4-60 

200 

15 

7.5 

1.5 

60-150 

450 

22.5 

11 

- b 

>150 

1000 

30 

15 

- b 


“These distances apply to above ground vessels. For mounded vessels the distances are as follows. The distances between buildings, etc., and the 
valve assembly are the same as those for above ground vessels with a fire wall; the distances between buildings, etc., and the vessel itself are 3 m 
in each case. The distances between vessels are 1.5 m for the lowest set of capacities quoted, but for the two higher sets the spacing should be 
determined by the site conditions and the requirements of installation, testing, maintenance and removal. 


Steam curtains may also be considered as a means of 
maintaining separation from an ignition source, although 
they are actually used mainly around process plants. 

Fire walls are utilized to give protection against flame or 
heat radiated from a fire. 

Trenches leading from the storage area should be fire stop¬ 
ped at or near the boundary by barrier walls or bunds across 
the pipes. Drains with openings in the storage area should 
have means to prevent the transmission of insoluble flam¬ 
mable and noxious products to the general drainage system. 


22.8.6 Hazardous area classification 

Guidance on the HAC for LPG pressure storage is given 
in API RP 500, the IP Area Classification Code, and 
also in NFPA 58 and 59, the LPGA LPG Storage Code and 
HS(G) 34. 

A table of guidelines for delineation of the zones round 
LPG pressure storage vessels for HAC is given in the LPGA 
LPG Storage Code. The virtually identical table given in 
HS(G) 34 is shown in Table 22.9. 
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Table 22.7 Minimum recommended separation distances for LFG storage: ICI LFG Code (ICI/RoSPA, 1970; 


reproduced by permission 









Minimum distance 



Material stored 






Hydrocarbons 


Non-hydrocarbons 



Non-hydrocarbons 





insoluble in water 



soluble in water 



Pressure storage® 









To boundary, process units, 

Ethylene 

60: 

m (200 ft) Methyl chloride 

23 n 

l (75 ft) Methylamines 

15 n 

i(50 ft) 

buildings containing a 

C 3 s 

451 

m (150 ft) Vinyl chloride 

23 a 

i(75 ft) 




source of ignition, or any 

C 4 s 

30: 

m (100 ft) Methyl vinyl ether 15 m 

i(75 ft) 




other fixed sources of 



Ethyl 

15 m 

i(50 ft) 




ignition 



chloride 






To building containing 


151 

n (50 ft) 

15 rr 

l (50 ft) 


15 n 

i(50 ft) 

flammable materials, for 
example filling shed 









To road or rail tank wagon 


151 

n (50 ft) 

15 rr 

L (50 ft) 


15 n 

i(50 ft) 

filling points 

To overhead power lines and 


151 

n(50ft) 

15 m 

L (50 ft) 


15 n 

i(50 ft) 

pipebridges 









To other above ground power 

(2) 

7.5 

m (25 ft) (2) 

7.5 n 

i(25 ft) See Note (3) 



cables and important 
pipelines or pipelines 
likely to increase the 
hazard 









Between pressure storage 

One-quarter of 


i of diameters of adjacent tanks 





vessels 









To low pressure refrigerated 

15 m (50 ft) from the bund wall of the low pressure tank, but n 

ot less than 



tanks 

30 m (100 ft) from the low pressure tank shell 






To flammable liquid® 

15 m (50 ft) from the bund wall of the flammable liquid tank 




storage tanks 









Low pressure refrigerated storage 15 ’ 








To boundary, process units, 

Ethylene 90 m 

(300 ft) 



Ethylene oxide 15 n 

i(50 ft) 

buildings containing a 

C 3 s 

451 

m (150 ft) 






source of ignition, or any 
other fixed sources of 
ignition <6) 

C 4 s 

151 

n (50 ft) 






To building containing 


151 

n (50 ft) 




15 n 

i(50 ft) 

flammable materials, for 
example filling shed 









To road or rail tanker 


151 

n (50 ft) 




15 n 

i(50 ft) 

filling point 

To overhead power lines and 


15] 

n(50ft) 




15 n 

i(50 ft) 

pipebridges 









Between low pressure 

One-half of sur 

n of diameters of adjacent tanks 






refrigerated tank shells 









To flammable liquid® 

Not less than 30 m 

(100 ft) between low pressure refrigerated LFG and flammable liquid 

storage tanks 

tank shells, but LFG and flammable liquids m 

ust be in separate bunds 



To pressure storage vessels 

As defined above under Pressure Storage 







Notes (to original table) 

(1) Measured in plan from the nearest point of the vessel, or from associated fittings from which an escape can occur when these are located 
away from the vessel. 

(2) If this distance cannot be achieved, the need for suitable fire protection of the cable or pipeline should be considered. 

(3) The tanks containing water soluble non-hydrocarbons being bunded (see Clause 8.6.2), power cables and pipelines at ground level should be 
outside the bund and so protected by the bund from fire in the tanks. 

(4) Flammable liquids are those with flashpoints up to 65.5°C (150°F). 

(5) Measured in plan from the nearest part of the bund wall (see Clause 8.6.3), except where otherwise indicated. 

(6) The Home Office Code for Storage ofLPG at Fixed Installations recommends 45 m (150 ft) for C 4 as well as C 3 , storage, which is considered to 
be unnecessarily conservative. The designer may be able to persuade the Licensing Authority of the adequacy of the ICI Code in this 
respect, in view of the significant difference in rate of vaporization of the respective materials. 

Additional notes (communicated by ICI c. 1977): 

(1) The separation distances quoted in this table are those within which leaks from pumps, valves, flanges, etc., will normally disperse to a safe 
level.They are not ‘safety distances’ for vapour cloud explosions. 

(2) Refrigerated storage tanks are now often constructed with an outer wall of concrete which will retain any spillage. This design may permit 
the use of lower separation distances but no definite figure has been agreed. 
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Table 22.8 Minimum recommended separation distances for LPG pressure and refrigerated storages: 
IP LPG Storage Code (Institute of Petroleum, 1987 LPG Storage Code) 


A Pressure storage 


Site 

Maximu 

(kW/m 2 ) 

\m radiation flux levels 

(BTU/hft 2 ) 

Equipment 

The outer surfaces of adjacent pressure storage vessels (1): 

Thermally protected (2) 

44 

13,750 

Unprotected (3) 

8 

2,500 

The outer surfaces of adjacent storage tanks containing 
flammable products (4) and process facilities: 

Thermally protected (2) 

32 

10,000 

Unprotected (3) 

8 

2,500 

Filling 1 discharge points 

8 

2,500 

Personnel inside boundary 

Process area (5) 

8 

2,500 

Protected work area (6) 

8 

2,500 

Work area (7) 

5 

1,500 

Critical area (8) 

1.5 

500 

Plant boundary 

Remote area (9) 

13 

4,000 

Urban area (10) 

5 

1,500 

Critical area (8) 

1.5 

500 

B Refrigerated storage 

Site 

Maximum thermal radiation flux levels 


(kW/m 2 ) 

(BTU/hr ft 2 ) 

Equipment 

The outer surfaces of adjacent refrigerated storage tanks: 

Thermally protected (2) 

32 

10,000 

Unprotected (3) 

8 

2,500 

The outer surfaces of adjacent storage tanks containing 
flammable products (4): 

Thermally protected (2) 

32 

10,000 

Unprotected (3) 

8 

2,500 

The outer surfaces of adjacent LPG pressure storage vessels and 

8 

2,500 

process facilities (11) 

Personnel inside boundary 

Process area (5) 

8 

2,500 

Protected work area (6) 

8 

2,500 

Work area (7) 

5 

1,500 

Critical area (8) 

1.5 

500 

Plant boundary 

Remote area (9) 

13 

4,000 

Urban area (10) 

5 

1,500 

Critical area (8) 

1.5 

500 

Notes : 




(1) The distance from an LPG pressure storage vessel to a refrigerated storage tank is determined by the requirement of Chapter 3 (see 3.3.1) and 
Table 2 of this appendix. 

(2) Such facilities/areas are protected by means of water sprays, insulation, radiation screens or similar systems. 

(3) Protection is provided by spacing alone. 

(4) Special consideration should be given to the location of floating roof tanks containing high vapour pressure products since effective water 
cooling of their roof structures is impracticable. 

(5) A normally unoccupied area occasionally manned by trained and suitably clothed persons familiar both with escape routes and oppor¬ 
tunities for temporary shelter afforded by the process plant. 

(6) A permanent building where personnel inside are shielded and/or have a shielded means of escape. 

(7) An open area or small (e.g. temporary) building without a shielded means of escape. 

(8) This is either an unshielded area of critical importance where people without protective clothing may be required at all times including 
during emergencies or a place difficult or dangerous to evacuate at short notice (e.g. a sports stadium). 

(9) An area only infrequently occupied by small numbers of persons, for example moorland, farmland, desert. 

(10) An area which is neither a remote area nor a critical area. 

(11) The allowable thermal radiation flux level is restricted for these facilities in view of the potentially longer duration of exposure resulting 

from a refrigerated tank/bund fire. 
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Table 22.9 Guidelines for hazardous area classification of LPG pressure storage (Health and Safety Executive, 
1987 HS(G) 34) (Courtesy of HM Stationery Office © All rights reserved) 


Factor Area classification 


Storage vessels 

(a) 

Within 1.5 m in all directions from 
the discharge orifice of fixed liquid 
level gauges, rotary or dip gauges, 
filler openings 

Zonel 


(b) 

Up to 1.5 m above ground level and within 
the distances set out for a fixed source of 
ignition in Table 2 column (a) b 

Zone 2 

Relief valve discharge 

(a) 

Within direct path of discharge 

Fixed electrical equipment 
should not be installed 


(b) 

Within 1.5 m in all other directions from 
point of discharge 

Zonel 


(c) 

Beyond 1.5 m but within 4.5 m, or the 
separation distance in Table 2 column (a) b 
in the case of vessels with a capacity not 
exceeding 25001, in all directions from 
point of discharge 

Zone 2 

Tanker loading and unloading 

(a) 

Within 1.5 m in all directions from a point 
where connections are regularly made or 
disconnected for a product transfer 

Zonel 


(b) 

Beyond 1.5 m but within 4.5 m or the 
separation distance in Table 2 column (a) b 
in the case of vessels with a capacity not 
exceeding 2500 1, from point of connection 
or disconnection 

Zone 2 

Pumps, compressors and 
vaporizers other than 
direct fired 

(a) Outdoors in open air, 

(a) 

Within 1.5 m in all directions 

Zonel 

at or above ground level 1 2 3 


(b) 

Beyond 1.5 m but within 4.5 m in all 
directions or the separation distance in 

Table 2 column (a) b in the case of vessels not 
exceeding 25001 capacity 

Zone 2 

(b) Indoor location with 

The entire room and any adjacent room not 

Zonel 

adequate ventilation 

separated by a vapour-tight partition 



a Where there is a high standard of maintenance of pumps and pump seals the area within 1.5 m in all directions from the pump may be classified 
as Zone 2. 
b Of HS(G) 34. 

(1) Where any area is classified under more than one factor the higher classification should prevail. 

(2) Any pit, trench or depression falling within a Zone 1 or Zone 2 area should be treated as a Zone 1 area throughout. 

(3) The term ‘outdoors in open air’ includes pumps, compressors and vaporizers which are covered by a canopy. 


For LPG storage during distribution, the IP Area Classi¬ 
fication Code refers to the LPGA Code, whilst for storage 
under the more varied conditions which pertain in ref ineries 
and process plants it advises the use of the point source 
method. 

22.8.7 Pipework and fittings 

The pipework, valves and other fittings for storage systems 
should be designed in accordance with approved practice 
for such equipment. Pipework for pressure systems was 
described in Chapter 12 and the discussion here is limited 
to aspects particularly relevant to storage. 

Pipework and fittings for LPG pressure storage are dealt 
with in the main LPG codes mentioned and also specifi¬ 
cally in LPG Piping System Design and Installation (LPGA, 
1990 COP 22) (the LPGA Piping Systems Code). 


The types of consideration which should be taken into 
account in pipework for storage are illustrated by the fol¬ 
lowing recommendations for pipework for LFG taken from 
the ICI LFG Code. 

The minimum temperatures which may be attained by 
the piping should be carefully considered and materials of 
construction selected accordingly. Storage systems are 
subject to such operational conditions as rapid blowdown, 
which can result in low temperatures. 

Allowance should be made in the pipework for stresses 
due to movement, expansion/contraction and vibration. In 
storage systems, typical causes of stress are shifting and 
settling of vessels and expansion/contraction due to tem¬ 
perature changes. 

Joints should be welded or flanged. Welded joints are 
preferable and flanged joints should be kept to a minimum. 
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Valves should be of the wedge gate or ball type. Ball valves 
give a more positive shut-off than wedge gate valves and 
should be used on the critical filling/discharge and drain 
lines. 

The ball valves should be dual directional, should be of 
the fire-safety type and should have antistatic protection. 
Ball valves welded into lines should be such that they can be 
maintained in situ by ‘top entry’. 

With a ball valve, liquid can be trapped in the body cav¬ 
ity. In low temperature, LFG duties conditions can occur 
which cause the liquid to expand. Provision should be made 
for relieving this expansion which does not render the valve 
unidirectional. 

The main filling/discharge line should have a minimum 
diameter of 4 in. The drain line should be 2 in., reducing 
to%in. 

The preferred pipework arrangement for a horizontal 
storage vessel is shown in Figure 22.8(a). There are no 
flanges, valves or other fittings on the filling/discharge 
line on the vessel side of the separation wall, only a single 
butt weld. Valves A-C are butt-welded ball valves and 
valve D is a flanged, spring-loaded valve. Valve A is the 
main shut-off valve, which is remotely operated and has 
fail-safe action, closing on air failure. 

There is also an alternative arrangement in which flanged 
joints are allowed on the vessel side of the separation wall. 

The preferred pipework arrangement for a spherical 
storage vessel is shown in Figure 22.8(b). 

If possible, the main filling/discharge pipe should be the 
only one below the liquid level. Another inlet may be pro¬ 
vided at the top of the vessel if mixing of the liquid by 
pumping is necessary. There may also be a vapour return 
line to the vessel. With a horizontal cylindrical vessel, it is 
desirable to put the filling/discharge line and the vent at 
opposite ends to assist purging of the vessel. 

The vessel branch sizes should be 4 in. minimum for 
the filling/discharge line and 1 in. minimum for all other 
branches. 

Sections of pipe, such as those between shut-off valves, 
in which liquid may become trapped and may then undergo 
further expansion, should be provided with liquid expan¬ 
sion relief valves. 

There should be good access to valves. Permanent access 
should be provided for valves which are operated or 
maintained regularly, or which may need to be used in an 
emergency. 

The pipework should be protected against mechanical 
damage from external sources. 

Pipework is very vulnerable to fire and should be pro¬ 
tected as far as possible. Fireproof insulation on pipework 
near storage vessels may be appropriate. 

A small fire at a leaking flange can have a torch effect and 
this possibility should be borne in mind in designing 
pipework. A fire of this type was one of the causes con¬ 
sidered at the Flixborough Inquiry. 

Remotely operated shut-off valves should be provided on 
all discharge or drain lines from storage vessels and these 
valves should be stable in fire conditions. Other valves in 
the storage area should be of fire-safe design. 

Turning to the guidance on pipework and fittings in the 
main LPG codes, detailed treatments are given in the LPGA 
LPG Storage Code, the LPGA LPG Piping Systems Code and 
the IP LPG Storage Code. These codes cover materials of 
construction, pipe thickness, pipe joints, welding, flanges, 
gaskets, bolts, valves, pipe supports, etc. 


The LPGA LPG Storage Code gives detailed require¬ 
ments for the minimum set of fittings on an LPG pressure 
storage vessel. These are (1) a pressure relief valve on the 
vapour space, (2) a drain or other means of emptying the 
vessel, (3) a maximum level indicator, (4) a filling connec¬ 
tion, (5) a service connection and (6) a pressure gauge on 
the vapour space on vessels of over 50001. 

The Code requires the provision of a manual shut-off 
valve on all liquid and vapour connections, except on the 
pressure relief valve or very small diameter (<1.4 mm) 
connections. 

Another requirement of the Code is that any connec¬ 
tion on the vessel greater than 3 mm diameter for liquid or 
8 mm diameter for vapour, except that for a relief valve, 
should be protected with an emergency shut-off valve 
(ESV). The types of ESV mentioned are excess flow valves, 
remotely operated isolation valves and back-check valves. 
The detailed applications of the three types are given in 
the Code. 

A back-check valve is a spring-loaded non-return valve 
held in the closed position. The valve remains closed 
against reverse flow until the upstream pressure exceeds 
that of downstream, when the valve opens. 

HS(G) 34 requires a remotely operated ESV on all liquid 
lines greater than 19 mm in diameter if they supply an 
activity which requires frequent making and breaking of 
connections or one where the general public have access or 
if the vessel is large (>225 m 3 ). 

22.8.8 Water drainage facilities 

As described in Chapter 20, small amounts of water tend to 
accumulate at the bottom on an LPG storage vessel and this 
water is commonly removed by the periodic action of an 
operator who drains it off manually. Loss of control by the 
operator can result in a breakthrough and escape of LPG. 

Methods of dealing with this problem have been dis¬ 
cussed by Klaassen (1980b), who describes valve arrange¬ 
ments for the bottom of LPG spheres designed to minimize 
the chances of such an escape. He describes a system with a 
2 in. line coming out of the bottom of the sphere, reducing to 
% in. on the downstream part of the drain line. Basic prin¬ 
ciples underlying the system are: (1) a reduction in the line 
size, as just mentioned; (2) the installation of a first ball 
valve in the 2 in. line dedicated to isolation rather than 
manipulation, and preferably remotely controlled; (3) the 
provision of two further ball valves on the drain line, the 
downstream one being a spring-loaded valve; (4) a separa¬ 
tion between the drain valve and the drain funnel and 
(5) the provision of an indication of water level which is visible 
at the point where the draining operation is performed. 

Guidance on water draining arrangements is given in 
HS(G) 34 The Storage of LPG at Fixed Installations (HSE, 
1987) as follows: 

66. Drain connections should be less than 50 mm in 
diameter and fitted with two shutoff valves in series. The 
length of piping between the valves should be at least 
0.5 m to minimize the risk of simultaneous obstruction of 
both valves by the freezing of any water present in the 
LPG. The piping downstream of the second valve should 
not discharge beneath the vessel. The second valve and 
piping should be adequately supported and secured to 
prevent mechanical damage or breakage by vibration or 
jet forces. Both valves on the drain systems should have 
means of actuation which cannot be readily removed or 
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moved from the closed position except by intentional 
operation. 

67. Alternatively, a satisfactory arrangement for drain 
lines could be a single valve and a plug or blanking plate 
fitted on the discharge side of the valve. Additional 
pipework should be fitted, when required, in accordance 
with paragraph 66. 

68. No drain lines should discharge within 6 m of any 
drainage system where this would be liable to create a 
hazard. 


22.8.9 Ancillary facilities 

The ancillary facilities required for LPG pressure storage 
include, in particular, pumps and vaporizers. It is impor¬ 
tant that these items, which effectively introduce a process 
element, should not hazard the storage. A pump should not 
be located directly under a vessel. 

Pumps are a potential source of leakage of flammable 
vapours.This is particularly the case for pumps with packed 
glands. Pumps with mechanical seals are to be preferred. 
The type of pump used also has implications for the HAC. 

A positive displacement pump needs to have a bypass or 
other appropriate protection against overpressure. The 
thermal expansion of LPG in a pump which is isolated and 
is then started up can be particularly damaging. 

LPG storage is often provided with vaporizers. Descrip¬ 
tions of, and requirements for, vaporizer systems are given 
in NFPA 58 and 59, the LPGA LPG Storage Code and 
HS(G) 34.Vaporizers may be heated by direct firing or by an 
indirect heating medium such as steam or hot water. Some 
principal features of a vaporizer system include the vapor¬ 
izer itself, drain connections, pressure relief and instru¬ 
mentation. Direct fired and certain other types of vaporizer 
constitute ignition sources. 

22.8.10 Instrumentation 

An LPG pressure storage vessel should be provided with 
suitable measurements and alarms on liquid level, pressure 
and temperature. A discussion of instrumentation for LFG 
pressure storage is given in the ICI LFG Code. Instru¬ 
mentation is essential to the safe operation of LPG pres¬ 
sure storage. It is important both that the instruments 
function correctly and that they do not themselves hazard 
the process. 

Vessels should be protected against maloperation by 
alarm and trip systems. Overpressure is obviously one 
condition against which protection is necessary It is often 
caused by overfilling, and so high level alarms and trips are 
important. But this is not the only condition requiring 
protection - overtemperature and undertemperature are 
important too. 

The measurement of level in pressure storage may pre¬ 
sent some difficulties. In order to avoid leakage, it may be 
policy not to put additional branches on the vessel simply 
for level measurement, which rules out conventional dif¬ 
ferential pressure measurements. The Code recommends 
duplicate internally mounted level measuring instruments 
as the primary measurements with a magnetic float gauge 
or radioactive gauge as the secondary measurement. 
Separate high and low level switches are also required for 
the alarm and trip systems. Here the Code’s recommenda¬ 
tion is that the switch should be put in an externally 
mounted float chamber, the top connected to the top of the 


storage vessel and the bottom to the filling/discharge line 
between the ball valves and the manifold. 

Debris from instruments should not create a hazard. It 
may be necessary to take precautions to prevent a loose 
float from a level measuring device blocking the branches 
to the relief valves. 

For the measurement of temperature, a long thermo¬ 
couple pocket is recommended. It should be inserted from 
the top and reach the bottom so that the temperature at any 
level can be measured. The bottom of the pocket should be 
guarded or supported in some way to reduce the risk of 
fracture by vibration. 

Specific instrumentation requirements are contained in 
the main LPG codes, particularly in respect of level gaug¬ 
ing. The LPGA LPG Storage Code requires the installation 
of a fixed maximum liquid level device, which should be of 
the type that allows vapour or liquid to be bled from a valve 
attached to a dip-tube to indicate when the maximum per¬ 
mitted level is reached during filling. The connection 
through the vessel should be no larger than 1.4 mm in dia¬ 
meter unless an excess flow valve is fitted. For a vessel of 
more than 5 m 3 capacity the Code also requires the provi¬ 
sion of a pressure gauge connected to the vapour space. It 
requires that the connection be protected either by a tap¬ 
ping reduced internally to ableedhole not larger thanl.4mm 
or by a suitable excess flow valve or shut-off valve. 

The provision of a contents gauge is also advised. The IP 
LPG Storage Code suggests that consideration be given to 
the installation of two independent level gauges in addition 
to the maximum level device. 

Sampling is another aspect which merits careful 
attention, because it tends to be a source of leakage. The ICI 
LPG Code makes the following recommendations on this. 
Sampling should be done from pipelines rather than from 
vessels. If a representative sample is required from a vessel, 
the product should be circulated and a sample taken from the 
circulation line. Samplepointsshouldbecarefullysited with 
respect to HAC, safe disposal of vented samples and access. 

Sample connections should be limited, preferably to 1 in. 
reducing to 1/4 in. There should be double manual isolation 
with a 1 in. ball valve followed by a 1/4 in. valve. The valves 
should be close together but with a minimum separation of 
1 m to avoid simultaneous blockage of both valves by ice or 
hydrate. 

Operations involved in sampling were considered in 
Chapter 20. 

Gas, flame and smoke detectors are another important 
aspect of instrumentation for storage. These have been 
discussed in Chapter 16. 


22.8.11 Pressure relief 

A pressure storage vessel should be protected against 
overpressure by a pressure relief valve. Pressure relief 
valves have been discussed in detail in Chapter 12. Only 
those aspects relevant to storage are considered here. 

Pressure relief valves for LPG pressure storage vessel 
should be designed according to a recognized code such as 
BS 5500:1991 or the ASME Boiler and Pressure Vessel Code, 
Section VIII. In this particular case, other appropriate codes 
are the LPGA LPG Storage Code, API RP 520 and NFPA 58 
and 59. 

Protection is required against overpressure due to 
(1) abnormal operating conditions and (2) fire exposure. It 
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may be provided by a single pressure relief valve or by 
separate relief valves for each category 

Operational relief 

A pressure relief valve for abnormal operating conditions 
should be designed to handle the most severe conditions 
which are likely to arise. Typical abnormal operating con¬ 
ditions include overfilling, high rundown liquid tempera¬ 
ture and high tank temperature due to solar radiation. 

Overpressure due to abnormal operating conditions may 
develop slowly or suddenly. The most common cause of a 
rapid increase in pressure is overfilling. The worst case 
here is obtained by considering the maximum liquid flow 
obtainable through the fully open control valve, and bypass 
if fitted, on the supply line. 

Fire relief 

A pressure relief valve for fire exposure should be designed 
to deal with the vapour generated by this. The vapour gen¬ 
erated may be calculated from the latent heat of the liquid 
and from the heat input. 

There are a number of measures which can, in principle, 
reduce the heat absorbed during a fire and hence the 
quantity of vapour to be handled. The most basic is to slope 
the ground under the vessel so as to ensure that any flam¬ 
mable liquid spill is drained away. Other measures to 
reduce heat absorbed include fireproofing, depressuriza¬ 
tion and water sprays. 

A method of estimating the heat absorbed in a fire is 
given in API RP 520, Appendix D. For a bare surface two 
equations are given: 

Q = 21,000 FA 082 [22.8.1] 

and 

Q = 34,500 FA™ 2 [22.8.2] 

where A is the total wetted surface (ft 2 ), F is an environ¬ 
mental factor and Q is the total heat absorption (BTU/h). 
Equation 22.8.1 is applicable where there is adequate 
drainage and prompt fire fighting, and Equation 22.8.2 
where these conditions are not met. 

In this method, any credits allowed for other measures 
are incorporated in the environmental factor F. The value 
of Fis unity for a bare vessel. No credit is given for depres¬ 
surization or water application facilities, and even with 
these the value of F is still unity. Credit is given, however, 
for fireproof thermal insulation, provided it will resist dis- 
lodgement by fire hose streams. For a vessel furnished 
with fireproof insulation with a thermal conductance of 
4 BTU/frh °F the value of Fis 0.3. Lower values of Fare 
given for insulation with lower thermal conductances. 

The LPGA LPG Storage Code and NFPA 58 and 59 give 
pressure relief valve capacities in tabular form and also 
give an equation for large vessels. The LPGA Code states 
that these capacities cover fire relief. 

The pressure relief valve setting, both for operational 
and for fire relief, is considered in Chapter 12, and valve 
sizing is discussed in Chapter 15. For pressure storage, 
valves should be able to handle flashing, two-phase flow. 

Combined relief 

A single pressure relief valve may be used to provide both 
operational and fire relief. Alternatively separate valves 
may be used for operational and fire relief. 


The arrangements are discussed in the ICI LPG Code. 
The Code states that where there is a single pressure relief 
valve, the relieving capacity should be at least equal to the 
greater of the individual capacities required for operational 
and fire relief, and that where separate operational and fire 
relief valves are provided the combined capacity of the two 
valves may be set against the fire relief requirement. 

Fluid phase 

A discussion of the fluid phase during pressure relief is 
given in API RP 520, although the account is not specifi¬ 
cally concerned with storage. The IP LPG Storage Code 
states that for overfilling the relief discharge would be a 
flashing liquid, whilst for fire relief it treats the discharge 
as a vapour. 

Relief disposal 

A discussion of relief disposal for LFG storage vessels is 
given in the ICI LFG Code. The Code states that it is prefer¬ 
able that relief valves, whether for operational or fire relief, 
should discharge into a closed system. 

An operational relief valve should discharge into a closed 
system which is led to an atmospheric vent or to a flare. The 
closed system should be designed to handle liquid dis¬ 
charge and to take the full flow from the valve. A fire relief 
valve should also discharge to a closed system. If this is not 
practical, it can be discharged vertically upwards to the 
atmosphere via a vent pipe. 

Direct discharge to atmosphere should be done in such a 
way as to ensure that flammable material is diluted below 
its lower flammability limit before it reaches an ignition 
source, and toxic material should be below the appropriate 
exposure or odour limit before it reaches ground level out¬ 
side the plant area. 

These requirements for direct discharge are fairly read¬ 
ily met for vapours lighter than air which can be vented at a 
point above plant structures at low velocities, but for those 
heavier than air it is more difficult. The Code states that for 
vapours heavier than air it is necessary to use a velocity of 
at least 150 m/s (500 ft/s) to ensure jet mixing with air suffi¬ 
cient to give rapid dilution. The problem is discussed by 
Cude, who indicates that current experience is that this cri¬ 
terion can be reliably met only by the use of pilot-operated 
relief valves rather than ordinary relief valves. A fuller 
account of dispersion from relief valves is given in Chapter 15. 

Most LPG pressure storage vessels are fitted with ver¬ 
tical vent pipes so that the relief discharge is directed 
upwards. The LPGA LPG Storage Code states that a vent 
pipe should have its outlet at least 1.8 m above the top of the 
vessel and should be not less than 3 m above ground level. 
HS(G) 34 gives similar requirements, but states that for 
large vessels the pressure relief system may discharge to 
the vent collecting system of a flare. 

22.8.12 Vacuum protection 

In severe cold weather the temperature of the contents of an 
LPG pressure storage vessel may fall below 0°C. For the 
storage of commercial butane in particular, this can cause 
the vapour pressure of the liquid to fall below atmospheric 
and thus create vacuum conditions. 

This problem and the measures that can be taken to 
protect against it are discussed in the LPGA LPG Storage 
Code. The Code states that, in the absence of more specific 
information, a butane vessel should be designed for a 
minimum temperature of -18°C, which is the lowest 
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ambient temperature recorded in the United Kingdom as 
sustained over a period of 12 h. 

One approach is to design for full vacuum. Alternative 
approaches are (1) the prevention of unacceptable vacuum 
conditions, (2) the provision of high and low pressure 
alarms and (3) the use of methods based on product com¬ 
position or vacuum breaking. 

A low pressure alarm serves to give warning of the 
development of vacuum conditions. 

Two methods of preventing an unacceptable vacuum are 
hot gas return and propane vapour pressurization. Hot gas 
return involves feeding hot butane vapour from a local 
vaporization source, and propane vapour pressurization 
involves connecting the vapour space of the butane vessel 
to that of a local propane storage vessel or to propane 
cylinders. Details of the procedures to be used are given in 
the LPGA Code. 

In certain special cases, and by agreement with the sup¬ 
plier, the composition of butane to BS 4250:1987 may be 
controlled so that the vapour pressure at the lowest service 
temperature will be above the minimum design pressure of 
the vessel. It should be confirmed that at this composition 
the vessel can withstand the vapour pressure at the refer¬ 
ence temperature. 

Other methods of limiting vacuum are the use of vacuum 
breakers or the introduction of inert gas. Both methods tend 
to lead to operating problems due to the introduction of air 
or inert gas and the first particularly is a specialist matter. 

22.8.13 Vaporizers 

LPG in vapour form may be obtained from a pressure stor¬ 
age installation using a vaporization facility. Vaporizers for 
LPG are treated in HS(G) 34. 

LPG vaporizers may be heated with low pressure steam 
or hot water or heated electrically or by direct firing. The 
equipment should be located with suitable separation dis¬ 
tances, in a well ventilated location and with the ground 
sloped to drain away any leak to a safe place. 

HS(G) 34 gives the following minimum separation dis¬ 
tances between vaporizers and the nearest important 
buildings or line of adjoining property. For vaporizers of 
capacity up to 36 kg/h, 3 m; of capacity >36 to 227 kg/h, 
7.5 m; and of capacity >227 kg/h, 15 m. Separation dis¬ 
tances between LPG vessels and direct fired or non¬ 
explosion protected electrically heated vaporizers are as 
given in column 3 of Table 22.6, which gives the distances 
for sources of ignition. The separation distance from LPG 
vessels for other types of vaporizer is 1.5 m. 

Other features detailed in HS(G) 34 include the 
arrangements for draining, pressure relief and control of 
liquid level and temperature. 

22.8.14 Fire protection 

Fire prevention and protection of LPG pressure storage is 
dealt with in the main codes mentioned and also specifi¬ 
cally in Recommendations for Prevention or Control of Fire 
Involving LPG (LPGA, 1972 COP 3) (the LPGA Fire Code). 
A further relevant standard is BS 5908: 1990. Other 
accounts include those by Kletz (1977d), Fullam (1987), 
Nazario (1988), Schoen and Droste (1988) and Schoen, 
Probst and Droste (1989). 

The effect of fire on a pressure vessel is broadly similar to 
that on an atmospheric tank. The unwetted parts of the 
vessel become hot and lose strength. As a result the vessel 
may burst, even though it is below its design pressure. 


Overtemperature is just as serious as overpressure. The 
loss of strength is greater with vessels designed to 
advanced pressure vessel codes. 

The other effect of fire is to heat the liquid in the vessel so 
that the pressure rises and causes the pressure relief valve 
to lift. Further heat input causes the liquid to vaporize 
without further rise in pressure, provided the valve has 
enough capacity to vent the vapour. If the valve fails to 
operate or has insufficient capacity, the rise in pressure 
may burst the vessel. 

Failure of a pressure vessel in a fire may therefore be due 
to either overtemperature or overpressure. The failure of 
the vessel at Feyzin, for example, occurred due to over¬ 
temperature, even though the relief valve had lifted. 

A discussion of fire prevention and protection is given in 
the ICI LPG Code. Some of the measures given in the Code 
have already been discussed, such as diversion and fire 
walls (see Section 22.8.5), fire protection of pipework and 
fittings (see Section 22.8.7) and fire and gas detection sys¬ 
tems (see Section 22.8.10). 

The ICI Code specifies measures to minimize spillages. 
The vessels and pipework should be made to give high 
standards of safety in both normal and emergency opera¬ 
tions, by appropriate design calculation methods. The 
number of connections below the top liquid level should be 
kept to a minimum, preferably just one filling/discharge 
line if possible. The minimum size connections should be 
used for draining and sampling. The installations should 
be protected against external damage from such sources as 
vehicles and other plants.There should be good level meas¬ 
urement and other control instrumentation, and attention 
should be paid to the filling arrangements. 

Measures for controlling spillages are also specified. The 
basic principle is that any vapour cloud resulting from a 
spillage should be safely diluted by air below its lower 
explosive limit before it can find a source of ignition. This 
dispersion should preferably be effected by air movement 
but, if necessary, some form of barrier may be required to 
contain and disperse the cloud. 

Thus the installation should be sited with regard to fac¬ 
tors such as ground contours and the prevailing wind. The 
provision of gas detectors should be considered. If neces¬ 
sary, consideration should be given to the provision of bar¬ 
riers or steam curtains to contain, direct or disperse the 
vapour cloud. Attention should be given to possible sources 
of ignition. 

Finally, the Code specifies measures for controlling fire. 
The layout should ensure that liquid spillages are drained 
away from under vessels to a catchment area where they can 
be pumped out or burned. Vessels should be provided with 
water cooling or fireproof insulation and supports should 
be fireproofed. Consideration should be given to the provi¬ 
sion of fire-fighting equipment to control and extinguish 
burning hydrocarbon liquids. 

Figure 22.10 shows a classic diagram by Kletz (1977d) of 
the methods of fire protection for an LPG pressure storage 
vessel. They are (1) sloping of the ground beneath the vessel, 
(2) fire insulation, (3) a remotely operated depressurization 
valve, (4) water sprays and (5) a pressure relief valve. 

Fixed water sprays are effective in giving immediate 
cooling of exposed surfaces and are widely used. On 
both horizontal cylinders and spheres there is a tendency 
for water to come off the vessel at the ‘equator’ and there¬ 
fore sprays are usually provided both above and below 
this line. 
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Figure 22.10 Fire protection arrangements for an 
LPG pressure storage sphere (Kietz, 1977d) (Reproduced 
with permission from Hydrocarbon Processing, August, 
1977) 


The ICI LPG Code gives the following method of calcu¬ 
lating the amount of water required. For a vessel enveloped 
in fire the rate of application of water needed to remove the 
total heat input is 0.2 UKgal/ft z min. But for a vessel 
designed to the Code, a lower rate of application in the range 
0.06-0.2 UKgal/ft z min is acceptable, provided the ground 
beneath the vessel is impervious and sloped away to a 
catchment area and the pipework is carried beyond the 
vertical projection of the vessel with no flanges or other 
fittings beneath the vessel. 

The rate of application of water may be determined by 
heat flux calculations and from the rise in the temperature 
of the water from the mains temperature to a temperature 
close to boiling point at 100°C. 

The Code gives the following method for the calculation 
of the heat flux. It is assumed that the separation distances 
given earlier in Table 22.7 are observed and that the fire is in 
the catchment area as shown in Figure 22.11. Then the heat 
radiated and the intensity of heat radiation from the 
flame burning on the liquid pool are calculated from the 
equations 


Q = 5.1 x WT^LWpC 
2.5 x 10~ 5 LWpC 
(. L+ W)h + LW 


[22.8.3] 

[22.8.4] 


where C is the net calorific value of the liquid in the pool 
(kj/kg), h is the height of the flame ( = 2W) (m), I is the 
intensity of heat radiation from the flame envelope 
(kW/m 2 ), L is the length of the pool (m), Q is the heat emitted 
by fire (kW), JFis the width of pool (m) and p is the density 
of the liquid (kg/m 3 ). 


envelope 

iis™’ 



Figure 22.11 Heat radiation from a fire burning in a 
catchment area to a pressure storage vessel (ICI/RoSPA 
1970 IS/74; reproduced by permission) 


It is assumed that the heat is radiated from a radiating 
area which is a vertical rectangular plane through the cen¬ 
tre line of the flame envelope cube prism parallel to the 
nearest point on the equator of the vessel, as shown in 
Figure 22.11. The heat flux received by this vessel is 
obtained by using the view factor method. 

A fixed water spray system is normally maintained dry 
so that it cannot become frozen. When this system is 
required to operate, water is supplied by a deluge valve. 
This valve may be operated manually or automatically. If 
operation is manual, the valve should be in a place acces¬ 
sible during the fire. The preferred system, however, is 
automatic operation triggered by fire detectors. 

Automatic detectors should be fast acting in order to 
protect the pipework in particular. Manual override con¬ 
trol should be provided on an automatic system to allow 
sprays to be turned on to protect adjacent surfaces, even 
though the automatic controls have not brought them on. 

It is desirable that, if possible, only those fixed sprays 
are activated which contribute to dealing with the fire con¬ 
cerned. Large installations should be subdivided to con¬ 
serve water, which is likely to be needed to fight the fire. 
Again, the main water sprays are normally provided by 
mobile equipment and are used both to fight the fire and to 
cool exposed surfaces. 

Fireproof thermal insulation may be used on pressure 
vessels as an alternative to, or in addition to, fixed water 
sprays. Such insulation reduces the rate of heat input from 
a fire to the vessel and this lag gives time in which fire¬ 
fighting measures such as mobile water sprays may be 
brought into play and the fire extinguished, or in the worst 
case an evacuation organized. 

Fireproofing should be such as to provide protection for 
2 h before the vessel becomes dangerously overheated. This 
insulation should he designed in conjunction with the 
arrangements for fire pressure relief. A fireproof insulation 
suitable for this purpose may be obtained by the use of 
vermiculite cement with a minimum thickness of 2 in. 

Some of the measures described have their difficulties. 
The use of fire insulation is not straightforward. Some of 
the problems are considered by Fullam (1987). The use of 
such insulation inhibits inspection of the vessel. Corrosion 
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and water ingress are liable to occur. There are potential 
problems with the durability of the insulation and its resist¬ 
ance to water jets. He states that these problems are serious 
enough to prevent the general adoption of this measure. 

Likewise, the use of depressurization is controversial, as 
discussed by Nazario (1988). One problem is the time 
required to depressurize. Another is that the depressuriza¬ 
tion lowers the liquid level and increases the area of unwet¬ 
ted metal exposed to the fire. The approach described by 
Nazario is to use fire insulation as the preferred method for 
horizontal storage vessels, but not for spheres. On the other 
hand, water sprays and not insulation are used for spheres. 

Turning to the guidance on fire prevention and protec¬ 
tion in the main LPG codes, and also specifically in the 
LPGA Fire Code, detailed treatments are given in API 
Std 2510, AP RP 520, NFPA 58 and 59, the LPGA LPG Sto¬ 
rage Code, the IP LPG Storage Code and HS(G) 34. 

The LPGA LPG Storage Code gives a summary table of 
fire protection arrangements for storages of different sizes. 
For storages below 25 te it is generally sufficient to provide 
a water supply; for storages greater than 25 te but less than 
50 te, fixed or portable water monitors should be available; 
and for storages greater than 50 te there should be a fixed 
water spray installation. This system should be automatic 
unless the plant is continuously attended. 

With regard to the wetting rate required to effect pro¬ 
tection for an uninsulated vessel, the Code states that a full 
film of water needs to be established over the whole vessel 
surface and supports at a rate of 7 l/m 2 min, and that the 
typical design spray rate required to achieve this is 
9.8 l/m 2 min; the Code refers to the work of Billinge, Moodie 
and Beckett (1986). In some cases, one of these figures is 
quoted without the other; the IP LPG Code refers to the 
lower figure and HS(G) 34 to the higher one. 

There should be adequate drainage to remove the fire 
water, and where necessary water sealed interceptors 
should be provided to prevent LPG entering the storm 
drains. 

The LPGA LPG Storage Code recognizes fire insulation 
as an alternative to water sprays, provided it is capable of 
limiting the vessel temperature below 450°C for a period of 
at least 60 min in full fire engulfment. The Code requires, 
however, that the insulation should: (1) be non-corrosive to 
the vessel surface; (2) be impervious to water vapour, either 
by cellular construction or by provision of an effective 
vapour barrier; (3) be resistant to a hose directed jet; (4) he 
durable and easily repairable, and strong enough that 
minor mechanical damage will not destroy the vapour 
barrier; (5) be unaffected by environmental conditions and 
(6) not itself be a hazard, by spalling, spreading flames or 
emitting toxic fumes. 

The LPGA Fire Code deals particularly with fire fighting 
of LPG fires. 

HS(G) 34 gives guidance similar to that in the LPGA LPG 
Storage Code, again with a summary table of fire protection 


22.8.15 Inspection 

Pressure storage vessels for LPG should be inspected in the 
manner and at the frequency given in the relevant codes, as 
described in Chapter 19. 

22.8.16 Mounded storage 

LPG is also stored in pressure vessels set in earthen 
mounds. Accounts of this method of storage are given in 


HS(G) 34 and by Bonnafous and Divine (1986) and Bellani, 
Cannalire and Beltrame (1992). 

The arrangements for a mounded LPG horizontal 
cylindrical pressure storage vessel given by the HSE in 
HS(G) 34 are shown in Figure 22.12. The external surface of 
the vessel should be given an external coating to prevent 
corrosion. It should be placed on a firm foundation and 
installed so as to prevent movement or flotation. The back¬ 
fill material should be inert and free of material likely to 
damage the external coating. The HSE advise that the 
depth of cover be at least 0.5 m. 

Some of the installations of mounded LPG vessels are 
very large. Bonnafous and Divine describe mounded stor¬ 
ages with horizontal pressure vessels of capacity 3500 m 3 . 
In these systems the vessel is supported on a compacted 
sand bed in a 120° circular cradle. The depth of cover is one 
metre minimum. 

Mounded storage offers enhanced protection against 
external fire, thus avoiding: a boiling liquid expanding 
vapour explosion (BLEVE); external explosion; impact 
from external threats such as vehicles or aircraft; and 
sabotage. 

22.8.17 Hydrogen related cracking 

In certain circumstances LPG pressure storage vessels are 
susceptible to cracking. The problem has been described by 
Cantwell (1989 LPB 89). He gives details of a company 
survey in which 141 vessels were inspected and 43 (30%) 
found to have cracks; for refineries alone the corresponding 
figures were 90 vessels inspected and 33 (37%) found to 
have cracks. 

The cracking has two main causes. In most cases it 
occurs during fabrication and is due to hydrogen picked up 
in the heat affected zone of the weld. The other cause is 
in-service exposure to wet hydrogen sulfide, which results 
in another form of attack by hydrogen, variously described 
as sulpfide^ stress corrosion cracking (SCC) and hydrogen 

LPG pressure storage has been in use for a long time and 
it is pertinent to ask why the problem should be surfacing 
now. The reasons given by Cantwell are three aspects of 
modern practice. One is the use of higher strength steels, 
which are associated with the use of thinner vessels and 
increased problems of fabrication and hydrogen related 
cracking; the use of advanced pressure vessel codes, which 
involve higher design stresses and the greater sensitivity of 
the crack detection techniques available. 

He refers to the accident at Union Oil on 23 July 1984 in 
which 15 people died following the rupture of an absorption 
column due to hydrogen related cracking (Case History 
AID). Cantwell states: ‘The seriousness of the cracking 
problems being experienced in LPG vessels cannot be 
overemphasized’. 

The steels most susceptible to such cracking are those 
with tensile strengths of 88 ksi or more. Steels with tensile 
strengths above 70 ksi but below 88 ksi are also susceptible. 

Cantwell also describes measures for the avoidance of 
the problem. For new vessels he recommends the use of 
lower strength steels which have controlled chemistry and 
welding and post-weld heat treatment and which have 
good toughness both at ambient and low temperatures. For 
existing vessels the recommendations centre on inspection 
techniques and intervals and on repair methods. A meas¬ 
ure applicable to both cases is the elimination of break¬ 
through of wet hydrogen sulpfide into LPG rundown. 
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Figure 22.12 General arrangement of LPG mounded pressure storage vessel (Health and Safety Executive, 1987 
HS(G) 34) (Courtesy of HM Stationery Office © All rights reserved) 


22.8.18 LPG-air plants 

LPG storage may be associated with an LPG-air plant, 
which is an installation for the production of LPG-air 
mixtures. Such plants are covered by the Recommenda¬ 
tions for LPG-Air Plants (LPGA, 1972, COP 9). The main 
elements of such plant are pumps and vaporizers. 


22.9 LPG Storage: Refrigerated Storage 

Codes and standards for LPG deal mainly with pressure 
storage rather than with refrigerated storage, but the guid¬ 
ance in NFPA 59 does cover refrigerated storage. Other 
guidance is available which deals primarily with storage 
tanks for low temperature duty. Further information may 
be sought in codes for refrigerated storage of LNG. 

22.9.1 Storage tanks 

Tanks for the refrigerated storage of LPG and LNG have 
developed from those for atmospheric storage of petroleum 
products. A relevant British Standard is BS 4741: 1971 
Specification for Vertical Cylindrical Welded Steel Storage 
Tanks for Low-temperature Service: Single-wall Tanks for 
Temperatures down to -50°C. 

There is available a variety of tank systems which may be 
used for the storage of LPG or LNG. A more detailed 
account is deferred to Section 22.11 on LNG, and only a brief 
account is given here. 

Tank systems for LPG have been described by Morand, 
Claude and Herbretau (1985). They distinguish the follow¬ 
ing tank systems: (1) single wall tank, (2) double wall tank, 
(3) double integrity tank and (4) membrane tank. 


A single wall tank has a wall made of low temperature 
steel with external insulation covered by a vapour barrier. 
A double wall tank has an inner wall of low temperature 
steel and an outer wall of carbon steel with insulation in 
between. The outer wall is not designed to withstand the 
cold liquid, so that this system still gives only a single 
effective containment. A double integrity tank system has 
an inner tank of low temperature steel with a suspended 
deck and an outer wall either of low temperature steel or 
pre-stressed concrete, but in either design the outer wall 
also is capable of containing the cold liquid. The membrane 
tank consists of a pre-stressed concrete containment with 
an aluminium foil membrane. These four tank systems are 
shown in Figure 22.13. 

Morand, Claude and Herbretau have given a detailed 
account of the GMS 2000 membrane tank system, adapted 
from the GMS membrane tank system developed for 
marine use. In such a membrane system, the functions 
of mechanical strength and leak-tightness are separated 
and are provided by separate features. 

The minimum design temperature for refrigerated stor¬ 
age tanks should take account of the lowest temperature to 
which they may be subjected. The tank may be cooled down 
to the minimum temperature of the refrigeration system if 
there is little movement of the contents, or even lower if 
there is malfunction of the system. 

22.9.2 Separation distances 

Separation distances for refrigerated LPG storage are 
given in the IP LPG Code and NFPA 59, and also in the ICI 
LPG Code. 
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Figure 22.13 LPG refrigerated storage tanks (Morand, Claude and Herbretau, 1985): (a) single wall tank; (b) double wall 
tank; (c) double integrity tank with concrete outer wall; (d) membrane tank (QMS 2000) (Courtesy of Gastech) 
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22.9.3 Secondary containment 

Secondary containment for refrigerated LPG storage tanks 
is treated in the same codes. An LPG storage tank should be 
provided with a full bund. The typical LPG refrigerated 
storage tank is sufficiently large to have its own bund, but 
in any event tanks containing other materials should not be 
located in the same bund as one holding refrigerated LPG. 

If the topography is such, either naturally or by addition 
of diversion walls, that any spill can be contained and 
drained to an impounding basin, this provides an accept¬ 
able alternative to a bund. 

Walls for full bunding should not be so high as to hinder 
fire fighting. The ICI LPG Code suggests a maximum 
height of 2 m (6 ft 6 in.) with an allowance of 0.15 m (6 in.) 
freeboard above the predicted liquid level. This leaves room 
for a foam blanket. There should be a minimum of two 
access points on opposite sides of the bund to allow safe 
access/escape in all wind directions. Access may be pro¬ 
vided by steps over the bund. 

22.9.4 Foundations 

Refrigerated LPG storage tanks require good foundations 
and insulation for the bottom of the tank. The foundations 
need to be protected against ‘frost heave’.The usual method 
of construction is to insulate the bottom of the tank and 
support it on a structure which has only limited contact 
with the ground and gives good air circulation. An account 
of foundation systems used for refrigerated storage tanks 
is given in Section 22.12. 

22.9.5 Insulation 

Refrigerated LPG storage tanks are insulated to reduce 
heat inleak. 

On a single wall tank the insulation over the walls and 
roof is typically polyurethane foam (PUF). The insulation 
between the two walls of a double wall tank is usually 
perlite. The insulation between the walls of a double integ¬ 
rity tank may be PUF or perlite. A load-bearing foam glass 
insulation is used between the bottom of the tanks and the 
foundation. 

Important features of the insulation on a single wall tank 
are the vapour sealing and the fire resistance. Vapour seal¬ 
ing of the insulation is necessary to prevent ingress of 
humid air and the consequent ice formation. The thermal 
insulation may also be given a degree of fire resistance, as 
described below. 

22.9.6 Ancillary facilities 

Ancillary facilities for refrigerated LPG tanks include the 
refrigeration system, the pumping facilities and vaporiza¬ 
tion equipment. 

Reciprocating compressors are used for the direct 
re-liquefaction of vapour boiled off due to heat inleak. Use 
is also made of reciprocating compressors on refrigeration 
sets. Malfunction of a refrigeration set can cause the liquid 
refrigerated to be cooled below its normal temperature. 

Reciprocating compressors can be a source of leakage of 
flammable vapour. They are subject to crankcase explo¬ 
sions and should normally be protected against this by an 
explosion relief valve. 

Pumps should not normally be located inside a bund, 
where they introduce an additional hazard and are them¬ 
selves at risk. It is desirable to locate them outside the bund. 
This also allows them to be used to pump down the storage 
tank during a fire. 


22.9.7 Instrumentation 

A refrigerated LPG storage tank should be provided with 
suitable measurements and alarms on liquid level, pressure 
and temperature and on boil-off gas flow. 

Principal features of the instrumentation are the 
arrangements to prevent overpressure and overfilling. Pres¬ 
sure control is an integral part of the refrigeration system. 

22.9.8 Pressure relief 

The tank also requires pressure relief and vent disposal 
arrangements. There should be arrangements for both 
pressure relief and vacuum relief. Details of pressure relief 
systems are given in NFPA 59. 

22.9.9 Vaporizers 

Refrigerated LPG storage is commonly equipped with a 
vaporization facility to supply LPG in vapour form. An 
accountofvaporizersforLPGhasbeengiveninSection22.8. 

22.9.10 Fire protection 

Fire protection for refrigerated LPG storage tanks has 
much in common with that for other types of storage tanks 
for flammable products. The effect of fire on a refrigerated 
storage tank is basically similar to that on an ordinary 
atmospheric tank, but the heating and vaporization of the 
liquid are much more rapid. 

Guidance on fire protection is given in NFPA 59. This 
refers to the need for HAC, for flammable gas detection and 
to a range of fire control and extinguishing systems such as 
water sprinkler, foam and dry chemical systems. 

Passive fire protection for refrigerated LPG storage 
tanks is discussed in the ICI LPG Code. Tanks are provided 
with conventional thermal insulation, such as cork, poly¬ 
urethane or perlite. Cork is combustible, but only burns 
slowly. In a fire risk area, it is usually vapour sealed with 
fire resistant mastic. Polyurethane is used in a similar way, 
and the ‘high char’ variety gives significant fire protection. 
Perlite is non-combustible, but needs to be contained in a 
steel jacket not easily damaged by fire. The conventional 
insulation, therefore, furnishes appreciable fire protection. 
A further fireproof finish may be added to bring the fire 
resistance up to a minimum of 2 h. 

Such fire resistant thermal insulation provides a basic 
protection, which may be supplemented by fixed and 
mobile water sprays. Insofar as the insulation buys time for 
active fire fighting, automatic initiation of a fixed spray 
system may be less necessary. 

22.9.11 Inspection 

There is relatively little published on the inspection of, and 
inspection intervals for, refrigerated LPG storage tanks. 

22.9.12 Underground storage 

A number of installations have been built in which LNG is 
stored underground in an earth pit, as described in Section 
22.10. The performance of these storages has been unsat¬ 
isfactory and the method has essentially been abandoned. 
LPG may, in principle, be stored in a similar manner, but 
the same difficulties apply. 

22.10 LNG Storage 

22.10.1 Regulatory requirements 

The storage of LNG is governed by the NIHHS Regula¬ 
tions 982 and the CIMAH Regulations 1984. The NIHHS 
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notifiable inventory is 50 te. The CIMAH inventory for 
which demonstration of safe operation may be required 
(Regulation 4) is 50 te and that which attracts a safety case 
(Regulation 7) is 200 te. 

22.10.2 LNG composition 

LNG is not a homogeneous material. There are appreciable 
differences in composition between LNGs from different 
sources. Chatterjee and Geist (1972) give the properties of 
typical LNGs as follows: 


Source Composition 


N 2 C, C 2 C 3 C 4 C 5+ SG a 


US 0.40 95.90 2.70 0.40 0.30 0.30 0.440 0.62 0.00164 

Algeria 1.70 87.00 7.90 2.30 0.80 0.30 0.474 0.59 0.00151 

Libya 0.40 68.60 24.20 9.40 2.00 0.40 0.538 0.50 0.00125 


In the above table, c 4 denotes wC 4 and iC 4 . The coeffi¬ 
cients of expansion of the liquid with respect to con¬ 
centration and temperature, a and yS, respectively, are given 
by a = (l lp)(dp/5x) and yS = (l/p)(5p/<5T), where T is the 
absolute temperature, x is the mole fraction of methane and 
p is the density of the liquid. 

For LNGs having a molecular weight in the range 16—24, 
the specific gravity lies approximately in the range 
0.42-0.54, respectively. 

22.10.3 Storage conditions 

LNG is generally stored fully refrigerated at -161°C and at 
atmospheric pressure. 

22.11 LNG Storage: Refrigerated Storage 

22.11.1 Storage tanks 

As stated earlier, tanks for the refrigerated atmospheric 
storage of LNG have been developed from the conventional 
atmospheric storage tanks. The design of atmospheric 
storage tanks is governed by API Std 620: 1990 Design 
and Construction of Large, Welded, Low-pressure Storage 
Tanks and API Std 650: 1988 Welded Steel Tanks for Oil 
Storage. For refrigerated storage frequent reference is 
made to API Std 620, Appendix Q: Low-pressure Storage 
Tanks for Liquefied Hydrocarbon Gases and Appendix R: 
Low-pressure Storage Tanks for Refrigerated Products. 
A relevant British Standard is BS 5387:1976 Specification 
for Vertical Cylindrical Welded Steel Storage Tanks for Low- 
temperature Service: Double-wall Tanks for Temperatures 
down to -196°C. 

Tank systems for LNG have been described by Aarts 
and Morrison (1981), Nassopoules (1982), Closner and 
Wesson (1983), Collins et al. (1983), Steimer (1983), Gilbert 
etal. (1985), D. A. Jones (1985), Crawford, Durr and Handman 
(1986) and Morrison (1987).The following tank systems may 
be distinguished: (1) single wall tank, (2) double wall tank, 
(3) double integrity tank and (4) membrane tank. 

A single wall tank has a wall made of low temperature 
steel with external insulation covered by a vapour barrier. 
A double wall tank has an inner wall of low temperature 
steel and an outer wall of carbon steel with insulation in 
between. The outer wall is not designed to withstand the 
cold liquid, so that this is still only a single containment 
system. A double integrity tank system has an inner tank 


with a suspended deck and an outer wall. Three permuta¬ 
tions of materials of construction are used. In the first, 
both the inner and outer walls are of low temperature 
steel. In the second, the inner wall is of low temperature 
steel and the outer one is of pre-stressed concrete. In the third, 
both walls are of pre-stressed concrete. In all three of these 
designs the outer wall also is capable of containing the cold 
liquid. The membrane tank consists of a pre-stressed 
concrete containment lined with a stainless steel membrane. 

Details of the internals of an LNG storage tank are shown 
in Figure 22.14. The construction of LNG storage tanks is 
discussed by Steimer (1983). 

22.11.2 Separation distances 

Separation distances for LNG storage are given in 
NFPA59A. 

22.11.3 Secondary containment 

Where the tank itself provides only single containment, 
secondary containment may be provided in the form of a 
bund. The bund height may be low, intermediate or high. 
Since the bund has to contain the full contents of the 
tank; a low bund has to be located at some distance from 
the tank; a high bund can be located close to the tank; and 
the intermediate height bund can be located at an inter¬ 
mediate distance from the tank. Such bunds may be used 
with a single wall tank or a double wall tank. A high con¬ 
crete bund should not be confused with the outer pre¬ 
stressed concrete wall of a double integrity tank. The latter 
is not structurally independent of the tank, whereas the 
former is. A high bund may, however, appear to be part of 
the tank, since it may be very close to it and may have its 
own roof. 

22.11.4 Foundations 

Foundations for LNG tanks are of two main types. One is an 
elevated pilecap foundation, with free air circulation. The 
second is a ringwall foundation with a heating system. An 
account is given by Steimer (1983). 

The monitoring of the settlement of the foundations has 
been described by Morrison (1987). 

22.11.5 Insulation 

A typical insulation for a single wall tank is polyurethane 
with a metal jacket. For double wall tanks, use is made of 
perlite between the two walls. Insulation materials used for 
the suspended deck include perlite, mineral wool and 
fibreglass. 

22.11.6 Ancillary facilities 

Ancillary facilities for refrigerated LNG tanks include the 
refrigeration system and the pumping facilities. Accounts 
are given by Collins et al. (1983), Gilbert et al. (1985), 
Crawford, Durr and Handman (1986) and Morrison (1987). 

An LNG storage is likely to be part of a terminal and 
vapour is generated from a number of sources, as described 
by Collins et al. Apart from those associated with the tank 
itself, these sources include superheated liquid rundown 
from process units, heat inleak into pipework and flash 
vapour formed during the loading of ships. The maximum 
vapour load may well occur during ship loading. Refrig¬ 
eration facilities are provided to deal with these loads, but 
peak vapour flows are sent to the flare. 

Pumping is required both for loading and for circula¬ 
tion, in order to prevent stratification. The tank system 
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described by Morrison has six in-tank loading pumps and 
one circulation pump. 

22.11.7 Instrumentation 

A refrigerated LNG storage tank should be provided with 
suitable measurements of and alarms for the liquid level, 
the pressure and temperature in the tank and the boil-off 
gas flow. 

Principal features of the instrumentation are the 
arrangements to prevent overpressure and overfilling. Pres¬ 
sure control is an integral part of the refrigeration system. 

The monitoring of the movement of the inner tank has 
been described by Steimer (1983). 

NFPA 59A requires that an LNG facility have an emer¬ 
gency shut-down system and gives details of the system to 
be provided. 

22.11.8 Pressure relief 

The tank also requires pressure relief and vent disposal 
arrangements. Accounts are given by Crawford, Durr and 
Handman (1986) and Morrison (1987). 

Pressure rises may occur due to heat inleak into the tank, 
high liquid in-flows, the in-flow of superheated liquid, 
vaporization due to pumped recirculation, a fall in baro¬ 
metric pressure, failure of the pressure control system, heat 
input during a fire, or rollover. Causes of vacuum include 
high liquid withdrawal flows, the in-flow of subcooled 
liquid, and a rise in barometric pressure. 

Pressure relief is provided by pressure relief valves and 
vacuum protection by vacuum breaker valves. In the system 


described by Crawford, Durr and Handman (1986), the 
pressure relief valves vent to atmosphere and the vacuum 
breakers admit air. 

The pressure control system may be arranged so that if 
the vapour flow is too great for the refrigeration system to 
handle, vapour is vented to the flare before opening of the 
pressure relief valves occurs. Operation of the vacuum 
breakers may be forestalled by vacuum control, which 
admits fuel gas. 

22.11.9 Fire protection 

Fire protection of refrigerated LNG storage tanks has much 
in common with that for other types of storage tanks for 
flammable products. Guidance is given in NFPA 59A Fur¬ 
ther accounts are those by Closner and Wesson (1983) and 
Morrison (1987). 

NFPA 59A refers to the need for HAC, for flammable gas 
detection and to a range of fire control and extinguishing 
systems such as water sprinkler, foam and dry chemical 
systems. 

Closner and Wesson describe a number of fire protection 
measures. These are: (1) containment systems which limit 
the size of the pool, and hence of any fire; (2) protective 
coating systems; (3) foam systems and (4) water deluge 
systems. 

The tank system described by Morrison is designed to 
withstand a collapse of the roof and the resultant tank fire. 
In these circumstances, the outer wall would be subject to 
hydrostatic pressure and severe thermal gradients from the 
flame, which is assumed to be tilted. 
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22.11.10 Annular space 

In a double wall tank, some attention needs to be given to 
the annular space between the two tanks, and in particular 
to the entry of LNG into the space. One way in which this 
can occur is by condensation, caused by an increase in 
pressure in the tank. In some cases, the annular space is 
purged with nitrogen. 

Another situation is that which results from a leak of 
LNG from the inner tank. If this is sufficiently large, the 
formation of vapour may generate a pressure sufficient to 
rupture the inner tank. An account of this problem in a 
double wall ammonia tank and its solutions has been given 
by Squire (1991), as described in Section 22.18. 

22.11.11 Inspection 

There is relatively little published on the inspection of, and 
inspection intervals for, refrigerated LNG storage tanks. 
An account of the design of storage tank internals to facili¬ 
tate the decommissioning and recommissioning of the tank 
has been given by Crawford, Durr and Handman (1986), 
who describe these operations in detail. 

22.11.12 Rollover 

Under certain conditions, ‘rollover’ of the liquid in an LNG 
tank can occur, resulting in the rapid evolution of a large 
quantity of vapour with the potential to overpressure 
the tank. 

Stratification can occur in an LNG tank if the density 
of the liquid ‘cargo’ charged to the tank is significantly 
different from that of the ‘heel’ already in the tank. As 
described above, there are in fact appreciable differences in 
density between LNGs from different sources. 

A model of rollover in LNG tanks has been given by 
Germeles (1975b), who develops an earlier model by 
Chatterjee and Geist (1972). The liquid in the tank is 
assumed to be stratified into a number of ‘cells’ with heat 
inleak from the sides and from the bottom of the tank as 
shown in Figure 22.15. The model consists essentially of the 
unsteady-state heat and mass balance equations for these 
cells and of supporting correlations. 

The model draws on previous work by J.S. TUrner (1965) 
on the mass and heat transfer between the interfaces of 
cells in stratified layers of saline solutions of different 
strength. He defines an interface stability parameter R 



where S is the concentration of the solute (mass fraction), T 
is the absolute temperature (K), a is the coefficient of 
expansion with respect to the temperature, T and /? is the 
coefficient of expansion with respect to the concentration. 
The heat and mass transfer coefficients are given as func¬ 
tions /i and f 2 of R. 

Another relation used in the Germeles model is the boil- 
off model by Hashemi and Wesson (1971). The boil-off rate b 
is given by 

b = 0.328 ^ ( T " ~ T s) 4/S [22.11.2] 

where b is the boil-off mass flux, C p is the specific heat of 
the liquid, g is the acceleration due to gravity, H w is the 



Figure 22.15 An LNG storage tank with the liquid 
stratified into n cells (Germeles, 1975b)(Courtesy of the 
Plenum Publishing Corporation) 


latent heat of vaporization of methane, k is the thermal 
conductivity of the liquid, T n is the absolute temperature of 
the top or wth cell, T s is the absolute saturation temperature 
of methane in LNG, p, is the viscosity of the liquid, p is the 
density of the liquid and p Q is the average reference density 
of the liquid. 

In the Germeles model, equilibration of the liquid den¬ 
sities is taken as the necessary and sufficient criterion 
for mixing. In this aspect his model differs from that of 
Chatterjee and Geist, which requires equilibration of both 
temperature and composition. 

Some results from a simulation of the La Spezia roll¬ 
over obtained by Germeles using his model are given in 
Figure 22.16. As Figure 22.16(a) shows, there is at rollover 
equilibration of density, but not necessarily of temperature 
or composition. Figure 22.16(b) shows the rapid increase 
in boil-off. The computed time to rollover is 34 h, which 
compares with a time of 31 h in the actual incident. 

Further theoretical and experimental investigations of 
rollover in LNG tanks have been reported (e.g. Nakano et al., 
1983;Takao and Suzuki, 1983). 

There are a number of measures which can be taken to 
reduce the risk of rollover. Accounts of such measures are 
given by Chatterjee and Geist (1972) and by Drake, Geist 
and Smith (1973). They include: 

(1) limitation of the variation in LNG composition; 

(2) mixing of the tank contents by the use of top and 
bottom filling points; 

(3) mixing of the tank contents by pump recirculation; 

(4) pressure control of the tank; 

(5) monitoring of parameters related to stratification; 

(6) provision of a high capacity vent. 

In some cases it may be possible to limit the variation of LNG 
composition, but in others this is not attractive. Mixing of 
the tank contents may be effected during filling by using top 
or bottom filling to charge a cargo which is more or less 
dense than the heel. Mixing during filling may be enhanced 
by jet mixing devices. Mixing during and after filling by 
recirculation pumps may also be used, although this is a 
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Figure 22.16 Simulation of the rollover of LNG in the tank in the La Spezia incident (Germeles, 1975b): (a) density, 
temperature and impurity concentration S; (b) boil-off flux (Courtesy of the Plenum Publishing Corporation) 


slow method and it may take too long; it also increases the 
heat inleak. Control of pressure in the tank may be used to 
give controlled evolution of vapour from the liquid. There are 
several parameters which may be used to monitor stratifi¬ 
cation. One is the liquid temperature profile in the tank. 
Another is the difference in density between the feed and the 
tank liquids, a third is the vaporization rate in the tank. 
Protection of the tank if rollover occurs despite these other 
measures requires the provision of a high capacity vent. The 
peak vapour evolution rate resulting from a rollover is diffi¬ 
cult to estimate and the vent needs to be generously sized. 


The rollover hazard receives mention in a number of 
accounts of LNG tank systems, including those by Collins 
et al. (1983), Crawford, Durr and Handman (1986) and 
LeChat and Caudron (1987). 


22.11.13 Particular installations 

There are a number of accounts of particular refrigerated 
atmospheric storage installations for LNG. 

The Montoir de Bretagne LNG terminal is described by 
Lechat and Caudron (1987). They discuss the potential for 
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rollover due to differences in the composition of the LNG 
cargoes received, and the precautions taken. 

An account of the LPG and LNG terminal at Das Island is 
given by Morrison (1987). He describes in detail the tanks, 
foundations, ancillary equipment, pressure relief and fire 
protection. 

22.11.14 Storage vessels 

Although an atmospheric storage tank is the norm for 
refrigerated land-based LNG storage, a pressure vessel may 
also be used, as described by Itoyama et al. (1989). The 
vessel is essentially an adaptation of the MRV storage 
sphere used on LNG carriers. It has an inner shell of alu¬ 
minium, to ensure strength at a cryogenic condition, and an 
outer shell of mild steel. 

22.11.15 Underground storage 

A number of early LNG storages took the form of an earth 
pit. The ground around the pit was frozen by the cold 
liquid, thus providing a seal. One such installation was 
the 21,000 te LNG storage at the British Gas terminal at 
Canvey. 

Experience with such earth pit storages, described by 
Ferguson (1975), was not good. Problems were experienced 
in making the containment leak-tight and waterproof and 
with Assuring of the ground. The heat inleak resulted in a 
boil-off rate which was uneconomic. Thus, whereas the 
boil-off for a good above-ground tank is of the order of 
0.04% per day by volume, that for an earth pit storage is 
some 0.1-0.3%. 

The abandonment of earth pit storage at Canvey meant 
that of some dozen such storages, by 1975 only one 
remained in use. However, the concept of underground 
storage remains alive. Conceptual designs for cavity stor¬ 
age of LPG and LNG have been described by Lagron, 
Boulanger and Luyten (1986). 

22.11.16 Mounded storage 

More success has been achieved with mounded storage in 
which the LNG pressure vessel is set in an earth mound. 
This method has already been described in relation to LPG 
storage. 

The method has been used in Japan, as described by 
Collins et al. (1983). In some cases use has been made of a 
concrete tank with its roof at grade, whilst in others the 
tank has been constructed at ground level and surrounded 
by a full earth berm. 

22.12 Hydrogen Storage 

Hydrogen is stored both as a gas and as a liquid. Relevant 
codes are NFPA 50A: 1989 Gaseous Hydrogen Systems at 
Consumer Sites and NFPA 50B: 1989 Liquefied Hydrogen 
Systems at Consumer Sites. Also relevant are The Safe 
Storage of Gaseous Hydrogen in Seamless Cylinders and 
Containers (BCGA, 1986 CP 8) and Hydrogen (CGA, 1974 
G-5). Accounts are also given by Scharle (1965) and Angus 
(1984). 

The principal type of storage for gaseous hydrogen is 
some form of pressure container, which includes cylinders. 
Hydrogen is also stored in small gasholders, but large 
ones are not favoured for safety reasons. Another form 
of storage is in salt caverns, where storage is effected by 
brine displacement. One such storage holds 500 te of 
hydrogen. 


A typical industrial cylinder has a volume of 49 1 and 
contains some 0.65 kg of hydrogen at 164 bar pressure. 
The energy of compression which would be released by a 
catastrophic rupture is of the order of 4 MJ. There is a 
tendency to prohibit the use of such cylinders indoors. 

Liquid hydrogen is stored in pressure containers. Dewar 
vessel storage is well developed with vessels exceeding 
12 m diameter. 

NFPA 50A requires that gaseous hydrogen be stored in 
pressure containers. The storage should be above ground. 
The storage options, in order of preference, are in the open, 
in a separate building, in a building with a special room and 
in a building without such a room. The code gives the 
maximum quantities which should be stored in each type of 
location and the minimum separation distances for storage 
in the open. 

For liquid hydrogen NFPA 50B requires that storage be 
in pressure containers. The order of the storage options is 
the same as for gaseous hydrogen. The code gives the 
maximum quantities which should be stored in each type of 
location and the minimum separation distances for storage 
in the open. 

Where there are flammable liquids in the vicinity of the 
hydrogen storage, whether gas or liquid, there should be 
arrangements to prevent a flammable liquid spillage from 
running into the area under the hydrogen storage. Gaseous 
hydrogen storage should be located on ground higher than 
the flammable storage or protected by diversion walls. 

In designing a diversion wall, the danger should be borne 
in mind that too high a barrier may create a confined space 
in which a hydrogen leak could accumulate. Scharle (1965) 
draws attention to the risk of detonation of hydrogen when 
confined and describes an installation in which existing 
protective walls were actually removed for this reason. 

Pressure relief should be designed so that the discharge 
does not impinge on equipment. Relief for gaseous hydro¬ 
gen should be arranged to discharge upwards and unob¬ 
structed to the open air. 

Hydrogen flames are practically invisible and may be 
detected only by the heat radiated. This constitutes an 
additional and unusual hazard to personnel which needs to 
be borne in mind in designing an installation. 

22.13 Toxics Storage 

The topic of storage has tended to be dominated by flam- 
mables. It would be an exaggeration to say that the storage 
of toxics has been neglected, since there has for a long time 
been a good deal of information available on storage of 
ammonia, chlorine and other toxic materials. Nevertheless, 
the disaster at Bhopal has raised the profile of the storage 
of toxics, especially in respect of highly toxic substances. 

In the United States, in particular, there is a growing 
volume of legislation, as described in Chapter 3, for the 
control of toxic substances. Attention centres particularly 
on high toxic hazard materials (HTHMs). 

Some of the factors which need to be taken into account 
in relation to storage of HTHMs are now considered. 

22.13.1 Inherent toxic hazard 

The starting point is the characterization of the toxic 
hazard. The toxicity of the substance is one aspect of this. 
Another is the inventory. But the potential for harm also 
depends very much on features of the substance and its 
storage which determine its emission and dispersion. 
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There are a variety of toxic exposure limits which have 
been devised for different purposes such as the threshold 
limit value (TLV) and the emergency exposure limit (EEL), 
but these tend to be of limited use in assessing the toxic 
hazard. Various attempts have been made to devise more 
appropriate indices such as the Dow Chemical Expo¬ 
sure Index (CEP). These exposure limits and indices are 
described in Chapter 18. 

The most realistic approach to the characterization of the 
inherent toxic hazard, however, would appear to be some 
form of hazard assessment, which need not necessarily 
amount to a full risk assessment, but may be limited to 
consequence assessment. 

22.13.2 Inherently safer design 

As for other process activities, so for HTHM storage the 
principle of inherently safer design should be applied. In 
the case of HTHM storage this means in particular exam¬ 
ining the products made and the whole series of processes 
used to make them, whether at the assessor’s site or else¬ 
where, with a view to the use of more benign chemicals and 
to the reduction of toxics inventories throughout the pro¬ 
duction and transport chains. In particular, it should be an 
aim to eliminate intermediate storage. Illustrations of the 
application of inherently safer design with regard to toxics, 
including toxics storage, are given in Chapter 11. 

Another aspect of inherently safer design in storage is the 
storage conditions. The choice between pressure and refrig¬ 
erated storage is the obvious example. But storage can be 
made inherently safer in other ways also, such as choosing 
the storage temperature such that it reduces the load on the 
disposal systemshoulditbecomenecessarytodepressurize. 

22.13.3 Storage siting and layout 

Storage for HTHMs should be sited so as to minimize the 
frequency and the consequences of any release. The con¬ 
sequences of a release may be reduced by the provision of 
separation distances between the storage and potential 
targets, exploitation of the terrain and provision of escape 
routes. Measures to reduce frequency include segregation 
from flammables, minimization of interactions with trans¬ 
port terminals and minimization of domino effects. 

22.13.4 High integrity design 

Plant used for the storage of HTHMs should be high 
integrity plant. The high integrity design features should 
cover, among other things, (1) plant layout, (2) vessels and 
tanks, (3) pipework, (4) loading and unloading facilities, 
(5) secondary containment, (6) instrumentation, (7) pressure 
relief and disposal systems and (8) contaminant control. 

For the most part, the codes and standards which govern 
plant design are oriented to flammables rather than toxics. 
There is relatively little guidance on toxics specifically. 

The American Society of Mechanical Engineers (ASME) 
Boiler and Pressure Vessel Code does, however, recognize a 
category of ‘lethal service’, where the gases or liquids con¬ 
tained are of lethal toxicity. The ASME main piping code 
B31.3 has a Category M which is of similar purport. 

The plant layout for HTHMs should include arrange¬ 
ments for the containment of liquid spillages by the use of 
bunds or other measures. 

Pressure vessels and atmospheric tanks for HTHM stor¬ 
age should be built to high integrity standards. It is not 
usual to use double integrity tanks for HTHMs, though 
they are used for ammonia. But other measures to enhance 


integrity such as full radiography of welds, stress relieving 
and so on, should be used. Foundations and supports 
should also be of high integrity. 

Likewise, pipework and fittings and equipment such as 
pumps should be to high integrity standards. Special 
attention should be paid to potential weak points such as 
nozzles, welds, flanges, gaskets and pipe supports. Events 
which might cause failure of pipework or equipment, such 
as hammerblow or vibration in the pipe or deadheading or 
cavitation in pumps, should be given extra consideration. 

There are two quite separate aspects to pipework integ¬ 
rity. The measures just described are aimed at the preven¬ 
tion of serious failures. It is also necessary to aim for a 
high degree of leak-tightness in order to prevent fugitive 

The disposition of the pipework into and out of the stor¬ 
age is another relevant feature. Lines connected below the 
liquid surface are a major source of large leaks and are to be 
avoided. 

Provision needs to be made to shut-off or reduce leaks 
which may occur in the form of excess flow valves, remotely 
operated isolation valves, and so on. 

Extra consideration should be given to external threats 
to the containment, whether due to impacts such as drop¬ 
ped loads or vehicles or to natural events. 

Associated with storage are loading and unloading 
facilities which are another potential source of release. 
Features of such facilities which are not present in storage 
itself and which tend to increase the risk include: (1) a 
higher level of activity; (2) the involvement of personnel 
from different companies; (3) connections which are con¬ 
stantly made and unmade and which may be relatively 
fragile; (4) the movement of vehicles, including moving 
off whilst still connected and (5) the absence of secondary 
containment. The design should aim to minimize these 
problems. 

The provision of secondary containment should be con¬ 
sidered. Types of secondary containment include double 
integrity containments, double-walled pipes, dump tanks, 
bunds, drainage and sump systems and enclosures. 

Some part of the instrument and control systems for 
HTHM storage may need to be high integrity. At the very 
least good practice should be followed in matters such as 
the use in critical applications of a sensor separate from 
that of the control loop for an alarm or a trip. It may be 
necessary in some cases to consider high reliability 
instrument systems based on the use of redundancy. 

Systems for pressure relief on HTHM storage should 
receive extra attention. The relief and disposal system 
appropriate depends on the nature and quantity of fluid to 
be handled. Whatever system is selected, it too should be of 
high integrity. 

A storage can be put at risk by the entry of a contaminant 
which either itself reacts with the material stored or cata¬ 
lyzes a reaction. For some chemicals it is necessary to 
include in the design features that prevent such con¬ 
tamination. 

22.13.5 High integrity operation 

Highintegrityinthedesignneedstobecomplementedbyhigh 
integrity in the operation of the plant. It is not appropriate to 
rehearse here the various features of good practice in opera¬ 
tion and maintenance, but a few salient points can be made. 

Storage is not simply a passive adjunct to the main 
process plant. It too is actively operated by filling and 
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emptying. These operations have the potential to cause 
destructive overpressure or underpressure and to cause 
overfilling, and they need to be carefully controlled. 

The storage should be operated so as to exclude con¬ 
taminants which might cause reaction of the material held. 
Likewise, operations should not result in serious depletion 
of any necessary stabilizer. 

Where the HTHM is flammable as well as toxic, meas¬ 
ures should be taken to control ignition sources, including 
procedures to prevent ignition by static electricity. 

Activities in the vicinity of storage, such as lifting of 
loads or movement of vehicles, should be controlled so that 
they do not pose an impact threat. 

Storage systems tend to have a quite large proportion of 
items for use only in an emergency and which tend to be 
neglected and are often found to be either in poor condition 
or in the wrong state. Examples are blocked pipes or closed 
valves on water spray systems or open valves on water 
drainage lines through bunds. 

With regard to maintenance, some aspects of particular 
importance in HTHM storage include (1) the identification 
and ranking of critical features, (2) inspection to detect 
unrevealed failures, (3) preventive maintenance, (4) isola¬ 
tion procedures and (5) documentation. 

The operating discipline should ensure that all 
protective features are maintained in operational condi¬ 
tion, whether these be heating or cooling systems, instru¬ 
mented protective systems, relief systems or fire protection 
systems. 

22.14 High Toxic Hazard Materials: CCPS Guidelines 

The Center for Chemical Process Safety (CCPS) has pub¬ 
lished guidance on the storage of HTHMs, and this is now 
described. 


22.14.1 CCPS Guidelines for Safe Storage and 
Handling of High Toxic Hazard Materials 
The CCPS Guidelines for Safe Storage and Handling of High 
Toxic Hazard Materials (1988/3) (the CCPS HTHM Storage 
Guidelines) cover a wide range of topics on HTHM storage. 
Many of these topics are dealt with in other parts of the 
present text. Table 22.10 gives an indication of the chapters 
or sections in which these topics are treated. 


Table 22.10 Some principal topics in the CCPS High 
Toxic Hazard Material Storage Guidelines and their 
treatment in this text 


Chapter No. 

1 . 

Overview 


2. 

Risk assessment 

9 

3. 

Plant design 



3.1 Inherently safer design 

11 


3.2 Plant siting 

10 


3.3 Plant layout 

10 

4. 

Design of storage and piping 

12, 22 

5. 

Loading and unloading facilities 

22,25 

6. 

Instrumentation and control 

13 

7. 

Isolation and containment 

12,22 

8. 

Inspection and maintenance 

19,21 

9. 

Operating procedures and training 

14,20,28 

10. 

Emergency planning 

24 


22.15 Chlorine Storage 

Storage of chlorine as a liquid is mainly either at chemical 
works or at installations where it is required for water 
treatment such as waterworks, power stations and swim¬ 
ming baths. Its boiling point is -34°C. 

Guidance on the handling and storage of chlorine is 
given in HS(G) 28 Safely Advice for Bulk Chlorine Installa¬ 
tions (HSE, 1986). This guidance is based on the earlier 
Guidelines for Bulk Handling of Chlorine at Consumer 
Installations (CIA, 1980/14) (the CIA Chlorine Storage 
Guide), which itself followed Code of Practice for Chemicals 
with Major Hazards: Chlorine (BCISC, 1975/1) (the CIA 
Chlorine Code). HS(G) 28 is the guidance now listed by the 
Chemical Industries Association (CIA). 

Further guidance is given in the various publications of 
the Chlorine Institute, including Chlorine Manual (1986, 
Pmphlt 1), Non-refrigerated Liquid Chlorine Storage (1982, 
Pmphlt 5), Refrigerated Liquid Chlorine Storage (1984, 
Pmphlt 78), Piping Systemsfor Dry Chlorine (1985, Pmphlt 6), 
Operation of ChlorineVaporizingEquipment (1979, Pmphlt 9) 
and Chlorine Tank Car Loading, Unloading, Air Padding, 
HydrostaticTesting (1979 Pmphlt 66). 

The account given here is confined to chlorine storage. 
Chlorine itself is discussed in Chapter 11, pipework for 
chlorine systems is discussed in Chapter 12 and chlorine 
unloading facilities are described in Section 22.26. 

22.15.1 Regulatory requirements 

The storage of chlorine is governed by the NIHHS Regula¬ 
tions 1982 and the CIMAH Regulations 1984. The NIHHS 
notifiable inventory is 10 te. The CIMAH inventory for 
which demonstration of safe operation may be required 
(Regulation 4) is 10 te and that which attracts a safety case 
(Regulation 7) is 75 te. 

22.15.2 Storage conditions 

Chlorine is generally stored under pressure at atmospheric 
temperature, but may also be stored fully refrigerated at 
—34°C and atmospheric pressure. 

22.15.3 Storage systems 

Chlorine should be stored in bulk only if it is used in 
quantities which make the use of drums impractical. A 
chlorine storage vessel should have a capacity appreciably 
greater than a full load from a road tanker or rail tank car. 
It is preferable to keep the number of vessels to a minimum 
in order to avoid complexity and proliferation of potential 
leak sources, but flexibility and continuity of supply 
require at least two vessels. 

The Chlorine Code gives a well defined philosophy for 
the storage of chlorine. In view of the importance of the 
hazard of toxic release from storage, the Code’s statement of 
the problem is of interest: 

Liquid stored in bulk is the potential source of the most 
serious incidents. 

Stored liquid could be released: 

(1) By failure of the vessel holding it. 

(2) By failure of pipework or equipment connected to 
that vessel. 

Stocks necessarily carried to conduct normal operation in 
the businesses are such that the techniques of design and 
operation of any storage must eliminate the risk of com¬ 
plete vessel failure leading to release of its contents. 
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(1) Liquefied gas storage canbe designed, fabricated, 
inspected and maintained so that there is no pos¬ 
sibility of a tank releasing its contents while it is 
kept within design conditions. 

(2) Protective systems of quantified high reliability 
and availability can be designed to ensure that 
these physical conditions are maintained. 

(3) Impurities can be controlled to obviate abnormal 
corrosion. 

(4) These measures may be backed up by relief sys¬ 
tems such that the combination of vessel design, 
protection, quality control and relief eliminates 
the possibility of complete vessel failure. 

(5) Liquefied gas storages can be sited, or given pro¬ 
tective barriers, such that they are fully protected 
from external damage other than civil commo¬ 
tion, sabotage, act of war or falling aircraft. 

From these first premises it follows that, although the 
risk of some damage to a storage vessel cannot be totally 
eliminated, the main dangers derive from failure of 
pipework or equipment whether on producing or using 
plants or connected to storage. 

The critical factors in preventing escapes are: 

(1) Arrangements for isolation of stocks from all 
other equipment. 

(2) Arrangements for isolation of process vessels 
from all other equipment. 

(3) Protection from external damage. 

(4) Means of maintaining design conditions and 
relieving abnormal conditions. 

(5) Means for disposal of purged or vented material. 

(6) The effect of chemicals and conditions in using 
processes on the design and operating require¬ 
ments. 

(7) Means for the retention of spillages near the point 
of origin and for their treatment. The capacity of 
the retention area shall be sufficient for, but need 
not be more than, the largest spillage which can 
reasonably be envisaged. The walls of the reten¬ 
tion area shall, however, be sufficiently high to 
contain also any material used in treating the 
spillage. 

22.15.4 Materials of construction 

Materials of construction for chlorine handling are dis¬ 
cussed in Chapters 11 and 12, and are therefore not dealt 
with in detail here, but there are a few matters which merit 
mention at this point. The normal material of construction 
for chlorine storage vessels is mild steel. Mild steel is 
satisfactory for the handling of dry gaseous or liquid 
chlorine, but not of wet chlorine. There are, however, upper 
and lower temperature limits for mild steel in chlorine 
which should not be exceeded. 

22.15.5 Storage vessels 

Chlorine pressure storage vessels are usually horizontal 
cylindrical vessels for the smaller capacities and spherical 
vessels for the larger ones. Pressure storage spheres up to 
400 te capacity have been used for chlorine, but some large 
vessels have been taken out of use, thus reducing the 
hazardous inventory. 

A chlorine pressure storage vessel should be designed to 
BS 5500:1991 Category 1 or equivalent, but with the addi¬ 
tional requirements of HS(G) 28. 


HS(G) 28 states that a chlorine storage vessel should have 
a minimum design pressure of 12 barg (174 psig). The 
minimum design temperature should be —35°C, the tem¬ 
perature to which liquid chlorine will drop if completely 
depressurized. The normal design range for temperature is 
-35°Cto45°C. 

With regard to the filling ratio, there is no standard 
equivalent to BS 5355: 1976 for transportable liquid con¬ 
tainers. HS(G) 28 states that for chlorine the figure nor¬ 
mally used is 1.25 kg of liquid chlorine/litre of capacity, 
which ensures that even at 50°C the volumetric fill does not 
exceed 95%. 

The connections on a chlorine storage vessel should be 
held to a minimum and kept simple. Connections required 
are (1) a liquid chlorine inlet, (2) a liquid chlorine outlet, 
(3) vent and padding air lines, (4) a relief system and 
(5) instrument connections. Lines entering below the liquid 
level are to be avoided so that any release is of gas rather 
than of liquid. The preferred arrangement is that all the 
connections should be through a manhole located on the top 
of the vessel. Detailed design of these lines is described 
HS(G) 28. 

The vent and padding air lines may have separate con¬ 
nections or may be through a single combined connection. 
The vent should go to the gas absorption system. 

The arrangements given in HS(G) 28 for a chlorine 
storage vessel and the associated unloading facilities are 
shown in Figure 22.17. 

Chlorine storage vessels should be located above ground 
and provided with abund.The bund should be able to take the 
contents of the largest storage vessel with adequate free- 
board.The ground under a storage vessel should be sloped to 
allow drainage into a sump. Provision should be made to 
remove rainwater over the bund wall rather than through it. 

22.15.6 Ancillary facilities 

Ancillary facilities required for chlorine storage include: 
an expansion vessel to take any chlorine vented in the event 
of overfilling; a gas absorption unit for the disposal of the 
vented material; equipment for the transfer of liquid 
chlorine from storage to consumer plants; and vaporization 
equipment to provide chlorine gas to consumer plants. 
These facilities are described below. 

22.15.7 Instrumentation 

A chlorine storage vessel should be provided with suitable 
measurements and alarms on liquid contents, pressure 
and temperature. The measurement of the liquid contents 
should preferably be by means of load cells or a weigh¬ 
bridge. 

Protection against overfilling should receive particular 
attention. As already stated, the vessel itself should be 
larger than the road tankers and rail tank car containers 
which deliver to it. There should be a high contents alarm, 
and possibly an extra-high contents alarm. A low contents 
alarm may also be appropriate. An ullage pipe may be pro¬ 
vided on the vent line with a low temperature or other alarm 
to warn of entry of liquid chlorine into the line. 

The storage should be provided with a chlorine gas 
detector system. 

22.15.8 Pressure relief 

For a chlorine storage vessel, pressure relief should be 
provided as an ultimate safeguard. HS(G) 28 requires that 
the pressure relief arrangements be a double stream system 




Figure 22.17 General arrangement for a chlorine pressure storage installation and road loading facility (Health and Safety Executive, 1986 HS(G) 28). 
The original diagram contains cross-references to certain paragraphs in HS(G) 28. (Courtesy of HM Stationery Office © All rights reserved) 
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with isolation valves on the upstream and downstream 
sides of each stream, so that one stream can be operational 
whilst the other is under maintenance. There should be a 
safeguard against the risk of the simultaneous isolation 
of both streams, either by means of a mechanical interlock 
on the isolation valves or of a procedure for locking the valve. 

For each relief stream, the relief devices should be either 
two bursting discs arranged back to back or a bursting disc 
followed by a pressure relief valve. Either way, there should 
be a pressure gauge on the space between the two devices. 
A pressure relief valve alone should not be used, owing to 
the risk of corrosion. 

A single stream system with locked open isolation valves 
is in common use, but the arrangements described are the 
preferred ones. 

An expansion vessel should be provided to receive the 
relief. It should be designed to the same standard as the 
storage vessels and should have a capacity about 10% of 
that of the largest vessel. It should be capable of being 
vented manually to the disposal system and should have its 
own high pressure alarm. 

22.15.9 Absorption system 

There should be suitable arrangements for the absorption 
of any chlorine vented. In some systems it is possible to 
arrange for the chlorine to be absorbed on a user plant, but 
normally a dedicated gas absorption system is required. As 
shown in Figure 22.17, the gas absorption system receives 
chlorine gas from normal venting and, via the expansion 
vessel, gas from the relief system. 

The gas absorption system should be instrumented to 
ensure that the circulation of liquid and the concentration 
of absorbent are correct and to measure the concentration 
of chlorine in the outlet gas stream. 

22.15.10 Transfer arrangements 

The transfer of liquid chlorine from a storage vessel to 
consumer plants may be effected by vapour pressure alone, 
by padding gas pressure or by pumping. The first two 
methods are the most common. 

The padding gas may be nitrogen or compressed dry air. 
Nitrogen for padding may be obtained from a liquid nitro¬ 
gen vaporization unit. Compressed air should be dry to a 
dewpoint below -40°C and should be oil free. The padding 
gas should be held in a receiver with an operating pressure 
and with protective devices and instrumentation such that 
the storage cannot be over-pressured by the padding gas. 
Detailed arrangements are described in HS(G) 28. 

For pumping, which may be utilized where a higher 
pressure is required or where the padding gas cannot be 
tolerated, use is made both of submerged pumps installed 
inside the tank and of external pumps. For the latter a spe¬ 
cial pumping system has been developed in which the 
liquid chlorine is first transferred from the storage vessel 
to a separate pumping vessel and then fed to the pumps. 

22.15.11 Vaporizers 

Where chlorine is required in vapour form, a limited supply 
may be obtained from cylinders or drums, but the supply of 
any appreciable quantity requires vaporization facilities. 
It is not good practice to draw the gas from the vapour 
space of a chlorine storage vessel, as this creates the risks 
that process liquid may be drawn into the vessel and that 
less volatile impurities such as nitrogen trichloride may 
become concentrated. 


HSE guidance on chlorine vaporizers is given in CS 16 
Chlorine Vaporizers (1985) and HS(G) 28. 

Three heating media are in use in chlorine vaporizers: 
hot water, steam and heat transfer fluids. The most common 
method is the use of hot water at about 60-70°C. Where 
steam is used it should be saturated and pressure limited to 
prevent overheating. 

Four main types of vaporizer are used, as shown in 
Figure 22.18. Type 1 has some form of vertical tube bundle, 
Type 2 is a coiled tube immersed in a heating bath, Type 3 
is a concentric tube, or jacketed pipe, unit and Type 4 is a 
kettle, reboiler unit. HS(G) 28 discusses the characteristics 
of the different designs. 

There are a number of potential problems and hazards 
associated with vaporizers. One is overpressurization. 
Avaporizer commonly operates at 70°C, at which tempera¬ 
ture the vapour pressure of chlorine is some 21 bar. This 
pressure can be realized in the vaporizer if it is isolated 
whilst containing the hot liquid. It is not usual in the United 
Kingdom to fit a pressure relief valve to a vaporizer. 

Overheating can result in more rapid corrosion and, 
in the extreme, the combustion reaction between steel 
and chlorine. A temperature limit of 120°C is normally 
observed. The pressure of steam used for heating is limited 
to 1 barg (15 psig), corresponding to a temperature of 120°C, 
with the steam saturated rather than superheated. 

If the flow to the vaporizer is excessive, the heating is 
insufficient or the heat transfer surfaces are fouled, the 
chlorine vapour may lose superheat, liquid droplets may be 
entrained or the vaporizer may flood. It is even possible 
that ice may form on the heating surfaces. An indication 
of these problems may be obtained from the gas flow and 
temperature from the vaporizer. HS(G) 28 gives details 
of the controls required. A knockout pot may also be 
installed to remove liquid droplets. 

If the chlorine becomes contaminated by water, whether 
by a pinhole leak of water or steam heating medium, or 
otherwise, rapid corrosion of mild steel can result. If 
vaporization of chlorine is partial rather than total, a con¬ 
centration of impurities, notably nitrogen trichloride, can 
occur with the attendant risk of explosion. 

Concentration of less volatile impurities such as nitrogen 
trichloride must be avoided. In some cases, the vaporizer 
itself is designed to ensure that the nitrogen trichloride is 
vaporized together with the chlorine. Otherwise a separate 
purge and vaporizer circuit may be required to deal with the 
impurity residues. 

Reverse flow of a process fluid into the vaporizer may 
occur if the pressure at the vaporizer falls or the process 
pressure rises or if the chlorine vapour condenses, creating 
a vacuum and causing suck-back. 

Precautions need to be taken against these various 
hazards. Detailed measures are described in HS(G) 28. 


22.15.12 Inspection 

HS(G) 28 requires that an initial inspection be made when 
the vessel is brought into service and that there should be 
a first thorough in-service inspection within 5 years of 
commissioning. Thereafter the inspection interval should 
be determined by the inspecting authority, but should 
normally not exceed 5 years. 

The guide gives details of the procedures to be followed 
in decommissioning and recommissioning the vessel and of 
the features to be inspected and the methods of inspection. 
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22.15.13 Storage operation 

The principles governing the operation of chlorine storage 
are outlined in HS(G) 28. 

22.15.14 Emergency arrangements 

Emergency planning for chlorine storage is dealt with in 
HS(G) 28. 


22.16 Ammonia Storage 

Anhydrous ammonia is stored as a liquid, mainly either in 
chemical works or, particularly in the United States, in 
storage terminals supplying agricultural users. Its boiling 
point is -33°C. 



Figure 22. 18 continued 
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Type 3 

Figure 22.18 Some types of chlorine vaporizer (Health and Safety Executive, 1986 HS(G) 28): (la) shell and tube; 

(1b) steam bayonet; (1c) hot water bath; (2) coil tube immersed in heating bath; (3) concentric tube unit and (4) kettle type 
evaporator (Courtesy of HM Stationery Office © All rights reserved) 


The handling of ammonia, including its storage, has 
been a major preoccupation of the industry and this is 
reflected in the Chemical Engineering Progress Series Safety 
in Air and Ammonia Plants (American Institute of Chemi¬ 
cal Engineers (AIChE) 1960-69/17-26) and Ammonia 
Plant Safety (and Related Facilities) (AIChE 1970-1994/ 
31—52). The work of the industry storage committee has 
been described by Ball (1968b). 

Guidance on ammonia storage is given in HS(G) 30 
Storage of Anhydrous Ammonia under Pressure in the United 
Kingdom (HSE, 1986). Two CIA codes, Code of Practice for 
the Storage of Anhydrous Ammonia under Pressure in the 
United Kingdom (1975/13) (the CIA Pressure Storage Code) 
and Code of Practice for the Large Scale Storage of Fully 
Refrigerated Anhydrous Ammonia in the United Kingdom 
(1975/8) (theCIA Refrigerated Ammonia Storage Code), are no 
longer listed. A relevant US code is ANSI K61.1:1989 Safety 
Requirements for the Storage and Handling of Anhydrous 
Ammonia. 

The account given here is confined to ammonia storage. 
Ammonia itself is discussed in Chapter 11, pipework for 
ammonia systems in Chapter 12 and ammonia loading and 
unloading facilities in Section 22.26. 

22.16.1 Regulatory requirements 

The storage of anhydrous ammonia is governed by the 
NIHHS Regulations 1982 and the CIMAH Regulations 
1984. The NIHHS notifiable inventory is 100 te.The CIMAH 


inventory for which demonstration of safe operation may 
be required (Regulation 4) is 50 te and that which attracts 
a safety case (Regulation 7) is 500 te. 

22.16.2 Storage conditions 

Ammonia is generally stored either under pressure at 
atmospheric temperature or fully refrigerated at -33°C 
and atmospheric pressure. A review of storage conditions 
has been given by C.C. Hale (1974). 

22.16.3 Materials of construction 

Materials of construction for ammonia handling are dis¬ 
cussed in Chapters 11 and 12, and are, therefore, not dealt 
with in detail here, but there are a few matters which merit 
mention at this point. The normal material of construction for 
ammonia storage vessels and tanks is carbon steel. Ammo¬ 
nia reacts with copper and copper alloys, particularly if even 
traces of water are present, and they should not be used. 

Materials of construction for ammonia handling need to 
be resistant to low temperatures and to SCC. High yield 
strength steels are more susceptible to SCC than lower yield 
strength steels, and an upper limit on strength may be 
specified. Austenitic steels are resistant to low temperature 
brittle fracture. 

22.16.4 Storage statistics 

Surveys of refrigerated ammonia storage with copious 
statistics have been given by C.C. Hale (1974,1980,1984) and 
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C.C. Hale and Lichtenberg (1990). The following subjects are 
among those covered, though not every subject is dealt with 
in every survey: (1) number of tanks, (2) size of tanks, 
(3) types of tank, (4) total storage capacity, (5) location of 
storage (by state), (6) siting of storage, (7) fill sources, 
(8) operating temperatures and pressures, (9) foundations, 
(10) insulation, (11) secondary containment, (12) vapour 
recovery systems, compressors and condensers, (13) flare 
systems, (14) inert gas purge systems, (15) utilities, 
(16) manning, (17) inspection, (18) downtime, (19) accident 
prevention programmes, and (20) emergency planning. 

22.16.5 Storage policies 

As for LPG and LNG, so for ammonia, the last decade has 
seen a considerable evolution of storage policy. Some 
accounts of these changes are given by WG. Jones et al. 
(1989), J.R.Thompson and Carnegie (1989) and Squire (1991). 

J.R. Thompson and Carnegie (1989) describe the policy of 
Dupont to replace pressurized storage of ammonia with 
high integrity refrigerated atmospheric storage. 

The policy of ICI is described by W.G. Jones et al. (1989). 
There the policy is to retain in use existing pressure storage 
spheres, but for new storage to use small stress relieved 
cylindrical vessels and refrigerated atmospheric tanks. 

22.16.6 Storage operation 

The principles governing the operation of ammonia stor¬ 
age are outlined in HS(G) 30 and in the CIA Refrigerated 
Ammonia Storage Code. 

The point was made earlier that in many of its aspects 
storage is not a low technology activity. This is illustrated 
by the comment of Squire (1991) in an account of the meas¬ 
ures taken to ensure the integrity of a particular large 
refrigerated ammonia storage tank: ‘Most, if not all, of the 
personnel associated with the ammonia tank did not 
understand the “technology of the tank” ’. 

22.16.7 Emergency arrangements 

Emergency planning for ammonia storage is dealt with 
in HS(G) 30 for pressure storage and in the CIA Refrigerated 
Ammonia Storage Code and by C.C. Hale (1980). Hale 
describes an ammonia terminal emergency programme 
with emphasis on the properties and hazards of ammonia 
itself and on protective equipment for personnel. 

22.17 Ammonia Storage: Pressure Storage 

22.17.1 Storage vessels 

Ammonia pressure storage vessels are usually horizontal 
cylindrical vessels for the small capacities and spherical 
vessels for the larger ones. It has been common practice to 
use pressure storage spheres with a capacity in the range 
500 to 3000 te, but many spheres have suffered problems of 
SCC and some have been taken out of use. 

An ammonia pressure storage vessel should be designed 
to BS 5500 Category 1, or equivalent, with due regard to 
Appendix D, which deals with low temperature steels, and 
taking into account the guidance given in HS(G) 30. HS(G) 
30 gives separate treatments for cylindrical and spherical 
vessels, and this distinction is followed here. 

22.17.2 Spherical vessels 

HS(G) 30 states that an ammonia pressure storage sphere 
should be designed to withstand the stresses imposed 
when the vessel is full and the pressure in the vapour 
space is equal to the vapour pressure of ammonia at the 


maximum design temperature plus the partial pressure of 
any inert gases which may be present. The minimum 
design temperature should preferably be -33°C, which 
is the temperature to which liquid ammonia will drop if 
completely depressurized, but in any event should not be 
greater than -10°C. 

The design should be such as to minimize the risk from 
SCC. The steel used should be not a high yield strength steel 
but one with a yield strength not exceeding 350 N/mm 2 . 
The vessel should be fully stress relieved. These require¬ 
ments apply to the design of a new vessel and are not 
necessarily met in existing vessels. 

The inspection requirements given in HS(G) 30 include 
100% magnetic particle inspection of all internal welds. 

22.17.3 Secondary containment 

It has been traditional to put bunds around all types of 
ammonia storage. But this practice has been questioned, 
for example by J.D. Reed (1974), in relation to pressure 
storage on the grounds that in this case sudden loss of 
containment tends to result in ejection of all the contents in 
the form of vapour, or spray, leaving no residual liquid. 

HS(G) 30 recognizes this argument, but requires that an 
ammonia storage sphere should be provided with a bund. 
The bund should be able to take 20% of the capacity of the 
sphere, should be positioned outside the sphere radius and 
should be not less than 1 m high. The ground under the 
vessel should be sloped to allow drainage into a sump. 

22.17.4 Ancillary facilities 

The ancillary facilities required for ammonia storage 
include, in particular, pumps for the transfer of liquid 
ammonia from storage. 

22.17.5 Instrumentation 

An ammonia storage sphere should be provided with suit¬ 
able measurements and alarms on liquid level, pressure 
and temperature. For level there should be at least two 
independent indicators. There should be a high level alarm 
independent of any indicators. 

22.17.6 Pressure relief 

HS(G) 30 requires that pressure relief on an ammonia 
storage sphere should be provided by means of at least two 
pressure relief valves. In addition, unless the sphere is 
designed for full vacuum, it should be protectedby a vacuum 
break valve. Use may be made of separate pressure and 
vacuum valves or of the combined pressure/vacuum type. 

There should be an isolation valve between each relief 
valve and the sphere, and a system should be incorporated 
to ensure that at any one time only one relief valve can be 
isolated. 

22.17.7 Inspection 

HS(G) 30 requires that an initial inspection be made when 
the sphere is brought into service and that there should be a 
first in-service inspection within 2 years of commissioning. 
A principal purpose of the inspection should be to detect 
any SCC which may have occurred, as described below. 
Provided the results of inspection are satisfactory, the 
inspection interval may be increased in steps of 2 years up 
to a maximum interval of not more than 6 years. 

The guide gives details of the procedures to be followed 
in decommissioning and recommissioning the vessel and of 
the features to be inspected and the methods of inspection. 
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22.17.8 Stress corrosion cracking 

Much of the treatment of operation and inspection in HS(G) 
30 is concerned with SCC. This problem is considered at 
more length in Section 22.19, but the recommendations of 
the guide may he noted at this point. These are to the effect 
that the oxygen content of the liquid ammonia should not 
exceed 2.5 ppm when the water content is as low as 100 ppm, 
and that serious consideration should be given to main¬ 
taining the water content at 0.2% w/w. 

22.17.9 Cylindrical vessels 

As mentioned above, HS(G) 30 gives a separate treatment 
for cylindrical pressure vessels for ammonia storage. The 
guide states that an ammonia pressure storage cylinder 
should be designed for a pressure of at least 15.5 bars. The 
design temperatures given are essentially as for a storage 
sphere. The arrangements given in HS(G) 30 for a ammonia 
storage cylinder and the associated unloading facilities are 
shown in Figure 22.19. For a storage cylinder, the guide 
does not require a bund, but there should be protection 
against vehicle impact. 

The inspection requirements given in HS(G) 30 include 
100% radiography of all butt welds, and ultrasonic and/or 
magnetic particle inspection of all other welds. 

22.17.10 Semi-refrigerated vessels 

It is convenient to deal here with pressure vessels for the 
semi-refrigerated, or semi-pressure, storage of ammonia. 
These are normally pressure spheres and are treated in 
HS(G) 30 together with pressure spheres for storage at 
atmospheric temperature. Principal differences are that 
with semi-refrigerated storage it is necessary to allow for 
the heat gain and resultant boil-off by provision of suitable 
thermal insulation and refrigeration. 

Insulation materials that may he used include foam glass 
and PUF. HS(G) 30 draws attention to the importance of a 
vapour barrier and to measures to prevent the integrity of 
the containment being impaired by the materials used in, 
or the attachment of, the insulation. 

22.18 Ammonia Storage: Refrigerated Storage 

22.18.1 Storage tanks 

Refrigerated liquid ammonia is stored in atmospheric stor¬ 
age tanks. Accounts of such storage are given in the CIA 
Refrigerated Ammonia Storage Code and by Shah (1982), 
Blanken (1987), J.R. Thompson and Carnegie (1989) and 
Herbertsson (1992). 

Tanks used for refrigerated ammonia have developed 
from conventional atmospheric storage tanks. The design 
of atmospheric storage tanks in general is governed by 
API Std 620: 1990 Design and Construction of Large, 
Welded, Low-pressure Storage Tanks and API Std 650: 
1988 Welded Steel Tanks for Oil Storage. For refrigerated 
ammonia storage frequent reference is made to API Std 
650, Appendix R. 

There are now in use a number of tank systems similar to 
those used for LNG. The single wall tank has a wall made of 
low temperature steel with external insulation covered by a 
vapour barrier. A double wall tank has an inner wall of low 
temperature steel and an outer wall of carbon steel with 
insulation in between. The outer wall is not designed to 
withstand the cold liquid, so this is still only a single con¬ 
tainment system. A double integrity tank system has an 
inner tank with a suspended deck and an outer wall. Both 


the inner and outer walls are of low temperature steel. 
Accounts of tank systems make little reference to the use of 
pre-stressed concrete for either the inner or outer wall or of 
membrane systems. 

22.18.2 Foundations 

The foundations of refrigerated ammonia storage tanks 
require be protected against ‘frost heave’. The problem 
and its prevention have been discussed by Morrison and 
Marshall (1970). Two principal types of foundation are 
used. One involves a tank bottom slab on piling so that 
there is free air circulation. In the other, the bottom slab is 
provided with insulation and electrical heating. 

Further descriptions of foundation systems are given in 
the CIA Refrigerated Ammonia Storage Code and by 
C.C. Hale (1980) and C.C. Hale and Lichtenberg (1990). 

22.18.3 Insulation 

A refrigerated ammonia storage tank requires thermal 
insulation. The type of insulation which is suitable depends 
on the tank system. Principal types of insulation for single 
wall tanks are foam glass, PUF, reflective multi-layered 
aluminium and Styrofoam. For doubled wall tanks use is 
made of perlite insulation. The suspended deck used in 
double wall tanks counts as another form of insulation. 

Insulation failures on single wall tanks are not unusual. 
A common cause is thepenetr: ation of moisture. Insulation 
problems have been described by a number of authors, 
including Hoffman (1967) and C.C. Hale (1974,1980). Loss 
of a section of lagging is undesirable, because it allows 
rapid heat leak into the tank with a consequent increase in 
vaporization; it may also cause ‘bump boiling’. 

Reviews of the failure rates of insulation systems have 
been made by C.C. Hale (1974,1980). He found that double 
wall tank systems filled with expanded perlite and reflec¬ 
tive multi-layer aluminium systems had a good record 
compared with foam glass, PUF and Styrofoam systems. 

Further descriptions of insulation systems are given by 
C.C. Hale (1984) and C.C. Hale and Lichtenberg (1990). 

Squire (1991) has discussed the effect of insulation in a 
double integrity tank system in the event of a leak from the 
inner tank into the annular space. Tests showed that as the 
ammonia vaporized, the perlite insulation behaved like a 
spouted bed, resulting in a pressure of 55—69 kPA (8—10 
psi). Solutions were to vent to annular space or install block 
Styrofoam insulation. No satisfactory way was found of 
doing the former, and for the tank in question the latter 
solution was adopted. 

22.18.4 Secondary containment 

Refrigerated ammonia storage tanks may be provided with 
some form of secondary containment. Accounts are given 
by Comeau (1972), MacArthur (1972), C.C. Hale (1974,1980), 
J.D. Reed (1974), Hendriks (1980), Shah (1982), Blanken 
(1987) and C.C. Hale and Lichtenberg (1990). 

Escape from refrigerated ammonia storage results in 
immediate flashing of only about 2% of the liquid. Even 
a primitive secondary containment should hold some 90% 
of the liquid. 

Bunds and other measures to prevent dispersion of 
ammonia from refrigerated storage have been discussed by 
Comeau (1972). It is not necessarily enough simply to catch 
the liquid released. If a low bund with a large surface area is 
used, the large quantities of ammonia vapour vaporized 
from the liquid will still present a serious hazard. It is 



4 



Figure 22. 19 General arrangement for an ammonia pressure storage installation (Health and Safety Executive, 1986 HS(G) 30) (Courtesy of HM Stationery 
Office © All rights reserved) 
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therefore desirable to reduce the surface area. There are 
various methods of doing this. Use may be made of con¬ 
trolled drainage which runs the liquid off to a pit where its 
evaporation is reduced. Foam blanketing is another possi¬ 
bility, provided the area to be covered is not excessive. 
However, the most effective method of reducing the surface 
area available for evaporation is the use of a high bund. 

The CIA Refrigerated, Ammonia Storage Code requires 
that for a refrigerated atmospheric ammonia storage tank 
in the United Kingdom, means must be provided to contain 
the liquid safely in the event of failure of the main tank. The 
two methods which are acceptable are the use of a double 
integrity tank or the use of a concrete wall of approximately 
the same height as the tank wall. For the latter it is recom¬ 
mended that the width of the annulus is 1.5 m. The Code 
recognizes that in remote locations a low bund may some¬ 
times be acceptable. 

22.18.5 Ancillary facilities 

Ancillary facilities for refrigerated ammonia tanks include 
refrigerationsystems. Accounts are givenbyC.C.Hale(1980, 
1984), C.C. Hale and Lichtenberg (1990) and Herbertsson 
(1992). 

Refrigerated ammonia storage requires the provision of 
refrigeration facilities to liquefy vapour boil-off caused by 
heat inleak. Where the storage is part of an ammonia man¬ 
ufacturing plant, the main ammonia refrigeration facility 
may be used with just a backup set for storage, but gen¬ 
erally the facility is a dedicated one. The principal elements 
are the refrigeration compressors and the ammonia con¬ 
densers. There may alsobeapurge system to remove inerts 
from the ammonia condenser or receiver. 

22.18.6 Instrumentation 

A refrigerated ammonia storage tank should be provided 
with suitable measurements and alarms on the liquid level, 
pressure and temperature in the tank, and on boil-off 
gas flow. 

Principal features of the instrumentation are the 
arrangements to prevent overpressure and overfilling. 
Pressure control is an integral part of the refrigeration 
system and there may also be a pressure control valve for 
emergency venting to flare. 

In addition to the usual level instrumentation, use may be 
made of an interlock system to prevent overfilling by the 
operator. 

In a double wall or double integrity tank system, instru¬ 
mentation may be provided to detect any leak into the 
annular space between the two tanks. 

22.18.7 Pressure relief 

The tank also requires pressure relief and vent disposal 
arrangements. Accounts are given by C.C. Hale (1974,1980), 
J.R. Thompson and Carnegie (1989) and C.C. Hale and 
Lichtenberg (1990). 

Pressure relief is provided by a pressure relief valve. 
Most tanks also have vacuum relief. PV valves are a com¬ 
mon method of providing both forms of relief. 

Venting to atmosphere has been common practice, pro¬ 
vided that the location is suitable and the venting is done at 
a safe height, but the trend is away from such venting. In 
the normal operation of refrigerated ammonia storage, 
however, there is very little venting. Vapour is reliquefied by 
the refrigeration set and returned as liquid to the tank. 


The main requirement for venting is in an emergency. In 
many systems, flares are provided to handle emergency 
venting. The flares may be on the tank, or inside or outside 
the bund. Venting to the flare may be by a separate pres¬ 
sure control valve rather than the main pressure relieve 
valve. Complete combustion of the ammonia flared, and 
avoidance of odour, is assisted by the addition of fuel gas. 

22.18.8 Inspection 

The inspection of refrigerated ammonia storage tanks pre¬ 
sents a numherof problems and needs to be governed by a well 
thought out policy. Accounts are given by Truscott and 
Livingstone (1978), Shah (1982,1987), P.P. Briggs, Richards 
andFiesinger(1986),WG.Joneseta/. (1989),Conley, Angelson 
and Williams (1991) and Squire (1991). Inspection prac¬ 
tice is one of the topics covered in the surveys by Hale. 

One type of problem is the determination of an inspec¬ 
tion interval. A difficulty here is that the opening up of the 
tank system is liable to introduce oxygen into it and may 
thus itself become a cause of deterioration. Another is that 
the outage period can be several months. A third difficulty 
concerns the degree of confidence which can be placed in 
the predictive techniques. 

The problem may also come in the form of a need to 
decide whether to open up a tank on a particular occasion. 
An account of a review of a particular refrigerated ammo¬ 
nia storage tank, its features and its hazards, has been 
given by Squire (1991), who describes the reasoning behind 
a decision not to open up the tank for inspection. 

There are also problems in the reliability of inspection 
techniques, as described below. 

The stages of decommissioning a tank for inspection and 
recommissioning it after inspection have been described 
by Shah (1982) and P.P. Briggs, Richards and Fiesinger 
(1986). The latter give an account of the arrangements for 
continuity, emptying and purging, tank entry and clean¬ 
ing, inspection and repair, and purging and refilling. 

22.18.9 Rollover 

There has been some concern that in refrigerated atmos¬ 
pheric storage tanks temperature stratification might 
occur, leading to ‘rollover’, which is defined as ‘a sponta¬ 
neous and sudden migration of a substantial mass of liquid 
ammonia from the bottom of the tank to the surface’. The 
effect of rollover is to release large quantities of vapour 
which could overpressure the tank. 

Rollover has been the subject of an investigation by the 
Ammonia Storage Committee, as described by Ball 
(1968b). Calculations showed that only a very small tem¬ 
perature gradient is required to initiate natural circulation 
and prevent temperature stratification. The calculations 
have been confirmed experimentally. It has also been 
shown, however, that there is a possibility of stratification 
in ammonia containing over 5000 ppm of water. 

An account of conditions which might lead to what he 
terms ‘thermal overload’ has been given by Squire (1991). 
They include the introduction of contaminated or wrong 
material such as wet ammonia or even water; the introduc¬ 
tion of warm ammonia; or a strong heat input such as might 
occur through loss of thermal insulation. 

22.19 Ammonia Storage: Stress Corrosion Cracking 

As already indicated, SCC has been a widespread problem 
in ammonia pressure storage vessels. Accounts have been 
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given by W.D. Clark and Cracknell (1977), Truscott and 
Livingstone (1978), Lemoine et al. (1986), Loginow (1986), 
Stephens and Vidalin (1988), Byrne, Moir and Williams 
(1989), Appl et al. (1990), Burke and Moore (1990), Selva and 
Heuser (1990) and Conley, Angelsen and Williams (1991). 

Although ammonia has been used without apparent 
problems in the chemical and refrigeration industries for 
many decades, the use of liquid ammonia for agricultural 
purposes, which began after the Second World War, saw a 
number of cases of failure in the vicinity of welds on the 
pressure vessels used. A survey by T.J. Dawson (1956) 
found that about 3 % of these pressure vessels failed within 
3 years of entering service. In the chemical industry, con¬ 
cern intensified in the 1970s. A1982 survey by the AIChE, 
described by Blanken (1982) and referred to by Burke and 
Moore (1990), reported inspection results for 72 pressure 
storage spheres in 37 of which SCC had been found. 

Extensive investigation, and in particular the work of 
Lunde (Lunde, 1984; Lunde and Nyborg, 1987,1989,1990) 
in the Kjeller Ammonia Stress Corrosion Project (KASP) 
has given a clearer picture of the conditions under which 
SCC occurs. This work has shown that (1) uncontaminated 
ammonia does not cause cracking, (2) contamination 
with oxygen at a concentration as low as 1 ppm promotes 
cracking and (3) 0.2% w/w water inhibits cracking in 
oxygen-contaminated ammonia in the liquid phase. 

It is also necessary to consider the vapour phase. Even 
where the liquid ammonia contains water, SCC can occur in 
the vapour phase, where due to the vapour-liquid equilib¬ 
rium relations the concentration of oxygen is some 650 
times higher than that in the liquid phase, whilst the con¬ 
centration of water is some 500 times lower. 

The metallurgy of the steel is also a factor. SCC occurs 
more readily where stress relief has not been carried out 
and in high yield strength steels. Measures to prevent SCC 
are therefore the use of stress relief by post-weld heat 
treatment and of low yield strength steels. 

With respect to crack growth, it has been found that under 
conditions typical of those known to cause SCC (3 ppm 
oxygen, 500 ppm water), crack growth rates are similar to 
those which occur in-service, of the order of 2-6 mm/year, 
depending on the stress intensity. Crack growth rates tend 
to be rapid initially, but to decrease markedly over time. 

Whereas SCC has been widespread in ammonia pressure 
storage vessels, this has not been the case with refrigerated 
atmospheric ammonia storage tanks - as recently as 1987 
it was largely discounted (Blanken, 1987). However, 
SCC has now been found in refrigerated ammonia storage 
tanks, as described below. 

22.19.1 Inspection and repair 

There are a number of accounts of the inspection of pressure 
vessels and of refrigerated tanks for ammonia storage in 
order to detect SCC. Inspections of pressure vessels have 
been described by R.S. Brown (1982) and by Guth and Clark 
(1985). They illustrate both the procedures for isolation, 
emptying, purging and entry, and bringing back on-stream 
such storages, and the procedures for inspection and repair. 

Brown describes the inspection and repair in 1978 of two 
ammonia spheres installed in 1961 and 1962. Although the 
recommendation in 1962 to maintain the ammonia water 
content at 0.2% was followed, the spheres may have con¬ 
tained some ammonia which did not contain water. The 
inspection was performed using both magnetic particle 
and dye penetrant methods and significant cracks were 


found, which were diagnosed as being due to SCC. A maxi¬ 
mum crack depth of 7.8 mm, or 25% of the shell weld cross- 
section, was found. Repairs were carried out in accordance 
with the ASME Boiler and Pressure Vessel Code and the 
Compressed Gas Association (CGA) Guidelines for Inspection 
and Repair of Cargo Tanks. Cracks were removed by 
mechanical grinding or arc gouging to sound metal. The 
area was then pre heated and weld repaired. Further 
inspection and repair were conducted in 1980. 

Another instance of cracking in two ammonia spheres in 
1982 is described by Guth and Clark. Acoustic emission 
was used to detect the faults. In one sphere the repair 
method used was to grind down to the parent metal, repair 
the weld and hammer to relieve stresses. In the other 
sphere the crack was ground out and the welder then pre¬ 
heated the metal, repaired it, and peened it. 

The discovery of SCC in a refrigerated ammonia storage 
tank has been described by Byrne, Moir and Williams 
(1989). The tank in question was a 12,000 te tank at Seal 
Sands, acquired by BASF from another company. The pre¬ 
vious owners had relied on acoustic emission testing to 
extend the inspection interval for the tank and had detected 
no SCC. An inspection performed hy the new owners using 
magnetic particle inspection discovered SCC. The SCC was 
found to occur mainly at the site of internal cleats and was 
attributed to defective welding procedures, the effect of 
which was aggravated by the use of high strength steel. A 
detailed account of the treatment of defects in this tank has 
been given by Selva and Heuser (1990). 

Appl et al. (1990) have given an account of the inspection 
of two further refrigerated ammonia storage tanks owned 
by BASF. They describe in detail the taking out of service, 
preparation, magnetic particle inspection, repair and 
bringing back into service. 

Principal techniques for the detection of cracks are 
magnetic particle inspection, dye penetrant testing and 
acoustic emission testing. The use of dye penetrant testing 
is described by Brown, but not by the other authors men¬ 
tioned. 

As already indicated, there is a view that acoustic emis¬ 
sion testing is not a reliable method. Vessels with SCC may 
not produce significant acoustic emission. Furthermore, 
Conley, Angelson and Williams (1991) describe a case where 
it was found that acoustic emission activity was greater in a 
vessel which had been repaired than in one with SCC which 
had not been repaired. 

The inspection technique mainly quoted is magnetic 
particle inspection. However, the same authors state that 
even this does not necessarily reveal all the defects and that 
different operators tend to produce different results. 

22.19.2 Fracture mechanics 

Fracture mechanics, described in Chapter 12, has been 
applied to SCC both in ammonia pressure vessels and 
refrigerated ammonia storage tanks. 

Accounts of the application of fracture mechanics to 
ammonia pressure vessels have been given by W.G. Jones 
et al. (1989) and Burke and Moore (1990). 

Byrne, Moir and Williams (1989) describe the applica¬ 
tion of fracture mechanics to the Seal Sands refrigerated 
ammonia storage tank. The task of removing all the defects 
found was enormous. The interest lay, therefore, in reduc¬ 
ing this activity to an acceptable level. In many cases, it 
was possible to determine that the crack would exhibit 
leak-before-break behaviour. Those cracks for which this 




STORAGE 22/53 


could not be demonstrated were removed. Further details 
of this fracture mechanics work are given by Selva and 
Heuser (1990). 

The use of fracture mechanics to set the inspec¬ 
tion interval for refrigerated ammonia storage tanks is 
described below. 

22.19.3 Control policy 

The maintenance of the integrity of ammonia storage 
requires a policy for the control of SCC. Accounts of such 
policies have been given by WG. Jones et al. (1989), Appl et al. 
(1990), Squire (1991) and Conley, Angelson and Williams 
(1991). 

WG. Jones et al. (1989) describe the policy of ICI for the 
control of SCC in ammonia pressure vessels. As stated 
earlier, the overall ammonia storage policy is to move away 
from pressure storage spheres to smaller fully stress 
relieved pressure vessels and refrigerated storage tanks. 
They postulate two extreme scenarios for pressure spheres. 
An unpurged, unlagged sphere handling imported ammo¬ 
nia from a variety of sources at relatively high temperature 
and without vapour export may well experience a com¬ 
paratively high level of SCC, whereas a purged, lagged 
sphere handling site-produced ammonia at a low tempera¬ 
ture with continuous vapour offtake may experience little, 
if any Operational measures to control SCC include purging 
to remove oxygen, maintenance of the water content, and 
cooling of the liquid. 

An account of policy at Dupont for the control of SCC in 
ammonia pressure vessels has been given by Conley, 
Angelson and Williams (1991). The approach includes the 
use of fracture mechanics to predict the probability of fail¬ 
ure and to determine inspection intervals. 

Appl etal. (1990) of BASF rehearse some of the problems 
of controlling SCC in pressure storage vessels. There are 
difficulties in excluding oxygen and in keeping the oxygen 
content of the liquid ammonia below 1 ppm. There are some 
applications for which the ammonia is required to be dry 
and for which a requirement to maintain a water content of 
0.2% w/w is highly undesirable. They state that stress 
relief by post-weld heat treatment appears to be the only 


reliable way to avoid SCC and that, whereas it has been 
necessary to scrap an older ammonia sphere due to SCC, a 
new stress relieved sphere inspected after 2 years of 
operation has shown no SCC. 

22.20 Other Chemicals Storage 

The storage of particular chemicals involves in some cases 
features which do not occur in the storage of the materials 
so far described. The general characteristics and handling 
of some of these chemicals are described in Chapter 11. 
The account given here seeks to highlight some features 
characteristic of the storage of individual chemicals; no 
attempt is made to give a comprehensive treatment of 
the storage of any given chemical, which is covered in the 
code cited. 

Table 22.11 lists some topics on storage dealt with in 
codes and guidance for particular chemicals. 

22.20.1 Acrylonitrile 

Guidance on the storage of acrylonitrile (AN) is given in 
Codes of Practicefor Major Hazards: Acrylonitrile by the CIA 
(1978 PAH) (the CIA Acrylonitrile Code). 

AN has a boiling point of 77.3°C. It is typically stored in 
atmospheric fixed roof storage tanks. An AN storage tank 
should be provided with a suitable bund. 

AN has a tendency to polymerize rapidly under certain 
conditions and in bulk storage it needs to be stabilized. The 
Acrylonitrile Code mentions three stabilizers. One is the 
methyl ether of hydroquinone (MEHQ), which is used when 
the AN contains dissolved oxygen. Another is ammonia, 
which combines with AN to form stabilizing compounds 
and thus in due course becomes depleted. The third stabi¬ 
lizer is water, which at a concentration of 0.2 % w/w confers 
a degree of stabilization. Strong alkali or peroxides should 
be excluded. 

Under certain conditions a flammable mixture can form 
in the vapour space of the tank. Precautions mentioned in 
the Code are the safe location of the vent, the installation of 
a flame arrester on the vent and the inciting of the vapour 
space. 


Table 22.11 Some topics on storage covered in certain codes of practice and guidance documents for particular 
chemicals a 
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chlorine (HSE, 1986 HS(G) 28); ethylene dichloride (CIA, 1975 PA13); ethylene oxide (CIA, 1992 RC14); hydrogen fluoride (CIA, 1978 PA14); 
phosgene (CISHC, 1975/3); vinyl chloride (CIA, 1978 PA15). Aspects other than storage are considered separately in Chapter 11. 
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22.20.2 Ethylene dichloride 

Guidance on the storage of ethylene dichloride (EDC) is 
given in Codes of Practice for Major Hazards: Ethylene 
Dichloride by the CIA (1975 PA13) (the CIA Ethylene 
Dichloride Code). 

EDC has a boiling point of 84.4°C. It is generally stored, 
dry or water saturated, in atmospheric storage vessels, 
which may contain several thousand tonnes. An EDC stor¬ 
age vessel should be provided with a suitable bund. 

Under certain conditions a flammable mixture can form 
in the vapour space of the tank. The Ethylene Dichloride 
Code advises that consideration be given to protecting the 
vapour space from ignition and requires that means be 
provided for preventing over- and underpressure, includ¬ 
ing explosion relief. 

Fire protection of larger EDC storage vessels tends to be 
by water spray systems, and that of small vessels is by fire 
insulation. 

22.20.3 Ethylene oxide 

Guidance on the storage of ethylene oxide (EO) is given in 
Guidelines for Bulk Handling of Ethylene Oxide by the CIA 
(1992 RC14) (the CIA Ethylene Oxide Code). 

EO has a boiling point of —17.8°C. It is stored as a lique¬ 
fied gas, mainly in pressure vessels, although refrigerated 
storage is an option. The separation distances appropriate 
for EO are of the same order as those quoted in codes for 
LPG, but should not be less than 15 m. 

An EO storage vessel should be provided with a suitable 
bund. Since an EO spillage is commonly dealt with by dilu¬ 
tion, the bund and drain arrangements should be able to 
handle water used for this purpose as well as the usual fire¬ 
fighting purposes of equipment cooling and fire control. 

Many EO bulk storages are associated with plants which 
use a catalyst to polymerize the EO. Stringent precautions 
are necessary to ensure that the catalyst is excluded from 
the bulk storage. Three ways in which contamination may 
occur are (1) backflow from user plants, (2) introduction by 
a diluent gas pressurizing system and (3) inadvertent con¬ 
tamination during supply offloading. Both design and 
operations measures are required to prevent contamina¬ 
tion. The design measures are described in Chapter 11. 

22.20.4 Hydrogen fluoride 

Guidance on the storage of hydrogen fluoride (HF) is given 
in Guide to Safe Practice in the Use and Handling of Hydro¬ 
gen Fluoride by the CIA (1978 PAM) (the CIA Hydrogen 
Fluoride Code). 

HF has a boiling point of 19.5°C. Liquid HE is stored in 
pressure vessels of a few tonnes upwards. 

The storage temperatures range from -5°C to 30°C, at 
which temperatures the vapour pressures of HE are 0.4 and 

1.5 bars, respectively. Assistance is therefore required to 
effect transfer from storage, and this may be by the use of 
inert padding gas or, more commonly, by pumping. 

The Hydrogen Fluoride Code lays particular emphasis on 
lines connected to the vessel below the liquid surface.Where 
these are unavoidable, it requires that there be a means of 
isolation integral to the vessel and independent of any exter¬ 
nal valve used for routine isolation and control, and that this 
external valvebe capable of remote operation. 

22.20.5 Oxygen 

The storage of oxygen is the subject of two codes by the 
British Compressed Gases Association (BCGA) - Bulk 


Liquid Oxygen at Production Plants (BCGA, 1990 Code 20) 
and Bulk Liquid Oxygen at Users’ Premises (BCGA, 1992 
Code 19) — and of one by the NFPA — NFPA 50:1990 Bulk 
Oxygen Systems at Consumer Sites. 

The hazard posed by liquid oxygen is the reaction with 
combustible or flammable materials. The layout for the 
storage of liquid oxygen should include the use of non¬ 
combustible surfaces, the provision of separation distances 
between storages of liquid oxygen and flammable liquids, 
and the prevention of contact between the two through 
flows of liquids, by ground contour or diversion. 

22.20.6 Phosgene 

Guidance on the storage of phosgene is given in Codes of 
Practice for Major Hazards: Phosgene by the CIA (CISHC, 
1975/3) (the CIA Phosgene Code). 

Phosgene has a boiling point of 8.2°C. It is stored as a 
liquid in pressure vessels. 

The Phosgene Code advises that the storage temperature 
be kept below 8°C so as to reduce the load on the disposal 
system if the vessel has to be depressurized. 

Particular emphasis is placed in the Code on the integrity 
of the pressure vessel, with requirements such as 100% 
radiography of butt welds and exclusion of installed lifting 
devices in the immediate vicinity of the vessel. 

The Code requires that all branches in the top of the 
vessel be fitted with dip pipes which protrude at least to the 
maximum liquid level under normal operating conditions 
to ensure that the tank cannot be accidentally overfilled. 
There should be no lines connected to the vessel below the 
liquid surface, but if this is unavoidable they should be 
provided with a remotely operated isolation valve. 

22.20.7 Monomers 

An important class of liquid chemicals which require to be 
stored are monomers. Accounts of the storage of monomers 
is given by Shelley and Sills (1969) and Bond (1985 LPB 65). 

A problem in the storage of monomers is polymerization. 
One hazardous consequence of such polymerization may be 
heat release, which causes both a rise in pressure and an 
acceleration in the reaction, resulting in the extreme case in 
the explosion of the tank. Another hazardous effect may be 
the blockage of vents and pressure relief devices. 

It is common practice to dose monomers with additives. 
A discussion of their use has been given by Bond (1985 LPB 
65). Types of additive include (1) inhibitors, (2) stabilizers, 
(3) anti-oxidants, (4) preservatives and (5) stenching 
agents. The function of inhibitors and stabilizers is to pre¬ 
vent polymerization, while anti-oxidants prevent decom¬ 
position, preservatives prevent bacterial or fungicidal 
attack and stenching agents impart an odour. 

Typically, an inhibitor is effective only in the presence of 
oxygen. The use of nitrogen to blanket the liquid can reduce 
the oxygen content both in the liquid and in the vapour 
space and render the inhibitor ineffective in both phases. 
The liquid monomer may polymerize in a runaway reaction 
and the monomer vapour may polymerize and block vents. 

A fuller account of the storage of monomers is given in 
the IChemE training package Safer Use of Chemical Addi¬ 
tives, described in Chapter 27. This package includes a list 
of chemicals which are commonly dosed with an additive, 
and gives the purpose of the additive, an example of the 
additive used, the quantity added and an indication of 
requirement for dissolved oxygen. 
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The interactions between the various factors are illus¬ 
trated by the account given by Shelley and Sills (1969) 
of options in the storage of styrene in the late 1960s. 
They describe the use of p-t- butyl catechol (TBC) as the 
inhibitor. The TBC also acts as an anti-oxidant but it is 
effective as an inhibitor only in the presence of oxygen. 
Storage under air suffices to maintain an adequate con¬ 
centration of oxygen in the liquid phase. However, there 
remains the problem of polymerization in the vapour 
phase on the internal surfaces of the tank. This is liable to 
occur in older tanks with rusty surfaces, but is largely 
eliminated by coating the surface. One policy for older, 
uncoated tanks is the use of a nitrogen blanket, since in the 
absence of oxygen polymerization in the vapour phase is 
much reduced. Where such a nitrogen blanket is used, 
separate measures are taken to maintain the oxygen con¬ 
tent of the liquid. 

22.20.8 Vinyl chloride 

Guidance on the storage of vinyl chloride is given in Codes 
of Practice for Chemical with Major Hazards: Vinyl Chloride 
by the CIA (1978 PA15) (the CIA Vinyl Chloride Code), and 
also in Precautions against Fire and Explosion: Vinyl Chlo¬ 
ride also by the CIA (1978/12). An account is also given by 
Shelley and Sills (1969). 

22.21 Bunds 

An important form of secondary containment is a bund, or 
dike. Accounts of bunding are given in The Design of Bunds 
(Barnes, 1990 SRD R500) and Bund Overtopping — The 
Consequences Following Catastrophic Failure of Large 
Volume Liquid Storage Vessels (Wilkinson, 1991 SRD R530). 

Barnes discusses: the bunding recommendations given in 
codes and standards; the philosophy of, and practice in, 
bunding; the design of bunds; the effectiveness and failure 
of bunds; and the use of high bunds and double integrity 
systems. He gives case histories of storage, and particularly 
bund, incidents and some statistics on storage failures. 
He draws particularly on the report Liquefied Energy 
Gases Safety (GAO, 1978) and on a study by Buckley and 
Weiner (1978). 

Common practice is to provide a bund for refrigerated 
atmospheric storage of LPG and other LPGs and for 
ammonia, but not for pressure storage of LPG or ammonia. 

For atmospheric storage tanks, containing such hazard¬ 
ous chemicals as acids and alkalis, it is again not usual 
to have a bund. If there is a danger of spillage onto roads, 
pathways or working areas, or of hazardous interaction 
between spillages of two liquids, separation by distance is 
appropriate. 

22.21.1 Code requirements 

Barnes reviews the requirements for bunding given in a 
large number of codes, including not only those for oil, LPG 
and LNG, but also for ammonia, chlorine and the various 
chemicals covered by the CIA codes. The overall picture is 
of considerable arbitrariness and some inconsistency. 

Codes differ, for example, in their requirements for fea¬ 
tures such as capacity and permitted wall height. They 
even differ as to whether or not a bund is required at all. 
Liquid ammonia and liquid chlorine have similar adiabatic 
flash fractions, at 16% and 18.3%, respectively, but Barnes 
identifies one code for ammonia which recommends 
a high bund, and another for chlorine which practically 


dismisses the use of a bund altogether. One code may set a 
maximum wall height to permit fire fighting in the bund, 
which would rule out the use of a high bund recommended 
in another code. 

22.21.2 Philosophy of bunding 

Barnes attempts, therefore, to develop a more coherent 
philosophy of bunding. He distinguishes between: liquids 
which are (1) flammable, (2) toxic, (3) corrosive and (4) reac¬ 
tive; liquids which are stored at a temperature (1) above the 
boiling point and (2) below it; and liquids which have (1) a 
high vaporization rate and (2) a low vaporization rate. 
Figure 22.20 shows his three decision trees for flammables, 
toxics and corrosives. 

He takes a reactive material as being one which does not 
in its own right present a flammable, toxic or corrosive 
hazard, but which on contact with some other material, 
such as water or acidic or alkaline effluent, could produce a 
substance which does constitute a hazard. For this case he 
gives a simple two-branch tree, in which bunding is not 
required if the reactive material could not come into contact 
with another reactant but may be required if it could, 
depending on the assessed hazard. 


22.21.3 Bund design 

The elements of bund design, which Barnes addresses, are 
(1) bund capacity, (2) materials of construction, (3) wall 
design, (4) surface water drainage, and (5) common bunding. 

Codes differ in their recommendations on bund capacity 
which vary between 75 % and 110 % of the nominal capacity 
of the container protected. Barnes also quotes data from 
the General Accounting Office (GAO) report which illus¬ 
trate the capacity allowed in practice. For the nine storages 
for which information is given, the capacities range from 
50% to 139%. 

In the selection of materials of construction, factors 
which have to be considered are the mechanical strength, 
the vaporization rate and, for low temperature liquids, the 
resistance to thermal shock. The materials used both for 
bunded areas and for bund walls are mainly earth and 
concrete. Use is also made of insulating concrete. 

A low bund wall facilitates firefighting, and up to about 
1980 many codes set a maximum height for the bund wall, 
often of the order of 2 m. This restriction is now less com¬ 
mon, reflecting a trend towards high wall bunds. Codes 
may also set a minimum height for a bund wall, such as the 
1.5 m height set in the NFPA codes. 

Most codes do not give clear guidance on the arrange¬ 
ments for the drainage of surface water. A major problem 
here is that if the arrangement for the removal of rainwater 
is through a drain hole with a valve on it which should 
normally be kept closed, the valve is liable to be left open, 
thus allowing any liquid released into the bund to escape 

The use of common bunding is widespread, but it is 
not regarded as good practice to co-bund incompatible 
materials. 

22.21.4 Bund sizing 

Relations for bund sizing have been given by Barnes, and 
reformulated by Wilkinson. Following the latter, for a 
cylindrical tank in a circular shaped bund 

nR 2 (H -h)= n(R + Lfh - nR 2 h 


[22.21.1] 
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whence 

h>R 2 H/(R + Lf [22.21.2] 

where h is the height of the bund, H is the original height of 
the liquid, L the distance between the tank wall and the 
bund and R is the radius of the tank. For a rectangular bund 

71R 2 ( H-h)= xyh -nRfh [22.21.3] 

whence 

h>nR z H/xy [22.21.4] 

where x and y are the dimensions of the bund walls. 


22.21.5 Vaporization from bunds 

For many hazardous materials the magnitude of the con¬ 
sequences of a release depends largely on the rate of 
vaporization from the pool formed. In the main, this 
depends partly on the area of the bund and partly on the 
material of construction used. 

A high bund gives a much smaller total area for vapor¬ 
ization. Another approach applicable with a low bund 
system is the use of a ditch within the bund, which for all 
but the largest releases, reduces the effective area for 
vaporization. There are a number of bund floor materials, 
such as insulating concrete, which give an appreciable 
reduction in the rate of vaporization. Another approach to 
the reduction of vaporization is to blanket the liquid sur¬ 
face, either with foam or with plastic spheres. 


Vaporization from surfaces such as bund areas is dis¬ 
cussed further in Chapter 15. 


22.21.6 Spillage from bunds 

With a low bund system in particular, if the release of liquid 
is sufficiently large it may flow as a wave which overtops 
the bund wall. Such overtopping has occurred in a number 
of cases. One of the most dramatic was at Qatar, where an 
LPG storage tank contained in a 50% capacity bund suf¬ 
fered a catastrophic failure. A ‘tidal wave’ of LPG over¬ 
topped the bund and caused massive destruction. Barnes 
quotes an estimate that, even if the capacity of the bund had 
been 100%, it would still have been overtopped by a wave 
some 5 m high. 

Another major overtopping, from a bund that was 20% 
undersized, occurred at Moose Jaw, Saskatchewan, in 1980, 
following the catastrophic failure of an oil storage tank. 

The GAO study gives results of modelling of bund over¬ 
topping by a tidal wave at a number of particular facilities. 
The six results for low bunds quoted by Barnes indicate 
overtopping in each case, with an average overspill of 58% 
of the tank contents. 

Further work on overtopping of low bunds has been done 
by Greenspan and Young (1978), who derived an analytical 
model based on the shallow water equations, and by 
Greenspan and Johansson (1981), who performed model 
experiments. They correlated the fraction Q of the original 
liquid volume which spills over as function of the ratio h/H, 
where h is the height of the bund and H is the original 
height of the liquid in the tank, with the bund r radius and 
wall angle 9 as parameters. 



Figure 22.20 continued 
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Figure 22.20 Decision trees for the design of bunds (Barnes, 1990 SRD R500): (a) flammable material (b) toxic 
material; and (c) corrosive material (Courtesy of the UKAEA Safety and Reliability Directorate) 
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Another form of escape from a bund is spigot flow in 
which the liquid issues from the containment as a jet which 
has a ‘throw’ sufficient to carry it over the bund wall. Spigot 
escapes also are dealt with in the GAO report. 

22.21.7 High bunds 

There is an increasing tendency to install high bunds, for 
which there are two main designs. In the first, the bund is 
some one-half to two-thirds the height of the tank wall and 
located about 7-8 m from it. In the second, the bund is the 
full height of the tank and separated from it by a distance of 
3 m or less. There may be a weathershield between the tank 
and the bund so that the existence of a separate bund is 
not obvious. In both designs the bund is structurally 
independent of the tank. 

Storage systems with bunds are to be distinguished from 
double integrity tanks which have two walls, both capable 
of containing the liquid, and in which the outer wall is 
concrete. 

22.21.8 Dynamic loading of bunds 

If a sudden, catastrophic failure of the tank wall occurs, 
and a large release of liquid occurs, the bund is subject to a 
dynamic load. It has been common to design bunds for the 
hydrostatic load of the liquid in the tank, but not for this 
dynamic load. Attention was drawn to the problem by 
Cuperus (1979, 1980), and it has subsequently been the 
subject of a number of studies. 

Most of the work has been done in respect of double 
integrity tank systems rather than bunds. For such a sys¬ 
tem Cuperus concluded on the basis of modelling work that 
the impact loading was highly asymmetric and that the 
pressure at the base of the outer wall could be six times the 
hydrostatic pressure of the stored liquid. 

Adorjan, Crawford and Handman (1982) have modelled 
the behaviour of the release allowing for the resistance of 
the insulation between the two walls. This modelling has 
been extended by Vater (1985) using the basic relation 

hp - ^ = (M f + M s ) ^ - R(x) [22.21.5] 

where g is the acceleration due to gravity, h is the initial 
height of the liquid in the tank, M f is the effective fluid 
mass, M s is the effective mass of the tank shell, R is the 
resistance to flow, t is the time, * is the distance, u is the 
velocity and p is the density of the fluid. Solution of 
the equation requires the determination of the initial 
acceleration du/dt, for which the techniques of finite dif¬ 
ference hydrodynamic analysis were used. 

Finite difference studies on this problem have also been 
described by Trbojevic and co-workers (Trbojevic and 
Maini, 1985; Trbojevic and Gjerstad, 1989; Trbojevic and 
Slater, 1989). These authors have investigated both double 
integrity systems and bunds. Figures 22.21 and 22.22 show 
typical results for a high bund and a low bund, respectively; 

Vater found that for the specific example which he 
considered the pressure at the base of the bund due to 
dynamic loading was some 2.65 times that due to hydro¬ 
static load. The value obtained by Trbojevic and Gjerstad 
was 2.5. Higher load amplifications were found higher up 
the bund wall. 

22.21.9 Consequences of spillage 

A study of the consequences of spillage over a bund wall 
has been made by Wilkinson (1991SRD R530). Predictions 


are given for the hazard ranges for various materials and 
scenarios using the GASP code for vaporization and the 
DENZ and CRUNCH codes for dense gas dispersion. 

22.22 Underground Storage Tanks 

Over the last 15 years there has come to prominence, par¬ 
ticularly in the United States, the problem of leakage 
from underground storage tanks (USTs). 

Underground storage tanks are treated in Underground 
Storage Systems (Schwendeman and Wilcox, 1987). Further 
accounts are given by Dwyer (1985), D.L. Russell and Hart 
(1987) and Semonelli (1990). 

In the United States, the Resource Conservation and 
Recovery Act (RCRA) was amended in 1984 to extend the 
responsibilities of the Environmental Protection Agency 
(EPA) to underground storage tanks containing hazar¬ 
dous substances. Regulations on USTh came into force in 
1988. 

Various estimates have been given of the scale of the 
problem. The EPA has estimated that there are in the United 
States some 700,000 USTs of which about 25% are ‘non- 
tight’. Evidence obtained by the EPA was to the effect that 
leaks came predominantly (84%) from loose tank fittings 
or faulty piping rather than from the tank itself. 

The hazardous substances, to which the controls apply, 
are those given in the Comprehensive Environmental 
Response, Compensation and Liability Act (CERCLA) list. 
A tank is defined as a UST if more than 10% of the volume 
of the tank and its pipework are below ground. 

The regulations require that: new UST systems for 
hazardous substances have a secondary containment such 
as a double-walled tank, an external liner or other accept¬ 
able system; the piping have secondary containment such 
as double-walled piping or trench lining; and pressurized 
piping have an automatic leak detection system. The 
requirement for secondary containment of tank and pipe¬ 
work does not apply to new UST systems for petroleum. 
For these the requirements are for: periodic monitoring to 
detect leaks on the tank; periodic leak-tightness testing or 
monitoring on the piping; and, on pressurized piping, an 
automatic leak detection system. There are less stringent 
requirements for existing tanks. 

Secondary containment systems are required to contain 
any leak until it is detected and removed, to prevent any 
release to the environment, and to be monitored at monthly 
intervals. Where external liners are used, they should be 
such that they surround the tank completely and prevent 
lateral as well as vertical migration of a leak; can contain 
the whole contents of the tank; and prevent interference of 
rain or groundwater with the ability to contain and detect 
a leak. 

Design of UST systems and methods of leak monitoring 
are discussed by D.L. Russell and Hart (1987). The designs 
include: a reinforced concrete tank with an external liner; 
a fibreglass tank with an external liner; and a regular 
horizontal tank placed in a reinforced concrete secondary 
containment. 

The authors discuss the methods available for leak 
detection. Volumetric leak detection techniques rely on the 
change in level in the tank. Other techniques are based on 
detection of the leak itself. A further account of leak detec¬ 
tion is given by Higgins and Byers (1989). 

Methods used for decontamination of land where a UST 
has leaked are described by E. Johnson (1989a). 
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Figure 22.21 Simulation of liquid behaviour following the failure of a single wall storage tank inside a high bund 
(Trbojevic and Slater, 1989): (a) time t=Os; (b) t=0.6 s; (c) t= 1.2 s; (d) t- 1.8s (Courtesy of the American Institute of 
Chemical Engineers) 


HSE guidance on underground storage tanks is given in 
HS(G) 52. 

The environmental aspects of underground storage 
tanks are considered further in Appendix 11. 

22.23 Glass Reinforced Plastic Storage 

Most storage is constructed in steel but widespread use is 
also made of GRP, or FRP, containments. 


An account of the use of GRP containers in the process 
industries is given in Composite Materials Handbook 
(Schwartz, 1991). HSE guidance on GRP containments is 
given in PM 75 Glass Reinforced Plastic Vessels and Tanks: 
Advice to Users (1991). 

The design of GRP containment is governed by BS 4994: 
1987 Specification for Design and Construction of Vessels and 
Tanks in Reinforced Plastics. 
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Figure 22.22 Simulation of liquid behaviour following the failure of a single wall storage tank inside a low bund 
(Trbojevic and Slater, 1989): (a) time t= 0 s; (b) t= 1.5 s; (c) t= 2.5 s; and (d) t=4.0s (Courtesy of the American 
Institute of Chemical Engineers) 


GRP tanks and vessels are widely used to store corrosive 
materials. In addition to good corrosion resistance, they 
have the further advantage that they are readily fabricated 
into complex shapes. GRP does not suffer from external 
corrosion and it can have a suitable self-colouring. These 
factors minimize the maintenance costs of GRP storage. 

However, GRP tanks are not without their hazards. In 
a small but significant number of instances tanks have 
failed. Some of these have been outright, or catastrophic, 
failures which have released the entire contents. The result¬ 
ant tidal wave of liquid is capable of demo-lishing a bund 
wall, or, if the tank is indoors, a building wall. 

GRP is subject to creep under sustained load, it is sus¬ 
ceptible to chemical attack and some types may fail at 
temperatures below 100°C. 

Typically, a GRP tank failure is due to environmental 
stress cracking in which the tank is subjected to excessive 
stress and crack propagation occurs, at first slowly and 


then with increasing rapidity. Prior to failure the tank often 
exhibits leaking or ‘weeping’. 

Resin rich layers are used to protect the glass reinforce¬ 
ment. Matrix cracking can expose the glass fibres to 
chemical attack. 

Another cause of failure is excessive temperature. There 
have been cases where a GRP tank containing water has 
failed at 70°C. 

As a material of construction, GRP has a number of fea¬ 
tures which distinguish it from steel. One is that it is ani¬ 
sotropic and thus has different strengths in different 
directions. The degree of difference depends on the fabri¬ 
cation, but it can be significant. Compared with steel, GRP 
is softer, it can only withstand much lower temperatures 
and it has a lower impact resistance but a coefficient of 
expansion three times higher. 

Different GRP formulations are required for the con¬ 
tainment of different chemicals. With an incorrect material 
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deterioration can be caused by even small traces (ppm level) 
of impurity. This has obvious implications for the change of 
use of tanks and for the use of second-hand tanks. 

GRP tanks are often provided with liners. 

PM 75 describes the salient features of safety in the use 
of GRP storage, covering design, fabrication, installation 
and operation. 

Design and fabrication should be to BS 4994:1987, which 
grades GRP containments into three categories, Categories 
I III. The strictest requirements are those for Category I, 
the application of which is governed by factors which 
include size, operating conditions and hazards. 

Important features of the design are the use of the 
correct material and the limitation of the liquid tempera¬ 
ture. PM 75 advises that the operating temperature 
should not exceed the design limits and should be no higher 
than 110° C. 

The purchaser of a GRP tank should supply the manu¬ 
facturer with a full specification of the tank duty. PM 75 
reproduces from BS 4994 an appendix giving the sug¬ 
gested information. 

Design and installation should ensure that the tank is not 
overstressed by providing good support for both the tank 
itself and the attached pipework. Care should be taken to 
avoid damaging the tank during erection. 

In-service the tank should be subject to periodic 
inspection. Inspection techniques used include: ultra¬ 
sonics to assess wall thickness, etc.; acoustic emission 
monitoring to detect defects; spark testing of welds and 
liner adhesion; and surface hardness testing and strain 
measurement. 

22.24 Filling Ratio 

The maximum permissible working capacity of a storage 
vessel, or permissible fill, is generally expressed either in 
terms of the filling ratio or of the maximum permissible 
volume. Other measures used are the filling density and 
the filling volume. 

Filling ratios for transport of liquefied gases by road in 
the United Kingdom are given in BS 5355:1976 Specifica¬ 
tion for Filling Ratios and Developed Pressures of Liquefiable 
and Permanent Gases. This standard gives formulae for the 
determination of the filling ratio, guidance on reference 
temperature for the United Kingdom and on maximum 
shade temperatures in other countries, and values of the 
filling ratio for the United Kingdom. It is considered fur¬ 
ther in Chapter 23. The formula used to calculate the filling 
ratio is generally of the form 

>7 = ^(1[22.24.1] 

where r\ is the filling ratio, p p is the density of the liquid 
at the reference temperature, p w is the density of water at 
15°C and <p is the fractional free space. The formula 
may also include a term for the confidence limits on the 
density of the liquid. The reference temperature is the 
maximum temperature which the product should reach 
in-service. 

For the United Kingdom, BS 5355: 1976 gives for low 
pressure liquefiable gases in vessels of volume greater than 
5 m 3 a reference temperature of 38°C. The corresponding 
shade temperature is given as < 35°C. 

Filling ratios for LFG storage vessels are given in the ICI 
LFG Code. The Code takes for LFG a free space of 3 % and a 


reference temperature of 38°C for vessels over 5 m 3 . This 
yields the following filling ratios: 

Propane 0.46 

Propylene 0.47 

w-Butane 0.54 

Vinyl chloride 0.85 

A formula for the maximum filling capacity of LPG sto¬ 
rage vessels is given by the LPGA (1991 COP 1). This is 

U ma x = 0.97 — V [22.24.2] 

gt 

where gi is the specific gravity of the liquid at the reference 
temperature, g t is the specific gravity of the liquid at its 
lowest likely temperature at filling, ?7 max is the maximum 
permissible volume and V is the internal volume of the 
vessel. The lowest likely temperature at filling is usually 
taken as 5°C. 

It should be noted that while in Equation 22.24.1 the 
denominator is the density of water at 15°C, in Equation 
22.24.2 it is the density, or rather specific gravity, of the 
liquid in question at the filling temperature. 

Guidance on filling density is given for LPG in NFPA 59 
and for LNG in NFPA 59 A Guidance on the filling ratio for 
chlorine is given in the CIA Chlorine Code. 

22.25 Loading and Unloading Facilities 

Closely associated with bulk liquid storage are the 
arrangements for the loading and unloading of road 
tankers and rail tank cars. An appreciable proportion of 
accidents occur in the unloading and loading facilities. 

Guidance on loading and unloading facilities is given 
for petroleum products in NFPA 30, the IP Refining Safely 
Code and HS(G) 50 and HS(G) 52; for LPG it is given in 
NFPA 58 and 59, the LPGA LPG Storage Code, the IP LPG 
Storage Code and HS(G) 34; and for toxic materials in 
general in the CCPS HTHM Storage Guidelines, for 
ammonia in HS(G) 30 and for chlorine in HS(G) 28. HAC is 
covered in the IP Area Classification Code. Further guid¬ 
ance is given by the Oil Industry Association (OIA, Pub. 
711) and in the ICI LPG Code. 

The account given here is concerned with the loading 
and unloading facilities associated with bulk storage in the 
main process industries, essentially at sites where the 
facilities and systems of work are those that are normal in 
these industries. It does not deal with facilities at small 
sites such as petrol filling stations. 

It is convenient to consider first facilities in general 
terms, but with reference essentially to road tanker facil¬ 
ities for petroleum products, and then to deal with aspects 
specific to rail tankers and to particular chemicals. 

22.25.1 Hazards 

Before considering the facilities as such, it is worth 
reviewing some of the hazards which are characteristic of 
unloading and loading facilities. There are four broad 
categories of hazard at a tanker terminal. These are fire/ 
explosion from leaks and spillages, fire/explosion of pro¬ 
duct in the tanker, toxic release and accidents arising from 
the transfer of the wrong products. 

These hazards arise from: (1) overfilling of the container; 
(2) failure of the connection; (3) damage caused by 
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movement of the vehicle itself; (4) vehicle movement whilst 
connected; (5) damage caused by impact by other vehicles; 
(6) ignition by static electricity; (7) equipment failures; 
(8) misidentification and (9) maloperation. 

Overfilling of the tank during loading of the storage 
vessel is one of the most common accidents at such facil¬ 
ities, as witnessed by the extent of the measures taken to 
counter it. The temporary connections between the tank 
and the storage are a weak link, and again attract much 
effort to maintain their integrity. A particular cause of 
failure with some connections is a lack of flexibility to 
accommodate the normal movement of the tank on its sus¬ 
pension during the transfer operation. 

Damage may be done to the fixed plant or to the vehicle 
itself as it moves to and from the loading bay. Releases also 
occur due to the movement of the vehicle whilst still con¬ 
nected to fixed system. This occurs most commonly when 
the vehicle is driven off, but other causes can be an unse¬ 
cured vehicle on unlevel ground or impact by another 
vehicle. Impact by another vehicle may also lead to a release 
due to the rupture of the connections. 

Any of the releases described may result in a fire, or 
occasionally an explosion. Another cause of fire/explosion 
is ignition of a flammable mixture in the tank of the 
vehicle. 

22.25.2 Fire and explosion 

A fire/explosion of the product during top loading con¬ 
stitutes a serious problem. The type of product which is the 
most hazardous is one which gives a flammable mixture in 
the vapour space. Liquids which give a lean mixture below 
the lower limit or a rich mixture above the upper limit of 
flammability are less troublesome. 

Ignition of the product is usually due to static electricity. 
This may be generated if the liquid is allowed to fall free 
and splash from the filling pipe into the tank, so it is normal 
practice to position the tip of the filling pipe near the bot¬ 
tom of the tank. But charge may be generated at the start of 
the filling before the pipe is fully submerged. It is also 
possible for the liquid to acquire a charge before it reaches 
the tank. Build-up of charge due to flow in the pipe itself is 
usually not critical, but product filters with cotton, paper or 
felt elements are prolific generators of static electricity. It 
has usually been considered that a relaxation time of 30 s 
between the filter and the outlet of the filling pipe is 
necessary to dissipate this charge. Moreover, there has 
been a trend to purer, drier products for which the relaxa¬ 
tion time tends to be in the range 100-500 s. A fuller 
account of the hazard of ignition by static electricity, 
including the specific case of tanker loading, is given in 
Chapter 16. 

Fire/explosion also occurs due to spillage. Hose spillages 
are particularly frequent. Often they occur because a 
tanker is driven away from the gantry with the hose still 
connected. Also, hoses may burst because they are not 
strong enough. 

22.25.3 Switch loading 

A particularly hazardous situation occurs when a less 
volatile product is put in a tank which previously contained 
a more volatile one. This hazard is described by the OIA. 
There is often a tendency for the residue of the latter to form 
a flammable mixture, while the former does not readily 
dissipate static charge. According to the OIA, such ‘switch 
loading’ has accounted for some 70-80% of severe losses 


at loading bays. These appear to occur most often when 
compartments are one-quarter to one-third full and when 
temperatures are close to SOT (-1°C). 

The IP Refining Safety Code states that, wherever pos¬ 
sible, switch loading should be avoided. 

22.25.4 Siting 

Since loading and unloading facilities are areas of rela¬ 
tively high risk, their siting is important. A suitable 
approach is to locate the facility on the far side of the stor¬ 
age from the process, where this is practical. The location 
should also be chosen to allow good access for the vehicles 
to be loaded or unloaded, but to be as free as possible from 
any form of interference, particularly from other vehicles. 
Siting is considered in more detail in Chapter 10. 

22.25.5 Layout 

The layout of the loading and unloading facilities can make 
a major contribution to the elimination and minimization of 
incidents. Some aims of layout are to avoid releases, to 
minimize the size of any release, to prevent the ignition of a 
release, and to control any fire from an ignited release. 

Some features of layout which contribute to these aims 
include: (1) minimum separation distances, (2) the general 
form of the loading/unloading bay, (3) ground slope and 
drainage, (4) ventilation, (5) access and escape, (6) lighting, 
(7) routing of pipelines, (8) protection against vehicle 
impact, (9) control of movements of vehicles, (10) control of 
the movement of personnel, (11) vessel, connection and 
equipment identification, (12) direct lines of sight, (13) con¬ 
trol of ignition sources, including HAC, (14) fire protection 
and (15) emergency equipment. 

Minimum separation distances for the loading and 
unloading facilities for particular materials are given in the 
codes for those materials, as described in Section 22.26. 

There should be sufficient space so that congestion is 
avoided. It is desirable that vehicles are able to drive in and 
out without reversing. The ground at a loading/unloading 
bay should be firm and impervious. At the filling point it 
should slope away so that spillage does not collect under 
the tanker and there should be suitable drainage. Where 
top loading is practised, there should he a platform with 
good access, including access to the top of the tanker, and a 
means of escape. The facility should be well ventilated 
and well lit. 

The layout should assure protection both of the fixed 
equipment and of the tanker from impact by another vehi¬ 
cle. Attention should be paid to the routing of pipelines 
connected to the facility. Damage from vehicles can largely 
be avoided by the provision of high kerbs around the load¬ 
ing island and also of barriers to protect equipment and by 
controlling the movement of vehicles. It may also be 
necessary, particularly where other persons may be pas¬ 
sing, to provide barriers or other means to control vehicle 
movements. 

Storage vessels, filling connections and other equipment 
such as pumps should be provided with a means of identi¬ 
fication. The layout should provide direct lines of sight so 
that personnel conducting transfer operations can observe 
the effects of their actions. 

Where a fire hazard exists, the control of ignition sources 
should be exercised through HAC and fire protection facil¬ 
ities should be provided. The HAC of loading and unload¬ 
ing facilities is considered in Section 22.25.6 and fire 
protection is discussed in Section 22.25.11. 
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Emergency equipment appropriate to the material han¬ 
dled should be available at the facility. 

There should be arrangements at a filling point to run 
part or all of tanker’s contents back to the storage vessel if 
necessary. 

22.25.6 Hazardous area classification 

Loading and unloading facilities are among the cases dealt 
with by the method of direct example in the IP Area Classi¬ 
fication Code, which covers petroleum products. The code 
gives detailed recommendations for the HAC of road and 
rail transportation, dealing separately with loading and 
unloading, including the unloading of road tankers at pet¬ 
rol filling stations. The Code gives some ten figures show¬ 
ing the HAC zoning in plan and elevation for different 
facilities and situations. 

Further guidance on the HAC for petroleum products is 
given in NFPA 30 and guidance on the HAC for LPG is 
given in HS(G) 34 and NFPA 58 and 59. 

22.25.7 Filling arrangements and connections 

There are three main types of connection used for the 
transfer of liquids between the fixed facility and the tank of 
the vehicle.These are (1) flexible hoses, (2) articulated arms 
and (3) flexible couplings. A description of the three types 
of system as used for chlorine is given in HS(G) 28. 

Connection is frequently by means of a hose. Articulated 
arms with swivelled joints are used on installations with a 
high throughput. Flexible couplings are used for certain 
products such as chlorine. 

Good practice in respect of hoses is illustrated by the 
guidance given in HS(G) 34 on flexible hoses for LPG. A 
hose should be designed and made to an appropriate stand¬ 
ard such as BS 4089; it should be suitable for the product 
to be handled; it should he provided with means of identi¬ 
fication; it should be protected both in respect of its end 
fittings against damage and ingress of foreign matter and, 
where necessary, in respect of external damage, using 
a procoil or similar device; it should be subject to a full 
system of maintenance and test, including inspection 
records, annual hydraulic testing, periodic examination 
for kinks, weakness and end fitting deterioration and 
electrical discontinuity; and it should be kept in a safe place 
when not in use and replaced or repaired when worn or 
damaged. 

The filling of tankers is carried out through a pipe in the 
top or in the bottom of the tank, that is by top or bottom 
loading. Top loading is often done by a rigid arm system and 
bottom loading by a hose. Pipes should be arranged so that 
the line between the tanker and the plant can be emptied 
before the tanker is uncoupled. Incidents sometimes occur 
due to a failure of the hydraulic system on a filling arm 
which causes it to drop and foul a tanker, and a locking 
device should be provided to prevent this. 

Vapour recovery systems are becoming more widely 
used, mainly to meet pollution requirements. These sys¬ 
tems have a filling arm which makes a gas-tight fit over the 
tank hatch, a short pipe which gives splash filling and a 
float switch which cuts off the flow when the tank is full. 
There is a separate vapour line which goes to a compressor 
and gasholder. Loss experience with these devices is good. 

22.25.8 Shut-off arrangements 

There are measures which can be taken to avoid overfilling 
and a number of devices which can be used to effect rapid 


shut-off if a leak occurs due to overfilling, failure of a filling 
connection or otherwise. 

These include (1) vessel identification, (2) vessel sizing, 
(3) ullage control, (4) pre-set filling meters, (5) pump trips, 
(6) high level alarms, (7) dead man’s handle arrangements, 
(8) non-return valves, (9) excess flow valves, (10) remotely 
operated isolation valves, (11) remote control of pumps and 
(12) self-sealing couplings. 

The marking of vessels to ensure correct identification is 
one elementary measure to prevent releases. The use of a 
storage vessel with a capacity at least that of the largest 
tanker from which transfer may be attempted is another: 
this is particularly important for chlorine facilities. Atten¬ 
tion to the ullage in the container to which transfer is to be 
made is a third. 

A pre-set filling meter may be used to ensure that the 
quantity transferred does not exceed the capacity of the 
container. The filling pump may be provided with a trip to 
stop the pump and preferably close a shut-off valve when 
the pre-set quantity has been delivered. There may also be a 
manual control for the pump and the shut-off valve at the 
loading point. On storage a high level alarm may be pro¬ 
vided to warn if overfilling is occurring. 

An arrangement which guards against an operator 
starting the filling and then having his attention diverted 
elsewhere is the use of a spring-loaded self-closing filling 
valve which remains open only as long as the operator’s 
hand is on it, that is a dead man’s handle valve. 

Means are available for cutting off flow from a damaged 
or disconnected connection, for example non-return valves, 
excess flow valves and remotely operated isolation valves. 

Whatever the other arrangements, means should be 
provided for stopping all pumps immediately if an incident 
occurs. This should be a manual control in an attended 
terminal and an automatic one in an unattended one. 

As described below, another means of shutting off a leak, 
applicable to the case where the vehicle moves away whilst 
still connected, is the use of a self-sealing coupling. 

22.25.9 Vehicle control 

Likewise, there are a number of methods which can be used 
to prevent a vehicle from moving away whilst it is still 
connected to the fixed plant by a filling connection, and 
thus causing a release. These mostly involve some form of 
interlock. There are also devices to shut-off flow. 

The measures used differ somewhat between road and 
rail, and those described here are those applicable to road 
tankers. The ground at the filling point should be level and 
chocks should be used to hold the tanker in position. 

Movement of the vehicle may be prevented by the use of 
an interlock system. One method is the use of an inter¬ 
locked barrier. Another is an arrangement which locks the 
vehicle’s braking system when the delivery hose is taken 
from its stowage position and releases the system only 
when the hose is restowed. A third is a brake flap arrange¬ 
ment which must be moved aside to gain access to the fill¬ 
ing branch, the action of which actuates the vehicle’s 
braking system. 

Flow may be cut off if the tanker moves by use of a self¬ 
sealing breakaway coupling. Other emergency shut-off 
devices have already been described. 

22.25.10 Static electricity control 

There are various precautions which may be taken against 
the hazard of ignition of product by static electricity 
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An account of these measures is given by the OIA. 
Two measures which it considers very desirable, although 
they are not generally adopted, are the complete elimina¬ 
tion of switch loading and the use of inerting of the tank 
during filling. The latter tends to be rather expensive and 
time-consuming. 

Measures which are normally taken are earthing and 
bonding to dissipate static charges on the metal contain¬ 
ment. The filling pipe, the product line and the gantry 
should be electrically continuous and earthed. The elec¬ 
trical resistance of the gantry should not exceed 10 4 fi and 
should be checked periodically 

Bonding involves connecting the product line to the 
tank. This prevents static discharge between the filling 
pipe and the tank. It is usually done using a wire with alli¬ 
gator clips. It is considered adequate if the electrical resist¬ 
ance of the bond does not exceed 10 6 fi. The bond should be 
inspected and its electrical resistance checked periodically. 
The bond should be such as to avoid damage if the vehicle is 
driven off before the bond is disconnected. Devices which 
drop down from the gantry to touch the tank are not con¬ 
sidered effective for bonding. 

As mentioned in Chapter 16, however, it may be desirable 
to aim for lower electrical resistances than those just quoted 
in order to ensure that the latter are reliably achieved. 
The bonding should be attached before the filling pipe is 
inserted into the tank and it should remain in place until 
the operation is completed. 

However, earthing and bonding do not immediately dis¬ 
sipate the charge on the surface of a non-conducting liquid 
in the tank. A relaxation time should be allowed after filling 
has been completed and before the filling pipe is with¬ 
drawn, to permit static charge on the liquid surface to dis¬ 
sipate to the pipe or tank shell.The minimum time is 1 min, 
but longer periods are advisable with some products, as 
indicated above. 

Where switch loading is practised, there are various 
additional precautions which may be taken. These include 
the use of inerting, low filling rates, special filling tips and 
static neutralizing devices, and longer relaxation times. 
The initial filling rate should be 3 ft/s maximum, rising to 
15 ft/s when the filling pipe outlet is fully submerged. 
Special filling pipe regulator tips are available to give this 
initial flow limitation. Static neutralizers may be installed 
in the product line. Longer relaxation times may be allowed 
before withdrawing the filling pipe. 

Bottom loading does not eliminate the static electricity 
hazard, particularly in switch loading, and still requires 
earthing. 

With vapour recovery systems, splash filling would 
theoretically appear to increase the hazard on switch load¬ 
ing. The OIA therefore recommends against their use in 
switch loading situations. 

22.25.11 Fire protection 

A loading/unloading facility should be provided with 
appropriate fire protection. The arrangements depend on 
the particular installation and especially on the product 
transferred, the amount of material and the number of 
tankers handled, the location of the terminal, and the 
potential for damage and business interruption. 

Fixed water sprays may be provided to cool tankers at 
filling points. The failure of tankers in a fire can be rela¬ 
tively rapid. The OIA makes recommendations for fixed 
sprays of water, foam or dry chemicals for terminals for 


flammable liquids. It is particularly concerned with auto¬ 
matic systems for unattended terminals. It suggests that 
fixed sprays should be located both in the roof and along 
the loading island so that extinguishing media can be 
directed under tankers. For fixed water sprays, a rate of 
application of 0.25 USgal/ft 2 min over the whole loading 
area is recommended. 

The ICI LPG Code recommends fixed water sprays 
for terminals handling more than one tanker simulta¬ 
neously or more than four tankers per day. The rate of 
application of water should be 0.2 UKgal/ft 2 min of tank 
surface. In multi-hay installations, there should be 
arrangements to control the sprays selectively. Automatic 
operation is not essential, as it is assumed that the terminal 
is manned during transfer operations. 

The Code also states that if fixed water sprays are not 
provided there should be fire hydrants capable of the same 
rate of application of water, but that if fixed sprays are 
installed the hydrant capacity can be reduced by 50%. 

For LFG fires the method of extinction is to cut off the 
supply of fuel. Water from spray nozzles may be used to cool 
tankers and equipment, particularly to prevent direct 
flame impingement, to bend flames away from equipment 
and to cool the flames themselves. But putting water 
directly on an LFG spillage has the effect of increasing the 
evaporation rate and this generally makes the fire worse. In 
addition, it is undesirable to extinguish an LFG fire with 
water because of the danger of a subsequent explosion. 
Water should not be used, therefore, on LFG fires, except 
for very small spillages. Foam may he used to limit the 
evaporation rate, but it will not normally extinguish a fire 
and, as just stated, it is not desirable that it should. 

Portable fire extinguishers and sand should be provided 
for dealing with small spillages or vehicle fires. 

Drains should be provided which will handle flammable 
liquids and fire water, along the lines previously described. 

Electrical cabling should be routed outside the high 
risk areas of the terminal or should be protected so that 
emergency services are maintained and any subsequent 
interruption minimized. 

It is desirable that the tanker at a terminal have some 
degree of fire resistance. There are large aluminium tankers 
which may fail within only 1 min when exposed to intense 
ground fires and these represent a serious hazard. 

The OIA draws attention to the increase in the number of 
unattended or ‘keystop’ terminals for flammable liquids. In 
such terminals there are problems of damage to loading 
equipment, of a lack of supervision of loading practices and 
of the absence of personnel to control fires. 

22.25.12 Rail facilities 

Most of the features of loading and unloading facilities for 
road apply also to rail, but there are some which are char¬ 
acteristic of the latter. 

Rail tracks should be laid straight and level, though a 
small gradient can be tolerated. HS(G) 52 gives a limit of 1 in 
400. The track and line-side equipment should be main¬ 
tained to the appropriate British Rail standard. 

There should be arrangements for the control of loco¬ 
motives whilst filling is in progress. 

There should be earthing and bonding to dissipate the 
static charges. Rails should be bonded together and to the 
product lines. A separate bond to the tank is necessary only 
if the earthing between the tank and the rails via the wheels 
is inadequate. 
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Stray currents constitute an additional hazard. These 
may arise from electrified main line tracks, rail circuit sig¬ 
nal systems or cathodic protection systems. If the siding is 
part of an electrified system, it should be electrically iso¬ 
lated from the rest of the system and bonded to the site main 
earth. Precautions which may he necessary against stray 
currents are insulating inserts in the rails where they enter 
and leave the loading siding and an insulating flange 
between the product line and the filling pipe together with 
a flexible bond between the rail tank and the filling pipe. 

22.25.13 Operation 

As with other aspects of process installations, the safety of 
loading and unloading facilities depends as much on 
operation as on design. 

A significant issue is the manning of the facility, which 
tends to vary and which has more than one aspect. One is 
control of the transfer. In some cases transfer is conducted 
by plant personnel and in others by the driver of the tanker. 
Another aspect is the back-up available if something goes 
wrong, such as the outbreak of a fire or a toxic release suf¬ 
ficient to overcome the person effecting the transfer. 

Safe systems of work should be provided and enforced 
which cover all aspects of the operation, from the identifi¬ 
cation of materials, vessels, connections and equipment, 
through the transfer operations themselves, to the emer¬ 
gency procedures. 

There should be a good standard of housekeeping at the 
facility. 

During filling all ignition sources should be excluded 
from the area of the filling point, including road or rail 
traffic. The engines of road tankers should be turned off. 

22.26 Loading and Unloading Facilities: Particular 
Chemicals 

22.26.1 Petroleum products 

As stated above, guidance on the loading and unloading 
facilities for petroleum products is given in NFPA 30, the IP 
Refining Safety Code and HS(G) 50 and HS(G) 52, and also 
by the OIA. 

The account already given has been based largely on 
facilities for petroleum products and these may therefore be 
treated briefly. Features specific to such products given in 
the guidance just mentioned include: minimum separation 
distances; HAC; top and bottom filling arrangements; 
spillage disposal arrangements and fire protection. 

22.26.2 LPG 

For the loading and unloading facilities for LPG, guidance 
is given NFPA 58 and 59, the LPGA LPG Storage Code, the 
IP LPG Storage Code and HS(G) 34, and also in the ICI 
LFGCode. 

For LPG, the requirements for minimum separation dis¬ 
tances are different. Particular importance attaches to the 
arrangements for the control of ignition sources, including 
the control of static electricity; HAC and fire protection. 
The discussion of fire protection in Section 22.25 covers 
LPG facilities. 

22.26.3 High toxic hazard materials 

Guidance on the loading and unloading facilities for 
HTHMs is given in the CCPS HTHM Storage Guidelines. In 
essence, the Guidelines cover ground similar to that just 
considered, both in respect of the hazards and the meas¬ 
ures taken to control them, at least as regards loss of 


containment, though the hazard from the flammability of 
the material may not apply. It is worth emphasizing, how¬ 
ever, that the points which do apply do so with particular 
force to HTHMs and that for such materials the standards 
of integrity required are high. 

The Guidelines point out that in the case of loading and 
unloading facilities it is not possible to apply the philoso¬ 
phy of secondary containment. 

With toxic materials even the small release which occurs 
as the tank is filled with a high vapour pressure liquid may 
be unacceptable. In such cases use should be made of a dual 
transfer line system, with one line used for transfer of 
liquid to and from the container and the other line used for 
venting vapour during filling. 

22.26.4 Chlorine 

Guidance is given on the unloading facilities for chlorine in 
HS(G) 28. Some specific aspects include potential inci¬ 
dents, minimum separation distances, filling connections, 
padding gas arrangements and systems of work. 

For chlorine, flexible couplings are the normal method of 
connection and HS(G) 28 gives details of their use. Methods 
of transfer of liquid chlorine described in HS(G) 28 are the 
use of dry compressed air or nitrogen or of chlorine vapour, 
obtained by recompression or vaporization. 

The system of work should ensure that one person, the 
driver, is present throughout the unloading, and that a 
second is present during connection and disconnection and 
is available throughout the unloading operation. 

22.26.5 Ammonia 

General guidance on the handling of ammonia is given in 
HS(G) 30, but this does not give guidance on loading and 
unloading facilities comparable with that for chlorine just 
described. 

Some of the issues arising in relation to loading facilities 
for ammonia are discussed by Lichtenberg (1987) the use of 
meters vs scales; the use of hoses vs articulated arms; 
blowing off vs the use of integral blowdown systems; and 
loading by the driver or by plant personnel. 

Articulated systems include vertical articulated arm 
systems and also compact horizontal articulated arm sys¬ 
tems with integral blowdown. 


22.27 Drum and Cylinder Storage 

Another type of storage is storage in drums and similar 
containers and in cylinders. Although such storage is, in 
principle, very simple, the hazards are not trivial. 

HSE guidance on drum and cylinder storage is given in 
CS 4 The Keeping of LPG in Cylinders and Similar Contain¬ 
ers (1986), HS(G) 40 Chlorine from Drums and Cylinders 
(1987) and HS(G) 51 The Storage of Flammable Liquids in 
Containers (1990). Another relevant code is Storage of Full 
and Empty LPG Cylinders and Cartridges (LPGA, 1967 
Code 7). 

22.27.1 Drum storage 

Chemicals are stored in containers at supplier and user 
sites in the chemical industry and at depot and warehouse 
sites. 

For flammable substances guidance is given in HS(G) 
51. This supersedes earlier guidance given both in CS 2 
and a Home Office code. HS(G) 51 does not cover reactive 
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chemicals such as organic peroxides, LPG or large 
containers. 

The containers considered in this guidance include 
drums, portable tanks and tank containers. Reference 
is made to containers of 200 1. A typical container in the 
United Kingdom is the standard 40 UKgal drum. 

Relevant British Standards on container construction 
are BS 814: 1974- for steel drums and BS 3951: Part 2: 
1978 - for freight containers. 

The general approach to drum storage is broadly as fol¬ 
lows. The preferred option is storage in the open. The stor¬ 
age should be in a defined area which should have an 
impervious surface and should be provided with a low 
bund or a drain and sump system. Where use is made of a 
bund, it is typically 150 mm high and should be large 
enough to hold 110% of the contents of the largest con¬ 
tainer. Within the storage area, the drums should be stored 
in stacks which should be marked off. The stacks should 
have good access and ventilation. There should be separa¬ 
tion distances between occupied buildings, the boundary, 
process units, flammable liquid tanks and fixed ignition 
sources. There should also be a maximum stack size. Guid¬ 
ance is given on maximum stack sizes and minimum 
separation distances to the objects mentioned and to LPG 
storage. The area around the storage should be free of 
combustibles and tidy. The area should be fenced off, with 
one or two access gates, depending on the size of the site. 
The storage should have a HAC as a Zone 2 area. Fire¬ 
fighting facilities should be provided. If there is difficulty 
in providing the separation distances recommended, some 
relaxation may be obtained by the provision of fire walls or 
fixed water sprays systems. 

Alternatively, storage may be in a separate building 
dedicated to that purpose or in a building used also for 
other purposes. The latter case requires additional fire 
resistant construction, particularly fire walls. A building 
used for such storage is essentially a warehouse, to which 
consideration is given in the next section. 

Further guidance on drum storage is given by two 
anonymous authors (Anon., 1979 LPB 27, p. 68); Anon. 
(1979LPB28, p.115). 

22.27.2 Cylinder storage 

As for other containers, chemicals are stored in containers 
at supplier and user sites in the chemical industry and at 
depot and warehouse sites. 

For LPG guidance is given in CS 4. The basic principles 
are essentially the same as for drum storage, but there 
are differences of detail such as in the specific values of 
maximum stack size and minimum separation distances. 

22.28 Warehouses 

Warehouses constitute a quite different kind of storage. 
A wide variety of materials are stored in warehouses in 
many different forms. Material may be simply stored in a 
stockpile on the warehouse floor, but more often there are 
bays which hold discrete items such as paper, drums and 
spare parts. Chemicals in packages and drums are also 
stored in warehouses. 

The Dangerous Substances (Notification and Marking 
of Sites) Regulations 1990 (the NMS Regulations) create 
a requirement for the notification and marking of sites 
which has particular relevance to warehouses. Guidance is 
given in HS(R) 29 Notification and Marking of Sites. The 


Dangerous Substances (Notification and Marking of Sites) 
Regulations 1990 (HSE, 1990). 

HSE guidance on warehouses is given in HS(G) 51 The 
Storage of Flammable Liquids in Containers (1990), HS(G) 
64 Assessment of Fire Hazards from Solid Materials and 
the Precautions Required for their Safe Storage and Use 
(1991) and HS(G) 71 Storage of Packed Dangerous Substances 
(1992). Further guidance is provided in Guidelines for Safe 
Warehousing by the CIA (1990 RC28) (the CIA Warehouse 
Guide). 

Also relevant are NFPA 231: 1990 General Storage and 
NFPA 231C: 1991 Racked Storage of Materials. 

22.28.1 Regulatory requirements 

Sites which store large inventories of hazardous substances 
are covered by the NIHHS Regulations 1982 and CIMAH 
Regulations 1984. These regulations do not, however, apply 
to most warehouses. In a typical warehouse the quantity of 
any given chemical is below the threshold quantities which 
trigger these regulations. The necessity for the control of 
warehouses, however, has been highlighted by a number of 
incidents. The NMS Regulations 1990 were brought in to 
close this loophole. 

In particular, the regulations are intended to provide the 
fire services with information to assist them in setting 
priorities for the inspection of sites and to warn firefighters 
arriving at an incident of the presence of dangerous sub¬ 
stances. 

Regulation 4 defines dangerous substances as those listed 
in Part 1A2 of the Approved List of the CPL Regulations 
1984 and other substances with the characteristic proper¬ 
ties set out in Schedule 2, Part 1, of those regulations. 
Notification is required if the warehouse stores a total of 
25 te or more of dangerous substances. Regulation 5 gives 
requirements for access marking and Regulation 6 
requirements for location marking. 

There are a number of other pieces of legislation which 
are relevant to warehouses. In addition to those already 
mentioned, they include the Petroleum (Consolidation) Act 
1928 (P(C)A), the Fire Precautions Act 1971, the Highly 
Flammable Liquids and Liquefied Petroleum Gases Regu¬ 
lations 1972 (HFLR), the Safety Signs Regulations 1980, the 
Control of Pesticides Regulations 1986, the Control of Sub¬ 
stances Hazardous to Health Regulations 1988 (COSHH) 
and the current Building Regulations. 

22.28.2 Management system 

For the most part the companies which operate warehouses 
handling chemicals are not in the mainstream of the 
chemical industry and its culture. The operation of a chemi¬ 
cal warehouse nevertheless demands a management sys¬ 
tem essentially similar to that in the industry. 

Specifically, the management system should ensure 
that among other things there are formal systems which 
cover the identification, assessment and control of hazards; 
the use of suitable buildings; the storage and segregation of 
chemicals; the provision and maintenance of fire protec¬ 
tion and the use of and training in suitable operating 
procedures. 

The responsibilities of those involved in warehouse opera¬ 
tion are outlined in the CIA Warehouse Code, which covers 
the supplier or owner of the goods, the warehouse keeper, 
the warehouse supervisor and the warehouse employee. 

An essential aspect of the management system is good 
communications. 
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22.28.3 Warehouse siting and layout 

The siting of warehouses is often far from ideal. Many 
existing warehouses are located in a built-up area and close 
to housing. Siting of new warehouses should be such as to 
minimize the risks to the surrounding area. Likewise, these 
risks should be taken into account when considering an 
extension to an existing warehouse. Fire and explosion are 
the events which are most likely to present a threat to the 
surrounding population. 

Many warehouses are located on waterways where they 
serve as transit points. This increases the risk of pollution of 
these waterways by chemicals released during an incident. 

The layout of the warehouse site should be such as to 
facilitate the movement of vehicles that are unloading or 
loading, with adequate access and parking. The layout 
should aim to minimize collisions and to allow incidents 
such as spillages or small fires to be readily dealt with. 

The layout should also assist security. Access should be 
gained only through access gates. Each separate ware¬ 
house building should he capable of being securely locked. 

22.28.4 Warehouse buildings 

The construction of a warehouse building is subject to the 
Building Regulations. For industrial storage buildings 
there is an approved document which sets out standards for 
compartment size and fire resistance. 

Some high fire hazard substances require separation 
distances between the building and the boundaries in 
excess of those specified in the Building Regulations. 
These include flammable liquids, oxidizing substances 
and organic peroxides. 

A warehouse for dangerous substances should pre¬ 
ferably be constructed in non-combustible materials. 
Where flammable substances are involved there may be 
specific regulatory requirements for fire resistance. 

Guidance on warehouse building construction is given in 
the CIA Warehouse Guide. This guidance is intended to 
illustrate the approach which might be taken by a chemical 
company in constructing a new facility. The code deals with 
(1) frame, (2) infill, (3) floors, (4) roof, (5) ventilation, 
(6) drainage, (7) emergency exit doors, (8) internal doors, 
(9) internal partitions, (10) wall and roof linings, (11) fire 
protection, (12) special facilities, (13) lighting and (14) elec¬ 
trical installations. 

Where the dangerous substances stored are liquids, 
floors should be impervious and resistant to the liquid. 
There should be bunds to contain the liquid and sills to 
prevent its spread through doorways. In areas where the 
risk of spillage is high, there should be a separate drainage 
system with sloped floor, a bund and a collection sump. 

Rainwater should be taken away from the roof and out¬ 
side areas in drains with roof downpipes sealed at ground 
level. The drainage arrangements should aim to prevent 
contamination of surface water by water used in fighting a 
fire in the warehouse. 

22.28.5 Material identification 

There should be a formal system for the identification and 
tracking of the dangerous substances handled. The system 
should be based on the classification systems for danger¬ 
ous substances. Most such substances arriving on site will 
be marked with the conveyance labels specified in the 
Chemical Hazard (Information and Packaging) Regula¬ 
tions (CHIP) and goods in international transit should be 
labelled with the United Nations labels. The supplier should 


normally provide in addition the information required 
under the CHIP supply labelling system. 

Some substances may require special storage conditions. 
These should be identified in advance by the supplier and 
accepted only if these conditions can be provided. Some sub¬ 
stances may degrade or become unstable during prolonged 
storage.These too shouldbeidentified by the supplier. 

All dangerous substances should be identified on receipt 
and their storage in and transfer from the warehouse 
documented. The documentation system should ensure 
both that records are made and that they are held securely. 

22.28.6 Material segregation 

The most serious incidents occur when a small event esca¬ 
lates and involves large quantities of material. The main 
cause of this is fire. An effective means of preventing such 
escalation is the segregation of materials. 

One purpose of segregation is to separate dangerous 
substances from materials which may ignite or burn read¬ 
ily in the early stages of a fire. Another is to keep dangerous 
substances out of general storage where their presence is 
liable to aggravate the difficulties of firefighters. 

Table 22.12 is the segregation table given in HS(G) 71. It is 
based on the conveyance labelling requirements of the CPL 
Regulations and is compatible with the UN Recommen¬ 
dations for the Transport of Dangerous Goods. The table does 
not include Class 1, Explosives, Class 6.2, Infectious 
Substances, or Class 7, Radioactive Substances, which are 
covered by separate guidance. The numbers in the table 
refer to the segregation of different classes of substance on 
the same floor of a building. Vertical segregation between 
different classes of material is not accepted except where 
there is an imperforate floor/ceiling with 1 h fire resistance. 
The general guidance given in the table is overridden where 
there is advice specific to a particular class of material. 

The International Maritime Dangerous Goods Code may 
also be used as guidance, provided allowance is made for 
the different factors which apply to land storage. 

22.28.7 Mechanical handling 

Modern warehouses make full use of mechanical handling 
aids. There is also a trend towards automated warehouses 
under computer control. The mechanical handling facilities 
should accommodate the full range of packages to be 
stored, so that improvisation is avoided. Widespread use is 
made in warehouses of pallets and forklift trucks. Guid¬ 
ance on the use of forklift trucks is available (HSE, 1992 
HS(G) 6). Forklift trucks are also considered in Chapter 21. 

22.28.8 Storage operation 

There are a number of basic operating principles which 
should be covered by formal operating procedures. 

When a consignment is received, the substance should 
be identified and the integrity of the package should be 
checked. Damaged packages should not be accepted into 
store but dealt with by repacking or disposal. 

Each location should have a specified storage capacity 
which should be adhered to. There should be maximum 
stack sizes and heights. The heights should take into 
account the potential for damage to the packages at the 
bottom and for fire spread. The racking used should be well 
constructed and should not be overloaded. Goods should 
not be stored so close to a wall as to interfere with ventila¬ 
tion or in gangways so that they inhibit access. 
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Table 22.12 Segregation table for storage of dangerous substances in warehouses?(Health and Safety Executive, 
1992 HS(G) 71) (Courtesy of HM Stationery Office. © All rights reserved) 

To be read in conjunction 
with Appendix 1° 


Class 2 


Class 3 


Class 4 


Class 5 

Class 6 Class 8 

2.1 

2.2 

2.3 


4.1 

4.2 

4.3 

5.1 

5.2 


2 Compressed gases 

2.1 Flammable 

- 

1 

2 

2 

2 

2 

2 

2 

3 

1 1 

2.2 Non-flammable toxic 

1 

- 

1 

1 

0 

2 

0 

0 

2 

0 1 

2.3 Toxic 

2 

1 

- 

2 

1 

2 

1 

0 

2 

0 1 

3 Flammable liquids 

2 

1 

2 

- 

1 

2 

2 

2 

3 

1 1 

4 Flammable solids 

4.1 Readily combustible 

2 

0 

i 

i 

- 

1 

2 

2 

2 

1 0 

4.2 Spontaneously combustible 

2 

2 

2 

2 

1 

- 

1 

2 

3 

1 1 

4.3 Dangerous when wet 

2 

0 


2 

2 

1 



2 

0 0 

5 Oxidizing substances 

5.1 Oxidizing substances 

2 

0 

0 

2 

2 

2 

1 


2 

1 1 

5.2 Organic peroxides 

3 

2 

2 

3 

2 

3 

2 

2 

- 

1 1 

6 Toxic substances 

1 

0 

0 

1 

1 

1 

0 

1 

1 

0 

8 Corrosive substances 

1 

1 

1 

1 

0 

1 

0 

1 

1 

0 


a The table shows general recommendations for the separation or segregation of different classes of dangerous substance. 

The miscellaneous dangerous substances in UN Class 9 and other dangerous substances in CPL have quite varied properties and no general 
advice can be given regarding segregation. Advice should be obtained from the supplier. 
b Of HS(G) 71. 

Key: 

0 Separation may not be necessary, but suppliers should be consulted about requirements for individual substances. In particular, it should be 
noted that some types of chemicals within the same class may react violently, generate much heat if mixed or evolve toxic fumes. 

1 ‘Keep apart’. Separate packages by at least 3 m or one gangway width, whichever is the greater distance in the store room or storage compound 
outdoors. Materials in non-combustible packaging which are not dangerous substances and which present a low fire hazard may be stored in 
the 3 m space. At least this standard of separation should be provided between substances known to react together readily, if that reaction 

2 ‘Segregate from'. These combinations should not be kept in the same building compartment or outdoor storage compound. Compartment 
walls should be imperforate, of at least 30 min f ire-resisting construction and sufficiently durable to withstand normal wear and tear. Brick or 
concrete construction is recommended. An alternative is to provide separate outdoor compounds with an adequate space between them. 

3 ‘Isolate’. This is used for organic peroxides, for which dedicated buildings are recommended. Alternatively, some peroxides may be stored 
outside in fire-resisting secure cabinets. In either case, adequate separation from other buildings and boundaries is required. 

Where a particular material has the properties of more than one class, the classification giving the more onerous segregation requirements 
should be used. 

Note: The table is to be read in conjunction with the following paragraphs from the text of HS(G) 71. Paragraphs 20 and 21 explain the logic 
behind the table and paragraphs 13,15,22 and 23 give certain caveats. 

20 Often the first material ignited in a fire is not itself a dangerous substance. For this reason, stocks of combustible materials such as easily 
ignitable packaging should not be kept in store rooms with dangerous substances. Separate storage areas should be provided. Similarly, 
even small quantities of dangerous substances stored in a warehouse for general goods may seriously increase the consequences of any fire, 
and in particular add to the dangers for the fire brigade. Dangerous substances should preferably be stored in dedicated warehouses or 
compartments of warehouses which are effectively fire separated from the remainder of the building. 

21 The intensity of a fire, or its rate of growth, may be increased if incompatible materials are stored together. In addition, a fire may grow and 
involve dangerous substances which of themselves are not combustible. In this way, toxic materials may be widely dispersed.To prevent this 
type of escalation a system of segregation is necessary in warehouses storing dangerous substances. 

13 The conveyance labels alone do not give adequate information for all purposes associated with storage, and the supplier should normally 
provide at least the additional information required under the CPL supply labelling system. This includes standard risk and safety phrases. 
In most cases, drivers making deliveries of a dangerous substance are required to carry on the vehicle information about the hazards of the 
substance(s) being carried. This may be useful if safety data sheets are not already held for substances being delivered. 

15 On arrival, the contents of each consignment or individual packages should be checked, identified and assessed against the shipment 
documents to verify acceptability. Dangerous substances should usally be identifiable by the conveyance labelling attached to the outer 
layer(s) of the packaging, and for most purposes can be assesed accordingly. The additional information obtained from the suppliers may 
identify specific examples of non-compatibility, and storage location should take account of this. 

22 The table overleaf gives recommedations for the segregation of dangerous substances of different types. The classification scheme is based 
on the conveyance labelling requirements of the CPL Regulations, and is consistent with the United Nation Recommendations on the 
Transport of Dangerous Goods. The table excludes Classes 1, Explosives; 6.2, Infectious substances; and 7, radioactive substances for which 
guidnce is given elsewhere (see Appendix 3) b 

23 Numbers in the Table relate to segregation of different classes of substance on the same floor of a building. Vertical segregation between 
different classes of material is not acceptable unless provided by an imperforate floor/ceiling of at least 60 minutes’ fire-resisting con- 
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Stock held for a prolonged period should be inspected for 
degradation. Where a substance has a maximum storage 
time this should not be exceeded. If this is close to occur¬ 
ring, the advice of the manufacturer should be sought. 

There should be arrangements for dealing with spil¬ 
lages. This is partly a matter of building design, as already 
described, but it is also necessary to provide an absorbent 
and to have procedures for dealing with and disposing of 
the spillage. 

Where appropriate, an operation should be governed by 
a permit-to-work. 

22.28.9 Fire protection 

The fire potential in a warehouse is high. The fire load is 
very high and the conditions for fire spread are nearly 
ideal, there being large amounts of combustibles close 
together and with good air circulation. In fact a large pro¬ 
portion of fire loss in storage is due to warehouse fires. The 
prevention of fires in warehouses is therefore extremely 
important. 

Fire protection in warehouses includes the following 
measures: (1) building construction, (2) control of ignition 
sources, (3) fire detection systems (4) fire protection sys¬ 
tems and (5) operational measures. 

As already stated, the building should preferably be 
constructed in non-combustible materials and have a 
degree of fire resistance. The starting point is a concrete or 
steel frame. Other aspects of fire resistant construction are 
concrete protection of the steel supporting columns, 
separation of the arrival and dispatch areas from the 
storage area by fire resistant walls, and further separation 
by fire resistant walls within the storage area. 

Whereas in process plant handling flammables the first 
line of defence is to remove the fuel by keeping the flam¬ 
mable material contained, in a warehouse storing flam¬ 
mable substances the fuel is to hand. Hence close control 
needs to be exercised over ignition sources. 

The warehouse should be covered by HAC. Normally the 
appropriate classification is Zone 2 and the arrangements 
should then be such that no operation requires a more 
stringent classification. 

Forklift trucks are a particular potential ignition source 
which require control. Where a HAC applies, only trucks 
suitable for use in that area should be used. 

Fire detection systems are valuable in giving rapid warn¬ 
ing of a fire. Whether detection is followed first by warning 
to personnel and manual fire-fighting methods or by 
immediate activation of automatic fire protection systems 
such as sprinklers depends on the circumstances. Prob¬ 
lems with the latter include false alarms and water damage. 

Sprinklers are the principal form of fire protection device 
used and are generally effective. For high warehouses, 
sprinklers on the roof may be insufficient and they may 
need to be provided at lower levels as well. Sprinkler pro¬ 
tection is discussed further in Chapter 16. 

There should be a working discipline, essentially similar 
to that required in a process plant, which ensures that pro¬ 
cedures are observed. These include general good house¬ 
keeping, the avoidance of obstructions to corridors and 
fire doors and the elimination of ignition sources. 

The HSE has developed a test, described in HS(G) 64 
(HSE, 1991) and referred to as the HSE Test, which may be 
used to assess the need for particular forms of fire protec¬ 
tion. Details of the test are given by Wharton (1990). The test 
characterizes a material in terms of (1) the maximum rate of 


vent temperature rise and (2) the total smoke evolution. For 
each of these two features the material is placed in one of two 
hazard categories according to the following scheme: 


Category 

Temperature rise 

Smoke 


(°C/min) 

(m3 ODml) 

HIGH 

-S700 

>400 

NORMAL 

<700 

<400 


a OD, optical density - see Wharton (1990). 


In some cases it may be a condition of a fire certificate 
under the FPA (1971) that certain precautions be taken for 
the storage of a HIGH fire hazard material. In any event it is 
desirable that a HIGH fire hazard material should be stored 
in a separate area, either in a separate building, a single 
storey extension of the main building or in the open air. 
Where it is not reasonably practicable to store such a 
material elsewhere than in the main building, it should be 
stored in an area separated from the rest of the building by a 
30 min fire partition. A HIGH fire hazard material should 
not be stored in a basement or below an occupied floor. 
Exceptions to this are given in HS(G) 64 such as cases 
where the quantities are small or the risk is reduced by the 
type of packaging used or by some combination of spacing 
and active fire protection. 

The problem of fire protection in warehouses is complex. 
The discussion of the problem, in relation to automated 
high bay warehouses, by the FPA (1970/9) outlines some of 
the difficulties. 

Arson is a potential problem in warehouses. Guidance 
from the FPA also includes a treatment of the prevention 
and control of arson (1992 AR2). 

22.28.10 Hazard assessment 

Substances stored in warehouses may be hazardous 
by virtue of their being combustible, flammable, explosive, 
toxic, corrosive, unstable, reactive with air and/or water, 
pyrophoric or liable to spontaneous combustion or 
oxidizing. 

There should be a system for the identification of the 
hazards. A checklist approach may in large part fulfil this 
function. 

A hazard assessment should be performed, broadly on 
the lines of those made for process plant, but allowing for 
the characteristic features of warehouses. Initiating events 
may be associated with: liquid spillage due to leaks or the 
opening of valves; spillages of solid materials due to 
damage to packages or to repackaging operations; dust 
clouds; or small fires. Scenarios of escalation may include a 
major fire, a series of explosions, a release of toxic gases 
and vapour within the warehouse or beyond, a large smoke 
cloud (possible highly toxic) or the overflow of large quan¬ 
tities of contaminated fire water. 

22.28.11 Emergency planning 

There should be an emergency plan for the warehouse, 
adapting the basic principles described in Chapter 24 to 
warehouse conditions. The plan should be suited to the 
level of the assessed risk and should be developed in con¬ 
sultation with the local emergency services. Personnel 
should be trained in the plan and in their own role in it, and 
exercises should be conducted. 
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22.29 Warehouses: Particular Chemicals Storage 

There are certain chemicals which are stored in warehouses 
that merit particular consideration. 

22.29.1 Sodium chlorate 

Sodium chlorate is a crystalline solid which is relatively 
stable and is a strong oxidant. It has a melting point of 
248°C and starts to decompose at 265°C with the evolution 
of oxygen. 

Guidance on the storage of sodium chlorate is given in 
CS 3 Storage and Handling of Sodium Chlorate and Other 
Similar Strong Oxidants (HSE, 1985). This guidance also 
applies to the several other strong oxidants listed. 

There have been several warehouse fires, two of which 
are described below, in which the involvement of sodium 
chlorate has resulted in violent explosions. 

One hazard of sodium chlorate is that it may become 
involved in a fire and explode, as just described. Another 
is that it may become mixed with a readily oxidizable 
material, such as a fuel. Such a mixture can be ignited by 
relatively mild stimuli and can burn with explosive violence. 

Sodium chlorate should be stored in a secure and separate 
area. It should be segregated from combustible materials 
and contaminants should be excluded. Control should be 
exercised over ignition sources and measures should be 
taken to prevent the material becoming involved in a fire. 

Storage for sodium chlorate may be in the open on a 
concrete pad, with or without a roof, but should preferably 
be fully enclosed. Any structure should be built of non¬ 
combustible materials and the floor should be smooth, 
impervious and non-carbonaceous. CS 3 gives maximum 
stack sizes and minimum separation distances for the stor¬ 
age of sodium chlorate. 

Packaging of sodium chlorate is preferably in metal 
drums with a plastic liner. International agreements on 
transport also authorize the use of certain soft packaging 
materials such as flexible intermediate bulk containers. 

Wooden pallets should not be used for the routine hand¬ 
ling of sodium chlorate as they are liable to become 
impregnated with it, thus creating a fuel-oxidant mixture. 
CS 3 advises, however, that where wooden pallets do form 
an integral part of an International Maritime Organization 
(IMO) Code approved package and the wood is new, they 
may be allowed for one-off storage. 

In view of the fact that the fires in the two warehouse 
incidents described in Section 22.30.7 were caused by out¬ 
siders, security assumes particular importance in the sto¬ 
rage of sodium chlorate. 

22.29.2 Organic peroxides 

Organic peroxides are highly reactive and thermally 
unstable substances which undergo self-accelerating 
decomposition. They have oxidizing properties and some 
are also toxic. 

Guidance on the storage of organic peroxides is given 
in CS 21 Storage and Handling of Organic Peroxides 
(HSE, 1991). 

In the pure state some organic peroxides detonate. For 
commercial use organic peroxides are desensitized, but 
even so they are capable of runaway decomposition. Such 
decomposition may be caused by heating or contamination. 

The self-accelerating decomposition temperature 
(SADT) of an organic peroxide is determined by test. 
The SADT tends to decrease with package size. A control 
temperature is specified which is the maximum storage 


temperature, and an emergency temperature at which 
emergency procedures should be implemented. The rela¬ 
tionships between these two temperatures and the SADT 
are given in CS 3. Another aspect of temperature control is 
that in some cases an organic peroxide can separate out of 
solution if cooled, resulting in a concentrated peroxide 
which may be shock sensitive. 

Organic peroxides should be stored in the original con¬ 
tainers in a dedicated storage and segregated from other 
materials. They should be maintained within the specified 
temperature limits. Contaminants should be excluded. 

Further detailed guidance on the storage of organic 
peroxides is given in CS 3. They are classified into four 
flammability types, Types 1-4. A distinction is made 
between storages up to 150 kg and above 150 kg. Minimum 
separation distances are given. A list is given of packaged 
organic peroxides by flammability type. 

22.29.3 Ammonium nitrate 

Ammonium nitrate (AN) is a crystalline solid with a melt¬ 
ing point of 170°C which decomposes above 210°C. Most of 
the commercial material stored is some form of mixture. 

Guidance on the storage of AN is given in CS 18 Storage 
and Handling of Ammonium Nitrate (HSE, 1986). 

AN is an oxidizing agent. It is not itself combustible, but it 
can assist the combustion of other materials, even if air is 
excluded. It is insensitive to the friction and impact of normal 
handling, but it can be detonated under conditions of heat 
and confinement or by severe shock.The probability of explo¬ 
sion is much increased if the AN is mixed with organic matter. 
In a fire, molten AN may form and flow into areas, such as 
drains, where it becomes confined and/or contaminated, and 
it may then explode. Furthermore, when heated in a fire, AN 
gives off toxic fumes, mainly oxides of nitrogen. 

The main requirements in the storage of AN are to avoid 
heating or involvement in a fire, serious confinement and 
contamination. 

CS 18 makes a distinction between AN and AN fertilizers 
with<28% nitrogen and those with >28% nitrogen. It 
deals mainly with the latter. 

Storage of AN with >28% nitrogen should be in a dedi¬ 
cated building constructed in materials which are not 
readily combustible and with good ventilation or in the 
open on a concrete pad. Measures should be taken to avoid 
the hazard of molten AN becoming confined or con¬ 
taminated, particularly in drains. 

AN in storage should be segregated from other materials. 
The storage should be located away from potential sources 
of heat, fire or explosion, including combustible and flam¬ 
mable materials. CS 18 gives maximum stack sizes and 
minimum separation distances. 

Packaging of ammonium nitrate is typically in 50 kg 
bags of material impermeable to oil or water. Paper pack¬ 
aging should not be used. The bags should preferably be 
palletized. If wooden pallets are used, they should be 
uncontaminated. 

With regard to AN fertilizers with<28%N, whilst most 
are not combustible, a few are capable of self-sustaining 
decomposition with strong evolution of toxic fumes. These 
are known as ‘cigar burners’. 

AN storage should be provided with good security. CS 18 
states that access should be prevented not only of unauthor¬ 
ized persons but also of animals.Whilst it does not elaborate, 
the point is presumably that an animal may not only damage 
packaging but may leave behind organic material. 
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22.30 Storage Case Histories 

22.30.1 Oil storage 

In the storage of petroleum products, there have been 
numerous cases of tank overpressure or vacuum collapse 
and of fire, and some cases of release from tanks. 

A review of the failure of storage tanks containing oil 
and similar products has been given by Wilkinson (1991 
SRD R530). He divides the incidents into mechanical and 
brittle fracture failures and failures following an explosion 
or bund fire. 

On 30 August 1983, a fire started on the floating roof of 
an oil storage tank at a refinery at Milford Haven, Wales 
(Case HistoryA106). The tank contained some 47,000 ton of 
light crude oils. There were fine cracks in the floating roof 
through which oil had seeped out. It is believed to have been 
ignited by hot carbon particles from the flare. The fire was 
massive, with three hoilovers of burning oil. It was not 
extinguished until 2 days later. 

On 2 January 1988, at Floreffe, Pennsylvania, a storage 
tank containing diesel oil suffered a sudden collapse (Case 
History A120). The tank split vertically and the force of the 
oil spurting out moved the tank 100 ft off its foundations. 
The tank cracked, collapsed and crumpled. A proportion of 
the oil flowed over the bund and entered the waterways. The 
tank had been reassembled after removal from another site 
and the failure occurred on its first filling after reassembly. 

22.30.2 LPG storage 

A review of LPG storage incidents has been given by 
Davenport (1986), who describes incidents at: Port Newark, 
New Jersey, on 7 July 1951; Feyzin, France, on 4 January 
1966; Texas City, Texas, on 30 May 1978; and Mexico 
City, Mexico, on 19 November 1984. Accounts of these inci¬ 
dents are given in Case Histories A19, A38, A92 and in 
Appendix 4, respectively. 

The Port Newark site had 100x115 m 3 horizontal pres¬ 
sure vessels for propane, in two groups, one of 70 vessels 
and the other of 30 vessels, separated by a distance of 10 6 m. 
A leak of unknown origin occurred in pipework near the 
vessels in the larger group. Within a few minutes the first 
vessel burst. Eventually all 70 tanks in the group ruptured 
with varying degrees of violence. None of the vessels in the 
smaller group failed. 

At Feyzin, there were four 1200 m 3 propane and four 
2000 m 3 butane pressure storage spheres. An escape of 
liquid propane occurred whilst water was being drained 
from the bottom of one of the propane spheres. The vapour 
cloud formed was ignited by a vehicle on a nearby road and 
the vapour cloud fire caused a series of BLEVEs which 
resulted in 18 deaths and the destruction of five of the 
spheres. 

At bothTexas City and Mexico City, the initiating event is 
believed to have been overpressure of a vessel which was 
being filled from a pipeline. At Texas City, there were three 
pressure storage spheres and a number of other pressure 
vessels. The hypothesis is that the sphere which was over¬ 
pressured developed a crack and released material which 
found a source of ignition. It was reported that the vapour 
cloud fire then changed to a jet flame at the sphere. Within a 
short time the sphere failed, giving a huge fireball. This 
was followed by a series of explosions and fires, and the 
failure of the other two spheres. 

The site at Mexico City contained four 1600 m 3 and two 
2400 m 3 pressure storage spheres and 48 horizontal 


cylindrical pressure vessels for storing propane and 
butane. The leak gave rise to a vapour cloud which ignited 
at a neighbouring plant and, within a short time, one or 
possibly two of the spheres ruptured. There followed a 
series of explosions and fires, which killed some 500 people 
and destroyed many of the storage vessels. 

Another significant incident is that of a 260,000 bbl 
refrigerated LPG tank at Umm Said, Qatar, on 3 April 1977 
(Case History A88). A massive failure occurred and a wave 
of liquid propane swept over the bunds and inundated the 
process area of the associated NGL plant before igniting. 
The NGL plant was completely destroyed. 

22.30.3 LNG storage 

One of the earliest process industry disasters was the failure 
on 20 October 1944 of an LNG storage tank at Cleveland, 
Ohio (Case HistoryA12). The cause of the rupture is believed 
to have been the use of a low carbon steel which was unsui¬ 
table for the low temperatures involved. Avapour cloud of 
LNG formed and ignited in the plant itself, whilst LNG 
liquid flowed into storm sewers, where it mixed with air and 
gave rise to a series of explosions. Some 128 people were 
killed. 

A quite different case is the disaster at Staten Island, 
New York, in 1973 (Case History A67). Work was being done 
inside an empty LNG storage tank when flammable resi¬ 
dues were ignited. Some 40 people died in the resultant fire. 

A rollover incident occurred on 21 August 1971 at 
the SNAM LNG terminal at La Spezia in Italy (Case 
History A54). A sudden increase in pressure occurred in the 
tank, causing a discharge from the tank safety valves and 
tank vent. The release from the safety valves lasted for 
75 min and that from the vent lasted 3 h and 15 min. 

22.30.4 Ammonia storage 

A review of the failure of ammonia storage failures has 
been given by Markham (1987b). He presents information 
on the ammonia concentrations as a function of distance in 
these incidents and on the physiological effects of ammonia 
on humans, animals and plants. 

On 13 July1973, a sudden failure occurred on a horizontal 
ammonia pressure storage vessel at Potchefstroom, South 
Africa (Case History A65). The cause of the failure was 
brittle fracture of the dished end. The ammonia spread as a 
dense gas cloud over the works and to an adjacent town¬ 
ship. Eighteen people were killed. 

On 16 November 1970, a 40,000 ton refrigerated atmos¬ 
pheric ammonia tank at Blair, Nebraska, was overfilled 
(Case HistoryA47). The ammonia overflowed and formed a 
massive dense gas cloud which extended some 9000 ft.The 
area was sparsely populated and no one was killed. 

In 1982, defects were observed on a 20,000 te refrigerated 
atmospheric ammonia tank at Arzew, Algeria (Martinez 
et al., 1987). They included tilting, extensive degradation of 
the tank wall insulation and failures of the anchor bolts. The 
cause is not known, but two hypotheses were advanced. One 
is an earthquake - there were earthquakes nearby in 1980 
and 1981. The other is frost heave, due to poor drainage, with 
the resultant accumulation of water in the aeration tubes and 
hence a reduction in the efficiency of the foundation heating. 

On 2 October 1984, a 15,000 ton refrigerated ammonia 
storage tank at Geismar, Louisiana, suffered a catastrophic 
failure of the roof-wall weld two-thirds of the way around its 
circumference (Badame, 1986). There was some release of 
ammonia which gave a small cloud, but evidently had no 
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serious consequences. The tank had suffered a mild over¬ 
pressure of some 0.5 psi. The refrigeration compressors were 
down at the time. The relief valve opened but did not have 
the capacity to prevent the pressure from increasing. The 
weld had been subjected over the 17 years of the tank life to 
some 80,000 cycles and was held to have failed due to low 
cycle fatigue. It also showed extreme lack of penetration. 

Another refrigerated atmospheric ammonia tank failure 
occurred on 20 March 1989 at Jonova, Lithuania (Case 
History A124). Some warm ammonia had been charged to 
the tank and in due course it erupted, causing a sudden 
increase in pressure. A massive failure occurred between 
the wall and the bottom of the tank and liquid ammonia 
rushed out. At the same time the tank was dislodged from 
its foundations and smashed violently through the con¬ 
taining wall on the far side from the escape, ending up 40 m 
away. A pool of liquid ammonia formed which in places was 
70 cm deep. The ammonia suddenly ignited and the whole 
plant area was engulfed in flames. A burning conveyor belt 
transmitted the fire to a store of NPK fertilizer. Seven peo¬ 
ple were killed. 

22.30.5 Pressure storage vessels 

In 1986 a pressure storage vessel holding 25 te of carbon 
dioxide ruptured (Coleman, 1989). The report on the failure 
concluded that the steel was brittle at its service tempera¬ 
ture and that inadequate leg attachments had created high 
local stress. The metallurgical evidence indicated that the 
heat treatment had not been properly carried out. There 
was also doubt whether the steel used in fabrication was 
the same as that on which the impact tests required had 
been performed. 

22.30.6 Pressure storage vessels: decommissioning 

Accounts of the decommissioning of pressure storage ves¬ 
sels also merit mention, even though in these cases no 
release occurred. 

Squire (1991) records the case of an ammonia pressure 
storage vessel as follows: 

A bullet tank in refrigeration service had been cleverly 
made by turning a high-pressure distillation column on 
its side. While possessing considerable strength at ambi¬ 
ent temperature, subsequent analysis showed no strength 
(<2 ft-lb) at 0°C. The bullet was immediately removed 
from service after identification. Great care was taken 
during the deinventory so as not to fracture the vessel. 
Coleman (1989) describes an investigation into the state 
of a set of pressure vessels for the storage of carbon dioxide. 
The investigation was prompted by the carbon dioxide 
storage vessel failure just described. The company com¬ 
missioned an investigation of its other carbon dioxide stor¬ 
age vessels, of which there were 24 vessels ranging in age 
from brand new to 26 years old. The work addressed in 
particular the risk of brittle fracture, and the methods used 
included visual examination, replica metallurgy and 
ultrasonic testing. The result of the investigation was that 
three vessels were taken out of service because it was found 
that their dished ends had been overheated during hot 
forming. Suspect metallurgy led to the withdrawal of a 
further six vessels, five of which had not only low tough¬ 
ness but also problems such as laminations and inclusions, 
weld defects and directly attached support brackets. All but 
one of these vessels were built before 1970, and most dated 
from before 1965. 


22.30.7 Warehouses 

On 4 January 1977, a serious fire and explosion destroyed 
a chemicals warehouse and adjacent whisky warehouse 
at Braehead and resulted in widespread window and roof 
damage within a 1 mile radius (Case History A85). Sub¬ 
sequent experimental investigation showed that explosions 
of this severity can be caused by the involvement of sodium 
chlorate under intense heat conditions. The warehouse had 
contained some 67 te of sodium chlorate in steel drums. The 
fire was started by boys who had built a ‘den’ beside the 
warehouse and had lit a fire there to warm themselves. 

On25September1982, afire, followed almost immediately 
by an explosion, occurred in the warehouse of B&R Hauliers 
at Salford (HSE, 1983b) (see also Case History A85). The 
warehouse contained some 2000 te of chemicals, including 
25 te of sodium chlorate.There was evidence that the original 
fire had been started outside the building by vandals and 
also that, earlier, persons had entered the warehouse where 
various containers were opened and chemicals mixed. The 
management had been unaware of the guidance issued by 
the HSE on sodium chlorate. 

Another warehouse incident which involved a much 
smaller amount of sodium chlorate, some 2.45 te, but which 
nevertheless proved serious enough, occurred on 21 January 
1980 at Barking, Essex (HSE, 1980a) (see also Case History 
A85). A fire started, probably caused by a domestic bar fire, 
possibly drying wet clothing and spread through packaging 
materials to involve various chemicals. There were three 
explosions, probably one was of an LPG cylinder and the 
other two of sodium chlorate. Nine firemen were injured. 

22.31 Storage Risk 

22.31.1 Historical record 

The risks from the process industries arise from processes, 
storage and transport. The historical record shows that 
storage is a major contributor. Storage figures prominently 
in the case histories given in Appendix 1 and elsewhere in 
this book. An attempt to quantify the contribution made by 
storage to the overall risks from the process industries is 
given below. 

22.31.2 Hazard assessment 

Another approach to the estimation of the risks from stor¬ 
age is hazard assessment. Two major hazard assessment 
exercises in which storage figures prominently are the 
Canvey Report and the Rijnmond. Report, which are 
described in Appendices 7 and 8, respectively. 

An account is given below of hazard assessments of the 
storage of the principal hazardous substances: LPG, LNG 
and ammonia. 

22.31.3 Storage vs process 

Although the quantities of hazardous materials held in stor¬ 
age are much larger than in process, it is usually considered 
that process is the principal hazard. This view is reflected in 
the distinction made in the EEC Directive on Major Accident 
hazards between process and process associated storage on 
the one hand, and isolated storage on the other. 

A study of the relative risks from process and storage has 
been made by Lees (1983d). He considered the following 
three principal sets of data: 

(1) accidents involving 10 or more deaths; 

(2) accidents involving 2 to 9 deaths; 

(3) fire losses. 
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The data used in this study are given in Tables 
22.13-22.15. The accidents listed in Table 22.13 were taken 
from the list given in Appendix 3 of the first edition of the 
present book. The table shows process and storage as the 
source of 14 and 9 accidents, respectively, making the latter 
39% of the total. Table 22.14 shows the contribution of stor¬ 
age, rising from 13% for accidents involving 2 deaths to 
36% for accidents involving 6-9 deaths. Of the fires given 
inTable 22.15,195 were in process and 23 in storage. Storage 
was thus the source of 11% of the fires. However, 72 % of the 
financial loss was attributable to storage. 

Lees states: 

What the foregoing data appear to indicate is that the 
contribution of storage to deaths in multiple fatality 
accidents in the oil and chemical industries tends to 
increase with the number of fatalities and for accidents 
involving 5 or more fatalities to approach a figure of the 
order of 20-35%. Thus the idea that material in storage 
presents a much lower risk than that in process is a half- 
truth and cannot be accepted without qualification. As 
far as concerns multiple fatality accidents, and in par¬ 
ticular large multiple fatality accidents, the contribution 
of storage is appreciable. 

Since this study the accidents at Mexico City and Bhopal 
have occurred, both of which involved storage. 

22.32 LPG Storage Hazard Assessment 

Turning now to hazard assessment of storage, treatments 
fall into three groups: (1) overview, (2) generic study and 
(3) specific study. A particular form of the second group is 
the guidance issued by the HSE or industry associations on 
safety cases. 


Table 22. 13 Some major accidents involving 10 or more 
deaths in the oil and chemical industries (Lees, 1983d) 
(Courtesy of Elsevier Science Publishers) 


Date 

Location 

Deaths 

Process/storage 

1926 

St Auban 

19 

Storage 

1928 

Hamburg 

10 

Storage 

1939 

Zarnesti 

c.60 

Storage 

1944 

Cleveland 

128 

Storage 

1944 

Denison 

10 

Storage 

1947 

Rauma 

19 

Storage 

1950 

Poza Rica 

22 

Process 

1959 

Ube 

11 

Process 

1960 

Kingsport 

15 

Process 

1962 

Toledo 

10 

Process 

1965 

Louisville 

12 

Process 

1966 

Feyzin 

18 

Storage 


LaSalle 

11 

Process 

1968 

GDR 

24 

Process 

1972 

Brazil 

37 

Storage 


Weirton 

10 

Process 

1973 

Potchefstroom 

18 

Storage 

1974 

Czechoslovakia 

14 

Process 


Flixborough 

28 

Process 

1975 

Beek 

14 

Process 


Scunthorpe 

11 

Process 

1976 

Chalmette 

13 

Process 

1977 

Columbia 

30 

Process 


Overviews of the hazard assessment of LPG pressure 
and refrigerated storage have been given in the Canvey 
Reports (HSE, 1978b, 1981a), and by Rasbash (1979/80) and 
Lyon, Pyman and Slater (1982). Generic hazard assess¬ 
ments of LPG pressure and refrigerated storage have been 
described by Considine, Grint and Holden (1982) and of 
pressure storage by Drysdale and David (1979/80), T.A. 
Smith (1985), Crossthwaite (1984, 1986) and Clay et al. 
(1988). Guidance on safety cases for LPG has been issued 
by the LPGA (1989 GN1). Specific hazard assessments of 
LPG pressure and refrigerated storage are given in the 
Canvey Reports, and of pressure storage by Khan (1990). 

The hazard assessments of LPG given in the Canvey 
Reports are described in Appendix 7 and are therefore not 
considered further at this point. 

The hazard assessments by Crossthwaite and Clay et al. 
are part of a generic methodology for the assessment of 
LPG, and by extension similar flammable materials, devel¬ 
oped by the HSE; they are described in Chapter 9. 

The studies by Drysdale and David and by Considine 
Grint and Holden are essentially generic risk assessments, 
the former dealing mainly with risk to plant personnel and 
the latter with risk to the public. 

22.32.1 Pressurized storage 

The classification of initiating events and hazard scenarios 
for the pressure storage of liquefied gas shown inTable 22.2 
is broadly applicable to LPG. For a pressure storage ves¬ 
sel containing LPG principal hazardous events are cata¬ 
strophic failure of the vessel, a major crack on the vessel, 


Table 22.14 Some lesser accidents involving two to nine 
deaths in the oil and chemical industries (Lees, 1983d) 
(Courtesy of Elsevier Science Publishers) 



No. of deaths per accident 


2 

3 

4 

5 

6-9 

Process 

No. of accidents 

26 

13 

9 

4 

11 

Total no. of deaths 

52 

39 

36 

20 

81 

Storage 

No. of accidents 

4 

3 

3 

l 

5 

Total no. of deaths 

8 

9 

12 

5 

46 

Deaths from storage (%) 

13 

19 

25 

20 

36 


Table 22.15 Some fire loss data for the petroleum 
industry a (Lees, 1983d) (Courtesy of Elsevier Science 
Publishers) 



No. of fires 

Frequency 
of fires 
(fires/100 
properties) 

Cost 
per fire 
(US$) 

Refineries 

176 

141.9 

2,04,000 

Natural gas plants 

19 

3.72 

49,000 

Tank farms 

3 

1.05 

127,000 

Bulk terminals (shore) 

11 

2.06 

313,000 

Bulk plants (inland) 

9 

0.97 

195,000 


a Data are for fires in 1977, as given by the API survey. 
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a major leak from the associated pipework, release due to 
overfilling of the vessel, a jet fire and an engulfing fire. 

In the hazard assessment made by Drysdale and David 
(1979/80), the object considered is a 600 te propane pres¬ 
sure storage sphere with, at the four points of the compass, 
open sea at a distance of 50 m, a chemical plant at 150 m, a 
main road at 200 m and a loading bay at 50 m. They treat the 
following events: (1) a crack in the vessel, (2) a small leakage 
from the pipework and (3) a large leakage from the pipe¬ 
work. They consider the scenarios of a fire at the vessel, 
leading to a BLEVE, a vapour cloud flash fire and a vapour 
cloud explosion (VCE). 

The authors give fault trees for the estimation of the 
frequency of: a fire at the sphere due to a small leak and for 
one due to a large leak; a BLEVE under fire conditions; and 
for a VCE. Some of the event frequency and probability 
estimates which they use are shown in Table 22.16, 
Section A. Many of these estimates are judgement figures 
and some differ from other literature values. 

For ignition they assume the following probabilities for 
the presence of an ignition source: at the chemical plant, 
1.0; at the main road, 0.5; and at the loading bay, 0.05. 
They further assume that the probability of ignition by the 
ignition source is 0.5 in each case. 

With regard to consequences, these authors make the 
assumption that all the propane released evaporates. They 
use the Gaussian passive gas model to estimate the travel 
distances of the resultant cloud. The principal hazardous 
outcomes which they consider are a BLEVE and a VCE, 
the other outcomes being a vapour cloud flash fire and 
dispersion without ignition. 

They assess the risks to the public as very low, but 
draw attention to the appreciable risk to firefighters from 
a BLEVE, a risk which was realized at Feyzin. 

The object assessed by Considine, Grint and Holden 
(1982) is one of two 1500 te butane spheres. Two sites are 
considered, both a 500 m square site with the storage object 
located at one corner. The urban site is surrounded on all 
sides by population at 100 m from the site and the remote 
site by population at a radial distance of 1000 m in all 
directions. They treat the following scenarios: (1) a cata¬ 
strophic failure of the vessel (explosive failure), (2) a cata¬ 
strophic failure (equivalent to a 6 in. nozzle), (3) a fracture 
of a liquid line, (4) a fracture of a vapour line, (5) overfilling, 
(6) a serious leak from the pipework and (7) a leak due to a 
draining or sampling operation. 

The authors consider the scenarios shown in Table 22.16, 
SectionB, and give theeventfrequencies shown in thattable. 

Their model for ignition at source is as follows: 


Release Probability of ignition 

Immediate Delayed 


Wind Wind not 
over site over site 


Large instantaneous 

0.25 

0.25 

0.25 

1000 te 

0.25 

0.25 

0.1 

250 kg/s, 50 kg/s 

0.25 

0.25 

0.1 

30 kg/s, 16 kg/s 

0.15 

0.15 

0.05 


The probability of ignition of a cloud reaching the edge 
of the populated area is taken as 0.7 and that of ignition over 
the populated area as 0.2. 


For both for the pressure storage and refrigerated 
storage cases, Considine, Grint and Holden consider the 
following scenarios (1) immediate ignition at source, 
(2) delayed ignition at source, (3) ignition at the edge of the 
population zone and (4) ignition over the centre of the 
population zone. 

For pressure storage, the immediate ignition at source of 
an instantaneous release is assumed to give rise to a fire¬ 
ball, and the immediate ignition of a continuous release is 
assumed to give rise to a jet flame, or torch fire. If ignition is 
not immediate, the cloud drifts. For an instantaneous 
release the assumption of complete vaporization is made 
and the gas dispersion is modelled using the DENZ dense 
gas dispersion code. The method used for the dispersion of 
the continuous releases is unclear, but appears to be the 
Gaussian model. For the three cases of delayed ignition the 
outcomes are flash fires and VCEs. 

The authors assumed that catastrophic explosive failure 
of one of the spheres would cause failure of the other also. 
Furthermore, a proportion of torch fires are capable of 
causing a BLEVE of a sphere. The total frequency of torch 
fires was assessed as 3 x 10 _3 /year and that of BLEVEs as 
7.1 x 10 _5 /year. 

Thus the principal outcomes considered are: an explo¬ 
sive failure, generating missiles and causing failure of the 
other sphere; a fireball; jet flames; a BLEVE; a vapour 
cloud fire and a VCE. The authors outline the models used 
and the associated injury relations. 

The risks estimated in this hazard assessment are given 
in Section 22.32.3. 

It will be apparent from this description that different 
analysts tend to formulate scenarios in somewhat different 
ways, even where the events considered are similar. 

22.32.2 Refrigerated storage 

The classification of initiating events and hazard scenarios 
for the refrigerated storage of liquefied gas shown in Table 

22.2 is broadly applicable to LPG. 

For a refrigerated storage tank containing LPG the prin¬ 
cipal hazardous events are catastrophic failure of the tank, 
explosion in the vapour space of the tank, rollover, a major 
leak from the associated pipework and release due to over¬ 
filling of the tank. 

The object assessed by Considine, Grint and Holden 
(1982) is a single refrigerated atmospheric fixed roof, 
single-wall storage tank containing butane positioned at 
the same location as the two pressure storage spheres 
already described. They treat the following events: (1) cata¬ 
strophic failure of the tank, (2) rollover, (3) overfilling, (4) a 
fracture of a liquid line and (5) a leak from the pipework. 

The authors consider the scenarios shown in Table 22.16, 
Section C, and give the event frequencies shown in that 
table. They use the same ignition model as for the releases 
from pressure storage. 

As for the pressure storage case they consider the four 
cases of immediate ignition at the source and of delayed 
ignitions at the source, at the edge of and over the population 

For instantaneous release by catastrophic failure of the 
refrigerated storage tank, Considine, Grint and Holden take 
into account overtopping of the bund. Immediate ignition of 
an instantaneous release is assumed to give a pool fire. If 
ignition is not immediate, vaporization occurs, which the 
authors estimate using the SPILL code. Immediate ignition 
of a continuous release is evidently also assumed to result in 
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Table 22.16 Event frequency/probability estimates given ir 
and David 1979/80; Considine, Grint and Holden, 1982) 

i two LPG hazard assessments (after Drysdale 

A Pressure storage sphere: Drysdale and David 



Frequency /probability 
(per year) 

Crack in pipe 


10 _4 /year 

Gasket failure 


5xl0 _5 /year 

Flange failure 


4xl0 _5 /year 

Valve seating failure 


3xl0 _z /year 

Drainage/sampling valve not properly shut 


10 _4 /year 

Pipe rupture due to: 

Vehicle impact 


10 /year 

Vibration 


10 _z /year 

Corrosion 


10 _4 /year 

Repair whilst operating 


10- 4 )year 

10~ 7 /year 

Excess pressure (blockage) 


Fatigue 


10 _4 /year 

Creep 


10 _5 /year 

Sabotage 


2xl0 _3 /year 

During filling operation: 

Operator fails to stop filling when correct level is reached 


0.1 

Operator fails to stop pump quickly enough when release occurs 

10“ 2 

Fixed water spray inoperative because: 

Water shut-off 


1Q- Z 

Activation fails 


2xl0 _z 

Water frozen 


5xl0“ 4 

Pipes completely blocked 


10“ 4 

Low main pressure 


3xl0 -3 

Sprinkler system damaged 


10“ 5 

Fixed water spray system ineffective because: 

Pipes partially blocked 


3x10 

Low mains pressure 


2xl0“ 3 

Some heads blocked 


8xl0“ 4 

B Pressure storage: Considine, Grint and Holden 

Event 

Frequence 3 /probability 

Flow b 

Catastrophic failure of vessel: 

Complete failure 

3 x 10“ 7 vessel-year 

Instantaneous release of 1500, 
2250 or 3000 te 

Failure equivalent to 6 in. nozzle 

7 x 10 _6 /vessel-year 

15te/min 

Fracture of 6 in. liquid line b 


1 te, or 1 te + 50 kg/s 

Pipework 

3xl0 _ j ,m -year 

5x10 7 item-year 


Equivalent failure of fittings 


Release due to overfilling 0 

10 _4 /vessel-year 

30 kg/s 

Fracture of 2 in. vapour line 

3xl0 _6 /m-year 

lkg/s 

Serious leak from equipment or pipework (1 kg/s): 

6 in. pipework 

6x10 /m-year 


2 in. pipework 

6xl0 _5 /m-year 


Flange 

3 x 10 -4 / flange-year 


Pump seal 

5xl0 _3 /seal-year 


Release in course of draining or sampling (1.5 kg/s): 

Release per operation 

nr 4 


Draining operations 

50/year 


Sampling operations 

lOO^year 


Failure to recover during draining 


Failure to recover during sampling 

KT 2 
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Table 22.16 continued 

C Referigerated atmospheric storage: Considine, Grint and Holden b 

Event 

Frequency 1 

Flow h 


Catastropic failure of tank 
Rollover 6 

Overfilling 1 *’ f , of which: 

With tank failure 6 

Without tank failure 6 

Fracture of 6 in. liquid line 

Leak from pipework, etc. 

5 x 10“ 6 /tank-year 
10 -5 /tank-year 

1CT 5 / tank-year 
10 -5 tank-/year 
9xl0 -5 /year 

As Section B 

As Section B 

Instantaneous release of 1500, 2250 o 
Instantaneous release of 1500, 2250 o 

Instantaneous release of 1500, 2250 o 
50 kg/s 

50 kg/s 
lkg/s 

>r 3000 te 
>r 3000 te 

>r 3000 te 


a Basic frequencies for a single vessel or tank. 

b The flows given are complex; quantities quoted here are specimen values and in some cases are not sustained for more than 1 minute. 
c Probability of emergency shut-off failure 0.2 
d Based on protective system design. 

e Probability of wall-base failure 0.25; probability of wall-roof failure 0.75. 

f Probability that operator switches off pump and limits the event to a release into the bund rather than tank failure, 0.9, 


a pool fire. The dispersion of releases which are not immedi¬ 
ately ignited at source is modelled using the same method as 
for the pressure storage study. Outcomes of delayed ignition 
of these releases are pool fires, torch fires, vapour cloud flash 
fires and VCEs. 

Further principal sources of information on the fre¬ 
quency or probability of events, on consequences and on 
assessed risk for LPG storage are the Convey Reports and 
the Rijnmond Report. 


22.32.3 Pressurized vs refrigerated storage 
The study conducted by Considine, Grint and Holden was 
primarily directed at the comparison of the risks arising 
from the two types of butane storage in the two types of 
location. The comparative risks assessed by these authors 
for the specific configurations considered are: 


Pantony (1985), D.F. Cooper and Chapman (1987) and 
P. Roberts (1990). 

The classification of initiating events and hazard sce¬ 
narios for the refrigerated storage of liquefied gas shown in 
Table 22.2 is broadly applicable to LNG. 

Considering some of the accounts mentioned, the treat¬ 
ment given by Kopecek (1977) is fairly general but includes 
a somewhat more detailed treatment than is generally 
found of the following natural events: (1) severe winds and 
tornadoes, (2) storm waves, tsunamis, (3) earthquakes and 
(4) meteorites. 

R.A. Cox et al. (1980) deal with the hazard assessment of 
terminals rather than storage per se. The storage which 
they considered is a double integrity tank with inner steel 
and outer concrete walls and an earthen berm. They give for 
catastrophic failure of the inner tank leading to outer roof 
collapse and for partial fracture of the outer roof due to 


Site 

Storage 

Individual 
(xlO -6 year -1 ) 

Societal risk (casualties >N) (x 10 

6 year -1 ) 

>10 

>100 

>1000 

>5000 

Urban 

Pressurize 

102 

159 

84 

76 

40 


Refrigerate 

35 

66 

7.1 

7.0 

1.6 

Rural 

Pressurize 

12 

76 

76 

76 

36 


Refrigerate 

0.26 

2.0 

2.0 

0.08 

- 


22.33 LNG Storage Hazard Assessment 

Overviews of the hazard assessment of refrigerated LNG 
storage have been given in the two Convey Reports (HSE, 
1978b, 1981a) and the Rijnmond Report (Rijnmond Public 
Authority, 1982) and by Kopecek (1977), R.A. Cox et al. 
(1980), Philipson (1980), Kunreuther and Lathrop (1981), 
Lyon, Pyman and Slater (1982), Nassopoules (1982), 
Philipson and Napadensky (1982), Valckenaers (1983), 
Wicks (1983), D.A. Jones (1985), Valk and Sylvester-Evans 
(1985), Napier and Roopchand (1986), D.F. Cooper and 
Chapman (1987) and Navaz (1987). Specific hazard assess¬ 
ments of LNG refrigerated storage are given in the Convey 
Reports and the Rijnmond Report and by Philipson (1980), 
Dale and Croce (1985), D.A. Jones (1985), Setters, Luck and 


overpressure typical frequencies of 2 x 10 -6 and 2 x 10 -5 / 
year, respectively. They also give a typical failure fre¬ 
quency of 2 x 10 -6 /year for catastrophic failure of a refrig¬ 
erated ethane storage tank. 

The accounts by Nassopoules (1982) and Closner and 
Wesson (1983) are concerned primarily with tank system 
designs, the former with a membrane system and the latter 
with double wall systems. Both give detailed consideration 
to the scenario of a tank fire in an adjacent tank. Closner 
and Wesson also consider a release from the inner tank, and 
earthquakes, missiles and blast. 

D.A. Jones (1985) reviews refrigerated LNG storage sys¬ 
tems, identifies five basic design concepts and summarizes 
the hazard assessments performed for installations 
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embodying each of these concepts. Details of the assess¬ 
ments are sparse except for the Canvey studies. He does, 
however, give the following summary of the overall risks 
for exemplars of three of the five types of system: 


Design 

Individual 

Societal risk 

1 . 

Single wall 

2 x 10“ 6 

9.3 x 10“ 6 


tank+low bund 

1.8 x 10“ 6 

5.5 x 10“ 6 

2. 

Single wall 

4 x 10“ 12 

Negligible 3 


tank+high bund 

8.5 x 10“ 9 

9 x l(r b 

3. 

Double integrity 
tank system 

Nil 

Nil 


a No more than two offsite casualties. 
b Risk for 100—1000 casualties. 


The overview of hazard assessment methodology by 
Napier and Roopchand (1986) quotes the frequency esti¬ 
mates for LNG terminals given by RA. Cox et al. and those 
of release duration on LNG plants given by H.H. West, 
Pfenning and Brown (1980). Napier and Roopchand also 
give information on models for vaporization, heavy gas 
dispersion, pool fires, flash fires and VCEs. 

The account by P. Roberts (1992) refers to a hazard 
assessment of a double integrity LNG tank with a pre¬ 
stressed concrete outer wall. Failure of the tank roof was 
considered and the consequences found to be limited, pro¬ 
vided the integrity of the tank walls was maintained. An 
analysis was undertaken to demonstrate the integrity of 
the outer wall. Consideration was given to the various 
initiating events such as earthquakes, severe impacts, frost 
heave, settlement and blast. The risk was assessed as 
negligibly low. 

Further principal sources of information on the fre¬ 
quency or probability of events, on the consequences and 
on the assessed risk for LNG storage are the Canvey 
Reports and the Rijnmond Report. 

22.34 Ammonia Storage Hazard Assessment 

Overviews of the hazard assessment of ammonia pressure 
and refrigerated storage are given in the Canvey Reports 
(HSE, 1978b, 1981a) and overviews of pressure storage are 
given in the Rijnmond Report and by Resplandy (1967). 
Guidance on safety cases for ammonia has been issued 
by the CIA (1989 GN1). Specific hazard assessments of 
ammonia pressure and refrigerated storage are given in the 
Canvey Reports, of pressure storage in the Rijnmond Report 
and of refrigerated storage by Squire (1991). 

The classification of initiating events and hazard sce¬ 
narios for the pressure and refrigerated storage of toxics 
shown in Table 22.2 is broadly applicable to ammonia. 

The hazard assessments of ammonia storage in the first 
Canvey Report and the Rijnmond Report are described in 
Appendices 7 and 8, but mention may be made here of the 
scenarios considered in those studies. 

For the Fisons ammonia pressure storage sphere the 
First Canvey Report considers for the vessel occurrences 
of spontaneous failure, engulfment in fire, blast effects 
and missile impact. Ignition of the thermal insulation on 
the vessel was identified as a possible scenario, but was 
quickly discounted. The Shell refrigerated ammonia stor¬ 
age tank system was of the high bund type. For this tank 


the report considers the scenario of a fire engulfing 
the bund wall. Apart from this, the report states: ‘The 
concrete collar ensures that the failure of the main tank 
cannot create a major hazard. The actual consequence of 
inner tank failure with the bund intact is virtually zero’. 
Various events initiating release from pipework associated 
with the storage were also taken into account. By the 
time of the Second Canvey Reports, both the pressure 
storage sphere and the refrigerated storage tank were 
no longer in use. 

One of the six objects studied in the Rijnmond Report 
was the UKF ammonia pressure storage sphere. Initiating 
events considered were catastrophic failure of the vessel, a 
major crack in the vessel and full bore fracture of the liquid 
and vapour lines on the vessel. 

An account is given by Squire (1991) of measures for 
enhancing the integrity of a refrigerated ammonia storage 
tank, which includes reference to a hazard assessment. The 
site handles a number of toxic substances, but the ammonia 
tank was assessed as constituting 50% of the total risk. 
Scenarios considered included catastrophic failure and 
rollover, or at least thermal overload, of the tank, and 
release from large pipework. 

As indicated, the main sources of information on the 
frequency or probability of events, on the consequences 
and on the assessed risk for ammonia storage are the First 
Canvey Report and the Rijnmond Report. 

22.35 Notation 

Section 22.4 

A surface area of pool (m z ) 

C calorific value of liquid (kj/kg) 

D diameter of tank (m) 

ki constant 

Q heat radiated from the flame envelope (kW) 

r liquid burning rate (m/s) 

p density of liquid (kg/m 3 ) 

Section 22.8 

Equations 22.8.1 and 22.8.2 
A total wetted surface (ft 2 ) 

F environmental factor 

Q total heat absorption (BTU/h) 

Equations 22.8.3 and 22.8.4 
C net calorific value of liquid in pool (kj /kg) 
h height of flame (m) 

/ intensity of heat radiation from the flame envelope 
(kW/m 2 ) 

L length of pool (m) 

Q heat emitted by fire (kW) 

W width of pool (m) 

p density of liquid (kg/m 3 ) 

Section 22.10 

T absolute temperature of liquid 
x mole fraction of methane 

a coefficient of expansion of liquid with respect to 

concentration 

fi coefficient of expansion of liquid with respect to 
temperature 
p density of liquid 
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Section 22.11 

Equation 22.11.1 

R interface stability parameter 

S concentration of impurity (mass fraction) 

T absolute temperature of liquid 

a coefficient of expansion with respect to temperature 

P coefficient of expansion with respect to concen¬ 
tration 

Equation 22.11.2 

b boil-off rate 

C p specific heat of liquid 

g acceleration due to gravity 

H v latent heat of vaporization of methane 

k thermal conductivity of liquid 

T n absolute temperature of liquid in top or nth. cell 

T s absolute saturation temperature of methane in LNG 

p viscosity of liquid 

p density of liquid 

p„ average reference density of liquid 

Section 22.21 

Subsection 22.21.4 
h height of bund 

H original height of liquid 

L distance between tank wall and bund 


R radius of tank 

x, y dimensions of bund walls 

Subsection 22.21.8 
g acceleration due to gravity 
h initial height of liquid in tank 

M t effective fluid mass 

M s effective mass of tank shell 

R resistance to flow 

t time 

u velocity of fluid 

x distance 

p density of fluid 

Section 22.24 

Equation22.24.1 only 
r\ filling ratio 

p p density of liquid at reference temperature 

p w density of water at 15° C 

^ fractional free space 

Equation 22.24.2 only 

gi specific gravity of liquid at reference temperature 

g t specific gravity of liquid at its lowest temperature 

of filling 

f/max maximum permissible volume 
V internal volume of vessel 
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23/2 TRANSPORT 


So far the loss prevention problems discussed have been 
principally those of fixed installations. It is necessary, 
however, to consider also the transport of hazardous 
materials. 

Some aspects of this transport which need to be con¬ 
sidered include: 

(1) regulatory control; 

(2) classification; 

(3) packaging and labelling; 

(4) transport containers; 

(5) hazards; 

(6) hazard assessment; 

(7) emergency planning. 

For each mode of transport, consideration has to be given to: 

(1) controls and codes; 

(2) hazard scenarios; 

(3) design; 

(4) operation. 

In addition, the features particular to a mode must be con¬ 
sidered. 

A general account of regulatory controls and of codes 
applicable to transport internationally and in the United 
Kingdom has been given in Chapter 3. More detailed infor¬ 
mation on controls and codes is given in the following sec¬ 
tions for road, rail, waterway, pipeline and sea transport. 

A major source of information on transport and the 
associated hazards and risks is Major Hazard Aspects of the 
Transport of Dangerous Substances by the Advisory Com¬ 
mittee on Dangerous Substances (ACDS, 1991) (the ACDS 
Transport Hazard Report). This report deals with marine, 
road and rail transport, and describes the regulatory 
regimes and transport environments as well as the hazards 
and risks. It considers in particular four substances which 
are both representative as well as themselves constituting a 
large proportion of the movements of dangerous sub¬ 
stances: motor spirit, liquefied petroleum gas (LPG), 
ammonia and chlorine. The report also deals with explo¬ 
sives and ammonium nitrate. The ACDS Transport Hazard 
Report is described in more detail in Appendix 17. 

Selected references on the transport of hazardous 
materials are given in Table 23.1. 

Sources of Information on Transportation of Hazardous 
Materials 

Because transportation regulations, requirements and best 
practices are changing constantly, the following is a list of 
reference websites which contain up-to-date information on 
regulatory and non-regulatory information concerning 
transport of hazardous materials. 

International 

www.iata.org 

The International Air Transport Association (I ATA) fosters 
safe and efficient air transport, including transportation of 
hazardous materials. 

www.imo.org 

The International Maritime Organization (IMO) is the 
United Nations specialized agency responsible for improv¬ 
ing maritime safety and reducing pollution from ships. 


Table 23.1 Selected references on the transport of 
hazardous materials 


NRC (Appendix 28 Transport ); D.R. Davis (1958); R. Lee 
(1961); Anon. (1962a); J.E. Browning (1969b); Pence (1969); 
Byrd (1970); J.R. Hughes (1970); McConnaughey et al. (1970); 

A. W. Clarke (1971a,b); A.B. Kelly (1971); National 
Transportation Safety Board (NTSB) (1971); Bigelow 
(1972); Institution of Fire Engineers (1972); Chemical 
Engineering (1973a); NFPA (1973/10); Pignataro (1973); 
Walmsley (1973,1974); W.S. Wood (1973,1982b); MCA 
(1974TC-20); Unwin, Robins and Page (1974); Westbrook 
(1974); Gay (1975); Malcolm (1975); Meadowcroft (1975); 
Peeler (1975); Whitbread (1975); Cantilli etal. (1976); 

D.R. Davies andMackay (1976); Horodniceanu et al. (1976, 
1977); Philipson (1976); Appleyard (1977); CONCAWE 
(1977 7/77); Druijff (1977); Flynn and Morrissette (1977); 
John (1977); Mullins (1977); Zedde (1977); ICE (1978); 
Horodniceanu and Cantilli (1979); IBC (1979/4,1981/20, 
1982/37,1985/65,1992/94,1993/106); Napier (1979a); 
Nimptsch (1979); Luckritz and Schneider (1980); Cannon 
(1983b);Vumbaco (1983); Bierlein (1984); Ichniowski (1984, 
1987); Belardo, Pipkin and Seagle (1985); Ackermann 
(1986); Carnes (1986); Kazarians, Boykin and Kaplan 
(1986); Kletz (1986J); Dryden and Gaweckie (1987); Frey 
and Handman (1987); Walker (1987); Chemical Industries 
Association (CIA) (1989 RC27); Belanger (1990); Burns 
(1990); N. Lees (1990); Beroggi and Wallace (1991); 
Canadine (1991); UN (1991); Croner Publishing (1993); 

B. Davies (1993) 

Containers, packaging 

Dowling (1960); Norden (1960d); Ayers and Rhodes (1963); 
Uncles (1966); Home Office (1968); McKinley (1968); 

J.E. Browning (1969b); A.W. Clarke (1971b); Lunn (1971, 
1975); Raymus (1973); Swinbank (1973,1975); Bohlman 
(1975); G.J. Lewis (1975); R.K. Roberts (1975); Steel 
(1975a,b); Department of Trade (1977); IMCO (1977); H. 
Morris (1977); Bond (1978); Boocock (1978); Cronin (1978); 
Gregory (1978); Anon. (1980 LPB 32, p. 15); Chlorine 
Institute (1980 Publ. 17,1985 Publ. 8); Petherbridge and 
Kinder (1983); HSE (1986 CS17, HS(G) 26,1992 CRR 37, 
HS(G) 78); Schilperoord (1986); Ashmore (1988 LPB 80); 
Blumel and Schulz-Forherg (1989); Shattes (1986); Anon. 
(1990c); NFPA (1990 NFPA 386); CIA (1991RC35, 
RC37,1992 RC59); UN (1991); Simpson and Jones (1992) 

Gas cylinders 

BCGA (Appendix 27,1988 GN2); CGA (Appendix 28, 
1966/1); HSE (1990 IND(G) 78(L)) 

Labelling 

MCA (SG-18,1976/24); D.L. Davies (1975); Rees (1975); 
Anon. (1978j); Williamson (1978); Anon. (1979h); Selikoff 
(1979); Anon. (1980 LPB 32, p. 15); O’Connor and Lirtzmann 
(1984) 

Radio -telephones 

ACDS (1991); British Gas (1992 GBE/DAT31); IP (1993 
TP20) 

COSHH in transport 

CIA (1991RC50) 

Road 

DepartmentofEnergy(n.d.,1974,1976a);DoT(n.d.,1978,1987a,b, 
1992b, 1993a,b);NSC(n.d./5,8);NTSB(Appendix28-fftg/?«wy 




TRANSPORT 23/3 


AccidentReports); OIA(Publ.711); Brantley (1964); Steymann 
(1966); BCISC (1967/6); Danskin (1969); 01sen(1969); H. 
Lewis (1971); Rohleder (1971); Brobst (1972); Harvison (1972, 
1973,1981); Ramsey (1972); CIA (1973/4,5,1988 CE4, PA16, 
1990 RC26); DoE (1974/5); IMechE (1975/20,23,1976/26,30, 
1977/32,1978/48,1983/72); Rutherford (1975); P.N. Anderson 
(1977); Ashton (1977); Davison (1977); Hudson (1977); Rickett 
(1977);Watters (1977); Anon. (1978 LPB19, p. 1); HSE (1978b, 
1981a,1983GS2691990IND(G)96(L));Napier(1979a); Anon. 
(1981 LPB 39, p. 17); Botkin (1981); Chlorine Institute (1981 
Publ. 76,1984 Publ. 49); Eiber (1981); Heller (1981); A.D. 
McLean (1981); Rudram and Lambourn (1981); ASME (1982/ 
191); Anon (1984jj,ll); M. Griffiths andLinklater (1984); Jager 
(1984); Sewell (1984a); Bressin (1985); Hawkins (1985); 
Lambourn (1985); Allsop etal. (1986); API (1986 Publ. 2219, 
1988 RP1004); L. A. James (1986); Kessler (1986); Anon. (1987 
LPB 76, p. 30); Grime (1987);Walker (1987); Glickman (1988); 
Canadine and Purdy (1989); Harwood, Russell and Viner 
(1989); Saccomanno etal. (1989); Anon. (1990c); Anon. (1990 
LPB 94, p. 10); Gorys (1990); Harwood,Viner and Russell 
(1990); NFPA (1990 NFPA 385,512,513,1992 NFPA 498); 
Ouellette, Hoa and Li (1990); Rhyne (1990); Saccomanno, 
Shortreed and Mehta (1990); Steward and van Aerde 
(1990a,b); ACDS (1991); UN (1991); Croner Publishing (1993); 
Department of Transport (DTp) (1993a); Purdy (1993); IP 
(1994/4,5) 

Pressure relief: Hawksley (1990 LPB 91): UN (1991) 

Rail 

BR (n.d.a,b); NTSB (Appendix 28 Railroad Accident 
Reports)-, Danielson (1964); Walton (1964); Heller (1965); 
Steymann (1966); Engel (1969); ASME (1971/188); 

Barren (1971); Maughan (1971); E.A. Phillips (1971); AAR 
(1972); Banks (1972); O’Driscoll (1972,1975b, 1976,1978); 
Stanek (1973); MCA (1974 TC-7); CIA (1975 PA1); Fizer 
(1976); P.J. Lynch (1977); HSE (1978b); Chlorine Institute 
(1979 Publ. 66); Napier (1979a); National Supply Co. (UK) 
Ltd (1979); R.K. Cooper (1980); Taig (1980); Sanderson 
(1981); IMechE (1983/72); Schlitchtarle and Huberich 
(1983); Ichniowski (1984); Jopson and Bale (1984); 

Hawkins (1985); Glickman (1988); J.L.Woodward and 
Silvestro (1988); Canadine and Purdy (1989); G.O. Rogers 
and Sorenson (1989); Saccomanno and El-Hage (1989); 
Saccomanno et al. (1989); J.L.Woodward (1989b); Gorys 
(1990); Rhyne (1990); Saccomanno, Shortreed and Mehta 
(1990); ACDS (1991); DTp (1993b); Janes Information Group 
(1993c); Tenniswood, Sharp and Clark (1993) 

Tunnels 

WE. Baker etal. (1979); Larson, Reese andWilmot (1983); 
Anon. (1985ee); HSE (1985e); A. Jones (1985); Considine 
(1986); M.M. Grant (1989); NFPA (1992 NFPA 502); 
Charters, Gray and McIntosh (1994) 

Waterways 

Martinson (1964); H.P. Nelson (1964); Steymann 
(1966); Briley (1967); Sohnke (1971); French and Richards 
(1973); Backhaus and Janessen (1974); Chlorine Institute 
(1984 Publ. 79); Ligthart (1980); Backhaus (1982); 

Boniface (1989); J.R. Thompson et al. (1990); API (1991 
RP 1125) 

Pipelines 

AGA (Appendix 28); ASCE (Appendix 28,1965/19,1975/5, 
1978/7,1979/8,1983/14,1984/17,20,1988/37,1991/44); 
ASME (Appendix 28 Pipeline Engineering)-, British Gas 


(Appendix 27,28); NTSB (Appendix 28 Pipeline Accidents 
Reports, 1978); Henderson (1941); Anon. (1964c); Lennart 
(1964); H.P. Nelson (1964); IGasE (1965/7,1967/89,1976/10); 
F.C. Price (1965,1974a, b); BRE (1966/3); Chilton (1966); 
FPC (1966); Hubbard (1967); IP (1967 Model Code Pt 6); 
NWB. Clarke (1968); Inkofer (1969); Rohleder (1969); 
Prescott (1970); Wasp,Thompson and Snoek (1971); 
Cleveland and Young (1972); Davenport and Brameller 
(1972); Walker, Coulter and Norrie (1972); Weiner, Mercer 
and Gibson (1972); Gibson, Knowles and Mercer (1973); 
NW Roberts and Stewart (1973); Smelt and James (1973); 
Devine etal. (1974); DOT (1974); C.C. Hale (1974); Anon. 
(1975f); L.J. Allen (1975); DOT, OPS (1975); Luddeke (1975); 
Newmark and Hall (1975); Szilas (1975); CONCAWE (1977 
9/77); Demars etal. (1977); DOT, OPSO (1977b); Gulf 
Publishing Co. (1977); IGasE (1977 Comm. 1044, IGE/TD1); 
Knowles,Tweedle and van der Post (1977); McKay et al. 
(1977); Sterling (1977); Dickson (1978); HSE (1978b,d, 
1980a,c); ASME (1979 Pressure Piping Code B31.4.1989 
Pressure Piping Code B31.8); Bryce and TUrner (1979); 
Muleski, Ariman and Auman (1979); Riley (1979); 
Shinozuka.Takadu and Ishakawa (1979);Tasucher and 
Streiff (1979); Wang and Cheng (1979);Thorley (1980); 

M.J. Turner (1980); de la Mare and Andersen (1981); 

Sheffy (1981); Stephenson (1981a); Chlorine Institute 
(1982 Publ. 60); N.C. Harris (1982); Sabnis, Simmons 
and Teuscher (1982); Whalley and Long (1982); 

Whittaker et al. (1982); Considine (1983); Diab (1983); 

API (1984/14,1985 Publ. 1108,1988 Std 1104,1991 RP 
1107,1110,1118,1119,1120,1993 RP 1102,1109,1113); 
Blything (1984 SRD R326); Forsyth (1984); G.G. King 
(1984); Pipeline Industries Guild (1984); Berryman and 
Daniels (1985); Bruce (1985); Fearnehough (1985); 

Jinsi (1985); Kipin (1985); Lund etal. (1985); Stripling, 
Khan and Dillon (1985); True (1985); Darton (1986); 
Redman (1986a,b); BP Petroleum Development Ltd 
(1988); C.C. Hale and Lichtenberg (1988); NRC, 
Transportation Research Board (1988); Bolt and 
Logtenberg (1989); D.A. Carter (1991); Colombari etal. 
(1992); Ahammed and Melchers (1993); DTI (1993); de la 
Mare and Bakouros (1994) 

Corrosion protection, cathodic protection: AGA (1979/29, 
1990/67); British Gas (1992 GBE/ECP) 

Plastic pipelines: British Gas (1985 Comm. 1281,1986 BGC/ 
PS/PL2); AGA (1989/12) 

Trenchless technology: International Society for Trenchless 
Technology (1991); ACGIH (1992/86) 

ICS (Appendix 27,1974); IP (n.d.); NTSB (Appendix 28 
Marine Accident Reports); OCIMF (Appendix 27); SIGTTO 
(Appendix 28); Wardle (n.d.); Minorsky (1959); Burgoyne 
(1965a); Rawson and Tupper (1968-); Comstock and 
Robertson (1969); Dickinson (1969); Dyer (1969); Advisory 
Committee on Carriage of Dangerous Goods by Sea (1971); 
DTI (1971); Lakey (1971,1973,1976); Neal (1971); Page and 
Gardner (1971); Stirling (1972); H.D. Williams (1972,1973); 
F.A. Smith (1973); European Petroleum Organisations 
(1974); Kahn,Talbot and Woodward (1974); Mostert (1974); 
Boe and Foleide (1975); Chapman (1975); Eisenberg, Lynch 
and Breeding (1975); Swinbank (1975); Henderson, 
Srinivansan and Gower (1976); NPC (1976); JJ. Smith (1976); 
Davison (1977); IMCO (1977); Mullins (1977); Tanker Safety 
Group (1977); HSE (1978b, 1981a); ICS/OCIMF (1978); van 
Poelgeest (1978); Snow (1978); Planning Research Corp. 
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(1979); Bockenhauer (1980); Rutherford (1980); B. White 
(1980); Gardenier (1981); Gregory (1981); Aldwinkle and 
Slater (1983); van den Brink (1983); Georgas (1983); 
Hendrickx and Lannoy (1983); van der Horst and van der 
Schaaf (1983); Hough (1983); Preston (1983); Colonna (1984, 
1986); Fleming (1984); Champness and Jenkins (1985); 
ACDS (1991); API (1991RP1140,1993 RP1139); DoT (1992); 
Janes Information Group (1993b); Paris Memorandum 
(1993); Donaldson (1994); Gilbert (1994); Hodges (1994); K 
James (1994); Jenkins (1994); Rawson (1994) 

Codes, classification rules, regulation: AW. Clarke (1971a); 
DTI (1971); Lakey (1971,1973,1976); Kvamsdal (1973); 

R.K. Roberts (1973); International Chamber of Shipping 
(1974); IMCO (1977); Anon (1984r); R. Pearson (1984); 

J. Smith (1994) 

Cargo compatibility: Flynn and Rossow (1970a,b); Flynn 
and Morrisette (1977); Morrisstte (1979) 

Hazard information systems: DOT, CG (1974a—d); Butt 
(1975); Myatt (1975); Rappaport (1975); Willis and Cece 
(1975) 

Human factors: Page (1971); Leeper (1973); Hoof t, Keith and 
Porricelli (1975); D. Anderson, Istance and Spencer (1977) 
Vessel design: Comstock (1967); Rawson andTupper (1968); 
Barnaby (1969); J. Cox (1971); R.K. Roberts (1973,1983); 
Hansen and Vedeler (1974); Chapman (1975); N. Jones (1976, 
1983); Eyres (1978); HSE (1978b, 1981a); Kitamura, 
Okumoto and Shibue (1978); Bockenhauer (1982,1985); 
Clayton and Bishop (1982); Farrell (1982); Huther and 
Benoit (1983); Jean and Lootvoet (1983); Kinkead (1983, 
1985 SRD R324); Betille and Lebreton (1986); Egge and 
Bockenhauer (1991) 

Cargo tanks: Schampel and Steen (1975,1976); 
Bockenhauer (1982) 

Ship movement: A.G. Robinson (1971); Bovet (1973); 
Computer Sciences Corp. (1973); PWW Graham (1973); US 
Coast Guard (1973); McDuff (1974); Eda (1976); J.W. Miller, 
Schneider and Varchok (1976); NPC (1976); Port of London 
Authority (1977); HSE (1978b, 1981a); Transportation 
Systems Centre (1978); ASCE (1980/11,1983/14,1986/28, 
1989/37); Ligthart (1980); Brok and van der Vet (1984); 
Mankabady (1982);Technica (1985); ACDS (1991) 

Collision, grounding: E. Chen (1975); Kinkead (1978 SRD 
R91,1985 SRD R342); Vaughan (1978); Ligthart (1980); 
Poudret et al. (1981); Asadi and Vaughan (1990): ACDS 
(1991) 

Ship shore transfer: B. White (1980); Armitage (1983); 

T.B. Morrow et al. (1983); Bond (1986 LPB 71); Holtkamp 
and Keech (1989) 

Emergency response, planning: Preston (1983); NFPA (1990 
NFPA1405); ACDS (1991) 

Pollution: Stubberud (1973); European Petroleum 
Organisation (1974); Hann and Jensen (1975); Lakey (1976); 
Fleming (1984) 

Tank purging, cleaning, inerting and flame protection: 
Page and Gardner (1971); Bang and Birkeland (1973); 
Boddaert (1975); Harth (1975); Savage (1975); Schampel 
and Steen (1975,1976,1977); Steensland, Askheim and 
Vossgard (1975); R.P. Wilson and Atallah (1975); Berkel 
(1982); Astleford, Morrow and Buckingham (1983); Anon. 
(1984s); Astleford, Bass and Colonna (1985) 

Vapour emission, vapour emission control: T.B. Morrow 
(1980,1982b, 1985); T.B. Morrow et al. (1980); API (1989/17, 
1991 RP 1124,1992/20); Lawrence and Cross (1994) 

Fire, explosion: Burgoyne (1965a); Schb’n (1968); Page and 
Gardner (1971); Victory and Roberts (1971); Wilse (1974); 


Barreto (1975); Goland and Critelli (1975); Kitagawa (1975); 
J.H. Lee, Knystautas et al. (1975); Rushbrook (1979);Takeda 
(1988) 

Static electricity: H.R. Edwards (1983); J.S. Mills and 
Oldham (1983); M.R.O. Jones and Bond (1984,1985) 

Fire protection: Page and Gardner (1971); Tanner (1976); 
Rushbrook (1979); Anon. (1980o, 1982k); Dicker and 
Ramsey (1983); Dimmer (1986); Wynne (1986); Gebhardt 
(1989); McKenna (1989); ACDS (1991); NFPA (1993 NFPA 
306) 

Containers, packing: Savi (1971); Stubberud (1971); 
Buschmann (1973); Kemler (1975); Swinbank (1975); 
Department of Trade (1977); UN (1991) 

Ports, port storage 

McKinley (1968); Meijer (1968); Dickinson (1969); Murdoch 
(1971); Siccama (1971); Bohlin (1973); J.R. Bradley (1973); 
Vossenaar (1975); Davison (1977); Hartlich (1977); HSE 
(1978b, 1980 HS(G) 7,1981a, 1986 GS 40); ASCE (1980/11, 
1983/15,1986/29,1989/38); Bryce (1980); Gebhardt (1980, 
1989); P. Lewis (1981); NFPA (1990 NFPA 307); ACDS (1991) 

Air 

Pike (1975a,b); Civil Aviation Authority (CAA) (1977); 

K Warner (1981); Wilkinson (1989); Janes Information 
Group (1993a) 

Particular chemicals 

Ammonia: Heller (1965,1981); Briley (1967); Inkofer (1969); 
Olsen (1969); Rohleder (1969,1971); Medard (1970); Cato 
and Dobbs (1971); Caserta (1972a); C.C. Hale (1974); CIA 
(1975/9, PAI); Eisenberg, Lynch and Breeding (1975); 
Luddeke (1975); O’Driscoll (1975a); Sterling (1977); Fiber 
(1981); DCMR (1985); Josefson (1987); C.C. Hale and 
Lichtenberg (1988) 

Chlorine: Chlorine Institute (Appendix 28,1979 Pmphlt 66, 
1981 Pmphlt 76,1982 Pmphlt 60,1984 Pmphlt 49,79,1986 
Pmphlt. 1); Danielson (1964); H.P. Nelson (1964); R.L. 
Mitchell (1971,1972,1982); Mathiesen, Bakke and Boe 
(1973); Westbrook (1974); Eisenberg, Lynch and Breeding 
(1975); Macdonald (1977); DCMR (1985); Hunter (1988); J.L. 
Woodward and Silvestro (1988); Canadine and Purdy 
(1989); Rhyne (1990) 

Explosives: P.A. Davies (1990,1993); ACDS (1991); 
Sorenson, Carnes and Rogers (1992); Gilbert, Lees and 
Stilly (1994a—i) 

LNG (see Table 11.23) 

LPG: Faridany and Ffooks (1983); Jager (1984); 

Puklavec and Lindenau (1985); Davenport (1988); Anon. 
(1990c) 

Monomers: Butcher and Sharpe (1983); Kurland and 
Bryant (1987) 

Petroleum: J.R. Hughes (1970); Page and Gardner (1971); 

F. A. Smith (1973); IP (1982 MCSP Pt 6) 

Particular chemicals: other chemicals 
Carbon dioxide: Brumshagen (1983) 

Ethylene: Anon. (1962f); Waddams and Cann (1974); McKay 
et al. (1977); Backhaus and Olschlager (1985) 

Lead additive: Associated Octel (1972 Bklt 23/72,1975 Bklt 
22/75) 

Liquefied gases: Purdy et al. (1988) 

Peroxides: Anon. (1984ee) 

Polybrominated biphenyls (PBBs): Jacobs, Chou and Tiedje 
(1976); Kay (1977) 
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Radioactive materials: Pike (1975a,b); DoE (1975/5); Wilson 
(1981LPB 42); Tuler, Kasperson and Ratick (1989) 
Self-heating materials: Stone,Williams and Hazlett (1976) 
Sulfur: Landry and Hiller (1975) 

Vinyl chloride: Dowell (1971); Kogler (1971); O’Mara, 

Crider and Daniel (1971); Wheeler and Sutherland (1975); 
Mukerji (1977) 

Fire (see Tables 16.1 and 16.2) 

Spill control ( see also Table All.l) 

R.L. Mitchell (1971,1972,1982); Baier etal. (1975); 

Brugger and Wilder (1975a,b); G.W. Dawson (1975); Pilie 
etal. (1975); Bulloff and Sinclair (1976); Froebe (1976, 

1985);Temple etal. (1978);Thorne (1978a); Zadic and 
Himmelman (1978); R.E.Warren (1978);Tenzeref a/. (1979); 
R.H. Hall et al. (1980); Norman and Dowell (1980); Temple 
etal. (1980); Anon. (1982h); Cumberland (1982); R.M. Hiltz 
(1982); R.L. Mitchell (1982); Scholz (1982); H.M. Freeman 
(1984); Neely and Lutz (1985); P.J. Warren (1985); 

Deckert (1986) 

Leak control, sealing: Anon. (1977J); R.L. Mitchell (1982) 
Hazard assessment 

Buschmann (1968); Crouch (1968); D.LKatz (1968); 
Lindeijer (1968); McConnaughey (1971); Siccama (1971); 
McQueen etal. (1972); Coates (1973); Fortson etal. (1973); 
French and Richards (1973); Kneebone and Boyle (1973); 
McKinley (1973); Swalm (1973); Woodward-Lundgren and 
Associates (1973); Dunn (1974); Dunn andTUllier (1974); 
A.D. Little (1974); Philipson (1974b); Allan, Brown and 
Athens (1975); BDM Corp. (1975); Bohlman (1975); 
Domalski and Tsang (1975); Droppo and Watson (1975); 
Fedor, Parsons and de Coutinho (1975); Gardenier et al. 
(1975); Humphrey (1975); Philipson and Schaeffer (1975); 
Simmons (1975); Simmons and Erdmann (1975);Tihansky 
(1975); Frenkel and Hathaway (1976); USCG (1976a); Stoehr 
etal. (1977);Tanker Safety Group (1977); HSE (1978b,d, 
1980c, 1981a); Napier (1979a); Jennsen and Larsen (1980): 
N.C. Harris (1982); Philipson and Napadensky (1982); Bello, 
Romano and Dosi (1983); Bergmann and Riegel (1983); van 
der Horst and van der Schraaf (1983); Lucas, Roe and 
Waterlow (1983); Windebank (1983); DCMR (1985); N.C. 
Harris and Roodbol (1985); Moffow (1985); Ackermann 
(1986); Allsop etal. (1986); D.A. Jones and Fearnehough 
(1986); Medland (1986); Purdy etal. (1987,1988); van Aerde, 
Stewart and Saccomanno (1988); Cummings and Bradley 
(1988); Ormsby and Le (1988); J.L Woodward and Silvestro 
(1988); Abkowitz and Cheng (1989); Andreassen and 
Gjerstadt (1989); Canadine and Purdy (1989); Guy (1989); 
Hoftijzer, van der Schaaf and Lupker (1989); Hubert and 
Pages (1989); V.C. Marshall (1989a, 1991b); Sellers and 
Bendig (1989,1990); Birk, Anderson and Coppens (1990); 
Ramachandran (1990b); Saccomano, Shortreed and Mehta 
(1990); J.R. Thompson et al. (1990); ACDS (1991); Brockhoff 
(1992); R.T. Hill (1992); Goh.Tan and Ching (1993); 
Medhekar, Gekler and Bley (1993); Purdy (1993); Romer 
etal. (1993); Song, Black and Dunn (1993);Tenniswood, 
Sharp and Clark (1993) 

Comparative studies — modes of transport: Westbrook 
(1974); Beattie (1989); Saccamano et al. (1989); ACDS (1991) 
Comparative studies — alternative routes: Rhyne (1990); 
ACDS (1991), 

Comparative studies — transport vs fixed installations: 
Haastrup and Brockhoff (1990); Haastrup and Styhr 
Petersen (1992) 


Explosives: Chapman and Holden (1987 SRD R412); P. A. 
Davies (1990); ACDS (1991) 

Transport statistics, transport accident statistics 

Hicks etal. (1973); Gay (1975); Department of Energy 
(1977b); Ichniowski (1987); ACDS (1991) 

Road: North (1974); DoT (1982,1985); CSO (1986); A. James 
(1986); Grime (1987); ACDS (1991); P.A. Davies and Lees 
(1991b, 1992) 

Rail: ACDS (1991); P.A. Davies and Lees (1991a) 

Rotorcraft: NTSB (1981) 


www.unece.org 

The United Nations Economic Commission for Europe 
(UNECE) provides links to all European nations’s trans¬ 
portation regulatory websites. 

www.cefic.be/Templates/shwStory.aspPNID = 27 
&HID = 365 

CEFIC is the European Chemical Industry Council (similar 
to ACC in the United States). The above link is to their 
Transport and Logistics section. 

UK 

www.hse.gov.uk 

The Health and Safety Executive (HSE) website provides 
multiple references to transport safety, as well as links to 
other, related sites at the following link: 

www.hse.gov.uk/spf/cdg/links.htm 

US 

Governmental Links: 
www.dot.gov 

The United States Department of Transportation (DOT) 
website provides information similar to the HSEs, specific 
to the United States. In particular, the following links pro¬ 
vide useful information: 

www.hazmat.dot.gov 

This link provides information on general Hazmat safety, 
including links to the Research and Special Programs 
Administration (RSPA), which is responsible for coordi¬ 
nating a national safety programme for the transportation 
of hazardous materials by air, rail, highway and water. 

www.geosbush.com/ctpat.htm 

This is a link to the Customs-Trade Partnership against 
Terrorism (C-TPAT) website. C-TPAT is a joint government- 
business initiative to build cooperative relationships to 
strengthen border security. 

www.hazmat.dot.gov/gydebook 

This is a link to the on-line version of the DOT Emergency 
Response Guidebook, 2000 edition. A revised edition is due 
out in 2004. 
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www.fra.dot.gov 

The Federal Railroad Administration (FRA) provides 
information specific to transport by rail in the US. 

www.faa.gov/regulations 

The Federal Aviation Agency (FAA) governs air traffic in 
the United States. The regulations section of their website 
lists both mandatory and non-mandatory guidance. 
Non-Governmental Links: 

www.transcaer.org/public/home.cfm 

TRANSCAER is a voluntary national outreach effort that 
focuses on assisting communities to prepare for a possible 
hazardous materials transportation incident. 

www.americanchemistry.com 

The American Chemistry Council (ACC) represents the 
leading companies engaged in the business of chemistry. 
Council members apply the science of chemistry to make 
innovative products and services that make people’s lives 
better, healthier and safer. The Council is committed to 
improved environmental, health and safety performance 
through Responsible Care, common sense advocacy 
designed to address major public policy issues, and health 
and environmental research and product testing. 

www.chemtrec.org 

Chemtrec, sponsored by the ACC provides a 24-h hazard¬ 
ous communications centre for member companies and 


www.chemtelinc.com 

CHEM-TEL is a 24-h emergency response telecommunica¬ 
tions service for industry. 

www.umtri.umich.edu 

The University of Michigan’s Transportation Research 
Institute conducts research into transportation safety. 

www.usroads.com 

USRoads provides a compilation of links to commercial 
sites dealing with transportation issues. 

www.aar.com 

The American Association of Railroads (AAR) provides 
information, research and training on the control and 
response to hazardous materials incidents in transport by 
rail. 

www.trucking.org 

The American Trucking Association (ATA) provides infor¬ 
mation on truck transport in the United States. 

Canada 

www.tc.gc.ca 

Transport Canada provides information in both French and 
English. It also provides the 2000 edition of the North 


American Emergency Response Guidebook on-line in French, 
English and Spanish. 

www.tc.gc.ca/canutec/en/menu 

Canutec provides hazard communications services in 
Canada similar to Chemtrec in the United States. 

Australia 

www.aph.gov.au/library/intguide/law/transportlaw.htm 
The Australian Parliament provides links to transport law, 
as well as non-governmental informational links. 

Mexico 

www.aniq.org.mx/setiq/setiq.htm 

SETIQ in Mexico provide similar services as CANUTEC 

and CHEMTREC provide in Canada and the United States. 

23.1 General Considerations 

The ability to transport the raw materials to and the prod¬ 
ucts from the plant is very important in determining the 
viability of a project. This aspect was briefly considered in 
Chapter 1 in relation to ethylene plant economics. 

The type of transport used may greatly affect the storage 
requirements. A mode of transport which involves larger 
but infrequent deliveries is, in general, likely to require 
more storage than one which gives continuous flow. Ship, 
rail, road and pipeline thus constitute a spectrum of modes 
of transport ranging from large discrete to continuous 
deliveries. The associated storage requirements have cor¬ 
responding economic and safety implications. 

In transport as in other aspects of loss prevention, 
training is of the greatest importance. It is essential that 
all personnel involved in the transport of chemicals are 
thoroughly trained in the properties of the chemicals and 
the associated hazards and in the normal operating and 
emergency procedures. 

23.1.1 Modes of transport 

The following modes of transport are used for the move¬ 
ment of hazardous materials: 

(1) road; 

(2) rail; 

(3) waterway; 

(4) pipeline; 

(5) sea; 

(6) air. 

23.1.2 Transport movements 

For the United Kingdom, information on the movements of 
hazardous materials is given in Transport Statistics Great 
Britain 1991 by the DTp (1992b), which is part of an annual 

Further data on the movements of hazardous materials 
by road and rail in the United Kingdom are quoted in the 
ACDS Transport Report and are given below in Sections 
23.6 and 23.8, respectively. 

For the United States, corresponding information is 
provided in the annual reports of the NTSB. The NTSB 
Annual Report for 1979 states that there were in that year 
some 250,000 hazardous materials shipments per day. 
Reports of accidental releases numbered about 16,000 and 
there were 19 fatalities and 942 injuries. The breakdown 
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of fatalities by commodity was as follows: gasoline 
32.5%, LPG 21.7%, chlorine 9.6%, corrosive liquids 9.6%, 
anhydrous ammonia 6%, aviation fuel 2.4%, compressed 
gas, 2.4% and others 15.6%. The Annual Report for 1991 
quotes the same number of daily shipments of hazardous 
materials. 


23.1.3 Transport conditions 

The main sets of conditions for gas or liquid transport are: 

(1) liquid at atmospheric pressure and temperature 
(atmospheric transport); 

(2) liquefied gas under pressure and at atmospheric tem¬ 
perature (pressure transport); 

(3) liquefied gas at atmospheric pressure and at low tem¬ 
perature (fully refrigerated transport); 

(4) gas under pressure. 


The behaviour of fluids released from such conditions 
has been described in Chapters 15 and 22. An account 
related specifically to transport is given by VC. Marshall 
(1991b). 

23.1.4 Transport hazards 

The transport of hazardous materials may present a hazard 
to (1) the transporter, (2) the crew or (3) the public. The 
relative importance of these varies between the different 
modes of transport. 

The hazards presented by the transport of chemicals are: 

(1) fire; 

(2) explosion; 

(3) toxic release 

(a) conventional toxic substances, 

(b) ultratoxic substances. 

As with fixed installations, so with transport, the most 
serious hazards arise from loss of containment. 

Modes of transport such as road, rail, waterway and 
pipeline can give rise to release of flammable gas or vapour, 
which may result in a flash fire or a vapour cloud explosion, 
or of flammable liquid which may lead to a pool fire. Flam¬ 
mable liquid can also spread and then ignite, giving rise to 
a flowing fire. Jet flames may occur on the containers. The 
contained material may undergo a boiling liquid expanding 
vapour explosion (BLEVE) or other form of explosion. In 
general, a flammable fluid is more likely to give rise to fire 
than to explosion. 

An explosion hazard also exists with substances that are 
to some degree unstable. 

If the material is toxic, release may result in a toxic gas 
cloud. Toxic or corrosive materials may also spread as 
liquids. 

With waterway and sea transport, the release of vapor¬ 
izable materials onto the water is liable to give rise to very 
rapid vaporization, resulting in a large vapour cloud. 

Transport accidents are particularly liable to cause pol¬ 
lution, since material spilled is often not recovered, but is 
dispersed into the environment. 

The initiating factor in a transport accident may be (1) 
the cargo, (2) the transporter or (3) the operations. 

The cargo may catch fire, explode or corrode the tank; the 
transporter may be involved in a crash or derailment or fire; 


the operations such as charging and discharging may be 
wrongly executed. 

Thus, the events which can give rise to hazards include 
particularly (1) container failure, (2) accident impact and 
(3) loading and unloading operations. 

Although the attention in transport of hazardous 
materials by moving vehicles focuses on the injury caused 
by release from containment, fatalities also occur due to 
the movement of the vehicles themselves. This should be 
taken into account also, particularly in comparative studies 
of different modes of transport, since although the deaths 
from this cause in any one accident tend to be small in 
number, they may in total equal or exceed those from the 
releases. 

23.1.5 Size of units 

As with fixed installations, so with transport, the question 
arises as to whether it is safer to handle a given quantity of 
hazardous material in a few large units or in many smaller 
ones. In particular, there is a wide range of possibilities 
with sea transport. The choice made affects not only the 
size of the ship but also that of the associated storage on 
land. In general, a small number of large units appears 
safer in the sense that the product of scale and frequency 
tends to be less. This is because, with fewer units, it is 
easier to achieve a more uniformly high standard of design 
and operation, and the frequency of incidents is less. The 
scale of the most serious accident, however, is greater. The 
problem has been considered by the Tanker Safety Group 
(1977), which has reviewed the historical experience with 
large crude oil tankers and supertankers. 

23.1.6 Multi-use containers 

The use of the same container to carry different chemicals 
is quite normal; it is fairly common practice in road tankers, 
barges, ships and pipelines. This not only creates potential 
problems of compatibility between materials carried, but 
also means that the carrier is less familiar with the sub¬ 
stances he is transporting. 

23.1.7 Loading and unloading 

Many of the hazards associated with transport arise during 
loading or unloading. This aspect was treated in relation to 
storage in Chapter 22 and is considered only occasionally 
in this chapter. 

23.2 International Codes 

The transport of chemicals is an international activity and 
international codes assumes a dominant role. These codes 
govern not only the classification, packaging and labelling 
of substances, but also the transport containers. There are 
four main codes which are relevant here and these are now 
described. 

23.2.1 UN Transport Code 

A basic code for international transport is provided by the 
Recommendations on the Transport of Dangerous Goods 
(United Nations, 2001) (the UN Transport Code). 

Topics dealt with in the code include: (1) classification, 
including testing; (2) packing; (3) labelling; (4) transport 
containers, including intermediate bulk containers and 
tank containers (IBCs) and (5) consignment procedures. 

The classification of dangerous goods for transport 
given in the UN Transport Code provides a framework 
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which is followed by other codes. The classification scheme, 
which is based on classification by class of substance, is 
shown in Table 23.2. 

In addition to this classification, there is for Class 1, 
explosives, a further categorization by compatibility group. 
The compatibility groups are A-H, J-L, N and S. The 
general nature of these compatibility groups is illustrated 
by the following entries: 

Group A Primary explosive substance. 

Group B Article containing a primary explosive sub¬ 
stance and not containing two or more effective 
protective features. 

Dangerous goods of all classes other than Class 1, 2,5.2, 

6.2 and 7 are assigned for packing purposes to one of three 


Table 23.2 UN Transport Code: classification of 
substances (United Nations, 2001) 


groups according to the degree of danger which they 
represent: 

Packing group 

I Great danger. 

II Medium danger. 

III Minor danger. 

The Code contains a set of specimen hazard warning 
signs for the labelling of dangerous goods. Further details 
of the classification, packaging and labelling provisions of 
the code are given in Section 23.3. 

The Code gives recommendations for the mechanical 
design, service equipment and pressure relief arrange¬ 
ments for transport containers, as described in Section 
23.4. It also contains recommendations on consignment 
procedures, including packages and the provision of 
transport documentation. In addition to the general 
recommendations of the Code, there are special recom¬ 
mendations applicable to each class of substance. 


Class 10 Explosives 

Division 1.1 Substances and articles which have a mass 
explosion hazard 

Division 1.2 Substances and articles which have a 

projection hazard but not a mass explosion 
hazard 

Division 1.3 Substances and articles which have a fire 
hazard and either a minor blast hazard or a 
minor projection hazard or both but not a 
mass explosion hazard 

Division 1.4 Substances and articles which present no 
significant hazard 

Division 1.5 Very insensitive substances which have a 
mass explosion hazard 

Division 1.6 Extremely insensitive articles which do not 
have a mass explosion hazard 


Class 2 Gases 

Division 2.1 Flammable gases 

Division 2.2 Non-flammable, non-toxic gases 

Division 2.3 Toxic gases 


Class 3 Flammable liquids 
Class 4 Flammable solids; substances liable to 
spontaneous combustion; substances 
which in contact with water emit 
flammable gases 
Division 4.1 Flammable solids 
Division 4.2 Substances liable to spontaneous 
combustion 

Division 4.3 Substances which in contact with water 
emit flammable gases 

Class 5 Oxidizing substances; organic peroxides 
Division 5.1 Oxidizing substances 
Division 5.2 Organic peroxides 
Class 6 Poisonous (toxic) and infectious 
substances 

Division 6.1 Poisonous (toxic) substances 
Division 6.2 Infectious substances 


Class 7 Radioactive materials 


Class 8 Corrosive substances 


Class 9 Miscellaneous dangerous substances 


23.2.2 European Road Carriage Agreement (ADR) 

The European code for international transport is the 
European Agreement Concerning the International Carriage of 
Dangerous Goods by Road (ADR) issued by the DTp (2003a). 

The document contains the Articles of the Agreement 
and two Annexes, Annex A and Annex B. Annex A, Pro¬ 
visions Concerning Dangerous Substances and Articles, 
has three parts: Part I on general provisions, Part II on 
special provisions for substances in the various Classes, 
and Part III a set of appendices. These appendices cover 
the following topics: Al, stability and safety conditions 
relating to explosive substances and articles, flammable 
solids and organic peroxides; A2, containers for Class 2 
substances, including aluminium alloy containers and 
containers for fully refrigerated gases; A3, tests for sub¬ 
stances; A5, general packing conditions; A6, intermediate 
bulk containers; A7, Class 7, radioactive materials; A9, 
symbols and labels. A4 and A8 are not used. 

Annex B, Provisions Concerning Transport Equipment 
and Transport Operations, has two parts and a set of 
appendices; Part I dealing with general provisions and Part 
II with special provisions for the various Classes whilst the 
appendices cover the following topics: Bl, containers 
including fixed and demountable tanks, tank containers 
and reinforced plastic tanks; B2, electrical equipment; B3 
certificates of approval for vehicles; B5 list of substances; 
and B6, certificate of driver’s training. B4 is not used. 

The provisions for classification, packaging and label¬ 
ling provisions are considered further in Section 23.3 
and those for transport containers are discussed in 
Section 23.4. 

23.2.3 International Rail Carriage Regulations (RID) 

There have for some time been a set of Uniform Rules con¬ 
cerning the Contract for International Carriage of Goods by 
Rail (CIM) and there is a Convention concerning Interna¬ 
tional Carriage by Rail (COTIF) of 1980. The international 
code for rail transport is the Regulations Concerning the 
International Carnage of Dangerous Goods by Rail (RID) 
issued by the DTp (2003b); it constitutes Annex 1 of the 
Uniform Rules. 

The document, which is itself an annex, contains 
extracts from the Articles of the Convention and from the 
Uniform Rules, which are Appendix B of the Convention. It 
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has three parts: Part I on general regulations, Part II on 
special regulations for substances in the various Classes, 
and Part III a set of appendices. These appendices cover the 
following topics: I, stability and safety conditions relating 
to explosive substances and articles, flammable solids and 
organic peroxides; II, containers for Class 2 substances, 
including aluminium alloy containers and containers for 
fully refrigerated gases; III, tests for substances; V, general 
packing requirements; VI, intermediate bulk containers; 
VII, Class 7, radioactive materials; DC, symbols and 
labels; X,construction, testing and use of tank containers; 
and XI, construction, testing and use of tank wagons. IV 
is not used. 

The provisions for classification, packaging and labelling 
provisions are considered further in Section 23.3 and 
those for transport containers are discussed in Section 23.5. 

23.2.4 International Maritime Dangerous 
Goods (IMDG) Code 

For sea transport, the relevant code is the International 
Maritime Dangerous Goods Code (IMDG Code) issued by 
the IMO (2002IMO-200). The classification for dangerous 
goods for maritime transport given in the IMDG Code 
is again virtually the same as that of ADR, as shown in 
Table 23.2. 


23.3 Classification, Packaging and Labelling 

There is a large international trade in dangerous goods and 
it is particularly important that the arrangements for the 
classification, packaging and labelling of these substances 
be accepted internationally. 

23.3.1 Regulatory controls and codes 

As already described, the international codes governing the 
transport of dangerous goods, namely the UN Transport 
Code, ADR, RID and the IMDG Code, give detailed recom¬ 
mendations on classification, packaging and labelling. 

Classification, packaging and labelling is the subject of 
EC Directive 67/548 (the Dangerous Substances Directive). 
In the United Kingdom, this directive was implemented for 
the road transport of hazardous materials by the Classifi¬ 
cation, Packaging and Labelling Regulations (CPL) 1984. 
The associated Approved Codes of Practice (ACOPs) are 
COP 19 Classification and Labelling of Substances Danger¬ 
ous for Supply andjor for Conveyance by Road 1984, Revi¬ 
sion 1 (HSE, 1990) and COP 40 Packaging of Dangerous 
Substances for Conveyance by Road 1984, Revision 2 (HSE, 
1990). Guidance is given in HS(R) 22 A Guide to the Classi¬ 
fication, Packaging and Labelling Regulations 1984 (HSE, 
1985). Also relevant is COP 33 Transport of Compressed 
Gases in Tube Trailers and Tube Containers (HSE, 1989). 

The Chemicals (Hazard Information and Packaging) Regu¬ 
lations 1993 (CHIP) now supersede the CPL Regulations. 

These regulations are complemented by the Road Traffic 
(Carriage of Dangerous Substances in Packages etc.) Regu¬ 
lations 1992 and the Road Traffic (Carriage of Dangerous 
Substances in Road Tankers and Tank Containers) Regula¬ 
tions 1992, which are described in Section 23.5. 

Guidance on cargo transport units (CTUs) for marine 
transportisgiveninHS(G)78Cowto'«erPacfe'wg(HSE,1992). 

For explosives there are the Classification and Labelling 
of Explosives Regulations 1983 (CLER) and the Packaging 
of Explosives for Carriage Regulations 1991. 


23.3.2 UN Transport Code 

The classification scheme of the UN Transport Code has 
been given in outline inTable 23.2. The Code gives guidance 
on assignment to a class, or a division within a class. For 
some classes of substances, notably explosives and organic 
peroxides, there are specified tests. These tests, and the 
flow charts for assignment, are described in Chapter 8. 

For Class 3, Flammable liquids, there is a hazard group¬ 
ing based on boiling point and flashpoint. This is 


Packing group 

Flashpoint 

Initial 


(closed cup) 

boiling point 


(°C) 

(°C) 

I 

_ 

<35 

II 

<23 

>35 

III 

>23, <60.5 

>35 


For Class 6, Poisonous (toxic) substances, there are group¬ 
ing criteria for solids and liquids based on oral toxicity and 
dermal toxicity, both characterized by an LD 50 value (the 
lethal dose at the 50% level) and for dusts and mists by an 
LC 50 value (the lethal concentration at the 50% level) for a 
1 h exposure. For toxic vapours, the grouping criteria are 
shown in Figure 23.1. The Code gives a list of the dangerous 
goods most commonly carried. It also gives guidance on the 
assignment of a substance which is not in the list and which 
presents more than one hazard. The guidance is in the form 
of (1) a list of classes and divisions in the order of pre¬ 
cedence and (2) a precedence table. 

The UN Transport Code gives detailed definitions of 
forms of packaging and specifies requirements for testing 
and marking. 

23.3.3 European Road Carriage Agreement (ADR) 

The classification for dangerous goods for transport by 
road given in the ADR is shown inTable 23.3.The classifi¬ 
cation is similar, but not identical, to that of the UN Trans¬ 
port Code. 

A special feature of ADR is that the classes are either 
restrictive or non-restrictive. The restrictive classes are 
Classes 1,2,6.2 and 7 For a restrictive class, only the goods 
specifically listed may be carried and goods not listed are 
prohibited. For a non-restrictive class, some goods, 
although not specif ically listed by name, may fall under one 
of the generic descriptions in the class, and are then carried 
according to the provisions which apply to that group, 
whilst other goods which display the dangerous properties 
of the class, but are not listed either specifically or gener- 
ically, may be carried free of ADR. However, there are for 
non-restrictive classes some goods which are prohibited. 

ADR gives a further classification for Class 2, Gases, 
which is particularly relevant here. This is shown in 
Table 23.4. 

23.3.4 International Rail Carriage Regulations (RID) 

The classification for dangerous goods for transport by 
rail given in RID is the same as that shown Table 23.3, with 
the slight modification given in the footnote to that table. 

23.3.5 CHIP Regulations 2002 

Like the CPL Regulations which they replace, the (CHIP) 
Regulations 2002 deal with classification, packaging and 
labelling of chemicals. 
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Figure 23.1 UN Transport Code: grouping criteria for toxic vapours (United Nations, 1993; reproduced by permission) 


Table 23.3 European Agreement for Road Transport 
(ADR): classification of substances? (Department of 


Transport, 2003a) 

Class 1 

Explosive substances and articles 

Class 2 

Gas: compressed, liquefied or dissolved under 
pressure 

Class 3 

Flammable liquids 

Class 4.1 

Flammable solids 

Class 4.2 

Substances liable to spontaneous combustion 

Class 4.3 

Substances which give off flammable gases on 
contact with water 

Class 5.1 

Oxidizing substances 

Class 5.2 

Organic peroxides 

Class 6.1 

Toxic substances 

Class 6.2 

Repugnant substances and substances liable to 
cause infection 

Class 7 

Radioactive material 

Class 8 

Corrosive substances 

Class 9 

Miscellaneous dangerous substances and 
articles 


a The classification given in the RID is identical with the above, except 
that very slightly different wording is used for Classes 4.3 (Sub¬ 
stances which, in contact with water, emit flammable gases) and 6.2 
(Infectious and repugnant substances). 


There are three HSE documents issued in support of 
these regulations. Guidance is given in L38 Approved 
Guide to the Classification and Labelling of Substances 
and Preparations Dangerous for Supply (the Approved 


Classification and Labelling Guide) (2002). L37 (2002) gives 
guidance on materials safety data sheets. The third docu¬ 
ment is the Approved Supply List, described below. 

The CHIP Regulations cover both supply and con¬ 
veyance. The supply provisions are designed to provide 
protection to those who handle dangerous substances, the 
conveyance provisions protection to those concerned with 
their conveyance. 

The regulations distinguish between substances and 
preparations, the latter being mixtures of substances. They 
also distinguish in classification between supply and con¬ 
veyance. Regulation 4 defines two approved lists. The 
Approved Supply List is given in Information Approved for 
the Classification and Labelling of Substances and Prepara¬ 
tions for Supply and the Approved Carriage List is given in 
Information Approved for the Classification and Labelling of 
Substances and Preparations for Carriage. 

Regulation 5 requires that a substance or preparation 
dangerous for supply should not be supplied unless it 
meets the requirements of this regulation, which include 
that it is in the Approved Supply List, that it is a new sub¬ 
stance classified in accordance with the Notification of New 
Substances Regulations 1982, or that it is classified in 
accordance with Schedule 1 of the CHIP regulations. Regu¬ 
lation 6 requires that the supplier should provide a safety 
data sheet. Regulation 7 requires that a substance or pre¬ 
paration dangerous for carriage should not be carried 
unless it has been classified by reference to the Approved 
Carriage List in the manner specified in the regulation. 

Regulation 8 gives requirements for the packaging of sub¬ 
stances or preparations dangerous for carriage or supply. 
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Table 23.4 European Agreement for Road Transport 
(ADR): classification of Class 2, Gases (Department of 
Transport, 1993a) 


A Subclasses of Class 2 a 


A Compressed gases having a critical temperature below 
-10°C 

B Liquefied gases having a critical temperature of 
-10°C or above 

(a) Liquefied gases having a critical temperature of 
70°C or above 

(b) Liquefied gases having a critical temperature of 
—10°C or above, but below 70°C 

C Deeply refrigerated liquefied gases 
D Gases dissolved under pressure 
E Aerosol dispensers and non-refillable containers of gas 
under pressure 

F Gases subject to special requirements 
G Empty receptacles and empty tanks 

B First subdivision, mainly relating to pure/gas or 
mixture 


Pure and technically pure gases Mixtures of gases 
A 1° 2° 

B(a) 3° 4° 

B(b) 5° 6° 

C 7° 8° 

D 9° 

Also 

E 10° aerosol dispensers; 11° non-refillable 
containers 

F 12° various mixtures of gases; 13° test gases 
G 14° empty receptacles and empty tanks, uncleaned 

C Second subdivision, relating to chemical 
properties 

(a) Non-flammable 

(at) Non-flammable, toxic 

(b) Flammable 

(bt) Flammable, toxic 

(c) Chemically unstable 

(ct) Chemically unstable, toxic 


a These subdivisions are used in a hierarchy which may be illust¬ 
rated by that of subclass A which is ordered: A; 1°; (a); (a t); (b); (b t); 

(c t); 2°; etc. 

These requirements cover three main points. The package 
should be designed, constructed, maintained and closed so 
as to prevent the leakage of the contents when the overall 
package is subjected to normal handling. Any packaging 
material likely to come into contact with the substance 
should be compatible with it. The closure on a container 
which is repeatedly reused should be designed so that even 
after repeated use it will not leak. These requirements are 
essentially similar to those of the CPL Regulations. 

Regulation 9 gives requirements for the labelling of 
substances and preparations dangerous for supply. These (1) 
include the name and address of the supplier, information (2) 
about the substance, symbols and risk and safety phrases. (3) 
Regulation 10 gives requirements for the labelling of sub- (4) 
stances and preparations dangerous for carriage. These (5) 
include the name and address of the supplier and the (6) 
hazard warning sign. 


Schedule 1 of the regulations gives three bases of classi¬ 
fication: (1) physico-chemical properties, (2) health effects, 
and (3) environmental effects. Classification on the basis of 
physico-chemical properties is made using the headings: 
(1) explosive, (2) oxidizing, (3) extremely flammable, (4) 
highly flammable and (5) flammable. Classification on the 
basis of health effects is made under the headings: (1) very 
toxic, (2) toxic, (3) harmful, (4) corrosive, (5) irritant, (6) 
carcinogenic, (7) mutagenic and (8) teratogenic. 

Schedule 2 gives the indications and symbols for 
substances and preparations dangerous for supply, and 
Schedule 3 the hazard warning signs for substances and 
preparation dangerous for carriage. Schedule 4 gives clas¬ 
sification provisions for preparations dangerous for supply 
and Schedule 5 gives those for pesticides. Schedule 6 lists 
the headings under which particulars are to be provided in 
safety data sheets. 

L38 gives guidance particularly on: (1) the classification 
by physico-chemical properties, health effects and envir¬ 
onmental effects; and (2) labelling and risk and safety 
phrases. For the classification of substances, the data 
necessary are essentially those of the base set given in the 
Notification of New Substances Regulations 1982. The 
guide refers particularly to the test methods of EC Direc¬ 
tive 84/449/EEC. 

With regard to labelling, L38 gives two separate sets of 
formal phrases: the risk phrases and the safety phrases. A 
risk phrase which figures prominently in occupational 
hygiene is R45: May cause cancer. 

Another risk phrase which occurs frequently in L38 is 
R48: Danger of serious damage to health by prolonged 
exposure. L38 gives detailed guidance on when R48 should 
be used. Other typical risk phrases are R23: Toxic by inha¬ 
lation, and R35: Causes severe burns. Some typical safety 
phrases are S15: Keep away from heat, S22: Do not breathe 
dust, and S29: Do not empty into drains. 

Detailed guidance on packaging is given in COP 40, an 
ACOP to the CPL Regulations. Aspects covered include: 
normal handling, dropping, stacking, abrasion and vibra¬ 
tion of packaging and weather effects on packaging; 
packaging of liquids and venting of packages; and repeated 
use of packages. 

A major feature of this code is the packaging of organic 
peroxides. It gives in Appendix Al, a list of such peroxides, 
in Appendix A2, a list of special provisions for these 
peroxides and in Appendix A3, a list of recommended 
packagings. It also gives in Appendix B, criteria for the 
packaging of organic peroxides not listed in Appendix A, 
utilizing the concept of the self-accelerating decomposition 
temperature. 

As with classification, so with labelling, a distinction is 
made between supply and conveyance. In general, for sup¬ 
ply there should be labelling on each discrete layer of 
packaging, while for conveyance, labelling is required only 
on the other layer. 

For supply, the particulars to be shown are: 


designation of the substance; 

indication(s) of the general nature of risk and the 

corresponding symbols; 

risk phrases; 

safety phrases; 

name and address of the manufacturer, importer, 
wholesaler or other supplier. 
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For conveyance, the particulars are: 

(1) designation of the substance; 

(2) substance identification number; 

(3) hazard warning sign; 

(4) additional information, covering such matters as 

(a) nature of the dangers, 

(b) advice on first aid, 

(c) action in case of fire, 

(d) measures to deal with any spillage, 

(e) instructions about any safety equipment; 

(5) name and address or telephone number of consignor or 
expert from whom advice on the hazard is available. 

The CHIP Regulations are designed to be consistent with 
the international codes such as the UN Transport Code, 
ADR, RID and the IMDG Code. 


23.3.6 Hazard warning symbols and signs 

The hazard warning labels, that is, signs and symbols, are 
international. The UN Transport Code gives specimen 
labels. Hazard warning signs for supply (brown) and sym¬ 
bols for carriage (multi-coloured) are given in the CHIP 
Regulation 2002. Hazard warning panels for road tankers 
are given in the Road Traffic (Carriage of Dangerous Sub¬ 
stances in Road Tankers and Tank Containers) Regulations 
1992. 


23.3.7 HAZCHEM system 

The CIA operates the HAZCHEM scheme described in 
Hazard Identification — A Voluntary Scheme for the Marking 
ofTankVehicles and Dangerous Substances (1975/X). 

Top panel of the HAZCHEM shows the HAZCHEM 
code number (2PE), the UN classification number 
(1230), the emergency telephone number and the hazard 
warning sign. 


The HAZCHEM guide gives information under the 
following letter code: A, emergency action code; B, sub¬ 
stance identification number; C, hazard warning sign; D, 
specialist advice; and E, evacuation. The first character in 
the code number refers to A, the emergency action code. 
The numbers 1, 2,3 and 4 refer to the firefighting methods 
to be used. The first letter P, R, S,Tor W, X,Y, Z, refers to the 
spillage action to be taken. The second letter E is added 
where there is need to consider evacuation of the area. 

There is also a European Transport Emergency Card, or 
TREMCARD, system operated by the European Council of 
the Chemical Manufacturers Federation (CEFIC) (CIA/1). 


23.3.8 US arrangements 

For the United States, accounts of controls on classification, 
packaging and labelling of dangerous substances are given 
in the NFPA Handbook (2003) and by Bierlein (1984). The 
regulating authority is the DOT. 

NFPA 704 provides a labelling system based on 
the classification system given in that code. The National 
Fire Protection Association (NFPA) diamond is shown in 
Figure 23.2. 

The DOT has a placard and labelling system. The system 
uses the United Nations (UN) hazard diamonds. Details of 
the system are given in the NFPA Handbook. 


23.4 Transport Containers 

23.4.1 Regulatory controls and codes 

The containers used for transport, whether fixed on a 
vehicle or multi-modal, are the subject of detailed require¬ 
ments in the UN Transport Code, ADR, RID and the IMDG 
Code. The general nature of the requirements for transport 
containers may be illustrated by considering those given in 
the UN Transport Code and in the ADR for road transport. 



Figure 23.2 NFPA 704 diamond (National Fire Protection Association, 2001), (Copyright © 2001 National Fire 
Protection Association Quincy, MA 02269. This warning system is intended to be interpreted and applied only by 
properly trained individuals to identify fire, health and reactivity hazards of chemicals. The user is referred to a certain 
limited number of chemicals with recommended classifications in NFPA 49 and NFPA 325M which would be used as 
a guideline only. Whether the chemicals are classified by the NFPA or not, anyone using the 704 system to classify 
chemicals does so at their own risk.) 
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23.4.2 Types of container 

The types of container used in the transport of dangerous 
goods include: (1) tanks fixed to road vehicles and rail cars; 

(2) multi-modal tank containers, which can be transported 
by several different modes of transport and (3) IBCs. There 
are also demountable tanks, which differ from tank con¬ 
tainers in that they are not intended to be loaded and 
unloaded whilst fully charged. 

The UN Transport Code defines a tank container as a tank 
having a capacity of not less than 0.45 m 3 whose shell is fitted 
with the items of service equipment and structural equip¬ 
ment necessary for the transport of dangerous liquids. 

It defines an IBC as a rigid, semi-rigid or flexible pack¬ 
aging having a capacity of not more than 3 m 3 which is 
designed for mechanical handling and is resistant to the 
stresses produced in handling and transport, as determined 
by tests. Excluded from this definition are the forms of 
packaging dealt with in Chapter 9 of the code, which covers 
items having a mass of less than 400 kg or a capacity of 
less than 0.45 m 3 . 

Tank containers are treated in the UN Code in terms of 
requirements for pressure vessels. IBCs are treated rather in 
terms of the requirements for packaging, with emphasis 
on tests for such packaging. There are pressure test require¬ 
ments , however, for certain metal IBCs such as drums. 

The ADR contains provisions for fixed tanks, or tank 
vehicles, and for tank containers. 

23.4.3 Tank containers 

In the UN Transport Code, transport containers are mainly 
dealt with in Chapter 12 on multi-modal tank transport, 
which covers tank containers for Classes 3—9 and for non¬ 
refrigerated liquefied gases, and Chapter 17 on multi-modal 
tank containers for refrigerated liquefied gases. The 
treatment is under the following broad headings: (1) gen¬ 
eral requirements, (2) cross-sectional design, (3) minimum 
shell thickness, (4) service equipment, (5) bottom opening, 
(6) safety relief, (7) pressure relief devices, (8) setting and 
(9) capacity. 

The treatment of transport containers in the ADR is 
mainly in Appendix A6 on IBCs and in Appendices Bla-c, 
dealing with tanks other than tank containers, tank con¬ 
tainers, and tanks made of reinforced plastics, respectively. 
The treatment is under the headings: (1) general scope 
and definitions; (2) construction; (3) items of equipment; 
(4) type approval; (5) tests, (6) marking and (7) operation. 

23.4.4 Road tankers 

The other main type of tank of interest here is fixed tanks 
on road tankers and rail tank cars. The general principles 
are similar for the two modes of transport and it is road 
tankers which are now considered. 

The requirements for road tankers, or tank vehicles, are 
treated in detail in the ADR. In the account that follows, the 
provisions quoted relate to the general requirements for 
tank vehicles. For some classes, there are also specific 
requirements. 

23.4.5 Tank shell construction 

The mechanical design of the tank shell on a tank vehicle is 
treated in detail in the ADR. The shell should be designed 
and constructed in accordance with a suitable code. The 
ADR gives certain minimum requirements covering, 
among other things, (1) the material of construction, (2) the 


minimum wall thickness, (3) the design pressure and test 
pressure and (4) the transport shocks. 

23.4.6 Material of construction 

The general requirement of the ADR is that the shell of a 
tank vehicle should be made of a suitable metallic material 
which is resistant to brittle fracture and stress corrosion 
cracking between -20°C and 50°C, except where another 
temperature range is prescribed for a particular class. 

The usual material of construction for the shell is mild 
steel. Lined mild steel is also used. The usual linings are 
plastics and rubber. In this case, it is necessary to maintain 
the lining carefully, especially at the joints. 

Other materials are used for tanks for particular chemi¬ 
cals. For example, aluminium alloy is utilized for hydrogen 
peroxide. 

23.4.7 Minimum wall thickness 

ADR gives the following formula for the calculation of the 
thickness of the cylindrical wall of the shell of a tank vehi¬ 
cle and of the ends and cover plates: 



where D is the internal diameter of the shell (mm), e is the 
thickness of the metal (mm), P is the calculation pressure 
(bar), a is the permissible stress (N/irrni 2 ) and A is a coeffi¬ 
cient, not exceeding unity, which allows for any weakening 
due to welds. 

There is also a minimum wall thickness. For a shell not 
exceeding 1.8 m diameter, this minimum thickness is 5 mm 
for mild steel, and for one of larger diameter it is 6 mm. For 
other metals, an equivalent thickness is applicable, deter¬ 
mined from a formula based on the general relation: 



where A is the fractional minimum elongation of the metal 
on fracture under tensile stress, R m is the minimum tensile 
strength, and subscripts 0 and 1 denote mild steel and the 
metal under consideration, respectively. 

23.4.8 Design pressure 

For the design pressure of the shell of a tank vehicle, the 
general provisions of the ADR define four categories of 
duty. The fourth covers shells for use with substances hav¬ 
ing a vapour pressure of more than 1.75 hara at 50°C. For 
this case, the calculation pressure should be 1.3 times the 
filling or discharge pressure, but in any case not less than 
4 barg. 

23.4.9 Transport shocks 

The shell, and its fastenings, on a tank vehicle are required 
by the general provisions of the ADR to withstand the fol¬ 
lowing forces: 


(1) In the direction of travel: twice the total mass. 

(2) At right angles to the direction of travel: the total mass. 

(3) Vertically upwards: the total mass. 

(4) Vertically downwards: twice the total mass. 
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23.4.10 Tank equipment 

The ADR general provisions detail the equipment which 
should be provided on the shell of a tank vehicle. This 
includes shut-off devices on bottom-discharge shells and 
pressure relief devices. 

A bottom discharge should be equipped with two 
mutually independent shut-off devices. The first should be 
an internal stop valve fixed directly to the shell and the 
second a sluice valve, or equivalent device, mounted in 
series, one at each end of the discharge pipe socket. In 
addition, the openings of shells should be capable of being 
closed by screw-threaded plugs, blank flanges or equiva¬ 
lent devices. 

The internal shut-off valve should be operable from 
above or below, and its setting (whether open or closed), 
should if possible be verifiable from the ground. The valve 
should continue to be effective in the event of damage to the 
external control. 


23.4.11 Pressure relief 

The general provisions of the ADR require that a shell for 
carriage of a liquid with a vapour pressure exceeding 1.1 
bara at 50°C should either be fitted with a safety valve or be 
hermetically sealed. A hermetically sealed shell is one with 
hermetically closed openings and without a safety valve, 
bursting disc or similar device, or one fitted with a safety 
valve preceded by a bursting disc. 

The special provisions for Class 2, gases, state that a 
shell for gases in 1° to 6° and 9° may be fitted with safety 
valves. But they also state that for carriage of toxic gases in 
1° to 9°, a shell should not have a safety valve unless it is 
preceded by a bursting disc. In this latter case, the 
arrangement should be satisfactory to the competent 
authority. These provisions also state that for shells 
intended for carriage by sea, the provisions of ADR do not 
prohibit the fitting of safety valves conforming to the 
regulations of the IMDG Code. 

The fitting of a pressure relief valve to a road tanker is not a 
straightforward matter. It cannot be assumed that the fluid to 
be relieved will necessarily be vapour; in some cases, with 
the tanker lying on its side, the fluid may be liquid. He con¬ 
siders the problems which this poses. 


23.4.12 Filling ratio 

The general provisions of the ADR contain a number of 
formulae for the degree of filling (DF). These are of the 
general form: 


[23.4.3] 
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35 x «4o 
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where d 15 and d 50 are the densities of the liquid at 15°C and 
50°C, respectively, t f is the mean temperature of the liquid 
at the time of filling (°C), a is the mean coefficient of cubical 
expansion of the liquid between 15°C and 50°C and x is a 
proportion (%) which has values dependent on (1) the 
nature of the fluid and (2) the pressure relief arrangements, 
these values ranging between 95 % and 100 %. 


23.5 Road Transport 

23.5.1 Regulatory controls and codes 

At the international level, codes for the road transport of 
dangerous goods are the UN Transport Code and the ADR. 

In the United Kingdom, road transport is governed by 
three principal sets of regulations. The first set is the 
(CHIP) Regulations 2002, which cover these aspects as 
they apply to road transport. These regulations, and the 
associated ACOPs and guidance, have been described in 
Section 23.3. 

The second set is the Road Traffic (Carriage of Dangerous 
Substances in Packages) Regulations 1992 (PGR). The 
regulations deal with: the design, construction and main¬ 
tenance of vehicles; the marking of vehicles; loading, stow¬ 
age and unloading; precautions against fire and explosion; 
information to be provided to the operator; information for, 
instructions to and training of drivers; supervision of 
parked vehicles; and information for the police. Regulation 
11 places limitations on the carriage of certain substances. 
It contains requirements that an organic peroxide or flam¬ 
mable solid subject to self-accelerating decomposition be 
kept below its control temperature. 

The third set of regulations is the Road Traffic (Carriage 
of Dangerous Substances in Road Tankers and Tank Con¬ 
tainers) Regulations 1992 (RTR). The regulations deal 
with: the construction, maintenance and testing of tankers 
and tank containers; the marking of vehicles with hazard 
warning panels; loading, filling and securing of closures; 
information to be provided to the operator; information to 
be carried with the vehicle; precautions against fire and 
explosion; information for, instructions to and training of 
drivers; parking of vehicles and their supervision when 
parked; and information for the police. 

Both the PGR and RTR give definitions of dangerous 
substances, referring in particular to the. Approved List.The. 
PGR also contains a schedule which gives criteria by which 
to determine whether a substance not in the list is to be 
classed as a dangerous substance. 

The regulations which preceded these two sets of road 
traffic regulations, PGR 1993 and RTR 1993, namely PGR 
1986 and RTR 1981, were supported by a number of ACOPs 
and guidance documents. The ACOPs are COP 11 Opera¬ 
tional Provisions of the Dangerous Substances (Conveyance 
by Road in Road Tankers and Tank Containers) Regulations 
1981 (HSE, 1983); COP 14 Road Tanker Testing: Examina¬ 
tion, Testing and Certification of the CarryingTanks of Road 
Tankers and Tank Containers used for the Conveyance of 
Dangerous Substances by Road (in support of SI19811059) 
(HSE, 1985); and COP 17 Notice of Approval of the Opera¬ 
tional Provisions of the Road Traffic (Carriage of Dangerous 
Substances in Packages etc.) Regulations 1986 by the Health 
and Safety Commission (HSE, 1987). The guidance is HS(R) 
13 Guide to the Dangerous Substances (Conveyance by Road 
in Road Tankers and Tank Containers) Regulations 1981 
(HSE, 1981) and HS(R) 24 Guide to the Road Traffic (Car¬ 
riage of Dangerous Substances in Packages etc.) Regulations 
1986 ( HSE, 1987). 

These documents are currently in the process of being 
updated, with a single L series document replacing both 
ACOPs and the guidance. A single document will replace 
COP 11 and HS(R) 13, another will replace COP 14 and a 
third will replace COP 17 and HS(R) 24. 

The design and construction of road tankers is covered 
in the following documents: L16 Design and Construction of 




TRANSPORT 23/15 


Vented Non-pressure Road Tankers used for the Carnage of 
Flammable Liquids (HSE, 1993); L17 Design and Construc¬ 
tion of Road Tankers used for the Carriage of Carbon Bisul¬ 
phide (HSE, 1993); L18 Design and Construction of Vacuum 
Insulated Road Tankers used for the Carriage of Deeply 
Refrigerated Gases (HSE, 1993); and L19 Design and Con¬ 
struction of Vacuum Operated Road Tankers used for the 
Carriage of Hazardous Wastes (HSE, 1993). 

The road transport of explosives is covered by the Road 
Traffic (Carriage of Explosives by Road) Regulations 1989. 
The associated ACOP is COP 36 Carriage of Explosives by 
Road (HSE, 1989). 

23.5.2 Hazard scenarios 

The bulk of hazardous materials transported by road are 
carried as liquids or liquefied gases in road tankers. The 
main types of road accident associated with these are leaks 
due to tank puncture resulting from a collision or over¬ 
turning or due to failure or maloperation of the tank 
equipment. Other causes of loss of containment are tank 
rupture due to overfilling, overheating or a defect and due 
to fire. 

If the tank is ruptured by overfilling or overheating, a 
physical explosion may occur, giving rise to a blast wave 
and to missiles. 

Material released from the tank by whatever cause may 
be flammable or toxic and in vapour or liquid form. A 
release of flammable vapour will form a vapour cloud 
which may ignite to give a flash fire or vapour cloud 
explosion. A flammable liquid spill may ignite to give a pool 
fire or flowing liquid fire. A toxic material will give a toxic 
gas cloud or toxic liquid spill. 

A fire at the tank itself may cause rupture of the tank 
and, if the tank contains flammable liquid, may lead to a 
BLEVE, with its associated fireball. Road tankers do not, 
however, suffer BLEVEs as commonly as rail tankers, 
because there is not the torch effect from relief valves on 
other tanks which occurs in rail crashes. 

Other hazardous materials are solids which are carried 
in goods vehicles. These include explosives and related 
substances. With these there is, therefore, the hazard of 
explosion. 

There are several characteristics of road transport which 
bear on the nature of the hazard. The vehicle is moving 
through an environment over which the driver has rela¬ 
tively little control. If there is an accident, it may occur at a 
variety of points along the route with very different vul¬ 
nerabilities. On the other hand, the quantity carried is 
limited, and it may be possible to move the vehicle to a less 
vulnerable location. 

One important aspect of vulnerability is the number of 
people exposed at a particular location. The extent and 
composition of the population exposed varies widely with 
the location. Another aspect is the susceptibility to envir¬ 
onmental pollution at that point. A road accident may pose 
a threat not only to life but also to the environment. 

A feature of road accidents is that access for the emer¬ 
gency services is generally relatively easy compared with 
rail. On the other hand, the accessibility of a road accident 
increases the likelihood that spectators will gather. 

23.5.3 Road tanker design 

Requirements for the design of road tankers are given 
in the Road Traffic (Carriage of Dangerous Substances 
in Road Tankers and Tank Containers) Regulations 1992 


(RTR). An outline of these requirements has been given 
in Section 23.5.1. Associated guidance is given in L16 
for flammable liquids and L18 for deeply refrigerated 
liquids. 

The RTR are essentially a set of goal-setting regulations 
and do not specify matters such as wall thickness or over¬ 
pressure protection. In particular, the requirements of the 
RTR for design and for testing and examination, given in 
Regulations 6 and 7(1), respectively, are very general, and 
much less detailed than those given in the ADR. The RTR 
states in Regulation 8(5) that the aforementioned regula¬ 
tions do not apply to the carrying tank of a road tanker or to 
a tank container where that tank and its fittings comply 
with the ADR, RID or the IMDG Code. In other words, 
compliance with the ADR is in effect one way of meeting the 
requirements of the RTR. 

There are also several industry codes which deal with the 
design and/or operation of road tankers. These include Safe 
Handling and Transport of LPG in Bulk by Road by the 
(LPGITA, 1974 COP2), Code of Practice for Road Tank Vehi¬ 
cles Equipped with Bottom Loading and Vapour Recovery (IP, 
1987), Road Transport of Dangerous Substances in Bulk 
(CIA, 1990 RC26) and Steel Containers for the Carriage of 
Hazardous Materials (CIA, 1991RC37). 

For the more hazardous substances, it is common prac¬ 
tice to use top rather than bottom connections and to pro¬ 
vide the vehicle with additional features such as side 
protection. 

23.5.4 Carriage tank fittings 

The provision of suitable carriage tank fittings can make a 
major contribution to minimizing any loss of containment, 
both in road accidents and in loading and unloading. Good 
practice with respect to such provision is illustrated by the 
features specified in the ADR, some of which have been 
described in Section 23.4. 

One particular feature is the arrangements for protec¬ 
tion against overpressure. For flammables, the practice is 
to fit pressure relief. HSE guidance is given in L16, and L18. 
L16 for flammable liquids, requires each tank to be fitted 
with pressure relief devices, which it specifies. L18, for non¬ 
toxic, deeply refrigerated gases, likewise requires pressure 
relief devices on each tank, and specifies them. 

For toxics, such provision is more controversial. In COP 
38 on transportable gas containers, the HSE states that 
containers for toxic fluids should not normally be fitted 
with pressure relief devices. 

23.5.5 Road tanker operation 

The RTR also contains requirements for the operation of 
road tankers, which reflect some of the elements of good 
practice. 

The documentation supplied should contain the infor¬ 
mation necessary for all the parties concerned, which 
include the consignee, the driver, the police and the fire 
service. 

The driver should be well trained in and provided with 
the information that he requires. The training should cover: 
loading and unloading operations, including precautions 
against overfilling and measures to secure closures; 
arrangements at lorry stopover points; and handling 
emergencies, including both spillage and fire. 

The vehicle, the carriage tank and its fittings need to be 
maintained to a high standard. 
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23.5.6 Filling ratio 

It is essential that a tank should not be overfilled, with the 
consequent hazard of rupture due to expansion of the 
liquid. The permissible extent of filling is specified in 
terms of the filling ratio. 

Guidance is given in the BS 5355:1976 Filling Ratios and 
Developed Pressures for Liquefiable Gases and Permanent 
Gases. This standard, as amended in 1981, defines the fill¬ 
ing ratio as: 

The ratio of the mass of gas introduced into a container to 
the mass of water (water capacity) at 15°C that fills the 
container fitted as for use, i.e. complete with valve, dip 
tube, float, etc. as necessary. 

BS 5355 gives in Appendix A formulae for the filling 
ratio (FR). It distinguishes between a low pressure liquefi¬ 
able gas, which has a critical temperature between -10°C 
and 70°C, inclusive, and a high pressure liquefiable gas, 
which has a critical temperature above 70°C. For single 
components, the FR formula is of the general form: 


FR »h(l-C/100) 


[23.5.1] 


where C is the confidence limits on the value of the liquid 
density (%), pi is the density of the liquid, p w is the density 
of water and x is a parameter which has the value 0.97 for 
low pressure liquefiable gases and 0.98 for high pressure 
liquefiable gases. The liquid density is to be evaluated at 
the appropriate reference temperature. 

The standard also give values of the filling ratio in tabu¬ 
lar form for a large number of gases. 

23.5.7 Reference temperature 

The reference temperature is the assumed maximum tem¬ 
perature which the tank contents could reach during car¬ 
riage. It is used to determine the filling ratio and also the 
developed pressure. 

BS 5355: 1976 gives reference temperatures for the 
United Kingdom and also information which allows refer¬ 
ence temperatures to be determined for other parts of the 
world. It classifies areas according to the maximum shade 
temperature.TheUnited Kingdom is classified as aclimatic 
area with a shade temperature <35°C. In addition to Class 
UK, there are Classes A-E, with maximum shade tempera¬ 
tures of 37.5,42.5,47.5,52.5 and > 52.5°C, respectively. 

Then for the United Kingdom, the reference temperature 
for container volumes (V) over 1 m 3 are as follows: 


Type of Reference Reference temperature 

contents temperature for for developed 

filling ratio CO pressure CO 

V = 1—5 m 3 F>5m 3 F = l-5m 3 F>5m 3 


Low 42.5 38 47.5 42.5 

pressure 
liquefiable 

High 50 45 

pressure 
liquefiable 
gases 


For low pressure liquefiable gases in winter, the standard 
gives a relaxation in reference temperature for filling ratio 
for volumes exceeding 5 m 3 . 

The choice of reference temperature is a very debatable 
subject. If a single reference temperature is used, simplicity 
is achieved, but the temperature selected has to be much 
higher than is necessary and economic for a large propor¬ 
tion of cases. Discussions of this point are given in the 
Home Office Containers Report and by AW Clarke (1971b). 
The latter states that reference temperatures as high as 
65°C have been used in international codes. 

The reference temperatures provide overall guidelines, 
but it is necessary also to observe any requirements of 
international transport and of the country of delivery. 

23.5.8 Hazardous materials 

For a given mode of transport, there are some hazardous 
materials which may not be conveyed. Road transport is a 
case in point. Writing in 1971, A.W. Clark (1971b) gave the 
following list of substances prohibited for road transport in 
West Germany: 

Class 2 Gases: chlorine, hydrogen bromide, hydrogen 
chloride, hydrogen fluoride, hydrogen sulfide, phos¬ 
gene, sulfur dioxide. 

Class 3 Flammable liquids: carbon disulfide. Class 6 Poi¬ 
sons: acetone, cyanohydrin, acetonitrile, acrylonitrile, 
allyl alcohol, allyl chloride, aniline, epichlorohydrin, 
lead alkyls, organophosphorus compounds. 

Class 8 Corrosives: bromine, fluoboric acid, hydrazine, 
liquid acid halides and liquid chlorides which give off 
acid fumes in contact with moist air (e.g. antimony 
pentachloride). 

For certain chemicals which are transported by road 
special measures are required. These include: 

(1) substances liable to polymerization; 

(2) substances carried fused; 

(3) hydrogen peroxide; 

(4) organic peroxides; 

(5) sulfur trioxide; 

(6) bromine; 

(7) lead alkyls. 

Some chemicals, such as butadiene or ethylene oxide, have 
a tendency to polymerize. It is essential to prevent poly¬ 
merization from starting, because if polymerization occurs 
heat is evolved and the reaction speeds up. One method of 
prevention is the use of an insulated tank, but this is 
increasingly being replaced by the alternative method, 
which is the use of polymerization inhibitors. 

Some substances which are solids at ambient tempera¬ 
ture, such as sulfur, phosphorus, alkali metals and naph¬ 
thalene, are often carried in fused form in overdesigned 
and insulated tanks. 

High strength hydrogen peroxide is transported in alu¬ 
minium or special steel tanks. Materials which could react 
with the peroxide such as wood or valve lubricants are 
excluded from the vehicle. A water tank is carried to deal 
with any accident. 

Organic peroxides are a somewhat similar case. They are 
sometimes carried in refrigerated insulated tanks to mini¬ 
mize the hazard due to their instability. 
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Sulfur trioxide is a solid at ambient temperatures and is 
carried heated in overdesigned and insulated tanks. It is 
stabilized to present polymerization. Bromine is usually 
transported in lead-lined steel tanks. Lead alkyls are car¬ 
ried in overdesigned and externally protected tanks. 

23.6 Road Transport Environment 

23.6.1 Road network and vehicles 

The assessment of major hazards arising in the road 
transport of hazardous materials requires the use of a wide 
range of data on the road transport environment. 

The road transport environment varies somewhat from 
one country to another. Accounts relevant to the United 
Kingdom have been given by Appleton (1988 SRD R474) and 
RA. Davies and Lees (1992), and accounts relevant to North 
America have been given by Glickman (1988), Harwood 


Unfortunately, as so often happens, there are difficulties 
in relating information from one source to that from 
another. For example, DTp statistics are for heavy goods 
vehicles (HGVs) with unladen weights of not less than 1.5 te, 
whereas the principal TRRL study of HGV fatal accidents 
deals with HGVs with unladen weights not less then 3 te. 


Road network 

There are two classifications of roads used in Britain. 
Roads are generally classified as trunk, principal, second¬ 
ary, etc., whilst in accident statistics, roads are described as 
A class, B class, and ‘other’. Broadly speaking, trunk and 
principal roads are equivalent to A class roads, whilst sec¬ 
ondary roads are equivalent to B class and ‘other’roads (P.P. 
Scott, 1983). The length of the road network (km) in Great 
Britain in 1973 was given by H.D. Johnson (1981) as follows: 


Length of road, (km) 


BUA a 



Non-BUA 




Trunk 1 principal 

Class Hand below b 

Total 

Trunk 1 principal 

Class Hand below b 

Total 

Motorways 

13,874 

117,052 

130,926 

32,383 

163,587 

195,970 

1752 


a BUA: built-up area. 

b Of these totals, Class II roads are 8746 km in BUAs and 19,643 km in non-BUAs. 


and Russell (1989), Harwood, Russell and Viner (1989), 
Harwood,Viner and Russell (1990), Steward and van Aerde 
(1990a) and Gorys (1990). 

As in hazard assessment generally, two situations can 
arise with respect to the estimation of the frequency of 
particular accident scenarios. Either it is possible to esti¬ 
mate the frequencies of these scenarios from historical 
data, or it is necessary to synthesize the frequencies, by 
methods such as modelling or fault tree analysis. 

Thus, for scenarios such as release of materials which 
are transported in large quantities (e.g. gasoline and LPG), 
it may well be possible to obtain historical data. For other 
scenarios, such as a release of chlorine or an explosion of 
explosives during transport, it is much more difficult. 
Moreover, even where historical data exist, it may still be 
necessary to resort to modelling for reasons such as the 
need to adapt the data to the particular assessment or to 
explore the effect of possible mitigatory measures. 

As will become apparent from the data givenbelow, a large 
proportion of incidents involving hazardous materials are 
not due to traffic accidents, but to other causes. The prime 
concern here is with incidents which occur during trans¬ 
port rather than during loading and unloading or in tem¬ 
porary storage, but some of the data sets also cover the 
latter. 

Hazardous goods are taken here to be goods defined as 
such under the United Nations classification and regulated 
by the Classification, Packaging and Labelling Regula¬ 
tions 1984 (CPL). These hazardous materials are mainly 
flammable and/or toxic liquids and liquefied gases, reac¬ 
tive chemicals and explosives. 

The principal source of information on road transport 
and on road accident statistics is the DTp. Other impor¬ 
tant sources are the Home Office and the Transport 
and Road Research Laboratory (TRRL), which is part of 
the DoE. 


Heavy goods vehicles 

Vehicles may be classed as HGVs, light goods vehicles 
(LGVs), cars, and motor cycles (MCs). HGVs may be sub¬ 
divided according tothenumberof axles.The vast majority 
of hazardous materials are carried in HGVs. The most 
common HGV is the rigid two-axle vehicle. 

The mass unladen of a typical two-axle HGV is some 
7.5 te and that of a typical three-axle HGV is some 11.5 te, 
while that of an LGV is some 1.5 te. The maximum load of a 
two-axle HGV is some 12 te. Approximately, 50% of HGVs 
carry full load and 25% is empty, with the remainder car¬ 
rying part loads. The load of an LGV is some 1.5 te. 

A total of 435,000 HGVs were registered in 1986 (DTp, 
1987b). The distribution of HGV weights for 1985 (JMP 
Consultants, 1986) was 


Gross vehicle 
weight (te) 

Proportion of 
vehicles (%) 

<20 

70 

20-22 

3 

22-24 

3 

24-26 

2 

26-28 

2 

28-30 

4 

30-32 

6 

32-34 

4 

34-36 

2 

36-38 

3 

>38 

1 


Figure 23.3 shows some principal HGVs together with their 
classifications. 











23/18 TRANSPORT 


Recommended 

Description 

Identifier 

UK 

Maximum 

Weight 

(tonnes) 

Shape 

LIGHT 

GOODS 

VEHICLES 

2 axles 

3.500 

c 

no rear side windows 

L 

0 HEAVY 

GOODS 

R 

VEHICLES 

R 

E 

S 

2-AXLE 

LORRIES 

2 axles 

Over 

3.5 

7.500 

m 

Shrnim 

BIGGER 

2-AXLE 

LORRIES 

2ax,es 

Over 

7.5 

17.000 

a£ lllt 

w 

MULTI¬ 

LORRIES 


24.390 

jttl 

p 

3 axles 
artic 

24.390 



rigid 

30.490 


& 

4 axles 

32.520 

m 


Vehicle 

draw-bar 

trailer 

32.520 


.*. r ii|S 


5 axles 

38.000 




Figure 23.3 Some principal goods vehicles 


Distances travelled 

The journeys travelled by HGVs in 1986 are shown 
in Table 23.5, Section A, by body type and road type. 
HGVs travelled a total of 221 x 10® km (DTp, 1987b). The 


average annual distance travelled per vehicle is 
thus 50,800 km (221 x 10®/435,000). Section B of the table 
gives a breakdown of the HGV distances travelled by road 
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Table 23.5 Road transport environment in Great Britain: 
journeys by heavy goods vehicles in 1986 (P.A. Davies and 
Lees, 1992) (Courtesy of Elsevier Science Publishers) 


A Distances travelled by body type and road type 


HGV type 


Distance (x 10 s km) 


All speed limits 

Non-BUR 1 

BUR 

Rigid 

152 


103 

49 

Articulated 

65 


58 

7 

Total b 

221 


165 

56 


B Proportion of distance travelled on each road 


Road class Proportion of vehicles (%) 


Non-BUR BUR 


A 87.0 61.0 

B 6.0 11.5 

Other 7.0 27.5 

Total 100 100 


a BUR, built-up road. Non-BUR includes motorways. 
b Figures for rigid and articulated vehicles are for defined axle con¬ 
figurations. Total includes cases where the axle configuration was not 
reported. 

c Non-BUR excludes motorways. 


Speed in built-up areas 

The severity of an accident depends on the speed of 
the vehicle(s). Of particular interest is the speed of vehicles 
in built-up areas (BUAs).Work on this has been done by the 
TRRL (N. Duncan, 1987). Their data for the speeds of good 
vehicles generally, LGVs as well as HGVs, are: 


Time of day 

Average speed (mph) 


Small towns 

Large towns 

Peak period 

13.1 

20.5 

Off-peak period 

14.9 

23.6 


The figures refer only to the time when the vehicle is actu¬ 
ally moving, the time spent stationary is discounted. With 
regard to the distribution of speeds, the assumptions made 
by TRRL are that the normal distribution applies and that 
the standard deviation is x / s of the mean. Using these 
assumptions estimates may be made of the probability that 
a vehicle may be travelling at a particular speed. 

More specific data on vehicle speeds at the moment of 
impact may be obtained from tachograph records, as 
described below. 

HGVs conveying hazardous materials (HGV/HMs) 

Some estimates are now made for HGVs conveying hazard¬ 
ous materials (HGV/HMs) in Great Britain. 

It has been estimated by Kletz (1986J) that in 1986 there 
were some 14,000 road tankers in operation. The authors 
have confirmed that this approximate figure is still valid. 
Kletz also gives the annual distance travelled per tanker as 
60,000 miles (96,500 km). 


There are, in addition, HGVs other than tankers carrying 
hazardous materials. The number of such vehicles which at 
some time transport hazardous materials may be quite 
large, but what matters in the present context is the number 
of equivalent ‘full-time’ vehicles. There appears to be no 
reliable source of information for this figure. An estimate 
has therefore been made. The data for hazardous cargoes in 
the United States given in Section B of Table 23.20 (see 
below) indicate that the ratio of non-tank truck to tank 
truck HGV/HMs is about 0.6. Those given in Section B of 
Table 23.18 (see below) for significant spillages indicate 
that the ratio of non-tank truck to tank truck HGV/HM 
spillages is about 0.9. The former figure is regarded as a 
better guide. A roadside survey conducted by the authors is 
consistent with this estimate. The ratio of 0.6 is used for 
Great Britain also, which yields: 

No. of tanker HGV/HMs = 14,000 

No. of non-tanker HGV/HMs = 0.6 x 14,000 = 8400 

No. of HGV/HMs = 14,000 + 8400 = 22,400 

Distance travelled by HGV/HMs 

For the distance travelled by HGV/HMs, loaded and unloaded: 

Distance travelled by individual vehicle = 60,000 
miles = 96,500 km 

Distance travelled by fleet = 22,400 x 60,000 = 13.4 x 10 s 
miles = 21.6 x 10 s km 

This figure is probably an upper bound, since non-tankers 
may well not travel as high an annual distance as tankers. 

The ACDS figures given in Table 26.6 for that part of the 
tanker fleet carrying motor spirit, on relatively short jour¬ 
neys, imply an annual distance travelled, loaded and 
unloaded, of 1.64 x 10 s km. 

Proportion of route in built-up area 
The severity of a road transport accident depends in part on 
whether it occurs in a BUA. The proportion of a route which 
passes through areas which are urban or suburban is 
typically of the order of 10-15 %, but it varies. Detailed values 
for some particular routes are given in the ACDS report. 

Movements of certain hazardous materials 
The ACDS report of a detailed breakdown of the move¬ 
ments of thefour materials considered is showninTable23.6. 

23.6.2 Road accidents 

Statistics on road accidents in Britain are given in the 
Annual Abstract of Statistics by the Central Statistical 
Office (CSO). Further information is given in the series 
Road Accidents Great Britain by the DTp. 

An accident may be classified as a collision with other 
vehicle (COV) or a single vehicle accident (SVA). The latter 
may be subdivided into a collision with a stationary object 
(SVO) or overturning (OT). 

Accident definitions 

Accidents are commonly classified in the United Kingdom 
as personal injury (PI) accidents and damage-only (DO) 
accidents. 

Road accident statistics derived from police records 
relate to personal injury accidents. The number of DO 
accidents generally has to be estimated from the number of 
PI accidents. For example, R.F.F. Dawson (1971) in a study of 
the cost of accidents gives the number of PI accidents in 
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Table 23.6 Road transport environment in Great Britain: 
tanker capacities and movements for four hazardous 
materials (Advisory Committee on Dangerous Substances, 
1991) (Courtesy of HM Stationery Office © All rights 
reserved) 


A Tanker capacities 


Substance 

Tank capacity (te) 

Motor spirit 

20-25 

LPG 

15 

Ammonia 

15 

Chlorine 

17 

B Tanker movements 

Motor LPG 
spirit 

Ammonia Chlorine 


Total loaded 
movements 
(loaded 
tanker km/yr) 

82 x 10 6 

19.54 x 10 6 

632,233 

1,121,358 

Total loaded 
journeys 
(loaded 

journeys/yr) 

1.3 x 10 6 

63,667 

2,974 

9,871 

Average loaded 
journey (km) 

64 

307 

213 

114 


1968 as 264,200 and estimates the number of DO accidents 
as 1,583,000, giving a DO/PI accident ratio of 6. Appleton 
states that values of the ratio given in DoTand TRRL stud¬ 
ies are in the range 6-12. He also states that a survey by the 
Safety and Reliability Directorate (SRD) of a small number 
of local authorities found a value of the DO/PI ratio of 2-3 
but the reporting was not consistent. In any event, the 
problem of defining what constitutes an accident is more 
severe for DO than for PI accidents. Moreover, an accident 
severe enough to endanger the integrity of a load is likely to 
result in some personal injury. It is convenient, therefore, to 
work in terms of the PI accident criterion. 

The main exception to the above is fires. Fire brigade 
records allow the derivation of fire statistics. Major studies 
of fires have been made by North (1974) and McLean (1981). 

The significance of the definition of an accident depends 
on the use to which it is to be put in the hazard assessment. 
Broadly speaking, the definition is important if historical 
data on releases are lacking, but this is less so if such statis¬ 
tical information is available. The reason why is that, in the 
latter case, it is possible to work with a definition of an acci¬ 
dent which is to a degree arbitrary and to work in terms of the 
probability of release given an accident so defined. If, on the 
other hand, data are not available and it is necessary to model 
the accident in order to determine the probability of release, 
the definition of what constitutes an accident becomes more 
significant, since it determines the accident frequency. 

In the following, the UK accidents considered are injury 
accidents, except for fires. 

Injury accidents 

For vehicles generally, H.D. Johnson and Garwood (1971) 
found that the proportion of fatal accidents in the total of 


serious injury and fatal accidents for the period 1959-65 
was in the range 5.1 -9.2 % for roads with speed restrictions 
of 30 or 40 mph and in the range 8.3-14.5 % for other roads. 

A study by the DTp (1987a) obtained for the ratio of fatal 
accidents to all injury accidents values in the range 0.018:1 
to 0.025:1. 

Some data on casualties in HGV accidents are given in 
Table 23.7. A study of fatal accidents involving HGVs in 1976 
has been given by Riley and Bates (1980). 

Grattan and Hobbs (1978) studied injuries to occupants 
of HGVs. In 1975, there were 3200 occupant casualties in 
HGVs, of which 800 were serious or fatal, the latter num¬ 
bering 71. These casualties were usually the result of colli¬ 
sion between two HGVs or between an HGV and a roadside 
obstacle. A 5% sample of the serious or fatal injuries was 
studied. All fatal injuries were associated with either mas¬ 
sive intrusion of the cab structure or ejection of the occupant. 

Hobbs, Grattan and Hobbs (1979) have examined various 
classifications of injury, in a study which relates the injury 
classifications to the length of stay in hospital. 

Kletz (1986J) quotes figures given by Hills (1981) for the 
number of deaths from the road transport of hazardous 
chemicals in the United Kingdom in the period 1970-80 as 
16 deaths overall, making an average of 1.23 deaths/year. 
From the context these are the deaths attributable to the 
load. Kletz also states that the average number of deaths per 
fatal accident is 1.5. 

HGV accident frequency 

In 1986, HGVs travelled 221 x 10 s km and there were 13,429 
accidents involving HGVs. A number of accidents involve 
more than one HGV. The number of HGVs involved in acci¬ 
dents is thus somewhat more than the number of accidents 
involving an HGV The number of HGVs involved in acci¬ 
dents in 1986 was nearly 15,000. 

Statistics on accidents involving HGVs are given 
Tables 23.8—23.11 gives, in Section A, the number of HGVs 
involved in accidents; in Section B, Table 23.8 the number 
of accidents involving HGVs by body type and road type; 
and in Section C, a breakdown of the road class on which 
the accidents occurred. Table 23.9 gives the number of HGV 
accidents in 1986, by the combination of vehicles involved. 
Table 23.10 gives the frequency of HGV accidents by body 
type, road type and road class. Table 23.11 gives the pro¬ 
portion of HGV accidents by junction type and by impact 
position. 

The basic annual accident statistics for HGVs in 1986 are: 

No. of accidents = 13,429/year 

No. of vehicles involved in accidents = 15,000 

Proportion of vehicles involved in accidents 

= 15,000/435,000 = 3.4%/year 
Frequency of accidents = 134,297(221 x 10 s ) 

■1= 0.62 x 10“ 6 /km 


Impact accidents 

A study of the impact speed of HGVs in accidents has been 
made by P.A. Davies and Lees (1991a,b) based on tacho¬ 
graph records. Table 23.12 gives the impact speeds obtained 
in this study. The accidents may be regarded as a biased 
sample in that the accidents were sufficiently serious for 
the police to have an interest and may tend therefore to give 
an overestimate of the impact speed in injury accidents 
generally. 
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Table 23.7 Road transport environment in Great Britain: casualties in HGVs in 1986 (P.A. Davies and Lees, 1992) 
(Courtesy of Elsevier Science Publishers) 


A Number of casualties 


Other vehicle type 

Fatalities 

Casualties 

HGV 

24 

672 

LGV 

- 

137 

Bus/coach 

- 

47 

Car 

4 

622 

Motorcycle 

- 

17 

Pedal cycle 

1 

8 

SVA (no pedestrian) 

32 

1045 

SVA (pedestrian) 

171 

1184 

Other 

28 

747 

Total 

260 

4479 


B Number of HGVs involved in injury accidents: rigid HGVs 


Road type No. of vehicles involved 


Fatal accidents AH accidents 


2-axle 3-axle 4-axle All 2-axle 3-axle 4-axle AU 


Non-BUR 239 41 50 330 3672 714 657 5082 

BUR 164 32 25 221 3988 631 463 5043 

All speed limits 403 73 75 551 7660 1345 1120 10125 


C Number of HGVs involved in injury accidents: articulated HGVs 


Road type No. of vehicles involved 


Fatal accidents All accidents 



2-axle 

3-axle 

4-axle 

All 

2-axle 

3-axle 

4-axle 

All 

Non-BUR 

35 

127 

83 

245 

447 

1444 

872 

2763 

BUR 

15 

39 

15 

69 

283 

674 

316 

1273 

All speed limits 

50 

166 

98 

314 

730 

2118 

1188 

4036 


D Number of casualties by road type 


Road type 

Fatalities 

AU casualties 

Non-BUR 

A roads 

451 

6,452 

B roads 

34 

838 

Other roads 

37 

1,095 

All roads 

522 

8,385 

BUR 

A roads 

205 

4,926 

B roads 

34 

933 

Other roads 

74 

2,316 

All roads 

313 

8,175 

All speed limits 

Motorways 

73 

1,888 

A roads 

656 

11,378 

B roads 

68 

1,771 

Other roads 

111 

3,411 

All roads 

908 

18,448 
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Table 23.7 (continued) 

E Proportion of casualties by road type 

Road type 

Fatalities (%) 

All casualties (%) 




Non-BURs 

57.5 

45.5 





BURs 

34.5 

44.3 





Motorways 

8.0 

10.2 





F No. of occupant casualties 

Occupants 


Fatalities 



Casualties 



Non-BUR 

BUR 

All 

Non-BUR 

BUR 

All 

Drivers 

53 

8 

61 

1987 

773 

2760 

Passengers 

14 

8 

22 

354 

205 

559 

All occupants 

67 

16 

83 

2341 

978 

3319 


Table 23.8 Road transport environment in 
Great Britain: number of HGV accidents in 1986 
(P.A. Davies and Lees, 1992) (Courtesy of Elsevier 
Science Publishers) 


A Number of HGVs involved in accidents 


HGV type 


Road type 


Ml speed limits 

Non-BUR 3 

BUR 

Rigid 

10,125 

5,043 

5,082 

Articulated 

4,036 

2,763 

1,273 

Total b 

14,773 

7,958 

6,815 

B Number of accidents involving HGVs 

HGV type 


Road type 



All speed limits 

Non-BU R b 

BUR 

Rigid 

9,601 

4,782 

4,819 

Articulated 

3,828 

2,621 

1,207 

Total 

13,429 

7,403 

6,026 

C Proportion of HGV accidents by road class 

Road class 

Proportion of accidents 0 (%) 



Non-BUR 

BUR 


A 

76 

60 


B 

10 

11 


Other 

14 

29 


Total 

100 

100 



a BUR, built up road. Non-BUR includes motorways. 
b Figures for rigid and articulated vehicles are for defined axle con¬ 
figurations. The total includes cases where the axle configuration was 
not reported. 

c Data exclude motorways. 


Fire accidents 

An investigation of fire in road vehicles was carried out by 
North (1974). Although reported in 1974, most of the data 
relate to 1971 and are therefore rather old. The study does, 
however, contain some information on certain special 


Table 23.9 Road transport environment in Great Britain: 
number of HGV accidents in 1986 by combination of the 
vehicles involved (P.A. Davies and Lees, 1992) (Courtesy 
of Elsevier Science Publishers) 


A All accidents 

Accident type 

Number 

Proportion (%) 

Single vehicle 

1,994 

14.8 

Two vehicles 

8,452 

63.0 

Three or more vehicles 

2,983 

22.2 

B Two-vehicle and single-vehicle accidents 

Accident type 

Number 

Proportion (%) 

Single vehicle 

890 

8.5 

Car 

5,271 

50.4 

Bus coach 

186 

1.8 

LGV 

594 

5.7 

HGV 

529 

5.1 

Motorcycle 3 

1,012 

9.7 

Pedal cycle 

723 

6.9 

Pedestrian 

1,104 

10.6 

Other 

137 

1.3 

Total 

10,446 

100.0 

C Two-vehicle accidents only 

Vehicle 


Proportion (%) 

Car 


62.4 

Bus/coach 


2.2 

LGV 


7.0 

HGV 


6.3 

Motorcycle 3 


12.0 

Pedal cycle 


8.6 

Other 


1.5 

Total 


100.0 


a Me 


aspects of vehicle fires, which are given below after a con¬ 
sideration of the main fire statistics. 

Information on the causes of fires in vehicles in 1985 has 
been given by the DTp(1985). In that year, out of some 248,000 
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Table 23.10 Road transport environment in Great Britain: frequency of HGV accidents it 

n 1986 (P.A. Davies 


and Lees, 1992) (Courtesy of Elsevier Science Publishers) 




A Accidents by road type 

HGV type 

Frequency (accidents/10 6 km) 



All speed limits 

Non-BUR? 



BUR 

All HGVs 0.62 

0.46 



1.08 

B Accidents by road class (DoT, 1987b) 

Road, class 

Frequency (involvements/10 6 km) 



Non-BUR 



BUR 

A class 

0.57 



1.19 

B class 

1.15 



1.21 

Other 

1.30 



1.28 

All 

0.48 



1.22 

C Accidents by road class 

HGV type 

Frequency (accidents/10 6 km) 




Non-BUR 



BUR 


A B 

Other A 


B 

Other 

All HGVs 0.66 1.32 

1.51 1.05 


1.08 

1.13 

D Accidents by body type, road class and combination of vehicles involved: car, bus/coach and motorcycle 

HGV type 

Frequency (accidents/10 6 km) 




Car 

Motorcycle 


Coach/bus 


A B Other 

A B Other 

A 

B 

Other 

All HGVs 0.56 0.57 0.60 

0.11 0.11 0.12 

0.02 

0.02 

0.02 

E Accidents by body type, road class and combination of vehicles involved: LGV, HGV and pedal cycle 

HGV type 

Frequency (accidents/10 6 km) 




LGV 

HGV 


Pedal cycle 


A B Other 

A B Other 

A 

B 

Other 

All HGVs 0.06 0.06 0.07 

0.06 0.06 0.06 

0.08 

0.08 

0.08 

F Accidents involving only a single vehicle by body type and road class: BURs 

HGV type 

Frequency (accidents/10 6 km) 




SVA (no pedestrian) 

SVA (pedestrian) 


Total SVA 


A B Other 

A B Other 

A 

B 

Other 

All HGVs 0.07 0.07 0.07 

0.08 0.08 0.09 

0.15 

0.15 

0.16 

G Accidents involving only a single vehicle by body type and road class: non-BURs 

HGVtype 

Frequency (accidents/10 6 km) 




SVA (no pedestrian) 

SVA (pedestrian) 


Total SVA 


A B Other 

A B Other 

A 

B 

Other 

All HGVs 0.04 0.08 0.09 

0.05 0.10 0.12 

0.09 

0.18 

0.21 


a Non-BUR includes motorways. 
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Table 23.11 Road transport environment in Great Britain: road position and impact position for HG V accidents 
(P.A. Davies and Lees, 1992) (Courtesy of Elsevier Science Publishers) 

A Road position (after DpT, 1987b) 

Junction type 


Proportion of accidents (%) 




Rigid 


Articulated 


Non-BUR 

BUR 

Non-BUR BUR 

Roundabout 

3.4 

5.5 

5.0 

8.9 

T or staggered junction 

13.7 

36.0 

10.0 

32.9 

Y junction 

1.3 

1.7 

1.1 

1.4 

Crossroads 

4.2 

13.6 

3.1 

12.5 

Multiple junction 

0.5 

1.7 

0.5 

2.7 

Slip road 

2.7 

0.5 

4.1 

1.3 

Private entrance 

5.0 

5.0 

3.0 

5.2 

Other 

1.0 

1.6 

1.0 

2.1 

Not at or within 20 m of junction 

68.2 

34.4 

72.2 

33.0 

Total 

100.0 

100.0 

100.0 

100.0 

B Impact position (after Riley and Bates, 1980) 

Impact position 


Proportion of impacts (% 

•) 


Car 

MC 

LGV 

HGV 

AU vehicles 

Front 66 

41 

63 

53 

59.4 

Side 16 

31 

9 

15 

18.6 

Rear 14 

26 

28 

24 

18.1 

Other 4 

2 

0 

8 

3.9 

Total 100 

100 

100 

100 

100.0 


Table 23.12 Road transport environment in Great Britain: 
impact speeds of HGVs in accidents (P.A. Davies and 
Lees, 1992) (Courtesy of Elsevier Science Publishers) 


A Collisions involving other vehicles 

Impact speed (mph) 

Non-BUR 

BUR 

Motorways 

0-9 

1 

3 

0 

10-19 

2 

4 

0 

20-29 

1 

10 

2 

30-39 

5 

12 

1 

40-49 

9 

5 

2 

50-60 

2 

2 

2 

>60 

1 

0 

0 

Total 

21 

36 

7 


B Single-vehicle accidents 


Impact speed 
(mph) 

Non-BUR 

BUR 

Motorways 

0-9 

1 

0 

0 

10-19 

3 

4 

0 

20-29 

2 

11 

0 

30-39 

2 

5 

1 

40-49 

1 

6 

1 

50-60 

0 

0 

2 

>60 

0 

0 

1 

Total 

9 

26 

5 


Table 23.13 Road transport environment in Great Britain: 
causes of fires in road vehicles 1984 (P.A. Davies and 
Lees, 1992) (Courtesy of Elsevier Science Publishers) 


Cause 

Number 

Proportion (%) 

Deliberate ignition 

7,434 

22.0 

Smokers’ materials 

1,165 

3.4 

Wiring of vehicle 

8,980 

26.6 

Oil and petroleum in contact 

8,475 

25.1 

with hot components 

Crash, collision 

881 

2.6 

Other 

4,042 

12.0 

Unknown 

2,793 

8.3 

Total 

33,770 

100.0 


accidents, there were some 33,000 fires. The causes of these 
fires are given in Table 23.13. It can be seen from the table that 
the vast majority of vehicle fires are non-crash fires. 

Information from the Home Office quoted by Davies and 
Lees for goods vehicle fires specifically indicates that in 
1986, fire brigades attended 7212 van and lorry fires. Not all 
of these were on a public highway. 

Of the 2578 HGVfires, 2559 (99.3%) were non-crash fires 
and 19 (0.7%) were crash fires. No breakdown is available for 
non-crash fires by vehicle type, but for crash fires, the 
breakdown is as shown in Table 23.14, Section A. The causes 
of the HGV non-crash fires are given inTable 23.14, Section B. 

The study by North gives some information on the loca¬ 
tion of vehicle fires. His data for lorries and tankers are 
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given in Table 23.14, Section C. They show that for HGVs, 
some 82% of fires occur on roads. About another 10% 
occur in car parks, yards and garage forecourts, probably 
for the most part in BUAs. 

North also gives information on the number of fatalities 
and on the damage caused in vehicle fires, which may help to 
determine the severity of such fires. In 1971, there were 241 
vehicle fires, of which 16 were in lorries and 10 in tankers, and 
in two lorry fires there was one death in each fire and in two 
tanker fires one death in each. In 1972, there were 289 vehicle 
fires, of which 19 were in lorries and 12 in tankers and in one 
tanker fire there were two deaths, there being no deaths in the 
lorry fires. Thus, for lorries, out of 35 fires, 2 were fatal (6%) 
and, for tankers, out of 22 fires, 3 were fatal (14%). 

North gives information on the resultant damage in 
a sample of car fires in 1971. Out of 200 fires, 73 caused 
minor damage, 44 damaged the original compartment, 24 
damaged or severely destroyed the original compartment, 


Table 23.14 Road transport environment in Great Britain: 
fires in HGVs 1986 (P.A. Davies and Lees, 1992) (Courtesy 
of Elsevier Science Publishers) 


A Number of crash fires 

Non-BUR 

BUR 

All speed limits 

All HGVs 11 

8 

19 

B Frequency of crash fires 

Frequency (fires/10 8 km) 

Non-BUR 

BUR 

All speed limits 

All HGVs 0.06 

1.15 

0.09 

C Location of lorry and tanker fires (North, 1974) 

Location 

Proportion of fires (%) 


Lorries 

Tankers 

Road or verge 

71.7 

67.4 

Motorway 

10.5 

15.2 

Field, open land 

6.4 

4.9 

Car park, yard 

10.1 

9.7 

Garage forecourt 

0.7 

0.5 

Garden 

0.1 

0.5 

Other (specified) 

0.5 

1.6 

Total 

100 

100 


15 damaged more than one compartment, 2 damaged the 
exterior, 40 (20%) damaged or destroyed the whole car and 
2 had no recorded result. 

From the above, the following annual estimates can be 
made for HGVfires: 

No. of crash fires = 19 

Crash fires as a proportion of accidents = 19/13,429 
= 0.14% 

No. of non-crash fires = 2559 
Non-crash fires as a proportion of accidents 
= 2559/13,429 = 19% 

Load-threatening accidents 

Investigations of accidents which might threaten the load of 
a large HGV transporting radioactive waste have been 
made by I.A. James (1986) and by Allsop et ol. (1986). The 
study by James is concerned with articulated, five-axled 
HGVs. For the determination of accident frequency, he 
assumes that only serious accidents, that is, those involv¬ 
ing death or serious injury have the potential to threaten the 
load. Thus, James considers only accidents where the sub¬ 
ject vehicle was an articulated HGV having a gross vehicle 
weight (GVW) of more than 1.5 tonne, where death or ser¬ 
ious injury was involved, and where the accident either was 
a SVA or involved another HGV of GVW greater than 1.5 
tonne. Table 23.15 shows his data for the number and fre¬ 
quency of such accidents. 

Also shown in the table are the results obtained by Allsop 
et ol. They considered all injury accidents involving either 
four-axle or five-axle HGVs in overturning or side damage. 
The accident frequencies obtained by these workers are 
appreciably higher. For motorways and A roads, their 
results are higher than those of James by a factor of 2-3. 
The factor is greater for B roads and other roads, but James’ 
data show that the distance travelled by these large HGVs 
on the lower class roads is relatively small. 

Chemical accidents 

An account of the chemical accidents attended by the UK 
public fire service in 1980 has been given by McLean (1981). 
There were 983 special service calls in which dangerous 
chemicals were involved and 968 actual incidents. The 
incidents occurred at both fixed installations and in 
transport. 

Table 23.16 gives the nature and number of these inci¬ 
dents. The principal chemicals involved, together with the 
number of incidents, were: hydrochloric acid (66), ammonia 
(65), LPG (42), sulfuric acid (34) and sodium hydroxide (30). 
There were 14 incidents involving petroleum and 10 involv¬ 
ing ammonium nitrate. Of these incidents, 132 were fires in 


Table 23.15 Road transport environment in Great Britain: number and frequency of a certain type of load-threatening 
accident (P.A. Davies and Lees, 1992) (Courtesy of Elsevier Science Publishers) 


Road type 

No. of 
accidents 

Distance travelled 
(xlO 6 miles) 

Accident frequency a 

(xlO 8 accidents/mile) 

(x 10 8 accidents/km) 

Motorway 

310 

3202 

9.68 

6.0 

A class 

740 

3855 

19.2 

11.9 

B class 

47 

172 

27.0 

10.4 

Total 

1097 

7229 

15.2 

9.4 

a Allsop etal. (1986) gi 

ve an acciden 

t frequency (accidents/10 km) as follows 

: motorways, 11.5; A roads, 36,5; B ro; 

ids, 114; other roads, 83.1. 
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Table 23.16 Road transport environment in Great Britain: 
nature of chemical incidents attended by the UK public fire 
services in 1980 (P.A. Davies and Lees, 1992) (Courtesy of 
Elsevier Science Publishers) 


Nature of 
incident 

Number of 
incidents 

Proportion of 
incidents (%) 

Chemical overheated 

9 

1 

Spillage 

419 

43 

Leakage 

211 

22 

Vapour, gas escape 

80 

8 

Potential spillage 

11 


Fire 

173 

18 

Explosion 

10 

1 

Chemical found 

19 

2 

Other 

20 

2 

Unknown 

16 

2 

Total 

968 

100 


which the presence of the chemical affected the firefighting 
to a significant degree, 18 were fires in which dangerous 
chemicals behaved in an abnormal manner and 25 were 
fires in which dangerous chemicals were present and gave 
rise to casualties. 

For all transport incidents, both road and rail, there were 
419 incidents, excluding cases in which chemicals were 
washed ashore. Of these, 105 (25%) occurred in rural areas, 
187 (45%) in urban industrial areas, 113 (27%) in urban 
residential areas, and the remaining 14 (3%) in unrecorded 
locations. 

As far as concerns the road transport incidents, there 
were 335 incidents, of which 21 (6%) were on motorways, 
120 (36%) on A class roads, 56 (17%) on B class roads, 29 
(9%) on unclassified roads, 96 (29%) occurred in aparking 
area off the public roads, and the remaining 14 (3%) were in 
unrecorded locations. 

In 243 (73%) of the incidents, the vehicle was attended. 
Therefore, the number of incidents in which it was unat¬ 
tended was as high as 92 (27%). 

In only 36 (11%) of the cases was an accident reported as 
the primary cause of the incident. 

Background on accidents 

A discussion of the UK accident statistics is given by 
H.D. Johnson and Garwood (1971). McBean (1982) attempts 
to assess the influence of road features on accident fre¬ 
quency and P.P. Scott (1983) that of traffic density, whilst 
Storie (1984) considers the effect of driver characteristics. 

A study of HGVaccidents was made in 1979 by Neilson, 
Kemp and Wilkins (1979), but the data given above are more 
up to date. 

23.6.3 Road accidents: HGV/HMs 
Accident frequency for HGV/HMs 
HGVs carrying hazardous materials have a higher stand¬ 
ard of design and operation, although the extent of this is 
variable. It may therefore be expected that the accident rate 
would be less. Information obtained by P.A. Davies and 
Lees (1992) for munitions vehicles indicates a reduction 
factor of about 0.1—0.33. For HGV/HMs, it seems doubtful 
whether such a large reduction is appropriate.The estimate 
used by Davies and Lees is 0.8. 


M. Griffiths and Linklater (1984) found that the propor¬ 
tion of HGV/HMs suffering an accident was the same as for 
HGVs generally. Although a lower accident rate per unit 
distance travelled is assumed here for HGV/HMs, these 
vehicles travel a greater distance per year, and the net effect 
is to give them an annual accident rate comparable with or 
rather greater than that of other vehicles. 

Taking the estimate: 

Ratio of HGV/HM to HGVaccident rates = 0.8 
then for HGV/HM accidents 
Frequency of accidents = 0.8 x 0.62 x 10 _6 /km 
& 0.50 x 10 _6 /km 

No. of accidents = 0.50 x 10 -6 x 21.6 x 10 8 
— 1080 accidents/year 
No. of vehicles involved in accidents 
t= (15,000/13,429) x 1080 = 1206 
Proportion of vehicles involved in accidents 
= 1206/22,400 = 5.4%/year 
For Ministry of Defence munitions vehicles (MVs), 
taking the estimate 

Ratio of MV to HGVaccident rates = 0.2 
then 

Frequency of accidents = 0.12 x 10 _6 /km 

Release frequency and probability for HGV/HMs 
An estimate of the frequency and probability of release 
given an accident can be made from the data given by 
Maclean. From his data: 

No. of releases due to traffic accidents = 36 

Frequency of release = 36/(21.6 x 10 s ) 

= 0.017 x 10 6 releases/km = 0.027 x 10 6 releases/mile 
Probability of release given traffic accident 
e 36/1080 = 0.033 = 3.3% 

These estimates are based on attendance by a fire brigade 
and should be regarded as lower limits. 

These results maybe compared with the US figures.Tables 
23.18-23.20 (see below) give for the USA data on the prob¬ 
ability of release and on the frequency of release per unit dis¬ 
tance travelled. Again, in both cases, a distinction has to 
be made between releases occurring as a direct result of a 
traffic accident and releases due to other causes. The data 
given in Table 23.19 are particularly relevant in this regard. 

Fatal accidents for HGV/HMs 

Ratio of fatal accidents to injury accidents = 0.022 

No. of fatal accidents = 0.022 x 1206 = 26.5/year 

No. of fatalities per fatal accident = 1.5 

No. of fatalities from accidents = 1.5 x 26.5 = 39.8, say 40 

About one death per year is attributable to the load and the 

rest are due to traffic accidents. 

23.6.4 Collision modelling: impact speed 

The attempt to estimate the frequency of a particular type 
of event arising from an HGV collision will depend both on 
the probability of the event given a collision with a par¬ 
ticular effective impact velocity, and on the frequency of a 
collision of sufficient severity with this impact velocity. 
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The effective impact velocity will depend on the closing, 
or impact, speed. For an SVA all that is required is the 
impact speed of a single HGV Data which may he used to 
construct a probability density function for HGV closing 
speeds in accidents are given inTable 23.12. For an accident 
involving two vehicles, it is necessary to combine the 
probability density functions of the two vehicles. In such 
cases, the probability density function for the HGV impact 
speed may be used for both vehicles. 

An approach to the determination of the probability of a 
given combined impact speed in a head-on collision of two 
HGVs is as follows. Given that there is available a distribu¬ 
tion of HGV impact speeds such as that shown in 
Table 23.12, the distribution of the impact speeds of an 
HGV-HGV head-on collision and the probability that the 
speed lies within a certain range may be obtained as fol¬ 
lows. Consider a normal distribution of HGV impact speeds 
f(x) on built-up roads, where x is the impact speed, with a 
mean x and standard deviation a. Then for the distribution 
f(x c ) of the combined (i.e. summed) impact speeds 


Monte Carlo simulation using the actual histogram data for 
collision speeds. 


23.6.5 Collision modelling: impact consequences 

There are several collision scenarios which may be relevant 
to the conveyance by road of hazardous materials. Loss of 
containment of hazardous liquids in bulk transport is the 
prime problem, but explosion of loads sensitive to shock 
may also be of concern. 

The modelling of vehicle collision is discussed in Hand¬ 
book of Road Safety Research (Grime, 1987). 

For loss of containment of a hazardous liquid, there will 
be critical combinations of the impact velocities at which 
penetration of the tank occurs. For a frontal collision of two 
vehicles, by conservation of energy 

\ ( m\v{ + m 2 i%) = \ (m\ +«2 )v i + E [23.6.8] 

and by conservation of momentum 


4 = 2* [23.6.1] 

o* = 2a 2 [23.6.2] 

ff c = 2 1 / 2 <r [23.6.3] 

The probability P that the combined impact speed x c lies 
between x cl and x c2 is then 

P(x c i<x c <x c2 ) 

» - *e)M <*c< [(*02 - ScM [23.6.4] 

= P(a <x c <b) [23.6.5] 


miVi + m 2 v 2 


wi + w 2 


[23.6.9] 


where E is the energy absorbed in the collision, mi is the 
mass of the first vehicle, m 2 is the mass of the second 
vehicle, v is the residual velocity of the two vehicles after 
the collision, and V\ is the initial velocity of the first vehicle 
and v 2 is that of the second vehicle. The mass of each vehicle 
is defined here as that of the vehicle plus its load which is 
assumed to be restrained. From Equations 23.6.8 


E = l[miv[ + m 2 v^ — (mi + m 2 )v l \ [23.6.10] 


= 1(b) -1(a) [23.6.6] 

m P [23.6.7] 

where subscripts 1 and 2 denote bounding values of speed. 
Values of 1(a) and 1(b) can be obtained from standard tables 
of the normal distribution. As an illustration, consider the 
following example: 

X = 30.6 mph 

a = 12.2 mph 

Xc = 2 x 30.6 = 61.2 

ffc = 2 1/2 x 12.2 = 17.3 mph 

The probability that the collision speed is between 110 
and 130 mph is then 

P[(110 - 61.2)/17.3 < * c < (130 - 61.2)/17.3] 

= P(2.28 < x c < 3.98) = 7(3.98) - 7(2.82) 

= 0.9999 - 0.9976 = 2.3 x 1(T 3 

This method provides a simple and rapid estimate of the 
probability of the combined collision speed, given a colli¬ 
sion. The results are, however, only as good as the quality of 
fit of the distribution used. Specifically, the method utilizes 
the tail of the distribution. The fitting and use of tails is a 
common problem in the use of distributions. In some cases, 
it may be preferable to use alternative methods such as 


Equation 23.6.10 may be used to determine the critical 
combination of velocities Vi and v 2 which give the critical 
energy absorption E CI for rupture of the containment. The 
latter factor is obtained from mechanical considerations for 
the particular tanker. 

An early example of such an approach was the investi¬ 
gation by Westbrook (1974) of the comparative risks of 
chlorine transport by road, rail and pipeline. The study 
included a road tanker collision analysis to determine the 
probability of puncture given a crash. 

A series of collision analysis studies for HGVs for US 
conditions is available in Gardner and Moffatt (1982). 

For the explosion of a shock sensitive load, there will be 
some critical impact velocity of the load at which explosion 
occurs. For a frontal collision of a vehicle carrying such 
a load unrestrained with another vehicle as shown 
inFigure 23.4, by conservation of momentum, the residual 
velocity v of the two vehicles is given by Equation 23.6.9. 
This velocity may be positive or negative. Then the impact 
velocity v e of the load is 

Vi = Vi - v [23.6.11] 

Equation 23.6.11 may be used to determine the critical 
combination of velocities Vi and v 2 which give the critical 
impact velocity v a for the load. 

The treatment of ship collision, described below, pre¬ 
sents close parallels to road collision analysis of the type 
just described. 
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Figure 23.4 Vehicle collision model 


Table 23.17 Road transport environment in Great Britain: number of spills of motor spirit August 1980-August 1985? 
(Advisory Committee on Dangerous Substances, 1991) (Courtesy of HM Stationery Office. Copyright. All rights reserved) 


Initialing event 

Spill mechanism 


spm si. 

se (kg) 


<15 

15-150 

150-1500 

>1500 

Rollover 

Puncture 



1 

4 


Equipment 



1 

3 


Not specified 


2 



Collision 

Puncture 


1 


2 


Equipment 


1 

1 



Not specified 


1 



Body material and 

Top hatch 


1 



equipment failure 

Pipework 

1 

2 




Material crack 

1 

2 



Total 


2 

11 

3 

9 


a The period considered is given in tables 4 and 5 of the report as starting in August 1981, but in table 6 as starting in 1980. The latter fits the 
estimate given for motor spirit tankers on p. 235, para 32, of the report for the puncture frequency = 1.9 X10 -8 per loaded tanker km and is 
adopted here. 


23.6.6 Releases 

Moving on to accidents resulting in releases, the ACDS 
report considers two categories of accident: (1) the puncture 
of a tank wagon in an accident and (2) failure or malopera- 
tion of the tanker equipment. 

It considers the four study materials in turn. For motor 
spirit 

Distance travelled = 82 x 10 6 tanker-km/year 

This figure, and the others quoted in this section, refer to 
loaded journeys only. 

The number of spills of motor spirit in the 5 -year period 
ending in August 1985 is shown inTable 23.17. The spills are 
classed as nuisance (<15 kg), small (15-150 kg), medium 
(150-1500 kg) and large (>1500 kg). 

For spills of motor spirit due to punctures: 

Frequency of spills due to punctures of motor spirit 


m 1.9 x 10 8 /tanker-km 

The frequency of medium spills due to punctures is 
1.4 x 10 7tanker-km and that of large spills 0.24 x 10 -8 / 
tanker-km. 

There were no punctures of LPG, ammonia or chlorine 
tankers in the observation period, if two incidents involv¬ 
ing the transport of ammonia and LPG in improperly 
designed tankers are disregarded. However, from an ICI 
analysis of US data showing 12 LPG puncture incidents, 
the frequency of spills due to puncture of US LPG tankers 


was estimated as 8.1 x 10“ 9 /tanker-mile. Then, allowing 
for the higher frequency of level crossing incidents in the 
United States and for differences in tanker design, the fre¬ 
quency of spills due to puncture of UK LPG tankers was 
obtained as 4.8 x 10 -10 /tanker-km. A similar value was 
assumed for ammonia, whilst for chlorine the frequency 
was estimated as 0.8 x 10 -10 /tanker-km. 

For motor spirit spills due to equipment failures, the fre¬ 
quency of small spills, including those with causes not spe¬ 
cified, is 1.9 x 10“ 6 /joumey, that of medium spills 3.0 x 
10 _6 /journey and that of large spills 4.5 x 10 _6 /joumey. 

With regard to spill size, the average size of spill in six 
puncture incidents was 4015 kg and that in three equip¬ 
ment failure incidents was 3640 kg. 

For the other three substances, the frequency of leaks 
due to equipment failure was obtained from fault trees 
which are given in the report. The results for all spills other 
than nuisance spills were as follows: 


Frequency of spill (spills/journey) 

LPG 

5.2 x 10“ 9 

Ammonia 

7 x 10“ 9 

Chlorine 

3.6 x 10“ 9 


23.6.7 Release ignition 

For the probability of ignition of a spill of flammable 
material, the ACDS report states that none of the 25 
spills considered ignited. It disregards the two nuisance 
spills (<15 kg) and obtains from the remaining unignited 























TRANSPORT 23/29 


spills, an expected value of 0.7 ignitions in 23 spills, or an 
ignition probability of 0.033. 

This value is lower than that adopted for rail spills, as 
described below.This appears surprising, since other vehicles 
are potential sources of ignition. The report gives as possible 
reasons the good drainage of roadways and the emergency 
actiontakenbytankerdrivers.Italsoquotesexpertjudgement 
that a probability of ignition of 1 in 30 is about right. 


23.6.8 Fires 

The other main event which may give rise to an incident is 
fire. The frequency of fires on HGVs was considered in 
Section 23.6.2.With regard to fire, for HGVs, generally non¬ 
crash fires are much more frequent than crash fires. The 
Australian work indicates, not surprisingly, that this is less 
so for road tankers carrying flammable materials. Never¬ 
theless, the figures suggest that even for such tankers, non¬ 
crash fires may be more significant. 


23.6.9 Lorry stopover point incidents 

The ACDS report also considers the hazard at lorry stop¬ 
over points. These may vary from overnight lorry parks to 
points where the stopover is less than 1 h. 

COP 11 states that when a vehicle is not being driven, it 
should be parked in a safe place or supervised at all times 
by the driver or other competent person. It recommends 
that for periods of parking in excess of 1 h, or for overnight 
parking, use should be made of a lorry park or some other 
place where the public do not have access. 

The report states that UK records contain no puncture 
incident in a lorry stopover point. The authors therefore 
attempt to derive an estimate by adapting the en route 
puncture frequency data described above. These data, 
which are expressed as a frequency of puncture per tanker-km, 
are converted to a frequency of puncture per tanker-hour 
using a notional average speed of 60 mph. The data are 
corrected to allow for the low speed of vehicles in lorry 
stopovers by applying for motor spirit tankers and LPG 
tankers correction factors of 0.1 and 0.01, respectively. The 
frequency of punctures per journey is then obtained using 
appropriate values for the length of a stopover, taken as 
typically half an hour, and for the number of stopovers, 
taken as averaging 1.5 per journey. 

For LPG, the en route frequency of puncture of a tanker is 
4.8 x l(T 10 /tanker-km and there are 63,667 journeys/year. 
Then, following the approach just described 
Frequency of puncture of tanker 
m 0.01 x 60 x 4.8 x 10 _10 /tanker-km 
fc 2.88 x 10“ lo /tanker-h 

With 1.5 stopovers/journey and a stay of 0.5 h/stopover 
Frequency of puncture of tanker 
m 1.5 x 0.5 x 2.88 x 10“ 10 
2.2 x 10 _1 °/journey 
3 f 63,667 x 2.2 x 1<T 10 
i= 1.4 x 10 _5 /year 

The frequency of leaks due to equipment failure was 
obtained from fault trees, one of which, that for LPG, is 
given in the report. 


Using this methodology the results obtained for all four 
study substances in lorry stopover points are as follows: 


Frequency of puncture Frequency of spills due 
(punctures/journey) to equipment failure 
(failures/h) 


Motor spirit 

2.9 x 10“ 9 

_ 

LPG 

2.2 x KT 10 

2.6 x 10 -9 

Ammonia 

1.4 x 10 _1 ° 

3.9 x 10“ 9 

Chlorine 

1.4 x HT 11 

1.3 x 1(T 9 


No evaluation of equipment failure frequency was made for 
motor spirit, since the consequences were judged to be minor. 


23.6.10 Exposed population 

The population exposed in a road transport accident is the 
en route population and the other road users together with 
the emergency services. Meaningful assessment of the 
societal risk from road transport requires the use of a rea¬ 
sonably refined population exposure model. The models 
used in the ACDS report are described in Appendix 17. 

Population density and other characteristics 
A study of the density and other characteristics of the 
population which might be exposed to hazardous materials 
has been made by Petts, Withers and Lees (1987). The 
information given includes data for the United Kingdom 
on population densities, both by day and by night, on the 
proportions of persons indoors and outdoors, and on 
the proportion of the population which may be considered 
particularly vulnerable. 

There have also been specialist studies of the population 
density along routes taken in the transport of hazardous 
materials. These include theTRIP programme referred to in 
the Second Canvey Report (HSE, 1981a) and the study by 
Canadine and Purdy (1989) already mentioned. 

High density targets 

Of particular interest is the probability that any incident 
will occur at a location where large numbers of people are 
exposed. An estimate of this probability for BUAs may be 
made from V-2 rocket incidents. The distribution of the 
rockets which fell on London was effectively random. Analy¬ 
sis of the 517 V-2 incidents in London gives 8.9% which 
caused >10 deaths and 1.4% which caused >33 deaths. 

Emergency services 

In addition to the population that is normally in the area, 
emergency services personnel who attend the accident are 
also at risk. It is not uncommon in an incident involving the 
road transport of hazardous materials that a significant 
proportion of the casualties include such personnel. 

A typical road accident involving injury and fire would 
probably be attended by one police patrol car (2 persons), 
one fire tender (4-5 persons) and one ambulance (2-3 
persons). If the incident is considered serious and if time 
permits, additional fire tenders may attend. 

23.6.11 Emergency services 
Attendance times 

In assessing the consequences of an incident, the time for 
the fire services to attend may be important. In accordance 
with Home Office guidance, fire brigades classify areas 
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into different categories of risk. For each category there is a 
specified minimum number of pumps (i.e. fire engines) 
which are required to attend the scene and a maximum time 
for their arrival. Avehicle fire is normally attended by one 
fire engine. Information from the London Fire Brigade 
obtained by P.A. Davies and Lees (1992) indicates that a 
vehicle fire is normally attended by one fire engine and that 
for the type of area through which, for example, road 
transport of explosives takes place, the maximum attend¬ 
ance time is 20 min. The mean attendance time is between 
10 and 15 min. 

23.6.12 North American environment 

There have been a number of studies in North America on 
the transport of hazardous materials. Several of the more 
recent studies are considered here. 

A review of accidents involving, and releases from, 
vehicles carrying hazardous materials has been given by 
Glickman (1988). The data are based on the reporting sys¬ 
tem of the DoT, Office of Hazardous Materials Transporta¬ 
tion. The basic data consist of the distance travelled by 
trucks carrying hazardous materials and the number of 
accidents involving a spillage. 

The reporting system requires the recording of any 
unintentional release occurring during loading/unloading, 
transportation, or temporary storage. The author equates 
such releases to spillages. Spillages are treated as 
significant if they involve more than 5 US gallons or 40 lh 
of material. From these reporting requirements, from 
the data given by Maclean above and from other data 
given below, it would seem that most of these spillages do 
not in fact occur due to road traffic accidents on the public 
highway. 

Some data from the study are shown in Table 23.18. 
The frequency of spillages is obtained by simply dividing 
the number of spillages by the distance travelled by the 
vehicles. 

There are several points of interest in these data. One is 
the rather high ratio of the distance travelled by vehicles 
other than tank trucks to that travelled by tank trucks. 
Another is the rather lower ratio of the number of sig¬ 
nificant spillages for vehicles other than tank trucks to the 
number for tank trucks. Also of interest is the striking dif¬ 
ference in the frequencies of spillage between private 
trucks and trucks for hire. 

The overall frequency of significant spillages is 

Frequency of significant spillages = 16,677(16,220 x 10 6 ) 
*= 0.10 x 10 -6 spillages/vehicle-mile 
<= 0.062 x 10 _6 spillages/vehicle-km 

Harwood, Russell and Viner (1989) have collated informa¬ 
tion on hazardous material (HAZMAT) accidents. This 
information was obtained from the DoT’s RSPA Hazardous 
Materials Incident Reporting (HMIR) System database. 
The system is based solely on self-reporting by carriers. No 
minimum release quantity or damage level is specified and, 
technically, any release, however small, is reportable. The 
requirements apply, however, only to interstate transport, 
and carriers engaged solely in intrastate transport are not 
required to report HAZMAT incidents under this scheme. 

Data were analysed for the period 1981-85. During this 
time, there were 28,433 HAZMAT incidents reported. Some 
data on these incidents are given inTable 23.19. As the table 


Table 23.18 Road transport environment in North 
America: the distance travelled and the number and 
frequency of spillages for US trucks carrying hazardous 
materials in 1982 (P.A. Davies and Lees, 1992) 
(Courtesy of Elsevier Science Publishers) 


A Distance travelled 



Type of vehicle 


Distance travelled 
(10 6 vehicle miles) 

Trucks 

Private 


6,416 

For hire 


9,804 

Total 

of which 

Tank trucks 


16,220 

Private 


4,121 

For hire 


307 

Total 


4,228 

B Number of spillages 

Type of vehicle 


No. of spillages 


Total 

Significant 

Trucks 

Private 

357 

233 

For hire 

5,314 

1,434 

Total 

of which 

Tank trucks 

5,671 

1,667 

Private 

248 

178 

For hire 

936 

692 

Total 

1,184 

870 


C Frequency of spillages 


Type of vehicle 

Frequency of spillages 


(spillages/10 

’ vehicle miles) 


Total 

Significant 

Trucks 

Private 

0.0556 

0.0363 

For hire 

0.542 

0.146 

of which 

Tank trucks 

Private 

0.0602 

0.0432 

For hire 

3.049 

2.254 


shows, the proportion of HAZMAT incidents due to traffic 
was 11%. However, the proportion of severe incidents due to 
traffic lay between 35% and 68%, depending on the defi¬ 
nition of severity. The authors give one definition of a 
severe incident as one involving injury or death, a fire or 
explosion or more than US$50,000 dollars worth of damage. 

The authors also give information from another data¬ 
base, the Motor Carrier Accident Report maintained by the 
FHWA Bureau of Motor Carrier Safety (BMCS), now 
renamed the Office of Motor Carriers. This database gives 
information on trucks involved in accidents, including 
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Table 23.19 Road transport environment in North 
America: hazardous material incident data from the US 
Department of Transportation RPSA database for 
1981-85 (P.A. Davies and Lees, 1992) (Courtesy of 
Elsevier Science Publishers) 


A Location of incidents 


Location 

Proportion (%) 

i Number 

On public highway 

48 

13,547 

Off public highway 

39 

e.11,089 

Unknown 

13 

c. 3,797 

Total 

100 

28,433 

B Failure involved in 

incidents on public highway 

Failure type 

Number 

Proportion (%) 

Traffic accident 

1,427 

10.8 

Body or tank failure 

2,741 

20.2 

Valve or fitting failure 

3,289 

24.3 

Cargo shifting 

4,945 

36.5 

Fumes or venting 

15 

0.1 

Other 

1,100 

8.1 

Total 

13,547 

100.0 

C Hazardous materials involved in 

incidents on 

public highway 



Material All incidents (%) Traffic incidents (%) 

Flammable liquids 46 

71 


Toxic liquids 5 



Corrosive liquids 40 

13 


D Consequences of incidents on public highway 

Count 

Number of incidents 

Traffic Other 

AH incidents 

incidents incidents 


No. of incidents 1,457 

12,090 

13,547 

No. of deaths 50 

4 

54 

No. of injuries 115 

358 

473 


whether the truck was carrying hazardous materials and 
whether a release occurred. The reporting system applies, 
however, only to interstate carriers. Data from this source 
are given in Table 23.20. 

An analysis of accident rates in three states (California, 
Illinois and Michigan) and of release prohabilities overall in 
the United States has been given in a study by Harwood, 
Viner and Russell (1990), which follows on from the authors’ 
earlier work (Harwood and Russell, 1989; Harwood, Rus¬ 
sell and Viner, 1989). The data were obtained from the acci¬ 
dent reporting systems of these states. Table 23.21 gives 
data on release frequencies and probabilities. 

The accident frequencies differ appreciably between the 
different classes of highway. They also apparently differ 
appreciably between states. The probabilities of release 
given an accident, however, are relatively similar for rural 
highways as a group and for urban highways as a group. 

An analysis of incidents in Canada in which there were 
releases of gasoline or LPG has been made by Steward and 


Table 23.20 Road transport environment in North 
America: data on HAZMAT trucks involved in accidents 
from the US Department of Transportation BMCS 
database for 1984-85 (P.A. Davies and Lees, 1992) 
(Courtesy of Elsevier Science Publishers) 


A Truck accidents 

Truck type 


Number 

Non-HAZMAT trucks 



71,164 

HAZMAT trucks 



3,703 

of which 




No release 



3,183 

Release 



530 

B Cargoes of HAZMAT trucks i 

n accidents 

Cargo 

Number of accidents 



No release 

Release 

Total 

General freight 

680 

61 

741 

Gases in bulk 

238 

21 

259 

Solids in bulk 

28 

12 

40 

Liquids in bulk 

1486 

345 

1831 

Explosives 

63 

7 

70 

Empty 

210 

10 

220 

Other 

467 

62 

529 

C Consequences of HAZMAT truck accidents 

Count 

Number of accidents 



No release 

Release 

Total 

No. of incidents 

3183 

520 

3703 

No. of deaths 

273 

53 

326 

No. of injuries 

2514 

441 

2955 


van Aerde (1990a). The incidents were those reported under 
the regulatory system as dangerous occurrences in the 
period 1986 to August 1987 (1.7 years).Thus, not all accidents 
were reported and the data are therefore not comparable 
with those reported under the US HAZMATscheme. 

There were 41 incidents involving gasoline. A proportion 
of these may not have been transport incidents. The pro¬ 
portion known to be transport incidents was 81%, leaving 
between0% and 19% which may not have been.Table 23.22 
gives the number of incidents by type of release. 

The three major types of incident were collision, colli¬ 
sion/overturn and overturn. The proportion of lading 
released in these cases was 30-40%. For fires, the release 
was large (98%) except in one case where it was very small 
(3%). Of these three types of incident, overturns caused 
most container damage. The authors suggest that in colli¬ 
sion accidents, a large proportion of the energy is dis¬ 
sipated in other parts of the vehicle. 

There were four evacuations of the public in the 
41 incidents. 

A similar analysis is given for the LPG incidents, but 
there were only nine of these. 

Further more general data are given in the review of trans¬ 
portation of hazardous materials in Ontario by Gorys (1990). 

Griffiths and Linklater (1984) have reported a study 
performed in 1980 of some 42 accidents involving road 
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Table 23.21 Road transport environment in North 
America: probability and frequency of release of material 
in truck accidents in the USA (P.A. Davies and Lees, 
1992) (Courtesy of Elsevier Science Publishers) 


A Probability of release by accident type: single 
vehicle accidents 


Accident type 


Probability of release 

Non-collision accidents 


Run off road 


0.331 

Overturn 


0.375 

Other 


0.169 

Collisions with: 

Fixed object 


0.012 

Parked vehicle 


0.031 

Train 


0.455 

Non-motorist 


0.015 

Other object 


0.059 

B Probability of release by accident type: multiple 

vehicle accidents 


Accident type 


Probability of release 

Collision with: 

Passenger car 


0.035 

Truck 


0.094 

Other vehicle 


0.037 

C Probability and frequency of release by road 

type 

Road type 

Probability of 

Frequency of release 

(release/10 g 

vehicle-miles) 


release 

Rural 

Two-lane 

0.086 

0.19 

Multi-lane 

0.081 

0.36 

(undivided) 

Multi-lane 

0.082 

0.18 

(divided) 

Freeway 

0.090 

0.06 

Urban 

Two-lane 

0.069 

0.60 

Multi-lane 

0.055 

0.77 

(undivided) 

Multi-lane 

0.062 

0.77 

(divided) 

One-way street 

0.056 

0.54 

Freeway 

0.062 

0.14 


tankers transporting flammable materials in New South 
Wales (NSW). In 1979, in NSW, there were some 3000 road 
tankers carrying flammable loads and some 100 pressurized 
tankers. The annual crash rate was 2.5%, which was the 
same as for all vehicles. 

There were 42 accidents investigated, 11 involving non- 
articulated vehicles and 31 involving articulated vehicles. 
There were 18 rollovers, 5 for the non-articulated vehicles 
and 13 for the articulated vehicles. 

In 24 cases there was no leakage of the bulk load but in 
three of these there was leakage of the prime mover fuel tanks. 


In 10 of the rollover cases, there was substantial leakage. In 
two of the non-rollover cases, the tank was punctured and 
burned out. Of the other non-rollover cases, one involved the 
loss of ‘a lot ’ of product from a fractured pipe fitting, one a loss 
from a discharge pipe and two from vents. 

The authors state that fire occurred in 5% of cases. This 
would seem to cover the two cases of burnout just mentioned 
and to imply that none of the other cases involved a fire. 

The authors obtained data on the various factors which 
influenced the accident under the headings: mechanical, 
environmental, behavioural and general. 

Factors causing rollover included high centre of gravity, 
‘soft’ roll stiffness and sloshing of the liquid. None of the 
tankers appeared to have side baffles. 

From these data, the following estimates may be made 
for crash fires: 

No. of crash fires = 2 

Crash fires as proportion of accidents = 2/42 = 4.8% 

23.6.13 Individuality of accidents 

It is easy in a preoccupation with incident statistics to lose 
sight of the individual nature of some of the accidents 
which have occurred involving the road transport of 
hazardous materials. Mention has already been made of the 
chlorine tanker crash with a lorry travelling down hill at 
60 mph. Other incidents with rather unusual features 
include the San Carlos campsite disaster (Appendix 16), 
which may not have been initiated by either crash or fire 
and which involved a vulnerable target, and the explosion 
of an explosives lorry at Peterborough (Case History A125), 
which involved a fire rather than a crash and occurred off 
the road in a company yard. 

Moreover, enough has been said to indicate that, even 
where historical data do exist, the data may or may not be 
directly applicable. A case in point is the provision of side 
protection on tankers. This is provided on the ICI chlorine 
vehicles but not on the Australian road tankers described. 
In such cases, it may be appropriate to modify any histori¬ 
cal data to take account of the difference between the con¬ 
ditions to which those data apply and the conditions of the 
problem in hand. Again this may involve modelling and the 
use of data appropriate to that. 

23.7 Rail Transport 

23.7.1 Regulatory controls and codes 

The international transport of dangerous goods by rail is 
the subject of the Convention Concerning International 
Carriage by Rail (COTIF) and is governed by the Regulations 
Concerning the International Carnage of Dangerous Goods 
by Rail (RID) (DTp, 1993b), as described in Section 23.2. 

In addition, the International Union of Railways (IUR) 
issues information of an obligatory or recommended nature. 

In the United Kingdom, British Rail (BR) has a number of 
internal regulations. There is no requirement on BR to 
accept dangerous goods for carriage. It has published the 
document List of Dangerous Goods and Conditions of 
Acceptance (LOG) (BR 22426) which lists the dangerous 
substances that it is prepared to accept and the conditions 
of such acceptance. The list is based on the United Nations 
(UN) classification. It incorporates relevant statutory 
requirements such as those for radioactive materials. The 
conditions cover maximum quantities, forms of packaging, 
labelling, documentation, etc., and conform as far as 
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Table 23.22 Road transport environment in North America: tanker accidents involving re 
(P.A. Davies and Lees, 1992) (Courtesy of Elsevier Science Publishers) 

:lease of gasoline in Canada 

Accident type 


No. of releases (%) 



Proportion (%) 


Spill 

Leak Spill/fire 

Fire 

Other 

Total 


Collision 

2 


1 


3 

7 

Collision / overturn 

5 

1 



6 

15 

Overturn 

19 

1 


l a 

21 

51 

Brake failure 

2 




2 

5 

Puncture 

2 

1 



3 

7 

Fitting/hose failure 


1 

1 


2 

5 

Fire 



2 b 


2 

5 

Military exercise 

1 




1 

2 

Bridge collapse 

1 




1 

2 

Total 

32 

3 1 

4 

1 

41 



b One of these is classified as a spill/fire. 


possible with UN recommendations. The Railways Act 
1845 requires the consignor to give written indication of 
goods which are dangerous, and the Railways Act 1921 
requires it to comply with the rules laid down by BR. 

In addition to BR’s general regulations, rules and proce¬ 
dures, for dangerous goods there are specific instructions 
to staff given in The Working Manual for Rail Staff, Part 3, 
Handling and Carriage of Dangerous Goods (BR 30054/3), 
commonly known as the ‘Pink Pages’. This deals with the 
definition of dangerous goods and gives procedures for 
acceptance, marking, loading, unloading, marshalling and 
movement, and for incidents and fires. 

In the United States, rail transport of hazardous 
materials is regulated by the DOT. The DOT Hazardous 
Materials Regulations (49 CFR Pt 179) apply to carriage 
by rail. The AAR complements the work of the DOT by 
setting standards. 

23.7.2 Hazard scenarios 

The hazard scenarios for rail transport of hazard¬ 
ous materials do not differ greatly from those for road 
described in Section 23.5. Thus, pool fires, torch fires, 
vapour cloud fires and explosions, and toxic releases may 
all occur in a broadly similar manner, as well as physical 
explosions and condensed phase explosions. 

There are, however, a number of differences. One is 
that the energy in a train collision is much greater than that 
associated with a vehicle collision on a road. Another is 
that a train typically contains a number of tank wagons and 
these may he vulnerable to the initiating incident. A 
particular instance of this is that torch fires in which the 
flame from one tank wagon plays on another are much more 
significant. The rail environment also differs in respect of 
the population exposed to the event and of the access for 
the emergency services. 

23.7.3 Rail tank wagon design 

The RID gives requirements for the design of rail tank 
wagons which parallel those in the ADR for road tankers. 
For more hazardous materials, it is good practice to provide 
a strongly protected filling connection cover and buffer 
override protection. 

Information on rail tank cars in the United States is given 
by Fitch (2003) in the NFPA Handbook. American rail tank 


cars are built to standards for freight cars generally and in 
addition must comply with the DOT Hazardous Materials 
Regulations and the Specifications for Tank Cars of the 
AAR. There are four main types of tank car: 

(1) non-pressure tank cars; 

(2) pressure tank cars; 

(3) cryogenic liquid tank cars; 

(4) other 

(a) high pressure service tank cars, 

(b) multi-unit tank cars. 

Non-pressure tank cars have tank test pressures of 100 psi 
(6.89 bar) and pressure tank cars have test pressures of 
100-600 psi (6.89-41.4 bar). Both types have capacities 
ranging from 4000 to 45,000 USgal (145-170 m 3 ). Cryo¬ 
genic liquid tank cars carry liquids at -130 to -423°F (-90 
to -253°C). The insulation is designed to protect the cargo 
for a 30 -day period. Multiunit tank cars, or ton containers, 
carry demountable tanks which can be taken off the car for 
filling and emptying. 

About 90% of the tank cars are constructed in carhon 
steel and most of the rest in aluminium. The regulations 
specify the following thicknesses of plate for the construc¬ 
tion of tank cars: for non-pressure tanks, 7 /i6 in. (11.1 mm) 
steel or y 2 in. (12.7 mm) aluminium, and for pressure tanks, 
9 / 16 in. (14.3 mm) steel and % in. (15.9 mm) aluminium. 

Tank cars may be provided with thermal insulation. The 
principal materials used are fibreglass and polyurethane 
foam. For cryogenic tanks, perlite is used. Some tanks are 
lined and some have heating coils. 

The DOT has promoted a programme of protective meas¬ 
ures to lessen the risk of tank rupture by overheating or 
puncture. These are: 

(1) Thermal protection; 

(2) Shelf couplers; 

(3) Head shields. 

The thermal protection is designed to protect the tank 
against a pool fire for 100 min or against a torch fire for 
30 min. The shelf couplers are of a design which is less 
likely to disengage in a derailment. The head shields pro¬ 
tect the lower part of the tank heads against puncture. 
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23.7.4 Rail system operation 

The development of British practice in the movement of 
bulk chemicals by rail has been described by Sanderson 
(1981). The older method was to move small numbers of 
wagons through a series of marshalling yards; the newer 
method is to make up complete trainloads, or block trains, 
running between two points, so that rail transport becomes 
an integral part of the production line linking two works. 

BR controls the movement of freight through the Total 
Operations Processing System (TOPS) computer system. 
This system makes it possible to keep track both of the 
movement of each individual wagon and of its position on the 
train. The system is particularly valuable in an emergency. 

23.8 Rail Transport Environment 

The basic sources of information on the rail transport 
environment in the United Kingdom are the Department of 
Transport and British Rail. 

The Transport Statistics Great Britain 1976-86 (DTp, 
1987b) and Rail Safety - Report on the Safety Record of the 
Railways in Great Britain 1986 (DTp, 1987a) provide certain 
basic information. There are also available an appreciable 
number of accident reports. 

Studies of the UK rail transport environment are given 
in the ACDS Transport Hazards Report (ACDS, 1991) and by 
PA. Davies (1990). As already stated, the former con¬ 
sidered four hazardous materials (motor spirit, LPG, 
chlorine and ammonia, and also explosives) whilst the lat¬ 
ter was concerned with explosives, particularly munitions. 
Essentially these studies utilize two basic categories of 
information: (1) rail movements and (2) incident records. 

23.8.1 Rail network and rolling stock 

BR operates a rail network with 22,423 km of running line 
and 3601 km of sidings. There are some 70 marshalling 
yards. 

In 1986, the distance travelled by freight trains was 
54 x 10 6 km. In the year 1985-86, the distance travelled by 
loaded tank wagons containing both hazardous and non- 
hazardous chemical and petroleum products was 47.4 x 10 6 
tank-wagon-km. 

The ACDS report gives a detailed breakdown of the 
movements of the four materials considered, as shown in 
Table 23.23. 

23.8.2 Rail accidents 

Information on accidents involving freight trains gen¬ 
erally is given in the study by Davies. The three main 
types of accident considered are collisions, derailments 
and fires. 

The ACDS study deals mainly with accidents resulting 
in releases and with the ignition of releases of flammable 
materials. 

From a study of general rail accident statistics, Davies 
gives the following breakdown of freight train accidents 
(FTAs)inl986: 


Type of accident No. Proportion (%) 


Collision 113 35 

Derailment 158 49 

Fire 53 16 

Total 324 100 


Table 23.23 Rail transport environment in Great Britain: 
tank wagon capacities and movements for four hazardous 
materials (after ACDS, 1991) (Courtesy of Elsevier 
Science Publishers) 


A Tank wagon capacities 

Substance 

Tank capacity (te) 

Bogies 


2-axle 



Motor spirit 

32 


75 

LPG 

20 


40 

Ammonia 

- 


53 

Chlorine 

29 


- 

B Tank wagon movements 


Motor LPG 

Ammonia Chlorine 


spirit 



Total 

10,199,095 13,90,590 

1,348,080 

313,668 


movements 

(wagon-km/ 

year) 

Total 55,814 4,334 4,500 2,342 

wagon 
journeys 
(wagon- 
journey/ 
year) 


He also made a study of some 187 accident reports, of 
which 38 were for FTAs. This is referred to as the FTA 


study. In this study, 
down of: 

he obtained 

the following break- 

Type of accident 

No. 

Proportion (%) 

Collision 

26 

68 

Derailment 

8 

21 

Fire 

1 

3 

Other 

3 

8 

Total 

38 

100 


23.8.3 Collisions 

In general, freight train collision accidents are more severe 
than derailments. For collisions in 1986, Davies gives: 


Type of collision 

No. 

Proportion 

(%) 

FTvsFT 

8 

7 

FTvsPT 

1 

1 

FT vs ECS 

10 

9 

Buffer stop 

55 

49 

Level crossing 

6 

5 

Miscellaneous obstacles 

22 

19 

Animals 

9 

8 

Other 

2 

2 

Total 

113 

100 
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where ECS denotes empty coaching stock, FT denotes 
freight train and PT denotes passenger train. The most 
severe collisions are with rolling stock. From the data just 
given, there were 19 such incidents (17%) which break 
down to give: 


Type of collision with rolling stock 

No. 

Proportion (%) 

FTvsFT 

8 

42 

FTvsPT 

1 

5 

FT vs ECS 

10 

53 

From the FTA study, he found that som 

e70% of collisions 

with rolling stock were head-on o: 

r front/rear collisions and 

obtained for these the following breakdown: 

Type of collision with rolling stock 


Proportion (%) 

Head on 


40 

Front on rear 


40 

Rear by front 


20 


The other 30% of collisions with rolling stock were side 
impacts or glancing blows. 

The most frequent type of collision was with buffer stops 
but the speed at which these collisions occurred was gen¬ 
erally 10 mph or below. This type of collision was considered 
sufficiently minor that in 1987 the practice of recording it 
was discontinued. It is worth noting, however, that a major 
disaster due to a collision of this type on a passenger train 
on the London Underground occurred at Moorgate station 
in 1975. 

The number of collisions at level crossings involving 
freight trains was small, but for all trains the following 
breakdown was obtained: 


Type of collision 

No. 

Proportion (%) 

Train on car or van 

18 

78 

Car or van on train 

5 

22 

Total 

23 

100 


The closing speeds at which collision accidents occurred 
are not known, but from an analysis of the FTAs in the 
FTAs survey, P.A. Davies and Lees (1991a) obtained the 
estimates shown in Table 23.24, Section A. 

23.8.4 Derailments 

Turning to derailments, these are generally less serious 
than collisions. The most severe derailments tend to be 
those which result in subsequent collisions. A study of 
derailments has been made by Taig (1980). He found that 
some 10% of derailments involve subsequent collision, 4% 
being with other rolling stock and 6% with other objects. 
Taig also presents a graph showing data on the speed at 
which derailments occur. These data are given in tabular 
form by Davies and Lees, as shown inTable 23.24, Section B. 

23.8.5 Fires 

As stated above, in 1986 there were 53 fires recorded on 
freight trains. Small fires are a not uncommon occurrence, 
but very few become severe. 


Table 23.24 Rail transport environment in Great Britain: 
accident speeds of freight trains (P.A. Davies and Lees, 
1992) (Courtesy of Elsevier Science Publishers) 


A Freight train closing speeds ii 
rolling stock a 

n collisions with 

Closing speed 

No. of 

Proportion of 

(mph) 

collisions 

collisions (%) 

1-10 

1 

5 

11-20 

8 

40 

21-30 

4 

20 

31-40 

3 

15 

41-50 

3 

15 

51-60 

1 

5 


B Derailment speeds of freight trains b 

Derailment speed 
(mph) 

Proportion of derailments 

On plain 

Not on plain 


track (%) 

track (%) 

1-10 

15 

54 

11-20 

20 

20 

21-30 

6 

6 

31-40 

18 

4 

41-50 

26 

4 

51-60 

9 

4 

61-70 

3 

4 

71-80 

2 

4 

81-90 

1 

0 


a Estimated from accident reports. Sample size = 20. 
b AfterTaig (1980). Sample size = 300. 


Fires may be classified as crash fires and non-crash fires. 
In the 187 accident reports for all trains initially reviewed 
for the FTA study, only one involved a non-crash fire, which 
was not on a freight train. By contrast, in the 38 reports of 
FTAs, there were 6 crash fires. Four of these resulted from 
collisions and two from derailments. All 6 fires were quite 
severe. On this basis, the ratio of crash to non-crash fires is 
of the order of at least 6 : 1. Since there were 34 crashes 
(collisions and derailments) in the survey, the probability of 
a fire given a severe crash is 0.18 ( = 6/34). 

23.8.6 Releases 

Turning to accidents resulting in leaks, the ACDS report 
considers two categories of accident: (1) puncture of a tank 
wagon by collision or derailment and (2) failure or mal- 
operation of the tank wagon equipment. 

It considers each of the four study materials in turn. 
For motor spirit 

Distance travelled = 10.2 x 10 6 tank-wagon-km/year 
There were four puncture incidents in a 6.25-year 
period, giving: 

Frequency of puncture of motor spirit tank wagon 
:f= 6.3 x 10 -8 /tank-wagon-km 

The report also mentions a BR estimate of puncture 
frequency of 10 -8 /tank-wagon-km. 
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For the liquefied gases, it refers to a study by ICI on 
incidents with the possible potential to cause puncture of a 
chlorine or ammonia tank wagon. In the 7-year period 
1980-86, there were on tank wagons generally seven 
puncture incidents. These all occurred on tank wagons 
with ‘thin’ (6 mm) walls. It was estimated that for such 
incidents the average probability of puncture of a chlorine 
tank wagon was 0.0385 and that for an ammonia 
wagon 0.103. Then utilizing the figure of 47.4 x 10 6 tank- 
wagon-km travelled by all laden tank wagons each year, 
the following estimates are obtained: 

Frequency of puncture of chlorine tank wagon 
= 0.9 x 10 _9 /tank-wagon-km 
Frequency of puncture of ammonia tank wagon 
•= 2.5 x 10 _9 /tank-wagon-km 

The frequency of puncture of an LPG tank wagon was 
taken as the same as that for an ammonia wagon. 

The other leak mode is failure or maloperation of the 
tank wagon equipment. These leaks were assumed to be 
relatively small. Estimates of the frequency of such leaks 
per 10-h journey were made using fault trees, which are 
given in the report. The following results were obtained: 


Frequency of leak 
(leaks/journey) 

LPG 

0.83 x 10“ 8 

Chlorine 

3.1 x 10“® 

Ammonia 

1.3x10-® 


No evaluation was made for motor spirit, since the con¬ 
sequences were judged to be minor. 


chlorine, 53%; and ammonia, >1% (occasional wagon load 
returned to its origin). 

Based on arguments relating to the differences between 
thin- and thick-walled tank wagons, the probabilities of 
puncture given an incident of the type just described were 
estimated as 0.01 for LPG and ammonia tank wagons and 
0.005 for a chlorine tank wagon. 

One of the busiest marshalling yards was selected for 
detailed study. The substance principally considered there 
was chlorine. The yard handles some 78% of the Speedlink 
chlorine traffic, or some 1500 chlorine tank wagons per 
year. It was estimated that the yard handles a total of 7990 
laden tank wagons of hazardous substances per year. 

The frequency of a chlorine leak due to a puncture of a 
tank wagon at this particular yard was then obtained as: 


Frequency of puncture of chlorine tank wagon 


= 3.6 x 10“ 3 x 0.005 
= 3.4 x 10 _6 /year 


1500 

7990 


It may be noted that in deriving this figure for a busy yard, 
it is the generic figure for puncture frequency for all yards 
which is used. 

For leaks due to failure or maloperation of equipment, 
use was made of the data obtained in the en route study, as 
given in Section 23.8.6. On the assumption that one-tenth of 
the total journey time is spent in the marshalling yard, the 
probability of a chlorine leak due to this cause was obtained 
as 3.1 x 10 -9 journey. Then 

Frequency of leak due to equipment failure of chlorine 
tank wagon = 1500 x 3.1 x 10 -9 
m 4.6 x 10 _6 /year 


23.8.7 Release ignition 

For the probability of the ignition of a leak of flammable 
material, BR incident reports showed that of five leaks over 
a period of 6.25 years, one ignited. The ACDS report bases 
its estimates partly on these data and data from fixed sites, 
and partly on judgement. It gives for small spills, whether 
of motor spirit or LPG, probabilities of 0.1 for immediate 
ignition, 0 for delayed ignition and 0.9 for no ignition. For 
large spills of motor spirit, the corresponding probabilities 
are 0.2,0.1 and 0.7 and those for large spills of LPG are 0.2, 
0.5 and 0.3, respectively. 

23.8.8 Marshalling yard incidents 

The ACDS report also considers activities in marshalling 
yards. BR operates some 70 such yards, but the majority of 
movements of dangerous goods are by block trains which 
do not enter marshalling yards. 

In the 8-year period to the end of 1987, there were two 
puncture incidents. These involved methanol tank wagons 
punctured in collisions, one by a coupling hook and the 
other by a shunting engine. On this basis, the report 
obtains a generic value for the puncture frequency of ‘thin’ 
walled tank wagons: 

Frequency of puncture = 3.6 x 10 _3 /yard-year 


The other main study substance passing through marshal¬ 
ling yards is LPG. The yard studied handles some 200 laden 
wagons per year. However, LPG tank wagons are not actu¬ 
ally marshalled. In view of this, the generic puncture fre¬ 
quency was reduced by a factor of 5. Then, taking the 
probability of puncture of an LPG tank wagon in an incident 
which would puncture a thin-walled wagon as 0.01, as given 
above, the frequency of an LPG leak due to puncture of a 
tank wagon at this particular yard was then obtained as: 

Frequency of puncture of LPG tank wagon 


= 4.6 x 10 6 /year 

23.8.9 Exposed population 

The population exposed in a rail transport accident com¬ 
prises the en route population and the other rail users, 
particularly passengers in other trains, together with the 
emergency services. 

Meaningful assessment of the societal risk from rail 
transport requires the use of a reasonably refined popula¬ 
tion exposure model. The models used in the ACDS report 
are described in Appendix 17. 


This implies similar levels of traffic at all yards. 

For the four study substances, the proportions travelling 
by Speedlink service are: motor spirit, <1%; LPG, 28%; 


23.8.10 US environment 

In the United States, the total railroad track mileage in 1981 
was 327,000. From a survey of US and Canadian Class 1 
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railroads for 1983, the length of line surveyed was 145,881 
which was 69.5% of the total track. This therefore gives for 
those two countries a total mileage of 209,900 for this class 
of track. 

In 1986, there were in use in the United States some 
183,000 tank cars, which comprised some 10% of the total 
fleet of freight wagons. 

The NTSB Annual Report 1980 gives the railroad acci¬ 
dent rate in 1979 for passenger and freight trains in the 
Unites States as 12.8 accidents per 10 6 train-miles. The 1981 
Report gives for 1980 the following breakdown of causes of 
train accidents: track defects, 41%; mechanical/electrical 
failures, 17%; human factors, 28%; and other, 14%. 

The main causes of accidents leading to loss of contain¬ 
ment of hazardous materials from rail tank cars are derail¬ 
ments and collisions. One principal casue of such accidents 
is the state of the track and of the rolling stock. 

23.9 Road and Rail Tunnels 

Both road and rail systems include tunnels. In principle, 
differences may be expected from open routes with respect 
to both the frequency and the consequences of incidents, 
but there are certain common features between road and 
rail tunnels as well. 

Accounts of tunnels tend to be either descriptions of 
incidents or hazard assessments. Case histories involving 
tunnels are described in Section 23.21 and hazard assess¬ 
ment is described in Section 23.26. 


23.10 Waterway Transport 

The extent of waterway movement of hazardous materials 
is small in the United Kingdom, but it is considerable 
in Europe and the United States. The Rhine and the 
Mississippi are major arteries. Accounts of waterway 
transport have been given by H.R Nelson (1964), Backhaus 
and Janssen (1974) and Ligthart (1980). 

In the United Kingdom, British Waterways bylaws apply 
to the transport of dangerous goods on canals. It issues a 
document on the terms and conditions of acceptance. 

In the United States, the responsibilities of the US Coast 
Guard extend to inland waterways. The US Army Corps of 
Engineers is also involved through its responsibility for 
waterfront structures and embankments, canals, bridges 
and dams. 

Backhaus and Janssen quote the maximum size of LNG 
barge which might be used on the Rhine as 108 m long x 
11.4 m broad. Alternatively, use might be made of four 
barges with a push tug with total dimensions 185 m long x 
22.8 m broad. 

The construction of the barge tends to vary with the type 
of material which it carries. In the United States, for exam¬ 
ple, for petroleum, the barge shell is also the container wall, 
whereas for chlorine there are separate chlorine tanks 
within the barge structure. 

A principal hazard of barge transport is collision. It is 
important to minimize the risk of this, not only when 
the barge is on the move but also while it is loading or 
unloading. 

Another hazard of barge transport arises where barges 
are used to carry a variety of chemicals. While skilled peo¬ 
ple are generally available to assist at the loading point, the 
barge operator may well be on his own at the unloading 
point. 


In the United States, the Coast Guard has attempted to 
improve the competence of barge crews by encouraging 
them to take specific training as chemical tankermen. 

The NTSB annual reports describe measures to reduce 
collisions. In particular, efforts have been made to improve 
bridge-to-bridge communications. 

A study of the hazards of transport of LPG on inland 
waterways has been described by Ligthart (1980). He states 
that serious risk arises only from collisions, although he 
qualifies this by excluding risks from cargo treatment, 
cleaning and repair. 

23.11 Pipeline Transport 

23.11.1 Regulatory controls and codes 

The movement of hazardous materials by pipeline in the 
United Kingdom is regulated by the Pipelines Act 1962 and 
enforced by the Pipelines Inspectorate. The Act distin¬ 
guishes between local pipelines (less than 10 miles long) 
and cross-country pipelines (greater than 10 miles long). 

In the United States, pipeline transport is regulated by 
the DOT through the Natural Gas Pipeline Safety Act 1968 
and related legislation for other hazardous materials. 
Relevant regulations include Pipeline Safety Program 
Procedures (Part 190) and Transportation of Natural and 
Other Gas by Pipeline: Minimum Federal Safety Standards 
(Part 192). 

Some standards and codes for pipelines include BS CP 
2010: 1970 - Design and Construction of Steel Pipelines in 
Land , the ASME Code for Pressure Piping B31.4: 1974 
Liquid Petroleum Transportation Systems and B31.8: 1975 
Gas Transmission and Distribution Piping Systems, the IP 
Pipeline Safety Code (1982 MCSP Pt 6) and IGE/TD/1 Steel 
Pipelines for High Pressure Gas Transmission (IGE, 1984). 

23.11.2 Hazard scenarios 

For a pipeline carrying flammable gas, some principal 
hazard scenarios are a jet fire and a flammable vapour 
cloud, leading to a flash fire or vapour cloud explosion, 
whilst for one transporting liquid, the scenario is a liquid 
spillage leading to a pool fire or flowing liquid fire. The 
main hazard scenario for a pipeline carrying toxic gas or 
liquid is a toxic vapour cloud. 

23.11.3 Pipeline economics 

The economics of pipeline transport have been discussed 
by Lennart (1964). The cost breakdown for pipelines is 
quite different from that for other modes of inland trans¬ 
port. At that time, for pipelines, the total costs were 
approximately 70% fixed costs and 30% variable costs, 
whilst for waterways, road and rail, the fixed costs were 
30%, 15% and 5% and the variable costs 70%, 85% and 
95%, respectively. Moreover, the cost index n relating the 
capital cost C to the throughput P 

C = kP n [23.11.1] 

where k is a constant, is very low. Lennart gives the capital 
cost of a 6 in. line as only about 45 % more than that of a 4 in. 
line. Thus, for the supply of an assured market at a fixed 
point, a pipeline is a very attractive mode of transport. 

23.11.4 Pipeline systems 

In Western Europe and North America, there are large 
pipeline systems carrying predominantly hydrocarbons. 



23/38 TRANSPORT 


For the former, statistics on the pipeline network are given 
in Performance of Oil Industry Cross-Country Pipelines in 
Western Europe: Statistical Summary of Reported Spillages - 
1991 (CONCAWE, 1991 4/92), which is part of an annual 
series. 

In 1991, Western Europe had 210 service pipelines with a 
total length of 21,000 km. These pipelines carry some 593 
million cubic metres of crude oil and refined products, 
giving a total movement of 101 x 10 9 m 3 -km. Maps showing 
the pipelines in Western Europe as a whole and in par¬ 
ticular areas are given in the CONCAWE report. 

Statistics on pipelines in the United States are collected 
by the Federal Energy Regulatory Commission (FERC). 
Periodic reviews are given in the Oil and GasJournal. In the 
review of the 1984 figures by True (1985), the mileage of 
interstate pipelines is given as, for gas, 258,204 miles and, 
for liquid, 173,922 miles. 

Sources of information on pipeline failures also often 
contain information on the size of pipeline systems. 


23.11.5 Pipeline design and operation 
Pipelines are usually buried about 1 m below ground. Their 
environmental impact is therefore usually minimal and 
they can be difficult to detect even by aerial survey unless 
there are sufficient marker posts. 

The extent to which the temperature of the gas in a 
pipeline varies depends on the depth at which it is buried, 
but for most pipelines in the United Kingdom the variation 
is small, although this is not always so in other countries. 

The standards of construction and protection of pipe¬ 
lines have improved markedly over the years. The older 
pipelines were of mild steel or cast iron. The former have 
often corroded, while the latter have often withstood con¬ 
ditions better. There are cast iron brine mains, for example, 
which have remained in good condition. But cast iron has a 
relatively low resistance to impact and is not an ideal 
material for pipelines for hazardous substances. 

Mild steel is now generally used for pipelines, but it is of 
much higher quality, being more uniform and better 
extruded or seam welded. Welds on the pipeline are more 
carefully done. 

Pipelines are also much better protected. The older 
pipelines had no specific external protection. Then the 
wrapping of lines was developed, culminating in the pre¬ 
sent practice of using a coal tar/glass fibre wrap. But this 
was not the whole answer, because corrosion still occurred 
at points where the wrapping was badly done or was 
damaged or where there were line joints. 

This problem has been largely overcome by the use of 
cathodic protection. Corrosion of steel involves iron pas¬ 
sing into solution as an ion. This process may be reduced by 
impressing on the pipe a suitable voltage. It is still neces¬ 
sary to wrap the pipe, because the currents required 
with unwrapped pipe are excessive. But cathodic protec¬ 
tion gives effective protection at defects and gaps on a 
wrapped pipe. 

The modern method of external protection, therefore, 
utilizes a combination of wrapping and cathodic protec¬ 
tion. With this system, minimum external corrosion rates 
are obtained. 

Internal corrosion depends on the material transported, 
but in many cases, it is very low. 

Pipelines are regularly inspected for corrosion, both 
external and internal. The internal surface of the pipe may 


be checked by instrumentation transported through the 
pipe by an ‘intelligent pig’. 

A code of practice for pipelines is provided by the Pipe¬ 
line Safely Code by the IP (1982 MCSP Pt 6). This deals with 
the design, materials, land and rights of way, construction, 
testing, cathodic protection, operation, maintenance and 
emergency procedures. 

The internal pressure of the pipeline should not be less 
than the normal maximum working pressure plus any 
anticipated surge pressure. The minimum wall thickness 
for a straight pipe under internal pressure is determined by 
the formula 



where a is a design factor, D is the external diameter of the 
pipe (mm), f y is the specified minimum yield strength (N/ 
mm 2 ), p is the internal design pressure above atmospheric 
pressure (bar), and t is the design thickness of pipe wall 
(mm). The design factor a is taken as 0.72 for gas and liquid 
pipelines in remote areas. 

Protective devices such as pressure relief devices and 
shut-down systems should be fitted to prevent the line 
pressure rising more than 10% above the internal design 
pressure and to deal with fluid expansion effects. 

The Institute of Petroleum (IP) code describes a number 
of additional protective measures which may be provided to 
avert damage to a pipeline. They are: (1) increased earth 
cover; (2) increased coating strength; (3) an additional pro¬ 
tective coating of concrete, provided this does not screen 
cathodic protection currents; (4) additional position 
markers on the surface; (5) increased pipe wall thickness; 
(6) provision of a casing sleeve and (7), for above ground 
pipelines, provision of impact protection. 

In some areas, design of the pipeline against earthquakes 
assumes greater importance. Accounts of the seismic design 
of pipelines include those of Newmark and Hall (1975), 
Shinozuka.Takada and Ishikawa (1979) and Jinsi (1985). 

Increasingly use is made of trenchless technology, in 
which a pipeline is installed, replaced or repaired without 
removing the earth above it. It is used particularly for 
water and gas distribution systems. An account of the set of 
technologies which come under this heading is given in 
Introduction to Trenchless Technology (International Society 
for Trenchless Technology, 1991). Whilst the techniques are 
applicable to distribution rather than transmission sys¬ 
tems, they have been used for pressure piping and for quite 
large diameter pipes. Upsizing of pipes of 225 and 355 mm 
diameter is well established and pipes of up to 600 mm 
diameter have been done. 


23.11.6 Hydrocarbon pipelines 

The majority of pipelines carry flammable gases such as 
natural gas, ethylene or LPG or flammable liquids such as 
crude oil, oil products or NGL. It is to hydrocarbon pipe¬ 
lines that the account given so far mainly relates. 

23.11.7 Ammonia pipelines 

There are some very extensive liquid anhydrous ammonia 
pipeline systems, especially in the United States. The 
ammonia is mainly used by farmers in the corn belt as 
fertilizer. 
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Descriptions of the Mid-America Pipeline System are 
given by Rohleder (1969) and by Luddeke (1975) and of the 
Gulf Central System by Inkofer (1969). 

The Gulf Central pipeline described by Inkofer has a 10 
in. diameter trunk line 548 miles in length running south to 
north with two spur lines off it. One of these has 417 miles of 
8 in. line and 235 miles of 6 in. line, the other has 234 miles 
of 8 in. line and 153 miles of 6 in. line. The design study was 
for a line operating at a pressure of 1440 psig (100 bar) and 
in the temperature range 35-75°F (2-24°C). Details of the 
design codes, materials and inspection methods are given 
by Inkofer. 

The hazard of brittle fracture was given special con¬ 
sideration. Cases have occurred where brittle fracture has 
propagated along a pipeline at a velocity close to that of 
sound in the metal. Thus, a large length of line could be 
affected. The maximum transition temperature for the 
pipeline was set at 0°F (-17.8°C), which is well below the 
normal operating temperature range. Above the transition 
temperature, ductile shear failures may occur, but these 
were considered less serious. 

The composition of the anhydrous ammonia is closely 
controlled to prevent attack on the pipeline. Impurities in 
ammonia, such as air or carbon dioxide, can cause stress 
corrosion cracking. This is largely inhibited, however, if the 
ammonia contains 0.2% water and this water content is 
specified as a minimum. 

The pipeline has at approximately 10 -mile intervals shut¬ 
off valves which can be closed manually. At the same points 
there are also check valves which prevent back flow from 
the line section ahead of the rupture point. At rather greater 
intervals there are pump stations with instrumentation 
that detects any sudden changes of pressure caused hy a 
line break and stops pumps and closes automatic shut-off 
valves. 

The situation arising in the event of a leak is considered by 
Inkofer. For a small leak, he suggests that, in theory, the 
ammoniashouldfreezethesurroundingground,butthiswas 
queried in the discussion, where it was pointed out that 
practical experience indicates that small leaks of ammonia 
actually tend to dissolve in water and generate heat. 

With a large leak due a major pipeline rupture, the line 
break detectors would stop the pumps and shut the isola¬ 
tion valves at the upstream pump station and the suction 
pressure controls would stop the pumps at the downstream 
pump stations, so that the pipeline break would be isolated 
to a single section. 

There would be an initial high pressure spurt of ammo¬ 
nia as the pipeline pressure vented. The line pressure would 
then fall to that corresponding to the vapour pressure of 
ammonia at the line temperature, that is, 107 psia at 60°F. 
Several other effects would further reduce the rate of dis¬ 
charge. Vapour locks would form at humps along the pipe¬ 
line, and these would cause a back pressure due to the 
accumulated liquid heads created by each rise in the line 
ending in a vapour pocket. Flashing of vapour would cool 
the remaining liquid. The overall results of these effects 
would probably be that after the initial spurt of flashing 
liquid there would be a period of prolonged and spasmodic 
ejection of liquid and vapour. 

The proportion of ammonia flashing off from saturated 
liquid at 60°F and 107 psia is approximately 10%. The 
remaining liquid would be cooled to —28°F and would form 
a pool. The evaporation from this pool would be in the range 
1-7 lb/ft 2 h and thus fairly slow. 


A 10-mile section of 10 in. line at 60°F contains 591 ton 
of ammonia and, assuming 90% of this forms a pool at 
-28°F, the resulting 24,990 ft 3 could form apool of 12,495 ft 2 
with a depth of 24 in., or one of 149,940 ft 2 with a depth of 2 in. 

The pipeline is continuously monitored by a pipeline 
dispatcher. In the event of a line break, he will know the 
location between the particular pump stations. He then 
sends out a team to locate the break more precisely, to shut 
all isolation valves in the section affected and to open 
blowdown valves in order to encourage the formation of 
vapour locks. The basic procedure for containing the spil¬ 
lage is to dike around it. The line is then excavated and the 
rupture repaired. If necessary, stopple plugs are inserted 
into the line to shut off the flow. 

The vapour from an ammonia line break is initially cold 
and heavier than air. It can travel in lethal concentration 
several miles. The dispersion of vapours from ammonia 
spillages was considered in more detail in Chapter 15. 

The description given by Rohleder and by Luddeke of the 
Mid-America Pipeline system is broadly similar. 


23.11.8 Chlorine pipelines 

Pipeline transport of chlorine is much less extensive than 
that of ammonia. Chlorine lines are dealt with in Chlorine 
Pipelines (Chlorine Institute, 1982 Pmphlt 60). Further dis¬ 
cussions are given by Danielson (1964) and H.P. Nelson 
(1964). 

The chlorine may be transported either as vapour or as 
liquid. Avapour line should be operated with vapour phase 
only and a liquid line with liquid phase only. The situations 
which might give rise to mixed phase conditions should be 
identified and measures taken to avoid them. 

The Chlorine Institute recommends that for any chlorine 
pipeline the maximum pressure should not exceed 300 psig 
(21 bar). However, this should not be construed as the 
design criterion. It recommends also that the maximum 
temperature at any section of the pipeline should not 
exceed 250°F (121°C). 

The pipeline may be above or below ground. A line above 
ground is easier to monitor for external corrosion but an 
underground line may be safer in some circumstances. If 
the line is buried, consideration should be given to the 
frost line. 

Internal corrosion is very low if the chlorine is dry, but is 
markedly increased by small quantities of water. It is 
essential, therefore, to design the line to facilitate drying 
out, to ensure that thorough drying is carried out and to 
keep the chlorine product dry. 

Liquid chlorine has a very high coefficient of thermal 
expansion and it is necessary, therefore, to protect lines 
against hydrostatic rupture. The Chlorine Institute recom¬ 
mends the use of a pressure relief valve or bursting disc 
discharging to a receiver or safe area or, alternatively, the 
use of an expansion chamber. Nelson states that an expan¬ 
sion chamber should have a capacity of 20% of the line 
volume. If an expansion chamber is used, it should be 
properly operated and maintained, so that air in the cham¬ 
ber is not gradually replaced by chlorine. 

The provision of a means for the control of line breaks is 
particularly important with a chlorine pipeline. Automatic 
shut-off valves may be installed for gas or liquid lines, 
while excess flow valves may be used as an alternative on 
liquid lines. A combination of both devices may be prefer¬ 
able for the liquid case. 
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23.11.9 Pipeline failures 

For Western Europe, the publication Performance of Oil 
Industry Cross-country Pipelines in Western Europe 1991 
(CONCAWE, 1992 4/92), one of a continuing series, gives 
details of pipeline failures. 

In the United States there appears to be no single body 
which regularly publishes information on pipeline failure. 
Pipeline operators are required to report leaks to the DOT. 
The DOT issues an annual report on natural gas pipelines. 
Major pipeline accidents are investigated by the NTSB. 
Both organizations periodically publish information on 
pipeline failures. 

A survey on the Safety of Interstate Natural Gas Pipelines 
by the Federal Power Commission (FPC) (1966) gives 
information on failures in these pipelines in the 15y 2 -year 
period from January 1950 to June 1965. The length of 
transmission pipelines covered was 204,730 miles in 1964. 
The number of failures recorded in the period was 1058 line 
failures, 121 compressor or metering station or other facil¬ 
ities failures, and 1115 field testing failures. Employees 
suffered 35 deaths and 135 injuries, and non-employees 
29 deaths and 87 injuries. Of the 64 deaths, 42 arose from 
failures in lines and 17 from failures in compressor or 
metering stations or other facilities. The causes of the line 
failures are analysed in Table 23.25. The relations between 
the number of failures and of casualties over the 15y 2 -year 
period and the pipe sizes are given in Table 23.26. 

Th t Annual Report on the Administration of the Natural 
Gas Pipelines Safety Act of1968 by the DOT for 1974 states 
that in 1974 there were 335,000 miles of natural gas gath¬ 
ering and transmission pipelines, and that in the period 
1970-74 there were 2093 failures. From these data, the 
failure rate for such pipelines was 1.25 x 10 -3 per mile per 
year. In this period, there were eight fatalities to employees 
and the same number for non-employees. Causes of the 460 
failures in 1974 are broken down as follows: 


Cause 

Proportion 

(%) 

Damage by outside forces 

59.5 

Corrosion 

17.0 

Construction defect or material failure 

17.6 

Other 

5.9 


The annual report on pipeline failures up to 1976 by 
CONCAWE (1977 9/77) states that between 1972 and 1976, 
the combined length of oil industry pipelines increased 
from 15,800 to 18,100 km and that in the period 1972— 76, 
there were 93 spillages. From these data, assuming an 
average of 17,700 km of pipeline over the period, the failure 
rate obtained for such pipelines is 1.05 x 10 _3 /km-year. 
The causes of the 93 failures are categorized in Table 23.27, 
first column. The corresponding report up to 1991 by 
CONCAWE (1992 4/92) states that in 1991 there were some 
21,000 km of pipeline and that in the period 1987—91 there 
were 50 spillages. Assuming an average of 20,000 km of 
pipeline over the period, the failure rate obtained is 
0.5 x 10 _3 /km year. The causes of the 50 failures are cat¬ 
egorized in Table 23.27, second column. 

Further information on gas pipelines operated by the 
British Gas Corporation (BGC) has been given by Knowles, 
Tweedle and van der Post (1977). They state that since 1970, 
all faults on the transmission system have been recorded 


Table 23.25 Failure of interstate natural gas transmission 
pipelines in the USA 1950-65: causes of failure (after 
Federal Power Commission, 1966) 


Pipeline punctured by 

279 

plough, bulldozer, 


excavating shovel, road 


grader or other earth- 


moving equipment 


Corrosion 

193 

External 

148 

Internal 

45 

Weld failures 

190 

Action of the elements 

84 

Coupling failures 

65 

Damage during 

58 

installation 


Fatigue failures 

35 

Defective pipe 

26 

Thermal stress 

21 

External explosion 

14 

Miscellaneous 

38 

Unknown or unreported 

55 

Total 

1058 


Table 23.26 Failure of interstate natural gas transmission 
pipelines in the USA 1950-65: failures by pipe diameter 
(after Federal Power Commission, 1966) 


Pipe 

diameter 

(in.) 

No. of 
failures 
reported 

Failures 
per 1000 

No. of 

casualties 

reported 

0-5.0 

141 

10.6 

4 

5.1-10.0 

324 

11.6 

25 

10.1-15.0 

132 

9.0 

9 

15.1-20.0 

278 

12.0 

43 

20.1-25.0 

97 

5.9 

35 

25.1-30.0 

62 

2.6 

31 

>30.0 

5 

2.8 

11 

Unreported 

19 

- 

9 


and that up to August 1977 there had been 309 repairable 
incidents, of which 73 were defined as ‘lost gas’ incidents. 
The following classification is given: 


Mechanical interference (including coating damage) 204 

Corrosion (internal and external) 32 

Other faults (including faulty seal on pig trap door, 56 

leaking flanges, cathodic protection pad weld 
crack, etc.) 

Girth weld 9 

Pipe defect 5 

Ground movement 3 

Total 309 


The interference incidents are further broken down as 
shown in Table 23.28. The total number of leaks includes 
broken connections and piercing of the carrier pipe, while 
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the number of leaks due to excavating machinery covers 
piercing of the carrier pipe only. 

A failure rate of 5 x lO -3 /mile-year for chlorine pipelines 
was used by Westbrook (1974) in his assessment of the 
hazard of this mode of chlorine transport, as described in 
Chapter 18. 

A study of pipeline failure rates in which the prime con¬ 
cern was with failure of offshore pipelines in the North Sea 
has been described by de la Mare and Andersen (1981). The 
work draws on the data sources already mentioned, that is, 
the DOT for the United States, CONCAWE for Western 
Europe and British Gas for the United Kingdom, and also 
the USCG for the Gulf of Mexico, Gaz de France (GdF) and 
the E&P Forum for the Arabian Gulf.The authors quote the 
following failure rates: CONCAWE, for onshore crude oil 
and product pipelines in Western Europe 1966—76, 


Table 23.27 Failure of oil pipelines in Europe 1972- 76: 
causes of failure (after CONCA WE, 1977 9/77) 


Cause of failure 

1972-76? 

1987—91 b 

Mechanical failure 

Construction 

7 

8 

Material 

14 

7 

Operational error 

System 

2 


Human 

2 

2 

Corrosion 

External 

34 

8 

Internal 

2 

5 

Natural hazard 

Subsidence 

3 

2 

Flooding 

- 

- 

Other 

- 

- 

Third party activity 

Accidental 

24 

13 

Malicious 

- 

2 

Incidental 

5 

3 

Total 

93 

50 


a CONCAWE (1977 9/77). 
b CONCAWE (1992 4/92). 


0.39 x 10 _3 /km-year for crude oil, 1.11 x 10 _3 /km-year for 
products, and overall 0.69 x 10 _3 /km-year; British Gas, for 
its gas transmission network 1970—77, 0.65 x 10 _3 /km- 
year; Gaz de France, for its gas transmission network 
1967-77,3.3 x 10 _3 /km-year; USCG, for offshore pipelines 
(6—18 in.) in the Gulf of Mexico, for oil 17.4 x 10 _3 /km-year 
and for gas 12 x 10 _3 /km-year. The North Sea had recorded 
two failures, giving a failure rate of 0.7 x 10 _3 /km-year, but 
with 95% confidence limits 0.067—2.5. 

The authors conclude that: the failure rates of pipelines 
appear similar even where the fluid handled and the 
environment are different; that the failure rates of oil 
pipelines depend on the diameter; that about half the fail¬ 
ures can be attributed to external factors; and that pipe¬ 
lines tend to exhibit wearout failure. On this latter point, 
they quote CONCAWE data for the times to the first, second 
and later failures, and analyse these data to demonstrate 
that wearout failure occurs. 

Another study of pipeline failure, confined to oil lines, is 
that given by Blything (1984 SRD R326), who considers 
pipeline failures in the United States, Canada and Western 
Europe, using data from the DOTand NTSB, the Canadian 
Petroleum Association (CPA) and CONCAWE, but mainly 
from the latter. Some of their analyses of the CONCAWE 
data for Western Europe are given in Table 23.29. Section A 
of the table gives the number of failures by pipe diameter 
and cause, Section B, the overall frequency of failure by 
pipe diameter and Section C, the size of the defects and 
spills. 

Section A shows that the most important causes of fail¬ 
ure are third party activity (TEA) and external corrosion. 
Both are dependent on the diameter of the pipe. The other 
two causes are less significant and less diameter depen¬ 
dent. External corrosion is also a function of the fluid car¬ 
ried and is most frequent on lines conveying heavy fuel oil 
(HFO). This mode of failure is often by pinhole leaks and 
tends to have a low potential for major hazard. 

Section B of the table shows that the overall failure rate 
of the pipeline decreases with increasing pipe diameter. 

The data on size of defects were somewhat sparse. Some 
21 incidents were found in the data for Western Europe and 
Canada where defect size was recorded. Of these, 15 were 
caused by TPA. The defects were either holes or partial 
penetrations which failed at a later date. For some of 


Table 23.28 Failure of British Gas Corporation gas transmission pipelines 1970- 77: failures by pipe wall thickness (after 
Knowles, Tweedie and van der Post, 1977) 


Wall thickness (in.) 


<0.374 

0.375-0.499 

0.500-0.625 

No. No./lOOO 

No. No./lOOO 

No. No./lOOO 

mile-year 

mile-year 

mile-year 


Total no. of interference 

98 

3.36 

60 

2.96 

34 

1.70 

incidents 

No. of incidents due 

69 

2.36 

33 

1.63 

18 

0.90 

to excavating machinery 
Total no. of leaks 

15 

0.51 

4 

0.19 

2 

0.10 

No. of leaks due to 

5 

0.17 

0 

0 

1 

0.05 

excavating machinery 
Mileage at risk 


3579 


2480 


2439 
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Table 23.29 Failure of oil pipelines in Western Europe 1975-80 (after Blything 1984 SRD R326, from CONCAWE) 

A No. of failures by pipe diameter and cause 

Cause 




Pipeline diameter (mm) 





150- 

-275 300-360 

400- 

-460 500-560 600- 

-700 

>800 All diameters 

External corrosion 

14 

5 

3 

0 0 


0 

22 

Third party 

17 

5 

5 

l a 0 


0 

28 

Mechanical 

3 

0 

1 

4 1 


4 

13 

Natural hazard 

1 

2 

1 

1 2 


0 

7 

All causes 

35 

12 

10 

6 3 


4 

70 

B Overall failure rates by diameter 

Pipeline diameter 


Length 



Frequency of failure 





(km) 



(failures/km-year) 

(mm) 


(in.) 






150-275 


6-10 


4967 



1.2 x 10“ 3 

300-360 


12-14 


2598 



7.7 x 10“ 4 

400-460 


16-18 


3118 



5.3 x 10“ 4 

500-560 


20-22 


2402 



4.2 x 10“ 4 

600-700 


24-30 


2358 



2.1 x KT 4 

>800 


>32 


2757 



2.4 x 10“ 4 

All diameters 







6.3 x 10“ 4 

C Size of defects 11 

Pipeline system 


Cause of failure 


Defect diameter range 

No. of 

Spillage 





(mm) 

incidents 

volume (m 3 ) 

WE oil pipelines, 1978 


Third party activity 


<50 

1 


2.5 





50-100(80) 

2 


58 



Mechanical 


<50 

1 


19 





>100 

1 


2000 

Canadian oil pipelines 


Third party activity 


<50(40) 

3 


50, 28,24 





50-100(76) 

4 


12,48,953,? 





>100(151) 

3 


64,935 


a Failure caused by loss of support due to indirect third party activity. 
b Also some Canadian data. 


these incidents, it was possible to estimate the size of the 
spill. Data for these incidents are given in Section C of 
Table 23.29. Details on each of the 21 incidents are given by 
Blything. 

These two reports give a wealth of further information 
on pipeline failures. As described, the main cause of failure 
in pipelines is interference, or TPA. In particular, damage 
occurs to pipelines from earth-moving and excavating 
equipment. Most pipelines can be punctured by the tooth of 
a mechanical excavator with the possible exception of very 
large mains, which have a thickness of about y 2 in. In rural 
areas, this may arise particularly from ditching and land 
drain work; in urban areas from work on services such as 
water, gas, electricity and sewage. It is essential, therefore, 
for the pipeline operator to keep a close watch on activities 
which may give rise to the hazard and for him to liaise with 
the authorities involved with planning and utilities. 
Moreover, it should be borne in mind that the person who 
needs to know is the excavator operator, and the organiza¬ 
tions concerned should understand their responsibilities to 
ensure this. 


23.12 Marine Transport: Shipping 

Marine transport is distinguished from the other modes 
of transport in a number of ways. These include its 
international nature, which has many aspects; the size of 
the cargoes carried; and the marine environment. 

General accounts of marine transport are given in the 
ACDS Transport Hazards Report (1991), Safer Ships, 
Cleaner Seas (Donaldson, 1994) (the Donaldson Report) and 
The Carriage of Bulk Oil and Chemicals at Sea (Rawson, 
1994), which may be supplemented by the references cited 
below. 


23.12.1 Shipping industry 

Marine safety needs to be viewed against the background 
of the shipping industry and its particular characteristics. 
An account of this background is given by Gilbert (1994). 
Since 1945, international trade has experienced an explo¬ 
sive growth. One consequence has been a massive increase 
in vessel size. Contrary to what might be expected, the 
industry is a Tow entry’ one. As Gilbert states, ‘In boom 
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times, banks and financial institutions have been only too 
willing to lend money to almost anyone who could submit a 
reasonable prospectus’. 

Most ships are custom built. The owner identifies a par¬ 
ticular market. Shipyards are then prepared to tailor the 
design to the owner’s requirements. Ships are built with 
single or double hulls, single or twin screws, and slow or 
medium speed engines, in combination with a wide variety 
of cargo, ballast and fuel systems. This is in marked con¬ 
trast, for example, with the situation pertaining to the 
design of aircraft. 

Another characteristic feature is manning. Crews often 
contain many nationalities, some of whom may have diffi¬ 
culty in communicating with each other. 

Shipping is vulnerable to the international economic 
cycle, so that in bad times large numbers of ships are laid 
up and sections of the industry are barely viable. This 
increases reluctance to incur expenditure on safety. 

The international nature of the industry and the resis¬ 
tance of a large part of it to effective controls has meant that 
international agreements have tended to represent the low¬ 
est common denominator. 

23.12.2 Hazard scenarios 

A marine accident may pose a major threat not only to life 
but also to the environment. 

A loss of containment of a material may occur due to 
damage to the cargo tanks or during loading and unloading 
operations. A serious hazard to life may arise from the 
release of a large quantity of flammable or toxic liquefied 
gas onto water, where it will vaporize rapidly, in or near a 
port. The USCG has commissioned studies of the hazard 
arising in this situation, such as the one by Eisenberg, 
Lynch and Breeding (1975). However, although much feared, 
this hazard has not so far been realized on a large scale. 

Shipboard fire and explosion is another serious hazard 
and one which does occur periodically. The initiating event 
may be a fire in the engine room, the pump room, a cargo 
tank or elsewhere. Or it may be an explosion in the engine 
room or cargo tank. A particular hazard exists if the ship 
carries explosive substances. Some of the most devastating 
explosions have occurred from the explosion of ammonium 
nitrate cargo. 

Loss of cargo also presents a threat to the environment. 
Here oil cargoes present a particular threat, since oil is 
carried in large quantities and is liable to do damage to the 
marine environment which it is difficult to prevent. 

23.12.3 Ship design 

Fundamentals of ship design are described in Principles of 
Naval Architecture (Comstock, 1967), Basic Ship Theory 
(Rawson and Tipper, 1968-), Basic Naval Architecture 
(Barnaby, 1969) and Mechanics of Marine Vehicles (Clayton 
and Bishop, 1982). Liquefied gas carrier (LGC) design is 
described in Liquefied Gas Handling Principles on Ships and 
in Terminals (SIGTTO, 1986/3). Accounts of ship design 
and construction with special reference to hazards are 
given in Incidents Involving Aircraft, Shipping and Railways 
(Home Office, 1985 Manual of Firemanship Bk 4) and in the 
NFPA Handbook. 

A ship is essentially constructed as a box girder formed 
by the hull and the main deck and strengthened by mem¬ 
bers such as the keel, frames, bulkheads and other decks. 

Cargo ships are of two broad types: (1) dry cargo ships 
and (2) bulk cargo ships. The first group is general purpose 


dry cargo ships carrying smaller quantities in packages, 
drums and tank containers, and includes general purpose 
ships, container ships, and roll-on/roll-off (RoRo) passen¬ 
ger (and cargo) ships. The second group is ships for the 
bulk transport of (1) crude oil, (2) petroleum products, 
(3) LNG, (4) LPG and other liquefied gases and (5) chemicals. 

Figure 23.5 illustrates some typical vessel designs. 
Figure 23.5(a) shows a cargo vessel; Figure 23.5(b) an ore/ 
bulk/oil (OBO) carrier; and Figure 23.5(c) a chemical tan¬ 
ker, or tank vessel. An oil tanker is broadly similar to the 
latter in respect of the layout of the holds, but tends to be 
very large. Figures 23.5(d) and (e) show two types of LPG 
carrier, and Figure 23.5(f) shows an LNG carrier. 

Older tank vessels have pump rooms, one forward and 
one aft between the engine room and the last cargo tank. In 
newer vessels the pump rooms are eliminated by the use of 
deep well pumps. 

A gas carrier, for liquefied gases, has cargo tanks which 
may operate at atmospheric pressure or higher pressure. 
Such tanks may be integral with the vessel or indepen¬ 
dent of it. 

Further treatment of ship design is deferred to Section 
23.16, where a description is given of liquefied flammable 
gas (LFG) carriers and chemical tankers. 

An account of the influence of the chemicals carried on 
ship design and operation, as reflected in the provisions of 
the IMO codes, has been given by Farrell (1982). 

23.12.4 Ship operation 

The transport of hazardous materials by ship calls for an 
approach to loss prevention very similar to that required for 
land installations. The management and the systems and 
procedures are crucial. There should be identification and 
assessment of hazards. An effective instrument system, 
with trips where necessary, is required. There needs to be a 
variety of fire protection measures. Operations such as 
loading and unloading should be carried out in accordance 
with specified procedures. There should be an inspection 
system with appropriate record keeping akin to that used 
for pressure systems. The equipment should be well main¬ 
tained and control exercised over modifications. There 
should be a permit-to-work system. Personnel should be 
thoroughly trained in all these aspects. 

Operations of particular relevance here are the loading 
and discharge of cargo and the operations on cargo tanks. 
These are discussed in Sections 23.14-23.17. 

Inspection of tanks is covered in Guidance Manualfor the 
Inspection and Condition Assessment of Tanker Structures 
(ICS, 1986/5), Guidelines on Surveys Required by the 1978 
SOLAS Protocol, the IBC Code and the IGC Code Fire Test 
Procedures (IMO, 1987 IMO-858), Inspection Guidelines for 
Bulk Carriers (OCIMF, 1989/8), Inspection Guidelines for 
Ships Carrying Liquefied Gases in Bulk (OCIMF, 1990/10) 
and Condition Evaluation and Maintenance of Tanker 
Structures ( ICS, 1992/12) 

23.12.5 Particular chemicals 

An important category of substances moved by sea is 
liquefied gases. These are not confined to LNG and LPG or 
even other hydrocarbons, but include a number of other 
major chemicals. 

A gas tanker is often designed to carry not only LPG but 
also ethylene, ammonia and vinyl chloride monomer as 
the principal cargoes, but the list of products may well be 
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more extensive. A cargo list for such a tanker is given by 
Puklavec and Lindenau (1985): 

Ethylene w-Butane, Mixtures of ethylene 

/-butane oxide/propene oxide 

Ethane Butadiene Acetaldehyde 

Propene Butylenes Monoethylamine 

Propane Vinyl chloride Methyl chloride 

monomer 

Ethane/ Isoprene monomer Dimethylamine 

propane 
mixtures 

Anhydrous Propene oxide Diethyl ether 

ammonia 

Other products are carried in general chemical tankers, 
or chemships. 

The Bulk Carrier Code (IMO, 1996 IMO-lOO) has both 
ship type and additional requirements which are a function 
of the chemical carried. 

An important class of chemical in sea transport is 
monomers. Monomers such as vinyl acetate need to be 
inhibited during transport. The effectiveness of inhibition 
depends on the oxygen concentration and problems can 
occur from polymerization due to low oxygen concentra¬ 
tion. An account of inhibitors for vinyl monomers has 
been given by Douglas, von Bramer and Jenkins (1982) and 
of the specific problem of vinyl acetate inhibition by 
D.W Butcher and Sharpe (1983). 

Other accounts of the transport of particular chemicals 
include that of R.W. Macdonald (1977) on chlorine and that 
of Brumshagen (1983) on carbon dioxide. 

23.12.6 Ship movement 

The control of ship movement in restricted waters is 
necessary because the risk of collision or grounding is 
greater and the consequences may often be more serious. 
The arrangements for ship control vary in different coun¬ 
tries, but many of the principal waterways have some form 
of movement control. This may vary from speed restric¬ 
tions and a requirement for pilotage to a full system akin to 
that used in air traffic control. 

There have been a number of studies of ship movement 
and of ship traffic control systems. The USCG has under¬ 
taken a programme of work on this topic. Table 23.30 shows 
typical ship movements in a major waterway as given 
by Sanders and Aldwinckle (1987). An account of ship 
movement at the approaches to Rotterdam has been given in 


a study of ship incident probabilities by Ligthart (1980). 
The speed restrictions required by the Port of London 
Authority as described in the Canvey Reports are discussed 
in Appendix 7. 

The proportion of ‘errant vessels’ in traffic lanes on the 
UK continental shelf has been studied by Technica (1985). 
This report was a follow-up to previous work on ship- 
platform collisions, which showed that the main risk is 
from errant vessels. One of the main points made is that 
errancy is not restricted to particular vessels, crews or 
captains, but may occur at some time in any vessel, 
although the frequency of such periods will vary between 
vessels. The findings were that the proportion of vessels 
which are errant at a given time is about 1.6%, both with 
good visibility and with bad, but that the proportion likely 
to recover from being on an imminent collision course fell 
for vessels of <40,000 DWT from 78% in good visibility 
to 8% in poor visibility and for vessels of >40,000 DWT 
from39% to 4%, respectively. 

23.12.7 Factors enhancing risk 

In recent years, there have been a number of developments 
which have combined to increase the risk of vessel failure. 
An account is given by Gilbert (1994). Among these devel¬ 
opments are the massive increase in the size of vessels. This 
is not just a matter of increase in the hazard. Gilbert states 
‘Many of these cape-size vessels (100,000 to 170,000 DWT) 
have been lost over the last two years due to suspected 
structural failure’. 

Structurally, important factors have been the reduction 
in scantlings, the use of high tensile steels or inferior coat¬ 
ings, increased stress caused by high capacity loading 
systems and poor lay-up provisions. 

Gilbert describes the three main modes of vessel failure: 
fire, collision and grounding. He also draws attention to the 
risk from piracy, which in some regions is not negligible. He 
states ‘In some instances, fully-loaded tankers have been 
left to steam at full speed in enclosed waters with no-one on 
the bridge, because pirates have locked up or otherwise 
restrained the crew’. 

23.13 Marine Transport: Regulatory Controls 

23.13.1 International regulatory controls and codes 

The international marine transport of dangerous goods 
is the concern of the IMO (formerly the International 
Maritime Consultative Organization (IMCO)). This organi¬ 
zation has a fairly complex structure of committees, which 


Table 23.30 Typical ship movements in a major waterway (Sanders and Aldwinckle, 1987) (Courtesy of Gastech) 


Ship size (x 10 3 GRT) 



Ship type 



Oil tanker 

Chemical tanker 

Gas carrier 

Other 

All 

0-1 

42 

0 

9 

1,064 

1,115 

1-2 

22 

153 

21 

1,374 

1,570 

2-4 

74 

62 

28 

1,591 

1,755 

4-6 

130 

48 

64 

2,044 

2,286 

6-15 

316 

65 

227 

8,043 

8,651 

15-30 

702 

33 

165 

4,361 

5,261 

30-80 

2,317 

78 

0 

3,621 

6,016 

80> 

537 

0 

0 

556 

1,093 

Total 

4,140 

439 

514 

22,654 

27,747 
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include the Maritime Safety Committee (MSC) and the 
Marine Environment Protection Committee (MEPC). 

Other interested bodies include the International Cham¬ 
ber of Shipping (ICS), the Oil Companies International 
Marine Forum (OCIMF) and the Society of International 
Gas Tanker and Terminal Operators (SIGTTO), together 
with International Association of Ports and Harbours 
(IAPH), the International Petroleum Industry Environ¬ 
mental Conservation Association (IPIECA) and the Inter¬ 
national Tanker Owners Pollution Federation (ITOPF). 

Accounts of the international controls and codes for the 
marine transport of dangerous goods are given in the 
NFPA Handbook (2003) and by the ACDS (1991). 

Some principal international conventions and con¬ 
ferences include the International Convention for the Pre¬ 
vention of Pollution of the Sea by Oil 1954 (OILPOL), the 
International Conference on Revision of the International 
Regulations for Preventing Collisions at Sea 1972, the 
International Convention of Prevention of Pollution from 
Ships 1973 (MARPOL), the International Convention on 
the Safety of Life at Sea 1974 (SOLAS), the International 
Convention on Training, Certification and Watchkeeping 
for Seafarers 1978 (STCW), and the Convention on the 
International Maritime Organization 1984. 

The resolutions of the periodic SOLAS conferences are a 
continuing source of provisions in the international system 
of control. The SOLAS Convention 1974 contains manda¬ 
tory requirements concerning carrier safety. Chapter VII of 
the Convention deals with dangerous goods. 

Some principal IMO codes include the Code for the Con¬ 
struction and Equipment of Ships Carrying Dangerous 
Chemicals in Bulk (the BCH Code) (IMO, 1993 IMO-772), 
the International Code for the Construction and Equipment 
of Ships Carrying Dangerous Chemicals in Bulk (the 
Bulk Carrier Code, or IBC Code) (IMO, 1996IMO-100) and 
the International Maritime Dangerous Goods Code (the 
IMDG Code) (IMO, 1992IMO-200). 

There are three IMO codes for LGCs: the Code for Exist¬ 
ing Ships Carrying Liquefied Gases in Bulk (IMO, 1976IMO- 
788), the Code for the Construction and Equipment of Ships 
Carrying Liquefied Gases in Bulk (IMO, 1983IMO-782) and 
the International Code for the Construction and Equipment 
of Ships Carrying Liquefied Gases in Bulk (the Gas Carrier 
Code, or IGC Code) (IMO, 1993 IMO-104). The first code 
applies to ships built up to 1976 and the second generally 
applies to ships built after 31 December 1976 and before 
1 July 1986. 

Guidance issued by the ICS and other bodies includes 
Safely in Chemical Tankers (ICS, 1977/1), Safety in Oil 
Tankers (ICS, 1978/2), Safely in Liquefied Gas Tankers (ICS, 
1980/3), Liquefied Gas Handling Principles on Ships and in 
Terminals (SIGTTO, 1986/3), International Safety Guide for 
Oil Tankers and Terminals (ISGOTT) (ICS, 1991/11), the 
Tanker Safety Guide (Chemicals) (ICS, 1971/13) and the 
Tanker Safety Guide (Liquefied Gases) (ICS, 1993/14). 

23.13.2 Paris Memorandum 

The responsibility for enforcement of international agree¬ 
ments on marine safety lies with the state in which the 
vessel is registered (the flag state). Standards are variable 
and, as a secondary measure, the states at whose ports the 
vessel calls (the port states) are empowered to carry out 
inspections and to detain the vessel whilst repairs are done. 
This latter arrangement is governed by the Paris Memo¬ 
randum of Understanding on Port State Control of 1982 (the 


Paris Memorandum, or Paris MOU). An account of this 
system is given in the Donaldson Report (Donaldson, 1994), 
described below, and its operation is reported in the annual 
reports of the Paris Memorandum. 

23.13.3 Classification societies 

In international shipping, an important role is played by 
the classification societies, of which the best known is 
Lloyds of London. An account of the work of Lloyds is given 
by McLean and Cripps (1986). The relationship of Lloyds to 
many of the international organizations mentioned is 
shown in Figure 23.6. 

The classification societies operate a system of classifi¬ 
cation rules, as described below. In addition, the major 
societies are authorized by over 125 administrations to 
apply the requirements of specified IMO conventions and 
to issue certificates of fitness. The Lloyds Register 
requirements for gas ship construction and class main¬ 
tenance are outlined in Figure 23.7. 

23.13.4 Classification rules 

Major sets of rules at Lloyds are the Rules and Regulations 
for the Classification of Ships and the Rules for Ships for 
Liquefied Gases. 

An account of Lloyds’ Classification Rules is given by 
J. Smith (1994). The hull of a ship must be able to withstand 
the forces due to still water and specified wave-induced 
loads. It must possess the local strength to resist buckling, 
fatigue, yielding and brittle fracture. In the Classification 
system, this is achieved by compliance with the Rule mate¬ 
rials requirements, hull arrangements and scantling for¬ 
mulations. The Rules are intended to provide basic proven 
design methods whilst leaving freedom to innovate. They 
prescribe design methods for the ship’s hull and certain 
other features and equipment. The system recognizes the 
principle of ‘equivalence’ and permits an alternative com¬ 
bination of arrangements and scantling, provided that it 
can be demonstrated to be of equal strength. 

23.13.5 UK regulatory controls 

In the United Kingdom, the transport of hazardous ma¬ 
terials by sea is regulated by the Department of Trade 
(DoT) through the Merchant Shipping Act 1965 and suc¬ 
ceeding Merchant Shipping Acts and through a series 
of regulations which include the Merchant Shipping 
(Cargo Ship Construction and Survey) Regulations 1984, 
the Merchant Shipping (Fire Protection) Regulations 1984, 
the Merchant Shipping (Gas Carrier) Regulations 1986, the 
Merchant Shipping (BCH Code) Regulations 1987, the 
Merchant Shipping (IBC Code) Regulations 1987 and 
the Merchant Shipping (Dangerous Goods and Marine 
Pollutants) Regulations 1990. 

The DTp maintains a Standing Advisory Committee, 
which has for some years issued the Recommendations for 
the Carriage of Dangerous Goods in Ships, commonly known 
as the ‘Blue Book’, covering variations from and additions to 
the IMDG Code judged appropriate for the United Kingdom. 
The 1990 edition of the IMDG Code with the 25th set of 
amendments provides comprehensive coverage of matters 
dealt with in the Blue Book, which is now superseded. 

British law has held that the act of sending to sea an 
unseaworthy vessel is a misdemeanour. The Merchant 
Shipping Act 1979 replaced the wording ‘unseaworthy’ by 
‘dangerously unsafe’. The Merchant Shipping Act 1988, 
Section 30, gives powers to prosecute the owner and master 
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Figure 23.6 Relationship of the Lloyds Register classification society with regulatory bodies and the liquefied gas 
shipping community (McLean and Cripps, 1986) (Courtesy of Gastech) 


of unsafe British ships in any port worldwide and of unsafe 
foreign ships in British ports. 

In the United Kingdom, enforcement of the Paris 
Memorandum is the responsibility of the Marine Safety 
Agency (MSA). Accounts of the regulatory framework 
in the United Kingdom are given by Hodges (1994) and 
K. James (1994). 


23.13.6 Seaworthiness 

In British maritime law, an important concept in marine 
safety, as described by Hodges (1994), is that of the 
‘seaworthy’ vessel, legally defined as one which is in ‘a fit 
stateastorepairs, equipments, crewandinallotherrespects, 
to encounter the ordinary perils of the sea’. The definition is 
thus limited to the perils ‘of the sea’ rather than‘on the sea’. 

Aspects of seaworthiness which have been the subject of 
court judgements include: the ship’s suitability to carry its 
cargo, or its cargoworthiness; its design and construction; 
its machinery, equipment and navigational aids; the suffi¬ 
ciency and competence of the crew; the sufficiency and 
quality of the fuel; and the stability and stowage of the cargo. 

The seaworthiness of a ship is a particular aspect of its 
safety. For example, a deficiency in the medical supplies 
would detract from safety, hut would not render the ship 
unseaworthy. 


23.13.7 Donaldson Report 

The Braer disaster in 1993 was the subject of an inquiry 
reported in Safer Ships, Cleaner Seas by Lord Donaldson 
(1994) (the Donaldson Report). The report reaffirms the 
duty of the flag state to enforce controls on the safety 
of vessels registered with it, but states that: There is 
clear evidence that some Flag States are failing in their 
responsibilities... ’. It recommends various measures 
to strengthen the controls exercised by the port states. 


23.13.8 Safety case 

Following the Piper Alpha incident and the Cullen Report, 
the new UK offshore regulatory regime is based on formal 
safety assessment and the safety case. This has led some to 
advocate a similar regime for ships at an international level. 
The question of a regime for ships based on a safety case is 
discussed by J. Smith (1994). 

The critique of a safety case for an individual ship has 
two main aspects, the potential benefits and the practical 
difficulties.With regard to benefits, the question concerns 
the extent to which the design and operation of the ship 
itself involves the type and degree of hazard for which the 
safety case methodology is suitable. The other question is 
the practicality of applying a safety case regime to inter¬ 
national shipping, particularly given the difficulties 
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Figure 23.7 Lloyds Register requirements for liquefied gas ship construction and class maintenance (McLean and 
Cripps, 1986) (Courtesy of Gastech) 


experienced in enforcing even a relatively straightforward 
prescription-based regime. 

There may well be benefits to be had from generic formal 
safety assessment studies. The question of formal safety 
assessment of ports, sea lanes, etc., is another matter and is 
well established. 

23.13.9 US controls 

In the United States, ships trading in US waters have to meet 
the requirements of the USCG.The USCG have responsibility 
for ensuring the safety both of US vessels and US ports. 


The USCG requirements for gas carriers are given in the 
Code of Federal Regulations,Title 46. The requirements for 
new ships are given in Part 154 and those for existing ships 
in Part 38. New ships are essentially those which meet the 
IMO Gas Carrier Code and existing ships are those which 
do not. An account of the USCG controls has been given by 
Rowek and Cook (1986). 

The United States has now taken action to raise the 
standard of ships calling at its own ports. The Oil Pollution 
Act 1990 (OPA) provides that, from the year 2010, all such 
vessels must have double hulls. 
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23.13.10 Pressure for change 

Shipowners are currently subject to a number of pressures 
to enhance the safety of vessels. Some of these are des¬ 
cribed by Rawson (1994). They include: IMO initiatives, 
unilateral legislation such as the OPA 1990 and the 
Paris Memorandum; the requirements of the classifica¬ 
tion societies and of the insurers, which are gradually 
tending to become more stringent; and the growth of liti¬ 
gation. Regulatory controls are thus increasingly being 
reinforced by economic pressures. There is, however, a long 
way to go. 


23.14 Marine Transport: Ports and Harbours 

23.14.1 Regulatory controls and codes 

Ports and harbours are controlled through the Docks Regu¬ 
lations 1988 and dangerous substances are controlled 
through the Dangerous Substances in Harbour Areas Regu¬ 
lations 1987 (OSHA). Guidance is given in HS(R) 21A Guide 
to the Dangerous Substances in Harbour Areas Regulations 
1987 (HSE, 1988) and GS 40 The Loading and Unloading of 
Flammable Liquids and Gases at Harbours and Inland 
Waterways (HSE, 1986). Also applicable are the regulations 
for fixed sites, including the Notification of Installations 
Handling Hazardous Substances Regulations 1982 
(NIHHS), the Control of Industrial Major Accident Hazards 
Regulations 1984 (CIMAH), the Dangerous Substances 
(Notification and Marking of Sites) Regulations 1990 and 
the Planning (Hazardous Substances) Regulations 1992. 

Interested organizations include the International Asso¬ 
ciation of Ports and Harbours (IAPH) and the Independent 
Tank Storage Association (ITSA). 

The OSHA Regulations are divided into 10 parts: 

(1) interpretation and application, (2) entry of dangerous 
substances into harbour areas, (3) marking and navigation 
of vessels, (4) handling dangerous substances, (5) liquid 
dangerous substances in bulk, (6) packaging and labelling, 
(7) emergency plans and untoward incidents, (8) storage 
of dangerous substances, (9) explosives, and (10) mis¬ 
cellaneous and general. 

Some principal regulations of the OSHA Regulations 
are: Regulation 6 on the notice of entry of dangerous sub¬ 
stances; Regulation 7 on harbour masters’ powers of pro¬ 
hibition of dangerous substances, etc.; Regulation 18 on 
precautions against fire and explosion; Regulation 19 on 
the fitness of vessels; Regulation 20 on permission for 
transfer between vessels; Regulation 21 on safety precau¬ 
tions for loading, unloading and transfer; Regulation 26 on 
the preparation of emergency plans by harbour authorities; 
Regulation 27 on emergency arrangements at berths; Reg¬ 
ulation 28 on untoward incidents; Regulation 29 on the 
storage of dangerous substances; Regulation 30 on storage 
tanks; Regulation 31 on the storage of freight containers, 
etc.; Regulation 32 on the parking of road vehicles; Regu¬ 
lation 34 on the need for an explosives licence; Regulation 
37 on the security of explosives; Regulation 41 on deterio¬ 
rated explosives; Regulation 43 on the power of harbour 
authorities to make bylaws; and Regulation 44 on enforce¬ 
ment. Regulation 28 deals both with the action in the event 
of untoward incidents and on reporting of such incidents. 
Regulation 34 defines the cases where there is need for an 
explosives licence; Regulations 37-42 on explosives apply 
irrespective of whether a licence is required. 

HS(R) 27 contains in Appendix 3 guidance on emergency 
plans and in Appendix 4 a checklist of duties under the 


Regulations, covering some 18 categories of person, 
including: the harbour authority, berth owner and berth 
operator; the harbour master; the harbour and the berth 
explosives security officers; the masters of vessels; the 
operators of barges and harbour craft, road tankers, rail 
tank wagons, and storage; consignors; drivers; and 
employers and the self-employed. 

COP 18 expands on some of these requirements, giving 
more details on aspects such as the information to be pro¬ 
vided by incoming tankers, which includes the substances 
carried, the equipment available such as an inert gas sys¬ 
tem, defects on the ship and the expected time of arrival 
(ETA); the control of rail traffic in harbour areas; the 
ship-shore transfer of dangerous liquids; precautions 
against fire and explosion, which include the elimination of 
ignition sources and the provision of firefighting facilities; 
storage tanks for dangerous substances; the handling, stor¬ 
age and security of explosives; the discharge of harmful 
dusts and vapours to the atmosphere; and emergency 
planning, at both harbour and berth level. It contains an 
appendix giving a checklist for ship-shore transfer. 

23.14.2 Port design and operation 

Accounts of the handling of hazardous materials at ports 
have been given by Gebhardt (1980,1989) and by P. Lewis 
(1981). Cargo is handled at a port in four basic modes: 

(1) bulk materials; 

(2) packaged goods; 

(3) containers; 

(4) roll-on/roll-off. 

The characteristics of these modes are discussed by Lewis. 

Some aspects of the design and operation of ports rel¬ 
evant to the handling of hazardous materials include: 

(1) ship traffic control; 

(2) ship-shore transfer; 

(3) emission control; 

(4) hazardous area classification; 

(5) jetty fire protection. 

Control of ship traffic is considered in Section 23.12, 
ship-shore transfer is considered in Section 23.14.3, and 
jetty fire protection is discussed in Section 23.14.4. 

Some emission of flammable gas is unavoidable during 
loading operations. As with land-based plant, it is neces¬ 
sary to consider the dispersion of such gas. Similarly, it is 
necessary to have a hazardous area classification of the 
ship and the jetty. 

23.14.3 Ship-shore transfer 

The loading and discharge of cargo is a hazardous opera¬ 
tion over which strict control needs to be exercised. 
Accounts are given in Liquefied Gas Handling Principles on 
Ships and in Terminals (SIGTTO, 1986/3), Guidelines for 
the Alleviation of Excessive Surge Pressure in ESD (SIGTTO, 
1987/4) (the SIGTTO ESD Surge Pressure Guidelines) and 
Recommendations and Guidelines for Linked ShipfShore 
Emergency Shutdown of Liquefied Gas Cargo Transfer 
(SIGTTO, 1987/5) (the SIGTTO ESD Guidelines) and by 
Gebhardt (1980), Armitage (1983), B. White and Cooke 
(1983), Holdsworth (1985) and Whitmore and Gray (1987). 

Loading arms are covered in Design and Construction 
Specification of Marine Loading Arms (OCIMF, 1987/5). 
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There is also guidance on manifolds (OCIMF, 1987/7 and 
1991/12) and on hoses (OCIMF, 1991/11). 

Accounts of the development of the SIGTTO guidelines 
on ship-shore transfer and emergency shut-down (ESD) are 
given hy Holdsworth (1985) and Whitmore and Gray (1987). 

The transfer of hazardous materials between ship and 
shore during loading and unloading depends on the effec¬ 
tive operation of a number of systems which include: 

(1) mooring system; 

(2) loading arms; 

(3) pumping system; 

(4) pressure relief. 

Some hazards of ship-shore transfer are: 

(1) ship movement; 

(2) leakage; 

(3) overfilling; 

(4) overpressure; 

(5) pressure surge. 

Mooring systems have already been discussed. A good 
mooring is required to ensure that the ship does not break 
away during transfer. It is also desirable that the motion of 
the ship be minimal. 

There are various arrangements for connecting the 
ship’s cargo tanks to the land terminal. Types of loading 
arm in common use include Chiksan loading arms and 
Kvaerner arms. 

In order to prevent leakage, pressure surge, overfilling or 
overpressure of tanks, it is necessary to design for these 
hazards and to establish a suitable link between ship and 
shore which allows orderly shut-down to be carried out. 

There should be a trip system so that shut-off can be 
effected in the event of a serious leak. The operating pump 
should be interlocked to stop if the shut-off valve closes. 

If shut-off is too rapid, pressure surge is liable to occur 
and can be very damaging. The prevention of pressure 
surge in this situation is an important feature of the SIGT¬ 
TO arrangements (SIGTTO, 1987/4 and 5). It has been dis¬ 
cussed by Armitage (1983). 

Measures need also to be taken to avoid overfilling and 
overpressure. Particular consideration should be given to 
the relief arrangements at the receiving end in relation to 
the delivery flow and pressure in order to ensure that over¬ 
pressure does not occur. 

The operating arrangements, discussed by Gebhardt 
(1980), are equally important. The transfer operation 
should be planned. There need to be sufficient personnel 
available on ship and on shore. At each end there should be 
an engineer in charge of the transfer. There should be good 
communication between ship and shore and the principal 
tasks of the transfer operation should be coordinated. 

The SIGTTO ESD Guidelines (SIGTTO, 1987/5) describe 
a standardized link connecting ship and terminal ESD 
systems to communicate and initiate ESD safely and 
rapidly. They give in an appendix a practical example of an 
intrinsically safe ship-shore ESD link system. 

The SIGTTO ESD Surge Pressure Guidelines (SIGTTO, 
1987/4) describe the hazards of surge pressures and give 
sets of guidelines common to ships and terminals and 
others specific to the ship or the terminal. The former cover 

(1) safe transfer rates, (2) valve characteristics and closure 
times, (3) pipeline design pressure and pipeline anchors, (4) 


linked ship and terminal ESD systems, and (5) operational 
factors. The guidelines also include an engineering treat¬ 
ment of surge as applied to loading systems and unloading 
systems and design approaches to alleviate surge pres¬ 
sures, including (1) pump shut-down/diversion of flow and 

(2) surge pressure relief. 

A checklist for ship-shore transfer has been given by 
B. White and Cooke (1983). 

Guidance on ship-ship transfer is given in Ship to Ship 
Transfer Guide (Liquefied Gases) (ICS, 1980/4) and Ship to 
Ship Transfer Guide (Petroleum) (ICS, 1988/7). 

23.14.4 Jetty fire and fire protection 

An account of fire and fire protection at jetties has been 
given by Dicker and Ramsey (1983). The minimization of 
the fire hazard at a jetty depends not only on the specific 
fire protection measures hut also on the general standard of 
design, operation and maintenance. The ship-shore trans¬ 
fer systems are one important feature here. The arrange¬ 
ments for dealing with leaks and spillages are another. 

The objectives of fire protection may be summarized as: 

(1) prevention of fires and explosions; 

(2) extinguishment of small fires; 

(3) control of fires that cannot be extinguished; 

(4) cooling of vulnerable equipment; 

(5) protection to permit escape; 

(6) protection to permit ship /shore access. 

It may not always be possible to extinguish a fire, and in 
such a case, the fire should be controlled, and vulnerable 
equipment such as tanks, loading arms, pipelines and 
manifolds on shore or on ship should be kept cool. 

The resources available on site should be such that an 
effective initial response to the fire can be mounted whilst 
the arrival of the outside fire services is awaited. 

The approach to fire protection at a jetty is broadly 
similar to that on a plant. Basic elements include: 

(1) control of leaks; 

(2) control of ignition sources; 

(3) fire control system; 

(4) means of escape; 

(5) means of access. 

The fire control system includes: 

(1) fire warning system; 

(2) fire detection system; 

(3) fixed firefighting system; 

(4) mobile firefighting system; 

(5) fire water supply system. 

First consideration should be given to avoidance of leaks of 
flammable materials. Potential leak sources should be 
reviewed and appropriate action taken. 

A source of flammables which is peculiar to jetties is 
flammable vapour vented from ship cargo tanks. 

Most of the common sources of ignition may be present at 
a jetty. These include hot work, repair work, vehicles and 
smoking. There are also activities specifically associated 
with shipping which may cause ignition such as use of 
ship’s galley equipment, repair work involving hammering 
or paint chipping, blowing of funnel uptakes or boiler 
tubes, or disconnection of ship-shore cargo pipelines. 
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Control of ignition sources should be based on a hazard¬ 
ous area classification. The Area Classification Code for 
Petroleum Installations by the IP (1990 MCSP Pt 15) gives 
guidance on hazardous area classification for jetties. 

In this connection, Dicker and Ramsey deprecate the use 
of a blanket approach in which flameproof equipment is 
applied without detailed study. They suggest that there is 
benefit to be gained from the source of hazard method which 
gives a better understanding of the potential leak sources. 
These authors also state that it has to be accepted that 
complete elimination of all sources of ignition from hazard¬ 
ous areas is not practicable in all circumstances at jetties. 

It is usual to provide a variety of means for fighting and 
controlling fire. For cargoes of crude oil or flammable 
liquids, the principal firefighting agent used is foam, which 
is applied by foam monitors. Low expansion foam is the 
most suitable for a jetty since it has a reasonable range. 
Fixed foam monitors may be used and may be remotely 
controlled. They may be supplemented with mobile moni¬ 
tors. Foam is usually not recommended for burning liquefied 
gas fires, since the gas tends to penetrate the foam blanket. 

If the fire is on a gas or vapour leak, the preferred course 
of action is to stop the leak. Extinguishing the flame with¬ 
out stopping the leak risks allowing the creation of a flam¬ 
mable vapour cloud which may give a more violent flash fire 
or vapour cloud explosion. 

Water monitors are used to cool exposed items, as already 
described. In the jetty situation, cooling of the gangways 
between the ship and shore is important for escape. 

The capacity of the foam and water systems should 
match the firefighting requirements. For large vessels, 
these can be appreciable. 

Effective fire control depends on coordination between 
shore and ship. One aspect of this is the compatibility 
between the ship and shore fire mains. It is necessary to 
ensure that connection of the ship’s fire water system to that 
on shore does not result in overpressurization. 

Another aspect is the responsibility for fire control in the 
early stages. Since in the event of fire the ship’s crew need to 
attend to other actions, particularly the closure of pipelines 
and actions to prevent fire spread, it may be advantageous 
to control initial firefighting from the shore. 

There should be good ship-shore communications. 
These are particularly important in the jetty situation, not 
only for firefighting but also for assisting escape. Regular 
exercises of the fire control system should be held. 

Accounts available of the fire protection arrangements 
at major terminals include those of the arrangements 
at Rotterdam by Vossenaar (1975), at Wilhelmshaven by 
Hartlich (1977) and at Hamburg by Gebhardt (1980,1989). 

Vossenaar quotes for the port of Rotterdam traffic of 
34,000 ships and 170,000 barges per annum. The area fire 
brigade has some 500 full time firemen who deal, each year, 
with about 5,000 fire and other emergencies. The fire bri¬ 
gade is equipped with high capacity pumps capable of 
delivering 4,0001/min. There are also 14 fire boats, most of 
which have an output of 15,0001/min and carry substantial 
quantities of foam, as well as a fire fort, a converted ferry, 
with a 30 m tower. 

Hartlich gives a detailed account of the construction 
of the Mobil terminal at Wilhelmshaven and of the fire¬ 
fighting arrangements. There are separate fire water sys¬ 
tems which draw on sea water and on the refinery fire water 
supply. The sea water pumps are protected against pack ice 
and freezing. 


The foam supply is estimated to last 60 min, supplying 
2 x 5,000 1/min and 3 x 800 1/min foam monitors. The 
monitors can be operated from the control building and 
also from other auxiliary control points. Use of the refinery 
mobile foam monitors extends the period of foam applica¬ 
tion to some 2 h. 

The foam monitors have a range of 85 m. This is not 
enough to give coverage of the whole deck of a supertanker, 
but such ships have their own systems. 

The foam induction rate is 5%. Devices are used to keep 
the induction rate constant at variable water flows. The 
foam compound is highly viscous and its flow velocity is 
low so that large diameter mains are necessary. These have 
a holdup of some 10,0001 of the compound. 

There are water monitors with an output of 3,0001/min 
for cooling ships’ gangways and hulls. Dry powder systems 
also are provided for fighting fires on platforms and around 
manifolds. 

Two of the jetties at this terminal are on an island. For 
this situation, it is necessary to provide facilities somewhat 
similar to those on an oil platform, such as lifeboats and 
fireproof shelter. 

Somewhat similar arrangements at the Shell terminal at 
Kattwyk at Hamburg-Harburg are described by Gebhardt. 

Evacuation of the ship in the event of a spillage of lique¬ 
fied gas may be assisted by the use of a water curtain to 
reduce the level of thermal radiation to which the crew is 
exposed. A study of such a system has been described by 
S. Stephenson and Coward (1987). 

Two principal scenarios are considered, the first, shown 
in Figure 23.8(a) being for a fire on deck, and the second, 
shown in Figure 23.8(b), for a fire on the sea. The fire con¬ 
sidered in the first case was a pool fire with diameter equal 
to the width of the ship, and sufficient fuel for burning to be 
maintained and evacuation to be necessary, and the second 
case considered was a fire on a continuous spill onto the 
sea. A model for heat transmission through water curtains 
was developed and embodied in the computer program 
PRINCE, as described in Chapter 16. 

The target heat fluxes for the two design basis fires are 
shown in Table 23.31. It is concluded that the water curtain 
considered would reduce the heat flux received by the 
human targets from 16 to 5 kW/m 2 and that this provides a 
significant contribution to safe evacuation. 


23.15 Marine Transport: Shipboard Fire and 
Fire Protection 

An account of fire and explosion on board ships of all kinds 
is given mFireAboardtflusWarodk, 1979).This work lists all 
recorded ship fires between 1800 and 1977 and describes in 
detail many of the principal incidents. It describes the 
general maritime legislation and that pertaining to fire- 
related aspects of ship design and construction. It covers 
fire protection aboard ship, including fire-proofing of 
ships, fire equipment on ships and firefighting on ships, 
and fire protection of ports and offshore structures. 

The fire-proofing of ships is governed by the Merchant 
Shipping (Construction) Rules 1965 and, for cargo ships, 
the Merchant Shipping (Cargo Ship and Survey) Rules 
1965. Rushbrook’s account follows closely the requirements 
of these rules and covers watertight doors, fire resisting 
and fire retarding divisions, fire resisting materials, elec¬ 
trical equipment and installation, oil fuel installations, 
ship structure, and construction aspects such as means of 
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Figure 23.8 Design basis fires for an LNG/LPG carrier (S. Stephenson and Coward, 1987); (a) position of fires on the 
deck; (b) position of a fire on the sea (Courtesy of Gastech) 


Table 23.31 Design basis fires for an LNG/LPG carrier (S. Stephenson and Coward, 1987) (Courtesy of Gastech) 


A Fire on deck 3 

Fire position 

View factor 

Wind velocity 
(m/s) 

Flame tilt 
(°) 

Target heat flux 
(kW/m 2 ) 


A 

0.06 


0 

0 

5 



A 

0.06 


5 

34 

11 



A 

0.06 


10 

46 

12 



B 

0.35 


0 

0 

33 



B 

0.35 


5 

34 

37 



B 

0.35 


10 

46 

44 



B Fire on sea 

Size of 

B 

L 

Spill rate 

D 

View 

Atmospheric 

Target heat 


(m) 

(m) 

(kg/s) 

(m) 

factor 

transmissivity 

flux 

(m 3 ) 







(kW/m 2 ) 

2,500 

13 

80 

10 

9.5 

0.08 

0.95 

8 

2,500 

13 

80 

100 

30 

0.19 

0.95 

18 

2,500 

13 

80 

1,000 

95 

0.24 

0.95 

23 

25,000 

25 

200 

10 

9.5 

0.04 

0.95 

4 

25,000 

25 

200 

100 

30 

0.13 

0.92 

12 

25,000 

25 

200 

1,000 

95 

0.22 

0.90 

20 

25,000 

25 

200 

1,0000 

300 

0.25 

0.90 

22 

125,000 

42 

280 

10 

9.5 

0.02 

0.90 

2 

125,000 

42 

280 

100 

30 

0.08 

0.90 

7 

125,000 

42 

280 

1,000 

95 

0.18 

0.88 

16 

125,000 

42 

280 

1,0000 

300 

0.24 

0.85 

20 

a Flame height/dic 

imeter ratio 

H/D — 3inzi 

ero wind. Atmospheric i 

:onditions: good vi 

sibility,10% humi 

dity. Emissive power of 

fire = 100kW/m 2 . 
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escape and facilities to shut-off forced ventilation. He also 
treats under this heading, fire detection systems and 
sprinkler systems. 

Requirements for firefighting equipment on ships are 
contained in the Merchant Shipping (Fire Appliances) Rules 
1965. Features covered by Rushbrook include: fire pumps 
and pump siting, fire water hydrants, fire hoses and hose 
reels, and portable fire extinguishers; fire fighter’s breathing 
apparatus, including hose reel and trolley compressed air 
apparatus, and high pressure air charging equipment; fire 
smothering arrangements, including inert gas generators, 
funnel gas inerting systems, steam smothering systems 
and high pressure water sprays; fire detection and alarm 
systems; and certain special topics such as foam installa¬ 
tions in mechanical spaces and crankcase monitoring. 

Rushbrook emphasizes the need for training for the 
whole range of tasks required in ship operation. He quotes 
legal cases establishing the employer’s obligation to pro¬ 
vide training. Aspects of fire training mentioned include 
fire patrolling and firefighting, but the issue is much wider 
than this. 

A detailed account of firefighting under different condi¬ 
tions is given by Rushbrook. Situations considered include 
fires in holds, in accommodation space, in refrigerated 
space, in fore and after peaks, and in engine rooms and 
machinery spaces. 

He gives a detailed discussion of the problem of fires in 
holds. In general it is a golden rule of firefighting to hit the 
fire fast and hard, but this is not necessarily the right 
approach to a hold fire. There is a tendency to open up the 
hold too soon. It may often be better to develop a coherent 
plan of attack and make suitable preparations and, if there 
is an inerting system, to activate it and let it do its work. 
There are exceptions, however; immediate action is neces¬ 
sary when the cargo is nitrates, sulfates or explosives. 

If quantities of water are pumped into the ship to fight a 
fire, they may lead to instability. Stability is determined by 
the relation between the ship’s centre of gravity and its 
centre of buoyancy. The centre of gravity is the point at 
which its weight may be taken to act, in the vertical direc¬ 
tion. The centre of buoyancy is the centre of gravity of the 
water displaced. If a vertical line is drawn through the 
centre of gravity of a body floating in a liquid and a second 
vertical line is drawn through the centre of buoyancy when 
the body is slightly displaced from its equilibrium position, 
the two lines meet at a point known as the metacentre. If the 
centre of gravity is below the metacentre, the ship is stable 



Figure 23.9 Effect of the centre of gravity on ship stability: 
B, centre of buoyancy; G, centre of gravity; M, metacentre 


and will right itself, as shown in Figure 23.9(a), hut if the 
centre of gravity is higher, the ship is unstable and tends to 
capsize, as shown in Figure 23.9(b). One solution to the 
problem of instability due to fire water is the use of an 
ejector, but this also has its limitations. 


23.15.1 Cargo tanks 

The problem of flammable cargoes and of the associated 
fire and explosion hazards is discussed in detail in Petro¬ 
leum Tankship Safety (Page and Gardner, 1971). 

Although oil tankers at any rate are now required to have 
inert gas systems to prevent tank fires, an understanding of 
such fires remains important. 

A typical tank system for a petroleum cargo ship is 
shown in Figure 23.10. The tank is designed to operate at a 
pressure of about 1.17 bar (2.5 psig) and can withstand 
about 1.24 bar (3.5 psig). If this latter pressure is exceeded, 
the decks and bulkheads may give way. 

The tank is fitted with an atmospheric vent which has a 
pressure/vacuum (PV) valve for normal operation and a 
bypass for loading. The PV valve is set to maintain the 
pressure within narrow limits, 0.14 bar (2 psi) above atmos¬ 
pheric and 0.035 bar (0.5 psi) below atmospheric. 

During loading, the bypass is used, since the flow of gas 
necessary to equalize pressure is too great for the PV valve 
to handle. At other times, the bypass is kept shut. 

It is important that vapour issuing from the vent during 
loading should not form a hazardous flammable or toxic 
cloud and it is desirable, therefore, for it to leave the vent at 
a velocity sufficient to promote mixing with the air. If 
loading is slow, the vapour may issue slowly and may 
accumulate. This problem may be overcome by fitting a 
minimum efflux velocity valve. 

There may or may not be an inert gas system which is 
used to prevent the occurrence of a flammable mixture in 
the tank. If no such system is provided, there may be a 
flammable atmosphere during certain stages of the trans¬ 
port cycle. The air mixture found in the space depends on 
the volatility of the liquid. 

Assuming that this is a volatile oil, which in this context 
means an oil above its flash point, then if the tank is clean 
and gas free, and contains only air before loading, the 
mixture in the vapour space will go from a too lean to a too 
rich mixture during loading. The diffusion of the vapour is 
slow, however, and a period of hours or even days may 
elapse before the space is saturated. Initially there may be a 



" 
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(a) tendency to roll back; (b) tendency to roll over. 
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tanker 


range of conditions in the tank from a too lean mixture near 
the roof to a too rich mixture in the vapour layer just above 
the liquid. During loaded passage the atmosphere remains 
too rich. The vapour concentration falls again, however, 
during unloading. If the rate of unloading is high, the tur¬ 
bulence of the air entering tends to give a homogeneous 
atmosphere in the vapour space, while if it is too low, there 
may be layering. At the end of unloading, the atmosphere 
may be too lean, flammable, or too rich, depending on the 
volatility of the oil. The same applies if the tank is left 
empty but dirty during passage. 

If the oil is involatile, then in principle a flammable 
mixture does not form, but this may occur if the oil is 
heated to assist pumping so that it rises above its flashpoint 
or if the tank contains traces of a volatile oil. 

The pressure in the tank is maintained close to atmos¬ 
pheric by ejecting air through the vent bypass during 
loading, by the operation of the PV valve during loaded 
passage and by letting air in through the vent bypass dur¬ 
ing unloading. 

In addition to loading and unloading operations, there 
are also those of tank cleaning and gas freeing. Tank 
cleaning is carried out by washing machines. If at all pos¬ 
sible, it should be done with a too lean atmosphere. Gas 
freeing is effected by steaming out or by diluting the 
atmosphere with air drawn through it by extractor fans or 
steam eductors or blown in by windsails. 

It is essential to eliminate all source of ignition. Some 
sources which are particularly relevant are as follows: 


(1) direct heat 

(a) cigarettes, 

(b) welding, 

(c) hot soot; 

(2) mechanical sparks 

(a) metal tools, 

(b) cigarette lighters, 

(c) heavy objects; 

(3) chemical energy 

(a) metal smears, 

(b) spontaneous combustion, 


(c) autoignition, 

(d) pyrophoric iron sulfide; 

(4) electrical equipment; 

(5) static electricity. 

Heavy objects which may produce a spark if they fall inside 
the tank include washing machines and anodes of cathodic 
protection systems. 

Static electricity may arise from several causes. Charge 
separation occurs as the oil flows through the loading pipe. 
It also occurs if the oil is splashed or sprayed or if the tur¬ 
bulence of the oil raises up water droplets which then settle 
through the oil. Charge recombination may then occur due 
to an earthed probe such as a washing machine, the use of 
an ullage tape or the presence of a floating metal object 
such as a tin can or piece of wood with metal bolts. Pre¬ 
cautions include the elimination of earthed probes and 
floating objects and the adoption of suitable ullage meas¬ 
uring arrangements. 

The use of steam for tank cleaning may also involve a 
static electricity hazard, but this is minimized by using 
only fixed apparatus bonded to the ship’s structure, keep¬ 
ing the steam velocity low and eliminating earthed probes. 

Further details of the precautions necessary in loading 
and unloading and in tank cleaning and gas freeing are 
given by Page and Gardner. 

If there is an inert gas system, this may be used to 
maintain an inert atmosphere in the tank. The inert gas 
produced with good combustion practice and after cooling 
and purification has a composition of approximately 3% 
oxygen, 13% carbon dioxide and 84% nitrogen. Under less 
ideal combustion conditions, the gas may contain carbon 
monoxide or more oxygen. 

Prior to loading, the tank is purged with inert gas down 
to an oxygen concentration of about 5%, the purge gases 
being discharged through the purge pipe. During loading, 
the gas displaced by the liquid is discharged through the 
vent bypass. The pressure in the tank during passage is 
maintained by the PV valve. When the liquid is unloaded, 
more inert gas is allowed into the tank to prevent a vacuum 
developing. After unloading, the tank may be cleaned with 
its atmosphere still inerted. 

An inert gas-vapour mixture is rather similar to a too 
rich mixture — it may become flammable if it is diluted with 
air. Situations in which this may happen include venting to 
atmosphere and rupture of the tank. 

The types of explosion which can occur in a tank vary. 
One factor is the volume of flammable mixture. This is a 
maximum when there is no liquid in the tank and a flam¬ 
mable mixture fills the whole space, a situation which may 
occur after loading or during cleaning. Another factor is 
the power of the explosion. If the mixture is close to its 
flammability limits and the flame speed is correspond¬ 
ingly low, the explosion tends to be low powered and 
the pressure rise gradual, so that the tank ruptures and the 
burning gases escape without further pressure rise in the 
tank. 

There are several situations in which a low powered 
explosion may give rise to a more powerful one. The initial 
explosion may overheat adjacent tanks. If the original 
mixture was close to the upper flammability limit, the 
explosion may cause dilution by air to give a more flam¬ 
mable concentration, while if the mixture was close to the 
lower limit, the explosion may vaporize more liquid to yield 
again a more flammable concentration. 
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Usually tanker explosions occur without prior warning, 
but sometimes the possibility of an explosion can be 
assessed from the nature of the flame issuing from the deck 
openings. A yellow-orange flame accompanied by black 
smoke indicates that the tank atmosphere is too rich and the 
flame will not pass back into it. A snapping, blue-red, 
nearly smokeless flame signifies that the tank contains a 
flammable mixture and that the flame may pass back. In 
this latter case, an explosion is imminent and the deck 
should be evacuated immediately. 

A fire on deck does not usually cause a cargo tank to 
explode, provided that the tank is completely closed. 

There is a trend towards the provision on tankers of an 
accommodation ‘citadel’ in which the crew are protected 
against fire in the cargo tanks, the cargo deck area, 
the engine room or the pump room. Measures are taken to 
reduce the risk of fire in the citadel itself. The ventilation 
system of the citadel and of the engine room should he 
such as to minimize the hazard from the entry of noxious 
gases. 


23.15.2 Static electricity 

Static electricity as a cause of ignition of flammable mix¬ 
tures in cargo tanks has already been considered in general 
terms. Detailed studies of the hazard have been carried out 
in support of the chemical industry’s case against compul¬ 
sory inerting. Accounts of this work have been given by 
H.R. Edwards (1983) and by Jones and Bond (1984). 

Edwards describes a series of experiments to determine 
whether the operations of loading, water washing and 
steam cleaning are capable of giving potentials sufficient to 
cause an incendive spark. Five trials were done on four 
vessels. 

The minimum potentials required to produce incendive 
sparks were estimated as follows: for loading, the required 
potential was taken as 20 kV based on work by Rees (1981) 
and by Strawson and Lyle (1975b). For water washing, work 
by van de Weerd (1975) indicates a required potential of 
15 kV, but a value of 10 kV was adopted. The same value of 
10 kV was also taken as the required potential for steam 
cleaning. 

In the loading experiments, the liquid used had a rela¬ 
tively low resistivity and high potentials were not obtained, 
the maximum surface potential being 3.4 kV. Estimates 
were made for other conditions using the method of 
Carruthers and Wigley (1962). It was estimated that the 
maximum surface value for a very high resistivity liquid 
(1 pS/m) would be 16.5 kV. The surface potential is a func¬ 
tion, however, of tank size and this maximum value is 
obtained only with tanks smaller than those normally 
used. With such a liquid there is also the option of limiting 
the charge rate. It is concluded that loading is not likely to 
give rise to the potential required for an incendive spark. 

Experiments on water washing in tanks up to 2500 m 3 
gave a maximum potential of 7.9 kV except for certain 
esters. There are, however, certain features which would 
tend to increase the safety factor. One is that the potential 
was measured in the middle of the earth free volume, but an 
earthed probe is unlikely to exist at this point. Moreover, 
chemical tankers use washing machines which do not pro¬ 
duce large slugs of water and probably in these conditions 
the potential required for an incendive spark exceeds 15 kV 
It is concluded that in water washing also the potential 
required for an incendive spark is unlikely to occur. 


The potential obtained in water washing for ethyl 
acetate, however, was 11.7 kV and that for methyl acrylate 
was also higher. These esters are therefore special cases. 

The steam cleaning experiments gave a maximum 
potential of 18 kV in a 1200 m 3 tank. It is concluded that 
in this case an incendive spark could, in principle, occur. 
However, steam cleaning is used only after water washing 
so that a flammable atmosphere should not be present. 

Further work on this topic is described by Jones and 
Bond, who define a tank centre space potential (TCSP) 
as the criterion to be considered. They develop a model 
to estimate the hazard threshold value of this potential. 
The model does not, however, predict the actual value of 
the potential which will occur in a given situation; this 
must be obtained by other means. They also give infor¬ 
mation on incidents and incident rates for cargo tank fires 
and explosions on chemical tankers, as described below. 

23.15.3 Inert gas systems 

One of the principal means of preventing fire on ships carrying 
flammable materials is the use of inerting. Inerting is treated 
in Inert Gas Systems (IMO, 1990IMO- 860) and by Rushbrook 
(1979), Gebhardt (1980), Berkel (1982), R.K. Roberts (1983), 
Anon. (1984r), Anon. (1984s) and Oellrich (1987). 

An account of the methods available for generating an 
inert gas, usually nitrogen, and of its applications has been 
given by Oellrich (1987), who lists the following methods of 
generation: 

(1) combustion processes; 

(2) catalytic combustion of ammonia; 

(3) pressure swing adsorption; 

(4) permeation processes; 

(5) cryogenerators; 

(6) boiler flue gas. 

These processes differ in various respects, including the 
required oxygen purity, energy consumption, convenient 
plant size and economics. 

Some basic requirements of a nitrogen generation 
process are high purity oxygen, preferably <0.3%, high 
capacity and low space requirements. 

There are several functions for which inert gas may be 
required. They include: 

(1) gas freeing; 

(2) inciting prior to loading; 

(3) purging and padding. 

Gas freeing is the purging of a tank with inert gas prior to 
purging with air for tank inspection. Purging and padding 
is carried out to render the gas space above the cargo in the 
tank inert and to keep it so. 

Inciting is typically used to reduce the oxygen content of 
the space incited to below 5%. 

There are certain problems and hazards associated with 
the use of inciting. These include: 

(1) contamination of cargo; 

(2) overpressure of tank; 

(3) neutralization of inhibitors; 

(4) asphyxiation of crew. 

The use of inert gas such as boiler flue gas may con¬ 
taminate the chemicals carried. The inciting operations 
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may cause overpressure of the tank. Certain inhibitors used 
to prevent polymerization of monomers may be rendered 
ineffective unless there is sufficient oxygen in the atmos¬ 
phere. An example is hydroquinone which is used as an 
inhibitor in vinyl acetate. The large quantities of inert gas 
required present a hazard of asphyxiation to the crew. 

The IMO requirements for inciting are given in Inert Gas 
Systems (IMO, 1990 IMO-860), which covers oil tankers, 
product carriers and combination carriers and also deals 
with chemical tankers. As already described, there are also 
inciting requirements in the IGC Code and the IBC Code. 

The use of inciting is an accepted practice for oil tankers, 
but has been controversial for chemical tankers. For oil 
tankers, the provision of an inert gas system has become 
mandatory. Under SOLAS 1974, it is required for tankers 
>100,000 DWTand under SOLAS 1978 for existing tankers 
>40,000 DWT, and new tankers >20,000 DWT. 

The IMO has also considered a proposal for a require¬ 
ment for chemical tankers, but there are certain problems 
and the proposal has been resisted. The problem has been 
discussed by H.R. Edwards (1983). Difficulties in the use of 
inert gas on chemical tankers are the facts that the most 
common method of inciting, that is, the use of inert gas 
from oil firing, is liable to contaminate the cargo and that 
inhibition of polymerization of monomers is less effective 
due to lack of oxygen. Given these difficulties, the relatively 
low number of incidents and the appreciable costs, it is 
argued that inciting is not justified. 

The work by M.R.O. Jones and Bond (1984, 1985) on 
static electricity and on fires and explosions in chemical 
tankers may be regarded as a contribution to assessing the 
risks from these latter hazards. A study by Lloyd’s Register 
showed that for chemical tankers, the use of inciting would 
lead to only a marginal reduction in the frequency of fire 
but an appreciable increase in the frequency of tank entry 
incidents (Anon., 1984s). 

The IMO requirements for environmental control, or 
control of the atmosphere in the vapour space of the cargo 
tanks, are given in Chapter 9 of the IBC Code. This states 
that vapour spaces ‘may require to have specially controlled 
atmospheres’ and describes four methods, of which inert¬ 
ing is one. 

23.16 Marine Transport: Liquefied Flammable Gas 

23.16.1 Regulatory controls and codes 

The controls and codes for ships carrying hazardous 
materials have already been described. For gas carriers 
transporting LFG, the IGC Code is of particular relevance. 

23.16.2 Hazard scenarios 

Principal hazards from gas carriers are spillage of a large 
quantity of LFG onto water, as a result of grounding, colli¬ 
sion or leak during transfer, and a large fire or explosion on 
the ship, particularly in or near a port. 

23.16.3 Ship design and operation 

The design of LGCs is described in the IGC Code and in 
Liquefied Gas Handling Principles on Ships and inTerminals 
(SIGTTO, 1986/3). As stated earlier, gas carriers are 
designed with cargo tanks integral with the vessel or with 
separate tanks. Plate 29 shows a typical gas carrier, in this 
case one with separate spherical tanks. 

Gas carriers fall into six groups: (1) fully pressurized 
carriers, (2) semi-refrigerated/semi-pressurized carriers, 


(3) semi-pressurized/fully refrigerated carriers, (4) fully 
refrigerated LPG carriers, (5) ethylene carriers and (6) 
LNG carriers. The first three groups are most suitable for 
smaller cargoes and the fourth for larger cargoes of LPG or 
ammonia. 

The principal contents of the IGC Code are shown in 
Table 23.32, Section A, and illustrate many of the most 
important features of gas carriers. 

The code specifies degrees of damage and flooding 
which the ship itself should be designed to survive. 

The Code recognizes five types of cargo containment 
system: (1) independent tanks, (2) membrane tanks, (3) 
semi-membrane tanks, (4) integral tanks and (5) internal 
insulation tanks. Independent tanks are classified as Type 
A, B or C. Type A tanks are basically constructed of plane 
surface. Type B tanks may be constructed of plane surface 


Table 23.32 Principal contents of the IGC Code and 
the IBC Code (International Maritime Organization, 1996 
IMO-782 and 1990IMO-IOO) 


A IGC Code 1996 

Chapter No. 

1 

General 

2 

Ship survival capability and location of cargo 
tanks 

3 

Ship arrangements 

4 

Cargo containment 

5 

Process pressure vessels and liquid, 
vapour and pressure piping systems 

6 

Materials of construction 

7 

Cargo pressure/temperature control 

8 

Cargo tank vent systems 

9 

Environmental control 

10 

Electrical installations 

11 

Fire protection and fire extinction 

12 

Mechanical ventilation in the cargo area 

13 

Instrumentation (gauging, gas detection) 

14 

Personnel protection 

15 

Filling limits for cargo tanks 

16 

Use of cargo as fuel 

17 

Special requirements 

18 

Operating requirements 

19 

Summary of minimum requirements 

B IBC Code 1990 

Chapter No. 

1-4 

Titles essentially as IGC Code 

5 

Cargo transfer 

6-14 

Titles essentially as IGC Code 

15 

Special requirements 

16 

Operational requirements 

16A 

Additional measures for the protection of 
the marine environment 

17 

Summary of minimum requirements 

18 

List of chemicals to which the code does 
not apply 

19 

Requirements for ships engaged in the 
incineration at sea of liquid chemical 
waste 
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or as pressure vessels. For a Type B, tank, the stress analy¬ 
sis is more comprehensive than that for a Type A tank. Type 
C tanks are normally cylindrical or spherical pressure ves¬ 
sels. Figure 23.11(a)-(c) illustrates these three types. 
Figure 23.11(d) and (e) show two principal membrane sys¬ 
tems, those of GazTransport andTechnigaz. 

The Code gives requirements for the pressure system, 
including cargo and process piping, type tests on piping 
components, piping fabrication and jointing details, testing 
of piping, cargo system valves, cargo hoses, cargo transfer 
methodsandvapour return connections.Itrequiresremotely 
operated emergency shut-down valves on each cargo hose 
connection, operable from at least two points on the ship. 

The IGC Code contains a number of requirements for 
materials of construction, specifying a range of steels for 
successively lower minimum design temperatures down to 
-165°C, and for welding and non-destructive testing. 

The Code gives detailed requirements for cargo tank 
venting, both pressure relief and vacuum relief, including 
settings and capacities. The pressure relief valve capacity 
should be able to handle the maximum capacity of the cargo 
tank inciting system or the fire exposure, whichever is the 
greater. There is also a requirement for an additional pres¬ 
sure relieving system for liquid level control. The Code 
gives the formulae for valve sizing. 

Under the heading of environmental control, the code 
contains requirements for the gas freeing of cargo tanks, 
including for flammable gases the use of inert gas. There 
are also requirements for environmental control in the hold 
spaces for cargo containment systems other than Type C 
independent tanks and for the spaces surrounding tanks of 
this latter type. 

In respect of fire protection, ships carrying products 
which are flammable or toxic are required by the IGC Code 
to have a water spray system for cooling, fire prevention and 
crew protection, and those carrying flammables are 
required to have dry powder systems. The Code specifies 
the areas and features to be protected by each system and 
gives equipment capacities and application rates. 

Matters covered under the special requirements of the 
Code are: (1) materials of construction; (2) independent 
tanks; (3) refrigeration systems; (4) deck cargo piping; (5) 
exclusion of air from vapour spaces; (6) moisture control; 
(7) inhibition; (8) permanently installed toxic gas detectors; 
(9) flame screens on vent outlets; (10) the maximum allow¬ 
able quantity of cargo per tank; (11) submerged electric 
cargo pumps; and (12) various chemicals, including chlo¬ 
rine, ammonia, ethylene oxide, propylene oxide/ethylene 
oxide mixtures and vinyl chloride. 

The code gives a tabular summary of minimum require¬ 
ments, covering (1) product name, (2) United Nations (UN) 
number, (3) ship type, (4) independent Type C tank, (5) 
control of vapour space in cargo tanks, (6) vapour detec¬ 
tion, (7) gauging, and (8) special requirements. 

One of the principal liquefied gases carried is LNG. Some 
features of LNG carrier design include (1) cargo tank design, 

(2) cargo protection, (3) cargo tank cooling, (4) cargo tank 
insulation, (5) boil-off, (6) reliquefaction and (7) propulsion. 

For LNG carriers, there are three principal cargo tank 
designs in use. These are the Gaz Transport (GT) mem¬ 
brane, the Technigaz (TGZ) membrane and the Moss 
Rosenberg spherical tank. The three types have been 
described by Bouckaert and Cappoen (1984). An account of 
the GTdesign has been given by Jean and Bourgeois (1985) 
and of the Technigaz design by Ogawa etal. (1986). 


Protection of the cargo tanks against grounding and colli¬ 
sion is an important aspect of the tank design. Designs based 
on independent tanks have obvious advantages here, 
but membrane design has also given good protection in 
practice. 

Since the LNG carried is very cold, it is necessary to 
ensure that its loading does not create a hazard due to 
thermal shock. The empty tanks may be sprayed with LNG 
before loading to cool them down or the tanks may be kept 
permanently cool. In the GTsystem, the solution adopted is 
the use of invar as the membrane material. 

There must also be good thermal insulation. There are a 
number of different insulation systems in use. Accounts are 
given by Bouckaert and Cappoen (1984) and Bo ckenhauer 
(1987). The effectiveness of the insulation is such that the 
boil-off rate achieved is very low. The boil-off may be used 
as fuel for the ship’s boilers. Alternatively, a reliquefaction 
system may be provided. 

There is a trend towards the use of diesel engines as the 
propulsion system. Accounts have been given by Engesser 
et al. (1987), Grone and Pedersen (1987) and Terashima et al. 
(1987). 

LPG carriers are often designed as flexible carriers able 
to handle not only LPG but also other liquefied gases. A 
typical cargo list for such carriers was given in Section 
23.12. The design of flexible semi-refrigerated carriers has 
been described by Faridany and Ffooks (1983) and by 
Backhaus and Olschlager (1985), the first being for an LPG 
carrier with multi-lobe tanks and the second an ethylene 
carrier with tri-lobe tanks. 

With respect to operation, Chapter 18 of the IGC Code 
treats the following topics: (1) cargo information, (2) com¬ 
patibility, (3) personnel training, (4) entry into spaces, (5) 
low temperature cargoes, (6) protective equipment, (7) 
systems and controls, and (8) cargo transfer. 

23.16.4 Terminal design and operation 

A terminal for LFG is either an export or an import termi¬ 
nal and normally handles mainly either LPG or LNG. Some 
principal LFG terminals are listed in Table 23.33. 

An account of LPG terminals in Europe has been given 
by de Sola (1985). Some principal export terminals 
are those at Sullom Voe (Shetlands), Flotta (Orkneys), 
St Fergus-Mossmorran, Grangemouth, Teesside (UK) and 
at Kaarstoe (Norway). Some principal import terminals are 
those at Canvey and Killingholme (UK), Rotterdam, Ter- 
neuzen and Flushing (Netherlands), Antwerp (Belgium) 
and Lavera (France). 

The LPG terminal at Mossmorran has been described by 
Sellers, Luck and Pantony (1985). An account of the LNG 
terminal at Arzew, Algeria, has been given by Benazzouz 
and Abbou (1987). The authors give a description of the 
first 20 years of operation of the site. This includes a 
detailed listing of the principal failures and associated 
down-time. 

Terminals differ depending on whether they are import 
or export terminals. An account of the differences for LNG 
has been given by R.A. Cox, Comer et al. (1980). The main 
elements of an import terminal are 


(1) berth for LNG ships and handling facilities; 

(2) LNG storage tanks; 

(3) pressure control system for tanks; 

(4) gas separation and dispatch system. 
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Water ballast 



(a) 



Figure 23.11 continued 
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No secondary 
barrier required 




Figure 23.11 Liquefied gas carrier cargo containment systems (Society of International Gas Tanker and Terminal 
Operators, 1986/6; reproduced by permission): (a) Type A prismatic self-supporting tank for fully refrigerated gas; (b) Type 
B spherical self-supporting tank; (c) Type C tank for semi-pressurized/fully refrigerated gas; (d) Gaz Transport membrane 
containment system for LNG; (e) Technigaz membrane barrier and insulation system for LNG 
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Figure 23. 11 continued 
Table 23.33 Some LFG terminals 


A LNG 


Location 

Reference(s) 

Antwerp, Belgium 

Arzew, Algeria 

Convey, UK 

Cove Point 

Fos-sur-Mer, France 

Kenai, Alaska 

Memphis 

Montoir-de-Bretagne, France 
Skikda, Algeria: 

Floating terminal 

Offshore terminal 

McKinney and Oerlemans (1985) 

Filstead (1965); Pierot (1968); Rerolle (1968); Laur (1970); Bourguet (1972); Seurat, 
Hostache and Gros (1978); Benazzouz and Abbou (1987) 

C. Gibson (1973); Jenkins, Frieseman and Prew (1974); Ploum (1977) 

Ward and Hildrew (1968a-b); Eke, Graham and Malyn (1974) 

Erne, Kime etal. (1980) 

Asselineau etal. (1972); Leray, Petit and Paradowski (1986a,b) 

Horn etal. (1974) 

Stanfill (1968) 

Colonna, Lecomte and Caudron (1986) 

Dolle and Gilbourne (1976); Khenat and Hasni (1977) 

Anspach, Baseler and Glasfeld (1979) 

Rust and Gratton (1980) 

B LPG 

Location 

Reference(s) 

Port Bonython, Australia 
Offshore terminal 

Craker, Scott and Dutton (1986); Chauvin and Bonjour (1985) 

Branchereau and Bonjour (1986) 

C NGL 

Location 

Reference 

Mossmorran 

Sellers, Luck and Pantony (1985) 


The main elements of an export terminal are 

(1) gas liquefaction and fractionation units; 

(2) LPG storage facilities; 

(3) LNG storage tanks; 

(4) berth for LNG ships and handling facilities; 
and sometimes 

(5) slugcatcher. 

These differences affect the hazards of the terminal. 


23.17 Marine Transport: Chemicals 

23.17.1 Regulatory controls and codes 

The controls and codes for ships carrying hazardous 
materials have already been described. For chemical tan¬ 
kers, the IBC Code is of particular relevance. 


23.17.2 Hazard scenarios 

Chemical tankers tend to present different hazards from 
those of gas carriers. These hazards include those of a 
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runaway reaction, an explosion, a toxic release and severe 
pollution. 

23.17.3 Ship design and operation 

It is convenient at this point to consider chemical tankers, 
or tank ships, which increasingly have come to share 
common features with gas carriers. Thus, as shown in 
Table 23.32, Section B, the headings of the IBC Code are 
very similar to those of the ICG Code. 

Cargo containment systems are of four types: (1) inde¬ 
pendent tank, (2) integral tank, (3) gravity tank, and (4) 
pressure tank. 

The cargo tank vent system is either an open vent or a 
controlled venting system using pressure/vacuum valves. 
The code gives requirements on the type of system for each 
product. 

The IBC Code recognizes four types of environmental 
control system: inerting, padding, drying and ventila¬ 
tion. It gives requirements on the type of system for each 
product. 

Matters covered under the special requirements of the 
Code include requirements concerning (1) acids, (2) toxic 
products, (3) inhibited cargoes, (4) high vapour pressure 
cargoes, (5) cargoes with a wide flammable range and 
low ignition temperature and (6) cargo contamina¬ 
tion, together with requirements for a number of specific 
chemicals. 

The Code gives a tabular summary of minimum 
requirements covering (1) product name, (2) UN number, 
(3) pollution category, (4) hazards, (5) ship type, (6) tank 
type, (7) tank vents, (8) tank environmental control, 
(9) electrical equipment, (10) gauging, (11) vapour detec¬ 
tion, (12) fire protection, (13) materials of construction, 
(14) respiratory and eye protection and (15) special 
requirements. 

With respect to operation, chapter 16 of the IBC Code 
treats the following topics: (1) tank filling, (2) cargo infor¬ 
mation, (3) personnel training, (4) opening of and entry into 
tanks, (5) stowage of cargo samples and (6) cargoes not to be 
exposed to excessive heat. 

There are an appreciable number of chemicals to which 
the code does not apply, and these are listed in it. 


23.18 Marine Transport Environment 

23.18.1 Shipping 

Information on the number of ships is available through 
Lloyds Register. The world fleet of oil tankers, chemical 
tankers and LGCs as given by Lloyds for 1986, quoted by 
Sanders and Aldwinckle (1987), is Further information on 
LGCs is given in Section 23.16. 


Ship type 

No. of ships 

Deadweight 

tonnage 

(xl0 6 te) 

Oil tanker 

5,985 

240.2 

Oil/chemical tanker 

502 

7.3 

Chemical tanker 

861 

6.1 

Gas carrier 

770 

10.1 

Total 

8,133 

263.7 

World fleet 

75,266 

647.6 


23.18.2 Marine incidents 

Lloyds Register also provides information on shipping 
incident statistics. Other sources of information are the 
Interim Report of the Tanker Safety Group (Tanker Safety 
Group, 1977) and Analysis of Serious Casualties to Sea- 
GoingTankers 1968-80 by the IMO. 

Table 23.34 gives data from the Tanker Safety Group 
report. The accident rates are similar for all classes of ship. 
There is no evidence that very large ships, particularly very 
large crude carriers (VLCCs) are more liable to accidents. 
The yearly figures showno discernible trend with time. 

For chemical tankers, information on fires and explo¬ 
sions has been given by M.R.O. Jones and Bond (1984), as 
shown in Table 23.35, which gives the number of fires and 
explosions, the size of vessel involved, the operation 
involved in each case and the source of ignition. 

23.18.3 Substandard vessels 

A study of the relation between the standards of ship 
design and operation and the probability of a ship accident 
has been reported in Substandard Tankers (van Poelgeest, 
1978). In a comparison between 37 tankers owned by a 
Greek tanker operator and 37 oil company-owned tankers 
for the year 1973, this author found that whereas the latter 
ships were involved in some 10 incidents, mostly relatively 
minor, with a loss of 10 vessel-days, 28 of the former were 
involved in accidents, in many cases sustaining serious 
damage, and some in more than one incident, with a loss of 
1072 vessel-days. The total of substandard tankers in the 
world tanker fleet of vessels of 6000 GRT and larger is 
estimated by van Poelgeest as approximately 450 vessels or 
13-15% of the fleet. 

Further information on substandard vessels is available 
in the 1993 Annual Report of the Paris Memorandum (1993). 
This gives statistics on the number of vessels, the number 
delayed/detained following inspection and the major cat¬ 
egories of deficiency. In 1993, there were 17,294 inspections 
covering 112,523 ships, with 43,071 deficiencies and 926 
detentions. The average proportion of vessels detained is 
about 8%, with some 10 states having at least double this 
proportion. The proportions for France, Germany, the UK 
and the USA are 4%, 3%, 2% and 0%, respectively. The 
proportion of the total delays/detentions attributable to 
different types of vessel includes 1.3 % for gas carriers, 5.3 % 
for chemical carriers and 10.7% for tanker/combination 
carriers, the proportions of each of these types detained 
being 6%, 8% and 7%, respectively. The breakdown of the 
major categories of deficiency is: life-saving appliances, 
24.3%; firefighting appliances, 16.8%; general safety, 
12.9%; navigational equipment, 11.6%; ship’s certificates, 

5.2 %; MARPOL requirements, 4.7%; and other, 24.6% .The 
report refers to the ‘increasingly ageing world fleet operat¬ 
ing in a marginal market’. 

23.18.4 Shipping: LPG 

There is a large trade worldwide in LFGs. Accounts of this 
trade are given mLNGLogby SIGTTO (1986) and byAprea 
(1983), Bouckaert and Cappoen (1984) and Glass (1987). 

LNG Log contains statistical information on individual 
LNG carriers and terminals; on cargo containment sys¬ 
tems; and on carrier movements, or voyages. In 1986, there 
were 963 movements of LNG carriers. 

Further data on the number of LNG and LPG carriers 
are provided by Aprea (1983), Blything and Edmondson 
(1983), Bouckaert and Cappoen (1984) and Aldwinckle and 
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Table 23.34 Serious casualties to and cargo fires/explosions on tankers carrying oil and chemicals during the period 
1968-75 (Tanker Safety Group, 1977) (Courtesy of Trade and Industry) 

A Serious casualties 3 

Year 



Tanker size (dwt) 





10,000 to <150,000 



>150,000 


No. of 

No. of 

Serious 

No. of 

No. of Serious 


ships 

serious 

casualty rate per 

ships 


ous casualty rate per 



casualties tanker 


casualties tanker 




per year 



per year 

1968 

2,927 

79 

0.0270 

16 

0 

- 

1969 

2,934 

72 

0.0245 

57 

4 

0.0702 

1970 

2,928 

57 

0.0194 

121 

3 

0.0248 

1971 

2,956 

56 

0.0189 

198 

8 

0.0404 

1972 

2,950 

67 

0.0227 

267 

7 

0.0262 

1973 

2,930 

63 

0.0215 

351 

2 

0.0570 

1974 

2,988 

64 

0.0214 

455 

5 

0.0110 

1975 

2,971 

78 

0.0263 

582 

10 

0.0172 

Total 

23,584 

536 

0.0227 

2047 

39 

0.019 

B Fires 

Year 



Tanker size (dwt) 





10,000 tc 

i <150,000 



>150,000 


No. of cargo 


Cargo fire (explosion rate 

No. of cargo 


Cargo fire (explosion rate 


fires (explosions 

per tanker per year 

fires (explosions 

per tanker per year 

1968 

13 


0.0044 

0 


- 

1969 

9 


0.0031 

3 


0.00526 

1970 

9 


0.0031 

0 



1971 

7 


0.0024 

1 


0.0051 

1972 

19 


0.0064 

2 


0.0075 

1973 

9 


0.0031 

2 


0.0057 

1974 

10 


0.0033 

0 


- 

1975 

5 


0.0017 

0 


- 

Total 

81 


0.0034 

8 


0.0039 


a Serious casualties are those involving loss of life, structural damage or pollution. 


McLean (1985). Tables 23.36 and 23.37 give data on the 
world LNG and LPG fleets, respectively. 

The number of LNG carriers (c. 1984) is given in Table 
23.36, Section B, as 81. Avessel capacity of 125,000 m 3 has 
become the standard size for a modern LNG carrier. For 
LPG carriers, the number (c. 1984) given in Table 23.37, 
Section B is 708. Of these, 213 were >5000 m 3 capacity. 

Only a proportion of the LPG fleet consists of 
refrigerated carriers, the rest being pressure carriers. 
Holdsworth (1985) states that a figure of 107 ships repre¬ 
sents 44% of world capacity in refrigerated LPG ships, 
which suggests a world fleet of some 243 vessels. 

The approximate worldwide deep sea movements per 
year of LFGs other than LNG and LPG are given by Glass 
(1987) as 370 for ethylene, 290 for propylene and 520 for 
butadiene. 

23.18.5 Marine incidents: LPG 

Incident statistics for LNG carriers are given by R.A. Cox, 
Comer et al. (1980) and Aldwinckle and McLean (1985), 
while Blything and Edmonson (1983) give data on fires and 


explosions. For LPG carriers, data on incident statistics are 
given by Aldwinckle and McLean (1985) and data on fire 
and explosion are given by Blything and Edmondson 
(1983). 

Table 23.38 gives incident data for the world LNG and LPG 
fleets and, for comparison, for the world cargo fleet. These 
include incidents involving fire and explosion as well as 
grounding and collision. Further data on LNG carrier inci¬ 
dents is given inTable 23.39, which again provides informa¬ 
tion both on grounding and collision and on fire and 
explosion. Data on LPG carrier fire and explosion are shown 
inTable 23.40 and data an stranding and collision are given 
in Table 23.41. For the world LGC fleet, which includes 
both LNG and LPG carriers, data are given inTable 23.42. 

These overall data on incidents and incident rates may be 
supplemented by data for specific waterways and ports. 
Incident data for the port of Rotterdam have been given by 
Ligthart. Figure 23.12 gives information on collision and 
stranding determined for this port. 

For the Thames estuary, accident data are given in the 
two Convey Reports as described in Appendix 7. 
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Table 23.35 Fire and explosions on chemical tankers in 
the period 1973-83 (after M.P.O. Jones and Bond, 1984) 


A Number of incidents 


Location 

No. incidents 

Cargo tank 

14 

Pump room 

9 

Engine room 

34 

Other 

11 

Total 

68 

B Cargo tank incidents: vessel size 

Vessel size 
(DWT) 

No. incidents 

<1,000 

7 

1,000-9,999 

2 

10,000-19,999 

2 

>20,000 

3 

Total 

14 

C Cargo tank incidents: operations involved 

Operation 

No. incidents 

Loading 

2 

Steaming out tank 

2 

Water washing with rubber hose 
and wooden nozzle 

1 

Inspection/cleaning by persons inside tank 

3 

Handling of slops 

3 

Polymerization of product 

1 

Overpressurization of tank with nitrogen 

1 

‘While being pushed by a tug’ 

1 

Total 

14 

D Cargo tank incidents: source of ignition 

Ignition source 

No. incidents 

Static electricity (attributed or probable) 

5 

Frictional spark 


Light bulb 

2 

Flare stack 

2 

Unknown 

2 

No ignition 3 

2 

Total 

14 


a 0f these two incidents classed as fire/explosion, one was a case 
where the tank was overpressurized by nitrogen, and the other was a 
case where polymerization of acrylic acid occurred, causing a high 
temperature but no fire or explosion. 


Table 23.36 World LNG fleet 

A Blything and Edmondson (1983) 

Date: 1981 

Ship capacity (m 3 ) 

No. of ships 

<5000 

7 

>5000 

64 

Total 

71 


B Aldwinckle and McLean (1985): No. of ships 


Ship capacity Ship age (year) 


(m) 

0-4 5-9 10-14 

15-19 20- 

-24 Total 

<5,000 

1 1 8 

1 

11 

5,000-9,999 

1 


1 

10,000-29,999 

1 1 

1 2 

5 

30,000-49,999 

2 5 

1 

8 

50,000-69,999 

1 


1 

70,000-99,999 

3 6 

2 

11 

100,000-129,999 

10 26 


36 

>130,000 

7 1 


8 

Total 

19 34 21 

5 2 

81 


Minorsky presented a model of collision damage based 
on the equations for conservation of energy and momen¬ 
tum. These are respectively 


\mpi{ — |{*»i + m 2 ) V 2 + E 




Wm 


vim 

mi + m 2 


[23.18.2] 


where E is the energy absorbed in the collision, m 1 is the 
effective mass of the striking ship, m 2 is the effective mass 
of the struck ship, V\ is the speed of the striking ship before 
collision and V is the residual speed of the two ships after 
the collision. 

Minorsky took the effective mass of the struck ship as 
the actual mass plus the added hydrodynamic mass 8m, 
which he estimated as 0.4 m 2 . 

He defined a resistance factor R T as 


R t = J2 PnL^n + Y ^4 [23.18.3] 


23.18.6 Ship collision 

Two principal ship accident modes which may give rise to 
large loss of containment are collision and grounding. Both 
have been the subject of study. Studies of collision include 
those of Minorsky (1959), Kinkead (1978 SRD R91, 1980), 
Bockenhauer (1980) and F.S. Harris (1986). 

The requirements for collision resistance are given by 
Harris as stability after collision, avoidance of spillage and 
energy absorption by the structure. 


where L is the length of damage, P is the depth of damage 
and t is the thickness, and the subscripts Aland n refer to 
the Mh member in the striking ship and the wth member in 
the struck ship. 

From ship collision data, he obtained an empirical cor¬ 
relation between E and Rt, as illustrated in Figure 23.13. 
The relation may be expressed in the form: 

E = mR-r + c [23.18.4] 

where c and m are constants. 
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Table 23.37 World LPG fleet 


A Blything and Edmondson (1983) Date: 1981 

Ship capacity (m 3 ) No. of ships 


<5,000 

>5,000 

Total 


409 

159 

568 


B Aldwinckle and McLean (1985): No. of ships 


Ship capacity (m 3 ) 




Ship age (year) 




0-4 

5-9 

10-14 

15-19 

20-24 

25-29 

>30 

Total 

Unknown 

6 

3 

1 




2 

12 

<5,000 

93 

97 

92 

121 

49 

18 

13 

483 

5,000-9,999 

30 

17 

4 

7 

1 



59 

10,000-29,999 

14 

17 

7 

20 

5 


2 

65 

30,000-49,999 

3 

2 

3 

3 

1 

1 


13 

50,000-69,999 

5 

8 

9 

1 




23 

70,000-99,999 

14 

27 

8 

1 




50 

100,000-129,999 


1 

2 





3 

Total 

165 

172 

126 

153 

56 

19 

17 

708 


Minorsky also defined an absorbed energy coefficient K 
and a ratio R of mass of the striking and struck ships: 


K =* 


«2 + 8m 
mi + m 2 + 8m 


[23.18.5] 


R = mi /m 2 [23.18.6] 

Figure 23.14 shows the relation given by Minorksy between 
the two parameters. As R —> 0, K —> 1, and as R —> 0, K —> 0. 
The relationship is not very sensitive to the value of dm. 
Using this model, Minorsky was able to determine the cri¬ 
tical impact speed of the striking ship required to cause a 
given degree of damage. 

The following treatment by Bockenhauer (1980) for 
collision damage to a gas carrier is typical of analyses 
based on the Minorsky method. From Equations 23.18.1 
and 23.18.2 


_ W1W2 ^2 
2(mi + m 2 ) 1 


[23.18.7] 


Then at the critical impact speed v CI of the striking ship and 
at the corresponding critical energy absorption E CI 


Ec r» 


mim 2 

2(mi + mz) a 


[23.18.8] 


_ / 2fi cr (mi + w 2 ) y 

“ V mm 2 J 


[23.18.9] 


The critical energy absorption E CT is given either as the 
sum of the energy absorptions of the striking ship E 2 , and 


of the struck ship E 2 : 

E C[ =E 1 +E i [23.18.10a] 


.E'er ~ 2 Ei [23.18.10*] 

whichever is the lesser. The energy absorption E 2 is 
obtained from the resistance factor using an expression 
similar to Equation 23.18.3 but with a different definition of 
the resistance factor. 

If the struck ship is moored at a jetty so that the residual 
speed Vis zero 

\miv[=E [23.18.11] 



where E f is the energy absorption of the fender. This is 
taken as 

Ek < 0.3 [23.18.13] 

Some critical impact speeds where the struck ship is an 
LNG or LPG carrier as obtained by Bockenhauer are given 
in Table 23.43. 

Kinkead (1978 SRD R91) has studied the collision of 
LNG carriers using a method based on that of Minorsky 
but extended by a more detailed analysis of the energy 
absorbed in the processes causing damage, which he calls 
the substantiation analysis. 

Figure 23.15 shows Minorsky-type curves obtained in 
this work. The dotted line is based on the more detailed 
substantiation analysis. Its principal feature is that it 
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Table 23.38 World LNG, LPG and cargo fleet incident frequency (incidents/IOOO ship-years) (after Aldwinckle and 
McLean, 1985) (Courtesy of Gastech) 

Casualty type a 




Ship type 


LNG 

carriers 

LPG 

carriers 

Total gas 
carriers 

Dry cargo 
ships 

Collision 

A 

0 

0.36 

0.32 

0.82 


B 

0 

1.08 

0.95 

5.82 


C 

0 

1.43 

1.27 

6.64 


D 

0 

0 

0 

2.97 

Contact 

A 

0 

0 

0 

0.21 


B 

0 

0.36 

0.32 

1.88 


C 

0 

0.36 

0.32 

2.08 


D 

0 

0 

0 

0.23 

Fire/explosion 

A 

0 

0.72 

0.63 

1.82 


B 

0 

3.58 

3.16 

3.37 


C 

0 

4.30 

3.79 

5.20 


D 

0 

2.87 

2.53 

4.98 

Foundering 

A 

0 

1.43 

1.26 

2.61 


B 

0 

0.36 

0.32 

0.33 


C 

0 

1.79 

1.58 

2.94 


D 

0 

0 

0 

8.35 

Hull/machinery damage 

A 

0 

0 

0 

0.29 


B 

2.65 

9.32 

8.52 

8.08 


C 

2.65 

9.32 

8.52 

8.36 


D 

0 

0 

0 

0.27 

Miscellaneous 

A 

0 

0 

0 

0.02 


B 

0 

0 

0 

0.22 


C 

0 

0 

0 

0.25 


D 

0 

0 

0 

0 

Missing 

A 

0 

0 

0 

0.15 


B 

0 

0 

0 

0.01 


C 

0 

0 

0 

0.16 


D 

0 

0 

0 

3.73 

War loss/hostility 

A 

0 

0 

0 

0.25 


B 

0 

0 

0 

0.62 


C 

0 

0 

0 

0.88 


D 

0 

0 

0 

1.03 

Wrecked/stranded 

A 

0 

1.79 

1.58 

2.81 


B 

10.59 

2.51 

3.47 

7.38 


C 

10.59 

4.30 

5.05 

10.19 


D 

0 

0 

0 

1.20 

Total 

A 

0 

4.30 

3.79 

8.98 


B 

13.24 

17.20 

16.73 

2771 


C 

13.24 

21.50 

20.52 

36.69 


D 

0 

2.87 

2.53 

22.76 

a A, No. of reported losses; B, No. of r 

eported serit 

jus casualties; C = A + B; D, No. 

of people 1 

dlled or missing. All per 

1000 ship-years. 


indicates that for striking ships in the displacement 
range 15,000-30,000 ton, the critical impact speed is con¬ 
siderably less than the simpler analysis suggests. 

Kinkead also gives a set of curves for the critical impact 
speed of the striking ship hitting an LNG carrier under 
different conditions, as shown in Figure 23.16. 

23.18.7 Ship grounding 

Of at least equal importance are ship groundings. Here 
there are two somewhat different scenarios which need to 
be considered. One is where the ship is moving at speed and 
its bottom is torn by a rock. Treatments of this situation 
have been given by Kitamura, Okumoto and Shibue (1978) 


and by Vaughan (1978). It has been shown by Poudret et al. 
(1981) that Vaughan’s approach fits well such a grounding 
incident which occurred with the El Paso Paul Kayser, as 
described below. 

The other scenario is grounding of the ship at low speed 
as a result of weather, currents, loss of control, etc. This is 
probably the situation which is most likely to occur in con¬ 
fined waterways. It has been studied by Johnsen and Jensen 
(1983) for the case of smooth rocks and by Kinkead (1983 
SRD R 342,1983) for that of sharp rocks. 

The ships considered by Kinkead are LPG carriers in the 
capacity range 11,754-58,950 m 3 . Grounding may occur 
with the ship moving forwards or sideways. For the ridged 
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World LNG carrier fleet incidents 


A General incidents (R.A. Cox, Comer et at., 1980) — Period: 1964—77 


Incident frequency (incidents/1000 movements) 




LNG traffic 

UK port survey 




Open sea port 

Estuarial port 

Grounding, stranding, 

3 

0.45 

0.17 

0.16 

drifting 

Collision, impact, 

4 

0.6 

1.22 

0.17 

ramming 

Leaks from tanks or 

6 

0.9 



during transfer 

Other 

6 

0.9 

- 

- 

B Fire and explosions (Blything and Edmondson, 1983) Period: 1971 81 

Ship capacity (m 3 ) 


No. of 


No. of 



ship-years 


incidents 

<100,000 


305 


2 

>100,000 


145 


2 

Total 


450 


4 


Table 23.40 World LPG carrier fire and explosions (after Blything and Edmondson, 1983) (Courtesy of the Institution of 
Chemical Engineers) 


A Incidents per year 


Ship capacity (m 3 ) 

No. of 


No. of ship-years 

Incident frequency 


incidents 



(incidents/ship -year) 

<5000 a 

14 


1850 

7.6 x 10“ 3 


>5000 b 

8 


662 

1.2 x 10“ 2 


B Incidents per voyage 

Ship capacity 
(m 3 ) 

No. of 


No. of voyages 

Incident frequency 

incidents 



(incidents/voyage) 

<5000 a 

14 


14,854 

8.4 x 10“ 4 


>5000 b 

18 


6,259 

2.9 x 10“ 3 


C Ship area and marine location 

Ship area 

Ship capacity 
(nr) 


No. of incidents 




At sec 

i In port or restricted waters Total 

Engine room 

<5000 

4 

2 

1 

► 18 


>5000 

9 

3 

J 


Cargo pumps/ 

<5000 

- 

2 

1 

► 4 

compressors 

>5000 

- 

2 

J 


Cabins/galley 

<5000 

2 


1 

► 3 


>5000 

- 

1 

J 


Other 

<5000 

- 

- 

1 



>5000 

- 

1 

J 


Unknown 

<5000 

>5000 

2 

2 

1 

1 

► 6 


a Over period 1977—81. 
b Over period 1971-81. 
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Table23.41 World LPG carrier groundings and collisions 1977-81 (after Blything and Edmondson, 1983) (Courtesy of 
the Institution of Chemical Engineers) 

Incident type 

Ship capacity (m 3 ) 

No. of 
incidents 

No. of 
ship-years 

Incident frequency 
(incidents/ship-year) 

Stranding 

<5000 

13 

1850 

7.0 x 10“ 3 


>5000 

18 

662 

27 x 10“ 3 

Collision 

<5000 

48 

1850 

2.6 x 10“ 2 


>5000 

25 

662 

3.8 x 1CT 2 


Table 23.42 

World LGC carrier incidents (after Aldwinckle and McLean, 1985) (Courtesy of Gastech) 



Cause of 
damage 







Ship aret 






No. of 

1 

2 

3 

4 

5 

6 

7 8 9 

10 11 12 

13 

14 

15 

All 

Collision 

8 





17 

6 

1 2 

3 



37 

15 

Grounding 

Pounding 

Ice 



1 


27 

1 


4 

1 

7 


41 

3 

Cargo shift 
Excess pressure 

2 

2 

10 

8 


6 



3 


3 

35 

8 

Vibration 

Cargo handling 







3 

4 

7 



11 

1 

4 

Wear and tear 

7 

1 

5 

5 

61 

24 

8 

4 

6 

10 

6 

4 

135 

3 

23 

Other 

Contact 

2 

5 

2 


13 

32 


6 

5 

1 

2 

3 

67 

2 

21 

Sloshing 

Heavy weather 
Fire 

6 

12 

12 

10 

23 

12 

6 

3 

3 

1 

2 

3 

97 

20 

Flooding 

Unknown 

14 

6 

29 

16 

76 

70 

9 

16 

32 

34 

18 

320 

42 

All 

39 

26 

39 

59 

204 

162 

31 

1 47 

62 

55 

37 

762 

48 

No. of ships 

17 

16 

21 

13 

33 

35 

13 

1 20 

21 

22 

20 


48 

Proportion of 

5.1 

3.4 

7.7 

5.1 

26.8 

21.3 

4.1 

0.1 6.2 

8.1 

7.2 

4.9 

100 


all areas (%) 
Incidence (per 

0.64 

0.42 

0.96 

0.64 

3.33 

2.65 

0.51 

0.02 0.77 

1.01 

0.90 

0.60 

12.45 


100 months) 















a 1, Fore end structure; 2, forecastle and deck; 3, transverse bulkheads (in way of cargo space); 4, longitudinal bulkheads (in way of cargo space); 5, 
bottom structure (in way of cargo space); 6, side structure (in way of cargo space); 7, deck structure (upper); 8, deck structure (tween); 9, weather 
deck hatchways and covers; 10, tween deck hatchways and covers; 11, bridge/deck houses and decks (excluding poop and forecastle); 12, engine 


rock formation considered, he obtains using a Minorsky- 
type analysis for a 15,495 nr carrier for forward grounding, 
a critical grounding velocity of 5.57 knot and for a 31,296 
m 3 carrier one of 5.11 knot. The sideways critical grounding 
velocities for these two vessels obtained from Minorksy 
analysis are 3.82 and 3.23 knot, respectively. However, 
using a more detailed analysis the latter two values reduce 
to 2.69 and 2.86 knot, respectively. The analysis contains 
some conservative assumptions. One is that the rock is not 
friable, another that no energy is absorbed by other rock 
projections. 

Kinkead states that imperfectly controlled manoeuvres 
during berthing of supply vessels at offshore platforms 
have occurred with sideways collision impact velocities of 
between 2.9 and 4.0 knot (between 1.5 and 2.0 m/s). Thus, 
the impact velocities which occur under imperfect control 


are of the same order as the estimated critical grounding 
velocities. 

23.18.8 Piracy 

A quite different kind of risk is that posed by piracy. The 
activities of pirates are monitored by the regional piracy 
centre of the International Maritime Bureau in Kuala 
Lumpur. Most attacks have occurred in the South China 
Sea, off Hong Kong and around Indonesia, and also off 
Somalia. In 1994, 60 vessels were boarded by pirates, 
almost twice as many as in the previous year. In several 
cases, ships were taken over and sailed to a port, where 
the cargo was unloaded and stolen. Most of the ships 
attacked were dry cargo vessels, but eleven oil tankers, 
four gas carriers and two chemical tankers were also 
involved. 
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vessels 5000 20 000 
Vessel size (T) 

(b) 

Figure 23.12 (a) Collision ratio and (b) stranding ratio per 
tonnage class for vessels entering and leaving Rotterdam. 
T, gross registered ton (- 100 fr) (Ligthart, 1980) 
(Courtesy of Elsevier Science Publishers) 


23.19 Air Transport 

Regulatory control of the carriage of hazardous materials 
by air has traditionally been the concern of the Restricted 
Articles Board of the International Air IATA. The IATA 
Restricted Articles Regulations have placed restrictions on 
the type and quantity of chemicals which are carried and 
specify requirements for packaging and labelling. These 
regulations are binding on IATA member airlines and are 
applied by many which are not members. They are also 
generally accepted by governments, who apply them to all 
aircraft registered with them. 

In 1983, the International Civil Aviation Organization 
(ICAO) issued its Technical Instructions for the SafeTransport 
of Dangerous Goods byAir(theTechnicalInstructions).These 
introduced into air transport the UN system for the classifi¬ 
cation and packaging of dangerous goods. These Technical 
Instructions have largely superseded the IATA regulations. 

In Britain, the Air Navigation (Dangerous Goods) Regu¬ 
lations 1985, and subsequent amending regulations, require 


dangerous goods to be carried in accordance with the 
Technical Instructions. The enforcing authority is the CA A. 

The IATA continues to publish its Dangerous Goods 
Regulations. These are broadly compatible with the Techni¬ 
cal Instructions and continue to be used by many operators. 

The Technical Instructions give specific instructions for 
the packaging and set maximum quantities for carriage. 

There are some substances the carriage of which is for¬ 
bidden. These forbidden substances fall into three cate¬ 
gories: (1) forbidden unless authorized by the state of 
origin; (2) forbidden unless authorized by all the states 
concerned; (3) forbidden in all circumstances. In the United 
Kingdom, requests for exemptions must come from the air 
operator and any exemption is issued to him. 

The quantities of hazardous materials moved by air are 
quite large. In general, the quantities permitted for carriage 
are larger for cargo than for passenger aircraft. There has 
been, however, a steady decline in the proportion of cargo 
aircraft, so that increasingly carriage is in passenger aircraft. 

The carriage of radioactive substances is governed by 
the IATA Regulations on Radioactive Materials, which 
embody the International Atomic Energy Agency (IAEA) 
Regulations on the SafeTransport of Radioactive Materials. 

In general, the carriage of hazardous materials does not 
appear to be a significant cause of, or aggravating feature 
in, aircraft accidents. However, improperly packed and 
loaded nitric acid was declared the probable cause of a 
cargo jet crash at Boston, MA, in 1973, in which three 
crewmen died (Chementator, 1975 Mar. 17, 20). 

Information on aircraft accidents in the United States is 
given in the NTSB Annual report 1984. In 1984, for sched¬ 
uled airline flights, the total and fatal accident rates 
were 0.164 and 0.014 accidents per 10 5 h flown, respectively. 
For general aviation, that is, all other civil flying, the cor¬ 
responding figures were very much higher at 9.82 and 1.73. 

23.19.1 Rotorcraft 

There is increasing use made of rotorcraft - helicopters 
and gyroplanes. Although these are used to transport 
people rather than hazardous materials, it is convenient to 
consider them here. 

An account of accidents is given in Review of Rotorcraft 
Accidents 1977-1979 by the NTSB (1981). In 64% of cases 
(573 out of 889), pilot error was cited as a cause or related 
factor. Weather was a factor in 17% of accidents. The main 
cause of the difference in accident rates between fixed wing 
aircraft and rotorcraft was the higher rate of mechanical 
failure in rotorcraft accidents. 

The NTSB Annual report 1981 gives for rotorcraft an 
accident rate of 11.3 and a fatal accident rate of 1.5 per 
100,000 h flown. 


23.20 Transport Emergency Planning and 
Spill Control 

23.20.1 Emergency planning 

The transport of hazardous materials requires emergency 
planning, but the nature of the emergency plans depends on 
the mode of transport. Road transport is covered by the 
CHEMSAFE scheme. Accounts of emergency planning for 
transport include those in HS(R) 27 and in the ACDS Trans¬ 
port Report (Cooney, 1991) and those by Bosman (1980), 
Cumberland (1982) and Cooney (1985).The topic is discussed 
in Chapter 24 and treatment here is limited to two aspects not 
dealt with there: marine emergencies and spill control. 
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Figure 23.13 Minorsky model of ship collision: empirical correlation between resistance to penetration and energy 
absorbed in collision (Minorsky, 1959) (Courtesy of the Journal of Ship Research) 



0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 

Absorbed energy coefficient, K 


Figure 23.14 Minorsky model of ship collision: effect of added virtual mass of water on energy absorbed in collision 
(Minorsky, 1959) (Courtesy of the Journal of Ship Research) 
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Table 23.43 Estimated critical impact speeds for ship 
collisiorf for gas carriers (after Bockenhauer, 1980) 
(Courtesy of Gastech) 


Critical impact speed (knot) 

Struck 

Sister LPG carrier Dry cargo 

Oil 

ship 

ship (6000 m 3 ) 

ship 

tanker 

LPG carrier: 




6000 m 3 

2.6 (2.0) 

2.3 (1.5) 

45(1.1) 
3.5 (1.8) b 

54,000 m 3 
LNG carrier: 

1.9 (1.5) 3.4 (3.2) 

2.8 (2.5) 

1.3 (0.9)° 

125,000 m 3 , 

3.7 (2.8) 5.0 (4.8) 

4.0 (3.8) 

40(2.5) 

membrane 
125,000 m 3 , 

5.9(45) 9.0 (8.6) 

6.5 (6.1) 

48(3.0) 

spheres 





a Values in brackets are for struck ship moored at jetty. 
b Oil tanker fully loaded. 
c Oil tanker in ballast. 


23.20.2 Marine emergencies 

The CIMAH Regulations 1984 contain a requirement for 
emergency planning for the fixed site to which they are 
applicable, which may include a port area. The DSH A Regu¬ 
lations 1987, Regulations 26 and 27, require ports handling 
hazardous substances to undertake emergency planning. 
HS(R) 27 gives in Appendix 3 detailed guidance for emer¬ 
gency planning in ports. 

IMO guidance is contained in Emergency Procedures for 
Ships Carrying Dangerous Goods (IMO, 1991 IMO-254) 
(EmS). Other guidance is given in Liquefied Gas Handling 
Principles on Ships and in Terminals (SIGTTO, 1986/3), 
Guide to Contingency Planning for the Gas Carrier Alongside 
and within Port Limits (ICS, 1987/6), Contingency Planning 
and Crew Response Guidefor Gas Carrier Damage at Sea and 
in Port Approaches (ICS, 1989/8), Guide to Contingency Plan¬ 
ning for Marine Terminals Handling Liquefied Gases in Bulk 
(ICS, 1989/9) and Guidelines for the Preparation of Ship¬ 
board Oil Spill Contingency Plans (OCIMF, 1990/9). 

Emergency shut-down of ship-shore transfer is covered 
in Guidelines for the Alleviation of Excessive Surge Pressure 
in BSD (SIGTTO, 1987/4) and Recommendations and 
Guidelines for Linked Ship/Shore Emergency Shutdown of 
Liquefied Gas Cargo Transfer (SIGTTO, 1987/5). 

Firefighting is covered in Cargo Firefighting on Liquefied 
Gas Carriers (SIGTTO, 1986/2) and Guide on Marine 
Terminal Fire Protection and Emergency Evacuation 
(OCIMF, 1987/6). 

Marine spill control is covered in Guidelines for the Pre¬ 
paration of Shipboard Oil Spill Contingency Plans (OCIMF, 
1990/9). 


23.20.3 Spill control 

There are a number of basic techniques for spill control, but 
there are also some measures which are specific to the mode 
of transport. 

Accounts of spill control are given in Highly Hazardous 
Materials Spills and Emergency Planning (Zadic and 
Himmelman, 1978) and Hazards Materials Spills Handbook 
(G.F. Bennett, Feates and Wilder, 1982) and by R.L. Mitchell 
(1971,1982), R.H. Hiltz (1982), Scholz (1982), H.M. Freeman 
(1984) and Deckert (1986) 


The ease of detection of a spill varies with the mode of 
transport. The driver of a road tanker will generally know 
at once. A spill on a rail tank wagon may not be appreciated 
immediately. A leak from a pipeline may remain undetected 
for a considerable time. 

The general principles of spill control in the field are 
described by Scholz (1982). The spill may be a continuing 
escape or a complete spillage of the whole contents. In the 
former case, the first step is the termination, or at least 
reduction, of the discharge. 

The measures which can be taken to effect this depend 
on the circumstances. If the leak is below the liquid level, it 
may be reduced by changing the orientation of the tank so 
that it is vapour rather than liquid which comes out; often, 
however, this is not practical. 

If the source of the leak is a valve, measures may be taken 
to shut it off. If the leak is from a puncture of the tank itself, 
it may be possible to plug it. The liquid in the leaking tank 
may be transferred to another vehicle, either as the prime 
method of terminating the discharge or after that has been 
done by some other method. Resort has also been had to 
dumping the liquid in a pit and then ‘neutralizing’ it. 

It may be possible to plug the leak by bolting on a patch 
plate. There are also special plugging devices such as the 
foam plugger developed by the EPA. 

Following any measures to effect (1) termination of 
discharge, the other measures for spill control are (2) con¬ 
tainment, (3) suppression of evaporation, (4) removal and 
(5) disposal. 

Whether the spill is a virtually instantaneous release of 
the whole tank contents or a more gradual leak, the liquid 
will form a pool on the ground. Priorities are to prevent the 
liquid entering drains and sewers, and water courses, and 
to limit the size of the pool formed. 

Depending both on the nature of the material spilled and 
the population exposed, there may be a need to reduce the 
rate of evaporation of the liquid pool. General methods of 
doing this are described below, but they may or may not be 
practical in a given case. 

Methods of removal include pumping and use of sorbents. 
The pumps used must be able to handle the liquid with which 
they are presented, which will include not that originally 
spilled but any added to control evaporation with, possibly, 
earth and other solid matter. Sorbents include straw and 
synthetic sorbents. The material recovered is transferred to 
temporary storage and then passes to disposal. 

Spill control measures which are available in principle 
may be impractical in many transport situations, because 
they require additional equipment or materials, or for some 
other reason. Accounts are available of measures actually 
used in the field, including those of R.L. Mitchell (1982) and 
Scholz (1982). 


23.20.4 Spill control: evaporation 

As just described, it may be necessary for highly hazard¬ 
ous materials to take measures to reduce the rate of eva¬ 
poration. An account of methods available to do this is 
given by R.H. Hiltz (1982). They include the use of (1) liquid 
phase modification, (2) surface cooling, (3) mechanical 
covers, (4) films and foams and (5) sorbents. 

For some liquids, the rate of evaporation maybe reduced by 
modifying the liquid phase in some way. Some basic princi¬ 
ples are dilution with water, reaction with another chemical 
and turning the liquid into a gel by use of a gelling agent. 
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Speed of striking ship (knots) 

Figure 23.15 Kinkead model of ship collision: comparison with Minorsky model for the case of a methane carrier 
stationary in mid-channel (Kinkead, 1978 SRD R391) (Courtesy of the UKAEA Safety and Reliability Directorate) 


Dilution with water can be effective in some cases, pro¬ 
vided the spilled liquid is miscible with water and the pool 
is sufficiently well confined that addition of water does not 
cause it to spread. 

There is available a Universal Gelling Agent which for a 
number of substances has been shown to be effective in 
forming a gel. These substances include water, gasoline and 
sulfuric acid. An account of this work is given by Pilie etal. 
(1975) and Baier et al. (1975/76) and the list of substances is 
quoted by R.H. Hiltz (1982). Hiltz states that although the 
formation of a gel may reduce the rate of evaporation, its 
value lies primarily in effecting immobilization of the spill. 
Further, the usefulness of the technique may be limited by 
the time taken for the gel to form. Few gels form within 
minutes and some take hours. 

The vapour pressure of the liquid, and hence the eva¬ 
poration, may be reduced by cooling the liquid surface, 
using ice, dry ice or liquid carbon dioxide. To be effective, 
this method requires good mixing of the coolant and the 

One form of mechanical covers is cloth covers. Another is 
particulate covers such as small plastic spheres or the like. 
Sprays based on materials such as urethane are also some¬ 
times classed as mechanical covers. 

Films provide essentially a two-dimensional cover and 
foams a three-dimensional one. Surfactant films act partly 
by film resistance and partly by quiescence. They may be 
applied as a spray or in the form of a foam which rapidly 
collapses. There is a wide variety of foams and a good deal 


of work has been done to assess their suitability for the 
control of the evaporation of particular chemicals. 
Accounts include those of Baier et al. (1975), R.H. Hiltz 
and Friel (1976), Gross (1978), Norman and Dowell (1978), 
R.H. Hiltz (1982,1987) and R.H. Hiltz and Brugger (1989). 
A matrix of foam suitability is given by R.H. Hiltz (1982). 
This shows high expansion surfactant foam as the best 
formulation for many of the substances listed, including 
gasoline, LNG, chlorine and ammonia. 

Sorbents are used both to reduce evaporation and to 
remove spilled liquid. With regard to the former function, 
the sorbent needs to be continuously replenished. If it is 
simply allowed to become saturated, it may be ineffective in 
reducing, and, by increasing the surface area, may even 
promote vaporization. 

23.20.5 Spill control: road transport 

The control of a spill from a road tanker illustrates many of 
the basic principles of spill control. An account of the con¬ 
trol of chlorine spills has been given by R.L. Mitchell (1982), 
with particular reference to the work in the United States of 
the Chlorine Institute. 

The methods which he describes include: shutting off 
leaking valves; plugging or patching of punctures; trans¬ 
ferring the load; and dumping the load into a pit and then 
neutralizing it. 

A large proportion of cases involve leaking valves. 
The handling of a spill situation is greatly facilitated 
if the valves and manways are standardized. As Mitchell 











TRANSPORT 23/73 


describes, for the carriage of chlorine in the United States, 
standardization of these items has been achieved for both 
rail tank cars and tank trucks. The Chlorine Institute has 
developed a number of emergency kits which include the 
equipment to assist in valve shut-off. 

Some measures may be taken immediately by the tanker 
driver such as notifying the incident, clearing the area and, 
if possible, creating temporary diking to divert or contain 
the liquid spill. Others such as load transfer or dumping 
and neutralization require additional equipment and/or 
materials and need to be undertaken by a trained team. 

23.20.6 Spill control: pipelines 

For pipelines spill control is treated in Methods of Preven¬ 
tion, Detection and Control of Spillages in West European 
Oil Pipelines (CONCAWE, 1987 1/87) and spill clean-up 
in Revised Inland Oil Spill Clean-up Manual (CONCAWE, 
19817/81). 

CONCAWE 1/87 deals with causes of spillage, which are 
essentially: mechanical failure, operational failure, corro¬ 
sion, natural hazards and TPA; prevention by design, con¬ 
struction and operation; detection by visual observation 
monitoring of pipeline parameters; control by operational 
measures; and emergency procedures. 

Pipeline parameters which may provide an indication of 
a leak, and which may be monitored for this purpose, 
include pressure and flow. A leak may be detected by a fall 
in pressure or flow, or an excursion of the volume balance. 
Other methods of detection are based on negative pressure 
waves and on ultrasonic noise. Pipeline leak detection is 
discussed further in Chapter 19. 

Emergency procedures for dealing with a pipeline 
spill include: notification of the leak; actions to reduce or 
stop the flow; location of the leak point; and measures to 
stop the hole. 

Spill clean-up is treated in CONCAWE 7/81 under the 
headings of (1) behaviour of oil spills, (2) identification of 
contaminated zones, (3) clean-up strategy, (4) clean-up 
methods for oil on ground surfaces, (5) clean-up methods 
for subsoil, (6) clean-up methods for ground waters, 
(7) clean-up methods for surface waters, (8) clean-up meth¬ 
ods in ice and snow, (9) integrated clean-up methods and 
(10) emergency kits for inland oil spills. 

23.21 Transport Case Histories 

23.21.1 Packaging and labelling 

Misidentification of chemicals can have very serious con¬ 
sequences. This was highlighted by the Firemaster tragedy 
in Michigan in 1973, which has been described in Bitter 
Harvest, The Poisoning of Michigan (Egginton, 1980) and by 
Getty, Rickert and Trapp (1977), Kay (1977) and Selikoff 
(1979). A consignment of Firemaster, a fire-retardant che¬ 
mical (polybrominated biphenyl, PBB), was dispatched 
from the Michigan Chemical Company instead of an animal 
feed additive which had a rather similar name. The con¬ 
sequences were a serious contamination of food eaten by 
animals and humans throughout much of the state. Cattle 
showed severe symptoms of poisoning. Somewhat similar 
symptoms were also found among residents of the state. 

23.21.2 Road transport 

Some principal incidents in the road transport of hazardous 
materials are shown in Table 23.44. Many of these incidents 
are described in Chapters 16-18 on fire, explosion and toxic 
release or are given in the case histories in Appendix 1. 


In particular, attention is drawn to: the incidents at Deer 
Lake in 1959 (Case History A27) and Eagle Pass, Texas, in 
1975 (Case History A76) involving BLEVEs and/or fire¬ 
balls; those at Berlin, New York, in 1962 (Case History A30), 
at Lynchburg, Virginia, in 1972 (Case History A59) and at 
St Amand-les-Eaux, France, in 1973 (Case History A66), 
involving vapour cloud explosions; and those at Lievin, 
France, in 1968 and Houston, Texas, in 1976 (Case History 
A84), involving toxic releases. 

On 14 July 1978, a road tanker carrying propylene rup¬ 
tured near a camp site at San Carlos de la Rapita, Spain, and 
there was a flash fire which resulted in an eventual death 
toll of some 210 people (Appendix 16). 

23.21.3 Rail transport 

Some principal incidents in the rail transport of hazardous 
materials are shown in Table 23.45. Many of these incidents 
are described in Chapters 16-18 on fire, explosion and toxic 
release or are given in the case histories in Appendix 1. 

In particular, attention is drawn to: the incidents at Cres¬ 
cent City, Illinois, in 1970 (Case History A50), Kingman, 
Arizona, in 1973 (Case History A63), Belt, Montana in 1976 
and Waverly,Tennessee in 1978 (Case History A93), involving 
BLEVEs and/or fireballs; those at East St Louis, Illinois in 
1972 (Case HistoryA57) and at Decatur, Illinois, in 1974 (Case 
History A71), involving vapour cloud explosions; those at La 
Barre, Louisiana in 1961 (Case HistoryA29) and at Cornwall, 
Ontario, in 1962, at Crete, Nebraska in 1969 and at Youngs¬ 
town, Florida in 1978 (Case History A94), involving toxic 
releases; and that at Glendora, Mississippi in 1969 (Case 
History A43), involving a major evacuation. 

On 10 November 1979, a freight train fire occurred in a 
BUA of Mississauga, Toronto (Case History A97). The fire 
was on a tank car containing flammable liquid, but the 
hazard was much increased by the fact that an adjacent tank 
car contained chlorine. A major evacuation took place. In 
fact, the emergency response was effective and the incident 
was contained, but the incident showed the importance of 
segregating flammable and toxic substances, so that a fire 
involving the former does not put the latter at risk. 

A derailment of a freight train occurred on 28 September 
1982 at Livingston, Louisiana (Case History A103). Some 43 
cars were derailed and there was a massive fire. A cause of 
the accident was the misapplication of the brakes by an 
unauthorized rider in the locomotive cab, a clerk who was 
‘substituting’ for the driver. The driver was found to have 
consumed a large amount of alcohol shortly beforehand. 

There have also been incidents in tunnels. On 20 
December 1984, a train conveying 835 te of petrol derailed 
in the Summit Hmnel, nearTodmorden,Yorkshire (A. Jones, 
1985). A spill occurred and was ignited, giving rise to a fire. 
One tank wagon suffered a BLEVE. The fire, which reached 
a mean temperature of 1300°C and 1530°C in places, 
destroyed the train and severely damaged the 2638 m long 
tunnel. Columns of flame and smoke rose high above the 
ventilation shafts. 

23.21.4 Waterway transport 

Some principal incidents in the inland waterway transport 
of hazardous materials are shown in Table 23.46. 

A collision on the Seine, below Rouen, between the two 
product tankers Foyoh Maru and Vitoria, in ballast after 
discharging a cargo of gasoline, resulted in a violent 
explosion on the latter killing six of the crew. The vessel 
itself broke in two and was completely destroyed, whilst 
fragments from it fell over a wide area. 
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Table 23.44 Some principal incidents in the road transport of hazardous materials 

A LNG 

Date 

Location 

Incident 

Deaths /injuries 

Reference a 

1971, Jun. 25 

WaterburyVT 

Blowout, leak 


Davis 

1971, Aug. 28 

Warner, NH 

Crash (SV), leak 


Davis 

1971, Oct. 8 

N. Whitehall,WI 

Crash (TV), petrol and tyre fire 


Davis 

1973 

Junction 80/95, NJ 

Crash (SV) 


Davis 

1973, Oct. 

Raynham, MA 

Crash (TV), trailer overturn 


Davis 

1974, Feb. 18 

Hamilton Tnpk, NJ 

Wheel fire, leak 


Davis 

1975, Nov. 

Dalton, GA 

Crash (SV) 


Davis 

1976, Jan. 

Chattanooga,TN 

Trailer overturn 


Davis 

1976, Sep. 16 

Pawtucket, RI 

Crash (TV), tanker o/tum 


Davis 

1977, Mar./Apr. 

Connecticut Tnpk 

Crash (TV) 


Davis 

1977, Jul. 

Waterbury, CT 

Crash (TV), trailer o/turn 


Davis 

B LPG 

Date 

Location 

Incident 

Deaths /injuries 

Reference a 

1943, Jan. 18 

Los Angeles, CA 

VCF 

5d 

Table A1.2 

1948, Oct. 13 

Sacramento, CA 

Fire 

2d 

Table A1.2 

1950, Aug. 

Wray, CO 

VCF 

2d 

Table A1.2 

1958, Oct. 18 

Littlebury 

Fire 


Davis 

1962, Jul. 25 

Berlin, NY 

VCE 

lOd, 17i 

Table A1.2 

1970, Nov. 12 

Hudson, OH 

Fire 

6d 

Table A1.2 

1972, Mar. 9 

Lynchburg, VA 

Fireball 

2d, 5i 

Table A1.2 

1972, Sep. 21 

NJ Turnpike, NJ 

Fire 

2d, 28i 

Table A1.2 

1973, Feb. 1 

St Amand, France 

VCE 

9d, 37i 

Table A1.2 

1974, Feb. 2 

High Prairie, Alberta 

Fire, explosion 

Id,severali 

Davis 

1975, Apr. 30 

Eagle Pass.TX 

Fireball 

17d, 34i 

Table A1.2 

1978, Jul. 16 

Tula, Mexico 

Explosion 


Table A1.2 

1978, Jul. 15 

Xilatopic, Mexico 

VCF 

lOOi, 220i 

Table A1.2 

1982, Dec. 29 

Florence, Italy 

Explosion 

5d, 30i 

Table A1.2 

1990, Sep. 24 

Bangkok,Thailand 

VCF 

68d, >100i 

Table A1.2 

C Other 

Date 

Location 

Incident 

Deaths /injuries 

Reference a 

1956, Aug. 7 

Call, Columbia 

Explosives explosion 

<1200d 

Table A1.2 

1968, Aug. 21 

Lievin, France 

Ammonia leak 

5d, 20i 

Table A1.2 

1970, May 30 

Brooklyn, NY 

Oxygen leak, fire 

2d, 30i 

Table A1.2 

1975, Dec. 14 

Niagara Falls, NY 

Chlorine leak 

4d, 80i 

Table A1.2 

1976, May 11 

Houston,TX 

Ammonia leak 

6d, 178i 

Table A1.2 

1976, Sep. 11 

Westoning, UK 

Petrol explosion 

3i 

Table A1.2 

1978 

Mexico City 

Propylene fire 

12d 

Table A1.2 

1978, Jul. 11 

San Carlos, Spain 

Propylene fire 

216d, 200i 

Table A1.2 

1980, Nov. 25 

Kenner, LA 

Gasoline fire 

7d,6i 

Table A1.2 

1980, Mar. 3 

Los Angeles, CA 

Gasoline BLEVE 

2d, 2i 

Table A1.2 

1982, May 3 

Galdecott Tunnel, CA 

Gasoline fire 

7d 

Table A1.2 

1989, Mar. 22 

Peterborough, UK 

Explosives explosion 

Id,107i 

Table A1.2 


BLEVE, boiling liquid expanding vapour explosion; S'!/ single vehicle;TV two vehicle; VCE, vapour cloud explosion; VCF, vapour cloud fire. 
a L.N. Davis (1979). 


On 30 August 1979, near Good Hope, Mississippi, the MV 
Inca Tupac Yupanqui lost steering and collided with the 
butane tank barge Panama City moored at a dock (Case 
History A96). The freighter’s bow struck the barge amid¬ 
ships, cutting it in two and causing a fire and explosion 
which killed 12 people and did extensive damage to the 
dock. Half the butane barge drifted downstream and con¬ 
tinued burning for about 24 h. 


At St Louis on 2 April 1983, a four-barge tow pushed by 
the towboat City of Greenville hit a bridge, causing the 
breakway of three barges and an oil spill fire. The burning 
barges caused further fires along a 2-mile stretch of the river 
front. Ayear later on 24 April 1984, the same bridge was hit 
by a 12-barge tow of grain barges and a breakway of these 
barges resulted in a chain reaction of other barge breakaways 
along the waterfront until some 150 barges were adrift. 
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Table 23.45 

Some principal incidents in the rail transport of hazardous materials 



A LPG 

Date 

Location 

Incident 

Deaths/injuries 

Reference a 

1949, Oct. 

Winthrop, MO 

Fire 

Id 

Table A1.2 

1959, Jun, 2 

Deer Lake, PA 

BLEVE 

lid,lOi 

Table A1.2 

1959, Jun. 28 

Meldrin, GA 

VCE 

23d 

Table A1.2 

1969, Jan. 25 

Laurel, MS 

BLEVE 

2d, 33 + i 

Table A1.2 

1970, Jun. 21 

Crescent City, IL 

BLEVE 

66i 

Table A1.2 

1973, Jul. 5 

Kingman, AZ 

BLEVE 

13d,95i 

Table A1.2 

1973, Nov. 6 

Ventura County, CA 

Leak 

2d, 4i 

Table A1.2 

1974, Feb. 12 

Oneonta, NY 

BLEVE 

25i 

Table A1.2 

1975, Oct. 22 

Fertile, MN 

BLEVE 



1976, Nov. 26 

Belt, MX 

BLEVE 

22i 

Table A1.2 

1977, Jun. 2 

Kent, OH 

Explosion 


Davis 

1978, Feb. 24 

WaverlyTN 

BLEVE 

16d, 43i 

Table A1.2 

B Chlorine 

Date 

Location 

Incident 

Deaths /injuries 

Reference a 

1914 

Chrome, NJ 

Leak 

Od 

Table A1.2 

1934, Feb. 28 

Niagara Falls, NY 

Leak 

Od 

Table A1.2 

1935, Mar. 13 

Griffith, IN 

Leak 

Od 

Table A1.2 

1940, Jan. 26 

Mjodalen, Norway 

Leak 

3d 

Table A1.2 

1947, Feb. 4 

Chicago, IL 

Leak 

Od 

Table A1.2 

1961, Jan. 31 

La Barre, LA 

Leak 

Id, 114i 

Table A1.2 

1962, Nov. 30 

Cornwall, Ont. 

Leak 

89i 

Table A1.2 

1963, Apr. 28 

Brandtsville, PA 

Leak 

Od 

Table A1.2 

1963, Aug. 9 

Philadelphia, PA 

Leak 

430+ i 

Table A1.2 

1967, Nov. 8 

Newton, AL 

Leak 

Od 

Table A1.2 

1973, Mar. 5 

Loos, BC 

Leak 

Od 

Table A1.2 

1978, Feb. 26 

Youngstown, FL 

Leak 

8d, 114i 

Table A1.2 

1979, Nov 19 

Mississauga, Ont. 

Leak 

Mass evacuation 

Table A1.2 

1981, Aug. 1 

Montana, Mexico 

Leak 

17d, 280i 

Table A1.2 

C Other materials 

Date 

Location 

Incident 

Deaths/injuries 

Reference a 

1915, Sep. 27 

Ardmore, OK 

Petrol fire 

40d 

Table A1.2 

1943, Jul. 29 

Ludwigshafen, Germany 

Butadiene VCE 

57d, 439i 

Table A1.2 

1948, Jul. 23 

Ludwigshafen, Germany 

DME VCE 

207d, 3818i 

Table A1.2 

1958, Jan. 22 

Niagara Falls, NY 

Nitromethane explosion 

200i 

Table A1.2 

1969, Feb. 18 

Crete, NE 

Ammonia leak 

9d, 53i 

Table A1.2 

1969, Sep. 11 

Glendora, MS 

VCM leak, VCE 

li 

Table A1.2 

1974, Jun. 26 

Climax, TX 

VCM VCE 

7d 

Table A1.2 

1974, Jul. 19 

Decatur, IL 

Isobutane VCE 

7d, 152i 

Table A1.2 

1974, Sep. 21 

Houston,TX 

Butadiene VCE 

Id, 235i 

Table A1.2 

1974, Aug. 6 

Wennatchee,WA 

MMN explosion 

2d, 113i 

Table A1.2 

1978, Sep. 27 

Oviedo Province, Spain 

Gasoline fire 

7d 

Table A1.2 

1979, Apr. 8 

Crestview, FL 

HMs leak 

14i 

Table A1.2 

1983, Nov. 2 

Dhurabar, India 

Kerosene explosion 

47d 

Table A1.2 

1987, Aug. 23 

Lhanzou, China 

Gasoline fire 

5d 

Table A1.2 


BLEVE, boiling liquid expanding vapour explosion; DME, dimethyl ether; HM, hazardous materials; MMN, monomethylamme nitrate; VCE, 
vapour cloud explosion; VCM, vinyl chloride monomer. 
a L.N. Davis (1979). 


23.21.5 Pipeline transport 

There have been a number of major accidents arising from 
the pipeline transport of hazardous materials. 

One of the worst disasters in the process industries was 
a pipeline accident. On 24 February 1984, petrol leaked 
from a pipeline passing through a shanty town at Cubatao, 


Brazil, forming a large liquid pool which then ignited (Case 
History A108). The death toll is uncertain, but is believed to 
have run to some hundreds. 

An explosion on a natural gas pipeline at Natchitoches, 
Louisiana, on 4 March 1965 caused a massive split in the 
pipe and killed 17 people (Case History A37). 
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Table 23.46 

Some principal incidents in the inland waterway transport of hazardous materials? 


Date 

Location 

Incident 

Deaths/injuries 

1978, Oct. 3 

1979, Aug. 30 

1980, Mar. 29 
1980, Dec. 12 
1983, Apr. 2 

Pilottown, LA 

Good Hope, MS 

New Orleans, MS 

New Orleans, MS 

St Louis 

Burmah Spar — collision with vessel 

Panama City - collision with vessel 

Exxon Baltimore — collision with vessel 

Pisces — collision with vessel 

City of Greenville - collision with bridge 

12d, 25i 

* Source: NTSB A 

L nnual Reports 1979—84. 




A leak of propane from a ruptured 8 in pipeline at Port 
Hudson, Missouri, on 9 December 1970, resulted in a mas¬ 
sive vapour cloud explosion (Case History A52). 

At Hearne,Texas, on 14 May 1972, a rupture on an 8 in. oil 
pipeline led to a flowing liquid fire (Case HistoryA58). 

A rupture of a 10 in. NGL pipeline at Austin, Texas, on 
22 February 1973 resulted in the formation of a vapour 
cloud which ignited some 20 min later, killing six people 
(Case History A62). 

On 13 March 1990, a gas cloud formed from a rupture of a 
liquid propane pipeline flowed downhill into the village of 
North Blenheim, New York (NTSB, 1991 PAR-91-01). The 
cloud ignited, flashing back to the pipeline rupture. Two 
people were killed. 

Another major pipeline disaster occurred on 3 June 1989 
at Ufa in Western Siberia (Case History A127). A leak 
occurred from a pipeline carrying mixed LPG near a rail¬ 
way line. A massive vapour cloud formed and ignited as 
two trains were passing. The strength of the explosion has 
been estimated as equivalent in the far field to 10,000 te of 
TNT. Initial reports put the death toll at 462, with many 
others severely burned. 

An incident involving a vapour leak on an ammonia 
pipeline occurred on 6 December 1973 near McPherson, 
Kansas (Case History A64). 

23.21.6 Marine transport 

The case histories considered here may be classed as: 
collisions, groundings and driftings; lightning strikes, 
fires and explosions; and oil spillages. 

On 9 November 1974, the oil/LPG carrier Yoyo Marti was 
in collision in Tokyo Bay with the cargo ship Pacific Ares. 
A 24 m gash was cut in the Yoyo Maru’s hull and naphtha 
spilled out and ignited, giving a fire with flames 70 m high. 
The vessel also had LPG in other cargo tanks, but the LPG 
tanks and fittings withstood the fire, although LPG from 
the tank vents burned. Firefighting vessels were for some 
time unable to approach close due to the heat. The vessel 
was towed out to sea, where it continued to burn and was 
eventually sunk by air strikes. The death toll was 33. 

In some cases, collisions occur while the vessels are 
proceeding at full speed. On 9 February 1982, off North 
Carolina, the barge carrier Lash Atlantico and the freighter 
Hellenic Carrier were in collision in thick fog as both vessels 
were at full speed. There were no injuries, but both vessels 
were badly damaged, the latter beyond repair. Ten days 
later, the barge carrier Del Norte and the freighter African 
Pioneer collided in the Gulf of Mexico, again both moving at 
full speed in thick fog. This time there were two serious 
injuries and again both ships were severely damaged. 

On 21 August 1980, the tanker Texaco North Dakota trav¬ 
elling at full speed struck a partially constructed oil plat¬ 
form in the Gulf of Mexico (NTSB, 1981 MAR-81-04). The 


tanker was partly loaded with petroleum products, several 
cargo tanks were ruptured and fire broke out which gutted 
the vessel. 

On 6 March 1982, the tankship Golden Dolphin exploded, 
burned and sank in the Atlantic 1000 miles to the south¬ 
east of Bermuda (NTSB, 1983 MAR-83-07). The vessel 
was in ballast and an empty cargo tank was being cleaned 
when a series of massive explosions occurred. An inert gas 
system had just been fitted but was not in use. The crew 
abandoned ship but nine died. 

On 27 February 1984, in the Gulf of Mexico, the tanker 
American Eagle was wracked by an explosion and broke up 
(NTSB, 1985 MAR- 85-06). Three crew died in the explosion, 
and two more died later and two were missing in the sinking. 

Some shipboard fires and explosions are caused by 
lightning strikes. On 19 April 1979, the tankship Seatiger 
was hit by lightning while unloading oil at Port Neches, 
Texas (NTSB, 1980 MAR-80-12). Most of the cargo tanks 
exploded and the ship was destroyed. A similar explosion 
occurred on 1 September 1979 at Deer Park,Texas, when the 
tankship Chevron Hawaii exploded while unloading oil at 
a refinery (NTSB, 1980 MAR-80-18). Lightning ignited 
flammable cargo vapours on deck which propagated into an 
empty cargo tank, where the explosion occurred. Amongst 
the many fragments was a 15 m x 2.1msectionofhull which 
penetrated an onshore ethanol tank 250 m away. Burning 
cargo spread across the water and ignited the contents of 
three petroleum barges, which exploded and sank. Casual¬ 
ties are variously given as 3 or 4 killed and 9-13 injured. 

Incidents of fires and explosions on chemical tankers 
with special reference to ignition in cargo tanks due to static 
electricity have been given by Jones and Bond (1984). 

Some of the worst disasters due to chemicals have been 
shipboard explosions of ammonium nitrate. On 16 April 
1947, a fire broke out on an ammonium nitrate vessel, the 
Grandcamp, in Texas City Harbor (Case History A16). 
After about an hour, the ship disintegrated with a tremend¬ 
ous explosion, killing all those in the dock. Fire spread to 
another vessel, the High Flyer, which also carried ammo¬ 
nium nitrate, and during the night this vessel too exploded. 
There were 552 deaths and over 3000 injuries. 

On 8 January 1979, a large explosion and fireball 
occurred on board the Betelgeuse which was unloading at an 
oil terminal at Whiddy Island, Bantry Bay, Eire (Case 
History A95). All 42 members of the crew were killed as 
well as a crewman’s wife and seven terminal operators. 

Further case histories of fire and explosion on vessels in 
port are given by Rushbrook (1979) and by Dicker and 
Ramsey (1983). 

Large-scale oil spills are a major threat to the environ¬ 
ment. Major oil spills are those from the Torrey Canyon in 
1967, the Amoco Cadiz in 1978, the Exxon Valdez in 1989 and 
the Braer in 1993. Further details are given in Appendix 11. 
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23.21.7 Marine transport: LPG 

Some principal incidents to LFG carriers are given in 
Table 23.47. An account of incidents involving LNG carriers 
has been given by Lakey and Thomas (1983). L.N. Davis 
(1979) describes incidents with both LNG and LPG vessels. 

On 29 June 1979, the LNG carrier El Paso Paul Kayser ran 
aground at Gibraltar. The bottom plating on the starboard 
side was ripped open but, although deformed, the Gaz 
Transport containment system, including both the primary 
and secondary containment barriers, remained liquid tight. 

Another grounding of an LNG tanker occurred on 12 
December 1980when theLAG Taurus ran aground at Mutsure 
Anchorage, nearTobataJapan.The initial damage in this case 
was less, but was aggravated during 4 days aground. 

Worse damage than in either of these cases was sus¬ 
tained by the El Paso Columbia when it grounded on 16 
December 1981 near Cape Sable in Nova Scotia. The engine 
room and, apparently, one cargo tank were flooded, hut the 
vessel was in ballast. 

In the autumn of 1968, the LPG carrier Claude collided 
with another vessel in Southampton Water. The crew aban¬ 
doned ship and the vessel drifted until it ran aground. 
Another ship was chartered to remove the cargo of butane, 
but backed off when one of the unloading hoses sprang a 
leak, giving a vapour cloud. The leak was stopped by other 
boarders. 

There have been a number of spills of LNG on the decks 
of LNG carriers. In 1965, fracture of the mild steel deck of 
the Methane Princess occurred due to a small LNG spill. In 
the same year, at Arzew another LNG carrier, the Descartes, 
also suffered deck fracture from an LNG overfilling. 

LNG carriers have also experienced cargo tank rupture. 
On 17 November 1969, rupture of a cargo tank occurred on 
the Polar Alaska due to violent sloshing of the LNG liquid. In 
1970, the LNG carrier Arctic Tokyo suffered cracking of a 
cargo tank due to sloshing. 

On 30 June 1974, there was a pump room explosion and 
fire aboard the semi-refrigerated LPG carrier Midi as she 
began unloading butylene at Grangemouth. A butylene 
vapour cloud estimated at 50 te spread around the area near 
the ship. The captain, who was in the pump room, died. 

There have been several lightning strikes followed by 
fires on LNG carriers. On 25 December 1964, this occurred 
to the Methane Progress just after loading at Arzew. The 
next year the same ship again suffered a lightning strike 
and fire. In 1977, the LNG Aquarius unloading at Tobata, 
Japan, was struck by lightning followed by fire. Lightning 
strike and fire have also been experienced by the LNG 
carrier Jules Verne. 

On 12 October 1984, the LPG tanker Gas Fountain, origi¬ 
nally the GayLussac, was attacked by an Iranian aircraft in 
the Gulf. Three rockets hit the vessel. The crew abandoned 
ship and were rescued. One rocket caused a rupture of the 
pipework of No. 2 tank; propane escaped and caught fire. A 
second rocket penetrated the deck into the containment 
space of No. 3 tank and exploded near the cargo tank, 
creating a hole some 3 m x 2 m. Butane escaped and ignited 
giving a large fire on deck. It is estimated that some 130 te of 
butane may have escaped during this initial depressuriza¬ 
tion. The next day, a salvage vessel arrived, extinguished 
the fires using water jets, and took the vessel in tow. 
Extensive repairs were carried out. About a month later, 
most of the LPG cargo, some 17,200 of the original 18,400 te, 
was transferred to another vessel. An account of this 
salvage is given by J.A. Carter (1986). 


23.22 Transport Risk 

23.22.1 Historical record 

The risks from the process industries arise from processes, 
storage and transport. The historical record shows that 
transport is a major contributor. Transport figures promi¬ 
nently in the case histories given in Appendix 1 and else¬ 
where in this book. An attempt to quantify the contribution 
made by transport to the overall risks from the process 
industries is given below. 

23.22.2 Hazard assessment 

Another approach to the estimation of the risk from trans¬ 
port is hazard assessment. A major hazard assessment exer¬ 
cise for transport is the ACDS Transport Hazards Report, 
which is described in Appendix 17. An account is given below 
of hazard assessments of transport by the principal modes 
of road, rail, ship and pipeline for the principal hazardous 
substances of LNG, LPG, chlorine and ammonia. 

23.22.3 Fixed installations vs transport 

A study of the relative risks from fixed installations and 
transport by road, rail, pipeline and waterway and sea has 
been made by HaastrupandBrockhoff(1990).They identified 
in the literature 1793 accidents in both fixed installations and 
transport. The breakdown of the accidents was as follows: 



No. of 

No. of accidents 


accidents 

with fatalities 

Fixed installations 

998(56%) 

454(67%) 

Loading/unloading 

104(6%) 

47(7%) 

Transport 

691 (39%) 

181 (27%) 

Total 

1793 

682 

and for the transport modes 


No. of 

No. of accidents 


accidents 

with fatalities 

Road 

205(30%) 

54(30%) 

Rail 

257(37%) 

41(23%) 

Pipeline 

133 (19%) 

56(31%) 

Inland waterway 

38(5%) 

4(2%) 

Marine 

58(8%) 

26(14%) 

Total 

691 

181 


The authors quote the analysis of transport accidents in 
the Major Hazards Incidents Data Service (MHIDAS) 
database made by Appleton (1988 SRD R474), who found 
that 17% involved road, 36% rail and 21% pipelines. 

The authors selected for study accidents occurring after 
1959, which gave a total of 510 accidents with fatalities. 
They present a set of frequency-number curves, including 
one showing an overall worldwide curve for fixed installa¬ 
tions and a corresponding curve for all transport modes. 
The transport curve lies somewhat above that for fixed 
installations, but for accidents with the number of fatalities 
exceeding four there was found to be no statistically sig¬ 
nificant difference between the two curves. Another of 
the graphs gives a set of separate curves for worldwide 
transport by road, rail and pipeline. The three curves lie 
very close to each other. 
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Table 23.47 Some principal incidents to LPG carriers 


A Groundings, standings, driftings 


Date 

Location 

Vessel 

Cargo 

References* 

1966, Mayl 

Thames 

Methane Progress 

LNG 

Cox 

1968, Sep. 

Mexico 

Aristotle 

LNG 


1974, Apr. 19 

Arzew, Algeria 

Methane Progress 

LNG 

Cox 

1974, Oct. 28 

Rhone Delta, France 

Hassi R’Mel 

LNG 

Cox 

1974, Nov. 

Le Havre, France 

Euclides 

LNG 

Davis 

1978, Jan. 11 

Canvey UK 

LNG Aries 

LNG 

Davis 

1979, Sep. 30 

Takari Bay, Lagos, Nigeria 

Babounis Costas 

LPG 

Lakey 

1980, Dec. 12 

Mutsure Anchorage, 

LNG Taurus 

LNG 

Lakey 

1981, Dec. 16 

Tobata, Japan 

Cape Sable Island 

El Paso Columbia 

LNG 

Lakey 

Nova Scotia 



B Collisions, 

rammings, impacts 




Date 

Location 

Vessel 

Cargo 

References a 



Methane Princess 

LNG 

Cox 

1968, Autumn 

Southampton, UK 

Claude 

LPG 

Davis 

1968, Sep. 12 

Flushing, Belgium 

Havfrost 

LPG 

Harris 13 

1968, Dec. or 

1969, Jan.) 

Canvey, UK 

Methane Princess 

LNG 

Davis 

1969, Feb. 10 


Methane Princess 

LNG 

Cox 

1969, Feb. 25 

Straits of Malacca 

Gohshu Maru 

LPG 

Harris 

1970, Oct. 19 


Methane Progress 

LNG 

Cox 

1970, Oct. 21 

Konigsforde,W. Germany 

Mariotte 

LPG 

Harris 

1971, Jun. 17 

Tokyo Bay, Japan 

Gohshu Maru 

LPG 

Harris 

1972, Jul. 21 

Heroya, Norway 

Monomer Venture 

LPG 

Harris 

1973, Jan. 14 

Bilbao, Spain 

Alexander Hamilton 

LPG 

Harris 

1973, Mar. 28 

Straits of Malacca 

World Bridgestone 

LPG 

Harris 

1973, Dec. 16 

RasTanura, Saudi Arabia 

Beava 

LPG 

Harris, 

Lakey 

1974, Aug. 

Terneuzen, Belgium 

Euclides 

LNG 

Davis 

1974, Nov. 9 

Tokyo, Japan 

Yoyo Maru 

LPG 

Davis, 

Harris, 





Lakey 

1974, Dec. 6 

London, UK 

Methane Progress 

LNG 

Cox 

1975, Jun. 9 

Buenos Aires, Brazil 

Gazana 

LPG 

Harris 

1975, Jul. 14 

Pentland Firth, UK 

M.P. Grace 

LPG 

Harris 

1977, Jun. 7 

Bahrain 

LNG Challenger and 
Lincolnshire 

LNG 

Davis 

1978, Aug. 14 

Singapore 

Khannur 

LNG 

Davis 

1978, Aug. 26 

Bahrain 

LNG Challenger 

LNG 

Davis 

1978, Oct. 29 

Suez Canal 

Lord Kelvin 

LPG 

Harris 

1980, Jan. 30 

Singapore 

Pine Queen 

LPG 

Harris 

1980, Feb. 19 

Porto Marghera, Italy 

Gazana 

LPG 

Harris 

1982, Jan. 24 

Curacao 

Faraday 

LPG 

Harris 

1982, Apr. 28 

Cristobal, Panama 

Luigi Casala 

LPG 

Harris 

1983, Apr. 3 

Tampico, Mexico 

Reynosa 

LPG 

Harris 

1983, Aug. 3 

Yugecho, Japan 

Kazutama Maru 

LPG 

Harris 

1985, Apr. 11 

Choshi, Japan 

Berge Arrow 

LPG 

Harris 

1985, May 31 

Coatzacoalcos 

Mariano Escobedo 

LPG 

Harris 

C Leaks 

Date 

Location 

Vessel 

Cargo 

References a 

1965 


Methane Princess 

LNG 

Lakey 

1965, May 


Jules Verne 

LNG 

Lakey 

1969, Nov 19 


Polar Alaska 

LNG 

Cox 

1974, Dec. 


Jules Verne 

LNG 

Cox 

1975, Mayl 


Methane Progress 

LNG 

Cox 
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Table 23.7 (continued) 





1976, Dec. 20 

Kenai 

Polar Alaska 

LNG 

Cox 

1977, May 14 

Chiba, Japan 

HUH 

LNG 

Cox 

1977, Sep. 16 

Bontang 

LNG Aquarius 

LNG 

Lakey 

1979, Apr. 8 

Cove Pt, MD 

Mostafa Ben Boulaid 

LNG 

Lakey 

1979, Apr. 25 

Everett, MA. 

Pollenger 

LNG 

Lakey 

1981, Jul. 31 

Sines, Portugal 

OlavTrygvason 

LNG 

Lakey 

Voyage 2 


Descartes 

LNG 

Cox 

D Lightning strike and fire 

Date 

Location 

Vessel 

Cargo 

References a 

1964, Dec. 25 


Methane Progress 

LNG 

Lakey 

1965 

Nr Arzew, Algeria Methane Progress 

LNG 

Lakey 

1977, Sep. 3 

Tobata, Japan 

LNG Aquarius 

LNG 

Lakey 

Unknown 


Jules Verne 

LNG 

Lakey 

E Other incidents 

Date 


Location Vessel 

Cargo 

References a 

1964 Small fire 


Methane Princess 

LNG 

Cox 

1966, Aug. 30 Small fire 


Methane Princess 

LNG 

Cox 

1971, Sep. 14 Weather damage to tank 

Arctic Tokyo 

LNG 

Cox 

1974, Jun. Pump room explosion 

Grangemouth, UK Milli 

LPG 

Davis Lakey 

1974, Jul. 7 Valve overpressurized, 

Massachusetts 

LNG 

Cox 

canopy cracked 





1976, Dec. 1 Broke moorings 

Marseilles, France Benjamin Franklin 

LNG 

Cox 

1978, Oct. 10 Pump fire 


Donges, France Danian Gas 

LPG 

Lakey 

Voyage 2 Overfilling, deck 

Jules Verne 

LNG 

Cox 

brittle fracture 






a R.A Cox, Comer et at. (1980); LN. Davis (1979); F.S. Harris (1986); Lakey and Thomas (1983). 
b LPG vessels in incidents quoted by Harris were all refrigerated carriers. 


Some major transport accidents include the ammonium 
nitrate explosions at Halifax, Nova Scotia, in 1917 and at 
Texas City in 1947, the road tanker fire at San Carlos in 1978, 
the pipeline rupture and fire at Cubatao in 1984 and the 
pipeline rupture and explosion at Ufa in 1989. 

23.23 Transport Hazard Assessment 

The hazards of transport tend to differ from those of fixed 
installations, whether processorstorage,inanumberofways. 

Disregarding pipelines for the moment, transport is char¬ 
acterized by the large amount of energy in the vehicles and 
vessels, both those carrying the hazardous materials and 
others.The order of increasing energy is road, rail and marine. 

Another difference is the transport environment, which 
is much less subject to control by management. A transport 
vehicle or vessel is exposed to a variety of external threats 
to an extent that the situation is qualitatively different from 
that on fixed plant. 

A third difference is in the variety of locations where 
an accident may occur and in the population exposed to any 
incident. 

These last two points also apply to some degree to 
pipelines, but these are fixed installations and tend to have 
more in common with other fixed installations in the 
process industries. 

The differences between transport and fixed installa¬ 
tions are reflected in the hazard assessments. In the hazard 
assessment of transport, the characteristic features tend 
to be the incident scenarios, the associated frequency esti¬ 
mates and the population models. By contrast, the hazard 


models used to determine consequences are generally 
those developed for fixed installations, although there are 
some special cases such models for explosions in ship cargo 
holds or for events in tunnels. 

As already mentioned, the most comprehensive hazard 
assessment for transport is the ACDS Transport Hazards 
Report, which is described in detail in Appendix 17.This deals 
with the risks from transport by road, rail and sea, though 
not by pipeline, for the set of four study substances motor 
spirit, LPG, chlorine and ammonia and also for explosives. 

Some other hazard assessments of transport are now 
described. 

23.24 Road Transport Hazard Assessment 

The road transport environment has been described in Sec¬ 
tion 23.6. The account given there includes estimates made in 
the ACDS report of the frequency of release for the four study 
substances. The substance which has been most intensively 
studied is chlorine. Accounts of studies on the risks of chlor¬ 
ine transport include those of Westbrook (1974), Lautkaski 
and Fieandt (1980) and Canadine and Purdy (1989). 

The work of Westbrook (1974) has been described in 
detail in Chapter 18. In this early study of chlorine trans¬ 
port in the United Kingdom, the author used data for road 
tankers generally and obtained the following estimate, 
which he then applied to chlorine tankers also: 

Frequency of accidents = 0.63 x 10 _6 /tanker-km 
The reference distance is for loaded journeys only. West¬ 
brook then assumed that all tanker accidents are potentially 
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spillage accidents. This approach is, therefore, very con¬ 
servative. 

Lautkaski and Fieandt (1980) in a study of the road and 
rail transport of hazardous materials in Finland made the 
following estimate for road tankers generally: 

Frequency of releases = 2 x 10 _8 /tanker-km 

It is unclear whether the reference distance is for loaded 
and unloaded journeys or for loaded journeys only. They 
state that some 15 % of releases are due to valve failures and 
85% to road accidents. 

Canadine and Purdy (1989) describe a hazard assessment 
of the rail and road transport of chlorine. This study, which is 
evidently part of the background work preceding the ACDS 
report, does not explicitly quote release frequencies, 
although it does give some figures for societal risk. It does, 
however, provide insight into the factors bearing on a hazard 
assessment for chlorine road transport. 

The principal producer of chlorine in the Unites 
Kingdom is ICL The company has some 19 road tankers 
with payloads of 15-21 te. Over a 60-year period, there have 
been three leaks. Two were due to incompletely closed 
valves and were quickly rectified and the third was minor. 

The frequency with which these tankers are involved in 
accidents is significantly lower than for commercial trans¬ 
port generally. The vehicles are fitted with various arrange¬ 
ments to reduce the accident rate, such as high quality 
suspension, anti-skid devices, anti-jack-knife systems, fuel 
cut-off devices, additional fire protection, andregular lights 
and fog lights. The tankers have their liquid and vapour 
valves protected in a recessed valve chest at the front of the 
vehicle. They have excess flow valves, and the two latest 
vehicles also have remotely operated shut-off valves. 

Since 1976, the company has taken additional measures 
to reduce the consequences of any collision. Additional rear 
and side protection has been fitted to resist penetration, 
absorb energy and spread the load in the case of collision. 
The value of these measures was illustrated in 1985 when 
the most serious accident recorded to date occurred. A 
chlorine tanker was hit by a 38 te articulated lorry travel¬ 
ling at an estimated 60 mph down a hill near Baslow in 
Derbyshire. The vehicle veered diagonally across the road 
and hit the chlorine tanker on its front offside, stopping it 
dead and driving it sideways across the road. The side 
protection on the tanker absorbed most of the collision 
energy and spread the load as it was designed to do; there 
was no leak. 

As described in Section 23.6, the ACDS report gives 
estimates for the road transport of chlorine which distin¬ 
guish between releases due to punctures and those due to 
equipment failure. The frequency of the latter is expressed 
as releases per journey, but using the average journey 
length quoted, the following estimates for releases from 
chlorine tankers are obtained 

Frequency of release due to puncture 
= 0.008 x 10 _s /tanker-km 
Frequency of release due to equipment failure 
(= 0.003 x 10 8 /tanker-km 
Frequency of release = 0.011 x 10 _8 /tanker-km 
The reference distance is for loaded journeys. 


23.25 Rail Transport Hazard Assessment 

The rail transport environment has been described in 
Section 23.8. The account given there includes estimates 
made in the ACDS report of the frequency of release for the 
four study substances. 

As for road transport, the substance which has been most 
intensively studied is chlorine. Accounts of studies on the 
risks of chlorine transport include those of Westbrook (1974), 
Lautkaski and Fieandt (1980), N.C. Harris and Roodbol 
(1985), Purdy etal. (1988) and Canadine and Purdy (1989). 

The early study of Westbrook (1974), described in 
Chapter 18, on chlorine transport in the United Kingdom, 
used data for freight trains generally combined with a train 
model for the probability of a release given an accident and 
obtained for chlorine tank wagons the following estimates: 

Frequency of accidents = 1.18 x 10 _6 /train-km 

Probability of release = 0.041 

Hence 

Frequency of release = 4.8 x 10 _8 /train-kmn or 
for an average of 4 tank-wagons per train 
Frequency of release = 1.2 x 10 _8 /tank-wagon-km 

The reference distance is for loaded journeys only. 

In their study for Finland, Lautkaski and Fieandt (1980) 
made the following estimates for rail tankers generally: 

Frequency of releases = 0.41 x 10 _8 /tank-wagon-km 

The reference distance is unclear. This figure excludes 
releases due to valve failure, which the authors state 
amounts in the case of rail transport to 99.5% of all relea¬ 
ses. They also say that the additional protective features of 
chlorine tank wagons were considered, but do not state 
what allowance, if any, was made for them. 

N.C. Harris and Roodhol (1985) describe a hazard 
assessment of the rail transport of chlorine for the 
Netherlands. The accident and release estimates which they 
quote include the following values: 


Country 


Event frequency 

Accident 

(train-km) 

Minor release 

(tank- 

wagon-km) 

Major release 

(tank- 

wagon-km) 

UK 

0.35 x HT 6 

1 x 10 -8 


Netherlands 

0.88 x 10“ 6 

1 x 10 -8 

0.1 x 10“ 8 

USA 

6 x 10“ 6 

6 x 10“ 8 

1.5 x 10 -8 


The reference distance is unclear. 

Purdy et al. (1988) describe the hazard assessment of 
chlorine rail transport. This study, which is evidently part 
of the background work preceding the ACDS report, 
resembles the treatment given in the latter and is not 
therefore considered further here. 

Another precursor to the ACDS report, the work of 
Canadine and Purdy (1989), deals with rail as well as road 
transport of chlorine. As for the road study, figures are 
given for societal risk though not for release frequency, 
but the account provides insight into the relevant factors. 
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The principal chlorine producer, ICI, operates some 40 
braked tank wagons which take a 28 te load.This contrasts 
with the fleet of about 300 unbraked tank wagons of 14 te 
capacity in the 1950s. The company has never experienced 
puncture of a chlorine rail tank wagon or a major release. 

The older type of tank wagon was involved in some 
major collisions, including one in which a loaded wagon 
travelling at 60 mph demolished a signal box, though it 
did not leak. Since the introduction of the larger wagons, 
accidents have been limited to minor derailments and 
collisions in marshalling yards. 

The modern wagons have a number of safety features. 
They are fitted with top mounted needle valves, each with 
an internal excess flow valve, and protected with a heavily 
reinforced low profile dome. They are provided with buffer 
override protection consisting of a reinforced hollow steel 
section mounted below the buffers across the width of the 
tank. 

As described in Section 23.8, the ACDS report gives 
estimates for rail transport of chlorine which distinguish 
between releases due to punctures and those due to equip¬ 
ment failure. The frequency of the latter is expressed as 
release per journey, but using the average journey length 
quoted, the following estimates for releases from chlorine 
tank wagons are obtained: 

Frequency of release due to puncture 

» 0.09 x 10 _8 /tank-wagon-km 


He states that for vehicles carrying packages, the fre¬ 
quency of spills is about twice, and that of fires about half, 
the above figures. Many package spills occur when the 
package falls off the vehicle. 

Events in tunnels may be initiated by a leak from a con¬ 
tainer, an explosion in a container, a fire of the load or an 
explosion of the load. The scenarios considered are fire, 
explosions (physical, condensed phase and vapour cloud) 
and toxic release. 

The hazard models used to predict the consequences are 
for the most part adaptations of those developed for events 
in the open. For pool spread, a two-dimensional adaptation 
of the SPILL code was utilized. Gas dispersion is domi¬ 
nated by the tunnel ventilation. For heavy gas dispersion, 
use was made of a two-dimensional adaptation of the DENZ 
and CRUNCH codes for instantaneous and continuous 
releases, respectively, with the cloud advected at the venti¬ 
lation velocity. For physical explosion the code GASEX 
was used. For condensed phase explosions, empirical 
correlations given in Christopherson (1946) were used to 
predict overpressure and impulse as a function of charge 
size, tunnel cross-section and distance. For vapour cloud 
deflagration, a simple combustion model was used based 
on a constant flame velocity and shock velocity, followed 
on completion of combustion by transition to a one¬ 
dimensional fluid flow code. 

Four tunnels were studied. The data given include the 
following: 



Tunnel 1 

Tunnel 2 

Tunnel 3 

Tunnel 4 

Length (m) 

1030 

1483 

1436 

650 

No. of tubes/lanes per tube 

2/2 

1/2 

1/2 

2/3 

Lane width (m) 

3.65 

2.41 

3.65 

3.65 

Headroom (m) 

5.1 

4.72 

5.03 

5.1 

Ventilation system 

Longitudinal 

Semi-transverse 

Semi-transverse 
plus section of longitudinal 

Longitudinal 

Construction 

Submerged section 

Driven tube 

Driven tube 

Cut and cover 


Frequency of release due to equipment failure 
m 0.02 x 10 _8 /tank-wagon-km 
Frequency of release = 0.11 x 10 _8 /tank-wagon-km 
The reference distance is for loaded journeys. 


23.26 Tunnel Transport Hazard Assessment 

Studies of road tunnel hazards include those of the Larson, 
Reese and Wilmot (1983) and Considine (1986), and several 
others referenced by the latter. 

In the study by Considine (1986), the two principal 
events considered are spills and fires. For the estimation of 
the frequency of these events, the approach adopted was to 
extrapolate from open route data, the information on inci¬ 
dents in tunnels being inadequate. The author’s estimates 
for road tankers are as follows: 

Frequency of spills from tankers = 5 x 10 _8 /tanker-km 
Frequency of fires on tankers = 1 x 10 _8 /tanker-km 


An explosion may cause damage to the tunnel. In general, 
experiments indicate that damage in a large tunnel corre¬ 
lates better with mean overpressure than with transient 
peak overpressures. For the condensed phase explosions, 
peak overpressures were high, but the serious structural 
failures predicted were limited to two tunnels. These fail¬ 
ures were of the roof and median wall in Tunnel 4 and of the 
road support in Tunnel 3 and were confined to a few tens of 
metres. The effects did not worsen dramatically for 
increasing charge sizes. The most damaging event was 
found to be deflagration of a vapour cloud filling the whole 
cross-section along an appreciable length. The effects 
obtained were comparable with those of a TNT explosion, 
but with a longer section sustaining damage. For injury 
from explosions, use was made of the injury relations 
given by Eisenberg, Lynch and Breeding (1975) and by 
W.E. Baker et al. (1979). 

A fire in a tunnel differs in its effects from oneintheopen 
in that the flames, hot gas and smoke are confined and are 
thus much more lethal. Persons exposed are principally 
other road users and the general public. 
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The results of the hazard assessment included the fol¬ 
lowing findings. The risks are mainly to other road users, 
those to the general public being typically an order of 
magnitude less.The dominant contributor (>70%) to these 
risks is flammable liquids. 

At the lower end of the spectrum (N > 1 and N > 10), the 
factor mainly determining the societal risks to road users is 
traffic density rather than tunnel design. In this region, the 
risks are remarkably similar to those on the open road. The 
effect of tunnel design is seen, however, at the upper end of 
the spectrum (N > 100). This is illustrated by the following 
values of the ratio of the frequency for N> 100 to that for N> 1: 


Tunnel 1 0.27 

Tunnel 2 0.39 

Tunnel 3 0.28 

Tunnel 4 0.03 


The low ratio forTunnel 4 reflects the fact that it has a short 
length and a large cross-section, and the high value for 
Tunnel 2 reflects the fact that it carries two-way traffic and 
a small cross-section. 

23.27 Pipeline Transport Hazard Assessment 

A hazard assessment of a hydrocarbon pipeline is 
described in A Safety Evaluation of the Proposed St. Fergus 
to Moss Morran Natural Gas Liquids and St. Fergus to 
Boddam Gas Pipelines (HSE, 1978d). 

The proposed natural gas liquids (NGLs) pipeline would 
run for approximately 200 km from St Fergus to Moss 
Morran. The pipe would be 16 in. (406 mm) diameter and 
would operate at a maximum pressure of 1000 psig (70 bar) 
and a minimum pressure of 246 psig (18 bar) with a typical 
fluid temperature of 10°C. The pipeline would transport up 
to 110,000 bbl/d (approximately 100 kg/s). The composition 
of the NGL would vary between summer and winter condi¬ 
tions. For the former, the NGL would contain approximately 
50% ethane and 30% propane. 

The failure rates of comparable pipelines and the factors 
influencing such failures are discussed in detail. The data 
considered include those of the US petroleum pipeline sys¬ 
tem, the European petroleum pipeline system and the UK 
gas transmission system, which have been described above. 
The report presents additional data on the UK petroleum 
pipeline system and on the UK gas transmission system. 

The oil company pipeline system in the United Kingdom 
is only approximately 1500 miles long. In the period 
1963-76, some 17 accidents were recorded. It was concluded 
that this is too small a number on which to base an estimate. 

The data for the European petroleum pipeline system 
(CONCAWE, 1977 9/77) were analysed. Many of the types 
of incident recorded were considered inapplicable to the 
proposed pipeline. On the basis of applicable incidents, the 
incident rate of the pipelines was 2.32 x 10 _4 /kmyear. 

The data for the UK gas pipeline system were provided 
by the BGC. The applicable incident rate of the pipelines 
was again 2.32 x KT 4 /km year. This value was based on 31 
faults. The distribution of rupture sizes of these faults was: 


Equivalent diameter (mm) 

No. of faults 

>80 

1(3%) 

20-80 

3 (10%) 

<20 

27(87%) 


The hole sizes considered in the assessment were 80 and 
20 mm equivalent diameters in the proportions 10% and 
90%, respectively. 

The emission rates from a rupture of the NGL pipeline 
were estimated as follows. Small orifices through which the 
maximum rate of emission as liquid would be less than 
100 kg/s, the approximate maximum pump delivery rate, 
would release NGL as liquid. Orifices which could deliver 
more than 100 kg/s would give an initial liquid flow, fol¬ 
lowed by choked two-phase flow as the pressure fell locally 
to the saturated vapour pressure. At this lower flow the 
pressure would rise again and reversion to liquid flow 
would occur. There would follow an oscillation between 
liquid flow and two-phase flow. It was assumed for sim¬ 
plicity that the flow through this intermediate size of orifice 
would be 100 kg/s. The largest orifices would be able to 
deliver 100 kg/s or more with two-phase flow. For this latter 
case, the flow under two-phase discharge was calculated as 
the geometric mean of the flows of pure liquid and pure gas. 
The flows calculated for the 20 and 80 mm holes were 15.2 
and 100 kg/s, respectively. 

These estimates were made for the first 5 min after the 
rupture. It was assumed that after this time, the pumps 
would be shut off. The conditions after 5 min were not 
investigated, since it was considered that the leak would 
probably reach a critical phase in respect of ignition in less 
than 5 min. 

The dispersion of the gas cloud from the pipeline was 
calculated assuming a neutral buoyancy gas and using the 
Pasquill equations. The effect of possible heavy gas 
behaviour was considered, but it was concluded that at the 
existing state of knowledge, it is not unreasonable to 
assume that the increased entrainment of air approxi¬ 
mately compensates for the slumping effect. 

The heat radiated from a flame ignited at the pipeline 
was calculated by the methods given in API RP 521:1969. 
The three heat radiation levels considered were 1, 8 and 
16kW/m 2 . These were chosen because they are, respec¬ 
tively, the level which is just tolerable to a clothed person, 
that which would result in death within minutes unless 
adequate shelter were found and that which causes spon¬ 
taneous ignition of wood. Some of the data given in the 
report for these hazards are shown in Table 23.48. 

The frequency of ‘interactions’ between the pipeline and 
the exposed populations was assessed. The most exposed 
population group considered was that at Glenfarg, which 
is 250 m from the pipeline. For this population the fre¬ 
quency of interaction for all releases up to lOOkg/s was 


Table 23.48 Hazards from the rupture of an NGL pipeline 
(Health and Safety Executive, 1978d) (Courtesy of the 
Health and Safety Executive) 


A Thermal radiation from burning vapours 
distance from flame centre (m) 

Release rate (kg/s) Radiation level (kW/m 2 ) 


20 

100 

250 

1000 


1 8 16 


128 45 32 

282 100 70 

450 160 112 

892 315 223 
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estimated as 4.4 x 10 5 /year. A further account of the 
approach taken in this work has been given by Bryce and 
Turner (1979). 

Following a proposal to increase the diameter of this 
pipeline from 16 in. (406 mm) to 24 in. (610 mm), a reap¬ 
praisal of the risks was undertaken (HSE, 1980c). Essen¬ 
tially the same methodology and data were used. The 
assessment found that the frequency of interactions 
remained highest for the population, at Glenfarg. For this 
population, the frequency of interactions for releases of 
242 kg/s was estimated as 4 x lCT 6 /year. 

An treatment of the hazard assessment of pipelines from 
a broader perspective has been given by M.J. Turner (1980). 

The hazard assessment of the British Gas pipeline in 
Morecambe Bay has been described by Considine (1983). 
The pipeline connects the offshore platform to the onshore 
terminal. It consists of a line about 40 km long and 
36 in. diameter containing some 1774 te of gas and 612 te of 
liquid. 

Scenarios for failure of the pipeline both on land and 
under water were considered. For the latter, there was 
uncertainty as to how the fluids released, particularly the 
liquid components, would behave. For the case of immedi¬ 
ate ignition of the release, two scenarios were considered, 
one in which the release burns as a torch and the other in 
which it burns as a liquid pool on the surface with the gas 
confined to the area of the pool. For the case where the 
release does not ignite immediately, a gas cloud forms and 
drifts with the wind. 

Consideration was also given to interaction with a pas¬ 
sing ship. For this, three cases were envisaged: (1) the gas 
cloud drifts towards the vessel; (2) the vessel sails through 
the cloud; and (3) the vessel itself causes the release in some 
way such as by grounding or dragging its anchor. 


23.28 Marine Transport Hazard Assessment 

The mid-1970s saw a growing public awareness of the 
hazards from process installations and one manifestation 
of this was concern over ports and terminals, and the 
associated traffic, and in particular LNG terminals. 

The USCG initiated an extensive programme of work on 
the hazards of ships carrying hazardous materials. One 
outcome was the vulnerability model developed by 
Eisenberg, Lynch and Breeding (1975) and their co-workers, 
which is described in Chapter 9. Other work performed or 
sponsored by the USCG and other bodies includes that of 
Fortson et al. (1973), Woodward-Lundgren and Associates 
(1973), Dunn and Tullier (1974), A.D. Little INC. (1974b), the 
National Materials Advisory Board (1974), Frenkel and 
Hathaway (1976), Stoehr et al. (1977) and the Planning 
Research Corp. (1979). 

A scenario of particular concern was the spillage onto 
the sea of a large quantity of flammable liquid such as LNG 
or LPG. In the worst case, such a spill could be massive and 
could be expected to spread and to vaporize rapidly, giving 
rise to a very large vapour cloud. There were similar con¬ 
cerns over liquefied toxic gases, particularly ammonia. 

Treatments of, and models for, the spill hazard were 
described by Burgess, Murphy and Zabetakis (1970 BM RI 
7448), McQueen W. et al. (1972), Fay (1973), Kneebone and 
Boyle (1973), Kneebone and Prew (1974), Drake and Reid 
(1977) and Hogan (1982). This hazard also figures strongly 
in the Vulnerability model. 


The frequency of realization of such hazards, particularly 
that of collision, was dealt with in other studies such as those 
by Horner (1974), Horner and Ecosystems Inc. (1974), Kahn, 
Talbot and Woodward (1974) and Ligthart (1980). 

At the same time, studies were undertaken on particular 
projects, or project proposals, such as those for Staten 
Island, Los Angeles, Oxnard, Point Conception, Everett 
and Matagordo Bay. Studies include those by the Federal 
Power Commission (1974, 1976, 1977), Philipson (1974, 
1980), Gratt and McGrath (1975a,b, 1976), Philipson and 
Schaefer (1975), Socio-Economic Systems (1977) and 
Nikodem (1978,1980). 

Accounts of the methodologies used in such work have 
been given by Philipson and Schaefer (1975), Kopecek 
(1977), Philipson (1978a,b, 1980), R.A. Cox, Comer et al. 
(1980), Lyon, Pyman and Slater (1982) and Philipson and 
Napadensky (1982). 

More recent accounts of hazard assessments of par¬ 
ticular terminals include those for Canvey (British Gas) by 
Lucas, Roe and Waterlow (1983), Horn et al. (1974) and Dale 
and Croce (1985), Mossmorran (Shell) by Sellers, Luck 
and Pantony (1985), St Fergus (British Gas) by Valk and 
Sylvester-Evans (1985), and an assessment by Bello, 
Romano and Dosi (1983). 

Treatments of oil as opposed to LNG terminals are much 
less numerous. An example is that given by Bergmann and 
Riegel (1983) for the oil terminal at Galveston. 

Aldwinkle and Slater (1983) have described the hazard 
assessment of a novel project, a process and storage ship 
(PASS). 

More recent accounts of methodology include those 
of Valckenaers (1983), Valk and Sylvester-Evans (1985), 
Sellers and Luck (1986) and Navaz (1987). 

The perspective of the HSE has been presented by Hough 
(1983), Wicks (1983), D.A. Jones (1985) and Crossthwaite 
(1986), while Considine and Grint (1985) have given a set of 
rapid assessment models, as described in Chapters 15-17. 

23.28.1 Hazardous events 

In marine transport, ships are at risk as the port approaches, 
in the port and during berthing, and whilst loading and 
unloading cargo. Accounts of scenarios of hazardous 
events during these different stages include the generic 
treatments by Solberg and Skramstad (1982), Hough (1983) 
and Cummings and Bradley (1988) as well as specific stu¬ 
dies such as that of Lucas, Roe and Waterlow (1983). The 
studies by Aldwinckle and Slater (1983) on the PASS system 
and by Considine (1983) on the Morecambe Bay pipeline 
also contain relevant material. 

The initial events fall into three broad categories: 
(1) release from cargo tanks, (2) release from a ship-shore 
transfer lines and (3) events associated with ship opera¬ 
tions. The cargo which has been most studied is LNG and 
the following account refers primarily to this. 

There are a number of events which have the potential to 
cause loss of containment of an LNG cargo. Two principal, 
and much studied, events are collision and grounding. 
Other events which have been examined as possible causes 
include: ship structural defects; liquid sloshing in a cargo 
tank; overpressurization of a cargo tank; a spillage on deck 
leading to brittle fracture; a fire on deck; a fire in a cargo 
tank; a fire on the sea; explosion in a cargo tank; an explo¬ 
sion in the engine room; and an explosion external to the 
vessel. Some of these rank as escalation events rather than 
initiating events. 
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A 125,000 m 3 gas carrier would typically have six 
22,000 m 3 cargo tanks.The worst case scenario is a virtually 
instantaneous release of the ship’s whole cargo of LNG, but 
this, whilst not physically impossible, is unrealistic. A more 
common, but still pessimistic assumption is a release from 
one cargo tank. More detailed assessments consider 
the extent of damage from the initiating event under con¬ 
sideration, such as collision or grounding, and estimate the 
flow through the aperture thus created. 

A detailed treatment of release flows and spill sizes is 
given Solberg and Skramstad (1982). The flow from a 
damaged cargo tank depends on the location of the hole. 
The authors present a graph for LNG showing the flow 
from different cargo tanks as a function of hole location, 
hole size and time. 

The location of the hole also affects the total size of the 
spill. The largest spill size is given by a tank penetration at 
sea level. Solberg and Skramstad give another graph 
showing the fraction of the cargo which is released as a 
function of the hole elevation. 

A spill of LNG from a cargo tank may or may not be 
ignited immediately. Solberg and Skramstad mention as 
possible ignition sources in a collision: sparks; heating of 
steel above the methane ignition temperature due to 
absorption of collision energy; and ignition sources present 
in the bow of the striking ship. 

For a spill onto the sea, if there is immediate ignition, a 
large release will give rise to a pool fire. If the release does 
not ignite immediately, a large flammable cloud will form. 
If this cloud is then ignited, the combustion will take the 
form of either a flash fire or a vapour cloud explosion. 
Alternatively, LNG may be spilled within the double hull 
structure of the ship and ignited, resulting again in either 
fire or explosion. 

Solberg and Skramstad suggest that a fire occurring in 
the double hull structure of the ship is likely to be starved 
of oxygen, unless the opening is very large and the spillage 
massive. For a pool fire on the sea beside the ship, they give 
a detailed model, as described below. 

This model indicates that, although a large pool fire will 
raise the temperature of both the outer hull and, after some 
delay, the inner hull, to a value at which some loss of 
strength will occur, this will not necessarily compromise 
the structural integrity of the whole ship. In this respect, a 
spill which is relatively small but prolonged may present 
the greater threat. A much larger fire may be of too short 
duration to induce tank failure. 

The creation of a flammable mixture in the double hull 
structure may result in an explosion.The hull contains void 
spaces interconnected by openings of different size. An 
explosion propagating through these voids could be very 
destructive. For a case where the whole space is filled 
by a mixture within the flammable range, Solberg and 
Skramstad estimate the explosion overpressure as of the 
order of 5-10 bar. 

For a vapour cloud explosion over the sea outside the 
ship’s hull, they consider the effect of the overpressure at a 
distance of twice the radius from the centre of the cloud, 
which they take as about 0.1 bar. Treating the structural 
response as a quasi-static one, this overpressure is low 
compared with the strength of the hull and would not be 
expected to cause damage to the hull structure of the con¬ 
tainment. 

Another principal scenario for a massive spill is rupture 
of the ship-shore transfer system during loading or 


unloading. This event is considered by Lucas, Rowe and 
Waterlow (1983) and Cummings and Bradley (1988); the 
former authors also examine its escalation. Two possible 
causes of failure of the transfer system are failure of the 
expansion bellows and rupture of the transfer arm. A pos¬ 
sible cause of transfer arm rupture is excessive movement 
between the ship and the jetty. 

Estimates of the size of spill which could result from 
transfer system rupture is usually based on the full bore 
flow and the time to shut off the flow. Lucas, Rowe and 
Waterlow quote a transfer flow of 17 te/min and a response 
time to shut-down of 30 s or less. 

These authors identify four ways in which, in principle, 
such a spill might escalate. If LNG is spilled on the deck of 
the ship, this may result in embrittlement and cracking of 
the steel. They conclude, however, that, given the low 
stresses, the cracks would arrest without extending beyond 
the embrittled zone. 

More serious is the third path to escalation, that is, an 
explosion resulting from the entry of the liquefied gas into 
the ballast tanks. Lucas, Roe and Waterlow describe the 
estimation of the resultant overpressure. In a totally con¬ 
fined enclosure, the overpressure generated could be some 
7 bar, which is well in excess of the pressure which most 
structures will withstand unless specifically designed to 
do so. However, commonly some weaker section fails and 
vents, thus reducing the pressure attained. Moreover, a 
high water level in the tanks tends to reduce the over¬ 
pressure. The authors describe studies in which the over¬ 
pressures calculated ranged from 0.07 bar for high water 
levels to 2 bar for nearly empty tanks, and other studies 
which indicated that in the absence of embrittlement by 
LNG such explosions would be unlikely to cause damage to 
the cargo tank. 

The fourth path to escalation which these authors 
consider is an explosion in the engine room. In general, 
no scenario for engine room explosion was identified 
which could cause cargo tank failure other than entry of 
a large quantity of flammable gas. For the latter case, use 
was made of wind tunnel modelling and explosion 
simulation. It was concluded that in the worst case, the 
peak overpressure in the engine room could be some 6 
bar, which compares with a cargo tank failure pressure 
of 3-4 bar. 

Events which may occur associated with operations 
on the ship are described by Cummings and Bradley 
(1988). They include (1) ignition of a vapour plume from 
a cargo tank, (2) improper control of ballasting/debal¬ 
lasting operations and (3) rollover of LNG in the cargo 
tank. 

The foregoing account has dealt with LNG. LPG pre¬ 
sents a broadly similar set of hazards. Some relevant dif¬ 
ferences are that it is not so deeply refrigerated and that it 
is more likely than methane to give a vapour cloud 
explosion. 

Other materials may have their own characteristic 
hazards. Thus, a monomer may undergo a runaway poly¬ 
merization reaction. Monomers are stabilized using an 
inhibitor but Cummings and Bradley refer to work on the 
risk that delays at sea may cause the inhibitor to become 
exhausted. 

23.28.2 Hazard models 

As already mentioned, one of the first sets of hazard mod¬ 
els for marine transport was the Vulnerability model (VM) 



TRANSPORT 23/85 


of Eisenberg, Lynch and Breeding (1975) and of other 
workers. This included constituent models for evaporation 
of pools on water, gas dispersion, pool fires, flash fires and 
vapour cloud explosions. 

Another set of hazard models which has been applied to 
marine transport is that of Considine and Grint (1985). 
These authors present convenient parameterizations of a 
number of models widely used in hazard assessment, 
including models for heavy gas dispersion, pool fires, flash 
fires and vapour cloud explosions. 

Whilst such sets of hazard models constitute a basic 
toolkit, other models also are required for hazard assess¬ 
ment. Treatments of collision and grounding have been 
described in Section 23.18. 

Models are also required for the effect of fire outside the 
ship’s hull on the integrity of the cargo tanks. Such models 
have been described by Solberg and Skramstad. The set of 
models given by these authors covers: the size and duration 
of a pool fire beside the hull as a function of the size of hole 
in the damaged cargo tank; the heat flux from such a fire as 
function of the fire base diameter; the heat flux received by 
the ship’s deck; and the unsteady-state temperature pro¬ 
files of the outer and inner hulls. 

Another group of models is that for explosions in con¬ 
fined spaces such as between the inner and outer hulls and 
in ballast tanks. These include both models for the over¬ 
pressures generated in a confined explosion and for the 
damage caused by such an explosion. The former may be 
analytical models or explosion simulation codes. 


23.28.3 Some hazard assessments 

As already described, there have been a considerable num¬ 
ber of hazard assessments for marine transport, covering 
shipping, ports and terminals. 

An early generic study was that given in the vulner¬ 
ability model by Eisenberg, Lynch and Breeding (1975), as 
described in Chapters 16-18. 

A hazard assessment of marine transport at an oil termi¬ 
nal at the Deep Water Port, Galveston, Texas, has been 
described by Bergmann and Riegel (1983). The scenarios 
considered were collisions and groundings, giving rise to a 
fire or explosion. 

The authors’ estimates of the frequencies and prob¬ 
abilities of these events are as follows. The frequencies of 
collision and grounding are estimated, respectively, as 


that where an explosion occurs, between 29% and 94% of 
the cargo tanks become involved, but that where a fire 
occurs some 10-13% of the cargo is spilled and burned. 
They take the proportion of cargo involved as 36% for an 
explosion and 12 % for a fire. 

Bergmann and Riegel have developed event trees for the 
three scenarios of collision, grounding and dockside fire/ 
explosion. They assess the effects of explosion using the 
methods of W.E. Baker et al. (1978), including correlations of 
overpressure vs scaled distance for a fuel-air explosive and 
of damage in terms of the pressure-impulse diagram. For 
fire, the treatment is largely concerned with firefighting and 
mitigatory measures, and appears essentially qualitative. 

The two Canvey Reports, described in Appendix 7, cover 
marine risks, including collision, grounding and loading/ 
unloading, and give a full assessment of individual and 
societal risks. 

A further hazard assessment of marine transport at the 
British Gas LNG terminal at Canvey is described by Lucas, 
Rowe and Waterlow (1983). This study details the various 
hazard scenarios, as described in Section 23.28.1, and gives 
an engineering assessment of each one. As a result of this 
assessment, some postulated scenarios are rejected, whilst 
others are accepted and countermeasures are described. 
For example, it is concluded that failure of the bellows 
expansion units in the ship-shore transfer line would be 
manifested by a small crack rather than sudden rupture, 
and that the latter is not a credible failure mechanism. 
Likewise, major failure due to low temperature brittle 
fracture following LNG spillage on the ship’s deck is dis¬ 
counted. Further, a fire on deck or on the sea is not expected 
to cause failure or overpressure of the inner hull. On the 
other hand, the authors do consider to be credible explo¬ 
sions in the ballast space or, with ingress of flammable 
vapour, in the engine room. They describe various meas¬ 
ures taken to counter these hazards such as improved 
emergency shut-down, deck protection and engine room 
explosion relief. 

One countermeasure described is to arrange that in 
operation the man-way hatches to each ballast tank are 
closed, though not secured. This, it was calculated, would 
allow sufficient pressure to build up as the first LNG 
entering the tank vaporizes that further entry of LNG 
through cracks would be inhibited. This is an example of 
the exploitation of the characteristics of the initial event to 
prevent escalation. 


Casualty type 

Frequency of 

Probability of 

Probability of 

Probability of explosion 


casualty 

spill (spills/ 

fire (fires/ 

(explosions/movement) 


(casualties/movement) 

movement) 

movement) 


Collision 

1.5 x 10“ 4 

4.3 x 10“ 5 

4.4 x 10 -s 

1.6 x 10“ 5 

Dockside fire/explosion 

1.4 x 10“ 4 

9.8 x 10“ 7 

1.0 x 10“ 5 

3.7 x 10“ 6 


1.5 x 10~ 4 /movement and 3.5 x 10~ 4 /movement, and the 
probabilities, given collision, of spill, fire and explosion as 
0.25,0.33 and 0.1. They give the following figures: 

They take as negligible the probability that, given a soft 
bottom with no hard underwater object, a grounding would 
result in a spill or fire. 

The authors found that for collisions only one in 23 spills 
resulting in fire propagated into an explosion, but that all 
explosions had resulted in spill and fire. Records indicate 


The authors comment that whilst a full quantitative risk 
assessment (QRA) has its place, in many instances, most of 
the benefits may be obtained from the detailed engineering 
analysis which should in any case be part of a good QRA. 
It is often more fruitful to put effort into discovering 
unidentified problems rather than into quantifying those 
already identified. This should be done in cooperation 
with the engineers involved in the design and operation 
of the system. 
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The ACDS Transport Hazard Report gives a set of hazard 
assessments for specific ports and utilizes this to obtain an 
assessment of national societal risks. 

23.29 Transport Hazard Assessment: 

Comparative Risks 

There have been a number of hazard assessments which 
have sought to determine the relative risks of different 
modes of transport, of the transport of different chemicals, 
or of transport in different countries. 

An early study of this nature was that of Westbrook 
(1974), described in Chapter 18, on the risks of chlorine 
transport by road, rail and pipeline. 

Ormsby and Le (1988) give frequency-number (FN) 
curves for the transport of natural gas, gasoline, LPG 
chlorine and ammonia in the United States, and also make 
comparisons with other parts of the world. For LPG, the 
dominant large event is the one that occurred at San Carlos. 
The study by Haastrup and Brockhoff (1990), described 
earlier, gives FN curves for transport in North America, 
Western Europe and other countries. 

Sellers and Bendig (1989) have described a comparative 
study for transport by road and pipeline associated with 
two terminals. 

The most comprehensive comparison of the risks of road 
vs rail is that given in the ACDS Transport Hazard Report. 
As described in Appendix 17, this study concludes that 
at least for the United Kingdom and for the four study 
substances, there is no basis for preferring one of these 
modes of transport to the other. 

23.30 Security Issues 

The US DoT issued HM 232 Final Rule, ‘Transportation 
Security’ on March 25,2003. 

23.30.1 Enhanced security requirements 

September 11,2001, brought home the reality of terrorism to 
all Americans. The terrible events of that day and the later 
anthrax scare, along with earlierbombings at the WorldTrade 
Center in 1993 and in Oklahoma City in 1995, mean that we all 
need to play our part in combating terrorism in order to 
maintain the type of lifestyle we enjoy. The DoT’s RSPA is 
responsible for the safe and secure transportation of hazard¬ 
ous materials. Hazardous materials are essential to the econ¬ 
omy of the United States and the well-being of its people. 

Since 11 September 2001, RSPA has worked closely with 
hazardous materials shippers and carriers, as well as 
Federal, state, and local government agencies, to improve 
the security of hazardous materials in our Nation’s trans¬ 
portation system. There are two strategies that are critical 
to managing transportation security risks. The first is to 
develop and implement security plans. The second is 
to assure that employees who handle and transport hazard¬ 
ous materials are trained to recognize and react to potential 
security problems. RSPA has established new security 
requirements that make use of these two strategies for 
hazardous materials transported in commerce. 

20.30.2 Hazardous materials transportation enhanced 
security requirements 

Companies must develop and implement a security plan if 
they offer for transportation or transport the following 
types or quantities of hazardous materials: 


(1) A hazardous material in an amount that must be plac¬ 
arded in accordance with the Hazardous Materials 
Regulations; 

(2) A hazardous material in a bulk packaging hav¬ 
ing a capacity equal to or greater than 13,248 T 
(3500 gallons) for liquids or gases or more than 
13.24 m -3 (468 cubic feet) for solids; or 

(3) A select agent or toxin regulated by the Centers for 
Disease Control and Prevention under 42 CFR part 73. 

At a minimum, the security plan must include the following 
elements: 

(1) Personnel security; 

(2) Unauthorized access; 

(3) En route security. 

The security plan must be in writing and must be retained 
for as long as it remains in effect and must be revised as 
necessary to reflect changing circumstances. 

23.30.3 Training 

Companies must provide training to their employees who 
are responsible for implementing the security plan. This 
training should cover the following topics. 

20.30.4 Security plans 

(1) Company security objectives; 

(2) Specific security procedures; 

(3) Employee responsibilities; 

(4) Actions to take in the event of a security breach; and 

(5) Organizational security structure. 

In addition, all hazmat employees - that is, employees 
who directly affect hazardous materials transportation 
safety — must receive training that provides an aware¬ 
ness of the security risks associated with hazardous 
materials transportation and methods to enhance trans¬ 
portation security. This training should also include a 
component that covers how to recognize and respond to 
possible security threats. 

The following guidance should assist you in developing 
a security plan appropriate to your industry and opera¬ 
tions. Even if you are not covered by the security plan 
requirements in the Hazardous Materials Regulations, you 
may want to review your current security programme and 
make any necessary adjustments to improve it. 

Begin with a security assessment 
To develop a security plan, a company should begin with a 
security assessment. List the materials they handle and 
identify those with the potential for use as a weapon or 
target of opportunity. Then, review their current activities 
and operations from a transportation security perspective. 
A security risk assessment model can be used to identify 
security risks and develop appropriate measures to reduce 
or eliminate those risks. 

A Security Template found on RSPA’s hazmat safety home- 
page (http://hazmat.dot.gov) utilizes the following steps: 

(1) Scoping - determine the scope of operations that 
should be subject to security risk management. Iden- 
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tify the types of hazardous materials handled and the 
modes of shipment used. 

(2) Knowledge of operations - collect detailed informa¬ 
tion about the company’s transportation operations: 

(1) quantities of material transported; (2) baseline 
security programmes; (3) current security proce¬ 
dures; and (4) related safety programmes and proce¬ 
dures. 

(3) Assessment - analyse potential security threats and 
identify security risk control points. Risk control 
points are points in the transportation process where 
the company can make an impact by improving pro¬ 
cedures or operations. 

(4) Strategy - rank or group security risks, prioritize 
opportunities for security risk reduction, and decide 
on preventative actions. Create a written document 
summarizing these decisions which becomes the 
company’s security plan. 

(5) Action - implement the security plan. 

(6) Verification - monitor implementation of the security 
plan. 

(7) Evaluation - determine if goals are being met and 
benchmark strategy and results with other companies. 


Suggested security measures 

The following are specific security measures that could be 
considered for inclusion in a security plan. At a minimum, 
a security plan must include the following elements: per¬ 
sonnel security, unauthorized access, and en route security. 

Personnel security 

Be aware of the possibility that an employee may pose a 
potential security risk. Establish a process to confirm the 
information provided by applicants on application forms or 
resumes, including checking with former and current 
employers, and personal references provided by job appli¬ 
cants. Such confirmation must be consistent with appli¬ 
cable Federal and State laws and requirements concerning 
employment practices and individual privacy. Employees 
can be one of the most critical assets for insuring the 
security of shipping or transportation operations. Under 
the new RSPA security requirements, employees must be 
familiar with the security plan and are properly trained in 
its implementation. Training should include company 
security objectives, specific security procedures, employee 
responsibilities, and organizational security structure. In 
addition, consideration should be given to taking one or 
more of the following actions: 

(1) Encourage employees to report suspicious incidents 
or events. 

(2) Implement routine security inspections. 

(3) Convene regular employee/management meetings on 
security measures and awareness. 

(4) Communicate with employees using an internal commu¬ 
nication system to provide information on facts, trends 
and other security issues. Because Internet communica¬ 
tions may be accessed by others, consider alternative 
methods for communicating sensitive information. 


Unauthorized access 

Access to hazardous materials in transportation and to a 
facility should be another security concern. Consider uti¬ 


lizing one or more of the following security measures to 

prevent unauthorized access: 

(1) Establish partnerships with local law enforcement 
officials, emergency responders, and other public 
safety agencies with jurisdiction over the facility 
Through such relationships, exchange information 
about threats, trends, and unsuccessful security 
programmes. 

(2) Request a review of the facility and security pro¬ 
gramme by local law enforcement and fire safety 
officials. 

(3) Restrict the availability of information related to the 
facility and the materials handled. Encourage 
authorities in possession of information about the 
facility to limit disclosure of that information to a 
need-to-know basis. 

(4) Add perimeter security and increase off-hour secu¬ 
rity patrols. Request that law enforcement personnel 
increase off-hour patrols. 

(5) Check the adequacy of locks and other protective 
equipment. Consider equipping access gates with 
timed closure devices. Conduct frequent inspec¬ 
tions. 

(6) Install additional lights, alarm systems, or surveil¬ 
lance cameras. 

(7) Restrict access to a single entry or gate. 

(8) Place limits on visitor access, especially when the 
Homeland Security Alert System raises its threat 
level; require visitors to register and show photo 
identification, and have someone accompany visi¬ 
tors at all times. 

(9) Require employees to display identification cards or 
badges. 

(10) Conduct security spot checks of personnel and 
vehicles. 

(11) Upgradesecurity procedures for handling pick-ups 
and deliveries at the facility. Verify all paperwork 
and require pick-ups and deliveriesbe handled only by 
appointment with known vendors. Require that ven¬ 
dors call before a delivery and provide the driver’s 
name and vehicle number. Accept packages and 
deliveries only at designated locations at the facility. 

(12) Secure hazardous materials in locked buildings or 
fenced areas. Have a sign-out system for keys. 

(13) Secure valves, manways, and other fixtures on 
transportation equipment when not in use. Lock all 
vehicle and delivery trailer doors when not in use. 
Secure all rail, truck, and intermodal containers 
when stored on site. Use tamper-resistant or tamper- 
evident seals and locks on cargo compartment 
openings. 

(14) Periodically inventory the quantity of hazard¬ 
ous materials in order to recognize if a theft has 
occurred. 

(15) Keep records of security incidents. Review records to 
identify trends and potential vulnerabilities. 

(16) Report any suspicious incidents or individuals to 
your local Federal Bureau of Investigation (FBI) 
office and to local law enforcement officials. 


En route security 

Shippers and carriers should work together to assure the 
security of hazardous materials shipments en route from 
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origin to destination. Shippers should assess the security 
of transportation modes or combinations of modes avail¬ 
able for transporting specific materials and select the 
most appropriate method of transportation to ensure their 
efficient and secure movement. Know the carrier and have 
a system for qualifying the carriers used to transport 
hazardous materials. Consider implementing one or more 
of the following measures: 


(1) Use carrier safety ratings, assessments, safety sur¬ 
veys, or audits, and ask the carrier to provide infor¬ 
mation on security measures it has implemented. 

(2) Verify that the carrier has an appropriate employee 
hiring and review process, including background 
checks, and an ongoing security training programme. 

(3) Verify the identity of the carrier and/or driver prior 
to loading a hazardous material. 

(4) Ask the driver for photo identification and a com¬ 
mercial driver’s license for comparison with infor¬ 
mation provided by the carrier. 

(5) Ask the driver to tell you the name of the consignee 
and the destination for the material and confirm with 
your records before releasing shipments. 

(6) Identify preferred and alternative routing, including 
acceptable deviations. 

(7) Strive to minimize product exposures to communities 
or populated areas, including downtown areas; 
avoid tunnels and bridges where possible; and expe¬ 
dite transportation of the shipment to its final 
destination. 

(8) Minimize stops en route; if you must stop, select 
locations with adequate lighting on well-travelled 
roads, and check your vehicle after each stop to make 
sure nothing has been tampered with. 

(9) Consider using two drivers or driver relays to mini¬ 
mize stops during the trip. Avoid layovers, particu¬ 
larly for high hazard materials. 

(10) Shippers and rail carriers should cooperate to assure 
the security of rail cars stored temporarily on leased 
tracks. 

(11) If materials must be stored during transportation, 
make sure they are stored in secure facilities. 

(12) Train drivers in how to avoid high jacking or stolen 
cargo - keep vehicles locked when parked and avoid 
casual conversations with strangers about cargoes 
and routes. 

(13) Consider whether a guard or escort for a specific 
shipment of hazardous material is appropriate. 

(14) Consider using advanced technology to track or 
protect shipments en route to their destinations. For 
example, you may wish to install tractor and trailer 
anti-theft devices or use satellite tracking or sur¬ 
veillance systems. As an alternative, consider fre¬ 
quent checks with drivers by cell phone to ensure 
everything is in order. 

(15) Install tamper-proof seals on all valves and package 
or container openings. 

(16) Establish a communication system with transport 
vehicles and operators, including a crisis commu¬ 
nication system with primary and back-up means 
of communication among the shipper, carrier, 
and law enforcement and emergency response 
officials. 


(17) Implement a system for a customer to alert the ship¬ 
per if a hazardous materials shipment is not received 
when expected. 

(18) When products are delivered, check the carrier’s 
identity with shipping documents provided by the 
shipper. 

(19) Get to know your customers and their hazardous 
materials programmes. If you suspect you have 
shipped or delivered a hazardous material to some¬ 
one who may intend to use it for a criminal purpose, 
notify your local FBI office or local law enforcement 
officials. 

(20) Report any suspicious incidents or individuals to 
your local FBI office and to local law enforcement 
officials. 


Additional information 

Up-to-date information is a key element of any security 

plan. Companys should consider methods to: 

(1) Gather as much data as they can about their own 
operations and those of other businesses with similar 
product lines and transportation patterns. 

(2) Develop a communications network to share best 
practices and lessons learned. 

(3) Share information on security incidents to determine 
if there is a pattern of activities that, when considered 
in isolation are not significant, but when taken as a 
whole generate concern. 

(4) Revise security plans as necessary to take into account 
changing circumstances and new information. 


23.30.5 C-TPAT - Customs-Trade Partnership Against 
Terrorism 

C-TPAT is a joint government-business initiative to build 
cooperative relationships that strengthen overall supply 
chain and border security. C-TPATrecognizes that Customs 
can provide the highest level of security only through close 
cooperation with the ultimate owners of the supply chain, 
the importers, carriers, brokers, warehouse operators and 
manufacturers. Through this initiative, Customs is asking 
businesses to ensure the integrity of their security prac¬ 
tices and communicate their security guidelines to their 
business partners within the supply chain. 

Businesses must apply to participate in C-TPAT. Parti¬ 
cipants will sign an agreement that commits them to the 
following actions: 

(1) Conduct a comprehensive self-assessment of supply 
chain security using the C-TPAT security guidelines 
jointly developed by Customs and the trade commu¬ 
nity. These guidelines, which are available for review 
on the Customs website, encompass the following 
areas: Procedural Security, Physical Security, Per¬ 
sonnel Security, Education and Training, Access 
Controls, Manifest Procedures, and Conveyance 
Security. 

(2) Submit a supply chain security profile questionnaire 
to Customs. 

(3) Develop and implement a programme to enhance 
security throughout the supply chain in accordance 
with C-TPATguidelines. 
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(4) Communicate C-TPAT guidelines to other companies 
in the supply chain and work towards building the 
guidelines into relationships with these companies. 

C-TPAToffers businesses an opportunity to play an active 
role in the war against terrorism. By participating in this 
first worldwide supply chain security initiative, companies 
will ensure a more secure supply chain for their employees, 
suppliers and customers. Beyond these essential security 
benefits, Customs will offer potential benefits to C-TPAT 
members, including: 

(1) A reduced number of inspections (reduced border 
times). 

(2) An assigned account manager (if one is not already 
assigned). 

(3) Access to the C-TPAT membership list 

(4) Eligibility for account-based processes (e.g. 
bimonthly/monthly payments). 

(5) An emphasis on self-policing, not Customs verifica- 


C-TPAT is currently open to all importers and carriers (air, 
rail, sea). C-TPAT membership will be made available to all 
sectors of the supply chain. Customs will be consulting 
with the trade community to develop the most effective 
approach for each sector to participate in C-TPAT. 
http: //www. geosbush.com/ctpat.htm. 

23.31 Notation 

Section 23.4 

Subsection 23.4.7 

A a fractional minimum elongation of metal on frac¬ 
ture under tensile stress 
D internal diameter of shell (mm) 

e thickness of metal (mm) 

P calculation pressure (bar) 

R m minimum tensile strength 

X constant 

a permissible stress (N/mm 2 ) 

Subscripts 
0 mild steel 

1 metal under consideration 

Subsection 23.4.12 
<fi 5 density of liquid at 15° C 

d 50 density of liquid at 50°C 

DF degree of filling (%) 

tp mean temperature of liquid at time of 

filling fC) 

oo amean coefficient of cubical expansion 

of liquid between 15°C and 50°C 
X parameter (%) (see text) 

Section 23.5 

C confidence limits on value of liquid 

density (%) 

FR filling ratio 

Pi density of liquid 

P w density of water 


X parameter (see text) 

Section 23.6 
Equations 23.6.1-23.6.7 
I normal distribution parameter 

P probability 

x impact speed 

x mean impact speed 

a standard deviation 

Superscript 


Subscript 

c combined 

Equations 23.6.8—23.6.11 
E energy absorbed in collision 

mi mass of first vehicle 

« 2 mass of second vehicle 

v residual velocity of two vehicles after collision 

Vi impact velocity of load 

Vi initial velocity of first vehicle 

v 2 initial velocity of second vehicle 

Subscript 
cr critical 

Section 23. 11 

Equation 23.11.1 
C cost 

k constant 

n index 

P throughput 


Equation 23.11.2 
a design factor 

D external diameter of pipe (mm) 

/ y specified minimum yield 

strength (N/mm 2 ) 

p internal design pressure above 

atmospheric (bar) 

t design thickness of pipe wall (mm) 


Section 23.18 

c constant 

E energy absorbed in collision 

Ei energy absorbed by fender 

K absorbed energy coefficient 

L length of damage 

m constant 

mi effective mass of striking ship 

m 2 effective mass of struck ship 

dm hydrodynamic mass 

P depth of damage 

R ratio defined by Equation 23.18.6 

P T resistance factor 

t thickness 

Vcr critical value of speed of striking ship 

before collision 
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Vi speed of striking ship before collision 

residual speed of two ships after 
collision 
Subscripts 

cr critical value 

n n\h member in struck ship 


N Mh member in striking ship 

1 striking ship 

2 struck ship 
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24/2 EMERGENCY PLANNING 


There is a considerable body of work on disasters of various 
kinds, both natural and man-made, and, whilst much of 
this may be only marginally relevant to process plant 
emergencies, it is helpful to have some awareness of this 
background (Table 24.1). 


Table 24.1 Selected references on emergency planning 


Disaster planning 

BSC (n.d./2); Prentiss (1951); Featherstone (1962); Ministry 
of Health (1962); Grosser et al. (1964); H.B. Williams (1964); 
Inbbar (1965); Healy (1969); Chatham-Savannah Defense 
Council (1971); Home Office (1972); Office of Emergency 
Preparedness (1972); Puget Sound Council of Governments 
(1975); J.W Richardson (1975); W.H. Gibson (1976); J. Howard 
(1976); League of Red Cross Societies (1976); Manning 
(1976); Abe (1978); Quarantelli (1978); de Boer and Baillie 
(1980a,b); H.D. Foster (1980); Frey and Safar (1980); 
Smulders (1980); Whittow (1980); Geipel (1982,1991); 

R. Jackson (1986); May and Williams (1986); Society of 
Industrial Emergency Services Officers (1986); Theodore, 
Reynolds and Taylor (1989); Dupont,Theodore and 
Reynolds (1991); M.A. Hughes (1991); D.J. Parker and 
Handmer (1992) 

Works emergency planning 

MCA (SG-4); NRC (Appendix 28 Emergency Response, 
Emergency Planning)-, Anon. (1961b); Labine (1961); 
Tenneco Oil Co. (1964b); Kling (1965); D.T. Smith (1967); 
Fowler and Spiegelman (1968); Gilmore (1968); Bennett 
(1972); van Cleve (1973); Hunter (1973); Hydrocarbon 
Processing Editors (1973); IRI (1973/9); PITB (1973/4); 

K. Wright (1973); Associated Octel (1974 Bklt 20/74); 
Brannon (1974,1976); Bruce and Diggle (1974); Duff and 
Husband (1974); Maas (1974); CIA (1976 RC20,1991RC31, 
RC47); CISHC (1976/6); Diggle (1976); Underwood, 
Sourwine and Johnson (1976); Chlorine Institute (1977 
FIRE, 1982 Pmphlt 64,1985 OPFLOW); H.R. Hill, Bruce 
and Diggle (1977); Searson (1977); Webb (1977); API (1978 
Publ. 2025); Harvey (1979b); Blanchard (1980); Melancon 
(1980); Willems (1980); Davenport (1981a); DnV (1981RP 
C106); Isman (1981); Lihou (1981LPB 42); E. Wilson (1981); 
Ranby and Hewitt (1982); G. Martin (1984); Burgoyne 
(1985c); HSE (1985 HS(G) 25); Husbands (1985); Lynskey 
(1985,1985 LPB 61);Vervalin (1985a); IBC (1986/67,1989/76); 
Marlier and Roure (1986); Walford (1986); Wfflcock (1986); 
CONCAWE (198711/87,1988 6/88,1989 2/89); K a linins 
(1987); Mullins (1987 LPB 87); O’Reilly (1987); AIHA 
(1988-/13); Cassidy and Pantony (1988); ILO (1989); 
Kharbanda and Stallworthy (1989); Lakey (1998); ACGIH 
(1989/35); Marlier (1989);Tavel, Maraven and Taylor (1989); 
Phong (1990); AGA (1991/74,75); Essery (1991); Ham and 
Gansevoort (1992); Key worth, Smith and Archer (1992); 
Marsden, Ferrario and Green (1992); J.N. Scott (1992); Zika 
and Matyas (1992); Schulein, Kloet and Stolk (1993) 

Off-site aspects: Quarantelli etal. (1979); Gabor and 
Griffiths (1980); J. Gray (1981); J. Gray and Quarantelli 
(1981); Tierney (1981,1982); CIA (1984 RC20a); Quantarelli 
(1984); HSE (1986b); Bellamy and Harrison (1988); Cassidy 
and Pantony (1988); de Larderei (1988); NSW Government 
(1988); Pietersen (1988b, 1993); Egol (1989a); ILO (1989); 
Belanger (1990); J. Singh and McBride (1990); C.R. Young 
(1990); Essery (1991); Rogers and Sorenson (1991); 
Ruggiero, Macchi and Morici (1992); S. Wilson (1992,1993); 


Callen, Dipema and Miller (1993);Thwaites (1993); Stephan 
(1994) 

Evacuation: Hans and Sell (1974); Ikeda (1982) Lynskey 
(1985); Purdy and Davies (1985,1985 LPB 65); Fitzgerald 
(1991 LPB 97); Essery (1993) 

Gas dispersion hazards: Ryckman and Peters (1982); 

M.E. Smith etal. (1983); Purdy and Davies (1985,1985 LPB 
62,63); McNaughton, Worley and Bodner (1987); 
Chikhliwader and Gelinas (1988); Ginnity (1988); Bais, 
Zerefos and Ziomas (1989); Rusch (1993); J.R. Taylor (1993) 

Drabek (1969); B.E. Fisher (1978a,b, 1980b); C.S. Lees 
(1985) 

Fire services (see alsoTable 16.2) 

Central Fire Brigades Advisory Council (1978); Gebhardt 
(1984); Beech (1985); Stephan (1994) 

Medical services 

Savage (1971,1977,1979); J.W. Richardson (1975); 

W.H. Rutherford (1975); Fozard (1976); Baskett and Zorab 
(1977); Easton (1977a,b); Lea (1977); Plewes and Kindle 
(1977); Snook (1977); Blanshan (1978); D.J. Williams (1979); 
de Boer and Baillie (1980a,b); Smulders (1980); Lessenger 
(1985); Thornley (1985) 

Computer aids (seeTable 29.1) 

Transport emergencies 

MCA (CC-l-CC-87); M.M. Anderson (1971); M.T. Miller 
(1971); Scanned (1971); Boardman (1972); Franklin (1972); 
Hess (1972); Benner (1975b); Cumberland and Hebden 
(1975); Ashton and Butcher (1976); McNeil (1976); Mesler 
(1976); BCGA (1977 GN1); Camm (1977); W.E. Clayton (1977); 
Mansfield (1977); Zajic and Himmelman (1978); Nimptsch 
(1979); Bosnian (1980); Hart (1980); Somerville (1981); 
ASTM (1983 STP 825,1990/1); Anon. (1984); Cooney (1985, 
1991); Mascone (1986); O’Reilly (1987); Cashman (1988); 
CONCAWE (1988 5/88,1989 7/89); Lakey (1988); 
Saccomanno and Allen (1988); Lycett etal. (1989); Rogers 
and Sorensen (1989); Quarantelli (1991); Sorensen, Carnes 
and Rogers (1992); Browne (1993); Stephan (1994) 

Hazard information systems 

Anon. (1986p); Cahffl (1989 LPB 85) 

Data sheets, Chem Cards: MCA (CC and CIC series); 
Bigelow (1970,1971) 

HAZCHEM: Home Office (n.d./6); London Fire Brigade 
(1973);Walmsley(1973);CIA(1975);FPA(1989CFSDFS6041) 
TREMCARDS: CIA (n.d./2); Walmsley (1973,1974) 
National Chemical Emergency Centre: Cumberland (1978); 
Goodwin (1984);WC.J. White (1985) 

Emergency response 

Road: IP (1989/1); API (1992 RP 1112) 

Rail: Barren (1971); Cato and Dobbs (1971); O’Driscoll 
(1975a); A.D. Williams and Catalan (1976) 

Pipeline: API (1991 RP 1122) 

Sea: Sohnke (1971); Balemans (1975); H.D. Williams (1975); 
Preston (1983) 

Fire services: Hayes (1971); F. Taylor (1975) 

Emergency, mutual aid schemes 

Gabor (1991) 

HI scheme: Bigelow (1970,1971); Sylvia (1972a, 1974); Anon. 
(1973a) 
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G Centres: ICI (n.d.a);Walmsley (1973) 

CHEMSAFE: CIA (1973/6.1991 RC32); Moddrel (1977) 
CHEMTREC: Bigelow (1970,1971); Rosenhah and Cole 
(1973); Zercher (1975,1976); Anon. (1994e); Resen (1986); 

E. Meyer (1989); Donahue (1994) 

CHRIS: G.H. Brown (1976) 

Chloraid: CIA (1983,1992 RC48); Carr (1986) 

CAER: Vervalin (1985b); Mascone (1986) 

Particular chemicals 

Ammonia: Cato and Dobbs (1971); Luddeke (1975); Greiner 
(1984); Lessenger (1985) 

Chlorine: R.L. Mitchell (1971); Carr (1986); CIA (1992 RC48) 
Missisauga incident: Whitaker (1980); Wignal and Leek 
(1980); Fordham (1982 LPB 44) 

Hydrogen cyanide: Gemmill (1961b) 

LPG: Anon. (1984v). 

Vinyl chloride: Dowell (1971) 

Glendora incident: Dowell (1971); Kogler (1971) 

Radioactive materials: Lindell and Perry (1980) 

Spectators 

Hymes (1985 LPB 65) 

Public relations, community impact, 
community response 

Essex County Council (n.d.); MCA (SG-12); Segaloff (1961); 
D.T. Smith (1967); Koran (1970); Nesmith (1970); Vervalin 
(1970); CISHC (1976/6); Attwood (1977);Windscale Local 
Liaison Committee (1979); CIA (1980); J. Gray (1981); J. Gray 
and Quarantelli (1981); Preece (1982); Walker (1982); 

J. Harris (1985) 

Aftermath 
Geipel (1982,1991) 

Stress, including post-traumatic stress disorder: Weisaeth 
(1988,1992); Gill and Picou (1991) 

Land reclamation: SCI (1980); Pratt (1993) 


Accounts of this work include Emergency and Disaster 
Planning (Healy, 1969), Disaster Preparedness (Office of 
Emergency Preparedness, 1972), Disaster Technology 
(Manning, 1976), Disaster Planning (H.D. Foster, 1980), 
Types and Events of Disasters Organization in Various Dis¬ 
aster Situations (Frey and Safar, 1980), Disasters (Whittow, 
1980), Disaster Policy Implementation (May and Williams, 

1986) , Accident and Emergency Management (Theodore, 
Reynolds and Taylor, 1989) and Hazard Management and 
Emergency Planning Perspectives in Britain (D.J. Parker and 
Handmer, 1992). 

In the United Kingdom, the Disaster Prevention and 
Limitation Unit (DPLU) at the University of Bradford is a 
specialist resource on disasters. Another is the Disaster 
Research Center, Ohio State University, and latterly the 
University of Delaware in the United States. 

For the process industries specifically, relevant materials 
are Highly Hazardous Spills and Emergency Planning (Zadic 
and Himmelman, 1978), Guide to Emergency Planning 
(Society of Industrial Emergency Services Officers, 1986) 
and Emergency Response to Chemical Accidents (O’Reilly, 

1987) . 

24.1 Introduction 

Process safety of a chemical plant encompasses several 
layers of protection. Control measures, shut-down systems, 
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Figure 24.1 Components of emergency planning 


release absorption, accumulation of releases by dikes, and 
protection by barriers. These layers of protection are 
intended to prevent an event from propagating into severe 
consequences because of deviations from normal operation 
conditions. Emergency response is the last layer of protec¬ 
tion that is intended to control an event if possible, or to 
reduce consequences in cases of loss of control. However, a 
reliable response to an emergency event requires planning. 
The three components of emergency planning are pre¬ 
sented in Figure 24.1. 

Much of the material in the preceding chapters has been 
concerned with reducing the scale and frequency of 
hazards. Nevertheless, there remains for any hazard a finite 
possibility that it will be realized. It is necessary, therefore, 
to plan for such emergencies. Emergency planning is an 
integral and essential part of the safety and loss prevention 
strategy. Its objective is to mitigate the consequences of any 
incident that may occur. 

The probability of the realization of a hazard is evaluated 
by a relatively sophisticated procedure, as already described. 
It is not then logical to assume that if this occurs, the worst 
consequences will necessarily follow. It is more appropriate 
to take a probabilistic approach to the evaluation of the 
consequences also. 

There are two main types of emergencies with which 
the chemical industry is concerned. These are the works 
emergency and the transport emergency. They are some¬ 
what different and require separate treatment. Whatever 
the type of emergency plan, the overall message is that it 
should be kept simple and flexible, but capable of being 
scaled up or down as circumstances demand. 

24.2 On-site Emergency Planning 

24.2.1 An overview 

Unanticipated circumstances may yield emergency 
events. Emergency planning adds an additional layer of 
protection to circumstances where all of the other layers of 
protection failed to prevent the incident. Figure 24.1 
demonstrates the three major components of emergency 
planning 

Emergency preparedness process begins with iden¬ 
tification of credible scenarios for which appropriate 
response strategies are developed. The analysis of resour¬ 
ces and capabilities of facilities to respond to the emer¬ 
gency scenarios is part of the preparedness stage. This 
analysis examines the resources and the capabilities at 
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the facilities, at neighbour sites, and the resources that 
are available at the local community. The development 
of resources is conducted according to the resources 
assessment and the potential of cooperation among site 
emergency responders, neighbouring facilities, and 
neighbouring communities. 

As mentioned above, at least three separate parties are 
involved in emergency situations, in addition to the net¬ 
work within the facility Therefore, communication sys¬ 
tems are crucial to successful execution of emergency plans 
in real-time situations as well as in drills. 

The complex nature of emergency events requires a very 
clear hierarchy of command, and a procedure without any 
ambiguities. It is extremely important that every position 
in the hierarchy is assigned to personnel with the appro¬ 
priate skills and personality. Training and assessment of 
the potential collaboration among these three groups is 
also extremely important. It is not uncommon for pre¬ 
paredness programmes to be revised based on assessments 
of drill results. 

The development of physical facilities infrastructure 
consists of the following: 

(1) Development of shelters and safe havens. 

(2) Establishment emergency operations centre (EOC). 

(3) Development of emergency communication cap¬ 
abilities. 

(4) Development of appropriate medical support infra¬ 
structure. 

As shown in Figure 24.2, emergency systems are 
developed in parallel with the development of physical 
facilities. The list below consists of typical items in emer¬ 
gency systems; however, it can vary according to special 
circumstances: 

(1) Emergency power supply 

(2) Emergency water supply 

(3) Communication systems 

(4) Emergency management computer support system 

(5) Site and community alert systems 

(6) Adequate incident command transportaion 

(7) Appropriate control room protection measures. 


24.2.2 Identification of credible scenarios 
The problem 

A process hazard evaluation yields a large list of potential 
incidents. This list should be assessed to determine like¬ 
lihood and consequences of each of the events, and then 
prioritized according to the risk associated with these 
events. 

Preparedness for emergencies involving worst case sce¬ 
narios requires enormous resources and may overwelm the 
business operability of the facility. Therefore, the outcome 
for each scenario should be evaluated based on the con¬ 
sequences and probabilities of the scenario. It is important 
to consider management controls in these evaluations. 
Incidents such as instantaneous loss of conainment are a 
major concern in the process inductries. However, mea¬ 
sures, such as control systems, overpressure reliefs, 
alarms, mechanical as well as non-destructive tests reduce 
the likelihood of development of such as scenario. Emer¬ 
gency planning may be effected by local regulations. The 
law may dictate the type of scenarios that emergency 
planning should be address. 

The large number of chemicals along with the large 
number of equipment and the variety of potential incidents 
that can occur from the combinations of chemicals equip¬ 
ment lead to an enormous number of possible scenarios. As 
mentioned earlier, it is impractical to plan for all emergen¬ 
cies, and therefore it is neccesary to analyse and prioritize 
the scenarios. The process of scenario selection and prior¬ 
itization is shown graphically in Figure 24.3. 

Identification of process areas with high hazards 
A large number of techniques are available for the identifi¬ 
cation of areas of major hazards. Dow Fire and Explosion 
Index (F&EI), and Dow Chemical Exposure Index (CEI) are 
examples of techniques that can be used to identify and 
evaluate hazards according to the nature of the substances, 
and other process physical conditions.The US National Fire 
Protection Agency (NFPA) Fire Hazard Indices is a classi¬ 
fication methodology that classifies materials according to 
the reactivity, flammability and their possession of health 
hazards. The results of examination of the plant with these 
techniques will lead to a list of ranked areas that should 
then be analysed to identify credible scenarios. 



Figure 24.2 Emergency preparedness flow chart 
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Figure 24.3 Process of scenario selection for emergency planning 


Credible scenarios 

A variety of techniques are available for identification of 
credible scenarios. The depth of analysis can vary from an 
informal review to a full Process Hazard Analysis session. 
The level of investigation is mainly dependent on the experi¬ 
ence of the reviewers. Highly experienced reviewers are able 
to identify credible scenarios by an informal review only. 

Consequence assessments 

A preliminary screening of incidents is a helpful phase in 
reducing the number of consequence assessments, and in 
categorization of the incidents prior to the assessment 
stage. The following criteria could be helpful for the 
screening purpose: 

(1) Incidents with only minor effects and low probability 
for escalation into a serious incident should be elimi¬ 
nated. 

(2) Incidents with high similarity of discharge rates, 
locations, inventories and emergency response 
operations should be grouped. 

(3) Two representative incidents should be grouped from 
each of the groups: (1) incident with high probability of 
occurrence, which may result in severe illness/injury 
or major property damage and (2) a credible worst-case 
scenario with critical/catastrophic consequences. 

The screening procedure described above will establish a 
list of incidents for consequence assessment. 

The common forms of incidents are fires, explosions and 
release of toxic material to the environment. Consequence 
assessment tools help in the estimation of the impact of these 
incidents on the employees, local communities, property 
and the environment. Source term modelling is used to esti¬ 
mate the release rate and quantity released. Explosion 
modelling, fire and thermal modelling, and dispersion 
modelling are applied for the assessment of the impact of 
the incidents. These are discussed in detail in previous 
chapters. The results of the consequence assessments lead 
to determination of areas that will be affected and the level 
of toxicity/thermal load/overpressure in these areas. 


24.3 Resources and Capabilities 

24.3.1 General 

The development of strategy for emergency response 
requires consequence assessments of a list of credible inci¬ 
dents and data on resources and capabilities. Data should 
be gathered on the following: 


(1) Emergency response equipment on-site. 

(2) Emergency response equipment in neighbouring 
facilities. 

(3) Emergency management service in local communities. 

(4) On-site medical capabilities and medical facilities in 
local communities. 


Appropriate resources and adequate capabilities are major 
factors in determining the severity of consequences of an 
incident. The following is a common list of physical facil¬ 
ities, equipment and systems that are useful in preparing 
for emergencies: 


(1) shelters; 

(2) safe havens; 

(3) emergency power supply; 

(4) adequate and alternate water supply; 

(5) EOC; 

(6) command post vehicle (CPV); 

(7) emergency management computer system; 

(8) media information centre; 

(9) medical facilities; 

(10) large-scale decontamination equipment; 

(11) emergency evacuation transportation; 

(12) communication centre; 

(13) on-site and off-site alerting system; 

(14) weather station. 


The paragraphs below present the major components of 
the equipment and systems above that are relevant to 
emergency preparedness. 
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24.3.2 Facilities and equipment in emergency planning 
On-site shelters and safe havens 

Shelters and safe havens provide protection from toxic 
substances release incidents when an evacuation is not 
viable. While shelters provide passive protection by closing 
all air passages and shutting ventilation systems, safe 
havens consist of independent source of breathing air, such 
as compressed air bottles, or a specially designed active 
carbon filtration system. Because of the need to safely shut 
off (or control) critical systems, it is common to design 
control rooms as shelters, and sometimes as safe havens. 

The process of emergency planning for shelters and 
safe havens should consider variables such as concentration 
of employees, distance from incident location, typical wea¬ 
ther conditions, and alternate evacuation routes. Admin¬ 
istration buildings are commonly used as shelters. When 
a building is selected as a shelter, the planner should 
verify that the spaces that are designated as shelter areas 
do not have holes and cracks, that doors and windows 
seal properly when closed, and that a ventilation system 
control (at least a shut- off control) is available. 

Both shelters and safe havens should consist of support 
systems that are proportional to the estimated occupancy. 

Emergency power supply 

Emergency power supply is a critical system. Planners 
should verify that vital systems and locations have a power 
supply for all situations. Generators that are attached to 
internal combustion engines are most common as emer¬ 
gency supply systems. However, stored electrical energy as 
battery racks are used as well. NFPA110 — Emergency and. 
Standby Power Systems, and NFPA 111 — Stored Electrical 
Energy Emergency and Standby Power Systems, provide 
guidelines and codes for these systems. 

Adequate and alternate water supply 
Adequate water supply is extremely important for proper 
emergency response. Type of chemicals used in the plant, 
thermal load, demand of sprinkler systems, foam systems 
and hose streams are factors that should be considered in 
calculation of water reserves. 

Alternate water supply is necessary to assure water 
delivery in an emergency. Ponds, lakes, reservoirs, and 
on-site tanks can be used as an alternate water source. 
However, for an adequate preventive maintenance pro¬ 
gramme, it is crucial to have the source as well as the 
equipment available. Moreover, heavy equipment is often 
required to access the alternate source of water, which will 
require hard surface pavement for the anticipated load. In 
case of extreme cold weather, measures should be taken to 
avoid freezing. 

Emergency operations centre 

It is not uncommon to designate a special room as an EOC. 
Location of the EOC should be carefully selected to mini¬ 
mize risk. The distance of EOC from processing areas and 
storage is an important variable in its functionality. The 
distance of the EOC from the normal residency of the 
management should be considered as well. The planner 
should designate an alternated EOC, which will he located 
opposite to the EOC in reference to the processing area. 
This will allow access to the alternate EOC in situations 
where access to the main EOC is not possible. An optimal 
EOC is one designed as a safe haven. NFPA 101 -Life safety 


code, consists of specifications for designing an EOC. An 
EOC should contain plans which facilitate the control of 
the emergency. Table 24.2 provides an example of a list of 
plans that should he available in the EOC. Documentation, 
material and equipment that may be necessary to monitor, 
administer and control the emergency should be provided. 
This includes the Emergency Plan and the list of personnel 
with their department, assembly point, home address, 
nearest relative, and telephone number, if applicable. 
Information from PHA studies scenarios should be avail¬ 
able in an appropriate format so that the EOC personnel can 
carry out continuous speculative reviews of the possible 
development of the emergency. The EOC should be pro¬ 
vided, as appropriate, with any equipment needed for 
dealing with the emergency, such as breathing apparatus, 
rescue gear, etc. 

The EOC should be manned in an emergency by the 
senior emergency coordinator, nominated senior works 
personnel, senior officers of the outside services and any 
nominated assistants such as messengers. Other personnel 
should not be in the centre. If the hazard justifies it, the 
EOC may be manned continuously. 

Command post vehicle 

CPV allows the Incident Commander (IC) to control the 
efforts and activities in emergencies and be located at 
vantage points. The IC should be able to communicate with 
the management in the EOC, have access to essential 
documents, be able to document the scenario, and he able to 
monitor the environment. Therefore, the CPV should be 
selected to allow installation of all the equipment necessary 
and installation of power source that will be able to supply 
the consumption that this equipment demands. 

Emergency management computation system 
Emergency management computation systems (EMCS) are 
used for organization of information, estimation of severity 
of the incident by using source and dispersion models, data 
collection from the field if a network is installed, receiving 
monitoring data, etc. This information is essential to 
determine the magnitude of the event, and to make deci¬ 
sions as to announce an escalation and to determine the 
need of evacuation both on- and off-site. Modern wireless 
networks, computation capabilities, and mobilization of 
computation systems make these systems extremely use¬ 
ful. Advanced process safety management packages with 
well-developed emergency management, can be connected 


Table 24.2 Some plans required in the Emergency 
Control Centre 


Fire water system and alternative water supply 

Other fire fighting equipment 

Safety equipment 

Works entrances and road system 

Assembly points 

Shelters and safe haven locations 

Relation of works to immediate surroundings and plans 

which can be used as an emergency develops to show: 

(1) areas affected by hazard; 

(2) areas evacuated; 

(3) deployment of emergency teams and equipment. 

(4) inventories of hazardous materials 





EMERGENCY PLANNING 24/7 


to weather station, alarm systems, local, state and federal 
authorities. 

Media information centre 

A significant incident may have an impact on the organi¬ 
zation’s reputation. Sharing information and collaborating 
with the media could reduce the snowball effect that an 
emergency event may have. Moreover, media can assist by 
announcing the emergency, and increase the awareness of 
the general public in areas that might be affected. 

A large room such as a conference room can be desig¬ 
nated a media information centre (MIC). The MIC should be 
located at a distance that will assure the safety of the 
reporters and should be designed as a shelter or safe haven. 

Medical facilities 

On-site medical facility can have the capability of a first-aid 
room or a medical department. In general, the adequate 
capability is a function of parameters such as number of 
employees in the plant, capabilities of the local community 
medical centres, distance to these centres, and the antici¬ 
pated consequences in an emergency. Coordination between 
emergency team, on-site medical facility, and local commu¬ 
nity medical centres may have major impact on the severity 
of consequences in cases of multiple casualty events, espe¬ 
cially if decontamination is required. Local emergency cen¬ 
tres should be made aware of the chemicals in the plant, and 
the estimated number of injuries that are expected in emer¬ 
gency. A procedure that enables evacuation of injuries by 
airlift is very common and can help in cases where the medi¬ 
cal centre is too far, or in cases where the situation requires 
specialties that are not available in the local medical centre. 

Communication system 

The design of communication system should address the 
following: 

(1) Maintain on-site communication. 

(2) Establish communication with off-site agencies and 
neighbouring facilities. 

(3) Allow communication among management, emer¬ 
gency team and responders. 

Communication equipment includes announcement system, 
alert system, phones, secure phone system, cellular phones, 
radio system, wireless computing systems and cableTV 
Alerting and announcement systems serve both on- and 
off-site. Use of alerting system requires coordination 
between the plant and the local agencies. An audio alerting 
system requires that a code be well communicated with the 
general public. In general, alerting systems are used to 
alert on weather hazards such as a tornado. Since man¬ 
made hazards are rare, emergency plan should verify pub¬ 
lic knowledge with regard to audio alerting systems. Cable 
TV is a very effective tool to notify the general public in 
local community with regard to hazards, and to deliver 
behav-ioural guidelines and directions. It is recommended 
that the planner not leave the notification of the general 
public to the local agencies. A computer dial-up system can 
be used as a tool to contact the general public in emergency. 

On-site response equipment and supplies consist of a 
variety of items. An inadequate equipment and supply can 
worsen the consequences of an event. Therefore, the plan¬ 
ner must verify that equipment and supplies will meet the 
needs in an emergency. 


Response equipment and supplies 

The success of the response team in mitigating an incident 
is dependent on the availability of adequate equipment, and 
implementation of an adequate procedure of inspection, 
maintenance and replenishment of this equipment. 
Response equipment and supplies can be divided to three 
main categories: 

(1) personal protection, 

(2) fire fighting, and 

(3) decontamination. 

Personal protection equipment allows the response team to 
function in the affected zone in order to continue with the 
efforts to control the incident and minimize the con¬ 
sequence. Personal protection equipment consists of two 
major types: 

(1) respiratory protection and 

(2) thermal and chemical protection. 

The circumstance determines the level of respiration pro¬ 
tection that is needed. In many cases, a mask equipped with 
a canned active carbon filter may answer the needs. In 
other cases, a self-contained breathing apparatus (SCBA) is 
required. This apparatus usually consists of a full face 
protection mask and a regulator connected to a compressed 
air cylinder that is carried by the responder. NFPA stand¬ 
ard 1981 Open-Circuit Self-Contained Breathing Apparatus 
determines the requirement of SCBA. 

A supplied air respirator (SAR) is a system that supplies 
air from a source that is located in a distance from the 
affected area. This system is known as an airline respira¬ 
tion system as well. The air is supplied through an air-line 
hose to the responder. The major advantages of this system 
are that it allows the responder to stay longer in the affected 
area, and that the responders are not required to carry 
heavy systems as with SCBA. The major disadvantages are 
that the responder is not as mobile as with SCBA, and that 
the air line hoses are vulnerable to mechanical, thermal 
and chemical damage and therefore this arrangement is not 
approved for Immediate Danger to Life and Health envir¬ 
onment, unless an emergency escape SCBA is carried by 
the responder as well. 

As for fire fighting gear, these systems supply reason¬ 
able thermal protection for most fires. In incidents in which 
excessive thermal load is expected, the responder should 
wear adequate clothing. An ice vest is used when high 
ambient temperature is imposed on the responders. The 
vest consists of pockets in which ice can be installed. The 
ice absorbs the thermal load, and enables the responder to 
stay longer in high-temperature environment, or to get 
closer to the source of the heat. 

NFPA 1991 - Standard on Vapor-Protective Ensembles for 
Hazardous Materials Emergencies, and NFPA -1992 Stand¬ 
ard on Liquid Splash-Protective Ensembles and Clothing for 
Hazardous Materials Emergencies assist in determining 
the proper clothes according to the characteristics of the 
hazards. 

Fire fighting and decontamination equipment consist of 
(but not limited to) the items in Table 24.3: 

A planner should determine the necessity of integrating 
heavy equipment as dump trucks, earth movers, and 
cranes, and integrating these in the planning. 
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Table 24.3 Major fire fighting and decontamination 
equipment 


Fire extinguishers 
Sprinkler system 
Water and foam engines 
Hydrant system 
Portable pumps 
Fire fighting truck 
Inhibitors 
Neutralizers 
Sorbents 

Hazardous material vehicle 


24.4 Developing an Emergency Plan 

24.4.1 Overview 

Regulatory agencies require preparation for emergencies 
and documentation of emergency plans. The emergency 
team will respond to incidents according to this plan and 
therefore the importance of the accuracy and comprehen¬ 
siveness of the written plan. Emergency plan consists of 
the following major components: 

(1) Establishment of a set of credible scenarios. 

(2) Study emergency plans of neighbouring facilities 
and local community. 

(3) Study availability of resources and capabilities, and 
determining needs. 

(4) Study emergency-related regulations and emer¬ 
gency authorities’ requirement and responsibilities. 

(5) Development of tactics to respond to fires and 
explosions, release of hazardous materials, natural 
hazards, terrorist threats, rescue, evacuation, and 
plan for medical response and emergency mitigation. 

(6) Development of procedures to assess level of 
emergency. 

(7) Training of emergency teams, other employees and 
contractors. 

(8) Development and execution of drills (include neigh¬ 
bouring facilities and local communities). 

(9) Development of drill-based improvement procedure. 

(10) Communication of the emergency plan on- and off-site. 

Component (1), (2) and (3) in the list above were discussed in 
detail earlier in this chapter. 

24.4.2 Emergency organizations and regulations 

Emergency-related regulations, requirements and respon¬ 
sibilities are different in different countries. The planner 
should study the requirements and regulations and develop 
the plan to meet these requirements. An active Local 
Emergency Planning Committee (LEPC) in the United 
States can assist a great deal in coordinating between the 
plant and the local community authorities and responding 
agencies. A central entity such as the LEPC in the United 
States may have in hand emergency plans from other sites 
and the emergency plan of the local community. Moreover, a 
mutual agreement that establishes a net of emergency 
equipment and supplies may be available and thus reduce 
the costs involved in preparing the plant for emergencies. 

Local community planning should include diverse gov¬ 
ernment, volunteer and private organizations. Table 24.4 
consists of examples of such organizations. 


Table 24.4 Organizations that may be involved in 
local community emergency planning 


Local community emergency preparedness organization 

Emergency management services 

Fire department 

Police department 

Traffic control agencies 

Hospitals 

Red cross 

Salvation army 

Department of Health 

EPA and OSHA (US)/HSE (UK) 

Coast guard 

Media 

Mayor 


When establishing a mutual framework for efforts in 
emergency, the planner should identify each one of the 
personnel that the plant should interact with, and establish 
a dialogue that will create mutual trust and commitment. 

24.4.3 Development of response tactic 

Initial assessments and criteria for decision on escalation 
of emergency are major issues in responding to an emer¬ 
gency. The planner should establish procedures for assess¬ 
ment of severity of the incidents, and a set of criteria that 
will help in the decision to declare on escalation of the 
situation. The emergency team management must under¬ 
stand that the safety of the employees and responders is 
their first priority Next is preventing the incident from 
escalating. Environmental concerns are next and finally 
the prevention of property damage is the last priority 
among these. The actions to be taken should be developed 
according to these priorities for both: fires and explosions, 
and release of hazardous material. In both cases, the initial 
efforts should determine work zones, in which the respond¬ 
ers will be able to respond from. 

Following the initial assessment, the IC should deter¬ 
mine what the objectives of the response are, for example, 
should the responders try to extinguish the fire (aggressive 
response), prevent it form spreading or, respond just to 
allow safe evacuation of employees (defensive)? This deci¬ 
sion should be made based on the risk associated with level 
of intervention. 

Next, location for mitigation efforts to take place should 
be determined as well as entrance and exit routes, the time 
frame for the variety of actions, and who will carry out the 
variety of responsibilities. 

The planner should develop procedures for the following 
indirect response components: 

(1) Warning and alerting 

(2) Communication 

(3) Distribution of managerial responsibilities 

(4) Emergency shut-down 

(5) Identification of missing employees 

(6) Mutual assistance with the variety of external 
entities 

(7) Reporting 

(8) Declaration of escalation 

(9) Security 

(10) Dealing with the media and 

(11) Special notification. 
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Procedures for direct response efforts should include the 
following: 

(1) Evacuation 

(2) Medical mitigation 

(3) Rescue 

(4) Fires and explosions 

(5) Release of hazardous materials 

(6) Terrorism threats 

(7) High winds 

(8) Flood 

(9) Freeze. 

Procedures for training, drills, effectiveness measure¬ 
ments and post-drill change management should be con¬ 
sidered part of the response stage as well as part of the 
preparedness. 

24.5 Training 

24.5.1 Background 

Training is the foundation of the success of emergency plan¬ 
ning. The training verifies that all employees are familiar 
with the alerting and warning codes, and the location of 
shelters and safe havens. Members of the response team are 
introduced to their responsibilities and its role in the ‘big 
picture’. The frame for training for emergencies was man¬ 
dated by the government in the United States. Occupational 
Safety and Health Administration (OSHA), Environmental 
Protection Agency (EPA), and the Department of Transpor¬ 
tation require training for emergencies. Other organizations 
established standards and good practices that are very use¬ 
ful. OSHA requires that an employer will train his employees 
at least once in three years. 

24.5.2 Fundamental training 

The most fundamental emergency training is the use of fire 
extinguishing systems and equipment. It is common for all 
employees to be trained to use these systems. Additional 
training that all employees should receive is familiarity 
with alert codes, evacuation routes, and the locations of 
shelters and safe havens. These training include identifi¬ 
cation of hazards, the type of response that is appropriate, 
and to whom these hazards should be reported, and which 
communication system is to be used. 

24.5.3 Operators training 

Operations personnel are required to be familiar with the 
site emergency plan, and to be familiar in details with the 
relevant part of the plan that is related to their processes. 
This part requires knowledge of safe work practices and 
emergency shut-down procedures. The operators should be 
trained on the procedure, and to the criteria for proper shut¬ 
down. This type of training is extremely important, and 
more important is exercising it, in order to increase the 
correct decision-making, and to prevent wrong decision¬ 
making as was made in the Piper Alpha incident in the 
North Sea. 

24.5.4 Response teams 

Response teams are required to have high level of familiarity 
with the emergency plan. They have to understand the 
inherent hazards that are characterizing the plant, and the 
list of credible incident that the emergency plan was 


developed for, hierarchy of command, reporting system, 
responsibilities, communication systems and all other rel¬ 
evant information and procedures that the emergency plan 
consists of. The response teams are required to have knowl¬ 
edge and skills in several types of response categories: 

(1) Firefighting 

(2) Release of hazardous material (in all phases: leak of 
liquids, rain of vapour and drops, gas) 

(3) Terrorism threats 

(4) Rescue (natural hazards, man-made hazards, con¬ 
fined places) 

(5) Medical and 

(6) Evacuation. 

In most cases the teams are designated to one or more of 
the categories; however, they are expected to be able to 
perform in other teams as well. 

Several of the emergency response personnel should be 
trained to deal with the media and public relations. This is a 
very sensitive duty because of the impact that the incident 
and the media covering the events may have on the image of 
the organization. 

24.6 Essential Functions and Nominated Personnel 

24.6.1 Incident Commander 

It is the IC responsibility to proceed to the scene of the 
incident and to coordinate the efforts. The following list 
describes the IC’s major responsibilities: 

(1) As soon as the IC becomes aware of an incident, he 
should assess its scale against predetermined cri¬ 
teria or emergency reference levels, and decide whe¬ 
ther a major emergency exists or is likely. If so he 
should immediately activate the on-site plan and if 
necessary the off-site emergency plan. 

(2) Ensure that emergency services have been called. 

(3) Direct the shutting down and evacuation of the other 
plant areas, etc., likely to be affected. 

(4) Ensure that key personnel have been notified. 

(5) Direct all operation at the scene. 

(6) Control the rescue and fire fighting operations 
activities until the arrival of the fire brigade, when he 
should hand over control to a senior fire officer. 

(7) Search for casualties. 

(8) Evacuate non- essential workers to assembly areas. 

(9) Set up a communications point with radio, telephone 
or messenger contact with the EOC. 

(10) Give advice and information as requested to the 
emergency services. 

(11) Brief the site emergency management and keep them 
informed of developments. 

Where a fire is involved, the IC will direct fire fighting 
until the outside Fire Brigade officer or the Fire Services 
arrives, he will then hand over control of this aspect to the 
senior officer of the fire brigade. The IC should be thor¬ 
oughly familiar with the works situation; a suitable person 
is the shift section manager. It is important that the IC be 
readily recognizable when he is at the scene of the incident. 
This is facilitated if he wears a distinctive garment such 
as a brightly coloured or luminous jacket or helmet. This 
garment should be known to all concerned and should be 
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distinct from any which might be worn by others at the 
scene, including the outside services. 


24.6.2 Emergency Operation Manager 

The function of the Emergency Operation Manager (EOM) 
is to take overall control of the emergency operation activ¬ 
ities from the EOC.The EOM controls the ‘big picture’ from 
the EOC, and takes an overall control of the scene. Among 
his responsibilities are the following: 


(1) If he decides that a major scale emergency exists or is 
likely to be developed, then he should ensure that the 
emergency services have been called and the off-site 
plan activated. 

(2) Ensure that key personnel are called in. 

(3) Exercise direct operational control of those parts of 
the works outside the affected area. 

(4) Continually review and assess possible develop¬ 
ments to determine the most probable course of 
events. 

(5) Direct the shutting down of plants and their evacua¬ 
tion in consultation with the IC and key personnel. 

(6) Ensure that casualties are receiving adequate atten¬ 
tion. Arrange for additional help if required. Ensure 
that relatives are informed. 

(7) In case of emergencies that involve risk to outside 
areas from wind blown materials, contact the local 
meteorological office to receive early notification of 
impending changes in weather conditions. 

(8) Liaise with chief officers of the fire and police serv¬ 
ices and provide advice on possible effects on areas 
outside the works, and ensure that personnel are 
accounted for. 

(9) Control traffic movement within the works. 

(10) Arrange for a log of the emergency to be maintained. 

(11) Where the emergency is prolonged, arrange for the 
relief of site personnel and the provision of catering 
facilities. 

(12) Issue authorized statements to the news media. 

(13) Ensure that proper consideration is given to the pre¬ 
servation of evidence. 

(14) Control rehabilitation of affected areas after the 
emergency. 

The EOC should be familiar with the activities and 
should have the authority needed to take any necessary 
major decisions affecting these activities, the activities in 
the neighbouring facilities and the outside services. 
A suitable person is the shift manager. For both managers 
deputies should be appointed who can take over their 
duties if they are unavailable for any reason. 


24.6.3 Other functions and personnel 

There are numerous other functions that may have to be 
carried out in an emergency. Some of these functions are 
normal, though they can easily become overtaxed in an 
emergency, but most are specific to the emergency situation. 
Similar to the list of responsibilities of the IC and EOM, each 
of the key personnel should be familiar with all his respon¬ 
sibilities, all the relevant procedures, to whom he reports 
and who are those under his responsibilities, and to whom he 
reports if the primary person is not in duty for any reason. 


24.7 Declaration and Communication of 
the Emergency 

24.7.1 Raising the alarm 

When a serious incident occurs, it is very desirable for the 
alarm to be raised as quickly as possible. Prompt action 
will in many cases forestall the development of a full 
emergency. Crucial aspects of raising the alarm are the 
authority to raise the alarm, the training of personnel and 
the alarm system. An efficient and widely practiced policy 
is to allow any employee to raise the alarm. Such a policy is 
more effective if personnel have been specifically trained 
in this aspect. 

24.7.2 Declaration of the emergency 

When the alarm has been raised, the emergency procedure 
is activated. The first stage is the decision as to whether the 
incident constitutes, or could develop into, an emergency. 
The IC should visit the scene of the incident. He then makes 
the decision whether to declare an emergency. The author¬ 
ity to declare an emergency need not be restricted to the IC; 
however, it is undesirable to allow the authority to be too 
widespread, but too close a restriction may introduce an 
undesirable delay into the declaration. Other competent 
personnel may therefore be vested with this authority. 

24.7.3 Communication of the emergency 

Once an emergency has been declared, it must be commu¬ 
nicated to the following entities: 


(1) 

EOM 


(2) 

Personnel working within the ar< 

;as affected 

(3) 

Personnel that are needed to be called in from outside 

(4) 

Off-site emergency services 


(5) 

Key personnel on call-in 


(6) 

Personnel in other threatened an 

:as and facilities 

(7) 

Police 


(8) 

Medical services 


(9) 

Media, and 


(10) 

Headquarters. 



As far as possible, the IC should be relieved of the task of 
communicating the emergency so that he can devote his 
efforts to dealing with it on site. However, the duties include 
communication of the emergency to interested parties 
until the EOM arrives. It may he appropriate to consider 
arrangements that assist the IC in this task. 

It is desirable to work out in advance fairly formal pro¬ 
cedures for the notification of an emergency. The order in 
which the different parties are to be notified is one obvious 
aspect. It is also necessary to avoid entering into lengthy 
explanations to personnel on call-in and, in such instances, 
use may be made of short pre-arranged messages. Person¬ 
nel liable to call-in should be issued with identification 
which will allow them to pass through police barriers 
erected to control traffic and sightseers. 

It is essential that the existence of an emergency be 
notified without delay to affected plants within the works, 
the emergency teams and the off-site services. 

The emergency should be notified to any neighbouring 
firm that might be affected by it. This may be necessary if 
there is a threat to the firm’s plant or personnel, if the firm’s 
activities could compound the emergency, for example, 
create a traffic jam at a shift change, or if there are mutual 
assistance arrangements. 
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24.8 Cooperation and Drills 

24.8.1 Planning cooperation with off-site services 

The planning of cooperation and the development of under¬ 
standing with the off-site services is vital to the success of 
response to emergency. The first step is obviously estab¬ 
lishment of agreements to cooperate in emergencies. These 
agreements are established mainly by the senior managers 
of the organizations involved. But this needs to be followed 
up by active planning and drills by plant personnel. 

The activities should be seen not as two disjoint activ¬ 
ities, but as a single operation in which agrowing weight of 
resources is brought to bear on the incident. The planning 
should aim to clarify not only what is to be done but also 
who is to do it. 

Cooperation benefits greatly if there is a full-time liaison 
officer, and this can be justified in an area where there is 
large potential for emergencies.What is known in advance is 
the general location and nature of possible emergencies. 
Other factors will not be so well defined: time, weather, and 
number of people. Excessive detail in the planning should be 
avoided. The aim should be to plan broad areas of responsi¬ 
bility, chains of command and systems of communication. 

Off-site services will require their own communications. 
On-site, the practice has been for the police, fire and medi¬ 
cal services to be linked by radio to their own communica¬ 
tions systems. The EOC should be available to them. 
Alternatively, they may wish to set up their own mobile 
control centres. 

The off-site services will also normally need to tap into 
the on-site emergency internal communication. This 
should be allowed through the EOC. An alternative is to 
provide for their use portable radios as used by the emer¬ 
gency teams. 

Each service should have its own emergency plans. The 
police have a Major Incident Plan that covers road, rail, 
aircraft and airports as well as industrial situations. The 
fire service probably has a number of emergency plans. 

24.8.2 Emergency drills 

Emergency drills are effective in familiarizing personnel 
with their functions.While drills with on-site personnel can 
be dictated by a routine, real-time simulation that involves 
all forces, on- and off-site are much more complicated to 
perform. However, the effectiveness of the plan, as well as 
the performance of each of the entities in the response stage 
can be assessed only in full-scale drills. It is common that 
full-scale emergency drill resulted in major changes in the 
plan, and sometimes it required conducting process hazard 
analysis in order to better understand the hazards, and the 
risks associated. In any case, the emergency plan should 
consist of a procedure for implementation of change 
management. 


24.9 Public Relations 

If a major incident occurs, it is important to provide the 
media with accurate information. To give no report in the 
pressis not an option. Allpersonnel should direct turns from 
the media to the spokesman. A good emergency plan will 
consist of a procedure that provides guidelines to answering 
questions. Several questions might be anticipated. The 
choice is between an attitude to the press that may foster 
informed and sympathetic reporting and one that almost 
guarantees ignorant and hostile comment. A company is 


unwise to expect sympathetic reporting unless over the long 
term it has built up with the press, as far as it is able, a rela¬ 
tionship of trust based on openness about the hazards pre¬ 
sent and the preventive and protective measures adopted. 
It will normally be appropriate that the long-term handling 
of major hazard policies be done by the company’s head 
office with reference to national policies and standards. 

The following is a list of common questions that a media 
would query about: 

(1) What happened and where? 

(2) How it occurred ? 

(3) Was a hazardous material released and how much? 

(4) What is the extent of the emergency? 

(5) How long will the event last? 

(6) Is the incident under control? 

(7) What are the measures that are being taken to pro¬ 
tect the public? 

(8) Are there injuries and fatalities, and how many? 

(9) On-going update on the emergency activities. 

(10) Information on the criteria of declaring on escalation. 

A periodic training of a spokesman can significantly 
improve the credibility and reliability of the firm’s public 
relations. 

24.10 Off-site Emergency Planning 

Off-site emergency planning are developed within a juris¬ 
diction, or a city, county or a region. An off-site emergency 
plan consists of procedures that address the following dis¬ 
ciplines: 

(1) Warning 

(2) Communication 

(3) Shelters and mass care 

(4) Evacuation 

(5) Fire fighting 

(6) Spills of hazardous materials and petroleum pro¬ 
ducts 

(7) Law enforcement 

(8) Health and medical services 

(9) Hazard mitigation 

(10) Public works 

(11) Utilities 

(12) Human services 

(13) Search and rescue 

(14) Transportation 

(15) Donation management 

(16) Terrorism threads. 

The purpose of an off-site emergency plan is to outline stra¬ 
tegic framework to respond to natural and man-made dis¬ 
asters. Since the terrorist attacks on the World Trade Center 
in New York on 11 September 2001, there is a significant 
emphasis on mutually supporting terrorism preparedness 
programmes, with the goal to enhance the capabilities by 
establishing a comprehensive programme for the full spec¬ 
trum of terrorist threat and any other kinds of disasters. 

The off-site emergency plan is similar in structure to the 
on-site emergency plan. However, coordination of off-site 
emergency plan requires much more energy and effort. 
While for on-site plans, the EOM has an authority to direct 
all the activities and disciplines in the plant, for off-site 
plans, the EOM may have partial authority only. 



24/12 EMERGENCY PLANNING 


Warning procedures should use common channels of 
communication to advise the public on an emergency; 
However, some people who are directly threatened by the 
hazard may not hear and not understand the warning. It is 
necessary to address special needs groups such as sight 
and hearing impaired, and nursing home. 

Communication system planning should assume that the 
hazards may neutralize the designated communication 
systems, and that additional communication equipment 
may be required. 

Provision of shelters and mass care is a major responsi¬ 
bility, and a large number of parameters are involved in the 
process of designation of shelters. The efforts in the United 
States should be coordinated with the American Red Cross, 
which has been chartered under federal law to provide 
mass care in cases of natural disaster. 

The characteristics of hazards, magnitude, intensity and 
anticipated duration are major factors in evacuation plan¬ 
ning. Small- and large-scale evacuation should be addressed 
by the planner. The criteria for the decision of evacuation 
should be clear, and the planner should remove ambiguities 
from this procedure. A common assumption is that about 
80% of the population at risk will respond to the first 
recommendation of evacuation. However, as the hazard 
becomes more obvious, more will respond. Some of the peo¬ 
ple will refuse to be evacuated under any circumstance. 
Some of them will demand that their pets be cared for too. 
All of these factors should be addressed, as well as the 
response rate at different parts of the day. 

Large number of procedures, modular plans and tem¬ 
plates are available for the disciplines listed above on the 
US Federal Emergency Management Agency and on states’ 
Division of Emergency Management websites. 

24.11 Transport Emergency Planning 

24.11.1 Background 

As described in Chapter 23, it is essential for hazardous 
chemicals to be transported in tanks and containers 
designed and maintained to high standards, for transport 
personnel to have any necessary training, for comparative 
studies of the different means of transport to be done and 
routes carefully selected, and for hazard studies to be 
carried out. Even so, it is still necessary to plan for possible 
transport emergencies. 

As with safety in the transport of hazardous chemicals 
in general, so with transport emergency planning, the 
chemical industry has always tended to take the view that 
although strictly the responsibility lies with the shipper, it 
is very much in the interests and responsibility of the 
industry also to take measures to deal with transport 
emergencies. This attitude finds practical expression in 
companies’ willingness to send emergency teams to situa¬ 
tions in which their own products are not involved. 

Transport emergency planning has something in com¬ 
mon with works emergency planning, but there are some 
important differences. The main one is that even with 
careful routing, there is a vast range of locations at which 
the emergency can occur. 

Transportation emergency planning includes the fol¬ 
lowing elements: 

(1) chemical data; 

(2) information and labelling; 

(3) incident control network; 


(4) emergency procedures; 

(5) emergency teams; 

(6) outside services, and 

(7) public relations. 

The following paragraph discusses these elements. 
Chemical data 

Although the properties of chemicals that are shipped are 
usually understood well enough for most purposes, it is 
necessary that particular attention be paid to any property 
that is specially important in a transport emergency. In the 
Glendora incident described below, 30,000 people were 
evacuated because it was feared that lethal quantities of 
phosgene might be generated by burning vinyl chloride 
monomer (VCM). Although the manufacturer’s expert on 
the spot discounted this hazard, the authorities proceeded 
with the evacuation. The incident led the industry to carry 
out research to determine more exactly the extent of the 
hazard from this source, which turned out to be small. 
Material Safety Data Sheet (MSDS) should be part of the 
delivery, to simplify the search for data. 

Information and labelling 

People involved in transportation incident need information 
about the chemical, but their needs differ. The amount of 
information required is different for the public, the person¬ 
nel involved in the first few minutes and for those involved 
in longer term incident control and clearing up operations. 

There are also different sources of information. The most 
accessible is the labelling of the container. Then there is 
usually more detailed information carried somewhere on 
the vehicle, if an MSDS is not reachable. The shipper and 
outside services, such as police and fire services, should 
have manuals that contain similar data. Finally, there is the 
manufacturer who may be contacted through the Federal 
Emergency Management Agency, EPA, and others. The UN 
classification code is commonly being used for labelling in 
transportation of hazardous materials. 

Emergency procedures 

There are certain priority actions that should be taken by 
the person at the scene of the incident. The priorities are as 
follows: 

(1) keep people away; 

(2) inform incident control; 

(3) contain the chemical; 

(4) avoid igniting the chemical, and 

(5) obtain chemical data. 

The communication with the EOC is important. The centre 
should be informed as follows: 

(1) place and time of the incident; 

(2) chemical involved; 

(3) container condition; 

(4) injuries or/and fatalities; 

(5) the surrounding area (urban, rural); 

(6) weather conditions; 

(7) the assistance available (police, fire services), and 

(8) the means of maintaining contact. 

It is particularly important for the man on the spot to 
ensure that the control centre can keep in contact with him, 
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by using a cellular phone or any other communication 
measure. If possible, the chemical should not be allowed to 
get into sewers. A pool of liquid may often be rendered safer 
by covering it with a blanket of suitable foam. 

Ignition of the material should be avoided if at all possi¬ 
ble. Sources of ignition should be kept well away. 

Some chemicals that are transported have properties 
that may increase the hazard of the incident. These include 
low boiling points, capacity for spontaneous ignition, and 
reaction with water. 

Emergency teams 

The manufacturer of a hazardous chemical normally 
arranges for an emergency team to be available to be sent to 
the scene as soon as a transport emergency is notified. In 
some cases this involves mutual assistance schemes. 

The personnel comprising the emergency team are 
usually thoroughly familiar with the chemical and are 
trained in handling incidents. In addition to the general 
incident control measures already described, the emer¬ 
gency team usually has expertise in dealing with leaks and 
fires and in emptying damaged containers and clearing up. 

A leak or spillage should not be ignited. If a leak has 
ignited, however, it may be the best policy to let it continue 
burning. The danger of putting out a fire without eliminat¬ 
ing the leak is that the amount of flammables may build up 
and, if re-ignited, cause a more serious fire or explosion. 

If other containers are present, as it typically the case in 
rail incidents, it may be necessary to cool these with water 
to prevent their overheating. 

The emergency team is sent as soon as possible on 
receipt of notification, but several hours are likely to elapse 
before it reaches the scene of the incident. 

24.11.3 External services 

The general role of the external services such as the police 
and fire services has already been described. Some addi¬ 
tional points relevant to transport emergencies may be 
mentioned briefly. 

A transport emergency differs from emergency activ¬ 
ities on-site. There is therefore much less scope for advance 
cooperation between a manufacturer and the services in 
his local authority area. The variety of hazardous chemi¬ 
cals that the services may have to handle is much greater. 

Another feature of a transport emergency is that it may 
well occur in an urban area. This means that measures 
to keep people away from the scene, to divert traffic, to 
maintain access for emergency vehicles and possibly to 
evacuate the population assume particular importance. 

Decisions on the advice to be given to the public, whether 
this be to take shelter or to evacuate, are particularly diffi¬ 
cult. In some situations where it is not strictly necessary to 
involve large numbers of people, the authorities may 
nevertheless have little choice but to order action, unless 
precise information is available to them on the hazards of 
the chemical, particularly the toxic hazards. Likewise, 
information on fighting fires of the chemical is important 
for the fire services. In particular, the latter need to know 
whether the chemical reacts violently with water. 

24.11.4 Rail transport 

The foregoing account has been concerned primarily with 
road transport, but most of it is applicable to rail road 
transportation as well. In this case, the railway authority 
establishes its own procedures and trains its own 


personnel. Again the prime requirement from the manu¬ 
facturer is full information about the chemicals. 

Emergencies involving hazardous chemicals on railways 
tend to have some special features. One is the problem of 
access, particularly for fire engines. The track is often 
blocked by derailed rail vehicles. Another aspect is that 
there are usually a number of tank cars involved, with the 
danger of a spread of the fire/explosion. Frequently there is 
a hazard to other transport, such as to trains on other 
tracks, or to nearby roads. 


24.12 Spectators 

An incident that lasts for any appreciable length of time is 
liable to attract spectators.This is true not only of transport 
incidents occurring outside the site, but also of incidents 
on-site that are visible outside. 

The effect of spectators is two-fold. The number of peo¬ 
ple at risk may be considerably increased, and the passages 
for the emergency services can become congested, with 
consequent delays. 

The problem of spectators has been investigated by 
Hymes (1985 LPB 65), who describes quite a large number 
of incidents in which spectators suffered injury. Some of 
the cases cited involve people who became exposed to the 
threat and stood watching it develop instead of making 
their escape, whilst in others they were attracted to the 
incident as sightseers. Some of the incidents that he 
describes are summarized in Section 24.13. 

The control of spectators is therefore an essential part of 
an off-site emergency plan and of a transport emergency 
plan. The responsibility for such control rests with the 
police. 


24.13 Emergency Incidents 

24.13.1 Historical data 

Some information on emergencies in the process industries 
has been obtained in the course of a study on human factors 
as a cause of pipe work failures by Bellamy, Geyer and 
Astley (1989). 

For failures of mitigation, the number of incidents due 
to each cause were as follows: delay, 23 (45%); design defi¬ 
ciency, 14 (27.5%) and lack of resources, 14 (27.5%). Exam¬ 
ples in the first category were lack of procedures for 
handling the incident and defective fire fighting equip¬ 
ment; in the second category, examples were a layout 
leaving insufficient space for fire water jets to be directed at 
the source of the fire and the inaccessibility of shut-down 
equipment due to the leak itself and in the third category, 
examples were lack of manpower and lack of equipment. 

The information on the implementation of emergency 
plans and on evacuation in this study is ambiguous. On 
the one hand, there were 42 cases recorded in which an 
emergency plan was put into effect. In 27 of these cases, the 
plan implemented was the on-site plan and in 11 it was the 
off-site plan; in the 4 remaining cases, the plan was not 
specified. On the other hand, there were 30 cases in which 
there was evacuation, either on-site or off-site or both, with 
13 on-site and 24 off-site evacuations. 

24.13.2 Incidents involving evacuation and/or shelter 

There have been a number of instructive incidents involv¬ 
ing evacuation and/or shelter. They include those at 
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La Barre in 1961, Glendora in 1969, Potchefstroom in 1973, 
Houston in 1976, and Mississauga in 1979. 

In 1961, a rail crash occurred at La Barre, Louisiana, 
involving a chlorine rail tank car, only 50 yd from a house. 
A father was looking after a baby in the house, the infant 
began to choke and gasp, and the frantic father carried it 
outside, where the gas concentration was higher still. The 
child died in hospital. 

In 1969, agroup of eightrailtankcarscontainingVCMwere 
involved in a crash at Glendora, Mississippi, and one started 
to leak. That evening one of the tank cars ruptured, with 
subsequent ignition of the leak. A heavy fog was observed 
over the area and it was considered that it might be VCM. The 
responders stated that in a VCM fire, phosgene could be 
formed. Further advice was sought from the manufacturer’s 
representative, who stated that the principal problem was 
likely to be HC1 and smoke, and university chemists, who 
stated that burning VCM could create phosgene that was 
potentially dangerous up to a radius of 35 miles. An evacua¬ 
tion was initiated involving some 30,000 people. 

In 1973, a sudden failure occurred in an anhydrous 
ammonia storage tank at Potchefstroom in South Africa. 
Workers in a building 80 m from the release survived, but 
people who left their houses 180-200 m from it died. 

In 1976 at Houston,Texas, a tank truck carrying 19 tons of 
anhydrous ammonia ruptured at a highway intersection. 
The resultant gas cloud enveloped the Houston Post build¬ 
ing but the workers inside were not affected. Outside, 
94 people caught in the cloud were injured, of whom 5 died. 

24.13.3 Mississauga 

Avery large evacuation occurred on Saturday, 10 November 
1979 at Mississauga, near Toronto. At 23.52 p.m., a train 
crashed and several propane rail tank cars exploded. The 
train manifest was found, but it was in code. A strong smell 
of chlorine was detected. At 01.30 the next morning, a 
readable version of the manifest was obtained. A rail tank 
car containing some 90 te of chlorine was identified as 
being in the train and it was concluded that this car was 
amongst the burning wreckage. At 03.00, the decision was 
taken to evacuate the surrounding population. An evacua¬ 
tion was begun which involved a total of about 215,000 
people. The chlorine tank car was identified by helicopter 
and found to have a visible hole in it. At 09.00 on Tuesday 
morning, an initial attempt was made to plug the hole, but 
this failed; a second attempt later was successful.The tank 
was subsequently emptied. During Tuesday afternoon 
143,000 evacuees were allowed to return to their homes in 
the areas more distant from the crash. The rest returned 
only after a total absence of 6 days. 

24.13.4 Incidents involving spectators 

The following incidents have been described in the study of 
spectators. At Deer Lake, Pennsylvania, in 1959, a road 
tanker carrying LPG was struck by a following truck in a 
wet street. LPG was released and ignited, engulfing the 
rear of the tanker. Fire services arrived, but expended 
water on a nearby building, and in due course the tanker 
suffered a boiling liquid expanding vapour explosion 
(BLEVE). Fragments, which included most of the tank, 
killed 11 spectators and injured 10 more. Emergency ser¬ 
vices were hampered both before the rupture and after it. 

At Meldrin, Georgia, in 1959, a rail tank car suffered a 
partial rupture near a picnic site. A large gas cloud spread 
and for some time did not ignite. When it did ignite, a flash 


fire occurred.There were 23 dead, many of whom were found 
in their cars. Emergency services were greatly hampered 
because the site was remote and served only by a dirt road 
congested by spectators and relatives of the casualties. 

At Kingman, Arizona, in 1973, a rail tank car carrying 
propane developed a leak that ignited. Despite police dis¬ 
couragement, a large crowd of spectators jostled to get a 
view. In due course the tank car underwent a BLEVE and a 
huge fireball erupted. Some 90 spectators 300 m away suf¬ 
fered injury. 

At San Carlos de la Rapita, Spain, in 1978, a road tanker 
carrying propylene past the Los Alfaques campsite rup¬ 
tured with a small explosion. A flammable gas cloud began 
to spread through the site. Campers who did not appreciate 
that the full hazard from the burning tanker had yet to 
develop stood around bemused whilst escape was still 
possible. Many wore bathing suits or light beachwear. 
There followed a major explosion and flash fire. The even¬ 
tual death toll was about 210, a large proportion from 
severe burns. 

Other incidents in which many of the deaths occurred 
among spectators are those at Texas City in 1947, and 
Caracas, Venezuela, in 1982. In the Texas City disaster, a fire 
developed aboard a ship in the harbour. The ship was car¬ 
rying ammonium nitrate. In due course the ship disin¬ 
tegrated in an enormous explosion, killing all those in the 
dock, including firemen and spectators. This explosion and 
a further one in another ammonium nitrate carrier killed 
552 people and injured another 3000. 

The Caracas disaster involved a fire in an oil tank sited 
on a hill. A boilover occurred and the burning oil flowed 
down the hill. Forty firefighters were killed, together with 
many civil defence workers and spectators, giving a fatal¬ 
ity toll of 153 with 7 missing. 


24.14 Recovery 

A recovery from a major emergency event is a process that 
requires major efforts and takes a significant period of 
time. The extant of the efforts is a function of parameters 
such as the resources that are required to rebuild and 
renovate, requirements of the enforcing agencies, person¬ 
nel commitment, length of process purchasing and deliv¬ 
ery, and more. The most important factor in the recovery 
process is leadership, and therefore the recovery manage¬ 
ment should be selected carefully. Recovery process 
consists of a very large number of details. The recovery 
manager needs to establish a recovery team that will 
represents all the disciplines in the plant. The team should 
include representatives from engineering, maintenance, 
production, purchasing, ES&H, legal department and 
other, as the circumstances require. 

Following the emergency phase, the site should be 
secured and preservation of evidence and data collection 
need to take place. Parallel to these activities, human 
resources should provide assistance to employees and vic¬ 
tim families. Incident that resulted in fatalities will require 
professional psychological support as well. Portion of the 
efforts of assessment of the damage to the environment and 
property and incident investigation could be integrated to 
avoid repetition of some of the phases. Clean up activities 
should be coordinated extremely carefully to avoid removal 
of evidence. It is recommended to consider involvement of 
the media in the process in order to improve public relation, 
and recovery of the damaged image. 
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24.15 Regulations and Standards 

24.15.1 Regulations 

In the United States, the OSHA established the Process 
Safety Management (PSM) requirements, following the 
issuance of the Clean Air Act section 112(r). The US EPA 
followed by issuance of the Risk Management Program 
(RMP), for Chemical Accidents Release Prevention. 

The Health and Safety Executive in United Kingdom 
established guidance for writing on- and off-site emer¬ 
gency plans ‘HS (G) 191 Emergency planning for major 
accidents: Control of Major Accident Hazards (COMAH) 
regulations 1999’. OSHA PSM standard consists of 12 ele¬ 
ments. CFR 1910.38 in the standard states the requirements 
for emergency planning. However, other OSHA require¬ 
ments such as CFR 1910.156 that establish requirements for 
training Fire Brigades, and CFR 1910.146 that states the 
requirement for training emergencies in confined spaces 
are related as well. 

EPA RMP rule is based on industrial codes and stand¬ 
ards, and it requires companies to develop an RMP if 
they handle hazardous substances that exceed a certain 
threshold. The programme is required to include the 
following sections: 

(1) Hazard assessment based on the potential effects, an 
accident history of the last 5 years, and an evaluation 
of worst-case and alternative accidental releases. 

(2) Prevention programme. 

(3) Emergency response programme. 

On the other hand, EPA requires that the communities 
will put the efforts from their side. The EPA Emergency 
Planning and Community Right-to-Know Act (EPCRA) 
establishes requirements for the industry, Federal, State 
and local governments, on reporting on hazardous and 
toxic chemicals. 

EPCRA consists of four parts: 

(1) Emergency planning (Section 301-303), 

(2) Emergency release notification (Section 304), 

(3) Hazardous chemical storage reporting requirements 
(Sections 311-312) and 

(4) Toxic chemical release inventory (Section 313). 

The purpose of the EPCRA is to help increasing aware¬ 
ness in the public on chemicals at individual facilities, their 
uses and releases into the environment. The act states that 
every community in the United States must be part of a 
comprehensive emergency plan. 

Both, the Department of Transportation and the 
Department of Energy, address emergency planning. 
Information is available on their websites. 

24.15.2 Standards 

A large number of standards that addresses process safety 
and are relevant to process safety are available. However, 
the NFPA published a variety of standards that are useful 
in emergency planning and training for emergencies. List 
of NFPA publications is given in Appendix A. Similarly, 
the National Institute of Safety and Health and the 
American National Standards Institute (ANSI) provide 
guidelines and standards that can be helpful in planning 
for emergencies. 
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Appendix A: NFPA Publications 


NFPA1 
NFPA 10 
NFPA 11 

NFPA11A 
NFPA 12 
NFPA12A 
NFPA 13 
NFPA13D 

NFPA13E 

NFPA13R 

NFPA 14 
NFPA 15 
NFPA 16 
NFPA 17 
NFPA 17 A 

NFPA 18 
NFPA 20 

NFPA 22 
NFPA 24 


Uniform Fire Code 

Standard for Portable Fire Extinguishers 
Standard for Low-, Medium-, and High- 
Expansion Foam Systems 
Standard for Medium- and High-Expansion 
Foam Systems 

Standard on Carbon dioxide Extinguishing 
Systems 

Standard on Halon 1301 Fire Extinguishing 
Systems 

Standard for the Installation of Sprinkler 
Systems 

Standard for the Installation of Sprinkler 
Systems in One- and Two-Family Dwellings 
and Manufactured Homes 
Recommended Practice for Fire Department 
Operations in Properties Protected by 
Sprinkler and Standpipe Systems 
Standard for the Installation of Sprinkler 
Systems in Residential Occupancies up to 
and Including Four Stories in Height 
Standard for the Installation of Standpipe, 
Private Hydrants, and Hose Systems 
Standard for Water Spray Fixed Systems for 
Fire Protection 

Standard for the Installation of Foam-Water 
Sprinkler and Foam-Water Spray Systems 
Standard for Dry Chemical Extinguishing 
Systems 

Standard for Wet Chemical Extinguishing 
Systems 

Standard on Wetting Agents 

Standard for the Installation of Stationary 

Pumps for Fire Protection 

Standard for Water Tanks for Private Fire 

Protection 

Standard for the Installation of Private Fire 
Service Mains and Their Appurtenances 
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NFPA 25 Standard for the Inspection, Testing, and 
Maintenance of Water-Based Fire Protection 
Systems 

NFPA 30 Flammable and Combustible Liquids Code 
NFPA30A Code for Motor Fuel Dispensing Facilities 
and Repair Garages 

NFPA30B Code for the Manufacture and Storage of 
Aerosol Products 

NFPA 31 Standard for the Installation of Oil-Burning 
Equipment 

NFPA 32 Standard for Drycleaning Plants 
NFPA 33 Standard for Spray Application Using Flam¬ 
mable or Combustible Materials 
NFPA 34 Standard for Dipping and Coating Processes 
Using Flammable or Combustible Liquids 
NFPA 35 Standard for the Manufacture of Organic 
Coatings 

NFPA 36 Standard for Solvent Extraction Plants 
NFPA 37 Standard for the Installation and Use of Sta¬ 
tionary Combustion Engines and Gas Tur- 

NFPA40 Standard for the Storage and Handling of 
Cellulose Nitrate Film 

NFPA 42 Code for the Storage of Pyroxylin Plastic 
NFPA 45 Standard on Fire Protection for Laboratories 
Using Chemicals 

NFPA 50 Standard for Bulk Oxygen Systems at Con¬ 
sumer Sites 

NFPA 50A Standard for Gaseous Hydrogen Systems at 
Consumer Sites 

NFPA 50B Standard for Liquefied Hydrogen Systems at 
Consumer Sites 

NFPA 51 Standard for the Design and Installation of 
Oxygen-Fuel Gas Systems for Welding, Cut¬ 
ting, and Allied Processes 

NFPA 51A Standard for Acetylene Cylinder Charging 
Plants 

NFPA 51B Standard for Fire Prevention During Weld¬ 
ing, Cutting, and Other Hot Work 
NFPA 52 Compressed Natural Gas (CNG) Vehicular 
Fuel Systems Code 

NFPA 53 Recommended Practice on Materials, 
Equipment and Systems Used in Oxygen- 
Enriched Atmospheres 
NFPA 54 National Fuel Gas Code 
NFPA 55 Standard for the Storage, Use, and Handling 
of Compressed Gases and Cryogenic Fluids 
in Portable and Stationary Containers, 
Cylinders, and Tanks 

NFPA 57 Liquefied Natural Gas (LNG) Vehicular Fuel 
Systems Code 

NFPA 58 Liquefied Petroleum Gas Code 
NFPA 59 Utility LP-Gas Plant Code 
NFPA59A Standard for the Production, Storage, and 
Handling of Liquefied Natural Gas (LNG) 
NFPA 61 Standard for the Prevention of Fires and 
Dust Explosions in Agricultural and Food 
Processing Facilities 

NFPA 68 Guide for Venting of Deflagrations 

NFPA 69 Standard on Explosion Prevention Systems 
NFPA 70 National Electrical Code® National Elec¬ 
trical Code 

NFPA70A Electrical Code for One- and Two-Family 
Dwellings and Mobile Homes 


NFPA70B 

NFPA70E 

NFPA 72 
NFPA 73 

NFPA 75 

NFPA 76 

NFPA 77 
NFPA 79 
NFPA 80 
NFPA80A 

NFPA 82 

NFPA 85 
NFPA 86 
NFPA88A 
NFPA90A 

NFPA90B 
NFPA 91 


NFPA92A 
NFPA92B 
NFPA 96 


NFPA 97 


NFPA 99 
NFPA99B 
NFPA99C 
NFPA 101 
NFPA101A 

NFPA101B 
NFPA 102 


NFPA 105 
NFPA 110 
NFPA 111 

NFPA 115 
NFPA 120 
NFPA 121 


NFPA 122 
NFPA 123 


Recommended Practice for Electrical 

Equipment Maintenance 

Standard for Electrical Safety Requirements 

for Employee Workplaces 

National Fire Alarm Code 

Electrical Inspection Code for Existing 

Dwellings 

Standard for the Protection of Information 
Technology Equipment 
Recommended Practice for the Fire Protec¬ 
tion of Telecommunications Facilities 
Recommended Practice on Static Electricity 
Electrical Standard for Industrial Machinery 
Standard for Fire Doors and Fire Windows 
Recommended Practice for Protection of 
Buildings from Exterior Fire Exposures 
Standard on Incinerators and Waste and 
Linen Handling Systems and Equipment 
Boiler and Combustion Systems Hazards Code 
Standard for Ovens and Furnaces 
Standard for Parking Structures 
Standard for the Installation of Air- 
Conditioning and Ventilating Systems 
Standard for the Installation of Warm Air 
Heating and Air-Conditioning Systems 
Standard for Exhaust Systems for Air 
Conveying of Vapors, Gases, Mists, and 
Noncombustible Particulate Solids 
Recommended Practice for Smoke-Control 
Systems 

Guide for Smoke Management Systems in 
Malls, Atria, and Large Areas 
Standard for Ventilation Control and Fire 
Protection of Commercial Cooking Opera¬ 
tions 

Standard Glossary of Terms Relating to 
Chimneys, Vents, and Heat-Producing Appli¬ 
ances 

Standard for Health Care Facilities 
Standard for Hypobaric Facilities 
Standard on Gas and Vacuum Systems 
Life Safety Code 

Guide on Alternative Approaches to Life 
Safety 

Code for Means of Egress for Buildings and 
Structures 

Standard for Grandstands, Folding and 
Telescopic Seating, Tents, and Membrane 
Structures 

Standard for the Installation of Smoke Door 
Assemblies 

Standard for Emergency and Standby Power 
Systems 

Standard on Stored Electrical Energy Emer¬ 
gency and Standby Power Systems 
Standard on Laser Fire Protection 
Standard for Coal Preparation Plants 
Standard on Fire Protection for Self- 
Propelled and Mobile Surface Mining 
Equipment 

Standard for Fire Prevention and Control in 
Underground Metal and Nonmetal Mines 
Standard for Fire Prevention and Control in 
Underground Bituminous Coal Mines 
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NFPA130 

NFPA140 


NFPA150 

NFPA160 

NFPA170 

NFPA203 

NFPA204 

NFPA211 

NFPA214 

NFPA220 

NFPA221 

NFPA225 

NFPA230 

NFPA232 

NFPA241 

NFPA251 

NFPA252 

NFPA253 


NFPA255 

NFPA256 

NFPA257 

NFPA258 

NFPA259 

NFPA260 


NFPA261 


NFPA262 

NFPA265 

NFPA268 

NFPA269 

NFPA270 

NFPA271 


Standard for Fixed Guideway Transit and 
Passenger Rail Systems 

Standard on Motion Picture and Television NFPA272 
Production Studio Soundstages and Approved 
Production Facilities 

Standard on Fire Safety in Racetrack Stables 
Standard for Flame Effects Before an Audience 
Standard for Fire Safety Symbols NFPA 273 

Guide on Roof Coverings and Roof Deck 
Constructions 

Standard for Smoke and Heat Venting NFPA 274 

Standard for Chimneys, Fireplaces, Vents, 

and Solid Fuel-Burning Appliances NFPA 284 

Standard on Water-Cooling Towers 

Standard on Types of Building Construction NFPA 285 

Standard for Fire Walls and Fire Barrier 

Walls 

Model Manufactured Home Installation 
Standard 

Standard for the Fire Protection of Storage NFPA 286 
Standard for the Protection of Records 
Standard for Safeguarding Construction, 

Alteration, and Demolition Operations NFPA 287 

Standard Methods of Tests of Fire Endurance 
of Building Construction and Materials 
Standard Methods of Fire Tests of Door NFPA 288 
Assemblies 

Standard Method of Test for Critical Radiant 


Flux of Floor Covering Systems Using a NFPA 289 
Radiant Heat Energy Source 
Standard Method of Test of Surface Burning 
Characteristics of Building Materials NFPA 290 

Standard Methods of Fire Tests of Roof Cov¬ 
erings NFPA 291 

Standard on Fire Test for Window and Glass 
Block Assemblies NFPA 301 

Recommended Practice for Determining 
Smoke Generation of Solid Materials NFPA 302 

Standard Test Method for Potential Heat of 
Building Materials NFPA 303 


Standard Methods of Tests and Classifica¬ 
tion System for Cigarette Ignition Resistance NFPA 306 
of Components of Upholstered Furniture 
Standard Method of Test for Determining NFPA 307 

Resistance of Mock-Up Upholstered Furni¬ 
ture Material Assemblies to Ignition by 
Smoldering Cigarettes NFPA 312 

Standard Method of Test for FlameTravel and 
Smoke of Wires and Cables for Use in Air- NFPA 318 
Handling Spaces 

Standard Methods of Fire Tests for Evaluating NFPA 326 

Room Fire Growth Contribution of Textile 

Coverings on Full Height Panels and Walls NFPA 329 

Standard Test Method for Determining 

Ignitibility of Exterior Wall Assemblies 

Using a Radiant Heat Energy Source NFPA 385 

Standard Test Method for Developing 

Toxic Potency Data for Use in Fire Hazard NFPA 402 

Modeling 

Standard Test Method for Measurement of NFPA 403 

Smoke Obscuration Using a Conical Radiant 

Source in a Single Closed Chamber NFPA 405 

Standard Method of Test for Heat and Visible 

Smoke Release Rates for Materials and 


Products Using an Oxygen Consumption 
Calorimeter 

Standard Method of Test for Heat and Visible 
Smoke Release Rates for Upholstered Furni¬ 
ture Components or Composites and Mat¬ 
tresses Using an Oxygen Consumption 
Calorimeter 

Standard Method of Test for Determining 
the Degrees of Combustibility of Building 
Materials 

Standard Test Method to Evaluate Fire Per¬ 
formance Characteristics of Pipe Insulation 
Standard Test Method for Mattresses for 
Correctional Occupancies 
Standard Method of Test for the Evaluation of 
Flammability Characteristics of Exterior Non- 
Load-Bearing Wall Assemblies Containing 
Combustible Components Using the 
Intermediate-Scale, Multistory Test Apparatus 
Standard Methods of Fire Tests for Evaluat¬ 
ing Contribution of Wall and Ceiling Interior 
Finish to Room Fire Growth 
Standard Test Methods for Measurement 
of Flammability of Materials in Cleanrooms 
Using a Fire Propagation Apparatus (FPA) 
Standard Method of Fire Tests of Floor 
Fire Door Assemblies Installed Horizontally 
in Fire Resistance Rated Floor Systems 
Standard Method of Fire Test for Room Fire 
Growth Contribution of Individual Fuel 
Packages 

Standard for Fire Testing of Passive Protec¬ 
tion Materials for Use on LP-Gas Containers 
Recommended Practice for Fire Flow Testing 
and Marking of Hydrants 
Code for Safety to Life from Fire on Merchant 
Vessels 

Fire Protection Standard for Pleasure and 

Commercial Motor Craft 

Fire Protection Standard for Marinas and 

Boatyards 

Standard for the Control of Gas Hazards on 
Vessels 

Standard for the Construction and Fire 
Protection of Marine Terminals, Piers, and 
Wharves 

Standard for Fire Protection of Vessels 
During Construction, Repair, and Lay-Up 
Standard for the Protection of Semiconductor 
Fabrication Facilities 

Standard for the Safeguarding of Tanks and 
Containers for Entry, Cleaning, or Repair 
Recommended Practice for Handling Relea¬ 
ses of Flammable and Combustible Liquids 
and Gases 

Standard for Tank Vehicles for Flammable 

and Combustible Liquids 

Guide for Aircraft Rescue and Fire Fighting 

Operations 

Standard for Aircraft Rescue and Fire Fight¬ 
ing Services at Airports 
Recommended Practice for the Recurring 
Proficiency Training of Aircraft Rescue and 
Fire-Fighting Services 
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NFPA407 

NFPA408 

NFPA409 

NFPA410 

NFPA412 

NFPA414 

NFPA415 


NFPA418 

NFPA422 

NFPA423 

NFPA424 

NFPA430 

NFPA432 

NFPA434 

NFPA450 

NFPA471 

NFPA472 


NFPA473 


NFPA484 

NFPA490 

NFPA495 

NFPA496 

NFPA497 


NFPA498 

NFPA499 

NFPA501 

NFPA501A 

NFPA502 

NFPA505 


NFPA520 

NFPA550 

NFPA551 


Standard for Aircraft Fuel Servicing 
Standard for Aircraft Hand Portable Fire 
Extinguishers 

Standard on Aircraft Hangars 
Standard on Aircraft Maintenance 
Standard for Evaluating Aircraft Rescue and 
Fire Fighting Foam Equipment 
Standard for Aircraft Rescue and Fire Fight¬ 
ing Vehicles 

Standard on Airport Terminal Buildings, 
Fueling Ramp Drainage, and Loading 
Walkways 

Standard for Heliports 

Guide for Aircraft Accident Response 

Standard for Construction and Protection of 

Aircraft Engine Test Facilities 

Guide for Airport/Community Emergency 

Planning 

Code for the Storage of Liquid and Solid 
Oxidizers 

Code for the Storage of Organic Peroxide 
Formulations 

Code for the Storage of Pesticides 

Guide for Emergency Medical Services and 

Systems 

Recommended Practice for Responding to 
Hazardous Materials Incidents 
Standard for Professional Competence of 
Responders to Hazardous Materials Inci¬ 
dents 

Standard for Competencies for EMS Person¬ 
nel Responding to Hazardous Materials 
Incidents 

Standard for Combustible Metals, Metal 
Powders, and Metal Dusts 
Code for the Storage of Ammonium Nitrate 
Explosive Materials Code 
Standard for Purged and Pressurized Enclo¬ 
sures for Electrical Equipment 
Recommended Practice for the Classifica¬ 
tion of Flammable Liquids, Gases, or Vapors 
and of Hazardous (Classified) Locations for 
Electrical Installations in Chemical Process 
Areas 

Standard for Safe Havens and Interchange 
Lots for Vehicles Transporting Explosives 
Recommended Practice for the Classification 
of Combustible Dusts and of Hazardous 
(Classified) Locations for Electrical Instal¬ 
lations in Chemical Process Areas 
Standard on Manufactured Housing 
Standard for Fire Safety Criteria for Manu¬ 
factured Home Installations, Sites, and 
Communities 

Standard for Road Tunnels, Bridges, and 
Other Limited Access Highways 
Fire Safety Standard for Powered Industrial 
Trucks Including Type Designations, Areas 
of Use, Conversions, Maintenance, and 
Operation 

Standard on Subterranean Spaces 
Guide to the Fire Safety Concepts Tree 
Guide for the Evaluation of Fire Risk 
Assessments 


NFPA555 

NFPA556 

NFPA560 

NFPA600 

NFPA601 

NFPA610 

NFPA654 

NFPA655 

NFPA664 

NFPA701 

NFPA703 

NFPA704 

NFPA705 
NFPA 720 

NFPA 730 
NFPA 731 

NFPA 750 

NFPA 780 

NFPA 801 

NFPA 804 

NFPA 805 

NFPA 820 
NFPA 850 

NFPA 851 

NFPA 853 

NFPA 900 
NFPA 901 

NFPA 906 
NFPA 909 
NFPA 914 


Guide on Methods for Evaluating Potential 
for Room Flashover 

Guide on Methods for Evaluating Fire 
Hazard and Fire Risk of Vehicular Furnishing 
Standard for the Storage, Handling, and Use 
of Ethylene Oxide for Sterilization and 
Fumigation 

Standard on Industrial Fire Brigades 
Standard for Security Services in Fire Loss 
Prevention 

Guide for Emergency and Safety Operations 
at Motorsports Venues 

Standard for the Prevention of Fire and Dust 
Explosions from the Manufacturing, Proces¬ 
sing, and Handling of Combustible Particu¬ 
late Solids 

Standard for Prevention of Sulfur Fires and 
Explosions 

Standard for the Prevention of Fires and 
Explosions in Wood Processing and Wood¬ 
working Facilities 

Standard Methods of Fire Tests for Flame 
Propagation of Textiles and Films 
Standard for Fire Retardant Impregnated 
Wood and Fire Retardant Coatings for 
Building Materials 

Standard System for the Identification of 
the Hazards of Materials for Emergency 
Response 

Recommended Practice for a Field FlameTest 
for Textiles and Films 

Recommended Practice for the Installation of 
Household Carbon Monoxide (CO) Warning 
Equipment 

Guide for Electronic Premises Security 

Standard for the Installation of Electronic 

Premises Security Systems 

Standard on Water Mist Fire Protection 

Systems 

Standard for the Installation of Lightning 
Protection Systems 

Standard for Fire Protection for Facilities 
Handling Radioactive Materials 
Standard for Fire Protection for Advanced 
Light Water Reactor Electric Generating 
Plants 

Performance-Based Standard for Fire Pro¬ 
tection for Light Water Reactor Electric 
Generating Plants 

Standard for Fire Protection in Wastewater 
Treatment and Collection Facilities 
Recommended Practice for Fire Protection 
for Electric Generating Plants and High Vol¬ 
tage Direct Current Converter Stations 
Recommended Practice for Fire Protection 
for Hydroelectric Generating Plants 
Standard for the Installation of Stationary 
Fuel Cell Power Plants 
Building Energy Code 
Standard Classifications for Incident 
Reporting and Fire Protection Data 
Guide for Fire Incident Field Notes 
Code for the Protection of Cultural Resources 
Code for Fire Protection of Historic Structures 
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NFPA921 

NFPA1000 

NFPAlOOl 

NFPA1002 

NFPA1003 

NFPA1006 

NFPA1021 

NFPA1031 

NFPA1033 

NFPA1035 

NFPA1041 

NFPA1051 

NFPA1061 

NFPA1071 

NFPA1081 

NFPA1122 

NFPA1123 

NFPA1124 

NFPA1125 

NFPA1126 

NFPA1127 

NFPA1141 

NFPA1142 

NFPA1143 

NFPA1144 

NFPA1145 

NFPA1150 

NFPA1192 

NFPA1194 

NFPA1201 

NFPA1221 

NFPA1250 

NFPA1401 


Guide for Fire and Explosion Investigations 
Standard for Fire Service Professional Quali¬ 
fications Accreditation and Certification 
Systems 

Standard for Fire Fighter Professional Quali¬ 
fications 

Standard for Fire Apparatus Driver/Operator 
Professional Qualifications 
Standard for Airport Fire Fighter Profes¬ 
sional Qualifications 

Standard for Rescue Technician Professional 
Qualifications 

Standard for Fire Officer Professional Quali¬ 
fications 

Standard for Professional Qualifications for 
Fire Inspector and Plan Examiner 
Standard for Professional Qualifications for 
Fire Investigator 

Standard for Professional Qualifications for 
Public Fire and Life Safety Educator 
Standard for Fire Service Instructor Profes¬ 
sional Qualifications 

Standard for Wildland Fire Fighter Profes¬ 
sional Qualifications 

Standard for Professional Qualifications for 

Public Safety Telecommunicator 

Standard for Emergency Vehicle Technician 

Professional Qualifications 

Standard for Industrial Fire Brigade Member 

Professional Qualifications 

Code for Model Rocketry 

Code for Fireworks Display 

Code for the Manufacture, Transportation, 

Storage and Retail Sales of Fireworks and 

Pyrotechnic Articles 

Code for the Manufacture of Model Rocket 

and High Power Rocket Motors 

Standard for the Use of Pyrotechnics before a 

Proximate Audience 

Code for High Power Rocketry 

Standard for Fire Protection in Planned 

Building Groups 

Standard on Water Supplies for Suburban 
and Rural Fire Fighting 
Standard for Wildland Fire Management 
Standard for Protection of Life and Property 
from Wildfire 

Guide for the Use of Class A Foams in Man¬ 
ual Structural Fire Fighting 
Standard on Fire-Fighting Foam Chemicals 
for Class A Fuels in Rural, Suburban, and 
Vegetated Areas 

Standard on Recreational Vehicles 
Standard for Recreational Vehicle Parks and 
Campgrounds 

Standard for Developing Fire Protection 
Services for the Public 
Standard for the Installation, Maintenance, 
and Use of Emergency Services Commu¬ 
nications Systems 

Recommended Practice in Emergency 
Service Organization Risk Management 
Recommended Practice for Fire Service 
Training Reports and Records 


NFPA1402 

NFPA1403 

NFPA1404 

NFPA1405 

NFPA1410 

NFPA1451 

NFPA1452 

NFPA1500 

NFPA1521 

NFPA1561 

NFPA1581 

NFPA1582 

NFPA1583 

NFPA1584 

NFPA1600 

NFPA1620 

NFPA1670 

NFPA1710 


NFPA1720 


NFPA1851 


NFPA1852 

NFPA1901 

NFPA1906 

NFPA1911 

NFPA1912 

NFPA1914 

NFPA1915 

NFPA1925 

NFPA1931 


NFPA1932 

NFPA1936 


Guide to Building Fire Service Training 
Centers 

Standard on Live Fire Training Evolutions 
Standard for Fire Service Respiratory Pro¬ 
tection Training 

Guide for Land-Based Fire Fighters Who 
Respond to Marine Vessel Fires 
Standard on Training for Initial Emergency 
Scene Operations 

Standard for a Fire Service Vehicle Opera¬ 
tions Training Program 
Guide for Training Fire Service Personnel to 
Conduct Dwelling Fire Safety Surveys 
Standard on Fire Department Occupational 
Safety and Health Program 
Standard for Fire Department Safety 
Officer 

Standard on Emergency Services Incident 
Management System 

Standard on Fire Department Infection 
Control Program 

Standard on Comprehensive Occupational 
Medical Program for Fire Departments 
Standard on Health Related Fitness Pro¬ 
grams for Fire Fighters 
Recommended Practice on the Rehabilitation 
for Members Operating at Incident Scene 
Operations and Training Exercises 
Standard for Disaster/Emergency Manage¬ 
ment and Business Continuity Programs 
Recommended Practice for Pre-Incident 
Planning 

Standard on Operations and Training for 
Technical Rescue Incidents 
Standard for the Organization and Deploy¬ 
ment of Fire Suppression Operations, Emer¬ 
gency Medical Operations, and Special 
Operations to the Public by Career Fire 
Departments 

Standard for the Organization and Deployment 
of Fire Suppression Operations, Emergency 
Medical Operations and Special Operations 
to the Public by Volunteer Fire Departments 
Standard on Selection, Care, and Main¬ 
tenance of Structural Fire Fighting Protec¬ 
tive Ensembles 

Standard on Selection, Care, and Main¬ 
tenance of Open-Circuit SCBA 
Standard for Automotive Fire Apparatus 
Standard for Wildland Fire Apparatus 
Standard for Service Tests of Fire Pump 
Systems on Fire Apparatus 
Standard for Fire Apparatus Refurbishing 
Standard for Testing Fire Department Aerial 
Devices 

Standard for Fire Apparatus Preventative 
Maintenance Program 
Standard on Marine Fire Fighting Vessels 
Standard on Design of and Design Verifi¬ 
cation Tests for Fire Department Ground 
Ladders 

Standard on Use, Maintenance and Service 
Testing of Fire Department Ground Ladders 
Standard on Powered Rescue Tool Systems 
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NFPA1951 Standard on Protective Ensemble for USAR NFPA1989 
Operations 

NFPA 1961 Standard for Fire Hose 

NFPA 1962 Standard for the Inspection, Care and Use of NFPA 1991 
Fire Hose, Couplings and Nozzles; and the 
Service Testing of Fire Hose NFPA 1992 

NFPA 1963 Standard for Fire Hose Connections 
NFPA 1964 Standard for Spray Nozzles 

NFPA 1965 Standard for Fire Hose Appliances NFPA 1994 

NFPA 1971 Standard on Protective Ensemble for Struc¬ 
tural Fire Fighting NFPA 1999 

NFPA 1975 Standard on Station/Work Uniforms for Fire 

and Emergency Services NFPA 2001 

NFPA 1976 Standard on Protective Ensemble for Proxim¬ 
ity Fire Fighting NFPA 2010 

NFPA 1977 Standard on Protective Clothing and Equip¬ 
ment for Wildland Fire Fighting NFPA 2112 

NFPA 1981 Standard on Open-Circuit Self-Contained 
Breathing Apparatus for Fire and Emergency 
Services NFPA 2113 

NFPA 1982 Standard on Personal Alert Safety Systems 
(PASS) 

NFPA 1983 Standard on Fire Service Life Safety Rope 

and System Components NFPA 5000 


Standard on Breathing Air Quality for 
Fire and Emergency Services Respiratory 
Protection 

Standard on Vapor-Protective Ensembles for 
Hazardous Materials Emergencies 
Standard on Liquid Splash-Protective 
Ensembles and Clothing for Hazardous 
Materials Emergencies 
Standard on Protective Ensembles for 
Chemical/Biological Terrorism Incidents 
Standard on Protective Clothing for Emer¬ 
gency Medical Operations 
Standard on Clean Agent Fire Extinguishing 
Systems 

Standard on Aerosol Fire Extinguishing 
Systems 

Standard on Flame-Resistant Garments for 
Protection of Industrial Personnel Against 
Flash Fire 

Standard on Selection, Care, Use, and Main¬ 
tenance of Flame-Resistant Garments for 
Protection of Industrial Personnel Against 
Flash Fire 

NFPABuildingConstruction and Safety Code 
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25/2 PERSONAL SAFETY 


The majority of injuries or deaths on process plants are the 
result not of high technology but of quite simple situations. 
The number of people involved in a single accident is 
usually only one or two. Thus, although loss prevention is 
particularly concerned with technical aspects, it is appro¬ 
priate nevertheless to devote some consideration to hazards 
to the person and to their control. 

Moreover, the loss prevention approach has a contribu¬ 
tion to make in this area also. The same management dis¬ 
cipline is required to deliver good performance in the 
personal safety area as in that of high technology. Three 
aspects appear particularly relevant: formal systems and 
procedures, hazard identification and hazard assessment. 

In addition to injuries from accidents, workers may also 
suffer impairment of health which sometimes becomes 
apparent only over a long period. It is necessary, therefore, 
to make some mention of this type of hazard and its control 
by occupational health measures. 

Personal safety is dealt with in a large number of texts, 
which include Safety and Management by the Association 
of British Chemical Manufacturers (ABCM) (1964/3), 
Industrial Safety Handbook (Handley, 1969,1977), Industrial 
Hazard and Safety Handbook (R. King and Magid, 1979), 
Safety and Accident Prevention in Chemical Operations 
(H.H. Fawcett and Wood, 1982), and Safety at Work (Ridley, 
1993-) and Safety in the Process Industries (R. King, 1990). 
Selected references on personal health and safety are given 
in Table 25.1. 

The general nature of the problem may be seen from the 
injury figures given in the Health and Safety Statistics 1990/ 
91 (HSE, 1992b) and shown inTable 25.2. These data refer to 
general industrial accidents and need to be supplemented 
for the chemical industry by data for that industry. These 
are reported on an occasional rather than an annual basis. 
Some accident data given in the Annual Report of HM Chief 
Inspector of Factories for 1985 are shown in Table 25.3. 

The overall approach in questions of personal safety 
should always be, in order of descending preference, (1) haz¬ 
ard elimination, (2) hazard control and (3) personal protec¬ 
tion. The principle of hazard elimination and control before 
resort to personal protection is a recurring theme. 

Another recurring theme in personal safety is the need 
for thorough training and for effective supervision. The 
objectives of training should include not only the ability to 
use equipment and perform tasks, but also the under¬ 
standing and motivation to do the work properly and safely. 
In other words, the worker should be convinced as well as 
instructed. Most of the hazards and activities described in 
this chapter have some training implications. The impor¬ 
tance of training cannot be overemphasized. Similarly, it is 
essential to have good supervision so that malpractices are 
stopped and procedures are enforced. 

25.1 Human Factors 

Much can be done to reduce accidents by proper design of 
the work situation. This is the province of human factors. 
An account of human factors in general and of its applica¬ 
tion to the job of the process operator in particular is given 
in Chapter 14. Discussion here is confined to those aspects 
which are particularly relevant to personal accidents. 

Guidance on human factors aspects is given in HS(G) 
48 Human Factors in Industrial Safety (HSE, 1989). Fur¬ 
ther accounts are given in Human Factors Engineer¬ 
ing (McCormick, 1957b), Human Engineering Guide to 


Table 25.1 Selected references on personal health 
and safety 


American Petroleum Institute (API) (EA-7402); Fire 
Protection Association (FPA) (S9, S10); HM Chief Inspector 
of Factories (annual); National Institute of Industrial 
Psychology (n.d.); OSHA (n.d./3, OSHA 2237,1990/6); 
RoSPA (IS/106); MCA (1962-/1-4); M.E.Webb (1962); 

D.B. Campbell (1965); Berry (1969,1977); Kershaw (1969); 
International Labour Office (ILO) (1972,1980b); Robens 
(1972); McCormick (1974); Bond and Bryans (1975); 

PLTB (1975 Safety Training Guide 1); Kershaw and Symons 
(1977); Atherley (1978); R. King and Magid (1979); Bulloff 
(1987); H.E. Nelson (1987); National Fire Protection 
Association (NFPA) (1991NFPA101,1992 NFPA101M, 
1994/40) 

Human factors (see also Tables 14.1,14.2 and 14.11) 

Hands (1969); American Industrial Hygiene Association 
(AIHA) (1971/1); Singleton (1976b); Stoecker (1976); 
Atherley (1977b); Dumitriu (1977); Hale and Glendon 
(1987); Health and Safety Executive (HSE) (1989 HS(G) 48); 
ACGIH (1992/76) 

Occupational hygiene, industrial hygiene 

ACGIH (Appendix 28); ASTM (STP164); Gauvain (n.d.); 
HSE (Appendix 28 Medical, SHW Leaflets, SIR 8,1977e, 

1982 HS(G) 20,1984 SHW 395,1987 Oil Industry 2,1993 
CRR 57); MCA (SG-1); National Institute of Occupational 
Safety and Health (NIOSH) (n.d./3,1974 Crit. Doc. 75-126, 
1977/4,1979/5,1980/22,1981/6,1985/8,1988/9,24,1987/11, 
1989/25,1990/19,1991/20,1992/21); National Safety 
Council (NSC) (n.d./3,1988/9,1989/10); Harvey and 
Murray (1958); Hunter (1959,1975); R.T. Johnson and 
Miller (1960); W.H. Meyer and Church (1961); Ministry of 
Labour (1962); Mort (1965); Coates (1966); SCI (1968); 

M.H. Hall (1969); Mayers (1969); Wilcox (1970); McElroy 
and Olishifski (1971); Schilling (1973); Kusnetz (1974); 

J.F. Morgan (1974); Socha (1974); AIHA (1975/2,1984/7, 
1988/14,15,1990/19); Scherberger (1977); Vlad (1977); 
Anon. (1978e); Atherley (1978); Mnnn (1978); D. Turner 
(1978); R. King and Magid (1979); Kohn (1979a); Thiess and 
Zapp (1979); Waldron (1979,1989); Harvey (1980-); P. Lewis 
(1980); Waldron and Harrington (1980); Widmer (1980); 
Burgess (1981); Chissick and Derricott (1981); Cullis and 
Firth (1981);Woolhead (1981); D. Farmer (1982); Gill and 
Ashton (1982); Selman (1982); Harrington and Gill (1983-); 
Murphy (1982);T.J. Rose and Nourish (1982); British 
Occupational Hygiene Society (BOHS) (1983 Monogr. 10); 
Constance (1983); First (1983); IBC (1982/27,30); ILO 
(1983/1); Kusnetz and Phillips (1983); Parmeggiani (1983); 
ASME (1984/196); CIA (1984 RC13); CONCAWE (1984 
84/54,1986 86/69,1987 87/57); Wang (1984); J.R.P. Clarke 
(1985); Health and Safety Commission (HSC) (1986/6); 
Cralley and Cralley (1987); Foa etal. (1987); Lipton and 
Lynch (1987,1994); Ricci and Cox (1987); Noma etal. 

(1988); R.M. Scott (1989); Abdullah and Yacob (1990); API 
(1990 Publ. 4519); Burge (1990); Carson and Mumford 
(1990 LPB 91); Dees and Taylor (1990); J.C. Edwards 
and Bujac (1990); Phoon and Tan (1990); Wolff (1990); 
Ryder (1991); IP (1993 MCSP Pt 18,1993/3); Lin etal. (1993); 
Phoon (1993) 

Skin diseases, dermatitis: BSC (n.d./3,9); Department of 
Health Education and Welfare (n.d.); HSE (HSW Bklt 18, 
1974 MS(B) 1,1975 SHW 367,1982 SHW 397,1981 EH 26, 

1983 MS(B) 6,1990 EH 58,1991 MS 24); R.P. White (1934); 
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L. Schwartz,Tulipan and Birmingham (1957); McCreanney 
(1969,1977); Fregert (1974); Levene and Calnan (1974); 
Rycroft (1979,1980,1980 LPB 33); McNaughton (1982); 
Gadian (1983); WA.D. Griffiths and Wilkinson (1985) 
Allergies, asthma: Eppe, Fontanges and Grollier-Baron 
(1980); BOHS (1984 Monogr. 12); HSE (1991 MS 25) 

Workplace exposure, environmental control, 
exposure monitoring 

ACGIH (Appendix 28); AIHA (Appendix 28); ASTM (STP 
164); HSE (MS 18,1989 EH 42,1990 HS(G) 61,1992 EH 56); 
MCA (1968/15); Linch (1974,1981); Newcombe (1974); API 
(1975 Publ. 4262); Chemical Society (1975); Zatek (1975); 
Marion (1979); Jardas (1980); Rung (1980); IBC (1981/14); 
British Gas (1987 TIN 25);Thorsen and Molhave (1987); 
Grumbles (1990) 

Analysis of working atmosphere, analytical 
methods 

DoEm (Det. Bklts series); HSE (MSDS series); Sunshine 
(1969); ACGIH (1972,1988/24,1989/27); Associated 
Octel Co. (1974 Bull. 18); Lisk (1974); CIA (1975/8); Ratcliff 
(1975);Thain (1976); NIOSH (1977-78/2,1978/1); Groves 
(1978); G.L. Lee (1980); Walton (1980); ASTM (1981 STP 721, 
1982 STP 786); Lauwerys (1983); Lloyd (1987); OSHA 
(1990/5); AIHA (1993/9,27) BS (Appendix 27 Analytical 
Methods) 

Control of Substances Hazardous to Health 
Regulations (COSHH), including assessments 

CIA (1989 RC9, RC11,1990 RC10, RC12,1991RC38, RC39); 
HSE (1989/24, IND(G) 64(L), 65(L), 67(L), 1990/28); Hewitt 
(1991); Hopkin (1991); Luxon (1991); Samuels (1991) 

Severe physical conditions 

C.N. Davies, Davis and Tyrer (1967); Harrington (1980b); 
NIOSH (1987/15) 

Hot environments: NIOSH (1972 Crit. Doc. 72-10269; 1986 
Crit. Doc. 86-113); Bedford (1974); Gill (1980a); American 
Society of Heating, Refrigerating and Air Conditioning 
Engineers (ASHRAE) (1985 ASHRAE 55); Jefri and Daous 
(1989); McGrath (1993) 

Environmental control: Bedford (1974); Waldron (1980b) 
Corrosive chemicals 

MCA(SG-l);OSHA(OSHA2237);Harford(1969);WI.Morton 
(1976); E.L.M. Roberts (1977); HSE (1984 SHW 395) 

Dust, including asbestos (seeTable 18.1) 

Aerosols (seeTable 18.1) 

Ventilation 

HSE (SIR 16,1975a, 1975 TON 19,1987 HS(G) 37,1988 EH 
22,1990 HS(G) 54); Walls and Metzner (1962); Hemeon 
(1963); ACGIH (1968,1982/6,1988/21,1989/38,1991/58, 
66-69); Grandidge (1969); IHVE (1970); ASHRAE (1972, 
1973,1988 ASHRAE 11,1989 ASHRAE 62,1991/4,5,1992/6, 
1993/7); Baturin (1972); Leach and Bloomfield (1973,1974 
BRE CP 36/74); Mecklenburgh (1973,1976,1985); Bedford 
(1974); Croome-Gale and Roberts (1975); MacDermott 
(1976); Anon. (1977 LPB 15, p. 10); CIBS (1977a,b); 
Chartered Institute of Building Service Engineers (CIBSE) 
(1977,1978-); Gill (1980b); ASTM (1982 STP 719); Caplan 
(1982); Goodfellow and Smith (1982); Anon. (1983 LPB 49, 
p. 15); Walsh, Dudney and Copenhauer (1983); Mitler (1984); 
Constance (1985); Goodfellow (1985,1986); Hayashi etal. 


(1985); Huebener and Hughes (1985); M.R. Marshall (1983); 
Cassells (1986-); Fangerand Christensen (1986); 

M.R. Marshall and Stewart Darling (1986); BOHS (1987); 
Anon. (1988 LPB 80, p. 20); AIHA (1991/21,22,1993/25); 
Eycott (1989); J.C. Edwards and Bujac (1990); Andreopoulos, 
Karayanis and Markatos (1992); NFPA (1992 NFPA 91,1993 
NFPA90A); McGrath (1993); ANSI Z9 series, ANSI Z9.2- 
1979, ANSI Z9.1-1991; BS 5720:1979, BS 5925:1991 
Local exhaust ventilation (LEV): Dallavalle (1952); 

B. Fletcher (1977); Bender (1979); Goldfield (1980); 
Goodfellow and Bender (1980); D. Hughes (1980); Piney and 
Carrol (1983); J.D. Cook and Hughes (1986); B. Fletcher and 
Johnson (1986); Saunders (1987) 

Compressed air 

American Oil Co. (n.d./2); BSC (n.d./l); Paterson (1969, 
1977); HSE (1989f, 1990 HS(G) 39) 

Inert gas 

Kletz (1980f); Anon. (1991 LPB 97, p. 5); Anon. (1991 LPB 
102, p. 25); Anon. (1993 LPB 110, p. 8); Anon. (1993 LPB 

112, p. 20) 

Electricity 

American Oil Co. (n.d./5); HSE (HSW Bklt 31,1984 
GS 27,1985 GS 37,1986 GS 38); RoSPA (IS/73); Haigh 
(1969); Consumers Association (1972); Bland (1977); 

Crom (1977); Bales (1977a, b); W.R. Lee (1977); BOHS 
(1985 Monogr. 2); Fordham Cooper (1986); Anon. (1990 LPB 
92, p. 22); Anon. (1991 LPB 102, p. 25); Marks (1991); 

NFPA (1993 NFC 70); Anon. (1994 LPB 118, p. 16) BS 
(Appendix 27 Electrical) 

Non-ionizing radiations 

ACGIH (n.d./12,1990/48); WHO (EHC14); Battocletti (1976); 
AIHA (1977-/3); BOHS (1978 Monogr. 1); Harrington 
(1980b); Kanagasabay (1980); Chowdhury (1982); Kielman 
and Fawcett (1982); McKinlay (1982) 

Ionizing radiations (see alsoTable A20.1) 

ACGIH (n.d./12,1990/48); MRC (1956,1975a); Wiltshire 
(1957); Imperial College (1958); Blatz (1959); Cherubin 
(I960); US Congress, Joint Committee on Atomic Energy 
(1960); Kuhn (1964); H.H. Fawcett (1965c); CVCP (1966); 
P.S. Baker (1968); Black and Horn (1968); Coombe (1968); 
Department of Employment and Productivity (1968); 
Bennellick (1969); HSE (1970 HSW Bklt 13); L.S. Taylor 
(1971); NAS/NRC (1972c); Shapiro (1972); International 
Commission on Radiological Protection (ICRP) (1977c, 
1979); Brodsky (1978-); R. King and Magid (1979); Doran 
(1980); Harrington (1980b); Holiday (1980 LPB 35); Dennis 
(1982); Kielman and Fawcett (1982); UN Scientific 
Committee on Effects of Atomic Radiation (1977,1982); 
BOHS (1982 Monogr. 5); Chilton, Shultis and Faw (1984); 
NFPA (1991 NFPA 801) BS (Appendix 27 Radioactivity) 

ACGIH (n.d„ 1990/41); Sliney and Wolbarsht (1980); Weber 
(1982); Winburn (1987,1990); Pilborough (1989); CVCP 
(1992) BS 7192:1989, BS EN 60825:1992 

Physical chemistry 

Leach (1967); Jennings (1974a,b); Keey (1977) 

Lifting and carrying 

HSE (HSW Bklt 1,1971 HSW Bklt 47,1978 PM 16,1981 PM 
21, 27,1985 PM 54, Research Review 2,1986 GS 39, 
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1993 PM 15); Halliday (1969); R. King and Magid (1979); 
Ayoub, Mital, Asimetal. (1980); Ayoub, Mital, Bakeen etal. 
(1980); Garg and Ayoub (1980); NIOSH (1981/7); Westerling 
and Kilblom (1981); Ayoub (1982); AIHA (1983/5,1989/16); 
Ayoub, Selan and Liles (1983); A.R. Hale (1984); Mital 
(1984a,b); Parnianpour, Bejjani and Pavlidis (1987); 
Nicholson (1989); Genaidy (1991); Snook and Ciriello (1991); 
Kroemer (1992); Pizatella etal. (1992); Waters etal. (1993); 
Kuorinka, Lortie and Gautreau (1994) 

Machinery, machine guarding 

BSC (n.d./5); HSE (HSW Bklt 4,14,20,33,42,TON 32,33, 

38,1970 HSW Bklt 41,1971 HSW Bklt 3,1980 MS 1,1981 PM 
21,23,1982 HS(G) 19,1984 PM 1,38,1986 PM 65); 
Blackshield (1969); Bramley-Harker (1969); Fairclough 
(1969); S.F. Smith (1969); Harding (1977); Southwell 
(1977); R. King and Magid (1979); Kinsley (1980); Rouhianen 
(1982); Vartiala (1982) ANSI B7.1-1988; BS (Appendix 27 
Machinery) 

Construction, demolition (seeTable 21.1) 

Welding (seeTables 12.1 and 21.1) 

Abrasive wheels 

Blackshield (1969); Southwell (1977); HSE (1984 
HS(G) 17) 

Pneumatic tools 

PNEUPROP (n.d., a,b, 1986) 

Miscellaneous hazards 

American Oil Co. (n.d./l, 2,6); MCA (SG-11); HSE (1971 
HSW Bklt 27,1974 HSW Bklt 46); EPA (1974 S8); BDH 
(1977c); Russell (1982) 

Plant layout (seeTable 10.2) 

Lighting (seeTable 10.2) 

Identification and labelling (see alsoTable 23.1) 

R.F. Wilson (1960); Gloag (1961); Hurst (1969); ASME 
(1975 A13.1-1975); MCA (1976/24); BDH (1977a); Stancliffe 
(1977); HSE (1985 HS(G) 27); API (1993 RP1109) BS 
(Appendix 27 Identification of Equipment) 

Personal protection 

NIOSH (1984/23,1990/17); NRC (Appendix 28 Personal 
Protective Equipment, PPE); N.T. Freeman (1962); 

H.H. Fawcett (1965b, 1982c); C.S. Nicholson (1969); 

W.I. Morton (1976); K.R. Nicholson (1976); Zippier (1976); 
Riddell (1977); Chlorine Institute (1978 Pmphlt 65); 

R. King and Magid (1979); BS (Appendix 27 Personal 
Protection ) 

Protective clothing, including gloves: ACGIH (n.d./lO, 
1989/30); Associated Octel Co. (1974 Bull. 21); Gauerke 
(1972); J.S. Shaw (1978); E.J.West etal. (1978); Crockford 
(1980); Stull (1987a,b); Hoyle (1988 LPB 80); 

Jones (1988 LPB 80); Parson (1988); Preece (1988); 

AIHA (1990/18); Mellin (1991 LPB 100); Tooth 
(1991 LPB 100); Bensel (1993); Pal etal. (1993); Mitel, 

Kuo and Faard (1994) 

Ear protection: Zohar, Cohen and Azar (1980) 

Eye protection: Joyner (1959); Guelich (1965); Barker (1969, 
1977); Wigglesworth (1974); Hill (1975); Nichols (1982); CIA 
(1990 RC22); ANSI Z87.1-1989; BS 2092:1987 


Footwear: FPA (1973 S4); ANSI Z41-1991; BS 1870:1976- 
Head protection: Anon. (1988 LPB 88, p. 14); ANSI Z89.1- 
1986; BS 5240:1987- 

Respiratory protective equipment (RPE), breathing 
apparatus (BA) 

Fieldner, Katz and Kinney (1921); S,J. Pearce (1957); ACGIH 
and AIHA (1963); H.H. Fawcett (1965d, 1982d); Cheffers 
(1969); Home Office (1975 Manual of Firemanship Bk 6); 
Anon. (1977—); Vanchuk (1978); HSE (1979 RA1); 

M.S. Levine (1979); Ballantyne and Schwab (1981); 
Chlorine Institute (1982 Pmphlt 75); Evans and Leinster 
(1984 LPB 60); IGasE (1986IGE/SR/13); Louhevara etal. 
(1986); NIOSH (1987/12,14); Anon. (1988 LPB 80); CGA 
(1989 G-7, G-7.1); HSE (1990 EH 53, HS(G) 53); Anon. 
(1991c); AIHA (1991/23); CIA (1991RC6); Anon. (1992 LPB 
106, p. 17); ACGIH (1992/88); ANSI Z88.2-1992; BS 
(Appendix 27 Personal Protection), BS 4275:1974, BS 4667: 
1974—, BS DD 97:1987- BS 7170:1990, BS EN132:1991 
Rescue 

EEUA (1962 Doc. 12); Home Office (1964/8); Walters (1977); 
MoD (1989a); HSE (1992 RP23) BS (Appendix 27 Personal 
Protection, Rescue) 

First aid 

HSE (HSW Bklt 36); St John Ambulance Association (1961, 
1992); Gardner and Roylance (1967);Taylor (1967); Cameron 
(1969,1977); API (1979 Publ. 2017); BDH (1977b); R. King 
and Magid (1979); McKenna and Hale (1981,1982); Chlorine 
Institute (1985 Publ. 63); ACGIH (1988/19,32,1991/64) 
Isolated workstations 
Bresson and Perez (1977) 


Equipment Design (C.T. Morgan et al., 1963), Human 
Engineering Guide for Equipment Designers (Woodson and 
Conover, 1964), Human Factors Evaluation in System Devel¬ 
opment (Meister and Rabideau, 1965), Ergonomics (Murrell, 
1965a), Human Performance in Industry (Murrell, 1965b), 
Human Factors (Meister, 1971), Handbook of Human Factors 
(Salvendy, 1987), Applied Ergonomics Handbook (Burke, 
1992 ACGIH/76) and Human Factors in Design and Engi¬ 
neering (Sanders, 1993). Accounts of human factors with 
specific reference to safety are given in Ergonomics Guides 
(AIHA, 1970—/l), Human Aspects of Safety (Singleton, 
1976b) and Human Factors in Process Operations (Mill, 
1992) and by Hands (1969,1977). 

Human factors should be considered from the beginning 
of the project. Much of the contribution which it can make 
to accident prevention is in areas such as the allocation of 
function between man and machine. If it is brought in later 
for detailed equipment design or in a rescue role, many of 
the options for design are already foreclosed. 

Much work in human factors is concerned with human 
error. In fact, error rates are one of the main criteria used in 
scoring human factors experiments.Where an error leads to 
injury or other serious effect, it becomes an accident. 

Error is to a large extent a function of the work situation. 
As such it is amenable to reduction by better design of the 
work situation, including not only equipment design but 
also all other relevant factors. Some error is certainly 
attributable to the individual, and variations in error rates 
between individuals can be investigated. But management 
should concentrate primarily on the work situation, since 
this is not only the factor which is most important but also 
that which it can most readily alter. 
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Table 25.2 Injuries to employees by nature of accident and of injury and by severity of injury in the year 1990/91 
(after HSE, 1992bf 

A Nature of accident and severity of injury 1 ' 




Nature of accident 


Severity of injury 



Fatal 

Non-fatal major 

Total 

Contact with moving machinery 

29 

1,738 

9,491 

or material being machined 

Struck by moving, including 

51 

2,371 

25,788 

flying or falling, object 

Struck by moving vehicle 

53 

733 

4,631 

Struck against something 

3 

781 

11,074 

fixed or stationary 

Injured whilst handling, lifting 

- 

1,257 

55,477 

or carrying 

Slip, trip or fall on same level 

1 

6,396 

39,849 

Fall from a height: 

Up to and including 2 m 

8 

1,964 

9,261 

Over 2 m 

66 

1,337 

3,162 

Height not stated 

7 

973 

4,517 

All heights 

81 

4,274 

16,940 

Trapped by something collapsing 

24 

204 

776 

or overturning 

Drowning or asphyxiation 

10 

22 

58 

Exposure to or contact with a 

14 

806 

5,336 

harmful substance 

Exposure to fire 

5 

109 

690 

Exposure to an explosion 

8 

90 

318 

Contact with electricity or electrical 

24 

298 

929 

discharge 

Injured by an animal 

3 

72 

928 

Other kind of accident 

28 

651 

7,960 

Injuries not classified by kind 

12 

94 

808 

Total 

346 

19,896 

181,053 

B Nature and severity of injury 0 

Nature of injury 

Fatal 

Severity of injury 

Non-fatal major 

Total 

Amputation 

- 

1,392 

1,463 

Loss of sight 


20 

29 

Fracture 

46 

14,108 

27,035 

Dislocation 

- 

30 

1,146 

Concussion and internal injuries 

16 

147 

1,290 

Lacerations and open wounds 

3 

617 

12,453 

Contusions 

37 

371 

29,221 

Burns 

9 

859 

5,827 

Poisonings and gassings 

25 

224 

822 

Sprains and strains 

- 

153 

59,752 

Superficial injuries 

- 

263 

17,478 

Natural causes 

— 

5 

20 

Other injuries caused by contact with electricity 

19 

80 

318 

Injuries of more than one of the other natures 

37 

261 

2,738 

Injuries not elsewhere specified 

21 

68 

1,228 

Injury not known 

85 

327 

11,128 

Total 

298 

18,925 

171,948 


a Source: Health and Safety Statistics 1990/91 (HSE, 1992b). Section A is an extract from table 9 and Section B is an extract from table 15. 
b Injuries reported to all enforcing authorities, including offshore injuries. 
c Injuries reported to the Factory and Agricultural Inspectorates and to local authorities. 
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Table 25.3 Incidents in the chemical industry in 1983 (after HM Chief Inspector of Factories, 1986b) 
A Incidents 


Incident type 

No of incidents 

Proportion of 
incidents (%) 

Releases of chemicals 1 

222 

34.5 

Machinery incidents 

77 

12.0 

Process-related fires and explosions 

66 

10.3 

Falls from a height 

56 

8.7 

Falls at same level and striking against objects 

39 

6.1 

Pressure system and other equipment failures b 

24 

3.7 

Hit by falling objects 

23 

3.6 

Failure or overturning of lifting equipment 

22 

3.4 

Struck or trapped by vehicle 

15 

2.3 

Affected by chemicals during work c 

13 

2.0 

Runaway exothermic reactions' 1 

9 

1.4 

Manual handling and strains 

8 

1.2 

Non-process related fires and explosions 

7 

1.1 

Confined space incidents - people overcome 

5 

0.8 

Electric short circuits 

5 

0.8 

Not elsewhere classified 

52 

8.1 

Total 

643 

100 


B Other information 


1. 17 incidents involved clear failures of the permit-to-work system 

2. There were 30 pipework failures in addition to 37 incidents involving flexible hoses or insecure temporary joints 

3. Of the 222 releases of chemicals, 127 (57%) affected people directly or indirectly to some degree, 92 (41%) occurred 
during normal operation with no immediate direct involvement of workpeople, 64 (29%) occurred during normal 
operations with direct involvement of workpeople, 68 (30%) occurred during cleaning, maintenance or repair 
activities 

4. 49 cases of ill health were recorded, mostly associated with the release of chemicals or with confined spaces 

5. 17 incidents involved tanker vehicles or tank containers 

6. 62 incidents (9.6%) involved personnel other than those employed by the occupier, ie. contractors, visitors, etc. 

a Including 97 toxic; 51 corrosive; 45 flammable; 23 hot, and 6 other materials. 

b Where main risk was not from chemicals released. 

c Examples are decanting, charging, etc., without significant escape or spill. 

d With no major release of chemicals. 


Principal influences on the frequency of errors, and 
hence of accidents, include (1) equipment design, (2) work¬ 
ing methods, (3) motivation and (4) stress. 

There is now a wealth of data on the design of equipment. 
The equipment should be physically easy to use. Valuable 
guidelines here are given by anthropometry, which is the 
study of human measurements. 

It is often possible to build into equipment a barrier to 
error. A simple example is to prevent a plug being put into 
the wrong socket by making the relative shapes such that 
this is impossible. More complex methods for achieving 
similar results include interlocks. 

Correct identification is important if error is to be avoi¬ 
ded. There should be clear and consistent coding and 
labelling. Avaluable form of coding is by colour. 

Much information is available on the ways in which 
humans receive information through the senses. Some 
account of this has already been given in Chapter 14 in 
relation to the design of displays and controls. 

It is necessary to train the operator in the use of equip¬ 
ment. The training should deal not only with how the 
operation is performed but also with why it is done that way. 

Although training is important, it is not always the cor¬ 
rect solution. Sometimes error is inherent in the design of 


the equipment. In this case, it is better to redesign the 
equipment than to use training to overcome the defects. 

It is important to pay attention to motivation in the use of 
correct and safe methods of operation, and this should be a 
major objective of training. 

Human performance is much affected by stress. Some 
factors which cause this stress include poor environmental 
conditions, bad equipment design, lack of time, fatigue and 
anxiety. Although there tends to lie some improvement in 
performance at moderate levels of stress, beyond a certain 
threshold (which is different for each individual), it causes 
severe deterioration. 

Important aspects of the environment are air quality, 
thermal conditions, illumination and noise. The first two 
are considered in Section 25.3. The last two are treated by 
Ragsdale (1969) and Atherley and Purnell (1969). Noise is 
also dealt with in Appendix 12. 


25.2 Occupational Health 

Occupational health is an established branch of medicine. 
It involves not only the investigation of industrial disease 
but also the provision of health services at the place of work. 
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Accounts of occupational health are given in Occupa¬ 
tional Diseases and Industrial Medicine (R.T. Johnson and 
Miller, 1960), Diseases of Occupations (Hunter, 1975), Occu¬ 
pational Health and Safety Concepts (Atherley, 1978), Recog- 
nitionofHealthHazardsinIndustry(Bmgess,1981ACGI}I/5), 
Occupational Health (Harrington and Gill, 1983-), Chemical 
Exposure and Disease (Sherman, 1988 ACGIH/16), Occupa¬ 
tional Health Practice (Waldron, 1989), Occupational and 
Environmental Health Management (Kavianan and Wentz, 

1990 ACGIH/47), Health Fundamentals (Hansen, 1991 
ACGIH/71) and Industrial Health (Peterson, 1991ACGIH/65). 
Epidemiological aspects are treated in Exposure Assessment 
for Epidemiology andHazard Control (Rappaport and Smith, 

1991 ACGIH/56) and Introduction to Occupational Epide¬ 
miology (Hernberg, 1992 ACGIH/79). 

Guidance on occupational health arrangements is given 
in HS(G) 20 Guidelines for Occupational Health Services by 
the HSE (1980). 

25.2.1 Industrial medical services 

A chemical works usually has a medical centre with facil¬ 
ities for medical tests and which is able to handle a small 
number of casualties. The centre is typically staffed by a 
doctor working part time and a nurse working shifts. 
Descriptions of such medical services and of their liaison 
with hospital emergency departments are given by 
Cameron (1969,1977) and M.H. Hall (1969, 1977), respec¬ 
tively, and the work of an industrial nurse is described by 
Mort (1965). 

The medical personnel should be familiar with the che¬ 
micals and processes used in the particular factory. Infor¬ 
mation such as that given on materials safety data sheets 
provides a useful starting point. 

Information on the medical history of individual workers 
is equally important. Careful interviewing and record 
keeping can assist in diagnosing early symptoms or high 
susceptibility in individuals. It can also make a significant 
contribution to the epidemiological investigation of indus¬ 
trial disease. 

25.2.2 Employment Medical Advisory Sen/ice 

The Employment Medical Advisory Service Act 1972 and 
the Health and Safety at Work etc. Act (HSWA) 1974, Part II 
define the role of the Employment Medical Advisory Service 
(EMAS). Information on EMAS is given in Employment 
Medical Advisory Service Act 1972 - Guide to the Service. 

The service acts as the medical arm of the HSC, does 
work on medical matters for which there are statutory 
requirements, provides medical advice to the Factory 
Inspectorate and to employers, and furthers research on the 
epidemiology of industrial disease. 

It is able to advise on the effects of particular jobs on 
health, on the medical precautions to be taken in working 
with substances which are toxic or otherwise hazardous to 
health, and on medical examinations, investigations and 
surveys. 

There is a series of guidance notes on medical topics (the 
Medical Series (MS)) and also series of leaflets (the MS(A) 
and MS(B) series). 

25.2.3 National Institute for Occupational 
Safety and Health 

An important source of information on occupational health 
is the NIOSH. Some publications of the Institute are listed 
in Appendix 28. 


25.3 Occupational Hygiene 

Industrial chemicals tend to be noxious substances. It is 
essential, therefore, to take appropriate measures of occu¬ 
pational hygiene to ensure that those who work with them 
are not exposed to unacceptable risks. 

Occupational health and hygiene are the subject of the 
Control of Substances Hazardous to Health Regulations 
1988 (the COSHH Regulations). These are described toge¬ 
ther with the HSE guidance in Section 25.4. 

Other regulations frequently referred to in this chapter 
are the Control of Lead at Work Regulations 1980 (the 
CLAW Regulations) and the Control of Asbestos at Work 
Regulations 1987 (the CAWR). 

In addition to that specifically related to the COSHH 
Regulations 1988, HSE guidance includes EH 22 Ventilation 
of the Workplace (HSE, 1988), EH 42 Monitoring Strategies 
for Toxic Substances (HSE, 1989), HS(G) 61 Surveillance of 
People Exposed to Health Risks at Work (HSE, 1990), HS(G) 
27 Substances for Use at Work: the Provision of Information 
(HSE, 1991) and EH 40/94 Occupational Exposure Limits 
(HSE, 1994). 

Guidance by the BOHS is given in Controlling Airborne 
Contaminants in the Workplace (the BOHS Airborne Con¬ 
taminants Guide) by Piney et al. (1987 BOHS/TG7) and by 
the AIHA in Basic Industrial Hygiene: A Training Manual 
(AIHA, 1975/2), Engineering Field Reference Manual 
(AIHA, 1984/7), and A Strategy for Occupational Exposure 
Assessment (Hawkins, Norwood and Rock, 1991AIHA/24). 
A computer-based system is described in LOGAN Work¬ 
place Evaluation System (Dupont, 1990 AIHA/20). 

Guidance on occupational hygiene in the petroleum 
industry is given in Guidelines for Recording Industrial 
Hygiene Data (CONCAWE, 1983 7/83), Health Aspects of 
Worker Exposure to Oil Mists (CONCAWE, 1986 86/69), 
Review of Strategies for the Evaluation of Employee Expo¬ 
sures to Substances Hazardous to Health (CONCAWE, 1987, 
87/57) and API Exposure Classification Schemefor Collection 
of Industrial Hygiene Monitoring Data by the API (1990). 

Further guidance is given in Employment and Reproduc¬ 
tive Health by the Chemical Industries Association (CIA) 
(1984 RC13). 

Occupational, or industrial, hygiene is also treated in 
Occupational Health and Safety Concepts (Atherley, 1978), 
Occupational Health (Harrington and Gill, 1983-), Case 
Studies in Industrial Hygiene (Perkins and Rose, 1987 
ACGWI9),IndustrialHygieneManagement(Garrett,Cra\\ey 
and Cralley, 1988 ACGIH/23), Fundamentals of Industrial 
Hygiene by the NSC (1988/13), The Risk Assessment of Envi¬ 
ronmental Hazards (Paustenbach, 1989 ACGIH/37), Quan¬ 
titative Industrial Hygiene: A FormulaWorkbook (Caravanos, 
1991ACGIH/74) and Industrial Hygiene Workbook (Burton, 
1992 ACGIH/85). Engineering aspects are treated in Health 
Hazards Control in the Chemical Process Industry (Lipton 
and Lynch, 1987), Industrial Hygiene Engineering (Talty, 
1988 ACGIH/22) and In-Plant Practices forJob-related Health 
Hazards (Cralley and Cralley, 1989 ACGIH/36). 

Guidance for dusts specifically includes EH 44 Dust: Gen¬ 
eral Principles of Protection (HSE, 1991), the User Guide to 
DustandFume ControlQAxnr, 1985) (the IChemE Dust Control 
Guide) and the BOHS Airborne Contaminants Guide. 

The elements of occupational hygiene include: 


(1) identification of noxious substances or effects; 

(2) establishment of criteria; 
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(3) assessment of exposure; 

(4) prevention of exposure; 

(5) control of exposure — 

(a) enclosure, 

(b) ventilation; 

(6) provision of PPE; 

(7) monitoring of workplace atmosphere; 

(8) monitoring of personnel; 

(9) keeping of records. 

This general approach is applicable to toxic and corrosive 
chemicals, noxious dusts, and ionizing and non-ionizing 
radiations. 

In addition to vapours and dusts, it is necessary to deal 
also with skin disease and noise. Skin care is treated in 
Section 25.8 and noise is discussed in Appendix 12. 

25.3.1 Noxious substances 

Information on the health effects of industrial chemicals is 
available from a large number of sources. These include: 
Dangerous Properties of Industrial Materials (Sax, 1957—), 
Hazardous Chemicals Handbook (Carson and Mumford, 
1994) and other compendia; Chemical Safety Data Sheets 
(Walsh, 1988, vol. 1) and (A. Allen (1988, other volumes); 
the series Information Sheets on Hazardous Materials by the 
FPA and other collections of such data sheets; and the 
Environmental Hygiene (EH) series and criteria docu¬ 
ments (EH 64 and 65) by the HSE. 

Information on hazardous chemicals, including materi¬ 
als safety data sheets, is discussed in Chapters 8 and 18, 
and materials toxicity in the latter chapter. 

Some aspects of health effects in the petroleum industry 
are treated in The Health Experience of Workers in the Petro¬ 
leum Manufacturing and Distribution Industry (CONCAWE, 
1987 2/87) and Survey of Exposure to Gasoline Vapour 
(CONCAWE, 19874/87). 

25.3.2 Airborne contaminants 

A classification of airborne contaminants is given by the 
HSE (1993, HS(G) 37). The particle size ranges given are: 


Size range (pm) 

Dusts 

0.1-75 


0.001-1.0 

Smoke 

0.001-1.0 

Mist 

0.01-1.00 


These figures refer to: dust generated by natural fragmen¬ 
tation or mechanical cutting or crushing; fume formed as 
solid particles of condensed vapour, especially metals; 
smoke as aerosol formed by the incomplete combustion of 
organic matter; and mist as an aerosol of droplets formed by 
condensation from the gaseous state, or as a dispersion of 
the liquid state. For vapour, a single value of 0.005 pm is 
quoted. This refers to the gaseous state of materials which 
are liquid or solid at room temperature and pressure. 

The BOHS Airborne Contaminants Guide gives for 
contaminants of occupational importance a size range of 
0.01—150 pm for both dust and mist, and of 0.001—1.0 pm 
for fume. 

The particle size of a contaminant is determined by the 
process by which it is generated. Oil mist generated by 


metal cutting has a larger particle size than that of oil 
fumes formed by the condensation of oil vapour. 

The behaviour of an airborne particle may be character¬ 
ized in terms of the settling velocity and the stopping 
distance. The latter is the distance which a particle with a 
defined initial velocity will travel before coming to rest. 
The BOHS Guide, quoting Hinds (1982), gives the following 
values for settling velocity and stopping distance: 


Particle diameter 

Settling velocity 

Stopping distance 

(pm) 

(m/s) 

(m) 

0.01 

7.0 x 10“ 8 

6.8 x 10“ 8 

1.0 

3.5 xHT 5 

3.6 x 10“ 5 

100 

0.25 

0.127 


The particle density used is 10 kg/m 3 and the initial veloc¬ 
ity for the stopping distance is 10 m/s. 

Fine particles sediment out only very slowly and thus 
remain airborne for long periods. They move with the air. 

Where particles are emitted from a source, the larger 
particles travel some distance, but the distance travelled by 
the finer particles is very short. Even if their initial velocity 
is high, their movement follows that of the air. 

As far as the health effects caused by particles are con¬ 
cerned, there is an upper limit of size above which a particle 
tends to be deposited before it reaches the lungs. The par¬ 
ticle size range of interest for harmful effects by inhalation 
into the lungs is discussed in the BOHS Guide, which gives 
the range as being from the submicron level to about 25 pm 
in diameter. 

25.3.3 Generation of contaminants 

There is a variety of ways by which a contaminant may 
enter the workplace atmosphere. Four principal routes are 
(1) a contaminant-generating process or operation, (2) a 
leak, (3) opening up of plant and (4) handling fabrics satu¬ 
rated with the material. 

For a vapour contaminant, a principal determinant is the 
vapour pressure. If a liquid is being handled under condi¬ 
tions where there is a route to the atmosphere and it is at a 
temperature at which it exerts an appreciable vapour 
pressure, a significant amount may escape. 

In relation to industrial hygiene, a significant measure is 
the ratio of the vapour pressure to the occupational expo¬ 
sure limit. Avapour hazard index (VHI) is defined as 

VHA.^ VaP ° U, ; pTe8SUre i . - [25.3.1] 

Occupational exposure limit 

where both the vapour pressure and the occupational 
exposure limit are measured in parts per million (ppm). 

The conditions that must be met for a dust contaminant 
to enter the workplace atmosphere are that a route exists for 
it to do so and that it has imparted to it sufficient energy to 
follow that route. 

Some conditions in which a contaminant, vapour or dust, 
may enter the atmosphere include (1) passage of air through 
the material, (2) free fall of the material, (3) pouring of the 
material, (4) agitation of the material, (5) transfer of the 
material, (6) opening of bags or drums of the material, 
(7) leak of the material, (8) opening up of plant containing 
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the material and (9) handling of fabrics saturated with the 
material. 

In addition, vapour generation may occur due to (1) the 
evaporation of a liquid or (2) the heating of a liquid; and 
dust generation may occur due to (1) vibration of a powder 
or (2) a size reduction of the material. 

Typical equipment and activities where contaminants 
are generated include reactor charging, mixing operations, 
powder handling and packing processes, grinding mills, 
conveyors and elevators, storage silos, hoppers and bins, bag 
emptying operations, drum and bag filling operations, and 
plant maintenance. 

The situations in which fumes and mists are generated 
tend to be highly specific. 

25.3.4 Leaks of contaminants 

A common source of contamination is leaks from the plant. 
A gross leak may be readily identified, but this may not be 
so where the leak is small, but still large enough to cause 
significant contamination. 

With regard to leaks of gas, vapour and liquid, an 
account has been given in Chapter 15 of fugitive emissions, 
particularly of volatile organic compounds (VOCs). 
Although originally work on such emissions was driven 
largely by concern over environmental pollution, the infor¬ 
mation is generally applicable equally to emissions into the 
workplace atmosphere. 

Leaks of dust can also occur. If the dust is fine, the leak 
may not be visible. Figure 25.1 shows a leak of asbestos dust 


from a gaiter, made visible only by the use of a dust lamp, 
as described below. 

25.3.5 Air movement 

As already described, most contaminants move with the air 
in the workplace. This air movement is therefore of great 
importance in developing controls. 

There are available a number of methods for the investi¬ 
gation of air movements. One is the use of a smoke tracer. 
Smoke is introduced from a smoke generator and its move¬ 
ment is observed or filmed. 

Methods exist for the visualization of the presence and 
movement of dust particles in air. The dust lamp, or Tyndall 
lamp, technique is widely used. This makes visible the dust 
cloud in a manner similar to that which occurs when a shaft 
of sunlight falls across a room where there is dust in the 
atmosphere. This method permits observation of dust 
clouds of particles too fine to be seen otherwise. The use of a 
dust lamp is illustrated in Figure 25.1. Accounts of the dust 
lamp technique are given by the HSE (1975 TON 35) and in 
the BOHS Guide. 

There is also an infrared (IR) technique which permits 
the movement of a vapour to be followed. 

25.3.6 Monitoring variables and criteria 

There is a hierarchy of methods which may be used as the 
basis for the monitoring and control of noxious substances. 
These are the measurement and monitoring of (1) the con¬ 
centration of airborne contaminants in the workplace, 



Figure 25.1 Leakage of asbestos dust due to failure of a gaiter (HSE, 1 975 TON 35) (Courtesy of HM Stationery Office) 
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(2) their concentration in workers’ body tissues and body 
fluids and (3) their effect on workers’ health. 

There are three corresponding types of criteria used in 
monitoring for occupational hygiene. For the concentration 
of contaminants in the workplace atmosphere, the criteria 
are expressed as occupational exposure limits.This type is 
exemplified by threshold limit values (TLVs) and occupa¬ 
tional exposure standards (OESs). Occupational exposure 
limits are considered in Section 25.3.7. 

The second type of criterion relates to the concentrations 
of toxic substances found in the worker’s body tissues and 
fluids, especially fluids such as breath, urine and blood. 
These are biological limit values (BLVs). 

The third type of criterion relates to the effect of toxic 
substances on the worker’s health. 

It should be emphasized that the concentration of any 
harmful substance should be kept not only below any 
maximum exposure limit (MEL) but as close to zero as is 
reasonably practicable. 

25.3.7 Occupational exposure limits 

In the United Kingdom, occupational exposure limits were 
formerly specified in terms of TLVs. There are now two 
main types of limit which apply: OESs and MELs. The lat¬ 
ter apply to a relatively restricted group of chemicals which 
are listed in Schedule 1 of the COSHH Regulations 1988. 

The larger group are covered by an OES. The current 
OES values are given in EH 40 Occupational Exposure 
Limits 1994 (HSE, 1994). The basis of the limits is explained 
in EH 64 Occupational Exposure Limits: Criteria Document 
Summaries (HSE, 1993). 

An account of the OES system is given in Occupational 
Exposure Limits (CIA, 1985 PA23). 

Further guidance is given by the AIHA in Workplace 
Environmental Exposure Level Guides (AIHA, 1980—/4), 
Occupational Exposure Limits - Worldwide (Cook, 1987 
AIHA/12), Hygienic Guides (AIHA, 1988/14) and Odor 
Thresholds for Chemicals with Established Occupational 
Standards (AIHA, 1989/17). The American Conference of 
Government Industrial Hygienists (ACGIH) guidance 
includes Documentation of the Biological Exposure Indices 
(ACGIH/1), Documentation of Threshold Limit Values and 
Biological Exposure Indices (ACGIH/3), Guide to Occupa¬ 
tional Exposure Values - 1992 (ACGIH/78) and Threshold 
Limit Values and Biological Exposure Indices, 1992—1993 
(ACGIH 1992/80). The ILO publishes Occupational Expo¬ 
sure Limits forAirborneToxic Substances (ILO 1991/2). 

25.3.8 Non-inhalation exposure 

The account given so far has concentrated on exposure by 
inhalation. It is also necessary to consider exposure by 
ingestion and by skin absorption. The consumption of food 
and drink in contaminated conditions is one situation in 
which ingestion of a contaminant is prone to occur. Skin 
absorption is discussed in Section 25.8. 

25.3.9 Assessment of exposure 

If workers may be exposed to a noxious substance, an 
assessment needs to be made of the extent of the exposure. 
This assessment merits as much effort as is generally 
devoted to determining how noxious the substance is. 

The foregoing account has indicated some of the pro¬ 
cesses, operations and activities which may cause con¬ 
tamination of the workplace atmosphere. The other aspect 
is the extent to which workers are exposed as a 


consequence of this contamination. The frequency, dura¬ 
tion and intensity of exposure are all relevant. 

The assessment should cover all modes of exposure and 
exposure due to activities as well as leaks. It should allow 
for foreseeable human behaviour. Assessment of exposure 
is an important aspect of the COSHH Regulations and is 
described further in Section 25.4. 

25.3.10 Prevention of exposure 

The minimization of exposure of workers to contaminants 
should be approached in a systematic manner and should 
be based on a hierarchy of measures of prevention and 
control. 

In accordance with the philosophy of inherently safer 
design, the first objective should be prevention. Resort 
should be made to control only after the potential for pre¬ 
vention has been fully explored. 

The prevention stage should address the following pos¬ 
sible approaches: (1) elimination or substitution of the sub¬ 
stance, (2) modification of the process, (3) segregation of 
processes, (4) elimination of leaks, (5) modification of 
operations and (6) arrangements for dealing with con¬ 
taminated clothing. 

Measures of prevention have two main objectives. One is 
to use substances which are less harmful. The other is to 
use processes and operations which are less prone to cause 
contamination. 

In some cases it has proved possible to replace a harmful 
substance by substituting it by a less harmful one. In other 
cases, the harmful substance maybe eliminated. This may 
occur by elimination of a harmful impurity or of a process, 
or process stage, in which the harmful substance is used. 
Modification of the process by alteration or substitution is 
another approach which has been used with success. A 
third method is to segregate the processes, or process 
stages, which are ‘dirty’ in respect of contamination from 
those which are ‘clean’. Examples of these approaches are 
given in Chapter 11 and in the BOHS Guide. 

Where leaks are a cause of contamination, measures 
should be taken to eliminate them. 

Contamination of the working atmosphere may also arise 
from various activities on the plant, such as opening reac¬ 
tors, taking samples or opening up equipment for main¬ 
tenance. This aspect may need to be controlled by specific 
procedures. 

Workers may be exposed to contamination from work 
clothes or from protective clothing, and arrangements may 
need to be made to prevent this. 

25.3.11 Control of exposure 

When measures based on prevention have been exhausted, 
controls should be used to reduce exposure further. These 
controls are applied in a hierarchy which is broadly as 
follows: 

(1) total or partial enclosure; 

(2) LEV; 

(3) general ventilation; 

(4) limitation of exposure — 

(a) number exposed, 

(b) frequency and duration of exposure; 

(5) PPE. 

A further discussion of prevention and control is given in 
Section 25.4 in relation to the COSHH Regulations 1988. 



PERSONAL SAFETY 25/11 


25.3.12 Ventilation of workplace atmosphere 

It is frequently necessary to use ventilation as one of the 
control measures taken to reduce exposure. 

The siting of plant in the open air rather than in a build¬ 
ing is often the most effective means of ventilation, since 
small leaks are then dispersed by the wind. But such open 
construction is not always appropriate, for various rea¬ 
sons, some of which were considered in Chapter 10. More¬ 
over, as discussed below, it cannot be assumed that an 
outdoor location guarantees that exposure is negligible. 

In most applications, the preferred method of indoor 
ventilation is LEV. The use of general ventilation tends to be 
less effective and more expensive. Where general ventila¬ 
tion is used indoors, it may be natural ventilation or 
mechanical ventilation. 

An account of ventilation is given in Section 25.7. 

25.3.13 Monitoring of workplace atmosphere 

The monitoring of the workplace atmosphere involves 
identifying valid methods of sampling, measurement and 
evaluation, and the adoption of a suitable monitoring 
strategy. 

HSE guidance on the measurement and monitoring of 
contaminants in the workplace atmosphere is given in EH 
42 Monitoring Strategies for Toxic Substances (HSE, 1989) 
and in the series Methods for the Determination of Hazard¬ 
ous Substances (MDHS). The series includes MDHS 70 
General Methods for Sampling Airborne Gases and Vapours 
(HSE, 1990) and MDHS 71 Analytical Quality in Workplace 
Air Monitoring (HSE, 1991). 

Further guidance by the AIHA is given in Quality 
Assurance Manualfor Industrial Hygiene Chemistry (AIHA, 
1988/15), Direct-Reading Calorimetric Indicator Tubes 
Manual (Perper and Dawson, 1993 AIHA/9), The Industrial 
Hygienists’ Guide to Indoor Air Quality Investigations 
(AIHA, 1993/26), and Manual of Recommended Practice for 
Combustible Gas Indicators and Portable Direct-Reading 
Health Survey Meters (AIHA, 1993/27). ACGIH guidance 
includes Methods of Air Sampling and Analysis (Lodge, 
1988 ACGIH/24), Air Sampling Instruments (ACGIH, 1989/ 
27) and Air Monitoring for Toxic Exposures (Ness, 1991 
ACGIH/51). 

For petroleum products, the guidance available includes 
The Identification and Measurement of Refinery Odors 
(CONCAWE, 1975 8/75) and Method for Monitoring Expo¬ 
sure to Gasoline Vapour in Air (CONCAWE, 1986 8/86). 

Strategies for measuring and assessing personal expo¬ 
sure are described in Review of Strategies for the Evaluation 
of Employee Exposure to Substances Hazardous to Health 
(CONCAWE, 198787/57). 

25.3.14 Health surveillance 

It may not be sufficient to monitor the working atmosphere. It 
is often necessary also to monitor the people who work in it 
by a system of health surveillance. HSE guidance on health 
surveillance is given in HS(G) 61 Surveillance of People 
Exposed to Health Risk at Work (HSE, 1990). 

HS(G) 61 lists the sets of regulations which contain 
requirements for medical surveillance. They include the 
CLAW Regulations, the CAWR and the COSHH Regulations. 

Health surveillance may be carried out at different 
stages of an employee’s involvement with the company. 
HS(G) 61 distinguishes between the types of surveillance 
which occur during recruitment, on employment, during 
work and on detection of an adverse effect. 


HS(G) 61 gives the following purposes of health surveil¬ 
lance at work: (1) to identify adverse effects early, (2) to 
identify inadequacies in control, (3) to inform those at risk 
as soon as possible of any damage to their health and (4) to 
provide an opportunity to reinforce health education on the 
risk present. 

It also describes some of the practicalities. (1) There 
are some substances which are impractical to control to a 
level which protects all those who may be exposed, due to 
differences in the susceptibility of individuals. A person 
sensitized to a lung allergen may develop asthma at a 
concentration level three orders of magnitude lower than 
would affect a previously unexposed person. (2) Control 
may not be equally effective in protecting all groups of 
workers. Controls designed to protect plant operators 
may not cover well maintenance personnel. (3) The controls 
may not do all they were intended to do. Early controls 
on cotton dust did not prevent byssinosis because they 
did not remove fine particles. (4) The type of injury may 
not be foreseen. This was the case with lung cancers 
from asbestos up to about 1940 and with mesothelioma 
from vinyl chloride monomer (VCM) until about 1974. 

Employees should be informed of possible consequences 
of health surveillance. One potential consequence might be 
that an employee is moved to another job. 

As with monitoring of exposure to airborne con¬ 
taminants, so with monitoring of concentrations of toxic 
substances in the body, the aim should be to keep the con¬ 
centrations as low as is reasonably practicable. 

Guidance on monitoring against BLVs is given by the 
ACGIH in Biological Monitoring of Exposure to Chemicals: 
Org0mcCo»/>0w»efe(DillonandHo,1987ACGIH/8),Mettods 
/orB/o/og/ca/Mom7on«g(KnelpandCrable,1988ACGIH/25) 
and Biological Monitoring of Exposure to Chemicals: Metals 
(Dillon and Ho, 1991ACGIH/52). AIHA guidance includes 
Biohazards Reference Manual ( AIHA, 1985/10). 

25.3.15 Hot environments 

The environment may also be injurious to health because it 
is too hot. This aspect is treated in Hot Environments 
(NIOSH, 1986 Publ.86-113) and by Bedford (1974) and Gill 
(1980a). 

Depending on the situation, countermeasures for hot 
environments may include the provision of ventilation, the 
use of protective clothing and the limitation of the work¬ 
ing period. 

25.4 COSHH Regulations 1988 

A requirement for a comprehensive system for the protec¬ 
tion of workers based on industrial hygiene principles is 
given in the COSHH Regulations 1988 (the COSHH Regu¬ 
lations). The corresponding Approved Code of Practice 
(ACOP), which also deals with carcinogenic substances is 
L5 (formerly COP 29) COSHH and Control of Carcinogenic 
Substances (HSE, 1991). It is convenient to refer to these two 
parts of the ACOP as the COSHH Code and the Carcinogens 
Code, respectively. Further guidance is given in COSHH 
Assessments (HSE, 1988b), HS(G) 27 Substances for Use at 
Work: the Provision of Information (HSE, 1988), EH 42 
Monitoring Strategies for Toxic Substances (HSE, 1989) 
and HS(G) 61 Surveillance of People Exposed to Health 
Risks at Work (HSE, 1990). 

Guidance from the CIA is given in the series COSHH - 
Guidance on Assessments (Reg. 6) (CIA, 1989 RC9), COSHH 
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- Guidance on Health Surveillance (Reg. 11) (CIA, 1989 
RC11), COSHH- Guidance on Information, Instruction and 
Training (Reg. 12) (CIA, 1990 RC 12), COSHH- Guidance 
on Setting In-house Exposure Limits (Reg. 7) (CIA, 1990 
RC10), COSHH - Guidance on Collection and Evaluation or 
Hazardlnformation (Reg. 2) (CIA, 1991RC39) and COSHH- 
Guidance on Recordkeeping (CIA, 1991 RC 38). 

Further treatments are given in The COSHH Regulations: 
A Practical Guide (Simpson and Simpson, 1991) and by 
R Lewis (1980), Blain (1987),Waterman (1987) and Boniface 
(1990b). The principal contents of the COSHH Regulations 
are given in Table 25.4. 

Regulation 2 defines a ‘substance hazardous to health’ 
(SHH) as covering the following: (1) a substance which is 
listed in Part 1A of the Classification, Packaging and 
Labelling of Dangerous Substances Regulations 1984 and 
for which the general indication of nature of risk is speci¬ 
fied as very toxic, toxic, harmful, corrosive or irritant; (2) a 
substance for which the MEL is specified in Schedule 1 
of the regulations or for which the HSC has approved an 
OES; (3) a micro-organism which creates a hazard to health; 
(4) dust of any kind, when present at a substantial con¬ 
centration in air and (5) any other substance which creates a 
comparable hazard to health. 

The regulations cover substances which have chronic or 
delayed effects such as substances which are carcinogenic, 
mutagenic or teratogenic. 

Under Regulation 3, an employer has towards an em¬ 
ployee the duties of: (1) assessment; (2) prevention or control 
of exposure; (3) use of control measures and their main¬ 
tenance, examination and test; (4) provision of information 
and training; and, where appropriate; (5) monitoring of 

Table 25.4 Principal contents of the Control of 
Substances Hazardous to Health Regulations 1988 and 
the associated Guidance 


Regulation 2 
Regulation 3 
Regulation 4 

Regulation 6 

Regulation 7 

Regulation 8 
Regulation 9 

Regulation 10 
Regulation 11 
Regulation 12 


Schedule 1 
Schedule 2 
Schedule 3 

Schedule 4 

Schedule 5 
Appendix 


Interpretation 

Duties under these Regulations 
Prohibitions relating to certain 
substances 

Assessment of health risk created by work 
involving substances hazardous to health 
Prevention or control of exposure to 
substances hazardous to health 
Use of control measures, etc. 
Maintenance, examination and test of 
control measures 

Monitoring exposure at the workplace 
Health surveillance 

Information, instruction and training for 
persons who may be exposed to 
substances hazardous to health 
List of substances assigned maximum 
exposure limits 

Prohibition of substances hazardous to 
health for certain purposes 
Frequency of thorough examination and 
test of local exhaust ventilation plant 
used for certain processes 
Specific substances and processes for 
which monitoring is required 
Medical surveillance 
Health records 


workplace exposure and (6) health surveillance. So far as is 
reasonably practicable, the employer should regard himself 
as having similar duties towards other persons at the pre¬ 
mises, except that there is no duty of health surveillance, 
and as having the first three duties listed towards others 
likely to be affected by the work. These duties are not 
confined to the occupier but apply also to contractors. 
Thus, the duties of an employer are owed by a contractor to 
his employees. 

Regulation 4 places prohibitions on certain substances 
listed in Schedule 2 to the extent specified in that schedule. 
This includes a prohibition on: the manufacture and 
use of 2-naphthylamine, benzidine, 4-aminodiphenyl and 
4-nitrodiphenyl; the use of benzene for any purpose other 
than in an industrial process; and on the use of sand for 
sandblasting. 

Regulation 6 requires that the employer make ‘a suitable 
and sufficient assessment’ of the risks created by the work 
and of the steps which need to be taken to ensure com¬ 
pliance. The assessment should be reviewed if there is rea¬ 
son to suspect that it is no longer valid or if there has been a 
significant change in the work. 

Regulation 7 requires that exposure to substances 
hazardous to health should be prevented or, where this is 
not reasonably practicable, adequately controlled. Further, 
it requires that so far as is reasonably practicable, this be 
done without recourse to personnel protective equipment, 
but, that, where necessary, such equipment should be pro- 
vided.Where a substance has a MEL specified in Schedule 1, 
the exposure should not exceed this limit and should be 
reduced below it to the extent which is reasonably practic¬ 
able. Where a substance has an OES, the exposure should 
not exceed this standard, but if it does, the employer should 
identify the reason and take action to remedy the situation 
as soon as is reasonably practicable. The exposure referred 
to may be any route, including inhalation, ingestion, 
absorption through the skin or contact with it. 

Regulation 8 requires that an employer providing any 
control measure, PPE or other item, should take all rea¬ 
sonable steps to see that these are properly applied and that 
an employee should apply them and report any defects. 

Regulation 9 requires adequate maintenance, examina¬ 
tion and test of control measures. It refers specifically to 
LEV and to RPE. For the former it lays down a maximum 
interval for examination and test of 14 months or, for plant 
specified in Schedule 3, the interval given in that schedule. 
It requires that a record be kept of the examination and test, 
and of any repairs effected. 

Regulation 10 requires that, where necessary to ensure 
control of exposure or prevent harm, monitoring of the 
workplace should be carried out using a suitable procedure. 
For certain substances given in Schedule 4, monitoring is 
required at the minimum frequency specified in the sched¬ 
ule. The regulation requires that records, or suitable sum¬ 
maries, be made and that where they are representative of 
the personal exposure of identifiable employees, they 
should be kept for 30 years. 

Regulation 11 requires that, where it is appropriate for 
the protection of the health of employees who are liable to be 
exposed to a SHH, the employer should set up a system of 
health surveillance. The regulation is a long one, with some 
12 sections. Regulation 11(2) states that health surveillance 
is appropriate where the employee is exposed to one of the 
substances and is engaged in one of the processes listed in 
Schedule 5, unless the exposure is insignificant, or where 
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he is exposed to a substance so that an identifiable disease 
or adverse health effect may he related to the exposure, 
there is a reasonable likelihood that the disease or effect 
may occur given the conditions of his work, and there is 
a valid technique for detecting indications of the disease 
or effect. 

Regulation 12 requires the employer to provide to an 
employee who does work which may expose him to a SHH 
such information, instruction and training as is suitable 
and sufficient for him to know the risks to health and the 
precautions to be taken.The information should include the 
results of any monitoring carried out in compliance with 
Regulation 10. If, in the case of a substance listed in Sched¬ 
ule 1, the MEL is exceeded, the employee should be 
informed immediately. The information should also include 
the collective results of any health surveillance carried out 
in compliance with Regulation 11, presented in a form 
where the data cannot be related to a particular individual. 

Regulation 12(3) requires that any person, whether or not 
an employee, who carries out work in connection with the 
employer’s duties under the COSHH should have the 
necessary information, instruction and training. 

Regulation 6 requires that the person making the 
assessment be competent and refers to Regulation 12(3). 

25.4.1 Substances hazardous to health 

There are a number of factors mentioned in the ACOP 
which need to be borne in mind when considering whether 
a substance is hazardous to health. The same substance 
may be hazardous in one form but not in another. Thus, a 
substance in dust form may be hazardous but be safe in 
solid form. The fibrous form may also be hazardous. A 
substance may contain an impurity which is more hazard¬ 
ous than the substance which it contaminates. A substance 
may have been found by experience to be hazardous, even if 
the causative agent has not been identified. Some combi¬ 
nations of substances may have harmful additive, or 
synergistic, effects. 

25.4.2 Suitable and sufficient assessment 

The ACOP states that the purpose of the assessment is to 
obtain the information necessary to select suitable control 
measures. It also provides a demonstration that the rel¬ 
evant factors have been taken into account and the nec¬ 
essary measures taken. 

A suitable and sufficient assessment should include an 
assessment of the risks to health, a determination of the 
measures which need to be taken to achieve control under 
Regulation 7, and an identification of any other action 
necessary to comply with Regulations 8-12. 

The assessment of risks should identify the substances 
to which personnel are liable to be exposed, the effects of 
the substances on the body, the places where and the forms 
in which these substances are likely to be present, and the 
ways in which and the extent to which personnel could be 
exposed, allowing for foreseeable deterioration, or failure, 
of a control measure. It should include an estimate of the 
exposure given the engineering measures and systems of 
work adopted. This estimate should be compared with any 
available standards for adequate control. 

If comparison indicates that control is likely to be inade¬ 
quate, the assessment should go on to determine the mea¬ 
sures which need to be taken to achieve adequate control. A 
record should be kept of the assessment, except in very 


simple and obvious cases which could be readily repeated 
and explained at any time. 

The assessment should be reviewed if it is shown to be 
no longer valid by some new information, which may 
include: results from the periodic examination and test of 
the engineering controls; results from the monitoring of 
workplace exposure; results of health surveillance, or a 
confirmed case of occupationally induced disease; or new 
information on health risks. A review is also called for if 
there is a significant change in the work, including any 
change in the substances used, the process, the through¬ 
put, the work practices or the engineering controls. 

Further guidance on the assessment is given in COSHH 
Assessment. The stages of the assessment are the gathering 
of information, the evaluation of the risks, the specification 
of the measures and precautions required and the record¬ 
ing of the assessment. Information needs to be gathered on 
the substances and their hazards and on the work and the 
working practices. 

Evaluation of the risks from a substance involves asses¬ 
sing, on the one hand, the potential for harm from exposure 
to it and, on the other, the nature of any exposure. For the 
latter, it is necessary to determine the situations in which 
exposure may occur, the persons liable to be exposed, and 
the frequency and duration of exposures. 

Where there is uncertainty about the magnitude or sig¬ 
nificance of the exposure in relation to the requirement for 
prevention or adequate control, exposure should be mea¬ 
sured, provided there is a suitable method of measurement. 

COSHH Assessment identifies five possible outcomes of 
the assessment, which may be summarized as: 

(1) risks are insignificant now and for the foreseeable 
future; 

(2) risks are high now, and not adequately controlled; 

(3) risks are controlled now, but foreseeably could become 

(4) risks are uncertain - uncertainty concerns extent and 
degree of exposure; 

(5) risks are uncertain — uncertainty due to lack of 
information. 

Guidance is given on the action to be taken for each of these 
outcomes. 

25.4.3 Competent person 

COSHH Assessment also gives guidance on the competence 
required of the person who is to undertake the assessment. 
The guide distinguishes between basic skills and addi¬ 
tional skills. The basic skills are an understanding of the 
regulations and the abilities to make a systematic assess¬ 
ment of the risks and the exposures, to specify the mea¬ 
sures which need to be taken in light of the assessment, and 
to communicate the findings in a report. 

The additional skills are qualifications, experience and 
training. The guide emphasizes particularly practical 
experience and an understanding of the behaviour of peo- 

25.4.4 Occupational exposure limits 

As already stated, the two types of occupational exposure 
limit mentioned in the regulations are the MEL and the 
OES. The MELs are listed in Schedule 1 and the OESs are 
contained in the List of Approved OESs. This is given in 
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EH 40 Occupational Exposure Limits, which is up-dated 
annually. 

The status of these two exposure limits is described in 
the ACOP. A MEL is the maximum concentration to which 
an employee may be exposed by inhalation under any 
circumstances. The concentration is averaged over a refer¬ 
ence period which is specified in Schedule 1. Further 
details of the application of MELs are given in the ACOP. 

Where an OES is assigned, exposure should be reduced 
to that standard. However, if exposure by inhalation 
exceeds the OES, the control may still be deemed adequate 
provided the reason for the excursion has been identified 
and appropriate steps are being taken to comply with the 
OES as soon as is reasonably practicable. 

Where a substance is not assigned an MEL or OES, the 
ACOP states that the concentration should be controlled to 
a level to which nearly all the population could be exposed, 
day after day, without adverse effects on health. 

25.4.5 Measurement and monitoring 

The ACOP states that compliance with an OES may be 
demonstrated by measuring and recording the exposure of 
employees in accordance with EH 42 Monitoring Strategies 
forToxic Substances (HSE, 1989). 

Guidance is given in the ACOP on those situations where 
monitoring is required. Paragraph 68 states that it is 
always required for substances in Schedule 4 and, in addi¬ 
tion, unless it is immediately obvious that control is ade¬ 
quate or suitable procedures for monitoring do not exist 
and cannot be devised, the requirement exists (1) where 
failure or deterioration of the control measures could result 
in a serious health effect, either because of the toxicity of 
the substance or the extent of the potential exposure, or 
both, (2) where measurement is necessary to ensure that an 
MEL or OES or any self-imposed working standard is not 
exceeded or (3) an additional check is required on the 
effectiveness of any control measure required under Regu¬ 
lation 7. 

EH 42 gives detailed advice on such monitoring, includ¬ 
ing sampling strategies and interpretation of results. 

25.4.6 Prevention and control 

The ACOP states that adequate control is achieved if certain 
standards set out in paragraphs 27-30 of the code are met. 
Paragraph 27 deals with substances assigned an MEL, 
paragraph 28 with substances assigned an OES, para¬ 
graph 29 with other inhaled substances and paragraph 30 
with exposure by routes other than inhalation. Compliance 
with an OES may be demonstrated by monitoring, as just 
described. 

As far as is reasonably practicable, prevention or ade¬ 
quate control of exposure should be achieved by means 
other than PPE. Circumstances in which it may be nec¬ 
essary to resort to the latter include those: (1) where it is not 
technically feasible to achieve adequate control by process, 
operational and engineering measures alone; (2) where a 
new or revised assessment necessitates the temporary use 
of personal protection until adequate control is achieved by 
other means; (3) where urgent action is required, such as 
that following a plant failure and (4) where routine main¬ 
tenance operations have to be done. In deciding whether to 
use PPE, due allowance should be made for its limitations 
and the practicalities of its use. 

TheACOPenumeratesthemeasureswhichmaybeusedfor 
the prevention or control of exposure to a SHH. Prevention 


may be effected by elimination of the substance or by 
substitution of a less hazardous substance. Twelve mea¬ 
sures are listed for control: (1) a totally enclosed process and 
handling system; (2) a plant, process or system of work 
which minimizes the generation of, or suppresses or con¬ 
tains, fumes, dusts, etc.; (3) a partially enclosed system, 
with LEV; (4) LEV; (5) sufficient general ventilation; (6) a 
reduction of the number of workers exposed and a restric¬ 
tion of access; (7) a reduction in the period of exposure; 
(8) regular cleaning of surfaces and walls; (9) the provision 
of a means of the safe storage and disposal of the sub¬ 
stance; (10) suitable PPE; (11) prohibition of eating, drinking 
and smoking in contaminated areas and (12) provision of 
adequate facilities of washing, changing and storage 
of clothing, including laundry arrangements for con¬ 
taminated clothing. 

25.4.7 Personal protective equipment 

PPE includes respiratory equipment, protective clothing, 
footwear and eye protection. The selection of such equip¬ 
ment for protection against a substance should take into 
account the ability of the material to resist penetration by 
the substance, the adequacy of the design of the clothing 
and its suitability for the intended use, the environment in 
which it is to be worn, and, in the case of dust, the dust 
release characteristics of the material. 


25.4.8 Health surveillance 

Guidance on health surveillance is given in the ACOP and 
also in HS(G) 61 Surveillance of People Exposed to Health 
Risks at Work (HSE, 1990). The ACOP describes the pur¬ 
poses of health surveillance, the type of surveillance suit¬ 
able and the situations in which it should be undertaken. 

The purposes of health surveillance are essentially the 
protection of the health of employees and the evaluation of 
health hazards and control measures. The surveillance 
should lead to action and, before it is undertaken, the 
options and criteria should be established. 

The health surveillance procedures enumerated in the 
ACOP are: (1) biological monitoring; (2) biological effect 
monitoring; (3) medical surveillance; (4) enquiries about 
symptoms, inspection or examination by a suitably quali¬ 
fied person; (5) inspection by a responsible person and 
(6) a review of the records and occupational history during 
and after exposure. Biological monitoring is based on the 
measurement of agents or their metabolites in body tissues 
or fluids, whilst biological effect monitoring is based on 
the biological effects on the worker. In this context, a 
suitably qualified person is instanced as an occupational 
health nurse and a responsible person as a manager or 
supervisor. The latter might check, for example, for chrome 
ulceration. 

Health surveillance is appropriate for any exposure 
which fulfils the criteria of Regulation 11(2). The judge¬ 
ment on the likelihood of disease or adverse effects should 
be related to the nature and degree of exposure and should 
take into account information on epidemiology, human 
exposure, human and animal toxicological data, as well as 
extrapolation from information about analogous sub¬ 
stances or situations. 

25.4.9 Schedule 5 

Frequent reference has been made in the foregoing to 
Schedule 5. This contains in Column 1 the names of various 
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substances and in Column 2 processes in which they are 
involved. 

One substance listed in this schedule is VCM. The pro¬ 
cesses given in column 2 opposite this substance are 
manufacture, production, reclamation, storage, discharge, 
transport, use or polymerization. 

25.4.10 Carcinogenic substances 

The ACOP contains a second, separate section, or code, 
covering the control of carcinogenic substances (the Carci¬ 
nogens Code). The Carcinogens Code covers scope, prohibi¬ 
tions, assessment, prevention and control, monitoring, 
health surveillance and information, instruction and 
training. Its structure thus reflects that of the COSHH 
Regulations and code. It is an amplification of the COSHH 
Code and not a replacement for it. 

With regard to scope, the code applies to substances 
assigned the ‘risk phrase’ ‘R45: May cause cancer’ of the 
Classification, Labelling and Packaging Regulations 1984 
and listed in Part IA1 of the approved list and to substances 
listed in Appendix 1 and substances arising from processes 
listed in that appendix. Certain substances are prohibited 
and these are listed in Schedule 2. 

The guidance on assessment and on prevention and 
control largely follows that of the COSHH Code, but there 
are particular emphases and specific measures. 

Exposure to a carcinogen involves risk of cancer. The risk 
increases with the exposure but there may be no short-term 
manifestation of adverse effects. The dose—response rela¬ 
tion is quantal rather than graded. 

In the case of carcinogens, particular importance is 
attached to prevention. The use of carcinogenic substances 
should be kept to a minimum, these should be clearly 
labelled, and the areas where they are used should be delin¬ 
eated and non-essential personnel excluded. 

The first choice for control should be a totally enclosed 
system. Where this is not practical, alternative effective 
engineering measures should be taken including, where 
appropriate, the use of LEV Care needs to be taken, how¬ 
ever, that control measures do not aggravate the risk in the 
workplace or the outside environment. 

Since exposure to carcinogens can result in a serious 
health effect, monitoring is normally required under para¬ 
graph 68 of the COSHH Code. 

The Carcinogens Code states that, unless exposure is 
insignificant, health surveillance is appropriate for all 
carcinogenic substances. For substances in Schedule 5 of 
the regulations, medical surveillance is required. The code 
explains the objectives and limitations of surveillance. 
Surveillance has limitations in the identification of suscep¬ 
tible persons and in early recognition of cancer. It is largely 
restricted to the keeping of records to protect workers 
through the detection and evaluation of health risks. 

In view of the nature of the risk, workers who may be 
exposed should be given full information about it and on 
the importance of prevention, control and hygiene mea¬ 
sures. This should include information on the long-term 
risk and on the need for continued surveillance. 

25.5 Dust Hazards 

In general industry, dust is one of the most serious hazards 
to health. Even in the chemical industry, where there are 
many toxic vapours, dust remains a relatively important 
airborne contaminant. 


The HSE guidance on dust hazards and their control is 
given in Principles of Local Exhaust Ventilation (HSE. 
1975a), MS 4 Organic Dust Surveys (HSE, 1977), EH 44 
Dust: General Principles of Protection (HSE, 1991) and EH 
40/94 Occupational Exposure Limits 1994 (HSE, 1994). Fur¬ 
ther guidance is given in User Guide to Dust and Fume 
Control (Muir, 1985) (the IChern Dust Control Guide), the 
BOHS Airborne Contaminants Guide and Dust Control 
Handbook (Mody and Jakhete, 1988 ACGIH/18) and by 
Bridgwater (1983). 

25.5.1 Health effects of dusts 

Some dusts have harmful effects, and some of the most 
harmful airborne contaminants are dusts. There are many 
dusts, however, which are inert, although they are unpleas¬ 
ant to breathe. Some account of the effects of dust on health 
and of exposure limits is given in Chapter 18. 

EH 40 requires that, in the absence of a specific exposure 
limit for a particular dust, exposure should be kept below 
both 10 mg/m 3 8-h time-weighted average (TWA) total 
inhalable dust and 5 mg/m 3 8-h TWA total respirable dust. 
Respirable dust is the fraction of inhalable dust which 
penetrates the lung. 

Much of the most important harmful effect from dusts is 
the various forms of fibrosis such as silicosis from silica or 
asbestosis from asbestos dust. Metals which are essentially 
harmless in bulk form may have dusts which are to some 
degree toxic and cause severe lung inflammation. Some 
dusts are associated with lung cancer. 

25.5.2 Measurement of dusts 

As described earlier, techniques exist for the visualization 
of dust clouds so that the presence and movement of dust in 
the workplace atmosphere may be followed. Such visuali¬ 
zation is often sufficient to check the general state of the 
atmosphere, to detect leaks and to investigate the effec¬ 
tiveness of measures for dust suppression. 

However, if the concentration of the dust is to be con¬ 
trolled in accordance with exposure limits, then a quanti¬ 
tative measurement of the total particle concentration is 
needed. It may also be necessary to measure the particle 
size distribution. The measurement of particle concentra¬ 
tion and size distribution is a specialist matter. 

Methods for the sampling and measurement of dust in air 
are described in the IChemEDust Control Guide, the BOHS 
Airborne Contaminants Guide, Particle Size Analysis (Lloyd, 
1987) and Particle Size Analysis (Stanley-Wood and Lines, 
1992), and by Stairmand (1951), T. Allen (1975), Munns 
(1977), Kaye (1981), Vincent and Mark (1981) and Rood 
(1992a,b). 

25.5.3 Minimization of exposure to dusts 

The general approach to the minimization of exposure is 
similar to that taken for airborne contaminants generally 
and is described in Section 25.3, which makes frequent 
reference to dusts. 

Section 25.3 describes the generation of dusts and 
methods for the prevention and control of exposure. 
Amplifying these as regards prevention, there are a num¬ 
ber of industrial examples of the elimination of dust by 
such means as the substitution of different materials or a 
change of process. The substitution of metal shot for silica 
sand in shot blasting eliminates silica dust. The change 
from dry to wet processes for asbestos products largely 
eliminates asbestos dust. 
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Another important aspect of prevention is the suppres¬ 
sion of dust fines. Here one approach is to prevent the gen¬ 
eration of fines by a modification of material or process. 
This is exemplified by the use of spray drying or fluidized 
bed processes to produce granular products. Another 
approach is the use of a de-dusting agent. This finds appli¬ 
cation in the treatment of many pigments with very small 
amounts of liquid de-dusting agent. 

Where exposure cannot he reduced sufficiently by pre¬ 
vention, it is necessary to resort to control. The methods of 
control available are described in Section 25.3. These 
include in particular enclosure and LEV. Indeed, accounts 
of LEV are couched mainly in terms of the control of dusts. 

Good housekeeping and hygiene measures assume par¬ 
ticular importance for dusts, especially highly toxic dusts. 
The objective of good housekeeping is to prevent dust from 
being carried back into the atmosphere. It includes the 
construction of buildings to eliminate dust-collecting sur¬ 
faces and permit easy cleaning, the avoidance of dust spill¬ 
ages, the removal of dust piles and of pastes which form 
dust when dried, and the cleaning of dust-collecting sur¬ 
faces. Arrangements to prevent contamination by dusty 
clothing may also be necessary. 


25.6 Asbestos Dust 

Asbestos dust is a particularly important hazard and 
occurs in the process industries. It is appropriate, there¬ 
fore, to give it separate consideration. The effect of asbestos 
dust on health was described in Chapter 18 and it is prin¬ 
cipally the control of the dust which is considered here. 

The relevant regulations are the CAWR 1987. There are 
two ACOPs, L27 (formerly COP 21) Control of Asbestos at 
Work (HSE, 1993) and COP 3 Work with Asbestos Insulation, 
Asbestos Coating and Asbestos Insulation Board (HSE, 1988). 

Further guidance on asbestos dust is given in EH 10 
Asbestos: Exposure Limits and Measurement of Airborne 
Dust Concentrations (HSE, 1990). There are a number of 
other guidance documents from the HSE, including MS 13 
Asbestos (HSE, 1988), EH 41 Respiratory Equipment for Use 
Against Asbestos (HSE, 1985), EH 50 Training Operatives 
and Supervisors for Work with Asbestos Insulation and 
Coatings (HSE, 1988), EH 51 Enclosures Provided for Work 
with Asbestos Insulation, Coatings and Insulating Boards 
(HSE, 1989), EH 35 Probable Asbestos Dust Concentrations at 
Construction Processes (HSE, 1989), EH 52 Removal Tech¬ 
niques and Associated Waste Handling for Asbestos Insula¬ 
tion, Coatings and Insulation Boards (HSE 1989), EH 37 
Work with Asbestos Insulating Board (HSE, 1989), EH 47 
Provision, Use and Maintenance of Hygiene Facilities for 
Work with Asbestos Insulation and Coatings (HSE, 1990) and 
EH 36 Work with Asbestos Cement (HSE 1990). 

A US viewpoint is given in Asbestos: Medical and Legal 
Aspects (Castleman, ACGIH1990/39). 

The principal contents of the CAWR are given in 
Table 25.5. It can be seen from this table that the general 
structure of the CAWR mirrors that of the COSHH 
Regulations, with requirements for the assessment, 
prevention or reduction of exposure, control measures, 
maintenance of control measures, air monitoring, health 
records and medical surveillance, and information, 
instruction and training. The CAWR also contains, how¬ 
ever, a number of other provisions which are described 
below and which serve as an additional model for expo¬ 
sures of this general type. 


Table 25.5 Principal contents of the Control of Asbestos 
at Work Regulations 1987 and the associated Guidance 


Regulation 2 
Regulation 3 
Regulation 4 
Regulation 5 
and5A 
Regulation 6 
Regulation 7 
Regulation 8 


Interpretation 

Duties under these Regulations 
Identification of the type of asbestos 
Assessment of work which exposes 
employees to asbestos 
Notification of work with asbestos 
Information, instruction and training 
Prevention or reduction of exposure to 


Regulation 9 
Regulation 10 
Regulation 11 

Regulation 12 

Regulation 13 
Regulation 14 
Regulation 15 
Regulation 16 
Regulation 17 
Regulation 18 

Regulation 19 


Use of control measures, etc. 

Maintenance of control measures, etc. 
Provision and cleaning of protective 
clothing 

Duty to prevent or reduce spread of 
asbestos 

Cleanliness of premises and plant 
Designated areas 
Air monitoring 

Health records and medical surveillance 
Washing and changing facilities 
Storage, distribution and labelling of raw 
asbestos and asbestos waste 
Supply of products containing asbestos 
for use at work 


Schedule 1 Particulars to be included in a notification 


Regulation 4 requires that the type of asbestos to which 
exposure may occur be identified. 

Regulation 2 defines action levels and control limits. The 
action levels are 96 fibre-hours/ml of air where exposure is 
solely to chrysotile, and 48 fibre-hours/ml of air where 
exposure is to any other form of asbestos alone or in mix¬ 
tures including mixtures of chrysotile with any other forms 
of asbestos. Where both types of exposure occur separately 
over a 12-week period, a proportionate number of fibre- 
hours per ml of air applies. 

The control limits given in this regulation are for chryso¬ 
tile (1) 0.5 fibres/ml of air averaged over any continuous 
period of 4 h and (2) 1.5 fibres/ml of air averaged over any 
continuous period of 10 min. For any other form of asbestos, 
either alone or in mixtures, including mixtures of chryso¬ 
tile with any other forms of asbestos, the control limits are 

(1) 0.2 fibres/ml of air averaged over any continuous period 
4 h and (2) 0.6 fibres/ml of air averaged over any continuous 
period of 10 min. 

In general, the regulations apply to any exposure to 
asbestos at work, but some particular regulations are trig¬ 
gered only if exposure is liable to exceed the action level. 
These are Regulations 6,14 and 16, relating, respectively, to 
notification, designated areas and medical surveillance. 

Regulation 6 requires notification of work with asbestos 
unless the exposure is not liable to exceed the action level or 
the employer is licensed under the Asbestos (Licensing) 
Regulations 1983. 

Regulation 14 requires that any area in which work on 
asbestos is carried out be designated as: (1) an asbestos 
area, where the exposure of a person working for the whole 
of his working time is liable to exceed the action level; or 

(2) a respirator area, where the concentration of asbestos 
is liable to exceed any control limit. 
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General guidance on air monitoring is given in EH 42 
Monitoring Strategies for Toxic Substances (HSE, 1989) and 
guidance for asbestos specifically is given in EH 10 Asbes¬ 
tos: Exposure Limits and Measurement of Airborne Dust 
Concentrations (HSE, 1990). EH 10 gives detailed informa¬ 
tion on the determination of action and control levels and on 
the monitoring and measurement of airborne asbestos, 
including accredited quality control laboratories, mea¬ 
surement methods, sampling and interpretation. It also 
contains a schedule dealing with sampling methods. Also 
relevant is A Guide to Monitoring Airborne Asbestos in 
Buildings (Keyes and Chesson, ACGIH1989/33). 

Further guidance on measurement is given in MDHS 39/3 
Asbestos Fibres in Air ( HSE, 1990). 

Quality control laboratories are accredited for airborne 
asbestos measurement under the National Measurement 
Accreditation Scheme (NAMAS). This supersedes the 
earlier NATLAS scheme. 

Where a process has the potential to generate asbestos 
dust, the methods of eliminating or reducing the generation 
of dust described in Section 25.5 should be exploited as far 
as is reasonably practicable. 

Leaks from plant handling asbestos dust can cause ser¬ 
ious contamination of the workplace atmosphere but are 
often invisible. They may be detected, however, using a 
dust lamp. This is illustrated in Figure 25.1 above, which 
shows the visualization of asbestos dust using a dust lamp. 

An important part of the asbestos dust problem in the 
process industries relates to lagging. In many applications, 
there are satisfactory substitutes and the industry has 
moved towards the use of these. Any use of asbestos should 
be confined to white asbestos. In practice, the use of 
asbestos is limited and it may not be easy to obtain. 

Dust is particularly likely to be raised in removing lag¬ 
ging. The work should be segregated and workers should 
wear protective clothing and RPE. The area should be 
thoroughly cleaned after the work is complete. 

Maintenance is particularly important in plant where 
asbestos dust may arise or in plant with asbestos lagging. 

Where asbestos dust may be present, housekeeping 
measures assume particular importance. A high standard 
of cleanliness is necessary in the workplace. There need to 
be good facilities for washing and changing, and for 
cleaning protective clothing. 

25.7 Ventilation 

If an assessment of the air quality in the workplace shows it 
to be necessary, ventilation should be provided. Accounts 
of ventilation are given in Exhaust Hoods (Dallavalle, 1952), 
Plant and ProcessVentilation (Hemeon, 1963), Fundamentals 
of Industrial Ventilation (Baturin, 1972), Basic Principles of 
Heating and Ventilation (Bedford, 1974), Air Conditioning 
and Ventilation of Buildings (Croome-Gale and Roberts, 
1975), Handbook of Ventilation for Contaminant Control 
(McDermott, 1976), Advanced Design of Industrial Ventila¬ 
tion Systems for Contaminant Control (Goodfellow, 1985) 
and by Grandidge (1969, 1977), Gill (1980b), Goldfield 
(1980), Caplan (1982), Cassells (1986-) and Fanger and 
Christensen (1986).The HSE guidance is given in Principles 
of Local Exhaust Ventilation (HSE, 1975a), HS (G) 37 An 
Introduction to Local Exhaust Ventilation (HSE, 1987), EH 22 
Ventilation of the Workplace (HSE, 1988) and HS (G) 54 
The Maintenance, Examination and Test of Local Exhaust 
Ventilation (HSE, 1990). Further guidance is given in 


the BOHS Air Contaminants Guide, the CIBSE Guide by the 
CIBSE* (1977), Ventilation Requirements by the Building 
Research Establishment (BRE, 1981 Dig. 208), Design of 
Industrial Ventilation Systems (Alden and Kane, ACGIH 
1982/6), Heating, Ventilation and Air-Conditioning Analysis 
and Design (McQuiston and Parker, ACGIH 1988/21), 
Ventilation for Control of the Work Environment (Burgess, 
Ellenbecker and Treitman, 1989 ACGIH/38), Guide for 
Testing Ventilation Systems (ACGIH 1991/58), Industrial 
Ventilation: A Manual of Recommended Practice (ACGIH 
1991/67), Industrial Ventilation Workbook (Burton, 1991 
AIHA/21), Laboratory Ventilation Workbook (Burton, 1991 
AIHA/22), Industrial Ventilation: Engineering Principles 
(Heinsohn, 1991ACGIH/66) and IAQ andHVAC Workbook 
(Burton, 1993 AIHA/25) and in the handbooks of the 
ASHRAE (1990/4,1991/5,1992/6,1993/7). 

A relevant code of practice is BS 5925, which is particu¬ 
larly relevant to natural ventilation. The 1980 version was 
BS 5925: 1980 Design of Buildings: Ventilation Principles 
and Designing for Natural Ventilation which is the current 
one for much of the ventilation literature quoted here. The 
current version is BS 5925:1991 Code of Practice: Ventilation 
Principles and Designing for Natural Ventilation. The code 
for mechanical ventilation is BS 5720:1979 Code of Practice 
for MechanicalVentilation and Air Conditioning in Buildings. 

The reasons for ventilation and ventilation rates for 
normal purposes are discussed in Chapter 10. Briefly, a 
degree of ventilation which maintains a suitable thermal 
environment commonly suffices for the other requirements 
also. BS 5925: 1980 recommends for factories a rate of 
0.81/s per m 2 of floor area. 

If there is airborne contamination, however, the situation 
is different. In this case, the air requirement may depend 
primarily on the reduction of the contaminant concentra¬ 
tion below the control limit. 

As described in Section 25.3, the design should exploit, 
to the extent practical, methods of keeping the workplace 
atmosphere free of contamination which do not rely on 
ventilation. 

If ventilation has to be used, there are two main methods 
available. These are general ventilation, which relies on 
dilution, and sometimes also on displacement, and LEV, in 
which contamination is removed close to its source so that 
the main workspace is not affected. 

25.7.1 Local exhaust ventilation 

HSE guidance on LEV is given in Principles of Local 
Exhaust Ventilation (HSE, 1975a), HS (G) 37 An Introduction 
to Local Exhaust Ventilation (HSE, 1987) and EH 22 Ventila¬ 
tion of the Workplace (HSE 1988). Further guidance is given 
in the BOHS An Contaminants Guide. 

LEV removes contaminants from the source directly into 
a ventilation system. It does not rely on the dilution or dis¬ 
placement effects of general ventilation. It should be 
designed to remove the contaminant from around the 
source rather than from around the operator. 

An LEV system may be considered in terms of the 
following elements: (1) contaminant source, (2) hood, 
(3) ducting, (4) air filtration plant and (5) fan. 


The Chartered Institute of Building Services Engineers has 
twice changed its name in recent years, the previous acronyms 
being Institution of Heating and Ventilation Engineers (IHVE) 
and Chartered Institute of Building Services (CIBS). The guide 
referred to is also known as the IHVE Guide and the CIBS Guide. 





25/18 PERSONAL SAFETY 


25.7.2 Contaminant source 

The main problem in effecting LEV is the dispersion of the 
contaminant from the source. Once it has escaped from the 
immediate area of the source, it is very difficult to bring it 
under control. It is necessary, therefore, to obtain informa¬ 
tion on the behaviour of the contaminant leaving the 
source, such as its direction and velocity. 

The air currents which influence the behaviour of the 
contaminant should also be studied. Air currents which are 
not essential to the process but are incidental or uncon¬ 
nected should be eliminated. 


25.7.3 Enclosure and receptor hoods 

It is usual to distinguish between two basic types of enclo¬ 
sure or hood systems used in LEV: (1) enclosures and 
receptor hoods and (2) captor hoods. Enclosures may be 
(1) total enclosures or (2) partial enclosures. 

With a receptor hood, the emission source is either inside 
or at the mouth of the hood. The hood receives con¬ 
taminated air brought into it by air currents. These are 
either hot air currents rising from the process or cold air 
currents induced by the process. The air currents from a 
furnace and from a grinding wheel illustrate the two pro¬ 
cesses, respectively. The function of the fan in this type of 
system is simply to suck away the air entering the hood. 

Total enclosure is the most effective arrangement, but it 
is not always practical. It is used in the chemical industry 
and for the handling of radioactive materials. It may 
involve remote operation using manipulators. 

Where a total enclosure is used, it needs to be air-tight so 
that it contains the vapour or dust handled, and strong 
enough to remain so. When such an enclosure is used, the 
space inside and the plant and equipment inside may be 
heavily contaminated. There is thus a need for measures to 
limit exposure when the enclosure has to be opened. These 
may include measures to remove the contaminant and mea¬ 
sures such as procedures and/or interlocks to control access. 

There are a number of types of partial enclosure, 
including (1) booths, (2) fume cupboards, (3) hoods over hot 
processes and (4) jet assisted hoods. 

A partial enclosure should be no larger than is necessary 
for the purpose. The velocity of the air entering it should be 
high enough to overcome any tendency for the air inside to 
escape. Turbulence may be created within the enclosure by 
the working of equipment inside it and outside the enclo¬ 
sure by air currents. For a partial enclosure, the basic air 
flow required is given by 

Q = AV [25.7.1] 

where A is the area of the opening (m 2 ), Q is the volumetric 
air flow (m 3 /s) and V is the inward superficial air velocity 
(m/s). The BOHS Guide states that whilst in quiet condi¬ 
tions an inward air velocity of 0.5 m/s may suffice, in more 
difficult circumstances, 2 m/s or more may be needed, and 
that for normal situations in factories, an air velocity of 
1 m/s is often used. Depending on the nature of the enclo¬ 
sure, it may also be necessary to make an allowance for 
leakage at the joints of the enclosure. Guidance is given in 
the BOHS Guide. 

A booth is a type of partial enclosure from which one 
side, or part of one side, is missing. It should be deep, since 
leakage due to eddies tends to occur round the edges of a 
shallow booth. 


If the booth is large enough for an operator to work inside 
it, he should work at the front open face and not between the 
contaminant source and the air exhaust outlets. 

A laboratory fume cupboard may be regarded as a spe¬ 
cial type of booth giving partial enclosure, but with a clo¬ 
sure which can be closed to give almost total enclosure. 
There are many variations depending on the type of work 
to be done, but a fume cupboard usually takes the form of 
an open-fronted booth with a vertically sliding front win¬ 
dow, or sash. The sash may be left open, partially closed or 
closed, and there are various arrangements designed to 
maintain a stable air flow and to ensure that air is drawn 
from both the top and bottom of the cupboard. 

Relevant standards for fume cupboards are BS 7258: 
1990 Laboratory Fume Cupboards and also BS DD191:1990 
Method for Determination of the Containment Value of a 
Laboratory Fume Cupboard. Further guidance is given by 
D. Hughes (1980), Piney and Carroll (1983) and J.D. Cook 
and Hughes (1986). 

Another receptor arrangement is a hood over a hot pro¬ 
cess. The design intent is that the hot gas rises from the 
process and flows into the hood. If the gas plume is not hot 
enough or if too much air is entrained into it, so that the 
total plume volume is too great and too cool, the hood may 
not operate as intended. The plume may miss the hood or 
may enter but may flow back out. 

Methods are available for the design of such hoods. They 
include the plume models by Hemeon (1963) and Bender 
(1979) and methods of measuring plume volume and veloc¬ 
ity, assisted by the use of cine or video film, developed by 
Bamford (1961) and Goodfellow and Bender (1980). 

A further type of receptor arrangement is the jet- 
assisted, or push-pull, hood. This is used with an open 
surface such as a tank, where a jet of air is blown across the 
surface. The design intent may be frustrated if the jet is too 
powerful so that it carries the contaminant beyond the 
exhaust hood or if it strikes parts of the tank so that 
turbulence is created. 

Models applicable to jet-assisted hoods of this type 
include those by Hemeon (1963) and Baturin (1972), whilst 
a practical application has been described by Huebener and 
Hughes (1985). 

25.7.4 Captor hoods 

The other main type of hood used in LEV is the captor 
hood. Whereas a receptor hood receives a flow of con¬ 
taminated air carried into it, a captor hood draws the air 
flow in. The two types of hood may sometimes be similar in 
shape, but the principle of operation is different. A receptor 
hood operates on the push and a captor hood on the pull 
principle. 

For a captor hood, the air velocity required depends cri¬ 
tically on the distance between the hood face and the con¬ 
taminant source. For a normal shape such as a circle, square 
or rectangle (although not for a slot), the air velocity at a 
point only one-hood face diameter from the centre of the 
hood face itself is typically only one-tenth of the face velo¬ 
city. Thus, a broad rule-of-thumb for a practical system is 
that the contaminant source should not be more than one 
hood face diameter from the hood face. 

A more scientific approach is based on the concept of a 
capture velocity, which is the velocity induced at the source 
sufficient to capture the contaminant. Whilst there is no 
real design alternative to the use of capture velocity, the 
concept has limitations. It is most applicable where the 
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contaminant at the source has a low velocity, but tends to 
break down where the contaminant is directed away from 
the hood at an appreciable velocity. The BOHS Guide states 
that, although capture velocities as low as 0.25 m/s are 
sometimes quoted, a value of 0.5 m/s should be taken as a 
practical minimum, and it uses in a subsequent illustrative 
example a velocity of 0.75 m/s. 

A relation for the superficial velocity of air entering the 
hood has been given by B. Fletcher (1977). This is 

V _ 1 

Vo — 0.93 + 8.58« 2 

x fwy* 

av*\l) 

© - 1/3 

where A is the face area of the hood (m z ), L is the length of 
the hood (m), V is the capture velocity at distance X (m/s), 
V 0 is the superficial velocity at the face of the hood (m/s), 
W is the width of the hood (m), X is the distance from the 
hood (m), and a and /? are indices. 

The performance of a captor hood may be enhanced by 
the use of flanges around the face inlet. The design of such 
flanges is treated in the BOHS Guide. 

The volumetric flow of air required for a captor hood can 
be very much greater than for a receptor hood. The BOHS 
Guide gives a comparison of four systems. Of these four 
systems, the one most economical in air is a receptor hood 
with a small aperture in the face side, the second is a 
receptor hood with the whole face side missing, and the 
third is a captor hood with a large flange and the last a 
captor hood with no flange. The ratio of the volumetric air 
flow required by the last of these arrangements to that 
required by the first is 100 :1. 


[25.7.2] 

[25.7.3] 

[25.7.4] 


In indoors there tend to be wide variations between the 
concentrations at different locations in the work space; 
the concentrations can differ by orders of magnitude. The 
enhancement of general ventilation may have little or no 
effect on the concentration at a particular point. 

In general, the variability of the concentration of a con¬ 
taminant at a fixed point outdoors tends to be very high. 
Indoors, the variability at a fixed point is much less. 

General ventilation may have two effects. One is simply 
to reduce the concentration of contaminant by the intro¬ 
duction of more air. The other is to move the contaminant in 
a particular direction by displacement of air. 

As described in Chapter 10, methods are available for the 
determination of the volumetric flow of air due to natural 
ventilation. Guidance is available in BS 5925: 1980. The 
BOHS Guide gives a worked example based on the BS 5925 
method. 

The concentration of contaminant resulting from 
general ventilation may be obtained on the assumption 
of perfect mixing in the work space, as described in 
Chapter 10. In practice, the concentration may be con¬ 
siderably higher. One approach to this problem is the 
method used by the ACGIH for the determination of con¬ 
centration of a contaminant relative to theTLV. This method 
utilizes an empirical factor K which takes into account 
variations in the concentration with space and time, and 
allows for the toxicity of the contaminant.Values of K range 
from 3 to 10. 

25.7.7 Air jets 

Air jets are sometimes used as part of a system of general 
ventilation. They are of two types: those that draw air from 
within the work space and those that draw air from outside. 
In the first type, the jet is used to promote mixing in the 
space. In the second type, it may be used as a fresh air jet to 
provide a volume where the concentration of contaminant is 
low, but in this case it must be sufficiently near the point in 
question to effect this; otherwise, the jet is liable to become 
contaminated with air from the work space. 

The following equation is given by the CIBSE (1977) for 
the centre line velocity of a jet: 


25.7.5 Low volume, high velocity system 
A particular type of captor hood arrangement for LEV is 
the low volume, high velocity (LVHV) system. This system 
utilizes a small hood (typically <6 cm 2 ) placed very close to 
the contaminant source and a high capture velocity 
(«50-100 m/s). It may be used for vapour sources such as 
welding and for dust sources such as grinding. However, it 
is not easy to use and tends to be limited in application. 
Successful use requires that it be unobtrusive, correctly 
adjusted and properly maintained. 


25.7.6 General ventilation 

LEV is the preferred method of ventilation, but there are 
circumstances in which it is not applicable, and in such 
cases it is resorted to general ventilation of the work space. 
However, such general ventilation is usually regarded as a 
comparatively ineffective method of contaminant control. 

Some processes are operated outdoors, and it is often 
assumed that an outdoor location ensures negligible expo¬ 
sure. This is not necessarily so, and each case should be 
treated individually 


Y _ kq 

V X (A<Q) 1/2 


[25.7$ 


where A f is the free area of discharge (m 2 ), C d is the coeffi¬ 
cient of discharge, Q is the volumetric flow (m 3 /s), V x is the 
centre line velocity at distance x (m/s), X is the distance 
along the centre line (m) and K is a constant. The value of C d 
is taken as 1.0 for a well-rounded nozzle and 0.6 for a sharp- 
edged orifice and that of K as 7.0 for a round nozzle and 5.7 
for a standard grill, where the outlet velocity is 4-8 m/s. 

The use of air jets can cause problems if the jet is not well 
integrated with the overall system design. Typical effects 
are undesired dispersion of the contaminant, interference 
with existing LEV systems, the creation of vortices where 
the contaminant becomes concentrated, and discomfort 
due to cold draught. 

Use is also made of air curtains to provide a barrier to the 
flow of contaminant. The use of such a curtain can result in 
dispersion rather than containment of the contaminant and 
careful design is needed. Another device sometimes used is 
an air douche in which air is discharged at low velocity 
above the heads of workers. 
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25.7.8 Air replacement 

The air removed by the ventilation system has to be 
replaced. It is usually recommended that this replacement 
air should enter through properly designed inlets. Air 
which simply leaks in through open doors, windows and 
cracks, may cause unpleasant draughts and may also set up 
air movements which affect the operation of an LEV system. 

25.7.9 Design of ventilation systems 

In designing a ventilation system for the control of a con¬ 
taminant, this ultimate purpose needs to be borne con¬ 
stantly in mind. It is not uncommon for this objective to be 
lost sight of and for the design to degenerate into the mere 
provision of the mechanical elements of the system such as 
the hood, ductwork and fan. The-BOSS Guide gives a series 
of quotations, starting with J.B.S. Haldane in 1907 and 
continuing into the 1980s. The following, from Hemeon 
(1963), though not the most recent, perhaps puts the pro¬ 
blem most clearly: 

It sometimes seems that engineers experience such sheer 
satisfaction in their ability to handle the design of duct 
work on a neatly quantitative basis, that they are led to 
slight the initial problem of selecting suitable exhaust or 
ventilation rates as though they were a minor detail to be 
covered as quickly as possible ... whereas the part they 
slight is the essential of industrial ventilation. 

For this reason, the Guide advocates design leadership by 
an occupational hygienist. 

Accounts of the mechanical design of ventilation sys¬ 
tems are given in the texts quoted. In particular, Local 
Exhaust Ventilation , the BOHS Guide and the IChemE 
Dust Control Guide give detailed treatments, dealing with 
overall system design, ductwork, fittings, multi-branched 
systems, fans, and air cleaning and disposal. 

Guidance on the commissioning of ventilation systems is 
given in Principles of Local Exhaust Ventilation, BS 5720, the 
Commissioning Code ofCIBSE( CIBS, 1977; CIBSE, 1978-), 
and the BOHS Guide. 

Where the system is a multi-branched one, the balancing 
of the flows is of particular importance. 

25.7.10 Maintenance of ventilation systems 

It is important that any ventilation system for the control of 
contaminants be properly examined and maintained. HSE 
guidance is given in HS(G) 54 The Maintenance, Examina¬ 
tion andTest of Local Exhaust Ventilation (HSE, 1990). 

Inspections have found that the effectiveness of many 
industrial ventilation systems is low. Sometimes this is due 
to inefficient functioning of the mechanical items due to 
poor maintenance. But it is also possible for these items 
to be working as intended but for the ventilation achieved to 
be ineffective. This may arise, for example, if the con¬ 
taminant source has been moved somewhat further from 
the hood. 

The prominence given in regulations to maintaining the 
whole system so that it operates as intended reflects the 
problem. As described earlier, Regulation 9 of the COSHH 
Regulations requires that for an LEV plant, the maximum 
interval for thorough examination and test is 14 months, or 
as given in Schedule 3 to that regulation. The CLAW Regu¬ 
lations and the CAWR also contain requirements for LEV 
system maintenance. 

Checklists for the maintenance of LEV systems are given 
HS(G) 54 and the BOHS Guide. 


25.8 Skin Disease 

Thus far, the discussion has dealt with toxic substances 
which are airborne. It is also necessary to prevent corrosive 
and toxic chemicals from causing irritation of the skin 
leading to skin disease, or dermatitis, and from entering 
the body through the skin. 

Guidance on skin disease is given in MS 3 Skin Tests in 
Dermatitis and Occupational Chest Disease (HSE, 1977), EH 
26 Occupational Skin Diseases (HSE, 1981) and MS 24 Health 
Surveillance of Occupational Skin Disease (HSE, 1991). Fur¬ 
ther accounts of skin disease are given in Occupational 
Diseases of the Skin (L. Schwartz,Tulipan and Birmingham, 
1957) and Manual of Contact Dermatoses (Fregert, 1974) and 
by McCreaney (1969,1977), Rycroft (1979,1980,1980 LPB 
58) and Gadian (1983). Aspects of skin disease in the petro¬ 
leum industry are dealt with in Petroleum Hydrocarbons: 
their Absorption Through and Effect on the Skin (CON- 
CAWE, 1984 84/54) and Factors Affecting the Skin Penetra¬ 
tion and Carcinogenic Potency of Petroleum Products 
Containing Polycyclic Aromatic Compounds (CONCAWE, 
1990 90/55). 

Occupational skin disease is the most common cause of 
disablement in industry. Statistics are given in the Health 
and Safety Statistics 1990-91 (HSE, 1992b). There are a 
number of different ways of arriving at a figure for such 
disease, but the number of new cases is of the order of 
40,000 per year. 

The types of chemical which cause skin disease are 
classified as (1) contact irritants, (2) contact sensitizers and 
(3) photosensitizers. Contact irritants cause direct damage 
to the skin. Contact sensitizers cause a specific allergic 
response to develop over a period. 

Photosensitizers may be either irritants or sensitizers, 
but require the additional stimulus of sunlight or ultravio¬ 
let (UV) light. 

Substances which are liable to cause skin disease are 
chemicals, cutting oils, degreasing agents, tar and pitch. It 
may also be caused by physical agents such as heat, cold, 
humidity, light and ionizing radiations. 

Prevention of skin disease should be based on engineer¬ 
ing measures to eliminate the causal agent, supplemented 
where necessary by personal protection. Where chemicals 
have to be handled, it is essential to use the proper methods 
and to wear the appropriate protective clothing, to observe 
the highest standards of personal hygiene, to change 
working clothes, including underwear, frequently and to 
take a thorough shower each day. Any break in the skin 
should be covered. Skin rashes should be reported, and 
wounds treated, promptly. 


25.9 Physico-chemical Hazards 

There are a number of physico-chemical effects which are 
very simple and familiar to the engineer, but which have 
implications often not fully appreciated, particularly by 
process and maintenance personnel. 

An account of some of these effects has been given by 
Jennings (1974a,b). They include: 

(1) density differences - 

(a) gases and vapours, 

(b) liquids; 

(2) phase changes; 

(3) vapour pressure; 
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(4) flashing liquids; 

(5) nearly immiscible liquids; 

(6) heat of mixing; 

(7) exothermic reactions; 

(8) impurities. 

At constant pressure, the density of a gas or vapour p g is 
proportional to the molecular weight M and inversely pro¬ 
portional to the absolute temperature T: 



Density differences can cause the gas or vapour to flow in 
unexpected ways. 

In one case, a manhole in a reboiler containing benzene 
was left open. Some benzene vapour escaped and poured 
down so quickly into the base of the room that the operator 
was killed before he could put on a respirator. 

Another incident involved a hydrogenation vessel which 
was shut-down for repair, but into which hydrogen con¬ 
tinued to leak through a valve that was only partially 
closed. When the top manhole cover was taken off to admit a 
charge of carbon dioxide as an inert blanket, there was a flash 
of fire. Since the hydrogen was much less dense, enough air 
had presumably entered to form a flammable mixture. 

Differences in liquid density can give rise to very high 
pressure in equipment and to layering. In one incident, the 
discharge and suction valves were shut on a pump full of 
ethylene glycol and the pump was left running. The liquid 
heated up and the volumetric expansion of the liquid gen¬ 
erated a pressure sufficient to crack the pump casing. 

The effect of layering due to the difference of densities of 
two liquids is illustrated by the following case. A mixture 
of liquid caustic soda and phenol was being prepared in a 
reaction vessel by an operator. The addition was made 
without agitation and the phenol formed a separate layer on 
top of the caustic soda. When the agitator was switched on, 
there was a violent reaction and about half the charge was 
ejected through the top opening, which had a hinged lid, 
onto the operator. 

The volume changes associated with a change of phase, 
particularly changes between liquid and vapour, can pro¬ 
duce violent effects. At atmospheric pressure, for example, 
one volume of liquid water vaporizes to give about 1600 
volumes of steam. 

A road tanker was being filled with hot tar at a tem¬ 
perature just below 100°C when the pump failed. In accor¬ 
dance with normal practice, the tar line was blown out with 
steam. Since the tank was only half full, the driver went on 
to another site to top up and so obtain a full load. Here the 
tar was at a temperature in excess of 100°C and a few sec¬ 
onds after the filling began, hot tar was ejected from the 
manhole. The cause was vaporization of the steam con¬ 
densate left in the tank from the steam blowing operation at 
the first site. 

Conversely, sudden contraction of vapour can create a 
vacuum and cause a vessel to implode or to draw in air. A 
particular important case is a situation which occurs when 
heat input is lost on the reboiler of a distillation column. 
Rapid condensation of the vapour in the column may create 
a vacuum which draws air in through the vent and may thus 
cause an explosive mixture to form. This may be prevented 
by the use of nitrogen injection. 


Powerful effects are also produced by the variation of the 
vapour pressure with temperature. For a pure liquid, the 
relation between the vapour pressure and temperature may 
be represented by the Antoine equation: 

#^exp^yO [25.9.2] 

where p° is the vapour pressure, T is the absolute tempera¬ 
ture, and A, B and C are constants. For most liquids, the 
vapour pressure doubles over a temperature range of about 
8°C. For ideal liquid mixtures, Raoulf’s law applies: 

p, = p°x t [25.9.3] 

where p° is the vapour pressure of the pure component i, 
pi is the partial pressure of component i and x, is the 
concentration of component i (mole fraction). 

But, if instead the liquids are immiscible, then for each 
liquid 

Pi=P° [25.9.4] 

In both cases, the total pressure Pis given by Dalton’s law: 

P = 5> 

In the general case, some of the components may be inert 
gases. 

The effect of vapour pressure is illustrated by a case in a 
works producing chlorine by the mercury cell process 
where a worker was found to have persistently high mer¬ 
cury in his urine, even though he hardly ever went into the 
cellroom. His main work was the removal of ebonite lining 
from mild steel sections used in the cellroom equipment. 
The work involved the application of heat. This heat was 
sufficient to cause traces of mercury lodged in cracks in the 
ebonite to exert an appreciable vapour pressure. 

A common phenomenon associated with vapour pres¬ 
sure is cavitation in pumps. This occurs if the suction 
pressure is low and the liquid temperature is high. Pockets 
of vapour form and collapse as the local pressure falls 
below or rises above the vapour pressure. The resultant 
erosion and pitting is extremely damaging to the pump. 

A Dowtherm furnace started up and the pressure rose 
suddenly from 15 to 110 psi. Water had entered the system 
and both liquids were exerting their full vapour pressure. 
In this instance, the pressure relief valve operated and 
prevented an accident. 

If a liquid at a given pressure is let down to a lower pres¬ 
sure such that the boiling point at the lower pressure is less 
than the original temperature of the liquid, liquid immedi¬ 
ately flashes off until the lower pressure boiling point is 
reached, the amount of vapour formed being determined by 
the heat balance. 

A tank had been cleaned by boiling water in it under 
pressure. The operator opened a vent to release the pres¬ 
sure, but loosened a manhole before the venting was com¬ 
plete. Large amounts of boiling water and steam issued out 
around the cover. 

Liquid systems in which there are two separate liquid 
phases are loosely referred to as ‘immiscible’, although 
there is always some mutual solubility, so that ‘nearly 
immiscible’ would be a more accurate description. Consider 
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a system with two nearly immiscible components A and B. 
At equilibrium, the phase which is nearly all A is saturated 
with a small quantity of B. If this phase has separated out, 
both A and B exerttheir full vapour pressure. If B has a high 
vapour pressure, a considerable proportion may be evolved. 

An operator drained water from a tank in which there 
was a water layer covered with a benzene layer. The benzene 
in the water exerted an appreciable vapour pressure and the 
operator suffered benzene poisoning. 

When two liquid chemicals are mixed together, there is a 
heat of mixing. Whilst this is zero for an ideal mixture and 
low for many mixtures, for others it is appreciable. 

Owing to a failure of communication, a tanker of hydro¬ 
chloric acid was unloaded into a storage tank used for sul¬ 
furic acid. When about half of the 3000 gal load had been 
transferred, there was a violent explosion, which raised the 
tank several inches off the ground and buckled it, and 
broke the inlet and outlet lines. 

In another case, a violent explosion occurred when mix¬ 
ing took place between very strong caustic soda, which was 
lying on the bottom of a vessel and was covered by a solid 
crust, and weak caustic soda above it. 

Reaction kinetic effects, especially in exothermic reac¬ 
tions, are discussed in Chapter 11. 

A particular case of importance is situations in which 
there is inadequate agitation in a chemical reactor. The 
reactants are allowed to build up without agitation and then 
react explosively, either spontaneously or when agitation is 
started. 

One incident involved a sulfonation process in which 
benzene and concentrated sulfuric acid were premixed 
before transfer to a reaction vessel. On one occasion, the 
agitator was not used and the reactants were transferred 
unmixed. The operator noticed this and quickly switched 
on the reactor agitator. There was a rapid reaction, benzene 
vapour was evolved, a flammable mixture was formed in 
the room and it ignited. 

Impurities can cause violent reactions or severe corrosion. 

An operator was transferring thionyl chloride by 
vacuum from a 55 gal drum through a stainless steel hose 
when the hose developed a leak. He obtained another hose, 
checked that nothing drained from it and substituted it for 
the first. When he opened the feed valve, the hose ruptured. 
The accident was caused by a small amount of water which 
was left in the hose and which reacted violently with the 
thionyl chloride, releasing large volumes of hydrogen 
chloride and sulfur dioxide. Calculation showed that one 
teaspoonful of water would be enough to generate a pres¬ 
sure of 2800 psig in the hose. 

Corrosion not only reduces the strength of the equip¬ 
ment, but also generates gases. 

An apprentice under training was erecting some pipe¬ 
work. He required a blank flange of a particular size and 
noticed one on some redundant pipework nearby. When he 
attempted to remove the blank, acid sprayed in his face. The 
pipework had been used previously for concentrated sul¬ 
furic acid and corrosion had generated hydrogen, which 
pressurized the pipe. 

25.10 Ionizing Radiation Hazards 

Materials and machines which give off ionizing radiation 
are widely used in industry. They are potentially very 
hazardous, hut they may be handled safely by taking 
proper precautions. 


The legislation covering the use of ionizing radiations is 
discussed in Chapter 3. That of principal relevance here is 
the Ionizing Radiations Regulations 1985. The associated 
ACOP is COP 16 The Protection of Persons against Ionising 
Radiation arising from any Work Activity (HSE, 1985). 

Engineering aspects of ionizing radiations are described 
in Radioactivity for Engineers (Coombe, 1968) and health 
and safety aspects are described in Radiation Hygiene 
Handbook (Blatz, 1959), Radiation Protection Standards 
(L.S. Taylor, 1971), Principles of Radiation Shielding (Chilton, 
Shultis and Faw, 1984), Industrial Radiation Hazards Desk- 
book (Cheremisinoff, Cheremisinoff and Teresinski, 1987 
ACGIH/12) and Radiation Protection (Shapiro, ACGIH 
1990/48) and by H.H. Fawcett (1965c), Bennellick (1969, 
1977), Brodsky (1978-), Doran (1980), Harrington (1980b), 
Dennis (1982) and Kielman and Fawcett (1982). 

A code relevant to potential exposure to radioactive 
materials during a fire is NFPA 801:1991 Facilities Handling 
Radioactive Materials. 

The hazard from sealed sources, from machines 
designed to generate ionizing radiations such as X-rays and 
from machines which give off radiations adventitiously is 
one of external exposure, but unsealed sources present the 
further hazard of internal exposure arising from ingestion. 

Ionizing radiations are a complex and specialist matter 
and only a very limited treatment is given here. A more 
detailed treatment of types and units of radiation is given 
in Appendix 20. COP 16 gives detailed coverage of a large 
number of industrial aspects. 

25.10.1 Types and units of radiation 

There are three main types of radioactive particle or ray: 
(1) a-particles, (2) /l-rays and (3) y- and X-rays, a-particles 
have a relatively large mass and short range, being stopped 
by an air gap of about 8 cm or a sheet of paper, and generally 
they present little external radiation hazard, but are dan¬ 
gerous if they get inside the body, /?-rays (or particles) have 
a much smaller mass and greater penetrating power. Their 
range in air is about 10 m, but they are usually stopped by a 
few millimetres of solid material, y-rays and X-rays are 
electromagnetic radiations which have a range of a few 
hundred metres, but can be stopped by a few millimetres of 
lead or by 0.5-1 m of concrete. 

In the SI system, the units of radiation are: for activity, 
the becquerel (By); for absorbed dose, the gray (Gy); and 
for the dose equivalent, the sievert (Sv). The dose equiva¬ 
lent is the product of the absorbed dose and a quality factor 
(QF). The corresponding units in the older system are the 
curie (Ci), rad (rad) and rem (rem), respectively. 

25.10.2 Effects of exposure 

a-Particles destroy bone marrow so that the red corpuscles 
are not replaced. /1-rays give rise to skin burns, skin cancer, 
dermatitis and eye disease, y-rays and X-rays cause skin 
burns and cancer and ageing effects. Fairly severe expo¬ 
sure is required to cause sterility, but genetic effects are 
believed to be proportional to exposure. 

25.10.3 Industrial applications 

Industrial applications of ionizing radiations include the 
following: 

(1) radioactive process materials; 

(2) Radioactive auxiliary materials - 
(a) tracers, 
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(b) sorting aids, 

(c) quality control aids, 

(d) static eliminators, 

(e) instruments; 

(3) y- and X-rays - 

(a) non-destructive testing, 

(b) quality control; 

(4) irradiation - 

(a) food preservation, 

(b) cold sterilization, 

(c) polymerization. 

Some process materials, such as radioactive metals, are 
themselves radioactive. 

Radioactive materials are commonly used as tracers. 
Examples are the use of 24 Na, 59 Fe and 60 Co in work on 
mixing, piston ring wear and refractory wear, respectively, 
and of various tracers in following the progress of pigs or of 
interfaces between products in pipelines and in detecting 
leaks in water and other pipe systems. 

Items on which sorting or quality control is to be carried 
out may be tagged with a radioactive material. Radioactive 
sources are used to ionize the air and so dissipate static 
electricity. Instruments which use radioactivity include 
level measuring instruments that measure the height of the 
liquid surface and ionization chambers which detect the 
presence of smoke. 

y-Ray sources are used to detect flaws in castings. The 
castings are grouped around the source with photographic 
plates behind them. Similarly, the non-destructive testing 
of pressure vessels and components, and particularly 
welds, is carried out using X-rays. The latter are also used 
in X-ray fluoroscopy for the inspection of items on conveyor 
belts for quality control purposes. 

Applications of irradiation in polymerization include the 
vulcanization of rubber and polymerization of high melting 
point polyethylene. 

25.10.4 Measurement of radiation 

Measurements of radiation are made both on the plant and 
on the personnel. In the first case, the objective is to check 
radiation flux levels and releases, in the second, to monitor 
exposure. 

Portable devices for measuring the exposure of person¬ 
nel include film badges and pocket ionization chambers. 
Both types measure )?-, y- and X-rays. 

Radiation on the plant or from contamination is mea¬ 
sured by instruments such as Geiger-Muller counters and 
scintillation counters. Except for scintillation counters, 
these instruments do not measure a-particles, but special 
a-measuring instruments are available. 

25.10.5 Limits for exposure 

Occupational exposure to radiation should always be kept 
as low as practicable. The established limits should be 
observed, but since any level of radiation may involve some 
risk, every effort should be used to minimize exposure. 

Recommendations on limits for exposure are made by 
the ICRP. These recommendations are widely applied 
internationally. 

In the United Kingdom, the National Radiological Pro¬ 
tection Board (NRPB) makes recommendations to govern¬ 
ment on working limits, taking into account the ICRP 
recommendations. 


The statutory limits for ionizing radiations are given in 
the Ionizing Radiations Regulations 1985 and are: 


Adult workers: 

dose limit 

Adult employees: 

investigation level 
Members of public: 

dose limit 
Members of public 
exposed over long 
periods: dose limit 

50 mSv in any calendar year 

15 mSv in any calendar year 

5 mSv in any calendar year 

1 mSv annual average 

The following are 
NRPB (1993): 

the limits now recommended by the 

Adult workers: 
dose limit 

20 mSv in any calendar year 

Adult employees: 
investigation level 

15 mSv in any calendar year 

Students and 
apprentices 

6 mSv in any calendar year 

Members of public: 
dose limit 

1 mSv in any calendar year 


0.3 mSv from any single source 


25.10.6 Control of exposure 

As in industrial hygiene generally, control of radiation 
exposure depends on deciding acceptable limits of expo¬ 
sure, designing the plant to minimize release, operating 
systems which minimize exposure and monitoring the 
personnel exposed. 

Radiation may be contained within the equipment by 
shielding. This may take the form of lead a few millimetres 
thick. Protection of equipment giving off radiations may be 
provided by interlocks. 

If some exposure is unavoidable, measures should be 
taken to minimize it. Since the dose is inversely propor¬ 
tional to the square of the distance and proportional to 
time, the distance from the radiation source should be as 
great and the time of exposure as short as possible. 

Contamination from unsealed sources requires special 
measures for control and decontamination. These are dis¬ 
cussed by Bennellick (1969,1977). 

All personnel who may be exposed to radiation should he 
monitored. Principal methods of monitoring include the 
carrying of personal radiation metres and the testing of 
blood. If tests indicate that a person is nearing the limit of 
exposure, he should be withdrawn temporarily or perma¬ 
nently from the work. 


25.11 Non-ionizing Radiation Hazards 

Ionizing radiation is not the only kind of radiation which 
may be hazardous. There are a number of types of non¬ 
ionizing radiation which can have harmful effects. 

Accounts of non-ionizing radiation are given by 
Harrington (1980b), Kanagasbay (1980), Kielman and 
Fawcett (1982), McKinlay (1982) and Pilborough (1989). 
Guidance is available in the series Nonionizing Radiation 
Guides (AIHA, 1977-/3). 
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25.11.1 Electromagnetic spectrum 

The electromagnetic spectrum is divided by wavelength 
into the following regions: 


Cosmic rays 
y-rays and X-rays 
UV 

Visible region 
IR 

Microwaves 
Radio waves 


<10“ 4 nm 
10 -4 —10 nm 
10-400 nm 
400-700 nm 
700 nm—1 mm 
1mm—lm 
>lm 


The boundaries have developed by usage and are adopted 
by convention. Non-ionizing radiation is conventionally 
taken as that radiation which has a wavelength exceeding 
100 nm, and thus starts within the UV region. 

25.11.2 Artificial sources 

Artificial sources of non-ionizing radiation include: in the 
UV region, welding; in the IR region, welding, furnaces and 
lasers; in the microwave and radio frequency (RF) regions, 
microwave ovens, communications equipment and radar. 

25.11.3 Health effects 

The health effects of exposure to non-ionizing radiation are 
felt mainly on the eyes and skin. UV, IR, and microwave and 
RF radiations can each cause damage to both these parts of 
the body. 

Thermal injury occurs when the rise in the temperature 
of the tissue is more than a few degrees. Thermomechanical 
damage ensues when thermal expansion of tissue is at such 
a rate that it results in explosive disruption. Photochemical 
injury is caused by absorption of a greater dose of energy 
than the body’s repair mechanism can handle. 

25.11.4 Ultraviolet radiation 

UV radiation is most harmful in the waveband 200-315 nm. 
Acute injury depends essentially on the total dose, whether 
this be received for a few seconds or over some hours. 

The effect of overexposure on the eye is exemplified by 
such conditions as ‘welder’s flash’ and ‘snow blindness’ a 
condition known as photokeratitis which is painful but 
generally reversible.The acute effect on the skin is ery thma, 
or sunburn. Long-term overexposure of the skin leads to 
the chronic condition of skin cancer. 

Guidance on UV radiation is given in Ultraviolet Radia¬ 
tion (AIHA, 1991/14a). 

25.11.5 Infrared radiation 

Visible and IR radiation entering the eye are focused on the 
retina and can cause damage, but this is usually averted. 
The reaction to a bright light is to avert the eye and this 
aversion response, occurring typically with 0.25 s, usually 
ensures that damage is avoided. 

The main cause of injury to the skin from IR is thermal 
damage. A particularly hazardous form of IR radiation is 
that from a laser. 


25.11.6 Laser radiation 

A laser produces an intense monochromatic beam of non¬ 
ionizing radiation, either as continuous wave (CW), a single 
pulse or a series of pulses. The beam from some lasers can 
cause damage, particularly to the eye. 


Guidance on lasers is given in PM 19 Use of Lasers for 
Display Purposes (HSE, 1980) and Safety in Universities - 
Notes of Guidance, Part 2:1 Lasers by the Committee of Vice- 
Chancellors and Principals (CVCP) (1992). A relevant code is 
BS EN 60825: 1992 Radiation Safety of Laser Products, 
Equipment Classification and Users Guide. Further guid¬ 
ance is given in A Guide for the Control of Laser Hazards by 
the ACGIH (1990/41). 

Laser products are classified according to the maximum 
permissible exposure (MPE) of the eyes and skin, and to 
the associated accessible emission level (AEL). 

Class 1 laser products are those which are inherently 
safe. Class 2 laser products are not inherently safe but have 
a power so limited that eye damage should not result over a 
duration of 0.25 s for a blink reflex. Classes 3A, 3B and 4 
cover higher power products. 

A laser may or may not produce a beam in the visible 
part of the electromagnetic spectrum, so that a person 
working with one which does not may be unaware that he 
has been exposed. 

Personnel working with laser equipment should wear 
safety glasses appropriate to the class of laser concerned. 
A high level of ambient lighting is beneficial in that it 
restricts pupil size. 

Since different classes of laser have very different power 
outputs, arrangements satisfactory for one class may not 
be so for a higher power class. 

The use of lasers requires a safe system of work, the 
principal elements of which are control of access, warning 
notices and lights, and, possibly, interlocks. 

Work with lasers should be subj ect to health surveillance. 

25.11.7 Protection and control 

The principles of protection from non-ionizing radiations 
have many similarities with those for protection against 
the hazards already considered. The first line of defence is 
engineering measures to eliminate or reduce exposure, the 
second is systems of work for the control of exposure and 
the third is PPE. 

25.12 Machinery Hazards 

Accidents caused by moving machinery have always been a 
serious problem in industry. The reduction of this type of 
accident has been one of the main concerns of industrial 
safety legislation. The development of this legislation has 
been described in Chapter 3. 

Guidance on the hazards and safe use of machinery is 
given in two series of publications by the HSE, the HSW 
series ( Health and Safety atWork Booklets) and the PM ( Plant 
and Machinery ) series. The former includes HSW 3 Safety 
Denies for Hand and Foot Operated Presses (HSE, 1971) and 
HSW 41 Safety in the Use of Woodworking Machines (HSE, 
1970). The PM series includes PM 1 Guarding of Portable 
Pipe-threading Machines (HSE, 1984), PM 21 Safety in the 
Use of Woodworking Machines (HSE, 1981), PM 22 Training 
Advice on the Mounting of Abrasive Wheels (HSE, 1983), 
PM 23 Photoelectric Safety Systems (HSE, 1981), PM 41 
Application of Photo-electric Safety Systems to Machinery 
(HSE, 1984) and PM 65 Worker Protection at Crocodile 
(Alligator) Shears (HSE, 1986). A relevant standard is BS 
5304:1988 Code of Practice of Safety of Machinery. Accounts 
of safe working with machinery are given by Haigh (1969, 
1977) and Bramley-Harker (1969,1977). 
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25.12.1 Machine guarding 

The law on the safeguarding of machinery has become 
progressively stricter. Requirements are given in the 
Factories Act 1961, Sections 12-15. These sections state 
that prime movers and their flywheels should be securely 
fenced, as should electric motors and generators, trans¬ 
mission machinery and other dangerous machinery unless 
safe by construction or position, that devices for promptly 
cutting off the power from transmission machinery should 
be provided in every place where work is carried out, that 
efficient mechanical appliances should be provided to move 
driving belts to and from fast and loose pulleys and that 
driving belts should not rest or ride on revolving shafts 
when the belts are not in use. 

Secure fixed fencing is the preferred method of guarding 
machinery. The fencing should be strong so that it fulfils its 
protective function and does not deteriorate as a result of 
frequent removal and replacement for maintenance. It 
should be secure and removable only by the use of tools. 

The fencing should enclose the parts guarded compl¬ 
etely. Many accidents occur on equipment where the fenc¬ 
ing is incomplete and where a worker is liable to catch his 
hand between the moving part and the guard. 

In some applications, however, complete enclosure by 
fencing is not possible, because it is necessary to feed 
material or components into the machine. In such cases, 
partial fencing may he used. The space left unprotected 
should be big enough to allow the required access for 
materials hut should exclude the hand. Thus, complete 
fencing is normal for machinery such as revolving shafts, 
belt drives and gear wheels, but partial fencing is used on 
power presses and calenders. 

Partial fencing may be complemented by distance fenc¬ 
ing, which prevents the operator approaching too close to 
the machine. 

If a fixed guard is not practical by reason of the nature of 
the operation, a permissible alternative for machinery 
other than prime movers or transmission machinery is a 
device which automatically prevents the operator from 
coming in contact with the dangerous plant. 

Some other methods of providing protection on these 
lines are (1) feeders, (2) interlocks and (3) trips. 

A feeder device such as a side, chute or roller is used to 
allow material or components to be fed into a machine 
without the necessity for a worker to put his hand in. 

It is often necessary to have access to machinery for 
purposes such as maintenance. In this case, use may be 
made of an interlock which prevents access until the 
machine is stopped and prevents start-up while it is 
unguarded. 

The stopping of the machine requires a braking system. 
The interlock should ensure that the machine has been 
completely stopped before access is possible. 

With some machinery, fencing is not a practical solution. 
An alternative approach is the use of a trip. Trip devices 
include safety bars, photoelectric cells and proximity 
switches. Again a braking system is necessary to ensure 
that the machine stops quickly. 

It is essential for there to be good maintenance both of 
the machine itself and of the fencing and other protective 
systems such as interlocks, trips and brakes. 

Operators should be trained in the use of the machinery 
itself and in the protective systems. Likewise, maintenance 
personnel should have training in the maintenance of both 


machine and protective system. In some cases, this training 
is the subject of a specific statutory requirement. The 
Power Presses Regulations 1965, for example, specify the 
training required for the maintenance of such presses. 

25.12.2 Running nips 

A large proportion of the hazards on moving machinery 
arises from running nips. A running nip occurs when 
material runs onto or over a rotating cylinder. Running nips 
exist, for example, where a belt runs over a pulley wheel, a 
chain over a sprocket wheel, a conveyor over a roller or mat¬ 
erial over a drum, or where two rolls create an in-running 
nip. Running nips cause many accidents and the accidents 
are frequently serious. 

An account of running nips is given by S.F. Smith (1969, 
1977). One relevant code is BS 5667:1979 -Specification for 
Continuous Mechanical Handling Equipment: Safety Requ¬ 
irements, particularly Part 18 Belt Conveyors - Examples 
of Guarding Nip Points and Part 19: 1979 Conveyors and 
Elevators with Chain Elements - Examples of Guarding 
Nip Points. Another code is BS 7300:1990 Code of Practice 
for Safeguarding of the Hazard Points on Troughed Belt 
Conveyors. 

Typically accidents arise because an operator gets his 
clothing caught in a nip or slips and falls into one, because 
he tries to make some adjustment to the material running 
onto a cylinder or to remove foreign bodies or to clean 
rollers, or because the machinery is started up by mistake. 
Where material runs onto a roller, it is safer if it runs 
over the top so that the hazard is confined to the sides of 
the nip. 

Most of the methods of protection described for machin¬ 
ery in general are applicable to running nips. The preferred 
method is complete fixed fencing, but partial fencing, dis¬ 
tance fencing, feeders, interlocks and trips are also used. 
Again if interlocks or trips are used, it is essential that 
braking be such that it can stop the machinery sufficiently 
quickly. Often several measures are used in combination. 
Protection on a conveyor belt, for example, may use a com¬ 
bination of fixed fencing, distance fencing, interlocks and 
trip wires. 

25.12.3 Inadvertent starts 

Some accidents occur due to the inadvertent starting of 
machinery. A study of this type of accident has been made 
by Rouhiainen (1982), who investigated some 105 incidents 
involving inadvertent starting of machinery in a range of 
industries. Of the six incidents in the chemical industry, 
four involved presses and two involved guillotine shears, 
machinery not particularly characteristic of the industry. 
On the other hand, there were 14 accidents with conveyors, 
8 with other transferring and lifting machines, and 3 with 
packaging machines. 

The primary causes assigned included 24 intentional 
starts, 26 starts caused by human error, 21 starts caused by 
accidentally touching the start button, and 16 starts caused 
by the machine itself. 

The author proposes measures to prevent inadvertent 
starts in both maintenance and normal operations. The 
former includes the disconnection of sources of electrical 
and mechanical energy, such as would be applied in a good 
permit-to-work system. The latter includes the use of bar¬ 
riers, interlocks and touch stopping devices. 
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The protective measures described in the guidance in 
Section 25.12.1 include protection against inadvertent 
starts. 

25.12.4 Abrasive wheels 

Accidents with abrasive wheels used for grinding are 
usually due to wheel failure. The number of accidents is 
small, but this is so only because great care is usually taken 
with grinding operations. 

Relevant statutory requirements include the Grinding of 
Metals (Miscellaneous Provisions) Regulations 1925. Guid¬ 
ance is given in PM 22 Training Advice on the Mounting of 
Abrasive Wheels (HSE, 1983) and HS(G) 17 Safety in the Use 
of Abrasive Wheels (HSE, 1984). Accounts of abrasive wheels 
is given by Blackshield (1969) and Southwell (1977). 

The main cause of wheel breakage is accidents, includ¬ 
ing damage to the wheel by mechanical shock and 
unchecked traverse of the work onto the side of the wheel. 

Excessive rotational velocity is also dangerous. For a 
given wheel, a velocity is specified and should be adhered 
to. The velocity depends on the type of grinding. In high 
velocity grinding, the velocity is about twice that for nor¬ 
mal grinding. It is essential to avoid using wheels made for 
normal velocity in high velocity work. 

Other causes of breakage include excessive heating and 
excessive work pressure. 

Safety measures in grinding work include selection and 
care of the wheels, proper mounting of the wheels, running 
at the specified speed and eye protection for the operator. 

25.13 Electricity Hazards 

Accidents in factories due to electricity are frequently 
associated with a failure to isolate or earth electrical 
equipment or to temporary or defective equipment. 

The use of electrical equipment in factories is governed 
by the Electricity at Work Regulations 1989, which super¬ 
sede the Electricity (Factories Act) Special Regulations 
1908 and 1944. Guidance is given in HS(R) 25 Memo¬ 
randum of Guidance on the Electricity at Work Regulations 
1989 (HSE, 1989). A further treatment is given in Handbook 
on the Electricity at Work Regulations (Marks, 1991). 

HSE guidance on electrical safety is given in HS(G) 13 
Electrical Testing: Safety in Electrical Testing (HSE, 1980), 
GS 27 Protection Against Electrical Shock (HSE, 1984), GS 37 
Flexible Leads, Plugs and Sockets (HSE, 1985), PM 64 Elec¬ 
trical Safely in Arc Welding (HSE, 1986), PM 32 Safe Use of 
Portable Electrical Apparatus (Electrical Safety) (HSE, 1990) 
and GS 47 Safely of Electrical Distribution Systems in Fac¬ 
tories (HSE, 1991). Further accounts are given in Electrical 
Safety Engineering (Fordham Cooper, 1986) and by Haigh 
(1969,1977), Crom (1977) and Bales (1977a-c). 

Some British Standards on electricity and electrical 
work are given in Appendix 27. One of particular relevance 
here is BS 2769: 1984 Hand-held Electric Motor-operated 
Tools. Part 1 of this standard gives general requirements 
for all types of tool and part 2, sections 0-14, describe 
requirements for some 14 types of tool. 

Electrical equipment should be installed, inspected, 
tested and maintained only by competent electricians. 

Equipment should be regularly inspected and serviced. 
Equipment on which repair is to he done should be dis¬ 
connected from the supply until the work is complete. The 
importance of this instruction should be made clear to both 
electrical and other maintenance personnel. Defective 


equipment should be taken out of use and completely dis¬ 
connected from the supply until it is repaired. 

Temporary wiring should be avoided as far as possible, 
but if used should be to a safe standard and properly 
earthed. It should be regularly inspected and repaired as 
necessary and it should be replaced by a permanent 
installation as soon as possible. 

Circuits should not be overloaded, as this increases the 
risk of fire. Loading should be carefully supervised and 
circuits protected by fuses or circuit-breakers. 

Leads should have wires of the standard colours, which 
in the United Kingdom are brown for live, blue for neutral 
and green and yellow for earth. Leads of other colours on 
old or imported equipment should preferably be replaced. 

A large proportion of electrical accidents involves por¬ 
table tools. As described in BS 2769: 1984, the types of 
portable tool are (1) earthed tools and (2) all-insulated or 
double-insulated tools. It is essential to ensure that an 
earthed tool is not used unless it is properly earthed. All 
portable tools should be maintained and tested regularly. 

Cables and plugs are vulnerable and require attention. 
Wear occurs particularly at the points where the cable 
enters the tool or plug. Cable grips reduce this problem. 
Flexible cables should be positioned so that they are not 
damaged by heavy equipment. 

Tools with low voltage (110 Vor, in damp conditions, 50 V) 
should be used wherever practicable. The plug/socket sys¬ 
tem for such tools should be such as to prevent their being 
plugged into the normal mains. 


25.14 Other Activities and Hazards 

The hazards associated with certain common activities are 
considered in this section. Other activities and hazards are 
treated in other chapters. Those associated particularly 
with maintenance, for example, are covered in Chapter 21. 


25.14.1 Lifting and carrying 

Handling, lifting and carrying activities are discussed in 
HSW 1 Lifting and Carrying (HSE, n.d.), Work Practices 
Guide for Manual Lifting (NIOSH, 1981 Publ. 81-122) 
and Manual Material Handling (Kroemer, McGlothlin 
and Bobick, 1989 AIHA/16) and by Halliday (1969,1977), 
A.R. Hale (1984) and Kroemer (1992). 

The Factories Act 1961 states that ‘a person shall not be 
employed to lift, carry or move any load so heavy as to cause 
injury’. 

According to the Health and Safety Statistics 1990/91 
(HSE, 1992b), accidents involving the handling, lifting and 
carrying of goods were responsible for some 55,477 inju¬ 
ries, including 2 fatalities and 1257 non-fatal major injuries 
reported to the HSE. In many cases, such accidents result in 
permanent injury, such as back trouble or hernia, and in 
long periods of absence from work. 

These activities are often treated in terms of sudden 
injury arising from a single incident. But, in fact, much 
injury occurs due to cumulative strain caused by incorrect 
practices over a long period. 

The first essential is that the ergonomics of the handling 
task should be right. This means not only that the weight to 
behandledshouldnotbe excessive,butalsothattheadoption 
of awkward positions should not be necessary and that suit¬ 
able aids such as handles, platforms, rollers, etc., should be 
provided and sufficient time should be allowed. 
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Then, it is necessary that workers doing handling work 
observe some basic principles relating to grip, the position 
of the arms, chin and feet, back posture and the use of body 
weight. The grip should he a full palm rather than a fin¬ 
gertip grip. The arms should be held close to the body and 
fully extended so that the weight is taken by the body itself 
rather than the arms. The chin should be kept in, which 
reduces the risk of spinal injury. The back should be kept 
flat. This prevents compression of the abdominal contents, 
which leads to hernia, and in conjunction with correct foot 
positioning gives better mechanical advantage. The feet 
should be positioned slightly apart to give good balance. 
The weight of the body should be used ballistically, avoid¬ 
ing jerky actions. The use of body weight is one of the 
principles underlying judo and allows large weights to be 
moved with minimum effort. 

There are wrong and right ways of lifting a heavy object. 
If the object is lifted with the back curved, the effort 
required is great and is placed on the back and abdominal 
muscles, whereas if it is lifted with the legs bent and the 
back straight, the effort is less and is taken by the leg and 
thigh muscles. These basic principles have been summar¬ 
ized in the ‘six-point drill’ of the NSC. 

The heights to which heavy objects have to be lifted can 
often be reduced by the use of a platform. 

A heavy object should be carried with the arms straight, 
with the head close to the body and with a straight 
back. Changes of grip and twisting movements should be 
avoided. So should blind carrying, in which the load pre¬ 
vents the carrier from seeing in front of him. The floors or 
other surfaces over which the carrying is done should not 
be slippery. 

Any protective clothing necessary for handling should 
be worn. In particular, the task often requires the use of 
safety shoes or gloves. 

A single worker should not attempt to handle an object 
which is too heavy for him alone. He should obtain the 
assistance of others. 

The maintenance of a fixed position is one of the most 
tiring tasks for the muscles. Thus, even a seated task may 
cause muscle strain if it requires the operator to adopt 
awkward static positions. 

In addition to recognized handling tasks, the occurrence 
of handling operations in such tasks as maintenance 
should be considered. 

Handling objects requires good muscle tone. A worker 
should therefore be given time to tone his muscles up before 
being required to lift the heaviest loads if he is not used to 
such work. 

It is important to give training in matters of handling. 
This is so not least because people often feel they know how 
to do it correctly, when in fact they do not. People often 
attempt from misjudgement, zeal or bravado, to handle 
loads which are too heavy. They should be discouraged 
from doing this. 

A study of the effectiveness of safety training has been 
made by A.R. Hale (1984), which includes a case study of the 
effectiveness of training in handling loads. The basic 
principles commonly taught are those of the NSC’s six- 
point drill mentioned earlier. The study found that con¬ 
ventional training tended to concentrate on injuries to the 
back, to the exclusion of other handling injuries, that it did 
not actually result in correct handling actions, and that 
recognition of good and had postures was more important 
than action drills. 


25.14.2 Hand and power tools 

The proper use of hand tools is clearly essential for safety. 
But injuries also arise from the use of defective tools. A 
split hand file handle may come off and allow the file to 
penetrate the hand. A‘mushroomed’ head on a cold chisel 
may loose fragments which could injure the eye. Another 
cause of injury is the use of the wrong tools. It is necessary, 
therefore, to provide suitable tools for the range of tasks to 
be performed, to store them securely, to maintain them 
properly and to have them regularly inspected by a com¬ 
petent person. 

Guidance on the use of portable hand-held power tools 
includes PM 14 Safety in the Use of Cartridge Operated Tools 
(HSE, 1978) and Pneumatic Tools - Safely in Operation, 
Safety Recommendations for the Use and Operation of Por¬ 
table Pneumatic Tools and Recommendations for the Proper 
Use of Hand Held and Hand Operated PneumaticTools by the 
European Committee of Manufacturers of Compressors, 
Vacuum Pumps and Pneumatic Tools (PNEUROP) (n.d.a, 
n.d.b, 1986, respectively). A further account is given by 
Bland (1977). 

25.14.3 Welding 

Welding operations may involve hazards to the plant and 
the welder. The former have been dealt with in other chap¬ 
ters, particularly Chapter 21, and only the latter are con¬ 
sidered here. 

Guidance on welding is given in MS 15 Welding (HSE, 
1978) and PM 64 Electrical Safety in Arc Welding (HSE, 
1986). Further sources of guidance are the publications of 
the Welding Institute (WI), the American Welding Associa¬ 
tion (AWS), the AIHA and the API. These include Health 
and Safety in Welding and Allied Processes by Balchin (1991 
WI/43); the Welding Handbook (AWS, 7th ed. 1976-/1, 8th 
ed. 1987-/2), the EWH series Effects of Welding on Health 
(AWS, 1979-/3, 4), Fumes and Gases in the Welding Envi¬ 
ronment (AWS, 1979/5) and Fire Safety in Welding and 
Cutting (AWS, 1992/13); Arc Welding andYour Health (AIHA, 
1984/6) and Welding Health and Safety Resource Manual 
(AIHA, 1984/8); and Safe Welding and Cutting Practices in 
Refineries, Gasoline Plants and Petrochemical Plants (API, 
1988 Publ. 2009). Further accounts are given by Sanderson 
(1969,1977). A relevant standard is BS 1542:1982 Specifi¬ 
cation for Equipment for Eye, Face and Neck Protection 
Against Non-ionizing Radiations arising during Welding and 
Similar Operations. 

The principal method of welding considered here is 
electric arc welding, which may be done by manual, semi¬ 
automatic or fully automatic methods and may take place in 
a welding shop or on site. 

Electric arc welding uses power supplied by trans¬ 
formers or motor-generator sets which are supplied by the 
factory electrical system or by a self-contained engine- 
driven generator set. The circuit has three electrical con¬ 
nections: the welding lead, the welding return and the 
welding earth. 

During welding, the electrode and parts of the holder are 
electrically live and hot, the arc gives off high intensity 
visible light and both IR and UV radiation and fumes are 
evolved. It is necessary, therefore, to take suitable precau¬ 
tions so that the operation can be done safely. 

All the welding connections should be capable of carry¬ 
ing the full welding current. The welding lead should be 
robust and flexible enough for this purpose. The welding 
return, which is often the most neglected part, should 
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receive equal attention. It need not be as flexible and in a 
workshop may be a permanent installation. The welding 
earth should be as near the work as possible rather than at 
the source of supply, although this is not always practi¬ 
cable. All joints in these connections should be in good 
condition. Where it is unavoidable that the cables are laid 
over rough surfaces, there should be frequent inspection 
for defects. 

The electrode holder should be of sufficient size and 
should be insulated. Gloves should not be relied on to 
achieve insulation. If work is temporarily interrupted, the 
safest procedure is to render the holder electrically dead. 

In the United Kingdom, open circuit voltages up to 100 V 
are used for welding, but in certain situations, such 
as welding at height, in damp conditions or in vessels, 
this may be too high a voltage for safety. Low voltage dev¬ 
ices can be fitted which reduce the open circuit voltage by 
about half. These restore the full voltage when the electrode 
is touched to the work so that the arc can be struck. 
The voltage across the arc then drops as usual to a much 
lower value. 

Some portable welding sets, particularly semi-automatic 
gas shielded equipment, have hoses for gas and water sup¬ 
ply. The equipment should not be pulled around by the 
cables and the hoses. Both the latter should be regularly 
inspected. 

Proper protective clothing and equipment should be 
used for welding. This typically includes an apron or more 
extensive covering, leather gloves and a helmet which has 
suitable filter glass and which protects the back of the neck 
from other nearby arcs. Different filter glasses are required 
for different welding currents. A hand shield with filter 
glass may be used as an alternative for short periods. 

Screens may be used to protect other people from the 
rays of the arc. Booths used for welding should have a matt 
finish to reduce reflected light. This is an important pre¬ 
caution, especially with heavy current welding and high 
density arcs. 

There should be adequate ventilation, particularly when 
working in a confined space. One purpose of ventilation is 
to remove welding fumes. These are not particularly detri¬ 
mental to health, although some fumes such as those from 
galvanized materials are more noxious, but exposures 
should be minimized. Ventilation is also needed to remove 
inert gases such as nitrogen, argon and carbon dioxide. The 
two latter are heavier than air and thus tend to accumulate 
in confined spaces.This is made more hazardous by the fact 
that the gases cannot be smelled and that the welder may be 
out of sight. The use of air-supplied BA is necessary in 
some cases. 

In welding, care should be taken that hot metal does 
not damage equipment or set alight material, which may 
lead to a fire. 

Since electric arc welding involves electricity, the statu¬ 
tory notice for electrical equipment should be posted. 


25.14.4 Corrosive chemicals 

Corrosive chemicals present two kinds of hazard. One is 
corrosion of the plant leading to failure and hence injury. 
The other is injury from direct contact with the chemical, 
usually during some operations or maintenance activity 
Accounts of the problem are given in Safely and Man¬ 
agement by the ABCM (1964/3) and by Harford (1969) and 
E.L.M. Roberts (1977). 


Chemical corrosion is hazardous if it causes leaks in the 
plant or a failure in features such as staircases and hand¬ 
rails. It is necessary, therefore, to design both the plant and 
the buildings or structures to resist corrosion. 

The vessels and pipework of the plant itself should be 
designed so that they do not corrode excessively and so that 
the effects of corrosion such as leaks and blockages can be 
dealt with as easily as possible. 

The plant should also have a suitable layout. Open ves¬ 
sels containing corrosive materials and similar hazardous 
features should be fenced off. Parts which may leak, such as 
pipe flanges, should not be located over walkways and 
should, if necessary, have handrails around them. Floors 
and other surfaces should be sloped to let spillages drain or 
be washed away and to avoid allowing corrosion of features 
such as stairways by spilled materials. The layout of the 
plant for corrosive materials is discussed more fully in 
Chapter 10. 

There should be clear marking of equipment and pipe¬ 
work to minimize errors of identification. 

The plant should be maintained to a standard commen¬ 
surate with the corrosive hazard. Leakage of fluids at high 
pressure is particularly dangerous. 

There should be regular inspection of buildings or 
structures which may become corroded. Items which are 
vulnerable or which may fail with serious consequences 
include stairways, ladders and handrails, high level walk¬ 
ways, anchor points and lifting tackle. 

Adherence to systems such as the permit-to-work system 
and to procedures such as the procedures for line breaking 
or for sampling and the prompt repair of leakages and 
cleaning up of spillages are effective in reducing the 
hazard from direct contact. 

The plant should be provided with showers, eye foun¬ 
tains, eye washes and other neutralizers as applicable. 


25.14.5 Compressed air 

Compressed air is widely used in plants and in workshops, 
and presents hazards which are often not appreciated. 
Guidance is given in HS(G) 39 Compressed Air Safety (HSE, 
1990) and by Paterson (1969,1977). 

Compressed air is provided by air compressor systems 
and it is used in blow guns and pneumatic tools. Com¬ 
pressor systems are treated in Chapter 12 and pneumatic 
tools in Section 25.14.2. 

Use is often made of compressed air from a blow gun to 
blow swarf, filings and chippings from equipment or 
machinery. The air blast needed to effect such cleaning is 
usually quite sufficient to blow debris into, and cause injury 
to, the eye. 

Another practice is the use of compressed air to clean 
clothes or parts of the body such as the hair. This is a very 
hazardous procedure. Air may enter the bloodstream 
through cuts in the skin, possibly with fatal results, or it 
may cause injury to the eye, ears, nostrils or rectum. The 
pressure needed to burst the bowels is quite low, about 
4 psig. Moreover, it is emphasized that clothing offers 
no protection. 

Horseplay with compressed air is likewise extremely 
dangerous. Air lines put down the trousers or even up the 
rectum have caused fatal or near-fatal injury. 

The nature of the hazard from compressed air is such 
that it may affect not only the operator but also other 
people nearby. 
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Guidance on safer types of blow gun is given in HS(G) 39. 
This states that only two types are suitable, those with 
reduced jet velocity safety nozzles and those with air cur¬ 
tain safety nozzles. Whilst not foolproof, these types 
greatly reduce the risk. Types of blow gun nozzle which 
consist simply of a reduced orifice in direct line with the 
supply hose can be extremely dangerous and should not be 
used unless preceded by a tamper-proof pressure regulator. 

Compressed air may also cause dust deposits to rise and 
form a dust cloud, thus creating the risk of a dust explosion. 


25.14.6 Oxygen 

As already mentioned, an oxygen-enriched atmosphere 
greatly increases the flammability of many materials, 
including clothing. Oxygen leakage from the process or 
from oxygen cylinders can create a hazardous situation. A 
relevant code on this topic is NFPA 53M: 1990 Fire Hazards 
in Oxygen-Enriched Atmospheres. 

Moreover, for this reason, oxygen should not be added to 
an oxygen-deficient atmosphere, such as that in a vessel, in 
order to make it breathable. 

Oxygen is used in one type of self-contained breathing 
apparatus (SCBA). It should not be used in the alternative 
type which uses air. 

Ozone is a hazard at very low concentrations, due to 
its powerful oxidizing effect, the OES being 0.1 ppm. 
Guidance is given in EH 38 Ozone: Health Hazards and 
Precautionary Measures (HSE, 1983). 


25.14.7 Inert gas 

Atmospheres of inert gases which do not support respira¬ 
tion are common in the process industries, especially in 
vessels and confined spaces. 

Guidance on oxygen-deficient or inert atmospheres is 
given in Oxygen-Deficient Atmospheres by the Compressed 
Gas Association (CGA) (1983 SB-2) and Guidelines for Work 
in Inert Confined Spaces in the Petroleum Industry (API, 
1987 Publ. 2217A). 

Breathing equipment for use in oxygen-deficient atmos¬ 
pheres must have its own air supply. The air-purifying type 
is not suitable. 

It should be appreciated that an oxygen-deficient atmos¬ 
phere can occur outside the plant as well as inside it. 
Accidents have occurred in which a worker standing 
alongside a plant has been asphyxiated. The hazard is 
greatest if the plant has been opened up for some purpose 
such as repair. 


25.15 Personal Protective Equipment 

There are many tasks for which some form of PPE such as 
clothing or other equipment is necessary. 

Accounts of PPE are given in Chemical Protective Cloth¬ 
ing (CIA, 1986 RC7), Guidelines for Selection of Chemical 
Protective Clothing (Schweppe et al., ACGIH 1987/10), 
Chemical Protective Clothing Performance Index Book 
(Forsberg and Keith, ACGIH 1989/30) and Chemical Protec¬ 
tive Clothing (Johnson and Anderson, 1990 AIHA/18) and 
by H.H. Fawcett (1965b, 1982c), C.S. Nicholson (1969), 
K.R. Nicholson (1976), Riddell (1977), Crockford (1980), 
Parson (1988) and Preece (1988). Some British Standards 
and NFPA codes for protective clothing are given in 
Appendix 27. 


A significant problem associated with PPE is the setting 
of the standards which the equipment is required to meet. 
This is discussed by Berry (1969,1977). 

Some tasks which may require PPE are (1) working with 
corrosive chemicals, (2) working with toxic chemicals, 
(3) working with dusts, (4) working in hot environments, 
(5) working in noisy environments, (6) welding, (7) fire 
fighting and (8) rescue. 

Protective clothing should be regarded as a last line of 
defence. It is much preferable to remove or control the 
hazard, if this is practicable. 

For some tasks there are specific statutory requirements 
that protective clothing should be worn. In the United 
Kingdom, such requirements were rare until the 1940s but 
they are now quite numerous. Even where specific statutory 
requirements do not exist, the use of protective clothing 
is often necessary to comply with the HSWA1974, Section 2. 

It is the responsibility of the management to specify 
when protective clothing and equipment are required and 
to provide them. The worker then has the duty to use them. 
If he is reluctant to do so, management is responsible for 
enforcing their use. The Factory Inspectorate has used the 
prohibition notice procedure on an individual worker to 
make him wear protective clothing. 

According to the Act, Section 9, no charge may be levied 
on an employee for anything done or provided to meet a 
specific statutory requirement. 

Some types of protective clothing and equipment are 
(1) body clothing, (2) gloves, (3) helmets, (4) shoes, (5) eye 
protection and (6) ear protection. 

There is no point in providing protective clothing which 
is not used. In general, therefore, it is better to select prac¬ 
tical clothing which offers a good level of protection rather 
than theoretically safer but more cumbersome clothing. 
But each case should be considered on its merits. 

Protective clothing may be a general issue or may be 
issued to an individual. The latter policy is preferable 
wherever it is practicable. 

For some substances, specific guidance is available, as 
exemplified by EH 27 Acrylonitrile: Personal Protective 
Equipment (HSE, 1981). 


25.15.1 Eye protection 

The eye is a vulnerable organ and the avoidance of eye 
injury is particularly important. 

The Factories Act 1961, Section 65, states that eye pro¬ 
tection may be specified in certain processes, and eye pro¬ 
tection has been covered by the Protection of the Eyes 
Regulations 1974 which give a schedule of processes for 
which appropriate eye protection is required. These pro¬ 
cesses include various cleaning and blasting operations 
using shot, water jets and compressed air, various opera¬ 
tions involving particular tools, especially power tools, 
and various processes with hot metal or molten salt. Of 
particular relevance here is item 11, which reads: 

The operation, maintenance, dismantling or demolition 
of plant or any part of plant which contains or has con¬ 
tained acids, alkalis, dangerous corrosive substances, 
whether liquid or solid, or other substances which are 
similarly injurious to the eyes, and which has not been so 
prepared (by isolation, reduction of pressure, emptying 
or otherwise), treated or designed and constructed as to 
prevent any reasonably foreseeable risk of injury to the 
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eyes of any person engaged in any such work from any of 
the said contents. 


These regulations are now superseded by the Personal 
Protective Systems at Work Regulations 1992, which deal 
with all types of such protection, including eye protection. 
Requirements for eye protection are also contained in cer¬ 
tain other regulations. 

Guidance on eye protection is given in L25 Personal Pro¬ 
tective Equipment at Work (HSE, 1992) and Protection of the 
Eyes (CIA, 1990 RC22) and by Guelich (1965), Barker (1969, 
1977) and Wigglesworth (1974). 

Flying objects, chemicals and radiations are the main 
hazards to the eye in the process industries. Flying objects 
come most often from the use of hand or power tools. Che¬ 
mical splashes are typically caused by operations such as 
line breaking or sampling. Welding is the main source of 
injurious radiations. 

The hazard to the eye from power tools such as grinding 
wheels is understood and the use of eye protection is nor¬ 
mal. There is evidence that, as a result, injuries to the eye 
from hand tools are as frequent as those from power tools 
(Wigglesworth, 1974). 

The general principle that personal protection should be 
used only if hazard elimination and control are not suffi¬ 
cient applies with particular force to eye protection. The 
main types of eye protection are spectacles, goggles and 
face shields. 

Spectacles have either prescription or plain lenses, 
depending on whether the wearer does or does not wear 
glasses. The lenses are glass or plastic such as cellulose 
acetate, acrylic or polycarbonate material. For welding, fil¬ 
ter lenses are used. 

The most appropriate eye protection depends, in princi¬ 
ple, on the task. Aview which is not only widely held but is 
also supported by successful company systems is that the 
most effective approach is to issue safety spectacles to all 
personnel who need eye protection and to require their use. 
Although safety spectacles do not give total protection 
against all eye hazards, they do give perhaps 90% protec¬ 
tion and are more likely to be worn than some other devices. 
In other words, a protection which is worn is better than a 
superior protection which is not worn. The objective of the 
system based on safety spectacles is to achieve a situation 
where these are worn as naturally as prescription specta¬ 
cles. This means that the spectacles should be fitted indi¬ 
vidually. 

The alternative approaches are systems based on 
eye protection areas, supervisor’s orders or personal 
judgement. 

Whatever system is adopted, there are tasks for which 
eye protection other than safety spectacles is required. In 
particular, some tasks require protection not only for the 
eyes but also for the whole face. This applies especially to 
persons handling corrosive chemicals or doing welding. 

First aid for eye injuries is discussed in Section 25.17. 


25.16 Respiratory Protective Equipment 

There are a number of tasks in the process industries for 
which RPE, or breathing equipment, is necessary. 

Guidance on RPE is given in HS(G) 53 Respiratory Pro¬ 
tective Equipment (HSE, 1990) and also in Respiratory Pro¬ 
tection: A Manual and. Guideline (Colton, Birkner and 
Brosseau, 1991 AIHA/23) and by H.H. Fawcett (1965d, 


1982d), Cheffers (1969, 1977), Vanchuk (1978), Crockford 
(1980), Louhevaara et al. (1986), Stull (1987a,b), Parson 
(1988) and Preece (1988). Some special applications 
are dealt with in EH 41 Respiratory Equipment for Use 
against Asbestos (HSE, 1985) and EH 53 Respiratory Pro¬ 
tective Equipment for Use against Airborne Radioactivity 
(HSE, 1990). 

Relevant standards are BS 4275:1974 Recommendations 
for the Selection, Use and Maintenance of Respiratory Pro¬ 
tective Equipment and BS 4667: Part 3:1974 Fresh Air Hose 
and Compressed Air Line Breathing Apparatus. 


25.16.1 Regulatory requirements 

The Factories Act 1961, Section 20, and formerly the Che¬ 
mical Works Regulations 1922, Sections 6-8, require the 
use of approved BA for work in vessels and confined spaces 
where the atmosphere may contain dangerous fumes or 
may lack oxygen. There are requirements for the use of RPE 
in the CLAW Regulations 1980, the CAWR 1987 and the 
COSHH Regulations 1988. 

The use of RPE should not be a substitute for measures 
to maintain a breathable atmosphere. The regulations 
require that it be used only as a last line of defence in 
situations where it is not reasonably practicable to control 
exposure by other means. 

The regulations deal not only with the situations in 
which RPE should be worn, but also with its suitability and 
specification. In essence, they require that it be suitable for 
use, in that it has a sufficient air supply, that it fits well and 
that it is worn properly. The regulations also require that 
the RPE should meet a laboratory test specification. For an 
application requiring a high level of protection, this means 
that the HSE must approve the equipment itself and issue 
an Approval Certificate. For a lower level of protection, it is 
sufficient that the equipment meet a laboratory test 
approved by the HSE. 


25.16.2 Applications of RPE 

As just stated, RPE should be used only where it is the only 
reasonably practicable approach.There are four main types 
of situation in which it is used. These are (1) temporary 
situations, (2) short duration situations, (3) maintenance 
work and (4) escape. Temporary situations are those which 
arise in non-routine circumstances such, as commission¬ 
ing. An important particular case is for activities in emer¬ 
gencies. Short duration situations may arise routinely. It is 
not normal for a worker to wear RPE all the time, but he 
may wear it routinely for certain tasks, for example, sam¬ 
pling or vessel entry. 


25.16.3 Types of RPE 

There are two broad classes of RPE. One is the respirator, 
which takes in air from the workspace and filters or cleans 
it, removing noxious gases and vapours or dusts, before it 
is inhaled. It is not itself a source of air and is quite unsui¬ 
table for use where the bulk gas in the atmosphere is not 
breathable air but is an asphyxiating mixture. 

The second class is air-supplied equipment which does 
have a source of clean air. This class may itself be sub¬ 
divided into equipment to which air is supplied by a hose 
and BA. Air for equipment supplied by hose may be com¬ 
pressed air or from a fresh air source. BA may be of the 
compressed air line or self-contained type. 
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HS(G) 53 gives the classification of RPE shown in 
Table 25.6. It contains an appendix giving illustrated 
descriptions of the main types. 


25.16.4 Air-purifying respirators 

The disposable facepiece or the half-mask respirator fits 
over the nose but does not cover the whole face. A full face 
mask respirator does cover the whole face; the wartime ‘gas 
mask’ is of this type. A powered respirator has a fan to 
assist the flow of air through the filter. 

Each type of respirator is available in three performance 
classifications. Thus, half-mask and full face mask res¬ 
pirators may be of the PI, P2 or P3 specification. 

The filters available for respirators are of three types: 
(1) filters for particular gases and vapours only, (2) filters 
for dusts and other particulate materials and (3) combination 
filters for particular gases and vapours and for dusts and 
other particulates. 

As already stated, the air-purifying respirator differs 
fundamentally from the air-supplied RPE in that it is not 
itself a source of air and is therefore of little use unless 
breathable air can be drawn through it from the surround¬ 
ing atmosphere. It will not sustain breathing in an 
asphyxiating atmosphere. 

The concentration of oxygen in normal air is approxi¬ 
mately 21%. A person breathing air with an oxygen con¬ 
centration of less than about 16% may manage to do light 


Table 25.6 Types of respiratory protective equipment 
(after HSE, 1990HS(G)53) 


A Respirators 


A1 Filtering respirators 

Al.l Disposable filtering facepieces 
A1.2 Half-masks + filters 
A1.3 Full face masks+filters 
A2 Powered respirators 
A2.1 Half-masks 
A2.2 Full face masks 
A2.3 Visors 

A2.4 Hoods and helmets 
A2.5 Blouses (half-suits) 


B Air-supplied equipment 3 


B1 Compressed air-supplied equipment 
B2 Fresh air hose equipment 
B2.1 Unassisted 
B2.2 Manually assisted 
B2.3 Power assisted 
B3 Breathing apparatus 

B3.1 Compressed air line apparatus: demand type 
B3.2 Compressed air line apparatus: demand type 
with positive pressure 

B3.3 Self-contained breathing apparatus: open-circuit 
compressed air type 

B3.4 Self-contained breathing apparatus: 
closed-circuit compressed oxygen type 


a HS(G) 53 classifies simple compressed air-supplied equipment in its 
figure 3 in terms of (a) blouses, (b) hoods, helmets and visors, (c) half¬ 
masks, and (d) constant flow equipment, but classifies fresh air hose 
equipment in terms of the assistance to the air flow. 


work for a few minutes, but is likely to exhibit symptoms 
ranging from laboured breathing to unconsciousness or 
death. 

Respirators are produced for military, fire fighting and 
industrial uses. In the former case, they are commonly 
referred to as ‘gas masks’. A respirator intended for one 
type of application should not be used for another. 

The purifying element may work in several ways. 
Usually it adsorbs the gas. Alternatively, it may act as 
a catalyst: carbon monoxide is oxidized catalytically to 
carbon dioxide. 

The element is designed to protect against a particular 
chemical or group of chemicals and should not be used for 
other substances. There are a number of toxic gases for 
which a respirator is quite unsuitable. Respirators should 
not generally be used against gases which have a high 
odour threshold or no odour at all, since odour is the only 
warning of failure of the respirator. 

Some toxic gases are irritant to the face and for these full 
face protection should be used. 

It is essential that respirators be kept in good condition 
and not held too long in stock; otherwise, the air-purifying 
element and/or the facepiece may deteriorate. The purify¬ 
ing element should be replaced after use or after the elapse 
of a certain time according to a specified policy. 

It will be apparent that, although respirators are the 
most convenient form of RPE and have many legitimate 
applications, they also have some serious drawbacks and 
the circumstances in which they are used should be care¬ 
fully considered. 


25.16.5 Simple compressed air-supplied equipment 

Simple compressed air-supplied equipment is so called to 
distinguish it from compressed air line BA, described 
below. In simple compressed air-supplied equipment, the 
air is supplied through a hose from an independent source 
of compressed air. There are various types, utilizing a full 
face mask, half-mask, hood or blouse. 

The air supplied should meet the air quality standard 
described below. It should come from a high quality source 
which is capable of meeting the foreseeable needs of those 
requiring to use it. It should not be drawn for the com¬ 
pressed air supply intended for general works use. There 
should be suitable pressure reducing and pressure relief 
arrangements to protect the wearer from overpressure. 

The hose used should comply with BS 4667: Part 3:1974. 
The air line should be secured by a sturdy harness. Its route 
should be carefully chosen to keep it short, to allow escape 
and to avoid fouling and damage and it should be kept 
free of kinks. 

The simple compressed air-supplied equipment is not a 
BA and it should not be used in situations where there is 
immediate danger to life or health; in other words, it should 
not be used in circumstances where an unprotected person 
would be rapidly overcome. 

25.16.6 Fresh air hose equipment 

In fresh air hose equipment, the air is supplied through a 
hose from a fresh air source. There are various types, uti¬ 
lizing a full face mask, half-mask, hood or blouse. 

The requirements for air quality and for hose quality 
and routing for compressed air-supplied equipment apply 
also to fresh air hose equipment like simple compressed air- 
supplied equipment, fresh air hose equipment should not 
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be used in situations immediately dangerous to life 
or health. 

25.16.7 Breathing apparatus 

BA is of two types. One is compressed air line apparatus 
and the other is SCBA. BA, whether of the compressed air 
line or self-contained type, provides the highest degree of 
protection and is the only type suitable for use in an atmos¬ 
phere immediately dangerous to life or health. 

25.16.8 Compressed air line breathing apparatus 

Compressed air line apparatus is used with a full face mask 
or a full enclosing suit. There are two different methods of 
supplying the air. One is negative pressure demand in 
which the suction in the face mask generated by inhalation 
opens a demand valve allowing air into the mask. The other 
is positive pressure demand. With the former, the pressure 
inside the mask is slightly below atmospheric, whilst with 
the latter it is mainly above atmospheric, although it can 
fall below at high inhalation rates. 

25.16.9 Self-contained breathing apparatus 

SCBA comes in two types. One utilizes compressed air on 
an open-circuit system and the other compressed oxygen 
on a closed- circuit system. 

Open-circuit compressed air BA utilizes a full face mask 
to which air is supplied from compressed air cylinders car¬ 
ried on the wearer’s back. 

Closed-circuit compressed oxygen BA utilizes a full face 
mask to which oxygen is supplied from compressed oxygen 
cylinders carried on the wearer’s back. Exhaled air is pas¬ 
sed through a purifier which removes carbon dioxide and is 
recirculated. 

SCBA offers the wearer mobility but requires him to 
carry on his back a bulky load. 

Use of oxygen instead of air introduces certain problems. 
There may be physiological effects on the person breathing 
it. The flammability of the material is much increased in 
oxygen-enriched air. 

The length of time for which breathable air is supplied by 
SCBA is typically | and 1 h for both types, but the time for 
which an apparatus provides air depends on the breathing 
of the wearer. Heavy exertion may cause an apparatus to 
run out before the nominal period. 

Exhaustion of the air supply is hazardous and may cause 
asphyxia. An adequate safety margin of time should be 
allowed. There is normally a timer which can be set to give 
warning when the time has run out. 

SCBA is indispensable, but it is more complex to use 
than other types. Maintenance and training aspects are 
therefore especially important. 

25.16.10 Escape breathing apparatus 

A particular type of SCBA is that provided for escape. 
Such escape BA is intended for use over a short duration, 
typically less than 10 min, and should be used for this 
purpose only. 

25.16.11 Air quality standard 

There are air quality standards which apply to air supplied 
to any form of air-supplied RPE. Standards are given in BS 
4275: 1974 and in HS(G) 53, Appendix 4. The latter states 
that: the air supplied should contain not more than 5 ppm of 
carbon monoxide and 500 ppm of carbon dioxide, with other 
impurities kept to a minimum; the air should be comfortable, 


being in the temperature range 15-22°C and with relative 
humidity no higher than 85%; and the air flow capacity 
should be a minimum of 1201/min per person. 

25.16.12 Selection of RPE 

The procedure for the selection of a suitable RPE described 
in HS(G) 53 is a two-stage one. The first stage involves 
selection on the basis of the contaminant concentration and 
the second involves selection on the basis of work-related 
and personal factors. 

The guide gives a set of charts formulated in terms of the 
maximum multiple of the occupational exposure limit for 
which a particular RPE is suitable. For example, the suit¬ 
abilities of full face mask respirators for dusts and other 
particulates are shown as multiple values of about 5,13 and 
800 for filter classifications PI, P2 and P3, respectively. 
There are separate charts for respirators for gases and 
vapours, respirators for dusts and other particulates, and 
for simple compressed air-supplied and fresh air hose 
equipment. 

In selecting a respirator, account should be taken of the 
suitability of the filter for the particular gas or vapour and 
of the time until ‘breakthrough’, when the filter becomes 
ineffective. 

Work-related factors which need to be taken into account 
in the second stage of selection include the length of time 
for which the RPE is to be worn, the physical work rate, and 
the needs for mobility, visibility and communication. 

Personal factors include medical fitness, face shape and 
size, facial hair and the use of spectacles. Aworker should 
not be subjected to additional health risks by virtue of 
wearing an RPE. Persons with a respiratory disorder may 
find difficulty with respirators which rely on lung power to 
draw air through the filter. 

A face mask should achieve a good fit to the face. 
Procedures for checking face fit are given in HS(G) 53, 
Appendix 5. A beard or even stubble is liable to prevent a 
good fit to a face mask. Where there is immediate danger 
to life or health, a wearer with facial hair should be 
provided with an alternative type such as a hood, blouse or 
air-fed suit. 

For a wearer of spectacles, the side arms tend to interfere 
with the seal of a full face mask and an alternative should 
be used such as a hood or blouse. However, spectacles worn 
inside these may mist over or become dislodged. Spectacles 
should not be worn, therefore, where the wearer would be in 
immediate danger to health if he removed the equipment to 
adjust his glasses or would be unable to leave the con¬ 
taminated area at once in case of a problem. 

25.16.13 Procedures for using RPE 

There should be written procedures covering the situations 
in which RPE should be used and the actual use of the 
equipment, and the use should be integrated in the permit- 
to-work system. 

The use of RPE is liable to involve a degree of discomfort 
and the periods for which it is required to be worn should be 
set with this in mind. 

For a respirator, an estimate should be made of the dura¬ 
tion of the protection provided by the filter cartridge used. 

The equipment should be used in accordance with the 
manufacturer’s instructions. It should be checked before 
use and should not be used if it has not been cleaned or is 
defective. Equipment which relies on a face seal should be 
given a fit test on each occasion it is used. 
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Where the atmosphere in an area is immediately dan¬ 
gerous to life or health, only BA should be used. There 
should be continuous supervision of the wearer from out¬ 
side the area of hazard. Either the wearer should be kept 
under continuous observation or should be in communica¬ 
tion with the person supervising. Rescue equipment should 
be available. 

Where contamination of the RPE is likely to occur due to 
dust or other substances hazardous to health, facilities for 
decontamination should be provided at the exit from the 
contaminated area, so that the spread of such substances is 
minimized. 

25.16.14 Maintenance of RPE 

There should be a system of records for RPE covering its 
storage and maintenance. 

RPE for immediate use should be clean and free of 
defects before being put into storage and should be segre¬ 
gated from equipment awaiting maintenance. There should 
be an adequate stock of spares for items such as filters, head 
straps and batteries. 

The maintenance required includes cleaning, disinfec¬ 
tion, examination, repair and testing. HS(G) 53 gives 
details of good practice in maintenance and, in Appendix 6, 
of examination and testing. 

25.16.15 Training for RPE 

Persons involved in the use of RPE should be given suitable 
training. Management should have an appreciation of RPE, 
its applications, selection, use, maintenance and limita¬ 
tions. Wearers should be trained in the wearing and use of 
the equipment and its limitations. Maintenance personnel 
should receive training in the maintenance, repair and 
testing of the equipment. 

Training should be both theoretical and practical. The 
former should include: the hazards of contaminants and 
asphyxiation and the use of RPE to control exposure; the 
operation, performance and limitations of the equipment; 
the operating procedures and permit systems which gov¬ 
ern its use; the storage and maintenance of the equipment; 
and the factors which may reduce the protection which it 
provides. 

Practical training should cover: practice in inspecting 
the equipment before use; obtaining a good fit to the face, 
where applicable; putting the equipment on, wearing it and 
removing it; cleaning it after use; storing it; and replacing 
parts such as filters and cartridges. 

Training is particularly important for the types of RPE 
which are more complex and are used in atmospheres 
immediately dangerous to life or health such as SCBA. 

25.17 Rescue and First Aid 

Effective rescue and first aid arrangements are essential in 
the process industries. 

The Factories Act 1961, Section 61, and formerly theThe 
Chemical Works Regulations 1922, Sections 6-14, contain 
various provisions for rescue and first aid. 

The responsibility for the provision of these services 
should be clearly defined. There are some features, such as 
rescue equipment, which might, in principle, come under 
either the safety, the fire or the medical department. 

All rescue and first aid equipment should be located with 
care and properly maintained. Personnel should be fully 
trained in its use. 


25.17.1 Rescue 

An account of general rescue methods is given in The Light 
Rescue Handbook by the Ministry of Defence (MoD, 1989a) 
(the MoD Rescue Handbook). Rescue from confined spaces is 
treated in Recommendations to Facilitate Rescue from Con¬ 
fined Spaces (EEUA, 1962 Doc. 12). A further account is 
given by Walters (1977). 

There should be a rescue system which is capable of 
handling all reasonably foreseeable situations which may 
arise on a process plant. Frequently this function is per¬ 
formed by the works fire services, supplemented if neces¬ 
sary by the local authority fire services. 

Rescue apparatus such as stretchers should be provided 
at strategic points. 

Arrangements for rescue are also part of certain routine 
tasks such as entry into vessels or confined spaces and of 
some special operations such as hot tapping. 

The MoD Rescue Handbook is oriented to rescue tasks 
arising from both natural and man-made disasters such as 
earthquakes and hurricanes and road and rail crashes. 
It deals with: the aims of rescue; the organization of the 
rescue team; the responsibilities of the team leader; per¬ 
sonal and rescue equipment; searching for casualties; 
the five stages of rescue (surface casualties, lightly 
damaged buildings, likely survival points, selected debris 
removal and general debris clearance); recovery of the 
dead; recovery of valuables; building construction; lever¬ 
ing and jacking; strutting and shoring; repairs to utilities; 
rope and wire bonds; knots and lashings; and thermal 
image cameras. 

25.17.2 First aid 

Regulatory requirements for first aid are given in the 
Health and Safety (First Aid) Regulations 1981. COP 42 
First Aid at Work. Health and Safety (First Aid) Regula¬ 
tions 1981 (HSE, 1990) is the relevant ACOP. The relevant 
manual is the First Aid Manual of the St John Ambulance 
Association (1992), the official manual of the three leading 
organizations in the United Kingdom in this field, the 
St John Ambulance Association, the St Andrews Ambul¬ 
ance Association and the British Red Cross. First aid is also 
treated in First Aid Manualfor Chemical Accidents (Lefevre, 
1989 ACGIH/32) and Industrial First Aid: Reference and 
Training Manual (ACGIH, 1991/64) and by Lord Taylor 
(1967), Cameron (1969,1977) and McKenna and Hale (1981). 
Also relevant is Emergency Care for Hazardous Materials 
Exposure (Bronstein and Currance, 1988 ACGIH/19). 

The requirements of the First Aid Regulations are 
largely contained in Regulation 3. This requires an 
employer to make provisions for first aid by providing 
suitable equipment and facilities and by appointing suit¬ 
able persons. These appointed persons have to possess 
a first aid certificate from an organization recognized for 
this purpose by the HSE and receive refresher training at 
specified intervals. 

The ACOP deals under Regulation 3 with: different work 
activities needing different provisions; the applicability 
of, and provision of first aider cover for, situations when 
access to treatment is difficult, employees work away from 
employer’s premises or employees of more than one 
employer work together; provision for persons other than 
an employer’s own employees and for trainees; first aid 
equipment and facilities, first aid boxes and kits, travelling 
first aid kits, supplementary equipment, first aid room and 
equipment; suitable persons; criteria for deciding adequate 
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and appropriate provisions for first aiders; number of 
employees and appointed persons; the recruitment and 
selection of first aiders; appropriate training for first 
aiders; access to skilled advice; recording first aid treat¬ 
ment; approval of first aid courses and qualifications; 
refresher courses; first aid training where specific hazards 
exist; emergency first aid training; first aid trainers and 
examiners; first aid examinations; and training of first aid 
lay trainers. 

The number of first aiders required is specified in the 
ACOP as a minimum of 1 per 50 employees, a figure which 
applies to low risk situations. In hazardous situations, the 
employer should assess whether a higher proportion of 
first aiders is required. 

Subjects to be included in the syllabus for first aid 
training given in the ACOP include (1) resuscitation, 
(2) treatment and control of bleeding, (3) treatment of shock, 
(4) management of the unconscious casualty, (5) contents of 
first aid boxes and their use, (6) purchasing first aid sup¬ 
plies, (7) transport of casualties, (8) recognition of illness, 

(9) treatment of injuries to bones, muscles and joints, 

(10) treatment of minor injuries, (11) treatment of burns and 
scalds, (12) eye irritations, (13) poisons, (14) simple record 
keeping, (15) personal hygiene in treating wounds with 
reference to hepatitis B and human immunodeficiency 
virus (HIV) and (16) communication and delegation in an 
emergency. 

It is necessary to have a first aid system which can deal 
with the types of injury likely to he encountered on the 
plant, and where there are special hazards, first aiders 
should also receive additional training in respect of these. 
Normally first aiders in process plants are drawn from the 
process and maintenance personnel. 

First aid equipment which should be provided includes 
first aid boxes and resuscitation apparatus. There should 
also he showers and eye wash equipment to deal with inju¬ 
ries from corrosive chemicals. 

Showers are effective provided they are used, but there 
are certain practical problems. Measures need to be taken 
to ensure that the water supply is not frozen or turned off at 
a hand valve. And the reluctance of workers to make use of 
showerswhenfullyclothedmayhavetobeovercomeby drills. 

Guidance on first aid for eye injuries is given in Protec¬ 
tion of the Eyes (CIA, 1990 RC22). Eye wash equipment 
includes eye wash fountains, pre-packed sterile washes, 
and eye wash bottles. The last two are a last resort, and are 
not supported by the ACOP. 

Eye injuries from corrosive chemicals should preferably 
be dealt with by irrigation with water, using plenty of water 
and continuing for a long time. If sterile washes or eye wash 
bottles are used, they should contain an adequate volume. 
The CIA recommends, for example, for these two types of 
wash volumes of at least 500 ml and 11, respectively. 

Information is available also on first aid for particular 
chemicals. Materials safety data sheets may include such 


information. The CIA Codes of Practice for Chemicals with 
Major Hazards and related publications give guidance on 
first aid. 

In some situations there is a danger that the first aider 
may himself be injured, and precautions should be taken to 
ensure that this does not happen. Cases mentioned in the 
ACOP include casualties from electric shock, chemical 
burns and gassing. It states that in a case of electric shock, 
the current should be switched off before the casualty is 
touched or, if this cannot be done, the first aider should 
stand on dry insulating material and free the casualty from 
the electrical source with a wooden or plastic implement. 
Where the casualty has a chemical burn, the first aider 
should avoid contaminating himself with the chemical. 
With a casualty who has been gassed, the use of suitable 
protective equipment is advised. 


25.18 Notation 

Section 25.7 

Subsection 25.7.3 
A area of opening (m 2 ) 

Q volumetric air flow (m 3 /s) 

V inward superficial air velocity (m/s) 

Subsection 25.7.4 
A face area of hood (m 2 ) 

L length of hood (m) 

V capture velocity at distanced (m/s) 

V B superficial velocity at face of hood (m/s) 

W width of hood (m) 

X distance from hood (m) 

a, [} indices 

Subsection 25.7.7 

A f free area of discharged 2 ) 

C d coefficient of discharge 

K constant 

Q volumetric flow (m 3 /s) 

V x centre line velocity at distance X (m/s) 

X distance along centre line (m) 

Section 25.9 

A, B,C constants in the Antoine equation 
M molecular weight 

pi partial pressure of component! 

p° vapour pressure 

p°i vapour pressure of component! 

P total pressure 

T absolute temperature 

%i concentration of component i (mole fraction) 

p g density of gas 
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Accidents in chemical plants may harm the process, the 
personnel or both. Research on accidents is relevant, there¬ 
fore, both to accidents which result in property damage and 
those which cause personal injury. 

Accident research as a discipline tends to concern itself 
primarily with those accidents in which people are involved. 
It is primarily concerned, therefore, with injury to person¬ 
nel. But it does involve the study of the total accident situa¬ 
tion. Often it is a matter of chance whether this situation 
hazards the process or the people. Clearly accident research 
is closely related to work in other fields such as human fac¬ 
tors and, in particular, human error. 

Accounts of accident research include Occupational 
Accident Research (Kjellen, 1984), Information Processing 
and Human-Machine Interaction (Rasmussen, 1986), Indi¬ 
vidual Behavior in the Control of Danger (A.R. Hale and 
Glendon, 1987) and Human Error (Reason, 1990). Many of 
the classic papers in the field are given with commentary in 
the collection Accident Research, Methods and Approaches 
(Haddon, Suchman and Klein, 1964). 


Much work on the subject is concerned with areas 
which are not of prime interest here, such as accidents to 
children, accidents in the home and traffic accidents. 

In addition to work on personal accidents, it is convenient 
to deal here briefly with some principal research pro¬ 
grammes on, and test sites for, major hazards. 

Selected references on accident research are given in 
Table 26.1. 


26.1 General Considerations 

The development of accident research has shown that 
there are a number of serious pitfalls in the investigation of 
accidents. There is a tendency for a particular feature to be 
studied as a possible cause of accidents and there is 
frequently a bias in favour of this feature. Often no infor¬ 
mation is given on any work with a control group. This 
situation was contrasted with that in medical work in a 
classic paper by Gordon (1949), who suggested that the 
approach taken in epidemiology is applicable to accident 


Table 26.1 Selected references on accident research 


E. Farmer (1932); Gordon (1949); Paterson (1950); Kerr (1957); Sheldon (1960); Rapoport (1961); Suchman (1961); Haddon, 
Suchman and Klein (1964); Surry (1969a,b); A.R. Hale and Hale (1970,1972); Ramsey (1973); Carr (1975); Hendry (1975); 
Pickbourne (1975); HSE (1976d, 1993a); Smillie and Ayoub (1976); Verhaegen etal. (1976); Saari (1977); Kjellen (1984); Leplat 
(1985,1987); Pastorino etal. (1986); Rasmussen (1986); A.R. Hale and Glendon (1987); Beckers (1993) 

Classification of accidents 

HM Chief Inspector of Factories (annual); California State Department of Health (1953-57); ILO (1961); HSE (1983c, 1986c, 
1992b) 

Indices of harm 
Solomon and Alesch (1989) 

Accident models (seeTable 2.1) 

Accident proneness 

Greenwood and Woods (1919); E. Farmer and Chambers (1926,1939); Newbold (1926); E. Farmer (1932); Tillman and Hobbs 
(1949); Arbous andKerrich (1953); Suchman and Scherzer (1960); Cresswell and Froggatt (1963); L. Shaw and Sichel (1971); 
Schafer (1973a); Cazamian (1983) 

Judgement, risk-taking 

J. Cohen and Hansel (1956); J. Cohen, Dearnaley and Hansel (1956,1958); Fortenberry and Smith (1981) 

Risk homeostasis 

McKenna (1975,1985); Wilde (1978,1982a,b, 1985,1988); Shannon (1986); J.G.U. Adams (1988); Janssen andTenkink (1988) 

Human error (seeTable 14.10) 

Reason (1977,1979,1986,1987a,b, 1990,1991) 

Slips, trips and falls 

Sheldon (1960b); P.R. Davis (1983); Manning (1983); Buck and Coleman (1985);Tisserand (1985) 

Road accident research 

I.D. Brown (1990b); Reason etal. (1990); Rumar (1990);Wagenaar and Reason (1990) 

Major hazards research 

Brugger and Wilder (1975b); Buckley and Weiner (1978); Schneider, Lind and Parnarouskis (1980); Blackmore et al. (1981); 
Benson and Sinclair (1982); Bless (1982); Bello and Romano (1983a); Desteese and Rhoads (1983); Puttock, Colenbrander 
and Blackmore (1983); Johnston (1984,1985); McQuaid (1984b, 1991); Roebuck (1984 LPB 58); Anon. (1985bb); Koopman 
and Thompson (1986); Quarantelli, Dynes and Wenger (1986); Schnatz (1986); Anon. (1987h); Closner (1987b); Rubin 
(1987); Mellor etal. (1988);Thomson and von Zahn-UUman (1988); CEC (1989);Teja (1989); Carmody (1990a); Shortreed 
(1990); Institute for Systems Engineering and Informatics (1991a,b); Michot, Bigourd and Pineau (1992); Storey (1992); 
Cole and Wicks (1994) 

Research facilities: FPA (CFSD OR 5,1991CFSD OR 6); HSE (1983/14); Le Diraison and Bailleul (1986); Redman (1986a); 
British Gas (1988 Comm. 1381); Flood and Stephenson (1988); Groothuizen (1988); Clerehugh (1991); D.C. Bull and 
Strachan (1992); CMI(1992) 
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research. The epidemiology model, which is described 
below, has been widely used in work on accidents. 

26.2 Definition of Accidents 

The question of what actually constitutes an accident 
is worth at least brief consideration. It has been con¬ 
sidered bySuchman(1961),whodistinguishesthreedefining 
characteristics: (1) degree of expectedness, (2) degree of 
avoidability and (3) degree of intention. An event is 
more likely to be classed as an accident if it is unexpected, 
unavoidable and unintended. 

Other secondary characteristics are (1) degree of warn¬ 
ing, (2) duration of occurrence, (3) degree of negligence and 
(4) degree of misjudgement. Classification of an event as an 
accident is more probable if it gives little warning and hap¬ 
pens quickly and if there is a large element of negligence 
and misjudgement. 

It is suggested, however, by Suchman that as knowledge 
increases an event is more likely to be described in terms 
of its causal factors and less likely to be classified as an 
accident. 

26.3 Classification of Accidents 

Much work on accidents is concerned with accident statis¬ 
tics. These statistics are based on an accident classification 
of some kind. Accident classifications are therefore quite 
important. Unless a classification contains a particular 
category which is of interest, there is no means of retrieving 
information on it. 

There are a number of standard accident classifications. 
These include the classification used by the HSE in its 
annual Health and Safety Statistics, published in the 
Employment Gazette and that used in the annual Yearbook of 
Labour Statistics published by the International Labour 
Office. Relevant standards are the American National 
Standards Institute (ANSI) Z16 series. 

26.4 Causes of Accidents 

The main aim of accident research is to understand acci¬ 
dents so that they can be prevented. The attempt to under¬ 
stand an accident is often equated with the search for its 
cause. 

The concept of the cause of an accident, however, has 
become somewhat discredited. In accident investigation an 
administrative requirement to report a single cause usually 
does not do justice to the complexity of the situation. In 
accident research, there has been much criticism of work 
which isolates and overemphasizes a particular factor. 

It is more acceptable, therefore, to regard an accident as 
arising from a particular combination of factors rather than 
from a single cause. There is thus a tendency to consider 
relationships between variables rather than causes. 

While this approach is undoubtedly correct in general, 
the danger is that the accident situation then appears 
incredibly complex and the attempt to understand it, hope¬ 
less. The work of Rapoport (1961) provides something of an 
antidote to this. As he points out, the scientific technique of 
isolating the influence of one variable by controlled experi¬ 
mentation has been enormously fruitful and it should not be 
lightly abandoned. 

Rapoport distinguishes between specific and non¬ 
specific causes both in the field of disease and in that of 
accidents. Progress in control of disease has come both from 


specific factors (e.g. vitamins), and non-specific ones 
(e.g. public hygiene). 

Although much work on accidents is of a statistical 
nature, the value of the descriptive approach should not be 
underestimated.The work of Sheldon (1960) on accidents to 
old people involving falls has been cited as a classic in this 
regard. 

The investigation of accidents is dealt with in Chapter 27, 
which describes an illustration of an accident investigation 
given by Houston (1971). The investigation does not aim to 
find a single cause, but rather to discover the many factors 
which contribute to the accident. 

26.5 Accident Models 

Recognition of the complexity of accidents has led to the 
development of a number of accident models. A particular 
model of the accident situation is that derived from epi¬ 
demiology, following the work of Gordon (1949). The factors 
involved in an accident are defined as follows: (1) host, 
(2) agent and (3) environment. Although this model derives 
from medical work, it has been applied in many other fields. 

The main agent in an accident is usually some form of 
energy which inflicts physical damage. Accidents not 
accounted for by energy have as an agent a toxin, which is 
the other principal agent. 

A distinction is made between an agent and the vehicle for 
that agent. In an accident from a falling spanner, the agent is 
energy and the vehicle is the spanner. 

Another model of the accident situation, which draws 
both on Gordon’s model this one and on fault trees, is that 
developed by Houston (1971,1977). In this model a driving 
force is activated by a trigger so that through some form of 
contact process it causes injury or damage to a target. 

A second group of models is based on the concept that 
it is possible to define for a system a ‘normal operating 
state’, and hence deviations from that state, and that such 
deviations are associated with danger. The models of G.L. 
MacDonald (1972) and Kjellen (1983) exemplify this group. 
Figure 26.1 by Hale and Glendon illustrates MacDonald’s 
model. 

A third group of models is based on human information 
processing. They include those of Surry (1969b), A.R. Hale 
and Hale (1970) and A.R. Hale and Glendon (1987). The 
models of Surry and of Hale and Hale are both formulated in 
terms of perception, cognition and physiological response, 
or action. That of Surry is in two parts, the first dealing with 
the danger build-up and the second with the danger release 
or emergency. Each part has a similar structure, that for 
danger build-up being: 

Perception Warning of danger build-up? 

Perception of warning? 

Cognitive process Recognition of warning? 

Recognition of avoidance 
mode? 

Decision to attempt to avoid? 
Physiological response Ability to avoid? 

Another important model in this group is that of 
Rasmussen (1986) based on the distinction between 
knowledge-based, rule-based and skilled activity. As 
characterized by A.R. Hale and Glendon (1987), following 
Leplat (1985), these three levels of function correspond 
at the cognitive level to interpretation, identification and 



26/4 ACCIDENT RESEARCH 


Type of interventions DEVELOPMENT OF 

possible in order to PREDISPOSING CONDITIONS 

block or reverse process 

Pre-planning_ 

NORMAL OPERATION 

Controls _|_ 

DEPARTURE FROM NORMAL 
Hazard recognition_.j._ 

METASTABLE 

Recovery _j._ 

UNSTABLE 

Secondary safety__j_ 

DAMAGING EVENT 

Repair/rescue/reporting/absence_I_ 


Kjellen (1983) model 
- equivalent phases 


(Loss of control) 

) 

(Initial phase) 

I 

(Concluding phase) 

I 

(Injury phase) 

I 


(Harm ceases) 


Figure 26.1 Scheme illustrating accident models of MacDonald and Kjellen (A. R. Hale and Glendon, 1987 (reproduced 
by permission of Elsevier Science Publishers); after G.L. MacDonald (1972) and Kjellen (1983)) 


SYSTEM MODE 


LEVEL OF 
FUNCTIONING 


Knowledge 


Rules 


Skills 


Tests for yes Need * or Yes Responsibility 

danger known-► action —► accepted or —»- 

& carried out? recognized? allocated? 

i (Labelled 


Hazard seeking 
initiated? 


Programmed 
or insistent — 
danger signals? 


Response ^ 
- in programme — 
& carried out? 


SYSTEM 

BOUNDARY 


Danger 

unaffected 


Danger brought (or stays) 
under control 


I 


■(Increasing Static Decreasing) 
OBJECTIVE DANGER 


Figure 26.2 ‘Behaviour in the face of danger’ accident model (A. R. Hale and Glendon, 1987 (reproduced by permission 
of Elsevier Science Publishers)) 


observation/activation and in terms of behaviour to evalu¬ 
ation/task definition, procedure and execution, respec¬ 
tively. The Rasmussen model is described in more detail in 
Chapter 14. 


A model which draws on the foregoing models is the 
‘behaviour in the face of danger’ model of A.R. Hale and 
Glendon (1987) shown in Figure 26.2. This has the general 
structure of Rasmussen’s model but amplifies it using 
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stages drawn from Surry’s model. The model shows what 
has to occur if the danger is to be averted. In other words it is 
a prescriptive model. The text by Hale and Glendon is an 
exploration of the factors affecting this behaviour and of the 
extent to which the behaviour is likely to lead to a successful 
outcome. 

Other models, reviewed by Mill (1992), include those of 
the Institut National de Recherche sur la Securite (INRS) in 
France, the Occupational Accident Research Unit (OARU) 
in Sweden and the International Loss Control Institute 
(ILCI) in Georgia. The INRS model represents an accident 
as a deviation in the normal work situation and has a fault 
tree structure. The OARU model is intended for investiga¬ 
tion of single person injuries and represents the accident 
as a chain of deviations. The ILCI model is a five layer 
model which progresses from basic causes in management 
deficiencies and progresses through to the immediate 
causes. 

A number of other accident models, drawn mainly from 
the literature on process safety rather from than the 
psychological literature, are described in Chapter 2. 

The contribution of human factors, and in particular the 
work situation, to accidents is considered in Chapter 14. 

26.6 Accident Proneness Plan 

The idea that certain people are accident prone is quite 
an ancient one. In fact the accident prone individual is a 
classic comic character. Accident proneness as a concept in 
accident research, however, dates from the classic paper 
of Greenwood and Woods (1919) of the Industrial Fatigue 
(later Health) Research Board on accidents to industrial 
workers. The inter war period saw a number of publications 
on various aspects of accident proneness by investigators 
at the boards, in particular those by Newbold (1926) and 
E. Farmer and Chambers (1939). 

The fact that an individual has an above-average number 
of accidents does not in itself necessarily mean anything. It 
can be shown from the Poisson distribution that on the basis 
of chance alone there will be individuals who have quite 
large numbers of accidents. It is accidents that cannot be 
explained in this way which have given rise to the concept of 
accident proneness. 

The terminology associated with the problem of the vari¬ 
ation in accident rate between individuals tends to be a 
source of confusion. Accident repetition describes the 
observed fact that an individual has suffered an above- 
average number of accidents and that this is statistically 
significant. Accident proneness refers to a higher than 
average susceptibility to accidents which arises from 
psychological factors and tends to be permanent. Accident 
liability is a broader term describing an above-average 
accident rate which may be due to many factors, including 
work situations and personal stresses and which tends 
to be temporary. It is emphasized, however, that authors in 
this field have been criticized (e.g. Arbous and Kerrich, 
1953) for lack of definition and consistency in their use 
of terms. 

Greenwood and Woods (1919) showed that some indus¬ 
trial workers have more accidents than would be expected 
from chance alone, using the Poisson distribution. In other 
words, they established the fact of accident repetition.They 
offered as an explanation a theory of unequal liability to 
accidents, but did not themselves go so far as to suggest one 
of accident proneness. 


These findings were confirmed in further work by 
Newbold (1926), who suggested that there might be a 
psychological explanation for them. 

The phenomenon of accident repetition has subsequently 
been confirmed by numerous workers, many of whom have 
gone beyond the original investigators’ more conservative 
conclusions to develop a theory of accident proneness. 

An activity which has been studied particularly is driv¬ 
ing (e.g. E. Farmer and Chambers, 1939;Tillman and Hobbs, 
1949; Cresswell and Froggatt, 1963; L. Shaw and Sichel, 
1971). Farmer and Chambers investigated driver accidents 
and concluded that accident proneness was an established 
fact. Yet the only significant correlation obtained between 
accident rate and individual characteristics was in tests on 
aesthetokinetics rather than on personality. 

The concept of accident proneness has been severely 
criticized by Arbous and Kerrich (1953), while Suchman 
and Scherzer (1960) have given an evaluation of its status. 
The conclusion drawn is that accident proneness is difficult 
to establish, but that accident liability is a more accept¬ 
able concept. Accident liability may be connected with 
such factors as the work situation or stress, is usually tempo¬ 
rary and does not depend primarily on personality traits. 

The investigation of accident liability may in fact be a 
fruitful way of reducing accidents. An example is the work 
of Viteles at the Cleveland Railway Company (Arbous and 
Kerrich, 1953). He identified 50 individuals with accident 
liability and, taking a clinical approach, analysed the cases 
individually. The prime causes of accident liability which he 
identified are shown in Table 26.2. Various measures, 
including medical treatment, systematic instruction and 
increased supervision, were taken. As a result, the accident 
rate was almost halved. This approach requires, of course, a 
great deal of effort. In a further review, Cazamian (1983) 
takes it as established that certain individuals do have 
repeated accidents, but treats this as an acquired suscep¬ 
tibility rather than an inherent predisposition. Individuals 
may enter and leave the group of accident repeaters. Some 
factors canbe identified which increase the susceptibility to 
repetition. Accidents are more common among young 


Table 26.2 Prime causes of accident liability in an 
industrial investigation after Viteles 


Prime cause 

Percentage 
of cases 

Faulty attitude 

14 

Failure to recognize potential hazard 

12 

Faulty judgement of speed and distance 

12 

Impulsiveness 

10 

Irresponsibility 

8 

Failure to keep attention constant 

8 

Nervousness and fear 

6 

Defective vision 

4 

Organic disease 

4 

Slow reaction 

4 

High blood pressure 

2 

Senility 

2 

Worry and depression 

2 

Fatigability 

2 

Improper distribution of attention 

2 

Inexperience 

2 

Miscellaneous 

6 
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workers than mature adults, among those who lack training 
and experience and among those who are ill. 

26.7 Human Error 

Work on the psychology of human error is exemplified hy 
theworkof Reason, described inHumanError(Reason, 1990) 
and in other work (Reason, 1977,1979,1986,1987a,b, 1991). 
One aspect of this work is the recognition that many 
accidents occur due to absent-mindedness and that, whilst in 
the vast majority of cases the consequences of such absent- 
mindedness are not serious, in a proportion of cases they are. 

26.8 Risk-taking 

Some accidents occur because people consciously take 
risks. In a given case the risk is generally judged to be small, 
but it is a finite risk nevertheless, and occasionally such 
behaviour results in an accident. 

26.8.1 Risk homoeostasis definition? Maintaining an 
acceptable equilibrium 

It is sometimes argued, particularly in relation to activities 
such as car driving, that there is a certain level of risk which 
people accept and that if physical measures are taken to 
reduce this risk, such as improved traffic engineering or 
vehicle crash resistance, the effect of these measures is 
cancelled by changes in individual behaviour so that the end 
result is that the risk remains the same. 

A formal theory of risk homoeostasis has been given by 
Wilde (1978,1982a,b, 1985,1988). According to this theory, 
the loss due to road accidents per unit time is the output of a 
closed loop process in which the set-point is the target level 
of risk. 

The concept of risk homoeostasis does not imply that all 
measures to improve road safety are doomed to failure. 
A distinction is drawn between physical and motivational 
measures. The latter act to influence the target level of risk 
and can indeed be effective. The theory is pessimistic, how¬ 
ever, on the effectiveness of non-motivational measures. 

A critique of the theory of risk homoeostasis has been 
given by McKenna (1975,1985). 

The measure of effectiveness in this debate is important. 
It is common ground that physical measures can reduce the 
accident rate per unit distance covered. It is argued, how¬ 
ever, by Wilde that they have little effect in reducing the 
accident rate per unit driving time. 

26.8.2 Risk judgement 

Another type of situation which can also lead to accidents 
occurs when there is misjudgement of the risk. In relation to 
such accidents, a distinction has been drawn by J. Cohen, 
Dearnaley and Hansel (1956) between judgement and capa¬ 
bility. They investigated the ability of bus drivers to drive a 
bus through a narrow opening. The work distinguished 
between lack of success due to misjudgement of the width of 
the opening and inability to drive the bus through it. In 
some cases, a generally capable driver would try to drive 
through an opening which was narrower than the bus itself. 
Obviously these two causes of failure have different impli¬ 
cations for training. 

An undesired outcome may occur either because the 
actions do not go as planned or because the plan is inad¬ 
equate. It is with the first of these causes, ‘actions-not-as- 
planned’, that the work is concerned. 


Reason conducted an experiment in which 35 subjects 
kept a diary of their actions-not-as-planned over a 2-week 
period.The classification of these errors and the proportion 
of errors in each main class are shown in Section A of 
Table 26.3, while Section B gives specific examples. 

The classification is based on a computer program model 
of human activity. The discrimination errors are failures in 
classification of the inputs. The program assembly errors 
involve use of inappropriate subroutines. The test failures 
refer to failure to check on the progress of a sequence or to 
selection of an incorrect branch. The subroutine failures 
involve insertion into, omission from or mis-ordering 
within a sequence. The storage failures are forgetting or 
mis-recalling plans and actions. 

Reason outlines a number of concepts which may help to 
explain the results obtained. Skilled performance involves 
switching between open and closed loop modes of control. 
Typically a large part of a task or series of tasks may be 
carried out under open loop control, but it is necessary to 
revert to closed loop control at certain critical decision 
points. A failure to make the necessary switch at the 
appropriate moment is likely to result in an error. 

In some cases, a motor programme sequence shares a 
common subsequence with another sequence, but there is a 
critical decision point where it diverges from this second 
sequence. This is a situation particularly likely to lead to 

Some motor programmes appear to acquire a strength 
which causes them to be activated contrary to the current 
plan. This is likely to apply particularly to a programme 
which has been used frequently or recently. 

Reason goes on to propose certain hypotheses concern¬ 
ing such errors. He suggests that test failures occur when a 
critical decision point is reached while still under open loop 
control and where the strengths of the two motor pro¬ 
grammes are markedly different, and that if an error occurs 
it is likely to involve the unintended activation of the stron¬ 
gest motor programme beyond the node. 

Another hypothesis is that storage failures in the execu¬ 
tion of a sequence are associated with some counting 
mechanism in the motor programme which checks off the 
actions as they are performed. It appears that on occasion 
this counter is unable to distinguish between planned 
actions and others which are similar in duration and degree 
of activity, so that if an interruption occurs the programme 
resumes at the wrong point. 

In tasks such as maintenance, a large proportion of the 
errors involve omission. The practical application of the 
work described points to the provision of memory aids 
which assist the worker to remember which stage of the 
sequence he has reached. 

This work leads to the distinction made by Reason (1990) 
between slips, lapses and mistakes. In essence, a slip is 
either an error in implementing a plan or an unintended 
action, a lapse is an error in which the intended course of 
action is not executed due to a failure of memory, and a 
mistake is an error in establishing the correct course of 
action. 


26.9 Social Factors 

The effect of physical features of the environment on acci¬ 
dents is readily appreciated. Less obvious, but often as 
important, is that of its social aspects. Social factors are 
effective in reducing accidents (1) if the socially approved 
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Table 26.3 Classification and examples of actions-not-as-planned (after Reason, 1979) 


A Proportion of errors in each class 

1. Discrimination failures (11%) 

1.1 Perceptual confusions (objects confused are physically similar) 

1.2 Functional confusions (objects confused are functionally similar) 

1.3 Spatial confusions (objects confused are close together) 

1.4 Temporal confusions (time is misperceived and inappropriate actions initiated) 

2. Program assembly failures (5 %) 

2.1 Behavioural spoonerisms (program elements are reversed) 

2.2 Confusions between currently active programs 

2.3 Confusions between ongoing and stored program 

3. Test failures (20%) 

3.1 Stop-rule overshoots (actions proceed beyond intended end-point) 

3.2 Stop-rule undershoots (actions cease before their intended end-point) 

3.3 Branching errors (initial sequence of actions is common to two different routines and wrong branch is taken) 

3.4 Multiple side-tracking (subject is apparently diverted from original intention by series of minor side-steps) 

4. Subroutine failures (18%) 

4.1 Insertions (unwanted actions are added to a sequence) 

4.2 Omissions (necessary actions are left out of a sequence) 

4.3 Mis-ordering (actions carried out are correct but in wrong order) 

5. Storage failures (40 %) 

5.1 Forgetting previous actions 

5.2 Forgetting discrete items in plan 

5.3 Reverting to earlier plans 

5.4 Forgetting the substance of plan 

B Examples of actions -not- as -planned 

1.1 ‘I put my shaving cream on my toothbrush’ 

1.2 There were two objects before me on the draining board: a cloth and a container of cleaning fluid which I normally 
keep in the bathroom but had brought into the kitchen to use. I decided to return the cleaning fluid to its place in 
the bathroom, but set off with the cloth in my hand instead’ 

1.3 ‘I turned on my electric fire instead of my transistor radio which was on the floor near it’ 

1.4 ‘When I got up on Monday morning, I found myself putting on Sunday’s sweater and jeans instead of my working 
clothes’ 

2.1 ‘I unwrapped a sweet, put the paper in my mouth and threw the sweet in the waste paper basket’ 

2.2 ‘My office phone rang. I picked up the receiver and bellowed “Come in” at it’ 

2.3 ‘I fetched a box of matches to light the electric fire’ 

3.1 ‘I brought the milk in from the front step to make myself a cup of tea. I had put the cup out previously. But instead of 
putting the milk into the cup, I put the bottle in the fridge’ 

3.2 ‘I was just about to step into the bath when I discovered that I still had on my underclothes’ 

3.3 ‘I intended to drive to Place X, but then I “woke up” to find that I was on the road to Place Y’ 

3.4 ‘I went upstairs to sort out and fetch down the dirty washing. I came down without the washing having tidied the 
bathroom instead. I went upstairs again to collect the washing, but somehow got side-tracked into cleaning the bathroom. 
I forgot all about the washing until I returned to the kitchen where the washing machine was pulled out in readiness’ 

4.1 ‘I came out of the sitting room in the daytime and flicked on the light as I left the room’ 

4.2 ‘I filled my electric kettle with water, plugged the lead into the back of the kettle and switched on the wall socket. 
When the kettle failed to boil I discovered I had not inserted the plug into the wall socket’ 

4.3 ‘Sitting in the car about to leave work, I realized I had put the car into gear and released the handbrake without first 
starting the engine’ 

5.1 ‘I started to walk home and had covered most of the distance when I remembered I had set out by car’ 

5.2 ‘I had intended to post a letter while I was out shopping but when I got home I found I still had the letter in my pocket’ 

5.3 ‘I decided to make some pancakes for tea. Then I remembered we didn’t have any lemons so I decided not to bother. 
Five minutes later I started getting together the ingredients for pancakes, having completely forgotten my change 
of mind’ 

5.4 ‘I went upstairs to the bedroom, but when I got there I couldn’t remember what I came for’ 


behaviour minimizes accidents and (2) if individuals 
adhere to that behaviour. 

The effect of individual deviation from the approved 
standard has been considered by Paterson (1950). The basic 
argument may be illustrated by reference to Figure 26.3, 
which shows on the horizontal axis the strength of group 


conditioning, decreasing away from the origin, and on the 
vertical axis the number of people who exhibit that degree 
of conditioning. It is assumed that the optimal type of 
behaviour which minimizes accidents corresponds to that 
given by the highest degree of group conditioning. Curve A 
represents a highly disciplined society with a low mean. The 
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Figure 26.3 Effect of social factors in behaviour affecting 
accident rates 


discipline may be due to the harshness of nature or to 
the social and political system. Curve B corresponds to a 
less disciplined society with a high mean. Also shown in 
the figure is the social threshold, which is the point at which 
the deviation from optimal behaviour results in marked 
increase in accidents. If the socially approved behaviour is 
optimal in reducing accidents, then clearly there will be more 
accidents in a society where there is greater individual 
deviation. 

It cannot be assumed, however, that social pressures 
always tend to reduce accidents. On the contrary, the 
expectations of a small peer group may well run in the 
opposite direction and it is often this influence which is 
strongest. Thus the behaviour laid down in company safety 
procedures may be assumed to reduce accidents. But certain 
types of peer group pressure may increase them. Examples 
are neglect of permit-to-work procedures, failure to wear 
protective clothing and horseplay among apprentices. 

26.10 Accident Prevention 

Measures to prevent energy causing injury or damage may 
be based on the following four principles: (1) reduction of 
the energy available, (2) modification of the release of the 
energy, (3) separation by distance and (4) separation by a 
barrier. 

Accident models such as that of Houston (1971, 1977) 
are useful in analysing potential accident situations and 
identifying appropriate preventive measures. 

Accident prevention measures are not infrequently 
brought in without adequate understanding of the problem 
and without sufficient evaluation. Such measures are likely 
to be relatively ineffective. There is a tendency to believe 
that they must be better than nothing. But often they are an 
obstacle to progress, because they give the impression that 
something is being done about the problem. 

This contrasts with the very thorough trials which are 
made on the effectiveness of drugs in countering disease. 
Proper evaluation is necessary for proposed accident pre¬ 
vention measures also. This again is in line with the more 
quantitative approach which characterizes loss prevention. 
The practical application of this principle is seen in the work 
of the Road Research Laboratory on the evaluation of road 
safety. 


26.11 Safety Training 

Most prescriptions for the prevention of accidents lay much 
emphasis on training, and rightly so. It is necessary, how¬ 
ever, that the training be effective. 

A study of the effectiveness of safety training by 
A.R. Hale (1984) found relatively little previous work on the 
topic.The essential finding of the study is that, unless effort 
is invested in analysing the problem and defining the 
training requirements, the training is liable to be ineffective 
and to get the activity a bad name. The author quotes the 
Robens Report (Robens, 1972) which states: ‘Most people are 
agreed that safety training is of vital importance. There is 
no unanimity about what in practice should follow from that 
proposition’. 

The requirements for training found in the legislation by 
the author are patchy, with power presses governed by a 
detailed training schedule whilst injection moulding 
machines have no specific provision. There are require¬ 
ments of competence for drivers of coal mine face conveyors, 
but not for those of fork lift trucks. 


26.12 Major Hazards Research 

Research on major hazards is described throughout this 
book, particularly in Chapters 15-17 on emission and dis¬ 
persion, fire and explosion. The treatment here is confined 
to an indication of some of the major experimental pro¬ 
grammes and the sites where they have been conducted. 

Large-scale experimental trials on dense gas dispersion 
have been conducted in the United Kingdom at Porton Down 
(Picknett, 1981a-c), Maplin Sands (Puttock, Colenbrander 
and Blackmore, 1983) and Thorney Island (A.G. Johnston, 
1984, 1985; McQuaid, 1984b) and in the United States at 
China Lake, California (Ermak et al„ 1983), and at the 
NevadaTest Site (Koopman and Thompson, 1986). 

Large-scale trials on fire phenomena have been per¬ 
formed at the Health and Safety Executive’s (HSE) Explo¬ 
sion and Flame Laboratory at Buxton. This includes work 
on pool fires, fireballs and engulfing fires (A.F. Roberts, 
1987; McQuaid, 1991). 

Other work on fires has been done at Shell sites and at the 
British Gas sites at Fauld and at Spadeadam in cooperative 
projects involving a number of companies, including in 
particular trials on jet flames and on fire insulation. The 
Maplin Sands work on dense gas dispersion included trials 
on vapour cloud fires. 

Explosion experiments on a large scale include those on 
condensed phase explosives such TNT and other military 
explosives at the Aberdeen Proving Ground (W.E. Baker, 
1973) and other military sites. Buildings and equipment 
have been subjected to condensed phase explosions in 
Nevada (Glasstone and Dolan, 1980). Large-scale work on 
vapour cloud explosions has been done in the Netherlands 
atTNO (vanWingerden, 1989a). 

In addition to the HSE laboratories just described other 
European centres include the Shell Thornton Research 
Centre (TRC) (D.C. Bull and Strachan (1992), the British Gas 
laboratories at Solihull, Loughborough and Killingworth 
and sites at Fauld and Spadeadam (Clerehugh, 1991), the 
Prinz Maurits Laboratory of TNO in the Netherlands 
(Groothuizen,1988)andtheChristianMichelsenInstituteat 
Norway (CMI, 1992). UK centres specializing in fire include 
the Fire Research Station at Borehamwood and the Depart¬ 
ment of Fire Safety Engineering at Edinburgh University. 
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The European Community has had a wide-ranging 
programme of work on major hazards, particularly dense 
gas dispersion and vapour cloud explosions. This work is 
described by the Commission of the European Commu¬ 
nities (CEC, 1989) and by Storey (1992). The commission 
maintains the Joint Research Centre QRC) at Ispra, Italy, 
which includes the European Laboratory for Structural 
Assessment (ELSA). 

In the United States, research in many areas of process 
safety is conducted at the Mary Kay O’Connor Process 
Safety Center at Texas A&M University In 2004, the 


Center had active research projects on Abnormal Situa¬ 
tion Management, Aerosol Experiments and Modeling, 
Flammability Measurements and Modeling, Incident 
Database (Development, Analysis and Causation), Inher¬ 
ently Safer Design, Chemical Safety Assessment, Quanti¬ 
tative Risk Assessment, Reactive Chemicals (Thermal 
Analysis, Calorimetric Measurements, and Modeling) and 
Safety Performance Measurement Systems and Safety 
Metrics. 

The work of many of these research centres is described in 
other chapters, mainly in Chapters 15-17. 
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27/2 INFORMATION FEEDBACK 


The feedback of information about incidents, accidents 
and failures, and about the performance of preventive 
measures, is a crucial aspect of the management system. 

Some aspects of information feedback are considered 
here. Others are dealt with in other chapters, in particular 
Chapters 6,8, 21 and 28. 

Selected references on information feedback are given in 
Table 27.1. 

Table 27.1 Selected references on information feedback 
(see also Tables 1.1, 6.1 and 28.1) 


Guelich (1956); Heinrich (1959); Simonds and Grimaldi 
(1963); ABCM (1964/3); H.H. Fawcett and Wood (1965, 
1982); McElroy (1965); Gilmore (1967,1970); BCISC 
(1969/9); Handley (1969,1977); Arscott (1975); Byrne 
(1975); Hearfield (1975); Kletz (1975a, 1976a, 1979c,h); 
Wellman (1975); Dawes and Davies (1977); Pitts and Gowan 
(1977); R.W. Henry (1979); NFPA (1990 NFPA 901,902M); 
Hancock (1992 LPB105) 

Incident reporting, total loss control 
BSC (n.d./6,7); NRC (Appendix 28 Incident Reporting)-, 
Heinrich (1959); Bird and Germain (1966); J.A. Fletcher and 
Douglas (1971); Webster (1974,1976); Dukes (1975); 
Hearfield (1975); Laitinen (1982); Lewis (1989 LPB 87); 

I.D. Brown (1990a); HSE (1992b); Brazier (1994) 

Incident investigation and analysis 
NRC (Appendix 28 Incident Investigation)', SMRE (Incident 
Investigation 1); Guelich (1956); ABCM (1964/3); Bulkley 
(1967); Lynch (1967,1973); Spiegelman (1969); Webb (1969); 
Siebert (1970); Houston (1971); W.G. Johnson (1973a,b, 1975, 
1977,1980); Benner (1975a); D.G. King (1975); R.J. Parker 
(1975); A.R. Baker (1976); Gugan (1976); Nertney (1976, 
1978); Strehlow and Baker (1976); WE. Baker, Westine and 
Cox (1977); R. King and Taylor (1977); Leplat (1978a); 
Bruun,Taylor and Rasmussen (1979); Kletz (1979g,h, 
1982a,b, 1983a, 1984a, 1986a, 1988h); Beyers (1980); HSE 
(1980 EMI, EMS); Robinson (1980 LPB 33); Ursenbach 
(1980,1983); Burgoyne (1981/82,1982); Sheehy (1981); 

W.E. Baker (1982); Feggetter (1982); Pimble and O’Toole 
(1982); Searson (1982);Wiestling (1982); Zilka (1982); 
Boissieras (1983); Kjellen (1983); Mollerhoj and Robert 
(1983); van der Schaaf and Steunenberg (1983); Suokas and 
Rouhiainen (1984); Benner (1985); Vaija, Jarvelainen and 
Dohnal (1985,1986a); Anon. (1986 LPB 72, p. 21); S.J. Brown 
(1987); Duguid (1987); Hendrick and Benner (1987 
ACGIH/14); Leplat (1987); Suokas (1987); Ferry (1988); 
Mosleh etal. (1988); van der Schaaf (1988); I.D. Brown 
(1990a); Dowell (1990); ILCI (1990); S.E. Anderson and 
Skloss (1991); Svenson (1991a,b); Livingston and Green 
(1992); Philley (1992b); Nishikawa (1993) 

Fire, explosion investigation: FPA (CFSD AR series, AR1, 
AR 5); J. Kennedy (1962); Huron (1963); Bulkley (1967); 
Kirk (1969); VJ. Clancey (1972b, 1981); W.B. Howard (1972); 
Sadee (1973a); Anon. (1975 LPB 2, p. 15); R.J. Parker (1975); 
AR. Baker (1976); FRS (1976 Fire Res. Note 1054); Guenther 
etal. (1976); Gugan (1976); Levinson (1977); Ettling (1978); 
Guenther, Goodwin and Brininger (1978); Dennett (1980); 
Yallop (1980); Beland (1981,1982); Craven (1981,1982); 
McIntyre (1981); Willis (1981); WE. Baker (1982); Delplace 
and Vos (1983); D.A. Gray, Drysdale and Lewis (1983); 

R.J. Harris (1983); G.D. Davis (1987); Zeeuwen (1988); 
Cullen (1990);Taillet (1991); I.F. Thomas (1993,1995); 

I.F. Thomas and Gugan (1993) 


Transport investigations: NTSB (Annual reports); 
Lasseigne (1984) 

Warnings, near misses 

NRC (Appendix 28); Pitts and Gowan (1977); Laitinen 
(1982,1984); Lees (1982b, 1983b, 1985); N. Carter and 
Menckel (1985); Anon. (1989 LPB 85, p. 7); van Kernel, 
Connelly and Haas (1990); A.R. Hale etal. (1991); Ives (1991); 
D.A. Lucas (1991); Reason (1991); van der Schaaf, Lucas and 
Hale (1991); van der Schaaf (1991a-c) 

Safety effectiveness, safety measurement 
HSE (OP 9,1986 PML10,1992 Oil Industry 3); Wynn (1950); 
Grimaldi (1960,1965,1970); Pollina (1962);Tarrants (1965, 
1970,1973); Rockwell and Bhise (1970); Anon. (1975 LPB 2, 
p. 12); Hooper (1975); S. Dawson, Poynter and Stevens 
(1982); Pastorini etal. (1986); Kaufman (1988); Gruhn 
(1993); Marcombe, Krause and Finley (1993) 

Governmental investigation, disaster inquiries 

Mecklenburgh (1977a); Davidson (1984); Crossland (1991); 
Fennell (1991); Wells (1991); I.F. Thomas (1993); I.F. Thomas 
and Gugan (1993); Lees (1994b) 

Particular inquiries (see also Appendices 1—3, 5,6, 
16,19, 21, 22) 

R.J. Adams (1967); H. Griffiths, Pugsley and Saunders 
(1968); F. Morton (1970); Merrison (1971); R.J. Parker (1975); 
Ministry of Social Affairs (1976); Orsini (1977,1980); 
Gjerde (1977-78); Costello (1979); Shooter (1980); Naesheim 
(1981); Hickman (1984); Layfield (1987); Sheen (1987); 

Steel (1987); Fennell (1988); O’Riordan, Kemp and Purdue 
(1988); Hidden (1989); Barnes (1990); Cullen (1990); 
Donaldson (1994) 

Information retrieval, organizational memory 

Kletz (1980g, 1982 J, 1993c); A.F. Roberts (1980); 

R.W. Fawcett and Kletz (1982); Hancock (1989,1992); 

K. Rasmussen and Gow (1992) 

Information exchange, publication 

Kletz (1985g,q); Resen (1985b); Glass and Rivard (1987) 

HSE information services, HSELINE 

Pantry (1986,1987 LPB 78); HSE (1990 HSEL1); Lewis 
(1993 LPB 114) 

Education 

Imperial College (1975); Butler, Ball and Pearson (1978); 
Beveridge (1979 LPB 27); Lees (1980b); Lihou (1981 LPB 
40); D.B. Nelson (1982); HSC (1983); Mewis (1984); Anon. 
(1985f); Anon. (1985 LPB 62, p. 13);Talty (1986); Kaufman 
(1987); Kletz (19881,1990a); Levitzky (1988); Crowl and 
Louvar (1989); Nolan (1989); Craweley (1991 LPB 102); 

V.C. Marshall (1991c); Pitt etal. (1991); Crawley and Scott 
(1992); Hazards Forum (1992); Lemkowitz (1992a,b); 

R.B. Ward (1993b,c); Louvar and Kubias (1994) 

CCPS: Anon. (1986c) 

IChemE: Anon. (1988i,j,q) 


27.1 The Learning Process 

It is clearly essential that the industry should learn from its 
mistakes so that as far as possible it avoids repeating them. 

This need to learn has long been recognized and is dealt 
with by a system of accident reporting and investigation. 
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On the basis of this information, accident statistics are 
compiled and an attempt is made to determine the trend in 
safety performance. Case histories are obtained and gen¬ 
eral lessons are derived. These lessons give rise to changes 
of practice, which are often embodied in standards and 
codes of practice or training programmes. These results are 
then publicized. 

This system is essentially similar at company and at 
national level. There are statutory requirements for the 
reporting and investigation of accidents. Company require¬ 
ments may be confined to these or may include other inci¬ 
dents. Accident statistics, safety performance trends and 
case histories are produced, changes in practice are made 
and publicity is given to these at both company and 
national level. 

The effectiveness of this approach depends very much 
on the way in which it is implemented. There are wide 
differences, for example, in the quality of incident inves¬ 
tigation and consequently in the benefit derived from it. 
There is also considerable variation in the extent to which 
the real lessons of case histories are appreciated and 
applied. 

There are also other weaknesses in most systems for 
learning from incidents. One of the most fundamental has 
to do with the nature of the accident process itself. An 
accident normally occurs only when a number of conditions 
are fulfilled. If some of these conditions are not met, there 
may be instead an incident or ‘near miss’. In general, the 
ratio of near misses to accidents is several orders of mag¬ 
nitude. This is seen most clearly in civil aviation, which is 
one of the few fields where there is a requirement to report 
near misses. Thus, in effect, a system based on reporting 
only of accidents reduces drastically the amount of infor¬ 
mation from which learning can take place. 

The recognition of this fact is the basis of the total loss 
control approach, as described in Chapter l.With total loss 
control there is a requirement for the reporting not only of 
personal injury but also of property damage accidents. 

Not all near misses, however, result in property damage. 
Another important category of near misses is the opera¬ 
tional incident. The aircraft near misses just mentioned 
are, in fact, mainly incidents associated with excursions 
outside operational limits rather than with damage to 
equipment. The chemical industry, however, does not 
appear to have a mechanism for learning from operational 
near misses. 

Another weakness of the usual approach to learning 
stems from the nature of the hazards on process plants. It is 
a characteristic of complex technological systems that they 
allow very little scope for learning gradually by trial and 
error. Instead, it is necessary to try to eliminate failures 
from the start. 

This is the reason for the growth in reliability engineer¬ 
ing and it has implications for the learning process. It 
means that attention needs to be concentrated not only on 
the accidents but also on the failures within the system that 
in a proportion of cases result in an accident. The emphasis 
on learning shifts then to the assessment of system reli¬ 
ability and to the collection of data required on equipment 
failure and human error. 

It is not enough, however, to discover the facts about 
accidents. It is even more necessary to make sure this 
information is used. A high proportion of accidents 
constitutes repetitions, with only minor variations, of 
accidents which have already occurred elsewhere and 


which are well understood by the engineering profession as 
a whole. It is not to be expected that the individual engineer 
should familiarize himself with all these. But he should 
make it his business to become familiar with some of the 
exemplary case histories and their lessons. In addition, he 
should make use of aids such as checklists and codes of 
practice that embody much of this experience in the most 
readily usable form. 

If learning is to take place, therefore, it is necessary to 
have both a means of obtaining information, for example 
accident reporting and investigation, and a means of 
ensuring that this information is utilized, for example, 
checklists and codes of practice. It is desirable for the 
learning process to take place at both company and 
national level and the measures described are, therefore, 
necessary at both levels. 


27.2 Incident Reporting 

A system for reporting accidents and perhaps other inci¬ 
dents is necessary at company level. The minimum system 
is one limited to meeting the requirements for statutory 
reporting of accidents. 

The national reporting requirements, which are described 
in Chapter 3, have been extended in recent years to 
cover certain types of event not previously included, such as 
leaks. 

Such statutory requirements, however, are intended to 
assist the national learning process. The real object of a 
company reporting system should be to help the company 
to learn. It may he appropriate, therefore, for there to he a 
requirement for the reporting of additional types of inci¬ 
dent. Events likely to be of particular interest in safety and 
loss prevention (SLP) include: 

(1) leaks of flammable materials; 

(2) leaks of toxic materials; 

(3) leaks and/or fires at pumps; 

(4) fires/explosions on burners; 

(5) storage tank collapse; 

(6) malfunctions of pressure systems items (relief valves, 
non-return valves, vents); 

(7) incidents involving trip system malfunction or dis¬ 
arming; 

(8) incidents involving alleged operator error. 

It is necessary to define carefully the level of incident 
that is reportable. This can be done satisfactorily at com¬ 
pany level so that the reporting is adapted to the particular 
circumstances and produces useful information. 

A reporting system is not of much value unless the 
information that it generates is utilized. 

It is also appropriate here to refer again to total loss con¬ 
trol, which involves a system both of incident reporting and 
of subsequent action, although in this case the emphasis is 
on some form of damage. 


27.3 Operations Monitoring 

In addition to incidents that have some physical result, such 
as the leakage of flammable materials or the collapse of a 
storage tank, there are also other incidents, such as excur¬ 
sions outside the specified operating conditions. These 
operational incidents also may constitute near misses. 
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The monitoring of operations from this viewpoint, 
however, is not well developed. The instrumentation pro¬ 
vides trend records of selected variables and the operator 
records certain types of incident or excursion. These may 
be analysed or discussed with him by the plant manager. 
With the advent of process computers there is also a record 
of the alarm excursions of a larger number of measure¬ 
ments and of the operator’s interventions via the computer. 
This information is mainly used in ad hoc investigations. 

The Court of Inquiry on the Flixborough disaster experi¬ 
enced some difficulty in extracting useful information 
from the process instrumentation, most of which was 
destroyed by the explosion and the collapse of the control 
room. The report (R.J. Parker, 1975) suggested, therefore, 
that consideration should be given to the creation of a statu¬ 
tory requirement for the installation on such plants of a 
‘black box’ facility such as is carried on aircraft. 

This facility in aircraft is governed in the United Kingdom 
by the Air Navigation Order1972, S chedule 5, which requires 
that certain aircraft, essentially those involved in public 
transport, should be equipped with a flight data and cockpit 
voice recording system approved by the Civil Aviation 
Authority (CAA). A flight data recorder system is required 
which records a list of specified parameters (e.g. pressure, 
altitude, airspeed, compass heading, pitch and roll atti¬ 
tudes) with a specified logging interval, accuracy and relia¬ 
bility. A crash-protected recorder is also required which will 
retain a record of these parameters in the event of aircraft 
crash .This is the so - called ‘black box’, although it is actually 
more like a red football in appearance. As already men¬ 
tioned, a cockpit voice recorder is also a requirement. 

This system, therefore, gives a complete record of the 
flight, including the information on maloperations and 
near misses, the number of which exceed actual crashes by 
several orders of magnitude. 

The information given by the cockpit voice recorder is 
very useful and in crash investigations can be as important 
as the instrument data. 

It will he apparent that the aircraft black box is in effect a 
system rather than a piece of hardware. It works well for 
aircraft where the parameters that should be specified for 
recording are standard, where the correct flying behaviour 
is well defined, and where there is a single authority that 
can analyse the data. Its application to chemical plant is 
more open to question for several reasons. Chemical plants 
already have a considerable amount of recording, particu¬ 
larly those with computers. There is much greater variation 
in chemical plants, both in the instrumentation and in the 
operation. Any analysis of the operations recorded would 
almost certainly be practical only at company level. Fur¬ 
thermore, despite Flixborough, it is not very often that the 
process instrumentation is destroyed. 

If the object is to further the learning process at national 
level, it would seem more profitable to concentrate attention 
on a more systematic approach to the analysis of process 
operations in order to learn about near misses rather than 
to provide protected recorders which are used only to assist 
rare Courts of Inquiry. There would seem to be considerable 
scope for the operations monitoring of process plants. This 
might be somewhat on the lines of the replay of the aircraft 
flight data record, but as always any system used would 
have to be adapted to the rather different characteristics of 
chemical plants. 

Nevertheless, the provision of a facility akin to the air¬ 
craft black box system is quite practical on chemical plant, 


particularly where there is a process computer. The main 
requirements for such a system are the provision of a sched¬ 
ule of data to be recorded, the proper maintenance of the 
instruments and the protection of the system against fire/ 
explosion. 

27.4 Accident Models 

Accident models, which have already been considered in 
Chapters 2,8 and 26, are here considered again briefly from 
the viewpoint of accident investigation. 

Not all accident investigators find it helpful to make use 
of an accident model, but some do. Work on accident models 
for use as aids in accident investigation has been described 
by Benner (1985) and the Center for Chemical Process 
Safety (CCPS) (1992/1). 

27.4.1 Logic tree models 

Perhaps the most widely used form of accident model is the 
logic tree, this term being taken here to cover fault trees 
and other methods with a tree structure. 

The Management Oversight and Risk Tree (MORT) of 
W.G. Johnson (1980), described in Chapter 2, provides a 
methodology for either investigating an accident or asses¬ 
sing a situation. MORT gives an idealized safety system 
represented as a logic tree containing specific control fac¬ 
tors and general management factors. There is a text com¬ 
mentary that helps to identify good and bad practice. 

Another logic tree method, the causal tree, derives the 
work of Leplat (1978a, 1987). This model resembles a fault 
tree, but is applied to an event that has already happened 
and which therefore contains no OR gates, only AND gates. 
Construction of the tree is guided by simple rules that 
specify the event chains. The aim of the method is to iden¬ 
tify those changes that can be made to break the chain of 
events. 

27.4.2 STEP 

A model which does not have a tree structure is the 
Sequentially Timed Events Plotting (STEP) procedure of 
Hendrick and Benner (1987 ACGIH/14). The elements of the 
model are actors, actions and events. An actor can be a 
person, equipment, substance, etc., whilst an action is 
anything brought about by an actor, and an event is the 
unique combination of an actor and one action. A struc¬ 
tured procedure is used to create a model of the accident 
from these elements. 

27.4.3 Kletz model 

Kletz states that he does not find the use of accident models 
particularly helpful, but does utilize an accident causation 
chain in which the accident is placed at the top and the 
sequence of events leading to it is developed beneath it. An 
example of one of his accident chains is given in Chapter 2. 
He assigns each event to one of three layers: 

(1) immediate technical recommendations; 

(2) avoiding the hazard; 

(3) improving the management system. 

In the chain diagram, the events assigned to one of these 
layers may come at any point and may be interleaved with 
events assigned to the other two layers. 

It is interesting to note here the second layer, avoidance 
of the hazard. This is a feature that in other treatments of 
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accident investigation often does not receive the attention 
that it deserves, but it is in keeping with Kletz’s general 
emphasis on the elimination of hazards and on inherently 
safer design. 

27.4.4 Comparative studies 

A comparative study of the characteristics of three accident 
models as applied to accident investigation has been made 
by Livingstone and Green (1992). They start from the 
perspective that investigations are generally too biased 
towards technical factors and take insufficient account of 
root causes. They identify three accident models as poten¬ 
tially useful: the causal tree model, MORTand STEP 

Livingstone and Green find that the causal tree method 
provides little guidance on how to collect the relevant 
information or identify the main events involved. It deals 
mainly with the direct causes, or trigger events, and does 
not deal so well with the root causes. They view STEP as 
well structured, but again as being of little assistance with 
root causes.They see MORT, on the other hand, as excelling 
in the identification of root causes, but as requiring the 
accident sequence to be identified separately. 

These authors propose a hybrid model that combines 
STEP and root cause analysis. 

27.5 Accident Investigation 

Accident investigation is described in Professional Accident 
Investigation (Kuhlman, n.d.), Modern Accident Investiga¬ 
tion and Analysis (Ferry, 1988), Learning from Accidents 
(Kletz, 1988h, 1994) and Forensic Engineering (Carper, 
1989) and by Bulkley (1967), M.E. Lynch (1973), Kletz 
(1979g, 1984a), Burgoyne (1981/82,1982) and Craven (1982). 

Some accounts of accident investigation are concerned 
essentially with in-house investigations, whilst others des¬ 
cribe the viewpoint of the consultant investigator. The 
account given here starts with a consideration of the selec¬ 
tion of the investigator, either in-house or a consultant. It 
continues withareviewofthepurposesofinvestigationfrom 
the perspective of a consultant and then with the organiza¬ 
tion and conduct of an investigation, basically the technical 
aspects, again written from the viewpoint of a consultant, 
although the principles are equally applicable to an in-house 
investigation. Next, consideration is given to some parti¬ 
cular types of investigation. The account then considers 
the investigation of the deeper causes of the accident and the 
recommendations for prevention, written largely from the 
viewpoint of the in-house investigator. The section con¬ 
cludes by considering a number of other topics related to 
investigations. 

27.5.1 Selection of investigator 

A formal system for the appointment of an accident inves¬ 
tigator should be part of the emergency planning in a 
company. The selection of an investigator is discussed by 
Craven (1982). The choice is of particular importance if the 
accident is a major disaster. In this case it will usually be 
necessary to appoint a multi-disciplinary team, but the 
team will still require a leader. Craven considers the selec¬ 
tion of the investigator under two headings: expertise and 
affiliation. Professional expertise and qualifications are 
factors to be taken into account, but personality and 
investigatory experience are also important. For small 
accidents, an in-house investigator may often be appro¬ 
priate, but for a large accident it may be preferable to call in 


an outsider who is free of company involvement and is 
perceived as more independent. 

27.5.2 Purpose of investigation 

The usual purpose of an investigation is to determine the 
cause of the accident and to make recommendations to 
prevent its recurrence. There may, however, be other aims, 
such as to check whether the law, criminal or civil, has been 
complied with or to determine questions of insurance lia¬ 
bility. 

The situation commonly faced by an outside consultant 
is described by Burgoyne (1982) in the following terms: 
The ostensible purpose of the investigation of an accident 
is usually to establish the circumstances that led to its 
occurrence - in a word, the cause. Presumably, the object 
implied is to avoid its recurrence. In practice, an investi¬ 
gator is often diverted or distorted to serve other ends. 
This occurs, for example, when it is sought to blame or to 
exonerate certain people or things - as is very frequently 
the case. This is almost certain to lead to bias, because 
only those aspects are investigated that are likely to 
strengthen or to defend a position taken up in advance of 
any evidence. This surely represents the very antithesis 
of true investigation... 

Ideally, the investigation of an accident should be 
undertaken like a research project. 

It is, however, relatively rare for such investigations to be 
conducted in this spirit. 

27.5.3 Organization of investigation 

Often there will be separate investigations carried out by 
the company and by the regulatory body, which in the 
United Kingdom is the Health and Safety Executive (HSE). 
It is important, therefore, that the responsibilities of the 
investigation teams and of the individual investigators be 
clearly defined, and that people who may be affected by 
their activities be informed. 

The investigation should start as soon as possible after 
the incident, while memories are still fresh and evidence is 
undisturbed. In particular, photographs, measurements 
and similar evidence should be taken on the site as early as 
possible. 

The precise procedure for an investigation cannot be 
rigidly defined in advance. It may involve assessment of 
damage and interviewing of personnel and may include 
laboratory work such as metallurgical examination and 
simulation work such as the operation of equipment under 
simulated process conditions. 

27.5.4 Conduct of investigation 

The form taken by an investigation depends somewhat on 
the accident, but is likely to be broadly as follows: (1) remit, 
(2) preliminary site visit, (3) collection of background 
information, (4) examination of damage, (5) interviewing of 
witnesses, (6) research and analysis and (7) final report. 

The purpose of the investigation should be clearly 
defined from the outset and a clear remit obtained. If in the 
course of the investigation it proves to be necessary, the 
remit should be renegotiated. The investigator should also 
ascertain the general circumstances of the accident. 

The preliminary site visit should be made as soon as 
possible. The first matter to be considered is the potential 
hazards. The situation pertaining after a large accident 
particularly is, in the nature of the case, an uncontrolled one. 
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Some of the hazards enumerated by Burgoyne (1982) are: 
mechanical hazards, such as falling through collapsing 
structures or due to unsafe access, falling objects such 
as lifting gear, striking and crushing by collapsing struc¬ 
tures, and collision with dangerous objects; thermal hazards 
of hot surfaces and fluids, and concealed fires; chemical 
hazards from corrosive, flammable or toxic materials, pre¬ 
sent as spills or in confined spaces or giving rise to sprays; 
and electrical hazards from live circuits and equipment. 

At this stage, the site should not be disturbed. Photo¬ 
graphs of the site are, however, invaluable. Colour photo¬ 
graphs are preferred, since they give much more 
information, particularly on fire damage. A record should 
be kept of the location and viewpoint of each photograph. 
Sketch plans, sketches and notes should be made as appro¬ 
priate. It may be helpful to obtain an overview of the site 
by viewing it from a distance, perhaps from the window of 
a nearby building. 

During this visit, the names should be obtained of eye¬ 
witnesses and of others who may have relevant informa¬ 
tion. Witnesses should be encouraged to write down their 
experience whilst it is fresh and, if possible, before they 
have talked to other witnesses. 

The investigator needs to familiarize himself with the 
details both of the process and of the plant equipment. 

Examination of the damage caused by the accident 
usually yields much useful information. Some of the 
detailed features of fire and explosion damage are con¬ 
sidered below. 

The interviewing of witnesses is another important 
source of information but requires some care. Information 
should be sought on the situation immediately before as 
well as during and after the event. Allowance needs to be 
made for the fact that the account given by a witness may be 
defective by reason of the initial observation, memory or 
descriptive powers. Accounts of sudden, short and violent 
events in particular tend to be unreliable. The interviewer 
should avoid the use of leading questions and should seek 
to cross-check accounts given. 

There follows a period of analysis and research. The 
danger of jumping to a conclusion and the need to keep an 
open mind are often emphasized. Burgoyne argues that the 
use of a working hypothesis, possibly with variants, is 
necessary, provided it continues to be treated as no more 
than that. The working hypothesis is then tested and 
adjusted, typically by an iterative process. 

There may be some issues that can be resolved only by 
physical tests. In some cases, small scale tests are ade¬ 
quate, but frequently the only tests capable of providing 
results that will carry conviction are relatively large scale, 
time-consuming and expensive. One reason for the time 
and expense may well be the hazards of the work required. 
The decision as to whether to call for tests is often one of the 
most difficult which an investigator has to take. 

There comes apoint where further work is subj ectto the law 
of diminishing returns and the investigator has to come to a 
conclusion, even if, as is usually the case, there are loose ends. 

A report is then written. This may well be best cast in the 
form of a chronological account of the steps by which the 
investigator came to his conclusion. The elements of an 
accident report are described by Craven. 

27.5.5 Findings of investigation 

An investigation is expected (1) to determine what hap¬ 
pened and why it happened and (2) to propose how it might 


be prevented from happening again. These two outcomes 
constitute the findings and the recommendations of the 
investigation. 

It is common for reports of accident investigations to draw 
conclusions, and make recommendations, which are con¬ 
cerned almost entirely with technical matters, and which 
fail to delve deeper into the more fundamental causes. 

This characteristic of the conclusions of an accident 
inquiry is often virtually guaranteed by the way the investi¬ 
gator is chosen. Management assumes that the causes are 
technical and appoints to investigate them the person who 
seems to have the best technical qualifications for the task. 
He in turn assumes that he has been appointed to discover 
the technical cause(s). 

In fact, accidents are typically the result of a combina¬ 
tion of failures, technical and human, both of which are 
outcomes of management failure. Various aspects of this 
have been described elsewhere, notably in Chapters 2, 6, 9 
and 14. 

This characteristic of accidents is now common ground in 
the literature on accidents and their investigation. Different 
aspects are emphasized by different authors. For example, 
Reason (1991) stresses the prior presence of latent failures, 
or resident pathogens; Swain (1972) emphasizes the work 
situation and the associated performance shaping factors; 
and Bellamy (1984) stresses communication failures. 

The need for a ‘layered’ accident investigation which 
strips off the surface layers and delves down to these 
deeper causes is a persistent theme in the work of Kletz on 
accident investigation and of learning from accidents; he 
calls it ‘peeling the onion’. Some authors use an accident 
model and/or taxonomies of causes as an aid to laying bare 
the structure of the accident. 

The basic message of such work is that, at the end of the 
day, it is management that has the responsibility of ensur¬ 
ing that the deficiencies and failures of equipment and 
humans are so controlled that accidents are avoided and 
that recommendations for preventing a recurrence must 
start from this perspective. 

However, the proposition that accidents are always in 
some sense attributable to management is not in itself 
especially constructive. It is much more helpful to identify 
the particular failings which repeatedly contribute to 
accidents. 

Most workers on accident investigation give their own 
classifications of these failings. For example, the classifi¬ 
cation given by Reason in relation to near misses is quoted 
in Section 27.16. 

Another classification is that of Kletz, which, as already 
mentioned, treats the accident in terms of the three layers 
(1) immediate technical recommendations, (2) avoiding the 
hazard and (3) improving the management system. 

Kletz makes a number of suggestions for things to avoid 
in accident findings. It is not helpful to list ‘causes’ about 
which management can do very little. Cases in point 
are ignition sources and ‘human error’. The investigator 
should generally avoid attributing the accident to a single 
cause. Kletz quotes the comment of Doyle that for every 
complex problem there is at least one simple, plausible, 
wrong solution. 

Increasingly, the findings of accident investigations are 
presented in terms of the root causes. The concept of root 
causes has been discussed in Chapter 8 and is considered 
further in Section 27.8. It underlies the family of techniques 
described by Wells and co-workers, the audit methodology 
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being developed by the HSE and the approach suggested by 
the CCPS. The findings should identify the specific root 
causes and the recommendations should then address each 
of these in turn. 

27.5.6 Recommendations of investigation 

As just indicated, the recommendations should arise out of 
the findings of the investigation. The investigation should 
aim to match each root cause with a corresponding appro¬ 
priate recommendation. 

A recommendation will generally address one of three 
aspects of the accident situation: (1) reduction of frequency, 
(2) reduction/mitigation of consequences and (3) limitation 
of exposure of people. 

In terms of the fault tree representation, the aim is 
to insert a new, or to strengthen an existing, AND gate at 
each critical point in order to prevent escalation up the 
demand tree. 

It is urged by Kletz that technical proposals for preven¬ 
tion should aim for defence in depth and, therefore, should 
give due weight to the earlier as well as the later lines of 
defence. In fault tree terms, there should not be excessive 
concentration on the upper levels of the tree just below the 
top event. 

Lines of defence which Kletz lists, some applicable only 
to flammables are (1) limitation of inventory, (2) inspection 
of construction, (3) gas detectors, (4) leak warning system, 
(5) leak isolation, (6) leak dispersion by open construction 
and fluid curtains, (7) elimination of ignition sources, (8) 
passive fire and explosion protection, (9) active fire fighting 
measures and (10) separation distances. 

Kletz identifies as recurring themes in general recom¬ 
mendations in his own analyses of accidents: (1) design of 
user-friendly plants, (2) hazard identification by hazard 
and operability (hazop) studies, (3) control of plant modi¬ 
fication and (4) inspection and testing of protective 
equipment. 

Another recurring theme is management, which has a 
number of aspects, including (1) organizational memory 
and (2) training. 

Recommendations may seek to exploit the concept of 
hazard warning outlined in Chapter 9. From this viewpoint, 
the existence, or insertion, of an AND gate in the fault tree 
means that the events below that gate, if observable, may be 
monitored and treated as warnings. 

It is good practice to draw up draft recommendations 
and to consult on these before final issue with interested 
parties. This contributes greatly to their credibility and 
acceptance. 

It is relevant to note that in a public accident inquiry, such 
as the Piper Alpha inquiry, the evidence, both on mana¬ 
gerial and technical matters, on which recommendations 
are based is subject to cross-examination. 

The recommendations should avoid overreaction and 
should he balanced. It is not uncommon that an accident 
report gives a long list of recommendations, without 
assigning to these any particular priority. It is more helpful 
to management to give some idea of the relative importance. 
The King’s Cross Report (Fennell, 1988) is exemplary in this 
regard, classifying its 157 recommendations as (1) most 
important, (2) important, (3) necessary and (4) suggested. 

In some instances, plant may be shut-down pending the 
outcome of the investigation. Where this is the case, one 
important set of recommendations comprises those relating 
to the preconditions to be met before restart is permitted. 


These recommendations may well involve process and/or 
plant modifications and, if so, should be subject to the 
established systems for management of change. 

There should be full documentation of the recommen¬ 
dations, covering those considered and rejected as well as 
those accepted. 

27.5.7 Report of investigation 

The investigation is documented in the final report. If it is a 
lengthy one, it may also be appropriate to issue an interim 
report. 

The final report should include: an executive summary; 
an outline of the accident; a statement of the scope of the 
inquiry; the background, which will often need to cover 
relevant aspects of the management systems, the process, 
the plant and its operational history; a narrative of the 
events prior to and comprising the accident; an account of 
the investigation itself; a listing of the findings, with sup¬ 
porting evidence; and a listing of the recommendations, 
with clear links to the findings. 

The requirements for follow-up of the report should also 
be specified in writing, whether in the report itself or 
otherwise. These include dissemination of the report’s 
contents and action on it recommendations. 

27.5.8 Experimental work 

It is necessary in some investigations to undertake experi¬ 
mental work. Two main types of investigation are tests on 
failed equipment and experiments undertaken to test a 
hypothesis. 

The damage survey in the field is often complemented by 
laboratory examination of failed equipment. Figure 27.1 
illustrates the procedure used at the time for examination of 
equipment failure by the Safety in Mines Research Estab¬ 
lishment (SMRE), an HSE ‘in-house’ facility. Some of the 
inspection techniques have been described in Chapter 19. 

An account of the approach taken in experimentation 
done to test a hypothesis is given by A.R. Baker (1982). 
Simulation experiments are done for three basic purposes: 
(1) to confirm or demonstrate, (2) to identify a mechanism or 
(3) to determine an initial condition. Thus, an experiment 
may be carried out to confirm or demonstrate convincingly 
that a particular event or sequence of events could have 
occurred under appropriate conditions. The relevance of 
such work depends on the extent to which the conditions of 
the accident can be simulated. Failure to reproduce even one 
of these initial conditions to which the results are known, 
or expected, to be sensitive may vitiate the work. In other 
causes, the initial conditions and the results are known, but 
the mechanism is not understood. There may be several 
candidate mechanisms. In yet other cases, the aim is to deter¬ 
mine the initial condition(s) that caused the event of interest. 
Where there is a sequence of events, it is often impractical, 
and unnecessary, to simulate the whole sequence; it may 
be sufficient to simulate just one of these events. 

It is generally easier to show that something could hap¬ 
pen than that it could not. For the former a single positive 
result suffices, whereas for the latter the experimental 
space to be explored may be very large. 

In many cases, a small scale experiment is not adequate, 
but large scale experimentation may be problematic, and is 
often potentially hazardous. It is likely to be expensive and 
time-consuming. 

Where experiments are carried out, it is good practice to 
make a full photographic record. 
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Diagnose cause/sequence of failure - Confirmatory experiments 

Write report (for issue to interested - Recommendations when appropriate 

parties and/or use in inquiries) for avoiding recurrence 

Figure 27.1 Sequence of events in the examination of faulty equipment (Safety in Mines Research Establishment, 
1971, Engineering and Metallurgy 4; reproduced by permission. The sequence may be modified and stages omitted 
according to the type of failure) 
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Baker describes some seven different experimental 
investigations, including work on the bellows assembly at 
Flixborough and on a gas explosion in a building. 

27.5.9 Some types of investigation 

The account given so far has considered accident investi¬ 
gations conducted either in-house or by a consultant 
investigator. As mentioned earlier, accident investigations 
may also be carried out to check compliance with the law 
or to determine insurance liability. Where a crime is sus¬ 
pected, the police will be involved and may draw on 
resources such as those of the Home Office Forensic 
Science Laboratories. Where a violation of health and safety 
legislation is at issue, the HSE will be involved and may 
choose to conduct their own investigation, as described 
below. Where there is a question of the applicability of an 
insurance policy or the possibility of a transfer of liability 
to another party, one or more of the parties concerned may 
conduct their own investigations. It can occur, therefore, 
that there is more than one investigation of the accident 
going on at the same time. 

27.5.10 Regulatory investigations 

In the United Kingdom, a proportion of the more serious 
accidents are investigated by the HSE. It is the normal 
practice to publish the report. HSE reports in the Investi¬ 
gation Report series, listed in Appendix 28, include the fol¬ 
lowing: Explosion at Laporte Industries, Ilford, 5 April 1975 
(HSE, 1976b), Explosion at Appleby Frodingham Steelworks 
Scunthorpe, 4 November 1975 (HSE, 1976a), Explosion at 
Dow Chemical Factory, King’s Lynn, 27 June 1976 (HSE, 
1977b), Fire and Explosion at Braehead Container Depot, 
Renfrew, 4 January 1977 (HSE, 1979b), Leakage of Propane 
at Whitefriars Glass Limited, Wealdstone, Middlesex, 20 
November 1980 (HSE, 1981c), Fire and Explosions at B&R 
Hauliers, Salford, 25 September1982 (HSE, 1983b), Abbeys- 
tead Explosion, 23 May 1984 (HSE, 1985a), Summit Tunnel 
Fire (HSE, 1985e), The Fires and Explosion at BP Oil (Gran¬ 
gemouth) Refinery Ltd, 13 March, 22 March and 11 June 1987 
(HSE, 1989a) and The Peterborough Explosion of a Vehicle 
Carrying Explosives, 22 March 1989 (HSE, 1990b). 

Likewise, in the United States of America if an accident is 
sufficiently serious, an investigation is conducted by the 
Occupational Safety and Health Administration (OSHA). 
The report Phillips 66 Company Houston Chemical Complex 
Explosion and Fire (OSHA, 1990a) is a case in point. 

Investigations into transport accidents in the United 
States of America are conducted by the National Trans¬ 
portation Safety Board (NTSB). Some of their reports are 
listed in Appendix 28. 

27.5.11 Public inquiry investigations 

The Flixborough Report (R.J. Parker, 1975) together with its 
associated daily transcripts and the documents submitted 
to the inquiry remains perhaps the most comprehensive 
account of an accident investigation in the chemical indus¬ 
try. References to some of the large number of reports are 
given in Table A2.1. Accounts by individual investigators 
include those by Tucker (1975), J.I. Cox (1976b) and Gugan 
(1976). Further details of the Flixborough investigation are 
given in Appendix 2. 

The Piper Alpha Report (Cullen, 1990), with its associated 
transcripts and the papers published subsequently, is 
another illustration of a major accident inquiry. References 
are given inTable A19.1. Accounts of individual investigators 


include those of Bakke (1989), R.A. Cox (1989a), 
M.E. Davies (1989), S.M. Richardson (1989) and Savffle 
(1989). Further details of the Piper Alpha investigation are 
given in Appendix 19 and an account of the inquiry is given 
in Section 27.9. 

27.5.12 Illustrative examples 

There are available in the literature a large number of 
reports and other accounts of accident investigations which 
serve as illustrative examples. At the top level there are the 
reports of public inquiries such as the Flixborough Report 
and the Piper Alpha Report. At the next level down are the 
accident investigation reports of the HSE and the NTSB, to 
which reference has just been made. 

The work of Kletz gives a large number of accounts of 
accidents, each with an analysis that is an illustration of the 
principles of investigation that he advocates, together with 
explicit statements of those principles. 

An account is now given of two further illustrative 
examples of the techniques of accident investigation. 

27.5.13 Illustrative example: choked vent 

An account of the investigation of accidents in process 
plants has been given by Houston (1971). This work was 
referred to earlier in Chapter 2. The approach taken is illus¬ 
trated by an example that he gives of a hypothetical acci¬ 
dent (see Figure 27.2): 

One end of a storage drum was blown out seriously 
injuring three men who were working nearby. 

The drum was used to store an organic liquid with a 
relatively high melting point. Steam tracing on the feed 
line was not very effective and chokes were common. 
Because of this it was customary to blow the line clear 
with air at 100 lbf/in 2 before and after each transfer. 

On this occasion the operator realized that the vent was 
not blowing and assumed that the line was blocked. In 
fact it was the vent that was blocked and when the pres¬ 
sure reached an estimated 30 lbf/in 2 one end of the vessel 
failed. Debris, particularly hot residual product from the 
last batch at 120°C, was blown some distance and three 
men who were working about 15 ft away were seriously 
injured. 

The analysis of this accident using a model accident ana¬ 
lysis form is shown in Table 27.2. The method has several 
important features. It does not report a principal cause, but 
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Figure 27.2 Accident involving the failure of a storage 
vessel (Houston, 1971) (Courtesy of the Institution of 
Chemical Engineers) 














Table 27.2 Model analysis of storage vessel accident (Houston, 1971) (Courtesy of the Institution of Chemical Engineers) 
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rather a chain of events that might be broken in several 
places. It identifies both the advance warnings and the 
preventive measures that might be utilized to prevent 
recurrence, and it yields recommendations that are capable 
of practical implementation. 

27.5.14 Illustrative example: ethylene oxide 
plant explosion 

An illustration of the investigation of a quite different kind 
of accident is that undertaken following the explosion at 
the ethylene oxide/glycol plant of BASF on 7 March 1989 at 
Antwerp (Anon., 1991LPB100, p. 1). The incident involved 
an explosion on a distillation column separating ethylene 
oxide (EO) and acetaldehyde. The investigation found that 
probably a small leak of EO had led to an accumulation of 
auto-oxidizable polyethylene glycols (PEGs) in the insula¬ 
tion of the column. 

The account referenced describes the organization of 
task forces to (1) secure the damaged plant, (2) repair the 
equipment, (3) document the damage, (4) assemble infor¬ 
mation and (5) search for the cause. 

A thorough review was made of the chemistry of 
the process and of the potential sources of ignition. The 
explosion event was reconstructed from an analysis of 
the damage, the examination of materials, the statements 
of eye-witnesses and the recorded information from nearby 
plants, and the probable chain of events leading up to the 
explosion reconstructed. 

The location of the first explosion was identified as the 
acetaldehyde column K303 from the fact that a manhole 
cover from this column had left an imprint on nearby col¬ 
umn K205. The damage to the trays of the column indicated 
that the explosion occurred in the lower part of the column, 
probably at the bottom. 

Alternativesourcesofignitionincludedchemicalreaction 
of the bottom products, static electricity and EO decom¬ 
position in an overheated pump, but these were eliminated. 
The only ignition source that could not be discounted was 
a fire within the insulation. It was confirmed that this 
was a feasible mechanism. EO itself is a low boiling liquid 
that does not generally accumulate on insulation, but it 
reacts with water to give PEG, a reaction which normally 
requires a temperature of 180°C but which was shown to 
proceed in direct contact with mineral wool at 100°C. The 
PEG is high boiling and can support self-heating of the 
insulation. 

27.5.15 Disputed investigations 

A large proportion of accidents are investigated by the fire 
services for the purpose of records and statistics, and the 
investigation is relatively short. Even where it is rather 
fuller, time and resource constraints still apply. 

In some cases, a later investigator comes to a different 
conclusion as to the technical causes. Three such cases are 
given by Ursenbach (1980,1983). In the first, the ignition of 
a vapour cloud from a plant leak was ascribed to a non- 
explosion-proof electric cart, but subsequent modelling of 
the vapour dispersion showed that a flammable mixture 
could not have reached the vehicle. In the second, an 
explosion was attributed to a defective acetylene cylinder, 
but a later study of marks on the cylinder indicated that the 
damage to it had been caused by compression of an oxygen 
cylinder onto it by the collapsing roof. In the third case, it 
was reported that the damage was due to an explosion of 
solvents evaporating from a massive ink spill caused by the 


failure of a ball mill at ground level, but a further investi¬ 
gation found that other explosions had occurred on upper 
floors which could not have been due to the heavier-than-air 
vapour on the ground floor. 

27.6 Fire Investigation 

Accounts of the investigation of fire are given in Fire and 
Arson Investigation (J. Kennedy, 1962) and Fire Investigation 
(Dennett, 1980) and by Burgoyne (1981/82, 1982) and 
Craven (1982). 

The overall conduct of an investigation has been described 
above. The general account given of the preliminary site 
visit, the examination of damage, the interviewing of 
witnesses, etc., is applicable, but in addition there are a 
number of considerations which apply specifically to fire 
investigation. 

The preliminary site visit serves to identify the area of 
origin of the fire. Further work is aimed at establishing the 
material first ignited, the source of ignition and the general 
features and pattern of the fire and thus identifying the 


27.6.1 Fuel involved in fire 

Some pointers to identifying the fuels involved in a fire or 
explosion are given by C.H.H. Willis (1981). 

27.6.2 Temperature attained by fire 

The temperature of a process plant fire does not normally 
rise much beyond 1000°C. This is so whether the material 
undergoing combustion is a flammable liquid or a solid 
material such as wood, plastic or paper. On the other hand, 
it is usually sufficient to cause significant deterioration of 
steelwork, which occurs in the range 550-600°C. Jet 
flames can give rise to temperatures appreciably higher 
than 1000°C. 

Some indicators of the behaviour of the fire are charring 
of wood, melting of metals, damage to vessels and damage 
to structural steelwork. Charring of wood can be expected 
to be deepest where the fire has burned longest. Most types 
of wood are charred to a depth of about 2.5 cm within 
40 min, whatever the fire, as long as the flame is the diffu¬ 
sion flame normal in a fire. 

Copper has a melting point of 1080°C and usually does 
not melt hut its alloys brass and bronze do; their melting 
points being in the range 800-1000°C. So does aluminium 
with a melting point of 650°C. 

The paint on a vessel containing liquid may be blistered 
above the line of the liquid level but not below. If the origi¬ 
nal liquid level is known, this can be used in conjunction 
with an assumed heat input rate to estimate the duration of 
the fire. Craven suggests values for the heat input rate of 
110 kW/m 2 typical and 170 kW/m 2 maximum, in the 
absence of a jet flame. 

The temperature at which structural steelwork distorts 
is attained in most process plant fires, and the damage 
can be spectacular, but generally it is not a very helpful 
indicator. 

Fire temperature indicators are also described by 
Guenther et al. (1976), Guenther, Goodwin and Brininger 
(1978) and McIntyre (1981). The latter gives an account of 
the use of common materials as temperature indicators. He 
divides such indicators into two classes: time independent 
and time dependent. Some indicators which are essentially 
independent of, or only weakly dependent on, time are the 
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melting of metals, the charring of wood, the high tempera¬ 
ture scaling of steel and the recrystallization of copper. He 
gives a list of some 25 temperature indicators which may be 
observed by one of three methods: visual examination, 
hardness testing or metallographic examination. 

27.6.3 Electrical short circuits 

Fires of electrical origin are of considerable interest to fire 
investigators. A relevant code is NFPA 907M. 

Accounts of the treatment electrical short circuits in fire 
investigations are given by Levinson (1977), Ettling (1978), 
B eland (1981,1982), Delplace and Vos (1983) and D.A. Gray, 
Drysdale and Lewis (1983). 

An electrical short circuit is a potential source of igni¬ 
tion. It is accompanied by an electric arc. Such an arc 
causes damage to the electric wiring and leaves a visible 
mark. The problem is to determine whether in a given case 
the short circuit is a cause or an effect of the fire. 

The differentiation of cause from effect is addressed 
by Delplace and Vos (1983) and experimental work to this 
end is described by D.A. Gray, Drysdale and Lewis (1983). 
Delplace and Vos also state that there is a close parallel 
between the pattern left by a fire and the location of 
the short circuits and that this can be exploited in fire 
investigation. 

27.7 Explosion Investigation 

Accounts of the investigation of explosions are given in 
Unconfined Vapour Cloud Explosions (Gugan, 1979), Explo¬ 
sion Investigation (Yallop, 1980) and Investigation and 
Control of Gas Explosions in Buildings and Heating Plant 
(R.J. Harris, 1983) and by V.J. Clancey (1972b, 1981), 
W.E. Baker (1982) and Craven (1982). 

27.7.1 Types of explosion 

There are a number of different types of explosion on pro¬ 
cess plant which the investigator may need to consider. 
They include: 

(1) condensed phase explosion; 

(2) physical explosion - 

(a) hydraulic, 

(b) pneumatic; 

(3) confined gas explosion; 

(4) vapour cloud explosion; 

(5) boiling liquid expanding vapour explosion; 

(6) dust explosion; 

It may also be necessary to distinguish between deflagra¬ 
tion and detonation. 

Explosions may occur with buildings; gas explosions in 
buildings are of particular importance. 

27.7.2 Condensed phase explosions 

Explosions of a condensed phase explosive such as TNT 
are of less interest for process plant than are some of the 
other types, but on the other hand the methods of investi¬ 
gation are well established and accounts more comprehen¬ 
sive, so that it is convenient to start with them. Accounts 
include Explosion Investigation (Yallop, 1980) and that by 
V.J. Clancey (1972b). The effects of condensed phase 
explosions, which are well documented, are described in 
Chapter 17 and the information given there may be used for 
diagnostic purposes. 


The text by Yallop covers (1) explosion accidents and the 
explosion investigator, (2) fundamentals of explosives, 
(3) the approach to the scene, (4) the observation and 
assessment of damage, (5) identification of the explosive, 

(6) causes of initiation, (7) explosions in moving vehicles, 
(8) injury to persons, (9) examination of suspects, (10) analy¬ 
sis of witness statements, (11) unlikely occurrences, 
(12) negative evidence and (13) drawing the conclusions. 

Yallop’s treatment of the observation and assessment of 
damage covers (1) the importance of damage, (2) the type of 
explosive and explosion damage, (3) the value to be 
attached to damage observations, (4) the importance of the 
site of the explosion centre, (5) the determination of the site 
of the explosion centre, (6) the significance of pressure, 

(7) the application of pressure observations, (8) the phe¬ 
nomenon of fragmentation, (9) information from frag¬ 
ments, (10) craters and (11) ground shock. Some of the 
relationships given by Yallop, and also by Clancey, are 
among those used in Chapter 17, which also draw on his 
accounts of explosives and of their initiation. 

Observable damage falls into three categories: (1) per¬ 
manent distortion of objects, (2) displacement of objects 
and (3) flame and heat effects. Permanent distortion may 
itself be subdivided into (1) plastic deformation, (2) fracture 
and (3) fragment attack. In general, permanently distorted 
objects are generally quite reliable indicators, whereas 
displaced objects are much less dependable. 

Modes of plastic deformation considered include: (1) bend¬ 
ing of long metal objects such as structural members, rails, 
window frames, pipes, and nails, screws and bolts; (2) dish¬ 
ing of metal plates, including tanks; and (3) movement of piles 
of particulate matter. The author states, however, that obser¬ 
vations cannot be made on a container that is full of liquid, 
which inhibits distortion. Fracture may be observed of the 
structural elements of buildings, the contents of buildings, 
and objects outdoors. Fragment attack take the form of sur¬ 
face attack, giving dents or small craters, or penetrative 
attack. The latter can be useful in locating the explosion 
centre by projecting back the lines of the penetration holes. 

Flame and heat effects are melting and decomposition. 
The contact between the hot gas of the blast wave and sur¬ 
rounding objects is generally too short for much heat 
transfer to occur, but metal surfaces close to the explosion 
centre can exhibit ‘gas wash’, which is characterized by 
partial melting of the surface layers, giving a ripple effect. 
In some cases, heat transfer is sufficient to cause decom¬ 
position, such as the charring of organic materials or the 
discoloration of painted surfaces. 

This information may be used to prepare a direction/ 
damage diagram. Yallop describes a diagram made for the 
gas explosion in the flats at Ronan Point in 1968 with a 
detailed explanation of some 19 items. 

The author gives a detailed account of the determination 
of overpressures from plastic deformation and from frac¬ 
tures. These may be used to determine the charge weight of 
the explosive using the usual scaling laws. 

It is a basic principle of explosion investigation to recover 
as many primary fragments as possible. Fragments can 
give information on the nature of the exploding object and 
on the site of the explosion, and possibly the charge weight. 

A further account is given by W.E. Baker (1982). He 
advises for the determination of explosion yield the use of 
the pressure-impulse method. He draws attention to the 
need to allow in the far field for meteorological effects due 
to possible focusing of inversions and wind shear. 
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27.7.3 Physical explosions 

Physical explosions are often the result of overpressuri¬ 
zation during a fire. Depending on whether the vessel is full 
of liquid or not, the explosion may be hydraulic or pneu¬ 
matic. The mode of failure is determined by the weakest 
feature of the containment. A pneumatic explosion is the 
more violent and gives rise to a large number of missiles. 

The estimation of the energy released in, and of the 
effects of, a physical explosion are described in Chapter 17. 

27.7.4 Confined gas explosions 

The behaviour of an explosion of gas confined within a 
plant depends on the nature of the space concerned. With a 
single volume such as a vessel the explosion can be expec¬ 
ted to be a deflagration with a stress essentially uniform 
over the containment. With a multi-compartment volume 
there is scope for run-up to higher flame speed and for 
pressure piling. Damage is likely to be at a maximum at the 
point most remote from the source of ignition. With a pipe¬ 
line the flame speed may accelerate to give a detonation. 

Slow deflagration of a gas mixture tends to give a pure 
ductile failure at a pressure corresponding to the static 
strength of the container. The bursting of a cylindrical 
container in such a deflagration is usually taken to occur 
when the pressure causes the stress to exceed the hoop 
stress. 

Where the flame speed in a gas mixture runs up to 
detonation, which can occur in a vessel of high aspect 
ratio or a pipeline, bursting may occur at a higher pressure 
than that for static loading. The bursting of a cylindrical 
containment in a detonation may be taken to occur at a 
pressure corresponding to a stress that is about twice the 
hoop stress. 

Detonation in a pipeline gives rise to a characteristic 
longitudinal tear, or ribbon. This may be repeated at points 
along the pipeline where the explosion is relieved and then 
starts again the run-up to detonation. 

Interpretation is complicated by the fact that a ductile 
failure due to a slow deflagration can create a tear that 
accelerates into a brittle fracture. Conversely, detonation 
does not necessarily cause brittle fracture. 

The investigator usually seeks to determine the point of 
initiation of the failure. Where the failure is ductile, the 
point of initiation tends to correspond to that of maximum 
thinning. Where the failure is brittle, there tend to be char¬ 
acteristic chevron marks on the tear that point back to the 
point of initiation. 

With regard to source of ignition, little can be deduced 
from the pattern of bursting of a single vessel, but for a 
multi-compartment configuration the maximum damage 
tends to occur remote from the source of ignition. 

27.7.5 Failure analysis 

Failure analysis seeks to determine the details of the failure 
of the containment and generally involves the collection of 
the fragments generated by the explosion within it. An 
account is given by Craven, who describes the piecing 
together of the fragments to reconstruct the original con¬ 
tainment and to take measurements of the thickness. 

Another account of failure analysis is that of Beyers 
(1980), who describes the investigation of a massive explo¬ 
sion at a group of spherical and cylindrical storage vessels. 
Utilizing information on the necking of the vessels, crack 
propagation and fracture mechanics, it was possible to 
determine the order of failure of the vessels and to establish 


that failure had occurred because both a level measuring 
device and a safety relief valve had failed, so that pumping 
was allowed to continue when the vessel was full and the 
resultant overpressure was not relieved by the safety relief 

27.7.6 Vapour cloud explosions 

The main effect of a vapour cloud explosion that is used for 
diagnostics is the blast. Vapour cloud explosions tend not 
to give a crater and the missiles from such explosions 
usually yield less information than do those from confined 
explosions. 

The characteristics of a vapour cloud explosion are 
described in Chapter 17. They are generally less well 
defined than those of a condensed phase explosion and 
consequently more uncertain in their application for diag¬ 
nostic purposes. 

A detailed survey of the damage done by the blast from 
the vapour cloud explosion at Flixborough has been 
described by Gugan (1979), who also gives an account of the 
interpretation of this damage to estimate the yield of the 
explosion. Features considered include the crushing of 
vessels and the bending of lampposts. 

27.7.7 BLEVEs 

A boiling liquid expanding vapour explosion (BLEVE) is 
another type of explosion which occurs in accidents in the 
process industries. A BLEVE tends to generate a number of 
fragments, but the overpressure of the blast wave is slight. 
There is usually relatively little difficulty in establishing 
that a container has undergone a BLEVE. 

27.7.8 Ignition sources 

It is usually more difficult to identify the source of ignition 
for a vapour cloud than for solid materials and in many cases 
of vapour cloud explosion no ignition source is identified. 

27.7.9 Injury to humans 

Injury to humans, whether deceased or surviving, is 
another potential source of information. The information 
that may be obtained from this source is considered by 
Yallop. A treatment of injury from different explosion 
effects is given in Chapter 17. 

27.7.10 Gas explosions in buildings 

An account of the investigation of gas explosions in build¬ 
ings with particular reference to natural gas has been given 
in Investigation and Control of Gas Explosions in Buildings 
and Heating Plant (R.J. Harris, 1983). Some treatment of the 
topic is also given by Yallop. The account by Harris is con¬ 
cerned particularly with explosions following leaks of 
natural gas in consumers’ premises. 

Investigation of a gas explosion in a building proceeds by 
trying to establish (1) the nature of the explosion and, 
assuming it is a gas explosion, (2) the type of gas, (3) the 
source of gas, (4) the quantity, concentration and distribu¬ 
tion of the gas, (5) the ignition source, and frequently, 
(6) the pressure generated and the distribution of pressure 
damage. 

The investigation may start by determining whether the 
damage has been caused by fire or explosion. Here a useful 
indicator is damage to windows that may have been caused 
by pressure or by heat. The pattern of failure of a glass 
window under pressure is quite different from that of 
failure due to heat. Pressure failure gives a large number of 
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fragments with visible stress marks, whilst failure by heat 
gives fewer fragments and no stress marks. Pressure fail¬ 
ure causes fragments to travel further and they could be 
found at distances of over 5 m from the window. 

An explosion due to gas may be distinguished from that 
of a bomb by the fact that the former gives a slow pressure 
rise and causes damage that is omni-directional, whereas 
the latter gives a fast pressure and damage is greatest at the 
location of the bomb. 

With regard to the type of gas, the principal clue is 
whether the gas is lighter or heavier than air, which may 
often be determined from a ‘tide mark’ of scorching. 

The search for the source of gas depends on the building 
and the potential gas sources in it. 

The quantity of gas may be estimated from the damage 
done both within the building and outside. Again, the 
behaviour of the windows provides important information. 
The pressure inside the building maybe estimated from that 
required to break the windows and from the distance trav¬ 
elled by the fragments. The correlations used are those 
of M.R. Marshall, Harris and Moppett (1977) given in 
Chapter 17. The other indicator is damage to windows of 
other buildings. Here use is made of the relation for the 
pressure outside a vented enclosure, which decays accord¬ 
ing to a modified inverse square law, as given in Chapter 17. 
The pressure on these outside windows is assumed to be the 
reflected pressure at normal incidence, or twice the incident 
pressure. 

The author enumerates some of the ignition sources 
found in consumers’ premises, hut states that often the 
ignition source is not found. 

27.8 Accident Investigation: CCPS Guidelines 

Guidance on incident investigation is given in Guidelines 
for Investigating Chemical Process Incidents (CCPS, 1992/10) 
(the CCPS Incident Investigation Guidelines). 

The Guidelines are concerned with process safety incident 
investigation (PSII). They cover (1) introduction, (2) basic 
incident investigation techniques, (3) investigating process 
safety incidents, (4) practical investigation considerations 
(gathering evidence), (5) multiple cause determination, 
(6) recommendations and follow-through, (7) formal reports 
and communications issues and (8) development and imple¬ 
mentation. They contain a number of appendices, including: 
a review of major accidents such as Bhopal, Mexico City, 
Piper Alpha and Pasadena; examples of the causal tree 
method (CTM) and multiple-cause, systems orientated inci¬ 
dent investigation (MCSOII) method; an example incident 
investigation; and examples of root cause analysis. 

27.8.1 Types of investigation 

The CCPS Guidelines distinguish between three types of 
investigation: 

Type 1 Traditional, informal investigation carried on 
by immediate supervisor. 

Type 2 Committee-based investigation using expert 

judgement to find a credible solution of cause 
and remedy. 

Type 3 Multiple-cause, systems-oriented investigation 

that focuses on root cause determination, inte¬ 
grated with an overall process safety manage¬ 
ment (PSM) programme. 

The Type 3 investigation is the preferred method. 


27.8.2 Investigation management system 

The Guidelines advocate that the company should have in 
place a management system for PSII. They describe the 
elements of this system, including the systems for incident 
reporting, incident classification, activating an investiga¬ 
tion, selecting and training the investigation team, docu¬ 
menting the inquiry, disseminating its findings and 
following through its recommendations. 

It is desirable that the approach to PSII be one that 
chimes with the methods of process safety review already 
in use for plant design and operation. This is met by the 
multiple cause analysis, or Type 3, approach, utilizing logic 
tree and related techniques. 

The Guidelines give a detailed account of the measures 
necessary to set up a PSII management system, including 
the training requirements. 

27.8.3 Investigation techniques 

The Guidelines review some 18 investigation techniques 
which include: (1) fault tree analysis (FTA); (2) the CTM 
taken up by Rhone-Poulenc (Leplat, 1978a; Boissieras, 
1983); (3) the MORT method of W.G. Johnson (1980); (4) the 
MCSOII developed by Rohm and Haas (Dowell, 1990; 
S.E. Anderson and Skloss, 1991); (5) the Accident Anatomy 
Method (AAM) developed at the Riso National Laboratory 
(Bruun, Taylor and Rasmussen, 1979); (6) Action Error 
Analysis (AEA) described by J.R. Taylor (1979); (7) the 
Cause-Effect Logic Diagram (CELD), developed by the 
Electrical Power Research Institute (EPRI) (Mosleh et al., 
1988) among others; (8) hazard and operability (hazop) 
analysis; (9) the Accident Evolution and Barrier (AEB) 
technique in development at the Swedish Nuclear Power 
Inspectorate (Svenson, 1991a); (10) Work Safety Analysis 
(WSA) developed at the Technical Research Centre in Fin¬ 
land (VTT) (Suokas, 1981; Soukas and Rouhiainen, 1984); 
(11) Human Reliability Analysis (HRA) developed at Sandia 
National Laboratories (B.J. Bell and Swain, 1983; Swain and 
Guttman, 1983); (12) Multi-linear Events Sequencing 
(MES) developed by the NTSB (Benner, 1975); (13) the 
STEP procedure described by Hendrick and Benner (1987); 
and the Systematic Cause Analysis Technique (SCAT) 
developed by the International Loss Control Institute 
(ILCI) (1990). 

Of these methods hazop, FTA, MORT, and AEA have 
been described in Chapters 2, 8 and 9, HRA in Chapter 14 
and STEP in Section 27.4. CTM essentially utilizes a 
stripped-down fault tree that is applicable to the particular 
accident and contains only AND gates. MCSOII is also a 
fault tree adaptation in which the events at the level just 
below the top event are the presence of the injurious factor, 
the presence of the target and a contact duration suffi¬ 
cient to cause harm. AAM utilizes a tree that, like the 
one in MORT, is generic, but which resembles a cause- 
consequence diagram and which is then developed to 
represent the features of the particular accident. AEB 
describes the incident in terms of a series of events in two 
parallel systems, the human and the technical, and of bar¬ 
rier functions that should prevent escalation. WSA utilizes 
a proforma in which are analysed the work step, hazard, 
causative factors, priority ranking and corrective actions. 
MES charts the events in a time sequence and is a fore¬ 
runner of STEP. SCAT treats the incident as a domino effect 
and involves describing successively the loss, the contact 
between the injurious factor and the target, the immediate 
causes, the basic causes and the failure of control. 
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The Guidelines also describe other aids such as the 
fact-hypothesis matrix and simulation/recreation. 

27.8.4 Multiple root cause analysis 

Two strong themes in the Guidelines are that accidents have 
multiple causes and that the investigation should delve 
down to the root causes. The preferred approach is termed 
‘multiple cause analysis’, but might equally well be called 
‘multiple root cause analysis’. The account given of the 
conduct of such an analysis relies heavily on the use of 
logic trees. 

The Guidelines illustrate the application of this approach 
to major accidents such as Flixborough, Challenger and Piper 
Alpha, as well other incidents involving fire/explosion, 
compressor failure and vehicle collision. 

27.8.5 Recommendations, reports and follow-up 

The Guidelines discuss the recommendations of the inves¬ 
tigation, dealing with the distinction between findings and 
recommendations, the correspondence between root cau¬ 
ses and recommendations, the attributes of good recom¬ 
mendations, the layers of recommendations, the types of 
recommendation, the process of feedback on draft recom¬ 
mendations, the documentation of the recommendations, 
the recommendations on restart of plant, the documenta¬ 
tion of the recommendations and the follow-through of the 
recommendations. They also treat the reporting of the 
incident from the initial verbal report through the interim 
report to the final report. The approach taken to these topics 
is broadly in line with that described in Section 27.5. 

27.9 Public Accident Inquiries 

In the United Kingdom, certain accidents are investigated 
by official bodies. The system varies with the industry, but 
in the case of a major disaster there is likely to be some form 
of public inquiry. 

Reports of such accident inquiries include Tfe Flixborough 
Disaster (R.J. Parker, 1975), The Windscale Inquiry 
(R.J. Parker, 1978), MV Herald of Free Enterprise. Report of 
Court (Sheen, W87), Investigation into the King’s Cross 
Underground Fire (Fennell, 1988), Investigation into the 
Clapham Railway Accident (Hidden, 1989) and The Public 
Inquiry into the Piper Alpha Disaster (Cullen, 1990). The two 
major disasters in the process industries which in recent 
years have been the subject of a public inquiry are thus 
Flixborough in 1974 and Piper Alpha in 1988. 

In the process industries, a proportion of accidents are 
investigated by the HSE. Until the mid-1970s the reports 
of these investigations were not generally published as 
such, although reference was often made to them in the 
annual report of Chief Inspector of Factories. Following the 
Flixborough inquiry in 1974, the HSE have conducted a 
number of major accident investigations and have pub¬ 
lished their reports, as described in Section 27.5. Thus, the 
number of public inquiries is very small and even quite 
major accidents are now mainly dealt with by an HSE 
investigation and report. 

27.9.1 Procedure at public accident inquiries 
A public accident inquiry is appointed by the government 
minister responsible and is presided over by a judge. There 
is some variability in the precise form taken, but the broad 
pattern is that the evidence is brought forward by the 
counsel to the Crown who is assisted by consultants to 


the inquiry. The judge himself is assisted by two or three 
technical assessors. The terms of reference are usually to 
establish the cause and to make recommendations for the 
prevention of any recurrence. 

The judge receives requests from parties who wish to be 
represented and then gives a ruling on who the parties are 
to be. Typical parties might be the operator, other industrial 
companies, government bodies, trades unions and repre¬ 
sentatives of survivors and relatives. Each party is repre¬ 
sented by a barrister, typically a Queen’s Counsel (QC), who 
is supported by a solicitor and usually by experts. 

Witnesses are brought forward by Crown counsel and by 
other parties and can be cross-examined by the parties. In 
this sense, the procedure resembles the adversarial process 
in the law courts. 

27.9.2 Critique of public accident inquiries 
The Flixborough inquiry (R.J. Parker, 1975) found that 
the disaster was due to a large release of hot, flashing 
cyclohexane from a 20 in. pipe, which gave rise to a massive 
vapour cloud explosion. This pipe was an inadequately 
supported bypass assembly consisting of a dog-leg pipe 
between two expansion bellows. The inquiry also found 
that this release was caused by pressure and temperature 
conditions in the pipe itself more severe than those that 
had previously prevailed. An alternative theory was put to 
the inquiry by Gugan and Cox that the assembly failed fol¬ 
lowing prior rupture of a nearby 8 in. line, but the inquiry 
rejected it. A third theory was advanced at the time by 
R. King (1975a) that the cause was superheating of water in 
the reactor upstream of the pipe, but the inquiry did not 
pursue this hypothesis.The inquiry left proponents of these 
last two hypotheses dissatisfied with the way in which the 
technical evidence had been handled, and this gave rise to 
some debate in the engineering press at the time. 

In consequence a view emerged and gained some support 
in the engineering profession that a public inquiry, with its 
adversarial legal process, is not the best forum in which to 
arrive at the truth about engineering matters. This view 
was urged after the Flixborough inquiry by Mecklenburgh 
(1977) and has been argued again with reference to the 
same inquiry by R. King (1990). 

The critique given by King is broadly as follows. Many of 
the legal representatives at the inquiry are retained by 
interested parties. The presumption must be that the latter 
are concerned to protect their interests. A party may have 
an interest in ruling out a given cause and/or establishing 
another one. This situation is liable to lead to the investiga¬ 
tion of improbable theories urgedby particular parties at the 
expense of more probable explanations and thus to an 
imbalance in the investigation. Some persons whose impar¬ 
tial expertise would be valuable may not be called to give 
evidence because they are prevented by their employers or 
counsel or by the inquiry procedures. The inquiry itself is 
not accountable and there is no means of reopening it if 
its conclusions are subsequently found to be incomplete 
or incorrect. 

The alternative model for technical investigation urged 
by Mecklenburgh draws on the procedure used in civil 
aviation. Aircraft accidents are investigated by the Acci¬ 
dent Investigation Branch (AIB) of the Department of 
Trade.The AIB is directly responsible to the minister and is 
not part of the CAA. The Chief Inspector of Accidents pres¬ 
ents a report directly to the minister. The investigations 
of the AIB are inquisitorial not adversarial. The inspectors 
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have considerable powers to obtain evidence and inspect 
wreckage. Provision is made for persons whose reputation 
may be affected, such as the pilot, to make representations 
before the report is submitted. 

The Flixhorough inquiry handled the investigation of 
certain technical aspects by using a management commit¬ 
tee that organized meetings of technical experts. This work 
went on in parallel with the main inquiry. Mecklenburgh 
argues that it would have been both practical and prefer¬ 
able for the technical investigation to have been completed 
before the public inquiry proper. This technical investiga¬ 
tion would have dealt with the theories concerning the 
cause of the rupture of the 20 in. pipe. Mecklenburgh 
recognizes that there are usually human and management 
reasons for an accident. These he considers proper subjects 
for a public inquiry. He does not suggest that the latter be 
dispensed with but only that it should start only after the 
technical investigation has been completed. He, therefore, 
proposes that it should be required by regulation that the 
public inquiry be preceded by a technical investigation 
conducted by a specialist unit within the HSE. The techni¬ 
cal inquiry could, of course, be dispensed with if the tech¬ 
nical reasons for the accident are clear. This would leave the 
inquiry free to concentrate on the human and management 
aspects. 

On the other hand, several engineers who have been 
involved as technical assessors on public inquiries have 
spoken in their favour. Davidson (1984), who was an 
assessor on the Flixborough inquiry, states: 

I do not share the view, expressed widely, that an engineer 
or a scientist, or a committee of them, would form a more 
effective Court of Inquiry than the existing type. As part 
of the Flixborough Inquiry there was a management 
committee to oversee tests and discuss the scientific side 
of the Inquiry. Representatives of the major parties were 
included. This committee was useful but very difficult to 
manage: everyone had preconceived ideas as to tests 
and how they should be run. There was not the well- 
established framework of rules evolved by lawyers over 
the centuries for orderly cross-examination. Of course 
some accident inquiries - e.g. for railways, mines and 
aircraft - are run by engineers or scientists. But such 
investigations have quasi-legal powers: the chairmen 
have by long experience become engineer/judges and 
conduct their inquiries much like a court of law. On bal¬ 
ance I was impressed by the procedure at the Flixborough 
Inquiry and felt that an inquiry is best run by lawyers. 

Support for the present system is also expressed by 
Crossland (1991), an assessor on the King’s Cross inquiry. 

27.9.3 Piper Alpha inquiry 

The nature of a public inquiry into a major disaster may be 
illustrated by considering the Piper Alpha inquiry (Cullen, 
1990). This was a large inquiry, as shown by some of the 
statistics. The inquiry sat for 180 days extending over 
13 months. It heard evidence from 260 witnesses and had 
some 842 documents before it. 

Piper Alpha involved a release of flammable gas, which 
ignited and exploded, and initiated a long and complex 
chain of escalation. The resultant emergency had many 
facets, including the assembly in the accommodation 
module and the escape and rescue. It was therefore a very 
different type of accident from Flixborough. 


The assessors to the inquiry were an experienced oil 
man who had just retired as managing director of a large oil 
company, the production director of a large petrochemical 
company, and an academic specializing in SLP but with 
13 years industrial experience. The team was thus well 
balanced, containing two industrialists and one academic 
or, viewed from another angle, one from the oil industry 
and two from outside it. 

The inquiry was in two parts. Part 1 dealt with the acci¬ 
dent itself, its causes, its escalation and the emergency to 
which it gave rise, whilst Part 2 dealt with the deeper 
causes. Prior to Part 1, the judge announced that the inquiry 
would be considering in Part 2 the following subjects with a 
view to making recommendations: (1) the location and pro¬ 
tection of accommodation, (2) the means of mitigating the 
effects of explosions, (3) the means of ensuring the integ¬ 
rity of emergency systems, and (4) the means of ensuring 
full and safe evacuation. As the evidence in Part 1 unfolded, 
he added (5) permits-to-work, (6) control of the process, 
(7) risk assessment and (8) the offshore safety regime. 

The assembly of the evidence was a major logistical 
exercise.The inquiry was seeking to determine the cause of 
an explosion that could have come from a leak through a 
hole of no more than a few square millimetres. But with 
most of the platform at the bottom of the sea, it was neces¬ 
sary to decide whether to recover the process equipment; 
the inquiry decided against doing this. The main accom¬ 
modation module had, however, been lifted from the sea¬ 
bed. A major, and almost archaeological, exercise took 
place to recover the documents in this module. The docu¬ 
ments believed to be relevant to the inquiry were specified 
and assembled by the consultants to the inquiry who cre¬ 
ated a library available to the parties. 

The interviewing of the witnesses and the preparation of 
witness statements was another major activity. Evidence 
was given to the inquiry by 58 of the 61 survivors, and the 
other three gave written statements. The inquiry also heard 
from 38 witnesses to the emergency, 5 eye-witnesses who 
observed and photographed events, 8 persons from other 
nearby installations, 32 current and former employees of 
the operating company on a variety of technical and man¬ 
agement matters, 14 current and former employees of other 
companies, 35 expert witnesses and 6 witnesses on behalf 
of regulatory and other bodies. 

The evidence given in Part 1 by the witnesses not called 
as experts covered a range of topics: the practices of the 
company; the activities on the platform in the preceding 
days; the activities and events immediately prior to the 
explosion; the explosion itself and its effects; the escalation 
of the events from the initial explosion to the abandonment 
of the platform; the behaviour of the communications sys¬ 
tems and of the emergency systems for shut-down and fire 
fighting; the development of and response to the emer¬ 
gency on the platform; the escape from the platform; the 
response of the fire fighting vessel Tharos which was near 
the platform at that time; the response of personnel on the 
nearby, linked platforms; and the rescue. In many cases, a 
single witness had significant evidence on a number of 
these topics. 

The interim report by the Department of Energy indi¬ 
cated two principal hypotheses for the leak of hydro¬ 
carbons. One was that a leak occurred from the end of a 
relief line on a condensate pump where a pressure relief 
valve had been removed, because the blind flange at that 
point was not leak-tight or was missing altogether. 
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The other was that liquid condensate had backed up into a 
reciprocating compressor and caused damage and a leak. 

The inquiry began to hear expert evidence at a quite 
early stage, interleaved with evidence from the expert wit¬ 
nesses. This covered, among other things, the interpreta¬ 
tion of eye-witness evidence on the site, fuel, nature and 
strength of the initial explosion; the damage to and behav¬ 
iour of the emergency power and shut-down systems; the 
gas cloud which formed in the module; the pressures gen¬ 
erated by and general behaviour of this gas cloud; the 
damage to the walls of the module; the missile effects from 
the explosion; the pressures and flows in the gas and oil 
pipelines into and out of the Piper platform; the behaviour 
of hydrates, with special reference to the conditions on the 
platform; and various aspects concerning the relief line on 
the condensate pumps. 

As an illustration of the mix of witnesses, the first eight 
called were: (1) a diver (survivor), (2) a detective inspector, 
(3) a former deputy offshore installation manager, (4) a 
manager at Lloyds Register, (5) a lead maintenance techni¬ 
cian, (6) an expert on explosion modelling, (7) an expert on 
gas detectors and (8) an electrician (survivor). 

In public inquiries, generally, the chairman is able to 
exercise control and ensure balance by indicating those 
topics in which the inquiry is interested and those in which 
it is not. A degree of latitude may he allowed to parties to 
explore particular issues. In making these decisions the 
chairman is advised by the assessors. At the end of the day, 
the final report is that of the judge alone. Nevertheless, it is 
the assessors’ responsibility to advise him on the technical 
issues. In this sense, an assessor has ownership of the 
problem. This concentrates the mind and is a strong incen¬ 
tive to try to make sure that evidence is as balanced and 
complete as possible and that the arguments are in place to 
support both the positive and negative conclusions. It can 
occur that different hypotheses for the cause are enter¬ 
tained until a quite late stage or that some hypotheses are 
discarded but fresh ones are taken on board. 

Firm control was exercised in the Piper Alpha inquiry. 
The inquiry does not appear to have been seriously criti¬ 
cized either for omitting matters which ought to have been 
considered or for examining particular matters, and espe¬ 
cially matters raised by interested parties, to the point of 
imbalance. The report shows that there was an examina¬ 
tion of a wide range of hypothetical leak scenarios, many 
prompted by non-expert witness evidence, and that several 
fresh scenarios were given consideration, notably one in 
which the leak was the result of a chain of events initiated 
by hydrate blockage and another in which pipework suf¬ 
fered overpressure from a methanol injection pump. But 
there is little evidence of the pursuit of issues arising from 
special pleading by parties. 

The inquiry did make use of the system of meetings of 
technical experts, but only on two occasions. Each was 
chaired by an assessor. The topics at the two meetings were 
flows in certain pipelines and the scenario of condensate 
entry into a reciprocating compressor. The purpose of the 
meetings was to define the areas of agreement and dis¬ 
agreement. In both cases, there were technical reports to 
consider but the meeting did not deal with experimental 
work. At the second of these meetings, the experts reached 
the agreement that the scenario involving ingestion of 
liquid condensate into a reciprocating compressor could be 
ruled out. This conclusion was given in evidence to the 
inquiry and its report accepts this view. 


A considerable amount of experimental work was pre¬ 
sented in evidence. The inquiry heard about work com¬ 
missioned by the operating company on the nature and 
strength of the initial explosion, which included explosion 
simulation, on the explosion damage to the fire walls, on 
missiles from these walls, on the failure of the Tartan gas 
riser and on the leak potential of various configurations of 
blind flange and on further explosion simulation work done 
for the Department of Energy. The inquiry itself commis¬ 
sioned wind tunnel tests to determine the gas cloud which 
might be expected to form given various leak scenarios and 
the consistency of this with the gas detector evidence. It 
also commissioned a single explosion simulation for a sce¬ 
nario of a leak at the pressure relief valve site, due either to 
a non-leak tight blind flange or to a hydrate-initiated event. 

The Piper Alpha Report concluded that, on balance of 
probability, the leak occurred from the site of the missing 
pressure relief valve where the blind flange was not leak- 
tight. An explanation of this scenario was given which 
showed that it was possible to tie up quantitatively the leak 
rate from a non-leak-tight blind flange, the gas detector and 
wind tunnel evidence of a main leak preceded by a small 
leak, the size of the flammable gas cloud, the overpressure 
generated by explosion of that cloud, the damage done by 
the explosion and the effects experienced in the control 
room from that explosion. 

Among the recommendations made in the report were a 
change in the regulatory authority and a requirement for 
submission of a safety case, with a safety management 
system and quantitative risk assessment. 


27.9.4 Role of public accident inquiries 

The account given above makes clear that most accidents are 
in fact investigated outside the forum of a public inquiry. 
The HSE investigations appear in large part to accord with 
the intention of the system proposed by Mecklenburgh. The 
residual issue, therefore, concerns those process industry 
disasters that are on a scale sufficient to attract a public 
inquiry. Such disasters are rare events. They are likely to 
differ greatly one from another and the public inquiries held 
into them may, and probably should, differ also. 

The experience of the Piper Alpha inquiry is instructive. 
The most striking thing is that the technical issues and the 
human and managerial issues were interwoven in several 
ways. In many cases, a witness had evidence to give on both 
aspects. Witness evidence led to the consideration of fresh 
leak scenarios. A given scenario often involved both tech¬ 
nical and human and managerial aspects. 

Timing is another important feature. Time is required to 
decide on, schedule and obtain the evidence, both in docu¬ 
ments and from witnesses, and to allow the experts to pre¬ 
pare their evidence, which often constitutes a mini-research 
project and may involve physical or computer simulation. 
The chairman and the assessors need time to digest the evi¬ 
dence and come to a settled view. The interweaving of the 
technical with the other evidence provides this time. 

A third feature is the authority of a public inquiry. The 
inquiry can require the company involved to furnish docu¬ 
mentation that may bear on the accident. The documents 
may be large in number, some may be hard to locate and 
some may be sensitive. It can require the attendance of 
witnesses. Once at the inquiry these witnesses are on oath. 
Most have probably never been in a court of law, let alone a 
major accident inquiry. 
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This authority also allows the inquiry to exercise control 
to try to ensure that the treatment is as balanced and com¬ 
plete as possible. This control is needed in respect both of 
interested parties and of technical experts. 

Another aspect of authority relates to the fate of its report. 
Acceptance of the findings of the cause and of the recom¬ 
mendations to prevent recurrence depends in large part on the 
perceptionoftheinquiry by government, theindustry and the 
public. A public inquiry is better positioned to establish its 
authority than a technical investigation. This is doubly 
necessary where an inquiry recommends major changes in 
the regulatory regime or in the industry 

These considerations suggest that proposals for some 
form of separate technical investigation are unlikely to 
improve on the current form of public inquiry. What may be 
beneficial, however, is to recognize that there is consider¬ 
able variability in the accidents which occur and that the 
public inquiry procedure needs to be flexible enough in its 
way of working to accommodate this variability. 

27.10 Organizational Memory 

Experience shows that the investigation of accidents is not 
in itself sufficient to ensure that the lessons are both 
learned and retained in the collective memory. It is neces¬ 
sary to take specific measures to ensure that this occurs. 
The problem is considered here from the viewpoint of a 
company. The arrangements necessary at national level are 
described elsewhere in this chapter. 

Approaches to the problem are discussed in Lessons from 
Disaster by Kletz (1993b) and (1980g, 1982J, 1993c), 
R.W. Fawcett and Kletz (1982) and Hancock (1989,1992). 

The reduction of accidents is to a large extent a matter of 
applying what is already known. Unfortunately, within an 
organization this knowledge often decays. Sometimes it is 
an individual who is unaware, even though the matter is 
well known in many parts of the organization. Sometimes 
the organization as a whole appears to have forgotten. In 
Kletz’ words ‘Organizations have no memory’. 

Kletz has also put the matter even more graphically. 
During his time as a safety adviser, he was often tempted to 
tell a manager on whose plant a familiar accident had hap¬ 
pened: ‘Don’t bother to write the accident report. I’ll send 
you a copy from my files’. 

The first step in countering this problem is to ensure that 
the right lessons are drawn about the accidents that have 
already occurred, in the company and elsewhere. The need 
to get down to the fundamental causes was the main theme 
of Sections 27.5 and 27.8. 

Measures aimed at making sure that the lessons are not 
forgotten but remain fresh in the collective memory are 
described by Kletz (1993b). Starting from receipt of the 
report, they may be summarized as follows.The immediate 
actions should be to (1) follow up the recommendations and 
(2) publicize the lessons. In order to keep the accident fresh 
in the memory, steps should be taken periodically to (3) 
hold workshops in which it is discussed and (4) describe it 
in the company SLP newsletter. Measures may also he 
taken to (5) introduce a reference to the accident in any code 
that contains provision derived from it and (6) create a data¬ 
base of accident case histories that gives company per¬ 
sonnel easy access to them. Management should (7) avoid 
turning a blind eye to unacceptable work practices and 
(8) before removing equipment or ending a procedure, find 
out what its original purpose was. 


There are a number of recurring themes in accident 
investigation and it is helpful to be aware of these. Some 
themes which run through the work of Kletz and which he 
has highlighted explicitly are shown in Table 27.3. 

27.11 Case Histories 

Case histories are critical to the learning process. Without 
this lifeblood, the process would soon shrivel and die. Case 
histories, and their sources, are described in Appendix 1. 

27.12 Information Exchange 

Learning can take place only if information on accidents 
and accident investigations is made freely available by the 
publication of reports and by schemes for information 
exchange. 

27.12.1 Loss Prevention Bulletin 

A principal information exchange scheme is that operated 
by the Loss Prevention Panel of the Institute of Chemical 
Engineers (IChemE). The Loss Prevention Bulletin (LPB) 
published by the panel contains articles on various aspects 
of SLP, but above all it gives case histories of accidents with 
accompanying analyses. The titles of the articles in the 
bulletin are listed after the references given at the end of 
this book. 


Table 27.3 Some recurring themes in accident 
investigation (after Kletz) 


A Some recurring accidents associated with or 
involving 

Identification of equipment for maintenance 

Isolation of equipment for maintenance 

Permit-to-work systems 

Sucking in of storage tanks 

Boilover, foamover 

Water hammer 

Choked vents 

Trip failure to operate, neglect of proof testing 

Overfilling of road and rail tankers 

Road and rail tankers moving off with hose still connected 

Injury during hose disconnection 

Injury during opening up of equipment still underpressure 

Gas build-up and explosion in buildings 

B Some basic approaches to prevention 

Elimination of hazard 
Inherently safer design 
Limitation of inventory 
Limitation of exposure 
Simple plants 
User-friendly plants 
Hazard studies, especially hazop 
Safety audits 

C Some management defects 

Amateurism 

Insularity 

Failure to get out on the plant 

Failure to train personnel 

Failure to correct poor working practices 
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27.12.2 Trend in publication 

According to Kletz (1993b), the number of accident case 
histories published is diminishing. Unless this trend is 
reversed, the industry’s learning process will be severely 
impaired. 

Kletz deals in detail with the justification for the pub¬ 
lication of accident reports, the reasons for the fall-off and 
the measures that should be taken to counter it. 

27.13 Accident Databases 

The accessibility of accident case histories is much 
enhanced by the creation of accident databases, particu¬ 
larly computer-based databases. 

27.13.1 Major databases 

There are a number of major accident databases such as 
the Major Hazard Incidents Data Service (MHIDAS), the 
Explosion Incidents Data Service (EIDAS) and the Envi¬ 
ronmental Incidents Data Service (EnvIDAS) of the Safety 
and Reliability Directorate (SRD); the Failure and Accident 
Technical Information System (FACTS) of TNO; the Major 
Accident Reporting System (MARS) of the Commission of 
the European Communities (CEC); and World Offshore 
Accident Database (WOAD) of Veritas OffshoreTechnology. 
An account is given in Appendix 1. 

27.13.2 Company databases 

A number of companies have developed their own accident 
databases, either confined to accidents that have occurred 
in the company or extended to include other accidents. An 
account of such a database in ICI has been given by 
R.W Fawcett and Kletz (1982). 

27.14 Safety Performance Measurement 

Turning from accident investigation to the feedback of infor¬ 
mation about safety performance in a company, the first 
requirement is for methods of measuring it. Accounts of safe¬ 
ty measurement are given in Managing Safety (HSE, 1981d) 
andTechniquesofSafetyManagement(D.Fetersen,1989). 

27.14.1 Safety performance metrics 

The safety performance criteria that is appropriate to use 
are discussed in Chapter 6. For personal injury, the injury 
rate provides one metric, but it has little direct connection 
with the measures required to keep under control a major 
hazard. For the latter, what matters is strict adherence to 
systems and procedures for such control, deficiencies in the 
observance of which may not show up in the statistics for 
personal injury. However, as argued in Chapter 6, there is a 
connection - this is that the discipline which keeps per¬ 
sonal injuries at a low level is the same as that required to 
ensure compliance with measures for major hazard control. 

There needs, therefore, to be a mix of safety performance 
criteria. Those, such as injury rate have their place, but 
they need to be complemented by an assessment of the per¬ 
formance in achieving safety-related objectives. Safety 
performance criteria are discussed in detail by Petersen. 
Different criteria are required for senior management, 
middle management, supervisors and workers. He lists the 
desirable qualities of metrics for each group. 

Any metric used should be a valid, practical and cost- 
effective one. Validity means that it should measure what it 
purports to measure. One important condition for this is 


that the measurement system should ensure that the pro¬ 
cess of information acquisition is free of distortion. 

Qualities required in a metric for senior management are 
that it is meaningful and quantitative, is statistically reli¬ 
able and thus stable in the absence of problems, but 
responsive to problems and is computer-compatible. 

For middle management and supervisors, the metric 
should be meaningful, capable of giving rapid and constant 
feedback, responsive to the level of safety activity and 
effort, but sensitive to problems. 

A metric that measures only failure has two major 
defects. The first is that if the failures are infrequent, the 
feedback may be very slow. This is seen most clearly where 
the criterion used is fatalities. A company may go years 
without having a fatality, so that the fatality rate becomes 
of little use as a measure of safety performance. The second 
defect is that such a metric gives relatively little feedback to 
encourage good practice. 

A safety performance metric may be based on activities 
or results. The activities are those directed in some way 
towards improving safety practices. The results are of two 
kinds, before-the-fact and after-the-fact. The former relates 
to the safety practices, the latter to the absence or occur¬ 
rence of bad outcomes such as damage or injury. 

Metrics for activities or before-the-fact results may be 
based on the frequency of some action such as an inspec¬ 
tion or the frequency of a safety-related behaviour, such as 
failure to wear protective clothing. Or, they may be based 
on a score or rating obtained in some kind of audit. 

27.14.2 Some incident-based metrics 

There are numerous metrics that can be devised based on 
incidents such as damage or injury. The first requirement 
for such a measure is a clear definition of the events to be 
recorded. 

The incidents measured may include various forms 
of injury event and reportable accidents. Types of injury 
event include first aid treatments, lost time accidents, ser¬ 
ious injury accidents and fatalities. Types of reportable 
accident are those for which there are statutory reporting 
requirements and those for which there is, in addition, a 
company reporting requirement. 

Some metrics commonly used in the United Kingdom 

Mi = nrJNp [27.14.1] 

M 2 =N VU /N b [27.14.2] 

M 3 = » hl /A h [27.14.3] 

where Mi, M 2 and M 3 are metrics, «hi is the number of 
hours lost, «ita is the number of lost time accidents, « ra is 
the number of reportable accidents, Ah is the number of 
hours worked and N p is the number of persons at risk. 

27.14.3 Organization of measurement 

There needs to be a formal system for the measurement of 
safety performance. This may be organized in various 
ways. In particular, systems differ in the division of 
responsibility between line management and the safety 
function. 

It is normal for line management to measure, and report 
on, production performance and it may well do the same on 
safety performance. This is the preferred method in the 
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arrangements described by the HSE (1981d). If it is adopted, 
its operation should be subject to audit by the safety 
function. 

The HSE states ‘The most frequently encountered diffi¬ 
culty in applying measuring schemes is for a manager to 
separate his own performance as an individual from that of 
his team’. The way in which this problem is resolved 
depends on the culture of the particular company. 


A particular formulation of chi-square for this case 
(Moroney, 1956, p. 255) is 


*2 


[x\{n 2 - x 2 ) - x 2 (»i - *i)] 2 («i + n 2 ) 
n\n 2 {x\ + x 2 ) («i + n 2 -x 1 - x 2 ) 


(. x i - kx 2 f 

Mxi + xz) 


[27.15.2] 

[27.15.3] 


27.15 Safety Performance Monitoring 

Given that performance is to be assessed by measuring 
events, such as failures or accidents, then probability theory 
may be used to determine whether there has been an 
improvement or deterioration in performance as between 
two situations. 

27.15.1 Statistical measures 

An account of the methods that may be used to detect 
changes of performance has been given by Wynn (1950). If 
over a given reference period in a population of size n the 
observed number of events x has been sufficiently large 
that the expected number of events, g ( =x/n ) is firmly 
known, then the Poisson distribution is applicable 


k = — [27.15.4] 

n 2 

The system described here has one degree of freedom, and 
for this the values of the chi-square are: 


Confidence level (%) 

l 2 

90 

2.706 

95 

3.841 

99 

6.635 


P(r)=ex P(-A)J I 27 - 15 - 1 ] 

where P(r) is the probability of r events. The application of 
Equation [27.15.1] is facilitated by the use of Figure 27.3, 
which gives the observed number of events vs the expected 
number of events. It should be noted that although the 
curves drawn are continuous, the events to which they 
apply are integers. 

As an illustration of the use of Figure 27.3, consider the 
case where the expected number is 8. If the observed 
number is 10, the difference is not significant, but if the 
observed number is 15, this is significant at the 95% level. 

The use of the Poisson distribution in this way is per¬ 
missible only if the expectation g is known. The confidence 
with which the expected number of events is known 
depends on the observed number of events in the reference 
period. The determination of the confidence limits for the 
frequency of an event for use in the exponential or Poisson 
distribution was described in Chapter 7. Tables of the con¬ 
fidence limits of the Poisson distribution have been given 
by Woodcock and Fames (1970 UKAEA AHSB(S) R179). 

If there is no firm expectation, the Poisson distribution is 
not applicable, but the problem may be treated using the 
chi-square distribution. This distribution may be used to 
test the hypothesis that there is no difference between a 
reference period and a test period where the population size 
and the number of events in the reference period are »i and 
X\ and those in the test period are n 2 and x 2 , respectively. For 
this case, the following chi-square table is applicable: 



No. affected 
by event 

No. unaffected 
by event 

Total 

Population 1 

Xl 

B) 

n\ 

Population 2 

x 2 

n 2 -x 2 

n 2 

Totals 

X\-\-X 2 

n 1 + n 2 -xi-x 2 

«l + «2 


The application of Equation [27.15.3] is facilitated by the 
use of Figure 27.4, which gives the group (*i -kx 2 ) vs the 
group k(x\ +x 2 ). 

As an illustration of the use of Figure 27.4, consider the 
case where in the reference period the population size is 
1000 and the number of events is 55, and in the test period 
the corresponding values are 1000 and 45. Then, the values 
of k and of the groups ( x\—kx 2 ) and k(x\+x 2 ) are 1,10 and 
100, respectively. This difference is not significant, but if 
the numbers of events in the reference and test period are 
60 and 40, respectively, the difference is significant at the 
95% level. 

The chi-square method becomes inaccurate if the num¬ 
ber of events in the cells of the chi-square table falls too low. 
The number should exceed about 20, or for approximate 
work about 5. 

It should be noted that the quantity investigated using 
the methods just described is the number of events, not the 
event rate. It is also emphasized that the validity of any 
conclusions drawn depends on the correct choice of the 
variable that describes the population size. If in a parti¬ 
cular case, for example, it is assumed that the number of 
maintenance accidents depends on the number of main¬ 
tenance personnel, whereas in reality it depends on some 
other factor such as the number of maintenance tasks done, 
then incorrect conclusions may be drawn. 

27.15.2 Vigilance against rare events 

The more serious accidents are rare events, and the absence 
of such events over a period must not lead to any lowering of 
guard. There needs to be continued vigilance. 

The need for such vigilance, even if the safety record is 
good, is well illustrated by the following extract from the 
‘Chementator’c6lvmnofChemicalEngiwering(1965Dec. 20, 
32) Reproduced with permission of Chemical Engineering: 
The world’s biggest chemical company has also long been 
considered the most safety-conscious. Thus a recent 
series of unfortunate events has been triply shattering to 
Du Font’s splendid safety record. 











the ct 

N.J..C; 

250 

240 

230 

220 

210 

200 

190 

180 

170 

160 

150 

2 140 

S 130 

"8 120 

1 110 

100 

90 

70 

60 

50 

40 

30 

20 

10 

0 

( 

Figure; 

Wynn, 1 


NFORMATION FEEDBACK 27/21 


:st incident occurred earlier this month when adust 
lion and flash fire in a dyestuff drying machine at 
mpany’s immense Chambers Works, Deepwater, 
msed some $50,000 damage, claimed two lives and 


injured nine more, three seriously Ironically, in August 
of this year the plant had received an award from the 
governor of New Jersey for achieving 16,771,355 man 
hours worked without a single lost time accident. 



Graph (coarse scale) for the determination of trends in safety performance: Poisson distribution (after 
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ite November, a flash fire swept the drying room 
company’s Carney Point, N.J., gunpowder plant. 
?e was relatively light but four workmen 
ed. In operation before the turn of the century, 


the plant had had no fatal accidents since before 
World War I. 

The earliest of the triple tragedies was a blast and fire 
at the firm’s Louisville plant in August. Claiming 11 lives 
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Figure 27.4 Graph for the determination of trends in safety performance: chi-square distribution (after Wynn, 1950) 


and causing $5 to $10 million damage, the accident’s 
magnitude was without precedent in the company’s 
history. 


27.16 Near Miss Reporting 

It has long been appreciated that for every accident there 
are many lesser events, some with less material effect and 
others with no effect at all, and that is desirable to learn 
from these ‘near misses’. 

Accounts of the monitoring of and learning from near 
misses are given in Near Miss Reporting as a Safety Tool 
(van der Schaaf, Lucas and Hale, 1991) and by N. Carter and 
Menckel (1985). 

Near Miss Reporting contains in effect a debate on the 
subject and poses the question of the purpose of such 
reporting. 

27.16.1 Licensee Event Reports 

One of the main public sources of information on near 
misses is the Licensee Event Reporting system of the 
Nuclear Regulatory Commission. Analyses of Licensee 
Event Reports (LERs) have been given by Rasmussen 
(1980b), who has also used the information given in these 
reports in his development of a methodology for the han¬ 
dling of human error. 

27.16.2 Models for reporting 

A system of near miss reporting must specify in some way 
the events to be reported and must, therefore, be based, 
explicitly or implicitly, on some form of model. Three prin¬ 
cipal forms of model are (1) the engineering system, 

(2) human behaviour and (3) the managerial and organiza¬ 
tion factors. Each type of model is represented in the 
account that follows. 


27.16.3 Aims of reporting 

It is suggested by van der Schaaf (1991c) that near 
miss reporting may be undertaken for three different 
purposes: (1) modelling (qualitative insight), (2) monitoring 
(quantitative insight) and (3) motivation (maintaining 
alertness). 

If the aim is modelling, the interest centres on reporting 
of ‘new’ types of near misses, whereas if it is monitoring, 
the implication is that it is known types that are reported. 
The third aim, motivation, differs from the other two in 
that it is essentially a by-product of the reporting, albeit an 
intended one. The activity of reporting near misses makes 
people more conscious of them. 

The author gives an account of a near miss management 
system which is aimed at monitoring rather than model¬ 
ling, but which should have as a by-product an increase in 
motivation amongst those involved in the reporting. 

27.16.4 Near miss management system 

A description is given by van der Schaaf (1991b) of a near 
miss management system (NMMS). The concepts under¬ 
lying this are that its sole function should be as a means for 
the organization to learn from near misses, that is should 
have as comprehensive a coverage as possible of the inputs 
and outputs, that it should be based on a suitable model of 
human behaviour and that it should be integrated into, 
rather than grafted onto, the organization. The modules of 
the framework for the NMMS are: 

(1) Detection: recognition and reporting. 

(2) Selection: according to purpose(s). 

(3) Description: all relevant hardware, human and orga¬ 
nizational factors. 

(4) Classification: according to a socio-technical model. 

(5) Computation: statistical analysis of large database of 
incidents to uncover certain (patterns of) factors. 
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(6) Interpretation: translation of statistics results into 
corrective and preventive measures. 

(7) Monitoring: measuring the effectiveness of proposed 
measures after their implementation. 

Further features of the NMMS are described by van der 
Schaaf (1991a) in an account of its application in a chemical 
plant, and specifically in the central control room. The 
detection module is essentially a redesigned version of an 
existing near miss reporting system. The selection module 
allocates the event to the modelling or monitoring mode. 
The description module utilizes a form of fault tree, termed 
an incident production tree, which contains as elements not 
only faults and errors but also recoveries, as described 
elsewhere by van der Schaaf (1988). The classification 
module is based on Rasmussen’s Skills-Rules Knowledge 
(SRK) model of human behaviour. The classification pro¬ 
ceeds in two stages. In the first stage, a rough classification 
is made into (1) technical factors, (2) organizational factors 
and (3) behavioural factors. Each element in the incident 
production tree is then examined according to the following 
procedure. It is first considered for classification as a tech¬ 
nical factor, and if it is such, it is assigned to a subcategory 
such as engineering, construction, etc.; if this does not 
apply, it is considered for classification as an organiza¬ 
tional factor; if this also does not apply, then and only then 
is it considered for classification under the third category 
as a behaviour factor. 

27.16.5 Computer aid for reporting 

The practicalities of near miss reporting and a computer- 
based aid influence diagram analysis (IDA) for such 
reporting are described by A.R. Hale et al. (1991). This work 
complements that of van der Schaaf just described and 
utilizes the same framework modules. 

A problem with near miss reporting is that if a proforma 
is used, most of the entries are not relevant to a given event. 
This can be overcome by the use of a computer aid in which 
the user is prompted to enter information interactively. 

The accident model used in this case is a hybrid derived 
partly from the energy barrier concept found in MORT 
(W.G. Johnson, 1980) and partly from the concept of devia¬ 
tion from normal conditions (Kjellen, 1983; A.R. Hale and 
Glendon, 1987). 

27.16.6 Critiques of reporting 

A critique of near miss reporting has been given by Reason 
(1991), who argues that current reporting schemes, where 
they exist, tend to be relatively ineffective in supporting 
safety management. 

He distinguishes between active failures that have an 
immediate adverse effect, and latent failures which lie as 
dormant, enabling conditions until the accident is trig¬ 
gered by an active failure. He likens latent failures to resi¬ 
dent pathogens in the human body. He argues that the most 
effective approach to the prevention of accidents is to iden¬ 
tify and neutralize these pathogens. 

Reason utilizes an accident model in which a distinction 
is made between failure types and failure tokens. In 
essence, the failure types are general classes of managerial 
and organizational failure, whilst the tokens are specific 
failures of individuals. The latter are categorized as slips 
and lapses, mistakes and violations. 

He considers five channels for system safety informa¬ 
tion. These channels are (1) accident and incident reporting 


systems, (2) unsafe act and near miss reporting systems, 

(3) precursors of unsafe acts, (4) failure type indicators and 
(5) stylistic or cultural indicators. The precursors of chan¬ 
nel 3 are described in terms similar to those applied to 
performance shaping factors. The failure types of channel 4 
are the classes of managerial failure. The cultural indica¬ 
tors of channel 5 are described in terms of a seven-point 
ranking scale, which ranges from a condition where safety 
practices are at the barest industry minimum to one where 
good practice is followed. 

The general failure types are (1) hardware defects, 
(2) design failures, (3) poor maintenance procedures, 

(4) poor operating procedures, (5) error-enforcing condi¬ 
tions, (6) poor housekeeping, (7) incompatible goals, 

(8) organizational failures, (9) inadequate training and 
(10) inadequate defences. 

Reason argues that the key to effective safety manage¬ 
ment lies in appreciating what is controllable and what is 
not. He contrasts the situation in respect of accidents with 
that pertaining in production. Most of the factors that 
affect production are under the control of management. 
Accidents are different. They arise from a complex inter¬ 
action between latent failures and local triggering events. 
There is little management can do about the latter. It should 
concentrate on the former, and any near miss reporting 
system should reflect this. What should be reported are 
failures at the level of channels 4 and 5. 

The need to base near miss reporting on an appropriate 
model is echoed by Lucas (1991), who proposes reporting 
based either on the man-machine interface or on system- 
induced error. 

27.16.7 Hazard warning structure 

Another approach to near miss reporting is the hazard 
warning structure developed by Lees (1982b, 1983b, 1985). 
The basic concept is that the undesired event is modelled 
using a hazard warning tree, a specialized form of fault 
tree, so that the place of lesser events in the hazard warning 
structure can be seen. An account of hazard warning 
structure with examples is given in Chapter 9. 

The hazard warning concept is intended to be used first 
in the design of plant and to be then carried through into its 
operation. If at the design stage an analysis has been made 
of the hazard warning structure for the undesired events 
of interest, it is then possible to use the analysis to locate 
lesser events as they occur in the structure, to assess their 
significance and to take measures to control them. 

The hazard warning structure approach is based on, 
and oriented to, fault trees for engineering systems. By 
comparison with the near miss reporting just described, 
it has the following distinguishing characteristics. The 
events to be monitored are decided in advance and are 
relatively well defined. Other events not included are not 
monitored, at least not as part of this particular exercise. 
The method does not address human errors as such 
but rather the effects of such errors on the engineering 
system. 

The incident production tree described above evidently 
has features in common with the hazard warning tree. 

27.17 Education 

The education of engineers normally includes some material 
on safety. In chemical engineering, this has traditionally 
tended to cover aspects such as legal requirements and 
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personal safety. There has also generally been some cover¬ 
age of the engineering aspects, particularly in design pro¬ 
jects, but overall the treatment has been variable. 

The occurrence of disasters such as Flixborough, Seveso 
and Bhopal has highlighted the need for greater awareness 
of and knowledge about SLP. These three accidents have 
had particular impact in the United Kingdom, Continental 
Europe and the United States of America, respectively. The 
trend has been for industry to urge universities to teach 
SLP and for professional bodies to introduce a requirement 
that SLP be part of the curriculum. 

Accounts of the treatment of SLP in university courses 
in chemical engineering have been given by Mewis (1984), 
Talty (1986), Kaufmann (1987), Kletz (19881,1990a), Crowl 
and Louvar (1989), Nolan (1989), VC. Marshall (1991c), 
Crawley and Scott (1992) and Lemkowitz (1992a,b). 

The inclusion of SLP in chemical engineering curricu¬ 
lum requires justification. The ACMH in its Third Report 
(Harvey, 1984) stated: 

It is important that students be introduced to the concept 
of inherently safer design and that they realize that safety 
in plant operation must be considered right at the start 
of the design study. Process safety must be taught in 
a rigorous, stimulating way by staff of appropriate 
experience. Departments that initially do not have this 
expertise may need to use the services of experts from 
other universities, industry and consulting firms. By 
virtue of the nature of processes that give rise to major 
hazards, it is the chemical engineer who often fills the 
position of responsible person in the design or operation 
of plant, (paragraph 124) 

Support for this view is given by Kletz (1981), who 
advances three principal arguments. One is the importance 
of treating safety from the outset as an integral part of the 
design of plant and of aiming for inherently safer design. 
Another is that whatever use he may make of other subjects 
taught at university, any practising chemical engineer will 
be involved in safety matters. He has a moral and legal 
responsibility and will probably be faced with safety issues 
from the first day. The third is that SLP involves basic 
principles. 

SLP involves the application of a quantitative approach 
and encourages numeracy. It is based on a structured 
approach that involves the identification of hazards, 
an estimation of their frequency, an estimation of the 
consequences and decision-making based on defined 
criteria. 

The need for an engineer to take a wider view of the task 
in hand is emphasized by Crawley and Scott (1992). Indus¬ 
try requires someone who is capable of reasoning and is 
aware of the factors involved and of the pitfalls. For exam¬ 
ple, in a design the student may well be able to calculate a 
flow in a pipe, but fail to give consideration to erosion, 
vibration, noise or isolation for maintenance. 

The need to achieve a cost-effective design is another 
factor. There is often almost no end to the safety measures 
that might be taken. The engineer needs a tool which 
assists in deciding how far to go. 

The view exists that even if the need for education in SLP 
is accepted, it is better done when the engineer first enters 
industry. However, the chemical engineer may well enter a 
firm that lacks the means of bringing him up to the level 
of SLP awareness and capability achievable at university, 
or one that does not have a safety culture. Even larger 


companies generally favour its inclusion in the university 
course. This does not, of course, obviate the need for the 
company to carry out its own training in SLP, particularly 
for new entrants. 

The extent to which SLP ranks as a mainstream 
subject in chemical engineering has been examined by 
V.C. Marshall (1991c). He argues that to qualify, a subject 
must meet the following criteria. It should (1) be acknowl¬ 
edged as such by the academic culture, (2) be recognized 
as relevant by students, (3) be intellectually demanding, 
(4) comprise a well established corpus of knowledge, 
organized on clearly defined unifying principles, (5) be 
highly quantitative and thus capable of being subjected to 
mathematical analysis, (6) possess a content and unifying 
principles set out in authoritative textbooks, (7) be taught 
by specialists, (8) be a compulsory subject which must 
normally be passed and (9) be examined formally. He goes 
on to consider the extent to which SLP now meets these 
criteria. V.C. Marshall (1987, 1989c, 1990d) has also 
attempted to develop the unifying structure which he 
calls for. 

Some objectives to be attained in teaching SLP and 
means used to achieve them include: 


Awareness, interest 
Motivation 

Knowledge 

Practice 


Case histories 
Professionalism 
Legal responsibilities 
Techniques 
Problems Workshops 
Design project 


There has been considerable debate as to whether SLP 
should be taught by means of separate course(s) or as part 
of other subjects. The agreed aim is that it should be seen as 
an integral part of design and operation. Its treatment as a 
separate subject appears to go counter to this. On the other 
hand, there are problems in dealing with it only within 
other subjects. It cannot be expected that staff across the 
whole discipline will have the necessary interest, knowl¬ 
edge and experience and such treatment is unlikely to get 
across the unifying principles. These latter arguments have 
weight and the tendency appears to be to have a separate 
course on SLP but to seek to supplement this by inclusion of 
material in other courses also. It is common ground that 
SLP should be an essential feature of any design project. In 
1983, the IChemE issued a syllabus for the teaching of SLP 
within the core curriculum of its model degree scheme. This 
syllabus was: 

Safety and Loss Prevention. Legislation. Management of 
safety. Systematic identification and quantification of 
hazards, including hazard and operability studies. Pres¬ 
sure relief and venting. Emission and dispersion. Fire, 
flammability characteristics. Explosion. Toxicity and 
toxic releases. Safety in plant operation, maintenance 
and modification. Personal safety. 

In 1988, the IChemE issued further suggestions for the 
teaching of SLP. The background to these is given by Nolan 
(1989) and Crawley and Scott (1992), who also give an out¬ 
line of the material proposed. 

The topics highlighted by Kletz (19881) as core material 
in SLP are inherently safer design, hazop, hazard analysis, 
human error and maintenance and modification. 
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The emerging pattern in the introduction of SLP into 
undergraduate courses appears to be an elementary treat¬ 
ment, perhaps within an overview course on chemical 
engineering, early on followed at some later point by a 
dedicated course on SLP. This is the approach described by 
Crawley and Scott and by Lemkowitz (1992a,b). 

Another subject that has many similarities to SLP is 
environmental protection. These similarities include the 
engineer’s moral and legal responsibilities, the concept 
of inherently cleaner design and a structured approach to 
environmental risks. There is a discernible trend, there¬ 
fore, to treat environmental protection in a manner 
broadly similar to, and sometimes in the same course 
as, SLP. 

The inclusion of SLP within a university chemical 
engineering course is not without its problems. One is 
the allocation of time within the timetable. The order of 
contact hours typically mentioned is some 4 hours for 
elementary treatment early on and 20 hours for a later 
dedicated course. 

The other main problem is the availability of staff able 
and willing to teach SLP. Such teaching requires both 
industrial experience and knowledge not only of the spe¬ 
cific discipline of SLP but of a number of core subjects. 
Only a small proportion of departments contain staff 
specializing in the subject. It is recognized, therefore, that 
there is need for support for staff teaching SLP. Two 
principal forms of support are the use of engineers from 
industry to complement the academic teaching and the 
provision of teaching material on the subject. 

SLP can serve as an integrating factor in a course. In this 
respect, it has much in common with a design project. Some 
of the regular chemical engineering subjects on which the 
teaching of SLP draws are: 

(1) mathematics; 

(2) thermodynamics; 

(3) fluid mechanics; 

(4) mass transfer; 

(5) heat transfer; 

(6) reaction engineering; 

(7) particle science and technology; 

(8) process instrumentation; 

(9) process dynamics and control; 

(10) human factors; 

(11) computer methods; 

(12) management; 

(13) engineer in society. 

Table 27.4 illustrates some of the links between SLP topics 
and regular chemical engineering subjects. 

Accounts of practice in particular courses are given by 
Kaufmann (1987), Kletz (19881) and Lemkowitz (1992a,b). 
Kaufmann describes the use of a number of mini-courses, 
taking some 10—15 min. The treatment described by 
Lemkowitz involves an integrated treatment of SLP and 
environmental protection and has three main parts. In the 
first, early part a problem is taken from the media or 
the literature and becomes a project for investigation by 
the student, which involves interviewing industrial per¬ 
sonnel about it. The second part is a dedicated course of 
lectures taking some 24 hours. The third part is a safety 
report that is submitted prior to starting on a laboratory 
project. 


Table 27.4 Some links between safety and loss 
prevention and other subjects in chemical engineering 


SLP topic 

Regular subject 

Inherently safer design: 

Chemical reactors 

Reaction engineering 

Separation processes 

Mass transfer 

System failure 

Reliability engineering 

Failure rates 

Probability theory 

Pressure vessels 

Properties of materials: 
Strength of materials 
Fracture mechanics 

Chemical reactors: 

Reaction runaway 

Reaction engineering 

Instruments 

Instrumentation 

Venting 

Fluid mechanics: 
two-phase flow 

Trip systems: 

Instrumentation 

Trip failure 

Reliability engineering 

Trip response 

Process dynamics 

Process operator 

Human factors 

Emission: 

Relief valve discharge 

Fluid mechanics: 
gas flow 

Flashing liquid 

Fluid mechanics: 
two-phase flow 

Vessel burst 

Mixing processes 

Vaporization: 

Volatile liquid 

Simultaneous heat and 
mass transfer 

Cryogenic liquid 

Unsteady-state heat 
transfer 

Dispersion 

Turbulence theory 

Fire 

Radiant heat transfer 

Explosion: 

Explosion energy 

Thermodynamics 

Adiabatic flame 

Thermodynamics 

temperature 

Toxicity: 

Toxicity testing 

Probability theory 

Computer aids: 

Plant design 

Expert systems 

Fault tree synthesis 

Graph theory 

Valve sequencing 

AI techniques 

Pressure systems management 

Management 

Risk criteria 

Engineer in society 


27.18 Teaching Aids 

There are available a number of teaching aids of various kinds, 
suitable for use in the education of engineers at universities 
and/or of engineers and other personnel in industry. 

Short introductions to SLP are given in Flowsheeting for 
Safety (Wells, Seagrave and Whiteway, 1976) and A First 
Guide to Loss Prevention (McCrindle,1981) and more sub¬ 
stantial texts include Industrial Safety Handbook (Handley, 
1977), An Introduction to Loss Prevention (Wells, 1980), 
Industrial Hazard and Safety Handbook (R. King and Magid, 
1979), Safety and Accident Prevention in Chemical Opera¬ 
tions (H.H. Fawcett and Wood, 1982), High Risk Safety 
Technology (A.E. Green, 1982b), Major Chemical Hazards 
(VC. Marshall, 1987), Chemical Process Safety (Crowl and 
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Louvar, 1990) and Safety in the Process Industries (R. King, 
1990), as well as the present book. 

A series of books by Kletz includes Cheaper, Safer Plants 
(Kletz, 1984d), Learning from Accidents in Industry (Kletz, 
1988h), What Went Wrong? (Kletz, 1988n), Improving Che¬ 
mical Engineering Practices (Kletz, 1990d), An Engineer’s 
View of Human Error (Kletz, 1991e), Plant Design for Safety 
(Kletz, 1991g), Hazop andHazan (Kletz, 1992b) and Lessons 
from Disaster (Kletz, 1993b). 

The IChemE has been active in the production of a 
variety of aids. Table 27.5 lists a computer simulation, open 
learning modules, slide modules and video training 
modules on various topics. Other aids include the infor¬ 
mation exchange scheme of the Loss Prevention Bulletin, 
the publications listed in Appendix 28, and many of the 
books by Kletz just mentioned. 

Another source of material is the CCPS of the American 
Institute of Chemical Engineers (AIChE). Specifically, 
educational material from this source includes Safety 
Health and Loss Prevention in Chemical Processes: Problems 
for Undergraduate Engineering Curricula - Instructor’s 
Guide (CCPS, 1990). 

There are available a number of films and videos, both on 
the process industries generally, and on SEP in particular. 
Some of these are listed in Table 27.6. 


Table 27.5 Some training aids for safety and loss 
prevention available from the IChemE 


1 Hazards of Over- and Under-Pressuring of 
Vessels (SL) 

2 Hazards of Plant Modifications (SL) 

3 Fires and Explosions (SL) 

4 Preparation for Maintenance (SL) 

5 Furnace Fires and Explosions (SL) 

6 Preventing Emergencies in the Process 

Industries (V, SL) 

7 Work Permit Systems (SL, B) 

8 Human Error (SL, B) 

9 Inherent Safety (V, SL, B) 

10 Handling Emergencies (CS) 

11 Safe Handling of LPG - Pt 1: Pressurized 

Bulk Storage and Road and Rail 
Loading (V,SL) 

12 Safer Piping - Awareness Training for the Process 

Industries (V, SL) 

13 Safe Handling of LPG - Part 2: Ship / Shore 

Transfer and Refrigerated Storage (V, SL) 

14 Practical Risk Assessment (OL) 

15 Hazop and Hazan (SL, B) 

16 Controlling Electrostatic Hazards (V, SL) 

17 Managing for Safety (V, SL) 

18 Safer Use of Chemical Additives (SL) 

19 Offshore Practical Risk Assessment (OL) 

20 Learning from Accidents (SL) 

21 Flammable Liquid Fire ... Don’t be a Victim (V) 

22 Dust Explosion Hazard (V, SL, B) 

23 Control of Exothermic Chemical Reactions (V SL, B) 

24 Tank Fires (SL) 

E04 Environmental Auditing (SL) 


B, book; CS, computer simulation module; OL, open learning module; 
SL, slide training module;!/ video training module. 


Table 27.6 Some training aids for safety and loss 
prevention: films and videos 


A HSE 


It Shall be the Duty (HSWA1974) 

All in a Day’s Work (work of Factory Inspectorate) 
Health at Work (work of EM AS) 

Protection of Eyes Regulations 
Guarding Machinery 
Principles of Machinery Guarding 
A Guide to Interlocking Guards 
Abrasive Wheels 

Watch that Space: Confined Space Hazards in Factories 
Control of Exothermic Chemical Reactions 


B Fire Protection Association 


Understanding Fire 


C Amoco 


Hazard of Air Hazard of Water 


D British Gas 


The Science of Flame - Principles 
The Science of Flame — Control 
The Frigg Story 

Too Good to Waste (North Sea gas) 
The Innovators 


E Conoco UK Ltd 


The Murchison Project (offshore oil) 


F Millbank Films (ICI) 


If One Green Bottle (management responsibility) 
Something to do with Safety Reps 
Talking of Safety (safety committees) 

When Fire Starts 

Toxic Hazards in Industry 

Permit-to-Work 

IsThere Anything I’ve Forgotten? (permit-to-work systems) 
Incident Rendered Safe (transport emergencies) 

Better than Cure (occupational health) 

Safeguard (machine guarding) 

One Last Shock (electrical safety) 

Make light of Lifting 
Mind Your Back (lifting) 

It Need not Happen (protective clothing) 

Air to Breathe (breathing apparatus) 

Rescue Team Alert 

One Million Hours (accident investigation) 

Nobody’s Fault (story of an accident) 

Flashpoint (laboratory safety) 


G Shell 


Oil Refinery 
Principles of Refining 
Petrochemicals: the Building Blocks 
Petrochemicals: Polymerization Reactions 


H Total Oil Great Britain Ltd 


Petroleum, its Refining 

Flames of the Desert (Middle East oil) 
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Table 27.6 (continued) n r! , 

Before the Derricks Rise (offshore oil) 

The Riddle of the Deep (offshore underwater) -'m 


I UK Atomic Energy Authority 


Principles of Fission Section 27. 

The Nuclear Fuel Cycle £ 

Safety and Nuclear Power n 

Nuclear Fuel Reprocessing p 


27.19 Notation X 2 

Section 27.14 

Afi, M 2 , M 3 metrics 

«hi number of hours lost Subscripts 

«i ta number of lost time accidents 1,2 


number of reportable accidents 
number of hours worked 
number of persons at risk 


15 

ratio defined by Equation [27.1.4] 
size of population 
probability 
counter 

observed number of events 
expected number of events 
chi-square 


population!, 2 
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Safety and loss prevention depend primarily on the overall 
management system, as described in Chapter 6 and 
also in other chapters. The people who carry the main 
responsibility for safety are the line managers rather than 
the safety specialists. At managerial, as at other levels, 
safety is everyone’s responsibility. There remains a need, 
however, within the management system for a specific 
safety organization and for safety personnel. The quality of 
this safety system can have a significant effect on safety 
performance. 

Selected references on process safety systems are given 
inTable 28.1. 


Table 28.1 Selected references on process safety 
systems (See also Tables 1.1, 6.1 and 27.1) 


ABCM (n.d./l, 1964/3); ILO (n.d.); Guelilch (1956); Simonds 
and Grimaldi (1963); H.H. Fawcett and Wood (1965); Sands 
and Bulkley (1967); CBI (1968); Leeah (1968); BCISC 
(1969/9,1973/12); Handley (1969,1977); Hearn (1969); 
Gilmore (1970); Freeman and Pickbourne (1971); Lloyd and 
Roberts (1971); R.L. Miller and Howard (1971); D. Petersen 
(1971-); D. Williams (1971); Kramers and Meijnen (1974); 
Health and Safety Executive (HSE) (1975 HSW Bklt 35); 
Cocks and Rogerson (1978); W.G. Johnson (1980); Messing 
(1980); Kletz (19811); Kilian (1982); London (1982);Willette 
(1982); Witter (1982);Tweeddale (1985 LPB 63); Harron 
(1986); Rausch (1986); E.K. Young (1986); McSween (1993) 

Safety officers, safety advisers 

Institution of Industrial Safety Officers (n.d.); ASSE 
(1966); J. Jones (1974); HSE (1976c); Kletz (1977g, 1982k); 
HSC (1983/2); Dawson, Poynter and Stevens (1985); D. 
Stevens (1986); D. Gray (1988); Hutcheon (1988) 

Safety policy statement 

BSC (n.d./8); CBI (1974); Egan (1975,1979); HSC (1975 
HSC 6,1982IAC/L1,1991 HSC 6) 

Trade unions and safety 

M.J. White (1969,1977); ILO (1971-72); Kinnersley (1973); 
Levinson (1975); TUC (1975); Cullen (1990) 

Safety committees 

HSC (HSC 8,1977/3); RoSPA (IS/32); Ministry of 
Labour (1968) 

Safety representatives 
HSC (HSC 9,1977/3); Egan (1978) 

Safety training 

Institution of Industrial Safety Officers (n.d.); BCISC 
(1965/5); Gimbel (1965b); Kingdon (1969); Atherton (1971); 
Burrage (1971); CAPITB (1971 Inf. Pap. 10,1975 Inf, Pap. 16); 
PITB (1975/1-3); ILO (1980a); Kubias (1982); A.R. Hale 
(1984); D.J. Lewis (1984e); Roy (1984); FPA (1989 CFSD 
MR9); Bhoonchaisri (1990); J.R. Taylor (1993) 

Organizational memory 

Kletz (1980g, 1982j, 1985i, 1993c) 

Communication 

Tye (1969); D. Williams (1971); Lowe (1985) 

Accident prevention 

NSC (n.d./2,1992/11); Devauchelle and Ney (1962); 

H.H. Fawcett and Wood (1965,1982); McElroy (1965) 


Proprietary systems 

International Safety Rating System (ISRS): Bird and 
Germain (1985); Bond (1988 LPB 80); Eisner and Leger 
(1988); D. Petersen (1989); Pringle and Brown (1990); 
Arnold, Redfearn and Maaren (1992); Bird (1992 LPB 103) 
MORT: W.G. Johnson (1977,1980) 


28.1 Safety Culture 

It is crucial that senior management should give appro¬ 
priate priority to safety and loss prevention. It is equally 
important that this attitude be shared by middle and junior 
management and by the workforce. 

A positive attitude to safety, however, is not in itself 
sufficient to create a safety culture. Senior management 
needs to give leadership in quite specific ways. Safety 
publicity as such is often a relatively ineffective means 
of achieving this; attention to matters connected with 
safety appears tedious or even unmanly. A more fruitful 
approach is to emphasize safety and loss prevention as a 
matter of professionalism. This in fact is perhaps rather 
easier to do in the chemical industry, where there is a con¬ 
siderable technical content. The contribution of senior man¬ 
agement, therefore, is to encourage professionalism in this 
area by assigning to it capable people, giving them appro¬ 
priate obj ectives and resources, and creating proper systems 
of work. It is also important for it to respond to initiatives 
from below. The assignment of high priority to safety neces - 
sarily means that it is, and is known to be, a crucial factor in 
the assessment of the overall performance of management. 

A fuller discussion of management leadership in creating 
a safety culture is given in Chapter 6. 

28.2 Safety Organization 

28.2.1 Safety department organization 

It is normal for there to be a separate department respon¬ 
sible for safety and loss prevention. Titles vary, but gen¬ 
erally include some combination of those two phrases. 

Managers involved in safety work are generally referred 
to as safety managers, safety advisers or safety officers. 
The head of a larger department is typically designated as 
safety adviser and other staff as safety officers. 

A large department may have staff who specialize in 
areas such as engineering, safety systems and manuals, 
training, and so on. 

Other areas which may come within the safety depart¬ 
ment include occupational health, industrial hygiene, pro¬ 
cess safety, medical matters and environmental protection. 

The safety department needs to be, and be seen to be, 
independent, and the organizational structure should 
reflect this. In particular, the department should be inde¬ 
pendent of the production function. 

28.2.2 Safety responsibilities 

In broad terms, it is the responsibility of the safety organi¬ 
zation to: participate in the formulation of safety policy; 
ensure that safety systems are created, maintained and 
adapted; ensure compliance with the regulatory require¬ 
ments; review plants and procedures; identify, assess and 
monitor hazards; educate and train in safety; assist com¬ 
munication and promote feedback in safety matters; and 
contribute to technical developments in safety. Thus, 
safety personnel are concerned with the development and 
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maintenance of the overall safety system and with its 
application to particular works and to plants. 

As already stated, it is line management which has 
the executive responsibility for safety, as it does for pro¬ 
duction; the role of the safety function is advisory. This 
means that in many areas of safety it is line management 
which undertakes an activity, but with assistance from 
the safety function. Accident investigation is acase in point. 

In many instances, the safety department will monitor 
and will intervene only if necessary. For example, the plant 
emergency procedures manual should be revised periodi¬ 
cally. The safety department will recognize a respon¬ 
sibility to see that this is done. If necessary, it will prompt 
line management to undertake the revision and may provide 
support. 

Turning to the specific areas for which safety department 
typically takes some responsibility, these include: 

(1) advice to senior management, including - 

(a) overall safety policy, 

(b) safety management system, 

(c) compliance with regulatory requirements, 

(d) safety performance measurement, 

(e) technical aspects of safety, 

(f) litigation support, 

(g) hazard insurance reviews, 

(2) creation, monitoring and revision of safety manage¬ 
ment system, including - 

(a) personnel selection criteria, 

(b) process safety reviews, hazard studies, 

(c) safety auditing, 

(d) emergency planning, 

(e) accident investigation, 

(f) safety documentation, 

(g) safety training, 

(h) compliance with regulatory requirements, 

(3) oversight and prompting of safety-related activities, 

including those in (2); 

(4) safety training, exercises and drills; 

(5) communication, including - 

(a) developments in regulatory requirements, 

(b) developments in technology, 

(c) good practice in safety, 

(d) accident investigation and case histories. 

The safety department has a responsibility to ensure that 
there exists a safety management system which is appro¬ 
priate and comprehensive, to monitor its implementation 
and operation, and to undertake period audits and reviews 
and to make proposals for revision as necessary. 

On safety matters, the department should be the com¬ 
pany’s window to the outside world, monitoring develop¬ 
ments, whether in legislation, technology or good practice. 

For large projects, the safety department will need to plan 
ahead in some detail, to ensure that the various process 
safety reviews and hazard studies are scheduled and 
resourced. 

Increasingly, safety personnel are involved in technical 
matters. Typical areas where safety personnel have had a 
strong technical input in recent years include inherently 
safer design, trip systems, isolation arrangements, hazard 
identification techniques, hazard analysis, quantitative 
risk assessment and emergency planning. 

The safety department will have a substantial com¬ 
mitment to education and training. This includes such 


essential aspects as: induction and refresher training on 
safety matters; and exercises and drills for emergencies 
such as a fire or toxic gas release and for fire fighting. But its 
activities should also go beyond this and should extend in 
two further direct ions in particular. One is the creation of the 
safety culture and the dissemination of good practice. The 
other is training for new safety-related techniques. Exam¬ 
ples of techniques introduced in recent years are hazop stu¬ 
dies and quantitative risk assessment. In both cases, safety 
personnel have taken the lead in introducing the techniques 
and training engineers to apply the methods themselves. 
Safety training is considered further in Section 28.7. 

Many of the activities described involve some form 
of communication. This is considered in more detail in 
Section 28.8. 

28.2.3 Safety professionals 

Personnel involved in work on safety and loss prevention 
tend to come from a variety of backgrounds and have a 
variety of qualifications and experience. It is possible, 
however, to identify certain trends. One is increasing pro¬ 
fessionalism. The appeal to professionalism is an essential 
part of the safety culture, and this must necessarily be 
reflected in the safety personnel. Another trend is the 
involvement in safety of engineers, particularly chemical 
engineers. A third trend is the extension of the influence of 
the safety professional. 

The addition of a process safety course in many uni¬ 
versity chemical engineering curriculum has increased 
dramatically the safety awareness of recent graduates. 

In the following section, an account is given of the role of a 
typical safety officer. Discussion of the role of the more 
senior safety adviser is deferred until Section 28.6. 

28.2.4 Safety officer 

The role of the safety officer is in most respects advisory. It 
is essential, however, for the safety officer to be influential 
and to have the technical competence and experience to be 
accepted by line management. The latter for their part are 
not likely persistently to disregard the advice of the safety 
officer if he possesses these qualifications and is seen to be 
supported by senior management. 

The situation of the safety officer is one where there is a 
potential conflict between function and status. He may have 
to give unpopular advice to managers more senior than 
himself. It is a well-understood principle of safety organi¬ 
zations, however, that on certain matters, function carries 
with it authority. 

The safety officer should have direct access to a senior 
manager, for example, works manager, should take advan¬ 
tage of this by regular meetings and should be seen to do 
so. This greatly strengthens the authority of the safety 
officer. 

Much of the work of a safety officer is concerned with 
systems and procedures, with hazards and with technical 
matters. It should be emphasized, however, that the human 
side of the work is important. This is as true on major 
hazards plants as on others, since it is essential on such 
plants to ensure that there is high morale and that the sys¬ 
tems and procedures are adhered to. 

Although the safety officer’s duties are mainly advisory, 
he may have certain line management functions such as 
responsibility for the fire fighting and security systems, 
and he or his assistants often have responsibilities in 
respect of the permit-to-work system. 
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28.2.5 Associated areas 

Safety is commonly associated with one or both of two 
additional areas: (1) occupational health and (2) environ¬ 
mental protection. 

The association of safety with occupational health is a 
long-standing one. In some cases the two have operated as 
separate, parallel functions, whilst in others one has been 
subsumed into the other. An account of the relationship 
between the two has been given by Kilian (1982). The 
increasingly strict requirements for industrial hygiene 
have resulted in a substantial expansion in occupational 
health, which mirrors that in safety and loss prevention. 

As environmental protection has grown in prominence, 
it has become increasingly linked with safety. There 
appear to be a number of reasons for this. One is that it 
may be a matter of chance whether an incident results in 
injury to people or in acute damage to the environment. 
Another is that the loss prevention approach is broadly 
applicable also to environmental protection. Athird is that it 


is often convenient to combine the safety and environ¬ 
mental functions. 

28.2.6 Safety roles 

A study of the role of safety specialists in industry from the 
viewpoint of the social scientist has been described by 
S. Dawson, Poynter and Stevens (1985). 

They identify the three main activities of safety person¬ 
nel as (1) processing and generating information, (2) giving 
advice and participating in problem solving and (3) taking 
direct action. These activities may be undertaken at any 
one of five stages of the technical control of hazards, 
namely (1) identification of hazards, (2) assessment of risk, 
(3) development of controls, (4) implementation of controls 
and (5) long-term monitoring and adaptation of risk and 
standards. They illustrate the matrix, which arises from 
this schema, as shown inTable 28.2. 

With regard to the sources of influence to which the 
safety specialist has access, the authors identify: (1) formal 


Table 28.2 Safety specialist activities in relation to technical control of hazards (S. Dawson, Poynter and Stevens, 
1985) (Reproduced by permission of Elsevier Science Publishers) 


Safety 

specialists’ 

activities 



Stage of technical control 


Identification 

Assessment 

Development 

Implementation 

Longer term 

of hazards 

of risk 

of controls 

of controls 

monitoring and 
adaptation 


A Processing 

Keeping 

Calculating 

Processing 

Processing 

Comparing 

information 

accident 

accident 

equipment 

orders for 

accident statistics 


statistics. 

frequencies, 

manufacturers’ 

safety 

over time 


Processing 

etc. Processing 

information 

equipment 



hazard 

information on 

and lists of 




information 

hygiene 

standards 

products, etc. 



B Giving advice/ 






problem¬ 

solving 

B1 Passive 

Looking at 

Answering 

Commenting 

Commenting on 

Investigating 

adviser 

work operations, 

questions 

on available 

effectiveness 

accidents. 


on request. 

about severity 

controls 

on request 

Inspecting. 


Investigating 

of hazards 

which have 


Providing 


complaints 


been 


feedback on 




suggested 


request 

B2 Active 

Taking initiative 

Lobbying for 

Recommending 

Identifying 

Making 

adviser 

in looking for 

appropriate 

controls 

shortfalls and 

recommendations 


hazards 

standards, 


improvements 

for update/review 



control limits 



of systems 

C Taking direct 






executive 

action 






Cl Jointly 

Doing joint 

Jointly 

Jointly 

Joint supervision 

Participating 

with line 

inspections 

deciding on 

drawing up 

and approval or 

in reviews of 

management 

and audits 

standards 

codes of 
practice 

disapproval to jobs 

arrangements 

C2 Alone 

Doing own 

Deciding 

Issuing 

Supervising job. 

Modifying 


inspections 

unilaterally 

instructions. 

Exercising veto. 

procedures, etc., 


and audits 

what is 

Specifying 

Physically stopping 

on own initiative 



safe/unsafe 

controls to 
be followed 

people working 
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organizational position; (2) managerial dependence on 
specialist expertise; (3) patronage by senior management; 

(4) direct role in the control process; (5) internal coalitions, 
for example, with the workforce; (6) external coalitions, for 
example, with the HSE; and (7) personal qualities. 

In respect of the dependence of senior management on 
safety specialists, they see therelationship extending from one 
in which the safety function is required to assure compliance 
and to deal with external agencies to one in which it has in¬ 
creasing relevance to coremanagerial objectives andactivities. 

28.3 Safety Policy Statement 

In both Europe and the United States, legislation has 
decreed that the company must protect workers from 
hazards of the plant. 

The US Occupational Safety and Health Administration 
has a general duty clause. The general duty clause, Section 
5(a)(1) of the Occupational Safety and Health Act of 1970, 
applies to all employers and requires each employer to pro¬ 
vide employees with a place of employment which is free of 
recognized hazards that may cause death or serious physi¬ 
cal harm. 

The Health and Safety at Work etc. Act (HSWA) 1974, 
Section 2(3), states: 

Except in such cases as may be prescribed, it shall be the 
duty of every employer to prepare and as often as appro¬ 
priate revise a written statement of his general policy 
with respect to the health and safety at work of his 
employees and the organization and arrangements for 
the time being in force for carrying out that policy, and to 
bring the statement and any revision of it to the notice of 
all his employees. 

It is suggested, however, that in large or complex under¬ 
takings, it maybe appropriate to divide the policy statement 
into two parts. The first should be a single document giving 
a concise statement of general policy, organization and 
arrangements, and the second a more detailed document, or 
collection of documents, including manuals of rules and 
procedures. 

28.4 Safety Representatives 

A system of safety representatives with responsibility for 
their fellow workers at a particular workplace has long 
existed in chemical works. 

A safety representative is appointed by a trade union. He 
represents in the first instance, the employees who are 
members of that union, but may by agreement represent 
other employees also. The functions of the safety repre¬ 
sentative are to represent the employees in consultation 
with the employer. 

His specific functions, typical of both the United States 
and European Regulations, are as follows: 

(1) to investigate potential hazards and dangerous 
occurrences at the workplace (whether or not they 
are drawn to his attention by the employees he repre¬ 
sents) and to examine the cause of accidents at the 
workplace; 

(2) to investigate complaints by any employee he repre¬ 
sents relating to that employee’s health, safety or wel¬ 
fare at work; 

(3) to make representations to the employer on matters 
arising out of sub-paragraphs (1) and (2) above; 


(4) to make representations to the employer on general 
matters affecting the health, safety or welfare at work 
of the employees at the workplace; 

(5) to carryout inspections in accordance with Regulation 
5,6 and 7 below; 

(6) to represent the employees he was appointed to repre¬ 
sent in consultations at the workplace with inspectors 
of the Regulatory Authority and of any other enforcing 
authority; 

(7) to receive information from inspectors; and 

(8) to attend meetings of safety committees where he 
attends in his capacity as a safety representative in 
connection with any of the above functions. 

The safety representative should keep informed on the 
hazards of the workplace, the relevant legislation and the 
employer’s safety policy, organization and arrangements. 
The employer’s duty to disclose information is particularly 
important in relation to safety representatives. The Regu¬ 
lations require an employer to make available to safety 
representatives information which is within the employer’s 
knowledge and which the representatives need to enable 
them to fulfil their function. 

The information which the employer makes available 
should include: 

(1) information about the plans and performance of their 
undertaking and any changes proposed insofar as they 
affect the health and safety at work of their employees; 

(2) information of a technical nature about hazards to 
health and safety and precautions deemed necessary 
to eliminate or minimize them, in respect of machinery, 
plant, equipment, processes, systems of work and 
substances in use at work, including any relevant 
information provided by consultants or designers or by 
the manufacturer, importer or supplier of any article or 
substance used, or proposed to be used, at work by their 
employees; 

(3) information which the employer keeps relating to the 
occurrence of any accident, dangerous occurrence or 
notifiable industrial disease and any statistical records 
relating to such accidents, dangerous occurrences or 
cases of industrial notifiable disease; 

(4) any other information specifically related to matters 
affecting the health and safety at work of his employees, 
including the results or any measurements taken by the 
employer or persons acting on his behalf in the course of 
checking the effectiveness of his health and safety 
arrangements; 

(5) information on articles or substances which an 
employer issues to homeworkers. 

Another important right of the safety representative is to 
inspect the workplace. The guidance notes refer to the fol¬ 
lowing types of inspection: 

(1) safety tours - general inspections of the workplace; 

(2) safety sampling - systematic sampling of particular 
dangerous activities, processes or areas; 

(3) safety surveys - general inspections of the particular 
dangerous activities, processes or area. 

The safety representative also has the right to carry out 
inspections following notifiable accidents, dangerous 
occurrences and notifiable industrial diseases. 
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The safety representative should act as a channel of 
communication between the management and the work¬ 
force on safety matters. The arrangements outlined create 
the conditions for a concerned individual to make a major 
contribution to the safety of his fellow workers. 

The relation between safety representatives and safety 
committees is a flexible one. Safety representatives are not 
appointed by or responsible to safety committees, or vice 
versa.There are provisions to protect safety representatives 
from both civil and criminal legal action arising from the 
discharge of their duties. 

28.5 Safety Committees 

Feedback from works personnel on safety matters is often 
most effective through such informal channels as direct 
contact with a foreman or manager. The formal system 
consists of safety representatives and safety committees. 

The most common practice requires the employer to 
establish a safety committee if requested to do so by at least 
two safety representatives.The guidance notes suggestthat 
the objectives of a safety committee are to promote coopera¬ 
tion between employers and employees and to provide a 
forum for participation by employees in matters of health 
and safety and that specific functions might include: 

(1) the study of accident and notifiable diseases statistics 
and trends, so that reports can be made to management 
on unsafe and unhealthy conditions and practices, 
together with recommendations for corrective action; 

(2) examination of safety audit reports on a similar basis; 

(3) consideration of reports and factual information pro¬ 
vided by inspectors of the enforcing authority under 
the Health and Safety at Work Act; 

(4) consideration of reports which safety representatives 
may wish to submit; 

(5) assistance in the development of works safety rules 
and safe systems of work; 

(6) a watch on the effectiveness of the safety content of 
employee training; 

(7) a watch on the adequacy of safety and health commu¬ 
nication and publicity in the workplace; 

(8) the provision of a link with the appropriate inspector¬ 
ates of the enforcing authority. 

The existence of a safety committee does not in any way 
relieve management of its responsibility for safety, but such 
a committee can fulfil a valuable function in complementing 
the work of the professional safety personnel. 

The response of management to suggestions made by the 
safety committee is very important. This does not mean that 
suggestions should always be accepted. But where they are 
not, a reasoned explanation should be given. 

28.6 Safety Adviser 

The safety department is led by a safety adviser. The 
approach taken by the safety adviser may well have a crucial 
influence on safety and loss prevention in the company. 
In the process industries, the work of the safety adviser 
is likely to have a large technical content. As loss prevention 
has grown in importance, so has the function of the 
safety adviser. 

The role of the safety adviser is to a considerable extent 
what the person appointed makes of it. The approach taken 


by one safety adviser is illustrated by the work of Kletz, 
which is referred to frequently in this book. Some of the 
technological developments with which he is associated 
include: inherently safer design; hazop studies; hazard 
analysis, and the adoption of a quantitative approach gen¬ 
erally; human factors; emergency isolation valves and trip 
systems; incident investigation; and safety education and 
training. Kletz has described his work in a number of books 
the titles of which are given in Chapter 27. 

The work of other safety advisers mentioned in this book 
includes that of W.B. Howard (1983,1984), Lynskey (1985) 
and Searson (1982,1983). 

28.7 Safety Training 

Training in safety is important both for management 
and for workers. Some of the general principles which 
should govern such training are outlined in Chapter 14. 
The discussion here deals primarily with the content of 
training. 

Guidance on safety training includes the many books 
issued by the AIChE Center for Chemical Process Safety, 
and the Safety series of the IChemE. Managers require 
training, particularly in technical aspects of safety and in 
the loss prevention approach, in company systems and 
procedures, in the division of labour between the company’s 
specialist safety personnel and themselves, and in training 
workers. Some topics in safety training for managers are 
listed inTable 28.3. 

Any of the usual methods of training may be used, but 
particular mention should be made of case studies of inci¬ 
dents, which have proved especially effective. A number of 
case studies, often with audio-visual material have been 


Table 28.3 Some topics in safety training for managers 


Managerial responsibility for safety and loss prevention 
Legal requirements, in particular the Health and Safety at 
Work etc. Act 1974, the Factories Act 1961, the CIMAH 
Regulations 1984 and the COSHH Regulations 1988 and 
the work of the Health and Safety Executive 
Principles of safety and loss prevention 
Company’s management system in relation to safety and 
loss prevention 

Company safety policy, organization and arrangements, 
including safety personnel, safety representatives and 
safety committees 

Hazards of the particular chemicals and processes 
Accidents and accident prevention, including accident 
statistics and case studies 
Pressure systems 
Trip systems 

Principle of independent assessment 
Plant maintenance and modification procedures, including 
permits-to-work and authorization of modifications 
Fire prevention and protection 
Emergency planning arrangements 
Training of personnel 
Information feedback 
Good housekeeping 

Sources of information on safety and loss prevention, 
including both people and literature 
Case histories 
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produced by ICI and the IChemE. These include some of the 
case histories given in Appendix 1. 

In addition, managers should also be familiar with the 
material which workers need to know. Workers require 
training particularly in recognition of hazards, in systems 
of work, in the use and location of safety equipment, and in 
actions to be taken in particular situations. Some topics in 
safety training for workers are listed inTable 28.4. 

For process operators, the list given in Table 28.4 is 
complementary to that in Table 14.11, which covers more 
general aspects, but includes many which have a large 
safety content. In particular, aspects such as the identi¬ 
fication of equipment are very important. Table 28.4 makes 
reference to various kinds of equipment such as those for 
personal protection, fire fighting, first aid and rescue. It is 
important that the training covers all aspects of its use, 
including when to use it, how to use it and where to find it. 

Safety training should be included in the initial induction 
course so that the worker does not endanger himself and his 
fellows when he first goes onto the plant. 

This initial training should be supplemented as soon as 
possible by more thorough safety training. 

The supervisor, or foreman, has a particularly important 
part to play in training workers. 

Training needs to be supported by documentation of 
various kinds. The plant design and operating manuals 
are key documents for training. In particular, the use of 
task analysis to assist in the development of operating 
procedures and operating manuals has been described 
in Chapter 14 and the writing of operating manuals in 
Chapter 20. 

There is also a need for documentation more specifically 
concerned with safety in aspects such as company safety 


Table 28.4 Some topics in safety training for workers 


Workers’ responsibility for safety 
Legal background, in particular the Health and Safety at 
Work etc. Act 1974 and the Factories Act 1961 
Company safety policy, organization and arrangements, in 
particular general safety rules, safety personnel, safety 
representatives and safety committees 
Hazards of the particular chemicals and processes 
Fire/explosion hazard (flammable mixture, ignition 
source). Ignition sources and precautions, including 
hazardous area classification, static electricity, welding, 
smoking. Fire spread, fire doors. Action on discovering 
fire or unignited leakage. 

Toxic hazard. Action on discovering toxic release 
Emergency arrangements, including alarm raising, alarm 
signals, escape routes, assembly points 
Protective clothing, equipment use and location 
Fire fighting methods, equipment use and location 
Rescue methods, equipment use and location 
First aid methods, equipment use and location 
Lifting and handling 
Permit and handover systems 
Security, restricted areas 
Good housekeeping 
Accident reporting 
Health, medical aspects 
Case histories 
See also Table 14.10 


rules and procedures, procedures in the case of fire and 
information on chemicals. Data sheets describing the 
properties and handling of individual chemicals are issued 
by various bodies. 

Again case studies of incidents are an especially effec¬ 
tive training technique. Atherton (1971) has described 
an interesting variation of this method in which the case 
study material consisting of slides and voice recordings 
was itself developed by a team comprising managers 
and workers. The incident selected for reconstruction was 
a real accident, in which a fitter removed a blank from 
a sulfuric acid line and received chemical burns. Extracts 
from the dialogue and points arising are shown inTable 28.5. 


28.8 Safety Communication 

A major aspect of the activity of safety personnel is com¬ 
munication in its various forms. This follows from the 
advisory role of the safety function. For the most part, 
communication takes place as a result of the participation 
of safety personnel in the various activities such as process 
safety reviews and hazard studies, emergency planning, 
safety training and safety cases. Such participation can be 
an effective means of creating and maintaining the safety 
culture. 

In addition, it should be one of the aims of the safety 
department to exploit a range of communication techniques 


Table 28.5 Extracts of dialogue from an accident case 
history reconstructed for training purposes (Atherton, 
1971) (Courtesy of the Institution of Chemical Engineers) 


(a) Start of incident 

Dialogue 

Maintenance foreman: In the morning, Len, I want to put 
B2 pump in on the weak circulation tank in C.D. 

Process foreman: O.K., George, I’ll have a clearance ready 
for you. There’s no need for me to be there, you know the 
job. I’ll put a chalk mark on the flange where the blank 
has to be removed. Just tell the fitter to be careful but he’ll 
know what he is doing. 

(b) The fitter is about to remove the blank 

Dialogue 

Fitter: Right, can you pass me the 5/8 in. spanner, Chris? 

Apprentice: O.K. 

Fitter: I’ll start on these back bolts first. By hell These are 
tight. 

Apprentice: How long have these been in? 

Fitter: They look like originals, don’t they? 

Apprentice: Aye. 

Fitter: I think we’ll start on these front ones first, they look 
a bit easier. 

Points arising 

1 Poor attitude by supervisor 

2 Poor identification of equipment 

3 Assumes the fitter knows the properties of the 
chemicals with which he will come into contact 

4 No mention of any specific instructions 

5 Question clearance procedure 

Points arising 

The man knows the correct procedure, but takes a short cut 
(a common theme of many accidents) 
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to inform and motivate people at all levels in the organiza¬ 
tion. Matters on which it will wish to communicate include 
developments in regulatory requirements, developments in 
technology, and good practice in safety. 

There are a variety of techniques which are used to do 
this. There is commonly a safety newsletter. Table 28.6 
shows some of the topics dealt with in issues of the ICISafety 
Newsletter. Important features are that the topics are matters 
of concern and that the comments made are clear, practical, 
reasoned and authoritative. 

Incident investigations and case histories, and the les¬ 
sons drawn from these, provide concrete illustration of 
the principles. Incidents within the company are likely 
to make most impact, but it should he the case that these 
are not numerous enough to transmit the message, so 
that it is necessary to draw also on case histories from 
elsewhere. A detailed account of incident investigation 


and of the approach to drawing the lessons is given in 
Chapter 27. 

The potential of case histories is not exhausted by 
recounting them in a newsletter. As described above, they 
should also he used in workshops, in which the group is 
invited to carry out its own analysis of the lessons to be 
learned and to formulate its own recommendations. 

In addition to providing general reinforcement of the 
safety culture, such communication addresses two specific 
problems. One is raising the safety awareness of fresh and 
inexperienced personnel. Another is arresting the decay of 
procedures whose purpose is liable be forgotten if some time 
has elapsed since an incident occurred. 

Another form of communication is to draw the attention 
of management to deterioration in the operation of systems 
and procedures and to malpractices. This is effective but 
requires a certain skill. 


Table 28.6 Some questions I am often asked (after ICI Safety Newsletter) 


1 66/8 Do we spend more on safety than other companies? 

2 67/4 Would two small plants be safer than one hig one? 

3 68/7 How can we change people’s attitude to safety? 

4 69/4 What is our policy on safety? 

5 70/5 Men are unreliable so should we try to make out plants fully automatic? 

6 71/9 Who should take the decisions on safety matters - the manager or the safety officer? 

7 72/5 How can we keep alive the memory of incidents that have happened on the plant 

when the staff change every few years? 

8 73/1 How will the new Health and Safety at Work Act affect us? 

9 74/6 Is there any easy way to get people interested in the plant safety book? 

10 75/6 How often will an operator act correctly when an alarm sounds? 

11 76/6 Most of our checking will show nothing wrong - so what is our incentive to continue? 

12 77/7 Why does the Petrochemical Division board issue so few directives on safety? 

13 78/12 Can you recommend some books which will give me some background information on loss prevention? 

14 79/5 Are we expected to learn the lessons of accidents which have occurred somewhere else? 

15 80/8 How long should a manager spend on a plant? 

16 81/9 Why don’t ‘they’ do more about safety (or plant tidiness or training)? 

17 82/8 Do you put forward minimum standards? Can you go further than you suggest as long as you do not do less? 

18 84/7 Flixborough has been described as the price of nylon - is it worth it? 

19 85/6 How does our safety record compare with other companies? 

20 86/4 In our designs, should we assume that people make mistakes? 

21 87/5 What should we do to old plants when standards 

change? 

22 88/6 How can I find out quickly and easily what has been written and recommended 

about subjects I am interested in at the moment? 

23 91/8 Do we really need to do an operability study as this is only a very simple project 

(or it is very similar to the last one)? 

24 92/6 What should we do to improve the safety record? 

25 94/6 Are we willing to give information on safety to other companies? 

26 95/5 Which airline should I fly? 

27 96/5 What is the difference between operability studies and hazard analysis? 

28 97/8 Is the Safety Newsletter issued free? 

29 98/9 Do we spend too much money and effort on the problems that the press and TV publicize? 

30 99/8 Can we get the money needed for safety? 

31 100/6 What, in six words of one syllable, is the biggest single cause of accidents? 

32 102/9 Can I be prosecuted if there is an accident on a plant which I work on or which I have designed? 

33 108/7 What’s new? 

34 117/2 Does ICI add on more protective equipment than other companies? 

35 119/5 How does ICI compare with other companies? 

36 121/7 What should I do if a Factory Inspector 

asks me to do something which I think is unnecessary or even unsafe? 

37 123/2 If we install a lot of automatic trips and controls on our plant, will we turn operators into zombies? 

38 124/6 Has all the money and effort put into technical safety in the last 10 years 

produced any results? 
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28.9 Safety Auditing 

A major aspect of the work of the safety department is 
auditing. Audits are the periodic examination of the func¬ 
tioning of the safety system. Accounts of auditing are 
given in Safety Auditing (Kase and Wiese, 1990) and by 
D. Williams (1971), Madhavan and Sathe (1987), Madhavan 
and Kirsten (1988), Madhavan and Landry (1988), Monk 
(1988),Tweeddale (1992), Ozog and Stickles (1992), D. Scott 
and Crawley (1992), J. Lockwood (1993), Sankaran (1993), 
Hurst and Ratcliffe (1994) and Hurst, Hankin etal. (1994). 

28.9.1 Types and time-scales of audit 

The overall system of control and auditing needs to 
operate at three levels, which correspond to increasingly 
longtime-scales: 


Level Time-scale 


1 Monitoring of outputs of systems and procedures 
Short term, essentially continuous 

2 Audit of implementation of systems and 
procedures. Medium term 

3 Audit of functioning and appropriateness of 
systems and procedures. Long term 


Subjects of audit at both Levels 2 and 3 should be (1) the 
safety management system of the company, (2) the safety 
management system and operation of the plant and (3) spe¬ 
cial features of the plant. 

Some of the audit activities of a safety officer are shown 
inTable 28.7, which is adapted from a more detailed table on 
safety audits given by D. Williams (1971). Important points 
illustrated by this table are the involvement of management 
at all levels, the training of both management and work¬ 
force, and the role of systems and procedures. 

28.9.2 Company audits 

The overall safety management system of the company 
should be subject to audit. At Level 2 the audit should check 
that the systems established are being operated and at 
Level 3 that these systems are still appropriate. 

28.9.3 Plant audits 

At plant level, there should be a post-commissioning audit 
carried out soon after a plant has been commissioned. 
Audits should then be repeated at intervals throughout 
the life of the plant. Plant audits should cover the safety 
management system of the plant, including operation, 
maintenance and control of change. 

A structure for the conduct of the audit of a safety 
management system is available in the STATAS method 
described in Chapter 6. 

28.9.4 Special feature audits 

These general audits may be supplemented by audits in 
which some particular feature is examined in greater depth. 
Typical topics for such special feature audits might be the 
fire protection system or the permit-to-work system. 

28.9.5 Audit aids 

The conduct of a plant audit is assisted by the use of aids 
such as checklists. A structured set of checklists related to 


the root causes of accidents is typically used. This is 
described in Chapter 8. 

28.9.6 Audit procedure 

The effectiveness of an audit is highly dependent on the 
technique used. There is some guidance available on these 
practical aspects of auditing. 

Tweeddale (1990, 1993) describes an approach to the 
auditing of a typical management system, taking as an 
illustration the auditing of a procedure for maintenance 
work permits. He sets four questions, or hurdles: 

(1) Do you have a procedure for... ? 

(2) What are the main objectives of that procedure? 

(3) How do you know whether that procedure is being 
properly applied in your area? 

(4) Do you have to report to anyone about how well that 
procedure is being applied? 

He shows how much these relatively simple questions can 
reveal. 

28.9.7 Audit quality 

Considerable effort is expended on audits in the process 
industries, but much of it is relatively ineffective in dis¬ 
covering defects in the systems examined. The quality of 
audit is crucial. 

The point is illustrated by the audits conducted on Piper 
Alpha. Audits of various kinds were quite frequent, but 
none had picked up the numerous defects in the permit-to- 
work system. Yet once the Inquiry began, these defects 
were quickly laid bare in the evidence of the witness on this 
topic (Lockwood, 1989). This evidence repays study. The 
Piper Alpha Report is critical of the quality of the audits 
carried out. 

28.10 Safety Rating 

Some companies utilize as part of the safety system a safety 
rating system. Use may be made of a system developed 
in-house or of one of the proprietary systems. Three systems 
are described below - the ISRS, MORT and MANAGER 
systems - as illustrations of the types of system available. 

A number of the accounts of audits referred to in 
Section 28.9 also contain rating schemes of various kinds. 

28.10.1 Management and oversight risk tree 

One such system is the Management and Oversight Risk 
Tree (MORT) described in MORT Safety Assurance Sys¬ 
tems (WG. Johnson, 1980). This system has been mentioned 
earlier in Chapters 2 and 27. 

MORT provides a methodology for assessing a situation 
which may lead to an undesirable outcome such as injury or 
damage.Thebasic logic tree of MORT is shown in Figure 2.3. 
This MORT tree contains in structured form many of 
the basic concepts of safety management and engineering, 
including the concepts of: vulnerable targets, harmful 
energy, precursor events, barriers to escalation, mitigation 
of consequences, management policy formulation, man¬ 
agement policy implementation and risk assessment. 

28.10.2 International safety rating system 

The International Safety Rating System was developed by 
Bird and co-workers at the International Loss Control 
Institute (ILCI) at Georgia State University. The philosophy 
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Table 28.7 Some safety audit activities (after D. Williams, 1971) (Courtesy of the Institution of Chemical Engineers) 


Activity 


Interval (month) 

Plant safety review 

Review of adequacy of operations, equipment and 
building safety 

12 

Job safety analysis 

Reviews of standard operating procedures. Update 
where necessary 

12 

Operator review 

Check for deviation from standard operating 
procedures and on work habits 

6 

Supervisors’ safety meetings 

Education, training, drills, follow-up 

3 

Management development 
seminar 

Development of managerial competence 

1 

Supervisory training 

Training of foremen for supervisory role 

1 

Safety committee 

Motivational safety suggestions 

1 

Plant manager’s meeting 

Communication, education, training, innovation, 
follow-up 

1 

Foremen’s meeting 

Communication (vertical, horizontal), motivation, 
education, training 

1 

Critical incident technique 

Observation of unsafe acts, conditions. Reports of 

lPlus 

continuous 

observation 

Central plant safety 

Safety policy 

As needed 

Safety review committee 

Review of safety of new processes and/ or 
equipment 

As needed 

Works safety procedures review 

Review of work safety procedures 

As needed 


underlying the system is given in Practical Loss Control 
Leadership (Bird and Germain, 1985). The evolution of the 
system has been described by Bond (1988 LPB 80). 

The system developed as the Five Star Rating System, 
was refined jointly with the South African Chamber 
of Mines to yield the International Mining Safety Rating 
System, and was finally generalized to give the ISRS. 
There are several versions of the system, including one 
for petrochemicals. The elements of the system are given 
inTable28.8. 

An account of the application of the system in a refinery 
has been given by Arnold, Redfearn and Maaren (1992) and 
of its application elsewhere by Eisner and Leger (1988) and 
Pringle and Brown (1990). 

28.10.3 MANAGER system 

The MANAGER system described by Pitblado, Williams 
and Slater (1990) and outlined in Chapter 9 was developed to 
assist in estimating the effect of the quality of management 
in quantitative risk assessment. A feature of the method is 
that it seeks to take account of all areas shown to be impor¬ 
tant in accident causation and of the incorporation of widely 
accepted management principles in all key elements of the 
safety management system. 

28.10.4 Critique of rating systems 

As mentioned in Chapter 6, a critique of safety rating, or 
packaged audit, systems has been given by D. Petersen 
(1989). He cites studies indicating that most packaged audit 


Table 28.8 Elements of International Safety Rating 
System 

1. Leadership and administration 

2. Management training 

3. Planned inspections 

4. Job analysis and procedures 

5. Accident/incident investigation 

6. Planned job observation 

7. Emergency preparedness 

8. Organizational rules and regulations 

9. Accident /incident analysis 

10. Employee training 

11. Personal protective equipment 

12. Health control and services 

13. Programme evaluation system 

14. Purchasing and engineering control 

15. Personal communications 

16. Group meetings 

17. General promotion 

18. Hiring and placement 

19. Records and reports 

20. Off-the-job safety 


systems do not contain many of the elements found to be 
critical to safety performance and, on the other hand, that 
they do contain elements which fail to correlate with safety 
performance. 
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The use of computers in the design and control of process 
plants is now widespread. The use of safety-related com¬ 
puter aids is described briefly in this chapter. A more gen¬ 
eral discussion of chemical engineering computer software 
is contained in Lees 2nd edition; however, the availability 
of software is changing too fast to simply develop a list.The 
list would be out dated before publication. The World Wide 
Web with its concomitant search capability has made pub¬ 
lished software lists out dated. 

Rather than provide exhaustive lists, the generic type of 
available software, as it applies to loss prevention will be 
described herein. However, reference has already been 
made in a number of chapters to various specialist computer 
codes pertinent to the technology under discussion, such as 
those for consequence analysis and hazard analysis. 

29.1 Computer Aided Process Engineering 

Some of the principal codes for process plant design in 
CAD, or computer aided process engineering (CAPE), are 
now reviewed, considering first individual programs and 
then integrated packages. 

29.1.1 Process selection 

The selection of the process is perhaps the most funda¬ 
mental problem in process design and it is a tough one. An 
account of the developments in the computer aiding of 
process route selection is given in Chapter 30. 

29.1.2 Physical, thermodynamic and phase equilibrium 
properties 

A package that furnishes physical, thermodynamic and 
vapour-liquid equilibrium properties is an essential ser¬ 
vice package for process design. Some of the packages are 
part of a suite of programs, typically supporting a flow 
sheet simulator. 

29.1.3 Flow sheet simulation 

Flow sheet simulation, handling the mass and energy bal¬ 
ances, is the heart of the process design package. Much 
theoretical work has been done to produce codes that 
are efficient, particularly in handling features such as 
recycles. The core of a system for process plant design is the 
program, which performs the steady-state mass and heat 
balances, also called the process simulator. There are 
two main types of process simulators. The sequential 
modular (SM) simulator consists of a sequence of modules 
for the various unit operations performed. A basic set of 
modules is a mixer, a divider and a reactor. The equations 
of each unit operation are solved sequentially. The equation 
oriented (EO) simulator, by contrast, solves the equations 
of the whole system simultaneously. An SM simulator 
can accommodate more readily a variety of types of 
model in the modules, including user configured models, 
whereas the EO simulator scores for features which span a 
number of units such as recycles, control systems and 
constraints. 

The process simulator forms the core of an integrated 
CAPE system. This core program draws on programs 
offering other facilities. These include physical properties, 
equipment sizing, cost and economics, and dynamic simu¬ 
lation packages. An important feature of a fully integrated 
CAPE system is the database. The database may contain 
files on a wide variety of aspects of the design, from flows, 
pressures and temperatures to material take-offs. Different 


CAPE systems start from different starting points. 
One may start from a graphics facility, another from a pro¬ 
cess simulator. Consequently, the systems have different 
strengths and weaknesses. 

The degree of integration in current CAPE systems is not 
always as advanced as might be assumed. Typically a two- 
dimensional package will have its own database, which 
allows it to draw symbols representing plant units, but it 
does not identify the symbols as units such as vessels or 
heat exchangers, and does not have associated information 
about the units. In other words, it is purely a drawing pack¬ 
age. This means that it cannot readily be used to capture the 
data about the units required for a package to perform a 
function such as fault tree synthesis. 

CAPE systems typically have the capability to perform 
the following project functions: 

(1) analysis of layout designs - 

(a) conceptual designs, 

(b) detailed designs; 

(2) checking of designs against standards; 

(3) control of project information; 

(4) generation of documents and listings; 

(5) archiving of project information. 


29.1.4 Piping and instrument diagrams 

Closely linked to the flow sheet simulation is the generation 
of the process flow diagram (PFD) or piping and instru¬ 
ment diagram (P&ID). 

29.1.5 Process synthesis 

Closely linked to the mass and energy balances is the ther¬ 
mal economy. These include computer programs for heat 
exchanger network design and for process synthesis using 
pinch technology. 

29.1.6 Cost and economic estimates 

Another essential service package is a program, which 
furnishes cost data and can be used to estimate the costs of 
designs. 

29.1.7 Engineering units conversion aids 

Aids for conversion between different chemical engineer¬ 
ing units will always be necessary until a global standard 
is widely utilized. 

29.2 Pipework and Fluid Flow 

Programs for pipework are of several different types. One 
group performs the fluid flow calculations for piping and 
piping networks. Programs of this type include: 

(1) two-phase flow; 

(2) flash-off and flash drums; 

(3) unsteady-state flow; 

(4) flow through control valves; 

(5) flow through rotating machinery; 

(6) pipeline leak detection. 


29.3 Unit Operation and Equipment 

There are a number of programs for the design of unit 
operations and equipment of various types. Programs exist 
not just for shell and tube heat exchangers but also for 
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air-cooled heat exchangers, thermosyphon reboilers, 
furnaces and heat exchanger networks: 

(1) chemical reactors; 

(2) distillation columns; 

(3) fired heaters; 

(4) solid-liquid separation; 

(5) flare systems; 

(6) steam systems; 

(7) pumps and compressors. 

29.4 Databases, Bibliographies and Indexes 

Physical, chemical and toxic properties: there are a number 
of databases, or data banks, for the physical, chemical and 
toxic properties of materials. The databases are often 
associated with a government agency or technical society, 
such as the following: 

Registry of Toxic Effects of Chemical Substances (RTECS), 
supplied by the National Institute for Occupational 
Safety and Health (NIOSH); 

HSDE created by the NLM as part of itsToxnet data system; 
Oil and Hazardous Materials Technical Assistance Data 
System (OHMTADS), supplied by the Environmental 
Protection Agency (EPA); and 
Chemical Hazard Response Information System (CHRIS) 
supplied by the US Coast Guard. 

NIOSHTIC, supplied by the NIOSH; 

HSELINE, supplied by the Health and Safety Execu¬ 
tive (HSE); 

CISDOC, supplied by the International Occupational Safety 
and Health Information Centre of the International 
Labor Office (ILO); 

MHIDAS, covering hazardous incidents, supplied by the 
Safety and Reliability Directorate; 

TOXLINE, supplied by NLM; 

RISKLINE, supplied by the National Chemical Inspectorate 
of Sweden; 

BIOSIS, CAS, IPA and TOXBIB. PEST-BANK, supplied by 
the National Pesticide Information System, gives the 
key registration data of all US registered pesticides. 
European Inventory of Existing Commercial Chemical 
Substances (EINECS) is an inventory of European 
commercial chemicals. 

International Nuclear Information System (INIS) is sup¬ 
plied by the IAEA Medical databases, which include 
MEDLINE and CANCER. 

Another set of databases is those from Microinfo. They 
include HAZARDTEXT (safe handling and incident 
response), INFOTEXT (regulatory listings), MEDI- 
TEXT (evaluation of exposed individuals) and SARA- 
TEXT (toxicity, SaraTitle III) 

The Bretherick Reactive Chemical Hazards Database is the 
database version of the Handbook of Reactive Chemical 
Hazards (Bretherick, 1990b). 

CHEMSAFE and CHEMTOX are, respectively, compendia 
of the flammability and toxic properties of a large 
number of substances. 

A number of specialty databases on medical subjects are 
available from Elsevier Science Publishers, including 
the Excerpta Medica database EMBASE. 

IRIS is a database of monographs in support of the assess¬ 
ment of the risk from a large number of chemicals. 

There are three incident data banks operated by SRD. 
MHIDAS is the Major Hazard Incident Data Service. The 


other two are the Explosion Incidents Data Service (EIDAS) 
and the Environmental Incidents Data Service (EnvIDAS). 
In addition to MHIDAS, AEA Technology offers the AIRS 
code for the recording of incidents in the workplace. 

Another computer-based incident data bank is FACTS, 
ofTNO. 

29.5 Compliance Management 

There are quite a large number of programs to assist with 
compliance with regulatory requirements, mainly for the 
United States. 

29.6 Computational Fluid Dynamics 

Codes for computational fluid dynamics (CFD) find wide¬ 
spread use both in design and in hazard assessment. 

29.7 Hazard Identification 

There are a number of codes available to assist in the conduct 
of the various techniques for hazard identification. Aids for 
hazard and operability (HAZOP) analysis are particularly 
valuable with the housekeeping and follow-up aspects. 
Computer codes exist for a number of hazard models, and 
indeed for the more complex models this is the only practical 
method of use. Some of the principal subjects are as follows: 
jets; vapourization from pools; pool fires; fire engulfment; 
flame impingement; explosion in, and explosion relief of, 
large enclosures; vapour cloud explosions. 

29.7.1 Fault tree analysis 

Details of aids to fault tree analysis. These cover the deter¬ 
mination of the minimum cut sets, analysis for common 
cause failure, assessment of importance and sensitivity, 
quantitative analysis and uncertainty analysis. 

29.8 Pressure Relief Devices Sizing 

29.8.1 Reactor venting 

The SAFIRE code for the venting of reactors, which 
implements the design methods developed by the Design 
Institute for Emergency Relief Systems (DIERS) as part of 
its design package for emergency relief. 

29.8.2 Blowdown 

Programs that calculate the emission flows from vessels, 
pipes and pipelines are: 

BLOWDOWN (Imperial College) 

BLOWSIM (UCL) 

An account of BLOWDOWN is given by Haque, Richardson 
and Saville (1992). 

29.8.3 Gas dispersion 

One of the most important topics covered by such codes is 
gas dispersion, particularly dense gas dispersion. An acc¬ 
ount of gas dispersion models was given in Chapter 15. Dif¬ 
ferent models are used for passive and dense gas dispersion. 

Passive gas dispersion 

Models for passive gas dispersion were described in 
Chapter 15. Manual calculation is possible with the simpler 
forms of model, but for most practical applications, par¬ 
ticularly in air pollution modelling, use is made of com¬ 
puter codes. 

There are now a large number of codes for specific situa¬ 
tions such as multiple sources, complex terrain, urban con¬ 
ditions, and coastal and offshore locations. 
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The EPA advises certain codes as ‘preferred’ codes for air 
pollution modelling. The codes are listed with full details by 
Zannetti (1990). Zannetti also lists the codes advised by 
the EPA as ‘alternative’ as well as a large number of other 
programs. 

Dense gas dispersion 

Models for dense gas dispersion, also described in 
Chapter 15, have tended to be much more complex than 
those for passive dispersion, and for most such models, 
a computer program is essential. 

Jets 

The computer codes model jets of different density or 
buoyancy, jets with high and low velocity, jets with vertical, 
horizontal or angled orientation, jets in ambient wind and 
turbulent conditions, jets with two-phase flashing behav¬ 
iour, and jets with airborne aerosol effects. 

Vapourization from pools 

Several computer codes for vapourization from pools have 
been developed. 

Fire events 

Programs for the calculation of the thermal radiation from 
a jet flame, a pool fire or a boiling liquid expanding vapour 
explosion (BLEVE) are widely available. 

Condensed phase explosions 

There are a number of programs that have been developed 
by the military to determine the effects of explosions, 
nuclear explosions and condensed phase explosions, 
including weapons. 

Vapour cloud explosions 

There are several computer codes for, or applicable to, the 
estimation of the blast from vapour cloud explosions. 

29.8.4 Explosions in large enclosures 

Codes for the simulation of explosions in large enclosures 
play an important role in the design of fire and explosion 
protection of offshore platforms. These programs solve the 
fundamental equations of fluid flow taking into account 
turbulence and combustion. The three-dimensional Navier- 
Stokes equations, suitably augmented to include the effects 
of turbulence and combustion, are cast in discrete form, 
employing a finite volume technique, and are solved impli¬ 
citly. Turbulence is modelled in terms of eddy viscosity, and 
combustion is modelled in terms of a turbulent, mixing- 
limited reaction. The space modelled is divided into a grid 
of ‘boxes’ of 1 m 3 volume. Normal assumptions are that the 
gas cloud is a stoichiometric homogeneous, quiescent 
mixture. Ignition is modelled by assuming that at time 
zero, half the flammable mixture in one of the boxes has 
undergone combustion. 

29.9 Hazard Assessment Systems 

Some computer codes for hazard assessment systems are 
described here: 

ARCHIE 

The ARCHIE code of the Federal Emergency Management 
Agency (FEMA), from Hazmat America, contains a set of 


models for a variety of scenarios cast in a tree structure, 
which at the first level down include pressurized gas 
release, liquid release followed by vapourization from the 
pool, a closed tank engulfed in fire, and a condensed phase 
explosion, and at lower levels extend to events such as jet 
flame, flash fire, vapour cloud explosion and BLEVE. It is 
described in the Handbook of Chemical Hazard Analysis 
Procedures (FEMA, 1989). 

SAFETI 

The SAFETI code was developed for the Dutch Ministry of 
Housing, Physical Planning and Environment. This is a 
major code for the conduct of a complete probabilistic risk 
assessment (PRA). The development of the code was 
prompted by the Rijnmond PRA described in Appendix 8. 
The program performs a complete PRA for a fixed instal¬ 
lation. It is designed for ease of input, speed of processing 
and transparency of results, both intermediate and final. It 
is also designed for minimum loss of detail, and allows the 
level of detail to be varied. 

Details of the plant are entered into the PLANT program. 
A plant is organized in terms of ‘units’, which are linked by 
connecting ‘pipes’ to ‘vessels’. Vessels and pipes have asso¬ 
ciated with them a set of ‘equivalent discrete failures’ 
(EDFs), essentially leaks and ruptures. Each failure is 
assigned a failure frequency, for which default values are 
supplied. Other input information includes the population 
density, defined by a grid; the density of ignition sources; 
and the meteorological conditions. There are databases for 
the failure frequencies, population, ignition sources and 
meteorology. 

A set of eight release scenarios is used. These are: (1) an 
instantaneous release (by vessel rupture) of a flammable 
material; (2) a continuous pressurized release (from vessel 
or pipe) of a flammable material; (3) the vapourization of a 
refrigerated flammable liquid; (4) a pool fire; (5) a fireball or 
BLEVE; (6) an instantaneous pressurized release (by vessel 
rupture) of a toxic material; (7) a continuous pressurized 
release (from vessel or pipe) of toxic material and (8) the 
vapourization of a refrigerated toxic liquid. The program 
handles the development of these releases utilizing a set of 
four event trees, for which the starting events are one of the 
four possible combinations of instantaneous vs continuous 
and aerosol vs no aerosol in the cloud. The nodes in these 
event trees include the following queries: (1) Rainout? 
(2) Evapouration? (3) Pool left behind? (4) Pool of limited 
duration? (5) Essentially instantaneous? (6) Behaves as a 
free jet? 

The hazard models used are described in Chapter 9.There 
are four gas dispersion models together with a set of models 
for vapourization from a pool, jet flames, fireballs, BLEVEs 
and vapour cloud explosions and probit equations for injury 
and damage. 

The outcomes of the event trees for flammable releases 
are events that are then modelled, using the set of hazard 
models and probit equations. The results can be output in a 
variety of forms, including as risk contours, individual 
risks and frequency-number curves. 

There are interactive facilities which permit the user to: 
bypass some or all of the automatic generation of EDFs 
and to replace them with alternative releases or events; 
replace a default failure frequency with an alternative 
value; and replace a standard hazard model with an alter¬ 
native one. 
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WHAZAN 

A rather simple code is WHAZAN, developed byTechnica 
for the World Bank. It is described in the Manual of Indus¬ 
trial Hazard Assessment (Technica, 1986). WHAZAN pro¬ 
vides a facility for the user to explore the consequences of a 
set of release scenarios. The core of the program is a set of 
hazard models. The program does not make estimates of 
the frequency of the scenarios or of the risks. WHAZAN is a 
much more modest package than SAFETI and was devel¬ 
oped to run on a PC in the first instance. 

RISKAT 

The HSE has developed its own hazard assessment pro¬ 
gram entitled initially the Risk Assessment Tool (RAT), 
and latterly RISKAT. The essential features of this program 
have been described in Chapter 9 in connection with the 
HSE guide assessments for liquefied petroleum gas and 
chlorine. 

29.10 Emergency Response Simulation 

An aid to training personnel in the handling of emergencies 
is available in the form of the handling emergencies simu¬ 
lation system of the IChemE. The trainee assumes the role 
of the main incident controller and is responsible for con¬ 
trolling all personnel, and issuing operational commands. 
The program contains nine incident scenarios involving 
fire, toxic release and a combination of both. It uses a pre¬ 
plan entered by the trainee to determine how the scenario 


develops. The scenario highlights weak points in the pre¬ 
plan. In order to assist post-mortem analysis, a log is pro¬ 
vided of events during the incident and of actions taken. 
There are several packages for the simulation in real time of 
the development of an emergency using suitable hazard 
models. The essential concept is that, in an emergency, the 
system is provided with certain key pieces of information, 
such as the material released, estimates of the location 
and size of the leak and the meteorological conditions, and 
gives a VDU display of the phenomenon such as plan and 
elevation contours of gas concentration. 

One such system is SAFER (Dupont Safer Emergency 
Systems). The core of the code is a gas dispersion program 
together with data on the chemicals handled in the plant and 
their properties. The computer is provided with a network 
of instruments that measure meteorological conditions 
such as wind direction and speed. In an emergency, data are 
furnished to the computer both by these instruments and by 
operator inputs. SAFER is more than a computer code. It is 
essentially an emergency response system built around the 
computer package. 

29.11 Transport 

Hazard assessment systems for transport are not well 
represented. Transportation Risk screening programs, 
which support evaluation of the risks from different 
chemicals, transport modes and routes, typically are pro¬ 
prietary to special consultancy companies. 
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This chapter deals with artificial intelligence, expert sys¬ 
tems and certain other advanced developments in compu¬ 
ter aiding. The aim of the chapter is to provide an overview 
of the field and an appreciation of the sorts of problem 
which are tackled, the types of technique developed, the 
terminology used and the applications made. 

Accounts of artificial intelligence (AI) include Artificial 
Intelligence (Winston, 1984), Introduction to Artificial Intelli¬ 
gence (Charniak and McDermott, 1985), Introduction to 
Knowledge Based Systems (Frost, 1986), Introduction to 
Artificial Intelligence and Expert Systems (Patterson, 1990), 
The Elements of Artificial Intelligence (Tanimoto, 1990) and 
Encyclopaedia of Artificial Intelligence (Shapiro, 1992). 

An important area of AI is expert systems. A large pro¬ 
portion of the AI applications in the process industries are 
of this nature. Expert systems are therefore given par¬ 
ticular attention in this chapter. 

Most accounts of AI are written in a style that makes 
extensive use of lines or sections of computer programs. 
For the most part this practice has not been adopted here. 
Theaimhasbeento couch explanations in natural language. 
Some limited use has been made of program-type material, 
however, purely in order to give a feel for the approaches 
taken. The expressions principally used are related to the 
predicate calculus. This has influenced the order of treat¬ 
ment of the subjects in the chapter. The account of pro¬ 
gramming languages is placed after the account of predicate 
logic but before most of the other topics where program-type 
material maybe used. 

Selected references on AI and on expert systems are 
given in Table 30.1. 

Table 30.1 Selected references on artificial intelligence, 
expert systems and advanced aids 


A General 


Hempel (1952); Craik (1943); Bruner, Goodnow and Austin 
(1956); Vickers (1968); Simon (1969); Lindsay and Norman 
(1972); J. Anderson and Bower (1973); Schank and Colby 
(1973); Bobrow and Collins (1975); J. Anderson (1976); 
Weizenbaum (1976); Sternberg (1982); Schon (1983) 
Artificial intelligence 

Bowden (1943); Turing (1950,1963); Feigenbaum and 
Feldman (1963); Newell and Simon (1963,1972); Minsky 
(1967); Ernst and Newell (1969); Findler and Meltzer (1971); 
Nilsson (1971,1980); lighthffl (1973); Michie (1974, 

1982a,b,d, 1983); E.B. Hunt (1975); Rubin (1975); Raphael 
(1976); Boden (1977); Winston (1977); Latombe (1978); 
Feigenbaum (1979,1983); N. Graham (1979); Nii and Aiello 
(1979); Charniak, Riesbeck and McDermott (1980); Barr 
and Feigenbaum (1981-); Schank and Riesbeck (1981); 

P.R. Cohen and Feigenbaum (1982); Szolovits (1982); 
Feigenbaum and McCorduck (1983); Hayes and Michie 
(1983); Michalski, Carbonnell and Mitchell (1983); Rich 
(1983); Durham (1984b); O’Shea and Eisenstadt (1984); 
Reitman (1984); Simons (1984,1988); Sowa (1984); Winston 
and Prendergast (1984); Charniak and McDermott (1985); 
P.R. Cohen (1985); Hillman (1985); J.J. Richardson (1985); 
Shirai and Tsujii (1985); Frost (1986); Kanal and Lemmer 
(1986); C. Williams (1986); Yazdani (1986); Gevarter (1987); 
Cleal and Heaton (1988); Ramsay and Barret (1987); Jezzard 
(1988); Savory (1988); W.ATaylor (1988); Mirzai (1990); 
Patterson (1990); Tanimoto (1990); Martins (1992); Shapiro 
(1992) 


Expert systems 

Waterman and Hayes-Roth (1978); Chisholm and Sleeman 
(1979); Michie (1979,1980,1981,1982a-d); Waterman (1979, 
1981,1985); Reboh (1980); Addis (1982); R. Davis (1982); 

R. Davis and Lenat (1982); Sacerdoti (1982); Stefik et al. 
(1982); Bigger and Coupland (1983); Bramer (1983,1984); 
Duda and Shortliffe (1983); Hayes-Roth, Waterman and 
Lenat (1983); Naylor (1983); Stefik and de Kleer (1983); 
Swartout (1983); Weiss and Kulikowski (1983); Alty and 
Coombs (1984); Alvey, Myers and Greaves (1984); V Begg 
(1984); Durham (1984a, 1985a); Forsyth (1984a,b); R. 
Brown (1985); A. Goodall (1985); Gupta, Bandler and 
Kiszka (1985); Harmon and King (1985); Hayes-Roth (1985); 
Michaelson, Michie and Boulanger (1985); Mill (1985); 
Politakis (1985); Sell (1985): Denning (1986); Dreyfus and 
Dreyfus (1986); Elliot (1986); Frost (1986); S. Hughes 
(1986); Keravnou and Johnson (1986); L. Moskowitz (1986); 
Myers (1986); S.Wood (1986); Hu (1987); Kerridge (1987); 
Quinlan (1987); Shapiro (1987); Slatter (1987); Sturridge 
(1987); Cleal and Heaton (1988); Evitt and Mukaddam 
(1988); A. Goodall (1988); Greenwell (1988); Huang and 
Fan (1988); Ince (1988); Madni (1988); J. Martin and 
Oxman (1988); Parsaye and Chignell (1988); Pham (1988); 
Savory (1988); C.Tayler (1988b); Waters and Nielsen (1988); 
J.A. Campbell and Cuena (1989); Lien (1989); Madhavan 
and Kirsten (1989); Vadera (1989); Ferrada and Holmes 
(1990); IEE (1990 Conf. Publ. 322,1991 Coll. Dig. 91/26); 
Patterson (1990); Ford (1991); Mitter (1991); Gonzales and 
Dankell (1993) 

Knowledge acquisition 

R. Davis (1977,1978); Waterman (1978,1981); Chisholm and 
Sleeman (1979); Nilsson (1980); Hayes-Roth,Waterman and 
Lenat (1983); Weiss and Kulikowski (1983); Sell (1985); 
Boose (1986); Kidd (1987); Chignell and Petterson (1988); 
Norman and Naveed (1988); Diaper (1989); Aldersey, Lees 
and Rushton (1993) 

Knowledge representation 

Michie (1974); Winograd (1975); Hayes (1977); Lyons (1977); 
Winston (1977); Barr and Feigenbaum (1981—); Culicover 
(1982); Hayes-Roth, Waterman and Lenat (1983); Israel 
(1983); Weiss and Kulikowski (1983); Simons (1984); 
Harmon and King (1985); Sell (1985); Beynon and Davies 
(1987); Hodgson (1991) 

Language: Chomsky (1957); Winograd (1972,1983); Lawson 
(1982); Pinker (1984); Cullingford (1986); J. Allen (1987) 
Pattern recognition: Fu (1981) 

Vision: H.C. Andrews (1970); Hanson and Riseman (1978); 
Ballard and Brown (1982); Marr (1982); Horn (1986) 

Logic: Stebbing (1942); Lukasiewicz (1951); Suppes (1957); 
Kleene (1967); Ennis (1969); Nilsson (1971,1980); Lemmon 
(1972); Manna (1973); Shafer (1976); van Emden (1977); 
Hodges (1978); Kowalski (1979); R. Turner (1984) 

Predicate calculus: Larson and Michalski (1977); Nilsson 
(1980); Clocksin and Mellish (1981); Hayes-Roth, Waterman 
and Lenat (1983); Alty and Coombs (1984) 

Incidence calculus: Bundy (1984) 

Heuristics: Polya (1954,1957); Buchanan, Feigenbaum and 
Sridharan (1972); Wickelgren (1974); Sussman and 
Stallman (1975); Pearl (1984) 

Procedural representation: Raphael (1968); Hewitt (1972) 
Production systems, rules: Newell (1973); R. Davis and King 
(1976); R. Davis, Buchanan and Shortliffe (1977); Winston 
(1977); Waterman and Hayes-Roth (1978); van Melle (1979); 
Nilsson (1980): Barr and Feigenbaum (1981—); Winston and 
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Horn (1981); Alty and Coombs (1984); Simons (1984); 
Harmon and King (1985); Sell (1985) 

Semantic networks: Minsky (1968); J. Anderson and Bower 
(1973); Simmons (1973); Michie (1974); Norman and 
Rumelhart (1975); Winston (1977,1984); Duda etal. (1978); 
Chisholm and Sleeman (1979); Rychener (1979); Nilsson 
(1980); Barr and Feigenbaum (1981—); Alty and Coombs 
(1984); Simons (1984); Harmon and King (1985); Sell (1985) 
Semantic primitives: Wilks (1975); Schank and Abelson 
(1977);Winograd (1978) 

Frames: Kuipers (1975); Minsky (1975); Bobrow and 
Winograd (1977); Schank and Abelson (1977); Winston 
(1977,1984); Barr and Feigenbaum (1981-); Winston and 
Horn (1981); Alty and Coombs (1984); Harmon and 
King (1985) 

Bayesian logic: Duda, Hart and Milsson (1976); Naylor 
(1983); Weiss and Kulikowski (1983); Alty and Coombs 
(1984); Sell (1985) 

Fuzzy logic: Zadeh (1965,1968,1975a,b, 1978,1979, 

1983a,b, 1985,1992); Zadeh and Fukanaka (1975); Gaines 
(1976); Gaines and Kohout (1977); Dubois and Prade (1980); 
Mamdani and Gaines (1981); Forsyth (1984c); Kacprzyck 
(1983,1992); Zimmerman (1984,1986,1987); di Nola etal. 
(1989); Zadeh and Kacprzyck (1992) 

Odds: Michie (1982a) 

Operation, control, search 

Control strategies: Winston (1977,1984); R. Davis (1980a,b); 
Nilsson (1980); Hayes-Roth,Waterman and Lenat (1983); 
Alty and Coombs (1984); Harmon and King (1985); 

Sell (1985) 

Search: Doran and Michie (1966); Doran (1968); Michie 
(1974,1982b); Winston (1977,1984); Charniak, Riesbeck and 
McDermott (1980); Nilsson (1980); Barr and Feigenbaum 
(1981-); Gardner (1981); Winston and Horn (1981); 
Hayes-Roth, Waterman and Lenat (1983); Alty and 
Coombs (1984); Simons (1984); Montgomery (1991) 
Forward chaining, backward chaining, backtracking: 
Charniak, Riesbeck and McDermott (1980); Nilsson (1980); 
Winston and Horn (1981); Weiss and Kulikowski (1983); 
Alty and Coombs (1984); Winston (1984); Harmon and 
King (1985) 

Inference engine: Hayes-Roth, Waterman and Lenat (1983); 
Naylor (1984) 

Problem-solving 

Games and puzzles: Michie (1974) 

Draughts (checkers) and chess: C.E. Shannon (1950a,b); 
Newell, Shaw and Simon (1958); Samuel (1959,1960, 

1963a,b, 1968); Michie (1974); Newborn (1975); Shapiro and 
Niblett (1982) 

Theorem-proving: C.C. Green (1969); Michie (1974) 

GPS: Newell, Shaw and Simon (1960); Newell and Simon 
(1963); Ernst and Newell (1969) 

Facilities 

Blackboard systems: Engelmore and Morgan (1988) 
Questioning, questionnaires: Weiss and Kulikowski (1983) 
Explanation: A.C. Scott etal. (1977);WJ. Clancey (1979, 

1983) ; Hayes-Roth,Waterman and Lenat (1983); Sell (1985); 
Ellis (1989) 

Learning 

Nilsson (1965,1988); Michie (1974,1983); D. Shaw, Swartout 
and Green (1975); Summers (1977); Winston (1980,1982, 

1984) ; Dietterich and Michalski (1981); Simon (1983); 
Forsyth (1984d); Hart (1984); Simons (1984); S.F. Smith 


(1984); Durham (1985d,e); M. James (1985); Schlimmer and 
Langley (1992); Al-Attar and Hassan (1994); C.C. Taylor, 
Spiegelhalter and Michie (1994) 

IDS: Quinlan (1979,1983a,b); Durham (1985d); Quinlan 
etal. (1986) 

Planning 

Fikes and Nilsson (1971); Fikes, Hart and Nilsson (1972); 
Sacerdoti (1975,1977); Stefik (1981a, b); Vere (1983,1992); 
Oshima (1983);Wilensky (1983); Chapman (1985); J. Allen, 
Hendler and Tate (1990); Lyons and Hendricks (1992) 

Tutoring 

Sleeman and Brown (1982) 

Validation 

Hayes-Roth,Waterman and Lenat (1983); Weiss and 
Kulikowski (1983); A. Stevens (1984); Sell (1985) 

Programming 

Knuth (1968,1969,1973);Tyugu (1988) 

Compilation, compilers: Bornat (1979); Charniak, Riesbeck 
and McDermott (1980) 

List processing: Forster (1967) 

Logic programming: Kowalski (1974,1979); van Emden 
(1977); J.A. Robinson (1979,1983); K.L. Clark and Tarnlund 
(1982); K.L. Clark (1983); Oliviera (1984); Sell (1985); 
Amble (1987) 

Recursion: Burge (1975); Winston and Horn (1981) 

Languages 

LISP: McCarthy etal. (1962);Weissman (1967); 

D. P. Frie d man (1974); Siklossy (1976); Winston (1977); 

J. Allen (1978,1979); McCarthy (1978); Pratt (1979); 
Charniak, Riesbeck and McDermott (1980); Barr and 
Feigenbaum (1981-);Teitelman and Masinter (1981); 
Winston and Horn (1981); Danicic (1983); Gnosis (1984); 
Hasemer (1984a,b); Laubsch (1984); Queinnec (1984); 

Steel (1984); Harmon and King (1985); Narayanan and 
Sharkey (1985); Coxhead (1987) 

PROLOG: Kowalski (1974,1979); van Emden (1977); 
Warren, Perreira and Perreira (1977); Coelho etal. (1980); 
Clocksin and Mellish (1981); K.L. Clark and McCabe (1982); 
J.A. Campbell (1983,1984); Mizoguchi (1983); Swinson 
(1983); Alty and Coombs (1984); Clocksin (1984); Forsyth 
(1984a); Li (1984); Schlobohm (1984); Yazdani (1984,1985); 
Burnham and Hall (1985); J. Cohen (1985); Colmerauer 
(1985); Durham (1985c); Harmon and King (1985); 
de Saram (1985); Hinde (1986); Sterling and Shapiro (1986); 
Saint-Dizier (1987) 

POP-2: Popplestone (1967); Burstall (1971); Burstall and 
Collins (1971); Burstall and Popplestone (1971); Burstall, 
Collins and Popplestone (1971) 

POP-11: Ramsay and Barrett (1987); Popplestone (1992b) 
POPLOG: Sloman, Hardy and Gibson (1983); Hardy (1984); 
Popplestone (1992a) 

Object-oriented p g „ Goldberg and Robsen 

(1983); B.J. Cox (1986); Stefik and Bobrow (1986); 

S. Cook (1987) 

C++: Coplien (1992); Wang (1994) 

Example systems 

DENDRAL: E.G. Buchanan, Sutherland and Feigenbaum 
(1969,1970); Feigenbaum, Buchanan and Lederberg (1971); 
Michie (1974); E.G. Buchanan etal. (1976); Carhart (1977); 

E. G. Buchanan and Feigenbaum (1978); E.G. Buchanan 
(1979); Nilsson (1980); Lindsay etal. (1980); Barr and 
Feigenbaum (1981-); Hayes-Roth, Waterman and Lenat 
(1983); Weiss and Kulikowski (1983); Alty and Coombs 
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(1984); E.G. Buchanan and Shortliffe (1984); Winston 
(1984); Harmon and King (1985); Sell (1985) 
PROSPECTOR: Duda etal. (1978); Hart, Duda and Einaudy 
(1978); Duda, Gaschnig and Hart (1979); Reboh (1980,1981); 
Barr and Feigenbaum (1981-); Duda and Gaschnig (1981); 
A. Campbell etal. (1982); Hayes-Roth,Waterman and Lenat 
(1983); Weiss and Kulikowski (1983); Alty and Coombs 
(1984); Harmon and King (1985); Sell (1985) 

MYCIN: Shortliffe and Buchanan (1975); Shortliffe (1976); 
W.J. Clancey, Shortliffe and Buchanan (1979); Shortliffe, 
Buchanan and Feigenbaum (1979); Barr and Feigenbaum 
(1981-); W.J. Clancey and Lettsinger (1981); Hayes-Roth, 
Waterman and Lenat (1983); Weiss and Kulikowski (1983); 
Alty and Coombs (1984); Cendrowska and Bramer (1984); 
Winston (1984); Hannon and King (1985); Sell (1985) 
TEIRESIAS: Barr and Feigenbaum (1981—); Hayes-Roth, 
Waterman and Lenat (1983); Alty and Coombs (1984); 
Winston (1984) 

Rl, XCON, XCEL: McDermott (1980,1981,1982a,b); Hayes- 
Roth, Waterman and Lenat (1983); Weiss and Kulikowski 
(1983); Alty and Coombs (1984); Bachant and MacDermott 
(1984); Kraft (1984); Winston (1984); Harmon and King 
(1985); van de Brug, Bachant and MacDermott (1986); 
Durham (1987) 

CASNET: Weiss, Kulikowski and Saflr (1977,1978); Weiss 
etal. (1978); Barr and Feigenbaum (1981 -); Weiss and 
Kulikowski (1981,1983); Kulikowski and Weiss (1982); 
Hayes-Roth, Waterman and Lenat (1983); Alty and 
Coombs (1984) 

MOLGEN: Hayes-Roth,Waterman and Lenat (1983); Alty 
and Coombs (1984) 

INTERNIST: R.A. Miller, Pople and Myers (1982); 

Pople (1982) 

PUFF: Hayes-Roth, Waterman and Lenat (1983); 

Naylor (1983) 

OPS: Forgy and McDermott (1977); Forgy (1981); Hayes- 
Roth, Waterman and Lenat (1983); Brownston et al. (1985); 
Harmon and King (1985) 

KAS: Hayes-Roth, Waterman and Lenat (1983); Harmon and 
King (1985) 

Spill prevention: B.A Kelly and Oakes (1980); Hayes-Roth, 
Waterman and Lenat (1983) 

AL/X: Reiter (1980) 

STEAMER: Holan, Hutchings and Weitzman (1984) 
AMEURISKO: Lenat (1982,1983); Lenat and Brown (1984); 
Durham (1985f); Shells Cendrowska and Bramer (1984); 
E.J. Miller, Wilson and Lewis (1988) 

EMYCIN: van Melle (1979,1980,1981); van Melle, Shortliffe 
and Buchanan (1981); Hayes-Roth,Waterman and Lenat 
(1983); Weiss and Kulikowski (1983); Alty and Coombs 
(1984) 

EXPERT: Weiss and Kulikowski (1979,1981); Barr and 
Feigenbaum (1981-); Kulikowski and Weiss (1982); Hayes- 
Roth, Waterman and Lenat (1983); Harmon and King (1985) 
MICRO EXPERT: P. Cox (1984) 

ES/P ADVISOR: Harmon and King (1985) 

CRYSTAL: Wallsgrove (1988) 

G2: Gensym Corp. (1992) 

Databases 

Date (1977); R. Davis (1980); Ullman (1982); Maier (1983); 
Frost (1986) 

Decision aids 

Kunz and Rittle (1970); Conklin and Begeman (1988); Potts 
and Bruns (1988); Lubers (1991) 


Documentation aids 

Bourdeau (1991); Kahkonen and Bjork (1991); Casson 
(1992); Casson and Stone (1992); Chung and Stone (1994) 

Neural networks 

Minsky and Papert (1969);Touretszky and Hinton (1985); 
Gallant (1988); Saito and Nakano (1988); IFF (1989 Conf. 
Publ. 313,1991 Conf. Publ. 349, Coll. Dig. 91/19,1993 Conf. 
Publ. 372); Beale and Jackson (1990); Zeidenberg (1990) 


B Process applications 


Engineering design 

Simon (1969); P. Freeman and Newell (1971); Eastman 
(1978); D.C. Brown and Chandrasekaran (1989); Ganeshan, 
Finger and Garrett (1991) 

Artificial intelligence 
Chowdhury and Caudwell (1982); F. Kane (1986); 
Stephanopoulos (1990); Bunn and Lees (1988); Hutton, 
Ponton and Waters (1990) 

Expert systems 

Anon. (1984tt); Andow (1984); B. Knight et al. (1984); Anon. 
(19851); Banares-Alcantara and Westerberg (1985); 
Banares-Alcantara,Westerberg and Rychener (1985); Avni, 
Kandell and Gupta (1985); Baker-CounseU (1985b); 
Banares-Alcantara, Sriram etal. (1985); Berkovitch and 
Baker-Counsell (1985); Chowdhury (1985b); Chowdhury, 
Short and Gibb (1985); M. Henry (1985); R.L. Moore (1985); 
Sachs, Paterson and Turner (1985); Voller and Knight 
(1985); Anon (1986h); Basden and Mines (1986); Beazley 
(1986); British Gas (1986 Comm. 1297); Branch (1986); 
Coulsey (1986); Durham (1986); Ferguson and Andow 
(1986); Mines (1986); Mines and Basden (1986); Hollnagel 
etal. (1986); R.A. King (1986); Kosar and Blahut (1986); 
Niida etal. (1986); Shirley and Fortin (1986);Vaija, 
Jarvelainen and Dohnal (1986b); Anon. (1987k,s); Andow 
and Ferguson (1987); N. Atkinson (1987a); Banares- 
Alcantara etal. (1987); BarnweU and Ertl (1987); Holt etal. 
(1987); IBC (1987/71); A. Moore (1987); Oxman and Gero 
(1987); Rafaat and Abdouni (1987); Rand (1987); Russo and 
Peskin (1987); Sangiovanni and Romans (1987); Shirley 
(1987); Stephanopoulos (1987);Tayler (1987b); Anon. 
(1988n); Banares-Alcantara, Ko etal. (1988); Birky, McAvoy 
and Modares (1988); Bunn and Lees (1988); Norman and 
Naveed (1988); Novak, Schechter and Lake (1988); Royse 
(1988); Shum etal. (1988);W.A.Taylor (1988); BRE (1989 
IP4/89); Gani (1989); Hofmeister, Halasz and Rippin (1989); 
Hollnagel (1989); Lahdenpera, Korhonen and Nystrom 
(1989); Birky and McAvoy (1990); Suokas, Heino and 
Karvonen (1990); Gulbrandsen (1991); Leicht,Wingender 
and Ruppert (1991); Quantrill and Liu (1991); Calzada, 
Espasa and Barrera (1992); Crowe et al. (1992); Fiumi and 
Giorgio (1992); Hanratty and Joseph (1992); Martinez etal. 
(1992); Samdani and Fouhy (1992); Chang, Hwang and 
Hwang (1993); Hingoraney (1994) 

Process plant design, equipment selection 
Rudd and Watson (1968); Bunn and Lees (1988); Myers, 
Davis and Herman (1988); Waters, Chung and Ponton 
(1989); Waters and Ponton (1992); Chung, Abbas and 
Robertson (1993); Yang etal. (1993) 

Process modelling 

Franks (1967); Durham (1985b); A.R. Mitchell and Griffiths 
(1980); Andersson (1989); Cott et al. (1989); Nilsson (1989); 
Piela etal. (1991); Gallun etal. (1992); Marquardt (1992); 
Nemeth etal. (1992) 
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Process synthesis 

Powers and Jones (1973); May and Rudd (1976); Westerberg 
(1980,1985,1989); Nishida, Stephanopoulos and 
Westerberg (1981); Umeda (1982); Rippin (1983); Sargent 
(1983); Stephanopoulos (1983); Grossman and Floudas 
(1987); Grossman,Westerberg and Biegler (1987); 
Montagna etal. (1987); Pai and Hughes (1987); Beltramini 
and Motard (1988); Douglas (1988); Floquet, Piboleau and 
Domenech (1988); Kirkwood, Lock and Douglas (1988); 
Reklaitis and Spriggs (1988); Engelmann etal. (1989); 
Grossman (1989); Hofmeister, Halasz and Rippin (1989); 
Motard (1989); Mizsey and Fonyo (1990); Ostrovsky and 
Berezinsky (1991); Raman and Grossman (1991); Crowe 
et al. (1992); Journet (1993) 

DESIGN-KIT 

Stephanopoulos, Johnston et al. (1987) 

MODEL.LA 

Stephanopoulos, Hanning and Leone (1990a,b) 

Planning 

Rivas and Rudd (1974); Rivas, Rudd and Kelly (1974); 
Fusillo and Powers (1987,1988a,b); Stephanopoulos et al. 
(1987); Foulkes etal. (1988); Lakshmanan and 
Stephanopoulos (1988a,b, 1990); Aelion and Powers (1991); 
Rotstein, Lavie and Lewin (1992); Soutter and Chung (1993) 
Qualitative modelling 

Andow (1973); Andow and Lees (1975); de Kleer (1975,1984, 
1985,1992); Hayes (1979,1985); Martin-Solis, Andow and 
Lees (1982); Centner and Stevens (1983); de Kleer and 
Brown (1983,1984,1986); Wilensky (1983); Bobrow (1984, 
1985); R. Davis (1984); Kuipers (1984,1986,1989); 

B.C.Williams (1984a,b); Hobbs and Moore (1985); Ponton 
and Vasek (1986); Weld (1987,1988a, b); Dalle Molle, Kuipers 
and Edgar (1988); Mavrovouniotis and Stephanopoulos 
(1988); Oyeleye and Kramer (1988); Pethe, Singh and Knopf 
(1989); Waters and Ponton (1989); P. Rose (1990); Weld and 
de Kleer (1990); Yamashita, Shoji and Suzuki (1990); Catino, 
Grantham and Ungas (1991); Faltings and Struss (1991); 
Grantham and Ungar (1991); P. Rose and Kramer (1991); 
Hardt (1992); Koivisto etal. (1992); Fanti, Chung and 
Rushton (1993); Savkonic-Stevanovic (1994) 

Order of magnitude estimation, modelling 
Mosteller (1977); Mavrovouniotis and Stephanopoulos 
(1988) 

Neural networks 

Hoskins and Himmelblau (1988); Venkatasubramanian and 
King Chan (1989); Watanabe et al. (1989); Bhagat (1990); 
Bhat and McAvoy (1990); M.A. Kramer and Leonard (1990); 
Samdani (1990a); Venkatasubramanian, Vaidhyanathan 
and Yamamoto (1990); Okayama (1991); 
Venkatasubramanian and McAvoy (1992); Chitra (1993); 
Fan, Nikolaou and White (1993); A J. Morris, Montague and 
Willis (1994) 

Fault propagation 

Andow (1973); Andow and Lees (1975); Umeda etal. (1979, 
1980); Andow, Lees and Murphy (1980); Martin-Solis, 
Andow and Lees (1982); B.E. Kelly and Lees (1986a-d); 
Parmar and Lees (1987a,b); Khan and Hunt (1989); Waters 
and Ponton (1989); A. Hunt etal. (1993a—e) 

QUEEN: Chung (1993) 

Design decision aids 

Ramirez-Dominguez and Banares-Alcantara (1993); Chung 
and Goodwin (1994); Goodwin and Chung (1994a,b) 


Explosion venting 

Santon etal. (1991); von Haefen (1992); Santon (1992) 

Reliability engineering 
FIABEX: MM. Grant and Harvey (1989) 

Hazard identification 

Lihou, Rahimi and Fletcher (1980); lihou (1983 LPB 51); 
Andow and Ferguson (1987); Karvonen, Suokas and Heino 
(1987); Kletz (1988b); Weatherill and Cameron (1988,1989); 
N. Morgan (1992b); Heino, Suokas and Karvonen (1989a,b); 
C. Price and Hunt (1991); C. Price etal. (1991); R.A. Freeman, 
Lee and McNamara (1992); Goring and Schecker (1992); 
Heikkila and Heino (1992); Heino, Poucet and Suokas 
(1992); Schb’nenburg (1992); Lear (1993); Heino etal. (1994); 
Venkatasubramanian and Vaidhyanathan (1994) 
COMHAZOP: Rootsaert and Harrington (1992) 

HAZID: Parmar and Lees (1987a,b); Zerkani and Rushton 
(1992,1993) 

Failure modes and effects analysis (FMEA) 

C. Price et al. (1991) 

Fault tree drafting and synthesis 

W.Q. Smith and Lien (1968); Fussell (1973a,b); Henley 
(1977); L.S. Baker etal. (1978); Camarda, Corsi and 
Trentadue (1978); DJ. Allen and Rao (1980); Lihou (1980b); 
Poucet and de Meester (1981); Amendola et al. (1983); Poucet 
(1983); D.J. Allen (1984); Shafaghi, Andow and Lees (1984); 
Shafaghi, Lees and Andow (1984); VTT (1985 Res. Rep. 
330); Kumamoto and Henley (1986); Kohda and Henley 
(1988); Mullhi etal. (1988); Napier and Palmer (1988); de 
Vries (1990); Bossche (1991a-c); Chuei-Tin Chang and 
Her-Chuan Hwang (1992) 

CAT: Salem, Apostolakis and Okrent (1975a, b, 1977); Chu 
(1976); Apostolakis, Salem and Wu (1978); Salem, Wu and 
Apostolakis (1979); Salem and Apostolakis (1980); 
SqueUati (1980); Poucet (1983) 

FAULTFINDER: Andow and Lees (1975); Martin-Solis, 
Andow and Lees (1977,1980,1982); B.E.Kelly (1982); 

B.E. Kelly and Lees (1986a-d); Mullhi etal. (1988); A. Hunt 
etal. (1993a—e) 

FTS: Powers and Tompkins (1974a,b, 1976); Powers and 
Lapp (1976,1977); Henley and Kumamoto (1977); Lapp and 
Powers (1977a,b, 1979); Locks (1979,1980); Powers (1977); 
Shaeiwitz, Lapp and Powers (1977); Lambert (1979); 
Yellman (1979); Cummings, Lapp and Powers (1983) 
RIKKE: J.R. Taylor (1982); J.R. Taylor and Olsen (1983); 

J.M. Morgan (1985) 

Hazard models 

Rao and Raj (1990); Koivisto etal. (1991) 

Hazard assessment 

Nelms (1988); Ja’ger, Diedershagen and Kiihnreich (1989); 
Reeves and Mennell (1989); Reeves, Wells and Linkens 
(1989); Kakko (1991); Heino, Poucet and Suokas (1992) 

Process monitoring 

Stainthorp and West (1974); Hogger (1975); Berenblut and 
Whitehouse (1976,1977); Anon. (1977a); Munday (1977); 
Dye (1979); Cheung and Stephanopoulos (1990); Alty and 
McCartney (1991); Alty and Bergan (1992) 

RESCU: Shorter (1985) 

Multi-media systems 

Alty and McCartney (1991); Alty and Bergan (1992);Tani 
etal. (m2) 

Fault administration and diagnosis 

Jervis and Maddock (1965); Welbourne (1965,1968,1974); 
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Kay (1966); Kay and Heywood (1966); Earth and 
Maarleveld (1967); Patterson (1968); Andow (1973,1982, 
1984,1985a—c, 1986); E. Edwards and Lees (1973,1974); 
Andow and Lees (1975); Dahll (1976); Dahll et al. (1976); 
Powers and Lapp (1977); EPRI (1978 EPRINP- 613,1980 
EPRINP-1379, EPRI NP-1684); Frogner and Meijer (1978, 
1980); Iri etal. (1979); Umeda etal. (1979); GeseUschaft fur 
Reaktorsichheit (1980); Long (1980); Long etal. (1980); 
Meijer, Frogner and Long (1980); Lees (1981a, 1983c, 1984); 
Pau (1981a,b); Martin-Solis, Andow and Lees (1982); 

W.R. Nelson (1982,1984); Kokawa, Miyaki and Shingai 
(1983); Guarro and Okrent (1984); Herbert (1984); Iserman 
(1984);Watanabe and Himmelblau (1984); WR. Nelson and 
Blackman (1985); Shiozaki etal. (1985);Tsuge etal. (1985); 
Ungar (1985); Modarres and Cadman (1986); Rowan (1986); 
Wollenberg (1986); Arendt etal. (1987); Dalle Molle and 
Himmelblau (1987); Frank (1987); M.A. Kramer (1987a,b, 
1988); Kumamoto and Henley (1987);Washio, Kitamura and 
Sugiyama (1987); Ramesh, Shum and Davis (1988); Rich 
and Venkatasubramanian (1988,1989); ShumefaZ. (1988); 
Venkatasubramanian (1988); Venkatasubramanian and 
Rich (1988); B. Chen etal. (1989); Gertler and Qiang Luo 
(1989); M.A. Kramer and Finch (1989); Rich etal. (1989); 
Sang Hoon Han etal. (1989);Tsuge, Matsuyama and 
McGreavy (1989); Venkatasubramanian and King Chan 
(1989); Basila, Stefanek and Cinar (1990); L.W. Chen and 
Modarres (1990); Chung-Chen Chang and Cheng-ChingYu 
(1990); D.J. Cooper and Lalonde (1990); Finch, Oyeleye and 
Kramer (1990); M.A. Kramer and Leonard (1990); Labadibi 
(1990); Poucet (1990); Qian (1990); P. Rose (1990);Trenchard 
(1990); Ungar, Powell and Kamens (1990); 
Venkatasubramanian, Vaidhyanathan and Yamamoto 
(1990); Yamashita, Shoji and Suzuki (1990); Adamson and 
Roberge (1991); Aldersey, Lees and Rushton (1991); Chen- 
Ching Yu and Chyuan Lee (1991); Hoskins, Kaliyur and 
Himmelblau (1991); Li and Olson (1991); McDowell and 
Davis (1991); Pelti, Klein and Dhurjati (1991); P. Rose and 
Kramer (1991); Yoon, Oh and Yoon (1991); Corea,Tham and 
Morris (1992); Corti and Sansone (1992); IEE (1992 Coll. 
Dig. 92/45,92/48); Karvonen etal. (1992); Labadibi and 
McGreavy (1992); Ramesh, Davis and Schwenzer (1992); 
Saelid, Mjaavatten and Fjalestad (1992); Venkateswarlu, 
Gangiah and Rao (1992); Yih-Yuan Hsu and Cheng-Chin Yu 
(1992); Chuei-Tin Chang etal. (1993); Fan, Nikolaou and 
White (1993); Fathi, Ramirez and Korbicz (1993); 
Ramanathan, Kannan and Davis (1993) 

Instrument system design: Lambert (1977); Plamping and 
Andow (1983); Plamping (1986); A.M. and Narasimhan 
(1993) 

ANTICIPATOR: Munday (1977); Dye (1979) 

AUTOPES: Wagenaar, Boesmans and Schrijnen (1989) 
COGSYS: Anon. (1988n) 

Malfunction detection 

Instruments: Kuehn and Davidson (1961); Clementson 
(1963); Ripps (1965); Barton etal. (1970); Anyakora (1971); 
Goldmann and Sargent (1971); Sommer etal. (1971); Umeda, 
Nishio and Komatsou (1971); Anyakora and Lees (1972b, 
1973); Nogita (1972); E. Edwards and Lees (1973,1974); 
Nogita and Uchiyama (1973); R.N. Clark, Fosth and Walton 
(1975); Hawickhorst (1975); Bellingham (1976); Bellingham 
and Lees (1976a,b, 1977a,b); Lees (1976d); Mah, Stanley and 
Downing (1976); Wfflsky (1976); Stanley and Mah (1977); 
Himmelblau (1978,1979); Park and Himmelblau (1983, 
1987); Narasimhan and Mah (1987); Jongelen, den Heijer 


and van Zee (1988); Tjoa and Bielger (1991);Whiteley and 
Davis (1992) 

Plant equipment: Gallier (1968); Anyakora and Lees 
(1972b); Lees (1972); Whitman (1972); Collacott (1976b, 
1977b); Himmelblau (1978); Dalle Molle and Himmelblau 
(1987); M.A. Kramer (1987b); MA ICramer and 
Palowitch (1987) 

Data management and reconciliation 

Romagnoli and Stephanopoulos (1981); Gorczynski (1985); 
Himmelblau (1985); lordache, Mah andTamhane (1985); 
Madron (1985); Heenan and Serth (1986); Seith and Heenan 
(1986); Rosenberg, Mah and lordache (1987); Crowe (1988); 
R.J. MacDonald and Howat (1988); Chen-Shan Kuo, 
Tamhane and Mah (1990); May and Payne (1992); Rollins 
and Davis (1992,1993); Verneuil, Pin Yang and Madron 
(1992); Leibovici, Verneuil and Pin Yang (1993); McMorris 
and Graveley (1993) 

Operating procedures 
Tomita, Hwang and Oshinma (1989) 

Robots 

R. Brooks (1986,1989); Schoppers (1987) 

Transport systems 

Bliimel and Schulz-Forberg (1989) 

Accident databases 
Koivisto.Vaija and Dohnal (1989) 


30.1 Knowledge Representation 

30.1.1 Knowledge 

Knowledge is of many kinds and this is reflected in the 
forms of knowledge representation used. 

One distinction commonly made is between data and 
information. Other distinctions made about knowledge are 
domain-independent vs domain-specific, exact vs fuzzy, 
and procedural vs declarative knowledge. Some types of 
knowledge include: facts; models; distinctions; relation¬ 
ships; constraints; procedures and plans; and rules-of- 
thumb, or heuristics. 

The extent of the knowledge required varies greatly 
between problems. In certain limited worlds, such as the 
‘blocks world’ extensively studied in AI, the world knowl¬ 
edge required is quite limited. In real-life, or mundane, 
situations on the other hand, the human comes to the prob¬ 
lem possessed of a massive store of knowledge. He draws 
from this information not only about facts but also about 
other aspects such as constraints. 

30.1.2 Natural language 

By far the most widely used and most expressive form of 
knowledge representation is natural language. As a method 
of representation in AI work, however, natural language 
has a number of deficiencies. 

There are a number of fundamental problems of natural 
language in this respect. It tends to be ambiguous. Its syn¬ 
tax and semantics are not well understood. There is con¬ 
siderable diversity in the structure of sentences. In some 
cases the meaning depends on the context. 

Work in AI tends to involve the use of structured knowl¬ 
edge and natural language is not an obvious method for 
this purpose. 
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30.1.3 Databases 

By contrast, in databases structure is a principal feature of 
the knowledge representation. In large part this structure 
is oriented to data retrieval, but it may also represent rela¬ 
tionships between the objects stored, and databases gen¬ 
erally have certain facilities for certain elementary 
transformations on the data. Databases are considered 
further in Section 30.2. 

30.1.4 Classical logics 

Logic is a formal method of reasoning and provides a sound 
theoretical basis for the reasoning process. This is par¬ 
ticularly important for computer-based approaches. 

There are two principal logics in common use. One of 
these classical logics is prepositional logic (PL) and the 
other first order predicate logic (FOPL). Prepositional logic 
is the earlier form, is simpler and is generally the starting 
point in teaching. 

Predicate logic has been developed to overcome some of 
the limitations of prepositional logic. It is a more general 
logic of which prepositional logic may be regarded as a 
special case. It is predicate logic which is most widely used 
in AI and which is used in ‘logic programming’. 

Prepositional logic has a number of serious limitations. 
It cannot readily describe properties of entities or express 
relationships between them. Predicate logic has been 
developed as a form of logic with enhanced expressiveness. 
It replaces propositions with predicates and utilizes func¬ 
tions, variables and quantifiers. This makes it possible to 
reason about entities in terms of their classes and of their 
relationships. 

In defining the syntax of a logic use is frequently made of 
the Backus-Naur form (BNF). 

Prepositional logic and predicate logic are described in 
Sections 30.3 and 30.4, respectively. 

30.1.5 Non-classical logics 

Classical logic has severe limitations in its ability to handle 
real-world situations. It deals with statements that are 
either true or untrue and does not accommodate infor¬ 
mation which is incomplete, vague, contradictory or un¬ 
believable. It does not readily handle uncertainty and 
inconsistency. It is a feature of classical logic that it is 
monotonic. The conclusions once derived are valid deduc¬ 
tions and remain so. The set off acts and inferences can only 
increase; it cannot decrease. This does not accord well with 
real life, in which it is necessary to revise conclusions 
reached as more information becomes available. 

Common-sense reasoning is therefore not well served by 
classical logic and there have been developed a number of 
non-classical logics that address particular deficiencies. 
Many of these deal with uncertainty and inconsistency, but 
other aspects such as time are also accommodated. 

These non-classical logics are considered in Section 30.7. 

30.1.6 Probabilistic reasoning 

Much knowledge relates in some way to uncertainty. The 
methods just described are not well adapted to representing 
knowledge under uncertainty, but other methods do exist 
for this purpose. Foremost among these are probabilistic 
reasoning and fuzzy logic. 

Methods for handling uncertainty are described in 
Section 30.8 and those of probabilistic reasoning and fuzzy 
logic are described in Sections 30.9 and 30.10, respectively. 


30.1.7 Structured knowledge 

AI possesses a rich repertoire of methods for the storage of 
knowledge in structured forms. The creation of structure 
has a significance that goes far beyond simple ease of 
retrieval. It imposes a discipline that ensures that the 
entities and their relationships are formally defined and it 
facilitates basic operations such as search and matching. 
Structured knowledge is considered in Section 30.12. 

30.1.8 Graphs, trees and networks 

A form of knowledge representation widely used by humans 
is diagrams in the form of graphs, trees and networks. There 
are a large number of such diagrams in common use and a 
number that have been developed in the course of AI work. 
These diagrams may be mapped into program structures 
and in many cases there are standard techniques available to 
do this. An outline of some of the graphs, trees and networks 
in use in AI is given in Section 30.22. 

30.1.9 Programming languages 

The programs of interest here are those that both contain 
representations of knowledge and perform operations on 
them. Such programs are most effectively implemented in 
programming languages of the declarative rather than the 
procedural type, the principal languages being LISP and 
Prolog. The strength of these languages is their ability to 
combine representation of knowledge in the forms required 
in AI work and support for various modes of reasoning. 
Programming languages are described in Section 30.11. 

30.2 Databases 

A widely used form of knowledge representation is the 
database. Databases are a major topic but may be treated 
here quite briefly. 

Accounts of databases are given in An Introduction to 
Database Systems (Date, 1977), Principles of Database Sys¬ 
tems (Ullman, 1982), and The Theory of Relational Databases 
(Maier, 1983). Data bases in the context of AI are discussed 
by Frost (1986) and Tanimoto (1990). 

A database stores and provides ready access to data. It 
imposes a discipline on the classification and storage of 
data. It is a natural form for the storage of knowledge about 
certain types of relationship between data. 

A rich variety of data structures are available, including: 
arrays, lists, strings, queues, stacks, bit maps and records; 
direct access, sequential, inverted and transposed files; hash 
tables; graphs and trees; and multi-lists, inverted lists and 
bit lists. 

Aids to the design and implementation of databases exist 
in the form of database management systems (DBMSs) that 
provide a collection of procedures, documentation aids, 
languages and programs. 

Corruption of the database must be avoided and various 
formal systems are required. By controlling access a privacy 
subsystem protects against unauthorized alteration of the 
database. An integrity subsystem protects against invalid 
alteration by imposing a discipline on those authorized to 
make changes. A back-up and recovery subsystem provides 
a facility for rebuilding the database after corruption has 
occurred. 

30.2.1 Relational databases 

A form of database suited to the handling of large data sets 
with regular structure is the relational database. The term 
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‘relation’ is applied to a set of ordered w-tuples, or ordered 
sets each containing n items. An «-ary relation has n fields. 
The first field is referred to as the primary key. A field 
possesses a domain, which comprises the set of entities 
from which elements in the field may be drawn. A name is 
assigned both to the relation and to its fields. The following 
table is an illustration of a 3 -ary relation. 


PIPE 


Section 

Diameter (in.) 

Material 

Supplier 

Straight 

3 

Copper 

X 

Straight flanged 3 

Mild steel 

Y 

90° bend 

4 

Stainless steel Y 

T-section 

4 

Stainless steel Y 


The relation is PIPE, the primary key is Section , the other 
fields being Diameter, Material and Supplier. 

Some elementary operations that are supported by rela¬ 
tional database programs include selection, projection and 
joining. Selection is the creation from an existing relation of 
a new, more specialized relation by selection of a subset of 
rows which have some common property. Projection is the 
creation from an existing relation of a new, more specialized 
relation by excision of some of the fields. Joining is the 
creation of a new relation by the fusion of two existing 
relations. 

30.3 Prepositional Logic 

30.3.1 Propositions 

Prepositional logic deals with the relationships between 
propositions. Typical propositions are: 

(1) The valve is open. 

(2) The valve is open and the pipe is full of liquid. 

The first of these is a simple proposition and the second a 
compound proposition. Propositions are also referred to as 
statements, sentences or formulas. Statements are repre¬ 
sented by prepositional symbols, which are capital letters, 
commonly P, Q, R, etc. 

30.3.2 Syntax 

The main feature of the syntax of prepositional logic is the 
connectives, the symbols for which are shown inTable 30.2, 
Section A. Use is also made of parentheses () as delimiters, 
but where there is no chance of ambiguity, parentheses may 
be omitted, in which case the order of precedence of the 
connectives is, from highest to lowest: -i, A, V, =t>, 

The set of statements commonly used to illustrate the 
connectives is as follows: 

-.P 
PAQ 
P vQ 
P^Q 
P^Q 


Table 30.2 Some features of propositional logic 


A Connectives 


Type 

Meaning 

symbol 

Symbol 

Alternative 

Negation 

not 


m 

Conjunction 


A 

& 

Disjunction 

or 

V 

V 

Implication 

if... then 

=> 

—> 

Double implication 

if and only if 




B Some equivalence laws 


Idempotency 

P AP sP 

PVPhP 

Commutativity 

PAQeeQ a p 

PvQeeQvP 

P^Q^Q^P 

Associativity 

(PAQ)AR = PA(QAR) 

(P v Q) v R = P v (Q v R) 

Absorption 

PA(PvQ) = P 

PV(PAQ) = P 

Distributivity 

PA(QVR) = (PAQ) V (PA1 
PV(QAR) = (PVQ) a (PVl 

De Morgan 

—'(P A Q) = -■ P v -iQ 
~ , (P V Q) = ->P A ->Q 

Conditional elimination 

P => Q = -iP V Q 

Bi-conditional elimination 

P<^Q = (P^Q) A(Q^P) 


c 

Truth table for equivalent statements 


p 

Q 

-P 

PAQ 

PVQ 

P^Q 

T 

T 

F 

T 

T 

T 

T 

F 

F 

F 

T 

F 

F 

T 

T 

F 

T 

T 

F 

F 

T 

F 

F 

T 


inference. The semantics of a statement is the truth value 
assigned to it, the process of assignment being known as 
interpretation. The truth values assigned are true or false. 
These values are commonly denoted by T for true and F for 
false, particularly in truth tables. It should be noted that 
the symbols T and F themselves represent statements and 
are used in compound statements. 

Some properties of statements are: 

Satisfiability - a statement is satisfiable if there is an inter¬ 
pretation for which it is true. 

Contradiction - a statement is contradictory, or unsatis- 
fiable, if there is no interpretation for which it is true. 
Validity - a statement is valid, or autologous, if it is true for 
every interpretation. 

Equivalence — two statements are equivalent if they have 
the same truth value for every interpretation. 

Logical consequence - a statement is a logical consequence 
of another if it is satisfied by all interpretations that 
satisfy the first. 


30.3.3 Semantics 

Some principal features of the semantics of propositional 
logic are the properties of statements and the rules of 


In the interpretation of compound statements use is often 
made of substitution of equivalent statements. Table 30.2, 
Section B shows some equivalence laws that may be used in 
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making such substitutions. Another way of determining 
equivalence is the use of truth tables. A truth table for 
equivalent statements is shown in Table 30.2, Section C. 

30.3.4 Inference rules 

The means to perform deductions is provided by the rules 
of inference. Some principal rules are as follows. 

Modus ponens 
Assertion: P 

Assertion: P > Q 

Conclusion: Q 

Chain rule 

P => Q 
Qs»R 
P => R 

Disjunctive syllogism P 

P 

PVQ 

Resolution 

Pv-iQ 

QvR 

PVR 

Other rules of inference are: 

Substitution - if s is a valid statement, a statement s' 

derived from it by consistent substitution is also valid. 
Simplification — from P V Q inference is P. 

Conjunction - from P and Q inference is P V Q. 
Transposition — from P =>- Q inference is -Q =>• -iP. 


30.4 Predicate Logic 

30.4.1 Basic entities 

The basic entities handled in first order predicate logic 
(FOPL) are constants, variables, functions and predicates. 
The first three are referred to as terms, and predicates are 
referred to as atomic formulas, or atoms. An atom or its 
negation is referred to as a literal. 

A constant is a term that has a fixed value and a variable 
is a term that can take different values. A function maps 
elements of the domain to further elements of the domain. 
A predicate maps elements of the domain to truth values. 
Commonly used constant symbols are a, b, c, ...; function 
symbols f,g,h, ...; variable symbols x, y, z\ and predicate 

symbols P, Q, R.Use is also made of quantifiers. These 

are for existential quantification and V for universal quan¬ 
tification. The meanings are: 

3 x For some x; there is an x 
Vx For all* 

The expression 3xP(x) means that there exists at least one 
element of the domain which makes P(x) true. 


30.4.2 Syntax 

In respect of syntax, the logical connectives used in FOPL 
are the same as those for prepositional logic. 

30.4.3 Well-formed formulas 

There are rules for the construction of syntactically correct 
formulas. Formulas derived by correct application of these 
rules are termed well-formed formulas, or wffs (pro¬ 
nounced woofs). An atomic formula is a wff. Wffs are 
obtained from predicates, or atomic formulas, by applica¬ 
tion of quantifiers and connectives. 

Some wffs contain variables. If a variable follows or is 
within the scope of a quantifier, it is said to be bound; 
otherwise it isfree.The variablexinthe expression Vx(P(x) =>- 
Q(x,y)) is bound, whereas the variable y is free. For a 
formula to be evaluated, it is necessary that all the vari¬ 
ables in it be bound. This leads to the requirement that a 
wff should contain only bound variables. 

Awff, or a predicate, which has no variable is referred to 
as a ground atom. 

30.4.4 Semantics 

The semantics of FOPL are somewhat more complex than 
those for prepositional logic. They largely revolve around the 
conversion of wffs to clausal form and the application of the 
rules of inference and the principle of resolution. 

Accounts of the semantics for FOPL, including equi¬ 
valence and truth tables are given by Frost (1986) and 
Patterson (1990). 

30.4.5 Clausal form 

One of the most powerful methods of interpretation in 
FOPL is the resolution principle. But, in order to apply it, 
it is necessary first to convert the wffs to clausal form. 
A formal six-step procedure exists to effect this conversion. 

30.4.6 Inference rules 

Interpretation of the wffs is effected by application of the 
rules of inference for FOPL. One of these is modus ponens 
An illustration of modus ponens in FOPL is the following: 

Assertion P(a) 

Implication VxP(x) => Q(x) 

Conclusion Q(a) 

In this interpretation since the implication P(x) => Q(x) is 
true for all x, it is true in particular for x = a. 

30.4.7 Resolution principle 

Resolution is an inference procedue that is applied to a set 
of clauses to determine if the set is unsatisfiable. 

The principle of resolution is as follows. If there are two 
clauses Cl and C2, the parent claues, which have no vari¬ 
ables in common and if there is a iteral in Cl that is the 
complement of a literal in C2, bot literals are deleted and a 
new clause C, the resolvent, is formed from the remaining 
reduced clauses. 

An illustration of the principle is the following resolution: 
-PVQ 

-QvR 

-PVR 
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There is a family of types of resolution applicable to par¬ 
ticular combinations of numbers and of types of parent 
clauses. 

30.5 Non-deductive Inference 

The form of inference just described is deductive inference, 
but this is not the only form of inference in use. Other forms 
are abductive inference, inductive inference and analogical 
inference, and these are now described. These forms of 
inference are not strictly valid, but they are nevertheless in 
common use. 

30.5.1 Abductive inference 

Abductive inference may be represented as 

Q 

P 

where the superscript c denotes a possible causal relation¬ 
ship. A proposition Q and a causal relation P => Q are used 
to infer a proposition P. 

30.5.2 Inductive inference 

Induction involves generalization based on a limited sam¬ 
ple of entities from the universe of entities. Inductive 
inference may be represented as: 

P(ai)...P(a.) 

V*P(*) 

30.5.3 Analogical inference 

Analogical inference is based on the assumption that two 
situations that are similar in some respects are also similar in 
other respects. It, in fact, appears to utilize a combination of 
deductive, abductive and inductive inference. Analogical 
inference may be represented as: 

F=^ Q 
P* => Q' 

where the superscript r means related to and superscript ' 
denotes similar to. 

30.6 Production Rules 

As already mentioned, one form in which knowledge may 
be represented is as a set of rules, also called productions. 
Such rules may be regarded as a special case of preposi¬ 
tional logic. 

The rules are of the type IF.. .THEN—They have a left- 
hand side (LHS), which is variously known as the ante¬ 
cedent, premise, condition or situation and a right-hand side 
(RHS), which is known as the consequent, conclusion, action 
or response. The proposition on the LHS may be a compound 
one with a number of propositions ANDed together. 

A suitable set of rules, or productions, can be used to 
form the basis of a production system. Production systems 
are one of the main methods of implementing expert sys¬ 
tems and are discussed further below. 

30.6.1 Production systems 

A production system has three main features: the rule base, 
a working memory and the inference engine. The rule base 


holds the set of rules that embody the expertise of the sys¬ 
tem. The working memory is supplied with the input data, 
or facts, on the problem to which the rules are to be applied. 
The inference engine controls the operation of the rules to 
deduce conclusions from these data. 

The rules in the rule base are laid out as a set of logic 
statements. The rule base may be inspected by an expert 
to check for correctness. Rules may be added, removed or 
modified with relative ease. 

The operation of a production system is quite different 
from the execution of a program in a procedural language. 
Execution is not controlled by a procedure as such, but 
involves making a pass through the rule base and deter¬ 
mining which rules are satisfied. 

The inference engine applies the input facts to the rules 
and determines which rules are satisfied, or ‘trigger’. Pro¬ 
vided there is no conflict between the output from a rule 
and that for another rule, the rule then ‘fires’. 

30.6.2 Conflict resolution 

If such conflict does occur, it becomes necessary to apply a 
suitable conflict resolution strategy. The application of this 
strategy determines which rules should fire. The conflict 
resolution strategy used may be a generalized one or it 
may be one specific to the particular problem. There are a 
number of generalized strategies for conflict resolution. 
Winston (1984) lists the following six strategies: (1) speci¬ 
ficity ordering, (2) rule ordering, (3) data ordering, (4) size 
ordering, (5) recency ordering and (6) context limiting. 
Specificity ordering applies to a group of rules where the 
conditions of one rule are a superset of which the conditions 
in the other rules are subsets; priority is given to the rule 
with the superset of conditions. In rule ordering, the rules 
are arranged in a priority list and rule first triggered has 
priority. In data ordering, all possible aspects of the situa¬ 
tion are arranged in a priority list and the rule having the 
highest priority condition has priority. In size ordering, the 
rule has priority that has the largest number of conditions. 
In recency ordering, priority is given either to the rule that 
fired most recently or, alternatively to that which fired least 
recently. Context limiting involves dividing the rules into 
groups and creating a procedure that activates and deacti¬ 
vates groups; those rules that are in the active groups, 
having priority. 

30.7 Non-classical Logics 

The point has already been made that a classical preposi¬ 
tional logic is not sufficiently expressive. The creation of 
another, now classical, logic, the predicate calculus, was a 
response to this deficiency. The same need has given rise to 
the development of further, non-classical logics. 

These newer logics extend the range of the knowledge that 
can be represented and are thus more expressive. They make 
it possible to handle knowledge that is incomplete, uncertain, 
vague and/or inconsistent, or associated with time. They are 
often more efficient in handling the knowledge. 

The properties of a logic are that it has a well-defined 
method for representing knowledge, for obtaining proofs 
by syntactical manipulation and for extracting meaning 
using a semantic model. 

30.7.1 Many-sorted logics 

In a many-sorted logic the entities in the universe of 
discourse are divided into sorts. There are different sort 
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structures. One is a structure where all the sorts are dif¬ 
ferent, or disjoint. Another is a structure where the sorts 
are related as in a tree, with the sorts at a lower layer being 
subsets of those in the layer above. Another is a structure in 
which the sorts are related as in a lattice, with non- 
hierarchical links between them. 

Such many-sorted logics are used to place appropriate 
limitations on searches, and thus to improve search effi¬ 
ciency, and on logical operations, and thus avoid non¬ 
sensical interpretations. 


30.7.2 Situational logics 

A situational logic is a method of representing relation¬ 
ships that pertain in a particular situation. The usual 
device for effecting this is to augment the predicate with an 
extra argument which denotes the situation. 


30.7.3 Non-monotonic logic 

The point was made earlier that the classical logics are 
monotonic logics. They do not accommodate the revisions 
that are necessary to cope with real-life situations. There 
are several reasons why it may become necessary to revise 
knowledge. One is that the original knowledge may have 
been incomplete so that a default value had to be used. 
Another is that in problem-solving it is often necessary to 
make a temporary assumption. Another is that the situa¬ 
tion may have changed. 


30.7.4 Many-valued logics 

The classical logics utilize in their semantics just two 
values, true and false. Other logics have been developed 
which permit the use of a wider range of values. One such 
many-valued logic is that of Lukasiewicz (1951), which uti¬ 
lizes three values. In addition to true and false, there is an 
intermediate value, which is applicable where the state¬ 
ment may be true, or ‘sort of true’. 


30.7.5 Fuzzy logic 

Fuzzy logic, which is based on fuzzy sets, permits reasoning 
where there is uncertainty and vagueness. It is considered 
further in Section 30.10. 


30.7.6 Modal logics 

The classical logics deal with statements in the indicative 
mood concerning what is. There has been developed a 
family of modal logics which have been characterized as 
being in the subjunctive mood and which deal with what 
must be, should be, might be, is believed to be, etc. 

Some principal modalities and the descriptor pairs 
associated with them are: 

Alethic modality: necessary, possible. Temporal modality: 
always, sometimes. Deontic modality: obligatory, permis¬ 
sible. Epistemic modality: known, believed. Each modality 
has its associated modal operators. Thus for alethic modality 
operators are necessary (L) and possible (M). 


30.7.7 Temporal logic 

The classical logics do not accommodate time. The tem¬ 
poral logics that have been developed to overcome this 
limitation follow two broad approaches. One is the use of a 
temporal modality. In this form of temporal logic, use is 


made of the modalities: 

Always, sometimes. 

Other modalities used are: 

Past, present, future 
and 

Precedes, succeeds. 

There are corresponding temporal operators, of which the 
most common are probably always (A) and sometimes (S). 

The other approach is to adapt FOPL to handle time. One 
method makes use of timepoints.Thepredicate is augmented 
with an extra argument that denotes the time point. The 
approach is somewhat similar to that used in situational logic. 

30.7.8 Epistemic logic 

Epistemic logic is a form of logic used to reason about 
knowledge possessed by other agents. 

30.8 Uncertainty and Inconsistency 

The foregoing discussion has brought out the need to be able 
to handle uncertainty and inconsistency. Some approaches 
to this problem are now described. 

30.8.1 Sources of uncertainty 

There are a number of sources of uncertainty. Uncertainty 
arises due to the randomness of events and to incomplete¬ 
ness, vagueness, unreliability, and unbelievability of and 
contradictions in knowledge. 

30.8.2 Probability theory 

The traditional approach to handling uncertainty is the use 
of probabilistic reasoning. This has been considered in 
some detail in Chapter 7. The treatment there was in the 
context of reliability engineering, but the basic probability 
theory is of wide applicability. 

Probabilistic reasoning is utilized in AI and an account is 
given in Section 30.9. However, it also has a number of limi¬ 
tations, which have led to the development of alternative 
approaches. These limitations are perhaps best understood 
by considering these other techniques. 

30.8.3 Certainty theory 

Expert systems are typically based on a set of rules. In 
some cases it is not certain that a rule is correct. It is not 
easy to characterize this uncertainty using conventional 
probability theory and certainty theory has been devel¬ 
oped to handle this problem. 

For a statement S a certainty measure, or certainty, G(S) 
is defined such that 

C(S) If S is true 

C(S) = -1.0 If S is false 
C(S) =0 If nothing is known about S 

C(S) may also have values intermediate between +1.0 and 
-1.0, reflecting the degree of certainty that it is true or false. 
For a rule a certainty factor CF is defined 

If A then X with certainty factor CF 

CF has the value 1.0 if it is certain that the rule is true, it has 
the value -1.0 if it is certain that the rule is false, and may 
take intermediate values, reflecting the degree of certainty 
that it is true or false. 
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In the approach, a rule is taken to be either true (CF = 1.0) 
or false (CF = -1.0), and its application results in a conclu¬ 
sion X that has a value true or false. A truth value of X is 
obtained by application of a single rule. Application of a 
second rule which gives a truth value for X either confirms 
the original value or contradicts it. Using certainty theory, 
however, the truth value of X is associated with a certainty 
value which is subject to adjustment each time a rule is 
applied and yields a truth value for X. 

The relations used to determine the certainty C(X) of the 
statement X given A are: 

C(X | A) = C(X) + [CF (1.0 - C(X))] C(X) >0; CF > 0 
[30.8.1a] 

C(X | A) = C(X) + [CF (1.0 - C(X))] C(X) <0; CF < 0 
[30.8.1b] 

c < x|A >- i. 0 -2SwmicBii C(X)>0!CF<0 

or C(X) < 0; CF>0 

[30.8.1c] 

In the original work the certainty factor for a rule was 
formally related to the probability that it is true, as follows: 

CF = max(P(X|A) ; P(X)]-F(X) CF>Q ^ 

CF = mi C F<0 [30.8.2b] 

“(X) 

The certainty factor CF in Equation 30.8.2a is also referred 
to as the measure of belief (MB) that the rule is true, and CF 
in Equation 30.8.2b as the measure of disbelief (MD). 

In subsequent work certainty factors have often been used 
in a heuristic way to attach subjective estimates of certainty 
to rules. As an illustration of the application of certainty 
factors, consider the following illustrative example. 

If A then X CF = 0.8 
If B then X CF = 0.7 

with an initial certainty C(X) = 0. For both rules the rela¬ 
tion applicable is Equation 30.8.1a. Successive applications 
give for C(X) values of 0.8 and 0.94. 

30.8.4 Dempster/Shafer theory 

The Dempster/Shafer theory is a theory of evidence that 
makes a distinction between uncertainty and ignorance. 
It utilizes a belief function that is essentially a probability 
function to which confidence limits have been assigned. 
In other words, the belief function gives the probability 
that the probability estimate lies within certain bounds. 

As the bounds narrow, the belief function tends to the 
conventional probability function. In other words, prob¬ 
ability theory may be regarded as a special case of 
Dempster/Shafer theory. 

30.8.5 Possibility theory and fuzzy logic 

Another type of uncertainty is that which arises from the 
vagueness of natural language. This can be handled using 
fuzzy logic. This approach is also known as possibility 
theory. Fuzzy logic is considered in Section 30.10. 


30.8.6 Incidence calculus 

In probability theory the relationships between events are 
based on the assumption that the events considered are 
independent. Formulations of the basic probability relations 
exist that incorporate correlation terms which allow for 
dependency between events. The problem is the difficulty of 
furnishing numerical values for these correlation terms. 

An alternative approach is the use of the incidence 
calculus of Bundy (1984). A set JFis defined which is the set 
of all possible worlds or incidents. The incidence i(A) of a 
formula A with respect to W is that subset containing all 
those incidents for which A is true. The independence of 
two formulas is obtained from the intersection of the two 
incidences, or subsets. 

30.8.7 Plausibility theory 

Another problem that needs to be addressed is reasoning 
with knowledge obtained from sources that are not totally 
reliable. This is the province of plausibility theory. Plausi¬ 
bility theory makes it possible to reason with inconsistent 
sets of knowledge obtained from imperfect sources. It uti¬ 
lizes p-sets, a p-set being a set of assertions vouched for by 
sources with some degree of reliability. Each member of a 
p-set is assigned a plausibility value that is determined by 
reference to the source with the highest status. 

30.8.8 Truth maintenance systems 

As already described, non-monotonic reasoning involves 
revision, and therefore the possibility of introducing 
inconsistency into the knowledge base. It is the function of 
a truth maintenance system (TMS) to maintain the con¬ 
sistency of the knowledge base during the process of rea¬ 
soning by the inference engine, which is thereby freed to 
get on with its main task. ATMS is also known as a belief 
revision system or revision maintenance system. 

ATMS maintains a record of the current beliefs and of 
the justifications for these beliefs. It identifies contra¬ 
dictions and the statements responsible for them and 
implements retractions. The record of the knowledge base 
takes the form of a dependency network, the nodes of which 
represent premises, conclusions, rules, etc. Each node has 
attached to it a justification enumerating the inference 
steps by which it was derived. The exception is premise 
nodes, since premises require no justification. 

Two types of justification record are used, support lists 
(SLs) and conceptual dependencies (CDs), the first being 
the more widely used. A support list takes the form 

(SL < in-list > < out-list>) 

An active node must have at least one valid node in the in¬ 
list and hence IN the current belief set, and all nodes in the 
out-list must be OUT of the belief set. The state of a TMS 
may be represented in tabular form. A typical example 
might be: 


Node 

Status 

Support list 


nl 

IN 

(SL ()()) 

Premise 

n2 

OUT 

(SL(nl)(n3)) 

Unjustified belief 

n3 

IN 

(SL(n5)(n4)) 

Justified belief 

n4 

OUT 

(SL ()()) 

Retracted premise 

n5 

IN 

(SL ()()) 

Premise 
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TheTMS can also be represented in graphical form using a 
special set of symbols. 

When a contradiction is discovered, the TMS examines 
the dependency structure that supports the contradictory 
node and identifies the offending nodes directly. This pro¬ 
cess is termed dependency-directed backtracking (DDB) 
and is for this purpose a more efficient search strategy than 
chronological backtracking. The other type of record, the 
CD, may be regarded as a form of conditional proof. It takes 
the form: 

(CD < consequent > < hypothesis in-list > < hypothesis 

out-list >) 

The CD is valid if the consequent node is IN when each node 
in the hypothesis in-list is IN and each node in the hypoth¬ 
esis out-list is OUT. CDs can be, and usually are, converted 
toSLs. 

There are a number of different types of TMS. These 
include the non-monotonic TMS (NMTMS) or justification- 
based TMS (JTMS); the logic-based TMS (LTMS); and the 
assumption-based TMS (ATMS). 


30.8.9 Default reasoning 

Another form of non-monotonic logic is default reasoning. 
This permits default assumptions to be handled. The 
method is non-monotonic because it may be necessary at 
some later stage to retract an assumption. Default reason¬ 
ing may be represented as 

P(x): MQ(*) 

R« 

where M is a consistency operator, which has the meaning 
‘and if it is consistent to assume...’. 

30.8.10 Default reasoning: closed world assumption 

The method of default reasoning just described is suitable 
for making specific individual default assumptions, but it 
is sometimes desirable to be able to make some more global 
set of assumptions. This is the function of the closed world 
assumption (CWA). 

The CWA is that if a proposition cannot be proven it is 
false. It is often a reasonable assumption in a situation 
which is well understood and in which most of the facts are 
known. 

Formally, the CWA involves the use of a metarule that 
if P(a) cannot be disproved, the assumption —iP(«) is to 
be made. 


30.8.11 Default reasoning: predicate completion and 
circumspection 

Whilst default assumptions are valuable, they need to be 
carefully handled. Proliferation of default assumptions can 
cause problems. Two methods of doing this are predicate 
completion and circumspection. 

Predicate completion involves the use of completion 
formulas to restrict the application of predicates to those 
entities to which they are applicable. Circumspection for¬ 
mulas fulfil a somewhat similar function by restricting the 
entities to which a predicate is applied to those with defined 
characteristics. 


30.8.12 Heuristics 

In many AI applications, particularly in expert systems, 
use has been made of heuristics and of ad hoc methods to 
take account of uncertainty. There are no doubt various 
reasons for this. One is probably unfamiliarity with the 
more formal methods available. Another is the difficulty of 
providing the probability estimates required in many for¬ 
mal methods. 

A feature for which heuristics have been developed is the 
treatment of the degree of confidence in particular rules. 
For example, the expert system SOLOMON of PR. Cohen 
(1985) utilizes a system of ‘endorsements’, effectively 
weightings, to be applied to rules. 


30.9 Probabilistic Reasoning 

30.9.1 Probability 

Probability theory is considered at some length in 
Chapter 7 and it is sufficient here to restate the following 
basic relations for independent events A and B: 


P(A AND B) = .P(A) * P(B) 

[30.9.1] 

P(A OR B) = P(A) + P(B) - P(A) * P(B) 

[30.9.2] 

~*P(A) = 1 — P(A) 

[30.9.3] 

30.9.2 Bayes’ rule 

Much use is made in AI of Bayesian inference. Restating 
Bayes’ rule for an event E and a hypothesis H 

P(E|H)*P(H) 

R (H E) “ P(E)- 

[30.9.4] 

Generalizing for a set of hypotheses Hi,.. 

., H„: 

R(E|H,.)*P(H,) 

' E?P(E | H,.)P(H y ) 

[30.9.5] 

30.9.3 Odds 

Another formulation of probability that is 
is odds. The odds O(E) in favour of an ever 
its probability P(E) as follows: 

often used in AI 
it E are related to 

n(JA P( E) 

0(£)= T^P(E) 

[30.9.6] 

or, altnernatively 


pm- °CE) 

( > ~ 1 + 0(E) 

[30.9.7] 

For Bayes’ rule, where there is a hypothesis H, the two 
associated ratios of likelihood are 

TS P( E|H) 

P(EhH) 

[30.9.8] 

LN- P( ^ E|H) 

LN -p(^EhH) 

[30.9.9] 

These relationships are used, for example, in the expert 
system PROSPECTOR. In the terminology there used the 
two likelihood ratios are termed logical sufficiency (LS) 
and logical necessity (LN). 
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Another useful concept associated with odds is that of 
the weight of evidence. In the use of Equation 30.9.4, the 


process of updating for a series of events Ej,..., E„ is 
somewhat clumsy. An elegant device introduced by Turing 
is to reformulate using odds and then to take logarithms. 
This gives 

log e 0(H | E) = log e 0(H) + m [30.9.10] 

^ logg fi [30.9.12] 


where / t was termed by Turing the Bayesian factor in favour 
of H yielded by E,-, and «;,■ is the weight of evidence. 

30.10 Fuzzy Logic 

Fuzzy logic, and fuzzy set theory generally, addresses the 
problem of vagueness as opposed to randomness. The term 
fuzzy logic is used in two senses. In the broader sense it is 
virtually co-terminous with fuzzy set theory, whilst in the 
narrower sense it refers to that part of fuzzy set theory that 
deals with inference. Fuzzy set theory was introduced by 
Zadeh (1965). Accounts are given in Fuzzy Sets and Systems 
(Dubois andPrade, 1980), Multistage Decision-Making under 
Fuzziness (Kacprzyk, 1983), Fuzzy Sets Theory and Its Appli¬ 
cations (Zimmerman, 1986), Fuzzy Sets, Decision-Making 
and Expert Systems (Zimmerman, 1987), Fuzzy Relation 
Equations and Their Application to Knowledge Engineering 
(di Nola et al., 1989) and Fuzzy Logic for the Management of 
Uncertainty (ZadehandKacprzyk, 1992) and by Zadeh (1968, 
1975a,b, 1978,1983a,b, 1985) and Kacprzyk (1992). 

Fuzzy logic provides a means of handling the vagueness 
inherent in natural language. Some of the quantities with 
which it deals are: 

Fuzzy predicates: small, large;young, old 
Predicate modifiers: very, quite, extremely 
Fuzzy quantifiers: most, many, few, often, usually 
Fuzzy numbers: about n, a little more than n 
Fuzzy probabilities: likely, unlikely 
Fuzzy possibilities: quite possible, virtually impossible 
Fuzzy truth values: true, quite true, mostly untrue 

Fuzzy quantifiers are also termed linguistic quantifiers, 
and predicate modifiers are also termed linguistic hedges. 

Fuzzy logic effectively involves a numerical encoding of 
natural language terms, or linguistic variables. It is some¬ 
times known as linguistic variable theory. 

If X = {x} is a universe of discourse, consider a fuzzy set 
Awhich is a subset of X, denoted A c X.The set A is a set of 
ordered pairs. {(x A , AaM)} • The g A (x) is the grade of mem¬ 
bership of * in A. 

For example if X= {1, 2,..., 10}, a fuzzy set for large 
numbers might be given as A = 0.3/6+0.5/7+0.85/8 +1/9 + 
1/10, where the grade of membership of the numbers 1-5 is 
zero, where that of the number 6 is 0.3, meaning that there is 
a probability of 0.3 that 6 is a member of the set, and so on. 

The grade of membership in a set may be defined in 
terms of a membership function. Figure 30.1 shows two 
functions commonly used. Figure 30.1(a) is a form used 


for a linguistic variable such as a fuzzy quantifier and 
Figure 30.1(b) is a form used for a fuzzy number. 

For the determination of the number of members in a 
fuzzy set with a given attribute, if A is the set of n items and 

X\ .x n the members of that set and these members have 

to some degree the attribute F and therefore have a mem¬ 
bership function g?(xi), the number «pof items which have 
this attribute F, or cardinality of the set, is determined as 

Wf = X^f (Xi) [30.10.1] 

As an illustration, consider the problem of a set of items 
some of which are said to need replacement. If this set is 
A = 0.3 /jci + 0.3/x 2 + 0.8/x 3 + 0.8/x 4 + 0.8/x 5 , then from 
Equation 30.10.1 «f = 3.0. 

For the determination of the truth of a statement involv¬ 
ing a fuzzy quantifier, such as ‘most xs are F’, the problem 
may be posed as the evaluation of the truth value r of the 
statement, which may be expressed in a form such as r(Qxs 
are F), where A = {xi,..., x„} is the set of interest, F is an 
attribute and Q is a fuzzy quantifier. The grade of mem¬ 
bership of an item x,- in the set Awith respect to the attribute 
F is jUf(Xi). The membership function is gcfr). Then the 
relations for the determination of the truth value are 

**m> ( *) i 30 - 10 - 2 ! 

r(QxsareF) =AiQ (r) [30.10.3] 

As an illustration, consider the problem of determining the 
truth of the statement ‘Most compressors are reliable’. The 
problem is then to evaluate the truth value r of this state¬ 
ment which may be expressed as t(Qxs are F), where A is 
the set of n compressors, F is the attribute reliable and Q is 
the fuzzy quantifier most. Suppose that the grades of 
membership g^(xj) for the attribute reliable in the set of 
compressors are taken as A = 0.1/xi + 0.6/x 2 + 0.8/x 3 and 
that the fuzzy quantifier may be represented by a suitable 
membership function g Q (r) taken as 

AqM =1 r>0.8 

g Q (r) = 2r- 0.6 0.3<r<0.8 
AqM =0 r < 0.3 

Then from Equations 30.10.2 and 30.10.3 r = 0.5 and 
AqM = 0.4, giving a truth value t of 0.4. 

For fuzzy logic there is no unique set of inference rules, 
but the following are those most generally quoted. In terms 
of the truth valuer 

t(-A) - 1 - t(A) Negation 

t(A A B) = min(r(A), r(A)) Conjuction 
t(AVB) = max(r(A), t( A)) Disjuction 

The application of inference rules in fuzzy logic tends to be 
considerably more complex than the corresponding exer¬ 
cise in classical logics. 

30.11 Programming Languages 

Many accounts of knowledge representation and of infer¬ 
ential reasoning give examples cast either in the form of the 
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Figure 30.1 Some Functions in fuzzy logic: (a) membership function of a fuzzy set; (b) two examples of a fuzzy number 


predicate calculus or of a specific programming language 
such as LISP or PROLOG. This section is a short introduc¬ 
tion to these three languages, which is given for the pur¬ 
pose of making more concrete some of the concepts in the 
preceding sections and indicating how they are imple¬ 
mented in practice. 

30.11.1 Predicate calculus 

Knowledge representation and inferential reasoning are 
often exemplified using not a specific programming lan¬ 
guage but the predicate calculus. This is the approach 
adopted, for example, by Charniak and McDermott (1985). 

The following are examples of some of the forms of 
knowledge representation and of inferential reasoning 
described in earlier sections cast in predicate calculus form. 

Assertions 
(inst vessel-1 vessel) 

(structure vessel-1 thick-walled) 


(opens fitter flange) 

Isa hierarchy 

(isa pump pressure-raiser) A pump is a pressure 

raiser. 

Connectives 

(if (and (inst thermocouple instrument) If a thermo¬ 
couple is an 
instrument 

(robustness instrument delicate) and an 

instrument 


Vessel-1 is an instance 
of a vessel. 

A structural feature of 
vessel-1 is that it is 
thick-walled. 

A fitter opens a flange. 


(robustness thermocouple then a ther- 

delicate) mocouple 

is delicate. 


Quantifiers 

(forall x (if (inst x instrument) (robustness x delicate) 

All instruments are delicate, 
(forall x (if (control-valve x) (exists y) (power-source-of 
x y) All control valves have a 

power source. 


1. (inst thermocouple instrument) Athermocoupleisan 

instrument. 

2. (forall x (if (inst x instrument) All instruments are 

delicate. 

(robustness x thermocouple) 

3. (if (inst thermocouple instrument) If a thermo¬ 

couple is an 
instrument, 
then a ther¬ 
mocouple is 
delicate. 

4. (robustness thermocouple delicate) A thermocouple 

delicate. 


The third entry is obtained from universal instantiation 
and assertion 2 and the fourth by modus ponens from 
assertions 3 and 1. 

Abductive inference 

(has-inspections vessel-1) Vessel-1 has inspections. 

(for all * (if (contains-chlorine x) (has-inspection x)) 

All vessels which contain 
chlorine have inspections, 
(contains-chlorine vessel-1) Vessel-1 contains chlorine. 
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This example illustrates the fact that abductive inference is 
not a strictly valid form of reasoning and may given a 
incorrect conclusion. 

Inductive inference 

(if (inst instrument-1 instrument) Instrument-1 is 
delicate. 

(robustness instrument-1 delicate) 

(if (inst instrument-2 instrument) Instrument-2 is 
delicate. 

(robustness instrument-2 delicate) 

(forall x (if (inst x instrument) 

(robustness x delicate) All instruments are 
delicate. 


A fitter opens a flange. 


Opens-1 is an instance 
of opening. 

The agent opening is a 
fitter. 

The object opened is a 
flange. 


Frame 

An assertion 

(opens fitter flange) 

may be cast in the frame form as 

(opens opens-1) 

(agent-opening opens-1 fitter) 
(object-opened opens-1 flange) 


Forward chaining 

(if (inst ?x pump) (inst lx pressure-raiser) If an object is 
a pump, then it 
is a pressure- 
raiser. 


30.11.2 LISP 

LISP (List Processing language) is a high level, symbolic 
processing language devised by McCarthy (1960,1978) and 
embodies his calculus for symbolic processing. 

Accounts of LISP are given in LISP 1.5 Primer 
(Weissman, 1967), The Little LISPer (D.P. Friedman, 1974), 
Let’s Talk LISP (Siklossy 1976), Anatomy of LISP (J. Allen, 
1978), A Beginner’s Guide to LISP (Hasemer, 1984a), Com¬ 
mon LISP (Steel, 1984), LISP (Winston and Horn, 1981) and 
by D. Shaw, Swartout and Green (1975), J. Allen (1979), Pratt 
(1979), Hasemer (1984b), Laubsch (1984), Patterson (1990), 
Tanimoto (1990) and Gabriel (1992). 

LISP can be run in the interpreted or compiled modes, the 
former being more commonly used. 

There are a number of dialects of LISP. A widely used 
form is Common LISP, which was created in an attempt to 
obtain a standard form. There are, however, several other 
widely used forms, including MACLSP and INTERLISP. 
The syntax of LISP is very simple. All data and program 
statements are represented in LISP as s-expressions. The 
valid s-expressions are the following: atoms, strings, lists 
and dotted pairs. An atom is a number or string of con¬ 
tiguous characters, including letters, numbers and special 
characters. A string is a sequence of characters enclosed 
in double quotation marks. A dotted pair, or cons, is an 
ordered pair of s-expressions enclosed in parentheses. A 
list is a sequence of s-expressions enclosed in parentheses. 


Atom a—b 

String “ab” 

Dotted pair (a ■ b) 

List (a b) 


The basic operation of LISP is evaluation. 


Instruction in LISP are described as forms. There are 
three basic types: functions, macros and special forms. 

LISP contains a number of forms, which include the fol¬ 
lowing: input and output forms; control forms; list manipu¬ 
lation forms; arithmetic functions; logical functions; 
evaluation forms; predicates; and function and property 
forms. 

A principal feature of LISP is list processing and it pos¬ 
sesses a number of functions for the manipulation of lists. 
These include cons, car, cdr and append. 


30.11.3 Prolog 

Prolog (Programming in Logic) is a programming lan¬ 
guage based on the predicate calculus. A number of 
researchers contributed to its origins; it was implemented 
by Colmerauer and co-workers (Colmerauer, Kanoul and 
van Caneghem, 1983). 

Accounts of Prolog are given in Programming in Prolog 
(Clocksin and Mellish, 1981), The Art of Prolog (Sterling and 
Shapiro, 1986) and Prolog Programming for Artificial Intel¬ 
ligence (Bratko, 1986) and by K.L. Clark and McCabe (1982), 
Clocksin (1984), J. Cohen (1985), Colmerauer (1985) and 
Patterson (1990). 

Programming in a language such as Prolog is referred to 
as logic programming. Prolog programming may be viewed 
as the creation of a database of facts and rules about 
objects, their attributes and relationships. This database 
can then be interrogated. 

Prolog has a simple syntax. A program consists of terms. 
A term is a constant, a variable or a structure. It consists of a 
sequence of characters. A character may be of four kinds: an 
upper case letter, a lower case letter, a digit or an operator. A 
constant may be of two kinds: an atom or an integer. 
Examples of atoms are: 

vessel 

pressure-raiser 

Avariable is similar to an atom except that it starts with an 
upper case letter of underline sign ‘J. A structure consists of 
a functor and of components, with the functor written first 
followed by the components in parentheses. An example of 
a structure is: 

pressure_raiser (pump) 

meaning ‘a pump is a pressure raiser’. 

Facts 

A fact or assertion is exemplified by: 

corrodes (wet_chlorine, milcLsteel) 
meaning ‘wet chlorine corrodes mild steel’ 


Rules 

A rule is cast in the form: 

conclusion if condition 1 and condition 2 ... 

where the first term is the head and the rest is the body. 
Such a form is termed a Horn clause. An example of a rule is 

corrodes(X, Y): wet_chlorine(X), mild_steel(Y) 

where: denotes if and the commas between the structures 
and. The meaning is X corrodes Y if X is wet chlorine and Y 
is mild steel. 
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A list is written as a sequence of terms with commas 
between and enclosed in square brackets. An example of a 
list is: 

[steel, aluminium, copper] 

An empty list is denoted by [ ]. 

The head and tail of a list may be distinguished by the 
use of a vertical bar. An example of this is: 

[a|b, c, d] 

List manipulation 

There are a number of list manipulation functions: 
append, member, cone, add, delete; cone denotes 
concatenate. 

Queries 

A query is exemplified by: 

?-corrodes (X, mild_steel) 
meaning ‘what X corrodes mild steel?’. 

Prolog program 

A Prolog program proceeds by taking the rule condition, 
or headless Horn clause, and ‘instantiating’ the variables 
(X and Y in the above examples) to identify those 
instances which satisfy the rule. Thus for the rule given 
above the clause 

?- wet_chlorine (X), mild_steel(Y) 

satisfies 

corrodes (X,Y) 

The program continues by this process of resolution. A 
Prolog program may be regarded as a resolution theorem 
prover for Horn clauses. 

The search strategy used in Prolog is depth-first. This 
strategy is in many ways simpler, but it does involve back¬ 
tracking and the search can get into a ‘loop’. 

30.11.4 Object oriented programming 

Another type of language that is now widely used in AI is 
object oriented programming (OOP). 

Object oriented programming is described in 
SMALLTALK-80, The Language and its Implementation 
(Goldberg and Robsen, 1983) and in Object Oriented 
Programming (B.J. Cox, 1986) and by Stephanopoulos 
(1987) and Hodgson (1991). 

In OOP, the program consists entirely of objects. An 
object is a frame-like entity with slots that hold not only 
data but also procedures. Procedures may perform a wide 
range of functions such as symbolic manipulation, numeri¬ 
cal calculation and inferencing. Objects are arranged in 
hierarchies. Computation involves the sending of messages 
between objects. 

One feature of object oriented programming is data 
encapsulation. Data structures incorporate within them¬ 
selves the procedures that are used to manipulate them. An 
object can be regarded as a frame with slots that are the 
operations allowable on the object. 

Another feature is the class hierarchy. At the top of the 
hierarchy is a single-object class, consisting of the prin¬ 
cipal object. Other objects lower down in the hierarchy 
belong to classes that are in effect subclasses. Inheritance 
occurs through the hierarchy. 


OOP is an extremely powerful tool. A whole manu¬ 
facturing process may be represented as an object, cover¬ 
ing not only the physical plant but also its operation, 
documentation, hazards and so on. 


30.11.5 C-^- programming language 

Of the more conventional programming languages, men¬ 
tion should be made in particular of C++. This language 
supports object oriented programming and interfaces with 
both LISP and Prolog. 


30.11.6 Language characteristics and facilities 

Work in AI makes use of a number of languages, and there 
are major differences between them. An account is given 
by Frost (1986). A distinction is often made between pro¬ 
cedural languages and declarative languages, with con¬ 
ventional languages such as FORTRAN being described 
as procedural and those such as LISP and Prolog as 
declarative. However, the term procedural is not well 
defined. 

The essential distinction is whether or not the ‘flow of 
control’ is specified. The flow of control is specified in con¬ 
ventional languages, using such commands as GO TO 
statements and DO loops, but not in languages such as 
LISP and Prolog. In these latter declarative languages there 
are no explicit commands that determine the flow of control. 
This does not mean, however, that the programmer has no 
influence on control. In a language such as Prolog the flow 
of control is affected by the order in which the statements 
are written. 

Languages used in AI work include: the functional 
language LISP; the logic programming language Prolog; 
the frame languages AM and KRL; and the script language 
SAM. 

The flexibility of a language may be increased by the use 
of an add-on facility. Thus, for example, the program FLEX 
provides Prolog with an object oriented enhancement. 

A language such as Prolog is used particularly as a 
research tool. A commercial implementation may well be 
rewritten in a conventional language such as C++. 


30.12 Structured Knowledge 

The foregoing sections have described some ways of 
representing knowledge. It is now necessary to consider in 
more detail the representation of knowledge in structured 
form. 

30.12.1 Indexing 

A basic form of structure is that provided by the use of 
indexing, addresses, pointers and lists. These structures 
are not, however, generally sufficient for the purposes 
of AI. 

30.12.2 Associative networks 

A widely used form of representation in AI is the associa¬ 
tive network. This is a form of directed graph with labelled 
nodes and arcs. An example is shown in Figure 30.2(a). An 
associative network may be expressed in terms of the 
predicate calculus, with nodes and arcs represented by 
terms and relations. An example illustrating this equiva¬ 
lence for a blocks world scene is given by Charniak and 
McDermott (1985). 
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Figure 30.2 (a) An associative network and (b) an is-a network 


The arcs of an associative network may represent a 
number of different relations. Some principal relations are: 


Label 

Meaning 

Used with 


is-a 

Is an instance of 

Generic not 


has 

Has as parts 

Specific not 


t° 

Is a kind of 

Is 

Generic not 
Attribute 


member-of 

Is a member of 

Larger set c 

■r entity 

subset-of 

Is a subset of 

Larger set o 

ir entity 


The ISA and HAS links are of particular importance for 
structured form inheritance. 


30.12.3 ISA hierarchy 

A particular aspect of associative nets is the ISA hierarchy. 
This is effectively a way of expressing a taxonomy using a 
network with is-a arcs and working down from the generic 
to the specific. The associative network is shown in Figure 
30.2(b) is an example of an ISA hierarchy. 

30.12.4 Inheritance 

Children can inherit a characteristic from their parents. 
Similarly, entities in an ISA hierarchy may inherit from 
entities directly above them. Another way of putting this is 
that a set can inherit a characteristic from a superset of 
which it is part, and a subset can inherit from a set. Multi¬ 
ple inheritance occurs when a set is part of more than one 
superset and may thus inherit from both supersets. This 


obviously creates the potential for conflict between the 
inherited values. 

As stated earlier, the use of inheritance may be regarded 
as a form of default reasoning. The point has also been made, 
however, that the proliferation of defaults through inher¬ 
itance can cause problems and it is necessary to proceed 
cautiously. In some cases it may be appropriate to allow most 
members of a set to inherit a certain characteristic but to 
arrange to override this for some members of the set. 

30.12.5 Semantic networks 

Associative networks are widely used in natural language 
comprehension and are then often termed semantic 
networks. 

30.12.6 Slot and filler systems 

Another type of representation goes by the general name of 
a slot and filler system. Particular forms are frames and 
scripts. In terms of the predicate calculus, a slot and filler 
system may be represented by a single statement with a 
number of arguments corresponding to the number of slots. 

Slot and filler systems are useful for: representing 
archetypes, or stereotypes; handling default values; 
matching and pattern recognition; and error detection. 

30.12.7 Conceptual dependency 

Before considering particular slot and filler systems, it is 
appropriate to mention conceptual dependency (CD) theory. 
The basic concept here is that a set of sentences that have 
different structures but identical meaning should have 
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a CD representation that is both unique and unambiguous. 
CD methodology provides a set of tools such as primitives, 
syntax, rules, etc., for the formulation of such sentences. 

30.12.8 Frames 

A frame is a structure that contains a number of pieces of 
information on some entity such as an object, event or 
situation. It is applicable where the entity has a stereotype 
that is sufficiently strong to define the features on which 
information should be stored. Typical situations treated 
in the AI literature are attending a meeting or eating in a 
restaurant. 

A frame consists of a frame name and a list of attribute- 
value, or slot-filler, pairs. In other words, the attributes are 
also called slots and the values fillers. A slot is simply the 
name of an attribute and the filler its value. Many accounts 
use the mixed terminology of slots and values, and this is 
adopted here. An empty frame, or schema, contains only 
the frame and slot names, whilst an instantiated frame 
contains also the values. In some cases default values may 
be supplied for slots. 

Alternatively, or in addition, a slot may be furnished with 
associated information in the form of a procedural attach¬ 
ment, or demon. Two commonly used types of attached 
information are a procedure to determine the value for the 
slot if one is needed (the if-needed attachment) and one to 
be executed when the value has been filled in (the if-added 
attachment). Another type is a constraint on the value 
which can be added to the slot. A slot may also be filled with 
the name of another frame. In this way hierarchies of 
frames may be created. 

Frames are a natural form of representation for default 
reasoning and for inheritance. 

30.12.9 Scripts 

Like a frame, a script is a structure that contains a number 
of pieces of information on some entity such as an event, 
situation or activity. It differs in that the slots contain not 
values but sentences written in terms of CD primitives. 
Typical situations treated in the AI literature are eating in a 
restaurant or shopping in a supermarket. Thus, a script 
will typically have a script name and slots for the situation, 
actors, initial conditions and props. 

There will then be slots for several scenes and one for the 
outcomes. A script may be used to reason about a current 
situation by filling in those parts which characterize the 
situation, retrieving from memory another script which 
matches this situation. Slots in the current script are filled 
by inference using inherited and default values. 

Like frames, scripts are a natural form to use for default 
reasoning and inheritance. 

30.12.10 Constraints 

A simple constraint may be represented as a predicate of 
the predicate calculus. Alternatively, it may be required to 
represent a more generalized constraint in the form of an 
algebraic equation relating several variables. In this case a 
constraint schema may be created which lists the variables 
in the equation and, for each of these variables, the alge¬ 
braic expression by which it is evaluated. 

30.12.11 Relational databases 

Another form of structured knowledge representation 
is the relational database. This has been described in 
Section 30.2. 


30.12.12 Production systems 

Another form of structured knowledge is a production 
system. Production systems have already been described in 
Section 30.6 and are therefore not considered further here, 
except to note that the knowledge held in a production sys¬ 
tem is not necessarily confined to that embodied in the 
rules, but may include, in the conflict resolution section, 
knowledge about the control strategy which governs the 
application of the rules. It is often in this latter that much of 
the expertise resides. 

30.12.13 Objects 

Objects constitute another form for the representation of 
structured knowledge. They have been described in the 
previous section in the context of OOP. 

30.13 Search 

The application of the tools described to problem-solving 
typically involves some form of search. Search is one of the 
fundamental activities in AI. 

30.13.1 Search procedures 

There are a large number of search procedures that are used 
in AI. They may be classified in several ways. Some proce¬ 
dures are used to search for optimal paths; others for any 
path, not necessarily an optimal one; and others again for 
game playing. Another distinction is between uninformed, 
unguided, or blind search and informed or guided search. 
Some principal procedures category are: 


General 

Informed 

Optimal 

Breadth-first 

No 

No a 

Depth-first 

No 

No a 

Hill-climbing 

Yes 

No 

Beam 

Yes 

No 

Best-first 

Yes 

No 

British Museum 

No 

Yes 

Branch and bound 

Yes 

Yes 

A* algorithm 

Yes 

Yes 

Games 



Minimax 



Alpha beta 




a Search does not necessarily find the optimal, or shortest, 
path unless it is exhaustive. 


30.13.2 Uninformed search 

Uninformed search is inefficient, but it may be necessary to 
resort to it if there is difficulty in formulating heuristics or 
an evaluation function to guide the search. 

30.13.3 Breadth-first search 

Breadth-first search involves visiting all the nodes at a 
given level before moving to the next level. A breadth-first 
search is illustrated in Figure 30.3(a). 

30.13.4 Depth-first search 

Depth-first search involves moving down the tree as 
rapidly as possible, visiting nodes at successively lower 
levels until the lowest node in the branch is reached, then 
returning back up the tree to the point at which a downward 
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(e) 

Figure 30.3 Search through a goal tree: (a) breath-first search; (b) depth-first search; (c) hill-climbing; 
(d) beam search; (e) best-first search 


move again becomes possible, and so on. A depth-first 
search is illustrated in Figure 30.3(b). A depth-first search, 
therefore, necessarily involves backtracking. 


30.13.5 Informed search 

It will be clear from the account just given that uninformed 
search methods are subject to combinatorial explosion and 
become impractical for larger problems. The remedy is to 
inform the search in some way. 


30.13.6 Heuristic search 

One approach to informed search is the use of heuristics. 
These may take various forms, but generally have to do 


with the characteristics of the goals, states and paths 
between states. 


30.13.7 Evaluation function 

It may be possible to guide the search by using a formal 
evaluation function, which may also go by other names 
such as an objective function or a figure of merit. The 
formulation of such a function is an aspect of matching, 
which is discussed in Section 30.14. Given an evaluation 
function it becomes possible to utilize search methods 
which are much more efficient. The sum of the values of an 
evaluation function between the nodes on a path is known 
as the path length. 
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30.13.8 Hill-climbing 

A hill-climbing search utilizes an evaluation function 
that it seeks to minimize and is essentially a form of depth- 
first search. It differs from a regular depth-first search in 
that at a given node the next move made is to the child node 
for which the evaluation function is minimized. A hill¬ 
climbing search is illustrated in Figure 30.3(c). 

Like other forms of hill- climbing, there are certain classic 
topological problems which a hill-climbing search may 
encounter. They include the foothill, plateau and ridge 
problems. 

Although, in general, hill-climbing is a common form of 
optimization, a hill-climbing search as just described does 
not guarantee a global optimum solution. 

30.13.9 Beam search 

A beam search resembles a breadth-first search in that it 
proceeds level by level, but differs from it in that the search 
utilizes an evaluation function and moves downwards only 
through the best w nodes at each level. A beam search is 
illustrated in Figure 30.3(d). By comparison with breadth- 
first search, beam search is much more economical. 

30.13.10 Best-first search 

A best-first search resembles hill-climbing in that it utilizes 
an evaluation function, but differs from it in that it uses 
this function in a different way. Whereas in hill-climbing 
the function is used to select between the child nodes of the 
current node, in a best-first search the function values for 
all nodes visited are stored and the search moves from the 
node for which the function is a minimum, wherever it 
may be in the tree. A best-first search is illustrated in 
Figure 30.3(e). Like hill-climbing, a best-first search does 
not guarantee a global optimum. 

30.13.11 British Museum method 

Of the methods that provide an optimum solution, the British 
Museum method involves an exhaustive search through the 
whole tree to identify the optimum path. The search may be 
breadth-first or depth-first, but in either case it is modified 
so that it does not stop when a path is found but continues 
until all paths are found and the optimum can be identified. 
The method is even more subject to combinatorial explosion 
than the regular uninformed search methods. 

30.13.12 Branch-and-bound search 

A branch-and-bound search proceeds by storing the path 
lengths and expanding that node which at any given stage 
has the shortest path length.This means that the search may 
move down a path in one branch of the tree and then jump 
to one in a second, quite different, part of the tree when 
movement down the current path has raised the path length 
above that in the second part. Abranch-and-bound search is 
somewhat complex; an account is given by Winston (1984). 

In this search method termination when a path is found 
does not actually guarantee an optimal solution, since in 
principle there may be a path that is incomplete but very 
close to the solution point. For an optimal solution, it is 
necessary to use the condition that termination occurs when 
the shortest complete path is shorter than the shortest 
incomplete one. 

30.13.13 A* algorithm 

The A* algorithm is a special form of branch-and-bound 
search which utilizes instead of the path length from the 
start to the current node the total path length from the start 


to the goal node. This means that it must possess a heuristic 
for estimating the distance between the current and the 
goal node. If this estimate is a lower bound on the actual 
distance, the solution obtained is optimal.This condition is 
known as the admissibility of the algorithm. 

30.13.14 Games search 

Games differ from other problems handled in AI in that 
there is an active opponent. This has led to the development 
of specialized forms of search for game playing. The tree 
through which the search is conducted is known as a game 
tree. The head of the tree is the start position and the suc¬ 
cessive layers represent the ‘turns’ of the two players. Game 
trees are considered further in Section 30.15. 

30.13.15 Move generation and evaluation 

A particular form of heuristic search that has been devel¬ 
oped for games such as checkers and chess is move gen¬ 
eration and position evaluation. Some of the heuristics for 
these are described in Section 30.15. 

30.13.16 Minimax method 

The Minimax method utilizes the concepts of move gen¬ 
eration and position evaluation and searches for the moves 
most likely to win the game. 

The two players seek to achieve conflicting goals. One 
player is taken as seeking to maximize the evaluation 
function and the other as seeking to minimize it. The maxi¬ 
mizing player (Max) has to assume that, when it is his or her 
turn, the minimizing player (Min) will select that move 
which minimizes the function. 

It is assumed in the Minimax method that it is practical 
to perform only a limited evaluation of a position; in other 
words, that it is practical to look only a limited number of 
moves ahead. The maximum number of levels to which the 
search can be extended before evaluation takes place is the 
lookahead depth. 

For a start which is Max’s move, the even numbered 
levels contain nodes where the evaluation function is 
applied to obtain a maximum score and the odd numbered 
levels nodes where it is applied to obtain a minimum score. 
A move is evaluated by backing up from the current node to 
the start, summing the scores at each level. The best move 
for Max is then that with the maximum backed-up value. 

30.13.17 Alpha beta method 

Another search method used for game playing is the alpha 
beta method. It is essentially a form of the Minimax method 
which prunes those branches of the tree that give a bad 
result and are therefore irrelevant. The essential principle 
is that if the opponent has even one good response to a move 
that would cause it to give a bad result, the move is bad and 
that branch is pruned. 

30.13.18 Control 

In general, search needs to be subject to some control 
strategy. The methods just described in effect constitute 
particular strategies. However, problems differ, and a strat¬ 
egy suitable for one may not be appropriate for another. The 
development of search control strategies is an important 
area of work in AI. 

30.13.19 Dependency-directed backtracking 

One of the most widely used search methods is depth-first 
search. This involves backtracking, which unless guided 
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can be an inefficient process. One common method of pro¬ 
viding such guidance is dependency-directed back¬ 
tracking (DDB). 

In conventional backtracking, on failing to find a solu¬ 
tion the search tracks back to the last node visited at which 
an alternative path exists. In DDB, the search returns 
instead to the node which is implicated in the failure. In this 
case the backtracking is guided by the data dependencies 
of the rules involved, which it uses to seek out the node 
causing the contradiction. This function may be performed 
by the truth maintenance system. 

30.13.20 Forward and backward chaining 

Search may proceed by forward chaining or by backward 
chaining. These two modes of search may be explained 
either in terms of the rules or of the search tree. 

In forward chaining the left-hand side of the rule is 
instantiated first, so that this mode is termed data-driven 
inference. Inbackward chaining, by contrast, theright-hand 
side of the rule is instantiated first, and this mode is termed 
goal-driven inference. In terms of the search tree, forward 
chaining involves a search from the bottom to the top of 
the tree, or from leaf to root, whilst backward chaining 
involves a search from the top down, or from root to leaf. 
Thus, forward chaining is referred to as data-driven or bottom- 
up, or as antecedent reasoning, and backward chaining as 
goal-driven, top down, or as consequent reasoning. 

The mode of chaining which is most appropriate 
depends on the shape of the tree. Figure 30.4 shows two 
search trees. Forward chaining is best suited to the fan-in 




Figure 30.4 Direction of chaining as a function of the 
shape of the goal tree: (a) forward chaining; (b) backward 
chaining. In each diagram the search is from the bottom 


case shown in Figure 30.4(a) and backward chaining to the 
fan-out case shown in Figure 30.4(b). 

30.14 Matching and Pattern Recognition 

30.14.1 Matching 

Another major activity in AI, and one closely related to 
search, is matching. Some form of matching is involved in 
virtually all AI work but the nature of the matching process 
depends on the particular field of application. Areas of AI 
in which matching is required include logical reasoning, 
learning, planning, expert systems, vision and natural 
language comprehension. 

Matching is required for a number of purposes. It may 
serve to identify and classify objects, retrieve objects from 
a knowledge base, establish the eligibility of objects for 
inheritance, select alternatives, control a sequence of 
operations, and so on. 

The overall process of matching may be described as 
one of representation, transformation and comparison. The 
obj ect to be matched must first be represented in a form that 
captures the relevant characteristics. This representation 
may then need to he transformed to make it conformable 
for comparison with another object, the referrent.This com¬ 
parison is based on a matching measure, or metric, which 
forms the basis of comparison, and a matching criterion, 
which is used to decide whether a match is established. 

There is a variety of representational structures to which 
matching may be applied. They include: clauses in pre¬ 
positional or predicate logic and logic rules; sets and bags; 
frames and scripts; and graphs, trees and networks. 

There are a number of types of matching metric. There 
are various distance metrics based on quantitative vari- 
ables.They may be deterministic or probabilistic. Probability 
metrics include product moment correlation and measures 
of clustering. There are also distance metrics based on 
qualitative variables. These variables may be: binary vari¬ 
ables, denoting one of two states; nominal variables, denot¬ 
ing equality or inequality; and ordinal variables, denoting 
rank order. 

There are a number of similarity measures. One type of 
similarity measure is based on the sets of attributes com¬ 
mon to the object and its referrent. Another type which is 
used for labelled graphs is based on the ‘cost’ of trans¬ 
forming the graph into its referrent graph. Another metric 
is the distance that can be defined between the fuzzy sets 
associated with an object and those associated its referrent. 
The matching criteria used, and the types of matching 
obtained, may be exact, partial or fuzzy. 

30.14.2 Pattern recognition 

Pattern recognition comprehends, but is somewhat broader 
than, matching. The term is applied particularly to vision. 
The process of pattern recognition involves feature selec¬ 
tion, matching and classification. Pattern recognition is 
often closely associated with learning by the development 
of classification rules. Pattern recognition is one of the 
strengths of neural networks, described in Section 30.21. 

30.15 Problem-solving and Games 

An important part in the development of AI has been 
played by problem-solving of various kinds, particularly 
puzzles and games. An influential early program was 
General Problem Solver (GPS). 
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30.15.1 Puzzles 

Puzzles frequently quoted in the AI literature include mis¬ 
sionaries and cannibals, painted squares, the travelling 
salesman and the Towers of Hanoi (or Hanoi Towers) prob¬ 
lems. The solution of these puzzles is treated essentially as 
a search. A particular form of search applied to puzzles is 
means-ends analysis. 

In theTowers of Hanoi the goal is to transfer three graded 
discs from one peg to another, starting from an initial state 
in which the three discs are on one peg, with the smallest 
disc on top and the largest at the bottom, and there are two 
empty pegs. The rules are that a disc can be moved only 
when there is no disc on top of it and that it may not be 
placed on a smaller disc at the destination peg. The puzzle is 
therefore a planning problem in a world akin to the blocks 
world described below. 

30.15.2 Games 

Games likewise feature strongly in AI. These are generally 
two-person, zero-sum games, and include tic-tac-toe 
(noughts and crosses), checkers (draughts) and chess. 
These may all be treated as board games and have well- 
defined rules. Such games are generally represented by a 
game tree, with the first state at the root of the tree and with 
the successive move options represented by the successive 
plies below. 

For any but the simplest game, a blind search is imprac¬ 
tical for combinatorial reasons and some more sophisti¬ 
cated search method is needed. As already described, 
characteristic search methods used for game tree searches 
include the Minimax and alpha beta methods. 

Practical problems may be handled by a games approach 
insofar as they can be treated as games against nature; in 
particular, against a nature which seeks to defeat the 
human player by invoking Murphy’s law that whatever can 
go wrong, will go wrong. 

30.15.3 Samuel’s checkers program 

An early and influential games program was the checkers 
program of Samuel (1959, 1963a,b). This program used 
Minimax search and heuristic methods for state evaluation 
and move generation. State evaluation utilized a function 
with some 16 features such as the number of pieces, piece 
location and piece advantage. Move generation was guided 
by tree pruning heuristics. The program also possessed a 
learning capability, with storage and retrieval of board 
states that had occurred in previous games. 

30.15.4 Chess playing programs 

Another game that received attention early in the work on 
AI and has been influential in its development is chess. 
Work on computer chess is described in Computer Chess 
(Newborn, 1975). A short account of its historical develop¬ 
ment is given by Charniak and McDermott (1985). 

Early workers in computer chess were C.E. Shannon 
(1950a,b) and Turing (1953). An early program was written 
by Bernstein. A major advance occurred in 1967 with the 
program by Greenblatt. Another influential treatment was 
that of Newell and Simon (1972). 

The general approach to chess playing is broadly similar 
to that applied to checkers, as just described. A search is 
conducted through the game tree using methods such as 
Minimax and alpha beta, and exploiting heuristics for state 
evaluation and move generation. 


The conduct of a game such as a chess may be regarded 
as a form of planning, albeit under conditions where there 
is an opponent who seeks to frustrate the plan. 

30.15.5 General Problem Solver 

General Problem Solver (GPS) by Newell and Simon (1963) 
was another early and influential program. It is described 
in GPS: A Case Study in Generality and Problem-Solving 
(Ernst and Newell, 1969). 

GPS may be regarded as the first AI system to make a 
clear separation between problem-solving and task knowl¬ 
edge. It was designed to tackle the class of problems that 
can be formulated in terms of a set of objects, which include 
states, and of operators that are applied to these objects to 
transform them into goal objects, or states. 

The basic method used in GPS is means—ends analysis. 
The search is depth-first, with backtracking, and utilizes 
forward chaining. 

In GPS an operator has three features: the preconditions, 
the transformation function and the differences reduced. 
The first is a state description which it is a necessary 
condition that the current state should match for the 
operator to be applicable. The second is the function that 
the operator performs. The third links the operator to the 
differences that it is effective in reducing. 

30.15.6 Blocks world 

An environment widely studied in AI work is the so-called 
blocks world. This world consists of a set of blocks on a 
flat surface. It is a world that is relatively simple and 
predictable. 

Blocks world has been used as an obj ect of study in several 
areas of AI. It has obvious application to manipulation by 
robots, but it has also been used in work on computer vision. 

30.16 Vision 

A quite different area of work is that of vision. This topic is 
a major one in AI but is not of prime concern here, and will 
be treated briefly. 

Accounts of visual image processing and computer 
vision are given in ComputerTechniques in Image Processing 
(Andrews, 1970), Computer Vision Systems (Hanson and 
Riseman, 1978), ComputerVision (Ballard and Brown, 1982), 
Vision (Marr, 1982), Robot Vision (Horn, 1986) and by 
Winston (1984), Patterson (1990) andTanimoto (1990). 

Most applications of visual image processing lie outside 
the process field, but its use in robotics may have some 
bearing. There are also applications in accident investiga¬ 
tion, as described below. 

Visual image processing is generally described as invol¬ 
ving an image acquisition stage followed by low level, inter¬ 
mediate and high level processing stages. The image 
acquisition stage yields a digitization of the image. Low level 
processing deals with noise reduction, outline and edge 
definition, thresholding, and texture and colour. Threshold¬ 
ing converts a grey image into one with regions of black and 
white only. Intermediate level processing handles shape for¬ 
mation and interpretation and involves operations such as 
connecting, filling in, combining boundaries, determining 
regions and assigning labels. High level processing deals 
with semantic analysis and interpretation and involves the 
identification and characterization of objects and relation¬ 
ships. The various processes utilize a number of specialized 
techniques such as the determination of the edge distance 
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and surface direction, region growing, shape analysis, and 
so on. More advanced topics include three-dimensional 
images and motion. Work on aspects of visual image proces¬ 
sing, notably on blocks world problems, has had influence on 
AI generally 

Image enhancement may sometimes be used in accident 
investigation. The Piper Alpha Inquiry heard evidence on 
image enhancement of photographs taken of the west side 
of the platform in the early stages of the fire, with particu¬ 
lar reference to the issues of the nature and source of the 
fireball and of any damage which may have occurred to the 
firewall between the modules, though in the event it was 
not possible in this case to take much from this evidence. 

30.17 Natural Language 

Another area of work is that of natural language. This too 
is a major topic in AI, but again one that can be treated 
briefly here. 

Accounts of natural language processing and machine 
translation are given in Syntactic Structures (Chomsky, 1957), 
Semantic Information Processing (Minsky, 1968), Under¬ 
standing Natural Language (Winograd, 1972), Semantics 
(Lyons, 1977), Syntax (Culicover, 1982), Practical Experience 
of Machine Translation (Lawson, 1982), Language as a 
Cognitive Process (Winograd, 1983), Language Leamahility 
and Language Development (Pinker, 1984), Conceptual Struc¬ 
ture (Sowa, 1984), Natural Language Processing (Cullingford, 
1986), Understanding Natural Language (J. Allen, 1987) 
and by Winston (1984), Charniak and McDermott (1985), 
Patterson (1990) andTanimoto (1990). 

Natural language processing as such is of little interest 
here, but work in this area has an important bearing on topics 
that are relevant such as knowledge and knowledge repre¬ 
sentation. Work on natural language covers areas such 
grammars, parsing, syntax, semantics and language gen¬ 
eration. 

Some kinds of knowledge used in understanding lan¬ 
guage include: syntax, or the structure of language; 
semantics, or the meaning of language; pragmatic knowl¬ 
edge, which relates sentences and their meaning to context; 
and world knowledge, which is required to use a language 
effectively. 

In the areas of semantics, work relevant to the topics dis¬ 
cussed earlier includes that on the semantics of quantity, time, 
space, and knowing and belief. 

Transition networks, a technique for parsing sentences, 
and their development, augmented transition networks 
(ATNs), are based on directed graphs. ATNs have been used 
in Stone World, a program that simulates some of the 
activities of a stonemason, moving objects around an 
environment. 

Some understanding of natural language is likely to be 
helpful in applying AI techniques in areas such as operat¬ 
ing procedures. 

30.18 Planning 

Another major area of work in AI is that of planning. 

Accounts of AI planning include those in GPS (Ernst and 
Newell, 1969), A Structure for Plans and Behavior (Sacerdoti, 
1975), Planning and Understanding (Wilensky, 1983) and 
Readings in Planning (J. Allen, Hendler and Tate, 1990) and 
by Fikes and Nilsson (1971), Tate (1976, 1977), Sacerdoti 
(1977, 1985), Waldinger (1977), Steflk (1981), Vere (1983, 


1992), Winston (1984,1992), Chapman (1985), Charniak and 
McDermott (1985), Currie and Tate (1991) and Lyons and 
Hendricks (1992). 

Planning programs which have been influential in the 
development of planning in AI are GPS by Ernst and Newell 
(1969), STRIPS by Fikes and Nilsson (1971) and Fikes, 
Hart and Nilsson (1972), NOAH by Sacerdoti (1975,1977), 
NONLIN by Tate (1977), MOLGEN by Steflk (1981), DEVISER 
by Vere (1983) and TWEAK by Chapman (1985). 

30.18.1 Planning and plans 

Requirements for planning are that there he an initial world 
state, a set of actions that change that state and a set of goals 
for the final state, and that the environment be sufficiently 
predictable, though not necessarily completely determined. 

The need for planning arises where the situation is novel 
or critical. Often, however, the situation is familiar. In such 
cases it may well be sufficient to retrieve from store an 
existing plan. 

It is instructive to compare a plan and a program. A plan 
is typically executed once, whilst a program may be run 
many times, albeit with different input data. Apian may have 
to cope with an environment that is subject to changes, 
whereas the environment in which a program operates is 
stable. A plan defers commitment in order to be able 
respond to the environment. 

Planning may be regarded as a special case of reasoning 
about time, or temporal reasoning. The temporal relation¬ 
ships may be shown in a time map, which is a specialized 
form of associative network. In one form of time map the 
nodes represent times, in another they represent situations. 

Planning involves decomposing a task into a set of sub¬ 
tasks. These subtasks are then further decomposed until a 
level is reached at which a subtask decomposes into a set of 
primitive actions. The task may be represented in the form 
of a task network, which is a special kind of time map. The 
structure of the task is in effect a plan for performing it. 

Accounts of the overall activity of planning tend to break 
it down in different ways. One broad type of activity is plan 
generation. This involves creating a plan to perform a task. 
The generation of plans is one of the more difficult areas of 
planning. Plan generation tends currently to be domain- 
specific, with domain-independent plan generation often a 
rather distant goal. 

It may not always be necessary to generate a fresh plan. 
In some cases it is sufficient to recognize that the task is, or 
is sufficiently close to, one for which a plan has already 
been devised and is already in store. 

Another broad area of planning is plan selection and 
coordination decisions, which are rather more amenable to 
domain-independent treatment. Plan selection involves 
choosing from candidate plans and plan coordination the 
sequencing of a set of plans. Criteria for making these 
decision include avoidance of interference between plans 
and minimization of resources, including time. 

Planning, therefore, involves the manipulation of a 
number of plans. These plans are not necessarily treated as 
a global plan. The emphasis may be rather on the planner 
and on the way in which it manipulates these plans during 
execution. In general, plans may be relatively simple, but 
the planning algorithms that manipulate them can be 
rather complex. 

Plan execution involves executing the primitive actions 
of the plan, monitoring for failures and, if necessary, 
replanning. 
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30.18.2 Blocks world and mundane planning 

Much AI work on planning has centred around the blocks 
world situation in which a robot performs actions such as 
stacking or unstacking the blocks. In the simple case, it is 
assumed that the only changes to the environment are those 
caused by the robot’s action and that these actions are pre¬ 
dictable, instantaneous and performed one at a time. 

Features of this situation are the relative simplicity of the 
goals, the world state and the resultant plans. In real-life, or 
mundane, situations the case is quite different. There are 
likely to be a number of goals some of which may conflict 
and there may be a large amount of common sense infor¬ 
mation that needs to be taken into account. 

30.18.3 Goal ordering and meta-goals 

Planning is sensitive to the order in which the goals are 
attempted. An inappropriate ordering can result in exten¬ 
sive backtracking. Methods of goal ordering are therefore 
needed. 

One method is to permute the order of the goals if there is 
difficulty in obtaining a solution. A more systematic 
approach is to order the goals in a hierarchy. High level 
goals have features such as: they are the most difficult to 
achieve, they determine the structure of the space, and they 
are not themselves affected by actions. 

In many cases, particularly in mundane situations, the 
problem of the ordering of goals becomes quite severe.There 
are multiple goals that may interfere or are conflicting 
so that there is a need to be able to reconcile goals and to 
abandon goals. This problem has often been tackled by the 
use of ad hoc rules that set meta-goals such as achieving as 
many goals as possible, maximizing the value of the goals 
achieved, avoiding impossible goals and economizing 
resources such as time. 

Wilensky (1983) has attempted a more fundamental 
approach which eschews this ad hoc approach and in which 
planning of meta-goals, or meta-planning, is conducted in 
exactly the same way as regular planning of goals. This 
approach is implemented in the program PANDORA. 

30.18.4 Protection of goals 

Planning requires that certain goals and states be protected 
from alteration. It is normal that a goal, once achieved, is 
protected. However, if subsequently a solution cannot be 
found, it may be necessary to violate this protection in order 
to seek a solution by goal permutation or some other method. 

Protection is also applied to states. A state is protected 
during an interval if it is required to be true throughout that 
interval. An important class of plan failure is that of pro¬ 
tection violations. 

One strategy for preventing protection violations is to 
detect them as they occur. Another is to anticipate them. 
The basic method of dealing with a protection violation is 
reordering. 

30.18.5 Events, actions and macroactions 

The interaction of an agent with an environment may be 
described in terms of the actions of the agent and of the 
events in the environment. 

The general form of a primitive action routine specifies 
(1) objects (to be used), (2) steps (to be executed), (3) order 
(of steps) and (4) protection (of goals). A primitive action 
is modelled by specifying the action routine and the pre¬ 
conditions and post-conditions of the action, or in other 
words the conditions for it to be taken and its effects. 


A set of primitive actions may be grouped together in a 
structure with associated goal protections to form a macro¬ 
action. The plan implemented by a macroaction is thus one 
created by a human rather than an AI planner. Macroactions 
are a useful device, but also have drawbacks. In some cases a 
macroaction may be inf lexible or inappropriate. 

30.18.6 Operators 

Closely related to the above is the concept of an operator. 
In AI planning an operator acts on a state to effect transi¬ 
tion to some other state. An operator is an action with 
attached lists of pre-conditions and post-conditions. The 
pre-conditions are the conditions that must be met for the 
operator to be applied and the post-conditions those that 
will then pertain. One of the most widely used operators is 
the STRIPS operator, described below. 

30.18.7 The frame problem 

In most cases, when an action in a plan is implemented, 
only a limited proportion of the system states alters, so that 
the effect is localized. There may, however, be a large num¬ 
ber of states that might change. The need to infer that a 
state will not change across an event is known as the ‘frame 
problem’, the term frame here having no connection with 
frame as a form for knowledge representation. 

30.18.8 Planning by search 

In AI, planning is effectively a specialized form of search. 
There are two approaches that may be taken to this search. 
One is to search through the space of world situations, or 
possible states of the world. In this type of search the initial 
state and final states are given by initial and final world 
models and the operators are the primitive acts. 

The alternative, and generally preferred method, is to 
search the space of plans. In this case operators are applied 
to reduce the task to subtasks and primitive tasks and to 
order unordered tasks. The search is conducted to discover 
a sequence of operations to transform the initial state into 
the goal state. 

30.18.9 Measures of complexity 

A measure of complexity in planning may refer either to the 
planning algorithm or to the planning task. The computa¬ 
tional time for the implementation of a planning algorithm 
may be expressed in terms of a function O(«), where n is the 
number of items or some other suitable metric of problem 
size. If in the algorithm O (n) is a polynomial in n, the pro¬ 
blem is said to have polynomial time complexity. If, on the 
other hand, O (n) is such that n appears as an exponent, 
the problem is said to have exponential time complexity. 
The increase in computational time with n for exponential 
time complexity is such that the task of solution is regarded 
as intractable, whereas with polynomial time complexity 
the task may be tractable. 

The difficulty of a planning task is commonly expressed 
in terms of NP-completeness. Known algorithms for the 
solution of NP-complete problems have an exponential time 
complexity and the task is generally assumed to be 
intractable. A task which is difficult in this sense is said to 
beNP-hard. 

30.18.10 Means-ends analysis 

One of the basic techniques of planning is means-ends 
analysis. The essential features are an initial state, a goal 
state, a set of operators with pre-conditions, and a difference 
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function. The latter is a measure of the difference between 
the goal state and the current state. 

Means-ends analysis starts with a small number of 
general steps that are then expanded into more detailed 
steps. If in the current state an operator cannot be applied 
because a pre-condition is not satisfied, the algorithm cre¬ 
ates a subgoal. It moves to an adjacent state in which the 
pre-condition is satisfied. 

One problem in means-ends analysis is that of real and 
apparent difference, or distance from the goal. If the dif¬ 
ference function is crude and inappropriate, the search can 
enter a dead end where the apparent distance to the goal is 
short but the real distance is large. An analogy is reaching a 
point that is close to the goal as the crow flies but where the 
path is blocked by an insurmountable cliff face. 

30.18.11 General Problem Solver 

Mention has already been made of the General Problem 
Solver (GPS) program of Ernst and Newell (1969). The basic 
method used in GPS is means-ends analysis. GPS works 
from the current state to the goal in a forward-chaining 
process. It proceeds by selecting and applying operators to 
reduce the difference function. If necessary, it resorts to the 
creation of subgoals. If the search reaches a dead end, it 
backtracks. Thus GPS in effect uses a depth-first search. 

30.18.12 STRIPS 

A development from GPS is the planner STRIPS (Standford 
Research Institute Problem Solver) created by Fikes and 
Nilsson (1971) and Fikes, Hart and Nilsson (1972). STRIPS 
has had a major influence on AI planning, being widely 
used, copied and modified. STRIPS is a linear planner, as 
described below. 

A characteristic feature of STRIPS is the operator used. 
The STRIPS operator consists of an action with a specified 
listof pre-conditions andpost-conditions.The pre-conditions 
are the conditions that must be met for the operator to be 
applied and the post-conditions those that will then pertain. 

Another feature of STRIPS is that it tackles the frame 
problem by making the default assumption that an action 
has the effects specified, no less and no more. 

30.18.13 Linear and non-linear planning 

A distinction is made in planning between linear and non¬ 
linear planning. Early planning programs used linear 
plans.The planner starts at one end, either the initial or the 
goal state, and moves step by step closer to the other end. 
The order of the operations performed is completely spe¬ 
cified. Non-linear planning, by contrast, utilizes partial 
plans. A partial plan is a set of steps that is not fully deter¬ 
mined. Features of a partial plan that may not be fully spe¬ 
cified are the order of the steps or the choice of operator to 
be used. A single partial plan may comprehend a number of 
total plans, or completions. 

The use of non-linear instead of linear planning is much 
more efficient, being characterized by polynomial time, as 
opposed to exponential time. 

30.18.14 NOAH 

The first non-linear planner was NOAH by Sacerdoti 
(1975,1977). 

30.18.15 Planning theorems 

A feature of AI planning is the formulation of governing 
theorems. This aspect is associated particularly with the 


work of Chapman. This work moves planning away from 
ad hoc approaches and emphasizes the proving of planning 
theorems, on correctness or attainability. 

30.18.16 TWEAK 

The planning theorem approach is embodied in the 
TWEAK program developed by Chapman (1985). This is a 
non-linear planner that retains the STRIPS-type operator. 
A plan produced by the program is guaranteed to be correct. 

30.18.17 Hierarchical planning 

In the foregoing account, frequent reference has been made 
to goals and some to subgoals. It might perhaps be inferred 
from this that AI planning always involves a hierarchy of 
goals, but this is not so. Hierarchical planning is only one 
approach. 

In hierarchical planning, the higher level goals are ex¬ 
pressed in relatively general terms and are then expanded 
into the more detailed lower level goals. Translation from 
higher to lower levels goals is a matter of inference. To this 
extent hierarchical planning may be distinguished from 
planning proper, which involves the selection and ordering 
of goals. 

30.18.18 Non-subgoaling planning 

An alternative to hierarchical planning is to use a single 
level of goals. Such non-hierarchical planning is sometimes 
known as non-subgoaling planning. The characteristic 
non-subgoaling planner proceeds by forward chaining 
using means-ends analysis and adds actions to the plan in 
the order in which they will be used. Using this approach it 
is relatively easy to check that the current plan does not 
enter into an undesirable state, and hence that the final plan 
does not do so either. 

30.18.19 State graph planning 

In state graph planning the problem is represented as a 
graph of the possible states of the system, the states being 
represented by the nodes and the actions by the arcs con¬ 
necting the nodes. State graph planning can provide solu¬ 
tions to a wide range of planning problems, including most 
operating procedure synthesis problems. However, it has a 
number of limitations. Problems of modelling and of unde¬ 
sirable states have to solved by the user in the process of 
creating the state graph. The state graph can he very large 
and it may not be easy to modify it. There are issues of the 
correctness and completeness of the stage graph. 

30.18.20 Goals of protection 

A planner should ensure that entry is not made into an 
undesirable state. However, AI planning methods for the 
avoidance of such states are not well developed. Hence in 
applying such planning to process problems such as oper¬ 
ating procedure synthesis, where it is essential to avoid 
unsafe states, some adaptation is necessary. 

A variety of terms have been used to describe the nega¬ 
tive goal of avoiding entry into an undesirable state. They 
include domain constraints, avoidance goals, preservation 
goals and goals of prevention. The latter term is the one 
used here. 

30.18.21 Functional operators 

As already described, a central concept in planning is that 
of an operator. Reference has been made particularly to the 
STRIPS operator, which has been widely used. However, in 
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systems such as process networks the conditions after an 
event can depend on those that pertain before it. In other 
words there is a functional dependency between the input 
and output states. This cannot be handled by a STRIPS- 
type operator. 

This problem has led to the development of the condi¬ 
tional, or functional, operator. This type of operator has a 
number of sets of pre-conditions and a number of sets of 
post-conditions. For each set of pre-conditions, there is a 
corresponding set of post-conditions which apply. 

30.18.22 Action synergy 

It commonly occurs in planning that a group of actions has 
an effect which is not exhibited by the individual actions 
taken in isolation. This is known as action synergy. 

A simple example is a pair of valves in a pipe. If the initial 
state is that both are closed, the action of opening one of 
them does not have the effect of allowing flow through the 
pipe. This effect is obtained only by the actions of opening 
both valves. 

There are there thus some goals that can be achieved 
only by action synergy. Action synergy may also be the 
cause of an undesirable effect. In some cases it can have the 
effect of entering an unsafe state. 

30.18.23 Subplan merging 

Another situation common in planning is the need to merge 
two subplans. This can often be a non-trivial operation. 

A simple example of the need for subplan merging is the 
problem of taking a tool from a toolbox. The initial states 
are that the toolbox is shut and that the tool is inside. The 
desired end state is that the toolbox is shut and that the tool 
is outside. The last two states therefore constitute goals for 
the end state. The plan must ensure that the two subplans 
for removing the tool and shutting the toolbox are so 
merged that the tool is removed before the toolbox is shut. 

30.18.24 Planner operation 

At this point an account is given, following Vere (1992), of 
the operation of a typical AI planner. The planner operates 
by keeping a stack of goals and conducting an ordered 
depth-first search to achieve them. 

It proceeds by a process of node expansion, involving 
backward chaining. Each node represents a subgoal. The 
planner achieves the subgoal by selecting an action with a 
post-condition which matches the subgoal. The precondi¬ 
tions of that action then become the new subgoals. 

It is not always necessary or appropriate to expand a pre¬ 
condition. In many cases a pre-condition can be achieved by 
linking. Linking is used where the precondition of a subgoal 
is already satisfied, in that there already exists elsewhere 
in the plan above the current subgoal a node with an asser¬ 
tion which achieves that pre-condition. In some instances, 
there may be several linkings which satisfy a pre-condition. 
Associated with this are syntactic conventions in action 
descriptors which inhibit backward chaining of a pre¬ 
condition and thus reduce the extent of backtracking. 

Where node expansion throws up more than one candi¬ 
date action, in other words where an OR branch occurs, it 
is necessary to select one of them. Rules are therefore 
required for action selection. These rules may be domain- 
independent or domain-specific. Some criteria for domain- 
independent selection are to choose an action on the basis 
of: the number of non-linkable pre-conditions; the number 


of additional, or bonus, goals which it achieves; and the 
resources which it consumes. 

Conflict can arise where there are two unordered nodes 
with contradictory assertions. Resolution of the conflict 
needs to be made immediately. It is effected by placing the 
two nodes in order and maintaining the protection of the 
upper node. 

Node expansion, linking and conflict resolution by 
ordering are the three fundamental operations of this type 
of planner. Vere gives an example of a blocks world plan 
utilizing only these three operations. If neither node 
expansion nor linking is possible, the subgoal cannot be 
achieved and it then becomes necessary to backtrack. 

30.18.25 NONLIN 

The program NONLIN by Tate (1976) is a hierarchical 
planner that operates broadly on the above lines and has 
been applied to turbine overhaul and naval missions. 

30.18.26 Execution monitoring 

A plan may fail in execution due to a number of causes. One 
such cause is simply random events. Hence execution 
monitoring is an essential part of planning. Planning of a 
task and its execution need to be interleaved. There is no 
point in formulating a comprehensive plan if it is likely to 
be negated by events occurring at an early stage. On the 
other hand, some degree of forward planning is desirable. 
One issue in planning is how far ahead to plan. 

There is no agreed approach to execution monitoring, 
but it is possible to identify certain issues. At any given 
time the planner has an expectation that a number of states 
are true. It may conduct tests to verify them. In this case it 
requires criteria for selecting the tests. 

A related problem is the explanation of unexpected 
results. These may arise for a number of reasons such as 
a defective model of the world situation or a random event. 

30.18.27 Reactive planning 

The conventional approach to planning is the creation of a 
plan which in the absence of changes in the environment 
will achieve the goals but which has some capability to 
respond to such changes and to replan. There exists, how¬ 
ever, a quite different approach, which is to achieve goals by 
a process of responding to the environment. This is reactive 
planning, which is described by Lyons and Hendricks (1992). 

Conventional planning has typically been applied to 
situations of the blocks world type. Other worlds exist, 
however, and need to be dealt with. One envisioned by 
Schoppers (1987) is ‘baby world’, in which the environment 
is disturbed by activities characteristic of babies, such as 
throwing bricks around, and so on. It is with this type of 
world that reactive planning is concerned. 

Like conventional planning, reactive planning seeks to 
achieve goals, but when a change in the environment occurs, 
it reacts not by making a modest change to the original plan, 
or replanning, so much as by creating a new plan. 

Thus, the techniques used in reactive planning are based 
on some form of reaction between the agent and the envir¬ 
onment. For example, Brooks (1986,1989) has used a hier¬ 
archy of routines that react with the environment to achieve 
goals, the hierarchy being termed the ‘subsumption archi¬ 
tecture’ and the routines the ‘behaviours’. 

Another aspect of reactive planning is the work of Nilsson 
(1988), who has addressed the problem that in conventional 
planning the higher levels surrender control and have to 




30/28 ARTIFICIAL INTELLIGENCE AND EXPERT SYSTEMS 


suspend action until they receive it back, so that the situa¬ 
tion is liable to occur that the lower levels of control continue 
with activities which have been rendered inappropriate by a 
change in the environment. 

Reactive planning is a relatively new but now influential 
approach. 

30.18.28 Temporal planning 

Planning necessarily deals with the ordering of subtasks, 
but it does not necessarily deal with time constraints. 
Temporal planning addresses problems where such time 
constraints exist. 

These time constraints have been handled in work by 
Vere (1983), in which each action is assigned a start time 
and a duration. Temporal relationships are defined using 
words such as before, equal, meets (adjoins), overlaps, 
during, etc. He has implemented this method in the program 
DEVISER. 

30.18.29 Domain dependency 

Initial work on planning utilized domain-independent 
approaches. Later work has moved to domain-dependent 
methods. This change of approach was prompted by experi¬ 
ence. In addition, however, it has been shown by Chapman 
(1985) that there are theoretical reasons for thinking that 
it is not practical to build a domain-independent planner 
that is able to tackle real-life problems and is also provably 
correct. 

30.18.30 Decision theory 

One method of analysing a plan is the use of decision theory. 
Since AI work on planning has largely been concerned with 
synthesis and since decision theory is a tool for analysis, 
the extent of application of decision theory in planning has 
been limited. Human planners are well able to create plans 
in mundane situations. Decision theory was developed to 
assist in the analysis of plans for the more complex cases. 

More extensive application of decision theory for the 
analysis of plans synthesized by AI planning methods is 
likely to highlight the problem of obtaining estimates for 
the values of probability and utility used in the theory. 

30.19 Learning 

From the earliest day of AI, the creation of a machine which 
can learn has been one of the principal goals. Accounts of 
learning in AI are given in Learning Machines (Nilsson, 
1965), Machine Learning (Michalski, Carbonell and Mitchell, 
1983-) and by Lenat (1982,1983) and Simon (1983). 

Two principal categories of task in machine learning are 
(1) classification and (2) problem-solving. 

The representation of the objects that the machine 
experiences may take various forms. Objects may be 
described in various ways, including in terms of binary 
features, multi-valued attributes, classes or structural 
relationships. 

Learning may be classified in a number of ways. The 
learning modes considered here may be described as 
(1) learning by instruction, (2) learning by classification, 
(3) learning by exploration and conceptualization, (4) learning 
by experience and analogy, (5) learning from failure and 
(6) learning by problem-solving. 

In addition to these learning modes, there are also particu¬ 
lar devices that have a learning capability. Two that figure 


prominently in AI are (1) neural networks and (2) genetic 
algorithms. 

Of particular importance in learning is the use of infer¬ 
ence by induction and this is discussed in Section 30.20. 

In the following, an account is given of the learning 
modes and learning devices just described. It needs to be 
said, however, that for some of the learning modes the work 
described constitutes only a very partial exploration of the 
mode both in breadth and depth. 

30.19.1 Supervised and unsupervised learning 

Most work on classification tasks involves supervised 
learning. Typically, the program is given a learning set in 
which both the class and attributes of each object are spe¬ 
cified and it is then required to create a discrimination 
hierarchy. 

There is some work, however, on learning in unsupervised 
classification tasks where the program has to perform the 
assignment to classes itself. 

In problem-solving unsupervised learning is the norm, 
but some work has been done on supervised learning in 
which an expert prompts the program at crucial junctures. 

30.19.2 Learning from data and stored knowledge 

Another distinction is between learning from data and 
from stored knowledge. It is often assumed that learning 
requires new data about the interaction of the agent and its 
environment. In fact, there is generally much to be learned 
from knowledge already in store which can be retrieved and 
processed in various ways so as to learn new concepts, rules 
and so on. In particular, learning may take place in the 
course of problem-solving. 

30.19.3 Learning by instruction 

One method by which a program may learn is to receive 
instruction from a tutor. Such learning by instruction may 
proceed in various ways. 

One type of instruction that the tutor may give is modi¬ 
fications or additions to rules such as those in the knowl¬ 
edge base of an expert system. The tutor may provide 
additional rules, perhaps rules-of-thumb. Or he may moni¬ 
tor the responses of the system, detect deficiencies in these 
responses, examine the explanations given for them, and 
identify and modify the rules causing these defective 
responses. 

Instruction of an expert system on these lines is per¬ 
formed by the expert systemTEIRESIUS of R. Davis (1980), 
created as an intelligent editor for MYCIN. An account of its 
operation is given by Charniak and McDermott (1985). 

There is an element of instruction in some of the other 
methods of learning also, insofar as the learning set or 
environment presented to the program has been chosen by 
the tutor. This choice is often of considerable importance. 

30.19.4 Learning by classification 

Learning by classification involves inductive reasoning in 
which generalizations are made from a learning set of spe¬ 
cific objects, each of which is labelled with attributes and 
assigned to a class. This form of learning is considered in 
more detail in Section 30.20. 

30.19.5 Learning by exploration 

Learning by exploration is essentially concerned with 
concepts. The program is given a learning set in which the 
objects are unclassified and required to develop concepts. 
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One area of work here is conceptual clustering in which the 
program determines how to cluster and to describe objects. 
It typically involves the creation of a hierarchy of concepts. 

Two programs which perform learning by exploration 
are AM and EURISKO, both by Lenat (Lenat, 1982,1983; 
Lenat and Brown, 1984). Their operation is described by 
Charniak and McDermott (1985). Exploration differs from 
search in that the purpose is to develop and enhance 
concepts rather than to achieve goals. Essentially such 
exploration involves activities such as determining simi¬ 
larities and differences between objects and classifying 
them into sets, frames and hierarchies. 

30.19.6 Learning by experience 

Learning by experience may take various forms, but the 
aspect that is considered here is essentially learning by 
analogy. This type of learning is also known as case-based 
learning. In such learning, numbers of specific cases are 
stored in memory. An issue is the extent to abstraction of 
the salient features is performed at the time of storage or is 
deferred until the case is to be used. Clearly this affects the 
storage of cases in, and retrieval from, the memory. 

A program that learns by experience is MACBETH by 
Winston (1980, 1982). An account is given by that author 
(Winston, 1984). This program deals with the process of 
learning from situations by analogy with other situations 
and the discovery of general rules. A situation, or precedent, 
is presented in the form of a natural language description. 
This description is transformed using techniques of natural 
language understanding. This transformation facilitates 
the creation of a cause structure for the precedent. The pre¬ 
cedent has constraints that are to be matched before the 
precedent can be applied. The precedent is then applied by 
analogy to other situations where such a match exists and 
rules are derived. Such reasoning by analogy is liable to 
deduce rules that are too sweeping, and ‘censors’ are used to 
modify the rules by introducing additional conditions. 

30.19.7 Learning from failure 

A particular form of learning by experience is learning by 
failure. A type of failure that features strongly in AI is the 
failure of a plan. 

A program that learns by the failure of plans is HACKER 
by Sussman and Stallman (1975), another influential sys¬ 
tem. An account is given by Charniak and McDermott 
(1985). The program has been used in the blocks world 
environment. It contains a simulated effector system that 
reports the reason for failure of a particular step in a plan. 
The program revises the plan on the basis of the report. 

The program also has a collection of ‘critics’ that have 
the function of criticizing plans. These critics too have an 
ability to learn, which they do by analysing the experience 
of failures. 

30.19.8 Learning by problem-solving 

As stated earlier, learning does not necessarily have to be 
based on new data; it is also possible to learn by processing 
stored data. This type of learning is sometimes called ana¬ 
lytical learning, as opposed to inductive learning from data. 

Accounts of such analytical learning tend to deal par¬ 
ticularly with learning by problem-solving. One problem¬ 
solving tool that may be learned is a set of rules. The task 
of problem-solving is performed. Learning from this solu¬ 
tion proceeds by identifying the features of the problem 
and the problem-solution pairs that were used. From this 


explanation, general rules are derived. This form of analy¬ 
tical learning is also called explanation-based learning. 

Besides rules, other features of problem-solving which 
may be learned include macro-operators and heuristics. 

30.19.9 Neural networks 

Turning to devices with learning capability, one of the prin¬ 
cipal developments is neural networks. A neural network is 
a network of ‘neurons’ that in a simplified way models the 
operation of the human brain. It learns from a learning set 
of input-output patterns. It is in effect a device for learning 
by experience. A fuller account of neural networks is given 
in Section 30.21. 

30.19.10 Genetic algorithms 

Another device described in biological terms is the genetic 
algorithm, so called from a loose analogy with genetic 
change in a population. A genetic algorithm utilizes a set of 
patterns the weighting of which is changed as learning 
proceeds. In effect the patterns compete and only the fit 
survive. Genetic algorithms are used both for classification 
and for problem-solving. 

The genetic algorithm method may be applied to the 
development of rules in a rule-based production system. 
The weighting of the rules is adjusted to reflect their con¬ 
tribution to desirable behaviour. 

In some applications, use is made of operators that pro¬ 
pose new rules and the exploration conducted is primarily 
on the effect of different combinations of rule rather than of 
weightings of individual rules. 

30.20 Inductive Learning 

A large proportion of learning in AI proceeds by inference 
through induction. One of the principal uses of induction is 
the classification of objects, events and situations, but 
applications of inductive reasoning are much wider than 
this and extend to concepts, rules and so on. An account of 
induction in AI is given by Patterson (1990). 

The concept underlying inductive learning is the basic 
logic of inductive inference: 

Assertions P(ai) -* Q(bi) 

P(aQ -> Q(bi) 

Conclusion Mxy P(*)—>Q(y) 

Induction may be regarded as a process of class forma¬ 
tion. The task is to partition the universe U of objects into 
classes. The minimum partition is into a single class C and 
the rest U - C.To this end use if made of concepts, a concept 
being a description or rule which subdivides a set. The 
target concept is the concept that classifies all the objects in 
the universe. The positive instances are those objects that 
fit the target concept and the negative instances are those 
that do not. A consistent classification rule is one that is 
true for all positive instances and false for all negative 
instances. 

30.20.1 Generalization and specialization 

There are a number of recognized techniques of induction 
involving generalization and its converse, specialization. 
The basic process in induction is generalization. However, 
generalization may become too sweeping, so that the class 
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created includes negative as well as positive instances. Such 
overgeneralization may be corrected by specialization. 

Methods of generalization are exemplified by the tech¬ 
niques of changing constants to variables, dropping con¬ 
ditions and closing an interval. Replacement of constants 
by variables simply means that, given that a relation holds 
in a number of instances, it is inferred that it is generally 
true. Dropping a condition involves removing a condition 
in a description and thus widening the class. In closing an 
interval it is inferred that what is true of objects at the two 
bounds of the interval is true of objects in between. 


30.20.2 Inductive bias 

Generalization may be treated as a search problem. As such, 
it involves the familiar need to attend to the efficiency of 
the search. The term bias is applied in this context to 
those factors, other than those of the learning set, which 
influence the selection of hypotheses. One type of bias 
involves restricting the hypothesis space to be searched. 
Another involves ranking the hypotheses. 


30.20.3 Classification 

A principal application of inductive learning is classifica¬ 
tion, in which the program is presented with a learning set 
of objects each of which is assigned to a class and described 
by a number of attributes. The task is then to induce a dis¬ 
crimination hierarchy, or a set of rules, for the assignment 
of the objects to the classes. 

In the more straightforward cases the learning set is 
consistent in that it does not contain counter-examples. 
More advanced work addresses the problem of such noisy 
learning sets. 

In using a classification algorithm, the selection of the 
learning set requires some care to ensure that the set pro¬ 
vides comprehensive coverage of the domain of interest and, 
where necessary, to exclude counter-examples. 


30.20.4 ID3 

One of the principal classification methods is the ID3 algo¬ 
rithm of Quinlan (1983a,b). ID3 is based on an information 
theory approach. 

If in a sample of n objects there is a proportion p which 
belong to class C and hence a proportion (1 - p ) which do 
not, a quantity H c may be defined as 

H c = -plog 2 p-( 1 -p) log 2 (l -p) [30.20.1a] 

« - ^2Pi log 2 pi [30.20.1b] 

H c may be regarded as the expected information content 
of a message from a discrimination, or decision, tree for a 
set C of objects. 

The attribute on which to branch first is selected on the 
criterion that the information gain is to be maximized. The 
information gain Gy for attribute; is 
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[30.20.2] 

with 


Hi = Y.PiHji 

[30.20.3] 

Hjh = -pjk log 2 pjk - (1 -pjk) log 2 (l — Pjk) 

[30.20.4] 


where Hj is the information content at the node for 
attribute j, H jk is the information content associated 
with the individual branches at the node, and p jk is the 
proportion of objects having attribute j in branch k at 
the node. 

The algorithm is illustrated by Quinlan using the 
following single-class classification problem. Objects either 
belong to the class or they do not and are then denoted by 
+ or -, respectively. There are three attributes: height, hair 
and eyes.The learning set of objects is: 

short, blond, blue: + short, dark, blue: - tall, dark, brown: - 

tall, blond, brown: - tall, dark, blue: — short, blond, brown: - 
tall, red, blue: + tall, blond, blue: + 

There are therefore three branch points in the decision tree. 

Then, since there are three objects out of eight that are 
in class C, and five that are not, Equation 30.20.1 gives 

H c = -(3/8) log 2 (5/8) - log 2 (5/8) = 0.954 bits 

Taking the first attribute, height, the information still needed 
for a rule for the ‘tall’ branch is, from Equation 30.20.4, 

% m —(2/5) log 2 (2/5) - (3/5) log 2 (3/5) = 0.971 bits 

and that needed for the ‘short’ branch is 

H i2 m -(1/3) log 2 (l/3) - (2/3) log 2 (2/3) = 0.918 bits 

and hence from Equation 30.20.3 the expected information 
content is 

Hj = (5/8) x 0.971 + (3/8) x 0.918 = 0.951 bits 
Then from Equation 30.20.2 the information gain is 
Gy = 0.954 - 0.951 = 0.003 

This value is negligible. Computing the information gains 
for the second attribute, hair, and the third attribute, eyes, 
in the same way yields information gains of 0.454 and 
0.347, respectively. Thus the second attribute, hair, is 
selected for the first branch. Then the first branch of the 
decision tree is: 


Node 

Link 

hair: 

red: 

tall, red, blue: + 
dark: 

short, dark, blue: - 
tall, dark, blue: - 
tall, dark, brown: - 


blond: 

short, blond, blue: + 
tall, blond, brown: — 
tall, blond, blue: + 
short, blond, brown: — 
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Proceeding in a similar manner, the third attribute, eyes, is 
selected for the second branch. This then gives: 


Node Link 

Node Link 

hair: red: 

tall, red, blue: + 


dark: 

short, dark, blue: - 
tall, dark, blue: - 
tall, dark, brown: - 



eyes: blue: 

short, blond, blue: + 
tall, blond, blue: + 
brown: 

tall, blond, brown: — 
short, blond, brown: — 


A further, more complex example is given by Patterson 
(1990). 

Further work on this algorithm has addressed aspects 
such as handling the noise in the data, the detection of 
thresholds for numeric attributes and updating of the tree 
with new data. 

In one application to the classification of diseases, 
the algorithm outperformed an expert system constructed 
by conventional methods over a period of years (Quinlan 
etal. 1986). 

The classification tool EXTRAN is an implementation 
of IDS. 

30.20.5 INDUCE 

Another program for inductive learning is INDUCE devel¬ 
oped by Michalski and co-workers (Larson and Michalski, 
1977; Dietterich and Michalski, 1981). This program dis¬ 
covers class patterns and formulates generalized descrip¬ 
tions of these patterns. A characteristic feature is its 
utilization for its descriptive language of an extension of 
first-order predicate logic. 

30.21 Neural Networks 

A quite different kind of learning device is exemplified by 
neural networks. These utilize a form of learning which in 
certain respects mimics that of the human brain. Neural 
networks are described in Neural Computing (Beale and 
Jackson, 1990) and Neural Networks in Artificial Intelligence 
(Zeidenberg, 1990) and by Patterson (1990) and Tanimoto 
(1990). 

Work on neural networks was originally inspired by 
research on modelling of the human brain. Another input 
comes from studies of associationist psychology, particu¬ 
larly behaviourism. A neural network is a large network of 
nodes connected by links. These nodes are information 
processing elements based on a simple model of the neuron 
in the human brain. A node sums the stimuli entering it 
through the links and has a threshold above which it will 
execute, or fire, and pass a stimulus to the connected nodes. 
A link has a weighting that is applied to the stimulus 
passing along it. The link weights enhance or inhibit the 
stimuli. The knowledge held in the network is distributed 
throughout it in the form of features such as these thresholds 


and weights. The network has an input layer of nodes, an 
output layer and a number of intermediate layers in between. 

Learning in, or ‘programming’ of, a neural network pro¬ 
ceeds broadly as follows. The network is set to its initial 
condition, typically with thresholds and weights set at 
random. It is presented with a learning set of pairs of inputs 
and outputs that it is then taken through. For each input 
the output is observed and adjustments are made to the 
thresholds and weights according to some strategy. The 
process is repeated until the learning set is exhausted. 

A common strategy for adjusting the adjustable features 
during learning is error back-propagation. In thismethod, the 
error between the desired and actual outputs is used to adjust 
first the hidden layer next to the output. This error in then 
propagated back, ultimately to the input layer. The features 
most commonly adjusted are the thresholds and weights, but 
other strategies may be used which involve adjustments to 
the network topology or even to the learning strategy. 

A neural network is a form of statistical associative 
model. The statistic inference that it utilizes is better able to 
handle randomness and exceptions than is rule-based 
inference. Rule-based systems can handle exceptions, but 
generally at the price of much increased complexity. 

Neural networks have been used for knowledge repre¬ 
sentation, production systems and expert systems, pattern 
recognition, visual image processing, speech recognition 
and natural language understanding. 

Production systems and expert systems created using 
the neural network technique are known as connectionist 
systems. One application, byTouretszky and Hinton (1985), 
simulates the firing of rules and thus the operation of a 
production system. Another application is the creation of 
expert systems, as in the work of Gallant (1988) and Saito 
and Nakano (1988). 

Gallant has described a neural network expert system 
for the diagnosis and treatment of the medical condition of 
acute sarcophagal disease. The system handles two forms 
of disease, six symptoms and three treatments. It is able to 
make deductions from an incomplete set of data on the 
symptoms and to give an explanation of the route by which 
it arrived at its conclusions. 


30.22 Graphs, Trees and Networks 

AI makes use of a large number of graphs, trees and net¬ 
works, some of which are now briefly described. Some of 
these graphical forms constitute forms of knowledge rep¬ 
resentation, whilstothersrelate to thereasoningprocess.The 
graphical forms can be represented by suitable program 
structures in the programming languages used. Some 
graphs, trees and networks used in AI are listed inTable 30.3 
and some are shown in Figures 30.2 and 30.5. 

Taxonomic hierarchies for classification of entities go by 
various names. One form of particular importance is the 
ISA hierarchy, which has been described in Section 30.12 
and which is shown in Figure 30.2(b). Another form is the 
object oriented system (OOS) hierarchy. 

An inheritance hierarchy is a particular type of taxo¬ 
nomic hierarchy, which in addition to showing the classifi¬ 
cation shows also inheritance of attributes. 

A discrimination net represents the process of discrimi¬ 
nation between entities and attributes in order to identify 
an object. An object identification net is similar. 

Also the term ‘decision tree’ is sometimes applied to this 
type of diagram. 
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Table 30.3 Some graphs, trees and networks used in artificial intelligence 

Type 

Application 

Nodes “ 

Reference b 

Taxonomic hierarchies 

Classification 

Entities 


All things hierarchy 


Entities 

Winston, p. 322 

ISA hierarchy 


Entities 

C&M, p. 26 

OOS hierarchy 

Classification 

OOS entities 

Patterson, p. 155 

Inheritance hierarchy 

Inheritance 

Entities 

C&M, p.406 

Discrimination net, 

Identification 

Entities; entities, 

C&M, p. 154 

object identification net 


attributes; entities 

Patterson, p. 317 

Parse tree 

Grammar 

Syntactic categories 

Frost, p. 531 

Syntax tree 

Grammar 

Syntactic categories 

Frost, p. 527 

Transition network 

Grammar 

Syntactic categories 

C&M, p. 202 

Augmented transition network 

Grammar 

Syntactic categories 

Associative network 

Relationships 

Entities, attributes 

Patterson, p. 129 

Semantic net 

Relationships 

Nouns, verbs, adjectives 

Frost, p. 457 

Semantic tree 

Logical reasoning 

Logical expression; truth values 

Tanimoto, p. 234 

Bayesian network 

Bayesian inference 

Evidence; inferences; conclusions 

C&M, p.478 

Truth maintenance network, 

Truth maintenance 

Premises, assumptions, 

Patterson, p. 85 

belief network 

systems 

facts; beliefs 

Winston, p. 244 

Constraint propagation network 

Constraint propagation 

Facts; beliefs 

Winston, p. 243 

Goal tree 

Planning 

Goals; subgoals; primitive actions 

C&M, p. 277 

AND/OR tree 

Planning 

Goals; subgoals; primitive actions 

Winston, p. 39 

Search tree 

Search 

Start; intermediate nodes; end 

C&M, p. 265 

Games tree 

Games 

Start; positions; end 

C&M, p. 281 

Time map 

Action sequences 

Actions 

C&M, p.432 

Task network 

Planning 

Task; subtasks; primitive actions 

C&M, p.492 

Frame network 

Frames 

Frames 

Patterson, p. 138 

Decision tree c 

Decisions 

Utility values 

C&M, p. 521 

Neural network 

Neural networks 

Model neurons 

Patterson, p. 344 


a where there is a single entry, all nodes are of this type; where there are two entries (separated by a semi-colon), the first refers to the top node and 
the second to the intermediate and bottom nodes; and where there are three entries, the first refers to the top node, the second to the intermediate 
nodes and the third to the bottom nodes. 

b References are to: Chamiak and McDermott (1985) (C&M); Frost (1986); Patterson (1990);Tanimoto (1990); Winston (1984). 
c The term decision tree is commonly used in AI for a tree which represents decision-making in terms of decision theory, and this is the 


Diagrams used in the syntactical analysis of natural lan¬ 
guage include parse trees, syntax trees, transition networks 
and augmented transition networks (ATNs). A semantic net 
is used to represent the meaning of sentences. 

The associative network is a widely used tool for rep¬ 
resenting relationships of various kinds, as shown in 
Figure 30.2(a). 

A semantic tree shows the development of a logical 
expression in terms of its truth values. A Bayesian network 
gives the structure of the relationships between evidence, 
inferences and conclusions in Bayesian inference. 

A truth maintenance system (TMS), or belief network, 
shows the structure of the TMS in terms of the current 
beliefs and the premises, assumptions and facts that sup¬ 
port them. A constraint propagation network is somewhat 
similar. 

A goal tree shows the expansion of a goal into its subgoals 
and ultimately to the primitive actions that are necessary 
to achieve it. Where AND/OR logic is involved, the diagram 
may also be referred to as an AND/OR tree. A goal tree is 
shown in Figure 30.5(a). 

A game tree shows the development of a game from the 
start position, through the moves to the end position. A game 
tree is shown in Figure 30.5(b). 

A search tree shows the process of search from the start 
through the nodes to a solution, if one is found. Search trees 
are considered in Section 30.13. 


A time map shows a series of actions in time, as shown in 
Figure 30.5(c). 

A task network shows the expansion of a task into its 
subtasks and ultimately to the primitive actions that are 
necessary to perform it. A task network is illustrated in 
Figure 30.5(d). 

A frame tree shows a hierarchy of frames. 

The term ‘decision tree’ is used to describe more than one 
type of diagram. In terms of decision theory it shows the 
structure of a decision in relation to the utility values. In 
other cases the term is applied to discrimination trees. 
Another, and common, form of decision tree is that used in 
human decision-making, as described in Chapter 14. 


30.23 Directed Graphs 

A graphical representation of some importance in engi¬ 
neering is the directed graph, or digraph. Digraphs have 
been widely used in process modelling. Accounts of directed 
graphs are given in Graph Theory in Modern Engineering 
(Henley and Williams, 1973), Structural Models: An Intro¬ 
duction to theTheory of Directed Graphs (Harary, Norman and 
Cartwright, 1975) and GraphTheory (Gould, 1988). 

Directed graphs are also known as directed linear 
graphs, directed networks or signal flow graphs. A digraph 
consists of a set of vertices, or nodes, joined by branches, 
which are also termed links, arcs or edges. 
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for maintenance 
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Figure 30.5 Some graphs trees and networks used in artificial intelligence: (a) goal tree; (b) game tree; (c) time map; 
(d) task network. See Figure 30.2 for associative network and ISA forms 
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A digraph is said to be connected if it has no pair of 
vertices that are not connected by branches. It is strongly 
connected, or strong, if for each vertex there exists a 
directed path from that vertex to another vertex. Otherwise 
it is said to be weakly connected, or weak. 

A path is a set of at least two connected branches. A 
closed path is called a cycle, or loop. A digraph that contains 
no cycles, or loops, is referred to as an acyclic graph. A tree 
is an acyclic graph. 

30.23.1 Flow graph algebra 

Three principal rules of flow graph algebra are (1) the addi¬ 
tion rule, (2) the transmission rule and (3) the product rule. 

The addition rule states that the value of a variable 
represented by a vertex is the sum of all the transmittances 
entering the vertex. The transmission rule states that 
the value of a variable represented by a vertex is trans¬ 
mitted on every branch leaving the vertex.The product rule 
states that if a series connected graph has n vertices 
the « — 1 branches can be replaced by a single branch 
whose transmittance function equals the product of the 
original branches. 

The transmittance function, or operator modifying the 
value leaving one vertex and entering another, is generally 
a gain constant. Where differential equations are handled, 
however, it may also be an integration. For an independent 
variable such as time t this integration may be expressed as 
f df, or in the Laplace domain as 1/s. 

A signal flow graph (SFG) is used to represent a set of 
simultaneous linear algebraic equations or linear differ¬ 
ential equations. A typical signal flow graph is shown in 
Figure 30.6. 

These equations may also be cast in matrix form and 
manipulated in the usual way. Thus, SFG theory is a way of 
modelling system that is not only convenient but has a 
sound theoretical basis. 

30.23.2 Flow graph reduction 

There are a number of techniques for the reduction of SFGs. 
In addition to the product rule already mentioned, they 



Figure30.6 A signal flow graph. Graph forQ 3 = 0?+ Q 2 ; 
dh/dt = (1/A)(Qs-Q 4 - Q s ); h=J(dh/dt)dt 


include elimination of ‘self-loops’, various elementary 
transformations and Mason’s rule. An account of these 
techniques is given by Henley and Williams (1973). 

30.23.3 Digraphs in process modelling 

Extensive use has been made of digraphs in the modelling 
of process plants, particularly in the modelling of fault 
propagation. In such work the nodes represent process 
variables such as flow, pressure, and temperature, and the 
edges represent the effects of one variable on the other. 

In qualitative modelling, using digraphs a convention 
commonly employed is to use a transmittance function of 
+1,0 and —1 for a positive influence, zero influence and a 
negative influence, respectively. Some workers also use 
+10 and -10 to denote, respectively, strong positive and 
negative influences. 

Generally, it is only certain variables which are of inter¬ 
est. In such cases use may be made of the techniques for the 
reduction of graphs mentioned earlier. 

The use of digraphs in process modelling is discussed 
further in Section 30.36. 


30.24 Expert Systems 

One of the AI tools which has been most widely taken up 
with a view to industrial application is expert systems. 
Accounts of expert systems are given in Building Expert 
Systems (Hayes-Roth, Waterman and Lenat, 1983), Build 
Your Own Expert System (Naylor, 1983), Expert Systems 
(Alty and Coombs, 1984), Expert Systems (Forsyth, 1984b), 
Expert Systems (Harmon and King, 1985), Expert Systems 
(Sell, 1985), Competent Expert Systems (Keravnou and 
Johnson, 1986), Expert Systems: Strategic Implications and 
Applications, (Beerel, 1987), Programmer’s Reference Guide 
to Expert Systems (Hu, 1987), Knowledge Acquisition for 
Expert Systems (Kidd, 1987), Building Expert Systems: A 
Tutorial (J. Martin and Oxman, 1988), Artificial Intelligence 
and Expert Systems (Savory, 1988), Expert Knowledge and 
Explanation: The Knowledge-Language Interface (Ellis, 
1989), and Expert Systems and Artificial Intelligence: An 
Information Manager’s Guide (Ford, 1991) and by Winston 
(1984), Charniak and McDermott (1985), Frost (1986), 
Patterson (1990) and Tanimoto (1990). 

The vast majority of expert systems are rule-based 
production systems, though other methods can be used 
such as neural networks. 

The description of actual expert systems is deferred to 
Section 30.25, but occasional reference is made in this 
section to certain major systems, notably MYCIN. 

30.24.1 Project management and organization 

The strategic aspects of expert systems are considered 
in Expert Systems: Strategic Implications and Applications 
(Beerel, 1987). 

The management and organization of an expert system 
project depend very much on the nature and scale of the 
project. Most industrial applications are relatively modest. 
For a more substantial project, however, the management 
and organization may well determine the success. 

The selection of an appropriate application is crucial. 
Some characteristics bearing on suitability are discussed 
in the next section. There are two essential conditions for 
undertaking the development of an expert system: that it 
be feasible and that, once created, it will be used. 
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The first condition requires that there be available at 
least one domain expert who can provide the necessary 
expertize. A decision has to be made whether sole reliance is 
to be placed on this expert or whether other experts are to be 
brought in. The function of the experts is not only to furnish 
expertise, but also to evaluate the system produced. 

The second condition, that at the end of the day the 
system actually be used, implies the involvement of the 
potential users right from the start. One view is that it is 
a user who should be responsible for the project.Whether or 
not this is adopted, the principle of user involvement is not 
in doubt. 

Knowledge acquisition in a project of any size is the 
responsibility of a knowledge engineer. The knowledge 
engineer is not a domain expert, but should be skilled both 
in knowledge acquisition and knowledge representation 
and in the building of expert systems. 

The basic team for the creation of an expert system is thus 
the project manager, the expert, the knowledge engineer 
and the user. 


30.24.2 Selection of applications 

Experience with expert systems indicates that there are 
some types of problem for which an expert system is 
suitable and others for which it is not. For the latter, this 
does not necessarily mean that there is no suitable AI tool, 
only that an expert system is not that tool. 

The most basic requirement is that there be an estab¬ 
lished domain expertise and an expert from whom the 
domain knowledge can be elicited. 

Another equally basic requirement is that there should 
be a need for the system so that adequate resources can be 
made available for its development and so that once it has 
been developed it is used and maintained. 

A distinction is sometimes made between common sense 
and mundane knowledge, to the effect that common sense 
involves various forms of reasoning and mundane knowl¬ 
edge various kinds of knowledge about the world. Common 
sense and mundane knowledge are strong points for humans 
but weak features of machine intelligence. 

The characteristics of a problem which favour an expert 
system application are: that there is a defined domain of 
expertise; that the task to be performed is well focused and 
of moderate complexity; and that the knowledge can be 
represented in standard forms, particularly by facts and 
rules. 

The task should be one performed by an expert and be of 
a level of complexity that it is neither trivial nor so involved 
that creation of an expert system becomes impractical. The 
time taken to perform such a task is typically between a 
few minutes and a few days. 

In a given organization, the question of the selection of 
the first application of an expert system is of some impor¬ 
tance. As with any other innovation, a bad first experience 
is likely to set the technology back for some years. 

30.24.3 System development 

The development of an expert system proceeds through the 
following typical stages: (1) system concept, (2) feasibility 
study, (3) outline specification, (4) preliminary knowledge 
acquisition, (5) knowledge representation, (6) tool selec¬ 
tion, (7) prototype development, (8) main knowledge acqui¬ 
sition, (9) revised specification, (10) system development, 
(11) testing and evaluation and (12) handover. The process 


is an iterative one, with looping hack between some of these 
stages. 

Prototyping covers the creation of the prototype, the 
writing of the documentation, the induction of the user, and 
use and evaluation by the user. 

The point has already been made that the user should be 
involved from the start. This involvement should cover not 
only the specification and evaluation of the final system, 
but also evaluation at intermediate stages. 

An account of the development of a large expert system 
is given by J. Martin and Oxman (1988). 

30.24.4 System architecture and facilities 

A minimal architecture for an expert system is a knowl¬ 
edge base, an inference engine and a user interface. 

The knowledge base contains the set of facts and rules 
that constitutes the expertise. A distinction is sometimes 
made between a database of facts and a knowledge base 
containing rules. The knowledge base itself is frequently 
spoken of in terms of a set of knowledge bases. The infer¬ 
ence engine performs the process of inference from the 
facts and rules in the knowledge base. It is a basic principle 
of the architecture that the knowledge base and inference 
engine are separate. 

The user interface has several functions. It is the means 
whereby the user supplies additional information to the 
system, either in response to demand or by volunteering it, 
and the means whereby he receives the output. 

To these three basic features may be added a number of 
others. They include a blackboard, a knowledge acquisi¬ 
tion facility, a learning facility and an explanation facility 
A blackboard is a device for communicating with the 
knowledge bases and holding intermediate hypotheses 
and decisions. Only a proportion of systems incorporate 
a blackboard. A knowledge acquisition facility provides 
the means for the knowledge engineer to input knowledge 
elicited from the domain expert, allowing him to input 
and edit facts and rules, and so on. An inductive learning 
facility may also be provided. The user interface may con¬ 
tain an explanation facility. 

30.24.5 Inference engine 

The inference engine may incorporate any of a number of 
different inferencing, search and problem-solving meth¬ 
ods. It may have forward or backward chaining, corre¬ 
sponding respectively to data- or goal-driven inference, or 
a mixture of both. It may use depth-first or breadth-first 
search, hill-climbing, means-ends analysis, generate-and- 
test, pattern-matching, and so on. Or it may use some hybrid 
scheme. 

30.24.6 Blackboard 

A blackboard is a device for holding a set of intermediate 
hypotheses and decisions, in other words partial solutions. 
It communicates with and draws knowledge from the set of 
knowledge bases in an opportunistic way. In some cases it 
can be regarded as being split into three parts: plan, agenda 
and solution. The plan part contains the goals, plans, states 
and contexts; the agenda the potential actions awaiting 
execution; and the solution the hypotheses and decisions. 
The blackboard can be altered only by the knowledge 
bases. Such forms of control as the blackboard has act to 
focus attention on a problem and the knowledge bases then 
indicate what contribution they can make. 
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30.24.7 Knowledge acquisition facility 

It is helpful to the creation of an expert system if there is a 
knowledge acquisition facility (KAF) that provides for the 
editing of facts and rules and for their entry into the 
knowledge base. 

There may also be provided a facility for inductive 
learning. This may be regarded as part of the knowledge 
acquisition facility or as a separate feature. In any event, the 
purpose of this facility is to allow knowledge to be entered 
in the form of a learning set of examples provided by the 
expert and rules to be induced from these examples. This is 
an alternative to the provision of explicit rules by the expert. 

30.24.8 Explanation facility 

Most expert systems are provided with an explanation 
facility which can provide some form of justification for the 
conclusion reached, but the sophistication of such facilities 
varies. Accounts of explanation facilities are given in 
Expert Knowledge and Explanation (Ellis, 1989) and by Sell 
(1985) and J. Martin and Oxman (1988). 

There are two main types of user for an explanation 
facility, the knowledge engineer and the client user. There 
are several types of explanation that a user requires. One is 
elaboration of the questions that he is asked in order to 
assist him to answer them correctly. Another is justifica¬ 
tion for these questions in order to motivate him to provide 
answers to them. The third is an explanation of the rea¬ 
soning process. 

One of the simplest forms of explanation facility is rule¬ 
tracing. The system keeps track of the path by which it has 
reached the current point and can display this to the user on 
demand. A rule trace is relatively easy for the system to 
provide. A detailed example is given by Ellis (1989). 

However, an explanation facility that utilizes a simple 
rule trace is somewhat crude. It is preferable that the line of 
reasoning be explained rather in terms of the principles 
that govern the domain, using domain knowledge in a 
structured way. 

Considering the explanation facilities in actual expert 
systems that used in MYCIN is effectively a rule trace. 
NEOMYCIN by W.J. Clancey and Letsinger (1981) utilizes a 
number of domain-specific meta-rules which control the 
problem-solving and is thus able to provide a more domain- 
related explanation. 

The program XPLAIN by Swartout (1983) utilizes both a 
domain model, which is descriptive, and domain principles, 
which are prescriptive, and is able to provide an explana¬ 
tion that justifies rather than simply records the program 
behaviour. 

In most cases the output of an explanation facility is con¬ 
fined to text. STEAMER by Hollan, Hutchings and Weitzman 
(1984), on the other hand, which deals with operations on 
a steam plant, provides both graphical and textual output. 

Generally, an expert system is used by a quite small 
number of people. There tend to be considerable differences 
in individual preferences for output from an explanation 
facility. One way of accommodating this is to provide 
options which individual users can select. 

In more advanced work on this topic, user models are 
utilized to improve the design of the explanation facility. 

30.24.9 Building tools 

There are available a number of tools for building expert 
systems. They include programming languages, expert 
system shells and expert system building environments. 


Accounts of building tools for expert systems are given in 
Hayes-Roth, Waterman and Lenat (1983) and J. Martin and 
Oxman (1988). Lists of some principal tools are given by 
Frost (1986) and Hu (1987). 

The languages traditionally used for building expert 
systems are LISP and Prolog. Insofar as the early and 
classic systems were built in the United States where LISP 
was the favoured language, LISP has been predominant. 
Prolog implements logic programming. For object-oriented 
programming use may be made of SMALLTALK. Of the 
general purpose languages, C++ is particularly compatible. 

An expert system shell is strictly a tool created from an 
existing expert system by removing the features which are 
specific to the original problem, whilst retaining the gen¬ 
eral structure and in particular the inference method. A 
tool of the same general type may be created from scratch, 
and is sometimes also referred to as a shell. 

Shells are widely used and can be especially useful for 
prototyping. The weakness of shells is that problems vary 
in nature and a shell capable of dealing with a wide range of 
problems needs to be rather sophisticated. Thus, some 
applications require data-driven search, others require 
goal-driven search and others again require a mix. Some 
applications involve uncertainty, whilst others do not. 
Some applications may have large quantities of data but 
few rules, and others the converse. Lists of the principal 
shells are given by Frost (1986) and Hu (1987). 

There are in addition a number of so-called ‘environ¬ 
ments’ for the building of expert systems. These differ from 
shells in that they are more flexible. The concept of an 
expert system building environment is that it offers a wide 
range of features, particularly for the knowledge repre¬ 
sentation and the inference engine. Environments include 
KAS, OPS5 and AGE, described in the next section. 

There are also numerous tools for particular individual 
features of expert systems. They include tools for building 
knowledge bases, knowledge acquisition facilities, learn¬ 
ing facilities, the user interface, explanation facilities, and 
so on. There are knowledge base management systems, 
which fulfil functions somewhat similar to those of data¬ 
base management systems. 

30.24.10 Knowledge elicitation and acquisition 

Crucial activities in building an expert system are knowl¬ 
edge elicitation and knowledge acquisition. The two terms 
are often used almost interchangeably, but whereas in 
knowledge elicitation the emphasis is on eliciting the 
domain knowledge from the expert, in knowledge acquisi¬ 
tion it is on providing the program with this knowledge. 
Accounts are given in Knowledge Acquisition for Expert 
Systems (Kidd, 1987) and Knowledge Elicitation (Diaper, 
1989) and by Beerel (1987) and J. Martin and Oxman (1988). 

The expertise of the domain expert has a number of 
facets. Typically, he or she has a wide experience and 
knowledge of case histories, problems and solutions, both 
successful and failed. This background provides him with 
an understanding of the structure of the domain, of the 
crucial distinctions which have to be made, of the con¬ 
straints which apply, of the problems to be solved, of the 
decompositions which can be made, of problem-solving 
and search strategies, of heuristics and rules-of-thumb, of 
facts and rules, and of exceptions and refinements. 

The task of knowledge elicitation is generally undertaken 
by the knowledge engineer. His or her task is to acquire and 
represent the domain knowledge and to engineer the system 
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so that it is easy for the user to utilize. The most common 
method of knowledge elicitation is interviewing of the 
expert by the knowledge engineer. The aim is to make 
explicit the expertise. There is a large literature on inter¬ 
viewing, especially in the social sciences. Another approach 
is close observation of the expert as he performs the task. 
Typically this utilizes some form of verbal protocol in which 
the expert explains what he is doing and why he is doing it. 
A third approach is for the expert to provide sets of problems 
and solutions and for the knowledge engineer to induce from 
these the internal rules which the expert is evidently using 
to obtain the solutions. A fourth method is prototyping, in 
which the expert and knowledge engineer cooperate to build 
a system. The expert furnishes knowledge for, and provides 
tests of, the system, while the knowledge engineer tries to 
create a suitable system structure. 

The interaction between the knowledge engineer and the 
expert is not limited to debriefing the expert. They need 
also to work together to design the user interface. Decisions 
are required on the questions that he or she is to be asked and 
on the explanations that are to be provided for him or her. 

The process of knowledge elicitation is generally incre¬ 
mental and iterative. The expert is unlikely to be able to 
make explicit his or her expertise in a particular area in a 
single pass, and the process of elicitation is likely to prompt 
him or her to make additions and refinements, or even to 
undertake a more fundamental restructuring. 

The main domain expert is not the sole source of knowl¬ 
edge available to the knowledge engineer. He or she may also 
utilize the literature and databases, historical records, case 
histories and case studies, and interviews with other engi¬ 
neers. It should be borne in mind, however, that whereas the 
expertise of the single expert can reasonably be presumed to 
be coherent, an eclectic approach that draws on a wide range 
of sources is more likely to involve both inconsistencies 
and contradictions and out-of-date methods. 

In some cases, an expert system is created by the domain 
expert himself or herself. In particular, it has become quite 
common for systems to be created utilizing an induction 
tool that is provided by the expert with a learning set of 
examples and solutions. 

30.24.11 System evaluation 

It is clearly necessary that at some stage an expert system 
should be evaluated, but such evaluation raises a number of 
issues that need to be addressed if it is to be done satisfac¬ 
torily. The evaluation and validation of expert systems are 
discussed by Hayes-Roth, Waterman and Lenat (1983), Sell 
(1985), Beerel (1987) and Ellis (1989). 

It is not self-evident that there is need for an evaluation of 
the system other than the ultimate test of successful use. In 
fact, however, there are benefits to be gained from evalua¬ 
tion prior to entry into service, both in terms of the quality 
of the system finally produced and of the learning process 
of the organization that is building the system. 

Some issues that arise in the evaluation of an expert 
system are the criteria, the assessors, the timing, the 
methods and the overall evaluation process. An expert 
system generally captures the expertise of a single expert. 
A question therefore arises as to whether the system is to be 
judged by its success in reproducing that expertise or in 
solving problems. The distinction is a fundamental one. 
Another basic question to be decided is who is to perform 
the evaluation. The assessment may, in principle, be per¬ 
formed by the expert, the knowledge engineer and/or the 


client users. The timing of the evaluation is another issue, 
the options being to carry out interim assessments 
throughout the building of the system or to defer evaluation 
until it is complete. The methods used for the evaluation 
may be informal or formal ones. 

Evaluation criteria that are based on the requirement 
that the system reproduce the expertise of the domain 
expert centre essentially on the ability of the system to 
provide high quality advice based on correct and accep¬ 
table reasoning. More specifically, criteria for the quality of 
the advice may relate to the following features: (1) con¬ 
sistency, (2) completeness, (3) soundness, (4) precision and 
(5) usability. Consistency means that the system should 
give similar answers to similar questions. A small change 
should not induce totally different behaviour. Completeness 
implies that the coverage of the domain is comprehensive. 
The requirement for soundness is that the statements 
made are true. The precision requirement applies only where 
there are quantitative outputs, and has the usual meaning. 
Usability means here that the user interface should operate 
as intended, a requirement distinct from user-friendliness. 
The evaluation should address not only the quality of the 
conclusions but also the quality of the reasoning by which 
they are arrived at. This is not just a matter of correct infer¬ 
ence, but has to do also with the extent to which particular 
conclusions are supported by an overall structure. 

Criteria are also required to evaluate the discourse with 
the user. In large part these will centre round the ques¬ 
tioning of the user and the provision of explanation to the 
user, which were discussed above. 

An expert system is built with particular categories of 
user in mind, and ultimately it is they who must be satisfied. 
This does not necessarily mean that evaluation should be 
carried out solely by these users. Generally it will be 
appropriate for the knowledge engineer, the expert and the 
users all to be involved. The knowledge engineer is able to 
evaluate the program technically as an expert system, 
including here the user interface, whilst the expert can 
assess it in terms of the expert advice which is provided and 
the user in terms of the ease of use and value of the advice. 

With regard to timing, it is preferable to conduct the 
evaluation as the building of the system progresses rather 
than to defer it to the end. User evaluation and feedback as 
the system is being created is a recurring theme in discus¬ 
sions of system evaluation. 

The evaluation may be informal and qualitative or it may 
use formal and possibly quantitative methods. Some for¬ 
mal methods are described in Hayes-Roth, Waterman and 
Lenat (1983). Whatever other methods are used, two that are 
unavoidable are testing by the expert and use by the users. 
These tests may be informal but they should address the 
task that the system has been designed to perform and the 
criteria which have been agreed for its evaluation. 

Evaluation of an expert system is not a straightforward 
matter. Sources of difficulty are: the potential confusion 
between defects in the system and in the expertise which it 
embodies; a lack of understanding by users of the scope 
and limitations of the system and unrealistic expectations 
for its performance; importation by users of extraneous 
criteria; disagreement about the relative importance of cri¬ 
teria; and deficiencies of the system whilst it is still only 
partially developed. 

Accounts of case studies of the evaluation of expert sys¬ 
tems are given in Hayes-Roth, Waterman and Lenat (1983). 
They describe assessment of the R1 system for computer 
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system configuration and of the ORNL spill crisis man¬ 
agement system, and the lessons learned about evaluation. 
Foremost among these lessons are the need to involve users 
early and fully. At the end of the day the ultimate test is 
whether the system is used, and, if so, whether it has 
proved cost-effective. 

30.25 Expert Systems: Some Systems and Tools 

30.25.1 DENDRAL 

DENDRAL is an expert system that discovers molecular 
structures. Work on DENDRAL dates from 1965 and its 
creation was a landmark in AI. It is described by 
E.G. Buchanan, Sutherland and Feigenbaum (1969,1970), 
B.C. Buchanan etal. (1976), B.C. Buchanan and Feigenbaum 
(1978) and Lindsay et al. (1980) and also by Hayes-Roth, 
Waterman and Lenat (1983), Winston (1984) and Patterson 
(1990). 

The program determines the molecular structure of a 
substance from information on the constituent elements, or 
chemical formula, and the mass spectrograph. It has a 
structure enumerator, which synthesizes candidate chemi¬ 
cal structures subject to constraints, derived largely from 
the mass spectrograph data, that certain structures must 
be present (the necessary list) and that certain structures 
must not (the forbidden list). For each candidate structure it 
synthesizes a mass spectrograph. It matches the synthe¬ 
sized spectrographs of the candidate structures to the 
experimental ones and selects the structure that gives the 
best fit. 

The system is thus a prohlem-solving program which 
uses a generate-and-test strategy. The generation part 
involves a search that is partly guided by heuristic rules. 
It also contains other rule-based systems, one of which is a 
set of rules for structures in the forbidden list that supple¬ 
ment the mass spectrograph information. The test part is 
the spectrograph matching process. 

The use of DENDRAL showed up some of the problems 
of knowledge elicitation. This led to the development of 
META-DENDRAL, which induces rules from examples 
(E.G. Buchanan and Feigenbaum, 1978). 

30.25.2 MYCIN 

MYCIN is an expert system for the diagnosis of infectious 
blood diseases. It is described in Computer-Based Medical 
Consultation: MYCIN (Shortliffe, 1976) and Rule-Based 
Expert Systems (E.G. Buchanan and Shortliffe, 1984) and 
also by Hayes-Roth, Waterman and Lenat (1983), Winston 
(1984), Charniak and McDermott (1985) and Patterson (1990). 

The program is a rule-based production system. Initially 
it had some 200 rules that by the early 1980s had risen to 
about 600. A feature of the rules is the use of certainty 
theory. Each rule is assigned a certainty factor that is pro¬ 
pagated through to yield a certainty for the result for each 
hypothesis. Search in MYCIN is a slightly modified form of 
depth-first search with backward chaining. The current 
hypothesis constitutes the goal of an AND/OR tree. 
MYCIN has an interactive facility. Backward chaining has 
the advantage over forward chaining that it is more com¬ 
patible with user interaction. A search that proceeds by a 
process of elimination tends to generate a large number 
of questions, which is liable to irritate the user, and the 
interaction is modified so that the user is asked a smaller 
number of direct questions, the answers to which then 
guide the search. 


Associated with MYCIN is TEIRESIAS, which was 
developed as a front end to aid knowledge acquisition. 
MYCIN has also given rise to EMYCIN, an expert system 
shell based on MYCIN. 


30.25.3 CASNET 

CASNET is an expert system for the diagnosis and treat¬ 
ment of glaucoma, and is a research program. It is described 
by Weiss, Kulikowski and co-workers (Weiss, Kulikowski 
and Safir, 1977,1978; Weiss etal., 1978;Weiss and Kulikowski, 
1981,1983; Kulikowski and Weiss, 1982) and also by Hayes- 
Roth, Waterman and Lenat (1983) and Patterson (1990). 

The program carries out diagnosis using three levels of 
knowledge: patient observations, pathological state and 
disease. Its general structure is shown in Figure 30.7. 

The use of the intermediate level of pathological state is a 
key feature of the approach taken in CASNET. CASNET 
utilizes an associative network or semantic net. Inference is 
effected by traversing the network in a search for the most 
plausible paths of cause and effect. The program also 
utilizes production rules. 

30.25.4 PROSPECTOR 

PROSPECTOR is an expert system that gives advice on 
mineral deposits. It is described by Duda etal. (1978), Hart, 
Duda and Einaudy (1978), Duda, Gaschnig and Hart (1979) 
and A. Campbell et al. (1982) and also by Hayes-Roth, 
Waterman and Lenat (1983), Charniak and McDermott 
(1985) and Tanimoto (1990). 

The program utilizes geological field data to advise on 
the likely locations of deposits of a particular mineral. Like 
CASNET, it makes use of an intermediate level of knowl¬ 
edge, and is one of the best examples of an expert system 
based on this feature. It contains ‘models’ of situations in 
which deposits of particular ores tend to occur. 

PROSPECTOR is a rule-based production system. 
Explicit use is made of Bayesian inference, as shown in 
Figure 30.8. Where use is made of such Bayesian prob¬ 
abilities, it is necessary that the prior probabilities be con¬ 
sistent. Methods of approach to this problem are discussed 
by Tanimoto (1990). 

The user has a facility to interact with PROSPECTOR. 
This includes the option to volunteer information. 

30.25.5 CADUCEUS 

CADUCEUS, originally called INTERNIST, is an expert 
system for the diagnosis of diseases of the internal organs, 
and is a research program. It is described by R.A. Miller, 
Pople and Myers (1982), Pople (1982) and also by Hayes- 
Roth, Waterman and Lenat (1983) and Charniak and 
McDermott (1985). 

The authors of the program claim that it covers some 
two-thirds of the diseases of the internal organs. It deals 
with about 500 diseases in terms of some 3500 conditions. 
In addition to its wide coverage, another of its strengths is 
its ability to handle multiple diseases. The information 
used in the program includes not only symptoms but also 
medical history and laboratory test results. A feature of the 
search strategy used in CADUCEUS is that it involves a 
large bottom-up element. 

Work on the development of CADUCEUS aims to make 
the program act more like a physician by making an initial 
global assessment, decomposing the problem and parti¬ 
tioning the symptoms among the separate subproblems. 
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Figure 30.7 Levels of knowledge in CASNET (Weiss et at., 1978) (Courtesy of North Holland Publishing Company) 


30.25.6 R1/XCON 

XCON, originally called Rl, is an expert system for the 
configuration of VAX computer systems, and is in indus¬ 
trial use. It is described by McDermott (1980,1981,1982a), 
and also by Hayes-Roth, Waterman and Lenat (1983), 
Winston (1984), Chamiak and McDermott (1985) and 
Tanimoto (1990). 

The program accepts an order for a computer system and 
performs the following aspects of system configuration: 

(1) check the order for missing and mismatched items, 

(2) create the layout of the processor in cabinets, (3) put 
boxes in the input/output cabinets and place components 
in these boxes, (4) put panels in the input/output cabinets, 


(5) create the floor plan layout and (6) do the cabling. XCON 
is thus a problem-solving program. It is based on produc¬ 
tion rules. 

The number of rules in XCON is large. In 1979 the pro¬ 
gram had about 800 rules, by 1983 about 3000 and by 1990 
some 12,000.The large number of rules requires an efficient 
search strategy. Search in XCON is by forward chaining. 
This search involves minimal backup. The rules apparently 
incorporate sufficient constraint that the search rarely goes 
up a blind alley. The method of inference in XCON is 
deductive. This distinguishes it from the diagnostic pro¬ 
grams, where inference is by abduction. The program 
illustrates the fact that an expert system can be useful even 
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Figure 30.8 Bayesian inference in PROSPECTOR (Charniak and McDermott, 1985) (Courtesy of Addision-Wesley 
Publishers) 


if it is at a relatively early stage in its overall development. 
It was already in use in 1979. 

XCON is of particular interest here for two reasons. It is 
the only one of the classic systems described that deals 
with design, and it is a system that has been in industrial 
use for well over a decade. 

30.25.7 BAGGER 

In addition to the classic expert systems just described, 
there are certain others that are also instructive. One of 
these is BAGGER, an expert system for bagging groceries 
in a supermarket, which is described by Winston (1984). 
Although essentially a toy system, BAGGER constitutes a 
useful introduction to an expert system based on produc¬ 
tion rules, including features such as conflict resolution. 

30.25.8 EMYCIN 

An early shell was EMYCIN (Empty MYCIN) (van Melle, 
1979,1980,1981; van Melle, Shortliffe and Buchanan, 1981). 
It is a domain-independent system for the creation of expert 
systems for diagnosis or consultation. It retains the basic 
rule structure, inference engine and explanation facility 
of MYCIN. A further account is given in Hayes-Roth, 
Waterman and Lenat (1983). 


30.25.9 Other shells 

Other shells frequently mentioned are ESP ADVISER and 
SAVOIR. Some systems are variously referred to as shells 
or building tools. 

30.25.10 ART 

ART (Automated Reasoning Tool) was one of the first 
building tools. It is intended for use in building large sys¬ 
tems and integrates a number of problem-solving tech¬ 
niques. ART is written in CommonLISP. An account is 
given by J. Martin and Oxman (1988). 

30.25.11 AGE 

Another early building tool was AGE (Nil and Aiello, 1979). 
AGE contains two types of entity: components and frame¬ 
works. A component is a routine that supports a basic AI 
mechanism and a framework a fixed configuration of 
components. A back-chaining framework and a blackboard 
framework are the two original frameworks. AGE is 
described by Hayes-Roth, Waterman and Lenat (1983). 

30.25.12 KAS 

KAS (Knowledge Acquisition System) (Duda, Gaschnig 
and Hart, 1979) is a knowledge acquisition system derived 
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from PROSPECTOR. It places more emphasis than EMYCIN 
on information volunteered by the user, trying to avoid a 
large number of low pay-off questions and utilizing a mix 
of forward and backward chaining. Hayes-Roth, Waterman 
and Lenat (1983) give a further account. 

30.25.13 OPS5 

OPS5 (Official Production System 5) (Forgy, 1981) is one 
of the OPS family of building tools. It was developed as an 
aid in the building of Rl/XCON. It may be described as a 
rule-based programming language and is used to build 
rule-based production systems that use, primarily, forward 
chaining. It incorporates the RETE algorithm. Accounts 
are given in Hayes-Roth,Waterman and Lenat (1983) and by 
Patterson (1990). 

30.25.14 KEE 

KEE (Knowledge Engineering Environment) is variously 
described as an expert system shell or building tool. It has 
production rule, frame and object oriented system facil¬ 
ities. Inference is by inheritance and by forward and back¬ 
ward chaining. Accounts are given by Frost (1986) and 
Patterson (1990). 

30.25.15 KES 

Another system building tool is KES, which has produc¬ 
tion rule and frame facilities. An account is given by Frost 
(1986). 

30.25.16 EXPERT 

EXPERT (Weiss and Kulikowski, 1979,1981) is a building 
tool for diagnosis- or classification-type consultation sys¬ 
tems. An account is given in Hayes-Roth, Waterman and 
Lenat (1983). 

30.25.17 EXPERTEASE and EXTRAN 

EXTRAN, and the earlier EXPERTEASE, are classifica¬ 
tion tools based on the IDS algorithm for inductive learning. 

30.26 Qualitative Modelling 

In engineering, the conventional method of modelling a 
physical situation to create a mathematical model consist¬ 
ing of algebraic and differential equations based on classi¬ 
cal physics. In recent years, there has been growing interest 
in an alternative approach that goes by the names of naive 
physics, and of qualitative modelling, qualitative physics 
or qualitative simulation. 

Accounts of naive physics and qualitative modelling are 
given in Mental Models (Centner and Stevens, 1983), Quali¬ 
tative Reasoning about Physical Systems (Bobrow, 1985), 
Formal Theories of the Commonsense World (Hobbs and 
Moore, 1985), Readings in Qualitative Reasoning about Phy¬ 
sical Systems (Weld and de Kleer, 1990) and Recent Advances 
in Qualitative Physics (Faltings and Struss, 1991) and by 
Forbus (1984), de Kleer and Brown (1984), Kuipers (1984), 
Hardt (1992) and de Kleer (1992). 

30.26.1 Naive physics 

Classical physics is based on qualitative concepts that are 
then translated into quantitative mathematical models. 
Naive physics utilizes the same concepts but derives from 
them qualitative models. Work on naive physics has been 
described by Hayes (1979,1985) and Hardt (1992). The work 


on qualitative modelling by de Kleer and Brown (1984), 
Forbus (1984) and Kuipers (1984) also comes under this head. 

In naive physics the physical situation is modelled for¬ 
mally but qualitatively. The modelling remains symbolic 
and the variables take a limited number of discrete states. 
Naive physics retains all the basic concepts of classical 
physics such as state, equilibrium, conservation of mass, 
momentum and energy, and so on, but treats them in a 
qualitative way. It follows the same sequence of model 
formulation, solution and interpretation of the results. 

One way of looking at naive physics is that it is a formal 
encoding of common sense reasoning about physical 
situations. In many cases, particularly in mundane situa¬ 
tions, it can be quite difficult to formulate a quantitative 
mathematical model, but it is feasible to derive a qualitative 
model. In its own terms the qualitative model can be made 
as rigorous as the quantitative one. 

A naive physics model can also be viewed from the 
opposite perspective as a reduction of a quantitative model 
to its essential qualitative form. In some work on naive 
physics models have been derived both by encoding of 
natural language statements and by reduction of the equa¬ 
tions of a conventional mathematical model to qualitative 
model format. 

The formalization of common sense reasoning about 
physical situations in a naive physics model is not easy. 
Common sense draws on large quantities of knowledge 
about the physical world and the forms of knowledge 
representation involved are often specialized.The approach 
advocated by Hayes (1979) in his ‘naive physics mani¬ 
festo’ is the use of predicate calculus. In fact, the three 
main developments in qualitative modelling have not 
adopted this approach. These developments are component- 
based modelling, constraint-based modelling and process- 
based modelling. 


30.26.2 Fault propagation 

As it happens, some of the early work on qualitative 
modelling was in the process field. Qualitative models were 
used by Andow and Lees (Andow, 1973; Andow and Lees, 
1975) to model fault propagation in process plants. The 
purpose of the work was to determine the interaction 
between process variables with a view to creating alarm 
trees for alarm diagnosis by process computer. 

The basic principle may be illustrated by considering the 
differential equation for the change in level in an open tank 
with water flowing in and out: 

J = Qi-Q 2 [30.26.1] 

where L is the level, Q is the flow and t is time, and sub¬ 
scripts 1 and 2 denote the inlet and outlet, respectively. 

In the work of Andow and Lees the equations of the cor¬ 
responding qualitative model were obtained from those of a 
conventional mathematical model. Thus, the qualitative 
model equation equivalent to Equation 30.26.1 is 

L = (+Q h -Q 2 ) [30.26.2] 

that signifies that L increases if Qi increases or Q 2 decrea¬ 
ses, or vice versa. It may be noted that Equation 30.26.2 
may also be obtained by encoding an engineer’s natural 
language statement that ‘The level increases if the flow in 
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increases or the flow out decreases, and vice versa’. It con¬ 
stitutes, in effect, a half-way house between a description in 
natural language and that of a quantitative model. 

Work on fault propagation is described in Section 30.36. 

30.26.3 Qualitative modelling 

As stated above, qualitative modelling has developed in 
three main directions. These are: component-based, or 
device-based, modelling, as in the work of de Kleer and 
Brown (de Kleer, 1975,1985; J.S. Brown and de Kleer, 1981; 
de Kleer and Brown, 1983, 1984, 1986); process-based 
modelling, as in the work of Forbus (1983,1984,1990); and 
constraint-based modelling, as in the work of Kuipers (1984, 
1986). Of these three methods, component-based modelling 
appears the most suitable for the qualitative modelling of 
process plant and it is therefore this which is primarily 
considered here, but a brief account of the other two methods 
is appropriate. 

30.26.4 Process-based modelling 

In the process-based modelling of Forbus (1984), the physical 
situation is described in terms of the physical process which 
over time cause changes to occur. The physical processes are 
those such as flowing, heating, cooling, boiling and so on. 

30.26.5 Constraint-based modelling 

In the constraint-based modelling of Kuipers (1984,1986), 
the physical situation is described in terms of the variables 
and the constraints relating these variables. Three prin¬ 
cipal types of constraint are used. These are: 

Arithmetic: X= Y + Z 
Functional: Y=M + (X) 

Derivative: F=dX/df 

The arithmetic constraint requires that the values of the 
variables have the indicated relationship at all times; the 
functional constraint requires that Fis a strictly increasing 
function of X (or, for M“, a decreasing function); and the 
derivative constraint requires that Fis the rate of change of 
X. Thus, the constraints consist of a qualitative adder, a 
qualitative proportionality and a qualitative differential. 

30.26.6 Component-based modelling 

The component-based modelling approach of de Kleer and 
Brown (Q.S. Brown and de Kleer, 1981; de Kleer, 1984,1992; 
de Kleer and Brown, 1984) involves decomposing the sys¬ 
tem into separate, context-independent entities which are 
then modelled. These entities are materials, components 
and conduits. Examples of materials are fluids or current; 
examples of conduits are pipes or wires. 

A component-based approach is well suited to the mod¬ 
elling of systems with a fixed topology such as items in a 
process plant. The approach is essentially reductionist. An 
overview of component-based modelling has been given by 
de Kleer (1992) and the account here draws on this. 

30.26.7 Composability 

It is a basic principle of qualitative modelling that the 
model of a component should be independent of the context. 
This is the ‘no-function-in-structure’ principle. De Kleer 
illustrates this principle with the example of an electric light 
switch. A model of the switch that makes the unqualified 
statement ‘If the switch is off, no current flows; and if the 
switch is on, current flows’ violates the principle. Situations 


can be envisaged, such as that where there is another switch 
in series, where it might not be true. The correct formulation 
is that current flows if the switch is on and there is potential 
for current flow. 


30.26.8 Quantity spaces and landmarks 

In the notation for qualitative modelling used by de Kleer a 
qualitative value of x is denoted by [x]. The qualitative 
value of x is defined in relation to some reference, or land¬ 
mark, value. A basic quantity space is the +, -, 0 value 
space. This means that [x] = + if x > 0; [x] = - if * < 0 and 
[x] = 0ifx=0. 

The landmark value may be taken not as zero but as some 
other value, say a. In this case the origin is shifted by 
defining some new variable, say y, asy = x - a. 

Basic issues in qualitative modelling are the choice of the 
quantity space and of the landmarks. 


30.26.9 Qualitative equations and arithmetic 

Basic arithmetic operations in qualitative modelling are 
addition 

H = M + Mi [30-26.3] 

and multiplication 

[z] = [xy] = [xjfjf [30.26.4] 

In these relations, the qualitative value of [z] is fully defined 
for multiplication, but for addition it is indeterminate. The 
relationships for addition and multiplication in qualitative 
arithmetic are shown in Table 30.4. 

For derivatives, the notation 



signifies that x is increasing. An alternative notation for 
[dx/df] is Mx. 

It is not permissible to manipulate qualitative equations 
according to the same rules as conventional ones. In par¬ 
ticular, an operation such as the subtraction of [y] + [z] 
from [x] + [y] + [z] = 0 does not necessarily yield [ x ] = 0. 


Table 30.4 Some relationships of qualitative arithmetic 


A Addition [x] + [y] 

M 

M 


- 

0 

+ 

0 

0 

+ 

+ ? 

+ 

+ 

B Multiplication [x] [y] 

M 

[x] 


- 

0 

+ 

+ 

0 

_ 

0 0 

0 

0 

+ 

0 

+ 
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In the qualitative modelling method of de Kleer, an 
expression in terms of qualitative values, operators and 
variables is referred to as a confluence. A typical con¬ 
fluence used by this author is 

6P + [P]0A — QQ = 0 [30.26.5] 

where A is the area of an open control valve, P is the pres¬ 
sure drop across the valve and Q is the flow through it. 

A set of qualitative values satisfies a confluence either if 
the qualitative equality strictly holds in accordance with 
the relations given in Table 30.4 or if one side of the con¬ 
fluence remains indeterminate because the addition 
operation is not closed. A set of values contradicts a con¬ 
fluence if both sides evaluate to a distinct qualitative value 
and the confluence is not satisfied. These statements imply 
that a confluence may be neither satisfied nor contradicted 
if some of the variables do not have assigned values. 

Confluences are not used in the qualitative modelling 
work of Forbus or Kuipers. 

30.26.10 Qualitative models 

A component may have a number of states, each associated 
with a particular regime. A model of a component for the 
full set of regimes is termed a state specification. 

Such a model may be illustrated by the valve model given 
by de Kleer (1992). This is 

[A = A max ]; ff=0; 0P = O Valve open 
[0<A<A max ]; [P] = [Q] Valve working 

0P = [P]0A - 0Q = 0 

[A = fi|j [Q]=0; 00 = 0 Valve closed 

where the subscript max denotes the maximum. 

An account has been given by de Kleer of the treatment of 
flow-like and pressure-like variables in component model¬ 
ling. For flow it is assumed that the fluid is incompressible 
and the conduit runs full, and the principle of conservation 
of mass is applied. This rule is termed the continuity con¬ 
dition. For pressure it is assumed that the sum of the pres¬ 
sure drops in the conduit is constant. This rule is the 
compatibility condition. 

30.26.11 Time effects 

Qualitative modelling is concerned with changes, and 
changes take place over time. The modelling must therefore 
take time into account in some way. It is not unusual in 
qualitative modelling work for the time aspect to be some¬ 
what fuzzy. This is commonly so in fault tree studies, as 
already described. 

There are three main methods which have been used 
for modelling change over time: the use of a sequence of 
intervals (Forbus, 1984); the use of intervals separated by a 
number of instants (de Kleer and Brown, 1984); and the use 
of intervals separated by single instants (Kuipers, 1984). 

Rules necessary for reasoning about change over time 
have been derived by B.C. Williams (1984a,b) and are 
described by de Kleer (1992). 

30.26.12 Dependence and causality 

De Kleer draws a distinction between dependence and 
causality. It does not follow that because one variable 
is dependent on another, it is necessarily caused by it. 


For causality to apply, stricter criteria must be met. 
Two such criteria are locality and temporal order. Locality 
requires that for one variable to be a cause of another, the 
two variables must describe the behaviours of components 
which are physically adjacent, and temporal ordering 
requires that for one variable to be the cause of another it 
must precede it, even if only by an infinitesimally short 
interval of time, or mythical time. 

30.26.13 Ambiguities and multiple interpretations 

As already indicated, qualitative modelling is inherently 
ambiguous, and thus gives rise to multiple behaviour pre¬ 
dictions, or interpretations. How serious this is for model¬ 
ling in a particular application depends largely on the 
extent to which it is possible to devise rules for the elimi¬ 
nation of some of the interpretations. 

30.26.14 Envisioning 

The reasoning process that uses qualitative modelling to 
produce a description of the behaviours of the system over 
time is termed envisioning. An illustration of envisioning is 
given by de Kleer (1992). He presents a stage-by-stage 
account of the behaviour of a mass—spring-friction sys¬ 
tem and shows that qualitative modelling can he used to 
envision the oscillatory behaviour of the system. 

30.27 Engineering Design 

Applications of AI have been mainly in the fields already 
described, but there is an increasing amount of work in 
engineering. The material of prime interest here is that on 
process plant design, which is described below, but first 
some consideration is given to design expertise and to AI 
applications in engineering design generally. 

30.27.1 Design expertise 

Accounts of the design process in general include Intro¬ 
duction to Design (Asimow, 1962), The Nature of Design (Pye, 
1964), Design Engineering (Dixon, 1966), An Introduction 
to Engineering and Engineering Design (Krick, 1969), 
Engineering Design (Middendorf, 1969), Management of 
Engineering Design (Leech, 1972), Supplementary Readings 
in Engineering Design (Geiger, 1975), A Students Introduc¬ 
tion to Engineering Design (Simon, 1975) and The Sciences 
of the Artificial (Simon, 1969). 

The design process and expertise in design are some¬ 
what elusive. Designers have found it difficult to explain 
their skill and others who have studied it have also found it 
hard to pin down. Broadly, however, the design process 
involves problem recognition and definition, problem 
decomposition, the generation of alternative options and 
selection from these options. 

The expert possesses a knowledge base in which knowl¬ 
edge may be represented in a number of forms, many being 
analogous to those described earlier. He has available a 
mental library of design archetypes. He has knowledge 
relevant to the evaluation of situations such as: the fre¬ 
quency, or probability of events; the consequences of 
events; and the costs, in money and other factors. He is 
aware of constraining factors such as project objectives; 
costs; time; hazards; regulatory requirements; standards 
and codes requirements; and so on. He is able to make dis¬ 
tinctions of all sorts that would probably not occur to the 
layman. He possesses the ability to decompose a problem 
into subproblems which have only weak interactions and 
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which are more manageable. He has methods of working 
which include logical argument, rules-of-thumb, mental 
models and analogues. 

Part of the skill in engineering design consists of a 
knowledge of design methods for specific situations and 
equipment, based usually on appropriate mathematical 
models. This is the type of expertise with which the young 
engineer fresh from college may be expected to be familiar. 
Another part of the expertise comprises a personal collec¬ 
tion of rules, many of them not explicit. These include both 
rules-of-thumb and heuristics, which guide the search for 
solutions. In this type of expertise the experienced engi¬ 
neer may be expected to have the advantage. 

With design, in general, it is the initial conceptual stage 
that is the most critical. Closely related to this is the concept 
of design based not on trial and error but in getting it right 
first time. 

30.27.2 Expert systems 

The application of AI to engineering design is still in its 
infancy. A principal trend, however, has been the use of 
expert systems. An influential application of expert sys¬ 
tems to engineering design was Rl, or XCON, which has 
already been described in Section 30.25. Another applica¬ 
tion of AI quite common in engineering design is the use of 
classification systems. 

30.27.3 Design architectures 

There are, however, developments that start from a critique 
of these current approaches. One such is described in 
Design Problem Solving by D.C. Brown and Chandrasekaran 
(1989). The stance taken by these authors is broadly as fol¬ 
lows. Most applications of AI in engineering design take 
the form of expert systems. These tend to be general expert 
systems, often shells, which use domain-independent con¬ 
trol and inference, and are simply loaded with the rules and 
data for the particular problem. They argue that typical 
practice with programming languages, system building 
tools and shells tends to involve the use of particular control 
structures even though this may not be apparent.They state: 
The fact that the low level language is used to implement a 
higher level control structure results in the knowledge 
base actually containing quite a few rules that are really 
programming devices for expressing this higher level of 
control. That is, the much talked about separation of 
knowledge from inference is not really true in practice for 
complex problems. 

It is argued by Brown and Chandrasekaran that for effi¬ 
cient design it is necessary to take account of the specific 
domain and that there are generic tasks characteristic of 
each domain. Whilst there may be a range of features that 
are common to tasks in any domain of engineering, the 
relative importance of these features varies so greatly that 
it is not effective to adopt a uniform approach. Excessive 
emphasis on domain-independence suppresses the dis¬ 
tinctions in control and inference which are characteristic 
of human conduct of generic tasks in different engineering 
design domains. 

The framework for design that they propose is one that 
accommodates the domain-specific features. Design is 
viewed as the use of a number of different, and cooperating, 
types of problem-solver. The basic design process is that of 
generate and test. Four strategies are described for gen¬ 
erating, or proposing, designs; (1) design decomposition, 


(2) design plans, (3) design by critique and modification 
of nearly correct designs and (4) design by constraint 
processes. 

The first approach involves decomposing the design 
problem into suitable subproblems and creating a design 
hierarchy. Features of this process are the conversion of the 
goals and constraints of the overall problem into goals and 
constraints on the subproblems. 

The design plans are pre-compiled partial design solu¬ 
tions. A design plan contains a sequence of design actions. 
Strategies for the retrieval of such plans include attach¬ 
ment of plans to goals or to components. NOAH may be 
viewed as a program which instantiates and expands 
design plans, since for each goal of the item under design, 
there is a stored procedure, effectively a plan. 

Another way to proceed is by critique and modification 
of almost correct designs. This is applicable where such 
almost correct designs can be retrieved and converted to 
correct designs by processes of matching, critique and 
modification. Modification may involve the use of a number 
of problem-solving methods which may include means- 
ends analysis, hill-climbing and dependency-directed 
backtracking. 

The fourth approach is design by constraint processes. 
This is applicable where there is a structure but the para¬ 
meters are still to be determined. It proceeds by propaga¬ 
tion of the constraints and incremental convergence on a 
solution which satisfies them all. 

The authors distinguish three classes of design. Class 1 
is creative design, essentially innovation and invention. 
Class 2 typically involves powerful decomposition and 
complex failure recovery features. Class 3 is routine design 
in which the problem is readily decomposable with only 
weak interactions between the subproblems and which is 
characterized by routine plans and failure recovery 
mechanisms. 

30.27.4 DSPL 

Brown and Chandrasekaran describe an expert system 
architecture for a Class 3 design and the programming 
language DSPL (Design Specialists and Plans Language) 
created to perform such design. DSPL contains design 
agents in the form of specialists, plans, tasks and steps. 
There is a hierarchy of specialists each of which possesses 
a set of plans and has the function of plan selection. A 
plan is a sequence of calls to specialists or tasks. Each 
plan has a sponsor that matches the characteristics of 
the plan with those of the task for which it is a candidate. A 
task is a sequence of steps that it executes. The primitive 
design agent is the step. It provides a value for an attribute 
of the design. 

A feature of DSPL is failure handling. The basic 
approach taken is that the design agent concerned detects, 
diagnoses and fixes its own local failures and passes on 
only those failures that it cannot correct. 

The authors give a detailed account of DSPL covering, in 
addition to the architecture features just mentioned, the 
handling of the database, constraints, dependencies and 
problem-solving. They describe DSPL itself and given an 
example of the design of an air cylinder system. 

30.28 Process Applications 

Thrning now to the use of AI, expert system and other 
advanced techniques in the process industries, a number of 
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overviews have been published. They include those of 
Stephanopoulos and Townsend (1986), Westerberg (1989), 
Mutton, Ponton and Waters (1990) and Stephanopoulos 
(1990). The following areas of application can be identified: 

(1) project aids 

(a) aids for handling issues, 

(b) aids for handling requirements; 

(2) process synthesis 

(a) reaction route, 

(b) energy; 

(3) plant design: synthesis 

(a) inherently safer design, 

(b) classification activities, 

(c) designs with shallow structure, 

(d) designs with deep structure; 

(4) plant design: analysis 

(a) hazop, 

(b) fault tree analysis; 

(5) operating procedures; 

(6) process monitoring; 

(7) fault administration; 

(8) malfunction detection. 

These various computer aids fall into four broad categories, 
as aids for (1) the design project, (2) the design synthesis, 
(3) the design analysis and (4) the plant operation. Thus 
item (1) in the above list covers aids for the design project as 
a whole, items (2) and (3) cover the process and plant design 
synthesis aids, item (4) covers plant analysis aids and items 
(5)—(8) plant operations aids. 

Computer aids for process and plant synthesis may be 
termed front-end aids, whilst aids for plant analysis are 
back-end aids. Another way of looking at the matter is in 
terms of the generate-and-test concept: the synthesis aids 
represent the generate phase and the analysis aids the test 
phase. These various aids are considered in the sections 
that now follow. 


30.29 Project Aids 

It is appropriate to begin the account of AI aids for process 
plant design by considering those which address design 
problems at the highest level. 

30.29.1 Aids for representing design issues and history 

Design involves the identification of a succession of issues, 
discussion of these issues and decisions to select particular 
options. There are a number of benefits to be had by adopt¬ 
ing a more formal approach to the handling of design issues. 
Such an approach imparts greater structure to the decision¬ 
making process, assists communication and cooperation 
between the different design disciplines and provides a 
record of design information.This information is of various 
kinds and includes the design intent, the chronological 
development of the design, the issues raised, the constraints 
recognized, the rules applied and the decisions made. 

This record is of particular value when a design is 
undertaken which draws on that for an existing plant. 
Unless such information can be retrieved, the designers of 
the new plant may be unaware of significant issues and 
constraints and may not appreciate the reasons for certain 
design features. In the more serious cases, some assump¬ 
tion or feature critical to safety is not appreciated. 


Parties concerned with the design can see the issues 
under discussion and can make their contribution by rais¬ 
ing further issues, proposing alternative solutions, advanc¬ 
ing further arguments for or against a solution and 
drawing attention to facts relevant to, or making comments 
on, an argument. Needless to say, if a decision aid is used in 
this way there needs to be a policy governing the parties 
authorized to access it and to modify it. 

Work on this topic, and on the creation of associated 
computer aids, has been described by a number of workers 
including Kunz and Rittle (1970), Conklin and Begeman 
(1988), Potts and Bruns (1988), Ganeshan, Finger and 
Garrett (1991), Lubers (1991), Chung, Abbas and Robertson 
(1993), Ramirez-Dominguez and Banares-Alcantara (1993) 
and Chung and Goodwin (1994). 

An intelligent information system for safe plant design is 
described by Chung and Goodwin (1994). An overview of 
the system is shown in Figure 30.9. The system is issue- 
based, allowing the issues arising in the design and the 
arguments related to the issues to be represented and cap¬ 
tured. It provides a historical record of the development of 
the design and of the issues affecting this development. 
Elements of the system are (1) the viewpoint mechanism, 
(2) the issue base and (3) the rule base. 

The viewpoint mechanism is used to represent the design 
hierarchy Each viewpoint is a single point in the design 
space. The viewpoint hierarchy provides a chronological 
record of the states of the design. The viewpoint mechanism 
allows the designer to move around the design from node 
to node whilst maintaining consistency A record is kept of 
the design changes and of the constraints and rules together 
with a list of previous viewpoints.When the designer changes 
the viewpoint the mechanism traces back from the root to 
that point, reasserting all the constraints, rules and deci¬ 
sions stored along the way. The viewpoint mechanism also 
ensures that all changes made to one node are propagated 
through the design from the parent node to the child nodes. 

The core of the system is the issue base. This provides a 
record of the issues considered. An issue is identified, 
positions are taken and arguments adduced for or against 
each position. In due course a decision is made to select one 
of the positions, or options. 

Figure 30.10 shows an issue base for the following case: 
A chemical company wants to build a new plant in the 
United States. There is an existing plant for the same 
tonnage and product in the United Kingdom which uses 
both recycled cooling water (RCW) at 21°C and chilled 
water at 5°C. There are heavy demands on the cooling. 
The atmospheric ambient and wet bulb temperatures are 
higher at the proposed US site by 5°C and 8°C, respec¬ 
tively, on average. Are any modifications needed to the 
plant items and/or cooling supply systems? 

The structure consists of nodes and semantic links. As 
shown, an argument is linked to a position by a support or 
an against link and a position is linked to an issue by a 
response-to link. 

The authors also describe other types of node and link 
found necessary in developing this basic structure. Addi¬ 
tional types of node used are fact, commentand decision nodes 
and additional types of link are follow-up, combined- 
with and replaced-by links. The first of these links allows 
re-examination of an issue on which a decision has 
already been made, the second allows the combination of 
several positions to form a single response and the third 
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ISSUE BASE VIEWPOINT RULE BASE 



Figure 30.9 Aid for the representation of design issues and history: system overview (Chung and Goodwin, 1994) 
(Courtesy of Kluwer Academic Publishers) 


decomposition of the problem into a set of smaller ones.These 
extensions thus cater for features such as iteration and 
decomposition, which are characteristic of design. 

The rule base constitutes the third main element of the 
system. This contains both general rules and rules specific 
to the particular design. 

30.29.2 Aids for representing regulatory and 
code requirements 

Another generic problem in design is the handling of the 
requirements of legislation, standards and codes, and 
company policies. The number of documents containing 
requirements and the number of individual requirements is 
generally very large, and this poses a major information 
handling problem. An account of the development of the 
aids to assist with such information handling has been 
given by Chung and Stone (1994). The problem has several 
different aspects, including the retrieval of the require¬ 
ments relevant to a particular issue and the comprehension 
of these requirements. 

Considering first an individual document such as a 
standard, three distinct approaches to the problem may be 
identified. The first is to accept the document as it is and 


provide aids to the user in finding his way around it. The 
second is to perform some kind of processing on the docu¬ 
ment. The third, and most radical, is to intervene at the 
stage when the document is being written and provide aids 
to assist the author in writing it. 

The retrieval problem has two aspects: retrieval of whole 
documents and retrieval of requirements from within a 
document. For both types of retrieval widespread use is 
made of keywords. For retrieval of whole documents these 
may be words in the title, keywords provided by the author 
or keywords searched in the text. The use of combinations 
of keywords narrows the search space. 

Bourdeau (1991) has described the creation of a major 
keyword-based system REEF which is a 15,000 page ency¬ 
clopaedia consisting of about 1000 documents commonly 
used by French building professionals. The database con¬ 
tains about 75% text with the rest made up of some 3500 
tables, 9000 drawings and numerous formulae. Informa¬ 
tion is indexed at two levels, that of the document and that 
of the information unit. 

Another approach is to analyse the hierarchy of concepts 
in a document and to provide an aid based on search down 
through the hierarchy. 
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Figure 30.10 Aid for the representation of design issues and history: issue base for the decision on the selection of 
cooling water temperature. RCW, recycled cooling water (Chung and Goodwin, 1994) (Courtesy of Kluwer Academic 
Publishers) 


Another aid to retrieval is hypertext. This allows the user 
to hrowse through a document looking at related items. 
This too is based on some form of hierarchy or network of 
relationships. 

Further progress is likely to depend on a more funda¬ 
mental approach. Work in this area has developed in the 
direction of the modelling of the knowledge domain. This 
work bears both on retrieval and on comprehension. There 
are a number of methods that deal with relationships. 
Relationships between objects in a hierarchy and attributes 
of objects may be represented in a type hierarchy and 
the constituent parts of an object in a part hierarchy. 


Dependencies may be represented in network form. For the 
conclusion of a conditional statement, the pre-conditions 
may be shown in order of precedence in an ingredience 
network. A complementary representation is a dependence 
network that shows all the conclusions to which a given 
condition contributes. Requirements can be converted to 
various logical forms. These include logic programming, 
production rules, decision tables and so on. 

One outcome of this sort of approach is the conversion of 
the document into an expert system. As can he imagined, 
this is a major task. Nevertheless, several expert systems 
of this type have been created, mainly in the building field. 
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The use of methods such as logic programming or pro¬ 
duction rules raises a number of issues such as the mixing 
of domain and control information and the updating of the 
program when requirements are changed, which are dis¬ 
cussed hy Chung and Stone. One approach being taken to 
overcome such problems is the development of generic 
standards processors, which allow the user to input the 
domain information in a purely declarative way. Another 
development is automated text formalization, which is 
essentially the application of natural language compre¬ 
hension methods such as parsing to convert the text into 
formal language. A more radical departure is the develop¬ 
ment of author support systems to ensure that the original 
document is written in a more structured and formal man¬ 
ner. This addresses at source the defects that later lead to 
problems of retrieval and comprehension. 

In the account given so far, consideration has been lim¬ 
ited to a single document. There is also the problem of 
retrieving, comprehending and reconciling requirements 
from a variety of bodies. A limited amount of work has been 
done by researchers on author support systems, such as the 
work by Stone and Tweed (1991) on the capture of informa¬ 
tion from the common sources on which regulations, stand¬ 
ards and codes draw. 

Aids for handling the requirements that a design must 
meet are potentially invaluable, but it will be apparent from 
the foregoing that their development is in its early stages. 

30.30 Process Modelling 

Before considering process and plant design as such, it is 
necessary at this point to say something about modelling. 
It has become clear from attempts to apply AI to a number of 
problems in this area that a common lesson is the need for 
modelling of the process and the plant. Such models are often 
referred to as deep level knowledge in contrast to compiled 
knowledge such as rules. Some areas in which modelling 
is required are process and plant design, planning of plant 
operations and the diagnosis of faults on operating plant. 

Such modelling draws particularly on the fundamental 
work on qualitative modelling described in Section 30.26, 
and especially on that of Kuipers and of Forbus on compo- 
nented qualitative modelling and qualitative process theory, 
respectively. Some principal developments in qualitative 
modelling are now described. 

30.30.1 Modelling languages and environments 

Methods based on qualitative modelling tend to require 
the availability of a considerable number of models. The 
manual configuration of models requires considerable effort 
and can be a limiting factor in the use of the methods. 

There have been a number of approaches aimed at miti¬ 
gating this problem. One is the development of modelling 
languages such as OMOLA (Andersson, 1989; Nilsson, 
1989), MODEL.LA (Stephanopoulos, Manning and Leone, 
1990a,b) and ASCEND (Piela et al„ 1991). Another devel¬ 
opment is automatic model generation. 

The characteristic approach is the identification of com¬ 
mon features of models and of a hierarchy of models with 
inheritance of features. 

30.30.2 MODEL.LA 

MODEL.LA is a modelling language for the interaction or 
automatic construction of models of process systems. It is 
designed to be able to generate models at various levels of 


abstraction, to capture qualitative, semi-quantitative and 
quantitative knowledge, and to produce complete docu¬ 
mentation of the modelling context such as the process task 
and the assumptions and simplifications. 

It has an object oriented structure. The syntax is described 
as an extended Backus—Naur form. It utilizes six modelling 
elements: generic unit, port, stream, modelling scope, con¬ 
straint and generic variable. There are 11 semantic relation¬ 
ships obeying basic axioms of transitivity, monotonicity, 
commutativity and merging. The structure of the models 
is depicted by digraphs that are constructed by algorithms 
driven by the modelling context. 

30.30.3 Model generation 

Closely related to the use of modelling languages is the 
systematic, and hence automatic, generation of models. 
Work on this topic has been described by Catino, Grantham 
and Ungar (1991). These authors’ work utilizes Forbus’ 
qualitative process theory (QPT). The approach taken is 
based not so much on process units such as reactors and 
heat exchangers as on process phenomena such as reac¬ 
tions and heat exchange. The authors describe the use of 
an adaptation of QPT to configure such models, and the 
creation of a prototype model library. 

30.30.4 Order-of-magnitude modelling 

A methodology for formal order-of-magnitude, or O(M), 
reasoning in process engineering has been outlined by 
Mavrovouniotis and Stephanopoulos (1988). In qualitative 
modelling use is made of qualitative values (—, 0, +). For 
some purposes, this treatment of the quantity space is not 
sufficiently expressive. It is desirable to be able to have a 
more adequate treatment of absolute and relative values 
and to be able to take into account concepts such as ‘much 
smaller than’ or ‘slightly larger than’. The O(M) method 
provides a means of doing this. 

30.30.5 Dynamic qualitative modelling 

Most work in qualitative modelling is confined to the 
steady state, but there is some work emerging on unsteady- 
state, or dynamic, qualitative modelling. Thus, a method 
for the dynamic qualitative modelling and simulation of 
process systems is described by Dalle Molle, Kuipers and 
Edgar (1988). 

30.30.6 Mathematical programming 

Another area of modelling is mathematical programming, 
specifically mixed integer linear programming (MILP) and 
mixed integer non-linear programming (MINLP). An 
account of the relationship between MILP and logical 
inference for process synthesis is given by Raman and 
Grossman (1991), who show that qualitative knowledge on 
process synthesis that can be expressed in prepositional 
logic form can also be represented in the form of equivalent 
linear equations and inequalities. 

30.31 DESIGN-KIT 

A number of computer aids for design such as building 
tools and environments have been created. One of these is 
DESIGN-KIT described by Stephanopoulos et al. (1987). 
DESIGN-KIT is a process design environment built on 
CommonLISP and KEE. It is intended in the first instance 
to support the synthesis of process flowsheets, the configu¬ 
ration of control loops for complete plants, the planning and 
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scheduling of plant-wide operations and the operational 
analysis of plants. 

The underlying philosophy is that the designer should 
have available an environment which allows him to move 
consistently between the tasks of: (1) the conceptual design 
of processing schemes and the evaluation of alternative 
chemistries, and mass and energy balances; (2) the simu¬ 
lation and evaluation of designs in respect of operability 
and economics; (3) the sizing and costing of major equip¬ 
ment; (4) the creation of control loop configurations; (5) the 
design for start-up, shut-down and alternative operating 
modes and (6) the generation of piping and instrument 
diagrams, fabrication isometrics, etc. Further, the envir¬ 
onment should allow high-level communication between 
the user and the computer, full and transparent integra¬ 
tion of its various facilities, and easy maintenance and 
modification. 

Some specific features of DESIGN-KIT are shown in 
Table 30.5. 


30.32 Process Synthesis 

Turning now to the actual design process, the most creative 
part of the design is the synthesis of the process and of the 
plant. 

Accounts of process and plant synthesis have been given 
in Strategy of Process Engineering (Rudd and Watson, 1968) 
and in Conceptual Design of Chemical Processes (Douglas, 
1988). Reviews include those of Westerberg (1980, 1985), 
Nishida, Stephanopoulos and Westerberg (1981), Umeda 
(1982), Stephanopoulos and Townsend (1986), Grossman 
and Floudas (1987), Gundersen and Naess (1988), Floquet, 
Piboleau and Domenech (1988), R. Smith and Linnhoff 


Table 30.5 Some features of DESIGN-KIT (after 
Stephanopoulos et at., 1987) 


1. Generation of graphic descriptions, for example, 
flowsheets, control structures, material and energy 
balances, operational paths, etc., with windowing 
facilities and menu-driven operations 

2. Automatic generation of data structures describing the 
graphic objects 

3. Modular construction of new graphic objects, process 
units models, design methodologies, operational 
objectives, etc. 

4. High-level descriptions of various tasks, for example, 
graphic operations, design procedures, specification- 
directed simulation, definition of design or operational 
goals, automatic modelling of process units, etc. 

5. Equation-oriented simulation and design facilities 
with dynamic generation of the relevant equations 
(specified by the problem to be solved), pre-processing 
of the equations, selection of the design variables, 
symbolic differentiation, etc. 

6. Reasoning capabilities for the utilization of heuristic 
knowledge, qualitative information, O(M) analysis, 
goal-directed design or planning, as well as query and 
explanation facilities 

7. Unified database management system with contextual 
description of the information and capability, through 
a common data model, to handle all types of knowledge 
(data, graphs, equations, inequalities, procedures, 
qualitative statements, heuristics, etc.) 


(1988), Grossman (1989) and Mutton, Waters and Ponton 
(1990). 

The work of Rudd and Watson deals with in the first 
part, the creation and assessment of alternatives under 
the headings of (1) the synthesis of plausible alternatives, 

(2) the structure of systems, (3) economic design criteria, 
and (4) cost estimation; in the second part, optimization 
under the headings (5) the search for optimum conditions, 

(6) linear programming, (7) the suboptimization of systems 
with acyclic structure, (8) macrosystem optimization strat¬ 
egies and (9) multi-level attack on very large problems; 
and in the third part, engineering in the presence of 
uncertainty under the headings (10) accommodation to 
future developments, (11) accounting for uncertainty in 
data, (12) failure tolerance, (13) engineering around varia¬ 
tions and (14) simulation. 

A series of studies on process synthesis have been 
described by Rudd and co-workers (Masso and Rudd, 1968, 
1969; Rudd, 1968; Siirola, Powers and Rudd, 1971a,b; 
Powers and Jones, 1973; Rudd, Powers and Siirola, 1973; and 
May and Rudd, 1976). 

Douglas (1988) describes a hierarchical approach to con¬ 
ceptual design with the following hierarchy of decisions: 

(1) batch vs continuous; 

(2) input-output structure of the flowsheet; 

(3) recycle structure of the flowsheet; 

(4) general structure of the separation system 

(a) vapour recovery system, 

(b) liquid recovery system; 

(5) heat exchanger network. 

Douglas’ work deals with: in the first part, a strategy for 
process synthesis and analysis under the headings (1) the 
nature of process synthesis and analysis, (2) engineering 
economics, and (3) economic decision-making; in the sec¬ 
ond part, developing a conceptual design and finding the 
best flowsheet under the headings (4) input informa¬ 
tion and batch vs continuous, (5) input-output structure 
of the flowsheet, (6) recycle structure of the flowsheet, 

(7) separation system, (8) heat-exchanger networks, and 
(9) cost diagrams and the quick screening of process alter¬ 
natives; and in the third part, other design tools and appli¬ 
cations under the headings (10) preliminary process 
optimization, (11) process retrofits, (12) computer aided 
design programs and (13) summary of, and extensions to, 
the conceptual design procedure. 

Process synthesis is of great importance. In particular, it 
is relevant to (1) inherently safer design, (2) inherently 
cleaner design and (3) inherently low energy design, or 
process integration. 

30.32.1 Process route 

If the process involves a chemical reaction, this reaction is 
generally the most fundamental feature of the process. A 
number of studies have been carried out with a view to 
developing computer aids to selecting the chemical route, 
or process synthesis. Such work has been described, for 
example, by May and Rudd (1976). This is an area with great 
potential that has barely been broached. 

30.32.2 Process flowsheet 

The synthesis of the overall flowsheet is the least developed 
area of process synthesis. Most work addresses the more 
tractable subproblems such as energy economy. 
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A prototype system for the synthesis of the process 
flowsheet, PIP, has been described by Kirkwood, Locke and 
Douglas (1988). PIP has a hierarchical structure. It utilizes 
heuristics to select unit operations, to establish inter¬ 
connections between them, to identify the dominant design 
variables and to generate process alternatives. It attempts 
to devise a flowsheet using a depth-first search. 

Beltamini and Motard (1988) have described the develop¬ 
ment of an expert system, KNOD, which acts as a front end 
to a process simulator. It is used to test strategies and heu¬ 
ristics for the design and simulation of process structures. 

A method of synthesizing a flowsheet which combines 
hierarchical and algorithmic approaches is described by 
Mizsey and Fonyo (1990). A prime purpose of this system is 
to give the designer confidence that the initial universe of 
potential process paths generated contains all the relevant 
paths. 

30.32.3 Process simulators and databases 

It is now common practice to use a process simulator to 
explore the various features of a process flowsheet. This 
simulation brings with it a requirement for more powerful 
database systems that are capable of supporting such work. 
Conventional database management systems tend to be 
deficient in a number of ways and the development of 
database systems for process simulation has been an active 
area of work. An example is the development of SIMBAD, a 
process simulator linked to a powerful database, described 
by Montagna etal. (1987). There is also a trend to add object 
oriented features to traditional relational databases. Huang 
and Fan (1988) describe a hybrid database that marries an 
object oriented approach with a relational one. 

30.32.4 Process integration as a model 

One of the most successful areas of process synthesis is 
that of process integration, the design of heat exchanger 
networks. Taking this as a model for process synthesis as a 
whole, Westerberg (1989) identifies two key features. One is 
the ability to set targets for the design and the other is the 
use of an effective domain-specific representation, in this 
case for heat flow. 

30.32.5 Other process design aspects 

The problem of handling constraints during design is 
addressed by Waters and Ponton (1992). The work is con¬ 
cerned with the early identification and correction of 
design errors and explores the use of an automated check¬ 
list to prevent violations of design intent. 

An exploration of the applicability of an expert system to 
the design of batch processing systems is described by 
Hofmeister, Halasz and Rippin (1989). The authors refer 
particularly to the importance of problem representation, 
highlighted in the earlier work of Rippin (1983). 

Hanratty and Joseph (1992) have described the application 
in an expert system for reactor selection of the analytic 
hierarchy process (AHP) method of Saaty (1980).The AHP is 
one of the techniques for encoding expert judgement, as 
described in Chapter 9, and is widely used in the social 
sciences. It is based on the method of paired comparisons. 

Another design problem is the analysis of the flexibility 
of a design. This has been addressed by Grossman and 
Floudas (1987) who describe a flexibility criterion and a 
flexibility test. 

Engelmann et al. (1989) have described the use of distri¬ 
buted expert systems in process synthesis. 


30.33 Plant Design: Synthesis 

Moving on to the design of the plant as opposed to that of 
the process, this too is an important area. Here some 
modest progress has been made in the development of aids 
for certain types of task, but there remains much scope. 

30.33.1 Inherently safer design 

One of the prime aims in the design of process plants is to 
promote the practice of inherently safer design right from 
the conceptual design stage. Apart from developments 
such as those in process synthesis and the selection of a 
reaction route, which are certainly important aspects of 
inherently safer design, it is not easy to identify any 
specific synthesis aid in this area. 

30.33.2 Characteristics of design problems 

An overview of the expert design of plant handling hazard¬ 
ous materials has been given by Bunn and Lees (1988). 
What these authors do is to describe a series of design 
problems, involving various kinds of design expertise, 
ranging from very simple, even trivial, design activities 
to designs with deep structure and to designs apparently 
better suited to solution by machine rather than by man. 

The problems considered in this work are (1) the choice of 
whether or not to fit an emergency isolation valve, (2) the 
design of a flare system, (3) the design of a pressure relief 
system and (4) the design of a valve sequencing system; 
together in each case with the nature of the appropriate Al aid. 

The first part of this section gives an account of this 
work, as an illustration of the potential for Al and expert 
system aids across the whole synthesis activity in plant 
design. The second part describes some particular aids 
that have been developed. 

30.33.3 Design as equipment selection: emergency 
isolation valves 

The most simple problem in the set considered by Bunn and 
Lees is the decision whether or not to fit an emergency iso¬ 
lation valve (EIV). The problem was investigated by study¬ 
ing a published paper in which an expert describes the 
factors that he took into account in making the decision and 
gives examples of cases where such valves were installed 
and of others where they were not. An interview was also 
held with the same expert. 

The account used was that given by Kletz (1975b) of the 
installation of EIVs on two petrochemical plants. In decid¬ 
ing whether or not to install an EIV both the frequency and 
consequences of an escape were taken into account. Kletz’ 
paper states: 

Three situations should be considered: 

(1) The equipment is particularly likely to leak; for 
example, very hot or very cold pumps. 

(2) The equipment is less likely to leak. But if it does leak, 
a very large quantity of material will run out and there 
is no way of stopping it; for example, the bottom pump 
on a still containing more than, say, 50 ton of flam¬ 
mable liquid. 

(3) The equipment is less likely to leak, but if it does so, the 
leak will be very large; for example, a very large pump. 

The paper gives two tables, one for an olefins plant and one 
for an aromatics plant, listing the situations where the 
installation of an EIV was considered, giving the parameters 
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for these situations and stating whether or not it was decided 
to install such a valve. One of these tables, that for the 
olefins plant, is shown in Table 30.6. 

From the rules explicitly stated, the examples given and 
the comments made in the text of the paper, the following 
extended set of rules was derived. The overt rules are: 

(1) Fit if the equipment is particularly likely to leak. This 
is so if (a) it has a history of leakage or (b) it is pumping 
liquid at extremes of temperature or (c) it is otherwise 
thought likely to leak. 

(2) Fit if the equipment is less likely to leak, but if it does, 
it could release a large or very large quantity. 

There also appeared to be some covert rules. These 
include: 


(3) Fit if the liquid is above its autoignition temperature. 

(4) Fit if it is convenient for process reasons. 

(5) Do not fit if there is a control valve that will perform 
the same function. 

(6) Do not fit if there is an alternative means of stopping 
the leak. 

(7) Do not fit if the fluid is a gas in a compressor. 


Here the second and third rules given by Kletz have been 
combined into a single rule. 

Some of the rules are stronger than others. Thus Rule 1 is 
a strong rule. Rules 5 and 6 are also strong rules. Rule 7 is a 
weak rule and may be overriden by Rule 4. Aparticular rule 
also seems to have some influence as a counter-rule. Thus a 
small inventory weights the decision against fitting an El V. 


Table 30.6 Emergency isolation valve location: parameters for the provision of emergency isolation valves on an 
olefins plant (Bunn and Lees, 1988; after Kletz, 1975b) (Courtesy of the Institution of Chemical Engineers) 


Item 



Material 

Temperature 

(°C) 

Pressure 

(psig) 

Inventory 

(ton) 

Leak history 

EIV Note 

1. 

Furnaces 

Naphtha 

100 

120 

Small 

- 

Y 

1 

2. 

Feed pump 

Naphtha (gassy) 

15 

140 

70 

N 

N 

2 

3. 

Bottoms pump 

Fuel oil 

210 

30 

100 

Y 

Y 

3 

4. 

Sidestream pump 

Distillate fuel oil 

160 

25 

20 

N 

Y* 


5. 

Bottoms pump 

Fuel oil 

210 

30 

60 

Y 

Y 


6. 

Bottoms pump 

Gasoline 

85 

20 

25 


N 

4 

7. 

Bottoms pump 1 

Fuel oil 

220 

30 

1 

Y 

N 

5 


2 

Distillate fuel oil 

180 

25 

1 

- 

N 

5 

8. 

Reflux pump 

Ethylene 

-30 

270 

30 

Y 

Y 

6 

9. 

Sidestream pump 

Ethylene 

-30 

270 

10 

Y 

Y 

7 

10. 

Reflux pump 

Propylene 

40 

250 

50 

N 

Y 


11. 

Cold AI exchanger 

Methane 

-100 

370 

30 

Y 

Y 

8 

12. 

Process gas 
compressor 

Methane, 
ethylene, 
propylene, etc. 

40 

30 

50 


N 

9 

13. 

Compressor 

Ethylene 

-100 

65 

40 


Y 

9 

14. 

Compressor 

Propylene 

-40 

40 

100 


N 

9 

15. 

Bottoms pump 

Light gasoline 

90 

150 

5 

V 

N 

10 

16. 

Reflux pump 

Methane 

-100 

370 

5 

Y 


11 

17. 

Reflux pump 

Ethane/ethylene 

-14 

350 

5 

- 


12 

18. 

Converter 

Ethane/ethylene 

80/150 

350 

- 

Y 

Y 

13 

19. 

Reflux pump 

Propylene 

5 

90 

1 

- 

N 


20. 

Reflux pump 

Propylene 

30 

175 

5 

- 

N 


21. 

Bottoms pump 

Butylene 

120 

50 

15 

- 

N 


22. 

Reflux pump 

Butylene 

35 

50 

5 

- 

N 



“Borderline. 

Notes: 

1. Control values used as EIVs in event of tube failure and reasonably remote hand isolations. 

2. No history of leaks, material cold. 

4. Inventory can be pumped out with other pumps. 

5. Inventory small and feed to column can be isolated. 

6. Pump has leaked. 

7. Pump has leaked and ignited. 

8. AI heat exchangers more fragile than steel and therefore classified as likely to leak. Isolation by means of remote hand valves, control valves 
and one extra EIV 

9. Centrifugal machines - no history of leaks except one bad leak on ethylene compressor. Most of inventory would be flared. Leaks would be 
gas. Leak rate from ethylene and propylene compressors would be small - several tons per hour. 

10. Congested area, but remote manual valve accessible. 

11. Valve fitted remote by distance - but upstairs. Despite low temperature there is no history of leaks. 

12. Valve fitted remote by distance - but upstairs. 

13. Valve fitted on inlet and exit and blowdown lines to isolate and blow down vessel to stop runaway reactions. At least five incidents have 
occurred on plants outside the company. 
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An analysis of the apparent effects of the rules is shown 
inTable 30.7. 

The decision on whether to provide an EFVappeared to 
be a relatively straightforward classification problem. The 
use of an AI aid for classification was therefore investi¬ 
gated, the programs chosen being initially EXPERTEASE 
and later EXTRAN, which are based on the IDS algorithm. 

The class value was taken as EIV fitted/not fitted; 
and the attributes as (1) fluid, (2) equipment, (3) inventory, 
(4) temperature, (5) pressure and (6) leak history. The first 
and second attributes were entered as the process material 
and the plant equipment, the third to fifth attributes as a 
number and the last attribute as yes/no. 

The 22 cases were run through the program that induced 
from them a set of rules. However, this first application was 
not regarded as satisfactory. Among other things, no use 
was made of leak history, which was supposed to be a 
strong rule. 

The view was taken that the problem should be refor¬ 
mulated. This time the attributes taken were (1) large 
hazard, (2) leak history, (3) high leak likelihood, (4) large 
inventory, (5) high temperature, (6) above the autoignition 
temperature, (7) convenient for process reasons, (8) alter¬ 
native means of stopping the leak and (9) fluid is a gas in a 
compressor. The revised data set is shown inTable 30.8 and 
the set of rules induced is given inTable 30.9. 

This set of rules was regarded as more satisfactory 
However, in view of the fact that Rule 6 is a strong rule, it 
was considered that it should probably be the first branch. 
The fact that this is not so is evidently due to the fact the 
example set is not sufficiently comprehensive. 


The authors conclude from this example that an AI classi¬ 
fication tool of this general type can be useful, but that it 
has to be applied with caution. Care needs to be taken in the 
definition of the attributes and in the provision of a learn¬ 
ing set which is not only sufficiently large but also is 
specifically designed to cover the domain. 


30.33.4 Designs with shallow structure: flare system 

The next problem considered by Bunn and Lees is the 
design of a flare system. They take this as representative of 
a class of design synthesis problems with relatively shallow 
structure. 

A common design problem is the design of a unit for 
which there already exists a skeletal design archetype, or 
stereotype, which is more or less fixed in respect of the 
basic set of components, but where there exist options both 
for the details of these components and for add-on features. 
If it is assumed that all the relief gas flows that are to be 
handled have already been specified then, the authors 
argue, flare design might be taken as an example of this 
type of problem. 

Generally, the first step taken by the expert is to define 
the primitive problem. The understanding that the problem 
originally posed needs to be redefined and the ability to do 
this is an essential feature of his or her expertise. In order 
to do this he or she needs to collect information. In the case 
of a flare system this includes data on gas flows and com¬ 
position. He or she is then able to consider whether alter¬ 
natives to flaring are appropriate. These include, in the 
case of a flare system, total containment, trip systems, 


Table 30.7 Emergency isolation valve location: apparent influence of expert’s rules on the decision to fit emergency 
isolation valves on an olefins plant (Bunn and Lees, 1988) (Courtesy of the Institution of Chemical Engineers) 


Item 

History of leaks 

Fit EIV 

Comment 

1. Furnaces 

- 

Y 

Rule 1(c) apparently. Rule 5 

2. Feed pump 

N 

N 

Influence of counterrule 1(a), 3 

3. Bottoms pump 

Y 

Y 

Rulel(a) and (b), 2,3 

4. Sidestream pump 

N 


Rule 1(a) and (b) and 2 not satisfied, but influence of 
Rules 2 and 4 perhaps 

5. Bottoms pump 

Y 

Y 

Rule 1(a) and (b), 2 

6. Bottoms pump 


N 

Rule 6 

7. Bottoms pump 1 

Y 

N 

Rule 1(a) and (b) but overridden by Rule 6 

2 


N 

(Rule 1(a) and (b) not satisfied) 

8. Reflux pump 

Y 

Y 

Rule 1(a) and (b) 

9. Sidestream pump 

Y 

Y 

Rule 1(a) and (b) 

10. Reflux pump 

N 

Y 

Rule 2 apparently 

11. Cold AI exchanger 

Y 

Y 

Rule 1(a) and (b). In part Rule 5 

12. Process gas compressor 

- 

N 

Rule 7 

13. Compressor 

- 

Y 

Rule 7 but overridden by Rule 4 

14. Compressor 


N 

Rule 7 

15. Bottoms pump 

Y 

N 

Rule 1(a) but overridden by Rule 6. Influence of 
counterrules 2 and 3 perhaps 

16. Reflux pump 

Y 

? 

Meaning of notes not clear. Does 

17. Reflux pump 

- 

? 

valve fitted refer to existing valve? 

18. Converter 

Y 

Y 

Special case 

19. Reflux pump 

- 

N 

(Rule 1(a) and (b) and 2 not satisfied) 

20. Reflux pump 

- 

N 

As (19) 

21. Bottoms pump 

- 

ISP 

As (19) 

22. Reflux pump 

- 

N 

As (19) 


a Borderline. 

Note: Extremes of temperature taken as -30°C < T > 180°C. 
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Table 30.8 Emergency isolation valve location: revised formulation of parameters for the provision of emergency 
isolation on an olefins plant (Bunn and Lees, 1988) (Courtesy of the Institution of Chemical Engineers) 




Attribute 


EIV 



1 

2 

3 

4 

5 

6 

7 

8 


1. Furnaces 

N 

Y 

N 

N 

N 

N 

N 


Y 

2. Feed pump 

N 

N 

Y 

N 

N 

N 

N 


N 

3. Bottoms pump 

Y 

N 

N 

Y 

Y 

N 

N 


Y 

4. Sidestream pump 

N 

N 

Y 

N 

Y 

N 

N 


Y a 

5. Bottoms pump 

Y 

N 

N 

Y 

Y 

N 

N 


Y 

6. Bottoms pump 

N 

N 

N 

N 

N 

Y 

N 


N 

7. Bottoms pump 1 

Y 

N 

N 

Y 

N 

Y 

N 


N 

2 

N 

N 

N 

Y 

N 

N 

N 


N 

8. Reflux pump 

Y 

N 

N 

Y 

N 

N 

N 


Y 

9. Sidestream pump 

Y 

N 

N 

Y 

N 

N 

N 


Y 

10. Reflux pump 

N 

N 

N 

N 

Y 

N 

N 


Y 

11. Cold A1 exchanger 

Y 

N 

N 

Y 

N 

N 

N 


Y 

12. Process gas 

N 

N 

N 

N 

N 

N 

Y 


N 

compressor 

13. Compressor 

N 

N 

N 

N 

N 

N 

Y 

Y 

Y 

14. Compressor 

N 

N 

N 

N 

N 

N 

Y 


N 

15. Bottoms pump 

Y 

N 

N 

N 

N 

Y 

N 


N 

16. Reflux pump 

Y 

N 

N 

N 

N 

N 

N 

N 

(1) 

17. Reflux pump 

Y 

N 

N 

N 

N 

N 

N 

N a 

(1) 

18. Converter 

Y 

N 

N 

N 

N 

N 

N 


Y 

19. Reflux pump 

N 

N 

N 

N 

N 

N 

N 


N 

20. Reflux pump 

N 

N 

N 

N 

N 

N 

N 


N 

21. Bottoms pump 

N 

N 

N 

N 

N 

N 

N 


N 

22. Reflux pump 

N 

N 

N 

N 

N 

N 

N 

- 3 

N 


a Borderline. 
b Attributes: 

1. Does the equipment have a history of leaks? 

2. Is the equipment otherwise likely to leak? 

3. Is the liquid above its autoignition temperature? 

4. Is the liquid being pumped at high temperature? 

5. Is the equipment less likely to leak, but the situation such that if it 

6. Is there an alternative means of stopping the leak? 

7. Is the fluid a gas in a compressor? 

8. Is the fitting of an EIVconvenient for process reasons? 


Table 30.9 Emergency isolation valve location: set of 
rules for the provision of emergency isolation valves on a 
alkenes plant (Bunn and Lees, 1988) (Courtesy of the 
Institution of Chemical Engineers) 


Large hazard 
Yes: fit EIV 
No: leak history 
Yes: fit EIV 

No: otherwise likely to leak 
Yes: fit EIV 

No: pumping at high temperatures 
Yes: alternative means of stopping leak 
No: fit EIV 
Otherwise no EIV 


relief valve venting to atmosphere, unflared vent stacks 
and plant flaring. 

Given that a flare system is still the appropriate solution 
for at least some of the relief flows, the expert has then to 
determine a strategy for the overall system. This may 


i a large quantity will escape (is there a large hazard) ? 


involve controlled blowdown to smooth out peak flows, low 
and high level flares and multiple flares. A particular 
aspect of this strategy is segregation of different gas flows: 
dry from wet gases, normal temperature from low tempera¬ 
ture gases, hydrogen sulfide from other gases, and reactive 
gases from other gases. Only when these various strategic 
decisions have been made does the design of the flare 
system itself begin. Some aspects of the design expertise 
involved in flare system design are outlined inTable 30.10. 

A typical flare system is illustrated in Figure 30.11. The 
basic elements of a flare system are the relief header, the 
knockout drum, the seal drum, the flare stack, the flare tip 
and the pilot light. The design of the flare system itself 
involves: deciding whether to provide various additional 
features; selecting a means of implementing the basic and 
additional features both in terms of equipment and of 
utility fluids such as purge gas and flare tip steam; and a 
determination of the magnitude of some of these features. 
Possible additional features include quench drums, vapor¬ 
izer drums, vapour recovery, molecular seals and flame 
arresters. Some principal features that need to he specified 
quantitatively include knockout drum size, flare stack 
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Table 30.10 Design of flare systems: some aspects of Legislation 
Glare the design expertise involved (Bunn and Lees, 1988) 

(Courtesy of the Institution of Chemical Engineers) 


General area 


Gas flows requiring 
disposal 

Gas compositions 
requiring disposal 


Alternatives to flaring 


System options 


Segregation 


Flare system, 
basic elements 


Flare system, 
additional elements 

Purge gas 
Hazards 

Air hazard 
Water hazard 
Extreme cold 

Other problems 


Specific element or topic 

Normal flows 

Emergency flows 

Hydrocarbons 

Hydrogen 

Hydrogen sulfide 

Steam 

Air 

Total containment 
Trip systems 
Relief valve venting to 
atmosphere (air, 
steam, cold gases) 
Unflared vent stacks 
Plant specific flaring 
Multiple flare systems 
Dry gas vs wet gas 
High vs low level flares 
Controlled blowdown 
Dry gas vs wet gas 
High or low 
temperature gases 
Hydrogen sulfide 
Reactive materials 
Relief header 
Knockout drum 
Seal drum 
Flare stack 
Flare tip 
Pilot light 
Quench drum 
Vaporizer drum 
Vapour recovery 
Flame arresters 
Molecular seals 
Fuel gas 
Nitrogen 
Blockage 
Explosion 
Heat radiation 
Toxic gases 
Liquid carryover 
Sources 
Effects 
Sources 
Effects 

High melting point 
hydrocarbons 
Steam injection 
Ignition failure 
Smoke 
Pollution 
Glare 
Noise 

Land sterilization 


Standards, codes 

Knockout drum design 
Flare stack design 

Flare tip design 
Design models 

Evaluation criteria 

Economics 

Optimization 

Project control 
Materials of construction 

Mechanical construction 

Explosion prevention 

Process control 

Start-up 

Shut-down 

Turn-down 

Emergency conditions 
Plant operation 

Plant maintenance 
Plant extensions 
Plant modifications 


Pollution contorl 

Smoke 

Noise 

Plant layout codes 
BS CP 3013:1974 
APIRP 520 
APIRP 5211969 


Diameter 

Height 

Steam 

Low pressure air 
Coanda flares 
Flame dimensions 
Heat radiation 
Buoyant plume (ground 
level concentrations) 
Heat radiation levels 
Smoke levels 
Noise levels 
Relief header costs 
Flare stack costs 
Other equipment costs 
Purge gas costs 
Land sterilization 
Capital vs operating costs 
Land sterilization 
Controlled blowdown 
Purge gas costs 
Long lead items 
Corrosion 
Brittle fracture 
Welded joints 
Header valves 
Insulation, steam tracing 
Inert gas flow 
Inert gas conservation, 
molecular seals 
Oxygen monitoring 
Flashback prevention, 
flame arresters 
Controlled blowdown 
Manual vs automatic 
control of flare quality 
Initial purge with inert gas 
High gas flows 
Air diffusion 
Low gas flows 
High gas flows 


Operating instructions 
Emergency action 
(to reduce flows) 
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Figure 30.11 A typical basic flare system (Bunn and Lees, 1988) (Courtesy of the Institution of Chemical Engineers) 


diameter and height, flare tip dimensions, purge gas flow 
and flare tip steam flow. As Table 30.10 indicates, there are 
many further aspects that must also be taken into account. 

Nevertheless, in the case of a flare system the basic 
structure of the design appears relatively straightforward. 
The design can apparently be decomposed into a set of 
subdesigns that have only weak interaction. The design 
may proceed in a series of sequential stages, using rules 
appropriate to each stage, and with only a modest degree of 
iteration. 

Bunn and Lees list a number of rules obtained from the 
literature, from standards and codes and from expert 
sources, which are used in flare system design. They clas¬ 
sify these rules as follows: 

Alternative (A) An alternative option is offered. 
Requirement (R) A requirement to take a particular 
course of action, add a particular fea¬ 
ture or achieve a particular result. 
Permission (Pe) A permission to take a particular course 

of action or add or omit a particular 
feature. 

Prohibition (Pr) A prohibition on taking a particular 
course of action or adding a particular 
feature. 

Design (D) A rule of thumb giving guidance on 
some particular aspect, usually a 
design criterion. 

A prohibition is essentially a negative requirement. 

The derivation and use of the rules revealed several 
problems, which were not unexpected. One is that the 
abstraction of rules from the literature is liable to give rules 
that are contradictory or out of date. Another is that some 
rules are stronger than others and a means needs to be found 
to incorporate this factor. Similarly, some rules are subj ect to 
exceptions and this also needs to be taken into account. 


The authors identify the following types of expertise: 
being involved in flare system design: 


(1) knowledge of the initial data to be collected; 

(2) knowledge of the ways in which the primitive problem 
may be reformulated; 

(3) knowledge of the alternatives to the use of a flare 
system and of criteria for their selection; 

(4) knowledge of options for modification of the flare load 
to be accepted; 

(5) knowledgeofthebasicconfigurationsofflaresystems; 

(6) knowledge of the options for additional features and 
criteria for their selection; 

(7) knowledge of the models available for the design of 
particular features and of the regimes in which they 
apply; 

(8) knowledge of the constraints associated with regu¬ 
latory controls, standards and codes, and so on. 


The authors refer to the creation of a simple research 
expert system for elementary flare system design incor¬ 
porating a rule-based production system. The program 
described uses forward-chaining and the principal conflict 
resolution methods are context limitation and specificity 
ordering. 

Although the flare design problem is classed by the 
authors as one with shallow structure, this emphatically 
does not mean that it is straightforward. The classification 
refers solely to the structure of the problem and the 
decomposition required to solve it. In fact, the design rules 
used by an expert may well be very sophisticated.The point 
is that the expertise resides in these other rules rather than 
in rules, or strategies, for decomposition subdesigns which 
have only weak interaction. The design may proceed in a 
series of sequential stages, using rules appropriate to each 
stage, and with only a modest degree of iteration. 
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30.33.5 Designs with deeper structure: pressure 
relief system 

Bunn and Lees’ third problem is the design of a pressure 
relief system. This problem they take as representative of 
a class of design synthesis problems with relatively deep 
structure. 

The situations that are considered for pressure relief are 
operational relief, both normal and abnormal, and fire 
relief. A relief survey is made based on the piping and 
instrument diagram. The system is decomposed into sub¬ 
systems. The decomposition is done on the basis of what is 
manageable. Typically a subsystem is a functional unit, 
such as a distillation unit, with up to half a dozen vessels. 
Another principle which is used is that of pressure breaks, 
the section of plant between two such breaks being for 
practical purposes at a uniform pressure level. 

A review is made for operational relief of the over¬ 
pressure sources and load to be relieved. This covers: utility 
failures, where use is made of standard cases; open inlets 
and closed outlets; heat inputs; cooling loss; operating 
excursions; and equipment failures. For fire, a finer sub¬ 
division may be used, with a separate consideration of each 
vessel. Again use is made of standard cases. 

Selection is made of the relief sinks, which may he 
another part of the plant, the atmosphere, the relief header, 
or another closed system. The capacities and set pressures 
of the pressure relief valves may then be determined and 
the pressure relief valves selected. 

The foregoing is the barest outline of the design process 
for pressure relief. It is summarized in Table 30.11. 


Table 30.11 Design of pressure relief systems: 
outline strategy of system design (Bunn and Lees, 1988) 
(Courtesy of the Institution of Chemical Engineers) 


Decompose pressure system 
Select subsystems 

(Default assumption: each main vessel is a subsystem) 
Identify pressure breaks 
Locate pressure reliefs 

(Default assumption: pressure relief is located on 
each main vessel) 

Identify relief loads on each main vessel 
Utility failure (including control loop failures) 

Open inlet (connection to high pressure source) 

Closed outlet (disconnection to low pressure sink) 

Heat input 
Cooling loss 
Operating excursions 

Equipment failures (especially valves: NRVs, EIVs) 

Fire 

Quantify relief loads on each main vessel 
Utility failure standard cases 
Fire standard cases 
Select relief sink 
Other part of plant 
Flare header 
Other closed system 
Atmosphere 

Determine set pressure of RVs 
Determine capacity of RVs 
Select type of RVs 

EFV emergency isolationvalve; NRV non-return valve; RV return valve. 


Some of the topics that may be considered in the review 
of overpressure sources and loads are listed in Table 30.12. 
Some of the additional topics that also need consideration 
are listed in Table 30.13. 

The design of pressure relief systems appears therefore 
to involve appreciable expertise in the selection of a design 
strategy. There is, in principle, a significant initial decom¬ 
position to be performed. Knowledge is required of the 
range of overpressure sources that need to be reviewed. 
Some of these are effectively stereotype situations. A cred¬ 
ible worst case has to be selected. In making this selection, 
both for utility failure and for fire, use is made of standard 
cases to prevent the design worst case being too pessimis¬ 
tic. There is a whole range of design alternatives to be con¬ 
sidered and of special situations to be taken into account. 

A common strategy for handling problems with deeper 
structure is to apply a small number of additional rules that 
simplify the decomposition. In the case of pressure relief 
system design one such rule is to provide each vessel with a 
pressure relief valve. 

30.33.6 Designs with deeper structure: valve sequencing 

The final problem in design synthesis considered by Bunn 
and Lees is that of valve sequencing. This problem is taken 
as being representative of a class of design synthesis prob¬ 
lems that are characterized by the features that there is a 
complex problem-solving task, but that this task requires 
little expertise or common sense knowledge. 

The generation of an operating sequence for a set of valves, 
subject to certain constraints, is very similar to the problem¬ 
solving and game-playing tasks commonly addressed in AI. 
It involves a search to satisfy goals. The knowledge that has to 
be provided to obtain a solution is, however, relatively limited. 

These features imply another characteristic of this type 
of problem. There tends not to be a recognized expertise. 
There is provided as part of the design a network of valves 
that need to be opened and shut in order to operate the 
plant. An engineer is assigned the task of specifying the 
operating sequence, but this assignment is unlikely to 
be made on the basis of a recognized expertise comparable 
with, say, expertise in flare system design. 

Bunn and Lees instance here the work of Rudd and 
co-workers on the synthesis and analysis of valve seq¬ 
uences. This study is described in Section 30.43 along with 
other work on the synthesis of operating sequences. This 
example completes the overview of some characteristic 
design synthesis problems. The remainder of this section 
describes some of the design aids that have been developed. 

30.33.7 AI applications 

Turning now from the structure of plant design synthesis 
problems to applications of AI to such synthesis, an account 
of AI applications that deals particularly with plant 
synthesis and analysis as well as process synthesis is given 
by Mutton, Ponton and Waters (1990). 

At present most such applications appear to be in the area 
of expert systems. Some of these are considered in Section 
30.35. However, the current consensus appears to be that 
the most promising methods are those that are based on 
process modelling of the sort described in Section 30.30. 

30.33.8 Incremental design and safety constraints 

A development of some interest is the concept of incre¬ 
mental design as applied to safety. In conventional plant 
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Table 30.12 Design of pressure relief systems: some 
aspects of overpressure sources and loads (Bunn and 
Lees, 1988) (Courtesy of the Institution of Chemical 
Engineers) 


Overpressure sources 

API RP 521 
(page no.) 

1. Extraneous components: 


Water in hot oil 

9 

Light hydrocarbon in hot oil 

9 

Light components in distillation fluids 

7 

2. Chemical reactions: 


Combustion 

11 

Reaction runaway 

12 

3. High pressure (HP) source: 


HP process fluids 

4 

HP utilities 

4 

Pressure raisers 


Pumps 


Compressors 


Heat exchanger HP side 

5.15 

4. System isolation: 


Systems with closed outlet 

4,7 

Shut-in systems (see thermal 


expansion below) 


5. Heat input: 


Burners 


Steam 

5 

Heat transfer fluid 


Atmosphere 


6. Cooling loss: 


Water cooling 


Cooling water failure 

8 

Flooding 

8 

Inerts accumulation 

8 

Air cooling 


Fan failure 

8 

Louvres failure 

8 

Heat transfer fluid 


Reflux cooling 


Reflux pump failure 

8 

Subcooled feed 


7. Thermal expansion (shut-in systems): 


Fluid at ambient temperature 

12 

Fluid below ambient temperature 

12 

Fluid below temperature of another 

12 

process fluid 


8. Pressure transients: 


Water hammer (incompressible fluid) 

6 

Steam hammer 

6 

9. Fire 

6,13 

Relief loads 

Single failure principle 


Control loop effects 


Capacity credit 


Utility failure standard cases 


Fire standard cases 



Table 30.13 Design of pressure relief systems: some 
additional topics to be considered (Bunn and Lees, 1988) 
(Courtesy of the Institution of Chemical Engineers) 


A list of areas of expertise, by no means complete, is: 
Legal and standards requirements 
Alternatives to or mitigation of PR: 

Pressure containment 
Pressure limiting instrumentation 
Mitigation of fire PR: 

Fireproofing 
Water drench 
Ground slope 

Pressure limiting instrumentation: 

Alternative to PR 
Mitigation of PR 
Reduction of flow 
Reduction of frequency 
Standard applications 
Economics of alternative solutions 
Overpressure scenarios: 

Utility failure standard cases 
Fire standard cases 
Unit operations and equipment: 

Furnaces 

Distillation columns 

Shell and tube heat exchangers 

Air cooled heat exchangers 

Centrifugal pumps 

Pressure storage 

Steam systems 

Pipelines 

Selection of disposal systems: 

Other parts of plant 
Flare system 

Other closed system (e.g. absorber) 
Atmosphere 
Atmosphere disposal: 

Disposal criteria 
Safe disposal 
PRV design and location 
Flare disposal: 

Segregation of materials 
Materials of construction 
Minimum venting pressure: 

Flare header 
Atmosphere 

Depressurizing arrangements 
Special conditions: 

Corrosive fluids 
Cold fluids 

Fluids containing hydrogen sulfide 
Stepped relief settings 
Selection of PRVs 
Thermal relief 
Hammerblow prevention 
Vacuum relief 


PR, pressure relief; PRV pressure relief valve. 

design, the designers proceed with the design, adhering to 
good design practice, and the design is subjected to safety 
reviews at prescribed stages. An alternative approach, 
which emphasizes the application of the safety constraints 
in an incremental way, has been championed by Ponton 
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and co-workers. The application of this philosophy has 
been described in respect of the safety constraints on 
design by Waters, Chung and Ponton (1989) and Waters and 
Ponton (1992) and in respect of hazard studies by Black and 
Ponton (1992). 

30.33.9 DSPL 

Another development is the application of methods devel¬ 
oped for equipment design to the design of process plant. 
An account was given in Section 30.27 of the expert system 
building tool DSPL. This has been used mainly for mech¬ 
anical design, but in the process field DSPL has been used 
by Myers, Davis and Herman (1988) to create an expert 
system for the design of sieve plate distillation columns. 

30.34 Plant Design: Analysis 

The synthesis of plant designs is complemented by their 
analysis. The analysis constitutes the test element in the 
overall generate-and-test activity. There now exist a large 
number of computer programs for the analysis of various 
aspects of plant design. One category is those programs 
that compute an index and perform a ranking of the 
hazards of the plant. Another category is those which assist 
with hazard assessment. Computer aids of this sort 
have been described in Chapter 29. There are now begin¬ 
ning to appear aids for design analysis that have an AI 
flavour. 

30.34.1 Inherently safer design 

Although aids for the synthesis of inherently safer design 
are not well developed, some work has been done in ana¬ 
lysing of plant designs to check the extent to which they 
conform to this principle. A program of this nature has 
been developed by Journet (1993). The process is treated as 
an object or frame and the features of the process and the 
plant are developed as a hierarchy. Early branches in the 
hierarchy are the chemical route, the design information, 
the process streams, the plant units, the nomenclature and 
the decisions. The treatment is informed by the concepts of 
elimination, substitution, intensification and attenuation. 
The program identifies the features with implications for 
an inherently safer design. 

30.34.2 Fault propagation 

A number of aids to plant analysis have been described 
which are based on the qualitative modelling of the propa¬ 
gation of faults through the plant. Fault propagation mod¬ 
elling is therefore a basic enabling technology. It is 
described in Section 30.36. 

30.34.3 Hazard identification 

One aspect of plant analysis that has attracted much inter¬ 
est is the creation of an aid to hazard identification that 
would produce information similar to that yielded by a 
hazop study. Developments in this area are described in 
Sections 30.37—30.39. 

30.34.4 Fault tree analysis 

Another aspect of plant analysis that has attracted a num¬ 
ber of workers is the development of an aid for the synthesis 
of fault trees. Programs have been available for some years 
for the analysis of fault trees, but the construction of the 
fault tree is still done manually. Developments in this area 
are described in Sections 30.41 and 30.42. 


30.35 Expert Systems: Some Process Systems 

Expert systems were introduced in the process industries 
in the mid-1980s and are in widespread use. The typical 
expert system in the process industries is much more 
modest than the classic expert systems described in the 
previous section. Most have been created using shells. 
An appreciable proportion have been developed by a single 
engineer acting as the expert. The development time has 
generally been of the order of months rather than years. 

Some principal applications are: (1) physical, chemical 
and thermodynamic properties; (2) selection of equipment, 
materials of construction, and processes and plants; 
(3) design of processes and plants; (4) process control; 
(5) process monitoring and (6) fault administration. The 
first four of these are considered in this section and the last 
two in Sections 30.44 and 30.45. 

The bulk of these applications is to the handling of fault 
conditions, either on an individual item of equipment or on 
a process plant. Before considering these different appli¬ 
cation areas, it is of interest to consider a statistical profile 
of process industry applications. 

30.35.1 Statistical profile 

A survey of expert system applications in the process 
industries has been described by Sangiovanni and Romans 
(1987). 

These authors found about 200 applications in some 30 
companies. They classified these applications as (1) selec¬ 
tion, (2) design, (3) planning and scheduling, (4) control, 
(5) situation analysis, (6) diagnosis, (7) prediction, (8) pre¬ 
scription and (9) instruction. They define: situation analy¬ 
sis as monitoring available data and information and 
inferring the system’s state; diagnosis as inferring the 
cause of a malfunction or deviation; prediction as inferring 
the likely consequences of an action or set of actions; and 
prescription as recommending cures for a system mal¬ 
function or deviation. 

Of these functions, selection accounted for some 15%. 
Situation analysis accounted for some 8%, diagnosis for 
33%, prediction for 10% and prescription for 21%. Thus 
one-third of the applications were for diagnosis and the 
group of four functions related to fault administration 
(situation analysis, diagnosis, prediction and prescription) 
accounted between them for 66%. Only about 2% of 
applications were to design. 

Of these expert systems, 30% had been developed by 
engineers, 29% by a team without the vendor, 29% by a 
team with the vendor and 12 % by an internal AI group. The 
development time was <3 months for 30 % 3-12 months for 
40% and >12 months for 27%. 

Some two-thirds of the systems were in daily use, 
including cases where the system was used by different 
people at a number of locations. Some 90% of applications 
made use of an expert system shell. Over 60% were imple¬ 
mented on a PC. The dominant contributor to software 
costs was maintenance of the software, at some 67%, com¬ 
pared with design and coding and with testing and debug¬ 
ging, which each accounted for about 13%. 

30.35.2 Physical, chemical and thermodynamic properties 

An expert system for physical properties has been de¬ 
scribed by Banares-Alcantara, Westerberg and Rychener 
(1985). This system, CONPHYDE, uses the framework of 
PROSPECTOR and is described as a prototype. It has been 
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applied to the selection of vapour-liquid equilibrium 
properties. 

Gani (1989) has described an expert system for the selec¬ 
tion of models of physical properties and phase equilibria. 

30.35.3 Selection of equipment 

An application of expert systems that has found rapid accept¬ 
ance in the process industries is equipment selection. Many 
such applications utilize an induction tool that is provided by 
an expert with a learning set of examples, and induces the 
rules that the expert has evidently used in the solutions. This 
type of tool allows the expert to create his own system, and 
many experts have taken advantage of this. Equipment 
selection applications are not, however, confined to the use of 
induction tools. In other cases use has been made of shells. 

An expert system for control valve selection has been 
described by Royse (1988). ICI has developed an expert 
system SYSLAG for the selection of thermal insulation 
(R.A. King, 1986). 

30.35.4 Selection of materials of construction 

The selection of materials of construction has been an 
active area of application. Accounts have been given by 
Baker-Counsell (1985b), Basden and Mines (1986) and 
R.A. King (1986). 

An expert system for general corrosion has been devel¬ 
oped by the National Association of Corrosion Engineers 
(NACE) and the National Bureau of Standards (NBS). 
Another such system, Achilles, has been created at Harwell. 
These systems are outlined by R.A. King (1986). 

The Achilles system advises on the selection of mild steel 
and stainless steel for pipes, vessels and bolt assemblies. It 
exploits the use of graphics to illustrate the system under 
consideration and to highlight potential corrosion problems. 

Expert systems used at ICI are outlined by Berkovitch 
and Baker-Counsell (1985). One of these is SCC for stress 
corrosion cracking. Another is AUSCOR for the selection 
and corrosion properties of stainless steels. 

30.35.5 Selection of process and plant 

There are also a number of expert systems for the selection 
of a process or plant, or an ancillary feature. 

Lahdenpera, Korhonen and Nystrom (1989) have de¬ 
scribed an expert system for the selection of solid-liquid 
separation equipment. An expert system, DECADE, for 
catalyst selection has been created by Banares-Alcantara, 
Westerberg etal. (1987) and Banares-Alcantara, Ko etal. (1988). 

30.35.6 Design of process and plant 

Process synthesis and plant design, including high level 
expert system approaches, are considered in Sections 
30.32—30.34. In general, design is a difficult application 
and there are relatively few examples of expert systems in 
design, as opposed to selection. 

An expert system for the design of heat exchanger net¬ 
works has been described by B. Chen etal. (1989).This is an 
area of design where a well-structured approach has been 
developed so that the difficulties of creating an expert 
system are less severe. 

Accounts of an expert system for the design of dust 
explosion relief systems have been given by Santon et aL 
(1991) and Santon (1992). Another expert system, DUS- 
TEXPERT, for the assessment of dust explosion hazards 
has been described by von Haefen (1992). 


30.35.7 Process control 

Most applications of expert systems on process plants 
involve some form of process monitoring and/or fault 
administration rather than process control as such. 

Work on the development of expert systems for the 
synthesis of control systems has been described by Birky, 
McAvoy and Modarres (1988) and Birky and McAvoy (1990). 

The LINKMan expert system developed by the Scientific 
Instrument Research Association (SIRA) and the Blue 
Circle cement company has been used for control of equip¬ 
ment on the latter’s plants. Accounts have been given by 
M. Henry (1985), Durham (1985f) and Tayler (1987b). 
Applications have included the control of a ball mill and of a 
cement kiln. The program uses rules for process control 
based on natural language and fuzzy logic. 

The RESCU project (Shorter, 1985; Coulsey, 1986) 
involves the use of an expert system for the quality control 
of an ethoxylate plant in ICI. The system detects control 
variations and upsets, and recommends actions. One out¬ 
come of this project has been the development of the 
knowledge representation language KRL. 

A follow-up to this work is the COGSYS system (Anon., 
1988n). 

PICON is an expert system with capabilities both in pro¬ 
cess control and also in fault administration. Accounts have 
been given by R.L Moore (1985) and F. Kane (1986). Since the 
first applications have evidently involved fault adminis¬ 
tration, discussion of PICON is deferred to Section 30.45. 

30.35.8 Other applications 

Expert systems are in use in the process industries for 
a variety of other purposes. Reviews of applications 
and potential applications are given by M. Henry (1985), 
Coulsey (1986) and Barnwell and Ertl (1987). 

The SYNICS system (Coulsey, 1986), which is described 
as not so much an expert system as a ‘working textbook’, 
containing both graphics and mathematics, is used both for 
problem-solving and browsing. Applications have included 
powder formulations. 

The Honeywell MENTOR expert system (Sangiovanni 
and Romans, 1987) is used in the field by technicians 
servicing refrigeration systems. 

30.36 Fault Propagation 

Many of the methods used to identify and assess hazards at 
the design stage such as hazard and operability studies, 
failure modes and effects analysis, fault trees and event 
trees, involve tracing the paths by which faults propagate 
through the plant. Fault propagation is thus a common 
feature of these techniques. Fault propagation is also 
a feature of methods for the diagnosis of alarms in the real¬ 
time computer control of processes. 

Fault propagation is therefore a generic feature of work 
in this field. It follows that the computer aids for many of 
these methods may, in principle, draw on a methodology 
that is to some extent common. This concept has been 
elaborated byAndow, Lees and Murphy (1980). 

In the following sections computer aids are described for 
hazard identification, fault tree synthesis and analysis, 
and alarm diagnosis. Included in this account are some aids 
developed by Lees and co-workers which explicitly draw on 
a common methodology (Andow and Lees, 1975; B.E. Kelly 
and Lees, 1986a-d; Parmar andLees, 1987a,b; A. Hunt etal. 
(1993a-e). Some features of the fault propagation method¬ 
ology used in this work are now described. 
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30.36.1 Fault propagation 

The propagation of a fault through a plant may be repre¬ 
sented in terms of the initiation of a fault in a unit that is 
unhealthy, the passage of the faults through units that are 
otherwise healthy and the termination of the fault in a unit 
that is thereby rendered unhealthy. A unit may be modelled 
using a number of representations. Those considered here 
are: (1) functional, or propagation, equations; (2) event 
statements and (3) decision tables. 

The propagation equations describe the propagation of 
faults through a healthy unit, while the event statements 
describe the initiation of a fault in an unhealthy unit or the 
termination of a fault in a unit that thus becomes unhealthy. 

A propagation equation is a functional equation that 
describes the relation between an output parameter of a 
unit and the input and other output parameters. A typical 
propagation equation is 

L=f(Q 1 ,-Q 2 ) [30.36.1] 

which signifies that the level L increases if the inlet flow ft 
increases or the outlet flow Q 2 decreases, and vice versa. 

30.36.2 Fault initiation and termination 

The propagation equations describe how a fault propagates 
but not how it is initiated or terminated.This information is 
provided by event statements. An initial event statement 
takes the form 

Initial fault: parameter deviation 

The initial faults are usually mechanical failures. A termi¬ 
nal event statement takes the form 

Parameter deviation: terminal event 

The terminal events are usually undesired events or 
hazards. Atypical initial event statement is 

F PART-BLK: ft LO [30.36.2] 

which signifies that outlet flow Q 2 is low if there is a partial 
blockage. The letter F denotes a failure event. A typical 
terminal event statement is 

P 2 HI: OVERPRES [30.36.3] 

which signifies that if the pressure P 2 is high, there is 
overpressure of the unit. 

The third form is a decision table. A typical decision 
table is 

V ft REV V ft HI T ft HI [30.36.4] 

This relation refers to conditions in reverse flow, {/being 
the temperature in reverse flow and subscripts 1 and 2 
denote the inlet and outlet ports under normal flow condi¬ 
tions, respectively. The relation signifies that the outlet 
temperature ft is high if there is reverse flow Q 2 and 
the inlet temperature ft is high. The lettersTand Vdenote 
the top event of a mini-fault tree and a process variable, 
respectively. 

30.36.3 Flow propagation 

In fault propagation modelling it is necessary to have 
a suitable method of modelling flow propagation. There 
are several features that need to be allowed for. One is that 


the representation should model correctly the two-way 
propagation of a fault. Thus, for example, if a valve is shut, 
a disturbance travels from it not only downstream but also 
upstream. The method for flow deviations should be com¬ 
patible with that used for pressure deviations. A flow model 
that is based on pressure differences can run into difficulty 
because in some applications the deviations of pressure are 
not sufficiently well defined to use differences between 
them to determine flow. A third requirement in some cases 
is that the flow propagation should be able to handle a large 
leak from a component such that continuity of flow through 
that component is not maintained. 

In cases where this latter aspect does not need to be taken 
into account, flow is often modelled by the simple relation 

Qi =/(ft) [30.36.5] 

For the case where a large internal leak needs to be 
allowed for, Kelly and Lees (1986a) have modelled flow 
propagation using, by convention, the following pair of 
relations: 

Qi = /(ft,ft) [30.36.6] 

ft =/(ft, ft) [30.36.7] 

where G is the pressure gradient, and Q is the flow and 
subscripts 1 and 2 denote the inlet and outlet ports, 
respectively. Here the pressure gradient G is essentially a 
surrogate for flow. 

30.36.4 Model representation 

Fault propagation models may be represented in various 
ways, which may well be equivalent. 

Lees and co-workers (B.E. Kelly and Lees, 1986c,d; 
Parmar and Lees, 1987a,b) have represented their models 
initially in terms of propagation equations, event state¬ 
ments and decision tables. They have utilized a proforma 
that contains slots for a description of the unit and for these 
relationships. An example of such a proforma is given in the 
next section. 

Most workers, however, have used the digraph representa¬ 
tion. An account of digraphs has been given in Section 30.23. 

The two representations, are in principle, equivalent. In 
digraph terms, the propagation equations yield those nodes 
in the digraph that represent deviations of the process 
variables and the initial event statements those nodes that 
represent failures. 

The essential requirements for a model format are that 

(1) the modelling process be straightforward, so that it can 
be applied by practising engineers as well as research 
workers, with as little effort and error as possible, and that 

(2) it support the automation of model creation using model 
archetypes. 

30.36.5 Model library 

Models already created are stored in a model library. 
An essential feature of such a library is a taxonomy that 
helps the user to distinguish between different models and 
to identify those required or, alternatively, to confirm that 
some are not available in the library. The library needs to be 
governed by a discipline which ensures that appropriate 
information is provided about each model, such as the 
person creating it and the extent of its use, and that an 
incorrect model is not entered. 
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30.36.6 Model generation 

Generally the user will find that some models are not in the 
library and need to be generated. In this case it is necessary 
to configure the models and enter them into the library. 
Since this is liable to be the main and most difficult input 
that the user has to provide, it is highly desirable that the 
process of model generation be kept as simple as possible. 

The rules governing the manual generation of models 
should be formulated explicitly and documented. 

In many cases the new model to be created differs only 
slightly from an existing one. There is therefore scope for 
the use of model archetypes and templates and for core 
models or model sections. This applies particularly to ves¬ 
sels. It is often the case that the model library already con¬ 
tains the models required for common items such as pipes, 
fittings, pumps, etc., and for instrumentation, but that 
there are certain vessels that need to be modelled. There is 
therefore scope for the provision of vessel archetypes and 
templates. Of particular significance here are ports on 
vessels and other units. Although there are a considerable 
number of different types of port, a given type tends to 
recur. It is useful therefore provide a taxonomy of ports and 
a guide to their selection. 

Core model elements may be provided for common types 
of unit such as heat exchangers and reactors. 

30.36.7 Ambiguities and loops 

Fault propagation deals with the deviations of process 
parameters but the degree of deviation is not fully defined. 
In consequence, ambiguities arise. A particular disturbance 
may apparently give rise to a number of possible alternative 
responses or interpretations. The problems caused by ambi¬ 
guities have been discussed by Waters and Ponton (1989). 

These ambiguities may arise when faults are being pro¬ 
pagated forward from an event, as in an event tree, or 
backward from an event, as in a fault tree. In either case 
rules are required for the resolution of the ambiguities. 
Unresolved parameters also occur due to the presence of 
loops and recycles. Some of the options for resolution are 
discussed by Waters and Ponton. 

One approach to such resolution is to introduce addi¬ 
tional constraints. Work on these lines for digraphs has 
been described by P. Rose and Kramer (1991), and devel¬ 
oped further by Fanti, Chung and Rushton (1993). The 
digraph representing a process flow structure usually con¬ 
tains loops, there is more than one path that can be traced 
between nodes and, since the paths may have opposing 
influences, ambiguities arise. The approach taken by Fanti, 
Chung and Rushton is the use of high level constraints 
such as a mass balance. They illustrate their method using 
the recycle tank system of P. Rose and Kramer shown in 
Figure 30.12, which also gives the corresponding digraph. 
Their results for this problem are shown in Table 30.14. 
Section A of the table shows the possible responses of the 
variables flow FI—F4, level L1-L2 and pressure P3 to 
changes in valve resistance R3 and R4. Five interpretations 
are identified. Section B of the table shows the resolution of 
these ambiguities using high level constraints. 

Another approach is the use of heuristics. An example is 
furnished by the work of A. Hunt et al. (1993e) on fault tree 
synthesis. A configuration that is liable to give rise to such 
inconsistencies is a unit with more than two ports. Incon¬ 
sistencies arise from looping around the unit. In this case 
use is made of the rule that in the development of the tree 
at a particular unit only one change of port is allowed. 


Although ambiguities and loops undoubtedly present 
problems and merit further work, they do not appear to 
have proved a serious hindrance to the development of fault 
propagation tools for tasks such as hazard identification or 
fault tree synthesis. 

30.36.8 Structure identification 

Another problem that arises in modelling for fault propa¬ 
gation is that of identifying structural features in the flow 
diagram. The structural feature in question may be: a 
recycle flow; a control loop and the streams affected by its 
action; a trip loop and the streams affected by its action, 
whether it be a loop with an open or a closed trip valve; or a 
divider-header combination, where the divider and the 
header may be separated by a number of intermediate 
units, and where there may be a number of dividers and 
headers nested or staggered. 

Some types of structural information are readily provided 
by the user, and in this case this may be the appropriate 
course. In other cases it is not easy for the user to identify the 
structure, but it is feasible to devise an algorithm to identify 
it, in which case this may be the best approach. 

In any event, the identification of structure is a generic 
problem. Approaches to the problem have been described 
in a number of different areas for example heat exchanger 
networks (Pethe, Singh and Knopf, 1989); and fault tree 
synthesis (A. Hunt et al., 1993a-e). 

30.36.9 Alternative representations 

As already indicated, fault propagation relations may be 
represented in a number of different ways. To some extent at 
least it is possible to map between them. An account of 
alternative representations and of mapping has been given 
by Aldersey, Lees and Rushton (1991). 

Some forms of representation available include (1) func¬ 
tional equations, (2) program rules, (3) digraphs, (4) block 
diagrams, (5) logical expressions, (6) truth tables, (7) cut 
sets, (8) fault trees and (9) event trees. 

Figure 30.13 shows a heat exchanger system together 
with representations of the system in the nine forms just 
listed. The heat exchanger is a cooler in which a hot process 
fluid is cooled by cooling water. The cooling water is itself 
cooled by a chiller prior to entering the main cooler. 

Of the three graphical forms, the digraph contains the 
most information. For a particular event, a fault tree or an 
event tree may be obtained from the digraph, but with loss 
of information. 

A common method of constructing a fault tree is to start 
with a digraph and to obtain the required fault tree from it. 
Accounts of this approach have been given by Lapp and 
Powers (1977a,b), Lambert (1979) and Andrews and Morgan 
(1986). 

Mapping between fault trees and event trees, and vice 
versa, has been described by Aldersey, Lees and Rushton 
(1991). 

There are now a considerable number of mathematical 
models of process plant and it may be desired to derive a 
qualitative model from an existing quantitative model. 

A method of doing this was developed by Andow (1973) 
in his work on modelling for alarm diagnosis. Consider the 
relationship 

RHS = A + B * ((C + D/E) - F) f G [30.36.8] 

6 5 2 1 3 4 
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F0 F3 




Figure 30.12 A recycle tank system (Fanti, Chung and Rushton, 1993: after P. Rose and Kramer, 1991) 
(Courtesy of the Institution of Chemical Engineers) 


where RHS represents the right-hand side of an equation 
and the numbers show the order of evaluation following 
the normal rules of algebra. It can be seen that evaluation 
does not occur in the order in which the operators are 
discovered. Converted to Reverse Polish Notation, the rela¬ 
tion becomes 

RHS = ABCDE / +F—Gf*+ [30.36.9] 

12 3 456 

The operators are now in the correct order, whilst the 
operands remain in their original order. 


This use of this technique to reduce quantitative models 
to qualitative ones is described by Andow, who gives full 
details of the transformation. 

30.36.10 Generic modelling 

Fault propagation modelling may be used to support a range 
of safety-related techniques such as hazard identification, 
fault tree synthesis, operating procedure synthesis and 
alarm diagnosis. There is clearly an advantage to be gained 
by formulating a type of generic model that supports all 
these methodologies and others. On the other hand, the 
development of a particular technique should not be unduly 
constrained by the requirement for commonality. This 
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Table 30.14 Response of recycle tank system (after Fanti, Chung and Rushton, 1993) (Courtesy of the Institution of 
Chemical Engineers) 

A Initial candidate responses 

Disturbance 




Responses 





LI 

FI 

L2 

F2 

P3 

F3 

F4 

R3 + 

- 

- 

_ 

- 

_ 

- 

_ 

Candidate R3A 


- 

- 

- 

- 

0 

- 

0 

Candidate R3B 


- 

— 

+ 

— 

+ 

— 

+ 

Candidate R3C 


- 

- 

0 

- 

+ 

- 

+- 

Candidate R3D 


- 

- 


- 

+ 

- 

+ 

Candidate R3E 

R4 + 

4- 

+ 

■ 

+ 

+ 

+ 

+ 

Candidate R4A 


+ 

+ 

+ 

+ 

+ 

+ 

0 

Candidate R4B 


+ 

+ 

+ 

+ 

+ 

+ 

- 

Candidate R4C 

B Responses after resolution 

Disturbance 




Responses 






Ll 

FI 

L2 

F2 

P3 

F3 

F4 


R3 + 

- 

- 

- 

- 

0 

- 

0 

Candidate R3B 

R4 + 


+ 

+■ 

+ 

+ 

+ 

0 

Candidate R4B 


The supporting argument is as follows. Disturbances R3 + and R4 + each leave FO unchanged, FO = 0. Overall mass balance requires F4 = F0. 
Hence candidate responses R3A, R3C, R3D and R3E and responses R4A and R4C are eliminated. 


is illustrated in the work of Lees, Rushton, Chung and 
co-workers. The models used in early development of par¬ 
ticular techniques differed slightly, but a considerable 
commonality was retained which is built on in the later work. 

30.36.11 QUEEN 

A code QUEEN, designed to provide a front-end for fault 
propagation modelling in activities such as hazard identi¬ 
fication, fault tree synthesis, operating procedure synthesis 
and alarm diagnosis has been described by Chung (1993). 

30.37 Hazard Identification 

In addition to computer aiding of process synthesis and 
plant design in general, there are a number of types of aid 
that specifically address hazard and safety issues. 

Qualitative modelling, and particularly fault propaga¬ 
tion modelling, is an important feature in many of these aids. 

The first form of computer aid considered here is aids for 
the identification of hazards. A number of workers have 
described systems which perform functions broadly similar 
to those carried out in a hazard and operability, or hazop, 
study or which serve as an aid in the conduct of a study 
of this general type. Systems include: HAZID by Parmar 
and Lees (1987a,b); a system described by Weatherffl and 
Cameron (1988, 1989); HAZOPEX by Heino, Suokas and 
Karvonen (1989a,b) and Suokas, Heino and Karvonen 
(1990); HAZEXPERT by Goring and Schecker (1992); and 
COMHAZOP by Rootsaert and Harrington (1992). 

The applicability of AI techniques in this area is dis¬ 
cussed by Ferguson and Andow (1986). The identification 
of hazards is in many ways one of the least promising fields 
for computer methods. It is very difficult to devise a tech¬ 
nique that can compete with man’s ability to think laterally 
and to make apparently obscure connections, with those 
from a conventional hazop study. They also give an account 
of an application session. 


HAZOPEX has been developed using a LISP machine 
and an expert system shell. 

30.37.1 COMHAZOP 

The COMHAZOP system is described by Rootsaert and 
Harrington (1992). The plant configuration is entered and 
unit models are assigned to the units. The program exam¬ 
ines deviations associated with the units and uses rules to 
identify the causes of these deviations. 

30.37.2 HAZEXPERT 

Goring and Schecker (1992) describe the hazard identifi¬ 
cation system HAZEXPERT. This aid eschews a HAZOP- 
style approach. The plant configuration is entered. A set of 
pre-defined consequences such as overpressure, explosion, 
etc., is used. A search, limited in scope around the set of 
units under examination, is conducted to discover the 
causes of these events. The program contains a generic 
hazard knowledge base in which a key concept is dis¬ 
turbance of the mass or energy balance. HAZEXPERT is 
implemented using an expert system shell. 

30.37.3 PSAIS 

PSAIS (Plant Safety AI System) is described by Schoneburg 
(1992). The program utilizes only a limited number of rules 
but holds a large collection of design cases. Examination of a 
plant design is based on accessing ‘similar’ cases in the 
design case database. If no similar case is found, anewcase is 
created. Use is made of fuzzy matching. In this way PSAIS 
benefits from a continuous process of learning. 

30.37.4 HAZExpert 

The HAZExpert system is described by Venkatasubra- 
manian and Vaidhyanathan (1994). The general approach 
described appears broadly similar to that used in HAZID. 
The authors identify as distinguishing characteristics 
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Functional equations 

Qi =/( Qi ) 

e<=/( Q3 > 

Tt=f(Qi.-Qi.Ti.Ti) 

Event statement 
EF: r 2 HI, HI 

(a) (b) 

Program rules 
for fault propagation 
rule (pipe, propagation, [q,2], [q,l], [ ]) 

(see first functional equation in (b) above; other rules not given) 
for fault initiation 

rule (pipe, environment, [[‘external fire’, ‘ ’, ‘ ’]][[t,2,hi][) 

(see event statement in (b) above) 


(c) (d) 

Logical expressions 

T 2 HI = Qi HI + Qi LO + T, HI + T 3 HI + EF 
Ti HI = ( T„ HI) ( CF ) 

(e) (0 



CHILLER COOLER 




T3 HI T cw HI I CF 


(partial table only, contains only lines where T 2 HI is true) (full table) 


(g) 

Figure 30.13 Some forms of representation of a process system and of faults in such a system (Aldersey, Lees and 
Rushton, 1991): (a) cooler system; (b) functional equations and event statements (EF, external fire); (c) program rules 
(in Prolog); (d) diagraph (CF, cooler failure); (e) block diagram for event Q4LO (LO, low); (f) logical expressions for events 
T 2 HI and T 3 HI (HI, high); (g) truth tables for these same events (F, false; T, true); (h) minimum cut sets for event T 2 HI; 
(i) fault tree for event T 2 HI; (j) event tree for event T cw HI (Courtesy of the Institution of Chemical Engineers) 
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Minimum Cut Sets 
for event T 2 HI 
M, = Q, HI 
M 2 =Q 3 LO 
M 3 = r, HI 
M 4 = 7' cw HI, CF 
Mi = EF 

00 



(0 



CF 


G) 


Figure 30.13 continued 

an emphasis on consequences and the resolution of ambigu¬ 
ities. HAZExpert is implemented in G2 by Gensim (1992). 

30.38 Hazard Identification: HAZID 

A more detailed account is now given of one particular 
code for hazard identification. This is the HAZID code 
described by Parmar and Lees (19876a,b). The method 
follows closely the general approach taken in a hazop study, 
but draws on generic fault propagation technology devel¬ 
oped for fault tree synthesis. An overview is now given of 
HAZID, which both illustrates an application of fault 
propagation modelling and serves as an example of a 
hazard identification code. 

30.38.1 Hazard identification strategy 

Initially the problem of hazard identification was approa¬ 
ched without any preconception as to the structure of the 


method. Both top-down and bottom-up approaches used in 
fault trees and event trees, respectively, were considered as 
possible candidates. Completeness in the identification of 
hazards is the crucial feature of an effective method. A top- 
down method must therefore start from a complete list of 
consequences and a bottom-up method from a complete list 
of causes. It is difficult to provide lists that ensure com¬ 
pleteness in all situations. In a conventional hazop the 
starting point is the list of process parameters in a pipe and 
the list of guidewords. This pair of lists yields a closed set of 
events but generates an open set of causes and con¬ 
sequences. This characteristic of the hazop approach is the 
desired one and was therefore adopted for the computer 
aided method also. 

30.38.2 System decomposition 

The starting point for the method is the piping and 
instrument diagram. This is then converted to a block dia¬ 
gram. As in a conventional hazop the analysis is carried out 
on the pipes rather than the vessels. The block diagram 
contains the vessels and other major items, but most of the 
elements in it are pipework items such as pumps, hand 
valves, control loops, etc. For each unit in the block diagram 
a unit model is specified, drawing on a library of unit 
models. Additional models may be configured by the user 
and entered in the library as required. 

30.38.3 Unit models 

A unit model is a representation of the propagation of input 
parameter deviations into output parameter deviations and 
also of the initiation and termination of these deviations. 
The fault propagation utilizes the methodology described 
in Section 30.36. The basic representations used are 

(1) propagation equations and (2) event statements. 

For specific applications it may be convenient to trans¬ 
form these basic representations into alternative forms. 
Thus, in fault tree work they may be converted to a set of 
mini-fault trees. In HAZID they are converted into a set of 
rules written in Prolog. 

The initial and terminal events are, respectively, the 
causes and consequences which the hazard identification 
procedure seeks to discover. The completeness of the iden¬ 
tification depends on the quality of the modelling of these 
events. 

The configuration of the unit models is guided by the use 
of the following checklist for the initial event statements: 

(1) function, 

(2) hydraulics, 

(3) containment, 

(4) impurities, 

(5) environment. 

A process unit has a particular function. For example, it 
is the function of a gas absorption column to absorb a solute 
from a gas stream into a liquid stream. Thus one function 
fault in such a unit is that maldistribution of the liquid 
causes the outlet gas solute concentration to be high and the 
outlet liquid solute concentration low. This may be repre¬ 
sented by the initial event statement 

maldistribution > x% hi, x 4 lo 

where x is the concentration of the solute and subscripts 
2 and 4 refer to the outlet gas and outlet liquid streams, 
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respectively; This is equivalent to the rule that if maldis¬ 
tribution occurs, then x 2 hi and x 4 lo may occur. 

A process unit has a hydraulic function in that it 
should transmit flow, and a containment function, in that it 
should not leak. It also has functions related to impurities 
and its environment in that it should not introduce impu¬ 
rities and should not undergo excessive deviations due 
to environmental changes. Typical initial event state¬ 
ments for various units for these other four functions 
respectively are: 

blockage > q\ none, q 2 none 
leak (major) > qi hi, q 2 lo 
broken packing > /a 4 
external cold source > t 2 lo 

where i is the impurity concentration, q is the flow, t is the 
temperature and a is the impurity packing debris. 

Terminal event statements usually relate to a serious 
excursion of a process parameter. Some typical terminal 
event statements are 

p 2 hi > overpressure 
t 2 lo > undertemperature 
f 4 hi > overfilling 

where/ is the level, p is the pressure and t is the temperature. 

Initial and terminal event statements provide the means 
of entering a fairly comprehensive list of initial and termi¬ 
nal events, and hence causes and consequences. 

30.38.4 Fluid and materials models 

In addition to the unit models there are models for the pro¬ 
cess fluids and for the materials of construction. These are 
used primarily to allow consequences to be made condi¬ 
tional on the existence of a particular process fluid or 
material of construction susceptibility. For example, low 
flow may cause blockage, but only if the process fluid con¬ 
tains solids which can deposit out; low temperature may 
cause brittle fracture, but only if the material of construc¬ 
tion is mild steel. 

There are special treatments for the common faults leak 
and blockage, and releases to the environment are con¬ 
solidated in a special escape model. 

30.38.5 Cause and consequence generation 

The hazard identifier program receives as input tables 
giving the configuration of the block diagram and listing 
the library models to be used for each unit. The program 
operates on the system line by line. For a given line each 
parameter deviation is examined in turn and its causes and 
consequences are generated from the initial and terminal 
event statements in the unit models. 

The link between the causes and consequences listed for 
a particular parameter deviation is the deviation itself. In 
general, most of the causes result in most of the con¬ 
sequences and most of the consequences result from most 
of the causes, but not all. For example, in a pump delivery 
shut-in is a cause of no flow and results in the consequences 
pump overheats and loss of level in the downstream vessel, 
but no changeover to a stand-by pump is a cause of no flow 
and results in loss of level but not in pump overheating. 

With regard to the direction of search for causes and 
consequences, Figure 30.14 shows two options. In Method 1 


the search is from local cause to distant causes, whilst in 
Method 2 it is from local consequence to distant conse¬ 
quences. HAZID uses Method 1, for two reasons. First, this 
method involves the evaluation of consequences rather 
than causes and such an evaluation is considered the prime 
form of filtering. Second, the method allows the possibility 
of tracing a consequence linked to a number of causes and is 
compatible with the search for such causes using a fault tree. 

30.38.6 Screening of faults 

In the foregoing, attention has been focused on the genera¬ 
tion of potential faults. In the absence of some screening 
mechanism the number of faults generated can be very 
large. This is a common problem in computer-generated 
output, but it occurs to a degree in conventional hazop also. 
Several approaches may be taken. The main distinction is 
between suppression of the initial generation of the faults 
and handling of faults after they have been generated. 

A particular form of suppression is effected by the fluid 
and materials of construction models, as already described. 
In many cases a fault thrown up by the fault propagation 
modelling has a credible realization only if there is a par¬ 
ticular fluid susceptibility, so that where the fluid model 
contains no such susceptibility, the fault need not be gen¬ 
erated. Similar considerations apply to the materials of 
construction model. 

With regard to handling of faults after generation, men¬ 
tion has already been made of the consolidation of similar 
faults caused by different items in a single line. 

The other methods of handling faults involve some form 
of screening. The simplest approach here is to lay ‘masks’ 
over the output. Avariety of types of mask may be used for 
different purposes. A hierarchy of masks may be used which 
give successively larger amounts of detail. Other specialist 
masks may be envisaged for particular problem areas. 

Another more difficult but worthwhile form of screening 
is the use of engineering heuristics to evaluate faults. The 
evaluation may address causes or consequences. Suitable 
heuristics are of various types, but in each case the purpose 
is to assist the decision as to whether a fault can be dis¬ 
regarded either because the cause is not credible or the 
consequence is negligible. Some heuristics relate to the fre¬ 
quency and cost of faults, and require both estimated values 
and cut-off levels. Other heuristics are based on engineer¬ 
ing practices. For example, there are usually company 
practices that determine whether in a given case a liquid 
relief valve is provided on a section of pipe which is shut in. 

30.38.7 Fault consolidation 

For the lines connecting the vessels and other major 
equipment, use is made of a special pipe model. Faults in 
the line due to minor units such as pumps, hand valves and 
control loops are collected up and consolidated so as to 
avoid excessive proliferation of faults. In this way a fault 
such as a blockage is flagged in the line only once, but all 
the causes of the fault are identified. 

30.38.8 Model generation and model library 

The configuration of a unit model is carried out using a 
model generation program. The data are entered on a pro¬ 
forma. A typical proforma is shown in Figure 30.15. Items 
1-6 are entered by the user and the remaining items are 
generated by the program. The rules in items 7-9 are in 
Prolog, as described below. 
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Cause 


Consequence 

failure . 

deviation 

N 

failure 

• deviation ■ 

Location 1 


Cause 

Consequence 

failure 


failure 

deviation 

L ' 

« deviation 


Location 1 


deviation 


deviation 


failure 
deviation - 


deviation 
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Cause Consequence 


^ deviation . 


✓ failure 

deviation 

Location3 
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Consequence 

failure 

* deviation • 


deviation 


Location3 


Figure 30.14 HAZID: generation of causes and consequences (Zerkani and Rushton, 1992): (a) search for causes; 
(b) search for consequences (Courtesy of Pergamon Press) 


Models are held in a model library. In some applications 
the user may find all the models required already in the 
library. Where this is not so, he or she configures the miss¬ 
ing models using the model generation program. 

There are certain relationships between models that may 
be exploited to achieve a degree of automatic model gen¬ 
eration. One is the hierarchical structure of models. Thus, a 
pump is a subclass of the class of pressure raisers and 
inherits certain characteristics. Even where there is no 
formal hierarchy, a group of models may be related by some 
shared process or feature. In such cases use may be made of 
model archetypes, or partial models. 

Much modelling centres around ports at the inlet and 
outlet of vessels and other equipment. A taxonomy of 
standard ports permits the selection of appropriate sets of 
equations, or models, for such ports. 

30.38.9 Computer codes 

The main programs in the HAZID package are: MASTER, 
which does the housekeeping; CONFIGURATOR, which 
handles the configuration; IDENTIFIER, which is the core 
program and generates the cause and consequence lists for 
the parameter deviations; CONSOLIDATOR, which turns 
these lists into a table similar in form to that produced by a 
conventional hazop; and MODGEN, which generates the 
unit models. There is a unit model library. The task of 
IDENTIFIER is to handle rules and the program is written 
in Prolog. The other programs are written in Fortran. 


30.38.10 Illustrative example: water separator 

An illustrative example of the use of HAZID has been given 
by Parmar and Lees (1987b). The plant examined is the feed 
section of the alkene dimerization plant described by 
Lawley and shown in Figure 8.25.The corresponding block 
diagram for this plant is shown in Figure 30.16. Table 30.15 
gives part of the hazard identification table generated for 
this example together with extracts from the original table 
of Lawley, which was given in Table 8.29. 

30.39 Hazard Identification: Enhancements 

The published work on computer-based aids for hazard 
identification suggests that there is still much to be done to 
devise an aid which is useful in identifying hazards prior to 
conventional hazop, let alone one which might do more 
than this. 

The current state of the art may be summarized by say¬ 
ing that, in general, aids are more successful in identifying 
causes than consequences, the range of which tends to be 
rather limited, and both are lacking in richness and are thus 
rather stereotyped.The overheads for the input of data tend 
to be too high. The output tends to be lacking in dis¬ 
crimination, and thus excessive. 

An aid such as HAZID is built largely around fault propa¬ 
gation, which utilizes models based on engineering princi¬ 
ples and which is stronger on the identification than on the 
evaluation of faults. Fault generation needs to be enhanced 
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1. Model number, name 

13 pipe 

1 2 

2. Engineering description and assumptions 
Engineering description 

N/A 

Engineering assumptions 
N/A 

3. Propagation equations 

Pi =/(/»! ) 

Qi =.f(<h) 

12 =/(/,) 

■v 2 =/(■'-,) 

4. Supplementary information 
Normal state: N/A 

No multicomponent features 
Failure modes; 1 

5. Initial event statements 
blockage > q 2 lo. <7, none. /?, hi 
leak > escape 

leak (rupture) > <7, hi. q 2 lo, q 2 none. />, lo 
external cold source, cold weather, lagging loss > t, lo 
external heat source, lagging loss, fire > /, hi 
external heat source with blocked-in pipe > p 2 hi 

6. Terminal events 

p 2 hi > leak (rupture) 

/, lo > leak (rupture) 

7. Rules for fault propagation 

rule (pipe, propagation. [/>. 2], [[/), 1]]. []) 
rule (pipe, propagation. [4, 2], [[</. 1]], []) 
rule (pipe, propagation. [/. 2], [[t, 1]]. []) 
rule (pipe, propagation. [V. 2], [[.v. 1]]. []) 

8. Rules for fault initiation 

rule (pipe, hydraulic, [[‘blockage'. ‘ ‘ ']], [[4. 2. lo], iq, 2. none], ip, 1, hi]]) 

rule (pipe, containment, [[‘leak’, ‘ ‘ ']], [['escape', ' ',' ']]) 

rule (pipe, containment, [['leak (rupture)’,' ',' ']], [[<7,1 . hi], [ q , 2. lo], iq, 2. none], ip. 


2, lo], ['escape ‘ ', ' ’]]) 

rule (pipe, environment, [[‘cold weather’, ' ' ']. ['lagging loss’. ' ' ’]]. [[r. 2, 

lo]]) 

rule (pipe, environment, [['hot weather’,' ', ' ’]. [‘lagging loss’. ' ’,' ’], ['fire'.' ’, 
’]][[/- 2, hi]]) 

rule (pipe, environment, [['external heat source with blockcd-in pipe’, ' ’, ' ’]], 


C IP, 2, hi]]) 

9. Rules for fault termination 

rule (pipe, effect, [[/), 2, hi]], [['leak (rupture)'. ' ’, ' ’]]) 

rule (pipe, effect, [[r, 2, lo]], [[‘leak (rupture)’, ‘ ’,' ’]]) 

10. Model status: 

Written: JCParmar June 1986 
Checked: FPLees June 1986 
Usage: 3 Configurations 


Figure 30.15 HAZID: proforma for configuration of a unit model (Parmar and Lees, 1987b) (Courtesy of 
Elsevier Science Publishers) 
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Figure 30.16 HAZID: illustrative example: block diagram for alkenes dimerization plant (Parmar and Lees, 1987b) 
(Courtesy of Elsevier Science Publishers) 


by grafting onto this basic mechanism domain expertise. 
Thus, for example, a heat exchanger may have expertise 
bearing on tube vibration under abnormal flow conditions, 
blockage under no flow conditions, pinhole leaks between 
tubes and the shell, the overpressure hazard following tube 
burst, theneedforspaceto remove the tubebundle,andsoon. 
Perhaps even more important is the need to strengthen fault 
evaluation.There are various methods of doing this but most 
may be broadly classed as forms of expertise. 

Features in which enhancement of current methods 
is likely to be of value include the following: (1) design 
screening, (2) information acquisition, (3) generation of 
faults, (4) evaluation of faults and (5) presentation of output. 


30.39.1 Design advice and screening tools 

The point has already been made that if the designs coming 
forward incorporate defects which are relatively elemen¬ 
tary and numerous, a hazop-style aid may not be the most 
efficient way of correcting the situation. There may be 
scope for assisting the designer by providing a design 
advisor tool. Such a tool is essentially an aid to design 
synthesis. Likewise, it may be appropriate to provide a 
design screening tool to filter out certain common and 
readily identifiable defects. In contrast to the design advice 
tool, this is a tool for design analysis. A design screening 
tool is likely to rely largely on an examination of the con¬ 
figuration of the units and of the plant as a whole. Config¬ 
uration screening is discussed further below. Suffice it to 
say that it needs to be catered for somehow and that, if it is 
not performed by a separate aid, it is necessary to incor¬ 
porate it in the main hazard identification aid. 


30.39.2 System discipline 

It can be envisioned that over time aids such as those for 
representing design issues described earlier and the 
hazard identification aids described here could exert a 
significant influence on the design process. Such aids tend 
to require adherence to a more formal discipline involving a 
more explicit declaration of issues, arguments and intent. 
This is not only a condition for the effective integration and 
exploitation of these aids but also a desirable development 
in the design process itself. 

Permitted terminology 

One aspect of this is the discipline to be adhered to in the 
terminology used. It is good practice to use lists of the 
permitted terminology for units, faults, process variables, 
deviations and so on. 

As a simple example, confusion can be caused if the state 
of a valve is described on some occasions as ‘closed’ and on 
others as ‘shut’. More fundamentally, the discipline is of 
value with respect to generic and specific faults and to the 
inheritance of faults. Thus, for example, use might be made 
of the generic faults ‘block’, indicating complete blockage, 
and ‘outflow’, indicating major leak. Realizations of the 
generic fault block in a line might be the specific faults 
blockage, closure of valve, freezing of fluid or polymeriza¬ 
tion of fluid. 

30.39.3 Fault generation and evaluation 

As already stated, a hazard identification aid is required 
both to generate faults and to evaluate them. Fault genera¬ 
tion is primarily by means of fault propagation models, 
fluid and materials of construction models, and expert 
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Table 30.15 HAZID: illustrative example; hazard identification table generated for alkene dimerization plant 
(Parmar and Lees, 1987b) (Courtesy of Elsevier Science Publishers) 


Process Original hazop 

deviation causes 

Computer-aided hazard 
identification causes 

Original hazop 
consequences 

Computer-aided 
hazard identification 
consequences 

No flow No hydrocarbon at 

Source: 

Loss of feed to 

Pump: 

intermediate storage 

<h none 

reaction section and 

Pump fluid 


source empty 

reduced output. 

overheats 

J1 pump fails 

Pipe: 

Polymer formed in 

Settler: 

(motor fault, loss of 

Blockage 

heat exchanger 

?! none 

drive, impeller 

Leak (major) 

under no flow 

Outflow(s) none 

corroded away, etc.) 

Pump: 

Loss of NPSH 

Rotation fault 

conditions 

l 5 none 

Line blockage, isolation 
valve closed in error or 
LCV fails shut 

Impeller fault 

Cavitation 

Low b.pt. material gassy 
materials 

J1 pump overheats 


Line fracture 

Delivery shut in 

No change to stand-by 
Stand-by fail on demand 
Maloperation of valves 
Blockage 

Leak (major) 

NRV: 

Valve stuck closed 

Pipeline: 

Blockage 

Leak (major) 

Control valve: 

Loop fails closed 

Sensor fails closed 
Controller fails closed 
Control valve fails closed 
Set point moved closed 
Isolation valve closed 
Valves: 

Valve moved closed 

Hydrocarbon 
discharged into area 
adjacent to 
public highway 


More flow LCV fails to open 

Source: 

Settling tank 

Meter: 

or LCV bypass 

?i high 

overfills 

Inaccurate 

open in error 

Meter: 

Incomplete 

measurement 


Bypass fails 

separation of water 

Settler: 


Bypass moved open 

phase in tank, 

?i high poor settling 


Control valve: 

leading to problems 

4-2 high 


Loop fails open 

Sensor fails open 
Controller fails open 
Control valve fails open 

Set point moved open 
Bypass directed open 

in reaction section 

l 5 high 

Liquid enters vent 

Less flow Leaking flange 

Source: 

Material loss 

Meter: 

or valved stub 

pi pl Qx low 

adjacent to 

Inaccurate 

not blanked 

Blockage 

public highway 

measurement 

and leaking 

Leak (major) 

Pump: 

Loss of NPSH 

Rotation fault 

Impeller fault 

Cavitation 

Low b. pt. material 

Gassy material 

Delivery part shut 
Blockage 


Settler: 

Outflow(s) low 

4 low 
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Table30.15 (continued) 

Process Original hazop Computer-aided hazard Original hazop Computer-aided 

deviation causes identification causes consequences hazard identification 

consequences 


Leak (major) 

NRV: 

Valve fails part closed 
Pipeline: 

Blockage 
Leak (major) 

Control valve: 

Loop fails part closed 
Sensor fails part closed 
Controller fails 
part closed 

Control valve fails part 
closed 

Set point moved part 
closed 

Isolation valve part 
closed 
Blockage 
Valve: 

Valve partly closed 


LCV, level control valve; NPSH, net positive suction head; NRV, non-return valve. 


rules. The prime means for fault evaluation are the fluid 
model and expert rules. 

30.39.4 Integration of expertise 

The generation of faults is done partly by fault propagation, 
but to achieve a greater richness and completeness it 
is necessary to introduce in addition various forms of exper¬ 
tise. The following are some of the attachment points, or 
‘hooks’ to which such expert rules may be attached: guide- 
words; faults; deviations; undesired outcomes; units; lines; 
configuration of units (including connectivities and eleva¬ 
tions); fluids; reactions; impurities and their sources; mate- 
rialsofconstruction;pressureraisers(pumps,compressors); 
instrumentation; control computers; protective devices 
(especially relief valves); small items (drain and sample 
valves, filters, small bore pipework, etc.); mode of operation 
(batch, continuous, etc.); operations (usual modes of opera¬ 
tion, operating instructions); maintenance; storage; trans¬ 
port; utilities; environmental influences (heat, cold, rain, 
extreme weather) and environmental impacts (releases). 

Expert rules are also a prime means for the evaluation of 
faults. Once a fault has been generated, any expertise 
available to the program can be brought to bear to evaluate 
it. This applies whether the fault generation step has 
involved fault propagation, the fluid model or fault gen¬ 
eration expertise. Often, fault generation and evaluation 
will be part of the same package of expert rules. 

30.39.5 Information requirements 

The hazard identification activity requires the availability 
of a considerable amount of information. The information 
requirements for conventional hazop have been discussed 
in Chapter 8. 

Minimal requirements for a computer aid are generally 
(1) the piping and instrument diagram, and information 
about (2) the main plant units, (3) the fluids and (4) the 


materials of construction. In addition, however, informa¬ 
tion may be needed about other aspects such as design 
intent and operating procedures. 

Some comments are now given about some of these types 
of information. 

Fluids 

Information is required about the properties of the fluids in 
the plant. This is discussed in more detail below. Suffice it 
to say at this point that in large part this is information 
about fluid properties and susceptibilities. The former 
should be available in the standard generic fluid properties 
databases but much of the latter may not. 

Materials of construction 

Information is also required on the properties of the 
materials in the plant, essentially on their susceptibilities. 
Provision of this information is the function of a generic 
materials of construction database. 

Design intent 

There is a quite large amount of information on design 
intent which is not necessarily given in the piping and 
instrument diagram (P&ID). This category covers a wide 
range of types of information. One type may be broadly 
characterized as configurational information. For example, 
the P&ID may show two pumps piped up in parallel with¬ 
out making it clear whether these are 50 or 100% pumps. 
Or, again, two pressure relief valves may be shown but 
with no indication on setting, capacity or stagger. Another 
category is that which relates to the function of the unit, 
especially where this involves a dual or subsidiary function 
or a constraint on function. 

Operating procedures 

Another important category of information is the operating 
procedures. Ideally these should be available at the time 
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where the hazard identification is undertaken, but they 
may well not be. 

Resident hazards 

It is commonly the case in a conventional hazop that even 
before the study is commenced the team already knows that 
the plant is subject to certain hazards, or other problems. In 
conducting the examination these ‘resident hazards’ are 
uppermost in the mind. It makes sense in devising a com¬ 
puter method to find some way of ensuring that the search 
covers such resident hazards. 

Information representation 

For some types of information the form of representation 
appears straightforward. For fluid-materials incompat¬ 
ibilities, for example, a look-up table is a natural format. 
Moreover, such information is of the type which should in 
large part be available in standard databases. With other 
types of information, such as design intent or operating 
procedures, there are issues both as to the representation 
most useful to the hazard identification aid and as to the 
ease of acquisition. 

Lack of information: effects and strategies 
Lackofinformationhas certain consequences. In some cases 
the system may fail to generate a fault. More often, it will be 
unable to evaluate a potential fault that it has identified. 
There are strategies for coping with a lack of information. 
One is to conduct a dummy run of the hazard identification 
aid to establish the information that is missing. This implies 
that the data are to be provided prior to the main run. 

An alternative approach is to use default assumptions 
about matters such as design intent or operator procedures. 
It can be envisaged, for example, that for many standard 
operations a corresponding standard, default operating 
procedure is attached. The use of default assumptions has 
obvious dangers, however. In some cases it is precisely the 
haziness about intent that it is the function of the study to 
identify. It may well be prudent, therefore, at least to draw 
attention to the fact that such a default has been used. 

30.39.6 Information acquisition and CAD interface 

A large amount of generic information on physical, chemi¬ 
cal and thermodynamic properties and on materials of 
construction is, in principle, available in standard data¬ 
bases. Data on the plant itself are available in the design 
databases. The information acquisition problem relates to 
that part of the information required which is not available 
from these sources. 

Information may be provided for use by a computer aid 
by manual input, by retrieval from the system’s own data¬ 
base or by accessing the database of another system. Man¬ 
ual input imposes an overhead that can make the use of the 
aid much less attractive. There is therefore a strong incen¬ 
tive to obtain the information required automatically. 

One approach to information acquisition is to provide 
a database that is intended to meet in full the information 
needs. Another is to rely completely on the interactive provi¬ 
sion of data by the user. An intermediate, or hybrid, approach 
is to provide the database with a substantial amount of 
information but to anticipate some user input of data. 

As indicated, a method of identifying the items of infor¬ 
mation needed to solve a particular problem but still miss¬ 
ing in the database is to perform a dummy run for the sole 
purpose of such identification. 


Use may also be made of heuristics. One strategy for 
automatic acquisition is to exploit the implications of the 
plant configuration. One example is that the presence of a 
water separator implies free water in the feed to it and hence 
a hazard of generation of static electricity. Another is that 
the presence of a trip implies a hazard against which the 
trip is guarding. And so on. 

The aim must be that the hazard identification tool 
acquires most of its information by accessing a CAD system 
and its associated databases. Here it is sufficient to note 
that facilities for interfacing such an aid to the CAD sys¬ 
tems in general use are not yet universally available. 

30.39.7 Plant configuration features 

As mentioned earlier, a plant design may possess config¬ 
urational features that point to potential hazards. Such 
undesirable features include those associated with (1) pres¬ 
sure relief, (2) shut-in pipework, (3) water hammer, (4) throt¬ 
tling of pump suction and (5) emergency isolation of 
hazardous inventories. As a simple example, where a plant 
configuration shows a long pipeline terminating inashut-off 
valve, thereisapresumptionthatwaterhammermightoccur. 

It is for consideration at what stage identification of such 
undesirable configurational features should be under¬ 
taken. One policy is to leave them to be identified in 
the course of the main hazard identification procedure. 
An alternative, and perhaps preferable, policy is to conduct 
a preliminary screening for such features. 

30.39.8 Plant system decomposition 

Success in the analysis of a plant system can often depend 
on the appropriateness of the decomposition. It is therefore 
worth devoting some effort to ensuring that the system is 
decomposed in the way best calculated to achieve the 
desired results. 

In most methods decomposition is into units and lines, 
together with source and sink units representing the main 
inflows and outflows across the plant boundaries. Another 
element that it may be convenient to use is an offtake. This 
is any feature through which a flow can occur out of a line or 
unit and includes an atmospheric vent, a pressure relief 
valve, a drain or sample point, etc. 

There is an issue as to whether a line between units 
should be handled as a whole or decomposed into its con¬ 
stituent parts, with each fitting such as a valve or filter 
treated separately. Similar choices apply to the units. 
A pump set or a valve and bypass set may each be treated as 
a single unit or decomposed further. 

30.39.9 Model hierarchies and inheritance 

It is becoming increasingly common to model the plant as a 
hierarchyof objects and to exploitthe concept of inheritance. 
The head of the hierarchy may be taken as the plant itself. In 
this case the plant object contains the connectivities 
between the units, which are the next level of object. 

The models of the units may also be ordered in hier¬ 
archies. Thus, for example, one model hierarchy may be 
headed by a pressure raiser, which is the parent for com¬ 
pressors, fans, pumps, etc. A given unit may belong to 
more than one hierarchy. Thus, a centrifugal compressor 
may belong both to the hierarchy of pressure raisers and 
of rotating machines. Benefits of ordering the unit 
models in a hierarchy are that this provides structure in the 
model library and that models can inherit characteristics. 
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Inheritance is a valuable feature but needs to be applied 
with care, particularly where multiple inheritance is 
involved. Options inrespectofinheritancefromaparentunit 
are (1) to accept the whole set of characteristics, (2) to suppress 
the whole set of characteristics or (3) to accept the set of char¬ 
acteristics but to overwrite some of them. A declaration of the 
option exercised should be attached to the model. 

For inheritance to be practised successfully it is neces¬ 
sary that the characteristics of the parent model be 
expressed in a way which is sufficiently general. As indi¬ 
cated earlier, one aspect of this is that the faults in the 
model need to be generic. 

30.39.10 Units as objects 

One way of generating faults is to list the attributes of a unit 
as an object. This provides a fault generator for the unit. 
This concept may be illustrated in terms of the properties 
of a pump. A pump: 

(1) has problems - 

loss of power; loss of lubrication; loss of cooling; 
cavitation; deadheading; reverse flow; vibration; 

(2) causes problems - 

can cause loss of flow; can cause loss of pressure; 
can cause power surge (start-up and shut-down); can 
cause vibration; 

(3) is an equipment - 

has states; has foundations; has connections; 
requires operation/control; requires maintenance; 

(4) is an equipment which has states - 

has operational state; has short-term stand-by 
state; has long-term stand-by state (mothballing); has 
breakdown state; has maintenance state; 

(5) is an equipment which requires operation/control - 
requires to be started up; may require preliminary 
conditions/activities before start-up; requires to be 
shut-down; may require observable operation (visual, 
audible cues about start-up, running, etc.); may 
require remote operation; may require synchronized 
operation (e.g. with an emergency isolation valve); 

(6) is an equipment which requires maintenance - 
requires access; requires mechanical isolation; 
requires electrical isolation; may require lifting gear; 

(7) is a machine - 

(a) requires power; has motion; dissipates energy; 
has inertia; 

(b) has rotary motion; has bearings; has seals; 

(8) is a pressure raiser - 

is a source of low pressure (inlet); is a source of high 
pressure (outlet); 

(9) is a flow device - 

causes turbulence; may have cavitation; 

(10) has subsystems - 

may havelubeoilsystem;mayhavewater cooling system; 

(11) is a leak source - 

has hazardous area classification; 

(12) has reliability engineering requirements - 

has reliability requirement; has availability 
requirement. 


30.39.11 Faults and susceptibilities 
Susceptibilities 

Closely related to the foregoing is the concept of looking at 
a unit in terms of its susceptibilities. This also is perhaps 


best explained by way of example. Consider a water sep¬ 
arator. Some rules for this might be: 

(1) If the residence time is low, then the outflow liquid may 
contain free water. 

(2) If the operator fails to drain the water, then the outflow 
liquid may contain free water. 

(3) If interfacial effects occur (emulsion), then the outflow 
liquid may contain free water. 

(4) If the liquid is one susceptible to charge generation 
(low conductivity) and the liquid velocity is high or 
there is a charge generator (e.g. filter) in the inlet line, 
then there is a hazard of static charging and discharge. 

Similarly, for a heat exchanger: 

(1) If the exchanger is new/recently cleaned, then the 
outflow process liquid temperature may be high. 

(2) If the exchanger is old, then fouling may have occurred 
and the outflow process liquid temperature may be low. 

(3) If there is a tube leak and the heating fluid pressure 
is greater than the process fluid pressure, then the 
outflow process liquid will have minor component 
increase consisting of heating fluid. 

(4) If the residence time is high and the process fluid 
is susceptible to polymerization, then the liquid may 
polymerize in the exchanger. 

(5) If the liquid contains minor components that promote 
fouling, then fouling may occur. 

(6) If the liquid contains minor components that attack 
the existing fouling film, then the outlet process liquid 
may contain debris. 

The richness of the fault representation depends in large 
part on the imaginativeness with which unit suscept¬ 
ibilities are identified. 

Conditional faults 

The susceptibilities just described constitute a form of 
fault with an attached condition. The attachment of condi¬ 
tions to faults is important because it either limits the 
number of faults generated or increases the proportion 
eliminated, depending on the stage at which the conditions 
are applied. 

As a further example of a conditional fault, wet steam 
may be characterized as a fluid that is erosive, but with the 
attached condition that the velocity is high. The erosiveness 
of the steam is a generic property, but the velocity is a con¬ 
dition to be met in the specific application. 

Faults with external effects 

A hazard identification aid should cater not only for faults 
that propagate through the plant but also to some degree for 
those which have an impact outside it. Examples are liquid 
overflow from a storage tank and its implications for 
the bund around the tank or discharge from a relief and it 
effects. 

30.39.12 Expert rules 

As indicated, a unit may be provided with a set of expert 
rules for both the generation and evaluation, or resolution 
of faults. In some cases generation and resolution may 
occur within the same unit, in others use has to be made of 
fault propagation between units. 
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As an example of the latter, more complex case, consider 
l pump with the rule set 


Hook 

Generation 

Resolution 

Has lube 

Lube oil system 

Response required 

oil system 

failure may cause 

if and only if lube 


flow of lube oil 

oil impurity in 


as impurity into 

process creates 


process fluid if 

a significant 


failure creates 
a leak path and if 
the pressure of 
lube oil is greater 
than the pressure 
of process fluid 

problem 


At this point a potential fault has been generated but not 
resolved. It is not known whether lube oil in the process 
fluid is an unacceptable impurity. Now consider the trans¬ 
port of the lube oil impurity into a water separator. Apply¬ 
ing the water separator rule, or susceptibility, given earlier: 

If interfacial effects occur (emulsion), then the outflow 
liquid may contain free water. 

This rule effectively defines, for this unit, the nature of 
the potential problem. Whether or not the lube oil impurity 
is a significant problem depends on whether it is a foaming 
agent. This is determined from the fluid model, which is 
now described. 

30.39.13 Fluid and stream models 

Modelling of the units in terms of fault propagation and 
expert rules needs to be complemented by modelling of the 
fluid. A distinction is made between the fluids and the 
streams. ‘Fluid’ refers to the chemical substance, or mix¬ 
ture, which has generic properties. ‘Stream’ refers to the 
stream at a given location in the specific plant. A stream is 
defined primarily in terms of the fluid and of the pressure 
and temperature. 

Some elements of the fluid and stream models are 

(1) stream definition, (2) stream transformations and 
(3) stream displacements. 

Stream definition 

A stream at equilibrium is defined basically in terms of its 
composition and of the pressure and temperature. The 
composition may be defined in terms of (1) bulk compo¬ 
nents and (2) minor components, intended and unintended. 
The stream composition and the operating conditions of 
pressure and temperature define the phase and the physi¬ 
cal properties of the equilibrium fluid. 

Stream transformations 

Much stream behaviour may be characterized in terms of 
transformations. These are (1) intended transformations 
and (2) unintended transformations. The intended trans¬ 
formations are what the process is all about, typically 
reaction and separation. The unintended transformations 
are what the exercise seeks to identify. 

Stream interactions 

Another way of categorizing stream behaviour is in terms 
of interactions. These are (1) interactions with operating 


conditions, (2) interactions with other materials and 
(3) interactions with other features. 

Stream interactions with operating conditions 
There are three categories of stream interaction with operat¬ 
ing conditions: (1) phase, (2) flow properties and (3) reaction. 

Phase transformations are (1) vaporization, (2) con¬ 
densation, (3) melting and (4) solidification. These trans¬ 
formations may be partial or total. 

Flow property transformations are any transformation 
that affects the flow properties of the fluid, for example 
viscosity change and change to slugging flow. 

Reaction may occur within the fluid itself. This reaction 
may be in a reactor, where the reaction may be the intended 
reaction or also an unintended one; or it may be in another 
part of the plant, where it will almost always be an unin¬ 
tended reaction. 

Stream interactions with other materials 
There are a large number of stream interactions with other 
materials that may be conceived. The interactions con¬ 
sidered here are confined to those which are due to the fluid 
constitution (composition and properties) and do not 
extend to the fluid motion. 

The interactions include those with other materials such 
as (1) other fluids (bulk components, minor components), 

(2) catalyst, (3) materials of construction, or corrosion 
(main components, minor components), (4) air, (5) water 
and (6) additives (interfacial agents, promoters, inhibitors). 
In each case it is necessary to consider the interaction both 
of the bulk components and of the minor components of the 
stream. 

Interactions of the stream with the materials of con¬ 
struction include interactions of the stream both with the 
main components and with minor components such as 
gaskets, seals, trims, etc. Lubricants and sealing fluids 
may be treated as ‘minor components’. 

Air and water might be treated on a par with the other 
unintended minor components, but they are so common, 
and incidents associated with them so frequent, that they 
perhaps deserve special status. One aspect of this is that 
consideration should be given to whether or not they are 
declared as specific components of the stream. 

Stream interactions with other features 
Streams also interact with other features in the sense that 
a problem arises from the combination of the stream and 
the feature. These features include (1) units, (2) unit faults, 

(3) operations and (4) maintenance. 

An example of an interaction between the stream and a 
unit is the case where the fluid is flammable and is trans¬ 
ferred into a road tanker. There is a recognized hazard of 
static electricity in some cases. 

An example of an interaction between the stream and a 
unit fault is the case where the stream contains gunk that 
causes blockage. 

An example of an interaction between the stream and an 
operation is the case where a gravity separator is used to 
remove water from a toxic solvent with which it is nearly 
(but not totally) immiscible and the water is drained off the 
bottom. The water will be saturated with the solvent and 
the latter will therefore exert its full vapour pressure. If the 
solvent is toxic, this may affect the operator. 

An example of interaction between the stream and 
maintenance is the case where the fluid is very toxic and 
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special precautions will need to be taken when the plant is 
broken open. 

30.39.14 Fluid and stream models: hydraulics 

A quite different set of fluid phenomena are those that fall 
into the broad category of hydraulic effects. One way of 
looking at these is in terms of the displacement of one fluid 
by another. 

Displacement of gas by liquid 

Displacements of gas by a liquid include (1) displacement in 
a vessel, (2) displacement in a pipe, (3) condensate hammer, 
(4) liquid lock and (5) siphon. 

The pipe displacements are (1) permanent, flowing dis¬ 
placement (2) a moving liquid slug and (3) an essentially 
immobile liquid slug. 

Displacement of gas by a liquid in a vessel can cause 
overflow and overpressure. Displacement of gas by a liquid 
in a pipe can cause erosion and incorrect measurement and 
control. Condensate hammer can cause damage to pipe¬ 
work and machinery. Liquid lock can prevent gas flow and 
pressure equalization. 

Displacement of liquid by gas 

Displacements of liquid by a gas include (1) displacement 
in a vessel (partial, total), (2) displacement in a pipe and 
(3) gas lock. 

Displacement of liquid by a gas in a vessel can cause loss 
of head and overpressure. It can also take the form of gas 
breakthrough when a liquid seal at the bottom of a vessel 
is lost. Displacement of liquid by a gas in a pipe causes 
incorrect measurement and loss of control. Gas lock can 
prevent liquid flow. 

Displacement of liquid by liquid 

Displacement of liquid by a liquid occurs in rollover. 
Rollover is caused by the formation of two liquid layers and 
by inversion of the densities of the two layers. 

30.39.15 Fluid and stream models: modelling strategy 

A strategy for modelling the fluid needs to deal both with 
the identification and with the resolution of stream-related 
problems. 

Stream problem identification 

Stream-related problems arise from the three sorts of stream 
interactions and from stream hydraulics. One strategy for 
dealing with stream interactions is the use of breakpoints. 
A breakpoint is defined as a point in the plant at which the 
fluid constitution (composition and properties) and/or the 
operating conditions undergo or may undergo a significant 
change. This definition covers both a point where a change 
is intended and one where no change is intended but may 
nevertheless occur. It is for consideration what constitutes 
a significant change. 

At each such point the three types of stream interaction 
are examined, to identify any problems. The default 
assumption is that unless there is information to the con¬ 
trary, the stream passes through a breakpoint with its 
constitution and operating conditions unchanged except as 
given in the design. 

Stream hydraulic problems tend to be related to par¬ 
ticular types of line and unit. One way of dealing with these 
is therefore by using lines and units as the hooks for the 
appropriate expertise. 


Stream problem resolution 

Fault generation needs to be followed by fault resolution. The 
stream model should contain aids to assist in determining 
whether a generic fault identified by the fault generation 
process is in fact a significant problem in the specific case. 
Some types of resolution aid include (1) landmark values, 
(2) susceptibility rules and (3) other rules. Here rules are 
taken to include related forms such as truth tables. 

30.39.16 Fluid and stream models: information 

The implementation of such a strategy requires the 
handling of information, which may be broken down into 

(1) information requirements, (2) information representa¬ 
tion and (3) information acquisition. 

The foregoing approach to the fluid and stream models 
implies the need for information on (1) inlet streams and 

(2) intended stream transformations at breakpoints, and 
information relating to the potential for (3) unintended 
stream transformations, (4) unintended stream interactions 
with other materials, (5) unintended stream interactions with 
other features and (6) unintended stream hydraulic effects. 

The set of inlet fluids is those fluids entering at the 
boundaries and includes process fluids and utility fluids. 
The set of intended stream transformations is, in effect, the 
process. 

The unintended stream transformations arise from the 
first two types of interaction (with the operating conditions 
and with the other materials). The unintended stream 
interactions with other materials may result in stream 
transformations, as just mentioned, and/or in other effects. 

This part of the information relates to fault generation. 
The second part is that which relates to fault resolution. In 
large part this latter is concerned with various types of 
susceptibility to stream changes. 

A large part of the fluid model consists of information 
about susceptibilities and incompatibilities. These relate 
to the three types of interaction already described, which 
are (1) stream-stream interaction, (2) stream-materials 
interaction, and (3) stream-feature interaction. These 
interactions occur essentially due to the fluid properties of 
the stream(s). 

There are also interactions due to stream properties such 
as pressure and temperature. These include (1) pressure- 
materials interaction and (2) temperature-materials inter¬ 
action. 

Information on susceptibilities and incompatibilities is 
most naturally represented as rules or look-up tables. 

30.39.17 Materials of construction model 

Another model required is the materials of construction 
model. What this model should provide is the suscept¬ 
ibilities of the materials in the plant to undesirable inter¬ 
actions. The most elementary form of model is one that 
gives the incompatibilities between the materials of con¬ 
struction of the main items of equipment and the fluids. 
More useful is a model that also gives this information for 
(1) minor components of the main plant items and (2) for 
impurities in the fluids. 

The materials model should also cater for susceptibil¬ 
ities of the materials to the stream properties of pressure 
and temperature. The materials model may be extended 
to give some information on effects. In most cases the 
basic effect is corrosion. The significance of this, however, 
varies. It may lie in its potential to cause a leak or in con¬ 
tamination of the fluid. 
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30.39.18 Filtering of faults 

The output given by current computer aids for hazard 
identification tends to be too indiscriminate and too volu¬ 
minous. As pointed out in Chapter 8, in a conventional 
hazop the identification of hazards is only one part of the 
activity; the other part is the filtering out of those hazards 
that are unfeasible or negligible. 

Four forms of filtering can be distinguished: (1) sup¬ 
pression, (2) consolidation, (3) evaluation and (4) masking. 
These are now considered in turn. 

Suppression of faults 

By ‘suppression’ is meant suppression of the consequences 
and/or causes during the generation process or immedi¬ 
ately thereafter. It has its place, but carries with it certain 
dangers. Suppression needs to be governed by suitable 
rules, which may not be easy to devise. 

An example of suppression that may well be appropriate 
is the suppression of generalized blockage and leakage 
faults which tend to proliferate in certain aids, particularly 
where each fitting in a line is the subject of a separate 
examination. 

Consolidation of faults 

Consolidation of faults involves replacing a set of faults by a 
more limited set of equivalent faults. It is applicable mainly 
where a line has been decomposed into its constituent 
elements, each with its associated fault set. The use of con¬ 
solidation requires suitable rules, the formulation of which 
may not be trivial. This contrasts with suppression, which 
is readily implemented. 

Evaluation of faults 

Evaluation of faults may take several forms. One is the 
application of expert rules, another is the use of landmark 
values and a third is the use of susceptibility data. 
Some types of rule for evaluation include those associated 
with (1) consequences, (2) product of consequence and 
frequency, (3) frequency, (4) classic hazard situations, 
(5) plant equipments, (6) protective devices, (7) unrevealed 
failures and (8) process variables.There will be some events 
so serious that they are unacceptable virtually regardless 
of the frequency. There will be others where the product 
of (consequences x frequency) is an appropriate filtering 
criterion. There may be others, applicable to low con¬ 
sequence events, where only the frequency is of interest. 
There are certain classic situations such as thermal 
expansion of blocked-in fluid. There are certain pieces of 
equipment such as pump sets where there are classic 
hazards and solutions. There are certain classic aspects of 
protective devices such as a pressure relief valve where the 
set pressure may not be exceeded but where capacity may 
be. There are certain rules, displayed in hazops, as to how 
to handle unrevealed failures, particularly in instruments. 
There may be rules governing process variables such as level 
or pressure. One way of developing evaluation rules is to 
identify the features that trigger interest on the part of 
members of a hazop team. 

Another method of evaluation is the use of landmark 
values. These are most likely to be associated with the fluid 
model. A typical application of a landmark value is to 
determine whether the fluid is likely to undergo a change of 
phase such as boiling or freezing. 

The third evaluation method mentioned above is the use 
of data on susceptibility or compatibility. This method is 
likely to be applicable mainly to the fluid and materials of 


construction models. Data on susceptibility may take the 
form of look-up tables or rules. 

The account of evaluation that has just been given 
implies that the way to proceed is to generate all possible 
faults and then to evaluate each one to determine whether it 
can be rejected. There is an alternative approach to evalua¬ 
tion which is to reverse the ‘burden of proof and to apply the 
default rule that no fault is retained unless there is good 
reason to do so. This is possibly closer to the modus oper¬ 
andi of a hazop team. Whichever approach is adopted, the 
information and rules required to support the identifica¬ 
tion decisions are broadly similar. 

Masking of faults 

Whatever the extent and effectiveness of the various forms 
of filtering, there remains the question of whether to dis¬ 
play in the output all the faults not removed by the filtering 
processes described or whether to practice some form of 
masking. 

In principle, masking is a relatively simple operation. 
It involves defining within the total information a subset 
that is not to be displayed and laying a mask over it. There 
may be a number of masks, each with its subset, and they 
may overlap, like Venn diagrams. 

A hierarchy of masks can be envisaged, with distinc¬ 
tions based on the severity of the failures involved, with a 
stringent mask for coarse hazard studies, etc. Alter¬ 
natively, the distinction may be based on the discipline 
involved, for example, control systems, pressure relief sys¬ 
tems, etc., for use by different parties to the design. There is 
also the option of user-configured masks. 

30.39.19 Query and action outputs 

The output from a conventional hazop study includes a 
list that is typically a mixture of queries and actions. The 
actions may vary in status from requirements to suggestions. 

The corresponding output for a computer aid is likely to 
contain a different mix, weighted more to queries, with 
proposals for positive action probably confined to certain 
limited areas. Effort is better employed in improving the 
quality of the queries rather than in extending the aid into a 
design tool. 

30.39.20 Explanation facility 

As described earlier, a standard feature of an expert system 
is the explanation facility. There is, in principle, no reason 
why such as facility should not be provided as part of a 
hazard identification aid, to be consulted in the probably 
small number of cases where the logic of the argument is 
unclear to the user. 

30.40 Fault Tree Analysis 

A large number of computer programs have been developed 
for the analysis of fault trees, which are often very large. 
The tasks carried out by these programs fall mainly into 
four categories. These are determination of: 

(1) minimum cut sets, 

(2) common cause failures, 

(3) reliability and availability, 

(4) uncertainty. 

Some of these codes are listed in Table 29.7. This table gives 
the references to the codes listed. Further references are 
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given in Table 29.1. One of the first sets of codes was PREP 
and KITT developed by Vesely and co-workers. PREP 
obtains the minimum cut sets and KITT evaluates reli¬ 
ability and availability. There are two versions, KITT-1 and 
KITT-2, the latter having the capability of handling time- 
dependent failure data. These codes have been widely used 
and were utilized in the Rasmussen Report. 

Another group of codes are those developed by Fussell 
and co-workers. These include MOCUS, BACFIRE and 
SUPERPOCUS for determining minimum cut sets, com¬ 
mon cause failures and reliability and availability. 

Codes for the determination of importance include 
IMPORTANCE, developed by Lambert. 

The Rasmussen Report included several codes. SAMPLE 
combines input distributions to give an output distribution. 
MOCARS determines the distribution of a tree top event. 


30.41 Fault Tree Synthesis 

As just described, there are available a number of computer 
codes for the analysis of fault trees. The synthesis of fault 
trees is a more difficult problem, but some progress has 
been made in developing aids for this. Again the codes 
utilize some form of fault propagation modelling. 

30.41.1 Fault tree drafting 

Some codes for fault tree construction are aids to the 
manual synthesis of fault trees. They include TREDRA 
and TREE. 


30.41.2 Fault tree synthesis codes 

There are a number of codes that have been developed to 
effect the automatic synthesis of fault trees. The different 
methods take different starting points, including: func¬ 
tional equations (e.g. B.E. Kelly and Lees, 1986a); graphical 
methods such as digraphs (e.g. Andrews and Morgan, 
1986); reliability block diagrams (e.g. Caceres and Henley, 
1976) and reliability graphs (e.g. Camarda, Corsi and 
Trentadue, 1978); logic models (e.g. Poucet, 1983) and logic 
flowgraphs (e.g. Guarro and Okrent, 1984); tabular meth¬ 
ods, such as decision tables (e.g. Salem, Apostolakis and 
Okrent, 1977) and transition tables (e.g. J.R. Taylor, 1982; 
Bossche (1991a—c); and mini-fault trees (e.g. Fussell, 
1973a,b; B.E. Kelly and Lees, 1986a). 


Some of these codes are summarized in Table 30.16. Most 
are probably best characterized as research codes. An 
account is now given of some of these methods. 

30.41.3 DRAFT 

An early code for fault tree synthesis was the DRAFTcode 
of Fussell (1973a,b). He used models which he termed com¬ 
ponent failure transfer functions, which are effectively a 
form of mini fault tree. He applied his method, which he 
called the SyntheticTree Model, to electrical systems rather 
than process plants, although the electrical systems con¬ 
sidered were on process plant systems. 

30.41.4 FTS 

The first fault tree synthesis code for process plants was 
the FTS code of Powers and Tompkins (1974a,b), further 
developed by Powers and Lapp (Powers and Lapp, 1976; 
Lapp and Powers, 1977a,b). These authors model the plant 
system using digraphs. Figure 30.17(a) shows the nitric 
acid cooler system used by Lapp and Powers, which has 
become a classic example, and Figure 30.17(b) shows the 
digraph given by the authors for this system. 

The fault tree is constructed by selecting the node for 
the top event of interest and then developing the tree for the 
causes of this event. For a given node, the causes are the 
inputs to the node. The tree is developed down to the basic 
events. Causes that violate consistency are deleted. 

Control loops are handled by means of an operator, which 
is essentially a loop structure imposed at the appropriate 
point in the development of the tree. Separate operators are 
used for feedback and feedforward loops. 

The fault tree obtained in this work has been subject to 
some discussion in the literature (e.g. Lambert, 1979; Lapp 
and Powers, 1979; Locks, 1979;Yellman, 1979). 

30.41.5 CAT 

Another early code for the synthesis of fault trees for pro¬ 
cess plants was the CAT code of Salem, Apostolakis and 
co-workers (Salem, Apostolakis and Okrent, 1975a,b, 1977; 
Apostolakis, Salem and Wu, 1978; Salem and Apostolakis, 
1980). In the CAT code the models used are cast in decision 
table form. The tree is then constructed by nominating a top 
event and developing its causes by selecting from the 
appropriate entries of the decision tables, using suitable 
procedures to maintain consistency. 


Table 30.16 Some computer codes for fault tree synthesis 


Code a 

Methodology 

Reference 

DIRAFT 

Failure transfer functions 

Fussell (1973) 

FTS 

Digraphs 

Powers and Tompkins (1974a,b); Powers and Lapp (1976); 
Lapp and Powers (1977a, 1979); Cummings, Lapp and 
Powers (1983) 

CAT 

Decision tables 

Salem, Apostolakis and Okrent (1977); Apostolakis, 

Salem and Wu (1978) Salem and Apostolakis (1980) 


Digraphs 

D.J. Allen and Rao (1980); D.J. Allen (1984) 

CAFTS 

Transfer logic models, mini-fault trees 

Poucet and de Meester (1981); Poucet (1983,1990) 

RIKKE 

Equation ‘bigraphs’,transition tables 

J.R. Taylor (1982) 

FAULTFINDER 

Propagation equations, mini-fault trees 

Martin-Soils, Andow and Lees (1982); B.E. Kelly and 

Lees (1986a-e); Mullhi etal. (1988); A Hunt etal. (1983a—e) 

AFTC 

Decision tables 

Sang Hoon Han etal. (1989) 

FISA 

Causal trees, transition tables 

Bosche (1991a-c) 


a Synthesis codes usually have a drafting package also. 
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Figure 30.17 A nitric acid cooler system (Lapp and Powers, 1977a): (a) flow diagram; (b) diagraph 
(Courtesy of the Institute of Electrical and Electronic Engineers) 
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30.41.6 RIKKE 

The RIKKE code of J.R. Taylor (1982) utilizes the so-called 
equation ‘bigraph’, transition table and mini-fault tree 
models. The construction of the tree proceeds by selecting a 
top event and developing its causes by tracing through the 
mini-fault trees, with procedures to maintain consistency. 
Taylor characterizes his fault construction algorithm as 
utilizing a component-by-component construction and 
contrasts it with that of Lapp and Powers, which he 
describes as a loop-by-loop method. A feature of Taylor’s 
method is the use of a larger set of deviations than simple HI 
and LO, such as VHI and DIST HI. 

30.41.7 FAULTFINDER 

Another code for fault tree synthesis is the FAULTFINDER 
code of B.E. Kelly and Lees (1986a-e) and A. Hunt et al. 
(1993a—e). This is described in the following section. 

30.41.8 Loop structure methods 

The methodology for fault tree construction described is 
essentially component oriented, but this is not the only 
approach that may be adopted. An alternative is a structure 
oriented method in which the structure of the tree is deter¬ 
mined from the outset by that of features such as the control 
and trip loops. This type of approach is illustrated in the 
work of Shafaghi, Andow and Lees (1984) and Shafaghi, 
Lees and Andow (1984). 

30.42 Fault Tree Synthesis: FAULTFINDER 

A more detailed account is now given of one particular code 
for fault tree synthesis. This is the FAULTFINDER code 
described by B.E. Kelly and Lees (1986a-e) and A. Hunt 
etal. (1993a-e). 

In this work the models are formulated initially in terms 
of functional equations of the type described in Section 
30.36. The building blocks for the fault tree synthesis, 
however, are mini-fault trees, described in the earlier work 
of Martin-Solis, Andow and Lees (1982). The mini-fault 
trees are constructed automatically from functional equa¬ 
tion models. 

The overview of FAULTFINDER that follows, both 
illustrates another application of fault propagation model¬ 
ling and serves as an example of a fault tree synthesis code. 
The description is necessarily highly simplified. 

30.42.1 System decomposition 

The system decomposition is essentially similar to that 
used in the HAZID code. The piping and instrument dia¬ 
gram is converted to a block diagram and for each unit in 
the latter a unit model is specified, drawing on a library of 
models, with additional models configured by the user if 
necessary. 

It is also necessary to provide certain structural infor¬ 
mation. The main information required relates to the con¬ 
trol and trip loops. For each loop the instruments 
comprising the loop and the streams immediately affected 
by the action of the loop are identified. 

30.42.2 Unit and top event models 

The code uses the basic fault propagation methodology 
described in Section 30.36. A plant unit is modelled in 
the first instance using any combination of three forms: 
propagation equations, event statements and decision 
tables. The propagation equations are used to represent the 
propagation of a disturbance, or fault, through a unit and 


the event statement to describe the initiation of a fault in 
a unit. The decision tables are used mainly to represent 
relations involving AND gates. 

From these three forms of input are constructed the mini¬ 
fault trees for the units. For each output from the unit there 
are at least two mini-trees, one for the deviation HI and one 
for LO.The top event of a mini-tree, therefore, is a deviation 
of an unit output. The mini-tree has only one level below 
this top event, the events in this level consisting of either 
variable deviations or basic faults. 

The derivation of a mini-tree in a unit model proceeds as 
follows. Consider the relation given earlier for flow through 
a pipe 

Q 2 out = /(Gi in, Gz out) [30.42.1] 

and the event statements 

PART-BLK Q 2 out LO [30.42.2] 

LK-LP-EN: Q 2 out LO [30.42.3] 

The propagation equation states that Q 2 is LO if Gi or G 2 
is low. The event statements state that Q 2 is LO if there 
occurs the fault PART-BLK (partial blockage) or the fault 
LK-LP-EN (leak to low pressure environment). The result¬ 
ant mini-tree is shown in Figure 30.18(a). Separate but very 
simple mini-tree models are used for the top events. Figure 
30.18(b) shows a top event model for the event VES-RPT 
(vessel rupture). 

The configuration of a unit model is carried out using the 
model generation program. The data are entered on a pro¬ 
forma essentially similar to that used in HAZID and shown 
in Figure 30.15, but the output generated by the program 
consists in this case of the set of mini-fault trees for the unit. 

The methodology includes various aids to reduce the 
modelling effort, and to achieve a degree of automatic 
modelling. There is a facility to generate automatically the 
event statements for certain standard faults at ports. There 
are programs and template models for the configuration of 
vessels. And there are also some basic archetypes of other 
units such as reactors and heat exchangers. 

30.42.3 Fault tree construction 

Fault tree construction starts by nominating a top event, 
retrieving first the appropriate top event model and then 
the unit mini-trees that have as their top event the causes 
of the variable deviations that are the causes of the top 
event. The causes of the top events in this first set of mini¬ 
trees are then in turn developed using further mini-trees. 
The development continues until the base events in the 
mini-trees are either basic failures or events crossing the 
boundaries of the system. The principle of tree construc¬ 
tion is therefore very simple. The complications arise 
mainly in ensuring consistency and in handling certain 
structures in the plant. 

30.42.4 Tree consistency 

There are two main types of consistency that need to be 
maintained: series consistency and parallel consistency. 
In essence, series consistency means that an event cannot 
be caused by its obverse. Also it cannot be caused by itself. 
An event may also be inconsistent with certain faults. 
Series consistency is checked as the tree is developed. 
Parallel consistency is the consistency of events in one 
branch of the tree with events in other branches of the tree 
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(b) 

Figure 30.18 FAULTFINDER: some mini-fault trees (after B.E. Kelly and Lees, 1986a; A. Hunt et at., 1993e): 

(a) mini-fault tree for event Q 2 LO (LK-LP-EN, leak to low pressure environment; PART-BLK, partial blockage); 

(b) mini-fault tree for top event VES-RPT (vessel rupture) (LT-BR-FR, low temperature brittle fracture; MECH-DEF, 
mechanical defect; OVERPRES, overpressure) 


under an AND gate. The check on parallel consistency is 
made during the rationalization stage that follows con¬ 
struction of the crude tree. 

30.42.5 Tree structures 

It is found that there are certain structures in a plant which 
need to be given special treatment, notably control loops, 
trip loops and divider-header combinations. The fault tree 
for a plant may be regarded as a composed of a basic 
demand tree, devoid of all control and trip loops, with the 
control and trip branches then added to it. Manual con¬ 
struction of a fault tree essentially proceeds by creating 
first the demand tree and then adding the control and trip 
branches. The structure of the tree is largely determined by 
these features. 

It is desirable that an automatically constructed tree 
retain this general structure. But in any case it is found that 
problems arise in the construction of the tree unless some 
information on the control and trip loop structure is explic¬ 
itly provided. It is possible in principle to limit the input 
information to the basic unit connectivities and to have the 
program identify the loops, but it is simpler to provide this 
information as part of the input. 

Another type of structure that needs special treatment is 
combinations of dividers and headers.These occur in many 
guises, such as the suction and delivery manifolds of a pair 
of pumps or a control valve with a bypass. In some cases 
divider-header combinations are nested and in others they 
are staggered. In the case of divider-header combinations 
manual identification is complicated, and the program is 
provided with an algorithm to effect identification. 


For the control and trip loops, use is made of templates 
that impose a structure on the tree at the point in tree 
development where the loop is encountered. For control 
loops use is made of three such templates. One of the tem¬ 
plates, shown in Figure 30.19, is for a controlled variable in 
either a feedback or feedforward loop. The other two are for 
a manipulated variable, one in a feedback loop and the 
other in feedforward loop. 

For trip loops a distinction is made between functional 
failure (failure to operate on demand) and operational 
failure (spurious trip). Atemplate is used for functional fail¬ 
ure, but not for operational failure, which is treated on a 
par with any other failure which disturbs the system. 

30.42.6 Fluid and materials of construction models 

The methodology allows for the supplementation of the 
unit models by models for the process fluids and for the 
materials of construction. Essentially, these models handle 
various kinds of susceptibility, whether to phase change or 
to corrosion. The general approach is similar to that used in 
the HAZID code. 

30.42.7 Tree rationalization 

Once the crude fault tree has been constructed it is neces¬ 
sary to rationalize it. Rationalization involves a number 
of operations. These include: checking for parallel con¬ 
sistency; elimination of certain branches where the base 
event is impossible or, alternatively, certain; and rationali¬ 
zation of the branches of control loops. It is at this stage that 
the attachment of the trip loop functional failure branches 
occurs, the treatment during the initial construction being 
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Figure 30.19 FAULTFINDER: template for a controlled variable deviation, in either a feedback or a feedforward loop 
(A. Hunt et at., 1993c) (Courtesy of Elsevier Science Publishers) 


limited to identification of the variables that are protected 
by the loop. 

30.42.8 Sequential operations 

A sequence of operations may be handled by treating each 
step separately and re-initializing the configuration at each 
step. An overall fault tree then takes the form of tree with a 
top event SEQUENCE FAILS, with the two events ANDed 
together at the next level down SEQUENCE FAILS AT 
STEP 1 and SEQUENCE FAILS AFTER STEP 1, and so on. 

In this connection, it merits mention that the top event of 
a fault tree does not need to be a hazardous event. It can also 
be an event such as SEQUENCE ABORTS in, say, a com¬ 
puter controlled sequence. 

30.42.9 Other features 

The methodology also accommodates a number of other 
features. Changes to control and trip loop set points 
normally receive no special treatment. Control exercised by 
a human operator or process computer that is equivalent to 
a conventional control loop is modelled as a notional loop. 

Failures of utilities may be modelled either as inde¬ 
pendent failures in individual units or as inputs from a 
common supply which is itself subject to complete failure. 
This latter method may also be used to model other com¬ 
mon cause failures. 

30.42.10 Model generation and model library 

The general approach to model generation and to the model 
library in FAULTFINDER is that outlined in Section 30.36 
for fault propagation in general and in Section 30.38 for 
HAZID. Unit models are stored in the unit model library as 
sets of mini-fault trees. Details of the library are given by 
B.E. Kelly and Lees (1986c) and A. Hunt etal. (1993a). 

A new model is generated by completing a proforma on 
which are entered the functional equations, event state¬ 
ments and decision tables, if any, for the unit. The mini¬ 
fault trees of the model are then generated automatically. 
Generation of new models for vessels is assisted by the 
provision of a taxonomy of ports, by partial automation of 
the modelling of ports and by the use of a special vessel 
model generation program and of vessel archetypes, or 
templates. 

30.42.11 Computer codes 

The main programs in the FAULTFINDER package are: 
MASTER, which does the housekeeping; FAULT, which 


constructs the tree; and MODGEN and EVTGEN, which 
generate the unit models and top event models, respec¬ 
tively. There are model libraries for unit models and top 
event models. Use is also made of various other programs 
for fault tree drawing and of standard programs for fault 
tree analysis. 


30.42.12 Illustrative example: pump changeover 

Numbers of examples of fault trees constructed by the 
program are given in the accounts by B.E. Kelly and Lees 
(1986a-d) and A Hunt etal. (1992a-e). Avaporizer example 
is given by Mullhi et al. (1988). 

An illustrative example of fault tree construction using 
FAULTFINDER is given by B.E. Kelly and Lees (1986d). 
The system considered is the pump system shown in Figure 
30.20. The problem was to identify the potential causes of 
abortion of a 14-step changeover sequence. The configura¬ 
tion block diagram is shown in Figure 30.21. The fault tree 
for Step 8 of the changeover is illustrated in Figure 30.22, 
the key for which is given in Table 30.17. The initial entries 
in the table of the minimum cut sets for this step, obtained 
by a fault tree analysis code, are shown in Table 30.18. 
The original paper gives further details, including listings 
of the steps in the sequence, the unit models used, the 
sequence steps and abort conditions, the configuration at 
each reinitialization and the minimum cut sets. 


30.43 Operating Procedure Synthesis 

There are relatively few computer aids for the examination 
of plant operations such as start-up and shut-down, 
although it is often in these phases that incidents occur, but 
progress is now apparent in the synthesis of operating 
procedures through the application of Al planning tech¬ 
niques. Pioneering work in this area was the study of Rivas 
and Rudd (1974) on the synthesis of operating sequences for 
valves. 

With the progress made in Al planning techniques, 
operating procedure synthesis (OPS) for process plants has 
become a more active area. Studies include those done on 
valve operations by O’Shima (1983), on operating proce¬ 
dures by Fusillo and Powers (1987,1988b) and Aelion and 
Powers (1991), on valve operations by Foulkes et al. (1988), 
on purging procedures by Fusillo and Powers (1988a), on 
operating procedures by Lakshmanan and Stephanopoulos 
(1988a,b, 1990) and Soutter and Chung (1995a,b) and on 

























Figure 30.20 FAULTFINDER: illustrative example - a pump system (B.E. Kelly and Lees, 1986d) 
(Courtesy of Elsevier Science Publishers) 







































Figure 30.21 FAULTFINDER: illustrative example - configuration block diagram for pump changeover system 
(B.E. Kelly and Lees, 1986d) (Courtesy of Elsevier Science Publishers) 

























30/84 ARTIFICIAL INTELLIGENCE AND EXPERT SYSTEMS 




Figure 30.22 continued 
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Figure 30.22 FAULTFINDER: illustrative example - pump changeover sequence; fault tree for step 8 
(B.E. Kelly and Lees, 1986d) (see Table 30.17 for key) (Courtesy of Elsevier Science Publishers) 


batch processes using qualitative process theory by 
Rotstein, Lavie and Lewin (1992). 

Several of these studies are now described. But first it is 
pertinent to make one or two points on the relationship of 
OPS to AI planning. 

30.43.1 Unsafe states 

In the application of planning to process operations it is 
obviously necessary to pay particular attention to the 
avoidance of undesirable, and especially of unsafe, states. 
Insofar as much AI planning work has been concerned with 
robots operating in blocks world, the question of unsafe 
states has tended to be less urgent. Techniques for handling 
the unsafe state problem are not well developed in AI 
planning. In process operations, however, the avoidance of 
unsafe states is very much to the fore. The avoidance of 
unsafe states is an essential requirement of an OPS planner 
and may well govern the choice of planning algorithm. In 
seeking to avoid unsafe states, an advantage lies with a 
planning strategy in which actions are added one at a time 
and the safety of the new state is confirmed before pro¬ 
ceeding further; in other words with a forward-chaining, 
linear planner. 

30.43.2 Valve operations 

Much of the work described on OPS has been concerned 
with the synthesis of sequences of valve operations. From 
the point of view of planning, the crucial feature of valve 
operations is that they are not readily handled by a simple 
planning operator. The problem is that an action in which a 
valve is closed or opened does not have a unique set of 
effects. The effects depend on the state of the whole system. 
For example, if a line contains two valves in series, the 
effect of opening the upstream valve is not unique, but 
depends on whether or not the downstream valve is already 


open. One solution to the valve operations problem is to 
make use of domain specific knowledge. 


30.43.3 Valve operations: method of 
Rivas, Rudd and Kelly 

Historically, research in this area started with two pieces of 
work by Rudd and co-workers, one concerned with analysis 
and the other with the synthesis of valve operating 
sequences. Strictly, only the latter constitutes OPS, but it is 
convenient to describe first the work on analysis. 

In their study, Rivas, Rudd and Kelly (1974) considered the 
analysis of a proposed valve sequence to determine whether 
it was hazardous. Such an analysis may be used to obtain a 
safe sequence for incorporation in operating instructions or 
it may be made the basis of a real-time software interlock 
system which leaves it to the operator to propose a valve 
sequence, but inhibits any hazardous sequence. 

The possible states of the chemical species are shown in 
Figure 30.23. In pattern (a) the species A flows through the 
system without other contact; in (b) species A and B join 
and share a common path through the system; in (c) A is 
stopped in the system by a closed valve; in (d) A is trapped 
within the system by two closed valves; in (e) A is even¬ 
tually flushed from the system leaving the connector 
empty; in (f) A is held in the system not by closed valves as 
in (d) but by the driving force causing the flow of species B. 

A simple network of connectors is shown in Figure 30.24. 
It consists of two inlets through which species 1 and 2 
(square boxes in Figure 30.24), respectively, can enter, an 
internal loop of three connectors and one outlet connector. 
The structure of this network is given in Table 30.19, which 
shows, according to the nomenclature of Figure 30.25, the 
number of each connector (plain numerals in Figure 30.24), 
the numbers of the two nodes associated with it (circled 
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Table 30.17 FAULTFINDER: illustrative example - pump changeover sequence; key to fault tree for Step 8 
(B.E. Kelly and Less, 1986d) (Courtesy of Elsevier Science Publishers) 

No. in 
fault 

Text 

No. in 
fault 
tree 

Text 

No. in 
fault 
tree 

Text 

1 

SEQ-FAT Step 8 

55 

R61REV 

109 

HV-F-SH Unit 15 

2 

SEN-F-HI Unit 67 

56 

P60 SOME 

110 

DT Row 1 Unit 17 

3 

SEN-F-STK Unit 67 

57 

HF-D-OP Unit 51 

111 

DT Row 5 Unit 17 

4 

P79 SOME 

58 

HV-F-OP Unit 51 

112 

R70REV 

5 

DTRowlUnit7 

59 

R87REV 

113 

R73REV 

6 

R7REV 

60 

P69 SOME 

114 

P50 SOME 

7 

P6 SOME 

61 

P59 SOME 

115 

DT Row 1 Unit 19 

8 

R8REV 

62 

A(DUMMY) Unit 52 

116 

SHUTDOWN Unit 17 

9 

P56 SOME 

63 

P64 SOME 

117 

A(DUMMY) Unit 60 

10 

R65REV 

64 

R61REV 

118 

R71REV 

11 

STARTUP Unit 6 

65 

P72 SOME 

119 

HV-D-OP Unit 50 

12 

R62REV 

66 

P68 SOME 

120 

HV-F-OP Unit 50 

13 

HV-D-OP Unit 49 

67 

R10 REV 

121 

R67REV 

14 

HV-F-OP Unit 49 

68 

P9 SOME 

122 

DT Row 3 Unit 21 

15 

R66REV 

69 

HV-F-OP Unit 51 

123 

HV-F-OP Unit 60 

16 

A(DUMMY) Unit 56 

70 

HV-D-OP Unit 51 

124 

HV-D-OP Unit 60 

17 

A(DUMMY) Unit 54 

71 

P69 SOME 

125 

R69REV 

18 

R63REV 

72 

R87REV 

126 

P68 SOME 

19 

R9REV 

73 

P71 SOME 

127 

A(DUMMY) Unit 57 

20 

NRV-F-OP Unit 3 

74 

P74 SOME 

128 

R68REV 

21 

P60 SOME 

75 

HV-D-OP Unit 57 

129 

R22 NONE 

22 

R61REV 

76 

HV-F-OP Unit 57 

130 

HV-D-SH Unit 22 

23 

HV-F-OP Unit 56 

77 

HV-D-OP Unit 11 

131 

HV-F-SH Unit 22 

24 

HV-D-OP Unit 56 

78 

HV-F-OP Unit 11 

132 

R87REV 

25 

R59REV 

79 

HV-D-OP Unit 49 

133 

HV-D-OP Unit 57 

26 

R10 REV 

80 

HV-F-OP Unit 49 

134 

HV-F-OP Unit 57 

27 

P59 SOME 

81 

HV-F-OP Unit 60 

135 

R87REV 

28 

A(DUMMY) Unit 51 

82 

HV-D-OP Unit 60 

136 

R13 NONE 

29 

P69 SOME 

83 

HV-F-OP Unit 62 

137 

P67 SOME 

30 

R87REV 

84 

HV-D-OP Unit 62 

138 

A(DUMMY) Unit 57 

31 

R10 REV 

85 

P68 SOME 

139 

R21REV 

32 

P9 SOME 

86 

P72 SOME 

140 

P20 SOME 

33 

HV-D-OP Unit 51 

87 

HV-D-OP Unit 57 

141 

HV-F-OP Unit 57 

34 

HV-F-OP Unit 51 

88 

HV-F-OP Unit 57 

142 

HV-D-OP Unit 57 

35 

P68 SOME 

89 

P71 SOME 

143 

R13REV 

36 

P72 SOME 

90 

P74 SOME 

144 

HV-F-OP Unit 50 

37 

HV-D-OP Unit 19 

91 

P63 SOME 

145 

HV-D-OP Unit 50 

38 

HV-F-OP Unit 19 

92 

P66 SOME 

146 

R74REV 

39 

HV-D-OP Unit 57 

93 

HV-D-OP Unit 60 

147 

A(DUMMY) Unit 62 

40 

HV-F-OP Unit 57 

94 

HV-F-OP Unit 60 

148 

R69REV 

41 

P74 SOME 

95 

HV-F-OP Unit 62 

149 

P68 SOME 

42 

P71 SOME 

96 

HV-D-OP Unit 62 

150 

HV-F-OP Unit 62 

43 

HV-D-OP Unit 11 

97 

HV-D-OP Unit 51 

151 

HV-D-OP Unit 62 

44 

HV-F-OP Unit 11 

98 

HV-F-OP Unit 51 

152 

R87REV 

45 

HV-F-OP Unit 62 

99 

HV-D-OP Unit 56 

153 

A(DUMMY) Unit 57 

46 

HV-D-OP Unit 62 

100 

HV-F-OP Unit 56 

154 

P67 SOME 

47 

HV-F-OP Unit 60 

101 

P3NOR 

155 

HV-D-OP Unit 57 

48 

HV-D-OP Unit 60 

102 

HV-D-SH Unit 1 

156 

HV-F-OP Unit 57 

49 

HV-D-OP Unit 11 

103 

HV-F-SH Unit 1 

157 

R21REV 

50 

HV-F-OP Unit 11 

104 

P2NOR 

158 

P20 SOME 

51 

HV-F-OP Unit 51 

105 

R14 NONE 

159 

R13REV 

52 

HV-D-OP Unit 51 

106 

PI NOR 

160 

HV-F-OP Unit 50 

53 

R60REV 

107 

R15 NONE 

161 

HV-D-OP Unit 50 

54 

A(DUMMY) Unit 51 

108 

HV-D-SH Unit 15 
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numerals) and the connectors which are common to the 
nodes. The connectors that can be closed by valves, in this 
case all the connectors, are shown by a valve 
symbol. 

Thus, for example, the last entry in the table states that 
the two ends of connector 6 have been denoted as 3 and 2, 
that connectors 3 and 5 join at node 3 and connectors 2 and 
4 at node 2, and that connector 6 can be closed by a valve. 

A proposed valve sequence is shown in Table 30.20 The 
authors give an analysis of the consequences of carrying 
out this sequence. The essence of the method is the use of 
symbolic logic to determine the consequences of proposed 
operations such as those put forward in Table 30.20. 


30.43.4 Valve operations: Rivas and Rudd planner 

The second, more difficult, problem in this work is the 
synthesis of safe valve sequences, considered by Rivas and 
Rudd (1974). This may be used to generate sequences for 
incorporation in operating instructions or to carry out real¬ 
time automatic sequencing. 

Figure 30.26 shows another simple network of connectors. 
The system is filled with air and the objective is to initiate 
flow of hydrogen to the low pressure outlet without allowing 
hydrogen and air to come into contact under pressure. 

The method is based on defining a hierarchy of succes¬ 
sively more explicit goals, as shown in Table 30.21. Level 0 
contains the overall goal; Level I goals are tasks, ordered to 
satisfy the Level 0 goal; and Level II goals are at the cause 


Table 30.18 FAULTFINDER: illustrative example - 
pump changeover sequence; some minimum cut sets of 
the fault tree for Step 8 (B.E. Kelly and Lees, 1986d) 


Minimum Cutset order Unit no. Faults 

cut set no. 


2 

3 


5 

6 


2 


2 


4 HV-F-SH 

6 STARTUP 

49 HV-F-OP 

67 SEN-STK 

67 SEN-F-HI 

9 NRV-F-OP 

11 HV-F-OP 

54 HV-F-OP 

57 HV-F-OP 


and effect level and are expressed as logical propositions. 
The objective is to get the computer to accept some inter¬ 
mediate level goal and then itself to synthesize the 
sequence. In this work the goals at Levels 0,1 and II were 
created manually whilst the valve sequence was synthe¬ 
sized by the program from the Level II goals. 

The planner used by Rivas and Rudd does not itself use a 
hierarchy of goals but is of the non-subgoaling type. It 
proceeds by adding actions in the order in which they will 
be executed. This facilitates checking to avoid unsafe states. 

In order to limit the search space, the heuristic is adopted 
that an action is not considered unless it contributes 
immediately to the achievement of a goal. In other words, 
the planner looks only one step ahead. The planner uses 
forward chaining without backtracking. As indicated 
earlier, this type of planner architecture is well adapted to 
the avoidance of unsafe states. On the other hand, the 
translation of high level into low level goals has to be done 
manually and the planner does not handle combinations 
and interactions of actions. 

30.43.5 Operating procedures: Fusillo and 
Powers planner 

Fusillo and Powers (1987) have extended the work of Rivas 
and Rudd to the synthesis of operating procedures in 
general. In this work procedure synthesis is represented as 
a state space and operators are used to move between states. 
A state is a vector of physical quantities such as flow, tem¬ 
perature and pressure, and of statuses of equipment such 
as valves and pumps. An operator represents the mani¬ 
pulation of equipment such as opening or closing a valve. 

Salient features of the method are (1) system decom¬ 
position, (2) modelling, (3) constraints and (4) planning. 
These are now considered in turn. 

System decomposition and stationary states 
A system decomposition is sought which minimizes the 
interactions between the subsystems. In the approach 
adopted, a subsystem is one or more major process units, 
is physically isolable and, preferably, has stationary states. 

A stationary state is essentially a quasi-steady-state 
condition. An example is a distillation column operating 
under total reflux. Stationary states are stable intermediate 
states and are invaluable in planning operating sequences. 

For a continuous plant, one start-up strategy is to estab¬ 
lish the stationary states of the subsystems with the path¬ 
ways between them closed and then to integrate the 
subsystems to obtain the desired plant operating state. 



Figure 30.23 Valve operations synthesis: states of chemical species (Rivas, Rudd and Kelly, 1974) 
(Courtesy of the American Institute of Chemical Engineers) 
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Modelling 

For each subsystem a set of global variables is defined. Each 
unit in the subsystem is modelled in terms of lists of effects 
that operations of the unit have on the variables in the 
subsystem. These effects are expressed in terms of a set of 
multiple discrete values (zero, low—low, low, medium—low, 
medium, medium—high, high, high—high). To aid plan¬ 
ning, each unit type is designated as a source or sink of one 
or more variables. For example, a heat exchanger may be 
marked as a source of temperature, or a compressor as 
a source of flow. 

Constraints 

Constraints arise from a number of factors. The authors list 
(1) pre-conditions of unit operations, (2) requirements for 
a reaction, (3) production requirements, (4) hazards and 
(5) materials of construction. Use is made of both global and 
local constraints. A global constraint applies throughout 
the system. For example, there may be a constraint that two 
substances that can give an explosive mixture should not 
be allowed to mix. A local constraint is a pre-condition for 
some process task. For example, a fired heater should not be 
started up unless there is flow through the tubes. 

Planning 

Planning is effected by identifying the conditions that 
must be changed by the operating procedures, translating 
the identified changes into tasks, and ensuring that the 
proposed sequence of tasks will achieve the overall goals. 

The planning method used is a modified means-ends 
analysis. Differences between the current state and the 
final goal state are computed. A set of intermediate goal 
states is formulated to reduce the difference between the 
current state and the final goal state. Movement from one 



Figure 30.24 Valve operation synthesis: network of 
connectors (Rivas, Rudd and Kelly, 1974) (Courtesy of 
the American Institute of Chemical Engineers) 


state to another is effected by the application of operators, 
which are manipulations of units in the subsystems. 

Planning proceeds in a hierarchical fashion. For exam¬ 
ple, the task of starting up a compressor has beneath it in 
the hierarchy the tasks of starting the seal flush and 
lubricating oil units. The planner takes an unordered list 
of manipulations, selects manipulations to achieve the goal 
and attempts to order the manipulations, using a depth- 
first search to effect the ordering. 

The planning therefore utilizes three main strategies 
to reduce the search space: (1) constraints, (2) a hierarchy of 
tasks and (3) stationary states. 

Computer program 

Fusillo and Powers describe a prototype computer pro¬ 
gram, POPS, which implements the planning method just 
described. The program is written in LISP. Use is made of 
a model library structured in the form of an is-a hierarchy. 

Illustrative example 

A chlorination plant is used by the authors as an illus¬ 
trative example of the application of the planning method. 

Actions, interactions and unsafe states 
The planner of Fusillo and Powers (1987) is characterized 
by Soutter (1993) as one that attempts to separate action 
generation and action ordering. It first uses means-ends 
analysis to generate all the necessary actions and then 
uses a search to order these actions. Soutter classifies 
this as a non-subgoaling planner. For such a planner a dif¬ 
ficulty is presented by interactions. This is so despite the 
attempts of the planner, described above, to minimize such 
interactions. 

Fusillo and Powers (1988b) have addressed the problem 
of interactions. When failure of the plan occurs, new 
actions are added. However, this modification means that 
actions are no longer added to the plan in the order in which 
they will be executed, which means that it is no longer so 
easy to check for unsafe states. 

30.43.6 Purging operations: Fusillo and Powers planner 

Another valve operations problem addressed by Fusillo 
and Powers (1988a) is the synthesis of purging procedures. 
In purging it is necessary to consider each species sepa¬ 
rately. Features of a purging procedure are (1) the purging 
fluid (2) the purging method and (3) the destination of the 
fluid purge. 

The general approach adopted resembles that used in 
the authors’ work on general operating procedures, as 
described above, in that it involves goal formulation, 
operator generation and task sequencing. There are, 


Table 30.19 Design of valve sequencing operations: structure of a network of connectors (Rivas, Rudd and Kelly, 1974) 
(Courtesy of the American Institute of Chemical Engineers) 


Connector 

Nodej 

Nodel 

Connectors joined to nodej 

Connectors joined to node l 

Species Valves 

1 

1 


4,5 

- 

1 X 

2 

2 


4,6 

— 

2 X 

3 

3 


5,6 

- 

X 

4 

1 

2 

1,5 

2,6 

X 

5 

1 

3 

1,4 

3,6 

X 

6 

3 

2 

3,5 

2,4 

X 
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however, certain differences that arise due to the nature of 
the purging problem. For goal formulation, it is not always 
possible to discover intermediate goals by the computation 
of differences as in a normal means-ends analysis. In such 
cases an alternative method is used which involves the 
discovery of goals by analysis of the global constraints. 



Figure 30.25 Valve operations synthesis: nomenclature 
(Rivas, Rudd and Kelly, 1974) (Courtesy of the American 
Institute of Chemical Engineers) 


Table 30.20 Design of valve sequencing operations: 
proposed valve sequence fora network of connectors 
(Rivas, Rudd and Kelly, 1974) (Courtesy of the American 
Institute of Chemical Engineers) 


Order of operation 
procedure 

Open valves 

Closed valves 

1 

1,3,5,6 


2 

2 

1,5 

3 

4 

2,3 


High pressure 



1 2 4 5 outlet 


1 2 3 4 5 


Initial state closed open open open closed 


Figure 30.26 Valve operations synthesis: second 
network of connectors (Rivas, Rudd and Kelly, 1974) 
(Courtesy of the American Institute of Chemical Engineers) 


For operator generation, the operators consist of sub¬ 
system-wide purge operations. The authors give as an 
illustrative example the synthesis of a purge sequence for a 
chloroform reaction system. 


30.43.7 Valve operations: Lakshmanan and 
Stephanopoulos planner 

Further work on the synthesis of valve operations 
has been described by Lakshmanan and Stephanopoulos 
(1988a,b, 1990). 

Lakshmanan and Stephanopoulos (1988a) review the 
state of planning in AI with particular reference to non¬ 
linear planning and to planning operators. They examine 
the problem of planning for operations such as valve 
sequencing and identify as a crucial problem that of the 
operators to be used. They consider the use of the STRIPS- 
style operator, which has a single set of preconditions and a 
single set of post-conditions, and rehearse its limitations. 
Such an operator cannot handle the situation in process 
plants where the post-conditions tend to depend on the state 
of the plant prior to application of the operator. They con¬ 
sider instead the functional operator, which has a number of 
sets of preconditions and of post-conditions such that a 
particular set of post-conditions is associated with a par¬ 
ticular set of post-conditions. However, they suggest that 
using functional operators renders planning intractable. 

In this and subsequent work, Lakshmanan and 
Stephanopoulos (1988b, 1990) describe a non-linear plan¬ 
ning method based on hierarchical modelling and utilizing 
domain-specific knowledge. In this method planning 
proceeds in two principal phases: (1) problem formulation 
and (2) plan synthesis. The problem formulation phase 
involves (1) initial state description, (2) goal state descrip¬ 
tion, (3) specification/identification of constraints and 
(4) specification/identification of stationary states. The 
plan generation phase involves (1) identification of primi¬ 
tive operations, (2) construction of a partial plan, and 
(3) synthesis of complete plans. 

The approach adopted is domain-specific and utilizes a 
hierarchy of models. At the first, and lowest level, are the 
system variables and parameters. Each variable or para¬ 
meter is formally defined as a collection of structured 
knowledge with attributes such as current value, current 
trend, range of values, etc. At the second level are the process 
‘streams’, which include flows of mass, energy and momen¬ 
tum. The third level consists of constraining relationships 
such as mass, energy and momentum conservation, flow- 
pressure drop relations, and so on. The fourth level is the 
constraining relationships of the sets of defined process 
operating conditions. There is a corresponding hierarchy of 
structures, starting at the bottom with models of actual and 


Table 30.21 Design of valve sequencing operations: hierarchy of goals for synthesizing valve sequences for second 
network of connectors (Rivas, Rudd and Kelly, 1974) (Courtesy of the American Institute of Chemical Engineers) 


Level 0 goal 

Level Igoal 

Level IIgoal 

Valve 

operation 

Initiate hydrogen flow to low 

Evacuate air 

Stop air flow 

Close 3 

pressure outlet 


Open system to low 
pressure outlet 

Close 5 

Final sequence (close 3, open 5, open 1) 

Initiate hydrogen flow 


Openl 
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notional ports, and rising through models of composite 
segments, of process units, of processing segments and of 
the complete plant. Planning then involves the identification 
of operators, their application to produce partial plans and a 
process of generate-and-test. The authors give as an illus¬ 
trative example a catalyst regeneration problem. 

In that it solves valve sequencing operation by the use of 
domain-specific knowledge, the program is not a general 
OPS planner. This planner also is characterized by Soutter 
(1993) as a non-subgoaling planner. 

30.43.8 Valve operations: planner of Foulkes et al. 

Another study of this kind is the work on valve and pump 
sequencing carried out by Foulkes et al. (1988). The authors 
begin with a statement of the OPS problem. In a typical 
process system there may be a very large number of poten¬ 
tial paths and thus a very large search space. Furthermore 
there are then likely to be a large number of solutions that 
are nearly, but not quite, correct. 

They give a formal treatment of the combinatorial 
explosion problem and illustrate it by considering the plant 
used in the work of Rivas and Rudd (1974), in which the 
number Mof on-off valves was 17. The number of different 
combinations of valve state is thus 2^ = 131,072. 

Foulkes et al. argue that where the number of potential 
valve changes is large, the prior formulation of operating 
sequences for infrequently performed operations is not 
practical and is not attempted. The purpose of the work was 
to devise a system that could be used off line to devise on 
demand a suitable sequence for a particular operation. 

They describe a method in which the plant is decom¬ 
posed into the elements ‘pipe fragment’ and ‘pump frag¬ 
ment’, which consist of a piece of pipe with a valve or a 
pump, respectively, on the end. Planning proceeds by 
searching first for paths and then for sequences of valve 
and pump operations, subject to constraints. 

The program was written in Prolog and illustrates the 
exploitation of the facilities of that language for declaring 
‘operators’, for ‘pattern matching’and for depth-first search. 

30.43.9 Operating procedures: Soutter and 
Chung planner 

An attempt to develop a general-purpose method OPS 
known as the Chemical Engineering Planner (CEP), is 
described by Soutter and Chung (1995b). This planner is 
intended to perform both general OPS tasks and valve 
operations synthesis. 

CEP is a hierarchical planner. It receives higher level 
goals and translates them into lower level goals. The plan¬ 
ning engine is complemented by an inference engine, which 
performs the goal translation just described. This inference 
engine uses backward chaining. CEP is believed to be the 
first planner to use both types of engine. 

CEP is described as a STRIPS-based planner, apparently 
primarily in recognition of its use of STRIPS-type operators. 
The planning engine in CEP, however, follows the strategy 
of least commitment, utilizing partial ordering. In other 
words, CEP is a non-linear planner. These two features of CEP, 
backward chaining and non-linear planning, keep it com¬ 
patible with the main thrust of development in Al planning. 

The planner in CEP is assisted by ‘agents’ that perform 
various specialist functions. One agent monitors conflicts, 
another advises on complex goals, and so on. 

The problem of unsafe states is handled in CEP in terms 
of global constraints. A global constraint is a set of unsafe 


states. Goals of prevention are used to prevent entry into an 
unsafe state. 

CEP utilizes a problems specification language. This 
language describes four types of knowledge: (1) the domain 
objects, (2) the operators, (3) the global constraints and 
(4) the problem specification. 

The inference engine utilizes inference operators. 
For example, the high level goal flow (inlet, outlet) is the 
establishment of flow from inlet to outlet of a pipe. This is 
translated by the inference engine using the appropriate 
inference operator into the lower level goals open (inlet, 
middle) and flow (middle, outlet). The latter is further trans¬ 
lated in a similar way. The relevant inference operator is: 

operator FindFlow 

( 

pipePa; pipe ?b 
pipe ?c; 

expand 
*flow(?a, ?b) 
using 

open(?a, ?b) 
flow(?c, ?b) 
end 

) 

In some cases an inference operator that defines a hier¬ 
archy is termed a hierarchical operator. 

As an illustration of planning using CEP, consider 
the problem of the start-up of a compressor described by 
I.S. Sutton (1992), in an account of the writing of operating 
instructions. The problem may be explained by reference to 
Figure 30.27. Figure 30.27(a) shows the compressor V-206 
itself. The task set is to shut-down compressor C-206. 
Figure 30.27(b) shows the steps in the shut-down sequence 
given by Sutton. 

For the planner the task is to achieve the goal shut-down of 
V-206 is true. Figure 30.27(c) shows the definition of V-206 
as an object. Figure 30.27(d) shows a typical hierarchical 
operator DoShutdown. Figure 30.27(e) shows the translation 
of the high level goal into the lower level, or induced, goals. 
Figure 30.27(f) shows atypical planning operator Checkldle. 

The operation of the planner is indicated by the follow¬ 
ing brief outline. The goal is shut-down of V-206is true. This 
goal is translated by the inference engine using the hier¬ 
archical operator DoShutdown into the three subgoals: 

(1) pressure of V-206 is atmospheric; 

(2) isolated of V-206 is true; 

(3) turned-off of V-206 is true. 

The planner selects the first subgoal and proposes the 
addition to the plan of the action Depressure. The corres¬ 
ponding operator has the pre-conditions 

(1) pressure of V-206 is medium; 

(2) bleed of V-206 is open; 

and the effect 

(1) pressure of V-206 is atmospheric. 

However, if this action is entered as the start of the plan, a 
global constraint is violated. This global constraint is that 
the bleed valve should not be open when the compressor is 
on. This constraint is violated because the initial state is 
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XV-2069 

(a) 


Close suction valve XV-2067 
Wait until pressure of V-206 pressure (PI-2065) 
is medium (less than 35 psig) 

Stop compressor (SW-2066) 

Confirm current through meter M-2066 zero 
Close discharge valve XV-2068 
Open bleed valve XV-2069 
Wait until pressure of V-206 is zero 
Close bleed valve XV-2069 


frame(compressor isa machine). 
instance(V-206 isa compressor. 
[Pressure Gauge is PI-2065, 
Switch is SW-2066, 

Meter is M-2066]) 

(c) 


(b) 


operator DoShutdown 
compressor ?c; 
expand 

• shutdown of ?c is true 

pressure of ?c is atmosphere; 
isolated of ?c is true; 
turned-off of ?c is true; 


KEY 


Shut-down 


(d) 



Close suction Wait Switch Wait for 

valve for medium off zero voltage 

pressure 


Close Open Wait for 

discharge bleed valve atmospheric 

valve pressure 


Close bleed 
valve 


(e) 


operator Checkidle 


compressor ?c; 
achieve 

■ checkidle of ?c is true; 
using 

state of ?c is off; 
end 


Confirm the current through meter; 
(?m) [Meter of ?c is ?m;] is zero'; 

(f) 


Figure 30.27 Operating Procedure synthesis: shut-down of a compressor (Soutterand Chung, 1995b): (a) Compressor 
system V-206; (b) steps in shut-down sequence (after Sutton, 1992); (c) definition of compressor V-206 as an object; 
(d) hierarchial operator DoShutdown; (e) translation of high level goal into low level goals; (f) planning operator Checkidle 


that the compressor is on. In order to prevent violation a 
new action is added to switch off the compressor before the 
action Depressure is taken. 

The OPS output given by the planner is essentially the 
same as that shown in Figure 30.27(b). 

30.43.10 Operation procedures network 

Most work on OPS is based on a component oriented 
approach. Work utilizing instead Forbus’ qualitative process 


theory (QPT) has been described by Rotstein, Lavie and 
Lewin (1992), who propose the concept of an operation 
procedures network (OPNet). 

The motivation for this approach is the deficiencies of 
the component based method in the treatment of batch pro¬ 
cesses. QPT lends itself better to the handling of the basic 
transformations of mass and energy in such processes. 

The method described by the authors involves the fol¬ 
lowing stages: (1) the definition and ordering of the mass 
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and energy balances, (2) their instantiation in a particular 
plant structure, (3) their ordering in space and time, and (4) 
the synthesis of the operating procedures. 

30.44 Process Monitoring 

Process monitoring has several aspects. One is the detec¬ 
tion of a disturbance or abnormality which falls short of an 
identifiable fault and which does not necessarily result in 
any process alarm. The second is the handling of alarms 
caused by some fault or operator action, the diagnosis of 
the fault and the response to it. The third is the detection of 
a incipient malfunction which has not yet resulted in a fault 
or an alarm. There are advanced methods, including AI 
techniques, which address all three of these. The first 
aspect is considered in this section and the others in the 
two subsequent sections. An overview of some of the 
methods available for these functions is given in Fault 
Detection and Diagnosis in Chemical and Petrochemical 
Processes (Himmelblau, 1978). 

30.44.1 Disturbance characterization 

One form of monitoring which is in widespread use is data 
reconciliation. It is important for process operation to have 
a valid mass and energy balance. Factors such as process 
transients and measuring instrument errors mean that it is 
not a trivial matter to obtain such balances. 

Data reconciliation is able to draw on a large body of 
work on estimation and filtering, and some form of data 
reconciliation is quite common practice. Quite separately 
from this, the process operator monitors the process and 
comes to a judgment as to whether it is in a normal condi¬ 
tion or whether there is a disturbance or abnormality. In 
doing this he or she makes use of his or her mental model 
and of heuristics such as limit, or landmark, values and 
rules of thumb. 

There is now emerging a formal approach to the inter¬ 
pretation of process information. Thus, Cheung and 
Stephanopoulos (1990) have described a methodology for 
transforming the information given by trend records into 
indicators of process state that are sufficiently quantitative 
to allow the operator to make powerful inferences about 
trends in variables which are not measured. 

Some of the difficulties faced by the process operator 
in interpreting process information are enumerated by 
Cheung and Stephanopoulos. Some causes of these diffi¬ 
culties are that there may be (1) process outputs changing at 
different rates, (2) dead time and inverse responses, 
(3) interactions between control loops, (4) conflicting 
information from sensors and (5) incomplete information 
due to lost’ sensors. The operator may therefore find it have 
difficult to (1) distinguish between normal and abnormal 
conditions, (2) assess current trends and anticipate future 
states, (3) identify the causes of these trends and (4) plan 
and schedule sequences of operating steps leading to a new 
operating level. 

Another approach is that described by Whiteley and 
Davis (1992). These authors treat the problem in terms of 
adaptive pattern recognition and develop a qualitative 
interpretation of the process information. 

30.44.2 Trend and state display 

Turning to displays of the process trends and state, com¬ 
puter graphics have made it possible to create displays that 
previously could not be contemplated. The starting point 
for the design of such displays should be a consideration of 


the operator’s tasks and problems, and a display should 
evolve as a solution to these. Otherwise there is a danger 
that the display will be a solution looking for a problem. 
Various types of display have been developed by computer 
manufacturers for loop parameters, trend records, etc. 

Display of system state is one of the most important 
types of display. Some illustrative examples of this type of 
display are given in Figures 30.28-Figure 30.31. 

Figure 30.28 represents a mimic diagram. This particu¬ 
larly display is simply a colour slide which the operator 
uses to help him identify equipments. VDU displays can be 
provided on similar lines with continuous updating of 
equipment status. 

Figure 30.29, after Wolff (1970), shows apolar plot of eight 
variables in which the length of each vector is proportional 
to the measured value. The vectors are scaled so that at the 
normal values their tips touch a common circle. Figure 30.30, 
after H.H. Bowen (1967), illustrates a rather similar princi¬ 
ple in which the variable vectors are scaled to form a com¬ 
mon surface, Figure 30.30(a) showing a normal condition 
and Figure 30.30(b) an abnormal one. Figure 30.31, after 
Stainthorp and West (1974), shows a status array for a dis¬ 
tillation column with methanol and propanol feeds. The 
rows represent process variables and the items in them 
absolute, deviation andrate-of-change alarms or the normal 
condition as shown in Figure 30.31(a). Figures 30.31(b)—(f) 
correspond to the conditions normal operation, severe 
upset, shut-down necessary, clear for start-up and near¬ 
normal operation (during start-up), respectively. 

Displays have been described for facilities such as manual 
control (e.g. Crawley, 1968), scheduling (e.g. Ketteringham, 
O’Brien and Cole, 1970; Ketteringham and O’Brien, 1974), etc. 
Other displays for activities such as malfunction detection 
are described below. 

The degree of sophistication in the information proces¬ 
sing underlying a display varies greatly and may not be 
apparent from the display itself. Thus, the polar and 
surface plots illustrated above require only scaling of the 
measurements, while other displays involve the use of 
predictive models, estimation techniques, etc. 


30.44.3 Multi-media aids 

Another development is the use of multi-media aids that 
exploit the potential of combinations of audio, visual and 
other forms of information presentation. Accounts are 
given by Alty and McCartney (1991) and Alty and Bergan 
(1992). 

The approach taken in this work to use multi-media aids 
under the control of a knowledge based system. Some media 
that are used in such work include: text, static graphics and 
diagrams, dynamic graphics, animation, sound, speech and 
video. There is a wealth of research available in the human 
factors literature on the relative efficacy of different media 
for the transmission of different types of information. 

A system that uses alternative media needs to be sup¬ 
ported by a resource management facility that selects and 
schedules the media. In the work described, use is made of 
a knowledge based system for this purpose. 

There is no lack of options for the design of such a sys¬ 
tem, but it is still early days in the development of the 
principles that should govern such design. Alty and Bergan 
(1992) have described a laboratory study involving the 
Grossman water bath experiment on manual control with 
multi-media aiding. Experiments on the use of multi-media 
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Figure 30.28 Computer graphics displays of system state - mimic diagram (The Boots Company Ltd), 

In the original display full use is made of colours. Coloured pipe lines in the original are shown in the above figure 
according to the code shown 



Figure 30.29 Computer graphic displays of system 
state - polar plot (after Wolff, 1970) (Courtesy of the 
Scienmic instrument Research Association) 


facilities in industrial process control rooms have been con¬ 
ducted and the reception is said to have been favourable. 

30.44.4 Expert systems 

There are also developments in the application of expert 
systems to process monitoring. There is a considerable 
monitoring element in the expert systems for process con¬ 
trol described in Section 30.35. In some expert systems, 
however, assistance to the process operator in assimilating 
process information is the prime aim. An example is 
ESCORT, described by Sachs, Paterson and Turner (1985). 

30.45 Fault Administration 

The second aspect of process monitoring is fault adminis¬ 
tration. One of the principal functions of a computer sys¬ 
tem in process control is to assist the operator in the 
handling of fault conditions. The use of the computer to 
enhance the alarm system has been described in Chapter 
14. Among the enhancements mentioned there are systems 
in which alarm diagnosis, or alarm analysis, is performed. 
In those early systems the alarm diagnosis facilities pro¬ 
vided were fairly basic and the data structure for the diag¬ 
nosis was created manually. Since then a good deal of work 
has been done on alarm diagnosis systems which have more 
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Figure 30.30 Computer graphic displays of system state - surface plot (after H.H. Bowen, 1967): (a) normal condition; 
(b) abnormal condition (Courtesy of Taylor & Francis Ltd) 
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F432 Steam to reboiler 


T433 Upper temperature 


T431 Bottom temperature 


L431 Base tank level 


L432 Reflux drum level 


X431 Methanol feed 


X432 Propanol feed 



(f) 


Figure 30.31 Computer graphic displays of system state - status array (Stainthorp and West, 1974): (a) Key to status 
array; (b) normal operation; (c) severe upset condition; (d) shut-down necessary; (e) clear for start-up; (f) near-normal 
operation (Courtesy of the Institution of Chemical Engineers) 


advanced facilities and in which the alarm data structure is 
generated automatically. 

The bulk of the work on fault administration has been 
concerned with alarm handling and diagnosis, although 
there is some work on other aspects such as on advice for 
corrective actions and on prediction times at which excur¬ 
sions across alarm limits will occur. 


Fault administration has proved particularly attractive 
to workers in AI and expert systems. For example, esti¬ 
mates of the proportion of applications of process industry 
expert systems that are in this field range from some one- 
third to one-half. 

A number of distinct phases may be discerned in work on 
alarm handling and diagnosis: (1) manual design of alarm 
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analysis systems for industrial nuclear power stations; 
(2) early explorations of the systematic creation of the alarm 
data structure; (3) disturbance analysis systems, prompted 
by the Three Mile Island accident; (4) expert systems and 
(5) various AI approaches, notably those based on model¬ 
ling and on neural networks. A review of developments to 
the third of these phases has been given by Lees (1983c). 

Fault administration is another field where qualitative 
modelling, including fault propagation modelling, plays 
a central role in many of the methodologies developed. 

30.45.1 Alarm structure and display 

Before describing some of the advanced aids developed for 
handling alarms, it is pertinent to consider the quality of 
the basic alarm system provided. It makes little sense to 
draft a sophisticated alarm diagnosis system onto a fun¬ 
damentally defective alarm system design. Two aspects of 
this design are of particular relevance. One is the structure 
of the alarms and the other their display. 

The issue of the structure of the alarm system has been 
addressed in several different ways. Some of these take as 
their starting point failures and others take the resulting 
undesirable events. Thus, one approach is to list the faults 
that it is desirable to be able to identify because they are in 
some way significant, and to assess the ability of the sys¬ 
tem to give an unambiguous indication that a particular 
fault, and no other, has occurred. In other words, an 
assessment is made of the degree of fault discrimination. 
The problem is akin to that of the observability of process 
variables. Work in this area has been described by Park and 
Himmelblau (1987). 

Another approach, described by Lambert (1977) and 
based on his concept of the probabilistic ‘importance’ of the 
events in a fault tree, is to create fault trees for the principal 
undesired events on the plant and to identify in each tree 
measurable events which rank high in importance. 

The approach taken by Modarres and Cadman (1986) is 
not dissimilar, but centres rather on the effectiveness of the 
alarm system in supporting the activities of the process 
operator. The method described is based on the use of goal 
trees for the operation of the plant and of decision trees, 
which can be constructed in parallel to show all the opera¬ 
tor actions required to achieve each goal and also the con¬ 
sequences of failure to achieve the goal. 

These various approaches are not, of course, mutually 
exclusive. 


30.45.2 Alarm trees 

Work on alarm diagnosis for process plants took as its 
starting point the use of alarm handling systems in nuclear 
plants, described in Chapter 14. Thus Welbourne (1965, 
1968) gives an account of the use of alarm trees. A simple 
alarm tree is shown in Figure 30.32. The alarm tree gives the 
relations between process alarms, and does so economically 
without duplication of information. There is no emphasis on 
any particular top event. Deduced alarms may be added to 
the tree, but the tree is self-sufficient without them. 

Early work on alarm diagnosis for process plants was 
done by Andow and Lees (Andow, 1973; Andow and Lees, 
1975) and Powers (1975). Andow and Lees explicitly took the 
view that alarms diagnosis was likely to find a role on pro¬ 
cess plants only if the necessary knowledge base could be 
created with reasonable economy, and that this knowledge 
base should consist primarily of models rather than rules. 


They describe a method for creating the alarm data 
structure based on fault propagation models of the type 
described in Section 30.36. The flow diagram is converted 
into a block diagram of linked unit models. The models 
used are simple functional models such as that of the mix¬ 
ing tank shown in Figure 30.33. This representation is then 
converted into a network of interacting process variables, 
effectively a digraph, and this network is then reduced to 
the network of those process variables on which there are 
alarms. The method utilizes list processing to produce 
the alarm network automatically from the unit models. 
Figure 30.34 shows two alarm trees for the mixing tank 
system. Whereas the conventional alarm tree is as shown 
in Figure 30.34(a), the alarm tree obtained by this method 
is that given in Figure 30.34(b). 

The type of display envisaged by Andow and Lees is 
illustrated inTable 30.22, which is a form of truth table. In a 
conventional truth table an active alarm is TRUE and an 
inactive one is FALSE. The truth value of deduced alarm X 
depends on the truth values of the set of process alarms. 
This deterministic approach may be replaced by a prob¬ 
abilistic one, as used in Table 30.22. In this table the 
evaluation TRUE is obtained if the sum of the products of 
the process alarms A-I and the probability weightings 



Arrows indicate direction of search for prime cause alarm 
A Process alarm 
© Deduced alarm 

Figure 30.32 Alarm tree including a deduced alarm 
(Andow and Lees, 1975) (Courtesy of the Institution of 
Chemical Engineers) 



Figure 30.33 Mixing tank system (Andow and Lees, 
1975). Functional model equations: dLs/dt= f(F A , F c ); 
dTM= f(T A ,L B , F a ); P a = f(T c , L B ; P B = f(P A L B ; F c = f(P B , 
P c ) (Courtesy of the Institution of Chemical Engineers) 
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Figure 30.34 Alarm trees for mixing tank system (Andow and Lees, 1975): (a) conventional alarm tree; 
(b) process variable-based alarm tree (Courtesy of the Institution of Chemical Engineers) 


Table 30.22 Modified ‘truth table’ containing probablities for a deduced alarm (Andow and Lees, 1975) 
(Courtesy of the institution of Chemical Engineers) 




Process alarms and the their probability weightings 



Target 

value 

Deduced alarm 
message 

A 

B 

C 

D 

E 

F 

G 

H 

/ 

0.7 

0.45 

0.8 

0.3 

0.65 

_ 

_ 

_ 

_ 

2.1 

Fault X 

0.3 

0.75 

- 

- 

- 

0.9 

0.8 

- 

- 

1.85 

FaultY 

- 

0.2 

0.45 

- 

0.65 

0.7 

- 

0.65 

0.3 

1.75 

Fault Z 


exceeds the target value, active alarms having a value 1 and 
inactive ones 0. The normal truth table is a special case of 
this more general table. 

30.45.3 Fault trees 

Another early approach taken to the creation of an alarm 
data structure is the use of fault trees. A fault tree shows the 
relation between the top event, which is usually some 
hazardous condition, and the bottom events, which are 
typically mechanical faults. It tends to emphasize these top 
and bottom events. A separate fault tree is needed for each 
top event. 

The use of alarm structures based on fault trees was 
suggested in early work by Powers and co-workers. An 
outline of an approach towards the synthesis of fault trees 
was been described by Powers and Tompkins (1974a,b), 
whilst Powers (1975) conducted experiments in which a 
fault tree was used to assist an operator to diagnose inert 
gas blanketing in a heat exchanger. The use of fault trees to 
create the alarm data structure was also investigated by 
Martin-Solis, Andow and Lees (1977). They used fault pro¬ 
pagation models to derive mini-fault trees, as already 
described in Section 30.42, and obtained alarm structures 
essentially similar to digraphs containing AND gates. The 
work showed that the veracity of the instrument readings is 
a significant problem in computer alarm diagnosis, just as 
it is in human fault diagnosis. 

This work on alarm diagnosis by Andow, Lees and co¬ 
workers was the origin of their work on fault propagation 
modelling, which has since found further application in 
hazard identification and fault tree synthesis. 


30.45.4 Disturbance analysis systems 

The accident in 1979 at Three Mile Island (TMI), described 
in Appendix 21, highlighted the importance of alarm 
systems and alarm diagnosis. The problems experienced 
by the operators led the task force to make recommenda¬ 
tions for the use of a safety status display and for work to 
establish the feasibility of a disturbance analysis system 
(DAS). 

TMI gave impetus to work in course at the Electrical 
Power Research Institute (EPRI), Palo Alto, California, 
described by Frogner and Meijer (1978,1980), Long (1980), 
Long et al. (1980) and Meijer, Frogner and Long (1980). 

An initial study was made of the potential benefits of a 
DAS. The assessment was made by selecting suitable 
nuclear power station subsystems, obtaining data on the 
outages of these subsystems in existing stations, and esti¬ 
mating the proportion of these outages which would prob¬ 
ably have been avoided using a DAS facility. An initial 
survey showed that out of 1161 outages there were 274 that 
appeared preventable by more rapid action aided by a DAS. 
These authors subsequently did work with an experi¬ 
mental DAS that showed appreciable reductions in operator 
response time between the two cases where the DAS was 
not used and where it was. 

Long gives an analysis of some of facilities that a DAS 
might provide. It could upgrade the plant signals and infer 
important parameters from simple analytical models, 
could monitor the mode of operation and compare the con¬ 
figuration with simple plant configuration models, and 
could recognize disturbances and provide assistance with 
procedures for off-normal conditions. 
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Figure 30.35 Disturbance analysis system: conceptual 
example of a cause-consequence tree and of a sequence 
of events in the tree (Frognerand Meijer, 1980): (a) cause- 
consequence tree; (b) sequence of events (Courtesy of the 
Electrical Power Research Institute) 

The DAS developed in this work utilizes a multi-level 
methodology. Level 1 is based on decision tables, the inputs 
to a table being one or more sensor signals and the output a 
message. Level 2 utilizes the cause-consequence tree 
(CCT) method. Level 3 provides a facility for the use of 
quantitative models. 

The Level 1 decision tables are relatively simple and 
serve to reduce the proportion of signals passed on to 
Level 2. The more complex signal patterns are analysed in 
Level 2 using the CCTs. The general form of the CCTs and 
the terminology used are shown in Figure 30.35. The tree in 
Figure 30.35(a) consists of nodes connected by arcs, the 
nodes being associated with attributes. These attributes are 
a variable identifier (VI, V2, ...), a required condition for 
the variable (HI, LO,...), a message identifier (Ml, M2,...), 
a logic gate (AND, OR,...) and a time delay (5 s, 10 s,...). 

The methodology defines a node as observable if it 
associated with a variable measured by a sensor. An 


observable node is given a required condition. If this con¬ 
dition is met, the node is active. A time delay is the 
expected minimum time between two events. If the 
observed time between two events is less than the time 
delay, or if the observed sequence does not correspond to 
that in the tree, it is assumed that the branch is not active. 
The use of time delays, therefore, contributes to the 
unique identification of a disturbance. If a node is active 
and it has associated with it a message, that message is 
also active. If a node is not active solely because the time 
so far elapsed is less than the time delay, the node and the 
associated message are potentially active. A typical 
sequence of events for the CCTshown in Figure 30.35(a) is 
shown in Figure 30.35(b). 

The status of a variable is shown by one of a set of 
status indicators. These status indicators are listed in 
Figure 30.36(a) and the state transition diagram for the 
indicators is shown in Figure 30.36(b). The normal value of 
a status indicator for a variable is S 0 . If a value goes outside 
its limit, the indicator is set at Si. When the disturbance 
analysis starts, the indicator is set at S 2 . The result of a 
disturbance analysis causes the indicator to be set at S 4 if 
a satisfactory message is determined or at S 3 if the cause 
cannot be found. Once the value is outside its limits, this 
value is latched for a period of T 1 seconds for an S 4 variable 
or T 2 seconds for an S 3 variable. If the value returns inside 
the limit, it is set at S 5 once the latching period has elapsed. 
Again the disturbance analysis is actuated, but this time 
with low priority and the indicator is set at S 6 . When the 
disturbance analysis is complete, the indicator is set at S 0 . 
Status indicators S 7 —S 9 and Si 0 are associated with algo¬ 
rithms that deal with spurious events and failure events, 
respectively Methods are given for the treatment of faults 
on, and of temporary excursions of, sensors. 

The data acquisition system (DAS) was tested on a 
training simulator and operated by process operators from 
nuclear power plants. In general, it behaved reasonably 
well, but the reduction in average operator response time 
from 34 to 30 seconds was not great. The time required 
for the operator to move physically to the appropriate part 
of the control room accounted for an appreciable fraction of 
the total response time in both cases. 

A number of human factors points emerged during this 
work, of which just one may be quoted. Frogner and Meijer 
(1980) state: 

The DAS effectiveness is reduced if the results of the 
diagnosis are presented without adequately conveying 
the status of the process. For the operator to exercise 
judgement and not just function as an automaton, he must 
understand the state of the plant and the reason for his 
action. In this respect, the condensed one-line DAS 
messages need improvement. It is recommended that 
future systems incorporate DAS messages into a more 
informative picture of the state of the process; for exam¬ 
ple, by using process and instrumentation diagrams. 

In this method, the CCTs are created manually by the 
analyst. Considerable effort was required to produce the 
model database, which is plant specific, and this effort was 
seen as a factor limiting application. 

Another major project on disturbance analysis which 
took place at about the same time was the joint project 
between the Gesellschaft fur Reaktorsicherheit (GRS) 
at Garching, in then West Germany, and the Institut for 
Atomenergi at Halden, Norway, involving development of 
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S 0 Normal condition: variable is within its specified limits 
S, Value was within limits and it just went outside 

5 2 Disturbance analysis is currently performed due to S, 

5 3 Analysis due to S, is complete: cause not known 

5 4 Analysis due to S, is complete: cause known 

5 5 Value was outside limits and it just went inside 

5 6 Disturbance analysis is currently performed due to S 5 

5 7 Too high a frequency of events has been registered for this variable. 
Analysis is being performed or waiting on DAS 

5 8 Variable causing spurious events 

5 9 Spurious event causing variable becomes normal. 

Analysis is being performed or waiting on DAS 

S, 0 False event 



Figure 30.36 Disturbance analysis system (Frogner and Meijer, 1980): (a) status indicators; (b) state transition diagram 
for status indicators. DISTAN denotes Disturbance Analyser (Courtesy of the Electrical Power Research Institute) 


DAS systems known as STAR for the nuclear power plants 
at Grafenrheinfeld and Biblis in the former country. 

As in the EPRI work the fault propagation is repre¬ 
sented by cause-consequence diagrams (CCDs). Some of 
the differences between the EPRI and GRS systems have 
described by Frogner and Meijer (1978) and Bastl and 
Felkel (1981). 


30.45.5 Expert systems 

One of the modes of operation of the commercial expert 
system PICON, referred to above in Section 30.36, is the 
alarm management mode. Accounts of its operation in this 
mode have given by Berkovitch and Baker-Counsell (1985), 
R.L. Moore (1985) and Rand (1987). The latter describes the 
creation of the rule base by observation of operators, inter¬ 
viewing of operators and operator input of rules, with the 
latter being favoured. 

An account of ESCORT, a system for detection and 
diagnosis of faults and the detection of instrument 
malfunction is given by Sachs, Paterson and Turner (1985). 


Two large expert system projects FALCON (Shirley, 1987) 
and REACTOR (WR. Nelson, 1982) on systems with large 
rule bases have been carried out and are reported to have 
had success in some applications. 

An expert system based on EXPERT has been developed 
by Mizoguchi (1983). The application described is fault 
diagnosis on a nuclear reactor primary cooling system. 
The rule base consists of some 76 rules, of which 6 
are finding-to-finding, 60 finding-to-hypothesis and 10 
hypothesis-to-hypothesis rules. 

In the expert system for malfunction diagnosis de¬ 
scribed by Shum et al. (1988), use is made of a hierarchical 
structure in which the nodes represent particular mal¬ 
function hypotheses. Use is made of the concept of 
‘specialists’, a concept used also in the design language 
DSPL, referred to in Section 30.27. There is a collection of 
‘specialists’ coordinated to arrive at an overall diagnosis. 
Each specialist possesses compiled and qualitative knowl¬ 
edge for the evaluation of a hypothesis. The method is 
claimed to be especially effective at handling multiple 
symptoms and multiple malfunctions. 
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There are a number of other systems which are described 
as expert systems, but which place emphasis on models as 
well as rules, as described below. 

30.45.6 Model-based methods 

Iri et al. (1979) have used digraph models to represent the 
alarm structure of a plant. This work has subsequently 
been developed in a number of studies, including those of 
Kokawa, Miyaki and Shingai (1983), Shiozaki et al. (1985) 
and Qian (1990). 

An expert system MODEX for malfunction diagnosis 
has been described by Rich and Venkatasubramanian 
(1987), and its successor MODEX2 has been described 
by Venkatasubramanian and Rich (1988). The system is 
based on a two-tier architecture, consisting of a bottom 
level of process specific, compiled knowledge and a top level 
of process general, deep level knowledge. An agenda-based 
inference control algorithm generates malfunction hypo¬ 
theses from structural and functional information about 
the process. Diagnostic reasoning alternates between the 
two levels. 

Finch, Oyeleye and Kramer (1990) given an account of 
a program MIDAS which diagnoses the causes of plant 
disturbances, including equipment degradation and 
failure, sensor failure, incorrect operation and external 
disturbances. The diagnosis utilizes an event model to 
construct clusters of events, each cluster being associated 
with a single fault. The program handles features such as 
variations in order of detection, complex dynamics, sensor 
failures and multiple plant failures. 

In the work of Ramesh, Shum and Davies (1988) the 
emphasis is on the nature of the tasks involved in diag¬ 
nosis. One task is associated with the plant sensor and 
another with the product quality data. Ramesh, Davies and 
Schwenzer (1992) develop this approach, with an investi¬ 
gation of the information processing tasks underlying 
diagnostic reasoning. 

The approach described by Grantham and Ungar (1990) 
differs from others in two main ways. It utilizes Forbus’ 
qualitative process theory (QPT), and it can automatically 
modify the unit models, allowing identification of faults 
that significantly change unit behaviour. The authors 
characterize their method as one that operates at a higher 
level of generality, and hence robustness, by giving the 
system an ability to create its own models from a descrip¬ 
tion of the substances and objects present and the prevail¬ 
ing process conditions. It has the ability to identify faults 
that change significantly the mode of operation of a unit, 
without the need for explicit fault modes. 

A prototype expert system PRODES for fault diagnosis 
is described by Lahadibi and McGreavy (1992). The system 
utilizes fault propagation models elicited from the user and 
cast in the form of decision tables. 

Saelid, Mjaavatten and Fjalestad (1992) have described 
an expert system for operator support with object oriented 
features and utilizing an expert system shell. The system 
detects disturbances in the connections between units, 
identifies the faulty unit and then initiates diagnosis of 
that unit. This internal unit diagnosis utilizes a combi¬ 
nation of process models, fault trees and Kalman filtering. 

30.45.7 Fault-tree-based methods 

Ulerich and Powers (1988) have described a method for 
fault diagnosis based on fault trees. This work extends the 
earlier work of Powers (1975) on this topic. It utilizes the 


FTS methodology for fault tree synthesis from digraphs 
developed by Powers and co-workers, as described in 
Section 30.41. A prior fault tree is created. From this prior 
tree there is then created a further fault detection tree in 
which there is attached to each basic event a verification; 
the event is treated as valid only if it is verified. The veri¬ 
fication consists of a set of process indications that must all 
be satisfied. 


30.45.8 Goal tree-success tree method 

The expert system GOTRES for fault diagnosis is de¬ 
scribed by Chung, Modarres and Hunt (1989). The system 
is based on the goal tree-success tree (GTST) method 
illustrated in Figure 30.37. The tree is developed from the 



Figure 30.37 An outline goal tree-success tree 
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process objective at the top, downwards to successively 
lower levels of goal. Since all goals are necessary for 
success, the logic gates relating the goals are all AND gates. 
The nature of the tree changes at the point where it is no 
longer possible to develop the tree without reference 
to hardware. Attached to each goal is a goal verification 
procedure that uses relevant process indicators to deter¬ 
mine whether the goal is satisfied. 

The authors state that experience shows that the use of 
a success tree rather than a failure, or fault, tree allows a 
more succinct treatment. They also suggest that a success 
orientation corresponds better to human thinking, and 
illustrate this with the analogy of a car journey, where 
the driver concentrates on the success paths rather than the 
failure paths. 

Chen and Modarres (1992) describe an expert system 
FAX for the diagnosis of faults and advice on corrective 
actions, with emphasis on the latter. The control objective is 
represented as a goal tree with success paths for both plant 
and operator inputs, and corrective actions are found by an 
adaptive search. 

30.45.9 Neural networks 

A quite different approach to alarm diagnosis is the use of 
neural networks, for which this appears a natural applica¬ 
tion, and a number of studies have been published. Neural 
networks were described in Section 30.21. Most of the work 
on such artificial neural networks (ANNs) is concerned 
with back-propagation networks (BPNs). The studies done 
cover learning, recall and generalization. 

Hoskins and Himmelblau (1988) explore the character¬ 
istics of ANNs desirable for knowledge representation in 
processes and illustrate their discussion with an account of 
the use of an ANN to discriminate between faults in a sim¬ 
ple process. 

A further exploration of ANNs is described by Ungar, 
Powell and Kamens (1990). ANNs are able to learn non¬ 
linear and logical relationships as well as linear ones. They 
describe work using an ANN on a simple process in which a 
comparison is made between performance with discrete 
inputs, that is, alarms, and with continuous inputs, that is, 
sensor readings, and also work on the effect of noise. 

Venkatasubramanian, Vaidyanathan and Yamamoto 
(1990) have studied the performance of ANNs under 
certain taxing conditions, including multiple faults and 
sensor faults. 

M.A. Kramer and Leonard (1990) consider particularly 
the problems of extrapolation outside the conditions cov¬ 
ered in the learning set. Such extrapolation becomes neces¬ 
sary when the learning set is undersized, when the parent 
distributions of fault classes undergo shifts, and when 
input data are corrupted by missing or biased sensors. They 
identify as a problem the inability of an ANN to detect when 
it lacks the data to effect a reliable classification. 

30.45.10 Response advice systems 

An account of a system for providing the operator with 
advice on the response to failures of critical safety func¬ 
tions is given by Nelson and co-workers (W.R. Nelson, 1984; 
W.R. Nelson and Blackman, 1985; WR. Nelson and Jenkins 
1985), who describe the Response Tree Evaluation project, 
one of those initiated following Three Mile Island. The 
purpose of the system is to select a response to provide by 
alternative means the safety function that has been dis¬ 
abled. The program creates a goal tree for the provision of 


the function, evaluates the availability of the various units, 
and searches for success paths. The search can be quite 
complex, since in general there is redundancy not only 
between units but within them. 

Reference has already been made to the work of Chen 
and Modarres (1992) on the expert system FAX for the 
diagnosis of faults and advice on corrective actions. 

30.45.11 Influence modelling and assessment system 

The bulk of the work described so far deals with engineer¬ 
ing problems of alarm diagnosis. It is necessary, however, 
to consider the ultimate function of such a system. This 
function is to provide support to the process operator, 
unless he be completely eliminated. As discussed in 
Chapter 14, the provision of an effective computer-based 
aid for the handling of alarms is fraught with difficulty. 

This problem has been addressed by Embrey (1986). He 
takes as his starting point the fact that whereas for most 
types of human error the probability of recovery tends to be 
high, for diagnosis it is low. 

In order to aid diagnosis, it is necessary to have some 
appreciation of the way in which the operator goes about it. 
In one view, the operator uses two distinct approaches. The 
first is the use of relationships between symptoms and 
faults. These are the symptomatic rules, or S-rules. They 
may be formally represented as a fault-symptom matrix 
(FSM). The other approach is topographic search. In this 
mode the operator makes a series of good/bad assessments 
based on his or her knowledge of the locations of and rela¬ 
tionships between system components. These are the 
topographic rules, or T-rules. Since the use of S-rules 
involves less effort, the operator will generally apply these 
first, before resorting to the T-rules. 

The FSM has been quite widely used in the process 
industries, and can be a useful aid to symptom based 
diagnosis, but it is rather inflexible and does not accom¬ 
modate changes over time. Alternatively, use may be made 
of symptom-based procedures. These effectively bypass 
overt diagnosis and proceed straight to actions. Such pro¬ 
cedures have been developed for nuclear plants following 
theThree Mile Island incident, but seem less applicable to 
process plants that are much more varied. 

The approach proposed by Embrey is the use of an 
influence modelling and assessment system (IMAS). 
The purpose of this is to assist an operator in making his or 
her own diagnosis, and more specifically to support the use 
of the T-rule approach. His or her understanding of the 
relationships in the process, both causes and consequences 
of events, is elicited and encoded as a subjective cause- 
consequence model (SCCM). 

Whatever the merits of this particular system, it is well 
to give the human aspect of fault administration its due 
share of attention. 

30.46 Malfunction Detection 

The third aspect of process monitoring is malfunction 
detection. The process computer can be used to detect or 
assist the operator to detect malfunctions before these give 
rise to alarm conditions. Malfunction detection, particu¬ 
larly in instruments, by the process operator, has been 
discussed in Chapter 14. Here consideration is given to the 
exploitation of the computer’s potential in this area. 

There are two basic methods of detecting malfunction 
in an equipment. These are to monitor (1) equipment 
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performance and (2) equipment condition. The checking of 
performance is exemplified by the determination of the 
characteristic of a pump or of the heat transfer coefficient 
of a heat exchanger, while the checking of a condition is 
illustrated by the measurement of a compressor bearing 
temperature or the observation of leakage on a valve. 

A classification of general methods of detecting mal¬ 
function in plant equipment such as compressors or heat 
exchangers, is as follows: 

(1) process variable incorrect; 

(2) equipment parameter incorrect; 

(3) equipment relationship incorrect; 

(4) equipment status incorrect; 

(5) equipment condition faulty. 

Probably the most common method of detection is from 
the fact that one or more process variables show the wrong 
value. Another check is that on a single parameter of the 
equipment, such as the efficiency of a compressor. Or a 
check may be made on a simple relationship such as the 
characteristics of a pump. Certain types of equipment, 
particularly mechanical handling equipment and regulat¬ 
ing elements, have discrete states which they should be in at 
various stages of process operation, and a check may 
therefore be made on equipment status. Alternatively, 
the equipment condition may be checked with respect to 
features such as vibration. The classification of checks for 
malfunction detection in instruments has been given in 
Table 14.6. 

The condition monitoring of plant equipment is an 
important activity on process plants and involves the use 
of specialized instrumentation and the interpretation of 
the signals obtained, and is described in Chapter 19. The 
aspect of interest here is the role of the computer as an aid in 
this area. 

The types of function that the computer can perform 
include scanning, smoothing and comparing signals, cal¬ 
culating indirect measurements, processing information 
through simple correlations and models, and generating 
displays. 

The use of process computers for malfunction detection 
as opposed to alarm monitoring was rather slow to develop. 
For some time the widespread activity of condition moni¬ 
toring made relatively little use of process computers. There 
has been, however, a gradual increase in the role of the 
computer in support of this function. 

The use of a computer to monitor reciprocating com¬ 
pressor performance by calculating quantities such as gas 
leakage and efficiency has been reported by Gallier (1968). 
Several different schemes are described with different 
instrumentation requirements. Benefits adduced by the 
author are the early detection of malfunction and also 
improvement of the load between parallel compressors. 

In another installation where reciprocating compressors 
are used in the on-off mode to maintain the pressure of air 
in receivers within fixed limits, the amount of time during 
which the compressors are on is used as a simple indication 
of possible trouble. 

Models of large centrifugal compressors are sometimes 
used for optimization purposes, but such models may also 
be used to monitor compressor characteristics as a means 
of malfunction detection. Other applications of the use of 
process computers in detecting malfunction in process 
machinery have been described in Chapter 19. 


Monitoring need not necessarily be confined to process 
machinery. The calculation of heat transfer coefficients in 
plant equipment by the process computer is quite widely 
practised. 

The principal method currently used for early detection 
of malfunction, however, is the measurement and analysis 
of equipment characteristics such as vibration, using spe¬ 
cial instruments. The signals obtained are often rather 
noisy and individual to the equipment. These character¬ 
istics suggest that there is scope for the use of the compu¬ 
ter’s ability for the smoothing and display of information. 

Another related development is the monitoring of unde¬ 
sirable operating conditions on the plant. This can be due to 
maloperation by the operator and it is sometimes possible 
for the computer to monitor this and display it to the 
operator. The display to the operator of the rate at which 
he or she is using up the creep life of furnace tubes is one 
industrial example of this. 

The same principle has been applied in the monitoring 
of control of ships, where the degree of maloperation is 
measured by instrumentation and analysed using estima¬ 
tion theory. The data are then displayed to the operator as a 
signal (Asbjornsen, 1976). 

Of particular importance to the computer system itself is 
the correct operation of the sensors and valves that are 
connected to it. The detection of malfunction in these 
instruments is now considered. 

30.46.1 Malfunction detection in individual instruments 

The detection of incipient malfunction in instruments may 
follow one of two approaches. In the first the check is made 
on an individual instrument, or at least a limited set such as 
a control loop, whilst in the second it is made on an ensem¬ 
ble of instruments, often in different parts of the plant. 

Some of the checks made by the process operator on 
individual instruments and control loops have already been 
described in Chapter 14. Many of the developments in 
checks that may be made by the process computer have 
analogues in those made by the operator. In those systems 
where computer checks on instruments have been imple¬ 
mented, the favoured methods generally have been checks 
on ‘hardover’ zero or full-scale signals and on an excessive 
rate of change in signals. 

These checks, however, by no means exhaust the poten¬ 
tial. The noise on a signal is often a useful indication of 
malfunction. Anyakora and Lees (1973) have described a 
method in which the noisiness of the signal is used as a 
check. The smoothed signal is subtracted from the crude 
signal to yield a noise residue, and a noise parameter is cal¬ 
culated from the sum of the squares of the noise residue 
taken over a group of readings.The technique has been used 
to detect the onset of malfunction in a thermocouple and in a 
flowmeter with freezing impulse lines. A modification of 
the technique has also been used to detect incipient sticki¬ 
ness in control valves. In this case the noise residue was the 
difference between the desired and actual valve positions, 
the latter being measured by a potentiometer. 

A method of detecting malfunction in any of the ele¬ 
ments in a flow control loop based on a comparison of the 
measured flow with the control valve position has been 
developed by Bellingham and Lees (1977b). The principle is 
that the valve position gives an additional indication of 
flow with which the actual flow measurement can be com¬ 
pared. The method assumes that the relation between flow 
and pressure drop through the system remains constant. 
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In the simplest case where the valve can be stroked over its 
whole range, the relation between the valve position and 
flow, or the valve characteristic, can be obtained, and any 
departures from the original characteristic can be deter¬ 
mined. It was found in practice that it is preferable to detect 
such divergence using a simple tracking estimator that 
generates an error residual. This method does not require 
the full stroking of the valve. The detection of faults rang¬ 
ing from flowmeter zero error to valve trim damage was 
demonstrated. 

This approach has also been applied by Bellingham and 
Lees (1977a) to the general control loop such as level, pres¬ 
sure and temperature, in which the measurements and the 
valve position are not as directly linked as in the flow con¬ 
trol loop. The loop studied was a level control loop. In this 
work use was made of an estimation method based on 
Kalman filtering. Again the method was successful in 
detecting faults ranging from level meter zero error to 
valve trim damage. A rather cruder check based on the 
same principle on the feed flow to a cement kiln has been 
described by Barton etal. (1970). 




<b) 


Most of these techniques may be used either to carry out 
an automatic check or to provide a display to assist the 
operator in checking. A display specifically developed to 
allow visual checking by the operator is that of an engine 
gimbal developed by H.H. Bowen (1967) and illustrated in 
Figure 30.38. Figure 30.38(a) and (b) show the step 
response of healthy and unhealthy gimbals, respectively; 
it is difficult to distinguish between them. Figure 30.38(c) 
and (d) show the corresponding phase plane displays; the 
difference is quite clear. 

Figures 30.39-30.41 illustrate the type of display which 
may be generated using the Anyakora and Lees (1973) 
technique of monitoring the instrument noise. Figure 
30.39(a) and (b) show, the noise parameter plots for a 
healthy and for a failing thermocouple, Figure 30.40(a) and 
(b) show those for a healthy flowmeter and for one with 
frozen impulse lines, and Figure 30.41(a) and (b) show those 
for a healthy and for a sticking control valve. 

The display shown in Figure 30.42 is a plot given by 
Bellingham and Lees (1977b) of the flow in a flow control 
loop as measured by the flowmeter (dotted line) and as 




Figure 30.38 Computer graphic displays for malfunction detection: phase plane plot of engine gimbal (after H. H. Bowen, 
1967): (a) step response plot - device healthy; (b) step response plot - device unhealthy; (c) phase plane plot - device 
healthy; (d) phase plane plot - device unhealthy (Courtesy of Taylor & Francis Ltd) 
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Figure 30.39 Computer graphic displays for malfunction detection: noise parameter plot for a failing thermocouple 
(after Anyakora and Lees, 1973): (a) thermocouple healthy; (b) thermocouple failing. The horizontal line represents 
the mean value of the noise parameter for a healthy instrument 



Figure 30.40 Computer graphic displays for malfunction detection: noise parameter plot for a frozen flowmeter 
(after Anyakora and Lees, 1973). (a) Flowmeter healthy; (b) flowmeter with impulse lines frozen. The horizontal line 
represents the mean value of the noise parameter for a healthy instrument 



Figure 30.41 Computer graphic displays for malfunction detection: noise parameter plot for a sticking control valve 
(after Anyakora and Lees, 1973): (a) valve healthy; (b) valve sticking. The horizontal line represents the mean value of 
the noise parameter for a healthy instrument 
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Figure 30.42 Computer graphic displays for malfunction detection: measured and inferred flow in a flow control 
loop (after Bellingham and Lees, 1977b): (a) loop healthy; (b) loop with flowmeter zero error. Measured flow; 
( - ) flow calculated from the valve position 



Figure 30.43 Computer graphic displays for malfunction detection: error residual in a flow control loop (after Bellingham 
and Lees, 1977b): (a) loop healthy; (b) loop with flowmeter zero error. The horizontal line represents the mean value of 
the residual for a healthy loop 


inferred from the control valve position (full line). The 
generation of this display requires the valve to be stroked 
over the whole range. Figure 30.42(a) and (b) show healthy 
and unhealthy loops, respectively. Another display is based 
on the generation of a residual error, which is more suitable 
if valve travel is limited. Figure 30.43(a) and (b) illustrate 
the display of this residual for the healthy and unhealthy 
cases. 

This account is perhaps enough to give a flavour of the 
work on malfunction detection. It illustrates the allocation 
to the computer and the operator of functions which they 
perform well, such as signal processing and display genera¬ 
tion on the one hand and pattern recognition on the other. 

More detailed accounts of malfunction detection have 
been given by Anyakora and Lees (1972a,b), E. Edwards 
and Lees (1973) and Whitman (1972). 


30.46.2 Malfunction detection in instrument ensembles 

The alternative approach to instrument malfunction detec¬ 
tion is to check whole ensembles of instruments. As stated 
in Section 30.44, it is not uncommon to check the con¬ 
sistency of sets of instrument readings which determine a 
relationship such as a mass or energy balance, although 
generally the concern here is more with data reconciliation 
than malfunction detection. 

The checking of ensembles of instrument readings for 
internal consistency has received increasing attention. 
Reviews of work in this area have been given by Willsky 
(1976), Himmelblau (1978) and Venkateswarlu, Gangiah and 
Rao (1992). An early example of work in this area is that of 
Goldmann and Sargent (1971), who used Kalman filtering 
to track the unsteady-state behaviour of the system and to 
detect sensor drift. 
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Venkateswarlu, Gangiah and Rao classify the quantita¬ 
tive processing of sensor data into three broad categories: 
data reconciliation and rectification; state estimation; 
and filtering and parameter identification. Work on data 
reconciliation is illustrated by that of Mah, Stanley and 
Downing (1976), Stanley and Mah (1977), Romagnoli and 
Stephanopoulos (1981), Madron (1985), and Narasimhan 
and Mah (1987). Work on state estimation methods is illus¬ 
trated by that of Willsky (1976), Watanabe and Himmelblau 
(1983) and Frank (1987); and work on filtering and para¬ 
meter estimation is illustrated by that of Isermann (1984), 
Park and Himmelblau (1983), Watanabe and Himmelblau 
(1983,1984) and Dalle Molle and Himmelblau (1987). 

30.47 Notation 


Section 30.20 

Gj information gain for attribute n, 

H c expected information content of message 

Hj information content for attribute; at node 

H jk information content for attribute 

in branch £ at node 
attribute counter 
k branch counter 

H jk proportion of objects having attribute 

in branch £ at node 

Section 30.26 

L level 

Q flow 

t time 


Section 30.8 

C certainty 

CF certainty factor 

Section 30.9 

/ Bayesian factor 

LN logical necessity 

LS logical sufficiency 

O odds 

P probability 

w weight of evidence 

Section 30.10 

F attribute 

n number of items in set 
«f number of items with attribute F 

Q fuzzy quantifier 

H A (x) grade of membership of x in A 

li F (x) membership function for attribute F 

Hq(x) membership function 

t truth value 


Subscripts 

1 inlet 

2 outlet 


Section 30.36 

L level 

G pressure differential 

P pressure 

Q flow 

U temperature in reverse flow 


Subscripts 

1 inlet 

2 outlet 


Section 30.42 

As Section 30.36 
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31.1 Preface 

Chemical process incidents can be accompanied by 
significant consequences, both in terms of human life 
and in financial impact. Many major chemical process 
incidents are the result of a complex scenario involving 
simultaneous failures of multiple safeguards. A robust 
system for incident investigation is usually necessary to 
determine and understand the causes, as well as imple¬ 
ment measures to prevent a repeat event. This chapter is 
intended to provide an overview of incident investigation 
by addressing major concepts, principles and character¬ 
istics of effective incident investigations of chemical pro¬ 
cess events. The focus is on incidents pertaining to 
chemical processes and their associated hazards, and the 
associated investigation techniques appropriate for com¬ 
plex systems and scenarios. This chapter is based on best 
practices for incident investigation, and those common 
concepts (i.e. tools, techniques, definitions) included in 
root cause investigation methodologies currently in the pub¬ 
lic domain in use in the process industry. It is not the inten¬ 
tion to provide a stand-alone investigation methodology/ 
guideline, nor address internal or proprietary investigation 
methodologies. 

This chapter is based on: 

• process industry best practices for incident investi¬ 
gation; 

• investigation concepts from the Mary Kay O’Connor 
Process Safety Center Root Cause Investigation 
Course; 

• Ted Ferry’s book on accident investigation (Ferry, 
1988); 

• Kuhlman’s Professional Accident Investigation 
(Kuhlman, n.d.); 

• CCPS Guidelines for Incident Investigation (second 
edition) (CCPS, AIChE, 2003); 

• NFPA 921 Standard for investigation of fires and 
explosions (NFPA, Standard 921 Investigating Fires 
and Explosions); 

• American Chemistry Council Responsible Care code 
(CARE®, n.d.); 

• US National Safety Council investigation guidelines 
(National Safety Council, 1995). 

This chapter begins with an overview of general incident 
investigation concepts and definitions to provide a 
common baseline. Section 31.3 is devoted to collection 
and analysis of evidence including a segment on investi¬ 
gation witness interviews, Section 31.4 addresses investi¬ 
gation team issues, and Section 31.5 is devoted to 
identifying root causes. Recommendations, reports and 
sharing lessons learned are presented in Section 31.6. 
The chapter concludes with Section 31.7, a review of Inci¬ 
dent Investigation Management System issues and sources 
for additional information related to process industry 
investigations. 


31.2 General Investigation Concepts 

31.2.1 Purpose and scope of incident investigation 

Effective discovery of root causes is not an easy or simple 
task. Successful investigation is an iterative process based 
on scientific principles with the ultimate purpose being 


prevention of a repeat event. It is systematic, thorough and 
intellectually honest. There are four stages that must be 
successfully completed in order to prevent a repeat event of 
a similar nature: 

• Identify what happened and how it happened (identi¬ 
fying and understanding the scenario). 

• Determine why it happened (identify the specific under¬ 
lying and contributing causes). 

• Identify preventive remedies (recommendations and 
action items). 

• Implement changes to existing practices and systems 
(accompanied by sharing lessons learned to all those 
who could benefit). 

Unless and until the preventive actions are actually 
implemented, the risk exposure level remains unchanged. 
It is not unusual in the chemical process industry for simi¬ 
lar incidents to occur in sister plants or in similar plants 
owned by another organization. There is a growing recog¬ 
nition of the importance of the actual implementation, 
resolution and follow-through of investigation recommen¬ 
dations. 

31.2.2 Definitions 
31.2.2.1 Causes 

Incident investigation terminology is, unfortunately, 
inconsistent across the process industry This creates 
communication challenges even within a single organiza¬ 
tion. In the United States, the term incident is generally 
used in the context of referring to any unplanned event 
that did, or easily could have, resulted in undesirable 
consequences. When an incident results in actual unde¬ 
sirable consequences, such as injury to people, the envir¬ 
onment, damage to equipment or adverse impact to 
operating profits, the event is most commonly labelled as 
an accident. The term near-miss is used in this chapter to 
describe an event that generated no actual adverse con¬ 
sequences, but with a slight change in circumstances, 
could have produced actual adverse consequences. 
Examples of near-miss events include: 

• dropping a crane load where there is no injury or 
damage; 

• demand challenge to a final protection device (such as 
emergency shut-down control systems); 

• events where there is unintended energy contact to 
employees without resulting in injury. 

One challenge to effective root cause incident investiga¬ 
tion is the absence of a consensus definition of the term root 
cause. There are several definitions in use. For the pur¬ 
poses of this chapter the term root cause is used to repre¬ 
sent: the underlying reasons that allow defects in systems 
(physical equipment and systems and/or administrative 
systems) to exist, that the organization can correct. These 
defects are the result of, and symptoms of, underlying 
causes. Examples of these defects include faulty design, 
inadequate behaviour or task execution, improper instal¬ 
lation, ineffective training or maintenance. An event itself 
(such as the breaking of a component) cannot by definition 
be a root cause. Some conditions or underlying reasons 
may not be under the control of the organization, and are 
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therefore not considered to be root causes. This issue is 
discussed in more detail in Section 31.2.3.1. 


Root causes = Underlying system-related reasons that 
allow system defects to exist, and that the organization 
has the capability and authority to correct. 

Events are not root causes. 


31.2.2.2 Management system perspective 
An understanding of management system perspective is 
useful in effective root cause identification. The term man¬ 
agement system is used in a variety of contexts. When 
people hear this term for the first time, their initial reaction 
is to think of the people in the nice offices on the top floor. 
However, the term management system does not refer to the 
individuals on the management team or the management 
team’s general approach and organization. For the purpose 
of this chapter, the term management system is used to 
represent the total administrative activities and aspects 
associated with a dedicated task or objective. Root causes 
are almost always associated with, and can be linked to, one 
or more weaknesses or breakdowns in administrative 
management systems. 

Management systems have common generic components 
such as: written procedures, training, performance expec¬ 
tations, required competencies and assignment of different 
responsibilities. When searching for root causes, the 
investigation team should examine the components of all 
management systems involved in the incident (CCPS, 
AIChE, 2003). Examples of management systems may 
include: lockout/tagout, training systems, written operat¬ 
ing procedures, process hazard analysis systems, man¬ 
agement of change systems, mechanical integrity and 
maintenance systems, and recognition and response to 
anomalies (process upsets, transfers of material). 

In this context, management systems have common 
generic components as shown in Figure 31.1, including 
defined inputs, defined outputs, a work process (and/or 
procedure), a training component, allocation of responsibili¬ 
ties, sustained allocation of resources, documentation, an 
audit and/or measurement component, a minimum required 
skillset and knowledge set, accepted ranges of performance 
defining success, and usually a continuous improvement/ 
quality assurance component (BS 8800,1996).The incident 
investigation system is a good example of a management 
system. An effective incident investigation system contains 
all the above generic components as well as those shown in 
greater detail in Section 31.7, Figure 31.12. The objectives 
and expectations of the investigation are clearly established. 
Performance standards are implemented, personnel are 
trained and specific documentation requirements estab¬ 
lished. Investigation task activities are well-defined, audit- 
able and effectiveness is periodically evaluated. 

31.2.3 Investigation general concepts 
31.2.3.1 General concepts for incident investigation 
For effective investigations, an honest, thorough and sys¬ 
tematic approach is needed. The investigation team should 
ethically and objectively consider all facts, information 
and evidence, and use scientific principles to identify 
and evaluate all plausible cause scenarios. Rejection of 


proposed scenarios should be based on physical evidence. 
Wherever and whenever possible, independent verification 
of information should be sought. 

Prematurely stopping before reaching the root cause 
level is a major and recurring challenge to most process 
incident investigations. One common error is to identify 
an event for a root cause, thereby prematurely stopping 
the investigation before the actual root cause level is 
reached. Events are not root causes. Events are results of 
underlying causes. It is an avoidable mistake to identify an 
event as a root cause (i.e. a loss of containment release, a 
mechanical breakdown or failure of a control system to 
function properly). 

One fundamental objective is to pursue the investigation 
down to the root cause level. Effective investigations reach 
a depth where fundamental actions are identified that can 
eliminate root causes. The most appropriate stopping point 
is not always evident. It is sometimes difficult to dis¬ 
tinguish between a symptom and a root cause. When the 
investigation stops at the symptom level, preventive 
actions provide only temporary relief for the underlying 
root cause. It is critically important and necessary to 
establish a consistently understood definition of the term 
root cause. If the investigation stops before the root cause 
level is reached, fundamental system weaknesses and 
defects remain in place pending another set of similar 
circumstances that will allow a repeat incident. The organi¬ 
zation will then be presented with another opportunity to 
conduct an investigation to find the same root causes left 
uncorrected after the first incident. 

For example, consider the case where the investigation 
stopped before reaching the root cause level. 


Scenario - A massive release of toxic liquid occurred 
when a small (1/2 in.) bleed valve failed. The valve 
was found to be installed improperly, and was 
damaged by internal corrosion. 

Facts 

(1) One design feature was that the internal valve 
components could beremoved and replaced if they 
became worn. The valve was designed with a fail¬ 
safe provision and intended to he installed in a 
designated flow direction orientation. Access to 
the internal components was intended to be made 
from the inlet (upstream) side of the valve. The 
inlet port of the valve was provided with a threaded 
internal sleeve (retention ring) that could be 
removed for access to valve internal components. 
If the retention ring were to fail, pressure from 
the upstream flow would act to prevent the 
valve’s internal components from being ejected 
from the valve body. 

(2) The valve was marked with a flow direction arrow 
and delivered from the supplier with a conspicu¬ 
ous instruction tag warning of the consequences 
of improper installation. The investigation team 
found the valve to be installed in the wrong flow 
direction orientation. 

(3) Examination of the retention ring indicated the 
threads were corroded to the point of failure, and 
allowed the retention ring and value internal 
components to be ejected. 
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One root cause as found by the investigation team - 
‘valve installed backwards’ 

Recommendation submitted by the investigation team - 
‘refresher training for the mechanic who installed the 
valve’ 

Comment 

The investigation team stopped the investigation too 
early and failed to identify the underlying reasons why 
the valve was installed backwards. A more effective 
team might discover and correct additional underlying 
causes such as: 

• incomplete and out-of-date instructions for instal¬ 
ling and verifying proper orientation; 

• inadequate system for updating installation 
instructions and verifying that current instruc¬ 
tions are being used; 

• inadequate training system with no provision for 
confirming that the training accomplished the 
intended objectives and no periodic refresher/ 
reminder component was included within the 
training program; 

• current system does not call for insuring the cau¬ 
tion tag supplied by the manufacturer remains on 
the valve until its point of installation/application; 

• a defective system for ensuring that quarter turn 
quick opening bleed valves in toxic liquid service 
are capped or plugged when not in use; 

• an incomplete system for ensuring that new or 
temporarily transferred mechanics are aware of 
the special nature of these bleed valves. 

If the investigation team had reached the underlying 
system defect level, the team would have been able 
to more effectively eliminate the chances of a repeat 
incident. 


An investigation team may mis-identify ‘lack of suffi¬ 
cient knowledge/skill’ as a root cause and therefore, gen¬ 
erate a recommendation to conduct refresher training. This 
lack of sufficient knowledge/skill is, in most cases, a 
symptom and not a root cause. The training recommenda¬ 
tion assumes that the person did not know/understand the 
proper procedure. The training recommendation does not 
attempt to identify the underlying root cause of the 
employee’s behaviour. If and when a procedure is changed, 
retraining is necessary and would be a proper component of 
the recommended preventive actions. Deficiencies in the 
training management system could be the underlying 
root causes resulting in the symptom (inadequate knowl¬ 
edge or skill). Training (or refresher training) would be an 
appropriate action once the underlying root cause defi¬ 
ciency in the training system has been properly identified 
and corrected. 

Different investigation teams often have varying per¬ 
ceptions regarding expected stopping points and may also 
have different understandings of what is and is not a root 
cause. Within an organization, there should be a definition 
of the term root cause that is clearly and consistently 
understood and applied. 

Another requirement is that a root cause must be cor¬ 
rectable by the organization. Two extreme examples of this 
concept are weather conditions and physical properties of 


materials. The organization does not have the capability to 
prevent/control adverse weather such as rain, wind or 
extreme ambient temperatures. It would be incorrect for 
the investigation team to identify rain or some physical 
property (boiling point) as a root cause. The organization 
may have capability to implement protective measures to 
mitigate the consequences of wet conditions, but it would 
be incorrect to label rain (or ice) as a root cause. Another 
example would be a case where one plant (Plant A) causes 
injury to workers in an adjacent plant (Plant B) and the 
plants are owned by two different organizations. Plant B 
management can take certain actions to protect their 
workers from outside events that originate at Plant A. 
These protective measures might include gas detectors, 
alarm and alert systems, constructing safe haven refugees, 
providing personal protective equipment, training, filing 
lawsuits, and certain other emergency response and miti¬ 
gation measures. However, Plant B cannot enter Plant A 
and implement preventive measures because Plant B lacks 
the authority or control over Plant A. The root causes of 
injury to Plant B personnel would be limited to those 
weaknesses or breakdowns in Plant B systems and 
measures. 

31.2.3.2 Life cycle of an investigation 

Figure 31.2 provides a graphical representation of the root 
cause investigation process. There are several natural and 
overlapping stages to every process incident investigation. 
The first phase is determining ‘What happened’. This is 
followed by efforts to identify ‘Why it happened.’ Evidence 
is collected and analysed, and information is gathered from 
direct and contributing witnesses in an iterative process. 
This is the stage where the root causes are identified. The 
final stage is the ‘Prevention’ stage where preventive action 
measures are identified, implemented and verified and 
information is shared with all who might have potential 
benefit from the investigation’s outcome. 

31.2.3.3 Special investigation challenges for 
process incidents 

Although investigations of process incidents share many 
common elements with traditional industrial incident 
investigation, there are a few relatively unique features. 
Many process incidents involve outside parties such as 
regulatory agencies, insurance companies and in many 
instances litigation issues. Process incident investigations 
by nature carry additional challenges. Actual or potential 
consequences are significant and can be catastrophic in 
terms of loss of life, impact to the environment and in terms 
of financial impact on the organization. Specific design 
features of the manufacturing process system and sophis¬ 
ticated controls are provided to prevent adverse con¬ 
sequences. Multiple layers of protection are provided and 
maintained. Safeguard measures can be physical systems 
and devices (instrumentation interlocks, pressure relief 
valves and trip devices for example), administrative man¬ 
agement systems or combinations of the two. Most process 
incidents that result in significant consequences are asso¬ 
ciated with unusual combinations of circumstances and 
conditions, and multiple breakdowns of preventive meas¬ 
ures. In most instances, a single failure of a safeguard does 
not result in adverse impact. When adverse consequences 
do occur, it is most often the result of a complex scenario 
that involves simultaneous failures of several layers of 
protection. 
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Management System 



One relatively unique characteristic of modern process 
designs is the close coupling (Parlow, 1999). Large-scale 
single train units are now the norm. Surge capacity and 
intermediate storage are minimized. The design provides 
minimum selected redundancy and spare equipment. 
Designs stress reliability and corresponding maximum 
on-stream time. Intervals between scheduled shut-downs 
and turn-arounds are maximized. This approach results in 
potential for a problem in one part of the process to quickly 
propagate and cause impact to downstream portions of the 
plant process equipment. 

31.2.3.4 Concept of multiple causes 
A second major challenge is finding all root causes. One 
common mistake in root cause incident investigation is to 
prematurely stop the investigation before all root causes are 
identified. This mistake is sometimes built into the inves¬ 
tigation management system, by formally limiting the 
charter and expectations of the investigation team. Some¬ 
times the investigation team is specifically charged with 
finding ‘the root cause.’ Additional root causes are allowed, 
but the team is asked to discover the one root cause among 
all other causes most responsible for the event. This erro¬ 
neous approach ignores an axiom of root cause incident 
investigation, that is,‘There are always multiple root causes 



associated with an accident.’ Removing only one root cause 
corrects only part of the problem. If only one root cause is 
identified and eliminated, the result of the investigation 
effort would probably prevent a repeat of the exact specific 
incident sequence, but would leave the other root causes in 
place ready to cause a similar event. 

Each root cause has a specific risk factor associated with 
it (combination of likelihood and consequence severity). 
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Some root causes are associated with higher frequency of 
opportunities for occurrence or exposure, while others are 
associated with higher degree of severity of consequences. 
From this perspective, it is accurate to say that some root 
causes are more significant than others from a risk per¬ 
spective. However, for most accidents, it is not accurate to 
say that there is only one root cause associated with the 
accident. In the Three Mile Island, Bhopal, and Challenger 
Space Shuttle incidents, there were multiple root causes 
that acted in concert to allow the accident scenario to pro¬ 
gress (Philley, 1992; Chiles, 2001). In each of these three 
classic incidents, a series of failure events and conditions 
progressed to a final state of significant adverse con¬ 
sequence. The failure events and breeches of safeguards 
had different probabilities. If one of the series had not 
occurred, it is unlikely that the final event would have 
happened. Each individual failure represented an oppor¬ 
tunity to arrest the progression of the scenario. Each fail¬ 
ure was associated with a separate and distinct defect in a 
management system. The investigation would be incom¬ 
plete and less than adequate if the team finds and corrects 
only one of the underlying root causes. 

For optimum incident investigation results, the concept 
of multiple root cause should be fully integrated into the 
incident investigation management system, procedures, 
training and expectations. 

31.2.4 Management’s role in incident investigation 

Responsibility for prevention of incidents and repeat inci¬ 
dents is a responsibility shared at every level of the organi¬ 
zation from the board of directors down to the entry-level 
employee. However, the ultimate responsibility rests with 
those in management positions who establish policy and 
allocate resources. It is a general observation that process 
facilities and operations with the most successful records 
share common management leadership attributes and 
characteristics including: 

• personal involvement by line management in the 
review and approval of draft incident reports; 

• rigorous and robust follow-up and implementation of 
recommendations and action items generated from 
incident investigations; 

• proactive sharing of results, findings and lessons 
learned from investigations; 

• strong and sustained emphasis on reporting, investi¬ 
gating and taking action on near-miss events; 

• establishing priorities and implementation schedules 
for incident investigation action item recommendations. 

One critical function of the organization’s line manage¬ 
ment is the responsibility to act on the recommendations 
submitted by the incident investigation team (Noon, 2000). 
Managers must fully understand the risk associated with 
implementing, partially implementing, modifying, delay¬ 
ing or rejecting the suggested recommendations. Once a 
recommendation is accepted, there is a responsibility to 
ensure the action is implemented as intended and that the 
action is indeed successful in correcting the root cause. 
Follow-up verification, documentation, auditing and moni¬ 
toring are essential. 

Members of line management have the responsibility to 
implement a management system for incident investiga¬ 
tion. This responsibility requires sustained allocation of 
resources (i.e. financial and personnel). Many incident 


investigation actions are accompanied by auxiliary (sec¬ 
ondary) tasks such as updating training manuals, process 
safety information packages, or piping and instrumenta¬ 
tion drawings (P&ID). These auxiliary tasks also require 
allocation of organizational resources, prioritization, and 
tracking to satisfactory resolution. 

Line management must establish acceptable risk toler¬ 
ance criteria. This is most often accomplished by develop¬ 
ment and adoption of a risk matrix (CCPS, AIChE, 2003). 
Risk matrices are applied to assist in prioritization of 
issues and recommended preventive action items. Line 
management has a responsibility to effectively share the 
lessons learned from the investigation both internally 
and externally. 

Each level of the management structure must have an 
adequate and appropriate understanding of the incident 
investigation policy, procedure and responsibilities (DNV, 
1996). In most cases this requires a clear and consistent 
understanding of the implemented incident investigation 
management system including: What is an acceptable 
identification of root causes? What is acceptable regarding 
quality and wording of action item recommendations? 
What are the individual responsibilities for each person 
under the supervision of that manager? 

31.2.5 Human factors in incident investigation 

Human factors are involved in almost every process safety 
incident. Since human reliability is less than 100%, all 
administrative systems and safeguards are less than per¬ 
fect. Well-designed management systems take human 
reliability and human performance into consideration 
when designing safeguards. Well-designed human factor 
safeguards are error tolerant and allow some opportunity 
to detect and correct deviations before catastrophic con¬ 
sequences are reached. Well-designed safeguards will 
include confirmation that the intended protection remains 
in place. Every safeguard will have discrete periods of 
unavailability. Some process hazards are significant 
enough to require protection in depth (layers of protection) 
and robust barriers. 

When evaluating proposed additional safeguard meas¬ 
ures, incident investigation team members will often ben¬ 
efit from an understanding of the application of reasonable 
human performance reliability expectations. In some 
instances, the human performance expected by system 
designers (physical systems as well as administrative sys¬ 
tems) exceeds realistic or practical limits. In these cases the 
system design increases likelihood for human error or may 
call for unrealistic response times or response actions. 
When considering remedies to root cause defects, the inci¬ 
dent investigation team should apply recognized and gen¬ 
erally accepted human performance and human reliability 
expectations. Two excellent examples of applied human 
factors are the emphasis on inherent safety in system 
design and the concept of alarm management. Modern 
distributed control system (DCS) instrumentation allows 
almost infinite capability to add computer generated 
alarms and the result can be alarm overload/flood during 
the initial periods of process deviations and process upsets. 
The alarm management concept provides an opportunity 
to prioritize and categorize alarms and the associated 
expected response actions to alarms. 

The Japanese quality control technique of Poka Yoke 
is a concept that recognizes workers occasionally make 
mistakes and provides features in the manufacturing 
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process that minimize the incidence rate and consequences 
of mistakes. Manufacturing processes are provided with 
features that allow rapid detection of errors made by 
employees and, therefore, allow an opportunity to recover 
at minimum expense and consequence. 

The written procedure is a common accident prevention 
safeguard that depends heavily on human reliability (also 
referred to as standard operating procedure, SOP, or writ¬ 
ten instruction). The intent of the written procedure is to 
ensure actions and practices are sufficient to safely com¬ 
plete the designated task. Unfortunately, it is a common and 
erroneous finding for an investigation team to identify 
‘Employee failed to follow established procedure’ as a root 
cause. This failure on the part of the employee (behaviour or 
action) is in most instances a symptom of an underlying 
root cause (Peterson, 1984). The investigation should try to 
discover why procedures were not followed. In almost every 
case, there is an underlying system deficiency reason why a 
person did not follow the established procedure. The 
investigation team has an obligation to uncover and remove 
underlying causes for the failure to follow established pro¬ 
cedures. 


In most instances ‘failure to follow established, proce¬ 
dures’ is not a root cause, but is instead a symptom of an 
underlying system defect that can be corrected. 


It is not unusual for employees to consciously deviate 
from a written and established procedure. In some instances, 
the failure to follow established procedure may be due to 
inadequate knowledge. The classic recommendation that 
accompanies this premature stopping point is to provide 
training (or refresher training) to ensure the person(s) 
involved in the incident understands how to follow the 
established procedure. An example of a typical recom¬ 
mendation action item associated with this mistake might 
read, ‘Review the procedure with the employee to ensure 
that he understands the proper action expected.’ This 
individual training activity may be beneficial to the per¬ 
son^) who receives it, but in most cases does not address 
the underlying reason for the person’s lack of knowledge. 
The individual refresher training does not correct any 
system defects that resulted in the improper behaviour. In 
most cases, the other employees remain in a state of inade¬ 
quate training. Investigation teams often uncover and 
eliminate underlying system deficiency causes such as: 

• Deviation from procedure was commonly accepted 
practice. 

• Employee was following the example set by his super¬ 
visor and/or trainer. 

• Training program did not adequately inform the 
employee of the potential consequences associated with 
deviating from a specific step or action. 

• An out- of- date written procedure that no longer reflects 
current practices, or current configuration of the physi¬ 
cal system due to defects in the process safety infor¬ 
mation, document control, or operating procedures 
management systems. 

• Employee perceives that his way is better (safer, and/or 
more effective) due to deficiencies in the system for 


establishing and maintaining a specific competency 
and qualification level. 

Employee previously rewarded for deviating from the 
procedure due to a culture of rewarding speed over 
quality resulting in, and a reflection of, a defective 
quality assurance management system. 

Employee is experiencing temporary task overload due 
to defects in the scheduling and task allocation system 
and/or due to ineffective implementation of downsizing. 
Employee hasphysical/mental/emotionalreason(s) that 
causes him to deviate from the established procedure due 
to defects in the fitness-for- duty management system. 
Employee believed he was using the correct version of 
the procedure, but due to defects in the document man¬ 
agement system, he was actually using an out-of-date 
edition. 


31.2.6 Preparing for investigating process incidents 

A typical investigation environment immediately follow¬ 
ing an explosion or major fire may include the following 
circumstances: 

• all (or most) plant utilities out of commission (electrical 
power, steam, water, inerting purge gas systems, plant 
telephones, radio systems, pagers); 

• residual fires and hot spots still being brought under 
control; 

• personnel who were on duty at the time of the event may 
be injured and therefore, unavailable for interview (in 
some instances, for weeks); 

• environmental consequences still evolving; 

• the plant neighbourhood being evacuated; 

• regulatory agencies with partial or total control of the 
accident site; 

• local (and in some instances, national) news media 
demanding information; 

• a large portion of the potential evidence being destroyed 
by the fire or explosion; 

• many plant employees traumatized and/or exhausted 
from the initial emergency response; 

• third parties (insurance companies, contractors, cus¬ 
tomers, suppliers, attorneys) with legitimate needs for 
information and response action. 

This set of circumstances is not unusual, and demands a 
robust incident investigation management system that can 
be rapidly and efficiently activated. There may be only a 
brief opportunity to capture some of the time-sensitive 
evidence. Organizing and preparing an incident investiga¬ 
tion team is addressed in detail in Section 31.4. Composi¬ 
tion and configuration of a process incident investigation 
management system is addressed in Section 31.7. The 
management system must be developed and implemented 
prior to the incident, with accompanying training and 
auditing. 

Legal issues are a major component of investigations for 
process incidents. Many process incidents are accom¬ 
panied by significant consequences and, therefore, litiga¬ 
tion is probable. There may be third party injury or damage, 
on-site or off-site. Insurance company representatives have 
certain contractual legal obligations, needs and rights. In 
many instances in the United States, investigation of a seri¬ 
ous process incident is conducted under the direction of an 
attorney and in anticipation of litigation. Legal counsel for 
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the organization has an obligation to protect the financial 
impact to the organization and to manage contacts and 
interactions with regulatory agencies and opposing coun¬ 
sel. There are certain measures the incident investigation 
team can implement to control access to investigation 
documents by outside parties. In many instances an attor¬ 
ney is designated as investigation team leader to ensure 
that all legal aspects are controlled. 

In the United States, federal, state, and in some cases, 
local regulatory agencies have the authority and respon¬ 
sibility to conduct investigation of process incidents. In 
many cases, control of access to the accident site is assumed 
by the regulatory agency. Federal (US) agencies that may 
conduct investigations include: 

• OSHA - Occupational Safety and Health Adminis¬ 
tration; 

• MMS - US Minerals Management Service; 

• USBM - US Bureau of Mines; 

• EPA — Environmental Protection Agency; 

• ATF - Alcohol Tobacco and Firearms; 

• FBI - Federal Bureau of Investigation; 

• USCG — US Coast Guard; 

• CSB - US Chemical Safety and Hazard Investigation 
Board; 

• NTSB - National Transportation Safety Board (pipe¬ 
lines). 

In many cases these regulatory agencies are interested in 
determining compliance or lack of compliance with applic¬ 
able regulations and standards. In some instances, the 
identification and elimination of root causes is not their top 
priority. In addition to the federal agencies, there are state 
and local authorities such as Fire Marshals and Public 
Safety Departments that have authority and desire to con¬ 
duct incident investigations and issue reports and recom¬ 
mendations. 

In the United States, many process incident scenes are 
designated as uncontrolled hazardous waste sites under 
the OSHA 1910.120 Hazardous Waste and Emergency 
Response regulation, subpart (q). This requires specific 
training for most personnel who enter the site, and also 
requires a written safety and health plan be developed and 
implemented for control of potential hazards that may 

31.3 Evidence Issues 

31.3.1 Evidence challenges 

Evidence collection and analysis is an iterative activity. For 
optimum results, a formal system of evidence management 
is necessary. The quality of findings and conclusions of the 
investigation are a direct reflection of the quality of the 
evidence examined by the team. Many chemical process 
incidents present considerable challenges related to gath¬ 
ering evidence. The facility may be significantly damaged 
by the event and, therefore, critical physical evidence may 
no longer exist or may not be initially available to investi¬ 
gators. In some instances, the starting point may be a cra¬ 
ter. Regulatory agencies such as OSHA, FBI, US CG, EPA, 
ATF, or Fire Marshal may have total control of the site, and 
the owner representatives may be prohibited from entry 
In the United States, the site for many chemical process 
incidents is declared an uncontrolled hazardous waste site 
under the OSHA 1910.120 subpart (q) regulation and 


certain access controls and actions become required. In 
some instances, third party legal (or insurance company) 
representatives may quickly file legal action to prohibit the 
owner from taking any action that might disturb potential 
evidence, therefore arresting any investigatory activity 
related to evidence gathering. 

There are several recognized categories of evidence. 

• people; 

- eyewitness and personal knowledge, 

• physical evidence; 

- parts, things, equipment, 

• electronic; 

• paper documents; 

- historical, drawings, specifications, 

• position/configuration; 

• process parameters and conditions; 

• physical properties and characteristics. 

In many cases the plant infrastructure is severely 
damaged. Normal utilities and services will be unavailable, 
such as electrical power, telephones and radio communica¬ 
tion systems. In large facilities, undamaged portions of the 
plant will be demanding permission to resume operations. 
Critical witnesses such as personnel who were on duty at 
the time of the incident may not be available due to injuries 
or may be at home recovering from extended hours spent in 
initial emergency response activities. 

In the most severe explosion cases, a substantial portion 
of a process unit may be completely destroyed with only a 
crater remaining in the location of the equipment. Frag¬ 
ments and debris can be thrown considerable distances, 
sometimes outside facility boundaries. In many instances, 
sampling will be necessary to evaluate potential exposures 
to investigation personnel (asbestos, volatile organic com¬ 
pounds, blood-borne pathogens and others). 

Some evidence is extremely time-sensitive and requires 
top priority in the initial stages of the investigation. Witness’ 
perception, understanding and memory recall changes 
over time, and it is therefore important to place a high prior¬ 
ity on gathering evidence from direct eyewitnesses and 
others who were on-duty at the time of the event. Physical 
evidence degrades with time (e.g. fracture surfaces, dust 
and soot samples, residual liquids, and charts, logs and 
other paper records that are exposed to the elements). 
Availability and integrity of electronic process data can be 
impacted by the loss of normal or back-up electrical power. 
Access to offsite evidence and restoration of this offsite 
damage is not in the control of the chemical process facility 
owner. Documentation of the extent of damage and neces¬ 
sary temporary repairs are high priority evidence issues. 
Within the plant or facility boundaries, evidence collection 
requires notification and coordination of all employees to 
minimize loss or inadvertent alteration of the physical evi¬ 
dence. Evidence may be spread over a large area, and all 
personnel within the plant must be instructed on the proper 
manner to communicate the location of evidence for collec¬ 
tion by a trained team. Collection of chemical samples from 
vessels that are open to the atmosphere is also a high 
priority activity to ensure the sample is as representative 
as possible and to minimize adverse impacts from exposure 
to the elements (evaporation, moisture and others). Some 
evidence may be located in access ways and other places 
that need to be cleared quickly, and these areas may need to 
be placed on the high priority list. 
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For explosions, the damage itself may function as a 
blast gauge if the properties of the buildings and struc¬ 
tures are known. The end use of the evidence collection may 
include: 

• calculating blast pressures and impulses at each 
damaged structure; 

• generating pressure contours; 

• calculating the explosion energy released; 

• determining the type of explosion; 

• determining the source of the explosion. 


31.3.2 Potential sources of physical evidence 

Depending on the type and nature of the event, evidence 
prospecting may be required across a wide range of poten¬ 
tial venues. The location and relative position of physical 
evidence should be documented and in most instances, 
photographed in place before anything is moved. A special 
type of information often highly useful is the ‘as-found’ 
position of valves, switches, control devices or sequence 
indicators. Previous incident reports and reports of process 
hazard analysis (PHA) studies can provide insight to 
credibly possible failures and accident scenarios. Operat¬ 
ing data such as logbooks, computer records, process flow 
diagrams, and P&ID are potentially very useful docu¬ 
ments. Engineering files, inspection records and repair 
files contain valuable information on the construction and 
features of fixed equipment. Another resource is the man- 
agement-of-change records, providing information related 
to modifications that may not be updated on the equipment 
and system drawings. Scorer, scratch and impact marks 
made by moving objects can be helpful. The investigation 
team should look for things present that would not be 
expected to be present, and also look for things absent that 
would be expected to be present. Typical sources of evi¬ 
dence for chemical process incidents are listed in Table 31.1. 

31.3.3 Evidence collection and management 

For major chemical process incidents, evidence preserva¬ 
tion, storage and management is required. Effective col¬ 
lection and analysis of physical evidence should be 
conducted in a systematic fashion. All potentially impor¬ 
tant fragments, debris and other physical items should be 
documented in place (photography or other) before being 
moved or disturbed in any manner, noting the location and 
orientation. It is standard practice to assign individual 
evidence numbers to each piece of physical evidence col¬ 
lected. In most instances, small items are placed in clear 
plastic bags. A formal chain-of-custody system is devel¬ 
oped and implemented to track the status of, and access to, 
any evidence not retained in the custody of the incident 
investigation team. Disassembly of equipment should be 
documented with photography and annotated at each sig¬ 
nificant stage. In some instances, disassembly of equip¬ 
ment may require agency or litigant approval before 
anything is touched or changed. Long-term storage of 
physical evidence may be required for investigations that 
involve potential litigation. It is important to arrange for 
secure storage, restricted access and chain-of-custody 
management for items that may be retained long after the 
initial investigation team has concluded its work. Regu¬ 
latory agencies and other third parties may have need for 
copies of documentation as well as samples, photographs 
and portions of physical evidence. It is important to 


Table 31.1 Potential sources of evidence 


Operating data (computer log, alarms, charts) 

P&ID 
Lab results 

Instrument loop diagrams 
Instrumentation interlock drawings 
Instrumentation ladder logic diagrams 
Operating manuals 
Training manuals 
Material Safety Data Sheets 
Management-of-change records 
Inspection records 
Repair records 
Meteorological records 

Manufacturer’s bulletins and Original Equipment 
Manufacturers Manual 

Retainer samples of shipments and incoming raw materials 
‘As-found’ position of valves, switches and indicators 
Rupture disk condition 
Anomalies in damage (or non-damage) 

Residual liquids 

Scorch pattern 

Smoke traces 

Melting pattern 

Missile mapping 

Layering of debris 

Direction of glass pieces 

Analysis of undamaged areas and equipment 

Metallurgy analysis 

Fracture analysis 

Conductivity testing 

Security camera tapes 

Previous PHA study reports 

Material balances 

Chemical reactivity data 

Corrosion data 

Prior incident reports 


manage the distribution of copies of documents and other 
evidence in order to avoid unnecessary confusion and dif¬ 
ferences in interpretation of document evidence. 

31.3.4 Evidence photography 

Investigatory photography (and video) has multiple pur¬ 
poses. It is most often used to document the ‘as-found’ 
position, location, configuration arrangement, damage 
pattern and layering of physical evidence. In addition, 
photographic evidence is often useful in presenting the 
results of the investigation (reports) and in distributing 
lessons learned (training). Photographs taken by the 
investigation team find application in evidence analysis 
and in litigation activities. Photographs can be taken of 
items that need to be moved or of items and conditions 
that might change over the course of the investigation. 
Promptness is important since no accident scene can be 
considered frozen in time. In most instances, the investi¬ 
gation team should generate a formal log of each image, 
indicating the date, time, identity of the photographer and 
intended purpose or contents of the image. If multiple 
copies are distributed, a record of distribution should be 
maintained. In some instances, investigators have found it 
helpful to document the view of each significant witness by 
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going to the position where the witness was located to note 
what could be seen from his position. 

Conventional 35 mm photography, digital photography, 
instant print and video images all have a place in the 
investigation process. In some circumstances, the use of a 
professional photographer may be appropriate, however in 
most instances, photography will be done by investigation 
team members. It is important to capture a series of overall 
orientation views from multiple perspectives and from 
multiple distances. These views will significantly enhance 
the value of subsequent photos taken from a closer dis¬ 
tance. A sometimes-used resource for video is news media 
footage taken during the incident. This unedited footage is 
available directly from theTVstation and can provide clues 
related to the sequence of the event. 

Most photographic equipment requires perishable bat¬ 
teries that have, in some cases, unpredictable battery life. It 
is a good practice to implement a system to ensure that 
spare batteries are available and that periodic battery 
change-out and recharging occurs. Photographic film is 
date-sensitive and in addition, can be adversely affected by 
airport security screening devices. Storage of electronic 
digital images needs to be managed, with master copies or 
back-up copies maintained in a controlled manner. 

Photography can present hazards to investigators. The 
view through the lens is restricted and the photographer 
may not be aware of tripping and falling hazards. Photo¬ 
graphic and flash equipments are not normally designed 
for use in potentially flammable vapour conditions and 
require precautions similar to those used for any poten¬ 
tially spark producing tool or piece of equipment. 

Good practices for investigation photography include: 

• taking multiple orientation views from different posi¬ 
tions and distances; 

• placing an object of known size in the picture; 

• being aware of potential shadows that will be cast by 
the flash unit; 

• managing spare battery supply; 

• making a written record of each image that might be 
confusing to the viewer; 

• being aware of limitations of autofocus devices; 

• generating a detailed log of all photographs; 

• managing and documenting distribution of copies. 


31.3.5 Investigation witness interviews (gathering 
evidence from people) 

31.3.5.11ntroduction and general interview issues 
Gathering verbal information from witnesses is one of the 
more challenging aspects of incident investigation. Con¬ 
ducting an effective interview differs from most process 
safety management activities in that interviewing can be 
as much an art as it is a science. There are numerous vari¬ 
ables that affect interview success. Chemical process 
industry incidents are often accompanied by severe con¬ 
sequences and can also be accompanied by traumatic 
effects on human emotions. Chemical process industry 
incidents can be complex in nature and it is rare for a single 
witness to have a complete understanding of all the events 
and underlying circumstances. Each potential witness 
has a unique combination of perspective, personal experi¬ 
ence and understanding of apparent facts. Promptness 
in obtaining statements and conducting interviews is 


essential for effective witness interviews and for obtaining 
the most reliable information. 

Incident investigation interviews are conducted in a 
variety of circumstances. There are several types of inves¬ 
tigatory interviews. The most common incident investiga¬ 
tion interview is the initial screening interview, conducted 
for all possible witnesses who might be able to contribute to 
understanding the cause and event scenario. These initial 
interviews are usually brief (on the order of 30 min) and 
explore a wide range of topics and issues. A subset of wit¬ 
nesses is subsequently identified for follow-up interviews, 
which are more focused and address specific issues emerg¬ 
ing from the investigation. These follow-up interviews can 
last over one hour. In addition, it is not uncommon to conduct 
group interviews after the initial round of individual inter¬ 
views. In some instances, the presence of agroup can activate 
synergies that contribute to increased understanding and 
recall. There are other special types of incident investiga¬ 
tion interviews that are not in the intended scope of this 
chapter, including interviews of injured personnel (usually 
conducted at the hospital), interviews of non-employees 
(contractors, visitors, others), interviews conducted by regu¬ 
latory agencies and interviews conducted by third parties 
(insurance representatives, legal representatives). 

Since witness interviews are verbal communication 
exercises conducted between two human beings, they are 
naturally accompanied by human imperfection. In the 
chemical process industries, incident investigation inter¬ 
views are seldom conducted by professional interviewers. 
Following a chemical process incident, the interview 
atmosphere can be adversely affected by significant emo¬ 
tional or physical trauma. Each person brings their own 
perception of apparent facts and sequence of events. 
Human memory is imperfect and can be significantly 
impacted by passage of time, interaction with other people, 
and by the witness learning additional facts after the inci¬ 
dent. Humans have a capability and tendency to see and 
hear what we expect to see and hear. Our brains have an 
inherent tendency to interpret incoming information so 
that it becomes comprehensible to us, even if the incoming 
information is incomplete. We have a strong capability to 
identify patterns and fill in missing pieces of information 
based on our previous experiences and understandings. 

When evaluating incoming information from witnesses, 
the interviewer should keep in mind that the witness may be: 

• traumatized and may not be thinking as clearly as he/ 
she would otherwise; 

• unsure about certain information (and may withhold 
information or make incorrect assumptions); 

• overly confident (and not necessarily accurate) about 
certain information; 

• potentially defensive about certain issues; 

• apprehensive regarding possible disciplinary action for 
themselves or others; 

• angry at the company or at individuals; 

• making assumptions without realizing it; 

• second-guessing their own actions; 

• interested in accomplishing other obj ectives and agendas 
not directly related to this incident. 

Theperson conducting the interview should remember that: 

• All information from witnesses may not be accurate, 
complete, or factual. 
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• Some information may contain hidden assumptions 
and stipulations. 

• Some information may contain incorrect assumptions. 

• The witness may sincerely believe something to be 
true, yet the information actually is false, incorrect or 
incomplete. 

• Some degree of inconsistency among witnesses is 
normal. It is not unusual for two eyewitnesses to have 
different perceptions, understandings and recollection 
of the incident although they witness the same event. 

• The witness may have a vested interest in the outcome of 
the investigation. 

The interviewer should avoid placing blame or any impli¬ 
cation of fault-finding. It would be premature to make 
judgements regarding determinations of fault. 

31.3.5.2 Planning 

Pre-interview planning can have significant impact on 
quality and effectiveness of information gathered during 
initial screening interviews. In almost all cases, informa¬ 
tion supplied in follow-up interviews will be modulated by 
the witness’ interactions with other people after the initial 
interview and, therefore, the initial interview represents a 
unique opportunity to gather information with minimal 
contamination by others. The investigation team will often 
designate a single person as interview co-coordinator. This 
interview co-coordinator may not actually conduct every 
interview, but this person will have overall responsibility 
for witness interview evidence gathering. For consistency 
sake, it is desirable to have a minimum number of desig¬ 
nated interviewers (usually no more than two or three 
investigation team members). 

Persons selected as designated interviewers should have 
strong verbal communication and listening skills. Many 
technical personnel (such as engineers and chemists) find 
themselves assigned to investigation teams and often do 
not have strong verbal communication skills and abilities 
to communicate with non-technical personnel. Supervisory 
personnel, on the other hand, are often better suited for the 
interviewing task, due to their extensive experience and 
interactions with other people in the normal course of day- 
to-day activities. Typical practice is to have one interviewer 
and one witness in the room for the initial interview. In 
some instances, a second interviewer may be present to 
take notes or to provide specific knowledge for full under¬ 
standing of the information the witness may offer. For 
instances where there are two interviewers, it is a recog¬ 
nized best practice to designate one interviewer to function 
as ‘primary’ or lead interviewer and for the other inter¬ 
viewer to take a secondary role. In some instances, the 
witness may request to be accompanied by another person 
(i.e. union representative, attorney or other). It is widely 
recognized and accepted that the one- on- one interview is the 
most effective format, although in some cases circumstances 
prohibit this arrangement. There is typically a reduction 
in the quality and quantity of information gained from 
the interview if there are too many interviewers present. 

Venue for the interview should be neutral and non¬ 
intimidating for the witness. The interview location should 
provide privacy and be free from foot traffic and other 
interruptions. Interruptions disrupt the witness’ train of 
thought and can severely detract from the interview 
dynamics. It is a common mistake to conduct the interview 
in the private office of plant management. This practice 


generates additional stress on most witnesses, as many 
hourly personnel will not feel comfortable in such loca¬ 
tions, and will be less willing to supply complete and accu¬ 
rate information. 

One early and continuing task for the investigation team 
is identification of potential witnesses. Personnel who 
were present at the time of the event are in the highest 
priority category. During the course of the investigation, it 
is common to identify additional personnel who were not 
on the initial list of potential witnesses. It is more effective 
to schedule the interview at a time and place convenient to 
the witness. 

One recommended best practice is for the interviewer to 
personally visit the scene of the incident before conducting 
the interview.This adds to the interviewer’s understanding 
and interpretation of the information supplied by the wit¬ 
ness, and also provides an opportunity for the interviewer 
to ask clarifying questions for a more precise and complete 
set of facts. Before starting, the team must decide how the 
interview will be documented. The most common docu¬ 
mentation method for initial screening interviews is to take 
hand-written notes. On occasion, audio or video tape 
recording is done, although these can adversely affect the 
witness. In cases where there is a second interviewer pre¬ 
sent in the room, it is a good practice to designate this per¬ 
son as the official note taker. Some investigators suggest 
that in order to minimize witness apprehension, the inter¬ 
viewer should inform the witness of the intention to take 
notes and where feasible, offer to supply the witness with a 
copy of the hand-written notes. In many instances, it is 
beneficial to have interview aids present such as: paper and 
pencil, plot plan, P&ID, photographs, flipchart and mar¬ 
kers. During the interview, the witness should not be 
exposed to documents generated by the incident investi¬ 
gation team (such as marked-up diagrams, or listings of 
credible scenarios and possible causes), because informa¬ 
tion on these documents could alter the information that 
the witness provides during the interview. 

The remainder of this section will focus on techniques 
for the initial screening interview, conducted by the 
organization’s internal investigation team, recognizing 
that third party and regulatory interviews have additional 
issues beyond the scope and objectives of this chapter. 

31.3.5.3 Stages of initial screening interviews 

There are four distinct stages in every effective interview: 

(1) opening; 

(2) witness statement; 

(3) interactive dialogue; 

(4) closing. 


31.3.5.3.1 Opening phase 

In many cases, the overall effectiveness of the interview is 
determined during the first two minutes. If initial rapport 
and trust are not established, the quantity and complete¬ 
ness of the information offered by the witness will be sig¬ 
nificantly decreased. It is best to begin with introductions, 
clarification of the objectives and purpose of the interview 
and investigation, and a conscious effort by the interviewer 
to break the ice establishing some degree of rapport 
between the witness and the interviewer. Some inter¬ 
viewers find it helpful to start with some general back¬ 
ground questions before jumping into the more significant 
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issues. This practice establishes a dialogue flow and allows 
an opportunity for the witness to overcome any initial 
nervousness and anxiety. It is helpful to discuss how the 
interview will be documented and, in some cases, it is also 
helpful to inform the witness how he/she was selected for 
this interview. If the interview is to be recorded, it is a good 
practice to explain the purpose of the recording and to seek 
permission from the witness. Some interviewers find value 
in asking the witness if he/she has any questions about the 
interview process, as a means to minimize stress to the 
witness. In some instances, the interview may be con¬ 
ducted under a confidentiality arrangement, where the 
interviewer pledges that certain confidentiality will be 
maintained related to exactly what information was sup¬ 
plied by which witnesses. This confidentiality is common 
for investigation interviews conducted by regulatory 
agencies. If there are confidentiality issues, they should he 
discussed during this opening phase. 

31.3.5.3.2 Uninterrupted narrative 

Following the opening, a critical segment of the interview 
is the witness statement of what he/she saw and experi¬ 
enced. It is a best practice to allow the witness to tell their 
narrative without interruption. If the interviewer inter¬ 
rupts in order to clarify or expand on something the wit¬ 
ness said, the witness’ train of thought could be permanently 
derailed. The interruption will most likely cause the wit¬ 
ness to omit information he/she would otherwise have 
included. Listening silently during this narrative is very 
difficult and challenging even to experienced interviewers. 
During the narrative, the interviewer should write down 
items that need additional clarification. In most cases this 
initial narrative is completed in less than 10 min. During 
this listening phase, the interviewer should avoid giving 
non-verbal feedback such as frowning, yawning, looking at 
the clock or other actions that might distract or otherwise 
adversely affect the witness. 

31.3.5.3.3 Interactive dialogue 

During this phase, the interviewer and the witness enter 
into an exchange dialogue and information is transferred 
and clarified. This is the proper time to raise questions or 
receive confirmations from the preceding uninterrupted 
narrative. In most instances the interviewer will have a 
prepared list of general issues, items, topics and questions 
that provide the basis for completing this dialogue phase of 
the interview. These questions are used if the witness did 
not address the topic during the uninterrupted narrative 
segment. Open-ended questions are those questions that 
begin with what, which, where, when and how and cannot 
be answered with a simple yes or no response. Closed- 
ended questions are those that can be answered with a yes 
or no. Both types of questions have their place in incident 
investigation interviews. Open-ended questions are usually 
more productive and effective than closed-ended ques¬ 
tions, especially during the earlier stages of the interview. 
Closed-ended questions are necessary and effective for 
clarifications and confirmations. Some typically useful 
questions include: 

• ‘How and when did you first become aware of the event 
or that something adverse might be happening?’ 

• ‘What was different this time from previous times?’ 

• ‘What were the operating conditions prior to the event?’ 


• ‘Is this hazard covered in the training program and 
written procedures? If so, how is it covered?’ 

• ‘Who else might have additional information that could 
help us determine what happened?’ 

• ‘What are your suggestions/opinions on how this inci¬ 
dent could possibly be prevented in the future?’ 

During the interactive dialogue phase, it is a good prac¬ 
tice to use reflective listening techniques to confirm that 
the interviewer accurately understood witness’ statements. 
This playback allows the witness to correct any gaps or 
errors in the interviewer’s understanding. It is also a good 
practice for the interviewer to be on the alert for ambiguous 
or relative words that have different meanings for dif¬ 
ferent people. Examples of these potentially ‘fuzzy’ words 
include: fast, faster, slow, slower, usual, normal, typical, 
sometimes, often, recently. If possible, the interviewer 
should clarify any words, jargon or acronyms that have 
potential multiple interpretations. 

31.3.5.3.4 Summary closing phase 

The majority of initial screening interviews reach a natural 
conclusion after approximately 20-30 min. The witness 
has offered his/her version of what happened and has 
addressed most of the issues on the prepared list of ques¬ 
tions and areas of interest. The interviewer should use this 
phase to summarize his understanding of the information 
provided by the witness. It is a good practice to invite the 
witness to submit additional information if the witness 
remembers something after the conclusion of the interview. 
The interviewer should ensure the witness knows how to 
supply additional information and that the additional 
information is welcomed. The interviewer should thank the 
witness for his time and cooperation and should alert 
the witness regarding the possible need for a follow-up 
interview. 

31.3.5.3.5 After the interview 

Initial screening interviews are often conducted in series. 
Therefore, it is important to document thoughts, observa¬ 
tions, questions and follow-up issues immediately after 
each interview. If the interviewer waits until the end of the 
day, the interviewer will not remember everything and may 
not be able to recall which witness supplied which infor¬ 
mation. It is a good practice to allow additional time 
between interviews, for documentation or an unexpected 
extension. It is typical practice for the initial screening 
interviews to last approximately 30 min, with an additional 
15-20 min between interviews. In most cases, the inter¬ 
viewer will have visited the general scene of the event 
before beginning the interviews. In some instances, it may 
be beneficial after a particular interview for the inter¬ 
viewer to re-visit the scene and place themselves in the 
witness’ location (or to physically retrace the witness’ 
movements) to clarify and further understand statements 
made by the witness. 

31.3.5.4 Optimizing results 

A few chronic challenges to effective investigation inter¬ 
views include the following factors. 

31.3.5.4.1 Promptness 

Promptness is critical. Witness memory degrades and is 
strongly moderated by interaction with other witnesses. 
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The investigation team should conduct initial screening 
interviews promptly; 

31.3.5.4.2 Selective acceptance of information 

During early stages of an investigation, the investigation 
team may identify a most likely scenario among a set of 
possible cause scenarios, and allow this preliminary find¬ 
ing to affect the conduct of interviews. It is very easy for the 
interviewer to become selective regarding preferred or non¬ 
preferred information being supplied by the witness. The 
interviewer can become non-objective and may not capture 
potentially significant evidence. 

31.3.5.4.3 Disclosure 

Another avoidable mistake is to disclose investigation team 
preliminary findings to the witness during the interview. 
This disclosure can cause the witness to modify the infor¬ 
mation offered during the interview. 

31.3.5.4.4 Remaining neutral 

An effective interviewer operates in a neutral mode to 
cause minimum impact on the witness. Interviewers should 
avoid leading the witness or phrasing questions in such a 
form as to suggest a desired response. The interviewer 
should show respect for the witness, even if the interviewer 
believes the witness to be less than truthful or otherwise 
difficult. 

31.3.5.4.5 Making promises during the interview 
Another avoidable mistake is to make promises or com¬ 
mitments to the witness during the interview, especially if 
the interviewer is not in a position to ensure that the pro¬ 
mise is met. 

31.3.5.4.6 Written statements 

Statements written by the individual witness are a poten¬ 
tially strong augment for enhancing the effectiveness of 
interviews. In many cases these statements can be devel¬ 
oped by the witness prior to the interview as a means to 
minimize memory degradation and minimize witness inter¬ 
mingling of perceptions. It is a good practice to ask the 
witness to sign and date the statement that he/she prepares. 

31.3.5.4.7 Categories of witnesses 

There are several groups of witnesses. Direct eyewitnesses 
are those who were present and personally experienced the 
event. Indirect witnesses may not have been present, but 
nevertheless possess useful knowledge that could assist 
in determining and understanding the cause scenario. 
Indirect witnesses can also be helpful in disproving and 
excluding proposed scenarios that do not apply in this 
instance. There are several groups of non-employee wit¬ 
nesses who often contribute valuable information includ¬ 
ing: contractors, visitors, delivery personnel and former 
employees. Emergency responders who were present at the 
scene of the incident during the event can provide addi¬ 
tional clues as to the sequence of events and condition of 
equipment before the end of the incident. 

31.3.5.4.8 Room arrangements 

Interview room configuration can impact the quality and 
quantity of results. Some interviewers try to avoid a seat¬ 
ing configuration where the witness is on one side of a table 
(or desk) and the interviewer is on the opposing side. A 90° 


orientation is less threatening and more comfortable for 
many witnesses. 

31.3.5.4.9 Non-verbal communications 
Non-verbal communication such as eye contact and body 
posture can sometimes provide additional clues and 
insights as to the information being offered by the witness. 

31.3.6 Evidence analysis 

Evidence analysis can provide objective and scientific 
independent confirmation of the cause scenario speculated 
by the investigation team. Damage patterns provide infor¬ 
mation related to the origin and sequence. Investigators can 
also make useful determinations based on anomalies and 
by analysing what remains undamaged. 

There are numerous publicly available resources for evi¬ 
dence analysis, including physical property data for melt¬ 
ing temperatures autoignition temperatures and chemical 
incompatibilities. Some methods are nondestructive (Non¬ 
destructive Evaluation, NDE), while others require per¬ 
manent modification of the evidence.Visual examination is 
the most common and one of the most powerful evidence 
analysis techniques. NDE Integrity testing can include 
leak checking, X-ray radiography, ultrasonic thickness 
testing, physical measurements, magnetic particle testing 
and others. Two useful references are the National Fire 
Protection Association standards # 921 for Fire and 
Explosion Investigations and # 907 Determining Elec¬ 
trical Fire Causes. Although these two references are pre¬ 
pared for use primarily by municipal fire protection 
agencies and organizations, they contain information 
helpful to industrial investigators. For example, tables from 
NFPA 921 present autoignition (table 3.3.4) and melting 
(table 4.8) temperatures for specific commercial materials. 
NFPA 921 also includes an interesting section on Human 
Response to Fire (chapter 8), interview techniques and 
helpful information on preparing sketches and diagrams. 
Another useful reference in fire and explosion evidence 
analysis is the Materials Technology Institute Publication 
30, Guidelines for Assessing Fire and Explosion Damage. 
This publication uses a temperature profile to assist in 
determining fire cause and origin. 

Metallurgical and failure analysis of evidence, fractured 
physical evidence and failed equipment can provide valu¬ 
able information regarding the nature, sequence and cause 
of the incident. The mode of fracture (ductile or brittle) can 
indicate pressure and impulse forces. The direction and 
style of crack propagation is often helpful. Metallurgical 
analysis can help determine age, origin and reason for the 
failure. Cause and type of corrosion attack can be deter¬ 
mined and can provide evidence of contaminants or corro¬ 
sion not expected to be present. Temperature at time of 
failure can be determined. The actual fracture pattern can 
provide an indication of conditions at the time of failure. 

There are several types of chemical analysis techniques 
that can be helpful in identifying the cause and sequence of 
the event. Chemical analysis can be conducted to confirm 
or refute the presence of compounds, substances, trace 
impurities or gross contaminants. Retainer samples of raw 
materials and final products are often re-analysed to help 
refute low probability scenario. Residues remaining after a 
fire can still provide useful chemical evidence. Physical 
property testing is useful in analysing or confirming poten¬ 
tial fire, reactivity, stability, solubility or contamination 
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concerns. Gas chromatography and scanning electron 
microscopy (SEM) are two common methodologies. 

Arson is a special case and in many instances will leave 
tell-tail unique evidence. Most fire departments, law enfor¬ 
cement agencies and insurance companies have in-house 
experts available to assist if there is a suspicion of male¬ 
volent action. There are well-established char and burn pat¬ 
terns for most common building materials and components 
that can indicate the nature of the fire (Redsicker and 
O’Connor, 1997). Arson investigators look for atypical pat¬ 
terns and the presence of accelerators and ignition devices. 

31.4 The Investigation Team 

31.4.1 Team charter (terms of reference) 

Most incident investigation teams for significant process 
incidents are charted, organized and implemented as a 
temporary task force. Most team members will retain other 
full-time job assignments and responsibilities. The inten¬ 
tion is for the team to disband at the completion of their 
assignment, usually upon issuance of the official report. It 
is important and necessary for the team’s authority, organi¬ 
zation and mission to be clearly established, preferably in 
writing by a senior management official in the organiza¬ 
tion. The team charter authorizes expenditures, reporting 
relationships and designated responsibilities and author¬ 
ity levels for the team. The investigation team charter is 
usually generated and issued from the upper levels of the 
corporate organizational structure. 

31.4.2 Team composition 

The incident investigation team for process-related events 
is typically composed of a cross-section of skillsets and 
competencies related to the process and nature of the event 
under investigation. Team size can vary from as few as 
three full-time members to as many as 15, with six to eight 
being most common. In many aspects, the team size and 
composition are comparable to the team formed to conduct 
a PHA. There is a designated team leader who brings the 
investigation methodology expertise to the team. In almost 
all cases of process safety incidents, there are team mem¬ 
bers who have operating experience with the process unit 
that experienced the event as well as a process engineer 
who understands the control systems. In the United States, 
in incidents where there are significant consequences and a 
likelihood of litigation, the nominal or actual team leader 
may be an attorney. It is a common practice in significant 
incidents for the team to have a designated sponsor who is a 
member of the upper level of the organization’s manage¬ 
ment team. In addition to full-time members, it is a common 
practice to enlist technical speciality help on a part-time 
basis. These special team members may not attend every 
team meeting, but nevertheless execute designated tasks 
that help the team move forward in identifying root causes. 
Special skillsets might include reactive chemist, instru¬ 
mentation or control system engineers, material engineer, 
rotating machinery specialists and industrial hygienist. It 
is a common practice to use company employees from sister 
plants or sister units, who may have specific knowledge of 
the process being investigated, yet who may not be as 
emotionally connected to the incident. Use of outside per¬ 
sonnel can add additional credibility, objectivity or tech¬ 
nical expertise where appropriate. 

One member of the investigation team will normally he 
devoted full-time to coordinating the witness interviews. It 


is a good practice to designate one team member to manage 
all photography and photographic or video evidence. 
Another member is often designated as the official spokes¬ 
person coordinating all communication external to the team. 
For many incidents, management of evidence is assigned to 
a single team member. Another typical team member is 
a representative of the safety department familiar with 
the administrative safety management safeguards. 

31.4.3 Team preparations 

31.4.3.1 Training 

Team training occurs in two stages. There is normally an 
established formal training program for all potential 
investigation team members that is conducted prior to the 
event to maintain a pool of qualified potential team mem¬ 
bers. Some required training is extensive; US Hazardous 
Waste and Emergency Operations (OSHA 1910.120) and 
respiratory protection (US OSHA 1910.134) are examples 
and may require periodic refresher training and certi¬ 
fication. The incident investigation management system 
should be developed and implemented to assure that inves¬ 
tigation team member training needs are maintained. Use 
of respiratory protection devices may also require fit test¬ 
ing and pre-use medical evaluation. It is a major handicap 
to attempt to conduct all needed and legally required 
training after an event and before the investigation can 
begin.Team leaders require training in effective application 
oftheinvestigationtechnologymethodbeingapplied.aswell 
as an understanding of organizational expectations, defini¬ 
tions, reporting requirements and issues related to develop¬ 
ing recommended preventive action recommendations. 

At the time the investigation is launched, it is common 
for the personnel selected as full- or part-time team mem¬ 
bers to receive refresher training focused on the nature of 
the event. This refresher training may include personal 
protective equipment training (respiratory and other), the 
investigation methodology and approach, as well as spe¬ 
cific emergency preparedness and emergency response 
training related to the specific accident site. 

31.4.3.2 Supplies and maintaining readiness 
Investigation supplies and equipment fall into two general 
categories, individual and team items. Responsibility for 
procuring and maintaining individual items is normally 
placed on each individual team member and will include 
items such as hard hat, eye protection, safety footwear, fire- 
protective coveralls, gloves, goggles, boots, raingear, pen¬ 
cil, pen, notepad and flashlight. Team supplies are often 
collected beforehand and kept on-hand in a ready state. 
Preparation and maintenance of team supplies should be a 
component of the incident investigation management sys¬ 
tem and should be periodically inventoried, refreshed 
(batteries and film) and audited. In many instances there is a 
‘team go kit’ containing the most often used equipment that 
might be needed by two people during the first several days 
of investigation. The equipment needed by the team will vary 
considerably depending on the nature and location of the 
incident and the degree of infrastructure support immedi¬ 
ately available at, or adjacent to, the incident site. A typical 
assortment of team supplies and tools is shown inTable 31.2. 

31.4.4 Launching the investigation 
31.4.4.1 Getting started 

A critical first step is organizing the team, identifying 
potential team members and designating a team leader. 
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Table 31.2 Typical investigation team supplies and tools 


Item 

Details 

Minimum quantity 

Go bag 

Empty duffel bag 

1 

Camera - digital 


1 

Cell phone 


1 

Cell phone charger 

12 V DC for vehicle 

1 

Camera - 35 mm 


1 

Film 

35 mm 36 exp, colour 200 speed 

4 

Evidence tags 


50 

Battery for flashlight 


4 

Battery for recording device 


4 

Battery for camera 


2 

Wipes 

Box of 50 

lbox 

Zip-lock bags 

Small 

Small 4" x 6" 

25 

Medium 

Medium 8" x 10" 

25 

Large 

Large 1-2 gallon size 

12 

Plastic bags - extra-large 

10-20 gallon 

12 

Tie-wraps 

Plastic or wire 

50 

Permanent marker 

Fine point and wide point 

10 

Marker 

Yellow solid 

1 box of 6 

Marker paint stick 

Yellow medium point 

6 


Yellow fine point 

6 


Black medium 

6 


Black fine point 

6 

Tape 

Duct tape 

50 ft roll 

1 

Masking 

20 ft roll 

1 

Tape barrier marking 

‘DO NOT ENTER,’ ‘AUTHORIZED 
PERSONNEL ONLY’ 

200 ft 

Flashlight 

Explosion proof 

2 

Pocket dictating recorder with 
two cassettes 


1 

Tool 

Multi-tool 

All-in-one, pliers, screwdriver, awl 

2 

Screwdriver multiple tips 

Phillips,Torx, Slot, various sizes 

1 

Slip joint pliers 


1 

Wire cutters 


1 

Fish scale 

1-50 pound range 

1 

Pocket extension mirror 


1 

Magnifying glass 


1 

Tool box cutter 

Retractable blade 

1 

Toothbrush 


1 

Tape measure 

6.5 ft big letters 

1 


12 ft 

2 


25 ft 

1 

Ruler 

6 in. 

1 

Thermometer 

0-100 Frange 

1 

Compass 

Pocket type 

1 

Micrometer 


1 

Angle finder 


1 

Yellow string and plumb bob 


1 

Electric tester 


1 

Respirator 

Half mask, size medium 

1 

Respirator cartridges 


4 

Disposable coveralls 

Large and extra-large 

2 each 

Coveralls -Nomex 

Large and extra-large 

leach 

Disposable booties 


6 pairs 

Flags with rods 

Position markers 

24 
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Table 31.2 (continued) 

Chain-of-custody forms 

Helmet liners 

Gloves, nitrile or latex 

Gloves, leather 

Earplugs 

Eyeglasses 

Goggles 

First-aid kit 

Spray paint 

String 

Clipboard 

Pocket notebook 

Post-it notes 

Pencils — mechanical 

Pens 

Fanny pack 

Portable hand-held radios 
Garbage bags 
Rain gear 
Poncho 

Insect repellent 
Sun block cream 
Health and safety plan for 
investigation team 
Gas detector 


Safety glasses with side shields 

Small pocket size 
Pressurized cans, red/orange 

1 ball minimum 300 ft 
Metal box, straps 
Water resistant 

2 in. x 2 in. 


Set of three with spare batteries 

Large black plastic with tie wrap/closure 

Large 


Electronic and hard copy 
Personal, H 2 S, 0 2 , CO, flammable 


1 box 100 
1 dozen 


2 

2 

2 

2 

2 


Legal status of the investigation is determined and a formal 
charter is developed and issued. It is necessary to establish 
formal contact with emergency responders or regulatory 
agencies if they are in control of the scene to develop a plan 
for coordinated actions. The incident team leader should 
make preliminary arrangements for preservation of 
potential items of evidence. Sometimes the team leader may 
need to complete this action even before the initial investi¬ 
gation team meeting due to the time sensitive nature of 
some evidence. Circumstances may require the team leader 
(along with members of the investigation team who are 
immediately available) to: 

• plan and begin witness interviews; 

• organize and implement information (and evidence) 
management; 

• initiate a listing of factors that may have influenced the 
event (inherent process potential hazards, known risk 
and control measures); 

• develop a preliminary list of potential cause scenarios; 

• develop initial timeline; 

• arrange and plan for photography; 

• initiate investigation of areas outside restricted area; 

• begin to procure supplies and logistics for the team; 

• plan for evidence preservation (identification, control, 
storage, restricted access); 

• plan for team meeting - room, supplies and logistics; 


31.4.4.2 Initial team meeting 

The following section is intended to provide guidance to 
teams conducting initial team meetings for investigations 
of major incidents, however many of the items are applic¬ 
able for all initial team meetings regardless of the nature or 
severity of the event. The first order of business is usually 
formal introductions of team members and their individual 
backgrounds, experiences and skillsets that may have 


application to the investigation. The next order of business 
will address any legal and confidentiality issues. Commu¬ 
nication protocols and expectations (both internal and 
external to the team) should be clearly explained with con¬ 
firmation from each member that he understands and 
accepts the communication controls. For major incidents, 
another item for the initial team meeting is coordination 
and liaison with other entities (inside or outside the organi¬ 
zation). Evidence management should be discussed and 
preliminary arrangements made for collection, identifica¬ 
tion, documentation, chain-of-custody, storage and access 
to evidence by team members and others. Witness inter¬ 
views are an important function in every investigation, and 
it is typical to assign one team member to coordinate the 
entire interview process. Arrangements and responsibil¬ 
ities for photography (and video) are usually developed 
during the initial team meeting. There may be a recognized 
need for special technical knowledge, competencies or ser¬ 
vices that should he addressed during the initial and sub¬ 
sequent team meeting. 

It is also a good practice to address team supplies, logis¬ 
tics and consumables. There may be a need for training or 
refresher training in the use of personal protective equip¬ 
ment (such as respiratory protection or portable instru¬ 
mentation), and the initial team meeting presents an 
excellent opportunity to identify this need and make 
appropriate arrangements. As previously mentioned, it is 
a common practice to conduct specific training during 
(or immediately following) this initial team meeting. The 
initial team meeting may also include an overview tutorial 
on the process operations, materials, credible failure 
modes, previous incidents and potential hazard exposures 
than might be encountered by the team. 

31.4.4.3 Team member safety issues 

Field investigation activities are often conducted in less 

than ideal circumstances. Investigators can be exposed to 
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a variety of hazards. One common hazard is the constant 
potential for slips, trips or falls created by unstable 
working and walking surfaces. Accident scenes are often 
accompanied by sharp metal edges from debris and broken 
glass. Investigators can be injured by debris falling 
from above that becomes unstable by vibration or shifting 
rubble piles. 

Other hazard exposures include radiation from nuclear 
instrumentation devices, and stored potential energy in the 
form of hydraulics, pneumatic, spring energy and elevated 
mass. One initial task conducted by emergency response 
personnel is to attempt to isolate all sources of energy 
(electrical, pneumatic, thermal, hydraulic or other form). 
The investigation team should conduct an independent 
verification that all electrical power, energy sources and 
sources of additional fuel (gas pipelines for example) are 
isolated. It is not uncommon to find energized electrical 
circuits that were installed during construction and are not 
accurately depicted on existing electrical power distribu¬ 
tion documents. Air-borne contaminates from uncontrolled 
releases of process materials represent another potential 
hazard exposure. The team may need to conduct sampling 
to assess the need for additional clean-up or use of personal 
protective respiratory equipment. 

During the investigation, team members will often have 
need to access elevated or constricted space to make obser¬ 
vations or gather evidence. Access to elevated locations 
may have to be made by crane basket or special scaffold. 
Team members may need to be competent in the use of fall 
protection devices. Sometimes in major accidents, the 
investigators may need to deal with biohazards. As men¬ 
tioned earlier in Section 31.2.6 and Section 31.3.1, the site 
may be classified as an uncontrolled hazardous waste site, 
therefore, the team may need to implement hazardous 
waste and emergency response control measures. Regard¬ 
less, the investigation team should be prepared for emer¬ 
gencies that could occur during the course of the 
investigation, such as releases of materials or injuries to 
team members. It is a good practice to implement emer¬ 
gency alarm, alert and communication capabilities for the 
investigation team. 

31.4.4.4 Pre-entry activities 

Even before the team sets foot on the accident site, there are 
certain investigation tasks that can be initiated. Access to 
the site may be restricted due to emergency response 
activity or regulatory agencies. In many instances, the 
team, or portions of the investigation team, may be ready 
before authorization is received to make the initial entry. 
The initial team meeting can be conducted and witness 
interviews can begin, although it is more productive if the 
initial entry can be made before starting these two activ¬ 
ities. Required notifications must be completed and docu¬ 
mented. In some cases there is a requirement for follow-up 
notification. Assembling the list of potential witnesses 
and scheduling of interviews can begin immediately. 
If not already completed, the charter for the team, legal 
considerations, team composition, team leadership and 
arrangements for any travel, accommodations, team sup¬ 
plies and team refresher training should be conducted or 
confirmed. Emergency responders can be de-briefed. 
Arrangements for use of outside photography (such as 
aerial photography) can be completed. The investigation 
team meeting room, supplies, logistics and evidence 
storage arrangements can be made before the initial entry. 


Areas outside the accident scene (offsite, downwind, adja¬ 
cent units) can be toured, photographed and evaluated. The 
team or members of the team can begin to assemble rel¬ 
evant information and evidence (documentation, electronic 
data, drawings, material safety data sheets, meteorological 
records). Apreliminary timeline can be initiated as well as a 
compilation of credibly possible scenarios and factors that 
may have influenced the event. 

31.4.4.5 Initial reconnoiter 

One important activity is the initial visit to the scene. An 
effective technique for conducting this important activity 
is the initial reconnoiter. The objective of this activity is to 
obtain an overview of the entire incident scene before 
becoming overly focused on the apparent centre of the event 
and before any evidence is disturbed. The investigator (or 
in some cases the entire investigation team) conducts a 
slow, deliberate and systematic circuit from outside the 
accident scene. During this circuit the investigator should: 


look for potential safety hazard exposures to the inves¬ 
tigation team; 

look at the big picture (forest), not just the micro (trees); 
note what is not damaged; 

note what is present that would not be expected to be 
present; 

note what is absent that would be expected to be 
present; 

make intentional pauses to observe the scene from 
multiple angles and elevations; 
use all senses (such as smell, sounds, physical sensa¬ 
tions of pressure, force or heat); 


31.4.4.6 Suggested summary checklist for team leader 

The following is a suggested model checklist that can be 

prepared and used by incident investigation team leaders. 

31.4.4.6.1 Initial communications 

• Clarify known casualties and status of injured. 

• Internal notifications done and confirmed - who, when, 
what info, delivered to whom by whom. 

• Confirm legal and regulatory notifications and 
requirements - legal and regulatory status. 

• Confirm team charter - authority, administrative and 
financial, scope, reporting relationships. 

• Team member selection and notification, confirm 
availability, and identify potential availability prob¬ 
lems. 

• De-briefing with emergency responders and local site 
management - initial data gathering request. 

• Clarify need for HAZWOPER coverage and training. 


31.4.4.6.2 Initial team meeting (agenda and primary 
assignments) 

The following topics are applicable to most initial investi¬ 
gation team meetings. The team should consider each issue 
and make assignments where needed: 

• communication protocols, expectations, responsibil¬ 
ities, internal to team and external; 

• Evidence; 

- time-sensitive evidence (electronic and other), 
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- stabilization, 

- identification, 

- custody and control of access to evidence, 

- documentation, 

- storage (short term long term and preservation), 

- electronic evidence, 

witness interviews - assign responsibility for coordi¬ 
nation, identify potential witnesses, schedule, coordi¬ 
nation with other agencies and parties; 
photography - conventional film, digital, video, digi¬ 
tal, how to document and control distribution; 
logistics for team - supplies, personal protective 
equipment (PPE), finances, administrative needs, bio¬ 
logical issues; 

special services or technical skills that may be needed; 

liaison with other investigations and third parties 

(insurance, regulatory, Local Emergency Preparedness 

Committee (LEPC)); 

expectations for interim report; 

requirements, needs of management, review and 

release authorizations protocol and documentation; 

special training for team (all or part of team, PPE, 

chemistry, control, special equipments or systems); 

determine involvement of contractors; 

begin listing of known facts; 

develop initial timeline chronology; 

develop initial logic diagram to identify possible cause 

scenarios; 

identify restart criteria if applicable. 


31.5 Identifying Root Causes 

31.5.1 General concepts 

Root cause determination is an iterative process which sys¬ 
tematically seeks to identify and understand the under¬ 
lying causes that allowed the event sequence to progress to 
its ultimate consequences. As discussed in Section 31.2, the 
investigators need a clear understanding of the term root 
cause in order to determine the proper stopping point for 
the investigation. Chemical process incidents are most 
often complex events with multiple root causes (Philley, 
1992; CCPS, 2003). 

Root cause determination must be systematic and use a 
scientific approach. All credible explanations should be 
examined. Alternate scenarios that are rejected should be 
rejected based on evidence and the reasons for the rejection 
should be documented. Root cause investigation is similar 
to root cause analysis, however, there are some important 
differences between the two terms. Root cause analysis (or 
root cause failure analysis) is more often used to describe 
the process by which equipment failures are investigated 
(Mobley, 1999; Anderson, Bjorn and Fagerhaud, 2000).The 
term root cause investigation, on the other hand, is used 
in a broader context to describe the entire incident investi¬ 
gation process and all associated activities. Root cause 
analysis could be thought of as a subset of root cause 
investigation. One aspect of the root cause investigation 
process uses root cause analysis to determine and under¬ 
stand the actual adverse scenario and its underlying cau¬ 
ses. Results of root cause investigations should be based on 
evidence, reproducible and defendable. All comprehensive 
root cause determination approaches attempt to determine 
the underlying reasons that allowed a set of circumstances 
to exist, the trigger events in the adverse chain, and the 


failures in protective systems (physical systems and 
administrative systems). 

Root cause determination relies on application of the 
scientific method (BioTech Life Science Dictionary, 1995). 
The scientific method as universally accepted is an organi¬ 
zed approach to the study of a problem that consists of 
recognized steps of observation (collecting data and evi¬ 
dence), hypothesis (developing a set of credibly possible 
incident scenarios), testing (confirmation and validation of 
the speculated cause scenario), analysis (the results of the 
testing are interpreted and accepted or refuted), and con¬ 
clusion (the investigation findings) that can be indepen¬ 
dently evaluated by other investigators. As additional 
information (evidence) becomes available, investigators 
gain a more complete and accurate understanding of the 
cause scenario, then refine and adjust the hypothesis 
(speculated cause scenario). Rejected scenarios are docu¬ 
mented. All evidence is addressed, even information that 
may not support the speculated cause scenario. 

In the second edition of Lees (chapter 27), accident mod¬ 
els are discussed along with several approaches for identi¬ 
fying causes. T. Kletz views the accident as a series of 
events and assigns each eventto one of three general layers: 

• immediate measures to prevent a repeat event; 

• measures to avoid the hazard (implementing or 
strengthen barriers); 

• changes to the management system to eliminate or 
reduce the risk exposure (moving towards inherently 
safer design). 

Root cause tools are used to gather and analyse addi¬ 
tional evidence, information, and reach a more complete 
and accurate understanding of the actual scenario and 
its associated underlying reasons. Application of root 
cause determination tools is an iterative process because 
of the changing quantity and quality of information. 
Diagrams and checklist used alone do not automatically 
yield root causes, but do provide general direction and 
structure to assist investigators to examine possible issues 
that may apply to the incident being investigated. The 
investigators then use the specific evidence, facts, circum¬ 
stances and available information to determine the root 
causes. Various methodologies use different types of dia¬ 
grams, charts, checklists and definition of specific terms 
such as ‘near-root cause,’ ‘basic cause,’ ‘causal factors’ and 
others. It is not in the scope of this chapter to present a 
summary of all root cause determination methodologies 
currently in use. 

31.5.2 Toolbox 
31.5.2.1 Chronology 

Most root cause methodologies incorporate use of a chro¬ 
nology tool to establish the sequence of events, activities 
and conditions. Development of a timeline chronology is an 
iterative activity and allows the investigator to better 
understand the evidence and witness statements. Some 
items on the timeline can be precisely positioned because 
there is hard evidence such as a record of the time of alarms 
and instrumentation data (see Figure 31.3). Exact time for 
other information may not be capable of being determined, 
however, relative sequence may be identified. Some root 
cause investigators use the timeline to assist in identifying 
those events that represent adverse consequences, man¬ 
agement system breakdowns, unplanned situations or 
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failures of safeguard protective measures. In some root 
cause investigation methods, these undesirable outcomes 
are classified as ‘critical events.’ There is no established 
convention for constructing a chronology diagram. Some 
investigators prefer a horizontal orientation, while others 
find value in vertical or diagonal formats. For complex 
events or where there are simultaneous parallel sets of 
activities, the timeline can be expanded into branches and 
parallel tracks. 

31.5.2.2 Logic diagrams 

Logic diagrams have several applications in investigations, 
and are most often developed in an iterative fashion. As 
shown in the event tree logic diagram in Figure 31.4, in the 
early stages of an investigation they can be used to illus¬ 
trate credibly possible reasons, conditions and events 
to assist in determining the cause scenario. As shown in 
Figure 31.5, they can point the investigators to what spe¬ 
cific additional information or evidence might be gathered 
in order to confirm or refute a postulated cause scenario. 
In the middle and late stages of an investigation, logic 
diagrams can be refined and used as a quality control tool 


Partial Timeline 



to ensure the team is systematically addressing the infor¬ 
mation and that individual branches of the logic tree are 
consistent. Another use of logic diagrams is in presenting 
the findings in a formal written report. A simplified logic 
tree can be used to present the cause scenario and illustrate 
conditions and events so that the reader can follow a com¬ 
plex incident. In the early stages of an investigation, the 
type of logic gate may not be initially known since rela¬ 
tionships between facts, events or causes may not be suffi¬ 
ciently understood. At the later stages of the investigation, 
when the event is better understood, the types of gates 
(exclusive AND gates, OR gates) can be refined into the 
iterative diagram. Deductive diagrams similar to the con¬ 
ventional ‘fault tree’ diagrams are the most common type of 
investigative logic diagrams. On occasion, inductive dia¬ 
grams (such as the ‘event tree’ shown in Figure 31.4) may be 
used to determine a most likely match between known facts 
and possible causes. One special type of investigation logic 
diagram is the management oversight and risk tree 
(MORT) (Johnson, n.d.). The MORT investigation method 
uses a generic logic tree with pre-existing gates. The 
investigation team gathers and examines evidence to con¬ 
firm which branches of the tree were applicable in the par¬ 
ticular incident being investigated. 

The team applies the logic diagram in an iterative man¬ 
ner to identify what conditions and actions were present or 
were needed for the accident to occur. The initial logic dia¬ 
gram may contain several speculated ‘OR’ gates, where the 
information currently available is insufficient to determine 
if the branch was applicable. The logic diagram will high¬ 
light missing pieces of information thereby guiding the 
team to gather additional focused information. A logic dia¬ 
gram can highlight evidence that is inconsistent or contra¬ 
dicts a proposed incident cause scenario. Once there is 
sufficient evidence to refute a particular branch, further 
development of that particular branch is terminated and 
documented. Near the final stages of the investigation, the 
logic diagram can be used in a quality assurance mode to 
verify known facts meet logic principles and that each 
branch is in agreement with all other branches of the logic 
diagram. 


Tank at high level 
condition 


Tank reaches 
99% capacity 
During filling 
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One important limitation is that logic diagrams do not 
always show time or sequence relationships relative to the 
information on the diagram. Special charting diagrams use 
a combination of chronology and logic diagrams to illus¬ 
trate and understand the event. Some investigation meth¬ 
odologies apply special conventions such as the shape of 
text boxes and the type of interconnecting lines to further 
illustrate the event. 

Consider the following typical tank overflow event. 

Operator was unloading tank truck of liquid solvent 
while loading railcar of VCM chemical. Solvent storage 
tankTK102 was overfilled causing it to overflow. Approxi¬ 
mately 1735 gallons of solvent spilled into dike area. Level 
gauge on solvent tank was found to be 16% out of calibra¬ 
tion, thus reading low. VCM railcar was experiencing 
vapour lock problems. Incident occurred just before shift 
change. Level instrumentation on solvent tankTK102 was 
32 years old and was calibrated every 36 months. 

The initial logic diagram developed by the investigators 
might look like something shown in Figure 31.5. 


Partial Logic Diagram 



Investigation to 
Determine WHY? 

Figure 31.5 Logic diagram for tank overflow incident 


The investigation team then gathers additional infor¬ 
mation and evidence and develops an initial chronology. 

As additional evidence becomes available the team is 
able to refine the logic diagram and move closer to identi¬ 
fying underlying root causes (see Figure 31.6). Each branch 
of the logic tree is then developed to a point where evidence 
proves that the branch was not applicable, or to the point 
where underlying root causes can be identified. 

Another special diagram is the Ishikawa fish-bone dia¬ 
gram where information and conditions leading to the 
event are depicted as branches on a horizontal format (see 
Figure 31.7). The fishbone diagram is not a true logic dia¬ 
gram, however it does provide an effective tool for investi¬ 
gators to systematically gather and examine information 
relative to the causes of the incident. 


31.5.2.3 Application of critical thinking skills/concepts 
Critical thinking uses concepts of logic and reasoning in 
problem solving to produce more accurate and defendable 
conclusions (Philley, 2000). The investigation team is often 
initially confronted with conflicting information from wit¬ 
nesses and a large set of credibly potential scenarios, 
therefore, investigation of chemical process incidents can 
benefit from application of critical thinking skills. This 
section discusses several aspects of applying principles of 
critical thinking, to the investigation. The term ‘critical 
thinking’ has multiple definitions. One simple definition 
is, ‘the art of thinking about your thinking in order to 
make your thinking better’ (thereby making your think¬ 
ing clearer, more accurate, or more defensible (Center for 
Critical Thinking, n.d.). Applied to incident investigation, 
critical thinking helps the investigation team to: 


• identify and evaluate potential cause scenarios; 

• evaluate evidence in support of (or to refute) a proposed 
cause scenario hypothesis; 

• select the most appropriate (most likely) cause scenario. 


Partial Investigative Logic Diagram 



investigators continue each branch, gathering additional information 


Figure 31.6 Developing logic diagram 
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Fish-Bone Diagram for Investigations 


Environment 



Figure 31.7 Sample fish-bone diagram 


31.5.2.3.1 Lateral thinking 

One important critical thinking concept useful in investi¬ 
gation is lateral thinking. Lateral thinking is sometimes 
characterized as ‘thinking out-of-the-box.’ When applying 
lateral thinking, investigators search for alternate expla¬ 
nations that fit a given set of known conditions and facts. 
As additional evidence and information becomes available, 
the alternate explanation will become more or less credibly 
possible. Lateral thinking is particularly valuable in the 
early stages of the investigation in order to prevent the team 
from prematurely locking-onto an incorrect cause scenario 
and also in evaluating apparent contradictions in evidence. 
Lateral thinking allows and encourages investigators to 
deviate from normal explanations, conventions and expec¬ 
tations. Creativity is used to identify possible alternate 
explanations for the evidence presented. When presented 
with a set of circumstances, our first response is to find a 
traditional explanation that fits the facts as we understand 
them to be. A lateral thinking approach to identifying a 
cause scenario would not reject the most likely explanation, 
but would expand the set of possible scenarios to include 
alternate, less probable, explanations for the same set of 
facts. Alternate scenarios remain on the table until there is 
clear reason and evidence for rejecting them. Lateral 
thinking sometimes generates extra work for the investi¬ 
gation team to document reasons why alternate explana¬ 
tions were rejected. Nevertheless, it adds to the overall 
quality of the investigation and makes the ultimate find¬ 
ings more credible and defendable. 

31.5.2.3.2 Critical thinking validation of cause scenario 
One critical challenge is to accurately and quickly deter¬ 
mine the cause scenario. Validating speculated possible 
scenarios is fundamental to investigation success. In a 
purely scientific setting, a set of validity tests has been 
developed to prove a theory or hypothesis (Lett, 1997). 
In practical industrial accident investigations, these 
validation principles can be used to ensure a quality 
investigation: 

• Is the scenario logical? 

• Is it comprehensive in addressing all known evidence? 

• Are the identified causes sufficient to create the result? 

• Can it be replicated? 

• Does it have honesty and integrity? 


31.5.2.3.3 Logic 

This first validity test confirms that the identified scenario 
and associated facts agree with accepted logic principles 
(Webster’s II New Riverside Dictionary, 1984). Any argu¬ 
ment offered as evidence to support or disprove a suspected 
incident cause hypothesis must follow accepted rules of 
logic. Two excellent examples of this logic test are the 
fact-hypothesis matrix (CCPS, 2003), and the use of truth 
tables when testing the output of binary electronic circuits 
or when diagnosing/troubleshooting instrumentation 
systems. Logical thinking is essential for accurately deter¬ 
mining the scenario cause relationships in every process 
safety incident investigation. Investigators must apply 
logic and reason effectively. 

For example: 

1. if the temperature in tank A was higher than in tank 
B, and 

2. if the temperature in tank B was higher than in tank C, 
then, by logic and reason 

3. the temperature in tank A must have been higher than 
in tank C. 


31.5.2.3.4 Comprehensiveness 

The second validity test, comprehensiveness, confirms 
that all known information has been addressed in the 
evaluation. The team does not have the prerogative of being 
selective about which facts it accepts, even if a particular 
fact may not appear to support the preferred hypothesis. 
There is a natural tendency to welcome specific infor¬ 
mation that supports the scenario preferred by the investi¬ 
gators. There is a corresponding tendency to ‘reject’ 
information that does not support the desired hypothesis. 
At the conclusion of the investigation, if there is any evi¬ 
dence available that contradicts the cause scenario, reasons 
for refuting this contradictory information should be 
adequately documented. In purely scientific research activ¬ 
ity, this comprehensive test is easier to apply. However, 
in the practical world of industrial incident investigation, 
there are varying degrees of credibility regarding the 
accuracy of information. Not all information available to the 
investigation team has the same degree of truthfulness and 
accuracy. Often, the team will initially be faced with see¬ 
mingly contradictory information. In most, but not all 
cases, apparent contradictions can be resolved by gather¬ 
ing additional clarifying information. Inconsistent or con¬ 
flicting information is especially common in information 
gathered from witness interviews. 

31.5.2.3.5 Sufficiency 

The third validity test is sufficiency. Evidence offered in 
support of a cause scenario must be adequate (sufficient) to 
establish proof. If a scenario requires three components to 
be present, then the investigation team must establish the 
credible presence of all three components. 

31.5.2.3.6 Replicability 

The validity test of replicability requires that any evidence 
that is based on experimental results is capable of being 
duplicated by others using the same conditions. 

31.5.2.3.7 Honesty 

The final validity test is honesty. On the surface, this test 
seems an obvious requirement. However, in handling or 
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presenting evidence, there are opportunities for mislead¬ 
ing or incomplete representation of facts. The investigation 
team must exercise a high degree of honesty and integrity, 
especially in cases where findings may not be favourable to 
the organization’s reputation. Selected omission of infor¬ 
mation can have a significant effect and there is an obliga¬ 
tion to document any unresolved inconsistencies. 


31.5.2.3.8 Cause scenario selection issues 
Incident investigators often encounter cases of subjective 
opinion masquerading as truth. When analysing informa¬ 
tion, it is important to distinguish between objective fact 
and subjective opinion. Investigators should be alert for 
dogmatic statements that may not be supported by actual 
evidence. Dogmatism is establishing conclusions on rules, 
conditions, protocols and prescriptions established by 
some authority. Merely because oxygen tests are required 
by written procedural instructions does not mean that tests 
were actually conducted in the instance being investigated. 
The investigation team must verify assumptions. Stipula¬ 
tions should be clearly and thoroughly identified. 

Another challenge to investigators is determining which 
information is actually true. Investigators will often be 
faced with apparent contradictory information from wit¬ 
nesses. Witness testimony is a combination of actual true 
facts, personal opinions and judgements, and recollec¬ 
tions. Witness statements often reflect a conglomeration of 
first-hand information, assumptions, conclusions and 
hearsay. Information relayed in a verbal manner is subject 
to distortion and inaccuracy. Absolute truth is not created 
by consensus of opinion. Merely because a large number of 
people believe something to be true does not make the 
information a true fact. 

Here are three examples of ‘consensus opinion’ that at 
one time were believed to be facts. 

• ‘The earth is flat.’ 

• ‘The sun revolves around the earth.’ 

• ‘Accurate prediction of the future can be made by 
autopsy of a human liver’ (according to the early Baby¬ 
lonian practice of hepatoscopy, Shick and Vaughn, 
1999). 

Another critical thinking challenge is the occasional 
conflict between something that may be logically possible, 
but is physically impossible. Although it may be logically 
possible for a cow to jump over the moon, in the practical 
world there are physical limitations that prevent this 
statement to be physically possible. 

Memory imperfection is another variable that must he 
addressed using critical thinking. Significant differences 
in witness statements can be traced to our inefficient 
memory mechanisms. Investigators must apply critical 
thinking skills when faced with apparent contradictory 
information from different witnesses. Our perception can 
change over time as we gain additional information from 
interacting with other people and information sources 
(Gilovich, 1991). 

One major obstacle to evidence analysis is natural infor¬ 
mation filtering mechanisms that are part of normal 
thinking processes. Our perception of reality is actually a 
mental construction of several components. When faced 
with incomplete or potentially contradictory information, 
our brains will attempt to fill in the blanks to allow us to 


process and ‘make sense’ of the incoming information. The 
most common example of this is the optical illusion where 
our brain makes a determination when faced with ambigu- 

Accurate identification of the actual cause scenario 
can be adversely affected by several factors. One obstacle 
is premature selection of the cause scenario. The investi¬ 
gation must identify and examine all credible potential 
cause scenarios before selecting one cause scenario as 
the most likely based on the available facts. Early estab¬ 
lishment of ‘a most likely scenario’ is not a mistake as 
long as alternate scenarios remain under consideration 
until there is sufficient evidence to reject them. Premature 
selection of the cause scenario can create avoidable 
mistakes. The first problem is the resulting delay in iden¬ 
tifying the correct accident sequence, due to the team 
investing time, money and resources pursuing a false trail. 
A second potential problem is triggering irrational defence 
of an invalid scenario. Investigators are slow to abandon a 
preferred cause scenario, even when faced with evidence 
that would clearly disprove the scenario. The third poten¬ 
tial problem is the loss of credibility generated when the 
team has to announce that their initial findings and con¬ 
clusions were incorrect. This decreased credibility has 
an adverse impact, especially in instances where litigation 
is involved. 

Determination and selection of ‘the cause scenario’ 
involves rationalization. According to Psychologist Barry 
Singer (Gilovich, 1991), numerous experiments have con¬ 
firmed our natural behaviour regarding how we develop 
hypothesis and conclusions. It is our normal pattern to 
quickly (and automatically) form a hypothesis and then 
begin to seek confirming evidence. We do not inherently 
place emphasis on seeking evidence that might disprove 
our hypothesis. We tend to stick to (and vigorously defend) 
our original hypothesis even when faced with conflicting 
evidence that might disprove our desired hypothesis. 
Therefore, investigators should make a strong and con¬ 
scious proactive effort to operate with an open and 
unbiased approach, especially during the early phases of 
an investigation. 

Another challenge is the false or hidden assumption. It is 
sometimes easy to make incorrect assumptions regarding 
the association between truly random events, thus gen¬ 
erating a cause and effect correlation where there is not a 
direct cause and effect. Hidden assumptions can play havoc 
with an investigation when a team makes an assumption 
without realizing that an assumption has been made. These 
hidden assumptions often show up as inconsistencies in 
the cause scenario. When assumptions are made, they 
should be clearly identified and documented. 

Misjudging likelihood/probabilities can lead to erro¬ 
neous determinations when the investigation team believes 
a cause event to be too unlikely and, therefore, fails to 
thoroughly investigate a particular cause. Most people are 
not naturally proficient at estimating likelihood or prob¬ 
abilities of events. We remember confirming events much 
more effectively than we remember events that do not con¬ 
firm a perception. Numerous examples can be identified 
that illustrate our inability to accurately estimate prob¬ 
abilities. Perhaps one of the more common examples relates 
to our general non-appreciation of the odds for winning a 
typical lottery. Where contestants are asked to select a set 
of six winning numbers from a field of 50 numbers, the 
actual odds are on the order of 15 million to one. 
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A final challenge related to rapid and accurate determi¬ 
nation of the cause scenario is misplaced credibility. All 
other things being equal, we put more credibility on the 
first version of the story we hear. Subsequent versions that 
differ from the initial version are given less credibility 
because we begin to activate some of our natural mental 
filters (Gilovich, 1991). 


31.5.2.4 Truth table matrix 

Truth table matrices are common tools in logic and trou¬ 
bleshooting diagnostic activities. This concept has useful 
application in incident investigations. This tool can be 
applied effectively to help the investigation team determine 
the most likely scenario among a set of speculated credible 
cause scenarios, as well as assist the investigation team in 
resolving inconsistencies generated during witness inter¬ 
views. The fact-hypothesis matrix is a special version of 
the logic truth tables used in developing control system 
logic and diagnosing/troubleshooting activities (CCPS, 
2003). The tool can be used during the early stage of the 
investigation to allow the investigation team to focus on 
which evidence and fact issues and information could be 
further investigated in order to quickly produce a cause 
scenario that best matches the known facts. The fact- 
hypothesis matrix can be used in the later stages of the 
investigation in a quality assurance application to confirm 
consistency. The concept is simple: known (or suspected) 
facts are placed on one axis of the matrix and potential 
cause scenarios are placed on the other axis. Then the 
facts are analysed in conjunction with the speculated cause 
scenario for consistency (Table 31.3). 

Facts fall into at least one of four categories: 


1. + Yes - The fact supports the hypothesis (speculated 
cause scenario); 

2. - No - Fact contradicts (refutes) the hypothesis; 

3. 0 Neutral - The fact neither supports nor contradicts 
the hypothesis (is neutral); 


4. ? Insufficient information - The team does not have 

enough information to make a determination regarding 
category 1, 2 or 3. In this case, the team can then 
determine what specific information might be gath¬ 
ered that would allow the team to confirm or refute the 
relationship between the fact and the speculated 
hypothesis cause scenario. 

31.5.3 Specific methodologies and approaches 

The following discussion is not an attempt to include all 
recognized public or private root cause determination 
methodologies and approaches. This section is intended to 
present a representative sampling of some common meth¬ 
ods currently in use in the process industry. There is no 
intention to endorse any particular approach/method, and 
no attempt is made to fully explain contrast or compare one 
method to another. It is recognized that many organizations 
have developed and implemented effective internal inves¬ 
tigation protocols and methods based on their organiza¬ 
tion’s policies, resources and management styles. 

31.5.3.1 MORT 

One of the most widely distributed generic logic trees is the 
MORT developed by the US Atomic Energy Commission. 
The MORT diagram is part of the MORT system safety 
analytical procedure, and identifies causes and contribut¬ 
ing factors by systematically applying the generic causes 
and conditions against known facts associated with the 
incident. MORT diagram is a formal disciplined logic or 
decision tree to relate and integrate a wide variety of safety 
concepts systematically (Johnson, n.d.). Potential weak¬ 
nesses or breakdowns in management systems are con¬ 
sidered. A five-stage accident sequence generic model 
is used and is based on the original Heinrich dominos: 
(1) (background factors, (2) initiating factors (underlying 
conditions), (3) intermediate factors (such as environ¬ 
mental and hazard recognition), (4) immediate factors 
(the trigger events or unsafe acts), and (5) the resulting 
consequence results. The barrier and barrier analysis 


Table 31.3 Fact-hypothesis matrix/truth table 


Possible cause scenario 

Fact #1 

Fact #2 

Fact #3 


Lab Sample at 0600 
showed elevated 
moisture content 

High level alarm and 
high level condition 
noted in process sump 

Vent compressor tripped 
twice on the shift before 
the explosion 

A 

Event triggered by 
contaminated feedstock 
raw material 

Yes 

Supports the scenario 

Do not have enough 
information to decide 

0 

Neutral effect 

B 

Block valve left in 
incorrect position 
allowed backflow 
contamination 

0 

Neutral effect 

Yes 

Supports the scenario 

No 

Refutes the scenario 

C 

Leak in heat exchanger 
created contamination 
and overpressure 
condition 

Do not have enough 
information to decide 

Yes 

Supports the scenario 

Yes 

Supports the scenario 
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concept is used. The MORTsystem also considers change, 
change analysis, risk assessments and risk decisions. 
When applying the generic tree there are approximately 
1600 potential gates that must be evaluated. 


procedure (Benner, n.d.). In the STEP approach, events are 
arranged on a horizontal axis and designated actors are 
arranged in a vertical column, then the relationships 
between actors and events are connected. 


31.5.3.2 CCPS A and B approaches 

In the second edition (2003) of the Incident Investigation 
Guidelines published by the Center for Chemical Process 
Safety (CCPS) of the American Institute of Chemical 
Engineers, there is recognition of two general approaches 
in wide use in the process industry for root cause determi¬ 
nation. Both are iterative and begin with an accumulation 
of known information, data, and evidence. One approach, 
method A, applies a logic tree and an iterative loop with an 
associated set of formal stopping rules and quality assur¬ 
ance gates to ensure the investigation has progressed deep 
enough to reach the root cause level and broad enough to 
address multiple causes. The other approach, method B, 
seeks to identify causal factors and then applies pre¬ 
defined generic trees to identify potential root causes. Both 
methods are effective. 

31.5.3.3 Methods based on sequence diagrams 
Sequence diagrams combine the timeline and the logic 
diagram concept, and attempt to depict the incident sce¬ 
nario events and conditions that allowed the sequence to 
progress. Sequence diagrams are not necessarily intended 
to provide a complete incident investigation system, how¬ 
ever, they can be used to identify causal factors for sub¬ 
sequent analysis. In some sequence methods such as the 
multilinear event sequencing (MES) approach (Benner, 
n.d.; Atkins, 2001), a distinction is made between actors, 
actions and events. An actor is a person, substance or piece 
of equipment. Actions are defined as anything carried out 
by an actor. Events are results of those actions by the actor. 
There are several versions of causal factors charting 
currently being applied in the process industries. Rhone 
Poulanc implemented an events and causal factors chart¬ 
ing system. The causal factors charting approach is similar 
to MES diagram (see Figure 31.8), and breaks down the 
incident into individual events and causes, developing a 
diagram that is a cross between a logic diagram and a 
sequence diagram. A further evolution of this concept can 
be found in the sequentially timed events plotting (STEP) 


Sequence Diagram 



31.5.3.4 Cause analysis methods 
One method for incident investigation focuses on changes 
(known, unknown, intended and unintended). The Flix- 
bourgh explosion in 1974 was the result of temporary pip¬ 
ing changes. One of the causes of the Apollo 13 US Space 
Mission incident was an ineffective change management 
system that failed to find and properly modify all electrical 
components that would he impacted by a change in oper¬ 
ating voltage from 28 to 65 V (Goodwin, 2000). The change 
analysis investigation method guides investigators to 
identify and analyse all conditions and items that were 
different for the specific event. Root causes are found in 
examining the deviations from normal. 

The hazard-barrier-target model (Figure 31.9) for acci¬ 
dent causation provides a basis for several investigation 
methods. Accidents are viewed as a ‘hazard’ (some form of 
energy), acting on a target (usually a person). In the normal 
course of events, barriers prevent interaction between the 
hazard and the target. However, on occasion the barrier is 
insufficient to prevent the accident. An accident can be 
described in terms of an unwanted energy flow that comes 
into contact with a person. Barriers can be physical such as 
machine guards, instrumentation system interlocks or 
control systems, or can he administrative such as training, 
policies, procedures and practices. The number, reliability 
and robustness of the barriers are proportional to the 
potential consequences and are related to the risk (like¬ 
lihood and consequence). Recognizing that any given 
barrier will have a certain degree of unreliability, these 
investigation methods seek to identify and examine the 
barriers (management systems). 

Another method sometimes used to identify underlying 
causes is the job safety analysis (JSA, sometimes called job 
hazard analysis). A task is broken down into its component 
actions and each is examined individually to identify 
potential hazards and the associated safeguard measures 
that were established to prevent the hazard from acting on 
the person. JSA can be viewed as a special case of examining 
the hazards and barriers. Another cause analysis approach 
is the systematic cause analysis technique developed by 
the International Loss Control Institute (now Det Norske 
Veritas (DNV 1996)). In this approach, the investigation 


Hazard-Barrier-Target Model 


TARGET 
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□ TARGET | 
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Figure 31.8 Causal factors chart example 


Figure 31.9 Hazard-barrier-target model 
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team is guided through a deepening series of questions 
that initially examine general safeguards and conditions 
concluding with a list of possible system defects that 
the investigators should evaluate based on the evidence 
and specific circumstances for the incident being investi¬ 
gated. 

There are numerous additional analysis and decision 
making methods that can be applied to portions of the 
investigation, but that are not considered stand-alone inci¬ 
dent investigation methodologies. Two examples are the 
human reliability assessment (HRA) where human actions 
are systematically identified and analysed, and the failure 
mode and effect analysis (FMEA), which is an inductive 
method for examining failures in systems or components. 
Several recognized PHA methods can be used in all or 
parts to assist investigations. When attempting to match up 
possible scenarios with available evidence, the hazard and 
operability (HAZOP) approach can be beneficial in 
searching for credible deviations from intended design and 
operating conditions. The WHAT-IF method is a helpful 
brainstorming technique for speculating possible causes 
and then directing the investigation team in evidence 
gathering to confirm or refute a speculated scenario. 

31.5.3.5 Commercial methods 

There are several publicly available commercial root cause 
investigation methods, three of which are discussed below. 

TapRooT,® system is a commercially available process 
and set of techniques to investigate process safety inci¬ 
dents, analyse and develop corrective actions. It is widely 
used in the US process industry. The TapRooT® system 
(process and tools) combines both inductive and deductive 
techniques for systematic investigation of the correctable 
root causes of problems. TapRooT®goes beyond the simple 
technique of ‘asking why’ or the standard techniques of 
cause and effect (sometimes known as fishbone diagrams) 
or fault tree diagrams. Embedded intelligence allows Tap¬ 
RooT® to be used by people in the field to investigate 
everyday problems and yet, is robust enough for a complex 
major process safety accident investigation. Tools and 
techniques are used in all phases of an investigation - from 
initial planning through the collection of information and 
root cause analysis to the development of corrective actions 
and the presentation of an investigation to management or 
other interested parties. The system is supported by patent 
pending TapRooT® software and provides a trendable 
incident/root cause database and corrective action man¬ 
agement database (TAPROOT, www.taproot.com). 

Another commercial incident investigation methodology 
is the Apollo incident investigation and problem solving 
techniques method published by Apollo Associated 
Services Inc. The Apollo approach uses cause and effects 
charting and provides investigators with basic problem 
solving concepts to reach root causes. The reference is 
accompanied by worked examples and a training video. 
Guidance is provided to consider personnel performance 
factors, problems with written procedures and instruc¬ 
tions, and general hardware deficiencies. 

A third commercial root cause method is the REASON 
methodology developed by Decision Systems Inc 
(REASON, www.rootcause.com) This methodology is 
designed to provide a standard process that allows all 
options to be identified, modelled and analysed. The 
approach is presented as a standard operating procedure in 
a step-by-step format, to guide the investigator to ask the 


right questions to identify all relevant causes of the event. 
The REASON root cause analysis is a systematic process 
and software package for gathering and ordering relevant 
data, identifying internal causes that generated or allowed 
the problem to develop, and provides decision makers 
comparative cost effectiveness benefits of various possible 
remedies. 

The US National Safety Council (1995) published a sys¬ 
tematic approach for incident investigation that presents 
principles of investigation and the role of management 
leadership. The publication includes a guide for identifying 
causal factors and corrective actions using a set of work¬ 
book charts that lead the investigator to the underlying 
causes of incidents. Although this methodology is sys¬ 
tematic, it may not be sufficiently sophisticated and rigor¬ 
ous for complex process safety events. 

31.6 Recommendations, Reports and 
Lessons Learned 

31.6.1 Recommendations 

The payoff stage in the incident investigation process is 
implementation of changes that will eliminate the identi¬ 
fied root causes, thus reducing likelihood of a repeat inci¬ 
dent. This final stage involves development and evaluation 
of potential action item recommendations and begins once 
the root causes have been identified. In many instances, the 
charter of the investigation team ends with development of 
recommendations and issuance of a report. When recom¬ 
mendations are submitted to management, responsibility 
for action (acceptance and implementation) is transferred 
from the incident investigation team to the organization’s 
management structure. Management must evaluate, 
accept, reject or modify the recommendation and then 
implement changes. Until and unless these changes are 
implemented, the risks for a repeat incident remain 
unchanged. In some instances, even before the investiga¬ 
tion is completed, immediate action is recommended and 
implemented to take temporary measures to reduce or con¬ 
trol the hazardous risk exposures. 

All potential recommendations from the incident inves¬ 
tigation team should be reviewed for possible negative 
impact. It is not uncommon to inadvertently create or 
aggravate a second problem while trying to correct the 
original problem. Proposed changes should go through the 
management-of-change system for review and approval. It 
is not unheard of for incident investigators to develop 
recommendations that create a new problem while trying to 
eliminate or reduce an original problem (Kletz, 1993). When 
considering potential recommendations, the first priority 
would be to seek remedies that prevent the event before 
seeking remedies that mitigate consequences. Principles of 
inherent safety and layer of protection analysis can be 
successfully applied when considering remedies for root 
causes. Sometimes an investigation team will be able to 
identify and remove common cause failures that act on 
more than one safeguard. Many organizations now apply 
cost-benefit analysis to all proposed recommendations. 
The expected risk reduction benefits are calculated and 
compared to the expected cost of implementation (initial 
and continuing costs). 

When drafting text for recommendations, it is a good 
practice to include information related to benefits gained 
by implementing the action or to include potential 
consequences that might be incurred by rejecting the 
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recommendation. In a large majority of instances, the 
actual recommendation text (typically a text block of one or 
two sentences) is extracted and transferred to a listing or 
database of action items. The recommendation text block 
becomes a stand-alone text block, without the supporting 
information included in the written incident report. The 
new listing or database document often does not include 
specific information as to the origin of the recommenda¬ 
tion, the context in which the recommendation was devel¬ 
oped, circumstances that justified the recommendation, or 
possible consequences for failing to implement the recom¬ 
mendation. Well-written recommendation statements will 
begin with a phrase such as,‘In order to minimize the risk of 

.(insert specific consequences related to the specific 

recommended action), it is recommended that. 

(insert specific action).’ The practice of including the con- 
sequences-to-avoid or the benefits provided will assist the 
management team in evaluating and reaching a decision as 
to implementing the recommendation. 

Recommendations should be worded so the intentions of 
the investigation team and recommendation are clear to the 
reader. Wording that can be ambiguously interpreted 
should be avoided or clarified. Specific item numbers 
should be used wherever possible. A poorly worded 
recommendation might read, ‘Review start-up procedure 
for by-pass compressor.’ A better stated recommendation 
would read, ‘In order to prevent overpressure of the vent 
blowdown drum D-112, it is recommended that start-up 
procedure SP-1-22 be modified to clearly include the need 
for verifying a purge and de-pressure has been completed 
for By-pass Compressor C-14’. There are two conventions 
for drafting text for recommendations. Hard recommenda¬ 
tions are written in specific clear action terms, such as ... 
‘Provide an additional layer of overflow prevention protec¬ 
tion for tank T-102.’ Soft recommendations are intention¬ 
ally written to allow flexibility in implementation. Soft 
recommendations often begin with words such as ‘consider’ 
or ‘evaluate.’ Response actions required by hard recom¬ 
mendations are more rigorous and demand additional 
documentation in the event that the recommendation is 
rejected or modified. 

Another special case is the ‘If X ... then do Y...’ recom¬ 
mendation. Investigation teams may not have sufficient 
information to fully evaluate a specific hazard (or existing 
safeguard) and may generate a recommendation such as, 
‘Determine the auto-ignition temperature of reactor inter¬ 
mediate wash water product’. In cases where the investiga¬ 
tion team recommends further evaluation or further 
identification of information, it is a good practice for the 
recommendation text to include an ‘If ... then ...’ instruc¬ 
tion to indicate the investigation team’s expectation once 
the additional information does become available. An 
example would be the confirmation recommendation. The 
team may generate a recommendation to the effect of, 
‘Confirm that aqueous mixtures of chemical X are not 
soluble in chemical Y.’ The recommendation text should, in 
this case, include recommended actions to be taken if the 
mixture is determined to be insoluble in chemical Y, and 
what actions should be taken if, in fact, the mixture is 
determined to be soluble in chemical Y. 

In most chemical process incidents investigated by a 
team, there are significant consequences and an accom¬ 
panying likelihood for legal action. In these instances, 
recommendations require review and approval by the 
organization’s legal representatives, in order to minimize 


unnecessary litigation exposures. In some cases, normal 
language used in the manufacturing plant to describe the 
scenario, causes or suggested action items may trigger 
unexpected legal responses. The primary objective of the 
organization’s legal staff is to minimize or avoid adverse 
consequences from litigation or regulatory activities. In 
this context, there is a benefit in having legal representa¬ 
tives conduct a review and suggested edit of the text of the 
incident report, findings and recommendations. Legal 
representatives will normally be able to quickly identify 
text that may potentially be inflammatory, judgemental, 
subjective or especially damaging in future litigation. 

Some organizations make a distinction between findings 
and recommendations. Findings are statements of fact and 
do not include any suggested action. A team may find that 
there was no lubrication oil in the compressor gearbox or 
that the material of construction for a component of the 
piping system was Schedule 40 carbon steel 2-inch in dia¬ 
meter and the required specification for this service was 
Schedule 80. These findings statements are accompanied 
by separate recommendations for specific actions to 
address identified deficiencies Figure 31.10. 

The likelihood of a repeat incident remains unchanged 
unless and until preventive action is actually implemented. 
Proactive sharing of investigation results with all who 
could benefit will amplify potential benefits of the investi¬ 
gation. In the United States, there is a regulatory obligation 
for sharing results of certain process safety incident 
investigations with all workers (employees as well as con¬ 
tractors) ‘whose job tasks are relevant to the findings’ of the 
investigation (OSHA, n.d.). 

It is a recognized industry best practice to establish a 
formal system for promptly addressing and resolving 
recommended action items from investigations. Recom¬ 
mendations are often risk-ranked and assigned priorities 
so that the management team can more effectively reach 
decisions related to implementation schedule. Documenta¬ 
tion of the resolution of the recommendation and status 
tracking are important features of an effective incident 
investigation management system. If an original recom¬ 
mendation is modified or rejected, there should be docu¬ 
mentation stating the reasons for not implementing the 
recommendation as submitted by the incident investiga¬ 
tion team. In some organizations, the investigation team 
will submit a draft report for management review and 
approval containing proposed recommendations. After the 
final version of the recommendations have been accepted 
by management, completion assignments are made, target 
dates are established, and the final version of the recom¬ 
mendation is published. In many instances of serious 
chemical process incidents, review and approval of the 
recommendations text by the legal department is impor¬ 
tant and necessary. 

Some organizations include verification of implementa¬ 
tion as part of routine periodic audits and evaluations of 
the continued effectiveness of the incident investigation 
management system. 

There is an increasing emphasis and appreciation for the 
concept of verification and confirmation that the recom¬ 
mendation was implemented as intended and also that the 
action achieved the intended objective. In some progressive 
organizations, completion of recommended action items is 
closely monitored and accompanied by periodic status 
reports. Items that are not completed as scheduled receive 
special attention. Timely completion of action items has 
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Figure 31.10 Recommendations flowchart 


been recognized as a leading indicator for more successful 
safety management systems. Action item resolution can be 
integrated with other systems such as audits, inspections, 
quality assurance, PHA, pre-start-up safety reviews and 
management of change systems. 

31.6.2 Reports 

The written report is an accident prevention communica¬ 
tions tool to share findings and lessons learned from the 
investigation. There is a wide variety of report style and 
format. Some reports are highly technical and provide 
extensive detail on complex systems, failure modes and 
process operation. Other reports are as brief as one or two 
paragraphs and function as a heads-up alert communica¬ 
tion. A best practice format for internal process incident 
reports is shown in Figure 3.11. The report begins with a 
summary. This summary is most effective if limited to a 
single page highlighting the major items of what happened, 
why, and what the suggested action items are. For many 
process incident reports, it is beneficial to prepare a back¬ 
ground section to allow the reader to fully understand the 
process, the associated potential hazards and properties of 
the materials, control measures, intended safeguards and 
the nature of the incident scenario. The third section is 
often a narrative of the scenario, providing an explanation 
of the incident sequence, events and enabling conditions. 
This section presents the WHO, WHEN, HOW and WHAT 
HAPPENED information. The next section is often the 
‘findings and root causes’ section that presents root causes 
and contributing causes (the WHY information). In some 
instances, findings are separated and presented in a stand¬ 
alone section of the report. Recommended actions items, 
both short-term and long-term, are presented in the 
‘recommendations’ segment and are followed by back-up 
data in the appendix section. It is useful to include dia¬ 
grams, selected photographs and pertinent documentary 
evidence in each section as appropriate, with the bulk of the 
back-up data being located in the appendix. 



Figure 31.11 Typical incident report 


The advent of internal intranets allows a new and pow¬ 
erful tool for internal sharing to selected groups, with 
searchable databases, and multi-levels of report detail. It is 
now possible to send a broad alert and point interested 
parties to a file containing appropriate detail. Computer 
security features also enhance confidentiality concerns. 
It is possible to track access activity and confirm that 
personnel actually had an opportunity to open and read 
the incident report or bulletin. Imbedded hyperlinks are a 
powerful new addition to sharing lessons learned. 

31.6.3 Lessons learned 

Applying lessons learned and sharing information and 
findings from the investigation are important functions 
that can leverage the work of the investigation team. There 
is a rising expectation that organizations proactively share 
information from the investigation with all parties who 
could potentially be impacted. In the United States, many 
chemical companies have made significant commitments to 
industry to share incident investigation findings exter¬ 
nally to other organizations as part of the Responsible 
CARE® (American Chemical Council), American institute 
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of Chemical Engineers Center for Chemical Process 
Safety, National Petroleum Refiners Association, Synthetic 
Organic Chemical Manufacturers Association, American 
Petroleum Institute and other trade associations. 

Unfortunately, there are numerous instances of repeat 
incidents that might have been prevented if there had been 
adequate sharing of findings (internal within the organi¬ 
zation) or if the implementation had been completed 
promptly and as intended by the investigation team. In one 
recent chemical plant fire incident where a specific type of 
check-valve failed, the US Government Investigation Team 
discovered that the same organization had previously 
experienced an almost identical incident in one of its other 
locations, yet the lessons had not been adequately shared 
and acted on within the organization (US EPA/OSHA Joint 
Report, 1998). The investigation of the July 2000 Concorde 
Air crash uncovered numerous previous incidents related 
to tire failures. In one of the near-miss events, portions of a 
tire actually penetrated the fuel tank in the wing and cre¬ 
ated a fuel leak (Hazards Prevention Magazine, Second 
Quarter, 2001). 


31.7 Management System for Investigations 

Section 31.2 introduced the concept of management sys¬ 
tems in the context of incident investigation. There is a 
growing recognition of the value of the application of this 
management system perspective. In 1999, the British 
Standards Institute published a non-mandatory specifica¬ 
tion for Occupational Health and Safety Management Sys¬ 
tems (OHSAS18001,1999).This suggested template closely 
parallels the International Standards Organization Stand¬ 
ard ISO 14001 for Environmental Management Systems. 
American Petroleum Institute developed a Recommended 
Practice Model Environmental Health and Safety Man¬ 
agement System 9100 (API 9100 A and B, n.d.). Part A 
of this focused on initial development and part B was 
intended to provide guidance for improving an existing 
system. In the United States, the American National Stand¬ 
ards Institute intends to issue a new standard Z-10 for 
overall management of an organization’s safety and health 
program. British Standard 8800 is intended to provide 
guidance for developing and implementing safety manage¬ 
ment systems (BS 8800,1996). 

This section will focus on the development and imple¬ 
mentation of a typical management system for incident 
investigation. As discussed in Section 31.2 chapter, the 
term management system encompasses the total adminis¬ 
trative activities and aspects associated with a dedicated 
task or objective (see Figure 31.12). In this instance, the 
objective of the management system is prevention of repeat 
incidents and the specific functional task is conducting the 
incident investigation (Table 31.4). 

The configuration and content of the incident investiga¬ 
tion management system begins with a corporate policy 
commitment to prevent repeat incidents by investigating, 
identifying causes and remedies, and then implementing 
improvements specifically designed to eliminate under¬ 
lying root causes. A sustained and consistent commitment 
of organizational resources is required. Inputs to the 
incident investigation management system are the 
facts, circumstances, evidence and consequences (human, 
economic and environmental) associated with accidents, 
incidents and near-misses. Additional inputs are those 
facts gathered during the evidence discovery activity and 


the conclusions reached by the investigation team relative 
to causes and potential remedies. The outputs of the 
investigation management system are in two stages. The 
first stage is the suggested recommendations for action 
items and the second stage is the actual implemented cor¬ 
rective measures. 

Supporting the investigation management system are 
several critical components, the foundation of which is 
built on the formal commitment policy developed and 
implemented by upper level decision makers in the organi¬ 
zation. Specific investigation tasks and activities are 
assigned and a determination is made as to whom specific 
responsibilities for completion of each designated task are 
assigned. Awritten protocol is prepared and various com¬ 
ponents of the organization are trained in knowledge and 
skills needed to complete their assigned duties. It is com¬ 
mon to have at least three (and sometimes four) different 
investigation skill or knowledge levels. All employees (as 
well as contractors and visitors) need a minimum baseline 
knowledge regarding the reporting of incidents and the 
general policy commitment to investigate and implement 
improvements. This baseline segment can be less than one 
hour of training, but will require periodic refresh training 
and confirmations that minimum knowledge and aware¬ 
ness level is being maintained. 

Line managers and those charged with responsibility 
to review and approve draft investigation reports need 
to understand the acceptable incident investigation per¬ 
formance targets and need to have an understanding of 
how the system works. This competency level is achieved 
by specific training and periodic audits. Those who 
participate in or lead investigations need an additional 
competency in the actual investigation practices (how to 
do it). In some instances, there is a fourth level of compe¬ 
tency for designated subject matter experts or investiga¬ 
tion team leaders. This group provides the internal resource 
for those people who conduct the day-to-day programme 
activities and those who investigate the less serious 
incidents. 

Almost all incident investigation management systems 
include designated categories of incidents based on a scale 
of increasing severity of consequences and regulatory 
reporting requirements. Best practice organizations have a 
proactive near-miss investigation component as part of the 
incident investigation management system. It is common to 
establish increasing levels of severity and have increasing 
reporting and investigation requirements as the severity 
escalates. All successful management systems include an 
evaluation and periodic improvement component. Effec¬ 
tiveness of investigations should be evaluated on a regular 
basis and potential improvements noted. Safety audit pro¬ 
tocols should include specific questions and items related 
to incident and near-miss investigation and resolution of 
recommended preventive actions. The incident investiga¬ 
tion management system should include provisions for 
periodic review and update to ensure it is achieving the 
intended objectives. There should be a section that add¬ 
resses how changes (or temporary exceptions and devia¬ 
tions) are to be handled. The incident investigation 
management system should be integrated with other safety 
and loss prevention management systems such as the 
PHA system, training, auditing, change management and 
emergency preparedness and response system. Figure 31.13 
presents a typical table of contents for an incident investi¬ 
gation management system manual. 
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Follow-up and 

Performance Criteria Verification 



Figure 31.12 Incident investigation management system 


Table 31.4 Components for incident investigation management system 


Component category Example 


Objective 

Inputs 
Outputs... 
Responsibilities 


Skills and 
knowledge 
Performance 
assessment 
Documentation 

Resources and 
Funding 


... prevent reoccurrence of safety-related incidents by learning from past experiences with 
actual events and near-miss events, and implementing preventive measures ... 

... the event, facts, conditions and circumstances, people, equipment... 

... written report, recommendations, action items ... 

... line management establishes charter, degree of severity of consequences for mobilizing 
full or partial investigation team, team leader has assigned duties, team members have 
specific tasks and expected performance activitie s... 

... team member knowledge of root cause determination methods, evidence analysis skills, 
photography expertise, special metallurgical/laboratory test as needed ... 
trend analysis for common causes and repeat incidents ... 

... written investigation standard procedures, forms, systematic definitions of terms and 
cause categories, report format... 

... team members temporary full or part-time assignments, team expenditures for 
evidence gathering, analysis and report preparation, witness overtime, training expenses, 
maintaining readiness z... 


In the United States, there are two primary regulations 
applicable to process incidents involving release of hazard¬ 
ous substances that are on lists published by OSHA and the 
Environmental Protection Agency. The OSHA Process Safety 
Management (PSM) Standard 29 CFR 1910.119 section (m) 
lists several specific investigation requirements including: 

• Results of the investigation must be reviewed with all 
personnel whose job tasks are relevant to the incident 


findings (including contractor employees where 
applicable). 

Results of the investigation must be developed into a 
report. 

There must be a system for promptly addressing and 
resolving the findings and recommendations from the 
investigation. 

Resolution and corrective actions are required to be 
documented. 
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1. Management leadership 

• Policy 

• Legal requirements 

2. Definitions and categories of incidents 

3. Reporting and notification requirements 

4. Specific responsibilities 

5. Preparing for investigations 

• Criteria for investigators and investigation teams 

• Investigation training and periodic refresher training 

• Methodologies and tools for investigation 

6. Conducting the investigation 

• Communications issues internal and external to the investigation team 

• Evidence identification 

• Evidence management 

• Evidence preservation and chain-of-custody 

• Evidence analysis 

7. Root cause determination 

8. Findings and outputs 

• Developing potential recommendations 
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• Evaluating recommendations for management of change 

• Implementing recommended actions 
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- permanent changes 

- assignment of priority by risk ranking 

- status tracking, assignment of target dates for completion, assignment of 
persons responsible for completion of the recommendation 

- verification /confirmation of completion of the recommendation 

- documentation of resolution of recommendations 

• Reports 

• Implementing lessons learned 

• Sharing lessons learned with potentially affected persons 

9. Continuous improvement of the II management system 

• Monitoring effectiveness 

• Periodic audits and evaluations 

• Updates and changes to the II management system 

• Monitoring changes in regulations and corporate performance standards 

• Accident and incident trend analysis 

10. Appendix 

• Suggested forms 

• Suggested checklists 

• Reference standards and regulatory requirements 

• References for additional help 

Figure 31.13 Typical table of contents for an incident investigation management system manual 


In addition to these mandatory OSHA PSM requirements, 
there are several ‘non-mandatory’ expectations contained in 
the appendix of the regulation. The US EPA promulgated 
minimum incident investigation requirements in the Risk 
Management Plan section of the Clean Air Act. These regu¬ 
lations (Risk Management Plan 40 CFR Part 68) apply to a 
specific list of designated hazardous chemicals, and closely 
parallel the OSHA PSM investigation requirements with a 
few additional requirements such as: 


• The investigation must determine the quantity of 
material released and the duration of the release. 


• All known offsite impacts must be documented. 

• A record must be kept of all operational or process 
changes resulting from the investigation. 


Most incident investigation management systems will 
include suggested (or mandatory) forms and checklists to 
guide the team in a thorough investigation and to ensure 
that relevant information is included in the report. A report 
format showing level of detail and approval levels is often 
included in the written procedure/protocol document. 
Some organizations find value in having the legal depart¬ 
ment conduct a review of the draft report before it is issued. 
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The system for resolution of recommendations should be 
clearly presented in the management system. There should 
be a status tracking system and requirements for docu¬ 
menting the closure (resolution) of the recommendation. 
If the original recommendation is rejected or modified, the 
documentation should include the basis for the decision 


not to implement the recommendation as submitted by 
the investigation team. A recognized best practice is 
the post-implementation verification to ensure that the 
recommendation was actually implemented as intended 
and that the recommended action did accomplish the 
specific intent. 
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32.1 Introduction 

Inherently safer design is a philosophy which focuses on 
elimination of hazards or reduction of the magnitude of 
hazards rather than the control of hazards. Many of the 
concepts of inherently safer design have been applied by 
engineers in a wide variety of technologies for many years, 
without recognizing the common approach. In the late 
1970s, in the wake of many large incidents in the chemical 
industry, Kletz (1978) recognized the common philosophies 
of hazard elimination and hazard reduction, gave the phi¬ 
losophy the name ‘inherently safer design’, and developed a 
specific set of approaches to help engineers in the chemical 
process industries to design inherently safer processes and 
plants. Kletz realized that increased expectations for safety, 
from companies, regulatory bodies, and society in general, 
combined with the increased potential damage from inci¬ 
dents in the larger plants being built to meet increased 
demand and global markets, resulted in increased com¬ 
plexity and cost for the safety systems required to satisfy 
these demands. Furthermore, while hazard control systems 
can be made highly reliable, they can never be perfect and 
will always have some failure probability. While this prob¬ 
ability can be made very small, there is always some chance 
that all safety systems will fail simultaneously and the 
result would be a large incident. Also, the hazard manage¬ 
ment systems require ongoing maintenance, as well as 
management and operator training, for the life of the plant. 
This results in ongoing costs, and the potential for future 
deterioration of the safety systems. Deteriorated systems 
will have reduced reliability, increasing the potential for a 
catastrophic accident. Kletz suggested that in many cases, 
a simpler, cheaper and safer plant could be designed by 
focusing on the basic technology, eliminating or sig¬ 
nificantly reducing hazards and therefore the need to 
manage them. 

A process or plant is best described as ‘inherently safer’ 
with respect to a specific hazard or set of hazards, and with 
respect to other alternative designs. However, it is unlikely 
that any process or plant can be designed to eliminate all 
possible hazards, so it is generally inappropriate to 
describe any technology or plant as ‘inherently safe’. 

Since Kletz originally introduced the concept of inher¬ 
ently safer design to the chemical process industries, it has 
received increased interest from the industry. The inher¬ 
ently safer design philosophy has much in common with 
other important themes in the ongoing evolution of the 
chemical process industry at the beginning of the twenty- 
first century In particular, the industry’s increased interest 
in sustainability and research efforts on ‘green chemistry’ 
are often compatible with efforts to identify inherently 
safer processes. Other areas of research interest such as 
process intensification, nanotechnology, catalysis and bio¬ 
technology have the potential for developing inherently 
safer products and processes. 


32.2 Definitions 

32.2.1 Inherently safer design 

A dictionary definition of ‘inherent’ is ‘existing in some¬ 
thing as a permanent and inseparable element, quality, or 
attribute’. (Center for Chemical Process Safety (CCPS), 
1996) Thus, the basis for safety of an inherently safer 
process lies in the fundamental characteristics of the 
materials, operations and conditions of the process, 


characteristics which are inseparable from the process 
itself. The process relies on the chemistry, physics and 
toxicological properties of the materials and process 
operations for safety. Hazards are eliminated or sig¬ 
nificantly reduced, rather than controlled with safety 
equipment and procedures. 

32.2.2 Hazard 

Because inherently safer design focuses on the elimination 
or significant reduction of hazards, it is important to 
understand the definition of the word ‘hazard’. Over the 
years, the literature of process safety and risk management 
in the chemical process industry has developed many defi¬ 
nitions for this word and concept. For the purposes of this 
discussion, we will use the definition developed by the 
CCPS (1992) - a hazard is an inherent physical or chemical 
characteristic that has the potential for causing harm to 
people, the environment or property. A hazard is an inher¬ 
ent characteristic of a material or of its condition of use. It 
cannot be changed without changing the material or con¬ 
ditions of use. Some examples of hazards are: 

(1) Phosgene is toxic by inhalation. 

(2) Acetone is flammable. 

(3) Concentrated sulfuric acid is corrosive to the skin. 

(4) Nitroglycerine is an unstable material which can 
decompose explosively. 

(5) Steam at 40 bar pressure contains a large amount of 
energy, both from its temperature and pressure. 

These hazards cannot be eliminated or reduced without 
changing the material or its conditions of use. Thus, a pro¬ 
cess using acetone as a solvent might he modified to use a 
less flammable solvent, or perhaps a non-flammable sol¬ 
vent. A process using 40 bar steam as a heating medium 
might be changed to using a molten salt heating system, or 
alternative chemistry which operates at lower temperature 
might be discovered. However, it is important to remember 
that all processes and materials have multiple hazards, and 
a change to a material which eliminates or reduces one 
hazard may increase the magnitude of another existing 
hazard or create a new hazard. 

32.2.3 Risk 

Inherently safer design is a philosophy for risk manage¬ 
ment for a chemical process. Risk has been defined by 
CCPS (2000) as ‘a measure of human injury, environmental 
damage, or economic loss expressed in terms of the mag¬ 
nitude of the injury, loss or damage and the likelihood of 
occurrence of the incident’. While inherently safer design is 
generally considered to be applicable to the consequence 
(magnitude of injury, loss or damage) portion of the risk 
equation, it also applies to the likelihood of occurrence. An 
inherently safer design can either reduce the magnitude of 
a potential incident arising from a particular hazard, or it 
can make the occurrence of the accident highly unlikely, or 
perhaps impossible. 

32.3 History of Inherently Safer Design 

Elimination of hazards has always been an important 
approach to improving safety in all technologies. When 
prehistoric people decided to build a village on a hill above 
the flood plain of a river, they were choosing an inherently 
safer location with respect to the hazard of floods. They had 




INHERENTLY SAFER DESIGN 32/3 


other alternatives - monitoring the river level and estab¬ 
lishing evacuation plans, building dikes around the village, 
building houses on stilts, for example. In many cases, local 
geography, economic considerations or other factors 
required the adoption of these or other alternatives. Some 
of these other factors may have included consideration of 
hazards other than flooding - people on the high ground 
may have been more likely to be attacked by dangerous 
animals, appropriate building materials might not have 
been available and would have to be transported to the site 
resulting in expenditure of resources and exposure to 
transport hazards, drinking water might not have been 
readily available on high ground. But, with respect to the 
specific hazard of flooding, building the village on high 
ground was an inherently safer design which often was 
adopted. 

Over the centuries, engineers have invented and devel¬ 
oped inherently safer designs in many technologies. A four 
wheeled wagon is an inherently safer way to transport 
goods than a two wheeled chariot. A double track railroad, 
with a dedicated track for each direction of travel, is inher¬ 
ently safer than a single track for both directions of travel. 
In the 1860s, English chemist James Howden developed a 
process to manufacture nitroglycerine ‘in situ’ at the con¬ 
struction sites of the first US transcontinental railroad, 
eliminating the hazards of transporting nitroglycerine 
from the manufacturing site to the construction site. A few 
years later, in 1867, Alfred Nobel invented dynamite, a safer 
and more stable form of nitroglycerine. Although these and 
many other examples of inherently safer design can be 
cited from many different engineering technologies, the 
common philosophy of hazard elimination or reduction had 
not been recognized or identified as a generally applicable 
design strategy. 

In the 1960s and later, the rapidly expanding chemical 
industry was building larger plants than ever before, to 
meet an expanding and more global market. These large 
plants had larger inventories of hazardous material than 
previous generations of plants, and many operated at ele¬ 
vated temperature and pressure. The magnitude of a 
potential accident in a chemical plant was larger than ever 
before. While these large plants had extensive engineered 
safety features to manage and control the hazards, these 
systems were not perfect. The failure of the safety devices 
and procedures, while not common, did occasionally occur, 
and the result was a large accident. One major accident 
occurred at Flixborough, United Kingdom in 1974, caused 
by the release of many tons of superheated cyclohexane 
vapour from a high temperature, high pressure process. 
Following this accident, Trevor Kletz of ICI suggested that 
the best way to eliminate the possibility of this type of 
accident was not to develop ever more reliable safety devi¬ 
ces and procedures, but rather to focus on eliminating the 
need for those safety devices by eliminating the hazard or 
reducing its magnitude sufficiently that the consequences 
of an accident would not be serious. Kletz introduced this 
concept, which he called ‘inherently safer design’, in the 
Jubilee Lecture to the Society of the Chemical Industry in 
the United Kingdom in 1977, and the lecture was subse¬ 
quently published (Kletz, 1978). Over the years since 1977, 
Kletz expanded on the inherently safer design philosophy 
in a series of papers and books (most recently, Kletz, 1998), 
developing a set of principles to assist engineers in identi¬ 
fying inherently safer design options for chemical pro¬ 
cesses. Others picked up the concept and have further 


developed it, including Englund (1990,1991a, 1991b) and 
CCPS (1996). The philosophy has become an integral part 
of process design and process safety for many companies 
in the chemical industry. 

32.4 Strategies for Process Risk Management 

32.4.1 Overview of risk management strategies 

Process risk management strategies can be considered to 
fall into four categories (CCPS, 1996): 

(1) Inherent - eliminate or significantly reduce the 
hazard. 

(2) Passive - reduce the consequence or likelihood of an 
incident arising from a hazard through devices which 
do not require detection of an incident or action by any 
person or device. 

(3) Active - reduce the consequence or likelihood of an 
incident arising from a hazard by detection of an incipi¬ 
ent incident and activation of devices which interrupt 
the sequence of events resulting in the incident or 
mitigate the consequences of the incident. 

(4) Procedural - reduce the consequence or likelihood of 
an incident arising from a hazard by detection of an 
incipient incident followed by implementation of pro¬ 
cedures or human activated devices to interrupt the 
sequence of events resulting in the incident or mitigate 
the consequences of an incident. 

Usually, risk management strategies in the inherent and 
passive categories are more robust and reliable. They rely 
on the chemistry and physics of the process and plant, and 
do not have any active elements which must function 
properly, or human elements. However, a complete risk 
management programme for a process will include ele¬ 
ments from all of these strategies. This is particularly true 
when one considers all of the multiple hazards in a process. 

32.4.2 Risk management strategy example - combustible 
powder handling 

These categories are best understood with a specific pro¬ 
cess example. Consider a process which requires pneumatic 
conveying of a combustible powder from a storage silo to 
the processing equipment. The hazard of concern for this 
discussion is the potential for a dust explosion in the closed 
conveying equipment. Dust explosion testing indicates that 
the maximum pressure resulting from a confined combus¬ 
tion of the dust is 10 bar.The powder canbe ignited by static 
electric discharge of sufficient energy in the conveying 
system. The risk arising from this hazard might be man¬ 
aged by any of the following alternatives: 

Inherent risk management 

(1) Identify a non-combustible solid which can replace the 
combustible dust in the process. 

(2) Increase the particle size of the combustible solid so 
that a dust explosion cannot occur (use pellets or 
granules instead of a powder). 

Either of these alternatives eliminates the hazard of dust 
explosion, although there is a possibility of particle attri¬ 
tion of the granules or pellets, which could result in accu¬ 
mulation of fine particles somewhere in the process 
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equipment (perhaps a dust collector) where there would 
still be a potential for a dust explosion. 

Passive risk management 

(1) Build a conveying system with a pressure rating of 
15 bar. 

This does not eliminate the hazard of powder combustion, 
or reduce its magnitude, but it does contain the pressure 
from a dust explosion within the process equipment so it 
cannot injure people or damage other equipment. The 
higher pressure rated equipment contains the pressure 
simply by virtue of its existence and design. It does not 
have to detect a dust explosion, or take any action to per¬ 
form its function, so it is highly reliable and robust. How¬ 
ever, in the event of ignition, the dust explosion still occurs, 
and it does generate up to 10 bar pressure. Defects in con¬ 
struction of the equipment, age and corrosion, improper 
assembly or other failures could result in failure of the high 
pressure equipment and an explosion which impacts the 
outside environment could occur. 

Active risk management 

(1) Dust explosion venting panels to relieve the dust 
explosion pressure to a safe place. 

(2) Explosionsuppressionsystemswhichdetecttheincipi- 
ent explosion and inject a fire suppressant to reduce 
the explosion pressure to less than the failure pressure 
of the conveying system. 

(3) An inerting system, conveying the combustible 
powder with reduced oxygen gas. This is considered 
an active system because normal air contains 21% 
oxygen, sufficient to support combustion, and some 
kind of a active control system is presumed to be 
required to establish and maintain an inert atmos¬ 
phere in the conveying system. 

(4) A water deluge system installed in the process rack to 
put out an external fire following activation of dust 
explosion vents, which generally will release a sig¬ 
nificant flame or fireball which could ignite other 
combustible materials in the area. 

All of these systems contain multiple active components 
which must function properly in order for the active safety 
system to work. In general, they contain three types of gen¬ 
eric elements - a sensor of some kind to detect an incipient 
hazard; a logic element which receives input from the sensor 
and determines what action is required and a final action 
element which will implement the required action. Active 
safety devices may be designed to prevent an incident (e.g. 
the inert gas conveying system), or to mitigate the effects of 
an incident once it has started (explosion venting, explosion 
suppression, the water deluge system). 

Procedural risk management 

(1) Procedures to keep metal objects out of the conveying 
system. These objects could cause sparks in the con¬ 
veying system which could ignite the powder. 

(2) Procedures to ensure that equipment is correctly 
assembled and that all metal parts of the conveying 
system are properly electrically bonded and grounded. 


(3) A manually controlled inert gas conveying system, 
relying on the operator to monitor the oxygen con¬ 
centration (or some other parameter such as nitrogen 
flow rate which is known to confirm adequate inertion) 
and make appropriate adjustments to maintain an 
inert atmosphere. 

These risk management strategies rely on proper actions 
of people. They are subject to failure from human error, 
inattention and all of the other factors which make 
people less reliable for repetitive and uninteresting tasks. 

Summary of risk management strategy example 
Remember that this example considers risk management 
strategies with respect to a single hazard - the potential for 
dustexplosion.Inselectinganoptimum design, theengineer 
must consider all hazards, as well as the ability of the process 
to produce the required output. Some of the risk manage¬ 
ment strategies suggested to reduce the risk of dust explo¬ 
sion may introduce other hazards, increase the magnitude of 
other existing hazards, or inhibit the ability of the process to 
produce the required product. For example, inerting intro¬ 
duces thepotentialforasphyxiationfromexposureof people 
to a low oxygen atmosphere from the conveying system. 
Perhaps the different, non-combustible substitute for the 
combustible dust is highly toxic. More likely, there is no non¬ 
combustible solid which will work in the application. Pellets 
or granules may create a slipping hazard if spilled on the 
floor. Of course, there are ways to manage and control all of 
these hazards as well (and those strategies will also fall into 
the inherent, passive, active and procedural categories), and 
it is the task of the design engineer to understand all of them 
and select the optimum overall strategy. 

In this example, use of pellets in place of a dust will 
eliminate the risk of dust explosion in the conveying sys¬ 
tem, but perhaps the available pellets are cylindrical in 
shape and procedures to clean up spills and keep the floor 
clean will be required so people do not slip. Dust will still 
form from particle attrition (although there will be a lot less 
of it), and explosion suppression or venting may still be 
required in dust collectors. A complete risk management 
programme for a complex chemical process will require 
elements from all of the risk management strategies to 
properly manage all hazards. 

32.4.3 Process risk management and layers of protection 

The application of various process risk management 
strategies to hazard control in the chemical process 
industries has been described as providing multiple lay¬ 
ers of protection to the process (CCPS, 1993,1996). This is 
shown graphically in Figure 32.1, with the basic process 
design at the centre of the figure, and various passive, 
active and procedural protection layers applied to the 
process to prevent the hazard from impacting on people, 
the environment or property. These layers of protection 
fall into the categories described above. A process that is 
inherently safer will require fewer, and less robust, layers 
of protection - in fact a truly ‘inherently safe’ process 
(which is probably impossible if one considers ALL pos¬ 
sible hazards) would not require any layers of protection 
at all. The layer of protection concept has been developed 
as a methodology for quantitative risk analysis of a 
process, called Layer of Protection Analysis (LOPA) 
(CCPS, 2001). 
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Protection layers for a typical process are shown 
in the order of activation expected as a hazardous 
condition is approached. 


ESD - Emergency Shutdown 
SIS - Safety Interlock System 

Figure 32.1 Layers of protection fora chemical process (from CCPS, 1992, 1996) 


32.5 Inherently Safer Design Strategies 

Kletz (1998) has categorized inherently safer design strat¬ 
egies into four major categories: intensification, substitu¬ 
tion, attenuation and limitation of effects. Kletz also 
describes a number of additional strategies for the design 


of ‘friendly plants’ which he does not regard as true inher¬ 
ent safety strategies because they do not eliminate or sig¬ 
nificantly reduce the hazard, but rather make it more 
difficult for incidents to occur as a result of the hazard. 
These strategies are listed in Table 32.1, and include 
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Table 32.1 Strategies for inherently safer design 

Kletz (1998) 

CCPS (1996) 

Inherent safety strategies 

Inherent safety strategies 

(1) Intensification 

(1) 

Minimize 

(2) Substitution 

(2) 

Substitute 

(3) Attenuation 

(3) 

Moderate 

(4) Limitation of effects 

(4) 

Simplify 

‘Friendly plant design’ strategies 

Mapping of Kletz’s ‘friendly plant 

regarded as ‘add on’ features 

design’ strategies to CCPS inherent 


safety strategies 

(1) Simplification 

(1) 

Simplify 

(2) Avoiding knock on effects 

(2) 

Moderate (Limit effects) 

(3) Making incorrect assembly impossible 

(3) 

Simplify 

(4) Making status clear 

(4) 

Simplify 

(5) Tolerance of misuse (error tolerance) 

(5) 

Moderate (Limit effects) 

(6) Ease of control 

(6) 

Moderate (Limit effects) 

(7) Understandable software for computer control 

(7) 

Simplify 

(8) Instructions and procedures 

(8) 

Simplify 

(9) Life-cycle friendliness (construction 

(9) 

Consider all strategies with regard 

and demolition) 


to all phases of a plant life cycle 

(10) Passive safety 

(10) 

Moderate 


simplification and error tolerance. CCPS (1996) suggests 
the same basic inherently safer design ideas as Kletz, but 
reduces the categories to four - minimize, substitute, 
moderate and simplify. The CCPS concept of inherently 
safer design is somewhat broader than Kletz’s original 
concept, considering many of Kletz’s ‘friendly plant design’ 
principles to be approaches to inherently safer design as 
well. The distinctions are somewhat arbitrary, and the 
important point is that all of these principles are highly 
appropriate considerations for the design and operation of 
highly robust, reliable, and safe plants. Table 32.1 compares 
the Kletz inherently safer design and friendly plant strat¬ 
egies to those of CCPS, showing how they encompass the 
same basic ideas. For this discussion, the simpler CCPS 
categorization will be followed, recognizing Kletz’s more 
detailed categorization is embedded in the four CCPS 
strategies. 

The examples in the following sections are summarized 
from Kletz (1998) and CCPS (1996). More details can be 
found in these books. 

32.5.1 Minimize (intensify) 

The quantity of hazardous material and energy in a process 
should be minimized. This applies to all unit operations in 
a plant as well as to raw material, intermediate and haz¬ 
ardous product storage and to piping which connects 
equipment. Reducing the size of equipment containing 
hazardous materials and energy is inherently safer 
because the direct consequences of the loss of containment 
of that material or energy will be correspondingly reduced. 
Ideally, the consequences will be sufficiently reduced that 
the loss of containment is not capable of causing significant 
damage or injury, but, in any case, the consequences will be 
reduced. 

The use of smaller equipment may make it feasible to use 
other risk management strategies which would be imprac¬ 
tical or prohibitively expensive for large equipment. For 
example, consider a process which includes a nitration 
reaction. Nitration is a highly exothermic reaction process, 


and there is often a potential for a runaway reaction which 
could rupture the reaction vessel. The reaction can be done 
in a large batch reactor, perhaps several thousand gallons 
in volume. While it is possible to enclose this large reactor in 
a large bunker (a passive safety feature) capable of con¬ 
taining the explosion from a ruptured vessel, such a bunker 
would have to be extremely large and strong to contain such 
a large explosion. An alternative nitration process, using a 
continuous stirred tank reactor, might have a reactor 
volume of only a couple of hundred gallons. Now, contain¬ 
ment in a bunker becomes more feasible because the bunker 
is smaller, and it does not have to be as strong because it 
must contain the rupture of a much smaller vessel. In some 
cases it may be feasible to do the nitration in a pipe reactor, 
or an eductor, with a volume of only a couple of gallons, 
making containment even more feasible. Other safety 
devices may also become more feasible - for example it is 
practical to detect the temperature increase from a runaway 
reaction and dump the small continuous reactor into a large 
quench tank full of water in a few seconds (an active safety 
feature), while this cannot be done with the large batch 
reactor. 

How does an engineer identify opportunities to minimize 
the size of process equipment? An extensive literature is 
developing on the subject of Process Intensification in 
recent years, and there are many innovative ideas on how to 
reduce the size of all types of process equipment. Most of 
this work is not driven by safety considerations, but rather 
by economics. Smaller equipment is cheaper to build and 
operate, and takes up less space in the plant. Innovative 
technology to reduce the size of process equipment is not 
only safer, but it also saves money. Smaller equipment also 
provides better and more uniform control of conditions in 
the equipment — the temperature gradients are smaller, 
there is a more uniform concentration, mixing is more 
efficient and heat can be more easily removed. The key to 
reducing the size of process equipment is a basic under¬ 
standing of the physical and chemical processes that occur 
in the equipment. With this understanding, the engineer 
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can design equipment to optimize the rate limiting steps in 
the process, reducing the size of the equipment and making 
it safer, cheaper and more efficient. Stankewiez and 
Moujlin (2003) provide a good overview of process intensi¬ 
fication in general, including examples of its application to 
various unit operations and chemical technologies. 

CCPS (1996) and Kletz (1998) provide many specific 
examples of inherently safer design through intensifica¬ 
tion or minimization. Some areas where significant bene¬ 
fits have been realized include: 

(1) Reaction 

(a) Continuous stirred tank reactors have replaced 
batch reactors in many applications, including 
nitration, chlorination and polymerization. 

(b) Loop reactors, continuous pipe loops with a 
recirculation pump, provide intensive mixing and 
efficient heat removal and have been used for 
hydrogenation, ethoxylation, polymerization, 
chlorination and other exothermic reactions. 

(c) Reactive distillation combines the unit operations 
of chemical reaction and distillation into a single 
piece of equipment. A reactive distillation pro¬ 
cess for the manufacture of methyl acetate from 
methanol and acetic acid uses a single reactive 
distillation column and two auxiliary columns in 
place of a continuous reactor, an extractor and 
eight distillation columns. 

(d) Many rapid, highly exothermic reactions can be 
done in eductors. Examples include the Nobel AB 
process for nitroglycerine and the manufacture of 
Caro’s acid (Whiting, 1992). 

(e) Tubular reactors can be used for polymerization 
and many other reactions. 

(2) Distillation 

(a) Column packing and tray geometry can be modi¬ 
fied to minimize hazardous liquid inventory. 

(b) Column base geometry can be modified to mini¬ 
mize hold-up of hazardous material. 

(c) Centrifugal distillation devices such as HiGee 
which have much smaller inventory have been 
developed experimentally, although commercial 
applications are limited to date. 

(d) Advanced control of a multi-component distilla¬ 
tion column can allow a single column to replace 
multiple columns, with multiple feeds to and 
product streams from a single column. 

(3) Extraction 

(a) Centrifugal extractors have much smaller volume 
than traditional extraction columns. 

(b) The efficiency of extraction columns can be 
enhanced (and, therefore, the columns made 
smaller) by introducing pressure pulses or 
vibrations, or with a vibrating tray stack. 

(c) Combined mixer-settlers can replace separate 
mixing and settling vessels. 

(4) Heat exchange 

(a) Various types of heat exchangers have vastly dif¬ 
ferent efficiency, in terms of the heat transfer area 
per unit volume of material inventory. Table 32.2 
(from Kletz, 1998) compares the efficiency of a 
number of common types of heat exchanger. 

(5) Raw material storage 

(a) Modern inventory control systems reduce the 
need to store large quantities of hazardous raw 


Table 32.2 Surface compactness of heat exchangers 
(adapted from Kletz, 1998) 


Type of exchanger 

Surface compactness (m z /m 3 ) 

Shell and tube 

70 to 500 

Plate 

120 to 1000 

Spiral plate 

Up to 185 

Shell and finned tube 

65 to 3300 

Plate fin 

150 to 5900 

Printed circuit 

1000 to 5000 

Regenerative - rotary 

Up to 6600 

Regenerative - fixed 

25 to 15,000 

Human lung 

20,000 


materials. However, it is important to consider all 
hazards when making these decisions, including 
transportation. Truck transport of a hazardous 
raw material may allow a smaller on-site storage 
tank, but it will require more frequent shipments, 
and more frequent unloading operations. 

(b) storage of hazardous raw materials might be 
eliminated if a new plant can be located on the 
same site as the hazardous raw material manu¬ 
facturing plant, using the existing storage at the 
supplying plant. 

(6) Intermediate storage 

(a) Intermediate storage of hazardous intermediates 
is often provided as a buffer, so the entire plant 
will not have to shut-down when a particular 
piece of equipment or section of the plant must be 
shut-down for repair or maintenance. Improving 
the reliability of equipment or sections of a plant 
may eliminate the need for intermediate storage. 
In some cases, providing redundancy for critical 
pieces of equipment may also eliminate the need 
to store hazardous intermediates. 

(b) There may be choices on what materials to store 
as in-process intermediates. Perhaps a hazar¬ 
dous material is produced as an aqueous solu¬ 
tion, then distilled to produce a pure product, 
which is subsequently converted to various final 
products in downstream units. Storage of a large 
inventory the aqueous solution to supply the 
downstream processes could be considered as an 
inherently safer alternative to storage of the pure 
material. 

(c) Storage and transportation of hazardous raw 
materials can be reduced or eliminated by locat¬ 
ing a downstream plant on the same site as the 
plant producing the hazardous raw material - for 
example locating a plant producing a chlorinated 
pesticide adjacent to a chlorine manufacturing 
plant. 

(7) Piping 

(a) Hazardous material pipe diameter should be 
minimized, consistent with maintaining suffi¬ 
cient mechanical strength and integrity. A100 mm 
diameter pipe contains four times as much 
material as a 50 mm pipe of the same length. 

(b) Hazardous material pipe length should be mini¬ 
mized, again consistent with providing appro¬ 
priate spacing of hazardous facilities. 
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32.5.2 Substitute 

In the chemical industry, the two major areas where sub¬ 
stitution enhances inherently safer design are substitu¬ 
tion of a less hazardous chemical synthesis route for a 
desired product, and substitution of a less hazardous 
material for a specific application. Substituting less 
hazardous chemistry offers the greatest potential for 
enhancing inherent safety, but must be considered early in 
process development since alternate chemistry often 
requires abandonment of an existing plant and construc- 

Recently there has been a major research effort in many 
developed countries to develop environmentally friendlier 
‘green chemistry’ for the synthesis of many products and 
for chemical products. Many of these green chemistry 
alternatives are also inherently safer because they focus 
on eliminating or reducing the use of toxic and flammable 
materials. However, this is not always true, and sometimes 
environmental and safety considerations are in conflict. 
Perhaps the best known example of this conflict is in 
refrigerants. Chlorofluorocarbon (CFC) refrigerants were 
developed in the 1920s and 1930s as inherently safer alter¬ 
natives to refrigerants then in use. CFCs have low acute 
toxicity and are non-flammable, eliminating hazards of 
many of the refrigerants formerly used, such as light 
hydrocarbons (flammable), ammonia (toxic and flam¬ 
mable) and even sulfur dioxide (toxic, corrosive). Later, in 
the 1980s and 1990s CFCs were found to cause significant 
environmental damage, and they can no longer be used in 
many countries. In many cases, refrigeration systems are 
going back to earlier refrigerants, but it must be recognized 
that, while the hazards can be managed using strategies 
discussed earlier, refrigerants such as ammonia and light 
hydrocarbons are inherently less safe. 

Some specific areas of research which offer potential for 
development of inherently safer chemical manufacturing 
processes include the following. 

(1) Catalysis - Development of improved catalyst sys¬ 
tems which improve reaction selectivity (eliminating 
the need for extensive product purification systems), 
allow products to be produced under less severe con¬ 
ditions (lower temperature and pressure), speed up 
reactions resulting in smaller reactors and improve 
raw material conversion (eliminating the need for 
recycle) all can enhance inherent safety. 

(2) Catalytic reaction functionality can sometimes be 
immobilized on a solid substrate, such as solid 
superacid catalysts in place of hydrogen fluoride 
or aluminium chloride for some alkylation reactions, 
or ion exchange resins in place of sulfuric acid for 
esterification. 

(3) Supercritical processing may allow use of solvents 
such as carbon dioxide or water in place of flammable 
or toxic organic solvents. 

(4) Innovative energy sources such as ultraviolet light, 
microwaves and laser light enhance some chemical 
reactions. 

(5) Biocatalysis and enzymes may allow synthesis of pro¬ 
ducts at ambient temperature and pressure conditions. 

(6) Biological or biochemical synthesis may become 
feasible for many materials. Advances in genetic engi¬ 
neering and biotechnology in general may broaden 
the spectrum of products which can be made in 
this way. 


Clearly many of these alternatives have the potential 
for introducing new hazards. Catalysts may contain 
hazardous materials, supercritical processing requires 
elevated temperature and pressure and there are safety 
and environmental concerns which must be considered for 
biotechnology. 

Much of the literature of green chemistry and engineer¬ 
ing has focused on identifying substitute, less hazardous 
materials for many industrial and consumer applications. 
Many government environmental agencies have developed 
extensive resources and databases identifying potential 
substitutions. Some common examples of substitution of 
less hazardous materials include: 

(1) Use of water base latex paints in place of organic sol¬ 
vent base paints. 

(2) Replacement of flammable solvents with alternative 
solvents with a high flash point for many formulated 
products such as agricultural chemicals, dyes, adhe¬ 
sives, paints and coatings, and paint removers. 

(3) Replacement of chlorinated organic solvents by aque¬ 
ous systems for degreasing and cleaning in the 
electronics industry. 

32.5.3 Moderate (attenuate) 

Inherently safety can be enhanced by changing a material 
or process to moderate the hazard, or by designing the plant 
to moderate the impact of an incident arising from the 
hazard. Kletz (1998) refers to the later approach separately 
as ‘Limitation of Effects,’ while CCPS (1996) considers this 
to be a form of the ‘Moderate’ strategy. 

Moderating hazards of materials 

Dilution 

Dilution of a hazardous material with a less hazardous 
material (such as a solvent) offers several inherent safety 
benefits. Because the hazardous material is diluted, if 
the material is spilled, the partial pressure of the hazar¬ 
dous material will be lower than for the pure material, 
and the atmospheric concentration above the spill will be 
reduced. This will also reduce the downwind concentra¬ 
tion in the atmosphere. If the material is flammable, 
dilution with a non-flammable material such as water 
may be sufficient to significantly reduce the fire hazard. 
In some cases, pure materials such as hydrogen chloride 
or ammonia may require pressurized storage, while rela¬ 
tively concentrated aqueous solutions can be stored at 
atmospheric pressure. While many applications require 
use of a pure material, many do not - for example neu¬ 
tralization with ammonia or hydrochloric acid - and 
aqueous materials should be considered for those appli¬ 
cations where feasible. 

The stability of some solid materials can also be 
enhanced by dilution with an inert material. Alfred Nobel’s 
invention of dynamite — nitroglycerine absorbed onto an 
inert carrier - is an example of inherently safer design. As 
another example, the stability of benzoyl peroxide is 
greatly enhanced by handling it as a water wetted powder, 
compared to the pure, dry material. 

Refrigeration 

Refrigeration of liquefied gases can improve inherent 
safety. Refrigeration has a number of potential benefits. 
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(1) Storage pressure will be lower, in some cases storage at 
near atmospheric pressure is feasible. This results in a 
reduced leak rate in case of a loss of containment from 
the storage system because of a lower pressure. For 
storage near atmospheric pressure, a leak from the 
vapour part of the storage tank will be very small 
because there is practically no pressure to provide 
driving force for the leak. 

(2) A leak from a liquefied gas storage vessel at ambient 
temperature and elevated pressure will result in sig¬ 
nificant flashing of vapour into the atmosphere from 
the leak. A leak from a refrigerated storage tank will 
flash less, or not at all if the storage is near atmos¬ 
pheric. While the spilled material will boil or evapo¬ 
rate as it absorbs heat from the atmosphere and the 
ground, this rate of release will often be smaller than 
that resulting from a pressurized, flashing leak. 
Also, the designer will have the opportunity to 
reduce the evaporation rate of the spilled material 
by dike design to minimize surface area, insulating 
dike materials, covering the spill or secondary con¬ 
tainment. 

(3) The amount of release to the atmosphere from a 
liquefied gas storage vessel may actually be sig¬ 
nificantly higher than that which would be calculated 
from the flash calculation. As the material leaks from 
the storage vessel, a large fraction of the material will 
flash to vapour as a result of the pressure reduction to 
the atmosphere. Much, perhaps all, of the material 
which remains as a liquid according to the flash cal¬ 
culation, will be present as small droplets, an aerosol. 
These droplets may be too small to rapidly settle out 
and form a liquid pool on the ground. Instead, they 
may be carried downwind with the released vapour as 
a fine mist or fog. As they travel downwind, they will 
absorb heat from the atmosphere and evaporate. The 
actual amount of material released to the atmosphere 
from a pressurized gas leak may be several times 
larger than would be expected based on the flash cal¬ 
culation. Refrigeration of the pressurized gas elimi¬ 
nates the flashing and aerosol formation. 

Some of the materials for which refrigerated storage has 
been reported to be beneficial include ammonia, chlorine, 
butadiene, ethylene oxide, propylene oxide, methylamines 
and vinyl chloride. As for most design choices, again there 
are potential downsides to refrigeration - for example 
refrigerated storage facilities will require insulation which 
makes it more difficult to inspect piping and vessels, and 
may make them susceptible to external corrosion if water is 
absorbed into the insulation. 


Change physical characteristics 

The explosion hazard of a combustible dust is a function of 
its particle size. If these materials can be handled as a 
granule or pellet instead of a dusty powder, they will be 
inherently safer. This will also reduce the potential of 
exposure of people to airborne dusts. 

Some reactive or toxic materials can be immobilized by 
attaching them to a solid substrate, making them less likely 
to come into contact with people. For example, acid or basic 
functionality can be provided as a solid ion exchange resin 
or a membrane. Metal catalysts are often bonded to an 
inert carrier. 


Moderating hazards of processes 
Substitution of alternate chemistry, or development of 
improved catalysts, as discussed previously, can often 
allow a process to operate at lower temperature and pres¬ 
sure. This not only improves inherent safety but it is also 
almost certain to make the construction of the plant 
cheaper because equipment rated for lower temperature 
and pressure will cost less. 

There are many approaches to limiting the effects 
(moderating the effects) of an incident arising from a 
hazard. In many cases, these are probably better described 
as passive safety features rather than inherent. They do 
not reduce the magnitude of the hazard, or eliminate the 
hazard, but they are very robust and reliable methods for 
minimizing the potential impact of an incident. Some 
examples include: 

(1) Primary containment. Build stronger equipment. If a 
reaction has a maximum adiabatic pressure in case of 
a runaway of 200 psig, a 250 psig reactor will contain a 
runaway. It is essential to be highly confident of 
the maximum temperature and pressure in this 
case - the chemistry must be fully understood, 
including the potential for unknown reactions or 
decomposition at the elevated temperature and pres¬ 
sure resulting from the runaway reaction. 

(2) Secondary containment. Containment dikes around 
storage tanks and processing equipment. Also, con¬ 
tainment buildings canbeusedto reduce the release of 
toxic materials to the atmosphere. Bunkers or explo¬ 
sion proof buildings, with the process equipment 
operated from a remote location, have been used for 
explosives manufacture. 

(3) Plant siting. Locate hazardous material handling 
facilities as far as possible from potentially impacted 
population or equipment. 

(4) Batch reactions. For exothermic reactions, avoid batch 
processes where all of the materials are charged to 
the batch before the reaction is initiated. With this 
type of process, if temperature control is lost for 
some reason, all of the reaction energy is present 
in the reactor and a runaway reaction is possible. 
Semi-batch, or fed batch, reactions, where a limiting 
reactant is gradually added at a rate corresponding to 
the rate of reaction, are inherently safer. If tempera¬ 
ture control is lost, the limiting reactant feed can be 
stopped, and there is little or no reaction energy in 
the batch. 

(5) Maintain separation between incompatible materials, 
both for container storage in warehouses, and tank 
farm storage of bulk materials. 


32.5.4 Simplify 

Simplification is key to a ‘user friendly’ plant. If a plant is 
complicated, it is going to be more susceptible to incorrect 
operation. While most chemical plants are highly complex 
of necessity because of the complexity of the technology, 
designers should always be striving to eliminate all unnec¬ 
essary complexity. In some cases, simplification will elim¬ 
inate hazards by making it impossible to conduct 
operations which result in those hazards. In other cases, 
simplification will make it more difficult to make errors, 
perhaps not truly an example of inherently safer design, 
but still highly desirable. 
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Some examples of simplification include: 

(1) Use stronger (higher pressure rated) equipment can 
reduce or eliminate the need for complex pressure 
relief systems, and complex instrumentation and 
interlocks to protect against overpressure. 

(2) Eliminate unnecessary or seldom used piping. While 
the designer of a plant might think that the operators 
will someday want to transfer material from the final 
product tank back to the second distillation column, 
how often will this really need to be done? If the pipe is 
not used frequently, perhaps it will be plugged, the 
valves will be rusted shut, or the gaskets will be 
degraded several years after construction when 
somebody finally wants to use the pipe. It may be 
better to wait until there is a real need, then install a 
new pipe at that time. In the meantime, the unused 
pipe is a potential operating error waiting to happen. 
Question the real need for ‘abnormal operation’ 
piping - eliminating it will save money and the plant 
will be simpler and easier to operate safely. 

(3) Gravity flow can eliminate pumps, which require 
maintenance and can leak. 

(4) Make incorrect operation impossible. Many electric 
power plugs are designed so they can only be inserted 
in the socket one way, and there are many other exam¬ 
ples of equipment which has been designed so it 
cannot be operated improperly. 

(5) Develop processes which are insensitive to variation in 
operating parameters. Design engineers should chal¬ 
lenge research chemists and engineers to invent pro¬ 
cesses which are insensitive to variation in process 
operating parameters. While it is possible, for exam¬ 
ple, to control a reactor temperature to within 0.5°C, it 
is much easier to control the reactor to within 5°C. If 
the process can be modified so that it is less sensitive, 
the plant will be cheaper, more reliable and safer. 

(6) Good human factors design. Equipment should be 
designed to operate the way people expect it to oper¬ 
ate, it should provide feedback to the operator to con¬ 
firm proper operation, it should be designed with 
consideration for ergonomics and human factors. 
Kletz (1998) and CCPS (1996) provide many specific 
examples of both good and bad human factors design, 
and CCPS (1994) provides an extended discussion of 
human factors in the chemical industry. 


32.6 Inherently Safer Design Conflicts 

A chemical plant or process can be described as inherently 
safer in the context of one or more of its multiple hazards, 
when compared to other possible design options. However, 
in general it is unlikely that a particular design can be 
considered inherently safer with respect to all hazards 
simultaneously. Some examples of inherent safety conflicts 
include: 

(1) There are two alternative solvents for a process. One is 
flammable but has low acute toxicity. This solvent is 
inherently safer with respect to toxicity hazards. The 
alternative solvent is non-flammable, but has high 
acute toxicity — this solvent is inherently safer with 
respect to fire hazards, but inherently more hazardous 
with respect to toxicity hazards. 


(2) A process requires chlorine as a raw material. Chlorine 
can be supplied in 90 ton rail cars or 1 ton cylinders. A 
neighbour two miles away from the plant, concerned 
about exposure from a large leak, considers the cylin¬ 
ders inherently safer because the smaller quantity is 
less likely to result in exposure at that distance. 
The process operator, who must connect and dis¬ 
connect 90 cylinders instead of one rail car, will be in 
close proximity to the chlorine source and would con¬ 
sider the rail car to be inherently safer with respect 
to his risk of exposure to chlorine. 

(3) CFC refrigerants have low acute toxicity and are not 
flammable. They are inherently safer with respect to 
the flammability and acute personnel exposure. How¬ 
ever, it is now generally accepted that they cause long¬ 
term environmental damage, and their use is being 
phased out. 

It is almost always impossible to simultaneously maximize 
all desired characteristics of any engineered system. The 
central problem of all engineering design is to find the 
optimum combination of characteristics that best meets 
the overall objectives. This ‘best design’ depends on the 
relative importance which is attached to the various desir¬ 
able characteristics — what is the relative importance of 
flammability hazards, as compared to acute toxicity 
hazards, as compared to long-term environmental hazards, 
as compared to other hazards which might be identified. 
This relative importance may be impacted by the environ¬ 
ment in which the plant is built, the feasibility, reliability 
and effectiveness of passive, active and procedural safety 
features for the hazard of concern, and other design spe¬ 
cific factors. The inherent safety characteristics of a pro¬ 
cess become one of the many characteristics which the 
design engineer must evaluate as he determines his opti¬ 
mum design for a particular facility. 

Many decision-making tools have been developed to aid 
decision-makers in understanding the many conflicting 
characteristics of a multi-dimensional decision, allowing 
them to make logical and consistent decisions. CCPS (1995) 
describes the use of many of these tools, as listed in 
Table 32.3, to process safety decision-making in general. 
The INSIDE Project (Inherent Safety in Design (INSIDE) 
Project Team, 1997) also suggested the use of this type of 
tool for understanding and resolving inherent safety and 
environmental conflicts. These decision-making tools can 
also be applied to resolving conflicts between the inherent 
safety characteristics of a process with respect to differ¬ 
ent kinds of hazard, as well as conflicts between inherent 
safety and other important process characteristics such 
as environmental impact, various economic parameters, 

Table 32.3 Decision tools applicable to process safety 
and inherently safer design decisions (CCPS, 1995) 


Voting methods 
Weighted scoring methods 
Kepner-Tregoe decision analysis 
Analytical hierarchy process 
Cost-benefit analysis 
Mathematical programming 
Payoff matrix analysis 
Decision analysis 
Multi-attribute utility analysis 
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product quality, reliability and other process measures of 
importance to different stakeholders. The use of these tools 
will require some kind of a measure of the inherent safety 
characteristics of a process, a topic discussed in Section 7. 


32.7 Measuring Inherent Safety Characteristics of 
a Process 

32.7.1 Introduction 

In a recent global survey on the use and interest of people 
in inherently safe design, Gupta and Edwards (2002) 
reported at length that the survey responders, all con¬ 
nected with the process industry, academics or regulatory 
authorities, were generally familiar with inherently safe 
design and desired to use it to their advantage. They did not 
want another enforcing regime from the government 
requiring its use since they already have enough regula¬ 
tions related to process safety to follow. To use inherently 
safe design voluntarily they desired a simple way to deter¬ 
mine or measure the inherent safety of a process at the 
research and development stage before too much time and 
resources have been invested in the process development. It 
is so because with more resources invested, it becomes dif¬ 
ficult to make drastic changes and justify the expenses. 
Research chemists will also need to adopt the inherently safe 
design in process development. So far they have generally 
been oblivious of the safety issues. For their use of inherently 
safe design, it is essential that the inherent safety index (ISI) 
be very simple. 

There are no hard and fast rules or methods as to how to 
make a process inherently safer. One could use any one of 
several approaches possible (different catalysts, reactants, 
operating conditions, yield, by-products, etc). Up till now, 
the choice between competing processes has been guided 
by their technical feasibility and economic viability. Lately 
the safety and environment concerns have also impacted 
the choice between competing processes due to regulatory 
requirements. Therefore, if some sort of a measure of 
inherent safety were available, it would make the decision¬ 
making so much easier. Researchers spread over several 
continents have looked at the problem of measuring inher¬ 
ent safety Each group has developed ISI, different from the 
other groups. That is how, probably, progress is made in 
new fields. After due time and experience, people converge 
on to a common system, which is then universally adapted. 
In inherently safe design measurement, we have come to a 
stage where several approaches are available and it is time 
to start consolidating the work while not shutting out alto¬ 
gether newer approaches. As experience is gained in using 
the existing indices, a universally accepted index will 
develop. 

We mention the existing indices followed by a brief 
description of the inherent safety indices. Thereafter we 
discuss the work needed to consolidate the efforts. 


32.7.2 Existing indices 

Dow Fire and Explosion Index (Dow Chemical Company 
1994) and Mond Index (ICI, 1993) are used for determining 
the hazard level of a process plant. However, to use these, 
the process design has to be fully in place since a lot of 
information required pertains to that. Hence, these are 
unsuitable for use in conceptual design and preliminary 
process development stages, which is the aim of the 
inherent safety indices. 


32.7.3 Inherent safety indices 

Edwards and Lawrence index (Edwards and Lawrence, 

1993; Lawrence, 1996) 

Called PUS (Prototype Index of Inherent Safety), this was 
the first ever index that was developed and has been 
modified by later workers. 

The authors decided upon 17 parameters that they thought 
affected inherent safety (IS) of a process (Table 32.4). Out of 
these 17, they picked 7 in the first application of their PUS 
index (Table 32.4). They divided the total ranges that each of 
these parameters could possibly take in the process industry 
into several sub-ranges and assigned numerical scores to 
each sub-range. These numerical scores were either based 
on existing indices including the Dow Fire and Explosion 
Index and the Mond Index or on their own judgement. Scoring 
tables for temperature and pressure are given in Tables 32.5 
and 32.6 for our discussion purposes. Lawrence (1996) has 
given tables for inventory, explosiveness, yield, toxicity and 
flammability also. They applied PUS to six routes to manu¬ 
facture methyl methacrylate (MMA) in order to rank their 
inherent safety (MM A,Table 32.7).They considered each step 
of each route and noted down the operating pressure and 
temperature, yield, flammability, toxicity and explosiveness 
of all the reactants, products and intermediates involved. 
For inventory, they took a one-hour residence time, and stoi¬ 
chiometric relationship into account for a 50,000 tonnes 
per year production of the final product, MMA. The worst 


Table 32.4 Parameters listed by Lawrence (1996) 


(1) 

Inventory (volume 
or mass)* 

(10) 

Side reactions 

(2) 

Temperature* 

(ID 

Waste and co-products 

(3) 

Pressure * 

(12) 

Reaction rate 

(4) 

Conversion 

(13) 

Catalytic action 

(5) 

Yield* 

(14) 

Heat of reaction 

(6) 

Toxicity* 

(15) 

Phase 

(7) 

Flammability* 

(16) 

Phase change 

(8) 

(9) 

Explosiveness* 

Corrosiveness 

(17) 

Viscosity 

*Pai 

-ameters considered in the 

: MMA exa 

imple. 


Table 32.5 Temperature scoring table 
(Lawrence, 1996) 


Temperature (°C) 



Score 



T 

< 

-25 

10 

-25 

< 

T 

< 

-10 

3 

-10 

< 

T 

< 

10 

1 

10 

< 

T 

< 

30 

0 

30 

< 

T 

< 

100 

1 

100 

< 

T 

< 

200 

2 

200 

< 

T 

< 

300 

3 

300 

< 

T 

< 

400 

4 

400 

< 

T 

< 

500 

5 

500 

< 

T 

< 

600 

6 

600 

< 

T 

< 

700 

7 

700 

< 

T 

< 

800 

8 

800 

900 

< 

< 

T 

T 

< 

900 

9 

10 
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chemical for flammability, toxicity and explosiveness was 
taken for each step. Flammability score was based on the 
flash point and boiling point of a chemical, explosiveness 
was based on the range of explosive mixture (UEL-LEL) 
while toxicity was based on the threshold limit value (TLV). 

The scores for each step in a given process route for 
pressure, temperature and yield were added together and 
called the ‘process score’, while the scores for inventory, 
toxicity, flammability, explosiveness were added together 


Table 32.6 Pressure scoring table 
(Lawrence, 1996) 


Pressure (psi) 

Score 

0-90 

1 

91-140 

2 

141-250 

3 

251-420 

4 

421-700 

5 

701-1400 

6 

1401-3400 

7 

3401-4800 

8 

4801-6000 

9 

6001-8000 
+ 1 point per 2500 psi 

10 


and called the ‘chemical score’. The two sets of scores thus 
obtained for each step in a route were added to get a score 
for each route. These final scores were taken as a measure of 
the inherently safer (actually, inherently riskier) nature of 
different routes and the one with the highest numerical 
value was taken to be the worst route (Table 32.8). Based 
upon this exercise, acetone cyanohydrin (ACH) route comes 
out to be the worst. Note that this is the only route in use in 
major manufacturing facilities worldwide (unless some 
local laws prohibit the use of hazardous chemicals like 
HCN, HF, etc., thus forcing the choice of a different route). 

Edwards and Lawrence (1993) then invited eight 
renowned process safety experts to comment on their work 
(Table 32.9). The experts first looked at each of the routes in 
its entirety, then at each of the steps (without referring as to 
which route the specific step belonged to) and finally at the 
proposed PUS index. Their ranking of the different routes 
matched to a large extent the ranking obtained by Edwards 
and Lawrence using the proposed index. That is not sur¬ 
prising since, whether with or without an index, a process 
route with high pressure, high temperature, high values of 
toxicity, flammability and explosiveness and high inven¬ 
tory is more dangerous (and hence more inherently unsafe) 
than routes that are otherwise. 

This pioneering work of Edwards and Lawrence caught 
the attention of several other workers. Their indices are 
described below. 


Table 32.7 Details of six MM A routes (Lawrence, 1996) 


Route 1: Acetone cyanohydrin based route (ACH) 


Step 1: 2CH 4 + 2NH 3 + 30 2 - 2HCN + 6H 2 0 

Methane + Ammonia + Oxygen —> Hydrogen cyanide + Water 

Gas phase; Pressure: 3.4 Atm;Temperature: 1200°C; Yield: 64% 

Step 2: (CH 3 ) 2 CO + HCN -> (CH 3 ) 2 COHCN 

Acetone + Hydrogen cyanide —> Acetone cyanohydrin 

Liquid phase; Pressure: Atmospheric; Temperature: 29-38°C; Yield: 91% 

Step3:2(CH 3 ) 2 COHCN + H 2 S0 4 + 2H 2 0 (CH 3 ) 2 COHCONH, + (CH 3 ) 2 COHCONH 2 ■ H 2 S0 4 ^ICH 2 =C(CH 3 )C0NH 2 

+CH 2 =C(CH 3 )CONH 2 ■ H 2 S0 4 + 2H 2 0 

Acetone cyanohydrin + Sulfuric acid + Water —> 2-Hydroxyl-2-methyl propionamide + 2-Hydroxyl-2-methyl 
Propionamide sulfate —> Methacrylamide + Methacrylamide sulfate + Water 
Liquid phase; Pressure: 7 Atm; Temperature: 130-150°C; Yield: 98% 

Step 4: CH 2 =C(CH 3 )CONH 2 + CH 2 = C(CH 3 )CONH 2 • H 2 S0 4 + 2CH 3 OH + H 2 S0 4 -2CH 2 = C(CH 3 )COOCH 3 + 2NH 4 HS0 4 
Methacrylamide + Methacrylamide sulfate + Methanol + Sulfuric acid —> Methyl methacrylate + Ammonium bisulfate 
Liquid phase; Pressure: 7 Atm; Temperature: 110-130°C; Yield: 100% 

Step 5: H 2 S0 4 + 2NH 4 HSO, + 30 2 + CH 4 -> 3S0 2 + C0 2 + N 2 + 8H 2 0 + 0 2 
Sulfuric acid + Ammonium bisulfate + Oxygen + Methane —> Sulfur dioxide + Carbon 
dioxide + Nitrogen + Water + Oxygen 

Gas phase; Pressure: Atmospheric; Temperature: 980-1200°C; Yield: 100 

Step 6: 2S0 2 + 0 2 —> 2S0 3 

Sulfur dioxide + Oxygen —> Sulfur trioxide 

Gas phase; Pressure: Atmospheric;Temperature: 405-440°C;Yield: 99.7% 

Similar details were also given about the remaining following five routes: 

Route 2: Ethylene (via Methyl propionate) based route (C2/MP) 

Route 3: Ethylene (via Propionaldehyde) based route (C2/PA) 

Route 4: Propylene based route (C3) 

Route 5: Isobutylene based Route (i-C4) 

Route 6:Tertiary Butyl Alcohol based Route (TBA) 
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Heikkila and Hurme index (Heikkila, Hurme, and 
Jarvelainen, 1996; Heikkila, 1999) 

These authors argued that the safety is affected both by the 
properties of the chemicals as well as the equipment used. 
They have, therefore, included the type of equipment and 
process structure. The similarities and differences in their 
approach and that of Edwards and Lawrence are brought 

Table 32.8 Scores for MM A routes from PIIS index 
(Lawrence, 1996) 


Route Chemical score Process score Index score 


ACH 58 45 

C2/PA 49 30 

C3 39 28 

C2/MP 35 17 

i-C4 24 25 

TBA 25 22 


Table 32.9 Process Safety Experts invited to comment 
on IS Index (Lawrence, 1996) 


F.P. Lees - 

Loughborough University 

M. Kneale - 

Independent consultant 

H.A. Duxbury — 

Independent Consultant/ 
Loughborough University 

T.A.Kletz - 

Independent Consultant/ 
Loughborough University 

C.C. Pinder - 

BP Chemicals Ltd/ 
Loughborough University 

W.H. Orrell — 

Independent consultant 

M.L. Preston - 

ICI Engineering 

A.G. Rushton - 

Loughborough University 


103 

79 

67 

52 

47 


out in Table 32.10. In Table 32.11, they bring out nicely 
how the various parameters are connected to the basic 
principles of inherent safety. They go on to produce an ISI 
with subdivisions for different parameters (Table 32.12): 

ITI = ICI + IPI 

where ITI is the total ISI, ICI and IPI are the summations of 
respective worst-case values of the sub-indices for various 
parameters. These values are chosen from a range of num¬ 
bers for each parameter (Table 32.13). The ranges for each 
parameter have been further subdivided. Representative 
tables for temperature and pressure (Tables 32.14 and 32.15) 
can be compared with Tables 32.5 and 32.6 given by 
Edwards and Lawrence (1993). There are significant dif¬ 
ferences and it is difficult to pick one over the other. The 
authors have also used ISI as an objective function in the 
genetic optimization and have come up with a case based 
reasoning for safe process structure. 


Paianiappan, et al. index (Palaniappan, Srinivasan and 
Tan, 2002; Palaniappan, 2001) 

These authors have come up with an i-Safe index. They 
expanded the Heikkila and Hurme’s chemical and process 
safety indices to include five other supplementary indices, 
viz: Hazardous Chemical Index (HCI), Hazardous Reaction 
Index (HRI), Total Chemical Index (TCI), Worst Chemi¬ 
cal Index (WCI) and Worst Reaction Index (WRI). The pro¬ 
posed index has been used by Srinivasan and Meibao (2003) 
to evaluate the six synthesis routes for methyl methacrylate 
orMMA, the set first used by Edwards and Lawrence (1993). 
This was a painstaking work because a lot of information 
about properties and operating conditions was not available 
in the literature. They calculated from thermodynamics 
and atomic contributions and used other similar reaction 


Table 32.10 Inherent safety parameters (Heikkila, Hurme, and Jarvelainen, 1996) 


Inherent safety 
parameters 
(Edwards and 

Lawrence, 1993) 

Chosen parameters by 

Comments 

Lawrence 

(1996) 

Heikkila 

(1999) 

Inventory 

X 

X 

relative to capacity 

Phase 



release property 

Temperature 




Pressure 

x 

x 


Heat of main reaction 


X 

high/low heat generation 

New phase generation 



solid/gas formation 

Catalysts 




Side reactions 


x 

heat generation 

Waste products 



considered by substances 

Reaction yield 

X 


considered by inventory 

Reaction rate 



considered by AH R 

Viscosity 



hot spots 

Flammability 

X 

X 

ease of burning (liquid) 

Explosiveness 

x 

x 

explosive gas mixture 

Corrosiveness 


x 

construction material 

Toxicity 

X 

X 

an adverse effect on the human body 

Chemical interaction* 


X 

reactivity 

Type of equipment* 


X 

choice of equipment 

Safety of process structure* 


x 

choice of configuration 


* Not included in Edwards and Lawrence (1993). 
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Table 32.11 The characteristics of inherent safety in conceptual process design (Heikkila, Hurme, and 

Jarveiainen, 1996) 

Principles of inherent safety 

PUS (Edwards and 

ISI (Heikkila, Hurme, 

(Kletz, 1978) 

Lawrence, 1993) 

andjarvelainen, 1996) 

Intensification 

(1) inventory 

inventory 

inventory 

(2) reaction volume 

reaction yield 


Substitution 

flammability 

flammability 

(1) safer materials 

explosiveness 

explosiveness 

Attenuation 

toxicity 

toxicity 

chemical interaction 

(1) lower temperature 

temperature 

temperature 

(2) lower pressure 

Limitation of Effects 

pressure 

pressure 

(1) safer technical alternatives 


equipment safety 

(2) safer reaction conditions 

temperature 

safe process structure 


pressure 

pressure 
temperature 
chemical interaction 

Simplification 

(1) simplify process facilities 

Making incorrect assembly impossible 


safe process structure 

(1) choice of equipment, piping and 


equipment safety 

fittings correctly 

Tolerance 


safe process structure 

(1) resistant to maloperation 


corrosiveness 
equipment safety 
safe process structure 

Ease of control 


safe process structure 
heat of reaction 


Table 32.12 Inherent safety index and parameters for its sub-indices (Heikkila, 
Hurme, and Jarveiainen, 1996) 


Total inherent safety index 

Chemical inherent safety index 

Process inherent safety index 

Sub-indices for reaction hazards 

Sub-indices for process conditions 

Heat of the main reaction 

Inventory 

Heat of the side reactions 

Process temperature 

Chemical interaction 

Process pressure 

Sub-indices for hazardous substances 

Sub-indices for process system 

Flammability 

Equipment 

Explosiveness 

Process structure 

Toxicity 


Corrosiveness 



situations as well to make estimates. Their results follow 
the trend of Edwards and Lawrence, with the ACH route 
coming out to be the worst (Table 32.16). However, the spread 
of the i-Safe index values, called Overall Safety Index 
(OSI = sum of TRI for main reaction steps) for the six routes, 
was in a narrow band of 15, from 51 to 65, compared to the 
spread of 57, from 47 to 103, in the study of Edwards and 
Lawrence. 


Khan and Amyotte Index (Khan and Amyotte, 2003) 
These authors have proposed an Integrated Inherent 
Safety Index (I2SI). It comprises of two main indices: a 
hazard index (HI) and an inherent safety potential index 
(ISPI). Both the ISPI and HI range from 1 to 200. HI consists 
of a damage index (DI) and a process and hazard control 
index (PHCI). DI has four subparts related to fire and 
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Table 32.13 Ranges for inherent safety sub-indices 
(Heikkila, Hurme, and Jarvelainen, 1996) 



Symbol 

Score 

Chemical inherent safety index, I c 



Heat of main reaction 

1 Irm 

0-4 

Heat of side reaction, max 

Irs 

0-4 

Chemical interaction 

IlNT 

0-4 

Flammability 

Ifl 

0-4 

Explosiveness 

Iex 

0-4 

Toxic exposure 

Itox 

0-6 

Corrosiveness 

IcOR 

0-2 

Process inherent safety index, I PI 

Inventory 

I, 

0-5 

Process temperature 

It 

0-4 

Process pressure 

I p 

0-4 

Equipment safety 



Isbl 


0-4 

Osbl 


0-3 

Safe process structure 

1st 

0-5 

Table 32.14 Determination of the process 


temperature sub-index l T 

(Heikkila, Hurme, 


and Jarvelainen, 1996) 

Process temperature (°C) 

Score of It 


<0 

1 


0-70 

0 


70-150 

1 


150-300 

2 


300-600 

3 


>600 

4 



Table 32.15 Determination of the process pressure 
sub-index l p (Heikkila, Hurme, and Jarvelainen, 1996) 

Process pressure (bar) 

Score of Ip 

0.5-5 

0 

0-0.5 or 5-25 

1 

25-50 

2 

50-200 

3 

200-1000 

4 


explosion, acute toxicity, chronic toxicity and environ¬ 
mental impairment. PHCI has ten subparts related to pres¬ 
sure, temperature, flow, level, concentration, inert venting, 
blast wall, fire resistance wall, sprinkler system and forced 
dilution. After the different terms above have been com¬ 
puted from various graphs, the ESI is given by 

ESI = ISPI/HI 

ESI > 1 implies an inherently safer approach. The higher 
the quotient, the greater is the inherent safety nature of the 
process. The authors have utilized their elaborate index to 
evaluate the six routes for MMA manufacture, the example 
used by Edwards and Lawrence (1993). Khan and Amyotte’s 
results (Table 32.17) and conclusions follow the trend of 
Edwards and Lawrence. 


Gentile et al. Index (Gentile, Rogers and Mannan, 2001) 
In all the above indices, except Khan and Amyotte’s, there 
are sudden jumps in the score values at the extreme ends of 
each subdivision. For example,Table 32.5 shows a score of 2 
for a temperature range of 100 to 199, which suddenly 
jumps to 3 at 200. Thus, while a change of 99 in tempera¬ 
ture, from 100 to 199, did not produce any change in the 
score, a further change of only I, from 199 to 200, changed 
the score by 1. Similar situation is encountered in tables for 
all the parameters in the indices proposed by Edwards and 
Lawrence (1993), Heikkila, Hurme and Jarvelainen (1996) 
and Palaniappan, Srinivasan and Tan (2002). Also, the 
scoring tables proposed by different authors for the same 
parameter do not always match. This introduces a sub¬ 
jective (or arbitrary) factor in the calculation of the indices. 
This aspect was addressed by Gentile et al. (2001). 
They used the fuzzy set theory to improve the sensitivity 
(either excessive or insufficient), as it existed in the ranges 
selected for the various parameters under consideration. 
They calculated their ISI based on if-then rules that 
describe the knowledge related to inherent safety Each 
parameter is described by a linguistic variable whose range 
is divided into fuzzy sets. For each set, a membership func¬ 
tion is defined which has a specific shape describing the 
physical behaviour of the set. This approach eliminates the 
problems of the interval-type approach used by other inves¬ 
tigators as noted above. Gentile proposes to have an index 
with 4 stages (Gentile, 2003): stage 0 = route selection, 
1 = process design, 2 = mechanical design, 3 = operation. 

INSETToolkit (Mansfield, 1997; INSIDE Project Team, 1997) 
Experts from several corporations in United Kingdom and 
Europe worked on an EU sponsored project for an index for 
inherent safety, health and environment (ISHE). They 
called it as INSET toolkit. They accounted for many situa¬ 
tions and developed several methods (called tools) for 
rapid as well as detailed analysis of processes for their 
ISHE performance (Table 32.18).These elaborate tools await 
intense testing and modifying before these can be used. 

Gupta and Edwards Method (Gupta and Edwards, 2003) 
These authors expressed three concerns about the additive 
indices discussed above: 

(1) Addition of different types of hazards or parameters is 
not justifiable. 

(2) Arbitrary assignment of scores to different para¬ 
meters (P, T, Inventory, ...) without establishing 
equality of hazard for the same numerical value (Does 
a number 3 in the table for pressure present the same 
hazard as 3 in table for temperature, etc.?). 

(3) The total score will get biased by the number of steps 
(e.g. 6 steps in ACH route for MMA), or by one major 
score (e.g. for pressure in an HDPE plant). 

They proposed that the parameters of interest should be 
plotted individually for each step in a process route without 
carrying out any mathematical operation and then be 
compared with each other (Figure 32.2). 

Kletz commented on this approach favourably (Kletz, 
2003)... “Instead of an absolute index we could compare a 
proposed new design (or designs) with ... an existing 
design, using a number of headings. This benchmarking 
approach would give a comparison of alternatives rather 
than a position on a scale. This should be satisfactory as 
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Table 32.16 i-Safe indices for the six different process routes (Palaniappan, Srinivasan and Tan, 2002; 

Palaniappan, 2001) 

Process 

IRI 

OCI 

TRI 

OSI 

HCI 

HRI 

WCI 

WRI 

TCI 

ACH-1 

12 

12 

24 1 







ACH-2 

4 

12 

16 







ACH-3 

3 

8 

11 







ACH-4 

5 

9 

14 

[ 65 

12 

12 

14 

13 

65 

ACH-5 

8 

5 

13 







ACH-6 

5 

8 

13 1 







(C2/PA)-1 

6 

10 

16 1 







(C2/PA)-2 

2 

10 

12 1 

1 51 

10 

6 

13 

15 

75 

(C2/PA)-3 

4 

9 

13 1 







(C2/PA)-4 

1 

9 

10 > 







(C2/MP)-1 

6 

10 

16 1 







(C2/MP)-2 

11 

9 

20 

1 52 

10 

11 

12 

13 

47 

(C2/MP)-3 

7 

9 

16 J 







C3-1 

5 

10 

15 'I 







C3-2 

7 

8 

15 1 

> 64 

10 

10 

13 

13 

53 

C3-3 

10 

6 

16 







C3-4 

9 

9 

18 > 







1-C4-1 

15 

9 

24 1 







i-C4-2 

13 

9 

22 

1 64 

9 

15 

11 

15 

36 

i-C4-3 

9 

9 

18 J 







TBA-1 

9 

9 

18 1 







TBA-2 

12 

9 

21 

1 57 

9 

12 

11 

13 

39 

TBA-3 

9 

9 

18 J 








Table 32.17 Results of I2SI application to six MMA production processes (Khan and Amyotte, 2003) 


Process 

Process step 

Hazard index 

DI PHCI 

Inherent safety 
potential index 

ISI PHCI 

I2SI 

Acetone cyanohydrin (ACH) 

Hydrogen cyanide production 

174 

71 

49 

57 

0.3 


ACH production 

174 

43 

75 

38 

0.5 


HMPA/HMPASE production 

76 

67 

49 

55 

0.7 


MMA production 


67 

49 

55 

0.7 


Spent gas production 

166 

63 

42 

65 

0.6 


Sulfur trioxide production 

97 

57 

75 

40 

1.1 

Ethylene based via 

Propionaldehyde production 

174 

71 

35 

61 

0.2 

propionaldehyde (C2/PA) 

Methacrolein production 

174 

71 

74 

61 

0.5 


Methacrylic acid 

174 

71 

107 

47 

0.9 


MMA production 

174 

71 

156 

43 

1.5 

Propylene based (C3) 

Isobutyryl fluoride production 

174 

71 

35 

59 

0.2 


Isobutyric acid production 

174 

71 

102 

55 

0.7 


Methacrylic acid production 

174 

71 

118 

51 

0.9 


MMA production 

174 

71 

156 

43 

1.5 

Ethylene based via methyl 

Methyl propionate production 

174 

71 

35 

61 

0.2 

propionate (C2/MP) 

Methylal production 

174 

71 

99 

53 

0.8 


MMA production 

174 

71 

116 

53 

0.9 

Isobutylene base (i-C4) 

Methacrolein production 

174 

71 

101 

51 

0.8 


Methacrylic acid production 

174 

71 

107 

47 

0.9 


MMA production 

174 

71 

156 

43 

1.5 

Tert butyl alcohol (TBA) based 

Methacrolein production 

174 

71 

88 

55 

0.7 


Methacrylic acid production 

174 

71 

107 

47 

0.9 


MMA production 

174 

71 

156 

43 

1.5 


MMA: Methyl methacrylate; ACH: Acetone cyanohydrin; HMPA: 2-hydroxy-2-methyl propionamide; HMPASE: 2-hydroxy-2-methyl 
propionamide sulfate ester; DI; damage index; PHCI: process hazard and control index; ISI: inherent safety index; I2SI: integrated inherent 
safety index. 
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Table 32.18 Summary of INSET Tools (Mansfield, 
1997; INSIDE Project Team, 1997) 


Tool Description 


A Detailed constraint and objective analysis 

B Process design generation 

C Preliminary chemistry route options record 
D Preliminary chemistry route rapid ISHE 
evaluation method 

E Preliminary chemistry route detailed ISHE 
evaluation method 

F Chemistry route block diagram record 

G Chemical hazards classification method 

H Record for foreseeable hazards 

I ISHE performance indices 

1.1 Fire and explosion hazard index 

1.2 Acute toxic hazard index 

1.3 Inherent health hazard index 

1.4 Acute environmental hazard index 

1.5 Transport hazard index 

1.6 Gaseous/atmospheric emissions 

environmental index 

1.7 Aqueous emissions environmental index 

1.8 Solid emissions environmental index 

1.9 Energy consumption index 

1.10 Reaction hazard index 

1.11 Process complexity index 

J Multi-attribute ISHE comparative evaluation 

K Rapid ISHE screening method 

L Chemical reaction reactivity - stability evaluation 
M Process SHE analysis - process hazards 
analysis, ranking method 

N Equipment inventory functional analysis method 

0 Equipment simplification guide 

P Hazards range assessment for gaseous release 

Q Siting and plant layout assessment 

R Designing for operation 


users want to know how different methods of making X 
compare, not if a plant for making X is safer than a plant for 
making Y... [It] supports my gut feeling that displaying 
a series of measurements will be more useful than trying 
to find a single number that measures inherent safety.” 

To demonstrate, the authors used the MMA example 
(Lawrence and Edwards, 1993). They plotted the values of 
temperature, pressure and a combined value for flamm¬ 
ability, explosiveness and toxicity (FET) for each step in 
Figure 32.1 and then compared them. Considering pres¬ 
sure, its maximum value is 7 bars for the ACH route while 
the next three routes have 49 to 100 bars. The remaining 
two routes have 7.5 bars. Further, three of the steps in the 
ACH route operate at atmospheric pressure, which would 
result in no flashing, if leaks were to occur. Summing up, 
the ACH route has a significant advantage over other routes 
as far the pressure is concerned. Considering temperature, 
two of the steps in the ACH route have a higher temperature 
than other routes. However, the authors felt that a higher 
pressure is more of a hazard than a higher temperature, in 
as far leakage, flashing of a liquid or rupture of a vessel and 
formation of energetic missiles and/or BLEVE with a 
possible domino effect, are concerned. This matches with 
the number of times (41) the experts in Lawrence’s thesis 
(Lawrence, 1996) used pressure as the key feature in 


describing their assessment of hazards in the MMA routes 
compared to the number of times (9) they used temperature 
as an important parameter. Looking at the FET values, the 
ACH route, in general, has values similar to those in most 
other routes. Two of the experts downgraded the hazards of 
the ACH route because of the experience they had had on 
this process and had found it to be very safe. 

Gupta and Edwards also pointed out that in the ACH 
route, the first two steps relate to the production of the basic 
material, ACH; the last two steps relate to the disposal of 
by-products, and only steps 3 and 4 relate to the actual 
production of MMA (Table 32.7). In the remaining five 
routes, only the actual production steps of MMA were con¬ 
sidered, not the production of the basic materials or dis¬ 
posal of the by-products, if any. Hence, if only the actual 
MMA production steps (steps 3 and 4) are considered in the 
ACH route also, it comes out by far the most superior route 
compared to all the rest of the routes. No wonder, industry 
uses this worldwide. 

According to the authors, the advantage of this simple 
graphical method of comparing process routes is that one 
can expand consideration to incorporate economic, regu¬ 
latory, pollution control and worker health aspects, as well 
as factors such as the experience one has or the ‘comfort 
level’ one feels with each of the processes under considera¬ 
tion. Results from accident databases can be included as a 
parameter (e.g. frequency of accidents, loss per accident, 
etc.). As it expands, one can bring into consideration other 
important aspects, such as, process intensification, where 
if the process volume is reduced by, say a 1000 -fold, one can 
work at higher pressures, closer to runaway temperatures 
and with more toxic reactants since the total release and 
hence consequences there of, in case of an accident, would 
be rather limited due to the very small amounts of hazard¬ 
ous chemicals involved. 

The suggested graphical procedure also meets the users’ 
desire of a simple index. Actually, inherent safety and 
simplicity go together since simplicity is one important 
parameter of inherently safer plants. 

32.7.4 Future work 

The indices developed thus far are expertise intensive. 
They need to be simplified so that a scientist or an engineer 
in the process industry can understand and use them easily 
without having to hunt for a lot of data and information. 
Most of the work has been done in academic institutions 
(except INSET Toolkit). Several practical examples from 
industry need to be evaluated using the proposed indices 
and modifications made to them to suit the needs of the 
industry. A holy alliance between the researchers, industry 
personnel and the regulators would prove beneficial to all. 

32.7.5 Measuring inherently safer design - conclusions 

Inherent safety is an exciting field that has caught the 
attention of researchers, plant designers, management and 
regulators worldwide. An inherent safety measurement 
method is needed to compare different processes for an end 
product. This method should work at the research stage 
itself and not require too much data. Researchers in several 
countries have produced indices towards this end. These 
indices are in an evolving stage. These need to be simpli¬ 
fied. The intensive work put in by researchers needs to be 
consolidated and unified. The ultimate proof will be in the 
thorough testing of the indices by the industry and sharing 
of their experiences. Some industries have developed their 
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Figure 32.2 MMA Routes (Gupta and Edwards, 2003) 


own proprietary methods to test for inherent safety but 
these are not available in open literature. 

Once the company personnel starting from research che¬ 
mists, process engineers and the rest start using inherently 
safer design, they would actually see the advantages and 
want to use it more and more. With process plants thus 
becoming significantly safer, the regulators are likely to 
gradually relax on process safety protocols. Once inherently 
safer design is successfully applied to process industries, 
it can be adapted by other accident-prone industries such as 
mining, construction, transportation and others. 


32.8 Inherently Safer Design and the Process 
Life Cycle 

Inherently safer design applies to a process at all phases 
in its life cycle, from early process conception, through 
laboratory development, pilot plant, preliminary and 
detailed design, construction, operationandshut-downand 
demolition. However, the designer will be applying inher¬ 
ently safer design principles in different ways at different 
stages of the life cycle. Early on, he will be considering 
the basic technology and synthesis routes, and in the later 
stages of the life cycle the designers and operators will he 
looking at more specific opportunities for applying inher¬ 
ently safer design concepts to specific pieces of equipment. 
The greatest opportunities for making major improvements 
in inherent safety occur early in process development, when 


the designer may have many choices of basic technology 
and chemistry available, and may be free to choose less 
hazardous alternatives. However, it is never too late to apply 
inherently safer design concepts, and major improvements 
to the inherent safety characteristics of plants which have 
been in operation for many years have been reported. 

Here are some examples of the kinds decisions in which 
inherently safer design concepts should be applied by the 
designer or operator of a process at different life cycle stages. 

(1) Conceptual process research and development: selec¬ 
tion of basic process technology, raw materials, inter¬ 
mediate products, by-products and waste products, 
chemical synthesis routes. 

(2) Process research and development: selection of spe¬ 
cific unit operations, types of reactors and other pro¬ 
cessing equipment, selection of operating conditions, 
recycle, product purification, waste treatment. 

(3) Preliminary plant design: location of manufacturing 
facility, location of units on a selected site, size and 
number of production lines, size of raw material, 
intermediate, and product storage facilities, selection 
of specific equipment types for the required unit 
operations, process control philosophy. 

(4) Detailed plant design: size of all equipment, pressure 
rating and detailed design of all equipment and piping, 
inventory in processing equipment, location of specific 
equipment in the plant, length, route, and size of piping, 
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utility design, layout of equipment, detailed control 
system design, plant-operator interface design. 

(5) Operation: identification of opportunities to modify 
plant to enhance inherent safety (reduce inventory, 
upgrade with more modern equipment, identify 
opportunities for inherently safer operation based on 
improved process understanding), consideration of 
inherently safer design when making modifications 
and changes, ‘user friendly’ operating instructions 
and procedures. 

32.9 Implementing Inherently Safer Design 

Inherently safer design applies at all levels of chemical 
plant conception, research, design and operation. It is more 
of a design philosophy or way of thinking than a specific 
set of tools, review meetings or other specific activities. The 
initial focus of the designer should be on the elimination 
and minimization of hazards, rather than the control of 
hazards. When a hazard is identified at any stage of devel¬ 
opment, the designer should ask the following questions: 

(1) Can the hazard be eliminated from the process? 

(2) If the hazard cannot be eliminated, can the magnitude 
of the hazard, or potential incidents arising from the 
hazard, be significantly reduced? 

(3) Do the alternative designs identified from the answers 
to Questions 1 and 2 increase the magnitude of other 
existing hazards, or introduce any new hazards to the 
process? 

(4) If the alternative designs increase other hazards, or 
introduce new hazards, develop an understanding of 
these hazards and understand the relative importance 
of the various hazards. 


(5) Identify passive, active and procedural safeguards 
appropriate for management of all hazards. 

(6) Use a logical decision process to select the optimum 
design, considering inherent safety characteristics, 
other safety characteristics, and all other relevant 
design parameters. 

Too often, upon identifying a hazard, the designer skips past 
the first four questions and goes directly to question 5 - 
identifying ‘add- on’ safety features to manage and control a 
hazard whose existence and magnitude the designer 
accepts. While it will not always be possible or feasible to 
eliminate or significantly reduce hazards, it is certain that 
it will never happen if the designer never asks the question. 
This is the heart of the inherently safer design philoso¬ 
phy - first ask if hazards can be eliminated from the pro¬ 
cess, or if they can be dramatically reduced. Do not go 
directly to designing safety systems to manage and control 
hazards until it has been determined that it is not feasible to 
eliminate or reduce hazards. 

Some companies incorporate inherently safer design 
into the process hazard analysis (PHA) activities which are 
already included in their process safety programs. In the 
course of a safety review, HAZOP, or other process safety 
review activity, the review team and leader are charged 
with considering inherently safer design options. Other 
companies have used separate inherent safety reviews. 
CCPS (1996) and others have published some checklists 
which can be used in separate inherent safety reviews, or 
provided to PHA teams for consideration as they conduct 
their reviews. Table 32.19 is an example of a general check¬ 
list (CCPS, 1996). 

CCPS (1998) provides a series of checklists which are 
useful in identifying hazards associated with various 


Table 32.19 A Checklist for Inherently safer design (adapted from CCPS, 1996) 


1.1 Minimize (or itensify) 

1. Do the following strategies reduce inventories of hazardous raw materials, intermediates, and/or finished products? 

(a) Improved production scheduling 

(b) Just-in-time deliveries 

(c) Direct coupling of process elements 

(d) In-site generation and consumption 

2. Do the following actions minimize in-process inventory? 

(a) Eliminating or reducing the size of in-process storage vessels 

(b) Designing processing equipment handling hazardous materials for the smallest feasible inventory 

(c) Locating process equipment to minimize the length of hazardous material piping runs 

(d) Reducing piping diameters 

3. Can other types of unit operations or equipment reduce material inventories? For example: 

(a) Wiped film stills in place of continuous still pots 

(b) Centrifugal extractors in place of extraction columns 

(c) Flash dryers in place of tray dryers 

(d) Continuous reactors in place of batch 

(e) Plug flow reactors in place of continuous-flow stirred tank reactors 

(f) Continuous in-line mixers in place of mixing vessels 

4. Can thermodynamic or kinetic efficiencies of reactors be improved by design upgrades (e.g. improved mixing or heat 
transfer) to reduce hazardous material volume? 

5. Can equipment sets be combined (e.g. replacing reactive distillation with a separate reactor and multi-column 
fractionation train; installing internal reboilers or heat exchangers) to reduce overall system volume? 

6. Can pipeline inventories be reduced by feeding hazardous materials as a gas instead of a liquid (e.g. chlorine)? 

7. Can process conditions be changed to avoid handling flammable liquids above their flash points? 

8. Can process conditions be changed to reduce production of hazardous wastes or by-products? 
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1.2 Substitute 

1. Is it possible to completely eliminate hazardous raw materials, process intermediates, or by-products by using an 
alternative process or chemistry? 

2. Is it possible to completely eliminate in-process solvents by changing chemistry or processing conditions? 

3. Is it possible to substitute less hazardous raw materials? For example: 

(a) Non-combustible rather than flammable 

(b) Less volatile 

(c) Less reactive 

(d) More stable 

(e) Less toxic 

4. Is it possible to use utilities with lower hazards (e.g. low pressure steam instead of combustible heat transfer fluid)? 

5. Is it possible to substitute less hazardous final product solvents? 

6. For equipment containing materials that become unstable at elevated temperatures or freeze at low temperatures, is it 
possible to use heating and cooling media that limit the maximum and minimum temperature attainable? 

1.3 Moderate (or Attenuate) 

1. Is it possible to keep the supply pressure of raw materials lower than the working pressure of the vessels to which they 
are fed? 

2. Is it possible to make reaction conditions (e.g. pressure or temperature) less severe by using a catalyst or by using a 
better catalyst? 

3. Can the process be operated at less severe conditions using any other route? For example: 

(a) Improved thermodynamic or kinetic efficiencies of reactors by design upgrades (e.g. improved mixing or heat 
transfer) to reduce operating temperatures and/or pressures 

(b) Changes to the order in which raw materials are added 

(c) Changes in phase of the reaction (e.g. liquid/liquid, gas/liquid or gas/gas) 

4. Is it possible to dilute hazardous raw materials to reduce the hazard potential? For example, by using the following: 

(a) Aqueous ammonia instead of anhydrous 

(b) Aqueous HC1 instead of anhydrous 

(c) Sulfuric acid instead of oleum 

(d) Dilute nitric acid instead of concentrated fuming nitric acid 

(e) Wet benzoyl peroxide instead of dry 

1.4 Limit effects 

1. Is it possible to design and construct vessels and piping to be strong enough to withstand the largest overpressure that 
could be generated within the process, even if the ‘worst credible event’ occurs (eliminating the need for complex, high 
pressure interlock systems and/or extensive emergency relief systems)? 

2. Is all equipment designed to totally contain the materials that might he present inside at ambient temperature or the 
maximum attainable process temperature (i.e. higher maximum allowable working temperature to accommodate loss 
of cooling, simplifying reliance on the proper functioning of external systems, such as refrigeration systems, to 
control temperature such that vapour pressure is less than equipment design pressure)? 

3. Can passive leak-limiting technology (e.g. blowout resistant gaskets and excess flow valves) be utilized to limit 
potential for loss of containment? 

4. Can process units be located to reduce or eliminate adverse effects from other adjacent hazardous installations? 

5. Can process units be located to eliminate or minimize the following? 

(a) Off-site impacts 

(b) On- site impacts on employees and other plant facilities 

6. For processes handling flammable materials, is it possible to design the facility layout to minimize the number and size 
of confined areas and to limit the potential for serious overpressures in the event of a loss of containment and 
subsequent ignition? 

7. Can the plant be located to minimize the need for transportation of hazardous materials? 

8. Can materials be transported in the following ways? 

(a) In a less hazardous form 

(b) Via a safer transport method 

(c) Via a safer route 

1.5 Simplify/design for error tolerance 

1. Is it possible to separate a single, procedurally complex, multipurpose vessel into several simpler processing steps and 
processing vessels, thereby reducing the potential for hazardous interactions when the complexity of the number of 
raw materials, utilities, and auxiliary equipment is reduced for specific vessels? 
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2. Can equipment be designed so that it is difficult to create a potentially hazardous situation due to an operating or 
maintenance error? For example: 

(a) Simplifying displays 

(b) Designing temperature-limited heat transfer equipment 

(c) Lowering corrosion potential by use of resistant materials of construction 

(d) Lowering operating pressure to limit release rates 

(e) Using higher processing temperatures (to eliminate cryogenic effects such as embrittlement failures) 

(f) Using passive vs active controls (e.g. stronger piping and vessels) 

(g) Using buried or shielded tanks 

(h) Using fail-safe controls if utilities are lost 

(i) Limiting the degree of instrumentation redundancy required 

(j) Using refrigerated storage vs pressurized storage 

(k) Spreading electrical feed over independent or emergency sources 

(l) Reducing wall area to minimize corrosion/fire exposure 

(m) Reducing the number of connections and paths 

(n) Minimizing the number of flanges in hazardous processes 

(o) Valving/piping/hose designed to prevent connection error 

(p) Using fewer bends in piping 

(q) Increasing wall strength 

(r) Using fewer seams and joints 

(s) Providing extra corrosion/erosion allowance 

(t) Reducing vibration 

(u) Using double-walled pipes, tanks and other containers 

(v) Minimizing the use of open-ended valves 

(w) Eliminating open-ended, quick-opening valves in hazardous service 

(x) Improving valve seating reliability 

(y) Eliminating unnecessary expansion joints, hoses and rupture disks 

(z) Eliminating unnecessary sight glasses/glass rotometers 

3. Can procedures be designed so that it is difficult to create a potentially hazardous situation due to an operating or 
maintenance error? For example: 

(a) Simplifying procedures 

(b) Reducing excessive reliance on human action to control the process 

4. Can equipment be eliminated or arranged to simplify material handling? 

(a) Using gravity instead of pumps to transfer liquids 

(b) Siting to minimize hazardous transport or transfer 

(c) Reducing congestion (i.e. easier to access and maintain) 

(d) Reducing knock-on effects from adjacent facilities 

(e) Removing hazardous components early in the process rather than spreading them throughout the process 

(f) Shortening flow paths 

5. Can reactors be modified to eliminate auxiliary equipment (e.g. by creating a self-regulatory mechanism by using 
natural convection rather than forced convection for emergency cooling)? 

6. Can distributed control system (DCS) modules be simplified or reconfigured such that failure of one module does not 
disable a large number of critical control loops? 


specific types of process equipment, including vessels, 
reactors, mass transfer equipment, heat transfer equip¬ 
ment, dryers, fluid transfer equipment, solid—fluid 
separators, solids handling and processing equipment, 
fired equipment, and piping and piping components. The 
checklists also provide examples of inherent, passive, 
active and procedural design features which have been 
implemented to address the hazards listed.Table 32.20 is an 
example of the checklists from CCPS (1998), for dryers. 

The INSIDE project (INSET Toolkit, 1997) provide a 
set of tools for identifying inherently safer design options 
at various stages of process development. These tools are 
listed in Table 32.18. The CCPS and the Center for Waste 
Reduction Technologies (CWRT) has developed a process 
called MERITT (Maximizing EHS Returns by Integrating 


Tools and Talents) for enhancing process development 
by better integrating environmental, health and safety 
evaluations into the basic process development (CCPS and 
CWRT, 2001; Mulholland, Bendixen and Keeports, 2001). 

There have been some regulatory proposals to require 
that the chemical industry consider inherently safer design 
options. In the early 1990s, the United States Environ¬ 
mental Protection Agency considered requiring a ‘Tech¬ 
nical Options Analysis (TOA)’ for plants covered by its 
Risk Management Program (RMP), as required by the US 
Clean Air Act Amendments of 1990. However, the TOA 
requirement was not included in the final RMP regulations. 
In 1999, Contra Costa County, California passed its Indus¬ 
trial Safety Ordinance (Sawyer, 2002), which requires that 
covered facilities consider inherently safer design options. 




Table 32.20 An example of the equipment failure scenario tables, with potential design approaches, for dryers (excerpted from CCPS, 1998) 


No. 

Operational 

deviations 

Failure scenarios 




Potential design solutions 





Inherently safer/passive 

Active 

Procedural 

1. 

Overpressure 

Buildup and autoignition 

(a) 

Dryer design which minimizes 

(a) 

Automatic sprinkler 

(a) 

Periodic inspection and 



of deposits in dryers and 


buildup of deposits (smooth 


system/COz total flooding 


cleaning 



ductwork resulting in 


surfaces, elimination of potential 


system 

(c) 

Emergency response 



fire/explosion 


points of solids accumulation) 

(b) 

Use of inert atmosphere 


procedures 




(b) 

Use dryer with short residence 

(c) 

Deflagration venting 

(c) 

Proceduce to process most 





time (e.g. flash dryer) 

(d) 

Deflagration suppression 


stable materials first when 




(c) 

Design dryer to contain 


system 


campaigning multiple products 





overpressure where practical 

(e) 

Automatic isolation of 


to avoid ignition of unstable 




(d) 

Permanent bonding and 


associated equipment via 


materials 





grounding 


quick closing valves 

(d) 

Procedure for determining 
maximum tolerable material 









accumulation 








(e) 

Manual activation of fire 
fighting/inerting system 

2. 

Overpressure 

Ignition of condensing 

(a) 

Dryer design to prevent 

(a) 

Automatic sprinkler 

(a) 

On-line flammable gas 



flammable vapor in 


condensation in ductwork 


system/C0 2 total flooding 


detection and manual activation 



ductwork resulting in 

(b) 

Provision for drainage of ducts 


system 


of C0 2 total flooding system 



fire/explosion 


(e.g. sloped, low point drains) 

(b) 

Ventilation system to keep 

(b) 

Manual activation of fire 




(c) 

Eliminate ignition sources 


flammable concentration 


fighting/inerting system 





within the ductwork 


below lower flammable limit 

(c) 

Manual bonding and 




(d) 

Eliminate flammables 

(c) 

Deflagration vents 


grounding 




(e) 

Design dryer to contain 

(d) 

Use of inert atmosphere 







overpressure where practical 

(e) 

Automatic isolation of 






(f) 

Permanent bonding and 


associated equipment via 







grounding 


quick closing valves 
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Bills addressing security issues in the chemical industry, 
including the potential of inherently safer technology for 
reducing the attractiveness of a chemical plant as a poten¬ 
tial terrorist target, have been introduced in the US Senate 
in 2001 and 2003, but none have been passed as of the end 
of 2003. 

However, the best way to invent and build inherently 
safer processes is to make it a part of the thinking of all 
engineers and chemists as they go about their work. If they 
recognize the importance and benefits of hazard elimina¬ 
tion, their creativity in inventing new ways to eliminate or 
reduce hazards as they go about their work activities will 
go further toward enhancing inherent safety than any 
review meetings possibly could. 


32.10 Inherently Safer Design References 

The INSIDE Project (INSET Toolkit, 1997), CCPS (1996), 
and Kletz (1998) provide the most comprehensive overall 
discussions of inherently safer design. The International 
Process Safety Group and the Institute of Chemical Engi¬ 
neers (IPSG and IChemE, 1995) developed an excellent 
training package on inherently safer design. CCPS and 
CWRT (2001) provide an overall methodology (MERITT) 
for considering inherently safer process options in con¬ 
junction with environmental characteristics of a process at 
an early stage of process development. Table 32.21 lists a 
number of literature references which discuss inherently 
safer technology, grouped into specific topic areas. 


Table 32.21 Selected literature references on inherently safer design 


General references on inherently safer design 

Kletz (1978); Kletz (1979); Kletz (1983); Kletz (1984); Kletz (1985); Gerritsen and Van’t Land (1988); Kletz (1989); Englund 
(1990); Kletz (1990); Puranik, Hathi and Sengupta (1990); Englund (1991a); Englund (1991b); Kletz (1991a); Kletz (1991b); 
McQuaid (1991); Preston and Turney (1991); Barton and Rogers (1993); Center for Chemical Process Safety (CCPS) (1993b); 
Englund (1993); Hendershot (1993); Englund (1994); Mansfield (1994); Mansfield and Cassidy (1994); IPSG/IChemE 
(1995); Kletz (1995); Lutz (1995b); Center for Chemical Process Safety (CCPS) (1996); Hawksley and Preston (1996); Kletz 
(1996); Park (1996); Perrin (1996); Snyder (1996); van Steen (1996); Hendershot (1997b); Kletz (1997); Preston (1997); 
Center for Chemical Process Safety (CCPS) (1998); Kletz (1998); Mansfield and Hawksley (1998); Hendershot (1999); Kletz 
(1999a); Kletz (1999b); Dalzell and Willing (2000); Pasman and Lemkowitz (2000); Edwards and Gupta (2002); Mary Kay 
O’Connor Process Safety Center (2002); Gupta, Hendershot and Mannan (2003); Khan and Amyotte (2003b); Mannan 
Rogers et al. (2003) 

Examples of inherently safer design 

Hendershot (1988); Kharbanda and Stallworthy (1988); Lammertink (1992); Whiting (1992); Oosterkamp (1993); Wilkinson 
and Geddes (1993); Lin etol. (1994); Pan etal. (1994); Gowland (1995); Heil (1995); Marshall Mundt etol. (1995); Scheffler 
(1995); Windhorst (1995); Wiss, Fleury and Fuchs (1995); Carrithers, Dowell and Hendershot (1996); Dutt (1996); Keller, 
Heinxle and Hungerbuhler (1996); Koch, Krause and Mehdizadeh (1996); McCarthy Ditz and Geren (1996); Osterwalder 
(1996); Riezel (1996); McCarthy and Miller (1997); Delseth (1998); Lacoursiere, Sarlis and Ravary (1998); Sato, Aoki and 
Noyori (1998); Zwetsloot and Askounes-Ashford (1999); Book and Challagulla (2000); Hendershot and Post (2000); Wolff 
(2001); Khan and Amyotte (2002); Proctor and Warr (2002); Amyotte, Khan and Dastidar (2003) 

Methods for developing inherently safer designs 

Lutz (1994); Rushton, Edwards and Lawrence (1994); French,Williams and Wixom (1995); Lutz (1995a); Rogers et al. (1995); 
Lodal (1996); Mansfield, Malmen and Suokas (1996); INSIDE Project Team (1997); Lutz (1997); Turney etal. (1997); Center 
for Chemical Process Safety (CCPS) (1998); Wood and Green (1998); Schupp et al. (2000); Center for Chemical Process 
Safety (CCPS) and Center for Waste Reduction Technologies (CWRT) (2001); Hendershot (2002); Palaniappan, Srinivasan 
and Halim (2002) 

Inherent safety strategies minimize 

Doherty and Buzad (1992); Hannon (1992); Benson and Ponton (1993); Alamaro (1994); Paquet Jr. and Ray (1994a); Paquet 
Jr. and Ray (1994b); Jones (1996); Kelleher and Fair (1996); Lerou and Ng (1996); Ponton (1996); Brenchley and Wegeng 
(1998); Green (1998);TeGrotenhuis, Cameron and Butcher (1998); Wegeng and Drost (1998); Barrow, Cefai and Taylor 
(1999); Cybulski et al. (1999); DeWitt (1999); Jensen (1999); Lowe and Ehrfeld (1999); McCreedy (1999); Ramshaw (1999); 
Tonkovich etal. (1999); Wegeng, Drost and Brenchley (1999); Harold and Ogunnaike (2000); Hendershot (2000); 
Stankiewicz and Moulijn (2000); Warlin and Svensson (2000); Sharangpani and Tay (2001); Sojka (2002); Stitt (2002); 
Stankiewicz and Moulijn (2003);Tsouris and Porcelli (2003) 

Inherent safety strategies moderate 

Speechly,Thornton and Woods (1979); Hugo and Steinbach (1986); Orrell and Cryan (1987); Gygax (1988); Steensma and 
Westererp (1988); Grewer et al. (1989); Forsberg (1990); Steensma and Westererp (1990); Chevalier (1991); Lazari, Burley 
and Al-Hassani (1991); Newby and Forth (1991); Sherringron (1991); Wilday (1991); Bashir et al. (1992); Calvert (1992a); 
Calvert (1992b); Nasr (1992); Prugh (1992); Raghaven (1992); Shinnar Doyle et al. (1992); Cleary (1993); Harris (1993); 
Komarek (1993); Melhem (1993); Misono and Okuhara (1993); Singh (1993); Somerville (1993); Sundell and Nasman (1993); 
Nasr (1994); Paul (1994); Weirick, Farquhar and Chismar (1994); Costa, Recasens and Velo (1995); Eierman (1995); Velo, 
Bosch and Recasens (1996);Verwijs van den Berg and Westererp (1996); Flamberg,Torti and Myers (1998); Koolen (1998); 
de Santoli and Lo Giudice (2000); Rovison, Garcia and Collins (2001); Moosemiller and Whipple (2002) 




32/24 INHERENTLY SAFER DESIGN 


Inherent safety strategies substitute 

Agreda, Partin and Heise (1990); Amendola etal. (2000); Anastas (1994); Anastas and Breen (1997); Ashby and Paton 
(1993); Bailey (1992); Bell Manzer et al. (1995); Black (1996); Dartt and Davis (1994); Davis Kincaid et al. (1994); DeSimone 
etal. (1994); Dittmer (1997); Donohue and Geiger (1994); Flam (1994); Goldschmidt and Filskov (1990); Govardhan and 
Margolin (1995); Hall (1994); Hendershot (1998); Jessop, Ikariya and Noyori (1994); Joback (1994); Lim (1994); Lin and 
Ayusman (1994); Lubineau (1996); Lucas etal. (2003); Mandich andKrulik (1992); Manzer (1993a); Manzer (1993b); Manzer 
(1994); Mills and Chaudhari (1997); Mittelman and Lin (1995); Mittelman etal. (1994); Mizerek (1996); Moore Samdani et al. 
(1994); Negron (1994); Paul (1988); Rogers and Hallam (1991); Savage etal. (1995); Shanley (1999); Sorensen and Petersen 
(1992);Tavener and Clark (1997);Tietze (1995);Timberlake and Govind (1994);Tobin (1994);Varma (1999);Wallington etal. 
(1994); Walsh and Mills (1993); Welter (1991); Wender, Handy and Wright (1997) 

Measuring inherent safety 

Tyler (1985); Edwards and Lawrence (1993); ICI (1993); Lawrence, Edwards and Rushton (1993); Dow Chemical Company 
(1994); Lawrence and Edwards (1994); Edwards and Lawrence (1995); Mansfield etal. (1995); Edwards, Lawrence and 
Rushton (1996); Heikkila, Hurme and Jarvelainen (1996); Johnson, Unwin and McSweeney (1996); Lawrence (1996); 
Shonnard etal. (1996); Cave and Edwards (1997a); Cave and Edwards (1997b); Hendershot (1997a); Mansfield (1997); 
Gupta and Babu (1999); Heikkila (1999); Roller, Fischer and Hungerbuhler (2000); Palaniappan, Srinivasan and Tan 
(2000a); Palaniappan, Srinivasan and Tan (2000b); Palaniappan, Srinivasan and Tan (2000c); Gentile, Rogers and 
Mannan (2001); Palaniappan (2001); Etowa etal. (2002); Gentile, Rogers and Mannan (2002); Gupta and Edwards (2002); 
Palaniappan, Srinivasan and Tan (2002a); Palaniappan, Srinivasan and Tan (2002b); Gentile, Rogers and Mannan (2003); 
Gentile, Rogers and Mannan (2003a); Gupta and Edwards (2003); Huang,Tan and Preston (2003); Khan and Amyotte 
(2003a); Khan, Sadiq and Amyotte (2003); Shah, Fischer and Hungerbuhler (2003); Srinivasan and Meibao (2003) 

Inherent safety conflicts and decision-making 

Center for Chemical Process Safety (CCPS) (1995); Hendershot (1995a); Hendershot (1995b); Perry (1995); Berger and 
Lantzy (1996); Mansfield (1996); Dowell (1999); Fawell (2001); Mulholland, Bendixen and Keeports (2001); Luyben and 
Hendershot (2003) 

Inherent safety and environmental issues 

Brennan (1993); Englehardt (1993); Berger (1994); Mak, Muhle and Achini (1997); Sheldon (1997); Mulholland, Sylvester 
and Dyer (2000); Bendixen (2002) 

Inherent safety and education 

Kletz (1993); Gupta (1999); Gupta (2000) 

Regulations and public policy 

Marshall (1990); Ashford (1993);Tickner (1994); Stone, Gray andTickner (1995); Phillips and Gray (1996); Ashford (1997a); 
Ashford (1997b); Ashford (1997c); Contra Costa County Health Services (1997); Orum (1998); Baumann and Orum (1999); 
Ashford and Zwetsloot (2000); Ferris (2002); Moore (2002); Sawyer (2002); Baybutt (2003); Lindsey and Hendershot 
(2003); Moore and Rogers (2003) 
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33/2 REACTIVE CHEMICALS 


33.1 Background 

33.1.1 Motivation 

Serious incidents arising from uncontrolled reactivity have 
taken place since the inception of the chemical industry.The 
human toll of such incidents has been staggering. In recent 
decades, greater recognition and resources have been 
directed toward preventing and mitigating such occur¬ 
rences. A number of incidents have been so severe as to 
prompt regulatory initiatives to force better management 
of reactivity. It would not be surprising to see additional 
regulation enacted to address the issues. In any event, it is 
prudent for any company, organization or other group to 
scrutinize the chemicals being handled and implement 
measures to limit the risk of a major reactive hazards event. 

A sampling of incidents that have substantially height¬ 
ened concerns regarding reactive hazards in the general 
public, in governmental agencies and in industry includes: 

(1) The 1976 ICMESA incident in Seveso, Italy in which 
an uncontrolled chemical reaction generated pressure 
resulting in relief venting of a highly toxic dioxane 
into the neighbouring villages and countryside. 

(2) The 1984 Union Carbide incident in Bhopal, India in 
which methyl isocyanate was contacted with water, 
generating highly toxic cyanide gas and leading to 
thousands of fatalities. 

(3) The 1994 NappTechnology incident in Lodi, Newjersey 
in which an uncontrolled reaction involving gold ore 
processing led to the deaths of five fire fighters. 

(4) The 1999 Concept Sciences incident in Allentown, 
Pennsylvania in which an explosion arising from a 
process concentrating hydroxylamine resulted in five 
fatalities. Another event involving purified hydro¬ 
xylamine took place in a Nissin Chemical plant in 
Gunma Prefecture, Japan in 2000 and led to four 
fatalities. 

(5) The 2001 TotalFinaElf incident in Toulouse, France in 
which ammonium nitrate being processed for nitrogen 
fertilizers exploded, leading to 30 fatalities. 

These events, as well as numerous others, have influenced 
the perception and approach to reactive hazards. 

In 2002, the US Chemical Safety and Hazard Investiga¬ 
tion Board (CSHIB or CSB) issued a report examining 1,500 
US reactivity-related incidents. Of these, 167 serious inci¬ 
dents between 1980 and 2001 contained sufficient infor¬ 
mation to warrant further analysis, observations and 
conclusions. Nearly half of the incidents involved fatalities 
and nearly half affected the public (i.e. beyond the fenceline 
of facilities). The report also indicates that these types of 
incidents continue to occur at a troubling frequency 
The principal hazard is instability of an individual sub¬ 
stance or an uncontrolled or ‘runaway’ reaction. There now 
exist a bewildering multiplicity of tests for the detection 
and characterization of substances and reactions, and the 
apparatus for many of the tests is expensive. Moreover, it is 
not sufficient to determine the characteristics of the reac¬ 
tion on the laboratory scale. It is necessary also to char¬ 
acterize the reaction and the scale-up features to allow a 
safe design to be developed. The problem is particularly 
severe where it is a question of confirming that an existing 
process is safe, because in this case it is not possible to 
incorporate the safety margins that might be used in a new 
process. 


Runaway reactions 

In a runaway reaction, there is a reaction exotherm in the 
vessel or tank, the heat evolved is not removed sufficiently 
rapidly, the temperature of the reaction mass rises and the 
reaction accelerates. The exotherm may be from the main, 
intended process reaction or from an undesired side reac¬ 
tion. A high pressure may then be generated by the product 
gases or by the vapour pressure of liquids in the equip¬ 
ment. If this pressure is not relieved, the vessel or tank may 
suffer overpressure and fail. 

General reactivity incidents 

Uncontrolled reactions can occur in any setting or any piece 
of equipment where reactivity is not managed appro¬ 
priately. Though it is commonplace to envision such reac¬ 
tions taking place in reactors, the CSHIB investigation 
found that only 25% of the 167 incidents in the past two 
decades occurred in reactors. Another 22% occurred in 
storage equipment, an equivalent percentage in other pro¬ 
cess equipment (e.g. holding tanks, mixers, dryers), while 
13% took place in waste, separation and transfer equip¬ 
ment. In fact, only 70% of the incidents involved chemical 
manufacturing facilities while most of the remainder 
occurred in bulk storage/handling facilities. 

Reactor incidents 

Reactors (particularly, batch) are operated by a wide vari¬ 
ety of firms, many of which are quite small. On the other 
hand, the number of chemicals made by a given firm may be 
quite large. A work may produce over 1000 different che¬ 
micals using a range of reaction types. 

Analyses of batch reactor incidents in the United King¬ 
dom reported to the HSE have been given by Townsend and 
Pantony (1979), Barton and Nolan (1984), Nolan and Barton 
(1987) and by Marrs et ol. (1989). 

Marrs etal. based their study on two sets of data.The first 
was a set of UK data from the HSE’s own records for the 
period 1970-81 (the UK national data set) and the second, a 
collection of worldwide incidents made for the HSE (the 
world data set). The two sets contained 68 and 199 inci¬ 
dents, respectively. 

The overall taxonomy used by Marrs et al. is given in 
Table 33.1. The analysis of reactor overpressure incidents 
by incident mode is shown in Table 33.2, in which the tax¬ 
onomy is developed in finer detail and which utilizes the 
worldwide set. The table includes more detailed analyses 
for (a) sulfonation, (b) nitration and (c) polymerization 
reactions, for which incidents are relatively common. 

Information on reactor relief was obtainable only from 
the national set. Table 33.3-Table 33.5 give information on 
overpressure relief arrangements, overpressure incident 
and relief system behaviour. 

These workers also carried out an expert judgment field 
survey the results of which are shown in Table 33.6. The 
comparison of the ranking of the relative importance, or 
frequency, of the incident modes (1 = most important, etc.) 
is shown in Section A. There is reasonable agreement 
overall, with two exceptions. Thus, in both rankings, 
incorrect charging and inadequate cooling are ranked high, 
undesired catalysis low and excessive heating, incorrect 
agitation and exotherm from impurity, moderate. The 
exceptions are unknown exotherm/decomposition, which 
is ranked much lower by the experts than in the case his¬ 
tories and inadequate hatch control. The experts were from 
companies with expected good practice and the relatively 
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Table 33.1 Taxonomy for reactor overpressure 
analysis (Marrs et at., 1989) (Courtesy of the Institution 
of Chemical Engineers) 


A System description 

Chemical reaction 

Reactants, intermediates, products 

Heat of reaction 

Known exotherms 

Reactor pressure 

Reactor temperature 

Charging 

Cooling 

Heating 

Agitation 

Control system 

Trip/interlock system 

Batch cycle/control 

Operating vents 

Relief system 

B Reaction type 

B1 Alcoholysis 
B2 Animation 
B3 Condensation 
B4 Cyclization 
B5 Diazotization 
B6 Esterification 
B7 Halogenation 
B8 Hydrogenation 
B9 Hydrolysis 
BIO Isomerization 
Bll Methylation 
B12 Nitration 
B13 Oxidation 
B14 Polymerization 
B15 Sulfonation 


C Pressurizing fluid 

Cl Vapourized liquid 
C2 Decomposition gas 
C3 Water vapour 
C4 Flammable gas 
C5 Other gas/vapour 

D Pressurizing event 

D1 Regular reaction exotherm 
D2 Impurity reaction exotherm 
D3 Heat of mixing, dilution 
D4 Regular reaction decomposition 
D5 Impurity decomposition 
D6 Water ingress and Vapourization 
D7 Air ingress and combustion 
D8 High pressure gas ingress 

E Process deviation 


El Regular reaction inadequate information 
E2 Regular reactant unknown decomposition 
E3 Impurity reaction exotherm 
E4 Impurity decomposition 
E5 Incorrect charging 
E6 Inadequate cooling 


E7 Excessive heating 
E8 Incorrect agitation 
E9 Inadequate batch control 
E10 Undesired catalysis 
Ell High pressure gas connection 

F Initiating fault 

FI Inadequate reaction screening 
F2 Incorrect design 
F3 Mechanical failure 
F4 Utilities failure 
F5 Control system failure 
F6 Operator error 

G Overpressure effect 

G1 Open vessel 
G2 Excursion only 
G3 Bursting disc operated 
G4 Vessel ruptured 

G5 Bursting disc operated but inadequate, vessel ruptured 

H Bursting disc failure cause 


HI Undersized for design conditions 

H2 Demand greater than design conditions 

H3 Installation error 

H4 Modification error 

H5 Maintenance error 

H6 Disc failure 

H7 Vent piping failure 

I Release effects 


11 Flammable release 

1.1 No ignition 

1.2 Fire 

1.3 Explosion 

12 Toxic release 


low ranking of unknown exotherms probably reflects 
their view that they had taken steps to control this hazard. 
Sections B-E of Table 33.6 give the corresponding rank¬ 
ings of particular incident submodes. 

33.1.2 Regulations and compliance 

The rapid development of industrial facilities since 1950 
was followed by an increase in incidents involving reactive 
and toxic substances. Major losses due to these incidents 
prompted legislation to prevent such incidents. 

Seveso I 

A release of TCDD (tetrachlorodibenzoparadioxin) in the 
Seveso, Italy, incident of 1976 contaminated 10 square miles 
and about 2000 people were treated for dioxin poisoning. In 
1982, the European Community adopted the Seveso Direc¬ 
tive to identify and control the location of hazardous 
installations and to assess the hazards of substances above 
threshold quantities from a list of toxic, flammable or 
explosive materials. 

Seveso II 

The Seveso Directive required a review of its scope by the 
European Community, and in December 1996 the Seveso II 
Directive was adopted with the objective to prevent major 
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Table 33.2 Analysis of reactor overpressure: incident modes (Mans et at. 1989) (Courtesy of the Institution of 
Chemical Engineers) 


A Detailed Breakdown 


All reactions Nitration Sulfonation Polymerization 


Case 1: Cl Overpressure by Vaporized liquid 

D1 Regular reaction exotherm 

El Regular reaction inadequate information (7) 

El.l Unknown exotherm 
E1.2 Inadequate definition of operation 
E5 Incorrect charging (35) 

E5.1 Excess of reactant 
E5.2 Deficiency of reactant 
E5.3 Too fast addition of reactant 

E5.3.1 Automatic control failure 
E5.3.2 Manual control failure: 
Measurement/alarm 
Operator error 

E5.4 Too slow addition of reactant 

E5.5 Addition of wrong reactant 

E5.6 Modification of reactant 

E5.7 Incorrect order of reactant addition 

E5.8 Too slow reaction of solid (coarse particles) 

E5.9 Too fast reaction of solid (fine particles) 

E6 Inadequate cooling (26) 

E6.1 Underdesign (esp. scale-up) 

E6.2 Coolant circulation fault 

E6.2.1 Coolant source failure 
E6.2.2 Power failure 
E6.2.3 Pump failure 
E6.2.4 Coolant turned off 
E6.2.5 Coolant leak/loss 
E6.2.6 Blockage 
E6.2.7 Freezing 

E6.2.8 Automatic control failure 
E6.2.9 Manual control failure: 
Measurement/ alarm 
Operator error 

E6.3 Inadequate agitation (for heat transfer) 

E6.4 Internal fouling 

E6.5 External fouling 

E6.6 Evaporative coolant fault 

E6.7 Condenser fault 

E6.7.1 Condenser vapour inlet blockage 
E6.7.2 Condenser flooding 
E6.7.3 Condenser frozen 
E6.8 Moderating solvent fault 
E6.9 Steam jacket cooling inadequate 
E6.10 Other causes 
E7 Excessive heating (19) 

E7.1 Initial overheating 
E7.2 Heating/cooling changeover fault 
E7.3 Unintended heating or heating 
instead of cooling 
E7.4 Pump energy 
E7.5 Agitator energy 
E7.6 Steam leak 
E7.7 Live steam 
E7.8 Automatic control failure 
E7.9 Manual control failure: 

Measurement/ alarm 
Operator error 

E7.10 Overheating in flange joints 
E8 Inadequate agitation (for making) (20) 


3 

10 

9 


5 


3 a 

1 

3 b 

3 

2 


2 

3 

3 

2 C 


2 

2 

1 

2 


20 


2 

1 

3 


2 


3 


4 


2 
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Table 33.2 (continued) 


E9 Incorrect batch control (18) 

E9.1 Initial temperature low 
E9.2 Initial temperature high 
E9.3 Too fast reactant addition relative to temperature 
E9.4 Incorrect cycle 
E9.5 Inadequate chemical moderation 
E9.6 Stewing 
E9.7 Other causes 
E10 Undesired catalysis (5) 

E10.1 Excess, or too rapid addition, of catalyst 
E10.2 More active catalyst 
E10.3 Catalyst maldistribution 
E10.4 Catalyst impurity 
E10.5 Catalyst left over from previous batches 
D2 Impurity reaction exotherm (21) 

D2.1 Water 
D2.2 Air 

D2.3 Materials left in reactor 
D2.4 Head transfer fluid 
D2.5 Other impurities 
D3 Heat of making dilution 

Case 2: C2 Overpressure by decomposition gas 
D4 Regular reactants decomposition (16) 

E2 Regular reactant unknown decomposition 
Ditto (side reaction) 

D5 Impurity reactant decomposition 
E4 Impurity decomposition 

Case 3: C3 Overpressure by water vapour 
D6 Water ingress and vaproization 

Case 4: C4 Overpressure by flammable gas 
(ignition of explosive mixture) 

D7 Air ingress and combustion (7) 

Case 5: C5 overpressure by other gas I vapour 
D8 High pressure gas ingress 

Miscellaneous cases 

XI Overpressure following unknown exotherm, where 
it is unclear if exotherm is a decomposition 
X2 Overpressure following operator attempts to 
recover from fault conditions 

Cases where cause is unknown 
Z1 Cause unknown 


2 

4 

3 
1 

4 
4 

2 


3 


11 


2 2 


7 1 

1 

7 3 

4 2 1 


12 


5 


B Summary 




Mode(%) 


All reactions d 

Nitration 

Sulphonation 

Polymerization d 

Regular reaction inadequate information 

3.5 (3.7) 

9.1 

0 

7.1 (8.6) 

Incorrect charging 

17.2(18.3) 

0 

13.8 

14.3(17.4) 

Inadequate cooling 

13.1(14.0) 

0 

6.9 

28.6(34.8) 

Excessive heating 

9.6(10.2) 

9.1 

17.2 

14.3 (17.4) 

Inadequate agitation 

10.1 (10.8) 

36.4 

13.8 

7.1 (8.6) 

Incorrect batch control 

9.1 (9.7) 

0 

13.8 

3.6 (4.4) 

Undesired catalysis 

2.5 (2.7) 

0 

0 

3.6 (4.4) 

Impurity reaction exotherm 

10.6(11.3) 

27.3 

3.4 

0 

Regular reactant unknown decomposition 

8.1 (8.6) 

18.2 

10.3 

0 

Water ingress and Vapourization 

0.5 (0.5) 

0 

3.4 

0 

Air ingress and combustion 

3.5 (3.7) 

0 

3.4 

0 
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Table 33.2 (continued) 


High pressure gas ingress 

0.5 (0.5) 

0 

0 

0 

Exotherm of unknown type 

3.5 (3.7) 

0 

10.3 

0 

Recovery from fault conditions 

2.0 (2.2) 

0 

6.9 

3.6 (4.4) 

Cause unknown 

6.1 

0 

0 

17.9 

Total 

No. of applicable incidents = 199 

100 

100 

100 

100 


a In one case cause is assigned to lack of cooling, although there had also been a change in the quality of the reactants. 

b In one case cause is assigned to a failure of a temperature controller, although a new more active catalyst was also in use. 

c In one case cause is assigned to gross overheating by steam, although it was also subsequently found that the reaction mixture exhibited 

instability. 

d Values in brackets are based on redistribution of ‘Causes unknown’ among known causes in proportion to relative frequency of latter. 


Table 33.3 Analysis of reactor overpressure: relief 
arrangements (Marrs et at. 1989) (Courtesy of the 
Institution of Chemical Engineers) 


Relief arrangement 

No. 

BD(s) 

11 

RV 

8 

RV + BD 

2 

RV, vent part closed 

1 

BD, recommend larger BD 

2 

RV recommend BD 

1 

BD, vessel open 

1 

NoBD 

4 

Recommend BD 

4 

No relief 

1 

Manual vent valve 

1 

Small vent(s) 

1 

Vent, recommend BD 

1 

Small holes 

1 

Vessel open 

15 

Vessel open, recommend BD 

1 

Unknown 

13 

Total 

68 

a BD, bursting disc; RY relief valve. 


Table 33.4 Analysis of reactor overpressure: 
overpressures (Marrs et al. 1989) (Courtesy of the 
Institution of Chemical Engineers) 

Overpressure incident 

No. 

Proportion 

(%) 

Vessel open, hazardous release 

18 a 

27.3 

Glasswork shattered, hazardous release 

16 b 

24.2 

Vessel ruptured, hazardous release 

19 

28.8 

Vessel ruptured 

1 

1.5 

Explosion 

5 

7.6 

Hazardous release 

5 

7.6 

Catchpot ruptured 

1 

1.5 

Catchpot fire 

1 

1.5 

Total 

66 

100.0 


a One case where overpressure was vented through two holes; one 
where manhole was opened; and one where operator disconnected 


b One case where reflux divider ruptured - glassware not specifically 
mentioned. 


Table 33.5 Analysis of reactor overpressure: relief 
system behaviour (Marrs et at. 1989) (Courtesy of the 
Institution of Chemical Engineers) 


Relief system behaviour 

No. 

Proportion (%) 

Relief operated; 

Glassware ruptured 

3 

6.3 

Vessel ruptured 

1 

2.1 

Explosion 

1 

2.1 

Catchpot ruptured 

1 

2.1 

Catchpot fire 

1 

2.1 

Hazardous release 

3 

6.3 

Relief fitted, but failed: 

Glassware ruptured 

M :l ' b 

6.3 

Vessel ruptured 

8 

16.7 

Explosion 

2 

4.2 

Glassware ruptured 

10 c 

20.8 

Vessel ruptured 

ll d 

22.9 

Explosion 

2 

4.2 

Hazardous release 

2 

4.2 

Total 

48 

100 


a One case where relief valve (RV) fitted, but vent part closed; and one 
where bursting disc (BD) fitted, but larger BD recommended. 
b One case where BD failed to rupture. 

c Five cases where relief arrangements unknown; three cases where 
BD recommended; and one where no relief was fitted. 

A Six cases where relief arrangements unknown; three cases where 
there was no BD; one case where BD recommended; and one where 


incidents involving dangerous substances and limit 
the consequences of such incidents to people and the 
environment. This replacement directive included new 
requirements relating to safety management system and 
emergency planning. Whereas the original Seveso Direc¬ 
tive focused on technical factors affecting safety, Seveso II 
focuses on management systems, which were determined 
to be responsible for the majority of incidents. 

OSHA 

The Occupational Safety and Health Administration 
(OSHA) was created by the 1970 OSH Act of the US Con¬ 
gress to establish consistent regulation with regard to 
industrial personnel and workplace conditions. In 1992, 
OSHA promulgated the Process Safety Management (PSM) 
of Highly Hazardous Chemicals — a program with 14 
elements including a process hazard analysis (PHA). 
See Appendix 31 for a discussion of OSHA and PSM. 
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Table 33.6 Analysis of reactor overpressure: 
comparison of rankings from case histories and from 
expert judgement field study (Marrs et at., 1989) 
(Courtesy of the Institution of Chemical Engineers) 



Case 

histories 

% Rank 

Field 

study 

Rank 

A Incident modes 

Unknown exotherm/decomposition 

15.1 

2 

6 

Incorrect charging 

17.2 

1 

1 

Inadequate cooling 

13.1 

3 

3 

Excessive heating 

9.6 

6 

4 

Incorrect agitation 

10.1 

5 

5 

Inadequate batch control 

9.1 

7 

2 

Undesired catalyst 

2.5 

8 

8 

Exotherm from impurity 

10.6 

4 

7 

B Incorrect charging 

Excess of reactant 

29.4 

1 

1 

Deficiency of reactant 

26.5 

2 

3 

Too fast addition of reactant 

23.5 

3 

2 

Modification of reactant 

11.8 

4 

4 

Incorrect order of reactant addition 

5.9 

5 

5 

C Inadequate cooling 

Coolant source/power failure 

0 

5 

5 

Coolant pump set failure 

3.8 

4 

4 

Coolant turned off 

11.5 

r,= 1 

2 

Automatic control failure 

11.5 

ml 

1 

Condenser fault 

11.5 

= 1 

3 

D Excessive heating 

Initial overheating 

15.8 

si 

2 

Heating/cooling changeover fault 

15.8 

= 1 

3 

Undesired heating 

10.5 

= 3 

5 

Automatic control failure 

10.5 

A|3 

4 

Manual control failure 

10.5 

«*13 

1 


E Incorrect batch control 


Initial temperature too low 

11.1 

4 3 

Initial temperature too high 

0 

5 5 

Too fast addition of reactant 

22.2 

= 1 1 

relative to temperature 
Incorrect cycle 

16.6 

3 4 

Excessive holding 

22.2 

= 1 2 


EPA 

The Environmental Protection Agency (EPA) was created 
by the Clean Air Act of 1970 of the US Congress to reduce 
exposures of hazardous substances. In 1996, the EPA 
promulgated the Risk Management Program (RMP) for 
Chemical Accident Release Prevention - a program with 
11 elements, including a hazard evaluation (similar to the 
OSHA PHA) and a risk assessment for worst-case and alter¬ 
native case releases of toxic substances. See Appendix 32 
for a discussion of EPA and RMP. 


TCPA 

According to the US CSHIB report issued in 2002, more 
than 50% of the 167 reactivity-related incidents analysed 
were not covered by existing OSHA or EPA regulations. 

In response to concern about reactivity incidents, 
the New Jersey Department of Environmental Protection 
announced in August 2003 that reactive chemicals were 
added to the list of extraordinarily hazardous substances 
(EHS) in the New Jersey Toxic Catastrophe Prevention Act 
(TCPA) rules. This was the first regulatory rule in the United 
States to require assessment of reactive chemical hazards 
compared to assessment of process hazards required by 
the OSHA PSM in 1992 and by the EPA RMP rule in 1996. 
When announced, the list of EHS with threshold quantities 
included 30 chemicals and 43 chemical groups. 

33.1.3 Overall strategy 
Overall strategy 

A strategy for safe reactor design, given in the IChemE 
Guide, largely follows N. Gibson, Rogers and Wright (1987), 
who describe the strategy developed at ICI, as follows: 

(1) definition of the process conditions and plant design; 

(2) characterization of the chemical reaction and its 
hazards; 

(3) selection and specification of safety measures; 

(4) implementation and maintenance of safety measures. 

The stages in and strategies for the assessment and control 
of hazards of chemical reactors are shown in Figures 33.1 
and 33.2, respectively. The characterization of the chemical 
reaction and its hazards involves: 

(1) hazard evaluation of the reaction; 

(2) characterization of reaction for scale-up; 

and safety aspects of the design of the reactor include: 

(3) inherently safer design; 

(4) control and trip systems; 

(5) emergency safety measures; 

(6) overpressure relief. 

The strategy will be influenced by the types of reaction 
operated in the company, by evidence from previous inci¬ 
dents and by the options available for safety measures. 


33.2 Technical 

33.2.1 Strategies for identifying and characterizing 

reactive hazards 

Chemical reactivity overview 

Definition 

The US CSHIB has proposed the following definition of a 
reactive hazard: ‘A sudden event involving an uncontrolled 
chemical reaction with significant increases in temperature, 
pressure, or gas evolution that has the potential to, or has 
caused serious harm to people, property or the environment’. 

Reactive hazards have the potential to cause harm to 
people or loss of life along with extensive damage to the 
surroundings due to the uncontrolled release of energy. 
A common pathway involves overpressurization of equip¬ 
ment, either through buildup of pressure or through 
weakening of the equipment structural integrity, leading 
to possible generation of a blast wave or generation of 
a flammable vapour cloud that can explode upon finding 
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(1) Initial chemistry 


(a) Characterization of 
materials/process 

(b) Suitability of production 


(2) Pilot plant 


(a) Chemical reaction hazards 

(b) Influence of plant on 
hazard 

(c) Definition of safe 
procedures 


(3) Full-scale production 


(a) Re-evaluation of chemical 
reaction hazards 

(b) Effect of expected 
variations in process 
conditions 

(c) Hazards from plant 
operations 

(d) Definition of safe 
procedures 

(e) Interaction of technical 
safety with engineering, 
production, economic and 
commercial aspects of 
process 


Figure 33.1 Stages in control of hazards of chemical 
reactions (N. Gibson, Rogers and Wright, 1987) 
(Courtesy of the Institution of Chemical Engineers) 


an ignition source. For a detailed assessment of reactive 
hazards risk, an understanding of reaction pathway, stoi¬ 
chiometry, energetics, gas generation and rates is needed. 

Strategy 

Overall evaluation strategy The strategy for reaction 
hazard evaluation described in the IChemE Guide involves 
the following: 

(1) desk screening; 

(2) explosibility tests; 

(3) preliminary screening tests; 

(4) characterization of normal reaction; 

(5) characterization of runaway reaction. 

These are now discussed under the categories of 

(1) desk screening; 

(2) preliminary screening tests; 

(3) detailed tests. 

Calculational methods are also included as well as a 
synopsis of various test schemes. 

Principal factors A review of the factors that should be 
taken into account in the reaction assessment has been 
given in the two ABPI Guidelines. The components covered 
should include: the reactants, the reaction intermediates 
(whether isolated or not) and the reaction products; the 
by-products; the solvent; additives; the still residues; and 
the wastes and effluents. 

The review should consider the effect of contaminants 
on the stability of components and on the reaction rate. 
Contaminants may include: impurities in the reactants; 



Figure 33.2 Strategy for control of hazards of chemical reactions (N. Gibson, Rogers and Wright, 1987) 
(Courtesy of the Institution of Chemical Engineers) 
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materials of construction; corrosion products; water, 
steam, refrigerant and other heat transfer fluids; and 
materials from elsewhere. Other factors mentioned include: 

(1) incorrect use of catalysts; 

(2) addition of extra quantities of reagents; 

(3) sequence of addition or omission of reagents; 

(4) addition of wrong reagent; 

(5) drift of pH and sensitivity to buffering in normal or 
abnormal operation; 

(6) effect of process errors on reaction conditions. 

Categorizing reactivity types 
Stability vs reactivity with other species 
Many compounds will undergo degradation or decomposi¬ 
tion when subjected to elevated temperature, mechanical 
impact or other disturbances. Some compounds can poly¬ 
merize or re-arrange internally. Most compounds will also 
react when placed in contact with certain other species. 

According to the CSHIB report released in 2002,10% of 
the 167 reactivity-related incidents analysed involved 
impact- or thermally-sensitive materials. Another 35% 
were associated with runaway reactions. About 36% of the 
incidents involved chemical incompatibility. 

Tests for chemical reaction Reactivity information app¬ 
licable to individual substances should be obtained. 
Somewhat similar information is required for the evalua¬ 
tion of the hazards of conducting a chemical reaction in a 
reactor. It is still necessary to determine the behaviour of 
the individual components - reactant, intermediates and 
products - but in addition it is necessary to examine the 
reaction as a whole, including not only the main, desired 
reaction, but also secondary reactions. In the methods 
described below, it should be recognized when the methods 
are being applied to address the stability or reactivity in 
combination with other species. 

Intended vs unintended 

It is useful to distinguish between ‘intended’ and ‘unin¬ 
tended’ reactions or alternatively ‘normal’ and ‘abnormal’ 
reactions. Intended reactions are clearly those reactions 
targeted in a process. Unintended reactions are the side 
reactions that are typically avoided. Usually, there are no 
intended reactions in blending, distribution, transporta¬ 
tion and storage operations. An intended reaction occur¬ 
ring outside of its associated equipment can in that context 
be considered as unintended. More-extensive stoichio¬ 
metric and thermokinetic information is generally avail¬ 
able for targeted reactions. Moreover, the strategy for 
managing the risk of reactive hazards can be profoundly 
affected by whether a reaction of interest is intended or 
unintended. 

Additional factors generally considered when designing 
equipment for intended reactions include: heat transfer, 
mixing limitations, phase separation, inlet and outlet flows 
(properties and rates), and process and relief venting 
capacity. 

Reaction phase 

Another characteristic important for understanding 
reaction behaviour and for determining the appropriate 
approach(es) for addressing the reactivity is the phase or 
phases in which the reaction occurs. Reactions commonly 
take place or initiate in the liquid phase, but some, such as 


combustion, predominate in the gas-phase. The 
decomposition of polymers upon heating or of explosives 
once triggered are examples of solid-phase reactions. Many 
reactions, such as those that are facilitated by hetero¬ 
geneous catalysts, are surface reactions. The reactants may 
reside primarily in the liquid phase or can even be gas- 
phase (such as in methanation), but the species must travel 
to and adsorb on the surface to undergo reaction. Finally, 
the mere adsorption of certain species on solid surface 
can potentially evolve enough heat to cause significant 
temperature excursions and further reactivity. 

Vapour vs gassy vs hybrid 

The ability of a reaction to cause overpressurization of 
equipment depends heavily on the type of gas or vapour 
generated. Generally, a ‘vapour’ refers to a non-condensed 
species that is in thermodynamic equilibrium with the cor¬ 
responding species in a condensed phase (usually a liquid, 
but possibly a solid). A ‘gas’ describes a non-condensable 
species that is not in thermodynamic equilibrium. If a 
vapour-liquid system is heated, the vapour pressure of the 
species will rise and the pressure of the system is dictated 
by the temperature and composition. A latent heat is asso¬ 
ciated with generation of the vapour. Removal of vapour 
from the system (e.g. by venting) will cause heat (mostly 
latent) to be discharged. In a ‘gassy’ system, the pressure 
is determined by the amount of non-condensable gas gen¬ 
erated (a function of reaction stoichiometry, rate and time) 
and removal of such gas only takes away sensible heat. The 
term ‘hybrid’, is applied to systems which exhibit both 
vapour and gassy features (e.g. when both vapour and 
gassy species are present, such as for hydrogen peroxide in 
water decomposing to yield non-condensable oxygen). 

Characterizing reactions 

It is usual to classify unit processes on the basis of 
the reaction involved and, as described in Section 11.14 of 
Chapter 11, these unit processes have certain generic 
characteristics. A classification of unit processes in terms 
of their exothermicity has been given by Hoffmann (1985). 
He classes halogenation, oxidation, organometallic reac¬ 
tions and some polymerizations as highly exothermic; 
nitration as exothermic; amination, sulfonation, conden¬ 
sation and some hydrogenations as moderately exothermic; 
and alkylation, hydrolysis and some hydrogenation as 
mildly exothermic. Thermodynamic schemes such as 
CHETAH (CHEmical Thermodynamics And energy 
Hazard evaluation) may be used to evaluate the thermo¬ 
dynamic characteristics of the reaction. 

The substances involved in the reaction, whether as 
reactants, intermediates or products should be screened 
for explosibility. Basic methods, which have been descri¬ 
bed in Chapter 8, are examination of reactive chemical 
groups, computation of the oxygen balance and experi¬ 
mental explosibility testing. 

To characterize a chemical reaction adequately, however, 
it is desirable not only to obtain a qualitative under¬ 
standing of the behaviour of the reaction, but also to obtain 
quantitative data on various parameters needed for the 
specification of the process. It is expected that companies 
and agencies carrying out intended chemistry will have 
already acquired sufficient information pertaining to that 
chemistry to enable appropriate safeguarding. However, in 
the event that such information is absent, the following 





33/10 REACTIVE CHEMICALS 


approaches can be applied as well to intended chemistry as 
to unintended chemistry. 

Desk screening 

Initial desk screening will provide information on the 
physical and chemical properties and the reactivity of the 
chemical. Where specific data are lacking, features such 
as group structure, thermodynamic data, oxygen balance 
and reactivity of analogous substances provide pointers. 
Discussions of this aspect are given by Snyder (1965) and 
by the ABPI (1981,1989). 

The starting point should always be a thorough litera¬ 
ture search to determine the data already available on the 
properties of the chemical. For intended reactions (and 
some unintended reactions), an organization’s internal, 
proprietary literature may contain a wealth of information 
pertaining to the stoichiometry, thermodynamics and 
kinetics. This information might be specific to processing 
conditions, which limits applicability in safeguarding, 
but might also feature unique effects such as behaviour in 
the presence of other process species or reactivity with 
particular catalysts. 

If gaps remain in the knowledge base for reactivity, 
a search of the open literature should be pursued. For 
established commercial reactions, it is often helpful to 
consult the original papers. In certain journals, papers on 
chemical reactions regularly include information on pote¬ 
ntial hazards. References frequently reviewed also include: 
Dangerous Properties of Industrial Materials (Sax, 1957-, 
1975-, 2000), Encyclopaedia of Chemical Technology (Kirk 
and Othmer, 1963-, 1978-, 1991-) and Handbook of Reac¬ 
tive Chemical Hazards (Bretherick, 1999); NFPA 49 and 
491M; FM data sheets 7-19 and 7-23; and CMA (MCA) 
case histories. Frequently, published texts and journal 
articles can provide insight regarding the chemistry and 
thermokinetics. Material Safety Data Sheets (MSDSs) 
should also be consulted for qualitative and limited quan¬ 
titative reactivity information. 

It is instructive to observe that 90% of the US reactiv¬ 
ity incidents analysed by the CSHIB involved reactive 
hazards documented in literature available to the chemical 
processing industry. 

Thermal stability Identification of reactivity of compo¬ 
nents should be based on a coherent strategy. This will 
normally involve ‘desk’ screening, preliminary tests and 
substantial tests. If an exotherm is identified, tests may be 
done to characterize it. Other aspects may also need to be 
investigated such as the extent of gas evolution and the 
behaviour of the substance under conditions of processing 
such as drying. 

Desk screening and explosibility tests 

NFPA classification A general method of categorizing 
reactivity and instability of individual species is provided 
in NFPA: 1994 49 Hazardous Chemicals Data, which 
gives materials a Chemical Reactivity Rating as shown in 
Table 33.7. The code lists the rating for a large number of 
chemicals. 

To demonstrate the importance of examining all likely 
reactivity scenarios and not depending solely on a screen¬ 
ing approach to identify reactive hazards, note that only 
10 % of the 167 reactivity incidents examined by the CSHIB 
involved chemicals rated ‘3’ or ‘4’ in the NFPA system; 60 % 
were not rated at all or received a ‘0’ rating. 


Table 33.7 Degrees of reactivity (instability) hazard as 
defined in NFPA: 1994 49 (Reproduced with permission 
from NFPA 49 Hazardous Chemicals Data, Copyright, 
1994, National Fire Protection Association, Batterymarch 
Park, Quincy, MA 02269, USA) 


Degree Description 

4 Materials that in themselves are readily capable 
of detonation or explosive decomposition or 
explosive reaction at normal temperatures and 
pressures. This degree usually includes materials 
that are sensitive to localized thermal or 
mechanical shock at normal temperatures and 
pressures 

3 Materials that in themselves are capable of 
detonation or explosive decomposition or 
explosive reaction, but that require a strong 
initiating source or that must be heated under 
confinement before initiation. This degree usually 
includes: materials that are sensitive to thermal or 
mechanical shock at elevated temperatures and 
pressures; materials that react explosively with 
water without requiring heat or confinement 

2 Materials that readily undergo violent chemical 

change at elevated temperatures and pressures. 
This degree usually includes: materials that 
exhibit an exotherm at temperatures less than 
or equal to 150° C when tested by differential 
scanning calorimetry; materials that may react 
violently with water or form potentially explosive 
mixtures with water 

1 Materials that in themselves are normally stable, 
but that can become unstable at elevated 
temperatures and pressure. This degree usually 
includes: materials that change or decompose on 
exposure to air, light or moisture; materials that 
exhibit an exotherm at temperatures greater than 
150°C but less than or equal to 300°C, when tested 
by differential scanning calorimetry 

0 Materials that in themselves are normally stable, 
even under fire conditions. This degree usually 
includes: materials that do not react with water; 
materials that exhibit an exotherm at 
temperatures greater than 300°C but <500°C, 
when tested by differential scanning calorimetry; 
materials that do not exhibit an exotherm at 
temperatures <500°C when tested by differential 
scanning calorimetry 


General Reactivity of Chemical Structures 
and Constituents 

Certain groups (shown in Figure 33.3) (Kohlbrand, 1985) 
are known by experience to be unstable or explosive. 

Chemical sensitivity to decomposition 
(reactive conditions) 

Instability of materials It is important to know whether 
a chemical can be safely handled both in process and in 
storage and transport. The problem has two main aspects. 
One is the hazard of instability of a single component such 
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as a reactant, intermediate or product when undergoing 
physical processing on the plant and when stored and 
transported. The other aspect is the hazard of instability of 
the reaction mass in a chemical reactor. These two aspects 
of instability are dealt with here and in Chapter 11, respec¬ 
tively. This section deals with thermal instability and with 
explosibility. 

Accounts of the evaluation of instability of materials 
include those given in Guidance Notes on Chemical Reaction 
Hazard Analysis by the Association of the British Pharma¬ 
ceutical Industry (ABPI) (1981) and its successor Guidelines 
for Chemical Reaction Hazard Evaluation ABPI (1989) and 
by Coates and Riddell (1981a), N. Gibson, Harper and 
Rogers (1985) and Cronin, Nolan and Barton (1987a). 

Oxygen balance A substance may release energy by 
combustion in air or by decomposition; the main hazard 
is decomposition. Rapid energy release occurs if the 


constitution of a substance is such that its carbon and 
hydrogen are able to react with its own oxygen without 
needing to obtain oxygen from the surrounding air. If there 
is just enough oxygen to give a stoichiometric reaction of all 
the carbon to carbon dioxide and hydrogen to water, there 
is said to be a zero oxygen balance. The more reactive 
substances, such as explosives, typically contain enough 
oxygen to give such decomposition. 

The oxygen balance (OB) is an important indicator of 
stability for some classes of explosive compounds contain¬ 
ing nitrogen. For an organic compound of formula C x H y O z 
it has been defined by Lothrop and Handrick (1949) as: 

OB sk -1600 (2x + y/2 - z)/M [33.2.1] 

where M is the molecular weight. Thus, an unstable, or 
explosive material having perfect balance to yield carbon 
dioxide and water has a zero OB value - one lacking 
sufficient oxygen has a negative OB value, and one 
containing excess oxygen has a positive OB value. 

In principle, therefore, the ideal OB for a substance 
suitable as an explosive would appear to be zero. Most 
explosives actually have a negative OB, but Lothrop and 
Handrick did find that the power of explosives increases as 
the OB increases and approaches a value of zero. Values of 
the oxygen balance for some materials of recognized 
instability are nitrobenzene (—163), dinitro-toluene (-114) 
and glycerol trinitrate (+3.5). 

Chemical incompatibility with other materials The 
incompatibility of chemicals brought together can pose a sig¬ 
nificant reactive hazard. Examples include acids combined 
with bases, pyrophoric materials plus air, and water-sensitive 
chemicals plus water. It is worth noting that an ‘incompat¬ 
ibility’ is deemed to be more severe in potential consequence 
than the lack of ‘compatibility’ between substances. 

Evaluating potential chemistry between components in 
a process can be a daunting task given that the number of 
combinations for a moderate number of species can quickly 
grow into the thousands. Such an evaluation can require 
considerable resources for reviewing available information 
or testing, but tools have been made available to assist in 
this endeavour. A publication from the US CoastGuard (*) 
and one from the US Environmental Protection Agency 
(EPA 1980) indicate the presence of potential incompat¬ 
ibilities based on the types of chemical functional groups in 
the compounds. The US National Oceanic and Atmospheric 
Administration (NOAA) has posted on its website a pro¬ 
gram called the Chemical Reactivity Worksheet, which 
incorporates the EPA methodology and some additional 
incompatibility guidelines to facilitate chemical incompat¬ 
ibility assessment. 

When exploring possible chemical interactions between 
materials, it is also worthwhile to consider compounds 
arising from inadvertent forward flow or backflow from 
other parts of a process or other units, additives, catalysts, 
utility stream components, contaminants, materials of 
construction, cleaning agents and species common in the 
environment (e.g. air, water, pollutants). 


‘ U.S. Coast Guard Academy, ‘The Evaluation of the Test Procedure 
for Hazardous Binary Combinations of Materials in Marine 
Transportation’, US Department of Commerce, National Technical 
Information Service, Aug. 1974, AD-A007 915, Report No. CG-D- 
85-75. 
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Related previous incidents Knowledge and analysis of 
previous incidents is extremely valuable to help identify 
reactivity hazards including those caused by incompat¬ 
ibilities of a process with materials that the process could 
easily contact, as in the following cases: 

Concepts Science and Nissin Chemical: The 1999 
Concept Sciences incident with five fatalities in Allentown, 
Pennsylvania and the 2000 Nissin Chemical incident with 
four fatalities in Japan involving explosive decomposition 
of hydroxylamine. In these incidents, the incompatibility of 
hydroxylamine/water solutions and iron and oxides of iron 
is a suspected factor. 

Napp Technology: The 1994 Napp Technology incident 
with five fatalities in Lodi, New Jersey in which an uncon¬ 
trolled reaction resulted from the incompatibility of water 
with the process mixture that included the spontaneously 
combustible sodium hydrosulfite. 

Bhopal: The 1984 Union Carbide incident in Bhopal, 
India in which the incompatibility of methyl isocyanate 
with water led to the release of toxic cyanide gas and 
thousands of fatalities. 

Screening and detailed computational methods using 
classical and QM models and correlations 
Reactive Hazards Index An attempt has been made by 
Stull (1970) to find some theoretical basis for reactivity 
With unstable materials, there is relatively little difference 
between the heat of decomposition A H d and the heat 
of combustion AH 0 under stoichiometric conditions, or 
between the adiabatic decomposition and combustion 
temperatures. Thus, Stull gives an empirical correlation 
between the difference between these two heats, 
AH 0 - A H d , or between the temperatures and the NFPA 
Chemical Reactivity Rating. 

In a refinement of this work, Stull (1973) has introduced 
kinetic as well as equilibrium considerations and has 
derived an empirical Reaction Hazard Index (RHI): 


[33.2.2] 


where E a is the activation energy (kcal/mol), and T d is 
the adiabatic decomposition temperature (K). The RHI 
correlates broadly with the Chemical Reactivity Index. 


and/or decomposition reactions. These include those of 
Cruise (1964), of the National Aeronautics and Space 
Administration (NASA) (Gordon and McBride, 1971,1976) 
and of the American Society for Testing of Materials 
(ASTM) (E.J. Davis and Ake, 1973; Treweek, Claydon and 
Seaton, 1973). These programs can then be used to deter¬ 
mine the energy hazard potential of materials. 

The ASTM program, named CHETAH, calculates four 
quantities, which may be taken as criteria of energy hazard 
potential (Treweek, Claydon and Seaton, 1973): 

(1) heat of decomposition Aff d ; 

(2) heat of combustion, A H 0 - heat of decomposition, Aff d ; 

(3) oxygen balance; 

(4) y criterion. 

They criterion is given by: 

y=1 fl(AW 

MW = molecular weight 
N = number of atoms in the molecule 
The energy hazard potentials are related to criteria (1)—(4) 
as shown in Table 33.8 (see Figure 33.4). These criteria 
correlate reasonably well with data on shock sensitivity. 
An account of the updating of the CHETAH program 
has been given by Frurip, Freedman and Hertel, (1989). 
CHETAH is now available as an interactive PC program. 
It includes an interpreter subroutine that uses pattern 



Determination of energy hazard potentials There are a 
number of thermodynamic schemes and corresponding 
computer programs, which have been developed to cal¬ 
culate the equilibrium products and heats of combustion 


Figure 33.4 Energy hazard potential as a function of the 
heats of combustion and decomposition (after Traweek, 
Claydon and Seaton, 1973) (Courtesy of the American 
Institute of Chemical Engineers) 


Table 33.8 Energy hazard potential criteria in CHETAH (after Treweek, Claydon 
and Seaton, 1973) 


Criterion 

Energy hazard potential 

High 

Low 

Medium 

1 

A H d > -0.3 

-0.7 < A H d < -0.3 

A H d < -0.7 

2 

See Figure 33.4 



3 

OB > 240 

120 < OB < 240 

-80 < OB < 120 


OB < -160 

-160 < OB < -80 


4 

y <30 

30<y<110 

y>110 
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recognition techniques to combine the four hazard criteria 
into an overall hazard rating and a data bank. 

Molecular group contribution methods The principle of a 
molecular group contribution method is that molecular 
properties are the result of added contributions of individu¬ 
al atoms. Benson (1976) demonstrated that a wide variety 
of thermodynamic properties of a molecule could be esti¬ 
mated from the sum of contributions of the bonds in the 
molecule with corrections for the influences of side chains. 

The CHETAH program (version 7.2) by ASTM (1998) 
applies a molecular group contribution method for ther¬ 
modynamic property estimations. A wide range of gaseous 
thermodynamic properties can thereby be computed, such 
as heat capacity, C p , entropy, S, enthalpy of formation, A H ir 
Gibbs free energy of formation, AGf, enthalpy of reaction, 
A H„ entropy of reaction, AS r and Gibbs free energy of 
reaction, AG r Molecular group contribution methods are 
limited, however, to available thermodynamic data for 
molecular groups (Irikura and Frurip, 1996). 

Quantum chemistry methods Quantum chemistry meth¬ 
ods are based on molecular quantum theory in which the 
motion and distribution of electrons are represented by 
electron probability distributions called molecular orbitals 
(Bruneton etal, 1997). Using these methods, the structure, 
energy and properties of a molecule or an assembly of 
molecules can be calculated to varying degrees of accuracy 
depending on the molecules and the methods employed. 
Numerical techniques and software programs have been 
developed to perform the quantum chemistry calculations. 

The fundamental quantum chemistry (or ab initio) 
methods are coupled with statistical mechanics to estimate 
system thermodynamic properties of large numbers of 
molecules or atoms. These properties include the enthalpy 
and entropy of formation of the reactants and products, 
enthalpy and entropy of the reaction, Gibbs free energy of 
the ideal gas reaction and Gibbs free energy of mixing of 
the reaction. There exists no single quantum method that 
yields satisfactory results for all chemical systems, and the 
usefulness of the various methods depends on the system 
size and type, the property that is calculated and calcula¬ 
tion costs. Therefore, the ab initio methods require more 
experience, compared to group contribution or other clas¬ 
sical methods, for selection of appropriate models and 
assessment of the results. 

With the quantum methods a molecular electronic 
orbital,0,-, is generally represented as a linear combination 
of a finite number of basis functions, xo, which are similar 
to hydrogen atom wavefunctions, with each function mul¬ 
tiplied by a weight factor, c ia . 

Each orbital will accommodate up to two electrons with 
opposite spins. Basis function sets used with each level of 
theory can be minimal with one basis function per orbital of 
an atom within the molecule or improved in accuracy by the 
inclusion of multiple functions of the appropriate type per 
orbital. The total wavef unction of all orbitals for a molecule is 
represented by a linear combination of Slater determinants 
(SD) constructed from the molecular orbital functions. The 
Hartree-Fock model uses the simplest total wave function 
with a single SD, which approximates the average static 


interactions among the electrons. Inclusion of instanta¬ 
neous electron-electron interactions, or electron correla¬ 
tion, requires two or more SDs with models of increasing 
complexity, computational expense and accuracy. With a 
given model, accuracy can be enhanced with the use of 
increasingly large sets of selected basis functions. 

Among the most useful quantum methods for engineer¬ 
ing calculations are Density Functional Theory (DFT), 
which is a cost-effective approach that explicitly includes 
electron correlation for a wide range of molecule sizes, such 
as B3LYP, the Moller-Plesset perturbative methods at 
various orders, such as the second order MP2 or third order 
MP3, highly accurate (energy errors to ~ 1 kcal/mole) 
composite methods that include electron correlation such 
as the Gaussian-n (Gl, G2, G3) methods and the complete 
basis set (CBS) series, and the inexpensive, but generally 
much less accurate, semi-empirical methods, such as AMI 
and PM3 (Young, 2001; Morokuma, 2002). Quantum calcu¬ 
lations using these various methods are performed on 
commercial software, such as the Gaussian 98 and Gaus¬ 
sian 03 (Frisch et al. 1998) software modules available for 
supercomputers, servers and personal computers. 

For some thermochemical properties, such as heats of 
formation calculations using with isodesmic reactions, in 
which the numbers and configurations of electrons are 
balanced as well as possible on both sides of the reaction, 
some or much of the electron correlation error cancels. This 
is not the case for chemical activation energies on which the 
reaction rates depend exponentially, so even small errors in 
calculated activation energies will often yield unacceptably 
large errors, especially for the lower level models, in the 
calculated reaction rate constants. However, higher level 
quantum models, such as CCSD(T), coupled cluster with 
single and double excitation and perturbative triple exci¬ 
tation, with a large set of basis functions can yield energies, 
such as heats of reactions, that rival or even exceed 
experimental accuracy (Truhlar, 2001). A discussion of 
computational accuracy and cost for many approaches and 
models is provided by Cramer (2002, p. 220). 

Once the thermodynamic properties are predicted or 
estimated for each reactant, intermediate and product in 
the suggested reaction pathways, enthalpy and Gibbs free 
energy calculations are performed to identify plausible 
stoichiometries to follow initial pathway scenarios. Plau¬ 
sible stoichiometries are reactions that are thermo¬ 
dynamically feasible, for which the corresponding Gibbs 
free energy change, AG r < 0. 

The Gibbs free energy of reaction at constant tempera- 

AG r = A H r - TAS r 
The enthalpy of reaction is: 


AH T = Affj dg - v,- AHyapj + AH? ix + AHf ress 


A ff r ldg : enthalpy of reaction calculated in the ideal gas 
phase; 

AH vapi : enthalpy of vaporization or sublimation for N 
condensed species; 

A H?"*: mixing and solvent enthalpic effects. 

Aff r press : pressure enthalpic effects; 
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The entropy of reaction is: 

A Sr = AS‘ dg - Vi + AS? 1 * + ASj? ress 

AS; dg : entropy of reaction calculated in the ideal gas 
phase; 

AS r : mixing and solvent entropic effects; 

Agpress; p ressure entropic effects. 

Therefore, the Gibbs free energy change on reaction can be 
defined by the following equation: 

AG r = AGj dg + A Gf x + AG*’ ress 

Assumptions are often used to simplify these relationships. 
The pressure effects on the enthalpy and entropy of reac¬ 
tion are usually insignificant compared to the other con¬ 
tributions and can then be neglected. The solvent and 
mixture interaction enthalpy and entropy contributions are 
usually small when compared to the enthalpy and entropy 
of the reaction. It is generally only when the solvent has 
particularly strong affinities with the solutes, such as polar 
interactions or formation of hydrogen bonds, that these 
terms are significant (Bruneton etal., 1998). 

Screening for significant reactions to assess potential 
hazards, thermodynamically non-feasible (AG r > 0) and 
reaction pathways with low A H r or A H r > 0 and low APare 
generally excluded and the remaining ones are considered 
for further evaluations. 

High exothermic A H r is considered an indication of a 
potential hazard, but such an indication is not sufficient to 
assess the potential of a reactivity hazard. A more thorough 
evaluation should be based also on A P and on the kinetics 
of the reaction pathways (i.e. the reaction rates). For 
confirmation and to provide more information about the 
system, the activation energies and rate constants are 
measured experimentally and also computed using quan¬ 
tum models within the context of transition state theory. 

Transition state theory methods Chemical reaction rates 
calculated from classical molecular dynamics are often 
unsatisfactory, but exact quantum calculations are prac¬ 
tical only for systems with a small number of accessible 
quantum states. Transition State Theory (TST), however, 
in which a transition state, which is formed from the ener¬ 
getically activated reactants and intermediate along the 
reaction coordinate between reactants and products, is 
based not on the details of molecular motions and collisions 
but on their statistical properties using the principles 
of statistical mechanics. Abimolecular reaction with reac¬ 
tants A andfi, transition state [AB] f in equilibrium with the 
reactants, and products C can be stated 

A —//<-* AB'J -C 

At present, this theory combines classical and quantum 
principles employing simplifying assumptions including a 
thermal, quasi-equilibrium of the transition state with the 
reactants (Garrett and Truhlar, 1984). Another assumption 
of the original approach by Eyring (1935) and Evans and 
Polanyi (1935) is that motion of the reacting species along 
the reaction coordinate can be separated from other 
dynamics and treated as a classical translation. 


Even though TST is not a complete quantum model, 
quantum effects are approximated by the use of quantum 
partition functions for vibrational motions and a quantum 
tunneling and reflection correction or transmission coeffi¬ 
cient, k, for motion along the reaction coordinate (Cramer, 
2002, p. 486). For a bimolecular reaction in the gas phase 
with species A and B, the TST absolute rate constant is 

*tst = K{T ) k jl®e-Wk™ 
h QaQb 



where k is the transmission coefficient, k B is the Boltzmann 
constant, h is the Planck constant, T is the absolute tem¬ 
perature, E 0 is the energy of lowest level (zero point energy) 
of the transition state relative to the energy of the lowest 
level of the reactants, Q A , Q B are the equilibrium partition 
functions per unit volume for the reactants A and B, is 
the transition state partition function minus the partition 
function for motion along the reaction coordinate, and K} is 
the equilibrium constant for the reactants and transition 
state species in molar concentration units. 

Qa, Qb are calculated from statistical mechanics using 
spectroscopic data to obtain moments of inertia, vibra¬ 
tional frequencies and electronic states. is calculated 
using quantum mechanics or semi-empirical models, to 
obtain moments of inertia and vibrational frequencies for 
the calculated transition state geometry. For the bimole¬ 
cular reaction, the reaction rate is 

with A and B in molar concentration units. 

For a macroscopic system with the number of particles 
the order of Avogadro’s number, the distribution of mole¬ 
cular energies at a particular temperature are assumed to 
consistent with the Boltzmann distribution in which all 
molecular states at the same energy are equally probable. 
The canonical TSTrate constant k(T) is a Boltzmann aver¬ 
age over a microcanonical TST rate constant k(E) at a given 
energy, (Garrett and Truhlar, 1979). 

K(T) = j X k(E)P(E) dE 

where P(E) is the Boltzmann distribution of energies. 
This approach is employed in the highly successful Rice- 
Ramsperger-Kassel-Marcus (RRKM) theory to represent 
the behaviour of unimolecular reactions (Forst, 1973). 

Because theTSTequation is based on the highest potential 
energy along the reaction coordinate and not the free energy 
of the transition state structure, it does not account for some 
trajectories that recross the transition state and reduce the 
actual rate constant. Variational Transition State Theory 
(VTST) corrects this deficiency by adjusting the transition 
state along the reaction coordinate, s, to maximize the 
transition state free energy, minimize the recrossings and, 
therefore, minimize the TST rate constant (Truhlar and 
Garrett, 1980; Hase, 1983; Allison and Truhlar, 1989) 


* vtst (T, S ) = min 

s h QaQb 
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The statistical approach and approximations make possi¬ 
ble practical computations, andTSTand VTST have proved 
to be highly successful in representing with sufficient 
accuracy a wide range of chemical behaviour. As a result, 
this theory has become more commonly used for engineer¬ 
ing reaction rate predictions. 

Representing the TST expression in thermodynamic 
terms and using the equilibrium assumption of reactants 
with the transition state, AG ot = -RTlnKl, and the TST 
rate constant can be expressed equivalently as 

lTST _ „ ^bT „_AG> t/gT 

H -K—e 

where AG ot is the standard free energy of activation, and the 
superscript o refers to the standard states of the transition 
state and reactants. Expressing AG°t in terms of standard 
enthalpy and entropy changes, AG°t = Aff°t - TAS°\ the 
TST rate constant becomes 

lTST _ 

R -K-j-e e 

which can be related to the traditional Arrhenius rate con¬ 
stant, 

k A =Ae~ E '-/ RT 

where E a , the experimental activation energy (or Arrhenius 
activation energy) is the average difference between 
the average energy of the reacting molecules and the 
average energy of all the reactant molecules (Fowler and 
Guggenheim, 1939). 

For a process at constant pressure, the standard enthalpy 
and thermodynamic energy are related by Aff” 1 = AE 0 * 
— PMAV°\ where AF^ is the standard volume of activa¬ 
tion. For a unimolecular reaction AF^ is zero and for reac¬ 
tions in solution, AF't is close to zero, so, E a = AH°^ + RT, 
and the TST rate constant is 

£TST = ]; kBT 1+AS*/S) Q—Ea/RT 


Therefore, the Arrhenius pre-exponential factor can be 
expressed as 

A = 


For gas phase reactions other than unimolecular and ass¬ 
uming the ideal gas model, PAV* 1 = An’RT, the Arrhenius 
activation energy is, E ? = AH ° + + (1 - A rA)RT and the 
Arrhenius pre-exponential factor is 

A = K ex p(i_A»t)^«£-^/*> 

Such expressions are used to relate the molecular VTST 
or TST model to the macroscopic Arrhenius model to 
represent experimental data and the observed reaction rate 
in terms of molecular behaviour. 

For reactions in liquid solution for which static interac¬ 
tions of the reacting species and the solvent are included, 


the relationship between the solution and gas phase VTST 
or TSTrate constants is 

& VTST =s$S^ T e -AG 2iv'' i?T 

where the free energy of solvation, AG^ lv = AGf - AGg^is 
the difference between the free energies of activation in the 
solution and in the gas phase (Ladanyi and Hynes, 1986). 
Models for calculating AG°J lv include implicit models 
in which the solvent is treated as a continuous medium 
and explicit models in which the solvent molecules are 
treated individually.The explicit methods, which generally 
require extensive computation, employ classical molecular 
dynamics, Monte Carlo or quantum molecular dynamics 
and often treat a layer of solvent molecules surrounded by a 
solvent continuum (Cramer and Truhlar, 1999; Cramer, 
2002, p.403). 

Important deviations from this model were shown by 
Kramers (1940) to be due to solvent dynamical effects that 
increase with velocity along the reaction coordinate. 
To account for these effects of medium to high solvent 
friction that increases with solvent density and viscosity, 
an additional factor to correct VTST or TST is included 
(Steinfeld etal., 1999). 

^TST =jfe VTST K KR 

where k kr (/ 1, ®) < 1 is the Kramers transmission coeffi¬ 
cient, ft is a friction constant and co is a parameter. For cases 
of lower friction, k™ ~ 1, but for high friction cases the 
reaction rate constant decreases with increasing friction of 
the species in the solvent. 

As a result of employing quantum mechanical methods 
within the statistical TST and VTST, computed rate con¬ 
stants can be calculated cost effectively at increasing levels 
of accuracy (Maity etal., 2000). For many systems, however, 
kinetic systems include a large number of elementary reac¬ 
tions and rate constants. A practical approach includes a 
sensitivity analysis to determine the most significant reac¬ 
tions for which the rates constants are then calculated from 
the structure, energy and vibrational frequency informa¬ 
tion of the reactants and transition states. To reduce com¬ 
putation costs, the activation energy can be estimated using 
models such as the Evan-Polanyi linear free-energy rela¬ 
tionship between the activation energy and heat of reaction 
or bond dissociation energy (Evans and Polanyi, 1938). 

E? 0 =E? 0 +yAH? 

where E% is an intrinsic activation energy for a family of 
similar species, A Hf is the heat of reaction for the zth reac¬ 
tion within the family of species and y is a constant. But this 
empirical estimation of activation energies by itself can lead 
to large uncertainties in the predicted rate constants. 
A recent development to increase accuracy is a version of 
TST, reaction class TST or RC-TST, to estimate rate con¬ 
stants for species within a family or class where each 
member includes the same reactive moiety. This approach 
performs a full calculation of the smallest species in the 
class and takes advantage of relatively similar potential 
energy surfaces along the reaction coordinate so that rate 
constants of the other class members can be estimated from 
differences in activation energies and reaction energies. 
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Because a modest level of quantum calculations are 
involved for all but the smallest species in the class, rate 
constant calculations for the class members can be rapid 
and cost effective (Zhang and Truong, 2003). 

Chemical reaction rate parameters also have been corre¬ 
lated with molecular properties of the reacting species 
using approaches such as QSPR (quantitative structure- 
property relationships) to relate the observed parameters 
to these molecular properties, called descriptors that are 
based on experimental measurement or computed from the 
molecular structure. Example descriptors are molecular 
weight, boiling point, highest occupied molecular orbital 
and dipole moment. 

Overview of tests 

In cases where sufficient or reliable reactivity information 
is not available from a desktop review or from calculations, 
the gap in information is usually filled through experi¬ 
mental results.Test methods have been developed for evalu¬ 
ating individual component stability as well as reactivity 
with other species. The test methods used for reactions 
among species are broadly similar to those used for single 
components, but there are some important differences. 
In particular, it is necessary for the design of the reactor 
system to have much more information. There are two main 
reasons for this. One is that the design involves selecting 
not only an operating temperature, but also a number of 
other parameters and features such as a feed addition rate 
and a pressure relief system. The other is that the design 
involves scale-up to full scale. While these factors can be 
important for individual component stability in a reactor 
system as well, they must be accommodated in the design 
for normal operation. 

The information sought from tests includes data on the 
presence and quantitative features of exotherms, rate of 
heat evolution and rate of gas evolution. One group of tests 
uses a Carius tube or similar equipment. These include the 
closed tube test and the delayed onset detection test. 
Another group utilizes a Dewar flask. This includes tests 
involving: ramped and stepped heating of the reaction 
sample in a Dewar flask; ramped heating of the sample and 
a reference material in a Dewar flask (the simple exotherm 
test, or dynamic heating test); and the hot storage test using 
a Dewar flask, or heat accumulation test. 

In many tests, the sample is held in an apparatus placed 
in an oven. Tests employ various temperature control 
modes. The temperature may be held constant, ramped or 
stepped. The sample may be held under adiabatic condi¬ 
tions by arranging for its temperature to be tracked by that 
of the oven. Alternatively, the sample conditions may be 
made isothermal by holding the temperature of the oven 
constant at a value slightly below that of the sample. 

There are numerous accounts of particular tests and of 
their interpretation. Some of these are described below. 

Experimental test methods and equipment for screening 
Thermal Behaviour The information obtained in the 
various types of tests varies. Some tests merely indicate 
that an exotherm exists, whilst others permit quantitative 
evaluation of the exotherm parameters such as the heat 
evolved. This information gives a quantitative measure of 
the heat released. 

Preliminary tests The starting point for preliminary 
tests is usually to test for the occurrence of an exothermic 
reaction when the substance is heated. 


Melting point tube test A simple, if crude, test is the 
capillary melting point tube test in which the sample is 
heated up at a constant rate of about 10°C/min in a standard 
melting point apparatus. A result such as that shown 
in Figure 33.5(a), in which the sample temperature has 
exceeded that of the heating medium, indicates that there is 
an exotherm. 

Deuiar tests A number of tests involve the use of a 
Dewar flask. These are of three types: (1) ramped tempera¬ 
ture tests, (2) differential temperature tests and (3) adia¬ 
batic tests. 

In the first type, the sample is held in a tube in a heat 
transfer medium in a Dewar flask and the temperature of 
the medium is ramped at a constant rate; a typical rate of 
temperature increase is 2°C/min. If, at a given medium 
temperature, the sample temperature rises above that of the 
medium, as shown in Figure 33.5(a), an exotherm is pre¬ 
sent. A plot of this kind is given by N. Gibson (1984). 

Alternatively, the same apparatus may be used, but the 
temperature of the heating medium may be increased in a 
series of steps, holding the temperature constant for a per¬ 
iod at each step; a typical increment is 10°C. If at a given 
medium temperature the sample temperature rises, there is 
an exotherm. Figure 33.5(b) illustrates a result showing an 
exotherm occurs at 90°C. 

These two variants of the first type of Dewar test do not 
appear to have a specific name, other than the rather 
ambiguous ‘Dewar flask’ test. They are referred to here as 
the ‘ramped heating’ and ‘stepped heating’ Dewar flask 
tests, respectively. 

In the second type of Dewar flask test, the procedure is to 
put the sample and a reference material in two tubes in a 
Dewar flask filled with heat transfer medium, to heat the 
medium up at a constant rate and to measure the tempera¬ 
ture difference between the sample and the reference 
material. A plot is made of the temperature difference, AT, 
between the sample and the reference material vs the tem¬ 
perature, T, of the heat transfer medium. Atypical result for 
a material is illustrated in Figure 33.5(c). This test is refer¬ 
red to by the ABPI (1981), which gives details and plots, as 
the ‘dynamic heating test’, and by Coates and Riddell 
(1981a) as the ‘simple exotherm test’ and the ‘dynamic 
heating test’. 

The third type of Dewar flask test is the ‘adiabatic test’. 
The sample is held in a pressure Dewar flask in an oven. 
The flask simulates the reactor and the process is carried 
out in the plant. The temperature of the oven is controlled to 
follow closely the sample temperature allowing measure¬ 
ment of any exotherm that occurs. The test is described by 
T.K. Wright and Rogers (1986). 

Tube Test An alternative to the Dewar flask is an open 
or a closed tube test. A Carius tube is often used, but if gas 
evolution occurs, a closed tube is more suitable. It is desir¬ 
able to establish the extent of any gas evolution in the initial 
screening. This may be done by a pressure-time test using 
a closed Carius tube. 

Closed Tube Test A closed tube test may be used to 
detect the onset of an exotherm and gas evolution. A 10 g 
sample is held in a closed Carius tube in an oven and the 
temperature of the oven is ramped upwards at a typical rate 
of 2°C/min. The test is described by N. Gibson (1984) and 
N. Gibson, Rogers and Wright (1987) and is referred to 
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Figure 33.5 Exotherm profiles in tests for thermal stability of individual substances: (a) sample and heating medium 
temperatures in melting point tube test or Dewar flask ramped temperature test; (b) sample temperature in Dewar flask 
stepped temperature test; (c) temperature difference between sample and reference material in Dewar flask dynamic 
heating test. 


as the Imperial Chemical Industries (ICI) programmed 
screening test or as the ‘ICI 10 g sealed tube test’. 

Delayed Onset Detection Test Another test is the 
delayed onset detection test. The sample, held in a lagged 
Carius tube placed in an isothermal oven, is maintained 
isothermally at about 10°C above the oven emperature 
using a small electric heater. An exotherm is detected by 
a fall in the electrical power requirement. The test is 
described by the ABPI (1981). 

The tests just outlined can be performed using in-house 
apparatus and avoid the use of specialist instrumentation, 
which can be expensive. 

Hot Storage Tests It may also be necessary to test the 
behaviour of the material when held at a high temperature 
for a long period under adiabatic conditions. In the hot 
storage test, the sample is held in a container in a Dewar 
flask under quasi-adiabatic conditions and any exotherm is 
recorded. The test period is usually at least 7 days. The test 
is also referred to as the ‘heat accumulation test’. The hot 
storage test is carried out if the material is to be held at or 
subjected to a temperature relatively close to the exotherm 
onset temperature T e , say at T e = 50°C. This applies to 
in-plant processing, to storage and transporation. The 
results of this test can be related to the Self-Accelerating 
Decomposition Temperature (SADT) determined through 
a United Nations Orange Book test Recommendations on 
the Transport of Dangerous Goods: Model Regulations, 
13th ed., United Nations, NY, 2004. 


Insulated Exotherm Test The insulated exotherm test 
(IET) is a form of Differential Thermal Analysis (DTA), 
which is described in the next section. 

Decomposition Pressure Test The decomposition pres¬ 
sure test (DPT) is carried out in a pressure vessel. The oven 
temperature is ramped and the sample temperature and 
vessel pressure are measured. 

Explosive Behaviour 

Impact Sensitivity If there is reason to suspect that the 
substance has the potential to explode, it may be subjected 
to tests for explosibility. These include an impact sensitiv¬ 
ity test such as the drop weight test and a detonability test. 
Explosibility tests are described below. 

A detailed account of initial screening tests, of the pre¬ 
cautions to be taken and of the interpretation of the results 
is given by Snyder (1965). 

Experimental test methods and equipment for 
detailed evaluation 

Tests using special instruments and calorimeters There are 
a number of rather more elaborate techniques which may be 
employed to detect and quantify exotherms and for which 
special instrumentation has been developed. The principal 
techniques are DTA, differential scanning calorimetry 
(DSC) and accelerating rate calorimetry (ARC). 

DTA In DTA, the sample is held in a tube in a vessel 
surrounded by a heat transfer medium and is heated at a 
constant rate. A typical heating rate is 2°C/min. A plot 
is made of the temperature difference, AT, between the 
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Figure 33.6 Exotherm profiles in tests for thermal stability of individual substances using differential thermal analysis 
(DTA): (a) conventional ramped temperature test; (b) ramped temperature tests, showing effect of rate of temperature 
increase (Grewer et at., 1989); (c) isothermal tests, showing effect of time-dependent material stability (Duval, 1985) 
(Courtesy of the American Chemical Society) 


sample and the heat transfer medium vs the temperature, 
T, of the latter. A typical result for a material giving an 
exotherm at 200°C is illustrated in Figure 33.6(a). The use 
of DTA to detect thermal instability is described by Silver 
(1967) and Coffee (1969). DTA may be carried out with open 
or closed tubes, the latter being more appropriate where gas 
evolution occurs. 


In conventional DTA, the temperature is programmed to 
rise at a constant rate. Figure 33.6(b) (Grewer et ol, 1989) 
illustrates a set of traces obtained for different heating 
rates. Where the thermal stability of a substance may be a 
function of time, DTA may be performed isothermally. 
Figure 33.6(c) (Duval, 1985) shows a set of traces for DTA of 
a substance exhibiting time-dependent thermal instability. 
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The use of isothermal DTA is described hy Schulz, Pilz 
and Schacke (1983) and by Duval (1985). DTA may also 
be performed using in-house apparatus. Cronin, Nolan and 
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Figure 33.7 Experimental determination of thermal 
stability of reaction mixtures - 1 (Grewer, 1974): 

(a) differential thermal analysis of sulfonation of 
nitrobenzene; (b) differential thermal analysis of 
diazotization of 2-cyano-4-nitroaniline in i-i 2 S0 4 
(Courtesy of Elsevier Publishing Company) 


Barton (1987) have described an ‘insulated exotherm test’, 
which is based on DTA. 

Figure 33.7(a) from Grewer (1974) shows a DTA plot for 
the sulfonation of nitrobenzene in sulfuric acid in which the 
product has decomposed and Figure 33.7(b) one for the 
diazotization of 2-cyano-4-nitroaniline in sulfuric acid in 
which the three peaks correspond to the reactions asso¬ 
ciated with the CN, N 2 and NU2 groups. 

DSC In DSC, the sample and a reference material are 
held in pans in a vessel and are heated at a constant rate of 
typically 5—10°C/min. The heating is carried out by a con¬ 
trol system that maintains the sample and the reference 
material at the same temperature. The variation in the heat 
that must be supplied to the sample to keep it at the same 
temperature as the reference material gives a quantitative 
measure of any exotherm in the sample. A plot is made 
of the rate of change of heat input to the sample with 
time, dQ/df, vs the temperature, T, of the reference 
sample. Again, open or closed pan methods may be used. 
An account of DSC is given by Wendlandt (1986). 
Figure 33.8 (Duval, 1985) shows a typical DSC plot. 

Some substances must be tested under pressure. One 
reason for this is that a volatile substance can reach higher 
temperatures if held under pressure and thus the tempera¬ 
ture range over which an exotherm may occur is extended. 
Another reason is that pressure may enhance an exotherm, 
especially in air. The conduct of DTA and DSC with the 
sample under pressure in a pressure cell and the use of a 
test scheme based on atmospheric DTA(DSC), pressure 
DTA(DSC) and a confinement test have been described by 
Seyler (1980). The confinement test is designed to measure 
the temperature at which a material under confinement will 
generate heat and pressure while subjected to a constant 
temperature increase of l-2°C/min. In the scheme descri¬ 
bed by Seyler (illustrated in Figure 33.9), if atmospheric 
DTA(DSC) shows a moderate to severe exotherm, a ther¬ 
mal hazard is established; pressure DTA(DSC) may 
be bypassed, but a confinement test is required. If 
atmospheric DTA(DSC) shows a weak exotherm or none, 




Temperature (°C) 

Figure 33.8 Exotherm profile in test for thermal stability of individual substances using differential scanning 
calorimetry (DSC) (Duval, 1985) (Courtesy of the American Chemical Society) 
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Figure 33.9 Test scheme using pressure DTA/DSC to 
identify need for confinement test (Seyier, 1980) (Courtesy 
of Elsevier Science Publishers) 


pressure DTA(DSC) is carried out and if a strong exotherm 
is detected, a confinement test is performed. 

DTG or TGA Another instrumental technique is dif¬ 
ferential thermo-gravimetry (DTG), hut this is less widely 
used. It can also he referred to as thermogravimetric ana¬ 
lysis (TGA). In combination with compositional analysis 
tools, such as flame ionization, infrared and mass spectro¬ 
scopy detectors, it becomes a powerful technique for iden¬ 
tifying decomposition products. It can also be combined 
with DSC to provide an indication of the energetics asso¬ 
ciated with volatile species generation. 

Tests characterizing the normal reaction 

Dynamic heating test The dynamic heating test has 
open and closed tube versions. The oven temperature is 
ramped and the temperature difference between the sample 
and a reference material is measured to detect any exo¬ 
therm. The test is also known as the ‘simple exotherm test’. 

Adiabatic heating test The adiabatic heating test uses a 
Dewar flask. The oven temperature is held constant and 
any exotherm is measured. The test period is at least 8 and 
preferably 24 h. This test is also known as the ‘heat 
accumulation test’. 

Figure 33.10(a) from Grewer (1974) gives a plot for an 
adiabatic storage test of diazotization solution of 2-cyano- 
4-nitroaniline in which again there are three steps in the 
curve corresponding to the exotherm peaks in the DTA test. 
Figure 33.10(b) shows a plot for an adiabatic reaction test, 
similar to the adiabatic storage test but conducted at 
the operating temperature, for the reaction of />-nitro-/V- 
methylaniline with carbyl sulfate in nitrobenzene under 
pressure. 

AZT24: Further methods of characterizing the reaction 
and the reactor have been described by Grewer et al. (1989). 
It is common for a product to be brought to an elevated 
temperature for some 24 h. The adiabatic storage test may 
be used to determine a suitable temperature limit. The most 
useful information yielded by the adiabatic storage test is 
the adiabatic induction time 71,d. Usually this correlates 
with temperature according to the relation log T a b vs 1/71 
This correlation can be used to determine the temperature 
at which the adiabatic induction time is 24 h. This temper¬ 
ature is known as AZT24. 




Figure 33.10 Experimental determination or thermal 
stability of reaction mixtures - 2 (Grewer, 1974): 

(a) adiabatic storage test of diazotization solution of 
2-cyano-4-nitroaniline in H2SO4; (b) adiabatic reaction test 
of solution of p-nitro-N-methylaniline and carbyl sulfate in 
nitrobenzene (Courtesy of Elsevier Publishing Company) 


In addition to this storage version of the test, there is a 
reactor version in which the flask simulates the reactor and 
the process is carried out as on the plant. 

Heat flow calorimetry In heat flow calorimetry, the 
sample is held in the calorimeter (a jacketed mini-reactor) 
and a heat transfer medium is circulated so that it removes 
heat at the same rate as it is generated, maintaining iso¬ 
thermal conditions. A test of this type is described by 
Coates and Riddell (1981a). The RC-1 of Mettler is an 
example of a heat flow calorimeter. 

One important test carried out using a reaction calori¬ 
meter is the determination of the adiabatic temperature 
rise. This single test provides a large amount of information 
on the thermodynamic and kinetic and characteristics of 
the reaction such as the heat capacity of the reaction mass, 
heat of reaction and the rate of heat production. 

Isoperibolic calorimetry Isoperibolic calorimetry is car¬ 
ried out in a simple form of a heat flow calorimeter. The heat 
transfer medium is held at constant temperature, the tem¬ 
perature difference between this medium and the sample is 
measured and the heat flow is thus obtained. 

Power compensation calorimetry This method utilizes 
another form of heat flow calorimeter in which a heater in 
the sample maintains it at the desired reaction temperature, 
even though it loses heat to a heat transfer medium held at a 
lower temperature. 
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Numerous other specialized instruments for the investi¬ 
gation of reactions have been described such as the TZP 
described by Kunzi (1980). This instrument allows a com¬ 
ponent or reaction mixture to be investigated in the same 
oven under isobaric and isochoric conditions and under 
identical thermal conditions. The author mentions parti¬ 
cularly the investigation of decomposition reactions. 

There are also available several special calorimeters 
developed for the study of thermal stability and reaction 
exotherms. 

SIKAREX: One special calorimeter is the SIKAREX 
described by Hub (1976,1977a,b). The calorimeter consists 
of a tube held in a temperature-controlled environment and 
with a heating element on the tube itself. It can be operated 
in quasi-isothermal, adiabatic and isothermal modes. In the 
quasi-isothermal mode, the sample is brought to tempera¬ 
ture equilibrium with the environment, the environment 
temperature is increased and, if an exotherm occurs, the 
temperature difference between the sample and the envir¬ 
onment is measured. In the adiabatic mode, the environ¬ 
ment is maintained at the same temperature as the sample. 
In the isothermal mode, the environment is held at a tem¬ 
perature below that of the sample, the tube heater is used to 
maintain the temperature of the sample and the heat 
required to do this is measured. 

Another special calorimeter is the SEDEX (SEnsitivity 
Detector of EXothermic processes) described by Hakl 
(1981). This instrument is an oven equipped with tempera¬ 
ture control and adapted to take various types of sample 
containers with inlet and outlet tubes, stirrers and so on. 
The system may be used in various modes. 

ARSST: The Advanced Reactive System Screening Tool 
(ARSST) is an instrument intended to provide rapid 
screening of chemical reactivity as well as provide some 
detailed kinetic parameters for reaction characterization. 
The sample is placed in an open 100 ml round-bottom flask 
and its temperature ramped by external heaters. An exo¬ 
therm appears as a reduction in heat required during the 
ramp. The sample and flask are kept in a containment ves¬ 
sel pressurized to help retain sample liquid in a condensed 
state. The apparatus can also be equipped with a detector to 
indicate during venting whether gas/vapour only or gas/ 
vapour plus liquid are leaving the flask. 

Adiabatic calorimeters - Adiabatic temperature rise 
test One test that yields a large amount of information 
on the reaction parameters is an adiabatic test in which the 
reaction is taken to completion. Such a test gives a sigmoi¬ 
dal temperature profile, with the temperature initially ris¬ 
ing rapidly and then levelling off as the reactants are 
consumed. A simple analysis of such a test is given by the 
1981 ABPI Guidelines. The analysis yields the adiabatic 
temperature rise, the self-heat rate, the velocity constant 
and the activation energy. 

Dewar calorimetry: Dewar calorimetry tests (described 
also in the previous section) operated in an adiabatic mode 
can be utilized to determine the adiabatic temperature rise, 
the heat of reaction and reaction kinetics. 

ARC: In the Accelerating Rate Calorimeter (ARC), the 
sample is held in a bomb calorimeter under adiabatic con¬ 
ditions. Adiabaticity is achieved by heating the surround¬ 
ings of the sample cell so that the temperature outside the 
cell matches the temperature in the cell. ARC testing may 
be done in different ways, but one of the most common is 



Figure 33.11 Exotherm profile in test for thermal stability 
of individual substances using accelerating rate calorimetry 
(ARC) (N. Gibson, Rogers and Wright, 1987) (Courtesy of 
the Institution of Chemical Engineers) 


the ‘heat, wait and search’ method. The temperature is 
increased in steps, a typical increment being 10°C. 
The sample is then held for a period at that temperature. 
The rate of any temperature increase is observed to see if it 
exceeds a set value, typically about 0.02°C/min. If it does 
not, the temperature is raised by the incremental amount 
and the procedure is repeated. If the temperature rises at a 
high rate, there is an exotherm. Accounts of the ARC are 
given by Coates (1984a,b) and Ottaway (1986). A typical 
result, given by N. Gibson et al. (1987), for a material giving 
an exotherm at about 80°C is shown in Figure 33.11 The 
TIAX, LLC ARC instruments are widely used. 

The ARC presents the advantage of studying compound 
reactivity in an adiabatic environment, more representative 
of plant and storage conditions than in isothermal or 
temperature-ramped instruments. The ARC is also equip¬ 
ped to accommodate and measure large increases in sample 
pressure, which requires a relatively thick-walled cell rela¬ 
tive to the amount of sample contained. This leads into the 
concept of the thermal inertia factor, </>, reflecting the amount 
of heat absorbed by the sample container relative to that 
retained in the sample itself .The thermal inertia is defined as 



where m denotes the mass, Cp the heat capacity, subscript c 
the cell + stir bar and s the sample. A high thermal inertia 
factor indicates that much of the evolved heat is utilized to 
raise the temperature of the sample container instead of the 
sample itself. In this circumstance, the extent of tempera¬ 
ture rise from a reaction can be dampened and subsequent 
reactions missed. The 4> factor of commercial equipment 
approaches a value of unity. A value of 1.5—5 is typical of 
ARC tests. 

Stirring can be accomplished in the ARC through use of a 
specially designed thick-wall sample cell equipped with an 
internally mounted magnetic stir bar. An external rotating 
drive magnet causes the internal stir bar to spin. 

The ARC can be viewed as a forerunner of a family of 
instruments developed to reduce the thermal inertia factor 
closer to unity. These instruments include the VSP, Phi-Tec 
and the APTAC. Information obtained from the ARC, VSP, 
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PHI-TEC and APTAC can be employed to characterize 
runaway reaction kinetics as well as help size appropriate 
relief vents. 

VSP: The Vent Sizing Package or VSP (originally the 
DIERS Bench-Scale Apparatus) was the first of the adia¬ 
batic calorimeters to incorporate pressure-balancing in its 
design. This feature allows use of a thin-walled sample can 
while still enabling the sample to reach elevated pressures 
during a test. The VSP also operates with a 120 cc sample 
cell. The use of a larger sample with a thin-wall can yields 
thermal inertia factors typically 1.05-1.20. The VSP has 
more recently been upgraded to include multi-zone heating 
elements, solid ceramic insulation and mechanically driven 
stirring (vs magnetically coupled stirring). 

PHI-TEC: Another adiabatic calorimeter equipped with 
pressure balancing, and thus operating with thin-walled 
cans and larger sample sizes, is the PHI-TEC. It has many of 
the newer features described above for the VSP. 

APTAC: The Automatic Pressure Tracking Adiabatic 
Calorimeter (APTAC) is also a VSP-like instrument, but 
more fully instrumented and automated. The sample 
resides in a spherical cell and exhibits greater sensitivity 
for exotherms (0.04°C/min) than the VSP. The instrument 
can also be purchased with various integrated sample 
injection and venting options. As the name implies, this 
calorimeter is designed to operate fully automatically once 
sample is loaded and the test initiated. 

Tests to detect and characterize an exotherm may need to 
be supplemented by other tests. Mention has already been 
made of explosibility/detonability and of deflagration tests. 

Gas evolution measurement Gas evolution is another 
important parameter. One measurement method utilizes 
a tube and another an autoclave. These tests are also 
described by Coates and Riddell (1981a). 

Automated gas burette: Gas evolution measurement is 
carried out with a burette in which the gas evolved builds up 
and is then released in a cycle which is then repeated, with 
the total gas evolution determined from the number of 
releases made. The releases and the counting are automated. 

Thermal mass flowmeter: Gas evolution measurement 
using a thermal mass flowmeter to measure the flow of gas 
evolved. 

Blowdown tests J. Singh (1988a) describes the use of a 
reaction calorimeter to determine the maximum pressure 
resulting from runaway of the main process reaction and 
thus to assess the option of containment instead of venting. 

In the blowdown test, the reaction mixture is brought to 
the reaction runaway temperature in a test cell, and when 
the vent pressure is reached, a vent valve is opened full. 


Venting down to atmospheric pressure occurs, typically 
over a period of some 6 s. The residual liquid in the cell is 
measured. If the cell remains over 60% full of liquid, the 
vent fluid is taken as all vapour. If the cell contains less 
than about 5% of liquid, the venting is taken as homo¬ 
geneous, that is the vent fluid is representative of the 
vapour-liquid mixture in the vessel. For residual fills 
between these two limits, the venting is taken as two-phase 
but not homogeneous, that is vapour disengagement and 
preferential venting of vapour have occurred. 

The vent sizing test involves bringing the reaction mix¬ 
ture to the reaction runaway temperature and opening the 
vent valve, but this time the vapour is vented at a slow, 
controlled rate. The temperature of the reaction mass levels 
off and the reaction is tempered, the vapour flow being such 
as to give thermal equilibrium. The vent valve is then 
closed momentarily, the temperature rises and the valve is 
opened again. The rate of temperature rise can then be used 
to size the vent. The author gives an example of the calcu¬ 
lation of vent size. 

Combustion tests A combustion test for preliminary 
screening is the train firing test, which indicates the ability 
of a flame to propagate through the material in powder 
form. A train of finely ground material is laid on a heat 
insulating surface in a line and ignited. In the version 
described by ABPI (1981), ignition is by heated wire; in that 
described by N. Gibson, Harper, and Rogers (1985), it is by a 
gas flame. The extent of fire spread is observed and cate¬ 
gorized as shown in Table 33.9, the degree of hazard 
increasing with the rating number. 

Deflagration tests Certain liquids such as peroxides 
and hydroperoxides are susceptible to violent decomposi¬ 
tion, even in the absence of air. In contrast to process reac¬ 
tions in which the reaction rate depends on the temperature 
according to the Arrhenius equation, these decompositions 
show no simple temperature dependence, but occur at 
about 200°C and are characterized as deflagrations (sub¬ 
sonic propagating reactions). Whether a particular mixture 
will decompose in this way depends on the concentration, 
the temperature and the presence of an ignition source such 
as a hot spot, spark or flame. Liquid-phase deflagration 
tests are carried out in a small cylindrical vessel fitted with 
rupture discs in which the liquid sample is ignited by a 
heated wire. The maximum pressure resulting from a liquid 
decomposition would typically rule out simple contain¬ 
ment as a design option. 

Deflagration may also occur in the vapour phase.Vapour 
phase deflagration tests are carried out in a spherical ves¬ 
sel in which the vapour sample is ignited by a fused wire. In 
this case, containment may be an option, although venting 
is also widely used. 


Table 33.9 Interpretation of train firing test (after N. Gibson, Harper and Rogers 1986) 


Fire spread 

Result 

Rating 

No 

No ignition 

1 

No 

Brief ignition, rapid extinction 


No 

Local combustion, at most smouldering, slight spread 

3 

Yes 

Hot red glow or slow decomposition without flame 

4 

Yes 

Burning like a firework or slow steady burning with flame 

5 

Yes 

Very rapid combustion with flame or rapid decomposition without flame 

6 
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Drying of powders Two main categories of tests are 
performed on powders: dust explosivity tests (described in 
Chapter 17 in conjunction with flammability issues) and 
drying tests. The ABPI (1981) describes two tests: (1) a 
‘through air’ drying test in which air is passed through abed, 
and (2) an ‘over air’ test in which air is passed over a layer. 

Some factors that affect the behaviour of a powder in 
drying include 

(1) chemical composition; 

(2) impurities; 

(3) effective thermal conductivity; 

(4) effect of air; 

(5) time-dependent effects. 

A more-detailed account is given by N. Gibson, Harper and 
Rogers (1985,1986). 

The material to be dried may be chemically complex, 
perhaps incorporating agents to instill special properties, 
or it may contain impurities. Both of these factors may 
influence the reactivity of the material. If a reaction occurs, 
the rate of heat loss depends on the effective thermal con¬ 
ductivity of the material in powder form. If the reaction 
mechanism is predominantly oxidation, the availability of 
air is an important factor.The reaction may occur only after 
a certain time, or induction period. 

N. Gibson, Harper and Rogers (1985,1986) also describe 
the set of tests illustrated in Figure 33.12: a bulk powder 
test, an aerated powder test and a powder layer test. The 
configuration selected being that in which the powder is to 
be dried on the plant. In each test, the powder is subjected to 
a stream of warm air. The authors discuss the application of 
the results from these tests to particular drying processes. 
This aspect is considered further in Chapter 11. 

Interpretation and comparison of experimental test methods 
Reaction characterization The reaction system may be 
characterized in terms of the following fundamental 
quantities: 

(1) physical and chemical properties of the components; 

(2) reaction stoichiometry; 

(3) heat of reaction; 

(4) quantity of gas evolved; 

(5) kinetics of reaction. 


(a) m (c) 



Bulk Fluidized Layer 

□ Sample T, Thermocouple 


Figure 33.12 Tests for thermal stability in driers: (a) bulk 
form; (b) fluidized form; and (c) layer form (after N. Gibson, 
1984) (Courtesy of the Society of Chemical Industry) 


Exotherm characterization Some parameters characteriz¬ 
ing an exotherm are: 

(1) exotherm onset temperature; 

(2) adiabatic temperature rise; 

(3) heat of reaction; 

(4) rate of temperature rise (also known as the self-heat 
rate); 

(5) rate of heat generation; 

(6) rate of pressure rise; 

(7) velocity constant, activation energy and pre-expo¬ 
nential constant; 

(8) adiabatic induction time. 

Some of these parameters can be determined from DSC or 
DTA tests. Most of these parameters can be obtained from 
an adiabatic Dewar flask test or ARC test. 

Interpretation of exotherm onset temperature test 
Although the temperature for reaction onset (i.e. ‘onset 
temperature’) is a convenient concept, it needs to be borne 
in mind that even at lower temperatures there is still a non¬ 
zero reaction rate. It is important to note that the onset 
temperature is a measure linked to the detection limit of the 
instrument utilized. It is not a value unique to the reaction 
chemistry alone. 

Aquotedonsettemperatureisonemeasuredbyaparticular 
test and is highly dependent on sample size, degree of adia- 
baticity, instrument sensitivity, time-temperature history 
and reaction kinetic features, notably activation energy. 

A traditional approach to reactor safety has been to set 
the temperature of reactor operation at some fixed tem¬ 
perature interval below the exotherm onset temperature 
measured in the laboratory test. A widely quoted value of 
this safety margin is 100°C, the ‘100 degree rule’. 

Various authors discuss this safety margin. Coates and 
Riddell (1981a) state that any material with an exotherm 
onset temperature within 100°C of the maximum operating 
temperature as determined by the simple exotherm test is 
considered a potential hazard. In such a case, the material is 
subjected to the adiabatic exotherm test. If the exotherm 
onset temperature in this test is 50°C or more above the 
operating temperature it is not considered a hazard. If it is 
within this 50°C safety margin, it is subjected to a long-term 
hot storage test at 20°C above the operating temperature. 

The IChemE Guide, which rehearses the factors affect¬ 
ing a measured onset temperature, as just described, states 
that the 100° rule, or a similar one, should not be used as the 
basis of safety unless previous experience has shown the 
rule to be valid for the type of reaction in question. 

Interpretation of initial screening tests 
Initial screening tests can provide information on the 
occurrence of a thermal excursion, or exotherm, and on the 
following of its features: (1) onset temperature, (2) heat 
release and (3) rate of heat release. The data from screening 
tests must be interpreted with care. In particular, any onset 
temperature determined will be a function of the sample 
size and the heating mode. The IChemE Guide gives a 
method of correcting temperature for sample size. 

Comparison of methods for an exotherm 
Several authors have given comparisons of different meth¬ 
ods of determining exotherm parameters. N. Gibson (1984) 
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has given the following results for the exotherm onset 
temperature of 3,5-dinitro-o-toluamide: 

ICI programmed screening test 115-120°C 
DTA (fast scan) 274-284°C 

ARC 120—125°C 

He comments that the limitations of fast scan DTA and 
ARC are well known. 

A comparison of exotherm onset temperatures for a large 
number of substances, as determined by ARC and by other 
methods, has been given by Fenlon (1984). Hakl (1981) has 
given a comparison of exotherm onset temperatures for 
five substances determined by DSC and by SEDEX. The 
values determined by the former are consistently higher, 
the difference ranging from 25°C (80°C against 55°C) for 
f-xylylchloride with 0.02% Fe and 85°C (380°C against 
295°C) for 1-nitroathrachinone. 

Interpretation of tests characterizing the normal reaction 
The interpretation of the tests characterizing the normal 
reaction is discussed in the 1981 and 1989 ABPI Guidelines 
and the IChemE Guide. These give a number of illustrations 
of test results together with commentaries. 

For equipment and safeguarding design, it is necessary 
to know 

(1) heat transfer parameters; 

(2) rate of heat evolution; 

(3) rate of gas evolution; 

(4) rate of heat removal. 

The rate of heat evolution is a function of the the heat of 
reaction and reaction kinetics. The heat evolution rate also 
depends on the reaction conditions and circumstances, 
such as reaction mode, the reaction temperature, the reac¬ 
tant concentration and any thermal events that may occur. 
The reaction mode may be batch or semi-batch .The reactant 
concentration is determined by the reaction mode and the 
initial temperature. The reaction temperature is a design 
parameter, but an excursion may occur due to an exotherm. 
Thermal events are those such as mixing, adsorption, 
phase changes, gas evolution, decomposition and so on. 

It is necessary to have full information on the gas evolu¬ 
tion and decomposition characteristics. If the reaction is 
subject to gas evolution, data are needed on the rate of gas 
evolution, which is a function of the kinetics and the 
quantity of gas evolved (as reflected by the reaction stoi¬ 
chiometry). If the reaction is subject to decomposition, 
information is required on the temperature range in which 
it occurs and on any tendency for autocatalysis. 

The rate of heat removal is a function of the reaction 
temperature attained and of the heat transfer character¬ 
istics. The latter, in turn, is governed by the cooling 
arrangements. For jacket cooling, it depends primarily on 
the reaction and coolant temperatures, the effective heat 
transfer area and the heat transfer coefficients. 

Test schemes 

Preliminary or initial screening tests In the ABPI 1981 
scheme preliminary tests, the safety screen test is the 
melting point tube test and the combustibility test is 
the train firing test, as described in Chapter 8. The explo¬ 
sion and detonation potential tests are of the type 
described in that chapter. In the ABPI 1989 scheme, shown 


in Figure 33.13, the tests are not classified in terms as 
preliminary or screening tests, but the first six of the tests 
listed are grouped under the heading of tests for unex¬ 
pected decomposition. The combustibility test is again the 
train firing test. The DSC and closed tube tests are ramped 
temperature tests for the detection of an exotherm. The 
delayed onset detection test is an essentially isothermal 
test for the detection of delayed onset of any exotherm. The 
adiabatic Dewar test, which simulates the reactor under 
adiabatic conditions, gives information on the rate of any 
exothermic reaction. The ARC test also provides this 
information. Details of the tests not already described are 
given below. 

The IChemE Guide scheme involves DSC and the 10 g 
closed tube test along with the insulated exotherm and 
decomposition pressure, initial screening tests. 

Test schemes for material instability Test schemes for 
thermal instability of materials have been described by 
a number of authors. Table 33.10 summarizes some of the 
principal schemes. A test scheme given by Kohlbrand 
(1985) is shown in Figure 33.14(a) and another given 
by Cronin, Nolan and Burton (1987) is shown in 
Figure 33.14(b). Test schemes for powders have been given 
by N. Gibson, Harper, and Rogers (1985,1986), as shown in 
Figure 33.15. Test schemes for reactivity are given in the 
subsequent subsection. 

ABPI Test Scheme The Guidelines for Chemical Reaction 
Hazard Evaluation (ABPI, 1989) address material stability 
as well as chemical reactivity. Included is a sub-scheme for 
the screening of the substances involved in the reaction: 
raw materials, intermediates and products. The overall 
scheme is illustrated in Figure 33.16. This scheme for 
individual substances covers (1) explosive properties, 

(2) unexpected decomposition and (3) maximum safe tem¬ 
perature for storage. For characterizing normal reactions, 
the dynamic heating and the adiabatic heating tests are 
employed. The scheme also utilizes the adiabatic Dewar 
test, ARC, the heat flow calorimeter test and the two gas 
evolution measurement tests to characterize the intended 
reaction. 

For explosive decomposition, the scheme involves 
assessment of explosive properties from (1) chemical struc¬ 
ture, (2) oxygen balance, (3) energy of decomposition and 
(4) preliminary small scale tests (e.g. DSC), and if necessary, 
larger-scale Koenen tube orTrauzl lead block tests. 

For unexpected decomposition, five tests are given: 

(A) small scale testing using ramped temperatures 

(1) DSC, 

(2) closed tube test; 

(B) isothermal testing for delayed onset 

(3) delayed onset detection test, 

(4) ARC, 

(5) adiabatic Dewar test. 

Each test is fully described in the Guidelines, which also 
give, in most cases, typical output traces. The purpose and 
nature of these tests may be summarized as follows: the 
DSC test determines the onset temperature of any exo¬ 
therm. The test method referenced is that of Wendlandt 
(1986). The closed tube test detects the onset of an exotherm 
and of gas evolution to detect delayed onset and to estimate 
the heat evolution and gas evolution rates. The test method 
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Figure 33.13 UN transport classification tests; flow chart for classification of a substance or article as i 


follows that of N. Gibson, Rogers and Wright (1987). The 
delayed onset detection test detects the onset of an exo¬ 
therm and estimates the heat evolution rate. The ARC test 
detects an exotherm and determines the maximum safe 
working temperature. The ARC method given is the heat, 
wait and search technique mentioned earlier and described 
by Coates (1984a,b) and Ottway (1986). The adiabatic 
Dewar test, similar to the ARC method, detects an exotherm 
and gas evolution and determines the maximum safe 
working temperature. The test method is described by 
T.K. Wright and Rogers (1986). 

The tests for maximum safe storage temperature apply 
only to liquids. For solids, the temperature may not be uni¬ 
form throughout the material, making it necessary to treat 
this situation as a self-heating problem. An account of self¬ 
heating is given in Chapter 16. 

For powders, the Guidelines refer to the methods of 
N. Gibson, Harper and Rogers (1985). 


1 (UN, 1991) 

Test schemes for chemical reactivity A systematic approach 
to testing requires that it be performed within the frame¬ 
work of a scheme for the acquisition of the complete set of 
information necessary for reactor design. There are a 
number of test schemes described in the literature. 

The scheme described in the ABPI First Guidelines com¬ 
prised the following tests: 

(1) preliminary tests 

(a) safety screen test, 

(b) combustibility test, 

(c) explosion and detonation potential tests; 

(2) dynamic heating test; 

(3) adiabatic heating test 

(a) reaction exotherm, 

(b) hot storage; 

(4) special tests 

(a) drying stability tests. 
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Table 33.10 Some test schemes for thermal stability of a single substance 1 

Test 

Snyder 

ABPI 

Coats and 

Duval 

N. Gibson 

Cronin, 

Greweretal. 

ABPI 


(1965) 

(1981) 

Riddell 

(1985) 

(1984) 

Nolan and 

(1989) 

(1989) 




(1981a) 



Barton (1987) 



Melting point tube 
Dewar flask: 

x b 

x b 







Hot holding 

Dynamic heating 

x b 

x b 

x b 






Hot storage 


x b 

x b 






Pressure tube 

x b 




x 




Delayed onset 

DTA 




x 



x 


DSC 




X 




x b 

ARC 

Thermal stability bomb 

x b 







xb 

Explosion/detonation 

x b 

X 

X 


X 



X 

Deflagration 


x b 

X 




X 

X 

Drying 


x b 

x b 


x 



x 


a The table gives the tests principally discussed by the authors; it should not be assumed that no other tests are done. 
b These references give an account of the test apparatus and method. 



Figure 33.14 continued 
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Figure 33. 14 Test scheme for thermal stability of a material: (a) test scheme of Kohlbrand (1985) (Courtesy of the 
American Institute of Chemical Engineers); and (b) test scheme of Cronin, Nolan and Burton (1987) (Courtesy of 
the Institution of Chemical Engineers) 
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In this scheme, the safety screen test is the melting point 
tube test; the combustibility test is the train firing test; the 
adiabatic heating test for the main process reaction is 
similar to the stepped heating test using a Dewar flask. 

The test scheme described by Coates and Riddell 
(1981a,b) is very similar. Figure 33.17 shows the decision 
tree given by these workers. 

The test scheme given by O’Brien et al. (1982) is shown in 
Figure 33.18. Other test schemes include those of Cronin, 
Nolan and Barton (1987) and N. Gibson, Rogers and Wright 
(1987), described below. 

Another test scheme is that described by Kunzi (1980), 
who states that the problem may come in various forms, 
and outlines the way in which the scheme is used. It may 
be required to evaluate a complete process, or one stage 
of a process such as distillation or storage, or a single 
component. He gives a decision tree for approaching 


the general problem. Essentially, steps 1 and 2 are desk 
screening; step 3 is the standard laboratory tests; step 6 
involves tests to characterize the process main reaction; 
step 8 tests to explore undesired reactions; and step 10 tests 
to study storage. The actual scheme used is based on the 
availability in the test centre of a range of instruments 
including theTZP as described above. 

The tests in the scheme given in the ABPI Second 
Guidelines described above are: 

(1) DSC; 

(2) combustibility test; 

(3) closed tube test; 

(4) delayed onset detection test; 

(5) adiabatic Dewar test; 

(6) ARC; 

(7) heat flow calorimeter test; 



(a) 


Figure 33.15 continued 
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Figure 33. 15 Test schemes for thermal stability of a material with special reference to drying N. Gibson, 
Harper and Rogers (1985, 1986); (a) and (b) (Courtesy of the Institution of Chemical Engineers) 


(8) gas evolution measurement, using automated gas 
burette; 

(9) gas evolution measurement, using thermal mass 
flowmeter. 


Again, the flowchart is given in Figure 33.13. 

The ICI test scheme described by N. Gibson, Rogers and 
Wright is shown in Figure 33.19. 

The IChemE Guide gives the test scheme shown in 
Figure 33.18 and lists the following tests: 


(1) initial screening tests: 

(a) DSC, 

(b) insulated exotherm test, 

(c) decomposition pressure test, 

(d) 10 g closed tube test, 

(2) tests characterizing normal reaction: 

(a) Dewar calorimetry, 

(b) isoperibolic calorimetry, 

(c) power compensation calorimetry, 

(d) heat flow calorimetry, 

(e) gas evolution measurement, using automated gas 
burette, 


(f) gas evolution measurement, using thermal mass 
flowmeter, 

(3) tests characterizing runaway reaction: 

(a) adiabatic Dewar calorimetry, 

(b) other types of calorimetry, 

(c) Vent Sizing Package (VSP), 

(d) Reactive Systems Screening Tool (RSST), 

(e) Phi-Tec adiabatic calorimeter. 

Quantitative impact of exothermic reactions on system 
dynamics 

Kinetics and heat effects The rate of a chemical reaction is 
controlled by the reaction kinetics, diffusion processes, 
and/or supply of reactant. The reaction considered here is 
the simple, irreversible first-order reaction: 

A—> B [33.2.4] 

with reaction kinetics which can be expressed as 
r = pkx [33.2.5] 

where r is the reaction rate (kmol/m 1 2 3 s), k is the velocity 
constant at reaction temperature (s -1 ), * is the concentra¬ 
tion of reactant A (mole fraction) and p is the molar density 
of feed and of reaction mass (kmol/m 3 ). 
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Figure 33.16 Test scheme for assessment of thermal stability of reactant materials ABPI (1989) 
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Figure 33.17 Test scheme for chemical reactivity evaluation. T e = lowest temperature at which exotherm occurs; 
T op = mean temperature of intended use (Coates and Riddell (1981b)) (Courtesy of the Institution of Chemical 
Engineers) 


The variation of velocity constant with temperature is 
generally expressed in terms of the Arrhenius equation: 

k = k 0 exp (-E/RT) [33.2.6] 

where E is the activation energy (kj / kmol), k 0 is the velocity 
constant at the reference temperature (s -1 ), R is the 
universal gas constant (kj/kmol K), and T is the absolute 
temperature (K). 

The reaction is accompanied by an enthalpy change so 
that the heat generated is: 

Q s = Vr(—AH) [33.2.7] 

where AH is the heat of reaction, which is negative for an 
exothermic reaction (kj/kmol), Q s is the heat generated by 
the reaction (kW), and 7is the volume of the reactor (m 3 ). In 
considering reactor stability, exothermic reactions are of 
prime importance. 

In a closed adiabatic system, the behaviour of a kinetics- 
controlled exothermic reaction is as shown in Figure 33.20. 
The reaction generates heat, which causes the temperature 
and, hence, the velocity constant to increase continuously 
throughout the course of the reaction. The reaction rate and 
heat generated at first increase almost exponentially due to 
the increase in the velocity constant, then pass through a 
maximum and finally decrease as the reactants become 
exhausted. 

In many practical cases, an exothermic reaction can 
accelerate almost exponentially and cause overheating or 
explosion, if the heat is not removed from the system 
rapidly enough. These effects may occur while the reaction 
is only part way along the curves shown in Figure 33.20. 


There are a number of factors, however, that can limit the 
acceleration of the reaction rate. One limiting factor, which 
applies in all cases, is the exhaustion of the reactants. This 
applies even for a continuous feed of reactants, because 
once the resident material is consumed, the reaction rate 
cannot exceed the reactant feed rate. Another important 
limiting effect is the transition in heterogeneous reactions 
from a kinetics-controlled to a diffusion-controlled 
reaction. As the temperature rises, the reaction kinetics 
become so rapid that they cease to be the limiting factor and 
diffusion takes over the role. These effects are shown in 
Figure 33.21(a). The dashed lines represent the reaction 
rates limited by the kinetics alone and by diffusion alone. 
The actual reaction rate, shown by the full curve, is deter¬ 
mined by the combined effects of the kinetics and diffu¬ 
sion. It is limited at low temperatures by kinetics and at 
high temperatures by diffusion. Diffusion may be limited 
by the velocity in the reactor or by intra-particle mass 
transfer. The change of reaction rate with temperature and 
velocity for such a case is illustrated in Figure 33.21(b). 

Another limiting factor is the relation between the reac¬ 
tion rate and temperature. Some of the relations that occur 
are shown in Figure 33.22. Figure 33.22(a) gives the normal 
curve of rapid rise in reaction rate with temperature; Figure 
33.22(b) shows diffusion control with a slow increase of 
reaction rate with temperature; Figure 33.22(c) illustrates 
an explosion with a sudden increase in reaction rate at the 
ignition point; Figure 33.22(d) is for a catalytic reaction 
controlled by the rate of adsorption; Figure 33.22(e) corre¬ 
sponds to the occurrence of a side reaction, which becomes 
significant as temperature increases; and Figure 33.22(f) 
indicates a reaction in which conversion is limited by 
thermodynamic equilibrium effects. 
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Figure 33.18 Test scheme for chemical reactivity 
evaluation. TNR = temperature of no return (O’Brien et al. 
(1987)) (Courtesy of the American Institute of Chemical 
Engineers) 


Exothermic reactions in an adiabatic environment 
Batch reactors: reaction hazard evaluation A theoreti¬ 
cal treatment of an adiabatic reaction has been given 
by Townsend and co-workers (Townsend, 1977, 1981; 
Townsend and Tou, 1980). The treatment is for an wth-order 
reaction, but utilizes a pseudo-first-order reaction 
approach. For an wth-order reaction: 

^ = -kC" [33.2.8] 

k = Aexp(-E/RT) 33.2.9 

whereA is the pre-exponential factor, C is the concentration 
of reactant, E is the activation energy, k is the reaction 
velocity constant, R is the universal gas constant, t is the 
time, T is the absolute temperature, and n is the order of the 
reaction. 


Consider an adiabatic reaction as shown in Figure 33.23. 
The adiabatic temperature rise AT ab is: 

AT ab = T t - T 0 [33.2.10] 

where T f is the final absolute temperature and T 0 is the 
initial absolute temperature. The adiabatic temperature 
rise is calculated from the heat of reaction by: 

(-A H r ) = Mc v AT ab [33.2.11] 

where c T is the constant-volume specific heat of the reaction 
mixture. A H T the heat of reaction, and M is the mass of the 
reaction mixture. 

The appropriate concentration-temperature relation¬ 
ship is approximately 


C' 

G> 


Tf-T 

Tf - T 0 


and hence 


C=« 


Tf-T 

v/;’ lb - 


Co 


[33.2.12a] 


[33.2.12b] 


where C 0 is the initial concentration of reactant. 

The self-heat rate, mr, is obtained from Equations 33.2.8 
and 33.2.12b: 

I33 - 213a| 

= m T [33.2.13b] 

A pseudo-reaction velocity constant k* is defined as: 
k* = q?- 1 * [33.2.14a] 

= ((T f - r)/AT ab ) B AT ab [33.2.14b] 

From Equations 33.2.9 and 33.2.14a: 

Ink* = In(CJ-U) -E/RT [33.2.15] 


Equation 33.2.15 may be used to obtain the pre-exponential 
factorA and the activation energy E. 

The initial self-heat rate m 0 is obtained from Equation 
33.2.13b and is 

mo = £ 0 AT ab qf _1 [33.2.16] 

where k 0 is the reaction velocity constant at the initial 

temperature. From Equations 33.2.13 and 33.2.16: 

|33 2 17 " 

-’ % ( T Ii T )’“ p [-?(r-5)] |3a217b| 

At the maximum self-heat rate: 

5 = ° I 33 ' 218 ] 


























REACTIVE CHEMICALS 33/33 



Figure 33. 19 Test scheme for chemical reactivity evaluation (N. Gibson, Rogers and Wright (1987)) 
(Courtesy of the Institution of Chemical Engineers) 


and hence it can be shown that 

nRT* + ET m -ET f = 0 [33.2.19] 

where T m is the absolute temperature at the maximum rate. 
Then from Equation 33.2.18: 


It is possible to obtain an analytical solution of Equation 
33.2.21c if it is assumed that 

A = uV [33.2.22] 

where a is a constant andy is an integer. It can be shown that 
for a second-order reaction 


F RT 2 RT 2 

T - = 2nR K 1 + 4 *RT</E) V2 ~ 1] [33-2.20] K = ^~ 


[33.2.23] 


The maximum self-heat rate, m m , is obtained by substitut¬ 
ing T m in Equation 33.2.17a. The time to the maximum rate 
is obtained as follows. Integrating Equation 33.2.13a 

e m = t m -t [33.2.21a] 

«9j| d t [33.2.21b] 

Jr [33 ' 2 ' 21C] 

where f m is the time for the temperature to reach the max¬ 
imum rate value at T m and 8 m is the time to the maximum 
rate from temperature T. 


The same equation applies for other nth-order reactions. 

If the activation energy E is high, the second term in 
Equation 33.2.23 is much less than the first, and hence 


d - = ^E [33.2.24] 

Then from Equations 33.2.13b and 33.2.24 


k((T t -T)/AT ab ) n AT ab q-'E 

1 -g 8 1 

m [((T f - T)/AT ab ) n AT ab C%~ 1 e\ 


[33.2.25a] 

In A+E/RT 
[33.2.25b] 
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Figure 33.20 Course of a kinetic controlled exothermic 
reaction in a closed adiabatic system: (a) heat generated 
vs time; (b) temperature vs time; (c) heat generated vs 
temperature 


But, under the same assumption of a high activation 
energy, the second term in Equation 33.2.25b is much 


greater than the first, and hence 


ln0 m = —hi A +E/RT 

[33.2.26a] 

or, from Equation 33.2.9, 


ln0 m = Ink* 

[33.2.26b] 

RTl 


9m0 ~ koA T^q-'E 

[33.2.27a] 


The time, 0 mO , to maximum rate at temperature, T 0 , 
and thus from the start of the reaction, is obtained from 
Equation 33.2.25a by substituting k 0 and T 0 for k and T, 
respectively 




Figure 33.21 Kinetic and diffusion control of a 
heterogeneous reaction: (a) transition from kinetic 
to diffusion control as temperature increases (Denbigh and 
Turner, 1971) (Courtesy of Cambridge University Press); 
(b) increase in rate of a diffusion controlled reaction with 
reactor velocity 


Similarly, substitutingT 0 forT in Equation 33.2.26a 
In 0 m „ = - In A - E/RT 0 [33.2.27b] 

33.2.2 Identification of reactive hazards scenarios 

A review should be conducted to determine credible path¬ 
ways by which the identified reactive hazards can poten¬ 
tially pose significant threats to the process or equipment 
(Table 33.11). It is important to capture not only the devia¬ 
tion initiating a potential event, but also the sequence 
events that can follow. Care should be taken not to place too 
much credit for existing mitigations at this point to ensure 
that scenarios are not immediately dismissed before a 
proper assessment of risk is performed. Once reactive 
hazards scenarios have been identified and developed in 
such a review, the potential severity and frequency of each 
event can be evaluated. 

Emphasis in the review should focus on potential events 
that could lead to ‘high consequence’ events. This will 
encourage resources to be focused on the more significant 
scenarios. The definition of ‘high consequence’ will be spe¬ 
cific to the particular company or organization, but as a 
benchmark, potential events that can be life-threatening, 
substantially damage assets or cause production loss, 
severely impact the environment or damage the company’s/ 
organization’s reputation should be considered. Downtime 
can be caused by asset damage. It can also arise from a 
shut-down of facilities to address a violation of code or 
standard. In this manner, exceedance of more-stringent 
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Figure 33.22 Some principal types of variation of reaction rate with temperature (after Frost and Pearson, 1961): 

(a) kinetic-controlled reaction; (b) diffusion-controlled reaction; (c) sudden explosive reaction; (d) adsorption-controlled 
reaction; (e) side reaction; (f) equilibrium-limited reaction (Reproduced with permission from Kinetics and Mechanisms, 
2nd edn, by A.A. Frost and R.G. Pearson, Copyright ©, 1961, John Wiley and Sons Inc. Figure 32.22(b) is additional to 
the figures given by these authors) 



Figure 33.23 Temperature and self-heat rate of an 
adiabatic reaction (Townsend and Tou, 1980) (Courtesy of 
Elsevier Publishing Company) 


local regulations, which could threaten the unit’s license 
to operate, may also be considered a high consequence event. 

The review should focus exclusively on reactive hazards. 
Use of the Hazard Operability (HazOp) method (with stan¬ 
dard ‘guidewords’) can bring a structured, thorough 
approach to identifying deviations. However, it can also 
cause the review to spend substantial time on safety mat¬ 
ters unrelated to reactivity. It may be most expedient to 
devote attention to deviations that have some possibility for 
high consequence outcomes. 


Table 33.11 Examples of standard initiating events 
and upset scenarios 


1. High start or operating temperature 

2. High reactant concentration 

3. Low solvent or diluent concentration 

4. High level 

5. High catalyst concentration 

6. Low catalyst concentration 

7. Increased heating or decreased cooling to process 

8. Fire exposure 

9. Loss of power 

10. Contact between usually separated, reacting chemical 

11. Exposure of air-sensitive or water-sensitive materials 

12. Handling of dust-generating material 

13. Potential to accumulate or ‘pool’ reactant (e.g. during 
unit start-up) 

14. Special start-up or shut-down issues 

15. Change of catalyst type, grade or supplier 

16. Phase separation of reactants 

17. Unexpected loss of (catalyst) activity 

18. Change in residence time (including extended storage 
time of reactive intermediates) 

19. High flow 

20. Low or no flow 

21. Low start or operating temperature 

22. Sudden change in flow or pressure (gas) 

23. Procedure steps out of order 

24. Slop tank operation 

25. Feed change 

26. Disturbances in linked units or shared equipment 

27. Transients in recycle streams 

28. Backflow or feed upsets from linked units 
2 9. Heat exchanger leakage 
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Guidewords and pathways pertaining to normal opera¬ 
tions, off-normal operations (including start-ups and 
shut-downs) and deviations from normal operations should 
be examined. The resultant sequence of events that could 
ultimately lead to a high consequence incident is then 
captured. In general, the determination of the actual con¬ 
sequence for a particular scenario can require significant 
time to set up and carryout the needed calculations. Follow¬ 
up is therefore assigned to the appropriate resource to 
validate the perceived consequence after the review. 
Thus, the risk is not assessed in the review; rather it is best 
carried out subsequently. For this reason, existing and 
anticipated mitigation measures are not discussed exten¬ 
sively at this stage. 

Examples of reactivity-related initiating events appear 
in Appendix C. This list, as well as a list of previous inci¬ 
dents, can be examined to ensure that these events have 
been considered in the review. 

Given the potential for a high consequence incident 
arising from a reactivity event, it may be prudent to con¬ 
sider selected multiple jeopardy scenarios (a ‘jeopardy’ 
being an initiating deviation, not including a failed 
response by people or instrumentation to a deviation). The 
number of combinations of deviations can be quite large, so 
attention should be directed towards those combinations of 
jeopardies in which the reactive hazards of the process can 
be manifested as high consequence events. Note that a run¬ 
away reaction itself is not a jeopardy but a consequence of 
operating under upset conditions. This means that, for 
example, heat input from a plant fire leading to an 
increased reaction rate is a single jeopardy scenario. 

Since each facility is unique in equipment configuration, 
operating conditions, operating procedures and perhaps 
even in species compositions, care should be taken that 
scenario identification focus on the specific facility being 
addressed and that the reviewbe thorough. Similar process 
units, even if in different manufacturing locations, will 
likely have many scenarios in common but the unique 
aspects above can result in generation of distinct scenarios. 
It is conceivable that two facilities at the same manu¬ 
facturing location can have differing scenarios. 

The review for an entire facility can extend to all process 
equipment (typically, the vessels and tanks) - that is, not 
just the reactor. When conducting such reviews, it is good 
practice to ‘divide’ a process unit into subsections or ‘nodes’ 
to reduce the complexity of the process. Example nodes can 
be: feed preparation, pre-reactor separations, reactor, post¬ 
reactor separations, finishing and product/off-spec/by- 
product storage. For change management, small projects or 
incident follow-up studies, a narrower selection of equip¬ 
ment may be acceptable. 

It is beneficial to provide to the review team documenta¬ 
tion summarizing the reactivity information as well as 
Process or Engineering Flow diagrams. Process and 
Instrumentation diagrams can serve as a reference in case 
more specific information is needed. 

To ensure that the process is thoroughly studied with 
ample consideration for actual operating practice and con¬ 
figurations, the review team should include the following 
as participants: 

(1) Process support engineer; 

(2) Plant support engineer; 

(3) Plant operator; 

(4) RHA specialist. 



Figure 33.24 Self-heat rate and heat transfer of a 
reaction with cooling: (Townsend and Tou, 1980) T B , 
temperature of heat exchanger; T NR , temperature of no 
return; T a initial temperature; dash (') indicates alternative 
set of values (Courtesy of Elsevier Publishing Company) 


In addition, an identified facilitator, scribe and safety spe¬ 
cialist may be required (though these roles may be carried 
out by the listed attendees). 

All likely scenarios should be described in detail indicat¬ 
ing clearly what the cause of the scenario is, how the unmiti¬ 
gated scenario develops, and what the ultimate consequence 
might be. In addition, the resource to be employed in follow¬ 
up, where needed, and the type of follow-up are recorded. 

33.2.3 Reactive hazards risk assessment 
Issues during scale-up 

Consider a system with external cooling. The heat genera¬ 
tion and heat removal curves for such a system are shown in 
Figure 33.24. As the reaction rate and, hence, the heat evo¬ 
lution increase, a temperature may be reached at which the 
rate of heat evolution exceeds the heat removal capacity of 
the system; this is the temperature of no return T NR . From 
Equation 33.2.16 the rate of heat evolution Q e is: 

Q e = AfCyAoATabCT 1 2 3 4 [33.2.28] 

The rate of heat removal Q r is: 

Q r = WAc(To ~ T c) [33.2.29] 

where A c is the surface area for heat transfer, T c is the 
absolute temperature of the coolant, and U is the overall 
heat transfer coefficient. Equating the heat evolution and 
removal rates given in Equations 33.2.28 and 33.2.29 

Mc v A exp JLJ ATabQT 1 = UA C (T 0 - %) [33.2.30] 

It can be seen from Figure 33.24 that Equation 33.2.30 has 
two solutions. No runaway reaction should occur if the 
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initial temperature of the reaction massT 0 is below a critical 
valueTo and the temperature of the coolant T c is below a cri¬ 
tical value T c . But as T 0 increases to the temperature of no 
returnT nr) there is a single solution. At this point, the slope of 
the line of heat evolution equals that of the line of heat 
removal.Then from Equations 33.2.9,33.2.28 and 33.2.29: 

Mcyk d AT ab C[[ _1 = UA C [33.2.31] 

The time 9r nl to the maximum rate at the temperature of no 
return T nl is, from Equations 33.2.27a and 33.2.31: 


9 ° 

Tm k ) AT zb Q' i ^E 
_Mc v 
~UAc 


[33.2.32a] 

[33.2.32b] 


The group ( Mc v /UA C ) is known as the ‘equipment time line’. 

The case where the maximum self-heat rate coincides 
with the initial self-heat rate is of interest. For this: 


Wm = mo [33.2.33] 

and 

T m =T 0 = T* [33.2.34] 

say, where T* is the minimum initial absolute temperature 
above which only deceleration of the reaction occurs. 

Then from Equations 33.2.19 and 33.2.34 and noting that 

T f = A T ab + T [33.2.35] 

T* = ( EAT ab /nR) lf2 [33.2.36] 

Thus, theoretically, there exists a temperature above which 
the effect of concentration depletion on the reaction rate is 
greater than that of acceleration due to temperature. 

The parameters used in the foregoing analysis are the 
true parameters of the reaction. In practice, they have to be 
calculated from experimental measurements, which are 
affected by the thermal capacity of the container. The true 
adiabatic temperature rise AT ab is related to the adiabatic 
temperature rise AT abs of the sample: 

Mc v AT ab = (Mc y + M b c vb )AT abs [33.2.37] 


AT ab = <j>AT abs [33.2.38] 

^ = 1 + lgf [33-2.39] 

where c vb is the specific heat of the sample container and 
M b is the mass of the container. The quantity <f> is the ther¬ 
mal inertia and its reciprocal is a measure of the degree of 
adiabaticity. Similar corrections apply to the other mea¬ 
sured quantities: 

wo = </>«os [33.2.40] 

0 m = 9 ms /<j> [33.2.41] 


where m os is the measured self-heat rate at temperature T 0 
and 9 ms is the measured time to maximum rate at tempera¬ 
ture T. 


Consequence assessment 

The intent of consequence assessment is to determine 
which scenarios need prevention or mitigation action. This 
facilitates effective utilization of resources for evaluation 
and implementation. Scenarios that have been generated 
are screened and evaluated for potential to lead to high 
consequence events. Each scenario found to be capable of 
yielding a high or excessive consequence event is high¬ 
lighted and may be addressed through likelihood assess¬ 
ment and risk reduction measures, if needed. 

In consequence assessment, all scenarios generated 
should be evaluated based on the consequences with 
regards to the design of the unit (e.g. design pressure, 
design temperature or depending on local regulations the 
temperature where failure in the metallurgy is experi¬ 
enced). If the consequence is not evaluated, then the like¬ 
lihood directly should be evaluated along with a decision to 
ensure that the likelihood falls below the corporate or 
organization’s tolerable risk frequency. 

Reactive hazards, by definition, lead to an excursion in 
temperature and/or pressure. To ascertain whether a high 
consequence event could occur, the extent of temperature 
and pressure rise associated with each scenario should be 
evaluated. This test can be carried out by a variety of 
means, including spreadsheet calculations for simple 
steady-state operations or a dynamic simulation for more 
complex systems. 

In evaluating the consequences of a scenario, it may be 
prudent to take no credit for operator procedures and 
training, instrumentation and mechanical relief (these can 
be examined during likelihood assessment). However, 
inherent constraints to the development of the con¬ 
sequence, such as maximum heating medium temperature, 
equilibrium (thermodynamic)-limited reactant conversion 
or catalyst deactivation, etc., can be accounted for in the 
calculations. Continued exposure to an external fire heat 
input combined with reaction heat, though, can lead to 
temperatures far beyond the rating of the equipment. In a 
fire exposure scenario in which reaction is taking place, the 
consequence can be presumed to be high, and the calcula¬ 
tion will essentially determine the time taken to exceed 
allowable levels. (The appropriate standard, e.g. NFPA 30 
or API RP 521, should he applied for the heat input flux.) 

For effective use of resources, it may be advisable to 
identify scenarios, at an early stage, that can serve as 
worst-case scenarios for similar scenarios. In this manner, 
if the worst-case scenarios do not yield a high consequence, 
neither will the lesser scenarios. However, if the more 
severe scenario does have potential to yield a high con¬ 
sequence, the consequences of the successively less severe 
scenarios should also be evaluated so that proper safe¬ 
guarding can be performed. 

The resultant maximum temperature and pressure 
should be compared to appropriate criteria (e.g. design 
temperature, design pressure and material properties) to 
determine whether the consequences are high or not. Inter¬ 
nal corporate or organizational criteria can serve as a 
minimum for this purpose. National, state or local regula¬ 
tions may impose stricter criteria that must be followed. For 
example, the exceedance of equipment design temperature 
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is prohibited in some countries and can be considered a 
threat to a facility’s license to operate. 

Consequence assessment results should be summarized 
for each corresponding scenario generated from the review. 
The extent of temperature and pressure rise, what further 
action (if any) is needed and whether the scenario should be 
addressed via likelihood assessment should be docu¬ 
mented. 

Mixing and heat transfer 

The reaction and heat transfer behaviour of the reactor is 
strongly affected by the degree of mixing. There may well 
be departures from near-perfect mixing, and with highly 
viscous reaction masses these may be considerable. 

The IChemE Guide gives two models of the profile of the 
temperature between the centre of the reaction mass and 
the wall. The first is a uniform temperature, the Semenov 
model, applicable where the reaction mass is well mixed. 
The second is a sigmoidal temperature profile, the 
Frank-Kamenetsky model, applicable where the mass is 
unmixed. This latter model is fundamental to thermal 
explosion, or self-heating theory and is treated in Chapter 
16. Reactor situations where the temperature in the reaction 
mass is liable to rise may be treated using thermal explo¬ 
sion models. 

The conventional treatment for the case where the mass 
is poorly mixed is the Frank-Kamenetsky thermal explo¬ 
sion model, as described in Chapter 16. Specifically, the 
equations generally quoted are those used in relation to 
the experimental determination of the critical value of the 
ignition parameter 5c, namely Equations 16.6.107- 
16.6.109. 

The Guide also quotes the simpler treatment by 
Leuschke (1981), which yields the relation: 

ln~cx~ [33.2.42] 

where S is the surface area of the mass, T d is the minimum 
decomposition temperature, and Fisthevolume of themass. 

With regard to heat transfer coefficients, correlations are 
available for the heat transfer coefficients on the inside of a 
stirred reactor and on the outside of the vessel in the jacket. 
Accounts of reactor heat transfer coefficients are given by 
Chapman and Holland (1965a,b). A method widely used for 
the film heat transfer coefficient on the inside of the vessel 
is that of E.E. Wilson (1915). The effect of agitator geometry 
on this coefficient may be taken into account by the use of a 
geometric factor, and a correlation is available for this fac¬ 
tor also. Details are given in the IChemE Guide, which also 
discusses cases that are non-ideal due to non-Newtonian 
behaviour, and so on. The Guide also gives a treatment of 
reactors operated under reflux conditions. 

Reaction simulation testing 

The testing described thus far is fairly formal, employing 
specific laboratory tests within the framework of a test 
scheme. One of the recognized tests, however, is the Dewar 
flask test in which the conduct of the reaction is explored. 

There are a number of accounts of various laboratory 
tests conducted to explore the conduct of the reaction. 
Coates and Riddell (1981a,b) have described a ‘worst case’ 
analysis of a nitration reaction in a semi-batch reactor. 
The heat of reaction and the rate of heat evolution were 


determined in a calorimeter and used to select the time over 
which the fed reactant should be added, or the ‘addition 
time’. Non-normal conditions were investigated such as 
accumulation of unreacted nitric acid in the reactor and the 
effect of this on the temperature of the reaction mass when 
reaction did occur. These authors also describe two other 
reaction studies. 

The IChemE Guide describes the use of Dewar calori¬ 
metry to mimic the plant reactor and explore reactor con¬ 
figurations, agitation, cooling and heating systems, 
addition of gases, liquids and solids, and so on. 

33.2.4 Batch reactors: basic design 
Inherently safer design 

The application of the principle of inherently safer design 
to the choice of reaction route was described in Section 11.7 
of Chapter 11. An account is given here of its application to 
batch reactors, which has been advocated particularly by 
Regenass (1984). The approach described by this author 
depends essentially on the avoidance of high concentra¬ 
tions of the reactants. One method of limiting reactant 
concentration is the use of a semi-batch, or ‘fed-batch’, 
reactor in preference to an ‘all-in’ batch reactor. In the latter, 
all the reactants are added in the initial charge; in the for¬ 
mer, one of the reactants is added continuously. The hazard 
in the all-in design is that conditions may occur in which 
there is a sudden massive reaction of the unreacted reac¬ 
tants. This is liable to occur, for example, on resumption of 
agitation after an agitator failure. In the semi-batch reactor, 
the continuous feed arrangement, combined with a suitable 
reactor temperature, keeps the concentration of one of the 
reactants relatively low and it is possible to effect prompt 
shut-off of the feed if a potentially hazardous operating 
deviation occurs. 

The full benefit of the semi-batch reaction mode does 
depend, as just indicated, on the adoption of a suitable 
reaction temperature. If this temperature, and therefore the 
reaction rate is too low, accumulation of the fed reactant can 
occur. The reaction temperature should be high enough to 
ensure that the reaction proceeds sufficiently rapidly to 
avoid accumulation. 

An example of the application of this principle has been 
given by Fierz et al. (1983,1984), who describe the design of a 
semi-batch reactor for the further nitration of a substituted 
nitrobenzene. Two operating temperatures were investi¬ 
gated—80°C, and 100°C—using a bench scale calorimeter 
(BSC). At 80°C, shut-off of the feed atthe worst instant, when 
the reactants are present in equimolar proportion, resulted 
in heat release before and after shut- off of 90 and 180 kj/kg of 
final reaction mass, respectively, whilst at 100°C the corre¬ 
sponding figures were 190 and 80 kj/kg. At the lower oper¬ 
ating temperature, the heat release was sufficient under 
adiabatic conditions to give atemperature rise of 110°C, tak¬ 
ing the temperature to 190°C, at which temperature an 
undesired exotherm would occur, whilst at the higher oper¬ 
ating temperature, the adiabatic temperature rise was only 
40°C, taking the temperature to only 140°C. Figure 33.25 
shows results obtained from the BSC work. 


Safe operation criteria 

Methods are available for the prediction of safer operating 
regimes for both batch and semi-batch reactor modes. One 
approach is based on the application of the Semenov ther¬ 
mal explosion model to the case of a well mixed reactor. This 
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Figure 33.25 Heat effects in a semi-batch reactor at reaction temperatures of (a) 80° C and (b) 700° C (Fierz et al., 1984) 
(Courtesy of the Institution of Chemical Engineers) 


model applies to a liquid mass with agitation and convec¬ 
tion. An account is given by Grewer et al. (1989). 

A limiting condition for the reactor with cooling but 
without reaction can be derived from the adiabatic induc¬ 
tion time. This is: 

^=-k0 [33.2.43] 


ro = kcAoCBo [33.2.47] 

where c is the concentration, k is the reaction velocity con¬ 
stant, r is the rate of reaction, n is the effective order of the 
reaction and subscripts A, B and 0 indicate reactant A, 
reactant B and initial conditions, respectively. For a semi¬ 
batch reaction a relation which fits most cases is: 


UA C 

~ Vcpp 


[33.2.44] 


(1-Z)(//t d -Z) 
0 1+7d//F 0 td 


[33.2.48] 


where A c is the surface area for heat transfer, c v is the spe¬ 
cific heat of the reaction mixture, t is the time, U is the 
overall heat transfer coefficient, V is the volume of the 
reaction mixture, K is the cooling parameter, 9 is a dimen¬ 
sionless temperature difference, and p is the density of 
the reaction mixture. The critical condition for thermal 
explosion is: 


with 

ro = kcAoCEU [33.2.49] 

where Vd is the volume of addition, Vo is the initial volume, 
t d is the time of addition and subscript D indicates addition. 
The authors define a thermal reaction parameter B: 


where e is the base of the natural logarithm. 

The authors define the degree of conversion Ain terms of 
the fraction of heat released. They state that experience 
shows that for a batch reaction the following equation may 
be used: 

r = ro(l-Xf [33.2.46] 


_ gAT ad 

RT2 


[33.2.50] 


where E is the activation energy, R is the universal 
gas constant, T is the absolute temperature, and AT ad is 
the adiabatic temperature rise. They state that in rela¬ 
tive terms a reaction can be regarded as non-critical pro¬ 
vided that for batch reactions B < 5 and for semi-batch 
reactions B <10. 
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Another important parameter is the Damkohler number 
Da, which is a measure of the rate of reaction: 


Da = 1 u> 0 [33.2.51] 

co 

where Cq is the initial concentration of the limiting minor 
component, and v u is the stoichiometric coefficient of that 
component. 

For a batch reaction the aim is to have a slow or only 
moderately fast reaction so as to avoid overloading the 
cooling capacity. For this Da<l is a suitable condition. By 
contrast, for a semi-batch reaction the aim is to maintain a 
reaction rate sufficiently fast to prevent the accumulation 
of reactants. This is assured provided that Da>100. 

A measure of the cooling capacity is given by the Stanton 
number St: 

St = Kt [33.2.52] 

where for a hatch reactor t is the reaction time and for a 
semi-batch reactor it is the time of addition x D . 

For reactors with jacket cooling only a further criterion is 
the ratio of the Damkohler and Stanton numbers Da/St, 
known as the ‘stability’. For a batch reactor, the ratio Da/St 
should be «1 and for a semi-batch reactor it should be >1. 
For a multi-phase reaction, an effective Damkohler number 
is used which takes into account additional mass transfer 
phenomena. 

The foregoing applies to the case of a well-mixed reactor 
at more or less constant temperature. Other conditions, 
particularly stoppage and restart, may be allowed for by 
using in the Damkohler number a critical temperature. For 
a batch reactor this critical temperature is the highest tem¬ 
perature which can occur in the reactor, and for a semi¬ 
batch reactor it is the lowest which can occur. This latter is 
the reference temperature T re( defined as: 

Tj + str c 
rei “1 PI" 

where subscripts c, f and ref indicate coolant, feed and 
reference, respectively. The reference temperature is the 
temperature produced in the reactor by feed addition and 
by cooling, but without reaction, and is the lowest which 
can occur, because the feed temperature is usually less than 
the jacket temperature. At this temperature, the rate of 
reaction is lowest and the danger of accumulation of reac¬ 
tants highest. 

Reactor modelling 

The most fundamental understanding of the reaction sys¬ 
tem is obtained by modelling it. An account of such model¬ 
ling has been given by Gordon et al. (1982). These authors 
describe the modelling of the reaction of the amination of 
o-nitrochlorobenzene (ONCB) with aqueous ammonia 
under pressure to produce o-nitroaniline (ONAN). The 
study included the determination of the heat of reaction 
and the reaction kinetics for the animation and the heat of 
reaction and reaction kinetics for the decomposition of 
ONAN. The model was validated by comparing model pre¬ 
dictions with ARC results and with temperature and pres¬ 
sure profiles of the plant reactors in normal operation and 
from a reactor incident. 


Difficult reactions 

One type of reaction that may be difficult to handle is one 
with a low activation energy, since this means that the reac¬ 
tion rate increases very rapidly with temperature. Another 
difficult type of reaction is one in which the vapour pressure 
of the reaction mixture is low. In this case, high temperatures 
can be reached before the pressure relief system responds. 
This problem is discussed by Regenass (1984). 

Secondary reactions 

In addition to the primary reaction, there may be one or 
more secondary reactions. If such a secondary, or side, 
reaction is exothermic, it may constitute a hazard. This 
problem has been discussed by Grewer et al. (1989). 

Whether a secondary reaction occurs may be established 
using DTA. If it does, the temperature T s at which the sec¬ 
ondary reaction takes place is estimated by subtracting 
100 K from the start of the reaction as given by the DTA. 
This estimate of T s is compared with the reaction tempera¬ 
ture T r or the maximum possible reactor temperature T max : 

r max = T r + A r ad [33.2.53] 

where AT ad is the adiabatic temperature rise (K), T max is 
the maximum absolute temperature (K), T r is the reactor 
temperature (K), and T s is the absolute temperature of the 
secondary reaction. If the estimate of T s is greater thanT max 
there is no hazard and further investigation is not required. 

Use may also be made of the reaction energy of the 
secondary reaction. This may be obtained from the DTA by 
integration. A small reaction energy of<110-220 kj/kg or 
an adiabatic temperature rise of<50-100 K indicates there 
is no hazard. 

If the DTA does not yield clear-cut conclusions, it is 
necessary to obtain T s more precisely. The AZT 24 may be 
determined. If this temperature is greater thanT max , again 
there is no hazard. 

If T s lies betweenT r and T max there may be an appreciable 
hazard, but it may still be possible to carry out the reaction 
provided it can be ensured that the reactor temperature 
does not reach T s during the primary reaction. Alter¬ 
natively, if this cannot be guaranteed, use may be made of 
appropriate protective measures. Operation in this region 
is a specialist matter. 

If T s for a highly exothermic reaction is equal to or less than 
T„ it is rarely possible to carry out the primary reaction 
safely.These guidelines are summarized in Figure 33.26. 


Decompositions 

Grewer et al. (1989) give the following guidance on decom¬ 
position reactions. For single phase decomposition of 
organic substances, if the decomposition energy based on 
total reaction mass is<100-200 kj/kg, which corresponds 
roughly to A/ ad ~ 50-100 K, the effect of the decomposition 
is generally not critical. Even for a decomposition energy 
above the range just quoted, the effect may not be critical if 
there are other compensating effects such as endothermic 
reactions or high heat removal capacity. For inorganic sub¬ 
stances the criterion decomposition energy should be 
lower, due to the lower specific heat, whilst for substances 
containing water it should be higher. The authors state that 
the decisive criteria are the adiabatic temperature rise AT ad 
or the thermal reaction parameter B, which should not 
exceed about 8. 
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Case 1 Case 2 Case 3 

Safe Harmless Difficult Safe Dangerous 

but 

Figure 33.26 Hazards of side reactions (Greweretal., 1989) P, primary reaction; S, secondary reaction; T max , maximum 
reactor temperature; T R , temperature of reactor; T s , temperature at which secondary reaction occurs; A T ad , adiabatic 
temperature rise 


Spontaneous ignition 

Another hazard of batch reactors is spontaneous ignition of 
vapour—air mixtures in the vapour space of the reactor. 
Work on this has been described by Snee and Griffiths 
(1989). The problem arises particularly in resin manu¬ 
facture. Experiments were performed using cyclohexane 
as a substrate related to the components of resins, employ¬ 
ing vapour-rich mixtures with molar ratios of cyclohexane/ 
air of 1:2, in closed vessels in the size range 0.2-20 dm 3 . 

The work showed that fuel-rich mixtures undergo auto- 
catalytic isothermal oxidation, that in this situation the 
temperature may be increased by self-heating and that as a 
result spontaneous ignition can occur. Self-heating was 
found to set in at temperatures just below the autoignition 
temperature. The minimum temperature for spontaneous 
ignition decreased as vessel size increased. Using the 
Semenov thermal explosion model, the authors were able to 
make comparative predictions of the trend of the minimum 
temperature with vessel size, but state that absolute pre¬ 
dictions would require extremely accurate kinetic data. 

Heat loss from reactors 

Information on the rate of heat loss from a batch reactor has 
been given by T.K. Wright and Rogers (1986). They give data 
on cooling, mainly over the temperature range 96-80°C, 
for a range of reactors, of different sizes, stirred and 
unstirred, with different thicknesses of insulation and with 
none, and with jackets full and empty. The data are for 
reactors in the full condition. 

They correlate the data by plotting the rate of cooling 
against the cube root of the volume, on the assumption that 
the rate is proportional to the surface/volume ratio of the 
reactor, which for a sphere is proportional to the reciprocal 
of the radius or of the cube root of the volume. Their results 


are shown in Figure 33.27. Also shown in the figure are the 
rates of heat loss from 250 and 500 ml Dewar flasks. These 
entries show that these flasks have heat losses comparable, 
respectively, to 0.5 and 2.5 m 3 reactors and will not give a 
satisfactory simulation above these reactor sizes. 


33.2.5 Likelihood assessment 

All scenarios identified as yielding high consequences are 
examined to determine the risk, if existing safeguarding 
measures are adequate, and if any additional measures are 
needed to reduce the risk to tolerable levels. The initial 
basis for evaluation can be the existing safeguarding phi¬ 
losophy and measures (including instrumentation, 
mechanical relief, kill systems, etc.) of the unit considered. 

The risk associated with a scenario is the combined 
likelihood and consequence for that scenario. For scenarios 
that are ranked as ‘high’ consequence, the likelihood can 
be evaluated in qualitative terms (e.g. has already occ¬ 
urred in the company, has occurred in industry, etc.); semi- 
quantitative terms, as determined through, for example, a 
Layers of Protection Analysis (LOPA); or in quantitative 
terms, through a fully-executed Quantitative Risk Assess¬ 
ment (QRA). In LOPA, standard failure frequencies for 
various actions and barriers are combined with the safe¬ 
guarding scheme logic to yield the likelihood of occurrence 
of the overall scenario consequence (not just the initiating 
event). This approach is much more expedient and much 
less resource-intensive than performing a rigorous QRA, 
thus making the LOPA an attractive balance between cost 
and meaningful results. 

The likelihood assessment should take into account the 
availability and reliability of relevant factors in the possi¬ 
ble development of a scenario. For example, probability of a 
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Figure 33.27 Natural heat loss from reactors (T.K. Wright and Rogers, 1986) (Courtesy of the Institution of 
Chemical Engineers) 


deviation, process instrument failure, human error and 
human intervention can all be considered. 

A process safety risk specialist with appropriate train¬ 
ing should be involved in performing LOPA or QRA to 
determine the high consequence scenario likelihood. A 
process support or plant engineer as well as a reactive 
hazards specialist should provide input and guidance to 
the risk specialist to aid the likelihood calculations. 

Once the likelihood has been obtained, the composite of 
the likelihood with the consequence gives the risk of the 
scenario reactive hazard. This risk should not exceed 
the corporate or organizational risk criteria. If the like¬ 
lihood of an individual high consequence scenario does 
not exceed the tolerable threshold, then the scenario may 
be declared to be adequately safeguarded. In case the 
existing safeguarding measures cannot adequately reduce 
the consequence or likelihood of the high consequence 
scenarios, additional safeguarding or recovery measures 
are required. This may prompt the need to modify the 
safeguarding philosophy. 

The selected set of measures to address scenarios with 
unacceptable risk should be based on regulatory require¬ 
ments as well as technical and economical feasibility. In 
most cases, it will consist of a combination of several types 
of measures. The revised safeguarding philosophy should 
build upon the existing unit safeguarding philosophy and 
include extensions or changes recommended by plant 
operations, plant engineering, technical support staff and 
reactive hazards experts. 


33.2.6 Prevention measures 

In general, prevention is the preferred route to eliminate or 
reduce the consequences of high consequence scenarios. 
However, in practice this often requires significant process 
modifications that might not be economically feasible for 
existing units, as equipment might require changes. For 
new projects, however, this should be a major considera¬ 
tion in the design of the unit. Prevention measures can be 
divided in two categories - changes in process conditions 
(process changes) and changes to the hardware (design 
changes). 

Process changes (inherent safety) 

Process changes make the process inherently safer as they 
are inherent to the chemistry and therefore reduce the con¬ 
sequences of a scenario or eliminate a scenario. Some 
examples are given below: 

(1) Limiting the concentrations of the reactants (e.g. 
feedstock specification), which can reduce the max¬ 
imum adiabatic end temperature and pressure to 
within the design limits of the unit. 

(2) Change to a non-reactive solvent. 

(3) Use of a different catalyst resulting in a lower operat¬ 
ing temperature; however, such changes can often be 
a source of problems because it can make other unde¬ 
sirable reactions occur significantly at even lower 
temperatures, and the effects should be thoroughly 
tested. 









REACTIVE CHEMICALS 33/43 


Hardware changes 

Hardware changes comprise any changes in equipment/ 
hardware, excluding mechanical relief systems. Some 
examples are given below: 

(1) Remove heating coil from storage tank to prevent 
product decomposition; 

(2) Remove linework to prevent mixing of incompatible 
materials; 

(3) Upgrade pressure rating of vessel (increased design 
pressure); 

(4) Reduce flow rates by restricting orifices or smaller 
control valves; 

(5) Eliminate or substantially reduce storage of reactive 
intermediate species. 

33.2.7 Mitigation Measures 

The initial basis for mitigation is the existing safeguarding 
philosophy of the unit considered. The actual safeguarding 
philosophy employed can be dependent on regulatory 
requirements as well as the amount and type of risk posed by 
the scenarios. For example, relief venting is frequently a 
more cost-effective means than high integrity instrumenta¬ 
tion to limit pressure build-up in equipment. However, in 
several countries, relief venting is not the preferred option, 
particularly when potentially toxic or corrosive materials 
could be released. Moreover, there are cases where relief 
venting does not act as a mitigation measure, such as weak¬ 
ening of vessel wall integrity due to temperature excursions 
during syngas methanation. Two common categories of 
mitigation measures, instrumentation and emergency relief 
venting, are discussed in more detail elsewhere. 

Addition of any single prevention or mitigation option or 
a combination thereof can be considered. Once intolerable 
risk levels are precluded, alternative mitigations can be 
evaluated through a cost/benefit analysis. 

The outcome of this phase of the work should be docu¬ 
mented for each scenario, indicating whether the existing 
safeguarding philosophy and safeguards are adequate or, 
if not, what specific measures are recommended. 

Instrumentation and control 

Safe operation of a batch reactor requires close monitor¬ 
ing and control of reactant and additive flows to the 
reactor, of the operating temperature and of the agita¬ 
tion. For the operating temperature, the temperature at 
which an uncontrolled exotherm will occur under plant 
conditions is first defined. A safety margin is set between 
the operating temperature and this plant exotherm 
temperature. The operating temperature is displayed and 
provided with an alarm. The reaction temperature is con¬ 
trolled by a coolant. 

The measurement of the temperature of the reaction 
mass should receive careful attention. The instrument 
should not allow a hot spot to develop undetected and it 
should not have a large time lag or a high failure rate. It is 
good practice to have separate measurements for the tem¬ 
perature control loop and the temperature alarm. 

Events which may cause the temperature to go out 
of control, such as agitator or coolant failure, are identi¬ 
fied. Actions which can be taken to counter an increase 
in operating temperature such as shut-off of feed or use of 
full cooling are identified, and appropriate actions are 
selected to be activated either by operator intervention or 
by trip. 


Too low an operating temperature may also pose a hazard 
in that it allows reactants to accumulate. A lower tempera¬ 
ture limit should be specified and measures taken to 
maintain the temperature above this limit. 

Loss of agitation has two effects, poor mixing and poor 
heat transfer. Poor mixing tends to lead to the accumulation 
of reactants. These reactants are then liable to react at some 
later time, particularly if the agitation is restored. Poor heat 
transfer may result in inadequate cooling. Either effect may 
lead to a runaway reaction. Provision should be made to 
detect loss of agitation, which may occur due to agitator 
stoppage or due to loss of the agitator paddle. The first 
condition may be detected by measuring the rotational 
speed, the latter by measuring power consumption. The 
action to be taken on loss of agitation depends on the reac¬ 
tion. In semi-batch reactors, it is common to provide a trip to 
shut off the feed. 

The importance of matching the controls to the reaction 
and the danger of overenthusiastic use of generic controls 
has been highlighted by Brannegan (1985). More sophisti¬ 
cated measurement may be provided in the form of an 
on-line reaction calorimeter. Such a calorimeter has been 
described by Hub (1977c). 

Increasingly, reactor control is based on computers or 
programmable electronic systems (PESs). The HSE guide¬ 
lines on PESs give as an illustrative example the control of a 
nitration reactor. The example includes a full fault tree and 
failure data for the tree. An account is given in Chapter 13. 

Emergency safety measures 

There are a number of emergency measures that can be 
taken if a process deviation occurs that threatens to lead to 
a reaction runaway. The prime measures are: 

(1) inhibition of reaction; 

(2) quenching of reaction; 

(3) dumping. 

The reaction may be stopped by the addition of an inhibitor, 
or short stop. This involves the use of an inhibitor specific 
to the reaction in question. The effectiveness of inhibition, 
including the dispersion of the inhibitor within the reac¬ 
tion mass, needs to be demonstrated. 

Quenching involves adding a quenching agent, usually 
water under gravity, to the reaction mass to cool and dilute 
it. This method requires that there be sufficient free space 
in the reactor to receive the quench liquid. 

The third method is dumping, which involves dropping 
the reactor charge under gravity into a quench vessel 
beneath which contains a quench liquid. 

Other methods that can be used to slow the reaction but 
are not generally ranked as prime emergency safety mea¬ 
sures include: 

(1) shut-off of feed; 

(2) direct removal of heat; 

(3) indirect removal of heat: 

(a) full normal cooling, 

(b) emergency cooling. 

If the reactor is a semi-batch one, it is often possible to design 
it so that the reaction subsides when the feed is shut off. This 
principle has already been discussed. Another possibility 
is to slow the reaction rate by the addition to the charge of 
a liquid, which removes heat by vaporization. Heat may also 
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be removed from the reactor by indirect cooling, either by 
application of full cooling on the normal cooling system or by 
the use of an emergency, or crash, cooling system. 

Disposal of vented materials 

The material vented from a reactor has to be safely dis¬ 
posed of. This aspect is intimately related to the venting of 
reactors and is therefore dealt with in Chapter 17. 

33.2.8 Batch reactors: Reactor safety 
Hazard identification 

The hazard identification methods described in Chapter 8 
may be applied to batch chemical reactors. This has been 
described by Pilz (1986), who refers to the use of a variety of 
techniques including a cause-consequence matrix, a hazop 
study, a FMEA, a fault tree, an event tree, and an incident 
sequencediagram(similartoacause-consequencediagram). 

A number of generic fault trees for reactors have been 
published. Figure 33.28 shows a fault tree given by the 
British Plastics Federation (BPF, 1979) and Figure 33.29 
one given by Marrs et al. (1989). 

Although for batch reactor plants the hazard of reaction 
runaway receives most attention, there are various other 
potential hazards which should not be neglected. Some of 
these have been discussed by Brannegan (1985). 

The reaction stage of a process tends to involve various 
operations additional to the actual reaction, such as quen¬ 
ching, scrubbing and disposal. These operations also may 
involve scale-up problems and should receive careful 
attention 

Basis of safety 

For a given batch reaction, it is necessary to decide on an 
explicit safety philosophy, or basis of safety. Different 
approaches are appropriate for different reactions. The 
design may be guided by the characterization of the reac¬ 
tion already described. 

Factors which affect the choice of the basis of safety 
include: 

(1) reaction mode (batch, semi-batch); 

(2) identified hazards and scenarios; 

(3) practicalities of protection options; 

(4) effect on reactor system operation; 

(5) regulatory requirements. 

In some semi-batch reactions the reaction may be, or may be 
arranged to be, such that shut-off of the feed is sufficient to 
cause the reaction to die out rapidly. In this case the design 
may depend mainly on this feature. 

Bases of safety treated in detail in the IChemE Guide are: 

(1) emergency relief; 

(2) reaction inhibition; 

(3) containment. 

There may be practical difficulties with each of these 
options. For example, with venting disposal may present a 
severe problem. With containment the cost may be prohibi¬ 
tive. Another option that is increasingly pressed is reliance 
on control and trip systems. Whether this is permissible 
depends on the regulatory regime. 

Selection of safety measures 

Accounts of the measures for the safe design of a batch 
reactor include those by Christen (1980), Brannegan (1985), 


Berkey and Workman (1987), and N. Gibson, Rogers and 
Wright (1987), and the IChemE Guide. The application of 
the principle of inherently safer design has already been 
described with special reference to the use of a semi-batch 
reactor and to reaction temperature. 

The approach described by N. Gibson, Rogers and 
Wright (1987) is based on formal process definition. Four 
levels of the process are defined: 

(1) Level 1: fixed operating parameters; 

(2) Level 2: normal variations in operating parameters; 

(3) Level 3: generic fault conditions; 

(4) Level 4: abnormal situations. 

In Level 2 consideration is given to normal variation in the 
operating conditions. Some of the deviations are well 
recognized, others less so. Thus there may be an expecta¬ 
tion that the temperature of a batch reaction could vary by, 
say, ± 10°C. It may be less well appreciated that the holding 
time at a particular step may extend from a normal one hour 
to, say, 12 h over a weekend. 

The effects of certain failures that are generic in that 
they apply to many reactions, such as loss of coolant, rup¬ 
ture of an internal coil, or agitator stoppage, is assessed in 
Level 3. The authors regard Level 3 as the minimum stand¬ 
ard that leads to an acceptable level of safety in the majority 
of processes. 

Level 4 is concerned with the large number of abnormal 
conditions that could conceivably lead to reaction runaway. 
These conditions may be explored using a method such as 
hazop. 

The process definition should cover the operating para¬ 
meters and the expected variations of these parameters 
(e.g. concentrations, temperature, hold times) and the 
details of the operations (e.g. pumping, agitation, cooling) 
which do not have assured protection by trips. 

The safety measures described by Gibson, Roger and 
Wright are essentially process control to prevent reaction 
runaway emergency measures to stop an incipient runaway 
and measures of containment or venting to provide protec¬ 
tion in the event that a runaway occurs. 

The IChemE Guide takes an essentially similar 
approach. 

Hazard assessment 

Where the hazards identified warrant it, the reactor design 
may be subject to hazard assessment. One case where 
such an assessment may well be called for is a proposal 
to provide reactor protection by means of trips rather 
than venting. Hazard assessment of batch reactors in con¬ 
sidered in Section 11.13 of Chapter 11. An illustrative 
example of such an assessment is given in Appendix 1 of 
the IChemE Guide. 

Implementation of safety measures 
The implementation of the safety measures selected is 
discussed by N. Gibson (1986b). His account is in effect an 
illustration of good practice in this aspect of the develop¬ 
ment of a process. The design and operating functions need 
to understand the basis of safety and the critical features of 
the measures proposed and the measures should be accep¬ 
table to them. The effect of any process or plant modifica¬ 
tion should be evaluated. It is then necessary that the 
safety measures are maintained. 
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(a) 



Figure 33.28 Generic fault trees for assessment of hazards of batch reactors - 1 (BPF, 1979) (a) fault tree 
for top event ‘uncontrolled exotherm'; (b) fault tree for top event ‘death or serious injury’ 
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Figure 33.29 Generic fault tree for assessment of 
hazards of batch reactors - 2 (Mans etal., 1989) (Courtesy 
of the Institution of Chemical Engineers) 


Regulatory strategy for reactors 

The strategy developed by the HSE for control of the hazard 
from reactors has been described by Pantony, Stilly, and 
Barton (1989). From the analysis of incidents the authors 
conclude that the following are prominent causes: 

(1) lack of understanding of the chemistry; 

(2) inadequate engineering of the heat transfer; 

(3) inadequate control and safety backup system; 

(4) inadequate operational procedures. 

They identify the need for guidance on: 

(1) thermal hazards; 

(2) vent sizing; 

(3) process control. 

For thermal hazards, the HSE has sought both to develop 
individual test methods to fill perceived gaps and to develop 
a test strategy. 

Furthermore, the HSE has encouraged the development 
at the South Bank University an independent centre, the 


Chemical Reaction Hazard Centre (CRHC), where contract 
testing for thermal stability and process reactions can be 
carried out, and has sponsored work there. The centre 
provides a resource potentially of particular benefit to 
smaller companies.Work there has been described by Nolan 
and co-workers (Cronin, Nolan and Barton, 1987; Nolan and 
Barton, 1987). Cronin, Nolan and Barton have described the 
test instrumentation test scheme used. For venting, the 
approach is based on the DIERS work with some further 
development. 

For process control, the HSE has sponsored the com¬ 
parative study by Lees, Marrs and co-workers of protection 
by venting and by instrumented systems (Marrs etal. 1989; 
Marrs and Lees, 1989), which has already been described. 

33.3 Programme management 

33.3.1 Resourcing 
Staff Skill 

It should be evident that the proper assessment of reactive 
hazards involves 

(1) collecting available reactivity information; 

(2) developing reactivity information where gaps are 
apparent; 

(3) determining conditions or circumstances in which the 
reactivity hazards can be manifested; 

(4) evaluating the risk and 

(5) preventing or mitigating risk where appropriate. 

These steps require various and specialized activities and 
skills. Understanding of chemistry as well as of reactive 
hazards is needed in Step 1. An ability to recognize the 
information gaps, familiarity with testing instrumentation 
and knowledge for designing experiments are skills 
necessary for Step 2. Experience with plant operations 
and with potential deviations from those operations is cri¬ 
tical for identifying credible scenarios in Step 3 (but not 
unique to assessment of reactive hazards). Detailed famil¬ 
iarity with estimating scenario consequences and like¬ 
lihoods, for example, through process simulation and 
LOPA, respectively, in Step 4 is key to determining risk. 
Expertise in various prevention or mitigation approaches 
in Step 5, such as two-phase reactive relief design or pro¬ 
tective instrumentation design, is important for handling 
intolerable risk. 

Training and experience are important elements for 
ensuring that the process is carried out in a sound, techni¬ 
cal manner. The skill-set needed for this work is highly 
specialized and should not be expected to be acquired in a 
short timeframe. 

In principle, different staff could be needed to carry out 
various phases of the entire process. If this is the case, 
overlap or a strategy for effective transfer of knowledge 
between phases is necessary for continuity. 

Participation and ownership 

Experts in the reactivity area cannot efficiently assess 
the reactive hazards without input from process support 
and plant operations personnel. Substantial time spent 
re-discovering chemistry or learning about plant opera¬ 
tions can be avoided when a team of reactive hazards 
experts, process support staff and plant operations staff 
work in concert. 
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Moreover, an equally important consideration toward 
building a cross-functional team is ‘product ownership’. 
Crucial stakeholders, such as the technology and opera¬ 
tions organizations, will give greater credibility and more 
easily accept the work product from a team that also repre¬ 
sents them. Without such a team approach, there is a serious 
risk that the entire effort may be conducted in futility, 
because, in the end, no changes in the manufacturing 
facility may ever be implemented. 

Timing and cost 

The effort required for detailed experimental evaluation, 
kinetics extraction, process simulation model development 
and two-phase reactive relief evaluation can be formidable. 
It would be prudent to develop estimates for the extent of 
these activities as far in advance as possible and to budget 
accordingly. 

In addition to the cost of staffing for the assessment of 
reactive hazards, there may be significant costs with 
acquisition and maintenance of equipment (such as calori¬ 
meters) as well as software (such as process simulators). 

In addition to the possible significant cost associated 
with the effort, the amount of calendar time to carry out a 
complete evaluation (from collecting and analyzing data to 
designing safeguards) can be months or longer. 

33.3.2 Risk management 

To effectively manage risk (not just from reactive hazards), 
a company or organization should have its own definitions 
and methodology for assigning the level of risk Chapter X. 
The risk level can then serve as one criterion for prioritiz¬ 
ing activities, investments, and expenditures. 

An important element for facilitating decisions on issues 
(that are not driven by regulatory compliance) is the cor¬ 
porate or organization risk tolerance. This simply indicates 
the chosen level, below which, the risk is deemed to be 
‘tolerable’ or ‘acceptable’. A well-defined and documented 
risk tolerance level is useful for when and how much safe¬ 
guarding is needed. 

33.3.3 Implementation 

As can be expected, the potential cost for implementing 
recommendations can often overshadow the assessment 
cost. This aspect should be understood by the manu¬ 
facturing facility at the outset. However, it is also reason¬ 
able to presume that the reduced risk from potential 


reactive hazards-related events will greatly outweigh the 
combined analysis and implementation cost. 

Once recommendations have been presented to a plant, 
they should be entered into a system for managing their 
implementation. This can mean combining with requests 
from other safety-related and operational initiatives. These 
items may then be prioritized based on risk, regulatory 
compliance or some other criteria. Handling the reactive 
hazards recommendations in such a system ensures that 
the recommendations are addressed, scheduled and exe¬ 
cuted in an appropriate manner. 

Following implementation, it is useful to provide an 
assurance role to make sure that recommendations were 
indeed implemented and implemented as envisioned to 
reduce the reactive hazards risk. It can happen that ‘f ixes’are 
installed that bear insufficient resemblance to the original 
prevention/mitigation approach and do not help manage the 
risk. Verifying and validating the controls, equipment and 
systems put in place is therefore, a critical activity. 

All documented analyses and recommendations should 
be integrated with plant process safety information so that 
there is ready access to the information, that plant person¬ 
nel are familiar with the hazards and controls, and that the 
information will be incorporated in other programs and 
initiatives. 

33.3.4 Management of change 

The manner in which a facility handles management of 
change is an extremely important aspect of managing 
reactive hazards. Risk reduction measures implemented at 
a point in time can be circumvented or nullified by other 
seemingly innocuous changes that have been made. An 
engrained and rigorous management of change programme 
that includes consideration of reactive hazards is necessary 
to avoid ‘creep’ that quietly increases a facility’s level of 

33.3.5 Program maintenance 

Maintenance of a safety program to ensure that efforts are 
meeting needs requires continuous monitoring of systems, 
teamwork and a commitment to continual improvement. 
Development and growth of a safety programme can result 
from lessons learned from reviews of programmes and 
procedures, employee experience, audits, management of 
change, incidents including near miss incidents, equip¬ 
ment maintenance and new technology. 
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34.1 Introduction 

Numerous case histories of process incidents are provided 
in Appendix A1-A6. The most effective way to prevent 
these incidents is use of inherently safer design to eliminate 
or reduce the potential hazard. Chapter 11.7 provides a 
discussion of inherently safer design principles. In addi¬ 
tion, the Center for Chemical Process Safety book Inher¬ 
ently Safer Chemical Processes: A Life Cycle Approach (CCPS, 
1996) provides an excellent source of information on reduc¬ 
ing the inherent risk associated with process operation. 

In many processes, technical or manufacturing issues 
limit the engineer’s capability to design an inherently safer 
process. Further, there is generally a point where the 
required capital investment is disproportional to the addi¬ 
tional risk reduction provided by the process modification. 
In other words, the derived safety benefit is too low relative 
to the economic investment. 

When this occurs, protection layers or safeguards 
must be provided to prevent or mitigate the process risk. 
A safety instrumented system (SIS) is a protection layer, 
which shuts down the plant, or part of it, if a hazardous 
condition is detected. Accounts of SISs are given in 
Reliability Technology (A.E. Green and Bourne, 1972) and 
by Hensley (1968), R.M. Stewart (1971), Kletz (1972a), 
de Heer (1974), Lawley and Kletz (1975),Wells (1980), Barclay 
(1988), Rushton (1991a,b) and Englund and Grinwis (1992). 

Throughout the years, SISs have also been known as 
emergency shut-down systems (ESDs, ESSs), safety shut¬ 
down systems (SSDs), safety interlock systems (SISs), 
safety critical systems (SCSs), safety protection systems 
(SPSs), protective instrumented systems (PISs), interlocks 
and trip systems. Regardless of what the SIS may be 
called, its essential characteristic is that it is composed of 
instruments, which detect that process variables are 
exceeding preset limits, a logic solver, which processes 
this information and makes decisions, and final control 
elements, which take necessary action on the process to 
achieve a safe state. 

For start-up, the various instrumented permissives and 
operator actions must be defined. These permissives may 
require that certain process conditions exist prior to 
allowing start-up. They may also involve the use of tem¬ 
porary bypass of the SIS for start-up, such as the bypass of 
a low flow shut-down of a pump. From the case histories, it 
is apparent that the permissive and operator action 


requirements have often been ill-defined, allowing start-up 
under unsafe operating conditions. 

The required performance or integrity of the SIS must also 
be defined. Not all SIS provide the same performance. In 
Figure 34.1, a single process switch is connected to a non- 
redundant programmable electronic system (PES) that 
de-energizes a single solenoid operated valve venting air 
f rom aprocess valve actuator, causing the fail- closed valve to 
go to the safe state. This SIS will not provide the same per¬ 
formance as the SIS shown in Figure 34.2, which shows 2oo3 
(two-out-of-three) voting transmitters connected to a 
redundant PES that de-energizes solenoid operated valves 
venting air from the process valve actuator, causing the 
redundant fail-closed valves to go to the safe state. The for¬ 
mer has no redundancy and is susceptible to multiple, single 
points of failure. The latter provides redundancy, fault toler¬ 
ance, and the opportunity for implementation of on-line and 
fault tolerance. The latter provides redundancy, fault toler¬ 
ance, and the opportunity for implementation of on-line 
diagnostics. The combination of redundancy and diag¬ 
nostics yields a high level of confidence that the SIS will 
function whenrequired.The selection between the design in 
Figure 34.1 and the one in Figure 34.2 is dependent on the 
amount of risk reduction that the SIS is expected to provide. 

The risk reduction that the SIS must provide is defined 
by process hazards analysis, supplemented with semi- 
quantitative or quantitative evaluation. Qualitative process 
hazards analysis techniques, such as what-if analysis, 
checklists, and Hazard & Operability analysis (HAZOPs), 
are used to identify the causes and consequences of poten¬ 
tial process hazards. Semi-quantitative or quantitative 
techniques are then used to evaluate the risk reduction 
requirements. 

The semi-quantitative evaluation is typically performed 
using layers of protection analysis (LOPA). The CCPS book, 
Layer of Protection Analysis: Simplified Process Risk Assess¬ 
ment (CCPS, 2001) states that LOPA is used to determine 
whether there are sufficient layers of protection against 
potential process hazards. A brief introduction to LOPA is 
provided in this chapter, as it relates to SIS specification. 
In addition, refer to the hazards analysis chapter Chapters 
8 and 9 for more information on general hazard assessment 
principles. 

For quantitative risk assessment, the most com¬ 
monly used technique is fault tree analysis. A brief 



Figure 34.1 Simplex safety instrumented system (Courtesy of SIS-TECH Solutions, LP) 
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introduction to fault tree analysis is provided in Chapters 
8.11 and 9.5. 

The hazards analysis allocates risk reduction to the SIS. 
This risk reduction defines the integrity requirement for 
the SIS. Once the SIS functionality and integrity require¬ 
ments are known, it is possible to design an SIS that will 
mitigate the process risk. However, the design simply 
represents the intended operation of the SIS. How the SIS is 
actually maintained, tested and managed determines the 
risk reduction that the SIS will achieve over its lifetime. For 
this reason, the US standard ANSI/ISA 84.01-1996 and the 
international standard IEC 61511 emphasize a lifecycle 
approach to SIS. 

34.2 Examples of SIS 

Some illustrations of the specification and design of pro¬ 
tective systems have been given by Kletz (1972a, 1974a) and 
by Lawley and Kletz (1975). The applications include a 
hydrocarbon sweetening plant and a distillation column 
heating system. 

An example of the use of SISs in a hydrocarbon sweet¬ 
ening plant is shown in Figure 34.3 (Kletz, 1972a). The 
hydrocarbon is sweetened with small quantities of air that 
normally remain completely dissolved, but conditions can 
arise that generate an explosive mixture. Initially, it was 
assumed that the principal problem lay in a change in the 
air/hydrocarbon ratio, but a HAZOP study revealed that a 
hazard could arise in a number of ways. One example is the 
formation of an air pocket, which can occur as follows: 

(1) the temperature can be so high that the amount of air 
normally used will not dissolve; 

(2) an air pocket can be left behind when a filter is 
recommissioned; 

(3) the pressure can fall, allowing air to come out of 
solution; 

(4) a fault in the mixer can prevent the air being mixed 
with hydrocarbon, so that the pockets of air can be 
carried forward; 

(5) a fault in the air/hydrocarbon ratio controller can 
result in the admission of excess air. 

In this case, it is also necessary for the feed to be above its 
flashpoint, which can occur in a number of ways: (1) the 
temperature can be above the design flashpoint and (2) the 



1 Air pocket detector 

2 Low pressure 


Figure 34.3 Hydrocarbon sweetening plant (Kletz, 
1972a) (Courtesy of the American Institute of Chemical 
Engineers) 


feed can contain low flashpoint material. Alternatively, if 
there is both a loss of pressure in the receiver and a failure 
of the non-return valve, hydrocarbon may find its way into 
the air receiver. 

The fault tree for the hazard is shown in Figure 34.4. The 
probabilities of the various fault paths were evaluated from 
this tree and the SIS requirements were identified. The SIS 
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Figure 34.4 Fault tree for explosion on a hydrocarbon sweetening plant (after Kletz, 1972a) (Courtesy of the 
American Institute of Chemical Engineers) 


initiators considered, shown by the circles in Figures 34.3 
and 34.4, were 

(1) a device for detecting a pocket of air in the reactor; 

(2) a pressure switch for detecting a low pressure in the 
receiver; 

(3) a temperature measurement device for detecting a 
high temperature in the feed; 

(4) laboratory analysis for detecting a low flash¬ 
point feed; 

(5) a device for detecting a high air/hydrocarbon ratio. 

As the latter condition is detected by the SIS initiator 1, 
SIS initiator 5 was not used. The shut-down arrangement 
was that any of the SIS initiators 1-3 closes a valve in 
the air-line and shuts down the compressor. The use of the 
laboratory analysis of the feed flashpoint was restricted 
to ensuring that low flashpoint feeds were only present a 
sufficiently small fraction of the time to meet the system 
specification. 


Another example is provided for a distillation column 
heating system, as shown in Figure 34.5 (Lawley and Kletz, 
1975). Heat is supplied to the distillation column from an 
existing steam-heated reboiler and a hot-water-heated feed 
vaporizer. Plant throughput was to be increased by the 
addition of another reboiler and vaporizer. 

Existing dual pressure relief valves were adequate to 
handle overpressure from the existing reboiler and vapor¬ 
izer. The problem was to cope with the overpressure that the 
new reboiler and vaporizer might cause. Both re-sizing of 
the existing relief valves and the addition of a third were 
unattractive in the particular situation. Consequently, 
there was a requirement for an SIS that would shut-down 
both the steam to the new reboiler and the hot water pump 
on the new vaporizer. 

Both lool and loo2 SISs were considered. The lool sys¬ 
tem consisted of a pressure switch for detecting high pres¬ 
sure on the overhead vapour line, a relay and a contact on 
the power supply to the hot water pumps and a relay and 
contact for de-energizing the solenoid operated valve 
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closing the isolation valve on the reboiler steam supply. The 
summary of the failure rates of a simple SIS for this case is 
shown inTable 34.1. In the analysis, the authors determined 
that the simplex system could not achieve the fractional 
dead time (FDT) requirements. The authors therefore 
considered a loo2 SIS, which was a duplication of the lool 



Figure 34.5 Distillation column heating system (Lawley 
and Kletz, 1975) (Courtesy of Chemical Engineering) 


system. It was concluded that a loo2 system did meet the 
target FDT. The spurious trip rate for this system, however, 
was high, which was unacceptable from a plant reliability 
standpoint. This led to a requirement for a 2oo3 voting 
system, which met the target FDT with a lower spurious 
trip rate. 

34.3 SIS Standards 

34.3.1 ANSI/ISA 84.01-1996 

ANSI/ISA 84.01-1996 (ISA 84.01-1996) was issued in 1996 
by the Instrumentation, Systems and Automation society. 
In 2000, the Occupational Safety and Health Administra¬ 
tion (OSHA) acknowledged ISA 84.01-1996 as a standard 
that provides generally accepted good industry practice for 
the design of SISs. Consequently, the use of ISA 84.01-1996 
ensures compliance with the process safety management 
programme (OSHA 1910.119 regulation). By the end of 
2004, IEC 61511 will be accepted as ISA-84.00.01-2004 
Parts 1-3 (IEC 61511 Parts 1-3 Mod), leading to a single 
global standard by which to judge SIS adequacy. 

ISA 84.01-1996 is performance-based, using abenchmark 
called the ‘safety integrity level’ to define the adequacy of 
the SIS. During the process hazards analysis, the risk reduc¬ 
tion that must be achieved by the SIS is determined. This 
risk reduction is equivalent to the safety integrity level. The 
risk reduction provided at each safety integrity level is 
shown inTable 34.2. 

The SIS is designed and implemented to achieve the 
target safety integrity level (SIL). The standard has few 
prescriptive requirements, so the engineer designing the 
SIS relies on his or her experience to select appropriate 
instrumentation for the process application. The essential 


Table 34.1 Failure rates of trip systems for a distillation column heating system (Lawley and Kletz, 1975) 
(Courtesy of Chemical Engineering) 


Components Failure rate (faults/year) 


Fail-to-danger Fail-safe Total 


Trip initiator 
Impulse lines - blocked 
- leaking 

Pressure switch (contacts open to give trip signal 
Cable fractured or severed 
Loss of electrical supply 
Total 

Steam shut-off system 
Relay coil (de-energize to trip) 

Relay contact 

Relay terminals and wire 

Solenoid valve (de-energize to trip) 

Loss of electrical supply (to solenoid valve) 

Trip valve (closes on air failure) 

Air supply line - blocked or crushed 
— fractured or holed 
Loss of air supply 
Total 

Pump shut-off system 

Relay coil, contact, terminals and wire (as above) 


0.05 0.05 

0.01 0.01 0.02 

0.01 0.01 

0.10 0.20 0.30 

0.05 0.05 

0.10 0.15 0.25 

0.01 - 0.01 
0.01 0.01 

0.05 0.05 

0.22 0.53 0.75 

0.01 0.07 0.08 

0.01 0.07 0.08 
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Table 34.2 Safety integrity levels (SILs) according to 
ANSI/ISA 84.01-1996 


SIL 

Average 
probability 
of failure on 
demand 

Risk 

reduction 

factor 

Availability 

(%) 

1 

lO^-lO -2 

10-100 

90-99 

2 

io- 2 -io~ 3 

100-1000 

99-99.9 

3 

itr 3 -i(r 4 

1000-10,000 

99.9-99.99 


requirement is that the overall architecture must be capable 
of achieving the SIL at its designated testing interval. 
Thus, the engineer has the flexibility to design an SIS to 
meet the SIS performance target and the operational goals 
for the facility. 

After installation, the complete instrumented loop is 
tested to validate the SIS functionality. Operation, main¬ 
tenance and testing procedures are developed to ensure 
long-term performance of the SIS. Finally, management of 
change is used to assess the impact of any change on 
the functionality of the SIS or the SIL that the SIS can 
achieve. 

34.3.2 IEC 61508 

IEC 61508, ‘Functional Safety of Electrical/Electronic/ 
Programmable Electronic (E/E/PES) Safety-related Sys¬ 
tems,’ is a global safety standard. IEC 61508 applies to 
many different industrial sectors, including transporta¬ 
tion, manufacturing, medical and process. The standard 
serves as a framework and establishes minimum require¬ 
ments for the development of sector-specific standards. 
IEC 61508 consists of seven parts: 

• Part 1: General requirements; 

• Part 2: Requirements for E/E/PES; 

• Part 3: Software requirements; 

• Part 4: Definitions and abbreviations of terms; 

• Part 5: Examples of the methods for the determination 
of SILs; 

• Part 6: Guidelines on the application of parts 2 and 3; 

• Part 7: Bibliography of techniques and measures. 

IEC 61508 concerns any E/E/PES that is implemented 
to mitigate safety and environmental hazards posed by 
the ‘equipment under control’ (e.g. a distillation column). 
These hazards are identified during a hazards and risk 
analysis. 

The standard uses a lifecycle approach to establish 
activities that should occur throughout the lifetime of a 
safety-related system from conceptual process design to 
decommissioning. Thus, the standard covers design, 
operation, maintenance and testing of safety-related 
systems. 

Similar to ISA 84, IEC 61508 uses a risk-based approach 
for determining the required performance for safety- 
related systems. IEC 61508 has four safety integrity levels, 
as shown in Table 34.3. 

Specific hardware and software criteria are provided 
based on the required performance. Further, the standard 
establishes various techniques and measures to be used to 
achieve successful implementation of safety-related systems. 


Table 34.3 Safety integrity levels (SILs) according 
to IEC 61508 and IEC 61511 


SIL 

Average 
probability 
of failure 
on demand 

Risk 

reduction 

factor 

Availability 

(%) 

1 

10 _1 -10“ 2 

10-100 

90-99 

2 

io~ 2 -io- 3 

100-1000 

99-99.9 

3 

io- 3 -io~ 4 

1000-10,000 

99.9-99.99 

4 

10- 4 -l0“ 5 

10,000-100,000 

99.99-99.999 


IEC 61508 is the standard by which a manufacturer or 
supplier’s product is judged. This provides greater assur¬ 
ance that the equipment used to implement the safety- 
related system, especially the PESs, meets a minimum 
burden of proof. This does not mean that the equipment will 
work well in all applications. It does mean that the supplier 
met minimum quality standards in terms of design, manu¬ 
facturing and testing. As with all equipment, the user must 
still determine whether the device functions as intended 
when installed and operated in the process environment. 

34.3.3 IEC 61511 

IEC 61511, ‘Safety Instrumented Systems for the Process 
Sector,’ was issued by the International Electrotechnical 
Commission in 2003. IEC 61511 consists of three parts: 

• Part 1: Framework, definitions, system, hardware and 
software requirements; 

• Part 2: Guidelines in the application of IEC 61511-1; 

• Part 3: Example methods for determining safety integ¬ 
rity in the application of hazard and risk analysis. 

IEC 61511 is the first sector standard developed under the 
framework of IEC 61508. It represents an important step 
forward, because, for the first time, there will be a global 
standard that establishes the requirements for SISs used in 
the process industry. The worldwide acceptance of IEC 
61511 will lead to a higher level of consistency in the SIS 
specification, design, operation, maintenance and testing. 
The standard is flexible, since it is performance-based, 
using the SIL as the benchmark. It then builds upon the 
performance requirements, using a lifecycle approach for 
the SIS design. Consequently, the standard does not man¬ 
date how an SIS should be designed for a specific applica¬ 
tion. Instead, it provides a framework for evaluating 
whether an SIS is needed, specifying the SIS functionality, 
and establishing the required SIS integrity. 

The basic steps for compliance with IEC 61511 are as 
follows: 

(1) Establish the risk tolerance for the process under 
consideration. 

(2) Perform a process hazards analysis to determine the 
process risk associated with specific hazardous 
events. 

(3) Identify the hazardous events where the process risk 
exceeds the risk tolerance. 

(4) Identify the safety functions that reduce the pro¬ 
cess risk. 

(5) Allocate risk reduction to each safety function. 
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(6) For non-SIS safety functions, document how the 
non-SIS safety function achieves the risk reduction 
and perform proof tests to ensure these functions 
work as intended. 

(7) For SIS, define the functionality and integrity (i.e. 
required risk reduction) of the SIS. 

(8) Document how the functionality and integrity will 
be achieved in a safety requirements specification. 

(9) Design the SIS to achieve the functionality and 
required integrity. 

(10) Develop SIS operation, maintenance and testing 
procedures to demonstrate functionality and to 
ensure required integrity. 

(11) Quantitatively verify that the SIS design and 
intended procedures meet the required integrity. 

(12) Fully validate the functionality of any new or modi¬ 
fied SIS prior to introduction of hazardous chemical 
into the process. 

(13) Use change management processes to ensure that the 
functionality and integrity are maintained during 
any SIS modification. 

(14) Periodically audit the SIS documentation and 
installation for agreement with each other and the 
safety requirements specification. 


34.4 Layers of Protection Analysis (LOPA) 

LOPA is a semi-quantitative technique for assessing pro¬ 
cess risk. Dowell (1997, 1998) and Huff and Montgomery 
(1997) showed how LOPA could be used to determine the 
following: 

• what SIL is required for an SIS; 

• how many layers of protection are needed to reduce the 
risk to a tolerable level. 

The intent of LOPA, according to Layers of Protection 
Analysis (CCPS, 2001) (the CCPS LOPA book), is to provide 
a rational, objective, risk-based approach to identifying 
and specifying the protection layers that are used to pre¬ 
vent or mitigate process risk. Process risk is defined by the 
frequency and severity of potential hazards. The severity 
may be assessed in terms of human impact, such as injuries 
and fatalities, environmental impact, such as noise, 
releases or spills, or financial losses, such as production 
loss or equipment damage. 

The process risk is assessed in the absence of the pro¬ 
tection layers. The process risk is then compared to the 
tolerable risk. Tolerable risk may be defined by the owner/ 
operator of a facility, by an insurer, or by a governmental/ 
regulatory body. If the process risk is equal to or less than 
the tolerable risk, no protection layers are required. If the 
process risk is greater than the tolerable risk, the gap is 
closed using protection layers that prevent or mitigate the 
process risk. The protection layers are designed to reduce 
the process risk to a tolerable level. Examples of protection 
layers are provided in Table 34.4 from Guidelines for Safe 
Automation of Chemical Processes (CCPS, 1993/14) (the 
CCPS Safe Automation Guidelines). 

LOPA builds upon traditional H AZOP techniques, using 
guidewords to identify process deviations and associated 
initiating causes that potentially propagate into hazardous 
events. LOPA determines the frequency of each initiating 
cause using either an order of magnitude assessment or 


Table 34.4 Layers of Protection (CCPS, 1993/14) 
(Courtesy of the American Institute of Chemical Engineers) 


1. Process design 

2. Basic controls, process alarms, operator supervision 

3. Critical alarms, operator supervision and manual 
intervention 

4. Automatic SIS 

5. Physical protection (relief devices) 

6. Physical protection (containment dikes) 

7. Plant emergency response 

8. Community emergency response 


estimated failure rate. The use of look-up tables can provide 
a consistent basis for this assessment. Hazards analysis 
teams often have difficulty when asked to make frequency 
judgements without any guidance, because they typically 
have no experience with operating the facility without the 
protection layers and consequently have little basis for 
making the assessment. 

The consequence of the hazardous event is defined by: 
(1) the team using qualitative judgment, (2) look-up tables, 
or (3) consequence modelling for specific scenarios. The 
method chosen is typically dependent on the nature of the 
hazards present in a facility. If the hazards are easily 
understood by the team, the assessment may be completely 
qualitative with the team instructed to use past experience 
and process knowledge in its assessment. If the hazards 
are more complex, such as the overpressure of a vessel at an 
elevated location with release of hydrocarbons to the 
atmosphere, look-up tables may be given to the team to pro¬ 
vide guidance on whether the release should he considered 
flammable. When toxic chemicals are involved, dispersion 
modelling may be required to ascertain the degree of 
impact to the on-site personnel or to the community. 

With the initiating cause frequency and consequence, 
the unmitigated process risk can be determined: 

Unmitigated risk 

= initiating cause frequency x consequence 

This unmitigated risk is compared to the risk tolerance 
criteria to determine whether protection layers are 
required. The risk tolerance can be defined as a specific, 
numerical target, such as 1 fatality in 10,000 years, or 
in general categories using a risk matrix as shown in 
Figure 34.6. 

The consequence categories are defined in terms of 
safety, environmental and economic impacts. Safety is 
often evaluated in terms of potential fatalities, serious 
injuries, lost-time injuries or first-aid injuries. The safety 
category may also set different requirements dependent on 
whether these impacts occur on-site or off-site or whether 
the impacts are to plant personnel or members of the public. 
The environmental category may examine items such as 
environmental releases related to permit violations, plant 
or community response requirements (e.g. shelter-in-place 
or evacuation), or toxic gas levels. The economic category 
often examines losses associated with production inter¬ 
ruption and equipment damage. 

If a risk matrix is used, the required risk reduction 
can easily be determined once the frequency and conse¬ 
quence is known. For example, using Figure 34.6, with an 
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REQUIRED RISK REDUCTION MATRIX 


1 

10 

100 

1000 

10000 

TH 

2 

NR 

10 

100 

1000 

10000 

3 

NR 

NR 

10 

100 

1000 

4 

NR 

NR 

NR 

10 

10 


10000 

1000 

100 

10 

1 

FREQUENCY (1 in x years) 


Figure 34.6 Example risk matrix (Courtesy of SIS-TECH Solutions, LP) 


initiating cause frequency of 1 in 10 years and a con¬ 
sequence category of 2, the risk must be reduced by a factor 
of 1000 to achieve the risk tolerance. When a quantitative 
risk tolerance is defined, the process risk is compared to the 
quantitative target to determine the amount of required 
risk reduction. 

When the unmitigated risk does not meet the risk toler¬ 
ance, protection layers are used to reduce the risk to the risk 
tolerance. Any protection layer should meet the criteria 
established by the CCPS Safe Automation Guidelines and 
expanded by the LOPA book. 

(1) Specific: The independent protection layer (IPL) is 
capable of mitigating or preventing the consequences 
of the specified hazard. 

(2) Independent: An IPL is independent of the other pro¬ 
tection layers associated with the specified hazard. 
Independence requires that each layer be unaffected 
by the failure of another protection layer or by the 
conditions that caused another protection layer to fail. 
Most importantly, the protection layer is independent 
of the initiating cause. 

(3) Dependable: The protection provided by the IPL 
reduces the identified risk by a known and specified 
amount. 

(4) Auditable: The IPL is subject to regular periodic vali¬ 
dation or function testing. 

The dependable criterion is related to the probability of 
failure on demand (PFD) of the protection layer and thus 
is a direct measure of the risk reduction that the protec¬ 
tion layer can provide. Guidelines are typically developed 
to support LOPA by providing restrictions on the amount 
of risk reduction that can he allocated to any protection 
layer related to the protection layer’s design, operation, 
maintenance and testing philosophy. Tables 34.5 and 34.6 
provide examples of guidelines that might be developed for 


assessing the risk reduction provided by protection layers. 
The CCPS LOPA book also provides an extensive discus¬ 
sion about the protection layers, the range of risk reduction 
that can be expected from any protection layer, and, most 
importantly, limitations that should be considered prior to 
establishing any guideline used in a site-specific LOPA. 

The overall risk reduction required to reduce the unmi¬ 
tigated risk to the tolerable risk may be provided by one 
protection layer or multiple protection layers. It is always 
important to evaluate the claimed protection layers against 
the independence criterion. 

When the protection layer is a SIS, the risk reduction 
allocated to the protection layer is the SIL. This establishes 
the performance requirement for SIS, which must be met by 
the design, operation, maintenance and testing philosophy. 

After allocating the appropriate risk reduction to the 
existing or planned protection layers, the mitigated risk is 
again compared to the tolerable risk. If the tolerable risk is 
not satisfied, recommendations for additional risk mitiga¬ 
tion layers or design modifications should be made. LOPA 
is a tool used to ensure that process risk is successfully 
mitigated to the tolerable level. LOPA is a rational, defen¬ 
sible methodology that provides a rapid, cost effective 
means for identifying the IPLs that lower the frequency 
and/or the consequence of specific hazardous incidents. 
LOPA uses specific criteria and restrictions for the evalua¬ 
tion of protection layers, eliminating the subjectivity of 
qualitative methods at substantially less cost than fully 
quantitative techniques. 

LOPA can be used at any point in the lifecycle of a project 
or process, but it is most cost effective when implemented 
during front-end loading, as soon as process flow diagrams 
are complete and the Piping & Instrumentation Diagrams 
(P&IDs) are under development. For existing processes, 
LOPA should be used during or after the HAZOP review. 
LOPA is typically applied after a qualitative hazards 
analysis has been completed, which provides the LOPA 
















Table 34.5 Typical risk reduction factors (RRF) used in layers of protection analysis (Courtesy of SIS-TECH Solutions, LP) 


IPL 


Operator intervention 
using operating 
procedures 


Basic process control 
system (BPCS) 


Other/local 

Check valve (standard 

design) 


Flame arrester 
Vacuum breaker 
Restrictive orifice 
Pressure regulator 


Further restrictions on considering as IPL RRF (typical) 


The action should be independent from the initiating cause and any other IPL. If an operator action is the initiating cause, no risk 
reduction can be assigned to any operator action that solely relies on the same operator to recognize problem and quickly correct it. 
If the initiating cause is the basic process control system, no risk reduction can be assigned to any operator action that solely relies 
on BPCS information display (e.g. process conditions, indications) unless a detailed study of the BPCS is performed to ensure 


sufficient independence and redundancy in order to address common cause failure 
Process Related Rounds and Inspections. Frequency of operator rounds should be sufficient to 10 

detect potential incident. If recognition of process variable is required, the operator should log 
specific values from sensors or valves that are independent of the initiating cause. The operator 
log should provide unacceptable out-of-range values. Standard Operating Procedures should 
describe response to out-of-range values 

Observational. Frequency of operator rounds should be sufficient to detect potential incident and 10 

mitigate ultimate scenario. Impending incident should be obvious to operator through normal 
visual or hearing range, that is, loud noise, high vibration, serious leaking, etc. 

Review. Independent, supervisory review and sign-off that work is complete and correct prior to 10 

start-up or returning component to service 

Action. An operator action that uses a different operator, relying on independent observation 10 

Corrective Action: An operator action taken based on a scenario where the event propagation is 10 

sufficiently slow that the operator has enough time to recognize the error and to correct it 
Alarm:The alarm with operator response should be examined to ensure that it is independent See Table 34.6 


from the initiating cause and any other IPL. This includes not only independent field 
instrumentation but also an independent channel in the BPCS and independence of the 
operator (different operator). Only one BPCS-based alarm or BPCS function can be used as an IPL 
The RRF associated with alarms with operator response is based on the amount of time 
available for action and the location of the response. See Operator Time Restrictions Table for 
more information 

The BPCS should be independent of the initiating cause and any other IPL. If the initiating cause is a BPCS control loop, another the 
control loop’s within the BPCS should not be designated as a BPCS IPL, unless a detailed study of the BPCS is performed to ensure 
sufficient independence and redundancy in order to address common cause failure. The RRF associated with a BPCS IPL is limited 


to 1 in 10 per IEC 61511 

The control loops normal action will mitigate the scenario. The BPCS IPL should run in automatic 10 

mode during all operational phases where the accident scenario exists 
The IPL should be independent of initiating cause and any other IPL. It should be designed to mitigate the scenario 
Single check valve (none) 

Dual check valves in series 10 

Should be designed to mitigate the scenario 100 

Should be designed to mitigate the scenario 100 

Should be designed to mitigate the scenario 100 

Should be designed to mitigate the scenario 100 






Table 34.5 (continued) 


IPL 


Further restrictions on considering as IPL 


RRF (typical) 


Special personnel 
protection equipment 


Safety instrumented 
system 


Pressure relief valve (PRV) 


Vessel rupture disk 
Blast-wall/bunker 

Fire detection with water 
deluge system 


Gas monitors with 
automated deluge 


Special personnel protection equipment (PPE) that is not normally worn by operation or (none) 

maintenance personnel but is part of an established procedure. This PPE would include wire 
mesh gloves, 

fire suits, respirators, self-contained breathing apparatus, etc. The user of the equipment 
should be trained in the use of the PPE 

Should be independent of the BPCS. RRF is based on the SIL that is achieved by the complete functional loop 


SIL1 10 

SIL 2 100 

SIL 3 1000 

Clean Service. PRV should be sized to completely mitigate the scenario 100 

Clean Service. More than one PRV is available to mitigate overpressure scenario. Each PRV listed 1000 

should be capable of independently relieving the overpressure. Each PRV should be sized to 
completely mitigate the scenario 

Clean Service. More than one PRV is available, but more than one is required to mitigate the full 10 

load. This includes staged release PRVs. To achieve an RRF higher than 10, the PRVcalculations 
should be reviewed to determine whether the load can be successfully handled by each PRV, 
based on the specific scenario under review 

Plugging Service, that is, prone to plugging, polymerization, deposition, or has a history of failure 10 

to operate properly when tested. An unprotected PRV used in a plugging service is not 
considered sufficient for consideration as an IPL 

Plugging Service, that is, prone to plugging, polymerization, dep osition, or has a history of failure 10 

to operate properly when tested. Redundant Pressure Relief Valves with separate process 
connections. Each PRV should be sized to completely mitigate the event 

Plugging Service, that is, prone to plugging, polymerization, deposition, or has a history of failure 10 

to operate properly when tested. Pressure Relief Valve with integrated rupture disk. PRV should 
be sized to completely mitigate the scenario 

Plugging Service, that is, prone to plugging, polymerization, deposition, or has a history of failure 100 

to operate properly when tested. Pressure Relief Valve with integrated rupture disk with 
purging. PRV should be sized to completely mitigate the scenario 

Should be designed to mitigate scenario. Release should be evaluated for potential risk 100 

Process-related blast wall. This is not related to the control room design. The blast wall is typically 1000 

designed to direct/contain the explosion away from the main process unit 

Operator initiated response.The RRF is based on operator alarm and response criteria, as listed in Table 34.6 

Operator Time Restrictions Table 

Using fire detectors with automatic deluge, for example, foam, water curtain, water sprays, or 10 

emergency evacuation 

Operator initiated response.The RRF is based on operator alarm and response criteria, as listed in Table 34.6 

Operator Time Restrictions Table 

Using gas monitor with automatic response, for example, water cannons, water sprays, or 10 

emergency evacuation 





Table 34.6 Typical operator time restrictions with associated risk reduction factors (RRF) (Courtesy of SIS-TECH Solutions, LP) 


For all listings in the table below, the alarm and operator response should be evaluated to ensure that the components and actions are independent of the initiating cause. 

In all cases, the alarm must not be operator re-settable. The operator response time should consider the time it takes to recognize the alarm, to diagnose the problem, and to 
fully initiate action. This is compared to the process time, taking in account how rapidly the process moves from the alarm condition to the incident condition 

Time (min) 

Where 

How many 

Restrictions 

RRF 

<10 

Any 

Any 

Operator must troubleshoot the alarm and determine appropriate response 

1 

2-10 

Control i 

room Single 

operator 

Drilled response, also known as a ‘never exceed, never deviate’ response. If the alarm is 
received, the operator should execute a specific action every time without delay. Staffing 
should also be adequate so that there is an operator present at all times to respond to the alarm. 

If the operator response is to troubleshoot the alarm, less than 10 min is not an adequate amount 
of time and no RRF is allowed 

10 

>10 

Control i 

room Single 

operator 

Operator action is complicated, that is, large number of alarms generated by initiating cause and 
the response is not clear or documented 

1 

>10 

Control i 

room Single 

operator 

The operator is trained on alarm response, has procedures available to examine and practices the 
action periodically 

10 

>10 

Control i 

room Two 

operators 

All operators listed must receive the same information. Both operators can make independent 
responses, which completely mitigate the event. Alarm must not he operator re-settable. 

The operators are trained on alarm response, have procedures available to examine and practice 
the action periodically 

100 

>20 

Field 

Single 

operator 

The operator is trained on alarm response, has procedures available to examine and practices 
the action periodically 

10 

>20 

Field 

Two 

operators 

All operators listed must receive the same information. Both operators can make independent 
responses, which must completely mitigate the event. Alarm must not be operator re-settable. 

The operator is trained on alarm response, has procedures available to examine and practices 
the action periodically 

100 
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team with a listing of hazard scenarios with associated 
initiating causes, consequence ratings and potential safe¬ 
guards for consideration as IPLs. 

34.5 Level of Automation 

The allocation of function between the operator and the 
control system is a principal theme in human factors analy¬ 
sis and is discussed in Chapter 14. Of particular interest is 
the allocation of control and protective functions to the 
process operator or the instrumented system. 

34.5.1 Illustrative example: steam boiler protective system 

A case study of the optimum level of automation has been 
described by Hunns (1981).The system investigated was the 
protective system for a large steam plant. The plant con¬ 
sisted of a 100 MW boiler operating at 1500-2000 psi and 
producing 500 ton/h of steam. The boiler was dual fired 
with oil and gas. The principle features of the three candi¬ 
date control and protective systems are shown in Table 34.7. 

Each system was assessed for its reliability in the start¬ 
up and operational phases of the plant. Avariety of start-up 
sequences was considered, since each shut-down event 
resulted in the requirement for a different start-up sequence. 
Some 200 logic diagrams were produced. 

The criterion used to determine the optimum system was 
a function of the type of expected shutdowns, which were. 
These were classified as low penalty and high penalty. Low 
penalty shut-downs were unwanted shut-downs due to 
spurious trips and correct shut-downs in response to a 
demand. High penalty, or catastrophic, shut-downs were 
those caused by a demand to which the protective system 
did not respond. 

One such case is an excessive release of unignited fuel 
into the combustion chamber. Figure 34.7 shows a section 
of the logic, which the authors term ‘matrix logic’. Events 
identified hy the analyst are shown in the left-hand column. 
A particular event sequence is shown by a vertical column 
of the matrix containing one or more dots. The circle 
enclosing the “&’ symbol at the head of the column indicates 
that the events are ANDed together. The set of event 
sequences is collected under the OR symbol, which indi¬ 
cates that these event sequences are related to the top event, 
the unignited release, by OR logic. 

The device failure data were taken from the Safety and 
Reliability Directorate SYREL data bank. Human error was 
estimated based on expert judgement. There were almost 


180 human errors estimated by two experienced analysts. 
Performance shaping factors were assessed, such as avail¬ 
able time to react, prior expectancy, conspicuity of task and 
perception of consequence. Good agreement was obtained 
between the two analysts for most human errors. Those 
estimates that were particularly critical, or where a diver¬ 
gence between the two analysts had occurred, were medi¬ 
ated hy a third, independent analyst. 

The results of the study were expressed in terms of the 
number of low and high penalty shut-downs per year and 
the corresponding mean outage time. The mean outage of 
low penalty events was taken as 1/3 days/event and that of 
high penalty events as 60 days/event. The manual system 
resulted in appreciably more high penalty shut-downs but 
fewer with low penalty and overall a higher outage than the 
other two systems. The medium automated system yielded 
slightly more high penalty shut-downs and fewer low pen¬ 
alty shut-downs than the highly automated system, but the 
same outage time. On a lifecycle cost basis, for which the 
highly automated system had higher capital and main¬ 
tenance costs, the medium automated system was superior. 
The total lifecycle costs of the three systems - manual, 
medium automated and highly automated - were £0.122, 
0.095 and 0.099 million/year, respectively. 

34.6 Design 

Appropriate SIS design requires that the engineer under¬ 
stand the underlying purpose of the SIS. This entails 
reviewing the process hazards analysis (PHA) docu¬ 
mentation to better define the required SIS functionality 
and integrity. These basic requirements should then be 
developed into complete specifications. 

The functional specification should include the following: 

• Definition of the process safe state; 

• SIS inputs, voting configuration and trip points; 

• SIS outputs, redundancy requirements and safe state 
actions; 

• functional relationship between inputs and outputs; 

• automatic diagnostics for inputs and outputs; 

• provisions for bypassing, testing and maintenance; 

• provisions for manual shut-down; 

• required reset actions; 

• response time requirements for SIS actions; 

• means by which alarm, trip and diagnostic information 
is to be communicated to plant operator. 


Table 34.7 Elements of three candidate protective systems for a large steam boiler plant (after Hunns, 1981) 
(Courtesy of Elsevier Science Publishers) 


Control and protective features 


Protective system design a 


Manual 

Medium automated 

Highly automated 

Trip parameters’" 

A 

A 

A 

Boiler purge sequence 

M 

A 

A 

Burner flame failure detection 

M 

A 

A 

Gas valves leak test 

M 

M 

A 

Ignition burner control 

M 

M 

A 

Burner fuel valves operation 

M 

A 

A 


a A, automated; M, manual. 

b Low boiler drum level; low combustion air flow; low instrument air pressure; low fuel oil pressure; low atomizing steam pressure; low fuel gas 
pressure; high fuel gas pressure; high knockout drum level; and loss of 110 V DC supplies. 
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Figure 34.7 Matrix logic diagram for a steam boiler protective system: event ‘excessive unignited fuel release’ 
(Hunns, 1981) (Courtesy of Elsevier Science Publishers) 


The integrity specification should include the following: 

• integrity level assigned to the SIS; 

• testing interval requirements; 

• limitations on acceptable spurious trip rate. 

Once the functionality and integrity requirements 
are fully understood, the design process can begin. The 
following section will provide a discussion of the following: 
(1) separation of basic process control system (BPCS) and 
SIS, (2) response time requirements, (3) power supply, 
(4) choosing components, (5) integration of SISs and (6) field 
design. 

34.6.1 Separation of BPCS and SIS 

Prior to the implementation of modern digital control sys¬ 
tems (DCSs), the process industry relied on local control 
systems for day-to-day operation and local relay systems 
for shut-down functions. The design was inherently sepa¬ 
rated. The local pneumatic controller had its own trans¬ 
mitter and control valve. The relay system used separate 
process switches and dedicated final elements. 

As technology changed, there was intense pressure to 
combine these systems. However, the implementation of 
complex PESs makes it increasingly important to maintain 
the independence of the BPCS and the SIS. When these 
systems are combined, the SIS functions may be impacted 
by normal activities that take place within the BPCS, such 
as optimization of process control logic and manual control 
activities carried out by the operator. 

Most process control systems involve some sequential 
control even if it is largely limited to start-up and shut-down. 


The sequential logic should operate in such a way as not to 
cause any safety problems. Its operation should be tested 
against the SIS logic to ensure that normal operation of the 
sequential control does not trigger unnecessary SIS action 
or inhibit any required SIS action. BPCS provides protec¬ 
tion against hazardous events by maintaining the process 
within control tolerances. Process alarms are issued to the 
operator through the BPCS human-machine interface, 
notifying the operator that the process has exceeded preset 
process conditions. This allows the operator the opportu¬ 
nity to bring the process back into control, preventing a 
unit shut-down. 

CCPS Safe Automation Guidelines discusses the safety 
considerations in the selection and design of the BPCS. 
The topics covered include: (1) the technology selection, 
(2) the signals, (3) the field measurements, (4) the final con¬ 
trol elements, (5) the process controllers, (6) the operator/ 
control interfaces, (7) communication considerations, (8) 
electrical power distribution systems, (9) control system 
grounding, (10) batch control, (11) software design and data 
structures and (12) advanced computer control strategies. 
The design philosophy of CCPS SafeAutomation Guidelines 
requires that the BPCS and the SIS be separate systems. 
This ensures that the integrity of the SIS cannot be com¬ 
promised by the BPCS. 

IEC 61511 provides restrictions on the assumed failure 
rate of the BPCS and the risk reduction that can be claimed 
for it as a protection layer. It also discusses the analysis of 
common cause failures between the BPCS and other layers 
of protection including the SIS. The BPCS and SIS must be 
functionally independent such that no failure of the BPCS 
can prevent the SIS from functioning. 
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IEC 61511 also recommends the use of separation and 
diversity to achieve high SILs. For example, if the control 
valve can be the initiating cause for the hazard, the control 
valve should not be used as the primary shutdown device. 
Instead, a dedicated shutdown device should be provided 
to mitigate the risk. In the case of high SIL require¬ 
ments, redundant, dedicated shutdown devices are often 
implemented. 

34.6.2 Response time requirement 

The dependability of an SIS is based on its functionality 
and integrity. An important aspect of functionality is the 
dynamic response. The dynamic response of instrumenta¬ 
tion is illustrated in Figure 34.8. It is assumed in the figure 
that, when a fault occurs, the variable increases linearly 
from its normal level to the danger level. The nominal 
trip point is established somewhere along this ramp using 
an appropriate safety margin from the hazardous condition. 
However, the trip often does not occur at the specific point in 
time corresponding to this process variable condition.There 
will normally be delays due to (1) sampling, (2) dynamic 
response of the measuring instrument and (3) normal mea¬ 
suring instrument error. Even when the measuring instru¬ 
ment has responded, there will be delays in the safety 
circuitry and the closure of the shut-down valve. There will 
be a further delay in the process itself, due to the amount of 
time required for the valve closure to affect the process 
variable. All of these factors, delays and errors erode the 
available safety margin and should be considered carefully. 
The maximum rate of rise of the process variable is also 
critical. If the process variable rises very rapidly, SIS valve 
closure speed may become a major design factor. 

Further reduction of the nominal trip point may be 
appropriate, but the setting should not be put so low that 
noise in the process variable measurement activates the 
trip at normal operational conditions. After all, a spurious 



Figure 34.8 Effect of instrument error and dynamic 
response on the safety margin in a trip system (after 
Hensley, 1988) (Courtesy of the institute of 
Measurement and Control) 


trip can arise from a low trip set point, as well as from 
instrument unreliability. 

The dynamic response of the hazard scenario against 
which the SIS is designed to protect may be modelled using 
standard methods. An account of unsteady-state modelling 
of process operations is given in Mathematical Modeling in 
Chemical Engineering (Franks, 1967) and the modelling of 
instrumentation is treated in texts on process control, such 
as those by Harriott (1964) and Coughanowr and Koppel 
(1965). 

The following treatment is confined to the dynamic 
response of the measuring instrument or sensor. The 
inputs to a sensor are generally characterized by a set of 
idealized forcing functions, of which the main types rele¬ 
vant here are: (1) the step function, (2) the ramp function 
and (3) the impulse function. The unit step function 
changes suddenly at time zero from a value of zero to a value 
of one. The unit ramp function increases linearly with time 
and has a slope t. The unit impulse is a function that is 
infinitely large at time zero and zero elsewhere, but also has 
an area that is unity. These three forcing functions are 
shown in Figure 34.9(a)—(c). 

The device is typically modelled as either a first- or 
second-order system. Thus a temperature sensor might be 
modelled as a first-order system: 

Mcp < ^=UA(T i -T) [34.6.1] 

where A is the area for heat transfer to the sensor, c p is the 
specific heat of the sensor, Mis the mass of the sensor, t is 
time,Tis the temperature of the sensor, U is the overall heat 
transfer coefficient, and the subscript i indicates input, or 
forcing. Thus, T ; is the temperature of the surrounding 
fluid. 

Equation 34.6.1 may be written in the more general form 
for a first-order system as: 

x^= 1\-T [34.6.2] 

where 

tmMcp/VA [34.6.3] 

and t is a time constant. The lag described by Equation 

34.6.2 is known as a ‘transfer lag’. 

In this case, the model obtained is a linear one. If the 
model obtained is non-linear, it needs first to be linearized. 
A non-linear model is obtained, for example, if the mode 
of heat transfer to the sensor is radiation rather than 
conduction. 

The normal approach is then to express each term in the 
linear model as the sum of the steady-state value and the 
transient component. Given 9 as the transient component of 
temperature and the subscript ss as steady state. Equation 

34.6.2 then becomes: 

+ 0) = (T . ^ + 9i) + (Tss + e) [3464] 

The corresponding steady equation is: 

0 = T iiSS - T ss [34.6.5] 
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(c) 




Figure 34.9 Dynamic response of sensor systems: (a) step forcing function; (b) ramp forcing function; (c) impulse 
forcing function; (d) response of first-order system to step forcing function; (e) response to first-order system to 
ramp forcing function; (f) response to first-order system to impulse forcing function; (g) response of second-order 
system to step forcing function. For second-order system: cn n , natural frequency: l, damping factor 
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Subtracting Equation 34.6.5 from Equation 34.6.4 gives: 


[34.6.6] 


In other words, after an initial transient, the measured 
value lags the actual value by a time equal to the time 
constant t. 

For the impulse response: 


Equation 34.6.6 is then transformed into the Laplace, or s, 
domain by taking the Laplace transform: 

s6 - 0(0) = 0; - 0 [34.6.7] 

Taking the initial condition as the steady state with zero 
deviation gives 0(0) = 0 and hence the ratio of the output to 
the input, or the transfer function, is: 


0i = kS{t) 
0i = k 



0__1 
6{ T 


exp (—f/r) 


[34.6.19] 

[34.6.20] 

[34.6.21] 

[34.6.22] 


0i i||S, [34.6.10] 

Substituting Equation 34.6.10 in Equation 34.6.8 gives: 

S -(IT35 |34jml 


where 5(t) is the impulse function. The step, ramp and 
impulse responses of a first-order system are shown in 
Figures 34.9(d)—(f). 

An over-damped second-order system is equivalent to 
two transfer lags in series. The basic model is therefore: 


cm T 

x '6t =Ti ~ 

<m _ 


[34.6.23] 

[34.6.24] 


where subscripts 1 and 2 indicate the first and second 
stages, respectively. 

The transfer function of the second-order system is: 


0i (I + tjsX?+ r 2 s) 


Inverting the Laplace transformed expression in Equation The step response is: 

34.6.11 back into the time domain: 

6 = k[l- exp(-f/t)] [34.6.12] ~ = 1 - ^ ^ fa exp(-f/n) - i 2 exp(-f/r 2 )] [34.6.26] 


Equation 34.6.12 is sometimes written as: 


The impulse response is: 


~ = l-exp(—f/-r) [34.6.13] 

Where this is done, it should be noted that 0 ; is a constant, 
defined by Equation 34.6.9, whereas in Equation 34.6.6 it 
was a variable. 

For the ramp response, 0 ; is given as: 


6i = kt 



p * 

* 0+W 


[34.6.14] 

[34.6.15] 

[34.6.16] 

[34.6.17] 


The ramp response has the important property that 


[34.6.18] 


= —— [exp(—f/n) - exp(—// t 2 )] [34.6.27] 

0i Tl - T 2 

The step response of a second-order system is shown in 
Figure 34.9(g). 

It is sometimes required to provide an unsteady-state 
model of the sensor for incorporation into an unsteady- 
state model of the total system. In this case, an equation 
such as Equation 34.6.2 may be used for a first-order sys¬ 
tem and a pair of equations such as Equations 34.6.23 and 
34.6.24 for a second-order system. 

The three forcing functions may be illustrated by a 
flammable gas cloud as seen by a gas detector. The gas 
cloud may be seen by the sensor as any one of these forcing 
functions. The gas concentration may rise suddenly from 
zero to a value that remains constant (step function), it may 
rise linearly (ramp function) or it may rise momentarily 
from zero to a high value and then subside as rapidly 
(approximated by an impulse function). 

An account of the time lags that occur in SISs has been 
given by R. Hill and Kohan (1986), who characterize the 
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dynamic response of a SIS by a ramp function similar to 
that shown in Figure 34.8 and consider, in turn, the individ¬ 
ual time lags. If the time interval from the initial process 
deviation to the hazard point exceeds 2 min, there is nor¬ 
mally no problem in designing the SIS. On the other hand, if 
the time interval is less than this, there is a potential pro¬ 
blem. If the time interval is only a few seconds, an SIS may 
not be practical. 

The signal transmission lags to and from the logic sys¬ 
tem, and the logic system delay itself are normally negli¬ 
gible. The more significant lags are likely to be in the 
sampling and the sensor, in the final control element, and in 
the process itself. For analysers, sampling lags may amount 
to a dead time of the order of seconds to minutes. For 
smart transmitters, the sensor lag may be of the order of 
100—250 ms. Transfer lags in sensors vary, with tempera¬ 
ture measurement lags often being large due to the thermal 
inertia of the measuring pocket. The lag at the control valve 
can vary from a fraction of a second up to several minutes, 
depending on the valve size. The lag in the process itself is 
also highly variable. 

34.6.3 Power supply 

Loss of power to the process unit results in the failure of 
pumps and other electrical driven equipment. During the 
flare load analysis, as discussed in this volume, the loss of 
power case was cited as often presenting the largest flare 
load. How long one can run safely without power is depen¬ 
dent on the process operation. In designing the SIS, the 
choice must be made between energize-to-trip (ETT) and 
de-energize-to-trip (DTT). 

The SIS standards, ISA 84.01-1996 and IEC 61511, 
recommend the use of DTT design to provide greater 
assurance that the safe state is achieved under loss of power 
conditions. In a DTTdesign, loss of power causes the final 
elements to take their fail-safe action. To prevent brief 
power interruptions from causing process shut-downs, 
uninterruptible power supplies (UPS) are used. Power is 
supplied to the SIS instrumentation by the UPS when the 
power is lost. The UPS can be sized to supply power for any 
length of time, but for practical reasons generally do not 
supply power for periods in excess of 30-45 min. 

In DTTdesign, a power outage results in the final elements 
going to the safe state. Due to historical plant power supply 
problems, some companies migrated to an ETT design to 
allow the plant to continue to operate during short power 
outages. An ETT design requires that power be applied in 
order for the final elements to achieve their safe state. This 
migration to ETT improved process reliability, but placed the 
process at greater risk of an incident during a loss of power 
condition. ETT SISs are generally limited to SIL 1 applica¬ 
tions, because it is difficult to implement back-up power gen¬ 
eration and/or alternative power supplies (e.g. UPS) that have 
a combined failure rate of less than 1 in 100 years. If ETT cir¬ 
cuits are used, line monitoring must be performed, because 
any loose wire or open circuit will inhibit the safety action. 
But even line monitoring does not guarantee that the SIS will 
work when a process demand occurs, because fuses or coils 
may burn-out when power is supplied. 

Further, the discussion of the use of DTTor ETTcannot 
be restricted to examination of the failure rate only.The use 
of PES-based devices in ETTapplications is questionable. 
At the chip level, the probable operational states are equally 
likely to be on or off. There is consequently the question of 
whether the PES can be made fail-safe in an ETT design. 


This can only be determined by thorough failure modes 
and effects analysis. Many modern PES are not approved 
by independent certifying bodies for use in SISs operated 
as ETT systems due to the question of fail-safe status. For 
this reason, the CCPS Safe Automation Guidelines suggests 
alternative approaches to achieving process reliability. 
These are based on use of; (1) devices of proven reliability 
with self-diagnostic capability, (2) maintenance pro¬ 
grammes stressing preventive maintenance, inspection 
and proof testing and (3) redundancy including inputs, 
logic solver and outputs. 

34.6.4 Choosing components 

The choice of which device to use in an SIS is very impor¬ 
tant. All devices fail eventually due to manufacturing 
faults, age-related degradation or damage caused by pro¬ 
cess impact. Some devices are more prone to failure than 
others. For this reason, it is important to understand how 
the device performs in the application environment. This 
concept is called ‘proven-in-use’ or ‘prior use.’ Thus, 
selecting the right device depends on field experience and 
available failure rate data, as well as knowledge of the 
process application and process conditions. 

34.6.5 Integration of SISs 

As already described, an SIS is normally dormant and 
operates in a demand mode. An SIS device such as a sensor 
or a valve may fail in such a way that its failure will remain 
unrevealed until detected by proof testing or some other 
means. By contrast, similar devices in a control system are 
exercised continuously, and these failures are more likely to 
cause an operational excursion. The failure in the control 
system is often a revealed one. Yet the actual physical fault 
in both cases may be identical. A sensor may fail giving a 
low/zero or high reading, or a valve may stick open or 
closed. The concept of trip integration, which has been 
described by Rushton (1992), is based on this contrast 
between a fault that lies unrevealed in an SIS but is 
revealed in a measurement and control system. The princi¬ 
ple applies to any system that has a protective function.The 
system is regarded as integrated provided it is regularly 
exercised, which generally means that it is in use during 
the normal operation of the plant. 

As an illustration, Rushton describes a refrigerated stor¬ 
age tank for a toxic liquid, equipped with a cooling system 
and a pressure relief valve. Both are protective systems, but 
the cooling system is in more or less continuous use and is 
thus integrated, whereas the relief valve is not. 

In this case, the integration is benign, but it can also be 
malign. As an example of the latter, consider the case of a 
sensor that is common to both a level control loop and a 
high level alarm. Failure of the sensor results in failure not 
only of the control loop but also of the alarm. These situa¬ 
tions can easily be identified using LOPA. Then, design 
modifications can be implemented to ensure the independ¬ 
ence and integrity of each protection layer. 

34.6.6 Field design 
34.6.6.1 Configuration of SISs 

The configuration of SISs has been discussed by Rushton 
(1991a,b), who describes a formal approach. According to 
Rushton, for a fixed proof test interval, the ranking of SISs 
with respect to their functional and operational reliability 
is invariant and this is shown in Table 34.8. The SISs most 
commonly used are the lool, loo2,2oo2 and 2oo3 systems. 
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Table 34.8 Ranking of SIS configurations with respect 
to functional and operational failure (Rushton, 1991b) 
(Courtesy of the Institution of Chemical Engineers) 


Functional ranking 

Operational ranking 

4>moo„ 

System 

Ymoon 

System 

Low 

loo3 

Low 

3oo3 

I 

loo2 

| 

2oo2 


2oo3 


2oo3 

\ 

lool 

\ 

lool 


2oo2 


loo2 

High 

3oo3 

High 

loo3 


The use of parallel redundant, or loo n (1-out-of-w), sys¬ 
tems gives an increase in functional integrity, but a 
decrease in operational reliability compared with a lool 
(1-out-of-l) system. Better overall reliability characteristics 
can be obtained by the use of a majority voting system, of 
which the 2oo3 system is the simplest. A comparison of a 
2oo3 system with a lool system shows that the 2oo3 system 
has a higher functional integrity and operational reli¬ 
ability, while a comparison with a loo2 system shows that 
the 2oo3 system has a slightly lower functional integrity, 
but a much higher operational reliability. The 2oo2 system 
has some interesting characteristics. It has a lower func¬ 
tional integrity than a lool system, but its operational 
reliability exceeds not only that of the lool but also that of 
the 2oo3 system. When 2oo2 systems are used to improve 
operational reliability, the functional integrity can be 
improved by increased proof testing or by enhanced diag¬ 
nostics. The requirement for functional integrity is rarely 
such as to justify a loo3 system and that for operational 
reliability rarely such as to justify a 3oo3 system. 

The criterion given by Rushton for selection of the SIS 
configuration is an economic one and is: 

V = nC + d<l> s H + y s S+d(l-<t> s )G [34.6.28] 

where C is the annualized cost of a single channel trip, </> is 
the fractional dead time, y is the spurious trip frequency, G 
is the cost of a genuine trip, S is the cost of realization of a 
hazard, S is the cost of a spurious trip, V is the overall 
annual cost, and the subscript s indicates the SIS (as 
opposed to a single channel). The most economic solution is 
that which minimizes V. 

For a genuine trip, there is an element of loss related to 
the process failure that causes the demand. If, for purposes 
of comparison, this element (which will occur in all cases) is 
neglected, the cost of a genuine trip is approximately the 
same as that of a spurious one ( G=S j, so that Equa¬ 
tion 34.6.28 becomes: 

V = nC + <5<ft.ff + [y s + <5(1 - 0 s )]S [34.6.29] 

If the basic parameters of a particular application are 
known, namely the demand rate <5, the fail-to-danger rate 
2 d , spurious failure rate y s , the proof test interval t p , the 
repair time z„ the costs of hazard realization H, and spuri¬ 
ous trip S, then a plot of H/C vs S/C gives a map showing the 
regions where a particular configuration is optimal. The 
boundaries of the regions are curves of constant V/C. 


As an illustration, consider the case given by Rushton 
where the application is characterized by <5 = 0.01 
demands/year, 2=0.2 failures/year, 7=0.5 failures/year, 
ip = 1/12 and t r = 1/52. The map giving the optimal con¬ 
figurations for this case is shown in Figure 34.10(a). If <5 is 
increased to 1.0 demand/year, the map becomes that shown 
in Figure 34.10(b). 

Rushton also treats the case where there is an element 
of common cause failure (CCF). Rushton uses the 
beta method described in Chapter 9. He considers a loo2 
system: 


^002 = k -3- 

yioo2 = 2 x (1 - p 2 )y + p 2 y 


[34.6.30] 

[34.6.31] 


= (2-ft)y 


[34.6.32] 


where ft is the fraction of the functional failure rate which 
is common cause, or the functional beta value for that fail¬ 
ure rate, and ft is the operational beta value. 

The effect of CCF may be illustrated by considering the 
extension given by Rushton of his example to the case of a 
loo2 SIS where <5 = 1 demand/year, 2=0.2 failures/year, 
7 = 0.5 failures/year, t p = 1/12, t r =l/52 and where 
ft = ft = ft Maps of the configuration space for this 
case are shown in Figure 34.6.3(c) and (d) for different 
values of [I. Table 34.9 gives expressions for the probability 
of failure on demand and spurious trip rate for different 
trip configurations. 

This cost-based approach allows the different SIS con¬ 
figurations to be put on a common basis for purposes of 
comparison. Where the hazard includes risk to human life, 
there will be a target probability of failure or SIL that must 
be achieved and this will be the overriding factor in the 
choice of configuration. However, there are often many 
different SIS configurations that can achieve the necessary 
integrity. The cost-based approach can be used to judge 
which configurations are reasonably practicable from an 
operational reliability standpoint. 

34.6.6.2 Field sensors 

The SIS field sensors should be independent from the initi¬ 
ating cause for the potential hazardous event and from any 
other protection layers used to reduce the process risk to the 
risk tolerance. Independence is necessary to minimize com¬ 
mon cause failure. For example, if the initiating cause is the 
process control transmitter, the control transmitter cannot 
be used as the sole means for SIS initiation. For enhanced 
diagnostics, the control transmitter signal can be compared 
to the SIS transmitter signal to detect faults. Any sharing of 
the control transmitter with the SIS should be carefully 
assessed to ensure that potential common cause failures are 
adequately addressed. Further, the design should ensure 
that no failure of the control system can disable the SIS. 

Field sensor redundancy is related to the required integ¬ 
rity. For SIL 1, redundancy is usually not necessary, though 
it may be appropriate for a lower integrity (i.e. high failure 
rate) field sensor or for improving operational reliability. 
For SIL 2, redundancy is often employed to reduce the 
required proof test interval and to improve operational 
reliability. For SIL 3 or 4, there should be full redundancy, 
such that there are no single points of failure in the SIS 
design. IEC 61511 requires the demonstration of fault 
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Figure 34.10 Configuration selection map for trip systems: illustrative examples (Rushton, 1991b): (a) case with 
5= 0.01, p = 0; (b) case with5=0.1, p = 0; (c) case withy = 1, P= 0.3; and (d) case with y - 1,0= 1. See text for further 
details (Courtesy of the Institution of Chemical Engineers) 


Table 34.9 Fractional dead times and spurious trip rates for trip systems with simultaneous proof testing and 
common cause failures accounted for by the beta method (Rushton, 1991b) (Courtesy of the Institution of Chemical 
Engineers) 
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tolerance for SIL 3 or 4. Depending on the voting config¬ 
uration selection, the incorporation of fault tolerance may 
also improve operational reliability. 

Other features typically used for SIL 3 are on-line, 
continuous diagnostics and consideration of the use of 


diversity in the sensors. Use of diversity that reduces 
the on-line diagnostic capability should be carefully 
examined. Diagnostic capability improves functional and 
operational reliability, where diversity only improves 
functional integrity. Further, the achievement of diversity 
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may require the use of a lower integrity component, off¬ 
setting any potential benefit gained from the diversity. 

34.6.6.3 Diagnostics 

Diagnostics may he used to detect failures of SIS compo¬ 
nents, including sensors, logic solvers, final control ele¬ 
ments and energy sources. The CCPS Safe Automation 
Guidelines distinguish between passive and active diag¬ 
nostics. In passive diagnostics, the failure is revealed only 
when a demand is imposed, either by the system or by a 
proof test. In active diagnostics, the device is subjected 
continuously to testing, such as the comparison of analog 
signals from redundant transmitters. If the analog signals 
begin to deviate from each other and this deviation exceeds 
a pre-set tolerance, an alarm is generated notifying plant 
personnel that maintenance activity is required. An exam¬ 
ple of passive diagnostics is the use of partial stroke test¬ 
ing, where the solenoid valve that controls the air source to 
the final control element is used to periodically (e.g. daily, 
weekly or monthly) move the valve from the fully open 
position. This test provides early detection of solenoid 
valve and process valve failures. 

34.6.6.4 Logic solver 

The SIS technologies given in the CCPS Safe Automation 
Guidelines include: (1) fluid logic (pneumatic, hydraulic); 

(2) electrical logic, including direct-wired systems, electro¬ 
mechanical devices (relays, timers), solid-state relays, 
solid-state logic and motor-driven timers; (3) PES tech¬ 
nology, involving programmable logic controllers (PLCs) 
and (4) hybrid systems. The technologies are detailed in 
Appendix A of the CCPS Safe Automation Guidelines. 

The hardware of atypical PES consists of a chassis, input 
modules receiving sensor signals, main processors, output 
modules sending out signals to final control elements, 
terminations, power supplies, a BPCS interface, a human/ 
machine interface and an engineering interface. The soft¬ 
ware of a typical PES consists of embedded software 
and utility software, which perform the system level fault 
detection and execute basic PES functions. In addition, an 
application program within the PES executes the required 
user functions. The application program is constructed 
using software that is typically provided hy the PES vendor. 

The use of software raises a significant issue. Evolution 
of operating system platforms has resulted in a shortening 
of the lifespan of the embedded software. In some cases, 
the life span has decreased to less than 10 years. After this 
relatively short time, the vendor may no longer support the 
embedded software. Upgrading the embedded software is 
a major software modification that must be performed off¬ 
line and with thorough testing to ensure that the hardware 
works properly with the new embedded software. 

In the case of application software, process design or 
operational changes often result in the need to change the 
software. IEC 61511 requires that any change to the soft¬ 
ware is performed under management of change review. 
Further, any logic potentially impacted by the change 
should be tested to ensure that the change does not prevent 
proper operation of any other SIS. 

The SIS logic solver must provide performance that meets 
the required SIL. It was general practice for many years to 
design SISs as separate, hardwired systems. Hardwired 
systems have highly predictable failure modes and exhibit 
lowfailure rates. In contrast, PES are composed of hardware 
and software components with complex failure modes and 


substantially higher failure rates. The major advantages 
of PES are the ease of logic sequencing implementation, 
the ability to perform complex SIS logic and enhanced 
diagnostics of field components. Over the last 15 years, the 
practice of using PES has gained wider acceptance. 

A PES uses a large number of automatic diagnostic cir¬ 
cuits and functions that are implemented in hardware and 
software. The purpose of the diagnostics is to detect fail¬ 
ures, particularly dangerous failures, which would inhibit 
the operation of the PES. Upon detection of failure, the PES 
may perform one of the following actions: 

(1) For a simplex PES, the SIS fail-safe action is initiated. 

(2) For loo» PES, the SIS fail-safe action is initiated. 

(3) For loon PES, if the process safety time is sufficiently 
long, the operational state is continued under alterna¬ 
tive operating procedures or by other compensating 
measures that ensure that safe operation is maintained. 

(4) For 2oon PES, the failed circuit is voted toward the 
trip state. The operational state is continued under 
alternative operating procedures or by other compen¬ 
sating measures that ensure that safe operation is 
maintained. 

In the event of any detected failure, an alarm is generated 
by the PES indicating the nature of the failure and that 
maintenance is required. 

It is impossible to have 100% diagnostic coverage of 
faults. After all, the diagnostics are being performed by 
hardware or software components and these components 
are subject to failures that would prevent them from 
detecting faults. The dangerous failures that are not detec¬ 
ted by diagnostics are called dangerous, undetected fail¬ 
ures. These failures can only be uncovered by proof testing 
the PES hardware. The testing should be performed at a 
frequency that enables the PES to achieve the required SIL. 

Software-based SISs are treated in Safely Aspects of 
Computer Control (P. Bennett, 1993). Other accounts are 
given by P. Bennett (1991a,b), Bologna (1993), Ehrenberger 
(1993), Malcolm (1993), McDermid (1993) and Pyle (1993). 
Since software-based SISs are complex, successful imple¬ 
mentation requires a disciplined process to achieve func¬ 
tional integrity. Thus, standards are particularly important 
for software-based SISs. Practical guidance is available in 
ANSI/ISA 84.01-1996, IEC 61508, and IEC 61511. For par¬ 
ticularly complex software systems, analysis methods are 
necessary to identify hazards associated with the software 
itself. The application of HAZOP to process computers 
(CHAZOP) is described in Chapter 8. 

There are a number of real-time languages and environ¬ 
ments that have special safety-related features. One exam¬ 
ple is ADA. Accounts are given in Program Verification 
Using ADA (McGettrick, 1982), ADA for Specfication and 
Design (Goldsack, 1985), ADA in Industry (Heilbrunner, 
1988) and Developing Safety Systems: A Guide Using ADA 
(Pyle, 1991). 

An account of the application of PES to functions such as 
pump change over, fire and gas detection and emergency 
shut-down has been given by Margetts (1986a,b). He 
describes the planning of an operation such as pump 
changeover using hierarchical task analysis, in which the 
changeover task is successively re-described until it has 
been broken down into executable elements, and the appli¬ 
cation of HAZOP to assess the adequacy of the resultant 
design. 
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34.6.6.5 Final elements 

The final elements used for shut-down action should be 
independent of the initiating cause of the incident and any 
other protection layer used to mitigate the incident. The 
final elements can he valves, circuit breakers, motor start¬ 
ers, protective relays, etc. 

Final element redundancy is related to the required integ¬ 
rity. For SIL1, redundancy is usually not necessary, though 
it may be appropriate for a lower integrity (i.e. high failure 
rate) final element. For SIL 2, redundancy is often employed 
to reduce the required proof test interval. For SIL 3 or SIL 4, 
there should be full redundancy, such that there are no 
single points of failure in the SIS design. IEC 61511 requires 
the demonstration of fault tolerance for SIL 3 or SIL 4. 

For valves, the engineer should select the valve type that 
provides the best performance in the application environ¬ 
ment. This includes assessing the impact of the application 
environment on the valve, the need for tight shut-off, and 
the required speed of closure. Enhanced valve diagnostics 
should strongly be considered in SIL 3 or SIL 4 applications. 
For example, valve diagnostics can be obtained by partial 
stroke testing the process valve using the solenoid-operated 
valve that controls the air signal to the valve actuator. The 
solenoid valve is de-energized for a short time period 
allowing the process valve to move away from the full-open 
position. Once valve movement is confirmed, it is returned 
to the full-open position without process disruption. Since 
the degree of valve closure is controlled by the test method, 
any partial stroke test apparatus or procedure should be 
carefully assessed to ensure that operational reliability 
is maintained. Improper design of the partial stroke test 
apparatus or an incorrect procedure may result in full- 
closure of the valve, resulting in a process disruption. 


34.7 Verify 

34.7.1 Dependability 

Since an SIS protects against a hazardous condition, it is 
essential for the system itself to be dependable. The 
dependability of an SIS is related to its: (1) functionality 
and (2) integrity. It is necessary for the system to have the 
capability of carrying out its function in terms of features, 
such as accuracy, dynamic response, etc., and for it to have 
a high probability of doing so. 

The SIS functionality was discussed in Section 34.6. SIS 
functionality is defined by identifying what must be 
detected and the response that must be taken to achieve the 
safe state. The SIS functionality is, therefore, related to the 
input and output architecture. 

The SIS integrity can be improved by the use of: 
(1) redundancy, (2) diversity and (3) diagnostics. Redun¬ 
dancy involves the use of multiple instruments to detect the 
potentially hazardous event. With voting, multiple failures 
are required for the SIS to fail to function. This yields a lower 
probability of failure than that of a single instrument. But, 
redundancy is not always the full answer, because there are 
some dependent failures which may disable the whole set of 
redundant instruments. This difficulty can be minimized 
by implementing diversity, which often involves using 
different process variables to detect the same hazard or 
different types of instrumentation to measure the same 
process variable. On-line diagnostics can also be used to 
detect component failure including dependent failures. 
Diagnostics allow the operator to he notified that an SIS 
fault has occurred, significantly improving SIS integrity. 


Most SISs consist of a single channel comprising a sensor, 
a logic processor and a final control element, but where the 
integrity required is higher than that which can be obtained 
from a single channel, redundancy is generally used. 

In the process industry, hazardous conditions are 
seldom present, so most SISs operate in a demand mode, 
that is the SIS is dormant until a process excursion or 
demand occurs. Thus, functional failures of the system are 
generally unrevealed failures. Device failure that results in 
the SIS failing to function when required by a process 
demand can be predicted using probabilistic techniques. A 
dependable SIS should have a low PFD. 

The SIS should also be reliable and not result in spurious 
trips, that is, failure that causes the SIS to shut the plant 
down when no hazardous condition exists. Thus, opera¬ 
tional failures of the system are generally revealed failures, 
due to direct process impact or to system diagnostics. 

It is the objective of SIS design and operation to avoid 
both loss of protection against the hazardous condition, 
due to functional failures, and plant shut-down, due to 
operational failure or spurious trip. Since functional fail¬ 
ure of the system is generally unrevealed, it is necessary to 
carry out periodic proof testing to detect such failure. 

The simpler theoretical treatments of SISs usually 
assume that the functional failures are unrevealed, opera¬ 
tional failures revealed and failure rates are constant. This 
treatment draws particularly on the work of A.E. Green and 
Bourne in UKAEA AHSB(S) R117 (1966) and in Reliability 
Technology (1972). 

34.7.2 Frequency of events in an SIS 

A method of determining the frequency of events of interest 
has been described by Kumamoto, Inoue and Henley (1981). 
These events are the process demand rate, the functional 
failure rate and the operational failure rate. The method is 
implemented in the program PROTECT. 

The procedure is to designate each of these events in turn 
as the top event of a fault tree, to create the fault tree and to 
determine its cut-sets. These cut-sets together with the 
proof test interval for the SIS are the inputs used by the 
model to provide estimates of the frequency of the events 
mentioned. 

Theapplicationofthisprogramto determine the expected 
frequency of these events for an ammonia-air mixing 
plant as a function of the proof test interval has been 
described by Kumar, Chidambaram and Gopalan (1989). 

34.7.3 Fractional dead time 

The fractional dead time (FDT) of a device or system gives 
the probability that it is in a failed state. ANSI/ISA 84.01- 
1996, IEC 61511 and IEC 61508 use the term ‘probability 
of failure on demand’ to describe the FDT of a device or 
system. The equations provided in this section and the 
functional integrity section can be used to calculate the 
PFD, as well as the FDT. 

If the device failure is revealed, the FDT <j> depends on 
the failure rate X and the repair time i r : 

= |% T r « 1 [34.7.1] 

For a series system with revealed failure, the FDT <j> of the 
system is related to the FDT <j> ( of the individual devices as 
follows: 

= mt h « 1 34.7.2] 
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Foraparallel system with revealed failure, theFDT ^ ofthe 
system is related to the FDT of the devices as follows: 


For a parallel redundant, or loow, system with revealed 
failure, the FDT <j>i oon of the system is related to the FDT 
<£iooi °f a single device as follows: 

<hoon = 0?„ol [34.7.4] 

If, however, the device failure is unrevealed, the FDT 
depends on the failure rate X and the proof test interval t p . 
The probability q of failure within time period t is: 

? = l-exp(-^) [34.7.5] 

or, for small values of It 

q = Xt Xt « 1 

Then the FDT is: 


#4/ ?df 


■%jT- 


34.7.4 Functional integrity 

Functional failure of an SIS may be unrevealed or unde¬ 
tected. In this section, the failure rate X is used to calculate 
the FDT of the SIS related to unrevealed, fail-dangerous 
faults. 

For a simple SIS consisting of a single channel loot sys¬ 
tem with a failure rate X, the probability q of failure within 
proof test interval t p is: 

q = 1 — exp(—A t p ) [34.7.10] 

For small values of Xr p 


The SIS is required to operate only if a hazardous plant 
condition occurs. The probability ps that such a process 
demand, with a demand rate <5, will occur during the dead 
time t 0 after the failure is: 


For a loow system with unrevealed failure, the FDTor <f > 1oo „ 
of the system is obtained from the probability q\ oon of 
failure of the system within the time period t: 


[34.7.8] 


Ps - - l - exp(— (5t 0 ) 

But, on average, the dead ti 
interval t p : 

t °=! 

ps = l- exp(— 5t p /2) 

For small values of <5t p : 


[34.7.12] 

e i 0 is half the proof test 


A detailed account of calculation of FDT is given by 
A.E. Green and Bourne (UKAEA1966 AHSB(S) R117). 

The calculation of the FDT according to Equation 34.7.8 
requires the integration of the instantaneous probability as 
defined by Equation 34.7.5 or 34.7.6 for the specific sub¬ 
system voting. For highly redundant SISs, this integration 
can he quite complicated. Also, it is necessary to integrate 
the instantaneous probability of each device over a single 
testing interval. It is not unusual to have staggered testing 
where the components in the subsystem are tested at dif¬ 
ferent intervals. To simplify the analysis and to account for 
the staggered testing, ISA TR84.00.02 provides an alter¬ 
native method for determining the FDT of a loow sub¬ 
system. This method may yield a different FDT for the SIS 
than Equation 34.7.8, but it has been found to provide a 
sufficiently conservative approximation of the FDT. The 
FDT or 4> loon for the loow subsystem is obtained by multi¬ 
plying the probability q of failure of the individual devices 
in the system within the time period t. 

As described in ISATR84.00.02, the FDT for each com¬ 
ponent is determined using Equation 34.7.7. Then, the 
voting architecture is modelled using Boolean algebra. 
This greatly simplifies the calculation, because the inte¬ 
gration is performed only for the individual device not for 
the entire subsystem. For a loow system, the FDT can be 


P S =^ <5t p «1 [34.7.1 

The probability p v that a plant hazard will be realized c? 
be written in terms of the plant hazard rate q: 

Pn «1* exp(-^T p ) [34.7.1 

For small values of j/t p : 

/>, = qz P qz P « 1 [34.7.1 


Pn = QPs 


Jx p «l; <5 t p «1; qz p «l [34.7.19] 


If the assumptions underlying Equation 34.7.19 a 
not valid, an expression that has been commonly used is 


*0-411 jf 


[34.7.9] 


[34.7.21] 
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As given earlier, the probability q of failure of the simple 
SIS within the time period t is: 


q = l — exp(-lf) 

[34.7.22] 

For small values of It 


q = At At« 1 

[34.7.23] 

Then the FDT 0 of the simple SIS is: 


0 = ^ 9At 

[34.7.24] 

Hence 


0 = ^ 
v 2 

[34.7.25] 

and 


6At p 

^2 

[34.7.26] 

as before. 

For a parallel redundant, loo« or moon (w-out-of-«) with 
a majority voting system, the following treatment applies. 
If there are n devices of which m must survive for the sys¬ 
tem to survive and r must fail for the system to fail, 1 then 

r=n-m +1 

[34.7.27] 

The probability q moo „ of failure of this system within the 
proof test interval can be determined using a binomial dis¬ 
tribution as follows: 

qmm = ±Q<f(l-qr k 

[34.7.28] 

For small values of q: 


Qmom = Q/ 3«1 

[34.7.29] 

The FDT (j> moo „ of the system is: 


Qmom it 

[34.7.30] 

Then from Equations 34.7.23, 34.7.29 and 34.7.30, the FDT 
4>moon of the system is: 


[34.7.31] 

Thus for a 2oo3 majority voting system: 


02oo3 = 

[34.7.32] 

1 In this chapter the number of devices that must fai 

1 for the system 


to f ail is r.This notation differs from that used in Chapter 7 for r-out- 
of-ri parallel systems, in which r was used for the number of devices 
that must survive for thesystemto survive.Thesetwo notations are 
used in order to preserve correspondence with established usage in 
texts on general reliability (e.g. Shooman, 1968) and on SISs (e.g. 
A.E. Green and Bourne, 1972). 


For the special case of a parallel redundant, or loo n, sys¬ 
tem, Equation 34.7.31 reduces to give the FDT 0i oo „: 



Thus for a loo2 parallel system: 

= ^- [34.7.34] 

and for a loo3 system: 

0ioo3 = ^l [34.7.35] 

FDT is calculated from Equation 34.7.31. The results are 
shown in Table 34.11, as a function of At p and of the FDT 
0iooi for a single channel. Table 34.10 assumes that the 
devices are tested simultaneously at the end of the proof 
test interval. Some improvement can be obtained by stag¬ 
gered testing, as shown by the data inTable 34.11, which are 
taken from A.E. Green and Bourne (1972). 

The approximation method provided in ISATR84.00.02 
can also be used to calculate the FDT of redundant sub¬ 
systems. In this method, the FDT is determined for each 
device within the subsystem using Equation 34.7.25. Then, 


Table 34.10 Fractional dead times for trip systems with 
simultaneous proof testing 


System 

n 

m 

r 

4> 


lool 

1 

1 

1 

Aip/2 

</>lool 

loo2 

2 

1 

2 

(Ax p fj 3 

f 01001 

loo3 

3 

1 

3 

(At p f/4 

20 3 io„i 

2oo2 

2 

2 

1 

At p 

201001 

2oo3 

3 

2 

2 

(At p f 

40 2 iool 


Table 34.11 Fractional dead times for trip systems with 
staggered proof testing (A.E. Green and Bourne, 1972) 
(Reproduced with permission from Reliability Technology 
by A.E. Green and J.R. Bourne, Copyright©, 1972, John 
Wiley and Sons Inc.) 


System 

0* 

0/0* 


Xx v 


lool 

IT 

1 

loo2 

T^f 

1.6 

loo3 


3.0 

2oo2 

/Up 

1 

2oo3 

j^p) 2 

1.5 


a < p , fractional dead time for simultaneous testing; </>*, fractional dead 
time for staggered testing. 










34/24 SAFETY INSTRUMENTED SYSTEMS 


Boolean algebra is used to combine the resulting FDT into; 
system value. 

For a loo2 subsystem, this yields: 


<Aloo2 


At p At p _ A z x| 

; Tr x T"TT 


[34.7.36] 


To generalize, the approximation equation can be derived 
for woo« voting subsystems, using Equation 34.7.25 for the 
value of r and Equation 34.7.27 to represent the probability 
of failure of the individual components: 


Table 34.12 Spurious trip 
rates for trip systems 


System y 

lool 

X 

loo2 

2X 

loo3 

3X 

2oo2 

2X\ 

2oo3 

6X\ 




AHSB(S) R117) and Wheatley and Hunns (1981). The latter 
[34.7.37] gives expressions for a wide variety of SISs. 


34.7.5 Operational reliability 

It is also necessary to consider SIS operational failure. 
Operational failure, as presented in this section, is 
revealed. The failure rate A used in the equations in this 
subsection is applicable to these revealed, fail-safe or fail- 
spurious faults. 

For a simple SIS consisting of a single channel lool sys¬ 
tem with a failure rate A, the operational failure, or spurious 
trip rate, y is: 

f = A [34.7.38] 

For a parallel redundant, or loon, system the operational 
failure rate yi OOB is: 

7io«. = nA [34.7.39] 

For a moon system, which may be a majority voting system, 
the following treatment applies. The rate at which the first 
operational failure of a single channel occurs is nA. This 
first failure only results in a system trip if further opera¬ 
tional failure of enough channels sufficient to trip the sys¬ 
tem occurs within the repair time i r . The probability q y that 
this will occur is: 


34.7.6 Hazard rate of a single-channel SIS 

The hazard rate of a single-channel SIS, when Ai v <<1; 
<5t p << 1; r\ t p «1, was shown in Equation 34.7.19: 



When this equation is used outside its range of validity, 
the results obtained can be not only incorrect but non¬ 
sensical. Consider the case where the failure rate is A = 0.01 
failures/year, the demand rate is 5 = 3 demands/year and 
the proof test interval is t p = 1 year. Then, this equation 
gives for the hazard rate n a value of 0.015 hazards/year, 
which is actually greater than the failure rate A. 

A treatment is now given for the more general case, based 
on the work of Lees (1982a) as extended by de Oliveira 
and Do Amaral Netto (1987). For a single-channel SIS, the 
possible states are: (1) SIS operational, (2) SIS failed but 
failure undetected and (3) SIS failed, but failure detected 
and SIS under repair. The corresponding Markov model is: 

Pi($ = -Aft(i) + pP 3 (t) [34.7.46a] 

P 2 (t) = APi(t) - dP 2 (t) [34.7.46b] 




Ai r «l 


[34.7.40] h(t) = 5P 2 (t) - pP 3 (t) 


[34.7.46c] 


Then the operational failure i 


: y moon of the system is: 

[34.7.41] 


where P„ is the probability that the SIS is in state n. 

With the initial condition that the SIS is operational, the 
solution of Equations 34.7.4a-c is as follows: 


ymoon = nX i^ n _ (^ r ) m_1 [34.7.42] 

Thus for a 2oo3 majority voting system: 

72003 = (3A) • (2 Ar t ) [34.7.43] 

72003 = 6A 2 t r [34.7.44] 

Operational failure, or spurious trip, rates calculated from 
Equations 34.7.39 and 34.7.42 are shown in Table 34.12. It is 
emphasized again that the foregoing treatment is a simpli¬ 
fied one.The expressions derived here appear, however, tobe 
those in general use (e.g. Hensley, 1968; Kletz, 1972a; de Heer, 
1974; Lawley and Kletz, 1975). Full theoretical treatments of 
SISs are given by A.E. Green and Bourne (1966 UKAEA 


nr 2 nin - r 2 ) 
?2{r2 + jU + 5) + p5 


p M m -^y + ft} + exp(nf) ~ + y l exp (r 2 t) 

nr 2 n(n - n) M r i - r v 

[34.7.47b] 

=^ + rj l^V eX P^) 
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Then the FDT and hazard rate obtained from 
Equations 34.7.47b and 34.7.47c are instantaneous values, 
and are 


A, = 1 - j ^ [X exp(-^Tp) - 5 exp(-lTp)] X 5 

[34.7.55a] 

Ai = 1 — (1 + /lr p ) exp(l + Xt p ) 1 = 5 [34.7.55b] 

A number of other relations have been given in the litera¬ 
ture for situations where Equation 34.7.45 is not valid. An 
expression given by Kletz and by Lawley (Kletz, 1972a; 
Lawley and Kletz, 1975; Lawley, 1976) is as follows: 


<t>(t)=P 2 (t)+P 3 (t) 


[34.7.49] ij = || - exp(-<5r p /2)] 


[34.7.56] 


m=w)+Psm 


[34.7.50] 


The FDTand hazard rate obtained from Equations 34.7.49 
and 34.7.50 are defined as functions of time. The average 
value of the hazard rate over the proof test interval is: 

r\ = ~j\(t)&t [34.7.51] 

Then, substituting Equation 34.7.50 into Equation 34.7.51 
and integrating gives for the average hazard rate: 


nr 2 >|Tp(n - r 2 ) 1 

X5(r 2 + n + 5) . . 

— y—, -r ex P( r 2f P ) - 

- r 2 ) 


The foregoing treatment is based on the assumptions that 
the SIS is fully operational after a proof test is performed 
and that the test duration is negligible compared with the 
proof test interval. 

Although this model has a high degree of generality, it is 
based on the assumption that, following detection of an SIS 
device failure, the plant continues to operate while the SIS 
device is repaired. If in fact the policy is that the plant 
operation does not continue while the SIS device is being 
repaired, different expressions apply. If the state is 
dropped from the instantaneous hazard rate r\{t) in 
Equation 34.7.50 and the repair rate n = 0, Equation 34.7.52 
for the average hazard rate then becomes 


n = i|l - j3-j[lexp(-c5Tp) - 5 exp(-Atp)] j X f 5 
[34.7.53a] 

>/ = 4f -(i~;.Tp)cxp(-;.T P ); x = 5 [34.7.53b] 


This case is essentially that considered by Lees (1982a), 
who used the joint density function method. Two of the 
relations which he gives, for the failure density function/,, 
and the probability p v of realization of the hazard, are also 
of interest and are 

f" = I ex P(-<frp) ~ exp(-^tp)] Xf= 5 [34.7.54a] 

f„ = X 2 T p exp(-Aip) X = 5 [34.7.54b] 


This is in effect Equation 34.7.20. It may be derived from 
Equation 34.7.18 together with Equations 34.7.11,34.7.14 and 
34.7.17. It is applicable for small Xt: p and f/r p , but higher <5 t p . 

Lawley (1981) has subsequently given the more accurate 
Equation 34.7.53a,b. The assumptions underlying this 
equation have just been described. 

Wells (1980) has given an expression 



as an upper bound on the hazard rate for higher values of 
<5 t p (>2). This expression is equivalent to taking the prob¬ 
ability of failure on demand as 0 = X/(X + 5). De Oliveira 
and Do Amaral Netto (1987) give the relation: 

'7 = <5{ 1 - I ^ [1 - exp( -^p)]} [34.7.58] 

for low values of 5 but higher values of Xt p . 

Numerical results for some of these expressions have 
been given by Lees (1982a) and by de Oliveira and Do 
Amaral Netto (1987). Table 34.13 shows some comparative 
results obtained, mainly by the latter workers. 


34.8 Operate 

To ensure the control system integrity, the design process 
must be supported by administrative procedures and 
actions. The SIS consists of instrumentation and logic 
processors that can and do fail. When these failures are 
detected, immediate operator response is essential to 
ensure safe operation. This response includes issuing a 
request for repair of the faulted device, monitoring other 
process variables associated with the unit, and, if neces¬ 
sary, initiating a manual shut-down action. 

CCPS Safe Automation Guidelines outlines minimum 
procedural requirements, including: (1) operating pro¬ 
cedures, (2) maintenance facilities, (3) testing of the BPCS, 
(4) testing of the alarms and SIS, (5) test interval require¬ 
ments, (6) testing facilities, (7) operator training, (8) docu¬ 
mentation and (9) auditing of maintenance and 
documentation. 

ANSI/ISA 84.01-1996 and IEC 61511 require that the SIS 
operating procedures contain the following information: 


• description of the hazard that is being prevented with SIS; 

• SIS trip set points and SIS actions, including definition 
of safe state; 
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Table 34.13 Some numerical values given by expressions for the average hazard rate of a single-channel SIS 
(after de Oliveira and Do Amaral Netto, 1987) (Courtesy of Elsevier Science Publishers) 


Parameter 



Equation a 



(year) 

X 

(year -1 ) 

,5 

(year -1 ) 

34.7.52 

34.7.53 

34.7.56 

34.7.58 

34.7.18 

0.0192 

0.1 

0.1 

0.958 x 10 -4 

0.958 x 10 -4 

0.958 x 10 -4 

0.958 x 10 -4 

0.959 x 10 -4 



1.0 

0.954 x 10 -3 

0.952 x 10 -3 

0.954 x 10 -3 

0.958 x 10 -3 

0.959 x 10 -3 



10 

0.919 x 10 -2 

0.900 x 10 -2 

0.914 x 10 -3 

0.958 x 10 -2 

0.959 x 10 -2 


1.0 

0.1 

0.952 x 10 -3 

0.952 x 10 -3 

0.958 x 10 -3 

0.953 x 10 -3 

0.959 x 10 -3 



1.0 

0.949 x 10 -z 

0.947 x 10 -2 

0.954 x 10 -2 

0.953 x 10 -2 

0.959 x 10 -2 



10 

0.913 x 10 -1 

0.895 x 10 -1 

0.914 x 10 -1 

0.953 x 10 -1 

0.959 x 10 -1 


10 

0.1 

0.900 x 10 -2 

0.900 x 10 -2 

0.958 x 10 -2 

0.900 x 10 -2 

0.959 x 10 -2 



1.0 

0.897 x 10 -1 

0.895 x 10 -1 

0.954 x 10 -1 

0.900 x 10 -1 

0.959 x 10 -1 



10 

0.864 

0.845 

0.914 

0.900 

0.959 

1.0 

0.1 

0.1 

0.468 x 10 -2 

0.468 x 10 -2 

0.488 x 10 -2 

0.484 x 10 -2 

0.5 x 10 -2 



1.0 

0.359 x 10 -1 

0.355 x 10 -1 

0.393 x 10 -1 

0.484 x 10 -1 

0.5 x 10 -1 



10 

0.916 x 10 -1 

0.860 x 10 -1 

0.993 x 10 -1 

0.484 

0.5 


1.0 

0.1 

0.358 x 10 -1 

0.355 x 10 -1 

0.488 x 10 -1 

0.368 x 10 -1 

0.5 x 10 -1 



1.0 

0.284 

0.264 

0.393 

0.368 

0.50 



10 

0.847 

0.591 

0.993 

3.68 

5.0 


10 

0.1 

0.892 x 10 -1 

0.860 x 10 -1 

0.488 

0.900 x 10 -1 

0.5 



1.0 

0.827 

0.591 

3.93 

0.900 

5.0 



10 

4.82 

1.00 

9.93 

9.00 

50 


a In equations where n is used, n =365/year. 


correct use of operational bypasses, permissive, system 
reset, etc.; 

response to SIS alarms and trips; 

detection and response to faults, including when to 

execute a manual shut-down action; 

provisions for operation with detected faults. 


This information enables the operator to understand the 
purpose and function of the SIS and to recognize when to 
take action in response to SIS faults. 


34.8.1 Bypassing of SISs 

Bypasses (or overrides) may be required for start-up, 
maintenance or testing activities. When a bypass is placed 
in service, the bypass should be alarmed in the control 
room to notify operations staff that an SIS is inoperable. 
Then, compensating measures should be implemented to 
maintain safe operation, while any portion of the SIS 
is bypassed. Compensating measures may include, for 
example, increased process monitoring, increased super¬ 
vision, revised operational procedures or reduction in pro¬ 
duction rates. Operation and maintenance staff should be 
trained on the use and purpose of these compensating 
measures. The procedures and training should include 
the operational limits at which manual shut- down should be 
initiated. To facilitate the above actions, there should be 
open communication between the control room and field 
staff. 

Administrative procedures are also required to prevent 
unauthorized bypass of the SIS. Bypass use should be 
restricted to specific, authorized personnel. This may be 
supplemented by hardware measures, such as keyed 
switches, or software measures, such as passwords. 
There should also be a limitation on how long an SIS can be 


left in bypass without additional approval under change 
management. 

Bypasses are typically only used during maintenance or 
testing activities. Occasionally, a start-up bypass is required 
for start-up and these bypasses must be carefully evaluated 
to ensure that potentially unsafe process conditions cannot 
occur during this bypass condition. Timers, operation 
sequences or process condition-based permissives may be 
used to automatically bring the SIS out of bypass during 
start-up to prevent prolonged operation in the bypass con¬ 
dition. For example, to start-up a pump, the low flow SIS on 
the discharge of the pump must be bypassed. To prevent the 
pump from being run for too long in the bypass condition, a 
timer may be used to automatically bring the SIS back in 
service. The timer allows the bypass for a specified period 
after the start button has been pressed. 

When SISs are bypassed during normal operation, it is 
generally due to poor SIS reliability. If an SIS proves trou¬ 
blesome, it is prone to be bypassed without appropriate 
authorization. This is particularly likely to occur if there 
are frequent spurious trips, due to sensor failure or other 
causes. For this reason, it is important to have restrictions 
on when SISs can be in bypass and to intermittently alarm 
that the SIS is in bypass. Implementing independent pro¬ 
cess control and SIS increases the level of access security 
and control. When independence is not implemented, 
rendering an SIS ineffective may only require alteration of 
the SIS setpoint. 

34.8.2 Restart after a trip 

Once an SIS has taken the process to the safe state, the SIS 
should remain in the safe state until the process has reached 
safe operating conditions and the operator has reset 
the SIS. The process industry has had numerous incidents 
due to restart under unsafe conditions. One situation, 
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which has frequently led to incidents, is the restart of 
agitation in a batch reactor following an interruption of 
agitation. 

Kletz (1979a) provides an example of an incident that was 
caused by a valve that reset automatically. A cumene oxi¬ 
dation reactor was protected by an SIS that used high tem¬ 
perature to initiate shutdown of the air to the reactor and 
to initiate a dump of the reactor contents into a water tank. 
A spurious trip occurred, the air valve closed and the dump 
valve opened. When the trip condition cleared itself, the 
dump valve remained in the open, safe state condition, but 
the air valve did not remain in the closed, safe state condi¬ 
tion. The air valve reopened. Air passed into the reactor, 
creating a flammable mixture. 

Valk and Sylvester-Evans (1985) discuss cases where 
restart was initiated before safe conditions were reached. 
In these cases, vessels were repressurized too quickly after 
emergency depressurization. Treatment of the problem 
using a model of the blowdown has been described by 
S.M. Richardson and Saville (1992). The effect of rapid 
reduction of pressure in a vessel containing a material 
such as liquefied gas may be to chill the vessel below the 
transition temperature. If repressurization occurs before 
the vessel has warmed up sufficiently, the vessel can 
rupture due to brittle fracture. 


34.9 Maintain 

The importance of proof testing cannot be overemphasized. 
Testing and, more generally, SIS maintenance should be of 
high quality, if the functional and integrity requirements 
are to be achieved. Accounts of the testing and maintenance 
of SIS have been given by R.M. Stewart (1971), A. Taylor 
(1981) and Barclay (1988). 


34.10 Test 

Testing plays an important role in achieving functional 
integrity. All devices eventually fail. The most hazardous 
failure is a dangerous, undetected failure, which results in 
the device not functioning when a process demand occurs. 
This type of failure results in the need to periodically test SIS 
devices to determine if they are functional. Thus, the 
required proof test interval is related to the device failure rate. 

ANSI/ISA 84.01-1996 and IEC 61511 require the testing 
of SIS devices, including inputs, logic solver and final ele¬ 
ments. The test should be complete enough to validate the 
necessary functions of each device and the overall system. 
The test should also examine the system response to bad 
process variables from failed instrumentation. 

Perhaps, the most important functional test is the vali¬ 
dation of the SIS prior to introduction of hazardous chemi¬ 
cals into the process equipment.This validation is sometimes 
referred to as the pre-start-up acceptance test (PSAT) or the 
site acceptance test (SAT). Validation is a full functional test 
of the SIS performed to determine whether the installed SIS 
is functioning as intended from a specification, design and 
installation standpoint. Throughout the lifecycle, verifica¬ 
tion activities are performed to maintain a quality design 
process and to ensure that the design remains in agreement 
with the required functionality and integrity. Validation is 
the ultimate test of the SIS functionality. Since the majority 
of testing after start-up will consist of testing individual 
devices, it is extremely important that complete input to 


output testing is performed to identify any system level 
problems. 

The test should be conducted using a written procedure, 
which details the actions to be taken and requires the tech¬ 
nician’s signature at key steps. In addition, the worksite 
should be reviewed and approved by an independent per¬ 
son to make certain that all bypasses have been removed 
and that the SIS devices have been returned to fully the 
operational state. The procedure is necessary because: 
(1) the testing process can be quite complex, (2) the indivi¬ 
dual performing the test may not be familiar with the 
particular trip and (3) in many cases the test is one of the 
last tasks done prior to a start-up when there may be con¬ 
siderable pressure to short-cut the test. Changes to the 
procedure should be managed through a management of 
change (MOC) process. 

The test should cover the entire SIS from sensor to final 
element. From the point of view of testing, the preferred 
method is to take the process variable to the trip point using 
test equipment and to verify the trip action. This method 
requires a shut-down or provisions for bypass of the final 
element in order to perform the test. Other methods involve 
testing the field sensors, logic solver and final elements 
separately or testing some combination of these. For 
example, the process variable is taken to the trip point 
using test equipment, but the final element is held in posi¬ 
tion. This tests the process sensing device only. Then, the 
final element would be tested in a separate procedure at a 
different time. This disintegrated testing must be assessed 
to ensure that all devices required for successful SIS func¬ 
tion are tested at the appropriate interval. 

For inputs, the test should include process variable 
indication leading to alarm and trip initiation. For input 
devices requiring field calibration, the sensor calibration 
range should be checked to ensure that it matches the 
specification and that the trip setpoint is achieved at the 
corresponding process condition. This is accomplished 
by inducing the process condition at the sensor and 
monitoring the corresponding output of the input device. 
It should be demonstrated that the input device gene¬ 
rates the correct signal at the alarm and trip setpoints. 
It should also he shown that if there is a bad sensor 
output, there is appropriate indication of this fault to the 
control room. 

Logic solvers should demonstrate that on receipt of an 
input trip condition that it generates the correct output 
response. At the simplest level, this involves validating 
that the logic performed in the logic solver matches the 
specification. This may include the following validation 
activities: 

• Ensure that redundant devices are subject to the correct 
voting logic. 

• Determine how the logic solver processes bad sensor 
data (i.e. out of range) and whether this fault is properly 
annunciated in the control room. 

• Verify that computations are being performed correctly 
and that bad data do not impede program operation. 

• Verify that sequenced operations are occurring cor¬ 
rectly and that any required triggers (e.g. operation 
actions or devices) for sequencing are being received at 
the correct points during logic execution. 

• Ensure that any diagnostic alarms are generated 
according to the specification (e.g. deviation alarms for 
redundant input devices). 
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• Determine the action of the logic when power failure 
occurs. 

• Verify what happens to the logic when combinations of 
inputs occur in an unusual manner (e.g. fault insertion 
testing). 

The test for final elements should determine that the final 
element can achieve the safe-state condition. The final 
element boundary includes all of the devices from the logic 
solver output to the control element that takes action on 
the process. For example, in the case of fail-to-close block 
valves, the test must ensure that the solenoid valve de¬ 
energizes, venting air from the valve actuator, which causes 
the valve to go to the closed position. If limit switches are 
used for trip indication or for sequencing operation, these 
limit switches must be tested. If closure speed is specified, 
the test should include verifying the actual closure speed. 

While testing the functionality of the field devices and 
logic solver is an obvious requirement, it is also necessary to 
test auxiliary systems and communications. Auxiliary sys¬ 
tems may include electrical power and air supplies. For 
example, if an air-to-move valve is used, the availability of the 
air supply is safety-critical. Any communication between the 
SIS and the basic process control system should be tested to 
ensure proper transfer of the data between the two systems. 
The test should demonstrate that no communication failure 
can occur that would prevent proper functioning of the SIS. 
Thus, the test should validate all features of the SIS, demon¬ 
strating that the SIS meets the design specifications. 

The importance of testing on functional integrity 
cannot be overemphasized. The expressions derived in 
Section 34.7 show that the condition for high integrity is: 

ftp «1 

As an illustration of the effect of the proof test interval, con¬ 
sider a simple SIS that has a failure rate of 0.05 faults/year 
on a duty where the demand rate is 1 demand in 10 years: 

<5 = 0.1 demand/year 
Z = 0.05 faults/year 
If the proof test interval is 1 month: 

r p = 730 h/8760 h = 0.0833 years 
Then the FDT is: 



* 0.00208 

and the plant hazard rate is: 

n = H 

* 0.000208 hazards/year 


The plant hazard rate for a range of proof test intervals is: 


t p r\ (hazards/year) 

1 month 

0.000208 

6 months 

0.001250 

lyear 

0.002500 

2 years 

0.005000 

5 years 

0.012500 


The example above illustrates how the proof test interval 
affects the plant hazard rate and the FDT. The PHA, as dis¬ 
cussed previously, established a target risk reduction to be 
achieved by the SIS, which is expressed in ANSI/ISA 
84.01-1996 and IEC 61511 as the PFD. While this chapter 
refers to FDT, the discussions also apply to thePFD. Due to the 
significant impact of the test interval on the SIS performance, 
any changes to the test interval should only be made after 
management of change review, which should include an 
analysis of the impact of the test interval change on the PFD. 

There are practical limitations to the test interval. There 
is always the possibility that while conducting the test that 
the device may be damaged or not returned to fully opera¬ 
tional state. It is important to consider whether bypassing 
is required in order to perform the testing. If so, the SIS will 
become less available to perform its design function, as the 
test interval is decreased. For example, if the test interval is 
monthly and the test requires a bypass period of 1 h, the SIS 
unavailability due to the bypass action is as follows: 

1 h/test * 12 tests/year = 12 h/year * lyear/8760 h 
= 0.00137 

Thus, it is important to minimize the frequency and dura¬ 
tion of proof tests. Due consideration should be given to 
eliminating the use of bypasses whenever possible. The 
fewer bypasses that are required, the lower the probability 
that it will be left in bypass unintentionally. 

In some instances, it is desirable to test some of the 
potential failures of an SIS component at one interval and 
the other failures at a different interval. For example, full 
closure of an SIS block valve during normal operation 
requires a bypass line and valve in order for operation to 
continue uninterrupted. Instead, a partial stroke can 
be done, which cannot demonstrate that the valve will 
close, but will demonstrate that the valve can move. 
Summers (2000) and Summers and Zachary (2002) discuss 
various means of performing a partial stroke test of a block 
valve and how this type of test can improve the SIS func¬ 
tional integrity and reliability. 

One example cited by Summers and Zachary (2002) 
is the use of the solenoid valve to partially close a block 
valve in de-energize to trip SISs. The test is performed by 
pulsing the power to the solenoid valve for a period of time 
necessary to move the valve from the full-open position. 
This partial test verifies the ability to vent the air from 
the process valve actuator, including the solenoid valve, 
the solenoid vent point, the air tubing between the valve 
actuator and the solenoid valve, and the movement of the 
valve actuator. To reduce the potential for spurious trips, 
redundant solenoids can be used. 

The PFD of the device that undergoes two partial tests 
can be evaluated as follows. First, the functional failure 
rate and proof test interval associated with one of the tests 
is determined using Z A and t pA , respectively. Then, the 
functional failure rate and the proof test interval associated 
with the second test is determined using and Zb and t p b, 
respectively. Therefore, 

<?a = l = exp(—Z A f) [34.10.1] 

? A = Z A f Z A f«l [34.10.2] 

Similarly, 

?b = Zb t Zb t «1 [34.10.3] 






SAFETY INSTRUMENTED SYSTEMS 34/29 


Then the PFD is: 



4> = \ OUtpA + 4 b t p b) [34.10.5] 

34.11 Special Applications 

34.11.1 High integrity protection systems 

The use of SISs instead of pressure relief valves is some¬ 
times an attractive proposition, particularly where the 
relief valve solution involves a large flare or toxic scrub¬ 
bing system or where the process pressure develops so 
rapidly that the relief valve size is unreasonably large. 

The former case is considered by Kletz (1974a) and by 
Lawley and Kletz (1975), who suggest that if an SIS is used 
instead of a relief valve, it should be designed for a reliability 
10 times that of the latter. The reason for this is the uncer¬ 
tainty in the relief valve failure rate data and the difference in 
the modes of failure; a relief valve that fails to operate at the 
set pressure may nevertheless operate at a higher pressure, 
whereas an SIS is more likely to fail completely. 

API 521 and ASME Code Case 2211 require that any SIS 
used to protect a vessel against overpressure must achieve 
the level of risk reduction that would typically be provided 
by the relief valve. Thus, the PHA is used to determine how 
much risk reduction is required to mitigate the overpressure. 
This yields how much risk reduction must be provided by 
the SIS. Layers of Protection Analysis (CCPS, 2001) discusses 
the use of protection layers to evaluate the risk reduction 
provided by the relief valves and the use of high integrity 
protective system (HIPS) for overpressure protection. 

Summers (2002, 2003a) discusses the design of HIPS 
applied to flare load reduction. In many flare load reduction 
projects, the design intent is to mitigate the overpressure 
event with the SIS such that the potential load from the 
vessel under review can be removed from the load calcula¬ 
tion. This typically results in a risk reduction requirement 
equivalent to SIL 3. To achieve SIL 3, the HIPS is fully 
redundant in the process sensors, logic solver and output 
devices. The HIPS must also be tested frequently or incor¬ 
porate diagnostics for all devices. 

Summers (2003b) discusses the application of HIPS to 
reactive hazards management. These HIPS are often more 
complicated than those used for flare load reduction. The 
logic required to achieve a safe state for flare load reduction 
is typically simple, such as high pressure initiating a shut¬ 
down of final elements, such as valves, pumps or com¬ 
pressors. For reactive processes, the logic can be complex 
due to the use of the following: 


multiple process variables, such as the reactive condi¬ 
tions are only achieved after a specific temperature is 
reached during the batch reaction; 
sequence-oriented, including the modification of trip 
setpoints at various stages or the enabling of different 
SISs at different steps of the batch reaction; 
operational state-based, such as the enabling of differ¬ 
ent trip setpoints dependent on whether the process is 
in normal operation or in regeneration mode; 
kinetic reaction-based, where the logic contains pre¬ 
dictive calculations based on process kinetics. 


The risk reduction requirement for reactive hazards man¬ 
agement is often a factor of lOOO.This risk reduction maybe 
achieved with a single layer SIS or with multiple SIS layers. 
The former results in an SIL 3 requirement. The latter may 
involve combinations of layers, and these layers must be 
examined for potential common mode failure. 

34.11.1.1 HIPS example 

A major application of advanced SIS design is the ethylene 
oxide process of ICI described by Stewart and co-workers 
(R.M. Stewart, 1971,1974a; R.M. Stewart and Hensley, 1971). 
The ethylene oxide process is extremely hazardous for two 
reasons: (1) it operates with a reaction mixture very close to 
the explosive limit and (2) there is a fire/explosion hazard, 
as well as a toxic release hazard. 

The design of the protective system followed the 
methods already outlined. The risk criterion was set at a 
hazard rate of 3 x 10 -5 fatalities per year. The hazards were 
assessed by means of a fault tree, part of which is shown 
in Figure 34.11. 

The system devised is a HIPS, consisting of the high 
integrity trip initiators (HITIs), the high integrity voting 
equipment (HIVE) and the high integrity shut-down system 
(HISS). A schematic system diagram, which omits repli¬ 
cated signal connections, is shown in Figure 34.12. 

Redundancy is fully exploited throughout the system. 
Against each logic path to fire/explosion in the fault tree 
at least one parameter was selected initially to be a trip 
initiator. The choice of the trip initiating parameters is 
important but difficult. Some are obvious such as high 
oxygen concentration, high reactor temperature or low 
recycle gas flow. Others are far less obvious, but are needed 
to guard against combinations of faults or to substitute for 
other parameters. 

The measuring instruments used are carefully selected 
and, if necessary, modified to ensure high integrity. Each 
parameter is measured by triplicated input sensors, voting 
2oo3. The arrangement of the shut-down valves in the oxy¬ 
gen line illustrates further the use of redundancy. There are 
two lines each with three valves. A single line represents a 
loo3 shut-down system. Duplication is provided to permit 
complete testing without bypassing. 

The advantages of this SIS design are that the failure of 
one trip initiator in the fail-safe mode does not cause the 
plant to be tripped spuriously, the failure of one trip initia¬ 
tor in the fail-dangerous mode does not prevent the plant 
from being tripped, and the proof testing can be done 
without bypassing any devices. 

The SIS design was subjected to an independent assess¬ 
ment by assessors within the company who were advised 
by the UKAEA. The assessors checked all feasible faults 
that could lead to hazardous conditions. They also eval¬ 
uated the capability of the HIPS to carry out the protective 
action against the hazardous conditions arising from such 
faults and the occurrence rate of other hazardous condi¬ 
tions that the HIPS would not prevent. The overall hazard 
rate was compared with the design target. Table 34.14 shows 
some of the results generated during this assessment. 

The assessment showed that at this stage the plant 
hazard rate was 4.79 x 10 _5 /year, which was higher than the 
target of 3 x 10 _5 /year. An extra HITI was used to reduce 
the contribution of fault 3 from 2.72 x 10 -5 to 0.8 x 10 -5 / 
year, which enabled the SIS to achieve the target FDT. 

The assessors also examined the HIPS as installed to 
ensure that there were no significant deviations from 





Figure 34.11 Fault tree for fire/explosion on an ethylene oxide plant (after P.M. Stewart, 1971) (Courtesy of the Institution of Chemical Engineers) 
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Figure 34.12 High integrity protective system (after 
Stewart, 1971) (Courtesy of the Institution of Chemical 
Engineers) 


design and reviewed the maintenance, calibration and test¬ 
ing procedures. The quality of the maintenance and testing 
is crucial to the integrity of a protective system and much 
attention was paid to this aspect. 

It was estimated that an alternative system with 70 lool 
single trip initiators would result in some 30 spurious trips 
a year and that the system used reduced this by a factor 
of over 12. Since the cost of a trip was estimated as £2000, 
the savings due to avoidance of spurious trips was about 
£55,000 per annum. The cost of £140,000 for the installation 
was therefore considered justified on these grounds alone. 

A second account of this installation has been given by 
A. Taylor (1981), who describes the operation of the SIS 
over the period 1971-80. Analysis of the actual process 
unit and SIS performance revealed, that in a few cases, the 
demand frequency was greater than originally estimated 
by orders of magnitude. The author gives a table listing 
seven fault conditions, with the event numbering rising to 
53, which exemplify the worst discrepancies. The two fault 
conditions which show the greatest discrepancies are the 
opening of a certain relief valve and loss of reaction: 


Fault description 

Fault condition 


Predicted 

frequency 

(events/ 

year) 

Actual 

frequency 

(events/ 

year) 

Ratio of 
actual1 
predicted 
frequency 

15 A certain relief 

0.001 

1.68 

1680 

valve open 

48b Loss of reaction 

0.01 

1.16 

116 


The relief valve fault was due to shimmering or feather¬ 
ing, which had not been anticipated. The loss of reaction 
fault is not explicitly explained, but references by the 
author to the effect of modifications in reaction conditions 
may hear on this. It is noteworthy that of the seven fault 
conditions it is those for which the original frequency esti¬ 
mates were lowest that are most in error. 

With regard to instrument failure rates, in the case of 
magnetic float switches, three different failure mecha¬ 
nisms, and three different failure rates, were observed. 
Switches operating submerged in clean lubricating oil 
recorded no failures; those operating in recycled gas with 
occasional slugs of dirty water choked up; and a new type 
of switch was found to suffer from corrosion. This illus¬ 
trates that the failure rate of a device is dependent on the 
specific type of device and the application environment. 


The author also noted three examples of dependent fail¬ 
ure. One of these relates to the choked level switches just 
mentioned, which were all on one vessel. On four occasions, 
testing of the switches revealed that all were choked. The 
test procedure was altered to require that if one switch was 
found to be choked, the others should be tested. 

There were also mistakes made in the installation of the 
instruments. In one case, pneumatic pressure switches, of a 
flameproof type which is not waterproof, were located 
downwind of a low pressure steam vent pipe and suffered 
water ingress and corrosion. 

34 11.2 Emergency shut-down systems 

In many process units, there are SISs to prevent or mitigate 
specific process risks. In addition, the process unit may he 
protected by ESDs or emergency isolation systems. One of 
the principal accounts of ESDs is given in Offshore Instal¬ 
lations: Guidance on Design and Construction, Guidance 
Notes to the Offshore Installations (Construction and Use) 
Regulations 1974 issued by the Department of Energy 
(1984) and Offshore Installations: Guidance on Design, Con¬ 
struction and Certification (HSE, 1990b) (the HSE Design, 
Construction and Certification Guidance Notes). In many 
cases, ESDs are safety-instrumented systems and the 
principles described previously can be applied. The fol¬ 
lowing is a discussion of ESDs, related to the above refer¬ 
enced texts. 

34.11.2.1 Conceptual design of ESD 

The function of an ESD system is to detect a condition or 
event sufficiently hazardous or undesirable as to warrant a 
shut-down and transition to a safe state. The potential 
hazards are determined through PHA. Estimates are then 
made of the frequency and consequences of these hazards. 
The ESD can then be specified based on the identified 
operating parameters that must be kept within limits if the 
hazards are to be avoided and selecting shut-down actions 
that will act when these limits are exceeded. A shut-down 
sequence is determined, and the shut-down logic is for¬ 
mulated. It is not always necessary to shut-down the whole 
plant. There are different levels of ESD, which fall short of 
this, such as shut-down of an individual unit or of a section 
of a plant. 

34.11.2.2 Initiation of ESD 

The configuration of the shut-down initiators of the ESD is 
critical. If the configuration is poor, the ESD will not be 
activated when it should be. A balance must be achieved 
between the functional integrity and operational reliability 
of the ESD system. It should act when a hazard arises, but 
should not cause unnecessary shut-downs. 

One factor that affects this balance is that the plant is 
safest in the normal operating mode and that transitions, 
such as shut-down and start-up, tend to be more prone to 
hazards and should be avoided unless necessary. Another, 
related factor is that shut-down of one unit may result in 
process demands in other process units, causing initiation 
of other ESDs. These ‘cascade trips’ increase the hazard rate 
in the plant and should be avoided. 

ESD initiation may be manual or automatic. Manual 
initiation may use a shut-down button in the control room 
and/or a local shut-down button in the process unit. Auto¬ 
matic means are accomplished using instrumentation, 
including the fire and gas system and/or the SIS. Measures 
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should be taken to avoid inadvertent activation, including 
failures or errors during maintenance and testing. 

34.11.2.3 Action on ESD 

There are a variety of actions that an ESD system may take. 
Three principal types are: 

(1) flow isolation; 

(2) energy reduction; 

(3) material transfer. 

Flow isolation includes isolation of feed and other flows. It 
often involves shut-down of machinery and may include 
isolation of units. Energy reduction covers shut-off of heat 
input, as well as initiation of additional cooling. Material 
transfer refers to pressure reduction, venting, or blow- down. 

A fundamental principle in ESD design is failure to a 
safe state. The overall objective is failure to a safe state for 
the system as a whole. This is normally performed by 
applying the principle to individual units, but there may be 
exceptions, and cases should be considered individually. 
Each required action of the ESD system should be affected 
by positive means. Reliance should not be placed on the 
cascading effect of other trip actions. 

34.11.2.4 Detail design of ESD system 

It is a fundamental principle that protective systems be 
independent of the rest of the instrument and control sys¬ 
tem, and this applies equally to an ESD. The ESD design 
should generally follow the principles that apply to SISs, as 
previously described. There should be a balance between 
functional and operational reliability. Dependent failures 
should be considered. The reliability may be assessed using 
fault tree and other methods. The techniques of diversity 
and redundancy should be used as appropriate. Use may be 
made of majority voting systems. 

The emergency shut-down valves (ESVs) should have a 
high degree of integrity. Such valves are frequently provided 
with pneumatic or hydraulic power supplies, in addition to 
electricalpower supply. An ESVshouldbe located so that it is 
unlikely to be disabled by the type of incident against which 
it is intended to protect. 

The ESD system should be provided with power supplies 
that have a high degree of integrity. The normal approach is 
to provide a UPS. This supply should be designed and 
located so that it is unlikely to be disabled by the incident 
itself. The cables from the power supply to the final shut¬ 
down elements should be routed and protected to avoid 
damage by the incident. 

34.11.2.5 Operation of ESD system 

The operator should be notified of any change in ESD sta¬ 
tus. This includes indication that the ESD is in bypass, 
under test or under maintenance. Initiation of the ESD 
should activate audible and visual alarms in the control 
room. There should be an indication of the source of the 
initiation, whether manual or instrument. The ESD should 
also be signalled by an alarm that is part of the general 
alarm system. 

It maybe necessary in certain situations, such as start-up, 
changeover or maintenance, to bypass at least part of the 
ESD system, but such bypassing should be governed by 
formal procedures. The principles are analogous to those 
that apply to an SIS, as described previously. 
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34.11.2.6 Testing and maintenance of ESD system 

The ESD system should be subject to periodic proof testing 
and such testing should he governed by a formal procedure. 
The principles of proof testing were discussed previously. 
As far as is practical, the test should cover the complete 
system from initiation to shut-down condition. 

The need for proof testing and, more generally, for the 
detection of unrevealed failure should be taken into 
account in the design. The equipment should be designed 
for ease of testing. It should be segregated and clearly 
identified. Techniques for detection of instrument failure 
should be exploited. In voting systems, the failure of a single 
channel should be signalled. 

34.11.2.7 Documentation of an ESD system 

The ESD system should be fully documented. The HSE 
Design, Construction and. Certification Guidance Notes give 
details of recommended documentation. 

34.11.2.8 ESD of a gas terminal 

The design of systems for ESD and emergency depressur¬ 
ization (EDP) of a gas terminal has been described by Valk 
and Sylvester-Evans (1985). The design philosophy descri¬ 
bed is that: (1) the ESD system should operate only in an 
extreme emergency, (2) the ESD and EDP systems are 
separate from the control, SIS and relief systems and (3) that 
the systems should be simple and reliable. 

The preliminary design of the ESD and EDP systems 
was reviewed by means of a HAZOP study. Potential 
operational failures were studied using general reliability 
engineering methods and functional failures were studied 
using, in particular, fault tree analysis. A further HAZOP 
was conducted on the final design for the ESD and EDP 
system. 

Design studies showed that executing a totally fail-safe 
concept would result in a relief and flare system of excep¬ 
tional size. Alternatives considered were to allow an 
increase in the depressurization time for certain critical 
equipment beyond that recommended in the API RP 521 
and to control the peak depressurization flow in the relief 
and flare system. In the design adopted, the plant was 
divided into sections, such that the depressurization of 
each section could be done independently and the opera¬ 
tion of the sections was interlocked. The depressurization 
time of certain items was extended to 30 min as opposed to 
the 15 min recommended in API RP 521, but the design 
compensated for this extension by provision of additional 
fireproofing and water cooling arrangements. 

The authors highlight the differences of philosophy 
between companies on whether the ESD and EDP systems 
should be used for normal shut-down and depressurization 
or reserved as systems dedicated for emergency use. This 
project reaffirmed the need to consider the ESD and EDP 
systems at an early stage and to avoid treating them as 
‘add-on’ features to be dealt with late in the design. 

34.11.2.9 ESD on Piper Alpha 

The ESD system on Piper Alpha illustrates a number of the 
points just made. Overall, the system was largely effective 
in achieving shut-down, venting and blow-down, but there 
were a number of features which are of interest. 

The main ESD button initiated closure of the ESV on the 
main oil pipeline hut not on the ESVon the three gas pipelines. 
One reason for this was that closure of these latter ESVs 
would impose a forced shut-down on the linked platforms. 


There were three separate shut- down buttons, one for each of 
these valves, and shut-down depended on manual action by 
the control room operator—he was thrown across the control 
room by the explosion. 

The ESVs on the risers of the gas pipelines were located 
so that they were vulnerable to the fires that developed. 
This defect was widespread throughout the North Sea and 
regulations were introduced without delay to require such 
valves to be relocated. There was also evidence that some of 
the ESVs did not achieve tight shut-off. The explosion 
damaged power supplies, and, in some cases, closure of 
ESVs occurred, not due to survival of the intended power 
supply, but fortuitously. Further details are given in 
Appendix 19. 


34.11.3 Toxic storage instrumentation 

On plants handling high toxic hazard materials (HTHM), 
the instrumentation and control system assumes parti¬ 
cular importance. Some relevant considerations are out¬ 
lined in Guidelines for Safe Storage and Handling of High 
Toxic Hazard Materials by the CCPS (1988/2) (the CCPS 
HTHM Guide). 

Depending on the degree of hazard, the instrumentation 
and control system should be of high integrity. This 
requires adherence to the various principles already 
described for high integrity design, including the applica¬ 
tion of fail-safe design and the use, as appropriate, of high 
reliability instrumentation, instrument diversity and 
redundancy and high quality maintenance. It also involves 
the application of the techniques of hazard identification 
and assessment to the design. 

With respect to process variable measurement, principal 
considerations are that the potential for release from the 
instrument, or its fittings, should be minimized, that the 
instrument be reliable and that the measurement be accu¬ 
rate. For flow measurements, the use of non-invasive sen¬ 
sors, such as magnetic flowmeters, and avoidance of glass 
in instruments, such as rotameters is preferred. Orifice 
flowmeters also have the disadvantage of an extra flange 
and associated piping. For pressure measurement, dia¬ 
phragm pressure sensors are preferred to direct-connected 
gauges of the Bourdon tube type. Precautions to be taken 
where the latter have to be used include protection by inert 
liquid filling in corrosive service and installation of isola¬ 
tion valves and, possibly, flow limiters in the form of 
restriction orifices. For level measurement, weighing 
methods have advantages, but use of sight glasses should 
be avoided. For temperature measurement, particular care 
should be taken in the design of the thermowell, which can 
be a weak point. 

The arrangements for control and protection should 
address the hazards of particular importance for the stor¬ 
age of toxics. These include: (1) overpressure, (2) over¬ 
filling, (3) over-temperature and (4) high release flow. For 
overpressure, the main requirements are the provision of 
overpressure protection and of means of disposal for the 
relief flows. For overfilling, a significant role is likely to he 
played by SISs. For temperature deviations, which may 
indicate reaction runaway or thermal stratification with its 
attendant risk of rollover, the need is for warning. Some 
methods of dealing with excess temperature are described 
below. High release flow rates following a failure of con¬ 
tainment may be mitigated by the use of suitable control 
valve trims and of restrictor orifices or excess flow valves. 
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Storage of a reactive chemical requires close monitoring 
with respect to temperature and contamination. Methods of 
temperature control include the use of cooling coils, a 
reflux condenser, a quench system and short stop arrange¬ 
ment. All these methods depend on good mixing in the 
tank. Consequently, recirculation of the reactive chemical 
through a cooler is often used. Contamination can be 
introduced by putting the wrong chemicals in the tank or 
by using the wrong materials of construction for the tank, 
seals, or other peripheral equipment. Procedures and 
training are necessary to prevent these occurrences. 

34.11.4 Interlock systems 

Interlocks are another important type of protective device. 
They are used to: (1) control operations that must take 
place in a specified sequence or (2) ensure that one piece of 
equipment is in a specific state relative to other equipment. 
This definition of an interlock differs from that often used in 
the American literature, where the term ‘interlock’ tends to be 
applied to both SIS and interlock systems (as defined here). 

Accounts of interlock systems are given in Applied Sym¬ 
bolic Logic (E.P. Lynch, 1980) and Logical Design of Auto¬ 
mation Systems (V.B. Friedman, 1990) and by D. Richmond 
(1965), E.G.Williams (1965), Becker (1979), Becker and Hill 
(1979), Kohan (1984) and the CCPS (1993/14). 

In general, interlocks are used to prevent operation of 
equipment under unsafe condition.There are various means 
for implementing interlocks. These include mechanical 
devices, such as a padlock and chain on a hand valve, keyed 
interlocks and software interlocks implemented using pro¬ 
cess computers. Interlocks are usually simple in design, but 
can incorporate redundancy if high integrity is required for 
the application.Typical applications of interlocks include: 

(1) electrical switchgear; 

(2) test cubicles; 

(3) machinery guards; 

(4) vehicle loading; 

(5) conveyor systems; 

(6) machine start-up and shut-down; 

(7) valve systems; 

(8) instrumented systems; 

(9) fire protection systems; 

(10) plant maintenance. 

For example, electrical switchgear may be installed in a 
room where an interlock prevents the door from opening 
until there is electrical isolation. Similarly, an interlock may 
be used to prevent access to a test cubicle where high pres¬ 
sure or explosive materials are present until safe conditions 
are achieved. An interlock may be also used to stop access 
to a machine or entry into a vessel unless the associated 
machinery cannot move. In vehicle loading, interlocks are 
used to prevent a tanker from moving while it is still con¬ 
nected to the unloading arm. Pressure relief valves have 
interlocks to prevent all the parallel valves from being iso¬ 
lated simultaneously. There may be interlocks on other criti¬ 
cal valve systems. 

Interlocks may also be used to ensure sequenced opera¬ 
tion, as in a conveyor system. Interlocks are used for the 
start-up of machinery to ensure that all the pre-start con¬ 
ditions are met, that the correct sequence is followed, and 
that conditions for transition from stage to stage are met. 
For large rotating machinery, key factors are process con¬ 
ditions and oil pressures. 


Interlocks are often a subset of a SIS. An interlock may be 
used to prevent the disarming of an SIS unless certain 
conditions are met. Fire protection systems are provided 
with interlocks as a safeguard against leaving the system 
in bypass, particularly after testing or maintenance. Plant 
maintenance operations make much use of interlocks to 
prevent valves being opened or machinery started up while 
work is in progress. 

Some features of a good hardware interlock are that it: 
(1) controls operations positively, (2) is incapable of defeat, 
(3) is simple, robust and inexpensive, (4) is readily and 
securely attachable to engineering devices and (5) is regu¬ 
larly tested and maintained. 

Many interlocks are quite simple, but some are quite 
complex. When interlocks involve complex logic functions, 
they are effectively safety instrumented systems and can 
be designed in the same manner. In particular, there are 
some very large interlock systems on boilers and gas tur¬ 
bines. For example, control of sequential operations is often 
executed using numerous checks that must be satisfied 
before the next stage is initiated and checks that equipment 
has obeyed the control signals. These checks constitute a 
form of interlock. 

Since an interlock can bring the process to a halt, it is 
important to provide ‘first-out indication,’ including ade¬ 
quate status and alarm signals to indicate what initiated 
the stoppage. 


34.11.4.11nterlock diagrams 

As with safety instrumented systems, interlock design may 
involve a number of parties. For effective design, a common 
language and approach are needed. Unfortunately, there is 
substantial disagreement in the field related to the type of 
diagram used to describe the logic, the representation of 
symbols and the nomenclature. While standards have been 
written to cover these areas, thesymbols used in some are not 
in common use and the standards are subject to continuous 
revision. 

Three types of diagrams commonly used in the process 
industry are: (1) the process flowchart, (2) the logic diagram 
and (3) the ladder diagram. The last two are sometimes 
referred to as the ‘attached logic diagram’ and the ‘detached 
logic diagram,’ respectively. A process flow chart can be 
used to describe the sequence of operations. Process flow 
chart symbols have been given in Work Study (Curie, 1960) 
and are shown in Table 34.16, Section A. The logic required 
to implement this sequence may be shown in a logic dia¬ 
gram. This utilizes standard symbols for functions such as 
OR, AND and NOT, similar to those used in fault tree work, 
as described in Chapter 9. Standard symbols for fault trees 
are given in BS 5760 Reliability of Systems, Equipment and 
Components, Part 7: 1991 Guide to Fault Tree Analysis. 
Typical logic symbols are shown in Table 34.15, Section B. 

The logic diagram may then be converted to a ladder 
diagram. Standard symbols for protective logic systems 
are given in BS 3939:1985 Graphical Symbols for Electrical 
Power, Telecommunications and Electronic Diagrams. The 
relevant IEC standard is IEC 617 Graphical Symbols for 
Diagrams. BS 3939: Part 7: 1985 Switchgear, Controlgear 
and Protective Devices, which is identical to IEC 617-7, gives 
relevant symbols. Other sets of symbols include those 
given by E.G. Williams (1965) and those of E.P. Lynch 
(1980). An account of the evolution of logic symbols is given 
in An Introduction to the New Logic Symbols (Kampel, 1986). 
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Table 34.15 Interlock logic symbols 

A Work study symbols 3 

Symbol 

Activity 

Predominant result 

o 

Operation 

Produces, accomplishes changes 
further the process 

□ 

Inspection 

Verifies quantity or quality 

D 

Transport 

Moves or carries 

D 

Delay 

Interferes or delays 

V 

Storage 

Holds, retains or stores 

B Logic sysmbols b 


AND 


O 


OR 

NOT 


Delay 


C Ladder diagram symbols 3 

PB start 

Pushbutton start 

-• •- 


PB stop 

—_l_— 

Pushbutton stop 


Position, or limit, switch 

—II— 

Relay or solenoid contacts, normally open, 
closed when relay or solenoid is energized 

—^— 

Relay or solenoid contacts normally closed, 
opened when relay or solenoid is energized 

-(Mn)- 

Motor n 

-(fin)- 

Relay n 

-(Sn)- 

Solenoid n 


a These symbols are given by Currie (1960), who attributes them without reference to the American Society of Mechanical Engineers. 
b These symbols are given in BS 5670: Part 7:1991. The alternative symbol for NOT is a common alternative and is that used by E.P. Lynch (1980). 
c These symbols are those used by E.P. Lynch (1980). 
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Table 34.16, Section C, shows a selection of symbols, 
including those used here, from those given by Lynch. 

34.11.4.2 Some basic systems 

Some of the basic building blocks of interlock systems are 
illustrated using a simple starting circuit in Figure 34.13. 
Activation of the circuit occurs when a signal is generated 
by depression of the start pushbutton AND a signal due to 
non-depression of the stop pushbutton. Once activated, the 
circuit is maintained in the ‘on’ state until reset by the 
operator by depression of the stop pushbutton. 

Figure 34.13(b) shows a time-delayed holding circuit. If 
following activation by the start pushbutton, the signal X 
does not appear within the time interval specified, the 
output signal disappears. A typical application of this cir¬ 
cuit is start-up of a motor-driven pump, which is supplied 
with lubricating oil by a lube oil pump driven from the same 
motor. If after the time interval specified, the lubricating 
oil pressure signal is still absent, the pump is shut-down. 

Figure 34.13(c) shows a self-extinguishing circuit. Acti¬ 
vation of the pushbutton gives an output signal, which 
continues until the time interval specified has elapsed. 
Then, the output signal is extinguished. This circuit might 
typically be used to have a motor-driven equipment run for 
a period and then shut-down. 

34.11.4.3 Illustrative example: conveyor system 

As an illustration of an interlock system, consider the con¬ 
veyor system described by Lynch. The screw conveyor A 


feeds material from a car vibrator to an elevator, which 
discharges to screw conveyor B above two storage bins A 
and B. There is a slide gate on the pipe between conveyor B 
and each bin, with a limit switch on each gate. Material is 
fed from a bin by a star feeder into screw conveyor C. The 
loading equipment can fill the bins at several times the rate 
at which it can be withdrawn. 

Figure 34.14(a) shows a logic diagram for the interlocks 
for manual operation of this system. Conveyor B can be 
started only if either A or B slide gate is open. The elevator 
can be started only if conveyor B is running. Conveyor A 
can be started only if the elevator is running. The diagram 
also shows the simple non-interlocked starting circuit for 
the car vibrator. 

The corresponding ladder diagram is shown in Fig¬ 
ure 34.14(b). The diagram shows six circuits A-F. Certain 
relays occur in more than one circuit, for example, relay R1 
in circuits A and D, and this imparts the interlocking fea¬ 
ture. Circuit A is the starting circuit for conveyor B. This 
circuit can be activated only if either relay R2 or R3, the 
relays for the slide gates limit switches (LS), is closed. If 
this condition is met, depression of the start pushbutton 
(PB) energizes relays R1 and Ml and causes R1 to close and 
Ml to operate a relay in the power circuit. When the stop 
pushbutton is pressed, the circuit is de-energized and 
R1 opens. 

In circuit B, closure of the slide valve limit switch LSI 
energizes relay R2 and causes it to close, and opening of the 
switch causes R2 to open. Circuit C implements a similar 



(a) 


PB start 
PB stop 
Signal X 




Figure 34.13 Some basic interlock system logic diagrams: (a) simple starting circuit; (b) time delayed holding circuit; 
and (c) self-extinguishing circuit. PB, pushbutton 


















SAFETY INSTRUMENTED SYSTEMS 34/37 




Figure 34.14 Conveyor interlock system diagrams: (a) logic diagram, and (b) ladder diagram (E.P. Lynch, 1980) 
(Reproduced with permission from Applied Symbolic Logic by E.P. Lynch, Copyright ©, 1980, John Wiley and Sons Inc.) 


relationship between limit switch LS2 and relay R3. Circuit 
D is the starting circuit for the elevator. The circuit can be 
activated only if relay R1 is closed. If this condition is 
met, depression of the start button energizes relays R4 
and M2 and causes R4 to close and M2 to operate. Circuit E 
is the starting circuit for conveyor A, and is similar to 
circuit D. The circuit can be activated only if relay R4 is 


closed. Circuit F is a simple starting circuit and is not 
interlocked. 

34.11.4.4 Illustrative example: reactor system 
Another example of a simple interlock system is illustrated 
in Figures 34.15 and 34.16. Figure 34.15 shows a plant con¬ 
sisting of a water-cooled reactor in which a batch reaction is 



































34/38 SAFETY INSTRUMENTED SYSTEMS 





Figure 34.15 Batch reactor system. FIC, flow indicator controller; S, speed measurement; Tl, temperature indicator; 
TIC, temperature indicator controller 



Figure 34.16 Batch reader interlock system logic diagram 
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carried out. The reactor is charged with chemical A and 
chemical B is then fed in gradually from a weigh tank as 
the reaction proceeds. The interlock system is required to 
cut off the supply of B from the weigh tank if any of the 
following conditions apply: (1) the shut-off valve V3 on 
reactor 2 is open, (2) the agitator is not operating, (3) the 
agitator paddle has fallen off, or (4) the reactor temperature 
has risen above a fixed limit. The loss of the agitator paddle 
is detected by a current-sensitive relay on the motor. 

An interlock system for carrying out these functions is 
shown in Figure 34.16. The start input opens valve 1, unless 


valve 3 is open or the agitator is stopped, which conditions 
inhibit start-up. If these conditions occur later or if the 
reactor temperature rises or the agitator paddle falls off, 
valve 1 is closed. The interlock causing the closure is sig¬ 
nalled by a status or alarm display. There is a 10 s delay on 
the reactor high temperature interlock to allow for noise on 
that signal. If operation is inhibited by the high reactor 
temperature or agitator stoppage interlocks, these inter¬ 
locks are reset at 5 and 10 min, respectively, after the inhib¬ 
iting condition has cleared. An account of the reliability of 
interlock systems is given by R.A. Freeman (1994). 
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35/2 CHEMICAL SECURITY 


35.1 Introduction 

Security is a critical element of the management of a process 
facility. Security management is required for protecting 
the assets (including employees) of the facility, maintaining 
the ongoing integrity of the operation and preserving value 
of the investment. Process security and process safety have 
manyparallels.andmakeuseofmanycommonprogrammes 
and systems for achieving their ends. Process security 
requires a management systems approach to develop a 
comprehensive security programme, which shares many 
common elements to process safety management. 

The foundation of the security management system is a 
security vulnerability assessment (SVA), which is intended 
to identify security vulnerabilities from a wide range of 
threats ranging from vandalism to terrorism. With the 
recognition of threats, consequences, vulnerabilities and 
the evaluation of the risk of security events, a security 
management system can be organized that will effectively 
mitigate the risks. 

The world of safety and security in the chemical process 
industries has certainly changed since the terrorist attack 
on the United States on 11 September 2001. This and other 
violent acts pose a new risk paradigm for chemical security. 
The design and operation of a facility must now consider 
extreme acts of violence rather than only less severe threats. 

35.2 Security Management System 

A comprehensive process security management system must 
include management programme elements that integrate and 
work in concert to control security risks. The thirteen man¬ 
agement practices shown in Figure 35.1 are an example of 
a management system developed for the chemical industry: 

The purpose of the management system is to ensure the 
ongoing, professional and systematic application of secur¬ 
ity principles and programmes to achieve a level of speci¬ 
fied security. Traditional security management is not based 
on a management system and so is not necessarily a 
thorough, ongoing, risk-based, pro-active approach, but is 
more generally based and is reactive to security incidents 
primarily. 

The process security management system is to ensure the 
protection of people, property, products, processes, infor¬ 
mation and information systems and thereby ensure the 
continuity of the operation and supporting or dependent 
infrastructure. The chemical industry value chain encom¬ 
passes company activities associated with the design, 
procurement, manufacturing, marketing, distribution, 
transportation, customer support, use, recycle and disposal 
of products Site Security Guidelines for the U.S. Chemical 
Industry (American Chemistry Council, October 2001). 

The Security Code published by the American Chemistry 
Council is designed to help companies achieve continuous 
improvement in security performance using a risk-based 
approach to identify, assess and address vulnerabilities, 
prevent or mitigate incidents, enhance training and 
response capabilities and maintain and improve relation¬ 
ships with key stakeholders. Each company must 
implement a risk-based security management system for 
people, property, products, processes, information and 
information systems throughout the chemical industry 
value chain. The chemical industry value chain encom¬ 
passes company activities associated with the design, 
procurement, manufacturing, marketing, distribution, 
transportation, customer support, use, recycle and disposal 


(1) Leadership Commitment 


(2) Analysis of Threats, Vulnerabilities, and Consequences 


(3) Implementation of Security Measures 


(4) Information and Cyber Security 


(5) Documentation 


(6) Training, Drills, and Guidance 


(7) Communications, Dialogue, and Information Exchange 


(8) Response to Security Threats 


(9) Response to Security Incidents 


(10) Audits 


(11) Third-Party Verification 


(12) Management of Change 


(13) Continuous Improvement 


Figure 35.1 Example process security management 
system Site Security Guidelines for the U.S. Chemical 
Industry (American Chemistry Council, October 2001) 

of our products. The corresponding security management 
system must include the following thirteen management 
practices: 

(1) Leadership Commitment. Senior leadership commit¬ 
ment to continuous improvement through published 
policies, provision of sufficient and qualified resources 
and established accountability. 

(2) AnalysisofThreats,Vulnerabilitiesand Consequences. 
Prioritization and periodic analysis of potential secu¬ 
rity threats, vulnerabilities and consequences using 
accepted methodologies. 

(3) Implementation of Security Measures. Development 
and implementation of security measures commensu¬ 
rate with risks, and taking into account inherently 
safer approaches to process design, engineering and 
administrative controls and prevention and mitigation 

(4) Information and Cyber-Security. Recognition that 
protecting information and information systems is a 
critical component of a sound security management 
system. 

(5) Documentation. Documentation of security manage¬ 
ment programmes, processes and procedures. 

(6) Training, Drills and Guidance. Training, drills and 
guidance for employees, contractors, service provi¬ 
ders, value chain partners and others, as appropriate, 
to enhance awareness and capability 

(7) Communications, Dialogue and Information 
Exchange. Communications, dialogue and informa¬ 
tion exchange on appropriate security issues with 
stakeholders such as employees, contractors, com¬ 
munities, customers, suppliers, service providers 
and government officials and agencies balanced 
with safeguards for sensitive information. 
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(8) Response to Security Threats. Evaluation, response, 
reporting and communication of security threats as 
appropriate. 

(9) Response to Security Incidents. Evaluation, response, 
investigation, reporting, communication and correc¬ 
tive action for security incidents. 

(10) Audits. Audits to assess security programmes, and 
processes and implementation of corrective actions. 

(11) Third-Party Verification.Third-party verification that, 
at chemical operating facilities with potential off-site 
impacts, companies haveimplementedthephysical site 
security measures to which they have committed. 

(12) Management of Change. Evaluation and management 
of security issues associated with changes involving 
people, property, products, processes, information or 
information systems. 

(13) Continuous Improvement. Continuous performance 
improvementprocessesentailingplanning, establish¬ 
ment of goals and objectives, monitoring of progress 
and performance, analysis of trends and development 
and implementation of corrective actions. 

35.3 Security Strategies 

A basic premise is that all security risks cannot be com¬ 
pletely prevented. Appropriate strategies for managing 
security can vary widely depending on the circumstances 
including the type of facility and the threats facing the 
facility. As a result, it is difficult to prescribe security 
measures that apply to all facilities in all industries, but 
instead it is suggested to use SVA as a means of identifying, 
analysing and reducing vulnerabilities. The specific situa¬ 
tions must be evaluated individually by local management 
using best judgement of applicable practices. Appropriate 
security risk management decisions must be made com¬ 
mensurate with the risks. This flexible approach recog¬ 
nizes that there isn’t a uniform approach to security in the 
chemical process industry, and that resources are best 
applied to mitigate high risk situations primarily. 

Security strategies for the process industries are gen¬ 
erally based on the application of four key concepts against 
each threat (Managing and Analyzing the Security Vulner¬ 
abilities of Fixed Chemical Sites AIChE, August 2002.): 

(1) Deterrence 

(2) Detection 

(3) Delay 

(4) Response 

In the context of security of a process facility, the security 
strategies of deter, detect, and delay are defined as follows. 
(Managing and Analyzing the Security Vulnerabilities of 
Fixed Chemical Sites AIChE, August 2002.): 

Deter: A security strategy to prevent or discourage the 
occurrence of a breach of security by means of fear or 
doubt. Physical security systems such as warning signs, 
lights, uniformed guards, cameras, bars are examples of 
systems that provide deterrence. 

Detect: A security strategy to identify an adversary 
attempting to commit a malicious act or other criminal 
activity in order to provide real-time observation, inter¬ 
ception and post-incident analysis of the activities and 
identity of the adversary. 

Delay: A security strategy to provide various barriers to 
slow the progress of an adversary in penetrating a site to 


prevent an attack or theft, or in leaving a restricted area to 
assist in apprehension and prevention of theft. 

Response: The act of reacting to detected criminal 
activity either immediately following detection or post¬ 
incident via surveillance tapes or logs. 

A complete security design includes these four concepts 
in ‘Layers of Protection’ or a ‘Defense in Depth’ arrange¬ 
ment. Examples of these physical protection concepts and 
their associated countermeasures are graphically depicted 
in Figure 35.2 (adapted from ‘Site Security Guidelines for 
the U.S. Chemical Industry’, American Chemistry Council 
(ACC), October 2001) and Figure 35.3. The most critical 
assets should be placed in the centre of conceptual con¬ 
centric levels of increasingly more stringent security mea¬ 
sures. In the concept of rings of protection, the spatial 
relationship between the location of the target asset and the 
location of the physical countermeasures is important. 

In the case of malicious acts, the layers or rings of pro¬ 
tection must be particularly robust because the adversaries 
are intentionally attempting to breach the protective fea¬ 
tures and can be counted on to use whatever means are 
available to be successful. This could include explosions or 
other initiating events that result in widespread common 
cause failures. Some particularly motivated adversaries 
might commit suicide attempting to breach the security 
layers of protection. 

35.4 Countermeasures and Security Risk 
Management Concepts 

Countermeasures are actions taken to reduce or eliminate 
one or more vulnerabilities. Countermeasures include 
hardware, technical systems, software, interdictive 
response, procedures and administrative controls. 

Security risk reduction at a site can include the following 
strategies: 

(1) Physical Security 

(2) Cyber Security 

(3) Crisis Management and Emergency Response Plans 

(4) Policies and Procedures 

(5) Information Security 

(6) Intelligence 

(7) Inherent Safety 

35.5 SVA Methodologies 

There are several SVA techniques and methods available to 
the industry, all of which share common elements. 

The following is a list of some available SVA methodolo¬ 
gies published by various government, private and trade/ 
professional organizations. Some are merely chapters or 
sections of documents that address security or risk 
assessment/risk management in broader terms. Some are 
SVA/VA publications by themselves. Some of these ‘meth¬ 
ods’ are complete, systematic analytical techniques and 
some are more checklist in nature. 

(1) American Institute of Chemical Engineers Center for 
Chemical Process Safety: Guidelines For Analyzing and 
Managing the Security Vulnerabilities of Fixed Chemical 
Sites 

(2) American Petroleum Institute/National Petroleum 
Refiner’s Association, Security Vulnerability Assess- 
ment Methodology for the Petroleum Industry. 
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Figure 35.2 Defense in depth concept for security (layers of protection) 


(3) National Institute of Justice, Chemical Facility Vul¬ 
nerability Assessment Methodology, Jul. 2002 (this is 
summary of SandiaVAM). 

(4) US Army, FM 3 -19.30, Physical Security, appendix K. 

(5) Military Handbook, MIL-HDBK 1013/1A, Design 
Guidelines For Physical Security of Facilities. 

(6) Department of Energy, Office of Energy Assurance, 
Energy Infrastructure Risk Management Checklists For 
Small and Medium Sized Businesses, 19 August 2002. 

(7) Department of Transportation, RSPA, Surface Trans¬ 
portation Vulnerability Assessment, 25 October 2001. 

(8) Department of Transportation, RSPA, Enhancing 
Security of Hazardous Materials Shipments Against 
Acts of Terrorism and Sabotage Using RSPA’s Risk 
Management Self-Evaluation Framework (RMSEF), 
Jan. 2002. 

(9) National Infrastructure Protection Center, Risk 
Management: An Essential Guide to Protecting 
Critical Assets, Nov. 2002. 

(10) Synthetic Organic Chemical Manufacturers 
Association, Inc. (“SOCMA”); Manual on Chemical 
Site Security Vulnerability Analysis Methodology 
andModel 

(11) American Society of Industrial Security, General 
Security Risk Assessment Guideline. 

(12) North American Electric Reliability Council, Vulner¬ 
ability and Risk Assessment, Ver 2. 

(13) North American Electric Reliability Council, Security 
Guidelines for the Electricity Sector,Ver 1,14 June 2002. 


Ultimately, it is the responsibility of the owner/operator to 
choose the SVA method and depth of analysis that 
best meets the needs of his specific location. Differences 
in geographic location, type of operations, and on-site 
quantities of hazardous substances all play a role in 
determining the level of SVA and the approach taken. 


Independent of the SVA method used, all techniques 
include the following: 

(1) Characterize the facility to understand what critical 
assets need to be secured, their importance and their 
interdependencies and supporting infrastructure, 
and the consequences if they are damaged or stolen; 

(2) Identify and characterize threats against those assets 
and evaluate the assets in terms of attractiveness of 
the targets to each adversary; 

(3) Identify potential security vulnerabilities that threa¬ 
ten the system’s service or integrity; 

(4) Determine the risk represented by these events or 
conditions by determining the likelihood of a suc¬ 
cessful event and the consequences of an event if it 

(5) Rank the risk of the event occurring and, if high risk, 
make recommendations for lowering the risk; 

(6) Identify and evaluate risk mitigation options (both 
net risk reduction and benefit/cost analyses) and 

One approach to conducting a SVA is shown in Figure 35.4. 
This methodology was published by the American Petro¬ 
leum Institute and the National Petrochemical and Refiners 
Association in their guidelines Security Vulnerability 
Assessment for the Petroleum and Petrochemical Industries, 
American Petroleum Institute, May 2003. 


35.6 Defining the Risk to be Managed 

For the purposes of an SVA, the definition of risk is 
shown in Figure 35.5. The risk that is being analysed for the 
SVA is defined as an expression of the likelihood that a 
defined threat will target and successfully attack a specific 
security vulnerability of a particular target or combination 
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Figure 35.3 Defense in depth/layers of protection concept for a chemical process facility Moore, David, Applying Inherently Safer Technologies for Security of 
Chemical Facilities, 38th Annual Loss Prevention Symposium, AlChE 2004 Spring National Meeting, New Orleans, Louisiana, April 26-29, 2004 
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Step 3: 
Vulnerability 






Step 5: 
Countermeasures 
Analysis 


1.1 Identify critical assets 

1.2 Identify critical functions 

1.3 Identify critical infrastructures and interdependencies 

1.4 Evaluate existing countermeasures 

1.5 Evaluate impacts 

1.6 Select targets for further analysis 

2.1 Adversary identification 

2.2 Adversary characterization 

2.3 Target attractiveness 

3.1 Identify vulnerabilities 

3.2 Evaluate effectiveness of existing security measures 

3.3 Estimate degree of vulnerability 


4.1 Estimate risk of successful attack 

4.2 Prioritize risks 


5.1 Identify and evaluate countermeasures options 

5.2 Prioritize potential enhancements 

5.3 Cost/Benefit Analysis 


Figure 35.4 API/NPRA Security vulnerability assessment methodology 


Intentional Release Risk is a function of: 

Accidental Release Risk is a function of: 

Consequences of a successful attack 
against an asset and likelihood of a 
successful attack against an asset. 

Consequences of an accidental event 
and likelihood of the occurrence of the 

Likelihood is a function of: 

Likelihood is a function of: 

the Attractiveness to the adversary 
of the asset, 

the degree of Threat posed by the 
adversary and the degree of 
Vulnerability of the asset. 

The probability of an event cascading 
from initiating event to the consequences 
of interest and the frequency of the events 
over a given period. 


Figure 35.5 Intentional Release vs Accidental Release - Risk Definitions 


of targets to cause a given set of consequences. This is 
contrasted with the usual accidental risk definitions. The 
risk variables are defined as shown in Figure 35.6. 

35.7 Overview of a SVA Methodology 

The SVA process is a risk-based and performance-based 
methodology. The user can choose different means of 
accomplishing the general SVA method so long as the end 
result meets the same performance criteria. The overall 
5-step approach of the API/NPRA SVA methodology is 
described as follows: 

Step 1: Asset characterization 

The asset characterization includes analysing information 
that describes the technical details of facility assets to 
support the analysis, identifying the potential critical 


assets, identifying the hazards and consequences of 
concern for the facility and its surroundings and support¬ 
ing infrastructure and identifying existing layers of 
protection. Essentially, this step identifies the assets 
(people, facilities, information, reputation, business) of 
value, analyses why it is of value and identifies its impor¬ 
tance, determines the interaction of the assets with other 
neighbouring facilities, suppliers, or customers or other 
economic interdependencies. Assumptions are made on the 
worst credible security event consequences to determine 
the impacts. The estimate of severity of the consequences is 
one of the four risk factors. 

Step 2: Threat assessment 

The intentional release risk includes possible attacks by out¬ 
siders or insiders, or a combination of the two adversaries. 
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Consequences 

The potential impacts of the event 

Likelihood 

Likelihood which is a function of the chance of being targeted for 
attack, and the conditional chance of mounting a successful attack 
(both planning and executing) given the threat and existing 
security measures. This is a function of three variables below. 

Threat 

Threat, which is a function of the adversary existence, intent, 
motivation, capabilities and known patterns of potential 
adversaries. Different adversaries may pose different threats to 
various assets within a given facility. 

Vulnerability 

Any weakness that can be exploited by an adversary to gain access 
and damage or steal an asset or disrupt a critical function. This is 
a variable that indicates the likelihood of a successful attack given 
the intent to attack an asset. 

Target Attractiveness 

Target Attractiveness, which is a surrogate measure for likelihood 
of attack. This factor is a composite estimate of the perceived 
value of a target to the adversary and their degree of interest in 
attacking the target. 


Figure 35.6 API/NPRA SI/A methodology SVA risk variables (Managing and Analyzing the Security Vulnerabilities of 
Fixed Chemical Sites, AlChE, August 2002.) 


It may be perpetrated by a number of different adversaries 
with varying intents, motivations, weapons, tactics and 
capabilities. These issues need to be sorted out in a threat 
assessment, which is, in effect, a risk-based assessment 
that forms the basis of the design basis threat assumption 
the facility designs and operates to. 

The selection of the threats should include reasonable local, 
regional or national intelligence information, where avail¬ 
able. This step also includes determining the target attrac¬ 
tiveness of each asset from each adversary’s perspective. 

A responsible company has to give thought to the possi¬ 
ble threats and attempt to organize the many combinations 
and permutations into a threat matrix. Key to this matrix is 
the first variable - what is the target? Is the company a 
direct target or is it affected by a terrorist attack? From a 
pure risk management standpoint, companies need to be 
prepared for both contingencies, not only for the possibi¬ 
lity of direct physical or cyber attack to their facilities. This 
shows the multi-faceted aspects of the problem, and the 
need for industry, community and government cooperation 
to address the problem. 

For example, there is a major difference in the protection 
set required if the assumed threat is an armed attack by a 
small band of terrorists who use force to enter the main 
entrance way, vs a single insider who misuses their access 
to the process control system to cause a release from the 
same asset. Which threats are credible and to what extent is 
the threat potential? 

Threat is an important factor in the determination of risk. 
Prior to 11 September 2001, for example many of the other 
factors in the risk equation were present, but the threat was 
considered to be too low to be credible. It is the increased 
appreciation of threat that prompts us to now take action. 
Properly done, the threat assessment forms the basis of the 
process security management strategy for the facility. 


The threat definition results in a determination of the 
design basis threat for the facility. The threat assessment 
results in a ‘fixed’ and ‘variable’ design basis threat. The 
fixed threat forms the basis for the design and is the baseline 
threat estimate. The variable design basis threat assessment 
is an estimate of the change in threat levels given certain 
possible future conditions. The Homeland Security Advi¬ 
sory System (HSAS) is an example of a national effort to help 
define varying threat levels. Facilities are urged to take 
actions given increased threat levels, so these factors need 
to be considered in the threat assessment. 

The concept of fixed and variable design basis threats is 
useful for making decisions on facility design and operation. 
If the threat to insiders is considered significant, counter¬ 
measures designed to limit those risks are imperative. The 
fixed threat may determine the need for background 
screening, limiting the span of control of individuals, strong 
supervision, monitoring of activities, audits, surveillance, 
password controls and other measures. In fact, after deter¬ 
mining and appreciating that the insider threat potential 
threat is significant, the facility may be designed or 
redesigned to avoid use of a type of operation, substitute 
chemicals or other measures to minimize this potential. If 
other conditions change, the threat may increase. For exam¬ 
ple, if there are a large number of visitors such as during a 
turnaround or in the event of specif ic threat information or a 
terrorist attack in the United States, increased threat levels 
may change or add to the baseline countermeasures. 

Threat to a particular asset varies with several factors 
including the degree of interest that an adversary may have 
in the asset, as well as the degree of impact possible if the 
asset was attacked, disables, copied, compromised, or sto¬ 
len. For this reason, the threat assessment includes a step 
whereby each asset is analysed from the perspective of each 
potential adversary to determine the degree of attractiveness 
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Figure 35.7 Risk ranking matrix 


of the asset to the adversary. Attractiveness is therefore 
another factor in the determination of risk. 

Step 3: Vulnerability analysis 

The vulnerability analysis includes the relative pairing of 
each target asset and threat to identify potential vulner¬ 
abilities related to process security events. This involves 
the identification of existing countermeasures and their 
level of effectiveness in reducing those vulnerabilities. The 
degree of vulnerability of each valued asset and threat 
pairing is evaluated by the formulation of security-related 
scenarios or by an asset protection basis. If certain criteria 
are met such as higher consequence and attractiveness 
ranking values, then it may be useful to apply a scenario- 
based approach to conduct the Vulnerability Analysis. This 
approach option is very similar to the process hazard ana¬ 
lysis (PHA) techniques employed to analyse accidental 
releases. It includes the assignment of risk rankings to the 
security-related scenarios developed. 

Vulnerability is important to understand as it helps to 
determination how adversaries may target and execute 
crimes. Vulnerabilities are ubiquitous, so simply under¬ 
standing vulnerabilities is not sufficient to make a risk 
determination. Other factors such as threat, consequence 
and attractiveness are required for a more complete risk 
appreciation. 

Step 4: Risk assessment 

The risk assessment determines the relative degree of risk 
to the facility in terms of the expected effect on each critical 
asset as a function of consequence and probability of 
occurrence. Using the assets identified during Step 1 
(Asset Characterization), the risks are prioritized based on 
the likelihood of a successful attack which is a function of 
the threats assessed under Step 2 and the degree of vul¬ 
nerability identified under Step 3. 

A risk assessment matrix such as in Figure 35.7 can be 
used for the purpose of assessing risk. 

Risk assessment is only possible when there is some 
frame of reference. Since the events in question are extre¬ 
mely rate events, it is necessary to (1) use surrogate factors 
such as attractiveness and threat to determine the like¬ 
lihood of interest of attack of any particular asset and 

(2) use vulnerability as a measure of the likelihood of a 
successful attack given the desire to attack. Then the ana¬ 
lyst can use performance criteria to set risk goals. Each 


scenario is evaluated against those goals. For example, 
such criteria as the following may be set to determine 
unacceptable risk: 

Example security criteria: 

(1) No unauthorized person can easily cross the outer 
perimeter without delay or detection; 

(2) Any intruder is detected within 10 s of breaching the 
perimeter barrier; 

(3) Any intruder is interdicted within 5 min of breaching 
the perimeter barrier; 

(4) Any person entering the secured zone is authorized to 
be there; 

(5) Authorization is comprised of invitation and 
verification; 

(6) No unauthorized vehicle shall be allowed within 500 ft 
of a critical asset. 

These criteria are used as binary risk goals, that is, if 
the existing situation fails these tests, then additional 
countermeasures are required. 

Step 5: Countermeasures analysis 
Based on the vulnerabilities identified and the risk that the 
layers of protection are breached, appropriate enhance¬ 
ments to the security countermeasures may be recom¬ 
mended. Countermeasure options will be identified to 
further reduce vulnerability at the facility. These include 
improved countermeasures that follow the process security 
doctrines of deter, detect, delay, respond, mitigate and 
possibly prevent. Some of the factors to be considered are: 

(1) Reduced probability of successful attack 

(2) Degree of risk reduction by the options 

(3) Reliability and maintainability of the options 

(4) Capabilities and effectiveness of mitigation options 

(5) Costs of mitigation options 

(6) Feasibility of the options 

The countermeasure options should be re-ranked to evalu¬ 
ate effectiveness, and prioritized to assist management 
decision making for implementing security programme 
enhancements. The recommendations should be included 
in an SVA report that can be used to communicate the 
results of the SVA to management for appropriate action. 
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Preface to Third Edition 


The first edition of this book appeared in 1980, at the end of 
a decade of rapid growth and development in loss preven¬ 
tion. In the preface to the second edition, Frank P. Lees 
wrote, “After another decade and a half the subject is more 
mature, although development continues apace. In prepar¬ 
ing this second edition it has been even more difficult than 
before to decide what to put in and what to leave out.” Frank 
Lees’ statement in 1996 rings even truer today, another 
eight years later in 2004. Industrial advances and technol¬ 
ogy changes coupled with recent events have made it 
essential to focus on new topics while keeping a complete 
grasp of all of older technologies and learnings as well. 
Safety programs today must also consider issues such as 
chemical reactivity hazards, safety instrumented systems, 
and layer of protection analysis. In the post 9-11 world, 
process safety and loss prevention must also include con¬ 
sideration of issues related to chemical security and resi¬ 
lient engineering systems. 

The history of safety regulations in the United States can 
be traced back to the year before the beginning of the 
twentieth century. The River and Harbor Act, the first 
known federal legislation relevant to safety was promul¬ 
gated in 1899. Since then, the total number of legislations 
has steadily increased. In addition to the federal govern¬ 
ment, local entities such as the state, county, and cities have 
also promulgated regulations and ordnances, which 
impose safety requirements on process facilities. Varying 
degrees of similar legislative action has also occurred in 
the rest of the world. These legislation were all promulgated 
in response to some event, demographic changes, as well as 
changes in the industry. Also, as our understanding of the 
hazards associated with industrial processes developed, 
procedures and practices were put in place to limit or elim¬ 
inate the damage. Government programs and industry 
initiatives spurred improvements in the science and tech¬ 
nology needed for the recognition of hazards and asso¬ 
ciated risks. 

Management systems have been put in place to implement 
regulations and industry practices. Government regula¬ 
tions will continue to be a significant driver for safety pro¬ 
grams. As such, one of the main objectives of these 
management systems is to ensure compliance. However, it is 
also quite clear that profitability is directly related to safety 
and loss prevention. Thus the management systems for 
safety are intricately tied into the operational management. 

The industrial revolution brought prosperity and along 
with it the use of hazardous processes and complex tech¬ 
nologies. Growing economies and global competition has led 
to more complex processes involving the use of hazardous 
chemicals, exotic chemistry, and extreme operating condi¬ 
tions. As a result, a fundamental understanding of the 
hazards and associated risks is essential. Process safety and 
risk management requires the application of the basic sci¬ 
ences and a systematic approach. Recent advances, such as 
overpressure protection alternatives and reactive chemistry 
allow safer design and operation of processes. 

In the multiple barriers concept, plants are designed 
with several layers so that an incident would require the 


failure of several systems. Another novel approach to pro¬ 
cess safety and risk management is to consider various 
actions in a descending hierarchical order. Inherently safer 
design consideration should be first in the hierarchy fol¬ 
lowed by prevention systems, mitigation, and response. 
The success of these systems is dependent on the funda¬ 
mental understanding of the process and the associated 
hazards. Chronic as well as catastrophic consequences 
resulting from toxic and flammable substances can be 
reduced and/or eliminated through appropriate design and 
operating practices. 

Managing safety is no easy task, but it makes bottom- 
line sense. There is a direct payoff in savings on a company 
workers’ compensation insurance, whose premiums are 
partly based on the number of claims paid for job injuries. 
The indirect benefits are far larger, for safe plants tend to 
be well run in general and more productive. The recipe for 
safety is remarkably consistent from industry to industry. 
It starts with sustained support of top management fol¬ 
lowed by implementation of appropriate programs and 
practices that institutionalize safety as a culture as com¬ 
pared to add-on procedures. The ingraining of safety as 
second nature in day-to-day activities requires a paradigm 
shift and can only be accomplished when safety is viewed 
as an integral and comprehensive part of any activity as 
compared to being a stand-alone or add-on activity. 

This third edition of Loss Prevention in the Process 
Industries represents a combination of appropriate revi¬ 
sions of the essential compilations put together by Frank R 
Lees, along with several new chapters and additions on 
new areas that deserve attention and discussion. The third 
edition includes five new chapters and three new appen¬ 
dices. The five new chapters address incident investigation, 
inherently safer design, reactive chemicals, safety instru¬ 
mented systems, and chemical security. The three new 
appendices address process safety management regulation 
in the United States, risk management program regulation 
in the United States, and incident databases. 

The chapter on incident investigation provides a sum¬ 
mary of incident investigation procedures that can be used 
not only to determine causes of incidents but also provides 
a primer on capturing and integrating lessons learned from 
incident investigations into design, operations, main¬ 
tenance, and response programs. Chemical process inci¬ 
dents can be accompanied by significant consequences, 
both in terms of human life and in financial impact. Many 
maj or chemical process incidents are the result of a complex 
scenario involving simultaneous failures of multiple safe¬ 
guards. A robust system for incident investigation is 
usually necessary to determine and understand the causes, 
as well as implement measures to prevent a repeat event. 
This chapter is intended to provide an overview of incident 
investigation by addressing major concepts, principles, 
and characteristics of effective incident investigations of 
chemical process events. The focus is on incidents per¬ 
taining to chemical processes and their associated hazards, 
and the associated investigation techniques appropriate for 
complex systems and scenarios. This chapter is based on 



best practices for incident investigation, and those com¬ 
mon concepts (i.e., tools, techniques, definitions) included 
in root cause investigation methodologies currently in the 
public domain in use in the process industry. It is not the 
intention to provide a stand-alone investigation methodol¬ 
ogy/guideline, nor address internal or proprietary investi¬ 
gation methodologies. 

The chapter on inherently safer design addresses 
options and issues that can be considered with regard to the 
design and operation of plants. Inherently safer design is a 
philosophy that focuses on elimination of hazards or 
reduction of the magnitude of hazards rather than the 
control of hazards. Many of the concepts of inherently safer 
design have been applied by engineers in a wide variety of 
technologies for many years, without recognizing the 
common approach. In the late 1970s, in the wake of many 
large incidents in the chemical industry, Trevor Kletz 
recognized the common philosophies of hazard elimination 
and hazard reduction, gave the philosophy the name 
“inherently safer design,” and developed a specific set of 
approaches to help engineers in the chemical process 
industries to design inherently safer processes and plants. 
Trevor realized that increased expectations for safety, from 
companies, regulatory bodies, and society in general, 
combined with the increased potential damage from inci¬ 
dents in the larger plants being built to meet increased 
demand and global markets, resulted in increased com¬ 
plexity and cost for the safety systems required to satisfy 
these demands. Furthermore, while hazard control systems 
can be made highly reliable, they can never be perfect and 
will always have some failure probability. While this prob¬ 
ability can be made very small, there is always some chance 
that all safety systems will fail simultaneously and the 
result would be a large incident. Also, the hazard manage¬ 
ment systems require ongoing maintenance, as well as 
management and operator training, for the life of the plant. 
This results in ongoing costs, and the potential for future 
deterioration of the safety systems. Deteriorated systems 
will have reduced reliability, increasing the potential for a 
catastrophic accident. Trevor Kletz suggested that in many 
cases, a simpler, cheaper, and safer plant could be designed 
by focusing on the basic technology, eliminating or sig¬ 
nificantly reducing hazards, and therefore the need to 
manage them. 

The chapter on reactive chemicals provides an overview 
of this critical issue and provides guidance on management 
systems as well as experimental and theoretical methods 
for analyses of chemical reactivity hazards. Serious inci¬ 
dents arising from uncontrolled reactivity have taken place 
since the inception of the chemical industry. The human toll 
of such incidents has been staggering. In recent decades, 
greater recognition and resources have been directed 
toward preventing and mitigating such occurrences. A 
number of incidents have been so severe as to prompt reg¬ 
ulatory initiatives to force better management of reactivity. 
It is prudent for any company, organization, or other group 
to scrutinize the chemicals being handled and implement 
measures to limit the risk of a major reactive hazards event. 
A sampling of incidents that have substantially heightened 
concerns regarding reactive hazards in the general public, 
in governmental agencies, and in industry includes: 


• The 1976ICMESA incident in Seveso, Italy in which an 
uncontrolled chemical reaction generated pressure 


resulting in relief venting of a highly toxic dioxane into 
the neighboring villages and countryside. 

• The 1984 Union Carbide incident in Bhopal, India in 
which methyl isocyanate was contacted with water, 
generating highly toxic cyanide gas and leading to 
thousands of fatalities. 

• The 1994 NappTechnology incident in Lodi, Newjersey 
in which an uncontrolled reaction involving gold ore 
processing led to the deaths of five firefighters. 

• The 1999 Concept Sciences incident in Allentown, 
Pennsylvania in which an explosion arising from 
a process concentrating hydroxylamine resulted in five 
fatalities. Another event involving purified hydro¬ 
xylamine took place in a Nissin Chemical plant in 
Gunma Prefecture, Japan in 2000 and led to four 
fatalities. 

• The 2001 TotalFinaElf incident in Toulouse, France in 
which ammonium nitrate being processed for nitrogen 
fertilizers exploded leading to 30 fatalities. 

These events, as well as numerous others, have influenced 
the perception and approach to reactive hazards. 

The chapter on safety instrumented systems addresses 
systems and procedures that need to be in place with regard 
to this area of safety and instrumentation. In many pro¬ 
cesses, technical or manufacturing issues limit the engi¬ 
neer’s capability to design an inherently safer process. 
Further, there is generally a point where the required capi¬ 
tal investment is disproportional to the additional risk 
reduction provided by the process modification. In other 
words, the derived safety benefit is too low relative to the 
economic investment. When this occurs, protection layers 
or safeguards must be provided to prevent or mitigate the 
process risk. A Safety Instrumented System (SIS) is a 
protection layer, which shuts down the plant, or part of it, if 
a hazardous condition is detected. Throughout the years, 
SIS have also been known as Emergency Shutdown Sys¬ 
tems (ESD, ESS), Safety Shutdown Systems (SSD), Safety 
Interlock Systems (SIS), Safety Critical Systems (SCS), 
Safety Protection Systems (SPS), Protective Instrumented 
Systems (PIS), interlocks, and trip systems. Regardless of 
what the SIS may be called, the essential characteristic of 
the SIS is that it is composed of instruments, which detect 
that process variables are exceeding preset limits, a logic 
solver, which processes this information and makes deci¬ 
sions, and final control elements, which take necessary 
action on the process to achieve a safe state. 

The chapter on chemical security deals with this new 
and critical element of the management of a process facility 
following the events of September 11, 2001. Security man¬ 
agement is required for protecting the assets (including 
employees) of the facility, maintaining the ongoing integ¬ 
rity of the operation, and preserving value of the invest¬ 
ment. Process security and process safety have many 
parallels and make use of many common programs and 
systems for achieving their ends. Process security requires 
a management systems approach to develop a comprehen¬ 
sive security program, which shares many common ele¬ 
ments to process safety management. 

The new appendix on process safety management reg¬ 
ulation in the United States provides a summary of this 
regulatory requirement. The fourteen elements of the 
OSHA Process Safety Management (PSM) regulation (29 
CFR 1910.119) were published in the U.S. Federal Register 
on February 24,1992. The objective of the regulation is to 


prevent or minimize the consequences of catastrophic 
releases of toxic, reactive, flammable, or explosive chemi¬ 
cals. The regulation requires a comprehensive manage¬ 
ment program: a holistic approach that integrates 
technologies, procedures, and management practices. The 
process safety management regulation applies to processes 
that involve certain specified chemicals at or above 
threshold quantities, processes that involve flammable 
liquids or gases on-site in one location, in quantities of 
10,000 pounds or more (subject to few exceptions), and 
processes that involve the manufacture of explosives and 
pyrotechnics. Hydrocarbon fuels, which may be excluded if 
used solely as a fuel, are included if the fuel is part of a 
process covered by this regulation. In addition, the reg¬ 
ulation does not apply to retail facilities, oil or gas well 
drilling or servicing operations, or normally unoccupied 
remote facilities. 

The new appendix on risk management program reg¬ 
ulation in the United States provides a summary of this 
regulatory requirement administered by the U.S. Environ¬ 
mental Protection Agency. In 1996, EPA promulgated the 
regulation for Risk Management Programs for Chemical 
Accident Release Prevention (40 CFR 68). This federal reg¬ 
ulation was mandated by section 112(r) of the Clean Air Act 
Amendments of 1990. The regulation requires regulated 
facilities to develop and implement appropriate risk 
management programs to minimize the frequency and 
severity of chemical plant accidents. In keeping with 
regulatory trends, EPA required a performance-based 
approach towards compliance with the risk management 
program regulation. The EPA regulation also requires reg¬ 
ulated facilities to develop a Risk Management Plan 
(RMP). The RMP includes a description of the hazard 
assessment, prevention program, and the emergency res¬ 
ponse program. Facilities submit the RMP to the EPA 
and subsequently is made available to governmental 
agencies, the state emergency response commission, the 
local emergency planning committees, and communicated 
to the public. 

The new appendix on incident databases addresses 
compilations of incident databases that can used for 


improving safety programs, developing trends, perfor¬ 
mance measures, and metrics. Incident prevention and 
mitigation of consequences is the focus of a number of 
industry programs regulatory initiatives. As part of these 
programs and regulations, accident history data are often 
collected. There are two basic types of information. One is a 
database consisting of standardized fields of data usually 
for a large number of incidents. The second are more 
detailed reports of individual incidents. Analysis of these 
incident history databases can provide insight into incident 
prevention needs. While the analysis and conclusions 
obtained from the incident database are often limited by 
the shortcomings of the databases themselves, the fact 
remains that incident history databases are very useful and 
can be a powerful tool in focusing risk reduction efforts. 
The conclusions can be used to identify systematically the 
greatest risks to allow prioritization of efforts to improve 
process safety. At the plant level this might entail identify¬ 
ing certain processes, types of equipment, chemicals, 
operations and other factors most commonly associated 
with incidents. Databases that cover a very large number of 
facilities are likely to reveal trends and patterns that no one 
company or facility could determine from their own 
experience. Statistical knowledge of the likelihood of the 
release of certain types of chemicals could help emergency 
responders, state emergency response commissions, and 
local emergency planning committees determine the most 
likely and most serious chemical releases in their areas and 
plan appropriate chemical accident responses. Incident 
databases may also help identify technologies and prac¬ 
tices to prevent chemical accidents, or the need to develop 
them. For example, the data could indicate that inspection 
and preventive maintenance of equipment and instruments 
should become more thorough or more frequent. 


M. Sam Mannan 
College Station, 
Texas, USA 
2004 





Preface to Second Edition 


The first edition of this book appeared in 1980, at the end of 
a decade of rapid growth and development in loss preven¬ 
tion. After another decade and a half the subject is more 
mature, although development continues apace. In prepar¬ 
ing this second edition it has been even more difficult than 
before to decide what to put in and what to leave out. 

The importance of loss prevention has been underlined 
by a number of disasters. Those at San Carlos, Mexico City, 
Bhopal and Pasadena are perhaps the best known, but 
there have been several others with death tolls exceeding 
100. There have also been major incidents in related areas, 
such as those on the Piper Alpha oil platform and at the 
nuclear power stations at Three Mile Island and Chernobyl. 

Apart from the human tragedy, it has become clear that 
a major accident can seriously damage even a large inter¬ 
national company and may even threaten its existence, 
rendering it liable to severe damages and vulnerable to 
takeover. 

Accidents in the process industries have given impetus 
to the creation of regulatory controls. In the UK the Advi¬ 
sory Committee on Major Hazards made its third and final 
report in 1983. At the same time the European Community 
was developing its own controls which appeared as the EC 
Directive on Major Accident Hazards. The resulting UK 
legislation is the NIHHS Regulations 1982 and the CIMAH 
Regulations 1984. Other members of the EC have brought 
in their own legislation to implement the Directive. There 
have been corresponding developments in planning con¬ 
trols. 

An important tool for decision-making on hazards is 
hazard assessment. The application of quantitative meth¬ 
ods has played a crucial role in the development of loss 
prevention, but there has been lively debate on the proper 
application of such assessment, and particularly on the 
estimation and evaluation of the risk to the public. 

Hazard assessment involves the assessment both of the 
frequency and of the consequences of hazardous events. In 
frequency estimation progress has been made in the col¬ 
lection of data and creation of data banks and in fault tree 
synthesis and analysis, including computer aids. In con¬ 
sequence assessment there has been a high level of activity 
in developing physical models for emission, vaporization 
and gas dispersion, particularly dense gas dispersion; for 
pool fires, fireballs, jet flames and engulfing fires; for 
vapour cloud explosions; and for boiling liquid expanding 
vapour explosions (BLEVEs).Work has also been done on 
injury models for thermal radiation, explosion over¬ 
pressure and toxic concentration, on models of the density 
and other characteristics of the exposed population, and 
on shelter and escape. 

Some of these topics require experimental work on a 
large scale and involving international cooperation. Large 
scale tests have been carried out at several sites on dense 
gas dispersion and on vapour cloud fires and explosions. 
Another major cooperative research programme has been 
that of DIERS on venting of chemical reactors. 

The basic approach developed for fixed installations on 
shore has also been increasingly applied in other fields. For 


transport in the UK the Transport Hazards Report of the 
Advisory Committee on Dangerous Substances represents 
an important landmark. Another application is in the off¬ 
shore oil and gas industry, for which the report on the Piper 
Alpha disaster, the Cullen Report, constitutes a watershed. 

As elsewhere in engineering, computers are in wide¬ 
spread use in the design of process plants, where computer 
aided design (CAD) covers physical properties, flowsheet¬ 
ing, piping and instrument diagrams, unit operations and 
plant layout. There is increasing use of computers for fail¬ 
ure data retrieval and analysis, reliability and availability 
studies, fault tree synthesis and analysis and consequence 
modelling, while more elusive safety expertise is being 
captured by computer-based expert systems. 

The subject of this book is the process industries, but 
the process aspects of related industries, notably nuclear 
power and oil and gas platforms are briefly touched on.The 
process industries themselves are continually changing. In 
the last decade one of the main changes has been increased 
emphasis on products such as pharmaceuticals and agro¬ 
chemicals made by batch processes, which have their own 
particular hazards. 

All this knowledge is of little use unless it reaches the 
right people. The institutions which educate the engineers 
who will be responsible for the design and operation of 
plants handling hazardous materials have a duty to make 
their students aware of the hazards and at least to make a 
start in gaining competence in handling them. 

I would like again to thank for their encouragement the 
heads of the Department of Chemical Engineering at 
Loughborough, Professors D.C. Freshwater, B.W. Brooks 
and M. Streat; our Industrial Professors T.A. Kletz and 
H. A. Duxbury and Visiting Professor S.M. Richardson; my 
colleagues, past and present, in the Plant Engineering 
Group, Mr R.J. Aird, Dr P.K. Andow, Dr M.L. Ang, 
Dr PWH. Chung, Dr D.W. Edwards, Dr P. Rice and 
Dr A.G. Rushton - I owe a particular debt to the latter; the 
members of the ACMH, chaired by Professor B.H. Harvey; 
the sometime directors of Technica Ltd, Dr D.H. Slater, 
Mr P. Charsley, Dr P.J. Comer, Dr R.A. Cox, MrT. Gjerstad, 
Dr M.A.F. Pyman, Mr C.G. Ramsay, Mr M.A. Seaman and 
Dr R. Whitehouse; the members of the IChemE Loss Pre¬ 
vention Panel; the IChemE’s former Loss Prevention Offi¬ 
cer, Mr B.M. Hancock; the members of the IChemE Loss 
Prevention Study Group and of the Register of Safety Pro¬ 
fessionals; the editorial staff of the IChemE, in particular 
Mr B. Brammer; numerous members of the Health and 
Safety Executive, especially Dr A.C. Barrell, Mr J. Barton, 
Dr D.A. Carter, Mr K. Cassidy, Mr P.J. Crossthwaite, 
Dr N.W. Hurst, Dr S.F. Jagger, Dr J. McQuaid, Dr K. Moodie, 
Dr C. Nussey, Dr R.P. Pape, Dr A.F. Roberts and 
Dr N.F. Stilly; workers at the Safety and Reliability Direc¬ 
torate, particularly Dr A.T.D. Butland, Mr I. Hymes, 
Dr D.W. Phillips and Dr D.M. Webber; staff at Shell 
Thornton Research Centre, including Dr D.C. Bull and 
Dr A.C. Chamberlain; staff at British Gas, including 
Dr J.D. Andrews, Dr M.J. Harris, Mr H. Hopkins, 
Dr J.M. Morgan and Dr DJ. Smith; staff at the Ministry of 


Defence, Explosives Storage and Transport Committee, 
including Mr M.A. Gould, Mr J. Henderson and Mr P. Stone; 
and colleagues who have taught on post-experience courses 
at Loughborough, in particular Dr C.D. Jones, Dr DJ. Lewis 
and Mr J. Madden; BP International and Mr R. Malpas for 
allowing me to spend a period of study leave with the com¬ 
pany in 1985-86 and Mr F.D.H. Moysen, Mr G. Hately, 
Mr M. Hough, Mr R. Fearon and others in the Central Safety 
Group and in Engineering Department; the Honourable 
Lord Cullen, my fellow Technical Assessors on the Piper 
Alpha Inquiry, Mr B. Appleton and Mr G.M. Ford and the 
Cremer and Warner team at the inquiry, in particular 
Mr G. Kenney and Mr R. Sylvester-Evans; other profes¬ 
sional colleagues Dr L J. Bellamy, Professor B. A. Buffham, 
Dr D.A. Crowl, MrT.J. Gilbert, Mr D.O. Hagon, Dr D.J. Hall, 
Mr K.M. Hill, Professor T.M. Husband, Mr M. Kneale, 
Dr VC. Marshall, Dr M.L. Preston, Dr J. Rasmussen, 
Dr J.R. Roach, Dr J.R. Taylor, Dr VM. Trbojevic, Mr H.M. 
Tweeddale, Dr G.L. Wells and Dr A.J. Wilday; my research 


colleagues Dr C.P Murphy, Mrs J.I. Petts, Dr D.J. Sherwin, 
Mr R.M.J. Withers and Dr H. Zerkani; my research students 
Mr M. Aldersey, Mr D.C. Arulanantham, Dr A. Bunn, Dr 
M.A. Cox, Dr P.A. Davies, Dr S.M. Gilbert, Mr P. Heino, Dr 
A. Hunt, Dr B.E. Kelly, Dr G.P.S. Marrs, Dr J.S. Mullhi, 
Dr J.C. Parmar, Mr B. Poblete, Dr A. Shafaghi and Dr A.J. 
Trenchard as well as colleagues’ research students Mr E.J. 
Broomfield, Mr R. Goodwin, Mr M.J. Jefferson, Dr F.D. 
Larkin, Mr S. A. McCoy, Dr K. Plamping, Mr J. Soutter, Dr P. 
Thorpe and Mr SJ. Wakeman; the office staff of the 
Department, Mrs E.M. Barradell, Mr D.M. Blake, Miss H.J. 
Bryers and Miss Y. Kosar; the staff of the University 
Library, in particular Miss S.F. Pilkington; and my wife 
Elizabeth, whose contribution has been many-faceted and 
in scale with this book. 

Frank P. Lees 
Loughborough, 

1994 


Preface to First Edition 


Within the past ten or fifteen years the chemical and pet¬ 
roleum industries have undergone considerable changes. 
Process conditions such as pressure and temperature have 
become more severe. The concentration of stored energy 
has increased. Plants have grown in size and are often sin¬ 
gle-stream. Storage has been reduced and interlinking with 
other plants has increased. The response of the process is 
often faster. The plant contains very large items of equip¬ 
ment. The scale of possible fire, explosion or toxic release 
has grown and so has the area which might be affected by 
such events, especially outside the works boundary. 

These factors have greatly increased the potential for 
loss both in human and in economic terms. This is clear 
both from the increasing concern of the industry and its 
insurers and from the historical loss statistics. 

The industry has always paid much attention to safety 
and has a relatively good record. But with the growing scale 
and complexity involved in modern plants the danger of 
serious large-scale incidents has been a source of increas¬ 
ing concern and the adequacy of existing procedures has 
been subjected to an increasingly critical examination. 

Developments in other related areas have also had an 
influence. During the period considered there has been 
growing public concern about the various forms of pollu¬ 
tion, including gaseous and liquid effluents and solid 
wastes and noise. 

It is against this background that the loss prevention 
approach has developed. It is characteristic of this 
approach that it is primarily concerned with the problems 
caused by the depth of technology involved in modern 
processes and that it adopts essentially an engineering 
approach to them. As far as possible both the hazards and 
the protection are evaluated quantitatively. 

The clear recognition by senior management of the 
importance of the loss prevention problem has been crucial 
to these developments. Progress has been made because 
management has been prepared to assign to this work 
many senior and capable personnel and to allocate the other 
resources necessary. 

The management system is fundamental to loss preven¬ 
tion. This involves a clear management structure with well 
defined line and advisory responsibilities staffed by com¬ 
petent people. It requires the use of appropriate procedures, 
codes of practice and standards in the design and operation 
of plant. It provides for the identification, evaluation and 
reduction of hazards through all stages of a project from 
research to operation. It includes planning for emergencies. 

The development of loss prevention can be clearly traced 
through the literature. In 1960 the Institution of Chemical 
Engineers held the first of a periodic series of symposia on 
Chemical Process Hazards with Special Reference to Plant 
Design. The Dow Chemical Company published its Process 
Safety Manual in 1964. The American institute of Chemical 
Engineers started in 1967 an annual series of symposia on 
Loss Prevention. The European Federation of Chemical 
Engineers’ symposium on Major Loss Prevention in the 
Process Industries at Newcastle in 1971 and the Federation’s 
symposium on Loss Prevention and Safety Promotion in the 


Process Industries (Buschmann, 1974) at Delft are further 
milestones. 

Another indicator is the creation in 1973 by the Institu¬ 
tion of Chemical Engineers Engineering Practice Commit¬ 
tee of a Loss Prevention Panel under the chairmanship of 
MrT.A. Kantyka. 

In the United Kingdom the Health and Safety at Work etc. 
Act 1974 has given further impetus to loss prevention. The 
philosophy of the Robens Report (1972), which is embodied 
in the Act, is that of self-regulation by industry. It is the 
responsibility of industry to take all reasonable measures 
to assure safety This philosophy is particularly appro¬ 
priate to complex technological systems and the Act pro¬ 
vides a flexible framework for the development of the loss 
prevention approach. 

The disaster at Flixborough in 1974 has proved a turning 
point. This event has led to a much more widespread and 
intense concern with the loss prevention problem. It has 
also caused the government to set up in 1975 an Advisory 
Committee on Major Hazards. This committee has made 
far-reaching recommendations for the identification and 
control of major hazard installations. 

It will be apparent that loss prevention differs somewhat 
from safety as traditionally conceived in the process 
industries. The essential difference is the much greater 
engineering content in loss prevention. 

This is illustrated by the relative effectiveness of 
inspection in different processes. In fairly simple plants 
much can be done to improve safety by visual inspection. 
This approach is not adequate, however, for the more tech¬ 
nological aspects of complex processes. 

For the reasons given above loss prevention is currently 
a somewhat fashionable subject. It is as well to emphasize, 
therefore, that much of it is not new, but has been devel¬ 
oped over many years by engineers whose patient work in 
an often apparently unrewarding but vital field is the 
mark of true professionalism. 

It is appropriate to emphasize, moreover, that accidents 
arising from relatively mundane situations and activities 
are still responsible for many more deaths and injuries than 
those due to advanced technology. 

Nevertheless, loss prevention has developed in response 
to the growth of a new problem, the hazard of high tech¬ 
nology processes, and it does have a distinctive approach 
and some novel techniques. Particularly characteristic are 
the emphasis on matching the management system to the 
depth of technology in the installation, the techniques 
developed for identifying hazards, the principle and meth¬ 
ods of quantifying hazards, the application of reliability 
assessment, the practice of planning for emergencies and 
the critique of traditional practices or existing codes, 
standards or regulations where these are outdated by 
technological change. 

There is an enormous, indeed intimidating, literature on 
safety and loss prevention. In addition to the symposia 
already referred to, mention may be made of the Handbook 
of Safety and Accident Prevention in Chemical Operations by 
Fawcett and Wood (1965); the Handbook of Industrial Loss 


Prevention by the Factory Mutual Engineering Corporation 
(1967); and the Industrial Safety Handbook by Handley 
(1969, 1977). These publications, which are by multiple 
authors, are invaluable source material. 

There is a need, however, in the author’s view for a 
balanced and integrated textbook on loss prevention in the 
process industries which presents the basic elements of the 
subject, which covers the recent period of intense develop¬ 
ment and which gives a reasonably comprehensive biblio¬ 
graphy. The present book is an attempt to meet this need. 

The book is based on lectures given to undergraduate 
and postgraduate students at Loughborough over a per¬ 
iod of years and the author gladly acknowledges their 
contribution. 

Loss prevention is a wide and rapidly developing field 
and is therefore not an easy subject for a book. Never¬ 
theless, it is precisely for these reasons that the engineer 
needs the assistance of a textbook and that the attempt has 
been considered justified. 

The structure of the book is as follows. Chapter 1 deals 
with the background to the historical development of loss 
prevention, the problem of large, single-stream plants, and 
the differences between loss prevention and conventional 
safety, and between loss prevention and total loss control; 
Chapter 2 with hazard, accident and loss, including histor¬ 
ical statistics; Chapter 3 with the legislation and legal 
background; Chapter 4 with the control of major hazards; 
Chapter 5 with economic and insurance aspects; Chapter 6 
with management systems, including management struc¬ 
ture, competent persons, systems and procedures, stan¬ 
dards and codes of practice, documentation and auditing 
arrangements; Chapter 7 with reliability engineering, 
including its application in the process industries; Chapter 8 
with the spectrum of techniques for identifying hazards 
from research through to operation; Chapter 9 with the 
assessment of hazards, including the question of accep¬ 
table risk; Chapter 10 with the siting and layout of plant; 
Chapter 11 with process design, including application of 
principles such as limitation of inventory, consideration of 
known hazards associated with chemical reactors, unit 
processes, unit operations and equipments, operating con¬ 
ditions, utilities, particular chemicals and particular pro¬ 
cesses and plants, and checking of operational deviations; 
Chapter 12 with pressure system design, including prop¬ 
erties of materials, design of pressure vessels and pipe¬ 
work, pressure vessel standards and codes, equipment 
such as heat exchangers, fired heaters and rotating 
machinery, pressure relief and blowdown arrangements, 
and failure in pressure systems; Chapter 13 with design of 
instrumentation and control systems, including regular 
instrumentation, process computers and protective sys¬ 
tems; Chapter 14 with human factors in process control, 
process operators, computer aids and human error; Chap¬ 
ter 15 with loss of containment and dispersion of material; 
Chapter 16 with fire, flammability characteristics, ignition 
sources, flames and particular types of process fire, effects 
of fire and fire prevention, protection and control; 
Chapter 17 with explosion, explosives, explosion energy, 
particular types of process explosion such as confined 
explosions, unconfined vapour cloud explosions and dust 
explosions, effects of explosion and explosion prevention, 
protection and relief; Chapter 18 with toxicity of chemicals, 
toxic release and effects of toxic release; Chapter 19 with 
commissioning and inspection of plant; Chapter 20 with 
plant operation; Chapter 21 with plant maintenance 


and modification; Chapter 22 with storage; Chapter 23 
with transport, particularly by road, rail and pipeline; 
Chapter 24 with emergency planning both for works and 
transport emergencies; Chapter 25 with various aspects of 
personal safety such as occupational health and industrial 
hygiene, dust and radiation hazards, machinery and elec¬ 
trical hazards, protective clothing and equipment, and 
rescue and first aid; Chapter 26 with accident research; 
Chapter 27 with feedback of information and learning from 
accidents; Chapter 28 with safety systems, including the 
roles of safety managers and safety committees and repre¬ 
sentatives. There are appendices on Flixborough, Seveso, 
case histories, standards and codes, institutional publica¬ 
tions, information sources, laboratories and pilot plants, 
pollution and noise, failure and event data, Canvey, model 
licence conditions for certain hazardous plants, and units 
and unit coversions. 

Many of the matters dealt with, such as pressure vessels 
or process control, are major subject areas in their own 
right. It is stressed, therefore, that the treatment given is 
strictly limited to loss prevention aspects. The emphasis is 
on deviations and faults which may give rise to loss. 

In engineering in general and in loss prevention in par¬ 
ticular there is a conflict between the demand for a state¬ 
ment of basic principles and that for detailed instructions. 
In general, the first of these approaches has been adopted, 
but the latter is extremely important in safety, and a con¬ 
siderable amount of detailed material is given and refer¬ 
ences are provided to further material. 

The book is intended as a contribution to the academic 
education of professional chemical and other engineers. 
Both educational and professional institutions have long 
recognized the importance of education in safety. But until 
recently the rather qualitative, and indeed often exhorta- 
tory, nature of the subject frequently seemed to present 
difficulties in teaching at degree level. The recent quanti¬ 
tative development of the subject goes far towards remov¬ 
ing these objections and to integrating it more closely with 
other topics such as engineering design. 

In other words, loss prevention is capable of development 
as a subject presenting intellectual challenge. This is all to 
the good, but a note of caution is appropriate. It remains 
true that safety and loss prevention depend primarily on 
the hard and usually unglamorous work of engineers with 
a strong sense of responsibility, and it is important that 
this central fact should not be obscured. 

For this reason the book does not attempt to select parti¬ 
cular topics merely because a quantitative treatment is 
possible or to give such a treatment as an academic exer¬ 
cise. The subject is too important for such an approach. 
Rather the aim has been to give a balanced treatment of the 
different aspects and a lead in to further reading. 

It is also hoped that the book will be useful to practising 
engineers in providing an orientation and entry to unfa¬ 
miliar areas. It is emphasized, however, that in this subject 
above all others, the specialized texts should be consulted 
for detailed design work. 

Certain topics which are often associated with loss pre¬ 
vention, for example included in loss prevention symposia, 
have not been treated in detail. These include, for example, 
pollution and noise. The book does not attempt to deal in 
detail with total loss control, but a brief account of this is 
given. 

The treatment of loss prevention given is based mainly 
on the chemical, petrochemical and petroleum industries, 



but much of it is relevant to other process industries, such 
as electrical power generation (conventional and nuclear), 
iron and steel, gas, cement, glass, paper and food. 

The book is written from the viewpoint of the United 
Kingdom and, where differences exist within the UK, of 
England. This point is relevant mainly to legislation. 

Reference is made to a large number of procedures and 
techniques. These do not all have the same status. Some are 
well established and perhaps incorporated in standards or 
codes of practice. Others are more tentative. As far as pos¬ 
sible the attempt has been made to give some indication of 
the extent to which particular items are generally accepted. 

There are probably also some instances where there is a 
degree of contradiction between two approaches given. In 
particular, this may occur where one is based on engineer¬ 
ing principles and the other on relatively arbitrary rules-of- 
thumb. 

The book does not attempt to follow standards and codes 
of practice in drawing a distinction between the words 
should, shall and must in recommending particular prac¬ 
tices and generally uses only the former. The distinction is 
important, however, in standards and codes of practice and 
it is described in Appendix 4 a . 

An explanation of some of the terms used is in order at 
this point. Unfortunately there is at present no accepted 
terminology in this field. In general, the problems con¬ 
sidered are those of loss, either of life or property. The term 
hazard is used to describe the object or situation which 
constitutes the threat of such loss. The consequences which 
might occur if the threat is realized are the hazard potential. 
Associated with the hazard there is a risk, which is the 
probability of the loss occurring. Such a risk is expressed 
as a probability or as a frequency. Probability is expressed as 
a number in the range 0 to I and is dimensionless; fre¬ 
quency is expressed in terms of events per unit time, or 
sometimes in other units such as events per cycle or per 
occasion. Rate is also used as an alternative to frequency 
and has the same units. 

The analysis of hazards involves qualitative hazard 
identification and quantitative hazard assessment. The lat¬ 
ter term is used to describe both the assessment of hazard 
potential and of risk. The assessment of risk only is 
described as risk assessment. 

In accident statistics the term Fatal Accident Frequency 
Rate (FAFR) has some currency. The last two terms are 
tautologous and the quantity is here referred to as Fatal 
Accident Rate (FAR). 

Further treatments of terminology in this field are given 
by BS 4200: 1967, by Green and Bourne (1962), by the 
Council for Science and Society (1977) and by Harvey 
(1979b). 

Notation is defined for the particular chapter at the point 
where the symbols first occur. In general, a consistent 
notation is used, but well established equations from stan¬ 
dards, codes and elsewhere are usually given in the original 
notation. A consolidated list of the notation is given at the 
end of chapters in which a large number of symbols is used. 

The units used are in principle SI, but the exceptions are 
fairly numerous. These exceptions are dimensional equa¬ 
tions, equations in standards and codes, and other equa¬ 
tions and data given by other workers where conversion has 
seemed undesirable for some reason. In cases of conversion 

““Appendices 4, 5 and 12 in the first edition correspond to Appen¬ 
dices 27,28 and 30, respectively, in this second edition. 


from a round number it is often not clear what degree 
of rounding off is appropriate. In cases of description of 
particular situations it appears pedantic to make the 
conversion where a writer has referred, for example, to a 
1 inch pipe. 

Notes on some of the units used are given in Appendix 
12 a . For convenience a unit conversion table is included in 
this appendix. Numerical values given by other authors are 
generally quoted without change and numerical values 
arising from conversion of the units of data given by other 
authors are sometimes quoted with an additional sig¬ 
nificant figure in order to avoid excessive rounding of 
values. 

Some cost data are quoted in the book. These are given in 
pounds or US dollars for the year quoted. 

A particular feature of the book is a fairly extensive 
bibliography of some 5000 references.These references are 
consolidated at the end of the book rather than at the end of 
chapters, because many items are referred to in a number of 
chapters. Lists of selected references on particular topics 
are given in table form in the relevant chapters. 

Certain institutions, however, have a rather large number 
of publications which it is more convenient to treat in a 
different manner. These are tabulated in Appendices 4 a and 
5 a , which contain some 2000 references. There is a cross- 
reference to the institution in the main reference list. 

In many cases institutions and other organizations are 
referred to by their initials. In all cases the first reference in 
the book gives the full title of the organization. The initials 
may also be looked up in the Author Index, which gives the 
full title. 

A reference is normally given by quoting the author and, 
in brackets, the date, e.g. Kletz (1971). Publications by the 
same author in the same year are denoted by letters of the 
alphabet a, b, c, etc., e.g. Allen (1977a), while publications 
by authors of the same surname and in the same year are 
indicated for convenience by an asterisk against the year in 
the list of references. In addition, the author’s initials are 
given in the main text in cases where there may still be 
ambiguity. Where a date has not been determined this is 
indicated as n.d. 

In the case of institutional publications listed in Appen¬ 
dices 4 a and 5 a the reference is given by quoting the insti¬ 
tution and, in brackets, the date, the publication series, e.g. 
HSE (1965 HSW Bklt 34) or the item number, e.g. IChemE 
(1971 Item 7). For institutional publications with a named 
author the reference is generally given by quoting the 
author and, in brackets, the initials of the institution, the 
date and the publication series or item number, e.g. Eames 
(UKAEA1965 Item 4). 

The field of loss prevention is currently subject to very 
rapid change. In particular, there is a continuous evolution 
of standards and codes of practice and legislation. It is 
important, therefore, that the reader should make any 
necessary checks on changes which may have occurred. 

I would like to thank for their encouragement in this 
project Professor D.C. Freshwater and the publishers, and 
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Hazards, especially the chairman Professor B.H. Harvey, 
the secretary Mr H.E. Lewis, my fellow group chairmen 


Professor F.R. Farmer and Professor J.L.M. Morrison and 
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Mr E.J. Challis, Mr S. Hope, Mr M.A. McTaggart, Professor 
J.F. Richardson, Mr J.R.H. Schenkel, Mr R. Sheath and 
Mr M.J. Turner, and also from my university colleagues 
Dr P.K. Andow, Mr R.J. Aird and Dr D.J. Sherwin and 
students Dr S.N. Anyakora, Dr B. Bellingham, Mr C.A. 
Marpegan and Dr G.A. Martin-Solis. I am much indebted to 
Professor T.A. Kletz for his criticisms and suggestions on 
the text. My thanks are due also to the Institution of Plant 
Engineers, which has supported plant engineering activ¬ 
ities at Loughborough, to the Leverhulme Trust which 
awarded a Research Fellowship to study Loss Prevention in 


the Process Industries and to the Science Research Council, 
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Terminology 


Attention is drawn to the availability in the literature of a 
number of glossaries and other aids to terminology. Some 


Notation 


In each chapter a given symbol is defined at the point where 
it is first introduced. The definition may be repeated if there 
has been a significant gap since it was last used. The defi¬ 
nitions are summarized in the notation given at the end of 
the chapter. The notation is global to the chapter unless 
redefined for a section. Similarly, it is global to a section 
unless redefined for a subsection and global to a subsection 


British Standard glossaries are given in Appendix 27 and 
other glossaries are listed in Table 1.1. 


unless redefined for a set of equations or a single equation. 
Where appropriate, the units are given, otherwise a con¬ 
sistent system of units should be used, SI being the pre¬ 
ferred system. Generally the units of constants are not 
given; where this is the case it should not be assumed that 
a constant is dimensionless. 


Use of References 


The main list of references is given in the section entitled 
References, towards the end of the book. There are three 
other locations where references are to be found. These are 
Appendix 27 on standards and codes; Appendix 28 on 
institutional publications; and in the section entitled Loss 
Prevention Bulletin which follows the References. 

The basic method of referencing an author is by surname 
and date, e.g. Beranek (1960). Where there would otherwise 
be ambiguity, or where there are numerous references to the 
same surname, e.g. Jones, the first author’s initials are 
included, e.g. A. Jones (1984). Further guidance on names is 
given at the head of the section References. 

References in Appendices 27 and 28 are by institution or 
author. Some items in these appendices have a code number 
assigned by the institution itself, e.g. API (1990 Publ. 421), 
but where such a code number is lacking, use is generally 
made of an item number separated from the date by a slash, 
e.g. IChemE (1971/13). Thus typical entries are 


API Std 2000:1992 a standard, found in Appendix 
27 under American Petroleum 
Institute 

API (1990 Publ. 421) an institutional publication, found 

in Appendix 28 under American 
Petroleum Institute 

HSE (1990 HS(G) 51) an institutional publication, found 

in Appendix 28 under Health 


and Safety Executive, Guidance 
Booklets, HS(G) series 

Coward and Jones an institutional publication, found 
(1952 BM Bull. 503) in Appendix 28 under Bureau of 
Mines, Bulletins 

Institutional acronyms are given in the section Acronyms 
which precedes the Author Index. 

There are several points of detail which require mention 
concerning Appendix 28. (1) The first part of the appendix 
contains publications of a number of institutions and the 
second part those of the Nuclear Regulatory Commission. 
(2) The Fire Protection Association publications include a 
number of series which are collected in the Compendium of 
Fire Safety Data (CFSD). A typical reference to this is FPA 
(1989 CFSD FS 6011). (3) The entries for the Health and 
Safety Executive are quite extensive and care may be nee¬ 
ded in locating the relevant series. (4) The publications of 
the Safety and Reliability Directorate appear under the UK 
Atomic Energy Authority, Safety and Reliability Directo¬ 
rate. A typical reference is Ramskill and Hunt (1987 SRD 
R354). These publications are immediately preceded by the 
publications of other bodies related to the UKAE A, such as 
the Health and Safety Branch, the Systems Reliability 
Service and the National Centre for Systems Reliability. 

References to authors in the IChemE Loss Prevention 
Bulletin are in the style Eddershaw (1989 LPB 88), which 
refers to issue 88 of the bulletin. 
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APPENDIX 1/2 CASE HISTORIES 


An essential feature of the learning process in safety and 
loss prevention is the study of case histories. 

A1.1 Incident Sources 

The powerful impact of the internet has changed the way 
we obtain our information on process safety as well as 
everything else. In recent years, various governmental 
agencies and private organizations have improved our 
access to details of recent and past case histories. A number 
of websites provide a narrative of the event, the technical 
reasons for the accident as well as the management system 
shortcomings and valuable lessons learned. Written report 
sometimes supported by graphics and photos are often 
published by various agencies and provided on govern¬ 
mental websites. There are also university and corporate 
organizations that collect incidents and publish on their 
websites. 

Since about 1996, the US Environmental Protection 
Agency under the Chemical Emergency Preparedness and 
Prevention has investigated and reported on many high 
profile US chemical plant and refinery case histories. As a 
result of these investigations, some Alerts focusing on 
certain type of incidents have been developed. EPA reports 
are available at the following internet website: 
http://yosemite.epa.gov/oswer/ceppoweb.nsf. 

The US Chemical Safety and Hazard Investigation 
Board (CSB) matured in the late 1990s and their mission is 
to promote the prevention of chemical accidents. The focus 
of the CSB is on-site and off-site chemical safety, deter¬ 
mining causes and preventing chemical-related incidents, 
fatalities, injuries, property damage and enhancing 
environmental protection. The CSB started investigations 
on selected important chemical plant and refinery inci¬ 
dents in about 1998, and also provide reports on the inter¬ 
net at the following web address: 
http://www.chemsafety.gov/reports/. 

The Center of Chemical Process Safety, CCPS, of the 
American Institute of Chemical Engineers started provid¬ 
ing brief one-page summaries of types of hazards in late 
2001. These high-impact messages were designed with the 
chemical process operator and others involved with the 
manufacturing processes to focus quickly on an important 
topic. The publication is entitled the Beacon and can be 
found at: 

www.aiche.org/ccps/safetybeacon.htm. 

The Mary Kay O’Connor Process Safety Center at Texas 
A&M University in College Station is an international 
leader in process safety and is increasing in stature each 
year. They have a rich source of process safety information 
as well as documented case histories. The Center’s web 
address: 

http: / / process- safety, tamu. edu. 

The British Institution of Chemical Engineers (IChemE) 
offers links to a comprehensive list of well over a 150 other 
websites of incident reports. The IChemE site mainly 
describes incidents of interest to chemical or process engi¬ 
neers, and includes a time span of incidents from historical 
to today’s events. The collection includes both information 
and viewpoint. The address of this site is: 
http://slp.icheme.org/incidents.html. 

The Delft University of Technology of The Netherlands 
offers a vivid array of about two dozen outstanding fire 
and explosion photos, an accident database and more. The 
university’s main research effort is focused on measuring 


and modelling dust and gas explosions. The incident photos 
can be found at: 

http://www.dct.tudelft.nl/part/explosion/gallery.html. 

Two other excellent internet sources of process safety 
information including case histories are: 

• www.acusafe.com 

• www.hazardview.com 

The AcuSafe website provides a comprehensive electronic 
newsletter entitled AcuSafe News. Their newsletter is 
devoted to serving industry, government and interested 
members of the public by providing process safety prac¬ 
tices, incident news, lessons, learned and regulatory 
developments. Hazard View is a source of advice, comment 
and information for safety, environment and risk profes¬ 
sionals with major accident hazards in the process indus¬ 
tries. Their View Library has a number of vivid images of 
the damages from accidents. 

A booklet entitled Large Property Damage Losses in the 
Hydrocarbon-Chemical Industry — A Thirty Year Review, 
continues to be an excellent source of information in print 
form. This publication presents summaries of large prop¬ 
erty losses of incidents from around the globe. The valuable 
information is from a property insurance viewpoint and is 
presented in an easy-to-understand form. Most of the 
damages are the result of fires and explosions occurring in 
refineries, petrochemical plants, gas-processing plants, 
terminals, offshore and a miscellaneous category. It is 
updated every few years and the latest one, the twentieth 
edition, was released in January 2003. 

Collections of case histories have been published in Case 
Histories of Accidents in the Chemical Industry by the 
Manufacturing Chemists Association (MCA) (1962-/1-4) 
and by Kier and Muller (1983). Specialized collections have 
been published on particular topics such as major hazards 
(Harvey, 1979, 1984; Carson and Mumford, 1979; Lees, 
1980b; V.C. Marshall, 1987), fire and explosion (Vervalin, 
1964a, 1973a; WH. Doyle, 1969), vapour cloud explosions 
(Gugan, 1979; Slater, 1978a; D.J. Lewis, 1980d; Davenport, 
1987; Lenoir and Davenport, 1993), LPG (L.N. Davis, 1979), 
instrumentation (W.H. Doyle 1972a,b; Lees, 1976b), trans¬ 
port (Haastrup and Brockhoff, 1990) and pipelines (Riley, 
1979). The series Safety Digest of Lessons Learned by the 
API gives case histories with accompanying analyses. 
Another such series is that published by the American Oil 
Company (Amoco) of which Hazards of Water and Hazards 
of Air are the best known. The Convey Reports and the 
Rijmond Report give information on certain incidents. 
The reports of the HSE provide case histories of investiga¬ 
tions by a regulator as do those of the NTSB, which deal 
with rail, road, pipeline and marine accidents. Incidents 
involving large economic loss are described in the periodic 
review 100 Large Losses by Marsh and McLennan. 

Case histories are also given in the Annual Report ofHM 
Chief Inspector of Factories, the Chemical Safely Summary 
of the Chemical Industry Safety and Health Council (CISHC) 
and in journals such as Petroleum Review and NFPA Quar¬ 
terly. In addition, the Loss Prevention Bulletin issued by 
the IChemE gives case histories. There are also numerous 
case histories described in much greater detail in vari¬ 
ous papers and reports. The disasters at Flixborough 
(R.J. Parker, 1975), at Bantry Bay (Costello, 1979) and on 
Piper Alpha (Cullen, 1990) are among the most thoroughly 
documented. 
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The analysis of case histories to draw the relevant 
lessons is exemplified pre-eminently in the work of Trevor 
Kletz’s many books and numerous technical articles: 


Critical Aspects of Safety and Loss Prevention (1990b), 
Lessons from Disaster - How Organisations have No 
Memory and Accidents Recur (1993##), 

What Went Wrong? - Case Histories of Process Plant 
Disasters, 4th edn (1998##) 

An Engineer’s View of Human Error, 3rd edn 
(2001##A) and 

Learning from Accidents, 3rd edn (2001##B) and 
numerous technical articles. 


Additional lessons can be examined in Roy Sanders’ 
Chemical Process Safety: Learning from Case Histories 
(1999##). 

Selectedreferences on casehistories are given inTableAl.l. 
Some major incidents are listed in Table A1.2. A proportion 
of these are described in S ection A1.10. 

Table A1.1 Selected references on case histories 


Eddy, Potter and Page (1976); J.R. Nash (1976); Carson and 
Mumford (1979); Nancekieville (1980); D.J. Lewis (1984a, 
1993); Kletz (1981a, 1984m, 1985o,p, 1988d,h,i,n, 1993b); 
Buhrow (1985,1986); Kharbanda and Stallworthy (1988); 
Garrison (1988a,b); Koehorst (1989); Haastrup and 
Brockhoff (1990,1991); Marsh and McLennan (1991LPB 
99); Marsh and McLennan (1991 LPB 99); O’Donovan (1991 
LPB 99); Palmer and Marshall (1991 LPB 99); Anon. (1992 
LPB 99, p. 1); Chowdhury and Parkinson (1992); Lenoir and 
Davenport (1992);Taylor (1993 LPB 112); I.E. Thomas (1995) 

Databases 

Service Informatics and Analysis (1982); Amesz et al. 
(1983); K.R. Davies (1983); Makstenek etal. (1992); Winder 
et al. (1992); Bruce (1994); Koivisto and Nielsen (1994); 
Steffy (1994); 

Accident reporting: Badoux (1983) 

MHIDAS: SRD (1990) 

FACTS: Koehorst and Bockholtz (1991) 

MARS: Amendola, Contini and Nichele (1988); Drogaris 
(1991,1993) 

FIRE (warehouses): Koivisto and Nielsen (1994) 

Major hazard control 

Anon (1979c); Anon. (1985n); Anon. (1986o); Anon. (1990 
LPB 95, p.4) 

Hazard identification 

Sellers (1988); Sellers and Picciollo (1988); Cullen (1990) 

Process design 
Anon. (1992 LPB 107, p. 27) 

Chemical reactors 

Anon. (1962a); Zielinski (1967,1973); Fowler and 
Spiegelman (1968); Bast (1970); Grewer (1970); Valpiana 
(1970a,b); Zehr (1970); Vincent (1971); Fire J. Staff (1973a,d); 
Bloore (1974); Gugan (1974b); HM Chief Inspector of 
Factories (1974); Anon. (1975 LPB 1, p. 10); Anon. (1975 LPB 
3, p. 1); Anon (1975 LPB 5, p. 16); Anon. (1977 LPB 13, p. 13); 
Tong, Seagrave and Widerhorn (1977); Anon. (1979 LPB 28, 
29,30); Skinner (1981); Bond (1985 LPB 65); Anon. (1986 


LPB 68, p. 33); Berkey and Workman (1987); Anon. (1989 
LPB 90, p. 29); Levy and Penrod (1989); Anon. (1991 LPB 
98, p. 7); Kotoyori (1991); Anon. (1993 LPB 113, p. 25); Anon. 
(1994 LPB 115, p. 1); Anon. (1994 LPB 117, p. 18); Anon. (1994 
LPB 118, p. 8); Dixon-Jackson (1994) 

Petrochemical plants 

Britton (1994) 

Utilities 

Dowell (1994a) 

Ammonia, urea and ammonium nitrate plants 

R.W. James and Lawrence (1973); Anon. (1975h); Din (1975); 
Esrig, Ahmad and Mayo (1975); Henderson (1975); 
Lonsdale (1975); Osman (1975); K. Wright (1975); 
Visvanathan (1976); Kusha (1977); PC. Campbell (1981); 
Janssen, Siraa and Blanken (1981); Roney and Persson 
(1984); Anon. (1987 LPB 78, p. 11) 

DSTG 

FPC, Bureau of Natural Gas (1973); L.N. Davis (1979) 

Pressure systems and components 

Bohlken (1961); Saibel (1961a,b); Attebery (1970); R.W. 
Miller and Caserta (1971); Banks (1973); Gupton and 
Kreisher (1973); R.W. James and Lawrence (1973); van der 
Horst and Sloan (1974); Appl (1975); Blanken (1975); Fuchs 
and Rubinstein (1975); Lonsdale (1975); Steele (1975); Kletz 
(1976b, 1987a); National Vulcan (1977); Kinsley (1978); 
Makhan and Honse (1978); Perkins (1980 LPB 33); Anon. 
(1981 LPB 37, p. 23); Connaughton (1981); Blanken and 
Groefsma (1983); Anon. (1984 LPB 56, p. 26); R.W. Clark and 
Connaughton (1984); NBS (1986); Anon. (1988 LPB 83, p. 1, 
3, p. 11,15,17 and 19); Anon. (1989 LPB 86, p. 22 and 27); 
Anon. (1989 LPB 94, p. 16); Droste and Mallon (1989); Anon. 
(1990 LPB 93, p. 23); Rademayer (1990); Anon. (1991 LPB 
97, p. 9); Smith (1991 LPB 102); Anon. (1992 LPB 104, p. 27); 
Anon. (1992 LPB 107, p. 27); Crawley (1992 LPB 104); Anon. 
(1993 LPB 111, p. 25); Anon. (1993 LPB 113, p. 13); Anon. 
(1994 LPB 117, p. 24); Clayton and Griffin (1994) 

Process machinery 

OIA (n.d./7); Gibbs (1960); Rendos (1967); Shield (1967, 
1972); Naughton (1968); North and Parr (1968);Telesmanic 
(1968); Zech (1968); Zimmerman (1968); D.S.Wilson etal. 
(1970); von Nimitz,Wachel and Szenasi (1974); Anon. 
(1975f); Roney (1975); Novacek (1983); Anon. (1985 LPB 62, 
p. 27); Anon. (1990 LPB 91, p. 16); Anon. (1990 LPB 92, p. 15); 
Anon. (1994 LPB 116, p. 21) 

Instruments 

MCA (1962-/1-4); WH. Doyle (1969,1972a, b); Fritz (1969); 
H.D. Taylor and Redpath (1971,1972); Kletz (1974b,d); 
McLain (1975b); K.Wright (1975); Lees (1976b); Griffin and 
Garry (1984); Anon. (1986 LPB 68, p. 35); Anon. (1992 LPB 
104, p. 11); Anon. (1994 LPB 116, p. 22) 

Computer control systems 

Nimmo, Nunns and Eddershaw (1987,1993 LPB 111) 

Human error 

Speaker,Thompson and Luckas (1982); Anon. (1983i); 
Anon. (1989b); Anon. (1990 LPB 92, p. 13) 

Emissions, leaks, releases 

Schneidman and Strobel (1974); Anon. (1980 LPB 36, p. 25); 
Anon. (1982 LPB 43, p. 21); Edwards (1982 LPB 47); 
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Christiansen and Jorgensen (1983); Anon. (1986 LPB 70, 
p. 1); Anon. (1989 LPB 85, p. 27); Anon. (1989 LPB 90, p. 13); 
Anon. (1990 LPB 91, p. 16); Anon. (1992 LPB 104, p. 27); 
Anon. (1994 LPB 117, p. 24) 

Fire 

OIA (Publ. 651,1972 Publ. 302,1973); Woodworth (1958); 
Lamond (1962); MCA (1962-/1-4); Pinney (1962); Rendos 
(1964);Vervalin (1964a,c, 1973a,b); Anon. (1966d); Ashill 
(1966); Cowles (1966); McCarey (1966); Darling (1967); 
Ostroot (1967,1973); Zielinski (1967,1973); Anon. (1968b); 
Leroy and Johnson (1969); Orey (1972a); Searson (1972, 
1990 LPB 94); Fire J. Staff (1973b,e); Fowle (1973); Garrad 
(1973); NFPA (1973/10); St. Clair (1973); Beausoleil, Phillips 
and Snell (1974); Sharry and Walls (1974); Anon. (1975 LPB 
0, p. 13); McLain (1975b); Anon. (1976h,k); Kletz (1976g, 
1979a, 1984 LPB 58,1993 LPB 114); Saia (1976); Anon. 
(1978d); HSE (1978c); Isman (1978); Lathrop (1979); Anon. 
(1980u); Anon. (1981p); Crain (1981); Oosterling and 
Orbons (1981); Anon. (1982 LPB 43, p. 2); Anon. (1983m); 
Anon. (1983 LPB 51, p. 13); FM (1983); Anon. (1984 LPB 57, 
p. 19); Mullier, Rustin and Hecke (1984); Mumford (1984 
LPB 57); Anon. (1985 LPB 64, p. 13); Bond (1985 LPB 65, 
1991); Carson, Mumford and Ward (1985 LPB 65); Kohler 
(1985); Politz (1985); Anon. (1986 LPB 69, p. 17 and 33); 
Anon. (1986 LPB 71, p. 27); Lask (1986); McCoy, Dillenback 
and Truax (1986); Steinbrecher (1986,1989 LPB 88); Anon. 
(1987 LPB 77, p. 11 and 27);V.C. Marshall (1987,1990 LPB 
95,1994 LPB 116); Anon. (1988 LPB 79, p. 23); Anon. (1988 
LPB 82, p. 19); Anon. (1988 LPB 83, p. 13); Anon. (1988 LPB 
84, p. 19); Armstrong (1988 LPB 83); Schwab (1988a, 1988 
LPB 83); Anon. (1989 LPB 87, p. 15); Anon. (1989 LPB 88, 
p. 19); B. Browning and Searson (1989); IMechE (1989/111); 
Anon. (1990g); Anon. (1990 LPB 91, p. 22); Anon. (1990 
LPB 94, p. 26 and 30); Anon. (1990 LPB 95, p. 19); Adelman 
and Adelman (1990 LPB 94); Perunicic and Skotovic (1990 
LPB 96); Anon. (1991 LPB 97, p. 12); Anon. (1991 LPB 98, 
p. 9); Kohvaporrand (1991); Anon. (1991 LPB 102, p. 35); 
Anon. (1992 LPB 103, p. 24); Anon. (1992 LPB 104, p. 7,9 and 
13); Anon. (1992 LPB 105, p. 15); Carson and Mumford (1992 
LPB 108,1993 LPB 109,110); Kirk (1992 LPB 105); Prine 
(1992); Anon. (1993 LPB 113, p. 27); Anon. (1993 LPB 114, 
p. 19); Anon. (1994 LPB 115, p. 6); Anon. (1994 LPB 120, p. 10 
and 19) 

Fire: static electricity 

Klinkenberg and van der Minne (1958); Bustin (1963); 
Eichel (1967); Muller-Hillebrand (1963); van der Meer 
(1971); Anon. (1979 LPB 29, p. 134); Anon. (1983 LPB 52, 
p. 19); H.R. Edwards (1983); M.R.O. Jones and Bond (1984, 
1985); Liittgens (1985); Anon. (1987 LPB 78, p. 9); Owens 
(1988); Anon. (1994 LPB 118, p. 14) 

Explosions 

OIA (Publ. 651,1973); Assheton (1930); Jacobs etal. (1957); 
F.C. Price (1960); Matthews (1961); Popper (1963); 
Alexander and Finigan (1964); Bateman (1964); W. A. 
Mason (1964); Pipkin (1964); Sakai (1964); Schmitt (1964); 
Thodos (1964);Walls (1964b); Sorrell (1965); Anon. (1966c); 
W.L. Ball (1966a); Haseba etal. (1966);Wilkinson (1966); 
Adcock and Weldon (1967b, 1973); Dixon (1967); Dorsey 
(1967); Lorentz (1967,1973); J.D. Reed (1967); Bast (1970); 
Buehler et al. (1970); Fritsch (1970); Grewer (1970); Kotzerke 
(1970);Valpiana (1970a, b); Volpers (1970); Cracknell (1971); 
Dartnell and Ventrone (1971); K.W. Sanders (1971); GA 
Campbell and Rutledge (1972); Fire J. Staff (1973d); Freese 


(1973); Gozzo and Carraro (1973); Jacobs et al. (1973); 
Meganck (1973); de Oliviera (1973); WW Patterson (1973); 
Vervalin (1973e); Bateman, Small and Snyder (1974); Bloore 
(1974); Grimm (1974); Gugan (1974b); Hadas (1974); 
Hartgerink (1974); Kletz (1974b, 1976b,f,x, 1984 LPB 56, 
1988); Lockemann (1974); Ludford (1974);Tanimoto (1974); 
Voros and Honti (1974); Anon. (1975 LPB 1, p. 3 and 15); 
Anon. (1975 LPB 5, p. 1); Anon. (1975 LPB 6, p. 17); 
Dooyeweerd (1975); Henderson (1975); Strehlow and Baker 
(1975,1976); Anon. (1976 LPB 11, p. 2); Carver (1976); 
Kotoyori etal. (1976); Rebsch (1976); Saia (1976); Anon. 
(1977d);Tong, Seagraves and Wiederhorn (1977); Anon. 
(1978 LPB 19, p. 24); Cremer and Warner (1978); Markham 
and Honse (1978); Biasutti (1979); Anon. (1980y); 
Ramadorai (1980); Edwards (1982 LPB 47); Anon. (1983a); 
Bond (1983 LPB 50); Anon. (1983 LPB 51, p. 9); Lloyd 
(1983); Ursenbach (1983); Anon. (1984 LPB 54, p. 13); Anon. 
(1985c); HSE (1985d); Schwab (1988a,b, LPB 83);Wrightson 
and Santon (1988 LPB 83); Anon. (1989 LPB 87, p. 3,7 and 
27); Anon. (1989 LPB 88, p. 17); Anon. (1989 LPB 89, p. 13); 
Bond (1989 LPB 93); Cronin (1989 LPB 90); Ernst (1989); 
G.M. Lawrence (1989); MacDiarmid and North (1989); 
Nightingale (1989a, b); Urben (1989 LPB 80); Anon. 
(1990d,e,i); Anon. (1990 LPB 91, p. 15); Anon. (1990 LPB 95, 
p. 15); de Haven and Dietsche (1990); Segrave and Wilson 
(1990); Anon. (1991d,f,k,l); Anon. (1991 LPB 97, p. 23); 
Anon. (1991 LPB 98, p. 1 and 18); Anon. (1991 LPB 102, p. 7); 
Arendt and Lorenzo (1991); Carson and Mumford (1991 
LPB 102); Hempseed and Ormsby (1991); Anon. (1992b); 
Anon. (1992 LPB 103, p. 19); Anon. (1992 LPB 103, p. 31); 
Anon. (1992 LPB 107, p. 17); S.E. Anderson, Dowell and 
Mynaugh (1992); Moran (1992); Palazzi (1992); Raheja etal. 
(1992); Anon. (1993 LPB 109, p. 7); Anon. (1993 LPB 109, 
p. 25 and 26); Anon. (1993 LPB 110, p. 25); Anon. (1993 LPB 
112, p. 21); Bergroth (1993 LPB 109); Bond (1993 LPB 101); 
Wehrum (1993); Whitmore, Gladwell and Rutledge (1993); 
Zhang and Tang (1993); Anon. (1994 LPB 115, p. 9); Anon. 
(1994 LPB 116, p. 17) 

BLEVEs 

Kohler (1985); Selway (1988 SRD R492) 

Dust explosions, dust fires 

Morozzo (1795); D.J. Price and Brown (1922); NFPA (1957/1); 
K.C. Brown and James (1962); Remirez (1967);Yowell (1968); 
Noss (1971); O’Reilly (1972); Tonkin and Berlemont (1972 
FRS Fire Res. Note 942); K.N. Palmer (1973a); Pollock 
(1975); Lathrop (1978); Anon. (1979e); Braun (1979); Snow 
(1981); Anon. (1983 LPB 51, p. 9); Anon (1989 LPB 90, p. 27); 
Skinner (1989); Anon. (1990 LPB 95, p. 1,6 and 13); Kaiser 
(1991); Senecal (1991); Anon. (1994 LPB 115, p. 9) 

Toxic release 

Chasis et al. (1947); Joyner and Durell (1962); Hoveid (1966); 
Inkofer (1969); MacArthur (1972); Simmons, Erdmann and 
Naft (1973,1974); Eisenberg, Lynch and Breeding (1975); 
Lonsdale (1975); Luddeke (1975); Anon. (1976n,o); Hoyle 
and Melvin (1976); HSE (1978b); Harvey (1979b); Shooter 
(1980); N.C. Harris (1981b); Anon. (1982 LPB 48, p. 13); 
Prijatel (1983); Sweat (1983); Anon. (1985 LPB 66, p. 23); 
HSE (1985 LPB 63); Anon. (1987 LPB 75, p. 23); Anon. (1989 
LPB 86, p. 22 and 27); Anon. (1989 LPB 89, p. 27); Anon. 
(1990 LPB 91, p. 19); Anon. (1990 LPB 92, p. 11,15,23 and 
26); Duclos and Binder (1990); Huvinen (1990 LPB 92); 
Fallen (1990); M.P. Singh (1990); M.P. Singh, Kumari and 
Ghosh (1990); Anon. (1991 LPB 97, p. 7); Anon. (1991 LPB 
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98, p. 25); Anon. (1993 LPB113, p. 26); Anon. (1993 LPB112, 
p. 22) 

Plant commissioning 

Dyess (1973); Parnell (1973); J.R. Robinson (1973); Severn 
(1973); Arnot and Hirons (1974); Horsley (1974); Jenkins and 
Crookston (1974); Butzert (1976); Anon. (1977 LPB 18, p. 2); 
Bress and Packbier (1977); Givaporert and Eagle (1977); 
Tandy and Thomas (1979); Kletz (1984k); Grotz, Gosnell 
and Grisolia (1985); Ruziska etal. (1985); Song (1986); 

WK. Taylor and Pino (1987); Kneale (1991 LPB 97) 

Plant operation 

MCA (1962-/1-4); WH. Doyle (1972a); Kletz (1975b); Lees 
(1976b); Anon. (1978 LPB 20, p. 41); Anon. (1987 LPB 77, 
p. 17); Anon. (1989 LPB 88, p. 1); Anon. (1989 LPB 89, p. 9 
and 18);T.O. Gibson (1989); Anon. (1990 LPB 92, p. 22); 
Anon. (1991 LPB 98, p. 19); Anon. (1992 LPB 106, p. 19); 
Anon. (1992 LPB 107, p. 17); Anon. (1994 LPB 115, p. 7) 

Plant maintenance 

Simm s (1965); Anon. (1978 LPB 24, p. 155); Anon. (1979 LP 
27, p. 80); P.C. Campbell (1981); Roney and Persson (1984); 
Deacon (1988); Anon. (1989 LPB 85, p. 1,3 and 5); Anon. 
(1989 LPB 86, p. 17); Anon. (1990 LPB 92, p. 9); Anon. (1991 
LPB 97, p. 7); Anon. (1991 LPB 98, p. 20); Anon. (1991 LPB 

102, p. 27); Anon. (1991 LPB, p. 20 and 25); Anon. (1992 LPB 

103, p. 24,25 and 29); Anon. (1992 LPB 104, p. 10); Anon. 
(1992 LPB 107, p. 21 and 22); Anon. (1993 LPB 112, p. 20); 
Anon. (1994 LPB 116, p. 22); Anon. (1994 LPB 117, p. 17); 
Anon. (1994 LPB 119, p. 8); Bond (1994 LPB 117) 
Construction 

Anon. (1991 LPB 107, p. 21 and 22) 

Excavation 

Anon. (1992 LPB 107, p. 22 and 23) 

Plant modification 

Anon. (1975 LPB 1, p. 1); R.J. Parker (1975); Booth (1976); 
Henderson and Kletz (1976); Heron (1976); WW Russell 
(1976); Anon. (1978 LPB 22, p. 101) 

Storage 

OIA (Publ. 711,1974 Loss Inf. Bull. 400-1);Vervalin (1964a, 
1973a); J.A. Lawrence (1966); Frank and Wardale (1970); 
J.R. Hughes (1970); A. Nielsen (1971); Litchenberg (1972, 
1977); MacArthur (1972); Anon. (1975 LPB 0, p. 2); 
Henderson (1975); Lonsdale (1975); Anon. (1976 LPB 12, 
p. 7); Hampson (1976); Anon. (1978 LPB 20, p. 55); Anon. 
(1979 LPB 26, p. 31); Anon. (1979 LPB 27, p. 68); Gustin and 
Novacek (1979); Anon. (1980 LPB 32, p. 13); Anon. (1980 
LPB 36, p. 25); Anon. (1981 LPB 37, p. 7); Anon. (1981 LPB 
41, p. 11); Morgenegg (1982); Anon. (1984 LPB 57, p. 11); 
Anon. (1986 LPB 69, p. 29); Badame (1986); NBS (1986, 
1988); Anon. (1987 LPB 75, p. 19); Anon. (1987 LPB 78, 
p. 26); Anon. (1988m); Marshall (1988 LPB 82); Anon. (1989 
LPB 88, p. 11); Anon. (1992 LPB 106, p. 5). Warehouses: 
Pietersen (1988); Christiansen, Kakko and Koiviso (1993); 
Koivisto and Nielsen (1994) 

Transport 

AGA (Appendix 28 Pipeline Accident Reports); NTSB 
(annual reports); Engel (1969); Inkofer (1969); Medard 
(1970); Cato and Dobbs (1971); AW Clarke (1971b); Kogler 
(1971); Caserta (1972a); Ass. of Amer. Railroads (1972); 
Hayes (1972); Fire J. Staff (1973); Lloyds list (1974); Wilde 
(1974); DoE (1976/6); Anon. (1977 LPB 15, p. 33); Getty, 
Rickert and Trapp (1977); Merricks (1977); Anon. (1978j); 


Anon. (1978 LPB 54, p. 7); Anon. (1979g); Selikoff (1979); 
Egginton (1980); Anon. (1981m); George (1981a,b); Kletz 
(1981b); Knife (1982—83);V.J. Clancey (1983); van der 
Schaaf and Steunenberg (1983); M. Griffltsh and linklater 
(1984); Hymes (1985 LPB 61); Kilmartin (1985 LPB 61); 
G.A. Gallagher (1986); G. A. Gallagher and McCone (1986); 

D. J. Lewis (1986b); Watson (1986 LPB 72); Anon. (1988 LPB 
80, p. 3); Anon. (1990 LPB 92, p. 25 and 26); Anon. (1990 
LPB 93, p. 3); Anon. (1990 LPB 94, p. 1 and 7); Bond (1990 
LPB 94); Anon. (1991 LPB 98, p. 5); Anon. (1991 LPB 101, 
p. 13); Anon. (1993 LPB 110, p. 7); Marshall (1993 LPB 114); 
Anon. (1994 LPB 115, p.7) 

Emergency planning 

Donovan (1973); R.J. Parker (1975); Ikeda (1982); Anon. 
(1986 LPB 70, p. 1); Anon. (1993 LPB 113, p. 26) 

Emergency planning: transport 

Dowell (1971); Kogler (1971); Burns (1974); Dektar (1974); 
Ellis (1974); Furey (1974); Eisenberg, Lynch and Breeding 
(1975); HSE (1978b); Zajic and Himmelman (1978); Anon. 
(1982h); Anon. (1983m) 

Personal health and safety 

Anon. (1988 LPB 88, p. 3 and 14 (x2)) 

Environment 

E. Hughes (1973);Willman (1977); Anon. (1978 LPB 22, 

p. 114); Anon. (1982c); Kharbanda and Stallworthy (1982); 
Frisbie (1982); A. Shepherd (1982a); A.J. Smith (1982); 

Kier and Mffller (1983); Cairns (1986); Goudray (1992); 
Anon (1993a,f) 

Offshore 

Fischer (1982); Anon. (1991f) 

Other case histories 

Bakir et al. (1973); Anon. (1976 LPB 9, p. 5); Anon. (1976 LPB 
11, p. 10); Vervalin (1981,1987); Anon. (1982 LPB 48, p. 27); 
Anon. (1982 LPB 49, p. 26); Kletz (1982 LPB 48,49); Anon. 
(1984 LPB 54, p. 21); Anon. (1984 LPB 60, p. 1); Anon. (1985 
LPB 61, p. 33); Anon. (1985 LPB 64, p. 27); Buhrow (1985, 
1986); Lask (1986); Manuell (1986 LPB 71); Schillmoller 
(1986); Anon. (1987q); Plummer (1987 LPB 73); Robinson 
(1987 LPB 78); Anon. (1988h); Anon. (1988 LPB 81, p. 15); 
Anon. (1988 LPB 83, p. 25); Anon. (1989 LPB 88, p. 18); 
Anon. (1989 LPB 90, p. 15); Mansot (1989); Mooney (1991); 
Anon. (1993c); Davie, Nolan and Hoban (1994) 


Al .2 Incident Databases 

There are a number of databases specifically dealing with 

case histories. They include the following: 

• The incident databases Major Hazards Incident Data 
System (MHIDAS) and the corresponding explosives 
data system EIDAS are operated by SRD. 

• TNO has developed the FACTS incident database. 

• The JRC of the CEC at Ispra, Italy, runs the Major Acci¬ 
dent Reporting System (MARS), described by Drogaris 
(1991,1993). 

• The FIRE incident database for chemical warehouse 
fires has been described by Koivisto and Nielsen (1994). 

• An account of the offshore Hydrocarbon Release (HCR) 
database in the United Kingdom has been given by 
Bruce (1994). 
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A1.3 Reporting of Incidents 

The extent and accuracy of the reporting of incidents and 
injuries is variable and this creates problems particularly 
for attempts to perform statistical analysis of incident data. 

Three distinct problems may be identified: (1) occurrence 
of an incident; (2) injuries associated with an incident; and 
(3) national injury statistics.These three cases are considered 
in this section and in the next two sections, respectively. 

The awareness of the engineering community world¬ 
wide of incidents varies according to the country in which 
the incident has occurred and the size and impact of the 
incident. For example, in the recent past incidents in the 
United States have generally been reported in the technical 
press but reports of comparable incidents in the USSR have 
been relatively few. 

With regard to the effects of scale and impact, the 
probability of worldwide reporting of a incident clearly 
increases with these factors. The probability that an acci¬ 
dent of the magnitude of Bhopal is not reported in countries 
with a free press is negligible. However, as the size of the 
incident decreases, the probability that it is not reported or 
at least is not picked up in incident collections and data¬ 
bases increases.The problem has been discussed by Badoux 
(1983). Figure Al.l shows schematically the probable 
extent of underreporting, curve A representing the actual 
reporting situation and curve B the ideal one. 


A1.4 Reporting of Injuries in Incidents 

For various reasons, accounts of incidents tend to differ in 
the number of injuries and, to a lesser extent, fatalities that 
are reported. A discussion of this problem has been given 
by Haastrup and Brockhoff (1991). 

There are a number of reasons for differences in the 
numbers quoted. One is that early reports of an incident 
tend not be very accurate, but are sometimes quoted with¬ 
out sufficient qualification and the numbers then receive 
currency. 


With regard to fatalities, a difference arises between 
immediate and delayed deaths. A case where a proportion 
of delayed deaths is fairly common is burn casualties. 

The most frequent and large differences, however, are in 
‘injuries’. Here much of the difference can usually be 
accounted for by differences in definition. 

As an illustration, consider the injuries in the explosion 
at Laurel, Mississippi on 25 January 1969.The NTSB report 
on this incident (NTSB 1969 RAR) states that 2 persons 
died, 33 received treatment in hospital and numerous oth¬ 
ers were given first aid. Some authors have therefore 
quoted this as 2 dead, 33 injured. Eisenberg, Lynch and 
Breeding (1975) refer to the NTSB report but also to a pri¬ 
vate communication from a railroad source and state that 
976 persons were injured, 17 being in hospital for more than 
a month. This incident is one of those quoted by Haastrup 
and Brockhoff as an example of the problem. 

Another illustration is provided by the explosion at 
Silvertown, London, on 19 January 1917. The account given 
later in this Appendix states that 68 were killed, 98 seri¬ 
ously injured, 328 had slight injuries and about 600 are 
thought to have received treatment in the street or from 
private doctors. Thus this account gives three separate 
categories of injury, without even mentioning hospitals. 

A1.5 Reporting of Injuries at National Level 

It is normal for there to be a regulatory requirement for the 
reporting, as a minimum, of deaths and injuries. In the 
United Kingdom the relevant regulations are RIDDOR 
1985. The information gathered in this way is published by 
the HSE in the series Health and Safety Statistics. 

The reporting is incomplete. A study supplementary 
to the household-based Labour Force Survey 1990 in the 
United Kingdom showed that only approximately 30% of 
non-fatal injuries were reported to the HSE, but that the level 
of reporting varied significantly across industries (Kiernan, 
1992). For the energy industry the proportion of such 
accidents reported was 75%, and it seems probable that the 



Size -- 

Figure A1.1 Number of accidents reported (after Badoux, 1983): A, accidents actually reported; and B, total 
number of accidents (and ideal reporting curve) 
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level of reporting in process industries such as oil refining, Hours by J.R. Nash (1976). Some principal explosions are 
petrochemical and chemicals is similar. listed by Nash. His list gives death tolls that in some cases 

differ from those given elsewhere. The incidents in which 
the number of deaths is quoted as 200 or more are: 


Date 


Location 


No. of deaths 

1916 

Nov. 16 

La Satannaya, Belgium 

Munitions 

1000 

1917 

Jan. 19 

Silvertown, London 

Munitions factory 

300 a 


Feb. 20 

Archangel, Russia 

Munitions shipment 

1500 


Jun. 23 

Bloeweg, Belgium 

Munitions factory 

1000 


Aug. 6 

Henningsdorf, Germany 

Munitions factory 

300 


Dec. 6 

Halifax, Nova Scotia 

Munitions shipment 

1600 a 

1918 

Aug. 3 

Hamont Station, Belgium 

Munitions shipment 

1750 


Sept. 22 

Woellerdorf, Austria 

Munitions factory 

382 

1925 

May 25 

Peking, China 

Munitions store 

300 

1934 

Mar. 14 

La Libertad, Salvador 

Explosives store 

250 

1935 

Oct. 30 

Lanchow, China 

Munitions store 

2000 

1941 

Jan. 9 

Fort Smederovo, Yugoslavia 

Munitions store 

1500 

1944 

Apr. 14 

Bombay, India 

Munitions shipment 

1376 a 


Jul. 17 

Port Chicago, CA 

Munitions shipment 

321 

1956 

Aug. 27 

Cali, Columbia 

Munitions shipment 

1200 


a The death tolls given in the account in Section A1.10 are as follows: Silvertown 69; Halifax 1800; and Bombay Docks 350 (early reports) 
This list does not include incidents involving primarily ammonium nitrate. 


A1.6 Incident Diagrams, Plans and Maps 

Many accounts of incidents give diagrams, plans or maps 
showing features such as derailed tank cars, location of mis¬ 
siles, location of victims, etc. In particular, such diagrams are 
a feature of the accident reports by the HSE and the NTSB and 
of case histories described in the Loss Prevention Bulletin. 

Typical diagrams showing injury effects at an accident 
from an HSE report are given in Figure A1.19. A typical 
diagram of the site of an accident from an NTSB report is 
shown in Figure A1.16. 

The NTSB system of Hazardous Material Spill Maps, 
documents separate from the accident reports, is described 
by the NTSB (1979), Benner and Rote (1981) and Lasseigne 
(1984). One such map is shown in Figure A1.2. 

A1.7 Incidents Involving Fire Fighting 

A feature of some interest in incidents is the experience 
gained in fire fighting. Some minimal information about 
this is given for selected case histories in Series A. Further 
information may be found in the following accounts: 
Brindisi, 1977 (Mahoney, 1990) 

Milford Haven, 1983 (Dyfed County Fire Brigade, 1983; 
Mumford, 1984LPB57) 

Thessalonika, 1986 (B. Browning and Searson, 1989) 
Grangemouth, 1987 (HSE, 1989a) 

Port Heriot, 1987 (Mansot, 1989) 

A1.8 Incidents Involving Condensed Phase 
Explosives 

A number of the incidents given in the following sections 
involve explosives. There have been, however, a large num¬ 
ber of other explosives and munitions incidents that are of 
only marginal interest here. 

An account of explosions up to 1930 is given in History of 
Explosions by Assheton (1930) and later treatments are 
Explosions in History by N.B. Wilkinson (1966) and Darkest 


Other incidents given by Nash, with death tolls shown in 
brackets, are: 


Munitions, explosives, powder factories 

1915 Oct. 20 Paris, France (52); Nov. 31 Eilmington, 
Delaware (31); Dec. 11 Havre, Belgium (110); 1916 Apr. 4 
Kent, England (170); Dec. 6 Kent, England (26); 1917 Apr. 10 
Chester, PA (133); Oct. 4 Morgan, NJ (64); 1924 Mar. 1 Nixon, 
NJ (26); 1925 Mar. 1 Kharput, Turkey (160); 1926 Apr. 7 
Mannheim, Germany (40); Aug. 12 Csepel, Hungary (24); 
1929 Sep. 5 Brescia, Italy (22); 1931 Apr. 30 Nichteroy, Brazil 
(100); 1935 Jun. 13 Reinsdorf, Germany (52); Jul. 28 Taino, 
Italy (33); 1936 Jun. 15 Tallinn, Estonia (40); 1937 Jul. 17 
Chungking, China (110); 1940 Aug. 29 Bologna, Italy (38); 
1941 Jan. 10 Polichka, Czechoslovakia (80); 1943 Dec. 11 
Grenoble, France (73); 1947 Aug. 18 Cadiz, Spain (149) 

Munitions, explosives stores and arsenals 

1916 Feb. 6 Skoda, Austria (185); Feb. 20 Nish, Serbia (43); 
Mar. 4 Fort Double Coronne, France (30); 1926 Jul. 19 Lake 
Denmark, NJ (30); 1928 Sep. 26 Ft Cabreriza, Morocco (38); 
1929 Mar. 4 Sofia, Bulgaria (28); 1931 May 5 Yuchu, China 
(100); Aug. 13 Macao, China (26); 1932 Jul. 10 Nanking, 
China (100); 1935 Oct. 23 Shanghai, China (190); 1944 Nov. 
28 Fauld, England (175) a ; 1945 Feb. 26 Paris, France (20); 
Jul. 7 Saragossa, Spain (30); Oct. 25 Asnier-en-Bessin, 
France (33); Dec. 29 Codroipo, Italy (23); 1946 Apr. 8 Saigon, 
Vietnam (23); 1949 Jul. 26 Tarancon, Spain (25); 1953 Apr. 6 
Nantsechu, Formosa (54); 1956 May 17 Takoradi, Africa 
(25); 1963 Aug. 13 Gauhati, India (32) 

Munitions, explosives shipments 
1916 Aug. 8 Koenigsberg, Germany (50); 1919 Feb. 1 
Longwy, France (64); 1924 Dec. 27 Otaru, Japan (120); 1930 
Dec. 3 Midas Garaes, Brazil (36); 1955 Sep. 23 Gomex 
Palacio, Mexico (40); 1960 Mar. 4 Havana, Cuba (100); 1964 
Jul. 23 Bone, Algeria (85) 
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Munitions, explosives (otherwise unspecified) 

1925 Nov. 22 Ahwaz, Persia (70); 1933 Jan. 20 Morelia, 
Mexico (23); 1934 Aug. 4 Nakang, Japan (25); 1953 Aug. 18 
Benghazi, Libya (50); Sep. 12 Wuensdorf, Germany (20) 

a The death toll given in the account in Section A1.10 is 68. 


A1.9 Case Histories: Some Principal Incidents 

Two series of case histories are given below. Series A consists 
of case histories chosen according to one or more of the 
following criteria: (1) the incident is well known, generally 
by name; (2) it involved major loss of life and/or property; 
and (3) the physical events and the escalation are of interest. 

Series B consists of case histories of incidents which 
have not been selected for the A series and where in general 
the loss of life or property damage was less, but which are 
considered instructive, particularly in respect of the cause. 


Generally, in the A series mention is made of deaths and 
injuries, but the cost of property damage is not given. 
However, many of the incidents figure in the thirteenth edition 
of Large Property Damage Losses in the Hydrocarbon-Chemical 
Industries. A Thirty Year Review by Marsh and McLennan 
(M&M), edited by Mahoney (1990), which gives the 100 largest 
losses. For these incidents, the cost is shown inTable A1.2. 

A1.10 Case Histories: A Series 

A1 San Antonio, Texas, 1912 

On 18 March 1912 at San Antonio,Texas, workers were car¬ 
rying out repairs on the boiler of a large locomotive. Steam 
pressure was being raised when something went wrong 
and the boiler exploded violently. One 1600 vapour frag¬ 
ment travelled 1200 ft and a 900 vapour one fetched up 
2000 ft away. Twenty-six workers and residents were killed 
and another 32 were injured (J.R. Nash, 1976). 



Figure A 1.2 Hazardous Materials Accident Spill map: propane pipeline release, Ruff Creek, Pennsylvania, 
1977 (National Transportation Safety Board, 1979) 














Table A 1.2 Some major accidents in the process industries 


No. 

Date 

Location 

Plant/ 

Chemical 

Event 

Deaths / 

Cost 

References 




transport 



injuries 

(million 

US$) 


1 

1911 

Glasgow, UK 



DEX 

5d, 8i 


9 

2 


Liverpool, UK 



DEX 

37d, lOOi 


9 

3 


Manchester, UK 



DEX 

3d, 5i 


9 

4 

1912 

San Antonio,TX 

Loco boiler 

Steam 

IE 

26d, 32i 



5 

1913 

Manchester, UK 



DEX 

3d, 5i 


9 

6 

1914 

Chrome, NJ 

Rail tank car 

Chlorine 

TOX 

Od 


3 

7 

1915 Sep. 27 

Ardmore, OK 

Rail tank car 

Petrol 

F 

40d 


10 

8 

1916 Jul. 30 

Black Tom Island, NY 

Barge, rail cars 

Explosives 

HEX 

5d, many injured 



9 

1917 

Ashton, UK 

Chemical works 


HEX 

46d, 120i 



10 

Dec. 6 

Halifax, Nova Scotia 

Ship 

Munitions 

HEX 

1963d, «8000i 



11 

Jan. 19 

Silvertown, UK 

Munitions works 

TNT 

HEX 

69d, fs426i 



12 


Wyandotte, MI 

Storage tank 

Chlorine 

TOX 

Id 


3,7 

13 


Morgan, NJ 


Ammonium nitrate 

ANEX 

64d 


4 

14 

1919 

Cedar Rapids, IA 

Starch plant 

Corn starch 

DEX 

43d 


9 

15 

1920 

Niagara Falls, NY 

Gas cylinder 

Chlorine 

TOX 

3d 



16 

1921 Aug. 24 

Hull, UK 

Airship 

Hydrogen 

EX 



6,8,14 

17 


Kriewald, Germany 

Rail cars 

Ammonium nitrate 

ANEX 



15 

18 

Sep. 21 

Oppau, Germany 

Chemical works 

Ammonium nitrate 

ANEX 

561d 


4,7,11,15 

19 

1924 

Peking,IL 

Starch plant 

Corn starch 

DEX 

42d 


9 

20 

1925 

De Noya, OK 

Gas cylinder 

Chlorine 

TOX 

2d 



21 

1926 Dec. 13 

St Auban, France 

Storage tank 

Chlorine 

TOX 

19d 


1,3,7,10,11 

22 

1928 Jul. 7,13 

Asbokan, NY 

Rail tank car 

Chlorine 

TOX 

Od 



23 

May 20 

Hamburg, Germany 

Storage tank 

Phosgene 

TOX 

lOd 


3,10,11 

24 

1929 May 10 

Syracuse, NY 

Storage tank 

Chlorine 

TOX 

Id 


1,3,7 

25 

1930 

Liverpool, UK 



DEX 

lid, 32i 


9 

26 

1930 Dec. 

Liittich, Belgium 

Fuel plant 

Hydrogen fluoride, 
sulphur dioxide 

TOX 

63d a 


10 

27 

1932 Dec. 

Detroit, MI 

Storage 

LPG 




6 

28 

1933 Feb. 10 

Neunkirchen, Germany 

Gasholder 

Towns gas 

EX 

65d, several 
hundred injured 


10 

29 

1934 May 14 

Hongkong 

Gasholder 

Towns gas 

F 

42d, 46i 


10 

30 

Feb. 28 

Niagara Falls, NY 

Rail tank car 

Chlorine 

TOX 

Od 


7 

31 

1935 Mar. 13 

Griffith, IN 

Rail tank car 

Chlorine 

TOX 

Od 


1,3,7 

32 

1936 Nov. 12 

Johnsonburg, NY 

Pipeline 

Chlorine 

TOX 

Id 


1,3 

33 

1939 Jan. 2 

Newark, NJ 


Butane 

VCE 



6,14 

34 

Dec. 12 

Wichita Falls,TX 

Pipeline 

Oil film 

IE 

Od, li 


15 

35 

Dec. 24 

Zarnesti, Roumania 

Storage tank 

Chlorine 

TOX 

«60d 


1,2,3,7,10,11 

36 

1940Jan.26 

Mjodalen, Norway 

Rail tank car 

Chlorine 

TOX 

3d 


3,7,10 

37 

1941 

Liverpool, UK 



DEX 

6d, 40i 


9 

38 

1942 Jul. 21 

Tessenderloo, Belgium 

Chemical works 

Ammonium nitrate 

ANEX 

>100d 



39 

1943Jan. 18 

Los Angeles, CA 

Road tanker 

Butane 

VCF 

5d 


3,6,7 





Table A1.2 (continued) 


No. 

Date 

Location 

Plant/ 

transport 

Chemical 

Event 

Deaths/ Cost 

injuries (million 

US$) 

References 

40 

Jul. 29 

Ludwigshafen, Germany 

Rail tank car 

Butadiene 

VCE 

57d, 439i 

10,11,14 

41 

1944 Apr. 14 

Bombay, India 

Ship 

Munitions 

EX 

>350,1800i 


42 


Brooklyn, NY 

Gas cylinder 

Chlorine 

TOX 

Od, 208i 


43 

Oct. 20 

Cleveland, OH 

Storage 

LNG 

F 

128d, 200—400i 

3,6,7,8,10,11 

44 

Nov. 21 

Denison, TX 

Tank 

LPG 

F(?) 

lOd 

6,10 

45 

Nov. 27 

Fauld, UK 

Munitions store 

Munitions 

HEX 

68d, 22i 


46 


Kansas City, KS 

Grain dust 

Corn mill 

DEX 

4d, 20i 


47 

Jul. 17 

Port Chicago, CA 

Ships 

Explosives 

EX 

321 


48 

1945 Apr. 25 

Los Angeles, CA 

Storage 

Butane 

VCE 


6,14 

49 

1947 Apr. 28 

Brest, France 

Ship 

Ammonium nitrate 

ANEX 

21d 

4,7 

50 

Feb. 4 

Chicago, IL 

Rail tank car 

Chlorine 

TOX 

Od 

1,3,7 

51 

Feb. 20 

Los Angeles, CA 

Electrolysis plant 

Acetic anhydride, etc. 

EX 

17d, 130i 

10 

52 

Jan. 13 

Natrium,WV 

Gas cylinder 

Chlorine 

TOX 

2d 

10 

53 

Nov. 5 

Rauma, Finland 

Storage tank 

Chlorine 

TOX 

19d 

1,3,7,10,11 

54 

Apr. 16 

Texas City.TX 

Two ships 

Ammonium nitrate 

ANEX 

552d, «3000i 

4,7,11 

55 

1948 July 23 

Ludwigshafen, FRG 

Rail tank car 

Dimethyl ether 

VCE 

207d, «3818i 

5,6,7,8,10, 








11,14,15 

56 

Oct. 13 

Sacramento, CA 

Road tanker 

Butane 

F 

2d 

6 

57 

1949 Dec. 30 

Detroit, IL 

Cat cracker 

Propane, butane 

VCE 

5d 

14 

58 

Sep. 1 

Freeport,TX 

Pipeline 

Chlorine 

TOX 

Od 

7 

59 


Nitro,WV 

Reactor 

TCDD 

TOX 

228i 

10 

60 

Jun. 

Perth, NJ 

Storage tank 

HCs 

EX 

4d 

6 

61 

Oct. 

Winthrop, MO 

Rail tank car 

LPG 

F(?) 

Id 

6 

62 

1950 Jul. 20 

Billingham, UK 

Rail tank car 

Chlorine 

TOX 

Od 


63 

Feb. 16 

Midland, MI 

Synthetic rubber plant 

Butadiene, styrene 

VEEB 


8 

64 


Poza Rica, Mexico 

Plant 

Hydrogen sulphide 

TOX 

22d, 320i 

10 

65 

Aug. 

Wray, CO 

Road tanker 

Propane 

VCF 

2d 

6 

66 

1951 Sep. 7 

Avonmouth, Bristol, UK 

Storage tank 

Oil 

EX, F 

2d 


67 

Aug. 16 

Baton Rouge, LA 

Naphtha treating 

HCs 

VCE 

2d 

14 

68 

Jul. 7 

Port Newark, NJ 

Storage 

Propane 

VCF, BLEVE 

Od, 14i 

8,10,15 

69 

Feb. 8 

St Paul, MN 

Loading terminal 

LPG 

VEEB 

14d 

10 

70 

1952 Jul. 21 

Bakersfield, CA 

Storage 

Butane 

VCE 

Od 

6,8,10,15 

71 

Dec. 22 

Bound Brook, NJ 

Phenolic resin plant 

Resin dust 

DEX 

5d, 21i 

15 

72 

Jul. 24 

Kansas City, KS 

Loading terminal 

LPG 

VCE 


6,14 

73 

Apr. 4 

Walsum, FRG 

Storage tank 

Chlorine 

TOX 

7d 

1,3,7,10 

74 

1953 Aug. 6 

Campana, Argentina 

Refinery recovery unit 

Gasoline 

VCE 

2d 

14 

75 

Sep. 23 

Tonawanda, NY 

Organic peroxides plant 

Organic peroxides 

EX 

lid, 27i 

10 

76 

1954 Jun. 25 

Montreal, Quebec 

Gas cylinder 

Chlorine 

TOX 

Id 


77 

Oct. 18 

Portland, OR 

Rail tank car 

LPG 

VCE 

Od 

6,14 

78 

Jun. 4 

Institute,WV 

Rail tank car 

Acrolein 

IE 


6,14 

79 

1955 Jul. 14 

Freeport,TX 

Polyethylene plant 

Ethylene 

VCE 


14 


CD 

H 

O 

ZD 


(D 





80 Jul. 19 

81 
82 

83 Aug. 27 

84 Jul. 22 

85 1956 Jul. 29 

86 Jul. 26 

87 Aug. 7 

88 Oct. 22 

89 Jul. 29 

90 Mar. 10 

91 Dec. 19 

92 Jan.18 

93 1957 Jan. 8 

94 Apr. 16 

95 Oct. 24 

96 1958 Apr. 15 

97 Jul. 30 

98 Jan. 3 

99 Jan. 22 

100 May 22 

101 1959 Jun. 2 

102 May 28 

103 Jun. 28 

104 

105 Feb. 27 

106 

107 Jul. 11 

108 1960 Dec. 17 

109 Oct. 14 

110 1961 Feb. 23 

111 Dec. 17 

112 

113 Jan. 31 

114 

115 Aug. 

116 

117 1962 Jul. 25 

118 Nov. 30 

119 Apr. 17 


Ludwigshafen, FRG 
Runcorn, UK 
Waynesboro, GA 
Whiting, IN 
Wilmington, CA (sic) 
Amarillo,TX 
Baton Rouge, LA 
Cali, Columbia 
Cottage Grove, OR 
Dumas, TX 
Lake Charles, LA 
North Tonawanda, NY 
Uskmouth, Wales 
Montreal, Quebec 
Nitro,WV 
Sacramento, CA 
Ardmore, OK 
Augusta, GA 
Celle, FRG 
Niagara Falls, NY 
Signal Hill, CA 

Deer Lake, PA 
McKittrick, CA 
Meldrin, GA 

Phillipsburg, NJ 
Portland, OR 
Roseburg, OR 
Ube, Japan 
Freeport,TX 

Kingsport, TN 
Billingham, UK 
Freeport,TX 
FRG 

La Barre, LA 

Lake Charles. LA 
Minimata, Japan 
Morganza, LA 
Berlin, NY 
Cornwall, Ont. 

Doe Run, KY 


Rail tank car 

Feed plant 
Hydroformer 
Gasoline plant 
Storage tanks 
Alkylation unit 
Road vehicle 
Storage 
Storage vessel 
Storage tank 
Polyethylene plant 
Turbogenerator 
Storage vessel 
Chlorination vessel 
Loading terminal 
Loading terminal 
Loading terminal 
Rail tank car 
Rail tank car 
Tank farm 

Rail tank car 
Storage 
Rail tank car 

Compressor 
Road tanker 

Ammonia plant 


Nitrobenzene plant 
Pipeline 

Caprolactam plant 
Air separation plant 
Rail tank car 

Alkylation unit 
Reactor 

Road tanker 
Rail tank car 
Feed vessel 


BLEVE 

Chlorine TOX 

Grain dust DEX 

Naphtha DET 

Butane VCE 

Oil FB 

Butylene VCE 

Dynamite, munitions HEX 
LPG BLEVE 

HC BLEVE 

Chlorine TOX 

Ethylene VCE 

Steam IE 

Butane BLEVE 

Chlorine TOX 

LPG VCE 

Propane VCE 

LPG VCE 

EX 

Nitromethane DET 

Oil froth F 

BLEVE 

LPG BLEVE 

LPG BLEVE 

LPG VCE 


2i 


3d, 13i 
2d, 40i 

20d, >32i 

«1200d 
12d, 12i 
19d, 32i 
Od 
Od 

2d, 9i 
Id 
8d 
Id 

Id 

200i 
2d, 18i 

lid, lOi 
2i 

23d 


Lube and seal oil 
LPG 

Oxygen 
Allyl chloride, 
propylene chloride 
Reaction mixture 
Chlorine 
Cyclohexane 
Oxygen 
Chlorine 

Butane 

VCM 

Chlorine 

LPG 

Chlorine 

Ethylene oxide 


EX 6d,6i 

REL 

ANEX 13d 

IE lid, 40i 

EX 6d, 14i 

DET 15d, 60i 

TOX Od 

VCE Id 

EX 15d 

TOX Id, 114i 

VCE 2d 

VEEB 4d, lOi 

TOX Od, 17i 

VCE lOd, 17i 

TOX 89i 

IE, VCE Id, 21i 


10 

7.10.14 
5,6 

6,10 

10 

6.14 

6,14 

6.14 

5,10 

42.9 5,10,13,15 

10 

10 

3,5,6,7,9, 

10.11.14 


39.0 


20.2 


10 

6 

10,13 

3 

8.10.14 
10 

1, 2,3,5,7, 
10,11 
14 
10 
10 

3.6.7.9.10.14 
1,7,10 

5,6,7,8,10, 

13,14,15 



Table A1.2 (continued) 


No. 

Date 

Location 

Plant/ 

transport 

120 


Fawley, UK 

Cat cracker 

121 


FRG 

Reactor 

122 


Houston, TX 

Tank farm 

123 

Apr. 27 

Marietta, OH 

Phenol plant 

124 

Aug. 4 

RasTanura, Saudi Arabia 

Storage vessel 

125 


St Louis, MO 

Feed plant 

126 

May 10 

Toledo, OH 

Reactor 

127 

1963 Mar. 6 

Amsterdam, Netherlands 

Trichlorophenol plant 

128 

Apr. 28 

Brandtsville, PA 

Rail tank car 

129 


FRG 

Acetylene plant 

130 

Apr. 3 

Norwich, CT 

Transport tank 

131 

Aug. 9 

Philadelphia, PA 

Rail tank car 

132 

May 3 

Plaquemine, LA 

Ethylene plant 

133 


Texas 


134 

1964 Jun. 4 

Antwerp, Belgium 

Reactor 

135 

Jan. 1 

Attleboro, MA 

Reactor 

136 

Jul.17 

FRG 

Oxygen plant 

137 


FRG 

Reactor 

138 


FRG 

Reactor 

139 


Hebronville, MA 

PVC plant 

140 

Jan. 9 

Jackass Flats, NV 

Research laboratory 

141 

Oct. 25 

Liberal KS 

Compressor station 

142 

Jul.2 

Mobile, AL 

Pipeline 

143 

Jun. 16 

Niigata. Japan 

Refinery 

144 

Oct. 25 

Orange, TX 

Polyethylene plant 

145 


Paisley, UK 


146 

1965 Dec. 23 

Baltimore, MD 

Detergents plant 

147 

Sep. 12 

Baton Rouge, LA 

Tankship 

148 

Jul. 31 

Baton Rouge, LA 

Reactor 

149 

Aug. 7 

Bow. London. UK 

Flour mill 

150 

Oct. 24 

Escambia. USA 

Chemical plant 

151 


Houston,TX 

Ethyl chloride plant 

152 

Jul. 13 

Lake Charles, LA 

Ethylene plant 

153 

Aug. 25 

Louisville, KY 

Compressor 

154 

Mar. 4 

Natchitotehes, LA 

Pipeline 

155 


Pasadena,TX 

Ammonia plant 

156 


Texas 

Chemical plant 

157 


Whiting, IN 

Reformer 


Chemical Event Deaths / Cost References 

injuries (million 
US$) 


p-Nitrodiphenylamine 
Gasoline 
Benzene 
Propane 
Grain dust 
Acrylic polymer 
reaction 

Reaction mixture, 
including TCDD 
Chlorine 

Acetylene, diacetylene 

Organic peroxides 

Chlorine 

Ethylene 

Propylene 

Ethylene oxide 

VCM 

Oxygen 

Acrylamide reaction 
mixture 

Reaction mixture 

Hydrogen 

Propane 

Chlorine 

HCs 

Ethylene 

Benzene 
Chlorine 
Ethyl chloride 
Flour 

Hydrogen, carbon 
monoxide 
Ethyl chloride 
Methane or ethylene 
Monovinyl acetylene 
Natural gas 
Hydrogen, ammonia 
Butane 
Naphtha 


VCE 

IE 2d, 18i 

VCE 2d 

EX Id, 3i 

VCE, F Id, 115i 

DEX 2d. 34i 

VEEB lOd, 46i 

IE,TOX 8d, 14i 

TOX Od 

IE 7d,6i 

EX 4d,4i 

TOX 430+i 

VCE 7i 

IE 

IE 4d, 20i 

VEEB 7d,40i 

IE 

IE Id, 3i 

IE 3i 

IE 

VCE 

VCE 

TOX Id 

EQK, F, EX 2d 
VCE 2d 

DEX 5d, 2i 

VCE 
TOX 

DEX 5d, 32i 

VCE 

EX 12d 

VCE 

IE 12d, 60i 

IE 17d,9i 

F 2d, 3i 

F(?) 

EX 


14 

10 

14 

20.2 8,10,13 

6.10.14 

10 

10 

1.3.7.10 
10 

10 

1.10 

16.2 6,7,10,13,14 
5 

6.7.10 

19.9 8,10,13,15 

10 
10 

10 

5 

6.8.10.14 
14 

7 

87.3 13 

6.14 

9 
14 

10 

6.14 

9.15 

6.10 

10 

6,14 

39.2 10,13,15 

5,7,8,10 
10 

6 
10 


cn 

H 

o 

ID 


CO 





158 1966 Jan. 4 

159 

160 

161 Oct. 16 

162 Jun. 14 

163 May 23 

164 Jan. 19 

165 Feb. 6 

166 1967 

167 

168 

169 Dec. 19 

170 

171 Aug. 8 

172 Nov. 8 

173 

174 Jan. 20 

175 1968 

176 Jan. 1 

177 

178 

179 Aug. 21 

180 

181 Jan. 21 

182 

183 Dec. 

184 1969 Dec. 23 

185 May 8 

186 Feb. 18 

187 Jul. 17 

188 Oct. 1 

189 Dec. 28 

190 Aug. 12 

191 Sep. 11 

192 Sep. 9 

193 Jan. 25 

194 


Feyzin, France 
FRG 

Larose, LA 
LaSalle, Quebec 
La Spezia, Italy 
Philadelphia, PA 

Raunheim, FRG b 
Scotts Bluff, LA 
Antwerp, Belgium 
Bankstown, Australia 
Buenos Aires 
El Segundo, CA 
Hawthorne, NJ 
Lake Charles, LA 

Newton, AL 
Santos, Brazil 
Sacramento, CA 

Bolsover, UK 
Dunreith, IN 

GDR 
Hull, UK 
Lievin, France 
Paris, France 
Pernis, Netherlands 

Tamytown, USA 
Yutan, NE 
Basle, Switzerland 

Cleveland, OH 
Crete, NE 
Dudgeons Wharf, 
London, UK 
Escombreras, Spain 
Fawley, UK 
Flemington, NJ 
Glendora, MS 
Houston, TX 
Laurel, MS 
Long Beach, CA 


Storage vessels 

Storage vessel 
Pipeline 
Reactor 
Rail tank car 
Refinery 

Ethylene plant 
Reactor 


Fuel oil reservoir 
Alkylation unit 

Rail tank car 
Gas holder 
Saturn rocket 

Reactor 
Rail tank car 


Road tanker 
Petrochemical plant 
Slops tanks 

Chemical plant 

Pipeline 

Reactor 

1-ton containers 
Rail tank car 
Tank dismantling 

Storage 

Hydroformer 

Reactors 

Rail tank car 

Pipeline 

Rail tank car 

Tank 


Propane 

BLEVE 

18d, 81i 

68.8 

5,6,8,10,11, 
13,15 

Light HCS 

NGL 

F 

7d 


5 

Styrene 

VEEB 

lid,lOi 

11.4 

5,8,10,13,15 

Chlorine 

TOX 

Od 


3 

Benzene, cumene, 

VCF 



6,10 

propane 

Methane, ethylene 

VCE 

3d, 83i 

26.6 

5,6,8,10,13,14 

Butadiene 

VCE 

3d 


6,14 

VCM 

F 

4d, 33i 


5,10 

Chlorine 

TOX 

5i 


5 

Propane 

F 

10 Oi 


5,10 

Fuel oil 

F 


13.5 

13 


EX 

2d, lli 


5 

Isobutylene 

VCE 

7d,13i 

63.1 

3,5,6,7,8, 

10,13,14,15 

Chlorine 

TOX 

Od 


1, 3,10 

Towns gas 

IE 

300i 


5,10 

Hydrogen, 

VCE 



8 

oxygen fuel 

Reaction mixture, 

TOX 

79i 


10 

including TCDD 
(1) VCM 

F, EX 

5i 


10 

(2) Ethylene oxide 

BLEVE 




VCM 

24d 



5,10 

Acetic acid 

IE 

2d, 13i 


3,5,10 

Ammonia 

TOX 

5d, 20i 


5,7,9,10 


IE 



5 

Oil slops 

VCE 

2d, 85i 

97.7 

3,5,6,7,8, 

10,13,14,15 

Propane 

EX 

Id, 2i 


5,10 

LPG 

F 

5d 


6,10 

Dinitrochloraniline 

IE 

3d, 31i 


5,10 

reaction mixture 
Chlorine 

TOX 

Id 



Ammonia 

TOX 

9d, 53i 


3,5,7,9,10 

EX 

6d 

10 



Propane 

VCE 

4d, 3i 


5,14 

Hydrogen, naphtha 

VCE 

Od 


6,8,10,14 

VCM 

EX 


14 

13 

VCM 

TOX, VCE 

li 


6,10 

Natural gas 

VCE 

9i 


2,10,14 

LPG 

BLEVE 

2d, 33+i 


2,14 

Petroleum 

IE 

Id, 83i 


5,10 



Table A 1.2 (continued) 


No. Date 


195 Mar. 6 

196 

197 Oct. 23 

198 May 14 

199 Jan. 21 

200 1970 

201 Sep. 7 

202 Jan.21 

203 Feb. 6 

204 Nov. 16 

205 May 30 

206 Aug. 30 

207 Jun. 21 

208 Nov. 12 

209 Oct. 19 

210 Sep. 3 

211 

212 Dec. 5 

213 

214 

215 Dec. 10 


216 

217 1971 Jul. 10 

218 Jan. 19 

219 Apr. 24 

220 Jun. 5 

221 Aug. 8 

222 Oct. 19 

223 Sep. 15 

224 Aug. 21 

225 Dec. 23 

226 Feb. 25 

227 Nov. 7 

228 

229 Sep. 11 


Location 


Puerto La Cruz, Venezuela 
Repesa, Spain 
Texas City.TX 
Wilton, UK 
Wilton, UK 
Aghajari, Iran 
Beaumont,TX 
Belle, WV 
Big Springs, TX 
Blair, NE 
Brooklyn, NY 
Corpus Christi,TX 
Crescent City, IL 

Hudson, OH 
Javle, Sweden 
Jacksonville, MD 
Kiel, FRG 
Linden, NJ 
Mitcham, UK 
Philadelphia, PA 
Port Hudson, MO 


St Thomas Island, 

Virgin Islands 
Amsterdam, Netherlands 
Baton Rouge, LA 
Emmerich, FRG 

Floral, AR 
Gretna, FL 
Houston,TX 
Houston, TX 
La Spezia, Italy 
Lake Charles, LA 

Longview,TX 
Morris, IL 

Netherlands 
Pensacola, FL 


PlantI 
transport 


Crude unit 
Refinery 

Butadiene recovery 
Oxidation plant 
Polyethlene plant 
Compressor station 

Rail tank car 
Alkylation unit 
Storage tank 
Road tanker 
Cat cracker 
Rail tank car 

Road tanker 
Pipeline 
Pipeline 
Grain silo 
Refinery reactor 

Cat cracker 
Pipeline 


Refinery 
Rail tank car 
Oxidation plant 

Pipeline 
Road tanker 
Rail tank car 
Butadiene plant 
Storage tank 
Chemical plant 

Polyethylene plant 
Ethylene oxide plant 


Caprolactam plant 


Chemical 




Deaths/ 
injuries 


Cost 

(million 

US$) 


References 


HCs 

F 


15.6 

13 

LPG, propylene 

F 

Od 


5,10 

Butadiene 

IE,VCE 

3i 

26.6 

10,13,14,15 

Cyclohexane 

VCE 

2d, 23i 


5,6,8,10 

Ethylene 

IE 

4d 



Gas 

EX 

29d, lOi 



Oil 

F 


20.2 

10,13 

Ammonia 

TOX 

li 


7,9,10 


VCE 



14 

Ammonia 

TOX 

Od 


3,7,10 

Oxygen 

F 

2d, 30i 


12,15 


HUR 


23.0 

13 

Propane 

BLEVE 

66i 


2,5,6,8,10, 
11,15 

LPG 

F 

6d 


6,10 

Chlorine 

TOX 

Od 



Grain dust 

DEX 

6d, 18i 



CioHC 

VCE 

40i 

84.5 

6,10,13,14 

LPG 

IE 



5,10 


F(?) 

7d,42i 


5,10 

Propane 

VCE 

lOi 


2,3,5,6,7, 
8,9,10,11, 
14,15 

Natural gas 

IE 

25i 


5,10 

Butadiene 

EX 

8d, 21i 


10 

Ethylene 

VCE 

Od, 21i 


6,10,14,15 

Formic acid, hydrogen 

F, IE 

Id, many 


5 

peroxide 


injured 



Ammonia 

TOX 

Od 


3,5,10,11 

Methyl bromide 

TOX 

4d 


12 

VCM 

BLEVE 

Id, 5i 


2,8,10,12 

Butadiene 

VCE 

Id, 6i 


6,10,14 

LNG 

Rollover 

Od 



Trichlorethylene, 

VCF(?) 

4d, 3i 


10 

perchlorethylene 

Ethylene 

VCE 

4d,60i 

16.5 

6,8,10,13,14 

Ethylene oxide, 

IE 

4i 

16.2 

10,13 

oxygen 

Butadiene 


8d, 21i 


5 

Cyclohexane 

REL 

Od 


2,3,8,10 





230 Jul. 19 

232 Jun. 4 

233 1972 Aug. 14 

234 Feb. 29 

235 Oct. 22 

236 May 14 

237 Mar. 9 

238 

239 Sep. 21 

240 

241 Feb. 9 

242 Aug. 4 

243 

244 

245 1973 Feb. 22 

246 May 24 

247 May 23 

248 Dec. 27 

249 Sep. 6 

250 Oct. 8 

251 Jul. 5 

253 Mar. 5 

254 Dec. 6 

255 Oct. 28 

256 Jul. 13 

257 Oct. 24 

258 Feb. 1 

259 Aug. 24 

260 Oct. 28 

261 Feb. 10 

262 Jul. 8 

263 Nov. 6 

264 1974 Jan. 17 

265 Sep. 5 

266 Jun. 9 

267 Nov 29 

268 Apr. 17 

269 Apr. 26 

270 Jun. 26 


Raunheim, FRG 
Texas 
Waco, GA 
Billings, MT 
Delaware City, DE 

East St Louis, IL 

Hearne,TX 
Lynchburg, VA 
Netherlands 
NJ Turnpike, NJ 
Rio de Janeiro, Brazil 
Tewksbury, MA 
Trieste, Italy 
Weirton,WV 
Yokkaidi, Japan 
Austin,TX 

Benson, AR 
Cologne, FRG 
Freeport,TX 
Gladbeck, FRG 
Goi, Japan 
Kingman, AZ 
Lodi, NJ 
Loos, BC 
McPherson, KS 
Noatsu, Japan 
Potchefstroom, 

South Africa 
Sheffield 

St-Amand-les-Eaux 
St Croix, Virgin Islands 
Shinetsu, Japan 
Staten Island, NY 
Tokuyama, Japan 
Ventura County, CA 
Aberdeen, UK 
Barcelona, Spain 

Bealeton.VA 
Beaumont,TX 
Bielefeld, FRG 
Chicago, IL 
Climax, TX 


Tankship 
Chemical plant 
Road vehicle 
Alkylation unit 
Fluid coking unit 

Rail tank car 

Pipeline 
Road tanker 

Road tanker 
Storage vessel 
Storage tank 
Terminal 
Coke plant 
Chemical plant 
Pipeline 

Rail cars 
PVC plant 
Tank 

Oxidation plant 
Polypropylene plant 
Rail tank car 
Reactor 
Rail tank car 
Pipeline 

Vinyl chloride plant 
Storage vessel 

Gas works 
Road tanker 
Hydrodesulphurizer 
Chemical plant 
Storage tank 
Ethylene plant reactor 
Rail tank car 
Road tanker 
Chemical plant 

Pipeline 
Isoprene plant 

Storage tank 
Rail tank car 


Petroleum 

F, EX 

7d 

Ethylene 

VCE 

3d 

Explosives 

HEX 

5d, 33i 

Butane 

VCF 

Id, 4i 

Hot oil 

Hot oil 


Propylene 

damage 

VCE 

Id, 230i 

Crude oil 

F 

Id, 2i 

Propane 

FB 

2d, 5i 

Hydrogen 

IE 

4d,4i 

Propane 

F 

2d, 28i 

Butane 

BLEVE 

37d, 53+i 


F 

2d, 21i 

Crude oil 

F 


EX 


21d, 20i 

TOX 


76d, 978i 

NGL 

VCE 

6d, many 

Munitions 

HEX 

injured 

VCM 

EX 

4d, 2i 

Ethylene oxide 

VCF 

29i 

Cumene, etc. 

F 


Hexane, propylene 

VEEB 

4d 

Propane 

BLEVE 

13d, 95i 

Methanol 

VCF 

7d 

Chlorine 

TOX 

Od 

Ammonia 

TOX 

Od 

VCM 

VCE 

Id 

Ammonia 

TOX 

18d, 65i 

Towns gas 

EX 

4d, 24i 

Propane 

VCE 

9d, 37i 

Hydrogen, HCs 

F 


VCM 

VCE 

Id, 23i 

LNG residues 

F 

40d 

Ethylene 

VCE 

Id, 4i 

LPG 

REL 

2d, 4i 

VCM, ethylene 

FB 

VCF 


dichloride 

Gas 

F 

Od 

Isoprene 

VCE 

2d, lOi 

Silicon tetrachloride 

BLEVE 

TOX 

Od 

VCM 

VCE 

7d 


14.0 

16.9 


13.4 

29.7 


28.4 


40.0 


36.6 


10 

12 

6,10,13 
13 

2,3,5,6,8, 
10,12,14 
2,6,10,12 

2.3.6.10.12 
5 

2.3.10.12 

5.6.10.13 

13 

5,10 

10 

3,6,9,10,12 


2 . 5.10 
10 

5.10 

13.14 

10,11 

5.10 

3.10 

3.10 
14 

3,5,10, 

11.15 
5,10,11 

5,8,10,12 
13 

5.6.8.10 

10.11.15 
5,10,13,14 

12.15 
11 

6.10 


13,14 


2,3,6,10,12,14 



Table A1.2 (continued) 


No. 

Date 

Location 

Plant/ 

transport 

Chemical 

271 

Jul.7 

Cologne, FRG 

Vinyl chloride plant 

VCM 

272 

Jul. 19 

Decatur, IL 

Rail tank car 

Isobutane 

273 

Aug. 30 

Fawley, UK 

Polyethylene plant 

Ethylene 

274 

Jun.l 

Flixborough, UK 

Caprolactam plant 

Cyclohexane 

275 

Sep. 13 

Griffith, IN 

Cavern storage 

Propane 

276 

Jan. 4 

Holly Hill, FL 

Road tanker 

Propane 

277 

Sep. 21 

Houston, TX 

Rail tank car 

Butadiene 

278 

Aug. 17 

Los Angeles, CA 

Loading terminal 

Organic peroxides 

279 

Mar. 2 

Munroe, LA 

Pipeline 

Natural gas 

280 

Feb. 6 

Omaha, NE 

Chlorine vaporizer 

Chlorine 

281 

Feb. 12 

Oneonta, NY 

Rail tank car 

LPG 

282 

Aug. 25 

Petal, MO 

Salt dome storage 

Butane 

283 

Jul. 18 

Plaquemine, LA 

Cracking plant 

Propylene 

284 


Rotterdam, Netherlands 

Petrochemicals plant 

HC 

285 


Pitesti. Roumania c 

Ethylene plant 

Ethylene 

286 


Texas 

Chemical plant 

Pentanes 

287 

Aug. 6 

Wenatchee,WA 

Rail tank car 

Monomethylamine 

288 

Jan.11 

West St Paul, MN 

Storage vessel 

LPG 16 

289 

Jul. 21 

Zaluzi, Czechslovakia 

Ethylene plant 

Ethylene 

290 

1975 Feb. 10 

Antwerp, Belgium 

Polyethylene plant 

Ethylene 

291 

Mar. 16 

Avon, CA 

Refinery 

Oil 

292 

Nov. 7 

Beek, Netherlands 

Petrochemical plant 

Propylene 

293 

Nov. 21 

Cologne, FRG 

Cyclic hydroformer 

Hydrogen, naphtha 

294 


Deer Park,TX 

Polyethylene plant 

Ethylene 

295 

Sep. 1 

Des Moines, IA 

Rail tank car 

LPG 

296 

May 13 

Devers.TX 

Pipeline 

LPG 

297 

Apr. 30 

Eagle Pass.TX 

Road tanker 

LPG 

298 

Aug. 31 

Gadsden, AL 

Tank farm 

Gasoline 

299 

Apr. 5 

Ilford, UK 

Electrolysis plant 

Hydrogen, oxygen 

300 

Jan. 17 

Lima, OH 

Terminal 

Crude oil 

301 


Louisiana 


Propane 

302 

Jan. 31 

Marcus Hook, PA 

Oil tanker, tankship 

Oil, phenol 

303 


Marseilles, France 



304 

Dec. 14 

Niagara Falls, NY 

Road tanker 

Chlorine 

305 

Aug. 17 

Philadelphia, PA 

Tank farm 

Crude oil vapours 

306 

Aug. 2 

Romulus, MI 

Pipeline 

REL 

307 

Sep. 5 

Rosendaal, Netherlands 


Gasoline 


Event 


Deaths/ 
injuries 


Cost 

(million 

US$) 


References 


VCE 

VCE 7d, 152i 

VCE 

VCE 28d, 104i 

F Od 

VCE Od 

VCE Id, 235i 

EX Od 

EX, F Od 

TOX 

BLEVE 25i 

VCE 24i 

VCF(?) 

F 

VCE »100d 

VCE 2d 

DET 2d, 113i 


14 

2,6,9,10,11, 

12.14 
14 

412.2 2,3,5,6,8, 

10.11.13.14.15 

6,10 

5.6.10.14 

6.10.12.14 

5.10.15 


O 

33 

w 


BLEVE 4d,6i 

VCE 14d, 79i 

VCE 6d, 13i 

F 

VCE 14d, 107i 

VCE Od 

VCF ld,4i 

BLEVE 3i 

F 4d 

FB 17d, 34i 

‘BLEVE’ 4d, 28i 

EX Id, 3i 

F 

REL 

F 

IE Id, 3i 

TOX 4d, 80i 

VCF, EX 8d, 2i 


10 

5.6.10.14 

57.8 3,5,6,8, 

10.13.14 
21.2 13 

46.7 3,5,6,8, 

10,11,13,14,15 

6.14 
10 

9,10,12 

10.12.14 
10 

10 


16.0 13 

5 
10 

26.5 5,10,13 


VCE 





308 Nov. 4 

309 Dec. 4 

310 

311 Sep. 3 

312 Dec. 2 

313 1976 Dec. 10 

314 Nov 26 

315 Aug. 12 

316 May 7 

317 Aug. 31 

318 May 24 

319 Sep. 2 

320 May 11 

321 Jun. 27 

322 Aug. 6 

323 Jan. 16 

324 Oct. 15 

325 Jun. 16 

326 Dec. 17 

327 Sep. 26 

328 

329 Aug. 30 

330 Dec. 7 

332 Jul. 10 

333 Feb. 

334 Sep. 11 

335 1977 May 11 

336 Jun.4 

337 Feb. 2 

338 Oct. 17 

339 Jan. 27 

340 Sep. 24 

341 Jan. 4 

342 Dec. 8 

344 Feb. 20 

345 Jul. 8 

346 

347 

348 Dec. 28 

349 


Scunthorpe, UK 
Seattle,WA 
South Africa 
Texas City, TX 
Watson, CA 
Baton Rouge, LA 
Belt, MT 
Chalmette, LA 
Enid, OK 
Gadsden, AL 
Geismar, LA 
Haltern, FRG 
Houston, TX 
Kings Lynn 

Lake Charles, LA 
Landskrona, Sweden 
Rene 16 
Longview, TX 
Los Angeles, CA 
Los Angeles, CA 
Sansinena 
Manfredonia, Italy 
Puerto Rico 
Plaquemine, LA 
Robstown,TX 
Sandefjord, Norway 
Seveso 

Texas 

Westoning, UK 
Abqaiq, Saudi Arabia 
Abqaiq, Saudi Arabia 
Baton Rouge, LA 
Baton Rouge. LA 
Baytown,TX 
Beattyville, KY 
Braehead, Renfrew, UK 
Brindisi, Italy 
Cassino, Italy 
Dallas, TX 
Fairbanks, AK 
Galveston, TX 
Gela, Italy 
Goldonna, LA 


Hot metal ladle 
Road tanker 

Pipeline 
Hydrogen plant 
Storage vessel 
Rail tank car 
Refinery 
Pipeline 

Reactor 
Storage vessel 
Road tanker 
Reactor 

Refinery 

Loading terminal 

Ethanol plant 

Pipeline 

Terminal 

Absorption column 
Storage 
Surge tank 
Compressor station 

Reactor 

Pipeline 
Road tanker 
Pipeline 
NGL plant 
Chemical works 
Preheat furnace 
Tanker 
Road tanker 
Warehouse 
Ethylene plant 

Rail tank car 
Pipeline 
Grain silo 

Rail tank car 


Hot metal, water 

EX 

lid, 15i 

10 


F 


10 

Methane 

F 

7d,7i 

5,10 

Ammonia 

TOX 


10 

Hydrogen 

VCE 


14 

Chlorine 

TOX 

3i 

5,10,11,15 

LPG 

BLEVE 

22i 

10,12 

Ethyl benzene 

EX 

13d, 2i 

10 

Ammonia 

TOX 


10 


FB 

3d, 28i 

10 

Ethylene oxide, etc. 

IE 

56i 17.3 

10,13 

Carbon dioxide 

TOX 


12 

Ammonia 

TOX 

6d, 178i 

9,10,11,12 

Feed additive reaction 

IE 

Id 

10,15 

mixture 




Isobutane 

VCE 

7d 

10 

Ammonia 

TOX 

2d 

9,10 

Ethylene 

VCE 

Id 

14 

Gasoline 

VCE 

9d, many injured 

8,10,12,15 

Crude oil 

EX 

23.2 

13 


Arsenic compounds, etc. TOX 

Pentanes VCF 

Oil IE 

Natural gas VEEB 

Flammable liquid IE 

Trichlorphenol reaction IE 

mixture, including TCDD 
Ethylene VCF 

Petrol EX 

Crude oil F 

Fuel gas VCF 

Chlorine TOX 

Oil EX 

Gasoline VCE 

Gasoline F 

Sodium chlorate EX 

Light HCs VCE 

LPG IE 

Isobutane VCE 

Crude oil F 

Grain dust DEX 

Ethylene oxide, glycol IE 

LPG FB 

Hydrogen IE 


30i 

Id 

6d 


0d (d) 

Id, 15i 
3i 


lOi 

3d 

7d, 6i 
13i 

3d, 22i 
Id, 9i 
li 
Id 
15d 
Id, li 
2d, 9i 
20i 


10 

6 

23.2 13 

23.2 13 

5 

5,10,11,15 

6 
8 

99.2 13 

19.3 13,14 
10 

17.0 13 

14 
12 
5,10 

51.5 5,10,13,14 

5 

6,10,14 

72.1 10,13 

10,11 
5,10 
10,12 
5 



Table A1.2 (continued) 


No. 

Date 

Location 

Plant/ 

transport 

350 


Jacksonville, USA 


351 


Mexico 


352 


Mexico 


353 

Dec. 10 

Pasacabolo, Columbia 

Fertiliser plant 

354 

Nov. 9 

Pensacola, FL 

Rail tank car 

355 

Mar. 18 

Port Arthur,TX 

Stabilizer unit 

356 

Jun. 19 

Puebla, Mexico 


357 

Sep. 24 

Romeoville, IL 

Tank farm 

358 

Juf. 20 

Ruff Creek, PA 

Pipeline 

359 


Taiwan 


360 

Apr. 3 

Umm Said, Qatar 

Gas plant 

361 


Westwego, LA 

Grain silo 

362 

1978 Apr. 15 

Abqaiq. Saudi Arabia 

Gas plant 

363 


Baltimore, MD 

Sulphur trioxide 

364 


Chicago, IL 

Loading terminal 

365 

Jan. 12 

Conway, KS 

Pumping station 

366 

Oct. 3 

Denver, CO 

Cat polymerization unit 

367 

Aug. 4 

Donnellson, IA 

Pipeline 

368 

Sep. 16 

Immingham, UK 

Ammonia plant 

369 

May 29 

Lewisville, AR 

Rail tank car 

370 


Mexico City, Mexico 

Road tanker 

371 

Sep. 27 

Oviedo Province, Spain 

Rail tank car 

372 

Oct. 30 

Pitesti, Roumania 

Gas concentration unit 

373 

Feb.11 

PobladoTines, Mexico 

Pipeline 

374 


St Marys,WV 

Cooling tower 

375 

Jut 11 

San Carlos, Spain 

Road tanker 

376 

May 30 

Texas City,TX 

Storage vessel 

377 

Jul. 16 

Tula, Mexico 

Road tanker 

378 

Feb. 24 

Waverly,TN 

Rail tank car 

379 

Jul. 15 

Xilatopic, Mexico 

Road tanker 

380 

Feb. 26 

Youngstown, FL 

Rail tank car 

381 

1979 Jan. 8 

Bantry Bay, Eire 

Oil tanker 

382 

Jul. 18 

Bayonne, NJ 

Rail tank car 

383 

Feb. 6 

Bremen, FRG 

Flour mill 

384 

Jan. 6 

Burghausen, FRG 

Chemical plant 

385 

Oct. 6 

Cove Point, MD 

Pipeline 

386 

Apr. 8 

Crestview, FL 

Rail tank cars 

387 

Sep. 1 

Deer Park, TX 

Tankship Chevron Hawaii 

388 


Galveston Bay,TX 

Oil tanker 

389 

Dec. 11 

Geelong, Australia 

Crude unit 


Chemical 


Event 


Deaths I 
injuries 


References 


LPG 

Ammonia 

VCM 

Ammonia, etc. 

Ammonia 

Propane 

Diesel fuel, gasoline 

Propane 

VCM 

LPG 

Grain dust 

(1) Methane, (2) LPG 

Hydrogen sulphide 

LPG 

Propane 

LPG 

Syngas 

VCM 

Propylene 

Gasoline 

Propane, propylene 
Natural gas 


Propylene 

LPG 

Butane 

Propane 

Butane 

Chlorine 

Crude oil 

Chlorine 

Flour 

Hydrogen sulphide 

LNG 

HMs 

Distillate 

Crude oil 

Oil 


Cost 

(million 

US$) 


F 5 

TOX 2d, 102i 10 


TOX.VCE 

TOX 

VCE 

VCF 

F 

VCF 

F 

F 

DEX 

(1) F, (2) VCE 

TOX 

TOX 

EX 

VCE 

FB 

VCE 

FB 

F 

EX, F 
VCE 
VCE 

Structural 

collapse 

VCF 

BLEVE 

EX 

BLEVE 

VCF 

TOX 


DEX 

TOX 

VEEB 

TOX 

EX 

EX 

F 


30d, 22i 
4d 

14.6 

2d 

6d, lOi 

7d, 13+i 139 

36d, lOi 

90.8 
lOOi 
8d, 29i 

3d 37.1 

3d, 2i 

2i 

12d 

7d 

40d 

51d 


5,10 

12 

14 

15 

13 

9.12 
5,10 

5,8,10,13, 

14.15 

5.11.15 
13,14 
5,10 

10 

10 

13,14 

9.10.12 

14 
10 

10.12 
14 

14 


216d, 200i 
7d, lOi 93.0 

12 

16d, 43i 
lOOd, 220i 
8d, 114i 

50d 31.9 

14d, 17i 

Id, li 
14i 

105.4 
32d 


5,10,12,15 
10,12 

5.10.12 

9.11.13 


13 

10 


cn 

H 

o 

ID 


CO 


17.4 





390 

Aug. 30 

Good Hope, LA 

Tank barge Panama City 

391 


Hamburg, FRG 

Grain silo 

392 

Oct. 17 

Lerida, Spain 

Grain silo 

393 

Mar. 20 

Linden, NJ 

Cat cracker 

394 

Nov. 10 

Mississauga, Ont. 

Rail tank car 

395 

Aug. 

Orange, TX 

Pipeline 

396 

Sep. 8 

Paxton, TX 

Rail tank car 

397 

Sep. 4 

Pierre Port, LA 

Pipeline 

398 

Dec. 11 

Ponce, Puerto Rico 

Dimerizer vessel 

399 

Apr. 19 

Port Neches,TX 

Oil tanker Seatiger 

400 

Jan. 11 

Rafnes, Norway 

Chemical plant 

401 

Jul. 28 

Sauget, IL 

Reactor 

402 

Jul. 21 

Texas City, TX 

Alkylation unit 

403 

Sep. 18 

Torrance, CA 

Cat cracker 

404 

Jun. 26 

Ypsilanti, MI 

Storage 

405 

1980 Jan. 3 

Avon, CA 

Refinery 

406 

Jan. 1 

Barking, UK 

Warehouse 

407 

Jan. 30 

Bayamon, Puerto Rico 

Pipeline 

408 

Jan. 20 

Borger,TX 

Alkylation unit 

409 

Feb. 26 

Brooks, Alberta 

Compressor station 

410 

Dec. 31 

Corpus Christi,TX 

Hydrocracker 

411 

May 17 

Deer Park, TX 

Phenolacetone plant 

412 

Mar. 26 

Enschede, Netherlands 

413 

Aug. 18 

Gach Saran, Iran 

Warehouse 

414 

Nov. 25 

Kenner, LA 

Road tanker 

415 

Feb. 11 

Longport, UK 

Warehouse 

416 

Mar. 3 

Los Angeles, CA 

Road tanker 

417 

Oct. 8 

Mexico City, Mexico 

Loading terminal 

418 

Jul. 26 

Muldraugh, KY 

Rail tank car 

419 


Naples, Italy 

Grain silo 

420 

Oct. 21 

New Castle, DE 

Polypropylene plant 

421 

Jul. 15 

New Orleans, LA 

Pipeline 

422 

Nov 29 

Ortuella, Spain 

Storage vessel 

423 

Jul. 24 

Rotterdam, Netherlands 

Oil tanker Energy 
Concentration 

424 

Jul. 23 

Seadrift,TX 

Ethylene oxide reactor 

425 

Jun. 26 

Sydney, Australia 

Refinery furnace 

426 

Nov 20 

Wealdstone, UK 

Storage vessel 

427 

1981 Feb. 11 

Chicago Heights, IL 

Reactor weigh tank 

428 

Oct. 1 

Czechoslovakia 

Ammonia plant 

429 

May 8 

Gothenburg, Sweden 

Pipeline 

430 

Jul. 19 

Greens Bayou,TX 

Reactor 

431 

Aug. 1 

Montana, Mexico 

Rail tank car 

432 

May 15 

San Rafael, Venezuela 

Pipeline 

433 

Aug. 20 

Shuaiba, Kuwait 

Tank farm 


Butane 

FB 

12d, 25i 

16.4 

9,11,13 


Grain dust 

DEX 

2i 




Grain dust 

DEX 

7d 


10 


LPG 

VCF 


27.1 

13 


Chlorine 

TOX 



9,10,11,15 


LPG 

EX 

Id, li 


12 


Chemicals 

BLEVE 

8i 




LNG 

VCF 



10 


HCs 

IE 


23.3 

13 


Crude oil 

EX 


49.6 

13 


Chlorine 

TOX 



10 


Reaction mixture 

IE 


11.9 

13 


Propane 

VCE 


37.2 

13,14 


C3-C4 HCs 

VCE 



14 


Propane 

VCE 



14 



CD 


20.9 

13 


Sodium chlorate 

F, EX 





Petroleum products 

EX 

Id 


12 


Light HCs 

VCE 

41i 

48.5 

10,13,14,15 


Natural gas 

EX 


55.6 

13 


HC 

F 


23.6 

13 



F 


25.8 

13 


Propane 

VCE 



14 


Nitroglycerine 

HEX 

80d, 45i 


10 


Gasoline 

F 

7d,6i 


10 


LPG, etc. 

F, EX 





Gasoline 

BLEVE 

2d, 2i 




Ammonia 

TOX 

9d, 28i 


10 

Q 

VCM 

F 

4i 


10 

> 

Grain dust 

DEX 

8i 



(7) 

Hexane, propylene 

VCE 

5d, 25i 


10,14 

m 

Natural gas 

F 




1 

Propane 

EX 

51d 


10 

O) 

Crude oil 

Ship split apart 



9 

O 






ID 

Reaction mixture 

DET 


16.4 

13 

m 

Oil 

EX 


25.0 

13 

C/) 

Propane 

REL 

Od, li 




Tank contents 

VEEB 


17.4 

13 

> 

Syngas 

VCE 



14 


Propane 

VCE 

Id, 2i 


14 

m 

Herbicide reaction 

IE 


13 

13 

z 

mixture 





0 

Chlorine 

TOX 

17d, 280i 


11,12 

X 

LPG 

EX 

18d, 35i 


12 


Oil 

F 

Id, li 

124 

13 

CO 



Table A1.2 (continued) 


No. 

Date 

Location 

Plant/ 

transport 

434 

Sep. 6 

Stalybridge, UK 

Solvent recovery unit 

435 

1982 May 3 

Caldecott Tbnnel, 

Road tanker 


Oakland, CA 


436 

Dec. 19 

Caracas, Venezuela 

Storage tank 

437 

Apr. 18 

Edmonton, Alberta 

Compressor 

438 

Dec. 29 

Florence, Italy 

Road tanker 

439 

Jan. 20 

Fort McMurray, Alberta 

Compressor 

440 

Oct. 4 

Freeport,TX 

Transformer 

441 

Nov. 4 

Hudson, IA 

Pipeline 

442 

Mar. 31 

Kashima, Japan 

Desulphurization unit 

443 

Sep. 28 

Livingston, LA 

Rail tank car 

444 

Feb.13 

Morley, UK 

Warehouse 

445 

Jan. 17 

Moselle River, France 

Pipeline 

446 

Mar. 9 

Philadelphia, PA 

Phenol plant 

447 

Oct. 1 

Pine Bluff, AR 

Pipeline 

448 

Jun. 28 

Portales, NM 

Pipeline 

449 

Sep. 25 

Salford, UK 

Warehouse 

450 

1983 Apr. 7 

Avon, CA 

Cat cracker 

451 

Jul. 30 

Baton Rouge, LA 

Rail tank car 

452 

May 26 

Bloomfield, NM 

Compressor station 

453 

Apr. 14 

Bontang, India 

LNG plant 

454 

Apr. 3 

Denver, CO 

Rail tank car 

455 

Nov. 2 

Dhurabar, India 

Rail tank car 

456 

Aug. 30 

Milford Haven, UK 

Storage tank 

457 

Jul. 1 

Port Arthur, TX 

Polyethylene bead plant 

458 

Jan. 7 

Port Newark, NJ 

Storage tank 

459 

May 26 

Prudhoe Bay, AK 

NGL surge drum 

460 

Mar. 15 

West Odessa,TX 

Pipeline 

461 

Sep. 30 

Basile, LA 

Gas plant 

462 

1984 May 23 

Abbeystead, UK 

Valve house 

463 

Dec. 3 

Bhopal, India 

Storage tank 

464 

Feb. 24 

Cubatao, Brazil 

Pipeline 

465 

Aug. 15 

Fort McMurray, Alberta 

Coking unit 

466 

Mar. 8 

Kerala, India 

Cooling tower 

467 

Dec. 13 

Las Piedras, Venezuela 

Hydrodesulphurizer 

468 

Nov. 19 

Mexico City, Mexico 

Terminal 

469 

Sep. 25 

Phoenix, AZ 

Pipeline 

470 

Jul. 23 

Romeoville, IL 

Absorption column 

471 

Apr. 20 

Sarnia, Ont. 

Benzene plant 

472 

1985 Apr. 27 

Beaumont, KY 

Pipeline 

473 

Jul. 6 

Clinton, LA 

Ammonia plant 

474 

Jan. 18 

Cologne, FRG 

Ethylene plant 


Chemical Event Deaths / Cost References 

injuries (million 

US$) 


Hexane 

EX 



15 

Gasoline 

F 

7d 



Oil froth 

F 

150d, >500i 

58.9 

13,15 

Ethylene 

VEEB 


24.6 

11,13 

Propane 

EX 

5d, 30i 


12 

Hydrogen 

F 


24.6 

13 

Oil 

F 


17.2 

13 

Natural gas 

EX 

5d 



HCs 

F 


16.3 

13 

Flammables, toxics 

DELBLEVE 

0d,0i 



Herbicides, etc. 

F, POL 



9.11 

Carbon monoxide 

TOX 

5d 


11,12 

Cumene 

VCE 


29.3 

13 

Natural gas 

VCF 




Natural gas 

DEL EX 

6d 



Sodium chlorate 

EX 

60i 


15 

Recycle slurry 

F 


56.3 

13 

VCM 

F 




Natural gas 

VEEB 

21 



LNG 

IE 


57.5 

13 

Nitric acid 

TOX 




Kerosene 

EX 

47d 


12 

Crude oil 

F 

Od, 20i 

17.3 

13,15 


F 


17.8 

13 

Gasoline 

VCE 

Id 

40.3 

13,14 

NGL 

F 


40.3 

13 

LPG 

EX, F 

6d 


12 

HCs 

VCF 


33.9 

13 

Methane 

EX 

16d, 28i 


11,12 

Methyl isocyanate 

TOX 

«4000d 


11,15 

Petrol 

F 

>100d, ~150i 


12 

HCs 

VCF 


85.9 

13 

HCs 

EX 


13.6 

13 

Oil 

F 


70.1 

13 

LPG 

VCF, BLEVE 

«650d, ~6400i 

22.5 

11,13,15 

Natural gas 

EX, F 



Propane 

VCE, BLEVE 

15d, 22i 

143.5 

13.14,15 

Hydrogen 

VCE 

2d 


14 

Natural gas 

F 

5d, 3i 



Syngas 

VEEB 


14.7 

13 

Ethylene 

VCE 



14 





475 

Feb.19 

Edmonton, Alberta 

Pipeline 

476 

Jul. 23 

Kaycee,WY 

Pipeline 

477 

Feb. 23 

Jackson, SC 

Rail tank car 

478 

Mar. 9 

Lake Charles, LA 

Reforming unit 

479 

Nov. 5 

Mont Belvieu 

Salt dome storage 

480 

Dec. 21 

Naples, Italy 

Terminal 

481 

Jun.9 

Pine Bluff, AR 

Rail tank car 

482 

May 19 

Priola, Italy 

Ethylene plant 

483 

Feb. 23 

Sharpsville, PA 

Pipeline 

484 

Nov. 21 

Tioga, ND 

Gas processing plant 

485 

Jan. 23 

Wood River, IL 

Deasphalting-dewaxing 

486 

1986 Feb. 21 

Lancaster, KY 

Pipeline 

487 

Jun. 15 

Pascagoula, MS 

Distillation column 

488 

Oct. 30 

Schweizerhalle, Basel, 
Switzerland 

Warehouse 

489 

Feb. 24 

Thessalonika, Greece 

Oil terminal 

490 

1987 Jul. 3 

Antwerp, Belgium 

Distillation column 

491 

Oct. 11 

Fort McMurray, Alberta 

Tar sand plant 

492 

Mar. 22 

Grangemouth, UK 

Separator vessel 

493 

Aug. 23 

Lanzhou, China 

Rail tank car 

494 

Jun. 23 

Mississauga, Ont. 

Hydrotreater 

495 

Nov. 14 

Pampa,TX 

Acetic acid plant 

496 

Jun. 2 

Port Herriot, France 

Storage 

497 

Aug. 15 

RasTanura, Saudi Arabia 

Gas plant 

498 

Nov. 24 

Torrance, CA 

Aklylation unit 

499 

1988 Jul. 30 

Altoona, IA 

Rail tank car 

500 

Jun. 4 

Arzamas, USSR 

Railway station 

501 

Apr. 7 

Beek, Netherlands 

Polyethylene plant 

502 

Jan. 2 

Floreffe, PA 

Storage tank 

503 

May 5 

Norco, LA 

Cat cracker 

504 

Jun. 8 

Port Arthur, TX 

Storage 

505 

Oct. 25 

Pulua Merlimau 

Storage tanks 

506 

Sep. 8 

Rafnes, Norway 

VC plant 

507 

1989 Mar. 7 

Antwerp, Belgium 

Distillation column 

508 

Dec. 24 

Baton Rouge, LA 

Refinery 

509 

Jul. 22 

Freeland, MI 

Freight train 

510 

Feb. 2 

Helena, MT 


511 

Mar. 20 

Jonova, Lithuania 

Ammonia storage 

512 

Jul. 2 

Minnebeavo, USSR 

Gasoline plant 

513 

Sep. 5 

Martinez, CA 

Hydrotreater 

514 

Jun. 7 

Morris, IL 

Distillation column 

515 

Oct. 23 

Pasadena, TX 

Polyethylene plant 

516 

Mar. 22 

Peterborough, UK 

Road vehicle 

517 

Apr. 10 

Richmond, CA 

Refinery 

518 

Oct. 3 

Sabine Pass, TX 

Pipeline 


NGL 

VCE 



14 

Aviation fuel 

EX 

Id, 6i 




REL 




Propane 

VCE 



14 

Ethane, propane 

VCE 


44.8 

13,14 


F 


47.0 

13 

HMs 

REL 




HCs 

F 


72.8 

13 

Natural gas 

EX, F 




HCs 

IE,VCE 


11.3 

13 

Propane 

VCF 


25.2 

13 

Natural gas 

F 

3 burned 



Aniline, etc. 

EX 




Pesticides, etc. 

F, POL 



11 

Oils 

F 




Ethylene oxide 

EX 



14 

Tar sand, diesel fuel 

F 


39.7 

13 

Hydrogen 

F 


87.9 

13.15 

Gasoline 

F 

5d 


12 

Hydrogen, HCs 

F 


22.4 

13 

Acetic acid, butane 

VCE 

3d 

24.1 

13,14,15 

Oil 

F 

2d, 8i 



Propane 

VCE 


67.2 

13,14 

HCs 

F 


16.4 

13 

HMs 

REL 




Explosives 

HEX 

73d, 230i 


12 

Ethyiene 

VCE 



14 

Diesel fuel 

REL 


14.5 

13 

C 3 HCs 

VCE 

7d, 28i 

327 

13,14,15 

Propane 

F 


17.4 

13 

Naphtha 

F 


13.1 

13 

VCM, ethylene 

VCE 


12.0 

13,14 

dichloride 





Ethylene oxide 

EX 


80.1 

13,14 

Ethane, propane 

VCE 


44.7 

13,14 

HMs 

REL 




HMs 

REL 




Ammonia 

IE, F, TOX 

7d 



Propane 

VCE 

4d 


14 

Hydrogen, HCs 

For EX 


52.0 

13 

Propylene 

VCF 


41.6 

13 

Isobutane 

VCE 

23d, «103i 

>500 

13,14,15 

Explosives 

EX 

Id, 1071 



Hydrogen 

F 


93.6 

13 

Natural gas 

REL 






Table A1.2 (continued) 


No. 

Date 

Location 

Plant/ 

Chemical 

Event 

Deaths / 

Cost 

References 




transport 



injuries 

(million 

US$) 


519 

May 25 

San Bernadino, CA 

Pipeline 

Gasoline 

F 

2d, 3i 



520 

Sep. 18 

St Croix, Virgin Islands 

Refinery 

HCs 

HUR 


62.4 

13 

521 

Jun. 3 

Ufa, USSR 

Pipeline 

NGL 

VCE 

645d, p«500i 


14,15 

522 

Feb.14 

Urdingen, Germany 

Paint plant 

Reaction mixture 

IE 


41.6 

13 

523 

1990 Sep. 24 

Bangkok, Thailand 

Road tanker 

LPG 

VCF 

68d, >100i 



524 

Sep. 16 

Bay City, TX 

Tankship Jupiter 

Gasoline 

EX 

Id 



525 

Nov. 3 

Chalmette, LA 

Hydro cracker 

HCs 

VCE 


15.3 

13 

526 

Jul. 5 

Channelview, TX 

Wastewater storage tank 

Flammables 

EX 


12.2 

13 

527 

Jul. 19 

Cincinnati, OH 

Acrylic resins plant 

Xylene, solvent 

VEEB 


23.5 

13,14 

528 

Nov. 25 

Denver, CO 

Storage 

Jet fuel 

F 


30.6 

13 

529 

Nov. 6 

Nagothane, Bombay, India 

Ethylene plant 

Ethane, propane 

VCE 

31d 

22.4 

13,14 

530 

Mar. 3 

North Blenheim, NY 

Pipeline 

Propane 

VCF 

2d, 7i 



531 

Nov 15 

Porto de Leixhos, Portugal 

Deasphalting unit 

Propane 

VCE 



14 

532 

Nov. 30 

RasTanura, Saudi Arabia 

Refinery 

HCs 

F 


23 

13 

533 

Jul. 10 

Rio de Janeiro, Brazil 

Boiler 

Steam 

EX 


10.2 

13 

534 

Mar. 30 

Stanlow, UK 

Reactor 

2-4 dichloronitro— 

IE 

Id, 5i 


15 





benzene reaction 
mixture 





535 

May 14 

Tomsk. USSR 

Ethylene plant 

Gas 

VCE 



14 

536 


Warren, PA 

FCC 

LPG 

EX, F 


25.5 

13 

537 

1991 Jun. 17 

Charleston, SC 

Reactor 

Reaction mixture 

IE 


10 

13 

538 

Mar. 11 

Coatzacoala, Mexico 

Chlorine plant 


EX 


150 

13 

539 

Aug. 21 

Coode Island, Australia 

Storage tanks 

Acrylonitrile, etc. 

IE 

Od 

24 

13 

540 

Jun. 20 

Dhaka, Bangladesh 

Stripping column 


EX 


70 

13 

541 

Sep. 7 

Haifa, Israel 

Chemical plant 

Chemicals 

F 


15 

13 

542 

Jul. 14 

Kensington, GA 

Synthetic rubber 

Butadiene plant 

VCE 



14 

543 

Mar. 3 

Lake Charles, LA 

FCC 

Hot oil-water 

IE 


23 

13 

544 

Mar. 11 

Pajaritos, Mexico 

Vinyl chloride plant 

Propane 

VCE 

3d 


14 

545 

Mar. 12 

Seadrift.TX 

Ethylene oxide plant 

Ethylene oxide 

VCE 

Id 


14 

546 

Mayl 

Sterlington, LA 

Nitroparaffin unit 


EX 


105 

13 

547 

Apr. 13 

Sweeny, TX 

Reactor 

HCs 

EX 


50 

13 

548 

1992 Oct. 16 

Sodegaura, Japan 

Refinery 

Hydrogen 

VCE 

lOd, 7i 



549 

1993 Feb. 2 

Griesheim, Germany 

Reactor 

Reaction mixture 

TOX 

Od 



550 

1994 Nov 2 

Dronka, Egypt 

Fuel storage 

Aviation, diesel, fuel 

F 

«410d 



551 

1995 Apr. 27 

Ukhta, Russia 

Gas pipeline 

Gas 

F 





Alternative names 

Walsum, 1952: aka Duisburg-Walsum (often referred to asWilsum); Berlin, 1962: aka New Berlin; Doe Run, 1962: ate Brandenburg; Glendora, 1969 aka Black Bayou Jet; Rio de Janeiro, 1972: ateDuque de 
Caxais or Sao Paulo; West St Paul, 1974: aka St Paul; Des Moines, 1975: aka Angleton; Pasacabolo, 1977: aka Cartagena; Denver, 1978: aka Commerce; Donnellson, 1978: aka Fort Madison; San Carlos, 1978: 
aka Los Alfaques; Caracas, 1981: ateTacao; Montanas, 1981: ate San Luis Potosi; Stalybridge, 1981: aka Chemstar Ltd: Caracas, 1982: atelhcao; Salford, 1982: aka B&R Hauliers; Cubatao, 1984; ate Vila 
Soca; Mexico City, 1984: aka San Juan Ixhautepec; Schweizerhalle, 1986: ate Sandos; RasTanura, 1987: atejuaimah; Floreffe, 1988: aka Ashland; Rafnes, 1988: aka Bamble: Nagothane, 1990: aka 
Maharastra; Bombay; Coode Island, 1991: Melbourne 


CO 

H 

o 

ID 


CO 






Abbreviations: FCC = fluid catalytic cracker; HC = hydrocarbon; HM = hazardous material; VCM = vinyl chloride monomer 

Event abbreviations: ANEX = ammonium nitrate explosion; BLEVE = boiling liquid expanding vapour explosion; CD = criminal damage caused by vandalism, sabotage, etc.; DEL = delayed; 
DET =detonation (internal explosions only); DEX = dust explosion; EQK=earthquake damage; EX = explosion; F=fire; FB=fireball; HEX = high explosive explosion; HUR = hurricane damage; 
IE = internal explosion; POL=pollution; REL = release; TOX = toxic release; VCE = vapour cloud explosion; VCF=vapour cloud fire; VEEB = vapour escape into, and explosion in, building 

Costs 

Costs are in US dollars and are taken from the M&M compilations. The great majority are the trended costs as given in the thirteenth, 1990 edition by Mahoney (1990) and are thus in 1990 US dollars. 
Some values not included in the 1990 edition but given in the eleventh edition by Garrison (1988) have been converted to 1990 values, using a factor of 1.1; these are marked with an asterisk. Values for 
incidents in 1990 and 1991 given in the fourteenth 1992 edition by M&M (1992) are in 1991 US dollars. 

Principal references 

(1) Simmons, Erdmann and Naft (1974); (2) Eisenberg, Lynch and Breeding (1975); (3) V C. Marshall (1977b); (4) Harvey (1979b); (5) HSE (1978b); (6) Slater (1978a); (7) Gugan (1979); (8) D. J. Lewis (1980d); 
(9) Harvey (1984); (10) Kier and Muller (1983); (11) V C. Marshall (1987); (12) Haastrup and Brockhoft (1990); (13) M&M (Garrison (1988b); Mahoney (1990); and M&M (1992)); (14) Lenoir and Davenport 
(1993); (15) D.J. Lewis (1993) 


Additional references 

1; 2; 3; 4J. R. Nash (1976); 5; 6; 7; 8 Assheton (1930); 9 Billings and Copland (1992); 10 Assheton (1930); J. R. Nash (1976); 11 Anon, (n. d. b); Ministry of Home Security (n. d. a); Sainsbury (1977); 12; 13; 14; 15; 
16 Slater (1978b); 17; 18 BASF (1921); Comment etal. (1921); NBFU (1948); 19; 20; 21; 22; 23 Anon. (1928); N. C. Harris (1981b); 24; 25; 26; 27; 28 Anon. (1933a, b); 29; 30; 31; 32; 33; 34 P. Reed (1939); Armistead 
(1959); 35; 36 Romcke and Evensen (1940); 37; 38 NBFU (1948); J. R. Nash (1976); 39 Slater (1978b); Strehlow (1973b); 40 Stahl. Strassman and Richard (1949); J. R. Nash (1976); Giesbrecht et at. (1981); 
D. J. Lewis (1983); 41 J. R. Nash (1976); Patience (1989); 42 Chasis et al. (1947); 43 Moulton (1944); Coroner (1945); Elliott et d. (1946 BM RI3867); Burgoyne (1965b); Strehlow (1973b); J. R. Nash (1976); 
Marshall (1983IPB 52); 44 Anon. (1952-53); 45 ]. Reed (1977); Anon. (1992 LPB103); V C. Marshall (1992 LPB105); 46; 47 J. R Nash (1976); 48; 49 J. R. Nash (1976); 50; 51; 52; 53; 54 Kintz. Jones and 
Carpenter (1948 BM RI 4245); NBFU (1948); Wheaton (1948); Blocker (1949); Blocker and Blocker (1949); J. R. Nash (1976); 55 BASF (1948); Stahl, Strassman and Richard (1949); Giesbrecht et d. (1981); 
D. J. Lewis (1983); 56; 57; 58; 59; 60 Anon. (1949-50); 61; 62; 63; 64; 65; 66 H. E. Watts (1951); Anon. (1952); Kletz (1983 LPB 52); 67; 68 NBFU and FIRONT (1952); 69; 70 Jenkins and Oakshott (1955); 
Strehlow (1973b); D. J. Lewis (1980); Alderson (1982 SRD R246); 71NFPA (1957); 72; 73; 74; 75; 76; 77; 78; 79; 80; 81; 82; 83 Woodworth (1955); R.B. Jacobs etal. (1957,1973); Randall etal. (1957); 84; 85; 86; 87 
Walker (1973); J. R. Nash (1976); 88; 89; 90; 91; 92 Lindley and Brown (1958); 93 Selway (1988 SRD 492); 94; 95; 96; 97; 98; 99; 100 Anon. (1959a); Woodworth (1958); 101; 102; 103 Anon. (1960- 61); Slater 
(1978b); Strehlow (1973b); Hymes (1985 LPB 65); 104 Schmitt (1964); 105; 106 Cronan (1960c); 107 Sakai (1964); 108 Chementator (1960 Nov. 14,106); 109 Chementator (1960 Dec. 12,69); F. C. Price (1960); 
110; 111; 112; 113 Joyner and Durel (1962); 114; 115; 116; 117 Walls (1963-64,1964a); Strehlow (1973b); Strehlow and Baker (1976); 118; 119 Troyan and Levine (1968); 120; 121; 122; 123; 124 Laney (1964); 
Vervalin (1973e); 125; 126 Chementator (1962 May 28,68); 127; 128; 129; 130; 131; 132; 133; 134; 135 Walls (1964b); 136; 137; 138; 139 Chementator (1964Feb. 3,36); 140Bulkley and Jacobs (1966); 141; 142; 143; 
144; 145; 146; 147; 148; 149 Anon. (1967c); 150; 151; 152; 153 Chementator (1965 Sep. 13,105); Armistead (1966,1973); 154 Chementator (1965 Mar. 29,26; Aug. 2,41); FPC (1966); 155; 156; 157; 158 Anon. 
(1966g, h); Strehlow (1973b); Vervalin (1973e); Kletz (1974e, 1975d, 1977d); Anon. (1987 LPB 77, p. 1); Selway (1988 SRD R492); 159; 160 Chementator (1966Jan. 31,18); 161 Chementator (1966 Oct. 24,55); 
Anon. (1967b); FireJ. Staff (1967,1973d); 162; 163 McCarey (1966); 164 Anon. (1966c); 165; 166; 167; 168; 169; 170; 171 Chementator (1967 Aug. 28,56); Goforth (1970); NFPA (1973); Strehlow (1973b); Vervalin 
(1973e); Strehlow and Baker (1976); 172; 173; 174; 175; 176 NTSB (1968 RAR); 177; 178; 179 Medard (1970); 180; 181 Fontein (1968); Min. of Social Affairs and Public Health (1968); Strehlow (1973b); Wood- 
worth (1973); Strehlow and Baker (1976); 182 Slater (1978b); 183; 184; 185; 186 J. E. Browning (1969a); NTSB (1971RAR-71- 02); 187 Anon. (1970a); 188; 189; 190; 191 NTSB (1970 RAR-70 -02); Dowell (1971); 
Kogler (1971); Strehlow and Baker (1976); 192 NTSB (1971 PAR-71- 01); 193 NTSB (1969RAR); 194; 195; 196; 197RH. Freeman and McReady (1971); Jarvis (1971); Keister, Pesetsky and Clark (1971); Griffith 
and Keister (1973); 198 Anon. (1970e); 199 Anon. (1969b); 200 Anon. (1971d); 201; 202; 203; 204 MacArthur (1972); 205 NTSB (1970 HAR-71- 06); 206; 207 Watrous (1970); NTSB (1972 RAR-72-02); Strehlow 
(1973b); Vervalin (1973e); Strehlow and Baker (1976); D. J. Lewis (1991 LPB 101); 208; 209; 210 NTSB (1971 PAR-71- 02); 211; 212; 213; 214 Chementator (1970 Jun. 1,63); 215 NTSB (1972 PAR-72-01); Burgess 
and Zabetakis (1973 BM RI 7752); Strehlow (1973b); Strehlow and Baker (1976); 216; 217; 218; 219; 220 Chementator (1971 Jul. 26, 55); 221 NTSB (1972 HAR-72-03); Cremer and Warner (1978); 222 
Chementator (1971 Nov. 1,23); NTSB (1972 RAR-72-06); Slater (1978b); 223; 224 Sarsten (1972); 225; 226 Lauderback (1975); 227; 228; 229 W B. Howard (1975b); Slater (1978b); Stueben and Ball (1980); 
Matsuz and Sadler (1994); 230; 231; 232 NTSB (1971HAR-72-05); 233; 234; 235 NTSB (1973 RAR-73-01); Strehlow (1973b); Strehlow and Baker (1976); 236 NTSB (1973 PAR-73-02); 237 NTSB (1973 HAR- 
73-03); Strehlow and Baker (1976); 238; 239 NTSB (1973 HAR-73-04); 240 Selway (1988 SRD R492); 241; 242; 243 Chementator (1973 Jan. 8, 51); D. J. Lewis (1989c); 244; 245 NTSB (1973 PAR-73-04); 
Strehlow and Baker (1976); 246 (NTSB 1975RAR-75- 02); 247; 248; 249; 250; 251 Crawley (1982); Hymes (1985 LPB 65); 252; 253; 254NTSB (1974 PAR-74-06); Luddeke (1975); 255; 256 Lonsdale (1975); 257; 
258 Anon. (1973j); 259; 260; 261 Chementator (1973 Mar. 5,28; 1974 Apr. 1,17); US Congress (1973); D. J. Lewis (1989); 262 Chementator (1973 Jul. 23,58; Nov. 12,94); 263; 264; 265; 266 NTSB (1975 PAR- 
75 -02); 267 Chementator (1974 Dec. 23,21); 268; 269 Hoyle (1982): 270; 271; 272 NTSB (1975 RAR-75-04); Strehlow and Baker (1976);V C. Marshall (1980d); 273; 274 R. J. Parker (1975): Strehlow and Baker 
(1976); 275 Adderton (1974); Str e hlow and Baker (1976); 276; 277 NTSB (1975 RAR-75-07); Slater (1978b); 278 Sharry (1975); 279 NTSB (1975 PAR-75-01); 280; 281 NTSB (1974 RAR-74-04); 282 Anon 
(1974n); 283; 284; 285 Anon (1974k); Anon. (1974p); 286; 287 NTSB (1976 RAR-76-01); 288; 289; 290; 291; 292 Chementator (1975 Nov. 24,17); Min. of Social Affairs (1976); van Eijnatten (1977); Slater 
(1978b); 293; 294; 295 NTSB (1976RAR-76-08); 296 NTSB (1976PAR-76-05); 297 NTSB (1976HAR-76-04); 298; 299 HSE (1976b); 300 NTSB (1976PAR-76-03); 301 Slater (1978b); 302; 303; 304; 305 
Chementator (1975 Oct. 27,53); Anon. (1975n); 306 NTSB (1976 PAR-76- 07); 307; 308 HSE (1976a); 309 NTSB (1976 HAR-76- 07); 310; 311;312; 313 Anon. (1976n); Rees (1982); 314 NTSB (1977 RAR-77- 07); 
315 Chementator (1976 Aug. 30,49); 316; 317; 318; 319;320 Anon. (1976o); McMullen (1976); NTSB (1977 HAR-77-01); Fryer and Kaiser (1979 SRD R152); 321 HSE (1977b); 322; 323; 324; 325 Slater (1978b); 
326NTSB (1978 MAR-78-06); D.J.Lewis (1984c); 327; 328; 329; 330 NTSB (1977 PAR-77-03); 331; 332Temple (1977b); 333; 334; 335; 336; 337; 338; 339; 340 NTSB (1978 HAR-78-04); 341 HSE (1979b); 342 






Table A1.2 (continued) 

Anon. (1977b); 343; 344; 345 NTSB (1978 PAR-78-02); 346; 347; 348; 349; 350; 351; 352; 353; 354 NTSB (1978 RAR-78-04); Stueben and Ball (1980); 355; 356 D. J. Lewis (1991LPB100); 357; 358 NTSB (1978 
PAR-78- 01); 359; 360 Anon. (1977c);Whelan (1977); Kletz (1988 LPB 81); 361 Anon. (1977p, q); Lathrop (1978); Nolan (1979); 362; 363; 364 Chementator (1978 Feb. 27,64); 365; 366; 367 NTSB (1979 PAR-79 - 
01); 368; 369 NTSB (1978 RAR-78-08); 370; 371; 372; 373; 374 Anon. (1978m); 375; 376 Selway (1988 SRD R492); 377; 378 Anon. (1978b); NTSB (1979 RAR-7941); D. J. Lewis (1992 LPB 105); 379; 380 Anon. 
(1978k); NTSB (1978 RAR-78-07); 381 Costello (1979); Anon. (1980a, v); 382; 383; 384; 385 NTSB (1980PAR-80-02); van Meerbeke (1982); 386NTSB (1979 RAR-79-U);387NTSB(1980MAR-80-18); 388; 
389; 390 NTSB (1980 MAR- 80-07): 391; 392; 393; 394 Mississauga News (1979); Amyot (1980); Grange (1980); Fordham (1981 LPB 44); Lane and Thomson (1981); 395 NTSB Ann Rep. (1979); 396; 397; 398; 
399NTSB(1980MAR-80-12);400;401; 402; 403; 404; 405; 406HSE (1980a); Anon. (1980r);407NTSB(1980PAR-80-6);408;409;410; 411; 412; 413; 414; 415 HSE (1981b); 416NTSB(1980AR-80-05); 417; 418 
NTSB (1981RAR-81-01); 419; 420; 421 NTSB (1980 PAR-80-01); 422; 423; 424; 425; 426 HSE (1981c); 427; 428; 429 Nilson (1983b); 430; 431 Anon (1981 LPB 44); Anon. (1983 LPB 52); 432; 433; 434 HSE 
(1982a); Kletz (1983b); 435 NTSB (1983 HAR- 83-01); 436 Garrison (1984 LPB 57); M. F. Henry (1986); 437; 438; 439; 440; 441 NTSB (1983 PAR-83 - 02); 442; 443 NTSB (1983 RAR- 83 -05); Anon. (1984t) 
444; 445; 446; 447 NTSB (1983 PAR-83-03); 448 NTSB (1983 PAR-83-01); 449 HSE (1983b); 450; 451 NTSB (1985 RAR-85-08); 452 NTSB (1983 PAR-83-04); 458; 454 NTSB (1985 RAR-85-10); 455; 456 
Dyfed County Fire Brigade (1983); Mumford (1984LPB 57); Golec (1985); Steinbrecher (1986); 457; 458; 459; 460 NTSB (1984 PAR- 84-01); 461; 462 Burgoyne (1985a); HSE (1985a); 463; 464 Anon (1984oo); 
465; 466 Anon (1992 LPB106);467;468Pietersen (1985); Selway (1988 SRD R492); 469 NTSB (1985 PAR-85-01); 470; 471; 472 NTSB (1987 PAR-87-01); 473; 474; 475; 476 NTSB (1986PAR-86-01);477NTSB 
(1985RAR-85-12); 478;479; 480; 481 NTSB (1986RAR-86-04): 482; 483NTSB (1985 PAR-85-02); 484; 485; 486NTSB (1987PAR-87-01): 487; 488 Anon. (1986v. w, y); Beck(1986); D.Williams (1986); 
Anon. (1987 LPB 75); Stallworthy (1987); 489 B. Browning and Searson (1964); 490 Mellin (1991 LPB 100); 491; 492 Anon. (19871); Anon. (1988c, d); Anon. (1989b); HSE (1989a); Kletz (1989b); K. C.Wilson 
(1990a, b); 493; 494; 495; 496Mansot(1989);497; 498; 499NTSB (1989 RAR-89-04); 500; 501; 502 Prokop (1988);Wilkinson (1991 SRD R530);Mellin (1992 LPB 106); 503; 504; 505; 506; 507 Anon(1991LPB 
100); 508; 509 NTSB (1991RAR-91-04); 510 NTSB (1989 RAR-89-05); 511 Andersson (1991a, b); Kletz (1991a); Anon. (1992 LPB 107. p. 1): Anderson and Lindley (1992 LPB 107): Kukkonen etal. (1992); 
Wilday (1992 LPB 108,109); Kukkonen etal. (1993). 512; 513; 514; 515 OSHA (1990a); Kletz (1991j); 516 HSE (1990b); Anon. (1991 LPB 98. p. 24); 517; 518 NTSB (1990 PAR-90-02); 519 NTSB (1990RAR-90- 
02); 520; 521 Hofheinz and Kohan (1989); 522; 523 Anon. (1991 LPB 101, p. 19); 524NTSB(1991MAR-91-04); 525; 526 Anon. (1990d); 527; 528; 529 Indian Petrochemicals Corp. (1990); 530NTSB(1991PAR- 
91- 01); 531; 532 Anon. (1990g); 533; 534 Kletz (1990 LPB 100); Mooney (1991); Redman and Kletz (1991); Cates (1992); van Reijendam etal. (1992); 535: 536; 537; 538; 539 Anon. (1991b); I. Thomas (1991); 
Anon. (1992c); Croudace (1993 LPB 112); 540; 541; 542; 543 Anon. (1991d); 544; 545 Viera, Simpson and Ream (1993); 546; 547; 548 High Pressure Gas Safety Institute of Japan (1993 LPB 116); 549 Ondrey 
(1993a, b); Schonfeld (1993); Vennen (1993); 550 Reuter (1994); 551 Anon. (1995) 
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a Evidently including ‘excess deaths’, characteristic of a severe pollution incident. 

h Gugan (1979) gives two incidents in 1966 in the FRG (his Nos 49 and 50). His No. 49 is named as Raunheim, while No. 50 has no more specific location. For both the date is given as January and the 
reference as Bradford and Culbertson (1967). Incident No. 50 is not quoted by Lenoir and Davenport (1993). 

c Slater (1978a) cites an incident in Roumania in 1974 involving ethylene as a VCE with Id, 50i; this was given in the first edition of this book. The present entry relies on Anon. (1974k). 
d The figure for deaths refers to prompt deaths; it does not include abortions. 
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A2 Ashton, Manchester, 1917 

On 13 June 1917, a nitrator in an explosives works at Ashton, 
Manchester, went out of control and ‘boiled’ over, releasing 
hot acid onto the wooden staging and starting a fire. 
The fire took hold in the nitrator house. Spectators were 
attracted, including children. Soon after there was a large 
explosion, involving some 5 tons of TNT. The explosion 
ruptured two gasholders nearby, setting them on fire. The 
flames were described as half a mile high. 

Some 100 houses were demolished. 46 persons died, 
including 24 employees and 11 children. More than 120 
were injured sufficiently to need hospital treatment. The 
explosion made two craters, one at the location of the TNT 
drums and one at that of the drier and setting frays. The 
former was 90 ftx36 ftx5 ft deep and the latter 30 ftxl5 ft 
and relatively shallow. Some 12,000 ft 2 of glass was 
replaced. 

Billings and Copland (1992) 

A3 Halifax, Nova Scotia, 1917 

At about 8.48 a.m. on 6 December 1917, the French ammu¬ 
nition ship Mont Blanc was rammed by the Belgian relief 
ship Imo in Halifax Harbour, Nova Scotia. The Mont Blanc 
was carrying in her hold some 4,661,794 lb of picric acid, 
450,000 lb of TNT and 122,960 lb of guncotton as well as 
488,672 lb of benzol on deck. The Mont Blanc burst into 
flame and at 9.05 am there was a massive explosion. The 
inhabitants heard a ‘thundering crash’ and many ran to 
their windows to see what had happened. The noise was 
heard 191 miles away and some windows broke at a dis¬ 
tance of 61 miles. 

The explosion tore the ship apart and hurled fragments 
all over the city. The anchor shank fetched up 3-4 miles 
away. The blast caused almost complete destruction within 
a radius of about three-quarters of a mile. There was severe 
structural damage at distances ranging from 1 to 1.75 miles. 
It was estimated that 95% of the glass in the city was 
broken. Fires caused by overturned stoves broke out in 
many parts. 

Many people were killed when buildings were demol¬ 
ished. Large numbers suffered injury from flying glass and 
at least 500 people were totally blinded. In round figures, 
the death toll was put at 1800 and the number of registered 
wounded was 8000. 

A4 Silvertown, London, 1917 

On 19 January 1917, an explosion occurred at the Brunner 
Mond munitions factory at Crescent Wharf, Silvertown, 
London. A fire broke out at the melt pot room and took hold. 
It burned for some minutes when there was a massive 
explosion. Sixty nine people were killed and 98 seriously 
injured; there were 328 slight injuries recorded and about 
600 were believed to have been treated in the street or by 
private doctors. The report of the inquiry stated: 

At the time of the explosion the total quantity of TNT on 
the premises amounted to 83 tons, of which 28 were 
crude, 27 in process and 28 finished, and there were, in 
addition, 9 tons of TNToil in iron drums of which 5 tons 
were subsequently recovered—The outlines of the cra¬ 
ters seem to indicate that altogether about 30 tons of TNT 
and the remaining 4 tons of TNToil did not explode, but 
probably burned away. This would leave 53 tons of TNT to 
take part in the explosion. 

TNT oil is alcohol containing the soluble impurities of TNT. 


The explosion formed two separate craters. The smaller 
was circular in shape with a radius of about 25 ft and some 13 
tons of TNT had been present in this area. The larger crater, 
in the area containing the remaining 40 tons of TNT, was 
kidney-shaped, with approximate dimensions 150 ft x 50 ft. 

Anon, (n.d.b); Ministry of Home Security (n.d.a); 
Sainsbury (1977) 

A5 Oppau, Germany, 1921 

At 7.29 a.m. and again at 7.32 a.m. on 21 September 1921, 
two terrific explosions occurred at the Oppau works of 
Badische Anilin und Soda Fabrik (BASF). 

Figures for the death toll vary. Commentz etal. (1921) give 
the number of dead as 430, including 50 people in the vil¬ 
lage. According to V.C. Marshall (1987), following BASF 
(1958), the explosion killed 561, including 4 in Mannheim 
7 km away, injured 1500 and destroyed 1000 houses, 
including 75% of those in Oppau itself. It created a crater 
115 m long x 75 m wide x 10 m deep. 

The works after the explosion is shown in Figure A1.3. 
Other effects of the explosion were as follows (Commentz 
etal, 1921): 

Houses in the adjacent city of Ludwigshafen and in 
Mannheim, which lies opposite to Ludwigshafen on the 
right bank of the Rhine, were damaged, walls were shaken 
down and practically all windows were broken. At these 
places and at Heidevaporerg, which is about 14 miles from 
Oppau, the effect of the explosion was first felt by two very 
heavy earthquake-like shocks. In Mannheim some seconds 
later and in Heidevaporerg 82s after the shocks there came 
an enormous rush of air which broke windows and doors 
and caused damage to gas holders, oil tanks, and many 
river barges. The sound of the explosion reached as far as 
Bayreuth, at a distance of 145 miles, and the air pressure 
wave caused considerable damage in Frankfurt, which is 
about 53 miles from the scene of the explosion. 

The explosion involved some 4500 tons of a 50 : 50 mix¬ 
ture of ammonium sulfate and ammonium nitrate. Detona¬ 
tion was set off by blasting powder, which was being used 
to break up storage piles of material which had become 
caked, a procedure which had been carried out without 
mishap some 16,000 times previously. 

The danger of using explosives to break up caked 
ammonium nitrate had been demonstrated earlier in the 
year in Germany, when on 10 July at Kriewald this pro¬ 
cedure led to the explosion of two rail wagons containing 15 
te of that substance (D.J. Lewis, 1993). 

BASF (1921, 1958); Commentz et al. (1921); J.R. Nash 
(1976); NBFU (1948); HSE (1978b); V.C. Marshall (1987); 
D.J. Lewis (1993) 

A6 Hamburg, Germany, 1928 

On 28 May 1928, a tank containing phosgene exploded at 
the Stolzenburg factory on the Hofe-Kanal near the har¬ 
bour area of Hamburg. The wind was at first northerly and 
then changed to the south-east. At one location 5 miles 
away the gas was strongly felt. People were also affected by 
the gas at locations 6 and 11 miles distant. 

The prime source (Anon., 1928) states ‘Some 300 or more 
cubic feet of the gas were released’. V.C. Marshall (1987) 
suggests that this figure probably refers to the volume of 
the liquid, which would correspond to about 12 te, close to 
the figure of 11 te given by N.C. Harris (1981). 

11 people were killed and 171 required hospital treatment. 
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Figure A1.3 Oppau: BASF works after ammonium nitrate explosion, 1921 (Badische A nilin und Soda Fabrik) 


Anon. (1928); Hegler (1928); N.C. Harris (1981b); VC. 
Marshall (1987) 

A7 Neunkircken, Germany, 1933 

On 10 February 1933, an explosion occurred on a waterless 
gas holder in Neunkirchen in Germany. Work was being 
done on a bypass pipe between the inlet and outlet mains. 
Due to a series of actions which is not entirely clear, but 
which involved measures to bring misaligned flanges into 
alignment, a small explosion occurred at this bypass and 
ruptured the outlet main. A flame was seen to go up the side 
of the gasholder. It had burned for some 5 min when the 
main explosion occurred. The inquiry found that this 
explosion involved an air mixture which had formed above 
the piston. 

The explosion caused 65 deaths and several hundred 
injuries. 

Anon. (1933a,b); Kier and Miffler (1983) 

A8 Wichita Falls, Texas, 1939 

On 12 December 1939 an explosion occurred in a 10 in. dia¬ 
meter crude oil pipeline at Wichita Falls, Texas. A 38 mile 
section of the line had been emptied to locate and repair 
minorleaks.Themethodusedwastopassaseriesofscrapers 
through the line propelled by air, which was odorized to 
assist in detecting the leaks, and then to displace the column 
of air by one of oil. During this latter procedure a scraper 
propelled by the oil struck one that had stuck in the pipe, 
evidently causing a spark. The result was an oil film explo¬ 
sion, in which the detonation travelled down the pipeline for 
over 26.8 miles, rupturing the line at intervals of about 80 ft. 


The pattern of ruptures in the pipeline is shown in 
Figure A1.4. 

P. Reed (1939); Armistead (1959); D.J. Lewis (1993) 

A9 Tessenderloo, Belgium, 1942 

On 21 July 1942, a massive ammonium nitrate explosion 
occurred at a chemical works at Tessenderloo in Belgium. 
The death toll is given as of the order of 200. 

J.R. Nash (1976) 

A10 Ludwigshafen, Germany, 1943 
On 29 July 1943, a release occurred from a rail tank car in 
the BASF works at Ludwigshafen. The tank car contained 
16.5 te of a mixture of 80% butadiene and 20% butylene. A 
vapour cloud formed and ignited. The resultant vapour 
cloud explosion demolished a block 350 x 100 m 2 within 
the factory. Fifty-seven people were killed and 439 injured. 

According to Giesbrecht et al. (1981), there was a delay of 
some 10—25 s between the rupture and the explosion. These 
authors indicate that the cause was hydraulic rupture of the 
tank due to overheating in the sun. If so, the incident is 
remarkably similar to one which occurred in the same works 
5 years later, as described in Case HistoryA17. 

Stahl, Strassman and Richard (1949); J.R. Nash (1976); 
Giesbrecht et al. (1981); D.J. Lewis (1983); V.C. Marshall 
(1986 LPB 67,1987) 

All Bombay, India, 1944 

Just after 4.00 p.m. on 14 April 1944 in the Victoria Dock, 
Bombay, India, a massive explosion occurred on the muni¬ 
tions ship Fort Stikine. 
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(6) 

Figure A1.4 Wichita Falls, 1939: pipeline after the explosion: (a) aerial view showing blackening where repeated 
ruptures of the pipeline occurred; and (b) elevation view, showing broken ends of the pipeline projecting through the 
ground (Bureau of Mines) 


The ship carried some 1400 tons of mixed munitions 
(bombs, shells, torpedoes, mines, etc.). On its way it had 
picked up a cargo of cotton. In No. 2 Hold 187 tons of ammu¬ 
nition was stored with cotton bales above, then other 
material, 1089 drums of lube oil, and finally more explo¬ 
sives. This was contrary to regulations, which stated that 
cotton is liable to spontaneous combustion if contaminated 
with oil. Further notes stated that cotton and explosives 
should be stored at opposite ends of the ship and that oil 
drums stowed above cotton should be limited to 250 barrels. 

By mid-day on 14 April unloading of the ship was well 
under way. Soon after, crew on a nearby ship saw wisps of 
smoke coming from No. 2 Hold of the Fort Stikine, but did 
not inform the latter. Almost two hours passed before the 


fire was discovered. Water was applied to the hold using the 
ship’s three hoses. 

The authorities recognized the seriousness of the situa¬ 
tion and considered options such as moving or scuttling 
the ship, but both appeared impractical, since the ship’s 
engines were down for repair, there were no tugs available 
and the water was too shallow for scuttling. Moving the 
ship would also involve disconnecting the fire hoses laid 
from the dock into No. 2 Hold, which now numbered more 
than 30. 

By 3.30 p.m. although an estimated 900 tons of water had 
been poured into the hold, the port deck was too hot to walk 
on and a large patch on the side was glowing red. At 
3.50 p.m. a huge column of flame shot up from the hold and 
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at 4.06 p.m. the first massive explosion occurred. Some 
34 min later there was a second major explosion. 

The first explosion killed 60 firemen and set up fires in 
a 900 m radius. As a result of the two explosions together 
10 ships in the docks were destroyed or declared a total loss. 
Figures for the death toll differ. According to Patience (1989), 
early reports gave 350 people killed, 1800 injured and 50,000 
rendered homeless. J.R. Nash (1976) quotes 1376 dead. 

J.R. Nash (1976); Patience (1989) 

A12 Cleveland, Ohio, 1944 

At approximately 2.40 p.m. on 20 October 1944 a cylindrical 
LNG storage tank at the Liquefaction, Storage and Regasi¬ 
fication Plant of the East Ohio Gas Company at Cleveland, 
Ohio, ruptured and discharged its entire contents over the 
plant and the nearby urban area. The LNG vapour ignited 
almost immediately and an intense fire burned at the plant, 
causing great loss of life and extensive damage. 

More LNG flowed from the plant as liquid down storm 
sewers, where it mixed with air and exploded. 

The final death toll was 128 and the numbers injured 
were estimated as 200-400. The greatest loss of life 
occurred within the plant area. 

The plant was the first commercial LNG plant of its kind 
in the work. Its function was to liquefy and store natural 
gas during off-peak periods and to regasify it during peri¬ 
ods of peak demand. The LNG was stored at 5 psi and 
-250°F. The plant was built on a site which had been in the 
company’s possession for 50 years. The site was close to 
residential and industrial areas. 

The cause of the rupture is uncertain. The Bureau of 
Mines investigation (Elliott et al., 1946 BM RI 3867) con¬ 
cluded that the low carbon steel used in the construction of 
the vessel may have been unsuitable and that the failure 
may have occurred due to vibration or seismic shock. 

It was pointed out in the report that most industries 
handling liquid oxygen or air used not carbon steel but 
stainless steel or suitable non-ferrous metals. Following 
this accident, the use of the latter materials became more 
widely favoured in applications of this kind. 

The report recommended that the distance between a 
plant of this kind and the nearest inhabited building should 
be greater than half a mile. 

Following the rupture large quantities of liquid topped 
by burning vapour had flowed considerable distances from 
the tank. The report discussed the argument that a dike is 
not useful for a relatively volatile material such as LPG or 
LNG, concluded that a dike would have reduced the hazard 
and recommended that storages for liquefied gases should 
have a dike. 

The report also made a number of other recommenda¬ 
tions. These included the open siting of storage tanks to 
permit good ventilation; the use of precautions to eliminate 
sources of ignition to the standard considered necessary in 
explosives plants; the provision of remote closure for the 
bottom off-take valve; the installation of reliable level indi¬ 
cators and alarms; and the conduct of emergency drills. 

Moulton (1944); Coroner (1945); Elliott et al. (1946 BM RI 
3867); Burgoyne (1965b); Strehlow (1973b); J.R. Nash (1976) 
(under East Ohio Gas Co.); D.J. Lewis (1980); V.C. Marshall 
(1983 LPB 52,1987) 

A13 Fauld, UK, 1944 

On 27 November 1944 a huge explosion occurred in a 
munitions store at Fauld, Staffordshire. The store was 


underground in a former gypsum mine, mined on the 
‘crown and pillar’ method. The explosion involved mass 
detonation of 3500 tons of bombs. Although the store was 
in the countryside, the explosion killed 68 people and 
injured 22. It created a massive crater covering 12 acres and 
80 ft deep. 

The store handled large quantities of bombs for the 
bombing offensive. This included the repair and re-issue of 
bombs recovered after jettisoning. The personnel were 
working under considerable pressure. The inquiry found 
that the most likely cause was ignorance and disregard of 
the regulations by personnel working on jettisoned bombs. 
An armourer testified that he had seen a colleague using a 
brass chisel to remove a broken exploder from one of the 
bombs, a practice expressly forbidden. Other witnesses con¬ 
firmed that such irregularities were by no means uncommon. 

J. Reed (1977); Anon. (1992 LPB 103); VC. Marshall (1992 
LPB 105) 

A14 Port Chicago, California, 1944 
On the evening of 17 July 1944 two vessels, the Quinault 
Victory and the E. A. Bryan, were berthed at Port Chicago, 
California, taking on large quantities of cordite and TNT 
when they were rent by a massive explosion. At dawn next 
day the vessels, and the 321 men on them, had disappeared. 
The cause of the explosion was never established, although 
some authorities implicate deteriorated munitions. 

J.R. Nash (1976) 

A15 Brest, France, 1947 

On 28 July 1947 the vessel Ocean Liberty with a cargo of 
ammonium nitrate, exploded in the port of Brest, France, 
killing some 21 people. 

J.R. Nash (1976) 

A16 Texas City, Texas, 1947 

At about 8.10 a.m. on 16 April 1947 fire was observed in 
bagged ammonium nitrate fertilizer on board the ship 
Grandcamp in the harbour at Texas City. There were 
880 tons of ammonium nitrate in the hold affected and a 
further 1400 tons in another hold. Frantic efforts were made 
to extinguish the fire, but the quantity of water used initi¬ 
ally was too small and by the time hose lines had been 
connected to supply larger quantities, the fire was so well 
established that the crew was ordered to abandon the ship. 
At 9.15 a.m. the Grandcamp disintegrated with a tre¬ 
mendous thunderclap, killing all persons in the dock, 
including firemen and a crowd of spectators. 

Another ship, the High Flyer, which also had ammonium 
nitrate on board, was 700 ft away and was blown free of its 
hawsers. On account of the danger of another explosion, 
volunteers could not be found to move the High Flyer out of 
the burning area. At 6.00 p.m. ignition of its sulfur cargo 
occurred. At 1.10 a.m. the next day the High Flyer was rip¬ 
ped apart by the expected explosion. 

The report of the National Board of Fire Underwriters 
(1948) states: 

When the Grandcamp blew up, the cargo of peanuts, 
tobacco leaves, balls of sisal twine, and oil-well drilling 
equipment were blown in all directions. Shrapnel-like 
fragments of the ship were hurled in high trajectory, 
2000-3000 feet into the air; some travelled more than 
10,000 feet from the point of origin. Some of the oil-well 
drill rods (30 feet in length and 7 inches in diameter, 
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weighing close to iy 2 tons) were hurled almost 2 miles and 
buried 8 ft into the ground, like twisted hairpins.... 

It was virtually impossible to separate the effects of the 
two successive explosions, but, the report continues: 
Daybreak revealed a sickening scene of devastation- 
demolished concrete structures, masses of twisted 
wreckage, crippled refineries with battered storage 
tanks, some crumpled like tin-foil, and sidings of distant 
warehouses blown apart as if ripped by a tornado. Pitch 
black columns of smoke from the burning oil tanks 
spiralled skyward for 3000 feet or more, and were visible 
for 30 miles.They burned continuously for almost a week. 
Insurance inspection showed blast damage to over 3,300 
dwellings and 130 business buildings, to more than 600 
automobiles and some 360 box cars. Approximately 50 % 
of some 250 storage tanks, ranging from 25,000 to 80,000 
barrels capacity, were substantially damaged either by 
concussion, missile or intense fire. 

There were 552 deaths and over 3000 injuries in a 
community of some 15 000 people. 

Kintz, Jones and Carpenter (1948 BM RI4245); National 
Board of Fire Underwriters (1948); Wheaton (1948); Blocker 
(1949); Blocker and Blocker (1949); J.R. Nash (1976); VC. 
Marshall (1983 LPB 52,1987) 

A17 Ludwigshafen, FRG, 1948 

On 23 July 1948 a rail tank car containing dimethyl ether 
ruptured in the BASF works at Ludwigshafen. A vapour 
cloud formed and after some 6 s was ignited by hot work in 
a workshop. A block 230 m x 170 m was demolished and 
severe damage was done within an area 570 mx520 m. The 
death toll was 207 and the number of injured 3818. The 
casualties appear to have been confined to the works, 
the dead all being between 15 and 65 and there being very 
few women’s names listed. The official report by Stahl, 
Strassman and Richard (1949) considered four hypotheses 
for the cause of the rupture: (1) the presence of organic 
peroxides, (2) the presence of non-condensables, (3) over¬ 
heating leading to hydraulic rupture and (4) mechanical 
defects. They were able to rule out the first two and settled 
on the third: that the tank contents had been heated by the 
hot summer sun and that the tank, lacking a relief valve, 
had suffered hydraulic overpressure and rupture. This is 
the account generally given in the literature. 

This explanation has been questioned by VC. Marshall 
(1987). He points out that in order to obtain the pressure 
necessary to achieve hydraulic rupture the investigation was 
constrained to assume both that the tank was at least 4% 
smaller in volume than the norm, that this had not been 
remarked in 19 years of use and that the temperature reached 
was exceptionally high. He refers to the metallurgical analy¬ 
sis done at the time and described in the report, to the effect 
that the tank had weak spots. In addition, the tank had been 
involved the year before in an accident in which the valves 
had been knocked off. Further, the tank belonged to an 
ammonia plant and the plate giving the tare weight referred 
to the permissible filling limit for ammonia. Ammonia is 
known to cause embrittlement in some steels. The sig¬ 
nificance of the solar heating could well be that it increased 
the vapour pressure sufficiently to trigger the rupture. 

BASF (1948); Stahl, Strassman and Richard (1949); 
D.J. Lewis (1980, 1983, 1993); Giesbrecht et al. (1981); 
VC. Marshall (1986 LPB 67,1987) 


A18 Avonmouth, UK, 1951 

On 7 September 1951 a storage tank exploded at the Royal 
Edward Dock, Avonmouth, Bristol. The tank was being 
filled with gas oil from a ship. The gas oil was contaminated 
with petrol, which had leaked through a partition between 
the gas oil tank and the petrol tank, and this was known to 
those concerned. The tank was being splash filled and the 
explosion occurred as two men on the tank roof were gau¬ 
ging the level using a steel tape. The two men were killed. 

Evidently a flammable atmosphere had formed in the 
vapour space of the tank and had been ignited by a dis¬ 
charge of static electricity. The official report (H.E. Watts, 
1951) stated: ‘It was therefore quite possible for the steel dip 
tape to take up a charge of static electricity from the oil in 
the tank and to discharge it by means of a spark against the 
edge of the 10 inch manhole in the top of the tank through 
which the tape had been inserted’. 

H.E. Watts (1951); Anon. (1952); Kletz (1983 LPB 52) 

A19 Port Newark, Newjersey, 1951 
On 7 July 1951 a fire and BLEVEs devastated a large LPG 
storage at Port Newark, Newjersey. The storage comprised 
one section with 70 horizontal bullet tanks, each with a 
capacity of about 100 m 3 , and a further 30 tanks nearby.The 
tanks were not provided with thermal insulation or fixed 
water sprays. The initial event was experienced as a slight 
explosion followed by a fire. Within the next two and half 
min there were four small explosions near the seat of this 
fire, followed half a minute later by a large flash, a muffled 
explosion and a large fireball. Some 10-15 min into the 
event a BLEVE occurred. The next 100 min were punc¬ 
tuated by tank explosions and BLEVEs every 3-5 min. In 
all 73 bullet tanks were destroyed. 

The tanks were equipped with emergency isolation 
valves. Some 30 s into the event the button to close these 
valves was pressed. It was pressed again after two and a 
half min, there being some doubt whether the first time it 
had been pushed for long enough. In fact, it is estimated 
that on the side of the valves away from the tanks there was 
some 100 m 3 of LPG, mainly in a 12 in. delivery line from the 
docks and in 8 in. ring mains; thus there was potentially 
quite enough fuel to feed the fire even if the tanks them¬ 
selves were isolated. 

In many cases the BLEVEs were accompanied by fire¬ 
balls rising 750 m into the air. Many of the events registered 
on the barometer at Newark Airport, showingTNTequiva- 
lents of about 25 kg, consistent with the pressure energy in 
the vapour space of a tank. The damage done by missiles is 
described as spectacular. One large tank section 17 m long 
travelled over half a mile, demolishing a filling station and 
starting a fire. Another fragment ruptured the 12 in. 
underground water main to the site. Figure A1.5 shows one 
of the tank section missiles part buried in the ground. 

It has been suggested that a possible cause of the initial 
event was inadequate allowance for thermal expansion in 
the 8 in. ring mains. These handled propane at two different 
temperatures, the regular flows and a flow from a vapour 
recovery unit. 

NBFU and FIRONJ (1952); D.J. Lewis (1980,1993) 

A20 Bakersfield, California, 1952 
On 21 July 1952, the Paloma condensate recycling plant in 
Kern County, near Bakersfield, California, was struck by 
an earthquake. The earthquake had its epicentre about 
12 miles away, measured 7.7 on the Richter scale and had a 
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Figure A1.5 Port Newark, 1951: tank section part buried in ground (The Bettman Archive) 


maximum intensity in the range X-XI. Ground movement 
was of the order of 0.5 ft vertically and 1 ft horizontally. It 
was such as to cause a 60 ft high absorption column to 
swing at the top in an arc of 3 ft and to stretch its foundation 
bolts some 1.5 in. Figure A1.6 gives an aerial view of the 
facility following the earthquake. 

The plant had five large butane storage spheres which 
were not designed to earthquake standards. Two spheres 
collapsed with rupture of the feed lines. Butane escaped 
and formed a vapour cloud, which ignited some 90 s later 
at a transformer block. The resultant explosion and fire 
did extensive damage but there were no deaths or serious 
injuries. 

Jenkins and Oakshott (1955); D.J. Lewis (1980, 1993); 
Alderson (1982 SRD R246) 

A21 Bound Brook, NewJersey, 1952 
On 22 December 1952 a plant handling phenolic resin 
moulding powder at Bound Brook, New Jersey, was 
wracked by a dust explosion. The explosion occurred in a 
dust collector and then travelled through ducting, emerging 
at several points into floor areas, where it raised clouds of 
dusts which in turn underwent violent secondary explo¬ 
sions. The probable sequence of events was that a bearing 
in a hammer mill overheated, the powder in the mill began 
to smoulder and the smouldering powder passed into a 
flammable dust mixture in the dust collector. Five people 
were killed and 21 injured. 

NFPA (1957); D.J. Lewis (1993) 


A22 Whiting, Indiana, 1955 

On 27 August 1955 at the refinery at Whiting, Indiana, a 
reactor suffered an internal detonation and disintegrated. 
The reactor vessel was 127 ft tall x 22.5 ft diameter, having 
a wall 2.5 in. thick and weighing 500 te. A separator with a 
6 in. thick wall also fractured. The detonation has been 
estimated as having a TNT equivalent of 5.6 te. Fragments 
were thrown 1500 ft, one of 60 te landing on the tank farm 
and another killing a boy at home. The event started a fire 
which eventually covered 40 acres and lasted for 8 days. 
There was the one death just mentioned. 

The event occurred in the course of start up of a hydro¬ 
former unit. The start up procedure involved the circula¬ 
tion through the reactor and separator of inert gas heated in 
a furnace. Due to a valving error the gas being circulated 
was in fact a flammable mixture. In due course, the gas 
temperature at the exit of the furnace rose to 500—600°F, 
reaching the autoignition temperature. A detonation 
occurred in the reactor and another in the separator vessel. 

Woodworth (1955); R.B. Jacobs et al. (1957); Randall et al. 
(1957); R.B. Jacobs and Bulkley (1967); R.B. Jacobs et al. 
(1973); D.J. Lewis (1980,1993) 

A23 Cali, Columbia, 1956 

On 7 August 1956 eight trucks carrying dynamite exploded 
at Cali, Columbia, killing about 1100 people as they slept, 
and injured another 2000; some 500 of the dead were 
soldiers in barracks. 

Walker (1973); J.R. Nash (1976) 
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Figure A1.6 Bakersfield, 1952: recycling plant after the earthquake (The Bettman Archive) 


A24 Uskmouth, UK, 1956 

On 18 January1956 an explosion occurred on the No. 5 60 MW 
turbogenerator set at the Uskmouth power station of the 
Central Electricity Authority. The low-pressure turbine and 
generator were totally destroyed and the high-pressure tur¬ 
bine and plant severely damaged. Fragments were ejected 
with considerable force, causing damage to the turbine 
house. Two persons were killed and nine injured. The cause 
of the incident was established as machine overspeed. 

Lindley and Brown (1958) 


A25 Montreal, Canada, 1957 

On 8 January 1957, a series of BLEVEs occurred at a set of 
storage spheres at Montreal, Quebec. There were three 
spheres in a common bund: one 800 m 3 , one 1900 m 3 and 
one 2400 m 3 . The 800 m 3 sphere, which held butane, was 
overfilled due to a faulty level gauge. A vapour cloud 
formed and found an ignition source, probably at a service 
station 180 m away, and the flame flashed back to the 
sphere, where a pool fire started. After some 30 min the 
1900 m 3 sphere, which was less than 20% full, underwent 
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a BLEVE. Some 15 min later BLEVEs occurred on the other 
two spheres also. 

Selway (1988 SRD R492) 

A26 Signal Hill, California, 1958 
On 22 May 1958 an 80,000 bbl. tank serving as the feed tank 
to a viscosity-breaking unit at the refinery at Signal Hill, 
California, erupted. Steam issued, part of the roof was torn 
off and oil froth flowed out. There was no immediate igni¬ 
tion. The oil froth flowed through the plant in a wave about 
a metre high. A further eruption occurred and the froth 
ignited. Eventually it covered an area of 27 acres. The fire 
burned for 40 h. Two people were killed and 18 injured. 

The oil in the tank was at a temperature of 157° C. The 
source of the water which caused the eruption does not 
appear to be known: it may have been in the tank already or 
may have been pumped in by mistake. 

Woodworth (1958); Anon. (1959a); D.J. Lewis (1993) 

A27 Deer Lake, Pennsylvania, 1959 
On 2 June 1959 in the township of Deer Lake, Pennsylvania, 
a road tanker containing LPG slowed to a halt as a school 
bus in front stopped and was itself struck from behind by a 
truck. LPG escaped and was rapidly ignited. After some 15 
min the fire brigade arrived and were told by the driver of 
the tanker that it would be protected from explosion by its 
safety valves. They directed water and foam at a nearby 
wooden building. A crowd of spectators gathered and 
police had difficulty in moving them on. After the fire had 
burned for a time variously estimated as 20-45 min the 
tanker suffered a BLEVE. Shrubbery at a distance of 150 m 
was scorched. The tank itself travelled up the street, boun¬ 
cing off a stonewall. The tank, accompanied by stones and 
other debris, struck the main group of onlookers, killing 
most of them.There were 11 fatalities. 

Hymes (1985 LPB 65) 

A28 Meldrin, Georgia, 1959 

On 28 June 1959, a derailment occurred of a rail tank cars 
containing LPG at Meldrin, Georgia, with tank rupture and 
release of LPG. Avapour cloud formed and reached a near¬ 
by leisure park. Ignition occurred and the resultant vapour 
cloud fire caused 23 deaths. 

Anon. (1960-61); Hymes (1985 LPB 65); V.C. Marshall 
(1987) 

A29 LaBarre, Louisiana, 1961 

At about 8.15 a.m. on 31 January 1961 some 6000 USgal of 
liquid chlorine were spilled from a derailed tank car in the 
community of La Barre, Louisiana. A cloud of chlorine gas 
spread of over an area of approximately 6 square miles. For 
the most part it hung close to the ground, but in places 
‘boiled upwards’ to a height of 80—90 ft. Some 1000 people 
were evacuated. A series of determinations of the chlorine 
concentration were made by a team using mobile equip¬ 
ment. The first samples were taken at about 11.15 a.m., 
when a concentration of 10 ppm was measured at the end of 
a contaminated area some 200 yd long on a highway paral¬ 
lel to the railway. At about 3.00 p.m. a concentration of 
400 ppm was measured 75 yd from the wreck. One person 
died and about 100 were treated for exposure to chlorine. 
The fatality was an 11-month old infant in a family, which 
lived in a house approximately 50 yd from the tank car. The 
chlorine in the house made the infant choke and gasp and 
the frantic father carried it outside, where the gas con¬ 
centration was higher still. Although most of the exposure 


occurred inside the house, this exposure outside was 
probably critical. The child died in hospital. A 2-month old 
infant who remained in the house survived. 

Joyner and Durel (1962) 

A30 Berlin, New York, 1962 

On 25 July 1962, a tractor tank semi-trailer unit came off the 
road at Berlin, New York. The vehicle had failed to negotiate 
a bend, tipped over and jack-knifed. The tank hit a tree and 
its contents of some 6876 USgal of LPG were released. A 
vapour cloud formed which covered an area of some 2000 m 2 
and was 25 m high. There followed a massive vapour cloud 
fire which caused the deaths of 10 people and injured 17. 
Walls (1963-64,1964a); Kier and Muller (1983) 

A31 Doe Run, Kentucky, 1962 

On 17 April 1962 at Doe Run, Kentucky, a plant for the 
manufacture of an ethanolamine from ammonia and ethy¬ 
lene oxide suffered a major explosion. The reactor was 
supplied with liquid ethylene oxide from a 25 m 3 storage 
vessel. The reactant transfer pumps were provided with an 
interlock system but problems had been experienced with 
this system and the control had reverted to manual. A back 
flow of ammonia occurred into the ethylene oxide tank. A 
reaction took place which might have been a reaction run¬ 
away or a decomposition. The vessel ruptured, releasing a 
large quantity of ethylene oxide. The vapour cloud ignited 
immediately, giving an explosion estimated to have had a 
TNT equivalent of 16 te. It has been suggested that the 
mechanism of ignition may have been free radicals from 
the initial, internal reaction. 

Troyan and Levine (1968); D.J. Lewis (1980, 1993); 
Mahoney (1990) 

A32 Marietta, Ohio, 1962 

On 27 April 1962 at Marietta, Ohio, a benzene recycle pump 
on a phenol production unit became plugged with residue, 
and whilst attempts were being made to clear it, pressure 
built up in a stripper column. A 6 in. relief valve operated, 
discharging benzene vapour, which ignited. Missiles from 
the resulting explosion severed pipework, releasing large 
quantities of flammable liquids, which also ignited. One 
person was killed and three injured. 

Mahoney (1990) 

A33 Attleboro, Massachusetts, 1964 

On 12 January 1964, an explosion occurred in a vinyl 

chloride polymerization plant at Attleboro, Massachusetts. 

An illuminator port had been replaced on one of the 
reactors but not pressure tested. When the reactor was 
charged, a small leak developed. As the fitter was tighten¬ 
ing the clamping ring, the glass chipped and he was 
injured; the leak developed. An estimated 4.5 te of vinyl 
chloride escaped into the building, ignited and exploded 
with an estimated TNTequivalent of 17.7 te. The explosion 
broke pipework on all the 20 reactors and released some 
68 te of vinyl chloride, which ignited. There was a large 
fireball. Seven people were killed and 40 injured. 

Walls (1964b); D.J. Lewis (1980,1993); Mahoney (1990) 

A34 Niigata, Japan, 1964 

On 16 June 1964, the refinery at Niigata, Japan, suffered an 
earthquake of strength 7.7 on the Richter scale which caused 
two major fires. The first fire was the result of oil spillage 
from a floating roof storage tank. The oil was ignited by 
sparks as the roof smashed against the sides of the tank. 
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Later, a seismic tidal wave engulfed the area and unignited 
oil spread over the water. For 4 h this oil did not ignite. Six 
hour into the event an explosion occurred in another part 
of the refinery 1200 ft from the tank which was seat of the 
original fire. This second fire spread to within 350 ft of the 
first fire but the two did not merge. Two people were killed 
and 97 storage tanks were destroyed. 

Mahoney (1990) 

A35 Bow, London, 1965 

On 7 August 1965, a flour mill in Bow, London, suffered a 
dust explosion. The site of the explosion was a 15 te capac¬ 
ity metal flour bin on the third floor. Welding had been in 
progress shortly before and may have caused overheating 
of the metal and hence of the flour inside. Two major fires 
and many smaller ones broke out. Five people were killed 
and over 40 injured. 

Anon. (1967c); D.J. Lewis (1993) 

A36 Louisville, Kentucky, 1965 

On 25 August 1965 at Louisville, Kentucky, an explosion 
occurred on a plant manufacturing neoprene by poly¬ 
merization of chlorobutadiene in a compressor circulating 
monovinyl acetylene (MVA). The investigation concluded 
that a mechanical failure had caused local overheating in 
the compressor and that this had led to decomposition 
of the MVA. There followed a series of explosions, a total of 
10 occurring within 13 min and of 18 within 90 min. The 
escalation occurred due to transmission through pipework, 
flame impingement and missiles. Twelve people were killed 
and eight injured; all the deaths occurred within a radius of 
less than 100 ft from the original explosion. 

Armistead (1966,1973); Mahoney (1990); D.J. Lewis (1993) 

A37 Natchitoches, Louisiana, 1965 
On 4 March 1965, an explosion occurred on a 24 in. high- 
pressure natural gas pipeline at Natchitoches, Louisiana. 
The explosion was apparently caused by the high-pressure 
gas, there being no evidence of combustion in the pipeline. 
The splitting action of the pipe propagated the rupture 
for 27 ft along the pipe. The resultant blowout produced a 
crater 27 ft long, 20 ft wide and 10 ft deep. Three pieces of 
metal with a total weight of half a ton were hurled distances 
of 129-351 ft from the point of rupture. Within 60 s there 
followed an explosion that ‘incinerated’ an area of 13.8 
acres. Seventeen people were killed. 

FPC (1966); D.J. Lewis (1980) 

A38 Feyzin, France, 1966 

On 4 January 1966 at Feyzin refinery in France a leak on a 
propane storage sphere ignited, caused a fire that burned 
fiercely around the vessel and led to a BLEVE. 

The operator had opened two valves in series on the 
bottom of the sphere in order to drain off an aqueous layer. 
When this operation was nearly complete, he closed the 
upper valve and then cracked it open again. There was no 
flow and he opened the valve further. The blockage, which 
was presumably hydrate or ice, cleared, and propane gushed 
out, but the operator was unable to close the upper valve. He 
did not think at once to close the lower valve and by the time 
he attempted this, this valve also was frozen open. 

The alarm was raised and steps were taken to stop traffic 
on the nearby motorway. A vapour cloud about 1 m deep 
spread towards the road. It is believed that a car about 
160 m distant on the motorway may have been the source of 
ignition. It was afterwards found that its engine was not 


running but its ignition was on and it may have been stalled 
by taking in a propane-rich mixture at the air intake. 
Flames appeared to flash back from the car to the sphere 
in a series of jumps. 

The sphere was enveloped in a fierce fire. Its pressure 
relief valve lifted and the escaping vapour ignited. 

The LPG storage installation of which the sphere was a 
part consisted of four 1200 m 3 propane and four 2000 m 3 
butane spheres. The fire brigade was not experienced in 
refinery fires and apparently did not cool the burning 
sphere, presumably on the assumption that the relief valve 
would protect it. They concentrated instead on cooling the 
other spheres. About one and a half hours after the initial 
leakage the sphere ruptured, killing the men nearby. A 
wave of liquid propane was flung over the compound wall 
and flying fragments cut off the legs of the next sphere, 
which toppled so that its relief valve began to emit liquid. 

The fire at the storage spheres is shown in Figure A1.7. 
Plate 32 shows a sphere, toppled and engulfed in flames. 
Figure A1.8 shows an outline in the ground of one of the 
victims. 

The accident killed 18 people and injured another 81 
and caused the destruction of five of the spheres as well as 
other damage. 

Anon. (1966e,g,h); Kletz (1974e, 1975d, 1977d); Anon. 
(1987 LPB 77, p. 1); Selway (1988 SRD R492); Mahoney 
(1990); D.J. Lewis (1993) 

A39 LaSalle, Canada, 1966 

On 13 October 1966 at a plant at LaSalle, Canada, there was 
a runaway reaction in a styrene polymerization reactor. The 
bursting disc and dump line both operated, discharging 
material into the outside yard, creating a vapour cloud. A 
vapour fog also formed inside the building due to failure of 
a sight glass on the bursting disc vent. Ignition occurred 
and the vapour inside and outside the building exploded. 
It has been estimated that the release of styrene was 0.64 te 
and that the TNT equivalent of the explosion was 6.6 te. 
Eleven persons died. 

Fire Journal Staff (1967,1973d); D.J. Lewis (1980,1993) 

A40 Lake Charles, Louisiana, 1967 
Just before dawn at 4.45 a.m. on 8 August 1976, a cata¬ 
strophic explosion of a cloud of isobutane vapour occurred 
at the Cities Service refinery at Lake Charles, Louisiana. 
Seven people were killed and 13 injured and extensive 
damage was done. 

The escape occurred at a valve on a 10 in. isobutane 
pipeline, which ran between an alkylation unit and two 
storage spheres. The pipeline ran underground, but the 
valve was located in an open pit, which had filled with 
water from recent rain. The bolts on the valve bonnet had 
suffered severe corrosion by vapours from a leaking sulfu¬ 
ric acid pipeline nearby. 

That morning operators observed bubbles in the water 
and realized that there was a leak on the valve. An operator 
cleared the isobutane by flushing it with 110 psi water from 
the alkylation unit to sphere No. 1. He then closed the inlet 
valve on that sphere and began to open that on sphere No. 2. 
At this point the weakened valve in the pit failed and a 
geyser of water rose in the air. The operator, thinking that 
he had made an error, reversed his procedure, closing the 
valve on sphere No. 2 and opening that on sphere No. 1. 
As a result, isobutane from sphere No. 1 passed down the 
pipe and issued from the failed valve. 
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Figure A1.7 Feyzin, 1996: fire at the storage vessels (United Press International) 



The amount of isobutane which escaped was estimated 
as approximately 500 bbl. It formed a vapour cloud, which 
covered about 5 acres. The explosion had the charac¬ 
teristics of a detonation. Calculations indicated that it was 
equivalent to 10—12 tons of TNT. 


The explosion caused a major fire, which burned 
for two weeks until the flammable material had been 
used up. 

Goforth (1970); NFPA (1973); Vervalin (1973e); D.J. Lewis 
(1980,1993) 
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A41 Pernis, The Netherlands, 1968 
At 4.15 a.m. on 20 January 1968 an overflow was observed 
on slops tank 402 at the Shell refinery at Pernis. A hydro¬ 
carbon vapour cloud formed slowly over the adjacent area. 
At 4.23 a.m., after one or two smaller explosions, a violent 
explosion occurred which caused extensive blast damage 
and a large fire. The explosion was estimated to have been 
equivalent to 20 tons of TNT. The fire covered an area of 
about 250 x 300 m. Two people were killed and 85 were 
injured, mainly by flying glass. 

Slops tank 402 was a 1633 m 3 cone roof tank. Owing to 
cold weather during the previous two weeks, it had been 
necessary to heat the oil in the tank. It is believed that a 
layer of water-in-oil emulsion had built up, covering the 
coils and reducing the heat transfer from them to the oil 
layer above, so that a substantial temperature difference 
had developed between the two layers, and that vapour 
formation at the interface between the two layers initiated 
mixing, causing further vapour evolution so that the tank 
overflowed, the hydrostatic pressure at the bottom of the 
tank was reduced and violent boil-up occurred, giving the 
condition known as ‘stopover’. 

Fontein (1968); Ministry of Social Affairs and Public 
Health (1968); Wordsworth (1973); D.J. Lewis (1980,1993) 

A42 Dudgeons Wharf, London, 1969 
In 1969, an explosion occurred at Dudgeon’s Wharf, 
London, while an oil storage tank was being demolished. 
Six people were killed. 

Anon. (1970a) 

A43 Glendora, Mississippi, 1969 

At about 2.45 p.m. on 11 September 1969, a train entered Black 
Bayou junction near Glendora, Mississippi, pulling 157 rail 
cars, including eight containing vinyl chloride monomer 
(VCM). A pedestrian was struck and injured, and application 
of the emergency brake caused a derailment of 15 cars. 

At 3.30 p.m. the VCM manufacturer was informed that 
his chemical was involved and at 5.00 p.m. that the eight 
cars were derailed and that one was leaking. A technical 
expert was requested and the manufacturer sent the VCM 
plant superintendent, who had 25 years’ experience with 
the chemical. 

At about 8.00 p.m. one of the VCM tanks was ruptured 
and leaking, and by 10.00 p.m. the leak had ignited. A heavy 
fog was noticed over the area and it was considered that it 
might be VCM. The railway management consulted the 
Handbook of Hazardous Materials, which stated that phos¬ 
gene could be formed in VCM fires. They rang the company 
office, who advised that a hazard from phosgene was 
highly improbable and that the main problem was likely to 
be from HC1 and smoke. Nevertheless, the railway man¬ 
agement, the police, the National Guard and the Civil 
Defence Authorities continued to be worried by the phos¬ 
gene hazard. The Civil Defense director consulted uni¬ 
versity chemists, who advised that burning VCM would 
release phosgene, which could be a hazard to life at a 
radius of 35 miles. Accordingly, the police and National 
Guard evacuated all the towns nearby. The evacuation was 
reported as involving some 30,000 people. 

At 6.45 a.m. the next day an explosion occurred which 
demolished one of the eight VCM tank cars. The explosion 
caused a second tank car to rupture and ignite. After the 
fires were extinguished only five full tank cars were 
recovered. 


A report in The Commercial Appeal of Memphis, 
Tennessee (13 September, 1969) read Mississippi. There was 
a explosion followed by a further explosion and fireball. The 
next 40 min were punctuated by more explosions as one car 
after another burst or rocketed. The initial fireball set fire to 
buildings 200-400 ft away. Other fires were initiated by 
burning fragments up to 10 blocks distant. The blast caused 
structural damage within about 400 ft. Very little glass 
survived within about half a mile and windows broke as far 
out as 3 miles.Two people died and 976 were injured. 

Much of the damage was caused by the impact of 
rocketing tank cars and the fires which they set going. One 
37 ft section travelled through the air and bounced first at 
1000 ft distance, then bounced again at 300 ft, and again at 
200 ft, and finally went another 100 ft, before coming to 
rest at a total distance of 1600 ft, where it set fire to houses. 

At the first explosion people came out to see what was 
happening. The streets were full when the second explosion 
and fireball occurred. People became trapped between 
fences which ran parallel to the track and the towering 
fireball 200-400 ft away. There were many burn injuries, 
and many also from panic. 

It is of interest that a National Guard ordnance team, in a 
controversial procedure, successfully used shaped explo¬ 
sive charges to blow holes in two unruptured tank cars to 
prevent them exploding. 

NTSB (1969 MR); Eisenberg, Lynch and Breeding (1975) 
A45 Texas City, Texas, 1969 

On 23 October 1969 at Texas City, Texas, an explosion 
occurred inside a distillation column of a butadiene unit. 
The explosion was experienced as a two-part one, first the 
disintegration of the column and then ignition of the 
escaping gas. Numerous fragments fell within a radius of 
500 ft, some large shell fragments travelled 1500 ft and one 
800 lb section fetched up 3000 ft away. All five columns in 
the butadiene section were toppled or severely damaged. 
Thirteen people were injured. 

The column had been under total reflux. A leak occurred 
in an overhead line valve so that butadiene was lost and a 
build-up occurred of vinyl acetylene which on some trays 
reached a molar concentration of 50-60%. The internal 
explosion occurred due to thermal decomposition of vinyl 
acetylene and ethyl acetylenes. 

Freeman and McReady (1971); Jarvis (1971); Keister, 
Pesetsky and Clark (1971); Griffith and Keister (1973); 
Mahoney (1990); D.J. Lewis (1993) 

A46 Beaumont, Texas, 1970 

On 17 September 1970 at Beaumont,Texas, a 60 ftx40 ft oil 
slops tank was struck by lightning. The tank failed at the 
shell-floor seam, releasing 11,000 USgal of oil, which 
burned. The oil spread to involve in the fire another 16 
unbunded tanks nearby. 

Mahoney (1990) 

A47 Blair, Nebraska, 1970 

On 16 November 1970, an overflow occurred on a 40,000 ton 
refrigerated anhydrous ammonia storage tank at the Gulf 
Oil Company’s installation at Blair, Nebraska. 160 ton of 
ammonia was released, but there were no deaths or serious 
injuries. 

The overfilling was the result of an operator error. 
A factor which may have contributed to the error was the 
fact that the table of tank levels, or ‘strapping table’, did not 
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indicate clearly the position of the overflow pipe. In addi¬ 
tion, the high-level alarm and shut-down system failed to 
operate and apparently the overflow discharge valve also 
failed to operate at the set pressure, so that the liquid level 
in the tank rose until it reached the roof, at which point the 
overflow valve did open. There was an isolation valve on 
the overflow line directly below the relief valve. It was not 
possible to reach this valve and close it on account of the 
ammonia cloud. If isolation of the overflow line had been 
possible, much of the overflow could have been prevented. 
Once the overflow valve had opened, there was a dis¬ 
charge of ammonia to atmosphere. The discharge con¬ 
tinued for 2.5 h. 

There was almost no wind and an atmospheric inversion 
existed, so that initially the weather conditions were at 
their most unfavourable for dispersion. A low visible cloud 
of ammonia formed some 8-30 ft thick, covering approxi¬ 
mately 900 acres and extending over 9000 ft from the tank. 
The ammonia cloud shortly after the spill is shown in 
Figure A1.9. The ‘pancake’ shape of the cloud is clearly 
shown in Figure A1.9(c). Later, a light breeze arose and 
helped to keep the cloud from populated areas. 

MacArthur (1972) 


A48 Brooklyn, New York, 1970 

On 30 May 1970 a road tanker carrying liquid oxygen was 
manoeuvring in the yard of a hospital in Brooklyn, New 
York, when the tank ruptured violently. The tank was 
9.15 m 3 capacity but the tanker had just offloaded its first 
part load. The initial explosion killed the driver and one 
other person, and windows were broken some 600 ft away. 
The release of the liquid oxygen resulted in a number of 
fires. In addition to the two deaths mentioned, 30 people 
were injured. 

The tank was new and had been in service only one 
month. The investigation found that the % in thick alumin¬ 
ium tank shell had suffered appreciable loss of metal, the 
deficit being 73.5 kg for the shell and internal components. 
It further found that a chemical reaction had occurred 
between the oxygen and deposits left in a crevice between a 
bracket and the tank wall, and that this had generated 
enough heat to initiate an oxidizing reaction between the 
shell and the oxygen vapour. This reaction also had the 
effect of heating the contents and increasing the vapour 
pressure. The estimated vapour pressure attained was over 
100 bar compared with a design pressure of 15 bar. 

NTSB (1971HAR-71-06); D.J. Lewis (1993) 


A49 Corpus Ckristi, Texas, 1970 
On 3 August 1970 a refinery at Corpus Christi was hit by 
Hurricane Celia with winds of 140—160 miles/h and a 
rainfall of 6-8 in. The main structure of the catalytic 
cracker was toppled and some 30 tanks were destroyed. 

Mahoney (1990) 




A50 Crescent City, Illinois, 1970 

At 6.30 a.m. on 21 June 1970 a derailment occurred on a rail¬ 
way passing through the streets of Crescent City, Illinois. 
Nine rail tank cars loaded with LPG were among the 
derailed vehicles. The force of the derailment propelled the 
27th car in the train over the derailed cars on front and its 
coupler struck the tank of the 26th car and punctured it. 
Propane was released and ignited. 


(c) 

Figure A 1.9 Blair, 1970: ammonia cloud from storage 
tank: (a) plan view (Slater, 1978a); (b) aerial view showing 
ammonia cloud covering whole of foreground; and 
(c) ground level view showing ‘pancake’ shape of cloud 
(both Enterprise Publishing Company, Blair, Nebraska) 
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The safety valves of the other tank cars operated and 
released propane, which fed the fire. At about 7.33 a.m. the 
27th car exploded. Four fragments of the tank car were 
hurled in different directions for distances of 300,600 and 
750 ft. At about 9.40 a.m. the 28th tank car exploded, 
hurling one fragment which eventually stopped rolling at 
a distance of 1600 ft. At about 9.45 a.m. the 30th tank car 
exploded and at about 10.55 a.m. the 32nd and 33rd tank 
cars ruptured almost simultaneously. Fragments from 
these damaged the 34th and 35th tank cars and caused 
them to release propane. 

The main mechanism of damage in this incident was 
the rocketing of burning tank cars which hurled massive 
fragments and fresh fireballs up to 850 ft from the site of 
the derailment. 

The fireball produced by the contents of one of these tank 
cars, which contained 33,000 USgal (120 m 3 ) of LPG, is 
shown in Figure A1.10. The fireball was several hundred 
feet high. 

There were no fatalities, but 66 people were injured. 
There was extensive property damage. 

Watrous (1970); NTSB (1972 RAR-72-02); Strehlow 
(1973b); Eisenberg, Lynch and Breeding (1975); D.J. Lewis 
(1980,1991LPB101,1993). 


A51 Linden, New Jersey, 1970 

On 5 December 1970 in a refinery at Linden, New Jersey, 
local overheating in a hydrocracker unit caused an explo¬ 
sive failure of the 7 in. thick vessel. Severe damage was 
done to plant over a 300 yard radius, including a catalytic 
cracker and crude pipe still, where the control room roof 
collapsed. Shut-down of the other units was effected from a 
blast resistant control room, which suffered minor damage. 
Forty persons were injured. 

Mahoney (1990) 

A52 Port Hudson, Missouri, 1970 
At 10.07 p.m. on 9 December 1970, an abnormality occurred 
at a pumping station at Villa Ridge, 15 miles downstream 
from Port Hudson, Franklin County, Missouri. At 10.20 p.m. 
there was a sudden increase in throughput at the next up¬ 
stream pumping station at Rosebud, indicating a major line 
break. The pipeline failure had occurred near Highway C 
on high ground and the gas cloud flowed down a sparsely 
inhabited valley. 

At approximately 10.25 p.m. several witnesses became 
aware of the noise of the escaping jet of propane. Aplume of 
white spray, which was presumably drops of propane and 
of atmospheric moisture, was seen rising 50-80 ft above 



Figure A1.10 Crescent City, 1970: fireball from rail tank car (Courtesy of Champaign Fire Department) 
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the ground. By 10.44 p.m. several families had evacuated 
their houses and had driven to Highway C, from which they 
observed the cloud. 

At approximately 10.44 p.m. the valley appeared to light 
up. Witnesses reported no observable period of flame pro¬ 
pagation but rather a sudden flash as of lightning. There 
was an almost immediate overpressure which knocked over 
one person who was walking about half a mile from the 
centre of the cloud. 

In the Bureau of Mines report on the incident, Burgess 
and Zabetakis (1973 BM RI 7752) state: We think the wit¬ 
nesses has the unusual experience of observing a gas 
detonation’. In the succeeding seconds a fire storm was seen 
to roll up the sloping terrain towards Highway C. 

At the time and place of the failure the pipeline pressure 
was believed to be about 942 psig. The amount of liquid 
propane which is estimated to have escaped in the first 
24 min is 750 bbl. 

Burgess and Zabetakis estimate that since the propane 
issued from the pipe at approximately 1°C, the fraction 
flashing off would be about a quarter, but that a further 
appreciable fraction formed drops in the 50-80 ft plume 
seen by witnesses and that these drops derived their heat of 
vaporization from the air. 

For the estimation of the concentration of propane in 
the vapour cloud Burgess and Zabetakis use the 
Pasquill—Gifford model, their work antedating the devel¬ 
opment of models for heavy gas dispersion and for complex 
terrain. Thus 

X = Xci exp j “ \ j(~) + J | [Al.10.1] 



where x, y, z are the downwind, crosswind and vertical dis¬ 
tances (ft); Q is the flow rate of propane (ft 3 /s); u the average 
wind velocity (ft/s); a y , a z are the standard deviations in the 
y, z directions (ft); x is the concentration of propane (volume 
fraction); and xa is the concentration of propane on the 
centre line (volume fraction). 

The calculation given by Burgess and Zabetakis may be 
summarized as follows. The flow rate Q of propane is 
900 ft 3 /s at STP, the wind velocity is 8 ft/s and the stability 


category may be taken as category F in the nomenclature of 
D.B. Turner (1970). The plume dispersion coefficients a y and 
o z are obtained from the graphs given by this author. The 
lower and upper detonability limits of propane in air given 
by Benedick, Kennedy and Morosin (1970) are 2.8% and 
7.0%, respectively. 

The dimensions of the detonable plume thus calculated 
are shown inTable A1.3 and in Figure Al.ll.The total volume 
of the detonable zone is estimated to be 1,100,000 ft 3 . 
Assuming that the average mixture strength is 4.9%, the 
volume of propane in the detonable zone is 54,000 ft 3 , which 
is approximately 4.2% of the total quantity released up to 
the time of ignition. About the same amount of propane is 
contained in the over-rich part of the cloud. Thus most of 
the propane is dispersed beyond the lean limit contour. 

The mass of gas in 1,100,000 ft 3 of 4.9% propane-air 
mixture at a temperature somewhat less than ambient is 
about 100,000 lb. The enthalpy release on detonation is 
260 kcal/vapour. This compares with approximately 
500 kcal/vapour for TNT. TheTNTequivalent of detonable 
gas is therefore approximately 50,000 vapour. 

Burgess and Zabetakis also present a second calculation 
which attempts to take better account of the heavier- 
than-air density of propane-air mixtures and uses the 
following relations given by Singer and Smith (1953) for 
gustiness category D: 

a, = 0.44* a71 [Al.10.3] 

tr 2 = 0.2 a y [Al.10.4] 

This calculation gives the volume of the detonateable zone 
as 1,500,000 ft 3 . 

Burgess and Zabetakis give an analysis of the blast 
damage data in both the near and far fields of the explosion. 
Estimates of the TNT equivalent of the explosion range, 
with one exception, from 97,000 to 150,000 lb in the near 
field, while an estimate in the far field is 98,000 lb. This 
compares with estimates in the range 50,000-75,000 lb of 
TNT equivalent inferred from the volume of the detonable 
cloud. 

The efficiency of explosion is calculated by Burgess and 
Zabetakis as follows. If the 750 bbl. of propane which are 
estimated to have escaped had detonated as a homogenous 
stoichiometric mixture with air, the enthalpy release would 
have been 666 x 10 6 kcal. The enthalpy of detonation of 
TNT is 10 6 kcal/ton. The explosion was equivalent to some 


Table A1.3 Calculated dimensions of detonable plume of propane formed at Port Hudson, Missouri, on 9 December 
1970 (after Burgess and Zabetakis, 1973 BM PI 7752) (Reproduced by permission of the Bureau of Mines) 
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Figure A1.11 Port Hudson, 1970: calculated dimensions of detonable plume of propane (after Burgess and Zabetakis, 
1973 BM PI 7752) (Courtesy of the Bureau of Mines) 


50 ton of TNT. Thus the explosion gave 50/666 or 7.5% of 
the maximum theoretical yield, based on combustion of the 
whole cloud. 

The source of ignition of the cloud is uncertain, but 
Burgess andZabetakis conclude thatitwasprobablylocated 
in one of a group of outbuildings enveloped in the cloud. 

The explosion caused no deaths. 

NTSB (1972 PAR-72-01); Burgess and Zabetakis (1973 
BM RI 7752); Strehlow (1973b); Eisenberg, Lynch and 
Breeding (1975); D.J. Lewis (1980,1993) 

A53 Houston,Texas, 1971 

At 1.44 p.m. on 19 October 1971,20 freight cars were derailed 
at Mykawas Station, which is 10 miles south of the centre of 
Houston,Texas. Six of the tank cars contained VCM and two 
others butadiene and acetone. Two of the VCM tank cars 
punctured. An explosion and fire occurred while the cra¬ 
shed tank cars were still moving. The two punctured tank 
cars stopped in the burning area. At 2.30 p.m. there was a 
violent explosion when one of the tanks containing some 
100,000 lb of VCM burst, hurling fragments and giving a 
large fireball. Further tank cars burst, feeding the fire and 
generating additional missiles. 

One fireman was killed and some 50 people, many of 
them firemen, were injured. The area was sparsely built 
and populated and damage was slight. 

NTSB (1972 R AR-72- 06); Eisenberg, Lynch and Breeding 
(1975); D.J. Lewis (1980) 

A54 La Spezia, Italy, 1971 

On 21 August 1971, a rollover occurred in an LNG tank at 
the SNAM LNG terminal at La Spezia, Italy. There was a 
sudden increase in pressure resulting in discharges from 
the tank safety valves and vent. The safety valves dis¬ 
charged for about 75 min and the vent discharged at a high 
rate for 3 h and 15 min. 

The incident occurred 18 h after the tank had been 
loaded from the Esso Brega. The loading had been done 
through a nozzle at the side of the bottom of the tank, with 
the heavier, hotter cargo staying on the bottom and displac¬ 
ing the lighter, colder ‘heel’ of LNG, which had remained 
in the tank. These conditions were temporarily stable, but 


over the subsequent period the density of the upper layer 
increased and that of the lower layer decreased, eventually 
inducing the rollover. One factor was that the temperature 
difference between the two layers caused the upper layer 
to heat up and to become more dense due to boil-off of 
the lighter fractions. Another factor was a failure of the 
control valve some 4 h before the rollover, which caused a 
reduction in the pressure in the tank which in turn 
increased the boil-off. 

Sarsten (1972) 

A55 Long-view,Texas, 1971 

On 25 February 1971, a y 2 in. high-pressure ethylene gas 
pipe broke in a plant near Longview, Texas, and released 
1000 lb of ethylene. The vapour cloud found a source of 
ignition and exploded. The explosion broke numerous 
other pipes and caused the release of tonnage quantities of 
ethylene. The resultant larger vapour cloud in turn was 
ignited and gave a violent explosion. 

Four people were killed and 60 were treated in hospital. 

Detailed information on the blast damage is given by 
Eisenberg, Lynch and Breeding (1975). 

Eisenberg, Lynch and Breeding (1975); Lauderback 
(1975); D.J. Lewis (1980) 

A56 Pensacola, Florida, 1971 

On 11 September 1971, a pipe ruptured on a caprolactam 
plant at Pensacola, Florida, and released about 74,000 lb of 
cyclohexane at high pressure and temperature. A dense 
white cloud of cyclohexane vapour and mist formed which 
was estimated at over 100 ft high and about 2000 ft across 
at its maximum. The wind was very calm, but picked up 
slightly after the rupture. 

The cloud was rich enough to stall two trucks enveloped 
in it from lack of oxygen. Vapour from the cloud was drawn 
into a powerhouse furnace so that the stack emitted black 
smoke. However, the cloud did not ignite and eventually 
dissipated harmlessly. 

Eisenberg, Lynch and Breeding (1975); W.B. Howard 
(1975b); D.J. Lewis (1980); Stueben and Ball (1979) Sadler 
and Matusz (1994) 
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A57 East St Louis, Illinois, 1972 

At about 6.20 a.m. on 22 January 1972, a rail tank car loaded 
with propylene collided with a stationary hopper car in the 
Alton and Southern Railway Company’s Gateway yard at 
East St Louis, Illinois. 

The tank car had come from the hump classification yard 
at overspeed. The overriding coupler of the hopper car 
punctured the tank, the propylene escaped and formed a 
large vapour cloud which then ignited and exploded. 

More than 230 people were injured and extensive 
damage was done. 

The NTSB investigation (1973 RAR-73-01) concluded 
that the accident was probably caused by the failure of the 
retarding system in the hump classification yard to 
decelerate effectively heavy tank cars with oil or grease on 
their wheel rims, by the absence of a backup system to halt 
cars passing through the retarders at overspeed and by the 
routine acceptance of such overspeeds. 

NTSB (1973 RAR-73-01); Strehlow (1973a); Eisenberg, 
Lynch and Breeding (1975); D.J. Lewis (1980) 

A58 Hearne, Texas, 1972 

At 12.30 a.m. on 14 May 1972, a rupture occurred on an 8 in. 
crude oil pipeline near Hearne, Texas. Crude oil sprayed 
into the air from a 6 in. split in the top of the pipe, showering 
the surrounding countryside with oil. The oil flowed along 
a stream beneath a railway and a highway, and collected in 
a stock pond 1800 ft from the break. 

At 5.00 a.m. the crude oil was ignited by an unknown 
source. The resultant explosion and fire killed a man and 
seriously burned two other people. An intense fire several 
hundred feet high and 1800 ft long burned on the surface of 
the oil and along the stream, at the railway, the road and the 
stock pond, and scorched the whole area. 

The quantity of oil which escaped and burned was 
7913 bbl (332,346 USgal). Some 10% of the oil was fractions 
lighter than hexane. The mode of break was such as to 
encourage the separation of these light hydrocarbon frac¬ 
tions and the formation of a flammable gas cloud. 

NTSB (1973 PAR-73 - 02); Eisenberg, Lynch and Breeding 
(1975) 

A59 Lynchburg, Virginia, 1972 

On 9 March 1972 at Lynchburg, Virginia, a tractor semi¬ 
trailer tank truck carrying LPG overturned and punc¬ 
tured. A 32 in. hole appeared and some 4000 of the load of 
9208 USgal escaped before the liquid level fell below the 
hole. A vapour cloud formed and gave rise to a fireball. 
The radius of the fireball was estimated as at least 400 ft. 
Three eyewitnesses standing beside their cars at 450 ft dis¬ 
tance were severely burned by thermal radiation but were 
not touched by the flames. Two persons died and at least 
five were injured. 

NTSB (1973 H AR-73 - 03); Eisenberg, Lynch and Breeding 
(1975) 

A60 Newjersey, Turnpike, 1972 

On 21 September 1972 on the New Jersey,Turnpike, a tractor 
semitrailer tank truck carrying 7209 USgal of propylene 
sideswiped a bus. The tractor’s fuel tank and the fittings 
on the propylene tank were damaged and fuel and propy¬ 
lene leaks occurred. A friction spark from the collision 
ignited the fuel leak and the fire spread to the propylene 
leak. After some 20-25 min the tank exploded with a huge 
fireball. Fragments of the tank rocketed: the front section, 


comprising three-quarters of the tank, was found 1307 ft 
to the north-east; the rear head was found 540 ft to the 
south-west and the rear one quarter cylindrical section 
229 ft to the south-west; tank components were mainly 
strung out in a line stretching 850 ft to the south-east. Two 
persons were killed and 28 injured. 

NTSB (1973 HAR-73 - 04); Eisenberg, Lynch and Breeding 
(1975) 

A61 Rio deJaneiro, Brazil, 1972 

On 30 March 1972, a BLEVE occurred on an LPG sphere, 
one of five, at the Duque de Caxais refinery, Rio de Janeiro, 
Brazil. An operator was engaged in draining water from 
the bottom of a 1600 m 3 sphere. He went away, leaving 
open a 2 in. drain valve. When he returned, he found that 
he could not reach the valve to turn the flow off, because 
the jet of liquid, now LPG, had created a crater in the 
crushed stone under the sphere. A vapour cloud formed, 
ignited and flashed back to the sphere. Some 15-20 min 
later the relief valve opened and the material released 
ignited. The sphere then suffered a BLEVE. Thirty-seven 
people were killed and 53 injured. The other four storage 
spheres survived. 

Mahoney (1990); Selway (1988 SRD R492) 

A62 Austin, Texas, 1973 

At 10.53 p.m. on 22 February 1973 at Austin, Texas a 10 in. 
pipeline failed and released 278,880 USgal of NGL. The 
release blew a 10 ft diameter hole in the ground and a vapour 
cloud spread over the area. Soon after 11.00 p.m. two cars 
entered the cloud and stalled; their drivers got out. Then a 
van drove into the cloud and also stalled; the passengers 
got out, whilst the driver tried to restart. A large spark 
emerged from beneath the van and flames leaped hundreds 
of feet in the air. The fire burned through the cloud and 
the eight people in it were engulfed in flames. Four died 
immediately, two later and two sustained severe burns. 

NTSB (1973 PAR-73 - 04); Eisenberg, Lynch and Breeding 
(1975) 

A63 Kingman, Arizona, 1973 

On 5 July 1973, a BLEVE and fireball occurred on a rail tank 
car containing propane at Kingman, Arizona. The upper 
surface of the tank had been heated by jet flames from a 
relief valve and coupling leak. 

The event is captured in the NFPA film ‘BLEVE’ and has 
been analysed by Crawley (1982). The tank was a ‘jumbo’ 
one and he estimates that the tank capacity was 150 m 3 but 
assumes that it was perhaps half full. He assesses the 
diameter of the fireball as 400 ft and its duration as 10-15 s. 
The estimates given by VC. Marshall (1987) are that some 
45 te of propane took part and that the fireball radius 
was 150 m. 

Despite police advice a large crowd of spectators had 
gathered and more than 90 were injured. 

Crawley (1982); Hymes (1985 LPB 65); V.C. Marshall 
(1987) 

A64 McPherson, Kansas, 1973 

At 4.30 a.m. on 6 December 1973, a major leak occurred on 
the Mid-America Pipeline System at the Conway pump 
station near McPherson, Kansas. Prior to the leak an ice 
storm had been raging for two days and the pump station 
had lost power for 18 h, although it was partially restored 
by 3.00 a.m. The pipeline had been shut-down and upon 
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start-up at 4.12 a.m. a block valve failed to open, the line 
was overpressured and burst at a point where it had already 
sustained construction damage. 

An estimated 230 tons of anhydrous ammonia escaped 
over a period of half an hour. A low, visible plume of 
ammonia formed and drifted over Highway 56, which is 
some 1000 ft to the south. The weather conditions were very 
stable with a wind speed of some 5—10 mile/h and the 
plume remained narrow. Irritation symptoms were experi¬ 
enced and odour was detectable for about 3.5 and 8 miles 
from the escape, respectively. 

The incident caused no serious casualties. Many resi¬ 
dents had moved into a nearby town on account of power 
failures caused by the severe weather. Two truck drivers 
drove into the gas cloud on the highway. They escaped and 
were kept in hospital several days. People in dwellings 
% mile south of the leak and directly in the cloud path 
were safely evacuated by the Sheriff’s office and company 
personnel. 

By 4.30 p.m. the line had been stopped. 

The same pipeline failed again on 13 August 1979 at a 
point about 22 miles from the first failure. There was a 
release of some 360 tons of anhydrous ammonia. Again 
there were no casualties, but there was a large fish kill. 

NTSB (1974 PAR-74-06); Luddeke (1975) 

A65 Potchefstroom, South Africa, 1973 
At 4.15 p.m. on 13 July 1973, a sudden failure occurred in an 
anhydrous ammonia storage vessel at the Potchefstroom 
works of TRIOMF, a company part-owned by African 
Explosives and Chemical Industries Ltd. The tank was one 
of four 50 ton horizontal pressure storage bullets. An esti¬ 
mated 30 tons of ammonia escaped from the tank itself and 
another 8 tons from a tank car. 

The failure gave rise immediately to a gas cloud some 
150 m diameter and 20 m deep. At the time of the accident 
the air was apparently still, but within a few minutes 
a slight breeze arose which caused the cloud to move 
towards a township some 200 m to the north-east. The 
visible cloud then extended some 450 m downwind and 
300 m across. 

Deaths occurred both inside and outside the factory 
fence. At the time there were some 350 persons working 
in the plant, of whom some 30 were within 70 m of the 
failed tank. One employee was killed by the blast and eight 
died while trying to escape from points within a 100 m 
radius of the tank. Three others died of gassing within a 
few days. 

Outside the factory fence four people were killed immedi¬ 
ately and two died a few days later. Thus altogether 18 
people were killed. 

The occupants of the granulation plant control room 
80 m south-east of the failure survived. They put wet 
cloths over their faces and were taken to safety after some 
30 min. 

The failures occurred in tank No. 3 while it and tank No. 4 
were being filled simultaneously from a tank car. Actuation 
of an excess flow valve on the line between the two tanks 
prevented the release of the contents of tank No. 4 also. The 
tank car did not have an excess flow valve and did suffer 
escape of material. 

The cause of the failure was brittle fracture of the dished 
end of the tank. Evidence suggested that there had been no 
overpressure or overtemperature of the tank contents and 
no other triggering event was determined. 


The tanks were designed and fabricated in accordance 
with BS1515:1965 and were fabricated and commissioned 
in 1967. The fabrication is described by Lonsdale (1975): 
The dished ends were fabricated from two plates, cold- 
formed in the major radius, and hot flanged (at 850°C) at 
the knuckle. The plates had been passed as being in 
accordance with the requirements of BS 1501-151-28A. 
The butt welds in the end plates were checked by 100% 
X-ray after forming and flanging. (Expert metallurgists 
re-examining the X-rays of the failed dished end con¬ 
sidered that two sections of the weld did not conform to 
the requirements of the BS code.) The Inspection 
Authority representative considered that conditions in 
the flanging furnace rendered subsequent heat treat¬ 
ment unnecessary. 

The completed tank was not stress-relieved because it is 
not required by BS 1515.The tanks were given an hydraulic 
test at 1% times the design pressure of 250 lb/sq in gauge. 
Late in 1971 tank No. 3 was inspected. Two weld faults and a 
crack were found and were ground out. The tank was 
hydraulically tested to 347 psig for 30 min. Following 
repairs to a leaking tank level glass isolation valve, the tank 
was hydraulically tested to 325 psig for 3-4 h. 

Metallurgical testing revealed that the metal of the 
dished end was below its transition temperature under 
normal conditions. The minimum Charpy impact testing 
transition temperatures obtained were 20°C for the frag¬ 
ment and 115°C for the remaining part of the dished end. 

Ultrasonic examination of the dished end in No. 4 tank 
revealed numerous subsurface fissures. Such fissures may 
have provided the notch from which the brittle fracture in 
No. 3 tank propagated. After this examination tank No. 4 
was withdrawn from service. 

Following the inquiry into this accident, the South 
African authorities laid down that ‘All vessels containing 
dangerous substances shall be given appropriate heat treat¬ 
ment irrespective of the (construction) code requirements.’ 
Commenting on this Lonsdale states 
Stress-relieving does not overcome fully the damage 
done by progressive cold-forming of a dished end.This is 
particularly so where seam welds have hadtobemadein 
the dished end. There is a strong case for avoiding the use 
of progressively cold-formed ends for pressure vessels 
because of the difficulty of controlling the final state of 
the metal. 

Lonsdale (1975); D.J. Lewis (1993) 

A66 StAmand-les-Eaux, France, 1973 
On 1 February 1973, a road tanker containing 19 tons of 
liquefied propane skidded and overturned on a wet road 
surface in the village of St Amand-les-Eaux. A rupture 
occurred on the tanker and propane began to escape. The 
driver of the tanker immediately took steps to stop traffic 
entering the street and to warn the population. The vapour 
cloud grew and finally exploded, causing 5 deaths and 40 
injuries. The death toll might well have been higher but for 
the prompt action of the driver in carrying out his emer¬ 
gency procedures. 

Anon. (1973j); D.J. Lewis (1980) 

A67 Staten Island, New York, 1973 
On 10 February 1973 at Staten Island, New York, an explo¬ 
sion occurred inside a large LNG storage tank in which 
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work was being done. The tank was being repaired for a 
leak in the inner membrane lining and new liner sections 
were being installed. The tank had been well ventilated 
before work began. The source of fuel for the explosion 
was identified as LNG trapped in the insulation behind 
the liner and vaporized by the heat-sealing operations 
on the new liner sections. The explosion lifted up the 
concrete roof of the tank which then fell back into it, 
crushing the men there. Forty men were killed and three 
injured. 

US Congress (1973); D.J. Lewis (1989,1993) 

A68 Aberdeen, UK, 1974 

An incident which occurred at Aberdeen on 17 January 
1974, is described by Willcock (1986) in the following terms: 
(1) Butane tanker skids on black ice. Shaken and lightly 
injured driver regains control and stops safely at nearside 
kerb; (2) Half an hour later articulated lorry skids on 
black ice, collides with tanker and shears off emergency 
discharge valve. Gas starts escaping. Second driver 
slightly injured; (3) Five minutes later yet another 
articulated lorry skids and crashes into the other two. 
One more hurt driver; (4) Police and fire brigade arrive a 
few minutes later, but before they can get organized a car, 
trying to stop at the accident, skids into the rear of the 
tanker. Impact ignites butane. 

Willcock (1986) 

A69 Chicago, Illinois, 1974 

Soon after 12.30 p.m. on Friday 26 April 1974 employees at 
the Bulk Terminals complex in the Calumet Harbor area on 
the south side of Chicago, Illinois, heard a dull thud and 
saw fumes rising from the dike of Tank 1502, which con¬ 
tained 3300 m 3 of silicon tetrachloride. BulkTerminals was 
a storage tank farm with 78 tanks ranging up to 4900 m 3 in 
size, containing products such as vegetable oils and chemi¬ 
cals. It was situated in a built-up area. 

This was the start of an incident which involved a mas¬ 
sive cloud of irritant gas in a built-up area and was to prove 
very prolonged. At times the cloud was 8-16 km long. It 
took until May 3 to stop the leak and transfer the material 
and until May 15 before emissions were finally reduced to 
tolerable levels. 

Investigation found that a pressure release valve on a 6 in. 
line leading to the tank had been inadvertently closed. A 
flexible coupling in the line burst under pressure. The 
whole piping system shifted, cracking a 3 in. line on the 
tank wall. Liquid silicon tetrachloride escaped, creating a 
cloud with formation of hydrogen chloride gas. 

The initial emergency response was confused. The 
terminal management awaited action by the owners of the 
chemical. The fire service first decided not to get involved, 
because there was no fire. Lime trucks diverted to the scene 
by the EPA with a view to neutralizing the liquid in the dike 
were refused entry to the site. 

By 3.00 p.m. the cloud was 400 m wide, 300-450 m high 
and 1600 m long. 

Two agents were considered to blanket the liquid in the 
dike: non-protein high expansion foam and No. 6 fuel oil. At 
4.10 a.m. on Saturday 27 April, foam was applied but was 
not effective. At about 9.00 a.m., fuel oil was added and 
eight truck loads of lime were tipped in. Within an hour the 
vaporization was dramatically reduced. By noon matters 
appeared to be under control with a 16-member US Army 


chemical warfare team involved in transferring the 
material from the damaged tank. 

About 8.00 a.m. on Sunday 28 April, however, heavy rain 
began to fall on the hydrogen chloride cloud. Power lines 
were rapidly corroded and sparked like a firework display. 
By 9.30 a.m. four pumps had become inoperable due to 
corrosion. Then power failure put a stop to pumping. 

The threat existed that the pipe system would suffer 
further failure and release the remaining 2300 m 3 of 
material into the dike, which had been reduced in capacity 
by the material added to it. A large pit was dug to take any 
overflow from the dike and an operation was undertaken to 
seal the leak using quick drying cement. 

On the morning Monday 29 April inspection of the pipe 
system, undertaken in the cloud with a visibility of some 
18 in., indicated that the leak had not been sealed, either 
because the application had been ineffective or because it 
had been made at the wrong point. A second concrete pour 
was undertaken and completed by 11.30 p.m. 

By the morning of Tuesday 30 April the emission had 
been greatly reduced. It took, however, another three days 
to transfer the liquid out of the tank. 

In this incident one person died, 160 were hospitalized 
and 16,000 were evacuated. 

Hoyle (1982) 

A70 Climax, Texas, 1974 

On 29 June 1974 at Climax, Texas, a derailment occurred 
which resulted in the puncture of a rail tank car containing 
liquid vinyl chloride monomer. The hole in the end of the 
tank was 4 ft x 4 ft. The vinyl chloride escaped and formed 
a vapour cloud which travelled 1600 ft to the derailed loco¬ 
motive, where it ignited. There followed a violent vapour 
cloud explosion. It was found that the cylinder head had 
been blown off the diesel engine, which fact led to the 
hypothesis that vinyl chloride had been ingested into the 
engine and that the engine explosion had been the trigger 
for the vapour cloud explosion. The contents of the rup¬ 
tured tank car continued to burn after the explosion and 
a flame played on another vinyl chloride tank car which 
suffered a BLEVE. The explosions occurred in a rail 
cutting and there were no injuries. 

Eisenberg, Lynch and Breeding (1975) 

A71 Decatur, Illinois, 1974 

On 19 July 1974, a vapour cloud exploded in the rail-shunting 
yard at Decatur, Illinois. During shunting operations, a rail 
tank car was punctured by the coupler of a boxcar into 
which it had run, the hole being some 0.3 m 2 . The tank car 
contained 69 te of isobutane, which escaped and formed a 
vapour cloud. There was a delay of 8-10 min before the 
cloud ignited. There then occurred a massive vapour cloud 
explosion which caused extensive damage. Seven people 
were killed and 349 injured. 

This vapour cloud explosion has been of some interest, 
because on the basis of the assessment of certain injury and 
damage effects, the yield of the explosion has been esti¬ 
mated as unusually, even anomalously, high. The matter 
has been considered by V.C. Marshall (1980d, 1987), who 
gives a detailed comparison between the explosions at 
Flixborough and at Decatur, and concludes that the latter 
was certainly no more severe than the former, that its yield 
has been overestimated and that it was in fact comparable 
to that in other vapour cloud explosions. He comments, 
however, that in a shunting yard the wagons serve to 
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promote turbulence and provide on their undersides 
vertical confinement. 

NTSB (1975 R AR-75 - 04); Eisenberg, Lynch and Breeding 
(1975); VC. Marshall (1980d, 1987) 

A72 Los Angeles, California, 1974 
On Saturday 17 August 1974, an explosion occurred on a 
load of organic peroxides on a semitrailer in a storage shed 
at Los Angeles, California. The load was a mixed one of 
several different peroxides, totalling 5.3 te. It had been made 
up on the Friday, but the customer had declined delivery 
before the weekend, and the semitrailer was therefore 
parked in the storage shed until the Monday. On the Satur¬ 
day smoke and flames were seen coming from the shed and 
shortly afterwards there was a tremendous explosion. The 
source of the fire is not known. There were no injuries. 

Sharry (1975); DJ. Lewis (1993) 

A73 Petal City, Mississippi, 1974 

On 25 August 1974, a new salt dome storage was being fil¬ 
led with butane when a release occurred. The capacity of 
the storage had been miscalculated with the result that the 
head of the brine being displaced fell below that equivalent 
to the gas pressure and butane issued at high velocity. A 
quantity of butane estimated as 40-90 te escaped and 
formed a vapour cloud extending 2 km. The cloud ignited 
with a small explosion, there followed a second, stronger 
explosion and the cloud then burned for 5 h. It has been 
suggested that the initial combustion and associated ther¬ 
mals promoted air entrainment into the mainly over-rich 
cloud so as to create a large elevated flammable volume 
which then exploded. Twenty-four people were injured. 

Anon. (1974n); DJ. Lewis (1993) 

A74 Antwerp, Belgium, 1975 

On 10 February 1975, an explosion and fire caused extensive 
damage at a low-density polyethylene plant at Antwerp, 
Belgium. The cause was a leak of ethylene at high pressure 
due to fatigue failure of a vent connection on the suction of a 
compressor. Six persons were killed and 13 injured. 

Mahoney (1990) 

A75 Beek, The Netherlands, 1975 

On the early morning of 7 November 1975, the start up of 
Naphtha Cracker II on the 100,000 tons per annum ethylene 
plant at the Dutch State Mines (DSM) works at Beek was 
under way. At about 6.00 a.m., the compressed gas was sent 
to the low temperature system. At 9.48 a.m., an escape of 
vapour was observed near the depropanizer. Shortly after, 
the cloud formed found a source of ignition and there was a 
massive vapour cloud explosion. 

The explosion caused extensive damage and started 
numerous fires. Fire broke out in the pipeline systems and 
Tank Farm 2. Six tanks ranging in capacity from 1500 to 
6000 m 3 within a common dike were burned out. An aerial 
viewoftheplantaftertheexplosionisshowninFigureA1.12. 

The explosion killed 14 and injured 104 people inside the 
factory, and injured three persons outside it. 

The accident was investigated by a team from the 
Ministry of Social Affairs. Their findings are given in the 
Report on the Explosion at DSM, Beek on November 1975 
(the Beek Report) (Ministry of Social Affairs, 1976). The 
investigation involved TNO and the Department of Steam 
Engineering (Stoomwesen). A separate investigation was 
carried out by the company 

van Eijnatten, (1977) 


The investigation was hampered by the destruction of 
the instrument records in the control room. Figure A1.13 
shows the state of part of the control panel. A detailed 
breakdown of the degree of damage done to the instru¬ 
mentation is given in the report. It was also difficult to 
obtain useful information from the instruments which were 
retrieved, due to lack of synchronization, use of wrong 
recorder charts, lack of ink, inconsistent colour codes and 
out-of-date instrument diagrams. 

The evidence suggested that the escape occurred due to 
low temperature embrittlement at the depropanizer feed 
drum, on and around which five fractures were found. 
Three of these were identified as secondary ruptures, but 
there were two which could have been primary failures. Two 
hypotheses were put forward. The principal one considered 
by the government team was that the initial rupture 
occurred on a 40 mm pipe connecting the feed drum to its 
safety valve. 

The function of the feed drum was to take the €3* stream 
from the bottom of the de-ethanizer and a stream from the 
condensate stripper and pass this mixed liquid and vapour 
feed to the depropanizer. If the depropanizer were fouled, 
the feed drum could give a rough cut between the C 3 
fraction and the heavier liquids. The normal operating 
temperature of the drum was 65°C. 

At the time of the start-up, the reboiler of the de-ethanizer 
column was not operating properly. Possibly the circulation 
of hydrocarbons through the reboiler was reduced by 
thickening of the liquid. In consequence, the bottom pro¬ 
duct from the de-ethanizer was a liquid at about 0°C or 
lower with a high C 2 content. Discharge of this de-ethanizer 
stream into the feed drum would give flashing and could 
result in a temperature as low as -10°C. 

Coincidentally there was a half-hour interruption in the 
flow from the condensate stripper due to a failure in the 
propylene compressor system. As a result, a layer of liquid 
containing a large proportion of C 2 s was deposited on top of 
a layer of warm C 3 + liquid in the feed drum. From the evi¬ 
dence the two layers had not mixed to any appreciable 
extent and the top layer was at about —10°C. 

The feed drum material was a carbon steel which can 
normally be used at temperatures as low as -10 to -20°C. 
The fracture occurred at an autogenic weld. With such 
welds ageing can occur which could raise the transition 
temperature possibly up to 0°C. 

An alternative hypothesis which the government team 
considered was that the rupture had been caused by explo¬ 
sion of organic peroxides which might have been formed 
from material trapped in a section of flush pipe which was 
isolated and which was found to have ruptured. 

The amount of flammable material which escaped prior 
to the explosion was estimated at about 5.5 tons of hydro¬ 
carbons, mainly propylene, There is some uncertainty, 
however, about this figure. 

The best estimate of the cloud shape from the explosion 
damage is that shown in Figure A1.14. The location of 
the damage indicated that the depth of the cloud did not 
exceed 4 m. 

The estimated time which elapsed between the rupture 
and the explosion is approximately 2 min. From eyewitness 
accounts the source of ignition was identified as the flash 
drums in Section 1. 

The quantity of flammable material which exploded was 
estimated as about 800 kg of propylene with an energy 
release equivalent to 2.2 tons of TNT. 



APPENDIX 1/44 CASE HISTORIES 



Figure A1.12 Beek, 1975: DSM works after the explosion (Ministry of Social Affairs, 1976) 


From the damage to the control room it was calculated 
that an overpressure of 0.2-0.3 bar must have acted on the 
walls. But the estimated overpressure required to cause 
the damage to the cold blowdown drum was approxi¬ 
mately 1 bar. 

The damage outside the factory was entirely breakage 
of glass. The bulk of the damage was within a radius of 
4.5 km. It was believed that the pressure at this distance 
might have been about 0.005 bar, which is sufficient to 
break thin glass. It was suggested that damage beyond 
this distance may have been due to the deflection of shock 
waves by reflecting layers in the upper atmosphere. Flying 
glass caused one of the three injuries outside the factory. 

The incident illustrates the stress created by a develop¬ 
ing emergency of this kind and the confusion liable to 
ensue. At about 9.35 a.m. the operators were engaged in 
dealing with start-up problems. One entered the control 
room and called out ‘Something has gone on CU and there’s 
an enormous escape of gas’. He was distressed and was 
rubbing his eyes. He staggered against the telephone 
switchboard. A second operator ran to the entrance and 
tried to get out, but his view was obscured by a thick mist. 


He smelled the characteristic odour of C3-C4 hydrocarbons 
and realized there must be a major leak. He gave orders for 
the fire alarm to be sounded and ran out through another 
entrance to look at the gas cloud. He was seen from another 
office by a third man, apparently terrified and pointing to a 
gas cloud near the cooling plant. 

Some witnesses stated that the fire alarm system in the 
control room failed. The investigation concluded, however, 
that the fire alarm system was in good working order before 
the explosion, but that none of the button switches for the 
fire alarm was operated. 

Another aspect of the emergency was that the telephone 
lines to DSM were partially blocked by overloading. This 
did not affect rescue work, however, because the rescue 
services had their own channels of communication. 

Ministry of Social Affairs (1976); van Eijnatten (1977); 
D.J. Lewis (1980,1993) 

A76 Eagle Pass, Texas, 1975 

At 4.20 p.m. on 29 April a Surtigas tractor tank semi-trailer 
carrying LPG on US Route 277 near Eagle Pass, Texas, 
swerved to avoid a car in front which slowed suddenly to 
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make a turn. The tank semitrailer separated from the trac¬ 
tor, struck a concrete wall and ruptured, releasing LPG. 
Witnesses described a noise like that of a violent storm, 
followed immediately by an explosion. Simultaneously, fire 
covered the area and there was then a second explosion. 

The large front section of the tank rocketed up, struck an 
elevated sign, travelled 1029 ft and struck the ground; 
bounced up and travelled 278 ft; struck and demolished a 
mobile home; bounced up again and travelled 347 ft over 
another mobile home, causing it to burst into flames and be 
destroyed; and finally fetched up 1654 ft from its starting 
point. 

Sixteen people, including the driver, were killed and 512 
suffered burns. 

NTSB (1976 HAR-76-04) 

A77 Ilford, Essex, 1975 

At 11.10 a.m. on 5 April 1975, an explosion occurred at the 
factory of Laporte Industries Ltd at Ilford, Essex. The 
explosion was in a Lurgi electrolysis plant. The plant suf¬ 
fered extensive damage and one man who was injured 
subsequently died. 

The electrolysis plant produced hydrogen for process 
use and oxygen as a waste product by electrolysis of 
potassium hydroxide solution. The investigation con¬ 
cluded that the explosion probably occurred on the oxygen 


separating drum into which hydrogen had leaked. After the 
accident the company carried out a mass balance on the 
hydrogen flows just prior to the explosion and found that no 
less than 50% was unaccounted for. 

The ingress of hydrogen into the oxygen drum was 
apparently due to corrosion/erosion in the electrolysis cells. 
The internal breakdown of the cells had probably been 
initiated some time before the accident. On 2 April a crack¬ 
ing noise was heard in the cell block, which may have indi¬ 
cated minor explosions. 

There was a system of monitoring the purity of the 
hydrogen and oxygen streams by hourly gas analyses per¬ 
formed by the process operator. The evidence suggested 
that these analyses were not always carried out and that 
assumed values were entered in the process log. One 
operator stated that he only did the analyses two or three 
times in every 12 h. 

The report on the accident by the HSE (1976b) estimated 
that on the basis of the explosion damage the 16901 oxygen 
drum contained a 13.5% hydrogen, 86.5% oxygen mixture 
and the explosion produced a shock wave equivalent to 
22 kg of TNT. It was calculated that this explosion would 
have caused an overpressure of 1.03 kPa at 220 m and of 
0.21 kPa at 660 m on an open site. 

The most powerful explosion would have been produced 
by a stoichiometric mixture of 66 %% hydrogen, 33 y 3 % 
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Figure A1.14 Beek, 1975: simplified site plan of the works showing the estimated dimensions of the vapour cloud 
(Ministry of Social Affairs, 1976. Reproduced by permission) 


oxygen. Assuming a pressure equal to the set pressure of 
the relief valve on the drum, 515 psig, this composition 
would have produced a shock wave equivalent to 90 kg of 
TNT and this was calculated to cause an overpressure of 
1 kPa at 350 m and 0.21 kPa at 1050 m. 

The factory was in an urban area with houses 180 m and 
a school 210 m from the electrolysis plant. Although on an 
open site some damage might be expected from an explo¬ 
sion of the size described at these distances, none actually 
occurred. Probably this was due to the fact that the elec¬ 
trolysis plant was housed in a building designed and con¬ 
structed to direct any blast upwards. 

HSE (1976b) 

A78 Scunthorpe, Lincolnshire, 1975 
At about 1.25 a.m. on 4 November 1975 the Queen Victoria 
blast furnace at the Appleby Frodingham works of the 
British Steel Corporation (BSC) was tapped. By about 
2.00 a.m. some 175 tons of iron had been run into the first 
torpedo ladle and the stream was diverted into the second 
ladle. Some 10-15 min later intense flames and sparks 


began to issue from the blow pipe on No. 3 tuyere. The fur¬ 
nace crew tried to keep the pipe cool by spraying it with 
water and took steps to bring the furnace off blast to allow a 
new pipe to be fitted. While this was going on, a substantial 
water leak was observed coming from the furnace, but its 
source could not be located because of the flames. The 
water ran down the casthouse floor and entered the full 
torpedo ladle. 

Just before 2.47 a.m. the shift manager’s instruction to 
remove the full ladle was passed on to the loco driver and 
shunter by traffic control. The traffic personnel were 
informed that water was running into the ladle. At 2.47 a.m. 
an explosion occurred as the ladle was moved. 

Some 90 tons of metal were ejected. Four people were 
killed and 15 injured, and a further seven died later. 

The energy of explosion was estimated from the struc¬ 
tural damage as 2.5 MJ or the equivalent of 1 lb of high 
explosive. The energy required to eject the hot metal was 
estimated to have a maximum value of 12 MJ. The thermal 
energy in the hot metal was some 10,000 times greater 
than this. 
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Investigation revealed that the water leak was probably 
due to the failure by corrosion of a steel-blanking plug on a 
cooling water pipe. Such plugs had been in use for at least 
20 years. It transpired that there was among the employees 
considerable collective experience of previous failures of 
blanking plugs, although in most cases the knowledge of 
individuals was limited. 

HSE (1976a) 


A79 Baton Rouge, Louisiana, 1976 
On 10 December 1976, a massive chlorine release occurred 
from a storage vessel at Baton Rouge, Louisiana. The vessel 
was a horizontal bullet tank 125 ft long x 11 ft diameter 
resting on a load cell weighing system. An internal explo¬ 
sion caused the vessel to fall off its supports so that it 
was pierced by a metal upstand on the ground. Over a 
period of 5.6 h 90.7 te of chlorine was released. A gas cloud 
formed described as a 42 mile long wedge, lying over the 
Mississippi river and sparsely populated areas. Ten 
thousand people were evacuated. Three persons were 
treated for minor irritation. 

The cause of the tank displacement was an internal 
explosion of a natural gas-chlorine mixture at one end of 
the vapour space in the half full tank which produced a 
liquid surge along the length of the tank so that the 
momentum of the liquid caused the tank to jump off its 
supports. The tank was normally padded with nitrogen. 
The same nitrogen system was connected to the gland seals 
of hydrogen compressors in order to exclude air from the 
hydrogen. There was in addition a natural gas system 
which could be used on the gland seal as a more economic 
alternative. Due to the cold weather trouble had been 
experienced with natural gas condensate and the nitrogen 
system was in use. At some stage the lines to the nitrogen 
and natural gas systems were open at the same time and 
natural gas at higher pressure got into the nitrogen system. 
When the plant was restarted, an explosion occurred in the 
chlorine liquefaction system. It then spread via a balance 
line to the vapour space of the chlorine tank. 

Anon. (1976n); Rees (1982); D.J. Lewis (1984b, 1993) 


A80 Geismar, Louisiana, 1976 

On May 24 1976, an explosion occurred on a large poly¬ 
glycol ether reactor. The cause is believed to have been loss 
of agitation possibly combined with failure of a tempera¬ 
ture transmitter and/or addition of insufficient catalyst. 
The explosion hurled the reactor head some 1400 ft and 
fragments ruptured a large polyglycol ether tank and sev¬ 
ered the sprinkler system riser. Unreacted ethylene oxide 
and propylene oxide and other reactor contents escaped 
and there was a major fire involving the reactor and tank 
farm areas. 

Mahoney (1990) 


A81 Kings Lynn, Norfolk, 1976 

At approximately 5.10 p.m. on Sunday 27 June 1976, an 
explosion occurred on the Clopidol plant of the Dow 
Chemical Company at King’s Lynn, Norfolk. One man was 
killed and extensive damage was done to the plant and 
the buildings. The explosion involved the detonation of 
Zoalene, a poultry feed additive. 

Some months before it has been discovered that stocks 
of Zoalene had fallen below their normal level of purity and 


it was decided to remove water, one of the main impurities, 
by drying the material in a drier on the Clopidol plant. 

The drier was provided with dust explosion protection, 
including nitrogen inerting, explosion suppression devices 
and explosion relief. 

On 25 June at 3.00 p.m. a hatch of Zoalene was charged to 
the drier. At 2.00 p.m. on 26 June the steam to the drier was 
shut off. The material was left in the drier, however, at a 
temperature of approximately 120-130°C. At 5.07 p.m. the 
following day sound was heard coming from the drier and 
the shift foreman activated the emergency procedures. 
At 5.10 p.m. the explosion occurred. 

Zoalene was known to be a reactive chemical, but, as the 
incident showed, the hazard of a change to the process 
which involved holding the material at a moderately high 
temperature for a prolonged period was not fully appre¬ 
ciated and there were no instructions for the discharge of 
the material on completion of drying. 

The accident also revealed deficiencies in the methods 
available for screening materials to detect exothermic 
reactions. Zoalene had been screened by the company 
using differential thermal analysis, but this had revealed 
no exotherm at the processing temperature. After the acci¬ 
dent samples of Zoalene were tested by RARDE using dif¬ 
ferential scanning calorimetry. Exotherms were found in 
the temperature range 248-274° C. 

Zoalene samples were also tested by the company using 
the new technique of accelerating rate calorimetry devel¬ 
oped by Dow itself. It was found that samples would self¬ 
heat to decomposition if held under adiabatic conditions at 
120-125°C. At the time of the accident the company was 
working through a programme of screening its reactive 
chemicals, but had not yet checked Zoalene. 

The investigation described in the report of the HSE 
(1977b) concluded that the explosion had been a detonation 
with an energy release of 200—300 lb of TNT, that a tem¬ 
perature of over 800°C had been reached before detonation 
occurred and that there had been an extremely rapid pres¬ 
sure rise, probably to over 10,000 psi. 

The report gives a detailed map of the locations of the 
fragments from the explosion. 

HSE (1977b) 

A82 Los Angeles, California, 1976 
On 17 December 1976, a violent explosion occurred aboard 
the tanker Sansinena at Los Angeles, California. The ship 
had offloaded a cargo of light crude oil and was loading 
Bunker C oil. It was equipped with neither a vapour 
recovery nor a cargo tank inerting system. The explosion 
is believed to have been initiated by a spark from a pump. 
The force of the explosion threw the centre section and 
the bridge onto the dockside, leaving the bow and stern 
sections afloat. 

NTSB (1978 MAR-78-06); D.J. Lewis (1984c); Mahoney 
(1990) 

A83 Plaquemine, Louisiana, 1976 
On 30 August 1976 at Plaquemine, Louisiana, the top was 
blown off a transfer oil surge tank on an ethylene oxide 
plant, causing a serious fire and damage to six reactors and 
other equipment. A leak between the shell and tube sides 
of a reactor heat exchanger had allowed air at 200 psig to 
enter the heat transfer system. 

Mahoney (1990) 
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A84 Southwest Freeway, Houston, Texas, 1976 
At about 10.45 a.m. on 11 May 1976 in Houston, Texas, a 
tractor tank semi-trailer carrying ammonia went through a 
bridge rail on the interstate highway 1-610 and fell some 
15 ft onto the South-west Freeway, US 59. The interchange 
was the busiest in the state and at the time traffic was quite 
heavy. The tank, which held 19 te of liquid anhydrous 
ammonia, burst. 

The crash was caused by the excessive speed of the 
vehicle and by sloshing of the liquid in the partially loaded 
tank. However, the speed did not exceed 54 mile/h. 

The ammonia was released and formed a visible fog. It 
was a bright sunny morning with a wind speed of 7 mile/h. 
The initial height of the cloud determined from photo¬ 
graphs was about 30 m. The cloud was observed to reach a 
width of about 300 m and a length of 600 m. One photo¬ 
graph showed a tail to the left-hand side, indicating the 
typical slumping behaviour of heavy gas. It is estimated 
that the ammonia evaporated and the cloud dispersed 
within about 5 min. The driver of the truck and five other 
people were killed, 78 taken to hospital and about another 
100 injured. Apart from the driver all the casualties were 
due to gassing. 

Anon (1976o); McMullen (1976); NTSB (1977 HAR-77- 01); 
Fryer and Kaiser (1979 SRD R152) 


A85 Breahead, Renfrew, Scotland, 1977 
On 4 January 1977, the Breahead Container Clearance 
Depot, a chemicals warehouse, was destroyed by a serious 
fire and explosions. The fire had been started inadvertently 
by boys who had built a ‘den’ beside the warehouse and had 
lit a fire to warm themselves. The explosions caused wide¬ 
spread roof and window damage within a radius of a mile. 
The warehouse had contained some 67 te of sodium chlo¬ 
rate stored in 1774 steel drums. Investigations showed that 
under intense heat this substance is capable of giving 
explosions of the severity which occurred. 

This incident drew attention to the hazard of sodium 
chlorate. It emerged that since 1899 sodium or potassium 
chlorate had been implicated in six explosions, the then 
most recent being in Hamilton, Lanarkshire in 1969 and in 
a ship in Barcelona in 1974. Subsequently there occurred in 
the United Kingdom two other warehouse explosions 
involving sodium chlorate, one on 21 January 1980 at 
Barking, Essex (HSE, 1980a) and one on 25 September 1982 
at Salford (HSE, 1983b). 

Anon. (1979i,z); HSE (1979b); Matthews (1981) 


A86 Brindisi, Italy, 1977 

On 8 December 1977, a large gas release occurred on an 
ethylene plant at Brindisi, Italy, resulting in a vapour cloud 
explosion and fire, with extensive damage. The sewers 
were unable to handle the firewater and burning hydro¬ 
carbon liquids floated on it to a depth of some 18 in. Three 
persons died and 22 were injured. 

Anon. (1977b); Mahoney (1990) 


A87 Puebla, Mexico, 1977 

On 19 June 1977 a leak occurred on one of a group of VCM 
storage bullets. A fitter had made an error in removing an 
actuator from a liquid discharge valve on the tank, taking 
out the wrong bolts so that the valve plug suddenly popped 
out, allowing an escape through the 3 in. valve body. The 


release continued for 80 min in calm conditions, the vapour 
cloud formed being 1100 ft long, 800 ft wide and 5 ft deep. 
Five minutes later the cloud caught fire and flashed back to 
the tanks. A further 5 min later one tank suffered a BLEVE. 
Three more tank explosions followed. One person was 
killed and three injured. 

DJ. Lewis (1991LPB100,1993) 


A88 Umm Said, Qatar, Persian Gulf, 1977 
On 3 April 1977, a catastrophic failure occurred on a storage 
tank at Umm Said, Qatar, in the Persian Gulf. The tank was 
a single-wall carbon steel refrigerated atmospheric tank 
holding 37,000 m 3 of liquid propane at -42°C. A wave of 
propane liquid swept over the bund, boiling on the sand. It 
entered the adjacent separation plant and was ignited. 
There was a massive fire which did extensive damage, 
burned out of control for two days and was extinguished 
only after 8 days. Seven persons were killed and 13 injured. 

Information on this incident is still hard to come by. The 
failure is said to have occurred at a weld on the tank. It is 
reported that the same weld had been responsible for a leak 
a year before in which a vapour cloud formed and travelled 
500 ft but did not ignite. 

Anon. (1977c); Whelan (1977); D.J. Lewis (1980, 1993); 
Kletz (1988 LPB 81) 

A89 Westwego, Louisiana, 1977 

On 23 December 1977, a series of explosions took place in 
the silos of a large grain elevator at Westwego near New 
Orleans, Louisiana.There were some 73 reinforced concrete 
silos 35 m high and ranging in diameter from 8 to 10 m. 
Contents included corn, wheat and soya beans. 

The first explosion, which occurred in the morning, 
caused the top 20 m of a 75 m high head house to fall onto 
an office building. Explosions continued through the 
morning. More than half the silos were completely 
destroyed and others severely damaged. The wreckage of 
some of the silos is shown in Figure A1.15. 

More than 50 people were working on the complex when 
the explosions occurred. Thirty-six persons were killed 
and ten injured. Most of the dead were in the crushed office 
building. 

The source of ignition for the first explosion has not been 
determined. At the time the relative humidity was low, 
which would be conducive both to the presence of fine dust 
suspensions and to static electricity. 

This disaster is comparable in scale for dust explosions 
with that at Flixborough for vapour cloud explosions. 

Less than a week later, on 29 December 1977, there was a 
further series of explosions in another grain elevator at 
Galveston, Texas, in which 15 people died. 

Anon. (1977p,q); Lathrop (1978); Nolan (1979): D.J. Lewis 
(1993) 

A90 Abqaiq, Saudi Arabia, 1978 
On 15 April 1978, internal corrosion of a 22 in. 500 psig gas 
transmission pipeline on a gas processing plant at Abqaiq, 
Saudi Arabia, resulted in a leak which then expanded so 
that the line parted. A vapour cloud estimated as 405 ft x 
435 ft spread through the plant. Some 7 min later ignition 
occurred at a flare 1500 ft downwind. The escaping gas is 
described as having a jet/whipping action which threw a 
22 ft pipe section 400 ft so that it struck an spheroidal storage 
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Figure A1.15 Westwego, 1977: grain silos after the explosion (United Press International) 


tank. A second vapour cloud formed and was ignited by 
the initial fire, resulting in a vapour cloud explosion. 

Mahoney (1990) 

A91 Donndlson, Iowa, 1978 

At 12.02 a.m. on 4 August 1978, a leak of liquid propane 
ignited on an 8 in. LPG pipeline of the Mid-America Pipe¬ 
line System (MAPCO) in the rural area of Donnellson, 
Iowa. The pipeline pressure was over 800 psig and the leak 
came from a 33 in. split in the pipe. The intense fire killed 
two people and severely burned three others as they fled 
their homes; one of the injured later died. Some 157,500 
USgal of liquid escaped and 75 acres were burned. 

The investigation by the NTSB (1979 PAR-79-01) found 
that the failure occurred due to a dent and gouge in the pipe 
sustained in 1962 before the line was complete combined 
with stresses created when the line was lowered 3 months 
prior to the incident. 

VC. Marshall quotes this incident as involving 435 te of 
propane and giving a fireball of 305 m radius. The NTSB 
report refers to eyewitness reports of a ‘bonfire’ and states 
that when firefighters arrived about 12.20 a.m. they found a 
towering flame 400 ft high. 

NTSB (1979 PAR-79-01); VC. Marshall (1987) 

A92 Texas City, Texas, 1978 

On 30 March 1978, a series of fires and explosions occurred 
at LPG storage spheres at Texas City, Texas. 

There were three spheres, each 800 m 3 . One of the 
spheres suffered overpressure while it was being filled, due 


to failure of a pressure gauge and also of a relief valve. It 
cracked and leaked LPG. The leak ignited giving a massive 
fireball. 

Accounts differ in their description of the events which 
followed. According to Selway (1988 SRD R492), after 
20 min a second sphere, which was only partially full, suf¬ 
fered a BLEVE. The third sphere, which was virtually 
empty, failed due to a heat-induced rupture at the top, but 
remained upright. Thus all three spheres were damaged, 
but there was only one BLEVE event. Mahoney (1990) 
states that during the 20 min following the fireball, five 
horizontal bullets and four vertical ones were damaged by 
missiles and that the other two spheres were also damaged 
in this way. The missiles started fires and hit the firewater 
storage tank and electrical fire pumps, although two diesel 
fire pumps remained operable. 

Selway (1988 SRD R492): Mahoney (1990) 

A93 Waverly, Tennessee, 1978 

On 24 February 1978, an explosion occurred of an LPG 
rail tank car at Waverly, Tennessee. Two days before, on 
22 February, a freight train conveying two LPG tank cars 
derailed. There was no immediate release. A check on the 
following day showed that both tank cars were damaged but 
no leak could be detected. Both tank cars were underneath 
box wagons and these were lifted off. On 24 February as 
preparations were in hand to transfer the contents of the 
tank cars, one of them, which had suffered a long gouge-like 
scrape along one side, suddenly ruptured into four pieces 
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and released its contents of 59.4 te of LPG. Seconds later 
the gas ignited, probably by burning equipment nearby, 
giving a fireball. There followed a fire which did extensive 
damage. Sixteen people were killed and 43 injured. 

Anon. (1978b); NTSB (1979 RAR-79-01); D.J. Lewis (1992 
LPB105,1993) 

A94 Youngstown, Florida, 1978 
At about 1.55 a.m. on the night of 26 February 1978, a freight 
train of the Atlanta and Saint Andrews Bay Railway 
derailed near Youngstown, Florida. In the derailment a rail 
tank car containing liquid chlorine was punctured when it 
struck another tank car. The approximate position of the 
tank cars following the derailment is shown in Figure A1.16. 

A chlorine gas cloud formed and moved towards State 
Highway 231, which ran parallel to the railroad at a dis¬ 
tance of 300 ft. The weather conditions were a temperature 
of 50—55°F and a light westerly wind of 2—3 knots. There 
were already some patches of fog around and drivers, used 
to foggy conditions and unable to see the colour of the cloud 
as it was night, drove into it. Three vehicles drove right off 
the road and into the ditch. One motorist said the gas was so 
thick ‘You could not see your hand in front of your face’. 
Seven motorists abandoned their cars and died while try¬ 
ing to escape, whilst an eighth drove through the cloud but 
died a short distance down the road. 

The train’s engineer at the head of the train alerted the 
conductor at the rear by radio and then tried to escape 
through the cloud; he became lost and mired in a swamp, 
being rescued 6 h afterwards. The head brakeman, who had 
been with the engineer, circled round to the highway and 
started to alert traffic. The conductor and rear brakeman 
tried to inform the railroad facility at Panama City, but it 
was not manned after midnight. They began to rouse local 
residents and notified the police; almost 30 min had elapsed 
before the first emergency call was completed. They then 
went to the highway to assist in alerting traffic. The report 
by the NTSB (1978 RAR-7807) states. 

The head and rear brakeman both imperilled their lives 
by their repeated exposure to the chlorine gas cloud to stop 
and warn motorists of the dangerous situation.Their heroic 
actions saved many people from death or serious injury. 

The emergency service evacuated people, first in a 5 mile 
and then in a 10 mile radius. 

At 9.00 a.m. aerial observation revealed a gas cloud 3 miles 
wide and 4 miles long with a maximum height of 1000 ft. 
If the wind had been in a less favourable direction, the town 
of Youngstown would have been engulfed in the cloud. 

The chlorine gas killed eight people, as mentioned, and 
injured another 50. Some 2500 people were evacuated. 

Anon. (1978k); NTSB (1978 RAR-78-07) 

A95 Bantry Bay, Eire, 1979 

At about 1.06 a.m. on 8 January 1979, the Total oil tanker 
Betelgeuse blew up at the Gulf Oil terminal at Bantry Bay, 
Eire. The ship had completed the unloading of its cargo of 
heavy crude oil. No transfer operations were in progress. 
The first sign of trouble occurred at about 12.31 a.m. when a 
sound like distant thunder was heard and a small fire was 
seen on deck. Ten minutes later this was spread aft along 
the length of the ship, being observed from both sides. The 
fire was accompanied by a large plume of dense smoke. 
About 1.06-1.08 a.m. a massive explosion occurred. The 
vessel was completely wrecked and extensive damage was 
done to the jetty and its installations. There were 50 deaths. 



Figure A1.16 Youngstown, 1978: approximate positions 
of rail tank cars after the derailment (after NTSB, 1978 
RAR-78-07) 
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The inquiry (Costello, 1979) found that the initiating 
event was the buckling of the hull, that this was immedi¬ 
ately followed by explosion in the permanent ballast tanks 
and the breaking of the ship’s back and that the next 
explosion was the massive one involving simultaneous 
explosions in No. 5 centre tank and all three No. 6 tanks. It 
further found that the buckling of the hull occurred 
because it had been severely weakened by inadequate 
maintenance and because there was excessive stress due to 
incorrect ballasting. 

The ship was an 11-year old 61,776 CRT tanker. The 
weakened hull was the result of ‘conscious and deliberate’ 
decisions not to renew certain of the longitudinals and 
other parts of the ballast tanks which were known to be 
seriously wasted, taken because the ship was expected to 
be sold, and for reasons of economy. The vessel was not 
equipped with a ‘loadicator’ computer system, virtually 
standard equipment, to indicate the loading stress. It did 
not have an inert gas system, which should have prevented 
or at least mitigated the explosions. 

At the jetty there had been a number of modifications 
which had degraded the fire fighting system as originally 
designed. One was the decision not to keep the fire mains 
pressurized. Another was an alteration to the fixed foam 
system which meant that it was no longer automatic. 
Another was decommissioning of a remote control button 
for the foam to certain monitors. 

Another issue was the absence of the dispatcher from the 
control room at the terminal. It was to be expected that had 
he been there, he would have seen the early fire and have 
taken action. 

In a passage entitled ‘Steps taken to suppress the truth’ the 
tribunal states that active steps were taken by some per¬ 
sonnel at the terminal to suppress the fact that the dis¬ 
patcher was not in the control room when the disaster 
began, that false entries were made in logs, that 
false accounts were given to the tribunal and that serious 
charges were made against a member of the Gardai (police) 
which were without foundation. 

The inquiry report gives a long list of measures which 
might have prevented or mitigated the disaster: Had the 
vessel been properly maintained... Had Total supplied 
the ship with a loadicator... Had the dispatcher in the 
Control Room observed the initiation of the disaster... 
Had the alert been raised at the beginning of the dis¬ 
aster. .. Had the tug been moored in sight of the jetty... 
Had the decision to discontinue the automatically pres¬ 
surized fire-main not been taken. .. 

3 Anon. (19791); Costello (1979); Anon. (1980a); Mahoney 
(1990) 

A96 GoodHope, Louisiana, 1979 
On 30 August 1979, a freighter collided with the butane 
barge Panama City at a jetty on the Mississippi at Good 
Hope, Louisiana, striking it amidships, severely punctur¬ 
ing at least one of its tanks and causing a fireball. Twelve 
persons died and 25 were injured. 

NTSB (1980 MAR-80-07); VC. Marshall (1987) 

A97 Mississauga, Toronto, Ontario, 1979 
At 23.52 on Saturday 10 November 1979 at Mississauga, 
Toronto, a freight train derailment led to fires, explosions 
and a chlorine gas release, in an emergency lasting 11 days. 


The train had 25 rail cars of which 19 held hazardous 
materials, in a mixed load of flammables and toxics, 
including propane, toluene, styrene, caustic soda and 
chlorine. 

The derailment occurred due to lack of lubrication of a 
plain journal axle bearing on the 33rd car, a propane tanker. 
The red-hot axle, complete with wheels, parted from the 
tank car. Some 2 km further on at a location where there was 
a road crossing and points, this vehicle became detached 
from the front portion of the train. Many of cars in the rear 
section derailed. Several tanks were ruptured and a fire 
broke out. The brakes in the front section of the train were 
applied automatically and looking back the locomotive 
crew saw a fire and a tank car rocketing off. 

There followed a series of explosions, one within a min¬ 
ute and another just after midnight at 00.10. At 00.15 a 
propane tank suffered a BLEVE in which one half travelled 
2300 ft and buried itself 20 ft into the ground. At 00.24 
another BLEVE of a propane tank car occurred. 

There was a single chlorine tank car containing 90 te of 
liquid chlorine. This tank lost part of its insulation and a 
flame impinged on the bare metal. There was an iron - 
chlorine reaction which burned a 3 ft diameter hole in 
the tank. Chlorine began to escape through the hole. The 
effect was less serious than it might have been, since the 
effect of the fire was to cause the gas to rise in the thermal 
currents. 

The emergency developed over an extended period. 
Initially the emergency services did not know what was in 
the train: the manifest was found, but it was in code. There 
was, however, a strong smell of chlorine. At 1.30 a readable 
version of the manifest was obtained, identifying the 
chlorine tank car. At 3.00 the decision was made to evacuate 
the surrounding population, an exercise which eventually 
resulted in the evacuation of 215,000 people. The holed 
chlorine tank car was identified by a helicopter survey. 

At 9.00 on Thesday 13 November an initial attempt was 
made to plug the hole in the chlorine tank car, but without 
success; a second attempt succeeded. When subsequently 
the tank was emptied, only 18 te of chlorine was recovered. 

During Thesday afternoon 143,000 people were allowed 
back home. The rest did not return until after an absence of 
six days. 

Detailed timetables of the incident itself and of the eva¬ 
cuation are given by Fordham (1981LPB 44). 

The only injuries were those caused to eight firemen by 
inhalation of the noxious gases. 

Mississauga News (1979); Amyot (1980); Grange (1980); 
Anon. (19811); Fordham (1981 LPB 44); Lane and Thomson 
(1981); DJ. Lewis (1993) 

A98 Borger, Texas, 1980 

On 20 January 1980, a refinery at Borger, Texas, suffered 
extensive damage. Details are lacking, but it appears that a 
vessel was subjected to a pressure much in excess of its 
working pressure, the relief valve operated but was inef¬ 
fective due to ice blockage and the vessel ruptured, releas¬ 
ing 34 m 3 of hydrocarbon liquids. A vapour cloud formed 
and ignited, giving a vapour cloud explosion with a TNT 
equivalent of some 15 te. The blast destroyed the alkylation 
unit and boiler plant and shut-down the whole refinery. 
Forty-one people were injured. 

The ice plug is reported as due to freezing by propane of 
water which had accumulated in the flare system. 

Mahoney (1990); D.J. Lewis (1993) 
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A99 Wealdstone, Middlesex, 1980 
About 19.15 on 20 November 1980 an escape of propane 
began from a storage vessel in the factory yard of White- 
friars Glass Ltd at Wealdstone, Middlesex. The vessel was 
a 10 te vessel which contained 5 te of propane. The night- 
watchman smelled the odorized gas, but searched first 
inside the building, until he heard a hissing sound and saw 
a white cloud about 1.2 m deep around the base of the tank. 
Meanwhile a passer-by had called the fire brigade. The 
escape lasted several hours. Some 2100 people were eva¬ 
cuated from the area. One person had to attend hospital. 

The release was caused by the removal by the works 
engineer and a fitter of three of the four bolts on an adapter 
piece on the drain valve of the tank. The valve had two 
sections. The upper, body section was bolted to the under¬ 
side of the tank. The lower, adapter section had a spigot 
which extended into the upper section and held the ring 
seals in place against the ball. In other words, the adapter 
was an essential part of the valve. 

This was not known, however, to the persons who 
removed the bolts. 

The work on the valve had occurred during the after¬ 
noon. The delay between the removal of the bolts and the 
escape was attributed by the investigators to the accumu¬ 
lation in the vessel of non-volatile, viscous residues due to 
the removal of propane as gas from the top of the tank 
over a period of at least 10 years. 

HSE (1981c) 


AlOO Montana, Mexico, 1981 

At 17.52 on 1 August 1981 a train derailment resulted in 
a massive release of chlorine near Montana, Mexico. The 
train consisted of 38 wagons, including 32 rail tank cars 
containing liquid chlorine. It was moving down a steep 
and winding valley at a 3% gradient when its brakes failed. 
The driver radioed to other trains on the single track 
to warn them, and two trains drew into loops. The train 
derailed at over 80 km/h on a bend 350 m beyond Montana 
station. 

All the chlorine tank cars were 55 short tons, say 50 te, 
capacity. The pile-up included 28 of the 32 chlorine cars. 
Most were badly damaged. One tank car lost its dished end 
and the shell was propelled 2000 m. A second was split 
along its side. A third had a 0.5 m diameter hole, probably 
the result of an iron—chlorine fire, which could well have 
resulted from ignition of the cork insulation by red hot 
brakes. Four other tank cars suffered damage to their 
valves, which were ripped off or dislodged so that they 
leaked. It is estimated that 100 te of chlorine escaped in the 
first few minutes and 300-350 te in all. 

The population of Montana was some 400 people. There 
was also a passenger train with some 300 people at the 
station. The weather conditions to be expected at the time of 
day would be a warm wind blowing up the valley, towards 
the village. The vegetation up the valley was bleached by 
the gas cloud passing up it; there was also discoloration 
some 50 m down the slope and up the sides for a vertical 
distance of about 50 m. The highest concentrations appear 
to have occurred in a strip 1000 m long x 40 m wide. Seven¬ 
teen persons died, four in the caboose of the train and 13 
from gassing. About 1000 people were received in hospital 
and 256 were detained. 

Anon. (1982 LPB 44, p. 33); Anon. (1983 LPB 52, p. 7); 
V.C. Marshall (1987) 


A101 Stalybridge, UK, 1981 

At about 23.30 on 6 September 1981, a violent explosion 
occurred at the works of Chemstar Ltd at Stalybridge. 
Failure of cooling water to the condenser of a still had 
allowed hexane vapour to issue through the vent, and the 
escaping vapour found a source of ignition. One person 
was killed and one injured. 

The investigators found that the normal water supply 
was not available, a temporary supply had been used which 
proved to be erratic and there was inadequate flow indica¬ 
tion; that the vent had not been routed to a point outside the 
building; and that the training and supervision of the 
operator were inadequate. 

HSE (1982a); Kletz (1983b) 

A102 Caracas, Venezuela, 1982 

At about 6.17 a.m. on 19 December 1982, an explosion blew 
the top off a large oil storage tank at the electricity com¬ 
pany at Caracas in Venezuela. The oil in the tank caught fire 
and burned. Firemen arrived and attempted to control the 
fire and people stood watching it. After some hours there 
was a violent boilover of the tank contents and burning 
liquid ran down the hill on which the tank stood towards 
firemen and spectators. 

The power station was owned by C. A. La Electricidad de 
Caracas and was built in 1978. The tank involved was No.8 
storage tank, which was one of two cone roof tanks each 
55 m x 17 m, the other tank being No.9. Each tank had its 
individual bund and had two forms of fire protection. One 
was a 100 mm water drench pipe which ran to the centre of 
the roof and was designed to cascade water over the roof 
and shell to prevent overheating and the other was a semi¬ 
fixed foam system with five risers. 

No.8 tank contained No.6 fuel oil and at the start of the 
incident the depth of oil was 7.5 m. It had been feeding the 
boilers for six days prior to the fire. 

At 6.15 a.m, while it was still dark, two men went up on 
the roof of No.8 tank to gauge it, and a third waited in a 
vehicle. About 2 min later the roof blew off and at the same 
time the lines within the bund were ruptured. One of the 
foam risers on the tank was damaged. The source of igni¬ 
tion is not known, but neither man had a flashlight and it is 
possible a match was lit to read the gauge line. 

It is not known if either the water or foam fire protection 
systems on No.8 tank operated. The power company had no 
fire brigade and the nearest public fire service was a half an 
hour journey away over winding roads. 

Some 8 h after the fire began a violent boilover of No.8 
tank occurred. Burning oil surrounded No.9 tank and 
flowed down the hill into the sea, but was kept from the 
power station by a concrete wall. The inrush of air lifted 
roof panels at the power station 300 m away. 

The boilover killed 40 firemen and many civil defence 
workers and spectators. 153 people are known to have died 
and 7 were missing. 

Boilover is defined by the NFPA as follows: 

Boilover shall mean an event in the burning of certain oils 
in an open top tank when, after a long period of quiescent 
burning, there is a sudden increase in fire intensity 
associated with the expulsion of burning oil from the 
tank. Boilover occurs when the residues from surface 
burning become denser than the unburned oil and sink 
below the surface to form a hot layer which progresses 
downward much faster than the regression of the liquid 
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surface. When this hot layer, called a ‘heat wave’, reaches 
water or a water-in-oil emulsion in the bottom of the 
tank, the water first is superheated and subsequently 
boils almost explosively, overflowing the tank. Oils 
subject to boilover must have components having a 
wide range of boiling points, including both light ends 
and viscous residues. These characteristics are present 
in most crude oils and can be produced in synthetic 
mixtures. 

The heat wave travels at a rate which in most crude oils is 
some 300-460 mm/hbut can be as great as 900-1200mm/h. 
Its temperature can be as high as 315°C. When water comes 
into contact with the heat wave, it vaporizes to steam with a 
volume expansion of 1700 :1 or more. 

Normally No.6 fuel oil is regarded as not being subject to 
boilover. However, it is common practice in the United 
States to blend it. It is reported that the power company’s 
specifications allowed 5-20% light fractions, that the oil 
had a flashpoint of 71°C, that it was intended to be heated 
in storage to 65°C, but that the oil return temperature 
shown by the control room records was 80°C and the 
storage temperature was 82°C. The tank high-temperature 
alarms had sounded at midnight, some 6 h prior to the 
incident. 

Garrison (1984 LPB 57); M.F.Henry (1986) 

A103 Livingston, Louisiana, 1982 
On 28 September 1982, a freight train conveying hazardous 
materials derailed at Livingston, Louisiana. The train had 
27 tank cars some of them with jumbo tanks of 30,000 
USgal. Seven tanks cars held petroleum products and the 
others a variety of substances, including vinyl chloride 
monomer, styrene monomer, perchlorethylene, hydrogen 
fluoride and metallic sodium. 

The incident developed over a period of days. The first 
explosion did not occur until three days after the crash. The 
second came on the fourth day. The third was set off delib¬ 
erately by the fire services on the eighth day. The scene is 
shown in Figure A1.17. 


Meanwhile the 3000 inhabitants of Livingston were 
evacuated. Some were not to return home until 15 days had 

One factor contributing to the derailment was the mis¬ 
application of brakes by an unauthorized rider in the engine 
cab, a clerk who was ‘substituting’ for the engineer. Over the 
previous 6 h the latter had drunk a large quantity of alcohol. 

The incident demonstrated the value of tank car protec¬ 
tion. Many of the cars were equipped with shelf-couplers 
and head shields, and there was no wholesale puncturing 
and rocketing. Tanks also had thermal insulation which 
resisted the minor fires occurring for the two or more hours 
which it took the fire services to evacuate the whole town. 

NTSB (1983 RAR-83-05); Anon. (1984t) 

A104 Bloomfield, New Mexico, 1983 
At 12.04 p.m. on 26 May 1983 at the El Paso Natural Gas 
Company’s Blanco Field Plant near Bloomfield, New Mexico, 
a gasket on a compressor failed and natural gas at 815 psig 
began to escape into the building. Two operators heard the 
noise. One tried to shut off the gas supply to the com¬ 
pressors, the other to shut-down the compressor engine. 
Before they could effect these operations, the gas ignited 
and exploded, and both were severely burned. One com¬ 
pressor was destroyed and a second severely damaged. 

The investigation by the NTSB (1983 PAR-83-04) found 
that the probable cause was improper tightening of the 
compressor head bolts and lack of procedures for, and 
training in, bolt tightening. The report gives a detailed 
discussion of the bolting problem together with guidance 
on bolt tightening. 

It also criticized the emergency response, in that there 
was a failure to effect prompt relief of the high-pressure gas 
by activating the blowdown system. 

NTSB (1983 PAR-83-04) 

A105 Bontang, India, 1983 

On 14 April 1983 on an LNG plant at Bontang, India, the 
main cryogenic heat exchanger, 141 ft long x 14 ft diameter, 



Figure A1.17 Livingston, 1982: rail tank cars burning after the crash (National Transportation Safety Board, 1983) 
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ruptured during a start-up. The shell side operating pres¬ 
sure was 25.5 psi but it was exposed to gas at a pressure in 
excess of 500 psi. The explosion gave rise to missiles and a 
fire. The flow from a pressure controller on the shell and the 
flows from relief valves on the shell and tube sides of the 
exchanger vented to a common line. The investigation 
found that a valve on this line was closed, disabling both 
the pressure control and the pressure relief. The valve in 
question had apparently been omitted from the valve 
checklist for plant start-up. 

Mahoney (1990) 

A106 Milford Haven, UK, 1983 

On 30 August 1983, a fire broke out on the roof of a large 
crude oil floating roof storage tank at the refinery at 
Milford Haven, Dyfed, Wales. The tank was 78 m diameter x 
20 m high with a capacity of 94,100 m 3 and was 59 % full. It 
stood in a very large bund with dimensions 90 m x 180 m. 
The fire took hold and a massive tank fire ensued with an 
estimated burn-off rate of 300 te/h of oil. After 12.5 h boi- 
lover occurred, thousands of tonnes of burning oil flowed 
into the bund and a fire column rose 3000 ft high. Two hours 
later there was a further boilover. 

The floating roof had developed a split which allowed 
vapours and some oil to escape onto the roof. Ignition was 
attributed to hot carbon particles from the flare. An upset 
had resulted in a large flow of hydrocarbons to the flare 
which could have dislodged particles from the stack top. 

There was a major fire fighting operation. Oil was 
pumped out from the b ottom of the burning tank at a rate of 
700 te/h. The foam supplies available on site were sufficient 
for a floating roof tank seal fire, hut not for the fully devel¬ 
oped tank fire, and supplies were sought outside. There 
were two other storage tanks at a wall-to-wall distance of 
61 m from the burning tank, and an early priority was to cool 
the outside of these and to inject foam inside. Eventually, 
after the boilovers, enough foam was obtained, some 
305 m 3 , to mount a full foam attack, first on the fire in the 
bund and then on that in the tank itself. This process lasted 
15 h with the fire fighting being done under conditions of 
extreme heat. In the boilover events, firemen were affected 
by flash burns and by dry hot air. 

A detailed timetable of the incident is given by Mumford 
(1984 LPB 57). 

Dyfed County Fire Brigade (1983); Mumford (1984 LPB 
57); Golec (1985); Steinbrecher (1986); Mahoney (1990); 
D.J. Lewis (1993) 

A107 Abbeystead, UK, 1984 

On 23 May 1984, a group of people were assembled in the 
valve house of the Lune/Wyre Water Transfer Scheme at 
Abbeystead for a presentation when there was a violent 
explosion. The explosion occurred soon after the pumping 
system had been started up. The pumps had not been run 
for 17 days and the tunnel which conveyed the water was 
not full of water, its usual condition, but had been emptied 
through a drain valve which had been opened to remove 
silt. Subsequent tests showed that during this period 
groundwater would have leaked into the tunnel at a rate of 
1000 te/d. This water contained dissolved methane, which 
mixed with the air in the tunnel. The only venting of the 
tunnel was through the grilled floor of the valve house. 
Thus when the pumps were started and water moved up the 
tunnel, the methane-air mixture was displaced and came 
up through the grill into the valve house, where it found a 


source of ignition. The explosion killed 16 and injured 28; 
all the 44 persons in the valve house itself were killed or 
injured. 

Anon. (1984pp, 1985a); Burgoyne (1985a); HSE (1985a); 
Lihou (1985 LPB 66); VC.Marshall (1987) 

A108 Cubatao, Brazil, 1984 

On 24 February 1984 just before midnight a leak of petrol 
occurred on the Petrobas pipeline passing through the 
shanty town of Vila Soca at Cubatao in Sao Paulo state, 
Brazil. The petrol caught alight and a fire devastated the 
houses. The death toll was 508. 

Vila Soca was a shanty town of some 2500 dwellings.The 
number of people living there is uncertain, but is estimated 
as 8000, perhaps even 12,000. The pipeline was 30 years 
old. For 20 years the company had protested that Vila Soco 
had been built illegally on its land, but had nevertheless 
provided water and electricity. 

A leakage from the pipeline was noticed the day before the 
fire and a resident telephoned the company. In the leak which 
led to the disaster some 700 te of petrol escaped from the 
pipeline. The spread of the flammable liquid through 
the shanty town and under the houses was aided by water on 
the ground and by a small stream. A two-minute warning 
was given but this was not enough for the inhabitants to 
evacuate. The petrol caught fire and straight away created an 
inferno. Houses burned and exploded as the petrol beneath 
them ignited. It was 45 min before the fire brigade arrived by 
which time most of the shanty town had been destroyed. 

Anon. (1984oo); Kletz (1985p) 

A109 FortMcMurray, Avaporerta, 1984 
On 15 August 1984 at Fort McMurray, Avaporerta, hydro¬ 
carbon liquids close to their autoignition temperature were 
released from a 10 in. slurry recycle oil line on a fluidized- 
bed coking unit. Avapour cloud formed and ignited almost 
at once. The fire, which did extensive damage, was fed by 
further releases of hydrocarbon liquids, the flows being 
largely under gravity but in part from pumps which could 
not be shut-down. Fire fighting was hampered by rupture 
of a 900 psig steam line supplying the compressor turbine 
drives. The failure of the recycle line was due to erosion. 
Subsequent metallurgical examination showed that an 
18 in. long section of carbon steel had been inserted in error 
into the alloy steel line. 

Mahoney (1990) 

A110 Las Piedras, Venezuela, 1984 
On 13 December 1984 in a refinery at Las Piedras, 
Venezuela, an 8 in. oil line fractured and sprayed hot oil at 
700 psi and 650°F across a roadway onto hydrogen units. 
Ignition occurred, and the ensuing intense fire led to 
rupture of a 16 in. gas line, which resulted in a massive 
jet flame, leading to further line ruptures, some of which 
occurred with explosive force. The initial failure was a 
circumferential fracture in the heat affected zone in the 
parent metal about 1.5 in. from the weld. 

Mahoney (1990) 

Alll Romeoville, Illinois, 1984 

On 23 July 1984, a column at the Lemont refinery of Union 
Oil at Romeoville, Illinois, suffered a spontaneous failure. 
The vessel was an absorption column 8.5 ft diameter x 55 ft 
high in which a propane/butane feedstock was contacted 
with methylethanolamine (MEA). Just prior to the burst, an 
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operator noticed a horizontal crack about 6 in. long at the 
10 ft level. He went up a ladder to try to shut of the inlet 
valve and then saw that the crack had grown to some 2 ft. He 
had initiated evacuation of the area when the column failed. 
The column tore apart at the 10 ft level weld and the 45 ft top 
section, weighing some 20 te, rocketed up, landing about 
975 m away on a tower carrying a 138 kV power feed line to 
the area.The tower contents, estimated as 79.5 m 3 of propane/ 
butane and 8.75 m 3 of MEA, escaped and formed a vapour 
cloud, which ignited within seconds, giving a vapour cloud 
explosion. Some 30 min later a third explosion occurred 
when a vessel in the alkylation section suffered a BLEVE 
with associated fireball and missiles. The explosions and 
fire caused extensive damage. Seventeen people were killed 
and 31 injured. 

The vapour cloud explosion disrupted the electrical 
power supply, putting out of service a 2500 USgal/min 
electrical fire pump. One of the explosions sheared off a 
fire hydrant, reducing the pressure available from the two 
2500 USgal/min diesel-driven fire pumps. A fragment 
from the BLEVE landed on a unifining unit, initiating a 
major fire there. 

The blast resistant control centre, some 400 ft from the 
absorber, suffered little structural damage. 

The absorber vessel had a history of hydrogen attack 
problems. Over the years since 1972 repairs and modifica¬ 
tions had been done, and the vessel continued in service. 

Mahoney (1990); D.J. Lewis (1993); Vervalin (1987) 

A112 Priola, Italy, 1985 

On 19 May a major fire occurred on an ethylene plant at 
Priola in Italy. A faulty temperature probe initiated isolation 
of the hydrogenation unit in the cold section, and while the 
operators were trying to re-establish control, the relief sys¬ 
tem operated. At the same time fire was observed at the base 
of the de-ethanizer column. The hydrocarbon released 
ignited and an intense fire engulfed the adjoining ethylene 
and propylene distillation columns and spread to the storage 
area. The water deluge system protecting the storage tanks 
proved inadequate due to the intensity of the fire. In due 
course a tall, vertical propane tank exploded, its top section 
rocketing up some 500 m, and just missing a gasholder. Two 
propylene tanks fell over, one on a pipe rack and the other 
against an ethylene tank. In all, five of the eight ethylene and 
propylene tanks either exploded or collapsed. 

Mahoney (1990) 

A113 Schweizerhalle, Basel, Switzerland, 1986 
On 1 November 1986, a fire broke out in Warehouse 956 at 
the Schweizerhalle (Muttenz) works of Sandoz in Basel, 
Switzerland. The warehouse held large quantities of agro¬ 
chemicals. Attempts to extinguish the fire using foam were 
ineffective and water had to he used, in large quantities. It 
was not possible to contain this water within the site and, as 
a result, 10,000 m 3 entered the Rhine carrying with it some 
30 te of chemicals, including an estimated 150 kg of highly 
toxic mercury compounds dissolved in aqueous con¬ 
centrates. The incident did severe ecological damage. 

A not dissimilar incident, though one on a much smaller 
scale, occurred at Morley, Yorkshire, in 1982, when the 
river Calder was contaminated by chemicals in water used 
in fighting a fire which had broken out in a warehouse 
storing herbicides (VC. Marshall, 1987). 

Anon. (1986v,w,y); Beck (1986); D.Williams (1986); Anon. 
(1987 LPB 75, p. 11); Stallworthy (1987) 


A114 Thessalonika, Greece, 1986 

On 24 February 1986, an oil terminal at Thessalonika, 
Greece, experienced a small fire when a oil spillage in a 
bund was ignited by hot work. The privately owned ter¬ 
minal had 12 fixed and floating roof storage tanks holding 
crude oil, fuel oil and gasoline. Over the course of seven 
days, ground fires escalated until they covered 75% of the 
terminal area and involved 10 of the tanks. The escalation of 
the initial small fire was due in large part to accumulation 
of oil from previous spillages; to leaks from flanges 
exposed to the fire, which then fed it; and to the failure of 
fire fighting efforts in the early stages. By the first day 
seven tanks were affected. 

In the course of the succeeding days, several events 
occurred which led to major escalations. On Tank 3 over¬ 
pressure caused the shell-floor seam to burst so that the 
whole contents flowed out, feeding the fire and involving 
two more tanks. Tank 8 suffered a boilover with a fireball 
300 m high and ejection of burning oil over a wide area, 
some travelling up to 150 m. The fire fighting was 
hampered, and firemen endangered, by burn-back of flame 
in areas where the oil fire had already been extinguished 
by foam. 

B. Browning and Searson (1989) 

A115 Antwerp, Belgium, 1987 

On 3 July 1987, an explosion occurred inside an ethylene 
oxide purification column at the BP Chemicals works at 
Antwerp, Belgium. The explosion was due to decomposi¬ 
tion of the ethylene oxide and was accompanied by a fire¬ 
ball, which started a number of secondary fires. These, 
together with blast and missiles, caused extensive damage. 
Fourteen people were injured. 

The investigators considered two main hypotheses for 
the cause. One was that there was a leak of ethylene oxide 
into the insulation, leading to self-heating and then igni¬ 
tion of the leak, resulting in the heating of the ethylene 
oxide in the column itself. The other was the development 
of a hot spot inside the column due to exothermic poly¬ 
merization of ethylene oxide catalysed by rust. The first 
explanation was preferred. 

Mellin (1991 LPB 100) 

A116 Grangemouth, Scotland, 1987 
In 1987, there occurred at BP plants in the Grangemouth, 
Scotland, area three incidents, which were the subject of 
investigations by the HSE (1989a). 

Incident on 13 March 1987 

On 13 March 1987, a fire occurred when a maintenance team 
broke a flange in the flare line, hydrocarbons escaped and 
were ignited. There was a quite serious fire which lasted 
some hours. Two men were killed and two injured. 

The release occurred when two fitters started to break a 
flange in order to maintain a valve (V17). As they did so, 
vapour and a little liquid came out. They queried the 
situation with the process shift supervisor, who inspected 
the site and assured them that there could only be a small 
quantity present and it was safe to continue. They did so, 
and as the last bolt was undone, the crane holding the 
spacer increased its lift, the spacer sprang upwards, and 
liquid under pressure poured out. A vapour cloud formed 
and ignited. The source of ignition was almost certainly the 
engine of a nearby diesel air compressor. 





APPENDIX 1/56 CASE HISTORIES 


It was considered that if the fire was extinguished, fuel 
might continue to issue with the potential for a vapour 
cloud explosion and that if the flame receded into the pipe, 
there might be an internal explosion. For a while, therefore, 
fuel gas was fed into the line to keep the flame alight. 

The liquid which escaped had been held in a section of 
the flare line near a knockout drum. It should have drained 
via a small bore pipe into the knockout drum, but the entry 
of the pipe was blocked. The valve on this pipe had been 
checked as open, but the possibility of blockage had not 
been taken into account. The liquid was there in the first 
place because valve V17, thought to be fully closed, was in 
fact part open. The valves suffered from build-up of pyro¬ 
phoric scale. They had no indicators showing positively the 
valve position. It is estimated that there was about 50 m 3 of 
hydrocarbons in the line at the time and that 20 m 3 may 
have escaped. 

Among the findings of the investigation were that there 
was a need for position indicators on the valves; that there 
had been inadequate planning of the work to be done; that 
the check that the flare line had been drained was ineffec¬ 
tive; that the response to the first, small leak was inade¬ 
quate; that the procedure for flange breaking was incorrect; 
that when opening lines with pyrophoric scale, air should 
be excluded positively by a nitrogen purge, rather than 
reliance placed on its exclusion by flammable gases present; 
and that the exhaust gas spark arrester was missing. There 
should have been a requirement that in breaking a flange 
sufficient bolts remain in place whilst a gradual opening is 
made using a flange spreader. 

Incident on 22 March 1987 

On 22 March 1987 an explosion occurred during the start¬ 
up of a hydrocracker unit at the Grangemouth refinery. It 
involved the disintegration of a low-pressure separator. 
One fragment from the vessel, weighing 3 te, landed on the 
foreshore 1 km away. 

Accompanied by a fireball, the explosion initiated a 
severe fire. The refinery sustained extensive damage. One 
person was killed. 

The LP separator (V306) was 3.05 m diameter x 9.1 m 
long with a design pressure of 9 bar and a calculated burst 
pressure of 50 bar. It was fitted with a 3 in. relief valve 
designed for fire relief. Its disintegration was caused by 
breakthrough of gas from the HP separator (V305) due to 
loss of level control in the base of the latter. The HP 
separator pressure was 155 bar. The plant was in start-up 
mode and the process lines onV306 were closed. 

The gas breakthrough occurred due to loss of control of 
the level at the base of the V305. The pipework taking off 
the liquid split into two lines, one passing through the valve 
on the level control loop LIC 3 -22 and the other through that 
on H 3-22. The breakthrough occurred through the LIC 
3-22 valve. This valve had been fitted with a low-level trip, 
but this had been removed in 1985. The liquid at the base of 
V305 tended to give vortices and the trip system suffered 
from spurious trips which caused production difficulties. 
There was an extra-low-level alarm, but this had been on 
for months, until the bulb failed, and was regarded as 
spurious. The two float switches were fire damaged, but 
there was evidence that one had been incorrectly assem¬ 
bled and that on the other the small bore piping was 
blocked. The operators tended to place more reliance on 
the measurement provided by a nucleonic level gauge. 
However, this gauge had a zero error, showing a 10% 


reading when the true reading was zero. An audit had 
shown that there was a problem in control of the level on 
the vessel. In the shift in which the incident occurred valve 
LIC 3-22 was opened manually at least three times. Just 
before the explosion, it was opened again, and the level was 
lost. The HSE report states: 

The refinery had procedures for routine monitoring of 
interlocks, alarms and trips, but on the checklist for the 
hydrocracker some were omitted. The detection, trip and 
alarm systems for extra-low level in V305, had been 
inoperative for a long time and maintenance staff and 
operators presumed that these were no longer required. 
Training of new operators carried out by experienced 
operators helped to perpetuate this misconception. 
Although the refinery chief instrument engineer noted 
in 1985 that the LIC 3-22 trip solenoid had been dis¬ 
connected, this was not followed up. (paragraph 89) 

The report states that there should have been both a high- 
integrity trip system for level control and a pressure relief 
system capable of handling the maximum anticipated 
gas flow and that fuller consideration should have been 
given to proposals to make modifications to the plant. 

It emerged that there had been a previous incident on 
V305 which was probably a gas breakthrough, but on that 
occasion the process valves on V306 were open. 

The force of the blast was mainly downwards, while the 
fragments travelled upwards. The TNT equivalent of the 
explosion was estimated as 90 kg. 

Major problems were experienced in the fire fighting. 
Within 12 h 31 foam and water streams were discharging 
at a rate of 12,000 USgal/min. The drains were unable to 
cope with this flow. Hydrocarbons bubbled up in other 
parts of the site and floated on the water. The situation was 
exacerbated by large quantities of heavy, waxy material 
which caused blockages. 

Incident on 11 June 1987 

On 11 June 1987 at Dalmeny, near Grangemouth, a fire broke 
out during sludge cleaning work by a contractor in a stor¬ 
age tank, and one man died. The men had airline breathing 
apparatus (BA) to protect against toxics, but there was no 
mechanical ventilation and no regular monitoring of the 
atmosphere. The sludge had a flashpoint of less than 0°C. It 
transpired that the fire broke out when one man, who had 
taken off his BA, dropped a cigarette end. 

The investigation revealed that there were a number of 
deficiencies in the arrangement of the contract with the 
contractor and in the conduct of its personnel. The con¬ 
tractor was a specialist one, well known, considered com¬ 
petent and already working on site. There was no written 
procedure for the work. There was inadequate enforcement 
of the ‘no smoking’ rule, and some contractor’s personnel 
had not received the BP refinery rules booklet. Also 
inadequate was enforcement of the use of the BA. There 
was no lighting inside the tank and men discovered they 
could see better if they took the BA off. The team worked 
largely unsupervised. They wore the BA when entering and 
leaving the tank, and evidently also when the supervisor 
was about to visit, but some did not wear it all the time. 
The supervisor himself had on occasion removed his BA 
inside the tank to give verbal instructions. 

Anon. (1988c,d); Anon. (19871); Anon. (1989b); Anon. 
(1989 LPB 89, p. 13); HSE (1989a); Kletz (1989b); Mahoney 
(1990); KXWilson (1990a,b); D.J.Lewis (1993) 
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A117 Pampa, Texas, 1987 

On 17 November 1987 at Pampa, Texas, a vapour cloud 
explosion occurred on a plant for the liquid phase oxidation 
of butane to acetic acid and acetic anhydride using air at 
about 700 psig. There were three reactors with a capacity of 
38 m 3 . During the start up of one reactor a rupture or 
explosion occurred in the line taking the air to the reactor or 
in the reactor manifold, and butane and acetic acid flowed 
out. The vapour cloud which formed was ignited by gas- 
fired boilers some 60 m away, the delay before ignition 
being about 10 s. The resultant explosion did extensive 
damage. One aspect of this was that the blast severed 
piping in many of the sprinkler systems and also ruptured 
the underground fire water main, rendering the water 
pressure inadequate for its purpose. Three people were 
killed and 37 injured. 

Mahoney (1990); D.J. Lewis (1993) 

A118 Port Herriot, Lyon, France, 1987 
On 2 June 1987, the Shell depot at Port Edouard Herriot, 
near Lyon, France, with some 76 tanks, experienced a 
severe fire. Two persons were killed and eight injured. 

At the time of the account quoted the cause of the incident 
was not established. It states that at the relevant time of 13.15 
work was in hand on an electric cable for welding equipment 
and that the power was off but due to be switched on again 
at 13.30. The initial event was the formation of a spray in 
the area of the pumps. There was then a flash. 

There followed a series of explosions and fires. Twelve 
minutes into the event a tank holding 250 m 3 rocketed up 
200 m and fell outside the compound. There was a rapid 
escalation with five further tanks rocketing and falling 
inside the depot. Tank 6 exploded in what was probably a 
boilover. The associated fireball was 450 m high and 200 m 
‘wide’. During the night the fire progressed further. 

The extent of the escalation was attributed in large part 
to the fact that the tanks were old, and did not have a rup¬ 
ture seam in the roof, so that they tended to burst at the 
base, releasing the whole contents. 

Control of the fire was not achieved until 11.00 on 3 June 
after two heavy duty foam monitors, each of 6 m 3 /min 
capacity, obtained from outside, had been brought into play 
at 6.30. Among the conclusions drawn in respect of fighting 
such a fire were that the temperature of the wall of the 
vapour space of a tank engulfed in fire can rise within 2 min 
to 500°C, above the autoignition temperature for many 
flammable mixtures; that water cooling used while the 
foam attack is being prepared may be ineffective and may 
cause severe degradation of structures; that 4-hour fire 
insulation may not be sufficient; that concrete bunds may 
not last out and that earth mounds are preferable; and that 
an effective foam attack requires heavy duty equipment 
capable of 4-6 m 3 /min. 

Another conclusion was the need to review the fire per¬ 
mit system: the number, the nature and relations between 
the permits. 

Mansot (1989) 

A119 Ras Tanura, Saudi Arabia, 1987 
On 15 August 1987, a leak occurred on a gas plant at 
Ras Tanura, Saudi Arabia. There were two parallel gas 
fractionation trains with propane feed. Prior to the incident 
there had been a number of power interruptions which 
caused shut-down of one or other of the plants. It is believed 
that a leak of propane developed in one train, the probable 


source being a flange on a 4 in. relief line and that the 
release continued for about half an hour. A large vapour 
cloud formed and ignited. The ignition was probably from a 
security vehicle which had stalled and was being restarted. 
Severe damage was caused. 

Mahoney (1990) 

A120 Floreffe, Pennsylvania, 1988 
On 2 January 1988, an oil storage tank of the Ashland Oil 
Company at Floreffe, Pennsylvania, suffered catastrophic 
failure during its initial filling. The tank was a 120 ft dia¬ 
meter x 48 ft high cone roof tank. It was 40 years old and had 
been dismantled at a former site and re-erected. The failure 
was a sudden rupture. The force of the fluid spurting out 
one side caused the tank to move 100 ft backwards off its 
foundations. Some 92,400 bbl of diesel fuel were spilled.The 
oil overflowed the bund and much of it went into the river. 

The investigation found that the rupture occurred due to 
low temperature embrittlement initiated at a flaw in the 
tank shell base metal, about 20 cm up from the bottom. The 
flaw had been created by an oxyacetylene cutting torch and 
had been there since the initial fabrication. The actual 
fracture was in the shell base metal; it did not follow the 
welds but crossed them. In its previous service, the tank 
had stored heated product, while in its new service the 
product was not heated. It was the first time that in its new 
service the tank had been filled to maximum capacity in 
cold weather. 

Prokop (1988); Mahoney (1990); Wilkinson (1991 SRD 
R530); Mellin (1992 LPB106) 

A121 Norco, Louisiana, 1988 

On 5 May 1988, an explosion occurred on a catalytic cracker 
at the refinery at Norco, Louisiana. There was a rupture, 
due to internal corrosion, on an 8 in. elbow in the depropa¬ 
nizer overhead piping, which released 9 te of hydrocarbons. 
Avapour cloud formed and after about 30 s found a source 
of ignition, probably the FCC charge heater. The resultant 
vapour cloud explosion did extensive damage and caused 
immediate failure of all utilities. It put out of action fire¬ 
water and the four diesel fire pumps, and for several hours 
the fire fighting effort was limited. Some 20 major vessel or 
line failures occurred. Analysis of bolt stretch on columns 
indicated an overpressure up to 10 psi. Seven people were 
killed and 28 injured. 

Mahoney (1990); D.J.Lewis (1993) 

A122 Antwerp, Belgium, 1989 

On 7 March 1989, the BASF ethylene oxide plant at 
Antwerp experienced two explosions, each with a fireball. 
The first occurred in column K303, separating ethylene 
oxide and acetaldehyde, which disintegrated. The pipe¬ 
work on another column, K302, fractured, so that the col¬ 
umn depressurized and flame flashed back into it, causing 
a second internal explosion, separated from the first by 26 s. 
The blast, missiles and secondary fires caused extensive 
damage. Five people were injured. 

The investigation found that low cycle fatigue had caused 
a hairline crack in a welded seam on piping to a level indi¬ 
cator system, resulting in a small leak of ethylene oxide. 
This led to an accumulation of auto- oxidizable polyethylene 
glycols in the insulation. Removal of the metal covering of 
the insulation allowed self-heating to proceed. The insula¬ 
tion reached a temperature which was sufficient to cause 
decomposition of ethylene oxide stagnant in the piping 
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of the level control system, though it would not have been 
enough to overcome the cooling effect of flowing vapour. 

Mahoney (1990); Kletz (1990e); Anon. (1991LPB100, P. 1) 

A123 Baton Rouge, Louisiana, 1989 
On 24 December 1989, an explosion occurred in a refinery 
at Baton Rouge, Louisiana. An 8 in. diameter pipeline 
ruptured, releasing a mixture of ethane and propane. A 
record low temperature (10°F) may have contributed to the 
failure. The escaping vapour found a source of ignition and 
there was a vapour cloud explosion. The explosion rupt¬ 
ured a pipe band containing some 70 lines. These included 
lines for power, steam and firewater, and there was a partial 
loss of all these utilities. The extensive fire involved two 
large storage tanks, 12 small tanks and two separator units. 

Mahoney (1990) 

A124 Jonova, Lithuania, 1989 

On 20 March 1989, a refrigerated atmospheric ammonia 
tank failed at Jonova, Lithuania, leading to both a toxic 
release and a fire of ammonia as well as fire in a fertilizer 
store. Seven people were killed and 57 injured. 

The tank was 29 m diameter x 20 m high of single wall 
construction with perlite insulation held in place by 
an outer steel shell and with a surrounding 14 m high 
reinforced concrete wall. It had a capacity of 10,000 m 3 and 
at the time held 7000 te of liquid ammonia at -33°C. 
The capacity of each of the two pressure relief valves was 
4200 m 3 /h. The site also had two fertilizer stores, one for 
15,000 te and one for 20,000 te as well as one for 20,000 te 
of ammonium nitrate. 

The rupture was sudden and the force of the release 
caused the tank to move sideways from its base, smash 
through the concrete wall and fetch up 40 m away, leaving 
its bottom still on the foundations. The devastation around 
the tank was severe. The escaping liquid ammonia formed 
a pool which in places was 0.7 m deep. The vapour above the 
pool suddenly caught fire and the whole area was engulfed 
in flames. The fire set alight material on a conveyor belt to 
the 15,000 te store of NPK fertilizer, a ‘cigar burning’ 
material. The burning conveyor fell into the store and initi¬ 
ated a self-sustaining decomposition. 

After 12 h the pool of ammonia had evaporated. The 
fertilizer continued to burn for 3 days. 

The plant was 12 km from Jonova, a town of about 40,000 
inhabitants. A large cloud of ammonia and nitrous fumes 
spread 35 km, covering an area of 400 km 2 . The cloud 
height is described as being 100,400 and 800 m at distances 
of 5,10 and 20 km, respectively. Some 32,000 people were 
evacuated. 

The events leading up to the rupture were as follows. Due 
to an error, 14 te of warm ammonia at 10°C were transferred 
to the tank, where they formed a layer on the bottom. In due 
course this layer rose suddenly to the surface. The event 
was akin to a ‘rollover’, although this term is normally 
associated not with a pure liquid but with one of varying 
composition, such as LNG. The higher vapour pressure of 
the warmer liquid caused a sudden rise in pressure in the 
tank, which the pressure relief valves were unable to han¬ 
dle, and the tank burst. At the time the refrigeration com¬ 
pressors were not working, but this probably played little 
part in the incident. 

Kletz (1991a); Andersson (1991a,b); Anon. (1992 LPB, p. 11); 
Andersson and Lindley (1992 LPB 107); Kukkonen et al. 
(1992); Wilday (1992 LPB 108,109); Kukkonen etal. (1993) 


A125 Peterborough, UK, 1989 

On 22 March 1989, an explosion occurred in the yard of 
Vibroplant Ltd at Peterborough on a ICI truck carrying 
commercial explosives. The driver had missed his way and 
shortly after 9.30 a.m., approximately, entered the yard to 
turn round, when, as the vehicle passed over a speed ramp, 
there was a minor explosion inside the load compartment 
which blew the rear roller shutter door open. The driver 
stopped the vehicle, and he and the attendant got out to 
investigate. Smoke and flames were coming through gaps 
at the side of the door but no fire could be seen inside. They 
alerted the Vibroplant personnel in the yard and one of the 
latter telephoned the emergency services. At first only a 
small amount of black smoke was to be seen coming from 
the vehicle, but as the fire progressed there were minor 
detonations, or ‘pops’, and thick yellow smoke began to 
emerge. At 9.43—9.44 a.m. two fire tenders arrived. At 
9.45 a.m. the load exploded. The scene following the explo¬ 
sion is shown in Figure A1.18. One person was killed and 
107 were injured, of whom 84 were treated in hospital. 

The load was a mixed one, consisting 150 kg of Powergel 
800; 500 kg of Powergel E800; 56 kg of Magna Primers; 
76 kg of Ammon-Gelit; detonators and fuseheads.The latter 
included uncut Cerium combs, 2400 in three boxes. The 
total mass of explosive had aTNTequivalentof some 800 kg. 

The cause of the explosion was determined as a box of 
Cerium fusehead combs which were in unsafe packaging. 

The report of the HSE (1990b) gives details of the 
damage and injury done by the event. With respect to 
damage, the analysis includes the following: 



Distance 

(m) 

Overpressure 

(psi) 

Clean area 

14 

78 

Fireball 

18 

44 

Total destruction of cavity 

30 

14 

brick/block walls of steel 
framed building 

Serious damage to concrete 

110 

1.7 

frames of building 

Window breakage: 

90% 

«225 

069 

50% 

«360 

0B7 

Up to 

«580 

0.19 


The clear area is the area of the yard which was cleared of 
cars, etc. The report also gives a map showing the fall of 
major fragments. 

With respect to injury, plans are given showing the 
location of the persons exposed and of those who were 
blown over or suffered eardrum rupture. Two of the plans 
are shown in Figure A1.19. 

At the instant of the explosion there were some 31 per¬ 
sons within 60 m of the vehicle. The plans show 


Number of persons 

Distance (m) 

<20 

20-40 

40-60 

Exposed 

3 

12 

31 

Blown over 

2 

10 

15 

Eardrum rupture 

2 

4 
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Figure A1.18 Peterborough, 1989: Vibroplant works yard after the explosion (Courtesy of the Peterborough 
Evening Telegraph) 


The person who died was a fireman who was engulfed 
in the fireball, which extended 18 m. Another fireman at 
25 m suffered minor burns. Other information on injuries 
includes 



Distance 

(m) 

Overpressure 

(psi) 

Burns: 

Fireman engulfed in flames 

18 

44 

Fireman suffered 

25 

21 

slight burns 

Eardrum rupture: 

100% 

28 

17 

50% 

30 

15 

Up to 

45 

6.6 

Blown off feet: 

50% 

55 

4.7 

Up to 

70 

3.2 

Severe injury from 

40 


fragments other than glass 

Cuts from glass: 

Cuts to all 

0-50 

>5.5 

Cuts to many 

70-100 

3.2-1.9 

Cuts to some 

100-150 

1.9-1.15 

Cuts up to 

«200 

0.8 


Further details are given in the HSE report. 
HSE (1990b); Anon. (1991LPB 98, p. 24) 


A126 Richmond, California, 1989 
On 10 April 1989, in a refinery at Richmond, California, a 2 
in. line carrying hydrogen at about 2800 psi suffered a 
failure, apparently at a weld, giving rise to a jet flame, 
which impinged on the support of a reactor, 100 ft high and 
at least 10 ft diameter and with a wall thickness of 7 in., in a 
hydrocracker unit. The resultant failure of the reactor led 
to extensive damage. 

Mahoney (1990) 


A127 Ufa, Soviet Union, 1989 

On 4 June 1989, a massive vapour cloud explosion occurred 
in an LPG pipeline at Ufa in the Soviet Union. A leak had 
occurred in the line the previous day or, possibly, several 
days before. In any event, the engineers responsible had 
responded not by investigating the cause but by increasing 
the pressure. The leak was located some 890 miles from the 
pumping station, at a point where the pipeline and the 
Trans-Siberian railway ran in parallel through a defile in 
the woods, with the pipeline some half a mile from, and at a 
slightly higher elevation than, the railway. On the day in 
question the leak had created a massive vapour cloud which 
is said to have extended in one direction five miles and to 
have collected in two large depressions. 

Some hours later two trains, travelling in opposite 
directions, entered the area. The turbulence caused by their 
passage would promote entrainment of air into the cloud. 
Ignition is attributed to the overhead electrical power 
supply for one or other of the trains. There followed in quick 
succession two explosions and awall of fire passed through 
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by explosion 
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1.19 Peterborough, 1989: site plan showing location of certain injuries (Health and Safety Executive, 1990c): (a) persons blown to the ground by the 
i; and (b) persons suffering perforated eardrums (Courtesy of HM Stationery Office) 
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the cloud. Large sections of each train were derailed and the 
derailed part of one may have crashed into the other. The 
death toll is uncertain, but reports at the time gave the num¬ 
ber of dead as 462 and of those treated in hospital as 706, 
many with 70—80% burns. 

Hofheinz and Kohan (1989); DJ. Lewis (1989 LPB 90, 
1993) 

A128 Bangkok, Thailand, 1990 

At 22.30 on 24 September 1990, a road tanker carrying LPG 
was involved in a traffic accident at a busy road junction 
in the centre of Bangkok. Some 5 te of LPG was released 
but did not ignite immediately. When the cloud did 
ignite, there was evidently a flash fire, but accounts spoke 
also of an explosion, probably from gas which had entered 
a nearby building. In the worst affected area, almost 
all the shop houses on both sides of the street were 
destroyed. Reports gave some 68 persons dead and over 
100 injured. 

The vehicle was a flat bed lorry carrying two LPG tanks. 
The two tanks were interconnected by two lines and it 
appears that these were severed in the accident. The tanker 
had no license to carry LPG. 

Anon. (1991 LPB 101, p. 19) 

A129 Chalmette, Louisiana, 1990 
On 3 November 1990 in a refinery at Chalmette, Louisiana, 
failure involving a heat exchanger shell led to a release of 
hydrocarbons. A vapour cloud formed, was ignited by a 
heater and gave a vapour cloud explosion which did exten¬ 
sive damage. 

Marsh and McLennan (1992) 

A130 Nagothane, India, 1990 

On 6 November 1990 at Nagothane, India, a leak occurred 
on a pipeline transporting ethane and propane to a gas 
cracker complex. Avapour cloud formed and ignited at an 
offsite gas treatment and compression facility. The cracker 
was not damaged by the resultant vapour cloud explosion, 
but serious damage was done to the offsite units. There 
were 31 deaths. 

Marsh and McLennan (1992) 

A131 Stanlow, Cheshire, 1990 

On 20 March 1990, a reactor at the Shell plant at Stanlow, 
Cheshire, exploded. The explosion was due to a reaction 
runaway. 

The vessel was a 15 m 3 batch reactor containing some 
13.5 te of reaction mixture. The reaction was the Halex 
production of 2,4-difluoronitrobenzene (DFNB), using N, 
W-dimethylacetamide (DMAC) as solvent. The DFNB was 
then reacted to obtain the final product 2,4-difluoroaniline 
(DFA). 

The batch had been heated from ambient to 165°C over 
3 h, in the normal way It then rose above 170°C, instead of 
starting to dip slightly, and, unusually, began to vent gas. 
In the following 10 min the heating was switched over to 
cooling, but the temperature and pressure in the reactor 
continued to rise, at an increasing rate. The control room 
operators were unaware of the runaway; they were looking 
at a different display on the VDU. They were alerted to it by 
an outside operator. 

The pressure in the vessel reached a value later assessed 
as about 60-80 barg, which compares with the relief valve 


set pressure of 5 barg. The event generated blast, a fireball 
and missiles. The vessel body unwrapped into a flat plate 
and the cover was hurled 200 m; other missiles went up to 
500 m. The reactor structure collapsed, the fluoroaromatics 
plant was devastated and structural damage was done to 
nearby buildings. One man subsequently died, and five 
others were injured. 

There was evidence, from an eyewitness and from a 
severely burned lamp fitting which became a missile 
(Missile 47), that prior to the explosion there had been a jet 
flame above the reactor for some 30-120 s before the 
explosion, the leak coming from a flange or crack. The blast 
damage in the works had some unusual characteristics, 
decreasing only slowly with distance. The reactor had a 
vapour space of 3 m 3 , but the blast damage was much greater 
than could be accounted for by a physical explosion 
involving such a volume, and a combustive event was indi¬ 
cated. Analysis pointed to an event giving a long impulse 
with a duration time of perhaps 400 ms, compared with, 
say, no more than 50 ms for a vapour cloud explosion on the 
one hand and 10 s for an unconfined fireball on the other. 
The relatively long duration of the explosion would be due 
to the rate limitation imposed by air entrainment. The 
investigators called the event which occurred a ‘highly 
congested fireball’. The fetch of the missiles pointed to a 
pressure at the source in the range 60-80 barg. It was 
estimated that some 10 te of material had been ejected from 
the reactor at about 70 barg in a congested area and had 
been ignited by the jet flame above the vessel acting as 
a strong ignition source. These 10 te had an energy of com¬ 
bustion of 230,000 MJ; the event was consistent with an 
energy release of about one-fifth of this. 

Much of the damage done was due to the rarefaction 
wave. Many components were more sensitive to a negative 
that to a positive pressure deviation. 

The investigation found that the runway was due to the 
presence of acetic acid. This was detected by smell in the 
contents of a vent knockout vessel, and, much later, it was 
identified in a sample of the DMAC from the batch. Inves¬ 
tigation revealed a rather complex chemistry. It showed 
that, when added to a Halex reaction mixture, acetic acid 
causes exothermic reaction and gas evolution. The DFNB 
process involved a later stage of batch distillation in which 
the successive fractions were toluene, DMAC and DFNB. 
The investigators discovered that during one such batch 
water had entered the still via a leaking valve. The water 
had been removed by prolonged azeotropic distillation, 
using toluene. Under these conditions, DMAC undergoes 
slow hydrolysis, giving dimethylamine and acetic acid. 
However, for there to be any significant yield of acetic acid, 
the presence of DFNB is necessary, since this reacts with 
the dimethylamide, and thus shifts the equilibrium. 
On this occasion, the DMAC had then been further distilled 
to purify it. It turned out, however, that DMAC and acetic 
acid form a maximum boiling azeotrope with a boiling 
point close to that of pure DMAC. The presence of the 
acetic acid in the DMAC was not detected by the measure¬ 
ment of boiling point nor by the particular gas chroma¬ 
tograph method in use. Thus the water ingress incident 
evidently led to a batch of recycled DMAC which was 
contaminated with acetic acid, with the consequences 
described. 

Anon. (1991k); Kletz (1991 LPB 100); Mooney (1991); 
Redman and Kletz (1991); Cates (1992); van Reijendam etal. 
(1992) 
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A132 Coode Island, Mevaporourne, Australia, 1991 
On 21 August 1991, an explosion occurred at ATerminal of 
Terminal Pty at Coode Island, Mevaporourne, Australia. 
The site involved had 45 storage tanks, none pressurized, 
with a vapour recovery system. A 230 te acrylonitrile 
tank was lifted off its base and projected over four other 
tanks into the forecourt. There followed a series of bund 
and tank fires and tank explosions, at the end of which only 
13 tanks were left undamaged. There were no deaths or 
serious injuries. 

The cause of the initial explosion has not yet been estab¬ 
lished. Some of the explanations considered are rehearsed 
by I. Thomas (1991), including his own of exothermic poly¬ 
merization in the vapour recovery system. A critique of this 
explanation is given by Croudace (1993 LPB112). 

Anon. (1991b); I. Thomas (1991); Anon. (1992c); Alexander 
(1992a); Marsh and McLennan (1992); Croudace (1993 
LPB 112) 

A133 Seadrift, Texas, 1991 

At 1.18 a.m. on 12 March 1991, an ethylene oxide redistilla¬ 
tion column at the Union Carbide plant at Seadrift, Texas, 
exploded. A large fragment from the explosion hit pipe 
racks and released methane and other flammable materials. 
All utilities at the plant were lost. There was a substantial 
loss of firewater from water spray systems damaged or 
actuated by loss of plant air. The explosion and ensuing fire 
did extensive damage and one person was killed. 

The plant had been down for routine maintenance. Start¬ 
up began in the late afternoon of 11 March, but the plant 
was shut- down several times by trip action before the cause 
was identified and rectified. Operation was finally estab¬ 
lished around midnight. The plant had been operating 
normally for about an hour when the explosion occurred. 

The explosion was attributed to the development of a hot 
spot in the top tubes of the vertical, thermosiphon reboiler 
such that the temperature reached over 500°C instead of the 
normal 60° C, combined with a previously unknown catalytic 
reaction, involving iron oxide in a thin polymer film on the 
tube, which resulted in decomposition of the ethylene oxide. 

A low recirculation ratio in the reboiler could give in 
some of the tubes low flow, loss of liquid film and stagnant 
vapour. The account by Viera, Simpson and Ream (1993) 
gives a detailed discussion of measures to ensure that all 
the heated surfaces of the reboiler are kept wetted. 

Marsh and McLennan (1992); Viera, Simpson and Ream 
(1993) 

A134 Bradford, UK, 1992 

On 21 July 1992, a series of explosions leading to an intense 
fire occurred in a warehouse at Allied Colloids Ltd, 
Bradford. None of the workers at the factory was injured 
but three residents and 30 fire and police officers were 
taken to hospital, mostly suffering from smoke inhalation. 
The fire gave rise to a toxic plume and the run-off of water 
used to fight the fire caused significant river pollution. 

The HSE investion (HSE, 1993b) concluded that some 
50 min before the fire two or three containers of azodiisobu- 
tyronitrile (AZDN) kept at a high level in Oxystore 2 had 
ruptured, probably due to accidental heating by an adjacent 
stream condensate pipe. AZDN is a flammable solid 
incompatible with oxidizing materials. The spilled material 
probably came in contact with sodium persulfate and 
possibly other oxidizing agents, causing delayed ignition 
followed by explosions and then the major fire. 


The warehouse contained two storerooms. Oxystore No. 1 
was designed for oxidizing substances and Oxystore No. 2 
for frost-sensitive flammable products; this second store 
was provided with a steam heating system. In 1991, an 
increase in demand for oxidizers led to a change of use, with 
both stores now being allocated to oxidizing products. A 
misclassification of AZDN as an oxidizing agent in the 
segregation table used led to this flammable material being 
stored with the oxidizers. 

In September 1991, the warehouse manager, after dis¬ 
cussions with the safety department, submitted a works 
order for modifications to the oxystores, including Zone 2 
flameproof lighting, temperature monitoring equipment, 
smoke detectors and disconnection of the heater in Oxy¬ 
store 2. An electrician made a single visit in which he did 
not disconnect the heater but simply turned the thermostat 
to zero. Although safety-related, the work was given low 
priority and 10 months later none of it had been started. 

The explosion started at 2.20 p.m. and the first fire 
appliance arrived at 2.28 p.m. The fire services experienced 
considerable difficulties in obtaining a water supply ade¬ 
quate to fight the fire. At 3.40 p.m. power was lost on the 
whole site when the electricity board cut off the supply 
because the fire was threatening the main substation. 
The loss of power led to the shut-down of the works effluent 
pumps and escape of contaminated firewater from the site. 

The fire services made early contact with the company’s 
incident controller and strongly advised the sounding of 
the emergency siren, but this was not done until 2.55 p.m., 
when the incident had escalated. The fire gave rise to a 
black cloud of smoke, which drifted eastward over housing. 
The company stated on the day that the smoke was non¬ 
toxic. The HSE report, which gives a map of the smoke 
plume, states that ‘it was in fact smoke from a burning 
cocktail of over 400 chemicals and only some of them would 
have been completely destroyed by the heat of the fire’. 

The HSE report cites evidence that the warehouse had 
not been accorded the same safety priority as the produc¬ 
tion functions. It came under the logistics department, 
none of whose 125 personnel had qualifications as a chem¬ 
ist or in safety. 

HSE (1993b); Anon. (1994 LPB 119, p. 15); VC. Marshall 
(1994 LPB 117) 


A135 Castleford, UK, 1992 

At about 1.20 p.m. on Monday, 21 September, 1992, a jet 
flame erupted from a manway on the side of a batch still on 
the Meissner plant at Hickson and Welch Ltd at Castleford. 
The flame cut through the plant control/office building, 
killing two men instantly. Three other employees in these 
offices suffered severe burns from which two later died. 
The flame also impinged on a much larger four-storey 
office block, shattering windows and setting rooms on fire. 
The 63 people in this block managed to escape, except for 
one who was overcome by smoke in a toilet; she was rescued 
but later died from the effects of smoke inhalation. 

The flame came from a process vessel, the ‘60 still base’, 
used for the batch distillation of organics, which was being 
raked out to remove semi-solid residues, or sludge. Prior to 
this, heat had been applied to the residue for three hours 
through an internal steam coil. The HSE investigation 
(HSE, 1993b) concluded that this had started self-heating 
of the residue and that the resultant runaway reaction led 
ignition of evolved vapours and to the jet flame. 
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The 60 still base was a 45.5 m 3 horizontal, cylindrical, 
mild steel tank 7.9 m long and 2.7 m diameter. The still was 
used to separate a mixture of the isomers of mono- 
nitroluene (MNT, or NT), two of which (oNTand mNT) are 
liquids at room temperature and third (pNT) a solid; other 
by-products were also present, principally dinitrotoluene 
(DNT) and nitrocresols. It is well known in the industry 
that these nitro compounds can be explosive in the 
presence of strong alkali or strong acid, but in addition 
explosions can be triggered if they are heated to high 
temperatures or held at moderate temperatures for a long 
period. 

The still base had not been opened for cleaning since it 
was installed in 1961. Following a process change in 1988 a 
build-up of sludge was noticed, the general consensus 
being that it was about 18201, equivalent to a depth of about 
10 cm, though readings had been reported of 29 cm and, the 
day before the incident, of 34 cm. One explanation of this 
high level was that on 10 September the still base had been 
used as a Vacuum cleaner’ to suck out sludge left in the 
‘whizzer oil’ storage tanks 162 and 163, resulting in the 
transfer of some 3640 1 of a jelly-like material. The intent 
had been to pump this material to the 193 storage but 
transfer was slow and was not completed because the 
material was thick. The batch still was used for further 
distillation operations, which were completed on Septem¬ 
ber 19. The still base was then allowed to cool and on 
September 20 the remaining liquid was pumped to the 193 
storage. 

On September 17 the shift and area managers discussed 
cleaning out the still base. The former had been told by 
workers that the still had never been cleaned out and he 
realized that the sludge covered the bottom steam heater 
battery. It was agreed to undertake a clean-out. The area 
manager gave instructions that preparations should be 
made over the weekend, but when he arrived on the Mon¬ 
day morning nothing had been done. He was concerned 
about the downtime, but was assured that this could be 
minimized and gave instructions to proceed. 

At 9.45 a.m. the area manager gave instructions to apply 
steam to the bottom battery to soften the sludge. Advice 
was given that the temperature in the still base should not 
be allowed to exceed 90°C. This was based solely on the fact 
that 90°C isbelow the flashpoint of MNT isomers. However, 
the temperature probe in the still was not immersed in the 
liquid but in fact recorded the temperature just inside the 
manway. Further, the steam regulator which let down 
the steam pressure from 400 psig (27.6 bar) in the steam 
main to 100 psig (6.9 bar) in the batteries was defective. 
Operators compensated for this by using the main isolation 
valve to control the steam. This valve was opened until 
steam was seen whispering from the pressure relief valve 
on the battery steam supply line. This relief valve was set 
at 100 psig but was actually operating at 135 psig (9 bar), at 
which pressure the temperature of the steam in the battery 
tubes would be about 180°C. 

The clean-out operation, which had not been done in the 
previous 30 years, was not subjected to a hazard assess¬ 
ment to devise a safe system of work, and there were defects 
in the planning of and permit-to-work system of the 
operation. The task was largely handled locally with mini¬ 
mal reference to senior management and with lack of 
formal procedures, although such procedures existed for 
cleaning other still bases on the site. The permits were 
issued by a team leader who had not worked on the 


Meissner plant for 10 years prior to his appointment on 
September 7. At 10.15 a.m. he made out a permit for a fitter 
to remove the manlid.The fitter signed on about 11.10 a.m. 
and shortly after went to lunch. Operatives who were 
standing by offered to remove the manlid and the same 
team leader made out a permit for them to do so. When the 
fitter returned from lunch it was realized that the still base 
inlet had not been isolated and a further permit was issued 
for this to be done. 

Meanwhile, the manlid had been removed. The area 
manager asked for a sample to be taken. This was done 
using an improvized scoop. He was told the material was 
gritty with the consistency of butter. He did not check 
himself and mistakenly assumed the material was ther¬ 
mally stable tar. No instructions were given for analysis of 
the residue or the vapour above it. Raking out began, using 
a metal rake which had been found on the ground nearby. 
The near part of the still base was raked. The rake did not 
reach to the back of the still and there was a delay while 
an extension was procured. The employees left to get on 
with other work and it was at this point that the jet flame 
erupted. 

The HSE report states that analysis of damage at the 
Meissner control building at 13.4 m from the manway source 
indicated that at this building the jet flame was 4.7 m 
diameter. The jet lasted some 25 s and had a surface emissive 
power of about 1000 kW/m 2 . The temperature at 6 m from 
the manway would have been about 2300°C. 

The company employed some highly qualified staff with 
considerable expertise in the manufacture of organic nitro 
compounds. The HSE report describes some of the investi¬ 
gations of thermal stability, safety margins, etc., in which 
these staff were involved. It also comments in relation to 
the incident in question, ‘Regrettably this level of under¬ 
standing was not reflected in the decision which was made 
on 21 September when it was decided that the 60 still base 
would be raked out.’ 

As soon as the personnel at the gate office saw the flame 
one of them made a ‘999’ emergency call. The employee 
requested the ambulance and fire services, but spoke only 
to the former before the call was terminated at the 
exchange. Thereafter incoming calls prevented further 
outgoing calls for assistance. 

Just over a year before the incident the management 
structure had been reorganized. This involved replacing a 
hierarchical structure with a matrix management system, 
eliminating the role of plant manager and instituting a 
system in which production was coordinated through 
senior operatives acting as team leaders. The area man¬ 
agers had a significant workload. In addition to their pro¬ 
duction duties they had taken over responsibility for the 
maintenance function, which had previously been under 
the works engieering department. Managers were not 
meeting targets for planned inspections under the safety 
programme, and this was said to be due to lack of time. 

C. Butcher (1994); HSE (1994b); Kletz (1994 LPB119) 

A136 Sodegaura, Japan, 1992 

At 15.52 on 16 October 1992 at the Fuji Oil Sodegaura 
refinery at Sodegaura City, Japan, a large release of hydro¬ 
gen occurred from a rupture on a feed/reactor effluent heat 
exchanger on the heavy oil indirect desulfurization unit as 
the plant was being started up after a shut-down. There was 
a delay of a few minutes, during which personnel took 
measures to try to stop the release, before the leak found 
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a source of ignition and exploded. Ten were killed and seven 
injured. 

The investigation found that the leak occurred at a 
gasket retainer on the heat exchanger as illustrated in 
Figure A1.20. The gasket retainer had shrunk due to repeated 
thermal cycling and it suffered wear at the point shown as 
X on the diagram. The defect was detected and during a 
shut-down the surface was repaired by grinding. However, 
the effect of this was to cause the retainer to ride beyond 
the groove so that when the retainer was heated during 
start-up, a gap opened up and the escape occurred. 

High Pressure Gas Safety Institute of Japan (1993 
LPB116) 

A137 HoechstIncidents, Germany, 1993 
On 22 February 1993, an accident occurred at the 
Griesheim works of Hoechst, which was unprecedented in 
the company’s 130-year history. By April 2, there had been 
at five sites a series of no less than 14 incidents, comprising 
11 releases, two fires and one explosion, of which three 
were considered serious by the company. 

Incident on 22 February 1993 

The first of these, at 4.14 a.m. on 22 February, was a reaction 
runaway which occurred when a reactor for the production 
of o-nitroanisol was charged with reaction mixture with the 
agitator off and the latter was then switched on. Some 10 te 
of material was discharged through two safety valves. The 
ambient temperature was —2°C and most of the material 
solidified, but the residual gas cloud spread across the 
Main and affected an area of some 30 ha in Frankfurt. 

The information available to the works manager, a 
materials safety data sheet conforming to the DIN stand¬ 
ard, was that o-nitroanisol is ‘slightly toxic’, and he gave 
this description to the press. As it happened, the previous 
Friday this data sheet had been the subject of a revision, to 
the effect that the substance had been found to be carcino¬ 
genic to rats when administered in large doses over a long 
period. The revision had been known to the company’s 
specialists since November 1992 but not to the works 


manager. The toxicity of the substance was the subject of 
press comment. 

Incident on 15 March 1993 

The second serious incident, was on 15 March, on one of 
four parallel trains for the production of polyvinylalcohol. 
At the location in question in normal operation the material 
was in gel form on a conveyor belt inside an enclosure, but 
at the time the belt was stopped and empty. That morning 
the enclosure, which was normally kept inerted with 
nitrogen, was inspected. A precutter was still operating. 
An explosion occurred which killed the shift supervisor 
and injured the section manager. There followed a fire, 
which gave rise to a large column of smoke visible for some 
distance but which was rapidly brought under control. 

An investigation by the authorities concluded that the 
enclosure had contained flammable vapours, that air had 
entered the enclosure during the inspection and that tramp 
metal had entered, giving rise to a spark at the precutter. 

Incident on 2 April 1993 

The third incident, on2 April, involved a release of oleum.The 
release occurred when air pressure was applied to a vessel 
containing oleum and, due to a blockage in an outlet pipe, 
caused by crystallization, the oleum passed instead into an 
absorber where it reacted violently with the absorbent. A 
glass pipe ruptured and some 50 kg of oleum was released. 

Owing to difficulties experienced with the alarm system 
some 13 people at the research centre came in contact with 
the cloud and received treatment at the medical centre. 
Ondrey (1993a,b); Schonfeld (1993); Vennen (1993) 

A138 Dronka, Egypt, 1994 

On 2 November 1994, blazing liquid fuel flowed into the 
village of Dronka, Egypt. The fuel came from a depot of 
eight tanks each holding 5000 te of aviation or diesel fuel. 
The release occurred during a rainstorm and was said to 
have been caused by lightning. Reports put the death toll at 
more than 410. 

Reuter (1994) 


Gasket Gasket 

| retainer 



Direction of 
movement 


Figure A1. 20 Sodegaura, 1992: simplified diagram of 
heat exchanger gasket retainer. The gasket retainer 
suffered wear at the point marked X and repair was 
made by grinding, with loss of metal broadly as shown 
by the dotted portion (after the High Pressure Gas 
Safety Institute of Japan, 1993 LPB 116) 


A139 Ukhta, Russia, 1995 

Early in the morning on 27 April 1995, an ageing gas 
pipeline exploded in a forest in northern Russia. Reports 
described fireballs rising thousands of feet in the air and 
the inhabitants of the city of Ukhta, some eight miles dis¬ 
tant, as rushing out in panic. At Vodny, six miles away, the 
sky was so bright that people thought the village was on 
fire. The pilot of a Japanese aircraft passing over at some 
31,000 ft perceived the flames as rising most of the way 
towards his plane. 

Anon. (1995) 

AMO Terminal Fire Savannah, Georgia, 1995 
On April 10,1995, at approximately 11:30 p.m., explosions 
and fire occurred at Powell DuffrynTerminals, Inc. (PDTI), 
a commercial bulk liquid chemical storage and transfer 
facility, in Savannah, Georgia. Flames and thick black 
smoke from the fire forced the residents of the adjacent 
townhouse development to evacuate immediately. It took 
firefighters almost 3 days to finally put out the fire. The fire 
was within a concrete walled enclosure area containing six 
large storage tanks. During the fire, part of the enclosure 
wall was breached releasing contaminated firewater. 
The run-off from the fire contaminated an adjacent marsh 
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on the Savannah River resulting in a fish kill. (This first 
paragraph and the four following it were taken almost 
verbatim from the Executive Summary of the EPA’s 
Chemical Emergency Preparedness and Prevention Office 
report entitled EPA Chemical Accident Investigation Report, 
PDTI. It is EPA Report 550-R-98-003.) (A summary report 
by David Chung entitled Explosion and Fire at Powell 
DuffrynTerminals - Savannah, Georgia was also used.) 

After the fire, chemicals leaking from the storage tanks in 
the enclosure area reacted and produced toxic hydrogen sul¬ 
fide gas. The hydrogen sulfide gas release forced residents 
within one-half mile of the facility to evacuate. As many as 
2000 people were involved in the evacuation. An elementary 
school nearby was also forced to close. Approximately 300 
people went to hospital emergency rooms complaining 
of symptoms attributed to hydrogen sulfide exposure. For 
many nearby residents, the evacuation lasted more than 
30 days because of the continued evolution of hydrogen 
sulfide gas from the PDTI site. After the incident, extensive 
cleanup of the site and neighboring area was required. 

Powell Duffryn Terminals Inc is fully enclosed by a 
security fence with locked gates. On April 10,1995, the last 
employee left the site for the day at 5:50 p.m. The gates were 
locked, and no employees were on-site until after the 
explosions and fire had occurred. 

On the day of the fire, contractor employees had been 
installing a sealed foam chamber on the storage tanks 
containing crude sulfate turpentine (CST), a flammable 
liquid. This closed the CST tanks to the atmosphere and 
directed CST vapour to the vapour control (VC) system. The 
VC system was designed to control fume and odour from 
the CST by capturing the CST vapour using activated car¬ 
bon in two 50-gallon drums connected to the CST tanks 
using PVC piping. According to PDTI modification plans, 
each CST storage tank was supposed to be equipped with a 
flame arrester at its connection to the PVC piping. These 
flame arresters had been delivered but not yet installed. In 
addition, a fixed-piping foam fire protection system was 
not completed at the time of the fire. 

The explosions and fire at PDTI involved CST, which the 
facility began to store on 17 January 1995. Prior to 1995, the 
facility was permitted only for storing non-flammable 
liquids. The facility had not completed modifications to 
accommodate the storage of flammables when the fire 
occurred. The CST was stored in three storage tanks (two 
237,000 and one 422,000 gallon capacity) in a walled 
enclosure that contained a total of six tanks. The three CST 
storage tanks were connected by the partially completed 
VC system used to remove CST vapour from any venting 
that may occur. In the same enclosure were three other 
storage tanks (one 340,000 and two 323,000 gallon, 
respectively) containing sodium hydrosulfide solution (pH 
10.4 to 11.5); Briquest, an acidic cleaning solution (pH of 1) 
and Antiblaze 80, a fire retardant chemical. These tanks 
and associated pipes were damaged by the explosions and 
fire and leaked their contents into the six-tank enclosure 
area. Reaction of the sodium hydrosulfide with acids pres¬ 
ent in the enclosure area produced hydrogen sulfide, a 
toxic, foul smelling gas (EPA May 1998). 

The EPA Chemical Accident Investigation Team identi¬ 
fied the following as root causes and contributing factors 
in the accident: 

• The design for the Vapour Control System was inadequate. 

There is a documented history of fires in drums 


containing activated carbon where the organic vapour 
control design permitted the backflow of air through the 
drums. Organic sulfur compounds in CST can produce 
heat when they are adsorbed by the activated carbon. 
Due to the incomplete vapour control installation, air 
was permitted to backflow into the CST contaminated 
drums of activated carbon when the ambient tempera¬ 
ture drops and the vapours within the tank contract or if 
the tank is pumped out. 

It was a very hot afternoon when a tank truck of CST 
was unloaded. As the evening temperatures cooled, the 
tank vapour space cooled and the vapour contracted. 
Air drawn into the drums provided oxygen for the spon¬ 
taneous combustion. 

• The storage tanks were not equipped with flame arresters. 
The lack of these purchased, but not-yet-installed 
protection devices in the vent piping allowed the fire 
to travel from the carbon bed to the tank vapour space. 

• The foam fire suppression piping system was not com¬ 
pleted on the tanks containing CST. Despite the fact that 
flammable CST was being stored, the designed foam 
suppression system was incompletely installed. 

• Incompatible chemicals were stored in the same walled 
enclosure area. A large quantity of sodium hydrosulfide 
solution was stored in the same enclosed area as an 
acidic cleaning solution. When the tanks leaked the 
chemicals reacted generating toxic hydrogen sulfide 
(H 2 S).This noxious H 2 S gas caused injuries, forced eva¬ 
cuations and hampered a quick response and cleanup. 

For detailed recommendations, see either the EPA 
Report or David Chung’s article. 

A141 West Helena, Arkansas, 1997 
On the afternoon of 8 May 1997, a massive explosion and 
fire occurred at Unit Two of the Bartlo Packaging Incorpo¬ 
rated (BPS) facility located in West Helena, Arkansas. 
Three West Helena firefighters were killed and 17 required 
medical attention during the response. (This write-up is 
taken directly from EPA/OSHA Joint Chemical Accident 
Investigation Report, EPA 550-R-99-003. April 1999. Por¬ 
tions are taken word for word from the report.) 

Hundreds of residents and patients at a local hospital 
were either evacuated or sheltered-in-place. The Mississippi 
River traffic and major roads were closed for approximately 
12 h due to the release of toxic materials from the facility. 

BPS employees observed smoke in the Unit Two ware¬ 
house and all employees evacuated the building prior to the 
explosion. Members of the West Helena Fire Department 
responded to the scene within minutes. A reconnaissance 
team of four firefighters was outside of the building when 
an explosion occurred in the warehouse. Three firefighters 
were killed when they were struck by materials from a 
falling wall. The fourth firefighter was injured seriously. 

EPA and the OSHA conducted a joint investigation of the 
incident. The team determined that the incident was most 
likely caused by the decomposition of a bulk sack contain¬ 
ing the pesticide Azinphos methyl (AZM) 50W which had 
been placed against or close to a hot compressor discharge 
pipe. Under this scenario, the heat from the discharge pipe 
would have caused the pesticide to decompose and give off 
flammable vapours, which resulted in the fatal explosion. 

A142 Longford, Victoria, Australia, 1998 

On Friday September 25,1998, about 12:26 in the afternoon 

a reboiler ruptured at the Longford Gas Plant. The fracture 
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released hydrocarbon vapours and liquid. The vapours 
travelled towards the area of the fired heaters where it 
ignited. 

Two gas employees were killed and eight others were 
injured. Property damages were estimated initially to be 
over $187,000. Supplies of natural gas to domestic and 
industrial users were interrupted between 9 and 19 days. 
The State of Victoria, which is highly dependent on natural 
gas, suffered substantial disruption to the economy. 

The unit in which the release and fire originated was 
designed to remove ethane, propane, butane and other 
higher chain hydrocarbons by absorbing them in‘lean oil’. 
The oil, now saturated with light hydrocarbons was called 
‘rich oil.’ ‘Rich oil’ was distilled to release these hydro¬ 
carbons and it was now lean again. The exchanger that 
ruptured was the rehoiler. The cold rich oil was in the tubes 
and heated by warm lean oil. 

Investigators determined that the loss was attributed to 
the fracture of a heat exchanger following a process upset 
that was set in motion by the unintended, sudden shut¬ 
down of warm lean oil pumps. Following the loss of the lean 
oil flow, the condensate flowing from the absorbers was 
flashing at lower and lower temperatures. Ice formed on the 
outside of the heat exchanger. Simulations indicate that the 
temperature reached as low as -48°C (-54°F). The reduc¬ 
tion in temperature caused embrittlement of the heat 
exchanger’s steel shell. 

When hot lean oil was reintroduced into the vessel it 
ruptured releasing about 22,000 pounds of hydrocarbon 
vapour which exploded. (Technically it was reported not as 
a vapour cloud explosion, but a deflagration or flash fire.) 
An estimated 26,000 pounds of hydrocarbon vapour 
burned as a jet fire. 

After the initial fire, the flame front travelled back to the 
source and a prolonged fire developed. This fire was 
beneath a critical pipe rack called ‘King’s Cross.’ The 
flames impinging on this rack lead to three other rapid 
releases of flammable inventories and fireballs. The pipe¬ 
lines in this fire-affected area were major interconnections 
between three gas plants. It was difficult to isolate under 
these conditions. It required nearly 2.5 days for the total 
isolation of the piping network to stop the fire. 

The Australian Government ordered a Royal Commis¬ 
sion to investigate the cause of the accident. Follow-up 
reports provided some significant major lessons for the 
industry. 

1. The Safety Management System was judged incom¬ 
plete. This included the lack of operator training asso¬ 
ciated with the loss of lean oil flow, the circumstances in 
which brittle fracture might occur and the lack of dis¬ 
cussion of this potential problem in procedures for 
shut-down or start-up. 

2. One report listed the operator training emphasized the 
training was provided for the operators to do their 
job, rather than have the deeper understanding they 
needed to deal with unforeseen problems. 

3. Changes in organization during the 1990s is also men¬ 
tioned as a major contributor to this accident. Organi¬ 
zational changes were not subject to Management of 
Change scrutiny at this location. Until 1991 engineers 
worked at the Longford Plant on a daily basis. In 1992, 
as part of a restructuring of the company, all of the 
plant engineers were moved to Melbourne. The Com¬ 
mission’s official report states, ‘The physical isolation 


of the engineers from the plant deprived operations 
personnel of engineering expertise and knowledge 
which previously they gained through interaction 
and involvement with engineers on site. Moreover the 
engineers themselves no longer gained an intimate 
knowledge of plant activities.’ The number of super¬ 
visors and associated staff was reduced from 25 to 17 
between 1993 and 1998. The maintenance staff was 
also reduced from 67 to 58 during that time. 

The Commission stressed that the Audit and Review 
functions of the Safety Management System provides 
opportunities to discover gaps. It stressed the need for 
challenging rigorous corporate audits. The commission 
concluded that the methodology employed by the assess¬ 
ment team earlier in 1998 was flawed and failed to 
identify significant deficiencies (Coco, 2001; Boult, 2001; 
Kletz-2001). 

Augusta, Georgia, 2001 

On March 13,2001, three people were killed as they opened 
a process vessel containing hot plastic in Augusta, Georgia. 
They were unaware that the vessel was pressurized. The 
workers were killed when the partially unbolted cover blew 
off the vessel, expelling hot plastic. The force of the release 
caused hot oil tubing breakage, and a leak ignited. (Due to 
the serious nature of this incident, the US Chemical Safety 
and Hazard Investigation Board (CSB) initiated an inves¬ 
tigation. Their results were reported in Investigation 
Report: Thermal Decomposition - BP Amoco Polymers - 
Report No. 2001-03-1-GA, June 2002. This write-up is 
an abbreviated version of the CSB Report and some is 
copied verbatim.) 

Workers were attempting to open a cover on a polymer 
catch tank. The tank was designed to receive partially 
reacted waste diverted from a chemical reactor during peri¬ 
ods of start-up and shut-down. 

Twelve hours prior to the incident, an attempt was made 
to start the production unit. The start-up was aborted due 
to problems downstream of the reactor. However, prior to 
shut-down an unusually large amount of partially reacted 
material had been sent to the polymer catch tank. Hot 
molten plastic inside the tank continued to react and also 
began to slowly decompose, thereby generating gases and 
causing the contents of the tank to foam. The material 
expanded as foaming continued, and eventually the entire 
tank was filled. The material then forced its way into con¬ 
necting pipes, including the normal and emergency vents. 

Once in the pipes, the plastic solidified as it cooled, 
resulting in a hardened layer 3—5 in. thick around the 
entire inner wall of the tank. The core of the plastic mass 
remained hot and molten, and likely continued to decom¬ 
pose over several hours, generating gases that pressurized 
the vessel. 

Before opening the polymer catch tank, personnel may 
have relied on a pressure gauge and a transmitter on the 
vent piping from the vessel. However, any reading from the 
pressure gauge would likely have been unreliable because 
plastic had entered the vent line and solidified. 

The workers proceeded to remove the 44 bolts from the 
cover. When half of the bolts had been removed, the cover 
suddenly blew off. Hot plastic spewed throughout the area, 
travelling as far as 70 ft. The cover and the expelled plastic 
struck the workers, killing them. 
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The force created propelled the polymer catch tank 
backward and bent the attached piping. A section of hot oil, 
370°C, supply tubing for a heating jacket to the catch tank 
broke, and the fluid spilled into the area. A flammable 
vapour cloud formed and ignited within a few minutes. 
Several hours of fire-fighting efforts were required to 
extinguish the fire. 

The US Chemical Safety Board Key Findings include: 

1. The manufacturing process was not subjected to a 
specialized design review to identify thermal decom¬ 
position hazards from unintended and uncontrolled 
reactions, and the risks posed by decomposition of the 
plastic were not recognized. 

2. More than the normal amount of hot plastic entered 
the polymer catch tank during the aborted start-up. 
Reactions and decomposition of the plastic-produced 
gases. These gases caused the plastic to foam and 
expand. The expanded plastic forced its way into con¬ 
necting pipes, where it solidified and plugged the inlet 
to the vent line. Once this occurred, the gases could not 
escape and the vessel became pressurized. 

3. Operating experience revealed that the design of the 
polymer catch tank did not afford a practical and reli¬ 
able method for workers to check for hazards before 
opening the vessel. Drains were often plugged with 
solidified plastic, making it impossible to verify the 
absence of pressure or hazardous chemicals. 

4. Process safety information inadequately described 
the design basis and operating principles for the 
polymer catch tank. There was no discussion of the 
means by which overfilling could occur and its 
consequences. 

5. The possibility of overfilling was increased when the 
original start-up procedures were revised; the diver¬ 
sion of output from the reactor to the polymer catch 
tank was extended from 30 to 50 min. This modification 
of procedures was not subjected to a management of 
change (MOC) review. 

6. Process hazard analyses were inadequate. Other find¬ 
ings, root causes and recommendations are available in 
the Chemical Safety Board’s report (CSB). 


Martinez, California, 1999 

On 23 February 1999, a fire occurred in the crude unit at an 
oil refinery in Martinez, California. Workers were attempt¬ 
ing to replace piping attached to a 150 -foot-tall fractionator 
tower while the process unit was in operation. During 
removal of the piping, naphtha was released onto the hot 
fractionator and ignited. The flames engulfed five workers 
located at different heights on the tower. Four men were 
killed, and one sustained serious injuries. 

(Due to the serious nature of this incident, the US Chem¬ 
ical Safety and Hazard Investigation Board (CSB) initiated 
an investigation. The investigation was to determine the 
root and contributing causes of the incident and to issue 
recommendations to help prevent similar occurrences. This 
write-up is an abbreviated version of the CSB Report and 
much of the write-up is verbatim. The CSB examination led 
to ‘Investigation Report — Refinery Fire Incident — Tosco 
Avon Refinery’ Report No. 99-014-1-CA.) 

On February 10,1999, a pinhole leak was discovered in 
the crude unit on the inside of the top elbow of the naphtha 
piping, near where it was attached to the fractionator 


112 ft in the air. Plant personnel responded immediately 
and attempted to isolate the piping. The unit remained in 
operation. 

The naphtha piping was inspected and showed that it 
was extensively thinned and corroded. A decision was 
made to replace a large section of the naphtha line. Over the 
13 days between the discovery of the leak and the fire, 
workers made numerous unsuccessful attempts to isolate 
and drain the naphtha piping. Nonetheless, supervisors 
proceeded with scheduling the line replacement while the 
unit was in operation. 

On the day of the incident, the piping contained about 
90 gallons of naphtha, which was being resupplied from the 
running process unit through a leaking isolation valve. A 
work permit authorized maintenance employees to drain 
and remove the piping. After several unsuccessful attempts 
to drain the line, a maintenance supervisor directed 
workers to make two cuts into the piping using a pneumatic 
saw. After a second cut the piping began to leak naphtha, 
the supervisor directed the workers to open a flange to 
drain the line. As the line was being drained, the naphtha 
ignited, most likely from contacting the hot surfaces of 
the fractionator, and quickly engulfed the tower structure 
and personnel. 

Chemical Safety Board key findings 

1. The removal of the naphtha piping with the process 
unit in operation involved significant hazards. This 
non-routine work required removing 100 ft of 6-in 
pipe containing naphtha, a highly flammable liquid. 
Workers conducting the removal were positioned as 
high as 112 ft above ground, with limited means of 
escape. The hot process unit provided multiple sources 
of ignition, some as close as 3 ft from the pipe removal 
work. One isolation valve could not be fully closed, 
which indicated possible plugging. 

On three occasions prior to the incident, the naphtha 
pipe resumed leaking from the original pinhole and felt 
warm to the touch, indicating that one or more isolation 
valves were leaking. Numerous attempts to drain the 
piping were unsuccessful. 

2. The naphtha pipe that was cut open during the repair 
work was known by workers and the maintenance 
supervisor to contain flammable liquid. Although pro¬ 
cedures required piping to be drained, depressured and 
flushed prior to opening, this was not accomplished 
because extensive plugging prevented removal of the 
naphtha. Although the hot process equipment was 
close to the removal work, the procedures and safe work 
permit did not identify ignition sources as a potential 
hazard. 

3. The naphtha stripper vessel level control bypass valve 
was leaking, which prevented isolation of the line from 
the operating process unit. 

4. The refinery’s job planning procedures did not require 
a formal evaluation of the hazards of replacing the 100 ft 
of naphtha piping. The pipe repair work was classified 
as low risk maintenance. Despite serious hazards 
caused by the inability to drain and isolate the line - 
known to supervisors and workers during the week 
prior to the incident - the low risk classification was not 
reevaluated. 

5. The refinery’s permit for the hazardous non-routine 
work was authorized solely by a unit operator on the 
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day of the incident. Operations supervisors were not 
involved in inspecting the job site or reviewing the 
permit. 

6. Operations supervisors and refinery safety personnel 
were seldom present in the unit to oversee work 
activities. 

7. Deficiencies in auditing of maintenance line break¬ 
ing, lockout/tagout procedures were noted as well as 
a lack of a Management of Change review as one of 
the contributing factors. See the full CSB report for 
details. 


Root causes identified by the Chemical Safety Board 

1. The refinery’s maintenance management system did 
not recognize or control serious hazards posed by per¬ 
forming non-routine repair work while the crude pro¬ 
cessing unit remained in operation. 

• Refinery management did not recognize the 
hazards presented by sources of ignition, valve 
leakage, line plugging, and inability to drain the 
naphtha piping. Management did not conduct a 
hazard evaluation 1 of the piping repair during the 
job planning stage. 

• Management did not have a planning and authori¬ 
zation process to ensure that the job received appro¬ 
priate management and safety personnel review and 
approval. The involvement of a multidisciplinary 
team in job planning and execution, along with 
the participation of higher level management, would 
have likely ensured that the process unit was shut¬ 
down to make repairs safely once it was known 
that the naphtha piping could not be drained or 
isolated. 

• The organization did not ensure that supervisory 
and safety personnel maintained a sufficient pres¬ 
ence in the unit during the execution of this job. 
The refinery relied on individual workers to detect 
and stop unsafe work, and this was an ineffective 
substitute for management oversight of hazardous 
work activities. 

2. The refinery’s safety management oversight system 
did not detect or correct serious deficiencies in the 
execution of maintenance and review of process 
changes. 

• Neither the parent corporation nor the local faci¬ 
lity management audited the refinery’s line break¬ 
ing, lockout/tagout, or blinding procedures in the 
three years prior to the incident. Periodic audits 
would have likely detected and corrected the pat¬ 
tern of serious deviations from safe work practices 
governing repair work and operational changes in 
process units. These deviations included practices 
such as: 

• Opening of piping containing flammable liquids 
prior to draining. 

• Transfer of flammable liquids to open containers. 

• Inconsistent use of blind lists. 

• Lackofsupervisoryoversightofhazardouswork 
activities. 

• Inconsistent use of MOC reviews for process 
changes. 

3. Refinery management did not conduct an MOC review 
of operational changes that led to excessive corrosion 
rates in the naphtha piping. 


Management did not consider the safety implications of 
process changes prior to their implementation, such as: 

Running the crude desalter beyond its design parameters. 

• Excessive water in the crude feed. 

• Prolonged operation of the naphtha stripper level 
control bypass valve in the partially open position. 

These changes led to excessive corrosion rates in the 
naphtha piping and bypass valve, which prevented isola¬ 
tion and draining of the naphtha pipe (CSB). 

Toulouse, France, 2001 

This devastating accident will be discussed in much more 
detail in future editions as all of the details emerge. 

A massive ammonium nitrate explosion occurred on 
Friday 21 September 2001, at the Azote de France (AZF) 
fertilizer factory on the outskirts of Toulouse, France. The 
blast occurred in a storage facility that held 200-300 tons 
of granular ammonium nitrate. During the tragedy, 29 
people were killed; about 2500 were injured. One wounded 
person died later. 

Ammonium nitrate is primarily used as a fertilizer, 
however, if it combined with certain additives it can be used 
as an explosive. 

The AZF (Azote de France) started up in 1924 on the left 
branch of the Garonne River outside of Toulouse. The plant 
is in an industrial zone, but with urban sprawl the site is 
surrounded by housing and buildings used by the general 
public. 

The blast crated a crater that was about 50- 60 m with a 
depth of over 7 m. Windows were shattered within a radius 
of 1—1.5 km and windows were blown out in the city centre 
3 km away. The strength was estimated to be equivalent 
to 30—40 tons of TNT. 

This incident occurred just 10 days after the attack on 
the World Trade Center in New York. As a result, tens of 
thousands of people assumed that Toulouse was under a 
terrorists’ attack and ran into the streets in panic or 
attempted to flee. 

An investigation is still ongoing and more details will be 
available at a later date. 

Information from (R.J.A. Kersten, A.C. van der Steen, 
A.F.L. and G. Opschoor. The Ammonium Nitrate Explosion 
in Toulouse, France: The Incident and Its Consequences for 
Industrial Activities. A paper delivered at the Center for 
Chemical Process Safety - October 2002). 


A1.11 Case Histories: B Series 

One of the principal sources of case histories is the MCA 
collection referred to in Section All. There are a number of 
themes which recur repeatedly in these case histories. They 
include: 

Failure of communications 

Failure to provide adequate procedures and instructions 
Failure to follow specified procedures and instructions 
Failure to follow permit-to-work systems 
Failure to wear adequate protective clothing 
Failure to identify correctly plant on which work is to be done 
Failure to isolate plant, to isolate machinery and secure 
equipment 

Failure to release pressure from plant on which work is to 
be done 
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Failure to remove flammable or toxic materials from plant 
on which work is to be done 
Failure of instrumentation 
Failure of rotameters and sight glasses 
Failure of hoses 

Failure of, and problems with, valves 
Incidents involving exothermic mixing and reaction 
processes 

Incidents involving static electricity 
Incidents involving inert gas 

In the 2108 case histories described the most frequently 


mentioned chemicals and the corresponding number of 

entries are 





Ammonia 

48 


Chlorine 

37 

Caustic soda 

88 


Sulphuric acid 

46 

The most frequently mentioned operations are 

Loading 


38 

Steaming 

32 

Maintenance 


82 

Tank entry 

39 

Pipe fitting 


27 

Transfer 

46 

Process reaction 


66 

Unloading 

64 

Sampling 


24 

Welding 

36 

The most frequently mentioned equipments are 

Centrifuge 

24 


Machine 

27 

Cylinder 

26 


Pump 

60 

Drum 

76 


Rotameter, sight glass 

27 

Hose 

57 


Tank 

46 

Industrial truck 

31 


Tank car 

59 

Laboratory 

85 a 


Tank truck 

35 

line 

105 


Valve 

86 


a In the first 1623 case histories. 


It is emphasized, however, that in many instances it is not 
appropriate to assign a single cause. 

Accounts of some typical case histories, many of which 
are taken from the MCA collections, are given below. The 
descriptions are generally briefer than those given in the 
original sources, which should be consulted for further 
details. 

B1 A pilot plant batch reactor was started at 5.40 a.m. As 
soon as catalyst was added the temperature and pressure 
began to increase. In accordance with normal operation 
venting was carried out. But this was slow and difficult due 
to carryover of liquid and solids from the reactor into the 
vent lines. At about 6.45 a.m. the agitator stopped as a 
result of overload. The vent lines blocked, the pressure 
increased rapidly and the building had to be evacuated. It 
was re-entered at about 7.20 a.m., when the pressure was 
found to be 750 psi. Thereafter the reaction subsided as the 
reactants were used up. The pressure relief valve was set at 
750 psi, but was found to be blocked as a result of the inci¬ 
dent. The cause of the reaction runaway was overcharging 
of reactants at the start of the batch. (MCA 1966/15, Case 
History 867) 


B2 A batch chlorinator exploded suddenly killing 
employees and doing extensive damage. The reaction tem¬ 
perature was controlled automatically by manipulating the 
chlorine flow. During the batch the measured temperature 
fell sharply and it was realized that the thermocouple had 
failed. The agitator was stopped and the brine cooling was 
shut off while the instrument was repaired, but delay in 
stopping chlorine flow resulted in a high temperature 
giving decomposition reactions. The explosion blew the 
reactor cover through the roof and the reactor itself was 
driven down into the floor. Flammable gases were released 
which burned and caused the casualties mentioned. The 
explosion also ruptured chlorine and ammonia lines. 

The works emergency plan was activated, involving 
both local area services and mutual aid from other chem¬ 
ical firms. (MCA 1962/14, Case History 371.) 

B3 In a process involving chlorination of paraffin in a 
reactor, chlorine gas was piped into the system in a carbon 
steel pipe. The pipe ruptured and released paraffin and 
chlorine, which caused a fire and did extensive damage. 
Subsequent investigation revealed that the contents of the 
reactor had leaked into the pipe and had reacted with the 
chlorine vapour. Severe oxidation of the steel pipe by 
chlorine and/or hydrogen chloride led to the pipe rupture. 
(NFPA1973.) 

B4 An explosion occurred in a batch reactor which blew 
the top right off the vessel. The vessel was supported by 
steelwork two-thirds of the way up its side. The force of the 
explosion pushed the reactor 2.5 ft into the floor, which was 
3 ft below, as shown in Figure A1.21. Fragments of the lid of 
the vessel, which contained a bursting disc, were scattered 
over the countryside. (Anon. 1977n.) 

B5 The loaded basket of a 48 in. suspended-type cen¬ 
trifuge suddenly became unbalanced and in consequence 
the shaft flew out and broke the outlet pipe of an adjacent 
centrifuge. The investigation indicated that the imbalance 
had been caused by a sudden escape of cake from one side 
of the basket due to a hole in the cloth. (MCA 1966/15, Case 
History 645.) 

B6 A 2000 ft 3 diborane surge tank disintegrated causing 
severe loss. The failure fragmented the tank and reduced to 
rubble a 24 in. thick reinforced concrete wall barricading it 
on three sides. Fragments travelled 2200 ft and one cut four 
process lines in a unit 1800 ft distant. The tank was 8 ft 
inside diameter x 30 ft long. It was designed for a working 
pressure of 296 psi with a safety factor of 4. Prior to the 
installation it had been completely radiographed and 
stress-relieved. At the time of the explosion the tank pres¬ 
sure and temperature were 192 psig and 12° C. The cause of 
the explosion was not certain, but the most probable 
explanation appeared to be a defect in the tank aggravated 
by high stresses at the attachment weld of the platform 
support. (MCA 1966/15, Case History 730.) 

B7 A safety shut-off valve on the gas supply to the bur¬ 
ner in the combustion chamber of a drier remained open 
after the unit was shut-down. There was no indicator to 
show whether the valve was open or closed. On relighting 
the burner the operator made several errors, including that 
of opening the main valve on the gas supply to the burner 
before lighting the pilot burner. When the lighted taper was 
inserted into the combustion chamber, there was an explo¬ 
sion. (MCA 1966/15, Case History 1068.) 
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Figure A 1.21 Batch reactor after explosion (Anon., 1977n) 


B8 A reactor with a water j acket collapsed inwards due to 
overpressure in the jacket, the water from the jacket mixed 
with the reaction mass, and hot steam, and chemicals 
erupted violently through a sight glass and a rupture disc 
on the reactor. The overpressure of the jacket took 
place during the initial heating of the reactor charge and 
occurred because the inlet and outlet valves on the jacket 
were closed and there was no pressure relief device on the 
jacket, although there was a bursting disc on the reactor 
itself. (MCA 1966/14, Case History 353.) 

B9 A cabinet containing sparking electrical equipment 
was pressurized with nitrogen to exclude flammable gases. 
Nitrogen from the same main was used to ‘egg’ acetone out 
of a process vessel. The nitrogen pressure fell as a result of 
heavy demand, acetone passed back into the nitrogen 
and got into the cabinet. Subsequently the nitrogen flow to 
the cabinet was shut off, air leaked in and mixed with the 
acetone, and there was an explosion. (Kletz, 1976b.) 

BIO Butadiene from a reactor passed back up a line used 
for adding emulsifier through an obstructed non-return 
valve. The emulsifier tank had an open vent, so that the 
butadiene got out into the building and exploded. The 
explosion caused flames 75 ft high and was heard 10 miles 
away. Damage was minimized, however, by the light con¬ 
struction of the building which ruptured at the roof and at 
two of the walls. (Mallek, 1969.) 


Bll In a pilot plant acetaldehyde oxidation column the 
arrangements involved purging the column with nitrogen 
and then supplying acetaldehyde to the column by nitrogen 
pressure. The oxidation was carried out by admitting a con¬ 
trolled flow of oxygen to the column. The pipework allowed 
the nitrogen to be used to purge the column and part of the 
oxygen pipe. There was nothing to stop oxygen at higher 
pressure passing into the nitrogen in case of a leaking valve 
or of incorrect operation. During operation the operator 
observed a leak on the acetaldehyde supply drum and was 
told to shut the plant down. A few minutes later an explosion 
occurred which killed four people. From the investigation it 
appeared that oxygen had leaked via the nitrogen purge line 
into the acetaldehyde drum, in which reaction occurred with 
large rises in temperature and pressure and eventually a 
detonation. (MCA 1962/14, Case History 117.) 

B12 A malfunction of the control equipment allowed 
raw gas to accumulate in a direct-fired textile fibre drier. 
When circulating fans were turned on, the drier exploded. 
(Doyle, 1969.) 

B13 In an air liquefaction plant an electrical failure 
caused the control valve on an oxygen line to open and pass 
oxygen into a nitrogen line. The nitrogen was compressed 
and then used as wash liquid for the offgas from an 
ethylene plant. The nitrogen wash cold box exploded. 
(Doyle, 1969.) 
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B14 In a chlorine liquefaction system ‘gunk’ was warmed 
prior to removal from a cold trap. A leaky steam valve 
allowed overheating of the gunk. This contained sufficient 
nitrogen trichloride to explode. (Doyle, 1969.) 

B15 A vacuum system failed on a small still distilling a 
chloronitro compound. This allowed the temperature to rise 
and give a self-accelerating decomposition. A large still 
adjacent to the small one was seriously damaged. (Doyle, 
1969.) 

B16 A reboiler distilling epichlorhydrin from a mixture 
with tar was heated by steam. The thermocouple on the 
steam control loop tarred up and gave an incorrect reading. 
The only control of conditions in the column became the 
operator’s response to the temperature at the top of the 
column. This proved inadequate, the reboiler overheated 
and an explosion occurred. (Doyle, 1972a.) 

B17 In a furnace cracking ethylene dichloride to vinyl 
chloride under computer control the flow of ethylene 
dichloride to the furnace was controlled to maintain 
an optimum temperature in the cracked gas exit line. 
A furnace tube split and reduced the cracked gas flow and 
the cracked gas temperature. The control action increased 
the flow of ethylene dichloride. The furnace tubes burned 
up. (Doyle, 1972a). 

B18 A common type of ‘Dowtherm’ vaporizer is a single 
coil in which the liquid is superheated, followed by a flash 
chamber. There is an interlock between a flowmeter on the 
liquid line to the coil and the fuel flow controller, so that the 
coil is not heated unless liquid is flowing through it. A 
vapourizer of this type was started up after a shut-down 
and the coil immediately exploded. The impulse lines to the 
differential pressure transmitter had frozen just before the 
shut-down, showing a normal flow, and during the shut¬ 
down the exit line from the coil also froze up. On start-up 
the interlock did not work owing to the incorrect signal 
from the flowmeter and the heating of the coil caused 
pressure to build up and rupture it. (Doyle, 1972a.) 

B19 Excess water was removed from a hydrogen 
peroxide-water mixture by vacuum distillation. As a 
precaution against attempting to vaporize a dangerous 
concentration of peroxide, the liquid level and vapour tem¬ 
perature were measured: a low level or a high temperature 
signal operated a valve to dump de-ionized water into the 
reboiler. The hydrogen peroxide solution produced large 
quantities of heavy foam. The float-type level instrument 
measured the foam rather than the liquid level. After some 
erratic readings it gave a seriously inaccurate one while the 
level was low, and the reboiler exploded. (Doyle, 1972a). 

B20 The agitator on abatch nitration reactor was stopped, 
but the process operator was unaware of this. Instrumenta¬ 
tion which should have cut off the acid feed to the reactor and 
given an alarm signal of agitator stoppage apparently failed 
to work. When the agitator started up again, the reactor 
exploded. (Fritz, 1969.) 

B21 In an ethylene cracking furnace the flow of fuel to the 
furnace was manipulated to control the temperature of the 
gas leaving the furnace. The temperature measuring 
instrument failed and gave a low reading. The control 
action increased the heat to the furnace. The furnace was 
designed to supply mainly latent heat of vaporization 


to the process stream with a small amount of superheat. 
Thus the vapour temperature was sensitive to the addi¬ 
tional heat input and rose rapidly. The piping overheated 
and ruptured, releasing ethylene gas which was ignited 
by the burners of an adjacent furnace. The resultant fire 
did severe damage. (H.D. Taylor and Redpath, 1971.) 

B22 Ammonia synthesis gas at 2000 psig was passed 
through a scrubber which was fed with weak aqueous 
ammonia. The liquid from the bottom of the column passed 
to a vertical holdup tank with a 2 in atmospheric vent. The 
level of liquid in the base of the column was controlled 
automatically. The control valve in this loop stuck in the 
open position. Liquid and gas from the column surged into 
the hold-up tank and ruptured it. The escaping gas was 
approximately 75% hydrogen and it ignited, causing a fire. 
(MCA 1966/15, Case History 598.) 

B23 A flow ratio control loop failed and allowed excess 
hydrogen to enter a catalytic tower. Hot spots developed, 
causing thermal decomposition of the hydrocarbon- 
hydrogen stream and rupture of the tower. (MCA 1966/15, 
Case History 609.) 

B24 A flame failure occurred on the burner of a Dow¬ 
therm vapourizer and the procedure for relighting the 
burner was initiated. The firebox was checked and the 
automatic control system which purges and lights the flame 
was activated. A short developed across the fuelselector 
switch of the system, causing fuel gas to enter the com¬ 
bustion chamber during the purge cycle and thus creating a 
flammable fuel-air mixture. When the purge cycle was 
complete and the pilot light was ignited, an explosion 
occurred. (MCA 1966/15, Case History 821.) 

B25 An inert gas generator was found to have produced a 
flammable oxygen mixture. The ‘fail safe’ flame failure 
device had failed. The trip system on the oxygen content of 
the gas generated had caused shut-down when the oxygen 
content in some of the equipments reached 5%, but did not 
prevent creation of a flammable mixture in the holding 
tank. (MCA 1966/15, Case History 679.) 

B26 An air supply enriched with 2-3% oxygen was 
provided for flushing and cooling air-supplied suits after 
use. A failure of the control valve on the oxygen-air 
mixing system caused this air supply to contain 68-76% 
oxygen. An employee used the supply to flush his air- 
supplied suit, disconnected the lines, removed his helmet 
and lit a cigarette. His oxygen-saturated underclothing 
caught fire and he received severe burns. (MCA 1966/15, 
Case History 884.) 

B27 A chlorine cellroom was experiencing operational 
difficulties. A failure of the control system caused a back 
pressure to develop. When the operating personnel tried to 
shut the system down using manual controls, a failure of 
this equipment caused a serious chlorine release. One of 
two compressors taking hydrogen from a low-pressure 
gasholder continued to operate and failure of a low level trip 
created a negative pressure, allowing air to leak in. An 
explosion occurred in the cooling coils of the compressor. 
Hydrogen from another part of the process was introduced 
into the holder in an effort to maintain production. 
The hydrogen-air mixture in the holder diffused into 
the catalyst purification unit, where a high temperature 
developed, causing a second explosion. The failure of 
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the gasholder trip to operate was due to the fact that the 
timer had been bypassed by a ‘jumper’. (MCA 1966/15, 
Case History 694.) 

B28 An explosion occurred on a vinyl chloride poly¬ 
merization plant at Minamata, killing four and injuring 
eight other people inside the factory and slightly injuring 
two people outside it by flying glass. The polymerization 
reaction in No. 3 reactor was complete and the operators 
intended to discharge the contents, but No. 4 reactor was 
discharged in error. The reaction in this reactor was 
incomplete and the VCM escaped and exploded. (MCA 
1966/15, Case History 816.) 

B2 9 A rigger was removing manhole covers from a vinyl 
chloride reactor when he apparently became confused and 
removed the cover from a reactor which was operating 
under pressure. A large quantity of vinyl chloride vapour 
was released. It ignited to give a flash fire, which killed the 
rigger and two labourers. (MCA 1970/16, Case History 1132.) 

B30 In an ethylene oxide plant inert gas was circulated 
through a process containing a catalyst chamber and a heat 
removal system. Oxygen and ethylene were continuously 
injected into the inert gas and ethylene oxide was formed 
over the catalyst, liquefied in the heat removal section and 
passed to the purification system. On shut-down of the 
circulating compressor an interlock stopped the flow of 
oxygen and the closure of the valve was indicated hy a lamp 
on the panel. During one shut-down the lamp showed the 
oxygen valve closed. The process operator had instructions 
to close a hand valve on the oxygen line, but he expected 
the maintenance team to restore the compressor within 
5-10 min and did not close the valve. The process loop 
exploded. The oxygen control valve had not in fact closed. 
A solenoid valve on the control valve bonnet had indeed 
opened to release the air and it was the opening of this 
solenoid which was signalled by the lamp on the panel. 
But the air line from the valve bonnet was blocked by a 
wasps’ nest. (Doyle, 1972a.) 

B31 A catalyst bed was regenerated by circulating 
nitrogen through an electric heater, the bed and a cooler. 
The flowmeter on the nitrogen line choked with dust early 
on and the process operators learned to make do without it, 
controlling the plant by the nitrogen temperature at the 
bed inlet. One day the cooler blocked with dust and the 
temperature at the bed inlet stuck at its normal value. 
The heater over-heated and at 740°C its high temperature 
trip operated and cut off the power. The operator, seeing 
that the other instrument readings were normal, assumed 
the trip to be faulty and switched the power back on. The 
trip operated and was overridden three times in 1 h. There 
was a shift change during this hour. Finally the heater shell 
burst. (Kletz, 1974b.) 

B32 A tank had to be filled with enough raw material to 
last a day.The operator watched the tank level and switched 
off the pump when the required level was reached. One day 
after several years operation and some 1000 fillings, the 
man let the tank overflow. So a trip system was installed as 
an additional safeguard. The operator, however, got in the 
habit of using the trip system as a replacement and got on 
with something else. The plant manager knew about this, 
but was happy to see the improvement in productivity. 
However, since the trip system can be expected to fail about 


once in 18 months, the overall system had actually become 
less reliable. (Kletz, I974d.) 

B33 An explosion occurred in the open air in the vicinity 
of a hydrogen vent stack and caused severe damage. It was 
normal practice to vent hydrogen for periods of approxi¬ 
mately 45 min. On this particular occasion there was no 
wind, the hydrogen failed to disperse and the explosion 
followed. (MCA 1966/15, Case History 1097.) 

B34 An operator was adding charcoal impregnated with 
catalyst from a plastic bag into a reactor containing caustic 
soda blanketed with nitrogen. The charcoal dust ignited 
and there was a flash fire. It is believed that the ignition was 
caused by static electricity. (MCA 1966/15, Case History 
1094.) 

B35 An employee was repairing a blower on the vent 
stack of a dissolver. When he had finished the work, he 
switched the machine on, but observed that it was not 
operating. He reached into the stack to give the fan blades a 
turn and there was an explosion. The vent stack had con¬ 
tained a flammable mixture, which was probably ignited 
by static electricity from the man’s body. (MCA 166/15, Case 
History 703.) 

B36 A man was filling his cigarette lighter from a gallon 
can of naphtha when he dropped the lighter. It apparently 
struck on the wheel and gave a spark. Flammable vapour 
from a nearby drum filling plant ignited and caused a violent 
explosion. (MCA 1970/16, Case History 1175.) 

B37 A substantial section of lagging along the pipework 
of a process heating fluid system became contaminated 
with the fluid, which was a low volatility mineral oil, due to 
a pump gland leak. A lagging fire occurred, the symptoms 
of which were that first smoke was seen rising from the 
lagging, then the heating fluid rose 50°C above its set tem¬ 
perature of 270°C and finally the pump and a considerable 
length of pipe became enveloped in flames. The latter were 
quickly dealt with, but the temperature of the heating fluid 
continued to rise. Soon afterwards a small explosion 
occurred in a covered oil header tank housed inside a 
building. There was a large release of oil and fumes from 
the tank and these then exploded violently, causing severe 
damage to the building. The probable explanation was that 
some of the oil had been heated above its spontaneous 
ignition temperature and had been forced by expansion 
back up into the header tank, where its vapour met air and 
ignited. (Gugan, 1974a.) 

B38 A large spray drying plant with direct heating from 
a combustion chamber was being run in. The combustion 
system had been operating at a very low firing rate under 
manual control for some 24 h. The fuel oil to the burner was 
pumped by a positive displacement pump through ther¬ 
mostatically controlled heaters, excess oil being bypassed 
around the pump. After firing had continued unsupervised 
for some hours, there was a sudden eruption of flame 
through a hinged explosion panel near the combustion 
chamber and a man walking past was enveloped. Investi¬ 
gation showed that the eruption of flame could be 
explained by a gross increase in fuel flow to the burner, 
even though a manual valve on the fuel line was still at its 
original setting. It was also discovered that a fire had 
developed in the lagging of the fuel oil system, the lagging 
having become saturated with oil due to leaks from pipe 
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joints occurring during the initial pressure testing. The 
reason for the increase in fuel oil flow was probably a rise in 
the oil temperature to a value much in excess of that set on 
the thermostat, so that there was a decrease in oil viscosity 
and an increase in the quantity flowing through the valve. 
(Gugan, 1974a.) 

B39 Dried material from a double-drum steam drier was 
passed from a bag packer via a spout with a cotton apron to 
a leverpak. A small dust explosion occurred at the apron 
and led to a fire in the bagging plant and leverpak. It was 
considered from investigation that the dust had been 
ignited by a spark discharge of static electricity. The cotton 
apron was non-conducting and the bag packer was not 
earthed. (MCA 1966/15, Case History 653.) 

B40 An operator was in the process of unloading tita¬ 
nium carbide dust from 2 ft conical ball mill. He had 
removed 95 % of the material. The mill was being rotated in 
order to clean it when a dust cloud ignited. He received 
severe burns from which he later died. The product had 
been milled to a finer size than desired and thus rendered 
highly reactive. (MCA 1966/15, Case History 618.) 

B41 A set of air compressors comprising four three-stage 
740 h.p. machines with a discharge pressure and tempera¬ 
ture of 350 psi and 350°F had been in operation for about 8 h 
following aplant shut-down.The third-stage cylinder in one 
of the compressors was faulty and the 125 psi relief valve 
between the second and third stages began to relieve air 
intermittently. The third-stage discharge temperature went 
off the instrument scale at 400°F before the compressor 
could be shut-down. Some 15 min later the overhead dis¬ 
charge line was observed to be glowing red hot. Before the 
other compressors could be shut-down, the line ruptured 
and a flash fire occurred. Investigation indicated that lubri¬ 
cating oil had ignited in the compressor cylinder and dis¬ 
chargeline. (MCA 1962/14, Case History 35.) 

B42 An explosion occurred in a vinyl chloride pump and 
seriously injured an operator. The pump was on the ‘recov¬ 
ered’ vinyl chloride monomer (RVCM) system. The line 
sections before and after the pump had been removed and 
the explosion occurred in the idle vented pump about an 
hour later. The investigation showed that the entire RVCM 
system was contaminated with vinyl chloride polyper¬ 
oxide, which is an unstable material. There had been three 
abnormal occurrences on the plant prior to this accident. 
The RVCM gas compressors had not shut-down at 
low pressure due to the failure of a pressure switch. There 
had been an accumulation of RVCM liquid in the storage 
tanks for 20 days. And the acidity level in the vinyl chloride 
feed to the polymerizers had been high. (MCA 1970/16, 
Case History 1551.) 

B43 A four-stage reciprocating compressor used to 
compress nitrogen from 15 to 3000 psig exploded with a 
‘brilliant flash’ and projected fragments up to 160 ft from 
the building. Previous to the explosion the machine had 
been shut-down to change the third-stage suction and dis¬ 
charge valves and again to correct an error in the installa¬ 
tion of the former. Investigation showed that the discharge 
valve had been installed in the reversed position and that 
compression of the gas under these conditions could give 
a pressure of 16,800 psig and a temperature of 1310°F. This 
temperature exceeded the autoignition temperature of the 


lubricating oil. There may have been oxygen present due 
to the maintenance operations. These conditions resulted 
in the explosion. (MCA 1966/15, Case History 1056.) 

B44 A 40,000 gal horizontal tank was used to produce 
aqueous ammonia by introducing water at the top and 
anhydrous ammonia at the bottom. The tank was emptied 
and the water flow was started to make the next batch. 
The tank imploded due to the vacuum created by the 
absorption of the ammonia vapours by the water. (MCA 
1966/15, Case History 916.) 

B45 A holding tank containing ‘heavies’ from cracking 
furnaces suddenly erupted blowing oil, water and steam 
over the adjacent area. It is believed that condensate had 
come in contact with the hot oil, which was at a temperature 
of 600-700°F, thus generating large quantities of steam. 
(MCA 1962/14, Case History 455.) 

B46 A storage tank was not in use and was boxed up with 
some water inside. Rusting took place, the oxygen of the air 
in the tank was depleted and the tank collapsed inwards. 
(Anon., 1977n.) 

B47 A storage tank was cleaned out and filled with a 
high purity liquid. A polyethylene bag was put over the 
vent to prevent contamination. It was a hot day and the 
temperature of the liquid in the tank rose. There was a 
sudden shower, vapour in the tank condensed and the tank 
collapsed inwards. (Anon., 1977n.) 

B48 Cold liquid was pumped into a storage tank con¬ 
taining hot liquid. The liquid in the tank was cooled, the 
vapour pressure fell and the tank collapsed inwards. 
(Anon., 1977n.) 

B49 Modifications were required to a high-pressure 
chlorine main. The main was isolated and men began work. 
The supervisor then realized that there might be some 
chlorine present in a section of pipework at the tank car 
rack. The pipework was connected to the main, but there 
was an isolation valve between the main and the pipework. 
He assumed that this valve was shut and initiated measures 
to remove any chlorine present in the pipework section. 
There was liquid chlorine in this pipework and it passed 
via the isolation valve into the main and gassed the fitters 
working there. The isolation valve was subsequently found 
to be frozen in the part open position. (MCA 1966/15, Case 
History 707.) 

B50 An employee went into a water cistern to install 
some control equipment and immediately collapsed into 
water 2 ft below. A second employee who had accompanied 
him ran to fetch assistance. Minutes later he came back 
with several others, two of whom entered the cistern and 
also collapsed. Meanwhile the alarm had been raised. The 
fire services arrived and a crowd gathered. While the fire 
officer was putting on his self-contained breathing appa¬ 
ratus, one of the by-standers, saying that he could swim, 
descended into the cistern. The fire officer then went in, but 
took off his mask, presumably to call for some equipment, 
and collapsed. All five people died due to hydrogen sulfide 
poisoning. (MCA 1970/16, Case History 1213.) 

B51 A double fatality occurred in a steel works whilst 
two fitters were changing a gearbox valve for a blast fur¬ 
nace system. One or both men opened a valve allowing gas 
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to escape at a rate of 50,000 cu. ft. per hour. Of another two 
men who went to investigate the volume of gas passing 
through the valve, one was overcome by gas (but later 
recovered) and the other escaped to summon assistance. 
Safety precautions should have included either the isola¬ 
tion of the system upstream from the valve or the use of 
suitable breathing apparatus by the workmen. Although 
both maintenance men had been issued with compressed 
airline breathing apparatus it was found after the accident 
that only one of these was connected with the air supply 
and neither was being worn. The fatalities highlighted the 
dangers of complacency which can occur when a system 
has operated without incident for years and also the need to 
ensure that workers employed in such situations are ade¬ 
quately trained in the use of breathing apparatus.’ (Annual 
Report of HM Chief Inspector of Factories, 1974.) 

B52 During plant commissioning a temporary filter was 
put in a compressor suction line, as shown in Figure A1.22. 
The filter was located between the compressor and the low 
suction pressure trip. The filter blocked, the suction pres¬ 
sure fell below atmospheric, air was sucked in and a 
decomposition reaction occurred further on in the process 
where there was a higher pressure. Two pipe joints sprung 
and gas escaped and ignited. The resulting fire caused 
£100,000 damage and delayed the commissioning many 
months. (Henderson and Kletz, 1976.) 

B53 An olefins plant was severely damaged during 
commissioning by a fire in the refrigeration section of the 
gas separation plant. Although no one was seriously 
injured, the fire burned for 15 h and caused delay to the 
commissioning and considerable damage and consequential 
loss. The cause of the fire was that the low-pressure refrig¬ 
eration section, which was designed for 50 psig pressure, 
was subjected to a pressure of 400 psig. The overpressure 
occurred because of closure of a 12 in. valve on the exit of this 
section, installed during construction to allow high pressure 
gas to be used to assist in drying the plant prior to commis¬ 
sioning. The installation of the valve had been well debated in 
the plant operating team and with the process design con¬ 
tractor. But the installers did not follow the well-established 
requirement of providing pressure relief protection on the 
low-pressure system. (Heron, 1976.) 

B54 A works had a special network of air lines installed 
some 30 years ago for use with breathing apparatus only. 
The supply to this network was taken off the top of the 
general purpose compressed air main as it entered the 
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Figure A1.22 Compressor system after modification 
(Henderson and Kletz, 1976) (Courtesy of the Institution of 
Chemical Engineers) 


works, as shown in Figure A1.23. One day a man wearing a 
face mask inside a vessel got a faceful of water. He was able 
to signal to the anti-gas man and was rescued. Investigations 
revealed that the compressed air main had been renewed 
and that the branch to the breathing apparatus network had 
been connected to the bottom of the compressed air main. 
As a result a slug of water in the main would all go into the 
catchpot and fill it more quickly than it could empty. 
(Henderson and Kletz, 1976.) 

B55 Pressure relief on a low-pressure refrigerated ethy¬ 
lene tank was provided by a relief valve set at about 1.5 psig 
and discharging to a vent stack. When the design had been 
completed, it was realized that if the wind speed was low, 
cold gas coming out of the stack would drift down and 
might then ignite. The stack was not strong enough to be 
extended and was too low to use as a flare stack. It was 
suggested that steam be put up the stack to disperse the 
cold vapour and this suggestion was adopted. The result 
was that condensate running down the stack met cold 
vapour flowing up, froze and completely blocked the 8 in. 
pipe. The tank was overpressured and it burst. Fortunately 
the rupture was a small one, the ethylene leak did not ignite 
and was dispersed with steam while the tank was emptied. 
(Henderson and Kletz, 1976.) 

B56 A metal chute used to transfer a powder from a 
metal hopper into a metal vessel was replaced by a plastic 
hose. The flow of powder down the chute caused a charge of 
static electricity to build up in the hose and, although the 
hose was a conductor, the polypropylene end pieces used to 
connect it to the hopper and the vessel were not, and the 
charge was unable to dissipate. A spark occurred and the 
dust was ignited. (Heron, 1976.) 

B57 A relief valve weighing 258 lb was being removed 
from a plant. A 25 ton telescopic jib crane with a jib length 
of 124 ft and a maximum safe radius of 80 ft was used to lift 
the valve. The driver failed to observe this maximum 
radius and went out to 102 ft radius. The crane was fitted 
with a safe load indicator of the type which weighs the load 
through the pulley on the hoist rope, but this does not take 
into account the weight of the jib, so that the driver had no 
warning of an unsafe condition.The crane overturned on to 
the plant, as shown in Figure A1.24. (Anon., 1977n.) 

B58 Halfway through the unloading of a tank truck of 
anhydrous ammonia a stream of liquid was observed leak¬ 
ing from the bonnet of the stop valve on the unloading line. 



Figure A 1.23 Air offtake for breathing apparatus as ori¬ 
ginally installed (Henderson and Kletz, 1976) (Courtesy of 
the Institution of Chemical Engineers) 
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Figure A1.24 Mobile crane overturned on to plant (Anon., 1977n) 


The truck was taken off line and the storage tank was 
vented to a neutralizing pit to relieve its pressure. Con¬ 
siderable difficulty was experienced in reducing the pres¬ 
sure in the tank sufficiently to stop the flow of liquid 
ammonia. There was no shut-off between the leaking valve 
and the tank. Eventually the pressure was reduced by 
using a compressor and exhausting it to atmosphere. 
Investigation indicated that the failure of the valve was 
caused by a combination of a flaw in the body and strain 
induced by excessive pressure on one of the stud holts. 
(MCA 1970/16, Case History 1114.) 

B59 A storage tank 108 ft diameter x 49 ft high containing 
refrigerated propane at a pressure less than 1 psig was over¬ 
pressured and ruptured at RasTanura refinery, Saudi Arabia. 
The propane caught fire and gas from pilot-operated relief 
valves on two similar tanks, one containing propane and one 
butane, was also set alight. The ruptured tank burned out in 
some 36 h, while the butane and propane tank vent 
fires burned for 3 and 6 days, respectively. One person was 
killed and 115 were injured, and serious damage was done. 

Just prior to the incident the refrigeration plant 
had been shut-down. The intention was to go over to 


autorefrigeration in which the propane tank would be 
cooled by boiling off liquid and venting it into the blow¬ 
down system. But this autorefrigeration could not be 
established, because the blowdown line was blocked with 
liquid butane. The reason for the presence of the butane 
was that a remotely operated isolation valve had not fully 
closed, because the valve spring was prevented from oper¬ 
ating properly by paint and corrosion products. 

There was a steady rise in the pressure in the propane 
tank up to and then beyond the relief valve set pressure of 
1 psi. The operators, both at the end of one shift and at the 
beginning of the next, tried to find out the cause of the rise in 
pressure, butthey did not alertthe supervisors. (Laney, 1964.) 

B60 An operator checked the level in a storage tank and 
then began pumping in a volatile monomer from a tank 
wagon. The vent pipe of the storage tank was blocked, 
however, and a large quantity of monomer flowed out of the 
dip leg. (MCA 1970/16, Case History 1192.) 

B61 A tank truck was being loaded with ethyl acetate. 
The loader heard what he described as a ‘sizzling’ sound 
and looked in, but could see nothing. Soon after an explo¬ 
sion occurred. The investigation showed that the earthing 
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arrangements on the tank were in good order. The evidence 
suggested that the explosion was caused by static charge on 
the surface of the liquid. (MCA 1966/15, Case History 986.) 

B62 A tank trailer containing 6876 gal of propane under 
pressure ruptured on the highway 560 ft from the centre of 
the town. The propane escaped and exploded, causing 10 
deaths, 17 injuries and extensive damage. The investigation 
revealed various undesirable features of the tank, includ¬ 
ing weld defects which would create areas of enhanced 
stress concentration, differences of alignment between the 
cylinder and the end parts, and possible embrittlement of 
the plates due to the use of a heating process to effect 
chamfering. (MCA 1966/15, Case History 879.) 

B63 Acetic acid was being pumped out of one compart¬ 
ment of a two-compartment trailer. The manhole cover was 
propped open. The operator climbed on the tanker to obtain 
a sample. In order to do this he had to lift the manhole cover 
back. When he had taken the sample, he closed the manhole 
cover completely. A few seconds later the tank imploded as 
a result of the vacuum generated by the continued pump¬ 
ing. The tank was equipped with a spring-loaded vacuum 
breaker, but either this failed to open or it was undersized. 
(MCA 1966/15, Case History 1011.) 


B64 A tractor semitrailer transporting 7000 gal of pro¬ 
pane was modified by inserting a tee-piece between the 
excess flow valve and the manual shut-off valve on the 3 in. 
discharge line. The joint was connected to the tractor fuel 
tank by a % in. hose to allow the vehicle to be filled en 
route. There was another manual shut-off valve on the % in. 
line. The hose broke in transit. The leakage flow rate was 
too small to activate the excess flow valve. The driver 
stopped the vehicle, shut-off the engine and told the trainee 
driver to shut-off the smaller hand valve. When the latter 
touched the valve, the propane vapours ignited and he 
was engulfed in flames. The gas continued burning for 
another 1.5 h.The trainee driver died in the fire, which also 
caused other injuries and damage. (MCA 1966/15, Case 
History 995.) 

B65 An explosion occurred in a terraced house in East 
Street,Thurrock, in 1969 that blew a hole in the floor at the 
foot of the staircase. The wife of the householder fell in 
while carrying her child and both were injured. The Times 
(9 April, 1969) reported 

Investigators found that the explosion had been caused 
by the ignition of a mixture of petrol vapours and air and 
that the vapour was the result of a spillage of petrol two 
years before. 


Table A1.4 Some incidents and problems ii 

i the industries 1965- 77 


1 Power loss, weather and earthquake 

Power loss 

1965 Dec. 6,76 

1971 Jan. 25,25 


1966 Feb. 14,86 

1972 Nov. 27,34 


1967 Jun. 19,86 

1973 Nov. 12,94 


1968 Jun. 3,31 

1970 Jun. 27,80 

Dec. 10,66 

Cold weather 

1962 Feb. 5,35 

1977 Feb. 14,25 

Wind, hurricane, tornado 

1961 Oct. 2,33 

1972 Jul. 24,75 


1970 Aug. 24,31 

Nov. 27,34 

Flood 

1972 Jul. 24,75 


Earthquake 

1968 Dec. 16,44 

1972 Sep. 18,72 

2 Safely and safety legislation 

Safety 

1974 Jun. 10,34 

1975 Jun. 9, 34 

1977 Jun. 6,68 

Safety legislation and law 

1964 Aug. 3,27 

1977 Jan. 17,69 


Sep. 14,83 

Sep. 26,44 


1973 Apr. 16,58 

Dec. 5,67 


1975 Jun. 9,36 

1976 Jul. 19,72 

Dec. 19,28 

3 Transport and transport legislation 

Transport 

1962 Oct. 15,78 

1972 Dec. 11,44 


Nov. 12,86 

1974 Dec. 23,24 


1963 Feb. 4,36 

1975 Mar. 17,20 

Transport emergency systems 

1970 Jun. 15,83 

1971 Sep. 20,78 

1972 Sep. 4,19 

Transport legislation 

1969 Oct. 6,97 

1974 Dec. 23,24 


1973 May 28,43 

1977 Jan. 3,38 


1974 Sep. 16,44 

Mar. 28,54 

4 Pipelines and pipelines legislation 

Pipelines 

1964 Dec. 21, 27 

1967 Mar. 13,88 


1965 Sep. 27,75 

Apr. 24,87 
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Table A1.4 (continued) 


1966 Apr. 11,85 

1969 Sep. 22,68 


Jul. 4,39 

Oct. 20,52 


Dec. 19,45 

1970 Sep. 21,85 


1967 Jan. 2,19 

1973 Aug. 20,72 


Jan. 30,50 

1975 Jan. 20,44 

Pipelines legislation 

1965 Nov. 22,79 

1969 Oct. 20,52 


1968 Dec. 2,54 

1973 Aug. 20,72 


1969 Sep. 22,68 

1975 Jan. 20,44 

5 Toxic chemicals at the workplace 

Toxic or potentially toxic chemicals, 

1971 May 3, 38 

1976 May 24,70 

especially carcinogens 

1972 Jan. 10,38 

Oct. 25,66 


1974 May 13,52 

Dec. 20,19 


Oct. 28,33 

1977 Jan. 3,36 


1975 Jan. 6,57 

May 9,87 


Mar. 3,74 

Jun. 6,67 


May 12,40 

Jul. 4,62 


Jul. 7,36 

Jul. 4,64 


Jul. 21,52 

Jul. 18,54 


Aug. 4,38 

Aug. 15,88 


Aug. 18,41 

Oct. 25,74 


1976 Feb. 2,48 

Mar. 15,48 

Dec. 19,28 

Legislation on toxic chemicals 

1973 Jan. 22,47 

1977 Feb. 14, 28 


1974 May. 27,54 

Feb. 28,116 


Sep. 16,46 

Mar. 28,54 


Oct. 14,51 

Apr. 11,74 


Nov. 25,33 

May. 9,88 


1975 Feb. 3,20 

Jun. 20,60 


Mar. 3,74 

Jun. 20,62 


Sep. 15,70 

Jul. 4,64 


Oct. 27,56 

Sep. 12,90 


1976 May 24,70 

Oct. 10,72 


1977 Jan. 17,70 

Oct. 24,74 


Jan. 31,54 

Nov 21,114 


Jan. 31,56 

Dec. 5,68 

Testing and indexing of chemicals 

1974 Jul. 8, 29 

1975 Feb. 3,20 

1977 Jun. 20,61 

Vinyl chloride 

1974 Feb. 4,19 

1975 Apr. 14,33 


Apr. 15,39 

Jul. 7,34 


Jun. 24,98 

1977 Jan. 3,37 


Nov 25,33 

1975 Jan. 20,41 

Jul. 18,52 

Vinyl chloride legislation 

1974 Mar. 4,63 

1975 Feb. 17,35 


Apr. 15,40 

Jun. 9,36 


Jun. 24,98 

Oct. 13,67 


Jul. 8, 28 

Nov 24,20 


Jul. 22,54 

1976 Jan. 5,74 


Sep. 30,42 

Oct. 14,52 

1977 Jun. 20,62 


Dec. 23,21 

Aug. 1,20 

6 Pollution 


1974 May. 27,53 

1977 Jan. 31,55 


1975 May. 26,58 

May. 23,94 


Nov 10,118 

Jun. 6,68 

Sudden releases and spillages 

1967 Jun. 5,64 

1973 Sep. 3,48 


1969 Aug. 25,56 

1974 Jun. 24,96 


1971 Jul. 26, 55 

Jul. 8, 29 


1973 Feb. 5, 26 

Jul. 23,57 

1977 Mar. 14,75 
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Table A1.4 (continued) 

Long-term, low concentration pollution and its effects 


Fish kill s 
Oil slicks 
Mercury pollution 

Pesticides 

Ocean dumping 
Ocean incineration 
7 Pollution legislation 


Odour 

Water 


Oil spills 
Noise 

8 Abandonment of actual or planned production 


See also Transport, pipelines 


1968 Jan. 1,9 

1974 Nov. 25,36 

Aug. 26,25 

1975 Feb. 3,17 

1969 Mar. 10,44 

May. 12,40 

1970 Aug. 10,50 

May. 26,59 

Oct. 19,72 

Aug. 4,38 

1973 Jan. 22,48 

Sep. 1,52 

Aug. 20,71 

Nov. 10,119 

1975 Dec. 8,80 

1977 Jan. 3,36 

1976 Feb. 16,45 


1964 Jul. 6,70 

1970 Mar. 23,57 

1969 Nov. 3, 25 

1971 Jul. 26,55 

1969 Feb. 10,40 

1975 Mar. 17,17 

1973 Jun. 25,35 


1967 May. 8,85 

1970 Aug. 10, 50 

Nov. 20,60 

Sep. 7,25 

1970 Apr. 20,53 

Oct. 5,44 

1964 Apr. 13,81 

1976 Mar. 15,48 

1967 Oct. 9,108 

Oct. 25,66 

1974 Apr. 15,40 


1970 Aug. 24,32 

1974 Oct. 28,33 

1974 Oct. 28,33 

1975 Dec. 9,82 

1975 Jul. 7,35 

1976 Mar. 15,48 

Sep. 1,52 

1977 Mar. 14,74 

Oct. 13,68 


1969 Jun. 2,44 

1975 Jan. 20,42 

1970 Nov. 30,17 

1976 Feb. 2,48 

1971 Feb. 8,20 

Mar. 1,62 

1972 May. 15, 53 

1977 Feb. 28,116 

1973 Jun. 25,34 

Mar. 28,56 

1974 Feb. 4,20 

Apr. 11,74 

Mar. 18, 38 

Jul. 18, 54 

Jun. 24,95 

Nov. 7,42 

Sep. 2,20 

Dec. 19,26 

Oct. 14,50 

Dec. 19,27 

Dec. 23, 24 


1972 Sep. 4,19 


1969 May 19,89 

1976 Jul. 5,35 

1970 May 18,75 

1977 Jan. 31,56 

1972 May 15,53 

Jul. 4,63 

Oct. 16,53 

Aug. 15,90 

1974 Jan. 7,46 

Aug. 29, 20 

Apr. 29,82 

Dec. 5,68 

Oct. 14,52 

Dec. 18, 27 

1975 Feb. 3, 20 


1974 Jan. 7,46 


1974 Aug. 5,46 

1975 Oct. 13,68 

1967 Mar. 27,41 

1973 Jun. 11,63 

1968 Feb. 12,49 

1974 Nov. 25,33 

1969 Mar. 10,44 

Dec. 9,61 

Jul. 14,42 

Dec. 23, 21 

1970 Oct. 5,43 

1975 Oct. 13,67 

1971 Jan. 25, 25 

Nov. 10,118 

Feb. 8,17 

Nov. 24, 20 

Jul. 26, 56 

1976 Jan. 19,49 
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Table A1.4 (continued) 


Sep. 6,27 
1972 Mar. 20,53 


1977 Jan. 31,55 
Oct. 10,69 


This list includes cases where abandonment of actual or planned production was a i 
in fact occur. 

9 Litigation 1963 May 13,83 

1964 Apr. 27,78 
Dec. 21, 27 
1966 Apr. 11,85 
1968 Aug. 26,25 
1970 Mar. 23, 59 


i possibility, even if it did not 

1970 Jul. 27,80 
Aug. 24,32 

1971 Apr. 19,53 

1972 Dec. 25, 20 

1974 Oct. 14,52 

1975 Nov. 24,17 


The spillage involved 367 tons of petrol on rail sidings 
in July, 1966, and the investigation suggested that there 
was probably an eight-foot thick band of petrol vapour 
lying well beneath the surface of the ground in the East 
Street area. The vapour had been raised to the surface 
because of exceptionally heavy rainfall. 

The distance from the point of spillage to the house 
was several hundred yards. (Kletz, 1972b.) 

B66 On 30 November, 1962 at Cornwall, Ontario, a 
chlorine rail car was in a siding when a failure of the anchor 
section occurred and 30 ton of chlorine escaped. The siding 
was on the downwind side of town. Police and firemen 
organized prompt evacuation of the several hundred people 
in the rural area downwind of the spillage. Some 89 people 
were gassed. (Simmons, Erdmann and Naft, 1974.) 

B67 On 9 August, 1963 in Philadelphia, Pennsylvania, a 
chlorine rail tank car was rammed and a 1 in. loading line 
was broken. For a short period there was an escape of 
chlorine, amounting probably to no more than 1 ton. The 
release was in the middle of a built-up area, however. 
The number of people gassed was at least 430. (Simmons, 
Erdmann and Naft, 1974.) 

A1.12 Some Other Incidents and Problems 

Some other incidents and problems related to safety and 
loss prevention are listed in Table A1.4 under the following 


heads: (1) power loss, weather and earthquake; (2) safety 
and safety legislation; (3) transport and transport legisla¬ 
tion; (4) pipelines and pipelines legislation; (5) toxic 
chemicals in the workplace; (6) pollution; (7) pollution 
legislation; (8) abandonment of actual or planned produc¬ 
tion and (9) litigation. 

The references in Table A1.4, which are quoted by date 
only, are to accounts given by ‘Chementator’ in Chemical 
Engineering. The information given refers primarily to the 
United States. 

The table shows very clearly the increasing public 
concern with health and safety and with pollution in the 
process industries that began to build up from the early 
1970s. 


A1.13 Notation 

Q flow rate of propane (ft 3 /s) 

u average wind velocity (ft/s) 

x,y, z downwind, cross-wind and vertical distances (ft) 

Oy, standard deviations in crosswind, vertical 

directions (ft) 

X concentration of propane (volume fraction) 

Xd concentration of propane on centreline (volume 

fraction) 
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At about 4.53 p.m. on Saturday 1st June 1974, the Flixborough 
Works of Nypro (UK) Ltd (Nypro) were virtually demol¬ 
ished by an explosion of war-like dimensions. Of those 
working on the site at the time, 28 were killed and 36 others 
suffered injuries. If the explosion had occurred on an 
ordinary working day, many more people would have been 
on the site, and the number of casualties would have 
been much greater. Outside the Works injuries and damage 
were widespread but no one was killed. Fifty-three people 
were recorded as casualties by the casualty bureau, which 
was set up by the police; hundreds more suffered relatively 
minor injuries, which were not recorded. Property damage 
extended over a wide area, and a preliminary survey 
showed that 1821 houses and 167 shops and factories had 
suffered to a greater or lesser degree. (R.J. Parker, 1975 - 
the Flixborough Report, para. 1) 

The Flixborough explosion was by far the most serious 
accident which had occurred in the chemical industry in 
the United Kingdom for many years. 

The explosion was in the reactor section, Section 25A, of 
the caprolactam plant. 

Within a month of the disaster a Court of Inquiry under 
the chairmanship of Mr R.J. Parker was set up under 
Section 84 of the Factories Act 1961 to establish the causes 
and circumstances of the disaster and to point out any 
lessons which might be learned. 

The Court’s report The Flixborough Disaster, Report of the 
Court of Inquiry (R.J. Parker, 1975) (the Flixborough Report) 
is the most comprehensive inquiry conducted in the United 
Kingdom into a disaster in the chemical industry. 

The Flixborough disaster was of crucial importance in 
the development of safety and loss prevention in the United 
Kingdom. It made both the industry and the public much 
more aware of the potential hazard of large chemical plants 
and led to an intensification both of the efforts within 
industry to ensure the safety of major hazard plants and of 
the demands for public controls on such plants. 

The setting up of the Advisory Committee on Major 
Hazards (ACMH) at the end of 1974 was a direct result of the 
Flixborough disaster. 

The impact of Flixborough was reinforced by that of the 
Seveso disaster 2 years later. 

The description of the Flixborough disaster given below 
is necessarily a brief one, and is mainly based on the 
Flixborough Report and on the work of Sadee, Samuels and 
O’Brien (1976-77). Other accounts at the time include those 
of J.I. Cox (1976b) and Gugan (1976). Further critical 
accounts are described in Section A2.9. 

Selected references on Flixborough are given in 
Table A2.1. 


Table A2.1 Selected references on Flixborough 


Report of the Court of Inquiry 

R.J. Parker (1975) 

Reports presented to the Court 

Artingstall (1975); Ball (1975a);VJ. Clancey (1975a); Cottrell 
and Swann (1975a); J.I. Cox (1975b); A.G. Evans (1975); Gill 
(1975); Gugan (1975a); T.B. Jones (1975); VC. Marshall 
(1975d); F. Morton (1975); Munday (1975a); Newland (1975); 
Nypro (UK) Ltd (1975); A.F. Roberts (1975b); Sadee (1975); 
Samuels and O’Brien (1975) 


Further accounts 

Anon. (1974b); Ball and Steward (1974); T.B. Jones and 
Spracklen (1974); V.C. Marshall (1974,1976a,b, 1982 LPB 48, 
1984,1987,1994 LPB 117); Steward (1974); Tinker (1974); 
Anon. (1975d); Ball (1975b, 1976); Cottrell and Swann 
(1975b, 1976); J.I. Cox (1975a, 1976a,b); Dimeo (1975); FPA 
(1975/27); Gugan (1975b, 1976,1979); R. King (1975a-c, 
1976a,b, 1977,1990,1991); Ivinnersly (1975); Kletz (1975c,e, 
1976e, 1984e,f); McLain (1975a); Munday (1975b, 1976a,b); 
Rakestraw and Hildrew (1975); W Smith (1975); Tucker 
(1975); F. Warner (1975a,b); BRE (1976/7); HSE (1976 HSE1, 
HSE 2); O’Reilly (1976); Sadee, Samuels and O’Brien 
(1976-77); R.L. Allen (1977a, b); C.L. Bell (1977,1979); 

VJ. Clancey (1977a,c); Mecklenburg (1977a, b); H.D. Taylor 
(1977); Slater (1978a); Anon. (1979b); Harvey (1979b); 

W.G. Johnson (1980); D.J. Lewis (1980d, 1989a); D.C. Wilson 
(1980); Anon. (1981a); Offord (1983); Cullen (1984); 
Davidson (1984); Crooks (1990 LPB 96); Turney (1994 
LPB 117) 


A2.1 The Company and the Management 

A2.1.1 The company 

The Flixborough Report (paras 12-14) states 
The site was originally occupied in 1938 by a company 
called Nitrogen Fertilisers Limited, a subsidiary of 
Fisons Limited and used for the manufacture of ammo¬ 
nium sulphate. In 1964 Nypro was formed, owned jointly 
by Dutch State Mines (DSM) and Fisons Limited. It 
acquired the site from Nitrogen Fertilisers Limited. 
Between 1964 and 1967 plant was built for the production 
of caprolactam, which is a basic raw material for the 
production of Nylon 6, by a process, the first step of 
which was the production of cyclohexanone via the 
hydrogenation of phenol. The works were commissioned 
and production commenced in 1967. They were then and 
remained until the disaster the only works in the UK 
producing caprolactam. 

In 1967 Nypro was reconstituted with DSM owning 
45%, the National Coal Board 45% and Fisons Limited 
10%. Almost at once design began for additional plant to 
increase the capacity of the works from 20 000 tons of 
caprolactam per annum to 70 000 tons per annum. This 
additional plant, referred to as Phase 2, was completed at 
a cost of some £15 m. in 1972. Its distinguishing feature for 
present purposes is that in it the cyclohexanone neces¬ 
sary for the production of caprolactam was produced by 
the oxidation of cyclohexane instead of via the hydro¬ 
genation of phenol. In 1972 DSM acquired the holding of 
Fisons Limited and from then until after the disaster 
Nypro was owned as to 55% by DSM and as to the 
remaining 45% by the NCB. 

From the safety point of view, the oxidation process 
introduced new dimensions. Cyclohexane, which is in 
many of its properties comparable with petrol, had to be 
stored. More importantly, large quantities of cyclohexane 
had to be circulated through the reactors under a working 
pressure of about 8.8 kg/cm 2 and a temperature of 155°C. 
Any escape from the plant was therefore potentially 
dangerous. 

Nypro (UK) Limited was therefore a relatively small, single- 

site company operating a major hazard process. 
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A2.1.2 The management 

The management of the company is described in the 
Flixborough Report (paras 19-27). The description includes 
the following information of particular relevance to the 
caprolactam plant: 

Managing Director Mr R.E. Selman, qualified chemical 
engineer (HTS, Delft) 

General Works Manager Mr J.H. Beckers, qualified 
chemical engineer (MTS, Heerlen) 

Plant Manager Area 1 and Utilities Mr C.L. Bell, 
chartered chemical engineer 
Plant Manager Area 2 Mr PM. Cliff (to 1 May, 1974), 
chartered engineer (fuel); Mr R. Everton (from 1 May, 
1974), HND in chemistry 
Works Engineer Vacant (formerly Mr Riggall) 

Areas 1 and 2 Engineer Mr A.B. Blackman 
Services Engineer Mr B.T. Boynton, ONC in electrical 
engineering, NCB (Class 1) engineering certificate 
Safety and Training Manager Mr E. Brenner, Manager 

Area 2 covered Section 25A of the cyclohexane plant. 

The previous Works Engineer, Mr Riggall, had left and 
steps were being taken to replace him, but at the time of the 
accident there was no Works Engineer. In the absence of a 
Works Engineer a co-ordinating function was exercised by 
the Services Engineer. In addition, the engineering staff 
were told that if they had problems, they could call on the 
assistance of Mr J.F. Hughes of the NCB. 

The Flixborough Report (para. 27) states that following 
the departure of Mr Riggall ‘There was no mechanical 
engineer on site of sufficient qualification, status or 
authority to deal with complex or novel engineering prob¬ 
lems and insist on necessary measures being taken’. 

The report is critical of the fact that the Area 2 and Ser¬ 
vices Engineers had been asked to assume responsibilities 
which they should not have had to shoulder. 

A2.2 The Site and the Works 

The Flixborough works is on flat, low-lying land on the 
east bank of the River Trent some 6 miles to the south of 
the point where that river joins the Humber. The nearest 
villages are Flixborough itself and Amcotts, both of which 
are about half a mile away. The town of Scunthorpe lies at 
a distance of approximately 3 miles. 

The works is surrounded by fields and the population 
density in the neighbourhood beyond is very low. 

A site plan is shown in Figure A2.1. The diagram also 
shows the vapour cloud, as described below. An aerial view 
of the works before the explosion is given in Figure A2.2. 

Other plants on the site included an acid plant and a 
hydrogen plant. There was also a large ammonia storage 
sphere. 


A2.3 The Process and the Plant 

The cyclohexane plant, shown in Figure A2.3, consisted of 
a train of six reactors in series in which cyclohexane was 
oxidized to cyclohexanone and cyclohexanol by air injec¬ 
tion in the presence of a catalyst. The feed to the reactors 
was a mixture of fresh cyclohexane and recycled material. 
The product from the reactors still contained approxi¬ 
mately 94% of cyclohexane. The liquid reactants flowed 
from one reactor to the next by gravity. In subsequent 
stages, the reaction product was distilled to separate the 


unreacted cyclohexane, which was recycled to the reactors, 
and the cyclohexanone and cyclohexanol, which were con¬ 
verted to caprolactam. The design operating conditions in 
the reactor were a pressure of 8.8 kg/cm 2 and a temperature 
of 155°C. The reaction is exothermic. 

The heat required for initial warmup and for supple¬ 
mentation of the heat of reaction during normal operation 
was provided by a steam-heated heat exchanger on the 
reactor feed. The steam flow to the exchanger was con¬ 
trolled by an automatic control valve. There was a bypass 
around this valve, which was needed to pass the larger 
quantities of steam required during start-up. 

Removal of the heat of reaction from the reactors during 
normal operation was effected by vaporizing part of the 
cyclohexane liquid. The cyclohexane vaporized passed out 
in the off-gas from the reactors. The rest of this off-gas was 
mainly nitrogen with some unreacted oxygen. 

The off-gas passed through the feed heat exchanger 
(C2544) and then through a cooling scrubber (C2521) and 
an absorber (C2522), in which the cyclohexane was con¬ 
densed out, and thence via an automatic control valve to a 
flare stack. 

The atmosphere in the reactor was controlled using 
nitrogen from high-pressure nitrogen storage tanks. The 
nitrogen was brought into the works by tankers. 

The reactor pressure was controlled by manipulating 
the control valve on the off-gas line. Safety valves venting 
into the relief header to the flare stack were set to open at 
11 kgf/cm 2 . 

A trip system was provided which shut off air to, and 
injected nitrogen into, the reactors in the event of either 
a high oxygen content in the off-gas or a low liquid level in 
the nitrogen supply tank. This trip could be disarmed, 
however, by setting to zero the timer fixing the duration of 
the purge. 

The layout of the reactors in Section 25A is shown in 
Figure A2.4. 

A2.4 Events Prior to the Explosion 

On the evening of 27 March 1974, it was discovered that 
Reactor No. 5 was leaking cyclohexane. The reactor was 
constructed of l / 2 in- mild steel plate with y g in. stainless 
steel bonded to it on the inside. A vertical crack was found 
in the mild steel outer layer of the reactor. The leakage 
of cyclohexane from the crack indicated that the inner 
stainless steel layer was also defective. It was decided to 
shut the plant down for a full investigation. The following 
morning inspection revealed that the crack had extended 
some 6 ft. This was a serious state of affairs and a meeting 
was called to decide action. The decision was taken to 
remove Reactor No. 5 and to install a bypass assembly to 
connect Reactors No. 4 and 6 so that the plant could con¬ 
tinue in production. 

The openings to be connected on these reactors were 
28 in. diameter, with bellows on the nozzle stubs, but the 
largest pipe which was available on site and which might be 
suitable for the bypass was 20 in. diameter. The two flanges 
were at different heights so that the connection had to take 
the form of a dog-leg of three lengths of 20 in. pipe welded 
together with flanges at each end bolted to the existing 
flanges on the stub pipes on the reactors. The bypass 
assembly is shown in Figure A2.5. 

Calculations were done to check (1) that the pipe was 
large enough for the required flow and (2) that it was 




Figure A2. 1 Simplified site plan of the works of Nypro (UK) Ltd at Flixborough (Sade'e, Samuels and O’Brien, 1976- 77) (Courtesy of HM Stationery Office). 
The diagram also shows the estimated dimensions of the vapour cloud 
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Figure A2.2 Works of Nypro (UK) Ltd at Flixborough before the explosion (Nypro (UK) Ltd) 


capable of withstanding the pressure as a straight pipe. 
No calculations were made which took into account the 
forces arising from the dog-leg shape of the pipe. 

No drawing of the bypass pipe was made other than in 
chalk on the workshop floor. 

The existing stub pipes were connected to the reactors by 
bellows, as shown in Figure A2.5. No calculations were 
done to check whether the bellows would withstand the 
forces caused by the dog-leg pipe. 

The bypass assembly was supported by a scaffolding 
structure, as shown in Figure A2.5. This scaffolding was 
intended to support the pipe and to avoid straining of the 
bellows during construction of the bypass. It was not sui¬ 
table as a permanent support for the bypass assembly 
during normal operation. 

No pressure testing was carried out either on the pipe or 
on the complete assembly before it was fitted. A pressure 
test was performed on the plant, however, after installation 
of the bypass. The equipment was tested to a pressure of 
9 kgf/cm 2 , but not up to the safety valve pressure of 
11 kgj/cm . The test was pneumatic not hydraulic. 

Following these modifications the plant was started up 
again. The bypass assembly gave no trouble. There did 
appear, however, to be an unusually large usage of nitrogen 


on the plant and this was being investigated at the time of 
the accident. 

On 29 May, the bottom isolating valve on a sight glass on 
one of the vessels was found to be leaking. It was decided to 
shut the plant down to repair the leak. 

On the morning of 1 June start-up began. The precise 
sequence of events is complex and uncertain. The crucial 
feature, however, is that the reactors were subjected to a 
pressure somewhat greater than the normal operating 
pressure of 8.8 kgf/cm 2 

A sudden rise in pressure up to 8.5 kgf/cm 2 occurred 
early in the morning when the temperature in Reactor No. 1 
was still only 110°C and that in the other reactors was less, 
while later in the morning, when the temperature in the 
reactors was closer to the normal operating value, the 
pressure reached 9.1-9.2 kgf/cm 2 . 

The control of pressure in the reactors could normally be 
effected by venting the off-gas, but this procedure involved 
the loss of considerable quantities of nitrogen. Shortly after 
warmup began, it was found that there was insufficient 
nitrogen to begin oxidation and that further supplies would 
not arrive until after midnight. Under these circumstances 
the need to conserve nitrogen would tend to inhibit reduc¬ 
tion of pressure by venting. 
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Figure A2.3 Simplified flow diagram (not to scale) of the cyclohexane oxidation plant at Flixborough 
(R.J. Parker, 1975) (Courtesy of HM Stationery Office) 


A2.5 The Explosion 1 

During the late afternoon an event occurred which resulted 
in the escape of a large quantity of cyclohexane. As already 
explained, this event was the rupture of the 20 in. bypass 
system, without or with contribution from fire on a nearby 
8 in. pipe. The cyclohexane formed a vapour cloud and the 
flammable mixture found a source of ignition. 


At about 4.53 p.m. there was a massive vapour cloud 
explosion. 

The explosion caused extensive damage and started 
numerous fires. Aerial views of the plant after the explo¬ 
sion are shown in Figures A2.6 and A2.7. 

Reactors No. 4 and 6 and the debris of the bypass 
assembly are shown in Figure A2.8. The blast and the 
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Figure A2.4 Simplified plan and elevation of part of Section 25A of the cyclohexane oxidation plant at Flixborough 
(R.J. Parker, 1975) (Courtesy of HM Stationery Office) 


fires destroyed not only the cyclohexane plant but 
several other plants also. Many of the fires were in the 
tank farm. 

The blast of the explosion shattered the windows of the 
control room and caused the control room roof to collapse. 
Of the 28 people who died in the explosion, 18 were in the 
control room. Some of the bodies had suffered severe inju¬ 
ries from flying glass. Others were crushed by the roof. No 
one escaped from the control room. 

The main office block was also demolished by the blast of 
the explosion. Since the accident occurred on a Saturday 
afternoon, the offices were not occupied. If they had been, 
the death toll would have been much higher. 

The locations of the control room and main office block 
are shown in Figures A2.1 and A2.2 and the states of these 
buildings after the explosion in Figures A2.6 and A2.7. 

The fires on the site burned for many days. Even after 
10 days the fires were hindering rescue work on the site. The 
large ammonia sphere was lifted up a few inches. It leaked 
slightly at a flange, but the leak was not serious. 

A2.6 The Investigation 

An immediate investigation of the disaster was made by 
the Factory Inspectorate, which issued an interim report. 
On its appointment, the Court of Inquiry took control of the 


main investigations. The work of recovering, identifying 
and examining wreckage and of conducting relevant 
tests, was undertaken by the Safety in Mines Research 
Establishment (SMRE). The Court appointed the consult¬ 
ing engineers Cremer and Warner as its technical advisers. 
Other government bodies, consultants and universities 
were involved in the numerous studies undertaken. 

Some of the possible causes of failure of the bypass 
assembly were outlined early in the inquiry by the DSM 
counsel. They included (1) failure of the 20 in. pipe due to 
a small pressure rise; (2) prior failure of the 8 in. pipe; 

(3) prior failure of some other part of the system and 

(4) an explosion in the air-line to the reactors. He suggested 
several possible causes for a pressure rise in the 20 in. 
pipe: (1) entry of high-pressure nitrogen into the system 
due to instrument malfunction; (2) entry of water into 
the system; (3) temperature rise in the system due to 
excessive heating by steam in reboiler of C2544; (4) leakage 
of steam from a tube in C2544; (5) explosion of peroxides 
formed in the process and (6) explosion due to air in 
the system. 

The inquiry established (Flixborough Report , para. 6) 
that the cause of the disaster was ‘The ignition and rapid 
acceleration of deflagration, possibly to the point of deto¬ 
nation, of a massive vapour cloud formed by the escape of 
cyclohexane under a pressure of at least 8.8 kg/cnr and 
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Figure A2.5 Arrangement of the 20 in bypass pipe and scaffolding at Flixborough (RJ. Parker, 1975) 
(Courtesy of HM Stationery Office) 


a temperature of 155°C and that the escape was from 
Section 25A of the cyclohexane plant’. 

There was no dispute that the main part of the cyclo¬ 
hexane came from the 20 in. bypass assembly, but there 
was come uncertainly whether the mechanical failure of 
the assembly was the primary failure or whether it was a 
secondary failure caused by another event elsewhere. 
Three hypotheses were advanced: (1) the 20 in. pipe 
hypothesis, (2) the 8 in. pipe hypothesis and (3) the super¬ 
heated water hypothesis. 

A large proportion of the report is concerned with a dis¬ 
cussion of the first and second hypotheses, but the Court 
decided emphatically in favour of the first. 

The 20 in. pipe hypothesis is that the 20 in. bypass pipe 
ruptured in one stage as a result of the internal pressure 
and temperature conditions which probably occurred in the 
final shift. 

The site investigation revealed that the 20 in. pipe had 
yielded at the lower mitre, or ‘jack-knifed’, and that the 
bellows had undergone gross permanent deformation, or 
‘squirm’. 

The arrangement of the pipe was such as to subject the 
bellows to shear forces due to the internal pressure in the 


pipe as shown in Figure A2.9. The two thrusts PA are 
parallel and separated by a distance 2e and thus give a 
turning moment 2 PAe which is balanced by shear forces 
F=PAE/L. The shear forces give rise to bending moments 
and the maximum bending moment is at the mitre joints 
and is PAEl/L. This system of forces can lead to failure in 
two ways. The shear force may cause squirm of the bellows. 
The bending moments may cause failure of the pipe by 
buckling one of the mitres. As already mentioned, these 
effects had been neglected in the calculations done on the 
bypass assembly. 

These mechanisms were studied in comprehensive, full- 
scale investigations by SMRE, by Nottingham University 
and the Mining Research and Development Establishment, 
Bretby. The results of the tests are complex, but, in brief, 
they showed that squirm of the bellows could occur at 
pressures at or near the operating pressure. They did not 
show jackknifing and rupture following squirm. A 
mechanism for the latter was given by Newland (1975), who 
developed a theory based on the energies involved, which 
showed that at pressures above normal operating pressures 
but below the safety valve pressure there could occur 
squirm of both the bellows, followed by jackknifing of the 
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Figure A2.6 Works of Nypro (UK) Ltd at Flixborough after the explosion -1 (R.J. Parker, 1975) (Courtesy 
of HM Stationery Office) 


pipe, resulting in complete rupture. The pressures for 
jackknifing and rupture to be a consequence of squirming 
were estimated to be as follows: 


Low 

Probability 

High 

(kgf/cm 2 ) 

50% (kg f /cm 2 ) 

(kg f /cm 2 ) 

150°C 9.3 

9.9 

10.6 

160°C 9.1 

9.7 

10.4 


Other mechanisms of squirm alone and jackknifing alone 
were investigated, but appeared less probable. 

The Court concluded that the rupture of the 20 in. pipe 
assembly was a probability, albeit a low one, under the 
pressure and temperature conditions which occurred in the 
last shift. 

The 8 in. pipe hypothesis is somewhat more complex. 
The 8 in. pipe ran between separators S 2538 and S 2539. 
The location and details of the pipe are shown in 
Figures A2.4 and A2.10, respectively. There was a block 
valve, a non-return valve and a lagging box on the pipe. The 
pipe was made of stainless steel. 

Essentially the hypothesis was that a directed flame had 
occurred from the lagging box and had caused rupture 
of the pipe from which cyclohexane then escaped to form 
a vapour cloud. This hypothesis was advanced by Cox 
and Gugan. 


The hypothesis had its origin in eyewitness accounts of 
the events immediately prior to the explosion and in the 
condition of the equipment found in the site investigation. 
The latter revealed that there was a 50 in. split on the elbow 
of the 8 in. pipe and subsequent studies showed that the 
crack was caused by creep cavitation. The 50 in. split also 
exhibited a petal crack which was due to zinc embrittlement 
and a separate 3 in. crack due to the same cause was found 
on the straight vertical section of the pipe. In addition, two 
loose bolts were found on the non-return valve. There was 
some doubt as to whether these had been loose before the 
explosion, but the Court concluded that this was probably 
the case. 

The 8 in. pipe hypothesis may be summarized as follows. 
There were two loose bolts on the non-return valve. Then 
either there was a slow leakage of material over an exten¬ 
ded period and a lagging fire which caused further expan¬ 
sion of the bolts and growth of the leak, or there was a 
sudden gasket burst and ignition of the leak by static elec¬ 
tricity. In either case there was a directed flame from the 
lagging box. A sprinkler sensor head near the non-return 
valve failed to detect the fire. The flame burned off the 
lagging on the pipe elbow and caused a vapour blanket in 
the pipe and a vapour lock at the intrados so that the pipe 
overheated. The pipe suffered creep cavitation at the intra¬ 
dos and the 50 in. rupture occurred. Zinc from galvanized 
wire dripped onto the pipe and caused zinc embrittlement, 
but this was not responsible for the main failure. The 
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Figure A2.7 Works of Nypro (UK) Ltd at Flixborough after the explosion-2 (R.J. Parker, 1975) (Courtesy of HM 
Stationery Office) 


cyclohexane issued from the 50 in. crack and put out the 
flame. A fire then occurred in the region of the fin fan 
coolers which melted the zinc on the finned tubes and 
raised them to a temperature at which zinc embrittlement 
occurs. There followed an explosion in the region of one of 
the fan motors which caused the 20 in. bypass to jackknife 
and rupture. 

The foregoing account is a necessarily highly simplified 
summary of a very complex argument. The Court’s report 
gives a detailed account of this hypothesis but rejects it. It 
draws an analogy between the sequence of events required 
by the hypothesis with the balancing of billiard balls one 
on top of another and states ‘This balancing of ten balls is 
analogous to what is postulated for the 8-inch pipe 
hypothesis’. 

The third hypothesis is that the failure of the 20 in. 
bypass assembly was due to sudden evolution of vapour 
from a layer of superheated water at the bottom of Reactor 
No. 4. The water might have been present in the reactor 
initially or might have come from a leak in the steam-heated 
heat exchanger on the feed. Such a water layer was able to 
build up in the vessel more easily because the reactor agi¬ 
tator was not in use. This theory, advanced by R. King, was 
mentioned, but did not figure prominently at the inquiry. It 
has been described in a number of articles by King 
(1975a-c, 1976a, b, 1977). 


A2.7 The Explosion 2 

Another aspect of the Flixborough investigation is the 
studies conducted on the explosion itself. Accounts of the 
explosion have been given in the Flixborough Report, by 
Gugan (1976) and by Sadee, Samuels and O’Brien (1976—77). 

According to Sadee, Samuels and O’Brien the quantity of 
cyclohexane available in the five reactors and one after¬ 
reactor was 120 te. The normal operating pressure and 
temperature were 8.8kg f /cm 2 and 155°C, respectively. 
After the explosion it was found that the vessels still con¬ 
tained 80 te, so that the maximum quantity involved in the 
explosion was 40 te. These authors estimate that about 30 te 
escaped before the explosion and they take this quantity as 
the basis of their calculations. 

The flow from each of the two pipe stubs, which were 
opposite each other, but at slightly different heights, would 
form a turbulent momentum jet with the two opposing jets 
impinging on each other, thus giving very effective mixing. 

It is estimated by Sadee, Samuels and O’Brien that 50 %, 
or 15 te, of the cyclohexane would flash off as vapour and 
that the other 50% would form a mist. Whether or not the 
mist would then evaporate depends on the amount of air 
entrained by the jet. The authors state that evaporation is 
possible provided that the concentration of cyclohexane 
does not exceed 10%. 
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Figure A2.8 Reactors No. 4 and 6 and the bypass assembly at Flixborough after the explosion 
(R.J. Parker, 1975) (Courtesy of HM Stationery Office) 


Sadee, Samuels and O’Brien have calculated the dimen¬ 
sions of a stationary, free jet of cyclohexane at 1 MPa and 
150°C emitted from a 700 mm diameter opening and form¬ 
ing a cloud containing equal masses of vapour and liquid in 
air. This jet is shown in Figure A2.ll. The jet is 215 m long 
and has a maximum diameter of 25 m.The jet volume with a 
concentration exceeding the low flammability limit (1.2 %) 
is 64,400 m 3 and that with a concentration within the flamm¬ 
able range (1.2-8%) is practically the same. The average 
concentration in the flammable part of the jet is 1.85%, 
which is close to the stoichiometric proportion. The quan¬ 
tity of cyclohexane within the flammable part of the jet is 
4 te. If two such jets are assumed, the quantity is 8 te. 

The jets actually formed were not free jets, but were 
affected by the ground and the reactors. Taking these 
factors into account, the authors estimate the quantity of 
cyclohexane within the flammable part of the two jets 
as 22.4 te. 

Sadee, Samuels and O’Brien present calculations on the 
assumption that the quantity of cyclohexane involved in 
the explosion was 30 te.This amount of cyclohexane mixed 
with air to yield a flammable concentration of 2% gives a 
cloud volume of 400,000 m 3 . 


The precise shape of the cloud is uncertain, as is the 
source of ignition. From the carbon deposition and explo¬ 
sion damage the estimate of the cloud ground zero and 
shape is that shown in Figure A2.1. The source of ignition 
may have been the hydrogen plant. An alternative estimate 
of the cloud shape has been given by J.I. Cox (1976b). 

Various estimates have been made of the time which 
elapsed between the times of rupture and of the explosion, 
mostly ranging between 30 and 90 s. An estimate of 45 s 
has been widely quoted. 

There is evidence from carbon deposition and from eye¬ 
witness accounts that there was a flash fire as well as an 
explosion in the vapour cloud. 

From eyewitness accounts it appears that there may have 
been a short period during which the cloud had found a 
source of ignition and combustion was occurring at the 
edge of the cloud, but the cloud was expanding faster than 
the flame speed. Assuming a constant flow of vapour into 
the cloud, the velocity of outward expansion would fall 
as the cloud diameter increased and a point would be 
reached at which the velocity would fall below the flame 
speed. The flame would then travel rapidly towards the 
centre of the cloud. 
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Figure A2.9 Sketch of pipe and bellows assembly at Flixborough showing shear forces on bellows and bending 
moments in pipe (due to internal pressure only) (R.J. Parker, 1975) (Courtesy of HM Stationery Office) 


One effect of such a flash fire would be to cause a sudden 
and lethal depletion of the oxygen concentration. 

There was evidence of two explosive events. An iono¬ 
sphere recorder trace obtained at Leicester University 
(T.B. Jones and Spracklen, 1974; T.B. Jones, 1975) showed 
two disturbances, a smaller precursor followed by the main 
event. The time interval between them was some 45 s. 

Estimates of the energy of explosion were made in sev¬ 
eral ways, including estimation from ionospheric readings 
(T.B. Jones, 1975), from the barograph of a glider in the 
vicinity (Gugan, 1975a) and from a blast damage survey 
(A.F. Roberts, 1975; Samuels and O’Brien, 1975). 

The most detailed estimates of explosion energy are 
those derived from the blast damage survey. The results of 
this survey have been discussed by Gugan (1976), Munday 
(1975b) and Sadee, Samuels and O’Brien (1976-77). The 
latter gave a detailed listing and photographs of structural 
damage. 

The blast damage effects caused by the explosion have 
been assessed by Sadee, Samuels and O’Brien and are 
shown in Figure A2.12, in which the individual data bars 
give the ranges of peak overpressure determined from 
structural damage vs distance from the assumed epicentre 
of the explosion. 

The estimates of the energy of the explosion made by 
different workers depend on the explosion model used. 

Most estimates are based on the simplest model, in which 
the only parameter is the mass of TNT. These estimates are 
generally in the range 15-45 te of TNT. 


An alternative two-parameter model describes the 
explosion in terms both of the mass of TNT and the height 
of the explosion. Using this model, Sadee, Samuels and 
O’Brien estimate that the explosion was equivalent to 16 ± 2 te 
of TNT at a height of 45 ± 24 m above ground. 16 te of TNT 
have a calorific equivalent of about 1.6 te of cyclohexane; 
the calorific value of TNT is 1600 kcal/kg and that of 
cyclohexane is 11,127 kcal/kg. 

The curve given by Sadee, Samuels and O’Brien in 
Figure A2.12 is based on this two-parameter TNT model. 

If the cloud contained 30 te of cyclohexane and gave an 
explosion equivalent to the combustion of about 1.6 te, the 
explosion efficiency was about 5 %. This efficiency is based 
on the total quantity of cyclohexane in the cloud. 

The maximum overpressure at the centre of the cloud is 
uncertain. The maximum overpressure obtained from the 
structural damage, as described by Sadee, Samuels and 
O’Brien, was 0.7 bar. These authors state, however, that the 
theoretical curve in Figure A2.12 indicates an overpressure 
of 1 bar at the cloud boundary. 

Some estimates of the pressure developed within the 
cloud are considerably higher. These estimates are typi¬ 
cally based on calculation of the forces required to give 
damage effects such as the bending of steel lamp posts or 
crushing of steel vessels. Thus, for example, VJ. Clancey 
(1977a) states that where local effects occurred as a result of 
features such as confinement, pressures of up to perhaps 
5-7 bar have been estimated. The pressures calculated in 
this way would normally be reflected pressures. 
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Figure A2.10 Elevation view of 8 in. line at Flixborough, showing typical lagging box around valve (R.J. Parker, 
1975) (Courtesy of HM Stationery Office) 


A2.8 Some Lessons of Flixborough 

There are numerous lessons to be learned from the 
Flixborough disaster. A list of some of these is given in 
Table A2.2. Many of these lessons were highlighted in the 
Court’s report. 

The lessons include both public controls on major hazard 
installations and the management of such installations by 
industry. In the latter area there are lessons on both man¬ 
agement systems and technological matters and on both 
design and operational aspects. 

The fact that alternative hypotheses were advanced 
concerning the cause of the explosion does not detract from 
these lessons, but rather means that a greater number of 
lessons can be drawn. 

Some of these lessons are now considered. 

Public controls on major hazard installations 
The effect of the Flixborough disaster was to raise the 
general level of awareness of the hazard from chemical 
plants and to make the existing arrangements for the 
control of major hazard installations appear inadequate. 


The government therefore set up the ACMH to advise on 
means of control for such installations. The committee 
issued three reports (Harvey, 1976,1979b, 1984). Its recom¬ 
mendations are described in Chapter 4. 

This work was a major input to the development of the 
EC Major Accident Hazards Directive, which was imple¬ 
mented in the United Kingdom as the CIMAH Regulations 
1984. These require the operator of a major hazard instal¬ 
lation to produce a safety case. 

Major hazard installations receive a greater degree of 
supervision by the local Factory Inspectorate. The CIMAH 
safety case plays an important part in this. 


Siting of major hazard installations 
As the Flixborough Report (para. 11) points out, the casual¬ 
ties from the explosion might have been much greater if the 
site had not been in open country. 

The siting of major hazard installations is a matter of 
utmost importance. On the one hand distance is the only 
sure guarantee of safety, but on the other provision of 
increased spacing may be very wasteful of land. 
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Figure A2.11 Dimensions of and concentration 
distribution in a stationary, free jet of cyclohexane in air 
from an opening 700 mm diameter (Sade'e, Samuels and 
O’Brien, 1976- 77) (Courtesy of HM Stationery Office) 


The question of the siting of major hazard, installations, 
or more generally land use planning in relation to such 
installations, became a principal concern of the ACMH, and 
is treated in its three reports. Controls on major hazards 
through land use planning are discussed in Chapter 4 and 
Appendix 25. Siting is also considered in Chapter 10. 

Licensing of storage of hazardous materials 
The Flixborough Report (para. 194) states 
As at 1st June 1974 Nypro were storing on site 330,000 
gallons of cyclohexane, 66,000 gallons of naphtha, 
11,000 gallons of toluene, 26,400 gallons of benzene and 
450,000 gallons of gasoline. The storage of these poten¬ 
tially dangerous substances is nominally controlled by 
the local authority issuing licences under the Petroleum 
(Consolidation) Act 1928. In fact the only licences that 
had been issued related to 7000 gallons of naphtha and for 
a total of 1500 gallons of gasoline. The unlicensed storage 
of large quantities of fluids had no effect upon this 
disaster but it is clearly useless to have a licensing system 
which is so ineffective that it can lead to such results. 
The situation at Flixborough revealed the need for better 
methods of notification of major hazard installations to the 
local planning authorities and for greater guidance to these 
authorities by the HSE. 

The notification of major hazard installations is a 
requirement of the NIHHS Regulations 1982 and of the 


CIMAH Regulations 1984. These notification requirements 
and the advice now given by the HSE to local planning 
authorities are discussed in Chapter 4. 

Regulations for pressure vessels and systems 

The escape of cyclohexane at Flixborough was caused by a 

failure of the integrity of a pressure system. 

Current legislation on pressure systems in the United 
Kingdom consisted of regulations for steam boilers and 
receivers and air receivers. It failed to cover the Flixborough 
situation in two crucial respects. It applied only to steam 
and air and not to hazardous materials such as cyclo¬ 
hexane. And it dealt only with pressure vessels and not 
with pressure systems. This latter point is relevant, 
because at Flixborough the failure occurred in a pipe not a 
vessel. 

The Flixborough Report (para. 209) recommends that 
existing regulations relating to the modification of steam 
boilers should be extended to apply to pressure systems 
containing hazardous materials. 

Following Flixborough the HSE set about developing 
comprehensive regulations for pressure systems, which 
finally emerged as the Pressure Systems Regulations 1989. 
These regulations are described in Chapters 3 and 12. 

The management system for major hazard installations 
The Flixborough Report (paras 207, 209, 210) places much 
emphasis on deficiencies in the management system at the 
Nypro Works. 

The works did not have a sufficient complement of qua¬ 
lified and experienced people. Consequently, management 
was not able to observe the requirement that persons given 
responsibilities should be competent to carry them out. In 
particular, there was no works engineer in post and no 
adequately qualified mechanical engineer on site. 

Moreover, individuals tended to be overworked and thus 
more liable to error. 

The management system, however, is more than the 
individuals. It includes the whole structure which supports 
them. Thus the system should provide, for example, for the 
coverage of absence due to resignation, illness and so on. 

The use of a comprehensive set of procedures is another 
important aspect of the management system. A crucial 
procedure which was deficient at Flixborough was that for 
the control of plant modifications. 

The role of the safety officer at Flixborough was not well 
defined. 

The importance for major hazard installations of the 
management and the management system was the single 
most prominent theme in the work of the ACMH. Emp¬ 
hasis by the HSE on management aspects has steadily 
grown. The Cutten Report on the Piper Alpha disaster 
recommended that offshore the safety case should cover 
the safety management system and this is implemented in 
the offshore regulations. This aspect is discussed in 
Chapters 4 and 6. 

Relative priority of safety and production 
The Flixborough Report (paras 57, 206) drew attention to 
the conflict of priorities between safety and production. 
It states 

We entirely absolve all persons from any suggestion that 

their desire to resume production caused them knowingly 

to embark on a hazardous course in disregard of the 
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Figure A2.12 Peak overpressure vs distance at Flixborough estimated from blast damage (Sade'e, 
Samuels and O’Brien, 1976- 77) (Courtesy of HM Stationery Office) 


safety of those operating the Works. We have no doubt, 
however, that it was this desire which led them to overlook 
the fact that it was potentially hazardous to resume pro¬ 
duction without examining the remaining reactors and 
ascertaining the cause of the failure of the fifth reactor. 
We have equally no doubt that the failure to appreciate 
that the connection of Reactor No. 4 to Reactor No. 6 
involved engineering problems was largely due to the 
same desire. 


Use of standards and codes of practice 
As the Flixborough Report (paras 61-73) describes, the 
20 in. bypass assembly was not constructed and installed 
in accordance with the relevant standards and codes of 
practice. 


The principal standard relevant to the modification 
was BS 3351: 1971. The report quotes extracts from this 
standard: 

4.6.2. For axial bellows, the piping shall be guided to 
maintain axiality of the bellows and anchored at adjacent 
changes in direction to prevent the bellows being sub¬ 
jected to axial load due to fluid pressure. 5.4.2.I... .When 
expansion joints are used, the advice of the manufacturer 
should be sought with regard to the guiding, anchoring 
and support of the adjacent pipework. 

The bellows manufacturer, which was Teddington Bellows 
Ltd, produced a Designers Guide which made it clear that 
two bellows should not be used out of line in the same pipe 
without adequate support for the pipe. 
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Table A2.2 Some lessons of Flixborough 


Public control of major hazard installations 
Siting of major hazard installations 
Licensing of storage of hazardous materials 
Regulations for pressure vessels and systems 
The management system for major hazard installations 
The structure 
The people 

The systems and procedures 
The safety officer 

Relative priority of safety and production 
Use of standards and codes of practice 
Limitation of inventory in the plant 
Engineering of plants for high reliability 
Dependability of utilities 
Limitation of exposure of personnel 
Design and location of control rooms and other buildings 
Control and instrumentation of plant 
Decision-making under operational stress 
Restart of plant after discovery of a defect 
Control of plant and process modifications 
Security of and control of access to plant 
Planning for emergencies 
The metallurgical phenomena 
Nitrate stress corrosion cracking 
Creep cavitation of stainless steel 
Zinc embrittlement of stainless steel 
Use of clad mild steel 
Unconfined vapour cloud explosions 
Investigation of disasters and feedback of information on 
technical incidents 


The use of standards and codes of practice is described 
in Chapters 3,6 and 12. 

Limitation of inventory in the plant 
The Flixborough Report (para. 14) makes it clear that the 
large inventory of flammable material in the plant con¬ 
tributed to the scale of the disaster. 

The Second Report of the ACMH proposes that limitation 
of inventory should be taken as a specific design objective 
in major hazard installations. 

The limitation of inventory is a particular aspect of the 
more general principle of inherently safer design, which is 
now widely recognized. This is discussed in Chapter 11. 

Engineering of plants for high reliability 
The explosion at Flixborough occurred during a plant 
start-up. The Flixborough Report (para. 206) suggests that 
special attention should be given to factors which necessi¬ 
tate the shut-down of chemical plant so as to minimize the 
number of shut-down/start-up sequences and to reduce the 
frequency of critical management decisions. 

The reliability of plant is considered in Chapters 7 and 12. 

Dependability of utilities 

The high-pressure nitrogen required for the blanketing of 
the reactors at Flixborough was brought into the works 
by tankers. There was insufficient nitrogen available 
during the start-up when the explosion occurred. The 
Flixborough Report (para. 211) emphasizes the importance 


of assuring dependable supplies of nitrogen where these 
are necessary for safety. 

The dependability of utilities is discussed in Chapter 11. 


Limitation of exposure of personnel 
The Flixborough Report (para. 1) states that the number of 
casualties would have been much greater if the explosion 
had occurred on a weekday instead of on a Saturday. 

The First Report of the ACMH (para. 68) suggests that 
limitation of exposure of personnel be made a specific 
design objective. 

Aspects of limitation of exposure are controls on access 
to hazardous areas and design and location of buildings in 

The limitation of exposure of personnel is described in 
Chapters 10 and 20. 


Design and location of control rooms and other buildings 
Of the 28 deaths at Flixborough 18 occurred in the control 
room. The Flixborough Report (para. 218) refers to various 
suggestions made to the inquiry concerning the siting of 
control rooms, laboratories, offices, etc., and the construc¬ 
tion of control rooms on blockhouse principles. 

The construction of buildings for chemical plant is con¬ 
sidered in the First Report of the ACMH (para. 69). 

The design and location of control rooms and other 
buildings is discussed in Chapters 10 and 20. 


Control and instrumentation of plant 
The control and instrumentation system was not a promi¬ 
nent feature in the Flixborough inquiry. The Flixborough 
Report (para. 204) considered that the controls in the con¬ 
trol room followed normal practice. But it also states 
‘Nevertheless we conclude from the evidence that greater 
attention to the ergonomics of plant design could provide 
rewarding results’. 

Control system design and human factors in process 
control are described in Chapters 13 and 14. 


Decision making under operational stress 
The Flixborough Report (para. 205) draws attention to the 
problem of decision making under operational stress and 
emphasizes the desirability of reducing the number of cri¬ 
tical management decisions which have to be made under 
these conditions. 

Such critical decisions are not necessarily confined to 
management, however. Process operators may also be req¬ 
uired to take important decisions in emergency conditions. 

The process operator in emergency situations is dis¬ 
cussed in Chapter 14. 


Restart of plant after discovery of a defect 
Following the discovery of the serious defect in Reactor No. 5 
at Flixborough, the reactor was removed, a bypass assembly 
was installed and the plant was started up again. The Flix¬ 
borough Report (para. 57) is critical of the fact that the 
remaining reactors were not examined and the cause of the 
failure in the fifth reactor was not ascertained before plant 
start-up. 

The procedures for restart of the plant after discovery of 
a defect are discussed in Chapter 20. 
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Control of plant and process modifications 
The Flixborough Report (para. 209) states 
The disaster was caused by the introduction into a well 
designed and constructed plant of a modification which 
destroyed its integrity. The immediate lesson to be 
learned is that measures must be taken to ensure that the 
technical integrity of plant is not violated. 

As it happens, there was also a process modification at 
Flixborough, although this is not emphasized in the report. 
The agitator in Reactor No. 4 was not in use at the time of 
the disaster. The absence of agitation in the reactor could 
have allowed a water layer to accumulate more easily in the 
bottom of the vessel. The sudden evolution of vapour from 
superheated water was advanced by King as a possible 
cause of the rupture of the bypass pipe assembly. 

The control of plant and process modifications is dis¬ 
cussed in Chapters 6 and 21. 

Security of and control of access to plant 
The Flixborough Report (para. 194) draws attention to the 
fact that there were two unguarded gates through which 
it was possible for anyone at any time to gain access, 
although this fact did not contribute to the disaster. The 
security of plants is considered in Chapter 20. 

Planning for emergencies 

The Flixborough Report (para. 222) calls for a disaster plan 
for major hazard installations. Emergency planning is 
described in Chapter 24. 

The metallurgical phenomena 

The Flixborough disaster drew attention to several impor¬ 
tant metallurgical phenomena. Thus the Flixborough 
Report describes the nitrate stress corrosion cracking of 
mild steel (paras 53, 212); the creep cavitation of stainless 
steel (para. 214); the zinc embrittlement of stainless steel 
(para. 213); and the use of clad mild steel vessels (para. 224). 

The HSE subsequently issued Technical Data Notes (1976 
TON 53/1, 53/2; 1977 TON 53/3) on the first three of these 
problems. 

It was apparent from the discussion in the engineering 
profession following publication of the report that although 
metallurgical specialists were aware of failure due to zinc 
embrittlement, the phenomenon was not well known 
among engineers generally. 

The metallurgical features of pressure systems are dis¬ 
cussed in Chapter 12. 

Vapour cloud explosions 

The explosion at Flixborough was a large vapour cloud exp¬ 
losion. Although such explosions had become more common 
in the preceding years, none compared with Flixborough in 
scale and impact. The Flixborough Report (para. 215) draws 
attention to the marked lack of information on the conditions 
under which a vapour cloud can give an explosion. 

Since Flixborough, a large amount of work has been 
done on vapour cloud explosions. An account is given in 
Chapter 17. 

Investigation of disasters and feedback of information 
on technical incidents 

The Flixborough disaster was investigated by a Court 
of Inquiry. There was some feeling in the engineering pro¬ 
fession that a legal inquiry of this kind is not a satisfactory 


means of establishing the facts concerning technical inci¬ 
dents. This aspect is considered in the following section. 

The Flixborough Report (para. 216) states thatthe inquiry 
would have been greatly assisted if the essential instru¬ 
ment records in the control room had not been destroyed in 
the explosion and recommends that consideration be given 
to systems for recording and preserving vital plant infor¬ 
mation such as the ‘black box’ recorder used in aircraft. 

The investigation of disasters and the feedback of 
information from technical incidents is considered in 
Chapter 27. 

The points just outlined by no means exhaust the lessons 
to be learned from the Flixborough disaster. In parti¬ 
cular, there are many instructive aspects of the 8 in. pipe 
hypothesis relating to such features as lagging fires, 
directed flames and sprinkler sensor performance. 

A2.9 Critiques 

The Flixborough inquiry has been the subject of a number 
of critiques which have centred mainly on (1) the form of the 
inquiry; (2) the examination of the hypotheses; (3) the 
design of the plant (4) the management of the plant and 
(5) technical issues. These include those of R.L. Allen 
(1977b), Mecklenburgh (1977a), D.J. Lewis (1989a), R. King 
(1990) and I. Thomas and Gugan (1993), and the mainly 
technical discussions of Gugan (1979) and V.C. Marshall 
(1987). 

King gives a detailed description of the plant and it 
operation and diagrams showing the original plant and the 
modified plant. 

Mecklenburgh, King and Thomas and Gugan argue that 
the legal format is not conducive to elucidating the facts 
about technical issues. The question is discussed in detail 
in Chapter 27. 

With regard to the examination of hypotheses, Thomas 
and Gugan argue that the possible role of explosive reac¬ 
tions, described by Alexander (1990b,c), was insufficiently 
explored. With regard to the 8 in. pipe hypothesis, while 
accepting that the inquiry devoted considerable effort to 
exploring it, they are critical of the arguments used in dis¬ 
missing it. 

Thomas and Gugan rehearse various aspects of the 
20 in. and 8 in. pipe hypotheses. Aspects of the 8 in. pipe 
hypothesis are also discussed by Marshall. 

King gives an account of his own hypothesis that there 
was a pressure rise in Reactor No. 4 due to the evolution of 
water vapour from water present in that reactor. He also 
gives the background to the removal of the agitator from 
Reactor No. 4. 

King is critical of the conclusion that the crack in Reactor 
No. 5 was due to nitrates in the cooling water, the finding of 
a DSM report. He quotes an HSE source to the effect that 
the reactor vessel drawing specified a maximum thrust on 
the 28 in. stubs of 9 te, whereas at normal operating condi¬ 
tions the thrust was 38 te. He suggests that the nitrates 
found were from cooling water sprayed on the already- 
formed crack. 

The design of the plant is also criticized by Marshall, 
who argues that it would have been better to use not gravity 
flow involving the 28 in. pipe connections but pumped 
flow which would have allowed the use of much smaller 
diameter pipes. 

With regard to the operation of the plant, King is critical 
of the decision to remove the agitator from Reactor No. 4, 
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which, among other things, increased the hazard from 
water accumulation in the vessel. 

Thomas and Gugan point to the facts that the plant was 
shut-down to deal with leaks and was then restarted 
because ‘the leaks had cured themselves’ that the oxygen 
trip was disarmed; the production was continued even 
though there was a shortage of nitrogen; and that the plant 
was started up again after the failure of Reactor No. 5 
without inspection of the other reactors. 

One technical issue discussed by King is the thrust 
exerted by unrestrained bellows on the systems to which 
they are connected, which tends to be underestimated. 

Lewis gives some alternative estimates of the size of the 
release. He states that the inventory of the cyclohexane 
oxidation unit exceeded 120 te. Re-examination of the 
reactor section at a pressure of 8.6 bar shows that it had an 
inventory of 230 te with another 150 te in the attached dis¬ 
tillation section at 14.7 bar. 

He also discusses the problem of determining the effi¬ 
ciency of the explosion compared withTNT. Estimates were 
made from long-range effects and from medium range 
damage surveys, and both point to a TNT equivalent of 


15—20 te. There were major difficulties, however, in fitting 
TNT curves to the damage observed. 

The TNT efficiency is difficult to assess, depending as it 
does on the estimate of the mass within the flammable 
region and on the blast curves used. 

Gugan gives a detailed discussion of certain particular 
damage effects. They include crushing of a vessel, from 
which he estimates an overpressure of 0.76 MPa (110 psi); 
damage to drain covers, for which his overpressure esti¬ 
mate is 1 MPa; and bending of a reactor agitator shaft and 
deformation of lamp standards. He suggests that in general 
the analysis of the damage relied too much on the effects of 
overpressure to the neglect of the influence of impulse and 
dynamic pressure. 

Marshall regards the vapour cloud explosion at 
Flixborough as of particular interest in that it is the best 
documented and most studied case, and is thus an exem¬ 
plar. He gives a detailed analysis of the estimates of over¬ 
pressure made from the damage effects, treating separately 
those in the near and far fields. The results show wide 
scatter, and he concludes that it is peculiarly difficult to est¬ 
imate the energy release of such an explosion from damage. 
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At 12.37 on Saturday 9 July 1976, a bursting disc ruptured 
on a chemical reactor at the works of the Icmesa Chemical 
Company at Meda near Seveso, a town of about 17,000 
inhabitants some 15 miles from Milan. A white cloud drifted 
from the works and material from it settled out down¬ 
wind. Among the substances deposited was a very small 
amount of TCDD, one of the most toxic chemicals known. 
There followed a period of great confusion due to lack of 
communication between the company and the authorities 
and the latter’s inexperience in dealing with this kind of 
situation. Over the next few days in the contaminated area 
animals died and people fell ill. A partial and belated evacu¬ 
ation was carried out. In the immediate aftermath there 
were no deaths directly attributable toTCDD, but a number 
of pregnant women who had been exposed had abortions. 

A Parliamentary Commission of Inquiry, drawn equally 
from the Chamber of Deputies and the Senate and chaired 
by Deputy B. Orsini, was set up. The Commission’s report 
(the Seveso Report) (Orsini, 1977, 1980) is a far-ranging 
inquiry not only into the disaster but also into controls over 
the chemical industry in Italy. 

The impact of the Seveso disaster in Continental Europe 
has in some ways exceeded that of Flixborough and has led 
to much greater awareness of process industry hazards 
on the part of the public and demands for more effective 
controls. 

The EC Directive on Major Accident Hazards of 1982 
was a direct result of the Seveso disaster, and indeed 
this Directive was initially often referred to as the ‘Seveso 
Directive’. 

In addition to the Seveso Report, there are other accounts 
of the Seveso disaster and of TCDD in The Superpoison by 
Margerison, Wallace and Hallenstein (1980) and The Chemi¬ 
cal Scythe by A. Hay (1982) and by A. Hay (1976, 1979, 
1981), Bolton (1978),V.C. Marshall (1980),Theofanous (1981, 
1983), Rice (1982), Sambeth (1983) and W.B. Howard (1985). 

Selected references on Seveso are given in Table A3.1. 

A3.1 The Company and the Management 

The site at Seveso was operated by the company Industrie 
Chimiche Meda Societa Azionara (ICMESA), using a pro¬ 
cess developed by its parent company Givaudan, which 
was itself owned by Hoffmann La Roche. 

Icmesa started in Naples in 1926 and began operations in 
Meda in 1946. Givaudan acquired a majority shareholding 
in Icmesa in 1965. In the same year Givaudan was itself 
taken over by Hoffmann La Roche. Icmesa was an Italian 
company and the other two companies were Swiss. 

The management of the three companies and the offi¬ 
cials of the local authorities involved are described in on 
The Superpoison. The following information is relevant: 


General Manager, H. von Zwehl 
Technical Manager, C. Barni 
Production Manager, P. Paoletti 
Factory Doctor, E. Bergamaschini 

Givaudan 

Managing Director, G.Waldvogel 

Technical Director, J. Sambeth 

Director of Dubendorf Laboratories, B.Vaterlaus 

Hoffman La Roche 

Technical General Manager, R. Seheff 


Table A3.1 Selected references on Seveso 


Official report 

Orsini (1977,1980) 

Further accounts 

Anon. (1976k); Commission of European Communities and 
Italian Ministry of Health (1976); A. Hay (1976,1976a-e, 
1981,1982); Margerison (1976); VC. Marshall (1976b, 1980c, 
1983b, 1987,1992 LPB104); Comer (1977); Kimbrough etol. 
(1977);Temple (1977b); Bolton (1978,1991); Koch and 
Vahrenholt (1978); Pocchiari (1978); Slater (1978a); Verband 
der chemischen Industrie (1978); Bisanti et al. (1979); 
Cavallaro,Tebaldi and Gualdi (1979,1982); Ferraiolo (1979); 
Hombergeref al. (1979); Anon. (1980b); Margerison, Wallace 
and Hallenstein (1980); J.J. Stevens (1980); D.C. Wilson 
(1980); Cardillo and Girelli (1981); A. Robertson (1981); 
Theofanous (1981,1983); Rice (1982); Anon. (1983i,l,o,u,v); 
Anon. (1983 LPB 53, p. 27); Sambeth (1983); Cardillo, 
Girelli and Ferraiolo (1984); Redding (1984); W.B. Howard 
(1985); Kletz (1991) 

TCDD 

Herxheimer (1899); Kumig and Schulz (1957); Schulz 
(1957); Bauer, Schulz and Spiegelberg (1961); 
Higginbotham et al. (1968);Verrett (1970); Vos etal. (1973); 
Schwetz etal. (1973); WHO (1977); Cattabeni, Cavallaro and 
Galli (1978); A. Hay (1982); Rice (1982); Anon. (1984p); 
Tschirley (1986); EPA (1994a,b) 

Previous TCP and TCDD accidents 

Hofmann (1957); Schulz (1957); Bleiberg etal. (1964); 

US Senate (1970); Milnes (1971); May (1973); Dalderup (1974) 


Clinical Research Director, G. Reggiani 

Local Authorities 
Mayor of Seveso, F. Rocca 
Mayor of Meda, F. Malgrati 
Medical Health Officer, G. Ghetti 
Acting Health Officer, F. Uberti 

Regional Minister of Health, V. Rivolta 

Chief Medical Officer, Milan Province V. Eboli 

Chief Medical Officer, Lombardy V. Carreri 

Director of Provincial Health Laboratory, Milan A. Cavallaro 

Magistrate, S. Adamo 

A3.2 The Site and the Works 

When Icmesa built its works at Meda the site was sur¬ 
rounded by fields and woods. Over the years, however, the 
area near the site was developed. 

The reactor, Reactor A101, in which the runaway 
occurred was in Department B of the works. 

A3.3 The Process and the Plant 

The process which gave rise to the accident was the pro¬ 
duction of 2,4,5 -trichlorophenol (TCP) in a batch reactor. 

TCP is used for herbicides and antiseptics. Givaudan 
required it for making the bacteriostatic agent hexa- 
chlorophene. It manufactured its own because the herbi¬ 
cide grades contained impurities unacceptable in this 
application. Between 1970 and 1976 some 370 te of the 
chemical were produced. 
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Stage 1 

1,2,4,5-Tetrachlorobenzene 2,4,5-Sodium Trichlorophenate 



Figure A3. 1 Reaction scheme for production of 2,4,5-trichiorophenoi (TCP) 


The reaction was carried out in two stages. Stage 1 
involved the alkaline hydrolysis of 1,2,4,5-tetrachloro- 
benzene (TCB) using sodium hydroxide in the presence of a 
solvent ethylene glycol at a temperature of 170-180°C to 
form sodium 2,4,5-trichlorophenate. The reaction mixture 
also contained xylene, which was used to remove the water 
by azeotropic distillation. In Stage 2 the sodium tri¬ 
chlorophenate was acidified with hydrochloric acid to TCP 
and purified by distillation. The reaction scheme is shown 
in Figure A3.1. 

On completion of the Stage 1 reaction some 50% of the 
ethylene glycol would be distilled off and the temperature 
of the reaction mixture lowered to 50- 60°C by the addition 
of water. 

The process was a modification by Givaudan of a process 
widely used in the industry. The conventional process used 
methanol rather than ethylene glycol and operated at some 
20 bar pressure. 

In this reaction the formation of small quantities of 
TCDD as a by-product is unavoidable. At a reaction tem¬ 
perature below 180°C the amount formed would be unlikely 
to exceed 1 ppm of TCP, but with prolonged heating in 
the temperature range 230-260°C it could increase a 
thousand-fold. 

During manufacture nearly all (99.7%) of the TCDD 
formed concentrated in the distillation residues from which 
it was collected and incinerated. Only 0.3% found its way 
into theTCP, giving a maximum concentration of 10 ppb. 

The reactor was a 138751vessel with an agitator and with 
a steam jacket supplied with steam at 12 bar. The saturation 
temperature of steam at this pressure is 188°C.The controls 
on the reactor were relatively primitive. There was no 
automatic control of the heating. The reactor system is 
shown in Figure A3.2. 

The reactor was provided with a bursting disc set at 
3.5 bar and venting direct to atmosphere. The prime purpose 
of this disc was to prevent overpressure when compressed 
air was being used on the reactor. 

The works had an incinerator for the destruction of 
hazardous plant residues at temperatures of 800-1000°C. 

A3.4 TCDD and Its Properties 

The properties of TCDD are given the Seveso Report and in 
Dioxin, Toxicological and Chemical Aspects by Cattabeni, 
Cavallaro and Galli (1978) and by Rice (1982). 


2,3,7,8-tetrachlorodibenzo-p-dioxin, which is also known 
asTCDD or dioxin, has the formula 


'■“000 


Cl i 
Cl 2 


It is generated by the elimination of two molecules of HC1 
from 2,4,5-trichlorophenol 



TCDD is one of the most toxic substances known. In 1954, 
an accident at the BoehringerTCP plant in Hamburg led to 
a painstaking investigation by Schulz (1957) of the causes 
of chloracne in people who had been exposed. He found that 
the cause was not theTCP itself but an impurity which he 
identified asTCDD, or dioxin. Actually there is a family of 
dioxins,TCDD being the most toxic. 

The toxicity of TCDD is reviewed in the Seveso Report. 
The LD 50 data quoted in the report are shown inTable A3.2, 
Section A. The lowest LD 50 quoted is for guinea pigs and is 
0.6 pg/kg, that is a dose of 0.6 x 10 -9 per unit of body 
weight. The report also gives a table showing the toxicity of 
TCDD relative to that of other well-known poisons. An 
extract from this is shown inTable A3.2, Section B.TCDD is 
therefore an ultratoxic substance. 

TCDD can be taken into the body by ingestion, inhala¬ 
tion or skin contact. A leading symptom of TCDD poison¬ 
ing is chloracne, which is an acne-like skin effect caused by 
chemicals. A mild case of chloracne usually clears within a 
year, but a severe case can last many years. Other effects of 
TCDD include skin burns and rashes and damage to liver, 
kidney and urinary systems and to the nervous system. It 
appears to have an unusual ability to interfere with the 
metabolic processes. There are varying degrees of evidence 
for carcinogenic, mutagenic and teratogenic properties. 
These are reviewed in the report. 

TCDD is a stable solid which is almost insoluble in water 
and resistant to destruction by incineration except at very 
high temperatures. 
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Table A3.2 Toxicity of TCDD (after Orsini, 1980) 


A CDs,, to' 

various animal species 

Species 


LD S0 

(pkg/kg) 

References 

Guinea pig 

(male) 

0.6 

Schwetz et al. (1973) 

Rat 

(male) 

22 

Schwetz et al. (1973) 


(female) 

45 

Schwetz et al. (1973) 

Rabbit 

(male) 

115 

Schwetz et al. (1973) 


(female) 

115 

Schwetz et al. (1973) 

Mouse 

(male) 

114 

Vos etal. (1973) 

B Relative toxicity of 

some highly toxic materials 

Substance 


Minimum lethal dose (moles/kg) 

Botulinus to: 


3.3 xlO -17 


TCDD 


3.1 xlO -9 


Strychnine 


1.5xl0 -6 


Sodium cyanide 

2.0 xlO -4 



A3.5 Previous Incidents Involving TCP and TCDD 

The manufacture of TCP had resulted in a number of acci¬ 
dents prior to Seveso and its hazards and problems were 
recognized, to the extent that some companies had with¬ 
drawn from the business. 


A list of incidents, based on that given in the Seveso 
Report, is shown in Table A3.3. 

The original method of making TCP was to heat TCB 
and sodium hydroxide with methanol at about 200°C and 
20 bar. 

In 1949, there was a large release from a pressurized TCP 
reactor at the Monsanto plant at Nitro, West Virginia, when 
a valve ruptured. A total of 228 people were affected to 
some degree. In 1953, a TCP reactor explosion at BASF, 
affecting 42 people. Another TCP reactor explosion occurred 
at the Boehringer plant at Hamburg in 1954, 40 workers 
being affected. It was this incident which led to the dis¬ 
covery by Schulz of the ultratoxic properties of TCDD. At 
the Rhone-Poulenc TCP plant at Pont de Claix near 
Grenoble there were 100 cases of dioxin poisoning in the 
period 1953-70 and explosions in 1956 and 1966, affecting 
17 and 20 people, respectively. In 1963, at the Philips- 
Duphar plant on the North Sea Canal near Amsterdam a 
reaction runaway on a pressurizedTCP reactor blew the top 
off the reactor, even though the relief valve had blown, and 
affected some 30 people. In 1964, the operating procedure 
at the Dow plant at Midland, Michigan, was changed and 
an accident occurred which affected 60 people. In some of 
these incidents a small number of those exposed subse¬ 
quently died, apparently from the exposure. 

The incidents did not cause any direct exposure of the 
public, but they did reveal the difficulties of preventing the 
workers’ families being affected and of decontaminating 
the plant. In the Ludwigshafen accident one man got 
chloracne just by using his father’s towel. 
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Table A3.3 

Some incidents involving TCDD 



Date 

Location 

Injured 

Comments 

1949 

Nitro,WV (Monsanto) 

117 

Overheating leading to explosion 

1953 

Ludwigshafen (BASF) 

55 

Overheating leading to explosion 

1954 

Hamburg (Boehringer) 

37 

Exposure during plant operation 

1956 

Pont de Claix (Rhone-Poulenc) 

17 

Explosion 

1956 

USA (Hooker) 

? 

Overheating 

1960 

USA (Diamond Shamrock) 

? 

Overheating 

1963 

N. Sea Canal (Philips-Duphar) 

30 

Overheating leading to explosion 

1964 

Midland, MI (Dow) 

30 

Explosion 

1964 

Neuratovice (Spolana) 

72 

Exposure during plant operation 

1966 

Pont de Claix (Rhone-Poulenc) 

21 

Explosion 

1968 

Bolsover (Coalite) 

79 

Overheating leading to explosion 

1970? 

(Bayer) 

5 

Exposure during plant operation 

1972 

(Linz Chemic-Werke) 

50 

Exposure during plant operation 


(Thompson Hayward) 


Overheating leading to explosion 

1976 

Seveso (Icmesa) 


Overheating 


Various attempts were made at Ludwigshafen to remove 
the dioxin from the plant building, including the use of 
detergents, the burning off of the surfaces, the removal of 
insulating material and so on, but these were not effective. 
Eventually the whole building was demolished under con¬ 
trolled conditions and the debris buried. At Duphar some 
50 people were involved in cleaning up the plant, of whom 
four died within 2 years, though the connection between 
the incident and the deaths was unproven. The plant was 
sealed for 10 years and then dismantled from the inside 
brick by brick, the rubble was embedded in concrete and 
the concrete blocks were sunk in the Atlantic. 

In 1968, an accident occurred at the Coalite TCP plant at 
Bolsover. Coalite utilized a modification of the Givaudan 
process, using ethylene glycol and operating at atmos¬ 
pheric pressure, but with ortho-dichlorobenzene (ODCB) 
as the second solvent to remove the water formed. The use 
of this second solvent reduced the amount of expensive 
ethylene glycol which had to be used and not all of which 
was recovered after the batch. Research indicated that 
further reduction might be made in the amount of ethylene 
glycol used and a trial was carried out on the plant using 
half the normal quantity. A reaction runaway occurred, 
blew the top off the reactor and released flammable 
vapours which exploded and killed the shift chemist. 

The workers who had been in the building were affected 
but appeared to recover after 10 days and the undamaged 
part of the plant was thoroughly cleaned and brought back 
into use, the damaged part being sealed off. Some weeks later 
chloracne symptoms appeared not only among those who 
had been in the plant at the time of the accident but among 
others who had worked in the building occasionally after it 
hadbeen cleaned.Within 7 months there were some 79 cases of 
chloracne. Stringent hygiene measures were instituted and 
the cases gradually cleared.The most seriously contaminated 
part of the plant was dismantled and buried in a deep hole. 

The causes of the accident were investigated by Milnes 
(1971). He found that an exothermic reaction occurs between 
ethylene glycol and sodium hydroxide starting about 230°C 
and rising rapidly to about 400°C. He also showed that 
TCDD is formed by reaction of sodium trichlorophenate and 
sodium hydroxide as described above. Further, he demon¬ 
strated that whereas at the normal reaction temperature of 


180°C the amount of TCDD formed is only a few ppm, at 
250°C large amounts are formed. Subsequent work has 
shown that formation of TCDD is zero below 153°C, less 
than 1 ppm at 180°C but 1600 ppm in 2 h at 230-260°C 
(Orsini, 1980). 

A3.6 Events Prior to the Release 

The start of the batch began at 16.00 on Friday, 9 July 
(Table A3.4). The reactor was charged with 2000 kgTCB, 
1050 kg sodium hydroxide, 3300 kg ethylene glycol and 
600 kg xylene. 

After the reaction had taken place, part of the ethylene 
glycol was distilled off, but the fraction removed was only 
15% instead of the usual 50% so that most of the solvent 
was left in the vessel. Distillation was interrupted at 5.00 on 
10 July and heating was discontinued but water was not 
added to cool the reaction mass. The reactor was not 
brought down to the 50-60°C temperature range specified. 
The temperature recorder was switched off, the last tem¬ 
perature recorded being 158°C. 

The shift ended at 6.00. This time coincided with the 
closure of the plant for the weekend. The reactor was left 
with the agitation turned off but without any action to 
reduce the temperature of the charge. 

During the weekend, with the steam turbine on reduced 
load, the steam supply to the reactor jacket became super¬ 
heated, its temperature being about 300°C. 

A3.7 The Release 1 

At 12.37 on 9 July, the bursting disc on the reactor ruptured. 
The maintenance staff heard a whistling sound and a cloud 
of vapour was seen to issue from a vent on the roof giving 
rise to ‘the formation of a dense cloud of considerable alti¬ 
tude’. The release lasted some 20 min. 

A maintenance foreman, G. Bruno, who was passing, 
heard the disc rupture and realized something was wrong. 
He ran with two colleagues, R. Vito and C. Galante, to the 
boiler room to start-up the large firewater pump, then to the 
stores to get protective clothing. They approached Depart¬ 
ment B, where they felt the heat from the reactor. Bruno 
called in the technical manager, C. Barni, who arrived at 
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Table A3.4 Timetable of events at Seveso 


Jul. 


9 Friday 
10 Saturday 


11 Sunday 

12 Monday 

13 Tuesday 

14 Wednesday 

15 Thursday 


16 Friday 

17 Saturday 

18 Sunday 

19 Monday 

20 Tuesday 

21 Wednesday 

23 Friday 

24 Saturday 

26 Monday 
29 Thursday 


16.00 Final reactor batch started 
5.00 Final reactor batch interrupted 
12.37 Bursting disc on reactor ruptures 

Barni visits houses near plant to warn against eating garden produce. He asks carabinieri to 
repeat warning but they refuse 

Barni and Paoletti inform von Zwehl. They are unable to contact Ghetti or his deputy. They inform 
Rocca and Malgrati.Von Zwehl informs Sambeth 
Rocca and Uberti visit ICMESA. Letter of von Zwehl to Health Officer 
Report of Uberti to Rocca and Malgrati 

Sambeth and Vaterlaus inspect Dept B and contaminated area. Uberti writes to Provincial Health 
Officer in Milan 

Dubendorf Laboratories give first analyses showing highTCDD content. Sambeth telegraphs 
Waldvogel in Turkey and asks von Zwehl to inform local authorities. Sambeth informs 
Hoffmann La Roche and seeks clinical advice and permission to close plant. Rumours grow in 
Seveso. Citizens invade Uberti’s office. Rocca and Uberti meet von Zwehl. They decide to 
declare polluted zone and to post warning notices 
Workforce go on strike. Efforts are made to contact Ghetti in remote holiday farmhouse. Warning 
notices are erected. Rocca, Uberti and others meet von Zwehl again. Uberti insists on 
evacuation. Rocca requests and obtains permission for evacuation from Deputy Prefect of 
Milan. Rocca contacts journalist friend 

II Giorno carries front-page headlines on ‘Poison gas’ at Seveso. Press descend on town. Uberti 
contacts Cavallaro. 

Cavallaro’s team of health inspectors investigate contaminated area. Rocca, Ghetti, Cavallaro and 
Adamo meet von Zwehl. Cavallaro presses to know identity of poison released. Adamo 
threatens to arrest ICMESA management 

Waldvogel arrives in Seveso and offers local authority financial compensation, which is refused 
Cavallaro and Ghetti meet Vaterlaus in Zurich. Vaterlaus reveals that poison released wasTCDD. 

Uberti’s letter to Provincial Health Officer in Milan arrives. 

16.00 Ghetti telephones Rocca to say substance wasTCDD. Prefect in Milan is informed 
9.30 Meeting at prefecture. Rivolta and Carreri take over responsibility. Carabinieri arrest von 
Zwehl and Paoletti 

9.00 Meeting at prefecture. Rivolta decides against evacuation. Reggiani visits Rocca and urges 
evacuation. Reggiani asked to leave Deputy Prefect’s meeting unheard 
14.00 Rivolta reassures meeting in Seveso town hall. Reggiani argues with Rivolta and calls for 
evacuation. Carabinieri try unsuccessfully to arrest Reggiani, who returns to Switzerland 
9.30 Meeting of regional health council. Vaterlaus presents map of locations affected. Council 
decides to recommend evacuation and defines evacuation zone (part of Zone A) 

179 people evacuated 

Zone A extended and further 550 evacuated 


13.10 as the escape was subsiding. About an hour after the 
release began Vito and Galante were able to begin gingerly 
admitting cooling water to the reactor system. 

The release contaminated the vicinity of the plant with 
TCDD. Figure A3.3 is a map of the area, showing the zones 
later established and Table A3.5 gives the concentrations 
later measured in these zones. 

The area of Zone A was 108 ha (1.08 km 2 ) with con¬ 
centrations of TCDD averaging 240 pg/m 2 and rising to 
over 5000 pg/m 2 . The area of Zone B was 269 ha (2.69 km 2 ) 
with concentrations averaging 3 pg/m 2 but rising to 43 pg/m 2 . 
In the Zone of Respect, Zone R, which had an area of 1430 ha 
(14.3 km 2 ) the concentrations varied from indeterminable 
to 5 pg/m 2 . 

A3.8 The Emergency and the Immediate Aftermath 

The release set in train a series of events which were to have 
profound repercussions. They are described in detail in 
The Superpoison. It is possible here to give only a brief 
outline. 


When the situation had been brought under control in 
the works, Barni visited houses near the plant and warned 
people not to eat the garden produce. He asked the 
carabinieri to repeat the warning, but they refused, unless 
there was authorization from the municipal health officer. 

There were few obvious signs of an accident, although 
surfaces were covered with a thin, oily film. 

The municipal health officer, G. Ghetti, was on holiday in 
a remote farmhouse not on the telephone. 

On Sunday 11 July, Barni visited P. Paoletti, the produc¬ 
tion director, and they together contacted the general 
manager, von Zwehl, who was on holiday in the Alps. They 
then visited the mayor of Seveso, F. Rocca, and recom¬ 
mended that people living near the plant be warned not to 
eat garden produce. Rocca agreed to inform the carabinieri. 
He also brought in the mayor of Meda, F. Malgrati, since the 
Icmesa plant lay within the Meda boundaries. 

The same day von Zwehl informed J. Sambeth, technical 
director of Givaudan. Sambeth realized that there was a 
dioxin hazard and asked what temperature the reactor had 
reached. He told von Zwehl to close off Department B 
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Figure A3.3 Plan of the Seveso area, showing Zones A and B and Zone of Respect (after Orsini, 1980; 
V.C. Marshall, 1978) 


Table A3.5 Concentrations of TCDD in Zones A and B 
at Seveso (after Orsini, 1980) 


Zone 


Concentration (pg/m 2 ) 

Mean 

Maximum 

Minimum 

A1 

580.4 

5477 

n.v.d 

A2 

521.1 

1700 

6.1 

A3 (north) 

453.0 

2015 

1.7 

A3 (south) 

93.0 

441 

n.v.d. 

A4 

139.9 

902 

n.v.d. 

A5 

62.8 

427 

n.v.d. 

A6 

29.9 

270 

n.v.d. 

A7 

15.5 

91.7 

n.v.d. 

B 

3 

43.8 

n.v.d. 


n.v.d. = no value determined. 


and have samples from the reactor sent to the Dubendorf 
laboratories of Givaudan at Zurich. Normally he would have 
discussed the problem with the managing director of 
Givaudan, G. Waldvogel, hut the latter was on holiday in 
TUrkey; 

On Monday 12 July, Rocca together with the acting health 
officer for Meda and Seveso, F. Uberti, visited Icmesa and 
saw von Zwehl, who convinced them that there was no 
serious health hazard. Von Zwehl wrote a letter to the health 
officer. On the material released the latter said: 

Since we are not in a position to evaluate the substances 
present in the vapour or to predict their exact effects, but 
knowing the final product is used in manufacturing her¬ 
bicides, we have advised householders in the vicinity not 
to eat garden produce. 

On Tuesday 13 July, Uberti sent a report to Rocca and 
Malgrati, enclosing a copy of von Zwehl’s letter. He believed 
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the release was one of the minor accidents which occur 
periodically. 

OnWednesday 14 July, Sambeth and Vaterlaus, director of 
the Dubendorf laboratories, came to Seveso, inspected 
Department B and tried to work out how high a temperature 
the reactor had reached. They also inspected the con¬ 
taminated land. 

Uberti wrote the same day to the provincial health officer 
in Milan. The letter did not arrive until 20 July. 

On Thursday 14 July, the first analyses from the 
Dubendorf laboratory came through to Sambeth. They 
showed high dioxin contents. Sambeth telegraphed 
Waldvogel in Turkey. He warned von Zwehl to advise the 
local authorities that the release may have contained toxic 
by-products. 

He also contacted Hoffmann La Roche to seek clinical 
advice and permission to order closure of the plant. The 
clinical research director of Hoffmann, G. Reggiani, was 
not familiar withTCDD, but agreed to take over the health 
aspect and began to inform himself about the substance. 

Meanwhile rumours were growing in Seveso and a group 
of citizens invaded Uberti’s office. 

Rocca and Uberti met von Zwehl again. He agreed to pay 
compensation for any damage, produced a map of the pol¬ 
luted area, and suggested that people be advised not to eat 
garden produce and that warning notices be posted. He was 
not, however, prepared to say what the poison was. The 
visitors decided to declare a polluted zone and post notices. 

On Friday 16 July, the erection of warning notices began. 
At this point the workforce at Icmesa went on strike. Rocca 
and Uberti had a further meeting with von Zwehl where 
they again pressed to be told the identity of the poison. 

Uberti now urged Rocca to carry out an evacuation. 
Ghetti was contacted in his remote farmhouse, agreed to 
return but left the decision to Rocca. Rocca requested and 
obtained permission to evacuate from the Deputy Prefect of 
Milan. He also contacted a journalist friend. 

On Saturday 17 July U Giorno carried front-page head¬ 
lines about the ‘Poison gas’ at Seveso. The accident became 
a national issue and the press descended on the town. 

The same day Uberti contacted A. Cavallaro, director of 
the provincial health laboratories in Milan. 

On Sunday 18 July, Cavallaro’s team of health inspector 
arrived to investigate the contaminated area. 

Rocca, Ghetti, Cavallaro and a local magistrate, 
S. Adamo, met again with von Zwehl. Cavallaro pressed to 
know the poison involved. Adamo threatened to arrest the 
Icmesa management 

On Monday 19 July, Waldvogel arrived in Seveso. He 
offered the local authorities compensation, which they 
refused. 

OnTuesday 20 July, Cavallaro and Ghetti met Vaterlaus in 
Zurich. He revealed that the poison wasTCDD. Ghetti tele¬ 
phoned Rocca with this information. The Prefect in Milan 
was informed. 

On Wednesday 21 July, a meeting was held at the pre¬ 
fecture. The regional minister of health, V Rivolta, now took 
charge of the medical aspects together with V Carreri, 
director of health services for Lombardy. 

On the same day the carabinieri arrested von Zwehl and 
Paoletti. 

On Friday 23 July, there was another meeting at the pre¬ 
fecture. Rivolta was against evacuation. Meanwhile 
Reggiani had decided that evacuation was essential and 
arrived in Seveso to urge this view. He saw Rocca, who told 


him the decision was out of his hands. He came into the 
meeting at the prefecture but was asked to leave unheard. 

Later that day Rivolta addressed a meeting in Seveso 
town hall and gave reassurances about the hazards. 
Reggiani stated his disagreement with Rivolta and called 
for evacuation. He was unable to make his view prevail. At 
his hotel in Milan he was warned that the carabinieri were 
about to arrest him and drove north in haste to Switzerland. 

There followed a meeting in Lugano between Waldvogel, 
Sambeth and Vaterlaus, who had a map of the contaminated 
areas based on the analyses carried out by his laboratories. 
Reggiani told the Givaudan men of his experiences. It was 
agreed that an attempt must be made to persuade the Ita¬ 
lian authorities to evacuate and that Vaterlaus, who was 
deemed less likely to be arrested, should do this. 

On Saturday 24 July, a meeting of the regional health 
council was held in Milan. Vaterlaus presented his map of 
the areas affected. An evacuation zone was defined and the 
decision was taken to recommend evacuation. 

On Monday 26 July, 179 people were evacuated from an 
area which was later defined as part of Zone A. On Thurs¬ 
day 29 July, a further 550 people were evacuated from 
another area which was also part of what became Zone A. 

Eventually three zones, Zone A, Zone B and the Zone of 
Respect were defined, as described above. 733 people were 
evacuated from Zone A and 5000 in Zone B were put under 
medical surveillance, but allowed to remain in their homes. 

The release posed a severe problem for the Italian 
authorities, who were obliged to seek assistance from 
international experts in medical diagnosis and treatment 
and in analytical and decontamination procedures. 


A3.9 The Investigation 

The work of the Commission took place against a back¬ 
ground of intense national concern. 

The terms of reference of the Commission were wide- 
ranging. They have been described by V.C. Marshall (1980c) 
as follows: ‘These terms of reference appear to have com¬ 
bined the functions in UK terms of the Flixborough inquiry, 
the Major Hazards Advisory Committee and the Royal 
Commission on the Environment’. 

The report produced by the Commission, the Seveso 
Report (Orsini, 1980), covers a large number of topics, 
including the history of TCP production, the history of 
Icmesa, the toxicity of TCDD, the causes of the accident, the 
consequences of the accident in terms of contamination and 
health effects, the health measures taken, the reclamation 
of the contaminated land, the actions and responsibilities 
of the management and of the local and regulatory autho¬ 
rities and the recommendations. The report adduces four 
causes of the accident: 


(1) Interruption of the production cycle. 

(2) Method of distillation. 

(3) Set pressure of bursting disc. 

(4) Failure to install collection/destruction system for 
material vented. 

The production cycle was interrupted at 5.00 on 10 July and 
the reactor was left without agitation or cooling. 

In the process described in the original Givaudan patent 
the charge was acidified before distillation. In the process 
used at Icmesa the order of these two steps was reversed. 
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This allowed prolonged contact time between the ethylene 
glycol and sodium hydroxide. 

Another modification to the original process was a 
change in the molar proportions of the reactants from 
1TCB: 2 NaOH: 11.5 ethylene glycol 


1 TCB: 3 NaOH: 5.5 ethylene glycol 
which increased the molar concentration of sodium 
hydroxide. 

The setting of the bursting disc was 3.5 bar. The function 
of this device was to guard against overpressure from the 
compressed air, which was used to transfer materials to the 
reactor. The inquiry found that if the set pressure had been 
lower, venting would have occurred at a lower, and less 
hazardous, temperature. 

No device was installed to collect or destroy any toxic 
materials vented. The bursting disc manufacturer’s cata¬ 
logue stated ‘Bursting discs may be preferred in the case of 
fluids of great value and high toxicity where the loss of 
such fluids should be avoided. In this case a second receiver 
tank is required to recover the discharged fluid’. There was 
no such tank on the plant. 

Besides listing these four points the report makes a 
number of other comments. On the reactor itself it states 

Proof has been provided both of the inadequacy of the 
measuring equipment for a number of fundamental 
parameters and also the absence of any automatic control 
system. Measurement of acidity was carried out manu¬ 
ally by immersion of a rod with an indicator chart (sic) 
through a secondary inspection window. 

The reactor vessel was not given a hydraulic test as the 
reactor was considered to operate at atmospheric pressure. 
The fitting of the bursting disc was not reported to the state 
pressure vessel inspectors. 


The report recommends improved regulatory arrange¬ 
ments for the control of hazardous plants and, in this con¬ 
nection, places some reliance on the introduction of the EC 
Directive which came to be known as the ‘Seveso Directive’. 

The viewpoint of the companies has been given in sev¬ 
eral publications. The accident itself has been described by 
Sambeth (1983). The view of Hoffmann La Roche has been 
stated by Homberger et al. (1979). 


A3.10 The Release 2 

The contents of the reactor at the time of the accident have 
been given as 2030 kg sodium trichlorophenate, 540 kg 
sodium chloride, c.1000 kg ethylene glycol and 1600 kg 
sodium ethylene glycolate, diethylene glycol and poly¬ 
ethylene glycol. 

It is known that above 230°C such a mixture will undergo 
an exothermic decomposition reaction. Accidents had been 
known to occur involving a reaction runaway above this 
temperature. 

The actual temperature profile in the reactor has been 
given by Sambeth (1983) and is shown in Figure A3.4. Due 
to the interruption of the batch the usual sharp reduction in 
the temperature of the charge at the termination of the 
reaction did not take place and after 7.5 h the explosion 
occurred. 

Investigations carried out after the accidents using differ¬ 
ential thermal analysis showed that there exist two slow exo¬ 
therms (Theofanous, 1981,1983). One starts at about 185°C, 
peaking at 235°C and giving a 57°C adiabatic temperature 
rise. The other starts at about 255°C, peaking at 265°C and 
giving an estimated 114° C temperature rise. The adiabatic 
induction times for the two exotherms are 2.1 and 0.5 h, 
respectively The decomposition exotherm starts at about 
280-290°C and shows a rapid pressure rise at about 300°C. 

A mechanism for the reaction runaway has been 
proposed by Theofanous. This is that due to layering of the 



Figure A3.4 Reactor temperature profiles measured for accident at Seveso (Sambeth, 1983) (Courtesy of 
Chemical Engineering) 
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Time (h) 

Figure A3.5 Reactor temperature profiles calculated for period preceding accident at Seveso (after Theofanous, 
1981) (Courtesy of Nature) 


reaction mix the amount of residual heat in the upper sec¬ 
tion of the reactor wall was sufficient to raise the temper¬ 
ature of the top layer of liquid to c. 200-220°C, a temperature 
high enough to initiate exotherms leading to decomposi¬ 
tion. The calculated temperature profiles for this theory are 
shown in Figure A3.5. 

In the conduct of the final batch there were failures of 
adherence to operating procedures. WB. Howard (1985) 
instances (1) failure to distil off 50% of the glycol; (2) failure 
to add water; (3) failure to continue agitation; (4) switching 
off of the reactor temperature recorder and (5) failure to 
bring the reactor temperature down from its value of 158°C 
to the normal value of 50—60°C. 


A3.11 The Later Aftermath, Contamination and 
Decontamination 

As described above, there was a prolonged period in which 
the authorities tried to assess the situation and determine 
measures for dealing with it. They were advised by a team 
from Cremer and Warner (C&W), and an account has been 
given by Rice (1982). 

The release was modelled using fluid jet and gas disper¬ 
sion models and predictions made of the probable ground 
level concentrations of TCDD. Accounts have been given by 
Comer (1977) and Rice (1982). In this work the reaction 
mass was taken as 2800 kg ethylene glycol, 2030 kg tri- 
chlorophenol 2030, 542 kg sodium chloride and 562 kg 
sodium hydroxide. 

Estimates of the amount of TCDD generated in the reac¬ 
tor and dispersed over the countryside vary. Cattabeni, 
Cavallaro and Galli (1978) give an estimated range of 
0.45-3 kg released. The amount assumed in the C&W 
modelling work was 2 kg. 

Other parameters used in the modelling were bursting 
disc rupture pressure 376 kPa; vent pipe diameter 127 mm; 
discharge height above ground 8 m. The bursting disc 


rupture was assumed to a first approximation to be due to 
the vapour pressure of ethylene glycol at 250°C. From these 
data the value obtained for the vapour exit velocity was 274 
m/s. Two limiting cases were considered for the discharge: 
Case A, pure vapour (density 1.61 kg/m 3 ) and Case B, a 
two-phase vapour-liquid mixture (density 8.99 kg/m 3 ). 
Eyewitness accounts indicated that the actual event was 
intermediate between these two extremes. For Case A the 
total plume rise was estimated as 83 m with the downwind 
distance to the maximum height as 103 m and the corre¬ 
sponding figures for Case B were 55 and 95 m, respectively. 
Figure A3.6 shows the estimated ground concentration 
contours for a 2 kg release taken from this work. 

The modelling work proved useful in defining the pro¬ 
blem and planning the decontamination. The results 
showed that beyond about 1.5 km there was little difference 
in the concentration estimates for the two cases. There was 
good agreement between the predicted and the measured 
concentrations. This gave some confidence that the amount 
released was indeed about 2 kg. There had been some 
speculation by scientists that an amount as high as 130 kg 
had been released. 

Initially, various methods of decontamination were put 
forward by various parties. TCDD is virtually insoluble in 
water, which reduces the threat to the water supply, but 
means that the effect of rain is to transfer it from the vege¬ 
tation to the soil rather than to remove it. One method of 
removal suggested was burning and proposals were made 
to burn the contaminated ground with flame-throwers. It 
was feared, however, that unless a temperature of at least 
1000°C were attained, the TCDD would not be destroyed 
but simply swept up and deposited elsewhere. Another 
method proposed was to apply a mixture of olive oil and 
cyclohexanone to the ground, so that the TCDD would dis¬ 
solve in the oil and be broken down by the ultraviolet 
radiation of the sun. This was abandoned, because instead 
of sun there was rain, and it was feared that the dissolved 
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Figure A3.6 Estimated concentrates of TCDD at Seveso (Comer, 1977. Reproduced by permission.) 


TCDD would be washed into the rivers and might penetrate 
the water table. A third approach involved the use of spe¬ 
cially bred microbes capable of digesting toxic substances. 
Mixtures of more than a dozen strains of microorganisms 
bred on chemical substrates were already used to degrade 
chemical wastes, including cyanides and herbicides. 

The decontamination measures actually carried out are 
described by Rice.They include collection of vegetation and 
cleaning of buildings by high intensity vacuum cleaning 
followed by washing with high-pressure water jets. 

Itisworthmentionthatpeoplemayalsohavebeenaffected 
by materials in the reactor charge other than TCDD. 
VC. Marshall (1980) indicates that on the basis of the ground 
concentrations found in the contaminated area a minimum 
of 0.25 kg was released. He points out that there were some 
5-10 te of charge in the reactor and that several tonnes of 
material including sodium hydroxide must have been 
ejected. He suggests that burns around the hands and other 
parts of the body suffered by 413 persons who did not devel¬ 
op chloracne were probably caused by sodium hydroxide. 

Figure A3.7 gives plots of the actual ground concentra¬ 
tions, showing the change with time, obtained by Cavallaro, 
Tebaldi and Gualdi (1982). 

Data from the official report on ground concentrations in 
zones A and B are given in Table A3.5. 

A3.12 Some Lessons of Seveso 

Some of the numerous lessons to be learnt from the Seveso 
disaster, many of which were brought out in the Commis¬ 
sion’s report, are listed in Table A3.6. Some of them are 
similar to those from Flixborough, while others are differ¬ 
ent, reflecting both the different substances and processes 
and the different company and national situations 
involved. Some of these lessons are now considered: 

Public control of major hazard installations 
The Seveso disaster had the effect of raising the general 
level of awareness of the hazard from chemical plants 
in Italy and in Europe generally and highlighted the 
deficiencies in the existing arrangements for the control of 
major hazards. 


The Italian government set up the Commission of 
Inquiry to investigate the cause of the disaster and to make 
recommendations. It also gave strong support to the devel¬ 
opment of the EC Directive. 

Siting of major hazard installations 
The release at Seveso affected the public because in the 
period since the site was first occupied housing develop¬ 
ment had encroached on the area around the plant. The 
accident underlined the need for separation between 
hazard and public. 

Acquisition of companies operating hazardous processes 
A lesson which has received relatively little attention is the 
problem faced by a company which becomes owner by 
acquisition of another company operating a hazardous 
process. At Seveso the problem was compounded by the 
fact that Icmesa was owned by Givaudan and the latter by 
Hoffmann La Roche, so that the company ultimately 
responsible was at two removes. As a result the directors of 
the latter were not familiar with the hazards. 


Hazard of ultratoxic substances 

Seveso threw into sharp relief the hazard of ultratoxic 
substances. The toxicity of TCDD is closer to that of a 
chemical warfare agent than to that of the typical toxic 
substance which the chemical industry is used to handling. 

As it happened, the British Advisory Committee on 
Major Hazards was presenting its First Report, giving a 
scheme for the notification of hazardous installations, 
when Seveso occurred. It contained no notification propo¬ 
sals for ultratoxics. In the Second Report this deficiency 
was rectified. The EC Directive places great emphasis on 
toxic and ultratoxic materials. 


Hazard of undetected exotherms 

The characteristics of the reaction used had been investi¬ 
gated and the company believed it had sufficient informa¬ 
tion. It was well aware of the hazard from the principal 
exotherm. Subsequent studies showed, however, that other, 
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Table A3.6 Some lessons of Seveso 


Public control of major hazard installations 

Siting of major hazard installations 

Acquisition of companies operating hazardous processes 

Hazard of ultratoxic substances 

Hazard of undetected exotherms 

Hazard of prolonged holding of reaction mass 

Inherently safer design of chemical processes 

Control and protection of chemical reactors 

Adherence to operating procedures 

Planning for emergencies 

Difficulties of decontamination 


weaker exotherms existed which, given time, could also 
cause a runaway. 

The complete identification of the characteristics of the 
reaction being operated is particularly important. If these 
are not known, or only partially known, there is always the 
danger that the design will not be as inherently safe as 
intended, that operating modifications will have unforeseen 
results and/or that protective measures will be inadequate. 

Hazard of prolonged holding of reaction mass 
The interruption of the reaction and the holding of the reac¬ 
tion mass for a prolonged period after the main reaction was 
complete without reducing the temperature gave time for the 
weak exotherms to occur and lead to runaway. 

Inherently safer design of chemical processes 
The reactor was intended to be inherently safe to the extent 
that the use of steam at 12 bar set a temperature limit of 
188° C so that the contents could not be heated above this by 
the heating medium. Unfortunately this feature was 
defeated by allowing the reaction charge to stand hot for too 
long so that there occurred the weak exotherms, which the 
company did not know about. 


The bursting disc was not intended for reactor venting, 
but, as the Commission pointed out, if the set pressure of 
the disc had been lower, the reactor would have vented at 
a lower temperature and hence with less dioxin in the 
charge. 


Control and protection of chemical reactors 
The control and protection system on the reactor was pri¬ 
mitive. Operation of the reactor was largely manual. There 
was no automatic control of the cooling and no high tem¬ 
perature trip. 

The reactor was not designed to withstand a runaway 
reaction. It was not rated as a pressure vessel to withstand 
pressure build-up prior to and during venting, the disc was 
not designed for reaction relief and there was no tank to 
take the ultratoxic contents of the reactor. 

Adherence to operating procedures 

The conduct of the final batch involved a series of failures 

to adhere to the operating procedures. 

Planning for emergencies 

As the account given above indicates, the handling of the 
emergency was a disaster in its own right. Information on 
the chemical released and its hazards was not immediately 
available from the company. There was failure of commu¬ 
nication between the company and the local and regulatory 
authorities and within those authorities. Consequently 
there was lack of action and failure to protect and commu¬ 
nicate with the public. These deficiencies might in large 
part have been overcome by emergency planning. 

Difficulties of decontamination 

The incident illustrates the difficulties of decontamina¬ 
tion of land where the contaminant is both ultratoxic and 
insoluble in water. 
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APPENDIX 4/2 MEXICO CITY 


At about 5.35 a.m. on the morning of 19 November 1984, 
a major fire and a series of explosions occurred at 
the PEMEX LPG terminal at San Juan Ixhuatepec (San 
Juanico), Mexico City. Some 500 people were killed and the 
terminal was destroyed. 

The accident was investigated by a team from TNO 
which visited the site about 2 weeks after the disaster and 
has published its findings (Pietersen, 1985). A further 
account has been given by Skandia International (1985). 

Selected references on Mexico City are given in Table A4.1. 


A4.1 The Site and the Plant 

The site of the PEMEX terminal is shown in Figure A4.1 and 
an aerial photograph of the installation itself in Figure A4.2. 


Table A4.1 Selected references on Mexico City 


Anon. (1985v, hh); Berenblut etol. (1985); Cullen (1985); 
Kletz (1985p); Pietersen (1985,1985 LPB 64,1986a,b, 
1988a); Skandia International (1985); Hagon (1986) 


The oldest part of the plant dated from 1961 to 1962 
and was thus over 20 years old. In the intervening period 
residential development had crept up to the site. This 
process of encroachment is clearly visible from the aerial 
photographs shown in Figure A4.3. By 1984, the housing 
was within 200 m of the installation with some houses 
within 130 m. 

The terminal was used for the distribution of LPG, which 
came by pipeline from three different refineries. The main 
LPG storage capacity of 16,000 m 3 consisted of 6 spheres 
and 48 horizontal cylinders. The daily throughput was 
5000 m 3 . The layout of the terminal with storage tank 
capacities is shown in Figure A4.4. The two larger storage 
spheres had individual capacities of 2400 m and the four 
smaller spheres capacities of 1600 m 3 . The site covered an 
area of 13,000 m 2 . 

The plant was said to have been built to API standards 
and much of it to have been manufactured in the United 
States. 

A ground level flare was used to burn off excess gas. The 
flare was submerged in the ground to prevent the flame 
being extinguished by the strong local winds. 



* Pemex LPG facilities Scale 1:20 000 

• • • Borderline Mexico City/State of Mexico (north of the line) 

Figure A4.1 Area plan of the PEMEX site at Mexico City (Pietersen 1985) (Courtesy of TNO) 
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Figure A4.2 PEMEX plant at Mexico City before the accident (Skandia, 1985) (Photograph: State of Mexico) 



(*) (*) (c) 

Figure A4.3 Growth of housing near the PEMEX plant 
at Mexico City (Pietersen 1985): (a) 1962; (b) 1972; 

(c) 1982 (Reproduced by permission of TNO.) 


Adjoining the PEMEX plant there were distribution 
depots owned by other companies. The Unigas site 
was some 100-200 m to the north and contained 67 tank 
trucks at the time of the accident. Rather further away 
was the Gasomatico site with large numbers of domestic 
gas cylinders. 

A4.2 The Fire and Explosion 1 

Early in the morning of 18 November, the plant was being 
filled from a refinery 400 km away. The previous day the 
plant had become almost empty and refilling started dur¬ 
ing the afternoon. The two larger spheres and the 48 
cylindrical vessels had been filled to 90% full and the four 
smaller spheres to about 50% full, so that the inventory on 
site was about 11,000 m 3 , when the incident began. 

About 5.30 a.m. a fall in pressure was registered in the 
control room and also at a pipeline pumping station 40 km 
distant. An 8 in. pipe between sphere F4 and the Series G 
cylinders had ruptured. 

The control room personnel tried to identify the cause of 
the pressure fall but without success. 

The release of LPG continued for some 5—10 min. There 
was a slight wind of 0.4 m/s. The wind and the sloping 
terrain carried the gas towards the south-west. People in 
the nearby housing heard the noise of the escape and 
smelled the gas. 

When the gas cloud had grown to cover an area, which 
eyewitnesses put at 200 x 150 m with a height of 2 m, it 
found the flare and ignited. It was 5.40 a.m. The cloud 
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Figure A4.4 Layout of the PEMEX site at Mexico City (Pietersen 1985) (Courtesy of TNO) 


caught fire over a large area, giving a high flame and 
causing violent ground shock. 

When this general fire had subsided, there remained 
a ground fire, a flame at the rupture and fires in some 
10 houses. 

Workers on the plant now tried to deal with the escape. 
One drove off to another depot to summon help. Five others 
who may have been on their way to the control room or to 
man fire pumps were found dead, and badly burned. At a 
late stage someone evidently pressed the emergency shut¬ 
down button. 

In the neighbouring housing some people rushed out 
into the street, but most stayed indoors. Many thought it 
was an earthquake. 

At 5.45 a.m. the first BLEVE occurred. About a minute 
later another explosion occurred, one of the two most vio¬ 
lent during the whole incident. One or two of the smaller 
spheres BLEVEd, giving a fireball 300 m diameter. 

A rain of LPG droplets fell on the area. Surfaces covered 
in the liquid were set alight by the heat from fireballs. 
People burned like torches. 

There followed a series of explosions as vessels suffered 
BLEVE. There were some 15 explosions over a period of an 
hour and a half. BLEVE occurred of the four smaller 
spheres and many of the cylindrical vessels. 

The explosions during the incident were recorded on a 
seismograph at the University of Mexico. The timing of the 
readings is shown inTable A4.2 Section A. As the footnote 
indicates, it is suggested by Skandia that the initial explo¬ 
sion, or violent deflagration, was probably not recorded. 

The damage caused is shown in Figure A4.5, which 
shows the area of main housing damage and the fall of 


Table A4.2 Timetable of events at Mexico City 


A Seismograph readings 


1 5 h 

2 5 h 

3 6 h 

4 6 h 

5 6 h 


44 min 

46 min 
15 min 
31 min 

47 min 


52s 6 
01s 7 
53s 8 
59s 9 
56 s 


6h 49 min 

6h 54 min 

6h 59 min 

7h 01 min 


38 s 


22 s 
27 s 


Disturbances 2 and 7 were the most intence with a Richter scale 
intensity of 5 Skandia suggest that the first violent combustion may 
not have been recorded. 


B General timetable 

5.30 

Rupture of 8 in. pipe. Fall of pressure 
in control room 

5.40 

Ignition of gas cloud. Violent combustion 
and high flame 

5.45 

First explosion on seismograph, a BLEVE 
Fire department called 

5.46 

Second BLEVE, one of most violent 

6.00 

Police alerted and civilian trafffic stopped 

6.30 

Traffic chaos 

7.01 

Last explosion on seismograph, a BLEVE 

7.30 

Continuing tank explosions 3 

11.00 

Last tank explosion 

8.00-10.00 

Rescue work at its height 

12.00-18.00 

Rescue work continues 

23.00 

Flames extinguished on last large sphere 


a Explosions of cylindrical vessels. 
































Figure A4.5 Area plan of the PEMEX site at Mexico City, showing damage to housing area and fall of missiles (Pietersen 1985) (Courtesy to TNO) 
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Figure A4.6 PEMEX site at Mexico City after the accident (Skandia, 1985) (Photograph: State of Mexico) 


missiles. An aerial photograph of the plant after the dis¬ 
aster is shown in Figure A4.6. 

Numerous missiles were generated by the bursting of the 
vessels. Many of these were large and travelled far. Twenty- 
five large fragments from the four smaller spheres weigh¬ 
ing 10-40 te were found 100—890 m away. Fifteen of the 
48 cylindrical vessels weighing 20 te became missiles and 
rocketed over 100 m, one travelling 1200 m. Four cylinders 
were not found at all. The missiles caused damage both by 
impact and by their temperature, which was high enough to 
set houses alight. 

When the fire began, people were already on their way to 
work. Eyewitnesses spoke of a huge hot, red light, intense 
heat, smoke and lack of air, blast waves and missiles. The 
following account by Nicanor Santiago, a mason, is typical: 

Around 5.30 a.m. I went to work. It was still dark when 
I took my bicycle out of the house, when suddenly there 
was this huge light, red and hot. I could see nothing at all. 
The huge light blinded me. I could not feel anything 
except that everything was hot. Then I heard some 
explosions and a second blast. The walls of my house were 
rocking, it was an earthquake. I was lying on the pave¬ 
ment and close to me all sorts of matter came falling out of 
the sky. There was a lot of broken glass, chairs and flower 
pots were flying all over the place. I suddenly remem¬ 
bered the PEMEX gas plant and I saw a big tongue of 
fire and a very big orange mushroom, and then a felt 
another explosion. Pieces of molten metal were dropping 
out of the sky and I felt intense heat waves burning my 
clothes and my hair. I ran into the bedroom, everything 


was dark inside and there was plenty of smoke. I could not 
see anything. I could not breathe for the gas. I noticed 
something huge fell on top of the house and a rush of air 
threw me out of the house into the street. By then I was 
really frightened and I started to run as fast as I could. I do 
not know where my wife and children got to. They may 
even be unidentified in a mass grave. 

A timetable of events during the disaster is given in 
Table A4.2, Section B. 

A4.3 The Emergency 

Accounts of the emergency give little information about the 
response of the on-site management in the emergency and 
deal mainly with the rescue and firefighting. 

The site became the scene of a major rescue operation 
which reached a climax in the period 8.00-10.00 a.m. Some 
4000 people participated in rescue and medical activities, 
including 985 medics, 1780 paramedics and 1332 volun¬ 
teers. At one point there were some 3000 people in the area. 
There were 363 ambulances and five helicopters involved. 

The rescuers were at risk from a large BLEVE.The Skandia 
report states: ‘If a BLEVE had occurred during the later 
morning, a large number of those 3,000 people who were 
engaged in rescue and guarding would have been killed.’ 

The fire services were called by surrounding plants and 
by individual members of the public about 5.45 a.m. They 
went into the plant area only 3 h after the start of the 
incident. Initially, they moved towards the Gasomatico site, 
where a sphere fragment had landed and started a fire, 
which caused the domestic gas cylinders to explode. 
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The fire brigade also fought the fire on the two larger 
spheres, which had not exploded. They were at appreciable 
risk from BLEVE of the spheres. In the event, however, these 
burnt themselves out. The last flames on the spheres went 
out about 11.00 p.m. Some 200 firemen attended the site. 

A4.4 The Fire and Explosion 2 

The TNO report gives much technical information on the 
course of the disaster and on the fire and explosion phe¬ 
nomena which occurred during it. 

It discusses the effects of explosions, including vapour 
cloud explosions, BLEVEs and physical explosions; the 
effects of fire engulfment and heat radiation; and the 
effects of missiles, including fragments from bullet tanks 
and spheres. 

The report gives estimates of the overpressure from 
BLEVE of the principal vessels. It states that the degree of 
blast damage to housing was not great; that the vapour 
cloud explosion effects were not responsible for major 
damage; that the second explosion, a BLEVE, was the most 
violent and did damage houses; that the worst explosion 
damage was probably from gases which had accumulated 
in houses; and that much of the damage was done by fire. 

Films were available for many of the BLEVEs, though 
not for the second, violent explosion. From this evidence, 
the BLEVEs had diameters of 200—300 m and durations of 
some 20 s. Heavy direct fire damage was done at distances 
up to about 300 m, which agrees reasonably well with the 
estimates of fireball size. 

Avery large fire burned on the site for about an hour and 
a half, punctuated by BLEVEs. Details are given of the 
number, size and range of fragments from spheres and 
bullet tanks. Information on BLEVEs and missiles in the 
TNO report is given in Chapters 16 and 17. 


A4.5 Some Lessons of Mexico City 

Some of the lessons to be learned from Mexico City are lis¬ 
ted in Table A4.3. 

Siting of major hazard installations 
The high death toll at Mexico City occurred because the 
housing was too near to the plant. At the time the plant was 
constructed the area was undeveloped, but over the years 
the built-up area had gradually crept up to the site. 


Table A4.3 Some lessons of Mexico City 


Siting of major hazard installations 

Layout of large LPG storages 

Gas detection and emergency isolation 

Planning for emergencies 

Fire fighting in BLEVE situations 

Boiling liquid expanding vapour explosions 


Layout and protection of large LPG storages 

The total destruction of the facility occurred because there 

was a failure of the overall system of protection, which 

includes layout, emergency isolation and water spray 

systems. 

Gas detection and emergency isolation 
One feature which might have averted the disaster is more 
effective gas detection and emergency isolation. The plant 
had no gas detector system and, probably as a consequence, 
emergency isolation was too late. 

Planning for emergencies 

One particularly unsatisfactory aspect of the emergency 
was the traffic chaos which built up as residents sought to 
flee the area and the emergency services tried to get in. 

Another was risk run by the large number of rescuers 
who came on site from a BLEVE of one of the larger 
spheres. 

Fire fighting in BLEVE hazard situations 
The fire services appear to have taken a considerable a risk 
in trying to fight the fire on the two larger spheres. The 
potential death toll if a BLEVE had occurred was high. 

Boiling liquid expanding vapour explosions 
After Flixborough the problem of vapour cloud explosions 
received much attention. Mexico City demonstrates that 
boiling liquid expanding vapour explosions are an equally 
important hazard. 

Mexico City represents the largest series of major 
BLEVEs which has occurred and provides much informa¬ 
tion on these. 
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APPENDIX 5/2 BHOPAL 


Early in the morning of 3 December 1984, a relief valve 
lifted on a storage tank containing highly toxic methyl 
isocyanate (MIC) at the Union Carbide India Ltd (UCIL) 
works at Bhopal, India. A cloud of MIC gas was released 
onto housing, including shantytowns, adjoining the site. 

Close on 2000 people died within a short period and tens 
of thousands were injured. The casualty figures are dis¬ 
cussed further in Section A5.9. 

The accident at Bhopal is by far the worst disaster which 
has ever occurred in the chemical industry. Its impact has 
been felt worldwide, but particularly in India and the 
United States. 

Following the accident the Government of India (Gol) 
set up an inquiry which reported at the end of 1985 
(Varadarajan, 1985). An investigation was conducted by the 
US parent company the Union Carbide Corporation (UCC), 
which issued its own report (the Union Carbide Report) 
(Union Carbide, 1975). Another investigation was carried 
out by the ICFTU-ICEF (1985). In its initial investigation, 
Union Carbide had limited access to documents and per¬ 
sonnel, and it subsequently caused to be published further 
findings (Kalelkar, 1988). These investigations are described 
in Section A5.8. 

Besides the investigations mentioned, other accounts have 
been given in Bhopal. Anatomy of a Crisis by Shrivastava 
(1987) and by Badhwar and Trehan (1984), Bhushan and 
Subramanian (1985), Bowonder (1985,1987,1988), Bowonder 
andMiyake (1988), Kalelkar (1988), Kletz(1988h), van Mynen 
(1990) and Bowonder, Arvind and Miyake (1991). 

Selected references on Bhopal and MIC are given in 
Table A5.1. 


A5.1 The Company and the Management 

Union Carbide began operations in India in 1904 and by 1983 
had 14 plants operating in the country. Its Indian interests 
were held by UCIL. UCIL was owned 50.9% by the American 
parent company UCC and 49.1% by Indian investors. UCC 
thus retained a majority share, having persuaded the Indian 
government to waive its usual requirement for Indian 
majority shareholding, on the basis of the technological 
sophistication of the plant and the export potential. 


Table A5.1 Selected references on Bhopal and MIC 


Anon. (1984h); Badhwar and Trehan (1984); Anon. 
(1985b—e,k,ff,gg,ii); Anon. (1985 LPB 63, p. 1); Basta 
(1985); Basta etal. (1985); Bhushan and Subramanian 
(1985); Bowonder (1985,1987); Bowonder, Kasperson and 
Kasperson (1985); Chowdhury etal. (1985); IBC (1985/59); 
ICFTU-ICEF (1985); Kharbanda (1985,1988); Kletz 
(1985j,p, 1988h,n, 1990g, 1993b); Lepkowski (1985,1986); 
Lihou (1985); Resen (1985a); Union Carbide Corp. (1985); 
Varadarajan (1985); Webber (1985,1986); Anon. (1986b,1); 
Bellamy (1986); Bisset (1986); Shrivastava (1987); 

M.R Singh and Ghosh (1987); Anon. (1988b,o); Bowonder 
and Miyake (1988); J. Cox (1988a); Emsley (1988); Kalelkar 
(1988a, b); Kharbanda (1988); V.C. Marshall (1988a); 

Sriram and Sahasrabuhde (1988,1989);Tachakra (1988); 
van Mynen (1990); M.R Singh (1990); Bowonder, Arvind 
and Miyake (1991); Narsimhan (1993) 

Methyl isocyanate 

Kimmerle and Eben (1964); ten Berge (1985) 


UCIL began operations at Bhopal in 1969. Initially, the 
plant formulated carbamate pesticides from concentrates 
imported from the United States. In 1975, UCIL was licensed 
to manufacture its own carbaryl with the trade name Sevin. 
The process selected was the same as at the UCC plant at 
W.Virginia, but initially the MIC intermediate was imported 
from the latter source. Production began in 1979. The plant 
had a capacity of 5250 te/y, but the market was less than 
expected. Production peaked at 2704 te in 1981 and fell to 
1657te in 1983. At these levels of sales the plant had problems 
of profitability. 

Prior to the accident, the management structure of UCIL 
changed and the Bhopal pesticides plant was put under the 
direction of the Union Carbide battery division in India. 

A5.2 The Site and the Works 

The location of the UCIL works at Bhopal is shown in 
Figure A5.1. The works was in a heavily populated area. 
Much of the housing development closest to the works had 
occurred since the site began operations in 1969, including 
the growth of the J.P. Nagar shantytown. Although these 
settlements were originally illegal, in 1984 the government 
gave the squatters rights of ownership on the land to 
avoid having to evict them. Other residential areas which 
were affected by the gas cloud had been inhabited for over 
100 years. 

A5.3 The Process and the Plant 

In the process used at Bhopal, MIC was made using the 
reaction scheme shown in Figure A5.2. The process itself is 
shown in Figure A5.3. Monomethylamine (MMA) is reacted 
with excess phosgene in the vapour phase to produce 
methylcarbamoyl chloride (MCC) and hydrogen chloride 
and the reaction products are quenched in chloroform. 
The unreacted phosgene is separated by distillation from 
the quench liquid and recycled to the reactor. The liquid 
from the still is fed to the pyrolysis section where MIC is 
formed. The stream from the pyrolyser condenser passes 
as feed to the MIC refining still (MRS). MIC is obtained as 
the top product from the still. The MIC is then run to storage. 

Phosgene was produced on site by reacting chlorine and 
carbon monoxide. The carbon monoxide was also produced 

The MIC storage system (MSS) consisted of three storage 
tanks, two for normal use (Tanks 610 and 611) and one 
for emergency use (Tank 619). The tanks were 8 ft dia¬ 
meter x 40 ft long with a nominal capacity of 15,000 USgal. 
They were made of 304 stainless steel with a design pres¬ 
sure of 40 psig at 121°C and with hydrostatic test pressure 
of 60 psig. A diagram of the storage tank system is shown 
in Figure A5.4. 

A 30 ton refrigeration system was provided to keep the 
tank contents at 0°C by circulating the liquid through an 
external heat exchanger. 

There was on each storage tank a pressure controller 
which controlled the pressure in the tank by manipulating 
two diaphragm motor valves (DMVs), a make-up valve to 
admit nitrogen and a blowdown valve to vent vapour. Each 
tank had a safety relief valve (SRV) protected by a bursting 
disc. It also had a high temperature alarm and low and high 
level alarms. 

A vent gas scrubber (VGS) and a flare were provided to 
handle vented gases. The VGS was a packed column 5 ft 6 in. 
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Figure A5.1 Simplified plan of the area near the Union Carbide India Ltd works at Bhopal (M.P. Singh and Ghosh, 1987). 
The diagram also shows the estimated dimensions of the gas cloud (Courtesy of Elsevier Science Publishers) 


diameter in which the vent gases were scrubbed with caustic 
soda. There were two vent headers going into the column: 
the process vent header (PVH), which collected the MIC 
systemvents, and thereliefvalveventheader(RVVH), which 


collected the safety valve discharges. Each vent header 
was connected both to the VGS and the flare and could be 
routed to either.The vent stack after theVGS was 100 ft (33 m) 
high. A diagram of theVGS is shown in Figure A5.5. 
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(1) COCI 2 
Phosgene 


CH 3 NH 2 -— CHjNHCOCI 

Monomethylamine Methylcarbamoyl 

(MMA) chloride 

(MCC) 


HCI + Heat 

Hydrogen 

chloride 


(2) CH,NHCOCI 
(MCC) 


Heat 


CH,NCo 

Methyl isocyanate + HCI 
(MIC) 


Figure A5.2 Reaction scheme (Union Carbide, 1985. Reproduced by permission.) 


Tails 



vents 

Figure A5.3 Process for production of MIC (Union Carbide, 1985. Reproduced by permission.) 


The VGS had the function of handling process vents from 
the PVH and of receiving contaminated MIC, in either vapour 
or liquid form, and destroying it in a controlled manner. 

The function of the flare was to handle vent gases from 
the carhon monoxide unit and the MMA vaporizer safety 
valve and also vent gas from the MIC storage tanks, the 
MRS and the VGS. 

In the two years preceding, the number of personnel on 
site were reduced, 300 temporary workers being laid off 
and 150 permanent workers pooled and assigned as needed 
to jobs, some of which they said when interviewed they felt 
unqualified to do. The production team on the MIC facility 
was cut from 12 to 6. 

A5.4 MIC and Its Properties 

MIC is a colourless liquid with a normal boiling point of 
39°C. It has a low solubility in water. It is relatively stable 
when dry, but is highly reactive and in particular can 
polymerize and will react with water. It is flammable and 
has a flashpoint of —18°C and a lower flammability limit of 
6% v/v. It is biologically active and highly toxic. 

The high toxicity of MIC is indicated by the fact that its 
TLV at the time was 0.02 ppm. This is very low relative to 
most typical compounds handled in industry. 


MIC is an irritant gas and can cause lung oedema, but it 
also breaks down in the body to form cyanide. The cyanide 
suppresses the cytochrome oxidase necessary for oxy¬ 
genation of the cells and causes cellular asphyxiation. 

Information on the inhalation toxicity of MIC is given by 
Kimmerle and Eben (1964) and ten Berge (1985). 

MIC can undergo exothermic polymerization to the tri- 
mer, the reaction being catalysed by hydrochloric acid and 
inhibited by phosgene. It also reacts with water, iron being 
a catalyst for this reaction. This reaction is strongly exo¬ 
thermic. 

A5.5 Events Prior to the Release 

In 1982, a UCC safety team visited the Bhopal plant. Their 
report gave a generally favourable summary of the visit, 
but listed ten safety concerns, including 

3. Potentials for release of toxic materials in the phosgene/ 
MIC unit areas and storage areas, either due to equipment 
failure, operating problems, or maintenance problems. 

4. Lack of fixed water spray protection in several areas 
of the plant. 

7. Deficiencies in safety valve and instrument main¬ 
tenance program. 
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Figure A5.4 Flow diagram of Tank 610 system (Bhushan and Subramanian, 1985) (Courtesy of Business India.) 


8. Deficiencies in Master Tag/Lockout procedure 
application. 

10. Problems created by high personnel turnover at the 
plant, particularly in operations. 


Following this visit valves on the MIC plant were 
replaced, but degraded again. At the time of the accident, 
the instruments on Tank 610 had been malfunctioning for 
over a year. 

Between 1981 and 1984, there were several serious 
accidents on the plant. In December 1981, three workers 
were gassed by phosgene and one died. Two weeks later 
24 workers were overcome by another phosgene leak. In 
February 1982, 18 people were affected by an MIC leak. 
In October 1982, three workers were injured and nearby 
residents affected by a leak of hydrochloric acid and 
chloroform. 

Following this latter accident workers from the plant 
posted a notice in Hindi which read: ‘Beware of fatal 
accidents... lives of thousands of workers and citizens in 
danger because of poison gas... Spurt of accidents in the 
factory, safety measures deficient’. These posters were also 
distributed in the community. 

About a year before the accident, a ‘jumper line’ was 
connected between the PVH and the RVVH. Figure A5.4 
shows the MIC storage tank and pipework arrangements. 
The jumper line is between Valves 1 and 2. The object of the 
modification was to allow gas to be routed to the VGS if 
repairs had to be done on one of the vent headers. 


In June 1984 the 30 ton refrigeration unit cooling the MIC 
storage tanks was shut down. The charge of Freon refrig¬ 
erant was drained from the system. 

In October the VGS was turned off, apparently because it 
was thought unnecessary when MIC was only being stored 
not manufactured. In the same month, the flare tower was 
taken out of service, a section of corroded pipe leading to it 
being removed so that it could be replaced. 

Another feature was that difficulty was being experi¬ 
enced in pressurizing MIC storage Tank 610. It appeared 
that since nitrogen was passing through the make-up valve 
satisfactorily, the blowdown valve was leaking and pre¬ 
venting pressurization. 

According to plant workers there were other instru¬ 
mentation faults. The high temperature alarm had long 
been faulty. There were also faults on the pressure con¬ 
troller and the level indicator. 

The plant had a toxic gas alarm system. This consisted of 
a loud siren to warn the public and a muted siren to warn the 
plant. These two sirens were linked and could be activated 
from a plant toxic alarm box. The loud siren could be stop¬ 
ped from the control room by delinking the two. A proce¬ 
dure had been introduced according to which after 
delinking, the loud siren could be turned on only by the 
plant superintendent. 

Plant workers stated that on the morning of 2 December 
washing operations were undertaken. Orders were given to 
flush out the downstream sections of four filter pressure 
safety valves lines. These lines are shown in Figure A5.4. In 
order to carry out this operation Valve 16 on the diagram 
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Figure A5.5 Flow diagram of the vent gas scrubber system (Bhushan and Subramanian, 1985) 
(Courtesy of Business India) 


was shut, Valves 18-21 and 22-25 opened and then Valve 17 
opened to admit water. 

It was suggested water might have entered MIC storage 
Tank 610 as a result of this operation — the water washing 
theory. On this hypothesis, water evidently leaked through 
Valve 16, into the RVVH and passed through the jumper 
line into the PVH and thence into Tank 610. This would 
require that Valves 3 and 12 were open to connect the tank 
to the PVH and Valves 1 and 2 open to connect the RVVH 
to the PVH via the jumper line. 


A5.6 The Release 

On the evening of 2 December, a shift change took place on 
the plant at 22.45. At 23.00, the control room operator 
noticed that the pressure in Tank 610 was 10 psig. This was 
higher than normal but within the 2-25 psig operating 
pressure of the tank. At the same time the field operator 
reported a leak of MIC near the VGS. At 00.15, the field 
operator reported an MIC release in the process area and the 
control room operator saw that the pressure onTank 610 was 
now 30 psig and rising rapidly. He called the supervisor and 
ran outside to the tank. He heard rumbling sounds coming 
from the tank and a screeching noise from the safety valve 
and felt heat from the tank. He returned to the control room 
and turned the switch to activate the VGS, but this was not 
in operational mode, the circulating pump not being on. 

At 00.20, the production supervisor informed the plant 
superintendent of the release. At 00.45 operations in the 
derivative unit were suspended due to the high concentra¬ 
tion of MIC. 


At 01.00, an operator in this unit turned on the toxic gas 
alarm siren. After 5 min the loud siren was switched off 
leaving the muted siren on. 

At about the same time the plant superintendent and 
control room operator verified that MIC was being emitted 
from the VGS stack to atmosphere and turned on and 
directed at the stack fixed fire water monitors to knock 
down the vapour. 

Water was also directed at the MIC tank mound and at 
the vent header to the VGS. Steam issued from the cracks in 
the concrete showing that the tank was hot. 

One plant supervisor tried to climb the structure to 
plug the gas leak but was overcome, falling and breaking 
both legs. 

Some time between 01.30 and 02.30, the safety valve on 
Tank 610 reseated and the release of MIC ceased. 

At about 02.30, the loud siren was switched on again. 

The cloud of MIC gas spread from the plant towards the 
populated areas to the south. There was a light wind and 
inversion conditions. 

People in the housing around the plant felt the irritant 
effect of the gas. Many ran out of their houses, some 
towards the plant. Within a short period, animals and peo¬ 
ple began to die. 

At Railway Colony some 2 km from the plant, where 
nearly10,000 people lived, it was reported that within 4 min 
150 died, 200 were paralysed and 600 rendered uncon¬ 
scious and that 5000 were severely affected. 

People tried to telephone the plant but were unable to get 
through. At 01.45, a magistrate contacted the plant super¬ 
intendent. 
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The cloud of toxic gas hung around the area for the whole 
of 3 December. During the day, it stopped moving towards 
the city, but resumed its movement in that direction during 
the night. 

A5.7 The Emergency and the Immediate Aftermath 

Large numbers of people were affected by the toxic gas and 
very large numbers fled their homes. 

The two hospitals principally concerned, the Hamidia 
and the Javaprakas Hospitals, were overwhelmed with 
casualties. 

The difficulties were compounded by the fact that it was 
not known what the gas was or what its effects were. Specu¬ 
lation about the gas, including suggestions that it was 
phosgene, continued in the world press for some days. 

The company provided little advice. Initially, it stated 
that MIC causes eye irritation but is not lethal. 

As early as noon on 3 December, doctors at the Gandhi 
Memorial College carried out post-mortems which gave 
strong evidence of cyanide poisoning. Victims had died of 
respiratory arrest, but there was no evidence of the cya¬ 
nosis due to the deoxygenation of the blood which normally 
accompanies pulmonary asphyxiation and there were 
cases where there was no evidence of pulmonary oedema. 

There developed a conflict of views on the appropriate 
treatment. The standard treatment for cyanide poisoning is 
sodium thiosulfate. One group took the view that this 
should not be given until cyanide poisoning was estab¬ 
lished by analyses, another argued that it was well known 
that in cyanide poisoning the cyanide may be metabolized, 
leaving little trace. There followed a period in which the 
advice given was not clear. It was not until 3 February that 
an authoritative and unambiguous recommendation that 
sodium thiosulfate be used was issued by the Indian 
Council for Medical Research. 

The Indian Central Bureau of Investigation (CBI) took 
control of the site and began a criminal investigation. 

A5.8 The Investigations 

A5.8.1 Government of India investigation 

An investigation of the incident was undertaken by the 
Gol. It issued in December 1985, the Report on Scientific 
Studies on the Factors Related to Bhopal Toxic Gas Leakage 
by a team chaired by Varadarajan (1985). 

The report refers to the fact that it was reported that 
about 21.30 on 2 December an operator was clearing a 
possible choke in the RVVH lines downstream of the phos¬ 
gene stripping still filters by water flushing, without 
inserting a blind. The 6 in. isolation valve on the RVVH 
would presumably he closed but if it had not been leak- 
tight, water could enter the RVVH. This water could have 
found its way into the Tank 610 via the blowdown DMVor 
through the SRV and bursting disc. 

A5.8.2 Union Carbide investigation - 1 

A team from UCC arrived in Bhopal on 6 December charged 
with the tasks of assisting in the safe disposal of the 
remaining MIC and investigating the accident. The first 
task was completed on 22 December and the team returned 
home on 2 January. 

The investigation was severely constrained by the CBI 
control of the site and by the criminal investigation. The 
team were allowed only limited access to plant records and 


personnel. They were permitted to talk to certain persons, 
but not to interview staff directly involved in the incident. 
They were allowed to take samples fromTank 610, but not to 
open and inspect the tank and its piping or to take samples 
from elsewhere on the plant. An account of the situation is 
given by Kalelkar (1988b). 

On their return home, the investigators carried out a 
programme of some 500 experiments to establish what had 
occurred. The most abundant component in the residues 
was MIC trimer, others present in significant quantities 
being the components conveniently referred to as DMI, 
DMU, TMU, TMB and TRMB. There were also iron, chro¬ 
mium and nickel in approximately their proportions in 304 
stainless steel and some 5% chloride. 

Trimerization had obviously occurred, but it was unclear 
what other reactions had taken place. The investigators 
carried out experiments in which the principal materials 
believed to have been in the tank, namely MIC, chloroform, 
water and iron, were heated at 200°C and developed a 
reaction scheme which accounted for the production, 
starting from these materials, of the components found in 
the residue with the exception of TRMB, which they con¬ 
sidered they could account for. 

From plant records, Tank 610 contained prior to the inci¬ 
dent 41 te (90,400 lb; 11,290 USgal) of liquid. The team esti¬ 
mated that Tank 610 had originally contained 1000—2000 lb 
(120-240 USgal) water and 1500-3000 lb chloroform. The 
source of the water was uncertain. The chloroform could be 
accounted for by the fact that the MRS had been operated at 
a temperature higher than normal and in preparation for 
shutdown MIC with a high chloroform content has been 
sent to Tank 610 rather than Tank 619. The iron could have 
come from corrosion, given high chloroform and water con¬ 
tents and high temperature. 

The scenario which the investigators invoked to explain 
the events is as follows. The contents of Tank 610 were initi¬ 
ally at 15—20°C. Some 1000-2000 lb water entered the tank 
in a manner unknown. The exothermic reaction between 
MIC and water led to an increase in temperature and also 
in pressure due to evolution of carbon dioxide. The higher 
temperature and presence of chloroform caused accelerated 
corrosion.The iron thus produced catalysed the exothermic 
trimerization of MIC. 

Calculations showed that reaction of some 40% of the 
MIC would generate enough heat to vaporize the rest. This 
would give some 36,000 lb of solids in the tank, but only an 
estimated 10,000 lb were found. There may have been 
appreciable loss of solids and liquid through the relief vent. 

The period during which the relief valve was open was 
reported to have been about 2 h. It was calculated that in 
order to vent most of the tank contents in this time the dis¬ 
charge rate would have had to be 40,000 lb/h, of which 
29,000 lb/h were vapour and 11,000 lh/h solids/liquid 
mixture and that this would have required a pressure aver¬ 
aging 180 psig. The temperature reached was estimated as 
in excess of 200°C. These conditions would have been 
attained during the course of the venting. With the safety 
valve lifting at 40 psig the initial discharge would have 
been 10,000 lb/h. 

The report puts forward the hypothesis that the water 
was directly introduced into Tank 610, either inadvertently 
or deliberately through the process vent line, nitrogen line 
or other piping. It refers to the washing operation on the 
filter pressure safety valve lines and states that this section 
of line had not been isolated using a blind, hut that passage 
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of water to Tank 610 through several reportedly closed 
valves is unlikely. 

The report draws attention to a number of factors which 
contributed to the accident. These include the facts that 
refrigeration had been discontinued, that a blind was not 
used to isolate the lines being washed out, that the MRS 
was operated at a higher than normal temperature, that the 
VSG did not work and that the flare was out of commission. 

At the press conference held to present the report, the 
UCC spokesman suggested that the water may have come 
from a nearby utility station which supplied water and 
nitrogen to the area: ‘If someone had connected tubing to 
the water line instead of the nitrogen line, either deliber¬ 
ately or intending to introduce nitrogen into the tank, this 
could account for the presence of the water...’. The press 
interpreted this as a suggestion by UCC that the cause of 
the accident was sabotage. Subsequently UCC agreed that 
there was no direct evidence for this hypothesis. 

A5.8.3 Union Carbide investigation - 2 

Following the involvement of the Indian Government in 
litigation in the US courts, UCC was allowed access to per¬ 
sonnel who had been involved on the plant and was able to 
gather evidence in support of its original hypothesis. An 
account of this extension of the UCC investigation is given 
by Kalelkar (1988b). 

Against the water washing hypothesis he makes the 
following points. First, the water was introduced through 
a 14 in. inlet (Valve 17). The difference in head between this 
point and the inlet to Tank 610 was some 10.4 ft. There were 
three open bleeder valves close to the inlet point which 
would limit the backpressure of water to 0.7 ft. Second, 
there were a number of valves between the inlet point and 
the tank and for water to pass these would have had to be 
open or not leak-tight. One of these valves, close to the inlet 
point, had been shut since 29 November 1984. It was given 
a one-hour test during which no water leaked through it. 
Third, for water to reach Tank 610 it would have had to fill 
the 6 in. diameter connecting pipe, 65 ft of 8 in. RVVH, with 
numerous branches running off, and then some 340 ft of 
4 in. RVVH. The amount of water to do this was estimated 
as 4500 lb. On 8 February 1985, the CBI ordered a hole to be 
drilled in the lowest point of the PVH. For the hypothesis 
to hold this section, which had no bleeders or flanged 
joints, should have been full of water; it was completely dry. 

In support of the hypothesis of direct entry of water into 
Tank 610 the arguments presented by Kalelkar may be 
summarized as follows. First, an instrument supervisor, 
not on duty that night, stated that he had found the local 
pressure indicator on the tank missing; this was one of the 
few points to which a water hose could be connected. Sec¬ 
ond, a water hose was found nearby. Third, there was evi¬ 
dence that the operators had become aware earlier in the 
evening that water had entered Tank 610 and had taken 
steps to deal with the situation. Fourth, the plant logs 
showed evidence of extensive tampering and alteration. 

The plant could be supplied with MIC from Tank 610 or 
Tank 611, the MIC being passed to a one ton tank, the Sevin 
charge pot. There were difficulties with the pressure in 
Tank 610 and the transfers had been made from Tank 611. 
However, investigation showed that the MIC in the Sevin 
charge pot contained water. It had evidently come from 
Tank 610. Water is heavier than MIC and Tank 610 had a 
bottom offtake. The hypothesis is that the operators, aware 
that water had got into Tank 610 and wishing to remove it, 


on this occasion drew the MIC from that tank rather than 
from Tank 611. 

Kalelkar suggests that the addition of water to Tank 610 
may have been the act of a disgruntled employee. 

A5.9 The Late Aftermath 

The precise numbers of the dead and injured at Bhopal are 
uncertain. The scale of the accident was such that it led to 
much confusion. People have continued to die of the effects 
over a period of years. The official Indian Government esti¬ 
mate of the death toll about 2 years after the event was 1754. 
By 1989, this had risen to 3150 and by 1994 to 4000. Other 
figures given are 30,000 permanently or totally disabled; 
20,000 temporary cases; and 50,000 with minor injury. 

The ICFTU-ICEF report in 1985 states that the number 
of people treated in the state hospitals had been given by 
Dr Nagu, the Director of Health Services for Madhya Pradesh, 
as approximately 170,000. Some 130,000 were treated in 
Bhopal hospitals, mainly for lung and eye injuries, and some 
40,000 in 22 other districts. Some 12,000 of the 170,000 were 
in a critical condition and 484 died. He estimated the total 
number of dead as 2000. 

The disaster led to various sets of court proceedings. The 
Gol instituted criminal proceedings against UCC, which at 
the time of writing remain extant. The Gol also became a 
party to proceedings in the US courts. In 1987, UCC made a 
‘final settlement’ with the Gol of $470 million. Victims tried 
to challenge this in the US courts, but the US Supreme 
Court ruled that they lacked legal standing to do so. 

A5.10 Some Lessons of Bhopal 

A5.10.1 Some lessons 

The lessons to be learnt from Bhopal are numerous. A list of 
some of them is given in Table A5.2. They combine many of 
the lessons of Flixborough and Seveso. 

Some of these lessons are now considered: 

Public control of major hazard installations 
The disaster at Bhopal received intense publicity for an 
extended period and put major hazards on the public 
agenda worldwide, but particularly in India and the United 
States, which had not reacted so strongly to Flixborough 
and Seveso, whose impact had been felt most in Europe. 

Table A5.2 Some lessons of Bhopal 


Public control of major hazard installations 
Siting of and development control at major hazard 
installations 

Management of major hazard installations 
Highly toxic substances 
Runaway reactions in storage 
Water hazard in plants 

Relative hazards of materials in process and in storage 

Relative priority of safety and production 

Limitation of inventory in the plant 

Set pressure of relief valves 

Disabling of protective systems 

Maintenance of plant equipment and instrumentation 

Isolation procedures for maintenance 

Control of plant and process modifications 

Information for authorities and public 

Planning for emergencies 
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Siting of and development control at major 
hazard installations 

Very large numbers of people were at risk from the plant at 
Bhopal. This situation was due in large part to the encro¬ 
achment of the shantytowns, which came up to the site 
boundary. Although these settlements were illegal, the 
Indian authorities had acquiesced in them. 

In this instance, however, this was not the whole story. The 
accident showed that site was close enough to areas populated 
before the plant was built to present a hazard when used for 
the production of a chemical as toxic as MIC. If the manu¬ 
facture of such a chemical was envisaged from the start, the 
problem may be regarded as one of siting. If not, it may be 
viewed as one of intensification of the hazard on the site. 

Management of major hazard installations 
The plant at Bhopal was by any standards a major hazard 
and needed to be operated by a suitable competent man¬ 
agement. The standards of operation and maintenance do 
not give confidence that this was so. 

There had been recent changes in the responsibility for 
the plant which suggest that the new management may not 
have been familiar with the exigencies of major hazards 
operation. However, many of the problems on the plant 
appear to have antedated these changes. 

Highly toxic substances 

MIC is a highly toxic substance, much more toxic than 
substances such as chlorine which are routinely handled in 
the chemical industry. The hazard from such highly toxic 
substances has perhaps been insufficiently appreciated. 

This hazard will only he realized if there is a mechanism 
for dispersion. At Bhopal, this mechanism was the occur¬ 
rence of exothermic reactions in the storage tank. 

Runaway reaction in storage 

The hazard of a runaway reaction in a chemical reactor is 
well understood, but that of such a reaction in a storage 
tank had received little very attention. At Bhopal, this 
occurred due to ingress of water. Where such a reaction 
could act as the mechanism of dispersion for a large 
inventory of a hazardous substance, the possibility of its 
occurrence should be carefully reviewed. 

Water hazard in plants 

In general terms, the hazard of water ingress into plants is 
well known. In particular, water may contact hot oil and 
vaporize with explosive force or may cause a frothover, it 
may corrode the equipment and it may cause a blockage by 
freezing. Bhopal illustrates the hazard of an exothermic 
reaction between a process fluid and water. 

Relative hazard of materials in process and in storage 
There has been a tendency to argue that the risks from 
materials in storage are less than from materials in process, 
since, although usually the inventories in storage are lar¬ 
ger, the probability of a release is much less. The release at 
Bhopal was from a storage tank, albeit from one associated 
with a process. 

The relative hazard of materials in process and in storage 
is discussed Chapter 22. 

Relative priority of safety and production 
The features which led to the accident have been described 
above. As indicated, the Union Carbide Report itself refers 
to a number of these. 


The ICFTU-ICEF report states that at the time of the 
accident the plant was losing money and lists a number 
measures which had been taken, apparently to cut costs. 
These include the manning cuts and the cessation of 
refrigeration. 

Limitation of inventory in the plant 

The hazard at Bhopal was the large inventory of highly 

toxic MIC. The process was the same as that used at UCC’s 

W. Virginia plant. UCIL had stated that it regarded this 

inventory as undesirable, but was overruled by the parent 

company, which wished to operate the same process at both 

plants. 

Processes are available for the manufacture of MIC which 
require only small inventories of the material. Moreover, 
carbaryl canbe made by a route which does not involve MIC. 
The alternatives to the use of MIC are discussed by Kletz 
(1988h). 

Set pressure of relief devices 

It is desirable from the operational viewpoint for the set 
pressure of a relief valve to be such that the valve opens 
when the pressure rise threatens the integrity of the vessel 
but not when normal minor operating pressure deviations 
occur. Where the cause of potential pressure rise is a run¬ 
away reaction, however, there is a penalty in setting a high 
set pressure in that this may allow the reaction to reach a 
higher temperature and to proceed more rapidly before 
venting starts, so that there is a need to balance these two 
factors. 

Disabling of protective systems 

It was evidently not appreciated that the flare system was a 
critical component for the protection of the plant, since it 
was allowed to remain out of commission for the 3 months 
prior to the accident. It is essential that there he strict pro¬ 
cedures for the disabling of any item which is critical for 
protection and that the time for which the item is out of 
action be kept to a minimum. 

Maintenance of plant equipment and instrumentation 
The 1982 UCC safety team drew attention to the problems in 
the maintenance of the plant. The Union Carbide Report 
gives several examples of poor maintenance of plant equip¬ 
ment and instrumentation and the ICFTU-ICEF report 
gives further details. Workers stated that leaking valves 
and malfunctioning instruments were common throughout 
the plant. 

Maintenance was also very slow. The flare system, which 
was a critical protective system, had been out of commis¬ 
sion for three months before the accident. 

Isolation procedures for maintenance 
A particular deficiency in the maintenance procedures was 
the failure to isolate properly the section of plant being 
flushed out by positive isolation using a slip plate or 
equivalent means. The fact that the water may not have 
entered in this way does not detract from this lesson. 

Control of plant and process modifications 
A principal hypothesis to explain the entry of water into 
Tank 610 is that the water passed through the jumper line. 
The installation of this jumper line was a plant modifica¬ 
tion. Company procedures called for plant modifications 
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Event Recommendations for prevention/mitigation 

1st layer: Immediate technical recommendations 
2nd layer: Avoiding the hazard 

3rd layer: Improving the management system 


Public concern 
compelled other 
companies to improve 

standards Provide information that will help public keep 

|-risks in perspective. 

Emergency not handled 
well 

. j -Provide and practise emergency plans. 

About 2000 people killed 

|-Control building near major hazards. 

Scrubber not in full 
working order 
Flare stack out of use 
Both may have been 
too small 

-Keep protective equipment in working order. Size 

for foreseeable conditions. 

Discharge from relief 
valve 

I 

Refrigeration system 
out of use 

_Keep protective equipment in use even though 

plant is shut down. 

Runaway reaction 

I 

Rise in temperature 

|-Train operators not to ignore unusual readings. 

Water entered MIC tank 


Carry out hazops on new designs. 
Do not allow water near MIC. 


Decision to store 
over 100 tonnes MIC 

|- Minimize stocks of hazardous materials. 

Decision to use MIC 
route 

|- Avoid use of hazardous materials. 

Joint venture established 

- Agree who is responsible for safety. 

To achieve the above: 

1 Train chemical engineers in loss prevention 


Figure A5.6 An accident model for Bhopal, showing critical events and recommendations (Kletz, 1988h) (Courtesy 
of Butterworths) 
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to be checked by the main office engineers, but were evi¬ 
dently disregarded. 

There was also a process modification which more 
certainly contributed to the accident. This is the decom¬ 
missioning of the refrigeration system, so that the tempera¬ 
ture in Tank 610 was higher than the 0°C for which the 
system was designed. 

Information for authorities and public 
UCIL had not provided full information on the substances 
on site to the authorities, emergency services, workers 
or members of the public exposed to the hazards. Many 
workers interviewed said they had had no information or 
training about the chemicals. 

Planning for emergencies 

The response of the company and the authorities to the 
emergency suggests that there was no effective emer¬ 
gency plan. 


Within the works, defects revealed by the emergency 
include the hesitation about the use of the siren system and 
the lack of escape routes. 

The preliminary condition for emergency planning to 
protect the public outside the works is provision to the 
authorities of full information about the hazards. This was 
not done. In consequence the people exposed did not know 
what the siren meant or what action to take, the hospitals 
did not know what they might be called on to handle, 
and so on. 

Likewise, the essential action in an actual emergency is 
to inform the authorities what has happened and what the 
hazards are. On the morning of the accident, the hospitals 
were in the dark about the nature and effects of the toxic 
chemical whose victims they were trying to treat. 

A5.10.2 An accident model 

An accident model for Bhopal given by Kletz (1988h) is 
shown in Figure A5.6. 
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APPENDIX 6/2 PASADENA 


Shortly after 1.00 p.m. on 23 October 1989, a release 
occurred on a polyethylene plant at the Phillips 66 
Company’s chemical complex at Pasadena, near Houston, 
Texas. Avapour cloud formed and ignited, giving rise to a 
massive vapour cloud explosion. There followed a series of 
further explosions and a fire. Twenty-two people on the site 
were killed and one later died from injuries, making a death 
toll of 23. The number injured are variously given as 130 
and 300. 

A report on the investigation of the accident has been 
issued by OSHA (1990a). Other accounts include those of 
Mahoney (1990),T. Richardson (1991) and J.N. Scott (1992). 

Selected references on Pasadena are given in Table A6.1. 

A6.1 The Site and the Plant 

The Phillips works was sited in the Houston Chemical 
Complex along the Ship Channel, the location of a number 
of process companies. 

The plant on which the release occurred was Plant Vj one 
of the two active polyethylene plants in the complex. The 
plant operated at high pressure (700 psi) and high tempera¬ 
ture. The process involved the polymerization of ethylene 
in isobutane, the catalyst carrier. Particles of polyethylene 
settled out and were removed from settling legs. 

A6.2 Events Prior to the Explosion 

On the previous day work began to clear three of the six 
settling legs on Reactor No. 6, which were plugged. The 
three legs were prepared by a company operator and were 
handed over to the specialist maintenance contractors, Fish 
Engineering. The configuration of a typical leg is shown in 
Figure A6.1. 

At 8.00 a.m. on Monday, 23 October, work began on the 
second of the three blocked legs, Leg No. 4. The isolation 
procedure was to close the DEMCO hall valve and dis¬ 
connect the air lines to it. 

The maintenance team partially disassembled the leg 
and were able to remove part of the plug, but part remained 
lodged in the pipe 12-18 in. below the ball valve. One of the 
team was sent to the control room to seek assistance. 
Shortly after, at 1.00 p.m., the release occurred. 

Although both industry practice and Phillips corporate 
safety procedures require isolation by means of a double 
block system or a blind flange, at local plant level a pro¬ 
cedure had been adopted which did not conform to this. 

It was subsequently established that the DEMCO ball 
valve was open at the time of the release. The air hoses to the 
valve had been cross-connected so that the supply which 
should have closed it actually opened it. The hose connectors 
for the ‘open’ and ‘close’ sides of the valve were identical, thus 
allowing this cross-connection to be made. Although pro¬ 
cedures laid down that the air hoses should not be connected 
during maintenance, there was no physical barrier to the 
making of such a connection. The ball valve had a lockout 
system but it was inadequate to prevent the valve being 
inadvertently or intentionally opened during maintenance. 


Table A6.1 Selected references on Pasadena 


Anon. (1989 LPB 90, p. 0); Anon. (1990 LPB 94, p. 30); 
Mahoney (1990); OSHA (1990a); Redmond (1990); Vervalin 
(1990b); Bond (1991 LPB 97); Kletz (1991J);T. Richardson 
(1991); J.N. Scott (1992) 


A6.3 The Explosion 

The mass of gas released was estimated as some 85,200 lb 
of a mixture of ethylene, isobutane, hexene and hydrogen, 
which escaped within seconds. The release was observed 
by five eyewitnesses. A massive vapour cloud formed and 
moved rapidly downwind. 

Within 90-120 s the vapour cloud found a source of 
ignition. Possible ignition sources were a gas-fired catalyst 
activator with an open flame; welding and cutting opera¬ 
tions; an operating forklift truck; electrical gear in the 
control building and the finishing building; 11 vehicles 
parked near the polyethylene plant office; and a small die¬ 
sel crane, although this was not operating. 

TheTNTequivalent of the explosion was estimated in the 
OSHA report as 2.4 tons. An alternative estimate from 
seismograph records is 10 tons. 

There followed two other major explosions, one when 
two 20,000 USgal isobutane storage tanks exploded and 
the other when another polyethylene plant reactor failed 
catastrophically, the timings being some 10-15 min and 
some 25-45 min, respectively, after the initial explosion. 
One witness reported hearing 10 separate explosions over a 
2-h period. 

Debris from the explosion was found 6 miles from the site. 

All 22 of those who died at the scene were within 250 ft 
of the point of release and 15 of them were within 150 ft. 

Injuries which occurred outside the site were mainly due 
to debris from the explosion. 

The explosion resulted in the destruction of two HOPE 
plants. 


A6.4 The Emergency and the Aftermath 

People in the immediate area of the release began running 
away as soon as they realized that gas was escaping. The 
alarm siren was activated, but the level of noise in the 
finishing building was such that there was a question 
whether some employees there failed to hear it. 

The immediate response to the emergency was provided 
by the site fire brigade, which undertook rescue and care of 
the injured and began fighting the fire. Twenty-three per¬ 
sons were unaccounted for, but for an extended period the 
area of the explosion remained dangerous to enter. 

Severe difficulties were experienced in fighting the fires 
resulting from the explosion. There was no dedicated fire 
water system, water for firefighting being drawn from the 
process water system. The latter suffered severe rupture in 
the explosion so that water pressure was too low for fire¬ 
fighting purposes. Fire hydrants were sheared off by the 
blast. Fire water had to be brought by hose from remote 
sources such as settling ponds, a cooling tower, a water 
treatment plant and a water main on a neighbouring plant. 
These difficulties were compounded by failures of the fire 
pumps. The electrical cables supplying power to the regu¬ 
lar fire pumps were damaged by the fire so that these 
pumps were put out of action. Further, of the three backup 
diesel fire pumps one was down for maintenance and one 
quickly ran out of fuel. Despite these problems the fire was 
brought under control within some 10 h. 

The handling of the emergency was handicapped by the 
facts that the intended command centre had been damaged 
and that telephone communications were disrupted. Tele¬ 
phone lines were jammed for some hours following the 
accident. 





PASADENA APPENDIX 6/3 



Figure A6.1 Typical piping settling leg arrangement on reactor (Occupational Safety and Health 
Administration, 1990a) 


The emergency response was co-ordinated by the site 
chief fire officer and involved the local Channel Industries 
Mutual Aid (CIMA) organization, a co-operative of some 
106 members in the Houston area. 

More than 100 people were evacuated from the adminis¬ 
tration building across the Houston Ship Channel by the US 
Coast Guard and by Houston fireboats; they would otherwise 
have had to cross the area of the explosion to reach safety. 

The media were quickly aware of the explosion and 
within an hour there were on site 150 media personnel from 
40 different organizations. 


The financial loss in this accident is comparable with, 
and may exceed, that of the Piper Alpha disaster. Redmond 
(1990) has quoted a figure of $1400 million, divided almost 
equally between property damage and business interrup¬ 
tion losses. 

On the basis of a review of company reports and of the 
defects found during the investigation of the disaster, 
OSHA issued a citation to the company for wilful violations 
of the ‘general duty’ clause. The citation covered the lack 
of hazard analysis; plant layout and separation distances; 
flammable gas detection; ignition sources; building 
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ventilation intakes; and the fire water system; the permit 
system; isolation for maintenance. 

A6.5 Some Lessons of Pasadena 

Some of the lessons to be learned from Pasadena are listed 
in Table A6.2. 

Management of major hazard installations 
The OSHA report details numerous defects in the manage¬ 
ment of the installation. Some of these are described below. 

Hazard assessment of major hazard installations 
According to the report, the company had made no use of 
hazard analysis or an equivalent method to identify and 
assess the hazards of the installation. 

Plant layout and separation distances 
The report was critical of the separation distances in the 
plant in several respects. It stated that the separation dis¬ 
tances between process equipment plant did not accord 
with accepted engineering practice and did not allow time 
for personnel to leave the polyethyelene plant safely dur¬ 
ing the initial vapour release; and that the separation 
distance between the control room and the reactors was 
insufficient to allow emergency shut-down procedures to 
be carried out. 

Location of control room 

As just mentioned, the control room was too close to the 
plant. It was destroyed in the initial explosion. 

Building ventilation intakes 

The ventilation intakes of buildings close to or down¬ 
wind of the hydrocarbon processing plants were not 
arranged so as to prevent intake of gas in the event of a 
release. 

Minimization of exposure of personnel 
Closely related to this, there was a failure to minimize the 
exposure of personnel. Not only the control room but the 
finishing building had relatively high occupancy. 


Table A6.2 Some lessons of Pasadena 


Management of major hazard installations 

Hazard assessment of major hazard installations 

Plant layout and separation distances 

Location of control room 

Building ventilation intakes 

Minimization of exposure of personnel 

Escape and escape routes 

Gas detection system 

Control of ignition sources 

Permit-to-work systems 

Isolation procedures for maintenance 

Integrity of fire water system 

Dependability of fire pumps 

Audibility of emergency alarm 

Follow-up of audits 

Planning for emergencies 


Escape and escape routes 

As already stated, the separation distances were not such 
as to allow personnel on the polyethylene plant to escape 
safely. Further, the only escape route available to people 
in the administration block (other than across the ship 
channel) was across the area of the explosion. 

Gas detection system 

Despite the fact that the plant had a large inventory of 
flammable materials held at high pressure and tempera¬ 
ture, there was no fixed flammable gas detection system. 

Control of ignition sources 

The control of ignition sources around the plant was 
another feature criticized in the OSHA report. 

Permit-to-work systems 

The OSHA report stated that an effective permit system 
was not enforced for the control of the maintenance activ¬ 
ities either of the company’s employees or of contractors. 

Isolation procedures for maintenance 
In this incident the sole isolation was a ball valve, which 
was meant to be closed but was in fact open. There was no 
double block system or blind flange. 

The practice of not providing positive isolation was a 
local one and violated corporate procedures. The implica¬ 
tion is that it had not been brought to light by any safety 
audits conducted. 

Integrity of fire water system 

The practice of relying for fire water on the process water 
system and the failure to provide a dedicated fire water 
system meant that the fire water system was vulnerable to 
an explosion. 

Dependability of fire pumps 

The electrical cables to the regular fire pumps were not laid 
underground and were therefore vulnerable to damage by 
explosion and fire. One of the back-up diesel pumps had 
insufficient fuel and one had been taken out for main¬ 
tenance without informing the chief fire officer. 

Audibility of emergency alarm 

As described, the level of noise in some areas was such that 
the employees might not have been able to hear the siren. 

Follow-up of audits 

The OSHA report criticized the company’s failure to act 
upon reports issued previously by the company’s own 
safety personnel and by external consultants, which drew 
attention to unsafe conditions. 

Planning for emergencies 

The disaster highlighted a number of features of emer¬ 
gency planning. The company had put a good deal of 
effort into planning and creating personal relationships 
with the emergency services, by means such as joint 
exercises, and these paid off. The value of planning, 
training and personal relations was one of the most posi¬ 
tive lessons drawn. 

Another area in which a proactive approach proved ben¬ 
eficial was in relations with the media. Senior personnel 
made themselves available, and the company evidently felt 
it received fair treatment. 
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One weakness of the emergency planning identified was 
that it had not envisaged a disaster of the scale which 
actually occurred. 

The incident brought out the need to be able to respond 
clearly to calls from those liable to be affected about the 
toxicity of the fumes and smoke generated in such an event. 


The behaviour of rescue helicopters posed a problem. 
Personnel on the ground had no means of communication 
with them and the craft tended to come in low, creating the 
danger of blowing flames or toxic fume onto those below. 
A need was identified for altitude and distance guidelines 
for helicopters. 
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APPENDIX 7/2 CANVEY REPORTS 


The most comprehensive hazard assessment of non-nuclear 
installations in the United Kingdom is the Canvey study 
carried out for the HSE by SRD. 

The first phase of the work is described in Canvey: An 
Investigation of Potential Hazards from Operations in the 
Canvey Island/Thurrock Area (the First Canvey Report) 
(HSE, 1978b). The report is in two parts: Part 1 is an intro¬ 
duction by the HSE and Part 2 the SRD study. 

The origin of the investigation was a proposal to with¬ 
draw planning permission for the construction of an addi¬ 
tional refinery in the area. Two oil companies, Occidental 
Refineries Ltd and United Refineries Ltd, had been granted 
planning permission for the construction of oil refineries. 
The construction of the Occidental refinery was begun in 
1972, but was halted in 1973 pending a major design study 
review. United Refineries had valid planning consents, but 
had not started construction. It was a public inquiry into 
the possible revocation of the planning permission for 
the United Refineries development which gave rise to the 
investigation. 

Responses to the First Canvey Report centred mainly on 
two aspects: the methodology used and the magnitude of 
the assessed risks. The HSE commissioned further work, 
leading to the Second Canvey Report (HSE, 1981a), in which 
the methodology used is revised and the assessed risks are 
rather lower. 

An accountofthefirstreportisgiven inSections A7.1-A7.6, 
of the response to that report in Section A7.7 and of the 
second report in Sections A7.8-A7.10. 

A map of the Canvey/ Thurrock area showing the principal 
installations and populated areas is given in Figure A7.1. 

Selected references on the Canvey Reports are given in 
Table A7.1. 


A7.1 First Canvey Report 

The terms of reference of the investigation were 

In the light of the proposal by United Refineries Limited 
to construct an additional refinery on Canvey Island, to 
investigate and determine the overall risks to health and 
safety arising from any possible major interactions 
between existing or proposed installations in the area, 
where significant quantities of dangerous substances 
are manufactured, stored, handled, processed and trans¬ 
ported or used, including the loading and unloading of 
such substances to and from vessels moored at jetties; 
to assess the risk; and to report to the Commission. 

The members of the investigating team were appointed 
as inspectors of the HSE under the provisions of the Health 


Table A7.1 Selected references on Canvey Reports 


Canvey Reports 

HSE (1978b, 1981a) 

Reviews and critiques 

N. Turner (1975); Anon. (1980,l,p,s); Cremer and Warner 
(1980); Hansard (1980); V.C. Marshall (1980a); Anon. 
(1981r,w); R.Ward (1981); A.F. Grant (1982); IChemE 
(1982a, b); Rasbash (1982a); Anon. (1983c); Petts (1985a) 


and Safety at Work etc. Act 1974 and were given specified 
powers to enable them to make the necessary inquiries. The 
overall approach taken in the investigation was 

(1) To identify any potentially hazardous materials, their 
location and the quantities stored and in process. 

(2) To obtain and review the relevant material properties 
such as flammability and toxicity. 

(3) To identify the possible ways in which failure of plants 
might present a hazard to the community. 

(4) To identify possible routes leading to selected failures. 
Typically, the factors examined included operator 
errors, fatigue or aging of plant, corrosion, loss of 
process control, overfilling, impurities, fire, explo¬ 
sion, missiles and flooding. 

(5) To quantify the probability of the selected failures 
occurring and their consequences. 

The investigation involved the identification of the princi¬ 
pal hazards of the installations and activities in the area, 
the assessment of the associated risks to society and to 
individuals, and the proposal of modifications intended 
to reduce these risks. 

Some 30 engineers were engaged in the investigation, 
which cost about £400,000. 

A7.2 First Canvey Report: Installations and Activities 

The principal hazardous installations and activities iden¬ 
tified in the investigation are summarized in Table A7.2. 
These installations are now briefly described. 

A7.2.1 British Gas Corporation 

The British Gas Corporation operates on Canvey Island, a 
methane terminal that is used for the importation and stor¬ 
age of LNG from Algeria. There are some 50 shipments of 
LNG ayear made by two specially designed ships each with 
a cargo capacity of about 12,000 t. The LNG is pumped 
ashore from a single jetty into above-ground and in-ground 
fully refrigerated storage tanks with a combined total 
capacity of approximately 100,000 t.The natural gas is sent 
out as vapour by pipeline except for a small amount that 
goes out by road. 

The terminal is also used for the fully refrigerated stor¬ 
age of liquid butane. A pipeline from the butane tanks 
crosses the area. 

In addition, new LNG ships are commissioned at the 
terminal by using the LNG from the storage tanks to cool 
down the ships’ cargo tanks. 

A7.2.2 Texaco Ltd 

Texaco Ltd operates on Canvey Island storage for petroleum 
products, but not LPG, with a total capacity of more than 
80,0001. The petroleum products are brought in by sea via 
two jetties and are sent out by sea, road and pipeline. 

A7.2.3 London and Coastal Wharves Ltd 

London and Coastal Wharves Ltd also operates on Canvey 
Island storage for a wide range of substances, including 
petroleum products and other flammable and toxic materi¬ 
als, with a total capacity of more than 300,000 t. Part of 
the site is leased to Texaco. The materials are brought in 
mainly by sea via a single jetty and also by road and are 
sent out not only by road but also by sea. Oil is sent out by 
Texaco by pipeline. 






Figure A7.1 First Canvey Report: map of the Canvey/Thurrock area, showing principal installations and populated areas (Health and Safety Executive, 
1978b) (Courtesy of HM Stationery Office) 





Table A7.2 First Canvey Report: principal hazardous installations and activities at Canvey 


Location 

Company 

Installation or activity 

Storage 

Employees 

Transport in 

Canvey Island 

British Gas 
Corporation 

LNG terminal 

Fully refrigerated storage of LNG 
(atmospheric pressure, <-162°C) 

6 x 40001 above-ground tanks 

2 x 10001 above-ground tanks 

4 x 20,0001 in-ground tanks. 

Fully refrigerated storage of butane 
(atmospheric pressure, <10° C) 

1 x 10,0001 tank 

2 x 50001tanks 

200 

Sea 


Texaco Ltd 

Petroleum products 
storage 

Atmospheric storage of petroleum 
products >80,0001 total capacity 

130 

Sea 


London and 
Coastal 

Wharves Ltd 

Flammable and toxic 
liquids storage 

Atmospheric storage of liquids 
>300,0001 total capacity 

50 

Mainly sea but 
some road 


Occidental 
Refineries Ltd 

Oil refinery 
(proposed) 

Pressure storage of LPG 
(atmospheric temperature) 

2 x 7501 propane spheres 

2 x 4001 butane spheres 




United 

Refineries Ltd 

Oil refinery 
(proposed) 

Pressure storage of LPG 
(atmospheric temperature) 

4 x 2001 propane spheres 

3 x 9001 butane spheres. 

Process and storage containing 
hydrogen fluoride 



Coryton 

Mobil Oil Co. Ltd 

Oil refinery 

Pressure storage of LPG 
(atmospheric temperature) 

1 x 10001+14 other vessels, 
giving 40001 total capacity 

800 

LPG produced 



Oil refinery 
(extension) 

Pressure storage of LPG 
(atmospheric temperature) 

4 x 10001 LPG spheres. 

Fully refrigerated storage of LPG 


LPG produced 


(atmospheric pressure) 

1 x 50001 tank. 

Process and storage containing 
hydrogen fluoride 


Transport out 

Mainly pipeline 
(as vapour) but 


Pipeline, road, 


Pipeline (Texaco oil). 
Rest mainly road 
but some sea 


3) 

rn 

O 

3) 

-H 

co 


Pipeline, road, 


Pipeline, road, 
rail, sea 






Calor Gas Ltd 

LPG terminal 

Pressure storage of LPG 
(atmospheric temperature) 

3 x 601 propane vessels 

2 x 601 butane vessels + cylinders, 
giving 5001 total inventory 

100 

Pipeline (from 
oil refineries) 

Road (cylinders, 
bulk tankers) 

Shell Haven 

Shell Oil U.K. Ltd 

Oil refinery 

Pressure storage of LPG 
(atmospheric temperature) 

1 x 17001 butane sphere 
+ 3 other butane spheres, 
giving 32001 total butane capacity 

4 x 4001 propane spheres 

3 x 135t LPG horizontal vessels 

1900 

LPG produced 

Pipeline, road, 
rail, sea 




Fully refrigerated storage of 
liquid anhydrous ammonia 
(atmospheric pressure, -33°C) 
lx 14,0001 tank. 

Process and storage containing 
hydrogen fluoride 

2 x 401 vessels 


Sea 

Sea, road, 
occasionally rail 

Stanford-le-Hope 

Fisons Ltd 

Ammonium nitrate 
plant 

Storage of 92% aqueous ammonium 
nitrate solution 

1 x 50001 tank 
lx 20001 tank 

80 

Ammonium nitrate 
produced on site 

Road 



Ammonia storage 

Semi-refrigerated pressure storage 
of liquid anhydrous ammonia 
(pressure above atmospheric, 6°C) 

1 x 20001 sphere 


Rail 

Ammonia used 
on site 

Canvey/ 

Thurrock area 

General 

Transport of hazardous 
Materials by river, road, 
rail and pipeline 
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A7.2.4 Mobil Oil Co. Ltd 

Mobil Oil Co. Ltd operates at Coryton, an oil refinery as 
well as a bulk distribution depot and a large research and 
technical services laboratory. Oil is brought in by sea into 
storage tanks and is drawn off from these as required by 
the refinery. LPG is produced on site. The total storage 
capacity is more than 1,500,000 t. Products are sent out 
by sea, road, rail and pipeline. 

In addition, at the time of the investigation Mobil was 
undertaking a major extension of the refinery. 

A7.2.5 Calor Gas Ltd 

Calor Gas Ltd operates at Coryton, an LPG terminal for the 
filling of gas cylinders. The gas is supplied by pipeline from 
both the nearby refineries and is held in storage vessels 
with a total capacity of 350 t. The gas cylinders bring the 
total inventory on site to 500 t. LPG is sent out by road in 
cylinders and in bulk tankers. 

A7.2.6. Shell Oil UK Ltd 

Shell Oil UK Ltd operates at Shell Haven, an oil refinery 
Oil is brought in by sea into storage tanks and is drawn 
off from these as required to the refinery. LPG is pro¬ 
duced on site. The total storage capacity is more than 
3,500,000 t. Products are sent out by sea, road, rail and 
pipeline. 

There is also on site a large fully refrigerated storage 
tank for liquid anhydrous ammonia with a capacity of 
14,0001. Ammonia is brought in by sea and sent out by sea 
and road, and occasionally by rail. 

A7.2.7 Fisons Ltd 

Fisons Ltd operates at Stanford-le-Hope, an ammonium 
nitrate plant in which strong ammonium nitrate solution 
is produced by reacting together ammonia and nitric acid, 
the latter itself being made on site from ammonia. The 
ammonium nitrate is stored in two large heated tanks with 
a total capacity of 70001 and is sent out by road. Liquefied 
anhydrous ammonia for the process is brought in by rail 
and is stored in a large semi-refrigerated pressure storage 
sphere with a capacity of 20001. 

A7.2.8 Other activities 

Explosives are trans-shipped at Chapmans Anchorage at 
the eastern end of Canvey Island, while there is a specified 
anchorage for explosives ships at the other end of the area. 

Ships passing up and down the river are obliged to travel 
fairly close to the sea walls and jetties within the area. 

A7.3 First Canvey Report: Identified Hazards 

The investigation identified several principal hazards in 
the area. These are; 

(1) oil spillage over bund; 

(2) LNG vapour cloud release (10001); 

(3) LPG vapour cloud release (10001); 

(4) ammonium nitrate explosion (45001 of 92 % solution); 

(5) ammonia vapour cloud release (10001); 

(6) hydrogen fluoride cloud release (10001). 

The figures in parentheses indicate standard cases con¬ 
sidered in the study. 

A severe fire might occur if there is an escape of flam¬ 
mable liquids from storage so that large quantities flow 


down into the residential area. This hazard is presented by 
the large storages of flammable liquids at London and 
Coastal Wharves and Texaco and at the proposed refineries 
of Occidental and United Refineries, and also by the large 
butane storage at British Gas. 

A severe vapour cloud fire and/or explosion might occur 
if there is a spillage of LNG so that a vapour cloud forms 
and ignites. This hazard is presented by the large LNG 
terminal and storage at British Gas. The spillage might 
occur at sea or on land. 

Similarly, a severe vapour cloud fire and/or explosion 
might occur if there is a spillage of LPG so that a vapour 
cloud forms and ignites. This hazard is presented by the 
LPG terminals and storages at British Gas, Shell and Mobil 
and by those at the proposed refineries of Occidental and 
United Refineries. 

A severe explosion might occur if there is a rupture of an 
ammonium nitrate storage tank. This hazard is presented 
by the storage of ammonium nitrate at Fisons. 

A severe toxic release might occur if there is a spillage of 
ammonia. This hazard is presented by the large terminals 
and storages at Fisons and at Shell. The spillage might 
occur at sea or on land. 

A severe toxic release might also occur if there is a rup¬ 
ture of storage or process plant containing hydrogen 
fluoride. This hazard is presented by the alkylation facil¬ 
ities at Shell, at the Mobil extension and at the proposed 
Occidental refinery. 

The investigators also identified and assessed other 
hazards, but these are not considered here. 


A7.4 First Canvey Report: Failure and Event Data 

The investigation required the estimation of the prob¬ 
abilities of various occurrences and of their consequences. 

Some of the sources of information on such probabilities 

used in the study were 

(1) UK industries, including oil, chemical and other pro¬ 
cess industries and transport; 

(2) government organizations such as those concerned 
with fire, and road, rail and sea and air transport; 

(3) professional institutions, for example, Institution of 
Chemical Engineers, Institution of Civil Engineers, 
American Institute of Chemical Engineers; 

(4) international safety conference proceedings, for 
example, loss prevention in the process industries, 
ammonia plant safety and hazardous materials spills; 

(5) industry-based associations, for example, Chemical 
Industries Association, Institute of Petroleum, Amer¬ 
ican Petroleum Institute, Liquefied Petroleum Gas 
Industry Technical Association; 

(6) international insurance interests, for example, Lloyds, 
Det Norsk Veritas, and industrial risk insurers, Fire 
Protection Association; 

(7) overseas government and international agencies, for 
example, US Coast Guard, US Department of Trans¬ 
portation, OECD and EEC; 

(8) specialized research laboratories; 

(9) individual subject specialists known or recommended 
to the investigating team. 

Selected references used in the Canvey Report are given in 

Table A7.3. 
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Table A7.3 First Canvey Report: Selected 
references used 


Min. of Defence (n.d.); Wardle (n.d.); Brodie (1956); B.R. 
Morton,Taylor and Turner (1956); Cremer (1959,1961); 
Minorsky (1959); Cremer and Callaway (1961); Pasquill 
(1961,1965); Patty (1962); R.K. Davis etal. (1963); Blokker 
(1964); Bryant (UKAEA1964 AHSB(RP) R42); Glasstone 
(1964);Yih (1965); van Dolah etal. (1966 BM RI6773); 
Resplandy (1967); Brasie and Simpson (1968); Slade (1968); 
G.A. Briggs (1969): Clough and Garland (1970b); Kiwan 
(1970b); Bryce-Smith (1971); Finney (1972); MacArthur 
(1972); Brobst (1972); Feldbauer e/a/. (1972); Humbert- 
Basset and Montet (1972); Oppenheim, Kuhl and Kamel 
(1972); Burgess and Zabetakis (1973 BM RI 7752); Kuhl, 
Kamel and Oppenheim (1973); May, McQueen and Whipp 
(1973); Strehlow (1973b); BatteUe Columbus Lab. (1974); 
L.E. Brown, Wesson and Welker (1974b); Dicken (1974, 
1975); Geiger (1974); Hosker (1974b); Kneebone and Prew 
(1974); Munday and Cave (1974); Murata etal. (1974); NTSB 
(1974 PAR-74-06); Reed (1974); Simmons, Erdmann and 
Naft (1974); van Ulden (1974); CIA (1975/8); Germeles and 
Drake (1975); Gething (1975); J. Hall, Barrett and Ralph 
(1975); Lonsdale (1975); Raj etal. (1975); DoE (1976b); 
Gifford (1976b); MacMullen (1976); Munday (1976a); Neff, 
Meroney and Cermak (1976); Carver etal. (1977); R.A. Cox 
and Roe (1977); Davenport (1977b); Fitzpatrick and 
Goddard (1977); Havens (1977) 

See also Appendix 28 (HSE and SRD; UKAEA, SRD) 


The degree of uncertainty associated with the probabil¬ 
ity estimates is indicated by the following code: 

(a) assessed statistically from historical data - this 
method is analogous to the use of aggregate estimates 
in economic forecasting; 

(b) based on statistics as far as possible but with some 
missing figures supplied by judgement; 

(c) estimated by comparison with previous cases for 
which fault tree assessments have been made; 

(d) ‘dummy’ figures - likely always to be uncertain, a 
subjective judgement must be made; 

(e) not used; 

(f) fault tree synthesis, an analytically based figure 
which can be independently arrived at by others. 

The coding (a) denotes a value based on historical failure 
or event data. The coding (b) indicates that the value is 
again based on historical data as far as possible, although 
with some exercise of judgement, but also that given more 
effort a firmer value would probably be obtained. The cod¬ 
ing (d) indicates that the value is based on judgement and 
the prospects of ever reducing the uncertainty are poor. 
Category (d) factors are effectively dummy values. Con¬ 
clusions should not be drawn from these without testing for 
sensitivity. The value of a (d) category factor is generally 
not very small: it is typically 0.3 and exceptionally 0.1. The 
coding (f) denotes a value synthesized by fault tree meth¬ 
ods. This category is in fact very little used in the study. 
Instead use is made of (c) category factors. The coding (c) 
indicates that the value is based on a value previously 
obtained for a similar situation using fault tree methods. 
The Canvey Report contains much useful information on 


failure and event data. Some of these data are given in 
Section A7.5 and in Table A7.4. It is emphasized that these 
data are given here for illustrative purposes and that the 
report itself should be consulted for the description of the 
background to and the application of these data. 

A7.5 First Canvey Report: Hazard Models and 
Risk Estimates 

The investigation involved the study of a wide range of 
hazards and scenarios. 

The projects that were initiated as part of the investiga¬ 
tion were 

(1) consideration of known history of identified storage 
tanks and their possibility of failure; 

(2) probability of particular storage tanks or process 
vessels being hit by missiles caused by fires or explo¬ 
sions on site or adjacent sites, by fragmentation of 
rotating machines or pressure vessels, or transport 
accidents; 

(3) effects of vapour cloud explosions on people, 
houses, engineering structures, etc.; 

(4) evaporation of LNG from within a containment area 
on land or from a spill on water; 

(5) special problems of frozen earth storage tanks for 
LNG and the effect of flooding; 

(6) study of possible failures in handling operations; 

(7) consideration of the possible benefits and practi¬ 
cality of evacuation; 

(8) civil engineering aspects of the sea-wall - the 
chance of it being breached by subsidence, explosion 
or impact of ships, consideration of the timing of 
improved defences, consideration of the time for 
floods to rise; 

(9) statistics of ship collisions and their severity, 
groundings, etc., applying extensive world experi¬ 
ence to the Canvey Island area; 

(10) reliability and analysis of fluid handling practices, 
ship to shore, and store to road vehicles and pipelines; 

(11) toxicology of identified hazardous substances; 

(12) studies to determine the lethal ranges for various 
releases of toxic or explosive materials leading to a 
number of special studies such as 

(a) the behaviour of ammonia spilt on water or 
land, and 

(b) an assessment of the relative importance of 
explosion or conflagration from a cloud of 
methane or liquefied petroleum gas. 

The subjects that are considered in appendices to the 
report are 

(1) a review of current information on the causes and 
effects of explosions of unconfined vapour clouds 
(F. Briscoe); 

(2) fires in bunds - calculations of plume rise and position 
of downwind concentration maximum (R. Griffiths); 

(3) a quantitative study of factors tending to reduce the 
hazards from airborne toxic clouds (Q.R. Beattie); 

(4) the dispersal of ammonia vapour in the atmosphere 
with particular reference to the dependence on 
the conditions of emission (F. Abbey, R.F. Griffiths, 
S.R. Haddock, G.D. Kaiser, R.J. Williams and 
B.C.Walker); 





Table A7.4 First Canvey Report: soi 

me failure and event data used (after Health and safety Executive, 1978b) 



Installation or activity 3 



Canvey Report 
pagefs) 

Pressure vessels (LPG, 
ammonia, HF) 

Frequency of spontaneous failure of pressure vessel 

10 5 /year-10 4 /year 

57,59,69 

Pressure circuit (HF) 

Frequency of spontaneous failure of pressure circuit 

10 _4 /year 

59 


Frequency of release due to operational fault 

10 _4 /year 

59 


Frequency of penetration of pressure circuit by missile 

10 _4 /year 

59 

High speed rotating machine 

Frequency of disintegration of rotor 

10 _4 /year—10 _3 /year 

58 

Pipework (LPG) 

Frequency of failure of pipework (whole refinery installation) 

5 x 10 _3 /year 

56 

Pump(LPG) 

Frequency of catastrophic failure of pump 

10 _4 /year 

56 

LPG filling point 

Frequency of large vapour release 

5 x 10 _3 /year 

58,81 

LNG tank (above ground) 

Frequency of serious fatigue failure 

2 x 10 _4 /year 

63 


Frequency of overpressurization by overfilling 

10 _5 /year-10~ 4 /year 

63,95 


Frequency of rollover involving structural damage 

10 _5 /year-10 _4 /year 

63,95 

Jetty pipework (LNG) 

Frequency of catastrophic failure of jetty pipework 

10 _4 /year—10 _3 /year 

63 

Fire 

Frequency of major fire in a refinery 

0.1/year 

55,130 

Explosion 

Probability of refinery explosion, given major refinery fire 

0.5 

130 

Missiles 

Probability of missile generation, given refinery explosion 

0.1 

130 


Frequency of missile-generating explosion in refinery 

5 x 10 _3 /year 

130 


Average number of missiles generated per explosion 

c. 6 

130 


Probability of missile hitting large storage sphere at 300 m 

10 3 /year 

55 





Unconfined vapour cloud explosion 

Frequency of unconfined vapour cloud explosion in a refinery 

10 _3 /year 

Pipeline (butane) 

Frequency of failure of pipeline (15/20 cm diameter) 

3 x 10 _4 /kmy 

Rail transport 

Frequency of derailment of rail tank car 

1 x 10 -6 / train km travelled 


Probability of overturning given derailment 

0.2 

Road transport 

Frequency of accident of road tanker involving spillage 

1.6 x 10 _8 /km travelled 

Sea transport (Port of London) 

Frequency of ship-ship collision of moderate severity due 
to harbour movements 

0.5 x 10 _4 /harbour movement 


Frequency of berthing contact 

1.5 x 10“ 4 /harbour movement 


Frequency of grounding 

0.3 x 10 _4 /harbour movement 


Frequency of spillage due to harbour movements: 
ammonia carrier 

3.1 x 10 _5 /harbour movement 


Frequency of fire 

0.5 x 10~ 4 /harbour movement 
2.3 x 10~ 5 /movement 


Frequency of ship-ship collision of moderate severity in 
transit in estuary 


Frequency of spillage due to ship-ship collision intransit: 
ammonia carrier 

5 x 10 _6 /movement 

Jetty incidents 

Frequency of shipboard explosion at jetty: 
ammonia ship, Shell jetty 

10 _4 /harbour movement 


Frequency of fire or explosion at jetty: LPG, 

Occidental, Mobil jetty 

4 x 10 _5 /harbour movement 

Aircraft movements 

See Section A.5.5 of this Appendix 


Helicopter movements 

Frequency of helicopter accident - total accidents 

3 x 10“^/km flown 

8 x 10 _ 7kmflown 


- Fatal accidents 


a The data given in this table are in most cases heavily qualified and the original report should be consulted for the description of the background to and the application of them. 


69,130 

85 

79 

79 

84 

146 

146 

146 

149 

146 

147 

150 

96 

96 

139-140 

141 

141 
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(5) statistics on fires and explosions at refineries 
Q.H. Bowen); 

(6) missiles - penetration capability (EA White); 

(7) discussion of data base for pressure vessel failure 
rate (TA Smith); 

(8) risk of aircraft impacts on industrial installations in 
the vicinity of Canvey Island (LS. Fryer); 

(9) the dispersion of gases that are denser than air, with 
LNG vapour as a particular example (G.D. Kaiser); 

(10) not used; 

(11) the risk of a liquefied gas spill to the estuary (D.F. 
Norsworthy); 

(12) the toxic and airborne dispersal characteristics of 
hydrogen fluoride (Q.R. Beattie, F. Abbey, S.R. 
Haddock, G.D. Kaiser); 

(13) transient variation of the wall temperature of an 
LNG above-ground storage tank during exposure to 
an LNG fire in an adjacent bund (I.R. Fothergill); 

(14) the escape of 10001 of anhydrous ammonia from a 
pressurized storage tank (L.S. Fryer, G.D. Kaiser 
and B.C. Walker); 

(15) graphical calculation of toxic ranges for a release of 
10001 of ammonia vapour (J.H. Bowen); 

(16) effect of unbunded spill of hydrocarbon liquid from 
refinery at Canvey Island (A.N. Kinkead); 

(17) estimated risk of missile damage causing a 
vapour cloud release from existing and proposed 
LPG storage vessels at the Mobil refinery, Coryton 
(D.F. Norsworthy); 

(18) risks of accidents involving road tankers carrying 
hazardous materials (L.S. Fryer); 

(19) toxicology of lead additives (S.R. Haddock); 

(20) compatibility of materials stored at London and 
Coastal Wharves Ltd (S.R. Haddock); 

(21) blast loading on a spherical storage vessel (Q.Wall); 

(22) statistical comment on data on distribution of cracks 
found on inspection of steel vessel (Q.C. Moore); 

(23) calculation of resistance of ship hull to collision 
(A.N. Kinkead); 

(24) reduction of apparent risk by shared experience 
(Q.H. Bowen). 

The treatment of some of the topics which is given in the 

report is now described. These topics are 

(1) failure of pressure vessels; 

(2) failure of pressure piping; 

(3) failure of pipelines; 

(4) generation of and rupture by missiles; 

(5) crash of and rupture by aircraft; 

(6) ship collision and other accidents; 

(7) flow of a large release of oil; 

(8) temperature of the wall of an LNG tank exposed to 
an LNG fire in an adjacent bund; 

(9) evaporation of LNG and ammonia on water; 

(10) dispersion of an LNG vapour cloud; 

(11) unconfined vapour cloud fire and explosion; 

(12) ammonium nitrate explosion; 

(13) toxicity of chlorine, ammonia, hydrogen fluoride 
and lead additives; 

(14) dispersion of ammonia and hydrogen fluoride 
vapour clouds; 

(15) factors mitigating casualties from a toxic release; 

(16) road tanker hazards; 

(17) evacuation. 


It is emphasized that the following summary of the meth¬ 
ods used in the report is necessarily highly compressed and 
that the report itself should be consulted for a fuller dis¬ 
cussion of the methods themselves and of the background 
to and application of the methods. 

A7.5.1 Failure of pressure vessels 

Spontaneous failure of pressure vessels is considered as a 
possible initiating event for releases of LPG, ammonia and 
hydrogen fluoride. The report discusses spontaneous fail¬ 
ure of pressure vessels in Part 2, Section 5.3.2. and in 
Appendix 7 and the sensitivity of the results for LPG, 
ammonia and hydrogen fluoride releases in Part 2, Sections 
17.14-17.16. 

It reviews the surveys of pressure vessel failures avail¬ 
able at that date, as described in Chapter 12, and concludes 
that the UK survey data are broadly applicable to LPG sto¬ 
rage vessels. 

For vessels covered by the surveys the frequency of a 
fault requiring repair or withdrawal from service was 
about 3 x 10 _4 /y. If it can be assumed that the critical defect 
length is less than the wall thickness, so that detection is 
easier, and that there is an effective inspection system, a 
reasonable estimate of the probability of detection is 90%. 
The frequency of an undetected fault would then be about 
3 x 10 _5 /y. A catastrophic failure rate of pressure vessels of 
10 _5 /y is used in the study. 

In addition, however, the sensitivity of the results to 
errors in the assumed failure rate was calculated taking a 
failure rate of 10 _4 /y instead of 10 _5 /y. The effect of this 
change is almost to double the risk from LPG operations for 
the existing installations after the proposed modifications. 
Thus for an incident involving >1500 casualties the fre¬ 
quency is 264 x 10 _6 /y with a contribution of 20-10 _s /y 
for spontaneous failure of pressure vessels, but the latter 
rises to 200 x 10 _6 /y if the spontaneous failure rate of 
pressure vessels is increased from 10 _5 /y to 10 _4 /y. 

It is concluded that a high standard of inspection of the 
LPG pressure vessels is necessary. 

External threats to pressure vessels were also con¬ 
sidered. An event tree for the derailment involving over¬ 
turning of a rail tank car with possible threat to a sphere 
containing 2000 t of anhydrous ammonia is shown in 
Figure A7.2. 

Missile threats are described in Section A7.5.4. 

A7.5.2 Failure of pressure piping 

Failure of pressure piping is considered as a possible 
initiating event for releases of LPG and LNG. The report 
discusses the failure of LPG pressure piping in Part 2, 
Section 5.3.1. 

LPG is piped around the refineries in pressure piping. 
The pipes mainly contain liquid, but there are some vapour 
return lines. It was considered that probably if a large pipe 
were to fail, there would be a vapour plume, the plume 
would find a source of ignition and would burn back to the 
pipe and there form a burning jet. In burning back there 
would he the possibility of semi-confined vapour explo¬ 
sions. If on a 25 cm diameter LPG pipe the fluid burned as a 
jet, the latter could be over 50 m long, while if, due to 
obstruction, it burned rather as a hemisphere, the radius of 
the latter could be over 10 m. 

Various effects of such fires and explosions from LPG 
pipe failure are reviewed. An LPG sphere should withstand 
a semi-confined explosion beneath it; a horizontal cylinder 
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Figure A7.2 First Canvey Report: event tree for derailment involving overturning of a rail tank car with possible 
threat to a sphere containing 2000 te of anhydrous ammonia (Health and Safety Executive, 1978b) (Courtesy of HM 
Stationery Office) 


could be lifted up some tens of centimetres. The principal 
hazard foreseen, however, is burn back under an LPG 
storage sphere. 

Three cases are treated: (1) failure of a pipe, (2) failure of 
a pump and (3) failure of a suction line within about 10 m 
of a storage sphere. The smallest pipe size considered was 
15 cm diameter. 

It was estimated that the area of a typical refinery is 
about 3 km 2 and that the length of LPG pipe of diameter 
>15 cm in such a refinery is about 3 km, of which about 
10% is 25 cm diameter pipe. The total frequency of pipe 
fracture for this length of pipe was assessed from data in 
the SRS data bank as 5 x 10 _4 /y. For a pipe to affect the 
storage it must be sufficiently near. The hazard ranges of 15 
and 25 cm diameter pipe were taken as 150 and 500 m, 
respectively. The width of a plume would he of the order of 
20°, so that the possibility of the plume lying in any parti¬ 
cular direction is 5 %. Then the frequencies of involvement 
of an LPG storage vessel due to pipe failures are 

Frequency for 15 cm pipe 

s= 2 x 10“ 2 x 5 x 10“ 3 x 5 x 10“ 2 = 5 x 10“ 6 /y 
Frequency for 25 cm pipe 

= 1 x 0” 1 x 2 x 10 -1 x 5 x 10“ 3 x 5 x 10“ 2 = 5 x 10“ 6 /y 
Total frequency for all large pipes = 10 _5 /y. 

The number of LPG pumps in a typical refinery was esti¬ 
mated at about 20. The frequency of catastrophic rupture 
of such pumps was assessed from data in the SRS data bank 
as 10 _4 /y. As before, the probability of the plume in any 
particular direction is 5%. Then the frequency of involve¬ 
ment of an LPG storage vessel due to a pump rupture is 

Frequency for pumps = 20 x 10 -4 x 5 x 10~ 2 = 10 _4 /y 

In addition, there is the possibility that if the pumps are 
close together (<20 m spacing), a fire at one pump would 
involve other pumps and would create a large fire regardless 


of plume direction. Then the frequency for this event is 
2 x 10 _3 /y. 

The proportion of 25 cm diameter LPG pipe within 10 m 
of a storage vessel was estimated as about 10%. Then the 
frequency of involvement of an LPG storage vessel due to 
failure of such pipe is 

Frequency for 25 cm pipe beneath vessels 

* 10” 1 x 10“ 6 x 5 x 10“ 3 = 5 x 10“ 5 /y 

Thus the frequency of failure of an LPG vessel due to 
failure of a large LPG pipe or a pump is 1.6 x 10 _4 /y. If 
interaction between pumps can occur as described above, 
this figure rises to 2.1 x 10 _3 /y. 

The report also discusses the failure of the pipes that 
carry LNG from the jetty head to the storage tanks in Part 2, 
Section 6.5.2. 

The frequency of failure of these pipes was assessed 
as 10~ 4 -10~ 3 /y. The lower rate is more likely during actual 
transfer pumping and the higher rate during warm-up and 
cool-down when the pumps are not in use. 


A7.5.3 Failure of pipelines 

Failure of a pipeline is considered as a possible initiating 
event for LNG and LPG. The report discusses failure of 
pipelines in Part 2, Section 15. 

There are four methane pipelines leaving the British Gas 
terminal. One of these is a 35 cm diameter line passing close 
to the built-up area. A serious failure of this line would lead 
to a large release of methane, but the gas would be highly 
buoyant and would undergo turbulent mixing with air, so 
that there is no chance of the formation of a large vapour 
cloud heavier than air. 

The frequency of a serious failure of the 3 5 cm pipeline in 
the built-up area was estimated as not greater than 10“ 4 /y. 

There is a liquid butane pipeline from the British Gas 
terminal to a point near the Shell refinery. The line is 20 cm 
diameter for 4 km leaving the terminal and then reduces to 
15 cm diameter. The line is not used, but contains some 5851 
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of liquid butane at a pressure of 4—6 atm. A serious failure 
of this line could give an initial liquid release rate of 
20-30 t/min. If the pressure were sustained by flashing 
off of propane some 50-100 t could be released in a few 
minutes. Unless there is a limit on the amount of propane 
or other volatile component present, the flashing off of the 
discharging mixture could form a vapour cloud. 

The frequency of a serious failure was estimated from 
data for similar pipelines in the SRS data bank as 3 x 
10 _4 /km y. The distance travelled by the pipeline through 
populated terrain is 1.5 km. Thus the frequency of a serious 
failure causing casualties was estimated as 4.5 x 10 _4 /y. 

A7.5.4 Generation of and rupture by missiles 

Rupture by a missile is considered as a possible initiat¬ 
ing event for releases of LPG, ammonia and hydrogen 
fluoride. The report discusses the generation of missiles in 
Appendix 5 and the penetration capability of missiles in 
Appendix 6. 

Some scenarios considered are shown in Table A7.5. 

The frequency of a large fire in an oil refinery is, for the 
United States of America, 0.2/y obtained from API data 
and, for the United Kingdom, 0.25/y obtained from FRS 
data. The API figures indicate that the proportion of these 
fires that are very large is about one-third. Thus the fre¬ 
quency of a very large fire in a refinery was taken as 0.1/y. 

The proportion of such very large fires that involves 
explosion was estimated from IRI data as 0.5. The propor¬ 
tion of such explosions that generate missiles was esti¬ 
mated as 0.1. 

The frequency of a very large fire that involves an 
explosion and generates missiles was thus estimated as 
5 x 10 -3 y. 

It was estimated also that on average such a missile¬ 
generating explosion generates some half-dozen missiles. 

The frequency of disintegration of the rotor of a rotating 
machine was estimated as 5 x 10~ 4 /y from data in the SRS 
data bank. 

The report gives in Appendix 6 methods for the estima¬ 
tion of the probability of a missile landing in a given area at 
a known distance from the source and methods for deter¬ 
mining whether the missile will penetrate a vessel. 

Missiles particularly considered are fragments from 
process plant and gas cylinders. With regard to the former a 
case is quoted in the United Kingdom in which a fractured 
vessel produced at least seven missiles of 1 t capacity. 
Reference is also made to the explosion at Whiting, Indiana, 
where an exploding hydroformer generated some tens of 
missiles, one of 601, with a velocity of 600 ft/s. 

Various empirical formulae for penetration by missiles 
are given. There is considerable variation in the results 
obtained from these formulae. When used to determine the 
penetration thickness for a missile with a velocity of300 ft/s, 


the penetration thicknesses given by the formulae ranged 
from 0.25 to 2.75 in. One reason for the variation is that 
some of the formulae are applicable to clamped flat plates 
rather than spherical or cylindrical vessels. 

It is concluded that 

(1) LPG spheres in excess of 1| in. thick will not be 
penetrated by flying gas cylinders even at velocities 
of 300 ft/s, which is a pessimistic upper limit; 

(2) spheres and cyinders 0.75 in. thick could be pene¬ 
trated by flying gas cylinders; 

(3) process missiles can be considerably larger than a 
gas cylinder and can impact with substantially 
greater energy - these could penetrate LPG spheres 
and cylinders. 


The report also discusses missile threat to the LNG tanks 
in Part 2, Section 6.5.4. 

A7.5.5 Crash of and rupture by aircraft 

Rupture by aircraft crash is considered a possible initiating 
event for release of all the hazardous materials. The report 
discusses aircraft crash and vessel rupture in Appendix 8. 

The frequency of a fixed wing aircraft crash at Canvey 
was assumed to be that for the United Kingdom in general 
and not that for an area near the airport. Canvey is within 
the Special Rules Zone of Southend airport, but is neither 
close to the main runway nor beneath the airspace of an 
aircraft waiting to land. 

The frequency of an aircraft crash was obtained from UK 
aircraft accident data. Two alternative equations are given 
for the frequency of an aircraft crash on a target. They are: 

Method 1 F = A H F H + A^Fn [A7.5.1a] 

Method 2 F = A H F H + AyFu [A7.5.1b] 

where A H is the horizontal area of the target, A'y is the ver¬ 
tical area of the target, Ay is the horizontal projection of the 
vertical area of target; A the frequency of aircraft crash on 
the target area; F H is the frequency of aircraft crash per unit 
of ground area and Fy is the frequency of aircraft crash per 
unit of vertical area. 

In Equation A7.5.1a the value of A'y was calculated 
assuming that the impact angle is 15°. In Equation A7.5.1b 
the value of Fy was calculated from data on the frequency 
with which aircraft crash into the National Grid system. 
The latter frequency was taken as 0.1/y. 

Results obtained for the frequency of crashes of aircraft 
of all types on the total target area at Canvey for each type 
of hazard were identical by both methods except that, 
for the refrigerated LPG at British Gas, Method 1 gave 


Table A7.5 First Canvey Report: some potential missile accidents at Canvey (after Health and Safety 
Executive, 1978b) 


Site 

Installation 

Missile 

Shell 

LPG vessel 

Missile from storage area 

Mobil (including extension) 

LPG vessel 

Missile from process area 

Fisons 

Ammonia sphere 

Missile from rotating machine 

Shell 

Hydrogen fluoride plant 

Missile from neighbouring plant 

Mobil (extension) 

Hydrogen fluoride plant 

Missile from neighbouring plant 
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Table A7.6 First Canvey Report: some potential aircraft 
crash accidents at Canvey (after Health and Safety 
Executive, 1978b) 


Site 

Installation 

Frequency 
of impact 
(impacts/y) 

Shell, Mobil, UR, Occidental 

LPG 

lxl(T 6 

British Gas 

Methane 

lxl(T 6 

Calor Gas 

LPG 

2 x 1(T 6 

London and Coastal Wharves 

Oil 

7 x 10 -6 

Fisons 

Ammonia 

lxKT 7 

Shell 

Ammonia 

1 x 1(T 7 

Shell, Mobil, UR, Occidental 

Process area 

2 x 10“ 5 


a frequency of impact of 6 x 10 _7 /y and Method 2 one of 
4 x l(T 7 /y. Other results were as given in Table A7.6. 

The frequency of a helicopter crash was also considered. 
Helicopters are used to survey pipelines in the area. It was 
assumed that data on the frequency of helicopter crashes 
obtained from NTSB publications are applicable to these 
helicopters. The frequency of crash obtained from these 
data is 3 x 10 _7 /km flown. In such crashes descent is almost 
vertical. 

Frequencies of crash estimated were 2.4 x 10 _5 /y, 
1.4 x 10 _5 /y and 3.6 x 10 _6 /y for the Occidental, Shell and 
Texaco sites. These are not, however, the frequencies of 
impact on vulnerable targets. These latter frequencies 
should be very much less, provided the helicopter routes 
are chosen to avoid such targets. 

Helicopters are used by British Gas to survey its gas 
pipelines. There are about 26 inspection flights per year. 
The pilots are instructed to avoid flying over industrial 
complexes and to skirt such locations by about 500 yd. 

A7.5.6 Ship collision and other accidents 

Ship collision is considered as a possible initiating event for 
release of LNG, LPG and ammonia. The report discusses 
ship collision in Appendices 11 and 23. 

Ship collision may occur while the ship is at sea, is sta¬ 
tionary in mid-channel or is moored at a jetty. At the time 
of the survey the Port of London Authority (PLA) had just 
imposed on ships a new speed restriction of 8 knot. 

Data on the frequency of ship collisions were obtained 
from the PLA. These data show that over the 12 -year period 
1965-76, there were within the scheduled area 592,250 
harbour movements and 121 accidents, of which 91 were 
classed as minor. Thus this gives for collisions of at least 
moderate severity a frequency of 0.5 x 10 _4 /harbour 
movement. 

Other PLA data were analysed to obtain the frequencies 
of berthing contact, grounding and fire. Thus the fre¬ 
quencies for collision and for these other accidents are 

Frequency of ship-ship collision (moderate severity) 
s=0.5 x 10 _4 /harbour movement 
Frequency of berthing contact 
= 1.5 x 10 _4 /harbour movement 
Frequency of grounding 

*=0.3 x 10 _4 /harbour movement 
Frequency of fire 
#=0.5 x 10~ 4 /harbour movement 


Further PLA data were analysed to obtain the frequency 
of ship-ship collision for ships in transit in the estuary. 
Thus the frequency of collision in transit is 
Frequency of ship-ship collision (moderate severity) in 
transit = 2.3 x 10 _5 /movement 

The vulnerability of ships to collision damage varies. 
The LNG carriers are double-hulled ships, whereas the 
LPG and ammonia carriers were not considered as of 
comparable strength. The former have much greater cargo 
protection. 

An investigation of the resistance of ships to impact was 
carried out in 1959 by Minorsky, who correlated his results 
in terms of the critical impact speed vs the loaded dis¬ 
placement of the striking ship, and the Minorsky curve 
method is widely used as a means of assessing impact 
resistance of ships. 

For a typical LPG carrier, data on the relation of the cri¬ 
tical impact speed vs loaded displacement of the striking 
ship were obtained from Lloyds Register. These data were 
interpreted as meaning that a striking ship with a loaded 
displacement of about 4000 t (2000 GRT) could penetrate 
an LPG carrier and cause spillage if there is no speed 
restriction, but that a loaded displacement of about 15,0001 
(7500 GRT) would be necessary if the speed of the striking 
ship is limited to 8 knot. 

Data for another typical LPG carrier were obtained from 
Norsk Veritas. These data differ from the Lloyds data and 
indicate that this is an area of uncertainty. 

The frequencies of spillage for an ammonia carrier, 
which in this context is broadly similar to an LPG carrier, 
were estimated by using the historical data in conjunction 
with the following assumed probabilities: 

Probability of spillage from ship-ship collision = 0.2 
Probability of spillage from berthing contact = 0.1 
Probability of spillage from grounding = 0.2 

Thus for an ammonia carrier the frequencies of spillage 
due to harbour movements are 

Frequency of spillage due to ship-ship collision 
<= 1 x 10 _5 /harbour movement 
Frequency of spillage due to berthing contact 
m 1.5 x 10 _5 /harbour movement 
Frequency of spillage due to grounding 
m 0.6 x 10 _5 /harbour movement 
Total frequency of spillage due to harbour movements 
== 3.1 x 10 _5 /harbourmovement 

An alternative calculation of the frequency of spillage 
due to harbour movement based on world data gave a value 
of 1.45 x 10 _5 /harbour movement. 

It is concluded that for an ammonia carrier a reasonable 
estimate of frequency of spillage due to harbour move¬ 
ments is unlikely to exceed. 

Frequency of spillage due to harbour movements 
= 2 x 10 _5 /harbour movement 
but that this estimate might be significantly reduced if 
more information were available on cargo protection. 

The frequency of spillage for an ammonia carrier due to 
collision in transit in the estuary was estimated using an 
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assumed probability of spillage due to ship-ship collision 
of 0.2. Thus for an ammonia carrier frequency of spillage in 
transit is unlikely to exceed 

Frequency of spillage due to ship-ship collision in transit 

= 5 x 10 _6 /movement 

This estimate might be significantly reduced if more 
information were available on cargo protection. 

The frequency of spillage for an LPG carrier was taken 
as similar to that for an ammonia carrier. Thus for an LPG 
carrier the frequency of spillage is unlikely to exceed 

Frequencyofspillage = 2 x 10~ 5 /movement 

Again this estimate might be significantly reduced given 
more information on cargo protection. 

For an LNG carrier, the situation is different because the 
vessel is double-hulled. This case was the subject of a 
special study. From this study a relation was obtained for 
an LNG carrier between the critical impact speed and the 
loaded displacement of the striking ship. This relation for 
an LNG carrier differs considerably from that for an LPG 
carrier, since the former, being double-hulled, has much 
greater protection. The relation shows that for an LNG ship 
stationary in mid-channel a striking ship with a loaded 
displacement of 100,0001 (50,000 GRT) would need to have 
a speed of 9 knot to effect penetration at a 90° impact angle, 
and that for an LNG ship moored at a jetting striking ships 
with loaded displacements of 100,000 t (50,000 GRT) and 
20,0001 (10,000 GRT) would need to have speeds of 7 and 
13.5 knot, respectively, to effect penetration at a 45° impact 
angle. 

It was assumed, therefore, that only ships with a loaded 
displacement greater than about 20,0001 (10,000 GRT) have 
the potential to cause a spillage from an LNG carrier. This 
does not include allowance for the new PLA speed restrictions. 

It was also concluded that for an LNG carrier spillage 
due to berthing contact could be disregarded. 

The frequency of spillage for an LNG carrier was esti¬ 
mated from the historical data in conjunction with the fol¬ 
lowing assumed probabilities: 

Probability of striking ship > 20,0001 (10,000 GRT) = 0.1 
Probability of strike invulnerable section = 0.5 

Then for an LNG carrier the frequency of spillage is 
Frequencyofspillage = 2.5 x 10 _6 /movement 

This assessment is based on only four incidents over the 
12-year period. 

An alternative calculation of the frequency of spillage 
for LNG carriers based on world data gave a value of 
1 x 10 _6 /movement. 

It is concluded that for an LNG carrier a reasonable 
estimate for frequency of spillage is 
Frequency of spillage = 2 x 10 -6 /movement 

A7.5.7 Flow of a large release of oil 

A large release of oil from storage and flow of this oil 
towards housing is one of the hazard situations considered. 
The report discusses the methods of calculating the flow 


of a large release of oil from the catastrophic failure of a 
storage tank in Appendix 16. 

Equations are given for the flow of a slumping fluid 
derived from those of van Ulden (1974) assuming that his 
constants c and A have the value of unity. It is assumed that 
the liquid is initially held in a vertical cylindrical source. 
The equations are 

r = [r 2 + 2t(gV s /nf 2 ] 1/2 [A7.5.2] 

^ = 5- [A7.5.3] 

«f = ( gh ) 1/2 [A7.5.4] 

where g is the acceleration due to gravity (m/s 2 ); hf the 
slumped liquid depth (m); r the radius of the flooded zone 
(m); r s the radius of the source cylinder (m); /the time after 
initiation of slumping (s); Ui the slumped liquid velocity 
(m/s); and F s the volume of the source cylinder (m 3 ). 

A7.5.8 Temperature of the wall of an LNG tank exposed to 
an LNG fire in an adjacent bund 

The rupture of an LNG tank due to an LNG fire in an adja¬ 
cent bund is one of the hazard situations considered. The 
report discusses the effect of an LNG fire in an adjacent bund 
on the temperature of an LNG tank wall in Appendix 13. 

The LNG tanks considered are cylindrical in shape and 
are 30 m diameter and 20 m high. They stand in a bund of 
60 m diameter. 

The temperature of the tank wall is determined by the 
heat balance on the wall. It was assumed that the wall gains 
heat by radiation and loses it both by radiation and by 
convection. 

For the heat gained by the tank wall use was made of the 
experimental work of L.E. Brown, Wesson and Welker 
(1974b). It was assumed that the heat flux from the fire is 
44,000 BTU/h ft 2 , which is the maximum average value 
obtained by these workers for liquid pools of up to 30 m 
diameter. This value is considered reasonably conservative 
for bund fires with an effective diameter up to 60 m. The 
flame height calculated from the empirical formula given 
by these workers is 75 m. The fraction of the radiated heat 
received by the tank was then calculated by dividing both 
the flame and tank surfaces into smaller subsurfaces and 
determining view factors. The total radiated heat 0> 
received by the tank wall was calculated as 3.11 x 10 7 W. 

For the heat loss by the tank wall the equation used for 
radiation is 

Q r = £<r(A v +A H )0T [A7.5.5] 

where A h is the area of the tank roof (m 2 ); A v the exposed 
area of the tank vertical sides (m 2 ); Q r the heat loss by 
radiation (W); e the emissivity of the tank wall; 0 T the 
absolute temperature of the tank wall (K); and a the 
Stefan-Boltzmann constant (W/m 2 K 4 ).The equation used 
for convection is 

O n = (1.76A V + 2.25A h ) (A0) 1 ' 25 [A7.5.6] 

A0 = 0 T - 


[A7.5.7] 
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where Q n is the heat loss by convection (W); A 8 the tem¬ 
perature difference between the tank wall and ambient air 
(°C); and 0 A the absolute temperature of ambient air (K). 

TheareasAy and A H of tank surface are the exposed areas 
and since the whole of the roof but only part of the walls 
is exposed, A H is based on the whole of the roof surface, but 
Ay is based on only part of the vertical wall surface. 

The equilibrium tank wall temperature 0 T was found to 
be 647 K assuming an emissivity e of 0.5 and did not differ 
by more than 40° C even assuming an emissivity of unity. 
The tank wall temperature is therefore relatively insensi¬ 
tive to estimates of the emissivity. 

The heat loss by radiation is over three times greater 
than that lost by convection at a tank wall temperature of 
650 K. 

The time for the temperature of the tank wall to reach 
steady state was calculated from the unsteady-state equation 


d0T 
mCp df 


= Qi - (Qn + Qr) 


[A7.5.8] 


where c p is the specific heat of the tank wall (J/kg °C); m the 
mass of the exposed tank wall (kg); and / the time (s). 

The thermal capacity me, of the exposed tank wall was 
taken to include half that of the associated perlite insulation. 

Equation A7.5.8 is non-linear and is solved numerically. 
It was calculated that the time for the temperature of the 
wall to reach 95% of its equilibrium value is about 42 min. 


A7.5.9 Evaporation of LNG and ammonia on water 

The spillage and evaporation of LNG and ammonia on 
water is one of the hazard situations considered. The report 
discusses the evaporation rates of LNG and of ammonia 
spilled on water in Part 2, Sections 6 and 7, respectively. 

It is stated that for a rapid spill of LNG on water the 
evaporation time is short and a puff dispersion model is 
applicable. But for a continuous spill the evaporation rate 
rapidly reaches the spill rate and this evaporation rate then 
determines the pool diameter reached. The evaporation rate 
has been determined by a number of investigators as about 
0.19 kg/m 2 s, which corresponds to a liquid regression 
rate of 4.7 xl0“ 4 m/s. 

Similarly, it is stated that for a rapid spill of ammonia 
on water the evaporation time is short and that all the 
ammonia will evaporate, except for about 20% which dis¬ 
solves in the water. 


A7.5.10 Dispersion of an LNG vapour cloud 

The dispersion of an LNG vapour cloud is one of the hazard 
situations considered. The report discusses the dispersion 
of an LNG vapour cloud in Appendix 9. 

A cloud of cold LNG vapour tends to behave as a heavy 
gas cloud. The following elements are identified as par¬ 
ticularly important in describing the behaviour of such a 
cloud: (1) specification of the source, (2) description of the 
gravitational slumping, (3) description of the air entrain¬ 
ment, and (4) description of the thermal effects. 

The model of the source that is assumed can have a sig¬ 
nificant effect on the results. The release may be instanta¬ 
neous or continuous. The source may be of fixed size or of 
increasing size, as with LNG spilled on to water. The pro¬ 
cess of release may or may not involve the entrainment of 
large amounts of air. 


The differences between the various models currently 
available for the gravitational slumping phase are dis¬ 
cussed and it is suggested that these may be due in large 
part to the extent to which air entrainment is taken into 
account. The model of R. A. Cox and Roe (1977) is instanced 
as representative of the new generation of models that take 
into account air entrainment. 

Information is presented on the distance travelled by an 
LNG cloud before it is diluted to the lower flammability 
limit, that is, the hazard range. Experimental work descri¬ 
bed includes 


Source 

Release 

Weather conditions 

API 

1/3-101 

Stable (Pasquill 


on sea 

stability 
category E) 

Shell 

5—50t 

Relatively stable 

AGA 

Spillages in bunds giving 
vapour releases up to 

25 kg/s 



Theoretical work mentioned is that of Cox and Roe of 
Cremer and Warner. 

Hazard ranges derived from these sources are shown in 
Figures A7.3(a) and A7.3(b) for continuous and instanta¬ 
neous releases, respectively. Models for both instantaneous 
and continuous releases may be derived from the experi¬ 
mental work described by estimating values of the disper¬ 
sion coefficients in the Pasquill-Gifford model for an 
instantaneous release and assuming that these coefficients 
are the same for a continuous release. This is the basis for 
the curves shown in Figures A7.3(a) and A7.3(b), except for 
the API 2.5% case, which is based on the work of Feldbauer 
et al. (1972). The lower flammability limit of methane 
is approximately 5% and most of the data shown in the 
figures are for this concentration, but some data are 
shown for a concentration of 2.5%, which allows for local¬ 
ized short-term concentrations up to the lower flammability 
limit (LFL). 

The weather conditions on which the graphs are based 
are neutral conditions (Pasquill stability category D) or 
stable conditions (Pasquill stability category E). For less 
stable conditions the hazard range is less or at worst no 
greater. For Canvey more stable conditions (Pasquill stabi¬ 
lity categories F and G) were not considered, because 
Canvey Island is an urban site and it has been shown that 
over such an area the dispersion of a plume in very stable 
conditions is unlikely to produce airborne concentra¬ 
tions greater than those obtained over open country for 
neutral and stable conditions (Pasquill stability categories 
DandE). 

The quantities of LNG involved in the releases in Figures 
A7.3(a) and A7.3(b) are relatively small. The warning is 
given, therefore, that the use of these graphs for a con¬ 
tinuous release of, say, 10 t/s or an instantaneous release of, 
say, 10001 involves scaling up by two orders of magnitude 
with all the uncertainties attendant on such a procedure. 

Mention is also made of methods for the prediction of 
LNG vapour dispersion based on wind tunnel simulations, 
but it is concluded that the results obtained are subject to 
too great a range of uncertainty to be useful. 
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Figure A7.3 First Canvey Report: hazard ranges for releases of LNG vapour in neutral and stable weather 
conditions (Health and Safety Executive, 1978b): (a) continuous releases - curve 1 API tests model, 2.5% average, 
stable condition; curve 2 API tests model, 5% average, stable condition; curve 3 Shell tests model, 5% average, 
stable condition; (b) instantaneous releases - curve 1 API tests model, 2.5% average, stable condition (Feldbauer 
et al., 1972); curve 2 API tests model, 5% average, stable condition; curve 3 Shell tests model, 5% average, stable 
condition (Courtesy of HM Stationery Office) 
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For the purpose of the hazard assessment, however, it 
was necessary to make estimates of the possible range 
of vapour clouds from marine spillages of LNG. The dis¬ 
tances obtained by scaling up the small spillage data were 
considered too conservative and the following estimates 
were used: 


Spillage (t) 

Maximim range to LFL (km) 

average 

peak 

10 

0.54 

0.7 

100 

1.4 

1.8 

1,000 

3.8 

5.2 

10,000 

10 

10 


The average concentration corresponds to 5% and the 
peak concentration to 2.5 % that, as explained above, allows 
for localized short-term concentrations of double the latter 
value. 

A7.5.11 Unconfined vapour cloud fire and explosion 

An unconfined vapour cloud fire or explosion is considered 
as one of the possible accidents that could be the cause of 
fatalities. The report discusses unconfined vapour cloud 
fire and explosion in Part 2, Sections 4 and 6, and in 
Appendix 1. The treatment given of unconfined vapour 
cloud fire and explosion is broadly as follows. 

Two standard vapour clouds are considered. The first 
contains 1001 and the second 10001 of hydrocarbons. 

Ignition of an unconfined vapour cloud may result in fire 
or in explosion. The fire and explosion characteristics are 
given for the two standard vapour clouds just mentioned. 

Both complex explosion models and a modified TNT 
equivalent model were used to estimate the damage effects 
from an unconfined vapour cloud explosion. 

Only the modified TNT equivalent model is described 
here. This is similar to the usual model, except that the 
relation between peak overpressure and scaled distance is 
modified to allow for the fact that the explosion is that of a 
vapour cloud rather than that of TNT. 

For the energy of explosion an equivalence factor a is 
defined such that the explosion of a flammable gas cloud 
of W t of hydrocarbons with a combustion energy release 
H kcal produces the same damage effects as a TNTexplo¬ 
sion with an energy release of aH kcal. The value of a used 
is 0.1. In other words, it is assumed that 10% of the hydro¬ 
carbons takes part in the explosion. 

For the peak overpressure Ap m and the peak dynamic 
pressure q m at radial distance r and scaled distance r/// 1/3 
the relations used are shown in Figure A7.4. Separate 
curves of Ap m are given for TNT explosion, for hydro¬ 
carbon detonation and for hydrocarbon deflagration with 
a deflagration velocity of 170 m/s. Figure A7.4 is for 
spherical symmetry. Results for explosions with hemi¬ 
spherical symmetry may be obtained by doubling the 
energy release. 

Thus, for example, for a hydrocarbon vapour cloud 
explosion with an energy release a/7 where 

H = 11.1 xl0 6 W kcal 
a = 0.1 


Figure A7.4 gives for hemispherical symmetry 


A Pm 

r{m) 

(psi) (bar) 


3 0.2 

69.1 W 1/3 

1 0.07 

196 W 1/3 


For the two standard hydrocarbon vapour clouds con¬ 
sidered the fire and explosion characteristics used are 
shown in Section A of Table A7.7. The ranges quoted for 
dilution to the LFL are for weather conditions of Pasquill 
stability category D. The overpressures quoted apply only 
to the cases where an explosion occurs. 

The foregoing indicates for the standard hydrocarbon 
vapour clouds considered the estimated hazard ranges of 
fire and of explosion, that is, overpressure effects, where 
these effects occur. 

The probability of ignition of a vapour cloud was taken 
as 0.1 or 1, depending on whether ignition was regarded as 
improbable or probable, taking into account the ignition 
sources between the point of release and the population 
group. 

The probability of deflagration with overpressure in a 
vapour cloud, given ignition, was taken as 1 for large 
clouds (>100 t) of flammable gas, as 0.1 for smaller clouds 
of flammable gas other than methane, and as 0.01 for 
smaller clouds of methane, reflecting the significantly 
lower probability of explosion of a cloud of methane com¬ 
pared with one of other hydrocarbons. 

For the 10001 hydrocarbon vapour cloud it was assumed 
that the whole cloud burns with a fireball approximately 
equal in volume to that of the cloud formed by the stoi¬ 
chiometric gas-air mixture and further that, where over¬ 
pressure occurs, the proportion of hydrocarbon taking part 
in the explosion is 10%. 

If the vapour cloud is ignited in situ, the hazard to the 
public for the situations considered is that of explosion. In 
accordance with the data given inTable A7.7 it was assumed 
that the overpressure at the site boundary would not exceed 
0.2 atm. 

An incidence of 114% is quoted for casualties among 
the population in the areas subject to an overpressure 
between 0.2 and 0.05 atm, which is approximately the level 
of overpressure corresponding to the Explosives Acts 
recommendations. 

If the vapour cloud drifts and is ignited off-site, the 
hazards to the public for the situations considered are those 
of fireball and explosion. For this case, where the cloud is 
ignited and burns fully over the populated region, it was 
assumed that the whole population engulfed in the fireball 
is killed. For the 1000 t hydrocarbon cloud burning fully 
over a populated region with the average population den¬ 
sity of the area, the number of fatalities would be 2000. In 
addition, it was assumed that in this situation there would 
be 100 further fatalities and 2000 serious injuries caused 
by explosion effects out to a radius where the overpressure 
is 0.075 atm. 

The more probable case, however, is ignition when the 
leading edge of the cloud is just beginning to encroach on 
the populated region. 

It was assumed that if for ignition of the cloud on the edge 
of the populated region, the number of casualties is //and 
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Figure A7.4 First Canvey Report: peak overpressure and peak dynamic pressure vs scaled distance for various 
types of explosion (Health and Safety Executive, 1978b) (Courtesy of HM Stationery Office) 


the probability is P, then for ignition right over the populated 
region the number of casualties is 4/Vand the probability is 
0.25 P. It was also assumed that the range of probabilities 
may be represented by a linear probability distribution 
function. The corresponding relationships between the 
numbers of casualties and the probability of these numbers 
are given in Section B of Table A7.7. The number of fatalities 
is taken as half the number of casualties. 

For a hydrocarbon vapour cloud greater than 1000 t it 
was assumed that the number of casualties would vary 
with the mass of vapour according to a 2/3 power law. 

The report discusses unconfined LNG vapour cloud fire 
and explosion in Part 2, Section 6. The following scenarios 
are among those considered: 

Case la Release from storage tank (25 cm diameter 
hole) - vapour cloud of up to 1001 
lb Release from ship’s cargo tank at jetty (25 cm 
diameter hole) - vapour cloud of 1001 


2 Failure of storage tank - vapour cloud of 2001 

3 Failure of ship’s cargo tank - vapour cloud of 
10001 

The fire and explosion characteristics of the vapour clouds 
for these cases are given in Section C of Table A7.7. 

The probability of explosion, that is, overpressure in the 
vapour cloud, was taken as unity only for the larger clouds. 
The explosion effects were again calculated assuming that 
10% of the hydrocarbons take part in the explosion. 

A7.5.12 Ammonium nitrate explosion 

An ammonium nitrate (AN) explosion is considered as one 
of the possible accidents that could be the cause of fatal¬ 
ities. The report discusses ammonium nitrate explosions in 
Part 2, Sections 4.1.2 and 11, and in Appendix 1. 

The ammonium nitrate considered is the storage of 
92.5% aqueous solution in two tanks of 5000 and 2000 t 
capacity, respectively. A large spillage from this storage 
would probably give a mushy heap of ammonium nitrate 
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Table A7.7 First Canvey Report: vapour cloud fire, explosion and casualty characteristics used (after Health and 
Safety Executive, 1978b) 


A Fire an explosion characteristics of hydrocarbon vapour clouds 


Mass of 

Diameter of stoichiometric 

Range of stated 

Range for dilution to 

hydrocarbon (t) 

hemispherical cloud (m) 

overpressure (km) 

lower flammability limit (km) 


Before 

After 

0.2 atm 

0.07 atm 



burning 

burning 

(3 psi) 

(1 psi) 


100 

169 

323 

0.321 

0.910 

2 

1000 

364 

696 

0.691 

1.960 

5 

B Casualty characteristics of a IOOO 1 

t hydrocarbon vapour cloud fire and ei 

tplosion 

Upper limit 






No. of casualty 

0 

1500 

3000 

4500 


No. of fatalities 

0 

750 

1500 

2250 


Cumulative probability 

1 

0.64 

0.35 

0.14 


C Fire and explosion characteristics of an LNG vapour cloud 

Case 

Mass of 

Burnt cloud 

Radius of stated 

Probability of 


hydrocarbon 

radius 

overpressure 


overpressure 


(t) 

(m) 

(m) 






0.2 atm 

0.07 atm 





(3 psi) 

(1 psi) 


1 

100 

162 

321 

910 

0.01 

2 

200 

204 

404 

1147 

1 

3 

1000 

348 

691 

1960 

1 


crystals near the point of release. An escape of 4500 t of 
92.5% solution was considered as the standard case. 

If ammonium nitrate is ignited, the result is normally a 
fire rather than explosion. The latter is likely to occur only 
if conditions are favourable for transition from a fire to an 
explosion. 

These conditions have been investigated theoretically 
and experimentally by van Dolah et d. (BM1966 RI6773) 
and this work is discussed. It is concluded that the work 
indicates that transition to explosion would be impossible 
for quantities of ammonium nitrate of tens of tonnes and 
probably hundreds of tonnes, but that it might occur at the 
thousands of tonnes level. 

The historical record of ammonium nitrate explosions is 
reviewed and explosions of prilled ammonium nitrate in 
transport are quoted, one in rail tank cars at Traskwood, 
Arkansas, in 1960 and one in road tankers in Queensland 
in 1972. 

The only significant possibility foreseen for the occur¬ 
rence of an ammonium nitrate explosion was the derail¬ 
ment of a train carrying petroleum products that could 
cause simultaneously the rupture of an ammonium nitrate 
tank and a liquid petroleum fire. 

The frequency of a derailment and overturning was cal¬ 
culated as follows: 

Frequency of derailment of rail tank car 

s= 1 x 10 _6 /train km 

Number of trains with petroleum products 

= 3000/y 


Length of track opposite tanks «300 m 
Probability of derailment leading to overturning =0.2 
Probability of overturning on tank side of track =0.5 
Frequency of derailment and overturning on tank side of 
track = 8.5 x 10 _5 /y 

In view of the many uncertainties and of the omission of 
other possible accident modes this latter value was also 
taken as the frequency of an ammonium nitrate explosion. 
Thus 

Frequency of ammonium nitrate explosion 
-= 8.5 x 10 _s /y 

The effect of an ammonium nitrate explosion was 
assessed by reference to the data on such explosions given 
by M. A. Cook (1958) and shown in Table A7.8. 

These results were interpreted as follows. It was 
assumed that the predominant reaction in the explosion of 
ammonium nitrate is 

2NH4NO3 = 2N 2 + 4H 2 0 + 0 2 

for which the heat of reaction is 0.35 x 10 6 k cal/t. Then 
using this heat of reaction the values obtained for the 
group r/H 1 ' 3 (m/(kcal) 1/3 ) corrected for spherical symmetry 
for the distance for major damage in the four explosions 
listed lie in the range 1.72-4.8. This spread indicates a lack 
of agreement with the 1/3 power scaling relation, which is 
reduced but not eliminated if a 1/2 power scaling relation 
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Table A7.8 First Canvey Report: some major ammonium nitrate explosions (after Health and 
Safety Executive, 1978b) 


Date 

Location 

Mass of ammonium 

nitrate 

(t) 

Distance for 
major damage 
(m) 

Fatalities 

1918 

Morgan, NJ 

500 

1600 

64 

1923 

Oppau, Germany 

4500 

7000 

1100 a 

1947 

Brest, France 

3000 

5000 

21 

1947 

Texas CityTX 

3500 

2300 

560 


a This value differs from that given by Commentz et al. (1921). 



Figure A7.5 First Canvey Report: lethal exposure time vs 
concentration for chlorine (Health and Safety Executive, 
1978b) (Courtesy of HM Stationery Office) 


is used. The disagreement may be due in part to the relative 
lack of precision in the term ‘serious damage’. If these 
results are located on the curve for overpressure A p m (TNT) 
in Figure A7.4, then, as shown by the full line (line 1) in this 
figure, they correspond to an overpressure of 0.02 bar. This 
is an extremely low overpressure to cause serious damage. 
In view of this dilemma, it was decided to locate the 
ammonium nitrate results at an overpressure of 0.1 bar, as 
shown by the dotted line (line 2) in Figure A7.4, although 
they then lie above the TNTcurve. It is the further dotted 


line (line 3) which is used to calculate the damage ranges 
for explosions of 2250 and 4500 t of ammonium nitrate in 
the report. 

A7.5.13 Toxicity of chlorine, ammonia, hydrogen fluoride 
and lead additives 

The toxicity of chlorine, ammonia, hydrogen fluoride and 
lead additives is considered. The report discusses the toxi¬ 
city of chlorine in Appendices 3 and 12, that of ammonia 
in Appendix 15, that of hydrogen fluoride in Appendix 12 
and that of lead additives in Appendix 19. 

There is considerable uncertainty about the lethal dosa¬ 
ges for all these chemicals and it was necessary, therefore, 
to make approximate estimates. 

Chlorine was not one of the chemicals considered in the 
study to constitute a hazard at Canvey, but its toxicity is 
discussed in relation to factors that mitigate casualties 
from a toxic release and in relation to the toxicity of hydro¬ 
gen fluoride. 

For chlorine the relation between the lethal concentration 
and the time of exposure shown in Figure A7.5 was used. 
This graph is derived from data given by Dicken (1974, 
1975). 

For ammonia a probit equation was used 
Pr = a + Mn D [A7.5.9] 

D=j‘c zn dt [A7.5.10] 

where C is the concentration (g/m 3 ); D the dosage 
((g/m 3 ) 2 ' 75 min); Pr the probit; / the time (min); and a, b are 
constants. 

Precise information on the lethal dosage of ammonia is 
lacking. Two cases were considered. For case A it was 
assumed that a concentration of 1.75 g/m 3 (2500 ppm) is 
lethal to 50 % of the exposed population in 30 min, while for 
case B it was assumed that the same concentration is 50% 
lethal in 60 min. Then the values of the constants are 


Case A 1.14 0.782 

B -7.41 2.205 


For hydrogen fluoride it is necessary to take care with the 
units in which concentration is expressed on account of 
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the high degree of association in the vapour phase. Con¬ 
centrations are therefore expressed in units of mg/m 3 
rather than of ppm. 

Precise information on the lethal dosage of hydrogen 
fluoride is again lacking. Insofar as it is an irritant gas it 
appears to have effects similar to chlorine at similar con¬ 
centrations. The toxicity of hydrogen fluoride was therefore 
assumed for the purpose of the study to be similar to that of 
chlorine at a similar concentration, where the concentra¬ 
tion units are mg/m 3 . 

In addition, however, hydrogen fluoride in large but 
sublethal dosages may also have other injurious long-term 
effects. 

The lead additives are the alkyl lead compounds, par¬ 
ticularly the methyl and ethyl derivatives. 

For lead additives precise information on the lethal 
dosage is again lacking. The medical evidence is reviewed 
in some detail. It is concluded that there is a significant 
probability of fatality at a concentration of 500 mg/m 3 for 
an exposure of 1 h. It is also considered that total dosage is 
more important than concentration so that the concentra¬ 
tion can be scaled inversely with the exposure time for 
exposure times in the range 15-60 min. 


A7.5.14 Dispersion of ammonia and hydrogen fluoride 
vapour clouds 

The dispersion of anhydrous ammonia and hydrogen fluo¬ 
ride gas clouds is one of the hazard situations considered. 
The report discusses the dispersion of an ammonia gas 
cloud in Part 2, Section 7, and in Appendices 4 and 14 and 
that of a hydrogen fluoride gas cloud in Part 2, Section 5.5, 
and in Appendix 12. 

The dispersion of an anhydrous ammonia cloud 
depends on whether it is lighter or heavier than air. The 
following conclusions are reached. If an initial fraction of 
the ammonia released is in the form of suspended drop¬ 
lets, the cloud may become denser than air as it is dilu¬ 
ted. There will be a critical value for the initial fraction of 
droplets such that if the fraction is below this value the 
cloud will be less dense than air regardless of the humid¬ 
ity of the air. There will be a second critical value such 
that if the fraction is above this value the cloud will be 
more dense than air regardless of the humidity of the air. 
These two critical values are given, respectively, as 4-8% 
and 16-20% of the total mass of ammonia. Between these 
critical values the density of the cloud is determined by 
the degree of dilution and humidity of the air. High values 
of the air humidity favour low cloud densities and vice 
versa, since water in the atmosphere will tend to freeze 
and so liberate latent heat. 

The possible chemical reactions of anhydrous ammonia 
with the water and the carbon dioxide in the air to give 
ammonium hydroxide and ammonium bicarbonate and 
carbonate are also reviewed, but it is concluded that it 
seems unlikely that any such reaction will be a significant 
effect, although in foggy or rainy conditions it may convert 
some ammonia to a less toxic form and so effect some 
reduction in the hazard. 

The historical record of anhydrous ammonia releases is 
reviewed and those at Blair, Conway, Potchefstroo and 
Houston are quoted. In all these cases the ammonia cloud 
appears to have behaved as denser than air. 

The emission and dispersion of a release of 1000 t of 
anhydrous ammonia from pressurized storage at 6°C in 


weather conditions of Pasquill stability category D and 
wind speed of 3 m/s were calculated. 

For emission it was assumed that the whole mass of 
1000 t of ammonia is released virtually instantaneously, 
that 20% of the ammonia forms vapour and that the 
remaining 80% forms liquid droplets, so that the whole 
amount spilled is airborne. 

The escaping ammonia will entrain air. There is little 
information available on this aspect, although the Potch- 
efstroom accident provides some evidence. There some 401 
of ammonia were released and eyewitness accounts stated 
that ‘the immediate resulting gas cloud was about 150 m in 
diameter and nearly 20 m in depth’. This corresponds 
approximately to an air-ammonia mass ratio of about 10 if 
all the ammonia was airborne and visible. If it is assumed 
that in the scenario considered enough dry air is mixed 
with the ammonia to vaporize all the liquid ammonia, 
leaving an air-ammonia mixture at the boiling point of 
ammonia, the corresponding air-ammonia mass ratio is 
about 20. 

The following conditions were taken, therefore, as the 
source for the dispersion model. The release is 1000 t of 
anhydrous ammonia. This forms a vapour cloud with an 
air-ammonia mass ratio of 20 at a temperature of -33°C 
and with a density of 1.42 kg/m 3 . This density is greater 
than that of air at 20°C by a factor of 1.18 so that the cloud 
is denser than air. Both the radius and height of the cloud 
are 167 m. 

For dispersion it was assumed that the behaviour of 
the vapour cloud is described initially by a heavy gas 
slumping model and then by a neutral gas dispersion 
model. This follows the approach developed by van Ulden 
(1974). 

For slumping, van Ulden’s model is used 

d. = AP0-Pa)^ 1/2 [Amll] 

at \ p 0 ) 

h = Vo/nr 1 [A7.5.12] 

r 2 - rg = 2 [ ^ P ° ~ p a)gV ° ) *] ' [A7.5.13] 

where g is the acceleration due to gravity; h the height of 
the cloud; r the radius of the cloud; r a the initial radius of 
the cylinder; t the time; V 0 the initial volume of the cylin¬ 
der; p a the density of air; and p„ the initial density of the 
cloud. 

The termination of slumping depends in this model on 
the turbulent energy density and hence on the surface 
roughness length. For a roughness length z D of 10 cm the 
predicted height h at termination of slumping is 0.15 m. For 
the purposes of this approximate calculation the height h at 
termination of slumping was taken as 1 m. 

The state of the cloud at termination of slumping is 
then as follows. The radius is 2170 m, the height is 1 m, the 
density is 1.42 kg/m 3 . The time taken is about 12 min and 
the distance travelled with the wind speed of 3m/s is about 
2.6 km. 
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This model predicts, therefore, that the cloud radius 
becomes very large and that the cloud travels far down¬ 
wind. The cloud travel distance is regarded as pessimistic, 
because it is to be expected that at a height of 1 m the cloud 
will he slowed down by various obstacles. 

For further dispersion the Pasquill-Gifford model for a 
neutral buoyancy gas was used 

X(X ' y;t) = (2nfZ x a y a z 

[A7.5.14] 

a x = <Ty [A7.5.15] 

where x y and z are the distances in the downwind, cross- 
wind and vertical directions (m); Q * the mass released 
instantaneously (kg); t the time (s); u the wind speed (m/s); 
a x , <s y and a z the standard deviations, or dispersion coeffi¬ 
cients, in the downwind, crosswind and vertical (x,y,z) 
directions (m); and x the concentration (kg/m 3 ). The down¬ 
wind distance x is measured from the source. At the termi¬ 
nation of slumping it was assumed that the cloud has a 
Gaussian concentration distribution with the 10% edges of 
the cloud equal to the edges of the slumped cloud. Then at 
transition 

r = 2.14oy [A7.5.16] 

h = 2.14o> [A7.5.17] 

The maximum concentration on the axis at a downwind 

distance x occurs when the centre of the cloud is at that 
point so that 

x = ut [A7.5.18] 

and hence 

20* 

WW = (2 nf^cy* z [A7 ' 519] 

The mean concentration z av (*) along the axis is related to 
the maximum concentration z max M as follows: 

XavW = 0.585 * max (*) [A7.5.20] 

The mean concentrations calculated for the release con¬ 

sidered are given in Figure A7.6. Figure A7.6(a) shows the 
mean concentration as a function of downwind distance 
and Figure A7.6(b) the mean concentration as a function of 
exposure time. 

The distance at which the ammonia cloud is potentially 
lethal is obtained from Figure A7.6. If it is assumed that 
the ammonia is potentially lethal at a concentration of 
0.002 kg/m 3 for a period of 30-50 min, the range of poten¬ 
tial lethality of the cloud is 5 km from the point at which 
slumping is terminated. This point is itself 2.6 km from the 
source. 


Cloud behaviour was also investigated for other weather 
conditions. 

The approximate area within which people are at risk 
from an instantaneous release of 1000 t of anhydrous 
ammonia in weather conditions of Pasquill stability cate¬ 
gory D and wind speed of 6 m/s is shown in Figure A7.7. 

The model just described is a relatively crude one. Fur¬ 
ther, more sophisticated models were derived which took 
into account (1) the heating of the cloud and (2) the 
entrainment of air during the slumping phase. These 
models indicated that the overall behaviour of the cloud is 
not greatly altered by these effects and that the original 
model gave a sufficient representation for approximate 
calculations. 

The dispersion of a hydrogen fluoride gas cloud also 
depends on whether it is lighter or heavier than air. 
Hydrogen fluoride monomer has a molecular weight of 20, 
which suggests that the gas should be lighter than air. But 
hydrogen fluoride gas is highly associated, forming in 
particular the hexamer. Although dissociation takes place 
as the gas is diluted, the process is endothermic so that 
cooling occurs. Thus the behaviour of a hydrogen fluoride 
gas cloud is in some ways analogous to that of an ammonia 
gas cloud. 

The approach adopted was to treat the hydrogen fluoride 
cloud as denser than air. 


A7.5.15 Factors mitigating casualties from a toxic release 

Large toxic releases are considered as one of the possible 
accidents which could be the cause of fatalities. Theoretical 
estimates of large toxic releases tend, however, to give 
rather large numbers of fatalities and to appear pessimistic 
compared with the historical record. Consideration was 
therefore given to the factors mitigating casualties from a 
toxic release. 

The report discusses mitigating factors for a toxic 
release in Appendix 3. 

The historical record of chlorine releases is reviewed. 
The releases listed by Simmons, Erdmann and Naft (1974) 
are quoted, as are the releases at Zarnesti, Roumania, in 
1939 and at Baton Rouge, Louisiana, in 1976. 

The following features are adduced as factors that may 
mitigate the effects of a chlorine release: 

(1) low population density downwind of the source, parti¬ 
cularly within the first kilometre or so; 

(2) favourable weather conditions; 

(3) low rate of release; 

(4) escape; 

(5) shelter. 

It is possible to make a quantitative estimate of the effect 
of these factors. There are other factors such as 

(6) topography 

which may also be important, but which in the present state 
of knowledge cannot be readily assessed. 

A series of calculations was done for a 20 t chlorine 
release over periods of 6 s, 10 min and 6h in weather condi¬ 
tions of Pasquill stability category D and with a wind speed 
of 5 m/s. 

The calculations were based on the Pasquill model for 
short continuous releases, as given in Equation 15.16.31, 
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(a) 



Figure A7.6 First Canvey Report: mean concentration vs distance and exposure time for an instantaneous release of 
WOO te of anhydrous ammonia (Health and Safety Executive, 1978b): (a) mean concentration vs distance and (b) mean 
concentration vs exposure time (Courtesy of HM Stationery Office) 


using the graphs presented by Bryant (1964 UKAEA 
AHSB(RP) R42 Figure 4). This model may be adapted to the 
determination of the time of passage and the dosage from a 
nearly instantaneous release, as follows.The time of passage 


for an instantaneous release is obtained as the times 
between the concentration rising to, and subsequently 
falling back to, one-tenth of its maximum value. This time 
of passage is corrected for a nearly instantaneous release 
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Figure A7.7 First Canvey Report: approximate area 
within which people are at risk from an instantaneous 
release of 1000 te of anhydrous ammonia (Health and 
Safety Executive, 1978b) (Courtesy of HM Stationery 
Office) 


by adding to it the time of release. For the dosage use is 
made of the fact that Equation 15.16.31 gives the total 
dosage for an instantaneous release, as described in Chap¬ 
ter 15. The model applies strictly to short releases of 
approximately 3 min duration. No account was taken, 
therefore, of plume broadening with duration of release, but 
it was believed that this effect would be small for the 
stability condition considered. 

For various points on the downwind axis of the cloud, 
calculations were made of the dosage and of the time of 
passage, and by dividing the former by the latter, of the 
mean concentration. The chlorine toxicity data given in 
Figure A7.5 were used to determine for each mean con¬ 
centration the corresponding lethal exposure time. If the 
lethal exposure time was less than the time of passage, then 
the cloud was assumed to be fatal to a person remaining in 
the open air at that point. 

The results of the calculations are summarized in 
Figures A7.8(a—c), which show the mean concentration, the 
time of passage and the lethal exposure time vs distance 
for the three releases studied. 

The distances at which the time of passage and lethal 
exposure time cross over are the lethal distances, or hazard 
ranges, of the clouds. These distances are 2.7, 1.9 and 
0.6 km for release times of 6 s, 10 min and 6 h, respectively. 
The variation of the lethal range is due entirely to the 
slope of the line of lethal concentration vs exposure time in 
Figure A7.5, which is a log-log plot. If the slope were -1 
instead of approximately -2, there would be no variation 
of distance. 

The effects of the mitigating factors are discussed in the 
light of these results. 

For population density the effect of low population 
density is as follows. In a UK urban area with a popula¬ 
tion density of about 5000/km 2 the numbers in a 15° 


sector would be about 650, 2650 and 6000, while in a UK 
rural area with a population density of about 100/km 2 
the corresponding numbers would be 13, 53 and 120 
within distances of 1, 2 and 3 km, respectively. Thus it is 
estimated that a rapid release of 20 t of chlorine gas 
could kill up to 6000 in an urban area and up to 120 in a 
rural area. 

The effect of more favourable weather conditions was not 
calculated. It was considered that, in view of the uncer¬ 
tainties in gas dispersion estimates, calculations for other 
weather conditions were not justified. 

The effect of a lower rate of release is to reduce the esti¬ 
mated number of fatalities. The values may be calculated 
from the data given. 

The effect of escape was estimated by calculating the 
time for a man to walk out of the cloud. It was assumed 
that if the axial concentration is lethal for the time of 
passage of the cloud, the concentration halfway out of the 
cloud may be considered only injurious and that at the 
edge of the cloud, defined as 10% of that of the centre, 
relatively harmless. It was assumed that the man would 
walk out of the cloud across wind at a speed of 3 mile/h 
(1.34 m/s). Escape was assumed if the time to walk from 
the cloud centre to the cloud edge was less than the lethal 
exposure time at the axial concentration. The times to 
walk out are shown in Figures A7.8(a-c). The distances 
at which the time to walk out and the lethal exposure 
time curves cross are the lethal distances of the clouds 
allowing for escape. For the release time of 6 s the lethal 
range remains 2.7 km, but for the release times of 10 min 
and 6 h it is reduced to 1.1 km and less than 100 m, 
respectively. 

The effect of shelter was estimated using the equation 

C = Qfl - exp( -Xt )] [A7.5.21] 

where C is the concentration indoors; C 0 the concentration 
outdoors; t the time; and X the number of air changes per 
unit time. 

The value of X is about one change per hour for a modern 
centrally heated building, but in general can be two or three 
changes per hour, particularly if doors or windows are 
open. Assuming that shelter with one air change per hour is 
used, for a 6 s release the cloud is lethal at 100 m, but not at 
200 m, and for a 10 min release it is lethal at 300 m, but not 
at 500 m. For a 6 h release the concentration in the building 
rises to that outside it after 1 h and the cloud is lethal at 0.6 
km as before. Thus shelter is very effective for the release 
time of 6 s and quite effective for the release time of 10 min, 
but is ineffective for the release time of 6 h. In the latter 
case, however, escape is relatively easy. 


A7.5.16 Road tanker hazards 

A road tanker accident is considered as a possible initiating 
event for release of flammable and toxic materials. The 
report discusses road tanker accidents in Part 2, Section 14, 
and in Appendix 18. 

The nature of the hazard from a road tanker accident is 
not discussed in as much detail as that from some of the 
other hazards. Mention is made of the possibility of a 10 t 
spillage of flammable material which could give rise to 
a fire (p. 96) and of spillage of LPG which could give rise to 
a 14 t cloud which could travel 200 m and still remain 
flammable (p. 178). 
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Figure A7.8 First Canvey Report: mean concentration, lethal exposure time, time of passage and time to walk out vs 
distance for a 201 release of chlorine with various release times (Health and Safety Executive, 1978b): (a) release time of 
6 s; (b) release time of Wmin and (c) release time of 6 h (Courtesy of HM Stationery Office) 
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The frequency of spillage is estimated from data recorded 
by HM Inspector of Explosives on accidents resulting in 
loss of life and personal injury and involving the contents of 
petrol tankers. These records indicated that over the past 
5 years there were on average five accidents per year that 
led to a spillage. But from statistics published by the DoE 
(1976) the quantity of petroleum products moved by road is 
4.3 x 10 9 1 km. Then since the average tanker load is 141 

Frequency of petrol tanker accident involving spillage 

■«= 1.6 x 10 _8 /km 

Tankers carrying LPG are stronger than petrol tankers, 
but the conservative assumption was made that the fre¬ 
quency of accidents involving spillage is the same for LPG 
tankers as for petrol tankers. 

The frequency of spillage from all hazardous materials 
transported by road from the British Gas Corporation, 
London and Coastal Wharves, and Texaco was then esti¬ 
mated as 1.4 x 10~ 3 .The contribution of flammables to this 
figure is the largest, that of toxics being relatively small. 

A7.5.17 Evacuation 

The mitigating effect of evacuation was also considered. 
The report discusses evacuation in Part 1, Section 10, and 
in Part 2, Section 16. 

There are two respects in which the evacuation situation 
at Canvey Island is unusual. There are only two roads 
leading off the island, and these converge at a single 
roundabout, and there exist already plans for evacuation in 
the event of flooding by the sea. 

The need for an additional road off the island has been 
the subject of debate in the area. 

The evacuation process was modelled. An exponential 
model was used in which it was assumed that half the 
population is moved to safety in the first 2 h, half of the 
remainder in the next 2 h and so on. 

Evacuation was found to be possibly beneficial in one or 
two types of emergency. In particular, consideration was 
given to evacuation in the event of a large release of ammo¬ 
nia from a ship collision or jetty incident. For the majority 
of emergencies, however, it is suggested that it would be 
better to remain indoors rather than to attempt evacuation. 

Such evacuation would require prior planning. The 
existing arrangements for evacuation for flooding would 
not necessarily suffice, since the advance warning from a 
chemical emergency is likely to be less. 

Similarly, the provision of an additional road was seen as 
beneficial for the same types of incident, but it was consid¬ 
ered that the construction of such a road could not be recom¬ 
mended solely for evacuation without further discussion. 

A7.6 First Canvey Report. Assessed Risks and 
Actions 

The hazards described in Section A7.3 were assessed using 
appropriate failure and event data as described in Section 
A7.4 and hazard models and risk estimates, including those 
described in Section A7.5. The accidents that might occur, 
the nature and frequency of the initiating events and the 
frequency-number relations for casualties, or societal 
risks, are shown in Table A7.9. 

The results of the risk assessments are presented by the 
investigators as risks of causing casualties, that is, severe 
hospitalized casualties or worse. This is in accordance 
with established practice (e.g. Department of Defense, n.d.; 


Glasstone, 1964). It was considered misleading to attempt 
to distinguish between severe injury and death. 

These results have several interesting features. The 
hazards may be ranked for societal risks in order of des¬ 
cending frequency for accidents of different magnitude as 
shown in Table A7.9. 

The hazard arising from the very large quantities of LNG 
stored is a serious one, but is no worse than that from the 
considerably smaller quantities of LPG. 

The obvious hazards of LNG, LPG and ammonia are 
equalled by others, such as oil and hydrogen fluoride, 
which are perhaps less well appreciated. 

The relative importance of the hazards changes with the 
scale of the accident. For the smaller scale accidents oil 
spillage, flammable vapour clouds and toxic gas clouds are 
all important. As the scale increases, it is the toxic gas 
clouds that dominate. 

There are a number of interactions identified both 
within sites and between sites. These include the threat to 
LPG storage at Mobil from the Calor Gas site, to the oil 
storage at Texaco from explosives barges, to the ammonia 
sphere at Fisons from rotating machinery and from the 
ammonium nitrate plant at Fisons, to various installations 
from process and jetty explosions, and possibly to the 
ammonia storage tank at Shell from explosion in the Shell 
refinery. 

The relative hazard of the pressure storage of anhydrous 
ammonia at Fisons is much greater than that of the refri¬ 
gerated storage of the same chemical at Shell. The risk for 
the latter was assessed as negligible with the possible 
exception of rupture by an explosion. 

The assessed societal risks are shown in Table A7.9 and 
in Figure A7.9. Figure A7.9(a) gives the societal risks for all 
the existing installations. It shows that the risk of an acci¬ 
dent causing more than 10 casualties is 31 x 10 _4 /y. Figure 
A7.9(b) gives the societal risks for all the proposed devel¬ 
opments. It shows that the risk of an accident causing more 
than 10 casualties is 16 x 10 _4 /y. 

The assessed individual risks are given for all the 
existing installations. These range from 13 x 10 _4 /y in 
region A to less than 1 x 10 _4 /y in region G of the area. The 
individual risks are also given for all the existing instal¬ 
lations and proposed developments. These range from 
26.3 x 10 _4 /y in region A to less than 2 x 10 _4 /y in region G 
(Table A7.10). 

The investigators made a number of recommendations 
for the reduction of the hazards. These included 

(1) oil spillage — construction of a simple containing 
wall around the London and Coastal Wharves and 
Texaco sites and the proposed Occidental and UR 
refinery sites; 

(2) LNG tank flooding - construction of a dike; 

(3) spontaneous failure of LPG spheres - high stand¬ 
ard of inspection; 

(4) LPG vessel rupture by missile (Mobil) - measures 
including fitting of pressure relief valves on cylin¬ 
ders at Calor Gas depot; 

(5) LPG tank failure at BG jetty - improvement of 
bund; 

(6) LPG pipeline failure (BG) — removal of pipeline; 

(7) spontaneous failure of ammonia sphere - high 
standard of inspection, control of ammonia purity; 

(8) ammonia release at Shell jetty — provision of water 
sprays at jetty; 



Table A7.9 First Canvey Report: principal hazards identified at Canvey and associated societal risks (after Health and Safety Executive, 1978b) 


Hazardous Company Initiating event Type of accident Frequencies in units of10~ 6 (year 

material - 

Frequency of Frequencies for number of offsite casualties 

initiating event exceeding 


10 1,500 3,000 4,500 6,000 12,000 18,000 


Oil 


LNG 


LPG 


LNG and 

LPG 

LPG 


L&C,Texaco Explosion at BG jetty 

Explosion at 
Occidental jetty 

Texaco Explosion of stranded 

explosives barge 
Explosion of stranded 
explosives barge and 
breaching of sea wall 

Occidental Explosion in process area 

Occidental, UR LPG explosion due to 

spontaneous failure of sphere 
Refinery fire 
Subtotal 


Oil spillage over bund 


British Gas 


Incident at BG jetty 
(spillage, ship collision, fire, 
explosion) 

LNG ship collision 
Flooding of tanks 
Spillage over bund of 
above-ground tanks 
Spillage into bund of 
above-ground tanks 
Subtotal 

Explosion at BG jetty 
Pipeline failure 
Subtotal 


LNG vapour cloud 


3,600 

2,500 


100,000 

2,000 


Spontaneous failure of vessel 
Missile from storage area 
Shock wave from filling point 


1,230 1,000 500 

50 35 17 

6 4 3 

25 18 8 

30 20 10 

25 18 8 

1,366 1,095 546 

168 118 83 

5 3 1 

106 70 37 

56 33 17 

162 

497 224 138 

520 320 160 

450 

970 320 160 

1467 544 298 

184 110 60 


130 

7 

2 1 

4 

4 

3 

150 1 

56 37 16 

0.5 0.3 0.2 

14 
10 

80 37 16 

80 

80 

160 37 16 

25 


7 

0.1 


7 


3) 

m 

TJ 

o 

3) 

-H 

CO 







Table A7.9 (continued) 


Hazardous Company Initiating event Type of accident Frequencies in units of 10~ 6 /year 

material - 

Frequency of Frequencies for number of offsite casualties 

initiating event exceeding 







10 

1,500 

3,000 

4,500 

6,000 

12,000 

18,000 



Interaction from Calor Gas; 


4,100 

87 

50 

24 

12 






sphere failure 

Interaction from Calor Gas; 


1,200 J 










pipework failure 











Shell, Mobil 

Fire or explosion at jetty 


5,700 

69 

43 

30 

15 





Occidental 

Spontaneous failure of vessel 


90 

3 

2 

1 







Fire or explosion at jetty 


4,000 

80 

50 

28 

11 





UR 

Spontaneous failure of vessel 


70 

18 

8 

4 

2 





- 

LPG ship collision 


6,640 

196 

124 

64 

31 






Subtotal 


23,745 

637 

387 

211 

96 




Ammonium 

Fisons 

Rail accident 

Ammonium nitrate 

85 

85 

85 

85 

17 

17 



nitrate 



explosion 









Anhydrous 

Fisons 

Spontaneous failure of sphere 

Ammonia 

100 

68 

40 

28 

21 

15 

7 

3 

ammonia 


Missile from rotating machine 

vapour cloud 

30 -i 










Explosion in process area 


100 

► 204 

120 

84 

73 

47 

21 

9 



Rail accident 


135 J 









Shell 

Fire or explosion at jetty 


400 

228 

132 

96 

68 

40 

32 

20 



Ammonia ship collision 


375 

235 

153 

122 

96 

72 

54 

41 



Subtotal 


1,140 

735 

445 

330 

258 

174 

114 

73 

Hydrogen 

Shell 

Intrinsic failure of pressure 

Hydrogen fluoride 

200 >. 








fluoride 


circuit 

Missiles from neighbouring 

vapour cloud 

200 

\ 125 

100 

80 

75 

70 

35 

15 



plant 

Adjacent vapour cloud 


100 * 










explosion 











Mobil 

Intrinsic failure of pressure 


100 . 









(inc. extension) 

circuit 

Missiles from neighbouring 


100 1 

l n 

99 

72 

51 

30 

24 

15 



Adjacent vapour cloud 


100 J 

I 









explosion 











Occidental 

Intrinsic failure of pressure 


100 ) 

168 

144 

132 

120 

114 

80 

70 



circuit 

Missiles from neighbouring 
plant 

Subtotal 


100 

464 

343 

284 

246 

214 

139 

100 


5) 

rn 

TJ 

O 

3) 

-H 

CO 
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Figure A7.9 First Canvey Report: societal risks for existing installations and proposed developments (Health and 
Safety Executive, 1978b): (a) all existing installations and (b) all proposed developments (Courtesy of HM 
Stationery Office) 


(9) HF plant rupture (Mobil, Occidental) — provision of 
water sprays; 

(10) ship collision - strict enforcement of the speed 
restriction of 8 knot; 

(11) road tanker hazards - road tanker traffic restric¬ 
tion to new road only (if road built). 

The assessed effect of the proposed modifications is to 
eliminate the hazards from oil spillage, from LPG vapour 
cloud due to explosion at the jetty and pipeline failure at 
British Gas, and from vessel rupture at Mobil due to mis¬ 
siles from Calor Gas, and to reduce greatly many of the 
other hazards. 


The rank order for societal risk of the hazards assuming 
that the proposed modifications are carried out is then as 
shown in Table A7.ll. Oil spillage and LPG vapour cloud 
(BG) are eliminated. 

There are some hazards, however, which remain rela¬ 
tively difficult to eliminate. In particular, spontaneous 
failure of storage vessels, jetty incidents and ship collisions 
make large contributions to the residual risks. 

The effect of the proposed modifications on the societal 
risks for the existing and proposed installations is given in 
Figure A7.9. This shows that the risk of an accident causing 
more than 10 casualties is 9 x 10 _4 /y for the existing instal¬ 
lations and 2 x 10 _4 /y for the proposed developments. 
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Table A7.10 First Canvey Report: rank order of societal risks for some principal hazards of existing and proposed 
installations at Canvey (after Health and Safety Executive, 1978b) 

Frequencies in units oflO~ 6 /year 


>10 casualties >4,500 casualties >18,000 casualties 


1 

Oil spillage 

1366 

1 

Ammonia vapour cloud 

258 1 

HF vapour cloud 

100 

2 

LPG vapour cloud (BG) 

970 

2 

HF vapour cloud 

246 2 

ammonia vapour cloud 

73 

3 

Ammonia vapour cloud 

735 

3 

Oil spillage 

150 3 

LNG vapour cloud 

7 

4 

LPG vapour cloud (others) 

637 

4 

LPG vapour cloud (other) 

96 



5 

LNG vapour cloud 

497 

= 5 

LNG vapour cloud 

80 



6 

HF vapour cloud 

464 

-5 

LPG vapour cloud (BG) 

80 



7 

AN explosion 

85 

7 

AN explosion 

17 




Table A7.11 First Canvey Report: rank order of societal risks for some principal hazards of existing and proposed 
installations at Canvey, after improvements suggested (after Health and Safety Executive, 1978b) 


Frequencies in units of 10 6 (year 

>10 casualties 


>4,500 casualties 


>18,000 casualties 

1 LPG vapour cloud (other) 

421 

1 Ammonia vapour cloud 

71 

1 HF vapour cloud 24 

2 LNG vapour cloud 

396 

2 HF vapour cloud 

67 

2 Ammonia vapour cloud 18 

3 Ammonia vapour cloud 

240 

3 LNG vapour cloud 

66 

3 LNG vapour cloud 7 

4 HF vapour cloud 

115 

4 LPG vapour cloud (other) 

63 


5 AN explosion 

8 

5 AN explosion 

2 



The assessed individual risks are given for all the exist¬ 
ing installations after the proposed modifications. These 
range from 6 x 10 _4 /y in region A to less than 1 x 10 _4 /y in 
region G. The individual risks are also given for all the 
existing installations and proposed developments, after 
the proposed modifications. These range from 9 x 10 _4 /y 
in region C to less than 1 x 10 _4 /y in Region G. 

The risk to an individual member of the public at Canvey 
may be compared with the average risk to workers in 
British industry. For the latter the fatal accident rate (FAR) 
per 10 s exposed hours, is 4. If it is assumed that a man 
works 2000 h per year, then the FAR is equivalent to an 
individual risk of 0.8 x 10 _4 /y. 

A7.7 First Canvey Report: Responses to Report 

A7.7.1 Response of HSE 

The HSE accepted the report as a significant step forward 
in quantitative risk assessment, while acknowledging that 
there were some deficiencies. 

It concluded that provided certain improvements were 
carried out, none of the existing installations need cease 
operations and the proposed developments could take 
place. 

A7.7.2 Response of other parties 

An account of some of the other responses to the report is 
given by the HSE in the Second Canvey Report, described 
below. 

Publication of the report led to a surge of interest both 
locally and at national and international levels. HSE 
attended a public meeting at Canvey and explained the 


report. While the determination of the risks was welcomed, 
there was criticism of HSE’s decision to allow continued 
operation of the existing installations, subject to the 
modifications. 

The HSE gave a summary of some criticisms made of the 
report by various parties. One was that the report over¬ 
estimates the risks. The assessors were required by HSE 
not to err on the side of optimism. Many in the industry, 
however, considered that it is preferable to adopt a ‘best 
estimate’ approach and that a conservative method which 
involves making a pessimistic estimate at each stage where 
there is doubt is liable to give a gross overestimate of the 
risks. 

The HSE was also criticized in appearing to acquiesce in 
risks, some of which had been assessed as relatively high. 
On this the HSE draws attention to its requirement that 
improvements be made. It goes on. 

HSE strongly believes that it has a duty, as the body 
charged with enforcing health and safety legislation, to 
express opinions about what may be required by that leg¬ 
islation. In HSE’s view it is not sufficient merely to identify 
the risk to health and safety without also recommending a 
course of action. 

A critique of the First Canvey Report was published by 
Cremer and Warner (1980). 


A7.7.3 General comments 

An investigation of the kind described has perhaps an 
inevitable tendency to suggest that the hazards revealed 
were previously unappreciated. In fact companies involved 
in such a survey are generally very well aware of the 
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hazards and have taken the measures that they consider 
appropriate. 

The report itself expresses some reservations on the risk 
estimates and states: ‘Practical people dealing with indus¬ 
trial hazards tend to feel in their bones that something is 
wrong with risk estimates as developed in the body of the 

At the time, the industry in the United Kingdom was 
conscious particularly of the Flixhorough explosion. This 
has been dwarfed by subsequent disasters such as those at 
Mexico City, Bhopal, Ufa and Piper Alpha. 


A7.8 Second Canvey Report 

In 1981 there appeared the Second Canvey Report entitled 
Canvey: A Review of Potential Hazards from Operations in 
the Canvey Island/Thurrock Area Three Years after Publica¬ 
tion of the Canvey Report (HSE, 1981a). This again was 
in two parts, with Part 1 an introduction by the HSE and 
Part 2 the SRD study. 

In Part 1 HSE outlines the criticism of the first report, as 
just described, and gives its conclusions concerning the 
reviewed assessment. 

In the next two sections, accounts are given of the reas¬ 
sessed risks and actions and of some technical aspects of 
the second report. 


A7.9 Second Canvey Report: Reassessed Risks and 
Actions 

The risks assessed in the Second Canvey Report are gen¬ 
erally less than those in the first report. Thus, for example, 
at Stanford-le-Hope the individual fatality risk is given as 
0.6 x 10 4 /y, as opposed to 5 x 10 _4 /y in the first report, a 
reduction by a factor of 8. 

The HSE in Part 1 adduce the following reasons for 
this: (1) physical improvements already carried out; 
(2) changes in operation; (3) detailed studies by companies; 
(4) changes in assessment techniques; (5) correction of 
errors and (6) further changes firmly agreed but yet to 
be made. 

One major change in operation was the cessation of 
ammonia storage at Shell. 

In a number of cases in the first report, estimates of the 
risks had to be made without benefit of detailed studies. 
Subsequent studies by the companies involved showed that 
in some cases the risks had been overestimated. A case in 
point was the limited ammonia spill at Fisons. 

In a large proportion of cases the effect of the use of 
improved models for heavy gas dispersion was to reduce 
the travel distance of the cloud and hence the risks. 


The HSE describe a number of further actions taken or 
pending to reduce the risks. 


A7.10 Second Canvey Report: Technical Aspects 

The Second Canvey Report revisits some of the frequency 
estimates and gives a revised set of hazard models and 
injury relations, covering the following aspects: (1) emission; 
(2) gas dispersion; (3) ignition; (4) fire events (5) vapour 
cloud explosions and (6) toxic release. 

A7.10.1 Pressure vessel failure 

The report reviews the frequency of spontaneous failure 
of pressure vessels, in the light of a further survey of the 
failure rate of such vessels by T.A. Smith and Warwick 
(1978) (see also Smith and Warwick 1981 SRD R203). The 
use of a failure rate of 10 5 /y is reaffirmed. 

A7.10.2 Emission models 

The set of emission models given covers the following 
cases: 

(1) rupture of a pressure vessel; 

(2) flow from a pipe: 

(a) non-flashing liquid; 

(b) flashing liquid; 

(c) gas. 

The model for emission following rupture of a pressure 
vessel containing liquefied gas is the adiabatic flash. 

A7.10.3 Vaporization model 

Vaporization of a pool of liquefied gas is treated using the 
SRD code SPILL, which can be applied to instantaneous or 
continuous releases. 

A7.10.4 Gas dispersion models 

Most of the liquefied gases studied exhibit heavy gas 
behaviour on release. For these use is made of the SRD 
codes DENZ and CRUNCH for instantaneous and con¬ 
tinuous releases, respectively. 

The report gives some results from these models in the 
form of tables of distance to the LFL and HLFL for releases 
of propane and butane. As described in Chapter 15, a cor¬ 
relation model for heavy gas dispersion based on such 
tables has been developed by Considine and Grint (1985). 

A7.10.5 Ignition models 

The report gives several sets of ignition probabilities. 
It distinguishes three distinct cases of gas cloud 


Delay before ignition 

Cloud composition 

Likely consequence 

Seconds 

Droplets entrained, cloud likely 
to be rich 

Fire burning around edge of cloud 
(possibly leading to a fireball) 

Minutes 

Gas well mixed with air, likely 
to be in flammable range 

Flash fire or explosion 

An hour 

Gas well diluted with air, 
likely to be lean 

Hazard unlikely, though some flammable 
gas pockets possible 
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Table A7.12 Second Canvey Report: some ignition 
probabilities for a flammable vapour cloud (after Health 
and Safety Executive, 1981a) 


A Ignition on site 

Sources of ignition 

Ignition probability 


None 

0.1 


Very few 

0.2 


Few 

0.5 


Many 

0.9 


B Ignition at jetty 

Delay before ignition 

Probability of ignition following 


Fire/explosion 

Collision 

Immediate ignition 

0.6 

0.33 

(within 30 seconds) 
Delayed ignition 

0.3 

0.33 

(delay 14 to 
several minutes) 



No ignition (within 

0.1 

0.33 

a few minutes) 



C Ignition in transit 

Terrain 

Ignition probability 


Open land 

0 


Industrial site 

0.9 


D Ignition over populated area 

Type of ignition 

Ignition probability 


Edge/edge: edge of 

0.7 


unignited cloud 
just reaches edge 
of populated 



area when 



ignition occurs 
Central: unignited 

0.2 


cloud right 



over population 



when ignition 



occurs 



No ignition 

0.1 



dispersion: ignition may occur (1) at source, which may be 
(a) on site or (b) at a jetty; (2) in transit or (3) over a populated 
area. Table A7.12 shows some of the ignition probabilities 
given for a flammable gas cloud in these situations. The 
values are based partly on data on the proportion of releases 
ignited given by Science Applications Inc. (SAI) (1974) and 
D.C. Wilson (1980) and partly on judgement. 


A7.10.6 Fire models and injury relations 

The report gives a set of models for the following fire 
events: (1) pool fires; (2) fireballs; (3) BLEVEs; (4) flash 
fires. 


Delay before ignition Liquefied gas release 



Refrigerated 

Pressurized 

Immediate ignition 

Pool fire 

Fireball 

(within seconds) 
Slight delay 

Diffusion flash 

Premixed flash 

(up to 30 s) 

fire 

fire/explosion 

Longer delay 

Premixed flash 

Premixed flash 

(min) 

fire/explosion 

fire/explosion 


The event that occurs will depend on the delay before 
ignition. The behaviour assumed is as follows: For the vari¬ 
ous fire models the report refers to work by Considine 
(1981), evidently an early version of the paper by Considine 
and Grint (1985), which gives a similar set of models, as 
described in Chapter 16. 


A7.10.7 Vapour cloud explosion model and injury relations 

The vapour cloud explosion model covers both the prob¬ 
ability that an explosion occurs given ignition and the 
effects of such an explosion. For the former the prob¬ 
abilities used are 


Size of cloud 
(te) 

Explosion probability 

<10 

0 

100-100 

0.1 (LNG = 0.01) 

>100 

1 


For the effects of such an explosion use is made of the 
following relations based on the work of the ACHM: 


p 0 = kM 1/3 [A7.10.1] 

R = 30M 1/3 [A7.10.2] 


hence 

p a = UR [A7.10.3] 

where M is the mass released (te), p a the peak side-on over¬ 
pressure (kPa), R the radius of the cloud (m) and k, U are 
constants. Relationships are given as follows: 


Overpressure 

(kPa) 

Hazard range 
(m) 

Casualty probability 

0<7 

>4.25 R 

0 

7-21 

(2-4.25 )R 

0.1 

21-34 

(1.35-2 )R 

0.25 

34-48 

(1.1-1.35)7? 

0.70 

>48 

<1.1R 

0.95 
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Further the authors quote the estimates of the ACMH that 
the overpressure at the centre of the cloud is likely to be 
about 103 kPa and at the edge about 69 kPa. 


A7.10.8 Toxic injury relations 

Injury relations are given for ammonia and for hydrogen 
fluoride. For these gases the authors state that the best 
information available to them on the LC 50 , the concentra¬ 
tion lethal at the 50% level, is as follows: 


Timet 

Lethal concentration LC S0 

Ammonia 

(kg/m 3 ) 

Hydrogen fluoride 
(kg/m 3 ) 

1 


1.5 x 10“ 3 

5 

7 x 10“ 3 

4 x 10“ 4 

10 

3.5 x 10“ 3 


30 

1.2 x 10“ 3 


60 

5 x 10“ 4 

4 x 10“ 5 


They further state that these data may be fitted to the 
relation 


LCfso = kCf 3 [A7.10.4] 

where C is the concentration, LC t so the dose lethal at the 
50% level and t time. 


A7.11 Notation 

Section A7.5 

Subsection A7.5.5 

A h horizontal area of target 

Ay vertical area of target 

Ay horizontal proj ection of vertical area of target 

F frequency of aircraft crash on target area 

F h frequency of aircraft crash per unit of ground 

Fy frequency of aircraft crash per unit of vertical 


Subsection A7.5.7 

g acceleration due to gravity (m/s 2 ) 

hf slumped liquid depth (m) 

r radius of flooded zone (m) 

r s radius of source cylinder (m) 

t time after initiation of slumping (s) 

u t slumped liquid velocity (m/s) 

7 S volume of source cylinder (m 3 ) 


Subsection A7.5.8 
A h area of tank roof (m 2 ) 

Ay exposed area of tank vertical sides (m 2 ) 

c p specific heat of tank wall (J/kg°C) 

m mass of exposed tank wall (kg) 

Qi heat input to tank (W) 


Q n heat loss by convection (W) 

Q r heat loss by radiation (W) 

t time (s) 

e emissivity of tank wall 

9 A absolute temperature of ambient air (K) 

8 t absolute temperature of tank wall (K) 

A 9 temperature difference between tank and ambi¬ 

ent air (°C) 

a Stefan-Boltzmann constant 

(W/m 2 K 4 ) 


Subsection A 7.5.11 

H heat of combustion of hydrocarbons (kcal) 

Ap m peak overpressure (bar) 

q peak dynamic pressure (bar) 

r distance (m) 

W mass of hydrocarbons (t) 

a equivalence factor 


Subsection A7.5.13 
a, b constants 

C concentration (g/m 3 ) 

D dosage ((g/m 3 ) 275 min) 

P T probit 


Subsection A7.5.14 

Equations A7.5.11-A7.5.13 
g acceleration due to gravity 

h height of cloud 

r radius of cloud 

ro initial radius of cylinder 

V 0 initial volume of cylinder 

p a density of air 

p 0 initial density of cloud 


Equations A7.5.14-A7.5.20 
h height of cloud (m) 

Q * mass released instantaneously (kg) 

r radius of cloud (m) 

t time (s) 

u wind speed (m/s) 

x,y distances in downwind, cross-wind directions 

(m) 

a x , Gy, G z dispersion coefficients in downwind, crosswind 
and vertical directions (m) 

X concentration (kg/m 3 ) 

Xav mean concentration along axis (kg/m 3 ) 

Xmax maximum concentration along axis (kg/m 3 ) 


Subsection A7.5.15 
C concentration indoors 

C 0 concentration outdoors 

X 


number of air changes per unit time 
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Section A7.10 

Subsection A7.10.7 
k,k constants 

K constant 

M mass released (te) 

p 0 peak side-on overpressure (kPa) 

R radius of cloud (m) 


Subsection A7.10.8 
C concentration 

k constant 

LCf 50 dose lethal at 50 % level 

t time 
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APPENDIX 8/2 RIJNMOND REPORT 


Another comprehensive hazard assessment is the Rijn- 
mond study carried out for the Rijnmond Public Authority 
by Cremer and Warner. 

This work is described in Risk Analysis of Six Potentially 
Hazardous Industrial Objects in the Rijnmond Area, a Pilot 
Study issued by the Rijnmond Public Authority (1982) (the 
Rijnmond Report). 

The Rijnmond is the part of the Rhine delta between 
Rotterdam and the North Sea. Within the Rijnmond area of 
15 x 40 km z are located some one million people and a vast 
complex of oil, petrochemical and chemical industries as 
well as the largest harbour in the world. Adescription of the 
industrial complex at Rijnmond has been given by Molle 
and Wever (1984). A map of the Rijnmond showing the 
principal plant areas is given in Figure A8.1 and a diagram 
of the petrochemical complex in Figure A8.2. There are five 
oil refineries with a refining capacity of some 81 Mt/year, 
including the large refineries of Shell at Pernis and BP near 
Rozenburg, and major petrochemicals complexes operated 
by Shell, Gulf and Esso. Some of the other plants are 
described below. 

A first note on the industrial hazards issued in 1976 by 
the Rijnmond Authority was strongly criticized by indus¬ 
try. Accordingly a commission, COVO, was set up with 
representatives of the Labour Inspectorate of the Ministry 
of Social Affairs, the Rijnmond Authority and industry. 
COVO decided to carry out a pilot study of six industrial 
installations in the Rijnmond in order to evaluate the 
applicability of risk assessment to decision-making on 
safety and commissioned Cremer and Warner to carry out 


the study. A steering committee was formed and the work 
was done to the requirements of this committee. 


A8.1 The Investigation 

The aim of the work was to evaluate the methods of risk 
assessment for industrial installations and to obtain 
experience in the practical application of these methods. 
Such evaluation was considered to be essential before any 
decision could he made on the role of such methods in the 
formulation of safety policy. 

The objectives of the study were formulated so as to give 
an answer to the following questions: 


(1) What is the reliability of the assessment of the con¬ 
sequences and probabilities of possible accidents with 
industrial installations when the procedures and 
methodology of risk analysis are carried out to their 
full extent? 

(2) What problems and gaps in knowledge exist in the 
field of risk analysis? 

(3) How can the results of a risk analysis be presented 
conveniently, without losing important details, so that 
it may be used for safety policy decisions? 

(4) How well can the influence of risk reducing measures 
on the consequences and probabilities be calculated? 

(5) What resources are required, in time and money, to 
assess the risk with sufficient accuracy to be useful for 
safety policy decisions? 



Figure A8.1 Rijnmond harbour area (Molle and Wever, 1984) 
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Figure A8.2 Petrochemical complex in the Rijnmond harbour area (Molle and Wever, 1984) 
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The COVO steering committee was reinforced with 
experts from industry. The committee also included repre¬ 
sentatives of the Battelle Institute who were charged with 
the task of scrutinizing the methodology and models used. 
The overall approach taken in the investigation was: 

(1) to collect basic data and define the boundary limits of 
the installation; 

(2) to identify the potential failure scenarios; 

(3) to select and apply the best available calculation 
models for physical phenomena; 

(4) to collect and apply the best available basic data and 
models to calculate the probabilities of such events; 

(5) to choose and develop different forms of presentation 
of the final results; 

(6) to investigate the sensitivity of the results for vari¬ 
ations in the assumptions used and to estimate the 
accuracy and reliability of these results; 

(7) to investigate the influence of risk reducing measures. 

The investigation involved the identification of the princi¬ 
pal hazards of the installations in the area, the assessment 
of the associated individual and societal risks and the pro¬ 
posal of remedial measures to reduce the risks. 

The project was planned to last one year but in fact took 
two-and-a-half years and it cost some 2.5 m guilders. A 
supplementary contract was placed with the consultants to 
study methods of presenting the results. The report was 
published in 1982. It is in five parts. Part 1 is the report of 
the steering committee, Part 2 is the main Cremer and 
Warner study, Part 3 the supplementary Cremer and War¬ 
ner study, Part 4 is the Battelle review and Part 5 contains 
the industrial and other comments. 

A8.2 Installations and Activities 


in Tables A8.2 and A8.3, respectively. Other data are 
given in the sections on particular installations. 

A8.4 Hazard Models 

The principal hazard models used are given in Table A8.4 
and their application is described in the sections on parti¬ 
cular installations. 

A8.5 Injury Relations 

The injury relations used are given in Table A8.5 and their 
application is described in the sections on particular 
installations. 


A8.6 Population Characteristics 

The study covered the risks both to employees and to the 
public. For the off-site population a grid was used showing 
the number of people over an area of some 75 km 2 , which 
covered the whole of the Rijnmond. Populations were esti¬ 
mated for each 500 m 2 square using data from the 1971 
census, updated in 1975. 

Both day and night time populations were determined, 
day being defined as the working week of 45 h and night as 
the remaining 123 h. 

Outside the population grid average population den¬ 
sities were used. These were required only in cases where 
an exceptionally large cloud occurred. 

For the particular installations studied data were 
obtained on the numbers of employees present during day 
and night and on their locations. The on-site population N e 
was estimated from the relation 


(5W d + 16W n ) x 52 
((5 x (52 — « h )) 


[A8.6.1] 


The six installations studied were as follows: 


(1) Acrylonitrile storage (Paktank); 

(2) Ammonia storage (UKF); 

(3) Chlorine storage (AKZO); 

(4) LNG storage (Gasunie); 

(5) Propylene storage (Oxirane); 

(6) Hydrodesulfurizer (Shell). 


where Wh is the number of weeks off for holidays, sickness, 
etc., Ni the numbers present during the working day and 
N n the numbers present at all other times. 

For toxic gas hazard it was assumed that 1% of the 
population are outdoors. This estimate includes an allow¬ 
ance for people taking shelter. For explosion hazard it was 
assumed that 10% are outdoors. 


The storages of acrylonitrile and LNG were at atmos¬ 
pheric pressure and those of ammonia, chlorine and pro¬ 
pylene were all liquids under pressure. The acrylonitrile, 
ammonia and chlorine represented toxic materials and the 
LNG and propylene flammable materials. The hydro¬ 
desulfurizer represented part of a process plant, the section 
studied being the diethanolamine stripper. 

The context of these installations is described by Molle 
and Wever and accounts of the individual installations are 
given below. 

The report is organized partly by installation and partly 
by themes and material on a particular installation is 
therefore given dispersed. Table A8.1 gives a summary of 
the entries for each installation. 

A8.3 Event Data 

The event data used in the study were a mixture of 
generic data, plant data and estimates. Some failure and 
event data and some external event data used are given 


A8.7 Mitigation of Exposure 

The principal mitigations of exposure considered were eva¬ 
cuation and shelter. For evacuation the estimate of the pro¬ 
portion evacuated is taken as a function of the warning time. 
In some cases the proportion is estimated as 90-100%. 

For the effect of shelter from toxic gas the single¬ 
exponential stage model of ventilation is used. 

A8.8 Individual Assessments 

A8.8.1 Acrylonitrile storage (Paktank) 

The acrylonitrile (AN) storage is one of a number of stora¬ 
ges at the Botlek terminal of Paktank, a tank storage com¬ 
pany providing bulk storage and associated services to the 
oil and chemical industries. 

There are normally two or three tanks containing AN. 
The study was confined to a single tank and associated 
transfer systems which had been dedicated to handling AN 
for some years. This AN tank is one of a number of fixed 
roof tanks located in a tank bund which is at the centre of 
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the site. The tank has a capacity of 3700 m 3 . It is designed 
to withstand small variations of internal pressure, the 
breather valves being designed to open at an overpressure 
of 200 mmHg and a vacuum of 50 mmHg. 

Operation at the site is flexible, but in the preceding two 
years only six modes of transfer had been recorded, these 
being loading of coastal barges, loading of road tankers, 
loading of rail tank cars, filling from coastal barges and 
chemical tankers, filling from sample tanks, and transfer 
between this tank and others at the site. 

A summary of the risk assessment for the AN storage is 
given in Table A8.6. Section A of the table lists the unde¬ 
sired events considered, section B the hazard scenarios and 
section C the main fault trees. 

An escape from the tank into the bund, though instanta¬ 
neous, gives rise to a constant evaporation rate and hence 
acts as a continuous source. Releases from the pipework are 
also continuous sources. 

The frequency of the releases is estimated using the 
seven fault trees listed as shown in Figure A8.3. The table 
giving the frequency and event data for these trees con¬ 
tains 81 entries. Of these some 30 are derived from the 
generic data given inTables A8.2 and A8.3 and the rest from 
other sources, mainly company data, meteorological data or 
judgement. 

For fire hazard it was assumed that 10% of all major 
spillages or resulting vapour clouds and 5% of significant 
spillages ignite and that an operator present at the release 


or ignition source receives fatal burns in 80 % of cases. The 
hazard distances obtained are shown in the table as <10 m. 

For toxic gas hazard the exposure is continuous. In most 
cases only employees were at risk. A10-min exposure was 
assumed for employees, who are alert to the hazard. 

It was found, however, that serious toxic effects were 
possible to the public from a major spill (PI) if the exposure 
time was 30 min. For the public credit was given for eva¬ 
cuation, usually 90-100%, depending on the warning time. 

Typical hazard distances to the LTL 50 of 76 m are given in 
Table A8.6. The distances are greater for adverse weather 
conditions, being on the centreline for 2.0/F and 1.5/D 
conditions 575 and 260 m to the LTL S0 and 879 and 365 m to 
the LTL 05 , respectively. 


A8.8.2 Ammonia storage (UKF) 

The ammonia storage is part of a complex of plants pro¬ 
ducing ammonia, nitric acid, ammonium nitrate, urea and 
other fertilizers at the Pernis site of UKF. 

The ammonia is stored in a sphere under pressure at 
atmospheric temperature. The capacity of the sphere is 
1000 m 3 , but the average inventory is only 40% of this.The 
ambient temperature was taken in the study as 15°C that 
corresponds to a pressure of 7.1 bar. 

Ammonia is transferred to the sphere from rail tank cars 
or from the ammonia plant. Transfer of the liquid ammonia 
from the rail tank car is effected by pressurizing the tank 


Table A8.1 Rijnmond Report: summary of entries for the six installations (after Rijnmond Public Authority, 1982) 


Entry 




Page 




Acrylonitrile 

Ammonia 

Chlorine 

LNG 

Propylene 

Hydrodesulfurizer 

Main entry 

81 

111 

151 

183 

202 

225 

Historical review 

109,350 

132,351 

181,355 

200,361 

223,362 

240,370 

Release scenarios 

91 

113 

154 

187 

203 

227 

Undesired events 

Events key 

89 

133 

157 

188 

203 

229 

Event frequency 

101 

146 

171 

196 

210 

237 

Failure data 

Other data 

97,446 

438 

122,462 

170,480 

194,497 
191 

209,513 

235 

235 

Fault trees 

451 

468 

491 

507 

527 


Hazard models 

96 

115 

156 

189 

205 

228 

Injury relations 

Fire/explosion 

Toxic effects 

319, 331 

93,340 

145,340 

340 

319,331 

319,331 

231,340 

Consequence results 

Summary table 
Fatalities table 

102 

440 

149 

174 

198 

214 

239 

Grid printouts 

Fire/explosion 

Toxic effects 

93 

135,397 

161,404 

419 

422 

413 

Hazard ranges 

Fire/explosion 

Toxic effects 

96.102 

95.102 

135 

161 




Risk results 

Tables 

Risk contours 

102 

135, 578 

560 

161 




FN tables 

588 

589 

596 

603 

604 

608 

FN curves 

562 

563 

564 

565 

566 

567 

Evaluation 

250 

250 

251 

251 

252 

252 

Remedial measures 

107 

130 

180 

199 

213 

238 
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Table A8.2 Rijnmond Report: some failure and event data used (after Rijnmond Public Authority, 1982) 


A 

Data sources 



1 . 

AEC (1975) 

10. 

W. Marshall etal. (1976) 

2. 

Recht (1966c) 

11. 

Welker et al. (1976) 

3. 

SAI (1975) 

12. 

Bush (1975) 

4. 

Lees (1976b) 

13. 

SRS data bank 

5. 

Lees (1976c) 

14. 

D.L.E. Jacobs (1971) 

6. 

Skala (1974) 

15. 

Phillips and Warwick (1969 AHSB(S) R162) 

7. 

A.E. Green and Bourne (1976) 

16. 

Kletz (1972) 

8. 

Upfold (1971) 

17. 

Lawley and Kletz (1975) 

9. 

Smith and Warwick (1974 SRD R30) 



B 

Event data 




Equipment Failure rate a,b Reference 


Rate Range 


Tanks and vessels 


Pressure vessels 


Serious leakage 

1 x 10 5 /year 

Catastrophic rupture 

1 x 10 _6 /year 

Atmospheric storage tanks 


Serious leakage 

1 x 10 -4 

Catastrophic rupture 

6 x 10 _6 /year 

Refrigerated storage 


Tanks (double wall, 


high integrity) 


Serious leakage from 

2 x 10 _5 /year 

inner tank 


Catastrophic rupture from 

1 x 10 _6 /year 

both containments 


Pumps, pipework, etc. 


Pumps 


Failure to start 

1 x 10 _3 /d 

Failure to run 

3 x 10“7h 

normally 


Failure to stop 

1 x 10 _4 /d 

Catastrophic failure 

1 x 10 _4 /year 

Pipework c,d 


<50 mm 


Significant leakage 

1 x 10 _8 /sect. h 

Catastrophic rupture 

1 x 10 _9 /sect. h 

>50 mm, <150 mm 


Significant leakage 

6 x 10 _9 /sect. h 

Catastrophic rupture 

3 x 10 _1 7sect. h 

>150 mm 


Significant leakage 

3 x 10 _9 /sect. h 

Catastrophic rupture 

1 x 10 _1 7sect. h 

Hoses 


Heavily stressed 

4 x 10“®/h 

Lightly stressed 

4 x 10 _6 /h 

Loading arms 


Leakage 

3 x 10 _6 /h 

Catastrophic rupture 

3 x 10“ 8 /h 

Valves 


Pressure relief valves 


Fails dangerously 


Blocked 

0.001/year 

Lifts heavy 

0.004/year 

Lifts light/leakage 

0.06/year 

Vacuum relief valves 

0.005/year 

Other data taken from references 1, 5,6,7 



6 x 10 -6 —2.6 x 10 -3 /year 7,9,10 

4.6 x 10“ * * 5 - 6.3 x 10 _7 /year 12,15 


5 x 10 -5 —5 x 10 _3 /d 1 

1 x 10 _7 -1 x 10 _4 /h 1 

4 x 10 _5 -1 x 10 _3 /d 1,11 

3,13 


1,9,13,15 


11,14 


1 x 10“ 7 -1 x 10 _4 /h 1,11 

1 x 10 _8 -1 x 10 _5 /h 


0.001-0.01/year 5,7,13 

(1.4 x 10 -5 —3.6 x 10 _5 /d) 1 

0.02-0.09/year 1,5,7 

(1 x 10“ 5 -1 x 10 _4 /d) 1 
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Table A8.2 (continued) 

Instrumentation 

Data taken from 
references 1,5,6,7,13,16,17 

Electrical equipment 

Battery supply 

Failure to provide 

1 x 10 _6 /h 

lx lcr 

7 -6 x 10 _6 /h 

1,7 

proper output 
(in standby mode) 

Electric motors 

Failure to start 

3 x 10“ 4 /day 

7 x 10 _l 

5 —3 x KT 3 /d 

1 

Failure to run 

7 x 10 _6 /h 

5 x 10“' 

7 -l x 10 _4 /h 

1,7 

Emergency diesel 

system (complete) 

Failure to start 

3 x 10 _2 /day 

1 x 1(T : 

5 -l x 10“Vd 

4 -l x 10 _3 /h 

Failure to run 

3 x 10 _3 /h 

lx itr 

1 


a The unit d in this table stands for demand. 

b The failure rates taken from the Rasmussen Report correspond to the median values quoted there. 
c Values per metre run are also given and are one-tenth of those per section. 
d Following data are given for range: 


Industry Nuclear 

<75 mm 2 x 10 -9 - 5 x 10 _6 /sect. h 3 x 10 _11 -3 x 10 _8 /sect. h 

>75 mm 1X 10“ lo -5 X 10“ 6 /sect. h 3 X HT 12 -! X 10“ lo /sect h 


Table A8.3 Rijnmond Report: some external events data used (after Rijnmond Public Authority, 1982) 


Event 



Frequency a 

(events/year) 



Generic 

Acrylonitrile 

Ammonia 

Chlorine 

LNG 

Propylene 

Earthquake 

1(T 8 

X 

X 


X 

X 

Subsidence 

2 x 1(T 9 

2 x 1(T 7 

2 x nr 7 

2 x 1(T 7 

X 

X 

Flooding 

1(T 7 

X 

X 

X 

1(T 9 


Vehicular intrusion 

2 x 1(T 7 

X 

X 

X 

2 x lO -9 

X 

Mechanical impact 

1(T 7 

3 x nr 6 

X 

X 



Major fire 

1(T 6 

X 

nr 9 

X 

io- 12b 

10-5° 


a Frequencies for these events are not given for the hydrodesulfurizer. 
b Estimate based on fact that major fire would cause immediate ignition, not i 
c Estimate towards higher end of range due to flammable nature of products s 

i vapour cloud. 

Table A8.4 Rijnmond Report: some hazard models used 


Event 

Model 

A Emission 

Flow from 

A. Vessel containing liquid at atmospheric pressure 

B. Vessel containing liquid above atmospheric boiling point 

C. Vessel containing gas only 

Two-phase flow 

Fauske-Cude (Fauske, 1964; Cude, 1975) 

B Vaporization 

Spreading of liquid spill 

Vaporization of cryogenic liquid 

On water 

On land 

Combined spreading and vaporization of 
cryogenic liquid on land 

Vaporization from spill into complex bunds 

Evaporation of volatile liquid 

Shaw and Briscoe (1978 SRD R100) 

Shaw and Briscoe (1978 SRD R100) 

Shaw and Briscoe (1978 SRD R100); AGA (1974) 

Pasquill (1943), Opschoor (1978) 
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Table A8.4 (continued) 

Event 

Model 

C Gas dispersion 

Neutral density gas dispersion 

Pasquill-Gifford 

Dense gas dispersion 

R.A. Cox and Roe (1977) 

Dispersion of jet of dense gas 

Ooms, Mahieu and Zelis (1974) 

D Vapour cloud combustion 

Initial dilution with air 


Continuous Release 

Ooms, Mahieu and Zelis (1974) 

Instantaneous release 

Empirical relation 

Ignition sources 


Fire vs explosion 


E Vapour cloud explosion 

Vapour cloud explosion 

TNO (Wiekema, 1980) 

F Pool fire 

Flame emissivity 


Liquid burning rate 

Burgess, Strasser and Grumer (1961) 

Flame length 

P.H. Thomas (1963) 

Flame tilt 

P.H. Thomas (1965b) 

Fraction of heat radiated 


View factor 

Rein, Sliepcevich and Welker (1970) 

G Jet flame 

Flame length 

API (1969 RP 521) 

Deflection effect 

API (1969 RP 521) 

Buoyancy and liquid effects 

MITI (1976) 

View factor 

Rein, Sliepcevich and Welker (1970) 

H Fireball 

Fireball dimensions 


Radius 

R.W. High (1968) 

Duration 

R.W. High (1968) 

View factor 

McGuire (1953) 

Table A8.5 Rijnmond Report: some injury relations used 

A Fire: Steady state 

Incident thermcd Effect 


radiation 


(kW/m 2 ) 



1.6 Level insufficient to cause discomfort for long exposures 

4.5 Level sufficient to cause pain if subject does not reach cover in 20 s; blistering of skin likely 

(first degree burns) 

12.5 Minimum level for piloted ignition of wood, melting of plastic tubing, etc. 

25 Minimum level for unpiloted ignition of wood at infinitely long exposures 

37.5 Level sufficient to damage process equipment 


B Fire: Unsteady state 

Incident thermal 

Effect 

radiation dose 


threshold (kj/m 2 ) 


65 

Threshold of pain: no reddening or blistering of skin 

125 

First degree burns 

250 

Second degree burns 

375 

Third degree burns 
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Table A8.5 (continued) 


C Explosion 


Blast overpressure Effect 

(bar) 


0.03 Window breakage, possibly causing some injuries 

0.1 Repairable damage; light structures collapse; pressure vessels remain intact 

0.3 Major structural damage (assumed fatal to people inside buildings or other structures) 


D Toxic effects 

Data given in terms of constants i 
Y=k 1 +k 2 \nXC”T 

n probit equation for fatalities 



Gas 

Constants n ki 

k 2 

ltl 50 

(ppm”-min) 

Acrylonitrile 

Ammonia 

Chlorine 

Hydrogen sulfide 

2.5 -30.57 

2.75 -17.1 

2.75 

1.385 

1.69 

8.15 x 10 3 
1.22 x 10 10 
5.46 x 10 4 

1.6 x 10 s 


Table A8.6 Rijnmond Report: summary of assessment of acrylonitrile storage (Paktank) (after Rijnmond public 
Authority, 1982) 


A Undesired events 

Event 

Frequency 

Mass flow 

Duration 

Average no. 


(events/year) 

(kg/s or kg) 

(s) 

of fatalities 
to public b ’ c 
(deaths/year) 

PI Major rupture of tank 

4.3 x 10“ 5 

1.85 x 10 6 


7.6 x 10“ 6 

P2 Split in tank bottom/shell 

2.0 x 10“ 4 

1.85 x 10 6 



P3 Rupture of tank roof 

1.8 x 10“ 4 




P4 Open drain valve on tank 

1.0 x 10“ 4 


1800 


P5 Overfilling of tank 

1.5 x 10“ 3 

200 m 3 /h d 



P6 Internal explosion 

5 x 10“ 6 




P7 Unauthorized entry into tank 

2 x 10“ 5 




P8 Transfer line rupture 

9 x 10“ 7 

1.85 x 10 6 


3.2 x 10“ 7 

P9 Transfer line leakage 

5.2 x 10“ 5 


1800 


P10 Hose rupture 

2.6 x 10“ 3 


900 


Pll Catastrophic rupture of transfer line 

8.8 x 10“ 6 


900 


P13 Transfer hose rupture 

4 x 10“ 3 


600 


P14 Transfer hose rupture 

4 x 10“ 3 


600 

7.9 x 10“ 6 

Total 





B Hazard scenarios 

Spillage into bund 

Evaporation from bund 

Gas dispersion (from continuous source) 

Pool fire in bund 

Flash fire in vapour cloud 

C Fault trees 


PI Catastrophic rupture of tank 

Pl.l Severe overpressurization of tank 

Pl.1.1 Pressurization of tank with nitrogen 
Pl.1.2 Severe polymerization within tank 
PI.2 Severe tank depressurization 
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Table A8.6 (continued) 


P1.4 Severe polymerization in tank 
P5 Tank overfilled up to breather valve level 

P5.1 High level detected, incorrect action taken 


a There are 15 further events: 

P12 Transfer line leakage 
P15 Transfer hose leakage 
P16 Transfer line rupture 
P17 Transfer hose rupture 
P18 Transfer line/hose rupture 
P19 Transfer line/hose rupture 
P20 Transfer line/hose leakage 
P21 AN transfer line/hose leakage 
None of these events causes an average number of fatalities to the public >10 _5 /year. 

b For both cases PI and P8 the typical hazard distances to the LTL50 are 76 m and to the LTLq 5 126 m. These are the greatest hazard distances quoted. 
c For all cases the typical hazard distances for fatal effects from fire are <10 m. No hazard distances for fatal effects from explosion are quoted. 


P22 Line leakage 

P23 Sampling hose/line rupture 

P24 Transfer line/hose rupture 

P25 Sample tank leakage 

P26 Explosion with pre-pump sample 

P27 Hose rupture 

P28 Flash fire or explosion within AN system during m; 


car with ammonia vapour from the sphere and from the 
ammonia plant by pumps. Ammonia is transferred from the 
sphere to the downstream plants by pumps. 

An escape from a sphere may constitute an instanta¬ 
neous or a continuous source. Catastrophic rupture of a 
sphere was taken as equivalent to an instantaneous release, 
other escapes to continuous releases. 

A summary of the risk assessment for the ammonia sto¬ 
rage is given in Table A8.7. Sections A-C list the undesired 
events, the hazard scenarios and the main fault trees. 

Ammonia constitutes both a flammable and toxic hazard, 
but since the toxic effects can occur at concentrations 
100 fold less than the flammable effect, only the former 
were considered. 

A8.8.3 Chlorine storage (AKZO) 

The chlorine storage consists of five spheres associated 
with chlorine cellrooms at the Botlek site of AKZO. 

The chlorine is stored in the spheres under pressure at 
atmospheric temperature. Each sphere has a capacity of 
90 m 3 and can therefore hold 100 te, but at any given time 
one of the spheres is used as a dump tank, so that the 
capacity of the storage is 400 te. At ambient temperature 
the sphere pressure is 6.5 bar, but pressure is taken up to 
9 bar when the sphere is discharging to consumer plants. 
The spheres are located in a bund. 

Chlorine is received only from the associated production 
plant , but is sent out to a variety of consumers. There is a 
chlorine gas disposal plant consisting of caustic soda 
scrubbers. 

An escape from a sphere may constitute an instanta¬ 
neous or a continuous source. Catastrophic rupture of a 
sphere was taken as equivalent to an instantaneous release, 
other escapes to continuous releases or mixed releases. 

A summary of the risk assessment for the chlorine sto¬ 
rage is given inTable A8.8. Sections A-C list the undesired 
events, the hazard scenarios and the main fault trees. 

A8.8.4 LNG storage (Gasunie) 

The LNG storage consists of two tanks and associated 
equipment at the peak shaving plant of Gasunie at 
Maasvlakte. 

The LNG is contained in an inner tank of 9% nickel steel 
and an outer tank of carbon steel. This whole container is 
surrounded by a further containment consisting of a rein¬ 
forced concrete floor and a pre-stressed concrete wall. The 
capacity of each tank is 57,000 m 3 . 


An escape from a tank may constitute an instantaneous 
or a continuous source. Catastrophic failure of a tank was 
taken as equivalent to an instantaneous release, other 
escapes to continuous releases or mixed releases. 

A summary of the risk assessment for the LNG storage is 
given inTable A8.9. Sections A-C list the undesired events, 
the hazard scenarios and the main fault trees. 

A8.8.5 Propylene storage (Oxirane) 

The propylene storage is associated with the propylene 
oxide plant of Oxirane at Seinehaven. There are two 
spheres each with a capacity of 600 te. The ambient 
temperature was taken in the study as 15°C, that corre¬ 
sponds to a gauge pressure of 8 bar. 

Propylene is transferred to the spheres by pipeline, ship 
and rail tank cars. It is transferred from the spheres to the 
downstream plants. 

An escape from a sphere may constitute an instanta¬ 
neous or a continuous source. Catastrophic rupture of a 
sphere was taken as equivalent to an instantaneous release, 
other escapes to continuous releases. 

A summary of the risk assessment for the propylene sto¬ 
rage is given inTable A8.10. Sections A-C list the undesired 
events, the hazard scenarios and the main fault trees. 

A8.8.6 Hydrodesulfurizer (Shell) 

The section of the hydrodesulfurizer studied is the di¬ 
ethanolamine (DEA) regenerator. The latter is part of an 
absorber-regenerator unit which removes hydrogen sulfide 
from sour gas. The hydrogen sulfide is absorbed into DEA 
in the absorber and the fat DEA passes to the regenerator 
where a reversible reaction occurs releasing the hydrogen 
sulfide again. 

The escapes that can occur from this unit are of two 
types. There may be a direct release of hydrogen sulfide 
gas. Alternatively, the release may be by evolution of the 
gas from the fat DEA liquid. 

Hydrogen sulfide presents both a flammable and a toxic 
gas hazard. On review the flammable hazard was dis¬ 
counted. However, the flammability of the gas remains 
relevant in that in a proportion of cases the gas cloud would 
burn and would then not constitute a toxic hazard. 

A summary of the risk assessment for the regenerator 
section of the hydrosulfurizer is shown in Table A8.ll. 
Section A lists the undesired events and Section B the 
hazard scenarios. As indicated in section C there are no 
fault trees. 
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Figure A8.3 Continued 
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Figure A8.3 Rijnmond Report: fault trees for release from the acrylonitrile storage (Rijnmond Public Authority, 1982. Reproduced by permission); 
(a) head of tree for top event ‘catastrophic rupture or tank’; (b) sub-tree for ‘tank overpressurization' and (c) sub-tree for ‘tank depressurization' 
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(c) 

Figure A8.3 continued 


Table A8.7 Rijnmond Report: summary of assessment of ammonia storage (UKF) (after Rijnmond 
Public Authority, 1982) 


A Undesired events 

Event 

Frequency 

Mass flow 

Duration 

Average no. 


(events/year) 

(kg/s or kg) 

0) 

of fatalities 
to public a 
(deaths/year) 


UO Catastrophic failure 
of sphere when full 
U1 Catastrophic failure of sphere 
with average inventory 
U2.1 Full bore fracture of liquid 

line during transfer of ammonia 
U2.3 Full bore fracture of liquid 

line during transfer from another point 
U2.4 Full bore fracture of liquid 
line while line is isolated 
U3 Full bore fracture of bottom 
connection on sphere 
U4 Full bore fracture of top 
connection on sphere 
U5 Major crack in sphere shell b 
U7 Full bore fracture 
of vapour line 


2.3 x 10“ 7 682,000 

1.8x10-® 250,000 

5.6 x 10“ 7 166 

2.1 x 10“ 7 83 

1.9 x 10“ 4 83 

4.2 x 10“® 36 

4.4 x 10“® 39 

1.0 x 10“ 5 9.2 

1.4 x 10“ 5 22 


I 54 x 10“® 

I 67 x 10“® 

1,200 27 x 10“® 

3,000 11x10“® 

86 0 
6,950 38 x 10“® 

6,400 9 x 10“® 

>10,000 40 x 10“® 

300 56 x10“® 


Total 


197 x10“® 
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Table A8.7 (continued) 
B Hazard scenarios 


Sphere catastrophic failure: instantaneous release 
Pipeline rupture: continuous release 

C Fault trees 


U1 Sphere rupture 

Ul.l Support failure 
U1.2 Excess external heat 
U1.3 Excess of pressure 

Ul.3.1 Overfilling with liquid 
Ul.3.2 Chemically incompatible material introduced 
U1.4 Mechanical defect 

Ul.4.1 Stress corrosion cracking 

Ul.4.2 Corrosive material introduced from rail cars 


a For these nine cases the typical hazard distances to the LTL 50 are 2308,1497,671,575,241,374,23,63,87 m and to theLTL 05 2775,1819,893,755, 
327,501,100,103 and 142 m respectively. 
b Equivalent to a hypothetical 50 mm hole. 


Table A8.8 Rijnmond Report: summary of assessment of chlorine storage (AKZO) (after Rijnmond Public 
Authority, 1982) 


A Undesired events 





Event l* 

Frequency 

(events/year) 

Mass flow 

(kg/s or kg) 

Duration 

(s) 

Average no. 
of fatalities 
to public 0 
(deaths/year) 

Al.l Catastrophic burst, full 

0.93 x 10“ 7 

100,000 

I 

2.59 x FT 5 

A1.2 Catastrophic burst, half full 

0.74 x 10“ 6 

50,000 

I 

7.47 x 10“ 5 

A2.1 Split below liquid, A p = 6.5 bar 

0.83 x FT 6 

63 

790 

1.03 x 10“ 4 

A2.2 Split below liquid, Ap = 9 bar 

0.83 x FT 6 

76 

660 

1.03 x FT 4 

A3.1 Split above liquid level, Ap = 6.5 bar 

0.83 x FT 6 

14 

3500 

0.82 x FT 4 

A3.2 Split above liquid level, Ap = 9 bar 

0.83 x FT 6 

26 

1900 

0.82 x FT 4 

A4.1h Fracture of connection, full bore, 

Ap = 6.5 bar, angled horizontally 

3 x 10“ 7 

253 

200 

3.7 x 10“ 5 

A4.1d Fracture of connection, full bore, 

Ap = 6.5 bar, angled down 

3 x FT 7 

94 

530 

3.3 x FT 5 

A4.2h Fracture of connection, full bore, 

Ap = 9 bar, angled horizontally 

3 x FT 7 

300 

166 

3.7 x 10“ 5 

A4.2d Fracture of connection, full bore, 

Ap = 9 bar, angled down 

3 x 10“ 7 

110 

450 

3.3 x 10“ s 

A4.3h Fracture of connection, small leak 

Ap = 6.5 bar, angled horizontally 

6 x FT 6 

5.8 

3600 

9.1 x FT 6 

A4.3d Fracture of connection, small leak, 

Ap = 9.5 bar, angled down 

6 x FT 6 

2.2 

3600 

4.3 x FT 5 

A4.4h Fracture of connection, small leak, 

Ap = 9 bar, angled horizontally 

6 x 10“ 6 

6.9 

3600 

9.1 x 10 -5 

A4.4d Fracture of connection, small leak, 

Ap = 6.5 bar, angled down 

6 x FT 6 

2.6 

3600 

4.3 x FT 5 

A7.3 Full bore fracture of liquid line, 
valve open 

2.4 x 10“ 6 

64/32 

56/1500 

9 x 10“ 5 

A7.4 Full bore fracture of liquid line, 
valve open, later shut 

7.4 x FT 6 

64/32 

56/44 

5.8 x FT 6 

A11.5 Full bore fracture of liquid line, 
at end, valve open, later shut 

5.9 x lfT 5 

160/100 

60/240 

4.8 x FT 4 

A11.6 Full bore fracture of liquid line, 
small leak 

1.2 x FT 3 

3.6/1.3 

300/2300 

1.8 x FT 3 

A15.1 Full bore fracture of vapour line, 
valves open, later shut 

6.6 x FT 6 

15 

300 

1.8 x FT 4 

A17.2 Full bore fracture of liquid line, 
at end, valves open, later shut 

Total (37 events) 

8 x FT 6 

64/32 

23/280 

6.4 x 10 -5 

3.57 x FT 3 
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Table A8.8 (continued) 
B Hazard scenarios 


Tank catastrophic failure: instantaneous release 
Tank leak: mixed and continuous release 
Pipework leak: mixed and continuous release 

C Fault trees 


A1 Tank rupture 

A1.2 Pressure of water in tank 
A1.3 Internal explosion in tank 
A1.4a Bursting disc does not relieve 
A1.4b Source of overpressure potential 
A1.5 Overpressure due to liquid overfilling 


b Forthese20casesthetypic^hazarddSancestotheCTL5oare65^ e O,4900^3400^x2), SoOlx^f.'tTOOoffJTlOOtxt), 210^1600( 
1600 m and to the LTL 05 8600,6400,4200 (x 2), 2800 (x2), 6000 (x2), 1400 (x4), 2600,2000 (x2), 1400 and 2000 ra, respectively. 


Table A8.9 Rijnmond Report: summary of assessment of LNG storage (Gasunie) (after Rijnmond Public 
Authority, 1982) 


A Undesired events 


Event 

Frequency a 

Mass flow 

Duration 

Average no. 


(events/year) 

(kgTor kg) 

(s) 

of fatalities 
to public b 
(deaths/year) 

G1 Catastrophic failure of tank 

0.8 x 10“ 6 

0.126 

19 x 10 s 

I 

6.3 x 10“ 10 

G2 Failure of tank into earth bund 

1 x 10 -9 

19 x 10 6 

I 

3.5 x 10 -12 


0.144 




G3.1 Fracture of line (no pumping) 

2.5 x 10“ 7 

0.051 

60 

35 

4.5 x 10” 11 

G3.2 Fracture of line, other place 

8.1 x 10“ 7 

60 

35 

0 

(no pumping) 

0.027 




G4.1 Fracture of line 

1.5 x 10“ 8 

100 

600 

4.1 x 10“ 1Z 

(pumping) 

0.06 




G4.2 Fracture of line, other place 

4.8 x 10“ 8 

100 

600 

0 

(pumping) 

0.0585 




Total 




6.8 x 10“ 10 


B Hazard scenarios 


Inner tank failure: instantaneous release 

Concrete containment failure: instantaneous release 

Pipework rupture: continuous release (short) 

Spreading of liquid 

Vaporization of liquid 

Pool fire 

Flash fire 


C Fault trees 


G1 Tank rupture 

Gl.l Other sources of overpressurization 
G1.2 Excessive underpressurization 
G1.3 Internal explosion 


a For each case the probability of immediate ignition is 0.1 and that of ignition when dispersed is given by the second entry in the column. 
b For these six cases the typical hazard distances for fatal effects from fire are 211,174,152,210,151 and 199 m, respectively. No hazard distances 
are quoted for fatal effects from explosion. 
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Table A8.10 Rijnmond Report: summary of assessment of propylene storage (Oxirane) (after Rijnmond Public 
Authority, 1982) 


A Undesired events 


Evenf 

Frequency b 
(events/year) 

Mass flow or mass 
(kg/s or kg) 

Duration 

(s) 

Average no. 
of fatalities 
to public 0 
(deaths/year) 

0.01 Failure of full sphere 

0.028 xl0“ 6 

0.96 

600,000 

I 

1.43 x 10~ 7 

0.02 Failure of sphere 
containing 300 te 

0.233 x FT 6 

0.94 

300,000 

I 

1.52 x HP 6 

0.03 Full rate from sphere 
relief valve 

2.0 x 10“ s 

0.001 

20 

C 

0 

0.04 Failure of connection 

3.5 x 10 -7 

0.3 

455 

1300 

2.2 x 10 -7 

0.05 Failure of liquid line 

1.3 x 10“ 6 

0.33 

233 

2570 

5.3 x 10“ 7 

0.08 Failure of connection 

1.1 x 10 -6 

0.3 

202 

C 

3.6 x 10“ 7 

0.09 Failure of liquid line 

5.8 x 10“ 6 

0.15 

104 

C 

1.5 x 10“ 6 

0.20 Failure of liquid line 

2.4 x 10“ 5 

0.33 

230 

C 

13.2 x 10“ 6 

0.21 Failure of liquid line 

2.4 x 10“ 5 

0.13 

230 

C 

9.0 x 10“ 6 

0.25 Failure of liquid line 

3.6 x 10“ 6 

0.104 

280 

C 

1.04 x 10“ 6 

0.26 Failure of liquid line 

2.0 x 10“ 5 

0.17 

104 

C 

2.1 x 10“ 6 

0.30 Failure of liquid line 

Total(31 cases) 

1.1 x 10 -5 

0.31 

230 

C 

6.2 x FT 6 

3.66 x 10“ 5 


B Hazard scenarios 


Sphere failure: instantaneous release 

Vaporizer shell failure: instantaneous release 

Pipework failure: continuous release 

Gas dispersion 

Ignition probability 

Flash fire 

Explosion 

C Fault trees 


01 Sphere rupture 
01.1 Gross overstressing of shell 

01.1.1 Gas phase pressurization of sphere 

01.1.1.1 High temperature and pressure from jetty vaporizer 

01.1.1.2 Manual and power valves in circuit round spheres/vaporizer liquid and vapour lines all open 
01.1.2 Internal explosion in sphere 
01.1.3 Wrong material loaded 
01.1.4 Liquid overfilling 

01.1.4.1 Overfilling from ship 
01.1.4.2 Overfilling from rail car 
01.2 Mechanical defect in sphere shell 

01.2.1 Wrong material loaded (see tree for 01.1.3) 


“There are 19 further cases. None of these events causes an average number if fatalities to the public >10 _6 /year. 
b For each case the probability of immediate ignition is 0.1 and that of ignition when dispersed is given by the second entry in the column. 
c For these 12 cases the typical hazard distances for fatal effects from fire are 353, 338, 47.125,154,105,110,138, 218, 268,118 and 147 m, 
respectively. The hazard distances for explosion are given for overpressures of 0.3,0.1 and 0.03 bar. For the former the distances are 207,164,28, 
62,74,51,56,68,88 and 102 m, respectively. 
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Table A8.11 Rijnmond Report: summary of assessment of hydrodesulfurizer (Shell) (after Rijnmond 
Public Authority, 1982) 


A Undesired events 


Event 

Frequency 

Mass flow 

Duration 

Average no. 


(events/year) 

(kg/s or kg) 

(s) 

of fatalities 
to public* 
(deaths/year) 

Sl.l Major failure H 2 S line, 

3.2 x 10 -6 

1.21 

60 

0 

elevated, 1 min duration 

S1.2 Major failure H 2 S line, 

3.2 x 10“ 6 

1.21 

600 

0 

elevated, 10 min duration 

S1.3 Major failure H 2 S line, 

7.2 x 10“ 7 

1.21 

Long 

0 

elevated, extended duration 

S2.1 Major failure H 2 S line, 

3.2 x 10 -6 

1.21 

60 

0 

low level, 1 min duration 

S2.2 Major failure H 2 S line. 

3.2 x 10“ 6 

1.21 

600 

0 

low level, 10 min duration 

S2.3 Major failure H 2 S line, 

7.2 x 10“ 7 

1.21 

Long 

0 

low level, extended duration 

S5 Major failure at DEA line 

1.6 x 10“ 6 

0.49 

Long 

0 

Total 




0 


B Hazard scenarios 


Pipework failure: 

continuous release 
Gas dispersion 

C Fault trees 




a For these 7 cases the typical hazard distances to the LTL 50 are 0,19,59,81,144,153, and 64 m and to the LTLqs 0,85,96,99,173,181 and 811 
respectively. 


Table A8.12 Rijnmond Report: individual and average annual risk for six installations (Rijnmond Public Authority, 1982) 


Installation 

Average annual fatalities 

Individual risk employees 


Employees 

Public 


Acrylonitrile 

2.1 x 10“ 3 

7.9 x HT 6 

6.6 x 10“ 6 

Ammonia 

2.1 x 10“ 3 

2.0 x 10“ 4 

20 x 10“ 6 

Chlorine 

1.1 x 10 -2 

3.6 x HT 3 

5.1 x KT 5 

LNG 

1.5 x 10“ 7 

6.8 x HT 10 

5.7 x 10“ 9 

Propylene 

1.1 x 10“ 4 

3.7 x 10“ 5 

7.7 x 10“ 7 

Hydrodesulfurizer 

1.0 x 10“ 6 

0 

2.1 x 10“ 9 


For cases S1-S2, which involve direct release of hydro¬ 
gen sulfide, it was found that the inventory of gas, which is 
at a gauge pressure 0.5 bar, was too small to sustain a 
release of any significant duration and that for these cases 
the limiting flow was determined by the rate of evolution of 
the gas, which was 4370 kg/h. This is equivalent to dis¬ 
charge from hole of a 75 mm diameter. 

All the emissions are continuous sources. 

An ignition probability of 0.2 on release was assumed. 

For toxic gas hazard, therefore, the exposure is con¬ 
tinuous. In all cases only employees were at risk. 

Typical hazard distances to the LTL 50 are given in Table 
A8.ll, the greatest distance there quoted being 153 m. The 
distances are greater for adverse weather conditions, being 
for case S2.3 on the centreline for 2.0/F conditions 395 m. 


A8.9 Assessed Risks 

The results of the assessment are presented in a number of 
ways. These include 


Risk contours 
Risk to employees: 

Individual risk 
Risk to public: 

Individual risk 
Societal risk 
FN tables 
FN curves 

Average annual fatalities 
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Figure A8.4 Rijnmond Report: risk contours for ammonia storage (Rijnmond Public Authority, 1982. 
Reproduced by permission) 


Table A8.13 FN table for public for chlorine storage in Rijnmond Report (after Rijnmond 
Public Authority, 1982) 


No. of deaths 

Cumulative frequency 

No. of deaths 

Cumulative frequency 

1 

4.00 x 10“ 4 

125 

2.09 x 10“ 6 

10 

1.07 

151 

1.62 

20 

3.70 x 10“ 5 

200 

9.86 x 10“ 7 

30 

1.50 

304 

3.06 

40 

9.46 x 10“ 6 

404 

2.34 

50 

7.32 

518 

1.26 

60 

6.34 

738 

4.85 x 10“ 8 

70 

5.23 

1027 

3.40 

80 

4.31 

1697 

7.50 x 10“ 10 

90 

3.23 



100 

2.87 


























































Frequency F(/V) of events causing N or more deaths 
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Number of deaths per event ( N) 

Figure A8.5 Rijnmond Report: FN curve for chlorine storage (Rijnmond Public Authority, 1982. 
Reproduced by permission) 
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The individual risks and average annual fatalities are 
shown in Table A8.12. 

The use of risk contours is illustrated here by one of those 
for the ammonia storage shown in Figure A8.4, while that of 
FN tables and of FN curves is illustrated by those for the 
chlorine storage shown in Table A8.13 and Figure A8.5, 
respectively 


A8.10 Remedial Measures 

For each installation recommendations were made for 
remedial measures to reduce the risks. In accordance with 
the remit of the study the proposals made were illustrative 
rather than exhaustive and are suggestions for further 
evaluation. 

For the AN storage the main measure proposed is nitro¬ 
gen blanketing to prevent internal explosion. It is recog¬ 
nized, however, that there is a contrary view that lack of 
oxygen may make spontaneous reaction more likely. It was 
estimated that inciting would reduce the frequencies of 
events PI and P3 to 0.1 x 10 5 and 0.4 x 10 5 /year, respectively. 
Some 17 other measures are also listed, including hose 
support, tanker earthing and changes to sampling methods. 

For the ammonia storage the principal measure sug¬ 
gested is the provision of a bund. This would do little to 
retain material released in a catastrophic failure of the 
sphere, but it might well mitigate the effect of failure of a 
bottom connection. 

Another proposal made is the provision of an emergency 
air supply at the control room to allow the operators time to 
close emergency isolation valves. 


For the chlorine storage the main recommendations are 
directed to reduction of the size of escapes from pipework 
by the use of excess flow valves. 

For the LNG storage the main measure proposed is 
directed towards the prevention of escalation due to brittle 
fracture of carbon steel from a small release of cold lique¬ 
fied gas. It is suggested that baffles on the tank roof would 
reduce this risk. It was estimated that this would reduce the 
total risk by 5.6%. 

For the propylene storage the installation of remote isola¬ 
tion valves is the principal measure proposed. It was esti¬ 
mated that this would reduce the total risk by half. Proposals 
are also made for modifications to the vapour return system. 

For the hydrodesulfurizer the measures proposed are 
minor. It is suggested that there should be monitoring of 
hydrogen sulfide in the control room and that the hazard of 
spread of DEA through the drain system be investigated. 

A8.11 Critiques 

As indicated, the Rijnmond Report itself contains its own 
critique in the form of a review by outside consultants and 
industrial comment. Much of this relates to the failure and 
event data, the hazard models and the injury relations and 
particularly to the models. 

A8.12 Notation 

n h number of weeks off for holidays, sickness, etc. 

N d number of persons on site during day 
N e number of persons on site 
N n number of persons on site at other times 
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Laboratories are an integral part of the activities of the 
process industries. They include not only analytical 
laboratories and laboratories carrying out research and 
development work in industry but also university teaching 
laboratories where future industrial managers are trained. 
Pilot plants are considered in Appendix 10. 

Accounts of laboratories and of laboratory safety are given 
in Safety in the Chemical Laboratory by Pieters and Creighton 
(1957), Safety in University Laboratories by the AUT (1967), 
Hazards in the Chemical Laboratory by Muir (1971) and later 
Bretherick (1999, 2000), Handbook of Laboratory Safety by 
Steere (1971), A Guide to Laboratory Design by Everett and 
Hughes (1975), Prudent Practices for Handling Hazardous 
Chemicals in Laboratories by NRC Staff (1981), Introduction 
to Safety in the Chemical Laboratory by N.T. Freeman and 
Whitehead (1982), Handbook of Laboratory Waste Disposal 
by Pitt and Pitt (1985), Improving Safety in the Chemical 
Laboratory by J.A. Young (1987a) and Safety in Chemical 
Engineering Research andDevebpmentby'V.C. Marshall and 
Townsend (1991) (the IChemE Laboratories Guide). 

A Code of Practice for Chemical Laboratories (the RIC 
Laboratories Code) has been published by the Royal Insti¬ 
tute of Chemistry (RIC) (1976). 

Activities in a chemical laboratory are distinguished 
from those on an industrial plant, above all, by their small 
scale. The smaller quantities of species in the laboratory 
can reduce the overall consequence of an event. In addition, 
heat losses are relatively greater at the laboratory scale. 
This certainly reduces the hazards. There are, however, 
factors which may increase the risk of a hazardous initial 
event, such as the use of inexperienced and untrained 
personnel, and of escalation of that event, such as the 
enclosed space and the close proximity of personnel. 
Further, if the small scale of the hazard leads to general 
complacency and poor practice, the risk that it will be 
realized is augmented. 

Despite the lesser scale of the hazard, the approach to 
hazard control used for full-scale plants is applicable in 
large part to activities in the chemical laboratory. An acci¬ 
dent in the laboratory can give rise to considerable personal 
injury or loss of life and direct damage loss, because the 
density of personnel and of expensive equipment which are 
at risk is relatively high. There may also be serious con¬ 
sequential loss due to interruption of the facilities which 
the laboratory provides for production plants or of research 
and development activities. 

Moreover, where a laboratory, whether in the university, 
government, or industry, has a training function, it is 
essential to adhere to, and instill, good practice in hazard 
control. 

Many of these topics touched on here have already been 
discussed, albeit not specifically in relation to laboratories, 
in previous chapters, in particular those on legislation 
(Chapter 3), management and management systems 
(Chapter 6), hazard identification (Chapter 8), reactive 
hazards (Chapter 33), process design (Chapter 11), fire, 
explosion and toxic release (Chapters 16-18), personal 
safety (Chapter 25) and safety systems (Chapter 28). 

Selected references on laboratory safety are given in 
Table A9.1. 


A9.1 Legal Requirements 

In the United Kingdom the Factories Act 1961 covers 
industrial workplaces, including laboratories, while the 


Table A9.1 Selected references on laboratory safety 


BSC (n.d./4); Kintoff (1939); Pieters and Creighton (1957); 
Quam (1963); H.H. Fawcett (1965e, 1982e); C.H. Gray (1966); 
AUT (1967); Everett (1969,1979,1980 LPB 32); A.F.H.Ward 
(1969); BDH (1970,1977a-c); MCA (1970/19,1972/21); 
Imperial College Safety Committee (1971); Muir (1971); 
Steere (1971); Stephenson (1972 MCA/21); Ciba-Geigy Ltd 
(1974); Fairbairn (1974 SRD R8); Weekman (1974); Everett 
and Hughes (1975); Bremner (1976); Cooke (1976); RIC 
(1976); Seidenberger and Barnard (1976);Weissbach (1976); 
Anon. (1977 LPB 13, p. 14); Anon. (1977 LPB 18, p. 17); 

VC. Marshall (1977c, 1979b, 1980 LPB 32,1981 LPB 37); 
Anon. (1978 LPB 20); Curry (1978); Dept of Health and 
Social Security (1978,1979); Pitt (1978); J.M. Reynolds 
(1978); Buttolph (1979,1980 LPB 32); Cohn, linnecar and 
Ryall (1979); Fowler (1979,1980 LPB 32); G.F. Martin (1979, 
1980 LPB 32); Napier (1979b, 1980 LPB 32); Pogany (1979); 
Spencer (1979); Penninger and Okazaki (1980); Anon. 

(1981 LPB 39, p. 11); Bretherick (2000); G. Marshall (1981 
LPB 39); NRC Staff (1981); N.T. Freeman and Whitehead 
(1982); Pitt and Pitt (1985); B. Miller et al. (1986); Armour 
(1987); Baum and Diberardinis (1987); Bulloff (1987); 
Gerlach (1987); Hoyle and Stricoff (1987); Prokopetz and 
Walters (1987); Reale and Young (1987); Redden (1987); 
Saunders (1987); Springer (1987); Varnerin (1987); 
Williamson and Kingsley (1987); J.A Young (1987a-c); 
ACGIH (1988/20,1990/40,43,44,1991/61,69,1992/77); 
Ciolek (1988); Le, Santay and Zabrenski (1988); Lunn and 
Sansone (1990); Stricoff and Walters (1990); Kalis (1991); 
V.C. Marshall and Townsend (1991); NFPA (1991NFPA 45); 
Woodhead (1992); Bartlett, Hall and Gudde (1993); 
Senkbeil (1994) BS (Appendix 27 Laboratory Equipment) 

Fume cupboards, enclosures 

Walls and Metzner (1962); BOHS (1980 Monogr. 4,1987); 

J. Grant and Rimmer (1980); ASHRAE (1985 ASHRAE110); 
OSHA (1990/6); V.C. Marshall and Townsend (1991); AIHA 
(1993 Z95)BS 7258:1990- 


HSWA1974 applies to all places of work and thus extends 
coverage to university as well as industrial laboratories. 

Chapter 3 gives an account of these acts and also of other 
legislation relevant to laboratories such as that on the 
workplace, including management, work equipment and 
incident reporting; pressure systems; toxic substances 
and occupational hygiene; flammable and explosive mate¬ 
rials; fire; ionizing radiations; electricity; and personal 
safety, including safety signs, machine guarding, com¬ 
pressed air and compressed gases, manual handling, pro¬ 
tective equipment, eye protection and first aid. 

A review of legislation applicable to chemical engi¬ 
neering laboratories is given in the IChemE Laboratories 
Guide. 


A9.2 Laboratory Management Systems 

The management approach used for the control of hazards 
in industry is in large part applicable in chemical labora¬ 
tories. In particular, use should be made of formal systems 
and procedures as described in Chapter 6. 

The laboratory should have a management system with 
suitable organization and competent people, systems and 
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procedures, standards and codes of practice, and docu¬ 
mentation. There should be a clear chain of command and 
separation of executive from advisory, or staff functions. 
There should be a safety officer and a safety committee, 
and safety audits should be conducted. 

Some principal systems are described below, and others 
in later sections. 

A9.2.1 Hazard reviews 

There should be a system of hazard reviews for experi¬ 
mental work. A review should give a statement of the 
hazards involved and of the means by which they will be 
controlled. 

A9.2.2 Permit systems 

Hazardous activities should be covered by a permit system. 
Permits may be required for general maintenance activ¬ 
ities, for hot work and for vessel entry. The IChemE Guide 
gives example permit forms. 

A9.2.3 Incident reporting 

There should be a system for the reporting of incidents. As 
a minimum this should meet the legal requirements given 
in RIDDOR (1985), but in addition there should be a general 
requirement for the reporting of unintended events. 

A9.2.4 Safety audits 

The system of safety audits should cover the management 
systems for the laboratory, the equipment, the services, 
storage and waste disposal, and the operations. 

The conduct of safety audits is discussed in the IChemE 
Guide and by Bretherick (2000) and J. A. Young (1987b). 

A9.3 Laboratory Personnel 

There tend to be wide variations in the capability of the 
personnel who work in laboratories, ranging from well- 
trained and experienced permanent staff to relatively 
inexperienced research workers and students. A discus¬ 
sion of people in laboratories is given by Buttolph (1980 
LPB32). 

A9.3.1 Training 

It follows from the above that for laboratory personnel 
training assumes particular importance. This training 
needs to cover the hazards, the equipment, the procedures 
and the systems. As with all training, it should aim to 
motivate as well as to inform. 

Personnel who use the laboratory should be trained 
in good laboratory practice. The training should include 
such aspects as action to take in case of fire and other 
accidents, methods of eye irrigation and use of fire extin¬ 
guishers. 

The laboratory should have the appropriate number of 
persons trained in first aid. 

Where the personnel concerned are prospective man¬ 
agers of industrial plants, experience in a well-conducted 
laboratory provides a good foundation. 

Accounts of the content of, and techniques for, labora¬ 
tory training are given by Bretherick (2000), Armour 
(1987) and Redden (1987). 


A9.4 Laboratory Codes 

A9.4.1 RIC Laboratories Code 

The RIC Laboratories Code covers the following aspects: 

(1) Laboratory services 

(a) electricity 

(b) gas for heating 

(c) water 

(d) steam 

(e) ventilation 

(f) compressed air 

(g) brine circulation 

(h) hot plates, ovens and furnaces 

(i) drainage 

(2) Hazardous chemicals 

(a) flammable substances 

(b) explosive substances and mixtures 

(c) corrosive chemicals 

(d) irritant chemicals, dusts, gases and vapours 

(e) toxic chemicals 

(f) radiation and radioactive materials 

(g) cylindered gases 

(h) cryogenic fluids and systems 

(3) Hazardous techniques 

(a) pressure reactions 

(b) vacuum techniques 

(c) glass handling 

(d) heating of chemical apparatus 

(e) centrifugation 

(4) Organization 

(a) safety officers and safety committees 

(b) appointment and functions of a safety committee 

(c) fire prevention 

(d) personal protection 

(e) rescue 

(f) first aid and medical services 

(g) housekeeping and safety audits 

(h) labelling 

(i) storage 

(j) waste disposal 

(k) noise 

(m) documentation of procedures 

(5) Legal responsibility 

(a) legal responsibility 

(b) legislation 


A9.4.2 NFPA 45 

Guidance on fire protection is available in NFPA 45:1986 
Fire Protection for Laboratories using Chemicals. 

The standard covers (1) general topics, (2) laboratory 
unit hazard classification, (3) laboratory unit design and 
construction, (4) fire protection, (5) explosion hazard 
protection, (6) laboratory ventilating systems and hood 
requirements, (7) chemical storage, handling and waste 
disposal, (8) compressed and liquefied gases, (9) laboratory 
operations and apparatus and (10) hazard identification. 

The classification divides laboratories into high, inter¬ 
mediate and low hazard according to the maximum 
densities of materials held. For flammable or combustible 
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liquids Class I, II or IIIA, these densities are 


Laboratory unit Flammable or Maximum quantity I 
class combustible lOOff of unit (US gal) 

liquid class - 

Excluding Including 
storage storage 
[format] 


A 

High hazard 

I 

10 

20 



I, II and IIIA 

20 

40 

B 

Intermediate 

I 

5 

10 


hazard 

I, II and IIIA 

10 

20 

C 

Low hazard 

I 

2 

4 



I, II and IIIA 

4 

8 


The storage referred to is storage in cabinets and cans. The 
standard states that Class A laboratory units should not be 
used as instructional laboratories and that for Class B and 
C instructional laboratories the maximum quantities 
should be half those given above. 

An account of the use of NFPA 45 in laboratory design is 
given by Le, Santay and Zabrenski (1988). 

A9.4.3 IChemE Laboratories Guide 

The IChemE Laboratories Guide has the following cover¬ 
age: (1) introduction, (2) safety management of labora¬ 
tories, (3) the law and process laboratories, (4) hazards in 
chemical engineering laboratories, (5) designing process 
research and development facilities, (6) services, (7) storage 
of materials and disposal of waste, (8) design of experi¬ 
ments, (9) operating procedures and safety, (10) emer¬ 
gency procedures, (11) maintenance and modifications and 
(12) relevant publications. 

A9.5 Laboratory Hazards 

Reviews of hazards in chemical laboratories are given in 
the RIC Code and the IChemE Guide and in most texts of 
laboratory safety such as those of Steere (1971), Bretherick 
(2000) and J.A. Young (1987a). The list quoted from the RIC 
Code in Section A9.4 is typical. 

In addition to the specific treatments mentioned below, 
a general account of the handling of hazardous research 
chemicals is given by Prokopetz and Walters (1987) and one 
of hazards other than those from chemicals by Bulloff (1987). 

Further treatments of the hazards of flammable sub¬ 
stances are given in Chapter 16, of toxic substances in 
Chapter 18 and of others such as radiation, electrical and 
mechanical hazards in Chapter 25. 

A review of the causes of incidents in laboratories is 
given by J.A. Young (1987c), who utilizes the following 
headings: (1) management responsibilities inadequate, 
(2) lack of communication, (3) lack of personal respon¬ 
sibility, (4) lack of proper ventilation, (5) lack of protective 
equipment, (6) personal hygiene problems, (7) electrical 
hazards, (8) storage problems and (9) inadequate emer¬ 
gency procedures and equipment. 

A9.5.1 Reactive substances 

Where reactive substances are handled or processed, every 
effort should be made to obtain the fullest information 
on their behaviour. Texts such as Handbook of Reactive 
Chemical Hazards by Bretherick (2000), Sax’s Dangerous 


Properties of Industrial Materials (2000), and Hazardous 
Chemicals Handbook by Carson and Mumford (1994) are an 
essential point of departure. 

Bretherick (2000) has also provided a review of chemical 
reactivity in the laboratory context. 

A9.5.2 Flammable substances 

Many of the liquids and gases handled in laboratories are 
flammable. Each phase presents its characteristic hazards. 

Accounts of the hazards of flammable and combustible 
materials are given in the various NFPA codes, including 
for laboratories NFPA 45 and by Steere (1971), Bretherick 
(2000) and Gerlach (1987). 

Where flammable liquids are handled, one hazard is 
release followed by ignition. Factors which need to be con¬ 
sidered are the integrity of the containment, the flow of 
liquid if it does escape and any sources of ignition. 

Another hazard is overheating of the liquid, leading to its 
escape, either as a liquid following failure of the contain¬ 
ment or as vapour from an open vent. 

Afrequent cause of bench firesis loss, orunder-circulation, 
of cooling water. 

Flammable liquids should not be handled near, or heated 
on, naked flames and should also be kept away from arc¬ 
ing/sparking devices. 

Where flammable gases or vapours are handled, the 
most common hazard is a leak which allows a flammable 
atmosphere to build up in the enclosed laboratory space. 
Unless there is a high level of ventilation, this can occur 
even with a relatively small leak rate. 

Another cause of bench fires is contact between water 
and reactive metals such as sodium. 

Oxygen should not be used in such a way as to create the 
hazard of an oxygen-enriched atmosphere. Oxygen is liable 
to oxidize and then rupture rubber tubing. There is also the 
possibility of an ‘oxygen fire’ in which the metal can be 
ignited (arising, for example, from adiabatic compression, 
particularly in non oil-free lines as described in NFPA 53). 

A9.5.3 Toxic substances 

Where toxic substances are handled, it is necessary to 
consider all three modes of entry into the body and both 
short- and long-term toxic effects. 

For entry, inhalation may well be the principal mode, but 
in laboratory work in which chemicals are ‘handled’ to a 
much greater extent the ingestion and skin modes may be 
more significant than is usually the case. High standards of 
hygiene therefore assume greater importance. 

With regard to inhalation, there may he a hazardous 
short-term effect if the substance is highly toxic and 
circumstances can be foreseen in which a concentration 
sufficiently high to cause acute poisoning can occur. This 
is rather more likely in the enclosed space of a laboratory. 

More commonly, however, the hazard arises from expo¬ 
sure to low concentrations over a relatively long period. 

Where a toxic hazard exists, the requirements of the 
Control of Substance Hazardous to Health (COSHH) 
Regulations 1988 apply. 

The design countermeasures are primarily a high stand¬ 
ard of containment. Other measures are described in the 
next section. 

Accounts of the effects of toxic chemicals in the labora¬ 
tory context are given by Steere (1971), Bretherick (2000) 
and Springer (1987). 
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A9.5.4 Radiation hazards 

There are a variety of radiation hazards, most of which may 
be found on occasion in laboratories. They include both 
ionizing and non-ionizing radiations as described in 
Chapter 25. 

With regard to ionizing radiation, some devices contain¬ 
ing radioactive sources instanced in the IChemE Guide are 
certain liquid level gauges, gas chromatograph detectors, 
leakage detectors, anti-static devices on balances, and fire 
detectors. 

Certain apparatus producing voltages above 5 kVmay be 
a source of X-rays. 

Non-ionizing radiation sources include lasers, micro- 
waves and UV and IR devices. 

A9.5.5 Electrical hazards 

The electrical hazards are little different from those in 
industrial situations generally, but unless good practice 
is observed a laboratory tends to be especially vulnerable 
to them. 

Personnel may be at risk of electrocution from temporary 
lashups and repairs, defective and damaged cabling, 
unearthed components and poor earthing. This may be 
aggravated by handling equipment with wet hands. 

Short circuits due to worn cabling, wrong wiring or 
over-rated fuses can lead to a fire. 

A9.5.6 Mechanical hazards 

The mechanical hazards likewise are such as may be found 
in other industrial situations, but again laboratory person¬ 
nel may be especially vulnerable unless strict controls are 
observed. 

These mechanical hazards include those associated with 
rig equipment, workshop machinery, hand and power tools, 
lifting equipment, rotating equipment, and pinching 
equipment. 

Accidents are liable to occur where laboratory personnel 
use equipment with which they are unfamiliar in order to 
progress the job. 

A9.5.7 Operating condition hazards 

Equipment operating at high or low temperature consti¬ 
tutes a contact hazard. Contact with a very cold surface 
can cause a ‘cold burn’ not unlike the burn from a very hot 
surface. 

A cryogenic fluid also involves the hazard that it will 
vaporize by heat transfer from the atmosphere unless this 
is positively prevented. Depending on the nature of the 
fluid, such vaporization may give rise to an atmosphere 
enriched with a flammable or toxic material or oxygen. 

A laboratory usually contains a number of sources of 
high pressure such as compressed air, steam, compressed 
gas in cylinders and so on. Water also may act as a high 
pressure source. Rupture of equipment may occur either 
because the pressure to which it is subjected is above the 
design conditions, or because the equipment is weaker 
than designed. Overpressure can occur if a valve is open or 
fails, weakening if metal equipment is exposed to extremes 
of heat, cold or thermal cycling. 

Failure may also be caused by vacuum, which may occur 
not just by connection to a vacuum supply but by rapid 
cooling of a vapour in the apparatus. 

Rupture by a pressurized vapour/gas or by a superheated 
liquid, however, would have more severe consequences than 
by a subcooled liquid. 


A9.5.8 Water release hazards 

Another hazard is the escape of water, particularly in the 
form of a jet. Some potential effects of such a jet are short 
circuiting, thermal shock, extinction of gas jets and reac¬ 
tion with water-reactive chemicals. 

A9.6 Laboratory Design 

Laboratory design and layout is discussed in the IChemE 
Guide and by Steere (1971), Everett and Hughes (1975) and 
Baum and Diberardinis (1987). 

A checklist for laboratory design is given by Everett 
(1980 LPB 32) and a case study in such design by Martin 
(1980 LPB 32). 

A9.6.1 Laboratory layout 

The design and layout of a laboratory should proceed on 
principles broadly similar to those described in Chapter 10. 
This is the approach taken in the IChemE Guide. 

The method described in the guide is to analyse the 
needs of the experimental activities using a flow diagram 
showing the flow of materials between the experimental 
rigs, the workshops, stores, analytical services, waste dis¬ 
posal facilities, etc., and to develop layout diagrams in 
which the low and high hazard features are separated, with 
minimization of exposure near the latter. 

A9.6.2 Toxic chemicals 

The hazard from toxic chemicals has been described in the 
previous section. 

Where toxic chemicals are handled, the design should 
aim to keep the concentrations in the laboratory environ¬ 
ment below the relevant exposure limits. The prime means 
of ensuring this is to prevent leaks through a high standard 
of containment. 

For toxic chemicals the COSHH Regulations 1988 apply 
as described in Chapter 25. These regulations include pro¬ 
visions for monitoring the workplace atmosphere. 

Means of keeping down the concentration of contami¬ 
nants which do escape include use of ventilation and of 
fume hoods. 

A9.6.3 Ventilation 

The most common method of controlling the concentration 
of contaminants in the workplace is ventilation. The basic 
methods are local exhaust ventilation and general ventila¬ 
tion. Ventilation of the workplace is described in Chapter 25. 

The exhaust from the ventilation should pass to a safe 
place (e.g. away from air intakes). 

A9.6.4 Fume hoods 

For some toxic or noxious chemicals use is made of a fume 
cupboard. An account of fume hoods is given in Chapter 25. 

The resort to fume hoods has been criticized, however, by 
V.C. Marshall (1981 LPB 37) as outmoded. He argues that in 
the laboratory the release of noxious chemicals has become 
too readily accepted. The proper approach is higher stand¬ 
ards of containment which avoid such emissions. 

A9.6.5 Laboratory support 

There are a number of facilities which may be needed to sup¬ 
port the laboratory. They include (1) workshop, (2) stores, 
(3) receipt bays, (4) analytical services and (5) staff facilities. 
These are essentially self-explanatory. 
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The storage needs should be examined to identify the 
extent to which segregation is required. It is normal to devote 
one store to the materials required for the fabrication of rigs 
and another to process materials such as flammable and 
toxic liquids, but further segregation may be required. 

The IChemE Guide suggests, for example, that separate 
stores are normally required for solvents, different classes 
of chemicals, explosives, gas cylinders and cryogenic 
materials. 

Eating and drinking should not be permitted in labora¬ 
tories. There need to be adequate staff facilities provided. 

A9.7 Laboratory Equipment 

A9.7.1 Glassware 

Much laboratory apparatus is constructed in glass. Glass 
has a number of advantages such as resistance to corrosion, 
flexibility in use and visibility of contents. It can be used 
with a high degree of safety. For this it is necessary that its 
limitations be respected, that it be used only in suitable 
applications and that manufacturers guidance be consulted. 

A9.7.2 Hotplates, ovens and furnaces 

Hotplates, ovens and furnaces involve the hazard that an 
item being heated, or the heating element itself, becomes 
overheated. 

The use of ovens is frequently not subject to the same 
degree of formal control as other apparatus, and different 
people may put in items which are incompatible or may 
alter the controls, with undesirable results. 

A9.7.3 Centrifuges 

Laboratory centrifuges are a recognized hazard. They are 
the subject of BS 4402: 1982 Specification for Safety 
Requirements for Laboratory Centrifuges and are treated in 
Appendix 6 of the IChemE Guide. This is in addition to BS 
767 and a further IChemE guide both of which apply to 
industrial centrifuges. 

A laboratory centrifuge should be properly balanced. 
The buckets should be well fitting and with rubber pads 
in place. The machine should be cleaned and dried after 
use to prevent corrosion which is a common cause of 
mechanical failure. 

In use the lid should be closed and locking devices 
secured before start-up. The machine should be brought up 
to speed gradually. It should be stopped using the controls, 
not simply switched off. The lid should not be opened until 
the machine has come to rest. 

Centrifuges are discussed further in Chapter 11. 

A9.8 Laboratory Services 

Laboratories use a wide range of services. The most com¬ 
mon are (1) water, (2) steam, (3) compressed air, (4) fuel gas 
and (5) electrical power. Others include refrigerated cool¬ 
ants, vacuum, oxygen and other piped gases. 

A9.8.1 Water 

Water is used as process water and as coolant. 

Where the cooling load is larger enough to justify it, an 
external cooling water system may be provided which is 
a smaller-scale version of an industrial system with the 
water pumped through cooling towers. 

The use of water in laboratories involves several 
hazards. The first is the potential for reverse flow of liquid 


from a laboratory process into a water supply main. Where 
such a possibility exists, some safeguard is required. A 
break tank provides a barrier more dependable than a non¬ 
return valve. 

Another hazard is loss of cooling water. Generally this 
occurs on a single rig due to a leak at that point. 

A third hazard is the escape of water into the laboratory. 
A typical situation might be failure of a cooling water con¬ 
nection on apparatus in a fume hood where the drains are 
blocked, so that the water flows into the laboratory If the 
equipment is running unattended, a large quantity of water 
can escape, perhaps damaging equipment such as compu¬ 
ters on the floor below. 

There is often a requirement for demineralized water, 
which is supplied by a stand-alone unit. 

A9.8.2 Steam 

Steam is required in the laboratory for heating on larger 
rigs. It is typically provided by an external boiler system, 
but for small quantities may be generated by a small elec¬ 
trically heated, or less commonly, gas-fired, unit. 

The pressure of steam for laboratories is typically in the 
range 4-10 barg. Measures should be taken to ensure 
that equipment supplied with such steam cannot be over¬ 
pressured and that, where loss of coolant with steam still 
on could be hazardous, steam is shut off. 

The use of steam implies the use of steam traps. These 
devices need regular maintenance. 

A9.8.3 Compressed air 

Compressed air for laboratories is generally provided by a 
fixed piped system supplied from an external air receiver 
charged by a compressor. 

The air should be free of oil, which may be achieved 
either by use of an oil-free compressor or by oil-removal 
equipment. Regular maintenance is required for the latter. 

Compressed air is potentially hazardous and the supply 
pressure should be limited to that required for the purposes 
of the laboratory. 

Like steam, compressed air is a potential source of over¬ 
pressure and measures are needed to safeguard against this. 

A9.8.4 Fuel gas 

Fuel gas is another service which is usually provided in a 
laboratory by a fixed pipe system. 

A9.8.5 Refrigerated coolants 

Cooling to lower temperature that can be achieved by cool¬ 
ing water may be provided using refrigeration, either by 
circulation of a refrigerant or by the use of an intermediate 
fluid such as brine or ethylene glycol. 

The normal practice is to house the refrigeration set in a 
separate room. 

A9.8.6 Vacuum 

In some laboratories a piped system is provided to supply 
vacuum. Collapse of equipment under vacuum is not unlike 
an explosion and may generate missiles. Measures are 
required to ensure that equipment connected to vacuum is 
not under pressure. Also, backflow prevention should be 
installed. 

A9.8.7 Oxygen 

Another gas which may be provided as a fixed piped supply 
is oxygen, but where this is done special care is needed. 
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Hazards arising from the use of oxygen are attack and 
rupture of rubber tubing and creation of an oxygen- 
enriched atmosphere, which can result in a dramatic 
enhancement of the flammability of clothing. 

A9.8.8 Other piped gases 

Laboratory requirements for gases other than air vary 
greatly. In principle, where the usage is high, a fixed piped 
system has the very considerable advantage of eliminating 
the use of temporary facilities. However, frequently what is 
required is moderate quantities of a relatively large number 
of gases, so that a piped supply for any one is difficult to 
justify. In some instances pipes are used for different gases, 
with suitable precautions. 

Where a piped supply is installed, the gas is usually 
piped from gas cylinders located at a protected shelter on 
the outside of the building. 

Piped systems for hydrogen require special care. 

Lines should be carefully labelled and flow restrictors 
should be installed. 

A9.8.9 Compressed gas cylinders 

For the reasons just given, supply of many of the gases used is 
often taken from gas cylinders brought into the laboratory. 
The use of gas cylinders requires a number of precautions. 

The contents of the cylinder should be identified by 
labelling and colour coding. In use the cylinder should be 
fitted with a regulator and both valve and regulator should 
be kept clean and free of grease and oil. The valve should be 
closed when the cylinder is not in use. The cylinder should 
be transported in a wheeled carrier and when in use sup¬ 
ported in a vertical position. 

A more detailed treatment of precautions in the use of 
gas cylinders is given in Appendix 4 of the IChemE Guide. 

Cylinders should be secured (e.g. with chains) when in 
use or transported. 

A9.9 Laboratory Storage and Waste Disposal 

A9.9.1 Materials storage 

The storage of materials for the laboratory is discussed in 
the IChemE Guide and by Steere (1971), Bretherick (2000) 
and Williamson and Kingsley (1987). 

The main inventory of hazardous chemicals is, or should 
be, in the chemical storage locations. General principles 
governing such storage concern (1) segregation of incom¬ 
patible materials, (2) types of containers, (3) receipt points, 
(4) acquisition, stock-taking and disposal, (5) minimization 
of inventory and (6) identification, ownership, safety and 
health information and labelling. 

With regard to segregation, some relevant categories of 
chemical are (1) flammables, (2) toxics, (3) oxidizing agents, 
(4) corrosive substances, including strong acids and alka¬ 
lis, (5) cryogenic substances and (6) pyrophoric substances. 
Toxics should be segregated from flammables and oxidiz¬ 
ing agents from flammables, organic chemicals, reducing 
or dehydrating agents. Categories which should be held in 
separate stores include corrosive substances, cryogenic 
substances and pyrophoric substances. 

Types of container used are small containers, large con¬ 
tainers, bulk containers and gas cylinders. Aspects of good 
practice with small containers include the use of bottle 
carriers, non-spill containers and controlled dispensing. 
Good practice in the storage of large containers, essentially 
drums, and bulk containers is discussed in Chapter 22. 


The receipt points for chemicals should be designed 
to facilitate handling of incoming loads. Vehicles carrying 
gas cylinders generally have their own lifting gear, but 
those carrying drums often do not. 

The control of materials in storage is exercised through 
the processes of acquisition, stock-taking and disposal. 
It is common for an experimenter to order an appreciable 
quantity of a chemical, use only a portion of it and then 
forget about it. Unless close control is exercised, there can 
build up in the stores, a large quantity of chemicals, much 
without ‘ownership’. It is necessary to keep the situation 
under control by taking stock periodically and by disposal 
of unwanted material. 

Closely connected with this is the minimization of 
inventory. The inventory held in the laboratory itself and in 
storage should be the minimum necessary. 

The number of chemicals used in a laboratory can be 
large and the conditions of use very varied. It is essential to 
ensure that all materials are identified and labelled. There 
should be a materials safety data sheet for each chemical. 
Reale and Young (1987) give an account of labelling and 
MSDSs in the laboratory context. 

The Poison Rules 1982 give in Schedule 1 a list of sub¬ 
stances which must be stored in a locked cupboard under 
the supervision of a registered keeper and the usage of 
which must be entered in a register. 

A9.9.2 Waste disposal 

A laboratory usually generates gaseous, liquid and solid 
wastes, all of which need to be disposed of. The problems of 
waste disposal are not trivial and have become increasingly 
severe as environmental standards have risen. 

Accounts of this aspect are given in Handbook of 
Laboratory Waste Disposal by Pitt and Pitt (1985), in the 
IChemE Guide and by Steere (1971), Bretherick (2000) and 
Varnerin (1987). 

A distinction is generally made between domestic and 
chemical wastes. The former category includes paper and 
broken glass. The latter should be segregated both from 
paper and from unbroken bottles. 

Flammable solvents generally constitute a large propor¬ 
tion of the chemical wastes. Other liquids which are 
incompatible with such solvents should be collected sepa¬ 
rately. Separate collection is also required for oil-soaked 
rags. On no account should chemical wastes be put down 
the drains. 

Separate, clearly labelled receptacles are required for 
each category of waste. For some categories, such as for 
flammable solvents, receptacles with appropriate safety 
features should be used. 

Options for the disposal of laboratory wastes are listed 
by Pitt and Pitt, who give some 13 choices, although many 
are applicable only to small quantities. 

The disposal of wastes has to be formally managed 
by identifying disposals and obtaining the necessary 
licenses. 

Specialist contractors are used by most laboratories for 
disposal of at least some of their wastes. This is one of the 
options discussed by Pitt and Pitt. 

A9.10 Laboratory Operation 

A9.10.1 Information requirements 

It is essential to have the fullest information on the chemi¬ 
cals being handled and on the associated hazards. This 
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applies particularly to chemicals which are highly reactive 
or which have toxic effects at low concentrations over long 
periods. Sources of such information are discussed in 
Chapter 33. 

A9.10.2 Design of experiments 

Laboratory experiments are undertaken for different pur¬ 
poses and these necessarily influence their design. 

In all cases inherently safer design should be a prime 
aim, but the extent to which it can be achieved will vary 
Facets of inherent safety include scale, operating condi¬ 
tions and materials. Where the objective is the pedagogical 
one of demonstrating a principle, it may be possible to 
operate on a small scale, at atmospheric pressure and tem¬ 
perature and using less hazardous materials such as air, 
water and inert solids. 

The purpose of the experiment should be well defined. 
The experiment should not be too ambitious, and if neces¬ 
sary should progress in stages. Information on the materials 
handled and their potential hazards should be as complete 
as practical. The basis of safety should be defined. The 
design should cover the equipment and its operation, and 
should meet applicable standards and codes. 

The design should be subject to a hazard review, utiliz¬ 
ing hazard identification techniques such as checklists and 
hazop studies (covered in A9.10.3.). 

Laboratory equipment should be fit for purpose. The 
standard of construction of the apparatus should match the 
degree of hazard and its expected life. 

It is not uncommon to build a ‘temporary’ rig with con¬ 
nections made to certain services by hose rather than by 
fixed piping. If this is accepted in certain applications, care 
is still needed to ensure that the practice does not extend to 
unsuitable cases or to operation over extended periods. 

Another common practice is the use in a new experiment 
of a rig ‘inherited’ from an earlier one. The suitability of the 
equipment for the new purpose needs careful scrutiny. 

For critical features consideration should be given to the 
provision of automatic protective devices. Trips may be 
required to guard against loss of cooling, excessive heating, 
and deviations of pressure, temperature, flow, level and 
composition. 

Full instructions should be prepared for operating 
procedures and emergency procedures. Consideration 
should be given to the requirements of unattended opera¬ 
tion if this is planned. 

Certain activities require special enclosures. These 
include the use of a fume hood where the materials are toxic 
and of explosion cubicles where the process involves 
hazardous reactions or high pressures. 

The planning of safe experiments is discussed by Fowler 
(1989 LPB 32). 

A9.10.3 Hazard assessment 

If an experiment has the potential to cause serious injury, 
it is important to carry out a hazard assessment. Case 
studies of the application of hazard assessment in the 
laboratory have been described by Le, Santay and 
Zabrenski (1988). 

One example given is a review of the situations involving 
release of toxic gas sufficient to pose an acute toxic threat. 
The gases in question were arsine, diborane and phos¬ 
phine, all in hydrogen. A tabulation was made of the var¬ 
ious release scenarios, showing the expected toxic loads 


and candidate scenarios were then investigated. Fault tree 
analysis was used to determine the failure paths. 

Another case study described by these authors involved 
fault tree analysis where the top event considered was the 
formation of a detonable hydrogen-air mixture from a gas 
phase reactor system. 

A9.10.4 COSHH assessment 

A COSHH assessment should be made for any laboratory 
activity which attracts such an assessment under the 
COSHH Regulations 1988, as described in Chapter 18. 

A9.10.5 Operating procedures 

Operating procedures may be classified in two ways. One 
distinction is between general laboratory procedures and 
procedures specific to a particular rig. Another is between 
those which concern safety and those which do not. 

For the laboratory as a whole, general operating instruc¬ 
tions relating to safety are usually set down in a laboratory 
safety manual. 

For the particular rig, it is advisable to separate the pro¬ 
cedures which have safety implications from those which 
do not. Where operating instructions are imported, as with 
equipment bought from a manufacturer, it may be neces¬ 
sary to rewrite them, abstracting the safety-related parts. 

The operating instructions for a rig should cover start-up, 
running and shut-down, and should indicate the hazards and 
the countermeasures to be taken. They should not duplicate 
the general instructions. They should be clear and simple, 
and should be as concise as possible. 

A9.10.6 Emergency procedures 

The operating procedures for each rig should cover action 
to be taken in the event of an emergency (1) on that rig and 
(2) in the laboratory as a whole. 

It is an accepted principle that a laboratory fire should 
be fought if it can be done without undue risk. The same 
principle may be extended to other actions in an emergency 
which threatens to escalate. 

Emergency planning is discussed in Section A9.12. 

A9.10.7 Equipment maintenance 

The general approach to maintenance of equipment in a 
laboratory is similar to that in a plant. It involves identifi¬ 
cation of the equipment to be worked on; planning of the 
work and shut-down of the equipment; electrical and 
mechanical isolation of the equipment and preparation for 
the work by removing fluids and solids and by cleaning. 
The principles are as outlined in Chapter 21. 

A9.10.8 Equipment and procedure modification 

Similarly, control should be exercised over modifications 
to the equipment or the activities, analogous to those over 
equipment and process modification in a full-scale plant 
described in Chapter 21. 

The IChemE Laboratories Guide gives detailed guidance 
on what, in a laboratory context, constitutes a modification 
and contains in Appendix 14 a specimen form for control of 
modifications. 

A9.10.9 Permit systems 

The scope of the permit system, defining which activities 
need to be so covered and which do not, should generally 
be agreed between the laboratory superintendent and the 
rig supervisor. 
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The activities which require permits and the parties 
responsible for issuing and receiving them should be 
listed in the general laboratory instructions or the rig 
instructions. 

Hazardous activities such as maintenance and vessel 
entry should be covered by a permit system. The principles 
are similar to those for an industrial plant as described in 
Chapter 21. 

One of these principles is formal handover from opera¬ 
tions to maintenance personnel and then handback in the 
reverse direction. In a laboratory these responsibilities 
may sometimes be less clear than in a plant and, as just 
stated, they need therefore to be clearly defined. The effec¬ 
tiveness of the permit system depends on formal obser¬ 
vance of such handovers. 

A9.10.10 Housekeeping 

There should be a high standard of housekeeping. Facilities 
should be provided for disposal of broken glass and of waste 
materials. Equipment not in use should he removed or arran¬ 
ged tidily. Spillages should be cleaned up at once. Orderly 
sample storage with minimal retention should be maintained; 
glassware/equipment cleaning should be carried out. 

A9.10.11 Out-of-hours working 

Personnel working out of normal work hours should be 
required to sign in and sign out. 

Working alone in the laboratory should be permitted only 
where the hazard is low and is best kept to a minimum. 
Anyone who does work alone should be in contact with, or 
should be visited by, the security guard at regular intervals. 

A9.10.12 Unattended operation 

Unattended operation of equipment may present a hazard, 
especially if flammable or toxic materials are involved. 
There will be some experiments where such operation is 
not permissible. When unattended operation is practiced, 
arrangements should be made for the apparatus to be vis¬ 
ited by a trained security guard, who should be given full 
instructions on the action to be taken in case of accident or 
doubt and should be able to make telephone contact with 
the experimenter. 

A9.10.13 Access 

Access to the laboratory should he subject to control and 
unauthorized persons should be excluded. The extent of 
the measures necessary depends on the nature of the 
hazards and the confidentiality of the work. 

A9.11 Laboratory Fire and Explosion Protection 

A9.11.1 Fire protection 

The laboratory should be designed for fire protection, in 
accordance with building and fire protection codes and 
with advice from the fire authorities. 

Some basic elements of design for fire protection include 
the fire resistance of the laboratory envelope, including 
doors; internal layout; hazardous area classification; 
mechanical ventilation and a fire alarm system. 

It is desirable that there be constructional features with a 
minimum fire resistance between the laboratory and 
any adjoining section of the building and that the doors 
meet a fire resistant standard. Measures should be taken 
to prevent fire spread through openings in walls and voids 
in the roof. 


It should be a principal aim of the laboratory layout to 
minimize both the occurrence and escalation of fire. 

Hazardous area classification should be applied to effect 
control of ignition sources. It is suggested in the IChemE 
Guide that for a well-ventilated laboratory classification as 
Zone 2 should be sufficient. The guide states that ideally 
the whole space should be so classified, but if this is not 
practical, the Zone 2 should extend at least 2 m around any 
potential leak source. 

The risk of buildup of a flammable atmosphere may be 
minimized by the use of mechanical ventilation. The guide 
recommends that where flammable liquids are in use, the 
ventilation fan should be operated for the period of use and 
for 5 min thereafter. (Use of a flammable storage cabinet 
may be appropriate. Also, labs with fire risk may need to 
require workers/visitors to use Flame Retardant Clothing.) 

There should be a fire alarm system with alarm points 
inside the exits and at other strategic points. 

A9.11.2 Fire fighting 

The laboratory should be equipped with suitable fire 
extinguishers, fire blankets, etc. An account of fire extin¬ 
guishers in general is given in Chapter 16 and in the 
laboratory context in the IChemE Guide. 

A9.11.3 Explosion protection 

Where there is to be operation of equipment such as an 
experimental reactor with a significant risk of vessel rup¬ 
ture, a separate cubicle should be provided in which the 
work can be conducted. Such arrangements are perhaps 
more commonly found in pilot plants, but may find place in 
a laboratory. 

The cubicle should be designed to contain both blast and 
missiles. Accounts of such explosion-proof cells are given 
in Chapter 17 and Appendix 10. 

A9.12 Emergency Planning 

Emergency planning should be undertaken to identify the 
potential causes and types of emergencies and their con¬ 
sequences, and the countermeasures required. The princi¬ 
ples are similar to those outlined in Chapter 24. 

Planning should cover not only the laboratory and the 
rigs but also storages and services. The plan should be 
formulated by conducting audits during design and at 
commissioning and should be updated by audits at regular 
intervals thereafter. 

The purposes of emergency planning are to protect life 
and property. They are achieved by early recognition of the 
problem, rapid raising of the alarm and prompt action to 
bring the incident under control and to separate the people 
from the hazard. 

Functions which need to be performed in an emergency 
are to deal with the emergency, to evacuate people and to 
liaise with the emergency services. The personnel who will 
perform these functions should be identified and their 
tasks defined. 

The range of situations in laboratories tends to be par¬ 
ticularly wide and the emergency plan should aim for 
flexibility. 

Laboratory personnel responsible for emergency 
response should understand the statutory duties and likely 
priorities and needs of the external services. 

There are certain typical problems faced by the external 
fire services coming into laboratory situations. Steps 
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should be taken to find out what information the fire bri¬ 
gade is likely to need and to ensure as far as is practical that 
it can be provided. This means having the information 
available and appointing someone to communicate it in the 
actual event. Frequently fire brigades are hampered by 
hazards from gas cylinders and radioactive materials and 


by lack of information on the chemicals present and then- 
hazards. 

There should be regular fire drills, including joint exer¬ 
cises with the external services. 

A detailed account of laboratory emergency planning is 
given in the IChemE Guide. 
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APPENDIX 10/2 PILOT PLANTS 


Pilot plants are intermediate in scale between the labora¬ 
tory bench and the full-scale plant. They are used for a 
variety of purposes, essentially to obtain information on 
process design and operation and on products, including 
information relevant to safety. Some hazards are liable to 
show up first at the pilot plant stage and the pilot plant is 
therefore an important tool for hazard identification, as 
described in Chapter 8. Here consideration is given to the 
more general aspects of pilot plants and particularly to 
their characteristic features and hazards, and to safety in 
pilot plants. 

Accounts of pilot plants are given in Pilot Plants, Models 
and Scale-Up Methods in Chemical Engineering by 
Johnstone and Thring (1957), The Chemical Plant from Pro¬ 
cess Selection to Commercial Operation by Landau (1967), 
Chemical Process Development by D.G. Jordan (1968) and 
Pilot Plant Design, Construction and Operation by Palluzzi 
(1992) and by Constan (1984), Carr (1988), Dore (1988), 
Palluzzi (1989,1990,1991), Lesins and Moritz (1991), J. Jones 
et al. (1993a,b) and Lo and Oakes (1993). Safety is treated in 
the Pilot Plant Safety Manualby the AIChE (1972/33) and by 
Kohlbrand (1985), Siminski (1987), Carr (1988), Dore (1988), 
Capraro and Strickland (1989), Carson and Mumford (1989 
LPB 89, 90), Constan, Herman and Moeller (1992) and 
Palluzzi (1992). 

A number of authors on pilot plants give checklists, often 
as tables. These checklists include the following: justifica¬ 
tion for use (J. Jones et al., 1993b); overall programme 
(Lesins and Moritz, 1991; J. Jones et al., 1993a); chemical 
and process information (Dore, 1988); scale-up issues (Lo 
and Oakes, 1993); project review (J. Jones et al., 1993a); 
flowsheet review (Lesins and Moritz, 1991); hazards (Dore, 
1988); hazard identification—what-if review (Lesins and 
Moritz, 1991); plant construction (Dore, 1988); staffing 
requirements (J. Jones et al., 1993a); operating and safety 
aspects (Dore, 1988); operating manual (J. Jones et al., 
1993a); operator training manual (Chaty, 1985) and com¬ 
puter control systems (J. Jones et al., 1993a). Many of the 
entries in the AIChE Pilot Plant Safety Manual may be used 
as checklists for pilot plant safety. 

In general, the principles of laboratory safety, discussed 
in Appendix 9, are applicable to pilot plants also. 

Selected references on pilot plants are given inTable A10.1. 


A10.1 Pilot Plant Uses, Types and Strategies 

A10.1.1 Uses of pilot plants 

The purposes for which pilot plants are built are the 
development of (1) a new product, (2) a new process or (3) an 
existing process. For a new product small quantities may 
be required for testing and for market development. For a 
new process information is required to prove feasibility, 
specify operating conditions, resolve scale-up issues, pro¬ 
vide design data, identify problems, develop operating 
procedures and provide experience and training. For an 
existing process work may be required to check the suit¬ 
ability of different raw materials, improve product quality, 
explore modified operating conditions, improve the treat¬ 
ment of the effluents and effect cost reductions and other 
optimizations. 

Frequently it is information on reaction kinetics and 
yield which is lacking and which the pilot plant is required 
to provide. Other information typically obtained from a 
pilot plant is data on heat and mass transfer and pressure 


TableAIO.1 Selected references on pilot plants 


Michel, Beattie and Goodgame (1954); Johnstone and 
Thring (1957); E.L. Clark (1958); Lengeman and Hardison 
(1964); Gernand (1965); Hudson (1967); Landau (1967); 
Ellis (1968); D.G. Jordan (1968); Anon. (1969a); IChemE 
(1969/47); Conn (1971); AIChE (1972/68); Katell (1973); 
Roche et al. (1977); Shields and Vander Klay (1977); Braun 
(1978); Berty (1979); Randhava, Lo and Kronseder (1982); 
Kunesh and Hollenack (1983); Constan (1984); J.L. Jones 
(1984); Margolin (1984); Pfeffer, Bhalla and Dope (1984); 
Chaty (1985); Lowenstein (1985); P. Dawson (1986); Palluzzi 
(1987,1990,1991,1992); S.G. Phillips (1990); Ginkel and 
Olander (1991); Lesins and Moritz (1991); Pollack (1991); 
Uitenham and Munjal (1991); Jones et al. (1993a,b); Lo and 
Oakes (1993) 

Safety in pilot plants 

A. R. Jones and Hopkins (1966); Deviny (1967); Graf (1967); 
Marinak (1967); Prugh (1967); Klaassen (1971); Ligi (1964, 
1973); Bait and Berg (1974); Weissbach (1976); Roche et al. 
(1977); Lowenstein (1979); Franko-Filipasic and Michaelson 
(1984); Kohlbrand (1985); Basta (1986b); Siminski (1987); 
Carr (1988); Dore (1988); Capraro and Strickland (1989); 
Carson and Mumford (1989 LPB 89,90); Bond, Carson 
and Mumford (1990 LPB 93); Constan, Herman and 
Moeller (1992) 

High-pressure pilot plants 

E.L. Clark (1963); W.G. High (1967); AIChE (1972/65); 

B. C. Cox and Saville (1975); Jercinovic (1984); Mehne (1984) 


drops; on mixing effects; on impurities, foams and emul¬ 
sions; and on fouling and corrosion. 

The justification for pilot plants is discussed by J. Jones 
et al. (1993a). They discuss the following situations, in 
increasing order of difficulty: 


Process 

Product 

Customer 

New 

Existing 

Existing 

New 

New 

Existing 

New 

New 

New 


A10.1.2 Types of pilot plant 

Pilot plants differ in both type and scale. There are three 
principal types: (1) the general-purpose pilot plant; (2) the 
specific-purpose pilot plant; and (3) the multi-purpose 
pilot plant. The merits of these different types of pilot plant 
are discussed by Palluzzi (1991,1992). 

Representative capacities for different scales of opera¬ 
tion are given by J. Jones et al. (1993b) as follows: 


Scale 

Capacity 

Batch 

Continuous 

Laboratory bench 

0.1-1000 g 

10-100 g/h 

Mini-pilot plant 

1-100 kg 

0.1-10 kg/h 

Pilot plant 

100-1000 kg 

10-100 kg/h 

Semi-works 

1000-10,000 kg 

100-1000 kg/h 
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Some pilot plants currently in use are quite old and over the 
years have been modified and adapted. 

Accounts of particular pilot plants include those of Chaty 
(1985), P. Dawson (1986), Siminski (1987), Carr (1988), 
Capraro and Strickland (1989) and Lesin and Moritz (1991). 

A10.1.3 Strategies for development utilizing pilot plants 

It need not be assumed that a pilot plant necessarily has to 
be designed and located in-house; there are other options. 
The main options are (1) design and location in-house; 

(2) location in-house but with design by a design contractor; 

(3) hiring of outside pilot plant facilities and (4) contracting 
out of the pilot plant work. The merits of these options are 
discussed by Palluzzi (1991). 

A10.2 Pilot Plant Features and Hazards 

While the hazards encountered on pilot plants are essen¬ 
tially similar to those on full-scale plants, the character¬ 
istics of pilot plants are such that the hazard profile is 
somewhat different. The specific features and hazards of 
pilot plants are discussed by a number of authors, includ¬ 
ing Carr (1988) and Capraro and Strickland (1989). 

Some features characteristic of pilot plants include 
(1) gaps in knowledge; (2) novelty of chemicals, process, 
equipment and operations; (3) scale effects; (4) extent of 
manual activities; (5) frequency of modification; (6) multi¬ 
plicity of tasks; (7) materials storage and transfer; (8) flow 
features; (9) recycles; (10) utilities features; (11) frangible 
elements; (12) plant layout features; (13) location in a 
building and (14) research staff involvement. 

The process reaction may involve a number of potential 
hazards. Most frequently mentioned is the unidentified 
reaction exotherm, which could lead to a reaction runaway. 
There should be a formal system of screening to identify 
any exotherms. However, this is by no means the only 
hazard which may be present. The raw materials may con¬ 
tain impurities. The ratio and flow rate of the reactants may 
vary. There may be inhomogeneities due to poor mixing 
which affect reaction rate and temperature measurement. 
Features of the reaction such as induction time may assume 
greater significance. The handling of the catalyst may pose 
problems. 

There are a number of equipment problems which can 
occur on pilot plants. One is the use of unfamiliar equip¬ 
ment. Another is the reactivation of idled equipment. When 
this is in prospect, a check on the integrity of the equipment 
is advisable; it may have been ‘cannibalized’. Another prob¬ 
lem can be the use of equipment which differs from that 
used on the full scale and for which, in consequence, oper¬ 
ating procedures may be deficient. An example is an oven 
used by a number of different users with no formal control 
over its contents and settings. 

A principal reason for building a pilot plant is to fill the 
gaps in the information necessary for the design and 
operation of the full-scale plant. This implies that there will 
be gaps also in the information which ideally would be 
available for the design of the pilot plant. 

A pilot plant is on a scale intermediate between those of 
the laboratory and of the full-size plant. Relative to the 
laboratory, the larger scale of the pilot plant means that 
hazards may become apparent which were obscured at the 
laboratory scale. Operation on the laboratory scale has 
some of the features of an inherently safer design. The most 
obvious is the limited inventory, but there are also others 


such as good ventilation. In some cases the problem may be 
that the change in scale is accompanied by other changes, 
such as the use of less pure raw materials. In others it may 
simply be that features always present become more 
obvious with scale such as the need to dispose of noxious 
effluents. Moreover, the pilot plant is the stage at which the 
process is first carried out in process plant as opposed to 
laboratory equipment and thus the stage at which difficul¬ 
ties of processing, of equipment or of measurement will 
show up. 

Relative to the full-scale plant, the smaller scale of 
the pilot plant is beneficial in reducing the scale of the 
hazard, but can lead to problems of flow control, blockage 
and so on. 

The balance between manual and automatic functions 
tends to be different in a pilot plant from that on the full 
scale. There are several reasons for this. Foremost reasons 
are economics and flexibility; others include factors such 
as measurement problems. 

It is a normal, and expected, feature of pilot plant 
operation that both the process and the plant are subject 
to frequent modification. A system for the control and 
documentation of modifications of both types is required, 
both as a record of the learning process and to assure 
safety. 

Work in a pilot plant is liable to involve tasks which are 
more numerous, varied and novel features, which can 
increase the probability of error. 

The problems of containers for materials and the identi¬ 
fication of the materials and containers can be a significant 
problem in pilot plants. The number of materials used may 
be appreciable, creating much greater scope for error than 
on a regular plant. It is necessary, therefore, that raw 
materials, intermediates, products and effluents be fully 
identified. Where common containers are used, as some¬ 
times with effluents, controls need to be established to 
prevent mixing of incompatible materials. 

Flow problems associated with features such as highly 
viscous fluids, gas locks, lutes, siphons, water hammer, 
cavitation and so on are features commonly encountered on 
process plants, but it is on the pilot plant that they may be 
first experienced and will have to be solved. 

Another feature which may well be novel at the pilot 
stage is recycling with its characteristic problems of posi¬ 
tive feedback and build-up of impurities. 

Some pilot plants, particularly the larger ones, are on a 
works site and are served by the works utilities. It is normal 
practice to give advance warning to the main production 
plants of an expected change in the status of such utilities, 
but the Cinderella status of the pilot plant may result in 
its being overlooked, and suffering unexpected loss of a 
utility. 

Frangible pipework and vessels made of glass or plastic 
and other features, such as rotameters and sightglasses are 
common in pilot plants, and make the plant more vulner¬ 
able to damage and leaks. 

Plant layout in pilot plants tends to be more congested. 
Such congestion can increase the risk of damage to plant 
or inadvertent movement of controls. An example of the 
latter is movement of a control such as a valve as an 
operator brushes against it. This danger is increased by 
the fact that the valve is much lighter and more readily 
moved than its equivalent on the full scale. Similar points 
apply to damage to plant, which is more vulnerable on the 
small scale. 
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In contrast to most large-scale plants, which are in the 
open, many pilot plants are in buildings, and this has a 
number of implications. There is often a more congested 
layout. There is an increased hazard from accumulation of 
gases or vapours. These may be flammable or toxic vapours, 
whether from open vessels or from leaks and spillages. Or 
they may be asphyxiant gas, such as nitrogen, or flamm¬ 
ability-enhancing gas, such as oxygen. Likewise, there may 
be occupational hygiene problems because fugitive emis¬ 
sions disperse less readily. 

Research staff involved in pilot plant work are likely to 
be less attuned than those familiar with plant operation to 
the disciplines necessary, and specific steps may need to be 
taken to rectify this. 


A10.3 Pilot Plant Scale-up 

Historically, a basic reason for the use of a pilot plant has 
been the difficulty of scaling up from the laboratory bench 
to the full scale. To a considerable extent, such scale-up is 
what chemical engineering is all about, and progress in the 
discipline has made this reason seem rather less cogent. 

Despite this, operation on the pilot scale may still be 
desirable even in respect of fundamental features such as 
reactor heat transfer, mixing, runaway and venting. 

However, even in terms of scale-up, there is more to pilot 
plant operation than the scale effects typically expressed 
in terms of dimensionless numbers and engineering 
models. As already indicated, there are other effects of 
scaling up such as the use of less pure raw materials; the 
occurrence of poor mixing; the build-up of impurities 
due to recycling; the need to dispose of noxious effluents; 
and so on. 

The process of scale-up is frequently envisaged as a linear 
one, progressing to successively larger scales. An alter¬ 
native model, however, is one in which the process is itera¬ 
tive, passing to and fro between the smaller and large scales. 

The pilot plant stage is the first at which the process is 
operated in the form of a plant. It therefore provides the 
first opportunity to examine all those features which are 
new in passing from laboratory bench to plant. This is so 
whether the pilot plant is small or large. 


A10.4 Pilot Plant Design 

There are a number of features which are characteristic of, 
or tend to bulk large in, the design of pilot plants. Some of 
these are now considered. 


A10.4.1 Some design objectives 

The pilot plant should be utilized to design the full-scale 
plant using recognized engineering methods of scale-up. 

The design should accommodate a sufficiently wide 
range of operating variables, such as pressure and tem¬ 
perature, to allow the effect of these variables to be deter¬ 
mined with some confidence. 

The purpose of the pilot plant is to provide information 
for the design of the full-scale plant. The plant should be 
designed and operated so as to yield information in which 
confidence can be placed and which is conformable to 
established design methods. As far as practicable, the pro¬ 
cess should be modelled and the experimental results 
compared with the model as they are obtained. Important 
features of such a model are the mass and heat balance and 


pressure drop relations, the reaction kinetics and the unit 
operations models. 

A10.4.2 Design standards and codes 

A particular problem in pilot plant design is the application 
of standards and codes. In general, these are formulated 
with full-scale plant in mind, and can sometimes pose dif¬ 
ficulties for the pilot plant designer. 

The standards to be applied should be declared at an 
early stage and any potential conflict identified, whether 
between different standards or between a standard and the 
design. 

The application of standards to pilot plants is discussed 
by Siminski (1987), who describes the particular case of the 
standards covering an engine test facility. The approach 
which he describes is to assess the impact of standards 
on the safety, industrial hygiene and environmental 
aspects of the plant, to assess the risks and develop alter¬ 
native strategies, to seek independent review and to test 
design concepts early on, to examine the specification to 
check whether features causing conflict with standards 
are strictly necessary, and to negotiate with the parties to 
achieve solutions. 

A10.4.3 Flexibility and multiple use 

Since the purpose of a pilot plant is to extend knowledge 
and deal with novel issues, it needs to be flexible. Methods 
of providing such flexibility are discussed by R Dawson 
(1986). They include the provision of inherently flexible 
equipment, a range of equipments and materials of con¬ 
struction and a layout which groups together items which 
most frequently need to be connected, thus avoiding long 
pipe runs. 

A10.4.4 Plant layout 

The basic principles of plant layout apply to pilot plants 
also, but some features assume particular importance. 

One feature just mentioned is layout to minimize the 
length of pipework and to ensure a convenient arrangement 
of principal items of equipment. 

Another feature is to ensure good access, which includes 
both access to items of equipment but also minimization 
of the likelihood of inadvertent damage to plant or opera¬ 
tion of controls as personnel move about congested pas¬ 
sages. Closely related is minimization of damage by dropped 
objects. 

Another feature is clear identification of equipment. One 
aspect is the labelling of tanks and vessels holding process 
materials, since misidentification of materials is an error 
characteristic of pilot plant operation. Another aspect is 
labelling and coding of equipment which may need to be 
worked on and which may contain noxious materials. 

Another feature is provision for collecting and disposing 
of liquid leaks. 

A fifth feature is the provision of protective barricades 
against missiles. In some cases this leads to a design in 
which the pilot plant space is divided up into separate cells. 

A10.4.5 Protective barricades 

If the process carried out involves high pressures, and 
particularly high-pressure reactions, protective barricades 
may be provided. 

Some practical aspects of barricades are discussed by 
Carr, who describes methods of protection against missiles 
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such as valve stems and reactor fragments, as well as high- 
pressure steam jets, which can be almost as damaging. 

Missiles from an exploding reactor may be stopped by a 
barricade in the form of a sand bath protected by a pressure 
relief valve. This reduces the need to house the whole plant 
in a barricade. 

For barricade design in general, design case missiles 
are specified and the barricade is designed to withstand 
these missiles, using methods such as those outlined in 
Chapter 17. It is on pilot plants that the provision of such 
barricades is most common, and thus where most of the 
expertise resides. 

A10.4.6 Pressure systems 

The combination of the facts that a pilot plant is usually in a 
building and that it is subject to continuous experimenta¬ 
tion and modification means that it is necessary to give 
particular attention to the integrity of the pressure system. 
Procedures should be laid down for the proof testing and 
leak testing of the plant. 

A10.4.7 Pressure relief 

It is common practice in pilot plants to put a safety valve on 
a vessel. The lines to and from such valves tend to be small 
diameter and liable to fill with liquid which then solidifies. 
Countermeasures include design of lines so that the liquid 
drains away and use of heated lines. 

A10.4.8 Frangible elements 

Pilot plants are frequently constructed in part or in whole 
in glass or plastic. They also tend to contain vulnerable 
features such as rotameters and sightglasses. 

The protection of the latter devices is described by Carr. 
Use is made of protective shields with adequate pressure- 
relief space between the shield and the device. Specific 
designs have been developed and tested for most types of 
device used. 

A10.4.9 Gas cylinders 

Another hazard discussed by Carr is gas cylinders. Rup¬ 
ture of a line supplied by a high pressure cylinder can result 
in a large jet of gas. He describes arrangements involv¬ 
ing the use of a limiting orifice just downstream of the 
regulator. 

A10.4.10 Ignition source control 

Another aspect of the design is the control of ignition 
sources. The importance of this is enhanced in a pilot plant 
by the facts that the probability of a leak tends to be higher, 
that in a building gas or vapour accumulates more readily 
and that the probability of personnel being present is rela¬ 
tively high. 

Since it is necessary to exclude all ignition sources, the 
proper approach is to make a formal examination of the 
plant to identify possible sources of release. These sources 
include activities, both operations and maintenance, as 
well as fixed plant. Such ignition hazard identification 
provides a basis for the design both of layout and equip¬ 
ment and of operating controls. 

The application of the methods of hazardous area clas¬ 
sification is one necessary aspect of this. The principal 
options are classification as Zone 1 or as Zone 2. Classi¬ 
fication as Zone 1 puts constraints on the equipment, 
particularly instrumentation, which can be used, while 


classification as Zone 2 requires the elimination of leaks 
and a good level of ventilation. 

An account of practical measures for an area classified 
as Class 1, Division 2, in the US system is given by Carr. 

Other features typically include liquid catchment and 
disposal arrangements, gas detectors and mechanical 
ventilation. 

Multipurpose plant places particularly severe require¬ 
ments on ignition control. 

These hardware measures need to be complemented by a 
system of operational controls to eliminate ignition sour¬ 
ces. Failure to do this largely negates the value of the 
hardware. 

A10.4.11 Plant classification 

A systematic approach to the design of pilot plants is to use 
a formal method of classification. 

Carr describes the method which is used in one company 
for classifying pilot plants for the purposes of design and 
operation and of personnel protection and which utilizes 
four operating categories: 


Category 

Hazard potential 

1. 

Detonation 

High potential for detonation or mas¬ 


reactions 

sive rupture and large, extremely 
rapid release 

2. 

Rupture 

High potential for large rupture and 


and fires 

large fire 

3. 

Leaks and 

Low potential for leaks and, at worst, 


small fires 

only leaks and fires of limited size 

4. 

Low 

Near ambient temperatures and low 


hazard 

pressures with very low potential 


operations 

for either ruptures or fires 


The corresponding protection requirements are given in 
Table A10.2. 

A10.4.12 Extent of automation and protective systems 

The operations to be performed on a pilot plant are on a 
small scale and are required for a limited period, relative to 
the equivalent operations on the full-scale plant. Further, 
their automation may well require the development of 
measuring instrumentation. Hence it will generally not be 
appropriate to seek to automate these operations to the 
extent that will pertain on the full-scale plant. 

Somewhat similar considerations apply to the provision 
of protective systems such as trips and interlocks. These 
definitely have their place in pilot as in full-scale plants, 
but the particular mix appropriate to the full scale may not 
suit the pilot scale. 

A10.4.13 Control systems 

The pilot plant should be provided with instrumentation 
sufficient not only to obtain design data but to ensure 
safety. The same principles should be applied as to the 
design of full-scale plant, such as the use of trips and 
interlocks, subject to the comments made above on the 
extent of automation and of protective systems. 

The use of computers, mainly PCs, for data acquisition 
and control of experiments is routine in pilot plants. In some 
cases the flexibility of such computers has also been 
exploited to provide alarms and trips. 






Table A10.2 Protection requirements scheme for pilot plants (after Carr, 1988) (Courtesy of the American Institute of Chemical Engineers) 


Typical hazard 


Category 1 

Category 2 

Category 3 


Category 4 


Detonating reactions 

Rupture and fire hazards 

Leaks and small fires 


Low hazards 


Hazard 

Protection 

Hazard 

Protection 

Hazard 

Protection 

Hazard 

Protection 


potential 

device 

potential 

device 

potential 

device 

potential 

device 

Detonation 

High 

Barricade 

Negligible 


Negligible 


Negligible 


(internal) 


Blast 









relief 







Shrapnel 

High 

Barricade 

Negligible 


Negligible 


Negligible 




Shrapnel stop 







Explosive atm. 

High 

Barricade Blast 

Moderate 

Baffle 

Negligible 


Negligible 


(external) 




Ventilation 







Ventilation 

Min. cubicle 


Cubicle size 





Fire 

High 

Baffle 

High 

Baffle 

Moderate 

Baffle 

Negligible 


Pressure leaks 

Possible 

Baffle 

Possible 

Baffle 

Possible 

Baffle 

Negligible 




(barricade) 






Skin toxic 

Possible 

Baffle 

Possible 

Baffle 

Possible 

Baffle 

Possible 

Baffle 



(barricade) 







Lung toxic 

Possible 

Ventilation 

Possible 

Ventilation 

Possible 

Ventilation 

Possible 

Ventilation 

Permitted 


Exculded 


Limited 


Limited 


Unlimited 

access to 
operating 









Summary of 


Barricade 


Baffle 


Baffle 


Baffle required if: 

protective 


Blast relief 


Ventilation 


Ventilation 


skin toxic 

devices 


Shrapnel 


Cubicle size 


Required if: 


chemicals or 



stop 




lung 


adjacent 



Ventilation 




toxic 


operations (see 



Min. cubicle 




chemicals 


baffle design) 
Ventilation 









required if: lung 
toxic chemicals 
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Control schemes for pilot plants are discussed by 
Uitenham and Munjal (1991) and Palluzzi (1992). 

The effectiveness of any protective systems depends on 
the training of the operators. 

A10.4.14 High-pressure plants 

Some pilot plants involve high-pressure equipment. The 
AIChE Pilot Plant Safety Manual contains sections on the 
design of pilot plants for high-pressure and for high- 
temperature operation. For the former further guidance 
is given in the High Pressure Safety Code by E.G. Cox 
and Savffle (1975) and by E.L. Clark (1963), W.G. High 
(1967), Jercinovic (1984) and Mehne (1984). 

At the pilot plant scale it is quite common to provide 
blast-proof cubicles and barricades against missiles, which 
tend to be impractical on the full-scale plant. 

A10.5 Pilot Plant Operation 

A10.5.1 Suitability of plant 

If the pilot plant is a multipurpose one and is thus used to 
investigate a number of different processes, a particularly 
careful check should be made that it is fully suitable for the 
proposed process. 

A10.5.2 Personnel and training 

The magnitude of the hazard on a pilot plant is less than on 
the full scale, but in other respects the operations tend to be 
more demanding. The materials, the process, the equip¬ 
ment, the plant and the procedures are all relatively unfa¬ 
miliar. The operating team needs strong leadership and 
experienced personnel. 

As with plant operation generally, training is critical. 
Many of the topics mentioned in this appendix imply the 
need for training. 

Training is required for management and research per¬ 
sonnel also. The latter may well be used to laboratory rather 
than plant situations, and need to become familiar with 
plant disciplines. 

A10.5.3 Operating and emergency procedures 

The operations to be performed should be identified and for 
each a suitable operating procedure should be developed, and 
examined from the safety viewpoint. Operations which are 
likely to bulk large in pilot plant work include manual opera¬ 
tions, reactor operations, sampling and measurement activ- 
ities.There also needs to be suitable emergency procedures. 

A10.5.4 Specifications and documentation 

Despite the small scale, it is desirable to adhere to a certain 
formality in pilot plant operation. Some aspects of this are 
discussed by J. Jones et al. (1993a). 

There should be formal specification for the raw materi¬ 
als, intermediate and products, for yield and throughput, 
for cost targets and for the completion date. 

Records should be kept of the progress of the project 
during the pilot plant stage, of problems and hazards 
encountered, and of the steps taken to solve the problems 
and to eliminate or control the hazards. 

The data needed for the design of the full-scale plant 
should be documented and the information gathered and 
recorded. 

The operating procedures evolved, including the emer¬ 
gency procedures should be properly documented. Again, 
this should include any problems and hazards encountered 
and the response made. 


Al 0.5.5 Mothballing 

By its nature a pilot plant is liable to be subject to inter¬ 
mittent operation, with periods when it is not in use. Often a 
pilot plant is shut-down and ‘mothballed’ for an extended 
period. If this is a possibility, it should be taken into 
account in the design. At the start of such a shut-down 
measures should he taken to prevent deterioration, includ¬ 
ing cleaning and flushing of the plant. On recommissioning 
care should be taken to identify hazards which may arise 
from the prolonged shut-down. 

A10.6 Pilot Plant Safety 

An accident in a pilot plant, like one in a laboratory, is 
generally on a much smaller scale than one on a full-scale 
plant, but again it can give rise to considerable direct and 
consequential loss. 

Safety in pilot plants is treated in the AIChE Pilot Plant 
Safety Manual. This deals with procedures, including 
transfer of information from the chemist, hazard identi¬ 
fication, process design, mechanical design and design 
review; scale-up from pilot to full scale; engineering 
standards for flammable, explosive, corrosive and toxic 
materials and for radiation protection; maintenance proce¬ 
dures; and high-pressure and high-temperature processes. 

In general, the same approach should be taken to the 
design and operation of a pilot plant as is adopted for a full- 
scale plant. Many of the topics already discussed are equally 
relevant to pilot plants, including management and man¬ 
agement systems (Chapter 6), hazard identification (Chap¬ 
ter 8), reactive hazards (Chapter 3), process, pressure system 
and control system design (Chapters 11—13), fire, explosion 
and toxic release (Chapters 16-18), plant operation and 
maintenance (Chapters 20 and 21), personal safety (Chapter 
25) and safety systems (Chapter 28). On the other hand there 
are certain features which are characteristic of pilot plants. 

Al 0.6.1 Project safety reviews 

There should be a system of project safety reviews adapted 
to pilot plant design and operation. These should be the 
subject of a formal requirement and should be documented. 

The general methods of hazard identification should be 
used to discover potential hazards in plant design and 
operation. In addition, there are hazard identification 
procedures which are particularly relevant to pilot plants. 

The information on the chemicals handled, the reactions 
involved, and the materials of construction for the plant 
should be as complete and as well documented as practical. 

The transfer of information from the chemist to the 
engineer should be regulated by formal procedures. The 
chemist should give a full description of the process, 
including the reaction kinetics and heats of reaction, limits 
of operating parameters such as pressure and temperature, 
and procedures and precautions adopted. The engineer 
should study the research reports to envision problems 
which may arise in scale-up to the pilot plant. 

The process reaction(s) should be screened to identify 
any reaction exotherm which might lead to a runaway 
reaction as described in Chapter 33. 

A10.7 Pilot Plant Programmes 

Accounts of pilot plant programmes emphasize a number 
of themes. They include keeping attention focused on the 
basic chemistry; keeping the programme simple, first 
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establishing feasibility, before getting involved in matters 
such as yield, effluents, etc., applying lateral thinking and 
seeking alternative approaches; being prepared to take the 
calculated risk that the process may not work, although 
taking no risks with safety; and making use of expert 
advice from other sources. 

A10.7.1 Handover and decommissioning 

The pilot plant operation must recognize the point at 
which the baton should be handed over to the next stage. 


However, it is advisable not to be in too much of a hurry to 
decommission a pilot plant. The purpose of the plant is to 
provide information and/or products to other users. Once 
they have received these, they too will have to undergo a 
learning process, and are likely to come back with quer¬ 
ies, some of which may require further plant trials. This is 
true particularly with new products, where the queries 
may be directed to improving quality or reducing cost and 
meeting regulatory requirements and environmental 
restraints. 
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APPENDIX 11/2 SAFETY, HEALTH AND THE ENVIRONMENT 


Although the problems of environmental protection (EP) 
are basically beyond the scope of this book, they cannot be 
completely neglected, because there are a number of ways 
in which they are closely linked to safety and loss preven¬ 
tion (SLP). 

Selected references on the environment and pollution are 
given in Table All.l. 

Safety, Health and the Environment 

These links are recognized in the common practice of cou¬ 
pling health, safety and environment (HSE) or safety, 
health and environment (SHE). In the following the latter 
acronym is preferred, the former already having an estab¬ 
lished meaning. 

A11.1 Common Responsibilities 

All. 1.1 Professional responsibilities 

The professional engineer has responsibilities both for 
safety and for environmental matters, which are very 
similar in nature. 

These responsibilities are outlined in the Engineering 
Council codes A Code of Professional Practice on Risk Issues 
(1992) and A Code of Professional Practice on Engineers and 
the Environment (1993) described in Chapter 3. 

All. 1.2 Legislation 

The detailed legislative requirements for safety and envi¬ 
ronment naturally vary between countries but the world¬ 
wide trend is clear. It is towards higher standards both 
inside and outside the factory; more formal management 
systems for identification, assessment and control; inher¬ 
ently safer/cleaner designs; and greater legislative and 
public pressures. 

Legislation is described in Sections A11.4-A11.6. 

A11.1.3 Professional education 

The education of professional engineers should provide a 
firm grounding in both safety and environmental matters, 
creating awareness, instilling responsibility and introduc¬ 
ing the appropriate engineering approaches. 

A11.1.4 Job descriptions 

Safety and environmental issues have both grown pro¬ 
gressively in importance for industry and government at 
all levels. In industry there has been an increasing ten¬ 
dency for job titles and descriptions to assign respon¬ 
sibilities which cover both safety and environment. 

All.2 Common Elements 

All.2.1 Economic factors 

Both SLP and EP have a fundamental influence on the 
design of the plant. Each imposes constraints which may 
well be decisive in the economics of the design. 

A poor design is more likely to require the addition of 
numerous protective devices and the installation of much 
pollution control equipment and to involve more last- 
minute modifications to meet legislative and other safety 
and environmental standards. 

A11.2.2 Inherently safer/cleaner design 

The concept of inherently safer design, discussed in 
Chapter 11 and Chapter 32, has its counterpart in that 
of inherently cleaner design, or, more broadly, waste 
minimization. 


Table A 11.1 Selected references on pollution, effluents 
and waste disposal 


Chementator (Table A1.4); EPA (n.d./l, 1988/2); MCA (SG-9, 
n.d./U); RCEP (Appendix 28); Mohlman (1950); Brady 
(1959); Cross (1962); Carson (1963); Byrd (1968); Chem. 
Engng (1968—); Chieffo and McLean (1968a,b); Marshal 
(1968); AIChE (1969-/120-126); Bond and Straub (1972, 
1973); Cecil (1972); Levine (1972b); Nilsen (1972b); Prober 
(1972—); Racine (1972); Ripley (1972); S.S. Ross and White 
(1972); G.F. Bennett (1973); DoE (1973 Poll. Pap. 4,1974 Poll. 
Pap. 1,1976 Poll. Pap. 9); R.D. Fox (1973);Vervalin (1973b,c, 
1979); Mahey (1974); McKnight, Marstrand and Sinclair 
(1974); Napier (1974a); Rudolph (1974); Sax (1974); Strahler 
and Strahler (1974); Jaffe and Walters (IChemE 1975/60); 
Roulier, Landreth and Carnes (1975); Singer (1975); 
Yamaguchi (1975); Boyd and Leotta (1976); CONCAWE 
(1976 6/76,1977 2/77,1979 5/79); R.W James (1976); Warner 
(1976,1979); Anon. (1977f); Allaby (1977); Ashby (1977, 
1979); E.B. Harrison (1977); Hillman (1977); Holum (1977); 
P. Sutton (1977b); Boyd (1978); G. Parkinson (1978,1980, 
1987); Pier etal. (1978); Pocock and Docherty (1978); Ricci 
(1978c); Schneiderman (1978); Bridgwater and Mumford 
(1979); Golden etal. (1979); Harwell (1979); Baasel, 
Mcallister and Kingsbury (1980); Bakshi and Naveh (1980); 
Dix (1980); Eggington (1980); Moss (1980); Anon. (1981i); 
Kletz (1981J, 1993e, 1994 LPB110); Portman and Norton 
(1981); Bennett, Feates and Wilder (1982);Trewhitt (1982); 
API (1983/7); ASME (1983/194); R.M. Harrison (1983); 
Macrory (1983); Train (1983); Barnes, Forster and Hrudey 
(1984—); D. Clarke (1984); Jalees (1985); Neely and Blau 
(1985); Pitt and Pitt (1985); D. Williams (1985); APCA 
(1986); Hollowood (1986);Vervalin (1986a); Anon. (1987i); 
Anon. (1988e); C. Butcher (1989c); CIA (1989 CE23,1991 
BT23); Hoover et al. (1989); Penkett (1989);Veselind, Peirce 
and Weiner (1990); IBC (1991/82-84); Jackman and Powell 
(1991); Shillito (1991); Anon. (1992 LPB 108); Diepolder 
(1992); Goldsmith (1992a); Parfitt and Andreasen (1992); 
Reid (1992); Wainwright (1992); Anon. (1993a,f); 

API (1993 Publ. 311,317); Doerr (1993); 

Englehardt (1993); Hydrocarbon Processing (1993b); 

Karrh (1993); Anon. (1994 LPB 120, p. 13); 

Agra Europe (1994a); Debeil and Myren (1994 LPB 119); 
Shillito (1994 IChemE/110) 

BS 7750:1992 

Waste minimization, inherently 
cleaner design 

Mencher (1967); Kohn (1978b); Duffy (1983);Tavlarides 
(1985); Goodfellow and Berry (1986); Koenigsberger 
(1986); EPA (1987b, 1988,1989a,b); Gardner and 
Huisingh (1987); ACGIH (1989/34); CIA (1989 CE1,1990 
CE2); Higgins (1989); Redman (1989c); H.M. Freeman 
(1990); Hethcoat (1990); Hunter and Benforado (1990); 

API (1991 Publ. 302); Berglund and Lawson (1991); R. 
Smith and Petela (1991-); Crittenden and Kolaczkowski 
(1992); Curran (1992); IBC (1992/88); Chadha and Parmele 
(1993); IChemE (1993/106,1994/111); Rossiter, Spriggs 
and Klee (1993) 

AIChE Center for Waste Reduction Technologies 

L.L. Ross (1991) 

Pilot plants 

Gundzik (1983); dAco, Campbell and Stone (1984); Pitt and 
Pitt (1985); Gurvitch and Lowenstein (1990) 
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Chemicals in the environment, inc. physical and 
chemical properties 

ASTM (Appendix 28); Sax (1957); MCA (1966-/13,14); 
CONCAWE (1970 9/70,19719/71,1985 5/85); Heck, Daines 
and Hindawi (1970); AIChE (1971/132,1975/138,1980/147); 
Walker (1971); ATucker (1972); NAS (1975); Moein, Smith 
and Stewart (1976); Neeley (1976,1980); Curtis, Copeland 
and Ward (1978); Mackenthun and Guarria (1978); SCI 
(1978); S.D. Lee and Mudd (1979); Tinsley (1979); Afghan 
and Mackay (1980); Alexander (1980); Blair (1980); Bungay, 
Dedrick and Matthews (1980); Freed (1980); Hanson (1980); 
Haque (1980a,b); Haque etal. (1980); Keith (1980); Khan 
(1980); Kimerle (1980); Lijinsky (1980); Mackay, Shiu and 
Sutherland (1980); Mill (1980); Murphy (1980); Riordan 
(1980); M.E. Stephenson (1980); Stern (1980); Weber et al. 
(1980); Zepp (1980); Jorgensen and Johnson (1981); NJ. King 
and Hinchcliffe (1981); Neely (1981); API (1982 Publ. 4434); 
PR. Edwards, Campbell and Milne (1982); Kullenberg 
(1982);Versino and Ott (1982); Rowe (1983); Dragun, 
Kuffner and Schneiter (1984); Iyengar (1984); Jorgensen 
(1984); Okouchi and Sasaki (1984); Piver (1984); Greenland 
(1985); Neely and Blau (1985); CEFIC Workshop (1986); 
Donkin and Widdows (1986); Moriarty (1986); Coughtrey, 
Martin and Unsworth (1987); Ashworth et al. (1988); 
Valsaraj and Thibodeaux (1988); Pagna and Ottar (1989); 
Barton, Clark and Seeker (1990); Lyman, Reehl and 
Rosenblatt (1990); Manahan (1991,1993); Wakoh and 
Hirona (1991); Brusseau (1992);Thoma etal. (1992); Gentile 
etal. (1993); Kollig, Kitchens and Hamrig (1993); Marple 
andThroop (1993); Larson and Weber (1994) 
Environmental limit values, indices: Ott (1978); Sittig (1994) 

Particular chemicals 

Lead: WHO (EHC3); Bryce-Smith (1971,1982); DoE (1974 
Poll. Paper); Collingridge (1979); RCEP (1983 Rep. 9); 
Mercury: Hartung and Dinman (1972); WE. Smith and 
Smith (1975); PCBs: WHO (EHC2); EPA (1975a); Higuchi 
(1976); Willman, Blazevich and Snyder (1976); Stroud, 
Wilkerson and Smith (1978); Berry (1981); Anon. (1984a); 
Kokozska and Flood (1985); Motter (1991) 

Dioxin, TCDD: Ayres (1981); Rice (1982); R.E. Tucker, Young 
and Gray (1983); Anon. (1984p); J.L Fox (1984b, 1985); Short 
etal. (1984); D.Williams (1984); Arienti etal. (1988) 
Pesticides: WHO (EHC5, EHC9); Carson (1963); F. Graham 
(1970); C. A. Edwards (1974) 

Nitrates: Nicolson (1979) 

Pollution and human health 

Howe (1970);Waldbott (1973); Chementator (1975 May 12, 
40; Aug. 4,38; 1977 Jan. 3,36); Trevethick (1976); Lave and 
Siskin (1977a,b); Doll and McLean (1979); Moghissi et al. 
(1980); Bolten (1985); BMA (1991) 

Environmental management, environmental 
risk management 

Cecil (1969); Vervalin (1979); IBC (1981/10); APCA (1986); 
J.J. Stevens (1988); Kolluru (1991); Harwell, Cooper and 
Flaak (1992); Kraft (1992); Ormon and Isherwood (1992); 
Welsh (1992,1993); S. Wilson (1992); Callahan and McCaw 
(1993); Turney (1993); Petts and Edjuljee (1994) 

BS 7750:1992 
Environmental planning 

D.C. Wilson (1981); Barclay (1987); DoE (1988 Circ. 15/88); 
Hassan (1993); Petts and Eduljee (1994) 

Environmental hazard identification, assessment 
Fuquay (1968); Friedl, Hiltz and Marshall (1973); EPA 


(1984d); Onishi et al. (1985); Keller and Lamb (1987); B.P. 
Smith (1987); NSW Govt (1989b); Paustenbach (1989); 
Cassidy (1990); Picciolo and Metzger (1992); Rouhianen 
(1992); IBC (1993/98); Petts and Eduljee (1994) 

Safety versus environment 

Anon. (1992 LPB108, p. 0); Kletz (1994 LPB116) 

Environmental modelling 

W.J. Farmer, Yang and Letey (1980); Burns, Cline and 
Lassiter (1982);Thibodeaux and Hwang (1982); EPA (1987); 
Batchelor (1990); Chhiber, Apostolakis and Okrent (1991); 
McBean (1993) 

Environmental auditing 

C. Butcher (1972b); Reiter, Sobel and Sullivan (1980); 
Baumer (1982); Keene (1982); Greeno (1984); D.L Russell 
(1985); Kingsbury (1994 LPB 118) 

Environmental emergency planning 
Cashman (1988); Cassidy (1990) 

Environmental impact statements 

Chementator (1972 May 1, 22; 1974 Apr. 1,20); Science 
Applications Inc. (1974); Mueller (1974); Gratt and McGrath 
(1975a,b, 1976); Jimeson (1975); Dept of Interior (1976); 
Willis and Henebry (1976,1982); Cremer and Warner (1977); 
Jain, Urban and Stacey (1980); Jain and Hutchings (1978); 
Prater (1978); ICI Australia Ltd (1979); Munn (1979); Atkins 
Res. and Dev. (1980); Passow (1980); Porter et al. (1980); 
Pizzi (1982); van Rest (1982); Petts and Edjuljee (1994) 

EPA compliance, inspections 

Hyland and Moore (1992); Hanisch, Hoffnagle and Walata 
(1993); Hohman, Sullivan and McNamee (1993) 

Cost of pollution, pollution control 

RCEP (Appendix 28); Eckenfelder (1969); Popper (1971); 
Chementator (1975 May 26,58; Sep. 1,52; 1977 Jan. 31,55); 
E.P. Austin (1977); Isaac (1978); Marion (1978c); Martindale 
(1979);Vatavuk and Neveril (1980); Anon. (1991h) 

Environmental analysis, monitoring 

Ottmers etal. (1972); Nemerow (1974); Sittig (1974); McKee 
(1976); R.G. Thompson (1976); R.M. Harrison and Perry 
(1977); Cornish (1978a); R. Briggs (1980); Hinchcliffe 
(1980); Simpson (1980); Hwang and Koerner (1983); Weston 
(1984); McMorris and Gravley (1993) 

Airborne effluents 

HSE (Appendix 28 Best Practicable Means Lftls, Emission 
Test Methods); ASTM (STP 281); HM Chief Alkali 
Inspector (annual report); MCA (n.d./6-10); WHO (EHC4, 
EHC7); J.E. Pearson, Nonhebel and Ulander (1935); Hewson 
(1951); Magill, Holden and Ackley (1956); Dept of Health, 
Education and Welfare (1960); Lapple (1962); Stern 
(1962—);Yocom and Wheeler (1963); Hughson (1966); 
Squires (1967); Brewer (1968); Carlton-Jones and Schneider 
(1968); Chieffo and McLean (1968a,b); Imperato (1968); 
Meetham (1968); Munson (1968); Rossano and Cooper 
(1968); Scorer (1968,1973); Sickles (1968); Fay and Hoult 
(1969); Constance (1970,1972a); Ermenc (1970);Weismantel 
(1970); Anon. (1971a); AIChE (1971/132,1972/133,1974/136, 
1975/139,140,1976/142,1979/145,1980/146,147,1981/149); 
Strauss (1971-, 1975); Anon. (1972a,e); CONCAWE 
(197214/72); Crowley (1972); Elkin and Constable (1972); 
Iya (1972); Morrow, Brief and Bartrand (1972a,b); 

Nonhebel (1972); S.S. Ross (1972a); R.S. Smith (1972); 
Swithenbank (1972); Teller (1972); ASME (1973/32); Cross 
and Schiff (1973); DoE (1973/2,3,1974/4); EPA (1973,1978a); 
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IHVE (1973); Lazorko (1973); Peters (1973); Stern etal. 
(1973); Vandegrift, Shannon and Gorman (1973); Wiley 
(1973); Dorman (1974); Pfeifer (1974); Ring and Fox (1974); 
Driscoll (1975); Ecke and Dreyhaupt (1975); Marchello and 
Kelly (1975); OpenUniv. (1975a); Parekh (1975); Rymarz and 
Klipstein (1975); Schneider et al. (1975a,b); Seinfeld (1975); 
Crawford (1976); Gammell (1976); O’Connell (1976); RCEP 
(1976 Rep. 5); Theodore and Buonicore (1976,1982); API 
(1977 Waste Manual, vol. 2); M.L. Barker (1977); E. Briggs 
(1977); Bump (1977); S.K. Friedlander (1977); N. Kaplan and 
Maxwell (1977); Kohn (1977b); Lasater and Hopkins (1977); 
Lave and Siskin (1977a); Perry and Young (1977); Preussner 
and Broz (1977); R.D. Reed (1977); Ricci (1977b); Rosebrook 
(1977); Straitz (1977); Dunlap and Deland (1978); Freitag 
and Packbier (1978); A.F. Friedlander (1978); McCarthy 
(1978); NSCA (1978); A. Parker (1978); Parrish and Seidel 
(1978); Bochinski, Schoultz and Gideon (1979); Downey and 
Ni Uid (1979); Hesketh (1979); Parmele, O’Connell and 
Basdekis (1979); Stockham and Fochtman (1979); Storch 
(1979); D.P. Wallace (1979); Buonicore (1980); England, Heap 
and Pershing (1980); Kenson and Holland (1980); Licht 
(1980); Marzo and Fernandez (1980); Niess (1980); Parungo, 
Pueschel and Wellman (1980); Theodore, Sosa and Fajardo 
(1980); Wheeler (1980); Ireland (1981,1984,1987); Keene 
(1981); Lallande (1981,1982); SCI (1981b); deWispelaere 
(1981,1983,1984,1985); Holland and Fitzsimmons (1982); 
Keith (1982); Record, Bubenick and Kindya (1982); 
Theodore and Buonicore (1982); E. Weber (1982); Elliot 
(1983); J.D. Daniels (1984); R.W. Lee (1984); Ogawa (1984); 
D.D. Adams and Page (1986); APCA (1986); Bretschneider 
and Kurfurst (1986); Farquhar (1986); Henstock (1986); 
Perriman (1986); DeWispelaere, Schiermeier and Gillani 
(1986); Redman (1989a); Veselind, Peirce and Weiner (1990); 
DoE (1991); ACGIH (1992/75); Benitez (1993); Speight 
(1993); IBC (1994/109) 

Odours 

ASTM (STP164, DS 48); Henderson and Haggard (1922); 
Summer (1963,1971); Chementator (1969 Jun. 30, 51); Turk 
(1969); Yocom and Duffee (1970); Oelert and Florian (1972); 
H.B.H. Cooper (1973); Dravnieks (1974); Turk, Johnston and 
Moulton (1974); Charlton, Sarteur and Sharkey (1975); 
CONCAWE (1975 8/75); Klooster,Vogt and Bernhart (1976); 
Harrell, Sewell and Walsh (1979); Valentin and North (1980); 
Kenson (1981); Amoore and Hautala (1983); Artis (1984); 
D.W Jones (1984); Keddie (1984); Lynskey (1984 LPB 60); 
Ferryman (1984); P.J. Young and Parker (1984); Ruth (1986); 
van Langenhove, Lootens and Schamp (1988); Miedema 
and Ham (1988); Devis (1990); Valentin (1990); Nagy (1991); 
A.M. Martin etal. (1992); Sober and Paul (1992) 

Liquid effluents 

ASTM (STP 130,148,1481, 207,337,442,573); CONCAWE 
(Appendix 28,1970 3/70,1975 3/75,1979 3/79); IP 
(Appendix 28 Oil Loss Con/s); MCA (n.d./12,1966-/13,14); 
Eckenfelder and O’Connor (1961); Gurnham (1963,1965); 
Busch (1965); Eckenfelder (1966,1969); Fair, Geyer and 
Okun (1966); AIChE (1967-71/127-129,1968/130,1969/ 
131,1972/135,1974/137,1975/141,1977/143,1981/148); 
Beychock (1967,1971); Jaeschke and Trobisch (1967); 

D.R. Montgomery (1967); SCI (1967); Cross (1968); 
Dahlstrom (1968); Dykman and Michel (1968); Eliassen 
and Tchohanoglous (1968); Geinopolos and Katz (1968); 
Kemmer and Odland (1968); Lesperance (1968); 

Sebastian and Cardinal (1968); A.R. Thompson (1968); 


API (1969 Waste Manual, vol. 1); Cecil (1969); Chopey 
(1970); Hiser (1970); Min. of Housing and Local Govt (1970); 
Anon. (1971h); Nemerow (1971,1974); Characklis and Busch 
(1972); Moores (1972); Newsom and Sherratt (1972); Nogaj 
(1972); McLoughlin (1973); Reiterand Sobel (1973); Helliwell 
and Bossanyi (1975); Huber (1975); IChemE (1975/58); Lash 
and Kominek (1975); Open Univ. (1975b); H.W. Parker (1975); 
Bush (1976); Mulligan and Fox (1976); Thompson (1976); 
Cope (1977); Finelt and Crump (1977); Ford and Tischler 
(1977); Lederman (1977); Lewin (1977); McDowell and 
O’Connor (1977); Moss (1977); Paulson (1977); B.A. Bell, 
Whitmore and Cardenas (1978); Culp, Webster and Culp 
(1978); IBC (1978/3,1993/100); Nathan (1978); Ramalho 
(1978,1979); C.R. Fox (1979); Freeze and Cherry (1979); 
Martindale (1979); Sundstrom and Klei (1979); Afghan and 
Mackay (1980); Brewin and Hellawell (1980); R.A. Freeman 
(1980); Glaubinger (1980); J.H. Robertson, Cowen and 
Longfield (1980); D.L Russell (1980); G.K. Anderson and 
Duarte (1981); Arceivala (1981); Ayling and Castrantas 
(1981); Chalmers (1981); Howe, Howe and Howe (1981); 
Iddleden (1981); Sidwick (1981); Walters and Wint (1981); 
Askew (1982); Olthoff and Oleskiewicz (1982); Selby (1982); 
Vernick and Walker (1982); Wheatley (1982); Barrs (1983); 
Langer (1983); Cushie (1984); A.E. James (1984); R.A. Mills 
(1984); Eckenfelder, Patoczka and Watkin (1985); Crossland 
(1986); J. Lawrence (1986); NFPA (1990 NFPA 820); 
Veselind, Peirce and Weiner (1990); Metcalf and Eddy 
(1991); G. Parkinson and Basta (1991); RCEP (1992 Rep. 16). 
Deep well disposal: Seim and Hulse (I960); Talbot and 
Beardon (1964); D.L. Warner (1965);Talbot (1968); Sheldrick 
(1969); M.E. Smith (1979) 

Hydraulic dispersal : Abbott (1961); Fisher et al. (1979); 
Lloyd, O’Donnell and Wilkinson (1979); Cunge, Holly and 
Verwey (1980); Kobus (1981); R.E. Lewis (1981); Novak and 
Cabelka (1981); Komar (1983); ASCE (1986/28) 

Oil-water separators : API (1990 Publ. 421) 

Stream dispersal, pollution, renewal. Streeter and Phelps 
(1925); H. A. Thomas (1948); Churchill and Buckingham 
(1956); Hwang (1980); Nusser (1982); Velz (1984); Wet air 
oxidation: Flynn (1979); Wilhelmi and Knopp (1979); 
Laughlin, Gallo and Robey (1983); Baillod, Lamparter and 
Barna (1985); Heimbuch and Wilhelmi (1985) 

Spills, spill control 

BDH (1970); Anon. (1972b); Attaway (1972); Bock and 
Sullivan (1972); L.S. Brown (1972); Cairns, Dickson and 
Grossman (1972); J.B. Cox (1972); G.W Dawson, Shuckrow 
and Mercer (1972); Donaldson (1972); Goodson and 
Jacobs (1972); R.H. Hiltz, Marshall and Friel (1972); 
Jennings (1972); Laroche (1972); Ludwig and Johnson 
(1972); D.G. Mason, Gupta and Scholz (1972); R.G. Sanders, 
Pantezolos and Rich (1972); Schuckrow, Mercer and 
Dawson (1972); Welch, Marmelstein and Maughan (1972); 
Wilder and Brugger (1972); Wye (1972); Ziegler and 
Lafornara (1972); May, McQueen and Whipp (1973); 

AIChE (1974/99,1980/100,144,1988/100,1989/70); May 
and Perumal (1974); Small and Snyder (1974); Univ. Engrs 
Inc. (1974); Weismantel (1974); Welker, Wesson and Brown 
(1974); Brugger and Wilder (1975a,b); G.W. Dawson (1975); 
Lindsey (1975); Otterman (1975); Wirth (1975); Armstrong, 
Gloyna and Wyss (1976); L.E. Brown et al. (1976); Burner 
(1976); F.E. Clark (1976); W.D. Clark (1976b); Conner (1976); 
Courchaine and Dennis (1976); Dalton (1976); G.W. Dawson, 
Mercer and Parkhurst (1976); Diefenbach (1976); Eagon 
etal. (1976); Freestone (1976); Freestone, Lafornara and 
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McCracken (1976); Fullner and Crump-Wiesner (1976); 
Gupta 1976); Hooper, Warner and Galen (1976); 

Imbrie et al. (1976); Jennings and Gentry (1976); Jensen 
(1976); Jouhola and Bougger (1976); Kaufmann (1976); 
Kirsch etal. (1976); Michalovic et al. (1976); Moser, Hargens 
and Wilder (1976); Overfield and Richard (1976); Rice etal. 
(1976); K.C. Roberts (1976); Rodgers (1976); Roehlich, Hiltz 
and Brugger (1976); Seidenberger and Barnard (1976); S. 
Shaw and Gower (1976); Silvestri etal. (1976); E.A. Simons 
(1976); Sinclair and Bower (1976); T.J. Thomas, Srinavasan 
and Gower (1976); B.C. Weber (1976); Whitebloom (1976); 
Wiener and Heard (1976); Huibregste etal. (1977); 
Martinsen and Muhlenkamp (1977); Badley and Heaton 
(1978); D.P. Brown (1978); Charlton etal. (1978); Corbett 
(1978); Darnell (1978); GW. Dawson and McNeese (1978); 
G.W. Dawson, McNeese and Christensen (1978); DOT (1978); 
Feates (1978); Freestone and Zaccor (1978); Gilman and 
Freestone (1978); Glattley (1978); Griwatz and Brugger 
(1978); Halvorsen (1978); Hand and Ford (1978); Harsch 
(1978a,b); Hubbs (1978); Huibregste, Lafornara and 
Kastman (1978); Huigbregste, Moser and Freestone (1978); 
Imbrie, Karwan and Stone (1978); Khattak and Whitmore 
(1978); Kirsch etal. (1978); Kiygielski and Bennett (1978); 
Ladick (1978); Lafornara, Frank and Wilder (1978); 
Lafornara, Lampl etal. (1978); Lafornara, Marshall etal. 
(1978); Lampl, Massey and Freestone (1978); Lathrop and 
Larson (1978); Mercer et al. (1978); Michalovic et al. (1978); 
Moien (1978); Neely and Mesler (1978); Norman and 
Dowell (1978,1980); TW Pearson (1978); Rinka and Schulz 
(1978); Roth etal. (1978); Ryckman,Wiese and Ryckman 
(1978); Schultz and Shah (1978); Seeman etal. (1978); 
Silvestri et al. (1978); J.T. Smith (1978); Soden and 
Johnson (1978); Stonebreaker, Freestone and Peltier (1978); 
Thuma etal. (1978);Tsahalis (1978); Urban and Losche 
(1978); Whiting and Shafer (1978);Willmoth (1978); Tracy 
and Zitrides (1979); Gunderloy and Stone (1980); 
Weidenbaum (1980); Huibregste and Kastman (1981); 
Schwartzman (1981); Shooter, Lyman and Sinclair (1981); 
Wentzel etal. (1981); Armstrong (1982); G.F. Bennett, 

Feates and Wilder (1982); Brugger (1982); Eckenfelder 
(1982); R.H. Hiltz (1982); Kletz (1982); Lafornara (1982); 
Ludwigson (1982); Nadeau (1982); Nusser (1982); 

Scholz (1982); ASTM (1983 STP 825,1990/1); 

Jeulink (1983); G.W Dawson and Mercer (1986); 

R.H. Hiltz (1988); Martins (1988); Melvoid and Gibson 
(1988); Abbott and Leeman (1990); ACGIH (1992/87); 
Browne (1993) 

Oil spills 

Anon. (1969d); Pattison (1969); Fay (1970); CONCAWE 
(1974 4/74,1980 9/80,19817/81,19819/81,198310/83,1987 
1/87,1988 2/88); dAlessandro and Cobb (1976b); Fingas and 
Ross (1977); C.J. Clark (1978); IP (1978 PUB 11,1983 PUB 18, 
1985/3); Middleditch (1981); API (1982 Publ. 2022); ASTM 
(1984 STP 840) 

Marine 

RCEP (1972 Rep. 2,1981 Rep. 8); WSL (1972); Cttee on the 
Environment (1974); EW.G. Smith (1974); DoE (1976 Poll. 
Pap. 8); Johnston (1977); Cole (1979); Jaafe et al. (1981); 
Norcross (1981); Kullenberg (1982); IP (1993 TP 27); 
Lawrence and Cross (1994) 

Torrey Canyon 

Cowan (1969) 


Hazardous and solid wastes 

MCA (SG-9,1974 SW1-SW3); Mohlman (1950); SCI (1957); 
Rickies (1965); FPA (S3,1971/15); Key (1970); Novak (1970, 
1972); Anon. (1971f); IChemE (1971/51); Witt (1971b, 1972); 
AIChE (1972/134); Baum and Parker (1973); Santolieri 
(1973); IMechE (1975/44,1977/49); Mantell (1975); Open 
Univ. (1975d); Patrick (1975); Roulier, Landreth and Carnes 
(1975); Saxton and Narkus-Kramer (1975); Stephenson etal. 
(ASME1975/186); Besselievre and Schwartz (1976); Boily 
(1976); D.R. Davies and McKay (1976); Frisbie (1976,1978); 
Lazar (1976a,b); E.P. Austin (1977); Feates (1977); Hillman 
(1977); Keen (1977); Paulson (1977); S.W. Pearce (1977); 

G. Jones (1978); Morrison and Ross (1978); Ricci (1978b); 
Huddlestone (1979); Okey, Digregorio and Kominek (1979); 
Pojasek (1979a,b); J. Smith etal. (1979); API (1980 Waste 
Manual)', Conway and Ross (1980); Gradet and Short (1980); 
Anon. (1981n); Basta (1981b,e); Jamieson (1981); Shen 
(1981); ASTM (1982 STP 760,1983 STP 805,1984 STP 851); 
Bentley (1982); Farquhar (1982); Kiang and Metry (1982); 
R.D. Ross (1982); Skitt (1982); Thibodeaux, Springer and 
Riley (1982); A.N. Clarke and Clarke (1983); Chivers (1983, 
1984); Cope, Fuller and Willetts (1983); G.W Davidson 
(1983); Dyer and Mignone (1983); Finnecy (1983); Jennings 
(1983); A. Lawrence (1983); D.A. Mills (1983); Cook (1984 
LPB 55); Hawkins (1984); Hillman (1984); Kennard (1984); 
Luck (1984); Mackie and Niesen (1984); E.F.Wood (1984); 
Zirschky and Gilbert (1984); Anon. (1985o); Basta, 
Hughson and Mascone (1985); Pitt and Pitt (1985); Porteous 
(1985); RCEP (1985 Rep. 11); Anon. (1986k); Arthurs (1986); 
Hollowood (1986); Payne (1986);W.F. Robinson (1986); 
Barclay (1987); M. Bradford (1987); CIA (1987 RC15, RC16, 
1989 RC17); Colen (1987a,b); Crittenden and Kolaczowski 
(1987); Crumpler and Martin (1987); EPA (1987); Loehr 
(1987); E.J. Martin and Johnson (1987); Stone (1987); Wiles 
(1987); Rendell (1988a); Hammitt and Reuter (1989); 
Salcedo, Cross and Chrismon (1989); ACGIH (1990/42, 
1992/83,84); Earth (1990); Batchelor (1990); L.W. Jones 
(1990); Pekelney (1990); Soudarajan (1990);Tedder and 
Pohland (1990); Veselind, Peirce and Weiner (1990); 
Weitzman (1990); HMIP (1991); Nemerow and Dasgupta 
(1991); IBC (1992/87); Paluzzi (1992); IMechE (1994/170); 
Petts and Eduljee (1994); Sara (1994) 

Incineration 

ASME (Appendix 28 Solid Waste); Frankel (1966); 

Monroe (1968,1983b); Cross (1972); CONCAWE (1975/2); 
Dunn (1975,1979); C.R. Lewis, Edwards and Santoro (1976); 
R. Harrison and Coulson (1977); Bartsch, Gilley 
and Steele (1978); J. Jones (1978); Dunn (1979); Fabian, 
Reher and Schon (1979); Hitchcock (1979); Ready and 
Schwab (1980 LPB 36,1981); HSE (1981BPM11); Deneau 
(1983); Frankel, Sanders and Vogel (1983); Monroe (1983b); 
Anon. (1984aa); Feeley (1984); H.M. Freeman (1984); 
Brunner (1985,1986,1989,1993); Rickman, Holder and 
Young (1985); Basta (1986a); Zurer (1986); Baker-Counsel 
(1987a); Beychok (1987); H.M. Freeman etal. (1987); 

Wiley (1987); C. Butcher (1990a); IBC (1990/78,1992/93); 
Vervalin (1990a); Veselind, Peirce and Weiner (1990); 

P.T.Williams (1990); Ondrey and Fouhy (1991); Zeng and 
Okrent (1991); Altorfer (1992); S.E. Anderson, Dowell 
and Mynaugh (1992); Haseltine (1992); RCEP 
(1993 Rep. 17) 

Landfill 

Perket (1978); Duvael (1979); Basta (1981b); Corbin and 
Lederman (1982); IBC (1982/22); A. Parker (1982); G.W 
Dawson (1983); J.D. Cook (1984); Hoppe (1984a); Crawford 





APPENDIX 11/6 SAFETY, HEALTH AND THE ENVIRONMENT 


and Smith (1985); Shuckrow,Touhill and Pajak (1987); 
Anon. (1988k); Shacke and Sawai (1990);Veselind, Peirce 
and Weiner (1990); Kemp and Gerrard (1991) 

Transport 

R.J. Buchanan (1982); Bromley and Finnecy (1985) 

Ocean disposal, ocean incineration 

Chementator (1970 Aug.24,32; 1974 Oct.28,33; 1975 Dec.8, 
82); Zapatka, Hann and Zapatka (1976); K. Pearce (1977); 
Ketchum, Kester and Park (1981); Finnecy (1982); Novak 
and Pfrommer (1982); Remirez (1982); Anon. (1984d); 

NRC (1984); Ditz (1988) 

Waste sites, site clean-up, contaminated land 

Dennis (1978); Kohn (1978d); Overcash and Paul (1980); SCI 
(1980); IBC (1981/18,1992/89); D.C. Wilson, Smith and 
Pearce (1981); Bowders, Koerner and Lord (1982); Long and 
Schweitzer (1982); Lord, Koerner and Freestone (1982); D.C. 
Wilson (1982); R.E. Edwards, Speed and Verwoert (1983); 
Muller, Brodd and Leo (1983); Rogoshenski, Boyson and 
Wagner (1983);Tyagi, Lord and Koerner (1983a—c); Block, 
Dragun and Kalinowski (1984); Block and Kalinowski 
(1984); Ehrenfelder and Bass (1984); Husak, Kissenpfennig 
and Gradet (1985); MA Smith (1985); Wagner at al. (1986); 
Lord and Koerner (1988); des Rosiers (1987); Arenti et al. 
(1988); Hopper (1989); Porter (1989); Ahlert and Kosson 
(1990); Bleicher (1990); IP (1991 PUB 58,1993/2); 
Raghavan, Coles and Dietz (1991); AGA (1992/86); 

N. Morgan (1992a); Vandegrift, Reed and Tasker (1992); 
Cairnie (1993); Pratt (1993) 

Superfund 

Ember (1984); Hoppe (1984b); Casler (1985); Sidley and 
Austin (1987); Redman (1989b); Bisio (1991b, 1992a) 

Love Canal 

Glaubinger, Kohn and Remirez (1979); J.L. Fox (1980a); 
Gage (1980); Holden (1980); Kolata (1980); Picciano (1980); 
M.W. Shaw (1980); M. Brown (1981); Kohn (1982); Anon. 
(1984hh) 

Rechem 

Anon. (1984a,i,o,aa,dd); Anon. (1985y,z); Anon. (1986d,x); 
Anon. (1987v); J. Cox (1988b) 


The philosophy of inherently cleaner design is to avoid 
the generation of noxious effluents. As with inherently 
safer design, this is easier said than done, but progress has 
been made and the pressures to operate cleaner processes 
continue to grow. 

Al 1.2.3 Intermediate storage 

A prime theme in inherently safer design is the elimination 
of intermediate storage. It transpires that the elimination of 
storage tanks is also a significant feature of waste mini¬ 
mization programmes. In the first case the motivation is to 
reduce the inventory of hazardous materials, while in the 
second it is to reduce the quantities of tank residues and 
wash liquids. 

Al 1.2.4 Hazard identification 

The general approach to hazard identification developed in 
SLP is also applicable to EP. 

The hazop method, for example, is increasingly being 
adapted or enlarged to cover the environment. 


Al 1.2.5 Hazard assessment 

Likewise, hazard assessment is finding application in EP 
as well as in SLP. 

Although much of the methodology of hazard assess¬ 
ment used in SLP is applicable to environmental problems, 
there are also some significant differences. The treatment 
of the events leading up to a release uses an essentially 
common methodology, but the modelling of the con¬ 
sequences of a release naturally differs more significantly. 

Thus whereas for SLP hazard assessment involves esti¬ 
mating and evaluating the consequences in terms of injury 
to people and damage to property, for EP the consequences 
to be considered are the fate of chemicals in the environ¬ 
ment, and their ultimate effects on plant and animal life. 

Al 1.2.6 Hazard models 

Many of the models used in hazard assessment for SLP are 
applicable also to EP, and indeed it was for the latter that 
some were first developed. 

Thus the treatment of emission, vaporization and dis¬ 
persion largely shares a common methodology, although 
there are some differences of emphasis. In gas dispersion, 
for example, heavy gas dispersion is of particular sig¬ 
nificance in SLP, while for EP passive dispersion, includ¬ 
ing dispersion over much greater distances, plays a more 
significant role. 

Al 1.2.7 Fugitive emissions 

A problem common to SHE and EP is that of low level, or 
fugitive, emissions from a plant. Such emissions have an 
impact on the health of workers in the plant and on the 
population and environment outside. 

In SLP the need for stricter controls on emissions within 
the plant was evidenced by the vinyl chloride problem in 
1975, while in EP pressure for emission controls arose from 
studies of the causes of air pollution in cities such as Los 
Angeles in the later 1970s, which implicated emissions from 
nearby refineries. 

Al 1.2.8 Environmental impact assessments 

There has been a general trend to require that an industrial 
activity make an environmental impact assessment (EIA) 
or environmental impact statement (EIS), also referred to, 
respectively, as an environmental assessment (EA) and 
an environmental statement (ES). Such environmental 
impact assessments and statements include safety issues, 
although mainly in respect of hazards to the public. 

Al 1.2.9 Safety cases 

Closely related is the requirement in European legislation 
for preparation of a safety case. The requirement to address 
hazards to the environment as well as humans has received 
increasing emphasis. 

All.2.10 Communication with public 

Process plants and hazardous waste facilities are both 
liable to generate opposition, prior to creation or in the 
course of operation. The need to communicate with the 
public, and the approach required, are very similar in both 


All.3 Some Conflicts 

Another link between SLP and EP is that in some cases 
a degree of conflict arises. In some cases the preferred 
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solution to a safety problem may be ruled out, or at least 
discouraged, on environmental grounds; in others stricter 
environmental controls may push the designer towards 
solutions which would not otherwise be adopted for safety 
reasons. 

Accounts of such conflicts have been given by Elphick 
(1972), R.Y. Levine (1972b), Bodurtha (1976) and Kletz 
(1993e). 

Some of the practices which are so affected are now 
considered. 

A11.3.1 Reactor venting 

The normal method of protection for a chemical reactor has 
been the provision of a bursting disc with a short, straight 
pipe discharging to atmosphere at a safe place. 

If such discharge is not permitted but this basic method 
of protection is retained, it becomes necessary to pipe each 
bursting disc into a vent header leading to a disposal sys¬ 
tem such as a scrubber or flare. Some of the problems which 
this creates have been described by Levine. 

It is largely for this reason that the alternative approach 
of using instrumented protective systems on reactors has 
become increasingly attractive, as described in Chapter 11. 

A11.3.2 Pressure relief valve discharge 

An essentially similar conflict and similar problems arise 
over the practice of fitting pressure relief valves which 
discharge directly to atmosphere. 

Some of the problems of vent collection systems are 
described by Kletz. 

Avoidance of discharge to atmosphere is one of the main 
arguments for the use of trip systems to protect against 
overpressure, as described in Chapter 13. 

A11.3.3 Flaring 

A flare radiates intense heat and light and may be smoky 
and noisy. These are all aspects of pollution which have 
become increasingly unacceptable. 

In contrast to the oil industry, which has continuous 
flaring, the chemical industry often makes use of an inter¬ 
mittent flare. The flare may be used to burn small quan¬ 
tities of smelly materials. But since very small quantities 
are sometimes not ignited by the flare pilot burner, it is 
sometimes necessary to operate the flare continuously, 
using fuel gas which could otherwise be used more 
productively. 

A11.3.4 Bleeding 

The build-up of impurities in plants is avoided by taking 
off a bleed. If this practice is inhibited by environmental 
considerations, the impurity can accumulate and may cre¬ 
ate a hazard. Levine describes a multimillion dollar loss 
which occurred due to the build-up of the explosive impu¬ 
rity azomethane. 

A11.3.5 Leakages 

The degree of leakage which has been tolerated in the past 
is now frequently unacceptable. The problems which can 
then arise are illustrated by the leakage of hydrogen from 
mercury cell chlorine plants. The hydrogen stream is one of 
the carriers of mercury vapour from the cells. Therefore 
mercury escapes in the hydrogen leakages. One possible 
solution is to run with the hydrogen under a slight negative 
pressure, but this creates the risk of air ingress leading to 
an explosion. 


A11.3.6 Incineration 

Burning in open pits has been widely used as method of 
disposing of waste solvents on chemical plants. Closed 
incinerators eliminate this pollution, but present hazards 
of their own. 

A11.3.7 Ventilation 

The hazard from flammable leaks in a compressor house 
can be reduced if the building is of open construction such 
that ventilation is much enhanced. This solution runs into 
the difficulty however, that the noise of the machinery 
carries further. 

A11.3.8 Combustion processes 

The attempt to reduce the emission of nitrogen oxides from 
combustion processes can increase the risk of explosion. 
A marked decrease in nitrogen oxides formation occurs as 
excess air is reduced. But reduction of excess air increases 
the probability of an explosion due to unburned fuel in the 
gas leaving the combustion chamber. 

A11.3.9 Pollution control equipment 

Equipment for the removal of flammable dust from gases 
can present another hazard. Although this can be mini¬ 
mized by the use of wet scrubbers, these run into difficul¬ 
ties from water pollution controls. 

A11.3.10 Halons 

Halons have found a distinctive role in the process indus¬ 
tries as fire extinguishants and explosion suppressants. 
The banning of chlorofluorohydrocarbons (CFCs) creates 
a gap which for fire extinguishants is not yet fully filled. 

Pollution of the Environment 

Awareness of the seriousness of environmental pollution 
grew rapidly in the 1960s. The publication of Silent Spring 
by Carson (1963) was a landmark. Other warnings have 
followed such as Bitter Harvestby Egginton (1980). 

Accounts of pollution and environment include Hand¬ 
book of Environmental Control by Bond and Straub (1973-), 
The Pollution Handbook by Mabey (1974), Introduction to 
Environmental Science by Strahler and Strahler (1974), 
A Dictionary of the Environment by Allaby (1977), Topics and 
Terms in Environmental Problems by Holum (1977), The 
Protection Handbook of Pollution Control by P. Sutton 
(1977b), Environmental Education by Bakshi and Naveh 
(1980), Britain, Europe and the Environment by MacRory 
(1983) and Environmental Pollution and Control by Veselind, 
Peirce and Weiner (1990). 

Also relevant are the reports of the Royal Commission on 
Environmental Pollution. 


All.4 Legislation 

Although there are significant differences between gas¬ 
eous effluents, liquid effluents and solid wastes, some of 
the legislation addresses more than one of these, and it is 
convenient therefore to take all three together. 

All.4.1 Air pollution 

The Alkali etc. Works Regulation Act 1906 was for many 
years the principal act governing air pollution. 
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The philosophy of enforcement of the act has been 
the use of best practicable means (BPM) to minimize 
emissions. 

The HSWA 1974 states in Section 1(1) (d) that its provi¬ 
sions are made with a view to controlling emissions of 
noxious substances and it contains in Section 5 a general 
duty to use best practicable means to prevent such 
emission. 

The Health and Safety (Emissions into the Atmosphere) 
Regulations 1983, amended 1989, create in Section 3 pre¬ 
scribed classes of premises for the purposes of Section 1(1) 
(d) of the HSWA, listed in Schedule 1, and specify under 
Section 4 substances prescribed as noxious. These pre¬ 
mises and substances are listed in Schedules 1 and 2, 
respectively 

A11.4.2 Control of Pollution Act 1974 

The Control of Pollution Act 1974 (COPA) has four main 
parts: Part I,Waste on Land; Part II, Pollution of Water; Part 
III, Noise; and Part IVj Pollution of the Atmosphere. 

Part I of the act states requirements for the disposal 
authority to control waste disposal by a system of licens¬ 
ing. It prohibits the unlicensed disposal of controlled 
waste. 

In Part II the act lays down the duties of the Water 
Authorities to operate a system of consents for discharges 
and prohibits noxious discharges. 

The provisions of Part IV on atmospheric pollution are 
limited and deal mainly with pollution by certain fuels and 
with information about air pollution. 

All.4.3 Environmental Protection Act 1990 

The Environmental Protection Act 1990 (EPA) has nine 
parts, those of principal relevance here being Part I, Inte¬ 
grated Pollution Control and Air Pollution Control by Local 
Authorities; Part II, Waste on Land; and Part III, Statutory 
Nuisances and Clean Air. 

Part I of the act establishes a system of integrated pollu¬ 
tion control (IPC) enforced by HM Inspectorate of Pollution 
(HMIP) and one of air pollution control (APC) administered 
by the local authorities (LA APC). 

Section 1 of Part I gives definitions of environment, 
pollution and harm which read as follows: 

(2) The ‘environment’ consists of all, or any, of the 
following media, namely the air, water and land; and 
the medium of air includes the air within buildings 
and the air within other natural or man-made structures 
above or below ground. 

(3) ‘Pollution of the environment’ means pollution of 
the environment due to the release (into any environ¬ 
mental medium) from a process of substances which are 
capable of causing harm to man or any other living 
organisms supported by the environment. 

(4) ‘Harm’ means harm to the health of living organisms 
or other interference with the ecological systems of which 
they form part and, in the case of man, includes offence 
caused to any of his senses or harm to his property; and 
‘harmless’ has a corresponding meaning. 

Section 2 creates a system of prescribed processes and 
substances and Section 3 allows regulations to be made for 
their control. Subsection 2 of Section 3 allows the pre¬ 
scription of standard limits for the concentration, the 
amount or the amount in any period to be released; of 
standard requirements for measurement; and of standards 


or requirements for the process. Subsection 5 allows the 
making of plans for establishing limits for the total amount 
or total amount in any period to be released in any area; for 
quotas for operators; and for establishing or reducing limits 
so as progressively to reduce pollution. 

Sections 6-12 create a system of authorizations to oper¬ 
ate a prescribed process. Section 7 deals with the conditions 
of such an authorization. It requires that in carrying on 
such a process use should be made of the best available 
technology not entailing excessive cost (BATNEEC) to 
prevent release of prescribed substances or to render 
harmless any other potentially harmful substances. 

Section 4 establishes the enforcing authorities and Sec¬ 
tions 13—19 deal with enforcement. Section 13 gives powers 
to make an enforcement notice and Section 14 a prohibition 
notice. 

Section 23 gives a list of offences and penalties. Sec¬ 
tion 27 gives powers such that where an offence causes any 
harm which it is possible to remedy the inspectorate may 
arrange for any reasonable steps to be taken to remedy the 
harm and may recover the cost from any person convicted. 

The EPA covers discharges into all environmental 
media. Some processes have the potential to make sig¬ 
nificant discharges into more than one medium, in some 
cases as a result of transfer from one medium to another. 
An example is removal of substances from a gas stream 
which then ends up in a liquid effluent. In such situations 
the EPA requires the selection of the best practical envi¬ 
ronmental option (BPEO) and the operator is required to 
demonstrate that its process meets the BPEO criterion. 

Part II of the act creates a duty of care in respect of wastes 
and a system of waste management licences. 

Part III defines a number of statutory nuisances which 
are ‘prejudicial to health or a nuisance’ and which include 
emissions such as smoke; fumes and gases; dust, steam, 
smell and other effluvia; accumulations or deposits; and 
noise. It lays on a local authority a duty to inspect its area to 
detect such nuisances and to act on them. 

The prescribed processes and substances are given in 
the Environmental Protection (Prescribed Processes and 
Substances) Regulations 1991. Schedule 1 contains a num¬ 
ber of chapters, each of which deals with a particular 
industry. The chemical industry is covered in Chapter 4 of 
the schedule. 

A distinction is made between those processes which are 
subject to control by local authorities in respect of air pol¬ 
lution only and those which have the potential for pollution 
of more than one environmental medium, which require an 
IPC authorization from the HMIP - the Part B and Part A 
processes, respectively 

All.4.4 Clean Air Act 1993 

The Clean Air Act 1993 covers pollution by smoke, grit, 
dust and fumes from industrial processes not required to 
be registered under the HSWA 1974 and the Health and 
Safety (Emissions into the Atmosphere) Regulations 1983. 

The act prohibits the emission of ‘dark’ smoke from any 
chimney or industrial premises. 

A11.4.5 Water pollution 

Until 1973 local authorities had the duty of providing sew¬ 
erage and sewerage treatment not only to domestic but also 
as far as possible to industrial users. Controls on effluents 
from industrial premises to the public sewerage system 
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were established by the Public Health (Drainage of Trade 
Premises) Act 1937. 

The Water Act 1973 transferred the responsibilities for 
industrial effluents to the public Water Authorities (WAs). 
The operation and maintenance of the sewerage system 
continued to be done by the local authorities on an agency 

The Control of Pollution Act 1974 strengthened the con¬ 
trols on water pollution. 

The development of controls on water pollution has been 
influenced by the apparent deterioration of water quality in 
the North Sea and by a series of North Sea Conferences of 
the states concerned, the first being held in 1984. 

Substances identified as particularly harmful to the 
aquatic environment by reason of their toxicity, persistence 
and bioaccumulation are identified in the ‘Red list’. 

Control of water pollution is now governed by the Water 
Act 1989, described below, and the EPA1990. 

The system being developed under these acts is one of 
integrated pollution control based on environmental qual¬ 
ity objectives (EQOs) and environmental quality standards 
(EQSs) utilizing the BATNEEC criterion. 

All.4.6 Water Act 1989 

The Water Act 1989 defines the waters which are subject to 
control, establishes the powers of control and creates the 
National Rivers Authority (NRA). 

Prior to privatization the WAs were responsible both for 
the supply of water and for control of pollution of water. In 
other words, they were both poacher and gamekeeper. The 
need to separate these functions led to the creation of the 
NRA, which is now responsible for protecting the aquatic 
environment. 

Section 103 of the Act defines the various waters subject 
to controls, which are essentially inland waters, including 
rivers and watercourses; groundwaters; coastal waters; 
and territorial waters out to a 3 mile limit. 

Part III of the Act gives the NRA powers to improve water 
quality and to control effluent discharges. 

Discharge of liquid effluent is governed by a system of 
discharge consents. The discharge consent procedures are 
given in Schedule 12 of the Act. 

Public participation is allowed by arrangements for 
advertising a discharge application in the local press and by 
a duty on the authority to consider representations made. 

A11.4.7 Hazardous wastes 

Control of hazardous wastes is exercised under the Deposit 
of Poisonous Waste Act 1972 and the Deposit of Poisonous 
Waste (Notification of Removal or Deposit) Regulations 
1972. 

Hazardous waste controls are also major elements of 
the Control of Pollution Act 1974, Part I and the EPA 1990, 
Part II, as already described.The EPA 1990 creates a system 
of waste management licences. 

A11.4.8 Environmental impact assessment 

EC Directive 85/337/EEC on the assessment of the effect of 
certain public and private projects on the environment 
creates for certain projects requirements for an environ¬ 
mental assessment. 

In the United Kingdom, implementation of these require¬ 
ments is largely covered by theTown and Country Planning 
(Assessment of Environmental Effects) Regulations 1988 
(the EA Regulations). 


The regulations specify that a developer provide infor¬ 
mation on the impact of the project in the form of an envir¬ 
onmental statement. 

A11.4.9 Advisory bodies 

There is a standing Royal Commission on Environmental 
Pollution (RCEP). The reports of the commission are listed 
in Appendix 28. 

Among the topics addressed are coastal water pollution 
(1972, Third Report), integrated air pollution control (1976, 
Fifth Report), sea pollution (1981, Eighth Report), waste 
management (1985, Eleventh Report), best practical envir¬ 
onmental option (1988, Twelfth Report), freshwater quality 
(1992, Sixteenth Report) and waste incineration (1993, 
Seventeenth Report). 

All.4.10 Safety cases 

EC Directive 82/501/EEC on major accident hazards cre¬ 
ates controls on certain installations which include the 
submission of a safety report. There have been two sub¬ 
sequent modifying directives, the second 88/610/EEC 
containing requirements in response to the Rhine pollution 
incident at Schweizerhalle in 1986. 

The initial directive is implemented in the United 
Kingdom by the CIMAH Regulations 1984 and the two 
later directives by amendments of these regulations. In the 
second set of amendments in 1990 the requirement for 
the safety case is contained in Regulation 7 and its contents 
are specified in Schedule 6. 

Schedule 6 refers to information on the consequences of 
a major accident without specifically mentioning those to 
the environment, but guidance given in HS(R) 21 by the 
HSE (1990) states that in relation to the environment infor¬ 
mation should include the routes by which harm may be 
brought about and the effect on the exposed environment 
including persistence of the substance in the environment. 

A11.5 EC Directives 

There are a considerable number of EC Directives con¬ 
cerned with the environment. Some of the principal direc¬ 
tives are listed in Chapter 3. 

An information service on EC legislation is given in 
European Environment Law for Industry by Agra Europe 
(1994a). 

Directive 76/464/EEC gives a list of substances danger¬ 
ous to the environment. 80/68/EEC addresses groundwater 
protection. Discharge of certain substances listed in 76/ 
464/EEC is covered by 86/280/EEC. There are directives 
on discharge of metals such as mercury and cadmium. 
Directive 84/360/EEC deals with air pollution from indus¬ 
trial plants and 88/609/EEC with large combustion plants. 
There are directives on ozone, sulfur dioxide, nitrogen 
dioxide and carbon dioxide. Other specific pollutants cov¬ 
ered by directives include lead, asbestos and PCBs. Toxic 
and dangerous wastes are the subject of Directives 78/319/ 
EEC and 91/689/ EEC, while 84/631/EEC deals with 
transfrontier shipment of wastes. 

Directive 85/337/EEC requires for certain activities the 
production of an environmental impact assessment. 

A11.6 US Legislation 

Accounts of US legislation on the environment and on 
pollution control are given by Lipton and Lynch (1987), 
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E.J. Martin and Johnson (1987), Nemerow and Dasgupta 
(1991) and Veselind, Peirce and Weiner (1991). 

The account given below complements that given in 
Chapter 3. 

All.6.1 Air pollution 

In the United States, air pollution legislation includes the 
Air Pollution Control Act 1975, the Clean Air Act 1963 
(CAA) and the Clean Air Act Amendments 1970,1977 and 
1990 (CAAA). 

The CAAA 1970 required the EPA to establish National 
Ambient Air Quality Standards (NAAQSs). The CAAA 
1977 brought in requirements for the NAAQSs to be 
regularly up-dated and for the ‘prevention of significant 
deterioration’ (PSD) in regions with air cleaner than 
the NAAQS. A system of New Source Reviews (NSRs) 
was instituted with New Source Performance Standards 
(NSPSs). Best available control technology (BACT) is 
required for compliance. 

Title III of the CAAA 1990 gives a list of 189 air toxics 
and requires the EPA to publish a list of source categories 
emitting 10 ton/year of any one toxic or 25 ton/year of a 
combination and to issue for such toxics maximum achiev¬ 
able control technology (MACT) standards. 

A11.6.2 Water pollution 

Water quality in the United States is protected by legisla¬ 
tion on effluent discharges to streams and on drinking 
water quality. The Federal Water Pollution Control Act 
1972 envisaged a nationwide policy of zero discharge of 
pollutants by 1985. The EPA introduced a discharge permit 
system in the form of the National Pollutant Discharge 
Elimination System (NPDES). The Clean Water Act 
Amendments 1977 backed away from zero discharge and 
introduced a system requiring instead that in due course 
discharges be treated with the best conventional pollutant 
control technology. In addition, the EPA is now charged 
with setting limits for some 100 toxic substances in 
effluents. 

Advisory standards for drinking water in the United 
states have long been set by the US Public Health Service 
(USPHS). The Safe Drinking Water Act 1974 authorizes the 
EPA to set minimum national drinking water standards. 

A11.6.3 Hazardous wastes 

Hazardous wastes in the United states, governed pre¬ 
viously by the Solid Waste Disposal Act 1965, are now are 
subject to the Resource Conservation and Recovery Act 
1976 (RCRA). The act seeks to ensure proper land disposal 
of defined hazardous wastes and to fill certain loopholes in 
control on air and water pollution. Under it the Office of 
Solid Waste (OSW) of the EPA promulgates regulations 
defining hazardous wastes and standards applicable to it. 
In implementation of the Act, the EPA classified waste 
disposal sites as landfills, lagoons or landspreading 
operations, defined eight categories of impact which such 
sites might have and stated the operational and perfor¬ 
mance standards to be met to minimize such impacts. 

Hazardous wastes attract further controls. For these the 
EPA has set up what is in effect a ‘cradle-to-grave’ system 
covering hazardous waste generation, transport and treat¬ 
ment, storage and disposal facilities, imposing duties on 
the generator, the transporter and the facility operator and 
involving tracking by a system of identification numbers 
and control by a system of permits. 


The problem of the large number of hazardous waste 
sites in unsatisfactory condition, or worse, is addressed by 
the Comprehensive Environmental Resource Conservation 
and Liability Act 1980 (CERCLA), or Superfund. The act 
creates controls on such facilities and provides for the EPA 
to supervise the clean-up of existing and abandoned sites. 
The EPA seeks to identify Potentially Responsible Persons 
(PRPs) and, where such parties are not found, it initiates 
a clean-up paid for from the Superfund. 

The Superfund Amendments and Reauthorization Act 
1986 (SARA) renews the Superfund. The part known as 
SARATitle III extends its application to accidental releases. 

The numerous other items of legislation which have 
some bearing on hazardous waste are reviewed by Edelman 
(1987). 

A11.6.4 Fugitive emissions 

Standards governing fugitive emissions have been 
promulgated by the EPA under the CAA. These are the 
Standards of Performance of New Stationary Sources 
Equipment Leaks of VOC, Petroleum Refineries and Syn¬ 
thetic Organic Chemical Manufacturing Industry 1983, 
amended 1984, also referred to as the New Source Perfor¬ 
mance Standards (NSPSs), the NSPS Regulations or the 
VOC (SOCMI) Regulations. These set standards for emis¬ 
sions permissible from items of equipment. 

In addition to these controls on VOCs, the EPA has also 
issued National Exposure Standards for Hazardous Air 
Pollutants (NESHAPs) for certain specific substances. 
These too give equipment emission standards. 

The NSPSs apply to new equipment but also have appli¬ 
cation to reconstructed and modified equipment, and guid¬ 
ance has been given on determining how far they affect 
existing equipment. In addition, existing equipment is 
affected by the assimilation into EPA controls of state 
requirements on monitoring and maintenance (M&M). 

A11.6.5 Environmental impact assessment 

The National Environmental Policy Act 1969 (NEPA) con¬ 
tains in Section 102 the far-reaching provision that where 
the action of a federal agency may have significant con¬ 
sequences for the human environment, an environmental 
impact statement should be given. The practice is to pre¬ 
pare a draft statement, which is put out for consultation, 
and then to issue the final statement. 

All.7 Environmental Management 

11.7.1 Environmental management systems 

The environment needs to be protected by an approach to 
management and management systems similar to that 
developed for safety and loss prevention, which has been 
described in Chapter 6. There should be an environmental 
management system (EMS) which parallels the safety 
management system. 

A11.7.2 BS7750 

Environmental management is the subject of BS 7750:1992 
Specification for Environmental Management Systems. 
The standard may be regarded as applying in this field the 
principles of quality systems given in BS 5750. An over¬ 
view is given by Shillito (1991). 

Requirements of BS 7750 include (1) documentation 
of the environmental management and management 
systems; (2) collation of regulatory requirements on the 
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environment; (3) inventory of raw materials and energy 
usage and of wastes and releases; (4) formulation of envi¬ 
ronmental objectives; (5) an environmental management 
plan; (6) a system of environmental audits; (7) a system of 
environmental controls with verification and testing; and (8) 
personnel qualified and trained in environmental matters. 

A11.7.3 Process environmental reviews 

The EMS should require a system of process environmental 
reviews akin to the process safety reviews described in 
Chapters 6 and 8. 

This review system should include formal systems for the 
identification and assessment of environmental hazards. 

The hazop study method is now applied to identify 
potential problems with the environment as well as with 
safety and operability. Accounts are given by Isalski et al. 
(1992) and Ormond and Isherwood (1992). 

All.7.4 Environmental audits 

Another essential feature of an EMS is a system of envi¬ 
ronmental audits. Environmental auditing stands in essen¬ 
tially the same relation to EP as safety auditing does to SLP. 

Accounts of environmental audits are given by Baumer 
(1982), Keene (1982), D.L Russell (1985) and Petts and 
Eduljee (1994). 

Al 1.7.5 Environmental planning 

The essential concern of planning is with the environment 
as broadly defined, including amenity as well as hazards 
and pollution. 

The planning arrangements vary from country to coun¬ 
try. Accounts of planning in the United Kingdom in relation 
to major hazard installations have been given by Petts 
(1988b, 1989,1992). 

Accounts of planning in relation to pollution are given by 
D.C. Wilson (1981) and Petts and Eduljee (1994), both deal¬ 
ing with hazardous wastes. 

To a considerable extent planning centres around the 
EIS, discussed in Section A11.9. 

Al 1.7.6 Environmental emergency planning 

Environmental emergency planning is needed to cover 
both fixed installations and transport. The treatment in 
Chapter 24, which covers both aspects as far as safety is 
concerned, is in large part applicable to planning for 
environmental emergencies. 

Further treatments relevant to the environment specifi¬ 
cally are given in Hazardous Materials Emergency Response 
and Controlby Cashman (1988) and by G.F. Bennett, Feates 
and Wilder (1982). 

As stated earlier, the CIMAH safety case is required to 
cover environmental as well as safety aspects of emergency 
planning. 

All.8 Environmental Hazard Assessment 

There is now an increasing activity in environmental 
hazard assessment. In large part this has been driven by 
the threat to the environment from hazardous waste sites. 

In the United states, the pollution arising from the 
hazardous wastes dumped at Love Canal, described in 
Section A11.22, and the resultant arrangements for clear¬ 
ing up waste sites under Superfund have stimulated 
assessment of such sites to determine the extent of the risks 
and to set priorities for clean-up. 


Hazard assessment is undertaken both for existing or 
proposed hazardous waste treatment, storage and disposal 
facilities (TSDFs) and for abandoned hazardous waste 
dumps. 

Accounts of environmental hazard assessment are given 
in Risk Assessment of Hazardous Waste Sites by Long and 
Schweitzer (1982), Hazardous Waste Risk Assessment by 
Asante-Duah (1993) and Standard Handbook for Solid and 
Hazardous Waste Facility Assessments by Sara (1994) and by 
H. Bradford (1986a), B.P. Smith (1987), Kemp and Gerrard 
(1991), Kolluru (1991), Welsh (1992, 1993) and Rouhiainen 
(1993). 

Al 1.8.1 EPA guidance 

Guidance on hazard assessment of hazardous waste sites, 
in the context of Superfund, is given in Risk Assessment 
Guidance for Superfund: I, Human Health Evaluation Man¬ 
ual and in Risk Assessment Guidance for Superfund: II, 
Environmental Evaluation Manual both by the EPA 
(1989a,b). EPA philosophy is also described by B.P. Smith 
(1987). 

The process outlined by the EPA involves the following 
steps: (1) hazard identification, (2) toxicity assessment, 
(3) exposure assessment and (4) risk characterization. 

A brief description of the assessment process is given by 
Kolluru (1991) and a more detailed account by Asante-Duah 
(1993). 

These stages in the assessment are now outlined. 

Al 1.8.2 Hazard identification 

Hazard identification is the first stage and, in this context, 
means the identification of those chemicals which pose the 
greatest risks, the so-called indicator chemicals. 

Since this identification involves the inventory, mobility, 
persistence and toxicity of the chemicals, some degree 
of iteration back from the subsequent stages may be 
necessary 

Al 1.8.3 Toxicity assessment 

Toxicity assessment requires consideration of toxicity both 
for carcinogens and for non-carcinogens. 

For carcinogens the assumption made by the EPA is that 
there is no threshold below which a dose is harmless. The 
probability of harm is then obtained from the slope of the 
dose-response curve, the so-called cancer slope factor 
(CSF) or potency factor. The EPA also recognizes a weight of 
evidence factor. Carcinogens are divided into four catego¬ 
ries: (1) human carcinogens, (2) probable human carcino¬ 
gens, (3) probable human carcinogens but with inadequate 
human data and (4) possible human carcinogens. 

For non-carcinogens a threshold is admitted. For the 
dose of such a chemicals there is therefore a no observable 
adverse effect level (NOAEL). A reference dose (RfD) is 
defined which is one hundredth of the NOAEL and which 
thus incorporates a substantial safety factor. The reference 
dose is also termed the acceptable daily intake (ADI). 

Al 1.8.4 Exposure assessment 

Exposure assessment involves determining the persons 
exposed and their intake of toxic chemicals. 

The EPA has issued standard assumptions for exposure. 
For adults these include the following: 

Air inhaled (m 3 /d) 20 
Water ingested (1/d) 2 
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Soil ingested (mg/d) 100 
Fish consumption (g/d) 6.5 
Lifetime exposure (year) 70 

The assessment required is for a reasonable maximum 
exposure (RME) under present and future land use 
conditions. 

A11.8.5 Risk characterization 

Risk characterization involves combining the toxicity and 
exposure estimates to obtain an assessment of risk to 
human health and making an assessment of the risks to 
the environment. 

Cancer risks are expressed as the probability of con¬ 
tracting cancer from exposure to the chemicals over a life¬ 
time. Non-cancer risks are expressed for a single substance 
in terms of a hazard quotient (HQ) or for a set of substances 
in terms of a hazard index (HI), the sum of the hazard quo¬ 
tients. The hazard quotient is the ratio of the daily intake to 
the RfD. If the HQ is less than unity, the chemical is not 
regarded as a threat to public health. 

A11.8.6 Source terms and transport models 

A full hazard assessment of a hazardous waste TSDF 
requires the modelling of source terms and of the transport 
and transformation of chemicals in the atmosphere and the 
ground. These aspects are discussed in Section A11.12. 

All.9 Environmental Impact Assessment 

All.9.1 Environmental assessments 

An EA presented in an ES is for some projects a regulatory 
requirement under the Environmental Assessment Regu¬ 
lations 1988. 

Accounts of ES are given in Environmental Impact 
Assessment of Waste Treatment and Disposal Facilities by 
Petts and Eduljee (1994) and by E.J. Martin and Johnson 
(1987) and Veselind, Peirce and Weiner (1990). 

The treatment by Petts and Eduljee is comprehensive 
and although concerned with hazardous waste facilities its 
general approach is of much wider application. 

The authors describe the regulatory requirements for, 
the purposes of and practice in respect of an EA and they 
relate the EA to the requirement to select the best practic¬ 
able environmental option (BPEO) with its implication that 
alternatives must be considered. 

They outline the process of scoping. Following Elkin and 
Smith (1988), identification of the crucial concerns should 
cover (1) geographic boundaries, (2) administrative 
boundaries, (3) project timing and duration, (4) key stake¬ 
holders, (5) key resources and land uses, (6) key activities, 

(7) key policies and (8) interactions. They describe the 
scoping techniques of consultation and identification of 
impacts and their significance and indicate other tech¬ 
niques such as checklists, matrix and network methods, 
and cause-effect diagrams. They then deal specifically 
with the scoping of landfill and incineration. 

For each feature subject to impact, Petts and Eduljee 
describe the feature itself, the scoping, the baseline condi¬ 
tions and survey, the prediction and evaluation of impacts, 
and the mitigation of impacts. They apply this treatment 
to (1) flora and fauna, (2) geology and soils, (3) ground 
and surface water, (4) air quality and climate, (5) public 
health, (6) landscape and visual amenity, (7) transport, 

(8) social and economic features, (9) land use and heritage 


and (10) residuals. In addition to the usual impact factors 
they consider acute events, noise and vibration, and land¬ 
fill gas. 

As a case study, the authors consider the Seal Sands 
incinerator. 

A US perspective is given by Veselind, Peirce and Weiner 
(1990). They describe an EIS as consisting of three distinct 
parts: (1) inventory, (2) assessment and (3) evaluation. 
The relevant factors are broadly similar to those just 
mentioned. They also outline a scoring scheme in which 
impacts are rated using scales of importance and 
magnitude. 

In some instances, particularly in the early days, the EIS 
has constituted a major exercise. For the trans-Alaska 
pipeline the draft EIS, the comments and the final EIS ran 
to 30 volumes. 

A11.9.2 Safety cases 

For major hazard installations the CIMAH Regulations 
1984 require the submission of a safety case which covers 
the consequences of a major accident not only for human 
but for the environment. This aspect of the safety case is 
discussed by Singleton (1989) and Cassidy (1990). 

The safety case is concerned with acute events and it 
may be regarded as complementing the regulatory controls 
dealing with long-term pollution and environmental 
impact. 

Cassidy advises that the safety case should give infor¬ 
mation on the land uses around the site, the environmental 
hazards of the substances stored or processed and the 
potential impact on flora and fauna and on the balance of 
nature. Where there is potential to contaminate water, it 
should give comprehensive information on the local water¬ 
courses and their uses. Particular attention should be paid 
to the potential for harm to targets which are rare or unique, 
to persistence of noxious substances in the environment 
and to long-term damage. The author gives decision trees 
for assessing land and water impacts. 

He also draws attention to the need to address the envi¬ 
ronmental aspects in the emergency planning required 
under the regulations. 

Singleton deals with the assessment of the consequences 
to the environment of an accident involving an ultra¬ 
toxic substance. He considers the cases of copper- 
chrome-arsenate (CCA) wood preservatives and of 
pesticides. 

A11.9.3 Waste facility assessments 

A hazardous waste facility needs to be assessed to deter¬ 
mine the hazard which it poses to the environment and to 
humans. 

Petts and Eduljee (1994) describe two approaches to such 
assessment. One is to undertake a full environmental 
hazard assessment, as described in the previous section. 

The other approach is the use of a structured checklist. 
This is the method used in the project on hazard assess¬ 
ment of landfill (HALO) described by Kemp and Gerard 
(1991). 

A somewhat similar approach is taken in the Hazard 
Ranking Scheme (HRS) of the EPA (1982a), which utilizes 
a scoring system. 

A11.9.4 Spill impact assessment 

A more specific form of impact assessment is the assess¬ 
ment of the effects of a spill of hazardous material. 
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Typically this might be a liquid spill occurring in road or 
rail transport or from a pipeline. 

Methods of assessing the impact of a spill which has 
already occurred are given in the literature as one aspect of 
spill control, as described in Section A11.20, but assess¬ 
ment of the impact of potential spills in advance receives 
little mention. 


All.10 Environmental Economics 

The costs to the process industries of environmental pro¬ 
tection are high, but experience indicates that, as with 
safety, good practice is also good business. 

Costs and savings may be computed at national or com¬ 
pany level. At the national level costs in the United states 
have been given in Environmental Investments: The Costs of 
a Clean Environment by the EPA (1991) (Chementator 1991 
Mar., 25). In 1972, expenditure on pollution control was 
some $30 billion («1% of GDP). By 1987, it had risen to $98 
billion («2% GDP) and by 1990 to $115 billion («2.1% 
GDP); the projection for the year 2000 is $140-160 billion 
(w3% GDP); the values are all in 1990 dollars. The 1987, 
figures include $28.9 billion for air and $42.9 billion for 
water pollution control. The process industries account for 
a large proportion of this expenditure. 

Savings at the national level are inevitably less easy to 
obtain. 

However, as described in Section A11.13, the efforts now 
devoted to waste minimization are testimony to the fact that 
there are economic benefits. 


All.11 Environmentally Noxious Chemicals 

There are a number of substances which figure particularly 
prominently as pollutants. Some of the principal ones are 
mentioned briefly in this section. 

Many of these substances appear in gaseous or liquid 
effluent streams. To this extent, their release is controlled 
one. The hazard from others may arise from an accident. 
A pesticide is a case in point, as described below. 

A11.11.1 Sulfur dioxide and acid rain 

A major pollutant from combustion processes is sulfur 
dioxide, which is responsible for acid rain. 

Acid rain pollution is described in Sulphur Emissions 
and the Environment by the SCI (1981b), Energy and the 
Environment: Acid Rain by Keith (1982), Acid Rain Infor¬ 
mation Book by Record, Bubenick and Kindya (1982) and 
Acid Deposition by Adams and Page (1986) and by Ireland 
(1987). Control technologies are detailed in Add Emissions 
Abatement Techniques by the DoE (1991-). 

A11.11.2 Nitrogen oxides 

Nitrogen oxides NO* arise from combustion processes. 
Both industrial combustion and cars are major con¬ 
tributors. 

The NO* problem and control technologies are discussed 
by Marzo and Fernandez (1980), Niess (1980), Redman 
(1989a) and R. Smith and Petala (1991-). 

A11.11.3 Pesticides 

Pesticides are highly active chemicals. The expose in Silent 
Spring by Carson (1963) rendered their use controversial. 


The production, storage and handling of pesticides cre¬ 
ates the potential for release in an event such as a fire, or 
with the fire water used. 

The pesticide problem is discussed in Persistent Pesti¬ 
cides in the Environmentby C.A. Edwards (1974) and by the 
SCI (1978). 

A11.11.4 Polychlorinated biphenyls 

For many years, until their extreme toxicity came to be 
appreciated, polychlorinated biphenyls (PCBs) were used 
as electrical transformer fluids. The main concern now is 
prevention of escape from such equipment and safe meth¬ 
ods of disposal. This is discussed by Berry (1981) and 
Motter (1991). A guide to EPA-approved methods of dis¬ 
posal is given by Kokozska and Flood (1985). 

All.11.5 Toxic metals 

Toxic metals which occur in trace quantities in effluents, 
including those from incinerators, can be very harmful to 
the environment. 

Treatments of toxic trace metals are given in Control and 
Fate of AtmosphericTrace Metals by Pagna and Ottar (1989) 
and by Barton, Clark and Seeker (1990). 

A11.11.6 Mercury 

Certain processes, notably traditional processes for 
chloralkali production, discharge mercury, albeit in very 
low concentrations. Accumulation of mercury, especially 
in the form of methyl mercury, is very noxious to the 
environment. 

All.11.7 Dioxins 

TCDD and other dioxins exhibit toxic effects in minute 
concentrations, and rank as ultratoxic substances. The 
toxicity of TCDD is discussed in Appendix 3 in the context 
of Seveso. 

TCDD is produced in very low concentrations in 
combustion processes and can be produced in a chemical 
reactor. 

The dioxin problem and methods of dealing with it are 
discussed in Human and Environmental Risks of Chlorin¬ 
ated Dioxins and Related Compounds by R.E. Ticker, Young 
and Gray (1983) and Dioxin Containing Wastes: Treatment 
Technologies byArienti etal. (1988) and by Ayres (1981), Rice 
(1982), Short etal (1984) and Beychok (1987a). 

All.11.8 Nitrates 

Nitrates are another significant pollutant, but arise mainly 
from the use of fertilizers, and are outside the present 
scope. An account is given by Nicolson (1979). 

All. 11.9 Health effects 

Threats to health may arise from the use, or more 
often abuse, of chemicals or from their release to the 
environment. 

Health effects of chemicals in the environment are 
treated in Health Effects of Environmental Pollutants by 
Waldbott (1973), Environmental Industrial Health Hazards 
by Trevethick (1976), Air Pollution and Human Health by 
Lave and Seskin (1977a), Long-Term Hazards of Environ¬ 
mental Chemicals by Doll and McLean (1979) and Hazard¬ 
ous Waste and Human Health by the BMA (1991) and by 
McLean (1981) and Asante-Duah (1993), as well as in texts 
on environmental hazard assessment. 
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All.12 Chemicals Transport, Transformation, 

Fate and Loading 

A fundamental approach to hazard assessment in EP 
involves tracing the dispersion and determining the fate of 
chemicals in the environment. 

In principle, a full treatment therefore involves study of 
the dispersion of gaseous effluents in the atmosphere and 
of the deposition of particulate matter; the transmission of 
chemicals through waters and soils of all types; and their 
passage through the food chain. 

A great deal of work has been and continues to be done in 
all these areas. In some cases the prime concern is with 
potential airborne releases from nuclear power plants or 
leaks from nuclear waste stores into watercourses, in others 
it is with the effects of pesticides and other chemicals 
already in use. 

Accounts of the transport, transformation and fate of 
chemicals in the environment include Environmental Pol¬ 
lution by Chemicals Walker (1971), Persistent Pesticides in 
the Environment by C.A. Edwards (1974), Pollution Criteria 
for Estuaries by Helliwell and Bossanyi (1975), Principles 
for Evaluating Chemicals in the Environment by the NAS 
(1975), Safely of Chemicals in the Environment by Harwell 
(1979), Chemical Concepts in Pollutant Behaviour by Tinsley 
(1979), Hydrocarbons and Halogenated Hydrocarbons in the 
Aquatic Environment by Afghan and Mackay (1980), 
Dynamics, Exposure and Hazard Assessment of Toxic Chemi¬ 
cals by Haque (1980b), Chemicals in the Environment by 
Neely (1981), Physico-Chemical Behaviour of Atmospheric 
Pollutants by Versino and Ott (1982), Environmental Expo¬ 
sure to Chemicals by Neely and Blau (1985), Pollutant 
Transport and Fate in Ecosystems by Coughtrey, Martin 
and Unsworth (1987), Control and Fate of Atmospheric 
Trace Metals by Pagna and Ottar (1989), Reaction Mecha¬ 
nisms in Environmental Organic Chemistry by Larson 
and Weber (1994), Hazardous Waste Risk Assessment by 
Asante-Duah (1993) and Standard Handbook for Solid and 
Hazardous Waste Facility Assessment by Sara (1994). 
Worldwide limit values are given in World-wide Limits for 
Toxic and Hazardous Chemicals in Air, Water and Soil by 
Sittig (1994). 

All. 12.1 Source terms 

The starting point for the modelling of transport through 
environmental media is the definition of the source terms. 

Three principal types of source terms are (1) gaseous 
emissions from a hazardous waste TSDF, (2) leachate see¬ 
page from aTSDFand (3) liquid spill into a watercourse in a 
transport accident. 

A review of gaseous emission source terms at aTSDF is 
given by B.P. Smith (1987). Models quoted by this author 
are for surface impoundments, that of Thibodeau, Parker 
and Heck; for aerated tanks, that of R.A. Freeman (1980); 
for storage tanks, the usual relations for ‘breathing’ losses; 
for landfill, that of W.J. Farmer, Yang and Letey (1980), as 
modified by Hwang (1980) and Shen (1981); and for land 
treatment, that of Thibodeaux and Hwang (1982). 

For liquid seepage the source term is highly site specific. 
Seepage from landfill is treated in accounts of landfill and 
of leachate. 

A liquid spill from a transport vehicle is a relatively 
well-defined source. Another form of transport spills is a 
pipeline leak, where the issues are the location and the 
flow rate. 


All. 12.2 Transport of chemicals 

Chemicals are transported through the environment by 
atmospheric dispersion and by movement through waters. 

A review of air, surface water, groundwater, soil and 
multimedia transport models applicable in this context is 
given by McBean (1993). 

For transport of gaseous emissions use is made of atmos¬ 
pheric dispersion models. These include the passive gas 
dispersion models familiar in hazard assessment, but also 
in some cases models for transport over much greater dis¬ 
tances and periods and in more complex meteorological 
conditions. 

The ISC model of the EPA is widely used, both in its 
short-term version ISCSTand its long-term version ISCLT. 

For transport through water the review by McBean may 
be supplemented by the exhaustive treatment of transport 
through soil and groundwater, based on fundamental 
geology and hydrology, given by Sara (1994). 

Transport through water is typically modelled using 
compartment, or control volume, models. For movement in 
surface water a widely used model is EXAMS of Burns, 
Cline and Lassiter (1982). 

The modelling of the dispersion of a chemical spilled into 
a stream is discussed by Kontaxis and Nusser (1982). 

There is no obvious preferred model for movement 
through groundwater. 

The TOX-SCREEN model of the EPA (1984c), which 
assesses the potential fate of chemicals released to air, 
surface water or soil, may be used to screen for substances 
which even on conservative assumptions are unlikely to 
pose a threat to the environment. 

In the United kingdom, as described by Welsh (1993), the 
HSE is developing a risk assessment tool for pollution 
risk from accidental influxes into rivers and estuaries 
(PRAIRIE), which incorporates a family of river dispersion 
models DYNUT. 

A11.12.3 Transformation of chemicals 

Chemicals moving through the environment may undergo 
a number of transformations, including reactions, 
among which are (1) hydrolysis, (2) chemical oxidation, 
(3) photolysis and photo-oxidation, (4) biodegradation, 
(5) absorption, (6) adsorption, (7) volatilization and 
(8) sedimentation. 

Some of these transformation processes are described by 
Welsh (1993). 

A11.12.4 Fate of chemicals 

The determination of the fate of chemicals in the environ¬ 
ment is an extremely complex matter. In part it has to do 
with the transport and transformation processes just out¬ 
lined and in part with the assimilative capacity of envi¬ 
ronmental media and with the effects of the take-up of 
chemicals into food chains. The concept of an ultimate fate 
appears to imply some eventual steady state, although the 
associated timescales may well be rather long. 

A11.12.5 Capacity of the environment 

To a greater or lesser degree, environmental media have 
the capacity to tolerate a certain chemical burden. The 
assumption that this is so is frequently implicit in industry 
practices. 

In certain instances this assimilative capacity is esti¬ 
mated and the loading is adjusted accordingly. Two such 
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cases are the limiting chemical load in land treatment and 
the oxygen demand load on watercourses. 

An example of calculated loading occurs in land treat¬ 
ment, where the quantity of liquid waste applied to an area 
of land may be estimated by identifying the soil con¬ 
taminant control and removal mechanisms and estimating 
the assimilative capacity. 

A11.12.6 Loading of watercourses 

Another example of loading occurs when a chemical is 
spilled into a watercourse, either by accidental discharge 
from a works or as a result of a transport accident. 

The health of a watercourse such as a stream or river 
depends on the maintenance of sufficient dissolved 
oxygen (DO). 

Industrial wastewater discharged into a watercourse 
tends to use up the oxygen in the latter, its propensity to do 
so being measured by its oxygen demand (OD), or more 
specifically its biological oxygen demand (BOD), described 
below. If the wastewater is hot, it also tends to raise the 
temperature of the watercourse. Discharge of wastewater 
therefore tends to deplete the oxygen in the watercourse 
both by virtue of its OD demand and its temperature. 
Reaeration processes operate to make up the dissolved 
oxygen deficit caused by these deoxygenation processes. 

There are a number of models, described by Nemerow 
and Dasgupta (1991), of the effect of wastewater discharge. 
They include the formulation of Streeter and Phelps (1925), 
the method of H.A. Thomas (1948) and the correlation of 
Churchill and Buckingham (1956). The latter found that 
they were able to correlate the DO as a function of the BOD, 
the temperature and the flow. 

All.12.7 Biological oxygen demand 

A standard method of expressing the oxygen demand is as 
the BOD measured under specified conditions over 5 days 
and at 20°C. 

The solubility of oxygen in water at 20°C is 9.2 mg/1. The 
BOD of domestic sewage is about 200 mg/1, whilst that of 
some industrial wastes can be as high as 30,000 mg/1. 

Another measure is the chemical oxygen demand (COD). 
The test for COD is quicker than that for BOD, but since in 
this case all the organics are oxidized, this test gives a 
higher reading. 

All.13 Waste Minimization 

The development of loss prevention is paralleled by that of 
waste minimization. A large part of the latter is by inher¬ 
ently cleaner design (ICD), which stands in much the same 
relationship to the environment as inherently safer design 
does to safety. But in so far as waste minimization involves 
management commitment and management systems to 
deliver a systematic approach, the closer parallel is with 
loss prevention. Another term commonly used is clean 
technology. 

Accounts of waste minimization are given in Hazardous 
Waste Minimization Handbook by Higgins (1989), Hazard¬ 
ous Waste Minimization by R.A Freeman (1990), Waste 
Minimization Guide by Crittenden and Kolaczkowski (1992) 
and by Redman (1989c), Hethcoat (1990), R. Smith and 
Petela (1991-), Curran (1992), Chadha and Parmele (1993) 
and Rossiter, Spriggs and Klee (1993). 

In the United States, the waste minimization approach is 
actively promoted by the EPA, relevant publications being 


Waste Minimization, Environmental Quality with Economic 
Benefits (EPA, 1987b) and Waste Minimization Opportunity 
Assessment Manual (EPA, 1988). 

A11.13.1 Waste minimization management systems 

The waste minimization philosophy has been widely 
adopted in the process industries. As with loss prevention, 
success has been achieved as management has become 
convinced and committed and has developed effective 
strategies, put in place formal systems, allocated the 
necessary resources, including people, and created a self¬ 
reinforcing waste minimization culture. 

An account of developments in the United States and 
elsewhere, is given by Redman (1989c), together with 
numerous examples of case studies and cost savings. 

Basic approaches to waste minimization are to modify (1) 
the chemicals, (2) the process, (3) the equipment and (4) the 
effluent treatment. Chemicals which tend to be troublesome 
include toxic metals and halogenated hydrocarbons. Pro¬ 
cess modifications which may prove fruitful are replace¬ 
ment of (1) chemical by mechanical processes and (2) single 
pass processes, including rinse operations, with closed 
processes. Effluent treatment may be modified to recycle or 
recover materials. 

Approaches to waste minimization are outlined in Fig¬ 
ure All.l. On an existing plant the first step is a waste audit. 

The ways in which waste minimization may be effected 
are very varied. This comes across clearly from the exam¬ 
ples quoted by Redman. They include minimization of 
plant washdowns, squeezing of sludges to remove water 
and reduce mass, design of drums which leave less residue, 

Redman cites a case, described by Huisingh, in which 
installation of equipment to recover wastes from film 
development at a cost of $120,000 made annual savings of 
$2.6 million on silver and on developing, fixing and bleach 
solutions, a payback time of one month. 

An account of a waste minimization programme in one 
company is given by Koenigsberger (1986). 

A11.13.2 Process plant wastes 

A review of the application of waste minimization in the 
process industries covering (1) the basic problem, (2) reac¬ 
tors, (3) separation and recycle systems, (4) process opera¬ 
tions and (5) utilities is given by R. Smith and Petala 
(1991—). 

In a reactor five main sources of waste are (1) low 
conversion, (2) unwanted by-products from the primary 
reaction, (3) unwanted by-products from the secondary 
reaction, (4) unwanted by-products from feed impurities 
and (5) degraded catalyst. There is often scope for reduc¬ 
tion of such waste by the application of reaction engineer¬ 
ing principles. 

In separation processes there may be scope for 
waste minimization by (1) elimination of feed impurities, 

(2) elimination of extraneous materials used for separation, 

(3) recycling of waste streams and (4) additional separation 
of such streams. 

As an illustration of the benefits of eliminating a feed 
impurity the authors instance the elimination of nitrogen 
by the use of oxygen rather than air in the oxychlorination 
stage of ethylene dichloride production. They describe a 
design of ethylene dichloride reactor which avoids carry¬ 
over of the ferric chloride catalyst and thus eliminates the 
need for washing and neutralization stages. 
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Under process operations they cover (1) start-up and 
shut-down, (2) product changeover, (3) equipment main¬ 
tenance, (4) tank filling, (5) accidental spillages and (6) 
fugitive emissions. During transient operations such as 
start-up and shut-down product may be off specification, 
additional by-products may be made and recycles may not 
be possible. Product changeover and equipment cleaning 
give rise to cleaning wastes. Tank filling causes losses as 
vapours are forced out. 

In the utilities wastes are associated particularly with 
combustion processes, steam generation and cooling water. 
All these wastes can be reduced by a design which promotes 
energy efficiency. In combustion methods are discussed of 
minimizing or dealing with oxides of sulfur and nitrogen. 
Other wastes to be minimized are boiler and cooling tower 
blowdowns. 

A11.13.3 Refinery wastes 

The application of waste minimization to refinery opera¬ 
tions has been described by Hethcoat (1990) and Curran 
(1992). 

Whereas originally waste minimization was applied 
mainly to the conservation of hydrocarbons, it now finds 
much wider application. The overall strategy involves (1) 
source reduction and (2) recycling as well as (3) treatment. 

Some principal wastes are (1) oily materials, (2) catalyst 
residues, (3) spent caustic and (4) wastewaters. 

Oily residues are oil-coated solids, mainly from oil- 
water separators, dissolved air filtration (DAF) units, heat 
exchanger cleanings and tank bottoms. Residues also arise 


in sewers from road dust materials carried in with runoff 
water. Waste catalysts arise from processes such as cata¬ 
lytic cracking, conversion of heavier products to lighter 
ones, reforming of gases to liquid products, and sulfur 
removal. Spent caustics occur as phenolic or sulfide caustics. 

The incidence of wastes is highly variable from one 
refinery to another. Curran states that quantities of oil 
residues and usage of water can vary by almost two orders 
of magnitude. 

Measures to reduce refinery wastes include use of mixers 
in crude oil tanks to keep solids suspended, elimination 
of intermediate storage tanks between units, elimination of 
blending tanks by use of in-line blending, minimization of 
surfactants which cause emulsions and promote sludges, 
preskimming of oil at the separators, use of pressurized air 
at the dissolved air flotation unit to give a more con¬ 
centrated sludge, reprocessing of oily residues in suitable 
refinery units such as a coker, paving of process areas to 
reduce dust and sweeping of roads for the same purpose. 

At the utilities measures taken include maximization of 
air cooling, use of a closed cooling water system and 
reduction of solids in the boiler blowdown water. 

Segregation also has a part to play. Curran describes 
segregation of phenolic and sulfide spent caustics, Heth¬ 
coat provision of three separate sewer systems for non-oily 
liquids and one for oily ones. 

Hethcoat discusses the identification of options for waste 
minimization, under the source reduction, recycling and 
treatment heads, giving as illustrations oily wastewater 
from separator bottoms and wastes from empty drums. 



Figure A11.1 Waste minimization: (a) techniques; and (b) assessment procedure (Environmental Protection Agency; 
reproduced by permission of Gower Press) 
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The recognized need to minimize waste 



Successfully implemented 
waste minimization projects 


(b) 

Figure A11.1 Continued 


A11.13.4 Process integration 

Waste minimization may be addressed in terms of process 
integration. The treatment by R. Smith and Petala (1991), 
just described, approaches the problem from this view¬ 
point. Another account is that of Rossiter, Spriggs and Kell 
(1993). 


A11.13.5 Center for Waste Reduction Technology 

The AlChE has set up the Center for Waste Reduction 
Technology (CWRT), a sister centre to the CCPS. It is 
described by L.L Ross (1991). 


All.14 Gaseous Effluents 

Processes tend to generate a number of gaseous effluents 
which include impurities entering in the feeds, notably 
nitrogen in process air and air dissolved in liquid feeds; 
unwanted gaseous products from reactions; gases from 
purges such as that in the flare stack; and gaseous products 
of combustion. 


Accounts of gaseous effluents, and the technologies of 
dealing with them, are given in Air Pollution Handbook by 
Magill, Holden and Ackley (1956), Atmospheric Pollution by 
Meetham (1968), Air Pollution by Scorer (1968), Air Pollu¬ 
tion Control by Strauss (1971-), Gas Purification Processes 
for Air Pollution Control by Nonhebel (1972), Pollution in the 
Air hy Scorer (1973), Compilation of Air Pollutant Emission 
Factors by the EPA (1978a), Fundamentals of Air Pollution 
by Stern et al. (1973), Dust Control and Air Cleaning by 
Dorman (1974), Gas Cleaning for Air Quality by Marchello 
and Kelly (1975), Air Pollution by the Open University 
(1975a), Air Pollution by Seinfeld (1976), Air Pollution 
Control Equipment by Theodore and Buonicore (1976), 
Approaches to Controlling Air Pollution by Friedlander 
(1978), Reference Book by the National Society for Clean Air 
(NSCA) (1978), Industrial Air Pollution Handbook by 
A. Parker (1978), Air Pollution Impacts and Control by 
Downey and Ni Uid (1979), Air Pollution Control by Hesketh 
(1979), Air Pollution Control Engineering by Licht (1980), 
Paniculate Air Pollution by Theodore, Sosa and Fajardo 
(1980), Air Pollution by E. Weber (1982), Hazardous Air 
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Emissions from Incineration by Brunner (1985), Environ¬ 
mental Pollution and Control by Veselind, Peirce and Weiner 
(1990), Process Engineering and Design for Air Pollution 
Control by Benitez (1993) and Gas Processing: Environ¬ 
mental Aspects and Methods by Speight (1993). 

A11.14.1 Types of gaseous effluent 

A gas effluent stream may consist of a gas which is itself 
noxious or of a non-noxious carrier gas which contains 
noxious impurities. The impurities may be gases or 
vapours, liquid droplets or solid particles. 

Some principal gaseous effluents which require to be 
treated are (1) hydrogen sulfide, (2) carbon dioxide, (3) sulfur- 
containing gases SO* and (4) nitrogen-containing gases 
NO*. Hydrogen sulfide and carbon dioxide are commonly 
referred to as acid gases. 

Hydrogen sulfide figures prominently in oil handling 
and refining. Carbon dioxide is the main acid gas product of 
combustion and also arises from oil refining and chemical 
operations. Sulfur oxides SO*, essentially S0 2 , are gener¬ 
ated in combustion of fuel containing sulfur and in oil 
refining and chemical operations. Nitrogen oxides NO*, 
essentially NO and N0 2 , arise as so-called fuel-bound NO* 
and thermal NO* from combustion processes. 

A11.14.2 Gaseous effluent control 

Waste minimization may be applied to reduce the quantities 
of the gaseous effluents to be treated and the concentration 
of noxious components in these effluents, and to facilitate 
any treatment necessary. 

A principal application of this approach which has long 
been practised is desulfurization of coal prior to combus¬ 
tion, as described below. 

A11.14.3 Gas cleaning 

The main methods of removing noxious gases or vapours 
from a gas stream are absorption, adsorption, reaction to a 
solid product and reaction with solids. 

Absorption processes for removal of hydrogen sulfide 
and carbon dioxide are the amine family of processes, 
including the Girbitol process using ethanolamine, and the 
carbonate family, including the Benfield process using 
potassium carbonate, and for removal of hydrogen sulfide 
the Stretford process using sodium carbonate. 

Hydrogen sulfide is removed in the Claus process by 
thermal and then catalytic reaction to sulfur. Hydrogen 
sulfide is also removed by reaction with iron oxide, a tra¬ 
ditional gasworks process. 

Processes for removal by absorption of sulfur dioxide 
include the Battersea process. Prior to combustion sulfur 
dioxide may be removed by fuel desulfurization. In its 
application to coal, this approach is also known as clean 
coal technology. In the process sulfur dioxide may be 
removed by reaction with limestone. 

Absorption in oil is a traditional method of removing 
acid gas and hydrocarbons. 

Flue gas desulfurization (FGD) comprises a group of 
techniques. One option is desulfurization of the fuel prior 
to combustion. A traditional post-combustion method is 
the removal of sulfur dioxide by the use of lime or limestone 
in ‘wet scrubbers’. Advanced post-combustion methods 
involve contacting the gas with a sorbent such as lime 
either by in-stack injection or by injection into separate 
in-line vessels. 


There are also combined processes for removal of 
both sulfur dioxide and nitrogen oxides, in which FGD is 
combined with a denitrification step. One method of 
removing nitrogen oxides is catalytic reaction with inj ected 
ammonia. 

There are a large number of other gas cleaning processes. 
Outlines of about 80 are given by Speight (1993). Process 
flow diagrams are given periodically in Hydrocarbon 
Processing. 

Removal of gaseous components may also be effected by 
the use of membrane processes. 

Principal methods for the removal of particles include 
cyclones, fabric filters and electrostatic precipitators. 

A review of technologies for acid gas removal in support 
of the UK programme is given in Acid Emissions Abatement 
Technologies by the DoE (1991). 

All.14.4 Smog reduction 

A number of industrialized countries have suffered from 
serious air pollution in the form of smog. An account of the 
‘killer smog’ in London in 1952 is given below. 

In the United Kingdom, considerable progress has been 
made in reducing this form of air pollution. Thus in the City 
of London between 1955 and 1974, for example, the annual 
average concentrations of smoke and sulfur dioxide near 
the ground were reduced as follows (Warner, 1976): 



Concentration 

Concentration 


of smoke 

ofS0 2 


(pg/m 3 ) 

(Pg/m 3 ) 

1955 

f*195 

230 

1974 

«40 

110 


All. 14.5Tall chimneys 

The use of tall chimneys for avoidance of pollution in the 
immediate vicinity of a plant is a traditional practice. The 
drawback is that noxious effluents may be spread, albeit in 
dilute form, further afield. 

An account of the practice of the Alkali Inspectorate in 
relation to tall chimneys has been given by Ireland (1984). 
The topic has also been discussed by Perriman (1986). 

All.14.6 Emission bubble 

An approach to air pollution control which in principle 
allows a company to adopt the most economic trade-offs is 
that of the ‘bubble’, in which all emissions from sources 
within the bubble are treated as if they were from a single 
controllable source. A formal statement of such a policy is 
that alternative methods of control are allowed provided it 
can be demonstrated that they are substantially equivalent, 
the criterion being the equivalence of the emissions leaving 
the bubble. The bubble concept was adopted by the EPA in 
1979. It had a mixed reception, being welcomed in some 
cases by industry, but not always by the states. An account 
is given by Weismantel and Parkinson (1980). 

All.15 Liquid Effluents 

The liquid effluents from a process plant include not just 
those shown as such on the flowsheet for the basic process, 
but a variety of other liquid flows ranging from washwater 
to rainwater runoff. 
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Accounts of liquid effluents, and the technologies of 
dealing with them, are given in Biological Waste Treatment 
by Eckenfelder and O’Connor (1961), Industrial Wastewater 
Control by Gurnham (1965), Industrial Water Pollution by 
Eckenfelder (1966), Water and Waste Water Engineering by 
Fair, Geyer and Okun (1966), Aqueous Wastes from Petro¬ 
leum and Petrochemical Plants by Beychok (1967), Liquid 
Waste of Industry by Nemerow (1971), Water Pollution by 
Newsom and Sherratt (1972), Waste Water Systems Engi¬ 
neering by H.W. Parker (1972), Clean and Dirty Water by the 
Open University (1975b), Handbook of Advanced Waste- 
water Treatment by Gulp, Webster and Gulp (1978), Waste- 
water Treatment by Sundstrom and Klei (1979), Wastewater 
Treatment and Disposal by Arceivala (1981), Biological 
Treatment of Waste Water by Winkler (1981), Handbook of 
Wasterwater Treatment Processes by Vernick and Walker 
(1982), Removal of Metals from Wastewater by Cushie (1984), 
Hazardous Waste Management Engineering by E.J. Martin 
and Johnson (1987), Environmental Pollution and Controlby 
Vesilind, Peirce and Weiner (1990), Wastewater Engineering 
by Metcalf and Eddy Inc. (1991) and Industrial and Hazard¬ 
ous Waste Treatment by Nemerow and Dasgupta (1991). 

The modelling of the hydraulics of, and dispersion in, 
rivers, estuaries, etc. is described in Hydraulic Behaviour of 
Estuaries by McDowell and O’Connor (1977); Groundwater 
by Freeze and Cherry (1979); The Mathematics of Hydrology 
and Water Resources by Lloyd, O’Donnell and Wilkinson 
(1979); Practical Aspects of Computational River Hydraulics 
by Cunge, Holly and Verwey (1980); Hydraulic Modelling by 
Kobus (1981); Models in Hydraulic Engineering by Noak and 
Cabelka (1981); and also in certain texts of computational 
fluid dynamics. 

All.15.1 Types of liquid effluent 

Liquid effluents from process plants are fluids from (1) the 
process, (2) the cooling system, (3) the process ancillary 
operations, (4) the sanitary system and (5) the rainwater 
runoff. The process ancillary operations are those such as 
cleaning and washing. 

A proportion of the fluids from the process are liquids 
which are either non-aqueous or high concentration aque¬ 
ous wastes. The rest are wastewaters containing oils and 
chemicals at lower concentrations. 

A detailed review of liquid wastes from different indus¬ 
tries, including the oil and chemical industries, is given by 
Nemerow and Dasgupta (1991). They cover organic chemi¬ 
cals; toxic chemicals; acid and chloralkali wastes; for¬ 
maldehyde wastes; pesticides wastes; and wastes from the 
energy, fertilizer, phosphates, plastics and rubber, soap and 
detergent and explosives industries. 

A11.15.2 Wastewater control 

Wastewater requires a degree of treatment before it is dis¬ 
charged to receivers such as municipal systems or water¬ 
courses. There are a number of prior measures which may 
be taken to minimize the extent of the treatment required. 
These measures include (1) volume reduction, (2) strength 
reduction and (3) flow equalization and proportioning. 

Waste minimization may be applied to reduce the volume 
of wastewater either by generating less in the first place or 
by reusing it. It may also be applied to keep down the con¬ 
centration of contaminants in the wastewater. Segregation 
of wastewaters also has a role to play in reducing the 
volume to be treated or facilitating treatment. 


Flow equalization involves the control of flows dis¬ 
charged to smooth out plant flow fluctuations and flow 
proportioning the control of discharge flows to match those 
in the municipal system or the watercourse. 


A11.15.3 Wastewater treatment 

Complete treatment of wastewater is typically classified 
as follows: (1) wastewater pretreatment, or conditioning, 
(2) primary treatment, (3), secondary treatment, (4) tertiary 
treatment, (5) sludge treatment and (6) liquid and sludge 
disposal. 

Wastewater pretreatment processes are screening and 
grit removal and neutralization. 

Primary treatment of wastewater involves removal 
of suspended solids by (1) sedimentation and (2) flota¬ 
tion. Either process may be operated with chemical addi¬ 
tion. Removal of oil droplets can be effected by gravity 
separation. 

Solids also occur in colloidal form, and the methods of 
dealing with them are often termed intermediate treatment. 
They include (1) chemical coagulation, (2) charge neu¬ 
tralization coagulation and (3) adsorption. The second of 
these involves coagulation by neutralization of the electric 
charge. 

Secondary treatment processes deal with dissolved 
organic materials and comprise a range of mainly bio¬ 
logical treatments. These processes are (1) aerobic or 
(2) anaerobic. 

There is a wide variety of aerobic processes including 

(I) lagooning, (2) activated sludge, (3) modified aeration, 
(4) dispersed growth aeration, (5) high rate aerobic treatment, 
(6) contact stabilization, (7) trickling filtration, (8) biologi¬ 
cal discs, (9) mechanical aeration, (10) wet combustion and 

(II) spray irrigation. Holding in lagoons is used to effect 
biological degradation. Activated sludge involves oxida¬ 
tion by floes from suspended and colloidal solids, the 
sludge concentration being controlled by a recycle. Modi¬ 
fied aeration is a modification of the activated sludge 
method. Dispersed growth aeration is a variant, which does 
not involve the use of floes. Contact stablization, or bio¬ 
sorption, is another modification of the activated sludge 
method. High rate aerobic treatment, or total oxidation, is 
another sludge process but with a higher sludge return 
rate. Trickle filtration and biological discs involve oxidation 
by slimes, the substrate being in the one case a packed bed 
and in the other rotating discs. Mechanical aeration 
involves sparging air into the liquid. Wet combustion, or 
wet air oxidation, is described below. In spray irrigation the 
liquid is sprayed onto land with aerobic conditions main¬ 
tained to a certain depth, and is thus both a treatment and 
a disposal. 

Anaerobic digestion takes place in closed vessels in the 
absence of air. Loadings are low and residence times long. It 
is most suited to small throughputs of liquids with high 
concentrations of readily oxidized organics and is used 
mainly for sludges rather than liquid wastes. 

Other methods of removing organics include steam 
stripping and solvent extraction. 

Tertiary treatment processes remove dissolved inorganic 
materials. They involve both chemical treatments and 
physical separation using a variety of unit operations. 
Chemical methods include (1) coagulation and precipi¬ 
tation and (2) oxidation and reduction reactions. Unit 
operations utilized are (1) evaporation, (2) adsorption, 
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(3) ion exchange, (4) reverse osmosis and (5) electrodialysis. 
Adsorbents used are activated carbon and polymers. 

Sludge treatment methods include (1) digestion, (2) con¬ 
ditioning, (3) thickening, (4) dewatering and (5) drying. 
Digestion may be aerobic or anaerobic, utilizing some of the 
methods already described. Conditioning is effected using 
chemical and thermal methods. Thickening maybe done in 
(1) gravity, (2) flotation or (3) centrifugal thickeners. Meth¬ 
ods of dewatering are (1) vacuum filtration, (2) filter press 
dewatering, (3) belt filter dewatering and (4) centrifugal 
dewatering. 

A11.15.4 Wet air oxidation 

For water contaminated by small amounts of organic com¬ 
pounds a method of treatment which is often attractive is 
the wet air oxidation (WAO) process, also referred to as wet 
combustion. Accounts are given by Flynn (1979), Wilhelmi 
and Knopp (1979), Laughlin, Gallo and Robey (1983), 
Baillod, Lamparter and Barna (1985), Heimbuch and 
Wilhelmi (1985), E.J. Martin and Johnson (1987) and 
Nemerow and Dasgupta (1991). 

The aqueous effluent to be treated is pumped to a high 
pressure, passed through a heater to heat it part way to the 
reaction temperature, then into a reactor vessel where 
compressed air is blown in and where the resultant exo¬ 
thermic reaction raises the liquid to its reaction tempera¬ 
ture, finally out through a cooler to a separator where the 
oxidized liquid is taken off the bottom and nitrogen, carbon 
dioxide, steam, etc., off the top. Typical reaction tempera¬ 
tures are in the range 275-320°C. There are numerous 
variations on this basic process, including the use of a 
catalyst. 

Wet air oxidation can degrade most industrial organic 
compounds. The reduction, or dilution, factors obtainable 
are generally good, though higher in some cases than 
others. Wilhelmi and Knopp list factors in the range 
12-4200. 

A11.15.5 Wastewater receivers 

Wastewater treated to a suitable quality may be discharged 
to the municipal sewage system, to watercourses such as 
streams or rivers, or to land. 

Some options available in principle are discharge of 
(1) raw industrial and sanitary wastes to the municipal 
system, (2) partially treated industrial and sanitary wastes 
to the municipal system, (3) completely treated industrial 
and sanitary wastes to the municipal system, partially 
treated industrial wastes to a watercourse, completely 
treated industrial wastes to a watercourse, and (6) com¬ 
pletely treated industrial wastes to land. These options are 
discussed in detail by Nemerow and Dasgupta (1991). 

A11.15.6 Deep well disposal 

A quite different option for dealing with liquid wastes is 
deep well injection. Accounts are given by M.E. Smith 
(1979) and Nemerow and Dasgupta (1991). 

This form of disposal has been used particularly in the 
United States, subject to strict controls and permitted only 
if no better method is available. 

The formation selected to receive the waste is one below 
the levels holding potable water. The basic technology used 
derives from oil and gas production. The receiving forma¬ 
tion may first be given a conditioning treatment. In order to 
eliminate solids, the waste is pretreated to remove sus¬ 
pended solids. In addition, a buffer solution such as dilute 


salt water may first be injected to prevent precipitation 
from the waste liquid. 

All. 15.7 Sludge disposal 

Methods of disposal of sludge from wastewater treat¬ 
ment include lagooning, landfill, incineration and sludge 
barging. 

Lagooning involves digestion and is in effect a treatment 
process which shades into storage or disposal. Landfill may 
take the form of area landfill or trench landfill. Incineration 
is considered below. 

Sludge barging has been used but tends to involve prob¬ 
lems of sludge rising to the surface or being washed ashore, 
and in many cases has been discontinued. 

All.16 Hazardous and Solid Wastes 

In addition to gaseous and liquid effluents, it is also 
necessary to deal with hazardous and solid wastes, 
including sludges and residues. 

Accounts of hazardous wastes and solid wastes, and the 
methods of waste disposal, are given in Disposal of Solid 
Toxic Wastes by Key (1970), Solid Wastes by Mantell (1975), 
Waste Recycling and Pollution Control by Bridgewater and 
Mumford (1979), Toxic and Hazardous Waste Disposal by 
Pojasek (1979), Handbook of Industrial Waste Disposal by 
Conway and Ross (1980), Design of Land Treatment Systems 
for Industrial Waste by Overcash and Pal (1980), Waste 
Management by Woolfe (1981), Hazardous Material Spills 
Handbook by G.F. Bennett, Feates and Wilder (1982), 
Hazardous Waste ProcessingTechnology by Kiang and Metry 
(1982), Risk Assessment of Hazardous Waste Sites by Long 
and Schweitzer (1982), The Scientific Management of 
Hazardous Wastes by Cope, Fuller and Willetts (1983), 
Handbook of Industrial Residues by Dyer and Mignone 
(1984), Hazardous Air Emissions from Incineration by 
Brunner (1985), Handbook of Laboratory Waste Disposal 
by Pitt and Pitt (1985), Hazardous Waste Management by 
Dawson and Mercer (1986), The Solid Waste Handbook by 
W.F. Robinson (1986). Hazardous Waste Management Engi¬ 
neering by E.J. Martin and Johnson (1987), Handbook of 
Hazardous Waste Incineration by Brunner (1989), Environ¬ 
mental Impacts of Hazardous Waste Treatment, Storage and 
Disposal Facilities by Salcedo, Cross and Chrismon (1989), 
Emerging Technologies in Hazardous Waste Management by 
Tedder and Pohland (1990), Environmental Pollution and 
Control by Veselind, Peirce and Weiner (1990), Hazardous 
WasteTreatmentTechnologies byjackman and Powell (1991), 
Industrial and Hazardous Waste Treatment by Nemerow and 
Dasgupta (1991), Environmental Impact Assessment for 
WasteTreatment and Disposal Facilities by Petts and Eduljee 
(1994) and Standard Handbook for Solid and Hazardous 
Waste FacilityAssessmenfby Sara (1994). 

A11.16.1 Types of hazardous and solid waste 

Hazardous and solid wastes fall into three categories 
(1) hazardous liquid wastes, (2) hazardous solid wastes and 
(3) non-hazardous solid wastes. The main concern here is 
with the first two of these. 

A11.16.2 Hazardous waste control 

The principles of waste minimization should be applied to 
minimize the quantity of hazardous waste and to ease the 
problems of handling it in treatment, storage and disposal 
facilities. 
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A11.16.3 Hazardous waste treatment, 
storage and disposal 

Hazardous wastes may be stored or sent to ultimate dis¬ 
posal, either with or without prior treatment. 

Methods of dealing with solid hazardous wastes include 
the use of (1) incineration, (2) landfill, (3) waste piles and 
(4) storage. Incineration, landfill and land treatment, which 
are usually treated as methods of ultimate disposal, are 
discussed further below. 

A waste pile, or tip, may be regarded as storage or dis¬ 
posal, depending on the acceptability of its being perma¬ 
nent. Storage proper is typically in drums. 

There are a number of methods of stabilization, fixation, 
solidification and encapsulation available for the treatment 
of residues and sludges, many developed originally for 
radioactive wastes. An account is given in E.J. Martin and 
Johnson (1987). 

For liquid hazardous wastes methods include the use of 
(1) incineration, (2) surface impoundment, (3) land treat¬ 
ment and storage. Incineration and land treatment are both 
methods of ultimate disposal. 

Surface impoundment (SI) or lagooning, has been dis¬ 
cussed above. The liquid may be aerated or non-aerated. As 
stated, a lagoon may be regarded as a form intermediate 
between treatment, storage and ultimate disposal. 

Storage is mainly in storage tanks, which may be open, 
open with external floating roof, closed with fixed roof and 
closed with internal floating roof. The vapour space may be 
inerted. 


A11.16.4 Incineration 

A prime method of dealing with hazardous waste is incin¬ 
eration. It is used for solid, liquid and sludge or residue 
wastes. 

Treatments of incineration are given in Handbook on 
Incineration by Cross (1972), Incineration by Brunner 
(1987) and Handbook of Hazardous Waste Incineration by 
Brunner (1989) and by Novak and Pfrommer (1982), 
Grumpier and Martin (1987), Wiley (1987),Vervalin (1990), 
Veselind, Peirce and Weiner (1990) and Nemerow and 
Dasgupta (1991). Particular aspects of incineration dis¬ 
cussed are the decision whether or not to use incinera¬ 
tion by Haseltine (1992), testing of incinerators by Monroe 
(1983b), off-normal emissions from incinerators by Zeng 
and Okrent (1991), problems with incinerators by Ready 
and Schwab (1980), role of incineration in remedial 
actions by H.M. Freeman (1984) and dioxin problems by 
Beychok (1987). Plasma arc incineration is described by 
Ondrey and Fouhy (1991). 

Incineration is a preferred method of the EPA. 

Incineration is commonly carried out in dedicated 
equipment. Types of incineration equipment are described 
by Novak and Pfrommer (1982) and Brunner (1989). Alter¬ 
natively, in some instances items of process plant may be 
used as incinerators. Feeley (1984) describes the use of 
boilers for this purpose. 

Incineration of solid wastes is done in open pits, rotary 
kilns and multiple hearth furnaces. 

Ideally, the products of combustion from an incinerator 
are carbon dioxide and water vapour. In practice, the gas¬ 
eous effluents may contain more noxious gases due to 
(1) incomplete combustion and (2) components in the waste. 
Some effluents which are troublesome in incinerators 
include sulfur and nitrogen oxides, metals and dioxins. 


There are three main factors which determine the 
completeness of combustion: time, turbulence and 
temperature - the three Ts. The first two are set by the 
design of the system, leaving only the temperature as an 
operating variable. The temperature is controlled by 
adjusting the air/fuel ratio. 

If the effluent gas falls below the concentration at which 
it can sustain combustion before destruction is sufficiently 
complete, one option may be to use an afterburn by inject¬ 
ing additional fuel gas. Alternatively, it may be necessary 
to pass the effluent gas through a scrubber. Thus an incin¬ 
erator produces both gaseous effluent and ash, and may 
produce a liquid effluent also. 

Combustion products which have proved particularly 
troublesome are the dioxins, notably TCDD. TCDD is a 
product in virtually all combustion processes, including 
barbecues. The production of TCDD at incinerators has 
been the subject of much concern. Controls are such that 
operators are required to keep the concentration of TCDD 
measured in the adjacent area vanishingly small. 

Incineration has the advantages that it is an established 
process, can handle a wide range of wastes, can accept high 
throughputs and is economical in its requirement for land, 
especially relative to landfill. Disadvantages are the com¬ 
paratively high cost and the effluents generated. 

Hazardous wastes in sludge form are incinerated in 
rotary kilns, fluidized beds and multiple hearth furnaces. 

Incineration is also practised for liquid wastes, provided 
they are at least partially combustible. A liquid waste may 
be categorized as combustible, partially combustible or 
non-combustible. A waste with a calorific value below 
about 18,500 kj/kg is regarded as only partially combus¬ 
tible. Where the properties allow, liquid wastes are gen¬ 
erally injected through an atomizer. 

A11.16.5 Landfill 

Another principal method of disposing of hazardous waste 
is landfill (LF). This involves depositing the hazardous 
waste on land which is then covered over. Both area and 
trench systems are used. 

Accounts of the landfill option are given in Landfill 
Technology by Crawford and Smith (1985) and by A. Parker 
(1982), G.W. Dawson (1983), J.B. Cook (1984), Loehr (1987), 
Veselind, Peirce and Weiner (1990) and Nemerow and 
Dasgupta (1991). 

The main problem with landfill is the leaching out of 
hazardous substances and transport of these into water¬ 
courses. Leachate management is therefore essential if 
landfill is used. 

This aspect is discussed in Groundwater Contamination 
from Hazardous Wastes by E.F.Wood (1984) and by Hoppe 
(1984a), Shuckrow, Touhill and Pajak (1987), Ahlert and 
Kosson (1990) and Batchelor (1990). 

There are a number of options for dealing with leachates. 
The first should be the application of waste minimization 
to eliminate or reduce potential leachates. The site can 
be designed to minimize the generation and escape of 
leachates, which includes diversion of surface waters and 
provision of barriers such a liners and trenches. Leaching 
may be reduced and/or leachate treatment simplified by 
segregation of wastes. Stabilization methods may be used 
to minimize leaching. The leachates may be collected and 
treated. 

Economic estimates generally show landfill to be appre¬ 
ciably cheaper than incineration but the potential for 
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migration of leachates into watercourses can be a serious 
problem which may well alter the balance of advantage. 

A description of an landfill project associated with the 
chemical industry is given by Anon. (1988k). 

A11.16.6 Land treatment 

Land treatment involves spraying the liquid on land, 
exploiting the assimilative capacity of the soil. 

Accounts are given in Design of Land. Treatment Systems 
for Industrial Wastes by Overcash and Pal (1980) and by 
Loehr (1987) and Nemerow and Dasgupta (1991). 

A11.16.7 Contract disposal 

The producer of hazardous wastes often has the option of 
having them removed by a specialist contractor. Given the 
number and severity of problems often arising with such 
wastes, this can be an attractive option. 

The main point to be made here is that regulatory con¬ 
trols are now such that there is a responsibility of the pro¬ 
ducer to ensure that the wastes are properly disposed of. 
The producer who hands over the wastes to a ‘cowboy’ 
contractor can expect trouble. 

A11.16.8 Hazardous waste facility siting 

A hazardous waste treatment, storage and disposal facility 
is liable to pose a more serious siting problem than the 
generality of process activities. In the United States more 
than half the applications for such developments fail. An 
account of the siting problem of TSDFs, with emphasis on 
the public consultation process, is given by Barclay (1987). 

A11.16.9 Hazardous waste facility management 

A hazardous waste facility needs to be managed. Incinera¬ 
tion, landfill and storage all involve their characteristic 
management problems. 

Active management is required of the basic activity and 
of the monitoring of effluents from the treatment processes, 
of spills and other escapes, and of the concentrations of 
chemicals in the immediate environment. 

For landfill, leachate management assumes particular 
importance. An account is given by Shuckrow,Touhill and 
Pajak (1987). 

A11.16.10 Hazardous waste facility reclamation 

In the past hazardous waste was frequently deposited in an 
uncontrolled manner, with the consequence that many 
countries have a large number of waste disposal sites, 
which present major problems in establishing owner¬ 
ship and responsibility, reasserting control and effecting 
reclamation. 

Accounts of land decontamination and reclamation are 
given in Reclamation of Contaminated Land by the SCI 
(1980), Remedial Action Technology for Waste Disposal Sites 
by Rogoshenski, Boyson and Wagner (1983) and by Wagner 
etal. (1986), Evaluation of Remedial Action Unit Operations 
at Hazardous Waste Disposal Sites by Ehrenfeld and Bass 
(1984), Contaminated Land: Reclamation and Treatment by 
M.A. Smith (1985), Dioxin Containing Wastes: Treatment 
Technologies by Arienti et al. (1988), Environmental 
Remediation by Vandegrift, Reed and Tasker (1992) and 
Remedial Processes for Contaminated Land by Pratt (1993). 

As described earlier, under CERCLA1980, or Superfund, 
the EPA is charged with supervision of site clean-up and 
federal funds are available for this. An account is given in 
Superfund Handbook by Sidley and Austin (1987). 


All. 16.11 Ocean dumping and incineration 

A quite different solution to the waste disposal problem is 
to dump or incinerate the waste at sea. 

Accounts of these options are given in Ocean Dumping of 
Industrial Wastes by Ketchum, Kester and Park (1981) and 
Ocean Disposal Systems for Sewage Sludge and Effluent by 
the NRC (1984) and by Finnecy (1982), Remirez (1982), 
Crumpler and Martin (1987), Ditz (1988) and Nemerow and 
Dasgupta (1991). 

Essential safeguards in any system of ocean dumping 
are those substances which are highly toxic and persistent 
and do not disperse sufficiently are not dumped and that 
for those materials which are the assimilative capacity of 
the area should not be overloaded. 

Vessels used for ocean incineration include Matthias I, II 
and HI, Vesta and Vulcanus. Of these the MT Vulcanus, 
a cargo ship converted in 1972 into a chemical tanker with 
two large incinerators, is perhaps the best known and 
documented. These incinerator vessels are described by 
Finnecy (1982). 

Both ocean dumping and ocean incineration are gov¬ 
erned by the marine pollution conventions.The Convention 
for the Prevention of Marine Pollution by Dumping of 
Wastes and Other Matter 1972 (the London Dumping Con¬ 
vention (LDC)) governs ocean dumping, and provisions on 
ocean incineration have been added to this. 

A review of the operation of this convention is given by 
the IMO (1991IMO-532). The unregulated dumping which 
used to take place has largely stopped, the dumping of cer¬ 
tain wastes has been eliminated altogether or is being 
phased out and stringent programmes are in place to assess 
the need for and impact of ocean disposal. 


All. 16.12 Underground storage tanks 

It is convenient at this point to mention briefly the problem 
of leaking underground storage tanks (USTh) and pipe¬ 
work. The use of underground storage is widespread but in 
recent years there has been growing concern, particularly 
in the United States, over leaks from such installations. 
Accounts are given by G. Parkinson (1987) and Stone 
(1987). 

Underground storage tanks are considered in Chapter 22. 


All.17 Fugitive Emissions 

Fugitive emissions occur on process plants from diffuse 
continuous sources such as valves, seals and flanges; from 
equipment which operates intermittently such as pressure 
relief valves; from the ‘breathing’ of storage tanks; and from 
activities such as draining and sampling and the opening 
up of equipment during operations or for maintenance. 

Accounts of fugitive emissions are given in Fugitive 
Emissions of Vapour from Process Plant Equipment by the 
BOHS (1984 TG3) and Health Hazard Control in the Process 
Industries by Lipton and Lynch (1987). 

The topic of fugitive emissions can be considered under 
the following heads: (1) emission sources, (2) emission con¬ 
trol, (3) occupational health effects and (4) environmental 
effects. 

Fugitive emission sources, emission control and occupa¬ 
tional health aspects are discussed in Chapters 15,12 and 
18, respectively. 

The environmental effect which initiated concern over 
fugitive emissions was smog, originally in Los Angeles. 
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The EPA has been active to reduce fugitive emissions, as 
instanced by Compilation of Air Pollutant Emission Factors 
(EPA, 1973), VOC Fugitive Emissions in Synthetic Organic 
Chemical Manufacturing Industry — Background Informa¬ 
tion for Promulgated Standards (EPA, 1982) and Standards 
of Performance for New Stationery Sources Equipment 
Leaks of VOC, Petroleum Refineries and Synthetic Organic 
Chemical Manufacturing Industry (EPA, 1984). 

All.18 Odours 

Another form of pollution is noxious odours. The con¬ 
centration at which a substance can cause an odour can be 
very low, and certainly well below the levels of the air 
quality standards set to prevent air pollution. 

Accounts of odours and their control are given in Meth¬ 
ods of Air Deodorisation by Summer (1963), Odour Pollution 
of Air by Summer (1971), Human Response to Environmental 
Odors by Turk, Johnston and Moulton (1974) and Odour 
Control by Valentin and North (1980) and by Oelert and 
Florian (1972), Amoore and Hautala (1983), Ruth (1986), 
Langenhove, Lootens and Schamp (1988), Miedema and 
Ham (1988), Valentin (1990), Nagy (1991), A.M. Martin etal. 
(1992) and Sober and Paul (1992). 

A11.18.1 Regulatory controls 

Regulatory controls on odours are at present fairlyru- 
dimentary. In the UK, odours are statutory nuisances under 
the EPA 1990 and subject to control by the local authorities. 

In the USA the Clean Air Amendments 1990 provide a 
framework within which controls on industrial odours may 
develop. 

In the Netherlands, the authorities have taken initiatives, 
described below, aimed at putting odour control on a more 
scientific basis. 

All.18.2 Odour-generating activities 

Many of the activities which give rise to noxious odours lie 
outside the mainstream process industries, being such as 
agricultural activities; animal waste rendering and leather 
tanning; fishmeal processing; sewage and effluent treat¬ 
ment and sludge disposal; brickmaking; and so on. How¬ 
ever, petroleum refining and chemical manufacture do 
generate odours as do coke ovens and tar distillation; pulp 
and paper processing; plastics and rubber processing; soap 
and detergent manufacture; and fermentation processes 
associated with brewing or pharmaceutical manufacture. 

A11.18.3 Odour measurement 

A fundamental approach to odour measurement would 
appear to require that (1) the components responsible for 
the annoyance are identified, (2) their concentrations are 
measured and (3) their contributions, severally and pos¬ 
sibly in combination, are quantified. This is a tall order. It 
is not surprising therefore that the most practical way of 
measuring an odour is still the human nose. 

The method commonly used is to assemble an odour 
panel of suitably selected individuals and to use the tech¬ 
nique of dynamic dilution. This involves diluting the 
original sample containing the odour with progressively 
larger quantities of clean air until 50% of the panel can no 
longer detect the odour. The results obtained are sensitive 
to the experimental conditions and can vary by a factor of 
10 or more. 


The concentration at which the odour is no longer 
detectable to 50% of the panel is designated as one odour 
unit (ou). The number D of dilutions required to get down to 
this concentration is a measure of the odour concentration 
of the original sample. Thus if dilution by a factor of 2000 is 
required (D= 2000), the odour concentration of the sample 
is 2000 ou. 

A11.18.4 Odour thresholds 

There are available a number of compilations of odour 
thresholds. They include the collections in Standardised 
Human Olfactory Thresholds by Devis (1990) and by 
Leonardos, Kendall and Barnard (1969), Amoore and 
Hautala (1983) and Ruth (1986). 

A11.18.5 Odour sources 

Odour sources may take the form of point sources, area 
sources, line sources or fugitive emissions. An area source 
is exemplified by an open tank containing liquid and a line 
source by a works transport route. A discussion of such 
sources is given by Sober and Paul (1992). 

Fugitive emission sources, with typical emission rates, 
are listed in EPA AP-42 Compilation of Air Pollutant 
Emission Factors (1985). 

All. 18.6 Odour dispersion 

The dispersion of an odour may be modelled using passive 
gas dispersion models, which are described in Chapter 15. 

The use of such models is discussed by Sober and Paul 
(1992). They refer in particular to the various EPA models 
such as ISC and Inpuff. 

Models specific to odours, developed at Warren Spring 
Laboratory (WSL), have been described by Valentin and 
North (1980) and Valentin (1990). For short-range disper¬ 
sion from a ground level source, the following simplified 
relation provides a rough guide: 

Dr = 7E/UX 2 [All.18.1] 

E = D C F [All.18.2] 

where D e is the odour concentration at the emission point 
(ou), D r is the odour concentration at the receptor point (ou), 
E the contaminant, or odour, emission flow (m 5 /s), F the 
total emission flow (m 3 /s), U the wind speed (m/s) and X 
the distance between the emission and receptor points (m). 

Other WSL models relate to the distance at which com¬ 
plaints can be expected. For ground level emissions 

dm ax = (<pE) 0 ' 6 [All.18.3] 

with 

E = DF [All.18.4] 

where d max is the maximum distance at which complaints 
can be expected (m), D the dilution factor (ou) and <j> a fac¬ 
tor. The value of <j> is 2.2, which is the geometric mean of the 
uncertainty range 0.7-7. The equation can be used for 
emissions for chimneys provided that d max is 40—50 times 
the effective chimney height. 
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An equation is also given for the effective chimney 
height for nuisance-free dispersion: 

Hq = (i l>Ef s [All.18.5] 

where H e is the effective chimney height (m) and i j/ a factor. 
The value of ip is 0.1, which is close to the geometric mean 
of the uncertainty range 0.05-0.15. The actual chimney 
height is obtained by subtracting the plume rise from the 
effective chimney height. 

The last two equations encompass not just dispersion 
but also human response. The ability to correlate the com¬ 
plaints distance, albeit with a wide uncertainty range, by 
extrapolation from panel experiments to field assessments 
on the basis of the dilution factor D is encouraging for the 
development of a generalized approach. 

A11.18.7 Odour control strategy 

The outline of an odour control strategy is given by Valentin 
(1990). A necessary preliminary is to establish that it really 
is your plant which is the source of the problem. The odour 
sources should be identified. If practical, an odour source 
should be eliminated. For those which are not eliminated, 
ventilation, local where possible, should he used to remove 
and collect the contaminated air. If the air stream contains 
mist or dust, these should be removed. This air should then 
be treated using one of the methods described below. 

A11.18.8 Odour control techniques 

There are a number of methods available for treating air 
containing air contaminated with odours. Accounts are 
given by Valentin (1990) and A.M. Martin et al. (1992). 

Martin et al. describe a wide range of techniques, 
including (1) incineration, (2) adsorption, (3) absorption, 
(4) condensation, (5) advanced oxidation and (6) biological 
treatment. Incineration may be carried out in a thermal 
incinerator, a catalytic incinerator, a flare, a boiler or a 
process heater. Adsorption is commonly by carbon. 
Advanced oxidation involves treatment with an oxidizing 
agent such as ozone using UV radiation to effect photo¬ 
chemical stimulation of the reaction. Biological treatment 
may be by a biological scrubber or a biological filter. The 
authors give examples of the efficiencies obtained with the 
different methods and guidance on selection of a method. 

The options available are also discussed by Valentin, 
who deals in particular with thermal and catalytic incin¬ 
eration, adsorption, absorption and biological filters. 

All.18.9 Odour impact on community 

Studies of the impact of odours on the neighbouring com¬ 
munity have been described by van Langenhove, Lootens 
and Schamp (1988) and Miedema and Ham (1988). 

The former study involved the investigation of odour 
from an animal rendering plant. A questionnaire was used 
to assess the proportion of persons annoyed by the odour at 
different distances. The effective limit of the nuisance was 
found at about 600 m. The authors then used a passive gas 
dispersion model to work back to the effective strength of 
the source, which they assessed as 68 x 10 s ou/h. 

Miedema and Ham describe field studies conducted by 
TNO in support of Dutch government plans for odour con¬ 
trol. The authors emphasize the importance of the method 
used to assess the dilution factor D. They describe and 
advocate the use of theTNO ‘sniffing car’ method. 


These authors too made use of a questionnaire to deter¬ 
mine the relation between the distance and the proportion 
of persons annoyed by the odour. They correlate their 
results in terms of the Cg 8 value, or the 1 hour average con¬ 
centration which is exceeded only 2 % of the year, and of the 
probability of being annoyed, expressed as a Z score, from 
the normal distribution, and obtain the relation 

Z = 1.19 logCgg- 2.16 [All.18.6] 

They suggest that a correlation of this type has potential 
as the basis for standards for odour control. 

All.19 Transport 

A proportion of the chemicals produced are consumed on 
site, but a large proportion are transported from the site. 

The transport of chemicals is discussed in Chapter 23 
and emergency planning for such transport in Chapter 24. 

Such transport, whether by vehicle or a pipeline, has the 
potential for an accident resulting in a spill. Spills are dis¬ 
cussed in the following section. 

Al 1.19.1 Transport of hazardous wastes 

There is also the separate question of the transport of 
hazardous wastes. This has been a severe problem area due 
to the prevalence of illicit practices in transport and dis¬ 
posal, described in Laying Waste by M. Brown (1981). The 
transport of hazardous wastes, and of material from spill 
incidents, is discussed by R.J. Buchanan (1982), Bromley 
and Finnecy (1985) and Colen (1987b). 


All.20 Spills 

Another way in which pollution can occur is by a liquid 
spill, either at a fixed site or during transport, including by 
pipeline. 

Spills are treated in Hazardous Chemicals - Spills and 
Waterborne Transportation by Weidenbaum (1980) and 
Hazardous Material Spills Handbook by G.F. Bennett, Feates 
and Wilder (1982) and by Lindsey (1975) and Feates (1978). 

The variety of situations which can occur and of the 
responses are illustrated in the numerous case histories 
described in the conference series National Conference on 
Hazardous Materials Spills in the United States. 

In the United States, hazardous materials spills involve 
several agencies, including the DOT, the EPA and the 
FEMA, as reflected in the guidance published for the EPA 
in Manual for the Control of Hazardous Material Spills by 
Huibregtse et al. (1977), in Emergency Guide for Selected 
Hazardous Materials by the DOT (1978) and for FEMA in 
Planning Guide and Checklist for Hazardous Materials Con¬ 
tingency Planning by Gunderloy and Stone (1980). 

All.20.1 Types of spill 

Some principal types of spill are those from (1) process 
plant or storage, (2) pipeline, (3) road tanker, (3) rail tank 
car, (5) barge, (6) ship and (7) drilling rig or fixed produc¬ 
tion platform. 

A spill within the works occurs in a relatively controlled 
environment, but this is less true of one in transport. 

A liquid spillage on land poses a threat to land and to 
watercourses. It is characterized by the facts that the 
release is transient and generally relatively limited in 
volume but often noxious. 
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Liquid spilled into a stream can cause a degree of pollu¬ 
tion which kills off much of the aquatic life so that a long 
period elapses before recovery can occur. 

A11.20.2 Response to spills onto land 

If a spill occurs on land, there are a variety of measures 
which can be taken. A review is given by Scholz (1982), who 
considers the problem under the heads of (1) termination of 
discharge, (2) containment to prevent entry into water¬ 
courses and (3) recovery and treatment. 

Chemical and physical measures are discussed by 
Eckenfelder (1982) who covers (1) neutralization, (2) sedi¬ 
mentation, (3) coagulation, (4) precipitation, (5) carbon 
adsorprtion, (6) ion exchange, (7) oxidation-reduction 
reactions and (8) biodegradation. A fuller account of bio¬ 
logical measures is given by Armstrong (1982). 

The EPA has developed a number of items of equipment 
for dealing with spills, including a portable foam diking 
system, a mobile physical-chemical treatment unit, a port¬ 
able sedimentation tank, a mobile incineration system and 
a mobile soil decontamination system. The foam diking 
system can be used to restrict the flow of a liquid over 
asphalt or concrete or to plug drains to prevent liquid from 
entering. These and other devices are described Freestone 
and Brugger (1982), in an account of EPA development 
work on spill control technology, and also by Scholz. 

Accounts of specific techniques and devices for dealing 
with hazardous material spills include those on physical 
barriers by Friel, Hiltz and Marshall (1973), sorbents by 
Melvoid and Gibson (1988), a mobile treatment system by 
M.K. Gupta (1976), a mobile incineration system by Tenzer 
et al. (1979), groundwater protection by Huibregtse and 
Kastman (1981), in situ detoxification of soil by Huibregtse, 
Lafornara and Kastman (1978) and soil reclamation by 
Wentzel etal. (1981). 

Al 1.20.3 Response to spills into streams 

If a spill occurs which threatens a stream may be possible to 
prevent it from entering the stream, but once it does the 
measures which can be taken are generally limited. 

Strategies for dealing with spills into streams have been 
described by G.W. Dawson and co-workers (Dawson, 
Shuckrow and Mercer, 1972; Dawson, 1975; Dawson and 
Parkhurst, 1976; Dawson and McNeese, 1978). 

One approach is stream diversion. The EPA has devel¬ 
oped a portable stream diversion system capable of 
bypassing 0.35 m 3 /s a distance of 300 m. 

Accounts are given by Lafornara (1982) of stream sam¬ 
pling and analysis, by Nadeau (1982) of bioassay and by 
Kontaxis and Nusser (1982) of dispersion modelling. 

All.20.4 Response to oil spills 

Methods for the control of oil spills have been published by 
CONCAWE. They include a manual on inland oil spill 
cleanup (CONCAWE 1981 7/81), disposal techniques for 
spilt oil (CONCAWE 1980 9/80), protection of ground-water 
from oil pollution (CONCAWE 1979 3/79), strategies for the 
assessment of biological impacts of large oil spills on 
European coasts (CONCAWE 1985 5/85), and field guides 
to inland oil clean-up (CONCAWE 1983 10/83), coastal 
waters clean-up (CONCAWE 1981 9/81) and oil spill 
dispersal (CONCAWE 1988 2/88). 

Al 1.20.5 Ultimate disposal of spilled material 

Ultimate disposal of spilled material is considered by 
Lindsey (1975), R.J. Buchanan (1982), Novak and Pfrommer 


(1982) and A. Parker (1982). The options described by these 
authors are primarily incineration and landfill. 

A11.21 Marine Pollution 

Pollution of the seas occurs by discharges made following 
cleaning of tanks of oil tankers and as a result of accidental 
spillages from oil tankers and chemical carriers. 

Pollution may occur as the result of illicit discharges or 
as the result of an accident. Most of the incidents which 
have hit the headlines have occurred after the ship has run 
aground. 

Accounts of sea pollution are given in Oil Pollution of the 
Sea and Shore by WSL (1972), Accidental Oil Pollution of the 
Sea by the DoE (1976), Marine Pollution by R. Johnston 
(1977) and Pollutant Transfer and Transport in the Sea by 
Kullenberg (1982), Poisoners of the Sea by Goudray (1988) 
and Marine Pollution by R.B. Clark (1993) and of pollution 
criteria in Pollution Criteria for Estuaries by Helliwell and 
Bossanyi (1975). 

The WSL publication records experience gained as a 
result of the pollution mitigation activities following the 
Torrey Canyon disaster. 

A11.22 Pollution Incidents 

Incidents involving pollution occur both from fixed instal¬ 
lations and in transport and over varying timescales. 

Al 1.22.1 Incident databases 

The SRD operates the Environmental Data Service EnvI- 
DAS which complements its other databases MHIDAS for 
major hazard incidents and EIDAS for explosion incidents. 

In addition, the account of an incident in a hazards 
database frequently includes some information on envi¬ 
ronmental effects. 

Al 1.22.2 Air pollution 

Air pollution incidents tend to take the form of (1) a sudden 
large release, (2) a regular lower level release which is 
aggravated by an unusual weather condition or (3) a regular 
practice of lower level release which is found to be dam¬ 
aging the environment. 

An example of a sudden large release is that at Seveso, 
described in Appendix 3. 

Al 1.22.3 Smog incidents 

At the end of October 1948, a heavy smog developed in 
inversion conditions in the industrial town of Donora, 
Pennsylvania. After several days conditions became such 
that 17 died within one day; a further 4 succumbed before 
the smog abated. 

The worst smog incident recorded was the ‘killer smog’ 
in London in 1952. Again a heavy smog developed in 
inversion conditions. The concentration of sulfur dioxide 
rose to some seven times its normal level. The maximum 
mean daily concentration of the gas in Central London 
reached 3500pg/m 3 . Two days into the incident the death 
rate began to soar. The number of excess deaths was esti¬ 
mated at about 4000. 

Al 1.22.4 Bonnybridge 

An example of the problems attendant on incineration is 
provided by the travails of Rechem, a company involved in 
the incineration of hazardous wastes. During the 1980s, the 
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incinerators which it operated included one at Bonnybridge 
in Scotland and one at Pontypool in Wales. At Bonnybridge 
there were complaints from the public and cattle nearby 
suffered from an unexplained sickness. Tests did not con¬ 
firm excessive levels of contamination, but the plant was 
closed. The company had further troubles in its relations at 
Pontypool, though again numerous independent surveys 
failed to find concentrations of contaminants above the 
background levels. 

A11.22.5 Watercourse pollution 

Watercourse pollution incidents tend to take the form of 
(1) a sudden large release, (2) a temporary but appreciable 
increase in the quantity or concentration of a regular 
release or (3) a regular practice of lower level release which 
is found to be damaging the environment. 

A11.22.6 Schweizerhalle 

On 1 November 1986, a fire in a agrochemical warehouse at 
Schweizerhalle in Basel, Switzerland, broke out and was 
extinguished with large quantities of fire water, which 
became contaminated and then found its way into the 
Rhine, causing serious pollution. The incident is described 
in Case History A113. 

All.22.7 Minimata 

Discharge of mercury compounds in Minimata Bay in 
Japan led to severe pollution and to the Minimata mercury 
poisoning disaster. For some 15 years prior to 1953, the 
Chisso Chemical Company had been discharging mercury 
catalyst into the bay. People fell ill, at first in small and then 
in increasing numbers. In 1957, a ban was placed on fishing 
in the bay. Of 116 officially recorded cases in 1958, 43 had 
died. By 1972, the official list of victims was almost 300. 

A11.22.8 Hazardous waste pollution 

Hazardous waste tends to give rise to developing problems 
at hazardous waste facilities rather than to incidents as 
such. However, incidents can arise such as those due to 
serious malpractice in transport of such wastes. 

Accounts of hazardous waste problems and incidents are 
given in Laying Waste by M. Brown (1981) and World of 
Waste by Goudray (1992). 

A11.22.9 Love Canal 

The scale of the environmental disaster which may result 
from waste disposal is illustrated by the case of Love Canal. 
In 1953, this site was sold by the Hooker Chemical Com¬ 
pany to the Niagara Falls education authority for a nominal 
sum. For over a decade the site had been used to dump 
chemical wastes. In 1976, local residents began to complain 
of odours and other nuisance. Concern escalated, leading to 
the relocation of 238 families and causing the President to 
declare the site a national environmental emergency, mak¬ 
ing it thereby eligible for federal clean-up funds. 

There were numerous damage suits. In support of its suit 
against the company, the Justice Department commis¬ 
sioned a chromosome study of 36 residents; the study 
proved controversial. 


The engineering measures taken to render the site safe 
are described by Glaubinger, Kohn and Remirez (1979). 

All.22.10 Land spill pollution 

Incidents involving PCBs are described by A.J. Smith 
(1982), others involving pesticides by Frisbie (1982) and one 
involving phenol by A. Shepherd (1982a). 

The Seveso incident, in which a large area of land was 
contaminated withTCDD, is described in Appendix 3. 

A11.22.11 Sea pollution 

Sea pollution incidents which tend to have particularly 
serious consequences are groundings of tankers on coasts. 
The three cases given below are all of this kind. Pollution of 
the sea also occurs from oil production activities, as 
described in Appendix 18. 

A11.22.12 Torrey Canyon 

On 18 March 1967, the tanker Torrey Canyon, carrying 
114,000 tons of crude oil, ran aground on the coast of 
Cornwall, releasing 30,000 tons of oil. Over the next 7 days 
a further 20,000 tons escaped. On 26 March the ship broke 
its back with release of another 50,000 tons. Following this, 
the ship was bombed to burn the remaining 20,000 tons and 
the oil slick was sprayed with detergent to disperse it. 

All.22.13 Amoco Cadiz 

On 16 March 1978, the oil tanker Amoco Cadiz lost its 
steering and ran aground at Portsall on the Brittany coast. 
The resulting oil spill polluted some 200 km of coastline, 
causing an incident which at the time was the worst to have 
occurred. 

A11.22.14 Exxon Valdez 

On 24 March 1989, the tanker Exxon Valdez ran aground 
near Valdez, Alaska, rupturing eight cargo tanks and 
releasing some 258,000 bbl of oil. The result was a major 
environmental disaster. 

All.23 Notation 

Section All. 18 

G) g 1-h average concentration exceeded only 2% of 
the year 

d max maximum distance at which complaints can be 
expected (m) 

D dilution factor (ou) 

D e odour concentration at emission point (ou) 

D r odour concentration at reception point (ou) 

E contaminant, or odour, emission flow (m 3 /s) 

F total emission flow (nr/s) 

H e effective chimney height (m) 

U wind speed (m/s) 

X distance between emission point and 

reception point (m) 

Z score value 

4> factor 

i ]/ factor 
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The environment may be degraded not only by chemical 
pollution but also by noise. Process plant contains a variety 
of noise sources covering rotating equipment, piping, com¬ 
bustion equipment and vents to atmosphere. Noise from 
process plant sources may affect workers from the perspec¬ 
tive of noise induced hearing loss and the general public 
through environmental or community noise impacts. The 
control of noise from process plants needs to be controlled 
and noise control design needs to be an integral part of the 
engineering and planning for any process facility. 

Accounts of noise, noise effects on humans and noise 
control are given in the following references: 

• Handbook of Noise Control by C.M. Harris (1957), 

• Handbook of Noise Measurement by A. Peterson and 
Gross (1967), 

• Noise and Vibration Control by Beranek (1971), 

• Noise and Hearing Conservation Manual by Berger etal. 
(1986 AIHA/11), 

• Engineering Noise Controlby Bies and Hansen (1988), 

• Woods Practical Guide to Noise Controlby Sharland (1990), 
. Noise and Health by Fay (1991ACGIH/70) and 

• Noise and Vibration Control Engineering by Beranek and 
Ver (1992). 

• Code of Practice for Reducing the Exposure of Employed Per¬ 
sons toNoiseby the DoE (1972/1) (the DoE Noise Code). 

A12.1 Regulatory Controls 

Regulations applicable to noise levels within an industrial 
facility are intended to protect employees from noise-induced 
hearing loss. The regulations are usually based on an 
employee noise exposure limits (e.g. 85 dB(A) averaged over 
8 h). The regulations normally allow for exposure to higher 
noise levels for reduced time periods and mandate the use of 
hearing protection if necessary. This allows the employees’ 
averaged noise exposure level to remain below the safe limits. 

Applicable regulations for the UK/EEC and USA would 
include the following: 

• EEC Machinery Directive - ‘Noise at Work Directive’, 
86/188/EEC and ‘Machinery Directive’, 89/392/EEC. 

• UK Noise at Work Regulations 1989. 

• USA OSHA regulation - USA Code of Federal Regula¬ 
tions Title 29 Part 1910.95 

Typically these regulations set a series of action levels 
based on employee noise exposure levels as follows: 

(1) First Action Level - daily personal noise exposure 
exceeds 85 dB(A) 

• Employer is responsible for initiating a hearing 
conservation programme and having noise 
assessment made by a competent person. 

• Employer is required to reduce the risk of hearing 
damage from exposure to noise to the lowest level 
reasonably practicable. 

• Appropriate hearing protection should be avail¬ 
able to the employee on request. 

(2) Second Action Level - daily personal noise exposure 
of 90 dB(A) 

• Appropriate hearing protection must be made 
available to all persons exposed. 

• Employer must reduce noise as far as reasonably 
practicable. 


• Other requirements include assessment records 
and audiograms, designated ear protection zones, 
training on maintenance and use of equipment and 
provision of information to employees and infor¬ 
mation to employees. 

The following International Institute of Noise Control 
Engineering (I-INCE) Publication summarizes and com¬ 
pares employee noise exposure regulations for a range of 
countries worldwide: Technical Assessment of Upper 
Limits on Noise in the Workplace’ I-INCE Publication 94-1. 

Community or environmental noise impact must also be 
considered in plant noise control design. Noise limits set to 
control noise emissions outside of the plant are primarily 
intended to protect plant neighbours from noise-related 
annoyance or interference. In setting community noise 
limits, local regulations need to be considered together 
with assessments of likely community reaction to the 
increased noise levels. These issues also need to be con¬ 
sidered in the context of the Environmental Impact 
Assessment (EIA) for the project. 

Government regulations to control environmental noise 
vary greatly from country to country Typically regulations 
apply to particularly zoning areas or land use classifica¬ 
tions with different noise limits defined for specified day¬ 
time and night-time noise levels (e.g. residential, mixed 
residential/commercial, industrial etc.). These limits are 
forced to be generic and may not meet the specific require¬ 
ments of a plant location. An important point, which is 
often overlooked, is that compliance with community noise 
regulations does not ensure against community com¬ 
plaints. People will complain because they find the noise 
disturbing or annoying, not because it exceeds a govern¬ 
ment regulation. 

An EIA for a project would require the evaluation of the 
existing ambient noise levels in the proposed plant location 
and the predicted operational noise levels from the facility 
to assess the noise impact of the new plant. 

Applicable standards and references for environmental 
noise would include the following: 

• World Bank - 'Pollution Prevention and Abatement 
Handbook’ of 1998. 

• US Export Import Bank - Environmental Procedures’ 
1998. 

• ISO 1996-1:1982 ‘Acoustics Description and Measure¬ 
ment of Environmental Noise — Parti: Basic Quantities 
and Procedures’. 

• ISO 1996-2:1987 ‘Acoustics - Description and Measure¬ 
ment of Environmental Noise - Part 2: Acquisition of 
Data Pertinent to Land Use’. 

• ISO 1996-3:1987 ‘Acoustics - Description and Measure¬ 
ment of Environmental Noise - Part 3: Application to 
Noise Limits’. 

• UK Control of Pollution Act 1974. 

• UK Environmental Protection Act 1990. 

A12.2 Process Plant Noise 

The following organizations have a series of useful stan¬ 
dards and guidelines relevant to Process Plant Noise: 

• Engineering Equipment Material Users Association 
(EEMUA), 14-15 Belgrave Square, London, England 
SW1X8PS UK; Phone: 071-235-5316 



NOISE APPENDIX 1 2/3 


• CONCAWE, Madouplein 1, Brussels B-1030, Belgium; 
Phone: 32-2-220-3111 

• American Petroleum Institute, 1220 L Street, NW, 
Washington, DC 20005-4070; Phone 202-682-8000 

A12.3 Noise Control Terminology 

A summary of widely used noise control terminology is 
given below: 

• Audible Frequency Range 

The range of sound frequencies normally heard by 
the human ear. The audible range spans from 20 Hz to 
20 kHz, but for most engineering investigations only 
frequencies between 40 Hz and 11 kHz (i.e. 63 Hz to 8 kHz 
octave bands) are considered. 

• Background Noise 

The sound pressure levels in a given environment from 
all sources excluding a specific sound source being 
investigated or measured. 

• Decibels (dB) 

Ten times the logarithm (to the base 10) of the ratio of two 
mean square values of sound pressure, voltage or current. 

• Sound Pressure 

A dynamic variation in atmospheric pressure. The 
pressure at a point minus the static atmospheric pres¬ 
sure at that point (N/m 2 ). 

• Sound Pressure Level (L p ) 

The ratio, expressed in decibels, of the mean square 
pressure to a reference mean square pressure which by 
convention has been selected to be equal to the assumed 
threshold of hearing. 


Lp - 10 log 10 

where P = RMS sound pressure (N/m 2 ); P re f = 2x 
KT 5 N/m 2 . 

• Sound Intensity 

The rate of sound energy transmission per unit area in 
a specified direction (W/m 2 ). 

• Sound Intensity Level (L\) 

The rate of sound energy transmission per unit area in a 
specified direction related to a reference intensity level. 

L\ = 10 logioQy 

where L=RMS value sound intensity (W/m 2 ); 7 re f» 
1 x 10 -12 watts/m 2 . 

• Sound Power 

The total sound energy radiated by a source per unit 
time (W). 

• Sound Power Level (Lf) 

The acoustic power radiated from a given sound source as 
related to a reference power level, expressed in decibels. 

L„ = 101og 10 (^Q 


where W=RMS value sound power (W); W Ie fm 
lxl0“ 12 watts. 


• Octave Bands 

Frequency ranges in which the upper limit of each band 
is twice the lower limit. Octave bands are identified 
by their geometric mean frequency (center frequency). 
The table below shows the octave band upper/lower 
frequency limits. 


Octave band cut-off frequencies (Hz) 

Octave band 

Lower band 

Upper band 

center frequency 

limit 

limit 

31.5 

22 

44 

63 

44 

88 

125 

88 

177 

250 

177 

355 

500 

355 

710 

1,000 

710 

1,420 

2,000 

1,420 

2,840 

4,000 

2,840 

5,680 

8,000 

5,680 

11,360 

16,000 

11,360 

22,720 


• 1/3 Octave Bands 

Frequency ranges where each octave is divided into 
one-third octaves with the upper frequency limit being 
1.26 times the lower frequency. Identified by the center 
frequency of each band. 

• A-Weighted Sound Pressure Level (dBA) 

The sound pressure level measured using an electronic 
filter that approximates the frequency response of 
the human ear. The table below shows octave band 
A-weighting correction factors. 


Octave band A-weighting correction factors 


Octave band center A-weighting 

freq (Hz) correction (dB) 


63 

125 

250 

500 

1000 

2000 

4000 

8000 


-26.2 

-16.1 


-3.2 

0 

+1.2 

+ 1.0 


• f-Aeq — Equivalent Continuous Sound Level 

The A-weighted energy mean of the noise level averaged 
over the measurement period. It can be considered as 
the continuous steady noise level which would have the 
same total A-weighted acoustic energy as the real fluc¬ 
tuating noise measured over the same time period. 



where T =total measurement time; Pjff) = A-weighted 
instantaneous sound pressure; P ref =2 x 10 -5 N/m 2 
L-Aeq is, therefore, an important number for the 
evaluation of a fluctuating noise level, because it 
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reflects the actual energy content of the time varying 
noise. L Aeq is used in its own right in many national and 
international standards for rating some forms of com¬ 
munity noise. 

• Ln — Percentile Level 

The A-weighted sound level equalled or exceeded by a 
fluctuating sound level x percent of the measurement 
time period. For example:c 

Laio ~ the A-weighted sound pressure level exceeded 
for 10% of the measurement period 
La 5 o ~ the A-weighted sound pressure level exceeded 
for 50% of the measurement period 
L A 9 o - the A-weighted sound pressure level exceeded 
for 90% of the measurement period 

The various L N levels over a measurement period 
are important in the evaluation of the temporal nature 
of the sound. A widely varying sound level over a 
measurement period will tend to have large differences 
between the various L N levels than a more constant 
steady noise. 

• Daily Personal Exposure 

The daily personal exposure of an employee is defined 
in the schedule to the HSE Noise Guide 1 as follows: 

where L EPd is the daily personal exposure (dB(A)); 
p A (t) is the time-varying value of the A-weighted 
instantaneous sound pressure in the undisturbed field 
(Pa); t is the time (h); p a is the base value of the sound 
pressure (Pa); T e is the duration of the exposure (h); T a 
a period of 8 h. As before, the value of p a is 2 x 10~ s Pa. 

A12.4 Noise Control 

Noise control is generally considered under four heads: 
(1) at source, (2) in transmission, (3) on emission and (4) on 
receipt. 

Noise can be generated only if there is a vibrating source, 
which may take the form of a vibrating surface or of 
fluctuation in fluid flow. The topic of noise is therefore 
inextricably bound up with that of vibration, as attested by 
the titles quoted earlier. 

• Control at Source 

Control of noise at source should be the first option 
considered. The approach is analogous to inherently 
safer design.The approach to noise control at source is to 
identify potential sources and to either eliminate them 
altogether or to reduce their level of vibration by one or 
more of the following: the surface, the amplitude, the 
frequency and, in the case of a fluid, the flow velocity. 
A number of specific methods for control of noise, 
such as impact reduction, clamping, damping, acoustic 
panels and silencers can be considered. 

• Control in Transmission 

In principle, noise associated with transmission 
through pipes and ducts may be structure-borne or 
fluid-borne. For gas or vapour pipes the sound is 


predominantly fluid borne as evidenced by the effec¬ 
tiveness of control by the use of in-line silencers. Such 
silencers are used, for example, on the intakes and 
exhausts of internal combustion engines and on the 
intake/exhaust of fans. 

• Control on Emission 

Control on emission involves modification of the route 
by which the noise reaches the worker. Devices used 
include sound-absorbing materials on the workroom 
walls, sound-absorbing screens, total or partial enclo¬ 
sure of machines and cabins serving as ‘noise refuges’. 
Another approach is to increase the distance between 
the worker and the noise source. Distance may be 
increased by segregation of noisy machines, use of 
remote controls and siting of exhausts. 

• Control at Receiver 

Control at the receiver involves the use of ear protection. 
Types and selection of ear protectors are discussed in 
HSE Noise Guide 5. 

Limiting the time for which the person is exposed to 
the noise may effect some reduction in the noise burden, 
but to be effective the proportion of time exposed has to 
be cut drastically. Complete removal for half a shift, for 
example, reduces the daily exposure by only 3 dB(A). 

The importance of addressing noise control issues as 
early as possible in a process plant engineering project 
cannot be over emphasized. The earlier noise control design 
issues are identified and resolved on a project, the more 
effective is the noise control design. That is effectiveness 
as measured in terms of overall project costs, impact on 
project schedule and compliance with the project noise 
requirements. 

Effective noise control design for refining or petro¬ 
chemical projects requires careful planning during the 
initial stages of the project, with equally careful and pru¬ 
dent execution through the various phases of the project. 
Before addressing specific project noise control design 
issues it will be useful to place some perspective on the 
noise control challenges faced on process plant projects. 
Any metric, from the capital cost, which can run in hun¬ 
dreds of millions, if not billions, of US dollars to the thou¬ 
sands of individual equipment items and bulk quantities of 
piping demonstrates the scale and complexity of these 
projects. The projects can be completely new ‘grass-roots’ 
plants or expansions to existing facilities. Often times a 
large project is further complicated by the need to divide 
the engineering in to manageable packages, with different 
engineering contractors responsible for different process 

The sections below highlight the key noise control 
design activities from the initial front end engineering 
design (FEED) phase of the project through Detailed 
Design to Commissioning and Start-up: 

• Front End Engineering Design (FEED) 

Noise control must be executed as early as possible in a 
proj ect to minimize the effect on proj ect costs layout and 
schedule. The major noise control activities on a project, 
therefore, tend to focus towards the FEED phase of the 
project. During these initial stages of aproject, baseline 
noise surveys may be required to establish existing 
noise levels at the plant site. For a ‘grass-roots’ project 
the primary focus of the baseline survey will be on 
community noise levels. For an expansion project at 
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an existing facility the survey must consider both in- 
plant and community noise levels. 

The key noise control task during the early stages of 
a project is the FEED Noise Study. This study evaluates 
the potential noise sources within the plant and estab¬ 
lishes, through plant noise modelling, the predicted 
noise levels (in-plant and community) for the new facil¬ 
ity. The initial modelling will be based on standard 
equipment with no special provision for noise control. 
The modelling will establish a baseline noise control 
position for the overall plant. This will identify poten¬ 
tially high noise equipment and high noise areas of the 
plant and will allow noise control design options to be 
readily included and evaluated in the plant noise model. 
This ‘what if’ analysis will allow the noise control 
design to be optimized to meet the plant owner’s overall 
project noise control requirements. 

Effective and accurate plant noise modelling is 
critical to this evaluation process. The plant noise 
modelling must be based on international and 
industry accepted standards (e.g. EEMUA, CONCAWE, 
ISO 9613). Noise model input data must be based on 
reliable and verifiable equipment and field noise data. 
Only with a solid background of field experience on 
comparable equipment in similar service can the noise 
control engineer speak with authority on predicted 
plant noise levels. 

The findings of the FEED Noise Study will provide 
the data to define definite and unambiguous noise limits 
and requirements for the Detailed Design phase of the 
project. This will apply to the designation of in-plant 
noise limits and the definition of ‘Restricted Areas’ (i.e. 
hearing protection areas) together with property line 
noise requirements and overall sound power level limits. 
The goal must be to define and specify noise control 
requirements so that they meet the project requirements 
and can be effectively managed and enforced during the 
Detailed Design phase of the project. 

• Detailed Design. 

Noise control for the detailed design phase of a project 
will involve the engineering contractor, or contractors, 
executing the noise control design for the project in 
compliance with the noise limits defined during the 
FEED phase of the project. Primary areas of noise 
control activity during the Detailed Design phase of the 
project would include: 

- Equipment requisition and design/data review 
process 

- Piping noise and control valve noise control 

Acoustic insulation definition 
Low noise control valve selection 
Vent and in-line silencers 

- Acoustic enclosures 

— Acoustic insulation for rotating equipment 

- Equipment shop noise testing (only in appropriate 
situations when good measurements are possible) 

• Commissioning and Start-up. 

The main noise control activities during commission¬ 
ing and start-up will be noise surveys to demonstrate/ 
verify compliance with the project noise limits. 
Depending on the results of the noise surveys corrective 
action may need to be initiated to reduce operation 
noise levels.Depending on the project type, long-term 


environmental noise monitoring in the community or on 
the plant property may be worthwhile during commis- 
sioning/start-up. This type of monitoring would pro¬ 
vide data on upset and startup venting operating 
conditions (e.g. flaring). Obtaining reliable data on 
these difficult to reproduce operating conditions may 
prove valuable. 

Noise control issues associated with typical classes of 

process plant equipment area discussed below: 

• Rotating Machinery 

A major source of noise in process plant is rotating 
machinery. Centrifugal compressors can produce noise 
levels of up to 100 dB(A) at 1 m from the equipment 
surface, often with dominant tonal content at the blade 
passing frequency. The casing is usually sufficiently 
massive to prevent transmission of aerodynamic vibra¬ 
tion. There are also other noise sources such as motors, 
turbines, gear units, lube oil pumps and control valves. 
Full acoustic enclosure is usually unnecessary and it is 
more common to use a combination of acoustic insula¬ 
tion and spring support for the pipework together with 
low noise valves.Another source of noise on rotating 
machinery is electric motors. Large medium voltage 
motors can produce a noise level above 90 dB(A), due 
principally to the cooling air fan and also sometimes 
to magnetically induced vibration. The problem is 
generally soluble using smaller, more efficient cooling 
air fans but on occasion increased frame size and/or 
cooling air silencers may be required. 

• Fluid Flow in Pipes 

Another main source of plant noise is the flow of fluids 
in pipes. Noise control of individual plant items may 
not be sufficient to attain the noise target and it may be 
necessary to address the noise in the pipework also. 

Noise from gas pipes is the subject of studies by 
CONCAWE described by Marsh et al. (1985), Pinder 
(1985) and van de Loo (1988). The CONCAWE piping 
model is an essentially empirical one and is somewhat 
similar to that inVDI 3733.With regard to noise control, 
Pinder outlines four methods, which relate to: pipewall 
thickness, plant layout, in-line silencers and acoustic 
insulation. 

Noise due to flow through valves is discussed in ISA 
S75.17-1989 Control Valve Aerodynamic Noise Prediction. 

• Combustion Processes 

Combustion processes are also a significant source of 
plant noise. On furnaces with induced or naturally 
induced air flow the air inlet and combustion noise can 
exceed 90 dB(A) @ 1 m per burner unless adequate 
acoustic absorption is included in the design of the 
burner plenums. With forced draft systems the sound 
levels are much less, noise in this case coming mainly 
from the fan intake, casing and motor. Noise can be 
transmitted by furnace wall and by duct vibration, the 
solution in this case being adequate stiffness. 

• Flares 

A particular type of combustion process that is liable to 
generate a high level of noise, including noise affecting 
the public, is a flare. 

The noise generated by a flare is a function of the 
energy release in the flame. Swithenbank (1972) has 
defined a noise generation efficiency equal to the frac¬ 
tion of the net heat release which is given off as noise 
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power, and has correlated it with mass velocity at the 
flare tip. Ohiwa,Tanaka and Yamaguchi (1993) describe 
fundamental studies on the noise from a turbulent dif¬ 
fusion flame. 

As he points out, proprietary flare tips are available to 
overcome the noise problem. Effective designs are 
based on the Coanda effect plus other utilizing mufflers 
or baffles for steam assist flares. A ground flare design 
also offers benefits for reduced noise due to flaring. 

• Pressure Relief 

An alternative method of disposal that also generates 
noise is venting to atmosphere. A method of estimating 
the noise from a high pressure relief discharging to 
atmosphere through a vent stack is given in API RP 
521:1990. 


A12.5 Notation 

/ fractional exposure 

/ tot total fractional exposure 


H sound power level (dB) 

L sound pressure level (dB(A)) 

L eq equivalent continuous sound level (dB(A)) 

Z-e p,d daily personal exposure (dB(A)) 

It sound pressure level at distance r (dB) 

N number of decibels (dB) 

pA(t) time-varying value of A-weighted instanta¬ 

neous sound pressure in the undisturbed field 

(Pa) 

p 0 base value of sound pressure (Pa) 

P pressure disturbance (Pa) 

r distance (m) 

t time (h) 

T e duration of exposure (h) 

T 0 8-h period 

W source power (W) 


Subscript 

o reference level 
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A13.1 Comments on Safety Factors to be Applied 
when Sizing a Simple Relief System 

It is recommended that a safety factor be applied to take 
account of both uncertainty in the data and inaccuracy in 
the calculation methods. 

It is assumed in the following discussion that (1) the 
designer has chosen a method appropriate to the applica¬ 
tion, intended to tend towards oversizing the relief system 
rather than the reverse, and (2) the relief system consists at 
most of a safety valve or bursting disc preceded by a con¬ 
stant diameter pipe and followed by a constant diameter 
pipe to atmosphere. It is also assumed that the flow through 
any safety valve has been checked against the manu¬ 
facturer’s data; under no circumstances should the mass 
flow be assumed to exceed the value so calculated. 

The safe case is that which corresponds with the highest 
estimate of the required relief rate(s) and the lowest esti¬ 
mate of the actual flow(s). 

The overall safety factor can be applied in one of two 
ways: 

(1) by sizing the relief system to pass a flow equal to the 
required mass flow multiplied by the safety factor; or 

(2) in cases where the vent capacity is determined by one 
particular cross-sectional area, by multiplying the 
calculated required vent area hy the safety factor. 
However, it is important then to check that the capac¬ 
ity remains determined by this area. 

The overall safety factor F 0 may be represented as the 
product of a number of sub-factors, each taking account of 
particular features: 

JVfcJjFi [A13.1] 


where F t is the sub-factor for feature i. Some of the sub¬ 
factors which may be appropriate are 

(1) A sub-factor (>1) to reflect any features of the 
method, unless included in other specific sub-factors 
such as those suggested below, which might lead to 
undersizing of the relief system for the application 
concerned. These might be features of the methods 
used to calculate the required relief rate(s) or vent area, 
although in most cases the methods will have been 
chosen so as to tend to overestimate those. They may 
also be features of the approach to assessment of the 
relief system flow capacity not covered below, for 
example the method may have neglected the presence 
of solids in the flow. The designer must himself estab¬ 
lish the required value for this sub-factor. 

(2) A sub -factor (> 1) to take account of uncertainty in the 
data. The magnitude and direction of any errors aris¬ 
ing from the data assumptions should be assessed. 
For reactors particular attention should be paid to 
any errors affecting the rate of reaction including its 
dependence on temperature. 

(3) A sub-factor (^ 1) to allow for the inaccuracy in the 
fluid flow calculation methods which is present even 
for incompressible liquid and/or ideal gas. In this dis¬ 
cussion it is assumed that the largest realistic pipe 
roughness has been assumed, otherwise a larger sub¬ 
factor will be necessary. 


Some recognized wide-applicability two-phase gas/ 
vapour-liquid flow methods, when used for lines in which 
friction and/or static head are significant, may be accurate 
only to a factor of ±2 (i.e. the actual flow is in the range half 
to two times the calculated value), and would thus corre¬ 
spond to a sub-factor of 2. For poorer methods, a larger sub¬ 
factor may be needed, while for methods more targeted at 
the specific application a lower sub-factor may suffice; 
expert advice should be sought. For two-phase gas/vapour- 
liquid flow with negligible friction and no changes in static 
head, for example through a safety valve alone, lower sub- 
factor values in the range 1.2—1.5 may sometimes be suf¬ 
ficient; expert advice should be sought. 

For vapour-only flow when friction is significant a rea¬ 
sonable value for this sub-factor will usually lie in the 
range 1,2-1.5, while if only momentum changes are sig¬ 
nificant, a lower sub-factor may be allowable; expert advice 
should be sought. 

(4) A subfactor to allow for the effects of gas/vapour- 
phase nonideality if these have not been taken into account 
in the mass flow capacity calculation. 

For critical (choked) frictionless gas/vapour-only flow 
(e.g. through a safety valve alone) the factor may be esti¬ 
mated from the work of Leung and Epstein (1988) using 
their figures 2, 4-6. These figures show the ratio of real- 
gas critical mass flow to ideal (Z = 1) critical mass flow (our 
sub-factor is the inverse of this ratio) as a function of 
the ratio (stagnation (inlet reservoir) pressure/thermo¬ 
dynamic critical pressure), for various values of the ideal 
(zero pressure) ratio of specific heats. The figures are based 
on the applicability of the Redlich-Kwong equation of state, 
but give a useful indication of the magnitude of the effects of 
non-ideality on critical flow. It can be seen that a sub-factor is 
needed for pressures exceeding about 20 times the critical 
pressure. At lower pressures the real critical flow is seen to be 
greater than the ideal critical flow, but caution should be 
exercised before adopting a sub-factor <1. It should be noted 
that non-ideality cannot be fully compensated for by assum¬ 
ing a constant Z value or using an adjusted fictitious mole¬ 
cular weight; this is discussed below 

For gas/vapour-only flow with friction, and for non- 
choked flow with or without friction, the author is unaware 
of any treatment analogous to that of Leung and Epstein. 
For given inlet reservoir conditions and back pressure and 
assumed constant Z, the adiabatic or isothermal mass flow 
of a gas through a perfect nozzle, and from a reservoir via 
a perfect rounded inlet into and through a straight pipe, 
is proportional to 1/Z 1/2 (Lapple, 1943). This suggests 
an approximate value for this sub-factor given by 


Real gas mass flow _ 1 
Ideal gas (Z = 1) massflow j||j| 


[A13.2] 


where Z max is the maximum value of Zoccurring in the flow. 
Clearly this sub-factor will be inaccurate when Z 
varies significantly (e.g. near the thermodynamic critical 
point, and near choking conditions); this can be seen by 
comparing this sub-factor (which if Zwere constant would 
apply equally to critical frictionless flow) with the sub- 
factor obtained from the work of Leung and Epstein for 
critical frictionless flow (and also from their figure 9). 
It would seem prudent to adopt a sub-factor at least as large 
as the larger of these two estimated sub-factors (but again, 
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care should be exercised before adopting any value <1). 
If the non-ideality is severe and such as to reduce the flow, 
then ideally the relief system should be sized using a 
method which takes full account of non-ideality; the other 
sub-factors would still be required. If the non-ideality is 
severe but (as is more likely) is such as to increase the flow, 
then a sub-factor of 1 may be prudent. 

It should be noted that the above sub-factors based on 
the work of Leung and Epstein and of Lapple are for 
application to the mass flow calculated on the basis of 
fully ideal (Z= 1) flow. If the flow has been calculated as 
semi-ideal with an assumed constant Z, or with an adjusted 
fictitious molecular weight, to give partial compensation 
for the departure from ideality, then this corresponds 
to the prior application of a sub-factor of ZzL . or 

(MW actua i/MW assume d) 1/z . 

It seems likely that the effects of gas/vapour-phase non¬ 
ideality in two-phase gas/vapour-liquid flow, will be less, 
but the author is not aware of any studies to validate this. 
It is suggested that this sub-factor be taken as the same as 
for gas/vapour-only flow. 

(5) A sub-factor (> 1) to take account of errors in the flow 
calculation for two-phase gas/vapour-liquid flow resulting 
from neglecting the variation in liquid density, liquid 
specific heat and latent heat along the pipe. The variation 
in these quantities can be judged from the calculated con¬ 
ditions along the pipe and thermodynamic charts. Then 
either a value can be assigned to this sub-factor or safe 
values can be assigned to those properties and the sub¬ 
factor set to 1. For calculation of mass flow capacity, 
safe values (giving a low mass flow) are low density, 


high specific heat and low latent heat. For gas-only or 
vapour-only flow, this sub-factor is irrelevant. 

Finally the designer must check that there are no further 
sub-factors to be included, and decide whether to accept the 
calculated overall safety factor F 0 . There is little published 
advice on typical factors. It would be surprising if the 
overall factor were to be less than 1.2 in any event, and sig¬ 
nificantly larger factors would be likely for reactors. 
For polymerization reactors Boyle (1967) said that the 
specified relief area should be two to three times the area 
indicated by design calculation (but note that this was 
before the preparation of the DIERS methods). Boyle’s 
recommendation is consistent with typical overall factors 
obtained using the approach described above for two- 
phase vapour/liquid venting. 


Caution 

It is emphasized that the above comments are 
offered only to assist the designer in his con¬ 
sideration of what might be an appropriate overall 
safety factor. The designer must decide whether the 
advice is relevant to his application (bearing in 
mind the restrictions defined in the second para¬ 
graph of this note) and what sub-factors and overall 
factor are adequate. 

H.A. Duxbury 

Industrial Professor, Department of Chemical 
Engineering, Loughborough University of Technology 
May 1994 
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APPENDIX 14/2 FAILURE AND EVENT DATA 


Many of the methods described in this volume require the 
use of data for failure and other events.This appendix gives 
a brief account of such data and a selection of references, 
which have been published in the open literature. 

The data are given in summary form and primarily for 
illustrative purposes only. It is emphasized that there are 
many factors that determine the failure rates of equip¬ 
ment and the range of failure rates observed can be quite 
wide. It should be borne in mind that the same data are 
often quoted by a number of references. The existence of 
several sets of data that are in agreement is not necessarily 
evidence of the validity of the data. For industrial reliabil¬ 
ity work, therefore, it is necessary to consult the original 
literature and to make appropriate use of data banks and 
plant data. 

Selected references on event and failure data are : 


Event and failure 

US Navy, Bur. of Naval Weapons (n.d.); NRC (Appendix 28 
Failure Data)', Dummer and Griffin (1960,1966); Edison 
Elec. Inst. (1963,1967); Timmermann (1968); R.L. Browning 
(1969a—c, 1970); F.R. Farmer (1971); Jacobs (1971); A.E. 
Green and Bourne (1972); AEC (1975); Gangadharan and 
Brown (1977); Cremer and Warner (1978); HSE (1978b); 
Ericsson and Bjore (1983); Johanson and Fragola (1983); 
Sherwin (1983); IEEE (1984); OREDA (1984,1989,1997, 
2002); Rackwitz (1984); Bendixen, Dale and O’Neill (1985); 
Reliability Analysis Center (1985); Rossi (1985); IAEA 
(1988); Boykin and Levery (1989); Hauptmans and Homke 
(1989); EUROSTAT (1991) 

Data collection and exchange 

Pollocks and Richards (1964); Boesebeck and Homke 
(1977); Frankel and Dapkunas (1977); Haueter (1977); 
Richards (1980); B.K. Daniels (1982); Bockholts (1983); 
Borkowski, Drago and Fragola (1983); Carlesso, Bastia and 
Borelli (1983); Himanen (1983); Melis etal. (1983); Games 
etal. (1985); Lamerse and Bosnian (1985); Walls and 
Bendell (1985); Blokker and Goos (1986);Thrpin and 
Kamath (1986); Wingender (1986,1991); Bendell (1987), 
Davidson (1994); Ireson, Coombs and Moss (1996); Lannoy 
and Procaccia (1996); Dhillon (1999); EsReDA (1999) 

Data problems and validity 

Kletz(1973b);J.H.Bowen(1977);R.L.Browning(1977);Cannon 
(1977); Devereux (1977); Lees (1977c); Parsons (1977); Rex 
(1977); Vesely (1977b); HSE (1978B); Apostolakis etal. (1980); 
Pitts etal. (1980); Apostolakis (1982,1985a); Martz (1984); 
OREDA (1984,1992,1997,2002); Mosleh and Apostolakis 
(1985); Andow (1989), EsReDA (1999), Kletz (1999) 

Barnes 0967 UKAEAAHSB(S) R138); Naresky (1967); 
AEC (1975); J.H. Bowen (1977); Collacott (1977b); B.K. 
Daniels (1982); Bobbio and Saracco (1983); Capobianchi 
(1983,1991); K.R. Davies (1983); OREDA (1984,1992,1997, 
2002); Bendell and Cannon (1985); Scarrone, Piccinini and 
Massobrio (1989); Bendell (1991a-c); Cannon (1991b); 
Cannon and Bendell (1991); Cross and Stevens (1991); 
Mizuta etal. (1991); MIL-HDBK217F; CCPS (1991); Fragola 
(1996); Ireson, Coombs, and Moss (1996); EsReDA (1999); 
Cooke and Bedford (2002) SRD: Barnes (1967 UKAEA 
AHSB(S) R138); Ablitt (1973 UKAEA SRS/GR/14, SRD 
R16,1975); Fothergffl (1973 UKAEA SRS/GR/22); Barnes 


et al. (1976); J.H. Bowen (1977); Cannon (1991a,b); EdF: 
Silberberg and Meclot (1985); Procaccia (1991); ENI: 
Avogadri, Bello and Colombari (1983); ERDS: Capobianchi 
(1991); FACTS: Koehorst (1989); Hoehorst and Bockholts 
(1991); IAEA:Tomic and Lederman (1991); Offshore: 
Gaboriaud, Grollier-Baron and Leroy (1983); Gjestad 
(1983);Tveit, Ostby and Moss (1983); OREDA (1984,1989, 
1992,1997, 2002); Bruce (1994); Groenendijk (1995); 
Sandtorv, Hokstad and Thompson (1996); Rausand and 
0ien (1996); Haugen, Hokstad and Sandtorv (1997); 
Langseth, Haugen and Sandtorv (1998) 

Populations (of plants, equipment, etc.) at risk 
Plants: AGA (n.d./lOl); IP (Oil Data Sht 15); IPE (1967-); 
SRI Int. (1988a-c); Anon. (1985dd); HSE (1986 Major 
Hazards 8); IPE (2002); Welsh (1993) 

Equipment: Hooper (1982) 

Transport: ACDS (1991) 

Mechanical equipment failure modes (see also 
Table 7.1) 

IMechE (1970/3); Pilborough (1971,1989); Collins and 
Monack (1973); B.W. Wilson (1974); Lancaster (1975); 
OREDA (1984,1992,1997,2002); H.C.D. Phillips (1990), 
Davidson (1994) 

Pressure vessels 

Kellerman (1966); Kellerman and Seipel (1967); 

Phillips and Warwick (1968 UKAEA AHSB(S) R162); 
Slopianka and Mieze (1968); Butler (1974); Engel (1974); 

T. A. Smith and Warwick (1974); AEC (1975); Boesbeck 
(1975); Bush (1975); HSE (1978b); Arulanantham and 
Lees (1981); Hurst, Hankin etal. (1992); Columns: H.C.D. 
Phillips (1990) 

Storage tanks 
H.C.D. Phillips (1990) 

Pipework 

S. AWilson (1972,1976); AEC (1975); Boesebeck and Homke 
(1977); Bush (1977); HSE (1978b,d); Arulanantham and 
Lees (1981); Cannon (1983); R.E.Wright, Stevenson and 
Zuroff (1987); Blything and Barry (1988 SRD R441); CIA, 
Chlorine Sector Gp (1989); de la Mare, Bakouros and 
Tagaras (1993); Hurst, Davies etal. (1994); Strutt, Allsop 
and Ouchet (1994); G. Thompson (1994) 

Heat exchangers 

A.E. Green and Bourne (1972); C.F. King and Rudd (1972); 
H.C.D. Phillips (1990); OREDA (1992,1997,2002), Lannoy 
and Procaccia (1996) 

Rotating machinery 

Turbomachinery: R.L. Browning (1970); Sohre (1970); 
OREDA (1992,1997, 2002) 

Compressors: Ufford (1972); Avogadri, Bello and Colombari 
(1983); H.C.D. Phillips (1990); OREDA (1992,1997, 2002); 
Lannoy and Procaccia (1996), Hale and Arno (2001) 
Pumps: Anon. (19721); F.R. Farmer (1971); Emelyanov etal. 
(1972); A.E. Green and Bourne (1972); C.F. King and Rudd 
(1972); Ufford (1972); AEC (1975); R. James (1976); Sherwin 
and Lees (1980); Dorey (1981); Aupied le Coguiec and 
Procaccia (1983); Avogadri, Bello and Colombari (1983); 
Sherwin (1983); Anon. (1985x); Bloch and Johnson (1985); 
N.M. Wallace and David (1985); Flitney (1987); H.C.D. 
Phillips (1990); OREDA (1992,1997, 2002), Lannoy and 
Procaccia (1996); Sawaryn, Grames and Whelehan (2002) 
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Valve 

Rijnmond Report; Moss (1977 NCSR Rll); Aupied, le 
Coguiec and procaccia (1983); Vivian (1985); OREDA (1992, 
1997,2002) 

Pressure relief valves: A.E. Green and Bourne (1972); Kletz 
(1972a, 1974a); Lawley and Kletz (1975); Aird (1982,1983); 
Aupied, Le Coguiec and Procaccia (1983); Oberender and 
Bung (1984); OREDA (1984,1992,1997,2002); Maher et al. 
(1988); Hanks (1994); D.W. Thompson (1994), Alfares (1999) 
Non-return valves: AEC (1975); Aupied, Le Coguiec and 
Procaccia (1983); McElhaney (2000) 

Emergency isolation valves: Haugen, Hokstad and 
Sandtorv(1997) 

Bursting discs 
Lawley (1974b) 

Instruments, including valves 

Barnes (1965 UKAEA AHSB(S) R99,1966UKAEA 
AHSB(S) R119,1967 UKAEA AHSB(S) R122, R131,1966); 
A.E. Green and Bourne (1965 UKAEA AHSB(S) R91, 

1965,1966 UKAEA AHSB(S) R117,1972); Bourne (1966 
UKAEA AHSB(S) R110,1967); A.E. Green (1966 UKAEA 
AHSB(S) R113,1969 R164,172,1971 UKAEA SRS/ GR/2, 
1970,1972); J.C. Moore (1966); Hensley (1967 UKAEA 
AHSB(S) R138,1968,1969UKAEA AHSB(S) R178,1971); 
R.L. Browning (1969c, 1972,1977); Mercer (1969); Anyakora 
(1971); Anyakora, Engel and Lees (1971); Stewart (1971); 
Upfold (1971); Lees (1973b, 1976b,c); Anon. (1974); Bulloch 
(1974); Lawley (1974b); Skala (1974); AEC (1975); Lawley and 
Kletz (1975); Moss (1977 NCSR R12); Bott and Haas (1978); 
H.S.Wilson(1978);Huyten(1979);delaMare(1980);Piccinini 
efa/.(1982); Aupied,LeCoguiecandProcaccia(1983);Rooney 
(1983); Unger (1983); Oberender and Bung (1984); OREDA 

(1984.1992.1997.2002) ;Vivian(1985);Kumar,Chidambaram 
and Gopalan (1989); R. Green (1993); Paula (1993); Strutt, 
Allsop and Ouchet (1994) 

Process computers 

Barton etal. (1970); Hubbe (1970); E. Johnson (1988) 

Fire protection, fire and gas detection, sprinkler 
systems 

Rasbash (1975a); MJ. Miller (1974,1977); P. Nash and 
Young (1976); Kamath, Keller and Wooliscroft (1981); 
Peacock, Kamath and Keller (1982); Peacock and 
Watson (1982); OREDA (1984,1992,1997, 2002); Gupta 
(1985); Finucane and Pinkney (1988 SRD R431); 
Rose-Pehrsson etal. (2000); Rowekamp and Berg (2000); 
Budnick (2001) 

Utilities 

R.L. Browning (1969c); Kletz (1975); Coltharp etal. (1978); 
OREDA (1984,1992,1997, 2002) 

Power supplies 

Dickinson (1962); R.L. Browning (1969c); AEC (1975); 
Jarrett (1983); B. Stevens (1983); Ketron (1980) 

Diesel generators, diesel-driven equipment: F.R. Farmer 
(1971); AE. Green and Bourne (1972); AEC (1975); OREDA 

(1984.1992.1997.2002) ; B. Steven (1983);Vesely, Uryasev 
and Samanta (1994) 

Electronic equipment 

Dummer and Griffin (1960,1966); US Army, Dept of 
Defense (1965); A.E. Green and Bourne (1972) 


Electrical equipment 

F.R. Farmer (1971); A.E. Green and Bourne (1972); AEC 
(1975); OREDA (1984,1992,1997, 2002) 

Electric motors 

Dickinson (1962); Benjaminsen and vanWiechen (1968); 
R.L. Browning (1969c); AEC (1975); Avogadri, Bello and 
Colombari (1983) 

Boilers 

F.R. Farmer (1971); H.C.D. Phillips (1990) 

Mills 

Notman, Gerard and de la Mare (1981) 

Belt conveyors 

Notman, Gerard and de la Mare (1981) 

Cranes 

F.R. Farmer (1971); OREDA (1992,1997, 2002) 

Reactor overpressure 

Marrs and Lees (1989); Marrs etal. (1989) 

Leaks and spillages 

Davenport (1977b, 1983); Kletz (1977J); HSE 
(1978b,d); Baldock (1980); Forsth (1981b); Hawksley 
(1984); AW Cox, Lees and Ang (1990); ACDS (1991); 
Berglund (1992);Taback, Siegell, Martino and 
Ritter (2000) 

Ignition of leaks 

R.L. Browning (1969c); A.W. Cox, Lees and Ang (1990); 
ACDS (1991) 

Fire and explosions 

Process plant fires: Rutstei and Clarke (1979); G.Wiiliam 
(1999) 

Refinery fires: API (1983,1984,1985) 

Pump fires: Kletz (1971); Wallace and David (1985); HSE 
(1978b) 

Tank fires: Kletz (1971); API (1983,1984,1985) 

Furnace explosions: Kletz (1972c); Ostroot (1972) 
Warehouse fires: Hymes and Flynn (1992 SRD R578) 

Vapour cloud explosions 

Wiekema (1983a,b, 1984); Davenport (1977,1983) 
Probability of ignition: Kletz (1977J); HSE (1978b); Moussa 
etal. (1982); A.W. Cox, Lees and Ang (1990); ACDS (1991) 
Delay before ignition: Kletz (1977J) 

Drift before ignition: Kletz (1977J) 

BLEVE 

Blything (1986); Hurst, Hankin etal. (1992) 

Transport 

Westbrook (1974); HSE (1978b); Appleton (1988 SRD R474); 
ACDS (1991); P.A. Davies and Lees (1992); Montiel et al. 
(1996) 

Pipelines see Table 23.1 
Ships 

HSE/SRD (HSE/SRD/WP10, 29); Sandtory and Edwards 
(1980); Poten and Partners (1982); Blything and Lewis 
(1985 SRD R340) 

Fire and explosion: Blything and Edmondson (1983,1984 
SRD R292); ACDS (1991) 
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LNG plants 

Welker et al. (1976); Welker and Schorr (1979); AGA 
(1981/33); D.W. Johnson and Welker (1981); Moussa et al. 
(1982) 

Offshore 

Goodwin and Kemp (1980); Sofyanos (1981); Anon. (1983h); 
Dahl et al. (1983); OREDA (1984,1992,1997,2002) 

Missiles 

HSE/SRD (HSE/SRD/WP7); HSE (1978b); Holden and 
Reeves (1985); Holden (1988 SRD 477); ACDS (1991) 

Aircraft crashes 

AEC (1975); HSE (1978b); Phillips (1981 SRD R198); 
Marriott (1985); Roberts (1987 SRD R388) 


A14.1 Type of Data 

There are several types of data that may be required. 
The first type is accident and incident data including the 
recording of system malfunctions, accident reports 
and databanks established to store accident information. 
The second type is event and failure rates data that involve 
all the abnormal events and the performance of equipment. 
For equipment, these data include: 

(1) Failure frequency, probability 

(2) Repair time 

(3) Unavailability 

and for events: 

(4) Event frequency. 

Failure rate data are usually given as frequencies or mean 
time to failure (MTTF). Two types of failure rate data are 
typically used: time-related and demand-related. Time- 
related failure rates are established for equipment that is 
continuously in use while demand-related failure rates are 
for equipment that is normally dormant and required to 
operate on demand. 

A14.2 Definition and Regimes of Failure 

The failure rate recorded for equipment necessarily 
depends on the definition of failure. The importance of this 
may vary. Failure of a pump to start on demand would 
appear relatively unambiguous, but failure of a pressure 
relief valve may refer either to failure of the set pressure to 
stay within prescribed limits when removed from the plant 
and tested in the workshop or to failure to relieve pressure 
during plant operation. An equipment failure can be cata¬ 
strophic, degraded or incipient. It is essential to have a 
uniform definition and classification of failure for data 
collection, selection and verification. 

It is usually assumed that the failure rate of a component, 
or strictly the hazard rate z, is constant, but this may not 
necessarily be the case, especially at the burn-in and wear- 
out stages of its life cycle. Consideration may be given to the 
effect of time-dependent failure characteristics for the 
equipment and processes perceived critical to plant opera¬ 
tion. Bathtub and Weibull distribution have been used to 


represent a wide range of failure data. The hazard rate may 
be decreasing, constant or increasing, corresponding to the 
regimes of early failure, constant failure or wearout failure 
and characterized by values of the Weibull shape para¬ 
meter p < 1,1, >1, respectively. A number of workers have 
found an early failure regime, corresponding to 1 < p. Some 
typical results are 


Equipment 

fi 

Reference 

Pump, 
type A 

0.74-1.07 

de la Mare (1976) 

typeB 

0.69-0.87 

Berg (1977) 
de la Mare (1976) 

Valves 

0.70-1.02 

de la Mare (1976) 

Pumps 

as low as 

Aird (1977b) 


0.5 



A further account of the Weibull method is given in 
Chapter 7. 


A14.3 Influence Factors 

The failure rate of equipment is influenced by a large 
number of factors, including design, specification, manu¬ 
facture, application, operating conditions, maintenance, 
and environment. Process equipment is used in a wide 
variety of operating conditions and environments, and it is 
desirable to account for these influencing factors. 

For some types of device, the effect of certain influencing 
or environmental factors can be quite well defined. An 
environment factor K, which is a multiplier to the nominal 
failure rate, is widely used for the effect of temperature on 
items of electrical equipment such as resistors. Some 
values of environment factors are given by A.E. Green and 
Bourne (1972). Base failure rate, quality factor, learning fac¬ 
tor, and environment factor are defined in MIL-HDBK-217F 
(1991) to predict failure rates for some electronic equipment. 
It is more difficult to define the effect of such factors on 
mechanical equipment, but a few examples may be men¬ 
tioned. Several authors have given correlations for the 
effect of particular influencing factors on equipment. Moss 
(1977 NCSR Rll) has given data on the failure rates of 
mechanical valves in two nuclear power stations. The 
overall failure rates X of the valve were 


Steam valves X = 0.1 faults/year 

Water valves X = 0.01 faults/year 


The variation of the failure rate with the severity of the 
operating conditions pressure and temperature was cor¬ 
related by an equation of the form 

i = Xq exp ^ — lj [A14.3.1] 

D = p + t [A14.3.2] 

where D is the severity parameter, p is pressure (psi), t is 
temperature (°C) and subscript 0 indicates base case. 
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C.F. King and Rudd (1972) have expressed the hazard rate 
for pumps as function of the form 

z = Ar 1 ' 2 + B + Q 3 [A14.3.3] 

where t is time and A , B and C are functions of temperature, 
motor power and pump utilization. An environment factor 
for instruments has been given by Anyakora, Engel and 
Lees (1971), as described in Chapter 13. Similarly, a severity 
index for instruments has been given by Barbin (1973). 

A14.4 Collection of Data 

Any reliability work would not be successful without an 
efficient data collection and analysis system, and collection 
of data is receiving more and more attention of engineers. 
Failure rate data are characterized by complex interactions 
of components, specifications, maintenance procedures, 
operating environments, etc. Each company should exam¬ 
ine the sources of data carefully and take full advantages of 
the available information, internal and external. 

The most desirable information for reliability and risk 
analysis is to have sufficient plant specific data. In general, 
failure of plant equipment needs to be recorded and inves¬ 
tigated, both in order to identify types of failure so that 
failure rates can be reduced by better engineering, and to 
obtain failure data for reliability calculations. 

It is normal practice to record for production manage¬ 
ment the downtime of the plant together with its cause. 
Frequently the cause assigned is the failure of the par¬ 
ticular equipment. This system may yield useful data, 
particularly on plant availability. Likewise, it is normal 
practice to record for maintenance management failures of 
plant equipment. Useful data on failure rates may be gen¬ 
erated by this system. 

Most chemical plants have a wealth of data in their 
operating and maintenance records. Frequently, the data 
yielded by the existing production and maintenance man¬ 
agement systems are not directly usable for reliability 
work. It is then necessary to make certain adjustment the 
records to obtain the desired data. Usually this involves 
some additional work by the operating and maintenance 
personnel. It is essential, therefore, to design the data col¬ 
lection system appropriately. Realizing this, CCPS (1991) 
devoted a whole chapter discussing locating raw plant data 
and converting them into reliability data. 

If data collection is to be instituted for reliability work, it is 
necessary to define the system carefully. This includes 
(1) data requirement, (2) data capture, (3) data classification 
(4) data retrieval, and (5) data utilization. The system 
should be appropriate in scale and in duration. In some 
cases the aim is to monitor continuously features such as 
equipment failure and/or unit availability. In this case con¬ 
tinuous collection is clearly necessary. On the other hand if 
the aim is simply to obtain data for reliability engineering 
or hazard assessment purposes, it may be sufficient to col¬ 
lect certain data over a limited period on a'campaign’ basis. 

One pitfall is to embark upon too ambitious a scheme 
that is then not fully exploited and soon falls into disuse. A 
better policy is to start with a more modest system and to 
put effort at an early stage into utilizing the data and 
demonstrating their usefulness to those involved in col¬ 
lecting them. At the other extreme, the desire to avoid this 
error can lead to the converse mistake of seeking so little 
modification to the existing system that usable data are not 


obtained. It is desirable, therefore, both to design the sys¬ 
tem so that it matches the use to be made of it and, once the 
system is operating, to begin as soon as possible to utilize 
the data which flow so that those participating can see that 
use their efforts are not being wasted. 

Particular attention should be paid to the point of gen¬ 
eration of the data. In some cases the quality of information 
on documents such as job tickets is sufficiently good for the 
purpose. But in other cases some form of specific debrief¬ 
ing may be preferable in order to ensure that the data 
obtained are meaningful. 

Further discussions of data collection are given by DJ. 
Smith and Babb (1973),Wingender (1991), Davidson (1994), 
Ireson, Coombs and Moss (1996) and Dhillon (1999). 


A14.5 Sources of Data 

Failure data may be obtained from external sources such as 
the literature and data banks. Alternatively, they may be 
collected within the works. The sources available depend 
on the user. A company operating plant has access to data 
from its own works that are not available to other parties, 
unless supplied to an accessible database. The possible 
sources may include warranty claims, previous experience 
with similar or identical equipment, repair facility records, 
factory acceptance testing, records generated during the 
development phase, customers’ failure reporting systems, 
test, and inspection records generated by quality control/ 
manufacturing group. 

Failure rates depend on many factors, including the 
function of the equipment in the system and the definition of 
failure; the process environment and the maintenance 
practices; and the type of equipment and its manufacturer. 
The ideal situation is to have sufficient in-house data from 
identical equipment in the same application. On the other 
hand, internal collection may not be appropriate, or for new 
plant designs there is apparently no in-house failure data. 

Generic data are often used in reliability work, espe¬ 
cially at design stage. However, there are available in the 
literature a number of collections of data, it requires 
the knowledge of the background and data origin to choose 
the appropriate generic failure rate data. Table A14.1 is the 
cross reference between principal data sources prepared 
by the Data Acquisition Working Party of the Mechanical 
Reliability Committee of the Institution of Mechanical 
Engineering (Davidson, 1994), and Table A14.2 is the 
equipment category associated with Table A14.1. 

A selection of data on equipment failure rates obtained 
by the UKAEA and given by A.E. Green and Bourne are 
shown in Table A14.3 and Figure A14.1. These data derive 
from the work of the UKAEA initially in the nuclear field 
but subsequently in non-nuclear applications also. 

Figure A14.2 and Figure A14.3 gives the operating ran¬ 
ges of critical failure rates of some equipment from nuclear 
plants and EIReDA data. 

Further selected failure rate data given in the Rasmussen 
Report are shown in Table A14.4. The failure data in this 
table include both failure rate per unit time and failure 
probability on demand and are quoted as a median value 
together with a range. These data were obtained from both 
nuclear and non-nuclear sources, but were collected for use 
in nuclear hazard assessment, in particular on the critical 
loss of coolant accident (LOCA). The report, which is 
described more fully in Appendix 23, gives extensive 
documentation qualifying the data presented. 
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Table A14.1 Summary of principal reliability data sources (reproduced from The Reliability of Mechanical Systems 
editedbyJ. Davidson (technical editor C. Hunsley), 1994, with permission from Professional Engineering Publishing Ltd) 


Reference Application Equipment 




Rotation 

Static 

Instrumentation 

Safely 

Process 

Electrical 

CCPS 

I 

Y 

Y 

Y 

Y 

Y 

Y 

Davenport and Warwick 

N, I 

- 

Y 



- 


DEF STAN 00-41 pt 3 Issue 1 

M 

Y 

Y 

V 

Y 

Y 

Y 

De la Mare 

O 


Y 





Dexter and Perkins DP-1633 

N, I 

Y 

Y 

Y 

Y 

Y 

Y 

EIReDA 

N, I 

Y 

Y 

Y 

Y 

Y 

Y 

ENI 

I 

Y 

Y 

Y 

Y 

Y 

Y 

Green and Bourne 

N, I 

Y 

Y 

Y 

Y 

Y 

Y 

IAEA-TECDOC 

N 

Y 

Y 

Y 

Y 

Y 

Y 

IEEE 500 

I 

Y 


Y 

Y 


Y 

Lees 

N, I 

Y 

Y 

Y 

Y 

Y 

Y 

MIL-HDBK-217F 

M 

Y 

Y 


Y 


Y 

NPRD-91 

N, I 

Y 

Y 

V 

Y 


Y 

OREDA84 

O 

Y 

Y 

Y 

Y 

Y 

Y 

OREDA 92 

O 

Y 

Y 

Y 

Y 

Y 

Y 

RKS/SKI85-25 

N, I 

Y 

Y 

Y 

Y 


Y 

Rothbart 

I 

Y 

Y 

Y 

Y 


Y 

Smith 

N, I 

Y 

Y 

Y 

Y 

Y 

Y 

Smith and Warwick 

N, I 

- 

Y 

- 



- 

Wash 1400 

N 

Y 

Y 

Y 

Y 


Y 

RMC HARIS 

O, N, I 

Y 

Y 

Y 

Y 

Y 

Y 

SRD Data Centre 

O, N, I, M 

Y 

Y 

Y 

Y 

Y 

Y 


0 = offshore; N=nuclear; I = industrial; M = military. 


include not only overall failure rates but also failure rates in 
some failure modes. The number of failures, which deter¬ 
mines the confidence bounds on the values, is also given. 

In the cases there is no applicable internal or external 
failure data, careful engineering estimation has to be made. 
Usually, the final data set to be used is a judicious mixture 
of data from all these sources. 

A14.6 Status of Data 

In hazard assessment it is a good practice to indicate the 
status of the data. Some relevant distinctions are: 

(1) Value based on historical data: 

(a) value based on large number of events (narrow 
confidence limits); 

(b) value based on small number of events (wide 
confidence limits); 

(c) value based on number of event-free years or 
occasions; 

(2) Value based on judgment of a number of experts. 

(3) Value synthesized using fault tree methods. 

(4) Value based partly on data and partly on judgment of 
analyst. 

(5) Value entirely on judgement of analyst. 

A similar classification is given in the First Convey Report 
described in Appendix 7. 

The status of data is discussed by Andow (1989) and 
Holloway (1989). 

A14.7 Processing of Data 

Using failure rate data requires thorough understand¬ 
ing and judicious judgements. The quality of the data 
from different sources will be varying. For a particular 


Table A14.2 Equipment category code for Table A14.1 
(reproduced from The Reliability of Mechanical Systems 
edited by J. Davidson (technical editor C. Hunsley), 1994, 
with the permission from Professional Engineering Pub¬ 
lishing Ltd) 


Equipment 

category 

Typical 

component 

1 

Rotating 

Pumps, compressors, turbines, 


equipment 

motors 

2 

Static 

Pipes, pipelines, flowlines, 


equipment 

valves, vessels 

3 

Instrumentation 

Sensor (temperature, pressure, 
level etc.) and controllers 

4 

Safety 

Fire pumps, safety valves, fire/ 
gas/smoke detectors 

5 

Process 

Pumps, compressors, valves vessels, 
piping 

6 

Electrical 

Cables, motors, circuit boards lamps 


a This table should be used in conjunction with the above table. 
b Note that the categories are not intended to be mutually exclusive. For 
example, pumps can be categorized as bother ‘rotating’ and ‘process’. 


Another set of failure rate data are those given by D.J. 
Smith (1985) and a selection is shown in Table A14.5. In this 
case the failure rate is given as a single value, a range or a 
single value and a range. 

A synthesis table generated by EIReDA is shown in 
Table A14.6. The data set are originally from nuclear plants. 

Failure rate data for offshore have been given in the 
collections by OREDA (1984,1992,1997, 2002). These data 
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Table A14.3 Some data on equipment failure rates 
published by the UKAEA, (data from Reliability Technology 
byA.E. Green and J.R. Bourne, Copyright©, 1972, 
reproduced with permission of John Wiley and Sons, Inc.) 


Failure rate 
(failures/10 6 h) 


Electric motors (general) 10.0 

Transformers (< 15 kV) 0.6 

(132-400 kV) 7.0 

Circuit breakers (general, <33kV) 2.0 

(400 kV) 10.0 

Pressure vessels (general) 3.0 

(high standard) 0.3 

Pipes 0.2 

Pipe joints 0.5 

Ducts 1.0 

Gaskets 0.5 

Bellows 5.0 

Diaphragms (metal) 5.0 

(rubber) 8.0 

Unions and junctions 0.4 

Hoses (heavily stressed) 40.0 

(lightly stressed) 4.0 

Ball bearings (heavy duty) 20.0 

(light duty) 10.0 

Roller bearings 5.0 

Sleeve bearings 5.0 

Shafts (heavily stressed) 0.2 

(lightly stressed) 0.02 

Relief valves: leakage 2.0 

blockage 0.5 

Hand-operated valves 15.0 

Control valves 30.0 

Ball valves 0.5 

Solenoid valves 30.0 

Rotating seals 7.0 

Sliding seals 3.0 

‘O’ring seals 0.2 

Couplings 5.0 

Belt drives 40.0 

Spur gears 10.0 

Helical gears 1.0 

Friction clutches 3.0 

Magnetic clutches 6.0 

Fixed orifices 1.0 

Variable orifices 5.0 

Nozzle and flapper 

assemblies: blockage 6.0 

breakage 0.2 

Filters: blockage 1.0 

leakage 1.0 

Rack-and-pinion assemblies 2.0 

Knife-edge fulcrum: wear 10.0 

Springs (heavily stressed) 1.0 

(lightly stressed) 0.2 

Hair springs 1.0 

Calibration springs: creep 2.0 

breakage 0.2 

Vibration mounts 9.0 

Mechanical j oints 0.2 

Grub screws 0.5 


Pins 15.0 

Pivots 1.0 

Nuts 0.02 

Bolts 0.02 

Boilers (all types) 1.1 

Boiler feed pumps 1012.5 

Cranes 7.8 


Sources : F.R. Farmer (1971); A.E. Green and Bourne (1972). 

Note : Further failure data on electronic, mechanical, pneumatic and 
hydraulic components are given byA.E. Green and Bourne (1972). 


reliability study, it is essential to consult the original data 
sources and identify appropriate data sources to reach a 
better estimation of the equipment failure rates. EsReDA 
(1999) offers a summary of the collection, analysis and 
quality assurance of reliability data. 

Mean failure rate is appropriate for failure rates obtained 
from testing a large population of samples under controlled 
environment, typically for electronic components. On the 
other hand, for mechanical equipment, we may want to look 
into the plant operation to select the appropriate data and 
apply some adjustment. 

A14.8 Uncertainty of Data 

Reliability data can deviate by a factor of three or four, and 
a factor of 10 is not unusual, as suggested by Trevor Kletz 
(1999). However, not much information exists in the open 
literature regarding the uncertainty of data. Since the 
uncertainty is quite large, it is inappropriate to report fail¬ 
ure rate data or calculations using failure rate data to more 
than two significant figures. A serious implication of pre¬ 
cision is suggested when more than two significant figures 
are reported. 

A14.9 Databases 

Database and data bank are sometimes referred to in the 
literature exchangeably. However, a database is a collection 
of data managed through computer programs for speci¬ 
fied applications while a data bank is a collection of data in 
a specific area of knowledge, such as a handbook. An 
account of data banks and databases is given in Reliability 
Data Banks by Cannon and Bendell (1991). Fragola (1996) 
reviewed reliability databases from a historical aspect and 
suggested the possible improvements of reliability data¬ 
base development. 

The two main kinds of database are the incident data¬ 
base and the reliability database. An incident database 
does not have an inventory of items at risk and concentrates 
on the attributes and development of the incidents. The 
information available is often limited to whatever was 
recorded at the time. A variety of databases have been 
established to store and share this type of information. 
Among them are FACTS, WOAD (Worldwide Offshore 
Accident Database), MARS (the European Union Major 
Accident Reporting System), etc. A reliability database 
may well record incidents, but treats them primarily as 
events from which statistical information on reliability, 
availability and maintainability are to be derived. Reli¬ 
ability data can be overall failure rates or values separated 
into failure modes and causes. 






APPENDIX 14/8 FAILURE AND EVENT DATA 



Figure A14.1 Typical ranges of failure rates for parts, equipments and systems (A.E. Green and Bourne, 1972) 
(reproduced with permission from Reliability Technology by A.E. Green and J.R. Bourne, Copyright©, 1972, John Wiley 
and Sons, Inc.) 



Figure A14.2 Demand critical failure rate ranges of some 
equipment at French nuclear plants (sample - 80-170 
unit-years depending on equipment) (Lannoy and Pro- 
caccia, 1996; reproduced with permission from Elsevier) 

Reliability databases are created by different users for 
somewhat different purposes. They range from the data¬ 
base created by a single individual through those at com¬ 
pany level to those operated by specialist organizations. 
High quality reliability data are expensive to collect and 
often require a long time or a large sample to be statistically 
viable. The investment of effort in creating and operating 
a reliability database is appreciable and the exercise is not 
one to be undertaken lightly. It is essential to define clearly 
the data to be held, the means by which they will be 
acquired, and the uses to which they will be put. 


Figure A14.3 Operating critical failure rate ranges of 
some equipment at French nuclear plants (sample= 
80-170 unit-years depending on equipment) (Lannoy 
and Procaccia, 1996; reproduced with permission from 
Elsevier) 


Most serious reliability databases are part of the activ¬ 
ities of an organization that is involved in other aspects of 
reliability work also. The organization thus has an interest 
in the database as a user, which is likely to make it more 
friendly to other users. There are a variety of reliability 
databases, such as the reliability databank operated by 
AEA Technology, ERDS, OREDA, etc. CCPS (1991) provides 
a review of the available databases. CCPS is also conduct¬ 
ing a reliability project with selected companies, but the 
results of this effort are not publically available. 
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Table A14.4 Some failure data used in the Rasmussen Report (AEC, 1975) 


Failure rate 


Median Range 


Diesels (complete plant) 

Failure to start, Q d a 

3 x 10“ 2 /d 

1 x 10“ : 

2 -l x 10“7d 
4 —3 x 10“ 2 /h 


Failure to run, given start, in emergency 

3 x 10“ 3 /h 

3x10“ 

Diesels (engine only) 

conditions, 4 

Failure to run, given start, in emergency 

3 x 10“ 4 /h 

3x10“ 

5 —3 x 10“ 3 /h 

Battery power systems 

conditions, 4 

Failure to provide proper output 4 

3 x 10 _6 /h 

1x10“ 

6 -l x 10“7h 

(wet cell) 

Electric motors 

Failure to start, Q d 

3 x 10/d 

1 x 10“ 

4 -l x 10“7d 

6 —3 x 10“7h 


Failure to run, given start, in normal 

1 x 10 _5 /h 

3x10“ 


environment, 4 

Failure to run, given start, in extreme 

1 x 10“ 3 /h 

1 x 10“ 

4 -l x 10“ 2 /h 

Transformers 

environment, 4 

Open circuit, primary or secondary, 4 

1 x 10“ 6 /h 

3 x 10“ 

7 —3 x 10 6 /h 


Short, primary to secondary 4 

1 x 10 _6 /h 

3 x 10“ 

7 -3 x 10 G h 

Solid state devices 

Failure to function, 4 

1 x 10“ 6 /h 

1 x 10“ 

7 —1 x 10“ 5 /h 

(low power application) 


Failure by short, 4 

1 x 10“7h 

1 x 10“ 3 /d 

1 x 10“ 6 /h 

1 x 10“' 

8 -l x 10“7h 
4 -3 x 10“ 3 /d 

Circuit breakers 

Failure to transfer, Q d b 

3x10“ 


Premature transfer, 4 

3 x 10“ 

7 -3 x 10“7h 
6 -3 x 10“7d 

Fuses 

Failure to open, Q d 

1 x 10 _5 /d 

1 x 10“ 6 /h 

3x10“ 


Premature open, 4 

3 x 10“ 

7 -3 x 10“7h 

Relays 

Failure to energize, Q d b 

1 x 10“ 4 /d 

3x10“ 

5 —5 x 10“ 4 /d 


Failure of NO contacts to close, given 

3 x 10“ 7 /h 

1 x 10“' 

7 -l x 10“ 6 /h 


energization, Xo 

Failure of NC contacts by opening, given no 

1 x 10“ 7 /h 

3x10“ 

8 —3 x 10“ 7 /h 


energization, 4 

Short across NO/NC contacts, 4 

1 x 10“ 8 /h 

1 x 10“' 

9 -lxl0“7h 

8 - l x 10“7h 

9 — 1 x 10“7h 
8 -l x 10 ®/h 


Coil open, 4 

1 x 10“7h 

1 x 10“7h 

1x10“' 


Coil short to power, Xo 

1 x 10“ ! 

Terminal boards 

Open connection, Xo 

lxl0“7h 

1 x 10“7h 

3 x 10“7h 

1 x 10“ : 


Short to adjacent circuit, Xo 

1x10“' 

9 -l x 10“7h 
6 -l x 10“7h 

Wires (typical circuit, 

Open circuit, 4 

1 x 10“ 

several joints) 


Short to ground, 4 

3 x 10“7h 

3x10“ 

-3 x 10“7h 


Short to power, Xo 

1 x 10“ 8 /h 

1 x 10 _6 /h 

1x10“ 

9 -l x 10“7h 
7 -l x 10“ 5 /h 

Instrumentation 

Failure to operate, 4 

1 x 10“' 

(amplification annunciators 
transducers, combination) 


Shift in calibration, 4 

3 x 10“7h 

3x10“ 

-3 x 10“ 4 /h 

Pressure switches 

Failure to operate, Qd 

1 x 10“ 4 /d 

3x10“ 

5 —3 x 10“ 4 /d 

Limit switches 

Failure to operate, Q d 

3 x 10“ 4 /d 

1x10“ 

4 — 1 x 10“ 3 /d 

5 - 3 x 10“ 4 /d 

Valves (manual) 

Failure to remain open (plug), Q d 

1 x 10“ 4 /d 

3x10“ 


Rupture, 4 

1 x 10“ 8 /h 

1x10“' 

9 -l x 10“ 7 /h 
4 -1 x 10“7d 

Valves (air-fluid operated) 

Failure to operate, Q d b 

3 x 10“ 4 /d 

1x10“' 


Failure to remain open (plug) c 

Qd 

1 x 10“ 4 /d 

3x10“ 

5 —3 x 10“ 4 /d 


4 

3 x 10“7h 

1x10“' 

7 —1 x 10“ 6 /h 
9 -l x 10 7h 
4 -3 x 10 3 /d 


Rupture, 4 

1 x 10“7h 

1 x 10“ ! 

Valves (motor operated, 

Failure to operate, Q d b 

1 x 10“ 3 /d 

3x10“ 

includes driver) 


Failure to remain open (plug) c 

Qd 

1 x 10“7d 

3x10“ 

5 -3 x 10“ 4 /d 


4 

3 x 10“7h 

1x10“' 

7 —1 x 10“ 6 /h 
9 -l x 10 7h 
4 -3 x 10“ 3 /d 


Rupture, 4 

1 x 10“7h 

1 x 10“ ! 

Valves (solenoid operated) 

Failure to operate, Q d b 

1 x 10 _3 /d 

3x10“ 


Failure to remain open (plug), Q d 

1 x 10 _4 /d 

3x10“ 

5 —3 x 10“ 4 /d 


Rupture, 4 

1 x 10“7h 

1 x 10“ ! 

9 -lxl0“ 7 /h 
6 -3 x 10“7d 

Relief valves 

Failure to open, Q d 

1 x 10“7d 

3x10“ 


Premature open, 4 

1 x 10“7h 

3x10“ 

6 —3 x 10“7h 
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Table A14.4 (continued) 






Median 

Failure rate 

Range 

Check valves 

Failure to open, Q d 

1 x 10 _4 /d 

3 x 10 _5 -3 x 10 _4 /d 


Internal leak (severe), 4 

3 x 10“ 7 /h 

1 x 10 _8 /h 

1 x 10“ 7 -1 x 10 _6 /h 

1 x 10“ 9 -1 x 10 _ 7h 

3 x 10 -4 —3 x 10 _ 7 d 


Rupture, 4 

Pumps (including driver) d 

Failure to start, Qd 

1 x 10 _3 /d 

3 x 10 _6 /h 


Failure to run, given start, in normal 
environment, 4 

3 x 10 _6 -3 x 10 _4 /h 


Failure to run, given start, in extreme 
post-accident environment inside 
containment, 4 

1 x 10 _3 /h 

1 x 10“ 2 -1 x 10 _4 /h 

Pipes < 3 in. (per section) 

Rupture/plug, 4,4 

1 x 10 _9 /h 

3 x 10 -11 —3 x 10 _8 /h 

> 3 in. (per section) 


Rupture/plug, 4.4 

1 x 10 /h 

3 x 10 —3 x 10“7h 

Gaskets (containment quality) 

Leak (serious) in post-accident situation, 4 

3 x 10 _6 /h 

1 x 10“ 7 -1 x 10 _4 /h 

Elbows, flanges, expansion 

Leak (serious) in post-accident situation, 4 

3 x 10 _7 /h 

1 x 10 _8 -1 x 10 _5 /h 

joints (containment quality) 

Welds (containment quality) 

Leak (serious) in post-accident situation, 4 

3 x 10 /h 

1 xlO —1 xlO /h 

Clutches (mechanical) 

Failure to operate, Q d b 

3 x 10 _4 /d 

1 x 10“ 4 -1 x 10 _3 /d 


a Qd = failure/demand; Ao=failure/h in operational mode; 4=failure/h in standby mode. The unit d in this table stands for demand. 
b Demand probabilities are based on the presence of proper input control signals. 

c Plug probabilities are given as probabilities per demand and as rates per hour, since the plug is generally time-dependent but may only be 
detected upon a demand on the system. 

d Turbine-driven pump system may have significantly higher failure rates. 


In the following, brief descriptions are given of six 
principal databases: the NCSR, ERDS, FACTS EIREDA, 
OREDA, and GIDEP databases. Other databases include 
the EOF database (Procaccia, 1991); the IAEA database 
(Tomic and Lederman, 1991); the CREDO database at 
ORNL (Knee, 1991); the Dante database (Mizuta etal., 1991), 
the SRDF database (AUPIED and PROCACCIA, 1984), 
the SKI-PIPE database (Lydell 2000), and the database 
operated for SRD Association by AEATechnology etc. 

A14.9.1 Design of database 

As to its definition, a database is first of all a computer 
system, which may have billions of data collections. The 
construction of a database involves the translation of the- 
logical data model, giving the relationships between 
the data field into the physical database embodied in the 
computer. This is ensured by the database management 
system (DBMS). Many software companies have developed 
very effective database management programs that can 
be tailored for any specific needs. Four main architecture 
models of the database management system are the hier¬ 
archical, network, relational and object models. The char¬ 
acteristics and merits of these different approaches for 
reliability databases are discussed in EsReDA (1999). 

Information about components held in the database comes 
under two main heads: the component inventory and the 
component history; The component inventory contains a 
description of each component on which information is held. 
The component history gives the detailed failure and main¬ 
tenance history of each component. Both for component 
inventory and component history the design of the data set to 
be held is not a trivial question. For inventory it is first neces¬ 
sary to define the component boundary. Avalve actuator, for 
example, may not remain permanently on the same valve. 

It is then necessary to specify the attributes of the com¬ 
ponents. This involves deciding the degree of subdivision 


or, alternatively, the level of aggregation. Excessive sub¬ 
division results in samples which are too small, while 
excessive aggregation lumps together items that differ 
significantly. 

For component history, information is typically recorded 
on failure mode and failure cause. Here the problem is 
the tendency toward excessive subdivision by creation of 
additional failure mode and cause categories. This problem 
is aggravated if numbers of persons are authorized to 
extend these categories. 

It is also desirable tohave aplain language fault descriptor. 
Experiencesuggeststhatasetofpre-specifieddescriptorsis 
on some occasions too detailed and on others not detailed 
enough, and that there is value in a facility to use free text. 

In general, it is desirable to store the data in their ‘origi¬ 
nal’ form rather than in an abstracted form, which involves 
loss of information. For this reason, the data in a reliability 
data bank may be stored as a set of events from which 
statistical data may then be obtained. 

Early reliability databases tried to account for environ¬ 
ments and other conditions via Korn factors, such as MIL- 
HDBK 217F and Green and Bourne (1972). Most of them 
give point estimates of failure rates without indicating the 
bound and confidence level. Modern reliability databases 
provide failure rates on categorized failure modes, like 
IEEE-Std-500 (1984), OREDA (1984, 1992, 1997, 2002), 
EIREDA (1991) and CCPS (1991). IEEE-Std-500, OREDA 
(1984,1992,1997,2002) and CCPS (1991) provide upper and 
lower values on failure rates and EIREDA (1991) provides 
confidence level with error factors. 

Many efforts have been carried out to standardize data¬ 
base design. Further discussion on database design can be 
found in Ireson, Coombs, and Moss (1996), Cooke and 
Bedford (2002) and the vol. 51, num. 2 of Reliability Engi¬ 
neering and System Safety which is specially devoted to 
reliability database design. 
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Table A14.5 Some data on equipment failure rates 
(D.J. Smith, 1985; reproduced by permission of 
Macmillan) 


Equipment 

Failure rate a 
(failure/10 6 h) 


Compressor 




Centrifugal, turbine driven 

150 



Reciprocating, turbine driven 

500 



Electric motor driven 

100 

300 


Diesel generator 

125 4000 



(0.97 start) 



Electricity supply 

110 



Gaskets 

0.02 

1 


Heat exchanger 

1 

40 


Pipe joint 

0.5 



Pumps 




Centrifugal 

10 

30 

80 

Boiler 

100 

500 


Fire b 

100 

150 


Fuel 

6 

50 


Oil lubrication 

10 

30 

100 

Vacuum 

20 



Turbine, steam 

30 

80 


Valves 




Ball 

1 

3.5 


Butterfly 

1 

20 

30 

Gate 

1.5 

15 


Relief 

4 

9 


Non-return 

2 

5 


Slam shut 

10 

30 


Solenoid 

1.5 

10 

30 

Valve actuators c 




Fail open 

0.1 

4 


Spurious close 

5 

40 



a Entries are given in three formats: a single value, where the various 
references are in good agreement; two values, indicating a range; and 
three values with one in bold, indicating a range with the value in bold 
predominating. Bold is also used for one end of a range, where that 
value predominates. 

b Approximately 800 for a complete fire pump and priming system. 
c Depends on the complexity of the pneumatic circuit; requieres 
FMEA. 


A14.9.2 Operation of database 

The operator of a reliability database has to maintain a 
sufficient flow of data from the data suppliers, synthesize 
the data from different sources, and satisfy the needs of the 
data users in a manner which is cost effective. This is no 
easy task. 

Fresh data are the lifeblood of a reliability data bank. 
There must be a sufficient incentive for an organization to 
supply them, either by collecting them itself or by allowing 
access for their collection. Typically it will be one that is 
also a user of the database. 

The data user will have a set of requirements, which 
often can be met only in part. Ideally the user would like 
data from which to obtain failure and repair time distribu¬ 
tions, and so on. Often these will simply not be available, 
the best on offer being perhaps failure or repair rates based 
on a constant rate assumption. There may also be problems 
of sample size. The data bank operator has to balance the 
often-conflicting requirements of user demand, data sup¬ 
ply and economy in handling. 


A14.9.3 Data acquisition 

Information on equipment for the component inventory is 
obtained from the plant documentation, which includes 
equipment records and equipment and plant drawings. 
Acquisition of the inventory data for a plant may not be 
straightforward. Records and drawings may be incomplete 
from the outset, and it is even more common that modi¬ 
fications made are not entered. There can be confusing 
identifications, with the same item allocated several quite 
different code numbers. 

There can be a corruption of the component design 
parameters, with differences between the item as designed 
and as purchased and installed being quite common. As 
Cross and Stevens comment: ‘It is incredible how poor the 
average plant inventory records are’. 

For information on equipment failure and repair a basic 
source of information is the j ob card or ticket. Typically this 
gives as a minimum the identity of the equipment, the 
failure notified or diagnosed and the repair work done. 
Other documentation such as logbooks, permits-to-work 
and stores requisitions are generally useful as cross-checks 
rather than prime sources. Sometimes, vendors’ test data 
can also be used as a supplement source. 

To the extent practical, the failure data should be such 
as to permit analysis to obtain failure distributions as well 
as average values. This implies that the data should give 
the times to failure for individual equipment rather than 
just the total number of failures. This greatly enhances the 
value of the data to the data analyst. 

Some data require a degree of reinterpretation or filter¬ 
ing. One common problem is the failure that presents as a 
cluster of events arising over a short time interval. This 
may take several forms, each of which involves events that 
are in some sense dependent. One is the repair that is 
unsatisfactory so that failure recurs almost immediately 
and the work has to be done again. Somewhat similar is 
the repair that is made in several passes such as a leaking 
valve which is first tightened, then repacked and finally 
replaced. A third situation is the nearly simultaneous fail¬ 
ure of a number of items due to a common cause. 


A14.9.4 NCSR database 

The NCSR Reliability Data Bank is a major database sys¬ 
tem which has been in operation for over twenty years ser¬ 
ving the nuclear, aerospace, electronics, oil, chemical and 
other industries. Accounts of the early database and 
SYREL data bank have been given by Barnes (1967 
UKAEA AHSB(S) R138), Ablitt (1973 SRS/GR/14) and 
Fothergffl (1973 SS/GR/22). The mature database has 
been described by Cannon (1991a,b). An account of further 
developments in the database is given by Cross and Stevens 
(1991). 

As described by Cannon (1991a) the data bank about the 
mid-1980s consisted of data stores for (1) generic reliability, 
(2) events, (3) accidents, (4) human reliability, and (5) mal- 
operation. Much of the data collection was carried out by 
placement of students in cooperating companies. Cannon 
gives examples of the use of the databank, including cases 
where application of the data resulted in reductions in the 
observed failure rates. 

Cross and Stevens (1991), writing from the perspective of 
the user as well as the operator of a data bank, describe the 
transition of the NCSR system from a system which was 
based originally on 1960s technology, using mainframe 
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Table A14.6 Example of best-estimated reliability parameters from some equipment (Lannoy and Procaccia, 1996; 
reproduced with permission from Elsevier) 

Equipment Main Character 

Mean failure 
rate (10“6/h) 

Range 

(10“7h) 

Failure on 
demand (10“ 

Range 

3 /d) (10 7 d) 

MMTR (h) 

Accumulator, nitrogen driven 






Pressurized P < 50 bar; 

T < 50°C 

Compressor, motor driven 

0.52 

0.2-0.8 

0.03 


2.6 

Centrifugal P: 6—40 bar; 

kW: 360 

81 

60-104 

0.18 

0.09-0.25 

2.6 

Reciprocating P “ 10 bar; 

kW: 5-85 

782 

506-1108 

0.3 

0.2-0.38 

5 

Water filter P: 10-190 bar 

(paper) 

Heat exchanger 

2.3 

1.5—3.1 



6 

Plate P: 7-155 bar 

T: 30—220°C 

20.7 

19-22 

0.01 

- 

9 

Shell/tube 

0.55 

0.08-0.9 

- 

- 

25 

Shell/tube P: 155 bar; 

71 200—300°C 

0.31 

0.005-0.5 

0.02 

- 

25 

Shell/tube P: 7-50 bar; 

71 50-220°C 

Pump, centrifugal multistage 

0.83 

0.2—1.3 



25 

Motor/turbine kW: 300/400 head: 

driven 3 900 m flow: 80 m 3 /h 

174 

125-228 

0.2 

0.1-0.3 

34 

Turbine driven kW: 2200/5300 
head: 570 m flow 
<3300 m 3 /h 

10 

7-14 

0.15 

0.11-0.27 

13 


a Standby pump. 


computers, large in size and not readily modified, to one uti¬ 
lizing modem database methods and implemented on PCs. 

Of the two basic formats for storage of information, 
summary and complete record, the NCSR system utilizes 
the latter, so that complete details of each event are held. 
From these complete records statistical data can then be 
abstracted as required. 

A14.9.5 ERDS database 

The European Reliability Data System (ERDS) is an EC 
database operated by the JRC at Ispra. It is described by 
Capobianchi (1991). 

ERDS acquires its data from European and other data¬ 
bases, and is therefore in effect a database of databases. It is 
oriented particularly to serve the nuclear industry. 

The data are rendered homogeneous by conversion to a 
uniform format. This format is specified in a detailed sys¬ 
tem of classification - the Common European Reference 
Classifications, which is thus by way of being a European 
standard. 

ERDS has four main data subsystems: (1) the Component 
Event Data Bank (CEDB), (2) the Abnormal Occurrences 
Reporting System, (3) the Operating Unit Status Report 
and (4) the Reliability Parameter Data Bank. Among them, 
the CEDB stores the component characteristics, historical 
information, and failure information and is the central sub¬ 
system, which serves and is connected to the other three 
subsystems. 


A14.9.6 FACTS database 

The Failure and Accident Technical Information System 
(FACTS) is an incident data bank operated by TNO in the 
Netherlands. It is described by Koehorst and Bockholts 
(1991). 

FACTS gathered the information about near-misses, 
minor accidents and major accidents associated with 
hazardous materials. Nuclear materials and military 
activity are excluded for its scope. The information is 
derived from the literature; from companies; from inspec¬ 
torates, fire services, etc.; and from FACTS agencies in 
other countries, respecting anonymity. Press reports serve 
as triggers to acquire information. 

Features of the database are a schedule of accident attrib¬ 
utes and values and a hierarchical keyword structure. 
Another structure is the cause classification in which the 
course of the accident is translated into a sequence of 
occurrences. 

This makes it possible to trace back from an event down 
the causal chain. The original plain text accounts are held 
on microfiche. 

Applications of the system described by the authors 
include (1) analysis of the role of instrumentation in 
accidents; (2) analysis of incorrect human response and 
(3) compilation of a reference book to trace incident 
causes (the Cause Book), giving a survey of incident 
causes which can occur in a large number of systems 
and operations. 
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Further analysis is given in An Analysis of Accidents with 
Casualties in the Chemical Industry Based on Historical Facts 
by Koehorst (1989). 

Developments of the system include an expert system 
front end. 

A14.9.7 OREDA database 

The Offshore Reliability Data (OREDA) project is an off¬ 
shore reliability database described in the handbook by 
OREDA (1984,1992,1997, 2002). It gives failure rates, fail¬ 
ure mode distribution and repair data for offshore instal¬ 
lations, mainly in the UK and Norwegian sectors of the 
North Sea. 

A substantial effort was devoted to the design of the 
system to ensure as far as possible that the components, 
their boundaries and environment, are well defined and 
that the data obtained are high quality and statistically 
meaningful. The database is fully explained in the OREDA 
handbook, which describes the system, gives the data and 
outlines the statistical treatment. Some discussion about 
the data collection and application of this project can be 
found in Groenendijk (1995), Sandtorv, Hokstad and 
Thompson (1996), Rausand and 0ien (1996), Haugen, 
Hokstad and Sandtorv (1997), Langseth, Haugen and 
Sandtorv (1998). 

The project therefore serves as a good illustration of 
a reliability database and is widely recognized as a stand¬ 
ard information source for risk analysis. 

The project is supported by ten major oil and gas com¬ 
panies: AGIP, BP, Elf, Esso, Norsk Hydro, SAGA, Shell, 
Statoil and Total. The data cover (1) process systems, 
(2) control and safety systems, (3) electrical systems, (4) uti¬ 
lity systems, (5) crane systems and (6) subsea equipment 
and drilling systems. 

The component inventory gives the following informa¬ 
tion: (1) brief description, (2) application, (3) operational 
mode (continuous, standby, protective, etc.), (4) internal 
environment (fluids handled), (5) external environment 
and (6) boundary specification, including a sketch. The 
operating data include (1) population at risk, (2) number of 
installations supplying data, (3) total calendar and opera¬ 
tional times and (4) number of demands (where applicable). 
The failures are broken down into four different catego¬ 
ries of severity: (1) critical, (2) degraded, (3) incipient and 
(4) unknown severity; there may be a number of modes 
in each category. The failure and repair data comprise 
(1) number of failures, (2) failure modes, (3) failure rates for 
each failure mode, (4) active repair time and (5) repair time. 
Mean and lower and upper bound values are given for the 
failure rates and mean, minimum and maximum values for 
the repair times. The active repair time is the average time 
required to analyse and repair the item and return it 
to service, excluding time to detect the fault and isolate the 
equipment and any delay due to tools or spares. The repair 
time is the number of manhours required for the repair. The 
failure and repair data are given for each mode and for the 
equipment overall. 

Some of the events recorded in the OREDA as failures 
are those such as failure to start and spurious trip. 

The number of installations participating, the number of 
components at risk and the number of failures experienced 
are very variable. In many cases the population at risk is 

The handbook states that data in the form of times 
between failures are collected, but that confidence in the 


statistical data varies between the different generic groups 
and that for most purposes time-independent failure rates 
are a relevant approximation. It does not give data on times 
between failures. 

A14.9.8 EIReDA database 

The EIReDA (European Industry Reliability Data Bank) is 
operated by ESReDA, which is established in 1992 by 
EuReDATA (European Reliability Data Bank Association) 
and ESReDA (European Safety and Reliability Research 
and Development Association) jointly. The original data 
were collected from 50 nuclear power plants operated by 
Electricite de France from 1978 to 1995 and analysed using 
Bayesian methodology. The data bank contains failure 
rates (for critical failure modes only) and mean repair time 
data for mechanical components, electrical components 
and instrumentation and control equipment. A full 
description of the data bank is provided in EsReDA (1998), 
which describes the scope, the choice of components, the 
definition of boundaries, and the statistical treatment. 

Engineering and operational characteristics are provided 
in detail for each item of equipment, as well as a color photo¬ 
graph, a general drawing and the boundaries. Background 
information such as inventory and service year is also pro¬ 
vided. Comparable data are listed in a separate table, com¬ 
piled from otht illy WASH 1400, 

IEEE 500, RKS 85-25; EuReDATA and ESReDA project 
reports and publications, and other power plant, modern 
petrochemical and processing plants). The methodological 
application to other industries is included in the appendix. 

A14.9.9 GIDEP database 

GIDEP (Government Industry Data Exchange Program) 
was established in 1959 as the Inter-service Data Exchange 
Program (IDEP) by the US government to reduce expendi¬ 
tures of resources in the life cycle of systems facilities and 
equipment through share of data among government 
agencies and industry organizations. 

To make use of GIDEP database, an agency or company 
has to be a full or partial participant of GIDEP program. 
GIDEP is currently participated by thousands of agencies 
and industries. 

Information on parts, processes and materials they use 
or manufacture is submitted to the GIDEP Operations 
Center by government and industry participants. 

The program maintains six major types of data: (1) engi¬ 
neering data; (2) failure experience data; (3) metrology 
data; (4) product information data; (5) reliability- main¬ 
tainability data and (6) urgent data requests. GIDEP is 
DOD’s centralized database for Diminishing Manufactur¬ 
ing Sources and Material Shortages (DMSMS). 

A14.10 Inventory 

A14.10.1 Inventory of plants 

Information is sometimes required on the number of plants 
at risk, either nationally or world-widely. This is needed, for 
example, in order to convert data on the number of a par¬ 
ticular type of event, for example, vapour cloud explosions, 
into a frequency per plant. 

Data on the number and capacity of chemical and petro¬ 
chemical plants in various countries are given in the 
publications by SRI International which include Directory 
of Chemical Producers - United States 1988 and Directory 
of Chemical Producers - Western Europe 1988 (SRI Int., 
1988b,c). 
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From the SRI data for the United States (US) and Western 
Europe (WE): 


US WE UK 


No. of chemical/petrochemical plants 1420 1455 185 


The following ratios 
for the plant capacity: 

i apply for the number of plants and 


US/WE 

UK/WE 

No. of plants 

0.92 

0.12 

Plant capacity 

1.08 

0.12 


For petroleum refineries similar data are given in the 
International Petroleum Encyclopaedia 2002 ( IPE, 2002). 
From IPE data 


Region Africa Asia East Middle North South West 

Europe East America America Europe 


No. of 46 203 94 46 170 68 105 

refineries 


The countries having ov 

er 10 refineries from IPE (2002) 

data are listed below. 


No. of refineries 

United States 

143 

China 

95 

Russia 

42 

Japan 

35 

Canada 

21 

Germany 

17 


17 

Italy 

17 

France 

13 

Brazil 

13 

United Kingdom 

11 

Argentina 

10 

Australia 

10 

Romania 

10 

World total 

732 


A refinery contains a number of major units and this 
number varies. Information given in periodic surveys (e.g. 
Anon., 1985dd) suggests an average value of about five 
such units per refinery. 

Information is also available on the number of installa¬ 
tions that attract certain regulatory controls. In the United 
Kingdom, the number of installations notifiable under the 
NIHHS Regulations 1982 has been given by Pape and 
Nussey (1985) and by Pape (1989) as 


LPG 600 

Natural gas 400 

Chlorine 120 

Total 1600 


Of the LPG installations 450 are storage installations 
and 130 gas cylinder storages. 

In a discussion of the CIMAH Regulations 1984 (later 
superseded by COMAH) Welsh (1993) states that over 400 
safety reports have been submitted. In interpreting this 
figure, it should be borne in mind that the number of 
reports is necessarily be equated to the number of CIMAH 
installations. CIMAH Regulation 1984 was later replaced 
by COMAH Regulation in the United Kingdom, which is 
stricter and came into force in the February of 1999. A total 
of 3-5000 top-tier major hazard plants in Europe are 
expected to submit safety, of which the United Kingdom 
has 438 with a further 843 lower tier installations. 

A14.10.2 Ammonia plants 

Estimates of the number of ammonia installations and 
carriers have been given by Baldock (1980) and are shown 
in Table A14.7. 


A14.11 Inventory of equipment in plants 

Another estimate that may be required is the number of 
potential leak sources on a plant. Information on the num¬ 
ber of fittings and valves on pipework of different dia¬ 
meters has been given by Hooper (1982) in the context of 
cost estimation and is shown in Table A14.8. 

Numbers of potential leak sources on various types of 
plant have been given, mainly in the context of fugitive 
emissions. Table A14.9 shows the numbers given by T.W. 
Hughes, Tierney and Khan (1979) for some potential leak 
sources in four petrochemical plants and Table A14.10 those 
given by D.P. Wallace (1979) for some sources in a single 
medium sized plant. Table A14.ll shows data given by Lip- 
ton and Lynch (1987) on the number of some sources in a 
large refinery. Table A14.12 after Wetherold (1983) gives the 
number of valves in a refinery and in two other plants. 

Using such data, it is possible to construct a profile of the 
potential leak sources on a typical plant. 

In a study of fugitive emissions from the ethylene oxide 
production industry, equipment containing more than 
1 wt % ethylene oxide is surveyed in 13 major EO plants by 
Berglund, Romano, and Randall (1990). 


A14.12 Vessel and Tanks 

The failure rates of pressure vessels are discussed in 
Chapter 12. 


Table A14.7 Estimated number of ammonia installations 
and carriers 


Estimated no. world-wide 

Plants 

2,000 

Storage areas 

1,000 

Vessels 

10,000 

Refrigeration plants 

100,000 

Transfer points 

1,000 

Road tankers 

1,000 

Rail tankers 

5,000 

Ammonia ships 

20 

Pipeline miles 

2,000 


Source: Baldock (1980), table 2. 






















FAILURE AND EVENT DATA APPENDIX 14/15 


Table A14.8 Pipework fittings and valves 


Nominal 

pipe 

diameter (in.) 

Total length 
of pipe (ft) 

Number of 
fittings 

Flanges 

Valves 

% 

33,990 

1,818 

11,589 

% 

33,123 

2,973 

7,551 

1 

124,513 

12,552 

10,363 

IVa 

121,212 

7,299 

3,313 

2 

142,891 

11,727 

4,199 

3 

125,550 

10,427 

2,441 

4 

84,705 

6,608 

1,346 

6 

77,717 

4,578 

898 

8 

67,667 

3,592 

466 

10 

39,225 

1,613 

301 

12 

16,445 

762 

162 

14 

3,997 

342 

72 

16 

10,292 

506 

90 

18 

3,530 

362 

41 

20 

5,698 

804 

34 

24 

5,983 

357 

40 

30 

3,121 

255 

13 

36 

1,608 

66 

12 

Source: Hooper (1982), 

table on p.128. 




Table A14.9 Inventory of potential leak sources: number 
of sources on four petrochemical plants 


Leak 

source 

No. of items 
Monochloro¬ 
benzene 
plant 

Butadiene 

plant 

Ethylene 

oxide/glycol 

plant 

Dimethyl 

thalate 

plant 

Flanges 

1500 

26,000 

NA a 

NA 

Valves 

640 

6,700 

NA 

NA 

Pumps 

25 

174 

69 

67 


Source: TW. Hughes,Tierney and Khan (1979), table 3. 
a NA: not available. 


Table A14.10 Inventory of potential leak sources: 
estimates of number of leak sources on a medium-sized 


plant 

Leak source 

No. of items 

Flanges 

2410 

Valves 


In-line, gas 

365 

In-line, liquid 

670 

Open-ended 

415 

Pump seals 


Packed 

6 

Mechanical, single 

43 

Mechanical, double 

10 

Compressor seals 

2 

Safety relief valves 

50 


Source: D.P. Wallace (1979), p. 92. 


Table A14.11 Inventory of potential leak sources: 
estimated number of sources in a large refinery 

Leak source 

No. of items 

Flanges 

46,500 

Valve 

11,500 

Pump seals 

350 

Compressors 

70 

Relief valves 

100 

Drains 

650 


Source: Lipton and Lynch (1987), table 7.2. 


Table A14.12 Inventory of potential leak sources: 
number of valves in a refinery and two other plants 


A No. of valves in three plants 

No. of valves 

Large integrated refinery 

21,800 

Large olefins plant 

15,000 

Cumene process unit 

1,179 

B No. of valves on different duties ii 

n large refinery 

Leak source 

No. of items 

Valves 


Gas and light liquid only 

13,334 

All 

21,776 


Source: Wetherold (1983), tables 1 and 3. 


Estimated failure rates of storage tanks quoted by 
Batstone and Tomi (1980) are shown in Table A14.13. 

Data on the failure rates of storage tanks in ammonia 
and LNG are given in Sections A14.25.2 and A14.24, 
respectively 

Data on storage tank fires are given in Section A14.28.5. 

A14.13 Pipework 

The failure rates of pipes are discussed in Chapter 12. 

De la mare and his coworkers developed pipeline inven¬ 
tory and pipeline failure and repair history databanks for 
the North Sea area. Some of their statistic results are shown 
in Tables A14.14-A14.18. 

Data on the failure rates of gaskets are given in Tables 
A14.3-14.5 and by Pape and Nussey (1985). 

Comparison of these values gives for the failure 
frequency of gaskets: 


Failure frequency (failures/year) 

Smith: Lower limit 

0.00018 

Upper limit 

0.0088 

UKAEA 

0.0044 

Rasmussen Report 

0.026 

Pape and Nussey 

4 x 10 -5 (average) 


























APPENDIX 14/16 FAILURE AND EVENT DATA 


A14.13.1 Bellows 

There is a potential ambiguity in the term bellows, which 
may refer to bellows used in instrumentation or to those 
used in pipework. 

The UKAEA data on the failure rate of bellows in Table 
A14.3 gives a failure frequency of 5 x 10 -6 failures/year. 
D.J. Smith (1985) gives a failure rate of 4 x 10 -6 failures/year. 


A14.14 Heat Exchangers 

Data on the failure rates of heat exchangers are given in 
Table A14.5. 

Some information on the failure rate of heat exchangers 
has been given by C.F. King and Rudd (1972) in a reliability 
study of a heavy water plant.With some 21 heat exchangers, 
the MTTF ranged from 677 to 7865 h. 

For offshore shell and tube heat exchangers, the data 
given by OREDA (1997) include the following (all failure 
modes included): 


To be statically justifiable, minimums of 3,500,000 calendar 
hours were established for each component. They reported 
0.07601 failures/year for electric air compressor and 0.01033 
failures/year for fuel air compressor (Hale and Arno, 2001). 

A14.15.2 Fans 

Data on the failure rates of fans are given in Table A14.45. 

A14.15.3 Pumps 

There are wide variations in the type, duty and environ¬ 
ment, and hence in the failure rate, of pumps. However, 
many pumps have a failure rate of some 1-5 failures/year. 
Data on the failure rates of pumps are given in Tables 
A14.3—A14.5. 

D.J. Smith (1985) gives the failure modes of pumps as 
about 50% leakage and 50% no transmission. 

Some information on the failure rate of pumps has 
been given by C.F. King and Rudd (1972) in a reliability 
study of a heavy water plant. MTTFs for four auxiliary 



Population 

No. of 
failures 

Failure rate 
(per 10 6 h) 

Mean repair 
time (manhours) 

Crude oil —> > sea water (1000—3000 kW) 

2 

0 

35.14 (upper limit) 


Crude oil -» > sea water (1000-10,000 kW) 

10 

29 

94.42 

145.0 

Gas -* > gas (1000-10,000 kW) 

4 

5 

75.02 

48.2 

Gas -> > gas (10,000-30,000 kW) 

1 

5 

142.60 

3.4 

Gas -> > sea water (100-1000 kW) 

4 

3 

31.16 

14.7 

Gas -f > seawater (1000-10,000 kW) 

4 

12 

85.62 

53.2 

Gas —► > water/glycol (1000—3000 kW) 

3 

5 

79.61 

47.4 

Gas —> > water/glycol (1000—10,000 kW) 

5 

13 

120.24 

45.0 

Gas —> > water/glycol (10,000-30,000 kW) 

12 

38 

121.64 

64.4 


A14.15 Rotating Machinery 

A14.15.1 Compressors 

Data on the failure rates of compressors are given in 
Table A14.5. 

For offshore compressors the data given by OREDA 
(1997) include the following (all failure modes included): 


Population 

No. of 
failures 


Failure rate (per 10 6 h) 

Mean repair 
time (manhours) 


Lower 

Mean 

Upper 

Centrifugal, electric motor driven 

100-1000 kW 5 

58 

2.64 

550.66 

2106.50 

20.6 

1000-3000 kW 14 

204 

174.54 

880.21 

2033.05 

25.1 

3000-10,000 kW 9 

398 

1157.79 

2433.02 

4088.47 

48.2 

Centrifugal, turbine driven 

9 

586 

122.28 

2449.88 

7341.37 

29.6 

Reciprocating, electrical motor driven 

1000-3000 kW 4 

352 

2293.78 

2509.70 

2741.16 

9.6 

3000-10,000 kW 4 

317 

4029.38 

5388.42 

6909.82 

98.6 


The Power Reliability Enhancement Program (PREP) of 
the US Army corps of Engineers conducted a study of the 
operational and maintenance data on 204 power generation, 
power distribution and HVAC components (Hale and Arno, 
2001). Efforts focused on the equipment installed after 1971. 


pumps ranged from 51 to 398 days according to 
maintenance data, but from 12.5 to 439 days according to 
production data. 

An account has been given by R. James (1976) of a pump 
maintenance program on 880 major process pumps, mainly 
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centrifugal pumps, aimed at eliminating premature 
wearout failures, in which the MTBF of the pumps was 
raised from 8.7 to 12.2 months. 

In accounts of pump reliability improvements by a par¬ 
ticular manufacturer (Anon., 1985x; Bloch and Johnson, 
1985) it is stated that for pumps the industry average 
MTBF is some 6 months, corresponding to a failure rate of 
2 failures/year. Bloch and Johnson state that ANSI 


Table A14.13 Estimated failure rates of storage tanks 


Failure rate 
(failures/10° year) 

Atmospheric tank 

30 

Refrigerated tank 


Single wall 

10 

Double wall 

1 


Source: Batstone and Tomi (1980), table Al. 


Table A14.14 Failure frequency varying with pipeline 
status and location (de la Mare, Bakouros and Tagaras, 
1993; reproduced with permission from Elsevier) 


Near platform Open Sea Near Shore 


Installation 4 19 0 

Hydrotest 5 5 0 

Operation 15 7 2 


Table A14.15 Failure frequency varying with cause of 
failure and location (de la Mare, Bakouros and Tagaras, 
1993; reproduced with permission from Elsevier) 



platform 

Open 

Near 

shore 

Material 

1 

3 

0 

Construction 

3 

10 

0 

Corrosion 

4 

0 

0 

Anchors 

5 

7 

0 

Fishing activity 

0 

1 

0 

Scour-vortex 

4 

4 

2 

Manufacturer 

1 

0 

0 

Constructor’s equipment 

2 

2 

0 


standard pumps have an MTBF of 13 months, or failure rate 
of 0.9 failures/year. It is claimed, however, by Anon. (1985x) 
that specified improvements have resulted in the achieve¬ 
ment of an MTBF of some 25 months, or failure rate of 
0.48 failures/year. For individual features improvements 
are said to have extended the lives of the ball bearings, the 
mechanical seal system, the shaft and the coupling to 5,2.5, 
15 and 7 years, respectively. 

A study of 85 ethylene plant pumps has been reported 
by Sherwin (1983). There were 243 failures and the failure 
rate was 1.8 failures/year. The failure modes are shown in 
Table A14.19 

Data on the failure rates of pumps in LNG plants are 
given in Table A14.44. 

A study of feedwater pumps in French nuclear power 
stations has been made by Aupied, Le Coguiec and Procaccia 
(1983). The overall failure rate was Failure rate of feedwater 
pumps = 5.6 x 10 -4 failures/h = 4.9 failures/year 

The failure modes of the pumps are shown in 
Table A14.20. 

A survey of pump mechanical seals by BHRA has been 
reported by Flitney (1987) in which pumps were surveyed 
in three refineries and five chemical plants, a sample of 
some 200-300 pumps being taken at each site. The two 
principal reasons for seal removal were 


Leakage 66% 

Bearing replacement 12 % 


Mechanical seals are also the subject of a study at 
Esso reported by N.M. Wallace and David (1985). They 
give a table of seal lives for some 17 cases, the lives 
varying from 2 to 12 months. For catastrophic failure of 
a pump the Rijnmond Report uses a value of 1 x 10 -4 
failures/year. 

Operational data of 505 primary coolant pumps of steam 
supply systems in 146 nuclear power plants were analysed 
and an average failure rate of 1 x 10~ 5 was suggested 
(Milivojevic and Riznic, 1989). 

Data from 320 electric submersible pumps gathered over 
a 13 -year period in Milne Point Field, Alaska were analysed 
and the mean time to failure is estimated to be 330 days 
(Sawaryn, Grames, andWhelehan, 2002). 

Some data on pumps given out by EIReDA is shown in 
Table A14.21. 


Table A14.16 Failure frequency and rate varying with diameter (de la Mare, Bakouros and Tagaras, 1993; reproduced 
with permission from Elsevier) 


Diameter 
range (inches) 

Percent by 
number of pipelines 

Percent by 
total operational 
experience a 

Failure 

frequency 

Failure rate 

(failures/1000 km-year) 

0.0-6.0 

4.8 

0.9 

0 

0.00 

6.1-12.0 

13.6 

2.7 

2 

1.71 

12.1-18.0 

20.8 

10.2 

21 

4.71 

18.1-24.0 

24.8 

10.2 

11 

2.47 

24.1-30.0 

16.8 

23.5 

7 

0.68 

>30.0 

19.2 

52.5 

16 

0.70 

Total 

100.0 

100.0 

57 

1.31 
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Table A14.17 

Failure frequency and rate varying with length (de la Mare, Bakouros and Tagaras, 1993; reproduced with 

permission from Elsevier) 








Length 

Percent by number 

Percent by 


Percent by 

Failure 

Failure rate 


range (km) 

of pipelines 


total length 


total operational 

frequency (failures/1000 km-year) 






experience:' 




0.0-2.0 

4.95 


0.18 


0.21 

1 

11.19 


2.1-10.0 

24.79 


2.37 


2.25 

8 

8.13 


10.1-20.0 

23.98 


6.57 


5.03 

13 

5.92 


20.1-50.0 

16.53 


10.84 


9.64 

3 

0.71 


50.1-100.0 

11.57 


15.96 


17.77 

4 

0.52 


> 100.0 

18.18 


64.08 


65.10 

25 

0.84 


Total 

100.00 


100.00 


100.00 

54 

1.21 


a Operational experience is defined e 

is the product of length and year of service. 




Table A14.18 

Failure frequency (F) and rate (r) varying with commissioning dates and years of operation (de la Mare, 

Bakouros and Tagaras, 1993; reproduced with permission from Elsevier) 




Years of operation 




Commissioning date 





Year 7- 

-8 

Year 9-10 

Year 11- 

-12 Year 13- 

-14 


F 


r 

F 

r 

F 

r F 

R 

1 

2 


1.8 

17 

7.2 

14 

8.2 3 

7.5 

2 

5 


2.3 

21 

4.5 

16 

4.7 3 

3.7 

3 

8 


2.2 

21 

3.0 

17 

3.3 3 

2.5 

4 

10 


2.0 

22 

2.4 

18 

2.7 3 

1.9 

5 

10 


1.6 

23 

2.0 

18 

2.6 

- 

6 

10 


1.4 

23 

1.6 

18 

1.8 

- 

7 

10 


1.2 

23 

1.4 

— 

— — 

- 

8 

10 


1.0 

23 

1.2 

- 

- - 

- 

9 

10 


0.9 

- 

- 

- 

- - 

- 

10 

10 


0.8 

- 

- 

- 

- 

- 


For offshore pumps failure data are given by OREDA 
(1992, 1997, 2002), covering motor and turbine driven 
oil pumps, motor and diesel driven fire pumps, chemi¬ 
cal injection pumps, and sea water injection and lift 
pumps. The following data were extracted from OREDA 
(1997). 


Population No. of Mean Mean 

failures failure repair 

rate time 

(per 10 6 h) (manhours) 


Centrifugal, chemical injection, processing 


51-100 kW 2 

10 

142.69 

57.1 

100-1000 kW 2 

Oil handling 

40 

570.78 

117.1 

100-1000 kW 16 

321 

533.28 

38.4 

1000-2500 kW 5 

132 

1136.97 

27.8 

2500-3600 kW 3 

98 

1357.04 

28.7 

Diaphragm, chemical injection, 

processing 


8 

35 

124.86 

31.6 

Reciprocating, oil handling 
2 

6 

105.63 

15.6 


Table A14.19 Failure modes of ethylene plant pumps 


Failure mode 

No. of failures 

Proportion (%) 

Seals/glands 

119 

49.0 

Overhauls 1 

62 

25.5 

Cleaning 

14 

5.8 

Repeat overhauls 

7 

2.9 

Leaks' 5 

7 

2.9 

Motor failures 

5 

2.0 

Couplings 

5 

2.0 

Bearings 

2 

0.8 

Other 

22 

9.1 

Total 

243 

100.0 


Source: Sherwin (1983). 

a Overhauls were not at regular intervals but as a result of conditions 
found on opening up following a failure. 
b Leaks other than those due to seals/glands. 


A14.15.4 Turbines 

Data on the failure rates of turbines are given inTable A14.5. 

A study of steam turbine failure with particular refer¬ 
ence to catastrophic failure and the generation of missiles 
has been described by Bush (1973). He quotes data from 
six major suppliers of steam turbines. The accumulated 
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Table A14.20 Failure modes of feedwater pumps in 
some French nuclear power stations 


Failure mode 

Proportion (%) 

Body, shaft 

5 

Packing 

29 

Overspeed 

10 

Contactors 

13 

Control 

16 

Lubrication 

12 

Human error 

6 


Source: Aupied, Le Coguiec and Procaccia (1983), figure, p. 149. 


operating experience is 12,330 years prior to 1950 and 
57,950 years in the period 1950-72. There were no failures 
in the earlier period and 10 in the later period. All four 
failures after 1959 were due to over-speed. Of the ten inci¬ 
dents seven generated missiles. His analysis indicates that 
the failure frequency was slowly decreasing. His estimates 
of the then current failure frequencies are 

Frequency of failure = 9 x 10 _5 /year 
Frequency failure resulting in missile generation 
= 8 x 10 _5 /year 

For offshore gas turbines failure data are given by 
OREDA (1992,1997, 2002). 


A14.16 Valves 

A14.16.1 General 

A study of valves in French nuclear power stations has 
been carried out by Aupied, Le Coguiec and Procaccia 
(1983). Some of the more critical valves are classified as 
primary valves and the others as secondary valves. Some 
of the failure rates obtained in this work are shown in 
Table A14.22, while failure modes are given inTable A14.23. 

A survey designed to identify significant and common 
valve problems such as leakage and jamming and to relate 
them to valve type, service and manufacturer has been 
described by Vivian (1985). The survey was conducted in 
a major oil company and covered 10 businesses involving 
17 facilities, of which a significant proportion are in the 
North Sea. Some quarter of a million valves were covered, 
of which almost 10% were reported as giving significant 
problems. The numbers of each type of valve are shown 
in Figure A14.4(a) and the associated problems in 
Figure A14.4(b). 

The UKAEA data inTable A14.3 gives for control valves 
a failure rate of 0.25 failures/year and for manual valves 
0.13 failures/year. The values used in the Rijnmond Report 
are 0.3 and 0.1 failures/year for control and manual valves, 
respectively. 

Further values for valve failure rates obtained by Moss 
(1977 NCSR Rll) are discussed in Section A14.25. These 
values are 0.1 and 0.01 failures/year for valves on steam and 
water service, respectively. The latter value in particular is 
a lower than the others quoted here. 

For valve rupture the Rasmussen Report gives a failure 
frequency of 1 x 10 _8 /h (0.9 x 10 -4 /year). For valves in off¬ 
shore operation, failure data are given by OREDA (1992, 
1997,2002). 


A14.16.2 Control valves 

Data on the failure rates of control valves are given in 
Tables A14.3-A14.5. Further data are given in various 
parts of this appendix. 

A14.16.3 Pressure relief valves 

For pressure relief valves (PRVs) the definition of failure is 
particularly important. Definitions of failure that may he 
used include failure of any kind, failure to lift within a 
certain proportion of the set pressure and failure to open 
on demand. The failure rates for these different types of 
failure are quite different. 

Data on the failure rates of PRVs are given in Tables 
A14.3—A14.5, A14.22 and A14.23. 

The following data are for the failure rates of PRVs are 
given by Kletz (1972a, 1974a) and by Lawley and Kletz (1975): 


Failure rate (faults/year) 


Valve fails shut 0.001 

Valve lifts heavy 0.004 

Total fail danger 0.005 (later modified to 0.01) 

Valve fails open or lifts light 0.02 

Total fail safe 0.02 


A survey of PRV inspections in a large chemical com¬ 
pany has been reported byAird (1983). Failure was defined 
as lifting 10% outside the set pressure when put under test. 
The number of useful tests was 866. The proportion of 
failures was 44.5%. 

The failure rate showed no discernible trend with 
operating time and it was concluded that PRVs may be 
subject to changes that occur relatively rapidly. One cause 
often quoted is spring relaxation. 

A study of controlled safety valves in power stations has 
been made by Oberender and Bung (1984). The valves were 
either intrinsically controlled by the vented fluid or exter¬ 
nally controlled by a control fluid (pneumatic or hydraulic). 
Two basic events were considered: faultless functioning 
and failure to open on demand. Some 1378 tests were 
conducted. The proportion of valves giving faultless 
functioning was approximately: 


Intrinsic control 40% 

External control 

Pneumatic 80% 

Hydraulic 85% 


The proportion giving failure on demand was 
approximately: 


Intrinsic control 

Load principle 2% 

Relief principle 4.5% 

External control 

Pneumatic 0.3% 

Hydraulic 0.8% 













Table A 14.21 Failure rate data of motor driven pump from EIReDA (Lannoy and Procaccia, 1996; reproduced with permission from Elsevier) 


Type 

Application 

Medium 

Main character 

Mean failure 
rate (10 _6 /h) 

Range 

(10 _6 /h) 

Failure on 
demand 
(10“ 3 /d) 

Range {10 3 /d) 

MMTR (h) 

Centrifugal 

Circulating 

water 

Fresh/salt water 

kW<4500 
head: 25 m flow 
~8000 m 3 /h 

4.7 

3-6.6 

0.20 

0.04-0.3 

41 

Centrifugal 

Containment 
drain system 

Polluted water 

kW<200 
head: 30 m 

200 

100-400 

1 

0.3-3 

20 

Centrifugal 3 

Refuelling pool 

B orated water 
(200 ppm) 

kW<75 
head: 50 m 

10.6 

7-14.5 

0.01 

<0.015 

27 

Helicoidal 

Reactor cooling 

B orated water 

kW<6100 
head: 90 m flow: 
22,400 m 3 /h 

2.6 

1.6-8.8 

0.1 

0.04-0.15 

37 

Centrifugal 10 

Chemical and 
volumetric 
control 

Borated water 

kW: 450 

head: 1770 m flow: 
34 m 3 /h 

59 

47-72 

0.12 

0.1-0.16 

22 

Centrifugal 

Makeup 

Demm. water 

kW<40 

head<190mflow: 
36 m ^h 

13.4 

9.6-17.6 

0.02 

<0.03 

16 

Centrifugal 3 

Safety 

injection 

Borated water 
(2000 ppm) 

kW<260 
head<82 m flow: 
<750 m 3 /h 

24 

11.5-48.1 

0.9 

0.55-1.25 

19 


a Intermitent operation. 

b Two out of three systems. 

c Standby pump operating hour < 1 h (test). 
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For the intrinsically controlled valves, however, there 
was an improvement over time, the failure rate falling from 
some 10% in the initial period to < 1% in the final period. 

Estimates of the success rate of PRVs in particular 
applications have been given by Prugh (1981) as follows: 


Venting of vapour/air explosion 1% 

Venting of runaway reaction 95 % 

Venting of excessive nitrogen purge 99 % 


Historical data on a 10% random sample (240 valves) out 
of 2416 relief valves in a petrochemical plant were collected 
and analysed (Alfares 1999). Figure A14.5 shows the 
composition of the sample and valves in the plant, and 
Table A14.24 shows the average time between failure by 
valve pressure, service, size, temperature and type. 

Failure data of relief valves for offshore operations are 
given by OREDA (1992,1997,2002). The following data are 
extracted from OREDA (1997): 


modes, failure causes, failure area, failure discovery 
method, extent of degradation with valve types were 
developed. Figures A14.6(a) and (b) are the distribution of 
1991-92 check valve failures and 1991 check valve popu¬ 
lation by valve type respectively. Tables A14.25 and A14.26 
are number of failures by valve type and failure mode and 
by valve type and failure cause specifically. Figure A14.7 is 
the relative failure rate by valve type and different system. 

Additional data on the failure rates of non-return, or check, 
valves are given in Tables A14.4, A14.5, A14.22 and A14.23. 

A14.16.5 Emergency isolation valves 

Failure data for safety shut-down valves from OREDA 
(1992) has been analysed by Haugen, Hokstad and 
Sandtorv (1997). The safety shut-down valves included are 
mainly gate valves of approximately 6 in. handling oil, gas 
or water in offshore installations. The data are divided into 
two groups based on the test intervals (6 months or 12 
months) as shown in Tables A14.27—A14.30. 

OREDA (1997) gives failure rate data for shutoff valves 
in offshore operations as follows: 


Type Population No. of Mean Mean 

failures failure repair 

rate time 

(per 10 6 h) (manhours) 


Globe 7 6 22.08 1.0 

(0.1—1.0 in.) 

Globe 21 9 12.30 3.4 

(1.1-5.0 in.) 

Globe 8 4 15.99 3.5 

(5.1-10.0 in.) 


A14.16.4 Non-return valves 

ORNL (Oak Ridge National Laboratory) and NIC 
(Nuclear Industry Check Valve Group) jointly conducted 
a study of check valve failures recorded between 1991 
and 1992 in the INPO (Institute of Nuclear Power Opera¬ 
tions) Nuclear Plant Reliability Data System (NPRDS) 
(McElhaney 2000). This study characterized check valve 
failures by valve type, and correlations between failure 


□ Sample 
| ■ Actual | 



0.25 0.5- 1.0 1.5- 3.0- 6 8.0 18 

0.75 2.0 4.0 10.0 

Size Group (Inch) 


Figure A14.5 The composition of the sample and 
relief valves in a petrochemical plant (Alfares, 1999; 
with permission from Elsevier) 


Type 

Population No. of Mean 
critical failure 
failures rate 

(critical 
failures 
per 10 s h) 

Mean 

repair 

(manhours) 

Gate 

104 

13 

2.10 

0.3 

(1.1—5.0 in.) 
Gate 

1 

1 

28.54 

3.0 

(20.1-30.0 ir 
Globe 

i.) 

8 

1 

5.19 

4.0 


Data on the failure rates of emergency isolation valves, 
also called slam shut or shut-off valves, are given in Table 
A14.5. Data on the failure rates of manual isolation valves 
are given in Tables A14.3 and A14.4. 

A14.17 Instruments 

For instruments the definition of failure is particularly 
important. This was discussed in detail in Chapter 13. 

The importance of the definition of failure has been 
studied by Kortland (1983) for differential pressure trans¬ 
mitters. For transmitters required to maintain their 
calibration within 2% the failure rate observed was 
0.1 failures/year. For transmitters with a required cali¬ 
bration within 5%, a less severe specification, the obser¬ 
ved failure rate was a function of the calibration interval, 
being about 0.01 failures/year with a calibration interval 
of 1 year, but increasing for longer calibration intervals. 

Some data on the failure rates of instruments are given in 
Chapter 13. The data given there refer mainly to instru¬ 
mentation in the early and mid-1970s. The data given in this 
section supplement those given in Chapter 13 and include 
more recent data. 

Data on the failure rates of instruments are given in 
Tables A14.3 and A14.4. 

A study of control system failure sequences in ammonia 
plants has been described by Prijatel (1984). A comparison 
is given between predicted and actual failure sequences. 
Information on actual failure sequences was obtained from 
the work of G.P. Williams and Hoehing (1983). Some 95% of 
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Table A14.24 Average time between failures of relief valves in a petrochemical plant (Alfares, 1999; with permission 
from Elsevier) 

Pressure 

(psi) 

<0 

0-100 

101-200 

201-300 

301-400 

401-500 

501-600 

601-700 

>700 

ATBF(m) 

22.25 

22.00 

26.83 

23.25 

16.79 

26.38 

19.95 

18.36 

28.23 

Service 

Water 

Steam 

Chemical 

Air 

HC a gas 

HC liquid 




ATBF(m) 

21.02 

20.60 

20.26 

41.11 

23.13 

22.88 




Size (in.) 

0.25 

0.5-0.75 

1.0 

1.5—2.0 

3.0—4.0 

6.0 

8.0-10.0 

18.0 


ATBT(m) 

41.00 

21.99 

24.67 

20.68 

22.58 

29.41 

24.33 

25.20 


Temp. (°C) 

1-99 

100-199 

200-299 

300-399 

400-499 

600-699 

900-999 



ATBF(m) 

31.89 

22.97 

21.94 

24.13 

19.73 

27.80 

24.29 



Type b 

CV 

BE 

TK 

BB 

BA 

PI 




ATBF 

22.76 

23.67 

32.27 

22.92 

18.80 

13.82 





a HC is hydrocarbon. 

b CV is conventional; BB balanced bellows; BE bellows; BA balanced;TK tank and PI pilot-operated. 




Fig A 14.6 (a) Distribution of 1991-92 check valve 
failure by valve type, (b) Distribution of 1991 check valve 
population by valve type (McElhaney, 2000; reproduced 
with permission from Elsevier) 


(1979). Some 870 instruments are considered in the survey. 
He gives the following availabilities: 


Analysers 


93.8% 

Gas chromatographs 


91.0% 

He also gives for analysers failure modes that include the 

following: 



Sampling system 


39% 

Analyser 


18% 

Non-availability of spares 

16% 

Plant upsets, start-up and shut-down 

11% 

A comparative study of the MTBF and maintenance time 
for controllers from five manufacturers has been described 
by H.S. Wilson (1978). He gives the following data: 

Manufacturer 

MTBF 

Maintenance 

type 

(year) 

time (h) 

A 

Electronic 1 

0.5 

B 

Electronic 1 

1.5 

C 

Pneumatic 5 

3 

D 

Electronic 3 

4 

E 

Pneumatic 15 

5 


the actual failure sequences were single event failures. 
Data on instrument failure were obtained from plant 
records and from the literature. Some of the data used in the 
study are given in Table A14.31. 

For control failure sequences the actual shut-down fre¬ 
quencies of particular units such as compressors were 
some two to four times as high as the predicted frequencies. 
The ranking of the instruments as a cause of shut-down 
was in descending order of importance controllers, 
switches, solenoid valves, control valves and unin¬ 
terruptible power supply (UPS) system, the contribution of 
these items to shut-downs being 41.2,36.7,7.5,4.6 and 4.3%, 
respectively. Thus two items, controllers and switches, 
accounted for 78% of shut-downs. 

Data on the failure rates of process chromatographs and 
other analytical instruments have been given by Huyten 


He comments that the controller from manufacturer E 
failed so rarely that the maintenance time was greater due 
to unfamiliarity. From this comment the maintenance times 
are evidently times per failure. 

Paula (1993) presented failure rates for programmable 
logic controllers (PLC) in three different processes: a US 
phenol plant, French nuclear plants and a Canadian nuclear 
power plant with data input from operation personnel 
and Electricite de France (EDF). His result is presented in 
Table A14.32. Rate of coverage, the probability of a PLC 
successfully switching to the redundant processor upon a 
single processor failure, is also estimated. 

A good deal of the literature data for instrument failure 
is now quite old. In general, it is to be expected that the 
failure rates have fallen. The following is a comparison of 
the failures rates given for certain measuring instruments 
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Table A14.25 Number of 1991-92 failures by valve design and failure modes (McEihaney, 2000; reproduced 
with permission from Elsevier) 


Disc or 
other part, 
off or broken 

Stuck 

closed 

Loose or 
detached 
part 

Stuck 

Restricted 
motion of 

Improper 

seating 

Unknown/ 
miscellaneous 

Not specified 

9 

2 

1 

12 

14 

49 

3 

Duo/double disc 

4 

0 

0 

3 

1 

27 

1 

In-line 

0 

0 

0 

4 

0 

5 

0 

Lift 

4 

24 

1 

29 

12 

194 

9 

Other 

0 

1 

0 

1 

1 

5 

3 

Stop 

0 

0 

1 

2 

2 

8 

1 

Swing 

14 

3 

12 

51 

31 

143 

34 

Tilting disc 

5 

4 

2 

8 

11 

48 

4 

Unknown 

3 

0 

9 

3 

3 

18 

0 


Table A14.26 Distribution of 1991-92 failures by valve design and failure cause (McEihaney, 2000; reproduced 
with permission from Elsevier) 



Not specified 

Duo/double disc 

In-line 

Lift 

Other 

Stop 

Swing 

Tilting disc 

Unknown 

Abnormal wear 

6 

8 

14 

4 

23 

13 

8 

10 

2 

Normal wear 

31 

21 

29 

25 

23 

19 

33 

24 

37 

Design problem 

16 

12 

14 

10 

0 

38 

15 

11 

11 

Human error 

1 

0 

0 

0 

0 

0 

1 

2 

0 

Maintenance error 

7 

0 

7 

2 

8 

0 

5 

8 

20 

Corrosion 

7 

25 

14 

19 

8 

0 

5 

4 

7 

Foreign material 

13 

6 

14 

35 

15 

13 

14 

8 

11 

Procedure problem 

4 

8 

0 

0 

0 

0 

2 

3 

0 

Stress corrosion cracking 

0 

0 

0 

0 

0 

0 


0 

0 

Erosion/erosion-corrosion 

1 

15 

0 

0 

0 

13 

2 

2 

0 

Installation problems 

3 

2 

0 

0 

0 

0 

2 

5 

0 

Manufacturing defect 

2 

2 

0 

1 

0 

0 

3 

4 

2 

Unknown 

8 

2 

7 

3 

23 

6 

9 

20 

11 



Figure A 14.7 Relative failure rate by valve design and system (McEihaney, 2000; reproduced with 
permission from Elsevier) 
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Table A14.27 Failure causes for maintainable items - critical (C) and non-critical (NC) failures, x = 6 months (Haugen, 
Hokstad and Sandtorv, 1997; reproduced with permission from Elsevier) 

Maintainable item 




Failure cause/descriptor 




Mechanical 

defects 

Materialfail- 
ures (defect/ 
deterior.) 

Instrument/ 

Electrical 

Other 

Total 

C 

NC 

C 

NC 

C 

NC 

C 

NC 

C 

NC 

Actuating device 

0 

0 

0 

2 

3 

0 

0 

3 

3 

5 

Actuator 

3 

0 

3 

10 

0 

0 

1 

0 

7 

10 

Body + internals 

2 

3 

16 

34 

0 

0 

7 

4 

25 

41 

Control unit 

0 

0 

0 

0 

5 

1 

1 

0 

6 

1 

Monitor/display 

0 

2 

0 

0 

0 

3 

0 

0 

0 

5 

Seals 

0 

0 


7 

0 

0 

0 

0 


7 

Signal transm. 

0 

0 

0 

0 

0 

1 

0 

0 

0 

1 

Valve seat 

0 

0 

0 

3 

0 

0 

0 

0 

0 

3 

Subsystems 

0 

0 

5 

0 

0 

0 

0 

0 

5 

0 

Total 

5 

5 

25 

56 

8 

5 

9 

7 

47 

73 


Table A14.28 Failure causes for maintainable items - critical (C) and non-critical (NC) failures, t— 12 months (Haugen, 
Hokstad and Sandtorv, 1997; reproduced with permission from Elsevier) 


Maintainable item 




Failure cause /descriptor 




Leakage 

Mechanical 

defects 

Material fail¬ 
ures (defect/ 
deterior.) 

Instrument/ 

Electrical 

failures 

Other 

C 

NC 

C 

NC 

C 

NC 

C 

NC 

C 

NC 

Actuating device 

0 

6 

1 

1 

0 

12 

1 

1 

2 

9 

Actuator 

3 

11 

1 


25 

27 

0 

0 

3 

4 

Body + internals 

0 

0 

1 

6 

16 

10 

0 

0 

0 

1 

Control unit 

0 

0 

0 

1 

0 

0 

12 

2 

0 

0 

Monitor/display 

0 

0 

0 

0 

0 

0 

0 

3 

0 

0 

Seals 

0 

0 

0 

0 

1 

4 

0 

0 

0 

0 

Sensor 

0 

0 

0 

0 

0 

0 

2 

3 

0 

0 

Signal transm. 

0 

0 

0 

0 

0 

0 

0 

1 

0 

0 

Subsystems 

0 

0 

0 

2 

4 

4 

0 

0 

0 

0 

Unknown 

0 


0 


0 

3 


0 



Valve seat 

0 

0 

0 

0 

1 

3 

0 

0 

0 

0 

Total 

3 

18 

3 

12 

47 

63 

16 

10 

6 

15 


Table A14.29 Number of critical failures for various failure modes, i — 6 months (Haugen, Hokstad and Sandtorv, 1997; 
reproduced with permission from Elsevier) 
























APPENDIX 14/26 FAILURE AND EVENT DATA 


by Anyakora, Engel and Lees (1971) and for sensors in For process sensors used in offshore operations, OREDA 
process alarm systems by OREDA (1992): (1997) gives the following data: 



Failure rate (failures/year) 

Anyakora, 

Engel and Lees 

OREDA 

Pressure 

1.41 


(p) (< 1500 psig) 


0.019 

(e) 


0.37 

Flow 

1.73 


(p) (gas) 


0.25 

(e) (gas) 


0.75 


1.71 


(e) 


0.096 

Temperature 

0.88 


(e) 


0.1 


The first authors refer for pressure to ‘pressure meas¬ 
urement’, for flow and level to differential pressure trans¬ 
ducers and for temperature transducers, but do not 
distinguish between transducers with pneumatic (p) or 
electronic (e) output. The instruments selected from the 
OREDA collection are all transducers with specified type 
of output. In comparing the figures, allowance needs to he 
made for the effects on failure rate of environment and 
calibration requirements. Nevertheless, the data do suggest 
an improvement in reliability. 


Table A14.30 Number of critical failures for various 
failure modes, r = 12 months (Haugen, Hokstad and 
Sandtorv, 1997; reproduced with permission from Elsevier) 


Code EXL FTC FTO INL LCP SPO 


20 11 1 


The codes system used for the failure modes are shown 

3 follows: 


DOP 

Delayed operation 

EXL 

External leak 

FTC 

Fail to close 

FTO 

Fail to open 

INL 

Internal leak 

LCP 

Leakage in closed position 

PLU 

Plugged 

SPO 

Spurious operation 


Application 

Population 

No. of 
failures 

Mean 

failure 

rate 

(/10 6 h) 

Mean 

repair 

time 

(manhours) 

Flow 

72 

92 

26.41 

0.4 

Level 

73 

57 

32.93 

10.4 

Pressure 

282 

137 

18.06 

6.4 

Temperature 

8 

7 

56.36 

0.5 


A14.18 Process Computers 

The reliability of process computer systems is discussed in 
Chapter 13. 

Data on the failure rates of 12 process computer systems 
in the paper industry given by Hubbe (1970) are shown in 
Table A14.33. 

Data by E. Johnson (1983) on the failure rates of several 
different process computer configurations are summarized 
inTable A14.34. The data refer to total system failure, rather 
than failure of individual items such as printers. Johnson 
gives full details of the fault and downtime incidents. He 
states that for the total system an MTBF of 5000 h with a 
combined availability of about 99.9%, corresponding to no 
more than 8 h downtime per year, is about the level which 
may be found acceptable. 

A14.19 Relief Systems 

Some information is available on the failure rates of the 
individual elements of a pressure relief system, such as 
pressure relief valves, bursting discs and vent systems. 
Data on the failure of these items is given in this section. For 
chemical reactors, information on the failure rate of pres¬ 
sure relief systems has been given by Marrs and Lees (1989) 
as described in Chapter 11. 

A14.19.1 Pressure relief valves 

Data on the failure rate of PRVs are given in Section 
A14.16.3. 

A14.19.2 Bursting discs 

Data for the failure rate of bursting discs are given by 
Lawley (1974b) as follows: 

Frequency of disc rupture at normal pressure 
*= 0.2 failures/year. 

Table A14.31 Failure of instruments in ammonia plants 
(after Prijatel, 1984) 


Failure rate 
(failures/year) 


Control valves 0.028 

Controllers * 3 0.25 

Switches’ 5 0.22 

Redundant switch systems 3 1.68 x 10 -4 

Solenoid valves 0.046 

UPS system 0.026 


a For flow, pressure, level. 

b For flow, pressure, temperature, level. 

c An alternative figure of 2.9 x 10 -3 failures/year is also given. 
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Table A14.32 Failure and coverage rates of PLC in an US phenol plant, French-design nuclear power plants, 
and a Canadian nuclear power plant (Paula, 1993; reproduced with permission from Elsevier) 


PLC application 

Single processor 
failure rate 
(per PLC year) 

Total PLC failure 
rate (perPLCyear) 

Coverage 

US phenol plant 

2 

0.0082 b 

0.016 c 

0.9918-0.9959 b 0.9837-0.9918 c 

French-design nuclear power plants 


0.011 d 

0.021 e 


Canadian nuclear power plant 


0.025 




a Information not available. 
b Excluding early failures. 
c Including early failures. 
d Excluding power supply failures. 
e Including power supply failures. 


Table A14.33 Failure data for 12 process computer systems in the paper industry (Hubbe, 1970) 



MTBF 

Availability 


Hardware faults (h) 

Software faults (h) 

Hardware faults (%) Software faults (%) 

Composite average 

550 

1365 

99.1 99.80 

Best case 

1633 

8163 

99.94 99.97 


Table A14.34 Failure data for some process computer systems in the chemical industry (after E. Johnson, 1983; 
reproduced by permission of Elsevier Science Publishers) 


System 

Operating 
time (h) 

No. of 
failures 

Downtime 

Availability 

m 

Failure (h) 

Planned (h) 

Single computer system with analogue standby 

66,528 

13 

65 

300 

99.9 

Twin computer system with analogue standby 3 

35,040 

8 

30.5 

38 

99.91 

Twin computer system with shared critical loops -1 

78,888 

21 

172 

48 

99.78 

Twin computer system with shared critical loops - 2 

78,888 

37 

388 

73 

99.5 

Twin computer system with analogue standby 3 

13,848 

6 

54 

17 

99.61 


“Different configurations. 


For chemical reactors the failure rate of bursting discs in 
a single company has been investigated by Marrs and Lees 
(1989). The estimates obtained refer to the bursting disc 
itself, including blockage before the disc, but not to the vent 
pipework after the disc. There were during the period of 
investigation 11 successful ventings and no failures. 
The estimated probability of failure from these data is 
0.083 failures/demand. An alternative, and less pessimis¬ 
tic, estimate was obtained from the fact that there were 
four unrevealed fail-to-danger failures in 164 reactor-years 
with an inspection interval of 1 year, giving an 
estimated probability of failure of 0.012. The authors’ best 
estimate of the probability of failure is 0.01 failures/ 
demand, but the confidence bounds are relatively wide. 

A14.19.3 Vent systems 

For chemical reactors and vented vessels, the failure rate of 
vent systems, excluding bursting discs, in a single com¬ 
pany has been investigated by Marrs and Lees (1989). 
There were 28 successful ventings and no failures during 
the period of investigation. 


The estimated probability of failure from these data is 
0.034 failures/demand. An alternative, and less pessimis¬ 
tic, estimate was obtained from the fact that there was one 
unrevealed fail-to-danger failure in 262 vessel-years with 
an inspection interval of one year, giving an estimated 
probability of failure of 0.0019. The authors’ best estimate 
of the probability of failure is 0.002 failures/demand, but 
the confidence bounds are relatively wide. 

A14.20 Fire and Gas Detection Systems 

A study of fire detection systems with particular reference 
to false alarms has been described by Peacock, Kamath 
and Keller (1982). Some data from this study are shown in 
Table A14.35. Section A of the table shows the event rates 
for fire detection systems as assessed for chemical plant by 
safety officers from a single company. Section B gives the 
event rates for each type of detector. 

Hanks (1983) has described a study of the fire and gas 
detection system at the gas terminal at St Fergus. The 
results reported for failure rates are confined to those for 
the gas detectors, which were mainly in compressor cabs 















APPENDIX 14/28 FAILURE AND EVENT DATA 


Table A14.35 Some event rates in fire detection systems 
(after Peacock, Kamath and Keller, 1982; reproduced by 
the permission of the American Institute of Chemical 
Engineers) 


A Events by location 

Event rate (events/10 3 detector-year) 


Real False Failure to Real 
alarms alarms operate alarms!false 
alarm 


Plant in buildings 

4.7 

3.4 

0.15 

1:0.7 

Plant in open 

60 

273 

27 

1:4.6 

All locations 

2.1 

7.2 

0.16 

1:3.4 

B Events by type of detector 

Smoke 

5.9 

40 

0.5 

1:6.8 

Heat 

1.5 

5.3 

0.3 

1:3.5 

Smoke and heat 

16 

38 

0 

1:2.4 

Flame (UV,IR) 

108 

622 

108 

1:5.8 


and emergency generator rooms. Hanks gives the following 
failure rates: 


Failure rate (failures/10 6 h) 


Compressor Other 

cab installation 


Gas detector 48 8 

Gas detector and module 75 35 


Y.P. Gupta (1985) describes a survey of automatic fire 
detection systems at six sites. His account includes 
estimates of the failure rates of ionization-type smoke 
detectors synthesized from data on the reliability of 
electronic components. For detectors in a first class, or 
non-adverse, environment, the overall failure rate was 
assessed as 0.057 faults/year, of which 0.04 faults/year 
were classed as fail-safe and 0.017 faults/year as danger¬ 
ous. Most adverse environments result in a much higher 
failure rate. For such environments the failure rate was 
assessed as 0.46 faults/year. For control units the failure 
rate was assessed for false alarms as 0.044 faults/year and 
for unrevealed dangerous faults as 0.06 faults/year. 

The US Navy Program, Damage Control Automation for 
Reduced Manning (DC-ARM) tested the performance of 
20 sensors to 120 scenarios (82 fire, 38 nuisance sources 
and 120 non-fire events) (Rose-Pehrsson et al., 2000). 
These sensors include electrochemical cell sensors (most 
of the gas detectors), solid state metal sensor (general 
hydrocarbon sensor), non-dispersive infrared sensor 
(carbon dioxide detector), photoelectric smoke detectors 
and ionization smoke detectors, which is shown in 
Table A14.36. The performance of smoke detectors is 
shown in Table A14.37. The data set were analysed with 
probabilistic neural network and par of the results is shown 
in Table A14.38. 

For offshore fire and gas detection systems failure data 
are given by OREDA (1992, 1997, 2002). OREDA (1997) 


include failure rate data for fire and gas detectors as 
following (all failure modes included): 


Type Population No. of Mean Mean 

failures failure repair 

rate time 

(Per (man 

10 6 h) hours) 


Flame 

Infrared 520 

Combination 132 

IR/UV 

Ultraviolet 358 

Heat 

Rate 666 

compensated 
Rate-of-rise 199 

Smoke / combustion 
Ionization 1214 

Photo electric 683 

Hydrocarbon gas 
Catalytic 2044 

Infrared 2 

H 2 S gas 10 


111 11.94 8.6 

31 7.36 0.4 

150 48.84 6.1 


46 2.30 17.4 

33 7.06 3.8 


171 4.60 3.9 

47 2.13 3.3 


1730 31.08 4.5 

19 309.97 10.5 

1 3.26 


A14.21 Fire Protection Systems 

Data on the failure rates of sprinkler systems are available 
from sources such as the Factory Mutual Research Cor¬ 
poration and the NFPA. 

A review of failure rates of sprinkler systems that draws 
on these sources has been given by Rasbash (1975a). For 
fires in buildings in the United Kingdom in the period 
1966—71, the breakdown of incidents given is 


Type of incident No. of 

incidents 


Small fire, extinguished by other means 5,229 

Sprinkler system installed and operated 
Fire controlled by other means 275 

Fire controlled by sprinkler 3,180 

Fire extinguished by sprinkler 651 

Effect of sprinkler unknown 73 

Sprinkler system installed but did not operate 676 
Total 10,084 


Thus, excluding the small fires, sprinkler performance 
was unsatisfactory in some 14% of cases. NPFA statistics 
for the period 1925-64 quoted by Rasbash indicate that in 
some 75,290 fires sprinkler performance was unsatisfac¬ 
tory in some 3.8% of cases. 

Rasbash also quotes statistics from the Australian Fire 
Protection Association (AFPA). For some 5734 fires in the 
period 1886—1968 the proportion of sprinklers which gave 
unsatisfactory performance was 0.2 %. For some 1250 fires 
in the period 1968-73 the proportion was 0.64%. These 
very low AFPAvalues are discussed by Rasbash, who refers 
to differences in the criteria for satisfactory operation. 
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Table A14.36 Sensors used in the multicriteria detection test program (Rose-Pehrsson et al., 2000; reproduced with 
permission from Elsevier) 


Species 

Sensor range 

Resolution 

Instrument model 
number 

Manufacturer 

Oxygen (0 2 ) 

0-25% 

0.1% 0 2 

6C 

City Technology 

Carbon monoxide 

0-4000 ppm 


A3ME/F 

City Technology 

with H 2 compensation 
(CO 4000 ppm) 

Carbon monoxide 

0—50 ppm 

0.5ppm 

TB7E-1A 

City Technology 

(CO 50 ppm) 

Carbon dioxide 
(C0 2 ) 

0-5000 ppm 

Accuracy = greater 
than ± 5% of reading 
or ±100 ppm 

2001V 

Telaire/Englehard 

Ci—Cg hydrocarbons 

0-50 ppm ethylene 

± 2.5 ppm 

SM95 -S2 with general 

International sensor 

(Ethyl) 

(C 2 H4) 


hydrocarbons solid 
state sensor 

technology 

Hydrogen (H 2 ) 

0-200 ppm 


TE1G-1A 

City Technology 

Hydrogen chloride 

0-10 ppm 

0.5 ppm 

TL1B-1A 

City Technology 

(HC1) 

Hydrogen cyanide 
(HCN) 

0—25 ppm 

0.1ppm±2%F.S. 

accuracy 

4664-40-1-1-1 

EIT 

Hydrogen sulfide (H 2 S) 

0-5 ppm 


TC4A-1A 

City Technology 

Sulfur dioxide (S0 2 ) 

0—10 ppm 

0.5 ppm 

TD2B-1A 

City Technology 

Nitric oxide (NO) 

0-20 ppm 

0.5 ppm 

TF3C-1A 

City Technology 

Temperature 
(thermocouple orTC) 

-200tol250“C 

1°C or 0.75% 

Type K, 0.127 mm bare 
bead TC 

Omega 

Temperature (Temp) 

—20°C to 75°C 

sfc 0.6“ C accuracy 

HX93 transmitter 
(RTD) 

Omega 

Relative humidity (RH) 

3-95% 

± 2 %RH accuracy 

HX93 transmitter 


Photoelectric smoke 

0-19% obs./m 


4098-9701 


detector (PHOTO) 

Ionization smoke 

1.6-10"n obs./m 


4098-9716 

Simplex 

detector (ION) 

Residential ionization 



83R 

First Alert 

smoke detector (RION) 

Optical density meter 
(ODM) 

Laser and photodiode 



VDM-2 670 nm, 2 mW 

MRD 500 PIN silicon 

Meredith 

Motorola 

with 0.965 m spacing 

Measuring ionization 
chamber (MICX, MICY, 



EC-912 

Photodiode Delta 
Electronics Testing 

MICY20) 


Table Al 4.37 Summary of smoke detector performance (Rose-Pehrsson et al., 2000; reproduced with permission from 
Elsevier) 

Alarm level (%obs./m) 


Photoelectric 



Ionization 


Fire source 
(%) 

Nuisance 
source (%) 

Overall? 

(%) 

Fire source 
(%) 

source (%) 

Overall 

(%) 

Typical: 11 (Photo) 4.2 (Ion) 

38 

82 

52(76) 

68 

71 

69(85) 

UL 268 minimum: 1.63 

70 

53 

65 (83) 

80 

61 

74 (87) 

Half the UL 268 minimum 0.82 

73 

53 

67 (83) 

84 

58 

76(88) 


a Overall percent correct is based on 82 fires and 38 nuisance sources (120 for events). The parenthetical value is the percent correct based on 
82 fires, 38 nuisance sources and 120 nonfire (background) events. The parenthetical value is the overall classification parameter that can 
be compared to the multivariate analysis results. 


For the United Kingdom fires the two principal causes of 
unsatisfactory performance were that the heads were inac¬ 
cessible to the fire and that the water was shut off, these 
occurring in 9.6 and 4.3% of the incidents, respectively. 

The figures for unsatisfactory performance of sprink¬ 
lers given by P. Nash and Young (1976) for the NPFA and 


Australian data are similar, but they give for the United 
Kingdom for the period 1965-69 a figure of 8.3% and 
quote a figure of 15% given by the Factory Mutual Cor¬ 
poration for the period 1970-72. 

From the UK data, the causes of unsatisfactory per¬ 
formance are given as system shut off, defective system, 











APPENDIX 14/30 FAILURE AND EVENT DATA 


Table A14.38 Probabilistic neural network classification results (Rose-Pehrsson et al., 2000; reproduced with 
permission from Elsevier) 

Sensor sets 

Number 

wrong 

No. of 

realfires 

correct 

No. of 
false 
alarms 

Overall 

percent 

correct 

0.82% 

CO 50 , CO4000, MICX, ODM, RION 

16 

73 

7 

93 

CO4000, MICX, ODM, RION 

14 

75 

7 

94 

CO 50 , MICX, ODM, RION 

19 

73 

10 

92 

C0 2 , C0 50 , CO4000, NO, Ethyl, MICX, ODM, RION 

15 

73 

6 

94 

MICX, ODM, RION 

24 

66 

8 

90 

CO 4000 , ODM, RION 

19 

71 

8 

92 

CO4000, MICX, RION 

28 

63 

9 

88 

CO4000, MICX, ODM 

27 

66 

11 

89 

Temp, RH, ODM, ION, PHOTO 

14 

73 

5 

94 

0 2 ,H 2 , Ethyl, ION, PHOTO 

13 

74 

5 

95 

0 2 , CO4000 , h 2 , ION, PHOTO 

12 

75 

5 

95 

0 2 , CO4000, Ethyl, ION, PHOTO 

13 

75 

6 

95 

0 2 ,H 2 S,RH, ION, PHOTO 

13 

74 

5 

95 

1.63% 

MICX, ODM, RION 

22 

70 

10 

91 

C0 2 , CO 50 , CO4000, NO, Ethyl, MICX, ODM, RION, PHOTO 

13 

74 

5 

95 

CO 4000 , MICX, ODM, RION 

18 

72 

8 

93 

CO 50 , MICX, ODM, RION 

18 

69 

5 

93 

0 2 , CO4000, NO z , ODM, PHOTO 

15 

74 

5 

95 

0 2 ,H 2 S, RH, ION, PHOTO 

6 

78 

2 

98 

11% 

MICX, ODM, PHOTO 

21 

69 

8 

91 

CO50, CO4000, NO, Ethyl, MICX, ODM, RION, PHOTO 

10 

76 

4 

96 

CO4000, MICX, ODM, RION 

13 

73 

4 

95 

0 2 , C0 2 ,H 2 ,MICY2,ODM 

10 

73 

1 

96 

0 2 , CO4000, RH, ION, PHOTO 

7 

77 

2 

97 

0 2 ,H 2 S,RH, ION, PHOTO 

6 

78 

2 

98 


system frozen and unknown, these occurring in 4.6, 0.60, 
0.07 and 3.0% of the incidents, respectively. 

From the NFPA data some principal causes of unsatis¬ 
factory performance were valve shut, inadequate water 
supply and obstruction to distribution, these occurring in 
36.0,9.6 and 8.4% of the incidents, respectively. The causes 
for the valve being closed were closed for no known reason, 
closed too early in the fire, closed for system repair or 
modification and closed to prevent freezing, these occur¬ 
ring in 22,21 and 20% of cases with a closed valve. 

Nash and Young also give failure rates for the compo¬ 
nents of sprinkler systems as follows: 


Component Failure rate 

(failures/year) 



Safe 

Dangerous 

Wet alarm valve 

15 x10 -2 

0.4 x 10“ 4 

Alternate alarm valve 

15 x10 -2 

0.8 x 10“ 4 

Alarm motor and gong 

6 x 10“ 2 

1.6 x 10“ 2 

Accelerator 

13 x 10“ 2 

7.9 x 10“3 

Main sprinkler stop valve 

- 

2 x 10“ 3 

Non-return valves 

- 

10 x10“ 3 


Budnick (2001) reported an analysis of 16 published 
reliability data for automatic sprinkler systems and the 
mean value of reliability was estimated between 93 and 
96% in his results. Further data on the effectiveness of fire 
protection systems have been given by M.J. Miller (1977), 
based on Factory Mutual experience in the period 1970-75. 
In presenting data, the author warns that an unknown 
number of system operations are not reported. He also 
points out that there is no standard definition of effective¬ 
ness so that there is an element of subjectivity. He states as 
rough guidance that the performance would be considered 
acceptable if the system is designed to FM/NFPA stand¬ 
ards and is operated within the design conditions and if 
any loss does not exceed the estimated Normal Loss 
Expectancy. For sprinkler systems, the number of reported 
events by type of system, with the proportion effective in 
brackets, was as follows: wet 2102 (91%); dry 650 (86%); 
deluge 62 (76%) and non-freeze 16. 

For special protection systems, the number of events 
with the proportion of successes, was as follows: water 
spray 49 (53%); dry chemical 22 (27%); carbon dioxide 100 
(51%) and steam 30 (63%). 

Information on failure rates of special protection sys¬ 
tems is limited. For carbon dioxide systems in Germany, 
Miller quotes a success rate of some 76-78% over a 14-year 
period. 
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For Halon systems, he states that data are even scantier, 
but refers to a series of 300 tests of such systems by Dupont 
in which in some 23 % of installations significant problems 
were identified and corrected. 

Miller also gives data on the effectiveness of other active 
protection systems, namely: gas analyser; smoke detector; 
rate-of-rise detector; spray nozzles; foam water sprinkler; 
high expansion foam; low expansion foam; explosion 
suppression; halon (fire protection); halon (explosion 
suppression); vaporizing liquid; inert gas; in-rack sprink¬ 
lers; standpipes. For only three of these is the number 
of reported events 10 or more, the numbers, with the 
number of successes, being as follows: gas analyser 13 
(2); high expansion foam 10 (3) and low expansion 
foam 12 (5). 

Reliability data of fire protection features from one boil¬ 
ing water reaction (BWR) sites and two pressurized water 
reaction (PWR) sites in German has been statistically 
analysed (Rowekamp and Berg, 2000). The study covers 
7-year operation of BWR and 7 and 4 years of operation for 
the two PWRs. Failure rates and unavailability for the fire 
protection equipment were estimated and presented in 
Table A14.39. 


A14.22 Emergency Shut-down Systems 

Data on emergency isolation valves are given in Section A14.16. 

For offshore emergency shutdown systems, failure data 
are given by OREDA (1997). It includes emergency shut¬ 
down valves as follows (all failure modes included): 



Population 

No. of 
failures 

Mean failure rate 
(failures/10 6 h) 

Ball 

5.1-10.0 in. 

14 

29(1) 

61.61 

10.1-20.0 in 

13 

15(3) 

32.93 

20.1-30.0 in 

2 

0(0) 

6.04 

Butterfly 

1 

1(1) 

28.54 

Gate 

1.1—5.0 in. 

39 

24(11) 

20.13 

5.1-10.0 in. 

481 

245 (105) 

26.50 

Plug 

2 

7(1) 

99.89 


The values for number of failures in brackets refer to 
failure to close or to failure involving some degree of 
internal leakage. 


Table A 14.39 Plant specific reliability data estimated for active fire protection features in a German BWR reference plant 
(Rowekamp and Berg, 2000; reproduced with permission from Carl Hanser Verlag) 


BWR plant PWR plant 1 PWR plant 2 

Inspection Failure Unavai- Inspection Failure Unavai- Inspection Failure Unavai- 

period rate lability period rate lability period rate lability 

[1/h] [1/h] [1/h] 


Fire alarm boards 

Detection 3m, la 6.7 x 10 _ 8 1.2 x 10 -4 3m 
drawers 

Detection lines 3m, la 2.3 x 10 -8 4.0 x 10 -5 3m 


Fire detectors 
Automatic la 

Press button la 

Fire dampers 3m, la, 3a 

Fire doors la 

Inergen gas - 

extinguishing 
system 

Dry sprinkler 6m, la, 5a 

extinguishing 
system 
(total failure) 

Dry sprinkler 6m, la, 5a 

extinguishing 
system 
(automatic 
actuation failure 
only) 

Wet sprinkler 6m, la, 5a 

extinguishing 
system 

Gas extinguishing 6m 
system (CO2) 

Stationary fire lm,la 

pumps 

Wall hydrants 6m,la 


1.4 xl0“ 7 1.3 xlO -3 

1.1 x 10 -7 9.4 x 10 -4 
2.3 x 10“ 6 6.7 x 10“ 3 
4.9 x 10“ 7 4.3 x 10 -3 

2.3 x 10 -7 9.9 x 10 -4 

4.1 x 10 -6 1.8 x 10 -2 

7.2 x 10 -8 3.2 x 10 -4 

2.1 x 10 -6 9.2 x 10 -3 
2.1 xlO -6 1.4 xlO -3 
4.4xlO -8 1.9 xlO -4 


la 

la 

6m 

la 


3m, la 


3m, la 


la 


3.4 x 10 -8 7.4 x 10 -5 
2.0 x 10“ 8 4.3 x 10“ 5 


1.3 x 10“ 6 1.1 
1.6 xlO -8 1.4 


: 10 -2 
: 10“ 4 


4.8 x 10“ 8 4.2 x 10“ 4 la 

3.8 x 10“ 8 3.3 x 10“ 4 la 
6.6xlO -7 2.9xlO -3 la 

7.1 x 10“ 7 6.3 x 10“ 3 3m, la 
- - 6m 


4.0 x 10“ 9 3.5 x 10“ 5 
3.8 x 10“ 8 3.3 x 10“ 4 

1.4 xlO -7 1.2 x 10 -4 
1.1 xlO -6 2.5 xlO -3 

1.5 x 10 -6 5.8 x 10 -2 


1.5 x 10“ 7 3.2 x 10“ 4 6m, 5a 1.6 x 10“ 7 6.5 x 10“ 4 


1.3 x 10 -7 2.9: 


10 2 6m 


5.8 


10“ 7 2.5 x 10 -3 


1.4 x 10“ 6 8.5 x 10 -4 6m 3.8 x 10“ 6 1.6 x 10“ 5 

8.5 x 10 -7 7.4 x 10 -3 la 1.1 x 10“ 7 9.5 x 10“ 4 
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For offshore platforms in the Gulf of Mexico, Forsth 
(1983) has reported that in 12 cases where the emergency 
shutdown system was mentioned in the fire or explosion 
incident report, the system operated properly in 11 but 
failed in one. 

For programmable logic controllers used in the emergency 
shutdown systems, Mitchell and Williams (1993) analysed 
failure data from natural gas compressor stations. The 
failure rate of PLC (microprocessor failures only) was esti¬ 
mated to be 0.072 failures/PLC year while the overall PLC 
failure (all causes) was estimated 0.32 failures/PLC year. 

A14.23 Utility Systems 

A14.23.1 Electrical power 

The failure rate of the outside power supply varies with the 
country concerned. In the United Kingdom, the National 
Grid system gives a high reliability supply and the failure 
rate is relatively low. In addition, chemical works often have 
their own power station. The failure rate of the power 
supply to a plant should normally be determined for the 
particular works. 

For the United Status, the Rasmussen Report (figure III 
6—5) gives data for outage times following a transmission 
line failure, as shown in Table A14.40. 

A detailed study of the power supply to a plant making 
RDX explosive, on which it is critical that agitation should 
not stop, has been described by Ketron (1980). His analysis 
of the distribution of power failures by duration may be 
summarized as shown in Table A14.41. The dates quoted in 
the table run from December 1968 to January 1974. 

A study of probability of off-site power outage versus 
duration at three nuclear plants is published by Arul et al. 
(2003) with the probability of 1-h off-site power outage 
between 0.1 and 1.0. 


Table A14.40 Outage times of electrical power supply 
following a transmission line failure (after Atomic Energy 
Commission, 1975) 


Outage time (%) 

Proportion of 
outages (%) 

<0.01 

1.1 

0.01-0.032 

6.1 

0.032-0.1 

18.7 

0.1-0.32 

37.9 

0.32-1.0 

12.6 

1.0-3.2 

11.7 

3.2-10 

8.4 

Table A 14.41 Duration of power failures i 

h an explosives 

plant (after Ketron, 1980; reproduced by permission of the 
American Institute of Chemical Engineers) 

Duration of 
power failure t (min) 

No. of incidents 

Momentary 

13 

f<l 

3 

l<f<10 

2 

10<f<60 

4 

t>60 

6 

Total 

28 


Literature failure rates of equipment used in power sup¬ 
ply systems given by Ketron are shown in Table A14.42. 
Weather-related features of power supplies have been con¬ 
sidered by Jarrett (1983). 

Al 4.23.2 Diesel generators 

Information on the reliability of diesel generators is given 
in the Raosmussen Report (AEC, 1975). The study gives a 
probability of failing to start on demand of 3 x 10 . 

Thus, if there are two diesel generators, but only one is 
required to provide the full emergency load, it might be 
calculated that the probability of both generators failing to 
start on demand is 9 x 10 -4 . In fact, however, startup is 
treated in the study (p. III-72) as a single event that may trip 
both units. The probability of both generators failing to 
start on demand is assessed as 10 -2 . The repair time for a 
diesel generator is given in the study (p. III-55/56) as a 
mean time of 21 h with a range of times of 2-300 h. 

A survey of emergency generating equipment over the 
period 1977-82 has been reported by R. Stevens (1983). 
Much of the equipment was found to be in appalling con¬ 
dition. The failure modes are shown in Table A14.43. 

Twenty-six years’ operational data of 11 diesel generators 
of 125-250 kV A at Chalk River Nuclear Laboratory have 
been analysed presented by Winfield (1988), which gave a 
mean failure to start probability of 4.4 x 10 -2 and failure to 
run probability between 5.6 x 10 -3 and 1.2 x 10 -2 . 


Table A14.42 Failure rates of electrical power supply 
equipment (after Ketron, 1980; reproduced by permission 
of the American Institute of Chemical Engineers) 


Failure rate a 
(failures/d) 

Diesel engine 

0.008 

Electric generator 

0.0014 

Electric motor 

0.0014 

Steam turbine 

0.000057 

Solenoid valves 

0.0000063 

Pneumatic valve 

0.00011 

Globe valve 

0.0034 


a Literature values. 


Table Al4.43 Failure modes of emergency engines/ 
generators (after B. Stevens, 1983; reproduced by 
permission of the American Institute of Chemical Engineers) 

No. of Proportion 

cases (%) 

36 26.1 

13 9.4 

6 4.4 

18 13.0 

14 10.1 

9 6.5 

7 5.1 

20 14.5 

7 5.1 

8 5.8 

138 100.0 


Cracking / overheating 

Cracking/freezing 

Mechanical breakage 

Bearings and journals/scoring 

Engine block/breakage 

Pistons/breakage 

Valves/breakage 

General mechanical 

Piston rings/breakage 

Crankshaft / cracking -breaking 

Total 
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Table A14.44 Mean probability of failure of emergency 
diesel generators at 63 nuclear plants from 1988-91 
(Veseiy, Uryasev, and Samanta, 1994; reproduced with 
permission from Elsevier) 


For Over Diesels or 

individual station stations 

diesels 


Failure to start 5.0 x 10 3 5.2 x 10 5 5.0 x 10 3 

Failure to load-run 9.6 x 10 -3 9.5 x 10 -5 9.3 x 10 -3 


A total of 195 emergency diesel generators at 63 operating 
nuclear plants have been analysed from 1988 to 1991 (Veseiy, 
Uryasev and Samanta, 1994). The mean probability of fail¬ 
ure to start and failure to load-run is given in Table A14.44. 
Load-run failure is defined as diesel generator starts but 
does not run successfully. Estimation of standard deviation 
and variance is also provided in their paper. 

For offshore diesel-driven pumps and emergency power 
generators, failure data are given by OREDA (1997) as 
follows. 


Population No. of Mean Failure 

failures failure to start 

(perl0 6 h) demand 


Main power 

1-100 kW 2 82 731.62 

100-1000 kW 8 174 479.80 

Emergency 7 142 685.44 0.018 

power 


A14.23.3 Instrument air 

An estimate of the failure rate of the instrument air supply 
has been given Lawley and Kletz (1975). They give: failure 
frequency of instrument air supply = 0.05 failures/year. 

This evidently refers to the instrument air supply rather 
than to the connections from the air supply to the instru¬ 
ment, for which separate failure rates are quoted. 

A14.23.4 Cooling water 

The arrangements for the supply of cooling water in a 
works vary somewhat. Generally, there is a works cooling 
water supply system, but use may also be made of other 
sources of supply such as wells. 

Atypical estimate of the failure rate of the cooling water 
supply of about 0.1 failures/year. This is for the supply 
itself and does not include failure of equipment such as 
cooling water pumps supplying a particular plant. 

A14.23.5 Steam 

Information on the failure rates of components of steam 
supply systems has been given by Coltharp etal. (1978), who 
carried out a study on the steam system of an automobile 
factory. Some of the data given by these authors is shown in 
Table A14.45. 

A14.24 LNG Plants 

A survey of events on LNG plants has been reported by 
Welker and Schorr (1979). The data were obtained on 25 


Table A14.45 Failure rates of some components of 
a steam supply system (after Coltharp et al., 1979; 
reproduced by permission of the American Institute of 
Chemical Engineers) 


Equipment 

Failure rate a 
(failures/10 6 h) 

Drives for spreader stoker: 


Electric drive 

0.3 

Steam drive 

50 

Boiler feedwater pump 

0.9 

Condensate collection and return 

10 

Waterwall tubes 

57 

Steam generating tubes 

0.3 

Superheater 

0.4 

Air preheater 


Fans 


Overfire air 

57 

Induced draft 

1.1 

Drives for fans 


(forced draft, overfire air, 


induced draft) 


Electric drive 

2 

Steam drive 

3 

Ash conveyor 

10 


“Sources of data are Edison Electric Institute (EEI), Hartford Steam 
Boiler (HSE) and automobile company. 


LNG peak-shaving plants in the United States ranging 
in age from 10 years to a few months. The survey covered 
nearly 35,000 h of vaporization experience, more than 
400,000 h of liquefaction experience and more than 
1.5 million hours of tank storage, as well as nearly 1.5 billion 
ft-h of pipe use and more than 1.3 million manhours of 
operating time. 

The authors define a minor failure as one which results 
in an unscheduled shutdown of operating equipment where 
the repair period is less than 24 h, a major failure as one 
where the shutdown is more than 24 h and a safety-related 
failure as one which results in a fire or a large leak of gas or 
liquid. 

Major leaks of gas are defined as those which could result 
in a release of the order of 100,000 ft 3 of gas. Major leaks of 
liquid involved primarily vaporizer tubes or pumps, with 
one major leak due to flange gasket failure. 

The fires reported are confined to those involving LNG 
as gas or liquid. About half the fires were minor and half 
major. Vaporizers appeared to have a high risk of fire, 
because they have a relatively high failure rate and are 
located near fired equipment. 

Some failure and event rates given in this survey are 
shown in Table A14.46. 


A14.25 Leaks 

A14.25.1 Leak sources 

Information on the distribution of leak sources is available 
in several different classifications. The distribution of the 
place of origin for large fires in Great Britain 1971-73 has 
been given in Table 2.11. 

The distribution of leak sources for process industry 
accidents reported to the HSE in the year 1987-88 has 
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Table A14.46 Failure and event rates on LNG plants (after Welker and Schorr, 1979; reproduced by 
permission of the American Gas Association) 


A Failure rates 


Plant section or equipment MTBF (h) 



Major failure 

Minor failure 

Safety-related failure 

Total failures 

Gas pretreatment 

20,000 

3000 

> 350,000 a 

3000 

Liquefaction 

6500 

2500 

> 420,000 a 

1800 

LNG vaporizers 

8000 

700 

15,000 

700 

Compressors 

3000 

900 

> 2 x 10 6a 

700 

LNG pumps 

>35,000 

3500 

> 35,000 

3500 

Cryogenic valves 

> 4 x 10 7a 

2 x 10 7 

> 4 x 10 7a 

2 x 10 7 

Controls 

15 x 10 6 

700,000 




B Other events 


MTBF( h) 


LNG tanks: 

Gas leaks 
Liquid leaks 
Cold spots 
Pipelines (per ft): 

LNG pipelines 
Pipe insulation 
Fire water mains 
Hazard detection sensors: 

Gas 

Radiation 

High temperature 

Smoke 

Emergency systems: 

Water hydrants, monitors 
Halon systems 
Dry chemical systems 
Human errors, leaks and fires: 
Human error incidents 
Major gas leaks 
Major liquid leaks 
Major fires 


a No failures. 

b Small leaks from gaskets not inc 
c Excluding false alarms. 


> 1.5 x 10 6 (no leaks) 

> 1.5 x 10 6 (no leaks) 

100,000 

> 1.5 x 10 9 (no failures) 11 

> 1.5 x 10 9 (no failures) 
>1.6x10® 


100,000 c 

350,000 c 

> 4 x 10 6 (no failures) 
1.4 x 10 s 


4 x 10 6 
100,000 
3 xlO 6 


50,000 

300,000 

150,000 

200,000 d 


been analysed by A.W. Cox, Ang and Lees (1990). Separate 
analyses are given for normal, closed process plant and 
for plant and activities with open surfaces, etc., as shown 
inTables A14.47 and A14.48, respectively. 

For vapour cloud explosions the distribution of leak 
sources has been obtained by A.W. Cox, Ang and Lees 
(1990) from the case histories listed by Davenport (1977, 
1983) as shown in Table A14.49. 

For fires and explosions on offshore installations in the 
Gulf of Mexico and in the Norwegian North Sea the dis¬ 
tribution of leak sources has been obtained by A.W. Cox, 
Ang and Lees (1990) from data given by Forsth (1981a,b) as 
shown inTables A14.50 and A14.51. 

Based on the API analysis of the SCAQMD refinery 
screening data, 90% of reducible fugitive emissions come 


from only about 0.13% of the piping components (API, 
1997;Taback, Siegell, Martino, and Ritter, 2000). 


A14.25.2 Leak frequency 

Estimates of the frequency of leaks on ammonia instal¬ 
lations and carriers have been made by Baldock (1980) and 
are given in Table A14.52. 

In late 1987,39 chemical plants and EPA jointly conduct a 
fugitive emission study including all domestic producers 
of ethylene oxide, phosgene and acrolein. Around 100,000 
components were examined between 1988—1990, and 
the result is presented in Berglund (1992), and leak rate is 
also found to be a function of monitoring frequency and 
maintenance procedure. 
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Table A14.47 Leak sources on closed process plant 
(after A. W. Cox, Ang and Lees, 1990; reproduced by 
permission of the Institution of Chemical Engineers) 



No. of 
incidents 

Proportion of 
incidents (%) 

Plant 

19 

22.1 

Reactor 

8 

9.3 

Vessel 

10 

11.6 

Tank 

7 

8.1 

Heat exchanger 

4 

4.7 

Vaporizer 

2 

2.3 

Pump 

13 

15.1 

Pipework 

17 

19.8 

Hose 

6 

7.0 

Total 

86 

100.0 


Table A14.48 Leak sources for plants and activities 
with open surfaces, etc. (after A. W. Cox, Ang and Lees, 
1990; reproduced by permission of the Institution of 
Chemical Engineers) 



No. of 
incidents 

Proportion of 
incidents (%) 

Solvent evaporating 

Oven 

4 

2.9 

Spray booth 

15 

10.8 

Small container 

31 

22.3 

Cleaning/degreasing 

Process 

15 

10.8 

Tanker/mobile plant 

33 

23.7 

Other 

41 

29.5 

Total 

139 

100.0 


Table A14.49 Leak sources in vapour cloud explosion 
incidents for 1962-1982 (after A. W. Cox, Ang and Lees, 
1990; reproduced by permission of the Institution of 
Chemical Engineers) 


Leak source 

No. of 
incidents 

Proportion of 
incidents (%) 

Reactor - reaction 

1 

2.85 

Vessel - explosion 

1 

2.85 

Vessel - rupture 

1 

2.85 

Tanks - reaction 

1 

2.85 

Tanks - overfilling, 

1 

2.85 

frothover 

Tanks - refrigerated 

2 

5.7 

storage, failure 

Pipe 

9 

25.8 

Flange 

2 

5.7 

Other fittings 

7 

20.0 

Hose 

1 

2.85 

Valves 

3 

8.6 

Sight glass 

1 

2.85 

Pumps 

1 

2.85 

Flare 

2 

5.7 

Valve opened 

1 

2.85 

Venting 

1 

2.85 

Total 

35 

100.0 


Table A14.50 Leak sources for fire and explosions in 
the Gulf of Mexico (after Forsth, 1981b; reproduced by 
permission of Det Norske Veritas) 


Leak source 

No. of 
incidents 

Proportion of 
incidents (%) 

Tanks, vessels, drains, 
sumps, pans, pits 

18 

13.7 

Holes, cracks 

6 

4.6 

Flanges, unions 

26 

19.8 

Hoses 

4 

3.1 

Nipples 

3 

2.3 

Valves 

16 

12.2 

Exhaust 

8 

6.1 

Other 

47 

35.9 

Unknown 

3 

2.3 

Total 

131 

100.0 


Table A14.51 Leak sources for fires and explosions 
in the Norwegian North Sea (after Forsth 1981a; 
reproduced by permission of Det Norske Veritas) 


Leak source 

No. of 
incidents 

Proportion of 
incidents (%) 

Tanks, vessels, 

10 

7 

drains, sumps, etc. 
Ruptures, holes, cracks 

4 

3 

Flanges, unions 

7 

5 

Valves, vents 

8 

6 

Other 

30 

21 

Unknown 

48 

36 


A14.26 Ignition 

A14.26.1 Ignition sources 

There is a small amount of information on the distribution 
of ignition sources, much of it for offshore installations. 

A study by the Fire Protection Association (1974) of igni¬ 
tion sources for large fires in the chemical and petroleum 
industries in Great Britain in 1971-73 gave the data shown 
in Table 2.11. There were 79 fires of which 23 were solid and 
10 unknown, the other 46 being gas, vapour or liquid. 

Ignition sources for process industry fire and explosions 
reported to the HSE in the year 1987-88 have been ana¬ 
lyzed by A.W Cox, Ang and Lees (1990). Separate analyses 
are given for normal, closed process plants and for plants 
and activities with open surfaces, etc. The former sets 
have been given in Table 16.46 and the latter are shown in 
Table A14.53. 

Offshore ignition sources have been given for fires and 
explosions in the Gulf of Mexico (GoM) and in the Norwe¬ 
gian North Sea (NNS) in reports by workers at Det Norske 
Veritas (Sofyanos, 1981; Forsth, 1981a,b, 1983). 

Forsth (1983) has given the data shown in Table 16.47 for 
ignition sources in these two locations. The number of 
accidents considered was for the GoM was 326 over the 
period 1956—81 and for the NNS 133 over an unspecified 
period. 
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Table A14.52 Estimated frequency of releases on 
ammonia installations and carriers (after Baldock, 1980; 
reproduced by permission of the American Institution of 
Chemical Engineers) 


Incident 

No. of 

Estimated 


incidents 

frequency 

Major failure of 

2 

lin6 x 10 4 vessel-year 

storage vessel 
Major release from 

t 

1 in 10 4 storage area-year 

storage vessel 
Serious release 

12 

1 in 2000 plant-year 

on plant 


1 in 10 5 plant-year 

Release on 

15 

refrigerator plant 
Release at transfer 



point 

Flexible hose 

11 

1 in 1000 transfer 

failure 


point-year 

Movement while 
still connected 
Major release 

3 

1 in 4000 transfer 
point-year 

Other release 

8 

1 in 1500 transfer 
point-year 

Major release in 
transport 

Road 

6 

1 in 2000 tanker-year 

Rail 

18 

1 in 3000 tanker-year 

Pipeline 

8 

1 in 3000 mile-year 

Sea 

1 

1 in 200 ship-year 

Total 

79 



Table A14.53 Ignition sources for plants and activities 
with open surfaces, etc. (after A. W. Cox, Ang and Lees, 
1990; reproduced by permission of the Institution of 
Chemical Engineers) 



No. of 
incidents 

Proportion of 
incidents (%) 

Flames: general 

27 

19.4 

LPG fired equipment 

2 

1.4 

Hot surfaces 

20 

14.4 

Friction 

11 

7.9 

Electrical 

29 

21.0 

Hot particles 

- 

- 

Static electricity 

10 

7.2 

Smoking 

17 

12.2 

Auto-ignition 

2 

1.4 

Unknown 

21 

15.1 

Total 

139 

100.0 


A14.26.2 Ignition probability 

A discussion of the probability of ignition of gas and liquid 
releases is given in Chapter 16. The account there utilizes 
data on blowouts on offshore installations given by Dahl 
et al. (1983). A fuller tabulation of these data is shown in 
Table A14.54. 


Table A 14.54 Ignition of blowouts in the Norwegian North 
Sea (after Dahl et al. 1983; reproduced by permission 
of Det Norske Veritas) 



No. of 


Proportion of 


incidents 


incidents (%) 

Gas: 





No ignition 

81 


70 


Fire 

23 


20 


Explosion 

12 


10 


Subtotal 

116 


100 


Oil: 





No ignition 

11 


92 


Fire 



8 


Explosion 

0 


0 


Subtotal 

12 


100 


Oil and gas: 





No ignition 

13 


57 


Fire 

10 


43 


Explosion 

0 


0 


Subtotal 

23 


100 


Fire 

4 




Explosion 

1 




Other 

15 




Total 

171 




Table A14.55 Number of fires in 

US petroleum industry 

1982-1985 (API, 1983, 1984, and 1985) 



Installations 


No. of fires 



1982 

! 1983 

1984 

1985 

Exploration, 



68 

107 

production, drilling 





Gas processing 



28 

19 

Exploration, production, 


25 

0 

drilling and gas 





processing, not separated 




Total of above 

163 

182 

121 

126 

Offshore portion only 



13 

6 

Refining 

201 

173 

142 

104 

Chemical operations 

61 

70 



Petrochemicals 



33 

20 


Table Al4.56 

refineries 1982- 

Number of fires in storage tanks ii 
-85 (API, 1983, 1984 and 1985) 

i US 

No. of fires 


Type of tank 



1982 

1983 1984 

1985 

Floating roof 

6 

6 10 

3 

Cone roof 

9 

6 13 


Dome roof 

0 

1 0 

0 


A14.27 Explosion following ignition 

Al 4.27.1 Explosion probability 

The discussion of ignition in Chapter 16 also covers for gas 
releases the probability of explosion, given ignition. 
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Table A14.57 Specific origin of 131 accidents in the 
transportation of natural gas (Montiel et al., 1996; 
2reproduced with permission from Elsevier) 


Origin 

No. of accidents 

Percentage 

Piping 

127 

96.9 

Pumps/compressors 

2 

1.5 

Rail tank 

1 

0.8 

Substation 

1 

0.8 


Table A14.58 Causes of 131 accidents in the 
transportation of natural gas (Montiel et al., 1996; 
reproduced with permission from Elsevier) 


Cause 

No. Of 
accidents 

Percentage of 
known“ 

Mechanical failure 

39 

43.3 

Impact failure 

37 

41.1 

Human error 

32 

35.6 

External events 

14 

15.6 

Service failure 

1 

1.1 

a Of the 131 accidents, cau 

ses of 90 were known. 



A14.28 Fires 

A14.28.1 Process plant fires 

A survey of the frequency of fires in industry in Britain has 
been reported by Rutstein and Clarke (1979). For the chemi¬ 
cal and allied industries (Standard Industrial Classifi¬ 
cation 5) they correlate the probability of fire per year with 
the floor space of the building using a function of the form 
P = aB c [A14.28.1] 

where B is the floor space (m 2 ), P the probability of fire over 
1 year, a is a constant and c an index. They give the follow¬ 
ing data: 


Probability of fire over 1 year 



All buildings 

Process buildings 

Probability 
function 
Probability 
for 1500 m 2 
building 

P=0.017B°' 27 

0.12 

P=0.069B° ab 

0.21 


A survey of the major safety incidents has been con¬ 
ducted by Williams, G.R (1999). Eighty-nine ammonia 
plants during the period 1994-96 have one fire every 14.2 
months on average, which is slightly better then previously 
reported value of 14.6 months. 

Al 4.28.2 Petroleum industry fires 

Information on the frequency of fires in the petroleum 
industry in the United States is given in the annual series 
Reported Fire Losses in the Petroleum Industry by the API. 
The fires reported are those involving losses greater than 
$2500. The fires losses for the period 1982—85 are shown in 
Table A14.55. 


Al4.28.3 Refinery fires 

Data on the frequency of refinery fires are given in 
Table A14.57. The API fire loss reports also give a break¬ 
down of the fire losses. For 1985 the sizes of fire by loss were 


Size of loss (1000$) 

No. of fires 

2.5-100 

65 

100-1000 

37 

>1000 

7 


The frequency of refinery fires may be estimated from 
these data and from the number of refineries given in 
Section A14.ll. The First Canvey Report gives frequency of 
fire in a refinery = 0.1 fires/year 

Al 4.28.4 Pump fires 

Estimates of the frequency of pump fires have been given 
by Kletz (1971) and are shown in Table A16.55. 

N.M. Wallace and David (1985) have described a study in 
Esso on mechanical seals, in which losses due to fires from 
pump failures were apportioned as follows: 


Seal failure 54% 

Bearing or shaft failure 36% 

Unknown 10% 


Al 4.28.5 Storage tank fires 

Information on the frequency of fires on storage tanks in 
the petroleum industry in the United States is given in the 
annual series Reported Fire Losses in the Petroleum Industry 
by the API. The fires reported are those involving losses 
greater than $2500. The storage tank fire losses for the 
period 1982—85 are shown in Table A14.56. 

For fires in fixed roof storage tanks for hydrocarbons 
Kletz (1971) states that based on data from more than over 
500 tanks over a period of 20 years the frequency of a tank 
fire or explosion is once in 883 tank-year. 

His estimate of the factor by which the frequency of fire 
or explosion may be reduced by the use of inerting is 10. 

A14.29 Explosions 

Al 4.29.1 Furnace explosions 

Data on the distribution of causes of furnace explosions has 
been given by Ostroot (1972). The numbers of incidents 
listed are 


Cause of explosion 

Gas 

Furnace firing 

Oil 

Inadequate purge 

55 

12 

Delayed ignition 

42 

81 

Incorrect fuel-air ratio 

19 

5 


In the discussion to the paper Kletz (1972c) said that his 
company reckoned on a frequency of explosion of 1 in 25 
furnace-year. Ostroot quoted for his company a figure of 
about 1 in 100, or even 1 in 1000 furnace-year. 
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A14.29.2 Vapour cloud explosions 

Data on vapour cloud explosions have been given by 
Davenport (1977,1983). 

For vapour cloud explosions at fixed installations 
Davenport (1983) records some 35 cases over the period 
1962-82 inclusive. The location of these explosions is 


United States 19 

Western Europe 10 

Other 6 


If it is assumed that there were at risk in the United States 
and Western Europe over this period some 10,000 chemical/ 
petrochemical plants, major refinery units, LPG storages 
and natural gas plants, then 

Frequency of vapour cloud explosion = 29/(21 x 10,000) 
#= 1.4 x 10 -4 explosions/year 

Information on the distribution of leak sources in vapor 
cloud explosions is given inTable A14.49. 

Further data on vapour cloud explosions are given in 
Chapter 17. 


A14.31 External Events 

A14.31.1 Aircraft crash 

Information on the probability of a potentially damaging 
accident due to an aircraft crash at various reactor sites is 
given in the Rasmussen Report (table III 6-4). The highest 
probability quoted is 1 x 10 _6 /year for a crash at a site 
located 5 miles from an airport with 40,000 air carrier and 
40,000 naval flight movements per year. The assumed 
target area is 0.01 mile 2 for larger aircraft and 0.005 mile 2 
for smaller ones. 

The impact of the aircraft would not necessarily cause 
damage within the containment. In fact the estimated 
probability that such damage would occur given impact is 
less than 1 in 100. 

Other accounts of the risk of aircraft crash are those of 
D.W. Phillips (1981SRD R198) and Marriott (1987). 


A14.32 Notation 

Section A14.23 

B 

P 


constant 
floor space (m 2 ) 
index 

probability of fire in 1 year 


A14.30 Transport 

Failure data for transport are given in Chapter 23 and 
Appendix 17. 

A total of 185 accidents involving natural gas (gaseous) 
were surveyed with 179 from the Major Hazard Incident 
Data Service database (Montiel et al., 1996), of which 131 
(70.8%) is transportation related. These 131 accidents dur¬ 
ing transportation are further analysed, and Tables A14.57 
and A14.58 give a summary of their findings. 


Section A14.27 

A,B,C 

D 

P 


X 

Subscript 


constants 
severity parameter 
pressure (psi) 
temperature (°C) 
hazard rate 
failure rate 


base case 
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An earthquake is one of the principal natural hazards from 
which process plants world-wide are at risk. Some account 
is therefore necessary of the seismic design of plants and 
the assessment of seismic hazard to plants. 

Accounts of earthquakes are given in Seismicity of the 
Earth and Associated Phenomenahy Gutenberg and Richter 
(1954), Elementary Seismology by Richter (1958), Introduc¬ 
tion to Seismology by Bath (1979), Earthquakes and the 
Urban Environment by Berlin (1980), Earthquakes by Eiby 
(1980), An Introduction to the Theory of Seismology by Bul- 
len and Bolt (1985) and Earthquakes by Bolt (1988). Treat¬ 
ments of earthquake engineering, most of which give some 
coverage of seismology, include Dynamics of Bases and 
Foundations by Barkan (1962), Earthquake Engineering by 
Wiegel (1970), Fundamentals of Earthquake Engineering by 
Newmark and Rosenbleuth (1971), Earthquake Resistant 
Design by Dowrick (1977,1987), Ground Motion and Engi¬ 
neering Seismology by Cakmak (1987) and Manual of Seis¬ 
mic Design by Stratta (1987). UK conditions are dealt with 
in Earthquake Engineering in Britain by the Institution of 
Civil Engineers (1985) and by Lilwall (1976) and Alderson 
(1982 SRDR246,1985). 

It is proper to recognize also the large amount of work 
done on seismicity and seismic engineering in Japan. 

Earthquake engineering is a specialist discipline. The 
account given here is limited to an elementary introduction. 

Selected references on earthquakes, earthquake-resis¬ 
tant design and earthquake hazard assessment are given in 
Table A15.1 


A15.1 Earthquake Geophysics 

A15.1.1 Earth structure 

The structure of the earth is illustrated in Figure A15.1 and 
is approximately as follows: a crust 30 km thick, a mantle 
2900 km thick and a core of 3470 km radius, giving a total 
radius of 6370 km. The core has an inner core of 1400 km 
radius. 

The crust exhibits two layers. In the lower of these layers 
the velocity of seismic waves is rather higher. The interface 
between the two is known as the Conrad discontinuity. 
Likewise, the mantle is divided into the upper and lower 
mantles. The crust and the upper mantle are termed the 
lithosphere. Other discontinuities are the Mohorovicic dis¬ 
continuity at the boundary of the crust and the mantle, and 
the Gutenberg discontinuity at the boundary of the mantle 
and the core. 

A15.1.2 Crustal strain and elastic rebound 

The earth’s crust has a degree of elasticity and when sub¬ 
ject to stress due to the earth’s forces it undergoes crustal 
strain. This property is the basis of the elastic rebound 
theory of Reid, which provides one explanation of the way 
in which earthquakes occur. Reid suggests that ‘the crust, 


Table A15.1 Selected references on earthquakes, 
earthquake-resistant design and earthquake hazard 
assessment (see also Tables 9.1 and 10.2) 


California Inst.Technol. (n.d.); NRC (Appendix 28 
Seismic Events); Mercalli (1902); Wrinch and Jeffreys 
(1923); Milne (1939); Nordquist (1945); Housner (1947); 
Dix (1952); EERI (1952); Gutenberg and Richter (1954, 


1956,1965); Neumann (1954); Jenkins and Oakshott 
(1955); Gutenberg (1956); Richter (1958); Bullen 
(1963); Evison (1963); Esteva and Rosenblueth (1964); 
Matuzawa (1964); C.R. Allen (1967); Esteva (1967,1974); 
Jennings, Housner and Tsai (1968); Karnik (1968,1991); 
Rothe (1969); Stacey (1969); P.O. Marshall (1970); NEIC 
(1970); TUcker, Cook etal. (1970); Anon. (1971e); 
Greensfelder (1971); Nat. Ocean Atmos. Admin (1972); 

Bath (1973,1979); Donovan (1973);Tank (1973); Barbreau, 
Ferrieux and Mohammadioun (1974); Lomnitz (1974); 
Hsieh, Okrent and Apostolakis (1975a,b); Okrent 
(1975); US Geol. Survey (1975); H.D. Foster (1976); 

H.D. Foster and Carey (1976); Hsieh and Okrent (1976); 
Lomnitz and Rosenblueth (1976); McGuire (1976); Bolt 
(1978,1980,1982,1988); Lee, Okrent and Apostolakis 
(1979); Verney (1979); Berlin (1980); Eiby (1980); BRE 
(1983 BR31); Veneziano, Cornell and O’Hara (1984); 

Bullen and Bolt (1985); Muir Wood (1985); EPRI (1986); 
Mosleh and Apostolakis (1986); ASCE (1987/33,1988/ 36); 
Bernreuter, Savy and Mensing (1987); Cassaro and 
Martinez-Romero (1987); Cermak (1987); J. Evans etal. 
(1987); Grandori, Perotti and Tagliani (1987); Kropp 
(1987); Nuttli and Herman (1987); Savy, Bernreuter 
and Chen (1987); Stratta (1987); Van Gils (1988); 

EEFLT (1991). 

Earthquakes in Britain: Davison (1924); Lilwall (1976); 
Alderson (1982 SRD R246,1985); Instn Civil Engrs (1985); 
Irving (1985); Liam Finn and Atkinson (1985) 

Earthquake-resistant design, earthquake 
hazard assessment 

ASCE (Appendix 27,28,1979/8,1981/12,1983/13, 

14,16,1984/19,1985/24,1986/30,1987/32,1990/39,40, 
1991/42,43); ASME (Appendix 28 Pressure Vessels and 
Piping, 1982/12,1984/16); ASTM (STP 450); NRC 
(Appendix 28 Seismic Fragility, Seismic and Dynamic 
Qualification, 1973,1979a,c); EERI (1952); Barkan (1962); 
NTIS (1963); Benjamin (1968); Benjamin and Cornell 
(1970); Wiegel (1970); Newmark and Rosenblueth (1971); 
BRE (1972 BR6); AEC (1973); Dept of Commerce (1973); 
Newmark and Hall (1973,1978); Okamoto (1973); Struct. 
Engrs Association of California, Seismology Committee 
(1975); Blume (1976); Int. Conf. Building Officials (1976, 
1991); Lomnitz and Rosenblueth (1976); McGuire (1976); 
Aziz (1977); Dowrick (1977,1987); P. Arnold (1978); Sachs 
(1978); Alderson (1979 SRD R135,1982 SRD R246,1985); 
Eberhart (1979); T.Y. Lee, Okrent and Apostolakis (1979); 
Anon. (1981c); R. Davies (1982); M. Schwartz (1982a); 
ASCE (1984); R.P. Kennedy and Ravindra (1984); Kunar 
(1985); Lee andTrifunac (1985); C.R. Smith (1985); 
Dimming (1986); Stratta (1987); R.P. Kennedy et al. (1989); 
Goschy (1990); Casselli, Masoni and Foraboschi (1992); 
Ravindra (1992) 

Structures: Timoshenko (1936); Flugge (1960); Warburton 
(1976); Pilkey and Chang (1978) 

Storage tanks, vessels: Veletsos and Yang (1976); Eberhart 
(1979); R.P. Kennedy (1979,1982a); Haroun and Housner 
(1981); R. Davies (1982); D.W Phillips (1982); Veletsos (1984); 
Priestly etal. (1986); Veletsos and Yu Tang (1986a,b) 

Fluid structure interactions, liquid sloshing: ASME (PVP 
128,1988 PVP 145,1989 PVP 157); ASCE (1984/18) 
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km 

Figure A15.1 The structure of the earth and passage of seismic waves through it (US Geological Survey, 1975) 


in many parts of the earth, is being slowly displaced, and 
the difference between displacements in neighbouring 
regions sets up elastic strains, which may become greater 
than the rock can endure. A rupture then takes place, and 
the strained rock rebounds under its own elastic stresses, 
until the strain is largely or wholly relieved’. 


A15.1.3 Plate tectonics, faults and fault creep 

In some regions earthquakes are associated with faulting 
of the earth, while in others there appears to be little 
apparent correlation between earthquakes and structural 
features. 

Earthquakes are frequently associated with faulting of 
the earth. There has been debate, however, as to whether the 
faults have caused the earthquakes or the earthquakes the 
faults. The latter viewpoint has been argued by Evison 
(1963). 

A fault in the crust may be caused by tension, compres¬ 
sion or shear. A normal fault, in which slip occurs between 
one block and another, is usually considered to be the 
result of tension and a reverse fault, in which one block is 
thrust below another, the result of compression or thrust. 
These two types of fault are also termed dip-slip faults. 
The slip plane is characterized by the angle of dip, or angle 
of the plane to the horizontal; an angle of dip close to 90° 
corresponds to a nearly vertical slip plane. In a shear 
fault the relative movement of the two blocks is pre¬ 
dominantly horizontal. This type is also termed a strike- 
slip, or transcurrent, fault. There are also oblique slip faults 
in which there is a combination of vertical and horizontal 
movement. 


As a result of displacement, the ground in a zone 
extending out from a fault can become permanently 
deformed. The disturbed zone, or shatter zone, can be up to 
1 km wide. The magnitude of displacements is discussed 
by Berlin, who mentions cases of a 14.4 m vertical dis¬ 
placement, or uplift, in Alaska and of a 4.9 m horizontal 
displacement in California; there is a 6.1 m horizontal dis¬ 
placement reported for the 1906 San Francisco earthquake 
but this is subject to some doubt. 

Thebuild-up of strain inthe crust maybe relaxedby a much 
more gradual movement of the crust, or fault creep. This 
process, which may be continuous or episodic, does not gen¬ 
erate earthquake waves. An account is given by Berlin. 

In some regions there are faults that are associated with 
recent seismic activity, or active faults. Perhaps the best 
known is the San Andreas fault in California. This fault is a 
strike-slip fault, or, viewed on a finer scale, a system of 
strike-slip faults. There are often lesser faults associated 
with the main fault as branch faults or as subsidiary faults, 
joining the main fault at oblique angles and sometimes in 
echelon along it. 

There are some regions which are very much more prone 
to earthquakes than others. One explanation for this is 
given by the theory of continental drift, and of plate tec¬ 
tonics, according to which the earth’s lithosphere is divided 
into a number of rigid plates that move relative to each 
other. Earthquakes are much more frequent at these inter¬ 
faces. The Pacific rim is the most striking example, but 
there are a number of others. 

There are a number of definitions of what constitutes an 
active fault. For the siting of nuclear power plants in the 
United States, the NRC considers a fault to be active if there 
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has been movement at least once in last 35,000 years. Other 
definitions are discussed by Berlin (1980). 

As stated earlier, however, earthquakes do also occur in 
regions where there is no apparent correlation with active 
fault structures. 

A15.1.4 Focus and epicentre 

The origin of an earthquake is termed the focus, or hypo- 
centre, and the point on the earth’s surface directly above 
the focus the epicentre. 

Earthquakes are classified as shallow focus (focus depth 
<70 km), intermediate focus (depth 70-300 km) and deep 
focus (depth >300 km). 

A15.1.5 Seismic waves 

During an earthquake waves pass through the earth and 
impart motion to the ground. These waves are elastic in that 
the rocks through which they pass then return to their ori¬ 
ginal shapes and positions. 

There are two broad types of wave: body waves and 
surface waves. Body waves are classified as primary, or P, 
waves and secondary, or S, waves. A P wave is a longi¬ 
tudinal or compression wave, is analogous to a sound wave 
and has a velocity of some 8 km/s. An S wave is a transverse 
or shear wave, is analogous to electromagnetic waves and 
has a velocity of some 4.5 km/s. The passage of P and S 
waves is illustrated in Figure A15.1. Both P and S waves can 
undergo reflection. Reflection can occur at the earth’s sur¬ 
face or at a boundary such as that between the mantle and 
the core. Refraction can occur through the core. On reflec¬ 
tion both types of wave can be transformed to the other 
type, that is, a P wave to an S wave, or vice versa. 

The notation used for P and S waves is illustrated in 
Figure A15.1. A P wave travelling directly from the focus 
to the point of measurement without reflection is denoted 
as P, one undergoing one reflection at the surface PP and 
one undergoing two reflections at the surface PPP. A P 
wave undergoing one reflection at the core is denoted as 
PcP. The corresponding notation for S waves is S, SS and 
SSS for a wave with zero, one and two surface reflections 
and ScS for a wave with one core reflection. There are also 
hybrid waves such as PS, PSS, PPS, PSP; SP, SPP, SSP, SPS; 
PcS and ScP. 

Both P and S waves can undergo refraction through the 
earth’s core. In the core itself there is a difference between P 
and S waves: an S wave cannot pass through the core. 
However, the wave leaving the core can be either a P wave or 
an S wave; in the latter case this is due to transformation at 
the core boundary. Hence, an S wave can enter the core, 
undergoing transformation to a P wave on entry and fur¬ 
ther transformation to an S wave on exit, and then travel on 


as an S wave again. The principal refractions through the 
core are denoted as PKP, PKS, SKP and SKS (K for Kern 
in German). There are also more complex waves such as 
PKKP (refraction—reflection-refraction in the core) 
and PKPPKP (refraction in core-reflection at surface- 
refraction in core). 

The distance between the focus and the point of mea¬ 
surement is generally expressed in degrees rather than 
kilometres. A degree corresponds to about 111 km. 

There is a limiting angle of about 103° at which a P wave 
is reflected from the core. At any angle greater than this the 
wave is refracted through the core. The effect is to create 
between an angle of about 103° and one of about 142° 
a ‘shadow zone’ to which waves do not penetrate. 

The other main type of wave is surface waves. Surface 
waves, long waves or L waves, travel round the surface of the 
earth rather than through the interior. They are classified as 
Love, or L Q , waves and Rayleigh, or i R , waves. Love waves 
have a horizontal but no vertical component, Rayleigh waves 
have both horizontal and vertical components. A Rayleigh 
wave is generally described as having a retrograde elliptical 
motion. Both types of wave travel more slowly than S waves, 
with the Rayleigh wave slower than the Love wave. 

L waves may travel round the earth several times and 
generate ground movement with amplitudes of about 1 mm. 
They have a typical period of 10—20 s. They contain large 
amounts of energy but do relatively little damage on 
account of the long period. Often an earthquake is ‘heard 
before felt’. Sounds like a low rumble can be generated by 
the faster P waves, while the ground shaking is due to the 
larger amplitude but slower S waves. 


A15.1.6 Seismic measurements 

An instrument for the recording of the ground motion 
caused by an earthquake is known as a seismometer and 
the record that it produces a seismogram. 

Measurements may be made of any of the three main 
time-domain parameters: displacement, velocity and 
acceleration. 

The measurement of ground motion is well developed 
and records have been obtained for the amplitude and for 
the acceleration of a large number of earthquakes. 

Figure A15.2 gives a seismogram showing the arrival of 
the P, S and L waves. 

There are a number of seismographic networks. A region 
of high seismic activity may have a number of such 
networks. Thus, in California, Berlin describes networks 
operated by the US Geological Survey, the Nuclear 
Regulatory Commission, the University of California and 
several other bodies. At the international level there is the 
World-wide Standard Seismographic Network (WSSN). 
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Figure A 15.2 A seismogram showing P, S and L waves (National Oceanic and Atmospheric Administration, 1972) 
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A15.2 Earthquake Characterization 

The quantitative characterization of earthquakes is largely 
in terms of magnitude and intensity scales and of empirical 
correlations. Earthquakes are a geographical phenomenon 
and hence in many cases the original correlations have been 
derived for a specific region, often California. This should 
be borne in mind in respect of the relationships quoted 
below. 


A15.2.1 Focus and epicentre 

For a particular location the distance r to the epicentre is 
the epicentral distance and the distance to the focus is the 
focal distance so that 

R 2 = tf + r 2 [A15.2.1] 

where R is the focal distance, or slant distance (km), h the 
distance between the focus and the epicentre, or focal depth 
(km) and r the epicentral distance (km). Use is often made of 
a modified focal distance defined as 

R 2 = tf + r 2 + k 2 [A15.2.2] 

where k is a modifying factor (km). Esteva (1967) has given 
an estimate of k = 20. 


A15.2.2 Magnitude and magnitude scales 

The severity of an earthquake is defined in terms of its 
magnitude and intensity. The more objective is the magni¬ 
tude, which is a measure of the total energy in the seismic 
waves. 

A scale for the representation of the magnitude of an 
earthquake was devised by Richter and magnitude is 
commonly quoted in terms of the value on the Richter scale. 
The value is a measure of the ratio of the maximum ampli¬ 
tude recorded for the earthquake in question to the max¬ 
imum amplitude for a standard earthquake, with both 
measurements made on a standard seismograph located at 
a standard distance from the earthquake, the instru¬ 
ment being a Wood—Anderson seismograph of defined 
characteristics. 

The magnitude M of an earthquake may be measured 
locally, in which case it is denoted Ml, or at a distant point 
through surface waves, when it is denoted M s . The two 
differ and in order to overcome this difficulty Gutenberg 
introduced the concept of unified magnitude m, or m h , 
which depends on the body waves. The magnitudes quoted 
in the literature are frequently not fully defined. 

The relation of Richter for the magnitude of a local 
earthquake is 

M l = log 10 (A/A o ) [A15.2.3] 

where A is the maximum amplitude (mm), A 0 the maximum 
amplitude of the standard earthquake (mm) and M L the 
local magnitude, under the standard conditions described. 
The value of A 0 assigned to the standard earthquake is 
A 0 = 0.001 mm. 

The Richter scale is thus a logarithmic one and an 
earthquake that is one unit higher on the scale has an 
amplitude 10 times as great as that below it. 

The Richter magnitude scale is open-ended with no 
lower or upper limit. The scale point 0 is an arbitrary one. 


A number of equations have been developed for the 
surface wave magnitude Ms and the body magnitude 
m h , relating these quantities to the characteristics of the 
seismographic record. 

It is often necessary to convert one type of magnitude to 
another. Two widely used approximate relations are those 
given by Richter (1958) 

M s = 1.59m b - 3.97 [A15.2.4] 

and 

Wb = 2.5 + 0.63M S [A15.2.5] 

These two magnitudes agree at a value of about 6.8; below 
this «b is larger and above it Ms is larger. There is also the 
empirical equation of Gutenberg (1956) 

« b = 1-7 + 0.8ML - O.OIMl [A15.2.6] 

A15.2.3 Energy 

The relationship between the total seismic wave energy 
and the surface wave magnitude was the subject of a series 
of studies by Gutenberg and Richter, who produced 
between 1936 and 1956 a number of correlations. The 1956 
Gutenberg—Richter equation for energy, quoted by 
Gutenberg (1956), is 

log 10 E = 11.8 + 1.5M S [A15.2.7] 

where E is the total energy (erg). 

Gutenberg has also given the following relations 
between the total energy and the other magnitudes: 

log 10 .E = 9.9 + 1.9 M l - 0.024 Ml [A15.2.8] 

log 10 £ = 5.8 + 2.4m b [A15.2.9] 

An earthquake that is one unit higher on the Richter mag¬ 
nitude scale has an energy some 27 times as great as that 
below it. 


A15.2.4 Frequency and return period 

A correlation between the frequency and magnitude of 
earthquakes was obtained by Gutenberg and Richter. Their 
equation is given by Richter (1958) as 

log 10 N = a — bM [A15.2.10] 

where N is the frequency of earthquakes exceeding that 
magnitude (per year), and a and b are constants. This 
equation is generally referred to as the Gutenberg-Richter 
equation for frequency. 

Various workers have used the Gutenberg-Richter 
equation to correlate the frequency of earthquakes for dif¬ 
ferent regions and periods. 

Estimates for the relationship between the magnitude 
and the frequency of earthquakes world-wide by Gutenberg 
and Richter (1940) are given below together with later esti¬ 
mates by the National Earthquake Information Center 
(NEIC) (1970). 



APPENDIX 15/6 EARTHQUAKES 


A/l 

Gutenberg and, 

Richter description 

Annual 

frequency 

NEIC 

description 

Annual 

frequency 

>8.0 

Great earthquakes 

1 

Great 

1.1 

7.0—7.9 

Major earthquakes 

10 

Major 

18 

6.0—6.9 

Destructive shocks 

100 

Large (destructive) 

120 

5.0—5.9 

Damaging shocks 

1,000 

Moderate (damaging) 

1,000 

4.0—4.9 

Minor strong shocks 

10,000 

Minor (damage slight) 

6,000 

3.0—3.9 

Generally felt 

100,000 

Generally felt 

49,000 


A15.2.5 Intensity and intensity scales 

The other main measure of the severity of an earthquake is 
the intensity. Intensity is a measure of the severity of an 
earthquake as experienced at a particular location. 

Thus, an earthquake of a given magnitude may have 
different intensities at different locations. However, in so 
far as interest centres on the effects at a given location, such 
as a town, an intensity may be assigned for the earthquake 
at that location. Thus, an intensity is often quoted for an 
earthquake identified by town and year. 

There are several scales for the representation of the 
intensity of an earthquake. One of the earliest was the 
Rossi-Forelli (RF) scale. This was modified by Mercalli to 
give the Mercalli scale and subsequently modified again 
in 1931 to give the Modified Mercalli (MM) scale. The 
MM scale has since undergone further revisions. The MM 
scale is the most widely used intensity scale. It is shown in 
Table A15.2 

One way of characterizing a particular earthquake is by 
an isoseismal map showing the contours of the MM scale 
intensities. 

The MM scale gives the intensity as a Roman numeral. 
For quantitative work the intensity is required as a 
numerical value. The practice is to use the Roman numeral 
directly. Thus, an earthquake of intensity between MM 
scale I and II has an intensity of 1.5. This is the approach 
described by Richter (1958, p. 140). 

There are numerous empirical relationships that have 
been developed between intensity and other earthquake 
parameters. One is the equation of Gutenberg and Richter 
(1956) between local magnitude, intensity and epicentral 
intensity 

M l =I + I 0 /3 [A15.2.11] 

where / is the intensity and I 0 the epicentral intensity. 

Another is the relation of Esteva and Rosenblueth (1964) 
between intensity, local magnitude and focal depth 

I = 8.16 + 1.45M l - 2.46 log 10 h [A15.2.12] 

The following relation is given by Richter (1958) between 
peak ground acceleration (PGA) and intensity: 

logi O 0 = ~-~ [A15.2.13] 

where a is the PGA (cm z /s). 

A15.3 Earthquake Effects 

The effects of an earthquake may be classified as direct or 
indirect. The direct effects include 


(1) ground shaking; 

(2) ground lateral displacement; 

(3) ground up-lift and subsidence; 

and the indirect effects 

(4) ground settlement; 

(5) soil liquefaction; 

(6) slope failure: 

(a) avalanches, landslides, 

(b) mud slides; 

(7) floods; 

(8) tsunamis and seiches; 

(9) fires. 

Of the direct effects, ground shaking usually occurs over 
a wide area. At faults, fault displacement results in lateral 
movement of the ground and surface breaks. The distance 
over which the surface breaks occur is variable. There may 
be tectonic up-lift and subsidence. 

Of the indirect effects, ground settlement may occur due 
to compaction of unconsolidated deposits. There may be 
soil liquefaction, giving a ‘quick condition’ failure. Slope 
failures may occur in the form of avalanches, landslides 
and mud slides. 

The earthquake may cause floods due to the failure of 
dams or levees. In certain regions there may occur tsuna¬ 
mis. A tsunami is a wave occurring in relatively shallow 
water and is caused by vertical displacement of the earth 
beneath the water. Seiches may also occur. A seich is a 
standing wave on the surface of water such as a lake. 

The destruction of buildings and the rupture of gas 
mains tends to give rise to widespread fires. 

A15.4 Earthquake Incidents 

Tabulations of earthquakes are given in a number of texts. 
Eiby (1980) gives a chronological list; this includes the 
values of the magnitudes. Berlin gives tables showing 
earthquakes that have caused major fatalities world-wide, 
major fatalities in the United States and major property 
damage in the United States. Bolt (1988) gives tables of 
earthquakes world-wide, in the United States and Canada 
and in Central and South America; the North American list 
gives MM intensities. Berlin (1980) also gives lists of 
earthquakes with special features such as shattered earth, 
vertical displacement and bad ground and soil liquefaction 
effects. 

Table A15.3 gives some earthquakes in this century that 
have caused major loss of life world-wide or property 
damage in the United States. Table A15.4 lists some earth¬ 
quakes that are frequently discussed in texts on earth¬ 
quakes or earthquake-resistant design as having features 
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Table A15.2 The Modified Mercalli intensity scale 


Intensity Description a 


I Not felt. Marginal and long-period effects of large earthquakes 

II Felt by persons at rest, on upper floors, or favourably placed 

III Felt indoors. Hanging objects swing. Vibration like passing of light trucks. Duration estimated. May not be 

recognized as an earthquake 

IV Hanging objects swing. Vibration like passing of heavy trucks; or sensation of a jolt like a heavy ball striking 

the walls. Standing motor cars rock.Windows, dishes, doors rattle. Glasses clink. Crockery clashes. In the 
upper range of IV, wooden walls and frame creak 

V Felt outdoors; direction estimated. Sleepers wakened. Liquids disturbed, some spilled. Small unstable 

objects displaced or upset. Doors swing, close, open. Shutters, pictures move. Pendulum clocks stop, start, 
change rate 

VI Felt by all. Many frightened and run outdoors. Persons walk unsteadily. Windows, dishes, glassware broken. 

Knickknacks, books, etc., off shelves. Pictures off walls. Furniture moved or overturned.Weak plaster and 
masonry D cracked. Small bells ring (church, school). Trees, bushes shaken (visibly, or heard to rustle) 

VII Difficult to stand. Noticed by drivers of motor cars. Hanging objects quiver. Furniture broken. Damage to 

masonry D, including cracks. Weak chimneys broken at roof line. Fall of plaster, loose bricks, stones, tiles, 
cornices (also unbraced parapets and architectural ornaments - CFR). Some cracks in masonry C. Waves 
on ponds; water turbid with mud. Small slides and caving in along sand or gravel banks. Large bells ring. 
Concrete irrigation ditches damaged 

VIII Steering of motor cars affected. Damage to masonry C; partial collapse. Some damage to masonry B; none to 

masonry A. Fall of stucco and some masonry walls. Twisting, fall of chimneys, factory stacks, monuments, 
towers, elevated tanks. Frame houses moved on foundations if not bolted down; loose panel walls thrown 
out. Decayed piling broken off. Branches broken from trees. Changes in flow or temperature of springs 
and wells. Cracks in wet ground and on steep slopes 

IX General panic. Masonry D destroyed; masonry C heavily damaged, sometimes with complete collapse; 

masonry B seriously damaged. (General damage to foundations -CFR.) Frame structures, if not bolted, 
shifted off foundations. Frames cracked. Serious damage to reservoirs. Underground pipes broken. 
Conspicuous cracks in ground. In alluviated areas sand and mud ejected, earthquake fountains, sand craters 

X Most masonry and frame structures destroyed with their foundations. Some well-built wooden structures 

and bridges destroyed. Serious damage to dams, dikes, embankments. Large landslides.Water thrown on 
banks of canals, rivers, lakes, etc. Sand and mud shifted horizontally on beaches and flat land. Rails bent 
slightly 

XI Rails bent greatly. Underground pipelines completely out of service 

XII Damage nearly total. Large rock masses displaced. Lines of sight and level distorted. Objects thrown 

into the air 


a CFR, Charles F. Richter additions to the 1931 scale. Masonry A, good workmanship, mortar, and design; reinforced, especially laterally, and 
bound together by using steel, concrete, etc.; designed to resist lateral forces. Masonry B, good workmanship and mortar; reinforced, but not 
designed in detail to resist lateral forces. Masonry C, ordinary workmanship and mortar; no extreme weaknesses like failing to tie in at corners, 
but neither reinforced nor designed against horizontal forces. Masonry D, weak materials, such as adobe; poor mortar; low standards of work¬ 
manship; weak horizontally. 

From Elementary Seismology by Charles F. Richter, W. H. Freeman and Company, Copyright © 1958. Reproduced by permission. 


of particular interest; accounts of these earthquakes are 
given in the references shown in the table. 

Table A15.3 gives only earthquakes that have occurred 
since 1920. It nevertheless includes some that have caused 
very large loss of life, in particular those at Kwanto in Japan 
in 1923 and Tangshan in China in 1976, where the death tolls 
were 143,000 and 250,000, respectively. 

The San Francisco earthquake in 1906 was one of large 
magnitude (8.3) and high intensity (XI). The ground shook 
for some 40-60 s. Notable features were the difference in 
damage between buildings on good ground and those on 
bad ground and the outbreak of large numbers of fires. 
Some 700 people were killed. 

TheTokyo-Yokohama earthquake in Japan in 1923, also 
known as the Kwanto earthquake after the province most 
affected, was another with large magnitude (8.3). Tokyo 
and Yokohama, both very densely populated, were almost 
completely destroyed. Fire broke out on a large scale and it 
was this rather than building collapse that was responsible 
for the high death toll of some 143,000. 


These two disasters gave impetus to the development 
of seismological studies and seismic engineering in the 
United States and Japan. 

The earthquake in Imperial Valley, California, in 1940, 
also known as El Centre, which had a magnitude of 6.9, is of 
particular interest to seismologists. A seismograph in El 
Centre recorded a PGA of some one third that of gravity. For 
many years this was the only record available to engineers 
showing clearly the ground shaking caused by a large 
earthquake close to its source. 

Another earthquake that has been of particular interest 
to seismological engineers is that at Parkfield in 1966 with 
a magnitude of 5.6. The Parkfield earthquake was less 
destructive than that at El Centre in 1940, but it gave a PGA 
of 0.5 g compared with that of 0.33 g for El Centre. 

The interest in these two earthquakes has been 
enhanced by a further earthquake at Imperial Valley in 
1979, which was of similar size to the 1940 event, and by the 
fact that Parkfield has been the subject of one of the prin¬ 
cipal examples of the prediction of future earthquakes. 
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Table A15.3 Some earthquakes causing major loss of life 
or property damage 


A Earthquakes causing major loss of life 3 

Year 

Location 

Number of deaths 

1920 

Kansu, China 

180,000 

1923 

Tokyo-Yokohama, Japan 

143,000 

1932 

Kansu, China 

70,000 

1935 

Quetta, India 

60,000 

1939 

Chilian, Chile 

30,000 

1939 

Erzincan, TUrkey 

23,000 

1960 

Agadir, Morocco 

14,000 

1962 

North-western Iran 

14,000 

1968 

North-eastern Iran 

11,600 

1970 

Peru 

66,000 

1972 

Managua, Nicaragua 

12,000 b 

1976 

Guatemala 

22,000 

1976 

Tangshan, China 

» 250,000° 

1976 

Hopei, China 

655,000 


B Earthquakes causing major property damage in 
the United States' 1 


Property damage 
($ million) 


1906 

San Francisco, CA 

24 

500 (fire loss) 

1933 

Long Beach, CA 

40 

1952 

Kern County, CA 

60 

1964 

Alaska and US West Coast 

500 

1971 

San Fernando, CA 

553 


a Earthquakes since 1920 causing 10,000 or more deaths. 
b This is Berlin’s figure; Bolt gives 5000. 

c For China in 1976 this is Bolt’s entry; Berlin gives Hopei with 655,000 
deaths. 

d Earthquakes since 1900 causing $40 million or more property 
damage. 

Sources: Berlin (1980); Bolt (1985). 


In 1954 the oil fields of Kern County, California, were 
subject to an earthquake. The damage caused by this event 
to process installations is described in Section A15.5. 

Several earthquakes have occurred in areas that were not 
regarded as major seismic risk zones. One of these occur¬ 
red at Agadir in 1960. The epicentre of the earthquake was 
close to the town and although of relatively low magnitude 
(5.8) it was very destructive. Much of the town consisted of 
old buildings and this was a further major contributor to 
the destruction. The death toll is quoted as 14,000. 

The earthquake at Skopje in 1963 had similar features. 
The area was not regarded as one of particular seismic 
activity. Its epicentre was close and it was highly destruc¬ 
tive despite being of relatively low magnitude (6.0). About 
1200 people were killed. 

Both the Agadir and Skopje earthquakes were practi¬ 
cally a single shock. 

The earthquake at Mexico City in 1957, which had a 
magnitude of 7.5, was notable for the damage to buildings 
standing on bad ground. In locations where the soil was 
alluvium, there was widespread soil liquefaction. The old 
lake bed area of the city experienced intensities of VII, 
whereas at other locations the intensities were Vor less. 


Another earthquake in which there was extensive 
damage due to soil liquefaction was that at Niigata in 1964, 
which had a magnitude of 7.5. The Niigata earthquake gave 
impetus to the study of soil effects, and particularly soil 
liquefaction. 

A large earthquake, of magnitude 8.4, occurred in 
Alaska in 1964.This event was notable for its long duration 
and wide reach, and for its destructiveness. The earth 
shook for about 3 min. Ground fissures occurred 725 km 
from the epicentre. Quite large areas suffered up-lift or 
subsidence. The docks at the port of Anchorage suffered 
large displacements. The damage caused to process instal¬ 
lations by this event is described in Section A15.5. 

The San Fernando earthquake of 1971 has several fea¬ 
tures of interest. It is a prime instance of the shattered earth 
effect described in Section A15.7. In localized areas the 
intensity was assessed as high as XII. Ground accelera¬ 
tions were the highest recorded at 1.25 and 0.7 g for hor¬ 
izontal and vertical accelerations, respectively. Some of the 
damage effects, particularly to lifelines, are described in 
Section A15.5. 

As far as concerns the United Kingdom, mention should 
be made of the Great British Earthquake of April 22,1884, 
near Colchester, to which a magnitude of 5.3 has been 
assigned. The PGA has been estimated as between 0.07 
and 0.2 g. 


A15.5 Earthquake Damage 

There are available numerous accounts of earthquake 
damage. Most texts on seismology contain descriptions 
and illustrations of the damage caused by particular 
earthquakes. These accounts deal largely, often exclusively, 
with damage to buildings, which is not the prime concern 
here. There is rather less information available on damage 
to plant. 

A review of seismic damage to process plant and utilities 
has been given by Alderson (1982 SRD R246). Information 
is also given by Berlin (1980). 

The earthquake in Kern County near Bakersfield in 1952 
(Case History A20) occurred in an oil production area. The 
production rate of several oilfields was affected. Many 
storage tanks skidded but only a few collapsed. 

The most spectacular effect occurred at the Paloma 
Cycling Plant, where the earthquake caused two of the five 
large butane spheres to collapse, rupturing pipework and 
giving a major release. A large vapour cloud formed and 
was ignited at electrical transformers almost three blocks 
away. There was a large vapour cloud explosion, followed 
by a major fire. 

On vessels, columns and tall heat exchangers steel foun¬ 
dation bolts were stretched. The top of one vessel standing 
60 ft high and weighing some 100 te was estimated from the 
1 in. stretch of the bolts at its base to have moved over an arc 
of 3 ft. There were no major failures, however, of horizontal 
vessels or pressure storage tanks. High pressure pipework 
withstood the earthquake well, although there were 
thermal failures in the subsequent fire; only one cold fail¬ 
ure was reported. 

At other installations damage was minimal. At one plant 
oil sloshing in storage tanks broke through the roof. At one 
pipeline station pipe displacements of 5 in. were found. 
Elevated water tanks with no lateral support suffered 
badly. Of the 12 in the area, two collapsed and seven had 
suffered damage to their supports. 
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Table A15.4 

Some earthquakes of particular interest 



Date 


Magnitude 

Reference 

18 April 1906 

San Francisco, CA 

8.3 


1 Sept. 1923 

Kwanto, Japan 

8.3 


18 May 1940 

Imperial Valley (El Centre) 

6.9 

Dowrick (1977) 

21 July 1952 

Kern County, CA 

7.7 

Berlin (1980); Alderson (1982) a 

21 Dec. 1954 

Eureka, CA 

6.6 

Alderson (1982) 

22 March 1957 

San Francisco, CA 

5.3 

Alderson (1982) 

28July 1957 

Mexico City 

7.5 

Berlin (1980) 

29 Feb. 1960 

Agadir, Morocco 

5.8 

Eiby (1980) 

22 May 1960 

Arauco, Chile 

8.4 

Eiby (1980) 

26 July 1963 

Skopje 

6.0 

Alderson (1982) 

27 March 1964 

Alaska 

8.4 

Berlin (1980); Alderson (1982) 

16 June 1964 

Niigata, Japan 

7.5 

Dowrick (1977); Berlin (1980); 

27June 1966 

Parkfleld 

5.6 

Dowrick (1977); VW. Lee and Trifunac (1987); 
Bolt (1988) 

19 Aug. 1966 

Varto, Turkey 

7 

Berlin (1980) 

9 Feb. 1967 

Columbia 

6.7 

Alderson (1982) 

31 May 1970 

Chimbote, Peru 

7.7 

Eiby (1980) 

9 Feb. 1971 

San Fernando, CA 

6.8 

Berlin (1980) 

4 Feb. 1975 

Liaoning Province 

7.4 

Bolt (1988) 

6 Sept. 1975 

Lice, Turkey 

6.7 

Berlin (1980) 

6 May 1976 

Friuli, Italy 

6.5 

Alderson (1982) 

27 July 1976 

Tangshan 

8.0 

Bolt (1988) 

13 Aug. 1978 

Santa Barbara, CA 

5.8 

Alderson (1982) 

15 Oct. 1979 

Imperial Valley (El Centre) 

- b 

Bolt (1988) 

2 May 1983 

Coalinga, CA 

6.7 (M l ) 

Bolt (1988) 

3 March 1985 

Algarrobo, Chile 

7.8 

Bolt (1988) 

19 Sept. 1985 

Ixtapa, Mexico 

8.1 

Bolt (1988) 


a Alderson (1982)=Alderson (1982 SDR R246). 

b This earthquake is described by Bolt (1988) as ‘similar’ to that in Imperial Valley in 1940. 


There was damage to a number of electrical power plants 
and electrical distribution systems. 

Overall plant management in this area were earthquake¬ 
conscious. Generally, tall vessels were well anchored and 
pipework provided with flexibility. 

Another instructive case is the earthquake at San 
Fernando in 1971 .This was the first occasion on which amajor 
effort was made to investigate the effects on lifelinesystems. 

The earthquake was particularly severe over an area of 
some 30 km 2 at San Fernando and Sylmar. Violent ground 
movement in this area broke gas mains and valves, but this 
was the only area where the gas distribution system suf¬ 
fered serious damage. The water supply system to San 
Fernando was devastated. 

The earthquake disrupted power supplies to large parts of 
Los Angeles.There was damage to Sylmar Converter Station 
(40% equipment loss), Olive Switching Station (80% loss) 
and Sylmar Switching Station (90% loss). The restoration 
time for the first of these was estimated at 1.5-2 years. 

At the Sylmar Central Office of the local telephone 
company 91 te of automatic switching equipment were 
destroyed, putting the telephone service out of action. 

The transport system was also severely affected. Some 
62 bridges were damaged, of which 25% collapsed or were 
severely damaged. 

Other earthquakes for which Alderson gives some 
information on damage to plant include Eureka in 1954, 
San Francisco in 1957, Alaska in 1964 and Santa Barbara 
in 1978. It is not uncommon for there to be some rupture 
of water mains, often due to a combination of corrosion 
and pressure surge. Some rupture of gas pipes also occurs. 


In the 1964 Alaska earthquake there were many failures 
of tanks and pipework. Tanks of all kinds moved and, if not 
well anchored, toppled over. Pipes failed at screwed joints 
and poorly guided thermal loops, as did long unsupported 
cast iron pipe runs. 

A15.6 Ground Motion Characterization 

The ground motion caused by an earthquake may he char¬ 
acterized in terms of the peak values of the acceleration, 
velocity and displacement; of the full time-domain respon¬ 
ses of these quantities, particularly the accelerogram, or of 
the response spectrum.The latter is described below. 

The information required for design depends on the 
method used. Some methods utilize the peak acceleration. 
The trend is, however, to use the full response in the form of 
an accelerogram or a response spectrum. 

For a single parameter, such as the PGA, methods 
of prediction are available. For a full response, such as 
an accelerogram or response spectrum, it is necessary 
to select one that is judged appropriate for the site. 

A15.6.1 Strong ground motion 

The typical pattern of ground motion is a sudden transition 
from zero to maximum shaking, followed first by a period of 
more or less uniformly intense vibration and then by a 
rather gradual attenuation of this vibration. 

There are, however, appreciable differences in the 
ground motion from different earthquakes. Newmark and 
Rosenblueth (1971) distinguish four types of strong ground 
motion: (1) practically a single shock; (2) a moderately long, 
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extremely irregular motion; (3) a long ground motion 
exhibiting pronounced prevailing periods of vibration; and 
(4) a ground motion involving large-scale, permanent 
deformations of the ground. 

They give the earthquakes at Agadir in 1960 and Skopje 
in 1963 in the first category; that at El Centre in 1940 in the 
second; that at Mexico City in 1964 in the third and those in 
Alaska and at Niigata, both in 1964, in the fourth. 

A15.6.2 Peak ground motion 

Methods are available for the estimation of the peak ground 
motion parameters. For ground acceleration one widely 
quoted relation is that given by Donovan (1973), derived 
from data for several seismic regions: 

a _ 1 Q80 exp(0.5M) 

(R + 25) 1,32 

where a is the PGA (cm/s 2 ). 

Esteva (1974) has used data for earthquakes in California 
to obtain equations for both PGA and peak ground velocity: 

j 5600 exp(O.SM) /?>lg 
(R + 40) 2 ’ 

^ = 32expM ^ 

(R + 25) 17 

where v is peak ground velocity (cm/s). 


For peak ground displacement Newmark and Rosen- 
blueth (1971) give the following approximate empirical 
relation 


5 < < 15 [A15.6.4] 

where d is peak ground displacement (cm). The lower limit 
of 5 and the upper limit of 15 apply to large epicentral dis¬ 
tances, say 100 km, and to small ones, respectively. 

A15.6.3 Vibration parameters 

The vibration characteristics of the earthquake are also 
important. Correlations are available for the fundamental 
frequency, or period, of earthquakes. These are described 
by Dowrick (1977). 

A15.6.4 Accelerograms 

The basic seismographic measurement is the accelero¬ 
gram. Profiles of velocity and displacement may be 
obtained from this by integration. A set of such profiles is 
illustrated in Figure A15.3. 

There are now available accelerograms for quite a large 
number of real earthquakes. Collections are maintained by 
major seismographic institutions such as the California 
Institute of Technology. 

Accelerograms are also available for simulated earth¬ 
quakes. A set of eight such accelerograms have been 


[A15.6.2] 

[A15.6.3] 



Figure A 15.3 Time histories of acceleration, velocity and displacement of the earthquake at Mexico City, 6 July 1964 
(after Rosenblueth, 1996) 
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described byjennings, Housner and Tsai (1968).There exist 
computer codes for the generation of simulated earth¬ 
quakes. 

The design of earthquake-resistant structures is 
increasingly based on dynamic analysis. The structure is 
modelled using the appropriate equations of motion and 
this model is then perturbed by a suitable forcing function. 
The natural forcing function to use is an accelerogram. 

A15.6.5 Response spectra 

The main interest in design, however, is in the maximum 
values of certain responses of the structure. Many of these 
depend only on the natural period and the degree of 
damping. A plot which shows the response of one of the 
parameters acceleration, velocity or displacement for a 
given degree of damping is known as a response spectrum 
and that for a set of values of the damping as the response 
spectra. 

Response spectra may be obtained from accelerograms 
by Fourier analysis and there are computer codes to do this. 

There are response spectra available for both real and 
simulated earthquakes. A regulatory body may specify a 
standard set of response spectra for use in design. 

Figure A15.4 shows a set of response spectra issued by 
the NRC. 

A15.7 Ground, Soils and Foundations 

The characteristics of the ground have profound effects 
on virtually all aspects of earthquake assessment and 
earthquake-resistant design. 

A15.7.1 Ground effects 

Experience of earthquakes shows that differences in the 
ground can result in large differences in the damage done. 



Figure A15.4 Seismic design response spectra given in 
Regulatory Guide 1.60 of the Nuclear Regulatory Com¬ 
mission (Nuclear Regulatory Commission, 1973). The four 
damping levels shown are for viscous damping of 0, 5, 2, 5 
and 10% of critical damping) 


According to Eiby (1980), in extreme cases this can amount 
to up to four degrees of intensity on the MM scale. It is 
therefore important to avoid siting structures on bad ground. 

Bedrock is generally regarded as a sound foundation and 
alluvium as less satisfactory. Alluvium tends to absorb the 
effects of small earthquakes but to amplify those of large 
ones, giving rise to the effect of soil amplification. 

A particular effect of bad ground is soil liquefaction, which 
can result in very severe damage. This is considered below. 

An important class of locations where alluvium is pre¬ 
sent is old river terraces, which are often the site of ports. 

As just stated, structures on the same site may suffer 
quite different degrees of damage due to differences in the 
quality of the ground. In the earthquake in 1957 in Mexico 
MM intensities of VII were determined for the old lake bed 
area of Mexico City, while other parts had intensities of Vor 
less. The earthquake at Varto, Turkey, in 1966 destroyed 
some buildings in a school complex but not others, the large 
difference in damage being attributed to the effect of very 
localized differences in the ground 

Where a structure straddles two types of soil, damage 
tends to be enhanced, and this is to be avoided. 

It is not universally the case that ground motion is worse 
in bad ground than in bedrock. Where the rock is on a ridge 
there can occur a phenomenon variously known as shat¬ 
tered earth, exploded outcrop or churned ground. The 1971 
San Fernando earthquake produced numerous instances. 

The susceptibility of steep slopes to avalanches is 
affected by the nature of the soil. A major slope failure 
occurred in the earthquake at Chimbote in Northern Peru 
in 1970 when an avalanche with an estimated velocity of 
200-400 km/h travelled 18 km, buried whole towns and 
killed some 20,000. However, slope failures can also occur 
on relatively gentle slopes. In the Alaska earthquake in 
1964 slope failures occurred due to liquefaction of lenses of 
sand contained in clay deposits. 

A15.7.2 Soil settlement and liquefaction 

Some of the worst earthquake damage has been due to a 
quick condition failure in which liquefaction of the soil has 
occurred. It is important, therefore, to be able to assess 
susceptibility to soil liquefaction. Damage may also occur 
due to soil compaction and settlement short of liquefaction. 

The behaviour of a soil under earthquake loading is a 
function of the strain magnitude, strain rate and number of 
cycles of loading. Some soils increase in strength under 
rapid cyclic loading, while others, such as saturated sands, 
tend to lose strength. 

Broadly, gravel and clay soils are not susceptible to 
liquefaction and dense sands are less likely to liquefy than 
loose ones. 

Two important characteristics of a soil bearing on lique¬ 
faction are its cohesion and its water content. Saturated 
cohesionless soils are prone to liquefaction. A full discus¬ 
sion of the effect of cohesion and saturation on soil lique¬ 
faction is given by Newmark and Rosenblueth (1971). 

The susceptibility of a cohesionless soil to liquefaction 
depends on its water content. For a dry cohesionless soil 
grain size is another important factor. For a medium grain 
size soil experiencing vibration a critical void ratio exists 
below which it tends to dilate and above which it tends to 
reduce in volume. This effect has been modelled by Barkan 
(1962). Other effects which can occur are breakage in large 
grain soils and air entrapment and soil liquefaction in fine 
grain soils. 
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A saturated cohesionless soil is most prone to liquefac- 
tion.The effect is not well understood, although it is known 
that relative density, confining pressure and drainage con¬ 
ditions are three important variables. Loose sands often 
liquefy after only a few loading cycles, whereas dense ones 
may require several hundred cycles. Conditions which pre¬ 
vent water from escaping promote liquefaction. 

Extensive soil liquefaction occurred in the earthquake at 
Niigata in 1964. There was loose sand and water was not 
able to escape, partly due to the extent of the foundations. 

With a saturated cohesive soil the strength tends to 
increase due to strain rate but to decrease due to cyclic 
loading. The net effect may be to increase or decrease the 
strength, depending on the nature of the soil. In a very 
sensitive soil a decrease in strength may set in after only a 
few cycles, whereas with a relatively insensitive one the 
strength may still be increasing after some 50 cycles. 

A15.7.3 Site investigation 

It is practice to carry out a site investigation to determine 
the characteristics of the ground. An account of the 
laboratory and field tests and of the information which they 
yield is given by Dowrick (1977). Laboratory tests on rela¬ 
tive density and particle size distribution and field tests on 
groundwater conditions and penetration resistance bear on 
the problems of soil liquefaction and settlement, while field 
tests on soil distribution, layer depth and depth to bedrock, 
groundwater conditions and the natural period of the soil 
provide data for response calculations. Other tests may be 
performed to obtain the shear modulus and damping 
characteristics. 

In addition to the use of drill holes to make the field tests 
just described, use may also be made of other techniques 
such as inducing and measuring vibrations. 

A15.7.4 Design basis earthquake 

Where dynamic analysis is to be performed, it may be 
necessary to modify the accelerogram to take account of 
the nature of the ground. The case of bedrock would seem 
at first sight to be the most straightforward, but this is not 
necessarily so, since most accelerograms are for softer 
soils, and there are very few for bedrock. The modification 
of accelerograms to take account of ground conditions is 
a specialist matter. An account is given by Dowrick (1977). 

The ground motion is also affected by any structure 
placed on it. The accelerogram relevant to the site as a whole 
is therefore the free field accelerogram. 

A15.7.5 Soil-structure interaction 

It has been found by experience that there is an appreciable 
interaction between the soil and the structure and that it is 
necessary to take this into account. 

The effects of bad ground have already been described. 
One such effect is soil amplification of the earthquake 
vibrations. 

The effects of soil-structure interaction (SSI) are to 
modify the dynamics of the structure and to dissipate its 
vibrational energy. 

In general, damage is greater if the natural period of 
a structure is similar to that of the soil on which it is built, 
for example a low, short-period building on a short-period 
soil deposit or a tall, long-period building on a long-period 
deposit. In the earthquake in 1957 at Mexico City extensive 
damage was done to long-period structures standing on 
deep (>100 m) alluvium. Another case where the natural 


period of structures suffering damage appeared closely 
correlated with the depth of subsoil was in the earthquake 
at Caracas,Venezuela, in 1967. 

The Uniform Building Code (UBC) in the United States, 
described below, originally contained a soil amplification 
factor that was then removed due to lack of knowledge as to 
what the factor should be. The 1976 version contains a 
site-structure resonance factor S.This factor is a function 
of the ratio T/T s where T and T s are the natural periods of 
the structure and soil, respectively. 

A soil deposit may be characterized by the width and 
depth of soil overlying the bedrock. The natural period 
increases with the depth of the deposit. Relations are 
available for the determination of the natural period of 
horizontal vibration of a soil deposit. Dowrick (1977) gives 
the equation 

T = 4 H/v s [A15.7.1] 

where H is the depth of the soil layer (m), T the natural 
period of the soil layer (s) and v s the velocity of the shear 
wave (m/s). 

In determining soil-structure interaction use is made of 
soil-structure models. In the simpler models the soil layer 
is represented using models of the lumped mass with 
spring and damping forces type not dissimilar to those 
used for the structure itself. 

A full dynamic analysis of soil-structure interaction is 
perhaps the most difficult task in earthquake engineering. 

A15.8 Earthquake-resistant Design 

The design of an earthquake-resistant structure includes 
the following principal steps: 

(1) seismic assessment; 

(2) ground assessment; 

(3) selection of structural form; 

(4) selection of the materials; 

(5) overall design of the structure. 

The first and second of these are considered in Sections 
A15.ll and A15.7, respectively. 

A15.8.1 Structural form 

It has been found by experience that certain structural 
forms resist earthquakes well while others do not. An 
account of the features of structural form that give earth¬ 
quake resistance is given by Dowrick (1977). In broad terms 
the structure should be simple and symmetrical and not 
excessively elongated in plan or elevation. It should have a 
uniform and continuous distribution of strength. It should 
be designed so that horizontal members fail before vertical 
members. 

The desirable degree of stiffness has been a matter of 
debate. The point is discussed by Dowrick, who states that 
either a stiff or a flexible structure can be made to work. 

A15.8.2 Materials 

The properties of materials of construction that confer 
good resistance to earthquakes include homogeneity, duc¬ 
tility and high strength/weight ratio. 

Materials generally quoted as being suitable for earth¬ 
quake-resistant structures include steel, in situ reinforced 
concrete and prestressed concrete. 
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A15.8.3 Static analysis 

The traditional method of earthquake-resistant design is 
static force analysis, also referred to as the static, or 
equivalent static, design method. 

The static method is based on the following relation for the 
effective horizontal force, or base shear, on the structure: 

V=ma [A15.8.1] 

where a is the acceleration (m/s 2 ), m mass (kg) and V hori¬ 
zontal force (N). 

The value of the acceleration a used in static design is 
typically in the range 0.05-0.20 g. 

Methods for the design of structures to withstand a hori¬ 
zontal force in the form of a wind load are well established 
in civil engineering, and the approach required for the 
static method for earthquake resistance is not dissimilar. 

Equation A15.8.1 is the basic relation traditionally used 
in earthquake design codes. These codes are described in 
Section A15.9. 

A15.8.4 Dynamic analysis 

It has long been recognized that the static design method is 
oversimplified, and a variety of dynamic design methods 
have been developed. 

In dynamic analysis an unsteady-state model of the 
structure is produced and the forcing function of the design 
earthquake is defined. The model is then excited using 
this forcing function. Methods of dynamic analysis differ 
in the type of model used, the use of model decomposition 
and the domain (time, frequency) in which the forcing is 
applied. 

The forces estimated using the more rigorous methods of 
dynamic analysis can be an order of magnitude greater 
than those obtained from the static method. 

An account of dynamic analysis is given in Section A15.10. 

A15.8.5 Detailed structural design 

The design methods described give information on the 
forces to be expected at different points in the structure. 
The detailed design of the various elements of the structure 
can then be performed. 

Discussions of the behaviour of structural elements and 
of detailed design using different materials are given by 
Newmark and Rosenblueth (1971) and Dowrick (1977). 

A15.8.6 Detailed non-structural design 

It is also necessary to design the non-structural features 
for seismic resistance. Much of the damage done by earth¬ 
quakes is non-structural. 

These features include in-fill panels and partitions; 
cladding and doors and windows. An account of their 
design is given by Dowrick (1977). 

A15.8.7 Services 

The seismic resistance of services is also relevant. Guid¬ 
ance on this aspect is given by Dowrick (1977). 

For services, the specification of the seismic resistance 
required is of particular importance. There may be some 
key services whose survival in full working order is 
regarded as vital. 

For such essential services Dowrick suggests the use of 
earthquake accelerations higher than those utilized in 
building design; the use of dynamic rather than static 
design methods and of the response spectrum technique 
and the design for elastic rather than plastic deformation. 


He states that a high degree of seismic resistance can 
usually be obtained at relatively little extra cost. 

Some services which he considers are electrical equip¬ 
ment, such as transformers mechanical equipment, such as 
boilers and pipework. 

A15.8.8 Specific structures 

The bulk of guidance on earthquake-resistant design 
relates to buildings and similar structures, but some is 
available for other types of structure. The types of struc¬ 
ture relevant to process plant include columns, storage 
tanks and pipes. 

Newmark and Rosenblueth (1971) discuss the seismic 
design of towers, stacks and stack-like structures; tanks 
and hydraulic structures and pipes. Columns are also con¬ 
sidered by Dowrick (1977). 

Accounts of particular earthquakes frequently give 
information on the extent of survival of, or damage to, 
process plant items. 

A15.9 Earthquake Design Codes 

Guidance on the design of earthquake-resistant structures 
is available in earthquake design codes. These codes have 
been developed particularly in the United States and Japan, 
and many countries have adopted or adapted the US codes. 

Someearthquakedesigncodeswhichhavebeendeveloped 
in the United States include the Uniform Building Code 
(UBC) of the International Conference of Building Officials 
(ICBO); the Basic Building Code of the Building Official 
and Code Administration (BOCA); the Standard Building 
Code (SBC) of the Southern Building Code Congress Inter¬ 
national; the recommendations of the Structural Engineers 
Association of California (SEAOC) and the ANSI code. 

The UBC appears the most widely quoted and influen¬ 
tial. An account of the development of the code is given by 
Berlin (1980). 

The method of design used in the code is the equivalent 
static method, also known as the seismic coefficient 
method. The account given here is based on the 1976 
version of the code. 

In its simplest form the basic equation of the code is 

V = CW [A15.9.1] 

where V is the lateral or shear force (N), W the load (N) and 
C a coefficient. The lateral shear force V is commonly known 
as the base shear coefficient. 

The working equation of the code has passed through 
various versions. That given in the 1976 code is 

V = 7JKCSW [A15.9.2] 

where C is the flexibility factor; I the occupancy impor¬ 
tance factor A" the framing factor; S the site factor and Z the 
seismic risk zone factor. 

The values to be used for the various factors are treated 
in the code. A discussion of these factors is given by Berlin 
(1980). 

The flexibility factor Cis a function of the natural period 
of the structure. There are a number of equations for the 
estimation of C. One principal equation is 

C = 1/15 T 1 / 2 [A15.9.3] 

where T is the fundamental period of vibration of the 
structure in the direction under consideration(s). 
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The occupancy importance factor I is 1.5 for essential 
facilities, 1.25 for a building where the primary occupancy 
is more than 300 people and 1.0 for other buildings. 

The framing factor K allows for the types of structure. 
It has values ranging from 0.67 to 1.33. The lower value 
is for a structure with ductile, moment resisting frame 
and the higher for a structure with a box system, in 
which lateral forces are resisted by shear walls or braced 
frames. A tabulation of values is given for different types 
of structure. 

For the seismic zone risk factor Z the United States is 
divided into five zones, which are defined in the code and 
may be characterized as follows: 

Zone 0 No damage 

Zone 1 Minor damage (MM intensity Vand VI) 

Zone 2 Moderate damage (intensity VII) 

Zone 3 Major damage (intensity VIII) 

Zone 4 Areas within Zone 3 close to certain major fault 
systems. 

The values of Zfor use in these zones are 3/16,3/8,3/4 and 
1 for Zones 1, 2,3 and 4, respectively. 

An account of codes in various countries is given by 
Alderson (1982 SRD R246). 

A15.10 Dynamic Analysis of Structures 

There are a variety of methods of dynamic analysis. 
Features of these methods are the unsteady-state model of 
the structure, the use of decomposition techniques, the 
forcing function and the domain in which the analysis is 
conducted. 

In the following account, dynamic analysis is described 
mainly in terms of a single design earthquake. It is gen¬ 
erally recommended that the analysis be repeated for fur¬ 
ther earthquakes. 

A15.10.1 Unsteady-state models of structures 

Unsteady-state models of the structure are distinguished 
by the number of degrees of freedom (DoF). Both single 
degree-of-freedom (SDF) and multiple degree-of-freedom 
(MDF) models are used. Basic SDF and MDF models are 
described by Dowrick (1977). 

The basic SDF model is the standard second-order sys¬ 
tem. This may be written as 

Fi + F 0 + F s =F(t) [A15.10.1] 

where Fis the applied force, or forcing function (N), F D the 
damping force (N), Fi the inertia force (N) and F s the elastic 
force (N). 

Substituting for the various force terms, Equation 
A15.10.1 may be written as 

mx + cx + kx = F{t) [A15.10.2] 

where c is the damping coefficient (kg/s), k the resistance 
(kg/s 2 ), m the mass of the system (kg), / the time (s) and 
x the displacement (m). In standard form the equation 
becomes 

^x + ^-x + x = ^F{t) [A15.10.3] 


C = ( <?/Amk) y 2 [A15.10.4] 

co n = ( k/m ) 1/2 [A15.10.5] 

where {is the damping factor and <u n the natural frequency 
(s -1 ). The damped frequency is 

to = (on{ 1 - f 2 ) 1/2 [A15.10.6] 

where to is the frequency of damped oscillation (s -1 ). 

The SDF model is a lumped mass model.The distribution 
of mass may be taken into account by the use of an 
MDF model. Thus an n-storey structure might be repre¬ 
sented by an MDF model in which the mass of each storey is 
assumed to be located at the floor of that storey. The model 
obtained then consists of a set of n equations similar to 
Equation A15.10.2. 

In the simpler case, the model is formulated as a linear one. 
For some systems a linear model represents an unacceptable 
oversimplification and a non-linear model is required. 

A15.10.2 Time-domain solution 

The dynamic model is then subjected to the forcing function 
of the design basis earthquake. In time-domain analysis, 
the unsteady-state model is excited by the time forcing 
function, which is the accelerogram. The equations are 
integrated numerically and the time response of the struc¬ 
ture is obtained. These responses include the forces, or 
stresses, on, and displacements of, the structural elements. 

A15.10.3 Normal modal analysis 

In some cases it is permissible to simplify the solution of 
an MDF model by a method known as normal modal, or 
simply modal, analysis. In this technique the vibrations in 
mutually perpendicular directions are treated as uncou¬ 
pled and the responses are obtained for the separate modes 
and are then combined by superposition to give the overall 
responses. The method is applicable only to linear systems. 

A15.10.4 Response spectra 

Another approach is the response spectrum method. As 
described above, a response spectrum represents for a 
series of SDF systems with a given degree of damping 
the peak acceleration, velocity or displacement obtained 
when forced by the acceleration-time profile, or accelero¬ 
gram, of the design earthquake. The family of curves for 
different degrees of damping constitutes the response 
spectra. The response spectra most commonly given are 
those for acceleration. 

The determination of the response spectra from the 
forcing function F(t) of the design earthquake is described 
by Dowrick. The displacement x(t) is given by 

x(tj t " ^^exp[-£(u(f ~ sin K^ _ T )] dl 

[A15.10.7] 

Then, taking a> rs co n , a response function is defined as 
V(t) = co n *(f) [A15.10.8] 

where F(f) is the response function (m/s). 
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It is the maximum values of the responses that are of 
interest. The maximum value of the response function is 
termed the spectral velocity, or strictly the pseudo-spectral 
velocity: 

Sr = F max [A15.10.9] 

where S v is the spectral velocity (m/s) and F max the maxi¬ 
mum value of the response function (m/s). Further 

S d = Sr/a>n [A15.10.10] 

S a = co n S v [A15.10.ll] 

where S a is the spectral acceleration (m/s 2 ) and S d the 
spectral displacement (m). 

The application of the response spectra is as follows. 
The natural frequency and damping of the structure is 
determined. The response spectra are then used to obtain 
the peak acceleration. This peak acceleration is then 
applied to find the forces on, and displacements of, the 
structural elements. 

The basic response spectra technique is described by 
Dowrick as essentially a special case of modal analysis, in 
that the method treats the system as a linear one and uses 
the principle of superposition. He also describes, however, 
adaptations of the method to non-linear analysis. 

A15.10.5 Frequency domain solution 

Alternatively, the analysis may be performed in the fre¬ 
quency domain. The method is described by Dowrick. The 
acceleration-time profile is converted by Fourier trans¬ 
form methods into an acceleration-frequency profile. This 
is then used to excite the model of the system. The response 
in the frequency domain is then converted back using the 
inverse transform to give the response-time profile. 

R. Davies (1982) describes the use of a version of this 
approach. The acceleration-time profile of the design 
earthquake, the accelerogram, is converted by Fourier 
analysis into an acceleration-frequency profile. The ana¬ 
lysis then proceeds in two stages. In the first stage, using a 
series of frequencies from the acceleration-frequency 
profile, the unsteady-state model is excited at each fre¬ 
quency by a sinusoidal force of that frequency and with an 
acceleration amplitude set at an arbitrary value. The out¬ 
puts are the forces on, and displacements of, the structural 
elements as a function of frequency. In the second stage 
these outputs are converted back to time profiles of forces 
and displacements. 

A15.10.6 Selection of method 

The selection of a method of dynamic analysis is discussed 
by Dowrick (1977). The structures to be analysed range 
from small, simple structures to large, complex ones. 
Broadly, more complex structures demand more sophisti¬ 
cated methods. He gives in ascending order of complexity 
the methods of static analysis, response spectra, modal 
analysis and non-linear modelling. 

A15.11 Seismicity Assessment and Earthquake 
Prediction 

The assessment of the seismic hazard to which an instal¬ 
lation may be exposed is normally based on information 
about the seismicity of the area in question. In principle, 


this may be complemented by information from the moni¬ 
toring of ground motions and prediction of any impending 
earthquake. However, such prediction is not sufficiently 
precise to be of much use for this purpose. 

A15.11.1 Seismic data and maps 

There are available a number of compilations of seismic 
maps and other information on seismicity. They include 
Seismicity of the Earth and Associated Phenomena by 
Gutenberg and Richter (1954); for Europe Seismicity of the 
European Area by Karnik (1968, 1971) and for Britain 
A History of British Earthquakes by Davison (1924) and 
Seismicity and Seismic Hazard in Britain by Lilwall (1976). 


A15.11.2 Seismicity assessment 

Seismic design or assessment normally takes as its start¬ 
ing point information on the relationship between the 
magnitude and frequency of earthquakes at the location of 
interest. In default of more specific information, use is 
generally made of the historical record. 

The normal method is to use a relation such as the 
Gutenberg-Richter equation, Equation A15.2.10, from 
which the frequency of earthquakes of various magnitudes 
may be determined. Several return periods and magni¬ 
tudes are selected for study. 

For an earthquake of a particular magnitude and fre¬ 
quency the probability of occurrence may be estimated 
making some assumption about the probability distribu¬ 
tion. A common assumption is that the incidence is random. 

Then, using a relation such as that of Donovan or Esteva, 
Equations A15.6.1 or A15.6.2, respectively, the PGA can be 
obtained. 

The approach taken is therefore statistical rather than 
geological. The potential benefits of a more geological 
approach are discussed by V W. Lee and Trifunac (1987). 
They argue that estimates for the occurrence rates of 
earthquakes are over a time interval of some 10 3_ 10 6 years 
for those based on geological structure, or ‘geological 
seismicity’, while those based on ‘historical seismicity’ are 
for intervals of the order of 10 2 -10 3 years. 

The assessment of seismicity in Britain described below 
serves to illustrate the approach generally taken. 


A15.11.3 Probability distributions 

The frequency of earthquakes of different magnitudes is 
commonly obtained from the Gutenberg-Richter equation, 
as just described. 

Use may also be made of the extreme value distribution 
of Gumbel (1958). 

The occurrence of an earthquake of given size is com¬ 
monly treated as a randomly occurring event for which the 
probability distribution is the Poisson distribution: 

V -1 — exp(—/.) [A15.ll.lj 

where for an earthquake of a specified size, P is the annual 
probability of exceedance and X the expected annual num¬ 
ber of earthquakes. 

The possibility of complementing this by utilizing 
information obtained from monitoring seismological indi¬ 
cators points to the possible use of the Bayesian approach. 

A discussion of appropriate distributions is given by 
Newmark and Rosenblueth (1971). 
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A15.11.4 Seismicity in Britain 

A study of the seismicity of Britain which is frequently 
quoted is that of Lilwall (1976). Figure A15.5 is one of his 
plots showing intensities of earthquakes with a return 
period of 200 years. 

Lilwall divides the country into the following zones: 
Great Glen, Comrie and Memstrie, South Wales and 
Herefordshire and the remainder. The first two are areas of 
a seismicity relatively high for Britain. The third may he 
regarded as typical of a relatively active area of the country. 

For the frequency of earthquakes Lilwall recasts 
Equation A15.2.10 as 

log 10 N = cl - Vm h [A15.ll.2j 

where a! and b' are constants. He obtains the following 
values for a' and b': 


Area a' 

b’ 

Surface area (km 2 ) 

Overall 4.13 

1.09 

2.3 xlO 5 

South Wales and 1.1 

0.55 

15,000 

Herefordshire 

Remainder 4.0 

1.15 

2.3 x Mr 

The return periods for earthquakes of different magni¬ 

tudes are then as follows: 

Magnitude m b 


Return period (year) 

4.0 


1.5 

4.5 


6.0 

5.0 


20.0 

5.5 


70.0 

6.0 


260.0 


The last two values are extrapolations beyond the observed 
range. 

From analysis of the data, Lilwall proposes for Britain an 
upper limit of 5.72 for the body wave magnitude and gives 
the relation 



where P is the annual probability of exceedance. 

For the relation between M s and m b , he uses the equation 
of P.D. Marshall (1970): 

M s = 2.08w b - 5.65 [A15.11.4] 

For the intensity in Britain he derives, following Esteva 
and Rosenblueth (1964), the relation 

I = 6.0 + 1.5714 -1.9 In R [A15.1L5] 

or, using Equation [A15.11.4] 

/ = -2.5 + 3.1m b - 1.9 In R [A15.11.6] 

HeusesfortheestimationofREquation A15.2.2 with# = 20. 



Figure A15.5 Seismicity map of Great Britain showing 
intensities of earthquakes with a return period of200years 
(Lilwall, 1976). Despite of shading give intensities of up to 
5, 5- 6, 6- 7 and over 7 (courtesy of HM Stationery Office) 


A15.11.5 Earthquake prediction 

There are a number of methods for the prediction of earth¬ 
quakes. Such methods are applicable mainly to active 
regions. Accounts are given by Berlin (1980), Eiby (1980) 
and Bolt (1988). 

One important concept is that of the seismic gap. Essen¬ 
tially, a seismic gap is an area that has not had an earth¬ 
quake for some time and in which strain is accumulating. 
The argument is that due to this strain accumulation the 
probability of an earthquake increases with time. 

The seismic gap concept has been applied to large 
earthquakes. Areas at the boundary of tectonic plates that 
have not had an earthquake for a long period are regarded 
as more likely to experience one than those that have had a 
recent event. The seismic gap approach has also been 
applied to lesser earthquakes. 

It has been found that in some cases large, shallow-focus 
earthquakes tend to migrate along a fault zone. 

There are a number of phenomena that are regarded as 
precursors of earthquakes. They range from fore-shocks, 
seismic wave anomalies and fault creep to behaviour of 
animals. 

There are also available several earthquake precursor 
models. Three principal models are (1) the dilatancy model; 
(2) the fault creep model; and (3) the propagating deforma¬ 
tion front model. 
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Attempts to predict earthquakes have met with mixed 
success. There is in China an established earthquake pre¬ 
diction programme. One much quoted case is that of the 
earthquake in Liaoning Province on 4 February 1975, which 
had a magnitude of 7.4. Officials decided that the evidence 
justified the issue of a warning that a strong earthquake 
was probable within 24 h, people left their houses and the 
earthquake in fact struck that evening. On the other hand 
no warning was issued for the earthquake atTangshan in 
1976, which had a magnitude of 8.0. 

In an account of the prediction of earthquakes in 
California, Bolt (1988) stated that there was one definitive 
prediction. This was that a moderate earthquake was likely 
to occur near Parkfield, California, between 1987 and 1993. 
This was based on a simple linear prediction of the trend 
of earthquakes, which have occurred in 1901, 1922, 1934 
and 1966. 


A15.12 Design Basis Earthquake 

In earthquake-resistant design, an installation is designed 
to withstand seismic events so that the frequencies at 
which various degrees of damage are incurred do not 
exceed the specified values. The choice of the design basis 
earthquake is governed by these frequency specifications. 

The characterization of the ground motion of an earth¬ 
quake has been described in Section A15.6. Essentially, 
there are three main approaches. These are characteriza¬ 
tion in terms of peak acceleration; of the response spectra 
or of the acceleration-time profile. These three methods of 
characterization accord with the three main methods of 
analysis described in Section A15.10: static analysis, 
response spectra and dynamic analysis. 

A15.12.1 Seismic hazard curve 

There are available empirical correlations between the fre¬ 
quency of exceedance and the magnitude of earthquakes 
and between their peak acceleration and magnitude, as 
described in Section A15.2. From these it is possible to 
obtain the relationship between the frequency of excee¬ 
dance and peak acceleration. A plot of these two quantities 
is often referred to as a seismic hazard curve. A seismic 
hazard curve may be constructed for a region or for a par¬ 
ticular site. 

Figure A15.6 shows seismic hazard curves for the United 
Kingdom given by Alderson (1982 SRD R246). Curve A is 
based on the Gutenberg-Richter equation, Equation 
A15.2.10, and curve B by a method given by Hsieh, Okrent 
and Apostolakis (1975). 


A15.12.2 Response spectra 

As described in Section A15.6, there are available a number 
of response spectra both for real earthquakes and for 
simulated earthquakes. 

One or more of these response spectra may be selected to 
define the design basis earthquake. With this method also 
the choice is governed by the earthquake severity, and 
hence the return period, for which the installation is to be 
designed. 

Two earthquakes that figure prominently in the litera¬ 
ture are those at El Centre in 1940 and Parkfield in 1966. 
A number of response spectra for the El Centre earth¬ 
quake and a comparison with that at Parkfield are given by 
Dowrick (1977). Further accounts of the Parkfield response 



Peak free field acceleration g (% g) —- 


Figure A15.6 Seismic hazard curves for the United 
Kingdom (Alderson, 1982 SRD R 246): (a) curve based on 
Gutenberg-Richter equation and (b) curve based on 
method of Hsieh, Okrent and Apostolakis (1975) (courtesy 
of the UKAEA Systems Reliability Directorate) 


spectra are given by D.W Phillips (1982) and VW. Lee and 
Trifunac (1987). 

The seismic design response spectra given in Regulatory 
Guide 1.60 of the NRC have already been mentioned and are 
given in Figure A15.4. They are discussed further below. 

Another set of response spectra are those developed in 
New Zealand, as described by Dowrick (1977). 


A15.12.3 Accelerograms 

For accelerograms the approach is broadly similar to that 
for response spectra just described. One or more accelero¬ 
grams may be selected with the choice governed by earth¬ 
quake severity and return period. 

For accelerograms also, the 1940 El Centre and 1966 
Parkfield earthquakes figure prominently in the literature. 

Newmark and Rosenblueth (1971) give a set of accelero¬ 
grams which illustrate the distinctions which they make 
between different types of ground motion. 


A15.13 Nuclear Installations 

The seismic hazard is of particular importance for nuclear 
power plants and a large amount of work has been done 
both on seismic design and on seismic hazard assessment. 
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The NRC has set earthquake-resistant design criteria 
and has undertaken a large amount of work on seismic 
engineering of nuclear plants. 

A15.13.1 NRC seismic design response spectra 

For the purpose of nuclear plant siting, the NRC considers 
a fault to be active if there has been movement at least once 
in 35,000 years. For such a fault, it is to be assumed that 
the largest earthquake supported by the fault system will 
occur within the next 50 years. 

In 1973 the NRC issued Regulatory Guide 1.60 
(RG 1.60) containing its seismic design response spectra, 
which have already been mentioned and are shown in 
Figure A15.4. 

Background to RG 1.60 is given by VW. Lee and Trifunac 
(1987). The RG 1.60 response spectra were developed 
from accelerograms of some 33 earthquakes and model the 
shapes of spectra that can be expected at intermediate 
distances from medium to large earthquakes. They state 
that experience of the RG 1.60 response spectra since that 
date shows that they are useful for straightforward cases, 
but meet with difficulties for responses in the near and 
far fields. 

These authors also describe the scaling of the RG 1.60 
response spectra for other distances, particularly for loca¬ 
tions in the near field. The method generally used is based 
on scaling by the PGA, although this presents some 
difficulties. 

Lee and Trifunac discuss approaches to the improved 
characterization of near-source ground motion. 

A15.13.2 Seismic Safety Margins Research Program 

The NRC has for some years had a major programme of 
work on seismic safety margins. Accounts of this work 
include those of Cummings (1986) and R.P. Kennedy et al. 
(1989). 

In simple terms the seismic safety margin is the earth¬ 
quake level at which with high confidence failure is extre¬ 
mely unlikely. An earthquake of this level is described as 
a seismic margin earthquake (SME). The SME is generally 
characterized by the PGA. 

The main body of work is that done under the Seismic 
Safety Margins Research Program (SSMRP). Among the 
reasons for the programme were uncertainty about the size 
of earthquakes to be expected; a lack of experimental data 
to guide plant design; the potential for common mode fail¬ 
ure due to ground shaking and the possibility that 
‘strengthening’ might increase risk. 

The SSMRP methodology involves a five-step proce¬ 
dure: (1) characterization of the seismic hazard; (2) deter¬ 
mination of the response of the structure and subsystems 
to seismic excitation; (3) determination of the fragility 
functions; (4) identification of accident scenarios; and 
(5) calculation of the frequency of failure and release. 

The seismic hazard is characterized by seismic hazard 
curves, response spectra and acceleration time histories 
based on a combination of real earthquakes, estimates 
from magnitude correlations, expert judgement and other 
methods. The necessary computations are performed 
by the computer code HAZARD. The soil-structure inter¬ 
action and the response of structure and subsystems to 
seismic excitation are treated simultaneously and are 
handled by the SMACS code. Seismic excitation includes 
forcing by an ensemble of acceleration time histories in 


three orthogonal directions. A third code SEISIM is used to 
handle the radioactive release aspects. 

Much of the work in the SSMRP has been concerned with 
the seismic fragility of items of equipment. The fragility is 
a function of the seismic load and is expressed as the 
cumulative probability of failure with load. 


A15.13.3 Seismic margin estimation 

A review of methods for the calculation of the seismic 
margin of items of equipment is given by R .P. Kennedy et al. 
(1989). 

The seismic margin review of a nuclear power plant 
requires the determination for certain components of 
the High Confidence of Low Probability of Failure 
(HCLPF) capacity. The study describes two candidate 
methods for doing this, the Conservative Deterministic 
Failure Margin (CDFM) method and the Fragility Analysis 
(FA) method. 

The CDFM method involves a design calculation which 
is essentially conventional in method but which utilizes 
more conservative assumptions. 

In the FA method, the fragility of the equipment is 
modelled as a double log-normal distribution with three 
parameters: A m the median ground acceleration and /Jr 
and the logarithmic standard deviations representing, 
respectively, the randomness and the uncertainty in the 
median value. The two latter parameters may be subsumed 
in the combined parameter j? c (= (/*t +/*u) 1 ' ,2 )■ The 
report describes the estimates made by four experts of 
the HCLPF by the CDFM and FA methods for a repre¬ 
sentative set of items, including a storage tank, a heat 
exchanger and an air tank. The bulk of the report consists 
of detailed calculations. The results are expressed as values 
of the PGA. 


A15.14 Process Installations 

There is rather less work published on the seismic design 
and seismic assessment of process plants, but there are 
some accounts available. Moreover, the methodologies 
developed in the nuclear industry are in large part applic¬ 
able to the process industries. 

The guide TID-7024 Nuclear Reactors and Earthquakes 
(NTIS, 1963) is quoted in the NPFA codes such as NFPA 
59A: 1985 Production, Storage and Handling of Liquefied 
Natural Gas (LNG) for guidance on seismic loading. 

A review of seismic design and assessment for process 
plants with special reference to major hazards is given in 
Seismic Design Criteria and Their Applicability to Major 
Hazard Plant within the United Kingdom by Alderson (1982 
SRD R 246). Further accounts of seismic assessment of 
process plants include those of Ravindra (1992), and, for 
the United Kingdom, of R. Davies (1982), Alderson (1985) 
and Kunar (1983). 

Methods for seismic design are given by the NRC (1979c). 
There is also a good deal available for particular items. For 
example, for liquid storage tanks accounts have been pub¬ 
lished by Veletsos and co-workers (Veletsos and Yang, 1976; 
Veletsos, 1984; Veletsos and Yu Tang, 1986a,b), Haroun and 
Housner (1981), R.P. Kennedy (1979,1989) and Priestly etal. 
(1986). Guidance on analysis of individual failure modes is 
given in standard texts on structures such as Timoshenko 
(1936),Warburton (1976), Pilkey and Chang (1978) and, for 
windloads, Sachs (1978). 
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A15.14.1 Seismic assessment of generic plants 

R. Davies (1982) has reviewed the seismic hazard for pro¬ 
cess plants in the United Kingdom. He identifies liquefied 
gas storage as a matter of principal concern and describes a 
study to assess the risk from such storage. 

The study was in three parts: the assessment of seismi¬ 
city in the United Kingdom; the selection of representative 
containment and the identification of principal failure 
modes and the modelling of the seismic response of these 
containments. 

Three levels of earthquake were defined, Levels 1-3. 
A Level 1 earthquake was taken as one with a return period 
of 150 years which would have a 0.25 probability of occur¬ 
ring over a plant life of 40 years. The work of Lilwall sug¬ 
gests that this return period corresponds to an earthquake 
of body wave magnitude about 4.5, which would typically 
yield at 15—20 km a site intensity of around VI on the MM 
scale. The Level 2 earthquake was taken as one with a 
return period of 2000 years, magnitude of 5.25 and site 
intensity of VII. For the Level 3 earthquake a frequency of 
10 -4 events/year, or a return period of 10 -4 years, was 
taken, following NFPA guidance in NFPA 59A: 1980 on the 
design earthquake for LNG storage. 

Earthquakes corresponding to each of these three levels 
were identified and the accelerograms of these earthquakes 
were obtained. The records used were those for the earth¬ 
quake at New Madrid, Missouri, on 13 June 1975 (body wave 
magnitude 4.3), those for that at Forgaria-Cornino, Italy, on 
11 May 1976 (magnitude 5.2) and the Temblor records of the 
earthquake at Parkfield on 27 June 1966 (magnitude 5.6). 

The method of dynamic analysis used by Davies was 
described earlier. 

Three generic types of liquefied gas storage were con¬ 
sidered: a double skin cryogenic tank with a suspended 
roof, an inner shell of 9% nickel steel and an outer shell of 
mild steel to hold 20,000 te of LNG; a 1250 te capacity 
spherical pressure storage vessel to hold 1250 te of propane 
and a cylindrical pressure storage vessel, or torpedo, to 
hold 250 te of liquid carbon dioxide. For all three contain¬ 
ments a foundation of hard rock was considered and the low 
temperature tank was also considered with a piled found¬ 
ation on soft soil. 

The failure modes considered were as follows. For the 
storage tank they were (la) rupture of the connection 
between the tank wall and the floor; (lb) ripping of the tie¬ 
down strap; and (lc) excessive displacement of the base of 
the shell and rupture of the connection pipes. For the 
sphere they were (2a) tear at the connection of the shell and 
supporting leg; (2b) buckling of the support columns; and 
(2c) excessive displacement at the connecting pipe takeoff 
and rupture of the pipe. For the torpedo they were (3a) tear 
at the connection of the shell and support; (3b) rupture of 
straps or supports; and (3c) sliding on or rolling off support 
and rupture of the connecting pipes. 

For the Level 1 earthquake the ratio of the seismic 
response stress to the seismic capacity stress was very 
small in each of these failure modes; the highest value of 
the ratio was 0.03 for the cryogenic tank tie-down strap on 
hard rock (mode lb). For the Level 2 earthquake the ratio 
was 1.4 for the cryogenic tank tie-down strap on hard rock 
(lb), 0.48 for the inner shell base of the tank on hard rock (la) 
and 0.21 for the inner shell base on piles (la again). For the 
Level 3 earthquake these three latter values were 1.9, 0.72 
and 0.29, respectively. Data on displacements are also 
given. 


The conclusion of the study is that for liquefied gas 
storages of the type considered an earthquake which 
occurs sufficiently frequently to be likely to be felt during 
the life of the plant poses a negligible risk of loss of con¬ 
tainment, but that one which approaches the maximum 
likely to occur in the United Kingdom could produce 
appreciable horizontal displacements in all types of plant 
and stresses in certain critical parts of some containments 
which exceed the dynamic design stresses allowed in cur¬ 
rent design codes. 

A15.14.2 Seismic assessment of particular plants 

An account of the seismic assessment of an existing pro¬ 
cess plant as part of the controls on acutely hazardous 
material (AHM) under the California Risk Management 
and Prevention Program (RMPP) under has been given by 
Ravindra (1992). The review covered both the site-specific 
geology and the engineering facilities. 

He describes the investigation of the seismic character¬ 
istics of the site, including the impact of active faults; the 
potential for surface faulting and ground breakage, soil 
settlement and liquefaction, and slope instability; and local 
soil amplification. A seismic hazard curve was established. 

The seismic capacity of the facilities was assessed by 
review of the design drawings and design codes used and 
by a walkaround of the plant. 

It was found that some components had been designed 
using the static design method with an acceleration of 0.2 g; 
this acceleration is similar to that in the UBC. Detailed evalu¬ 
ation established that some of these items were vulnerable 
even though they had been designed to a building code. 

The author gives examples of the seismic capacity 
assessed by a deterministic method given in RMPP guide¬ 
lines and by the FA method and quotes values of the med¬ 
ian ground acceleration A m and the logarithmic standard 
deviation of the uncertainty in this acceleration. The failure 
mode determining seismic capacity in most cases is failure 
of the anchor bolts or anchorage. The author comments that 
generally this can be upgraded at minimal cost. 

A15.14.3 Spherical pressure vessel 

An assessment of the seismic capacity of a spherical pres¬ 
sure storage vessel has been described by D.W Phillips 
(1982). 

The vessel considered is a 15 m diameter vessel sup¬ 
ported on 12 columns, or legs. The nominal contents of the 
vessel are 1200 te, the mass of the shell is 166 te and that of 
the legs 15.6 te. The active length of the supporting columns 
is 7.94 m. Each column has a flat steel plate welded to the 
bottom. The plate is attached by four foundation bolts to the 
concrete pedestal. The spacing between the bolts is 0.58 m 
and the inset of the bolts is 0.08 m. The bolts are 0.032 m 
in diameter. The effective dynamic mass of the vessel 
itself, with a contribution from the legs, is taken as 171 te 
(166 + V 3 x 15.6), giving a total effective dynamic mass of 
1371 te for the full vessel. 

From a separate study, it is known that the natural period 
of the vessel for horizontal vibration is as follows: 


State 

Mass of vessel and shell (te) 

Natural period (s) 

Full 

1371 

0.75 

Va full 

711 

0.58 

y 4 full 

471 

0.25 
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The vessel is located on a typical UK site. For such a site the 
seismic characteristics in terms of the free field horizontal 
acceleration are taken as 


Return period (year) 

Horizontal acceleration (g) 

100 

0.05 

1000 

0.12 

10,000 

0.25 


The method of calculation used is essentially a static 
analysis, but first a dynamic analysis is conducted to 
determine a dynamic, or resonance, correction factor. For 
this use is made of the data given above on the natural 
period and the horizontal acceleration together with suit¬ 
able response spectra. Two sets of response spectra are 
used, the NRC RG1.60 spectra and theTemblor-Parkfield 
spectra. A damping of 5% is taken as typical of welded 
steel at high strain and of bolted steel. For each degree of 
fill, the response spectra are used to obtain the acceleration 
from the natural frequency and damping. This value is 
scaled by the ratio of the maximum acceleration of the site 
to the maximum acceleration implied in the response 
spectra. 

The results for the horizontal response with intact bra¬ 
cing are 


The vertical excitation is taken as % of the horizontal. 
The overall structural response is assumed to be given by 

W 0 = Wf 1 [A15.14.2] 


where Wj is the load in the ith direction (N) and Wo the 
overall load (N). 

Then for the 100 year return period with horizontal 
acceleration of 0.05 g and incorporating the two orthogonal 
accelerations and the dynamic correction factor of 2, the 
peak horizontal seismic load of the full tank is 

W s = 2 1/z (1371 x 10 3 ) x 2 x 0.05 x 9.81 
« 1.9 x 10 6 N 

Thus, the seismic load is nearly 20 times the wind load. 

Phillips gives detailed calculations for the various 
modes of failure and for the corresponding seismic capa¬ 
cities. These show that the seismic response for which the 
structure is weakest is the overturning couple on the col¬ 
umn supports. The corresponding failure mode is tensile 
failure of the pedestal bolts. For this failure mode the safety 
factor has the values of 0.5,0.2 and 0.1 for the 100,1000 and 
10,000 year return periods, respectively. 


Return period 
(year) 



Horizontal response (g) 



NRC response spectra 

Temblor- 

-Parkfield reponse spectra 

Sphere full 

l kM 

1 um 

Sphere full 

l kM 

7 \m 

100 

0.07 

0.11 

0.14 

0.11 

0.16 

0.21 

1000 

0.17 

0.25 

0.33 

0.26 

0.37 

0.50 

10,000 

0.36 

0.53 

0.70 

0.54 

0.79 

1.03 


The accelerations are rather greater for the Temblor - 
Parkfleld than for the NRC response spectra. The greatest 
acceleration is experienced by the % full tank, but for this 
case the mass is much less. The dynamic correction factor 
chosen is 2, which corresponds approximately to the ratio 
of the PGAs for the site to those for the case of the full tank 
with the Temblor-Parkfield spectra. 

The sphere did not appear to have been designed for 
earthquake resistance. Probably, the principal horizontal 
force considered was wind loading. The relation for the 
wind load is 

W w = <b/y»X [A15.14.1] 


The calculation of this failure mode may be summarized 
as follows. Figure A15.7 shows the overturning couple for 
which the relation is 

F sb = ~F s ^ [A15.14.31 

n l 2 

where F s is the seismic load (N), F sb the seismic tensile 
force on the bolts (N), h and l 2 are the distances shown in 
Figure A15.7 (m) and n is the number of bolts resisting 
overturning. Taking 4 = 7.94 m and l 2 = 0.66 m and using 
the seismic load for the 100 year return period 


where C D is the drag coefficient, r s the radius of the sphere 
(m), u w the wind speed (m/s), W w the wind load (N) and p a 
the density of the air (kg/m 3 ). At the estimated Reynolds 
number of 10 7 the drag coefficient is 0.5. The wind speed 
with a 50 year return period would be between 18 and 
32 m/s. Taking the higher value for the wind speed and 
7.6 m and p a = 1.25 kg/m 3 


F sb = i(1.9xl0 6 ) 
= 9.5 x 10 5 N 


7.94 

0.66 


Taking a bolt area of 8.0 x 10 4 
tensile stress of 


per bolt gives a bolt 


W w m 1.1 x 10 5 

The seismic loading is assumed to consist of accelerations in 
three orthogonal directions, two horizontal and one vertical. 












EARTHQUAKES AP P E N DIX 1 5/21 



Figure A 15.7 Overturning couple on the support column 
of a pressure storage sphere (Phillips, 1982) (courtesy of 
the ukaea Systems Reliability Directorate) 


where F sh is the seismic tensile stress on each bolt (Pa). For 
the purpose of this assessment, tensile failure is assumed 
to occur at the yield stress, which for high tensile steel is 
some 0.6—0.7 x 10 9 Pa. Taking the lower value of the yield 
stress, gives for the safety factor at the 100 year return 
period a value of 0.5 (= 0.6 x 10 9 /1.2 x 10 9 ). 

For none of the other failure modes considered was the 
safety factor less than unity at the 100 year return period, 
though for two others it fell to unity at the 1000 year return 
period and below it at the 10,000 return period. 

A15.14.4 Storage tank 

An assessment of the seismic capacity of a flat-bottomed 
storage tank has been described by R.P. Kennedy (1989). 
The tank considered is 40 ft in diameter with a shell 37 ft 
high and an overall height to the tank top of 43.4 ft. 

The author describes in detail the use of the CDFM 
method.This consists of two parts, the determination of the 
seismic responses and the determination of the seismic 
capacities. There is not necessarily a one-to-one corre¬ 
spondence between a seismic response and seismic capa¬ 
city. For a given response there may be several features 
resisting failure and all these must be considered. 

The following responses are considered: (1) overturning 
moment in the tank shell immediately above the base plate 
of the tank; (2) overturning moment applied to the tank 
foundation through a combination of the tank shell and 
base plate; (3) base shear beneath the tank base plate; 
(4) combination of the hydrostatic plus hydrodynamic 
pressures on the tank side wall; (5) average hydrostatic 
minus hydrodynamic pressure on the base plate of the 
tank; and (6) fluid slosh height. These responses are all 
expressed as forces except the last; for this what matters is 
whether the sloshing fluid hits the roof. 

The author comments that the first of these responses is 
usually the governing one. The third is seldom governing 


for tanks with a radius greater than 5 m.The second, fourth 
and sixth seldom govern. 

In investigating these responses at least two horizontal 
modes, the impulse and the convective, or sloshing, modes 
and one vertical mode should be considered. 

Kennedy gives detailed calculations for the various 
seismic responses and for the corresponding seismic 
capacities. The governing response is usually the first, the 
overturning moment in the tank shell. 

The seismic responses are determined using a value of 
0.27 g for the peak ground acceleration. The overturning 
moment response is then estimated as 19,600 kip-ft. The 
corresponding capacity is determined by considering 
(1) the compressive buckling capacity of the shell; (2) the 
tensile hold-down capacity of the anchor bolts, including 
their anchorage and attachment to the tank; and (3) the 
hold-down capacity of the fluid pressure acting on the tank 
base plate. The combined resistance of these gives an 
overturning moment capacity of 20,800 kip-ft. The SME for 
this response is then calculated as 0.29 g (0.27 x (20,800/ 
19,600)). 

This response gives the lowest value of the SME and the 
overall SME for the tank is thus determined as 0.29 g. 

Kennedy also describes the determination of the seismic 
capacity in terms of the alternative FA method. Using this 
method the SME is found to be 0.31 g. 

A15.15 Notation 

a peak ground acceleration (fraction of g); (cm/s z ) 
(Sections A15.2 and A15.6 only); (m/s 2 ) (Sections 
A15.8 and A15.10 only) 

a, a' constants in Equations A15.2.10 and A15.11.2, 

respectively 

A maximum amplitude of earthquake (mm) 

A m median ground acceleration (fraction of g) 

A 0 maximum amplitude of standard earthquake (mm) 

b, V constants in Equations A15.2.10 and A15.11.2, 

respectively 

c damping coefficient (kg/s) 

C coefficient (Equation A15.9.1) 

C flexibility factor 

C D drag coefficient 

d peak ground displacement (cm) 

E energy of earthquake (erg) 

F force(N) 

F s seismic force (N) 

F sb seismic tensile force on bolts (N) 

F sb seismic tensile stress on bolts (Pa) 

g acceleration due to gravity (m/s 2 ) 

h focal depth (km) 

H depth of soil layer (m) 

I intensity of earthquake (Equation A15.11.5) 

I occupancy importance factor (Equation A15.9.2) 

I 0 epicentral intensity of earthquake 

k modifying factor for focal distance (km) 

(Equation A15.2.2) 

k resistance (kg/s 2 ) (Equations A15.10.2—5) 

K framing factor 

h active distance of support column (m) 

l 2 spacing + inset of bolts on support column base 
plate (m) 
m mass (kg) 

m b body wave magnitude of earthquake 
M magnitude of earthquake 
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M l local magnitude of earthquake 

M s surface wave magnitude of earthquake 
n number of bolts resisting overturning 

N frequency of earthquake (year -1 ) 

P annual probability of exceedance 

r epicentral distance (km) 

R focal distance (km) 

S site factor 

S a spectral acceleration (m/s 2 ) 

Sa spectral displacement (m) 

Sy spectral velocity (m/s) 

t time (s) 

T natural period (s) 

T natural period of soil layer (s) (Equation A15.7.1) 
u w wind speed (m/s) 

v s velocity of shear wave (m/s) 

V horizontal force, base shear (N) 

V response function (m/s) (Section A15.10 only) 

W load (N) 

Wi load in »th direction (N) 

Wo overall load (N) 


W s seismic load (N) 

W w wind load (N) 

x displacement (m) 

Z seismic risk zone factor 

P composite variability (fraction of g) 

/1 R log-normal standard deviation of randomness of 
median ground acceleration (fraction of g) 

/?u log-normal standard deviation of uncertainty in 
median ground acceleration (fraction of g) 
f damping factor 

X average annual number of events 

p a density of air (kg/m 3 ) 

co damped frequency (s -1 ) 

co n natural frequency (s -1 ) 


Subscripts 
D damping 

I inertia 

max maximum value 
S elastic 
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APPENDIX 16/2 SAN CARLOS DE LA RAPITA 


At about 14.30 in the afternoon of 11 July 1978 fire and 
explosions from a road tanker carrying propylene occurred 
at acamp site at Los Af aques (The Sand Dunes) at San Carlos 
de la Rapita between Barcelona and Valencia in Spain. The 
eventual death toll was 215. 

A Court of Inquiry on the disaster was held at Tarragona 
(Court of Inquiry,Tarragona 1982). A report was submitted 
to the inquiry by Carrasco (1978). Independent investiga¬ 
tions for the HSE were been carried out by Scilly (1978) and 
Hymes (1983 SRD R275), for the Hampshire Fire Brigade by 
Stinton (1978, 1979, 1983) and for the Dutch Directorate 
General of Labour by Ens (1986 LPB 68). Analyses of the 
accident are given by VC. Marshall (1985,1986LPB 72,1987). 

Selected references on San Carlos are given inTable A16.1. 


A16.1 The Camp Site 

The camp site was a triangular shaped piece of land 
between the coast road and the sea some 3 km from the 
nearest township San Carlos de la Rapita to the north. 
It was 200 m in length and 10,000 m 2 in area, tapering from 
about 100 m wide at the north to 30 m at the south end, 
and 60 m wide at the point of the accident. There was a 
brick wall on a concrete foundation between the road and 
the camp. 

On the day of the accident, the camp site was fully 
booked with some 800 people, but not all these were there 
at the time and in the area affected. Estimates of the 
number on site and of the number in the area most affected 
are 500 and 300-400, respectively. 


A16.2 The Road Tanker 

The road tanker was manufactured in 1973. It had no pres¬ 
sure relief valve and no pressure test certificate. It had 
nominal and actual capacities of 45 and 44.4 m 3 . 

It has been alleged that the tanker had been used on 
previous occasions to carry ammonia, which can lead to 
cracking of the tank, but this has been denied. 

At 12.05 the tanker took on a load of propylene at 
the ENPETROL Tarragona refinery. The system was that 
the driver would learn how much he was carrying when the 
vehicle was weighed at the weighbridge. There was no 
metering or other device to prevent overfilling. If he wished 
to reduce the load, he could burn some off using a device 
like a flamethrower. The maximum load for the vehicle was 
19 te, but it was plated as suitable for a maximum load of 
22 te and it was actually weighed out as a 23.5 te load. At 
12.35 the vehicle left the refinery. 

The driver had a recommended route, which was the 
motorway, and was provided with the toll money, but actu¬ 
ally took the N340 coast road, which went past the Los 
Alfaques camp. 


Table A16.1 Selected references on San Carlos 


Carrasco (1978); Stinton (1978,1979a,b, 1983); UKAEA 
(1979); J. Harris (1979); Court of Inquiry,Tarragona (1982); 
Moodie (1982); Scilly (1982); Hymes (1983 SRD R275,1986 
LBP 61); Manas (1984); VC. Marshall (1985,1986 LPB 72, 
1987); Ens (1986 LPB 68,72); Foxcroft (1986 LPB 71); 

Bond (1987 LPB 73) 


A16.3 The Fire and Explosions 1 

The sequence of events at the camp site is not entirely clear, 
but several eyewitness accounts are available.V.C. Marshall 
(1987) quotes the following. A young man serving a cus¬ 
tomer in the camp shop off the main site heard a bang. He 
got into his car to investigate and 2 min after the first 
sound heard a severe explosion. A'fireball’ appeared on the 
site. A tourist in the camp restaurant heard a‘pop’ from a tan¬ 
ker on the main road and saw a milky cloud drifting towards 
him. He ran to move his car and seconds later the cloud ig¬ 
nited. In one newspaper account a motor cyclist following the 
vehicle said that smoke and fire were issuing from the tank. In 
another such account a tourist walking his dog at the camp 
site entrance saw the tanker start to snake and then tip over; 
there followed almost immediately an explosion and fire. 

There were conflicting reports on the last movements of 
the road tanker, summarized by Hymes (1983 SRD R275). 
They include reports to the effect that the driver stopped at 
the camp with the tanker already leaking; that he stopped 
after it sprang a leak with a sharp report at the camp; that 
the vehicle veered across the road and broke through the 
camp site wall, suffering either a small leak or complete 
disintegration; and that the tanker veered across the road 
and struck the wall a glancing blow. 

Hymes gives two photographs, the first captioned as 
showing the unignited gas cloud and the second the cloud 
on fire. The latter photograph is shown in Figure A16.1.The 
photographer stated that the time between taking his first 
picture and going to the camp entrance to take further 
shots was 1-2 min and that the tanker ruptured violently 
after a few minutes. 

It is reported that until the main ‘fireball’ event, people 
stood around watching the pall of smoke from the fire. 
When it did occur large numbers, many scantily clad, were 
burned, some running into the sea to escape or douse the 
flames. 



Figure A16.1 The fire preceding the ‘fireball’ at 
San Carlos (Hymes, 1983 SRD R275) (Courtesy of 
the Safety and Reliability Directorate) 
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The area of damage and injury, including injury outside 
the flame envelope, is quoted by Marshall as covering an 
area equivalent to that of a 125 m radius circle. Over 90% of 
the camp site was gutted by fire. 

The explosion effects were variable. The discotheque 
about 75 m from the tanker was completely demolished, 
probably by an explosion of the gas inside it, killing four 
people, but in the opposite direction at a distance of only 
20 m a motor cycle still stood on its footrest. Many other 
objects in the camp liable to be blown over by blast still 
stood. 

The site after the event is shown in Figure A16.2. 

The vehicle was torn into four main pieces. Some two- 
thirds of the tank, including the rear portion, flew to the 
north-west, landed on the ground some 150 m away and 
then slid and came to rest in the outer wall of a restaurant 
about 300 m from its starting point. The middle section 
travelled about 100 m to the north-east into the camp. The 
cab unit travelled some 60 m along the line of the road to the 
south. The front end cap fetched up about 100 m beyond 
the cab. The location of some of the fragments is shown in 
Figure A16.3. The front end cap is the white hemispherical 
object at the bottom of Figure A16.3. 

A16.4 The Emergency and the Aftermath 

For about half an hour after the fire there were some 
200-300 people milling round the camp, many seriously 
burned and calling for help. Private cars and taxis began to 
ferry the injured to a hospital at Amposta 13 km away. The 
first ambulance came at 14.45 from the Shell oil drilling site 
at San Carlos. The municipal ambulances came at 15.05 and 
the fire brigade about 15.30. 

The road was still blocked by the burning cab so that 
victims had to be rescued from both sides of the camp and 
taken north to Barcelona or south to Valencia as circum¬ 
stances permitted. Those taken north to Barcelona received 
primary medical care at points en route, while those taken 


south to Valencia 165km away did not. In the first week the 
death rate at Valencia was twice that at Barcelona, but over 
2 months the death rates evened up, since most victims 
were too hadly burned to survive. 

Over 100 people died outright. Others died later from 
burns, so that the final figures were 215 dead and 67 injured. 

Most of those treated had very serious burns. Out of 
148 cases 122 had third degree burns to 50% or more of the 
body. Either there were fewer people only slightly burned 
or they received treatment elsewhere. 

A16.5 The Fire and Explosions - 2 

The Court of Inquiry held that there had been a rupture of 
the road tanker due to hydraulic overfill. This was the 
explanation given in a report submitted to it by Carrasco 
(1978). 

Other authors have put forward alternative explana¬ 
tions. There appear to be three principal hypotheses con¬ 
cerning the initial event: (1) hydraulic rupture of the tank, 
(2) a small leak on the tank and (3) a road accident. 

Aversion of the second hypothesis has been described by 
Hymes (1983 SRD R275). This is that a leak occurred on 
the tanker, that a gas cloud formed and found a source of 
ignition and that the flames burned back to the tanker. 
There followed an engulfing fire which caused a BLEVE. 
The vessel was in a weakened condition and the time for the 
BLEVE to occur was shorter than usual. Hymes does not 
state how the tanker came to stop at the camp, but on this 
scenario it could have been to attend to the leak. 

A somewhat similar account is given by Stinton (1983). 

The starting point in the argument in favour of the third 
hypothesis, as developed by Ens (1986 LPB 68), is the need 
to explain how the tanker came to stop and how the tank 
itself failed. Relevant here is the evidence of the one eye¬ 
witness who saw smoke and flames coming from the tanker 
and of the other who saw it snaking. The hypothesis is as 
follows. The tanker was grossly overfilled and under stress 



Figure A16.2 The site after the fire and explosion (Hymes 1983 SfiD R275). The camp site is in the right 
background behind the breached wall (Courtesy of the Safety and Reliability Directorate) 
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1 Apparent point of disintegration 

2 Driver’s cab 

3 Front end of tank 

4 Middle of tank 

5 Rear end of tank 

Figure A16.3 Flight of some missiles generated by 
the explosion (after Stinton, 1983; V.C. Marshall, 1987) 


have occurred at the edges of the cloud and stronger 
explosions in the buildings. 

With regard to the first hypothesis, that the tank suffered 
hydraulic rupture, attention has focused on the overfilling 
of the tanker and on the possible effects of this.The calcula¬ 
tions on this aspect are very dependent on the assumptions 
made about the volume and temperature of the liquid when 
the tanker left the refinery. 

Evidence was presented by Carrasco (1978) that the tank 
contents could have warmed up sufficiently in 2% h for the 
tank to become hydraulically full. He estimates a warm-up 
rate of 5.6°C/h. 

Carrasco’s work has been criticized by Marshall and 
Ens. Marshall draws attention to the work of Moodie (1982) 
showing the need, in considering hydraulic rupture, to 
allow for the expansion of the tank metal, the expansion 
being equivalent to between 3 and 6°C, depending on the 
steel used. Both authors, however, consider that it is pos¬ 
sible that the tank had become hydraulically full. Ens sug¬ 
gests that this becomes credible if allowance is made for a 
difference between nominal and actual tanker capacity, 
weighing errors and warming up of the liquid in the term¬ 
inal pipework. Under such biaxial stress the material would 
no longer be ductile but would become brittle. 

VC. Marshall (1987) gives an extensive discussion of the 
possible warm-up of the tank, the hydraulic overfill and 
physical rupture, the behaviour of the fragments and 
the fire. Despite his critique of Carrrasco, he concludes that 
hydraulic rupture of the tank is the most likely cause of 
the incident. 

He suggests that the initial bang heard was probably the 
tank rupture, that the later explosion was of gas which had 
entered a building and then exploded inside it and that the 
fire was a severe flash fire rather than a vapour cloud 
explosion or a BLEVE.The pattern of injuries, with a large 
proportion of dead to injured, is consistent with a flash fire. 

Hymes, Ens and Marshall all give detailed accounts of 
the site and of the physical evidence such as the fragments, 
the explosion damage and the burned area. 


A16.6 Lessons of San Carlos 

Among the lessons of San Carlos are the importance of 


(1) Equipment, procedures, supervision and training to 
so that it was liable to burst if subjected to impact. It prevent overfilling of vehicles carrying hazardous 
crashed due to a driver failure or tyre defect, causing it to materials. 

break through the boundary wall into the camp site. The (2) Provision of pressure relief on vehicles carrying flam- 

tank ruptured and released its contents. A gas cloud and mable materials. 

liquid pool formed, the gas being at first too rich to burn (3) Routing of vehicles carrying hazardous materials 

rapidly. In due course, however, the heat vaporized the away from populated areas and vulnerable targets, 

liquid pool and there was a fireball. Minor explosions may (4) Prompt treatment of burn victims. 
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A17.1 The Investigation 

The Advisory Committee on Major Hazards in its Third 
Report (Harvey, 1984) recommended that although its terms 
of reference were restricted to fixed installations, the major 
hazard potential from the transport of hazardous materials 
should also receive attention. 

The HSC accordingly asked the relevant permanent 
committee, the Advisory Committee on Dangerous Sub¬ 
stances (ACDS) to examine the matter. Its findings are 
presented in Major Hazard Aspects of the Transport of Dan¬ 
gerous Substances (ACDS, 1991) (the ACDS Transport 
Hazards Report). 

Selected references on the ACDS Transport Hazards 
Report are given in Table A17.1. Its principal contents are 
shown in Table A17.2. 


Table A17.1 Selected references on the ACDS 
Transport Hazards Report 


ACSD (1991); Turner (1992 LPB101); Anon. (1992 LPB 
107, p. 29) 


Table A17.2 Principal contents of the ACDS 
Transport Hazards Report 


1. Introduction 

2. Scope 

3. Method of Study 

4. Quantified Risk Assessment 

5. Risk Criteria 

6. QRA Results for Rail, Road and Ports 

7. The Peterborough Incident 

8. Risk Reduction and Mitigation 

9. Emergency Planning and Response 

10. Comparison of Rail and Road Transport 

11. Overview 

12. Recommendations 

Appendices, including 

Appendix 3 Summary of World-wide Major Hazard 
Transport Accidents 

Appendix 4 Summary of Movements and Regulatory 
Arrangements 

Appendix 5 Modes and Consequences of Failure of Road 
and Rail Tankers Carrying Liquefied Gases and Other 
Hazardous Liquids 

Appendix 6 Criteria for Evaluating Individual and Societal 
Risks in Transport 
Appendix 7 Port Risks 
Appendix 8 Transport by Rail 
Appendix 9 Transport by Road 
Appendix 10 Transport of Explosives by Rail 
and Road 

Appendix 11 Comparison of Risks for Transport by Rail 
and Road 

Appendix 12 Tolerability of Risks of Rail and Road 
Transport and Risk Reduction and Mitigation 
Appendix 13 Emergency Planning 
Appendix 14 Management of Safety in Transport 


Some of these entries are paraphrased. 


A17.2 Substances and Activities 

The study deals with four main transport activities: (1) rail 
transport, (2) road transport, (3) marine transport (ports 
only) and (4) explosives. 

The substances investigated varied as between these 
different modes of transport. For road and rail four sub¬ 
stances were studied: (1) motor spirit, (2) LPG, (3) chlorine 
and (4) ammonia. These substances are referred to in the 
report, and therefore here, as the non-explosive materials. 

For ports the substances considered were (1) flammable 
liquids, (2) flammable liquefied gas, (3) toxic liquefied gas, 
(4) ammonia and (5) ammonium nitrate. 

The transport of explosives by rail and by road was the 
subject of a separate study within the report. 

Excluded from the study were air transport, pipelines 
and radioactive substances. 


A17.3 Event Data 

The report contains a wealth of data on the movement of 
hazardous materials by rail, road and sea, on the nature and 
composition of loads and cargos and on event frequencies 
and probabilities. 

The event frequencies cover not only land transport acci¬ 
dents such as vehicle and wagon impacts and fires and mar¬ 
ine accidents such as collisions, strikings, groundings and 
engine room fires but also data used in the various fault trees. 

The probability data include release size distributions, 
ignition probabilities and so on. 

A17.4 Hazard Models 

The study makes use of hazard models for fire, explosion 
and toxic release. 

The fire models are for (1) a torch fire, (2) a flash fire and 
(3) a pool fire and the explosion models are for (1) a vapour 
cloud explosion (VCE), (2) a BLEVE and (3) a condensed 
phase explosion. The models relevant to toxic release are 
those for gas dispersion. 

The pool fire model is required for motor spirit, the other 
fire models and the VCE and BLEVE models for LPG or LFG. 

The hazard models fall into two sets. The first set com¬ 
prises HSE models, which are used for rail and road trans¬ 
port, the second set models incorporated in the SAFETI 
code, which are used for ports. In the following account the 
HSE models are described first, followed by those used in 
SAFETI, where applicable. 

A17.4.1 Gas dispersion 

The gas dispersion models used are DENZ and CRUNCH for 
instantaneous and continuous releases, respectively. The 
main direct application of these models is to toxic release. 

Use is also made of the parameterizations by Considine 
and Grint (1985) of results for flammable gas clouds 
obtained from DENZ and CRUNCH. 

The gas dispersion model used in SAFETI is the dense 
gas dispersion model of R.A. Cox and Carpenter (1980). 

A17.4.2 Torch fire 

The torch, or jet, fire model used is that of Considine and 
Grint (1985), modified to give length and width and repre¬ 
senting the flame as a cone. 

Atmospheric transmissivity is determined by the meth¬ 
od of Simpson (1984 SRD R304). 
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A17.4.3 Flash fire 

For a flash fire use is made of the model of Considine and 
Grint (1985). The formation of the gas cloud is modelled 
using the gas dispersion models described in Section A17.4.1 
and its combustion by assuming that it burns within the 
contour of the lower flammability limit. 

A17.4.4 Pool fire 

For a pool fire use is made of the SPREAD model, a sister 
model of SPILL (Prince, 1981 SRD R210), which differs 
from the latter in treating simultaneously the spreading 
and burning of the pool. The regression rate used is that of 
Mitzner and Eyre (1982). The other features of the model 
are not described but are evidently conventional. 

A17.4.5 Vapour cloud explosion 

The treatment of a VCE involves the determination of the 
mass of fuel in the cloud and of the overpressure resulting 
from explosion of this fuel. 

For the mass of fuel in the cloud, for an instantaneous 
release the method is to take this mass as twice the flash frac¬ 
tion. It is assumed that no explosion occurs if the mass is less 
than 10 te. For a continuous release the mass of fuel in the cloud 
is determined by the method of Considine and Grint (1985). 

The overpressure from explosion of this mass of fuel is 
determined from the correlation of Kingery and Pannell 
(1964) between mass of explosive and peak overpressure 
for TNT. The implication is that aTNTequivalent model is 
used, but further details are not given. 

The VCE model used in SAFETI is theTNO correlation 
model. 

A17.4.6 BLEVE 

The BLEVE model used is that of A.F. Roberts (1981/82). 

A17.4.7 LPG fire model 

The hazard models described are used in conjunction with 
the release scenarios for rail and road transport to produce 
an overall LPG fire model. 


In this overall model the number of fatalities is obtained 
from the relation 

N = D[aPoi + bP iA P t \ ia + cP id (l - P £ | id ) + d] [A17.4.1] 
where Z> is the population density (persons/m 2 ), Athe number 
of fatalities,P f | id the probability of fatal injury given that the 
person is within thecloud,Pi d theprobabilityofbeingindoors, 
P od the probability of being outdoors and a-dare coefficients. 
The coefficients c and dare associated withVCEs. 

The model is shown in Table A17.3 in the form of the 
coefficients a-d to be used in Equation A17.4.1. 

A17.4.8 LPG fire scenarios 

The LPG fire models just described are applied in the 
report to yield the hazard ranges and areas for the set of 
scenarios relevant to rail and road transport. These are 
summarized in Table A17.4. 

A17.4.9 Condensed phase explosion 

The condensed phase explosion model applicable depends 
on the type of explosive. This aspect is discussed in Section 
A17.10. An HD1.1 explosive constitutes a mass explo¬ 
sion hazard, an HD1.2 explosive a projection, or fragmen¬ 
tation, hazard and an HD1.3 explosive a fire hazard. 

For the estimation of the overpressure from an HD1.1 
explosive use was again made of the correlation of Kingery 
and Pannell (1964). 

For the fragments from an HD1.2 explosive data were 
supplied by the MoD from explosives trials, which allowed 
an estimate to be made of the density of fragments posses¬ 
sing a kinetic energy in excess of 80 J, taken as the lethal 
value. From these data two graphs were constructed, one 
for persons outdoors and one for those indoors. The data 
are classified as confidential but the report states that the 
average probability of fatal injury so obtained for persons 
in the open at 200 m is 0.02, while that for those indoors at 
the same distance is an order of magnitude less. 

The model used for the fire on an HD1.3 explosive is a 
vertical flame. Further details are not given. 


Table A17.3 Coefficients for LPG hazard model fatal injury equation (Advisory Committee on Dangerous 
Substances, 1991) (Courtesy of HM Stationery Office) 


b 


d 


2 kgs 1 torch flame 

332 

3.3 

0 

0 

36 kgs -1 torch flame 

5,353 

53.4 

0 

0 

20 te BLEVE 

47,596 

182 

0 

0 

40 te BLEVE 

87,013 

290 

0 

0 

2 kgs -1 flash fire F/2 weather 

7,800 

78 

0 

0 

36 kgs -1 flash fire D/5 weather 

7,800 

78.8 

0 

0 

36 kgs -1 flash fire F/2 weather 

185,000 

1,850 

0 

0 

Flash fire/torch flame/BLEVE (20 te) D/5 

48,416 

214.8 

0 

0 

Flash fire/torch flame/BLEVE (40 te) D/5 

87,225 

298 

0 

0 

Flash fire/torch flame/BLEVE (20 te) F/2 

213,587 

1,951 

0 

0 

Flash fire/torch flame/BLEVE (20 te) F/2 

238,145 

2,016 

0 

0 

20 te flash fire D/5 

64,808 

211 

0 

0 

20 te flash fire F/2 

57,969 

222 

0 

0 

40 te flash fire D/5 

97,644 

340 

0 

0 

40 te flash fire F/2 

88,180 

346 

0 

0 

36 kgs* 1 VCE 

185,000 

1,850 

925 

0 

20teVCE 

22,167 

222 

111 

25,874 

40teVCE 

34,636 

346 

173 

52,916 
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Table A17.4 Hazard ranges and areas for rail and road transport scenarios obtained from the LPG hazard model 
(after Advisory Committee on Dangerous Substances, 1991) 


A Torch flames 


Release rate Side-on End on 


(Kg/SJ 

Length 

(m) 

Distance to 

50% lethality a 
(m) 

Distance to 

1% lethality 
(m) 

Diameter 

(m) 

Distance to 

50% lethality a 
(m) 

Distance to 
1% lethality 
(m) 

2 

12.9 

8.5 

12.3 

4.3 

6.7 

9.4 

36 

54.6 

33 

48 

18.2 

26.3 

36.5 

B Flash fires: instantaneous releases (rail tank wagons) 

Vessel capacity 


Distance to 


Distance to 

(te) 


50% lethality 


1% lethality 



D5 

F2 


D5 

F2 



(m) 

(m) 


(m) 



20 

40 

70 

80 

50 90 

70 110 

75 

95 

C Flash fires: instantaneous releases (road tankers) 

Vessel capacity 0 


Distance to 50% lethality 

Distance to 1% lethality 

(te) 


(m) 


(m) 

15 


140 


150 

D Flash fires: continuous releases 

Release rate 



Area of fire 


(kg/s) 







D5 


F2 



(m ) 

(m 2 ) 

2 


310 

7,800 

36 


7,800 

185,000 

E BLEVEs (rail tank wagons) 

Vessel capacity 

Fireball radius 

Fireball duration 

Distance to 50% lethality 

Distance to 1% lethality 


(m) 

(s) 

(m) 

(m) 

20 

76 

12 

110 

175 

40 

96 

15 

160 

245 

F BLEVEs (road tankers) 

Vessel capacity 

Fireball radius 

Fireball duration 

Distance to 50% lethality 

Distance to 1% lethality 


(m) 

(s) 

(m) 

(m) 

15 

69 

11 

95 

150 


a This is also the distance to spontaneous ignition. 
b Cloud radius 75 m. 


A17.4.10 Condensed phase explosion: hazard range 

It is convenient to give at this point the estimate quoted 
in the report of the hazard range of a condensed phase 
explosion. 

The ranges for fatal injury by thermal radiation or over¬ 
pressure are in practice about 80-85 m, being limited by 
the maximum permitted loads of explosive of 16 te for a 
lorry and 20 te for a rail wagon. These are the distances at 
which the proportion of fatal injuries would be about 5%. 


A17.4.11 Toxic release 

For toxic release use is made of the appropriate gas dis¬ 
persion model to determine toxic concentration and 
hence, for a particular exposure period, the corresponding 

The conventional infiltration model is used to determine 
the indoor toxic load. 

For the number of persons affected by the release, the 
general approach is that used in the impact model 
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described in the next section. The concentration contours 
are calculated at which the probabilities of fatal injury 
are 1.0, 0.9, 0.5 and 0.1. This gives between these isopleths 
three zones with concentrations denoted Ci, C 2 and C3 
and with average probabilities of fatality taken as 0.95, 
0.3 and 0.1. 


For each zone there is a corresponding probability of 
escape indoors, the values used being 0 for Ci, 0.2 for C 2 and 
0.8 for C 3 . 

An analysis is given of the possible responses of an 
individual affected by a toxic gas cloud. The results are 
shown in Figure A17.1. 



(A) 



Figure A17.1 Possible responses of an individual affected by a toxic gas cloud (Advisory Committee on 
Dangerous Substances, 1991) (Courtesy of HM Stationery Office) 
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A17.5 Injury Relations 

Injury models are used in the study to relate the intensity of 
the physical effects to the probability of injury. These are 
mainly probit equations, but HSE dangerous doses are also 
utilized. Some use is also made of rules-of-thumb. 

The injury relations fall into two sets. The first set com¬ 
prises HSE models, which are used for rail and road trans¬ 
port, the second set relations incorporated in the SAFETI 
code, which are used for ports. In the following account the 
HSE relations are described first, followed by those used in 
SAFETI, where applicable. In some cases no details are 
given for the latter; where this is the case, it should not be 
assumed that they are the same as the HSE relations. 


A17.5.1 Thermal radiation 

For fatal injury from thermal radiation use is made of the 
probit equation of Eisenberg, Lynch and Breeding (1975) 

F e -14.9 + 2.56 ln(/ 4 ' ,3 f) [A17.5.1] 

where I is the thermal radiation (kW/m 2 ), t the time (s) and 
Fthe probit. 

In the SAFETI work on fireballs from hot rupture of 
large cargos in port, a modification of the Eisenberg equa¬ 
tion was used. In the region of thermal radiation above 
500 kj/m 2 , it was assumed that 75% of persons outdoors 
and 25% of those indoors are killed, either by radiation or 
by secondary ignition effects. 


A17.5.2 Fire engulfment 

Injury can also occur due to engulfment in a fire. The 
assumptions made are that a person outdoors is killed, but 
that for a person indoors there is a certain probability of 
survival with the complementary probability Pflid of 
becoming a fatality. 

In the SAFETI work the assumptions made were that for 
a flash fire all persons outside within the LFL contour and 
30% of those indoors within the contour are killed but that 
no fatalities occur beyond this contour. 


A17.5.3 Explosive: explosion overpressure 
An HD1.1 explosive constitutes a blast hazard. For fatal 
injury two equations are given, the first being used in the 
road and rail transport study and the second, and more 
up-to-date, in the port study, reflecting developments as the 
work progressed. 

The relationship given is for fatalities amongst persons 
indoors and is based on data on fatal injuries from V-2 
rockets in the Second World War, with allowance for the 
effect of bomb shelters. In this situation building collapse is 
a more significant cause of injury than overpressure. The 
data are shown in Figure A17.2(a). The relation is applied 
also to persons outdoors in the built-up area and therefore 
near to buildings. 

The first version of the equation is 

Y= 1.47 + 1.37 In/) 0 [A17.5.2] 

where p° is the peak side-on overpressure (psi) and Y the 
probit. The second version is 


A17.5.4 Explosive: explosion fragments 

The hazard from an HD1.2 explosive is fragments. As sta¬ 
ted in the previous section, the lethality of a fragment is 
taken as a function of its kinetic energy, and thus of mass 
and velocity, the lethal value being taken as one in excess 
of 80J. 

A17.5.5 Explosive: thermal radiation 
The hazard from an HD1.3 explosive is thermal radiation. 
Figure A17.2(b) shows the relationship given in the report 
for this. 

A17.5.6 Chlorine toxicity 

For fatal injury from exposure to chlorine use is made of the 
following probit equation: 

Y = -4.4 + 0.52 ln(C 2 75 0 [A17.5.4] 

where C is the concentration of chlorine, t the exposure time 
and Fthe probit. 

A17.5.7 Ammonia toxicity 

For fatal injury from ammonia the probit equation used is 

Y = -12.2 + 0.8 In (C 2 i) [A17.5.5] 

where C is the concentration of ammonia, t the exposure 
time and Fthe probit. 

The SAFETI code uses for fatal injury from ammonia the 
probit equation. 

Y = -9.82 + 0.71 ln(C 2 t ) [A17.5.6] 

where C is the concentration of ammonia (pj)m), t the 
exposure time (s) and Fthe probit. The group (C 2 /) is actu¬ 
ally computed as the time integral of the square of the 
concentration. 

A17.5.8 Hazard impact 

The method principally used in the report to estimate the 
impact of the hazard is as follows. The ranges are deter¬ 
mined at which the physical effect is lethal at the 0.90,0.50 
and 0.10 probability levels. The areas within these contours 
are denoted A go , A 50 and A 10 respectively. The average 
lethality within each area is taken as the average of the 
lethalities at the bounding contours. 

Thus, the lethality with the circle A 90 is 0.95 
(= (1.0—0.90)/2), that within the annulus (A50-A90) is 0.7 
and that within the annulus (A 10 -A 50 ) is 0.3. This yields 
the hazard impact relation 
N = D[0.95A 10 + 0.7(A so - A 90 ) + 0.3(A 10 - A 50 )] 

[A17.5.7] 

where A is an area (m 2 ), D the population density 
(persons/m 2 ) and N the number of fatalities. Use is also 
made of variations on this basic equation. 

A17.6 Population Characteristics 

In transport scenarios the characterization of the popula¬ 
tion exposed tends to be much more complex than for fixed 
installation scenarios. A significant proportion of the 
modelling described in the report is addressed to this 
aspect. 


F = 2.47+1.37 log 10 p° 


[A17.5.3] 
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Figure A17.2 Hazard ranges for explosives (Advisory Committee on Dangerous Substances, 1991): (a) HD1.1 
explosive (mass explosion hazard) and (b) HD1.3 explosive (fire hazard) (Courtesy of HM Stationery Office) 


For the general population the report utilizes four cate¬ 
gories of population density. These are 4210, 1310, 2120 
and 20 persons/km 2 . 

The proportion of the general population outdoors is 
taken for the purposes of the assessment as a function of 


the meteorological conditions, particularly conditions 
D5 and F2. 

This characterization of the general population essen¬ 
tially suffices for the assessment of fixed sites such as 
marshalling yards and ports but needs to be supplemented 
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by additional models for rail and road transport. These 
models, which are described below, are relatively complex 
but this complexity is necessary to obtain a realistic esti¬ 
mate of the risks. 

A17.7 Rail Transport 

The hazard of rail transport of non-explosive materials is 
considered in Appendix 8 of the report. 

An account has been given in Chapter 23 of the rail 
transport environment in the United Kingdom. It includes 
data given in the ACDS report on tank wagon capacities 
and movements and on release frequencies and prob¬ 
abilities. 

A17.7.1 Wagons and movements 

For the four hazardous materials studied, the rail tank 
wagon capacities and movements are given in Table 23.23. 
The wagon capacities are for motor spirit 32 and 75 te, for 
LPG 20 and 40 te, for chlorine 29 te and for ammonia 53 te. 

Rail movements along the major routes in the United 
Kingdom in 1985 are shown in Table A17.5, which also 
gives the population densities. 

A17.7.2 Exposed population 

The population exposed to an en route rail accident con¬ 
sidered in the report are the personnel on the trains 
involved, the passengers in passenger trains (PTh) and the 
general off-track population. 

For the density of the general population along the track 
the basic method used was to use a map to assign each 
square kilometre of the trackside area to one of the four 
population densities described in Section A17.6. 

A check was made on the adequacy of using these 
generalized values by taking one of the rail routes and 


determining the population densities with circles of 300 m 
radius along the track from the 1981 Census enumeration 
districts. The process was repeated with circles of smaller 
and larger diameter. The results showed that in general 
the map and census methods gave similar results, except 
that the map method underestimated the urban population 
in a few places. 

For the exposure of passengers in a PT to hazard from a 
heavy goods trains (HGT) five basic scenarios are con¬ 
sidered. One is the involvement of a PT waiting at a stop 
signal in the hazard zone of a release from an HGT, the 
obedient train case. The other four are (1) collision of the 
PTand HGT, causing a release; (2) collision of a PTand an 
HGT, where a release has already occurred; (3) a PT enter¬ 
ing the hazard zone of a release from an HGT and (4) a PT 
entering the hazard zone of a release from an HGTand col¬ 
liding, causing a further release. Two wind conditions are 
considered: (1) wind along the track and (2) wind perpen¬ 
dicular to the track. 

The proportion of carriages in the PT involved is the 
ratio of the length of the hazard-affected zone to the length 
of the train. 

With regard to air infiltration into a PT, the ventilation 
on most modern trains is controlled from the driver’s cab 
and is set at about 13 air changes/h. The driver experiences 
a ventilation rate about six times this and is thus effectively 
out of doors. 

A17.7.3 Initiating events and event frequencies 

The report considers two main types of initiating event. 

These are puncture of a tank wagon by collision or 
derailment and failure or maloperation of the tank wagon 
equipment. 

The treatment given for the frequency of these events 
for each of the four substances and for the probability of 


Table A17.5 Rail traffic and population densities along some major routes in the United Kingdom in 1985 
(Advisory Committee on Dangerous Substances, 1991) (Courtesy of HM Stationery Office) 



Motor spirit 

LPG 

Ammonia 

Chlorine 

All movements (wagon km/year) 

10,199,095 

1,390,590 

1,348,080 

313,668 

Total wagon journeys/year 

55,814 

4,334 

4,500 

2,342 

Major route 

Merseyside-Leeds- 

Hampshire- 

Teeside— 

Merseyside- 


Humberside 

Midlands 

Scotland 

Anglesey 

Route length (km) 

223 

329 

262 

156 

Number of wagons on route/year 

5300 x 32 te 

1,323 

2,204 

1,216 


3900 x 75 te 




Wagon km/year on route 

2,051,600 

435,267 

530,288 

189,696 

% Traffic in that substance 

20 

31 

39 

60 

Population density (people/km 2 ) 

Aggregate length of route with that population density 

Urban (4210) 

15 

30 

12.5 

0 

Both sides 3 





Suburban (1310) 





Both sides 3 

36.5 

48 

40.5 

19 

One side only 3 

1.5 

20 

12.5 

24 

Built-up rural (210) 





Both sides 3 

17.2 

14 

15 

24 

One side only 3 

0 

0 

0 

1.5 

Rural (20) 





Both sides 3 

143.2 

215 

181.5 

87.5 

One side only 3 

1.5 

22 

12.5 

25.5 

Tunnel 

9.5 





a Indicates whether the population is on both sides of the railway or on one side only, the other side being rural. 
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ignition, immediate or delayed, of flammables is described 
in Chapter 23. 

A17.7.4 Motor spirit events 

For motor spirit, the scenarios considered are instanta¬ 
neous releases of 32 and 75 te and continuous releases of 
25 kg/s (equivalent to a 100 mm hole). 

A release of motor spirit, if ignited, results in a pool 
fire. The pool spread and fire model used is described in 
Section A17.4. 

For a continuous release the times for the 32 te and 75 te 
wagons to empty are approximately 20 and 50 min, 
respectively. The size of pool, and pool fire, formed dep¬ 
ends on whether ignition occurs immediately. If ignition is 
delayed the radius of the pool from a 32 te wagon would be 
some 24 m and that for a 75 te wagon some 37 m. With 
immediate ignition, the pool radius in both cases would be 
12 m. The pool radii for instantaneous releases would be 
similar. 

A17.7.5 LPG events 

For LPG, the scenarios are instantaneous releases of 20 and 
40 te and continuous releases of 2 and 32 kg/s. 

If the release is instantaneous and is ignited immedi¬ 
ately, a fireball occurs. Otherwise, a flammable cloud 
forms. If this cloud is ignited, there is either a flash fire 
oraVCE. 

If the release is continuous and is ignited immediately, a 
torch fire or a BLEVE occurs. Otherwise a flammable cloud 
forms. If this cloud is ignited, there is either a flash fire or a 
VCE. The flash fire may be accompanied by a torch fire or a 
BLEVE. 

The report gives event trees for these scenarios. 


A17.7.6 Chlorine and ammonia events 

For chlorine and ammonia, the scenarios considered are as 
follows: 



Chlorine 

Ammonia 

Two-phase release 
from valve (kg/s) 

1.3 

2.1 

Single phase release 
from puncture (kg/s) 

45.1 

33.5 

Instantaneous release 
from catastrophic failure (te) 

29 

53 


The development of these events is determined using the 
hazard models described. 


A17.7.7 Marshalling yards 

In addition to these en route events, the report also 
addresses releases occurring in marshalling yards. The 
two materials of interest in this regard are LPG and chlor¬ 
ine. The frequency estimates for these events for the two 
materials are given in Chapter 23. 

The release scenarios considered are the same as for the 
en route case. 

A17.8 Road Transport 

The hazard of road transport of non-explosive materials is 
considered in Appendix 9 of the report. 

An account has been given in Chapter 23 of the road 
transport environment in the United Kingdom. It includes 


data given in the ACDS report on tanker capacities and 
movements and on release frequencies and probabilities. 

A17.8.1 Vehicles and movements 

For the four hazardous materials studied, the road tanker 
capacities and movements are given in Table 23.6. The tan¬ 
ker capacities are for motor spirit 20-25 te, for LPG 15 te, 
for chlorine 17 te and for ammonia 15 te. 

A17.8.2 Exposed population 

The population exposed to an en route road accident con¬ 
sidered in the report are the personnel of the vehicles 
involved, the other road users and the general off-road 
population. 

The road transport situation is rather different from that 
of rail. In particular, it is necessary to take into account the 
wide variety of types of road and road usage. 

Another basic difference is that the probability of other 
persons becoming involved in an incident is much higher 
for road than for rail. 

For the density of the general population along the road 
the method is essentially similar to that used for rail 
transport. 

The exposure of other road users to hazard from a road 
tanker is treated in terms of two zones, one for users behind 
the tanker and one for users on the other side of the road. 
For the former it is assumed that traffic backs up behind the 
tanker and that the section of the zone ahead of it is clear. In 
the second zone, on the other carriageway, the population 
density depends on whether the traffic stops or continues 
to move. It is assumed that the density in this zone is half 
that in the first zone. 

The density of the road user population backed up 
behind the tanker is computed as follows. The traffic is 
assumed to consist of 10% heavy goods vehicles (HGVs). 
The length of road occupied by an HGV is taken as 20 m and 
that occupied by other vehicles as 4 m. There are assumed 
to be 1.5 persons/vehicle. This yields for motorways 
and for other roads population densities of 0.056 and 
0.05 persons/m 2 , respectively. 

The full set of eight zones defined in the report comprises 
four on the same side of the road as the tanker and four on 
the other side. Zone a is one of standard population density, 
Zone b one of high density Zone c a clear zone and Zone d 
the zone of road users behind the tanker. Zones h, g, f and e 
are, respectively the corresponding zones on the other 
carriageway. 

With regard to air infiltration into vehicles, work by 
M. Cooke (1988) has shown that for a car travelling at 
40 miles/h the ram effect is sufficient to give one air change 
per minute and air ingress will be even greater if the venti¬ 
lation fan is on. For a stationary car use of the ventilation 
fan will again give about one air change per minute. Even if 
the fan is off, the car is not expected to provide significant 
protection, the volume of the air space being small. 

A17.8.3 Initiating events and event frequencies 

The report considers two main types of initiating event. 
These are puncture of a tanker by collision and failure or 
maloperation of the tanker equipment. 

The treatment given for the frequency of these events for 
each of the four substances and for the probability of igni¬ 
tion, immediate or delayed, of flammables is described in 
Chapter 23. 
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A17.8.4 Motor spirit events 

For motor spirit, the scenarios considered are instanta¬ 
neous releases of 4, 8 and 12 te and a continuous release of 
25 kg/s (equivalent to a 100 mm hole). The tankers contain 
six compartments and the instantaneous releases corre¬ 
spond to spills from one, two or three of these. 

A release of motor spirit, if ignited, results in a pool 
fire. The pool spread and fire model used is described in 
Section A17.4. 

The pool areas obtained are 


spm 


Pool area (m 2 ) 

Immediate ignition 

Delayed ignition 

25 kg/s 

314 


908 

4te 

707 


1018 

8te 

1385 


1964 

12 te 

2124 


3019 


A17.8.5 LPG events 

For LPG, the scenarios are an instantaneous release of 15 te 
and continuous releases of 2 and 32 kg/s. 

If the release is instantaneous and is ignited immedi¬ 
ately, a fireball occurs. Otherwise, a flammable cloud 
forms. If this cloud is ignited, there is either a flash fire 
oraVCE. 

If the release is continuous and is ignited immediately, a 
torch fire or a BLEVE occurs. Otherwise a flammable cloud 
forms. If this cloud is ignited, there is either a flash fire or a 
VCE. The flash fire may be accompanied by a torch fire or a 
BLEVE. The report gives event trees for these scenarios. 


A17.8.6 Chlorine and ammonia events 

For chlorine and ammonia, the scenarios considered are as 
follows: 



Chlorine 

Ammonia 

Two-phase release 
from valve (kg/s) 

1.3 

2.1 

Single phase release 
from puncture (kg/s) 

45.1 

33.5 

Instantaneous release 
from catastrophic failure (te) 

17.5 

15 


The development of these events is determined using the 
hazard models described. 


A17.8.7 Lorry stopover points 

In addition to these en route events, the report also 
addresses releases occurring at lorry stopover points. The 
three materials of interest in this regard are LPG, chlorine 
and ammonia. The frequency estimates for these events for 
the three materials are given in Chapter 23. The release 
scenarios considered are the same as for the en route case. 

A17.9 Marine Transport: Ports 

The treatment of marine transport in appendix 7 of the 
ACDS report is confined to the hazard at ports, which con¬ 
stitute fixed installations. 

The study of ports was performed using the 
SAFETIcode. 


A17.9.1 Ports 

There are in the United Kingdom some 42 ports with 
handling profiles exhibiting wide variety. The approach 
adopted was to study a set of three ports which had a 
representative set of major hazards. These ports were River 
Tees, the largest British chemical port complex; Felixstowe, 
a busy port with moderate hazardous trades; and Shore- 
ham, a small port with petroleum product trades. 

A17.9.2 Materials and movements 

The principal hazardous materials and the movements 
of these materials through British ports are shown in 
Table A17.6. 

A17.9.3 Exposed population and ignition sources 
The model for the exposed population is that incorporated 
in the SAFETI code. The population is characterized in 
terms of the numbers of persons within 100 m grid squares. 
Separate distributions are used for night and day, the night¬ 
time figures being based on census data and the day-time 
ones on adjustments to these data. The density of ignition 
sources is also modelled using the grid square method, 
with values of ignition probability assigned on the basis of 
judgement. 

A17.9.4 Initiating events and event frequencies 

The report first considers the following types of marine 
event: (1) collision, (2) grounding, (3) striking and (4) imp¬ 
act. A collision occurs where two ships run into each other, a 
striking where a moored vessel is struck by a passing ves¬ 
sel and an impact where a vessel runs into a dock wall or 
jetty. 

The starting point for the estimation of the frequency of 
these events at British ports was a study by the National 
Ports Council (1976), which was somewhat old and has 
known defects. The data were therefore re-analysed and 
supplemented by three additional data sets. The results of 
this analysis are given in Table A17.7(A). 

The effects of these events were assessed separately for 
tankers and for gas carriers. For tankers the effects were 
taken to be (1) collision or striking below water, (2) collision 
or striking above water, (3) grounding damage or (4) impact 
damage. For each case a representative hole size was 
assigned. 

For gas carriers all four marine events were assumed 
to have one of two effects: (1) cold leak through a hole or 
(2) cold rupture of the tank contents. For a cold leak the hole 
size was taken as that of the loading pipe connection, loca¬ 
ted at the bottom of a prismatic tank or at the mid-height of 
a spherical or cylindrical tank. For a cold rupture the 
release was taken as instantaneous from a pressurized tank 
or as occurring over 5 min from a refrigerated tank. It was 
assumed that 90% of the releases were leaks and 10% 
ruptures. 

Four other events were also considered: (1) transfer 
spills, (2) tanker explosion, (3) gas carrier fires and 
(4) ammonium nitrate ship explosions. 

The frequency of transfer spills was estimated from 
incidents reported to the HSE under NADOR in a 5.25 year 
period 1981-86. Transfer spills tend to be small and possi¬ 
bly, unreported. There were only eight spills reported, and 
just one for liquefied gas. 

There are significant differences between cargos and 
transfer arrangements which will affect the frequency of 
transfer spills. Differences identified included (1) cargo 
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Table A17.6 Hazardous cargos handled at British ports (after Advisory Committee on Dangerous 
Substances, 1991) 


A Overall 


Material group 

Terminals 

Visits 

Amount per terminal 

Amount per movement 

Total amount 



(ships/year) (te/year) 

(te/ship) 

(te/year) 

Crude oil 

17 

1,957 

9,244,347 

80,291 

157,153,891 

Low flashpoint products 

43 

5,163 

478,261 

3,983 

20,565,228 

High flashpoint products 

41 

3,126 

340,233 

4,463 

13,949,554 

Flammable liquefied gas 

26 

2,388 

374,180 

4,008 

9,674,268 

Toxic liquefied gas 

4 

87 

113,826 

5,233 

455,303 

Low flash chemicals 

21 

1,244 

105,689 

1,771 

2,205,975 

High flash chemicals 

23 

1,399 

119,689 

1,945 

2,739,746 

Explosive chemicals 

19 

258 

14,283 

1,052 

271,377 

Total 


15,662 



207,015,342 

B Liquefied gas 

Liquefied gas 



Visits 


Total amount 




(ships/year) 


(te/year) 

Ammonia 



87 


455,303 

Butadiene 



14 


20,990 

Butane 



548 


2,247,856 

C 4 mix 



227 


236,151 

Ethane 



76 


250,848 

Ethylene 



255 


623,886 

LPG a 



555 


2,339,388 

Propane 



414 


3,470,246 

Propylene 



222 


354,824 

VCM 



78 


130,079 

Total 



2476 


10,129,571 


a LPG comprises propane-butane mixes in varying proportions. 


Table 17.7 Frequency of some marine accidents at British ports (after Advisory Committee on Dangerous 
Substances, 1991) 


A Accidents by port type 


Collisions 


Grounding 

Striking 

Impact 


(per encounter) 

(per km) 

(per passing) 

(per visit) 

Open sea port 

5.0 x 10“ 4 


6.5 x 10“ 5 

4.0 x 10“ 6 

2.2 x 10 3 

Wide estuary 

4.0 x 10“ 5 


8.0 x 10“ 6 

4.0 x 10 -6 

2.2 x 10 3 

Wide river 

1.2 x 10“ 4 


1.6 x 10- 5 

9.0 x 10“ 6 

2.1 x 10 3 

Narrow river 

5.0 x 10“ 4 


6.5 x 10“ 5 

4.2 x 10“ 5 

6.5 x 10 3 

B Accidents by cargo group 



Transfer accident 


Explosion 




(per cargo transferred) 

(per visit) 


Crude oil 


1.9 x 10“ 4 


1.3 x 10“ 5 


Low flash products 


1.8 x 10“ 4 


3.5 x 10“ 6 


High flash products 


1.8 x 10“ 4 


1.5 x 10 -6 


Flammable liquefied gas 


7.6 x 10“ 5 


- 


Toxic liquefied gas 


7.6 x 10“ 5 


0 


Low flash chemicals 


1.5 x 10“ 4 


1.3 x 10 -5 


High flash chemicals 


1.5 x 10“ 4 


0 


Ammonium nitrate 


0 


7.0 x 10“ 6 
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(liquid, pressurized liquefied gas or refrigerated liquefied 
gas), (2) transfer equipment (articulated hard arm or 
flexible hose), (3) proportion of cargos unloaded, (4) use 
of vapour recovery, (5) use of ranging alarms, (6) emer¬ 
gency shut-down system (none, basic or advanced), (7) 
quick release coupling (none, pre-1987 or post-1987) and 
(8) environment (berth tidal or non-tidal, number of pas¬ 
sing vessels). 

The various transfer spills were condensed into 
four: (1) 3 min full bore (LG only), (2) 5 min full bore (liquid 
cargos only), (3) 15 min full bore and (4) 10 min at 10% 
full bore. 

Event trees were constructed to assist in estimating the 
proportion of each of these different outcomes. The bran¬ 
ches in the event trees were determined by the following 
three factors (1) immediate operator reaction (within 1 min), 
(2) operation of BSD within 10 min and (3) effectiveness of 
BSD when operated. 

The results of this work are the transfer spill frequencies 
shown in Table A17.7(B). 

Tanker explosion frequencies were obtained from ana¬ 
lysis of cases world-wide in Lloyds Casualty Returns for 
the period 1977-86. Table A17.7(B) shows the results. 

The frequency of gas carrier fires was obtained from the 
study by Blything and Edmondson (1984 SRD R292). The 
data were processed to give incident rates per visit and per 
kilometre of approach. 

It was estimated that there have been nearly 100 fire inci¬ 
dents but without any release of a cargo. Applying the sta¬ 
tistics for the case of no event over a period of time, the 
estimate obtained for the probability of cargo release 
given a fire was 0.007. It was then assumed that 90 % of such 
cases are hot leaks and 10 % hot ruptures. Only the latter was 
considered further, the former being treated as leaks 
through safety valves which are consumed by the fire on 
the vessel. 

For ammonium nitrate (AN) explosions the use of histor¬ 
ical data was eschewed, since such incidents occurred many 
years ago and involved organic-coated material which is no 
longer used. Instead use was made of faulttrees to predict the 
explosion frequency, the main path being a fire, probably 
from the engine room, entering a hold and melting part of the 
AN. Explosion could then be initiated by confinement, org¬ 
anic contamination or impact shock. The estimated frequ- 
encyofANshipexplosionsoobtainedis6.2 x 10 _8 percargo. 

A17.9.5 Releases of flammable liquefied gas 

Releases of flammable liquefied gas were modelled using 
the emission and dispersion models in SAFETI. The 
detailed treatment of the emission scenarios for cold relea¬ 
ses, namely cold leaks from and cold rupture of pressurized 
and refrigerated tanks, is described in the report. The dis¬ 
persion of the vapour was then obtained using the dense 
gas dispersion model. 

The ignition model in the code is then used to determine 
the proportion of cases in which the cloud is ignited. The 
proportion of ignitions resulting in a VCE is taken as 10%, 
the other 90% as giving a flash fire. 

Hot rupture of a pressurized tank is assumed to give a 
fireball. The size of tank is typically several hundred 
tonnes and the size of the resultant fireball is well outside 
the range for which correlations have been validated. 

Hot rupture of a refrigerated tank was initially also 
assumed to give a fireball, but this outcome is uncertain. A 
pool fire may well be more likely. Modelling of these two 


alternatives for this case indicated that they present com¬ 
parable hazards. 

A17.9.6 Releases of toxic liquefied gas 

Releases of liquefied ammonia were modelled using the 
emission and dispersion models in SAFETI. 

A17.9.7 Explosions of flammable liquid 

For flammable liquid explosions modelling of representa¬ 
tive events in respect of overpressure and fragments 
indicated that they are not in general significant beyond the 
vessel. 

Such explosions do, however, cause casualties amongst 
the crew. From analysis of tanker losses in port in the peri¬ 
od 1977-86 the following estimates were derived: 


Proportion of crew killed 

Probability given 
cargo explosion 

0.15 

0.37 

0.40 

0.11 

0.65 

0.04 

1.0 

0.04 


A17.9.8 Ammonium nitrate explosions 

Ammonium nitrate explosions are modelled using the 
TNT model with an appropriate value for the TNT equi¬ 
valent of AN. For bagged AN this was taken as 13% of the 
shipment mass and for bulk AN as 33%. These values 
include allowance for the TNTequivalent of AN, the prob¬ 
able mass aboard when the explosion occurs and the effi¬ 
ciency of explosion for the different types of storage. 

A17.9.9 Representative ports 

The report gives the results of the detailed studies for the 
three representative ports of River Tees, Felixstowe and 
Shoreham. 

A17.9.10 Extension to all ports 

The risk results obtained for the three representative ports 
were applied using a ‘simplified method’, details of which 
are given in the report, to obtain an estimate of the national 
societal risk. 

A17.10 Transport of Explosives 

The hazard from the transport of explosives by rail and 
road is considered in Appendix 10 of the report. 

A17.10.1 Categorization of explosives 

The hazards presented by explosives include blast, frag¬ 
ments and fireball. The hazard which predominates in a 
particular case depends on the class of explosive. 

The classification generally used in transport is the UN 
scheme, described in Chapter 23. The classes of explosive 
in this scheme which are of prime interest here are 

HD1.1 Mass explosion hazard; 

HD1.2 Projection hazard; 

HD1.3 Fire hazard; 

HD1.4 No significant hazard. 

For the purpose of hazard assessment, the ACDS found it 
necessary to develop a categorization more adapted to this 
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purpose, which reflects particularly the heat sensitivity of 
the substance or articles: 


UN class 

ACDS 

category 



M 

Heat sensitive substances in 
flammable packaging 

HD1.1 

N 

Heat sensitive articles - not readily 
ignitable 


P 

Heat insensitive substances 

HD1.2 

Q 

Heat sensitive articles 

HD1.3 

R 

Heat sensitive substances in 
flammable packaging 


T 

Heat sensitive articles and substances 
in non-flammable packaging 

HD1.4 

W 

Heat sensitive articles which present 
no great hazard 


A17.10.2 Limits on loads 

In the United Kingdom there are limits set to the load of 
explosive which canbe carried. These are 16 te for a lorry and 
20 te for a rail wagon, with a further limit of 40 te for a train. 

A17.10.3 Rail transport of explosives: explosives and 
movements 

The explosives moved in rail transport are predominantly 
(>97%) military explosives. In the year 1988/89 BR data 
showed that there were 8132 movements of wagons con¬ 
taining explosives. The average explosives train journey is 
320 km and the explosives movements are therefore 
2.6 x 10 6 wagon km/year. 

A special investigation was made of the composition of 
this traffic, which was found to be by Hazard Division as 
follows: HD1.121%; HD1.212 %; HD1.310% and HD1.4 44%. 
The explosives traffic was also analysed by the HSE cate¬ 
gorization scheme, which yielded by proportion of wagons 
the following dominant categories: N 10%; P 11%; Q 12%; 
T 10%;W 44%; N/T 3% andQ/W 4%. Some 27% of explo¬ 
sives wagons contained HD1.1 explosives, while 44% con¬ 
tained only HD1.4. 

An analysis was also conducted to obtain the average 
values of the NEQ, effectively TNTequivalent, of the loads. 

A17.10.4 Rail transport of explosives: exposed population 

The population exposed to the rail transport of explosives 
was determined in the study using a method essentially 
similar to that used for the four non-explosive substances. 

In the event, the assessment showed that for rail the risk 
is predominantly to the off-site population. 

A17.10.5 Rail transport of explosives: initiating 
events and event frequencies 

The main mechanisms identified in the report for the 
initiation of explosives are (1) fire, (2) impact and (3) unsafe 
explosives. 

An analysis was made for rail and road transport of data 
from various sources including the minutes of the ESTC of 
the MoD, the annual reports of HM Inspector of Explosives 
and the SRD explosives database EIDAS. There was for the 
United Kingdom over a 40 year period only one accident 
involving fatality, that at Peterborough in 1989 (HSE, 
1990c).However,forbothrailandroadtherewereanumberof 
dangerous occurrences, listed in Annex 2 of Appendix 10. 


The report discusses in detail the methods by which it 
obtains its estimates of the explosive events in both forms 
of transport. 

For rail transport it gives the following frequencies: 


Initiating mechanism 

Frequency 
(events/wagon km) 

Unsafe explosives 

1 x 10 -9 

Fire 

6 x 10“ 10 

Impact 

1 x 10“ 10 


The frequencies of events from unsafe explosives and from 
fire are thus assessed as broadly comparable, that assessed 
for events from impact being much lower. 

A17.10.6 Rail transport of explosives: explosions en route 

The explosion event depends, as stated earlier, on the class 
of explosive carried, being for HD1.1 a mass explosion, for 
HD1.2 fragments and for HD1.3 a fireball. The models 
described in Section A 17.4 were applied using the hazard 
impact method given in that section. 

A17.10.7 Rail transport of explosives: explosions in 
marshalling yards 

The study identified one marshalling yard which handled 
some 50% of explosives traffic and in which explosives 
were present almost continuously. An outline assessment 
was made, although no formal estimates of individual or 
societal risk were produced. 

Application of the hazard model for the different classes 
of explosive showed that none of the events had a range to 
10% lethality of more than 50 m. The population at this 
yard was beyond 110 m. 

Analysis resulted in the following estimates for the fre¬ 
quency of initiation of an explosive load in a marshalling yard 


Initiating mechanism 

Frequency (events/year) 

Unsafe explosives 

1 x 10 -3 

Fire 

2 x 10 -4 

Impact 

2 x 10“ 4 


A17.10.8 Road transport of explosives: explosives and 
movements 

An investigation was made of the composition of the road 
explosive shipments broadly similar to that made for rail. It 
was found to be by Hazard Division as follows: HD1.194%; 
HD1.2 2%; HD1.3 40%. The explosives traffic was also 
analysed using the ACSD categorization scheme, which 
yielded by mileage covered the following categories: 
M 51%; N 23%; P 20%; Q 2%; R 3%;T 1%. 

An analysis was also conducted to obtain the average 
values of the NEQ of the loads. The loads were classified 
into three bands with the load being distributed according 
to the following probabilities 


Band 

Mean NEQ 
(kg) 

Proportion of total mileage 
(%) 

1 

316 

18 

2 

1,778 

68 

3 

14,125 

14 
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A17.10.9 Road transport of explosives: exposed 
population 

The population exposed to the road transport of explosives 
was determined in the study using a method essentially 
similar to that used for the four non-explosive substances. 

In the event, the assessment showed that for road the risk 
is predominantly to the road users. 

A17.10.10 Road transport of explosives: initiating events 
and event frequencies 

The initiating events in road transport are the same as 
those for rail transport. The analysis made to obtain the 
frequency of the road events has been described above. The 
detailed methods are given in the report. 

For road transport it gives the following frequencies: 


Initiating mechanism 

Frequency (events/vehicle km) 

Unsafe explosives 

1 x 10 -9 

Fire 

2 x 10“ 9 

Impact 

2 x 1(T 10 


The figures are somewhat similar to those for rail trans¬ 
port, the frequencies of events from unsafe explosives and 
from fire being assessed as broadly comparable, that 
assessed for events from impact being much lower. 

A17.10.11 Road transport of explosives: explosions 
en route 

The explosion event was modelled in a manner essentially 
similar to that used for rail transport. The models descri¬ 
bed in Section A17.4 appropriate to the class of explosive - 
HD1.1, HD1.2 or HD1.3 - were applied using the hazard 
impact method given in that section. 

A17.10.12 Road transport of explosives: explosions at 
lorry stopover points 

For explosives the situation at lorry stopover points is quite 
different from that at marshalling yards. Such points are 
always on premises licensed for the purpose. Lorries also 
stop briefly en route, but such stops are brief and are 
always attended. This risk was not pursued. 

A17.11 Risk Criteria 

The ACDS report gives in Appendix 6 a review of the 
principles underlying the setting of risk criteria and of the 
application of these to individual and societal risk. 

The basic principle is that the risks should be as low as 
reasonably practicable (ALARP). 

A17.11.1 Individual risk 

With regard to individual risk to members of the public, the 
report refers to proposals made by the HSE. At the Hinkley 
Point Inquiry the HSE proposed that a fatality risk of 
10 3 /year is ‘intolerable’, though subsequent discussion 
suggested a lower level of intolerability. The HSE has also 
proposed a fatality risk of 10 _6 /year as ‘broadly acceptable’. 
The report adopts these criteria. 

A17.11.2 Societal risk 

In respect of societal risk, the ACDS criteria are formulated 
in terms of FN curves. A distinction is made between an FN 
curve for risk at national level and one for risk at local level. 
Both types of risk occur in the study, the en route risks of 


rail, road and explosives transport being treated mainly as 
national and the risks at fixed sites such as ports, mar¬ 
shalling yards, lorry stopover points and unloading points 
as local. 

The basic principle is illustrated in Figure 9.39, which 
shows an FN criterion plot for a local risk. The FN space is 
divided into four parts by three lines. The upper line is the 
tolerability line. Risks above this line are regarded as 
intolerable. The middle line is the scrutiny line. Risks 
between this line and the tolerability line may be unjustifi¬ 
able and require further study. The bottom line is the neg¬ 
ligible risk line. Risks below this line are regarded as 
negligible. Those between the negligible risk line and the 
scrutiny line should be reduced applying the ALARP 
principle. 

For the local risk criterion FN plot the ACDS proceeds as 
follows. The reference point is the risks assessed at Canvey. 
These risks were regarded as on the borderline of toler¬ 
ability. The values used by the ACDS for these risks are one 
third those predicted in the Second Canvey Report (HSE 
1981a). This Canvey FN curve is then used as a guide both to 
the setting of the absolute value of the tolerability line and 
to its slope. This is illustrated in Figure A17.3. 

The negligible risk line for the local FN plot is set three 
decades below the tolerability line. The arguments for this 
are based essentially on examination of the implications of 
setting it either two or four decades below. If the line were 
two decades down, the expectation value would be six 
fatalities per 1000 years. Applying a value of a life of £0.5 
million gives a potential expenditure of £3000 per annum, 
which might justify a QRA done every 10 years. It is argued 
that such a risk could hardly he regarded as negligible. On 
the other hand, if the negligible risk line were to be set four 
decades below the tolerability line, this would justify a 
potential expenditure of £30 per annum or £300 every 
10 years. On the basis of the cost of staff time this would 
barely permit even a cursory discussion, which suggests 
that this setting of the line is well into the negligible 
risk region. The slope of the tolerability line, and of the 
other lines, is —1, again reflecting the assessed risk at 
Canvey. 

The treatment in the report for the national risk criterion 
FN plot is less firm. A tentative scrutiny line is developed 
for ports which is derived not from any argument based on 
direct combination of the number of ports and of the local 
criteria but rather on the implication of transferring trade 
from any port where the risks are already at the tolerability 
limit. This line is entered on the FN plot for national societal 
risk for ports and also on other national societal risk plots 
as shown in the following paragraphs. 

A17.11.3 Value of a life 

As already mentioned, the report refers to the figure of 
£0.5 million for the avoidance of a statistical fatality, or the 
value of a life, used by the Department of Transport. It 
gives in appendix 7 on ports a discussion of cost benefit 
analysis of proposed remedial measures in which a factor of 
4 is applied to this figure, yielding a value of a life of 
£2 million (1991 value) to allow for ‘gross disproportion’ and 
uses this latter in the subsequent analysis. 

A17.12 Assessed Risks 

The assessed risks quoted in the study are now described. 
The report is careful to quote confidence bounds and to 
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Figure A17.3 FN curve risk criterion proposed by the ACDS for an identifiable community, E-n = 10 n (Advisory 
Committee on Dangerous Substances, 1991) (Courtesy of HM Stationery Office). Five concentrations are calculated at 
which the probabilities of fatal injury are close to 1.0 (concentrations C h C2)and0.9, 0.5and0.1 (three concentrations C 3 ). 
For each concentration there is a corresponding probability of escape indoors, the values used being 0 for C r , 0.2 for C 2 
and 0.8 for C 3 







































































































































(a) (b) 

Figure A17.4 FN curves for national societal risks from rail and road transport of four hazardous materials (Advisory Committee on Dangerous Substances, 
1991): (a) rail transport and (b) road transport. E-n= 10~ n (Courtesy of HM Stationery Office) 
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Figure A17.5 Continued 


Number of fatalities 

(a) 
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(b) 

Figure A17.5 FN curves for societal risks at British ports (Advisory Committee on Dangerous Substances, 1991): 
(a) local societal risk at Felixstowe and (b) national societal risk (simplified method). E-n= 1CT n (Courtesy of HM 
Stationery Office) 
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Figure A17.6 Continued 


Number of fatalities 

(a) 
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(b) 

Figure A17.6 FN curves for national societal risks from rail and road transport of explosives (Advisory Committee 
on Dangerous Substances, 1991): (a) rail transport and (b) road transport, E-n= 10~" (Courtesy of HM Stationery 
Office) 
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note uncertainties in, and qualifications to, the figures 
given. The account given here is in outline only. 

A17.12.1 Rail and road transport 

The assessed risks of rail and road transport for the four 
non-explosive materials are presented as individual risks, 
as societal risks in the form of FN curves and as expecta¬ 
tion values. 

The individual risk to the public for rail transport of the 
four materials is assessed as negligible. For example, for a 
person living 50 m from the track the fatality risk from 
chlorine transport is predicted to be 2.4 x 10 _7 /year. For 
road transport, the situation is rather more complex in that 
there may be certain locations such as a sharp corner which 
have a higher than average risk. But in general the risk is 
assessed as negligible and as only a small fraction of the 
overall risk faced by road users. 

The national societal risks assessed for the transport of 
the four materials, and for the combination of these, are 
shown in Figures A17.4(a) and (b) for rail and road, respec¬ 
tively. For rail transport the predominant risks are from 
motor spirit and ammonia, for road transport from motor 
spirit and LPG. For both modes the risk lies between the 
tolerability and negligible risk lines. 

The expectation values of the annual number of fatalities 
for the rail transport of motor spirit and ammonia are 
0.074/year and 0.3/year and those for the road transport of 
motor spirit and LPG are 1.1/year and 0.8/year, respectively. 

The report gives in Appendix 11 a comparison of the 
relative risks from rail and road transport. It makes the point 
that the choice of mode is not unrestricted. For example, 
motor spirit deliveries must at some stage beby road. A com¬ 
parison of the rail and road risks shown in Figures A17.4(a) 
and (b) suggests that the risks of road transport are higher, 
but these graphs are for risks from actual traffic flows. Fair 
comparison needs to be based on a pattern of shipments 
which is the same for both modes.The report gives a detailed 
discussion but the overall conclusion is that the assessment 
made provides little support for a general preference for 
either mode on the grounds of safety. 

A17.12.2 Ports 

As far as regards ports, the study of the three ports found 
that in some limited areas near the ports individual risk 
was such that on the basis of the risk criteria adopted 
advice would be against new housing development. 

The assessed societal risks are shown in Figure A17.5(a) 
and (b). The former shows the local societal risk for one of 
the ports, Felixstowe, obtained from the individual 
assessment for that port, and the latter the national societal 
risk for British ports, obtained from the simplified method 
described above. At none of the three ports was the local 
societal risk within the scrutiny zone. The national societal 
risk is also outside that zone. 

A17.12.3 Transport of explosives 

Turning to the risk from the transport of explosives, indi¬ 
vidual risk from en route transport by rail or road was not 
judged significant, but there was one marshalling yard 
where it might be. 

The national societal risks from rail and road transport 
of explosives are shown in Figures A17.6(a) and (b), 
respectively. The risks from road transport are higher by 
an order of magnitude. This is accounted for only in part by 
the greater volume moved; the proximity of other road 


users is also a factor. As Figure A17.6 shows, for explosives 
the principal contributor to the assessed societal risks in 
rail transport is the off-site population, whereas for road 
transport it is the road user population. For rail the frac¬ 
tion of the total risk contributed by the rail users is negli¬ 
gible, while for road the fraction contributed by the off-site 
population is 2-3%. For both modes the risk lies between 
the tolerability and negligible risk lines. The report indi¬ 
cates that further scrutiny would be appropriate. 


A17.13 Risk Evaluation and Remedial Measures 

The ACDS report gives an assessment of individual and of 
local and national societal risks, identifies certain activ¬ 
ities or situations where the risks may need to be reduced or 
at any rate should be subject to further scrutiny and in 
Appendices 7,10 and 12 makes proposals for a number of 
remedial measures. 

One measure of general applicability is adherence to, and 
enforcement of, good working practice. 

There are also various measures appropriate to the par¬ 
ticular activity. For rail, it is suggested that the design and 
construction of tanker wagons for motor spirit and for 
ammonia, the improvement of communication by provision 
of radio telephones and the training of train drivers should 
receive attention. 

For road, measures suggested relate to the design and 
construction of road tankers, use of designated routes, 
movement by night, provision of improved communication 
and availability of information in a chemical emergency 
and the training of drivers. Tfechnical measures referred to 
for tankers are devices to monitor tyre pressure and so 
reduce the risk of a tyre fire; additives for middle distillates 
to reduce the risks from static electricity during switch 
loading and cut-off devices to prevent engine overrun 
leading to possible ignition of vapour from spills following 
a tanker puncture. There may be scope for reduction of risk 
by the use of designated routes. Communications could be 
improved by provision of radio telephones. Information on 
the characteristics and emergency handling of chemicals 
carried should be available from chemical emergency 
information centres 24 hours a day. 

For ports, the proposals made in the report include mea¬ 
sures related to hard arm loading equipment and ESD sys¬ 
tems, communications within the port, control of pleasure 
vessels and land use planning. 

While many of these proposals might be made without 
benefit of a hazard assessment, the study provides gui¬ 
dance on priority areas. It identifies a number of features as 
meriting further scrutiny. These include the dominant 
contribution of motor spirit and ammonia to the en route 
national societal risks of rail transport and of motor spirit 
and LPG to those of road transport; the existence of indi¬ 
vidual risk with land use planning implications within 
100 m of lorry stopover points and the national societal risk 
for road transport of explosives. 

At least as important as the assessed levels of risk is the 
improved understanding of the hazards involved. An 
example is the relative contributions to the national societal 
risk in the transport of explosives of the off-site and rail or 
road user populations. 

Also of value are the negative results from the study. For 
the four non-explosive materials the report states that the 
risks from marshalling yards are not such as to inhibit 
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further housing development in the zone where houses 
currently exist. 


A17.14 Notation 

a-d constants 

A area (m 2 ) 

C concentration 

D population density (persons/m z ) 

I thermal radiation (kW/m 2 ) 

N number of fatalities 

p° peak side-on overpressure 


Pf\id probability of fatal injury given that a person is 
indoors and within the cloud 
P id probability that a person is indoors 

P od A probability that a person is outdoors 

t exposure time 

Y probit 

Equation A17.5.2 

p° peak side-on overpressure (psi) 

Equation A17.5.6 

C concentration of ammonia (ppm) 

t time (s) 
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APPENDIX 18/2 OFFSHORE PROCESS SAFETY 


Any account of loss prevention needs to include some 
mention of offshore oil and gas activities, even if this is 
necessarily brief. There is a continuous interaction 
between developments onshore and offshore. The treat¬ 
ment given here is confined to an outline of offshore safety 
activities. 

Offshore installations operate in a difficult and often 
hostile environment. The problems, not only of structures 
but also of processing, are challenging. The solution of 
these problems often involves technological innovation. 
The significance of this for safety and loss prevention is 
clear. 

The report into the Piper Alpha disaster (Cullen, 1990), 
known as the Cullen Report, provides a wealth of detail both 
on the design and operation of an actual platform, albeit 
one of the older ones, in the North Sea and on the impact on 
it of a major accident event. 

Accounts of offshore oil and gas are given in Offshore Oil 
Technology by Ranney (1979), Onshore Impacts of Offshore 
Oil by Cairns and Rogers (1981), Introduction to Petroleum 
Developmentby Skinner (1982), Technological Guidelines for 
Offshore Oil and Gas Development by Gilbert (1983), Gas 
Production Operations by Begg (1984), Behaviour of Off¬ 
shore Structures by Battjes (1985) and Safety in the Offshore 
Petroleum Industry by Barrett, Howells and Hindley (1987) 
and by R.J.S. Harris (1978), Holmes and Mead (1978),Timar 
(1978), Shy vers (1981) andWaldie (1986). 

The series of booklets by BP Petroleum Development Ltd 
(1990a—g) constitutes a useful starting point. 

Much useful information is also given in Offshore 
Installations'. Guidance on Design, Construction and Certi¬ 
fication by the HSE (1990b), also called the HSE Onshore 
Design Guide. 

Selected references on offshore safety are given in 
Table A18.1. 


A18.1 North Sea Offshore Regulatory Administration 

An outline of the legislation governing oil and gas activ¬ 
ities in the UK sector of the North Sea has been given in 
Lees Edition 3, Chapter 3, with a summary of the principal 
legislation given in Table A18.2. 

Two principal elements of the administration are the 
systems of internal control and of risk assessment. The 
Guidelines for the Licencee’s Internal Control 1979 describe 
in effect an SMS. The Regulations Related to the Licencee’s 
Internal Control1985 make this a regulatory requirement. 

Withregard to reassessment, thei?egM/«fe'o»sCo«:emOTg 
Safety Related to Production and Installation 1976 contained a 
requirement that if the living quarters were to be located on a 
platform where drilling, production or processing of petro¬ 
leum wastakingplace,arisk evaluation shouldbecarried out. 
At this date the evaluation was largely qualitative.The move to 
a more quantitative approach came with the Guidelines for 
Safety Evaluation of Platform Conceptual Design 1981. These 
had as a central feature, the provision of a sheltered area, 
requiredthe conduct of aconcept safety evaluation (CSE)and 
specified numerical acceptance criteria. 

The Guidelines defined a design accidental event as one 
that does not violate any of the following three criteria: 


at least one escape way from central positions which 
may be subjected to an accident, shall normally be intact 
for at least an hour during a design accidental event; 


Table A18.1 Selected references on offshore 
safety issues 


Offshore regulatory administration 

Burgoyne (1980); Barrett, Howells and Hindley (1987); 
Lyons (1989); Cullen (1990); Higgs (1990); IP (1990 PUB 51, 
1992 PUB 64); Petrie (1990); Priddle (1990); Barrell (1992); 
J.W. Griffiths (1992); HSE (1992 OTI588); H. Hughes 
(1992); Lees (1992); Leiser (1992); Bibbings (1992); 
Heiberg-Andersen (1990); Ognedal (1990,1994); 

Tveit (1990) 

Offshore hazards 

Leblanc (1981); Anon. (1983p); CuUen (1990); Ognedal 
(1990). Wind and waves: DoEn (1977a, 1984); HSE (1990b) 
Earthquakes: Cornell and Vanmarcke (1975); Wiggins, 
Hasselman and Chrostowski (1976); M.W. Mitchell (1983) 
Vessel-platform collisions: Hathway and Rowe (1981); 

DoEn (1984);Technica Ltd (1985); HSE (1990b); Blowouts: 
Fischer (1982); Anon. (1983b); Dahl etal. (1983); Goins 
and Sheffield (1983); Podio, Fosdick and Mills (1983); 
Milgram and Erb (1984); P.G. Mills (1984); Holand and 
Rausand (1987); Ostebo etal. (1989) 

Flammable gas clouds: HSE (1992 OTI 591); Cleaver, 
Humphreys and Robinson (1994) 

Ignition sources (see also Table 16.23): Forsth (1981a,b, 
1983); Dahl etal. (1983); Sokolov (1989); J.G. Marshall 
(1989); Cullen (1990); Eckhoff andThomassen (1994) 

Fires and explosions: Forsth (1981a,b, 1983); Solberg 
(1982a); Anon. (1983h,j,t); Dahl etal. (1983);Tompkins and 
Riffle (1983); Anon. (1985s,u); Brandie (1989b); 

Cullen (1990); Hjertager (1991a,b); HSE (1992 OTI 585,586, 
592,593, 595-599); Samuels (1992); Gardner et al. (1994); 
Wighus (1994); K. vanWingerden (1994) 

Missiles: R.A. Cox (1989); A.C. Palmer (1989); Cullen 
(1990); HSE (1992 OTI 603) 

Structural loading, response: DoEn (1984); HSE (1990b, 
1992 OTI 594,601,602,608,610); Haaverstad (1994) 
Escalation: D. Drysdale (1989); Cullen (1990); Four 
Elements Ltd (1991); M. Morris, Miles and Cooper (1994) 
Offshore safety management 
Brading (1989); Denton (1989,1991); Ellice (1989); Fotland 
and Funnemark (1989); Grogan (1989); Littlejohn (1989); 
Macallan (1989); McKee (1989); McReynolds (1989); 

G. Richards (1989); R.A. Sheppard (1989); API (1990 RP 
750); Cullen (1990); J. King (1992); McKeever and 
Lawrenson (1992); S. Lewis and Donegani (1993); Jacobson 
(1994). Command and control: Baxendine (1989); 

Cullen (1990); Larken (1992) 

Offshore emergency response, planning 

Fischer (1982); Tompkins (1984); Baxendine (1989); 
Matheson (1989); Cullen (1990); Fitzgerald et al. (1990); 

R. Wilson (1992) 

Offshore evacuation, escape and rescue 

Booth (1989); Clayson (1989); J.D. Evans (1989); Heiberg- 
Andersen (1989); Jefferey (1989); Keueher (1989); 

Lien (1989); McNeill (1989); de la Pena (1989); Perrott 
(1989); Petrie (1989); Rudd (1989); Side (1989); I.G. Wallace 
(1989,1992); Cullen (1990); Owen and Spouge (1991); 
Forland (1992); Forster and Wong (1992) 

Offshore safety 

DoEn (1977,1984); Burgoyne (1980); HSE (1980 HS(G) 12); 
Nat. Res. Coun., Cttee on Assessment of Safety of Outer 
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Continental Shelf Activities (1981); Dick (1982); 

Petrie (1983); Kaarstad and Wulff (1984); Barrett, Howells 
and Hindley (1987); Cullen (1990); Knott (1990); Antomakis 
and Barnes (1991); W.S. Atkins (1991); Bill (1991); IMechE 
(1991/134,1993/157); Venn (1991); Lees (1992); J. Morgan 
(1992); Renwick and Tolloczko (1992); Ronold (1992); 

Salter (1992); Eckhoff (1994); Lode (1994); Pappas (1994); 
Rushton etal. (1994). 

Safety system: Bodie (1989); Gordon (1989); 

McGeough (1989); Cullen (1990) 

Costs of safety: HSC (1992); Potter (1994) 

Injuries offshore: Wright (1986); Cullen (1990); 

H. Hughes (1992) 

Formal safety assessment 

Fjeld, Andersen and Myklatun (1978); Borse (1979); Slater, 
Ramsay and Cox (1981); Pyman and Gjerstad (1983); 
Vinnem (1983); Deaves (1986); Schrader and Mowinckel 
(1986); Haugen and Vinnem (1987); R.A. Cox (1989d, 

1990,1993); Ellis (1989); Ferrow (1989); Fleishman (1989); 
Gorse (1989); van der Graaf and Visser (1989); Hogh (1989); 
Pape (1989); Cullen (1990);Tveit (1990); Burns, Grant and 
Fitzgerald (1991); Rock and Butcher (1991); Diaz Correa 
(1992); Pape (1992); S.J. Shaw (1992); Sherrard (1992); 

Potts (1993); S.J. Shaw and Kristofferson (1993); Gardner 
et al. (1994); K Miller (1994); Pitblado (1994); Ramsay et al. 
(1994);Trbojevic etal. (1994) 

Offshore safety cases 

VC. Marshall (1989); Sefton (1989); Cullen (1990); 
Mansfield (1992); Pape (1992); Wendes (1992); Barrell 
(1994); Bellamy (1994); Clegg (1994); Durnin (1994); 

H. Hughes (1994); Jacobson (1994); Salter (1994); 

Spence (1994); Spiller (1994); Hawker (1995); D. Scott 
(1995); D.J. Wilson (1995) 

Offshore incidents 

Le Blanc (1981); WOAD (1988); Due, McFarlane and 
Crowther (1994); H. Hughes (1994) 

Sea Gem: R.J. Adams (1967) 

Ekofisk Bravo: Gjerde (1977-78); Ognedal (1990) 
Alexander Kielland: Naesheim (1981); Ognedal (1990) 
Ocean Ranger: NTSB (1983 MAR-83-02); Hickman (1984) 


• the shelter area shall be intact during a calculated acci¬ 
dental event until safe evacuation is possible; 

• depending on the platform type, function and location, 
when exposed to the design accidental event, the main 
support structure must maintain its load carrying 
capacity for a specified time. 

The categories of potential accident event to be evaluated 

were specified as 

(1) blowouts, 

(2) fire, 

(3) explosion and similar incidents, 

(4) falling objects, 

(5) ship and helicopter collisions, 

(6) earthquakes, 

(7) other possible relevant types of accident, 

(8) extreme weather conditions and 

(9) relevant combinations of these accidents. 


Table A18.2 Selected legislation of offshore 


A Acts 


1934 


Petroleum (Production) Act 

1962 


Pipelines Act 

1964 


Continental Shelf Act 

1971 


Mineral Workings (Offshore 

Installations) Act 

1971 


Prevention of Oil Pollution Act 

1975 


Petroleum and Submarine Pipe-lines Act 

1992 


Offshore Safety Act 

Offshore Safety (Protection against 
Victimization) Act 

B Statutory Instruments 

1972 

SI 703 

Offshore Installations (Managers) 
Regulations 

1973 

SI 1842 

Offshore Installations (Inspectors and 
Casualties) Regulations 

1974 

SI 289 

Offshore Installations (Construction and 
Survey) Regulations 

1976 

SI 1019 

Offshore Installations (Operational 

Safety, Health and Welfare) 

Regulations 


SI 1542 

Offshore Installations (Emergency 
Procedures) Regulations 


SI 923 

Submarine Pipe-lines (Diving 

Operations) Regulations 

1977 

SI 486 

Offshore Installations (Life-saving 
Appliances) Regulations 

1978 

SI 611 

Offshore Installations (Fire Fighting 
Equipment) Regulations 


SI 1759 

Offshore Installations (Well Control) 
Regulations 

1981 

SI 399 

Diving Operations at Work Regulations 

1989 

SI1029 

Offshore Installations (Emergency Pipe¬ 
line Valve) Regulations 


SI 971 

Offshore Installations (Safety 
Representative and Safety 

Committees) Regulations 

1992 

SI 2885 

Offshore Installations (Safety Case) 
Regulations 


The Guidelines gave explicit numerical acceptability cri¬ 
teria. In practical terms, it may be considered necessary to 
exclude the most improbable accidental events from the 
analysis. However, the total probability of occurrence of 
each type of excluded situation should not by best available 
estimate exceed 1 CT 1 2 3 4 5 6 7 8 9 per year for any of the main func¬ 
tions specified. This estimate is meant to indicate the order 
of magnitude to aim for, as detailed calculations of prob¬ 
abilities in many cases will be impossible due to lack of 
relevant data. 

Risk assessment is now the subject of the Regulations 
Relating to the Implementation and Use of Risk Assessment in 
the Petroleum Activities 1990. Ognedal emphasized that the 
Norwegian attitude is flexible in its approach to risk 
assessment and tries to avoid its degenerating into a ‘num¬ 
bers game’. 

The Cullen Report recommended far-reaching changes in 
the regulatory administration in the British sector of the 
North Sea. The recommendations flow from the evidence 
given on the Piper Alpha disaster and on the regulatory 
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administration up to that date. The administration 
envisaged is one of goal-setting rather than prescriptive 
regulations and of the use of QRA to demonstrate com¬ 
pliance. The report also recommended that an operator 
should submit a safety case and that this should be given 
structure by a requirement to demonstrate by QRA the 
integrity of a temporary safe refuge (TSR). Another major 
recommendation is that the operator demonstrate, as part 
of the safety case, an appropriate Safety management 
system (SMS). A further account of the report’s recom¬ 
mendations in relation to the evidence on the Piper Alpha 
disaster is given in Appendix 19. 

The recommendations of the CuUen Report were accepted 
in toto by the government and the new administration with 
the HSE as the regulatory body was put in place in 1991. 
Initial legislation under this administration includes the 
Offshore Safety Act 1992 and the Offshore Installations 
(Safety Case) Regulations 1992. Development of the new 
administration has been described by Barrell (1992a,b). 

A18.2 Gulf of Mexico Offshore Regulatory 
Administration 

The offshore petroleum industry began in the US Gulf of 
Mexico in the 1950s. The Coast Guard was the original 
regulatory agency, but the responsibility for offshore 
safety was eventually transferred to the Minerals Man¬ 
agement Service (MMS). The safety regulations are found 
in the UIS Code of Federal Regulations, Title 250. 

MMS directly references many of the American Petro¬ 
leum standards and recommended practice documents. 
The API 14 series, contain standards for subsurface safety 
valves, platform safety systems, piping systems, electrical 
systems, and fire safety systems. The API t series recom¬ 
mended practices for offshore staff training is also codified 
by the MMS. 

API 14C, the recommended Practice for analysis, 
design and installation of basic surface safety systems on 
offshore production platforms was originally promulgated 
in 1972. API 14C embodies two very important process 
safety concepts; 

• Every identifiable failure mode shall require two func¬ 
tionally independent safeguards. 

• Recommended safeguards for each type of offshore pro¬ 
cess unit (pressure vessel, pump, heater, etc) were devel¬ 
oped using a generic failure mode and effects analysis. 

The documentation showing the results of a 14C 
approach are presented in a Safety Analysis and Functional 
Evaluation diagram, known as a SAFE chart. The SAFE 
chart is a special type of cause and effect diagram. 

A18.3 Offshore Process Safety Management 

In the 1990s, MMS requested voluntary adherence to the 
API 75 and API 14G recommended practice documents, 
which present process safety concepts to the offshore 
environment. These standards are very similar to the 
OSHA process safety management regulation, containing 
virtually identical wording in many sections. 

A18.4 Offshore Safety Management 

An offshore platform has both marine and process char¬ 
acteristics. It shares with marine vessels the hazards of 


severe weather and of collision and in extremis those of 
escape to the sea. At the same time it contains high pressure 
plant processing oil and gas. The platform is also a self- 
contained community with its own power plant, accom¬ 
modation and other facilities. The senior manager on the 
platform is required in large part to combine the skills of a 
ship’s captain with those of a refinery manager and to 
exercise command and control in an emergency. 


A18.5 Inherently Safer Offshore Design 

The processing of hydrocarbons is the raison d’etre of an 
offshore platform. This clearly sets certain limitations on 
the practice of inherently safer design. Nevertheless, this 
design principle is just as applicable offshore. 

Three examples will suffice. One is reduction in the oil 
inventory in the production separators. The separators 
constitute a major oil inventory on the platform and it was 
the separators that fed the oil pool fire on Piper Alpha. 
Separators are now in use which have much reduced 
inventories. It may be noted in passing that evidence on the 
hydrocarbon inventory on Piper Alpha was given to the 
Inquiry by Clark (1989). 

A second example is adoption of a layout that minimizes 
the possibility of an oil pool forming near a gas riser. 

A third example concerns the potential for a jet flame 
from a gas riser to impinge on the accommodation. Follow¬ 
ing Piper Alpha, Shell reviewed their platforms to establish 
whether in each case this was a possibility (Chamberlain, 
1989). In those cases where it was, action was taken. 

A18.5.1 Friendly plant 

Closely related is the design of plant that is friendly to the 
process operator. In oil and gas extraction there are strong 
pressures to maintain production. In these circumstances, 
it is highly desirable that there be fallback states of plant 
operation to which the operator can resort, without facing 
the all-or-nothing choice of continuing normal production 
or effecting total shut-down. 

A case in point is the confidence that the operator has 
that shutting down the gas plant will not lead to loss of 
power on the main generators. Evidence at the Piper Alpha 
Inquiry appeared to indicate that in some systems fuel 
changeover on the generators, from gas to diesel, could not 
be fully relied on. If this situation exists, it puts a greater 
pressure on the operator to keep going. 

A18.5.2 Plant layout 

Offshore production platforms carry large amounts of 
equipment held in a small space. Space and weight are both 
at a premium, since they are difficult and expensive to 
provide. Spacing between equipment in a module has to be 
less generous than in onshore plants.Where a 15 m distance 
is widely used in the latter, the distance offshore is often 
half that. It is also necessary to ensure that the layout is 
such that the centre of gravity of the total mass of equip¬ 
ment is at the centre of the supporting structure. CAD 
packages for plant layout provide a powerful tool for 
achieving a layout that meets this requirement. 

The decks of the platform are divided into modules. The 
modules are separated by fire walls which inevitably 
reduce the ventilation. 

Layout design seeks to separate sources of hazard from 
vulnerable targets. The application of this principle is seen 
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on many platforms by the separation of the accommodation 
from the wellhead. 

A18.5.3 Platform systems 

There are a number of basic systems that are critical for 
safe operation of the platform. The account given here of 
these systems is limited to a brief overview. It is convenient 
to cast it as a description of the systems on Piper Alpha. 
The Cullen Report gives a detailed description of these 
systems and of their behaviour on the night of the disaster. 

Electrical power systems 

The first of the systems is the electrical power supply sys¬ 
tem. Basic power is supplied by a pair of main turbine- 
driven generators with dual fuel firing, gas being the normal 
fuel with diesel fuel as standby. As backup, there is an 
emergency generator, turbine-driven and diesel fuelled. 
Changeover of fuel on the main generator and start up of 
the emergency generator are automatic. Drilling is served 
by a separate power supply from a diesel-driven generator 
with its own emergency generators. 

The emergency generator for the main supply is 
designed to provide supply to critical services, which 
include HVAC, instrumentation and valves, and emergency 
lighting. Further backup is provided by an uninterruptible 
power supply (UPS) drawn from batteries designed to pro¬ 
vide power during the momentary interruption while the 
emergency generator starts up and, if necessary, for a 
period in the event of total failure of the main supply. 

Electrical systems for offshore production platforms are 
the subject of API RP14F: 1991. 

Fire protection system 

The fire protection system comprises a number of com¬ 
plementary elements. These are 

• hazardous area classification, 

• fire walls, 

• fire and gas detection system, 

• fire water deluge system, 

• fire pumps, 

• foam system, 

• Halon or clean agent systems and 

• fire fighting arrangements. 

Fire prevention and control on offshore production plat¬ 
forms is covered in API RP 14G: 1986. 

The first line of defense against fire is the use of hazardous 
area classification to reduce the risk of ignition of any flam¬ 
mable leak that may occur. This was formerly covered by API 
RP 500B: 1973, specific to offshore, which is now replaced by 
the general onshore and offshore code RP 500:1991. 

The traditional form of active fire protection is the water 
deluge system. This is covered by the NFPA Fire codes, 
Construction and. Use Regulations 1974 and the associated 
guidance in the Offshore Design Guide. The plant is divided 
into reference areas with a specified quantity of water to be 
delivered over each area. In order to limit the size of the 
reference areas use is made of firewalls. There are firewalls 
between the main production modules, namely the well¬ 
head, separation and gas compression modules. These 
provide basic passive fire protection. They are not neces¬ 
sarily designed as blast walls. 

There is an extensive fire and gas (F&G) detection sys¬ 
tem, with sensors in the main production modules and 


elsewhere, utilizing both combustible gas detectors and 
fire detectors. 

A fixed water deluge system with distribution through¬ 
out the main modules and at the risers furnishes a basic 
level of active fire protection. Water for the deluge system is 
drawn from the sea by fire pumps operating off the main 
power supply but with diesel-driven pumps as standby. 

At locations where an oil pool fire may occur, such as the 
production separators, foam injection is provided. 

Certain closed volumes may be provided with a halon 
total flooding system. Enclosures which may be protected 
in this way include the centrifugal compressor enclosures, 
the generator area, the electrical switchgear room and the 
control room. Where, as in the latter case, operators may be 
present, a non-toxic agent is used and there is prior alarm. 
These fixed systems are supplemented by the fire fighting 
teams. 

As just indicated, the traditional means of fire protection 
has been passive protection by firewalls and active protec¬ 
tion by a uniform water deluge. Alternative approaches 
have tended to be inhibited by the need to comply with the 
two separate sets of regulations covering fire, one requir¬ 
ing passive and the other active fire protection measures. 

In addition to the trade-off between passive and active 
fire protection, there may also be a trade-off between ven¬ 
tilation and active fire protection. If a module is well 
ventilated, gas from a leak is less likely to accumulate in the 
first place. 

A plea for greater flexibility was made to the Piper Alpha 
Inquiry by Brandie (1989b), who advocated a scenario- 
based approach in which specific fire hazards are identified 
and water deluge arrangements directed more specifically 
to these scenarios. The Cullen Report recommended this 
approach within the context of Safety Case. 

There are a number of issues related to fire protection. 
One is the availability of standard fire tests for hydro¬ 
carbon, as opposed to building, fires, such tests being nee¬ 
ded for design of fire walls. Another is the use of passive 
fire protection on risers, which might involve a risk of 
corrosion beneath the lagging. 

Another long-standing issue, which relates to active fire 
protection, is the availability of the fire pumps. 

There is generally a strong argument for the use of pas¬ 
sive fire protection in that once installed it appears less 
subject to human failings. The matter is not, however, 
straightforward. Thus, for example, in some applications 
corrosion may occur under fireproofing, which may both 
promote the corrosion and conceal it. 

There is now considerable activity in the investigation of 
fire events on platforms, covering oil pool fires and jet 
flames; impingement of flames on vulnerable targets such 
as risers and passive protection of these targets. Further 
details are given in Section A18.7. 

A18.5.4 Emergency shut-down system 

The platform is provided with an emergency shut-down (ESD) 
system, the main functions of which are (1) to shut down the 
flow from the reservoir, (2) to shut off the flow through the 
pipelines entering and leaving the platform, (3) to shut 
down the main items of equipment and (4) to initiate blow¬ 
down of the inventories to flare. There are various levels of 
ESD, some involving only individual items of equipment 
and others a full platform ESD, or PESD. Physically, PESD 
may be activated from the control room or from any of 
a number of emergency pushbuttons around the platform. 
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As important as the hardware are the procedures that 
govern operation of the PESD system. It bears emphasis 
that the protection apparently afforded can be negated if 
there are cultural, organizational or human factors which 
inhibit initiation of the system in a real emergency. 

A18.5.5 Evacuation, escape and rescue system 

The evacuation, escape and rescue (EER) system is built 
around the three main means of leaving the platform, 
which are (1) helicopter, (2) lifeboat and (3) liferaft. The 
emergency procedure is for personnel to collect at desig¬ 
nated muster points. In the vast majority of cases evacua¬ 
tion is by helicopter, personnel being summoned to the 
helideck from their muster points. There are a number of 
reasons, however, why evacuation by helicopter may be 
impractical. They include high winds and smoke from the 
platform, which can prevent landing. Another is the time 
taken to reach the platform. A helicopter already in or near 
the field may arrive relatively quickly but in many locations 
it takes about an hour for a helicopter to travel from an 
onshore base. 

If helicopter evacuation is not practical, the other main 
means of getting off the platform is by lifeboat. The use of 
lifeboats is also subject to limitations. Lifeboats may 
sometimes be difficult to reach and have limitations in high 
seas. Even if the conditions do not actually prevent use, 
they may increase the risk of injuries. 

If the lifeboats cannot be used, resort is to escape to the 
sea by launching liferafts and climbing down knotted 
ropes. The use of knotted ropes requires a certain degree of 
fitness and is not without risk. One area of development has 
been improved lifeboat systems. Prominent among these is 
the freefall lifeboat, which is launched with its complement 
straight into the water, as opposed to being lowered from 
davits. These have been in use on Norwegian platforms and 
are the method used on the replacement for Piper Alpha, 
Piper Bravo. 

A variety of devices have become available for escape, 
ranging from individual packages which can be hooked 
onto a guard rail to chutes and slides. 

Another aspect is the integrity of the escape routes from 
locations where personnel are likely to be to the means of 
escape. Escape routes need therefore to he designed against 
a variety of scenarios. Of particular importance are the 
routes to the lifeboats from the accommodation, where at 
any given time a large proportion of the personnel will be. 
One approach is to locate lifeboats in a protected area inte¬ 
gral with the accommodation. 

The Piper Alpha Inquiry heard a considerable amount of 
evidence on evacuation, escape and rescue. Contributors 
included Petrie (1989) (life-saving appliances), Rudd 
(1989) and Heiberg-Andersen (1990) (evacuation), Ginn 
(1989) (evacuation by helicopter), Kelleher (1989) (life¬ 
boats), Side (1989) (evacuation and rescue), I.G. Wallace 
(1989) (evacuation and escape), Lien (1989) and Perrott 
(1989) (escape systems), Booth (1989) (escape routes) and 
J.D. Evans (1989) and de la Pena (1989) (smoke hoods). 
Work in this area has been described by Bellamy and 
Harrison (1988), Forland (1992), Forster and Wong (1992) 
and I.G. Wallace (1992). 

A18.5.6 Explosion protection 

In many earlier platform designs, there was little protection 
against explosion over and above that against fire, namely 
partition walls being designed as firewalls rather than as 


blast walls. This situation no longer pertains and much 
effort is being devoted to explosion protection. CFD simu¬ 
lation is being used to study the overpressures generated 
by explosions in modules, with particular reference to the 
enhancing effect of obstacles and to the mitigating effects 
of venting and of water spray systems. 

A large amount of work has been done on the develop¬ 
ment and venting of explosions in modules and other 
obstructed spaces. Much of the work using CFD explosion 
simulation codes has been directed to the offshore module 
situation. Representative work using such codes is that of 
Hjertager (1982a, 1986, 1991), Bakke et al. (1989), Catlin 
(1990) and Hjertager et al. (1994). Examples of work on 
module explosions includes that described by Solberg, 
Pappas and Skramstad (1980,1981), A.J. Harrison and Eyre 
(1987b), Catlin (1991), Brenton, Thomas and Al-Hassan 
(1992), Samuels (1992,1993), Catlin, Manos and Tite (1993) 
and Catlin et al. (1993). A fuller account is given in Chapter 17. 

Blast walls 

An increasingly common method of explosion protection is 
the use of blast walls. The design of a blast wall is partly a 
matter of formulating suitable accident scenarios and pre¬ 
dicting by simulation the resultant overpressure and partly 
one of engineering the wall so that it fulfils its protective 
function even if it deforms somewhat. 

An account of the design of the blast walls on the Kittiwake 
platform was given to the Piper Alpha Inquiry by Doble 
(1989). The engineering of blast walls was described by van 
Beek (1989). 

Smoke minimization and protection 
Another area of work is the investigation of the hazard 
presented by smoke, particularly that from an oil pool fire. 
Aspects of this are the generation and movement of smoke 
and the exclusion of smoke from the accommodation. 

Al 8.5.7 Design basis accidents 

The design of plant to cope with accidental events requires 
that there be defined a set of design basis accidents. 
The concept is that the plant is then designed to with¬ 
stand the design basis accidents in each category but does 
not have to be designed for events more severe than this. 
The selection of the design basis accidents is therefore 
closely linked with the estimates for the frequency of 
such events, so that overall risk in the design is an appro¬ 
priate one. 

Drilling 

Drilling is a major activity on the platform that has no 
counterpart onshore. One aspect of this activity is the ever¬ 
present hazard of a well blowout. 

Another aspect that can impinge on the operation of the 
platform as a whole is the need to avoid loss of power such 
that the drill becomes stuck. 

Diving 

Diving is another activity specific to an offshore platform. 
For the most part it does not impinge to any major extent on 
other activities except in so far as precautions are neces¬ 
sary to ensure the safety of the divers. At the time of the 
explosion on Piper Alpha the fire pumps had been turned to 
manual start to prevent sudden start-up of the pumps with 
consequent danger of a diver being drawn into the pump 
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water inlet. This was not the policy on the sister platform 
Claymore, run by the same operator and in the same field. 


The proportion of contractors on a platform may well be of 
the order of 70 % or more. Typically specialist teams such as 
drillers and divers are contractors with one person from the 
operating company as liaison. Some contractors may 
remain on a platform for long periods, others come and go. 
The operating company attempts to ensure the quality of 
contractors admitted to the platform by means of a quality 
assurance system. Personnel from the company visit the 
contractor company onshore and make the usual quality 
assurance audit. 

It is the responsibility of a contractor to ensure that its 
personnel are properly trained in offshore emergency pro¬ 
cedures as well as in safe systems of work and PTW sys¬ 
tems. However, there may well be features of the systems 
operated on a platform that are particular to that platform. 
The operator needs, therefore, to ensure that contractors 
within its system are familiar with them. 


A18.6 Offshore Emergency Planning 

Offshore emergency planning has the same broad features 
as that for onshore. In principle, they include the detection 
of the incident, the assessment of its nature and serious¬ 
ness and if necessary, the declaration of the emergency, the 
assumption of command and control, and the implementa¬ 
tion of the emergency plan. 

However, the emergency may not present in this ideally 
structured form. It may well take the form of an emergency 
shut-down initiated automatically or by personnel in the 
control room or at one of the shut-down buttons scattered 
throughout the platform. 

A18.6.1 Emergency scenarios 

The first step in emergency planning is the definition of the 
set of scenarios on which the plan is to be based. A wide 
range of scenarios need to be considered if the plan is to be 
robust. It is not uncommon for an incident to require the 
evacuation of the platform, but in the vast majority of cases 
this will be by helicopter and management may well feel it 
has not done as well as it might if even one person is injured. 

At the other extreme is the sort of situation that arose on 
Piper Alpha where there was no prospect of an evacuation 
by any of the conventional means and where escape to the 
sea was the only option. This implies that the person in 
command explicitly instruct personnel to make their own 
escape. 

A18.6.2 Goal-setting regulations 

The basic framework operated in the new offshore safety 
administration is that of regulations which are goal-setting 
rather than prescriptive. 

The first set of regulations of the new offshore adminis¬ 
tration are the Offshore Installations (Safely Case) Regula¬ 
tions 1992. 

Before considering these, it is interesting to note that 
the first regulations issued, by the DoEn, in the wake of 
the Piper Alpha disaster were the Offshore Installations 
(Pipe-line Valve) Regulations 1989, which require the opera¬ 
tor to fit EIVs to the pipelines connected to the platform 
and are thus prescriptive. The Cullen Report explicitly 


endorsed this, in effect considering that exceptionally 
this case met the conditions for adopting a prescriptive 
regulation. 

A18.6.3 Safety case 

The Offshore Installations (Safety Case) Regulations 1992 
implement Recommendation 1 of the Cullen Report that the 
operator should submit to the regulator a safety case. 

For major hazard installations onshore a requirement for 
a safety case already existed under the CIMAH Regula¬ 
tions 1984. Evidence on the onshore safety case was 
given to the Piper Alpha Inquiry by Sefton (1989) and 
V.C. Marshall (1989d). 

The offshore safety case is largely modelled on the 
onshore case, but has three features not explicitly con¬ 
tained in the latter. 

Safety management system 

One of these is the requirement on the operator to demon¬ 
strate that it has an SMS, which will assure the safety of 
the project through the design and operation. The SMS is 
thus part of the safety case rather than a free-standing 
requirement. 

Temporary safe refuge 

The second distinguishing feature of the offshore safety 
case is the requirement that the platform has a TSR, nor¬ 
mally the accommodation, which should provide protection 
for a defined period. Design of aTSR involves the definition 
of the events against which it is to provide protection and 
specification both of the endurance period and the condi¬ 
tions which constitute failure. 

Quantitative risk assessment 

The third distinguishing feature of the offshore safety case 
is the requirement to use QRA. Essentially the QRA is a 
matter for the operator. The Cullen Report does, however, 
propose that one aspect of it be specified by the regulator. 

The Safety Case involves a demonstration that the fre¬ 
quency of events that threaten the endurance of the 
accommodation, or TSR, will not exceed a certain value. In 
order to provide at least one fixed point in the administra¬ 
tion, both the minimum endurance and the frequency with 
which there is a failure of such endurance should be speci¬ 
fied by the regulatory body, at least in the first instance. 

Accounts of offshore QRA include those of Pape (1992) 
(regulator), Sherrard (1992) (drillling units), R.F. Evans 
(1994) (model validation) and Gardner et al. (1994) 
(methodology). 


Al 8.6.4 Costs of offshore safety 

In the wake of Piper Alpha the offshore industry has 
incurred major expenditure to enhance safety. Much of this 
was incurred in response to the disaster itself and before 
the Cullen Report appeared. 

The HSE itself has made a comparison of the quantifi¬ 
able costs and benefit of safety measures in the UK North 
Sea expressed as Net Present Value over 15 years (HSC, 
1992). It attributes the bulk of both costs and benefits to 
the Safety Case Regulations, the costs being estimated 
at £1200-2500 million and the benefits at £2600-4600 
million. A commentary on these estimates is given by 
Potter (1994). 
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A18.7 Offshore Event Data 

As for onshore installations, information on offshore 
events is of two main types: (1) incident data and (2) equip¬ 
ment failure data.TheWorld-wide Off shore Accident Databank 
(WOAD, 1988) enumerates the principal accidents involving 
offshore structures involved in oil and gas activities. There is 
also a need, particularly in hazard assessment, for more 


detailed information on events such a leaks, fires and explo¬ 
sions, dropped loads and so on.The HSE has created the HCR 
database, as described by Bruce (1994). 

Equipment failure data collection is the subject of a 
major co-operative exercise carried out under the aegis of 
OREDA and initiated some years before Piper Alpha. This 
is described in Appendix 14. 
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At 10.00 p.m. on 6 July 1988 an explosion occurred in the gas 
compression module of the Piper Alpha oil production 
platform in the North Sea. A large pool fire took hold in the 
adjacent oil separation module, and a massive plume of 
black smoke enveloped the platform at and above the pro¬ 
duction deck, including the accommodation. The pool fire 
extended to the deck below, where after 20 min it burned 
through a gas riser from the pipeline connection between 
the Piper and "Ihrtan platforms. The gas from the riser 
burned as a huge jet flame. Most of those on board were 
trapped in the accommodation. The lifeboats were inacces¬ 
sible due to the smoke. Some 62 men escaped, mainly by 
climbing down knotted ropes or by jumping from a height, 
but 167 died, the majority in the quarters. 

The Piper Alpha explosion and fire was the worst accid¬ 
ent which has occurred on an offshore platform. 

Following the disaster a Public Inquiry was set up under 
the Public Inquiries Regulations - Offshore Installations 
Regulations 1974 presided over by Lord Cullen to establish 
the circumstances of the disaster and its cause and to make 
recommendations to avoid similar accidents in the future. 
The Inquiry’s report The Public Inquiry into the Piper Alpha 
Disaster (the Piper Alpha Report, or Cullen Report) (Cullen, 
1990) is the most comprehensive inquiry conducted in the 
United Kingdom into an offshore platform disaster, or indeed 
into any process industry disaster, onshore or offshore. 

The Piper Alpha Inquiry has been of crucial importance 
in the development of the offshore safety regime in the UK 
sector of the North Sea. Whereas Flixborough was followed 
first by a Court of Inquiry and then by the Advisory Com¬ 
mittee on Major Hazards, the Piper Alpha Inquiry not only 
discharged the function of an inquiry into the specific dis¬ 
aster, but made recommendations for fundamental changes 
to the offshore safety regime which were accepted by the 
government. 

The description of the Piper Alpha disaster given below 
is necessarily a relatively brief one. Nevertheless, it is some¬ 
what fuller than that of the case histories in the other 
appendices, for several reasons. It provides a good illus¬ 
tration of the work of an accident inquiry. It is replete with 
lessons on design and operation of hazardous installations. 
And it has had far-reaching consequences for the offshore 
safety regime. A fuller account is given in the Piper Alpha 
Report. The daily transcripts, available in copyright 
libraries, also repay study. An account from the viewpoint 
of one of the consultants to the Inquiry has been given by 
Sylvester-Evans (1991). 

Selected references on Piper Alpha are given in 
Table A19.L 


A19.1 The Company, the Management and the 
Personnel 

The Piper Alpha oil platform was owned by a consortium 
consisting of Occidental Petroleum (Caledonia) Ltd,Texaco 
Britain Ltd, International Thomson pic and Texas Petro¬ 
leum Ltd and was operated by Occidental. 

The management concerned with the Piper platform 
included 

Offshore Installation Manager Mr C.D. Seaton 

Offshore Superintendent MrT.J. Scanlon 

Senior Maintenance Superintendent Mr R.H. Seddon 
Maintenance Superintendent Mr K.D. White 

MrA.C.B.Todd 


Table A19.1 Selected references on Piper Alpha 


Report of the Public Inquiry 

Cullen (1990) 


Part 1 Evidence 

F. H. Atkinson (1989) (Lloyds Register); Bakke (1989) 
(explosion simulation); Balfour (1989) (gas detectors); 

Bett (1989) (reciprocating compressors); Bodie (1989) 
(Offshore Safety Superintendent); Bollands (1989) 

(Control Room Operator); Brading (1989) (Chairman, 
Occidental Petroleum (Caledonia) Ltd); Burns (1989) 

(Shift Supervisor, MCP01); A.G. Clark (1989) (Maintenance 
Lead Hand); M.R. Clark (1989) (hydrocarbon inventory); 
Clayson (1989) (evacuation, escape and rescue); R.A. Cox 
(1989a) (damage to firewall, explosion simulation); 

R.A. Cox (1989b) (damage by projectiles); R.A. Cox (1989c) 
(damage to electrical systems, ESD, F&G, fire protection 
systems); R.A. Cox (1989d) (damage to risers); Cubbage 
(1989) (explosion effects analysis); J. Davidson (1989) 
(Operations Superintendent, Claymore); M.E. Davies 
(1989) (wind tunnel modelling of gas dispersion); D.D. 
Drysdale (1989) (escalation of fire); J. Drysdale (1989) 
(hydrates, methanol injection); Gordon (1989) (Manager, 
Loss Prevention Dept); P.M. Grant (1989) (contractors); 
Grieve (1989) (Process Operator); Grogan (1989) 
(Vice-President Engineering, Occidental); Guiomar (1989) 
(OIM, MCP01); Henderson (1989) (Lead Operator); Jefferey 
(1989) (liferafts); Jenkins (1989) (DoEn Inspector); Johnsen 
(1989) (hydrates, methanol injection); Leeming (1989) 
(OIM, Tartan); P. Lloyd (1989) (electrical systems); 
Lockwood (1989) (Lead Production Operator, permits-to- 
work); Macallan (1989) (Production and Pipeline Manager); 
A.G. McDonald (1989) (telecommunications); McGeough 
(1989) (safety training); McLaren (1989) (Lloyds Register, 
electrical); McNeill (1989) (rescue); McReynolds (1989) 
(Vice-President Operations, Occidental); J.G. Marshall 
(1989) (ignition sources); Moreton (1989) (Production 
Supervisor, Tartan); J. Murray (1989) (gas detectors); A.C. 
Palmer (1989) (damage by projectiles); Paterson (1989) 
(hydrates, methanol injection); Petrie (1989) (Director of 
Safety, DoEn); Pillans (1989) (Lloyds Register, electrical); 
Rankin (1989) (supervisor, Score PSVcertification team); 

G. Richards (1989) (OIM (back-to-back)); S.M. Richardson 
(1989a) (hydrates, methanol injection); S.M. Richardson 
(1989b) (gas pipelines); S.M. Richardson (1989c) 
(autoignition); S.M. Richardson (1989d) (leaks); 

Ritchie (1989) (Managing Director, Score UK Ltd); 

K. Roberts (1989) (Facilities Engineer,Tartan); G.G. 
Robertson (1989) (Safety Supervisor); J.B. Russell (1989) 
(hydrates, methanol injection); Saborn (1989) (standby 
vessel); Sandlin (1989) (OIM, Claymore); Saville (1989a) 
(condensate admission to PSV 504 system); Saville (1989b) 
(leaks); Saville (1989c) (hydrates, methanol injection); 
Saville (1989d) (pipe failure); Scanlon (1989) 

(Offshore Superintendent, maintenance); Scilly (1989) 
(explosion effects analysis); Scothern (1989) (gas 
detectors); Seddon (1989) (Senior Maintenance 
Superintendent); Smyllie (1989) (flare); Tea (1989) 

(gas detectors); Thomson (1989) (Lloyds Register); Todd 
(1989) (Maintenance Superintendent); TUcker (1989) 
(accommodation); P.C.A.Watts (1989) 

(flare); Whalley (1989) (PSVrecertification); 

WPWood (1989) (DoTp surveys); Wottge (1989) 

(platform, facilities and systems) 
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Part 2 Evidence 

A J. Adams (1989) (pipeline isolation, inc. subsea isolation 
valves); C.S. Allen (1989) (PTWs); Ashworth(1989) 
(process control and ESD); Banks (1990) (maintenance 
supervisors); Baxendine (1989) (emergency command); 
van Beek (1989) (blast walls); Booth (1989) (escape routes); 
Brandie (1989a) (safe havens); Brandie (1989b) 
(alternatives to standard fire water systems); Broadribb 
(1989) (subsea isolation valves); Chamberlain (1989) 
(mitigation of vapour cloud explosions); R. A. Cox (1989c) 
(QRA); Cunningham (safety representatives); Dalzell 
(1989) (smoke ingress into accommodation); Daniel (1989) 
(standby vessels); G.H. Davies (1989) (PTWs); Day (1989) 
(emergency power); Denton (1989) (quality management 
systems); Doble (1989) (explosion prevention and 
mitigation - Kittiwake); Drew (1989) (standby vessels); 
Ellice (1989) (training of OIMs); Ellis (1989) (HSE view of 
QRA); J.D. Evans (1989) (smoke hoods); Ferrow (1989) 
(FSA); Fleishman (1989) (Gyda safety evaluation); Gilbert 
(1989) (subsea isolation valves); Ginn (1989) (evacuation by 
helicopter); Gorse (1989) (FSA); Heiberg-Andersen (1990) 
(evacuation, Norwegian sector); Higgs (1990) (offshore 
safety regime); Hodgkins (1989) (HSC - DoEn Agency 
Agreement); Hogh (1989) (QRA); M.J. Jones (1990) 
(training); Keenan (1989) (standby vessels); Kelleher (1989) 
(lifeboats); Kinloch (1989a) (PTW); Kyle (1989) (PTWs); 
Lien (1989) (escape systems); Littlejohn (1990) (offshore 
supervisors); Lyons (1989) (offshore safety regime); 
McIntosh (1989) (fire and explosion protection); McKee 
(1990) (safety management); Macey (1989) (standby 
vessels); Matheson (1989) (offshore emergency medical 
team); VC. Marshall (1989d) (safety cases); Middleton 
(1989) (standby vessels); Nordgard (1990) (accommodation 
in Norwegian sector); Ognedal (1990) (Norwegian offshore 
safety regime); Pape (1989) (HSE view on QRA); de la 
Pena (1990) (smoke hoods); Perrott (1989) (escape systems); 
Petrie (1989,1990) (life-saving appliances, offshore safety 
regime); Priddle (1990) (offshore safety regime); 
Rimington (1990) (onshore safety regime); Rudd (1989) 
(evacuation); Scanlon (1989) (PTWs); Sefton (1989) 
(CIMAH, safety cases); R.A. Sheppard (1989) 

(safety management); Side (1989) (rescue and 
evacuation); Spouge (1989) (options for accommodation); 
B.G. Taylor (1989) (offshore industry developments); 

Tveit (1990) (Norwegian offshore safety regime, QRA); 
Vasey (1989) (mitigation of module explosions); 

I.G. Wallace (1989) (evacuation and escape); Willatt (1989) 
(offshore pipeline connections) 

Further accounts 

Anon. (1988g); Johnsen (1989,1990); Boniface (1990a,c-e); 
Redmond (1990,1991LPB102); S.M. Richardson, Saville 
and Griffiths (1990); Sylvester-Evans (1990a,b, 1991); 
Tombs (1990); Lees (1991,1992a, 1994b) 


Other personnel on duty on the evening of July 6 and 
referred to below include 

Lead maintenance hand Mr A.G. Clark 

Lead production operator Mr R.A.Vernon 
Phase 1 operator Mr R.M. Richard 

Phase 2 operator Mr E.C. Grieve 

Control room operator Mr G. Bollands 

Instrument technician Mr W.H. Young 


A19.2 The Field and the Platform 

The Piper Alpha platform was located in the Piper field 
some 110 miles north-east of Aberdeen.The platforms in the 
field and the pipeline connections between them are shown 
in Figure A19.1.The Piper platform separated the fluid 
produced by the wells into oil, gas and condensate. The oil 
was pumped by pipeline to the Flotta oil terminal in the 
Orkneys, the condensate being injected back into the oil for 
transport to shore. The gas was transmitted by pipeline to 
the manifold compression platform MCP- 01, where it joined 
the major gas pipeline from the Frigg Field to St Fergus. 

There were two other platforms connected to Piper 
Alpha. Oil from the Claymore platform, also operated by 
Occidental, was piped to join the Piper oil line at the 
‘Claymore T’. Claymore was short of gas and was therefore 
connected to Piper Alpha by a gas pipeline so that it could 
import Piper gas. Oil from Tartan was piped to Claymore 
and then to Flotta and gas from Tartan was piped to Piper 
and thence to MCP- 01. 

Elevation views of the Piper Alpha platform, the layout of 
the production deck at the 84 ft level and the layout of the 
deck below, the 68 ft level, are shown in Figures A19.2, 
A19.3 and A19.4 respectively. The production deck level 
consisted of four modules, Modules A—D. A Module was the 
wellhead, B Module the oil separation module, C Module 
the gas compression module and D Module the power gen¬ 
eration and utilities module. 

A Module was about 150 ft long east to west, 50 ft wide 
north to south and 24 ft high. The other modules were of 
approximately similar size. There were firewalls between 
A and B Modules, between B and C Modules and between 
C and D Modules (the A/B, B/C and C/D firewalls, respec¬ 
tively); these firewalls were not designed to resist blast. 

The pig traps for the three gas risers from Tartan and to 
MCP-01 and Claymore were on the 68 ft level. Also on this 
level were the dive complex and the JT flash drum, the con¬ 
densate suction vessel and the condensate injection pumps. 

There were four accommodation modules: the East 
Replacement Quarters (ERQ), the main quarters module; 
the Additional Accommodation East (AAE); the Living 
Quarters West (LQW) and the Additional Accommodation 
West (AAW). 

The control room was in a mezzanine level in the upper 
part of D Module. It was located about one quarter of the 
way along the C/D firewall from the west face. 

There were two flares on the south end of the platform, 
the east and west flares, and there was a heat shield around 
A Module to provide protection against the heat from the 
flares. 

Platform systems included the electrical supply system, 
the fire and gas detection system, the fire water deluge 
system, the emergency shut-down system, the commu¬ 
nications system and the evacuation and escape system. 

Electrical power was supplied by two main generators 
which normally ran off the gas supply but could be fired 
by diesel. There was a diesel-fired emergency generator 
and also a drilling generator and an emergency drilling 
generator. In addition, there were uninterrupted power 
supplies for emergency services. 

The main production areas were equipped with a fire and 
gas detection system. In C Module the gas detection system 
was divided into five zones: Cl and C2 in the west and east 
halves of the module and C3, C4 and C5 at the three com¬ 
pressors, respectively 
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Figure A 19.1 Pipeline connections of the Piper field 
(Sylvester-Evans, 1991)(Courtesy of the Institution of 
Chemical Engineers) 


The fire water deluge system consisted of ring mains 
which delivered foam in A-C Modules and part of D 
module and at theTartan and MCP- 01 pig traps and water at 
the condensate injection pumps. The fire pumps were sup¬ 
plied from the main electrical supply but there were backup 
diesel-driven pumps. 

The hydrocarbon inventory in the pipelines was 
approximately as follows. The main oil line was 30 in. in 
diameter and 30 miles long and held some 70,000 te of 
oil. The gas line from Tartan was 18 in. in diameter and 
11.5 miles long and held some 450 te; the gas line to MCP- 01 
was 18 in. in diameter and 33.5 miles long and held 1280 te; 
the gas line to Claymore was 16 in. in diameter and 21.5 miles 
long and held 260 te. 

A19.3 The Process and the Plant 

The fluid from the wellhead, containing oil, gas, con¬ 
densate and water, passed through the wellhead ‘Christmas 
trees’ to the two separators where the gas was separated 
from the oil and water. The oil was then pumped into the 
main oil line. The gas was compressed first in three cen¬ 
trifugal compressors to 675 psia, with some gas being 
taken off at this point as fuel gas for the main generators, 
and then boosted in the first stage of two reciprocating 
compressors to 1465 psia. Condensate was removed and the 
gas was then further compressed in the second stage of the 
reciprocating compressors to 1735 psia. The gas then went 
three ways: to serve as lift gas at the wells, to MCP-01 as 
export gas or to flare. The plant could be operated in two 
modes, which affected the method of removing condensate. 
In the normal, or phase 2, mode, the gas passed from the 


first stage of the reciprocating compressors to the Gas 
Conservation Module (GCM), where it was dried. The gas 
was then cooled by reducing the pressure across a turbo¬ 
expander so that condensate was knocked out by the 
expansion and returned to the outlet of the JT flash drum, 
which was also the inlet of the second stage of the recipro¬ 
cating compressors. Condensate from the GCM was passed 
to the JT flash drum. The process could also revert to the 
original, or phase 1 mode, dating from a period before the 
GCM was installed to produce export quality gas, in which 
the GCM was isolated and gas from the first stage of the 
reciprocating compressors was let down in pressure across 
the JT valve into the JT flash drum so that condensate was 
knocked out by the Joule-Thomson (JT) effect and then 
passed as before into the second stage of the reciprocating 
compressors. Condensate from the JT flash drum passed 
first to two parallel centrifugal condensate booster pumps 
and then to two reciprocating condensate injection pumps 
which pumped the condensate into the main oil line. 
There was normally one condensate injection pump line 
operating and one on standby. 

Each condensate injection pump was protected from 
overpressure on the delivery side by a single pressure safety 
valve (PSV). The PSV was on a separate relief line from the 
delivery head of the pump rather than on the delivery line 
itself. The valve on Apump was PSV 504 and that on B pump 
PSV 505. These valves were located in C Module, the relief 
line running up from the 68 ft level, where the pumps were 
located, to the PSVs in C Module and back down to the con¬ 
densate suction vessel on the 68 ft level. 

In accordance with standard practice, methanol was 
injected into the process at various points to prevent 
formation of hydrates which would tend to cause blockages. 

A19.4 Events Prior to the Explosion 

On 6 July there was a major work programme on the plat¬ 
form. This included the installation of a new riser for the 
Chanter field and work on a prover and metering loop. 

The extra accommodation for the workforce was pro¬ 
vided on the Tharos, a large floating fire fighting vessel 
anchored near the platform. Also near the platform were 
the standby vessel, the Silver Pit, a pipeline vessel, the 
Lowland Cavalier, and Maersk anchor handling vessels for 
the Tharos. 

The GCM was also out of service for changeout of the 
molecular sieve driers. In consequence, the plant operation 
had reverted to the phase 1 mode so that the gas was rela¬ 
tively wet. 

The resulting increased potential for hydrate formation 
was recognized by management onshore. The increased 
methanol injection rates required were calculated and 
communicated to the platform together with suggestions 
for the configuration of the methanol pumps. The methanol 
injection rates needed were some 12 times greater than for 
normal phase 2 operation. 

However, there was an interruption of the methanol 
supply to the most critical point, at the JT valve, between 
4.00 and 8.00 p.m. that evening. 

The operating condensate injection pump was B pump. 
The A pump was down for maintenance. There were three 
maintenance jobs to be done on this pump: (1) a full 
24 month preventive maintenance (PM), (2) repair of the 
pump coupling and (3) recertification of PSV 504. In order 
to carry out the 24 month PM, the pump had been isolated 
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Figure A19.2 The Pipe Alpha platform: (a) east elevation 
(Courtesy of the Institution of Chemical Engineers) 


by closing the gas operated valves (GOVs) on the suction 
and delivery lines but slip plates had not been inserted. 
Work on the coupling, which was suffering from a vibration 
problem, would not involve breaking into the pump. 

With the pump in this state, with the GOVs closed but 
without slip plate isolation, access was given to remove PSV 
504 for testing. It was taken off in the morning of July 6 by a 
two-man team from the specialist contractor Score UK Ltd. 
They were not able to restore the PSV that evening. The 
supervisor in this team came back to the control room some 
time before 6.00 p.m. to suspend the permit-to-work (PTW) 


and (b) west elevation (Syivester-Evans, 1991) 


and the team then went off duty, intending to put the PSV 
back the next day. 

At about 4.50 p.m. that day, just at shift changeover, the 
maintenance status of the pump underwent a change. The 
maintenance superintendent decided that the 24 month PM 
would not be carried out and that work on the pump should 
be restricted to the repair of the pump coupling. 

About 9.50 p.m. that evening B pump on the 68 ft level 
tripped out. The lead production operator and the phase 1 
operator attempted to restart it but without success. 
The loss of this pump meant that with A pump also down 
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Figure A19.3 The Piper Alpha platform: the production deck on the 84 ft level (Sylvester-Evans, 1991) 
(Courtesy of the Institution of Chemical Engineers) 



Figure A19.4 The Piper Alpha platform: the 68 ft level (Sylvester-Evans, 1991) (Courtesy of the Institution of 
Chemical Engineers) 
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condensate would back up in the JT flash drum and within 
some 30 min would force a shut-down of the gas plant. 
There was a possibility that if the gas supply to the main 
generator was lost and if the changeover to the alternative 
diesel fuel failed, the wells also would have to be shut-down. 
It would then be necessary to undertake a ‘black start’. 

The lead operator came up to the control room. He talked 
on the telephone with the lead maintenance hand and it was 
agreed to attempt to start A pump. The lead operator signed 
off the permit for A pump so that it could be electrically 
deisolated and restarted, and went back down to the pumps. 
The lead maintenance hand came down to the control room to 
organize the electricians to deisolate the pump. It is uncer¬ 
tain precisely what action the lead operator and the phase 1 
operator took. They were observed at the pumps by the 
phase 2 operator and an instrument fitter, but the evidence of 
these witnesses was inconclusive. However, there was no 
doubt that the lead operator intended to start A pump. 

About 9.55 p.m. the signals for the tripping of two of the 
centrifugal compressors in C Module came up in the control 
room. This was followed by a low gas alarm in C3 zone on C 
centrifugal compressor. Then, the third centrifugal com¬ 
pressor tripped. Before the control room operator could 
take any action a further group of alarms came up: three 
low gas alarms in zones C2, C4 and C5 and a high gas alarm. 
The operator had his hand out to cancel the alarms when he 
was blown across the room by the explosion. 

Just prior to the explosion personnel in workshops in 
D Module heard a loud screeching sound which lasted for 
about 30 s. 


A19.5 The Explosion, the Escalation and the Rescue 

The initial explosion occurred at 10.00 p.m. It destroyed 
most of the B/C and C/D firewalls and blew across the room 
the two occupants of the control room, the control room 
operator and the lead maintenance hand. 

The emergency shut-down (ESD) system operated, clos¬ 
ing the emergency shut-off valve (ESV) on the main oil line 
and starting blowdown of the gas inventories to flare. The 
ESVs on the gas pipelines were not designed to close on 
platform ESD; this would impose an undesirable forced 
shut-down on the other platforms connected to Piper. 
Instead there were three separate shut-down buttons for 
these ESVs in the control room. 

The explosion was followed almost immediately by a 
large fireball which issued from the west side of B Module 
and a large oil pool fire at the west end of that module. The 
explosion and fire were witnessed by personnel on the ves¬ 
sels lying off the platform. It so happened that one witness 
on the Tharos was standing with camera at the ready. He 
took a sequence of shots of the development of the fireball. 

The large oil pool fire gave rise to a massive smoke plume 
which enveloped the platform from the production deck at 
the 84 ft level up. 

The offshore installation manager (OIM) made his way 
to the radio room and had a Mayday signal sent. 

The Tharos effectively took on the role of On-Scene 
Commander. The Coast Guard station and Occidental 
headquarters onshore were informed. Rescue helicopters 
and a Nimrod aircraft for aerial on-scene command were 
dispatched. The flight time for the helicopters was about 
an hour. 

Most of the personnel on the platform were in the 
accommodation, the majority in the ERQ. Within the first 


minute flames appeared on the north face of the module 
also and the module was enveloped in the smoke plume 
coming from the south. The escape routes from the module 
to the lifeboats were impassable. 

At the 68 ft level divers were working with one man 
under water. They followed procedure, got the man up 
and briefly through the decompression chamber. They 
were unable to reach the lifeboats, which were inaccessible 
due to the smoke. They therefore launched life rafts 
and climbed down by knotted rope to the lowest level, the 
20 ft level. 

The drill crew also followed procedure and secured the 
wellhead. 

The oil pool in B Module began to spill over onto the 68 ft 
level where a further fire took hold. There were drums of 
rigwash stored on that level which may have fed the fire. 

The fire water drench system did not operate. There was 
only a trickle of water from the sprinkler heads. 

The explosion disabled the main communications sys¬ 
tem which was centred on Piper. The other platforms were 
unable to communicate with Piper. They became aware that 
there was a fire on Piper, but did not appreciate its scale. 
They continued for some time in production and pumping 
oil. This pumping would have caused some additional oil 
flow from the leak at Piper. 

After some 20 min from the initial explosion the fire on 
the 68 ft level led to the rupture of the Tartan riser on the 
side outboard of the ESV This resulted in a massive jet 
flame which enveloped much of the platform. 

The emergency procedure was for personnel to report to 
their lifeboat, but in practice most evacuations would be by 
helicopter and personnel would be directed from the life¬ 
boats to the dining area on the upper deck of the ERQ and 
then to the helideck. Personnel in the ERQ found the escape 
routes to the lifeboats blocked and waited in the dining 
area. The OIM told them that a Mayday signal had been sent 
and that he expected helicopters to be sent to effect the 
evacuation. In fact the helideck was already inaccessible to 
helicopters. 

Some 33 min into the incident the Tharos picked up the 
signal ‘People majority in galley. Tharos come. Gangway. 
Hoses. Getting bad’. 

No escape from the ERQ to the sea was organized by the 
senior management. However, as the quarters began to fill 
with smoke individuals filtered out by various routes and 
tried to make their escape. 

Some men climbed down knotted ropes to the sea. Others 
jumped from various levels, including the helideck at 
174 ft. One man who had arrived only that afternoon on 
his first tour jumped from a high level. One standing on 
pipes protruding from the pipe deck was pushed off by 
another behind him who could no longer stand the heat of 
the pipes. 

The vessels around the platform launched their fast res¬ 
cue craft (FRCs). The first man rescued, by the FRC of the 
Silver Pit, was the oil laboratory chemist, who, on experi¬ 
encing the explosion, simply walked down to the 20 ft 
level and was picked up without getting his feet wet. Most 
survivors, however, were rescued from the sea. Much of 
the rescue operation took place after the rupture of the 
Tartan riser. 

The FRC of another vessel, the Sandhaven, was des¬ 
troyed with only one survivor. The FRC of the Silver Pit 
made repeated runs to the platform; eventually it was 
blown out of the water, and began to sink, but returned 
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to the platform and then finally sank, its crew being 
themselves rescued by helicopter. 

At about 10.50 p.m. the MCP-01 riser ruptured and about 
11.18 p.m. the Claymore riser ruptured. The pipe deck 
collapsed and the ERQ tipped. By 12.15 a.m. on 7 July the 
north end of the platform had disappeared. By the morning 
onlyA Module, the wellhead, remained standing. 

A19.6 The Investigation 

An investigation of the disaster was immediately under¬ 
taken by the Department of Energy (DoEn) headed by 
Mr Petrie. Two reports were issued, an interim report 
(the Petrie Interim Report, or simply, the Petrie Report) and 
a final report (the Petrie Final Report)', the latter included 
appendices on various technical studies commissioned. 

The Petrie Report put forward two scenarios for the 
hydrocarbon leak which led to the explosion: a leak from 
the site of PSV 504 (Scenario A) and a leak due to ingestion 
of liquid into the reciprocating compressors (Scenario B). 

The Inquiry was presided over by a Scottish judge, Lord 
Cullen, assisted by three technical assessors. There was a 
legal counsel to the Inquiry assisted by technical con¬ 
sultants to the Inquiry. Parties to the Inquiry included 
Occidental, the DoEn, groups representing survivors and 
the trade unions, the contractors, the specialist contractor 
Score, several equipment manufacturers and for the second 
part, the UK Oil Operators Association (UKOOA). Part 1 of 
the Inquiry dealt with the disaster and its background, 
Part 2 with the future. The Inquiry heard some 280 witnesses 
in 180 days of evidence and received some 840 productions, 
or documents. 

It began by considering whether to advise that the debris 
of the platform should be raised from the sea bed. It was 
clear at an early stage that the size of leak sought was of 
the order of 10 mm. The evidence was that the opera¬ 
tion presented a number of problems and hazards, would 
involve considerable delay and might well not provide much 
useful information. The Inquiry decided not to pursue the 
matter. 

In seeking to find the cause of the leak, the Piper Alpha 
Report begins with the evidence on the explosion itself. It 
concludes that the explosion was at 10.0 0 p.m., that it was in 
C Module and in the south-east quadrant of that module, 
that the fuel involved was condensate, that the leak gave 
rise to a gas cloud filling less than 25% of the module, that 
the mass of fuel within the flammable region was some 
30-80 kg, that the explosion was a deflagration rather than 
a detonation, that the maximum peak overpressure was in 
the range 0.2-0.4 bar and that the ignition source could not 
be identified. Evidence for these findings included the gas 
alarms in C Module; the screeching noise heard just prior 
to the explosion; testimony of and photographs taken by 
observers on the surrounding vessels of the fires just after 
the explosion; the effects of the explosion, including the 
damage to the two firewalls in C Module; the effects of the 
explosion on the control room and its occupants; the lack of 
damage to the heat shield on A Module and estimates of 
overpressure based on some of the explosion effects, such 
as firewall damage and bodily translation of persons. 

It was not initially clear how a gas cloud of sufficient size 
could develop without setting off certain gas alarms which 
according to the evidence had not been triggered. In parti¬ 
cular there was a gas detector in the roof above the site of 
PSV 504 or PSV 505 (the two valves were close together) 


and another some 2—3 ft above floor level among the heat 
exchangers between the reciprocating and centrifugal 
compressors; both these detectors were in C2 zone. How¬ 
ever, the first gas alarm was in C3 zone at C centrifugal 
compressor. Accordingly, wind tunnel tests were commis¬ 
sioned from BMT Fluid Mechanics to explore the pattern of 
gas alarms for different types of leak. Scenarios investi¬ 
gated included leaks of natural gas and of condensate, the 
one a buoyant and the other a heavy gas; leaks from various 
points in the modules and leaks from various types of 
source, including a leaking flange and an open pipe. It was 
concluded by the investigator that of the scenarios studied 
only a leak from the site of PSV 504 or PSV 505 fitted the 
pattern of gas alarms and, further, that this leak was a two- 
stage leak, the first stage being small and the second rela¬ 
tively large. It would have been this second stage which 
gave rise to the gas cloud sought. 

The experimental run of main interest simulated a leak 
of 100 kg/min from PSV 504. Figure A19.5 shows the 
contours of the lower flammability limit of the gas cloud 
formed after 30 s from such a leak. The cloud would not 
set off either of the gas detectors mentioned. Figure A19.6 
shows the mass of gas within the flammable limit as a 
function of the leak flow rate after 30 s and at infinite time. 
These results were subject to a number of reservations 
but indicated that a gas cloud of sufficient size could be 
formed. 

The next question considered was whether the explosion 
of such a gas cloud could cause the damage observed. It was 
estimated that the B/C firewall would fail at an over¬ 
pressure of 0.1 bar and the C/D firewall at an overpressure 
of 0.12 bar. 

Simulations of the explosion of flammable mixtures in 
the module had been commissioned prior to the Inquiry at 
the Christian Michelsen Institute (CMI) by the DoEn and 
other parties. The simulations were performed using the 
FLACS computer code. Following the wind tunnel work, the 
Inquiry commissioned a single further run for a gas cloud 
in the south-east quadrant of C Module and containing 
some 45 kg of propane within the flammable limit. The 
simulation was subject to a number of reservations but 
indicated that such an explosion could cause the firewall 
damage observed. 

The simulation also provided an explanation of a point 
which had seemed puzzling. The two occupants of the 
control room were thrown across it by the explosion and 
experienced a rush of cold air, not hot gas. The simulation 
showed that in the early stages of the explosion the control 
room wall would be subject to a positive overpressure and 
inrush of air, but that by the time the hot combustion pro¬ 
ducts approached the control room, the negative phase of 
the pressure pulse had set in, the velocity vectors had 
reversed and the direction of air flow was out of the control 
room into C Module. 

The two-stage nature of the leak also presented another 
point of difficulty. Isolation of A pump was by the closure of 
the GOVs on the suction and the delivery lines. The suction 
GOV was electrically isolated and it was uncertain whether 
power to it had been restored by the time of the initial 
explosion. In any event restoration of the valve would 
involve reconnecting a pneumatic line to the valve, which 
could quickly be done by an operator. It was concluded that 
this connection was made and that probably the operator 
gave it a tweak to make sure the valve movement was 
restored. This would have had the effect of admitting 
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Figure A19.5 The flammable gas cloud for a leak of 
100 kg/min in the BMT wind tunnel tests: LEL contours 
at 30 s (Cullen, 1990) 


condensate to the relief line to PSV 504, but not of filling it 
with condensate liquid, thus giving rise to the early, smal¬ 
ler leak. Subsequent opening of the valve and filling of the 
relief line with condensate liquid could then have caused 
the later, larger leak. 

Evidence was also heard on tests on leaks from blind 
flanges. The flange at PSV 504 was a ring-type joint 
(RTJ) flange. Three methods of tightening up were investi¬ 
gated: flogging up with a flogging spanner and hammer; 
hand tightening with a combination spanner and finger 
tightening. The results showed that a flange in good con¬ 
dition which had been flogged up or hand tightened did not 
leak. Even deterioration of the flange would he unlikely to 
give the leak sought unless the deterioration was gross. 
However, a finger-tightened flange could give a leak which 
was directionally downwards and was of the flow rate 
sought. 

The Inquiry concluded that the explosion had been 
caused by ignition of a gas cloud containing some 45 kg of 
hydrocarbon within the flammable range, arising from a 
two-stage leak, in the first stage perhaps some 4 kg/min 
and in the second stage some 110 kg/min lasting some 
30 s, coming from an orifice of equivalent diameter some 

There was no obvious explanation why the blind flange 
was not leak-tight. Much evidence was led to the effect that 
an experienced and competent fitter would not make up 
a blind flange which was not leak-tight. The Inquiry noted, 
however, that the decision not to proceed with the full 
24 month PM on A pump was taken just as shift handovers 
on the platform were starting so that some personnel may 
have been ignorant of this change in intent and that the 
lack of leak-tightness of the blind flange may have been 
connected with the status of A pump. 

The lead production operator had clearly had the inten¬ 
tion to start A pump. It was difficult to explain this given 
fact that its sole PSV was off. The Inquiry concluded that 
the lead operator was indeed ignorant of this, even though 
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Figure A19.6 Mass of fuel in the flammable range in the BMT wind tunnel tests: (a) variation with tir 
(b) variation with leak rate (Cullen, 1990) 
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this meant a serious breakdown of communications about 
the work. It implied that the fact that the PSV was off was 
not communicated in the handovers of the lead main¬ 
tenance hand, the phase 1 operator and the lead production 
operator and that the lead operator did not learn of it 
through the PTW system. 

When he found that he was unable to put the PSV back 
that evening, the Score supervisor came up to the control 
room to suspend the permit. He was on his first tour as a 
supervisor and had had no training in the operation of the 
PTW system in use on the platform. Whom he spoke to and 
what transactions took place were obscure. It was unclear 
how he knew that the procedure in filling out the permit for 
suspension was to write ‘SUSP’ in the gas test column. 

In any event the Score supervisor did not make a final 
inspection of the job site before going off work and evi¬ 
dently the lead production operator did not inspect the job 
site either, although in both cases good practice required 
that this be done. 

Further, the leak would not have occurred if there had 
been a more positive isolation of the pump by means such 
as the use of a slip plate. 

The explanation just described is that adopted in the 
Piper Alpha Report but several other scenarios for the leak 
were also explored. One group of scenarios was concerned 
with explanations of the leak from the blind flange follow¬ 
ing admission of condensate into A pump other than lack 
of leak-tightness. They include the possibilities of auto¬ 
ignition, shock loading, low temperature brittle fracture, 
and overpressurization by methanol injection. All of these 
were quickly ruled out except auto-ignition by compression 
of a flammable mixture formed in the relief line. The line 
had been left open for an hour before the blind flange was 
put back on. It was not possible to calculate whether auto¬ 
ignition would have occurred due to lack of data on auto¬ 
ignition properties of the multi-component mixture at the 
high pressures involved, some 300 bar. Moreover, company 
documentation on the rating of the pipework was incon¬ 
sistent so that it was uncertain whether the flange was 
a 900 or 1500 lb one. The expert evidence was that if 
auto-ignition had occurred and the lower rating applied, 
a leak was possible, although whether it would have 
had the required characteristics was another matter. An 
account of this work on auto-ignition has been given by 
S.M. Richardson, Saville and Griffiths (1990). 

The scenario was considered that condensate liquid had 
backed up in the JT flash drum and thence into the reci¬ 
procating compressors. There was evidence that on loss of 
B pump steps had been taken to reduce the condensate 
make by unloading and recycling these compressors. The 
report concludes that there had been insufficient time for 
backup to occur before the initial explosion and that in 
addition both the conditions around the compressors and 
the expected action of protective instrumentation were 
against this scenario. 

A further scenario which emerged in the Inquiry was 
that the leak occurred from PSV 505 and that it was caused 
by hydrate blockage. The interruption to the methanol 
supply to the JT valve lent credibility to this scenario. 
Experimental work commissioned showed that hydrates 
would form under the conditions pertaining at the JT valve 
during the partial loss of methanol supply if the tempera¬ 
ture at the valve fell below a critical value; it had in fact 
been below this temperature on 5 July. The expert evidence 
was that hydrates could pass through to the condensate 


injection pumps and cause blockage there some 2 h after 
restitution of the full methanol supply. There were several 
versions of the scenario all leading to blockage of hydrate at 
PSV 505 and overrunning of the pump so that the delivery 
pressure rose to a value high enough to cause rupture of the 
valve, which was the weakest point in the line. The report 
does not rule out this scenario, but regards it as less likely 
than the preferred one. 

Finally, the consultants to the Inquiry reviewed a large 
number of other scenarios which were not purely theore¬ 
tical but had some link with the information available at the 
time, which included a hazop study, past equipment fail¬ 
ures and process conditions that evening. None was found 
convincing by the Inquiry. 

Turning to the escalation, the causes of the oil pool fire 
and the fireball which occurred in B Module within seconds 
of the explosion in C Module were unclear. The Inquiry 
heard evidence on the type, number, velocity and impact 
effects of the projectiles which would have resulted from 
the destruction of the B/C firewall. The condensate injec¬ 
tion line ran from C Module through into B Module where it 
joined the main oil line.The report concludes that probably 
the fireball was caused by a missile rupturing this line near 
the main oil pumps at the west face of B Module. 

Estimates of the size of the oil pool fire indicated that the 
supply of oil to the fire probably exceeded the oil inventory 
of the separators and that there was a leak of oil from the 
main oil line through the main oil line EVS which was not 
fully closed. This leak would be aggravated by continued 
pumping of oil by the other platforms. 

The fire water deluge system did not work. The initial 
explosion knocked out the main power supplies. It may also 
have damaged the water pumps and the water mains. In any 
event it was the practice on Piper to put the pumps on 
manual start when divers were in the water and thus in 
possible danger of being sucked into the pump intakes and 
they were on manual start that evening. The start controls 
were at the pumps themselves. After the explosion occur¬ 
red an attempt was made to get through to the pumps to 
start them by personnel wearing breathing apparatus, but 
to no avail. Further evidence was given of quite extensive 
blockage caused by corrosion products in the fire water 
deluge system, which operated on sea water, a problem 
which had persisted for some years. 

The initial explosion caused the operation of the plat¬ 
form ESD. This could have occurred through loss of the 
main power supply and/or rupture of a pneumatic ring 
main. Also, although dazed by the explosion the control 
room operator pressed the platform ESD button. He did 
not, however, press the buttons to close the ESVs on the 
three gas pipelines. Evidently, these did close but then- 
closure was due rather to the effects of the initial explosion 
on power supplies to the valves. 

Following the initial explosion a period of extended 
flaring occurred which greatly exceeded that to be expec¬ 
ted from the flaring of the gas inventory on the platform. 
The report accepted that the most probable explanation 
was a failure of the Claymore ESV to close fully. 

The main communications for the Piper field were 
centred on Piper. The system was knocked out by the initial 
explosion, so that the other platforms were unable to com¬ 
municate with Piper and had difficulty communicating 
with the shore. 

The report details a number of management weaknesses. 
There were severe and numerous defects in the PTW 
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system. For example, it violated more than half of the main 
points in the code of practice on PTWs issued by the Oil 
Industry Advisory Committee (OIAC). The system was 
operated rather casually. The training of the specialist 
contractors supervisor in the permit system operated on 
the platform was found to be inadequate. 

With regard to handovers, the company had been pro¬ 
secuted only a year before for a fatality and had pleaded 
guilty. The report takes the view that a failure in handover 
procedures was a factor in that accident. 

A number of different types of audit were performed by 
the company, by its partners, by loss prevention specialists 
and so on. None of these had revealed the defects in the 
PTW which became apparent very quickly at the Inquiry. 

The report is critical of the handling of the emergency by 
the senior management on the platform and in particular of 
the failure to recognize that helicopter evacuation was not 
possible and to take command of the situation and organize 
escape from the ERQ. 

The decision to keep the platform operating despite the 
large workload is another matter of which the report is 
critical. 

The report states that the company had no system to 
ensure that all projects were subject to formal safety 
assessment. Certain techniques such as hazop were used on 
some projects and quantitative estimates had been made in 
some studies, but the approach was unsystematic. The 
report takes the view that as a consequence the hazards 
presented by the hydrocarbon inventory on the platform 
and particularly in the pipelines had not been system¬ 
atically addressed. 

Part 2 of the Inquiry was concerned with the future off¬ 
shore safety regime. The context was not only the Piper 
Alpha disaster but also the changes taking place in the 
North Sea oil province. The exploitable oil and gas fields 
were becoming smaller and the technology to develop them 
was becoming more varied. 

The evidence in Part 1 revealed serious weaknesses in 
the company management. It was an issue why the DoEn 
had not discovered these weaknesses. The report is critical 
of the relative lack of emphasis placed by the Department on 
the assessment of management and management systems. 

In contrast to the British onshore and Norwegian off¬ 
shore regimes, which had both moved increasingly towards 
goal-setting regulations, the British offshore regime relied 
excessively on prescriptive regulations, and associated 
guidance. 

The deficiencies of such a regime were illustrated in the 
regulations concerning fire protection, which had a num¬ 
ber of defects. Passive and active fire protection were cov¬ 
ered by two separate sets of regulations. The regulations, 
and associated guidance, for active fire protection led in 
practice to systems based on delivery of a uniform quantity 
of water over large areas of a platform, deluge systems 
prone to blockage and massive water pumps. Fire protec¬ 
tion was not integrated with explosion protection. 

The report states that the approach taken by the DoEn 
to the control of the major hazards from hydrocarbons at 
high pressure did not impress as an effective one. Further, 
the inspectorate had relatively little expertise in this area. 

Following the Piper Alpha disaster the DoEn brought in 
regulations to require ESVs to be placed nearer to sea level 
and for the valves to be of full ESV standard. The report 
notes that of the 400 risers covered by the regulations, some 
70 required modification in the latter respect. 


The regime made little use of formal safety assessment 
(FSA). This was in contrast to the regulatory use of FSA 
onshore, and in particular the onshore safety case. The 
DoEn had in fact explicitly rejected the concept of an off¬ 
shore safety case. This policy also contrasted with the 
situation in the Norwegian sector, where a concept safety 
evaluation (CSE) was required. Quantitative risk assess¬ 
ment is required in a CSE and is often necessary to fulfil 
the requirements of a safety case. 

Considerable evidence was heard on quantitative risk 
assessment (QRA). The burden of this evidence was that 
QRA is in regular use in many companies as an aid to 
decision-making both for onshore and offshore installa¬ 
tions and that there was no serious impediment to this from 
any problems of overall methodology, frequency estima¬ 
tion, consequence modelling or risk criteria. 

In contrast to the HSE, the DoEn was not well equipped 
to operate a regime based on goal-setting regulations and 
FSA. It had no experts in FSA or fire protection. 

A number of recommendations which would have met 
some of the points on which the DoEn was criticized had 
been made in the Burgoyne Report (Burgoyne, 1980), but 
had not been implemented. 

A19.7 Some Lessons of Piper Alpha 

A19.7.1 Some lessons 

Lessons from the Piper Alpha disaster are considered in 
this section with the exception of the recommendations of 
the report on the offshore safety regime which are con¬ 
sidered in Section A19.8. A list of some of the lessons is 
given in Table A19.2. Many apply particularly to offshore 
installations, but others are of more general applicability. 

Regulatory control of offshore installations 
The Piper Alpha disaster exposed weaknesses in the off¬ 
shore regulatory regime which have already been described. 
The lessons drawn are seen in the recommendations given in 
Section A19.8. 

Quality of safety management 

The Piper Alpha Report is critical of the quality of manage¬ 
ment, and particularly safety management, in the company. 

It was not that the company did not put effort into safety 
On the contrary, there were numerous meetings and much 
training on safety. The problem was the quality of these 
activities. 

Many managers had come up through the ranks and had 
minimal qualifications. The culture tended to be somewhat 
in-grown and insufficiently self-critical. 

These defects manifested themselves in various ways 
such as in the toleration of poor practices in plant isolation 
and operation of the PTW system; in the failure to appreci¬ 
ate the ineffectiveness of the audits done; in the failure to 
address the major hazard problem and to use FSA. The 
report comments: 

Senior management were too easily satisfied that the 
PTW system was being operated correctly, relying on the 
absence of any feedback of problems as indicating that all 
was well. They failed to provide the training necessary to 
ensure that an effective PTW system was operated in 
practice. In the face of a known problem with the deluge 
system they did not personally become involved in prob¬ 
ing the extent of the problem and what should be done to 
resolve it as soon as possible. They adopted a superficial 
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Table A19.2 Some lessons of Piper Alpha 


Regulatory control of offshore installations 
Quality of safety management 
Safety management system 
Documentation of plant 
Fallback states in plant operation 
Permit-to-work systems 
Isolation of plant for maintenance 
Training of contractors personnel 
Disabling of protective equipment by explosion itself 
Offshore installations: control of pressure systems for 
hydrocarbons at high pressure 
Offshore installations: limitation of inventory on 
installation and in its pipelines 
Offshore installations: emergency shut-down system 
Offshore installations: fire and explosion protection 
Offshore installations: temporary safe refuge 
Offshore installations: limitation of exposure of 
personnel 

Offshore installations: formal safety assessment 
Offshore installations: safety case 
Offshore installations: use of wind tunnel tests and 
explosion simulations in design 
The explosion and fire phenomena 
Explosions in semi-confined modules 
Pool fires 
Jet flames 

Publication of reports of accident investigations 


response when issues of safety were raised by others,... 
They failed to ensure that emergency training was being 
provided as they intended. Platform personnel and man¬ 
agement were not prepared for a major emergency as they 
should have been, (para 14.52) 

A crucial weakness was failure to appreciate that 
absence of feedback to management about problems is 
almost certainly an indicator not that there are no problems 
but that there are, and they could be serious. Of one OIM the 
report states: ‘His approach seemed to be, in his own words, 
“surely that is all you are concerned with about the permit 
system... If the system is working and no problems are 
identified... then you should be reasonably happy with 
it, surely?”... He had been surprised by the number of 
deficiencies in the operation of the permit system which 
had been revealed in the Inquiry. He had checked this out 
and found it to be true.’ Of another manager it states that he 
said ‘he knew that the system was monitored on a daily 
basis by safety personnel. By the lack of feedback he “knew 
that things were going all right and there was no indication 
that we had any significant permit to work problems”.’ 
(para 14.26) 

Safety management system 

Onshore the quality of the management and the manage¬ 
ment system are of prime concern to the HSE in its inspec¬ 
tions in general and in the safety case in particular. In 
submitting a safety case a company will often give exten¬ 
sive documentation on its systems. Nevertheless, in the 
regulations the formal requirements on management are 
fairly minimal. 

The Inquiry heard evidence in favour of the assurance of 
safety through the use of quality assurance to standards 


such as BS 5750 and ISO 9000. It also heard evidence on the 
need for better qualified management, including a pro¬ 
posed requirement for all OIMs to be graduates. 

The concept of a safety management system goes part 
way towards these insofar as the system itself is based on 
principles similar to those of quality assurance and covers 
the question of management quality. 

Documentation of plant 

The discrepancies in the documentation concerning the 
rating of the flange on PSV 504 have already been men¬ 
tioned. The Inquiry in fact heard of a number of other 
defects in the documentation of the plant. Failure to main¬ 
tain correct records can have serious consequences. 

Fallback states in plant operation 

The loss of the working condensate pump on Piper created 
a situation where operating personnel were under some 
pressure to start the other pump and avoid a gas plant shut¬ 
down with its possible escalation to a total shut-down, loss 
of power and the need for a ‘black start’. In this case the 
pressure was created partly by the view which an indivi¬ 
dual took of the probability that the changeover of the main 
generators from gas to diesel would fail. This illustrates the 
desirability of ensuring that plants have fallback states 
short of total shut-down. In this case the problem was in the 
reliability of changeover, a type of problem which may lie 
with design or with maintenance. 

Permit-to-work systems 

The defects in the PTW system have already been descri¬ 
bed. These defects led directly to a situation where con¬ 
densate was admitted to a pump from which the PSV had 
been removed and hence to the disaster. The Piper Alpha 
Report devotes considerable attention to the need for an 
effective system. 

Isolation of plant for maintenance 
The Piper Alpha Report states that the disaster would not 
have occurred if A pump had been positively isolated so 
that condensate could not be admitted. Positive isolation is 
not achieved by shutting a valve but requires means such as 
insertion of a slip plate or removal of a pipe section. 

Training of contractors' personnel 
The proportion of contractors’ personnel on an offshore 
installation can be as high as 70%. The offshore scene 
therefore exemplifies in extreme form a problem which 
applies to onshore plants also. This is the need to train 
contractors’ personnel in the company’s operating and 
emergency systems and procedures. Failure to train a con¬ 
tractor’s supervisor in the operation of the PTW system on 
Piper meant that he was unfamiliar with a feature of the 
system which turned out to be a critical one. 

Disabling of protective equipment by explosion itself 
The initial explosion on Piper disabled large parts of the 
protective systems, including power supplies and fire 
water supplies. It illustrates the importance of taking this 
factor into account in design and in FSA. 

Offshore installations: control of pressure systems for 
hydrocarbons at high pressure 

An offshore production platform contains a large amount of 
plant containing hydrocarbons at high pressure. The feed 
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to this plant is from the wells, which can sometimes behave 
in an unpredictable way. The pipelines connected to the 
platform contain large quantities of hydrocarbon, the high 
pressure gas pipelines constituting a particularly serious 
hazard. 

There needs therefore to be a comprehensive system for 
the control of the total pressure system, covering design, 
fabrication, installation, operation, inspection, main¬ 
tenance and modification and including control of such 
features as materials of construction, lifting of loads and so 
on and personnel need to be trained in the purposes and 
operation of system. 

Offshore installations: limitation of inventory on 
installation and in its pipelines 

The scale of the Piper disaster was due primarily to the 
large inventory of the three high pressure gas pipelines 
connected to the platform. The Inquiry heard evidence on 
the practicalities of reducing the number of gas pipelines 
connected to a platform. There are many technical pro¬ 
blems involved, but the point has been made that such 
reduction should be a design objective. 

The main inventory of hydrocarbons in process on a plat¬ 
form is in the separators. The massive oil pool fire on Piper 
was fed from the separators. The Piper Alpha Report recom¬ 
mends that methods of dumping this inventory be explored. 

Evidence was also heard that in some cases the main 
inventory of hydrocarbons on a platform might be the 
diesel fuel. 

The alternative method of preventing the hydrocarbon 
inventory from feeding a fire is emergency isolation, which 
is considered next. 

Offshore installations: emergency shut-down system 
The ESD system on Piper operated, shut-down ESVs and 
blew the gas inventory on the platform down to flare. 

Nevertheless, the accident drew attention to a number of 
problems in effecting isolation, some specific to offshore 
platforms and some more generally applicable. 

The Tartan riser ruptured on the outboard side of the 
ESV so that closure of this valve was of no avail. It is clear 
that an ESV needs to be located as close to the sea level as 
practical in order to minimize this risk. 

It is possible to go one step further and install a subsea 
isolation valve, but this is for consideration on a case-by¬ 
case basis. 

Both types of isolation valve received considerable 
attention in the Inquiry. However, neither will be effective 
unless it achieves tight shut-off. The evidence that the main 
oil line and the Claymore gas line ESVs did not shut-off 
tightly emphasizes the importance of this feature. 

Moreover, in order to be effective the ESD system has to 
be activated. The fact that on Piper closure of the three gas 
line ESVs was not part of the platform ESD but had to be 
effected for each line separately by manual pushbutton, 
that these buttons were not pushed and that closure only 
occurred due to loss of power shows that this problem also 
is not a trivial one. 

Offshore installations: fire and explosion protection 
An offshore installation is not in general able to call on 
outside assistance comparable with that available from the 
fire brigade to an onshore plant. It must be self-reliant. 

This implies that both protection against, and mitigation 
of, fire and explosion on the one hand and fire fighting on 


the other are of particular importance and that both the 
hazard assessment and the design and operation of the 
plant must be of high quality. 

Offshore installations: temporary safe refuge 
It is clear from the Piper disaster that there needs to 
be a temporary safe refuge (TSR) where personnel can 
shelter in an emergency and where the emergency can be 
controlled and evacuation organized. 

This TSR will normally be the accommodation. In most 
cases it will be on the production platform itself, but it may 
be on a separate accommodation platform. 

The protection of the TSR from ingress of smoke and 
fumes from outside and from generation of fumes by fires 
playing on the outside needs careful attention. Measures 
require to be taken to prevent smoke ingress through doors 
and through the ventilation system. 

Offshore installations: limitation of exposure of personnel 
The concept of a TSR is a particular application of the more 
general principle of limitation of exposure of personnel. 
The Inquiry also heard evidence of the application of the 
principle to other aspects such as the location of workshops. 

Offshore installations: formal safety assessment 
The evidence showed that many companies which operate 
installations onshore and offshore have formal systems for 
safety assessment and practise FSA routinely, that FSA 
has considerable benefits in the design and operation of 
plant and that it provides a suitable basis for dialogue 
between the company and the regulatory body. 

Offshore installations: safety case 
A safety case is a particular form of FSA. The evidence 
indicated that a safety case is as applicable offshore as 
onshore and that it is a suitable means for the company to 
demonstrate to the regulatory body that it has identified 
the major hazards of its installation and has them under 
control. 

Offshore installations: use of wind tunnel tests and 
explosion simulations in design 

Wind tunnel tests and explosion simulations were used in 
the Inquiry to investigate the cause of the explosion, but 
evidence was also heard of their value in platform design. 

Wind tunnels may be used to assess the effectiveness of 
ventilation and of the gas detection system in a module, the 
wind conditions at the helideck and the movement of smoke 
from oil pool fires. Explosion simulations may be used to 
investigate the effect of different module layouts on explosion 
overpressures and to assess the effectiveness of blast walls. 

The explosion and fire phenomena 
The Piper disaster drew attention to several important 
aspects of explosion and fire on offshore installations. 
These include explosions in semi-confined modules, oil 
pool fires and jet flames. 

Explosions in semi-confined and congested modules are a 
hazard which assumes particular significance offshore. 
Although major progress has been made in the last decade 
in simulating such explosions and developing design 
methods, this remains an area where further work is needed. 

Oil pool fires onshore are relatively well understood, but 
this does not apply to the behaviour of such a pool fire on 
an offshore platform. Aspects of some importance are 
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design to prevent accumulation of an oil pool in the first 
place and the massive smoke plume from such a fire. 

Jet flames, including jet flames from risers, are particu¬ 
larly important for offshore platforms. In this case there are 
available a number of models developed for flares and 
flames on onshore plant, including pipelines, which can be 
applied offshore. 

Evidence given indicated that in considering the hazard 
of a jet flame from a riser, the worst case was not necessa¬ 
rily a full bore rupture but a partial rupture, since the latter 
is sustained for a longer period. 

Publication of reports in accident investigation 
The Inquiry heard that the company had a policy of 
severely restricting circulation of accident investigation 
reports. 

Likewise, the DoEn did not make public reports on major 
offshore accidents. This contrasts markedly with the HSE 
policy of issuing reports on major accidents, many of which 
are referred to in this book. 

A19.7.2 An accident model 

The following outline of a model of the accident highlights 
the role played by some of the features just mentioned: 



Deficencies in 

Initial event: 
gas explosion 

Operational control 

Escalation 1: 

Hazard identification, 

explosion damage 

assessment and management 
Explosion mitigation 

Escalation 2: 

Hazard identification, 

oil pool fire 

assessment and management 
Fire mitigation and fire fighting 
Inter-platform emergency 
planning 

Escalation 3: 

Hazard identification, 

riser rupture 

assessment and management 
Fire protection of risers 

Escalation!: 

Hazard identification, 

accommodation 

assessment and management 

failure 

TSR fire and smoke protection 
Emergency command 
and control 


A19.8 Recommendations on the Offshore 
Safety Regime 

The Piper Alpha Report makes recommendations for 
fundamental changes in the offshore safety regime. 

The basis of the recommendations is that the responsi¬ 
bility for safety should lie with the operator of the installa¬ 
tion and that nothing in the regime should detract from this. 

The offshore regime envisaged in the recommendations is 
one in which the emphasis is on the operator demonstrating 
to the regulatory authority the safe design and operation of 
its installation rather than demonstrating mere compliance 
with regulations. In this regime the preferred form of reg¬ 
ulations is goal-setting rather than prescriptive. 


Table A19.3 Some elements of the safety 
management system 

Organizational structure 
Management personnel standards 
Training, for operations and emergencies 
Safety assessment 
Design procedures 

Procedures, for operations, maintenance, modifications 
and emergencies 

Management of safety by contractors in respect 
of their work 

Involvement of the workforce (operator’s and contractors’) 
in safety 

Accident and incident reporting, investigation 
and follow-up 

Monitoring and auditing of the operation of the system 
Systematic re-appraisal of the system in the light of 
experience of the operator and industry 


The recommendations envisage that FSA will play a 
major role. It may be used to demonstrate compliance with a 
goal-setting regulation or with the general requirements of 
the HSWA. 

A central feature of the regime proposed is the safety 
case for the installation. This safety case is broadly similar 
to that required for onshore installations but there are some 
important differences. In the offshore safety case it is 
required that the operator should demonstrate that the 
installation has a TSR in which the personnel on the 
installation may shelter while the emergency is brought 
under control and evacuation organized. 

Further, it is recommended that this demonstration 
should be by QRA. This means that there must be criteria 
which define the failure of the TSR and criteria for its 
endurance time and its failure frequency. The criteria 
may then be met by reducing the frequency of accidental 
events, by increasing the durability of the TSR or by some 
combination of these. 

The recommendation on the safety case includes a 
requirement that the operator should demonstrate that it 
has a safety management system (SMS) to ensure the safe 
design and operation of the installation. This SMS should 
draw on quality assurance principles similar to those of BS 
5750 and ISO 9000. The elements of the SMS should include 
those listed in Table A19.3. They include management 
personnel standards. 

Various measures related to hardware were urged at the 
Inquiry. These included the provision of separate accom¬ 
modation platforms, the installation of subsea isolation 
valves and blast walls, the use of freefall lifeboats and 
purpose-built standby vessels. The report takes the view, 
however, that in accordance with its basic philosophy such 
matters should be dealt with as part of the demonstration of 
safe design and operation. 

The report considers that the then current regulatory 
body, the DoEn, is unsuitable as the body to be charged 
with implementing the new regime and recommends the 
transfer of responsibility for offshore safety to the HSE. 

These recommendations were accepted immediately by 
the government and the new regime under the HSE began 
in April 1991. 
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APPENDIX 20/2 NUCLEAR ENERGY 


The energy industries in general have much in common 
with the process industries in terms of the management, 
the plant and the hazards. This is true even of the nuclear 
industry, although this also has a number of unique 
features. Historically, the nuclear industry has often had to 
face particular problems before they have impinged on the 
process industries and has had to devise solutions for them. 
In consequence, there are a number of areas where work in 
the nuclear industry is relevant to the process industries. 

In this appendix a general account is given of nuclear 
energy, essentially with reference to those features which 
are common to, or have impact on, the process industries. 
Accounts of the accidents at Three Mile Island and at 
Chernobyl and of the Rasmussen Report are given in 
Appendices 21, 22 and 23, spectively. 

Some topics common to both industries have been dealt 
with already in other chapters. The account of major hazard 
control in Chapter 4 covers nuclear hazards. The treatment 
of management and management systems in Chapter 6 is 
applicable to nuclear as well as process systems. 

General information on nuclear phenomena and on 
radioactivity is given in Source Book on Atomic Energy 
by Glasstone (1968), The Effects of Nuclear Weapons by 
Glasstone and Dolan (1979), Nuclear Energy Technology by 
Knief (1981) and A Dictionary of Nuclear Power and Waste 
Management by Foo-Sun Lau (1987). 

Frequent reference is made in this appendix to two 
reports issued following the accident at Three Mile Island. 
These are The Report of the Presidents Commission on the 
Accident at Three Mile Island (the Kemeny Report) (Kemeny, 
1979) and TMI-2 Lessons Learned Task Force Final Report 
{the Task Force Report) (NRC, 1979d). 

Selected references on the nuclear industry are given in 
Table A20.1. 


Table A20.1 Selected references on nuclear energy. 
See also Appendix 28, Section B (Nuclear Regulatory 
Commission) 


Nuclear energy and technology 

ASME (Appendix 28 Nuclear Safety)-, HSE (Appendix 28 
Nuclear Installations, 1979 HA 4); AIChE (1954-67/ 
101-118,1972/119); McCullough (1957); J.H. Bowen and 
Masters (1959); Kopelman (1959);Tipton (1960); El-Wakil 
(1962); Fozard (1963); Gill (1964); T. Thompson and 
Beckerley (1964); Lamarsh (1965); Zudans,Yen and 
Steigelman (1965); Shaw (1967); Glasstone (1968); 

F. R. Farmer (1969a); Glasstone and Sesonske (1969); ENEA 
(1970); Ramey (1970); Wechsler (1970); Berry (1971); CEGB 
(1971); T.J. Thompson (1971); A.E. Green and Bourne (1972); 

R. V. Moore (1972); Holdren and Herrera (1973); Jaeger (1973, 
1975); Inglis (1973); ACRS (1974); Allardice and Trapnell 
(1974); Bupp and Derian (1974); Cochran (1974); Willrich and 
Taylor (1974); Flood (1976); Haferle etal. (1976); S.E. Hunt 
(1976); RCEP (1976 Rep. 6); ASTM (1977 STP 616); 

S. Fawcett (1977); IMechE (1977/38,1982/64,1984/82, 
1988/99,1992/143); Pocock (1977); Pedersen (1978); 
Duderstadt (1979); J. Hill (1979a); Kaplan (1979); Cottrell 
(1981); Knief (1981); IBC (1982/24); IAEA (1983); 

W Marshall (1984); Rahn etal. (1984); Stahlkopf and Steele 
(1984); Bennett (1985); Wilkie and Berkovitch (1985); 
Wilkie (1986); Kletz (1986e, 1987g, 1991c); Inhaber (1987); 
UKAEA (1987); Varey (1987); Bindon (1988); Lewins (1988); 

G. Lewis (1988); VC. Marshall (1988b); Gittus (1988); 


Bennett and Thomson (1989); NFPA (1991NFPA 801,1993 
NFPA 803); Nowlen (1992); Hicks (1993) ANSI N series 
Inherently safer design 
Kletz (1988h); Forsberg et al. (1989) 

Sizewell B 

CEGB (1982); HSE (Appendix 28 Nuclear Installations, 
SizeweUB, 1982 HA 3,1982b,c, 1983a); NRPB (1982 R137, 
R142, R145, R146,1983 R160, R163); NRC (1983 NUREG- 
0999); (IMechE (1989/113,1994/173); 

Software reliability: CEC (1987 EUR 11147 EN); Hunns and 
Wainwright (1991) 

Nuclear waste, fuel reprocessing 

I. K.G. Williams (1979); Bennett (1981); R. Smith and Hartley 
(1982); J.A Williams (1982); Bennett (1985); IBC (1985/64, 
1986/70,1987/73); Heafield (1986); N.J. James, Rutherford 
and Sheppard (1986); Elliot and King (1987); N. James, 
Sheppard and Williams (1987) 

Radioactivity and radioactive contamination 

NRPB (Appendix 28); Moelwyn-Hughes (1961); WJ. Moore 
(1962); Yen Wang (1969); Coggle and Noakes (1972); 
McDonald, Darley and Clarke (1973); Sternglass (1973); 
AEC (1975); Brodine (1975); MRC (1975b); G.N. Kelly, Jones 
and Hunt (197 /! ;er and Schultz 

(1982); Foo-Sun Lau (1987); NRPB (1989,1993) BS 
(Appendix 27 Radioactivity) 

Nuclear hazard assessment and control 

HSE (Appendix 28 Nuclear Installations, 1977c, 1979d,f, 
1979 HA 5,1983/8,1992/16); AEC (1957,1975); Sinclair 
(1963); F.R. Farmer (1967a,b, 1969a,b, 1970,1971); 
Bourgeois (1971); Dale and Harrison (1971); F.R. Farmer and 
Gilby (1971); Hanauer and Morris (1971); Kirk and Taylor 
(1971); Ybarrando, Solbrig and Isbin (AIChE 1972/119); 
Hosemann, Schikarski and Wild (1973); EPA (1974); Karam 
and Morgan (1974); N.C. Rasmussen (1974,1981); 

Chicken (1975,1982,1986); Bridenhaugh, Hubbard and 
Minor (1976); Flood (1976); Freudenthal (1976); Rust and 
Weaver (1976); Ford (1977); Fussell and Burdick (1977); 
Comey (1977); HM Chief Inspector of Nuclear Installations 
(1977); G.N. Kelly, Jones and Hunt (1977); NRC (1977a-c); 
UCS (1977); Higson (1978); R.J. Parker (1978); E.E. Lewis 
(1979); Windscale Local Liaison Comm. (1979); Alvares 
and Hasegawa (1979/80); Joksimovic and Vesely (1980); 
Strong and Menzies (1980); Charlesworth, Gronow and 
Kenny (1981); Fleming et al. (1981); Sagan (1981); Allan, 
Adraktas and Campbell (1982); NRC (1982); Openshaw 
(1982); I.B.Wall (1982); Amendola (1983a,b); 

D.E. Bennett (1983); Fremlin (1983); Heudorfer and 
Hartwig (1983); Brooks (1984); CEC (1985/2); Lois and 
Modares (1985); Frank and Moieni (1986); C.D. Henry and 
Brauer (1986); Ronen (1986); Anon. (1987p); Ashworth 
and Western (1987); Durant and Perkins (1987); Gittus 
(1987); Mullins and Clough (1990 SRD R509); J. Singh, 
Cave and McBride (1990); Ang (1992); IAEA (1992); 

Wu and Apostolakis (1992); Hoffmeister (1993); 

J. R. Thomson (1994) 

NRC studies 

NRC (Appendix 28, Loss of Coolant Accident, Loss of Fluid 
Test, Operational Safely Reliability Program, Reactor Safety 
Study, Safety Assessment, Safety Goals, Severe Accident Risk 
Reduction Program) 

Benchmark studiesTUV (1979); NEA (1984) 
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Detailed studies 

Coxon (1971); Kazarians and Apostolakis (1978); 
Apostolakis and Mosleh (1979); Rasmuson, Wilson and 
Burdick (1979); Apostolakis and Kazarians (1980); 

Aupied, Le Coguiec and Procaccia (1983); M.G.R. Evans 
and Parry (1983); Hendrickx and Lannoy (1983); 

Coudray and Mattel (1984); NRC Steam Explosion Rev. 

Gp (1985); Bley and Reuland (1987); Ashurst and Davidson 
(1993IPB112) 

Emergency planning 

Eppler (1970); HSE (1982/5,1986b, 1991/15) 

Incidents 

Chamberlain (1959); Anon. (1962c); Norman (1975); Anon. 
(1976g); HM Chief Inspector of Nuclear Installations (1977); 
VC. Marshall (1979c); Bertini etal. (1980); Curtis, Hogan 
and Horowitz (1980); J.G. Fuller (1984); May (1989); Mosey 
(1990); Ashurst and Davidson (1993 LPB112); Anon. (1994 
LPB119, p. 13) 

Windscale 

Atom. Energy Office (1957); Fleck (1958); Fremlin (1978); 
R.J. Parker (1978); HSE (1981/4,1986/9); NRPB (1981R133, 
1982 R135); May (1989); Arnold (1992) 

Browns Ferry 

AEC (1975); Ford, Kendall and Tye (1976); NRC (1976); 
Anon. (1982 LPB 47, p. 13); May (1989) 

Severe accident risks 

Pickard, Lowe and Garrick (1983); NRC (1987a,b, 1989); 
Wheeler et al. (1989) 

Precursor events 

Minarick and Kukielka (1982); Cottrell etal. (1984); 
Minarick etal. (1985) 


A20.1 Radioactivity 

Accounts of radioactivity and of ionizing radiations are 
given by Glasstone (1968), Glasstone and Dolan (1979), 
Knief (1981), Foo-Sun Lau (1987) and in many texts on 
physical chemistry such as Moelwyn-Hughes (1961) and 
WJ. Moore (1963). 

Units of radioactivity are defined in Worley and Lewins 
(1988) (the First Watt Committee Report), based on Foo- 
Sung Lau (1987). 


A20.1.1 Types of radiation 

There are three main types of radioactive particle or ray: 
(1) a-particles, (2) /l -rays or particles and (3) y- and X-rays. 

a-particles are helium nuclei, or protons. Their mass is 
relatively large and their range correspondingly short. An 
air gap of about 8 cm or a sheet of paper may suffice to stop 
them. Generally, they present little external radiation 
hazard, but they are dangerous if they get inside the body. 

/1-rays, or particles, are electrons. They have a much 
smaller mass and greater penetrating power. Their range 
in air is about 10 m, but they are usually stopped by a few 
millimetres of solid material. 

y- and X-rays are electromagnetic radiations, or photons, 
which differ from each other only in respect of source and 
wavelength. They have a range of several hundred metres, 
but can be stopped by a few millimetres of lead or 0.5-1 m 
of concrete. 


Both /1-rays and y- and X-rays constitute an external 
radiation hazard. 

Ionizing radiation may be classified as direct or indirect. 
The former consists of particles and thus includes a-parti- 
cles (protons) and /1-particles (negatively charged electrons) 
and positrons (positively charged electrons), while the latter 
includes y- and X-rays (both photons) and also neutrons. 

A20.1.2 Units of radiation 

The units of activity of a radioactive source are bequerels 
(Bq) and curies (Ci) 

1 Bq = 1 disintegration/s 
1 Ci = 3.7 x 10 10 Bq 

Another unit of source strength is the roentgen (R), 
which defines the ionization effect of y- and X-rays. 

1 R produces in 1cm 3 air ions carrying a charge of 1 
electrostatic unit (esu) 

For y- and X-ray radiation 1R is equivalent to the absorp¬ 
tion of 87 erg/g of air. However, for other types of radiation 
and targets the equivalences are significantly different. 

Units of absorbed dose are rads and grays (Gy), the latter 
being the modern unit. 

1 rad = 100 erg/g = 0.01 J/kg 
1 Gy = 1 J/kg = 100 rad 

The effect on man of a given absorbed dose D is a func¬ 
tion of the type of radiation, for which a quality factor Q is 
defined. The value of Q is unity for y- and X-rays and elec¬ 
trons, but has other values for other types of radiation. The 
value of Q for a-particles is 20. The quality factor is also 
referred to as the relative biological effectiveness (RBE). 

The dose equivalent H is the product of the absorbed 
dose and the quality factor: 

H = DxQ [A20.1.1] 

Units of effective dose, or dose equivalent, are rems and 
sieverts (Sv), the latter being the modern unit 

1 rem = 1 rad x Q 
1 Sv = 1 Gy x Q 
1 Sv = 100 rem 

Thus the roentgen is the unit of total dose, the rad or 
gray that of absorbed dose and the rem or sievert that of 
effective dose. 

In the context of discussion of biological effects effective 
dose is frequently referred to simply as dose. 

A20.1.3 Radioactive decay 

Specific Activity and Half Life 

The basic equation for radioactive decay is 

= [A20.1.2] 

where n is the number of radioactive atoms, t time 
and X the radioactive decay constant (s _1 ). Then from 
Equation A20.1.2 

~ = exp(-A t) [A20.1.3] 
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where n 0 is the number of radioactive atoms at arbitrary 
time zero. The half-life x is defined by the relations 


^ = \ = exp(-Ar) 

[A20.1.4] 

xm\n2/X = 0.693/H 

[A20.1.5] 

But 


no = IVo/Afa 

[A20.1.6] 

where M a is the atomic weight and N 
stant ( = 6.024 xlO 23 ). Then from 
A20.1.3 and A20.1.6 at arbitrary time t 

0 is Avogadro’s con- 
Equations A20.1.2, 
= 0 (« = «o) 

d n No In 2 N 0 

df 'Af a x M a 

[A20.1.7] 


Energy release 

The release of energy during radioactive decay is governed 
by the relation of Einstein 


E = m<? [A20.1.8] 

where c is the velocity of light, E the energy release and m 
the mass. 

The energy may be calculated from the decay equation 
by determining the difference in mass of the two sides. An 
atomic mass unit (amu) is equivalent to 931 MeV. 

For example, for the decay of polonium 210 to lead 206 
and helium nucleus, or a-particle, the decay equation is 

84P0 210 —» 82Pb 206 + 2He 4 

and the atomic mass balance is 


LHS 

84Po 210 

Atomic mass 

210.049 

RHS 

82 Pb 206 

206.034 


2 He 4 

4.004 

Total RHS 


210.038 

Mass loss 


0.011 

Energy = 931 x 0.011 ■ 

= 10.2 MeV 



A20.1.4 Radioactivity health effects 

An account of health effects from radiation is given in 
Living with Radiation by the National Radiation Protection 
Board (NRPB) (1989). An account in the specific context of 
Chernobyl is given by the Watt Committee on Energy (1991). 

Potential health effects of radiation at relatively low 
doses are short term: (1) birth defects from radiation 
received by the foetus; (2) thyroid cancers from radioactive 
iodine; from 3 years onwards: (3) leukaemia; over a period 
5-40 years: (4) cancers; and over a generation: (5) genetic 
effects. 

Recommendations for radiation protection standards 
are given in Radiological Protection Bulletin 141 1993 by 
the NRPB (1993). Details are given in Chapter 25. 


A20.2 Nuclear Industry 

A20.2.1 Nuclear industry regulation 

Public control of the nuclear industry is discussed in 
Chapter 4. In the United Kingdom the regulatory body is 
the Nuclear Installations Inspectorate (Nil), which is part 
of the HSE. In the United States of America it changed in 
the mid-1970s from the Atomic Energy Commission (AEC) 
to the Nuclear Regulatory Commission (NRC). 

A20.2.2 Nuclear industry advisory committees 

In the United Kingdom there is a standing committee, the 
Advisory Committee on the Safety of Nuclear Installations 
(ACSNI) which advises on nuclear safety. In the United 
States of America there is an Advisory Committee on 
Reactor Safety (ACRS). 

Advice on radiological protection in the United Kingdom 
is the responsibility of the National Radiological Protection 
Board (NRPB). 

A20.2.3 International bodies 

Bodies operating at the international level include the 
International Atomic Energy Agency (IAEA) in Vienna and 
the International Committee on Radiological Protection 
(ICRP). The IAEA was set up in 1957 as an intergovern¬ 
mental organization linked to the UN. 

A20.2.4 Nuclear industry research 

Work for the nuclear industry is a main source of support 
for a number of major research laboratories and organiza¬ 
tions whose output is also of interest to the process indus¬ 
tries. In the United Kingdom these include the UK Atomic 
Energy Authority (UKAEA), which operates laboratories 
at Harwell. The Systems Reliability Directorate (SRD) is 
part of the UKAEA. 

In the United States of America major laboratories with a 
nuclear interest include the Argonne National Laboratory 
(ANL), Brookhaven National Laboratory (BNL), Electric 
Power Research Institute (EPRI), Lawrence Livermore 
National Laboratory (LLNL), Oak Ridge National Labo¬ 
ratory (ORNL) and Sandia Laboratories (SL). 

A20.2.5 Nuclear industry accidents 

Early perceptions of the hazard from the nuclear industry 
were coloured by the image of an explosion from a nuclear 
weapon. A major accident in the nuclear industry, a core 
meltdown, is quite different. There would not be the initial 
intense blast and radiation effects, but rather a dispersion 
of radioactive material at the site and from the site by the 
wind. Such an accident occurred at Chernobyl. 

A20.2.6 Nuclear industry debate 

Virtually from its inception the nuclear industry has been 
the subject of debate. Some principal critiques are Nuclear 
Power by Patterson (1976), Soft Energy Paths by Lovins 
(1977), The Risks of Nuclear Power Reactors by the Union of 
Concerned Scientists (UCS) (1977), Nuclear or Not? by Foley 
and van Buren (1978), Cover-up by Grossman (1980), The 
Fast Breeder Reactor by Sweet (1980), The PWR Decision by 
Cannell and Chudleigh (1984), Going Critical by Patterson 
(1985) and Nuclear Politics byT. Hall (1986). 

A20.3 Nuclear Reactors 

Accounts of nuclear reactor systems include Nuclear Reac¬ 
tor Control and Instrumentation by J.H. Bowen and Masters 
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(1959), Nuclear Reactor Engineering by Glasstone and 
Sesonke (1962), Nuclear Energy Technology by Knief (1981), 
Nuclear Power Technology by W. Marshall (1984), The 
Elements of Nuclear Power by D.J. Bennett and Thompson 
(1989) and The Technology of Nuclear Reactor Safety by 
T. Thompson and Beckerley (1989). 

Treatments by the HSE include PWR (HSE, 1979d), 
Safely Assessment Principles for Nuclear Reactors (HSE, 
1979f) and SizewellB (HSE, 1982b). 

A20.3.1 Nuclear reactor types 

Some principal types of nuclear reactor are 

(1) Gas-cooled reactors: 

(a) Magnox reactor; 

(b) Advanced gas-cooled reactor (AGR); 

(c) High temperature gas-cooled reactor (HTGR); 

(2) Light water reactors (LWRs): 

(a) Pressurized water reactor (PWR); 

(b) Boiling water reactor (BWR); 

(3) Heavy water reactors: 

(a) CANDU reactor; 

(b) Steam generating heavy water reactor (SGHWR); 

(4) Fast breeder reactors. 

Accounts of reactor types are given in Nuclear Power 
Reactors by the UKAEA (1987) and by Patterson (1976) and 
Lewins (1988). 

In the United Kingdom the first reactors were the gas- 
cooled Magnox reactors. The next generation were the 
AGRs reactors. The first pressurized water reactor came 
much later, at Sizewell B. 

Elsewhere, notably the United States of America and 
France, the vast majority of reactors installed have been 
PWRs. 

A20.3.2 Reactor design features 

In a nuclear reactor energy is released by a chain reaction 
involving neutrons. The reaction is sustained by those 
neutrons which are absorbed. Slower neutrons are 
absorbed in larger proportion than faster ones. Use is 
made, therefore, of a ‘moderator’ to slow down the neutrons. 
In some designs the moderator is graphite, for example, 
the Magnox reactor, while in others it is water, for example, 
the PWR. 

The power output of the reactor is controlled by move¬ 
ment of control rods, containing materials which are strong 
absorbers of neutrons, and the reactor is shut down by their 
full insertion. Emergency shut down, or scram, is effected 
by dropping in the rods. 

Even when shut down the reactor has a certain output 
of heat, due to radioactivity in the core. This decay heat 
needs to be removed if the core is not to overheat. The 
removal of the decay heat is one of the main problems which 
have to be handled in reactor design. 

The reactor core is cooled by a coolant which in the AGR 
is carbon dioxide and in the PWR is water. 

A20.3.3 Advanced gas-cooled reactors 

The underlying concept of the AGR is that if forced con¬ 
vection circulation of the gas coolant is lost, natural 
convection will still effect a degree of cooling. To this 
extent, the reactor is an application of inherently safer 
design. 


A20.3.4 Pressurized water reactors 

The majority of nuclear reactors installed world-wide are 
PWRs. In the PWR design the core is cooled by water which 
also doubles as the moderator. 

A PWR is provided with multiple systems to inject cool¬ 
ing water into the reactor to keep the core cool and with 
numerous protective systems to ensure the operation of 
this backup cooling. The reactor is vulnerable in the event 
of the failure of these instrument and cooling systems. 
On a PWR an emergency can escalate within a relatively 
short time scale. 

In a PWR the fuel is inside three sets of containment. The 
first is the fuel rods. The second is the reactor pressure 
vessel (RPV) in which the fuel rods are held. The third is the 
containment building which encloses the reactor vessel. 

The reactor is vulnerable to loss of coolant and much 
attention has been focused on the large loss of coolant 
(LOCA) accident. 

A20.3.5 Inherently safer design 

In view of the nature of the hazard from a nuclear reactor, 
there is interest in inherently safer design. Mention has 
already been made of the inherent safety aspects of 
the AGR. 

A review of approaches to inherently safer design of 
nuclear reactors is given in Proposed and Existing Passive 
and Safety-related Structures, Systems and Components 
(Building Blocks) for Advanced Light Water Reactors by 
Forsberg et al. (1989). 

Some examples are discussed by Kletz (1988h). The 
HTGR is a small reactor cooled by high pressure helium. 
The reactor is designed to withstand a high temperature 
and to have an adequate heat loss by radiation and natural 
convection if the coolant should fail. The Swedish process- 
inherent ultimate safety (PIUS) reactor is a water-cooled 
reactor immersed in boric acid solution, so that if the cool¬ 
ant pumps fail this solution is drawn through the core 
by natural convection. 

Another aspect of inherent safety is the reliability of 
the overall system for the control and protection of the 
reactor, which includes both the automatic control and 
protection and the process operator. As already mentioned, 
a PWR is vulnerable to equipment failure in the instru¬ 
ment and coolant systems which protect it. It is therefore 
vulnerable also to operator actions which render this 
protection ineffective. 

This feature is discussed by Franklin (1986) in these 
terms: 

When operators are subject to conditions of extreme 
emergency arising from a combination of unforeseen 
circumstances they will react in ways which lead to a high 
risk of promoting accidents rather than diminishing 
them. This is materially increased if operators are aware 
of the very small time margins that are available to them. 

A20.4 Nuclear System Reliability 

A20.4.1 Pressure systems 

The integrity of the pressure system is critical to the safety 
of a nuclear reactor such as the PWR. Much attention has 
been therefore focused on the potential for pressure vessel 
failure. 

Pressure vessel failure is considered in the Rasmussen 
Report. It is also discussed by Bridenbaugh, Hubbard and 
Minor (1976) and Cottrell (1977). 
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It was a principal issue at the Sizewell B inquiry, and an 
account is given in Appendix 26. 

The treatment given in Chapter 12 of failure rates of 
pressure vessels draws heavily on estimates made with 
nuclear applications in mind. 

A20.4.2 Protective systems 

From the start the nuclear industry made extensive use of 
instrumentation, and particularly of instrumented protec¬ 
tive systems. Accounts of this work are given in Reliability 
Assessment of Protective Systems for Nuclear Installations by 
Eames (1965 AHSB(S) R99) and Safety Assessment with 
Reference to Automatic Protective Systems for Nuclear Reac¬ 
tors by A.E. Green and Bourne (1966 AHSB(S) R136). 

This work led to interest in reliability technologies, 
including fault trees and dependent failure. Since it was 
necessary to have a target to aim for in design of such pro¬ 
tective systems, this also prompted the development of 
risk criteria. 

A20.4.3 Reliability engineering 

The nuclear industry joined the defence and aerospace 
industries in developing reliability techniques. A treatment 
of reliability engineering from the viewpoint of the nuclear 
industry and with special reference to protective systems, 
is Reliability Technology by A.E. Green and Bourne (1972). 

A20.4.4 Failure and event databases 

The practice of reliability engineering created the need for 
failure and event databases. This is illustrated by the 
development of the database of the UKAEA Systems 
Reliability Service (SRS) (Ablitt, 1973 SRS/GR/14). The 
development of this database is described in Appendix 14. 

A20.4.5 Fault trees 

The need to identify failure paths and to estimate failure 
frequencies for systems with multiple layers of protection 
has led in the nuclear industry to extensive use of fault 
tree analysis. It is the basic method used for frequency 
estimation in the Rasmussen Report. The technique is 
described in Reliability and Fault Tree Analysis by Barlow, 
Fussel and Singpurwalla (1975) and in Fault Tree Handbook 
by Vesely et al. (1981). 

Associated with this work are the fault tree analysis 
computer codes PREP and KITT (Vesely and Narum, 1970). 

A20.4.6 Event trees 

Likewise, the nuclear industry has made much use of event 
trees, both to identify and quantify the effects of certain 
failures, such as those of the power supply, and the out¬ 
comes of a release to atmosphere. 

A20.4.7 Dependent failures 

Nuclear reactors rely on extensive protective systems to 
give a very high degree of reliability, and it is characteristic 
of such systems that they are liable to be defeated by 
dependent failure. In some cases different assumptions 
about dependent failure can result in a dramatic increase 
in the estimated frequency of an accident. The nuclear 
industry has therefore put much effort into the study of 
this problem. 

The problem of dependent failure bulks large in the 
analyses in the Rasmussen Report and in the critiques of 
that report. 


An account is given in Defences against Common¬ 
mode Failures in Redundant Systems by Bourne et al. (1981 
SRDR196). 

A20.5 Nuclear Hazard Assessment 

A20.5.1 Probabilistic risk assessment 
The nuclear industry has for long made use of probabilistic 
risk assessment (PRA), or probabilistic safety assessment 
(PSA), as a means of ensuring that its hazards are identi¬ 
fied and under control and as a basis for dialogue on this 
with the regulatory authority. Guidance is given in PRA 
Procedures Guide by the NRC (1982). A more recent treat¬ 
ment is Procedures for Conducting Probabilistic Safety 
Assessment of Nuclear Power Plant by the IAEA (1992). 

The Rasmussen Report, described in Appendix 23, is one 
well known generic PRA. Another is the Deutsche Risikos- 
tudie Kernkraftwerke by the Technische Uberwachungs- 
verein (TUV) (1979). 

A20.5.2 Accident sequences and scenarios 

In a nuclear PRA considerable effort is devoted to the 
treatment of the accident sequences, or scenarios. 

Thus a large proportion of the IAEA document just 
referred to is devoted to procedures for the identification of 
accident initiators and of accident sequences, for the clas¬ 
sification of accident sequences into plant damage states 
and for the determination of the frequency of the accident 
sequences. 

A20.5.3 Rare events 

There are a number of natural and man-made threats which 
may hazard a nuclear plant. Examples of these two types of 
event are, respectively, an earthquake and an aircraft 
crash. Such events, their consequences and frequency, have 
therefore been the subject of much study by the nuclear 
industry. 

A20.5.4 Explosions 

One type of the event which may put a nuclear plant at risk 
is an explosion. The industry has examined various kinds 
of explosion, including vapour cloud explosions, and cer¬ 
tain types of particular interest to it such as steam explo¬ 
sions and hydrogen explosions. 

A20.5.5 Hydrogen explosions 

The fuel elements in the reactor core are held in metal 
cladding tubes. At high temperatures the zirconium metal 
used for this cladding can react with steam to produce 
hydrogen, with the risk of a hydrogen explosion. 

A20.5.6 Missiles 

Studies of some relevance to process plants are those on 
missiles such as the work reported by Baum (1984,1991). 

A20.5.7 Earthquakes 

Of rare natural events, the earthquake hazard bulks large 
both in plant design and in risk assessment. The nuclear 
regulator has put much effort into defining the type of 
earthquake which the plant should be required to with¬ 
stand. Guidance is given in Design Response Spectra for 
Seismic Design of Nuclear Power Plants by the NRC (1973). 

Then, given such a design earthquake, it is possible to 
specify equipment to withstand it, as described below. 
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A20.5.8 Expert judgement 

Where hard information is lacking, resort may be had to the 
use of expert judgement. Thus expert judgement may be 
used to obtain estimates of failure and event rates. It may 
also be applied to other aspects such as the formulation of 
accident sequences. Guidance on this approach is given 
in Eliciting and Analysing Expert Judgement: a Practical 
Guide by M.A. Meyer and Booker (1990). 

A20.5.9 Computer error 

A modern nuclear power station operates under computer 
control. The control computer, both hardware and software, 
is therefore a safety critical system. 

The quality assurance of the computer software is a 
particularly intractable problem. An account of this aspect 
of the Sizewell B computer system is given by Hunns and 
Wainwright (1991). 

A20.5.10 Human error 

The conduct of PRA for nuclear plants has led naturally to 
a requirement for methods of handling the human aspects, 
particularly in fault trees and in event trees. An overall 
methodology for this problem is described in Handbook 
of Human Reliability Analysis with Emphasis on Nuclear 
Power Plant Applications by Swain and Guttman (1983). 
A method of estimating error probabilities is addressed in 
SLIM-MAUD: an Approach to Assessing Human Error 
Probabilities using Structured Expert, Judgement by Embrey 
etal. (1984). 

Also relevant is the ACSNI Study Group on Human 
Factors Second Report: Human Reliability Assessment - a 
Critical Overview (ACSNI, 1991). 

A20.5.11 Source terms 

Each accident scenario needs to be associated with a 
defined source term, so that the dispersion of radioactive 
materials may be modelled. 

A20.5.12 Emission models 

The nuclear industry was one of the first to develop a sus¬ 
tained interest in two-phase flow, both flow within the 
plant and flow of leaks from it. An example of work from a 
nuclear background is Two-Phase Flow and Heat Transfer 
by Butterworth and Hewitt (1977). 

A20.5.13 Gas dispersion models 

Much of the work on gas dispersion modelling has been in 
support of work on the consequences of a nuclear accident. 
This is illustrated by one of the early texts, Meteorology and 
Atomic Energy 1968 by Slade (1968). 

A20.5.14 Severe accident risk 

A focus to work on PRA has latterly been provided by the 
Severe Accident Risk study, for which the basic document 
is NUREG-1150 Reactor Risk Reference Document of the 
NRC (1987). 

A20.5.15 Risk criteria 

The quantification of risks from nuclear reactors has 
necessarily led to the need for risk criteria by which to 
judge these risks. Some of the first risk comparisons were 
those given in the Rasmussen Report. 

Since then, there has been a wide-ranging debate of risk 
criteria for man-made hazards of all kinds. Nuclear risk 
criteria emerging from this are given in The Tolerability of 
Risk from Nuclear Power Stations by the HSE (1988b), and 
associated comments (HSE, 1988a). 


A20.6 Nuclear Pressure Systems 

A20.6.1 Quality assurance 

All aspects of the design and operation of nuclear power 
plant need to be carried out to high standards. There has to 
be, therefore, a system of quality assurance to ensure that 
these standards are met. 

This aspect is described in NUREG-1055 Improving 
Quality and the Assurance of Quality in the Design and Con¬ 
struction of Commercial Nuclear Power Plants (NRC, 1984). 

A20.6.2 Inspection 

High-quality inspection is an essential part of the nuclear 
industry’s armoury. It has a special interest in non-invasive 
techniques of monitoring and inspection. These include 
acoustic emission monitoring, ultrasonics and leak detec¬ 
tion methods. 

Methods of leak detection are described in NUREG/ CR- 
4813 Assessment of Leak Detection Systems for LWRs 
(NRC, 1987). 

The industry has also developed risk-based inspection. 
An account is given in NUREG/CR-5371 Development and 
Use of Risk-based Inspection Guides (NRC, 1989). 

A20.6.3 Fracture mechanics 

One of the most powerful inspection techniques for pres¬ 
sure systems is fracture mechanics and the nuclear indus¬ 
try has been in the van in developing such methods. They 
include the CEGB R6 system described in R/H/R6 Assess- 
ment of the Integrity of Structures Containing Defects by 
Milne et al. (1986). 

A20.6.4 Seismic qualification 

One of the principal external hazards to which a nuclear 
plant is vulnerable is an earthquake. There is therefore a 
requirement that equipment crucial to safe operation be 
able to withstand an earthquake of specified intensity. This 
is implemented by a system of seismic qualification of 
equipment. An account is given in NUREG-1030 Seismic 
Qualification of Equipment in Operating Nuclear Power 
Plants by the NRC (1987). 

A20.6.5 Ageing 

Another aspect which the nuclear industry has explored in 
some detail is ageing of equipment, and residual, or rema¬ 
nent, life assessment. 

An account of basic principles is given in NUREG/ 
CR-5314 Life Assessment Procedure for Major LWR 
Components (NRC, 1990). There are studies on specific 
equipment such as electric motors, diesel generators, 
instrument air systems, motor operated valves, etc. 

A20.7 Nuclear Reactor Operation 

The Kemeny Report and, even more, the Task Force Report 
on TMI contain numerous recommendations on nuclear 
reactor operation, particularly on the design of display and 
alarm systems and of control rooms generally, operating 
and emergency procedures, and operator training. 

A20.7.1 Human factors 

A considerable effort is made to apply human factors on 
nuclear power plants, a practice reinforced by the Kemeny 
Report’s emphasis on people-related problems. 

Some typical titles which illustrate the application 
of human factors on nuclear power plants are as 
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follows: NUREG/CR-3331 A Methodology for Allocating 
Nuclear Power Plant Control Functions to Human or Auto¬ 
matic Control (NRC, 1983); NUREG/CR-3371 Task Analysis 
of Nuclear Power Plant Control Room Crews (NRC, 1984); 
and NUREG-1122 Knowledges and Abilities Catalog for 
Nuclear Power Plant Operators (NRC, 1987). 

Three reports on human factors in nuclear power plant 
operation have been issued by the ACSNI Study Group on 
Human Factors. Reference has already been made to the 
second report, on human reliability assessment (ACSNI, 
1991). The other two are First Report on Training and 
Related Matters (ACSNI, 1990) and Third Report: Organis¬ 
ing for Safety (ACSNI, 1993). 

A20.7.2 Process operator 

The problems, and modelling, of the process operator have 
been the subject of extensive studies, notably the work 
described in Information Processing and Man—Machine 
Interaction by Rasmussen (1986). 

A20.7.3 Display and alarm systems 

Early developments in computer aids for the process 
operator were the alarm analysis systems developed at 
Wylfa and Oldbury nuclear power stations, described by 
Welbourne (1965) and Patterson (1968), respectively. The 
purpose of these systems is to assist the operator in inter¬ 
preting the large number of alarms which tend to come up 
in a plant emergency. 

One of the perceived problems atTMI was the difficulty 
experienced by operators in assessing the safety status of 
the plant. A recommendation of the Task Force Report was 
that every reactor should have a plant safety status display. 

TMI also illustrated the alarm interpretation problem 
just mentioned and the report recommended that the fea¬ 
sibility be explored of developing a suitable aid, which it 
termed a disturbance analysis system (DAS). 

A20.7.4 Control room design 

A large proportion of the studies conducted on control 
rooms have been in the nuclear industry, and these have 
contributed to the development of understanding of human 
factors and human error. 

In the aftermath of TMI control room design in general 
was also an issue. This illustrated in NUREG-0700 Guide¬ 
lines for Control Room Design Reviews (NRC, 1981). 

A set of studies of the Sizewell B control room are 
described by Ainsworth and Pendlehury (1994), Umbers 
(1994) and Whitfield (1994). 

A20.7.5 Operating procedures 

In the operation of nuclear power plants particular 
emphasis is placed on written operating procedures and on 
the training of operators in these. An account is given in 
NUREG/ CR- 3968 Study of Operating Procedures in Nuclear 
Power Plants (NRC, 1987). 

A20.7.6 Emergency procedures 

Operating procedures for dealing with an emergency 
assume particular importance on nuclear power plants. 
The Kemeny Report and the Task Force Report make recom¬ 
mendations on the emergency procedures. 

Such procedures are the subject of NUREG/CR-0899 
Guidelines for the Preparation of Emergency Operating 
Procedures (NRC, 1982) and NUREG/CR-3177 Methods for 
Review and Evaluation of Emergency Procedure Guidelines 
(NRC, 1983). 


A20.7.7 Operator training 

Process operators on nuclear power plants undergo ext¬ 
ensive training, for which the industry makes appreciable 
use of simulators. 

The need for such training is a principal theme of both 
the Kemeny Report and of the Task Force Report onTMI. It is 
also the subject of the first report of the Study Group on 
Human Factors of the ACSNI (1990). Simulator training is 
treated in NUREG/CR-3725 Nuclear Power Plant Simula¬ 
tors for Operator Licensing and Training (NRC, 1984) and 
numerous other reports. 

A20.8 Nuclear Emergency Planning 

An emergency plan, covering both on-site and off-site 
aspects, is an integral part of the arrangements at a 
nuclear power plant. 

A20.8.1 Accident management plans 

There has been growing emphasis on the need to plan for 
and to manage an emergency. 

Relevant work is that described in NUREG/CR 
Management of Severe Accidents by the (NRC, 1985) and 
NUREG/CR-5543 A Systematic Process for Developing 
and Assessing Accident Management Plans by the NRC 
(1991). 

A further account is given byAng (1992). 

A20.8.2 Off-site emergency plans 

Off-site emergency planning has been a feature of the 
nuclear industry from its earliest days. An account is given 
in Emergency Plans for Civil Nuclear Installations by the 
HSE (1986b). 


A20.9 Nuclear Incident Reporting 

In most regulatory regimes the nuclear industry is required 
to report to the regulator the occurrence of specified types 
of incidents. 

A20.9.1 Licensee Event Reports 

In the United States of America the system is that described 
in the NUREG/CR-2000 Licensee Event Report (LER) com¬ 
pilation. 

A20.9.2 Precursors to severe accidents 

The LERs record some events which are of such a nature 
that they could well have escalated into more severe events, 
even though in the particular case this has not occurred. 
These events are precursors of more serious incidents and 
serve as warnings. Periodic analyses are made of such 
precursors such as NUREG/CR-4674 Precursors to Poten¬ 
tial Severe Core Damage Accidents 1990: Status Report by 
the NRC (1991). 


A20.10 Nuclear Incidents 

There have been a number of incidents on nuclear plants 
which are instructive for the process industries also. In 
addition toTMI and Chernobyl, they include Windscale and 
Browns Ferry. 

Accounts of incidents include those in Nuclear Power by 
Patterson (1976), The Nuggett File by the UCS (1979) and 
Nuclear Lessons by Curtis et al. (1980); later incidents are 
covered by May (1989). 
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A20.10.1 Radioactive sources 

Although the incidents of prime interest here are those 
involving nuclear plant, other nuclear sources should not 
be neglected. The following case, believed to be the worst of 
it kind to date, illustrates the hazard from equipment con¬ 
taining a radioactive source. 

In 1985 in Goiania, Brazil, a radiotherapy institute 
moved premises, leaving behind a unit containing a 
caesium-137 source in a stainless steel container and with¬ 
out notifying the licensing authorities. Subsequently the 
building was partially demolished. Some 2 years after the 
institute’s departure, on 13 September 1987, two men 
entered and tried to dismantle the machine for scrap, 
one taking home the steel cylinder; both fell ill. However, 
some 5 days later one broke open the steel cylinder and 
the caesium spilled out. A train of events ensued which 
resulted in 249 people being exposed to radiation, of whom 
four died. 

A20.10.2 Military reactors and weapons plants 
Hanford, the Green Run, 1949 

On 2 December 1949 at Hanford, Washington State, there 
occurred one of a series of releases from an installation of 
eight nuclear reactors producing plutonium for the 
Manhattan Project. This was the Green Run, an experiment 
conducted to investigate monitoring methods which would 
be useful in intelligence work on the nuclear capabilities 
of other countries. The release formed a plume 200 miles 
x 40 miles in dead calm conditions and involved 20,000 Ci 
of xenon and 7780 Ci of iodine-131. 

Rocky Flats, Colorado, 1957 

On 11 September 1957 at Rocky Flats, Colorado, a fire 
occurred in a glove box at an atomic weapons plant. Pluto¬ 
nium shavings ignited spontaneously, workers tried to put 
the fire out and explosions occurred which blew out the 
ventilation filters. For half a day there was a release of 
plutonium contaminated smoke. On 11 May 1969 there 
occurred another glove box fire. All new weapons produc¬ 
tion was shut down for 6 months. 

Idaho Falls, Idaho, 1961 

On 3 January 1961 at Idaho Falls, Idaho, an incident 
occurred on a prototype military nuclear power plant, the 
Stationary Low Power Reactor SL-1, one of 17 reactors at the 
AECs National Reactor Test Station (NRTS). The reactor 
was shut down and control rods had been disconnected to 
install additional instrumentation. The emergency started 
with the sounding of alarms. As it developed, three men 
working on the control rods were found to be missing. One 
was discovered dead, pinned to the ceiling by a control rod, 
another was also dead and the third died soon after. The 
precise sequence of events is uncertain. One explanation 
given is that the central control rod was partially with¬ 
drawn and there was a power surge, generating steam 
which lifted the lid of the pressure vessel, causing it to rise 
9 ft and then drop back. 

A20.10.3 Windscale 

Accounts of the Windscale incident are given in Windscale 
Fallout by Breach (1978) and Windscale 1957 by L. Arnold 
(1992) and by May (1989). 

On 10 October 1957 at Windscale, United Kingdom, an 
incident occurred which led to a serious radioactive 
release. The installation consisted of two simple air-cooled, 


graphite-moderated, atomic piles used for the production 
of plutonium. The graphite was subject to deformation and 
build-up of energy due to neutron bombardment, the 
so-called Wigner effect. A procedure had been established 
to release the Wigner energy by turning off the fans, 
making the pile critical and letting heat build up. On 7 
October 1957, this procedure had been followed, but it 
appeared that not all the Wigner energy had been released, 
so the pile was heated up again. The sensors then showed 
an abnormal temperature rise and the power was reduced. 
By 9 October conditions seemed normal except that there 
was a hot spot. However, on 10 October a rise in radio¬ 
activity was detected at the filters in the chimney. An 
attempt was made to inspect the core using a remote 
scanner, which jammed. Staff removed a charge plug and 
looked in. All the fuel channels which they could see were 
on fire and a fuel cartridge had burst. The air movement 
caused by the fans was now fanning the blaze. Despite 
fears that it might lead to a hydrogen-oxygen explosion, 
the decision was taken to use water to put out the fire, 
which it did. As a result of the incident, workers on the site 
were exposed to radiation and milk from cattle in the area 
had to be discarded. The release was mitigated by the 
presence of the filters, installed at the insistence of Sir 
John Cockcroft, prominent at the top of the chimney, and 
known locally as ‘Cockcroffs Folly’. The piles were decom¬ 
missioned and set in concrete. 


A20.10.4 Civil nuclear reactors and reprocessing plants 
Chalk River, Ontario, 1957 

On 12 December 1957 at Chalk River, Ontario, there was a 
loss of control on a nuclear reactor leading to damage of the 
core so that it had to be removed and buried. In outline the 
initial sequence of events was as follows. Outside the con¬ 
trol room, a supervisor found that an operator was opening 
valves which caused the control rods to withdraw. He 
immediately set about shutting the valves, but some of the 
rods did not drop back. He telephoned the operator in the 
control room, intending to ask him to push a button which 
would drop control rods in, but by a slip of the tongue 
actually referred to a button which would withdraw rods. In 
order to comply, the operator moved away from the phone 
so that the supervisor temporarily lost touch with him. The 
operator in the control room soon recognized from the ris¬ 
ing reactor temperature that there was something wrong 
and pressed the scram button, but events had been set in 
train which led to core damage. 

Detroit, Michigan, 1966 

On 5 October 1966 near Detroit, Michigan, the Enrico 
Fermi reactor experienced an incident. The reactor was the 
first commercial fast breeder reactor in the United States of 
America. It was being started up for a series of tests when 
abnormalities were observed and some of the control rods 
were found not to be in their expected positions.Tests on the 
sodium coolant showed it to be contaminated, suggesting 
that part of the fuel core had melted, but the cause was 
unknown. The authorities were alerted and went on stand¬ 
by for evacuation. Subsequent investigation found that 
separation had occurred of parts from a steel cone at 
the bottom of the vessel, installed so that in a meltdown the 
fuel would spread out and not reach critical mass. In a last- 
minute modification, zirconium plates had been put onto 
the cone. One plate had worked loose, had been forced into 
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the core by the sodium coolant and had blocked coolant 
flow to two of the fuel assemblies. 

An account of this incident is given in We Almost Lost 
Detroit by Fuller (1984). 

Browns Ferry, Alabama, 1975 

Prior toTMI one of the US incidents which received parti¬ 
cular attention was that on 22 March 1975 at Browns Ferry 
Accounts are given in the Rasmussen Report and in Browns 
Ferry: the Regulatory Failure by Ford, Kendall and Tye 
(1976). The incident is described in Appendix 23. 

Beloyarsk, USSR, 1978 

On 30-31 December 1978 at Beloyarsk, USSR, there 
occurred an incident which until Chernobyl was the most 
serious in the nuclear industry The complex was 50 km 
from Sverdlovsk and housed two RMBK reactors and a 
BM600 fast breeder reactor. A serious fire broke out in the 
machine hall, causing steel girders and the concrete roof to 
collapse, opening up a huge hole above No. 2 Generator and 
disabling the fire protection system. Emergency proce¬ 
dures called for both RMBK reactors to be shut down. But 
as it was close to -50°C outside, it was feared the reactor 
cooling systems would freeze and the cores would overheat. 
Attempts were made to keep No. 1 Reactor and its turbine 
running, but despite the fire the turbine froze. There fol¬ 
lowed an extended emergency which eventually, with the 
arrival of fire fighters from outside, was brought under 
control. 

Cap la Hague, France, 1981 

On 6 January 1981 at Cap la Hague, Normandy, France, in a 
nuclear fuel reprocessing facility there occurred the most 
serious of a series of incidents. Fire broke out in a spent fuel 
dry waste silo. Ignition occurred in cotton waste, soaked in 
solvent and in contact with uranium and magnesium. The 
cotton waste had been used in a decontamination operation 
there several weeks earlier. The fire was attacked first by 
water, which formed steam, and then by liquid nitrogen. 
Radioactivity was released inside and outside the plant. 

New York State, 1982 

On 25 January 1982 in New York State the Ginna reactor 
experienced tube rupture, due to corrosion, in the steam 
generator, causing contamination of the secondary, clean 
steam circuit by the radioactive water from the primary 
water circuit cooling the core. High pressure in the steam 


circuit caused a pressure relief valve to open, initially in 
5 min bursts and then by sticking open for 50 min. Another 
PRV on the primary circuit was deliberately opened to 
reduce the pressure in that circuit but also stuck open. 
A steam bubble formed, but it proved possible to correct it 
by pumping in more water. 


Frankfurt, FRG, 1987 

On 16-17 December 1987 at Frankfurt, FRG, the Biblis A 
nuclear reactor experienced an incident involving the low 
pressure injection (LPI) system. It was a requirement that 
this system remain isolated to prevent (1) leakage of pri¬ 
mary coolant out through it and (2) overpressure of the 
system itself by the primary coolant. During start up the 
main valveTH22 S006 on the pipe between the LPI system 
and the primary circuit had been left open; there were also 
two secondary valves on the line. The status of the main 
valve was shown by a red light on the control panel, but the 
operators assumed that the fault was on the light itself. 
There were two changes of shift before it was realized that 
valveTH22 S006 was open. The operators took 2 h to decide 
on a plant shut down and then 10 min later changed their 
minds and tried an alternative, and hazardous, procedure. 
They decided to initiate flow through valve TH22 S006, 
expecting that the valve would then be shut by its trip 
system. They controlled the flow by cracking open one of 
the secondary valves and primary coolant started to 
escape, but valveTH22 S0006 did not shut, and after a few 
seconds they desisted. The operators then shut the reactor 
down. 


A20.11 Notation 

c velocity of light 

D absorbed dose (Sv) 

E energy 

H dose equivalent (Sv) 

M a atomic weight 

n number of radioactive atoms 

n 0 number of radioactive atoms at time zero 

No Avogadro’s number 

Q quality factor 

X radioactive decay constant (s -1 ) 

t half-life (s) 
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At 4.00 on 28 March 1979, a transient occurred on Reactor 
No. 2 at Three Mile Island, near Harrisburg, Pennsylvania. 
A turbine tripped and caused a plant upset. The opera¬ 
tors tried to restore conditions, but, misinterpreting the 
instrument signals, misjudged the situation and took 
actions which resulted in the loss of much of the water in the 
reactor and the partial uncovering of the core. Radio¬ 
activity escaped into the containment building. Site and 
general emergencies were declared. 

The accident at Three Mile Island (TMI) (also referred to 
initially as Harrisburg) was the most serious accident 
which had occurred in the US nuclear industry. 

The President set up a commission to investigate the 
accident. Their work is described in The Report of the Pre¬ 
sidents Commission on the Accident at Three Mile Island (the 
Kemeny Report) (Kemeny, 1979). 

The NRC carried out an investigation, reported in 
Investigation into the March 28, 1979 Three Mile Island 
Accident by Office of Inspection and Enforcement (the NRC 
Report) (NRC, 1979b). It also set up a task force, the findings 
of which are given in TMI-2 Lessons Learned Task Force 
Final Report (theTask Force Report) (NRC, 1979d). 

Another report is Analysis of Three Mile Island - Unit 2 
accident by the Nuclear Safely Analysis Center (NSAC) of 
EPRI (1979a). 

Hearings were also held by the US Congress (US Con¬ 
gress, 1979) at which evidence was taken from managers, 
engineers, process operators and others. 

The Accident at Three Mile Island gives the initial 
response of the HSE (1979a). 

TheTMI accident was a watershed in the development of 
nuclear power in the US and worldwide. After 1979, the 
ordering of new nuclear power stations in the US virtually 
dried up. Elsewhere, TMI has at the least heightened 
awareness of nuclear hazards. 

In addition to the official reports mentioned, accounts 
of the TMI accident have been given in Three Mile Island 
by Stephens (1980) and by J.F. Mason (1979), Rubinstein 
(1979a, b), Collier and Davies (1980), Dunster (1980), 
H.W Lewis (1980), Rogovin (1980), Schneider (1980) and 
Kletz (19821, 1988h). A detailed timetable of the events 
during the accident is given by the NRC (1979b) and by 
J.F. Mason (1979). 

Selected references on TMI are given in Table A21.1. 


A21.1 The Company and the Management 

The company which operated TMI was Metropolitan 
Edison (Met Ed). 

Table A21.1 Selected references on Three Mile Island 


NRC (Appendix 28 Three Mile Island, 1979b,d); Douglas 
(1979); EPRI (1979a); Ferrara (1979); HSE (1979a); Kemeny 
(1979); J.F. Mason (1979); Rubinstein (1979a,b); Savage 
(1979); US Congress (1979); Brookes and Siddall (1980); 
Cobb and Marshall (1980); Collier and Davies (1980); 
Dunster (1980); Lanouette (1980); Levy (1980); H.W. Lewis 
(1980); Rogovin (1981); Stephens (1980);Torrey (1980); Jaffe 
(1981); Moss and Sills (1981); Schneider (1981); Starr (1981); 
Straus (1981); Wolf (1981); Kletz (19821,1983j, 1988h); Sills, 
Wolf and Shelansky (1982); Slear, Long and Jones (1983); 
Anon. (1984kk); Ural and Zalosh (1985); Ballard (1988); 
Philley (1992) 


Some of the TMI staff who involved in dealing with the 
incidents were 

Station manager 
Station superintendent 
Superintendent of 
technical support 
Shift supervisor 
Shift foreman 
Control room operators 

Others involved included 
Met Ed vice-president 
for generation 
Babcock and Wilcox site 
representative 


A21.2 The Site and the Works 

TMI is situated on the Susquehanna River, some 10 miles 
south-east of Harrisburg, Pennsylvania. 


A21.3 The Process and the Plant 

The plant consisted of two PWRs of approximately 
900 MWe each. Unit 1 had been in commercial service since 
1974 and Unit 2 since December 1978. 

The contractors for the reactor plant were Babcock and 
Wilcox. 

The nuclear reactor system is shown in Figure A21.1. The 
reactor itself is a pressure vessel containing the reactor core. 
The fuel in the core is enriched uranium dioxide pellets 
encased in zirconium alloy tubing. There are some 37,000 of 
these fuel pins arranged in clusters in the core. The core 
is cooled by the primary cooling system containing water 
at a high pressure «15.2 MPa) to prevent its boiling. The 
water acts not only as a coolant but also as a moderator. 

Heat is removed from the reactor in this primary cooling 
circuit, the reactor cooling system (RCS), and used in the 
steam generators to generate steam to drive a pair of tur¬ 
bogenerators. The primary cooling system consists of two 
independent loops containing water at high pressure. 

Since the volume of the cooling water changes with tem¬ 
perature, it is necessary to have some free space or ‘bubble’ 
in the primary circuit to control the system pressure. This is 
provided by the pressurizer, which is equipped with elec¬ 
trical heating to raise steam and thus increase the pressure, 
and cold water sprays to condense steam and thus lower the 
pressure. Steam can be blown off through a pilot-operated 
relief valve (PORV). The tail pipe from the PORV is run to 
the reactor coolant drain tank. 

An emergency core cooling system (ECCS) is provided to 
give backup cooling. This consists of three separate sys¬ 
tems. One is the high pressure injection (HPI) system which 
pumps borated water into the system at a pressure greater 
than the normal coolant pressure. Another is the core 
flooding system which automatically injects cold borated 
water into the system when the coolant pressure falls below 
about 4.1 MPa. The third is the low pressure injection sys¬ 
tem which operates at 2.8 MPa. This takes water either from 
a large tank of borated water or from the dump of the con¬ 
tainment building and is thus capable of keeping up recir¬ 
culation indefinitely. 

The reactor, the primary cooling circuit and the steam 
generators are housed in a containment building which is 


Mr G. Miller 
Mr J. Logan 
Mr G. Kunder 

MrW. Zewe 
Mr F. Scheimann 
Mr E. Frederick; 
Mr C. Foust 
Mr J. Herbein 


Mr L. Rogers 





CONTAINMENT BUILDING Pilot operated 



Figure A21.1 Simplified flow diagram of TMI2 nuclear power plant (Kemeny, 1979) 
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leak-tight. The containment is designed to retain the con¬ 
tents of the primary circuit in the event of a major leak. 

The containment building has a spray system containing 
dilute sodium hydroxide. The spray is triggered by high 
containment pressure and is intended in the event of a loss 
of coolant accident to cool down the contents of the con¬ 
tainment and to scrub out iodine. 

The turbogenerator set is housed in a separate building 
which also contains the condensate and water treatment 
plants. Feedwater for the secondary circuit is from the con¬ 
denser. The condensate water is purified by ion exchange 
in a condensate polishing system, a package unit. 

The water converted to steam on the secondary side in 
the steam generators is supplied to them by the main feed- 
water pumps. These are backed up by auxiliary, or emer¬ 
gency, feedwater pumps. Both sets of feedwater pumps are 
housed in the turbine building. 

The control room is a typical one and is shown in 
Figure A21.2. 


A21.4 Events Prior to the Excursion 

Some 2 days prior to the incident, routine testing had been 
done on the valves on the auxiliary feedwater pumps. Two 
of the valves, the ‘twelve valves’, had inadvertently been 
left shut. 

For some 11 hours before the incident, the operators had 
been trying to clear a blockage in the condensate polishing 
system. In order to do this use was made of compressed 
air. The service air line used for this purpose was cross- 
connected to the instrument air line. The pressure of the 
air in the instrument line was less than that of the water in 
the units and some water got into the instrument air line, 
despite the presence of a non-return valve on that line. This 
water found its way to some of the plant instruments. 

Another feature was a persistent slight leak from either 
the regular safety valves or the PORV 


A21.5 The Excursion 1 

An account is now given of the events which consti¬ 
tuted the excursion. A timetable of the events is given in 
Table A21.2 Sections A and B showing the events and pha¬ 
ses, respectively. The trend records of the RCS parameters 
are shown in Figure A21.3. 

At the time of the incident on 28 March, the reactor was 
operating under automatic control at 97% of its rated out¬ 
put of 961 MWe. The incident began when water which had 
entered the instrument air line caused the isolation valves 
on the condensate polishing system to drift shut and the 
condensate booster pump to lose suction pressure and trip 
out. The main feedwater pumps in the secondary circuit 
then tripped and almost immediately the main turbine 
tripped. The time was 4.00.37. 

Valves allowing steam to be dumped to the condenser 
opened, and the auxiliary feedwater pumps started up. 
At the steam generators, the removal of heat from the 
RCS fell, and the pressure of the RCS rose. Within 3—6 s the 
PORV set pressure of 15.5 MPa was reached and the valve 
opened, but this was insufficient to relieve the pressure, 
and at 8 s in, pressure rose to 16.6 MPa, the set point for 
reactor trip. The control rods were driven into the core to 
stop the reaction. 

The RCS pressure now fell below the PORV set pressure, 
but the valve failed to shut. However, the valve position 
indicator in the control room, which actually indicated not 
the position of the valve but the signal sent to it, showed the 
valve as closed. The RCS continued to lose water through 
the open PORV. 

In the secondary circuit condensate was no longer being 
returned to the steam generators, because the valves on the 
condensate polishing system had closed. The auxiliary 
feedwater pumps were running, but the valves between the 
pumps and the steam generators were also, inadvertently, 
closed. At 1 min 45 s into the incident the steam generators 
boiled dry. 



Figure A21.2 Control room TMI2 (Kemeny, 1979) 
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Table A21.2 Timetable of events at Three Mile Island 

A Timetable (first hours) (after Dunster, 1980) 

Absolute 

Time into 


time 3 

incident 


4.01 

8s 

Feed water pump fails 

Pressure rise occurs in primary circuit 

Relief valves open 

Reactor shut-down 


13 s 

PORV fails to close but indicates closure in the control room 

Extra cooling water (normal) injected by the operator 

4.02 

1 min 45 s 

Steam generators dry out 

4.03 

2 min 

Pressure in primary circuit falls and emergency cooling water injection started 

4.04 

3 min 30 s 

Indication of high level of water in the pressurizer causes operator to shut off one emergency 



cooling pump 

4.06 

5 min 30 s 

Stem generated in the core 

Operators drain off small volumes of primary water in response to rising level in pressurizer 

4.11 

11 min 

Alarm indication of a high level of water in the containment building sump 

Sump water being pumped to auxiliary building 

4.39 

39 min 

Sump pumps stopped by operator 

5.00 

60 min 

Primary coolant pumps vibrating due to pressure of steam 

5.14 

1 h 14 min 

Two primary pumps stopped by operator 

5.45 

1 h 45 min 

Two remaining primary pumps stopped by oprator 

5.50 

1 h 50 min 

Temperature in outlet ducts high enough to show presence of superheated steam - 



sigificance not recognized 

6.22 

2 h 22 min 

Block valves on the relief valve lines closed by operators 

7.00 

3 h 

Site emergency declared 

7.20 

3 h 20 min 

Indication of 800 rem/h in containment building 

7.24 

3 h 24 min 

General emergency declared 

8.00 

4h 

Containment building isolated automatically but operators continue to transfer primary 



let-down water to tanks in the auxiliary building 

8.25 

4 h 25 min 

Local radio carried item concerning general emergency 

B Phases (Collier and Davies, 1980) 

Phase 1 

Thrhine trip 0 

-6 min 

2 

Loss of coolant 

3 

4 

5 

Continued depressurization 20 min-2 h 

Heat-up transient 2-6 h 

Extended depressurization 6-11 h 

6 

7 

Repressurization and ultimate establishment of stable cooling mode 13-16 h 

Removal of hydrogen bubble 1-8 d 


a Absoulte times are approximate; the turbine trip was at 4.00.37. 


Meanwhile the RCS pressure was dropping. At 2 min the 
pressure fell to 11 MPa at which point the first of the ECCS 
systems, the HPI system, came on and injected high pres¬ 
sure water. The liquid level in the pressurizer, however, was 
rising. 

The display of liquid level was an indicator of the level of 
fluid in the pressurizer, but no longer of the mass of water; 
the liquid now contained steam bubbles and had thus been 
rendered less dense. To this extent the level display had 
become misleading. 

The operators became concerned that the HPI system 
was increasing the inventory of water in the RCS, that the 
steam bubble in the pressurizer would be lost and that the 
circuit would become full of water and thus go ‘solid’. At 
4 min 38 s they therefore shut down one of the HPI pumps 
and throttled back the other. 

With water passing through the PORV the pressure in 
the reactor coolant drain tank built up and at 7 min 45 s the 


reactor building sump pump came on, transferring water to 
the waste tanks in the auxiliary building. 

At 8 min the operators realized that the steam generators 
were dry. They found that the auxiliary feedwater system 
valves were closed and opened them, thus restoring feed- 
water to the steam generators. 

At 60 min the operators found that the RCS pumps were 
vibrating. This was due to the presence of steam, though 
they did not realize this. At 1 h 14 min they shut off the two 
pumps in Loop B to prevent damage to the pumps and 
pipework, with possible loss of coolant, and at 1 h 40 min 
shut off the two pumps in Loop A. 

At 2 h 18 min the PORV block valve was at last shut off, 
thus stopping the loss of water from the RCS. The RCS 
pressure then began to rise. 

In the two hours since the turbine trip periodic alarms 
had warned of low level radiation in the containment 
building. At about 2 h in, there was a marked increase in the 








APPENDIX 21/6 THREE MILE ISLAND 


Pressure 
psig. 
2400 r- 

2200 - 
2000 - 
1800 - 
1600 - 
1400 - 
1200 - 
1000 - 



© Relief valve opens 
@ Reactor trip 
© HPI pump 1A started* 

@ Sieam. generators dry out 
© HPI pump 1C starts IB stops* 
© HPI pump 1C stopped* 

© RC flashes 
® Aux. FW flow initiated 
@ RC drain tank rupture 
disc ruptures 

* HPI history uncertain 


Time after turbine trip (minutes) 
(a) 




Figure A21.3 Trend records of reactor cooling system parameters at TMI2 (Collier and Davies, 1980): (a) parameters 
in minutes following turbine trip; and (b) parameters in hours following turbine trip 
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radiation readings. By 2 h 48 min in, high radiation levels 
existed in several areas of the plant. At 2 h 55 min a site 
emergency was declared. 

Attempts were made to restart the RCS pumps. One 
pump in Loop B operated for some 19 min but was shut 
down again by vibration trips at 3 h 13 min. 

Meanwhile, high radiation levels had been measured in 
the containment building. At 3 h 30 min a general emer¬ 
gency was declared. 

At some point, perhaps about 4 h in, the station manager 
appears to have realized that the reactor core had suffered 
damage. 

From 4 h 30 min attempts were made to collapse the steam 
bubbles in the RCS loops, but without success and at 7 h 
these efforts were abandoned. 

The operators then tried to bring in the lower pressure 
cooling system by reducing pressure in the RCS. They 
began at 7 h 38 min by opening the PORV block valve. At 
8 h 41 min the pressure fell to 4.1 MPa at which point the 
core flooding system operated. 

One consequence of the exposure of the core was that a 
steam-zirconium reaction occurred, generating hydrogen. 
During the depressurization, hydrogen from the RCS was 
vented into the containment building. At 9 h 50 min, there 
occurred in the containment building what was apparently 
a hydrogen explosion. There was a thud and a pressure 
spike of 0.19 MPa occurred. The sprays came on for some 
6 min. However, the nature of the event was not immedi¬ 
ately understood. 

By this time the reactor had been stabilized, although it 
had suffered core damage. 

When the significance of the event in the containment 
building became appreciated, concern grew about a pos¬ 
sible explosion of a hydrogen bubble there. 

A21.6 The Emergency and the Aftermath 

As already described, a site emergency was declared at 7.00 
on 28 March. At 7.24 a general emergency was declared. 
The emergency which then unfolded over the next week or 
so is described in the Kemeny Report. 

The plant was contacted by the local WKBO radio sta¬ 
tion. The radio station asked what kind of emergency it 
was. They were told by the company manager of commu¬ 
nications services that it was a general emergency, a 
‘red-tape’ sort of thing required by the NRC when certain 
conditions exist, but that there was no danger to the public. 

The emergency did not end with the establishment of 
stable operation. The following day, the core damage was 
found to be more serious than first thought. The hydrogen 
bubble problem persisted over the next 8 days and caused 
particular concern. There were also a number of other pro¬ 
blems, mainly associated with the large quantities of water 
contaminated with low level radioactivity. The levels of 
radioactivity in the atmosphere around the plant were 
monitored continuously. 

The handling of the emergency in respect of evacuation 
developed into a protracted saga, of which only highlights 
need be mentioned. In addition to the company and the 
NRC, the state governor and the President became 
involved. On 29 March, meetings were held to decide whe¬ 
ther to recommend evacuation. On 30 March, a radiation 
reading outside the plant, later found to be erroneous, led 
NRC officials to recommend evacuation. The local director 
of emergency preparedness was notified to stand by for an 


evacuation; he notified fire departments and had a warning 
broadcast that an evacuation might be called. Then the 
NRC chairman assured the Governor that an evacuation 
was not necessary. Later the Governor decided that preg¬ 
nant women and pre-school children should be evacuated. 
Meanwhile, people around the plant had started to make 
their own arrangements, and many left. By 1 April, the NRC 
had concluded that the hydrogen bubble posed no threat 
but failed to announce this properly. 

Operations to restore the situation at TMI-2 have lasted 
over a period of years (Masters, 1984). 

A21.7 The Excursion 2 

The operators in theTMI-2 control room made a number of 
errors. Some of these were failures to make a correct diag¬ 
nosis of the situation, others were undesirable acts of 
intervention. 

The first was the failure to realize that the PORV had 
stuck open. The operators had an indication that the PORV 
had shut again, in the form of a status light. However, this 
light showed only the shut signal sent to the valve, not the 
valve position itself. They were also misled by the reading 
of high water level in the pressurizer. 

There were several centra-indications, however, which 
pointed to the fact that the PORV was open. One was that 
the PORV outlet pipe was at a higher temperature than 
usual, 140°C instead of 90°C. Another was that the tem¬ 
perature and pressure in the pressurizer were lower than 
usual. The third was that there was a high level in the con¬ 
tainment building sump. Later, the vibration of the primary 
coolant pumps was another indication. 

Closely connected with this first diagnostic failure was 
the failure to recognize that the mass of primary coolant 
water had fallen. Here the operators were misled by the 
level measurement. 

Turning to the interventions, at 2 min into the incident, 
the HPI pumps tripped in automatically, because the mass 
of water in the primary circuit was falling. Thirty seconds 
later, the operators, fearing that the system would fill right 
up with water and go ‘solid’, shut the HPI pumps off. This 
was the wrong action, because the primary circuit then 
continued to lose water. 

Another counterproductive action was the shutting 
down of the primary coolant pumps. About 60 min into the 
incident, the pumps began vibrating. This was another clue 
that the primary circuit fluid was now a two-phase mixture 
of steam and water. The operators had been trained not to 
allow violent vibration of the pumps, which could damage 
them or the piping, and they shut the pumps down. The 
forced flow of cooling water through the reactor core 
ceased. 

These failures of diagnosis and the fear of the system 
going solid have frequently been characterized as illustra¬ 
tions of mindset. 

The operators were poorly served by the displays and 
alarms in the control room. Mention has already been made 
of the fact that some of the indicators did not actually dis¬ 
play the variable of direct interest. There were a large 
number of alarms which were difficult to interpret. 

A21.8 The Investigations 

Principal investigations into the accident are the NRC 
Report, the Kemeny Report and the US Congressional 
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hearings. These are described in this section. Recommen¬ 
dations given in the Kemeny Report and the Task Force 
Report are outlined in Section A21.9. 


A21.8.1 NRC report 

The NRC Report gives a detailed account of theTMI acci¬ 
dent with a full chronology for the first 16 h containing 
676 entries. There was little dispute about the basic facts. 
The investigations are significant mainly for their probing 
of the deeper causes. 


A21.8.2 Congressional hearings 

Hearings on the incident which are replete with informa¬ 
tion were held by the US Congress; they repay study. 

Of particular interest here are the sessions dealing with 
the display and alarm systems. Extracts from the record on 
these two topics are given, respectively, in Tables A21.3 
and A21.4 and are self-explanatory. 


Table A21.3 The display problem at Three Mile 
Island: evidence given to Congressional committee 
(after Lees, 1980f, based on US Congress, 1979) 


Weaver. I just want to say that is an extremely important point 
because one of the things we wanted to find out was how well 
they were in control. So you are raising the issue, I think, that 
because these gauges were off at one side they did not see them. 
Is that a possibility? 

Eisenhut: It is certainly a possibility. In fact, that is why I said 
that is an area - the reason I highlighted it, it is a question area 
as to what happened to the pilot-operated relief valve, what 
kind of indications they had that the valve was still open. 
Weaver: But they could have seen them? 

Eisenhut: There were at least a couple of other instruments they 
could have used if those instruments were working. I do not 
know whether they were. 

Weaver: The indications are that they did not see them for 
several hours; is that correct? 

Eisenhut: At least a couple of hours, [p. 27] 

Carr: We were told the other day that there was no direct level 
indicator in the reactor at the level of the coolant, that that had 
to be inferred from looking at other data, say the pressurizer 
pressure. Now we are saying that there is no direct indication 
of this valve at the top of the pressurizer, that we only got an 
indication, a direct indication on its mechanism rather than on 
its functioning, and that there were some backup inferences 
you could draw from other instruments which would lead 
someone to assemble some data. I suppose jumping way, way 
ahead of ourselves here I am wondering, is this a special 
feature of Babcock & Wilcox plants that on their gaging and 
instrumentation they do not use direct data, and then use the 
other stuff for backup? Or is this something throughout the 
nuclear industry, where there is a lot of data points and it leaves 
it to the operator to sort of assemble all of this, what is 
happening inside that building, in his head. 

Stella: Valve positions normally are indicated by a mechanism 
which looks at the travel of the stem, which is to some degree 
on indirect reference to what the valve is actually doing, but a 
more direct method than you would get from looking at the 
solenoid which starts the event, [p. 30] 


Stella: But as I tried to understand the accident, I reduced the 
number of program meters that I really wanted to know about 
to very few to try to make the judgement of what was going on. 
I think the operators can do that... 

You can reduce the number that you really need to focus on to 
try to understand the event that you have had to relatively few. 
For example if you had a major LOCA, he would know very 
quickly what program meters that he ought to focus his 
attention on. He would have very quickly a response in the 
reactor building that says I have a discharge of a lot of high- 
energy fluid. I either have a break in my secondary system in 
the reactor building or the primary system. I immediately look 
at my primary system meters. Then I can tell if that was a 
primary system rupture. If it is a primary system rupture, I 
then know what program meters to track. So there is a 
hierarchy of logic built into the very many alarms that you see 
that point him at the right direction.... But this whole family 
of alarms and gages that you see, there is a hierarchy of logic 
built into it that, as you are trained to be an operator, you know 
what critical program meters to look for very quickly and 
eliminate or focus your attention in the right direction. 

Carr: In the location of the alarms and gages and buzzes and 
switches and all that stuff, does the location on the panel follow 
that logic? 

Stella: Yes. [p. 31] 

Vento: One other thing before we go on to the other problem in 
the secondary system, which you did next. This relief valve, of 
course, is a key part of this, apparently. But there were some 
tailpipe temperature and some other indicators there that were 
also available. Who was responsible for watching those at this 
particular point? The tailpipe temperature? 

Frederick: What you are talking about is the outlet temperature 
of the relief valve. 

Vento :There is also a tank that this goes to that is not shown on 
here, and that has an indicator on it and a temperature and so 
forth. There is a thermocouple on here, and who was 
responsible for watching those in this particular process? It 
was just a generally shared thing? 

Frederick: The points that you are talking about are not 
displayed. They are not on the console. They are in the 
computer. You have to manually call them up. 

Vento: You have to call those things up. But were they not called 
up during this procedure at all? 

Frederick: No. 

Weaver: How many minutes are we in now? Where are we? 
Faust It is not a normal thing. 

Frederick: About an hour. 

Faust We did not know a problem like that existed at 
the time. 

Frederick: If the valve indicated shut, there is no reason to look 
at the downstream temperature, [p. 135] 

Reis: It is a broad question, but as well as you can answer it, do 
you think that the control room provided you, in a timely 
fashion, in an easy-to-read fashion, the information you 
wanted and needed? And alternatively, in the course of the 
accident, were the communications in the control room such so 
that when someone at the panel needed conceptual 
information, in other words, this instrument, that instrument, 
and this gage are reading things that do not jibe together, that 
you had that sort of immediate access to an engineer? When 
did you get it? Did it work well, so that you were able to figure 
out what was really going on? 

Frederick: The answer to the first question, the instruments, in 
my opinion, were not adequate. I can come up with a million 
questions on how to change them and the availability of 
additional input from the engineering staff. 
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It was not available to me, because I did not seek it 
out. I would give whatever question I had to the 
supervisor, and he would refer them to whoever he could 
as far as more operators, more engineers, to get more 
information. And he would bring back whatever 
suggestions there were if there were any. If things were 
that confusing, that I had to turn and ask somebody a 
question, I would wait for their response and their 
instructions on what to do next and then take the prescribed 
action according to what they suggested rather than what 
was on the panel. 

Faust I would way - well, I cannot change it much from 
what he said - we would continue to feed changes that we 
were seeing in the plant, to the supervisor; as well as if we 
thought we knew something that should be done, we would 
be saying that, too. 

Reis: In terms of the layout of the plant, in general, do you 
think there could be some significant changes that would 
make your job a lot easier? 

Frederick: Yes. 

Faust Definitely, [p. 155] 


Cheney: It seems to me that is a key point. Has this ever 
been questioned before, whether or not the pressurizer 
level was an accurate reflection of the reactor coolant level, 
in a general sense, in terms of the basic design of the 

McMillan: I think a lot of people have asked that question: 
What does the pressurizer level indicate to you? 

Cheney: I would just like to come back to that basic 
question: Whether or not those operators at Three Mile 
Island on that day were trained to read that pressurizer level 
as anything other than indicating reactor level, coolant level 
in the reactor? 

McMillan: Let us trace that through and see if we can find what 
evidence. 

Cheney: Do you think that is some flaw in the design of the 
reactor? 

McMillan: No, sir. 

Cheney: Why not have a coolant level indicator from within the 
reactor itself? 

McMillan: That has been suggested by a number of people, post 
Three Mile Island. 

Weaver: Mr McMillan, how do you measure the level of water in 
the reactor vessel? 

McMiUan:You do not measure the level of water in the reactor 

Weaver: But is that not an important thing to know? Why do 
you not have something that tells us the level of the water? 
McMillan: Well, I think- 

Cheney: I guess I would like to follow up on this. [p. 232] 


Weaver: Are you opposed, Mr McMillan, to water level 
measurement in the reactor vessel? 

McMillan: It is a difficult problem, yes. But I am not at this 
point saying it is insurmountable ... 

Weaver: I would say the first thing I was going to do, if I were 
going to design a nuclear plant, is to make sure we knew what 
the water level was. [p. 237] 


a In addition to the personnel identified in Section A21.1, the tran¬ 
script extracts given above refer to the following: Mr Cheney, 
Mr Vento, Mr Weaver, all Congressmen; Mr Reis, Congressional staff; 
Mr D.Eisenhut, Deputy Director, Division of Operating Reactors, 
Office of Nuclear Reactor Regulation, NRC; Mr MacMillan, Vice- 
President, Nuclear Power Generation Division, Babcock and 
Wilcox Co. 


Table A21.4 The alarm problem at Three Mile 
Island: evidence given to Congressional committee (after 
Lees, 1980e, based on US Congress, 1979) 


Weaver: The plant manager told me he thought 100 audio 
alarms were going off at one time. 

Stella: Is that what he told you? 

Weaver: Yes 

Stella: I would not be surprised. 

Weaver: All occurring in the control room? 

Mattson: Yes. 

Carr: And there is no instrumentation that helps the operator sort 
out the order of importance of these alarms, or the order of 
importance of gages or lights or switches; right? 

Mattson: Only the training. 

Carr: Only the training to assemble all of these instruments 
and react in split seconds, [p. 31] 

Weaver: How are people able to differentiate between these 
various alarms? 

Michelsen: I am not a human factors engineer. I have never studied 
control rooms enough to understand that area at all. It is a very 
good question. I have asked it sometimes myself, [p. 47] 

Higgins: There were a lot of short-term problems that were 
being addressed also; that is, equipment problems, loss of 
power, additional alarms that continued throughout the day, 
and we did not mention the number of alarms; there were a 
large number of equipment starts and stops, large number of 
individual problems ... [p. 97] 

Weaver: Would you describe the alarms that were going off? 
Were they going just constantly or was it - 
Higgins: One would occur; the operators would address that. 
And then another one, perhaps a little bit later another one, or 
if you have a particular event, a specific event, for example the 
hydrogen burning in the containment might generate several; 
or a particular release of radioactivity from an area in the 
auxiliary building might generate several related alarms. Like 
generally there are a lot of indicators of a particular event as 
Mr Michelson described, on relief valve. You have got a relief 
valve tailpipe temperature alarm; you have got an alarm in the 
reactor drainpipe, I believe; level indications, and perhaps 
alarms associated with those system pressure alarms. 

All this has to do with one relief valve lifting, so when a 
particular event occurs, you may get several related alarms, all 
of which have to be addressed, [p. 99] 

Higgins: If you have a scram, many alarms do come in as a 
result of that. Some are normal; some indicate things not being 
normal. And it is up to the operator by his training to 
distinguish which ones he expects, which ones not to expect, 
that type of thing, [p. 100] 

Higgins: There was a tremendous amount of activity going on 
in the control room. A lot of people were involved with a lot 
of the different problems, and that was one of many things. 
Operators were - alarms were going off; pumps were being 
started and stopped; valves were being cycled, and this* was 
just one of a myriad of those things that was occurring 
throughout the entire day. And I was thoroughly not able to 
follow what was going on. And I did not pick it up at all. [p. Ill] 
[*A spike on a recorder probably indicating a hydrogen burn - 
FPL], 

Frederick: The alarms — this is a big problem. There is only 
one audible alarm in the control room for the 1600 alarm 
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windows that we have, in other words, the ones that are 
displayed on the front of the console along with the ones on the 
reverse panel. So that during the emergency, I made a point of 
announcing that I did not want anybody to acknowledge the 
alarm, that is, push the acknowledgement to silence the alarm, 
because that would make all the windows stop flashing, and I 
wanted to read them all to see what was happening. As we 
began to run out of ideas, I wanted to review all of the alarms 
that we received to see if anything was happening that we 

Frederick : There are several steps in the alarm process. As the 
alarm comes in, it sounds an alarm and a flashing light. As 
long as the alarm stays in - and you push the button, and the 
light will go solid. If in the meantime the alarming condition 
clears itself or goes away and you push the button, the light will 
go out and you will not be able to tell that it ever came in. If you 
have three or four alarms at the same time, only one may stay lit 
out of the three or four. We had probably 100 or 200 alarms 
flashing within the first few minutes. 

Frederick : I would not be able to establish the chronology. I just 
wanted to see what systems were affected by the transient and 
if we could see something. There are some alarms you expect to 
get. If you read over them, you just discount them as being 
normal. But there may be a few that come in that you had not 
expected, and those are the ones I was looking for. [p. 136] 

Frederick : No. The sequence of alarms that comes out of the 
computer that they were able to read later on was backlogged. 
The alarms came in 100 at a time. The computer, the IBM 
typewriter just types them out one at a time. So as they were 
coming in rapidly, probably 10 or 15 per second, it just could not 
keep up. So there was a backlog of maybe 2 or 3 h. 

Faust. I do not know what time this fits into, but wehad problems 
with the alarm typewriter, too, at this time. I do not know what 
it was, but the easiest way for me to say it is, it sort of started 
eating the paper. In other words, it got off the track, [p. 137] 

Vento: Obviously the proper procedure here would have said 
that 300° or 280° in the tailpipe should have been an 
indication. 

Frederick : That is the point he is talking about. In other words, 
what came out of the computer on the typewriter was an alarm 
that said: Temperature hot. But we could not see that, because 
the alarm typewriter was backlogged several hours, [p. 139] 

Weaver: Now I am troubled by the newspaper reports. One 
report, early on, had it that there was just page after page of 
computer printout of question marks. 

Miller: Looking back - and we can come back to you with 
further information, but there was a period of time in the first 2 
to 3 h where the computer failed, I believe. 

Zewe: Yes, for over an hour period, it did not give us any 
information. 

Cheney: You mean you would query it and nothing would 
happen? 

Zewe: No. The question marks, periods, and so forth, the 
computer had hung up, where it really did not scan the 
parameters and print on in a fashion where we could interpret 

Cheney: It was unusable. 

Miller: I thing Bill would back this up. He was not using that 
totally. He was just using his console to operate the plant, so 
when that went out, he just had to go away from it. 

Weaver: What caused this? What was going on? What 
happened? We have it here in the chronology that 1 hour 13 to 
2:37 - in other words - 


Miller: I think, in fairness, the machine has got a tape, disc, and 
that sort of thing. It has experienced problems. It is not a vital 
piece of equipment to Bill’s use of the emergency procedures or 
operations of the plant, so I would guess Bill would just simply 
have told an electrical engineer to call someone in and go on 
with the console. 

Weaver: You do not have to have it in any way? 

Zewe: No, it is just an operator’s tool, but it is not anything that 
is really that critical to the operation, [p. 175] 


a In addition to the personnel identified in Section A21.1 and 
Table A21.3, the transcript extracts given above refer to the following: 
Mr Carr, Congressman; Mr Stello, Director, Division of Operating 
Reactors, Office of Nuclear Reactor Regulation, NRC; Mr Mattson, 
Division of System Safety, Office of Nuclear Reactor Regulation, NRC; 
Mr Michelson, Nuclear Engineer, Tennessee Valley Authority; and 
Mr Higgins, Region I, Office of Inspection and Enforcement, NRC. 


A21.8.3 Kemeny Report 

The Kemeny Report gives an account of the accident, from 
29 March to 2 April, presents findings and makes recom¬ 
mendations. Some findings are described in this section. 

The reports starts with what it calls ‘people-related pro¬ 
blems’. It states 

Popular discussions of nuclear power plants tend to con¬ 
centrate on questions of equipment. Equipment can and 
should be improved to add further safety to nuclear 
power plants, and some of our recommendations deal 
with this subject. But as the evidence accumulated, it 
became clear that the fundamental problems are people- 
related problems and not equipment problems. 

When we say that the basic problems are people- 
related, we do not mean to limit this term to shortcomings 
of individual human beings - although these do exist.We 
mean more generally that our investigation has revealed 
problems with the ‘system’ that manufactures, operates 
and regulates nuclear power plants.There are structural 
problems in various organizations, there are deficiencies 
in various processes, and there is a lack of communication 
among key individuals. 

We are convinced that if the only problems were equip¬ 
ment problems, this Presidential Commission would 
never have been created. The equipment was sufficiently 
good that except for human failures, the major accident at 
Three Mile Island would have been a minor incident. But, 
wherever we looked, we found problems with the human 
beings who operate the plant, with the management 
that runs the key organization, and with the agency that 
is charged with assuring the safety of nuclear power 
plants, (p. 8) 

The form frequently taken by this problem is described as 
follows: ‘In the testimony we received, one word occurred 
over and over again. That word is “mindset”.’ (p. 8) 

The report is critical of the approach taken to control of 
the industry, stating: 

We note a preoccupation with regulations. It is, of course, 
the responsibility of the Nuclear Regulatory Commission 
to issue regulations to assure the safety of nuclear power 
plants. However, we are convinced that regulations alone 
cannot assure safety. Indeed, once regulations become as 
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voluminous and complex as those regulations now in place, 
they can serve as a negative factor in nuclear safety. The 
regulations are so complex that immense efforts are 
required by the utility, by it suppliers and by the NRC to 
assure that regulations are complied with. The satisfaction 
of regulatory requirements is equated with safety This 
Commission believes that it is an absorbing concern with 
safety that will bring about safety - not just the meeting of 
narrowly prescribed and complex regulations, (p. 9) 

The report makes various criticisms of the NRC, of which a 
sample, changed in order, are: 

We found serious managerial problems within the orga¬ 
nization. These problems start at the very top... It is not 
clear to us what the precise role of the five NRC commis¬ 
sioners is, and we have evidence that they themselves are 
not clear what their role should be ... NRC’s primary 
focus is on licensing and insufficient attention has been 
paid to the ongoing process of assuring safety... NRC is 
vulnerable to the charge that it is heavily equipment- 
oriented, rather than people oriented. . .We are extremely 
critical of the role the organization played in the response 
to the accident... NRC has sometimes erred on the side 
of the industry’s convenience rather than carrying out 
its primary mission of assuring safety.. .(pp.19-21) 
The Commission identifies an over-concentration on large 
accident hazards: 

We find a fundamental fault even with the existing body 
of regulations. While scientists and engineers have wor¬ 
ried for decades about the safety of nuclear equipment, 
we find that the approach to nuclear safety has a major 
flaw. It was natural for the regulators and the industry to 
ask: ‘What is the worst kind of equipment failure that can 
occur?’ Some potentially serious scenarios, such as the 
break of a huge pipe that carries the water cooling to the 
nuclear reactor, were studied extensively and diligently, 
and were used as the basis for the design of plants. 
A preoccupation developed with such large-break acci¬ 
dents as did the attitude that if they could be controlled, 
we need not worry about the analysis of ‘less important’ 
accidents, (p. 9) 

A potentially insignificant incident grew into theTMI 
accident, with severe damage to the reactor. Since such 
combinations of minor equipment failures are likely to 
occur much more often than the huge accidents, they 
deserve extensive and thorough study, (p. 9) 

The report is critical of organizational failure to follow 
through safety issues: 

We find that there is a lack of ‘closure’ in the system -that 
is, important safety issues are frequently raised and may 
be studied to some degree of depth, but are not carried 
through to resolution; and the lessons learned from these 
studies do not reach those individuals and agencies that 
most need to know about them. (p. 11) 

The report reopens the issue of the influence of the opera¬ 
tor in a developing reactor emergency. The conventional 
approach has been that any action taken by the operator 
is likely to be beneficial. It gives this view as an example 
of designers’ mindset: ‘They concentrated on equipment, 
assuming that the presence of operators could only improve 
the situation - they would not be part of the problem’, 
(pp. 8-9). 


On the handling of the emergency the Commission 
comments: 

We are disturbed both by the highly uneven quality of 
emergency plans and by the problems created by multiple 
jurisdictions in case of a radiation emergency. Most 
emergency plans rely on prompt action at local level to 
initiate a needed evacuation or to take other protective 
action. We found an almost total lack of detailed plans in 
the local communities around Three Mile Island. It is one 
of the many ironies of this event that the most relevant 
planning by local authorities took place during the acci¬ 
dent. In an accident in which prompt defensive steps are 
necessary within a matter of hours insufficient advance 
planning could prove extremely dangerous, (p. 15) 

The report contains a number of supplemental views by 
individual members of the commission, one of which is by 
ProfessorT.H. Pigford. He is critical of the NRC’s approach 
to safety, which he characterizes as lacking in experienced 
personnel; failing to take a comprehensive approach with 
quantified safety objectives and rational priorities; and 
prone to introduce arbitrary requirements. He calls it 
‘A stifling approach. The existing process inhibits the 
interchange of technical information between the NRC and 
industry. It discourages innovative engineering solutions’. 
On human factors aspects he states 

The emphasis in this report upon equipment versus 
people obscures the fact that the equipment itself is only 
one product of the defense-in-depth or multiple-barrier 
design approach, which also encompasses the analysis 
of how components must perform and how systems 
of equipment must operate. The accident demonstrated 
that this system of equipment performed better than 
expected. 

The nature of the people-related problem needs clar¬ 
ification. One such problem - and a most serious one - 
was the errors made by the operators and the operator- 
supervisors, whose training was insufficient in scope 
and understanding. Another was failure of many indivi¬ 
duals to respond adequately to earlier experience 
from other reactors and to other advance information 
that might have alerted the operators and avoided the 
accident. 


A21.9 Some Lessons of Three Mile Island 

A21.9.1 Kemeny Report recommendations 

The Kemeny Report and the Task Force Report both give 
extensive recommendations. The heads of these recom¬ 
mendations are shown in Table A21.5, in Sections A and B, 
respectively. 

The Kemeny Report recommends that the NRC should be 
restructured as a new independent agency in the executive 
branch and that the ACRS should be strengthened. 

The report states: ‘To the extent that the industrial 
institutions we have examined are representative of the 
nuclear industry, the nuclear industry must dramatically 
change its attitude towards safety and regulations’. It goes 
on The industry should establish a program that specifies 
appropriate safety standards including those for manage¬ 
ment, quality assurance, and operating procedures and 
practices, and that conducts independent evaluations’. 

Improvements in operator training are called for, with 
particular emphasis on the use of simulators. 
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Table A21.5 Heads of some principal recommendations 
on Three Mile Island 


A Presidents Commission (Kemeny, 1979) 

Nuclear Regulatory Commission 
Utility and it suppliers 
Training of operating personnel 
Technical assessment 
Worker and public health and safety 
Emergency planning and response 
Public’s right to information 

B ‘Lessons Learned’ Task Force (Nuclear 
Regulatory Commission, 1979b) 

Personnel qualifications and training 
Staffing of control room 
Working hours 
Emergency procedures 

Verification of correct performance of operating activities 

Evaluation of operating experience 

Man-machine interface 

Reliability assessments of final designs 

Review of safety classifications and qualifications 

Design features of core-damage and core-melt accidents 

Safety goal for reactor regulation 

Staff review objectives 

NRR Emergency Response Team 


Under the heading of technical assessment, the report 
deals with equipment for information display in the control 
room and for mitigating the consequences of accidents 
and recommends a formal safety assurance programme 
involving hazard identification and assessment. 

The report recommends that there should be a require¬ 
ment for an emergency response plan. 

It also makes recommendations on worker and public 
health in relation to nuclear hazards and on the public’s 
right to information. 


A21.9.2 Task Force Report recommendations 

The recommendations of the Task Force Report are 
summarized in Section B of Table 21.5. They deal particu¬ 
larly with operator training and with the man-machine 
interface. 

The report calls for a thorough review of control room 
design and for development of aids to assist the operator in 
assessing the status of the plant and in analysing dis¬ 
turbances and alarms. It proposes the development both of 
a plant safety status display system and of a disturbance 
analysis system (DAS). 

On the former the report states 

Each licensee should be required to define and ade¬ 
quately display in the control room a minimum set of 
plant parameters (in control terminology, a state vector) 
that defines the safety status of the nuclear power plant. 
The minimum set of plant parameters should be anno¬ 
tated for sensor limits, process limits, and sensor status. 
The annotated set of parameters should be presented to 
the operator in real time by a reliable, single-failure-proof 
system located in the control room. (p. A-12) 


Table A21.6 Some lessons of Three Mile Island 


Regulatory control of major hazard installations 

People-related versus equipment-related problems 

Formal safety assurance 

Relative importance of large and small failures 

Influence of operator in an emergency 

Fault diagnosis by the process operator 

Accident management for major hazard installations 

Follow-up of safety issues 

Learning from precursor events 

Package and other ancillary units 

Display of variable of interest 

Plant status display and disturbance analysis systems 

Abuse of instrument air 

Limitations of non-return valves 


A21.9.3 Some lessons 

The Three Mile Island incident yields numerous lessons. 
Some of these are listed in Table A21.6. Many of these les¬ 
sons are drawn in the reports just described. 

Regulatory control of major hazard installations 
The comments made in the Kemeny Report on the regu¬ 
latory regime for US nuclear power plants under the NRC 
both echo those made in the Robens Report in the UK in 
1972 and themselves find an echo in those of the Cullen 
Report on UK offshore installations in 1990. In all three 
cases the reports are critical of an approach which they find 
excessively prescriptive. 

People-related versus equipment-related problems 
The theme which runs through the Kemeny Report is that 
equipment-related problems have received attention at the 
expense of people-related problems. The account of these 
problems given in the report indicates clearly that the term 
refers not just to process operators, although operator prob¬ 
lems were a central issue, but to management and man¬ 
agement systems. Here too, the report may be said to look 
back to Robens and forward to Cullen. 

Formal safety assurance 

The Kemeny Report calls for a formal safety assurance 
programme for nuclear power plants involving hazard 
identification and assessment. In UK terms, its recom¬ 
mendations parallel those of the ACMH for onshore plant 
and of the Cullen Report for offshore installations, which 
uses the term‘formal safety assessment’. 

Relative importance of large and small failures 
Engineers in the nuclear industry had tended to concentrate 
their attention on major failures, notably the large loss of 
coolant accident, to the relative neglect of lesser events, 
such as a small, or at least slower, loss of coolant, such as 
actually occurred atTMI. Yet, as the incident showed, such 
lesser events can escalate. Moreover, lesser events occur 
much more frequently. There needs to be a more balanced 
approach which addresses small as well are large failures. 

Influence of operator in an emergency 
It has been a basic assumption in the industry that in a 
nuclear emergency operator action would be beneficial, and 
that the longer the time available for such action the higher 
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the probability that it would be taken. TMI showed that 
this is not necessarily so, and that operator action can be 
detrimental. 

Fault diagnosis by the process operator 
The incident highlighted the problem of fault diagnosis by 
the process operator under stress. It showed the limitations 
of fixed operating rules in dealing with abnormal situa¬ 
tions and the dangers of tunnel vision, or mindset. In other 
words, it showed the inadequacy of rule-based behaviour 
and the need for knowledge-based behaviour and for 
training based on development of the latter. 

Accident management for major hazard installations 
TMI shows that a major accident poses a number of diffi¬ 
cult problems and that it needs to be managed. This implies 
that accident management must be recognized as a specific 
requirement and planned in advance. 

The handling of an emergency in the control room is one 
aspect of the problem, but there are many others. They 
include the identification, mobilization, direction and 
coordination of the necessary resources; planning for an 
emergency, both on-site and off-site; and handling of the 
media. 

Follow-up of safety issues 

The Kemeny Report is critical of the follow-up of safety 
issues, referring to a lack of closure. Safety issues which are 
raised and agreed to be valid need to be followed through to 
resolution. Personnel who most need to know should be 
informed. 

Learning from precursor events 

There had been previous incidents in which a PORV had 
been stuck in the open position, but the management of the 
TMI plant had no systematic approach to learning from 
such incidents. 


Package and other ancillary units 

Turning to some more detailed aspects, the incident started 

with a fault in the condensate polishing system, a package 

unit. It illustrates the point that the ancillary equipment 

and services should receive their due share of attention, 

starting with specification and continuing right through to 

operation. 

Display of variable of interest 

If a process variable is critical, it is highly desirable that the 
quantity which is displayed should be the variable of direct 
interest. At TMI there were two cases where this was not 
done. One is the water level in the pressure vessel. The other 
is the status of the PORV The display showed the signal to 
the valve rather than the actual valve position. 

Plant status display and disturbance analysis systems 
TMI was a dramatic illustration of the difficulties faced 
regularly by process operators in interpreting displays and 
alarms, and of way in which these can be compounded by 
information overload. It highlighted the scope for the 
development of improved display and alarm systems and 
for the exploitation of computers to this end. The principal 
aids proposed were plant safety status display systems and 
disturbance analysis systems. 

Abuse of instrument air 

The air used to clear the blockage on the condensate pol¬ 
ishing system was instrument air. It is bad practice to con¬ 
nect instrument air to the process, which can cause it to 
become contaminated. 

Limitations of non-return valves 

The entry of water into the instrument air system illus¬ 
trates the limitations of a non-return valve. Such a valve is 
intended to stop bulk flow of fluid; it will not necessarily 
prevent the passage of trace quantities. 
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On Monday 28 April 1986 a worker at the Forsmark nuclear 
power station in Sweden put his foot in a radiation detector 
for a routine check and registered a high reading. The sta¬ 
tion staff thought they had had a radioactive release from 
their plant and the alarm was raised. However, as reports 
came in of high radioactivity in Stockholm and Helsinki, 
the source of the release was identified as the Soviet Union. 
In fact, an accident had occurred on Unit 4 at Chernobyl in 
the Ukraine some 800 miles from Sweden on Saturday 26 
April. 

At 1.24 on that day an experiment to check the use of 
the turbine during rundown as an emergency power supply 
for the reactor went catastrophically wrong. There was a 
power surge in the reactor, the coolant tubes burst and a 
series of explosions rent the concrete containment. The 
graphite caught fire and burnt, sending out a plume of 
radioactive material. Emergency measures to put out the 
fire and stop the release were not effective until 6 May. 

The Soviet Government set up an investigatory team 
headed by N.I. Ryzhkov, President of the USSR Council of 
Ministers, to investigate. A report The Accident at the 
Chernobyl Nuclear Power Plant and its Consequences by the 
USSR State Committee on the Utilisation of Atomic Energy 
(1986) (the USSR State Committee Report) was presented in 
August 1986 to a meeting of experts at the IAEA in Vienna 
by V Legasov. 

Other accounts of the accident include Summary Report 
on the Post-Accident Review Meeting on the Chernobyl Acci¬ 
dent by the IAEA (1986), The Chernobyl Accident and its 
Consequences by Gittus et al. (1987, 1988) (the UKAEA 
Report), Chernobyl and the Safely of Nuclear Reactors in 
< )ECl) Countries by the NEA (1987), Report on the Accident 
at Chernobyl Nuclear Power Station by the NRC (1987b), The 
Chernobyl Accident and its Consequences for the United 
Kingdom by Worley and Lewins (1988) (the First Watt 
Committee Report), Chernobyl. A Policy Response Study by 
Segerstahl (1991) and Five Years after Chernobyl: 
1986-1991 by the Watt Committee (1991) (the Second Watt 
Committee Report) and by Franklin (1986) and Kletz 
(1988h). 

The story of Chernobyl is told in The Worst Accident in 
the World by Haynes et al. (1986), Mayday at Chernobyl 
by Hamman and Parrott (1987), The Chernobyl Disaster by 
Haynes and Bojcum (1988), Chernobyl. The Real Story by 
Mould (1988) and Ablaze by Read (1993) and by Franklin 
(1986) and Kletz (1988h). 

Selected references on Chernobyl are given in Table 22.1. 


Table A22. 1 Selected references on Chernobyl 


NRC (Appendix 28 Chernobyl)', BNES (1986); Franklin 
(1986); Hawkes et ol. (1986);'lAEA (1986); IBC (1986/69); 
USSR State Committee on the Utilization of Atomic Energy 
(1986); Watt Cttee on Energy (1986,1991); Collier and 
Davies (1987); Gittus et al. (1987); Hall, Hall and Nixon 
(1987 LPB 76); Hamman and Parrot (1987); NEA (1987); 
NRC (1987b); F. Allen (1988); Ballard (1988); Haynes and 
Bojcum (1988); Kletz (1988h); Marples (1988,1991); 

V.C. Marshall (1988 LPB 81); Mould (1988); Wheeler (1988); 
Worley and Lewins (1988); Gudiksen, Harvey and Lange 
(1989); Konstantinov and Gonzalez (1989); Parmentier and 
Nenot (1989); Voznyak, Kovalenko and Troitsky (1989); 
Hass et al. (1990); Ryin et al. (1990); Ottewell (1991); 
Segerstahl (1991); Read (1993) 


A22.1 The Operating Organization and 
the Management 

Little information has become available concerning the 
organization operating the Chernobyl plant or about its 
management. 

A22.2 The Site and the Works 

The Chernobyl nuclear power station is situated in a region 
which at the time was relatively sparsely populated. There 
were some 135,000 people within a 30 km radius. Of 
these 49,000 lived in Pripyat to the west of the plant’s 3 km 
safety zone and 12,500 in Chernobyl 15 km to the south-east 
of the plant. 

There were four nuclear reactors on the site. The first 
pair had been built in the period 1970—77 and the second 
pair were completed in 1983. 

A22.3 The Process and the Plant 

Unit 4 at Chernobyl was designed to supply steam to two 
turbines each with an output of 500 MWe. The reactor was 
therefore rated at 1000 MWe or 3200 MWt. 

Unit 4 was an RBMK-1000 reactor, which is a standard 
design widely used in the Soviet Union. The RBMK-1000, 
shown in Figure A22.1, is a boiling water pressure tube, 
graphite moderated reactor. The reactor is cooled by boiling 
water, but the water does not double as the moderator, 
which is graphite. 

The design of the reactor avoided the use of a large 
pressure vessel. Instead, use was made of much smaller 
individual pressurized fuel channels. The reactor had 1661 
fuel channels. There was in each one a fuel assembly, 
divided into two subassemblies, each containing 18 fuel 
elements. 

The reactor contained 192 te of uranium enriched to 2 %. 
The subdivision of the uranium into a large number of 
separately cooled fuel channels greatly reduced the risk 
of total core meltdown. 

The reactor was cooled by water passing through the 
pressure tubes. The water was heated to boiling point and 
partially vaporized. The steam—water mixture with a mass 
steam quality of 14% passed to two separators where steam 
was flashed off and sent to the turbines, while water was 
mixed with the steam condensate and fed through down¬ 
comers to pumps which pumped it back to the reactor. There 
were two separate loops each with four pumps, three oper¬ 
ating and one standby. This system constituted the multiple 
forced circulation circuit (MFCC). 

The moderator used was graphite. The reactor contained 
a stack of 2488 graphite blocks with a total mass of 1700 te. 

An emergency core cooling system (ECCS) was provided 
to remove residual heat from the core in the event of loss 
of coolant from the MFCC. 

The reactor was provided with a control and protection 
system (CPS). The control system incorporated a control 
computer. There was a control system which controlled the 
power output of the reactor by moving the control rods, in 
and out. Automatic protective systems included a trip to 
bring in the ECCS and reactor shut-down trips. Reactor 
shut-down was effected by the insertion of control rods, and 
conditions which would trigger shut-down included loss of 
steam to the turbines and loss of level in the separators. 

The reactor was housed in a containment built to 
withstand a pressure of 0.45 MPa. There was a ‘bubble’ 
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Figure A22. 1 Simplified flow diagram of Chernobyl Unit 4 (Nuclear Regulatory Commission, 1987b) 


condenser designed to condense steam entering the con¬ 
tainment from relief valves or from rupture of the MFCC. 

An important operating feature of the reactor was its 
reactivity margin, or excess reactivity. Below a certain 
power level the reaction would be insufficient to avoid xenon 
poisoning. It was therefore necessary to operate with a cer¬ 
tain excess reactivity. This reactivity could be expressed 
in terms of the number of CPS control rods which would 
need to be inserted to counter it. The operating instructions 
stated that a certain excess reactivity was to be maintained; 
the equivalent number of control rods was 30. 

Another important operating characteristic was the 
reactor’s ‘positive void coefficient’. An increase in heat from 
the fuel elements would cause increased vaporization of 
water in the fuel channels and this in turn would cause 
increased reaction and heat output. There was therefore an 
inherent instability a positive feedback, which could be 
controlled only by manipulation of the control rods. Control 
of the reactor at normal power output presented little 
problem, but this feature made the reactor highly sensitive 
at low outputs. 


A22.4 Events Prior to the Release 

The origin of the accident was the decision to carry out a 
test on the reactor. Electrical power for the water pumps 
and other auxiliary equipment on the reactor was supplied 
by the grid with diesel generators as back-up. However, in 
an emergency there would be a delay of about a minute 


before power became available from these generators. 
The objective of the test was to determine whether during 
this period the turbine could be used as it ran down to 
provide emergency power to the reactor. A test had already 
been carried out without success, so modifications had 
been made to the system, and the fresh test was to check 
whether these had had the desired effect. 

A programme for the test was drawn up. It included 
provision to switch off the ECCS during the test, appar¬ 
ently to prevent its being triggered during the test. 

At 1.00 on 25 April the reduction of power began. At 
13.05 Turbogenerator 7 was switched off the reactor. At 
14.00 the ECCS was disconnected. However, a request was 
received to delay shutting down since the power output 
was needed. It was not until 23.10 that power reduction 
was resumed. 

At some stage the trip causing reactor shut-down on loss 
of steam to Turbogenerator 8 was disarmed, apparently so 
that if the test did not work the first time, it could be repeated. 
This action was not in the experimental programme. 

The test programme specified that rundown of the tur¬ 
bine and provision of unit power requirements was to be 
carried out at a power output of 700-1000 MWt, or 20% of 
rated output. The operator switched off the local automatic 
control, but was unable to eliminate the resultant imbal¬ 
ance in the measurement function of the overall automatic 
controls and had difficulty in controlling the power 
output, which fell to 30 MWt. Only at 1.00 on 26 April was 
the reactor stabilized at 200 MWt, or 6% of rated output. 
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Meanwhile the excess reactivity available had been 
reduced as a result of xenon poisoning. 

It was nevertheless decided to continue with the test. 
At 1.03 the fourth, standby pump in one of the loops of the 
MFCC was switched on and at 1.07 the standby pump in 
the other loop. 


A22.5 The Release - 1 

With the reactor operating at low power, the hydraulic 
resistance of the core was less and this combined with the 
use of additional pumps resulted in a high flow of water 
through the core. This condition was forbidden by the 
operating instructions, because of the danger of cavitation 
and vibration. The steam pressure and water level in the 
separators fell and other process parameters changed. In 
order to avoid triggering the trips which would shut-down 
the reactor on these parameters, the trips were disarmed. 

The reactivity continued to fall and at 1.22.30 the opera¬ 
tor saw from a printout of the reactivity evaluation program 
that the available excess reactivity had fallen below a level 
requiring immediate reactor shut-down. Despite this the 
test was continued. 

At 1.23.04 the emergency valves on Turbogenerator 8 
were closed. The reactor continued to operate at about 200 
MWt, but the power soon began to rise. At 1.23.40 the unit 
shift foreman gave the order to press the scram button. The 
rods went down into the core, but within a few seconds 
shocks were felt and the operator saw that the rods had not 
gone fully in. He cut off the current to the servo drives to 
allow the rods to fall in under their own weight. 

Within 4 s, by 1.23.44, the reactor power had risen, 
according to Soviet estimates, to 100 times the nominal 
value. 


At about 1.24, according to observers outside Unit 4, 
there were two explosions, the second within some 3 s of the 
first, and debris and sparks shot into the air above the 
reactor. 

It is thought that the fuel fragmented, causing a rapid 
rise in steam pressure as the water quenched the fuel 
elements, so that there was extensive failure of the pressure 
tubes. The explosive release of steam lifted the reactor top 
shield, exposing the core. Conditions were created for 
reaction between the zirconium and steam, producing 
hydrogen. An explosion, involving hydrogen, occurred 
in and ruptured the containment building, and ejecting 
debris and sparks were seen. 

Some 30 fires broke out. 

The accident was aggravated by the fact that the 200 te 
loading crane fell onto the core and caused further bursts of 
the pressure tubes. 

The stricken reactor is shown in Figure A22.2. 

The timetable of these and the following events is shown 
inTable A22.2. 


A22.6 The Emergency and the Immediate Aftermath 

The fire brigades from Pripyat and Chernobyl set out at 
1.30. The fires in the machine hall over Turbogenerator 7 
were particularly serious, because they threatened Unit 3 
also. These therefore received priority. By 5.00 the fires in 
the machine hall roof and in the reactor roof had been 
extinguished. 

However, the heating up of the core and its exposure to 
the air caused the graphite to burn. The residual activity of 
the radioactive fuel provided another source of heat. The 
core therefore became very hot and the site of raging fire. 

During the next few days the fire raged and a radio¬ 
active plume rose from the reactor. The accident had 



Figure A22.2 Reactor of Chernobyl Unit 4 after the explosions (ITAR-TASS) 
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Table A22.2 Timetable of events at Chernobyl 


A Events prior to initial explosion 


25 April 


26 April 


1.00 Reduction of power started 

13.05 Turbogenerator 7 disconnected 

14.00 ECCS disconnected 

23.10 Power reduction resumed 

00.28 Operator switches off local automatic control, but is unable to eliminate resultant imbalance in 
measurement function of the overall automatic controls 
Power output falls to 30 MWt 
1.00 Reactor stabilized at 200 MWt (6% rated output) 

1.03 Standby pump switched on in one loop of MFCC 

1.07 Standby pump switched on in other loop of MFCC 

before 

1.19 Trips on low steam pressure and low water level disabled 

1.22.30 Printout confirming fall in excess reactivity 

1.23.04 To begin test, stop valve on steam to Turbogenerator 8 closed 

Trip on closure of both turbogenerator steam stop valves disabled 
1.23.40 Scram button pressed to drop control rods 

1.23.40 Operator hears banging noises and sees rods stopping before they reach bottom; disengages 
servo drives to allow rods to fall under own weight 
Rapid increase in power 

1.23.48 First explosion - extensive failure of pressure tubes, explosive release of steam, top lifted off 
reactor 

1.24 Second explosion - explosion within reactor space, possibly involving hydrogen, pressure increase 
to several MP, rupture of containment building 
Numerous fires 


B Events after initial explosion 


26 April 2.54 

3.34 

3.54 

5.00 

27 April 1.13 
27 April 

6 May 


Fire fighting units from Pripyat and Chernobyl arrive 

Most of fires in turbine room roof out 

Fire on reactor building roof out 

All fires, other than those in core, out 

Unit 3 shut-down 

Units 1 and 2 shut-down 

Start of smothering operation using helicopters 

Discharge of radioactivity drops to several hundred Ci/h 


become a major disaster. It was necessary to evacuate the 
population from a 30km radius round the plant and deal 
with the casualties and to take a whole range of measures 
to dampen and extinguish the fire, to cover and enclose 
the core, and to deal with the radioactivity in the 
surrounding area. 

Three evacuation zones were established: a special zone, 
a 10km zone and 30km zone. The latter zone is shown in 
Figure A22.3. A total of 135,000 people were evacuated. 

Accounts of the evacuation are incomplete and some¬ 
times contradictory, but what appears to have happened is 
as follows. Within a few hours of the accident an emergency 
headquarters was set up in Pripyat. About 14.00 on 26 April 
there was an evacuation of some 1000 people from within a 
1.6 km zone around the plant. A much larger evacuation 
took place about 14.00 next day, when about 1000 buses 
were brought in and within 2 h had evacuated some 40,000 
people. However, it was not until some 9 days later that the 
authorities in Moscow ordered complete evacuation from 
a 30 km zone around the site. 

First reports from Kiev spoke of no apparent concern, 
but as the nature of the disaster became known, parents 
hastened to send their children out of the city to relatives 
elsewhere. 


A medical team was set up within 4 h of the accident and 
within 24 h triage of the 100 most serious cases had been 
effected. 

A system was set up to control movements between the 
zones. People crossing the zone boundaries had to change 
clothing and vehicles were decontaminated. 

In the immediate aftermath of the accident steps were 
taken to obtain the measurements essential to the control of 
the emergency. These included the measurement not only of 
the radioactivity in and around the plant, but also of con¬ 
ditions in the reactor relevant to bringing it under control. 
The latter was made more difficult by the fact that the 
regular measurement system had been disabled. 

A decision had to be made whether to let the fire burn 
itself out or to smother it. In view of the hazard to the sur¬ 
rounding area, the latter course was chosen. A specialist 
team was assembled who began to cover the damaged 
reactor with compounds of boron, dolomite, sand, chalk 
and lead. Between 27 April and 10 May some 5000 te of 
material were dropped on the reactor by helicopter. By May 
6 the release of radioactivity had decreased to a few 
hundred Ci/day and had ceased to be a major factor. 

At the same time the core temperature was tackled by 
pumping nitrogen under pressure from the compressor 
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Figure A22.3 Evacuation Zone and Contamination Zone around Chernobyl site (after Watt Committee, 1991) 


station into the space beneath the reactor vault. This 
reduced the oxygen concentration and the temperature. By 
6 May the temperature rise had been halted and the tem¬ 
perature began to decline. 

Meanwhile Soviet experts were concerned about the 
hazard of the large amount of water directly beneath the 
reactor. If the core were to come into contact with this water, 
there could be massive and explosive vaporization into 
steam. Engineers went down through dark passages 
flooded with radioactive water and succeeded in opening 
two large valves to allow the water to drain out. 


Next an attempt was made to put a large concrete slab 
fitted with cooling coils beneath the core to prevent 
material from the core contaminating the ground and 
watercourses beneath it. Tunnelling in the soil at this point 
was difficult and it was necessary to resort to freezing the 
soil using liquid nitrogen, a method used in building the 
Leningrad Metro. The construction of this concrete bed was 
complete by the end of June. 

Subsequently the reactor was entombed in concrete. 

There was also intense activity to counter the effects of 
radioactivity in the surrounding area. 7000 wells were 
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sealed. The water supply to Kiev could no longer be taken 
from water near the plant and a new water supply for the 
city had to be constructed. A system of dikes was con¬ 
structed to catch radioactive rain water from the area 
around the plant. A system of bore holes and barriers was 
created to prevent contamination of water courses. 

Decontamination measures were also set in train. The 
site itself was divided into zones. The measures taken were 
to remove debris and contaminated equipment, deconta¬ 
minate roofs and outer surfaces of buildings, remove a 
5—10 cm layer of soil into containers, lay where necessary 
concrete or fresh earth on the ground, and coat certain 
surfaces with film-forming compounds. 

Decontamination of the area outside the site was com¬ 
plicated by the fact that the distribution of the radio¬ 
nuclides changed with time according to the terrain, 
particularly during the first 3—4 months. Hence the full 
value of measures to decontaminate a particular area is 
generally obtained only temporarily. Buildings were hosed 
down and the earth around them then removed. Measures 
were developed to allow the contaminated land to be used 
for agriculture: these included changes to methods of cul¬ 
tivation and harvesting and the use of dust-suppression 
materials. 

The accident was the subject of intense press interest 
world-wide, although hard facts were difficult to come by. 
Interest centred on satellite photographs of the burning 
core, evacuation measures taken or not taken, the assis¬ 
tance given by an American bone marrow transplant sur¬ 
geon, potential fallout in other countries and implications 
for nuclear power generally. 

The fire in the reactor was readily seen from above and 
satellite photographs appeared on the world’s television 
screens. These were soon supplemented by Soviet pictures 
of the stricken reactor. 

The death toll from Chernobyl cannot be known with 
certainty, since most deaths will be excess cancers. Two 
men died dealing with the accident itself. By the end of 
September the toll of dead in the USSR was 31 with 203 
injured. The casualties are discussed further in Section 
A22.8. 

Other European countries were also affected. Radio¬ 
active contamination was measured across Europe and 
many countries banned particular products for a period. 

A22.7 The Investigations 

A22.7.1 USSR State Committee Report 

In the West the main source of information on the accident 
was initially the investigation described in the USSR State 
Committee Report. 

Part I of the report gives a brief description of the reactor 
and describes the accident itself. The seven appendices of 
Part II describe the reactor system, the detailed design of 
the reactor, the measures to deal with the consequences, 
the quantity of radioactivity released, the dispersion of the 
radioactive plume and the radioactive deposition, the 
radio-ecological contamination caused, and the medical 
and biological consequences. 

An important feature of the investigation was a simula¬ 
tion of the accident using a mathematical model. This was 
assisted by the fact that the control computer had a pro¬ 
gram which logged several hundred critical parameters 
with a minimum cycle time of 1 s. 


According to the simulation a power surge occurred in 
the reactor which took the output to 530 MWt within 3 s. 
There was intense steam formation and then nucleate 
boiling in the fuel channels and abrupt pressure increase, 
causing bursting of the channels. 

The primary explosion was therefore bursting of the 
fuel channels by high pressure steam. The formation of 
steam and the rapid rise in core temperature created con¬ 
ditions for the steam-zirconium and other reactions. 
These reactions gave rise to hydrogen and carbon mon¬ 
oxide. After the reactor space had been vented and 
destroyed these mixed with air and burnt causing an 
explosion. 

The report criticises both the experimental programme 
and the conduct of the test. It states 
The quality of the programme was poor and the section 
onsafetymeasureswasdraftedinapurelyformalway... 
Apart from the fact that the programme made essentially 
no provision for additional safety measures, it called for 
shutting off the reactor’s emergency core cooling system. 

Because the question of safety in these experiments 
had not received the necessary attention, the staff 
involved were not adequately prepared for the tests and 
were not aware of the possible dangers. Moreover, as we 
shall see in what follows, the staff departed from the 
programme and thereby created the conditions for the 
emergency situation. 

The report highlights the positive void coefficient as a 
problem feature of the reactor design. It lists six violations 
of the operating instructions by the operators and gives the 
motivation for and consequences of each. 

The test programme specified that the ECCS should be 
disconnected. In addition, the reactor shut-down trip based 
on turbogenerator shut-down was disarmed. During the 
actual test the reactor shut-down trip based on coolant 
parameters was disarmed. These three actions were all 
taken to facilitate the test. The three other violations were 
the reduction in the reactivity margin, the switch from local 
automatic power control to manual control and the switch¬ 
ing on of the standby pumps. The first was connected with 
attempts to deal with the poisoning problem and it ren¬ 
dered the protective system ineffective. The second was an 
operator error and it made the reactor much more difficult 
to control. The third was done to make doubly sure of 
adequate cooling and it resulted in loss of level in the 
separator and the decision to disable the reactor shut-down 
trip based on coolant parameters. 

The report also points out that at low power levels the 
measurement of power density in the core is less accurate. 

The report gives an account of the release from the 
damaged reactor and of the emergency measures taken. 

The report records a number of measures being taken to 
prevent a repetition. They include changes to the organiza¬ 
tion responsible for the reactors and to the inspection 
organization and intensification of research on safety 
aspects. 

An important design modification mentioned is the use 
of uranium fuel enriched to 2.4 % rather than 2 % in order to 
try to avoid the positive void coefficient problem. 

In presenting the report to the IAEA Legasov is reported 
as saying that the plant was one of the best in the country 
with good operators who were so convinced of its safety 
that they ‘had lost all sense of danger’. 
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A22.7.2 Other reports 

As described at the start of the section, there have been a 
number of other reports on Chernobyl. The coverage of 
these reports is broadly as follows: 


IAEA NRC NEA Watt UKAEA 
Cttee 

1 2 


Design of 
RBMK 
reactors 

General X 

account 
of events 

Chronology X 

of events 

Radioactive X 

release, 
source terms 

Radioactive X 

dispersion 

Health X 

effects 

Environmental X 

effects, 

decontamination 

Emergency X 

response 

Safety issues X 


X X X X 

X XX 

XX X 

X X XX 

XX X 

X XX 

XX XX 

X 

XX X 


A22.8 The Release 2 

Estimates of the amount of radiation released are given in 
the USSR State Committee Report and several of the other 
reports mentioned. Table A22.3 Section A, based on figures 
given by Konstantinov and Gonzalez (1989), gives one such 
estimate of the total release, while Section B, based on the 
USSR State Committee Report , gives an estimate of the rate 
of release, showing the fall-off after 6 May. 

According to the USSR State Committee Report, on 26 
April the area around the site was in a low gradient pres¬ 
sure field with a slight wind varying in direction. At an 
altitude of about 1 km the wind speed was 5-10 m/s in a 
north-westerly direction. 

The most intense plume observed was during the first 
2—3 days in a northerly direction. Radiation levels in this 
stream at 5-10 km from the reactor and at 200m altitude 
were 1000 mR/h on 27 April and 500 mR/h on 28 April. 
According to aircraft monitoring data on 27 April the 
height of the stream exceeded 1200m in a north-westerly 
direction and the radiation level at this height was 1 mR/h. 
During the following days the height of the stream did not 
exceed 200-400 m. 

Information on the radiation levels experienced at and 
around the site is patchy. The report states that those at the 
site exceeded 100 mR/h. The report also gives the following 
additional activities: 

15 days after the accident at 30-40 km north: 35-40 mR/h 
15 days after the accidents at 50—60 km west: 5 mR/h 
At beginning of May in Kiev: 0.5—0.8 mR/h 

Maps of the radioactive fallout in the Chernobyl region 
are given in the Second Watt Committee Report and by 


Table A22.3 Estimated radioactive release from 
Chernobyl Unit 4 


A Core inventory and estimated fraction 
released (after Konstantinov and Gonzalez, 1989) 

Radionuclide 

Core 

Estimated 

Half-life 


inventory 1 

fraction 



(EBq) 

released l b (%) 


Kr-85 

0.033 

«100 

10.72 year 

Xe-133 

1.7 

«100 

5.25 d 

1-131 

1.3 

20 

8.04 d 

Te-132 

0.32 

15 

3.26 d 

Cs-137 

0.29 

13 

30.0 year 

Cs-134 

0.19 

10 

2.06 year 

Sr-89 

2.0 

4 

50.5 d 

Sr-90 

0.2 

4 

29.12 year 

Zr-95 

4.4 

3 

64.0 d 

Mo-99 

4.8 

2 

2.75 d 

Ru-103 

4.1 

3 

39.3 d 

Ru-106 

2.1 

3 

368 d 

Ba-140 

2.9 

6 

12.7 d 

Ce-141 

4.4 

2 

32.5 d 

Ce-144 

3.2 

3 

284 d 

Np-239 

0.14 

3 

2.36 d 

Pu-238 

0.001 

3 

87.74 year 

Pu-239 

0.0008 

3 

24065 year 

Pu-240 

0.001 

3 

6537 year 

Pu-241 

0.17 

3 

14.4 year 

Cm-242 

0.026 

3 

163 d 


B Estimated daily release rates (after USSR State 
Committee, 1986) 


Date 

Time after 
accident (d) 

Radioactivity 
released ® (MCi) 

Apr. 26 

0 

12 

27 

1 

4.0 

28 

2 

3.4 

29 

3 

2.6 

30 

4 

2.0 

Mayl 

5 

2.0 

2 

6 

4.0 

3 

7 

5.0 

4 

8 

7.0 

5 

9 

8.0 

6 

10 

0.1 

9 

14 

RiO.Ol 

23 

28 

20 x10“ 6 


a Decay corrected to 6 May 1986.1 Ebq = 10 18 Bq. 
b Stated accuracy ±50% expect for noble gases. 


Read. Figure A22.3 from the former shows the boundary 
of the zone contaminated to the level of 0.5 p Sv/h on 
10 May 1986. 

Accounts and maps of the radiation dispersion patterns 
over Europe and over the United Kingdom are given in the 
UKAEA Report and in the two Watt Committee Reports and 
byApsimon and Davison (1986), Wheeler et al. (1989) and 
Hass etal. (1990). 

Figure A22.4 from Gittus et al. (1987) shows the esti¬ 
mated radiation dispersion pattern across Europe on 
3 May 1986. 
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According to the Second Watt Committee Report, of the 
4% of the core inventory dispersed, the distribution was 
approximately 0.3-0.5% onthereactorsite,1.5-2.0% within 
20km and 1.0—15% beyond 20 km. The most significant 
isotopes outside the USSR were 1-131, Cs-134 and Cs-137. 

In Europe the highest dose equivalents in the year after 
the accident were 0.76, 0.67 and 0.59 mSv in Bulgaria, 
Austria and Greece, respectively, while that in the United 
Kingdom was 0.03 mSv. 


A22.9 The Later Aftermath 

Of those on site at the time, two died on site and a further 29 
in hospital over the next few weeks. A further 17 are per¬ 
manent invalids and 57 returned to work but with seriously 
affected capacity. The others on site, some 200, were 
affected to varying degrees. There is apparently no detailed 
information on the effects on the military and civilian 
personnel brought in to deal with the accident. 

Potential health effects at relatively low doses are dis¬ 
cussed in Appendix 20. A detailed discussion of such 
effects from Chernobyl is given in the Second Watt Com¬ 
mittee Report. For EC countries the estimates of the NRPB 
in 1986 were 100 fatal thyroid cancers and 2000 fatal gen¬ 
eral cancers, or 2100 fatal cancers. For the USSR the situa¬ 
tion is much more complex, but the report quotes an 
estimate by Ryin et al. (1990) of 1240 fatal leukaemia cases 
and 38,000 fatal general cancers. 


Table A22.4 Some lessons of Chernobyl 


Management of, and safety culture in, major hazard 
installations 

Adherence to safety-related instructions 

Inherent safer design of plants 

Sensitivity and operability of plants 

Design of plant to minimize effect of violations 

Disarming of protective systems 

Planning and conduct of experimental work on plants 

Accidents involving human error and their assessment 

Emergency planning for large accidents 

Mitigating features of accidents 


Measures to reduce the hazard from Unit 4 reactor have 
continued long after the events described, involving 
devoted and heroic work to limit the harm to their fellows, 
not only in the USSR but elsewhere. 


A22.10 Some Lessons of Chernobyl 

Some of the lessons of Chernobyl apply specifically to the 
nuclear industry and these are not considered here, but the 
more important ones are equally applicable to the process 
industries. A list of some of these is given in Table A22.4 
These lessons are now considered. 
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A22.10.1 Management of, and safety culture in, major 
hazard installations 

The management of the organization at the Chernobyl 
plant were clearly inadequate for the operation of a major 
hazard installation. 

The defects highlighted particularly in the foregoing 
account are a weak safety culture and overconfidence, 
a potentially lethal combination. 

A22.10.2 Adherence to safety-related instructions 

Closely linked to this is the lesson which most commenta¬ 
tors have highlighted as the principal one, the need to 
adhere to safety-related instructions. At Chernobyl a num¬ 
ber of such instructions were violated by the operators. 
These violations included disconnecting the ECCS and 
disabling two sets of trip systems. 

A22.10.3 Inherently safer design of plants 

The Chernobyl reactor had a low degree of inherent safety, 
due particularly to the positive temperature coefficient. 

The reactor did have some features, however, which 
might be claimed to be inherently safer. Thus by avoiding 
the use of a single large pressure vessel the design elimi¬ 
nated the hazard of catastrophic rupture of such a vessel 
and by subdividing the fuel into individually cooled chan¬ 
nels it reduced the risk of total core meltdown. 

On the other hand in addition to the sensitivity inherent 
in the positive temperature coefficient, the design also 
involved massive graphite blocks which could burn. 

Chernobyl thus also illustrates the fact that inherently 
safer design does not have a single dimension, but is multi¬ 
dimensional. 

A22.10.4 Sensitivity and operability of plants 

Closely related to inherently safer design is the sensitivity 
and operability of plants. The nuclear reactor at Chernobyl 
had a regime, that of low excess reactivity, at which it was 
close to instability and difficult to control. This is an 
undesirable characteristic in any plant. This fact is recog¬ 
nized in the recommendation made that the uranium fuel 
enrichment be increased to 2.4%. 

A22.10.5 Design of plant to minimize effect of violations 

At Chernobyl it was necessary to avoid operating the plant 
with a power output less than 20 % of the rated value. Where 
there is a feature which is so critical, it is arguable that the 
plant should be designed to ensure that it cannot be vio¬ 
lated. This is another aspect of inherently safer design. 

The practicality of such an approach can only be decided 
in the light of the particular case. As Franklin argues, it is 
not practical to design against all conceivable violations. 

A22.10.6 Disarming of protective systems 

The disarming of protective systems is a permissible prac¬ 
tice in certain cases, but these need to be well defined and 
there must be proper procedures fordoing so. At Chernobyl, 


protective systems were disarmed which should not have 
been. 

A22.10.7 Planning and conduct of experimental 
work on plants 

When work is to be done on a plant, whether engineering 
work or experimental testing, it is necessary, particularly if 
the work involves modification to safety-related features 
such as the disarming of trips, to review the potential 
hazards and to have specific authorized arrangements for 
the safe operation of the plant. 

Once the test is under way, unauthorized modifications 
should not be made to the equipment or to the test proce¬ 
dure itself which have potential safety implications. 

A22.10.8 Accidents involving human error and their 
assessment 

The Chernobyl disaster was caused by a series of actions by 
the operators of the plant. It appears to be a case of human 
error which is virtually impossible to foresee and prevent. 
No doubt the probability of any one of the events would 
have been assessed as low and that of their combination is 
virtually incredible. But there was a common factor, 
namely the determination to carry out the test. 

There is a need for the development of techniques, both 
for design and for hazard assessment of plant, for 
identifying potentially hazardous operator intervention 
sequences. 

A22.10.9 Emergency planning for large accidents 

The scale of the accident at Chernobyl was such that the 
resources required to deal with the emergency exceeded 
those available locally. In the event, the authorities 
responded by mobilizing resources on a military scale. 
Large numbers of military and civilian personnel were 
drafted in to work on the reactor itself, on evacuation and on 
decontamination. The evacuation on 27 April required 
some 1000 buses. 

A22.10.10 Mitigating features of accidents 

In terms of the effect of the accident on the population near 
the site there were several factors which mitigated the 
effect of the accident at Chernobyl, although the full value 
of these was partially lost due to hesitation in carrying out 
the evacuation. These mitigating features are discussed by 
Hawkes etal. (1986). 

The accident occurred at night so that fewer people were 
exposed on site and the population outside were mostly 
indoors. The intense fire created the conditions for the 
radioactive plume to rise high and carry the release away. 
There was little wind so that the plume was not prevented 
from rising and such wind as existed was away from the 
large centres of population to the south. The weather was 
dry so that the radioactivity was not washed down on the 
nearby population. 
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APPENDIX 23/2 RASMUSSEN REPORT 


A comprehensive hazard assessment of nuclear power 
plants in general is the Reactor Safety Study: An Assessment 
of Accident Risks in US Commercial Nuclear Power Plants by 
the Nuclear Regulatory Commission (NRC) (1975). The 
work was done by a team led by Professor N.C. Rasmussen 
and is often referred to as the Rasmussen Report. It is also 
known as the Reactor Safety Study (RSS) and also as WASH 
1400. It is referred to in this appendix as the Reactor Safety 
Study but elsewhere as the Rasmussen ReportThis study 
was a major exercise involving some 70 man years of work 
and costing $4 million. The report is a document of nine 
volumes some 15 cm thick. 

The RSS constituted a watershed in probabilistic risk 
assessment. It not only brought the PRA approach to the 
fore as an aid in decision-making, but created a framework 
and brought together the various techniques needed to 
carry out such a study. 

The work is of interest in respect of its methodology, its 
treatment of particular problems in risk assessment, its 
compilations of failure data and its presentation and eva¬ 
luation of risks. Also of interest are the critiques of the 
report. 

The methodology is based on the extensive use of fault 
trees and event trees and addresses the problem of uncer¬ 
tainty in the results obtained. 

The report has been followed by further reports which 
have developed the methodology. In particular, a treatment 
of overall PRA methodology is given in the PRA Procedures 
Guide of the NRC (1982) and of human factors methodology 
in the Handbook of Human Reliability Analysis with Emphasis 
on Nuclear Power Plant Applications. Final Report by Swain 
and Guttmann (1983). 

Selected references on the Reactor Safety Study are given 
in Table A23.1. 


A23.1 Earlier Studies 

The RSS, or WASH 1400, was not the first study of this 
subject. There were several earlier reports on nuclear 
reactor safety. 

The first of these was the report Theoretical Possibilities 
and Consequences of Major Accidents inLarge Nuclear Power 
Plants by the Atomic Energy Commission (AEC) (1957). The 
work was done by the Brookhaven National Laboratory and 
is often referred to as the Brookhaven Report and also as 
WASH 740. 

WASH 740 considered as a pessimistic accident sce¬ 
nario, or maximum credible accident, a situation where a 
reactor was nearing time for refuelling and thus contained 

Table A23.1 Selected references on the Reactor 
Safety Study 


Earlier studies 

AEC (1957); Ford (1977) 

Reactor safety study 

AEC (1975) 

Reviews and critiques 

AEC (1975) (Appendix XI); EPRI (1975); Hocevar (1975); 
Leverenz and Erdmann (1975,1979); Boffey (1976); EPA 
(1976);Yellin (1976); Erdmann etal. (1977); Ford Foundation 
and Mitre Corp. (1977); UCS (1977); H.W. Lewis (1978); 

S. Levine (1978,1979); ANS (1980); Hanks (1986) 


its largest inventory of fission products and suffered an 
accident involving loss from containment of half the core 
inventory in weather conditions which would carry the 
cloud towards a town of one million people 50 km away. It 
was estimated that this accident could result in 3,400 deaths, 
43,000 injured and $7 billion property damage. 

The report did not give an estimate of the frequency of 
such an event and stated in effect that the methodology to 
do so did not exist. 

A study to update WASH 740 was carried out by 
Brookhaven National Laboratory. The study was essentially 
complete by 1965 but was published only in 1973. It con¬ 
sidered an even more pessimistic scenario of a large accident 
in a city and gave estimates of 45,000 deaths and 70,000 
injuries. 

Another report on reactor safety was The Safety of 
Nuclear Power Reactors (Light Water Cooled) and Related 
Facilities by the AEC (1973), or WASH 1250. This report 
included both accounts of policy and collections of data and 
contained some of the early results of WASH 1400. 


A23.2 Risk Assessment Methodology 

The report provides a framework for probabilistic risk 
assessment. The overall methodology described is based 
on selection of a set of release scenarios; estimation of the 
frequency of each scenario using fault trees and of the fre¬ 
quency of each associated set of outcomes using event trees; 
estimation of the consequences using hazard models for the 
physical phenomena and models of population exposure, 
mitigation of exposure by shelter and by escape and eva¬ 
cuation and injury from radioactivity and evaluation of 
these results using risk criteria. Table A23.2(A) indicates 
the subjects covered by the various volumes of the report 
and Table 23.2(B) some of the specific topics. Reference to 
the report is frequently made here, in particular with 
respect to (1) failure and event data; (2) lognormal dis¬ 
tribution; (3) fault trees; (4) event trees; (5) common mode 
failure; (6) human error; (7) evacuation; (8) shelter; (9) FN 
curves and (10) risk evaluation. 

The RSS gives risk assessments of both PWRs and 
BWRs, but the account given here is largely confined to the 
former. 

A23.3 Event Data 

The RSS contains a compilation of a large amount of failure 
and event data. These are based primarily on nuclear 
industry experience supplemented by other sources. 

Most of the data refer to 2 years’ experience at 17 nuclear 
plants which were operational in the United States in 1972. 
The average plant in the sample was some 4 years old. 

Data for equipment are given as failure rates or prob¬ 
abilities of failure on demand. 

It is assumed that the failures are random and that the 
exponential failure distribution is applicable. The possibi¬ 
lity of failure due to ageing was considered but excluded. 
The report states: 

It should be recognized that the study did not include 
extreme ageing consideration since the applicability of 
its results is limited to only the next five years. 

The data on failure rates and probabilities are given not 
as point values but as ranges. Most of these data are 
presented in terms of the 90% confidence range and are 
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Table A23.2 Rector Safety Study: principal contents 


A Main report and appendices 


Main report 
Executive summary 


PWR fault trees 

Power system II- 81 

Reactor protection system 11-95 

Auxiliary feedwater system 11-102 

Emergency core cooling system 11-129 
PWR unavailabilities 11-4,5 


Appendices 

I Accident definition and use of event trees 

II Fault trees 

III Failure data 

IV Bounding techniques and special techniques 

V Quantitative results of accident sequences 

VI Calculation of reactor accident sequences 

VII Release of radioactivity in reactor accidents 

VIII Physical processes in reactor meltdown accidents 

IX Safety design rationale for nuclear power plants 

X Design adequacy 

XI Analysis of comments 


B Some specific topics 
First 100 LRW in US 
PWR data 

PWR coolant system 
PWR containment 
PWR design basis environment 
PWR emergency safety systems 
PWR safety design 
Design basis 
Coolant systems 
Safety systems 
PWR design adequacy 
Reactor coolant system 
Power supply 
Earthquake resistance 
Tornadoes 
PWR large LOCA 
PWR sm a ll BOCA 
PWR pressure vessel rupture 
PWR design basis accident 
PWR containment failure 

Physical explosions 
Hydrogen combustion 
Radionuclides 
Radioactive decay chains 
Radioactive core inventory 
Decay heat 

Risk assessment methodology 

Failure and event data 
Equipment 
Pipework 
Electrical power 
Human error 
Aircraft crashes 
Test and repair times 

Log-normal distribution 

Fault trees 
Construction 
Quantification 
Error bounds 
Common mode failures 


VI10-2 

VIII- 4 

IX- 8 

IX- 33 

X- 95 


IX-23, 27 

IX- 35 
X 

X- 28,42 
X-29, 55, 59 
X-24,34 
X-26,37 
1-40 

1-44 

I- 46; 1X8-1 
VIII-21 
VIII-133 

VIII Apps B, C 

VIII- 117 
VI3-3 
VII-83 
VI3-3 

IX- 13 

MR 146; IX 3-1 

III 

III-39 
III-74,84 
III-71,83 
III-59,81 
III-69,82 
III-53,57 

1142,1114,78, XI9-3 
II 

II- 7 
11-27 
11-39 

IV 


Radioactive release categories 
Event trees 
PWR event trees 
Meteorological data 
Gas dispersion 
Dispersion coefficients 
Building wakes 
Deposition 

Population characteristics 
Population density 
Population by time of day 
Mitigation of early exposure 
Evacuation 

Shelter, ventilation and 
inside dosage 

Mitigation of long-term exposure 
Interdiction 
Decontamination 

Doses of radioactivity 
Radioactivity dose-response 
relations 

Radiation dose criteria 
Fate of radionuclides in 
environment 
Health effects 
Contribution of various 
radionuclides 
Risks from natural and 
man-made hazards 
Early fatalities 
Earthquakes 
Hurricanes 
Tornadoes 
Meteorites 
Fires 
Dams 
Explosions 
Toxic gas releases 
Aircraft crashes 
FN curves 
Health data for US 
Cancer mortality 
Genetic disorders 
FN curves 
Confidence bounds 
Computer programs 
PREP-KIT: fault tree analysis 
ORIGEN 
CORRAL 

Brown’s Ferry incident 
Revisions between draft 
and final report 
Frequency 
Consequences 


V-3,74 VI2-1,2-5 

I 

1-5,11,39,58 


VI5-1, A-l 
VI4-1,7-1 
VI A-5 
VIA-12 
VI6-1, B-l 


VI10-1 
VI11-25 
VI 

VI11-3, App. J 
VI11-6 


VI11-15 

VI11-15, App. K, 

VI8-1, Apps C-E 
VI9-1, Apps F-I 

VI11-11 

VII-37,45 XI10-1 


VI13-1 


MR 
MR 112 

MR 10,107,116,124 
MR 10,106,115,122 
MR 10,106,123 
MR 10,107,125 
MR 10,108,114,129 
MR 108,118,128 
MR 10,108,117,127 
MR 10,109,130 
MR 10,108,117,126 
MR 119 
VI9-38 
VI9-39 
MR 105 


11-47 

VII-200, 209 
XI3-53 


XI5-1 
XI4-1 
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correlated using the log-normal distribution with values 
quoted for the lower and upper bounds, median and error 
factor. This use of the lognormal distribution reflects the 
large amount of uncertainty in the data so that for many 
items it was possible to give only order of magnitude values 
for the failure rate or probability. 

It is convenient to use as one of the parameters which 
describe the log-normal distribution the median. The 
report therefore quotes median values for much of the data. 

In addition to data on failures, data for test and repair 
times are also given. These times are also correlated using 
the log-normal distribution. 

It is worth emphasizing that in the report the lognormal 
distribution is not used to correlate times to failure. These 
are assumed to be exponentially distributed so that they 
are described by a constant failure rate. The lognormal 
distribution is used to describe the spread of these failure 
rates. On the other hand the log-normal distribution is 
indeed used to characterize test and repair times. 

There are special studies of pipework failure and 
power supply failure. Reactor pressure vessel failure is also 
considered. 

Some of the failure and event data in the RSS are given in 
Appendix 14. 

A23.4 Fault Trees 

The RSS makes extensive use of fault trees. The need to do 
this arises because the accident events considered can 
occur only if there are failures of a number of protective 
systems and because such failures are rare and insufficient 
historical data for them are available. 

The volume of the report which deals with the fault 
trees contains some 150 figures, most of them fault tree 
diagrams. 

The computer codes PREP and KITTwere used to cal¬ 
culate the frequencies of the top events from those of the 
base events. 

The PWR function unavailabilities obtained from the 
fault tree analyses are summarized in Table A23.3. 

A23.5 Event Trees 

The basic accident sequence considered is an initiating 
event followed by system failure and then containment 
failure. 

The RSS makes extensive use of event trees for the acci¬ 
dent sequences. 

A summary of the event trees is given in Table A23.4. 

A23.6 Common Mode Failure 

Common mode failures are recognized in the RSS as a fac¬ 
tor which may greatly increase the frequency of the hazard. 

Several techniques are used to handle such common 
mode failures. For similar events which may in some way be 
coupled, such as human actions to calibrate an instrument 
or open a valve, lower and upper bound probabilities of 
failure are defined. The lower bound probability pi is the 
probability calculated assuming complete independence of 
the events. The upper bound probability p u is the prob¬ 
ability calculated assuming complete coupling between the 
events. The actual probability p is then taken as the geo¬ 
metric mean, or log-normal median 

[A23.6.1] 


The example given is the reclosing of two valves. The 
probability of failing to close one valve is taken as 1CT 2 . 
Then, the lower bound is 10 -4 (10 -2 x 10 -2 ) and the 
upper bound 1(T 2 (10 _z x 1), while the probability given by 
Equation A23.6.1 is 10“ 3 ((1(T 4 x 1(T 2 ) 1/2 ). 

The method of handling coupled events in a fault tree is 
described below. 

Other common mode failures may occur as the result of a 
common event such as a fire or earthquake. The treatment 
of such external threats is considered below. 

The RSS concludes that common mode failures do not 
make a large contribution to the overall frequency of core 
melt failure. 


A23.7 Human Error 

The report gives an extensive treatment of human error and 
estimates for error rates for a number of types of error. It 
also deals with problems such as non-independence of, or 
coupling between, errors. 

The treatment of human error in the RSS and the 
Handbook of Human Reliability Analysis are described 
in Chapters 9 and 14 and some of their error rate esti¬ 
mates given. 


A23.8 Rare Events 

An important rare event considered in the RSS is failure of 
the reactor pressure vessel. The report states 
Potentially large ruptures in the vessel were considered 
that could prevent effective cooling of the core by the ECCS. 
Since certain of these ruptures appeared to be capable of 
causing missiles (such as the reactor vessel head) with 
sufficient momentum to rupture the containment, this area 
was explored with some care. There is some small prob¬ 
ability that a large vessel missile could in fact impact 
directly on the containment and penetrate through the wall. 
This type of rupture could involve a core meltdown in a 
non-intact containment. 

A study by the Advisory Committee on Reactor Safe¬ 
guards (ACRS) concluded that ‘the disruptive failure prob¬ 
ability of reactor vessels designed, constructed and operated 
according to code is even lower than 1 x 10 -6 per vessel 
year.’ The figure used in the RSS is 1 x 10 _7 /vessel year. 

The effect of this low estimate of reactor pressure vessel 
failure rate is to take this event out of consideration as a 
cause of release. The RSS states 
Gross vessel rupture would have to be at least about 100 
times more likely than the value estimated in order to 
contribute to the PWR core melt probability. 


A23.9 External Threats 

The RSS considers external threats such as fire, earth¬ 
quakes and sabotage. 

The prediction of earthquakes is highly uncertain and 
the report emphasizes this. It nevertheless states that a 
‘reasonable estimate (of core melt due to earthquake) is 
10 -7 per reactor year’. 

The RSS acknowledges the threat posed by sabotage, but 
does not take this into account in the risk estimates made. 
These estimates apply to bona fide accidents and exclude 
those due to sabotage. 


P = (Mu ) 1 
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Table A23.3 Reactor Safety Study: PWR function unavailabilities from trees (Nuclear Regulatory Commission, 1975) 


System Unavailability (Q) Major contributors (point estimates) 


Qupper 

Qmedian 

Qlower 

Hardware Test and 

Human Common 




maintenance 

mode 


PWR systems 

Electric power 

Reactor protection 

1.0x10 4 
1.0 x 10“ 4 

1.0x10 3 
3.6 x 10“ 5 

1.0 x 10“ b 
1.3 x 10“ 5 

2.2 x 10 -5 1 x 10 -5 



Auxiliary feedwater 

0—8 h after small LOCA 

3.0x10 4 

3.7x10 b 

7.0 x 10- b 

2.0 x 10 3.2 x lO- 


3 x 10“ b 

8-24 h after small LOCA 

0-8 h without net 

2.6 x 10- 3 
2.8 x KT 3 

1.2 x 10“ 3 
4.5 x 10“ 4 

5.4 x 10“ 4 
1.2 x 10“ 4 

l.l x 10“ 3 

2.0 x 10 -6 1.4 x 10 -4 


1.1 x 10 _4a 

Containment spray injection 

7.8 x KT 3 

2.4 x 10 -3 

1.0 x 10“ 3 

3.2 xlO -4 1.5 xlO -4 


1.9 x 10" 3a 

Consequence limiting control 

Hi-single train 

7.2 x HT 2 

2.8 x KT 2 

1.4 x 10“ 2 

2.0 x 10 2.1 x 10 -3 

3 x 10“ 3 

1.0 x 10“ 3a 

Hi-both trains 

4.8 x 10“ 3 

1.6 x 10“ 3 

4.8 x 10- 4 

4.0 x 10~ 4 8.4 xlO -5 


1.0 x 10“ 3a 

Hi-Hi single train 

2.6 x 10~ 2 

1.2 x 10“ 2 

7.2 x 10“ 3 

4.9xlO -3 2.1 xlO -3 


1.0 x 10“ 3a 

Hi-Hi both trains 

3.2 x RT 3 

1.1 xlO -3 

4.1 x 10“ 4 

6.5 x 10 -5 2.0 x 10 -5 


1 x 10“ 3a 

Emergency coolant injection 

Accumulators 

Low pressure injection 

1.4x10 3 
7.4 x 10“ 3 

9.5x10 4 
4.7 x KT 3 

6.2 x 10“ 4 
3.1 x KT 3 

4.9 x 10“ 3.4 xlO -4 
3.2 x 10 -4 9.6 x 10“ 4 

2.5 x 10“ : 

J 4.5 x 10 _5a 

High pressure injection 

2.7 x IQ- 2 

8.6 x 10“ 3 

4.4 x 10 -3 

1.1 x 10“ 3 

7.0 x 10~ 4 

1 4.5 x 10 _5a 

Safety injection control 


1.2 x 10“ 2 

5.8 x 10“ 3 

3.3 x 10“ 3 

3.0 x 10 -3 2.2 x 10 -3 


4.5 x 10“ ba 

Both trains 

2.7 x KT 4 

9.9 x 10“ 5 

5.4 x 10“ 5 

9.0 xlO -6 1.3 xlO -5 


4.5 x 10“ 5a 

Containment spray recirculation 

9.0 x KT 4 

1.0 x KT 4 

2.5 x KT 5 

5.2 x 10 -6 4.3 x 10 -5 


2.8 x 10“ 5a 

Containment heat removal 

3.0 x 10“ 4 

8.5 x 10“ 5 

3.0 x 10“ 5 

6.4 x 10“ 5 


1.0 x 10“ 5a 

Low pressure recirculation 

3.1 x 10 -2 

1.3 x 10“ 2 

4.4 x 10“ 3 

2.7 x 10 -3 1.0 x 10 -4 

1 x 10“ 5 

6.0 x 10“ 3a 

High pressure recirculation 

2.2 x 10“ 2 

9.0 x 10 -3 

4.3 x 10“ 3 

2.0 x 10“ 3 


6.0 x 10“ 3a 

Containment leakage 

Pressure reduced to <|psi 
Pressure not reduced to <lpsi 
Sodium hydroxide addition 

7.5 x 10“ 4 
1.0 x 10 -2 
1.1 x 10“ 2 

2.0 x 10- 4 
2.0 x 10“ 3 
5.9 x 10“ 3 

8.4 x 10“ b 
6.0 x 10“ 4 
3.6 x 10“ 3 

1.3 x 10 -4 

8.8 x 10 -4 

2.1 x 10 -4 4.8 x 10 -3 


1.2 x 10“ 3a 

PWR functions 

Electrical power 

Reactor protection 

1.0 x 10“ 4 
1.0 x 10“ 4 

1.0 x 10“ b 
3.6 x 10“ 5 

1.0 x 10-° 
1.3 x 10“ 5 

2.7 xlO -5 1.2 xlO -5 



Auxiliary feedwater 

0-8 h after small LOCA 

3.0 x 10“ 4 

3.7 x 10“ b 

7.0 x 10“ b 

2.0 x 10 3.2 x 10 _b 


3 x 10“ bc 

8—24 h after small LOCA 

0—8 h without net 

2.6 x 10“ 3 
2.8 x HT 3 

1.2 x 10 -3 
4.5 x 10“ 4 

5.3 x 10“ 4 
1.2 x 10 -4 

1.1 x 10“ 3 

2.0 xlO -6 1.4 xlO -4 


1.1 x 10 _4c 

Containment spray injection 

7.8 x 10“ 3 

2.4 x 10“ 3 

1.0 x 10“ 3 

3.2 x 10 -4 1.5 x 10 -4 


1.9 x 10“ 3c 

Emergency coolant injection 

Large LOCA 

9.0 x KT 3 

5.6 x 10“ 3 

3.0 x 10“ 3 

NA NA 

NA 

NA 

Small LOCA (2-6 in. diam.) 

3.0 x 10“ 2 

9.5 x KT 3 

4.0 x 10“ 3 

NA NA 

NA 

NA 

Small-small LOCA(l-2 in. diam.) 2.7x10 2 

8.6 x 10“ 3 

4.4 x 10“ 3 

NA NA 

NA 

NA 

Containment spray recirculation 

9.0 x KT 4 

1.0 x 10“ 4 

2.5 x KT 5 

5.2 x 10 -6 4.3 x 10 -5 


2.8 x 10“ 5c 

Containment head removal 

3.0 x 10“ 4 

8.5 x 10“ 5 

3.0 x 10“ 5 

6.4 x 10“ 5 


1.0 x 10“ 5c 

Emergency coolant recirculation 

Large LOCA 

3.1 x KT 2 

1.3 x 10 -2 

4.4 x 10~ 3 

2.7 xl0~ 3 1.0 xlO- 4 

1.0 x 10“' 

1 6.0 x 10 

Small LOCA 

2.2 x 10“ 2 

9.0 x 10 -3 

4.3 x 10“ 3 

2.0 x 10“ 3 


6.0 x 10“ 3c 

Small-small LOCA 


6.0 x 10“ 3< 


2.0 x 10“ 3 


3.0 x 10“ 3c 

Containment leakage 

Pressure reduced to <ipsi 
Pressure not reduced to <|psi 
Sodium hydroxide addition 

7.5 x KT 4 
1.0 x 10“ 2 
1.1 x 10 -2 

2.0 x 10“ 4 
2.0 x 10“ 3 
5.9 x 10“ 3 

8.4 x 10“ b 
6.0 x 10“ 4 
3.6 x 10“ 3 

1.3 x 10“ 4 

8.8 x 10“ 4 

2.1 xlO -4 4.8 xlO -3 


1.2 x 10 _3c 


“Also human error. 

b Containment pressure must be reduced to <5 psi to isolate containment spray injection system. 
c Common mode resulting from human error. 
d Point estimate value obtained only. 

NA, not applicable to combined systems. 
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Table A23.4 Reactor Safety Study: PWR accident sequences from event trees (Nuclear Regulatory Commission, 1975) 


Symbol Meaning 

A Intermediate to large LOCA 

B Failure of electric power to ESFs 

B' Failure to recover either on-site or off-site electric power within about 1 to 3 h following an initiating 

transient which is a loss of off-site a.c. power 
C Failure of the containment spray injection system 

D Failure of the emergency core cooling injection system 

F Failure of the containment spray recirculation system 

G Failure of the containment heat removal system 

H Failure of the emergency core cooling recirculation system 

K Failure of the reactor protection system 

L Failure of the secondary system steam relief valves and the auxiliary valves and the auxiliary feedwater system 

M Failure of the secondary system steam relief valves and the power conversion system 

Q Failure of the primary system safety relief valves to reclose after opening 

R Massive rupture of the reactor vessel 

Si A small LOCA with an equivalent diameter of about 5—15 cm 

S12 A small LOCA with an equivalent diameter of about 1-5 cm 

T Transient event 

V Failure of low-pressure inj ection system check valve 

a Containment rupture due to a reactor vessel steam explosion 

P Containment failure resulting from inadequate isolation of containment openings and penetrations 

y Containment failure due to hydrogen burning 

8 Containment failure due to overpressure 

e Containment vessel melt-through 


Sequence designation 


PWR sequence 

1. A 

2. Arp 

3. AH-a 

4. AH-/J 

5. AH-e 

6. AHI-a 

7. AHI-/J 

8. AHI-e 


10. AHG-(5 

11. AHG-e 

12. AHF-a 

13. AHF-/i 

14. AHF-i5 

15. AHF-e 

16. ADI-a 

17. AT)-ft 

18. AD-e 

19. ADI-a 

20. ADI-e 

21. ADG-e 

22. ADGI- 

23. ADF-0 

24. ADF-e 

25. ACD-/J 

26. ACD-e 

27. ACDGI-a 

28. ACDGI-/J 

29. ACDGI-<5 

30. ACDGI-e 

31. AB-a 

32. AB-y 

33. AB-e 


Event tree failure(s) 


Containment event tree failure 


Large rupture only 
Large rupture only 
ECCS recirculation 
ECCS recirculation 
ECCS recirculation 

ECCS recirculation plus sodium hydroxide 

ECCS recirculation plus sodium hydroxide 

ECCS recirculation plus sodium hydroxide 

Containment heat removal 

ECCS recirculation plus containment heat removal 

ECCS recirculation plus containment heat removal 

ECCS recirculation plus containment spray recirculation 

ECCS recirculation plus containment spray recirculation 

ECCS recirculation plus containment spray recirculation 

ECCS recirculation plus containment spray recirculation 

ECCS injection 

ECCS injection 

ECCS injection 

ECCS injection plus sodium hydroxide 
ECCS injection plus sodium hydroxide 
ECCS injection plus containment heat removal 
ECCS injection plus containment heat removal plus 
sodium hydroxide 

ECCS injection plus containment spray recirculation 

ECCS injection plus containment spray recirculation 

Containment spray injection plus ECCS injection 

Containment spray injection plus ECCS injection 

All except electric power and containment spray recirculation 

All except electric power and containment spray recirculation 

All except electric power and containment spray recirculation 

All except electric power and containment spray recirculation 

Electric power 

Electric power 

Electric power 


Containment leakage 

Vessel steam explosion 

Containment leakage 

Melt-through 

Vessel steam explosion 

Containment leakage 

Melt-through 

Overpressure 

Overpressure 

Melt-through 

Vessel steam explosion 

Containment leakage 

Overpressure 

Melt-through 

Vessel steam explosion 

Containment leakage 

Melt-through 

Vessel steam explosion 

Melt-through 

Melt-through 

Melt-through 

Containment leakage 

Melt-through 

Containment leakage 

Melt-through 

Vessel steam explosion 

Containment leakage 

Overpressure 

Melt-through 

Vessel steam explosion 

Hydrogen combustion 

Melt-through 
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Table A23.4 (continued) 


34. S 2 C-a 

35. S 2 C-<5 

36. TMLB'-y 

37. TMLB'-i5 

38. TMLB'-a 


Small LOCA plus containment spray injection 
Small LOCA plus containment spray injection 
Transient plus feedwater plus electric power 
Transient plus feedwater plus electric power 
Transient plus feedwater plus electric power 


Vessel steam explosion 
Overpressure 
Hydrogen combustion 
Overpressure 
Vessel steam explosion 



Figure A23.1 Reactor Safety Study: Schematic outline of consequence models (Nuclear Regulatory 
Commission 1975) 


A23.10 Release Scenarios 

The consequences of a core degradation or meltdown depend 
on (1) core inventory; (2) fraction released; (3) dispersion and 
deposition; (4) population exposed; (5) mitigating features 
(evacuation, shelter); and (6) injury relations. 

A schematic outline of the consequence models is shown 
in Figure A23.1. 

The initial radioactivity of the radionuclides in the reac¬ 
tor core is given in Table A23.5 and the reactor core inven¬ 
tory in Table A23.6. 

The release scenarios are shown inTables A23.7 and A23.8. 

The release from the reactor is used in the report as the 
source term for a plume gas dispersion model. This model 
takes into account the deposition of solid radionuclides. 


A23.11 Population Characteristics 

The population at risk was characterized by a composite 
model based on the 68 actual sites holding the first 100 
reactors. Six composite sites of different types were defined. 

The population density was determined as follows. The 
first type of site was an Atlantic coastal site and 14 of the 
reactors were assigned to this composite site. The actual 
population around each of these reactors was determined 
from census data for a distance of 50 miles. For each actual 


site 16 sectors were defined, making 224 sectors in total. 
These 224 sectors were then ranked in order of population 
density and 16 representative sectors were determined for 
the composite site. 

Data from a time use study byJ.P. Robinson and Converse 
(1966) were used to determine the fraction of time spent at 
different locations and hence the probability that a person 
was inside shelter. 

A23.12 Mitigation of Exposure 

Factors which mitigate the exposure of the population 
include shelter and evacuation. 

The RSS uses a single exponential stage evacuation 
model. This model is based on a study of actual evacuations 
by Hans and Sell (1974). 

Measures to mitigate long-term exposure include inter¬ 
diction of the contaminated zone and decontamination of 
this zone. 

The effect of shelter on concentration is modelled using a 
single exponential stage model for ventilation. 

A23.13 Injury Relations 

The effects of radioactivity on people are complex and are 
both short-term, or prompt, and long-term. 
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Table A23.5 Reactor Safety Study: initial activity of radionuclides in reactor core (Nuclear Regulatory 
Commission, 1975) 


No. 

Radionuclide 

Radio inventory source (curies x 10 8 ) 

Half-life (days) 

1 

Cobalt-58 

0.0078 

71.0 

2 

Cobalt-60 

0.0029 

1920 

3 

Krypton-85 

0.0056 

3950 

4 

Krypton-85m 

0.24 

0.183 

5 

Krypton-87 

0.47 

0.0528 

6 

Krypton-88 

0.68 

0.117 

7 

Rubidium-86 

0.00026 

18.7 

8 

Strontium-89 

0.94 

52.1 

9 

Strontium-90 

0.037 

11,030 

10 

Strontium-91 

1.1 

0.403 

11 

Yttrium-90 

0.039 

2.67 

12 

Yttrium-91 

1.2 

59.0 

13 

Zirconium-95 

1.5 

65.2 

14 

Zirconium-97 

1.5 

0.71 

15 

Niobium-95 

1.5 

35.0 

16 

Molybdenum-9 9 

1.6 

2.8 

17 

Technetium- 99m 

1.4 

0.25 

18 

Ruthenium-103 

1.1 

39.5 

19 

Ruthenium-105 

0.72 

0.185 

20 

Ruthenium-106 

0.25 

366 

21 

Rhodium-105 

0.49 

1.5 

22 

Tellurium-127 

0.059 

0.391 

23 

Tellurium-127m 

0.011 

109 

24 

Tellurium-129 

0.31 

0.048 

25 

Tellurium-129m 

0.053 

0.340 

26 

Tellurium-131m 

0.13 

1.25 

27 

Tellurium-132 

1.2 

3.25 

28 

Antimony-127 

0.061 

3.88 

29 

Antimony-129 

0.33 

0.179 

30 

Iodine-131 

0.85 

8.05 

31 

Iodine-132 

1.2 

0.0958 

32 

Iodine-133 

1.7 

0.875 

33 

Iodine-134 

1.9 

0.0366 

34 

Iodine-135 

1.5 

0.280 

35 

Xenon-133 

1.7 

5.28 

36 

Xenon-135 

0.34 

0.384 

37 

Cesium-134 

0.075 

750 

38 

Cesium-136 

0.030 

13.0 

39 

Cesium-137 

0.047 

11,000 

40 

Barium-140 

1.6 

12.8 

41 

Lanthanum-140 

1.6 

1.67 

42 

Cerium-141 

1.5 

32.3 

43 

Cerium-143 

1.3 

1.38 

44 

Cerium-144 

0.85 

284 

45 

Praseodymium-143 

1.3 

13.7 

46 

Neodymium-147 

0.60 

11.1 

47 

Neptunium-239 

16.4 

2.35 

48 

Plutonium-238 

0.00057 

32,500 

49 

Plutonium-239 

0.00021 

8.9 x 10 6 

50 

Plutonium-240 

0.00021 

2.4 x 10 6 

51 

Plutonium-241 

0.034 

5350 

52 

Americium-241 

0.000017 

1.5 x 10 5 

53 

Curium-242 

0.0050 

163 

54 

Curium-244 

0.00023 

6630 
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Table A23.6 Reactor Safety Study: reactor core inventory (Nuclear Regulatory Commission, 1975) 


Location 

Total inventory (curies) 

Fraction of core inventory 

Fuel 

Gap 

Total 

Fuel 

Gap 

Total 

Core a 

8.0 x 10 9 

1 1.4 x 10 s 

8.1 x 10 9 

9.8 x KT 1 

1.8 x 10“ 2 

1 

Spent fuel storage pool (max.) b 

1.3 x 10 9 

1 1.3 x 10 7 

1.3 x 10 9 

1.6 x 10 _1 

1.6 x KT 3 

1.6 x 10 _1 

Spent fuel storage pool (av.) c 

3.6 x 10 s 

3.8 x 10 6 

3.6 x 10 s 

4.5 x 10 -2 

4.8 x 10“ 4 

4.5 x 10 -2 

Shipping cask d 

2.2 x 10 7 

3.1 x 10 s 

2.2 x 10 7 

2.7 x 10“ 3 

3.8 x 10“ 6 

2.7 x 10“ 3 

Refuelling 6 

2.2 x 10 7 

2 x 10 5 

2.2 x 10 7 

2.7 x 10 -3 

2.5 x 10“ 5 

2.7 x 10“ 3 

Waste gas storage tank 

- 

- 

9.3 x 10“ 4 

- 

- 

1.2 x 10“ 5 

Liquid waste storage tank 

- 

- 

9.5 x 10 1 

- 

- 

1.2 x 10“ 8 


a Core inventory based on activity 1/2 h after shutdown. 

b Inventory of 2/3 core loading; 1/3 core with 3 day decay and 1/3 core with 150 day decay. 
6 Inventory of 1/2 core loading; 1/6 core with 150 day decay and 1/3 core with 60 day decay. 
d Inventory based on 7 PWR or 17 BWR fuel assemblies with 150 day decay. 
e Inventory for one fuel assembly with 3 day decay. 


In order to determine these effects it is first necessary to 
estimate the doses of radioactivity received and then to 
apply a dose-response relation. 

The RSS gives a detailed treatment of all these aspects 
and the report contains a large number of tables and graphs 
showing early and late fatalities and injuries due to differ¬ 
ent modes of injury and the contribution to these of indivi¬ 
dual radionuclides. 

It also deals with the contamination of land. 

A23.14 Uncertainty in Results 

An attempt is made in the report to put bounds on the errors 
of the estimates. 

A number of methods are used. Failure rates and prob¬ 
abilities are taken not as single values but as a range of 
values with a lognormal distribution, as described above. 

The inputs to the fault trees are therefore not single 
values of frequency or probability but distributions of 
these. The frequency or probability of the top event is then 
computed, also as a distribution, by sampling from the 
distributions of these individual events using Monte Carlo 
simulation. 

Such simulation may also be used to take account of 
common mode failures by arranging coupling between the 
failure rates or probabilities in question. 

A23.15 Presentation of Results 

The risks from reactor accidents are presented in the main 
report principally in the form of tables of frequency- 
consequence results. 

The results for 100 reactors are for the mix of both PWR 
and BRW reactors considered in the study. The risks for an 
individual PWR are higher than for a BWR and those for a 
composite single reactor based on the mix are close to those 
for a PWR. 

Table A23.9(A) shows the societal risk of early effects 
from one reactor and Table A23.9(B) of those from late 
effects. The report gives another table showing the societal 
risk from 100 reactors, the frequencies simply being greater 
by a factor of 100. Table A23.10 shows the individual and 
average societal risk from 100 reactors. 

The results are also given in graphical form. Figure A23.2 
gives a histogram of PWR release categories. Figure A23.3 


is the frequency-consequence curve, or FN curve, for early 
fatalities from a single reactor. The graph shows curves for 
a PWR, a BWR and the composite reactor. 

Figure A23.4 is the frequency-consequence curve for 
areas in which relocation of people and decontamination 
would be required. 

A23.16 Evaluation of Results 

Thef?SS evaluates the risk from the 100 nuclear reactors by 
making comparisons with those from other hazards. 

The main report gives numerous tables showing risks 
from various natural and man-made hazards such as 
earthquakes, hurricanes, tornadoes, meteorites, fires, 
dams, explosions, toxic gas releases and aircraft crashes. 

One of the principle comparisons made is the FN curve 
for the 100 reactors and for other hazards. Figures A23.5 
and Figure A23.6 show, respectively, the FN curve for early 
deaths for natural hazards and for man-made hazards 
together with the curve for 100 reactors. 

The overall conclusion of the report is that the risks to 
the public from 100 nuclear reactors are very much less 
than those from other natural and man-made hazards. 

The report has a slim Executive Summary which 
describes the report as a whole and gives a presentation and 
evaluation of the results. This summary does not include 
the societal risk estimates given in Table A23.9 and in gen¬ 
eral tends both to play down the risks and gloss over many 
qualifying assumptions. 

A23.17 Browns Ferry Incident 

The incident at Browns Ferry is widely regarded as a near 
miss and the RSS could hardly avoid reference to this 
incident. 

On 22 March 1975 a fire started in the electrical control 
cables at the plant. Following a plant modification a candle 
was used to detect air leaks at a point where a set of elec¬ 
trical cables passed through a wall. The fire burned out of 
control for l\ hours and badly damaged 1600 cables of 
which 618 were cables related to the safety systems. 

The power interruption caused disturbances on the 
reactors and the operators, hindered by dense smoke, had 
to struggle to bring them back under control. Unit 2 was 
shut-down and stabilized without great difficulty but Unit 1 








Table A23.7 Reactor Safety Study: PWR release scenarios ±1 (Nuclear Regulatory Commission, 1975) 


Fraction of core inventory released 


Accident 

category 

and 

frequency 

fi 

Description of 
accident category 

Duration 

of 

release 

(h) 

Elevation 

of 

release 

(m) 

Energy Xe—Kr 

release 

rate 

(Btu/h) 

/ 

Cs=Rb 

Te-Sb 

Ba-Sr 

Ru, Rh, Co, 
Mo.Tc 

Y, La, 

Zr, Nb, Ce, 

Pr, Nd, Np, 

Pu, Am, Cm 

PWRla 
and lb 

9 x 10“ 7 
per year 

Core melt-down and failure 
of containment spray and 
heat removal systems 
la - steam explosion after 
containment failure due to 
overpressure; lb - steam 
explosion ruptures 
containment 

0.5 

25 

20 x 10 6 (la) 0.9 

520 x 10 6 (lb) 

0.7 

0.4 

0.4 

0.05 

0.4 

3 x 10“ 3 

PWR2 

8 x 10“ 6 
per year 

Core meltdown, failure of 
containment spray and heat 
removal systems. 
Containment fails through 
overpressure after 
commencement of core 
meltdown 

0.5 

0 

170 x 10 6 0.9 

0.7 

0.5 

0.3 

0.06 

0.02 

4 x 10“ 3 

PWR3 

4 x 10“ 6 
per year 

Failure of containment due 
to overpressure before core 
meltdown 

1.5 

0 

6 x 10 6 0.8 

0.2 

0.2 

0.3 

0.02 

0.03 

3 x 10“ 3 


O 

3J 






PWR4 Core meltdown and failure 

5 x 10 -7 of containment system 

per year properly to isolate; failure 
of containment spray 
system 

PWR5 As PWR4, but containment 
7 x 1CT 7 spray systems operate to 
per year reduce release to 
atmosphere 

PWR6_ g Core melt down, failure of 

per year Containment maintains 
integrity but core melts 
through base 

PWR7 As PWR6, but containment 

4 x 10 -5 sprays operate 

per year 

PWR8 Large pipe break, containment 0.5 0 0 

4 x 10 -5 fails properly to isolate, all 
per year other engineered safeguards 
work, no core meltdown 

PWR9 As PWR8, but all engineered 0.5 0 0 

4 x 10 -4 safeguards function as 
per year designed. Essentially PWR 
design basis accident 


3.0 0 lx 10 6 


4 0 3 x 10- 


10.0 0 0 


10.0 0 0 


0.6 0.09 0.04 0.03 5 x 10“ 3 3 x 10“ 3 4 x 10“ 4 

0.3 0.03 9 x 10 -3 5 x 10 -3 10“ 3 6 x 10“ 4 7xl0“ 5 

0.03 8 x 10“ 4 8 x 10 -4 9 x 10 -8 9 x 10 -5 7 x 10“ s 10 -5 

6 x 10“ 3 2 x 10“ 5 10 -5 2 x 10“ 5 10“ 6 10“ 6 2 x 10 -7 

2 x 10 -3 10“ 4 5 x 10 -4 10“ 6 10“ 8 0 0 

3 x 10“ 6 10“ 7 6 x 10“ 7 10“ 9 10 “ n 0 0 
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Table A23.8 

Reactor Safety Study: PWR release scenarios - 

2 (Nuclear Regulatory Commission, 1975) 

Fission product 

Gap release fraction 

Melthdoum release fraction 

Vaporization release fraction a 

Steam explosion fraction b 

Xe, Kr 

0.030 

0.870 

0.100 

(X) (Y) 0.90 

I, Br 

0.017 

0.883 

0.100 

(X) (Y) 0.90 

Ca, Rb 

0.050 

0.760 

0.190 

- 

Te c 

0.0001 

0.150 

0.850 

(X) (Y) (0.60) 

Sr, Ba 

0.000001 

0.100 

0.010 

- 

Ru d 

- 

0.030 

0.050 

(X) (Y) (0.90) 

La e 

- 

0.003 

0.010 

- 


explosion can experience vaporization. 

b X = fraction of core involved in the steam explosion. Y=fraction of inventory remaining for release by oxidation. 
c Includes Se, Sb. 
d Includes Mo, Pd, Rh,Tc. 

e Includes Nd, Eu, Y, Ce, Pr, Pm, Sm, Np, Pu, Zr, Nb. 


Table A23.9 Reactor Safety Study: societal risk from one reactor (Nuclear Regulatory Commission, 1975) 


A Early effects 

Chance per reactor-year 




Consequences 


Early fatalities Early illness 

Total property Decontamination 

damage ($10®) area (^square miles) 

Relocation area 
(square miles) 

One in 20,000 a 

<1.0 

<1.0 

<0.1 

<0.1 

<0.1 

One in 1,000,000 

<1.0 

300 

0.9 

2,000 

130 

One in 10,000,000 

110 

3,000 

3 

3,200 

250 

One in 100,000,000 

900 

14,000 

8 


290 

One in 1,000,000,000 

3300 

45,000 

14 

- 

- 

B Cancer and genetic effects 

Chance per reactor-year 




Consequences 




Latent cancel 


Thyroid nodules b 

Genetic effects c 



fatalities (per year) 


(per year) 

(per year) 

One in 20,000 d 


<1.0 


<1.0 

<1.0 

One in 1,000,000 


170 


1,400 

25 

One in 10,000,000 


460 


3,500 

60 

One in 100,000,000 


860 


6,000 

110 

One in 1000,000,000 


1,500 


8,000 

170 

Nuclear incidence 


17,000 


8,000 

8,000 


a This is the predicted chance of core melt per reactor year. 

b This rate would occur approximately in the 10- 40 year period following a potential accident. 

c This rate would apply to the first generation born after a potential accident. Subsequent generations would experience effects at a lower i 
d This is the predicted chance of core melt per reactor year. 


was out of control for some hours and was stabilized only 
after the fire was put out. Control of Unit 1 was only 
achieved by the use of equipment which was not part of the 
safety system. 

The fire disabled all five emergency core cooling systems 
in Unit 1. 

At the point when control was lost 7 out of 11 of relief 
valves were failed. The fire disabled the other four. The RSS 
gives an analysis of the probability that these four valves 
would in fact be disabled in a fire without any of the valves, 
from the set of seven or the set of four, being repaired over 
the duration of the fire. The probability estimated was 0.003. 


A23.18 Critical Assumptions 

The results obtained in the RSS depend on the validity of 
a number of assumptions. 

Some of the more critical assumptions are 
plant standards are not seriously below average; 
failures are random rather than wearout; 
reactor pressure vessel operating conditions are closely 
controlled; 

site is not subject to unusually severe earthquakes; 
population density around site is not unusually high; 
emergency plans exist and are exercised; 
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Table A23.10 Reactor Safety Study: individual and average societal risk from 100 reactors (Nuclear Regulatory 
Commission, 1975f 

Consequence 

Societal 

Individual 

Early fatalities 15 

3 x KT 3 

2 x 1(T 10 

Early illness 15 

2 x KT 1 

1 x 1(T 8 

Latent cancer fatalities' 5 

7 x 10~ 2 per year 

3 x lO -10 per year 

Thyroidnodules c 

7 x 10 -1 per year 

3 x 1(T 9 per year 

Genetic effects' 1 

1 x 10“ 2 per year 

7 x KT 11 per year 

Property damage ($) 

2 x 10 6 

- 


a Based on 100 reactors at 68 current sites. 

b The individual risk value is based on the 15 million people living in the general vicinity of the first 100 nuclear power plants. 

'This value is the rate of occurrence per year for about a 30 year period following a potential accident. The individual rate is based on the total US 

^ This value is the rate of occurrence per year for the first generation born after a potential accident: subsequent generations would experience 
effects at a lower rate. The individual rate is based on the total US population. 



Release category 

Figure A23.2 Reactor Safety Study: histogram for frequency of PWR release categories (Nuclear Regulatory 
Commission, 1975) 
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Figure A23.3 Reactor Safety Study: FN curve for early fatalities for one reactor (Nuclear Regulatory Commission, 1975) 


medical facilities exist to handle large numbers of injured; 
and also 

sabotage is not considered. 


A23.19 Critiques 

The RSS has been the subject of much comment and criti¬ 
cism. Three principal critiques are the comments included 


as Appendix XI of the report itself, the Risk Assessment 
Review Group Report (H.K. Lewis, 1978) and The Risks 
of Nuclear Power Reactors by the Union of Concerned 
Scientists (UCS) (1977). 

There are also reviews by the EPA (1976) and the Amer¬ 
ican Nuclear Society (1980) and a series of reports by the 
Electric Power Research Institute (EPRI) (EPRI, 1975; 
Leverenz and Erdmann, 1975,1979; Erdmann etal., 1977). 
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Figure A23.4 Reactor Safety Study: frequency-consequence curve for areas requiring relocation and 
decontamination for one reactor (Nuclear Regulatory Commission, 1975) 


Some of the principal topics addressed in the critiques 
are indicated in Table A23.ll. 

Some of the comments made in the Review Group Report 
and the UCS review are now described. 


A23.19.1 Review Group Report 

The review found the RSS ‘inscrutable’. It was difficult to 
follow the detailed thread of any calculation and difficult 
therefore to carry out a peer review. 
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Figure A23.5 Reactor Safety Study: FN curves for early 
fatalities for 100 reactors compared with natural hazards 
(Nuclear Regulatory Commission, 1975) 


The group was also critical of the Executive Summary 
which they felt did not give a good summary of the findings 
of the Main Report and was thus misleading. 

The review is nevertheless sympathetic in principle to 
the attempt to quantify the frequency of events using fault 
tree and event tree methods and the consequences using 
hazard and injury models. 

It states that it is incorrect to say that the use of fault trees 
and event trees is fundamentally flawed: it is just an 
implementation of logic. 

On the other hand the practical application of the meth¬ 
odology involves various difficulties, including the avail¬ 
ability of data, the statistical treatment of the data and the 
selection of appropriate models. 

The group draws attention to the fact that the methodol¬ 
ogy is based on converting situations which are essentially 
continuous into discrete events and that this involves quite 
drastic simplification. 

It is suggested that the problem of data is such that in 
some areas it is not appropriate to give absolute risk values 
but only bounding values. 

The report criticizes the study for not always distin¬ 
guishing clearly between different sources of values quoted: 
historical data, subjective judgements and models. 

The review is sympathetic in principle to the use of 
values determined from expert judgement. Such judge¬ 
ments can be rather accurate as studies of betting demon¬ 
strate. It is necessary, however, to stay within the domain of 



Figure A23.6 Reactor Safety Study. FN curves for early 
fatalities for 100 reactors compared with man-made 
hazards (Nuclear Regulatory Commission, 1975). 

Note: car accidents caused at the time of the report 
about 50,000 deaths per year in the United states. 

These fatalities are not shown because data for large 
multiple-fatality accidents are not available 


experience of the expert and not require him to make 
estimates of events of which he has no experience. 

The log-normal distribution is used to fit much of the 
data. The group are somewhat critical of some of the fits 
obtained, particularly for sparse data, but they accept 
the use of this distribution. With regard to the use of the 
median rather than the mean of this distribution, they 
state that this is more a matter of presentation than of sub¬ 
stance and caused people to infer incorrectly that the study 
was predicting a lower failure rate than it actually did. 

They are much more critical of the use made of the geo¬ 
metric mean, or square root hounding, and quote as an 
example the estimation of the probability p of failure of 
three adjacent BWR control rods. This probability is cal¬ 
culated as described above using Equation A23.6.1, where 
the values of the bound probabilities are the follow¬ 
ing functions of the failure probability p x (= 10 -4 ) of a 
single rod 

Pi=Pl = 10- 12 
K = 0.01#* = 10“ 6 
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so that 
p = 10" 9 

An alternative model is the arithmetic mean which gives 
p = HT 6 

There is thus a large difference. 

The review devotes considerable attention to the problem 
of common mode failures. Such failures can cause indivi¬ 
dual equipment failures, can compromise redundant sys¬ 
tems and can activate low probability accident sequences. 
The principal causes of such failure listed by the group are 
power supply failure, human error and external threats 
such as fire, explosion, earthquake and sabotage. They 
were unconvinced that the problem had been fully dealt 
with in the study and suggest that the best way to handle 
such events is to mount a defence against them at the start 
and so eliminate their effects. 

It is suggested in the report that the treatment of earth¬ 
quakes is inadequate. Attention is drawn to the work of Hsieh 
and Okrent (1976) showing that design and construction 
errors can greatly reduce the safety factors thought to be 
present in a design. 

Another problem discussed at some length in the review 
is human factors and human error. The report expresses 
some disappointment that there were few comments on the 
human factors aspects of the study. Human factors affect 
the study in that human error can initiate an accident, can 
disable protective systems and can cause escalation, while 
on the other hand human action can mitigate an accident 
situation. The report recognizes that the human factors 
aspects of the study represent pioneering work and were 
well executed, but draws attention to the lack of data. 
The main thrust of the group’s comments, however, is to 
the effect that the study probably gives too little credit for 
the effectiveness of human action in averting an accident. 

The group identified various sources of uncertainty in 
the work, some biased towards conservatism and some to 
nonconservatism. Among the former factors were perva¬ 
sive regulatory influence towards the use of certain para¬ 
meter values and reluctance to claim full credit for effective 
human adaptability during accidents. Among the latter 
factors were questions of completeness and common-cause 
failure. They were therefore unable to determine whether 
the accident frequencies estimated were high or low, but 
were convinced that the error bounds had been greatly 
underestimated. 

The report discusses the problem of the completeness of 
the identification of the hazards. The probability of core 
melt predicted in the study is two orders of magnitude less 
than the upper bound value which may be estimated from 
the number of melt-free reactor years accumulated. The 
report suggests that if there are unidentified accident 
sequences which can lead to core melt, some precursor 
events in these sequences should probably be occurring, 
although they may remain unrecognized. They suggest it is 
important to subject potentially significant sequences and 
precursors, as they occur, to the kind of analysis given in 
the study. 

The report suggests that the results of the study cannot 
be applied directly to particular reactor sites. Application 


to a specific site would require more detailed study of the 
site characteristics such as topology and meteorology. 

The report gives an account of the Brown’s Ferry incident. 


A23.19.2 Union of Concerned Scientists report 

The review of the RSS by the UCS is more critical. 

In the view of the UCS publicly available documents on 
the study suggest that it was not sufficiently independent 
of the nuclear industry, that its results were largely pre¬ 
determined, that critical reviews were suppressed and that 
certain sensitive issues were avoided. 

The report starts with a fundamental critique of the 
basic methodology. It reviews experience of fault tree ana¬ 
lysis in the aerospace industry. It quotes as an example the 
use of the technique to estimate the reliability of the Apollo 
Service Propulsion System or SPS engine. One of the 
authors of the UCS report, W.M. Bryan, was in charge of 
reliability assessment during the testing of this engine. The 
estimated failure probability of the engine based on fault 
tree analysis was 1CT 4 while that estimated after testing 
was 4 x 10 -3 so that the theoretical analysis gave an 
underestimate by a factor of 40. 

The authors state that fault tree analysis for Apollo also 
failed to assure completeness of hazard identification. 
Many failures in the programme resulted from events 
which had not been identified as ‘credible’ and came as 
complete surprises. Some 20% of ground test failures and 
more than 35% of in-flight failures were not identified as 
credible prior to their occurrence. 

The report states 

Fault trees, mathematical models and event trees were 

developed over 20 years ago and were [later] discarded... 

by NASA and ... by the AEC as viable tools for esti¬ 
mating reliability/safety quantitative values. 

It lists as techniques which are used probabilistic design 
analysis, propagation of error techniques, reliability esti¬ 
mation from small samples, malfunction simulation models 
and others. 

The methodology used in the study is to synthesize 
accident sequences from failure data for single items. The 
UCS suggest that this approach fails to utilize information 
which is available on multiple failure accident sequences 
which have actually happened. 

The review draws attention to the database used in the 
RSS, which was described above. The average age of the 
plants used in the study was 4 years. Two difficulties which 
arise from this are that often data collection was not well 
established and that failures due to ageing would scarcely 
have begun to appear. 

The UCS criticize the assumption of random failure and 
suggest that failure rates may be significantly affected by 
ageing. 

Attention is drawn to the danger of using historical fail¬ 
ure data. The example is cited of the Skybolt rocket motor. 
A minor modification was made to the welding procedure 
for this motor. This resulted in flaws which were not 
revealed by quality assurance procedures but which caused 
the unit to explode under pressure and led to mission fail¬ 
ures of the first two operationally launched vehicles. 

An example is given where the study may have under¬ 
estimated failure probabilities. For the High Pressure 
Coolant System (HPCS) the study uses a failure probability 
of 7.8 x 10 -3 per demand. The report quotes data for four 
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reactors in which there were 10 failures in 47 tests, a failure 
probability of 0.21. 

Such instances also suggest that at some plants standards 
may be generally lower and the probability of an accident 
correspondingly higher, perhaps by an appreciable factor. 

The report is critical of the use made in the study of the 
lognormal distribution to express the uncertainty in failure 
rate data. It suggests that it is not at all clear that this is the 
correct choice. 

The report quotes the following comments by Yellin (1976): 

The basic fault tree model therefore begins from esti¬ 
mates of the logarithms of the component failure prob¬ 
abilities, rather than from the probabilities themselves. In 
view of this use of the log-normal input distributions, one 
should also evaluate the accuracy of roughly 10-20% in 
their estimates of these output logarithms of failure prob¬ 
abilities, while it is suggested here that the evidence pre¬ 
sented in WASH-1400 is in fact consistent with 
uncertainties of order 50%. This difference of opinion is 
crucial, since for a typical failure probability of 10 -6 , an 
accuracy of 10 -20 % results in an overall uncertainty factor 
of 10 in probability, while an accuracy of 50% results in an 
overall uncertainty factor of 1000. 

The use of the median instead of the mean of the log¬ 
normal distribution is also criticized as incorrect. The former 
is some 2.5 times less than the latter. The authors believe 
that its use results in the study in underestimation of the 
risks by this factor. 

The assumption of independence of events is criticized 
by the report, which devotes considerable space to the 
problem of common mode failures. 

The report suggests that the RSS underestimates the 
importance of failures which occur in accident sequences 
as the result of previous failures and also of failures due to 
incorrect design. 

The RSS found that common-cause failures do not make 
a significant contribution to the overall risk, but the UCS 
suggest that this contribution may have been underesti¬ 
mated. The example given is the miscalibration of four 
instruments in turn. The probability/) of miscalibration of 
a single instrument is given in the study as 3 x 10 -3 . For 
dependent failures of this kind the overall probability/) of 
failure would be calculated using the study methodology as 
the geometric mean of the case for four independent fail¬ 
ures and for tight coupling between failures. For the latter 
case, which gives the upper bound, the probability /> u is 

A, = 3 x 1(T 3 x 'Iff* x 1 x 1 = 3 x 10“ 4 

The last three terms are based on tight coupling. Then, the 
estimated probability p is 

p= [(3 x 10“ 3 ) 4 x 3 x l<r 4 ] 1/z «2x 10- 7 

Thus, the estimated ratio of the probability of the common- 
cause failure (2 x 10 -7 ) to the probability of the single fail¬ 
ure (3 x 10 -3 ) is approximately 1(T 4 . The UCS compare this 
figure with their own estimate obtained by examining the 
common-cause failures in the RSS database. Out of 303 
failures 33 are identified as common-cause.They take three 
of these failures as common-cause multiple miscalibra¬ 
tion failures and thus obtain an estimate of 1(T 2 for the 
probability ratio referred to. This differs from the RSS 
estimate by a factor of 100. 


The review gives the following breakdown of the 33 
common-cause failures in the RSS 


Failure 

No. of failures 

Drift of instruments, etc. 

4 

Miscalibration of instruments, etc. 

5 

Design error 

6 

Component failure 

9 

Environmental effects 

6 

Human error 

2 

Unknown 

1 

Total 

33 


The review refers to an incident on the Oak Ridge 
Research Reactor where the reactor had to be operated for 
5 h without emergency cooling protection due to seven 
sequential common mode failures, each involving three 
parallel elements, making a total of 21 failures in all. 

The review also considers what it calls common event 
failure which may lead to common mode failures. These 
events include fire, turbine missiles, earthquakes and 
sabotage. The UCS give an alternative analysis of the 
probability of core meltdown in the Brown’s Ferry fire 
based on the relief valve failures and obtains a value of 
0.03 instead of the RSS value of 0.003. 

The review draws attention to the problem of design 
adequacy. The equipment may be reliable in the sense that it 
functions, but it may not be capable of fulfilling its task. 
For the Emergency Core Cooling System (ECCS) the RSS 
assigned a probability of failure on demand of less than 0.1. 
The UCS argue that ECCS systems have not been tested 
under accident conditions and may well lack the basic 
capability and thus have a higher failure probability. 

Also, in the context of design adequacy the UCS take 
issue with the value used in the RSS for the failure fre¬ 
quency of the reactor pressure vessel. The RSS used a fig¬ 
ure of 10 -7 per year. The UCS argue that for non-nuclear 
pressure vessels the failure frequency is approximately 
1(T 5 per year and that there is no justification for using a 
value 100 times less. They base their argument partly on 
the fact that the failure rates of components in nuclear 
plants are not greatly different from those in non-nuclear 
plants. They quote Professor Rasmussen 
Probably one of the most serious issues that the [nuclear 
power plant] intervenors can raise today, with good sta¬ 
tistics to back their case, is that nuclear power plants have 
not performed with the degree of reliability we would 
expect from machines built with the care and attention to 
safety and reliability that we have so often claimed. 

The UCS also refer to comments made by Sir Alan Cottrell, 
formerly Chief Scientific Adviser to the British Government, 
emphasizing the problem of dealing with deterioration of the 
vessel in a situation where, being radioactive, it is extremely 
difficult to replace. The UCS review includes an appendix by 
Cottrell on reactor pressure vessel integrity. 

They also quote the following qualifications given in the 
Marshall Reportwith respect to such reactor pressure vessels: 
That it is essential to confine the operational transients to 
unusually narrow limits in order to avoid excessive crack 
growth by metal fatigue. 
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That emergency core cooling water should be injected 
at an unusually high temperature in order to minimize the 
risk of fracture by thermal shock. 

The UCS list a number of safety issues which are addres¬ 
sed inadequately or not at all in the RSS. These include the 
hazards of loss of containment through electrical penetration 
seals, of earthquakes and of sabotage as well as the ageing 
problem already mentioned. 

The UCS consider that the RSS dismisses too readily the 
risk from earthquakes. They give a number of quotations 
on the inability of seismologists to predict earthquakes. 
Thus, C.R. Allen (1967) states: 

Almost every large earthquake that has occurred in 
California has proved to be surprising in terms of what 
would have been expected by geologists, seismologists, 
and engineers at the time, 
and Greensfelder (1971) states: 

Thus the San Fernando earthquake occurred in an area 
which has had relatively low seismicity and was not 


caused by movement on a major, historically active fault, 
such as the San Andreas or one of its branches. In fact, 
portions of the fault associated with this shock were not 
previously mapped... 

The UCS argue that at the least the earthquake hazard 
introduces a much larger uncertainty than the RSS allows. 
The review includes an appendix on the earthquake hazards 
at the Diabolo Canyon nuclear reactor site. 

On sabotage the UCS argue that it is indeed difficult to 
quantify but that it is a relevant factor in considering 
nuclear safety. They draw attention to the fact that the 
saboteur may be able to deliberately defeat many of the 
factors which normally operate to mitigate an accident. 

The review makes a number of criticisms of the gas dis¬ 
persion model, of the models of population exposure and of 
the relations for injury from radioactivity. 

The UCS are doubtful about credit claimed for evacua¬ 
tion. Among their reasons are lack of emergency plans and 
failures in specific emergencies. They quote the failure to 
evacuate at Browns Ferry. 



(a) 

Figure A23.7 Reactor Safety Study: Alternative FN curves for fatalities for 100 reactors proposed by the Union of 
Concerned Scientists (UCS, 1977): (a) early deaths and (b) total deaths. Curve A is that for early deaths given in the 
original study, curve B the proposed alternative 
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Fatalities, x 
(b) 


Figure A23.7 continued 


A number of criticisms are made by the UCS of the 
handling of the results from the RSS. One criticism centres 
on the tendency to present the results simply as showing 
the risks of nuclear power to be very low and to play down 
the qualification and the uncertainties. Another is that the 
way the study was handled did not allow an effective 
process of peer review. 

The large changes made between the draft and final 
reports also attract criticism. In some cases these changes 
exceeded the uncertainty bounds given in the draft report. 

The Executive Summary is criticized as overoptimistic 
and misleading. 

The UCS conclude that the RSS is not usable for policy 
decisions. 

The review gives an alternative statement of the risks, 
the differences being partly of substance and partly of 
presentation. The UCS estimate of the frequency of a major 
release is 1 in 10,000 per reactor year, which is 20 times that 
of the RSS. The upper bound based on the number of inci¬ 
dent-free reactor years was 1 in 300. The estimate of the 


consequences of such a release is that the early fatalities 
and injuries would be 10 times greater than in the RSS. 
In individual cases the consequences might be 100 or 1000 
fold worse than the RSS predicts. The UCS estimate of the 
FN curve for early deaths is shown in Figure 23.7(a). The 
UCS also estimate that the late deaths are underestimated 
in thei?SS by a factor of 2—5 and further argue that the FN 
curve should show the total deaths. Figure A23.7(b) shows 
the curve which they give for this. 


A23.20 Notation 

p probability of failure 


Subscripts 

1 lower bound 

u upperbound 
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The Second Report of the Advisory Committee on Major 
Hazards (Harvey, 1979b) presents in an appendix a set of 
model controls for a major hazard installation in the form of 
‘Model Conditions for a Possible Licensing Scheme for 
Selected High Hazard Notifiable Installations’, although 
the report leaves open the question of whether the use 
of licensing or regulations is the best method of imple¬ 
menting such controls. The appendix is prefaced by the 
statement: 

‘The conditions outlined in this appendix have been 
written to give guidance as to the range and scope of the 
requirements that might be required if a licensing scheme 
of control were adopted for major hazard installations 
with the highest hazard potential.... The Committee is 
not yet in a position to say if certain installations should 
be regulated in this way until more information is avail¬ 
able, particularly from the proposed Hazardous Instal¬ 
lations (Notification and Survey) Regulations. It is, 
however, clear that there is a gradation of hazard with size 
and complexity of plant, and as this is increased there 
should be a greater degree of control and surveillance by 
the organisation in control of such activities. Thus this 
appendix has a wider application than the possible 
requirements for a licensing system of control. It is 
recommended that any organisation operating a major 
hazard plant, particularly one at the highest level of 
hazard potential, should review and satisfy itself that it 
could demonstrate that the requirements given below are 
adequately met.’ 

The full text, which is reproduced by courtesy of the 
Health and Safety Executive (HSE) and HM Stationery 
Office is given below. 


A24.1 Model Conditions for a Possible Licensing 
Scheme for Selected High Hazard Notifiable 
Installations 

With regard to a possible licensing system it is recognized 
that a licence is the most stringent form of control under the 
Major Hazards arrangements and would be applied only to 
those Notifiable Installations which present the greatest 
hazard potential. The licence would be granted to the 
organization which operates the installation and would be 
valid only for the specified location. 

The approach adopted to licensing would he that fore¬ 
shadowed by the Robens Committee and embodied in the 
Health and Safety at Work etc. Act 1974, namely that safety 
is the responsibility of the organization which should demo¬ 
nstrate that it is taking appropriate measures to ensure 
effective control of the hazards. 

The licensing procedure might be in two stages. At the 
first stage, the organization would provide the HSE with a 
statement of intent covering the nature of the proposed 
installation, the hazards and the features of the design 
and operation intended to control the hazards. At the 
second stage, the organization would provide HSE with 
design and operating information to show how the state¬ 
ment of intent is implemented. 

The documentation required might be in two parts 
corresponding to these two stages and consist of: 

Parti 

(1) The Systems Documentation; 

(2) The Preliminary Design Document. 


Part 2 

(1) The Background Documentation; 

(2) The Design Document; 

(3) The Operating Document. 

The Systems Documentation, which is relevant to 
Licence Conditions 1-9, would be concerned with the gen¬ 
eral systems which the organization has set up to ensure 
safety and could be used in support of more than one 
licence application provided that it is up-to-date. 

Details of the Preliminary Design Document are given 
in Licence Condition 10. 

The purpose of the Preliminary Design Document would 
be to show the general nature of the installation and of any 
associated hazards. The onus would be on the organization to 
draw attention at this stage to any special features which 
might have an important bearing on the granting of a licence. 

The Background Document would be documentation on 
the implementation of Licence Conditions 1-9, in relation 
to the particular installation. 

Details of the main Design Document and the main 
Operating Document are given in Licence Condition 10. 

The main Design Document would be essentially a more 
up-to-date and detailed version of the Preliminary Design 
Document, including additional details, such as materials 
of construction for the main plant items. 

The main Operating Document, which incorporates the 
Operating Manual, would give details of the personnel 
structure for the operation of the installation. 

A licence would be granted for a particular installation 
on a given site. The licence would not itself deal with ques¬ 
tions of siting, hut the issue of a licence is an indication that 
an installation meets certain standards and this is relevant 
to siting considerations. 

The licensee would be required to inform HSE of sig¬ 
nificant changes which are proposed in any of the matters 
within the scope of the licence. 

A24.1.1 Conditions for a licence 

The conditions for the issue of a licence are that the licensee 
shall demonstrate to the HSE that the design, construction, 
operation, maintenance and modification of his installation 
are or will be to the standard appropriate to the installation 
and in particular that the following features of his organi¬ 
zation are to such a standard: 

(1) The management system; 

(2) The safety system; 

(3) The responsible persons; 

(4) The arrangement for the identification of hazards; 

(5) The arrangements for the assessment of hazards; 

(6) The arrangements for the design and operation of 
pressure systems; 

(7) The arrangements for the minimization of exposure 
of personnel; 

(8) The arrangements for the administration of emer¬ 
gencies; 

(9) The arrangements for reporting of and learning 
from incidents; 

(10) The design and operating documentation. 

A24.1.1.1 Licence Condition: The management system 
The organization should show that it has and supports a 
management system and staff structure which combine to 
ensure continuing effective control of the installation and 
its hazards. 
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The staff concerned include contractors and consultants. 
This aspect is considered further in Licence Condition 3. 

The organization should show the management struc¬ 
ture, making clear the distinction between executive and 
advisory functions, and should give a brief job description 
for each post. 

The management system should give full support to the 
personnel who are responsible for the design and operation 
of the installation. Important elements include a suitable 
and well understood management structure; adequate 
human resources including coverage of absences, vacan¬ 
cies and emergency situations; recruitment, training and 
career planning; and effective communications. 

The management system should in particular provide 
satisfactory arrangements in the areas which are the subject 
of Licence Conditions 2-9. There should be comprehensive, 
formal and documented set of systems and procedures. 

The management should define the objectives of its 
system of documentation in respect of immediate a com¬ 
munication and of record-keeping and should specify the 
extent of the documentation required and the procedures 
for producing it. 

The management system should provide for thorough 
initial and continuing training of personnel in their work 
generally and in safety in particular. 

Full use should be made of appropriate standards and 
codes of practice.Where there are standards or codes which 
have statutory backing or which are commonly recognized 
within the United Kingdom as constituting sound practice, 
these should be applied as a minimum. Where there are no 
approved or accepted standards or codes the situation 
should he covered by the adoption of sound practice and the 
use of in-house codes. 

The management system should include formal pro¬ 
cedures for the control of modifications made to the plant or 
to the process, whether during design or during operation. 

The management system should require the indepen¬ 
dent assessment of features which are critical to the safe 
operation of the installation. This independent check is 
essential for inspection of pressure systems and for reli¬ 
ability assessment of instrument trip systems. The guiding 
principle is that the feature is critical to safe operation of 
the installation. It is acceptable that the check be done by an 
in-house authority provided that this is genuinely inde¬ 
pendent of the interested party. Thus pressure system 
inspection, for example, must be done by an authority 
independent of the operating authority, as described by 
Licence Condition 6. 

The management system should contain a variety of 
arrangements for the periodic audit both of the continuing 
appropriateness of systems and of the continuing effec¬ 
tiveness of their implementation. 

Background It is considered that in the case of major 
hazard installations the control of the plant and its hazards 
requires a considerable degree of formalization of com¬ 
munications through written systems and procedures, 
standards and codes of practice. This is essentially to 
encourage, and where appropriate enforce, collective and 
personal discipline by the use of operating methods which 
have been carefully thought out and which contain an 
appropriate level of checks and counterchecks to obviate 
problems and reduce errors. 

It is recognized that there is always the problem of over¬ 
administration through paperwork and what at times 


seems like ‘going through the motions’ without apparently 
contributing anything useful. However, it is considered 
that a careful review of incidents will, time and again, 
illustrate that there was a loss in discipline because appro¬ 
priate procedures either did not exist or were not observed. 

There should be an interlocking set of systems and pro¬ 
cedures to ensure safety through sound engineering and 
management practices. There is no upper limit to the num¬ 
ber of procedures which can be formalized, but there is 
nothing to be gained by deliberately trying to maximize the 
number. The optimum number is that which leaves no 
obvious gaps but avoids creating confusion by overlapping. 

Many of the required procedures are implicit in the various 
Licence Conditions which follow. It is evident that key pro¬ 
cedures include those for the identification of hazards, the 
assessment of hazards, the control of maintenance through 
permits-to-work, the control of modifications to process or 
plant, the inspection of equipment, the operation of the pro¬ 
cess (normal and emergency), the control of access, the con¬ 
duct of safety audits and the reporting of incidents. 

Self-auditing features should be built into the manage¬ 
ment system in the form of formal instructions for periodic 
checks on those parts of the system which may become 
degraded or unnoticed. The operation of a permit-to-work 
system, for example, should be subjected to regular audit 
by some means such as an instruction, not merely an 
exhortation, to the plant manager to sample a proportion of 
permits each week. 

A24.1.1.2 Licence Condition: The safety system 
The organization should show that within the management 
system there is a safety system which is appropriate to the 
level of hazard inherent in the installation. 

The safety system should in particular provide for 
satisfactory arrangements in the areas of the safety organi¬ 
zation, safety objectives and assessment, safety consulta¬ 
tive committees, and safety training. 

The organization should show that it has people compe¬ 
tent to operate the safety system. 

Background Most of the aspects of the safety system 
mentioned are already legal requirements, but it is the 
object of this section to review their adequacy in relation to 
the major hazard installation. 

A distinction can be drawn between the technological and 
human sides of safety. On a major hazard plant the techno¬ 
logical features are obviously particularly important. The 
responsibility for these aspects rests primarily with the 
qualified technical staff in the design and operations areas. 
There should be no neglect, however, of the human side. On 
the contrary, on a major hazard plant it is more important 
than ever to run a'tight ship’ as far as safety is concerned. 

The authority of the safety staff should be made clear, 
particularly in relation to the more technical aspects of 
the installation. Attention should be paid to the means of 
ensuring that the safety officers/advisers are effective and 

The safety objectives set for management and the assess¬ 
ment of the performance in meeting these objectives should 
be indicated. This may not be a simple matter of accident 
statistics. For major hazard installations there is an addi¬ 
tional problem of avoiding rare but catastrophic events. This 
makes it important to monitor both the occurrence of ‘near 
misses’ and the degree of adherence to procedures and rules. 

The programme of safety training provided for employees 
at all levels should be outlined. 
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Attention is also drawn to Licence Condition 9 which is 
concerned with the system of reporting of and learning 
from incidents. 

A24.1.3 Licence Condition: The Responsible Persons 
The organization should nominate Responsible Persons who 
are in charge of the design and operation of the installation. 

The term ‘Responsible Person’ has a specific meaning in 
the context and is explained below. 

The organization should show the management struc¬ 
ture down to the lowest level of executive technical man¬ 
agement, making clear the distinction between executive 
and advisory functions. There should be a job description 
for each post; the job descriptions for the posts held by 
Responsible Persons are particularly important. 

The level of seniority held by the Responsible Person 
should normally be either the lowest or second lowest level 
of technical executive management. 

It is envisaged that persons immediately senior to the 
Responsible Persons will themselves normally have been or 
be qualified to be a Responsible Person on major hazard 
installations, though not necessarily on those processes of 
which they are now in charge. 

The organization should show that a person nominated 
as a Responsible Person is qualified to hold the post by 
reasons of his academic qualifications, practical training 
and recent relevant experience. 

On the operations side, this experience should be 
experience in the operation of the actual process or of a 
similar process. Experience limited to design of the process 
or of similar processes and/or to operation of dissimilar 
processes is not acceptable. On the design side, the experi¬ 
ence should be in the design of similar processes. 

Where the process incorporates features of considerable 
technical novelty as a result of which no person has first¬ 
hand experience of operation of relevant full-scale plant 
even greater regard must be paid to the level of competence 
of the individual and normally experience of pilot plant 
operation would be required. 

Where the installation is to be designed in part or in whole 
by an outside contractor it is the responsibility of the orga¬ 
nization which will operate the installation to satisfy itself 
and to demonstrate to HSE that the design is to an appro¬ 
priate standard. The minimum requirement is that there be 
a nominated Responsible Person in the operating company 
who has the duty of liaison with the contractor. Where 
practical it is also desirable to have nominated Responsible 
Persons in charge of design in the contracting company. 

For convenience, reference is made here only to design and 
operation.The organization should enumerate all the project 
activities such as fabrication, construction, inspection, com¬ 
missioning and satisfy itself and HSE that there are nomi¬ 
nated Responsible Persons responsible for these activities. 

It is emphasized that the ultimate responsibility for the safety 
of the installation lies with the organization which operates it. 

Background The concepts of ‘Responsible’ and ‘Author¬ 
ized’ Persons occur in various management systems. Our 
usage of these words is that ‘Responsible’ relates to a job, for 
example, plant manager, and ‘Authorized’ to a task, for 
example, signing a permit-to-work. 

We have considered various models for Responsible Per¬ 
sons. These include those in the Mines and Quarries Act, 
the Merchant Shipping Act, the Factories Act (radioactive 
substances), the Explosives Act, the Medicines Act. 


We have also considered the arrangement whereby the 
Department of the Environment advised by the Institution 
of Civil Engineers recommends individuals for the design 
of reservoirs. 

Competence to do a job must depend on the definition 
of the job and its relation to other jobs. We began, there¬ 
fore, with a consideration of management structures and 
reviewed possible general models for a large and a small 
firm. It became apparent, however, that this was not a 
particularly helpful approach and it was not pursued. 
However, in a concrete situation we do consider the 
presentation of such a management structure and job 
descriptions desirable. 

With regard to the level of seniority we started with the 
proposition that the Responsible Person should be at the 
lowest level of the executive technical management. How¬ 
ever, this could give rise to problems in some areas. For 
example, it is necessary to train for succession and by 
definition trainees must be at a lower level. Such additional 
lower levels are not normal in existing practice, would be 
wasteful and would not offer job satisfaction. We therefore 
prefer to leave a degree of flexibility. But we do attach 
importance to ensure that the responsibility is real rather 
than nominal and is at the lowest practical level. 

Thus we envisage that the Responsible Person on the 
operations side would usually be capable of ‘stepping down’ 
and carrying out the job at the next level down. 

With regard to selection of Responsible Persons we con¬ 
sider academic qualifications, practical training and recent 
relevant experience essential. 

We think it is desirable that the person chosen should 
have the sort of broad scientific and technological educa¬ 
tion which a first degree in science or engineering usually 
gives. We consider that such a degree should normally be a 
necessary qualification. Exceptionally, however, people 
without a degree may be considered. We also attach impor¬ 
tance to the ability of the person to recognize problems 
outside his sphere of competence and to his willingness to 
seek the advice of other experts. 

We consider that although the Flixhorough disaster has 
emphasized the importance of the integrity of the plant, 
there may be other major hazards where the integrity of the 
process is of at least equal importance. Thus, whilst it is 
probable that the Responsible Person will normally be an 
engineer there will be cases where he will be a scientist, 
for example, a chemist. 

We attach particular importance to the selection of 
Responsible Persons on the operations side. 

We lay particular emphasis on recent relevant experi¬ 
ence. There is obviously room for discussion as to the 
‘relevance’ of experience or the ‘similarity’of processes. It is 
up to the organization to convince HSE on these points. 

We stress, however, that we would not want this empha¬ 
sis on recent relevant experience in any way to inhibit 
technological innovation or normal career development. 

We accept that technological progress requires speciali¬ 
zation. The professional institutions already recognize this 
and are considering a register of persons considered com¬ 
petent to design and operate major hazard installations. We 
are maintaining contact, although, whilst welcoming their 
interest, we see a number of difficulties in this approach. 

The requirement to nominate Responsible Persons 
should not be seen as detracting in any way from the 
necessity for a team effort by management to achieve high 
standards of safety in plants which have major hazards. 
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A24.1.1.4 Licence Condition: The arrangements for the 
identification of hazards 

The organization should show that it uses appropriate 
methods of hazard identification at all stages of the project. 

The terms ‘hazard identification’ and ‘safety audit’ 
refer to mainly qualitative techniques which review the 
existence of a hazard. 

The application of the techniques should be matched to 
the stages of the project, starting with coarse scale inves¬ 
tigations and progressing to fine scale studies to discover 
detailed faults. 

The management system should contain a formal 
requirement for the use of such methods, should specify 
the documentation required arising from this use and 
should monitor this use. 

The organization should show that it has people compe¬ 
tent to implement these methods of hazard identification. 
Background The first objective of hazard identification is 
to reveal the substances or processes which have a hazard 
potential.The second objective is to identify all conceivable 
threats to the installation or its processes which might lead 
to loss of containment. 

As technology has progressed identifying hazards has 
become in some ways more difficult. In particular, there are 
many hazards which are not revealed by traditional visual 
inspection. It has become necessary, therefore, to develop 
additional methods of hazard identification. 

An illustrative list of methods is given in Table A24.1 

Since every human enterprise involves the possibility of 
error it follows that the soundness of the management of 
the potentially hazardous installation is the predominating 
factor and that the first essential in all cases is an audit of 
the management system as a whole. 

It is recognized that there is a wide variety of methods of 
hazard identification in use in industry and that different 
techniques are applicable to different situations. There is 
no intention of imposing any particular method. 

It is necessary that the use of these methods be a 
requirement of the management system, which also should 
specify the degree of recording and documentation 
required and should contain a mechanism for auditing the 
application of the techniques to ensure that they are used. 

The people who have to implement these techniques 
must he competent to do so. HSE should be able to advise on 
opportunities for training in this area. 

Hazard identification covers much the same ground 
as safety audits in the broadest sense. The Chemical 
Industries Association has published two guides entitled 
Safely Audits: A Guide for the Chemical Industry (1973) and 
A Guide to Hazard and Operability Studies (1977). 


A24.1.1.5 Licence Condition: The arrangements 
for the assessment of hazards 

The organization should show that the hazards identified 
by the means described in the preceding section have been 
removed or that the associated risks have been reduced to a 
minimal level. 

In this context ‘minimal’ means the probability that an 
employee or member of the public will be killed or injured 
or that property will he damaged is at least as low as in 
good modern industrial practice. 

The method of demonstrating that the risks are at a 
minimal level should be comprehensive and logical. 


Table A24.1 Some methods of hazard identification 


Project stage 

Hazard identification method 

- 

Management and safety system 
audits 

All stages 

Checklists 

Feedback for workforce 

Research and 

Screening and testing for 

development 

Chemicals (toxicity, instability, 
explosibility) 

Reactions (explosibility) 
Impurities 

Pilot plant 

Predesign 

Hazard indices 

Insurance assessments 

Hazard studies (coarse scale) 

Design 

Process design checks 

Unit processes 

Unit operations 

Plant equipment 

Hazard and operability studies 
(fine scale) 

Failure modes and effects analysis 
Fault tree and event trees 

Hazard analysis 

Realibility assessments 

Operator task analysis and 
operating instructions 

Commissioning 

Checks against design, inspection, 
examination, testing 

Non-destructive testing, 
condition monitoring 

Plant safety audits 

Emergency planning 

Operation 

Inspection testing 

Non-destructive testing, condition 
monitoring 

Plant safety audits 


The method may consist of: 


(1) the use of codes of practice generally recognized in the 
industry; 

(2) the use of special testing; 

(3) the use of calculations based on appropriate data. 

In many cases it will be sufficient to show for all or at 
least some aspects of the hazard that a generally recog¬ 
nized and accepted code of practice is applicable and has 
been followed. 

Where there is any aspect of the hazard, the risk of which 
cannot be reduced to a minimal level by following a recog¬ 
nized code of practice or by special testing, then, whenever 
meaningful quantitative methods should be used to 
demonstrate that the risk has been reduced to a minimal 
level. These quantitative methods will normally consist of 
three steps: 

(1) An estimate of the consequence to employees and the 
public. 

(2) An estimate of the frequencies with which hazardous 
situations will occur. 
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(3) Comparison of (1) and (2) with the other risks to which 
people are normally exposed in order to show that the 
risk under consideration is relatively small. 

The management system should contain a formal 
requirement that such methods of hazard assessment 
should be applied. 

The organization should show that it has access to peo¬ 
ple competent to implement these methods. 

Background Having identified hazards, as described in 
the previous sections, it is necessary to know that the 
associated risks have been reduced to a minimal level. 

It is envisaged that the method of demonstrating that the 
risks are at a minimal level will normally be based on a fault 
tree approach, but that a detailed development of all parts 
of the tree will not generally be required. 

Sometimes it is possible to remove a hazard completely, 
for example, by replacing a flammable or toxic raw material 
by a non-flammable or non-toxic one. 

More often, the hazard cannot be eliminated completely, 
though the risk can be reduced to any desired level by the 
use of protective equipment. For example, the risk that a 
particular vessel will burst because of overpressure can be 
reduced by fitting a relief valve suitable for the duty, ade¬ 
quately sized and properly maintained. This does not 
eliminate the hazard completely as there is a small prob¬ 
ability that the relief valve will fail to lift when required. 
Even if two relief valves are fitted, there is still a very small 
probability of coincident failure. 

In many cases, codes of practice provide generally 
recognized and accepted methods of reducing a hazard to 
a minimum level. For example, in the case just considered, 
it would normally be sufficient to show that the vessel is 
fitted with a relief valve, adequately sized and properly 
maintained, as relief valves have been generally recognized 
for many years as an accepted way of reducing to a minimal 
level the probability that a vessel will burst. 

Similarly, if fracture of pipework has been identified as a 
hazard, it would be sufficient to show that the pipework has 
been designed and constructed and will be operated and 
maintained in accordance with a recognized and relevant 
code of practice. 

Codes of practice should not be used outside their area of 
applicability. Codes of practice for pipework, for example, 
do not cover fracture by projectiles and if it is necessary to 
take the latter into account, a separate study is necessary. 

Moreover, codes of practice imply acceptance of some level 
of probability of the hazard materializing. This level will be 
unacceptably high in relation to some maj or hazards. 

In some cases, it may be necessary to carry out special 
tests to quantify aspects of particular hazards. 

Where there is no generally accepted code of practice and 
where the problem cannot be resolved by testing, but where 
it is reasonably practicable to show quantitatively that the 
risk has been reduced to a minimal level, this should be 
done. In some cases, this cannot be done because of lack of 
data or of a suitable model to describe the system. In these 
cases, judgement will have to be used. 

Examples of hazards which may not be covered by 
recognized codes of practice and which, if they produce 
major effects, would have to be individually assessed, are: 


(1) runaway reactions (e.g. decomposition and poly¬ 
merization reactions); 


(2) impact of moving objects (e.g. cranes, vehicles, 
missiles from explosions); 

(3) failure of instrumental protective systems; 

(4) failure of services (e.g. electricity, water, compressed air). 

These can be described as events leading to possible loss 

of containment. 

The hazard quantification will normally consist of three 
stages in which probability and consequence must both be 
considered; sometimes it will be necessary to consider a 
number of possible outcomes differing in probability and 
consequence. An event which has the potential to kill many 
people may not cause great concern if the probability of it 
occurring is sufficiently small. We do not prohibit football 
matches because there is a small chance that an aeroplane 
may crash on the crowd. On the other hand, we would not 
build a new football ground at the end of a busy runway. 

(1) The first stage is the estimation of the probable con¬ 
sequence of the hazard. This may be based on past 
experience or it may be estimated from a theoretical 
study of the problem. The consequences may be 
expressed as the probability that an employee or a 
member of the public will be killed or injured or as the 
probability that extensive damage will be caused to 
the property of others or both. 

(2) The second stage is the estimation of the probability 
that the hazard will occur. Again this estimate may be 
based on past experience, or it may be synthesized 
from data on the failure rates of individual compo¬ 
nents or pieces of equipment. 

In estimating the probability that the hazard will occur it 
is necessary to assume that certain standards are followed 
in the operation of the equipment, for example, that relief 
valves are tested regularly. If these standards are not fol¬ 
lowed the conclusions of the hazard quantification are no 
longer valid. 

(3) The third stage is comparison of (1) and (2) with the 
other hazards to which people are exposed in order to 
ensure that the risk under consideration is minimal. 

This implies the use of a criterion against which risks 
can be judged. It is not intended that any single criterion 
should cover all cases. 

If it is not possible to carry out a complete study as indi¬ 
cated (i.e. stages 1-3), it may be possible to carry out a 
partial study and, if so, this should be done, as it helps to 
identify those aspects of the problem which have most 
effect on the probability and consequences. 

Where a new feature is used in place of one of proven 
reliability then it should be shown that the new feature is at 
least as safe as, and preferably safer than, the original. For 
example, if an instrumented protective system is used in 
place of a relief valve it should be shown to fail no more 
often, and preferably less often, than a relief valve. 

In other cases it may be appropriate to show that the risk 
to an employee is no greater than that for employees in the 
industry as a whole or to show that the risk to a member of 
the public is comparable with the other risks to which the 
public are exposed without their consent. 

It may be noted that it is difficult to find examples of 
instances in which members of the public have been killed 
as a result of accidents on major hazard installations. In 
most cases, if the risk to employees is minimal the risk to 
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the public will also be minimal; although a lower level of 
risk is required, the public are usually further away. 

It is necessary that the use of quantitative methods, 
whenever meaningful, should be a requirement of the 
management system. This should specify the recording 
and documentation required. 

In some cases a detailed study may be required taking 
many days or even weeks, but in other cases relatively 
simple calculations may be sufficient. 

The organization should show that it has access to, and 
uses as necessary, people competent to assess hazards, but 
these people need not be in its full-time employment; they 
may be consultants. 

Quantitative methods provide a means to assist man¬ 
agement to choose those measures which are ‘reasonably 
practicable’ for providing a safe plant and system of work. 

A24.1.1.6 Licence Condition: The arrangements for 
the design and operation of pressure systems 
The organization should show that it has a formal and 
well-understood management system for controlling and 
monitoring the design, fabrication, commissioning, opera¬ 
tion, inspection and testing of pipework, vessels and other 
equipment together forming the constituents of a pressure 
system which may give rise to a serious hazard. 

The term ‘pressure system’ refers to a linked series of 
equipment items operating at a pressure either above 
atmospheric or under vacuum, together with all the inter¬ 
connecting pipework. Such systems commonly form pro¬ 
cessing units, but the definition includes also storage and 
handling installations. 

The management system of control should be in two 
parts, and should be effected through two recognized chan¬ 
nels of authorization, related to Design and to Operation. 

The management design authority should identify and 
state the design parameters within which the pressure 
system is to operate and the conditions for which each 
component part of the pressure system shall be designed. It 
should also define the code under which the individual 
components shall be designed, or where no design code 
exists should cause sufficient work to be undertaken to 
satisfy themselves, either by experiment or by the use of 
specialist advisers, that the design is at least as safe under 
all foreseeable circumstances as the standard demanded by 
recognized codes. 

The design authority should also define the standards to 
be used for the pressure system during the fabrication and 
construction stages. Whenever possible the standards 
specified should be those quoted in recognized codes 
applicable to the particular pressure system. 

Management should ensure that an appropriate inspec¬ 
tion system is operated during fabrication and construc¬ 
tion work to check that the standards set by the 
management design authority are being met. This inspec¬ 
tion system may be in the same management organization 
as the design authority, or it may be appropriate to use one 
of the engineering insurance companies or other approved 
inspection agency. The inspection system should not be 
part of the operating authority. The design authority 
should also specify the written evidence required to 
demonstrate that the plant has been fabricated, constructed 
and proof-tested, in accordance with the design require¬ 
ments. Copies of documentation forming this written 
evidence should be verified, preferably by the inspec¬ 
tion agency before the pressure system enters service. 


Copies of all documentation relating to the design 
parameters, and to the verification by the inspection sys¬ 
tem, should be retained by the design authority and should 
also be available on the works on which the pressure system 
is operated. 

The operating authority should prepare a comprehen¬ 
sive set of instructions based on information issued by the 
design authority and upon an analysis of hazards involved. 
These instructions should set out clearly the way in which 
the pressure system shall be operated in both normal and 
abnormal circumstances, and the way in which the pressure 
system is to be protected from the effect of conditions more 
extreme than those permitted by the design authority. 
These instructions, which should be readily available to all 
those responsible for operation, inspection and repair of 
the pressure system, should set the limits within which the 
system is to be operated. Any variation in these limits out- 
with the parameters set by the design authority should 
be referred to the design authority or other independent 
qualified body for approval before fresh instructions are 
issued. Such submission and approval should be made 
in writing and copies retained in the works for future 
reference. 

The operating authority is responsible for ensuring that 
any repairs and modifications are designed, fabricated and 
tested to a standard not less than that used by the design 
authority for the original system. The operating authority 
should have a system of documentation which controls the 
repair and modification procedures, so that modification to 
the pressure system cannot be made without written 
authority from an authorized person. 

Thus, instructions prepared by the operating authority 
should include formal procedures for identifying and 
making process modifications, for identifying and making 
plant modifications and for restarting the plant after dis¬ 
covery of a serious defect. 

The operating authority should also provide and enforce 
the use of a code which ensures the continuing safety of the 
pressure system by a regular inspection of the equipment 
and the safety devices which are provided to protect that 
equipment. Such an inspection code should meet the 
following criteria. First, that a register is held on each 
works in which each item of equipment is given a unique 
designation and an engineering description which ade¬ 
quately describes the design and fabrication details and 
also details of operating conditions, both normal and 
maximum. Secondly, that the code should specify the fre¬ 
quency of inspection for the various classes of equipment 
and should also specify rules concerning the selection and 
training of inspectors. There should also be rules by which 
inspection frequencies may be increased or reduced, deci¬ 
sions being based upon the result of inspection records 
which should be held in the register. The code should spe¬ 
cify rules which guarantee the independence of the 
inspecting system from the operating authority, either by 
appointing external inspection authorities, or by making 
satisfactory arrangements for the in-house inspection 
authority to be responsible to a senior member of the 
organization who has the design authority within his 
charge. 

The organization should show that it has people com¬ 
petent to execute the control and monitoring functions 
described above in both the design authority and operating 
authority areas. It should also show that the inspection 
service is truly independent of the operating authority. 
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Background The control of design and operation of pres¬ 
sure systems is a cardinal feature for ensuring safe opera¬ 
tion of major hazard plants. 

The separation of management control into the areas of 
a design authority and an operating authority has been 
made in order to bring out clearly the separate responsi¬ 
bilities of these two parts of the total organization which 
designs, builds and operates a major hazard plant. The 
areas of authority interlock, and in small organizations 
there may be sharing of some specialist personnel. It is 
important, however, that the design concept and sub¬ 
sequent modifications to that concept should be controlled 
by an authority separate from the operating authority. In 
cases of contractor design, the organization will have to 
show that the contractor can carry out the duties of a design 
authority, particularly in the matter of documentation con¬ 
cerning the design parameters for the pressure system and 
the fabrication details, and in the provision of competent 
people for authorization. 

The use of a regular inspection is an essential feature of 
the safe continued operation of a pressure system. The 
register of equipment and inspection reports is the linchpin 
around which this inspection system is built. Decisions on 
the frequency of inspection and the nature of satisfactory 
inspection procedures should he taken by the inspecting 
authority with advice from the design authority. An 
essential feature of the integrity of the system is that the 
inspectors and their management are not under the tech¬ 
nical control of the operating authority. In small organiza¬ 
tions, considerable use can be made of external inspection 
agencies and other specialist help. In large organizations, 
such facilities are likely to be provided in-house. In those 
cases the organization should take particular care to show 
the independence of the inspection agency. 

It is important that safety devices such as relief valves, 
non-return valves and vents are included in the register of 
pressure systems and are subject to the same type of 
inspection and testing arrangements as are specified for 
the pressure equipment. Details of testing and frequency of 
examination may well be different from arrangements 
made for pressure equipment, but the principle of inclusion 
in a register, together with test and inspection notes, is 
essential. 

A system for registering and inspecting pressure vessels 
and other equipment and for the keeping of verification 
documentation which satisfies many of these criteria is 
described in BS 5500:1976 Unfired fusion welded pressure 
vessels, in the Pressure Vessel Inspection Code and in the 
draft Piping Systems Inspection Code of the Institute of 
Petroleum. 


A24.1.1.7 Licence Condition: The arrangement for 
minimization of exposure of personnel 
The organization should show that it has assessed the 
hazards to personnel involved in the installation and that 
where necessary it has taken steps to reduce these hazards to 
a minimal level. In particular, measures should be taken to 
limit the number of people at any one time in areas of high 
hazard to a minimum consistent with safe and efficient 
operation and to afford protection to exposed personnel, who 
may include operating personnel, maintenance personnel, 
investigation teams, construction workers and visitors. 
Background This matter is fully dealt with in chapter 7 of 
this report. 


A24.1.1.8 Licence Condition: The arrangements for the 
administration of emergencies 

The organization should show that it has assessed the 
hazards involved in the installation in relation to major 
emergencies and has maintained emergency plans. 

Emergency planning should include identification and 
assessment of possible major emergencies; nomination of 
persons responsible for administering an emergency; 
development of procedures for declaring, communicating 
and controlling the emergency and for evacuation; provision 
of buildings such as a control centre or refuge rooms and of 
equipment such as an alarm system; designation of works 
emergency teams and definition of duties of other workers; 
liaison with external services including police, fire and 
medical services; training and exercises for emergencies. 
Background A guide Recommended Procedures for Hand¬ 
ling Major Emergencies is published by the Chemical 
Industries Association (second edition, 1976). This covers 
primarily the administration of emergencies within the 
works. 

The guide also deals briefly with the planning of action, 
such as evacuation, which may be required outside the 
works. This is particularly important for certain major 
hazards. It should be emphasized in this connection that for 
toxic gas hazards the value of the time bought by any dis¬ 
tance separating the factory and the public may be wasted 
if there is no evacuation plan. 

A24.1.1.9 Licence Condition: The arrangements for 
reporting of and learning from incidents 
The organization should show that it has prepared a sched¬ 
ule of signals to be recorded and that the relevant instru¬ 
ments are housed in such a way that an accident on the 
plant is unlikely to prevent recovery of the records. 

The organization should show that it has a system for the 
reporting of incidents which might endanger the installa¬ 
tion or lead to loss of containment and that it uses the 
information obtained from this reporting system to learn 
how to reduce these hazards. 

These requirements for the reporting of hazardous inci¬ 
dents are additional to the existing statutory requirements. 
They have two main objectives. One is to ensure the 
reporting within the company of the ‘near miss’ type of 
incidents which often precede an accident. The other is to 
obtain data at national level on incidents related to serious 
hazards. HSE may request that certain types of incident be 
included. 

Background There already exist certain statutory 
requirements for the reporting of incidents. These include: 

(1) The Petroleum (Consolidation) Act 1928; 

(2) The Factories Act 1961; 

(3) The Dangerous Occurrences (Notification) Regula¬ 
tions 1947; 

as well as those specific to explosives factories, mines and 
quarries, and nuclear installations. 

These requirements are mainly concerned with acci¬ 
dents causing plant downtime, lost-time accidents and 
fatalities. 

It is well-known, however, that for every serious accident 
there are numerous incidents, including ‘near misses’. 
Since they are more numerous, these incidents offer greater 
scope for learning and improvement. 
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It is therefore proposed that the organization should have 
its own reporting system covering the type of incident sig¬ 
nificant in relation to its particular hazards. 

We have deliberately not specified the incidents which 
should be reported but we have in mind incidents relating 
to such matters as: 

(1) incidents involving serious operator error; 

(2) incidents involving trip system malfunction or dis¬ 
arming; 

(3) malfunctions of valves, for example, pressure relief, 
non-return; 

(4) leaks of flammable materials; 

(5) leaks of toxic materials; 

(6) leaks and fires at pumps; 

(7) fires and explosions in furnaces; 

(8) storage tank collapse. 

The important point is that the reporting system should 
be tailored to the needs of the organization. 

There may also be certain types of incident on which 
HSE wish to collect information nationally. In this case it 
may request their inclusion in the reporting scheme. Again 
we have not specified these incidents but an obvious one is 
the unconfined vapour cloud explosion. 

These reporting requirements should be seen in relation 
to the fact that we have not recommended that all major 
hazard installations have a ‘black box’ recording instru¬ 
ment system.We consider that the arrangements proposed 
here are a more efficient way of learning both at company 
and national level. 

The reporting system is intended primarily to assist the 
organization to learn from incidents and it should show 
that it has formal arrangements to do this. 

A24.1.1.10 Licence Condition: the design and operating 
documentation 

The organization should provide full documentation on the 
design and operation of the installation. The documenta¬ 
tion required is as follows: 

Parti Documentation 

(For Part 1(a) The System Documentation see Introductory 
Section of this appendix.) 

Part 2(b)Preliminary Design Document This should contain: 

(1) A brief description of the process and should include 
the nature of any chemical reaction involved and the 
various operations to which the material in process is 
subjected. In addition, any other exothermic reac¬ 
tions which may arise if operating conditions fall 
outside the design values, should be specified. 

(2) A comprehensive description of the nature of the 
hazards in the materials handled (toxic, flammable, 
explosive materials), of the objectives to be achieved 
in order to limit these hazards and of the methods 
in plant design and operation necessary to achieve 
these objectives. 

(3) A statement of any less hazardous process which 
could have been used and the reasons for selecting the 
particular process in question. This might include 
outstanding economic advantages, factors relating to 
the availability of raw materials, the avoidance of 
particularly difficult engineering operations or the 
necessity of making a product of a particular purity. 


(4) A process flow sheet, indicating quantities, the tem¬ 
peratures and pressures of materials at each stage 
and the vessel inventories, and the flow-rates in each 
of the principal flowlines. The reasons why such 
pressures and temperatures must be used should be 
given. Mass and heat balance diagrams should be 
given where appropriate. 

(5) A list of the main plant items, specifying the capa¬ 
city, design pressure, temperature limits for safe 
operation (upper and lower), and any special fea¬ 
tures of construction, together with the actual oper¬ 
ating conditions. Details of services should be given. 

(6) Details of the principal standards and codes to be 
used in the design. 

(7) A statement of the inventory of all hazardous materials 
in process and of the steps taken to keep this at 
the lowest level consistent with safe and efficient 
operation. 

(8) A statement of the method whereby the process will be 
controlled. Abnormal features, with particular refer¬ 
ence to hazards, should be highlighted and references 
made to any special features, including trip systems. 

(9) A list of all hazardous materials in bulk storage 
which may be endangered by a process incident and 
the steps to be taken to minimize the risk of their 
involvement. 

(10) A statement of all materials and services needed to 
maintain safe operation of the plant and of the steps 
taken to ensure their continuous availability. 

(11) A statement of any noxious effluents and their 
methods of treatment. 

(12) A site layout showing the proposed plant and control 
room, and their position relative to other installa¬ 
tions and buildings in the works, to loading bays at 
tanker terminals, to plants in neighbouring works 
and to the public area. 

(13) A statement of the location and construction of the 
control room. 

(14) The routing for all vehicles needing access to the 
plant, whether for the supply of materials and 
removal of products, or for maintenance or emer¬ 
gency purposes. 

(15) An account of the procedures for maintaining effec¬ 
tive liaison between the company and any outside 
organizations involved in the design or construction 
of the plant. 

(16) Details of actual experience of the company, or of 
availability of experience from external sources, in 
operation of pilot and production scale plants, for the 
same or a similar process. 

(17) Manning levels on the plant. 

(18) Proposals for dealing with emergency situations. 

Part 2 Documentation 

(For Part 2(a) The Background Documentation see Intro¬ 
ductory Section of this appendix.) 

Part 2(b) The Design Document This should contain: 


(1) An updated and detailed statement of all materials 
submitted in the Preliminary Design Document, 
including the process flowsheet, quantities and 
flowrates of all materials in process and storage 
areas, heat and material balances, instrument dia¬ 
grams and plant layout diagrams. 
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(2) Details of all principal plant items, as in item 5 of 
Part 1(b), giving codes used, materials of construc¬ 
tion and any special features. 

(3) Installation drawings and pipe layouts. 

(4) Documentation on hazard assessments and relia¬ 
bility studies. 

Part 2(c) The Operating Document This should contain: 

(1) A statement of the technical staff structure, including 
names of the Responsible Persons, together with 


details of standby arrangements for absence such 
as sickness or holidays, and of call-in arrangements. 

(2) A statement of the numbers of operating personnel 
and of their training with particular reference to 
emergency procedures. 

(3) The Operating Manual. This should include details 
of the start-up, normal shut-down and emergency 
shut-down procedures. 
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The Third Report of the Advisory Committee on Major 
Hazards (Harvey, 1984) contains an appendix on ‘The Siting 
of Developments in the Vicinities of Major Hazards: HSE’s 
Draft Guidelines to Planning Authorities. The full text, 
which is reproduced by courtesy of the HM Stationery 
Office, is given below. 

A25.1 The Siting of Developments in the Vicinities 
of Major Hazards: HSE’s Draft Guidelines to 
Planning Authorities (by the Health and Safety 
Executive - Major Hazards Assessment Unit) 

A25.1.1 Introduction 

The control of risks from major hazards may be achieved in 
various ways, for example: 

(1) limit the amount of hazardous material present; 

(2) reduce the likelihood of an accidental release of 
material; 

(3) plan for emergencies; 

(4) reduce the number of people exposed to risk. 

Some of these measures may be taken within the installa¬ 
tion, particularly at the project planning stage. 

In many cases the situation in the installations is already 
fixed and the scope for improvement under the HSW Act is 
fully utilized. Even so, there may remain some residual 
risk. It is unlikely that the residual risk could justify the 
removal of existing populations by the termination of 
viable land uses. However, it is possible to inhibit an 
increase in the population at risk by control of new devel¬ 
opments under planning legislation. 

It is the purpose of HSE’s advice to facilitate planning 
control where appropriate. Planning authorities are expec¬ 
ted to include the factor of risk in their consideration of a 
planning decision. Thus, the types of development near 
major hazards should be deliberately chosen to minimize 
the population at risk. 

HSE takes as a starting point the assumption that the 
major hazard installation complies with the requirements 
of HSW Act. It is then necessary to assess the level of resi¬ 
dual risk to a proposed development in the vicinity, and to 
judge whether this might be a significant factor in the 
planning decision. HSE’s assessment takes account of the 
consequences and likelihoods of various accident scenar¬ 
ios, and the implications of variations in vulnerability 
between different types of development. In some cases, the 
assumption of compliance with HSW Act implies a precise 
standard. 

In other cases the standards are not precisely defined, or it 
may be possible to comply in a variety of ways. The indi¬ 
vidual characteristics of installations are taken into account 
where possible, but there are limits to the amount of detail 
which can be considered. It may be necessary to assume 
average performance in the absence of obvious individual 
variations, or for cases which are being assessed on paper. 

This note deals only with the provision of advice on 
proposals for new developments in the vicinity of existing 
major hazard. The assessment techniques are used in a 
similar way when considering the siting of new major 
hazards in relation to existing buildings, but the judgement 
of the significance of the risks may be different. For exam¬ 
ple, the siting of a new major hazard may be constrained by 
the need to integrate it with existing plant. The application 
of a simple ‘reciprocal rule’ for the siting of new major 


hazards would neglect the differences in availability of 
sites for the two situations. There is also the possibility of 
seeking special safety standards on a new plant to facilitate 
its siting. 

A25.1.2 Assessment: likelihood and consequences of 
an accident 

The first part of the assessment is objective in the sense 
that it does not include social or political judgements, but it 
does include estimates of various factors where data is 
more or less unavailable. Thus it includes technical judge¬ 
ment by professional risk assessors. There is inevitably 
some uncertainty introduced by this judgement process 
and by lack of precision in basic data. This does not prevent 
the derivation of reasonable conclusions but it does imply 
that some caution is necessary. The technical judgements 
may tend to lead to an over-estimate of the risk level. If a 
planning decision is finely balanced, a more detailed 
review of assumptions may be worthwhile. 

Assessments of risk from different materials differ in 
detail but they have many features in common. The basic 
sequence of events for LPG and chlorine are: 

(1) LPG: 

plant failure; 
release; 
vaporization; 
mixture with air; 
ignition; 

explosion and/or fire; 
blast and/or heat propagation; 
impact (either directly on people, or on buildings 
which collapse or burn). 

(2) Chlorine: 
plant failure; 
release; 
vaporization; 
mixture with air; 
travel downwind; 
dilution; 
inhalation; 
injury. 

The risks from such sequences can be evaluated in two 
main ways, namely historical and analytical. In the histor¬ 
ical approach, information from past incidents is used to 
predict the risks. The Second Report of the Advisory Com¬ 
mittee contains information on some past incidents, and it 
derives a ‘Mortality Index’ to indicate the average number 
of fatalities per tonne of material released. This approach 
may be useful to devise a hazard rating for a material, but it 
is noticeable that the average index conceals a wide varia¬ 
tion between cases and it is thus of questionable value for 
predicting individual situations. Other problems with the 
historical approach are the small number of cases and the 
incompleteness of information on cases, so it may therefore 
provide a rather poor statistical basis. This approach might 
be difficult to adapt for prediction in situations different 
from those already included by the accidents. 

The alternative, analytical approach attempts to syn¬ 
thesize the risk on the basis of sequences outlined above. 
This approach is complex and requires assumptions to be 
made in the absence of data. Also, it may be difficult to 
select appropriate scenarios to include. It is, of course, 
possible to combine the approaches, and in practice this is 
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what is done. The historical approach is used to provide 
information on the likelihoods of releases, while the analy¬ 
tical approach is used to predict consequences. To illustrate 
the approach, the example of bulk pressurized LPG is used. 
Installations of this type comprise the majority of the major 
hazards in Britain, and the risks from them are relatively 

damaging but they are so unlikely as to present negligible 
extra risk. For the LPG example, separation distance 
guidelines for the siting of the first category of develop¬ 
ment near existing installations tend to be based on the 
provision of substantial protection from BLEVE and 
UVCE; this automatically gives a very high degree of 

listing the various possible releases, either by quantity 
(short release, e.g. tank burst) or by rate (long release, e.g. 
uncontrolled pipe-split). There is a continuous range of 
possible release, but this can usually be simplified by 
identifying obvious sub-divisions. For the LPG case we 
might have: 

A25.1.3 Assessment: types of development 

It was indicated earlier that different types of building 
may have associated with them populations whose vulner¬ 
abilities differ. This may be of great importance in a siting 

Event 

Probability 

Consequences 

Minor flange or gland 
weeping 

Pipework break 

Tank burst: BLEVE 

Tank burst: UVCE 
(delayed ignition) 

Tank burst: drifting 
gas clouds 

Quite likely 

Rather unlikely, especially 
for major cases 

Very unlikely 

Extremely unlikely 

Extremely unlikely 

Not felt off-site 

Localized, but could extend 
off-site from major cases 

May be harmful at considerable distances off-site 
May be harmful at considerable distances off-site 

May be harmful at considerable distances off-site 


It is now necessary to determine more precisely what are 
the probabilities and consequences of these events. 
Obviously there could be wide variations between indivi¬ 
dual plants and between events in each sub-division. For 
example, the effects from pipe-break might depend on: size 
of hole; duration before shut-off; whether liquid gaseous or 
two-phase; wind-speed; delay before ignition; dispersion to 
below flammable limits; type of combustion, and specific 
site features. To simplify the problem, assumptions are 
made to give an indication of the realistic outcome from the 
most severe event within a sub-division. 

The consequences in terms of likelihood of injury are 
derived by first calculating the impact intensity of the 
heat or blast at a particular distance, then relating this to 
the vulnerability of the population at that distance. The 
possibility is noted that different types of building, having 
different populations, might give different degrees of 
protection from any given intensity. 

The result of this process is a list of events and risks. 
A decision can then be made on which events are trivial 
in that no injury could result. For remaining events, the 
consequences are considered in conjunction with the 
likelihood, to determine the combined risk of release and 
injury. This completes the objective assessment. 

It should be noted that this approach does not auto¬ 
matically rule out from consideration any type of source 
event, however unlikely. Even the largest, most unlikely 
events are included, so there is not necessarily any cut-off 
corresponding to a ‘maximum credible accident’. However, 
attention is paid to the combined risks, which may be very 
small from an unlikely event, so that the largest events are 
not necessarily significant determinants of the overall risk. 
In practice, assessments may be based on one or two events 
which may thus appear to correspond to ‘maximum cred¬ 
ible accidents;’ this implies that lesser events may be more 


judgement. HSE feels that it would be inappropriate to 
advise against all forms of new development near major 
hazards nor need new major hazards to be sited away from 
all existing buildings. Types of developments may be dis¬ 
tinguished by various factors which relate to the risks, for 
example 

(1) whether residential, workplace, recreational, shop¬ 
ping, etc.; 

(2) length of time any individual may be present; 

(3) number of people who may be present and duration of 
occupancy; 

(4) ease of evacuation; 

(5) inherent vulnerability of people, for example, elderly, 
disabled, children; 

(6) physical factors, for example building height, materi¬ 
als of construction, etc. 

On the basis of these factors, HSE identifies three main 
categories of development. The first consists of develop¬ 
ments where users would be present for most of the time, 
or where large numbers could be present at any one time, 
or where people are particularly vulnerable. Examples 
include housing, shopping centres or very large retail out¬ 
lets, multi-storey office blocks, etc. The second category 
consists of less sensitive developments and includes 
industrial developments with low employment density, 
warehouses, etc. HSE also identifies a third category con¬ 
taining special cases such as hospitals, schools and other 
particularly vulnerable developments, to which particular 
attention should be paid in siting judgements. 

It is normally advised that planning control is only 
necessary in respect of the first and third categories of 
developments near major hazard installations. There are 
various mitigating factors associated with the second 
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category, such that it would be difficult to argue that the risks 
to users justify inhibition of this type of land use. These 
factors could include ease of evacuation, low occupancy¬ 
time, fitness of population (e.g. adult workforce), small 
number of people, building protection or building not hazar¬ 
dous to occupants, etc. 

A25.1.4 Summary of MHAU’s advice 

For LPG and similar flammable liquid gases, HSE recom¬ 
mends separation distance limits such that the consequ¬ 
ences of minor releases at the limit would not be injurious, 
while the consequences of major releases (BLEVE, UVCE) 
would be unlikely to seriously injure more than a small 
fraction of the exposed population. In principle, unignited 
vapour clouds could travel to the limit, or even beyond it in 
unfavourable weather conditions, and people enveloped in 
a cloud would probably be seriously injured, but the risk to 
an individual from such a scenario is very low. 

For chlorine, HSE recommends separation distance limits 
such that the consequences of major pipework failures 
would be unlikely to seriously injure more than a small 
fraction of the population downwind, in typical prevailing 
weather conditions. In unfavourable weather, or with larger 
releases from tank failure, people at greater distances could 
be injured, but the risk to an individual from such a scenario 
is very low. 

A25.1.5 Presentation of advice 

In presenting its advice, HSE attempts to give planning 
authorities clear guidance on the weight to be attached to 


the factor of safety. HSE tends to use one of three graded 
responses as follows: 

Situation 1 (negligible risk): No significant reasons for 
refusing planning permission. 

Situation 2 (marginal risk): The risks are very small and 
are not in themselves sufficient grounds for refusing plan¬ 
ning permission, but they could be a factor against the 
development to add to any other adverse factors. This 
would apply near the outer limit of separation distance, or 
with small developments. 

Situation 3 (substantial risk): While the probability of a 
serious incident is low, the consequences at the proposed 
development site could be serious. The safety issue should 
be a major factor and the planning authority is advised not 
to grant planning permission. If there were other factors 
which weighed strongly in favour of the application, HSE 
would seek to explain the technical assessment and level of 
risk in more detail before the planning authority’s decision 
was made. (In exceptional cases of situation 3, where the 
planning authority was minded to grant permission con¬ 
trary to the HSE’s advice, HSE might consider whether to 
request a planning inquiry where the issues could be 
examined in detail in a public forum.) 

It often happens that an initial unfavourable response 
from HSE leads to discussions of the scope for modifica¬ 
tions to reduce the risk. Significant reduction may enable 
HSE to advise favourably. In other cases, HSE may give a 
conditional response, with advice on the use of planning 
conditions to ensure that the risk is reduced. 
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In a limited number of cases, a planning proposal involving 
a major hazard goes to a public inquiry. The inquiry will 
then normally hear technical evidence, which is likely to 
centre around the hazard assessments carried out by the 
parties. Experience shows that there are a number of prob¬ 
lems associated with expert testimony at public inquiries. 

A study of large public inquiries is given in The Big Public 
Inquiry by Sieghart (1979). 

Accounts have been given of the public inquiries at 
Mossmorran by McGill (1981,1982,1983), Pheasant Wood 
by Petts (1985b) and at Canvey by Petts (1985a). A com¬ 
parative review of the problems of expert evidence at public 
inquiries and proposals for their mitigation has been given 
by Petts,Withers and Lees (1986). 

Public accident inquiries are discussed in Chapter 27. 

A26.1 Mossmorran 

It is usual in Scotland for planning applications for major 
oil-related developments to be called in for review by the 
Secretary of State. In the case of the application of Shell 
Expro to build a gas plant and of Esso Chem to build an 
ethylene cracker at Mossmorran together with associated 
facilities at Braefoot Bay, the minister decided on a public 
inquiry, which was held in 1977. The local planning 
authority (LPA) retained the consultants Cremer and 
Warner to produce an assessment of the hazards. The 
Health and Safety Executive (HSE) also gave its own 
assessment. These were the two main sources of technical 
evidence and neither opposed the development. Opposition 
came from local interest groups at Aberdour, Braefoot Bay 
and Dalgety Bay, who produced their own assessment. 
There was a delay of some 18 months after the inquiry 
closed until 1979 before the minister gave his approval. The 
delay was apparently caused in part at least by the issue of 
ignition of ‘radio sparks’, which was raised after the 
inquiry had ended. 

The Mossmorran inquiry, which has been studied by 
McGill (1981, 1982, 1983), illustrated the difficulties of 
public inquiries on hazardous installations, particularly 
with regard to expert testimony. The amount of informa¬ 
tion on the plant limited the contribution of the HSE and 
severely restricted that of the objectors. The latter con¬ 
sidered that the statutory authorities had not made avail¬ 
able a sufficiently full hazard assessment and they were 
not satisfied that the objections made to the assessments 
presented received sufficient weight or that either the LPA 
or the HSE were sufficiently independent of government 
and industry. The LPA were clearly in favour of the propo¬ 
sals before they commissioned the consultant’s report. 

A planning application is concerned with the develop¬ 
ment of land. The extent to which a planning inquiry 
should cover marine activities is perhaps a grey area. The 
hazards from marine activities at Braefoot Bay were briefly 
considered in the consultant’s report and the inspector did 
take some evidence on shipping movements in the estuary, 
but marine hazards were not thoroughly revealed. The 
objectors were not unnaturally more concerned with the 
level of risk than with its source and considered that 
insufficient attention was given to the marine hazards, 
which might exceed those from land-based activities. 

The inquiry exemplified the problem of assessing the 
risk from a plant for which the completed design is not yet 
available. The first stage of planning permission is outline 
planning permission. At this point,the design of the plant 


is generally available as a feasibility study only. It is outline 
planning permission, however, which is the important 
stage and it is difficult thereafter to revoke permission. In 
this case since the detailed design of the plant had not 
been done when planning permission was applied for, the 
assessments which could be made were that much less 
detailed and the uncertainties in the risks assessed that 
much greater. The objectors evidently thought that an ade¬ 
quate estimate of the risks could not be made without a 
hazop study, although this cannot be done until a detailed 
design is available. 

The inquiry did demonstrate, however, the effectiveness 
of a planning condition. Condition 24 of the planning per¬ 
mission eventually given required the companies to carry 
out hazop studies and major studies were carried out. 

The consultant’s report reviewed the various hazard 
scenarios and graded their likelihood in qualitative terms 
such as ‘low’, ‘very low’ and ‘extremely low’, but did not 
give a full assessment of individual and societal risks. 
The HSE evidence was qualitative. The lack of any full 
quantitative assessment was criticized by the interest 
groups, who emphasized that the Canvey study, a quan¬ 
titative assessment and public report, was regarded by 
the HSE as a major step forward in hazard control, yet 
such an exercise was not done for Mossmorran. These 
groups were also critical of various apparent inconsist¬ 
encies in the HSE approach. It was alleged that the HSE 
estimate of the maximum credible spill at Braefoot Bay 
was not consistent with that given for Canvey and that 
the HSE was recommending a cordon sanitaire at the gas 
plant but not at the marine terminal, where many of the 
hazards were. Some of the HSE’s assessments of physical 
phenomena were challenged and the opposition was able 
to call expert witnesses of some academic standing. The 
safety distances acceptable to the HSE were said to be 
less than those required in certain other countries. The 
opposition groups produced some risk estimates which 
indicated that the likelihood of a multiple fatality acci¬ 
dent at Aberdour/Dalgety Bay marine terminal was 1CT 4 / 
year as opposed to the estimate of 10 _6 /year given by the 
consultants. 

The consultant’s report, despite the absence of a quanti¬ 
tative assessment, gave advice on risk criteria. This raised 
the question whether it is the expert’s job not only to do the 
risk estimates but also to evaluate them. On the other hand 
there did appear to be some opposition groups would not 
have been too unhappy with an annual risk of ‘one in a 
million’ (10 _6 /year). 

After the inquiry had ended, the question was raised of 
the possible hazard of ignition of a release of flammables by 
‘radio spark’ transmissions from the nearby naval trans¬ 
mitter at Crimond. The HSE undertook extensive work on 
this ‘radio spark’ hazard. 

The inquiry also illustrates another very basic prob¬ 
lem, that if the company makes no modifications to its pro¬ 
posals as a result of objections posed, it appears to ride 
roughshod over the opposition, while if it does, it appears 
to be incompetent. 

The inquiry and its aftermath give an impression of 
imbalance in the treatment of the hazards. In particular, 
the question of hazards associated with radio sparks 
received a disproportionate amount of attention relative to 
the hazards at the marine terminal. Despite this concession 
to the opposition groups, they were clearly dissatisfied 
with the inquiry. 
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A26.2 Pheasant Wood 

The Pheasant Wood inquiry, which has been studied by 
Petts (1985b), on proposed housing development near to ICI 
chlorine and phosgene storages arose when the HSE asked 
the S ecretary of State to call in the proposal for review after 
the LPA had indicated its intention to grant planning per¬ 
mission. The HSE gave its hazard assessment. The devel¬ 
oper retained Cremer and Warner to present an alternative 
assessment, while ICI, although not directly involved, 
chose to offer its own assessment. All these parties pre¬ 
sented technical evidence. The HSE’s assessment included 
estimates of both frequencies and consequences of events, 
but did not combine these together to give individual and 
societal risks. They were criticized by the inquiry assessor 
and by ICI for this limitation. On the other hand, the other 
parties, although they did estimate these risks, did not 
always give the full basis of their estimates. Another point 
at issue between the HSE and the ICI evidence was some of 
the data used for the frequency of release.Whereas the HSE 
had to rely on generic data, the company was able to use 
data from its own installations which, depending on the 
viewpoint, were less pessimistic or more optimistic. The 
appropriateness of the gas dispersion models used was 
also an issue between the parties. The inspector found 
against HSE’s case and in favour of granting planning 
permission. A feature of the Pheasant Wood inquiry which 
distinguishes it from those at Mossmorran and at Canvey 
was the low level of public interest. 


A26.3 Canvey 

The Canvey complex of oil refineries, chemical works, etc., 
has been the subject of several inquiries and hazard 
assessments, which have been described by Petts (1985a). 
The period 1965—73 saw a spate of planning applications 
and three public inquiries for oil refinery development. 
The economic pressures were clearly strong. The inquiry 
inspector’s recommendations were twice overruled by the 
minister in favour of development. At the same time, the 
level of local concern over the hazards and environmental 
impact of the Canvey complex was rising and led to the 
opening, in 1975, of an inquiry into the possibility of 
revoking the planning permission granted to United Refi¬ 
neries Ltd (URL) in 1971. The technical assessor’s report 
discussed the hazards in qualitative terms. No quantitative 
hazard assessments were presented. 

One of the assessor’s recommendations was a study of 
the possible hazardous interaction between the various 
installations at Canvey. Acting on this, the minister asked 
the HSE to look into the matter and the HSE commissioned 
a study from SRD, the First Canvey Report. 

With the publication of this report, the minister was in 
a position to reopen the inquiry on the revocation of plan¬ 
ning permission for URL. The inquiry was held in 1980 
and considered both the bearing of the Canvey Report on 
the URL project and also the validity of the report itself, the 
parties being essentially the HSE and the objectors. The 
only full hazard assessment presented was that of the HSE 
in the form of the report. The report had not been commis¬ 
sioned specifically for the inquiry, but nevertheless there 
was for the first time available to an inquiry in Britain a full 
assessment of individual and societal risks. 

One of the main hazards considered was a marine spill 
of LNG or LPG at the British Gas methane terminal. 


Disagreements arose over the estimates both of the fre¬ 
quency and the magnitude of this hazard. While the Port of 
London Authority (PLA) considered that the report over¬ 
estimated the frequency of ship collision, the objectors 
presented graphic qualitative evidence of the problems of 
tanker handling. Estimates of the distance travelled by the 
flammable gas cloud before it fell to its lower flammability 
limit varied widely from 1 km to 28 miles. 

Doubt was cast on some of the HSE’s proposals for miti¬ 
gating the hazards. The practicality and effectiveness of 
the water spray barrier against an ammonia cloud was 
challenged. PLA witnesses stated that the 8 knot speed 
limit proposed in the Scheduled Area was not practical. 

The estimated risks were also matter for debate. The risk 
values were relatively high. For example, the calculated 
fatality risk attributed to the URL extension was compa¬ 
rable with the national fatality risk at work. The inspector 
considered the risks in some areas unacceptable. 

Although the Canvey Report received praise and its 
overall approach was not challenged, it had certain defi¬ 
ciencies which detracted from it. The text was very dis¬ 
jointed, there were discrepancies between text and tables 
and there were some inaccuracies. 

The inspector recommended that the URL planning 
permission should not be revoked, but only if the risk from 
the British Gas methane terminal were reduced by instal¬ 
ling a ring of igniters at the periphery or by closure. 

In 1981, the Second Canvey Report appeared. In this 
reassessment, which used revised failure data, more 
refined hazard models and more accurate population pro¬ 
files and which took into account changes made on the 
installations, the assessed risks were less, some by an order 
of magnitude. 

In 1982, another public inquiry was held, this time on the 
possible discontinuance of the British Gas methane termi¬ 
nal. British Gas produced a full hazard assessment, while 
the two convey Reports formed the basis of the HSE’s evi¬ 
dence. The British Gas assessment used by intent broadly 
realistic estimates, the HSE conservative ones. The risks 
estimated by British Gas were lower, in some cases by two 
orders of magnitude. Realism rather than conservatism 
was not the only reason for this. The British Gas estimates 
of failure rates were lower and its gas dispersion estimates 
gave lower travel distances. The inspector stated that he 
found HSE’s evidence much easier to understand and that 
he preferred their conservative approach, and he put some 
value on the independence of the HSE. 

A number of expert witnesses were called by the objec¬ 
tors, notably the Castle Point District Council and the 
Castle Point Refineries Resistance Group. In many cases, 
their evidence failed to stand up to cross-examination due 
to weak hypotheses on accident scenarios, oversimplified 
assumptions, incorrect hazard models, misunderstanding 
of the work of others, especially the Second Canvey Report, 
and numerical errors. The technical assessor played an 
active role in this inquiry both in advising the inspector 
and in producing the report. 

The inspector recommended against closing the British 
Gas terminal or requiring igniters. 

A26.4 Sizewell 

The inquiry on the proposal to construct a PWR at Sizewell 
B began in January 1983 and ended in February 1985. This 
is by any standards a ‘big’ public inquiry and the hazards of 
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a nuclear reactor are one of the topics on which much expert 
testimony has been heard. In the present context, the 
inquiry is of interest for its influence on the development of 
the form of such inquiries; for its influence on the for¬ 
mulation of risk criteria; and for the evidence given on some 
of the technical safety issues, particularly on rare events. 

An important feature of the inquiry was the use of 
counsel to the inquiry. The inquiry also saw the increased 
use of informal ‘side’ meetings between experts at which 
issues can be clarified and misunderstandings removed. 

Another feature of the inquiry is that a preconstruc¬ 
tion safety report was available before the inquiry from 
the CEGB, although many design aspects remained 
unresolved. 

With regard to risk, the Inspector suggested that where 
risks of the kind considered are accepted they are better 
described as ‘tolerable’ rather than ‘acceptable’ and 
encouraged the HSE to develop risk criteria. Such criteria 
have subsequently been published by the HSE (1988b, 
1989d). 

Among the many issues on hazards which the inquiry 
illustrates is that of the very rare event. A crucial accident 
scenario for a PWR is failure of the reactor pressure vessel 
(RPV). Such a failure is generally agreed to be a very rare 
event, but it may have very serious consequences. Estima¬ 
tion of the frequency of an event which has a high hazard 
potential but is very infrequent, perhaps scarcely credible, 
is one of the most intractable problems in hazard assess¬ 
ment. The inquiry is instructive not only because there 
were differences between experts in the methodology of 
estimation of the RPV failure frequency but also because 
there was scope for differences of perception of what was 
eventually established. 

Evidence on the estimation of the RPV failure frequency 
was given for the CEGB by Dr B. Edmundson, for the 
Greater London Council by Technica Ltd and for the Suffolk 
Local Authorities by Professor Kussmaul from Germany. 
Another expert, Professor T. A. Kletz, gave evidence at the 
invitation of the inspector. On the basis of historical pres¬ 
sure vessel failure data Technica estimated the RPV failure 
rate at 1 x 10 _6 /year. This figure was derived from the 
crude figure of 3.2 x 10 _6 /year obtained from the historical 
data, and was intended to give credit for improved tech¬ 
nology embodied in the RPV, but to be nevertheless a rea¬ 
listic rather than a conservative estimate, as the witnesses 
were at pains to point out. The CEGB derived their estimate 
of RPV failure rate using engineering principles, such as 
fracture mechanics, to determine the frequency of the fail¬ 
ure modes which they considered credible, and obtained for 
catastrophic vessel rupture with generation of missiles an 
estimate of 2.4 x 10 _9 /year. Professor Kussmaul preferred 
the CEGB’s approach to that of Technica but advocated an 
alternative method of pressure vessel construction so as 
to minimize the risk of weld failure. This construction was 
not accepted by the CEGB and after further discus¬ 
sion between the parties Professor Kussmaul accepted the 
CEGB’s approach subject to certain procedures which he 
specified and to which they agreed. As a result, the Suffolk 
Local Authorities withdrew their objections on grounds of 
safety, since they accepted Professor Kussmaul’s advice 
that the risks were ‘so low as to be incredible’. 

There were nearly two orders of magnitude between the 
CEGB and Technica estimates of the RPV failure rate. The 
Technica estimate was in fact based on a single historical 
pressure vessel failure, which the CEGB regarded as so 


unusual as to be inconceivable on their vessel. However, 
even if no failure has occurred historically, it is still pos¬ 
sible to make a statistical estimate by using the number of 
failure-free years and assuming that a failure is just about 
to occur. It therefore makes little difference to the number 
obtained whether the number of failures is one or zero. 
More important was the difference between the parties on 
whether the estimate should be based on historical statis¬ 
tics or engineering principles. Technica argued that even if 
the single historical failure was a bizarre one, such events 
cannot be completely discounted, that this stood in for the 
whole set of bizarre events which might occur, and that the 
method based on the historical data was the appropriate 
one to use. 

In his cross-examination, counsel for the CEGB sought 
to identify assumptions in the Technica estimate. For Tech¬ 
nica Dr. R.A. Cox stated clearly that the figure of 1 x 10 6 / 
year was a ‘best estimate’, intended as realistic rather than 
conservative. However, counsel drew attention to the fact 
that in its written evidence Technica had at one point 
referred to this figure as an ‘upper bound’. Dr P.J. Kayes for 
Technica then explained that what was meant by this was 
that the figure was an ‘upper bound on the type of studies 
that would claim RPV failure to be incredible’. Counsel then 
asked: ‘Is it intended to provide an upper bound to the 
likelihood of RPV failure?’ and the witness replied: Yes, it is, 
as a best estimate’. Thus Technica were liable to believe that 
their figure was accepted as a realistic estimate, the CEGB 
that it had been conceded to be conservative. 

In cross-examination, Professor Kletz commented that 
the two methods should not be seen as necessarily in con¬ 
flict. A difference between the two by orders of magnitude 
was understandable. He did say, however, that while a large 
improvement in the reliability of the CEGB vessel over his¬ 
toric vessels could be expected, he had some personal 
scepticism whether any man-made artefact could provide 
such a low figure as the CEGB was claiming. In the case of 
the RPV the failure frequency was so low that he felt there 
was some justification for making allowance as Technica 
proposed for bizarre events and referred to possible failure 
due to previously unknown metallurgical phenomena. 
When cross-examined by one of the assessors, he agreed 
that his scepticism regarding very low numbers applied to 
a very low figure for a single event rather than one obtained 
as the product of the figures for a chain of events. 

Thus, while the differences of opinion over points raised 
by Professor Kussmaul were largely settled by discussion 
outside the formal proceedings and the main findings 
reported back to the inquiry, the differences arising from 
the Technica evidence were not resolved at the side meet¬ 
ings and the parties were liable to interpret the evidence 
given in the inquiry cross-examination as supporting their 
particular positions. 

A26.5 Expert Evidence 

The foregoing account of some of the principal inquiries 
which have been held on hazardous installations indicates 
that there are a number of problem areas. These problems 
have been reviewed and proposals made for mitigating 
them by Petts, Withers and Lees (1986). 

A26.5.1 Problems of adversarial forum 

A view commonly expressed by technical experts is that 
the adversarial situation of a public inquiry is not an 
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appropriate means of examining technical issues. Many 
experts find the adversarial process unfamiliar and intimi¬ 
dating and regard it as an inappropriate means of arriving at 
the truth on technical matters. The adversarial process 
tends to lead to adoption of rigid, defensive positions. 

For interest groups opposed to a development, the 
adversarial forum of an inquiry has the advantage that 
they can examine the developer’s case, but can be intimi¬ 
dating to them also and it presents considerable difficulties 
for groups with few resources. 

A26.5.2 Problems with hazard assessments 

Many of the problems of expert testimony at public inqui¬ 
ries on process installations centre round hazard assess¬ 
ment. Most of these difficulties can be grouped under one 
or other of the following heads: 

(1) obscurity; 

(2) incompleteness; 

(3) inconsistency. 

Obscurity 

There may be inherent difficulties in the subject matter or 
in its presentation. 

Thus at the Sizewell inquiry the debate on engineering 
features of the pressure vessel was difficult to follow with¬ 
out engineering drawings. At the Canvey inquiry, the 
inspector himself had difficulties with the hazard assess¬ 
ment by British Gas and felt that the mode of presentation 
was more appropriate to a learned society than an inquiry. 

Fundamentally difficult matters are typified by the 
arguments at Sizewell over the frequency of rare events and 
over probabilistic risk analyses. 

Incompleteness 

Information may be incomplete for many reasons. The 
engineering design may not be complete by the time of the 
inquiry, there may be deliberate selectivity in the hazards 
examined and there may be simple failure to identify all the 
hazards. 

Thus at the Mossmorran and Sizewell inquiries much 
plant-specific information was unavailable because the 
projects were still in the feasibility stage. Estimates were 
therefore conceptual and based on generic data. This is 
likely to be a common situation. 

Selectivity is exemplified by Mossmorran, where the 
objectors expressed concern about hazards at the port 
which seemed to have received less attention than the gas 
plant itself. Again at Mossmorran, there were objections to 
the exclusion of aircraft crashes. Later the possible hazard 
of ignition from radio sparks was raised and led to a sepa¬ 
rate investigation. 

Inconsistencies 

Some inconsistencies appear at an inquiry simply 
because of the lack of an agreed structure and methodology 
for the hazard assessment. There are also differences in the 
particular models used and in the basic approach to prob¬ 
ability estimation. 

Examples of differing structure and methodologies 
appeared at Pheasant Wood, where the assessment by the 
HSE did not provide any estimates of individual or societal 
risk, while those of the consultants and of ICI did.The HSE 
case was based on generic data, while the ICI case was 
based on plant-specific data. 


At Canvey there were wide differences in the results 
obtained from different gas dispersion models. There have 
also been wide differences in the relations describing 
injury and damage. This is illustrated by the Rijnmond 
Report, which, although not a document presented to an 
inquiry, represents the type of hazard assessment which 
might be submitted. The report revealed ten-fold differ¬ 
ences in estimates of the lethal concentrations of chlorine. 

Such differences and uncertainties usually result in jud¬ 
gements being made about the likely margin of error. These 
judgements may occur at a number of points in the chain of 
calculations which make up the assessment. They may be 
optimistic or pessimistic. 

In general, industry is anxious that the risks should not 
be exaggerated and presses for realistic assessments 
wherever possible. It may seek to avoid the use of numerical 
estimates of risk altogether where the confidence bounds 
are very wide. The HSE, on the other hand, is bound in the 
public interest to take a fairly cautious view and may be 
expected to incline towards the use of values which are to 
some degree conservative. In the risks assessed for the 
methane terminal at Canvey, the HSE and British Gas 
sometimes differed by a factor of a hundred, partly due to 
the difference between realism and conservatism. 

Examples of the use of differences in approach to prob¬ 
ability estimation were demonstrated at Sizewell, where the 
objectors based their estimate of pressure vessel failure 
rate on historical data and the CEGB its estimate on engi¬ 
neering considerations, the latter thereby obtaining for the 
event in question a frequency lower by some two orders of 
magnitude. 

It should be recognized that public opposition to an 
industrial development may in some cases be so strong as 
to influence the character of the presentation and exami¬ 
nation of the hazard assessments. At Pheasant Wood there 
was little public interest, whereas at Mossmorran this 
interest was strong and organized. 

A26.5.3 Availability of information 

An essential requirement of the parties to an inquiry is the 
availability of information. This information needs to be of 
the appropriate kind and to be provided at the right time. 
This requirement would in large part be met if the company 
makes available at the outset of the inquiry a form of open 
conceptual safety case. 

The LPA may wish to commission an independent report 
from a consultant, as well as seeking advice from the HSE. 

The use of open safety cases presented in a uniform style 
would greatly assist the LPAs to become familiar with the 
problems posed by hazardous installations and to instruct 
consultants. 

The HSE may also provide for the inquiry inspector an 
independent hazard assessment by which he can evaluate 
the evidence of the other parties. 

Twenty-eight days before the inquiry the LPA is required 
to produce a written statement. It is only the LPA which has 
this obligation. 

A26.5.4 Parties to inquiry 

The LPA will always be a party to a planning inquiry. There 
is no general requirement that staff from other government 
bodies (such as the HSE) should appear in person. In prac¬ 
tice they often do. 

The parties will often be represented by legal counsel at 
the inquiry. An innovation at Sizewell was the appointment 
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of counsel to the inquiry itself. This appears to have been of 
great assistance to the inspector and to have helped other 
parties to clarify issues. In an adversarial process, the 
investigatory role of such counsel appears of great value, 
particularly for technically complex projects. 

The part played by the HSE at an inquiry needs to be 
seen in the context of its wider and ongoing role in the 
control of hazards. In order to safeguard this role, it is 
desirable that as far as possible the HSE should appear as 
an adviser rather than a protagonist and the situation 
where the HSE is the instigator of an inquiry is to be avoi¬ 
ded as far as possible. 

It is appropriate that at the outset of an inquiry the HSE 
be invited to state its role, the legislation under which it 
operates and the limits of its powers, that it define the set of 
principles by which it judges the nature of the risk and the 
relevant safety criteria required by the HSWA as enforced 
by the HSE. It may also indicate its expectations of the 
ability of the developer to meet these standards, while 
leaving it to the inquiry to balance these expectations with 
those of others, and with other relevant factors. 

Many experts are called by objectors. The problems 
experienced at past inquiries have often centred around 
disagreements between these experts and others. It is 
desirable that these experts play their full part in the for¬ 
mal and informal meetings described below. In this way, 
issues can be clarified and difficulties which have arisen in 
the past avoided. Another class of witness is those called by 
the inspector, but these appear to present fewer problems. 


A26.5.5 Arrangements at inquiry 

A large inquiry usually has a formal preliminary meet¬ 
ing presided over by the inspector at which a detailed set of 
objectives, procedures and timetable are developed from 
the terms of reference. Such a meeting, which largely 
determines the subsequent course of the inquiry, is essen¬ 
tial for large, technically complex projects. 

The normal procedure in a public inquiry is to hear evi¬ 
dence by party rather than by issue, with the project’s 
proposer having the final right of reply. This results in 
safety evidence being interspersed with other evidence on 
other topics, and not taken in its logical order. An exception 
tends to be made in big inquiries such as Sizewell, where 
hearing may be by issue. In general, hearing by issue suits 
the large organizations, who have little difficulty in mak¬ 
ing experts available on each issue as it arises. It may, 
however, create problems for smaller bodies with limited 
resources. 

As described above, there has been some criticism of 
the adversarial approach inherent in public inquiries. In 
eyes of the public, however, it remains a safeguard, albeit 
imperfect, against concealment and is an important factor 
in legitimizing the inquiry process. 

The problem of dealing with expert evidence in an 
adversarial forum may be mitigated by the use of non- 
adversarial side meetings between experts. Some of these 
may be formal meetings with minutes kept which are part 
of the inquiry record. 
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Standards and codes of practice are one of the principal 
means by which experience of problems and their respec¬ 
tive solutions is transmitted and fundamental to recog¬ 
nized and generally accepted good industrial practice. The 
production of a code is normally undertaken by a group of 
experienced practitioners under the aegis of an appropriate 
organization. The code represents the consensus of this 
group on what constitutes good practice. There is usually 
some degree of consultation with the parties who will use 
the code. 

There are avast number of codes produced by a variety of 
bodies and the status of a code depends on the body which 
promulgates it. Inevitably a code becomes out-of-date as 
technology changes, so that a process of continuous revi¬ 
sion is necessary. A 5-year update is most commonly- 
suggested. 

The philosophy commonly adopted in writing a new code 
is to define limited objectives and to get the code finished, 
recognizing that further revision will be necessary in due 
course, rather than to seek to produce a definitive work. 
Standards and codes of practice normally use a specialized 
and defined terminology. 

Mandatory requirements, that is, those that it is essen¬ 
tial to satisfy, are expressed by the use of the word ‘shall’. 
The word ‘must’ is used when an absolute imperative 
arises, for example when safety considerations apply. 

Non-mandatory requirements, that is, those that are 
recommended or desirable are usually expressed by the use 
of the auxiliary ‘should’. Should implies a recommendation 
based upon the judgement of experienced people but 
recognizes that some discretion is appropriate in special 
circumstances. 


A27.1 Globalization of Standards 

The ever increasing world of international trade has created a 
need for internationally accepted standards. When the large 
majority of products or services in a particular business or 
industry sector conform to International Standards, a state of 
industry-wide standardization can be said to exist. This is 
achieved through consensus agreements between national 
delegations representing all the economic stakeholders 
concerned - suppliers, users, government regulators and 
other interest groups, such as consumers. They agree on 
specifications and criteria to be applied consistently in the 
classification of materials, in the manufacture and supply 
of products, in testing and analysis, in terminology and in 
the provision of services. Hence, International Standards 
provide a reference framework, or a common technological 
language, between suppliers and their customers, thereby 
facilitating trade and the transfer of technology. 

International Organization for Standardization (ISO) 
together with the International Electrotechnical Commis¬ 
sion (IEC) and International Telecommunication Union 
(ITU) has built a strategic partnership with the World Trade 
Organization (WTO) with the common goal of promoting a 
free and fair global trading system. The political agree¬ 
ments reached within the framework of the WTO require 
underpinning by technical agreements. ISO, IEC and ITU, 
as the three principal organizations in international stand¬ 
ardization, have the complementary scopes, the frame¬ 
work, the expertise and the experience to provide this 
technical support for the growth of the global market. 

ISO is the world’s largest developer of standards. ISO 
is a network of the national standards institutes of 


148 countries, on the basis of one member per country, with 
a Central Secretariat in Geneva, Switzerland, that coordi¬ 
nates the system. ISO is a non-governmental organization, 
its members are not delegations of national governments. 
ISO occupies a position between the public and private 
sectors. This is because many of its member institutes are 
part of the governmental structure of their countries, while 
other members have their roots uniquely in the private 
sector, such as industry associations and technical societies. 

Therefore, ISO is able to act as abridging organization in 
which a consensus can be reached on solutions that meet 
both the requirements of business and the broader needs of 
society, such as the needs of stakeholder groups like con¬ 
sumers and users. The vast majority of ISO standards are 
highly specific to a particular product, material or process. 
However, the ISO 9000 and ISO 14000 standards have 
earned a worldwide reputation are known as ‘generic man¬ 
agement system standards’.‘Generic’ means that the same 
standards can be applied to any organization, large or 
small, product or service, and whether it is a business 
enterprise, a public administration or a government depart¬ 
ment. ‘Management system’ refers to what the organization 
does to manage its processes, or activities. ‘Generic’ also 
signifies that no matter what the organization is or does, if 
it wants to establish a quality management system or an 
environmental management system, then such a system 
has a number of essential features that are spelled out in the 
relevant standards of the ISO 9000 or ISO 14000 standards. 
The US OSHA process safety management regulation is 
another example of the performance-based philosophy 
defined in the generic management system standards. 


A27.1.1 Conformity assessment 

Conformity assessment means checking that products, 
materials, services, systems or people measure up to the 
specifications of a relevant standard. Many products 
require testing for conformance with specifications or 
compliance with safety, or other regulations before they can 
be put in the stream of commerce. Even simpler products 
may require supporting technical documentation that 
includes test data. ISO has developed many of the stand¬ 
ards against which products are assessed for conformity, 
as well as the standardized test methods that allow the 
meaningful comparison of test results so necessary for 
international trade. 

ISO itself does not carry out conformity assessment. 
ISO develops ISO/IEC guides and standards to be used 
by organizations that carry out conformity assessment 
activities. The voluntary criteria contained in these guides 
and standards represent an international consensus on 
what constitutes best practice. Their use contributes to the 
consistency and coherence of conformity assessment 
worldwide. 


A27.2 Where to Find Information on Standards 

There are several hundred thousand standards and tech¬ 
nical regulations in the world containing special require¬ 
ments for a particular country or region. Finding 
information about these, or about related conformity 
assessment activities, can be a heavy task. ISONET, the 
SO Information Network, can ease the problem. This is 
a worldwide network of national standards information 
centres, which have cooperatively developed a system to 
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provide rapid access to information about standards, tech¬ 
nical regulations and testing and conformity assessment 
activities in operation around the world. The World Trade 
Organization’s Agreement on Technical Barriers to Trade 
(WTO/TBT) typically establishes a national enquiry point 
to answer questions on regulations and standards in each 
country, the ISONET and WTO enquiry points are the 
same. WSSN is a network of publicly accessible Web servers 
of standards organizations around the world. It contains 
links to international, regional and national standardiza¬ 
tion bodies, and also to other international and regional 
organizations that develop standards in their specialized 
subject area; available at http://www.wssn.net/WSSN/ 
index.html. 

Leading national standards institutions, which co-operate 
with ISO are: 

• British Standards Institution (BSI); 

• American National Standards Institute (ANSI); 

• Deutsches Institut fur Normung (DIN); 

• Verein Deutscher Ingenieure (VDI); 

• Association Francaise de Normalisation (AFNOR); 

• Comite de Normalisation Europeen (CEN); 

• Comite de Normalisation Europeen Electrotechnique 
(CENELEC). 

Some technical associations that generate standards and 
codes of practice relevant to safety and loss prevention are 
listed below. 

• American National Standards Institute (NewYork); 

• American Industrial Hygiene Association (Fairfax, VA); 

• American Petroleum Institute (Washington, DC); 

• American Society of Civil Engineers (NewYork); 

• American Society of Heating, Refrigerating and Air- 
Conditioning Engineers (Atlanta, GA); 

• American Society of Mechanical Engineers (NewYork); 

• American Society for Quality Control (Milwaukee, MI); 

• American Society for Testing and Materials 
(Philadelphia, PA); 

• American Welding Society (Miami, FL); 

• British Chemical Industry Safety Council; 

• British Compressed Gases Association (London); 

• Chemical Industry Safety and Health Council 
(London); 

• Det Norske Veritas (Stavanger, Norway); 

• Imperial Chemical Industries Pic; 


• Institute of Electrical and Electronic Engineers (New 
York); 

• Institute of Petroleum (London); 

• Instrument Society of America (Research Triangle 
Park, NC); 

• International Chamber of Shipping (London); 

• International Maritime Organization (London); 

• Liquefied Petroleum Gas Industry Technical Associa¬ 
tion (London); 

• National Fire Protection Association (Quincy, MA); 

• Oil Companies International Marine Forum (London); 

• Society of International Gas Tanker and Terminal 
Operators (London); 

• Tubular Exchangers Manufacturers Association; 

• Underwriters Laboratories (Northbrook, IL); 

• Verein Deutscher Ingenieure. 


A27.2.1 Among the first safety codes 

Modern fire safety codes and standards, and in particular 
those developed by the National Fire Protection Associa¬ 
tion (NFPA), trace their origins to the nineteenth-century 
development of automatic sprinklers. From the beginning, 
sprinklers performed properly as extinguishing devices; 
however, they were originally installed in so many different 
ways that their reliability was uncertain. 

From the beginning, the mission of the NFPA is to reduce 
the burden of fire and related hazards on the quality of life. 
The NFPA mission today is accomplished by advocating 
scientifically based consensus codes and standards, 
research and education for fire and related safety issues. 
NFPA’s National Fire Codes are developed by technical com¬ 
mittees staffed by over 6000 volunteers, and are adopted 
and enforced throughout the world. NFPA functions as 
a non-profit membership organization with more than 
68,000 members worldwide. 

Development of NFPA standards follow the original prin¬ 
ciples still followed today by NFPA Technical Committees: 
‘To bring together the experience of different sections and 
different bodies of underwriters, to come to a mutual 
understanding, and, if possible, an agreement on general 
principles governing fire protection, to harmonize and 
adjust our differences so that we may go before the public 
with uniform rules and conditions which may appeal to 
their judgment is the object of this Association.’ 

Despite the term ‘National’ in NFPA, the name sometimes 
seems to imply the lack of international involvement. 
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A General 

American Conference of Government Industrial 

Hygienists 

(Cincinnati, OH) 

Documentation for the Biological Exposure 
Indices (BEIs) 

Documentation for the Physical Agents Threshold 
limit Values 

Documentation of Threshold limit Values and 
Biological Exposure Indices, 6th ed. 

A Guide to OSH A Regulations on Storing and 
Handling Flammable and Combustible Liquids by 
M.M. Carmel 

Recognition of Health Hazards in Industry 
by W.A. Burgess, 1981 

Design of Industrial Ventilation Systems, 5th ed., 
by J.L. Alden and J. M. Kane, 1982 
Noise Control: A Guide for Workers and Employers 
by R.L. Stepkin and R.E. Mosely, 1984 
Biological Monitoring of Exposure to Chemicals: 
Organic Compounds edited by H.K Dillon and 

M. H. Ho, 1987 

Case Studies in Industrial Hygiene ed. by 

J.L. Perkins andVE. Rose, 1987 
Guidelines for Selection of Chemical Protective 
Clothing, 3rd ed., by AD. Schweppe, P.P. Costas, 

J. O. Jackson and D.J.Weitzman, 1987 

Health Hazard Control in the Chemical Process 
Industry by S. Lipton and J. Lynch, 1987 
Industrial Radiation Hazards Deskbook by 

N. P. Cheremisinoff, P.N. Cheremisinoff and 
M.F.Teresinski, 1987 

Inhaled Dust and Disease by P.F. Holt, 1987 
Investigating Accidents with STEP by 

K. Hendrick and L. Benner, 1987 
Underground Storage Systems: Leak Detection 
and Monitoring byT.G. Schwendeman and 
H.K Wilcox, 1987 

Chemical Exposure and Disease 
byJ.D. Sherman, 1988 

Corporate Management of Health and Safety 
Hazards by R.E. Kasperson, J.X. Kasperson, 

C. Hohenemser and R.W. Kates, 1988 
Dust Control Handbook by V Mody and 
R. Jakhete, 1988 

Emergency Care for Hazardous Materials 
Exposure by A.C. Bronstein and 
PL. Currance, 1988 

Guidelines for Laboratory Design, 2nd ed., 
by L. DiBerardinis etal., 1988 
Heating, Ventilation and Air-Conditioning 
Analysis and Design, 3rd ed., 
by F.C. McQuiston and G.D. Parker, 1988 
Industrial Hygiene Engineering by 
J.T. Talty, 1988 

Industrial Hygiene Management by 
J.T. Garrett, L.J. Cralley and L.V Cralley, 1988 
Methods of Air Sampling and Analysis ed. 
byJ.P. Lodge, 1988 

Methods for Biological Monitoring ed. 

byT.J. Knelp and J.V Crable, 1988 

Toxicology: A Primer onToxicology Principles and 

Application by MA Kamrin, 1988 


Air Sampling Instruments, 7th ed., 1989 27 

Benzene: Occupational and Environmental 
Hazards edited by M. A. Mehlman, 1989 28 

Chemical Hazards in the Workplace 
by R.M. Scott, 1989 29 

Chemical Protective Clothing Performance Index 
Book by K. Forsberg and L.H. Keith, 1989 30 

Design and Protocol for Monitoring Air Quality 
edited by N.L. Nagada and J.P. Harper, 1989 31 

First Aid Manual for Chemical Accidents, 

2nded., by M.J. Lefevre, 1989 32 

A Guide to Monitoring Airborne Asbestos 
in Buildings by D.L. Keyes and J. Chesson, 

1989 33 

Hazardous Waste Minimization Handbook 

byT. Higgins, 1989 34 

Industrial Emergency Preparedness 

by R.B. Kelley, 1989 35 

In-Plant Practices for Job-Related Health Hazards 

Control, vols 1-2, ed. by L.V Cralley and 

L. J. Cralley, 1989 36 

The Risk Assessment of Environmental Hazards 

ed. by D.J. Paustenbach, 1989 37 

Ventilation for Control of the Work Environment 

by WA. Burgess, M.J. Ellenbecker and 

R.T. Treitman, 1989 38 

Asbestos: Medical and Legal Aspects 

by B.L. Castleman, 1990 39 

Destruction of Hazardous Chemicals in the 

Laboratory by G. Lunn and E.B. Sansone, 1990 40 

A Guide for Control of Laser Hazards, 1990 41 

Hazardous Waste Chemistry, Toxicology and 

Treatment by S.E. Manahan, 1990 42 

Laboratory Health and Safety Handbook 

by R.S. Stricoff and D.B. Walters, 1990 43 

The Laboratory Quality Assurance System by 

T.A. Radcliff, 1990 44 

Managing Safety and Health Programs 

by R. Boylston, 1990 45 

Neurotoxicity Handbook by R.M. Singer, 1990 46 

Occupational and Environmental Health 

Management by H.R. Kavianan and 

C. A. Wentz, 1990 47 

Radiation Protection: A Guide for Scientists and 
Physicians, 3rd ed., byj. Shapiro, 1990 48 

Rapid Guide to Hazardous Chemicals in the 
Workplace, 2nd ed., by R.J. Lewis, 1990 49 

SARA Title III by F.L. Fire, N.K Grant and 

D. H. Hoover, 1990 50 

Air Monitoring for Toxic Exposures 

by S.A. Ness, 1991 51 

Biological Monitoring of Exposure to Chemicals: 

Metals ed. by H.K. Dillon and M.H. Ho, 1991 52 

Carcinogenically Active Chemicals: 

A Reference Guide by R.J. Lewis, 1991 53 

Casarett and Doull’s Toxicology, 4th ed., edited by 

M. O. Amdur, J. Doull and C.D. Klaassen, 1991 54 

Chemical Hazards of the Workplace, 3rd ed., 

by G.J. Hathaway, N.H. Proctor, J.P. Hughes and 

M.L. Fischman, 1991 55 

Exposure Assessment for Epidemiology and 

Hazard Control ed. by S.M. Rappaport and 

T.J. Smith, 1991 56 

A Guide to OSHA Regulations on Inorganic Lead 

by M.M. Carnal, 1991 57 
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Guide for Testing Ventilation Systems, 1991 
Handbook of Toxic and Hazardous Chemicals and 
Carcinogens, 3rd ed., by M. Sittig, 1991 
Hazardous Chemicals Desk Reference, 2nd ed., by 
R.J. Lewis, 1991 

Hazardous Laboratory Chemicals Disposal Guide 
by M.A. Armour, 1991 

Improving Safety in the Chemical Laboratory, 

2nd ed., by J.A. Young, 1991 
Indoor Air Quality Workbook byJ.D. Burton, 1991 
Industrial First Aid: Reference and Training 
Manual, 1991 

Industrial Health by J.E. Peterson, 1991 
Industrial Ventilation: Engineering Principles by 

R. J. Heinsohn, 1991 

Industrial Ventilation: A Manual of Recommended 
Practice, 21st ed., 1991 
Industrial Ventilation Workbook by 
J.D. Burton, 1991 

Laboratory Ventilation Workbook by 
J.D. Burton, 1991 

Noise and Health ed. byT.H. Fay, 1991 
Occupational Health Fundamentals edited by 
D.J. Hansen, 1991 

The OSHA 500 by R.D. Morran and 
M.M. Moran, 1991 

Patty’s Industrial Hygiene and Toxicology ed. by 
G.D. Clayton and F.E. Clayton, 1991 
Quantitative Industrial Hygiene: A Formula 
Workbook byj. Caravanos, 1991 
Air Pollution Engineering Manual by 
A.J. Buonicore and WT. Davis, 1992 
Applied Ergonomics Handbook by M. Burke, 1992 
Basic Statistics for Laboratories by W.D. Kelly, 
T.A. Ratcliff and C. Nenadic, 1992 
Guide to Occupational Exposure Values - 
1992,1992 

Introduction to Occupational Epidemiology by 

S. Hernberg, 1992 

Threshold limit Values and Biological Exposure 
Indices, 1992-1993,1992 
The Guidebook to Successful Safety 
Programming by R.J. Colvin, 1992 
Hawley’s Condensed Chemical Dictionary, 

12th ed., ed. by R.J. Lewis, 1992 
Hazardous Waste Management Compliance 
Handbook, 1992 

The Hazardous Waste Q&A by T.P. Wagner, 1992 
Industrial Hygiene Workbook byJ.D. Burton, 1992 
An Introduction toTrenchlessTechnology by 
S.R. Kramer,W.J. McDonald and J.C.Thomson, 1992 
A Practical Guide to Chemical Spill Response by 
J.W. Hosty, 1992 

Respiratory Protection Program and Record 
Keeping, 1992 Kit by J. A. Pritchard 
Sax’s Dangerous Properties of Industrial 
Materials, 8th ed., by R.J. Lewis, 1992 

American Gas Association 

(Arlington,VA) 

Year 

1967 Gas Engineers Handbook 

1975 Purging Principles and Practice 

1977- Gas Measurement Manual 


1977 Handbook of Noise Control at Gas 
Pipeline Facilities by R.H. Pish and 
C.R. Sparks 4 

1979 LNG Plant Design and Construction 

1981 LNG Information Book 1981 6 

1982 Basic Principles of Accident Prevention 7 

1982 LNG Training Guide 8 

1983 Odorization Manual 9 

1984 LNG Preventive Maintenance Guide 10 

1986 Introduction to LNG for Personnel Safety 11 

1989 AGA Plastic Pipe Manual for Gas Service 12 

1989 Engine,Turbines and Compressors 

Directory 13 

1990 OSHA Inspection Guide 14 

1990 Federal Pipeline Safety Inspectors 

Manual by Dept of Transportation 15 

1991 Engine Analyzer Signature Directory 16 

1992 Classification of Gas Utility Areas for 

Electrical Installations 17 

1974 Evaluation of LNG vapor control methods 

by AD Little Inc. 18 

1974 Evaluation of the influence of absorbed 
and absorbed-hydrogen on the 
mechanical properties and fracture 
behavior of materials to be used in a 
hydrogen gas transmission system by 
A.R. Elsea et al. 19 

1974 An experimental study on the mitigation 

of flammable vapor dispersion and fire 
hazards immediately following LNG 
spills by University Engineers, Proj. 

IS-100-1 20 

1974 Comparison of dispersion from LNG 

spills over land and water with LNG 
vapor dispersion in weather inversions by 
BatteUe Columbus Labs, Proj. SI-3-7 21 

1974 LNG safety program. Phase II byBatteUe 

Columbus Labs, Proj. IS-3-1 22 

1974 LNG safety study. Interim report on 

Phase II work, Proj IS-3-1 23 

1975 Tankers and tanker terminals: a 

bibliography for the natural gas industry 
1960-1974 24 

1976 Ductile fracture arrest in gas pipeline by 

W.A. Maxey, Proj. NG-18 25 

1977 Flameless vapor explosions by MIT 

Res. Center 26 

1978 Simplified methods for estimating 
vapor concentration and dispersion 
distances for continuous LNG spills into 
dikes with flat or sloping floors by AD 

Little Inc. 27 

1978 A theoretical model for crack propagation 
and arrest in pressurized pipelines by 

P. A. McGuire et al. 28 

1979 A study of cathodic protection of buried 
steel pipeline by GJ. Hennon, 

Proj. PR-138-83 29 

1980 Before you dig, check 30 

1980 Field validation of atmospheric 

dispersion models for 

natural gas compressor stations 

by Engineering Science 31 
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59 
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61 
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63 

64 

65 

66 
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1980 Workbook predicting short-term 
atmospheric dispersion of reciprocating 
engine exhaust emissions from natural 

gas compressor stations 32 

1981 Development of an improved LNG plant 

failure rate data base by DW. Johnson and 
J.R. Welker 33 

1981 The effects of dents on failure 

characteristics of line pipe by 
RJ. Fiber ef a/. 34 

1981 Pipeline response to buried explosive 

detonations, vols 1-2 by E.D. Esparza, 
R.S.Westine and A.B. Wenzel 35 

1981 A study of the causes of failure of defects 
that have survived a prior hydrostatic test 
by J.F. Kiefner el al. 36 

1981 Underground storage of gaseous fuels: a 

bibliography 1926-1980 37 

1983 Brittle fracture arrest in gas pipelines by 

Maxey 38 

1983 Determination of compressor station 
relief valve criteria by Sparks, Proj. 

PR-15-148 39 

1984 Effect of hydrostatic retesting on stress 

corrosion cracking by Barlo, Eiber, Berry 
and Fessler 40 

1984 The effect of random seas on pipeline 

stability, vol. 1, Wave/soil simulations and 

simplified design methods by 

L.E. Borgman and R. Hudspeth 41 

1984 The effect of random seas on pipeline 
stability, vol. 2, Finite element modeling 
of pipeline response by L.E. Borgman and 
R. Hudspeth 42 

1984 Critical evaluation of multiphase pipeline 

calculation methods by Gregory and 
Fogarasi 43 

1985 Crank shaft stress reduction through 

improved alignment practices by Smalley 
and Palazzolo 44 

1986 NOT needs for pipeline integrity 

assurance by Kiefner, Hyatt and Eiber 45 

1986 Study of new joining processes for 

pipelines by G.R. Saltera and J. Weston 46 

1986 Underground tanks in the natural gas 

industry 47 

1987 Criteria to stop active pit growth by 

Thompson, Beavers and Han 48 


1987 Investigation of sulfide-stress cracking at 
pipe seam welds by H.J. Clalone and 

D.N. Williams 49 

1988 Crack growth behavior and modeling by 

T.K. Christman and EW. Brust 50 

1988 Effect of water chemistry on internal 

corrosion rates in offshore natural 
gas pipelines by D.W Shannon et al. 51 

1988 Emergency shutdown systems 

(compressors) 52 

1988 Field weldability of high strength 

pipeline steels by D.N. Noble and 
R.J. Pargeter 53 

1988 Heat affected zone toughness in 

heavy-wall pipe by A.G. Glover and 
D.B.Varo 54 


1988 Operating safety in the natural gas 

industry 55 

1988 Prediction of SCC susceptibility based on 

mechanical properties of line pipe by 
T.K. Christman 56 

1988 Proof testing on pre-hot-tap branch 
connections by M. Rosenfeld and 
WA. Maxey 57 

1988 Relief valves in compressor stations 58 

1988 A review of gas industry pipeline 

coating practices by S. Nunez et al. 59 

1988 Safety factors in the assessment of 
realistic defects in pipeline welds by 

A. P. Hodgson and R.H. Leggatt 60 

1989 Criteria for hot tap welding - further 

studies byThreadgill and Cola 61 

1989 Evaluation of the capabilities of advanced 

AE monitoring of buried natural gas 
transmission pipe and AE evaluation of a 
known colony of SCC by F.B. Stulen 62 

Not used 63 

1989 Remote field eddy current crack and 

defect detection by W. Lord 64 

1989 Review of procedures for welding onto 

pressurized pipelines by P. Threadgill 
and M. Cola 65 

1989 State-of-the-art methods for multiphase 

flow pipelines by C.J. Crowley et al. 66 

1990 Cathodic protection anodes 67 

1990 Effect of loading on the growth of 

deep stress corrosion cracks by 
J. A. Beavers et al. 68 

1990 Methods for prioritizing pipeline 

maintenance and rehabilitation by 
J.F. Kiefner, PH. Vieth etal. 69 

1990 Remote field eddy detection of stress 
corrosion cracking, Phase I by 

J.B. Nestleroth 70 

1991 Development of an ultrasonic stress 

corrosion cracking detection vehicle by 
C.WPop eetal. 71 

1991 Development and validation of a 

ductile flaw growth analysis for 
gas transmission line pipe 

B. N. Leis etal. 72 

1991 Evaluation of nondestructive inspection 

methods for welds made onto in-service 
pipelines, I and II by WA. Bruce and 
B.W. Kenzie 73 

1991 A guide to controlling natural gas in 

emergencies 74 

1991 Guidelines for analyses of fire protection 

and emergency response based on 49 CFR 
Part 193 75 

1991 Optimizing techniques for CTOD testing 

of girth welds in line pipe by McGaughy 
and Gordon 76 

1991 Technology of submersible remotely 

operated vehicles by F.R. Busby 77 

1992 Criteria for dent acceptability of offshore 

pipelines by J.R. Fowler 78 

1992 Development of a ductile pipe fracture 

model by G. Buzichelli, 

M.H. Kanninen et al. 79 
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1992 Development of optimized 

nondestructive testing inspection 
methods for weld made onto in-service 
pipelines, III by W.A. Bruce and 
B.W. Kenzie 80 

1992 Development of simplified weld cooling 

rate models for in-service pipelines by 
MJ. Cola etal. 81 

1992 Diverless pipeline repair clamp, Phase I 

by J.E. Miller and B. Knott 82 

1992 Diverless pipeline repair clamp, Phase II 

by J.R. Fowler et al. 83 

1992 Fracture behaviour of girth welds 

containing natural gas defects: 
comparison with existing workmanship 
standards by R. Denys 84 

1992 Fracture behaviour of girth welds 

containing natural gas defects: effect of 
weld metal yield strength by R. Denys 85 

1992 Historical manufactured gas plant sites: 

use of risk assessment in the development 
of remedial target concentrations 86 

1992 Remote field eddy detection of stress 
corrosion cracking, Phase II by 
J.B. Nestleroth 87 

1992 Spatial density of stress corrosion cracks 

in line pipe steel by R.N. Parkins et al. 88 
1992 A study of processes for welding 

pipelines by J. Weston 89 

1992 Subsea pig recovery concepts by 

H.O. Mohr 90 

1993 Diver-assisted pipeline repair manual by 

H.O. Mohr 91 

1993 Effect of weldment property variations 
on the behavior of line pipe by 
R.J. Dexter etal. 92 

1993 Repair weld residual stress by 

T.C. McGaughy 93 


Pipeline Incident Reports 

1977 Analysis of the Office of Pipeline Safety 
Annual Report data for natural gas 
distribution companies 1970 through 
1975 by J.F. Hefner and R.B. Smith 94 

1981 Analysis of the Office of Pipeline Safety 
Operations 1970-78 Reportable Incident 
Data for the NG distribution companies 
by D.N. Gideon 95 

1981 Analysis of the Office of Pipeline Safety 
Annual Report data for natural gas 
distribution companies by D.N. Gideon 
and R.B. Smith 96 

1984 An analysis of reportable incidents for 
natural gas transmission and gathering 
lines 1970 through 1981 by Kramer, 

Gideon and Smith 97 

c.1986 An analysis of reportable incidents for 
natural gas transmission and gathering 
lines: 1970-84 by Jongs, Kramer and 
Gideon and Smith 98 

1992 An analysis of reportable incidents for 
natural gas transmission and gathering 
lines June 1984 through 1990 by R.J. Fiber 
and D.J. Jones 99 


1992 DOT distribution, transmission and 

gathering incident report data since 1984 
and Annual Report data for 1990 100 

Annual series 

Survey of Underground Gas Storage Facilities 

in the US and Canada 101 

American Industrial Hygiene ssociation 

(Fairfax,VA) 

Year AIHA Press Publications Item 

1970- Ergonomics Guides (Annual Series) l 

1975 Basic Industrial Hygiene: ATraining 

Manual 2 

1977- Non-ionizing Radiation Guides (series of 

three titles) 3 

1980— Workplace Environmental Exposure 

Level Guides (WEELs) (AIHAWorkplace 
Environmental Exposure Levels 
Committee - Annual Series) 4 

1983 Work Practices Guide for Manual Lifting 

by NIOSH 5 

1984 Arc Welding and Your Health 6 

1984 Engineering Field Reference Manual 7 

1985 Biohazards Reference Manual 8 

1985 Manual of Recommended Practice for 
Portable Direct-Reading Carbon 
Monoxide Indicators (AIHA Gas and 
Vapor Detection Systems Committee) 

ed. by Patrick R. Frazee 9 

1986 Noise and Hearing Conservation Manual 

ed. by E.H. Berger,W.D.Ward, J.C. Morrill 
and L.H. Royster 10 

1987 Occupational Exposure Limits - World¬ 
wide by W. Cook 11 

1988- Emergency Response Planning 

Guidelines (Annual Series) 12 

1988 Hygienic Guides (series of four sets) 13 

1988 Quality Assurance Manual for Industrial 

Hygiene Chemistry 14 


1989/ Manual Material Handling: 

1993 Understanding and Preventing Back 

Trauma (AIHA Ergonomics Committee) 
ed. by K.H.E. Kroemer, J.D. McGlothlin, 


andT.G. Bobick 15 

1989 Odor Thresholds for Chemicals with 

Established Occupational Health 
Standards (TRC Environmental 
Consultants under contract to AIHA) 16 

1990 Chemical Protective Clothing, vols 1 -2, 

ed. by J.S. Johnson and K.J. Anderson 17 

1990 Computers in Health and Safety ed. by 

G. Rawls 18 

1990 LOGAN Workplace Evaluation System by 

Dupont 19 

1990 Safety Auditing: A Management Tool by 

D.W. Kase and K.J.Wiese 20 


1990 The Practitioner’s Approach to Indoor Air 
Quality Investigations: Proceedings 
of the Indoor Air Quality 
International Symposium (AIHA 
Indoor Environmental Quality 
Committee) ed. by D.M.Weekes and 
R.B. Gammage 21 



APPE 

1991 

1991 

1991 

1991 

1992 

1993 

1993 

1993 

1993 

1993 

1993 

1993/ 

1996 

1993 

1993 

1994 

1994 

1994 

1994 

1994 

1995 
1995 
1995 
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A Strategy for Occupational Exposure 
Assessment by N.C. Hawkins, 

S.K. Norwood and J.C. Rock 22 

Industrial Ventilation Workbook, 2nd ed., 

by D.J. Burton 23 

Laboratory Ventilation Workbook by 

D.J. Burton 24 

Respiratory Protection: A Manual and 

Guideline, 2nd ed., ed. by 

C.E. Colton, L.R. Birkner and 25 

L.M. Brosseau 

Occupational Exposure,Toxic Properties, 
and Work Practice Guidelines for Fiber 
Glass by J.R. Bender, J.L. Konzen and 


G.E. Devitt 26 

Direct-Reading Colorimetric Indicator 
Tubes Manual, 2nd ed., ed. byj. Perper 
and B. Dawson 27 

Dynamic Measures of Low Back 
Performance, an Ergonomics Guide by 
WS. Marras, J.D. McGlothlin, D.R. McIntyre, 
M.NordinandK.H.E.Kroemer 28 

IAQ and HVAC Workbook by D.J. Burton 29 
Manual of Recommended Practice for 
Combustible Gas Indicators and Portable 
Direct-Reading Health Survey Meters, 

2nd ed. 30 

Manual of Recommended Practice for 
Combustible Gas Indicators and Portable 
Direct-Reading Hydrocarbon Detectors, 

2nd ed., ed. by C.F. Chelton 31 

Responding to Community Outrage: 

Strategies for Effective Risk 

Communication by P.M. Sandman 32 

Sampling for Environmental Lead (AIHA 

Ad Hoc Committee on Sampling for 

Environmental Lead) 33 

The Industrial Hygienisfs Guide to 

Indoor Air Quality Investigations 34 

The Industrial Hygienist’s Guide to 

Indoor Air Quality Investigations (AIHA 

Indoor Environmental Quality 

Committee) ed. by P.J. Rafferty 35 

An Ergonomics Guide to VDT 

Workstations by C. Grant and 

M. Brophy 36 

Cumulative Trauma Disorders of the 

Hand and Wrist, An Ergonomics 

Guide by T.J. Armstrong and 

E.A. Lackey 37 

Industrial Hygiene Auditing: A Manual 

for Practice byA.J. Leibowitz 38 

Radio-Frequency and Microwave 

Radiation, 2nd ed. 39 

The American Industrial Hygiene 

Association: Its History and 

Personalities, 1939-1990 ed. by 

G.D. Clayton and F.E. Clayton 40 

Biosafety Reference Manual, 2nd ed. 

(AIHA Biosafety Committee) 41 

Exploring the Dangerous Trades: The 
Autobiography of Alice Hamilton 42 

Extremely Low Frequency (ELF) Electric 
and Magnetic Fields 43 


1995 Hazard Communication: An AIHA 

Protocol Guide 44 

1995 Inorganic Lead Guidance Document by 

L.C. Hearn, Jr. 45 

1995 Laboratory Chemical Hygiene: An AIHA 

Potocol Guide 46 

1995 Particle Sampling Using Cascade 
Impactors: Some Practical Application 
Issues (AIHA Aerosol 
Technology Committee) ed. by 

J.Y. Young 47 

1996 An Ergonomics Guide to Hand Tools 
(AIHA Ergonomics Committee) by 

R.G. Radwin and J.T. Haney 48 

1996 An International Review of Procedures 

for Establishing Occupational 
Exposure Limits (Chemical 
Manufacturers Association and 
AIHA) 49 

1996 Field Guide for the Determination of 
Biological Contaminants in 
Environmental Samples (AIHA Biosafety 
Committee) ed. by H. K. Dillon, 

P.A. Heinsohn, and J.D. Miller 50 

1996 Field Guidelines for Temporary 

Ventilation of confined Spaces With an 
Emphasis on Hotwork by M. Harris, 

L. Booher, and S. Carter 51 

1996 Management of People and Programs in 
Industrial Hygiene by F.M.Toca and 
D.Woodhull 52 

1996 New Frontiers in Occupational Health and 
Safety: A Management Systems 
Approach and the ISO Model ed. by 
C.F. Redinger and S.P. Levine 53 

1996 Occupational Health and Safety 

Management System: An AIHA 
Guidance Document (AIHA OHSMS Task 
Force) 54 

1996 Particle Size-Selective Aerosol Sampling 

in the Workplace: Some Practical 
Application Issues (AIHA Aerosol 
Technology Committee) 55 

1997 Laboratory Quality Assurance Manual, 

2nd ed. (AIHA Sampling and Laboratory 
Analysis Committee) 56 

1997 The Occupational Environment - Its 
Evaluation and Control ed. by S.R. DiNardi 57 

1998 A Strategy for Assessing and Managing 
Occupational Exposures, 2nd ed. by 

J.R. MulhausenandJ. Damiano 58 

1998 Communicating Risk in a Changing 

World ed. by T.L. Tinker, M.T. Pavlova, 

A.R. Gotsch and E.B. Arkin 59 

1998 General Concepts for Nonionizing 

Radiation Protection (AIHA Nonionizing 
Radiation Committee) 60 

1998 Hand-Arm Vibration: A Comprehensive 

Guide for Occupational Health 
Professionals, 2nd ed. by P.L. Pelmear 
and D.E.Wasserman 61 

1998 ISO 14000:A Guide to the New 
Environmental Management 
Standards 62 



1998 

1998 

1999 

1999 

2000 

2000 

2000 

2000 

2000 

2000 

2000 

2000 

2000 

2000 

2001 

2001 

2001 

2001 

2001 

2001 

2001 

2001 
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Physical Strength Assessment in 
Ergonomics ed. by S. Gallagher, 

J.S. Moore, and T.J. Stobbe 63 

The Quiet Sickness: A Photographic 
Chronicle of Hazardous Work in America 
by E. Dotter 64 

Engineering Reference Manual, 2nd ed., 
(AIHA Engineering Committee) ed. by 
F.N. Bolton and D.L. Johnson 65 

Safety Now! Controlling Chemical 
Exposures at Hazardous Waste Sites 
with Real-Time Measurements by 
C.S.E. Marlowe 66 

Current IAQ Practices Worldwide: 

Proceedings from the 4th IAQ 

Symposium 67 

Glossary of Occupational Hygiene 

Terms by S.R. DiNardi and 

W.E. Luttrell 68 

Guidelines of Hot Work in Confined 

Spaces: Recommended Practices for 

Industrial Hygienists and Safety 

Professionals by M.H. Finkel 69 

Investigations: A Handbook for 

Prevention Professionals by 

H.C.Woodcock and J. Seibert 70 

Laser Radiation by R.T. Hitchcock and 

R.J. Rockwell, Jr. 71 

Mathematical Models for Estimating 

Occupational Exposure to Chemicals 

(AIHA Exposure Assessment 

Committee) ed. by C.B. Keil 72 

Rapid Guide to Hazardous Chemicals in 

the Workplace, 4th ed. by R.P. Pohanish 73 

Risk Assessment Principles for the 

Industrial Hygienist by M. Jaycock, 

J. Lynch, and D.L Nelson 74 

The Noise Manual, 5th ed. by E.H. Berger, 

L.H. Royster, J.D. Royster, D.P. Driscoll 
and M. Layne 75 

User’s Guide to A Strategy for Assessing 
and Managing Occupational Exposures, 

2nd ed.’ (AIHA Exposure Assessment 
Committee) ed. byTW. Armstrong and 
B.D. Silverstein 76 

Chemical-Biological Terrorism: 

Awareness and Response to the Threat 77 

Confined Space Entry: An AIHA Protocol 
Guide, 2nd ed. 78 

Hazardous Harvests: Exploring 
Occupational and Environmental 
Health and Safety Hazards of 
U.S. Farmworkers 79 

Industrial Hygiene Performance Metrics 
(AIHA Management Committee) 80 

Occupational Asthma: Can This Disease 
Be Controlled? 81 

Report of Microbial Growth Task 
Force 82 

Respiratory Protection: A Manual and 
Guideline, 3rd ed. (AIHA Respiratory 
Protection Committee) 83 

Synthetic Fibers in the Workplace: Where 
Less is Healthier 84 


2001 Ultraviolet Radiation, 2nd ed. 85 

2002 Chemical Safety Handbook: For the 
Semiconductor/Electronics Industry, 

3rd ed. by D.G. Baldwin, M.E. Williams, 

and PL. Murphy 86 

2002 Ergonomics: From Concept to Practice- 

Making Ergonomics Work Proceedings 
from the AIHce 2001 Ergonomics 
Symposium 87 

2002 Ergonomics: Regulations and Standards 

in the United States, Canada, and Europe 88 
2002 Industrial Hygiene Reference & Study 

Guide by A. Fleeger, D. Lillquist 89 

2002 The AIHA 2002 Emergency Response 

Planning Guidelines and Workplace 
Environmental Exposure Level Guides 
Handbook 90 

2002 The Noise-Vibration Problem-Solution 

Workbook by L.H. Royster and 
J.D. Royster 91 

2002 Welding Health and Safety: A Field Guide 

for OEHS Professionals by M.K. Harris 92 

2003 Burton Field Guide for Industrial 

Hygiene by D.J. Burton 93 

2003 Environmental Health and Safety for 

Hazardous Waste Sites by R.C. Barth, 

P.D. George and R.H. Hill 94 

2003 Essential Resources for Industrial 

Hygiene: A Compendium of Current 
Practice Standards and Guidelines 
(AIHA Practice Standards and 
Guidelines Committee) ed. by M.K. Harris 95 


American Institute of Chemical Engineers 

(New york) 


Year Item 

Ammonia Plant Safely and related series 
Survey of Operating Practices inThirty-One 
Ammonium Nitrate Plants 1 

1960 The Manufacture of Nitric Acid by 

Oxidation of Ammonia 2 

1960—69 Safety in Air and Ammonia 

Plants,vols 2-11 13—12 

1961 -62 Operating Practices in Air and 

Ammonia Plants, vols 1-2 13-14 

1964 Survey of Low Pressure Storage of 

Liquid Anhydrous Ammonia 15 

1966 Safety in Ammonium Nitrate Plants 16 
1970-94 Ammonia Plant Safety and Related 

Facilities, vols 12-34 17-38 

Dow Chemical Exposure Index 

1994 Dow Chemical Exposure Index 39 

Dow Fire and Explosion Index 

1973 Dew’s Safety and Loss Prevention 

Guide, 3rd ed. 40 

1976 Dow Fire and Explosion Index 

Hazard classfication Guide, 4th ed. 41 
1981 Dow Fire and Explosion Index 

Hazard Classification Guide, 5th ed. 42 
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1987 Dew’s Fire and Explosion Index 

Hazard Classification Guide, 6th ed. 43 
1994 Dew’s Fire and Explosion Index 

Hazard Classification Guide, 7th ed. 44 


Loss prevention series 

1967-81 loss Prevention vols 1-14 45—58 

1991—93 Loss Prevention, vols 15—17 59—61 

Safety in Polythene Plants 

1973 Safety in High Pressure 

Polyethylene Plants, vol. 1 62 

1974 Safety in Polyethylene Plants, vol. 2 63 

1978 Safety in Polyethylene Plants, vol. 3 64 

Safety and Loss Prevention Conferences 
1987 International Symposium on 

Preventing Major Chemical 
Accidents 65 

1987 International Conference on 

Vapor-Cloud Modeling 66 

1989 International Symposium on 

Runaway Reactions 67 


Other Safety Aspects 

1972 AlChE Pilot Plant Safety Manual 68 

1976 Fundamentals of Fire and Explosion 69 

1989 Hazardous Chemicals - Spills and 

Waterborne Transportation 70 

Chemical Process Technology 

1967 High Pressure Technology 71 

1968 Advances in Cryogenic Heat 

Transfer 72 

1970 Methanol Technology and Economics 73 

1972 Vacuum Technology at Low 

Temperatures 74 

1974 Understanding and Conceiving 

Chemical Processes 75 

1981 Tutorial Lectures in Electrochemical 
Engineering and Technology edited 

by R. Alkire and T. Beck 76 

1982 Cryogenic Processes and Equipment 

ed. by T.H.K. Frederking et al. 77 

1982 Uncertainty Analysis for Engineers 78 

1983 Manual for Predicting Chemical 
Process Design Data edited hy 

R.P. Danner and T.E. Daubert 79 

1983 Tutorial Lectures in Electrochemical 

Engineering and Technology by 
R. Alkire and Der-Tau Chin 80 

1985 Computer Modeling of Chemical 

Processes by J.D. Seader 81 

1985 Plant Design and Cost Estimating 82 

1986 Cryogenic Properties, Processes and 

Applications 1986 ed. byA.J. Kidnay 
and M.J. Hiza 83 

1986 Measurements of Temperature in 

High Temperature Furnaces and 
Processes edited by D.P Drewitt and 
L.F. Albright 84 


1986 Storage Vessels and Other 

Equipment 85 

1987 Process Operations 86 

Computer-Aided Design 

1981 Foundations of Computer-Aided 

Process Design edited R.S.H. Mah 
andW.D. Seider 87 

1982 Selected Topics on Computer-Aided 
Design and Analysis edited 

by R.S.H. Mah and 

G.V. Reklaitis 88 

1983 Data Base Implementation and 

Application edited by G.V Reklaitis 
and J.J. Siirola 89 

Data series 

1984 Awareness of Information Sources 
edited byT.B. Selover and 

M. Klein 90 

1985 Data Compilation Tables of 
Properties of Pure Compounds 
edited by T.E. Daubert and 

R.P. Danner 91 

1986 Chemical Engineering Data Sources 
edited by D. A. Janowski and 

T.B. Selover 92 

Engineering Construction Contracts series 
1970—74 Engineering Construction 

Contracts, vols 1 -6 93-98 


National Conferences on Control of Hazardous 
Materials Spills 

1974 Control of Hazardous Material Spills 99 
1988 Control of Hazardous Material Spills 100 


Nuclear Engineering series 
1954—67 Nuclear Engineering, vols 

1-18 101-118 

1972 The Calculated Loss-of-Coolant 
Accident by L.J. Ybarrando, 

C.W. Solbrig and H.S. Isbin 119 


Pollution, Effluent and Waste Disposal series 
1967-75 Industrial Process Design for 

Pollution Control: 1967, vol. 1; 1970, 
vol. 2; 1971, vol. 3; 1972,vol. 4; 1974, 
vol. 5; 1974, vol. 6; 1975, vol. 7 120-126 

1967-71 Industrial Process Design for Water 
Pollution Control: 1967, vol. 1; 1970, 
vol. 2; 1971, vol. 3 127-129 

1968 Water-1968 130 

1969 Water-1969 131 

1971 Important Chemical Reactions in Air 

Pollution Control 132 

1972 Air Pollution and Its Control 133 

1972 Chemical Engineering Applications 

of Solid Waste Treatment 134 

1972 Water -1971 135 

1974 Recent Advances in Air Pollution 

Control 136 
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1974 Water -1974, Pt 1 Industrial 

Wastewater Treatment 137 

1975 Ecosystems Technology: Theory and 

Practice 138 

1975 Pollution Control and Clean Energy 139 

1975 Sulfur Dioxide Processing 140 

1975 Water -1975 141 

1976 Air Pollution Control and Clean 

Energy 142 

1977 Water -1977 143 

1980 Hazardous Chemicals - Spills and 

Waterborne Transportation 144 

1979 Control of Emissions from Stationary 

Combustion Sources: Pollutant 
Detection and Behavior in the 
Atmosphere 145 

1980 Implications of the Clean Air 

Amendments of 1977 and of Energy 
Considerations for Air Pollution 
Control 146 


1980 Lectures in Atmospheric Chemistry 147 

1981 Water-1980 edited by G.F. Bennett 148 

1981 Research Trends in Air Pollution 

Control: Scrubbing, Hot Gas Clean- 
Up, Sampling and Analysis edited by 
R. Mahalingam and A J. Engel 149 


Equipment Testing Procedures 

E - 4 Continuous Rotary Direct Heat Driers 

(not in current list) 

E - 5 Centrifugal Pumps (Newtonian Liquids) 

E-71965 Mixing Equipment (ImpellerType) 

E-101962 Plate Distillation Columns 

E-141968 Rotary Positive Displacement 

Pumps (Newtonian Liquids) 

E-15 Heat Exchangers (not in current list) 

E-161977 Fired Heaters 

E-18 c.1977 Dry Solids, Paste and Dough Mixing 
Equipment, 2nd ed. 

E-191978 Evaporators, 2nd ed. 

E-201980 Particle Size Classifiers 

E-211980 Centrifuges: A Guide to Performance 

Evaluation 

E-221984 Centrifugal Pumps (Newtonian 

Liquids), 2nd ed. 

E-231985 Continuous Direct-Heat Rotary Dryers: A 
Guide to Performance Evaluation, 2nd ed. 
E-24 c.1986 Tray Distillation Columns, 2nd ed. 

E-25 c.1986 Mixing Equipment (ImpellerType), 2nd ed. 

E-261988 Spray Driers 

E-271989 Fired Heaters 


Center for Chemical Process Safety (CCPS) 

1985 Guidelines for Hazard Evaluation 

Procedures 1 

1987 Guidelines for Use of Vapor Cloud 
Dispersion Models by S.R. Hanna and 

PJ. Drivas 2 

1988 Guidelines for Safe Storage and 

Handling of High Toxic Hazard Materials 
byA.D. Little Inc. and R. Levine 3 

1988 Guidelines for Vapor Release Mitigation 

by R.W Prugh and R.W. Johnson 4 


1989 Guidelines for Chemical Process 

Quantitative Risk Analysis 5 

1989 Guidelines for Process Equipment 

Reliability Data 6 

1989 Guidelines for Technical Management of 

Process Safety 7 

1989 Workbook of Test Cases for Vapor Cloud 
Source Dispersion Models by S.R. Hanna 
and D. Strimaitis 8 

1992 Guidelines for Hazard Evaluation 

Procedures, rev. ed. 9 

1992 Guidelines for Investigating Chemical 

Process Incidents 10 

1992 Plant Guidelines for Technical 
Management of Chemical Process 

Safety 11 

1993 Guidelines for Auditing Process Safety 

Management Systems 12 

1993 Guidelines for Engineering Design for 

Process Safety 13 

1993 Guidelines for the Safe Automation of 

Chemical Processes 14 

1994 Guidelines for Evaluating the 

Characteristics of Vapor Cloud 
Explosions, Flash Fires and BLEVEs 15 

1994 Guidelines for Implementing 

Process Safety Management 
Systems 16 

1994 Guidelines for Preventing Human Error 

in Process Safety 17 


Design Institute for Emergency Relief Systems (DIERS) 
1987 Safety Valve Stability and Capacity Test 
Results: Pressure Relief Valve 
Performance Study. Final Report 150 

1992 Emergency Relief Design Using DIERS 

Technology 151 

1992 Emergency Relief Systems for Runaway 

Chemical Reactions and Storage Vessels: 

A Summary of Multiphase Flow Methods 152 
1992 Bench-Scale Apparatus Design and Test 

Results 153 

1992 Small/Large Scale Experimental Data 

and Analysis 154 

1992 SAFIRE Computer Program and 

Documentation 155 


Design Institute for Physical Property Data (DIPPD) 

1987 Manual for Predicting Chemical Process 
Design Data ed. by R.P. Danner and 
T.E. Daubert 156 

This Manual is supplemented by a series 
of Documentation Manuals, detailing the 
basis for selection of the contents of 
chapters in the Manual 

1985 Experimental Results from the Design 

Institute for Physical Property Data,l: 

Phase Equilibria ed. by M.S. Benson and 
D. Zudkevich 157 

1987 Experimental Results from the Design 

Institute for Physical Property Data,l: 

Phase Equilibria and Pure 

Component Properties ed. by 

C. Black 158 
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1989 Experimental Results from the Design 

Institute for Physical Property Data,l: 
Phase Equilibria and Pure Component 
Properties - RII ed. byT.T. Shih and 
D.K. Jones 


Publ. 920 
Publ. 941 


American Oil Company (AMOCO) 

(Chicago, IL) 

Refinery Process Safety Booklets 

1 Hazard of Water 

2 Hazard of Air 

3 Safe Furnace Firing 

4 Safe Ups and Downs 

5 Hazard of Electricity 

6 Hazard of Steam 

7 Safe Handling of light Ends 

8 Engineering for Safe Operation 

9 Safe Operation of Air, Ammonia and 
Ammonium Nitrate Plants 

10 Safe Operation of Refinery Steam 
Generators and Water Treating Facilities 


Publ. 999 
Item Publ. 1108 

2 Publ. 2009 

3 

4 

5 

6 Publ. 2013 

g Publ. 2015 

9 Publ. 2021 

10 

Publ. 2023 


American Petroleum Institute 

(New York) 

EA 7301 Guidelines on noise 

EA 7102 The chronic toxicity of lead by 

D.C. Jessup etal. 

EA 7402 A mortality study of petroleum refinery 

workers by Tabershaw-Cooper 
Associates 

69-7 A review of the toxicology of lead by 

T.J. Haley 

75-25 Review of inhalation toxicology of 

sulphuric acid and sulphates by 
M.C. Battigelli and J.F. Gamble 

Bull. 2516 Evaporation loss from low pressure 
tanks, 1962 

Bull. 2521 Use of pressure—vacuum vent valves for 

atmospheric pressure tanks to reduce 
evaporation loss, 1966 

Bull. 6F2 Bulletin on fire resistance improvements 

for API flanges, 2nd ed., 1994 

Publ. 301 Above ground storage tank survey: 

1989,1991 

Publ. 302 Waste minimization in the petroleum 

industry: a compendium of practices, 1991 

Publ. 306 An engineering assessment of volumetric 
methods of leak detection in above 
ground storage tanks, 1991 

Publ. 307 An engineering assessment of acoustic 
methods of leak detection in above 
ground storage tanks, 1991 

Publ. 311 Environmental design considerations for 

petroleum refining processing units, 1993 

Publ. 315 Assessment of tankfield dike lining 
materials and methods 

Publ. 317 Industry experience with pollution 

prevention programs, 1993 

Publ. 421 Management of water discharges: 

design and operation of oil-water 
separators, 1990 

Publ. 910 Digest of state boiler and pressure vessel 

rules and regulations, 6th ed., 1992 


Publ. 2027 

Publ. 2028 
Publ. 2030 

Publ. 2031 

Publ. 2200 

Publ. 2202 

Publ. 2203 

Publ. 2207 
Publ. 2214 
Publ. 2216 
Publ. 2217A 
Publ. 2218 
Publ. 2219 
Publ. 2510 

Publ. 2510A 


Prevention of brittle fracture of pressure 
vessels, 1990 

Steels for hydrogen service at elevated 
temperatures and pressures in petroleum 
refineries and petrochemical plants, 

4th ed., 1990 

Technical data book - petroleum 

refining, 4th ed., 1983 

API petroleum pipeline maps, 

12th ed., 1985 

Safe practices in gas and electric cutting 
and welding in refineries, gasoline 
plants, cycling plants and petrochemical 
plants, 5th ed., 1988 
Cleaning mobile tanks in flammable or 
combustible liquid service, 6th ed., 1991 
Cleaning petroleum storage tanks, 

3rd ed., 1985 

Guide for fighting fires in and 
around petroleum storage tanks, 

3rd ed., 1991 

Guide for safe storage and handling of 
heated petroleum-derived asphalt 
products and crude oil residue, 

2nd ed., 1988 

Ignition hazards involved in abrasive 
blasting of atmospheric storage tanks in 
hydrocarbon service, 2nd ed., 1988 
Flame arresters in piping systems, 

2nd ed., 1991 

Guidelines for application of water 
spray systems for fire protection in 
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gas, and product pipelines, 2nd ed., 

1983 

Dismantling and disposing of steel from 

tanks which have contained leaded 

gasoline, 2nd ed., 1982 

Fire precautions for fueling fixed, 
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Guide to Post-Earthquake Investigation 
of Lifelines ed. by A.J. Schiff 48 

Lifeline Earthquake Engineering ed. by 
M.ACassaaro 49 

Pipeline Crossings ed. by J.P. Castronovo 50 
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U.S. Rohatgi, 1993 


Heat Transfer 

1980 Cryogenic Processes and Equipment in 

Energy Systems ed. C.F. Gottzman 49 

1980 Flow Induced Heat Exchanger Vibration 
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P.E. Dempsey 86 



APPENDIX 28/16 INSTITUTIONAL PUBLICATIONS 


1981 Wear of Materials 

1982 Advanced Materials for Pressure Vessel 
Service with Hydrogen at High 
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Wall Pressure Vessels, 1982 
STP 756 Stainless Steel Castings, 1982 

STP 760 Hazardous Solid Waste Testing (First 

Symp.), 1982 
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STP 761 Design of Fatigue and Fracture Resistant 

Structures, 1982 

STP 762 Fire Risk Assessment, 1982 

STP 766 Aquatic Toxicology and Hazard 

Assessment (Fifth Conf.), 1982 
STP 767 Atmospheric Corrosion of Metals, 

1982 

STP 770 Low-Cycle Fatigue and life Prediction, 

1982 

STP 786 Toxic Materials in the Atmosphere, 

Sampling and Analysis, 1982 
STP 789 Thermal Insulations, Materials, and 

Systems for Energy Conservation in the 
’80s, 1983 

STP 791 Fracture Mechanics (Fourteenth Symp.), 

1983 

STP 798 Probabilistic Fracture Mechanics and 

Fatigue Methods: Applications for 
Structural Design and Maintenance, 1983 
STP 801 Corrosion Fatigue: Mechanics, 

Metallurgy, Electrochemistry and 
Engineering, 1983 

STP 802 Aquatic Toxicology and Hazard 

Assessment (Sixth Conf.), 1983 
STP 803 Elastic-Plastic Fracture (Second Symp.) 

STP 805 Hazardous and Industrial Waste Testing 

(Second Symp.), 1983 

STP 806 Standardization of Technical 

Terminology: Principles and Practice, 

1983 

STP 811 Fatigue Mechanisms: Advances in 

Quantitative Measurement of Physical 
Damage, 1983 

STP 812 Flammability and Sensitivity of Oxygen- 

Enriched Atmospheres, 1983 
STP 814 Evaluation and Accreditation of 

Inspection and Test Activities, 1983 
STP 818 Corrosion of Metals in Association with 

Concrete, 1984 

STP 825 A Guide to the Safe Handling of 

Hazardous Materials Accidents, 1983 
STP 826 Fire Resistive Coatings, 1984 

STP 833 Fracture Mechanics (Fifteenth Symp.) 

STP 834 Definitions for Asbestos and Other 

Health-Related Silicates, 1984 
STP 840 Oil Spill Chemical Dispersants: 

Research, Experience and 
Recommendations, 1984 

STP 844 Methods for Assessing the Structural 

Reliability of Brittle Materials, 1984 
STP 851 Hazardous and Industrial Waste 

Management and Testing (Third Symp.), 

1984 

STP 854 Aquatic Toxicology and Hazard 

Assessment (Seventh Symp.), 1985 
STP 857 Fatigue at Low Temperatures, 1985 

STP 868 Fracture Mechanics (Sixteenth 

Symp.) 1985 

STP 872 Inhalation Toxicology of Air Pollutants: 

Clinical Research Considerations, c. 1985 
STP 880 Corrosion of Metals under Thermal 

Insulation, 1985 

STP 882 Fire Safety: Science and Engineering, 

1985 


Data Series 

DS 3 Report on Strength of Wrought Steels at 

Elevated Temperatures 

DS 5 Report on Elevated Temperature 

Properties of Stainless Steels, 1952 

DS 5 -SI Report on Elevated Temperature 

Properties of Stainless Steels - 
Supplement, 1965 

DS 5 -S2 An Evaluation of the Yield, Tensile, Creep 

and Rupture Strengths of Wrought 304, 
316,321 and 347 Stainless Steels at 
Elevated Temperatures, 1969 

DS 6 Elevated Temperature Properties of 

Chromium-Molybdenum Steels 

DS 11 Elevated Temperature Properties of 

Carbon Steels 

DS 15 Report on Elevated Temperature 

Properties of Wrought Medium-Carbon 
Alloy Steels 

DS 16 The Elevated-Temperature Properties of 

Weld-Deposited Metal and Weldments 

DS 22 Physical Properties of Metals and Alloys 

from Cryogenic to Elevated Temperatures 

DS 40 Elevated Temperature Properties of 

Basic-Oxygen Steel, 1952 

DS 48 Compilation of Odor and Taste Threshold 

Values Data, 1973 


Other publications 

Safe Handling of Hazardous Materials Accidents, 
2nd ed„ 1990 


American Welding Society 

(Miami, FA) 

Welding Handbook, lst-8th ed., 1938-1999 
Welding Handbook, 9th ed. 

A3.0-01 Standard Welding Terms and Definitions, 

2001 

AWS Arc Welding and Cutting Safely, 2000 

B2.1- 00 Specification for Welding Procedure and 

Performance Qualification, 2000 
B4.0/4.0M Standard Methods for Mechanical 

Testing of Welds, 1998/2000M 
Bl.10-86 Guide for the Nondestructive Inspection 

of Welds, 1986 

Bl.ll- 88 Guide for the Nondestructive Inspection 

of Welds, 1988 

Bl.ll- 99 Guide for the Nondestructive Inspection 

of Welds, 1999 

BRS Braze Safely, 1992 

C7.1 Recommended Practices for Electron 

Beam Welding, 1999 

CAWF Characterization of Arc Welding Fumes, 

1983 

D16.3M/D16.3 Risk Assessment Guide for Robotic Arc 
Welding, 2001 

QC-1-96 Standard for AWS Certification of 

Welding Inspectors, 1996 

SHF Safety and Health Fact Sheets, 2nd 

Edition, 1998 
SP Safe Practices 

ULR Ultraviolet Reflectance of Paint, 1976 
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Z49.1 Safety in Welding, Cutting, and Allied 

Processes (ANSI Approved), 1999 
Effects of Welding on Health 
EWH-1 1940-1977 

EWH-2 1978-1979 

EWH-3 1979-1980 

EWH-4 1980-1982 

EWH-5 1982-1984 

EWH-6 1984-1985 

EWH-7 1986-1987 

EWH-8 1988-1989 

EWH-9 1990-1991 

EWH-10 1992-1994 

EWH-11 1995-1996 

EWH-I Book Index 

WHB 1.9 Welding Science and Technology, 2001 

WHB 2.9 Welding Processes, Part 1 {to be published) 

WHB 3.9 Welding Processes, Part 2 (to be published) 

WHB 4.9 Materials and Processes, Part 1 (to be 
published) 

WHB 5.9 Materials and Processes, Part 2 (to be 
published) 

WI-2000 Welding Inspection Handbook, 

3rd Edition 


Associated Octel Company 

(Ellesmere Port, Cheshire) 

Handbook 
Octel Handbook 

Bulletins 

13 The use of explosimeters in atmospheres 

containing lead alkyl compounds, 1975 
18 TheTelmatic lead-in-air analyser, 1974 

20 How to deal with damaged and defective drums, 
1972 

21 Air supplied suit, 1974 

24 Lead-in-air threshold limitvalues, 1972 

28 Taking Octel tanks out of service, 1975 

Booklets 

20/74 Emergencies and safety involving Octel 
antiknock compounds 

21/74 Laboratory practice relating to Octel antiknock 
compounds 

22/75 Transport of Octel antiknock compounds 
23/72 Transport of Octel antiknock compounds by sea 


3 Environmental Quality, 1980 

4 Risk, Cost and Pollution, 1982 


British Approvals Service for Electrical Equipment in 
Flammable Atmospheres 

(Buxton, Derbyshire) 

Item 

BASEEFA Guide, 3rd ed. 1 

SFA3004 Shunt Diode Safety Barriers 

SFA3006 Battery Operated Vehicles 

SFA 3007 Instruments for Measuring Gas 

Concentration 

SFA 3009 Special Protection 

SFA 3012 Intrinsic Safety 


British Chemical Industry Safety Council 

(London) 

Year Item 

1959 Safety in Inspection and Maintenance of 

Chemical Plant 3 

1965-75 Quarterly Safety Summary 4 

1965 Safety Training — a Guide for the 

Chemical Industry 5 

1967 The Road Transport of Chemicals - 

Principal Safety Requirements 6 

1968 Guide to Fire Prevention in the Chemical 

Industry 7 

1968 Is it Toxic? 8 

1969 Safe and Sound 9 

1969 Safe and Sound. Summary for 

Managements 10 

1972 Major Hazards. Memorandum of 

Guidance on Extensions to Existing 
Chemical Plant Introducing a Major 
Hazard 11 

1973 SafetyAudits 12 

1973 SafetyAudits. Summary for 

Managements 13 

1974 Vinyl Chloride Monomer. Advisory Notes 
for PVC Processors 

British Safety Council Guides: Monthly 
Publications 14 


See also Appendix 27 


Association of British Chemical Manufacturers 

(London) 

Item 

Model Safety Rules for Chemical Works 1 

1934-60 Quarterly Safety Summary 2 

1964 Safety and Management 3 

Atomic Energy Research Establishment 

Harwell 

Harwell Environment Seminars 

1 Major Chemical Hazards, 1978 

2 Safety of Chemicals in the Environment, 
1979 


British Compressed Gases Association 

(Crawley, Surrey) 

Guidance Notes 

GN1 Guidance Notes on the Preparation of 
Major Emergency Procedures, 1977 
GN2 Guidance for the Storage of 

Transportable Gas Cylinders for 
Industrial Use, Revision 2,1997 
GN3 Application of the Manual Handling 

Operations Regulations to Gas Cylinders 
GN5 The Safe Application of Oxygen Enriched 

Atmospheres when Packaging Food, 1998 
GN6 Avoidance and Detection of Internal 
Corrosion of Gas Cylinders 
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GN7 

GN8 

GN9 

GN10 


The Safe Use of Individual Portable or 
Mobile Cylinder Gas Supply 
Equipment, 2000 

Catalogue of BCGA Members’ Cylinder 
Test Marks, Revision 4, 2000 
The Application of the Confined Spaces 
Regulations to the Drinks Dispense 
Industry, 2000 

Implementation of EIGA Carbon Dioxide 
Standards, 2000 


Technical Reports 

TR1 A Method for Estimating the Offsite 
Risks from Bulk Storage of Liquefied 
Oxygen Rl(LOX), 1984 

TR2 The Probability of Fatality in Oxygen 

Enriched Atmospheres due to Spillage of 
Liquid Oxygen R2 (LOX), 1999 
TR3 Replacement Substances for the 

Cleaning of Oxygen System 
Components, 1999 

CP4 Industrial Gas Cylinder Manifolds & 

Distribution Pipework/Pipelines 
(excluding acetylene), 

Revision 2,1998 

CP5 The Design & Construction of Manifolds 
using Acetylene Gas from 1.5 bar to a 
Maximum Working Pressure of 25 bar 
(362 lbf/in 2 ), Revision 1,1998 
CP6 The Safe Distribution of Acetylene in the 

Pressure Range 0—1.5 bar (0-22 lbf/in 2 ), 
Revision 1,1998 

CP7 The Safe Use of Oxy-Fuel Gas Equipment 
(Individual Portable or Mobile Cylinder 
Supply) Revision 2,1996 

CP15 -1 The Safe Re-rating of Existing BS 5045, 

Part 1,1982: Containers - Amendment 
AMD 5145,1986, Part 1: Containers 
for Permanent Gases, Revision 1, 

1996 

CP15 -2 The Safe Re-rating of Existing BS 5045, 

Part 1,1982: Containers - Amendment 
AMD 5145,1986, Part 2: Containers for 
Hydrogen Trailer Service, Revision 1, 
1996 

CP16 Movement of Static Storage Tanks for 
Non-Flammable, Non-Toxic Gases by 
Road, Revision 2,2002 

CP17 The Repair of Hand-held Blowpipes & 
Gas Regulators used with Compressed 
Gases for Welding, Cutting & Related 
Processes, Revision 1,1998 
CP18 The Safe Storage, Handling & Use of 

Special Gases in the Micro-Electronics 
Industry, Revision 1,1995 
CP19 Bulk Liquid Oxygen Storage at Users’ 
Premises, Revision 3, 2002 
CP20 Bulk Liquid Oxygen Storage at 

Production Sites, Revision 2, 2002 
CP21 Bulk Liquid Argon or Nitrogen Storage at 

Users’ Premises, Revision 1,1998 
CP22 Bulk Liquid Argon or Nitrogen Storage 
at Production Sites, Revision 1, 

2002 


CP23 Application of the Pressure Systems and 
Transportable Gas Containers 
Regulations 1989 to Industrial and 
Medical Pressure Systems Installed at 
Consumer Premises, Revision 1, 2002 

CP24 Application of the Pressure Systems and 
Transportable Gas Containers 
Regulations 1989 to Operational Process 
Plants, 1992 

CP25 Revalidation of Bulk Liquid 

Oxygen, Nitrogen, Argon and Hydrogen 
Cryogenic Storage Tanks, Revision 1, 

1998 

CP26 Bulk Liquid Carbon Dioxide Storage at 
Users’ Premises, Revision 1,1999 

CP27 Transportable Vacuum Insulated 

Containers of not more than 1000 litres 
volume, 1994 

CP28 Vacuum Insulated Tanks of not more than 
1000 litres volume which are Static 
Installations at User Premises, 1997 

CP29 The Design and Operation of Cylinder 

and TUbeTrailers for the SafeTransport of 
Compressed Gases by Road, 1999 

CP30 The Safe Use of Liquid Nitrogen Dewars 
up to 50 litres, 2000 

Leaflets 

LI Carriage of Gas Cylinders by Road in 

Cars, Vans and Other Vehicles - Guidance 
for Drivers at Work 

L2 The Safe Handling of Gas Containers at 

Waste Facilities 

L3 Pressure Systems Legislation - A 

Summary: 2001 

Technical Information Sheet 

TIS3 Dimensions for Three-seat Cutting 

Nozzles 

TIS4 BS EN ISO 14114 Acetylene Manifold 
Systems for Welding, Cutting and 
Allied Processes: General 
Requirements 

TIS6 Cylinder Identification Color Coding and 

Labeling Requirements, 2001 

TIS7 Guidelines for the Safe Transportation, 

Storage, Use and Disposal of Dry Ice 
Products, 2001 

TIS8 Information for Customers Collecting 

Gas Cylinders (Flammable, Inert and 
Oxidizing Gases), 2002 

TIS9 Gas Safety in Cellars - Checklist, 2002 


British Gas 

(London) 

Communications 

Comm. 1044 The background and implication of IGE/ 
TD/1, ed. 2 byA.E. Knowles and 
F. Tweedle, 1977 

Comm. 1046 Progress in noise control technology - 

applied to transmission and distribution 
by D. Headon, 1977 
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Comm. 1048 

Comm. 1052 

Comm. 1053 

Comm. 1103 
Comm. 1104 

Comm. 1110 

Comm. 1123 

Comm. 1135 

Comm. 1143 

Comm. 1149 

Comm. 1155 

Comm. 1224 

Comm. 1233 
Comm. 1241 

Comm. 1242 

Comm. 1255 
Comm. 1260 

Comm. 1277 
Comm. 1281 
Comm. 1296 

Comm. 1297 

Comm. 1298 


Noise generation and suppression in 
combustion equipment by 

B. D. Mugridge, C. Hughes and C.A. 
Roberts, 1977 

Conservation of natural gas in pipeline 
operation: system integrity and 
efficiency by G.C. Britton, G.M. Hugh and 
R.D. Walker, 1977 

Hazard prevention — a NorthAmerican 
experience by L. James, A. McDiarmid 
and C.W.P. Maynard, 1977 
Why pipes fail by D. Needham and 
M. Howe, 1978 

A review of construction and 
commissioning procedures for new 
pipelines by S. Gorton, D.J. Platts, 

K. T. Jones, A.E. Hawker and 

C. W Osborn, 1978 

The development of coal liquefaction 
processes in the United Kingdom by 
J.M. Topper, 1978 

Hydrocarbon production from sea 
bed installations in deep water by 
A. Dorr, 1978 

The analysis of engineering projects for 
the national gas transmission system by 

D. O. Pugh, 1978 

North East Frigg, a satellite of the 
Frigg giant gas field by C.E. Duvet, 

1981 

The northern North Sea gas gathering 
system by W.J. Walters, R.H.Willmott and 

I. J. Harthill, 1981 

Experience with on-line inspection by 
R.W.E. Shannon, D.W. Hamlyn and 
D. White, 1981 

The application of computer control to 
process plant by A. Brightwell, P. 

Spittle,T.P. Williams and V.C. Miles, 1983 
Safety in industry by B.F. Street, 1984 
Combustion of large scale jet-releases of 
pressurised liquid propane by 
WJ.S. Hirst, 1984 

Assessment of safety systems using fault 
tree analysis by J.M. Morgan and 

J. D. Andrews, c.1985 

BP engineering offshore by 
M.Woolveridge and A.C.Wake 
Buried modules - a new concept for 
district pressure control by D. Needham 
and C.A. Spearman, 1985 
Improved methods of PE pipe jointing by 

L. Maine and T.G. Stafford, 1985 
Corrosion control of steel pipelines by 
P. Corcoran and CJ. Argent, 1985 
Computer-based control and alarm 
systems for process plant by E.G. Brennan, 
T.P.Williams and G.Twizell, 1986 
Building practical expert systems in 
research and development by C. Ringrose, 
1986 

Smoke, fire and gas detection at British 
Gas installations by R.S. Davidson and 
SJ. Peacock, 1986 


Comm. 1304 

Comm. 1305 
Comm. 1306 

Comm. 1334 
Comm. 1345 
Comm. 1346 
Comm. 1349 
Comm. 1355 

Comm. 1380 

Comm. 1381 

Comm. 1404 

Comm. 1408 
Comm. 1409 

Comm. 1410 
Comm. 1438 

Comm. 1439 
Comm. 1456 

Comm. 1493 


British Gas-a commitment to safety by 
R. Herbert, J.M. Kitchen and 
PM. Mulholland, 1986 
Standards, certification and testing by 
W.J. Bennett and R. A. Hancock, 1986 
Performance testing and monitoring of 
compressor units by G.W. Fairbairn, 

J.R. Nisbet and I.C. Robertson, 1986 
Offshore structural steels - a decade of 
progress by P.R. Kirkwood, 1987 
Radar detection of buried pipes and 
cables by H.F. Scott and D.J. Gunton, 1987 
Recent developments in on-destructive 
testing by G. A. Raine and A.D. Batte, 1987 
Natural gas venting and flaring by 
D.R. Brown and M. Fairweather, 1987 
Ventilation in traditional and modern 
housing by D.W. Etheridge, D.J. Nevrala 
and R.J. Stanway, 1987 
The development and application of CAD 
techniques by T. Nixon, D.W. Hamlyn and 
J.E. Sharp, c.1988 

Hazard assessment at full scale-the 
Spadeadam story by B.J. Flood and 
R.J. Harris, c.1988 

Advances in coal hydrogenation for the 
production of SNG and coal liquids by 
PA Borrill and F. Noguchi, 1989 
Understanding vapour cloud explosions 
by R.J. Harris and M.J.Wickens, 1989 
The development and exploitation of 
British Gas pipeline inspection 
technology by L. Jackson and R. Wilkins, 
1989 

Plant and pipe location using radar 
methods by D.J. Gunton, 1989 
Fitness for purpose revalidation of 
pipelines by C.J. Argent, J.C. Braithwaite 
and W.P. Jones, 1990 
Pipe rehabilitation technology by 
J. Thomas and B.E. McGuire, 1990 
Programmable electronic systems 
applied to British Gas plant by 
R.M. Turner and T.P. Williams, 1991 
The development of CHAOS: a 
computer package for the consequence 
and hazard assessment of offshore 
structures by K. Greening, 

M.J.A. Mihsein, D. Piper and 
M.W. Vasey 


Engineering Standards Item 

Code of practice for large gas and dual fuel burners 1 
IM/9 Code of practice for the use of gas in 

atmosphere gas generators and 
associated plants, 1977 

IM/12 Code of practice for the use of gas in 

high temperature plant, 1980 
IM/18 Code of practice for the use of gas in 

low temperature plant, 1982 
PS/SHA1 Code of practice for hazardous area 
classification. Part 1 - Natural gas 
(draft), 1981 
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MRS Reports 

MRS E 378 Gaseous and dust explosion venting: 

determination of explosion relief 
requirements by M.R. Marshall, 1980 
MRS E 374 Ignition probabilities in turbulent mixing 

flow by A.D. Birch, D.R. Brown and 
M.G. Dodson, 1980 


Recommendations onTransmission and Distribution 
Practice 

IGE/TD/1 Steel pipelines for high pressure gas 
transmission, ed. 2, with amendments 
IGE/TD/5 Transport, handling and storage of 
plastic pipe. R1, Polyethylene pipe 
IGE/TD/10 Pressure regulating installations for inlet 
pressures between 75 mbar and 7 bar, 
with amendments 

IGE/SR/10 Procedures for dealing with escapes of 
gas into underground plant, 1987 
IGE/SR/11 Liquefied natural gas: 

R1,Temporary storages for periods not 
exceeding six months, 1971R 2, Use of 
road tankers and tank trailers as 
temporary storages, 1971 
IGE/SR/12 Handling of methanol, 1989 
IGE/SR/13 Use of breathing apparatus in gas 
transmission and distribution, 1986 
IGE/SR/14 High pressure gas storage: Pt 1, Above 
ground storage vessels, 1986 R 2, Buried 
pipe arrays, 1986 

IGE/SR/15 Use of programmable electronic systems 
in safetyrelated applications in the gas 
industry, 1989 

IGE/SR/18 Safe working in the vicinity of gas 

pipelines and associated installations. 

R1, Operating at pressures in excess of 
7 bar, 1990 


British Occupational Hygiene Society 
(London) 


2 


3 


5 

10 

11 

12 


Hazards of occupational exposure to 

ultraviolet radiation by D. Hughes, 1978 

Electrical safety interlock systems by 

D. Hughes, rev ed., 1985 

The toxicity of ozone by D. Hughes, 1979 

A literature survey and design study of 

fume cupboards and fume-dispersion 

systems by D. Hughes, 1980 

Notes on ionizing radiations: quantities, 

units, biological effects and permissible 

doses by D. Hughes, 1982 

Education and training in occupation 

hygiene by P.J. Hewitt, 1983 

The disposal of hazardous wastes by 

G.E. Olivers, 1983 

Allergy to chemicals and organic 

substances in the workplace by 

G.W. Cambridge and B.F.J. Goodwin, 1984 


Technical Guides 

GG1 The Manager’s Guide to Control of 

Hazardous Substances (with 21 case 
studies) 


TG3 Fugitive emissions of vapours from 

process plant equipment by A.L. Jones, 

M. Devine, PR. Janes, D. Oakes and 

N. J. Western, 1984 

TG4 Dustiness estimation methods for dry 

materials, by C.M. Hammond, N.R. Heriot, 
R.W Higman, A.M. Spivey, J.H. Vincent 
and A.B. Wells, 1985 

TG6 Sampling & Analysis of Compressed Air 

for Breathing Purposes 

TG7 Controlling airborne contaminants in the 

workplace by M. Piney, R.J. Alesbury, 

B. Fletcher, J. Folwell, F.S. Gill, G.L. Lee, 
R.J. Sherwood andJ.A.Tickner, 1987 
TG9 Biological Monitoring Reference Data 

TH1 Some applications of statistics in 

occupational hygiene, 2001 


British Safety Council 
(London) 

Item 

Communicating the Safety Message 1 

Compressed air safety code 2 

Construction Safety 3 

Emergency planning and disaster control 4 

Environmental Management 5 

Fire Safety 6 

Health and Safety in the Office 7 

Industrial dermatitis - causes and prevention 8 

Laboratory safety 9 

Machine guarding 10 

Management introduction to total loss control 11 

Managing Stress 12 

Manual Handling 13 

New techniques in loss control management 14 

Occupational Health 15 

Providing Personal Protection 16 

Respiratory Protective Equipment 17 

Risk Assessment 18 

Safety and Induction Training 19 

Safety policies — how to write and enforce them 20 

Safety Signs 21 

Skin disease from oils - causes and prevention 22 

Slips,Trips and Falls 23 

Update on Health and Safety Law 24 

Waste Management 25 

Working with Electricity 26 

Working with Substances Hazardous to Health 27 

Workplace Noise and Hearing Protection 28 

Workplace Transport 29 


Building Research Establishment 

(Borehamwood) 

Current Papers 

CP26/71 The breakage of glass windows by gas 
explosions by R.J. Mainstone, 1971 
CPU/73 The hazard of internal blast in buildings 
by R.J. Mainstone, 1973 

CP5/74 Smoke and toxic gases from burning 

plastic by G.WV. Stark, 1974 
CPU/74 Decomposition products of pvc for 
studies of fires by WD. Woolley, 1974 
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CP2/74 

CP29/74 

CP30/74 

CP32/74 

CP35/74 

CP36/74 

CP43/74 

CP45/74 

CP68/74 

CP72/74 

CP88/74 

CP91/74 

CP16/75 

CP25/75 

CP29/75 

CP32/75 

CP36/75 

CP37/75 

CP42/75 

CP67/75 

CP77/75 

CP78/75 

CP79/75 

CP82/75 

CP22/76 

CP24/76 


Nitrogen containing products from the 
thermal decomposition of flexible 
polyurethane foams by WD. Woolley, 1974 
Effects of fuel geometry in fires by 
P.M. Thomas, 1974 

Fires in enclosures P.M. Thomas, 1974 
Fires in model rooms: CIB research 
programmes P.M. Thomas, 1974 
Fires in oil soaked lagging by 
PC. Bowes, 1974 

Ventilation in relation to toxic and 
flammable gases in buildings by 
S.J. Leach and D.P. Bloomfield, 1974 
Experimental techniques for wind test 
tunnels on model buildings by P.F. Grigg 
and D.E. Sexton, 1974 
Structural damage in buildings caused 
by gaseous explosions and other 
accidental loadings by N. Taylor and 
S.J. Alexander, 1974 
The rapid extinction of fires in high- 
racked storages by P. Nash, NW Bridge 
and R. A. Young, 1974 
Determination of flame spread and fire 
resistance by H.L. Malhotra, 1974 
Methods of determining the optimum 
level of safety expenditure by 
S.J. Melinek, 1974 

Polymeric materials in fires by Fire 
Research Station and Building 
Regulations Professional Division, 1974 
Tornado damage in buildings 26 June 
1973 by K.J. Eaton and C.J. Judge, 1975 
Problems with the use of fire-fighting 
foams by J.G. Corrie, 1975 
The performance of the sprinkler in 
detecting fire by P. Nash and R. A. Young, 
1975 

The behaviour of automatic fire detection 
systems by J.F. Fry and C. Eveleigh, 1975 
The explosion risk of stored foam 
rubber by W.D. Woolley and S.A. Ames, 
1975 

Fire resistance - present and future by 
H.L.Malhotra, 1975 
Fire protection of flammable liquid 
storages by water spray and foam by 
P. Nash and R.A. Young, 1975 
The performance of the sprinkler in the 
extinction of fire by P. Nash and 
R. A. Young, 1975 

The testing of sprinkler installations by 
R. A. Young and P. Nash, 1975 
The testing of sprinklers by P. Nash and 
R. A. Young, 1975 

The essentials of sprinkler and other 
water spray fire protection systems by 
P. Nash, 1975 

Some design aspects of fire extinguishers 
by P. Nash, 1975 

Toxic combustion products of plastics by 
WD.Woolley and M. Raftery, 1976 
The response of buildings to accidental 
explosions by RJ. Mainstone, 1976 


CP43/76 Noise levels at the boundaries of factories 
and commercial premises by M.P. Jenkins, 
A.C. Salvidge and W. A. Utley, 1976 
CP50/76 The use of automatic sprinklers as fire 
sensors in chemical plant by P. Nash and 
C.R. Theobald, 1976 

CP52/76 Sprinkler systems for special risks by 
P. Nash and R. A. Young, 1976 
CP72/76 Background noise levels in the United 
Kingdom by K. Attenborough, S. Clark 
andW.A. Utley, 1976 

CP74/76 Experimental methods for the study of 
fire-fighting foams by J.G. Corrie, 1976 
CP9/77 Fire losses and the effect of sprinkler 
protection of buildings in a variety of 
industries and trades by F.E. Rogers, 1977 
CP8/78 The estimation of parameters of normal 
distributions from data restricted to 
large values, 1978 

CP12/78 Thermal theory of ignition burning and 
extinction of materials in a ‘stagnant’ 
gaseous boundary layer, 1978 
CP14/78 Soil-structure interaction and 

deformation with large oil tanks, 1978 
CP15/78 Quality control procedures for fire¬ 

fighting foams, 1978 

CP25/78 On design procedures for wind loading, 
1978 

CP36/78 The control of noise from fixed premises - 

some case histories, 1978 

CP39/78 Full-scale and model-scale studies of the 

dynamic behaviour of an offshore 
structure, 1978 

CP40/78 Growth and development of fire in 
industrial buildings, 1978 

CP52/78 life safety: what is it and how much is it 
worth, 1978 

CP59/78 Maintenance and operating costs of 
modern boilers by R.M. Milner and 
R.C. Wordsworth 

CP71/78 On simulating the atmospheric boundary 

layer in wind tunnels by N.J. Cook, 1978 
CP5/82 Isothermal methods for assessing 

combustible powders: Pt I Theoretical 
and experimental approach; Pt II 
Practical case histories by P.F. Beever and 
P.F. Thorne, 1982 

CP2/83 The incidence of accidental loadings in 
buildings, 1971-1981 by J.F. A. Moore, 
1983 

(series discontinued in 1983) 

Information Papers 

IP6/82 Spontaneous combustion, 1982 

IP22/82 Fire and glazing, 1982 

IP8/83 The incidence of accidental loads in 
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IP15/84 A hydrocarbon fire standard for offshore 
structures, 1984 

IP21/84 Fire spread in buildings, 1984 

IP22/84 Smoke spread within a building, 1984 
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IP5/88 Selection of sprinklers for high rack 
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IP3/89 Subterranean fires in the UK - the 

problem, 1989 

IP4/89 Expert systems, 1989 

IP21/89 Passive stack ventilation in buildings, 

1989 

Notes 

N81/81 Dust explosion - the respective roles of 

the Hartmann bomb and 20-litre sphere 
in prescribing the size of explosion relief 
vents: a preliminary study by P. Field and 
A.R. Abrahamsen, 1981 
N101/81 Dust explosion protection - a 

comparative study of methods for sizing 
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Technical Information 

TIL 63 Dust explosions, 1979 

BRE Reports Item 
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BR9 Buildings and the hazard of explosion by 

R.J. Mainstone, 1974 Wind loading 
handbook by CW. Newbury and 
K.J. Eaton, 1974 1 

Structural damage in buildings caused 
by gaseous explosions and other 
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United Kingdom Fire and Loss Statistics 
United Kingdom Fire and Loss Statistics, 1970 
United Kingdom Fire and Loss Statistics, 1971 
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S037 Explosibility assessment of industrial 
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S041 Self-heating: evaluating and controlling 
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(Publication: HM Stationery Office) 
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Results of fire resistance tests on elements of 
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Results of fire propagation tests on building 
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Results of surface spread of flame tests on 
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The explosion and fire at Nypro UK Ltd 
Flixborough on June 1974 by D.M. Tucker, 1976 7 

Manual for Testing Flame Arresters by 
Z.W. Rogowski, 1978 8 
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EP1 The designers guide to wind loading of 
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(Washington, DC) 
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Bull. 368 Static electricity in nature and industry 

by P.G. Guest, 1938 
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G.M. Kintz and F.C. Hill, I960 
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Bull. 627 Flammability characteristics of 
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IC 8757 Laboratory studies of self-heating of 
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RI 4835 Explosive characteristics of titanium, 
zirconium,thorium, uranium and their 
hydrides by I. Hartmann, J. Nagy and 
M.Jacobsen, 1951 

RI 4904 A study to determine factors causing 

pressure piling in testing explosion-proof 
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the production and handling of liquid 
hydrogen by M.G. Zabetakis and 

D. S. Burgess, 1961 


RI 5753 Explosibility of agricultural dusts by 
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R.E. Kennedy, 1962 
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RI 6369 Ignition of coal dust-methane-air mixtures 
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RI 6561 Pressure development in laboratory dust 
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RI 7752 Detonation of a flammable cloud following a 
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and M.G. Zabetakis, 1973 
RI 7839 Constant volume flame propagation by 

H.E. Perlee, F.N. Fuller and C.H. Saul, 1974 
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Perlee and M.G. Zabetakis, c.1963 
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4177 Burgess, J. Biordi and J.N. Murphy, 1972 
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5 4105 Hazards of LNG spillage in marine 

transportation by D.S. Burgess, J.N. Murphy 
and M.G. Zabetakis, 1970 
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10 Safety Training, 1971 
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in the United Kingdom 8 

1975 Code of Practice for the Safe Handling 
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PA11 Codes of Practice for Chemicals with 
Major Hazards: Acrylonitrile, 1978 
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RC15 Guidelines on Waste Management -1, 

The Use of Waste Disposal 
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Liability and Public Liability, 1992 
RC56 Risk Assessment Guidelines. Material 
Damage, 1992 

RC58 Volatile Organic Compounds (VOCs) - 
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006 Piping Systems for Dry Chlorine 14th ed., 
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057 Emergency Shut- Off Systems for Bulk 

Transfer of Chlorine, 3rd ed., 1997 
060 Chlorine Pipelines, 5th ed., 2001 
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Personal Protective Equipment for Chlor- 
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Recommended Practices for Handling 
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Respiratory protection guidelines for 
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Guidelines for the Safe Vehicular 
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release by A.E. Howerton, 1975 
OPFLOW Developing a chlorine emergency control 

plan, 1985 

PUBLIC Chlorine Institute Public Information 

Handbook for Emergency Planning and 
Community Right-to-Know, 1997 
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S.F. Hall, D. Martin and J. Mackenzie, 
1984 

EUR 9593 Experimental investigation of the 
EN acceleration of deflagration in wake flow, 

by G. Adomeit and H.Willms, 1984 
EUR 9541 On the adequacy of numerical codes for 

EN/I the simulation of vapour explosions by 

C. J.M. van Wingerden and A.C. van den 
Berg, 1984 

EUR 9541 Experimental study of the influence of 
EN/II obstacles and partial confinement of 

flame propagation by C.J.M. van 
Wingerden, 1984 

EUR 9592 Aspects of the dispersion of denser-than- 
EN air vapours relevant to gas cloud 

explosions by C.J. Wheatley and 

D. M. Webber, 1984 

EUR 9679 Caracterisation du champ de pression 
EN induit par l’explosion aerienne d’un 

melange air- hydrocarbure, deflagration 
lente, deflagration rapide by J. Brossard, 
D. Desbordes, N. de Fabio, J.L Gamier, 

A. Lannoy, J.C. Leyer, J. Perrot and 
J.P. Saint-Cloud, 1985 

EUR 9933 Computer processing of visual records 
EN from the Thomey Island large scale gas 

trials by M.L. Rietmuller, J.M. Buchlin 
and S. Rickaert, 1985 

EUR 10029 Large scale field trials on dense vapour 

EN EN dispersion by J. McQuaid and 

B. Roebuck, 1985 

EUR 11147 Licensing issues associated with the use 
EN of computers in the nuclear industry, by 

R.E. Bloomfield andW.D. Ehrenburger, 
1987 

EUR 12602 Fifteen benchmark exercises on vessel 
EN depressurisation with non-reacting 

fluids: hydrodynamic considerations by 
A.N. Skouloudis, 1990 

EUR 13699 Community Documentation Centre on 
EN Industrial Risk. Comparison of LPG- 

related regulations by S. Harris, 

J.E. Arreger,V.M.Trbojevic and R.A. Cox 
EUR 13386 Benchmark exercise on major hazard 

EN analysis, vol. 1, Designation of the project, 

discussion of the results and conclusions 
EUR 13597 Benchmark exercise on major hazard 

EN analysis, vol. 2, Summary contributions 

of participants 
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Other publications Item 

Large scale catastrophic releases of 1 

flammable liquids, by D.M. Johnson, 

M.J. Pritchard and M.J.Wickens 
Res. Contract EV4T.0014 UK(H) 

Safety of Thermal Water Reactors by 
E. Skupinski, B. Tolley and J.Vilain, 1985 
(Publication: Graham and Trottman, 2 

London) 

Compressed Gas Association 

(Arlington,VA) 

C-l Methods for HydrostaticTesting of 

Compressed Gas Cylinders, 1996 
C- 4 Fuel Containers and Their Installations 

American National Standard Method of 
Marking Portable Compressed Gas 
Containers to Identify the Material 
Contained, 4th ed., 1990 

C- 5 Cylinder Service Life - Seamless Steel High 

Pressure Cylinders, 1991 

C- 6 Standards for Visual Inspection of Steel 

Compressed Gas Cylinders, 2001 
C- 6.1 Standards for Visual Inspection of High 

Pressure Aluminum Compressed Gas 
Cylinders, 2002 

C-6.2 Guidelines for Visual Inspection and 

Requalification of Fiber Reinforced High 
Pressure Cylinders, 1996 

C- 6.3 Guidelines for Visual Inspection and 

Requalification of Low Pressure Aluminum 
Compressed Gas Cylinders, 1999 
C- 6.4 Methods for External Visual Inspection of 

Natural Gas Vehicle (NGV), 1998 
C-10 Recommended Procedures for Changes of 

Gas Service for Compressed Gas Cylinders, 
1993 

C-ll Recommended Practices for Inspection of 

Compressed Gas Cylinders at Time of 
Manufacture, 2001 

C-14 Procedures for Fire Testing of DOT Cylinder 

Pressure Relief Device Systems, 1999 
C-15 Procedures for Cylinder Design Proof and 

Service Performance Tests, 2002 
CGA- 341 Standard for Insulated Tank Specification for 
Cryogenic Liquids, 3rd ed., 1987 
G-l Acetylene, 2001 

G-l.l Commodity Specification for Acetylene, 1998 

G-1.2 Acetylene Metering and Pipeline 

Transmission, 2000 

G-1.3 Acetylene Transmission for Chemical 

Synthesis, 1970,1984 
G-2 Anhydrous Ammonia, 1995 

G-2.1 American National Standard Safety 

Requirements for the Storage and Handling 
of Anhydrous Ammonia (ANSI K61.1), 1999 
G-2.2 Guideline Method for Determining Minimum 

of 0.2% Water in Anhydrous Ammonia, 1985 
G- 3 Sulfur Dioxide, 1995 

G-4 Oxygen, 1996 

G- 4.1 Cleaning Equipment for Oxygen Service, 

1996 

G-4.3 Commodity Specification for Oxygen, 2000 


G- 4.4 Industrial Practices for Gaseous Oxygen 

Transmission and Distribution Piping 
Systems, 1993 

G- 4.8 Safe Use of Aluminum-Structured Packing 
for Oxygen Distillation, 2000 
G-4.9 Safe Use of Brazed Aluminum Heat 

Exchangers for Producing Pressurized 
Oxygen, 1996 

G-5 Hydrogen, 2002 

G- 5.3 Commodity Specification for Hydrogen, 1997 

G- 6 Carbon Dioxide, 1997 

G- 6.2 Commodity Specification for Carbon 

Dioxide, 2000 

G- 6.7 Safe Handling of Liquid Carbon Dioxide 

Containers That Have Lost Pressure, 1996 
G-6.9 Dry Ice, 1998 

G-7 Compressed Air for Human Respiration, 

1990 

G-7.1 Commodity Specification for Air, 1997 

G-10.1 Commodity Specification for Nitrogen, 1997 
G-12 Hydrogen Sulfide, 1996 

HB Handbook of Compressed Gases, 1999 

P-1 Safe Handling of Compressed Gases in 

Containers, 2000 

P- 6 Standard Density Data, Atmospheric Gases 

and Hydrogen, 2000 

P-7 Standard for Requalification of Cargo Tank 

Hose Used in the Transfer of Carbon Dioxide 
Refrigerated Liquid, 1996 

P- 8 Safe Practices Guide for Air Separation 

Plants,1989 

P-8.1 Safe Installation and Operation of PSA and 

Membrane Oxygen and Nitrogen Generators, 
1995 

P-8.4 Safe Operation of Reboilers/Condensers in 

Air Separation Units (EIGA DOC 65/99/E), 
2000 

P- 9 The Inert Gases: Argon, Nitrogen, and 

Helium, 2001 

P-11 Metric Practice Guide for the Compressed 

Gas Industry, 1998 

P-12 Safe Handling of Cryogenic Liquids, 1993 

P-13 Safe Handling of Liquid Carbon Monoxide, 

2nd ed., 1989 

P-14 Accident Prevention in Oxygen-Rich and 

Oxygen-Deficient Atmospheres, 1983 
P-16 Recommended Procedures for Nitrogen 

Purging of Tank Cars, 1992 

P-19 Hazard Ratings for Compressed Gases, 1992 

P-20 Standard for the Classification of Toxic Gas 

Mixtures, 1995 

P-23 Standard for Categorizing Gas Mixtures 

Containing Flammable and Nonflammable 
Components, 1995 

P-24 Guide to the Preparation of Material Safety 

Data Sheets, 1995 

P-28 Risk Management Plan Guidance Document 

for Bulk Liquid, 1998 
Hydrogen Systems, 1998 

P-29 Application of OSHA PSM and EPA RMP to 

the Compressed Gas Industry, 2000 
P-31 Tanker Loading System Guide, 2000 

P-32 Safe Storage and Handling of Silane and 

Silane Mixtures, 2000 
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P-34 Safe Handling of Ozone-Containing 

Mixtures Including the Installation and 
Operation of Ozone-Generating Equipment, 
2001 

P-35 Guidelines for UnloadingTankers of 

Cryogenic Oxygen, Nitrogen, and Argon, 2001 
P-36 The Safe Preparation of Gas Mixtures (EIGA 

Doc 39/01/E), 2001 

P- 37 Good Environmental Management Practices 

for the Compressed Gas Industry, 2003 
S-l.l Pressure Relief Device Standards - Part 1 - 

Cylinders for Compressed Gases, 2002 
S-1.2 Pressure Relief Device Standards - Part 2 - 

Cargo and Portable Tanks for Compressed 
Gases, 1995 

S-1.3 Pressure Relief Device Standards — Part 3 — 

Stationary Storage Containers for 
Compressed Gases, 1995 

S-7 Method for Selecting Pressure Relief Devices 

for Compressed Gas Mixtures in Cylinders, 
1996 

SB-1 Hazards of Refilling Compressed Refrigerant 

(Halogenated Hydrocarbon) Gas Cylinders, 
2000 

SB-2 Oxygen-Deficient Atmospheres, 2001 

SB-4 Handling Acetylene Cylinders in Fires, 1997 

SB-5 Hazards of Reusing Disposable Refrigerant 

(Halogenated Hydrocarbon) Gas Cylinders, 
2000 

SB-7 Rupture of Oxygen Cylinders in the Offshore 

Marine Industry, 1998 

SB - 8 Use of Oxy-Fuel Gas Welding and Cutting 

Apparatus, 1998 

SB-15 Avoiding Hazards in Confined Work Spaces 

During Maintenance, Construction and 
Similar Activities, 1998 

SB -21 Recommended Practice for Removing 

Hazardous Material Containers During 
Repair and Maintenance of Cylinder Trucks 
and Trailers, 1999 

SB-27 Safe Use and Handling of Small Cylinders, 
2001 

SB -28 Safety of Instrument Air Systems Backed Up 

by Nitrogen, 2003 

SB-29 Injury and Loss Prevention Resulting from 
Carbon Dioxide Delivery to Small Customer 
Sites, 2001 

SB-30 Hazards Associated with the 

Decontamination, Disposal, or 
Requalification of Cylinders in Diborane and 
Diborane Mixture Service, 2002 
TB-2 Guidelines for Inspection and Repair of 

MC-330 and MC-331 Anhydrous Ammonia 
Cargo Tanks, 4th ed., 1989 
TB-3 Hose Line Flashback Arrestors, 1998 

CONCAWE 

(The Hague,The Netherlands) 

General Interest Reports (Yellow covers) 

2/70 Corrosion: protection and inspection 

3/70 Prevention of water pollution from refineries 

9/70 Pollution of permeable strata by oil 

components 


9/71 Migration of oil in soil 

4/72 Surveying air pollution around 

oil refineries 

5/73 Current methods of routine testing and leak 

detection in operating oil pipelines 
4/74 Inland oil spill clean-up manual 

2/75 Incineration of refinery wastes 

3/75 Sampling of refinery liquid effluents 

8/75 The identification and measurement of 

refinery odours 

2/76 Determination of sound power levels of 

industrial equipment, particularly oil 
industry plant 

6/76 Effluents and emissions from European 

refineries 

2/77 Published regulatory guidelines of 

environmental concern to the oil industry in 
Western Europe 

3/77 Test method for the measurement of noise 

emitted by furnaces for use in the petroleum 
and petrochemical industries 
8/77 Measurement of vibrations complementary 

to sound measurement 

9/77 Spillages from oil industry cross-country 

pipelines in Western Europe. Statistical 
summary of reported incidents 
3/79 Protection of groundwater from oil pollution 

5/79 The environmental impact of refinery 

effluents 

9/80 Disposal techniques for spilt oil 

4/81 The propagation of noise from petroleum and 

petrochemical complexes to neighbouring 
communities 

7/81 Revised inland oil spill clean-up manual 

9/81 A field guide to coastal oil spill control and 

clean-up techniques 

8/82 Ecological monitoring of aqueous effluents 

from petroleum refineries 

10/82 Methodologies for hazard analysis and risk 

assessment in the petroleum refining and 
storage industry 

7/83 Guidelines for recording industrial 

hygiene data 

10/83 A field guide to inland oil spill clean-up 

techniques 

4/85 Investigations into the relationships 

between the chemical composition of 
mineral oils and their ability to cause skin 
cancer in mice 

5/85 Strategies for the assessment of the 

biological impacts of large coastal oil spills - 
European coasts 

7/85 Workplace noise and hearing conservation 

2/86 Volatile organic compound emissions: an 

inventory for Western Europe 
3/86 The health experience of workers in the 

petroleum manufacturing and distribution 
industry 

2/87 Review of European oil industry benzene 

exposure data 

4/87 A survey of exposures to gasoline vapour 

7/87 Health aspects of toluene and 

xylene exposures associated with 
motor gasoline 
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11/87 Emergency planning guidance notes - 

Selecting the incident scenarios for off-site 
emergency planning/Responsibilities of 
petroleum industry and regulatory 
authorities in off-site emergency planning/ 
Information to the public 

2/88 A field guide to the application of dispersants 

to oil spills 

5/88 Emergency planning guidance notes - 

Content of emergency plans/Planning for 
mutual aid 

6/88 Emergency planning guidance notes - 

Refinery emergency planning 
2/89 Emergency planning guidance notes - 

Training, exercises and rehearsal of 
emergency plans/Communications during 
emergencies 

4/89 Managing safety 

7/89 Emergency planning guidance note - 

Marketing installation emergency planning 
5/90 A field guide on reduction and disposal of 

waste from oil refineries and marketing 
installations 

4/92 Performance of oil industry cross-country 

pipelines in Western Europe — statistical 
summary of reported spillages 1991 
7/94 Review of European oil industry benzene 

exposure data (1986-1992) 

1/95 Oil refinery waste disposal methods, 

quantities and costs -1993 survey 
5/96 Collection and disposal of used 

lubricating oil 

2/97 European oil industry guideline for risk- 

based assessment of contaminated sites 
3/97 Task risk assessment 

1/98 Methods of prevention, detection and control 

of spillages in European oil pipelines 
4/98 European downstream oil industry safety 

performance - statistical summary of 
reported incidents -1997 and overview 
1993 to 1997 

7/98 The SEVESOII directive and the oil industry 

8/98 Trends in oil discharged with aqueous 

effluents from oil refineries in Europe —1997 
survey 

1/99 European downstream oil industry safety 

performance - statistical summary of 
reported incidents -1998 
2/99 Environmental exposure to benzene 

1/00 European downstream oil industry safety 

performance - statistical summary of 
reported incidents -1999 

2/00 A review of European gasoline exposure 

data for the period 1993 -1998 
3/01 European downstream oil industry safety 

performance - statistical summary of 
reported incidents - 2000 
4/01 Performance of cross-country oil 

pipelines in Western Europe statistical 
summary of reported spillages - 2000 
1/02 Western European cross-country oil 

pipelines - 30-year performance 
statistics 


7/02 Assessment of personal inhalation exposure 

to bitumen fume guidance for monitoring 
benzene-soluble inhalable particulate matter 
8/02 Method for monitoring exposure to gasoline 

vapour in air - revision 2002 
9/02 A survey of European gasoline exposures for 

the period 1999-2001 

2/03 Catalogue of CONCAWE reports 

Special Interest Reports (White covers) 

84/52 Recommended practice for investigating and 

dealing with 

84/54 Petroleum hydrocarbons: their absorption 

through and effect on skin 
84/55 The study of noise from steel pipes 

84/64 Experimental verification of the ISVR pipe 

noise model 

86/69 Health aspects of worker exposures to oil 

mists 

87/52 Cost- effectiveness of hydrocarbon emission 

controls in refineries from crude oil receipt to 
product dispatch 

87/57 Review of strategies for the evaluation of 

employee exposures to substances hazardous 
to health 

87/59 The prediction of noise radiating from pipe 

systems - an engineering procedure for 
plant design 

88/56 Quantified risk assessment 

89/53 Health risks from working in petroleum 

refining and from gasoline - a 
critique and recommendations in 
response to I ARC monograph 
volume 45 

89/55 Review of EC health and safety directives 

90/53 An assessment of occupational exposure to 

noise in Western European oil refineries 
91/53 The role of epidemiology in the health 

assessment of petroleum industry 
employees 

91/55 The European Community legislative 

92/55 The EC Safety Data Sheet Directive 
93/52 Industrial hygiene seminar 

95/60 Determination of air quality standards bands 

for ozone 

95/62 Air quality standard for particulate matter 

96/54 Development of a health surveillance 

programme for workers in the downstream 
petroleum industry 

96/63 Scientific basis for an air quality standard on 

benzene 

97/51 Scientific basis for an air quality standard 

for carbon monoxide complaints about noise 
00/52 Management of occupational health risks 

during refinery turnarounds 

01/52 A noise exposure threshold value for hearing 

conservation 

01/56 An assessment of occupational exposure to 

noise in the European oil industry 
(1989-1999) 

02/57 Catalogue of special interest reports 
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Department of Employment (HM Factory Inspectorate) 

(London: HM Stationery Office) 

Methods for the Detection of Toxic Substances in 
Air Booklets 

Superseded by HSE MSDS series Methods for the 
Determination of Hazardous Substances 

Other publications Item 

1971 Manhole Access in Enclosed 

Plant 1 

1972 The Factories Act 1961. 

A Short Guide 2 

1973 Lead: Code of Practice for 

Health Precautions 3 

1974 Precautions in the Use of Asbestos 

in the Construction Industry 4 

1974 Safety of Scaffolding 5 


Department of the Environment 

(London: HM Stationery Office) 

Circulars 

1/72 Development Involving the Use or Storage in 
Bulk of Hazardous Materials, 1972 
22/80 Development Control - Policy and Practice, 1980 
9/84 Planning Controls over Hazardous 

Development, 1984 

22/84 Memorandum on Structure and Local Plans, 1984 

15/88 Environmental Assessment, 1988 

Pollution Papers 

1 The Monitoring of the Environment in the 
United Kingdom, 1974 

2 Lead in the Environment and its Significance to 
Man, 1974 

4 Controlling Pollution, 1973 

8 Accidental Oil Pollution of the Sea, 1976 

9 Pollution Control in Great Britain: How it Works, 
1976 

10 Environmental Mercury and Man, 1976 


Other publications Item 

Code of Practice for Reducing the Exposure of 
Employed Persons to Noise, 1972 1 

Towards Cleaner Air, 1973 2 

Information about Industrial Emissions to the 
Atmosphere, 1973 3 

Clean Air Today, 1974 4 

Code of Practice for the Carriage of Radioactive 
Materials by Road, 1975 5 

Railway accident. Report on the accident that 
occurred on February 18,1975, at Moorgate Station 
on the Northern line, London Transport 
Railways, 1976 6 


Department of Trade and Industry (DTI) 

(London) 

05/1998 UK chemicals regulatory atlas: an 

overview of how to guide your 
chemical through to regulatory 
compliance. 


07/2000 BioGuide: regulations, information 

and support for biotechnology in the 
UK (2nd edition). 

03/2003 Biotechnology regulatory atlas: an 

overview of modern biotechnology 
regulation and how to achieve 
compliance. 

Det Norske Veritas 

(Stavanger, Norway) 

Research Division Technical Reports 
79 - 0483 Experimental investigations of partly 

confined gas explosions by 

D. M. Solberg, J. A. Pappas and 

E. Skramstad, 1979 

83 -1317 BLOW-DOWN - a computer program 

for dynamic analysis of hydrocarbon 
processes by J. Nylund, 1983 


Electrical Equipment Certification Service 
(closed 09/2002) 

(Sheffield) 

EECG2 Electrical Equipment Certification 

Guide, 1992 

SEA 3009 Special Protection 

SEA 3012 Intrinsic Safety 

Electrical Power Research Institute 

(Palo Alto, CA) 

EPRINP- 613 On-line power plant alarm and 

disturbance analysis system. Interim 
report by B. Frogner and C.H. Meijer, 
1978 

EPRI NP-1379 On-line power plant alarm and 

disturbance analysis system. Final 
report by C.H. Meijer, 1980 

EPRI NP-1684 Summary and evaluation of scoping 

and feasibility studies for disturbance 
analysis and surveillance systems 
(DASS) byA.B. Long etal. 1980 

Engineering Equipment Users Association 

(London) (predecessor to Engineering Equipment and 
Materials Users Association, q. v.) 

Handbooks 

7 Factory Stairways, Ladders and Handrails, rev. 
ed„ 1973 

8 Steam Trapping and Condensate Handling, rev. 
ed., 1962 

9 Agitator Selection and Design, rev. ed., 1962 

10 Ball and Roller Bearings (Rolling Bearings), rev. 
ed., 1965 

11 Vacuum Producing Equipment, 1961 

12 Thermal Insulation of Pipes and Vessels, 1963 

15 Pneumatic Handling of Powdered Materials 

(including Fluidization), 1963 

18 Supporting Mild Steel and Cast Iron Pipe, 1963 

19 Separation of Dust from Gases, 1968 

23 Pipe joining Methods, 1968 

25 Measurement and Control of Noise, 1968 
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26 Electrically Driven Glandless Pumps, 1968 

27 Dynamic Sealing of Rotating and Reciprocating 
Shafts, 1971 

29 Electrical Variable Speed Drives, 1968 

32 The Selection of Automatic Control Valves, 1969 

34 Installation of Instrumentation and Process 

Control Systems, 1973 

Documents 

4 The Use of Power Driven Portable Tools (with 

particular reference to their use where there may 
be fire or explosion risk), 1958 

9 Minimum Safety Requirements for Instruments 

Using Electricity, 1959 

12 Recommendations to Facilitate Rescue from 

Confined Spaces, 1962 

15 Fixing of Machines in Corrosive Conditions, 

1960 

17 The Built-in Thermal Protection of Induction 

Motors to BS 2960,1964 

23 EEUA Piping Data Sheets, 1965-69 

30 Materials Handling Systems and Equipment, 
1965 

33 Guide to Safe Design and Use of Industrial 
Electronic Equipment, 1969 

37 The Effect on Instrument Performance of 

Variations in 50 Hz Mains Power Supply 

45 Performance Requirements for Electrical Alarm 
Annunciator Systems, 1972 

46 Performance Requirements for Electrical 
Initiating Devices for Electrical Alarm 
Annunciators, 1975 

47 Electrical Apparatus for Use in Explosive Dust 
Hazards, 1973 

Engineering Equipment and Materials Users Association 

(London) 

Publications 

101 Lifting Points - A Design Guide, 1984 

104 Noise: a guide to information required from 
equipment vendors, 1985 

105 Factory Stairways, Ladders and Handrails, 2002 

107 Recommendations for the Protection of Diesel 

Engines for Use in Zone 2 Hazardous Areas, 1992 

132 Three-phase cage induction motors, rev. 1988 

133 Underground armoured cable protected against 
solvent penetration and corrosive attack, rev., 
1988 

138 Design and installation of on-line analyser 
systems, rev., 1988 

141 Guide to the use of noise procedure specification, 
1980 

143 Recommendations for tube end welding: tubular 
heat transfer equipment. Pt 1 - ferrous 
materials, 1977 

144 90/10 copper nickel pipe for offshore 
applications: seamless and welded, 1987 

145 90/10 copper nickel pipe for offshore 
applications: flanges - composite and solid, 1987 

146 90/10 copper nickel pipe for offshore 
applications: fittings, 1987 

147 Recommendations for the Design and 
Construction of Refrigerated Liquefied Gas 
Storage Tanks, 1986 


Reliability Specification - Model clauses for 
inclusion in purchasing specifications for 
equipment items and packages, 1986 
Code of Practice for the Identification and 
Checking of Materials of Construction Pressure 
Systems in Process Plants, 1997 
Code of practice for the identification and 
checking of materials of construction in 
pressurised systems in process plants, 1986 
EEMUA supplement to ASME/ANSI 
B31.3 -1987 edition, including B31.3a - 1988, 
B31.3b - 1988 and B31.3c -1989 for chemical 
plant and petroleum refinery piping, 1989 
Guidance to Owners on Demolition of Vertical 
Cylindrical Steel Storage Tanks and Storage 
Spheres (2nd edition), 2002 
Standard Test Method for Comparative 
Performance of Flammable Gas Detectors 
Against Poisoning, 1988 
Construction specification for fixed offshore 
structures in the North Sea, 1989 
Users’ Guide to the Maintenance and Inspection 
of Above-ground Vertical Cylindrical Steel 
Storage Tanks, 1994 (2nd edition 1997 
incorporating Amendment No. 1 and minor 
textual corrections) 

A guide to the selection and assessment of 
silencers, 1988 

Specification for line pipe for offshore, 1991 
EEMUA specification for quality levels for 
carbon steel valve casing 
A guide to the pressure testing of in-service 
pressurised equipment 
A Design Guide for the Electrical Safety of 
Instruments, Instrument/Control Panels and 
Control Systems, 1994 

Guide for Designers and Users on Frangible Roof 
Joints for Fixed Roof Storage Tanks, 1996 
Guide for the Prevention of Bottom Leakage 
from Vertical, Cylindrical, Steel Storage Tanks, 
1999 

A Practitioner’s Handbook - Electrical 
Installation and Maintenance in Potentially 
Explosive Atmospheres, 1997 
A Guide to Fieldbus Application for the Process 
Industry, 1997 

Guide for the Design, Construction and Use of 
Mounded Horizontal Cylindrical Vessels for 
Pressurised Storage of LPG at Ambient 
Temperatures, 2000 
Alarm Systems - A Guide to Design, 
Management and Procurement, 1999 
EEMUA Recommendations for the Training, 
Development & Competency Assessment of 
Inspection Personnel, 1999 
Compendium of EEMUA Information Sheets on 
Topics Related to Pressure Containing 
Equipment, 1999 

On-Line Leak Sealing of Piping - Guide to 
Safety Considerations 

Process Plant Control Desks Utilising Human- 
Computer Interfaces - A Guide to Design, 
Operational and Human Interface Issues, 

2002 


148 

148 

149 

153 

154 

155 

158 

159 

161 

166 

167 

168 

178 

180 

183 

186 

189 

190 

191 

193 

194 

199 

201 
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Environmental Protection Agency 

(NewYork) 

Item 

EPA Training Manuals 1 

Standard Operating Safety Guides, 1988 2 

See also Reference List 

Factory Mutual Research Corporation 

Reports Item 

16215 Evaluation of protection from explosion 
overpressure in AEC gloveboxes by 
C. Yao, J. de Ris and S.N. Bajolai, 1969 1 

Explosion venting of low strength 
equipment and structure by C. Yao, 1973 2 

Fire Protection Association 

(London) 

Compendium of Fire Safety Data (CFSD) 

Vol.l 

Organization of fire safety 

OR 01 Fire Safety Structure in the United Kingdom, 

1990 

OR 1 Fire Protection Law, 1989 
OR 2 The Fire Service, 1988 
OR 3 The Health and Safety Commission and the 
Health and Safety Executive, 1989 
OR 4 Government Departments, 1978 

OR 5 Fire Research of fire risks 

OR 6 FireTest Facilities, 1991 

OR 7 Security Organizations, 1989 

Management of fire risks 
MR 2 Fire Safety and Security Planning in 
Industry and Commerce, 1989 
MR4 Fire Safety Patrols, 1989 

MR5 Security against Fire-Raisers 

MR6 Fire Precautions during Stoppages of Work, 

1989 

MR7 Procedure in Event of Fire, 1990 

MR8 Fire Damage Control: Emergency Planning, 
1987 

MR9 First Day Induction Training, 1989 

MR10 Fire Safety Training, 

MR11 Occupational Fire Brigades and Fire Teams: 

Organization, Role and Functions 
MR12 Fire Safety Education and Training of People 
at Work, 1987 

MR14 Occupational Fire Brigades: Reports and 
Report Writing, 1989 

Vol.2 

Industrial and process fire safety 
FS 6011 Flammable Liquids and Gases: Explosion 
Hazards, 1989 

FS 6012 Flammable Liquids and Gases: Explosion 
Control, 1989 

FS 6013 Flammable Liquids and Gases: Ventilation, 

1979 

FS 6014 Flammable Liquids and Gases: Electrical 
Equipment, 1990 


FS 6015 Explosible Dusts, Flammable Liquids and 
Gases: Explosion Suppression, 1974 
FS 6016 Hydraulic Oil Systems Fire Safety, 1976 
FS 6017 Piped Services, 1982 
FS 6018 Corrosive Smoke: Planning to Minimize the 
Acid Damage Hazard, 1989 
FS 6021 Explosible Dusts:The Hazards, c.1989 
FS 6022 Explosible Dusts: Control of Explosions, 1989 
FS 6023 Explosible Dusts: Elimination of Ignition 
Sources, 1989 

FS 6024 Explosible Dusts: Extraction, 1989 
FS 6027 Bund Walls for Flammable Liquid Storage 
Tanks, 1990 

FS 6028 Safety Containers for Flammable Liquids, 

1987 

FS 6029 Reduced Sparking Tools (Non-Sparking 
Tools), 1989 

FS 6033 Crushing and Grinding 
FS 6034 Reciprocating Compressors 
FS 6041 Flammable Liquids and Gases: Application 
of the HAZCHEM Code to These and Other 
Substances, 1989 

FS 6042 Oil-Fired Installations, 1989 
(also Fire safety in various processes) 

Occupancy fire safely 

(Fire safety in other industries, occupancies and 
activities) 

Vol.3 

Housekeeping and general fire precautions 
GP1 Guide to Fire Prevention with Outside 

Contractors (withdrawn) 

GP 2 Cutting and Welding, 1990 

GP3 Hot Work Permits, 1989 

GP 4 Blowlamps 

GP 5 Safe Practice in Production 

Areas, 1988 

GP 6 Safe Practice in Storage Areas, 1988 

GP 7 Outdoor Storage, 1986 

GP 8 Fire Dangers of Smoking, 1989 
GP 9 Waste Incinerators, 1987 

GP10 Oil Soaked Floors, 1983 

GP 11 Fire Doors and Shutters: Use Care and 
Maintenance, 1990 

Nature and behaviour of fire 

NB1 The Physics and Chemistry of Fire, 1989 

NB 2 Ignition, Growth and Development of Fire, 

1988 

NB 3 The Physiological Effects of Fire, 1989 
NB 4 The Combustion Process, 1985 

NB 5 Autoignition Temperature (AIT), 1984 

NB 6 Ignition of Flammable Gases and 

Vapours by Sparks from Electrical 
Equipment, 1984 

Vol.4 

Information sheets on hazardous materials 
HI Acetone, 1986 


H174 Dimethyl carbonate, 1992 
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Vol.5 

Fire protection equipment and systems 
PE 1 Automatic fire detection and alarm 
systems, 1989 
PE 2 Fire points, 1988 

PE 3 Fire blankets, 1988 

PE 4 Portable fire extinguishers, 1990 

PE 5 First-aid fire fighting: training, 1989 
PE 6 The choice of fixed fire extinguishing 
systems, 1990 
PE 7 Hosereels, 1988 

PE 8 Hydrant systems, 1989 

PE 9 Automatic sprinklers: an introduction, 1989 
PE 10 Automatic sprinklers: components of a 
system (withdrawn) 

PE 11 Automatic sprinklers: design and 
installation, 1989 

PE 12 Automatic sprinklers: care and 
maintenance, 1989 

PE 13 Automatic sprinklers: safety during 
sprinkler shutdown, 1985 
PE 17 Automatic fire ventilation systems, 1989 


FPDG9 Fire prevention design guide: building 
services, 1990 

FPDG10 Fire prevention design guide: cavities and 
voids in building construction 

FPDG11 Fire prevention design guide: suspended 
ceilings (withdrawn) 

FPDG12 Fire prevention design guide: construction of 
roofs 

FPDG13 Fire prevention design guide: flame 
retardant treatment for wood and its 
derivatives, 1990 

FPDG14 Fire prevention design guide: fire doors and 
shutters 

FPDG15 Fire prevention design guide: upgrading 
factory buildings to control fire spread 

FPDG16 Air conditioning and ventilating systems, 
1989 

Building products 

Fire properties of building products, including 

B15 Fire resistant glazing — wired glass, 1984 

B18 Fire resistant glazing - laminated wired 
glass, 1985 


Security precautions 

SEC 1 Security equipment and systems, 1990 

SEC 2 Site layout, 1990 

SEC 3 Fences, gates and barriers, 1990 

SEC 4 External security lighting, 1985 

SEC 5 External closed circuit television 
systems, 1990 
SEC 6 Doors, 1985 

SEC 7 Windows and rooflights, 1985 

SEC 8 Access control, 1991 

SEC 9 Locks (withdrawn) 

SEC 10 Hardware for fire and escape doors, 1991 
Arson 

AR1 Management guide to fire 

AR 2 Prevention and control of arson in warehouse 

and storage buildings, 1992 
AR 4 Incendiary devices: information and 

guidance, 1990 

AR 5 Investigation of vehicle fires 

me 

Building and fire 
Design guides 

FPDG1 Fire prevention design guide: fire and the law, 
1989 

FPDG2 Fire prevention design guide: site 

requirements - space separation (withdrawn) 
FPDG3 Fire prevention design guide: control of fire 
and smoke within a building, 1990 
FPDG4 Fire prevention design guide: planning 
means of escape 

FPDG5 Fire prevention design guide: fire fighting 
facilities for the fire brigade (withdrawn) 
FPDG6 Fire prevention design guide: equipment for 
detection and warning of fire and fighting 
fire, 1991 

FPDG7 Fire prevention design guide: fire hazard 

FPDG8 Fire prevention design guide: fire insurance 
(withdrawn) 


Fire Safety Sheets 

53 Waste incinerators 

54 1973 Oil-soaked floors 

55 1974 Safety containers for flammable liquids 

56 1974 Fire points 

57 1974 Protection of records, plans and documents 

58 1974 Heat treatment baths 

59 Safe practice in storage areas 

510 1975 Safer practice in production areas 

511 1975 Non-sparking tools 


Other publications Item 

1964 Storage and handling of liquefied 

petroleum gas 1 

1964 Planning fire safety in industry 2 

1965 Checklist: fire safety in industry 3 

1965 What is fire? 4 

1968 Guide to fire prevention in the chemical 

industry 5 

1968 Planning guide to fire safety with 

electricity 6 

1969 Fire prevention manual for the iron and 

steel industry 7 

1969 Planning guide to procedures in case 

of fire 8 

1970 Fire protection for high bay warehouses 9 

1970 Planning guide to fire safety when you 

have outside contractors in 10 

1970 Planning guide to safety during sprinkler 

shutdown 11 

1970 Planning guide to the safe handling of 

flammable gases 12 

1970 Study report on fire risks and fire 

protection in automated high bay 
warehouses 13 

1971 Background notes on fire and its control 14 

1971 The fire hazards and safe disposal of 

waste 15 

1972 Fire precautions during stoppages of 

work at factories 16 

1972 Guide to safety in storage 17 
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1972 Management strategy for fire 18 

1972 Planning guide to security against fire 

raisers 19 

1973 Guide to how factory buildings can be 

adapted to control fire spread 20 

1973 Guide to safety with piped services 21 

1974 Fire and related properties of industrial 

chemicals 22 

1974 Guide and check list to first day induction 

training 23 

1974 Guide to fire doors and shutters 24 

1974 Guide to safety with electrical equipment 25 

1974 Planning program for the prevention and 

control of fire 26 

1975 Anatomy of a disaster 27 


Fire Research Station 

(London: HM Stationery Office) 

Fire Notes 

FI Fire Resistance of Floors and Ceilings by 
G.I. Bird, 1961 

F3 Roofs and Fire 

F4 Tests on Roof Construction Subjected to 

External Fire 

F5 Fire Venting in Single-Storey Buildings by 

G. J. Langdon-Thomas and PL Hinkley, c.1965 

F6 Fire Resistance of Brick and Block Walls by 

H. L. Malhotra 

F8 Fire and the External Wall by G.J. Langdon-Thomas 
and M. Law, 1966 

Fire Research Technical Papers 

5 Heat Radiation from Fires and Building Separation 

by M. Law, 1963 

10 Design of Roof Venting Systems for Single-Storey 

Buildings by P.M. Thomas and P.L. Hinkley, c.1964 

15 The Temperature Attained by Steel in Building 

Fires by E.G. Butcher,T.B. Chitty and L.A. Ashton, 
1966 

21 ExplosibilityTests for Industrial Dusts, 2nd ed., 

by M.M. Raftery, 1975 

Fire Research Notes 

298 The venting of explosions in duct systems. Part II, 
The venting of explosions in pentane-air mixture 
in a duct 6 ft long x 6 in. diameter by D.J. Rasbash 
and Z.W. Rogowksi, 1956 

516 On the size and orientation of buoyant diffusion 
flames and the effect of wind by P.M. Thomas, 

R.W. Pickard and H.G.H.Wraight, 1963 

600 Fire spread in wood cribs. Pt III,The effect of wind 
by P.M. Thomas 

609 Fire protection of liquid fuel storage by P.M. Thomas 
and M. Law, 1965 

658 The protection of equipment with flame arresters: 

2, Effect of contents, and use of improved arresters 
by K.N. Palmer and Z.W. Rogowski, 1967 

759 The relief of gas and vapour explosions in domestic 
structures by D.J. Rasbash, 1969 

760 Use of mechanical ventilation to reduce explosion 
hazards in high flats by K.N. Palmer, 1969 

810 The behaviour of automatic fire detection systems 
by J.F. Fry and C. Eveleigh, 1970 


820 Gas explosions in dwellings, 1969: material 
damage and injuries by E.D. Chambers 

830 Dust explosion venting - a reassessment of the 
data by K.N. Palmer 

847 Gas explosions in multiple compartments by 
D.J.Rasbash, K.N. Palmer, Z.W. Rogowksi and 
S.A. Ames, 1971 

899 Considerations of the fire size to operate and the 
water distribution from automatic sprinklers by 
MJ. O’Doghtery and P. Nash, 1971 

909 Some notes on the mathematical analysis of safety 
byR. Baldin, 1972 

910 Extreme value theory and fire losses by 
G. Ramachandran, 1972 

913 The thermal decomposition behaviour of some 
commercially available flexible polyurethane foams 
by W.D. Woolley, A.I.Wadley and P. Field, 1972 

914 Experiments with sprinklers in high-racked 
storages. 2, Extinction with face-mounted 
sprinklers by P. Nash, N.W Bridge and 

R. A. Young, 1972 

916 Experiments with sprinklers in high-racked 
storages. 1, Extinction with centrally mounted 
sprinklers by P. Nash, N.W Bridge and 
R. A. Young, 1972 

920 Fires in oil refineries and outdoor chemical plant in 
1969byS.E. Chandler, 1972 

921 The projection of flames from burning buildings by 
P.M. Thomas and M. Law, 1972 

925 Compatibility of fluorochemical and protein fire¬ 
fighting foams by T.B. Chitty, D.J. Griffiths and 
J.G. Corrie, 1972 

929 An application of the theory of extreme values for 

estimating the delay in the discovery of a fire by 
G. Ramachandran, 1972 

931 Performance of metal foam as a flame arrester 
when fitted to gas explosion relief vents by 
Z.W Rogowski and S.A. Ames, 1972 

932 Failure rates of automatic fire detection and alarm 
systems by E.D. Chambers, 1972 

937 The safety of hot self-heating materials in cool 
surroundings - a method of analysis by 
P.M. Thomas, 1972 

938 The performance of some portable gas detectors 
with aviation fuel vapours at elevated temperatures. 
Pt 1 — Tests with n-hexane, ‘AVTAG’ and ‘CIVGAS’ 
vapours by P.J. Fardell, 1972 

942 Dust explosions in a large cyclone plant by 
PS. Tonkin and C.F.J. Berlemont, 1972 

943 Extreme value theory and fire resistance by 
G. Ramachandran, 1972 

944 The rapid extinction of fire in high-racked storages 
by P. Nash, N.W Bridge and R.A. Young, 1972 

945 Flashback through crimped ribbon arresters by 
Z.W. Rogowski and S.A. Ames, 1972 

947 The production of free toluene diisocyanate from the 
thermal and thermal-oxidative decomposition of 
flexible polyurethane foams by WD. Woolley and 
A.I.Wadley, 1972 

950 A method of evaluating human life for economic 
purposes by S.K. Melinek, 1972 

951 Studies of the thermal decomposition of flexible 
polyurethane foams by air by W.D. Woolley, 
A.I.Wadley and P. Field, 1972 
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953 The behaviour of people in fires hy P.G. Wood, 1972 

957 The performance of some portable gas detectors 

with aviation fuel vapours at elevated temperatures. 
Pt 2 - Tests with ‘AVCAT’, ‘KERO B’ and ‘AVTUR’ 
vapours by P.J. Fardell, 1973 

959 Preliminary experiments on the use of water 
additives for friction reduction in fire hoses by 
P.E Thorne and K. Jordan, 1973 

961 Dust explosion venting - consideration of further 
data by K.N. Palmer, 1973 

963 Passive and active fire protection - the optimum 
combination by R. Baldwin and P.M. Thomas, 1973 

964 Evaluation of road tanker dip tubes as flame 
barriers by Z.W Rogowski and C.P. Finch, 1973 

966 The production of oxides of carbon from the thermal 
and thermal-oxidative decomposition of flexible 
polyurethane foams by W.D. Woolley and 
A.I.Wadley, 1973 

973 The effect of explosion pressure relief on the 
maximum experimental safe gap of propane-air 
and ethylene—air mixtures by Z.W. Rogowski and 
S.A Ames, 1973 

974 Explosion protection of equipment with flame 
arresters - specification of methods of test and 
construction, 1973 

978 Loss of life expectancy due to fires hy 
S.K. Melinek, 1973 

980 Storage properties of four foam liquids (Final 
report) by S.P. Benson, D.J. Griffiths, D.M.TUcker 
and J.G. Corrie, 1973 

981 The risk of dying by fire by M. A. North, 1973 

982 The economics of accident prevention - explosions 
by S.K.D. Coward, 1973 

984 Gas explosions in buildings. Pt 1, Experimental 
explosion chamber by PS. Tonkin and 

C.F.J. Berlemont, 1974 

985 Gas explosions in buildings. Pt 2,The 
measurement of gas explosion pressure by 
S.A. Ames, 1974 

990 Effect of pressure relief on the maximum 
experimental safe gaps of hydrogen/air mixtures by 
Z.W. Rogowski and C.P. Finch, 1973 

991 Factors affecting fire loss - multiple 
regression model with extreme values by 
G. Ramachandran, 1973 

992 Dust explosion hazards in pneumatic transport by 
K.N. Palmer, 1973 

993 The compatibility of fluorochemical and fluoro- 
protein foams by S.P. Benson, D.J. Griffiths and 
J.G. Corrie, 1973 

1003 Experimental appraisal of an American sprinkler 
system for the protection of goods in high-racked 
storage by N.W Bridge and R. A. Young, 1974 

1007 A laboratory fire test for foam liquids hy 

S.P. Benson, P.R. Bevan and J.G. Corrie, 1974 

1011 Some statistics of fire in road vehicles by 
N.A. North, 1974 

1018 The transmission of explosion of flammable gas/air 
mixtures through a flame gap on a vented vessel by 
Z.W. Rogowski, 1974 

1019 Pressures produced by gas explosion in a vented 
compartment by R.N. Butlin and P.S. Tonkin, 1974 

1022 Flash points of mixtures of flammable and 
nonflammable liquids by P.F. Thorne 


1025 Casualties attributed to toxic gas and 
smoke at fires - a survey of statistics by 
P.C. Bowes, 1975 

1026 A review of information on experiments 
concerning the venting of gas explosions in 
buildings by R.N. Butlin, 1975 

1028 Maximum permissible oxygen concentrations to 
prevent dust explosions in a large scale vertical 
explosion tube by P.S. Tonkin, 1975 

1029 The early stages of fire growth in a compartment: a 
co-operative research programme of the CIB 
(Commission W14). First phase by A.J.M. Heselden 
and S.J. Melinek, 1975 

1037 Performance of a two element crimped ribbon flame 
arrester by Z.W. Rogowski and A. Pitt 

1044 The evaluation of an improved method of gas- 

freeing an aviation fuel storage tank by P.J. Fardell 
and B.W Houghton, 1975 

1048 The inhalation toxicity of polyvinyl chloride 

pyrolysis products by P.C. Bowes, J.A.C. Edginton 
and R.D. Lynch 

1054 Estimation of maximum explosion pressure from 
damage to surrounding buildings. Explosion 
at Mersey House, Bootle, 28 August 1975 by 
R.N. Butlin, 1976 

1063 Test performance of automatic fire alarm equipment 
by G. Cowie, 1977 

1068 The protection of high-racked storages by 

commercial zoned sprinkler systems by S.P. Rogers 
and R.A. Young, 1977 

1073 The toxicity of halon extinguishing agents by 
P.F. Thorne, 1977 

1074 Use of a nitrogen filled high expansion 
foam to protect a 500 tonne fuel tank by 
A.A. Briggs, 1977 

1078 The construction of flammability diagrams from 
flash-point measurements by P.F. Thorne and 
A.A. Briggs, 1978 

(series discontinued in 1978) 

Fire Research Special Report 

2 Heat transfer by radiation by J.H. McGuire 

Fire Research Symposia 

6 Automatic Fire Detection, 1974 


Gas Council 

(London) 

Communications 

GC23 Explosion reliefs for industrial drying 
ovens by P. A. Cuhbage and 
W.A. Simmonds, 1955 

GC43 Explosion reliefs for industrial drying 
ovens by P. A. Cuhbage and 
W.A. Simmonds, 1957 

GC166 Ensuring safety and reliability in 

industrial gas equipment by P.F. Aris, 
R.A. Hancock and D.J. Moppett, 1969 

GC171 Spark ignition of natural gas, theory 
and practice by J.F. Sayers, G.P. Tewari, 
J.R.Wilson and P.F. Jessen, 1970 



INSTITUTIONAL PUBLICATIONS APPENDIX 28/43 


GE GAP Guidelines 

GAP.1.0.1 A Management Program for The 

Protection of Property, Production and 
Profits 

Suggested Written Statement of 
Corporate Management Policy Regarding 
Loss Prevention and Control 
Management of Change 
Replacement in Kind 
Processing Requests for Change 
Request for Change Forms 
Auditing Management of Change 
Measuring Management of Change 
Performance 

Management of Change at Small 
Facilities 

The Year 2000 (Y2k) Problem 
Examples of Date Fields 
Example of Hardware/Software/System 
Inventory Information 
What Specific Fixes Exist? 

Outside Contractors 
Impairments to Fire Protection Systems 
Elements of Rsvp (Restore Valves 
Promptly) Program 
Smoking Regulations 
Maintenance 
Maintenance Inspections 
Maintenance Information Systems 
Seasonal Maintenance 
Maintenance Program Elements 
Maintenance Program Evaluation 
Infrared Inspection 
Life Extension 
Employee Training 
New Construction 
Loss Control During Construction 
Design, Installation and Testing of 
Pressure Equipment and Machinery 
Mechanical Equipment Design and 
Installation 

Insurance Company Recommendations 
Pre-Emergency Planning 
Emergency Assessment and Resources 
National Emergency Radio Frequencies 
Emergency Action Plans 
GAP.1.7.0.1.A Emergency Action Plan Forms 
GAR1.7.0.2 Emergency Response Teams and 
Incident Management Systems 
GAP.1.7.0.2.A Emergency Response Team Forms 
Pre-Emergency Planning Resources 
Rented Boilers and Pressure Vessels 
Hazardous Materials Evaluation 
List of Properties of Materials and Tests 
Cutting, Welding and Other Hot Work 
Loss Prevention and Control for Cutting, 
Welding, Hot Work Operations 
Loss Prevention Audit 
GAP.1.10.0. A Conducting the Loss Prevention Audit 
GAP.1.10.0.B Loss Prevention Audit Report 
GAP.1.11.0 Fire Protection and Security Surveillance 


GAP.1.0.1.A 


GAP.1.0.2 

GAP.1.0.2.1 

GAP.1.0.2.2 

GAP.1.0.2.3 

GAP.1.0.2.4 

GAP.1.0.2.5 

GAP.1.0.2.6 

GAP.1.0.3 

GAP.1.0.3.A 

GAP.1.0.3.B 

GAP.1.0.3.C 

GAP.1.0.4 

GAP.1.1.0 

GAP.1.1.0.A 

GAP.1.2.0 

GAP.1.3.0 

GAP.1.3.0.A 

GAP.1.3.0.B 

GAP.1.3.0.C 

GAP.1.3.0.1 

GAP.1.3.0.2 

GAP.1.3.1 

GAP.1.3.2 

GAP.1.4.0 

GAP.1.5.0 

GAP.1.5.0.A 

GAP.1.5.0.B 

GAP.1.5.2 

GAP.1.6.0 

GAP.1.7.0 

GAP.1.7.0.A 

GAP.1.7.0.B 

GAP.1.7.0. 


GAP.1.7.0.3 

GAP.1.7.1 

GAP.1.8.0 

GAP.1.8.0.A 

GAP.1.9.0 

GAP.1.9.0.A 

GAP.1.10.0 


GAP.1.11.0.A 

GAP.1.11.0.B 

GAP.1.11.0.C 

GAP.1.11.1 

GAP.1.12.0 

GAP.1.12.0.A 

GAP.1.12.0.B 

GAP.1.12.0.C 

GAP.1.12.0.D 

GAP.1.12.0.E 

GAP.1.12.0.F 

GAP.1.13.0 

GAP.1.14.0 

GAP.2.0.1.1 

GAP.2.0.1.1.A 

GAP.2.0.2 

GAP.2.0.3 

GAP.2.0.3.A 

GAP.2.0.5 

GAP.2.0.6 

GAP.2.0.7 

GAP.2.0.8 

GAP.2.0.9 

GAP.2.0.9.1 

GAP.2.0.9.1.A 

GAP.2.1.0.1 

GAP.2.1.1 

GAP.2.1.2 

GAP.2.1.3 

GAP.2.1.4 

GAP.2.1.5 

GAP.2.1.6 

GAP.2.2.1 

GAP.2.2.2 

GAP.2.2.3 

GAP.2.3.2 

GAP.2.3.3 

GAP.2.4.1 

GAP.2.5.1 

GAP.2.5.1.A 

GAP.2.5.2 

GAP.2.5.2.A 

GAP.2.5.3 


Evaluating Guard Service 

Fire Alarm and Intrusion Detection 

Systems 

Is Your Facility Secure? 

Riot and Civil Commotion 
Fire Protection Equipment Inspection 
Suggestions for Conducting the Fire 
Protection Equipment Inspection 
Suggested Checklist for Fire Protection 
Equipment 

Suggested Automotive Fire Apparatus 
Checklist 

Suggested Fire Extinguisher and Inside 
Hose Connection Report Form 
Annual Cold Weather Inspections 
Fire Protection Equipment Performance 
Tests 

Hazard Identification and Evaluation 

Proper Housekeeping 

Design and Protection of Buildings and 

Structures from Windstorms 

Windstorm Data Maps 

Expanded Plastics in Building 

Construction 

Snow Loading of Buildings and 
Structures 

Snow Load Data Maps 
Protection of Buildings from Exterior 
Fire Exposures NFPA 80a - 2001 
Definitions of Types of Construction 
Engineered Lightweight Building 
Material 

Building Materials Standards 
Earthquake Design of Buildings 
Seismic Bracing 
Glossary 

Roof System Guide 

Single Ply Membrane Roof System 

Fastening of Insulation on Metal Decks 

Protected Metal for Building 

Construction (A.P.M., A.A.P.P., R.P.M.) 

Heat and Smoke Venting 

Roof Core Samples 

Installing a New Roof Structure over an 
Existing Roof System 
Fire Walls, Fire Barriers and Fire 
Partitions 

Fire Doors and through-Penetration 
Protection 

Testing of Fire Doors, Dampers and 

Windows 

Plastic Ducts 

Cellular Plastic Insulation for Mechanical 
Piping Systems 
Insulation of Heated Tanks 
Fireproofing for Hydrocarbon Fire 
Exposures 

Illustrations of Fireproofing 

Oil and Chemical Plant Layout and 

Spacing 

Hazard Classification Of Process 
Operations for Spacing Requirements 
Drainage for Outdoor Oil and Chemical 
Plants 
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GAP.2.9.1 

GAP.3.1.1 

GAP.4.0.3 

GAP.4.0.4 

GAP.4.0.5 

GAP.4.1.0 

GAP.4.1.1 

GAP.4.1.3 


GAP.4.2.0 

GAP.4.2.1 

GAP.4.3.1 

GAP.4.3.2 

GAP.4.3.3 

GAP.5.0.1 

GAP.5.0.2 

GAP.5.0.2.A 

GAP.5.0.2.B 

GAP.5.0.2.C 

GAP.5.0.3 

GAP.5.0.4 

GAP.5.0.5 

GAP.5.1.1 

GAP.5.2.1 

GAP.5.2.2 

GAP.5.3.1 

GAP.5.3.2 

GAP.5.3.3 

GAP.5.4.5 

GAP.5.4.5.1 

GAP.5.4.5.1.A 

GAP.5.5.4 

GAP.5.6.1 

GAP.5.6.2 

GAP.5.6.2.1 

GAP5.6.2.2 

GAP.5.6.2.3 

GAP.5.6.3.1 

GAP.5.6.4 

GAP.5.6.7 

GAP.5.7.1.1 

GAP.5.7.1.2 

GAP.5.7.1.3 

GAP.5.7.2.1.1 

GAP.5.7.4 

GAP.5.9.0.1 

GAP.5.9.0.2 


Dams and Other Hydraulic Structures 
Prevention of Explosion and Fire in 
Compressed Air Vessels and Systems 
Procedures for Leak Testing Safety 
Shutoff Valves 

National Fuel Gas Code - NFPA 
Installation of Oil-Burning Equipment - 
NFPA 

Introduction to Boiler Combustion Codes 
and Standards 

Boiler and Combustion Systems Hazards 
Code - NFPA 

Controls and Safety Devices for 
Automatically Fired Boilers Ansi/ 

Asme Csd 

Ovens and Furnaces — NFPA 
Industrial Furnaces Using a Special 
Processing Atmosphere - NFPA 86c 
Space Heaters 
Fired Product Heaters 
Thermal De-Burring Machines 
Electrical Terms 

Electrical Drawings and Diagrams 
Symbols for Electrical Construction 
Drawings 

Symbols for Electrical Diagrams 
Device Function Numbers 
High Energy Electrical Equipment 
Electrical Coordination - System Studies 
Managing Electrical Equipment 
Protection and Maintenance 
Grounding Systems and Ground 
Resistance Testing 
Lightning Protection 
Surge Protection 

Insulation Resistance Testing with a 

Megohmmeter 

Overvoltage Testing 

Power Factor, Dissipation Factor and Tip- 
Up Testing for Insulation Systems 
Transformer and Capacitor Dielectric 
Fluids 

Dielectric Fluids Containing Pcbs 
Pcb Contamination Incidents 
Rigid Nonmetallic Conduit and Electrical 
Nonmetallic Tubing 

Control Power for Electrical Switchgear 
Circuit Breakers 
Oil Circuit Breakers 
Gas-Insulated Circuit Breakers 
Molded-Case Circuit Breakers 
Electrical Instrumentation and Metering 
for Nonsinusoidal Waveforms 
Protective Relays 
Electric Fuses 

Guide to Off-Premises Power Analysis 
Utility System Problems Capacity and 
Distribution 

Electric Power Quality and Reliability 
Replacing Generator Retaining Rings 
Stationary Batteries 
Evaluating the Importance of a 
Transformer 
Transformers - Failures 


GAP.5.9.1 

GAP.5.9.2 

GAP.5.9.3 

GAP.5.9.4 

GAP.5.10 

GAP.5.11.1 

GAP.5.11.2 

GAP.5.12.0.1 

GAP.5.13.1 

GAP.6.0.1.0 

GAP.6.0.3.1 

GAP.6.0.8.1.0 

GAP.6.0.8.1.1 

GAP.6.0.8.3 

GAP.6.0.9.2 

GAP.6.0.9.3 

GAP.6.1.0.1 

GAP.6.1.1.0.1 

GAP.6.1.1.0.2 

GAP.6.1.1.0.2 

GAP.6.1.1.0.2 

GAP.6.1.1.0.2 

GAP.6.1.1.0.3 

GAP.6.1.1.0.4 

GAP.6.1.1.0.5 

GAP.6.1.1.0.6 

GAP.6.1.2.1 

GAP.6.1.2.2 

GAP.6.1.2.3 

GAP.6.2.1.1 

GAP.6.3.1.2 

GAP.6.3.3.1 

GAP.6.5.2 

GAP.7.0.5.0 

GAP.7.0.5.1 

GAP.7.0.5.2 


GAP.7.1.0.1 

GAP.7.1.0.2 

GAP.7.1.0.3 

GAP.7.1.0.4 

GAP.7.1.0.5 

GAP.7.1.0.6 

GAP.7.1.1.0 

GAP.7.1.5 

GAP.7.2.0.5 

GAP.7.2.0.9 


Transformers - Maintenance 
Transformers - Arrangement and Fixed 
Fire Protection 

Transformers - Electrical Devices, 

Instrumentation and Controls 

Transformers - Surroundings 

Electric Motors 

Fluorescent Lighting 

High Intensity Discharge (Hid) Lighting 

Hazardous (Classified) Location 

Electrical Equipment 

Electrical Enclosures 

Spare Rotating Elements 

Gears and Enclosed Gear Sets 

Vibration in Rotating Machinery 

Vibration Monitoring Recommended 

Practice 

Lubricating Oil Analysis 

Cold Casting Repair 

Tensioning of Fasteners 

Large Steam Turbine Loss Exposure 

Steam Turbine Principles 

SteamThrbine Loss Prevention 

Inspection 

Steam Turbine Unit Loss Prevention Data 
SteamThrbine Loss Prevention Data 
In-Service or At-Rest Inspection 
Steam Turbine Loss Prevention Data 
Dismantled Inspection 
Steam Turbine Mechanical Protection 
SteamTurbine Water Induction Protection 
SteamThrbine Lubricating Oil Systems 
SteamThrbine Life Extension 
Combustion Turbine Principles 
Combustion Turbine Loss Prevention 
Guidelines 

Combustion Turbine Loss Prevention 
Inspection 

Emergency Engine Maintenance 
Winterizing Reciprocating Engines and 
Compressors 
Dynamic Compressors 
Vaneaxial Fans and Blowers 
Overpressure and Vacuum Protection 
Pressure and Vacuum Relief Device 
Selection 

Pressure and Vacuum Relief 
Device Inspection,Testing and 
Maintenance 

Boiler and Fired Pressure Vessel Loss 

Prevention Management 

Boiler and Fired Pressure Vessel Loss 

Prevention Inspection 

Boiler Fundamentals 

Boiler Construction, Repair and 

Alteration 

Boiler Maintenance and Operation 
Low Water Protection for Boilers 
Water Tube Boiler Characteristics and 
Terminology 

Organic Heat Transfer Fluids and 
Equipment 

Sight Glasses and Gauge Glasses 
Pressure Vessels with Doors 
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GAP.7.2.1.0.1 

GAP.7.2.2.1 

GAP.7.2.4 

GAP.8.0.1.1 

GAP.8.0.1.1.A 

GAP.8.0.1.1.B 

GAR8.0.1.2 

GAP.8.0.1.3 

GAP.8.1.0 

GAP.8.1.0.A 

GAP.8.1.0.1 

GAP.8.1.1.1 

GAP.8.2.0.1 

GAP.8.2.0.1.A 

GAP.9.2.1.1 

GAP.9.2.1.1.A 

GAP.9.2.1.2 

GAP.9.2.3.1 

GAP.9.2.3.1.A 

GAP.9.2.3.2 

GAP.9.2.3.3 

GAP.9.2.4 

GAP.9.2.5.1 

GAP.9.2.7 

GAP.9.3.1 

GAP.9.3.2.0 

GAP.9.3.2.1 

GAP.9.5.1 

GAP.9.6.1.1 

GAP.9.6.2.1 

GAP.9.6.2.2 

GAP.9.11.1 

GAP.10.0.2.1 

GAP.10.1.1 

GAP.10.1.1.A 

GAP.10.1.2.1 

GAP10.1.2.2 


GAP10.1.2.3 

GAP.10.2.1 

GAP.10.2.1.A 

GAP.10.2.2 

GAP.10.2.3 

GAP.10.2.5 

GAP.10.2.6 

GAP.10.2.10 


Centrifugal Air Conditioning Unit 

Maintenance 

Cast Iron Dryers 

Deaerating Feed Tanks 

Oil and Chemical Properties Loss 

Potential Estimation Guide 

Vapor Cloud Explosion, Sample 

Calculation 

Vessel Explosion, Sample Calculation 
Liquid Holdup Estimation 
Emergency Block Valves 
Flammable and Combustible Liquids 
NFPA 30-2000 
Cross Reference Index 
Barrel Storage of Distilled Spirits 
Relocation of Underground Tanks 
Containing Hazardous Liquids 
Liquified Petroleum Gas Code - NFPA 
58-2001 

Cross-Reference Index 
Truck Loading Rack 
Truck Loading Rack Losses Case 
Histories 

Handling Flammable and Combustible 
Liquids on Docks, Piers and Wharves 
Spray Application of Flammable and 
Combustible Materials NFPA 
Cross-Reference Index 
Traveling Spray Booths 
Dipping and Coating Processes - NFPA 
34 -1995 

Fire Hazards Of Hydraulic Systems 

Solvent Vapor Degreasing 

Deep Fat Fryers 

Belt Conveyors 

Dust Collection Systems 

Electrostatic Precipitators 

Heating in Plastic and Plastic Lined 

Tanks 

Direct Halogenation 

Distillation of Flammable or Combustible 
Liquids 

Solvent Recovery with Activated Carbon 
Fire Protection for Laboratories Using 
Chemicals - NFPA 45 - 2000 
Polystyrene-Foam Packaging Materials 
Fire Protection for Storage NFPA 230 - 
1999 

Cross-Reference Index 
Maximum Reliability for High Racked 
Storage Protection 
Pre-Incident Planning for Fire 
Emergencies Involving Storage in Racks 
at Heights of 25 Ft (97.6 M) or Greater 
Carousel Storage 

Manufacture and Storage of Aerosol 
Products - NFPA 30b -1998 
Cross-Reference Index 
Rack Storage of Rolled Carpets 
Foamed Latex and Flexible, Open-Cell 
Foam Polyurethane Storage 
Hanging Garments 
Plastics Stored in Wire Baskets 
Sugar Storage Facilities 


GAP.10.2.11 

GAP.10.2.12 

GAP.10.3.1 

GAP.11.0.1 

GAP.11.1.1.0 

GAP.11.1.1.0 

GAP.ll.l.l.O.B 

GAP.11.1.3.1 

GAP.11.3.1.1.1 

GAP.11.3.2.2 

GAP.11.3.4.1 

GAP.12.0.1 

GAP.12.0.2 


GAP.12.0.2.A 

GAP.12.0.2.B 

GAP.12.0.3 

GAP.12.0.3.A 

GAP.12.0.3 

GAP.12.1.0.1.1 

GAP.12.1.1.0 

GAP.12.1.1.0.A 

GAP.12.1.1.0.B 


GAP.12.1.1.0.C 

GAP.12.1.1.1 

GAP.12.1.1.3 

GAP.12.1.1.4 

GAP.12.2.1.2 

GAP.12.2.3.1 

GAP.12.2.3.2 

GAP.12.2.3.3 

GAP.12.3.1.1 

GAP.12.3.1.1.A 

GAP.12.3.2.1 

GAP.12.3.3.1 

GAP.12.5.1 

GAP.12.5.1.A 

GAP.12.6.1.1 

GAP.13.0.0 

GAP.13.0.0.A 

GAP.13.0.0.B 

GAP.13.0.0.C 

GAP.13.0.1 

GAP.13.0.1.A 

GAP.13.0.2 

GAP.13.0.3 


Refrigerated Storage and Warehousing 
Nonwoven Material Storage 
Outdoor Storage 

Fire Protection and Security Surveillance 
National Fire Alarm Code® - NFPA 
72 -1999 

Cross-Reference Index 
U1 Fire Alarm Certificate Program 
Testing Auxiliary Fire Signaling Systems 
Heat Detectors for High Temperature 
Environments 

Drop-in-Pressure Waterflow Alarms 
Plug-Type Valve Supervisory Devices 
Fire Protection Hydraulics 
Inspection, Testing and Maintenance of 
Water-Based Fire Protection Systems - 
NFPA 25-1995 
Cross-Reference Index 
Summary of Minimum Inspection, Test 
and Maintenance Frequencies 
Microbiologically Influenced Corrosion 
in Sprinkler Systems 
Microbiologically Influenced Corrosion 
in Fire Sprinkler Systems 
Glossary 

Hydraulically Designed Water-Based 
Systems 

Sprinkler Systems 
Cross-Reference Index 
Example Application of NFPA 13 and 
Industrial Risk Insurers Interpretive 
Guide For Protection of Rack Storage 
Safety Factors 

Sprinkler System Hydraulics 
Shielding Heat-Actuated Devices 
Converting Wet Pipe Systems to Dry Pipe 
Systems for Energy Conservation 
Fixed Protection for Oil and Chemical 
Plants 

‘On-Off’ (Self Restoring) Sprinklers 
‘Automatic’ Sprinkler Corporation of 
America Mercury Check 
‘Automatic’ Sprinkler Corporation of 
America Model C & D Deluge Valves 
Foam-Water Sprinkler and Foam-Water 
Spray Systems — NFPA 16 - 1999 
Cross-Reference Index 
Low-Expansion Foam Systems-NFPA 
11 -1998 

Medium and High Expansion Foam 
Systems - NFPA 11a - 1999 
Testing of Fire Pump-Equipped 
Automotive or Mobile Fire Apparatus 
Sample N-488 

Water Mist Systems - NFPA 750 - 2000 
Selecting Extinguishing Systems 
Extinguishing Agent Selection Features 
Extinguishing System Selection Features 
Extinguishing System Design Features 
Extinguishing System Detection and 
Control 

Detection System Selection Factors 
Special Extinguishing System Review 
Mechanical Emergency Manual Release 
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GAP.13.0.4 

GAP.13.0.5 

GAP.13.0.5.A 

GAP.13.0.5.2 

GAP.13.0.6.1 

GAP.13.1.1.1 

GAP.13.1.3 

GAP.13.2.1.1 

GAP.13.3.1 

GAP.13.3.1.A 

GAP.13.3.2 

GAP.13.3.4.1 

GAP.13.4.1.1 

GAP.13.4.1.1 

GAP.13.5.1 

GAP.13.6.0 

GAP.13.6.1 

GAP.13.6.1.A 

GAP.13.7.1.1 


Special Extinguishing Systems Periodic 
Inspection and Test 

Extinguishing System Acceptance Tests 
Acceptance Test Checklist 
Door Fan Testing for Enclosure Integrity 
Two-Phase Gaseous Agent Calculation 
Dry Chemical Extinguishing Systems - 
NFPA17 -1998 

Dry Chemical Extinguishing Agents 
Corrosive and Contaminating Effects 
Wet Chemical Extinguishing Systems - 
NFPA 17a-1998 
Carbon Dioxide Systems — NFPA 
12 - 2000 

Cross-Reference Index 

Guidance for Carbon DioxideTime Delays 

Upgrading Low Pressure Carbon Dioxide 

Systems 

Halon 1301 Systems - NFPA 12a -1997 
Cross-Reference Index 
Deflagration Suppression Systems 
Clean Agent Halon Replacements 
Clean Agent Systems - NFPA 
2001-2000 
Cross-Reference Index 
Portable Fire Extinguishers - NFPA 
10 -1998 


GAP.13.7.1.1 

GAP.13.9.1 

GAP.14.0.1 

GAP.14.0.1.1 

GAP.14.1.1.0 

GAP.14.1.1.1 

GAP.14.1.2.0 

GAP.14.1.2.1 

GAP.14.1.2.1.2 


GAP.14.2.1.A 

GAP.14.2.1.1 

GAP.14.2.1.3 

GAP.14.2.2.1 

GAP.14.2.2.1.A 

GAP.14.2.2.2 

GAP.14.2.2.4 

GAP.14.2.3.1 


GAP.14.2.4.2 

GAP.14.5.0.1 

GAP.14.5.0.1 

GAP.14.5.0.2 


Chart of Typical Fire Extinguishers 
Spark Extinguishing Systems 
Fire Protection Water Supplies 
Municipal Water Supplies 
Estimating Fire Protection Water 
Demands 

Estimating Fire Protection Water 

Demands for Chemical Plants 

Analyzing Water Supplies 

Conducting Water Supply Tests 

Hydraulic Calculator and Quick 

Reference Flow Tables 

A Hydraulic Calculator 

Water Measurement Using Two Inch 

(50 Mm) Drain Tests 

Testing and Analyzing Looped Water 

Supplies 

Hydraulic Gradient 

Stationary Pumps for Fire Protection - 
NFPA 20-1999 
Cross-Reference Index 
Centrifugal Fire Pump Acceptance Tests 
Testing of Fire Pump Controller Features 
Pilot-Operated Relief Valves for Vertical 
Tiirbine Fire Pumps 
Manufacturer’s Instructions 
Ventilation of Fire Pump Rooms 
Wafer Check Valves 

Cummins Engine Company, Inc., Diesel 
Drivers for Fire Pumps 
Clarke-Detroit Diesel Engine 
Company, Inc. 

Firetrol, Inc. Model Fta 1100a Controller 
Private Fire Mains - NFPA 24 - 1995 
Cross-Reference Index 
Backflow Prevention for Fire Service 
Mains 


GAP.15.1.1 

GAP.15.1.1.A 

GAP.15.2 

GAP.15.2.A 

GAP.15.2.B 

GAP.15.2.1 

GAP.15.2.1.A 

GAP.15.2.2 

GAP.15.2.2.A 

GAP.15.2.3 

GAP.15.2.3.1 

GAP.15.2.3.2 

GAP.15.2.3.3 

GAP.15.2.3.4 

GAP.15.2.3.5 

GAP.15.2.3.6 

GAP.15.3 

GAP.15.3.A 

GAP.15.4 

GAP.16.1 

GAP.16.1.A 

GAP.16.2 

GAP.16.2.A 

GAP.16.3 

GAP.16.3.A 

GAP.16.4 

GAP.16.4.A 

GAP.16.5 

GAP.16.5.2 

GAP.16.5.2.A 

GAP.16.5.4 

GAP.16.6 

GAP.16.6.A 

GAP.17.1.1 

GAP.17.1.1.A 

GAP.17.1.1.B 

GAP.17.1.1.C 

GAP.17.1.1.D 

GAP.17.1.1.E 

GAP.17.2.1 

GAP.17.2.2 

GAP.17.2.3 

GAP.17.2.4 

GAP.17.2.4.A 

GAP.17.3.1 

GAP.17.3.2 

GAP.17.3.2.A 

GAP.17.3.3 

GAP.17.3.4 

GAP.17.4.0 

GAP.17.4.1 

GAP.17.4.2 

GAP.17.5.0 

GAP.17.5.1 

GAP.17.6.1 

GAP.17.6.2 

GAP.17.7 

GAP.17.8.1 


Windstorms 
Windstorm Glossary 
Earthquake 

Earthquake Mm Intensity Scales 
Earthquake Glossary 
Earthquake Hazard Zones — U.S. 

Alaska Hazard Zone Map 
Earthquake Hazard Zones - Canada 
Canada Hazard Zone Map 
Earthquake Hazard Zones - Global 
Earthquake Hazard Zones - Africa 
Earthquake Hazard Zones - Asia 
Earthquake Hazard Zones - Caribbean, 
Central America, and South America 
Earthquake Hazard Zones - Europe 
Earthquake Hazard Zones - Pacific 
Oceans 

Earthquake Hazard Zones - Middle East 

Earth Movement 

Earth Movement Survey Guide 

Flood 

Collapse 

Collapse Hazard Survey Guide 
Dropping 

Dropping Hazard Survey Guide 
Theft 

Theft Hazard Survey Guide 
Transit 

Transit Hazard Survey Guide 
Contamination and Corrosion From Fire 
Leaking Underground Storage Tanks 
Informational Resources 
Asbestos Containing Materials 
Liquid Damage 
Survey Guide 

Semiconductor Manufacturing 
Semiconductor Glossary 
Chemicals Used in Chip Fabrication 
Fire and Smoke Detection for Cleanroom 
Tools 

Semiconductor-Related Web Sites 

The U12360 Test 

High-Hazard Chemical and 

Petrochemical Plants 

Carbon Black Plants 

Pharmaceutical Plants 

Air Separation Plants 

Air Components and Contaminants 

Refineries and Large Gasoline Plants 

Gas Compressor Stations 

Compressor Interlocks 

Crude Oil and Petroleum Products 

Pumping Stations 

Crude Oil and Petroleum Products 

Storage Terminals 

Steel Industry Abstract 

Basic Oxygen Furnaces 

Steel Rolling Mills 

Pulp and Paper Manufacturing 

Chemical Recovery in Wood Pulping 

Protection for High-Rise Buildings 

High-Rise Building Construction 

Telephone Utilities 

Solid Wood Furniture Manufacturing 
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GAP.17.8.2 Pressboard Manufacturing 

GAP17.9 Solid Waste Disposal and Incineration 

GAP.17.10 Electronic Data Processing Facilities 

GAP.17.10.1 Computer Control of Industrial Processes 

GAP17.11.0 Cleanrooms 

GAP.17.11.1 Protection of Cleanrooms — NFPA 

318 - 2000 

Cross-Reference Index 
Electric Power Generation Abstract 
Fire Protection for Electric Generating 
Plants and High Voltage Direct Current 
Converter Stations NFPA 850-19 
GAP.17.12.1.A Cross-Reference Index 

Aluminum Industry Abstract 
Aluminum Rolling Mills 
Department Stores and Shopping Malls 
Health Care Facilities 
Parking Structures NFPA 88a -1995 
Laundries 
Convention Centers 
Cement Production 
Anechoic Chambers & Screen Rooms 
Aircraft Hull Protection 
Newspaper, Magazine and Book 
Publishing 

Printing Press Operations 
Automobile Manufacturing 
Mining Industry Abstract 
GAP17.20.0.A Mining Industry Abstract Glossary 
GAP.17.21.1 Cotton Processing 
GAP.17.21.1.A Glossary 
GAP.17.21.1.1 Lint Control in Cotton Mills 
GAP.17.22.0 Glass Manufacturing 
GAP.17.22.1 Glass Melting Furnaces 
GAP.17.23.0 The Food Processing Industry 
GAP.17.23.1.1 Bakeries 
GAP.17.23.1.6 Fried Food Products 
GAP.17.23.1 Vegetable Oil Manufacturing 
GAP.17.23.2.6 Sugar Processing 
GAP.17.23.2.6.ASugar Glossary 
GAP.17.23.3.1 Breweries 
GAP.17.23.3.2 Distilleries 

GAP.18.1 Ge Global Asset Protection Services 
Representatives on Loss Prevention 
Technical Committees 

GAP.18.2 International System of Units 
GAP.18.3 Definitions of ‘Listed,’ ‘Classified,’ 

‘Recognized,’ ‘Approved,’ ‘Acceptable’ 
GAP.18.3.1 Nationally Recognized Testing 
Laboratories 

GAP.18.3.1. A List of Testing Laboratories 


GAP.17.11.: 

GAP.17.12 

GAP.17.12. 


GAP.17.13.0 

GAP.17.13.1 

GAP.17.14.1 

GAP.17.14.2 

GAP.17.14.3 

GAP.17.14.4 

GAP.17.14.5 

GAP.17.15.0 

GAP.17.16 

GAP.17.17.1 

GAP.17.18 

GAP.17.18.1 

GAP.17.19.0 

GAP.17.20.0 


Health and Safety Commission 

(London) 

HSC Leaflets 

HSC1 Health and Safety at Work etc. 

Act 1974. Some Legal Aspects 
and How They Will Affect You, 1975 
HSC 2 Health and Safety at Work etc. Act 1974. 

The Act Outlined, 1975 

HSC 3 Health and Safety at Work etc. Act 1974. 

Advice to Employers, 1975 

HSC 4 Health and Safety at Work etc. Act 1974. 

Advice to the Self-employed 


HSC 5 Health and Safety at Work etc. Act 1974. 

Advice to Employees, 1975 

HSC 6 Guidance Notes on Employer’s Policy 

Statements for Health and Safety at 
Work, 1975 

HSC 7 Writing a Safety Policy Statement: 

Advice to Employers, rev., 1991 
HSC 8 Regulations, Approved Codes of Practice 

and Guidance Literature, 1975 
HSC 9 Safety Committees: Advice to Employers 

Whose Employees are not Members of 
Recognised Independent Trade Unions 
HSC 10 Time Off for the Training of Safety 

Representatives 

HSC 11 Health and Safety at Work etc. Act 1974: 

Your Obligations to Non-Employees 


Consultative Documents and Drafts Item 

Proposals for new legislation for pressurised 
systems, 1977 1 

Professional training and qualification in 
occupational safety and health, 1983 2 

Other publications 

Safety representatives and safety committees 
(regulations and guidance notes), 1977 3 

Report by the Health and Safety Commission on 
the hazards of conventional sources of energy, 

1978 4 

Policy statement on access to health and safety 
information by members of the public, 1986 5 

Statement of policy for the development of 
occupational health services by J. Cullen, 1986 6 


Health and Safely Executive 

(HM Stationery Office, London; HSE Books, Sudbury, 
Suffolk) 

Accident/Incident Reports 
See Reference list 

Approved Codes of Practice 
See Table 3.5 

Asbestos Item 

Asbestos health hazards and precautions. 

An interim statement by the Advisory 

Committee on Asbestos, 1977 1 

Asbestos. Final report, vol. 1,1979 2 

Asbestos: the control limit for asbestos by 

E.D. Acheson and M.J. Gardner, 1983 3 

Effects on health of exposure to asbestos by 

R. Doll andJ.Peto, 1985 4 

Best Practicable Means Leaflets (not in current list) 

BPM1 Best practicable means: an 

introduction, 1984 

BPM 3 Petroleum works (PVC polymer 

plants), 1979 

BPM 4 Hydrofluoric acid works (HE 

manufacture),1980 

BPM 5 Hydrochloric acid works, 1981 

BPM 10 Amines works, 1981 

BPM 11 Chemical incineration works, 1981 

BPM 16 Lead works, 1986 



APPENDIX 28/48 INSTITUTIONAL PUBLICATIONS 


Construction Sheets 

15 Confined spaces, 1991 

Contract Research Reports 

CRR1/1987 Noise exposure and hearing: a new 
look at experimental data 
CRR 5/1988 Hazard evaluation by thermal 
analysis 

CRR 15/1989 Evaluation of the human contribution 

to pipework and in-line equipment 
failure frequencies 

CRR 17/1988 Workbook on the dispersion of dense 

gases 

CRR 20/1990 Statutory employee involvement in 
health and safety at the workplace: a 
report of the implementation and 
effectiveness of the Safety 
Representatives and Safety 
Committees Regulations 1977 
CRR 26/1991 Guidance on HAZOP procedures for 
computer-controlled plants 
CRR 28/1991 Investigations of machinery noise 
reduction at source 

CRR 31/1992 Shiftwork, health and safety: an over¬ 
view of the scientific literature 
CRR 33/1992 Organization, management and 
human factors in quantified risk 
assessment. Report 1 

CRR 34/1992 Organization, management and 
human factors in quantified risk 
assessment. Report 2 

CRR 37/1992 Evaluation of the safety of composite 

transportable gas containers 
CRR 38/1992 The development of a model to 
incorporate management and 
organisational influences in 
quantified risk assessment 
CRR 39/1992 Review of equations of state of fluids 
valid to high density 

CRR 51/1993 Improving safety on construction 
sites by changing personnel 
behaviour 

CRR 54/1993 Attitudes towards noise as an 
occupational hazard, vols 1-2 
CRR 57/1993 Occupational health provision at work 

CRR 58/1993 A review of the state of knowledge and 

of current practice in selection 
techniques for process operators 
CRR 60/1993 Safety management of process faults: 

human factors in control design 
CRR 61/1993 Stress research and stress 

management: putting theory to work 
CRR 62/1994 Development and testing of a 

procedure to evaluate dustiness of 
powders and dusts in industrial use 

Dangerous Substances Item 

Major hazard aspects of the transport of dangerous 1 
substances, 1991 


EmissionTestMethods (not in current list) 

ETM1 An introduction: sampling and analysis 

of emissions to the air from scheduled 
works, 1981 


ETM 2 The sampling of gaseous emissions: 

sampling and analysis of emissions to the 
air from scheduled works, 1981 


Guidance Notes 
Chemical safety 

CS1 Industrial use of flammable gas 

detectors, 1987 

CS 2 The storage of highly flammable liquids, 

1977 (not in current list) 

CS 3 Storage and use of sodium chlorate, 

1985 

CS 4 The keeping of LPG in cylinders and 

similar containers, 1986 

CS 5 Storage of LPG at fixed installations, 

1981 (not in current list) 

CS 6 The storage and use of LPG on 

construction sites, 1981 

CS 9 Bulk storage and use of liquid carbon 

dioxide: hazards and procedures, 1985 
CS 15 Cleaning and gas freeing of tanks 

containing flammable residues, 1985 
CS 16 Chlorine vaporisers, 1985 

CS 17 Packed dangerous substances, 1986 

(not in current list) 

CS 18 Storage and handling of ammonium 

nitrate, 1986 

CS 21 The storage and handling of organic 

peroxides, 1991 

Environmental hygiene 
EH 1 Cadmium — health and safety 
precautions, 1986 

EH 2 Chromium - health and safety precautions, 
rev., 1991 

EH 3 Prevention of industrial lead poisoning (not 
in current list) 

EH 4 Aniline — health and safety precautions, 1979 
EH 5 Trichloroethylene - health and safety 
precautions, 1985 (not in current list) 

EH 6 Chromic acid concentrations in air, rev., 1990 
EH 8 Arsenic - health and safety precautions, 
rev,1990 

EH 10 Asbestos — exposure limits and 
measurement of airborne dust 
concentrations, rev, 1990 

EH 11 Arsine - health and safety precautions, 
rev., 1990 

EH 12 Stibine - health and safety precautions, 1977 
(not in current list) 

EH 13 Beryllium - health and safety precautions, 
1977 (not in current list) 

EH 14 Level of training for technicians making 
noise surveys, 1977 (not in current list) 

EH 16 Isocyanates - toxic hazards and 
precautions, 1984 

EH 17 Mercury - health and safety precautions, 1977 

EH 18 Toxic substances: a precautionary policy, 

1977 (not in current list) 

EH 19 Antimony - health and safety 
precautions, 1978 

EH 20 Phosphine - health and safety 
precautions, 1979 
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EH 21 Carbon dust - health and safety precautions, 

1979 (not in current list) 

EH 22 Ventilation of the workplace, 1988 
EH 26 Occupational skin diseases: health and 

safety precautions, 1981 (not in current list) 
EH 27 Acrylonitrile: personal protective 
equipment, 1981 

EH 28 Control of lead: air sampling techniques and 
strategies, 1986 

EH 34 Benzidine based dyes - health and safety 
precautions, 1982 

EH 35 Probable asbestos dust concentrations at 
construction processes, rev., 1989 
EH 36 Work with asbestos cement, rev., 1990 
EH 37 Work with asbestos insulating board, rev., 
1989 

EH 38 Ozone: health hazards and precautionary 
measures, 1983 

EH 40 Occupational exposure limits 1994,1994 
EH 41 Respiratory protective equipment for use 
against asbestos, 1985 (not in current list) 
EH 42 Monitoring strategies for toxic substances, 
rev., 1989 

EH 43 Carbon monoxide, 1984 
EH 44 Dust in the workplace: general principles of 

protection, rev., 1991 

EH 46 Man-made mineral fibres, rev., 1990 
EH 47 Provision use and maintenance of hygiene 
facilities for work with asbestos insulation 
and coatings, rev., 1990 

EH 50 Training operatives and supervisors for 

work with asbestos insulation, coatings and 
insulating boards, 1988 

EH 51 Enclosures provided for work asbestos 
insulation, coatings and insulating 
board, 1989 

EH 52 Removal techniques and associated waste 
handling for asbestos insulation, coatings 
and insulating board, 1989 
EH 53 Respiratory protective equipment for use 
against airborne radioactivity, 1990 
EH 54 Assessment of exposure to fume from 

welding and allied processes, 1990 
EH 55 The control of exposure to fume from 

welding, brazing and similar processes, 1990 
EH 56 Biological monitoring for chemical exposure 
in the workplace, 1992 

EH 57 The problems of asbestos removal at high 
temperatures, 1993 

EH 58 The carcinogenicity of mineral oils, 1990 
EH 59 Crystalline silica, 1992 
EH 60 Nickel and its inorganic compounds: health 
and safety precautions, 1991 
EH 62 Metalworking fluids - health 

precautions, 1992 

EH 63 Vinyl chloride: toxic hazards and 
precautions, 1992 

EH 64 Occupational exposure limits: criteria 

document summaries. Synopses of the data 
used in setting occupational exposure 
limits, 1993 

EH 65/ Criteria document series, including 
EH 65/4 1,2-dichloroethane: criteria document for an 
occupational exposure limit, 1993 


EH 65/6 Epichlorohydrin: criteria document for an 
occupational exposure limit, 1993 
EH 66 Grain dust, 1993 

General 

GS 4 Safety in pressure testing, rev., 1992 
GS 5 Entry into confined spaces, 1977 (not in 
current list) 

GS 6 Avoidance of danger from overhead electrical 
lines, rev., 1991 

GS 8 Articles and substances for use at work - 
guidance for designers, manufacturers, 
importers, suppliers, erectors and installers, 1977 
(not in current list) 

GS 9 Road transport in factories and similar 
workplaces, 1992 

GS 15 General access scaffolds, 1982 
GS 16 Gaseous fire extinguishing systems: precautions 
for toxic and asphyxiating hazards, 1984 
GS 21 Assessment of the radio frequency ignition 
hazard to process plants where flammable 
atmospheres may occur, 1983 (not in current list) 
GS 24 Electricity on construction sites, 1983 (not in 
current list) 

GS 26 Access to road tankers, 1983 (not in current list) 
GS 27 Protection against electric shock, 1984 
GS 28 Safe erection of structures, 1984— 

GS 29 Health and safety in demolition work, 1984— 

GS 31 Safe use of ladders, step ladders and trestles, 1984 
GS 33 Avoiding danger from buried electricity cables, 
1985 (not in current list) 

GS 37 Flexible leads, plugs, sockets, etc., 1985 (not in 
current list) 

GS 38 Electrical test equipment for use by 
electricians, 1986 

GS 39 Training of crane drivers and slingers, 1986 
GS 40 Loading and unloading of bulk flammable liquids 
and gases at harbours and inland waterways, 1986 
GS 42 Tower scaffolds, 1987 

GS 47 Safety of electricaldistribution systems on factory 
premises, 1991 

GS 49 Pre-stressed concrete, 1991 


Medical 

MS 4 Organic dust surveys, 1977 

MS 5 Lung function, 1977 (not in current list) 

MS 7 Colour vision, rev., 1987 
MS 8 Isocyanates: medical surveillance, 1983 (not in 
current list) 

MS 12 Mercury: medical surveillance, 1978 

MS 13 Asbestos,rev., 1988 

MS 15 Welding, 1978 

MS 18 Health surveillance by routine procedures (not 

in current list) 

MS 24 Health surveillance of occupational skin 
disease, 1991 

MS 25 Medical aspects of occupational asthma, 1991 


Plant and machinery 

PM 1 Guarding of portable pipe-threading 
machines,1984 

PM 3 Erection and dismantling of tower cranes, 
1976 (not in current list) 
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PM 5 Automatically controlled steam and hot 

water boilers, rev., 1989 

PM 9 Access to tower cranes, 1979 (not in current 
list) 

PM 13 Zinc embrittlement of austenitic stainless 
steel, 1977 

PM 14 Safety in the use of cartridge operated tools, 
1978 (not in current list) 

PM 15 Safety in the use of timber pallets, 1993 
PM 16 Eyebolts, 1978 

PM 19 Use of lasers for display purposes, 1980 
PM 21 Safety in use of woodworking machines, 1981 

PM 22 Training advice on the use of abrasive 
wheels, 1983 

PM 23 Photo-electric safety systems, 1981 
PM 24 Safety at rack and pinion hoists, 1981 
PM 27 Construction hoists, 1981 (not in current list) 
PM 28 Working platforms on forklift trucks, 1981 
PM 29 Electrical hazards from steam/water 
pressure cleaners, rev., 1988 
PM 30 Suspended access equipment, 1983 
PM 32 Safe use of portable electrical apparatus, 1990 
PM 38 Selection and use of electric handlamps, 1992 
PM 41 Application of photo-electric safety systems 
to machinery, 1984 

PM 53 Emergency private generation: electrical 
safety, 1985 

PM 54 Lifting gear standards, 1985 

PM 56 Noise from pneumatic systems, 1985 
PM 58 Diesel engined lift trucks in hazardous 
areas, 1986 

PM 60 Steam boiler blowdown systems, 1987 
PM 64 Electrical safety in arc welding, 1986 
PM 65 Worker protection at crocodile (alligator) 
shears, 1986 

PM 73 Safety at autoclaves, 1990 
PM 75 Glass reinforced plastic vessels and tanks: 
advice to users, 1991 

Guidance Booklets 

HS(G) 3 Highly flammable materials on 
construction sites, 1978 

HS(G) 5 Hot work: welding and cutting on plant 
containing flammable materials, 1979 
HS(G) 6 Safety in working with lift trucks, 1979 
HS(G) 7 Container terminals: safe working 
practice, 1980 

HS(G) 11 Flame arresters and explosion reliefs, 1980 

HS(G) 12 Offshore construction: health, safety and 
welfare, 1980 

HS(G) 13 Electrical testing: safety in electrical 
testing, 1980 (not in current list) 

HS(G) 15 Storage of liquefied petroleum gas at 
factories, 1981 (not in current list) 

HS(G) 16 Evaporating and other ovens, 1981 
HS(G) 17 Safety in the use of abrasive wheels, 1984 
HS(G) 19 Safety in working with power operated 

work platforms, 1982 

HS(G) 20 Guidelines for occupational health 
services, 1982 

HS(G) 22 Electrical apparatus for use in potentially 

explosive atmospheres, 1984 
HS(G) 25 Control of Industrial Major Accident 

Hazards Regulations 1984 (CIMAH): 
furtherguidance on emergency plans, 1985 


HS(G) 26 Transport of dangerous substances in 

tank containers, 1986 

HS(G) 27 Substances for use to work: provision of 
information, 1985 

HS(G) 28 Safety advice for bulk chlorine 
installations, 1986 

HS(G) 30 Storage of anhydrous ammonia under 
pressure in the United Kingdom: 
spherical and cylindrical vessels 
HS(G) 34 Storage of LPG at fixed installations,1987 
HS(G) 37 Introduction to local exhaust 
ventilation, 1987 

HS(G) 38 Lighting at work, 1987 
HS(G) 39 Compressed air safety, 1990 
HS(G) 40 Chlorine from drums and cylinders, 1987 
HS(G) 43 Industrial robot safety, 1988 
HS(G) 48 Human factors in industrial safety, 1989 
HS(G) 51 The storage of flammable liquids in 
containers, 1990 

HS(G) 52 The storage of flammable liquids in fixed 
tanks (exceeding 10,000 m 3 total 
capacity), 1991 

HS(G) 53 Respiratory protective equipment: a 
practical guide for users, 1990 
HS(G) 54 The maintenance, examination and 

testing of local exhaust ventilation, 1990 
HS(G) 56 Noise at work. Noise assessment, 
information and control, 1990 
HS(G) 61 Surveillance of people exposed to health 
risk at work, 1990 

HS(G) 64 Assessment of fire hazards from solid 
materials and the precautions required 
for their safe storage and use, 1991 
HS(G) 65 Successful health and safety 
management, 1991 

HS(G) 71 Storage of packed dangerous 
substances, 1992 

HS(G) 78 Container packing, 1992 

HS(G) 96 The costs of accidents at work, 1993 

Regulations Booklets 

HS(R) 1 Packaging and Labelling of Dangerous 
Substances - Regulations and Guidance 
Notes, 1978 

HS(R) 3 Guide to tanker marking regulations, 
1979 

HS(R) 6 Guide to the HSW Act, 1983 
HS(R) 7 Guide to the Safety Signs Regulations 
1980,1981 

HS(R) 8 Guide to the Diving Operations at Work 
Regulations 1981,1981 
HS(R) 11 First-aid at work, 1981 
HS(R) 13 Guide to the Dangerous Substances 

(Conveyance by Road in Road Tankers) 
Regulations 1981,1981 
HS(R) 14 Guide to the Notification of New 

Substances Regulations 1982,1982 
HS(R) 15 Administrative guidance on the 
implementation of the European 
Community ‘Explosive Atmospheres’ 
Directive (76/117/EEC and 79/196/ 

EEC), 1983 

HS(R) 16 Guide to the Notification of Installations 
Handling Hazardous Substances 
Regulations 1982,1983 




INSTITUTIONAL PUBLICATIONS APPENDIX 28/51 


HS(R) 17 Guide to the Classification and Labelling 
of Explosives Regulations 1983,1983 
HS(R) 18 Administrative guidance on the 

application of the European Community 
‘LowVoltage’ Directive (73/23/EEC) to 
electrical equipment for use at work in the 
United Kingdom, 1984 

HS(R) 19 Guide to the Asbestos (Licensing) 
Regulations 1983,1984 
HS(R) 21 Guide to the Control of Industrial 

Major Accident Hazards Regulations 
1984,1985 

HS(R) 22 Guide to the Classification, Packaging 
and Labelling of Dangerous Substances 
Regulations 1984,1985 

HS(R) 23 Guide to the Reporting of Injuries, 

Diseases and Dangerous Occurrences 
Regulations 1985,1986 

HS(R) 24 Guide to the Road Transport (Carriage of 
Dangerous Substances in Packages, etc.) 
Regulations 1986,1987 
HS(R) 25 Memorandum of guidance on the 

Electricity at Work Regulations 1989,1989 
HS(R) 27 A Guide to Dangerous Substances in 

Harbour Regulations 1987,1988 
HS(R) 29 Notification and marking of sites. The 

Dangerous Substances (Notification and 
Marking of Sites) Regulations, 1990 
HS(R) 30 A Guide to the Pressure Systems and 
Transportable Gas Containers 
Regulations 1989,1990 


Hazard Analysis Reports 

HA 1 Canvey: A Second Report - A Summary of a 
Review of Potential Hazards from Operations 
in the Canvey Island/Thurrock Area Three 
Years after Publication of the Canvey 
Report, 1981 

HA 2 Canvey: A Second Report - A Review of 
Potential Hazards from Operations in the 
Canvey Island/Thurrock Area Three Years 
after Publication of the Canvey Report, 1981 
HA 3 Sizewell B: A Review by HM Nuclear 
Installations Inspectorate of the 
Preconstruction Safety Report, 1982 
HA 4 PWR: A Report by the Health and Safety 
Executive to the Secretary of State for 
Energy on a Review of the Generic Safety 
Issues of Pressurised Water Reactors, 1979 
HA 5 Nuclear Safety: Safety Assessment 

Principles for Nuclear Power Reactors, 1979 

Health and Safely at Work Booklets (not in current list) 

1 Lifting and Carrying 

3 Safety Devices for Hand and Foot Operated 
Presses, 1971 

4 Safety in the Use of Abrasive Wheels 

6A Safety in Construction Work: General Site Safety 

Practice 

6B Safety in Construction Work: Roofing 
6C Safety in Construction Work: Excavations 
6D Safety in Construction Work: Scaffolding 
6E Safety in Construction Work: Demolition 
6F Safety in Construction Work: System Building 


10 Fire Fighting in Factories, 1970 

13 Ionizing Radiations: Precautions for Industrial 
Users, 1970 

14 Safety in the Use of Mechanical Power Presses 

18 Industrial Dermatitis: Precautionary Measures 

20 Drilling Machines: Guarding of Spindles and 

Attachments 

22 Dust Explosions in Factories, 1970 

24 Electrical Limit Switches and Their 
Applications, 1970 

25 Noise and the Worker, 1971 

27 Precautions in the Use of Nitrate Salt Baths, 1971 

28 Plant and Machinery Maintenance, 1970 

29 Carbon Monoxide Poisoning: Causes and 
Prevention 

3 0 Storage of Liquefied Petroleum Gas at 
Factories, 1973 

31 Safety in Electrical Testing 

32 Repair of Drums and Small Tanks 

33 Safety in the Use of Guillotines and Shears 

34 Guide to the Use of Flame Arresters and 
Explosion Reliefs, 1965 

35 Basic Rules for Safety and Health at Work, 1975 

36 First Aid in Factories 

37 Liquid Chlorine 

38 Electric Arc Welding, 1970 

40 Means of Escape in Case of Fire in Offices, Shops 
and Railway Premises 

41 Safety in the Use of Woodworking Machines, 1970 

42 Guarding of Cutters of Horizontal Milling 
Machines 

44 Asbestos: Health Precautions in Industry, 1970 

46 Evaporating and Other Ovens, rev., 1974 

47 Safety in the Stacking of Materials, 1971 

HSE Leaflets 

HSE1 After Flixborough?, 1976 
HSE 2 Flixborough, the lessons to be learned, 1976 

HSE 5 Introduction to the Employment Medical 
Advisory Service, 1985; rev., 1992 
HSE 8 Fires and explosion due to the misuse of 
oxygen,1984 

HSE 9 Area office information services, 1986 
HSE 11 Reporting of an injury or a dangerous 
occurrence, rev., 1986 

HSE 16 Law on health and safety at work: essential facts 
for small business and the self-employed, 1986 
HSE 17 Reporting a case of disease: a brief guide to the 
Reporting of Injuries, Diseases and Dangerous 
Occurrences Regulations 1985,1986 
HSE 21 Report that accident, 1988 
HSE 22 The specialists, 1988; rev., 1992 
HSEL1 HSELINE: the new computerised source of health 
and safety at work references, 1983; rev., 1990 

Industrial Advisory Committee Leaflets 
IAC/L1 Guidance on the implementation of safety 
policies, 1982 

IND(G) Leaflets 

IND(G) 1 (L) Obligations on importers of 

machinery, plant and substances in 
Great Britain, 1982 

IND(G) 17 (L) Asbestos and you, 1984 
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IND(G) 22 (L) 
IND(G) 30 (L) 
IND(G)35(L) 
IND(G) 39 (L) 
IND(G) 64 (L) 
IND(G) 65 (L) 
IND(G) 67 (L) 


IND(G) 78 (L) 
IND(G) 96 (L) 

IND(G) 98 (L) 
IND(G) 115 (L) 
IND(G) 117 (L) 

IND(G) 118 (L) 
IND(G) 119 (L) 


Danger! transport at work, 1985 
Buried cables - beware!, 1985 
Hot work on tanks and drums, 1985 
Permits to work and you, 1986 
Hazard and risk explained, 1989 
Introducing COSHH, 1989 
Introducing assessment, 1989 
(The last three constitute the COSHH 
leaflet ‘package’) 

Transport of LPG cylinders by 
road, 1990 

Are you involved in the transport of 
dangerous substances by road?, 1990 
Permit-to-work systems, 1992 
New explosives controls, 1991 
Policy statement on publication of 
reports of accidents, 1991 
Policy statement on standards, 1991 
Safer representatives and safety 
committees on offshore 
installations, 1991 


L Series 
See Table 3.5 

This series is gradually superseding the HS(R) and COP 
series 

Major Hazards Item 

Advisory Committee on Major Hazards. First 
Report, 1976 1 

Assessment of the hazard from radio frequency 
ignition at the Shell and Esso sites at Braefoot 
Bay and Mossmorran, Fife, 1978 2 

Report of the Steering Committee on radio 
ignition hazards at St Fergus, Scotland, 1979 3 

Safety evaluation of the proposed St Fergus to 
Mossmorran natural gas liquids and St Fergus to 
Boddam gas pipelines, 1978 4 

A reappraisal of the HSE safety evaluation of the 
proposed St Fergus to Mossmorran NGL 
pipeline, 1980 5 

Advisory Committee on Major Hazards. Second 
Report, 1979 6 

Advisory Committee on Major Hazards. Third 
Report, 1984 7 

Names and addresses of sites sent to the Health 
and Safety Executive under Regulation 7 of the 
Control of Industrial Major Accident Hazards 
Regulations 1984 (CIMAH) or deemed to have 
been sent under Regulation 7(3) by means of a 
notification already made in accordance with 
Regulations 3(1) of the Notification of 
Installations Handling Hazardous Substances 
Regulations 1982 (NIHHS), 1986 8 

Quantified risk assessment: its input to 
decision-making, 1989 9 

Risk criteria for land use planning in the vicinity 
of major hazards, 1989 10 


Medical Series Leaflets (not in current list) 

MS(A) 1 Lead and you, 1986 
MS(A) 7 Cadmium and you, 1986 
MS(A) 12 Hydrogen fluoride and you, 1990 
MS(A) 13 Benzene and you, 1992 
MS(A) 15 Silica dust and you, 1992 
MS(A) 16 Chromium and you, 1991 
MS(B) 1 Ulceration of the skin and inside the nose 
caused by chrome, 1974 
MS(B) 5 Skin cancer caused by oil, 1983 
MS(B) 6 Dermatitis and work (occupational 

dermatitis), 1983 

Methods for the Determination of Hazardous Substances 
MDHS 70 General methods for sampling airborne 
gases and vapours, 1990 

MDHS 71 Analytical quality in workplace air 

monitoring, 1991 

MDHS 72 Volatile organic compounds in air, 1992 


Nuclear Installations Item 

Accident at Three Mile Island, 1979 1 

Nuclear safety, 1979 2 

PWR, 1979 3 

Windscale. The management of safety, 1981 4 

Emergency plans for civil nuclear 

installations, 1982 5 

Work of HM Nuclear Installations 

Inspectorate, 1982 6 

HM Nuclear Installations Inspectorate: a 

bibliography of published work 1962—1982,1983 7 

Safety assessment principles for nuclear chemical 

plant, 1983 8 

Safety audit of BNFLs Sellafield, vols 1—2,1986 9 

Comments received on the tolerability of risk from 

nuclear power stations, 1988 10 

The tolerability of risks from nuclear power 

stations, 1988 (not in current list) 11 

An examination of the CEGB’s R6 procedure for 

the assessment of the integrity of structures 

containing defects, 1989 12 

ACSNI Study Group on Human Factors. First 

report on training and related matters, 1990 13 

ACSNI Study Group on Human Factors. Second 

report: Human Reliability Assessment - a critical 

overview, 1991 14 

A review of American nuclear emergency 

planning, 1991 15 

Safety assessment principles for nuclear plants, 1992 16 

The tolerability of risks from nuclear power 

stations, 1992 17 

ACSNI Study Group on Human Factors. Third 

report: Organizing for safety, 1993 18 

SizewellB Item 

Sizewell B, 1982 19 

Appraisal of the current situation on large LOCA 
calculations in the context of Sizewell B, 1984 20 


Medical Advice (not in current list) 

MA 3 Control of lead at work: medical surveillance 
information and advice from the Health and 
Safety Executive’s Medical Division 
MA 4 Asbestos (Licensing) Regulations 1983: medical 
surveillance 


Sizewell B public inquiry 

NII/P/1 Sizewell B public inquiry: proof of 

evidence on the work and responsibilities 
of HM Nuclear Installations Inspectorate, 
1983 (plus additional material denoted 
ADD1, ADD2, etc.) 
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NII/P/2 Sizewell B public inquiry: proof of 

evidence on HM Nuclear Installations 
Inspectorate’s view of the Central 
Electricity Generating Board’s safety 
case, 1983 

(plus additional material denoted ADD1, 
ADD2, etc.) 

Nil/S/2 Sizewell B inquiry: the Inspectorate’s 

approach to the assessment of code 
validation submissions, 1983 
NII/S/4 Sizewell B inquiry: schedule of Nil 
reservations and issues all of which 
require to be resolved to the Inspectorate’s 
satisfaction prior to licensing, 1983 
Nil/S/5 Sizewell B power station public inquiry: 

safety case computer codes - 
categorisation and validation 
assessment, 1983 

Nil/S/83 Sizewell B power station inquiry: 

relationship between the Nil’s 
assessment principles and levels of risk, 
1984 

Nil 01 Sizewell B: a review by HM Nuclear 
Installation Inspectorate 
SUPP1 Degraded core analysis, 1982 
SUPP 2 Safety analysis, 1982 
SUPP 3 External hazards - aircraft 
crash, 1983 

SUPP 6 Reactor protection system, 1983 
SUPP 7 External hazards - earthquake, 
1983 

SUPP 8 External hazards - fire, 1983 
SUPP 9 Code validation for LOCA, 1983 
SUPP 10 Reactor pressure vessel, 1983 
SUPP 11 Pressure circuit components, 
1983 

SUPP 12 ALARP strategy for dose 
reduction, 1983 
SUPP 13 Human factors, 1983 
SUPP 14 Quality assurance, 1983 
HA 3 Sizewell B: a review by HM Nuclear 
Installations Inspectorate of the 
preconstruction safety report, 1982 

Occasional Papers 

OP1 Problem drinker at work, 1981 
OP 2 Microprocessors in industry: safety 

implications of the use of programmable 
electronic systems in factories, 1981 
OP 3 Managing safety, 1981 

OP 5 Electrostatic ignition: hazards of 

insulating materials, 1982 
OP 9 Monitoring safety 

OP 10 Safety of electrical distribution systems 

in factories, 1985 

OP 11 Measuring the effectiveness of HSE’s 
field activities, 1985 

Offshore Technology Reports 

OTH 91337 Pipeline and riser loss of containment 
study, 1990 (PARLOC 90) 

OTH 92 389 Human factors, shift work and 

alertness in the offshore industry, 
1993 


OTI92 585 

OTI92 586 
OTI 92 587 
OTI 92 588 
OTI 92 589 

OTI 92 590 

OTI 92 591 

OTI 92 592 
OTI 92 593 

OTI 92 594 

OTI 92 595 
OTI 92 596 
OTI 92 597 

OTI 92 598 

OTI 92 599 
OTI 92 601 

OTI 92 602 

OTI 92 603 
OTI 92 604 

OTI 92 605 

OTI 92 606 
OTI 92 607 
OTI 92 608 

OTI 92 610 


Generic foundation data to he used in 
the assessment of blast and fire 
scenarios and typical structural details 
for primary, secondary and supporting 
structures and components, 1992 
Representative range of blast and fire 
scenarios, 1992 

The prediction of single and two-phase 
release rates, 1992 
Legislation, codes of practice and 
certification requirements, 1992 
Experimental facilities suitable for use 
in studies of fire and explosion hazards 
in offshore structures, 1992 
The use of alternative materials in the 
design and construction of blast and 
fire resistant structures, 1992 
Gas/vapour build up on offshore 
structures, 1992 

Confined vented explosions, 1992 
Explosions in highly congested 
volumes, 1992 

The prediction of the pressure loading 
on structures resulting from an 
explosion, 1992 

Possible ways of mitigating explosions 
on offshore structures, 1992 
Oil and gas fires: characteristics and 
impact, 1992 

Behaviour of oil and gas fires in the 
presence of confinement and 
obstacles, 1992 

Current fire research: experimental, 
theoretical and productive modelling 
resources, 1993 

The effects of simplifications of the 
explosion pressure - time history, 1988 
Computerised analysis tools for 
assessing the response of structures 
subjected to blast loading, 1992 
The effects of high strain rate on 
material properties, 1992 
Analysis of projectiles, 1992 
Experimental data relating to the 
performance of steel components at 
elevated temperatures, 1992 
Methodologies and available tools for 
the design/analysis of steel components 
at elevated temperatures, 1992 
Passive fire protection: performance 
requirements and test methods, 1992 
Availability and properties of passive 
and active fire protection systems, 1992 
Existing fire design criteria for 
secondary, support and system 
steelwork, 1992 

Thermal response of vessels and 
pipework exposed to fire, 1992 


Oil Industry Item 

A guide to the principles and operation of 
permit-to-work procedures as applied to the 
petroleum industry, 1986 1 
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Guidelines for occupational health services in 
the oil industry, 1987 2 

Guidance on health and safety monitoring in the 
petroleum industry, 1992 3 

Guidance on multiskilling in the petroleum 
industry, 1992 4 

Guidance on permit-to-work systems in the 
petroleum industry, 1991 5 

Offshore installations guidance notes: 
consolidated edition, 4th ed., 1990- 6 


Promotional Leaflets 

PML 6 New regulations on packaging and labels for 
dangerous substances: Classification, 
Packaging and Labelling of Dangerous 
Substances Regulations 1984,1985 
PML 7 Deadly maintenance: a study of fatal 
accidents at work, 1985 
PML 10 Monitoring safety, 1986 


Research Papers 

RP1 Examination of entrained air-flow rate data 
for large-scale water spray installations by 
J. McQuaid, 1978 

RP 7 Decay of spherical detonations and shocks by 
H. Phillips, 1980 

RP 8 Dispersion of heavier-than-air gases in the 
atmosphere: review of research, and progress 
report on HSE activities by J. McQuaid, 1978 

RP 11 Comparative risks of electricity production 
systems: a critical survey of the literature by 
A.V Cohen and D.K. Pritchard, 1980 

RP 18 Reproducibility of asbestos counts by 
T.L. Ogden, 1982 

RP 24 Dispersion of heavier-than-air gases in the 
atmosphere: a review of the organization and 
management of the HSE field trials 1982/84 
by D.G. Wilde, 1984 

RP 32 First aid retention of knowledge survey by 
M.C. Cullen, 1992 


Research Reviews Item 

Shift work and health by J.M. Harrington, 1978 1 

Manual handing and lifting by J.D.G. Troup and 
F.C. Edwards, 1985 2 

Alternatives to asbestos products: a review, 1986 3 


Safety Health and Welfare Leaflets 
SHW 29 Phenol poisoning (cautionary notice), 
1984 

SHW 367 Dermatitis (cautionary notice), 1975 

SHW 385 Cyanide poisoning (cautionary 

notice), 1983 

SHW 395 Gassing and chemical burns 
(cautionarynotice), 1984 
SHW 397 Effects of mineral oil on the skin 
(cautionary notice), 1982 
SHW 830 Dust explosions in factories, 1975 
SHW 849 Nitrate salt baths (cautionary notice), 
1975 

SHW 932 Dangers from carbon monoxide 
(cautionary notice), 1981 


SHW 2125 Danger and explosion in oil storage 
tanks fitted with immersed heaters 
(cautionary notice), 1981 

Sector Guidance 

See Asbestos, Dangerous Substances, Major Hazards, 

Nuclear Installations, Oil Industry 

Specialist Inspectors Reports 

SIR 5 Avoiding water hammer in steam systems 

by S. Mortimer and D.C. Edwards, 1988 

SIR 8 The National Exposure Data Base - a 

computer record system for occupational 
hygiene data by P.L. Beaumont, D.K. 
Burns and T.E. Taylor 

SIR 9 The fire and explosion hazards of 

hydraulic accumulators by D.B. Pratt 

SIR 16 Low volume, high velocity extraction 
systems by B. Fletcher 

SIR 19 Fire and explosion hazards associated 
with the storage and handling of 
hydrogen peroxide by R. Merrifield 

SIR 21 Assessment of the toxicity of major 

hazard substances by R.M. Turner and 
S. Fairhurst 


Technical Data Notes (not in current list) 

I Dust control - the low volume, high velocity 
system, 2nd rev., 1976 

2/73 Threshold limit values for 1975,1976 

3 Occupational cancer of the renal tract, rev., 1973 

4 Stibine - health and safety precautions, 1976 

5 Antimony - health and safety precautions, 1975 

6 Arsine - health and safety precautions, 1975 

7 Phosphine - health and safety precautions, 1975 

8 Chromium - health and safety precautions, 1973 

9 Arsenic - health and safety precautions 

10 Aniline - health and safety precautions 

II Cadmium - health and safety precautions, 
rev., 1975 

12 Notes for the guidance of designers on the 
reduction of machinery noise, 1975 

13 Standards for asbestos dust concentration for 
use with Asbestos Regulations 1969, rev., 1974 

14 Health — dust in industry 

15 Methyl bromide - health and safety precautions 

16 Prevention of industrial lead poisoning 

17 Trichloroethylene, rev., 1973 

18 The safe cleaning repair and demolition of 
large tanks for storing flammable liquids, 
rev., 1975 

19 Ventilation of buildings: fresh air requirements, 
rev., 1975 

20 Anthrax 

21 Mercury, rev., 1975 

24 Asbestos Regulations 1969: respiratory 
protective equipment, 2nd rev., 1975 

25 Safe operation of automatically controlled steam 
and hot water boilers, 1975 

26 Erection and dismantling of tower cranes, 1973 

27 Access to tower cranes, 1974 

29 Fire risk in the storage and industrial use of 
cellular plastics, rev., 1975 
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32 Guarding of portable pipe threading machines 

33 Power press mechanisms: overrun and fail-back 
devices 

35 Control of asbestos dust, 1975 

36 Safety in the use of cartridge operated fixing 
tools 

38 Tripping device for radial and heavy vertical 
drilling machines 

40 Standards for chromic acid concentration in air 
for use with the chromium plating regulations 

41 Isocyanates - toxic hazard and precautions, 1975 

42 Probable asbestos dust concentration at 
construction processes 

43 Technical level training: code of practice for 
reducing the exposure of employed persons to 
noise, 1976 

44 Road transport in factories, 1973 

45 Industrial use of flammable gas detectors, 1973 

46 Safety at quick opening and other doors of 
autoclaves, 1974 

47 Entry into confined spaces: hazards and 
precautions, 1975 

48 Permissible opening in fixed guards 

53/1 Zinc embrittlement of austenitic stainless steel, 
1976 

53/2 Nitrate stress corrosion of mild steel, 1976 
53/3 Creep of metals at elevated temperatures, 1977 

Technical Information Leaflets 

Engineering and metallurgy 
EM 2 Metallurgical examination of broken and 
defective equipment, 1980 
EM 3 Mechanical testing facilities at Sheffield, 

1980 

EM 4 Fracture mechanics of low and medium- 
strength steel, 1980 

EM 5 Fatigue crack initiation and propagation in 
steels, 1980 

EM 7 Design considerations for mechanical 
components, 1980 

Environmental contaminants 
EC 3 Catalytic gas sensing elements: their use 
in gas monitoring, 1980 

EC 4 Diffusive sampler for organic gases and 
vapours in air, 1980 

Frictional ignition 

FI 2 Frictional sparking risk with light metals 
and their alloys, 1980 

General 

G1 Health and Safety Laboratories - an 
introduction, 1980 

Hazard analysis 

HA 1 Safety aspects of industrial maintenance, 1982 
Machine safety 

MS 1 Measurement of the dynamic performance of 

machines and their safety systems, 1980 

Respiratory apparatus 

RA1 Filter self-rescuers, 1979 


Also series on Electrical hazards, Explosions, Protective 
equipment, Special instruments and techniques 

Technical Papers 

TP 1 Examination of entrained air flow rate data for 
large scale water spray installations by 
J. McQuaid, 1978 (also referenced as RP1) 

TP 7 Decay of spherical detonations and 

shocks by H. Phillips, 1980 (also referenced 
as RP 7) 

Toxicity Reviews 

TR1 Styrene, 1981 

TR 2 Formaldehyde, 1981 

TR 3 Carbon disulphide, 1981 

TR4 Benzene, 1982 

TR 20 Toluene, 1989 

TR 26 Xylenes, 1992 

TR 30 Phosphorous compounds, 1994 


Toxicology of Substances in Relation to Major Hazards 

Item 

1989 Acrylonitrile by R.M.Tbrner and 

S. Fairhurst 1 

1990 Ammonia by M.P. Payne, J. Delic and 

R. M. Turner 2 

1990 Chlorine by R.M. Turner and S. Fairhurst 3 

1990 Hydrogen Fluoride by R.M. Turner and 

S. Fairhurst 4 

1990 Hydrogen Sulphide by R.M. Turner and 

S. Fairhurst 5 

1992 Sulphuric Acid Mist by R.M. Turner and 

S. Fairhurst 6 

1993 Hydrogen Fluoride, rev., by M. Meldrum 7 


Translations 

including documents on Seveso, German Risk Study 
(Risikostudie) and German Order on Hazardous 
Substances (Storfallverordnung) 


Miscellaneous Publications Item 

Guide to the Explosives Acts 1875 and 

1923,1941 1 

Manhole Access to Enclosed Plant, 1971 2 

Code of Practice for Reducing the Exposure of 

Employed Persons to Noise, 1972 3 

Cost Effective Approach to Industrial 

Safety, 1972 4 

Principles of Local Exhaust Ventilation, 1975 5 

Fire Certificate (Special Premises) Regulations 

1976: 20 questions, 1976 6 

Success and Failure in Accident Prevention ,1976 7 

A Study of the Causes of Molten Metal and Water 

Explosions, 1977 8 

Brief History of HM Medical Inspectorate, 1979 9 

Effective Policies for Health and Safety, 1980 10 

Management’s Responsibilities in the Safe 
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Anisotropic Solids ed. by J.H. Boehler, 
1990 


EGF 6 

EGF 7 
EGF/ESIS 8 

EGF/ESIS 9 

ESIS 10 
ESIS 11 

ESIS 12 
ESIS 13 
ESIS 14 
ESIS 15 
ESIS 16 
ESIS 17 


High Temperature Fracture Mechanisms 
and Mechanics ed. by P. Bensussan and 
J.P. Mascarell, 1990 
Environment Assisted Fatigue, 1990 
Fracture Mechanics Verification by Large- 
Scale Testing ed. by K. Kussmaul, 1991 
Defect Assessment in Components - 
Fundamentals and Applications ed. By 
J.G. Blauel and K.-H. Schwalbe, 1987 
Fatigue under Biaxial and Multiaxial 
Loading ed. by K. Kussmaul, 1991 
Mechanics and Mechanisms of Damage 
in Composites of Multi-Materials ed. By 
D. Baptiste 

High Temperature Structural Design ed. 
hy L.H. Larsson 

Short Fatigue Cracks ed. by K.J. Miller 
and E.R. de los Rios 

Mixed Mode Fatigue and Fracture ed. by 
H.P. Rossmanith and K.J. Miller 
Behaviour of Defects at High Temperature 
ed. by R. A. Ainsworth and R.P. Skelton 
Fatigue Design ed. by J. Solin, G. Marquis, 
A. Siljander and S. Sipila 
Mismatching of Welds ed. by M. Kocak 
and K.H. Schwalbe 


Institution of Metallurgists 

See Institute of Materials 

International Chamber of Shipping 

See Appendix 27 for all publications 

International Labour Organisation 

(Geneva) 

Item 

Encyclopaedia of Occupational Health and Safety, 

1983 1 

Occupational Exposure Limits for Airborne Toxic 

Substances, 3rd ed., 1991 2 

International Maritime Organization 

(London) 

IMO-938 International Conference on Training and 

Certification of Seafarers 1978,1978 ed. 
including International Convention on 
Standards of Training, Certification and 
Watchkeeping for Seafarers (STCW) 1978 

IMO- 500 International Convention for the 

Prevention of Pollution of the Sea by Oil 
1954 (OILPOL), 1981 ed. 
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IMO- 532.82.03 Intergovernmental Conference on the 
Convention on Dumping Wastes at Sea 
1972,1982 ed. 

IMO- 013 Convention on the International Maritime 

Organization, 1984 ed. 

IMO- 001 Basic Documents, vol.l, 1986 ed. 

IMO- 007 Basic Documents, vol.2,1985 ed. 

IMO- 970 Global Maritime Distress and Safety 
System (GMDSS), 1986 ed. 

IMO-110 International Convention for the 

Safety of life at Sea 1974 (SOLAS), 

1986 ed. 

IMO-963 Merchant Ship Search and Rescue 

Manual (MERSAR), 1986 ed. 

IMO- 858 Guidelines on Surveys Required by the 

1978 SOLAS Protocol, the IBC Code and 
the IGC Code Fire Test Procedures, 

1987 ed. 

IMO-775 Index of Dangerous Chemicals Carried in 

Bulk, 1990 ed. 

IMO- 904 International Conference on Revision of 

the International Regulations for 
Preventing Collisions at Sea 1972,1990 ed. 
IMO- 520 International Conference on Marine 
Pollution 1973 (MARPOL), 1991 ed. 

IMO- 532 The London Dumping Convention: the 

First Decade and Beyond, 1991 ed. 

IMO- 927 Ships’ Routeing, 1991 ed. 

IMO-110 SOLAS, 1992 ed. 

(The SOLAS documents for 1986 and 1992 both carry the 
number IMO-110) 

International Occupational Health and Safety 
Information Centre 

(Geneva: Int. Labour Org.) 

Information Sheets 

15 Human Factors and Safety 

17 Noise in Industry 

Liquefied Petroleum Gas Industry Technical Association 

(London) 

Guides 

GN1 A Guide to the Writing of LPG Safety Reports, 
1989 

Other publications Item 

An Introduction to Liquefied Petroleum Gas, 1974 l 

Lovelace Foundation for Medical Education and 
Research 

(Albuquerque, NM) 

See particularly entries in Reference list under: Betz, P.A.; 
Bowen, I.G.; Damon, E.G.; Fletcher, E.R.; Goldizen,VC.; 
Hirsch, F.G.; Jones, R.K.; Richmond, D.R.;Taborelli,V; and 
White, C.S. 

Manufacturing Chemists Association 

(Washington, DC) (predecessor to Chemical Manufacturers 
Association q.v.) 

Chemical Safety Data Sheets 

SD-1-SD99 Chemical Safety Data Sheets, 1952-1975 


Safety Guides 

SG-1 Health Factors in the Safe Handling of 

Chemicals 

SG-2 Housekeeping in the Chemical Industry 
SG- 3 Flammable Liquids - Storage and Handling of 
Drum Lots and Smaller Quantities 
SG- 4 Emergency Organization for the Chemical 
Industry 

SG- 5 Plastic Foams - Storage, Handling and 
Fabrication 

SG-6 Forklift Operations 

SG-7 Guide for Storage and Handling of Shock and 

Impact Sensitive Materials 
SG- 8 Electrical Switch Lockout Procedure 
SG- 9 Disposal of Hazardous Waste 

SG-10 Entering Tanks and Other Enclosed Spaces 
SG-11 Off-the-Job Safety 

SG-12 Public Relations in Emergencies 

SG-13 Maintenance and Inspection of Fire Equipment 
SG-14 Safety in the Scale-Up and Transfer of Chemical 

Processes 

SG-15 Training of Process Operators 

SG-16 Liquid Chemicals - Sampling of Tank Car and 
Tank Truck Shipments 

SG-17 Fire Protection in the Chemical Industry 
SG-18 Identification of Materials 

SG-19 Electrical Equipment in Hazardous Areas 
SG-20 Safety Inspection Committee for 

a Small Plant 

Cargo Information Cards 
CIC-l-CIC-86 Cargo Information Cards 


Case Histories Item 

Case Histories of Accidents in the Chemical 
Industry, vol.l, 1962; vol.2,1966; vol.3,1979; 
vol.4,1975 1-4 

Index of Case Histories of Accidents in the 5 

Chemical Industry, 1975- 

Pollution, Effluent and Waste Disposal 
publications 

Air Pollution - Causes and cures 6 

Atmospheric Emissions from Chlor-Alkali 
Manufacture 7 

Atmospheric Emissions from Hydrochloric Acid 
Manufacturing Processes 8 

Atmospheric Emissions from Thermal Process 
Phosphoric Acid Manufacturing 9 

Atmospheric Emissions from Wet Process 
Phosphoric Acid Manufacturing 10 

Pollution Control Primer, vols 1—2 11 

Water Pollution - Causes and Cures 12 

Behavior of Organic Chemicals in the Aquatic 
Environment, Pt 1,1966; Pt 2,1969 13-14 

Odor Threshold for 53 Commercial Chemicals 15 

Critical Mathematical Evaluation of Air 
Pollution Concentration Modeling, 1970 16 


Solid Waste Technical Guides 

SWT AGuide for Loadfill Disposal of Solids Wastes, 
1974 

SW-2 A Guide for Contract Disposal of Solids Wastes, 

1974 
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SW- 3 A Guide for Incineration of Chemical Plant 

Wastes, 1974 

Transportation Emergency Guides 

CC-l-CC- 87 Transportation Emergency Guides 


Transportation and Packaging Bulletins 

TC-7 Tank Car-Approach Platforms, 1974 

TC - 8 Recommended Practices for Bulk 

Loading and Unloading Flammable 
Liquid Chemicals to and from Tank 
Trucks, 1975 

TC-20 Recommendations for Intransit Loss and 

Damage Report, 1974 

TC-27 Loading and Unloading Corrosive 

Liquids - Tank Cars, 1975 

TC-28 Loading and Unloading Liquid Caustic 

Tank Cars, 1975 

TC-29 Loading and Unloading 

Flammable Liquid Chemical - 
Tank Cars, 1975 


Other publications Item 

Grassroots - A Community Relations Guide for 
Chemical Plant Management 17 

Guidelines for Risk Evaluation and Loss 
Prevention in Chemical Plants, 1970 18 

Laboratory Waste Disposal Manual, rev. 


ed„ 1970 19 

Chemical Statistics Handbook, 7th ed., 1971- 20 

Guide for Safety in the Chemical Laboratory, 2nd 
ed., by F.G. Stephenson, 1972 21 

Guidelines for Chemical Plants in the 
Prevention, Control and Reporting of Spills, 

1973 22 

Statistical Summary (Supplement to Handbook), 

1975- 23 

Guide to the Precautionary Labeling of 

Hazardous Chemicals, 7th ed., 1976 24 


Ministry of Home Security 

(London) 

Reports 

RC 6 (The design of buildings against air 

attack) 

RC 216 (Blast pressures from German bombs and 

parachute mines) 

RC 270 (Field survey of air raid casualties) 

RC 289 (A collection of curves for the estimation 
of the magnitude of blast effects) 

RC 420 (The pressure wave produced by an 
under-water explosion) 

RC 425 (Measurements of blast pressures from 
bare charges of 60/40 RDX/TNT) 

RC 450 Structural defence 1945, by 
D.G. Christopherson, 1946 

REN 120 (Derivation of theoretical radius-of- 
damage curves) 

REN 144 (Analysis of damage from various 

charges) 

REN 188 (Notes on damage to gasholders) 


REN 190 The damage caused to houses by the 

Silvertown explosion, 19th January, 1917 
(n.d.), 

REN 214 Home damage by HE weapons acting by 
blast 

REN 316 (Radius of damage from 12,000 lb HC 
bombs filled with Amatex 9) 

REN 317 Casualty effects of high explosive 
bombs in low level daylight raids 
compared with high level night 
raids, by P.M. Blake and 
J.W.B. Douglas 

REN 367 (Prediction of blast damage) 

REN 368 Observations of blast damage in Great 
Britain from German weapons with 
aluminised and non-aluminised loadings 
REN 394 The blast effect of air burst bombs, by 

D.G. Christopherson, 1944 
REN 404 (‘Fly-bombs’: suggested first 

approximation for curves on rate of decay 
of pressure and impulse with distance) 
REN 434 (Weapons analysis. British 4000 and 
8000 lb HC bombs and industrial 
buildings) 

REN 450 (Clearance of trees) 

REN 454 The damage caused hy the German flying 

bomb (Fly), by C.G. Lyons and 
P.C. Gardiner (n.d.) 

REN 460 (The effect of charge weight ratio on 
equivalent charge weight) 

REN 478 (Damage to house property due to a flying 

bomb) 

REN 490 Blast impulses associated with specified 
categories of house damage, by 
D.G. Christopherson, 1949 
REN 497 (Further notes on equivalent static 
pressure of a blast wave acting on a 
structure of given frequency) 

REN 500 Damage caused to multi-storey 
buildings with load-bearing 
walls by German weapons 
acting by blast 

REN 523 The screening of blast by buildings, by 
C.G. Lyons and P.C. Gardiner (n.d.) 

REN 530 The damage caused by the German long 
range rocket bomb, by C.G. Lyons and 
P.C. Gardiner (n.d.) 

REN 549 Distinction between blast and earth 

shock damage 

REN 552 (Distance-damage curves. Comparison of 

damage from HE damage with that from 
atom bombs) 

REN 558 Empirical formulae for the average circle 

radii of A and C damage, by E.B. Philip 
REN 560 (Vulnerability of chimneys -1) 

REN 561 (Vulnerability of chimneys —2) 

REN 578 (Vulnerability of chimneys - 3) 

REN 580 (Blast impulse on ground due to air-burst 
bomb) 

REN 585 Blast and the Ministry of Home 
Security, Research and 
Experiments Department, 

1939-1945, by E.B. Philip 
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Public Record Office Files 
File AIR 20/3439,1945 File 
PREM 3/111,1945 

File HO 191/198,1945 (a) S101, Summary of information on 
the flying bomb to 24/6/44 (b) S104,‘Big Ben’ (c) S105, 
Casualty rates of flying bombs by day (d) S107, Presumed 
V2 projectiles 8th September 1944 (e) S109, Summary of 
information on the V2 rocket projectiles to 12 noon 15/9/44 
(f) S110 (g) Sill,The damage caused by the German long 
range rocket bomb (h) S112, Summary of the methods used 
for assessing the effectiveness of flying bombs and rocket 
bombs (i) S117, Future attacks on London (j) S118, A 
comparison of the standardised casualty rates for people in 
unprotected parts of dwellings exposed to rocket bombs 
(V2), flying bombs (VI) and parachute mines 


National Bureau of Standards 

(Washington, DC) 

Reports 

5482 Form characteristics of arrested saline wedges 
by G.H. Keulegan, 1957 

5831 The motion of saline fronts in still water by G.H. 
Keulegan, 1958 


Principles of Fire Protection Chemistry, 1989 24 

Automatic Sprinkler and Standpipe Systems, 

1990 25 

Industrial Fire Hazards Handbook, 1990 26 

Fire Protection Guide to Hazardous Materials, 

1991 27 

Fire Protection Handbook, 17th ed., 1991 28 

Building Construction for the Fire Service, 1992 29 

Hazardous Materials Response Handbook, 1992 30 

Liquefied Petroleum Gases Handbook, 1992 31 

National Fuel Gas Code Handbook, 1992 32 

Fire Protection Systems: Inspection,Test and 
Maintenance, 1993 33 

Flammable and Combustible Liquid Code 
Handbook, 1993 34 

National Electrical Code Handbook, 1993 35 

National Fire Alarm Code, 1993 36 

Automatic Sprinkler Systems Handbook, 1994 37 

Fire Alarm Signaling Systems Handbook, 1994 38 

Installation of Sprinkler Systems, 1994 39 

Life Safety Code Handbook, 1994 40 

NFPA Inspection Manual, 1994 41 


National Institute for Occupational Safety and Health 

(Cincinnati, OH) 


National Centre for Systems Reliability-see UK 
Atomic Energy Authority 


National Fire Protection Association Item 

Report of Important Dust Explosions, 1957 1 

Radiation Control for Fire and Other Emergency 
Forces by A. A. Keil, 1960 2 

Fire Behaviour and Sprinklers by 
N.J. Thompson,1964 3 

Fire Attack by WY. Kimball, vol.l, 1966; vol.2, 

1968 4 

Industrial Fire Brigades Training Manual, 1968 5 

Fire Officers Guide to Extinguishing Systems by 
C.W. Bahme, 1970 6 

The Fire Fighters Responsibility in Arson 
Detection, 1971 7 

Fire Service Communications for Fire Attack by 
WY. Kimball, 1972 8 

The Fire Officers Guide to Dangerous Chemicals 
by C.W Bahme, 1972 9 

Transportation Fire Hazards, 1973 10 

The Extinguishment of Fire by W.M. Haessler, 

1974 11 

A Hazard Study - Natural Gas and Fire 
Explosions, 1974 12 

Fire Protection by Halons, 1975 13 

Detecting Fires, 1975 14 

Fire Protection by Sprinklers, 1975 15 

Guides for Fighting Fires in and around 
Petroleum Storage Tanks, 1975 16 

The Systems Approach to Fire Protection, 1976 17 

Fire Command Textbook, 1985 18 

Fire Protection Handbook, 16th ed., 1986 19 

Electrical Installations in Hazardous Locations, 

1988 20 

Principles of Fire Protection, 1988 21 

SPE Handbook of Fire Protection Engineering, 

1988 22 

Management in the Fire Service, 1989 23 


Criteria Documents 
Publ. 76 -195 Acetylene, 1976 

Publ. 78 -116 Acrylonitrile, 1978 

Publ. 74-136 Ammonia, 1974 

Publ. 77-169 Asbestos, 1977, rev. 

Publ. 74 -137 Benzene, 1974; 1976, rev. 

Publ. 77-156 Carbon disulphide, 1977 
Publ. 73-11000 Carbon monoxide, 1972 
Publ. 76 -170 Chlorine, 1976 

Publ. 80 -106 Confined spaces, 1979 

Publ. 77-108 Cyanide, hydrogen and cyanide 
salts, 1976 

Publ. 78-215 Diisocyanates, 1978 
Publ. 77-200 Ethylene oxide (SHR), 1978 
Publ. 77-126 Formaldehyde, 1976 
Publ. 72-10269 Hot environments, 1972 


Publ. 86-113 Hot environments, 1986, rev 

Publ. 76-143 Hydrogen fluoride, 1976 

Publ. 77-158 Hydrogen sulphide, 1977 
Publ. 75-126 Identification system for occupationally 
hazardous materials, 1974 
Publ. 78 -158 Lead, inorganic, 1978, rev 
Publ. 76 -149 Nitrogen, oxides of, 1976 
Publ. 73-11001 Noise, 1972 
Publ. 76 -137 Phosgene, 1976 
Publ. 74-;lll Sulfur dioxide, 1974; 1977, rev. 

Publ. 78-205 Vinyl acetate, 1978; Vinyl chloride, 1974; 
Vinyl halides, 1979 

Publ. 88-110 Welding, brazing and thermal cutting, 
1988 


Sampling and Analysis 

Pubis 77-159, Manual of Sampling Data 

787-189 Sheets, 1978 

Pubis 77-157A, NIOSH Manual of Analytical 

77- 157B, 77-157C, Methods, 1977-1981 

78- 175,79-141, 

80-125,82-100 


Item 


2 
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Miscellaneous publications Item 

Pubis 74-127, National Occupational Exposure 

77-213,78-114, Survey 

88- 106,89-102, 

89- 103 3 

Publ. 77—181 Occupational Diseases — A 

Guide to Their Recognition, 1977 4 
Publ. 79-116 A Guide to the Work-Relatedness 

of Disease, 1979 5 

Pubis 81 -123, Occupational Health Guidelines 

88-118,89-104 for Chemical Hazards, 1981; 

supplement, 1988 6 

Publ. 81-122 Work Practices Guide for 

Manual Lifting, 1981 7 

Publ. 85—115 Occupational Safety and Health 

Guidance Manual for Hazardous 
Waste Site Activities, 1985 8 

Publ. 86-102 Occupational Respiratory 

Diseases, 1986 9 

Control of Unconfined Vapour 
Clouds by Fire Department 
Water Spray Handlines, 1987 10 

The Development and 
Application of Algorithms for 
Generating Estimates of 
Toxicity for the NIOSH Data 
Base, c.1987 11 

Guide to Industrial Respiratory 
Protection, 1987 12 

A Guide to Safety in Confined 
Spaces, 1987 13 

Respirator Decision Logic, 


Publ. 87-105 


Publ. 87-108 


in Work 


14 


Publ. 87-111 Stress Management ir 

Settings, 1987 15 

Publ. 88-108 Safe Maintenance Guide for 

Robotic Workstations, 1988 16 

Publ. 90—109 A Guide to Evaluating the 

Performance of Chemical 
Protective Clothing (CPC), 1990 17 
Publ. 90—117 Pocket Guide to Chemical 

Hazards, 1990 18 

Publ. 90—115 A Guide for the Management, 

Analysis and Interpretation of 
Occupational Mortality Data, 

1990 19 

Publ. 91 -113 Work Related Lung Disease 

Surveillance Report, 1991 20 

Publ. 92-100 NIOSH Recommendations for 

Occupational Safety and 
Health-Compendium of 
Policy Documents and 
Statements, 1992 21 

Index of Signs and Symptoms of 
Industrial Diseases, 1980 22 

Personal Protective Equipment 
for Hazardous Material Incidents; 

A Selection Guide, 1984 23 

Prevention of Leading Work-Related 

Diseases, 1986 24 

Proposed National Strategies for the 

Prevention of Leading Work-Related 

Diseases and Injuries, 1989 25 


National Radiological Protection Board 

(Harwell) 

Advice on Standards for Protection 

ASP1 1978 Recommendations of the International 
Commission on Radiological Protection 
(ICRP Publication 26): Statement by the 
National Radiological Protection Board 
on their acceptability for application in 
the UK 

ASP7 1985 Small radiation doses to members of the 
public 

Emergency Reference Levels 

ERL1 1978 Emergency Reference Levels: interim 
guidance 

ERL2 1981 Emergency Reference Levels: criteria for 
limiting doses to the public in the event of 
accidental exposure to radiation 

Derived Limits Reports 

DL1 1979 The Estimation of Derived Limits by 
N.T. Harrison etal. 

DL7 1983 Generalised Derived Limits for 
Radioisotopes of Caesium by 
S.M. Haywood and J.R. Simmons 

DL8 1983 Generalised Derived Limits for 
Radioisotopes of Strontium by 
S.M. Haywood and J.R. Simmons 

DL9 1984 Generalised Derived Limits for 
Radioisotopes of Iodine by 
J.S. Hughes et al. 

Scientific and Technical Reports 

R52 1976 Human Exposure to Radiation 

Following the Release of Radioactivity 
from a Reactor Accident: A Quantitative 
Assessment of the Biological 
Consequences by H. Smith and 
JW Stather 

R53 1977 An Estimate of the Radiological 

Consequences of Notional Accidental 
Releases of Radioactivity from a Fast 
Breeder Reactor by G.N. Kelly et al. 

R62 1977 Insignificant Levels of Dose: A Practical 

Suggestion for Decision Making by 
G.A.M.Webb and A.S. McLean 

R87 1979 The Radiological Consequences of 

Notional Accidental Releases of 
Radioactivity from Fast Breeder 
Reactors: Sensitivity to the Dose-Effect 
Relationships Adopted for Early 
Biological Effects by G.N. Kelly et al. 

R88 1979 The Radiological Consequences of 

National Accidental Releases of 
Radioactivity from Fast Breeder 
Reactors: Sensitivity to the Choice of 
Atmospheric Dispersion Model by 
J. A. Jones 

R91 1979 A Model for Short and Medium 

Range Dispersion of Radionuclides 
Released to the Atmosphere by 
R.H. Clarke 
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9 The Radiological Consequences of 
Notional Accidental Releases of 
Radioactivity from Fast Breeder 
Reactors: Sensitivity of the Incidence 
of Early Effects to the Duration of 
the Release 

The Consequences of a Reduction in the 
Administratively Applied Maximum 
Annual Dose Equivalent Level for an 
Individual in a Group of Occupationally 
Exposed Workers by N.T. Harrison 
The Radiological Consequences of 
Notional Accidental Releases of 
Radioactivity from Fast Breeder 
Reactors: The Influence of the 
Meteorological Conditions by 
C.R. Hemming etal. 

ESCLOUD: A Computer Program to 
Calculate the Air Concentration, 
Deposition Rate and External Dose Rate 
from a Continuous Discharge of 
Radioactive Material to Atmosphere 
by J. A. Jones 

A Model to Calculate Exposure from 
Radioactive Discharges into the Coastal 
Waters of Northern Europe by 
M.J. Clark etal. 

The Second Report of aWorking Group on 
Atmospheric Dispersion: A Procedure to 
Include Dispersion in the Model for Short 
and Medium Range Atmospheric 
Dispersion of Radionuclides - 
J.A. Jones, group secretary 
The Third Report of aWorking Group on 
Atmospheric Dispersion: The Estimation 
of Long Range Dispersion and Deposition 
of Continuous Releases of Radionuclides 
to Atmosphere — J. A. Jones, group 
secretary 

The Fourth Report of aWorking Group on 
Atmospheric Dispersion: A Model for 
Long Range Atmospheric Dispersion of 
Radionuclides Released over a Short 
Period - J. A. Jones, group secretary 
MARC - The NRPB Methodology for 
Assessing Radiological Consequences of 
Accidental Releases of Activity by 
R.H. Clarke and G.N. Kelly 
1 Accidental Releases of Radionuclides: A 
Preliminary Study of the Consequences 
of Land Contamination by 
J.R. Simmonds etal. 

An Assessment of the Radiological 
Impact of the Windscale Reactor Fire, 
October 1957 by M.J. Crick and 
G.S. Linsey 

An Assessment of the Radiological 
Consequences of Releases from Degraded 
Core Accidents for Sizewell PWR by 
G.N. Kelly and R.H. Clarke 
Degraded Core Accidents for the Sizewell 
PWR: A Sensitivity Analysis of the 
Radiological Consequences by 
G.N. Kelly etal. 


R145 1983 

R146 1983 

R147 1983 

R149 1983 

R157 1983 

R160 1983 

R163 1983 

R173 1984 

R175 1985 

R180 1985 


The Influence of Including Consequences 
beyond the UK Boundary on the 
Radiological Impact of Hypothetical 
Accidental Releases by J. A. Jones et al. 
The Radiological Impact on the Greater 
London Population of Postulated 
Accidental Releases from the Sizewell 
PWR by G.N. Kelly et al. 

The Radiological Impact of Postulated 
Accidental Releases during the 
Transportation of Irradiated PWR Fuel 
through Greater London by K.B. Shawefa/. 
Comparison of the MARC and CRAC2 
Programs for Assessing the Radiological 
Consequences for Accidental Releases of 
Radioactive Material by C.R. Hemming 
and D. Charles 

The Fifth Report of aWorking Group on 
Atmospheric Dispersion: Models to Allow 
for the Effects of Coastal Sites, Plume 
Rise and Buildings on Dispersion of 
Radionuclides and Guidance on the Value 
of Deposition Velocity and Washout 
Coefficients - J. A Jones, group secretary 
The Radiological Consequences of 
Degraded Core Accidents for the Sizewell 
PWR: The Impact of Adopting Revised 
Frequencies of Occurrence by G.N. Kelly 
and C.R. Hemming 

The Influence of Countermeasures on the 
Predicted Consequences of Degraded 
Core Accidents for the Sizewell PWR by 
G.N. Kelly et al. 

The Radiation Exposure of the UK 
Population - 1984 Review by J.S. Hughes 
and G.C. Roberts 

The Significance of Small Doses of 
Radiation to Members of the Public by 
A.B. Fleishman 

Procedures to Relate the Nil Safety 
Assessment Principles for Nuclear 
Reactors to Risk by G.N. Kelly et al. 


National Safety Council 

(Chicago, IL) 

Safety Data Sheets 

Safety Data Sheets NSC1-, 1952 

Safe Practice Pamphlets 
68 Pressure Vessels - Fired and Unflred 

70 Maintenance and Repair Men 
105 Welding 


Other publications Item 

Accident Facts (annual) 1 

Accident Prevention Manual for Industrial 
Operations, 7th ed. 2 

Fundamentals of Industrial Hygiene 3 

Handbook of Accident Prevention for Business and 
Industry, 4th ed. 4 

Motor Fleet Safety Manual 5 

Supervisors Guide to Human Relations 6 

Supervisors Safety Manual, 4th ed. 7 
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Vehicle Damage Scale for Traffic Accident 
Investigators 8 

Fundamentals of Industrial Hygiene, 1988 9 

Study Guide: Fundamentals of Industrial Hygiene, 

1989 10 

Accident Prevention Manual for Business and 
Industry, 10th ed., 1992 11 


Highway Accident Reports 

HAR-71- 06 Liquid OxygenTankTruck Explosion 

Followed by Fires in Brooklyn, New York, 
May 30,1970 

HAR- 71- 07 Accidental Mixing of Incompatible 

Chemicals, Followed by Multiple 
Fatalities, During a Bulk Delivery, 
Berwick, Maine, April 2,1971 

HAR-72- 03 Truck-Automobile Collision Involving 

Spilled Methyl Bromide on US 90 near 
Gretna, Florida, August 8,1971 

HAR-72- 05 Automobile-Truck Collision Followed by 

Fire and Explosion of Dynamite Cargo on 
US Highway 78, near Waco, Georgia, 

June 4,1971 

HAR-73-03 Propane Tractor Semitrailer Overturn 

and Fire, US Route 501, Lynchburg, 
Virginia,March 9,1972 

HAR-73-04 Multiple Vehicle Collision, Followed by 

Propylene Cargo Tank Explosion, New 
Jersey Turnpike, Exit 8, September 21, 
1972 

HAR-76-04 Surtigas SA,Tank-Semitrailer Overturn, 

Explosion and Fire, ne: _ 

Texas, April 29,1975 

HAR-76-07 Union Oil Company of California,Tank 

Truck and Full Trailer Overturn and Fire, 
Seattle, Washington, December 4,1975 

HAR-77- 01 Transport Company of Texas, Tractor 

Semitrailer (Tank) Collision with Bridge 
Column and Sudden Dispersal of 
Anhydrous Ammonia Cargo, Houston, 
Texas, May 11,1976 

HAR-78-04 Usher Transport Inc., 

Tractor-Cargo—Tank—Semi-Trailer 
Overturn and Fire, Beatty ville, Kentucky, 
September 24,1977 

HAR-80-05 Multiple Vehicle Collision and Fire, US 

Route 101, Los Angeles, California, 

March 3,1980 

HAR-83-01 Multiple Vehicle Collisions and 

Fire, Caldecott Tunnel, Oakland, 
California, April 7,1982 


Marine Accident Reports 

MAR-74-01 Tank Barge IOS-3301, Port Jefferson, New 
York, January 10,1972 

MAR-75 - 03 Tank Barge Ocean 89, Fire and Explosions, 

Carteret, New Jersey, 

October 25,1972 

MAR-75 - 05 Tankship Texaco North Dakota, Pumproom 

Explosion, Gulf of Mexico, October 3,1973 


MAR-78-01 

MAR-78-02 

MAR-78-06 

MAR-78-09 

MAR-78-10 

MAR-79-04 

MAR-79-05 

MAR-79-06 

MAR-79-13 

MAR-79-15 

MAR-79-16 

MAR-80-07 

MAR-80-11 

MAR-80-12 

MAR-80-14 

MAR-80-17 

MAR-80-18 

MAR-81-04 


US Tankship SS Marine Floridan Collision 
with Benjamin Harrison Memorial Bridge, 
Hopewell, Virginia, February 24,1977 
Tank Barge B -924 Fire and Explosion with 
Loss of Life at Greenville, Mississippi, 
November 13,1975 

Liberian Tankship SS Sansinena Explosion 
and Fire, Union Oil Terminal Berth 46, Los 
Angeles, California, December 17,1976 
Collision of Liberian Tankship M/V Stott 
Viking and US Crewboat Candy Bar in Gulf 
of Mexico, January 7,1978 
French Tankship SS Sitala Collision with 
Moored Vessels, New Orleans, Louisiana, 
July 28,1977 

Luling Destrehan Ferry M/V George Prince 
Collision with the Tanker SS Frosta on the 
Mississippi River, October 20,1976 
Capsizing and Sinking of the Self- 
Elevating Mobile Offshore Drilling Unit 
Ocean Express near Port O’Conner,Texas, 
April 15,1976 

USS LY. Spear (AS-36) Collision with 
Liberian Motor Tankship Zephyros, Lower 
Mississippi River, February 22,1978 
US Motor Tankship Sealift China Sea 
Ramming of the Italian Motor Cargo Vessel 
Lorenzo D’Amico, Los Angeles, California, 
January 15,1978 

Spanish Motor Tankship Ribaforada 
Ramming of Barge MB-5, Three Wharves 
and Cargo Ship M/V Tiaret, New Orleans, 
Louisiana, December 4,1977 
Collision of American Containership SS 
SeaLand Venture and Danish Tanker M/T 
Netty Maersk, Inner Bar Channel, 
Galveston,Texas, August 27,1978 
Collision of Peruvian Freighter M/V Inca 
Tupac Yupanqui and US Butane Barge 
Panama City, Good Hope, Louisiana, 
August 30,1979 

Collision of US Tankship SS Exxon Chester 
and Liberian Freighter M/V 
Regal Sword in the Atlantic Ocean near 
Cape Cod, Massachusetts, 

June 18,1979 

Liberian Tank Vessel M/V Seatiger 
Explosion and Fire, Sun Oil Terminal, 
Nederland,Texas, April 19,1979 
Collision of US Coast Guard 
Cutter Blackhorn and US Tankship 
Capricorn, Tampa Bay, Florida, 

January 28,1980 

Collision of Liberian Tankship M/V Pina 
and the Towboat Mr Pete and its Tow, Mile 
99.3 Lower Mississippi River, 

December 19,1979 

Explosion and Fire on board the SS Chevron 
Hawaii with Damages to Barges and Deer 
Park Shell Oil Company Terminal Houston 
Ship Channel, September 1,1979 
Tankship SS Texaco North Dakota and 
Artificial Island El-361-A, Collision and 
Fire, Gulf of Mexico, August 21,1980 
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MAR-81-05 

MAR-81-11 

MAR-81-12 

MAR-81-14 

MAR-82-02 

MAR-83-02 

MAR-83-03 

MAR-83-04 

MAR-83-06 

MAR-83-07 

MAR-84-08 
MAR-84-09 

MAR-85-04 

MAR-85-06 

MAR-85-11 

MAR-86-03 

MAR-86-05 

MAR-86-10 

MAR-87-02 


Collision of US Mississippi River Steamer 
Natchez and US Tankship SS Exxon 
Baltimore, New Orleans, Louisiana, March 
29,1980 

Grounding of US Tankship SS Concha 
Constable Hook, Reach of Kill Van Kull,Upper 
New York Harbor, January 19,1981 
Liberian Chemical Tankship M/V Coastal 
Transport Collision with US Offshore 
Supply Vessel M/V Sallee P, Lower 
Mississippi River, near Venice, Louisiana, 
November 24,1980 
Explosion and Fire on board the US 
Tankship Monticello Victory, Port Arthur, 
Texas, May 31,1981 

Collision of the US Tankship Pisces with the 
Greek Bulk Carrier Trade Master, Mile 
124,Lower Mississippi River, 

December 27,1980 

Capsizing and Sinking of the US Mobile 
Offshore Drilling Unit Ocean Ranger off the 
East Coast of Canada, 166 N Miles E of St 
John’s, Newfoundland, February 15,1983 
Explosion and Fire on board US Coastal 
Tankship Poling Bros No.9 East River, New 
York Harbor, February 26,1982 
Collision of US Towboat Creole Genii and 
LiberianTank Vessel Arkas near Mile 
130,Mississippi River, March 31,1982 
Engine Room Flooding and Near 
Foundering of US Tankship Ogden 
Williamette, Caribbean Sea, June 16,1982 
Explosions and Fire on board the US 
Tankship SS Golden Dolphin in the Atlantic 
Ocean, March 6,1982 
See MAR-87-02 

Grounding of the US Tankship SS Mobil Oil 
in the Columbia River, near Saint 
Helens,Oregon, March 19,1984 
Collision of the US Towboat Ann Brent and 
Tow with the Greel Tankship Maninia, Mile 
150, Lower Mississippi River, June 11,1984 
Explosion and Sinking of the United States 
Tankship SS American Eagle, Gulf of 
Mexico,February 26 and 27,1984 
Explosion and Fire aboard the US Mobile 
Offshore Drilling Unit Zapata Lexington, 
Gulf of Mexico, September 14,1984 
Explosion and Fire on board the US Mobile 
Offshore Drilling Unit GlomarArctic II in 
the North Sea, 130 Nautical Miles E-SE 
Aberdeen, Scotland, January 15,1985 
Explosion and Fire on board US Chemical 
Tankship Puerto Rican in the Pacific Ocean 
near San Francisco, California, October 31, 
1984 

Collapse of the US Mobile Offshore Drilling 
Unit Penrod 61 in the Gulf of Mexico, 
October 27,1985 

Capsizing and Sinking of the US Drillship 
Glomar Java Sea in the South China Sea 65 
Nautical Miles South-Southwest of Hainan 
Island, People’s Republic of China, 

October 25,1983 (supersedes MAR-84-08) 


MAR-87-05 
MAR-87-06 

MAR-87-07 

MAR-87-08 

MAR-87-09 

MAR-87-10 

MAR-88-09 

MAR-89-02 

MAR-89-03 

MAR-89-06 

MAR-89-07 

MAR-90-04 

MAR-90-06 

MAR-91-01 

MAR-91-03 

MAR-91-04 

MAR-92-01 

MAR-92-02 

MAR-92-04 


Explosion aboard the US Tank Barge TTT 
103, Pascagoula, Mississippi, July 31,1986 
Explosions and Fire aboard the US 
Tankship Omi Yukon in the Pacific Ocean 
about 1000 Miles West of Honolulu, Hawaii, 
October 28,1986 

Engineroom Flooding of the US Tankship 
Prince William Sound, near Puerto Vallarta, 
Mexico, May 9,1986 

Fires on board the Panamanian Tankship 
Shoun Vanguard and the US Tank Barge 
Hollywood 3013, Deer Park, Texas, 

October 7,1986 

Explosion and Fire aboard the US Tank 
Barge STC 410 at the Steuart Petroleum 
Company Facility, Piney Point, Maryland, 
December 20,1986 

Grounding of the Panamanian Tankship 
Grand Eagle in the Delaware River, near 
Marcus Hook, Pennsylvania, September 
28,1985 

Ramming of the Maltese Bulk Carrier Mont 
Fort by the British Tankship Maersk Neptune 
in Upper New York Bay, February 15,1988 
Striking of a Submerged Object by 
Bahamian Tankship Esso Puerto Rico, 
Mississippi River, Kenner, Louisiana, 
September 3,1988 

Explosion aboard the Maltese Tank Vessel 
Fiona in the Long Island Sound near 
Northport, New York, August 31,1988 
Capsizing and Sinking of the Mobile 
Offshore Drilling Unit Rowan GoriUa I in the 
North Atlantic Ocean, December 15,1988 
Collision between the Swedish Auto Carrier 
Figaro and the French Tankship Camarque, 
Galveston Bay Entrance, November 10,1988 
Grounding of the US Tankship Exxon 
Valdez on Bligh Reef, Prince William Sound 
near Valdez, Alaska, March 24,1989 
Engineroom Fire aboard the US Tankship 
Charleston in the Atlantic Ocean about 
35 miles off the South Coast, March 7,1989 
Grounding of the Greek Tankship World 
Prodigy off the Coast of Rhode Island, 

June 23,1989 

Collision between the Greek Tankship 
Shinoussa and the US Towboat ChandyN 
and Tow near Red Fish Island, Galveston 
Bay, Texas 

Explosion and Fire aboard the US Tankship 
Jupiter, Bay City, Michigan, September 16, 
1990 

Grounding of the US Tankship Star 
Connecticut, Pacific Ocean, near Barbers 
Point, Hawaii, November 6,1990 
Explosion and Fire on the US Tankship 
SurJCity, Persian Gulf, February 22,1990 
Collision of the Hong Kong-Registered 
MotorTankship Mandan with the US Army 
Corps of Engineers Barge Flotilla at Mile 
10.5 above Head of Passes in the Lower 
Mississippi River near Venice, Louisiana, 
August 15,1990 
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Pipeline Accident Reports 

PAR-71- 01 Mobil Oil Corporation High-Pressure 

Natural Gas Pipeline, near Houston, Texas, 
September 9,1969 

PAR-71- 02 Colonial Pipeline Co., Petroleum Products 

Pipeline, Jacksonville, Maryland, 
September 3,1970 

PAR-72-01 Phillips Pipeline Company, Propane Gas 
Explosion, Franklin County, Missouri, 
December 9,1970 

PAR-73 - 02 Exxon Pipeline Company, Crude Oil 

Explosion at Hearne, Texas, May 14, 

1972 

PAR-73 - 04 Phillips Pipeline Company, Natural Gas 

Liquids Fire, Austin,Texas, 

February 22,1973 

PAR-74- 06 Mid-America Pipeline System, Anhydrous 

Ammonia Leak, Conway, Kansas, 
December 6,1973 

PAR-75 - 01 Michigan-Wisconsin Pipeline Company, 

Natural Gas Transmission Line Failure, 
Monroe, Louisiana, March 2,1974 
PAR-75 - 02 Transcontinental Gas Pipeline 

Corporation, 30 inch Transmission line 
Failure, near Bealeton, Virginia, June 9,1974 
PAR-76 - 01 Mid Valley Pipeline Company, Crude Oil 

Terminal Fire, near Lima, Ohio, 

January 17,1975 

PAR-76-05 Dow Chemical Company USA, Natural Gas 
Liquids Explosion and Fire, near Devers, 
Texas, May 12,1975 

PAR-76 - 07 Sun Pipeline Company, Rupture of 8 inch 

Pipeline, Romulus, Michigan, 

August 2,1975 

PAR-77-03 Exxon Gas System Inc., Natural Gas 
Explosion and Fire, Robstown,Texas, 
December 7,1976 

PAR-78 - 01 Consolidated Gas Supply Corporation, 

Propane Pipeline Rupture and Fire, 

Ruff Creek, Pennsylvania, July 20,1977 
PAR-78 - 02 Alyeska Pipeline Service Company, 
Explosion and Fire, Pump Station 8, 
near Fairbanks, Alaska, July 8,1977 
PAR-79 - 01 Mid-America Pipeline System, Liquefied 

Petroleum Gas Pipeline Rupture and Fire, 
Donnellson, Iowa, August 4,1978 
PAR- 80-01 Southern Natural Gas Company, Rupture 

and Fire of a 14 inch Gas Transmission 
Pipeline South-East of New Orleans, 
Louisiana, July 15,1980 
PAR- 80-02 Columbia liquefied Natural Gas 

Corporation, Explosion and Fire, 

Cove Point, Maryland,October 6,1979 
PAR-80-06 The Pipelines of Puerto Rico Inc., 

Petroleum Products Pipeline Rupture 
and Fire, Bayamon, Puerto Rico, 

January 30,1980 

PAR- 83-01 The Gas Company of New Mexico, 

Natural Gas Explosion and Fire, Portales, 
New Mexico, June 28,1982 
PAR-83-02 Northern 

PAR- 83-02 Northern Natural Gas Company, Pipeline 
Puncture, Explosion and Fire, Hudson, 
Iowa, November 4,1982 


PAR-83-03 

PAR-83-04 

PAR-84-01 

PAR-85-01 

PAR-85-02 

PAR-86-01 

PAR-87-01 

PAR-90-02 

PAR-91-01 


Mississippi River Transmission 
Corporation, Natural Gas Flash Fire, 

Pine Bluff, Arkansas, October 1,1982 
El Paso Natural Gas Company, Compressor 
Station Explosion and Fire, Bloomfield, 
New Mexico, May 26,1983 
Mid-America Pipeline System, 
liquefied Petroleum Gas Pipeline Rupture, 
West Odessa,Texas, March 15,1983 
Arizona Public Service Company, Natural 
Gas Explosion and Fire, Phoenix, Arizona, 
September 25,1984 

National Fuel Gas Company, Natural Gas 
Explosion and Fire, Sharpsville, 
Pennsylvania, February 23,1985 
Continental Pipe line Company, Pipeline 
Rupture and Fire, Kaycee, Wyoming, 

July 23,1985 

Texas Eastern Gas Pipeline Company 
Ruptures and Fires at Beaumont, Kentucky, 
on April 27,1985, and Lancaster, Kentucky, 
on February 21,1986 

Fire on Board the F/V Northumberland and 
Rupture of a Natural Gas Transmission 
Pipeline in the Gulf of Mexico near Sabine 
Pass,Texas, October 3,1989 
Liquid Propane Pipeline Rupture and Fire, 
Texas Eastern Products Pipeline Company, 
North Blenheim, New York, March 3,1990 


Railroad Accident Reports 

RAR Southern Railway Company,Train 154, 

Derailment with Fire and Explosion, 
Laurel, Mississippi, January 25,1969 

RAR-70 - 02 Illinois Central Railroad Company, 
Derailment at Glendora, Mississippi, 
September 11,1969 

RAR-71- 02 Chicago, Burlington and Quincy RR 

Company, Train 64 and Train 824, 
Derailment and Collision with Tank 
Car Explosion, Crete, Nebraska, 

February 18,1969 

RAR-72- 02 Derailment of Toledo, Peoria and Western 
Railroad Company’s Train No. 20 with 
Resultant Fire and Tank Car Ruptures, 
Crescent City, Illinois, June 21,1970 

RAR-72- 06 Derailment of Missouri Pacific Railroad 
Company’s Train 94 at Houston,Texas, 
October 19,1971 

RAR-73 - 01 Hazardous Materials Railroad Accident in 
the Alton and Southern Gateway Yard in 
East St Louis, Illinois, January 22,1972 

RAR-74 - 04 Derailment and Subsequent Burning of 
Delaware and Hudson Railway Freight 
Train at Oneonta, New York, February 12, 
1974 

RAR-75-02 Southern Pacific Transportation 

Company, Freight Train 2nd BSM 22 
Munitions Explosion, Benson, Arizona, 
May 24,1973 

R AR-75 - 04 Hazardous Materials Accident in the 

Railroad Yard of the Norfolk and Western 
Railway at Decatur, Illinois, July 19,1974 
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RAR-75-07 

RAR-76-01 

RAR-76-08 

RAR-77-07 

RAR-78-04 

RAR-78-07 

RAR-78-08 

RAR-79-01 

RAR-79-11 

RAR-81-01 

RAR-83-05 

RAR-85-08 

RAR-85-10 

RAR-85-12 

RAR-86-04 

RAR-89-04 


Hazardous Materials Accident at the 
Southern Pacific Transportation 
Company’s Englewood Yard in Houston, 
Texas, September 21,1974 
Burlington Northern Inc., 
Monomethylamine Nitrite Explosion, 
Wenatchee, Washington, August 6,1974 
Derailment of Tank Cars with Subsequent 
Fire and Explosion on Chicago, Rock Island 
and Pacific Rail Company, near Des 
Moines, Iowa, September 1,1975 
Derailment of a Burlington Northern 
Freight Train at Belt, Montana, 

November 26,1976 
Louisville and Nashville Railroad 
Company, Freight Train Derailment and 
Puncture of Anhydrous Ammonia Tank 
Cars at Pensacola, Florida, November 9, 
1977 

Derailment of Atlanta and St Andrews Bay 
Railroad Company Freight Train, 
Youngstown, Florida, February 26,1978 
St Louis Southwestern Railway Company 
Freight Train Derailment and Rupture of 
Vinyl Chloride Tank Car, Lewisville, 
Arkansas, March 29,1978 
Derailment of L&N Railroad Company’s 
Train No. 584 and Subsequent Rupture of 
Tank Car Containing Liquefied Petroleum 
Gas, Waverly, Tennessee, February 22,1978 
Louisville and Nashville Railroad 
Company, Freight Train Derailment and 
Puncture of Hazardous Materials Tank 
Cars, Crestview, Florida, April 8,1979 
Illinois Central Gulf Railroad Company 
Freight Train Derailment, Hazardous 
Material Release and Evacuation, 
Muldraugh, Kentucky, July 26,1980 
Derailment of Illinois Central Gulf 
Railroad Freight Train Extra 9629 East 
(GS-2-28) and Release of Hazardous 
Materials at Livingston, Louisiana, 
September 28,1982 

Vinyl Chloride Monomer Release from a 
Railroad Tank Car and Fire, Formosa 
Plastics Corporation Plant, Baton Rouge, 
Louisiana, July 30,1983 
Denver and Rio Grande Western Railroad 
Company Train Yard Accident Involving 
Punctured Tank Car, Nitric Acid and Vapor 
Cloud, Denver, Colorado, April 3,1983 
Derailment of Seaboard System Railroad 
Train No. F-690 with Hazardous Material 
Release, Jackson, South Carolina, 

February 23,1985 

Derailment of St Louis Southwestern 
Railway Company (Cotton Belt) Freight 
Train Extra 4835 North and Release of 
Hazardous Materials near Pine Bluff, 
Arkansas, June 9,1985 
Head-On Collision between Iowa Interstate 
Railroad Extra 406 East with Release of 
Hazardous Materials near Altoona, Iowa, 
July 30,1988 


RAR- 89-05 Collision and Derailment of Montana Rail 
link Freight Train with Locomotive Units 
and Hazardous Materials Release, Helena, 
Montana, February 2,1989 
RAR-90-02 Derailment of Southern Pacific 

Transportation Company Freight Train on 
May 12,1989, and Subsequent Rupture of 
Calney Petroleum Pipeline on May 25, San 
Bernadino, California 

RAR- 91-04 Derailment of CSX Transportation Inc. 

Freight Train and Hazardous Materials 
Releasenear Freeland,Michigan, July22,1989 


Nordic Liaison Committee for Atomic Energy 

(available Riso Nat. Lab., Roskilde, Denmark) 


NKA/LIT(85)1 

NKA/LIT(85)3 

NKA/LIT(85)4 

NKA/LIT(85)5 

NKA/LIT(85)6 


The human component in the safety of 
complex systems by B.Wahlstrom, 1986 
Organization for safety by E. Edsberg, 
1985 

The design process and the use of 
computerized tools in control room design 
by B.Wahlstrom, R. Heinonen, J. Ranta 
and J. Haarla, 1985 

Computer aided operation of complex 
systems ed. by LP. Goodstein, 1985 
Training diagnostic skills for nuclear 
power plants by LP. Goodstein, 1986 


Occupational Safety and Health Administration 

(Washington, DC) 

OSHA series 

OSHA 2001 The Occupational Safety and Health 
Act, 1970 

OSHA 2098 OSHA Inspections 
OSHA 2220 Carcinogens 
OSHA 2224 Carbon Monoxide 
OSHA 2225 Vinyl Chloride 
OSHA 2230 Lead 
OSHA 2234 Mercury 
OSHA 2237 Handling Hazardous Materials 
OSHA 2248 Toluene Diisocyanate 
OSHA 2253 Workers Rights under OSH A 
OSHA 2254 Training Requirements for OSHA 
Standards 


Other publications Item 

New Hazards for Fire Fighters 1 

Occupational Cancer 2 

Essentials of Materials Handling 3 

Hazard Communication: A Compliance Kit, 1988 4 

OSHA Analytical Methods Manual, 1990 5 

OSHA Laboratory Standard - Chemical 
Hygiene Plan, 1990 6 

Chemical Information Manual, 1991 7 


Oil Companies International Marine Forum 

See Appendix 27 for all publications 

Oil Insurance Association 

(merged with Industrial Risk Insurers, q.v.) 

Publications 

Publ. 101 Hydrorefining Process Units. Loss Causes and 
Guidelines for Loss Prevention, 1974 
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301 Gasoline Plants. Recommendations and 
Guidelines 

302 Our Plant is on Fire. Case Histories of Gasoline 
Plant Losses, 1972 

501 Fired Heaters. Loss Causes and Guidelines for 
Safe Design and Operation, 1971 

502 Boiler Safety, 1971 

631 General Recommendations for Spacing in 
Refineries, Petrochemical Plants, Gasoline 
Plants,Terminals, Oil Pump Stations and 
Offshore Properties, 1972 

651 Loss Cause Study of Fires and Explosions in 
Engines, Compressors and Gas Turbines 

711 Truck Loading Rack Safety 

Loss Information Bulletins 

1 Hydrocrackers 

2 Alkylation Units, 1972 

400-1 Tank Fires, 1974 

Loss Control Bulletins 

400-2 ‘Jumbo’ Oil Storage Tanks, 1975 


Oyez Scientific and Technical Services Ltd 

See IBC Technical Services Ltd 

Petroleum Industry Training Board 

(London) 


Riso-M-1374 

Riso-M-1582 

Riso-M-1654 

Riso-M-1673 

Riso-M-1707 

Riso-M-1708 

Riso-M-1722 

Riso-M-1729 


Riso-M 1736 

Riso-1740 

Riso-M-1742 


PITB Safety Training Guides Guide 

1975 Personal Safety 1 

1975 Static Electricity 2 

1975 Safety Legislation for Vehicle and Plant 

Operators 3 


Riso-M-1743 


Riso-M-1794 

Riso-M-1826 


Other publications 

1971 Selection of Process Operators 

1971 The Training of Process 
Operators - Draft Recommendations 

1972 Technical Education for Process 
Operators 

1973 A Guide to Emergency Planning in Oil 
Installations 

1973 Oil Storage and Movement Driver 
and Operator Training - Draft 
Recommendations 

1975 Fire Training Manual 


2 

3 

4 

5 

6 


Riso-M-1837 

Riso-M-1878 

Riso-M-1890 

Riso-M-1894 

Riso-M-1903 


Riso National Laboratory 

(Riso, Denmark) (formerly 
Danish Atomic Energy Commission) 

Riso 256 Experiments on data presentation to 

process operators in diagnostic tasks 
byJ. Rasmussen and L.P. Goodstein, 1972 
Riso-M- 686 On the communication between operators 

and instrumentation in automatic process 
plants by J. Rasmussen, 1968 
Riso-M-706 On the reliability of process plants and 
instrumentation systems by 
J. Rasmussen, 1968 

Riso-M-808 Characteristics of operator, automatic 
equipment and designer in plant 
automation byJ. Rasmussen, 1968 


Riso-M-1907 

Riso-M-1908 

Riso-M-1983 

Riso-M-2139 

Riso-M-2162 


The cause cconsequence diagram method 
as a basis for quantitative accident 
analysis by D.S. Nielsen, 1971 
A study of mental procedures in 
electronic trouble shooting by 
J. Rasmussen and A Jensen, 1973 
A formalisation of failure mode analysis 
of control systems by J.R. Taylor, 1973 
The role of the man-machine interface in 
systems reliability by J. Rasmussen, 1973 
A semiautomatic method for qualitative 
failure mode analysis by J.R. Taylor, 1974 
Proving correctness for a real time 
operating system byJ.R.Thylor, 1974 
The human data processor as a system 
component: bits and pieces of a model by 
J. Rasmussen, 1974 
The operator’s diagnosis task under 
abnormal operating conditions in 
industrial process plant by LP. Goodstein, 

O. M. Pedersen, J. Rasmussen and 

P. Z. Skanborg, 1974 

Computer-aided diagnosis - results of a 
literature survey of medical applications 
by LP. Goodstein, 1974 
Sequential effects in failure mode 
analysis by J.R. Taylor, 1975 
Design errors in nuclear power plant by 
J.R. Taylor, 1974 

Use of cause - consequence charts in 
practical systems analysis by 
D.S. Nielsen, 1974 

Some assumptions underlying reliability 
prediction by J.R. Taylor, 1975 
Common mode and coupled failure by 
J.R. Taylor, 1975 

A study of abnormal occurrence reports 
by J.R. Taylor, 1975 
Experience with a safety analysis 
procedure by J.R. Taylor, 1976 
Interlock design using fault tree and 
cause consequence analysis by 
J.R. Taylor, 1976 

Notes on human factors problems in 
process plant reliability and safety 
prediction by J. Rasmussen and 
J.R. Taylor, 1976 

Reliability analysis of proposed 
instrument air system by D.S. Nielsen, 

O. Platz and H.E. Kongso, 1977 
Algorithms and programs for 
consequence diagram and fault tree 
construction by E. Hollo and 
J.R. Taylor, 1976 

Some points of advanced alarm system 

design by E. Hollo, 1977 

Notes on diagnostic strategies in 

process plant environment by 

J. Rasmussen, 1978 

Notes on human error analysis and 

prediction by J. Rasmussen, 1978 

Generality of component models used in 

automatic fault tree synthesis by 

J.R. Taylor, 1979 
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Riso-M-2206 

Rose-M-2285 

Riso-M-2293 

Riso-M-2304 

Riso-M-2311 

Rios-M-2311 

Riso-M-2319 

Riso-M-2341 

Riso-M-2349 

Riso-M-2351 

Riso-M-2357 


Cause-consequence reporting for 
accident reduction by 0. Bruun, 

J.R. Taylor and A. Rasmussen, 1979 
Notes on human performance analysis by 
E. Hollnagel, O.M. Pedersen and 
J. Rasmussen, 1981 
Coping with complexity by 
J. Rasmussen and M. lind, 1981 
Human errors. A taxonomy for describing 
human malfunction in industrial 
installations by J. Rasmussen, 1981 
Automatic fault tree construction with 
RIKKE — a compendium of examples, 
Volume 1 Basic models by J.R. Taylor, 1981 
Automatic fault tree construction with 
RIKKE — a compendium of examples, 
Volume 2 Control and safety loops by 
J.R. Taylor, 1981 

Risk analysis of a distillation unit by 
J.R. Taylor, 0. Hansen, C. Jensen, 

O.F. Jacobsen, M. Justesen and 
S. Kjaergaard, 1982 

The use of flow models for design of plant 
operating procedures by M. Lind, 1982 
A model of human decision making in 
complex systems and its use for design of 
system control strategies by J. Rasmussen 
and M. Lind, 1982 

Formalized search strategies for human 
risk contributions: a framework for 
further development by J. Rasmussen and 
O.M. Pedersen, 1982 
Multilevel flow modelling of process 
plant for diagnosis and control by 
M. Lind, 1982 


14 GENH AZ: A System for the Critical Appraisal 
of Proposals to Release Genetically Modified 
Organisms to the Environment, 1991 

15 Emissions from Heavy Duty Diesel Engined 
Vehicles, 1992 

16 Freshwater Quality, 1992 

17 Incineration of Waste, 1993 

18 Transport and the Environment, 1994 


Royal Society for the Prevention of Accidents 

(Birmingham) 

IS/13 Construction Regulations Handbook, 

10th ed„ 1975 

IS/29 Safety Handbook for Mobile Cranes, rev. 

ed„1974 

IS/32 Occupational Safety Committees Permit-to- 

Work Systems 

IS/72 Factory Accidents: Their Causes and Prevention 

IS/73 The Safe Use of Electricity 

IS/77 Site Register 

IS/103 RoSPA Guide to the Health and Safety at Work 
Act 1974 

IS/106 Safety at Work 

IS/108 The History of Work Safety Legislation, 1976 

See also Appendix 27 (Imperial Chemical Industries 
Ltd - RoSPA) 

Safety and Reliability Directorate - see UK Atomic 
Energy Authority, Safety and Reliability Directorate 

Safety in Mines Research Board 

(Sheffield) 


Other publications Item 

A background to risk analysis, vols I—III by 1 
J.R. Taylor, 1979 

See also individual authors in Reference List 

Royal Commission on Environmental Pollution 

(London) 

The reports are entitled Royal Commission on 
Environmental Pollution: First Report, etc. 

Reports 

1 First Report, 1971 

2 Three Issues in Industrial Pollution, 1972 

3 Pollution in Some British Estuaries and Coastal 
Waters, 1972 

4 Pollution Control, Progress and Problems, 1974 

5 Air Pollution Control: an Integrated Approach, 
1976 

6 Nuclear Power and the Environment, 1976 

7 Agriculture and Pollution, 1979 

8 Oil Pollution of the Sea, 1981 

9 Lead in the Environment, 1983 

10 Tackling Pollution: Experience and Problems, 
1984 

11 Managing Waste - the Duty of Care, 1985 

12 Best Practical Environmental Option, 1988 

13 The Release of Genetically Engineered 
Organisms to the Environment, 1989 


9 The lag on ignition of firedamp by Naylor and 
Wheeler, 1925 

36 The ignition of gases by hot wires by 

W.C.F. Shepherd and R.VWheeler, 1927 

46 The ignition of firedamp by the heat impact of rocks 
by M.M.J. Burgess and R.V.Wheeler, 1928 

54 The ignition of firedamp by the heat impact of metal 
against rock by M.M.J. Burgess and 
R.V.Wheeler, 1929 

62 The ignition of firedamp by the heat impact of hand 

picks against rocks by M.M.J. Burgess and 
R.V.Wheeler, 1930 

70 The ignition of firedamp by the heat of coal cutter 
picks against rocks by M.M.J. Burgess and 
R.V.Wheeler, 1931 

74 International Conf. on Safety in Mines at Buxton 

93 The ignition of firedamp by compression by 

Dixon and Harwood, 1935 


Safety in Mines Research Establishment 

(Sheffield) 

Electrical hazards 

1 Testing of intrinsically safe electrical equipment 

2 Research on flameproof enclosures for electrical 
equipment 

3 On-load testing of flameproof electrical equipment 

4 Arc physics 

5 Ignition of flammable gases by arc discharges 
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6 High-voltage equipment for use in flammable 
atmospheres 

7 Testing of types e and N electrical equipment and 
testing of flameproof electrical equipment 

Engineering and metallurgy 

2 Strength and energy absorption of wire ropes under 
impulsive loading 

3 Deterioration of wire ropes 

4 Metallurgical examination of faulty equipment 

5 Fatigue properties of chains 

6 Mechanical test facilities 

Explosion 

Prevention of explosions in pulverised fuel systems 

1 Fires in rigid polyurethane foam 

3 Small-scale flammability tests 

6 Behaviour of high-expansion foam in storage tanks 

Frictional ignition 

2 Frictional ignition tests with boot studs 

3 Firedamp ignition hazards from light alloys 

4 Firedamp ignition by hot surfaces produced by 
impact and friction 

5 The ignition hazard from glass 

Gas detection 

1 Use of a metallized membrane electrode in the 
monitoring of oxygen, carbon monoxide and 
other gases 

2 Catalytic oxygen-deficiency detector 

3 Infra-red hydrocarbon detector 

4 Fluorescence-quenching oxygen monitor 

5 A non-ambiguous catalytic detector for methane 

6 Gas detection with semiconductor metal oxides 

7 Circuitry techniques in a catalytic carbon-monoxide 
detector 

8 Circuitry techniques in a flashing methane alarm 

9 Circuitry techniques in a combustible-gas alarm 

10 The oxygen-deficiency hazard and its detection 

11 Gas detection with catalytic elements 

Incident investigation 

1 Use of small-scale models in the investigation of 
mine explosions 

Research Reports 

17 Ignition hazards associated with the use of a buffing 

machine underground by H. Robinson, P.B. Smith 
and H.L. Williams, 1951 
42 The ignition of firedamp by friction by 
A.H.A.Wynn, 1952 

59 Sparks from aluminium paint: the firedamp ignition 

hazard by C.S.W. Grice, 1952 
75 The ignition hazard from sparks of magnesium- 

base alloys by S.N.A Margerson etal, 1953 
90 The ignition hazard from sparks from cast alloys of 
magnesium and aluminium by H. Titman, 1954 
95 The ignition of explosive gas mixtures by friction 
by H. Titman and A.H.A.Wynn, 1954 
129 The ignition of explosive gas mixtures by small 
combustible particles. Pt 1, Ignition by particles of 
pyrophor bar by D. Rae, 1956 
177 The ignition of gas by the impact of light alloys on 
oxide-coated surfaces by D. Rae, 1959 


190 The ignition of methane-air by the glancing impact 

of metals on smears of light alloys formed on rusty 
surfaces by D. Rae, 1960 

192 Incendive frictional sparking from alloys 

containing aluminium by D. Rae and B.J. Nield, 1960 

223 The role of quartz in the ignition of methane by 
friction of rocks by D. Rae, 1964 

224 The size and temperature of a hot square in a cold 
plane surface necessary for the ignition of methane 
by D. Rae, B. Singh and R. Danson, 1964 

229 The ignition of gas by the impact of brass against 
magnesium anodes and other parts of a ship’s tank 
by D. Rae, 1965 

231 Ignition of firedamp by means other than electricity 
and explosives by H.F. Coward and H.T. Ramsay, 
1965 

236 The importance of rates of working and wear 

processes on the ignition of methane by friction by 
D. Rae, 1966 

240 Ignition of methane by electrical discharges by 
D.W.Widginton, 1966 

256 Some aspects of the design of intrinsically safe 
circuits by D.W Widginton, 1968 

Society of International Gas Tanker and Terminal 

Operators (SIGTTO) (London) 


LNG Log - A Record of Voyages Item 

Completed by the World Fleet of LNG 1 

Carriers (annual) Liquefied Gas Handling 

Principles on Ships and in Terminals 2 

Safety Aspects of the Marine 

Transportation and Storage of 

Refrigerated Liquefied Fuel Gases - A 

Review of the State of the Art 3 

Prediction of Wind Loads on Large 

Liquefied Gas Carriers 4 

Hydrates in PG cargoes - A 

Technological Review, 1984 5 

A Guide to Contingency Planning for the 

Gas Carrier at Sea and in Port Approaches 6 

A Guide to Contingency Planning for the 

Gas Carrier Alongside and Within Port 

Limits 7 

The Drift and Rescue Towage of Disabled 

Gas Carriers 8 

Safe Havens for Disabled Gas Carriers 9 

Recommendations and Guidelines for 

Linked Ship/Shore Emergency 10 

Shutdown of Liquefied Gas Cargo 

Transfer, 1987 11 

Guidelines for the Alleviation of 

Excessive Surge Pressures on BSD 12 

See also Appendix 27 

Safety and Reliability Directorate - see UK Atomic 
Energy Authority 


Technical Research Centre of Finland (VTT) 

(Espoo, Finland) 

Research Reports 

330 A comparison of automatic fault tree 

construction with hazard and operability study by 
J. Suokas and I. Karvonen, 1985 
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516 Evaluation of the validity of four hazard 

identification methods with event descriptions by 
J. Suokas and Pyy, 1988 

Other publications Item 

25 On the reliability and validity of safety 

analysis by J. Suokas, 1985 1 


TNO 

(Rijswijk.The Netherlands) 

Reports 

81- 07020 Wind tunnel modeling of the dispersion of 
LNG vapour clouds in the atmospheric 
boundary layer by L. A. Janssen, 1981 

See also individual authors in Reference List 


UK Atomic Energy Authority, Health and Safety 
Branch and Systems Reliability Service 

(Risley, near Warrington) 

Reports in AHSB, AHSB(RP) and SRS/GR series are 
prefaced in text by UKAEA, other series are not 

AHSB(RP) 


AHSB(RP) R42 

1964 

Methods of estimation of the 
dispersion of windborne 
material and data to assist in 
their application by P.M. Brynt 

AHSB series 

AHSB(S) R64 

1963 

An assessment of 
environmental hazards from 
fission product releases by 

J.R. Beattie 

AHSB(S) R91 

1965 

Reliability considerations for 
automatic protective systems 
by A.E. Green and A J. Bourne 

AHSB(S) R99 

1965 

Reliability assessment of 
protective systems for nuclear 
installations by AR. Eames 

AHSB(S) R110 

1966 

A criterion for the reliability 
assessment of protective 
systems by A J. Bourne 

AHSB(S) R113 

1966 

Assessment of sensing 
channels for high integrity 
protective systems by 

A.E. Green 

AHSB(S) R117 

1966 

Safety assessment with 
reference to automatic 
protective systems for nuclear 
reactors, Pts 1-3, by A.E. Green 
and AJ. Bourne 

AHSB(S) R119 

1966 

The use of detailed fault 
analysis in evaluating fail-safe 
equipment byA.R. Eames 

AHSB(S) R122 

1967 

The response times of 
protective systems for nuclear 
and chemical plant by 

A.R. Eames 

AHSB(S) R131 

1967 

A method of measuring 
equipment response time by 
A.R. Eames 


AHSB(S) R136 

1967 

Safety assessment - a method 
for determining the 
performance of alarm and 
shutdown systems for 
chemical plants by G. Hensley 

AHSB(S) R138 

1967 

Data store requirements 
arising out of reliability 
analyses byA.R. Eames 

AHSB(S) R160 

1969 

A quantitative approach to the 
evaluation of the safety 
function of operators on 
nuclear reactors by J.F. Ablitt 

AHSB(S) R162 

1968 

A survey of defects in pressure 
vessels built to high standards 
of construction and its 
relevance to nuclear primary 
circuit envelopes by 

C.A.G. Phillips and 

R.G. War wick 

AHSB(S) R164 

1969 

Reliability prediction by 

AE. Green 

AHSB(S) R172 

1969 

Safety assessment of 
automatic and manual 
protective systems for reactors 
by A.E. Green 

AHSB(S) R178 

1969 

The reliability prediction of 
mechanical instrumentation 
equipment for process control 
by G. Hensley 

AHSB(S) R179 

1970 

Confidence limits for numbers 
from 0 to 1200 based on the 
Poisson distribution by 
E.R.Woodcock and A.R. Eames 

SRS/GR series 

SRS/GR/1 

1973 

Plant and process reliability by 
G. Hensley 

SRS/GR/2 

1971 

Quantitative assessments of 
system reliability by A.E. Green 

SRS/GR/4 

1971 

Considerations in the use of 
system reliability models by 

A.J. Bourne 

SRS/GR/9 

1971 

Human factors by B. Sayers 

SRS/GR/12 

1973 

The effect of equipment 
reliability upon plant and 
system performance by 

A.R. Eames 

SRS/GR/13 

1973 

Some reliability characteristics 
for operating plant by 

A.R. Eames and 

C.D.H. Fothergffl 

SRS/GR/14 

1973 

An introduction to the ‘Syrel’ 
data bank by J.F. Ablitt 

SRS/GR/22 

1973 

The analysis and presentation 
of derived reliability data from 
a computerised data store by 

C. Fothergiffl 

NCSR series 

NCSRR6 

1975 

Application of diakoptical 
analysis in system reliability 
assessment 

NCSRR7 

1975 

Reliability analysis - a 
systematic approach based on 
limited data by A.J. Bourne 
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NCSRR8 

1976 

Report on the work and 
activities of the plant 
availability study group 

SRDR30 

NCSRRIO 

1976 

Human reliability in complex 
systems: an overview by 

D.E. Embrey 


NCSRR11 

1977 

The effect of operational 
loading on the failure 
characteristics of mechanical 
valves byT.R. Moss 

SRDR48 

NCSRR12 

1976 

Advances in Reliability 
Technology, ed. byT.R. Moss 

SRDR57 

NCSRR14 

1977 

The reliability analysis of 
logical networks by the 
computer program ALMONA 
by P. Brock 


NCSR16 

1979 

A literature survey of computer 
software reliability by 

B.K. Daniels and M. Hughes 

SRDR63 

NCSR17 

1979 

Reliability and protection 
against failure in computer 
systems by B.K Daniels 


NCSR21 

1979 

Optimal equipment 
replacement policies by 

R.F. de la Mare 


NCSR/GR/65 

1987 

The achievement and 
assessment of safety in nuclear 
power reactor systems 
containing software by 

C.J. Dale, A. Ball and 

M.H. Butterfield 

SRDR67 

NCSR/GR/68 

1987 

System unavailability for a 
continuous process having 
batched input or output by 

K. Evans 

SRDR68 

NCSR/GR/71 

1987 

Performance of pipework in the 
British sector of the North Sea 
by AG. Cannon and 

R.C.E. Lewis 

SRDR80 


UK Atomic Energy Authority, Safety and Reliability 
Directorate 

(Risley, near Warrington) 


SRDR1 

SRDR8 

SRDR16 

SRDR21 

SRDR26 


1971 Principles of reliability of 
nuclear reactor control and 
instrumentation systems by 
A.R. Eames 

1974 Chemical plants and 

laboratories safety assessment 
by A. Fairbairn, E.S. London, 
L.E. Lockett and A Cook, 1974 

1973 Accident probability reduction 
by the application of service 
reliability data by J.F. Ablitt 

1973 Stress concentration theory of 
fracture and its relationship to 
linear elastic fracture 
mechanics by W.H. Irvine 

1974 A stress concentration theory 
of fracture and its application 
to various crack geometries by 
W.H. Irvine 


SRDR85 

SRDR91 

SRD R95 

SRDR97 

SRDR100 

SRDR103 


1974 The second survey of defects in 
pressure vessels built to high 
standards of construction and 
its relevance to nuclear 
primary circuits by T.A Smith 
and R.G. Warwick 

1977 An elasto-plastic theory of 

fracture and its application to 
the analysis of experimental 
data by W.H. Irvine 

1976 An appraisal of the PREP 

KITTand SAMPLE computer 
codes for the evaluation of the 
reliability characteristics of 
engineered systems by P. Shaw 
and R.F. White 

1976 A description of the 
mathematical and physical 
models incorporated in 
TIRION 2 - a computer 
program that calculates the 
consequences of a release of 
radioactive material to the 
atmosphere and an example of 
its use by G.D. Kaiser 

1977 Critical review of the USCG 
report by Raj etal. (1974) on 
spills of liquid anhydrous 
ammonia on to water, with an 
alternative assessment of the 
experimental results by R.F. 
Griffiths 

1976 Accident rates from plant 
failure at high demand 
frequencies by D.H. Worledge 

1977 The use and interpretation of 
confidence and tolerance 
intervals in safety analysis by 
G.W. Parry, P. Shaw and 

D.H. Worledge 

1977 Effect of duration of release on 
the dispersion of effluent 
released to the atmosphere by 
R.F. Griffiths 

1978 A method for analysing cargo 
protection afforded by ship 
structures in collision and its 
application to an LNG carrier 
byA.N. Kinkead 

1977 The use of regeneration 
diagrams to solve component 
reliability problems by 

G.W. Parry and D.H. Worledge 

1978 HUBBLE-BUBBLE 1: a 
computer program for the 
analysis of non-equilibrium 
flows of water by D.J. Mather 

1978 Evaporation from spills of 

hazardous liquids on land and 
water by P. Shaw and F. Briscoe 

1978 The density of an ammonia 
cloud in the early stages of 
dispersion by S.R. Haddock 
and R.J. Williams 
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SRDR110 

SRDR113 

SRDR118 

SRD R125 

SRD R128 

SRD R129 

SRDR131 

SRDR134 

SRD R135 

SRDR143 
SRD R146 

SRD R149 

SRD R150 


SRDR152 


SRDR154 


1978 The incidence of multiple SRD R155 

fatality accidents in the 
UK by R.F. Griffiths and 

L. S. Fryer 

1978 The downtime distribution in 

reliability engineering by SRD R173 

G.W. Parry and D.H. Worledge 

1978 HUBBLE-BUBBLE II: a 

computer program to describe 
non-equilibrium flow of water SRD R177 
in simple pipe systems by 
D. Martin 

1978 Individual risk — a compilation 

of recent British data by SRD R190 

D.R. Grist 

1979 The role of event trees inreactor 
accident analysis by 

D.H. Worledge SRDR196 

1979 The tolerance-confidence 
relationship and safety 
analysis by G.W Parry, 

P. Shaw and D.H. Worledge 

1978 LNG/watervapourexplosions- 
estimates of pressure and 
yields by F. Briscoe and SRD R198 

G.J. Vaughan 

1978 TIRION 4: a computer program SRD R203 
for use in nuclear safety 

studies by L.S. Fryer and 
G.D. Kaiser 

1979 A method for the estimation of 

the probability of damage SRD R210 

due to earthquakes by 

M. A.H.G. Alderson SRDR217 

1979 Regeneration diagrams by 

G.W. Parry 

1979 A study of common-mode 

failures by G.T. Edwards and 

I. A. Watson, 1979 SRD R221 

1979 World-wide data on the 

incidence of multiple fatality 

accidents by L.S. Fryer and 

R.F. Griffiths SRDR229 

1979 Examples of the successful 
application of a simple model 
for the atmospheric dispersion 
of dense, cold vapours to the 
accidental release of SRD R238 

anhydrous ammonia from 
pressurised containers by 
G.D. Kaiser 

1979 DENZ - a computer program 

for the calculation of the 
dispersion of dense toxic or SRD R240 

explosive gases in the 
atmosphere by L.S. Fryer and 
G.D. Kaiser 

1979 The accidental release of SRD R241 

anhydrous ammonia to the 
atmosphere - a systematic 
study of factors influencing 
cloud density and dispersion 
by R.F. Griffiths and SRD R243 

G.D. Kaiser 


c.1979 


1980 

1980 

1981 


1981 

1981 

1981 

1982 

1982 

1983 

1982 

1983 

1983 

1983 


Validation of BK WAVE: a 
computer program for the 
calculation of one-dimensional 
shock wave propagation from 
explosions by F. Briscoe 
GASEX2: a two dimensional 
hydrodynamic code for use in 
gas cloud explosion 
calculations by D. Martin 
The metal/water explosion 
phenomenon - a review of 
present understanding by 
G.J. Vaughan 

The characterisation and 
evaluation of uncertainty in 
probabilistic risk analysis by 
G.W Parry and P.W Winter 
Defences against common¬ 
mode failures in redundant 
systems. A guide for 
management, designers and 
operators by A.J. Bourne, 

G.T. Edwards, D.M. Hunns, 
D.R. Poulter and I. A. Watson 
UK aircraft crash statistics - 
1981 revision by D. W. Phillips 
A survey of defects in pressure 
vessels in the UK for the period 
1962-1978 and its relevance to 
nuclear primary circuits by 
T.A. Smith and R.G. Warwick 
A users manual to SPILL by 
A.J. Prince, 1981 
Matching the results of a 
theoretical model with failure 
rates obtained from a 
population of non-nuclear 
pressure vessels by L.P Harrop 
A survey of turbulence models 
with particular reference to 
dense gas dispersion by 
C.L. Farmer 

Development of CRUNCH: a 
dispersion model for 
continuous releases of a 
denser-than-air vapour into 
the atmosphere by S.F. Jagger 
The transition from pressure- 
energy to gravity-driven 
slumping during the 
catastrophic release of a 
denser-than-air gas by 
S.F. Jagger 

The thermal response of tanks 
engulfed in fire by D.L.M. Hunt, 
P. Ramskill, C.G. Shepherd and 
R. Young, 1983 
A guide to the use of a 
computer program to model 
the thermal response of a 
tank engulfed in fire by 
P.K. Ramskill, 1983 
The physics of heavy gas cloud 
dispersal by D.M. Webber 
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SRDR245 

SRDR246 

SRDR251 

SRDR252 

SRDR254 

SRDR262 

SRDR263 

SRDR273 

SRDR275 

SRDR276 

SRDR277 

SRDR292 

SRDR295 

SRDR297 

SRDR299 

SRDR300 

SRDR301 


1983 Noncoherent structure theory: SRD R302 

a review and its role in fault 
tree analysis by B.D. Johnston 
and R.H. Matthews SRD R303 

1982 Seismic design criteria and 
their applicability to major 

hazard plant within the SRD R304 

United Kingdom by 
M.A.H.G. Alderson 

1983 GASEX1 - a general one¬ 
dimensional code for gas cloud SRD R307 
explosions by J. MacKenzie and 

D. Martin, 1983 

1983 Validation calculations for the 

code GASEX2 by D. Martin SRDR310 

1984 A suggested method for the 

treatment of human error in the 
assessment of major hazards SRD R314 

by R.F. White 

1983 A computational survey of the SRD R315 
factors influencing the 
pressure fields produced by 
unconfined vapour cloud by SRD R318 

J. MacKenzie 

1983 The fire hazards and counter 
measures for the protection of 
pressurized liquid petroleum 
gas storage on industrial sites 
by KW Blything SRDR319 

1983 A method of risk assessment for 

a multi-plant site by R.F. White 

1983 The physiological and 

pathological effects of thermal SRD R324 

radiation by I. Hymes 

1984 A literature review of fire 
modelling techniques and 

related subjects by I.C. Simpson SRD R325 

and N. A. Taylor 

1985 Application of the computer 

code DENZ by S.F. Jagger SRD R326 

1984 Fire/explosion probabilities on 
liquid gas ships by K.W. 

Blything and J.N. Edmondson SRDR327 

1984 Preliminary studies for the 
analysis of blast loaded 
cantilever tests by J. Jowett SRD R338 

1984 Thermal radiation hazard 

ranges from large hydrocarbon 

pool fires by M. Considine SRD R340 

1984 FIRENET - a program for 
performing probabilistic risk 
assessment of fires in SRD R341 

buildings by S.F. Hall and 
W.M. Scattergood 

c. 1984 MULTIPLET - a program for 
calculating large event trees by 
S.F. Hall SRDR342 

1984 An introduction to fuzzy set 
theory with a view to the 
quantification and 

propagation of vagueness in SRD R347 

probabilistic risk and 
reliability assessment by 
S.D. Unwin 


1985 A study of axisymmetric 
under-expanded gas jets by 
P.K. Ramskffl 

1984 A study of axi-symmetric two- 
phase flashing jets by 
P.R. Appleton 

1984 Atmospheric transmissivity - 
the effects of atmospheric 
attenuation on thermal 
radiation by I.C. Simpson 

c.1984 A modelling study of elevated 
plumes at a coastal location 
during onshore flow by 
P.J. Cooper and W. Nixon 

1984 The assessment of individual 
and societal risks by 

1986 Analysis of 100 te propane 
storage vessel by T.A. Smith 

1984 A simple parametric model for 
the dispersion of dense 
flammable gases by G.C. Grint 

1985 Thorney Island heavy gas 
dispersion trials - 
determination of path and area 
of cloud from photographs by 
A.J. Prince, D.M. Webber and 
PW.M. Brighton 

c.1985 Using concentration data to 
track clouds in the 
Thorney Island experiments 
by PWM. Brighton 

1985 Details and results of spill 

experiments of cryogenic 
liquids on to land and water by 
A.J. Prince 

c.1985 Factors influencing pool 
fires on porous ground by 
D.M. Webber 

1984 In-service reliability data for 
underground cross-country oil 
pipelines by K.W. Blything 

1985 A model of aerosol deposition 
in the lung for use in inhalation 
dose experiments by W. Nixon 

1987 The assessment of site-specific 
aircraft crash hazards by 
T.M. Roberts 

1985 Incident probabilities in liquid 
gas ships by K.W. Blything and 
R.C.E. Lewis 

c.1985 The estimation of missile 

velocities following the failure 
of a vessel containing high 
temperature pressurised water 
by D.LM. Hunt and AJ.Wood 

1985 Cargo protection afforded by 
hull structure of LPG carriers 
during grounding at low or 
drifting speeds by A.N. Kinkead 

1985 Guide to reducing human error 
in process operation (short 
version) by Human Factors in 
Reliability Group 
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SRDR352 

SRDR353 

SRD R354 

SRD R355 

SRDR357 

SRDR371 

SRDR372 

SRD R373 

SRD R375 

SRD R376 

SRDR377 

SRD R378 

SRD R379 

SRDR382 
SRD R383 

SRD R390 


1986 Discharge rate calculation SRD R393 

methods for use in plant safety 
assessment by RK. Ramskill 

1987 A review of stainless steel 
component failures by 
T.A. Smith 

1987 A description of ENGULF, a SRD R394 

computer code to model 
thermal response of a tank 
engulfed in fire by 
P.K. Ramskill and D.L.M. Hunt 

1985 Comparison between data from SRDR396 

Thorney Island heavy gas 

trials and predictions of 
simple dispersion models by 
C.J. Wheatley, A.J. Prince 
and PW.M. Brighton 

1986 A theory of heterogeneous SRDR401 

equilibrium between vapour 

and liquid phases of binary SRD R404 

systems and formulae for the 

partial pressure of HF + H 2 0 

vapour by CJ. Wheatley SRD R407 

1986 Similarity solutions for the 
spreading of liquid pools 
by D.M. Webber and SRDR410 

PW.M. Brighton 

1986 A description of the two 

dimensional combustion code 
FLARE by D. Martin 

1986 Some calculations using the 

two dimensional combustion SRD R411 

code FLARE by D. Martin 

1987 Evaporation from a plane 

liquid surface into a turbulent SRD R412 
boundary layer by 
PW.M. Brighton 

1986 Development of a model to 
predict the blast response of 
cantilevers byj.jowett and SRDR413 

J.P. Byrne 

1986 Further development of a canti¬ 

lever blast response model by 
J. Jowett, J.P. Byrne and 
T. Roberts SRDR414 

1986 The effects of missile impact 

on thin metal structures by 
J. Jowett 

1986 A review of hazard SRD R418 

identification techniques and 
their application to major 
accident hazards by SRD R421 

S.T. Parry 

1986 AEROSIM-S user manual by 

S.A. Ramsdale SRD R423 

1985 Common cause failure 

reliability benchmark exercise SRD R428 

by B.D. Johnston andj. Crackett 

1987 An integral model for 

spreading vaporising pools SRD R431 

derived from shallow-layer 
equations by D.M. Webber and 
PW.M. Brighton 


1987 A theoretical study of NH 3 
concentrations in moist air 
arising from accidental 
releases of liquefied NH 3 using 
the computer code TRAUMA 
by C.J. Wheatley 

1987 A users guide to TRAUMA, a 
computer code for assessing 
the consequences of accidental 
two-phase releases of NH 3 into 
moist air by C.J. Wheatley 

1988 Thermodynamics of mixing 
and final state of a mixture 
formed by the dilution of 
anhydrous hydrogen fluoride 
with moist air by P.N. Clough 
and C.J. Wheatley 

1987 AEROSIM-N user manual by 
S.A. Ramsdale 

1988 A model for the evaporation 
and boiling of liquid pools by 
D.M. Webber 

1986 Experiments on some effects 
of obstacles on dense gas 
dispersion by R.E. Britter 

1987 Discharge of liquid ammonia 
into moist atmospheres - a 
survey of experimental data 
and model for estimating 
initial conditions of dispersion 
by C.J. Wheatley 

1986 Common cause failure 
reliability benchmark exercise. 
Phase II by J. Crackett 

1987 Feasibility study of the 
assessment of risks involved in 
the conveyance of explosives 
by road by H. Chapman and 
PL. Holden 

1987 A users guide to ENGULF, a 
computer code to model the 
thermal response of a tank 
engulfed in fire by 
P.K. Ramskill 

1987 The development of ENGULF 
to model a multi-component 
Liquid in a fire engulfed tank 
by P.K. Ramskill 

1987 SRD Dependent Failures 
Procedures Guide by P. 
Humphreys and B.D. Johnston 

1987 Heat conduction under 
a spreading pool by 
D.M. Webber 

1987 Dry deposition to an urban 
complex by B.Y. Underwood 

1988 FPAs Guide on Fire 
Precautions by G. Burke and 
M. Finucane 

1988 Reliability of fire protection 
and detection systems by 
M. Finucane and 
D. Pinkney 
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SRDR439 

SRDR441 

SRDR442 

SRDR443 

SRDR444 
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SRDR467 

SRDR468 

SRDR474 

SRDR477 

SRDR480 

SRDR481 


1987 Criteria for the rapid SRD R483 

assessment of aircraft crash 
onto major hazard installations 
by D.W. Phillips SRDR488 

1987 An integral dynamic 

turbulence model for heavy gas 
cloud dispersal close to the 
source by D.M. Webber and 
C.J. Wheatley SRDR492 

1987 Comparison and test of models 
for atmospheric dispersion of 
continuous releases of chlorine 
by C. J. Wheatley, B.Crabol, SRDR494 

R.J. Carpenter, S.F. Jagger, 

C. Nussey, R.R Cleaver, 

R.D. Fitzpatrick and A.J. Prince 

1987 Guidelines for the design and 

assessment of concrete SRD R495 

structures subject to impact by 

P. Barr 

1988 Pipework failures - a review of SRD R500 

the historical incidents by 
KW.Blything and S.T. Parry SRDR504 

1998 Dry deposition to vegetated 
surfaces parametric 
dependencies by 

B. Y. Underwood 

1987 Likelihood as a measure of SRD R507 

uncertainty in system 
reliability and probabilistic 
safety assessment by 
A.R. Garlick 

1990 Similarity solutions for two SRD R509 

dimensional steady gravity 
currents by PWM. Brighton 

1987 The application of quality 

assurance within the UK AEA SRD R510 
by F. Allen and T.H. Nixon 

1989 Pressures produced by SRD R521 

instantaneous chlorine 

releases inside buildings by 
PW.M. Brighton SRDR530 

1989 Continuous chlorine releases 

inside buildings: concentrations 
by PWM. Brighton 

1988 Transport accident frequency 

data, their sources and their SRD R536 
application in risk assessment 
by P.R. Appleton 

1988 Assessment of missile hazards: 
review of incident experience 

relevant to major hazard plant SRD R552 

by P.L. Holden 

1989 ENGULF H: a computer code 
to model the thermal response 

of a tank partially or totally SRD R553 

engulfed in fire by 
P.K. Ramskffl 

1989 A user’s guide to ENGULF II: a 
computer code to model the 
thermal response of a tank 
partially or totally engulfed in SRD R563 

fire by P.K. Ramskill and 

C. Marriott 


1989 On the interpretation of puff- 
trajectory modelling by 
B.Y. Underwood 

1988 An initial prediction of the 
BLEVE frequency of a 100 te 
butane storage vessel by 
K.W. Blything and 
A.B. Reeves 

1988 The predicted BLEVE 
frequency of a selected 2000 m 3 
butane - sphere on a refinery 
site by M. Selway 

1989 Generalisation of the two- 
phase jet model TRAUMA to 
substances other than 
ammonia by D.N. Webber and 
PWM. Brighton 

1989 TRAUMA issue 3.5, a users 
update by S.C. Rutherford and 
D.M. Webber 

1990 The design of bunds by 
D.S. Barnes 

1989 Risk assessment of 
majorhazards. A brief 
overview of methods and 
information sources by 
P.L. Holden 

1990 A model for pool spreading and 
vaporisation and its 
implementation in the 
computer code GASP by 
D.M. Webber 

1990 The long term contribution to 
severe accident source terms 
and their mitigation by 
J.R. Mullins and P.N. Clough 

1990 Human error in risk 
assessment by J. Brazendale 

1989 A users guide to G*A*S*P* on 
microcomputers by 

D.M. Webber and S.J. Jones 

1991 Bund overtopping - the 
consequences following 
catastrophic failure of large 
volume liquid storage vessels 
byA.Wilkinson 

1990 Investigation into the ignition 
and melting characteristics of 
apparel fabrics subjected to a 
radiative heat flux by 

W. Boydell 

1993 A differential phase 

equilibrium model for clouds, 
plumes and jets by D.M. Webber 
and T. Wren 

1992 Description of ambient 
atmospheric conditions for the 
computer code DRIFT by 
A.J. Byrne, S.J. Jones, 

S.C. Rutherford, C. A. Tickle 
and D.M. Webber 

1992 Review of experimental data 
for validation of the code 
DRIFT by P.L. Edwards 
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SRDR578 

SRDR579 

SRDR582 

SRD R583 

SRD R584 

SRD R585 

SRD R 586 

SRD R 587 

SRDR552 

SRDAR1 

SRDAR3 


1992 The probability of fires in 

warehouses and storages by 

I. Hymes and J.F. Flynn 

1992 Probabilistic risk assessment 

of radio frequency ignition by 
P.J. Harrold 

1992 The effects of natural and man¬ 
made obstacles on heavy gas 
dispersion. Pt II, Dense gas 
dispersion over complex 
terrain by S.J. Jones, D. Martin, 
D.M. Webber and T. Wren 

1992 The effects of natural and man¬ 

made obstacles on heavy gas 
dispersion - report summary 
by PWM. Brighton, S.J. Jones, 
D. Martin, D.M. Webber and 
T.Wren 

1992 Mathematical modelling of 

two phase release phenomena 
in hazard analysis by 
D.M. Webber, G. A. Tickle, 
T.Wren and J. Kukkonen 

1992 Mathematical modelling of two 
phase release phenomena in 
hazard analysis - report 
summary by D.M. Webber, 

G.A.Tickle,T.Wren and 

J. Kukkonen 

1992 A model of a dispersing dense 
gas cloud and the computer 
implementation DRIFT I. 
Instantaneous releases by 
D.M. Webber, S.J. Jones, 

G.A. Tickel and T.Wren 

1992 A model of a dispersing dense 
gas cloud and the computer 
implementation DRIFT II. 
Steady continuous releases by 
D.M. Webber, S.J. Jones, 

G.A. Tickel and T.Wren 

1993 A differential phase 
equilibrium model for clouds, 
plumes and jets by D.M. Webber 
and T.Wren 

1991 Developing best operating 
procedures by Bardsley and 
Jenkins 

1991 The guide to reducing human 
error in process operation by 
P. Ball 


Welding Institute 

(Cambridge) 

Weldability of Steel by K.G. Richards, 1967 1 

Weld Preparations for Fusion Welding of Steelby 

K.G. Richards, 1966 2 

Fatigue of Welded Structures,1969 3 

Heat Treatment of Welded Structures, 2nd ed., by 
F.M. Burdekin, 1969 4 

Welding Dissimilar Metals, 1969 5 

C0 2 Welding, 3rd ed., byA.A. Smith, 1970 6 

Pipe Welding, 1970 7 


Welding Cast Austenitic Steels, 1970 
Welding Creep Resistant Steels, 1970 
Welding Procedures for Low Alloy Steels by 
N. Bailey, 1970 

Advances in Welding Processes 1971 
Brittle Fracture of Welded Structures by 
K.G. Richards,1971 

Electron-Beam Welding - Principles and Practice, 
ed. byA.H. Meleka, 1971 
(London: McGraw-Hill) 

Fatigue of Welded Structures, 1971 
Procedures and Recommendations for the 
Ultrasonic Testing of Butt Welds, 2nd ed., 1971 
Weldability of Structures and Pressure Vessels, 1971 
Improving Welded Product Design, 1972 
Lamellar Tearing in Welded Steel Fabrication, 1972 
NDT Aspects of the Significance of 
Weld Defects, 1972 

Pressure Vessel Standards - the Impact of 
Change, 1972 

Welding and Fabrication of Non-Ferrous 
Metals, 1972 

Fatigue Performance of Welded High Strength 
Steels, 1973 

Handbook of Radiographic Apparatus and 
Techniques, 1973 

Surface Coatings for Savings in Engineering, 1973 
Welding Steel without Hydrogen Cracking, 1973 
Advances in Welding Processes, 1974 
Quality Control and Non-Destructive Testing in 
Welding, 1974 

Welding Low Temperature Containment Plant, 1974 
Standard Data for Arc Welding, 1975 
The Toughness of Weld Heat Affected Zones, 1975 
Weld Decay in Austenitic Stainless Steel by 
T.G. Gooch and D.C. Willingham, 1975 
Welding Processes - Engineering Design Guide by 
P.T. Houldcroft, 1975 
(Oxford: Oxford Univ. Press) 

Recommendations for Friction Welding of Butt 
Joints in Metals for High Duty Applications,1975 
Control of Distortion in Welded Fabrication, 

2nd ed., 1976 

The Present Position Concerning the Biological 
Effects of Exposure to Fume in Welders by 

M. L Newhouse and R. Murray, 1981 
Welding Fume - Sources, Characteristics and 
Control by N. Jenkins, J. Moreton, P.J. Oakley and 
S.M. Stevens, vols 1-2,1981- 

Guidelines for Fracture-Safe and Fatigue-Reliable 
Design of Steel Structure by WS. Pellini, 1983 
The Facts about Fume, 2nd ed., ed. by 

N. Jenkins, 1986 

Introduction to the Non-Destructive Testing of 
Welded Joints by R. Halmshaw, 1988 
A Guide to Designing Welds by J. Hicks, 1989 
Weld Failures ed. by J. Harrison, 1989 
Fatigue Strength of Welded Structures, 2nd ed., by 
S.J. Maddox, 1991 

Health and Safety in Welding and Allied 
Processes, 4th ed., ed. by N.C. Balchin, 1991 
Process Pipe and Tube Welding ed. by W. Lucas, 1991 
Welding Structural and Corrosion Resistant 
Materials by J.F. Lancaster, 1992 


8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 


33 

34 
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World Health Organisation 

(Geneva) 

Environmental Health Criteria 
EHC1 Mercury 

EHC2 polychlorinated Biphenyls and Terphenyls 

EHC3 Lead 

EHC4 Oxides of Nitrogen 

EHC5 Nitrates, Nitrites and N-Nitroso Compounds 
EHC6 Principles and Methods for Evaluating the 
Toxicity of Chemicals, Pt 1 
EHC7 Photochemical Oxidants 

EHC8 Sulphur Oxides and Suspended Particulate 

Matter 

EHC9 DDTand its Derivatives 

EHC10 Carbon Disulphide 

EHC12 Noise 

EHC13 Carbon Monoxide 

EHC14 Ultraviolet Radiation 

EHC19 Hydrogen Sufflde, 1983 

EHC20 Selected Petroleum Products 

EHC21 Chlorine and Hydrogen Chloride 

EHC28 Acrylonitrile 

EHC53 Asbestos 

ECH54 Ammonia 

Note: 

Some of the series in this appendix which are shown with a 
closed range of dates are continuing series, e.g. the AlChE 
series on Ammonia Plant Safety 


B Nuclear Regulatory Commission 


Periodic Reports 
NUREG-0020 

NUREG-0040 

NUREG-0090 

NUREG-0304 

NUREG-0525 

NUREG-0540 

NUREG-0750 

NUREG-0933 

NUREG-0936 

NUREG-0940 

NUREG-1125 

NUREG-1145 

NUREG-1214 

NUREG-1415 


Licensed operators reactor status 
summary 

Licensee contractor and vendor 
inspection status report 
Report to Congress on abnormal 
occurrences 

Regulatory and technical reports 
(abstract index journal) 

Safeguards summary event list 
Title list of documents made publicly 
available 

Indexes to nuclear regulatory 
commission issuances 
A prioritization of generic safety issues 
NRC regulatory agenda 
Enforcement actions: significant actions 
resolved 

A compilation of reports of the Advisory 
Committee on Reactor Safeguards 
US Nuclear Regulatory Commission 
annual report 

Historical data summary of the 
systematic assessment of licensee 
performance 

Office of the Inspector General. 
Semi-annual Report 


Acoustic Emission Monitoring 
NUREG/CR-3825:1985 Acoustic emission/flaw 
relationship for in-service 
monitoring of nuclear pressure 
vessels 


NUREG/CR-4300:1985- 

NUREG/CR-5645:1991 

Aerosols 

NUREG/CR-1367:1981 
NUREG/CR-2139:1981 

NUREG/CR-2299:1982 
NUREG/CR-3422:1984 
NUREG / CR- 3830:1985 
NUREG / CR- 4342:1985 

NUREG / CR- 4501:1986 
NUREG / CR- 4658:1986 
NUREG/CR-4779:1987 

NUREG/CR-4997:1988 
NUREG / CR- 5162:1988 
Aging 

NUREG/ CR- 3156:1983 

NUREG / CR- 3808:1984 
NUREG-1144:1985 
NUREG / CR- 3819:1985 
NUREG / CR- 4144:1985 

NUREG / CR- 4156:1985 
NUREG / CR- 4234:1985 


NUREG / CR- 4279:1986 


Acoustic emission/flaw 
relationship for in-service 
monitoring of nuclear pressure 
vessels. Also 1986,1987 
Acoustic emission/flaw 
relationships for in-service 
monitoring of LWRs 

AEROSOL user’s manual 
Aerosols generated by free fall 
of powders and solutions in 
static air 

Aerosol release and transport 
program 

Aerosol release and transport 
program 

Aerosol release and transport 
program 

Uncertainty and sensitivity 
analysis of a model for 
multicomponent aerosol 
dynamics 

Modeling of vapor generation 
in flashing flow 
Aerosols generated by spills of 
viscous solutions and slurries 
New data for aerosols 
generated by releases of 
pressurized powders and 
solutions in static air 
Methods for describing air¬ 
borne fractions of free fall 
spills of powders and liquids 
CHARM: a model for aerosol 
behaviour in time varying 
thermal-hydraulic conditions 

A survey of state-of-the-art in 
aging of electronics with 
application to nuclear power 
plant instrumentation 
Aging-seismic correlation 
study on class IE equipment 
Nuclear plant aging research 
(NEAR) program plan 
Survey of aged power plant 
facilities 

Importance ranking based on 
aging considerations of 
components included in 
probabilistic risk assessments 
Operating experience and 
aging-seismic assessment of 
electric motors 
Aging and service wear of 
electric motor-operated valves 
used in engineered safety- 
feature systems of nuclear 
power plants 

Aging and service wear of 
hydraulic and mechanical 
snubbers used in safety-related 
piping and components of 
nuclear power plants 
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Correlation of electrical reactor 

cable failure with materials 

degradation 

Aging and service wear 

of auxiliary feedwater 

pumps for PWR nuclear 

power plants 

Nuclear plant aging research 
(NEAR) program plan 
Aging of nuclear station diesel 
generators 

An aging assessment of relays 
and circuit breakers and 
system, interactions 
Residual life assessment of 
major light water reactor 
components 

Risk evaluations of aging 
phenomena 

Degradation of nuclear plant 
temperature sensors 
An aging failure survey of light 
water reactor safety systems 
and components 
Aging and service wear of 
multistage switches used in 
safety systems of nuclear 
power plants 
Aging mitigation and 
improved programs for 
nuclear service diesel 
generators 

Life assessment procedures 
for major LWR components 
Aging assessment of 
instrument air systems in 
nuclear power plants 
Aging and service wear of 
check valves used in 
engineered safety feature 
systems of nuclear power 
plants 


NUREG/CR-4548:1986 

NUREG/CR-4597:1986 

NUREG-1144:1987 
NUREG / CR- 4590:1987 
NUREG/CR-4715:1987 

NUREG/CR-4731:1987 

NUREG/CR-4769:1987 
NUREG / CR- 4928:1987 
NUREG/CR-4747:1988 

NUREG/CR- 4992:1988 

NUREG / CR- 5057:1989 

NUREG / CR- 5314:1990 
NUREG / CR- 5419:1990 

NUREG/CP-4302:1991 


Alcohol, Drug Abuse 
NUREG-0903:1982 

NUREG/CR-3196:1983 

NUREG/CR-5784:1991 


Bolts 

NUREG-1339:1990 


Survey of industry and 
government programs to 
combat drug and 
alcohol abuse 
Drug and alcohol abuse: 
the bases for employee 
assistance programs in 
the nuclear utility 
industry 

Fitness for duty in the 
nuclear power industry 


Resolution of generic 
safety issue 29: bolting 
degradation or failure in 
nuclear power plants 


Chernobyl 

NUREG-1250:1987 

NUREG-1251:1987 

NUREG-1251:1989 

Combustion 

NUREG/CR-2658:1983 

NUREG/CR-4855:1987 

NUREG/CR-5275:1989 

Common Cause Failure 
NUREG/CR-2099:1982 

NUREG / CR-2098:1983 

NUREG/CR-2770:1983 

NUREG/CR-2771:1983 

NUREG/CR-3289:1983 
NUREG/CR-3437:1983 

NUREG/CR-4314:1985 

NUREG/CR-4780:1988 

NUREG/CR-5044:1988 
NUREG/ CR- 4780:1989 

NUREG/CR-5460:1990 


Auxiliary Feedwater System 

NUREG/CR-5404:1990 Auxiliary feedwater system 
aging 


Report on the accident at the 
Chernobyl nuclear power 
station 

Implications of the accident at 
Chernobyl for safety 
regulation of commercial 
nuclear power plants in the 
United States (draft) 
Implications of the accident at 
Chernobyl for safety 
regulation of commercial 
nuclear power plants in the 
United Sates 


Characteristics of combustion 
products: a review of the 
literature 

Development and application 
of a computer model for large- 
scale flame acceleration 
experiments 

Flame facility: the effect of 
obstacles and transverse 
venting on flame acceleration 
and transition for hydrogen-air 
mixtures 


Common cause fault rates for 
diesel generators: estimates 
based on Licensee Event 
Reports at US commercial 
nuclear power plants 
Common cause fault rates for 
pumps: estimates based on 
Licensee Event Reports at 
US commercial nuclear power 
plants 

Common cause fault rates 
for valves 

Common cause fault rates for 
instrumentation and control 
assemblies 

Common cause fault rates for 
instrumentation and control 
assemblies 

Data analysis using binomial 
failure rate common cause 
model 

Brief survey and comparison of 
common cause failure analysis 
Procedures for treating 
common cause failures in 
safety and reliability studies 
Estimation techniques for 
common cause failure events 
Procedures for treating 

safety and reliability studies 
A cause-defense approach to 
the understanding and 
analysis of common cause 
failures 
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Computer Reliability 

NUREG/CR-2118:1981 Reactor safety system design 
using hardened computers 
NUREG/CR-2288:1982 Computer surety 

NUREG/CR-3360:1984 Computer program CDCID, an 
automated quality control 
program using CDC update 


NUREG/CR-3655:1984 
NUREG/CR-4017:1984 
NUREG/CR-3987:1985 


Computer Software Reliability 

NUREG/CR-2186:1982 Quantitative software 

reliability analysis of computer 
codes relevant to nuclear safety 
NUREG/CR-4369:1986 Quality assurance (QA) plan 
for computer software 
supporting the US Nuclear 
Regulatory Commission’s 
high-level waste program 

NUREG/CR-4640:1987 Handbook of software quality 
assurance techniques 
applicable to the nuclear 
industry 


NUREG/CR-4227:1985 


NUREG/CR-4272:1985 


NUREG / CR- 3958:1986 


Containment 
NUREG/CP- 0033:1982 

NUREG/CR-3855:1985 
NUREG/CR-4119:1985 
NUREG / CR- 4149:1985 

NUREG/CR- 4220:1985 
NUREG/CR-5096:1988 

NUREG/CR-5394:1989 

NUREG/CR-5602:1990 


Proceedings of the workshop 
on Containment Integrity 
Characterization of nuclear 
reactor containment 
penetration 

Integrity of containment 
penetrations under severe 
accident conditions 
Ultimate pressure capacity of 
reinforced and prestressed 
concrete containment 
Reliability analysis of 
containment isolation systems 
Evaluation of seals for 
mechanical penetrations of 
containment buildings 
Evaluation of the leakage 
behavior of inflatable seals 
subject to severe accident 
conditions 

Simplified containment event 
tree analysis for the Sequoyah 
ice condenser containment 


NUREG/CR-4463:1986 

NUREG/CR-4577:1987 

NUREG/CR-4797:1987 
NUREG / CR- 5011:1987 

NUREG-1217:1988 

NUREG-1217:1989 

NUREG-1342:1989 

NUREG-1361:1989 


Control System, Including Displays, Alarms, Computers, 
Computer Aids 


NUREG/ CR-2776:1982 


NUREG/ CR-2988:1982 


NUREG/CR-3461:1984 


NUREG/CR-3621:1984 

NUREG/CR-3631:1984 


Alarms within advanced 
display systems: alternatives 
and performance measures 
An approach to modeling 
supervisory control of a 
nuclear power plant 
Response tree evaluations - 
implications for the use of 
artificial intelligence in 
process control rooms 
Safety system status 
monitoring 

Response trees and expert 
systems for nuclear reactor 
operators 


Control Room Design 
NUREG-0700:1981 

NUREG-0801:1981 

NUREG / CR- 3696:1984 


NUREG/CR-3975:1984 
NUREG/CR-4191:1985 


A method for analytical 
evaluation of computer-based 
decision aids 

Interim criteria for the use of 
programmable digital devices 
in safety and control systems 
Computerized annunciator 
systems 

Human engineering guidelines 
for the evaluation and 
assessment of video display 

Response tree evaluation: 
experimental assessment of an 
expert system for nuclear 
reactor operators 
Effects of control system 
failures on transients, 
accidents and core-melt 
frequencies at Combustion 
Engineering pressurized water 
reactor 

Human factors in annunciator/ 
alarm systems: annunciator 
experiment plan I 
Automated long-term 
surveillance of a commercial 
nuclear power plant 
Progress reviews of six safety 
parameter display systems 
Application of the adaptive- 
predictive controllers to plant 
safety surveillance utilizing 
online plant analyzer 
Evaluation of safety 
implications of control systems 
in LWR nuclear power plants 
(draft) 

Evaluation of safety 
implications of control systems 
in LWR nuclear power plants 
(draft) 

A status report regarding 
industry implementation of 
safety parameter display 
Lessons learned in process 
control at the Halden reactor 
project 


Guidelines for control room 
design reviews 

Evaluation criteria for detailed 
control room design review 
Potential human factors 
deficiencies in the design of 
local control stations and 
operator interfaces in nuclear 
power plants 

Identification and assessment 
of anticipated major changes in 
control rooms 

Survey of licensee control room 
habitability practices 
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NUREG/CR-5659:1990 Control room habitability 
system review models 


Corrosion 

NUREG / CR-2541:1982 

NUREG/CR-3220:1983 

NUREG/CR-3806:1984 

NUREG/CR-4221:1985 

NUREG/CR-4287:1985 

NUREG/CR-4464:1986 

NUREG/CR-4667:1986 

NUREG/CR-4723:1986 

NUREG/CR-5007:1987 

NUREG / CR- 5156:1988 
NUREG-1343:1989 


Environmentally assisted 
cracking in light water 
reactors: critical issues and 
recommended research 
Mechanistic aspects of stress- 
corrosion cracking of type 304 
stainless steel in LWR systems 
Environmentally assisted 
cracking in light water reactors 
An evaluation of stress 
corrosion crack growth in 
BWR piping systems 
Environmentally assisted 
cracking in light water reactors 
Performance demonstration 
tests for detection of intergra¬ 
nular stress corrosion cracking 
Environmentally assisted 
cracking in light water reactors 
Application of a two- 
mechanism model for 
environmentally-assisted 
crack growth 

Prediction and mitigation of 
erosive-corrosive wear in 
secondary piping systems of 
nuclear power plants 
Review of erosion -corrosion in 
single-phase flows 
Erosion/corrosion-induced 
pipe wall thinning in US 
nuclear power plants 


NUREG/CR-3723:1985 

NUREG/CR-3945:1985 

NUREG / CR- 4305:1985 
NUREG/CR- 4325:1985 

NUREG/CR-4422:1985 


NUREG/CP-0067:1986 

NUREG/CP-0077:1986 
NUREG/CR-4538:1986 
NUREG/CR-4806:1986 
NUREG/CR-4724:1987 

NUREG/CR-4841:1987 


Cost Estimation 
NUREG/CR-3971:1984 

NUREG/CR-4568:1986 

NUREG / CR- 4627:1986 


A handbook for cost 
estimating 

A handbook for quick 
estimates 

Generic cost estimates 


NUREG / CR- 4853:1987 

NUREG/CP-0092:1988 
NUREG/CR- 4828:1988 


Crack Growth, Fatigue, Fracture Mechanics 


NUREG/CR-2301:1982 


NUREG/CR-2467:1982 


NUREG/CP-0051:1984 


NUREG/CR-3644:1984 


NUREG/CR-3982:1984 


Fracture mechanics models 
developed for piping 
reliability assessment 
in light water reactors 
Lower bound KI SCC values 
for bolting materials - a 
literature study 
Proceedings of the CSNI 
specialist meeting on Leak- 
before-Break in Nuclear 
Reactor Piping 
Review of proposed 
failure criteria for ductile 
materials 

Case study of the propagation 
of a small flaw under PWR 
loading conditions and 
comparison with the ASME 
code design life 


NUREG/CR-4667:1989 
NUREG/CP-0109:1990 
NUREG/CP-0037 


Data Fitting 
NUREG-1378:1989 


Diesel Generators 
NUREG-0873:1982 

NUREG/CR-4347:1985 


Stress-intensity-factor 
influence coefficients for 
surface flaws in pressure 
vessels 

Fatigue crack growth rates of 
low-carbon and stainless steel 
piping steels in PWR 
environments 

Comments on the leak-before¬ 
break concept for nuclear 
power plant piping systems 
A parametric study of PWR 
pressure vessel integrity 
during overcooling incidents, 
considering both 2-D and 
3-D flaws 

A review of the models and 
mechanisms for 
environmentally- assisted 
crack growth of pressure vessel 
and piping steels in PWR 
environments 
Proceedings of the second 
IAEA specialists meeting on 
Subcritical Crack Growth 
Proceedings of the seminar on 
Leak-before-Break 
Fracture analysis of welded 
type 304 stainless steel pipe 
Analysis of cracks in stainless 
steel TIG welds 
Fatigue crack growth rates in 
pressure vessel and piping 
steels in LWR environments 
Fracture evaluation of surface 
cracks embedded in reactor 
vessel cladding 
Approximate methods for 
fracture analysis of through- 
wall cracked pipe 
Proceedings of the seminar on 
Leak-before-Break 
Fatigue crack growth of part- 
through cracks in pressure 
vessel and piping steels 
Environmentally assisted 
cracking in light water reactors 
Proceedings of the seminar on 
Leak-before-Break 
Proceedings of the seminar on 
Assessment of Fracture 
Prediction Technology: Piping 
and Pressure Vessels 


PLOTNFIT: a basic program 
for data plotting and curve 


A Bayesian analysis of diesel 
generator failure data 
Emergency diesel generator 
operating experience, 
1981-1983 



INSTITUTIONAL PUBLICATIONS APPENDIX 28/91 


NUREG/CR-4557:1986 

NUREG/CR- 4810:1987 

NUREG/CR- 5078:1988 


A review of issues related 
to improving nuclear power 
plant diesel generator 
reliability 
Evaluation of diesel 
unavailability and risk 
effective surveillance test 
intervals 

A reliability program for 
emergency diesel generators at 
nuclear power plants 


Dispersion in Water Courses 

NUREG-0868:1982 A collection of mathematical 
models for dispersion in 
surface water and groundwater 


Eddy Current Inspection 
NUREG/CR-2305:1982 

NUREG/CR-2824:1983 

NUREG/CR- 3200:1983 

NUREG/CR-2824:1984 
NUREG/CR-3949:1985 


Eddy current inspection for 
steam generator tubing 
program 

Eddy-current inspection for 
steam generator tubing 
program 

Eddy current inspection for 
steam generator tubing 
program: quarterly progress 
report 

Eddy-current inspection for 
steam generator tubing 
program (progress report) 
Eddy current inspection for 
steam generator tubing 
program 


Electric Motors 

NUREG/CR-4939:1988 Improving motor reliability in 
nuclear power plants 


Electrical Svstems 
NUREG/CR-2559:1982 

NUREG/CR-3063:1983 
NUREG/CR-3122:1983 

NUREG/CR- 3623:1984 

NUREG/CR-4257:1986 


Results of phase one of plant 
electrical system (PES) study 
A summary of the plant 
electrical systems (PES) study 
Potential damaging failure 
modes of high- and medium- 
voltage electrical equipment 
Status report: correlation of 
electrical cable failure with 
mechanical degradation 
Inspection, surveillance and 
monitoring of electrical 
equipment in nuclear power 
plants 


Emergency Procedures 
NUREG-0696:1981 

NUREG-0799:1981 
NUREG/CR-1970:1981 


Functional criteria for 
emergency response facilities 
Criteria for preparation of 
emergency operating 
procedures (draft) 
Development of a checklist for 
evaluating emergency 
procedures used in nuclear 
power plants 


NUREG/CR-1977:1981 
NUREG / CR-1999:1981 

NUREG / CR-2005:1981 

NUREG-0899:1982 
NUREG/CR-2005:1983 

NUREG/CR-3177:1983 
NUREG/CR-3632:1984 
NUREG-1210:1987 

NUREG-1358:1989 

NUREG / CR- 5228:1989 


Guidelines for preparing 
emergency procedures for 
nuclear power plants 
Human engineering 
guidelines for use in 
preparing emergency 
operating procedures for 
nuclear power plants 
Checklist for evaluating 
emergency operating 
procedures used in nuclear 
power plants 
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discussion of preliminary 
policy 

Workshop on Frameworks 
for Developing a Safety 
Goal 

Workshop on a Proposed 
Safety Goal 

Comments on the ACRS 
quantitative safety goals 
A survey of safety levels in 
Federal regulation 
Safety goals for nuclear power 
plants: a discussion 
Safety goals for nuclear power 
plant operation 
An analysis of the NRC safety 
goals for nuclear power 
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NUREG-1128:1985 Trial evaluations in 

comparison with the 1983 
safety goals 

NUREG/CR-4197:1985 Safety goal sensitivity studies 

NUREG/CR-4048:1986 A methodology for allocating 
reliability and risk 

Safety Issues, Prioritization of Safely Issues, Unresolved 
Safely Issues 


NUREG-0705:1981 


NUREG-0606:1985 

NUREG-0844:1985 


NUREG/CR-2800:1986 


Safety Measurement 
NUREG/CR-5568:1990 


Identification of new 
unresolved safety issues 
relating to nuclear power 
plants 

Unresolved safety issues 
summary 

NRC integrated program 
for resolution of unresolved 
safety issues A-3, A-4 
and A-5 regarding steam 
generator tube integrity (draft) 
Guidelines for nuclear power 
plant safety issue 
prioritization information 
development 


Industry based performance 
indicators for nuclear power 
plants 


Guidelines for confirmatory 
inplant tests of safety relief 
valve discharges for BWR 
plants 


Safeguards 

NUREG/ CR-1246:1981 
NUREG/CR-2404:1982 

NUREG/CR-1246:1983 
NUREG/CR-4392:1985 

NUREG-1304:1988 


SAFE user’s manual 
Analysing safeguards alarms 
and response decisions 
SAFE user’s manual 
Measures of safeguards risk 
employing PRA (MOSREP) 
Reporting of safeguards 
events 


Security 

NUREG-0768:1981 

NUREG/CR-1345:1981 
NUREG/CR-1589:1981 
NUREG/CR-2297:1982 

NUREG/CR-2546:1982 
NUREG/CR-2643:1982 


People-related problems affect¬ 
ing security in the licensed 
nuclear industry 
Nuclear power plant design 
concepts for sabotage control 
Pathfinding simulation 
(PATHS) user’s guide 
Security management 
techniques and evaluative 
checklists for security force 
effectiveness 

Reactor safeguards against 
inside sabotage 
A review of selected methods 
for protection against sabotage 
by an insider 


NUREG / CR- 3251:1984 
NUREG / CR- 3619:1984 
NUREG/CR-4462:1986 

NUREG-1178:1988 

NUREG-1267:1989 


The role of security during 
safety-related emergencies at 
nuclear power plants 
Survey of commercial 
nonnuclear security 
programs 

A ranking of sabotage/ 
tampering avoidance 
technology alternatives 
Vital equipment/area 
guidelines study 
Technical resolution of generic 
safety issue A-29: nuclear 
power plant design for 
reduction of vulnerability to 
industrial sabotage 


Seismic Events, Earthquakes 

NUREG/CR-1508:1981 Evaluation of the cost effects 
on nuclear power plant 
construction, resulting from 
the increase in seismic design 
level 

Seismic hazard analysis 
ARMA models for earthquake 
ground motions 

NUREG/ CR-1889:1981 Large LOCA-earthquake 

combination probability 

NUREG/CR-2015:1981 Seismic safety margins 

research program. Phase I 
Final Report — overview 

NUREG/CR-1120:1982 Seismic safety margins 
research program 

NUREG/CR-2405:1982 Subsystem fragility: seismic 
safety margins research 
program 

NUREG-0967:1983 Seismic hazard review for 

the systematic evaluation 
program - a use of probability 
in decision-making 

NUREG/CR-1582:1983 Seismic hazard analysis - 
overview and executive 
summary 

NUREG/ CR-2015:1983 Seismic safety margins 

research program 

NUREG/ CR-2945:1983 Characterization of 
earthquake forces for 
probability-based design of 
nuclear structures 

NUREG/CR-3315:1983 A consensus estimation study 

of nuclear power plant 
structural loads (seismic) 

NUREG/CR-3342:1983 Probabilistic models for 

operational and accidental 
loads on seismic category I 
structures 

NUREG/CR-3357:1983 Identification of seismically 

risk sensitive systems and 
components in nuclear power 
plants 

NUREG/CR-3127:1984 Probabilistic seismic 

resistance of steel 
containments 



APPENDIX 28/106 INSTITUTIONAL PUBLICATIONS 


NUREG/CR-3480:1984 
NUREG/CR- 3756:1984 

NUREG/CR-3811:1984 

NUREG-1147:1985 
NUREG/CP- 0059:1985 

NUREG/CR-3805:1985 

NUREG/CR-4145:1985 

NUREG/CR-4331:1985 

NUREG/CR-4334:1985 

NUREG/CR-4430:1985 

NUREG/CR-3805:1986 
NUREG/CR- 4431:1986 

NUREG/CR-4482:1986 


NUREG/CR-4822:1987 

NUREG/CR-4903:1987 

NUREG/CR-5073:1988 

NUREG/CR-5076:1988 

NUREG/CR-3006:1989 

NUREG/CR-5098:1989 

NUREG/CR-5250:1989 

NUREG / CR- 5270:1989 

Seismic Fragility 
NUREG/CP-0070:1985 


Value/impact assessment for 
seismic design criteria USI A- 40 
Seismic hazard 
characterization of the eastern 
United States 

Alternate procedures for the 
seismic analysis of multiply 
supported piping systems 
Seismic safety research pro¬ 
gram plan 

Proceedings of the MITI-NRC 
Seismic Information Exchange 
meeting 

Engineering characterization 
of ground motion 
Earthquake recurrence 
intervals at nuclear power 
plants: analysis and ranking 
Simplified seismic 
probabilistic risk assessment 
An approach to the 
quantification of seismic 
margins in nuclear power plants 
Current methodologies for 
assessing the potential for 
earthquake - induced 
liquefaction in soils 
Engineering characterization 
of ground motion 
Summary report on the seismic 
safety margins research 
program 

Recommendations to the 
Nuclear Regulatory 
Commission on trial guidelines 
for seismic margin reviews of 
nuclear power plants (draft) 
Broad band seismic data 
analysis 

Selection of earthquake 
resistant design criteria for 
nuclear power plants 
Quantification of margins in 
piping system seismic 
response 

An approach to the 
quantification of seismic 
margins in nuclear power plant 
Damping in building 
structures during earthquakes 
An analytical study of seismic 
threat to containment integrity 
Seismic hazard 
characterization of 69 nuclear 
power plants east of the Rocky 
Mountains 

Assessment of seismic margin 
calculation methods 


Proceedings of the workshop 
on Seismic and Dynamic 
Fragility of Nuclear Power 
Plant Components 


NUREG/CR-3558:1985 

NUREG/CR-4123:1985 

NUREG/CR- 4659:1986 
NUREG/CR- 4734:1987 

NUREG / CR- 4776:1987 
NUREG/CR- 4859:1987 
NUREG/CR-4899:1987 
NUREG / CR- 4910:1987 

NUREG/CR- 5588:1990 
NUREG/CR- 4659:1991 


Handbook of nuclear power 
plant seismic fragilities 
Seismic fragility of reinforced 
concrete structures and 
components for application to 
nuclear facilities 
Seismic fragility of nuclear 
power plant components 
(Phase 1) 

Seismic testing of typical 
containment piping 
penetration systems 
Response of seismic category I 
tanks to earthquake excitation 
Seismic fragility test of a 
6-inch diameter pipe system 
Component fragility research 
program 

Relay chatter and operator 
response after a large 
earthquake 

CARES (computer analysis for 
rapid evaluation of structures). 
Version 1 

Seismic fragility of nuclear 
power plant components 
(Phase II). A fragility 
handbook of eighteen 
components. 


Seismic and Dynamic Qualification 
NUREG-1018:1983 Seismic qualification of 

equipment in operating 
plants 

NUREG/CR-1161 Recommended revisions to 

Nuclear Regulatory 
Commissions seismic design 
criteria 

Seismic and dynamic 
qualification of safety-related 
electrical and mechanical 
equipment in operating 
nuclear power plants 
Equipment qualification 
methodology research: tests of 
pressure switches 
The use of in-situ procedures 
for seismic qualification of 
equipment in currently 
operating plants 
Seismic qualification of equip¬ 
ment in operating nuclear 
power plants (draft) 

Program plan for 
environmental qualification of 
mechanical and dynamic 
(including seismic) 
qualification of mechanical 
and electrical equipment 
program (EDQP) 

Seismic and dynamic 
qualification of related 
electrical and mechanical 
equipment 


NUREG/CR-3266:1983 


NUREG/CR-3630:1984 


NUREG/CR-3875:1984 


NUREG-1030:1985 


NUREG-1209:1986 


NUREG/CR-3137:1986 
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NUREG-1030:1987 

NUREG-1211:1987 


Seismic qualification of SLIM-MAUD 

equipment in operating NUREG/CR-3518:1984 

nuclear power plants 
Regulatory analysis for 
resolution of unresolved safety 

issue A-46: seismic NUREG/CR-4016:1987 

qualification of equipment in 
operating plants 


Severe Accident Risk Reduction Program 
NUREG-0900:1986 Nuclear power plant severe 
accident research plan 

NUREG/CR-4569:1986 A review of the severe accident 
risk reduction program 
(SARRP) containment 
event trees 

Study of severe accident 
mitigation systems 
Severe accidents insight report 
Evaluation of severe accident 
risks: quantification of major 
input parameters 
Evaluation of severe accident 
risks: quantification of major 
input parameters 
An integrated structure and 
scaling methodology for severe 
accident technical issue 
resolution (draft) 


NUREG/CR-4781:1987 

NUREG/CR-5132:1988 
NUREG/CR-4551:1990 


NUREG/CR-4551:1991 


NUREG/ CR- 5809:1991 


SourceTerms 
NUREG-0856:1985 

NUREG-0956:1985 

NUREG-0956:1986 

NUREG/CR-4587:1986 
NUREG/CR-4656:1986 

NUREG / CR- 4688:1986 


Severe Accident Risk Report (NUREG-1150) 

NUREG-1150:1987 Reactor risk reference 

document (draft) 

NUREG/CR-5000:1988 Methodology for uncertainty 
estimation in NUREG-1150 
(draft) 

NUREG/CR-5113:1988 Findings of the peer review 

panel on the draft reactor 
risk reference document 
NUREG 1150 

NUREG-1420:1990 Special committee review of 

the Nuclear Regulatory 
Commission’s severe 
accident risk report 
(NUREG-1150) 

NUREG-1150:1990 Severe accident risks: an 

assessment for five US nuclear 
power plants 

NUREG/CR-4840:1990 Procedures for the 

external event core damage 
frequency analyses for 
NUREG-1150 

NUREG-1150:1991 Severe accident risks: an 

assessment for five US nuclear 
power plants 


Sizewell B - analysis of 
British application of US PWR 
technology 


Siting 

NUREG/CR-1684:1981 A comparison of site 
evaluation methods 


NUREG-1265:1987 
NUREG / CR- 4722:1987 
NUREG / CR- 4883:1987 


NUREG-1228:1988 

NUREG/CR-5531:1991 

Steam Generators 
NUREG/CR-4079:1985 

NUREG/CR-4276:1985 

NUREG/CR-4276:1986 

Steam Supply 
NUREG-0852:1987 


SLIM-MAUD: an approach to 
assessing human error 
probabilities using structured 
expert judgment 
Application of SLIM-MAUD: a 
test of an interactive computer- 
based method for organizing 
expert assessment of human 
performance and reliability 


Reassessment of the technical 
bases for estimating source 
terms (draft) 

Reassessment of the technical 
bases for estimating source 
terms (draft) 

Reassessment of the technical 
bases for estimating source 
terms 

Source term code package: a 
user’s guide (MODI) 
Verification tests calculations 
for the source term code 
package 

Quantification and 
uncertainty analysis of source 
terms for severe accidents in 
light water reactors (QUASAR) 
Uncertainty papers on severe 
accident source terms 
Source term estimation using 
MENU-TACT 
Review of research on 
uncertainties in estimates of 
source terms from severe 
accidents in nuclear power 
plants 

Source term estimation 
during incident response to 
severe nuclear power plant 
accidents 

MELCOR 1.8: a computer code 
for nuclear reactor severe 
accident source term and risk 


Analytic studies pertaining to 
steam generator tube rupture 
accidents 

Vibration and wear in steam 
generating tubes following 
chemical clearning 
Vibration and wear in steam 
generating tubes following 
chemical clearning 


Safety evaluation report 
related to the final design of the 
standard nuclear steam supply 
reference system CESSAR 
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NUREG-1413 Safety evaluation report 

related to the preliminary 
design of the standard steam 
supply reference system 
RESAR 


Structures 

NUREG / CR-2347:1982 

NUREG/CR-2638:1982 

NUREG/CR-3628:1984 


Margins to failure - category I 
structures program: 
background and experimental 
program plan 

Snow loads for the design of 
nuclear power plant structures 
Probability based safety 
checking of nuclear plant 
structures 


System Interactions 

NUREG/CR-3922:1985 Survey and evaluation of 

system interaction events and 
sources 

NUREG/CR-4261:1986 Assessment of system 

interaction experience in 
nuclear power plants 


Thermal Hydraulic Analysis 
NUREG/CR-1157:1981 

NUREG/CR-1998:1981 


NUREG/CR-1826:1982 
NUREG/CR-3046:1983 

NUREG/CR-3257:1983 

NUREG/CR-2896:1984 

NUREG/CR-3329:1984 
NUREG/CR-3504:1984 
NUREG / CR-3772:1985 

NUREG/CR-3802:1985 

NUREG/CR-3820:1985 

NUREG/CR-3936:1985 


Thermal/hydraulic analysis 
research program: quarterly 

RELAP4/MOD7: a best 
estimate computer program to 
calculate thermal and 
hydraulic phenomena in a 
nuclear reactor or related 
system 

RELAP5/MOD1 code manual 
COBRA/TRAC - a thermal 
hydraulics code for transient 
analysis of nuclear reactor 
vessels and primary coolant 
RELAP5 assessment: LOFT 
turbine trip L6-7/L9-2 
COMMIX 1A a three- 
dimensional transient single¬ 
phase computer program for 
thermal hydraulic analysis of 
single and multicomponent 
systems 

Thermal/hydraulic analysis 
research program 
Thrbulence modeling in the 
COMMIX computer code 
RELAP5 assessment: 
semiscale small break tests 
S-UT-1, S-UT-2, S-UT-6, 
S-UT-7 and S-UT-8 
RELAP5 assessment: 
quantitative key parameters 
and run time statistics 
Thermal/hydraulic analysis 
research program (TRAC-PF1/ 
MODI) 

RELAP5 assessment: 
conclusions and user 
guidelines 


NUREG/CR-4278:1985 
NUREG/CR- 4292:1985 

NUREG/CR-3262:1986 

NUREG/CR-4371:1986 


NUREG/CR- 4830:1987 

NUREG / CR- 4312:1988 
NUREG/CR-5194:1988 

NUREG/CR-5273:1989 


Three Mile Island 

NUREG-0680:1981 

NUREG-0752:1981 

NUREG-0698:1984 


NUREG / CR- 4978:1987 
NUREG-1355:1989 


NUREG/CR-5457:1989 

Toxic Gas 

NUREG/CR-1741:1981 

NUREG/CR-3685:1984 

NUREG/CR-5656:1991 

NUREG/CR-5669:1991 

Transport 

NUREG/CR- 3499:1983 

NUREG / CR-5717:1991 


TRAC-PF1/MOD1 
development assessment 
A comparative analysis 
of constitutive relations in 
TRAC-PFL and RELAP5/ 
MODI 

COBRA-NC: a thermal 
hydraulic code for transient 
analysis of nuclear reactor 
components 
COMMIX-2: athree- 
dimensional transient 
computer program for 
thermal - hydraulic analysis 
of two-phase flows 
MELCOR validation and 
verification 1986 papers 
RELAP5/MOD2 code manual 
RELAP5/MOD2 models and 
correlations 

SCDAP/RELAP5/MOD2 code 
manual 


TMI-1 restart 

Control room design report for 
TMI-1 

NRC plan for cleanup 
operations at Three Mile Island 
Unit 2 

The cooldown aspects of the 
TMI-2 accident 
The status of 
recommendations of the 
President’s Commission on the 
Accident at Three Mile Island. 
A ten-year review 
A review of the Three Mile 
Island-1 probabilistic risk 
assessment 


Models for the estimation of 
incapacitation times following 
exposure to toxic gases or 
vapors 

Toxic gas accident analysis 
code user’s manual 
EXTRAN: a computer code for 
estimating concentrations 
oftoxic substances at control 
room air intakes 
Evaluation of exposure 
limits to toxic gases for 
nuclear reactor control room 
operators 


Severe rail and truck 
accidents:toward a 
definition of bounding 
environments for 
transportation packages 
Packaging supplier inspection 
guide 
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Two-Phase Flow 
NUREG/CR-2671:1982 

NUREG/CR-3372:1983 

NUREG/CR-4761:1986 

Utilities 

NUREG/CR-2796:1982 
NUREG/CR-2797:1982 
NUREG/CR-3351:1985 
NUREG/CR-5472:1990 

Value-Impact Analysis 
NUREG/CR- 4941:1987 

NUREG/CR-5579:1990 

Valves 

NUREG/CR-1363:1982 

NUREG/CR-3154:1983 

NUREG/CR-3914:1985 
NUREG/CR-4141:1985 

NUREG/CR-4648:1986 

NUREG/CR-4692:1987 

NUREG/CR-4999:1988 
NUREG/CR-5159:1988 


The Marviken full scale 
critical flow tests 
An analysis of wave 
dispersion, sonic velocity and 
critical flow in two-phase 


Small break critical discharge - 
roles of vapor and liquid 
entrainment in stratified 
two-phase region upstream 
of the break 

Compressed air and backup 
nitrogen systems in nuclear 
power plants 

Evaluation of events involving 
service water systems in 
nuclear power plants 
Safety implications associated 
with in-plant pressurized gas 
storage 

A risk-based review of 
instrument air systems at 
nuclear power plants 
distribution 


The application of value- 
impact analysis to USI A-45 
Value/impact assessment 
of jet impingement loads 
and pipe-to-pipe impact 


Data summaries of Licensee 
Event Reports of valves at 
US commercial nuclear 
power plants 

The in-plant reliability data 
base for nuclear power 
components: interim 
data report - the valve 
component 

Pump and valve qualification 


NUREG-1316:1989 

NUREG-1352:1990 

NUREG-1372:1990 

NUREG / CR- 5583:1990 

Water Hammer 
NUREG-0918:1982 

NUREG / CR-2059:1982 

NUREG / CR-2781:1982 
NUREG-0927:1983 

NUREG-0927:1984 

NUREG-0993:1984 
NUREG/CR-3939:1984 

NUREG / CR- 5220:1988 


Technical findings and 
regulatory analysis related to 
generic issue 70. Evaluation of 
power operated relief valve and 
block valve reliability in PWR 
nuclear power plants 
Action plans for motor- 
operated valves and check 
valves 

Regulatory analysis for the 
resolution of generic issue C-8 
‘Main steam isolation valve 
leakage and LCS failure’ 
Prediction of check valve 
performance and degradation 
in nuclear power plant 
systems - wear and impact 


Prevention and mitigation of 
steam generator water hammer 
events in PWR plants 
Compilation of data concerning 
known and suspected water 
hammer events in nuclear 
powerplants 

Evaluation of water hammer 
events in light water reactors 
Evaluation of water hammer 
experience in nuclear power 
plants 

Evaluation of water hammer 
occurrence in nuclear power 
plants 

Regulatory analysis for USI 
A-l: ‘water hammer’ 

Water hammer, flow induced 
vibration and safety/relief 
valve loads 

Diagnosis of condensation- 
induced water hammer 


Particular Nuclear Power Stations 
A Technical specifications for (name) station 
B Safety evaluation report related to the operation 
of (name) station 

-Technical 


Containment purge and vent 


specification 

evaluation 

valve test program. Final 

Beaver Valley 

1259,1279 

1057 

report 

Braidwood 

1223,1261,1276 

1002 

A study of typical nuclear 

Byron 

1097,1113 

0876 

containment purge valves in 

Calaway 


0830 

an accident environment 

Catawba 

1072,1099,1106,1182, 

0954 

Operating experience review 


1191 


of failures of power operated 

Clinton 

1202,1235 

0853 

relief valves and block 

Comanche Peak 


0797 

valves in nuclear power 

Diablo Canyon 

0817,1132,1151 

0675 

plants 

Enrico Fermi 

1089,1141 

0798 

Estimation of risk reduction 

Grand Gulf 


0831 

from improved PORV 

Hope Creek 

1186,1202 

1048 

reliability in PWRs 

LaSalle 

1013 

0519 

Prediction of check valve 

Limerick 

1088,1149 

0974,0991 

performance and degradation 

Millstone 

1161,1176 

1031 

in nuclear power plant systems 

Nine Mile Point 

1193,1253 

1047 
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Palisades 
Palo Verde 

River Bend 

San Onofre 
Seabrook 


1424 

1111,1133,1173 
1181,1248,1287 
1162,1204 
1142,1172 

1443 

1207,1331 


0712 

0857 

0887 

0989 

0517 

0896 


Shearon Harris 

South Texas Project 

Susquehanna 

Vogtle 

Waterford 

Watts Bar 

Wolf Creek 


1208,1240 
1012,1126 
1255,1334 
1042 

1237,1247,1343 
1117 

1104,1136 


1038 

0420 

0781 

0776 

1137 

0787 

0847 

0881 
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A29.1 Selected Organizations Relevant to Safety 
and Loss Prevention 

United Kingdom 

Associated Octel Company Limited, 
http://www.octel-corp.com/home/home.htm 
P.O. Box 17, Oil Sites Road, Ellesmere Port, 

Cheshire, CH65 4HF 

Phone: +44 (0) 151355 3611, Fax: +44 (0) 151356 2349 

Association of British Chemical Manufacturers - 
succeeded by Chemical Industries Association 
Association of British Insurers, 
http://www.abi.org.uk/ 

51 Gresham Street, London EC2V 7HQ 

Phone: +44 (0) 20 7600 3333, Fax: +44 (0) 20 7696 8999 

British Approvals Service for Electrical Equipment in 
Flammable Atmospheres (BASEEFA) - succeeded 
by Electrical Equipment Certification Service 

British Chemical Engineering Contractors 
Association (BCECA), 
http://www.bceca.org.uk/ 

1 Regent Street, London SW1Y 4NR 
Phone: +44(0)207839 6514 

British Chemical Industries Safety Council - succeeded 
by Chemical Industries Association 

British Cryogenic Council (BCC) - succeeded by British 
Cryoengineering Society (BCS) 

British Cryoengineering Society (BCS), 
http://www.bcryo.org.uk/ 

P.O. Box 41, Leatherhead, KT22 9YY 

Phone: +44 (0) 1372 376544, Fax: +44 (0) 1372 376544 

British Compressed Gas Association (BCGA), 
http://www.bcga.co.uk/ 

6 St Mary’s St, Wallingford, 0X10 OEL 

Phone: +44 (0) 1491825533, Fax: +44 (0) 1491826689 

British Computer Society (BCS), 
http://wwwl.bcs.org.uk/ 

1 Sanford Street, Swindon, Wiltshire, SN11HJ 
Phone: +44 (0) 1793 417417, Fax: +44 (0) 1793 480270 

British Engine Insurance Company, 

39 Windsor Place, Cardiff South Glamorgan, CF10 3BW 
Phone: +44 (0) 29 20237199 

British Fire Services Association, 
http://www.bfsa.org.uk/ 

86 London Road, Leicester LE2 OQR 

Phone: +44 (0) 116 2542879, Fax: +44 (0) 116 2542879 

British Geological Survey, 

Murchison House, West Mains Road, Edinburgh EH9 3LA 
Phone: +44 (0) 1316671000, Fax: +44 (0) 131668 2683 

British Hydromechanics Research Association - 
succeeded by BHR Group Limited 

BHR GROUP Limited 
http://www.bhrgroup.co.uk/ 

The Fluid Engineering Centre, Cranfield, 

Bedfordshire MK43 0AJ 

Phone: +44(0) 1234750422, Fax: +44(0) 1234750074 


British Insurance Association - succeeded by Association 
of British Insurers 
British Nuclear Society (BNES), 
http://www.bnes.com/ 

1-7 Great George Street, London, SW1P 3AA 
Phone: +44 (0) 20 7665 2241, Fax: +44 (0) 20 77991325 
British Occupational Hygiene Society (BoHS), 
http: // www.bohs.org/ 

Suite 2, Georgian House, Great Northern Road, 

Derby, DEI 1LT 

Phone: +44 (0) 1332 298101, Fax: +44 (0) 1332 298099 
British Pump Manufacturers Association (BPMA), 
http://www.bpma.org.uk/ 

The McLaren Building, 35 Dale End, Birmingham, B4 7LM 
Phone: +44 (0) 1212001299, Fax: +44 (0) 1212001306 

British Rail - privatized and succeeded by the 
Rail Industry Training Council (RITC Ltd) 

British Red Cross Society, 
http://www.redcross.org.uk/ 

9 Grosvenor Crescent, London SW1X 7EJ 

Phone: +44 (0) 20 7235 5454, Fax: +44 (0) 20 7245 6315 

British Safety Council, 

http: //ww2.bri tishsafetycouncil.org/ 

70 Chancellors Road, LondonW6 9RS 

Phone: +44 (0) 20 87411231, Fax: +44 (0) 20 87414555 

British Standards Institution (BSI), 

http://www.bsi-global.com/ 

389 Chiswick High Road, London, W4 4AL 

Phone: +44 (0) 20 8996 9000, Fax: +44 (0) 20 8996 7001 

British Waterways, 

http: //www.britishwaterways.co.uk/ 

Willow Grange, Church Road, Watford, WD174QA 
Phone: +44 (0) 1923 201120 
Building Research Establishment Ltd (BRE), 
http://www.bre.co.uk/ 

Garston, Watford WD25 9XX 
Phone: +44 (0) 1923 664 000 

Chamber of Shipping of the UK, 
http: //www.british-shipping.org/ 

Carthusian Court, 12 Carthusian Street, 

London EC1M 6EZ 

Phone: +44 (0) 20 7417 2800, Fax: +44 (0) 20 7726 2080 

Chemical and Allied Product Industry Training Board — 
now disbanded 

Chemical Industries Association (CIA), 
http://www.cia.org.uk/ 

Kings Buildings, Smith Square, London SW1P 3JJ 
Phone: +44 (0) 20 7834 3399, Fax: 020 7834 4469 

Chemical Industry Safety and Health Council — succeeded 
by Chemical Industries Association 

The Chemical Society - see the Royal Society 
for Chemistry 

Chief and Assistant Fire Officers Association (CACFOA), 
http://www.fire-uk.org/ 

9 -11 Pebble Close,Tamworth, Staffordshire, B77 4RD 
Phone: +44 (0) 1827 302300, Fax: +44 (0) 1827 302399 
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Confederation of British Industry (CBI), 
http://www.cbi.org.uk/ 

103 New Oxford Street, London WC1A1DU 
Phone: +44 (0) 20 7379 7400, Fax: +44 (0) 20 7240 8287 

Council for Oil and Gas Extraction, Chemicals 
Manufacturing and Petroleum Industries (COGENT) 
http://www.cogent-ssc.com/ 

Monticello House, 45 Russell Square, London WC1B 4JP 
Phone: +44(0)20 6379533, Fax: +44(0)2072916129 

Electrical Equipment Certification Service (EECS) - 
part of HSE but disbanded in 2002 

Engineering Council, (UK), 
http://www.engc.org.uk/ 

10 Maltravers Street, LondonWC2R 3ER 

Phone: +44 (0) 20 7240 7891, Fax: +44 (0) 20 7379 5586 

Engineering Equipment Users Association - succeeded 
by Engineering Equipment and Materials Users 
Association 

Engineering Equipment and Materials Users Association, 
http://www.eemua.co.uk/ 

3rd Floor, 30 Long Lane, London EC1A 9HL 
Phone: +44 (0) 20 77961293, Fax: +44 (0) 20 77961294 

The Fellowship of Engineering - now The Royal Academy 
of Engineering 

Fire Officers Committee - see Association of 
British Insurers 

Fire Protection Association (FPA), 
http://www.thefpa.co.uk/ 

Bastille Court, 2 Paris Garden, London SE18ND 
Phone: +44 (0) 20 7902 5300, Fax: +44(0) 20 7902 5301 

Fire Industry Confederation (FIC) 
http://www.the-fic.org.uk/ 

Neville House, 55 Eden Street, Kingston upon Thames, 
Surrey, KT11BW 

Phone: +44 (0) 20 8549 8839, Fax: +44 (0) 20 85471564 

Fire Research Station (FRS), 
http://www.bre.co.uk/frs/ 

FRS, the Fire Division of BRE, Garston, 

Watford WD25 9XX 

Phone: +44 (0) 1923 664700, Fax: +44 (0) 1923 664910 

Fire Service College, 

http: //www.fireservicecollege. ac.uk / 

Friends of the Earth Ltd., 
http://www.foe.co.uk / 

26-28 Underwood Street, London N17JQ 

Phone: +44 (0) 20 74901555, Fax: +44 (0) 20 7490 0881 

Health and Safety Commission/Executive (HSC/E), 
http: //www.hse.gov.uk/ 

2 Rose Court, 2 Southwark Bridge, London SE19HS 
Phone: +44 (0) 20 7556 2100, Fax: +44 (0) 20 7556 2109 

Health and Safety Executive, 

Research and Laboratory Division, 
http://www.hse.gov.uk / research/ 

Broad Lane, Sheffield, S3 7HQ 

Phone: +44 (0) 114 289 2000, Fax: +44 (0) 114 289 2500 


High Pressure Technology Association, 
http: / / w w w.liv. ac.uk/ ~ jsl/hpta.html 
c/o Department of Chemistry, University of Liverpool, 
Liverpool L69 7ZD 

Phone: +44 (0) 151794 3530, Fax: +44 (0) 151794 3588 
HM Stationery Office (HMSO), 
http://www.hmso.gov.uk/ 

The Stationery Office Ltd, P.O. Box 29, Norwich, NR31GN 
Phone: +44 (0) 870 600 5522, Fax: +44 (0) 870 600 5533 
Home Office, 

http://www.homeoffice.gov.uk/ 

Room 856,50 Queen Anne’s Gate, London SW19AT 
Phone: +44 (0) 870 0001585, Fax: +44(0) 20 7273 2065 

Imperial Chemical Industries pic, 

20 Manchester Square, London,W1U 3AN 
Phone: +44 (0) 20 7009 5000, Fax: 44 (0) 20 7009 5001 

Imperial Chemicals Insurance, 

1 Adam Street, LondonWC2 

Industrial Fire Protection Association of Great Britain, 

140 Aldersgate Street, London EC1A 4HX 
Phone: +44(0)2076063757 

Industrial Safety (Protective Equipment) Manufacturers 
Association, 

69 Cannon Street, London EC4N 5AB 
The Industrial Society - now disbanded 

Institute of Cancer Research, 
http://www.icr.ac.uk/ 

123 Old Brompton Road, London SW7 3RP 
Phone: +44(0) 20 7352 8133, Fax: +44(0) 20 7370 5261 

Institute of Geological Sciences - see British 
Geological Survey 

Institute of Materials (IOM), 
http://www.iom3.org/ 

1 Carlton House Terrace, London SW1Y 5DB 
Phone: +44 (0) 20 74517300, Fax: +44 (0) 20 78391702 

Institute of Measurement and Control, 
http://www.instmc.org.uk/ 

87 Gower Street, London WC1E 6AA 

Phone: +44 (0) 20 73874949, Fax: +44 (0) 20 7388 8431 

Institute of Metals - see Institute of Materials 

Institute of Oceanographic Sciences (IOSDL), 
http://wofiles.nwo.ac.uk/ 

Deacon Laboratory, Brook Road, Wormley, Godaiming, 
Surrey GU8 5UB 

Phone: +44 (0) 428 684141, Fax: +44 (0) 428 683066 

Institute of Offshore Engineering (IOE), 
http://www.civ.hw.ac.uk/ 

Heriot-Watt University, Research Park, Riccarton, 

Currie, Edinburgh EH14 4AP 
Phone: +44(0) 1314513151, Fax: +44(0) 131449 6254 

Institute of Petroleum, 
http://www.petroleum.co.uk/ 

61 New Cavendish Street, London,WIG 7AR 
Phone: +44 (0) 20 7467 7100, Fax: +44 (0) 20 72551472 
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Institute of Physics (IOP), 
http://www.iop.org/ 

76 Portland Place, London W1B1NT 

Phone: +44 (0) 20 7470 4800, Fax: +44 (0) 20 7470 4848 

Institution of Chemical Engineers (IChemE), 
http://www.icheme.org/ 

Davis Building, 165—189 Railway Terrace, 

Rugby CV213HQ 

Phone: +44(0) 1788 578214, Fax: +44(0) 1788 560833 

Institution of Civil Engineers (ICE), 
http: / /w w w.ice. org.uk / 

One Great George Street,Westminster, London SW1P 3AA 
Phone:+44 (0)20 7222 7722 

Institution of Electrical Engineers (IEE), 
http://www.iee.org/ 

Savoy Place, London WC2R OBL 

Phone: +44 (0) 20 72401871, Fax: +44 (0) 20 7240 7735 

Institution of Fire Engineers (IFE), 
http://www.ife.org.uk/ 

148 Upper New Walk, Leicester LEI 7QB 

Phone: +44 (0) 116 255 3654, Fax: +44 (0) 116 2471231 

Institution of Gas Engineers, 
http: / /w ww.igaseng.com/ 

17 Grosvenor Crescent, London SW1X 7ES12 York Gate 
London NW14QG 

Phone: +44 (0) 20 7487 0650, Fax: +44 (0) 20 7224 4762 

Institution of Industrial Safety Officers - see Institution of 
Occupational Safety and Health 

Institution of Marine Engineers (IMarEST), 
http: / / www.imarest.org/ 

Institution of Mechanical Engineers (IMechE), 
http://www.imeche.org.uk/ 

1 Birdcage Walk, Westminster, London, SW1H 9JJ 
Phone: +44 (0) 20 7222 7899, Fax: +44 (0) 20 7222 4557 

Institution of Nuclear Engineers (INE), 
http://www.inuce.org.uk/ 

Allan House, 1 Penerley Road, London SE6 2LQ 
Phone: +44 (0) 208 6981500, Fax: +44 (0) 208 695 6409 

Institution of Occupational Safety and Health (IOSH), 
http://www.iosh.co.uk/ 

The Grange, Highfield Drive, Wigston, 

Leicestershire LE18 INN 

Phone: +44 (0) 116 257 3100, Fax: +44 (0) 116 257 3101 

Institution of Plant Engineers - succeeded by 
The Society of Operation Engineers (SOE) 

Insurance Technical Bureau - now disbanded 

Joint Fire Research Organisation - see Fire Research 
Station 

Liquefied Petroleum Gas Industry Technical Association, 
17 Grosvenor Crescent, London SW1X 7EF 

Loss Prevention Council - purchased by BRE and now 
is the Fire Division (FRS) of the Building 
Research Establishment Ltd (BRE) 


Medical Research Council (MRC), 
http://www.mrc.ac.uk/ 

20 Park Crescent, London W1B1AL 

Phone: +44 (0) 20 7636 5422, Fax: +44 (0) 20 7436 6179 

Meteorological Office (MET), 
http: //www.met-office.gov.uk/ 

London Road, Bracknell, Berkshire RG12 2SZ 
Phone: +44 (0) 845 300 0300, Fax: +44 (0) 845 3001300 

Ministry of Defence, Defence Science and 
Technology Laboratory (DSTL), 
http://www.dstl.gov.uk/ 

Porton Down, Salisbury, Wiltshire SP4 0JQ 
Phone: +44(0) 1980 613121, Fax: +44(0) 1980 613085 

Ministry of Defence, Directorate of Safety Environment 
and Fire Policy (DSEF), 
http://www.mod.uk/dsef/ 

Old War Office, Whitehall, London SW1A 2EU 
Phone: +44(0)870 6074455 

Down Ministry of Defence, 

Tidal Branch, Hydrographic Department (UKHO) 
http://www.hydro.gov.uk/ 

Admiralty Way, Taunton, Somerset TA12DN 
Phone: +44 (0) 1823 337900, Fax: +44 (0) 1823 284077 

National Engineering Laboratory (NEL), 
http://www.nel.uk/ 

East Kilbride, Glasgow, G75 0QU 

Phone: +44 (0) 1355 220222, Fax: +44 (0) 1355 272999 

National Society for Clean Air (NSCA), 
http: //www.nsca.org.uk/ 

44 Grand Parade Brighton, UK BN2 9QA 

Phone: +44 (0) 1273 878770, Fax: +44 (0) 1273 606626 

National Radiological Protection Board (NRPB), 
http://www.nrpb.org/ 

Chilton, Didcot, Oxon, OX110RQ 

Phone: +44 (0) 1235 831600, Fax: +44 (0) 1235 833891 

National Vulcan Engineering Insurance Group, 

3 St Mary, Parsonage, Manchester M60 9AP 
Phone: +44618348124 

Oil and Chemical Plant Manufacturers Association, 
Suites 41—48,87 Regent Street, LondonW1R 7HF 

Petroleum Industry Training Board - succeeded by 
Petroleum Industry National Training Organisations 
(PINTO), and then by the Council for Oil and 
Gas Extraction, Chemicals Manufacturing and 
Petroleoum Industries (COGENT) 

Rail Industry Training Council (RITC) 
http://www.ritc.org.uk/ 

B118 Macmillan House, Paddington Station, 

LondonW21FT 

Phone: +44 (0) 870 2202773, Fax: +44 (0) 870 2202774 

The Royal Academy of Engineering, 
http:/www.raeng.org.uk/ 

29 Great Peter Street, Westminster, London SW1P 3LW 
Phone: +44 (0) 20 7222 2688, Fax: +44 (0) 20 7233 0054 

The Royal Institute of Chemistry - incorporated in 
The Royal Society of Chemistry 
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The Royal Meteorological Society, 
http://www.royal-met-soc.org.uk/ 

104 Oxford Road, Berkshire RG17LL 

Phone: +44 (0) 118 9568500, Fax: +44 (0) 118 9568571 

The Royal Society, 
http://www.royalsoc.ac.uk/ 

6-9 Carlton House Terrace, London SW1Y 5AG 
Phone: +44 (0) 20 7839 5561, Fax: +44 (0) 20 7930 2170 

The Royal Society of Chemistry (RSC), 
http://www.rsc.org/ 

Burlington House, Piccadilly, London W1J 0BA 
Phone: +44 (0) 20 7437 8656, Fax: +44 (0) 20 7437 8883 

The Royal Society for the Prevention of Accidents (RoSPA), 
http: //www.rospa.com/CMS/ 

Edgbaston Park, 353 Bristol Road, Edgbaston, 
Birmingham B5 7ST 

Phone: +44 (0) 121248 2000, Fax: +44 (0) 121248 2001 
Safety in Mines Research Establishment 

Sheffield Safety and Reliability Directorate - see 
UK Atomic Energy Authority 

Safety and Reliability Society, 

http: //www.sars.u-net.com 

Clayton House, 59 Piccadilly, Manchester Ml 2AQ 

Phone: +44 (0) 161228 7824, Fax: +44 (0) 161236 6977 

Society of Chemical Industry (SCI), 
http: / /www. soci .org/ SCI/ 

14-15 Belgrave Square, London SW1X 8BS 
Phone: +44 (0) 20 75981500, Fax: +44 (0) 20 75981545 

Society of Gas Tanker and Terminal Operators (SIGTTO), 
http://www.sigtto.org/ 

Liaison Office, 17 St. Helen’s Palace, London, EC3A 6DG 
Phone: +44 (0) 20 76281134, Fax: +44 (0) 20 7628 3163 

Society of Occupational Medicine (SOM), 
http: //www.som.org.uk/ 

Royal College of Physicians, 6 St. Andrew’s Place, 

Regent’s Park, London NW14LB 
Phone: +44 (0) 20 7486 2641, Fax: +44 (0) 20 7486 0028 

The Society of Operation Engineers (SOE), 
http://www.soe.org.uk/soe.org/ 

22 Greencoat place, London, SW1P1PR, 

Phone: +44 (0) 20 76301111, Fax: +44 (0) 20 7630 6677 

Trades Union Congress (TUC), 
http://www.tuc.org.uk/ 

23-28 Great Russell Street, London WC1B 3LS 

Transport and Road Research Laboratory (TRL), 
http://www.trl.co.uk/ 

Old Wokingham Road, Crowthorne 
Berkshire, RG45 6AU 

Phone: +44(0) 1344770007, Fax: +44(0) 1344770880 

TUC Centenary Institute of Occupational Health, 

London School of Hygiene and Tropical Medicine, 
http://www. tuc.org.uk/hjand_s/ 
http: //www.lshtm.ac.uk/ 

Keppel Street, London WC1E 7HT 

Phone: +44 (0) 20 7636 8636, Fax: +44 (0) 20 7436 5389 


UK Atomic Energy Authority (UKAEA), 
http://www.ukaea.org.uk/ 

Harwell International Business Centre, Didcot, 

Oxon, OX11 ORA 
Phone: +44 (0) 1235 820220 
UK Atomic Energy Authority, Safety and Reliability 
Directorate 

WigshawLane, Culcheth, Warrington, Lancashire 
The Welding Institute (TWI), 
http://www.twi.co.uk/ 

Granta Park, Great Abington, Cambridge CB16AL, UK 
Phone: +44 (0) 1223 891162, Fax: +44 (0) 1223 892588 

United States 

Air Pollution Control Association, 

Pittsburgh, PA 15230 

American Association for Artificial Intelligence (AAAI) 
http://www.aaai.org/ 

445 Burgess Drive, Menlo Park, CA 94025-3442 
Phone: +1 (650) 328 3123, Fax: +1 (650) 3214457 

American Chemistry Council (ACC), 
http: / /w w w.americanchemistry. com/ 

1300 Wilson Blvd. Arlington, VA 22209 
Phone: +1 (703) 7415000, Fax: +1 (703) 7416000 

American Chemical Society (ACS), 
http: / / www.chemistry.org/ 

115516th Street, NW, Washington, DC 20036 
1300 Wilson Blvd. Arlington, VA 22209 
Phone: +1 (703) 7415000, Fax: +1 (703) 7416000 

American Chemical Society (ACS), 
http: / / ww.chemistry.org/ 

Phone: +1 (800) 227 5558 (US only), +1 (202) 872 4600 
(outside the US), Fax: +1 (202) 872 4615 

American Gas Association (AGA), 
http://www.aga.org/ 

400 N. Capitol Street, N.W.Washington, DC 20001 
Phone: +1 (202) 824 7000, Fax: +1 (202) 824 7115 

American Industrial Hygiene Association (AIHA), 
http://www.aiha.org/ 

2700 Prosperity Avenue, Suite 250, Fairfax, VA 22031 
Phone: +1 (703) 849 8888, Fax: +1 (703) 207 3561 

American Institute for Aeronautics and 
Astronautics (AIAA), 
http://www.aiaa.org/ 

1801 Alexander Bell Drive, Suite 500 
Reston,VA 20191-4344 

Phone: +1 (703) 2647500, Fax: +1 (703) 2647551 

American Institute of Chemical Engineers (AIChE), 
http://www.aiche.org/ 

3 Park Avenue, New York, NY 10016-5991 
General Inquiries: +1 (212) 5917338, 

Fax: +1(212)5918897 

American Insurance Association (AIA), 
http:/ /www. aiadc.org/ 

Washington, D.C. Headquarters 

1130 Connecticut Ave, NW 

Ste. 1000,Washington, DC 20036 

Phone: +1 (202) 828 7100, Fax: +1 (202) 2931219 
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American Meteorological Society (AMS), 
http://www.ametsoc.org/AMS/ 

Headquarters, 45 Beacon Street, Boston, MA 02108-3693 
Phone: +1 (617) 227 2425, Fax: +1 (617) 742 8718 

American National Standards Institute (ANSI), 
http://www.ansi.org/ 

New York City Office (Operations), 25 West 43rd Street, 

4th Floor, New York, NY 10036 
Phone: +1 (212) 642 4900, Fax: +1 (212) 398 0023 

American Nuclear Society (ANS), 
http://www.ans.org/ 

555 N Kensington Avenue, Lagrange Park, IL 60525 
Phone: +1 (708) 352 6611, Fax: +1 (708) 352 0499 

American Petroleum Institute (API), 
http://www.api.org / 

1220 L Street, NW, Washington, DC 20005-4070 
Phone:+1(202) 682 8000 

American Society of Civil Engineers (ASCE), 
http://www.asce.org/ 

1801 Alexander Bell Drive, Reston, Virginia 20191-4400 
Phone: +1 (703) 295 6300, Fax: +1 (703) 295 6222 

American Society of Heating, Refrigerating and 
Ventilating Engineers - succeeded by American 
Society of Heating, Refrigerating and Air-Conditioning 
Engineers (ASHRAE), 
http://www.ashrae.org/ 

1791 TUllie Circle NE, Atlanta, GA 30329 
Phone: +1 (404) 636 8400, Fax: +1 (404) 3215478 

American Society of Mechanical Engineers (ASME) 
http://www.asme.org/ 

Headquarters,Three Park Avenue, New York, 

NY 10016-5990 

Phone: +1 (212) 5917722, Fax: +1 (212) 5917674 

American Society for Quality (ASQ), 
http: / /w w w.asq. org/ 

600 North Plankinton Avenue, Milwaukee,WI53203 
Phone: +1 (414) 272 8575, Fax: +1 (414) 2721734 

American Society of Safety Engineers (ASSE), 
http://www.asse.org/ 

Customer Service: 1800 E Oakton St., Des Plaines, IL 60018 
Phone: +1 (847) 699 2929, Fax: +1 (847) 768 3434 

American Society for Testing and Materials (ASTM), 
http://www.astm.org/ 

100 Barr Harbor Drive, P.O. Box C700,West Conshohocken, 
PA 19428-2959 

Phone: +1 (610) 832 9585, Fax: +1 (610) 832 9555 

American Standards Association - now 
American National Standards Institute (ANSI) 

American Trucking Association (ATA), 
http://www.truckline.com/ 

2200 Mill Road, Alexandria, VA 22314-4677 
Phone:+1(703) 8381700 

American Welding Society (AWS), 
http://www.aws.org/ 

550 Lejeune Road, Miami, FL 33126 
Phone:+1(800) 443 9353 


Argonne National Laboratory, 
http: //www.anl.gov/ 

Main site: 9700 South Cass Avenue, Argonne, IL 60439 

Phone: +1(630)252 2000 

Idaho site: Argonne-West, P.O. Box 2528, 

Idaho Falls, ID 83403-2528. 

Phone: +1(208)5337341 

Association of American Railroads (AAR), 
http: //www.aar.org/ 

50 F Street NW, Washington, DC 20001-1564 
Phone: +1 (202) 639 2200, Fax: +1 (202) 639 2439 

Atomic Energy Commission — now Nuclear 
Regulatory Commission 

Ballistics Research Laboratories, 
http://www.apg.army.mil/default.htm 
Aberdeen Proving Ground, MD 21005 
Phone: +1(410)3061403 

Battelle Columbus Laboratory, 
http: //www.battelle.org/def ault.stm 
505 King Avenue, Columbus, OH 43201 
Phone: +1 (614) 424 6424, Fax: (614) 424 5263 

Battelle Northwest Laboratory, 
http://www.pnl.gov/ 

092 Battelle Boulevard, Richland, WA 99352 
Phone: +1(509)3752121 

Brookhaven National Laboratory, 
http://www.bnl.gov/world/ 

P.O. Box 5000, Upton, NY 11973-5000 
Phone: +1(631)3448000 

Bureau of Mines (USMB) - closed in 1996 see 
Minerals Information Team, USGS Geologic Division 

Center for Chemical Process Safety (CCPS), 
http://www.aiche.org/ccps/ 

American Institute of Chemical Engineers, 3 Park Ave, 
New York, N.Y., 10016-5991 
Phone: +1 (212) 5917319, Fax: +1 (212) 5918895 

Chemical Manufacturers Association (CMA), 
www.cmahq.com/ 

Wilson Boulevard, Arlington,Virginia 22209 
Phone: +1 (703) 7415922, Fax: +1 (703) 7416922 

Chemical Transport Emergency Center (CHEMTREC), 
http://www.chemtrec.org/ 

1300 Wilson Blvd, Arlington, VA. 22209 
Phone: +1 (703) 7415523, Fax: +1 (703) 7416037 

Chemical Safety and Hazard Investigation Board (CSB), 
http://www.chemsafety.gov/ 

2175 K. Street N.W.-Suite 400, Washington, 

D.C. 20037-1809 

Phone: +1 (202) 2617600, Fax: +1 (202) 2617650 

Chlorine Institute, 
http://www.cl2.com/ 

1300 Wilson Blvd., Rosslyn,VA 22209 
Phone: +1 (703) 7415760, Fax: +1 (703) 7416068 

Clearinghouse for Occupational Safety and 
Health Information, Public Health Service, 

4676 Columbia Parkway, Cincinnati, OH 45226 
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Combustion Institute, 

http: //www.combustioninstitute.org/ 

5001 Baum Road, Suite 635, Pittsburgh, 

PA 15213-1851 USA 
Phone: +1(412)6871366 
Fax:+1(412) 6870340 
Compressed Gas Association (CGA), 
http: / / www. cganet.com/ 

4221 Walney Road, 5th Floor, Chantilly VA 20151-2923 
Phone: +1 (703) 788 2700, Fax: +1 (703) 9611831 

Department of Transportation Research and 
Special Programs Administration, 

Office of Hazardous Materials (OHM) 
http://hazmat.dot.gov/ 

DHM-1400 7th Street SW, Washington, DC 20590 
Washington, DC 20590-0001 
Phone: +1 (202) 366 0656, Fax: +1 (202) 366 5713 
Department of Transportation, US Coast Guard 
http: //www.uscg.mil/hq/g-m/gmhome.htm 
2100 Second Street SW,Washington, DC 20593-0001 
Phone: +1 (202)2672200, Fax: +1 (202) 2674839 
Dow Chemical Company, 

Bldg 566, Midland, MI 48640 

Earthquake Engineering Research Institute (EERI), 

http://www.eeri.org/ 

49914th Street Suite 320, Oakland, CA 94612-1934 
Phone: +1 (510) 4510905, Fax: +1 (510) 4515411 
Electric Power Research Institute (EPRI), 
http: //www.epri.com/ 

3412 Hillview Avenue, Palo Alto, CA 94304 
Phone: +1(800)3133774 
Environmental Protection Agency (EPA), 

Office of Research and Development (ORD), 
http: //www. epa.gov/ord/ 

EPA Headquarters: Ariel Rios Building, 

1200 Pennsylvania Avenue, N.W. 

Mail Code 3213A,Washington, DC 20460 

Phone: +1(202)2602090 

Ethylene Oxide Industry Council (EOIC), 

2501M Street NW, Washington, DC 20037 
Factory Insurance Association — see Industrial 
Risk Insurers 

Factory Mutual Research Corporation (FMRC), 
www.fmglobal.com 

1151 Boston-Providence Turnpike, Norwood, MA 02062 
Phone: +1 (781)762 4300 
Factory Mutual System, 
http: //www.fmglobal.com/ 

1301 Atwood Avenue, P.O. Box 7500 Johnston, R.1.02919 
Phone: +1 (401) 275 3000, Fax: +1 (401) 275 3029 
Federal Emergency Management Agency (FEMA), 
http://www.fema.gov/ 

500 C Street, SW Washington, DC 20472 
Phone: +1(202)5661600 
Federal Energy Regulatory Commission (FERC), 
http://www.ferc.gov/ 

888 First Street, N.E., Washington, DC 20426 
Phone:+1(866) 208 3372 


Federal Power Commission - see Federal 
Energy Regulatory Commission 
Gas Technology Institute (GTI), (formed through the 
merger of Institute of Gas Technology and Gas 
Research Institute) 
http://www.gri.org/ 

1700 S. Mount Prospect Road, Des Plaines, IL 60018 
Phone: +1 (847) 768 0500, Fax: +1 (847) 768 0501 
Hartford Steam Boiler Inspection and Insurance Company, 
http://www.hsb.com/ 

One State Street, P.O. Box 5024, Hartford CT 06102-5024 
Phone: +1 (860) 7221866, Fax: +1 (860) 722 5106 

Human Factors Society - succeeded by Human Factors 
and Ergonomics Society 

Human Factors and Ergonomics Society (HFES), 
http://hfes.org/ 

Box 1369, Santa Monica, CA 90406 

Phone: +1 (310) 3941811, Fax: +1 (310) 394 2410 

Idaho National Laboratory, 
http://www.inel.gov/ 

2525 Fremont Avenue, P.O. Box 1625, Idaho Falls, ID 83415 
Phone: +1(800)7082680 

Industrial Risk Insurers (IRI), 
http: / / www.industrialrisk.com / 

85 Woodland Street, Hartford, CT 06102-5010 
Phone: +1 (860) 520 7300, Fax: +1 (860) 520 7397 

Institute of Electrical and Electronic Engineers (IEEE), 
http://www.ieee.org/portal/ 

IEEE Corporate Office, 3 Park Avenue, 17th Floor, 

New York, New York, 10016-5997 
Phone: +1 (212) 419 7900, Fax: +1 (212) 752 4929 

Institute of Electrical and Electronic Engineers, 
Reliability Society (IEEE RS), 

See Institute of Electrical and Electronic Engineers (IEEE) 
information 

Institute of Gas Technology, 

See Gas Technology Institute (GTI) 

The Instrumentation, Systems, and 
Automation Society (ISA), 
http://www.isa.org/ 

67 Alexander Drive, P.O. Box 12277 

Research Triangle Park, NC 27709 

Phone: +1 (919) 549 8411, Fax: +1 (919) 549 8288 

Lawrence Livermore National Laboratories, 

http://www.llnl.gov/ 

7000 East Ave., Livermore, CA 94550-9234 
P.O. Box 808, Livermore, CA 94551-0808 
Phone: +1 (925) 4221100, Fax: +1 (925) 4221370 
Los Alamos National Laboratory, 
http://www.lanl.gov/ 

P.O. Box 1663, Los Alamos, NM 87545 
Phone: +1 (505) 664 5265, Fax: +1 (505) 667 9819 
Lovelace Biomedical and Environmental Research 
Institute, 

http://www.lrri.org/ 

2425 Ridgecrest Dr. SE, Albuquerque, NM 87108-5127 
Phone: +1 (505) 348 9400, Fax: +1 (505) 348 8541 
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Manufacturers Standardization Society of the Valve 
and Fittings Industry (MSS), 
http://www.mss-hq.com/ 

127 Park Street NE,Vienna,VA, 22180-4602 
Phone: +1 (703) 2816613, Fax: +1 (703) 2816671 
Manufacturing Chemists Association - now 
Chemical Manufacturers Association 
Minerals Information Team, USGS Geologic Division 
http://minerals.usgs.gov/minerals/ 
http://minerals.usgs.gov/minerals/pubs/mit/ 

U.S. Geological Survey, 988 National Center, 

Reston,VA 20192 

Phone: +1 (703) 648 6140, Fax: +1 (703) 648 4995 
National Academy of Science - National Academy of 
Engineering - National Research Council, 

2101 Constitution Avenue NW,Washington, DC 20418 
National Academies 
http://nationalacademies.org/ 

2101 Constitution Avenue NW, Washington, DC 20418 
Phone:+1(202) 334 2000 
National Academy of Engineering (NAE), 
http://www.nae.edu/ 

(See National Academies) 

National Academy of Science, 

http://www4.nationalacademies.org/nas/nashome.nsf 
(See National Academies) 

National Aeronautics and Space Administration (NASA), 
http://www.hq.nasa.gov/ 

Headquarters,Washington, DC 20546-0001 
Phone:+1(202) 358 0000 

National Board of Fire Underwriters - defunct 

National Bureau of Standards, 

Chemical Thermodynamics Data Center 
http://www.cstl.nist.gov/ 

Chemical Science and Technology Laboratory, NIST, 

100 Bureau Drive, Stop 8300, Gaithersburg, 

MD 20899-8300 
Phone: +1 (301) 975 -NIST (6478) 

National Center for Atmospheric Research (NCAR), 
http://www.ncar.ucar.edu/ 

Box 3000,1850 Table Mesa Drive, Boulder, CO 80305 
Phone: +1(303)4971000 

National Fire Protection Association (NFPA), 
http://www.nfpa.org/ 

1 Batterymarch Park, P.O. Box 9101, Quincy, 

MA 02269-9101 

Phone: +1 (617) 770 3000, Fax: +1 (617) 770 0700 

National Institute of Standards and Technology (NIST) 
http://www.nist.gov/ 

Building and Fire Research Laboratory, Gaithersburg, 
MD 20899 

Phone: +1 (301) 975 6850, Fax: +1 (301) 975 4032 

National Institute for Occupational Safety and 
Health (NIOSH), 
http://www.cdc.gov/niosh/ 

4676 Columbia Parkway, Cincinnati, OH 45226 
Phone: +1 (800) 356 4674, Fax: +1 (513) 533 8573 


National LP Gas Association (LPGA) - now 
National Propane Gas Association (NPGA) 

National Propane Gas Association (NPGA), 
http://www.npga.org/ 

115017th Street, NW, Suite 310, Washington, DC 20036 
Phone: +1(202)4667200 

National Research Council (NRC), 
http://nationalacademies.org/nrc/ 

(See National Academies) 

National Response Center (NRC) 

http: //www.nrc.uscg.mil/ 

c/o United States Coast Guard (G-OPF)-Room 2611, 

2100 2nd Street, Southwest Washington, DC 20593-0001 
Phone: +1 (202) 267 2675, Fax: +1 (202) 267 2165 
TDD: +1(202)2674477 (TDD means Telecommunications 
Device for the Deaf) 

National Safety Council (NSC), 
http: //www.nsc.org/ 

1121 Spring Lake Drive, Itasca, IL 60143 - 3201 
Phone: +1 (630) 2851121, Fax: +1 (630) 2851315 

National Technical Information Service (NTIS), 
http://www.ntis.gov/ 

U.S. Department of Commerce Technology Administration, 
5285 Port Royal Road, Springfield, VA 22161 
Phone: +1(703)605 6000 
TDD: (703)487 4639 

National Transportation Safety Board (NTSB), 
http: //www.ntsb.gov/ 

490 L’Enfant Plaza, SW, Washington, DC 20594 
Phone: +1(202)3146000 

Naval Surface Weapons Center (NSWC) - now disbanded 

Nuclear Regulatory Commission, 
http://www.nrc.gov/ 

Office of Public Affairs (OPA), Washington, DC 20555 
Phone: +1(800)368 5642 

Oak Ridge National Laboratory, 
http: //www.ornl.gov/ 

One Bethel Valley Road or P.O. Box 2008, Oak Ridge, 

TN 37831 

Phone: +1 (865) 2417600, Fax: +1 (865) 2417603 

Occupational Safety and Health Administration (OSHA), 
http://www.osha.gov/ 

200 Constitution Avenue NW,Washington, DC 20210 
Phone: +1 (800) 3216742 

Oil Insurance Association - merged in Industrial 
Risk Insurers (IRI) 

Reliability Division American Society for Quality (ASQ) - 
see information for American Society for Quality (ASQ) 

Sandia National Laboratory, 
http://www.sandia.gov/ 

Sandia National Laboratories, New Mexico, P.O. Box 5800, 
Albuquerque, NM 87185-(mail stop) 

Corporate Ombudsman Office: Mail Stop 0620 
Phone:(505)8449763 
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System Safety Society (SSS), 
http://www.system-safety.org/ 

P.O. Box 70, Unionville,VA 22567-0070 
Phone: +1(540)8548630 

Society of Reliability Engineers (SRE) 
http://www.sre.org/ 

Synthetic Organic Chemical Manufacturers Association 
(SOCMA), 

http://www.socma.com/ 

1850 M Street NW, Suite 700, Washington, DC 20036 
Phone: +1 (202) 7214100, Fax: +1 (202) 296 8120 

Southwestern Research Institute (SwRI), 

http://www.swri.edu/default.htm 

6220 Culebra Road, P.O. Drawer 28510, San Antonio, 

TX 78228-0510 
Phone: +1(210)6845111 

Underwriters Laboratories Inc. (UL), 
http://www.ul.com/ 

333 Pfingsten Road, Northbrook, IL 60062-2096 
Phone: +1 (708) 272 8800, Fax: +1 (708) 272 8129 

Union of Concerned Scientists (UCS), 
http://www.ucsusa.org/ 

2 Brattle Square, Cambridge, MA 02238-9105 
Phone: +1 (617) 547 5552, Fax: +1 (617) 864 9405 

USA Standards Institute - now American National 
Standards Institute (NIST) 

US Department of Transportation (DOT), 
http: / / www.dot.gov/ 

400 7th Street, S.W,Washington, D.C. 20590 
Phone:+1(202) 366 4000 

US Government Printing Office, 
http: //www. access.gpo.gov/ 

Office of Congressional and Public Affairs, Room C804, 
Stop: LP 

U.S. Government Printing Office 

Washington, DC 20402 

Phone: +1 (202) 5121991, Fax: +1 (202) 51212 


Europe 

European Chemical Industry Council (CEFIC) 
http://www.cefic.be/ 

Avenue E. van Nieuwenhuyse, 4, B-1160, Brussels, Belgium 
Phone: +32 (2) 676 7211, Fax: +32 (2) 676 73 00 

European Commission, 
http://europa.eu.int/comm/ 

B-1049, Brussels, Belgium 
Phone:+32(2)2991111 

European Commission, Joint Research Centre, 
http://www.jrc.cec.eu.int/ 

Via E. Fermi 1,1-21020 Ispra (VA), Italy 
Phone: +39 (0332) 789111, Fax: +39 (0332) 789001 

European Process Safety Centre, 
c/o Institution of Chemical Engineers, q.v. 
http://www.epsc.org/ 

165 -189 Railway Terrace, Rugby, CV213HQ, UK 
Phone: +44(0) 1788 534409, Fax: +44(0) 1788 551542 


Other Countries 

Canada 

Canadian Centre for Occupational Health 
and Safety (CCOHS) 
http://www.ccohs.ca/ 

250 Main Street East, Hamilton, Ontario, L8N1H6 
Phone: 1 (905) 570 8094, Fax: 1 (905) 572 2206 


Finland 

Ministry of Social Affairs and Health 
(STM, sosiaali- ja terveysministerio), 
http://www.vn.fi/stm/english/ 

Postal address: P.O. Box 33, FIN-00023 Government 
Visiting address: Meritullinkatu 8,00170 Helsinki 
Phone: +358 (9) 160 01, Fax: +358 (9) 160 74126 

VTT, Technical Research Centre of Finland, 
http://www.vtt.fi/ 

Espoo: P.O. Box 1700, FIN-02044 VTT 
Street address: Kemistintie 3, Espoo 
Phone: +358 (9) 4561, Fax +358 (9) 456 7020 


France 

Societe de Chimie Industrielle, 
http://www.scifrance.org/ 

28, Rue Saint Dominique, F-75007 Paris 

Phone: +33 (0) 153 59 0210, Fax: +33 (0) 145 55 40 33 


Germany 

Berufsgenossenschaft der Chemischen Industrie 
Bundesanstalt fur Materialprufung, Berlin 
Bundesanstalt fur Materialforschung (BAM) 

Federal Institute for Materials Research and Testing 
http://www.bam.de/english/ 

Unter den Eichen 87,12205 Berlin 
Phone: +49 (30) 8104 0, Fax: +49 (30) 8112029 

German Berufsgenossenschaften (GB) 

(institutions for statutory accident insurance 
and prevention for trade and industry) 
http://www.hvbg.de/ 

Berufsgenossenschaftliches Institut fur 
Arbeitsschutz (BIA) 
http://www.bgchemie.de/ 

Alte HeerstraBe 111, 53754 Sankt Augustin, 
Bundesrepublik Deutschland 
Phone: +49 (22) 412 3102, Fax: +49 (22) 412 3122 34 

DECHEMA, Gesellschaft fur ChemischeTechnik und 
Biotechnologie e.V 

http://www.dechema.de/homepage/welcome-e.html 
Theodor-Heuss-Allee 25, D- 60486 Frankfurt am Main 
Phone: +49 (069) 7564 0, Fax: +49 (069) 7564 201 

Deutsches Institut fur Normung (DIN), 
http://www2.din.de/ 

Berlin: 10772 Berlin 

Phone: +49 (030) 26010, Fax: +49 (030) 26011260 
Cologne Office: KamekestraBe 8,50672 Koln 
Phone: +49(0221)57130 

Technische Uberwachungsverein, 

Postfach 2104 20,Westendstrasse 199, W-8000 Munchen 
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Verein Deutscher Ingenieure (VDI), 
The Association of Engineers 
http://www.vdi.de/vdi/english/ 
Graf-Recke-Str. 84 40239 Diisseldorf 
Postfach 101139 40002 Diisseldorf 
Phone:+49(0)21162140 


Hong Kong 

Labour Department, Occupational Safety and Health 
http://www.info.gov.hk/labour/eng/osh/index.htm 
Service Headquarters, 15/F, Harbour Building, 

38 Pier Road, Central 
Phone: 2852 4041 


Japan 

National Research Institute of Fire and Disaster, (NRIFD), 
http: / / www.fri.go.jp/indexe.html 
14-1, Nakahara 3 Chome, Mitaka, Tokyo 181-8633 
Phone: +81422 44 8331, Fax: +81422 42 7719 

National Institute of Industrial Safety, 
http://www.anken.go.jp/english/top.html 
1-4-6, Umezono, Kiyose,Tokyo 204-0024 
Phone: +81424914512, Fax: +81424917846 


Latin America 

Pan American Center for Sanitary Engineering and 
Environmental Sciences (CEPIS), 
http: / / www.cepis. ops- oms .org/ indexeng.html 
Los Pinos 259, Urb. Camacho, La Molina, Lima 12 
P.O. BOX 4337, Lima 100, Peru 
Phone: +51 (1) 4371077, Fax: +51 (1) 4378289 

The Netherlands 

Committee for Prevention of Disasters — see Ministry of 
Social Affairs 

Ministry of Social Affairs, 

P.O. Box 90804, 2509LV,The Hague Stichting CONCAWE, 
22 President Kennedylaan,The Hague 

TNO Prins Maurits Laboratory (TNO-PML) 
http://www.pml.tno.nl/ 

Lange Kleiweg 137, P.O. Box 45, 2280 AA Rijswijk 
Phone: +31 (15) 284 2842, Fax: +31 (15) 284 3991 

TNO Environment, Energy and Process Innovation 
(TNO-MEP) 
http: / / www.mep.tno.nl/ 

Laan vanWestenenk 501, P.O. Box 342,7300 AH Apeldoorn 
Phone:+31 (55) 549 35 44 


Norway 

Christian Michelsen Research AS, 
http:/ /w ww.cmr.no/ 

Postal address: P.O. Box 6031 Postterminalen, 

N-5892 Bergen, Norway 
Visiting address: Fantoftvegen 38, Fantoft 
Phone: +47 (55) 5740 40, Fax: +47 (55) 5740 41 

DNV Technology Services 
http://www.dnv.com/technologyservices/ 

Corporate Headquarters, Oslo: Veritasveien 1,1322 Hovik 
Phone: +47 (67) 57 99 00, Fax: +47 (67) 57 9911 


Norwegian Fire Research Laboratory (NBL), 
http: //www.nbl.sintef.no/ 

Postal address: N-7465 Trondheim, 

Visiting address: Tiller Bru,Trondheim 
Phone: +47 (73) 5910 78, Fax: +47 (73) 5910 44 
Norwegian Society of Chartered Engineers, 
http://www.nif.no/ 

P.O. Box 2312, Solli, N-0201 Oslo, 

Phone: +47 (22) 94 75 29, Fax: +47 (22) 94 75 59 

Oreda, 

http://www.sintef.no/static/TL/projects/oreda/ 

c/o DNV Technology Services, 

c/o SINTEF Industrial Management, 

SINTEF Industrial Management 

http: / / www.sintef. no / units / indman/index.html 

S.P. Andersensv. 5,7465 Trondheim 

Phone: +47 (73) 59 03 00, Fax: +47 (73) 59 03 30 

Switzerland 

Schweizerische Chemische Gesellschaft, 

http://www.swiss-chem-soc.ch/ 

c/o SANW, Barenplatz 2,3011 Bern 

Phone: +41 (0) 31310 40 90, Fax: +41 (0) 3131216 78 

International 

Intergovernmental Maritime Consultative Organisation - 
see International Maritime Organization 
International Association of Fire Chiefs (IAFC), 
http://www.iafc.org/ 

4025 Fair Ridge Dr., Suite 300, Fairfax, 

VA 22033-2868, USA 

Phone: +1 (703) 273 0911, Fax: +1 (703) 273 9363 
International Association of Firefighters (IAFF), 
http: //www.iaff.org/ 

1750 New York Ave. NW, Washington, DC 20006-5395, USA 
Phone: +1 (202) 7378484, Fax: +1 (202) 7378418 
International Atomic Energy Agency, 
http: //www.iaea.or.at/ 

P.O. Box 100, Wagramer Strasse 5, A-1400 Vienna, Austria 
Phone: +4312600 0, Fax: +4312600 7 
International Council of Chemical Associations (ICCA), 
http://www.icca-chem.org/ 

International Chamber of Shipping, 
http://www.marisec.org/ 

12 Carthusian Street, London EC1M 6EZ, UK 
Phone: +44 (20) 7417 8844, Fax: +44 (20) 7417 8877 
International Commission on Radiological Protection, 
http: //www.icrp.org/ 

SE-17116 Stockholm Sweden 
Fax:+46 (8) 729 729 8 

International Federation of Chemical and General 
Workers Unions (ICF) - see International Federation 
of Chemical, Energy, Mine, and General Workers’ 

Unions (ICEM) 

International Federation of Chemical, Energy, Mine, 
and General Workers’ Unions (ICEM) 
http://www.icem.org/index.html 
Avenue Emile de Beco, 109, B-1050 Brussels, Belgium. 
Phone: +32(2)6262020 
Fax:+32(2)6484316 
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International Gas Union (IGU) 
http://www.igu.org/ 

P.O. Box 550, c/o DONG A/S, Agern Alle 24-26, 

2970 Hoersholm, Denmark 
Phone: +45 45171200, Fax: +45 45171900 
International Institute for Applied Systems 
Analysis (IIASA), 
http://www.iiasa.ac.at/ 

A-2361, Laxenburg, Austria 

Phone: +43 (2236) 807 0, Fax: +43 (2236) 71313 

International Institute for Refrigeration (IIR), 

Institut International du Froid 
http://www.iifiir.org/ 

177, boulevard Malesherbes, 75017 Paris - France 
Phone: +33 (0) 142 27 32 35, Fax: +33 (0) 147 6317 98 
International Institute of Ammonia Refrigeration (IIAR) 
http://www.iiar.org/ 

1110 North Glebe Road, Suite 250, Arlington, 

VA 22201, USA 

Phone: +1730 312 4200, Fax: +1703 312 0 065 
International Maritime Organization, 
http://www.imo.org/home.asp 

4 Albert Embankment, London, SE17SR, United Kingdom 
Phone: +44 (0) 20 7735 7611, Fax: +44 (0) 20 7587 3210 

International Labour Organisation (ILO), 
http://www.ilo.org/public/english/index.htm 
4, route des Morillons 
CH-1211 Geneva 22, Switzerland 
Phone: +41 (22) 799 6111, Fax: +41 (22) 798 8685 
International Occupational Safety and Health Information 
Centre, International Labour Office (ILO-CIS), 
http: //www.ilo.org/public/english/protection/safework/ 
cis/index.htm 

CH-1211 Geneva 22, Switzerland 

Phone: +41 (22) 799 6740, Fax: +41 (22) 799 8516 


International Labour Office, International Standards 
Organization (ISO), 

http://www.iso.ch/iso/en/ISOOnline.frontpage 
1 rue deVarembe, Case postale 56, CH-1211 Geneva 20, 
Switzerland 

Phone: +41 (22) 749 0111,Telefax: +41 (22) 733 34 30 

Oil Companies International Maritime Forum (OCIMF), 
http://www.ocimf.com/ 

27 Queen Anne’s Gate, London, SW1H 9BU, 

United Kingdom 

Phone: +44 (0) 20 76541200, Fax: +44 (0) 20 76541205 
Victoria Street, London SW1E1BH 

Organization for Economic Co-operation and 
Development (OECD), 
http://www.oecd.org/ 

2, rue Andre Pascal 
F-75775 Paris Cedex 16, France 
Phone:+33(1)452482 00 

United Nations Environment Programme (UNEP), 

http: / / www.unep.org/default, asp 

United Nations Avenue, Gigiri, P.O. Box 30552, 

Nairobi, Kenya 

Phone: +254(2)621234, Fax: +254(2)624489/90 

World LP Gas Association (WLPGA), 
http: / / www.worldlpgas.com / 

World LP Gas Association, 9 rue Anatole de la Forge, 
75017 Paris, France 

Phone: +33 (0) 158 05 28 00, Fax: +33 (0) 158 05 28 01 

United Nations Environment Programme/Division 
of Technology, Industry and Economics 
(UNEP/DTIE) 
http: / / www.uneptie.org / 

39-43, Quai Andre Citroen, 75739 Paris Cedex 15, France 
Phone: +33 (1) 44 3714 41, Fax: +33 (1) 44 371474 
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APPENDIX 30/2 UNITS AND UNIT CONVERSIONS 


SI units are used in this book unless otherwise stated, these 
are described in BS 5555:1981 SI Units and Recommenda¬ 
tions for the Use of their Multiples and of Certain Other Units. 
Table A30.1 gives selected references on units. 

A30.1 Absolute and Gauge Pressures 

It is common practice to attach to units of pressure an ‘a’ or a 
‘g’, denoting ‘absolute’ or ‘gauge’, respectively (e.g. bara, 
psig). This is not part of the SI system, where instead the 
designation ‘absolute’ or ‘gauge’ or some other defining 
term is applied to the pressure described. In this book both 
practices are used. 

A30.2 Other Units and Conversions 

Some other units which are used in the book are 

Table A30.1 Selected references on units 

A30.2.1 Volumetric flux 

1 l/m z s = 10 -3 m 3 /m 2 s 

11/m 2 min = 1.667 x 10“ 6 m 3 /m 2 s 

1 UK gal/ft 2 min = 8.149 x 1(T 4 m 3 /m 2 s 

1 US gal/ft 2 min = 6.791 x 10“ 4 m 3 /m 2 s 

A30.2.2 Other quantities 

SI unit conversion 

Conversions of other units to and from SI un: 
in tables compiled by Mullin (1967) and ! 
The conversion table given by the latter is re 
Table A30.2. 

lbbl (barrel) =42 US gal 
llusec = 10 3 torrl/s 

1 micron = 1(T 6 m 

Chappelear (1981); Horvath (1986); Mullin (1986) 

1 mil = 10~ d in. = 
1 torr = 1 mmHg 

= 2.540 xlO“ 6 m 
=1.333 xl0 2 N/m 2 

Table A30.2 SI unit conversion tables (Lees, 1968) 

Acceleration 

1 cm/s 2 

1.0000 xl(T z m/s 2 


lm/h 2 

7.7160 x 10 -8 m/s 2 


1 ft/s 2 

3.0480 x 10 _1 m/s 2 


lft/h 2 

2.3519 xl0“ 8 m/s 2 


lg 

9.8067 m/s 2 

Area. 

1cm 2 

1.0000 xl0“ 4 m 2 


1ft 2 

9.2903 x 10 -2 m 2 


lin. 2 

6.4516 xl0“ 4 m 2 


1yd 2 

8.3613 x 10 -1 m z 


lacre 

4.0469 xl0 3 m 2 


1 mile 2 

2.5900 xl0 6 m 2 


lha 

1.0000 xl0 4 m 2 

Calorific value (volumetric) 

1 cal/cm 3 

4.1868 xl0 6 J/m 3 


1 keal/m 3 

4.1868 x 10 3 J/m 3 


lBtu/ft 3 

3.7260 x 10 4 J/m 3 


1 Chu/ft 3 

6.7067 x 10 4 J/m 3 


1 therm/ft 3 

3.7260 x 10 9 J/m 3 


1 keal/ft 3 

1.4786 x 10 5 J/m 3 

Coefficient of expansion (volumetric) 

lg/cm 3o C 

1.0000 xlO 3 kg/m 3 °C 


1 lb/ft 3 °F 

2.8833 x 10 kg/m 3 °C 


1 lb/ft 3 °C 

1.6018 x 10 kg/m 3 °C 

Density 

1 g/cm 3 

1.0000 xlO 3 kg/m 3 


1 lb/ft 3 

1.6018x10 kg/m 3 


1 lb/UK gal 

9.9776 xlO kg/m 3 


1 lb/US gal 

1.1983 xlO 2 kg/m 3 


1 kg/ft 3 

3.5315x10 kg/m 3 


1ton/vd 3 

1.3289 xlO 3 kg/m 3 


1 slug/ft 3 

5.1538 xlO 2 kg/m 3 


1 pdl/in. 3 

8.6032 xlO 2 kg/m 3 


1 dyn/cm 3 

1.0197 kg/m 3 

Diffusion coefficient - see Viscosity, kinematic 

Energy 

leal 

4.1868 J 



4.1868 xlO 3 J 


lBtu 

1.0551 xl0 3 J 


lerg 

1.0000 xl0“ 7 J 


1 hp h (metric) 

2.6477 xlO 6 J 


lkWh 

3.6000 x 10 6 J 


lftpdl 

4.2139 x 10“ Z J 
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lftlbf 

1.3558 J 


1 Chu 

1.8991 xl0 3 J 


1 hp h (British) 

2.6845 xl0 6 J 



1.0551 x 10 s J 


1 thermic 

4.1858 xl0 6 J 


lftkgf 

2.9891 J 


lkgfm 

9.8066 J 


ldyncm 

1.0000 x 10~ 7 J 

Force 

1 dyn 

1.0000 x10“ 5 N 


lkgf 

9.8067 N 


lpdl 

1.3826 xl0 _1 N 


1 lbf 

4.4482 N 


ltonf(UK) 

9.9640 x10 3 N 


ltonf(US) 

8.8964 x10 3 N 


1 tonnef 

9.8067 x10 3 N 

Heat - see Energy 

Heat of combustion, formation, etc. -. 
Heat capacity - see Specific heat 

Heat flow - see Power 

see Specific enthalpy 


Heat flux 

1 cal/s cm 2 

4.1868 xl0 4 W/m 2 


lkcal/hm 2 

1.1630 W/m 2 


1 Btu/hft 2 

3.1546 W/m 2 


IChu/hft 2 

5.6784 W/m 2 


lkcal/hft 2 

1.2518x10 W/m 2 


1 ft lb/min ft 2 

2.4323 x lO^W/m 2 


lhp/ft 2 

7.9168 xlO 3 W/m 2 


lW/in. 2 

1.5500 xlO 3 W/m 2 

Heat release rate (mass) 

1 cal/s g 

4.1868 xl0 3 W/kg 


lkcal/hkg 

1.1630 W/kg 


lBtu/hlb 

6.4611 x 10“'W/kg 

Heat release rate (volumetric) 

1 cal/s cm 3 

4.1868 xlO 6 W/m 3 


lkcal/hm 3 

1.1630 W/m 3 


1 Btu/hft 3 

1.0350 xlO W/m 3 


IChu/hft 3 

1.8629x10 W/m 3 


lkcal/hft 3 

4.1071x10 W/m 3 

Heat transfer coefficient 

1 cal/s cm 2 °C 

4.1868 xlO 4 W/m 2 °C 


lkcal/hm 2o C 

1.1630 W/m 2 °C 


1 Btu/hft 2 °F 

5.6783 W/m 2 °C 


1 Chu/h ft 2 °C 
lkcal/hft 2o C 

1.2518 xlO W/m 2 °C 

Henry’s law constant 

1 atm/(g/cm 3 ) 

1 atm/(kg/m 3 ) 

1.0133 xl0 2 (N/m 2 )/(kg/m 3 ) 
1.0133 x 10 s (N/m 2 j/(kg/m 3 j 
6.3258 x 10 3 (N/m 2 )/(kg/m 3 ) 
2.8693 xl0 3 (N/m 2 )/(kg/m 3 ) 


1 atm/(Ib/ft 3 ) 

1 atm/(kg/ft 3 ) 

Latent heat - see Specific enthalpy 
Length 

1cm 

1.0000 x 10 _z m 


1ft 

3.0480 x 10 -1 m 


1 Angstrom 

1 micron 
lin. 

1.0000 xl0“ lo m 

1.0000 xl0“ 6 m 

2.5400 xl0“ 2 m 


1yd 

9.1440 x 10 _1 m 


lmile 

1.6093 x 10 3 m 

Mass 

lg 

1.0000 xlO” 3 kg 

4.5359237 x 10” 1 kg 


lib 


11 (tonne) 

1.0000 xlO 3 kg 


1 grain 

6.4799 x 10 -5 kg 


loz 

lcwt 

2.8350 xl0“ 2 kg 

5.0802 x10 kg 


1 ton (long) 

1.0160 xlO 3 kg 


1 ton (short) 

9.0719 x 10 2 kg 


ldram 

1.7718 xl0“ 3 kg 
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Mass per unit area 


Mass flow 


Mass flux, mass velocity 


Mass release rate (volumetric) 


Mass transfer coefficient, 

concentration driving force - see Velocity 
Mass transfer coefficient, 
dimensionless driving force - see Mass flux 
Mass transfer coefficient, pressure driving force 


Momentum, angular 


Momentum, linear 


Moment of inertia 




Pressure 


lg/cm 2 
1 dyn/cm 2 
1 lb/ft 2 
loz/ft 2 
lib/in. 2 
1 lb/yd 2 
Hong 
1 kg/ft 2 


lg/s 
lkg/h 
1 lb/s 
lt/h 
llb/h 
1ton/h 


1 g/s cm 2 
lkg/h m 2 
1 lb/s ft 2 
llb/h ft 2 
lkg/h ft 2 


1 g/s cm 3 
lkg/h m 3 
1 lb/s ft 3 
llb/h ft 3 
lkg/h ft 3 


lg/s cm 2 atm 
1 kg/h m atm 
llb/h ft 2 atm 
1 kg/h ft 2 atm 


1 g cm 2 /s 
llbft/Vs 
llbft 2 /h 


1 g cm/s 
1 lb ft/s 
llbft/h 
lgcm 2 
lib ft 2 
1 oz in. 2 
1 lb yd 2 


1 kcal/h 
lBtu/s 
1 erg/s 
1 tonne cal/h 
1 hp (metric) 

1 ft pdl/s 
lftlbf/s 
lBtu/h 
1 Chu/h 
1 hp (British) 

1 ton refrigeration 
IJ/h 

1 dyn/cm 2 
1 kgf/m 2 
lpdl/ft 2 


1.0000x10 kg/m 2 
1.0197 xHT 2 kg/m 2 
4.8824 kg/m 2 
3.0515 x 10 _1 kg/m 2 
7.0307 xlO 2 kg/m 2 
5.4249 xl0 _1 kg/m 2 
3.9230 xl0“ 4 kg/m 2 
1.0764x10 kg/m 2 

1.0000 xl0“ 3 kg/s 
2.7778 xHT 4 kg/s 
4.5359 xlO" 1 kg/s 
2.7778 x 10 _1 kg/s 
1.2600 x 10~ 4 kg/s 
2.8224 xlO -1 kg/s 

1.0000 x 10 kg/s m 2 
2.7778 xl0“ 4 kg/s m 2 
4.8824 kg/s m 2 
1.3562 x 10 _1 kg/s m 2 
2.9900 xl0“ 3 kg/s m 2 

1.0000 x 10 kg/s m 3 
2.7778 x 10 _1 kg/s m 3 
1.6018 x 10 kg/s m 3 
4.4496 xl0“ 3 kg/s m 3 
9.8096 x 10 _1 kg/s m 3 


9.8687 x 10“ 5 kg/s m 2 (N/m 2 ) 

2.7413 x 10“ 9 kg/s m 2 (N/m 2 ) 

1.3384 x 10“ 8 kg/s m 2 (N/m 2 ) 

2.9507 x 10“ 8 kg/s m 2 (N/m 2 ) 

1.0000 xl0“ 7 kg m 2 /s 

4.2140 xl0“ 2 kg m 2 /s 

1.1706 xl0“ 5 kg m 2 /s 

1.0000 xl0“ 5 kg m/s 

1.3826 xlO -1 kg m/s 

3.8404 xl0“ 5 kg m/s 

1.0000 xl0“ 7 kg m 2 

4.2140 xl0“ 2 kg m 2 

1.8290 xl0~ 5 kg m 2 

3.7926 x 10 _1 kg m 2 

4.1868 W 

1.1630 W 

1.0551 xl0 3 W 

1.0000 xl0“ 7 W 

1.1630 xl0 3 W 

7.3550 xl0 2 W 

4.2140 xl0“ 2 W 

1.3558 W 

2.9307 xl0 _1 W 

5.2754 x 10 _1 W 

7.4570 xl0 2 W 

3.5169 xl0 3 W 

2.7778 xl0“ 4 W 

2.8146 xl0“ 5 W 

1.0000 xlO” 1 N/m 2 

9.8067 N/m 2 

1.4882 N/m 2 
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Reaction rate - see Mass release rate 
Shear stress - see Pressure 
Specific enthalpy 


Specific heat 


Specific volume 


Surface per unit mass 


Surface per unit volume 


Surface tension 


Temperature difference 
Thermal conductivity 


Time 


Torque - see Energy 
Velocity 


1 atm (standard) 

1.0133 x 10 s N/m 2 

1 at (1 kgf/cm 2 ) 

9.8067 xl0 4 N/m 2 

lbar 

1.0000 xlO 5 N/m 2 

1 lbf/ft 2 

4.7880 x 10 N/m 2 

1 psi (lbf/in. 2 ) 

6.8948 xlO 3 N/m 2 

ltonf/in. 2 

1.5444 xlO 7 N/m 2 

1 in. water 

2.4909 xlO 2 N/m 2 

1ft water 

2.9891 xlO 3 N/m 2 

ImmHg 

1.3332 x 10 2 N/m 2 

1 inHg 

3.3864 xlO 3 N/m 2 

ltorr 

1.3332 xlO 2 N/m 2 

lksi 

6.8948 xlO 6 N/m 2 

1 oz/ft 2 

2.9926 N/m 2 

lcal/g 

4.1868 x 10 3 J/kg 

1 Btu/lb 

2.3260 xlO 3 J/kg 

IChu/lb 

4.1868 x 10 3 J/kg 

lkWh/lb 

7.9366 x 10 6 J/kg 

X ft lbf/lb 

2.9891 J/kg 

lcal/g °C 

4.1868 xlO 3 J/kg °C 

1 Btu/lb °F 

4.1868 xlO 3 J/kg °C 

1ft lbf/lb °F 

5.3803 J/kg °C 

1 m kgf/kg °C 

9.8067 J/kg °C 

1 cm 3 /g 

1.0000 xl0“ 3 m 3 /kg 

1 ft 3 /lb 

6.2428 xl0“ 2 m 3 /kg 

1 ft 3 /kg 

2.8317 x 10 _z m 3 /kg 

1 cm 2 /g 

1.0000 x FT 1 m 2 /kg 

lft 2 /lb 

2.0482 x 10~ 4 m 2 /kg 

lmf/g 

1.0000 xlO 3 m 2 /kg 

1 ft 2 /kg 

9.2903 xl0“ 2 m 2 /kg 

lyd 2 /oz 

2.9494 x 10 m z /kg 

lft^/oz 

3.2771 m 2 /kg 

1 mm 2 /mg 

1.0000 m 2 /kg 

1 cm 2 /cm 3 

1.00 00 x 10 2 m 2 /m 3 

lft 2 /ft 3 

3.2808 m 2 /m 3 

1 ft 2 /gal 

2.0436 x 10 m 2 /m 3 

lyd 2 /gal 

1.8392 x 10 2 m 2 /m 3 

ldyn/cm 

1.0000 xlO” 3 N/m 

lerg/cm 

1.0000 xlO” 3 N/m 

1 mg/in. 

3.8609 xlO -4 N/m 

lkgf/m 

9.8070 N/m 

lpdl/in. 

5.4431 N/m 

1 deg F (deg R) 

5/9 deg C (deg K) 

1 cal/s cm 2 

4.1868 xl0 2 W/m 2 (°( 

lkcal/hm 2 

1.1630 W/m 2 (° C/m) 

1 Btu/h ft 2 

1.7307 W/m 2 (° C/m) 

1 Btu/h ft 2 

1.4423 xlO” 1 W/m z ( ! 

lkcal/hft 2 

3.8156 W/m 2 (°C/m) 

lh 

3.6000 xl0 3 s 

lmin 

6.0000 x10 s 

1 d (day) 

8.6400 xl0 4 s 

lyr 

3.1558 xl0 7 s 

lcm/s 

1.0000 xlO -2 m/s 

lm/h 

2.7778 xl0“ 4 m/s 

1 ft/s 

3.0480 xlO” 1 m/s 

lft/h 

8.4667 xl0“ 5 m/s 

1 mile/h 

4.4704 x 10 _1 m/s 

lkn 

5.1444 xlO -1 m/s 
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Viscosity, absolute (or dynamic) 


Viscosity, kinematic 


Volume 


Volumetric flow 


Wetting rate (mass) - see Velocity, absolute 
Wetting rate (volumetric) 

Work — see Energy 


1 g/cm s (1 poise) 
lkg/mh 
1 lb/ft s 
1 lb/ft h 
1 kg/ft h 
1 lbf s/in. 

1 slug/ft s 


1.0000 xlO” 1 kg/m 
2.7778 xHT 4 kg/m - 
1.4882 kg/m s 
4.1338 xl0“ 4 kg/m 
9.1134 x 10 -4 kg/m ~ 
6.8948 xlO 3 kg/m s 
4.7880 x 10 kg/m s 


I cm 2 /s (1 stokes) 
lm 2 /h 

lft 2 /s 

lft 2 /h 

lcm 3 

lft 3 

II (litre) 
lin. 3 
lyd 3 

1 UK gal 
1 US gal 
1 UK barrel 
1 US barrel 
lpt 


1.0000 xl0“ 4 m 2 /s 
2.7778 xl0“ 4 m 2 /s 
9.2903 x 10 -2 nr/s 
2.5806 xl0“ 5 m 2 /s 

1.0000 xl0“ 6 m 3 
2.8317 xl0“ 2 m 3 
1.0000 xl0“ 3 m 3 
1.6387 xl0“ 5 m 3 
7.6456 x 10 _1 m 3 
4.5461 xl0“ 3 m 3 
3.7854 xl0“ 3 m 3 
1.6366 x 10 _1 m 3 
1.1924 x 10 _1 m 3 
4.7318 xl0“ 4 m 3 


lft 3 /s 
1 cm 3 /min 

lft 3 /min 
1 ft 3 /h 
lyd 3 /min 
1 UK gal/min 


1 US gal/min 

lUKgal/h 

lUSgal/h 


1.0000 xl0“ 6 m 3 /s 
2.7778 xl0“ 4 m 3 /s 
2.8317 xl0- 2 m7s 
1.6667 xl0- 8 m 3 /s 
1.6667 xlO^mVs 
4.7195 x 10 -4 m 3 /s 
7.8658 xl0“ 6 m 3 /s 
1.2743 xl0“ 2 m 3 /s 
7.5768 xl0“ 5 m 3 /s 
6.3090 xl0“ 5 m 3 /s 
1.2628 xl0“ 6 m 3 /s 
1.0515 xl0“ 6 m 3 /s 


11/hin. 1.0936 xl0“ 5 m 3 /sm 

— see also Viscosity, kinematic 
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The history of safety regulations in the United States can be 
traced back to the year before the beginning of the twentieth 
century. The River and Harbor Act, the first known federal 
legislation in the United States relevant to safety was pro¬ 
mulgated in 1899. This Act prohibited the creation of any 
obstruction not authorized by the US Congress, to the 
navigable capacity of any waters of the United States except 
on plans authorized by the Secretary of the Army. The Act 
was promulgated expressly to protect the nation’s water¬ 
ways from excessive dumping. Subsequent to the River and 
Harbor Act, the US Congress has passed numerous laws, 
which impose environmental or safety regulations on 
businesses. Since then, the total number of legislations has 
steadily increased. In addition to the federal government, 
local entities such as the state, county, and cities have also 
promulgated regulations and ordnances, which impose 
safety requirements on process facilities. 

In 1936, the United States federal government enacted 
the Walsh-HealyAct to establish federal safety and health 
standards for activities relating to federal contracts. The 
Walsh-HealyAct led to early research into the identifica¬ 
tion and control of occupational diseases. The ideas behind 
this Act are the basis of many of today’s occupational 
health and safety regulations. 

In 1970, Congress promulgated the Occupational Safety 
and Health Act (OSHA). As a result of this landmark legis¬ 
lation, OSHA and the National Institute for Occupational 
Safety and Health (NIOSH) were established within the 
Department of Labor and the Department of Health and 
Human Services respectively. OSHA’s mission is to, Assure 
so far as possible every working man and woman in the 
nation safe and healthful working conditions’. The OSH Act 
allows OSHA to set and enforce standards that require 
employers to maintain safe and healthful workplaces. 
NIOSH, on the other hand, does not have any regulatory or 
enforcement authority, but is charged with the responsibility 
of training of professionals and with the research and 
recommendation of new regulations to the Secretary of Labor. 

In 1990, EPA analysed chemical incidents in the early to 
mid-1980s and compared them to the Bhopal incident. The 
analysis concluded that 17 incidents released sufficient 
volumes of chemicals that could have been more severe than 
Bhopal if the weather conditions and plant location were 
different. Thus, the Clean Air Act Amendments of 1990 
contained specific mandates requiring OSHA and EPA to 
establish regulations to protect workplace employees and 
the public and the environment, respectively. OSHA ful¬ 
filled its mandate in 1992 by promulgating the process 
safety management regulation. 

Although NIOSH and OSHA were created by the same 
Act of Congress, they are two distinct agencies with sepa¬ 
rate responsibilities. OSHA is in the Department of Labor 
and is responsible for creating and enforcing workplace 
safety and health regulations. NIOSH is in the Department 
of Health and Human Services and is a research agency. 
NIOSH identifies the causes of work-related diseases and 
injuries and the potential hazards of new work technologies 
and practices. With this information, NIOSH determines 
new and effective ways to protect workers from chemicals, 
machinery, and hazardous working conditions. Creating 
new ways to prevent workplace hazards is the job of NIOSH. 

A31.1 The Process Safety Management Programme 

The fourteen elements of the OSHA Process Safety 
Management (PSM) regulation {29 CFR 1910.119) were 


published in the federal register on 24 February 1992. The 
objective of the regulation is to prevent or minimize the 
consequences of catastrophic releases of toxic, reactive, 
flammable, or explosive chemicals. The regulation requires 
a comprehensive management programme: a holistic 
approach that integrates technologies, procedures, and 
management practices. 

The process safety management regulation applies to 
processes that involve certain specified chemicals at or 
above threshold quantities, processes that involve flam¬ 
mable liquids or gases on-site in one location, in quantities 
of 10,000 lb or more (subject to few exceptions), and pro¬ 
cesses which involve the manufacture of explosives and 
pyrotechnics. Hydrocarbon fuels, which may be excluded if 
used solely as a fuel, are included if the fuel is part of a 
process covered by this regulation. In addition, the regu¬ 
lation does not apply to retail facilities, oil or gas well dril¬ 
ling or servicing operations, or normally unoccupied 
remote facilities. 

The management system required by OSHA’s process 
safety management regulation envisions a holistic pro¬ 
gram with checks and balances aimed at creating multiple 
barriers of protection. The performance-based approach 
does not prescribe specific methods and approaches, thus 
giving facilities the flexibility for customizing the methods 
to best meet their needs and organizational structures. The 
process hazard analysis (PHA) is the heart of the 
programme and impacts or interfaces with all of the other 
elements. However, it must also be pointed out that all 
elements of the programme must be implemented in their 
entirety to get the maximum benefit and accomplish the 
ultimate objective, that is, reduce the frequency and sever¬ 
ity of chemical plant accidents. Each element of the process 
safety programme is discussed in more detail here. 

A31.1.1 Employee participation 

This element of the regulation requires developing a writ¬ 
ten plan of action regarding employee participation; con¬ 
sulting with employees and their representatives on the 
conduct and development of other elements of process 
safety management required under the regulation; and 
providing to employees and their representatives access to 
process hazard analyses and to all other information 
required to be developed under this regulation. 

A31.1.2 Process safety information 

This element of the PSM regulation requires employers to 
develop and maintain important information about the 
different processes involved. This information is intended 
to provide a foundation for identifying and understanding 
potential hazards involved in the process. 

The process safety information covers three different 
areas, that is, chemicals, technology and equipment. A 
complete listing of the process safety information that must 
be compiled in these three areas is shown in Table A31.1. 
This information is intended to provide a foundation for 
identifying and understanding potential hazards involved 
in the process. 

The information in Table A31.1 is essential for developing 
and implementing an effective process safety manage¬ 
ment programme. The fundamental concept is that com¬ 
plete, accurate, and up-to-date process knowledge is 
essential for safe and profitable operations. The informa¬ 
tion contained in the first column of Table A31.1 should 
be available from the Material Safety Data Sheets (MSDS) 
for the hazardous chemicals, which are used as primary or 
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Table A31.1 Process safety information 

Chemicals 

Technology 

Equipment 

Toxicity 

Permissible exposure limit 
Physical data 

Reactivity data 

Thermal and chemical 
stability data 

Effects of mixing 

Block flow diagram or 
process flow diagram 

Process chemistry 

Maximum intended inventory 

Safe limits for process parameters 
Consequence of deviations 

Design codes employed 
Materials of construction 
Piping and instrumentation 
diagrams 

Electrical classification 
Ventilation system design 
Material and energy balances 
Safety systems 

Relief system design 
and design basis 


intermediate feedstocks or are produced as products at 
the plant. 

The information contained in the second column of 
Table A31.1 pertains to the technology of the process itself. 
The block flow diagram can be replaced by a process flow 
diagram. The process chemistry information must contain 
the basic chemical reactions involved and a brief descrip¬ 
tion of the chemistry involved. The maximum intended 
inventory refers to the maximum amount of any regulated 
chemical that may be expected to be present in the whole 
facility at any time. The safe limits for process parameters 
refer to the upper and lower hounds for the process para¬ 
meters outside of which the process would be hazardous. 
For example, in the case of a distillation process, the upper 
and lower limits of the process parameters outside which 
the operation of the process could cause significant damage 
to the tower or other attached equipment would have to be 
stated. In this example, the process parameters for which 
upper and lower bounds are to be specified are temperature, 
pressure, composition, and flow rate. The consequence of 
deviation from these stated bounds must also be compiled. 

Safe upper and lower limits for process parameters and 
equipment are also necessary for calibrating instrumenta¬ 
tion. It is important to understand the distinction between 
process parameter limits and equipment limits. Safe upper 
and lower limits for process parameters can be defined as 
follows: 

(1) For non-reactive processes, process parameter safe 
limits are defined based on equipment design ratings, 
relief device setpoints, and upstream and downstream 
conditions of the process and/or equipment. 

(2) For reactive processes, process parameter safe limits 
are defined based on the process chemistry informa¬ 
tion or any restricted physical conditions for the reac¬ 
tion as well as the criteria used for non-reactive 
processes. 

In contrast, equipment limits are specified by the manu¬ 
facturer based on materials of construction and design 
basis. Processes must be operated and maintained within 
both the process parameter and equipment limits. 

The final type of information that must be compiled per¬ 
tains to the equipment used in the process. The intent is to 
assure that all equipment used in the process meets appro¬ 
priate standards and codes such as those published by the 
American Society of Mechanical Engineers (ASME), the 
American Petroleum Institute (API), the American Institute 
of Chemical Engineers (AIChE), the American National 
Standards Institute (ANSI), the AmericanSocietyof Testing 


and Materials (ASTM), and the National Fire Protection 
Association (NFPA). Accepted industry practices can be 
used to decide which standards apply. In cases where stan¬ 
dards do not exist, generally acceptable engineering prac¬ 
tices can be used. The materials of construction for each 
equipment item and the design codes employed can be com¬ 
piled as separate lists or may be listed in the Piping and 
Instrumentation Diagram (P&ID). The P&IDs must repre¬ 
sent the facility exactly as it exists with flanges, valves, and 
all other connections shown. The different electrical classi¬ 
fications must also he compiled for different parts of the 
facility A simple plot plan showing the different areas of 
electrical classification would be considered to be in com¬ 
pliance with the regulation. Information must also be com¬ 
piled on any ventilation system. This information would 
indicate the areas in the facility that are ventilated and the 
nature of ventilation. A listing of all safety systems must also 
be compiled that are available to the workers. This listing 
should include any and all equipment that is available for 
protection of the workers from any hazard or emergency 
Information should also be available on the location of these 
safety systems and the procedures to use these systems. 

As is apparent from the foregoing discussion, compila¬ 
tion of the process safety information database represents 
a major challenge. This is complicated even more because 
the process safety information must also be kept up-to-date 
and accurate and made accessible to employees. Many 
plants have therefore implemented or are in the process of 
implementing electronic data management systems to 
manage, access, and use these data. The completion and 
accuracy of process safety information is crucial to the 
implementation of other PSM elements including PHAs 
and mechanical integrity 

The PSM regulation requires that process equipment 
should comply with generally accepted engineering 
practices. It is therefore not only important to compile all 
equipment information but also to ensure that it complies 
with consensus standards. OSHA is recognizing that there 
are consensus standards for design and fabrication, 
installation, maintenance procedures, and inspection and 
testing. Therefore, equipment constructed in accordance 
with codes, standards, or practices no longer in use should 
be evaluated to ensure that they are compatible with exist¬ 
ing standards. For example, a multi-layered vessel built 
years ago should be evaluated to ensure that it complies 
with today’s engineering standards. 

A31.1.3 Process hazards analysis 

This element of the PSM regulation requires facilities to 

perform a PHA. The PHA must address the hazards of the 
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process, previous hazardous incidents, engineering and 
administrative controls, the consequences of the failure of 
engineering and administrative controls, human factors, 
and an evaluation of effects of failure of controls on 
employees. This element requires that the PHA be per¬ 
formed by one or more of the following methods or any 
other equivalent method: 

(1) what-if; 

(2) checklist; 

(3) what-if/checklist; 

(4) hazard and operability (HAZOP) studies; 

(5) failure modes and effects analysis (FMEA); 

(6) fault tree analysis. 

The regulation suggests a performance-oriented 
requirement with respect to the PHA so that the facility has 
the flexibility to choose the type of analysis that will best 
address a particular process. PHAs may not be performed 
unless complete Process Safety Information is available for 
the process. 

PHAs and the results of PHAs can and will impact the 
development, implementation, and practice of other ele¬ 
ments of the PSM regulation. A PHA would help facilities 
identify hazards and ways to address them. PHAs also 
identify situations where process incidents due to control 
failure (e.g. pressure gauges, overfill alarms) could be 
prevented by redundant or backup control or by frequent 
maintenance and inspection practices. 

Many other elements of the PSM program should flow 
from, or at least be revised based on, the results of the PHA. 
Existing standard operating procedures, training and 
maintenance programs, and pre-startup safety reviews 
may need to be revised to reflect changes in either practices 
or equipment that derive from the PHA. The PHA may help 
define critical equipment that require preventive main¬ 
tenance, inspection, and testing programs. It may also help 
a facility focus its emergency response programs on the 
most likely and most serious release scenarios. 

The PSM regulation also requires that the PHAs be 
updated and revalidated, based on their completion date. 
First, the PSM regulation requires that the PHAs shall be 
updated and revalidated. Thus, the whole PHA should not 
only be examined to verify that the PHA is consistent with 
the current process but it also should be analyzed to 
examine if the original analysis is valid. Second, the PSM 
regulation requires that the updating and revalidating be 
done by a team similar in qualifications to the team that 
conducted the original PHA. The intent of a PHA revalida¬ 
tion is to ensure that the PHA team evaluates the previous 
PHA, examines the extent of any changes that might have 
occurred since the PH Awas implemented (or last reviewed) 
and decide what work is needed to make the PHA current. 

A31.1.4 Operating procedures 

The operating procedures must be in writing and provide 
clear instructions for safely operating processes; must 
include steps for each operating phase, operating limits, 
safety and health considerations and safety systems. Pro¬ 
cedures must be readily accessible to employees, must be 
reviewed as often as necessary to assure they are 
up- to-date and must cover special circumstances such as 
lockout/tagout and confined space entry. The employer 
must certify annually that the operating procedures are 
current and accurate. The synergism and commonality of 
operating procedures to maintenance procedures is in safe 


work practices. These safe work practices include lockout/ 
tagout, confined space entry, opening of process equip¬ 
ment or piping (i.e. hot tapping), and control of entrance 
into the battery limits. Even though the operations depart¬ 
ment is involved with all of these practices, maintenance 
also plays a very vital role in ensuring that these proce¬ 
dures are followed during all maintenance tasks. Many 
incidents have resulted from inadequate safe work prac¬ 
tices or a failure to follow procedures when they exist. 

A31.1.5 Training 

The regulation requires that facilities certify that employees 
responsible for operating the facility have successfully 
completed (including means to verify understanding) the 
required training. The training must cover specific safety 
and health hazards, emergency operations and safe work 
practices. Initial training must occur before assignment. 
Refresher training must be provided at least every 3 years. 

Even though this element of the PSM regulation pertains 
to operations staff only, it is important to remember that 
operations and maintenance training should be coordinated. 

A31.1.6 Contractors 

The PSM regulation identifies responsibilities of the 
employer regarding contractors involved in maintenance, 
repair, turnaround, major renovation or specialty work, on 
or near covered processes. The host employer is required to: 
consider safety records in selecting contractors; inform 
contractors of potential process hazards; explain the facil¬ 
ity’s emergency action plan; develop safe work practices for 
contractors in process areas; periodically evaluate con¬ 
tractor safety performance; and maintain an injury/illness 
log for contractors working in process areas. In addition, 
the contract employer is required to train their employees in 
safe work practices and document that training, assure 
that employees know about potential process hazards and 
the host employer’s emergency action plan, assure that 
employees follow safety rules of facility and advise host 
employer of hazards contract work itself poses or hazards 
identified by contract employees. 

A31.1.7 Pre-startup safety review 

This element of the PSM regulation requires a pre-startup 
safety review of all new and modified facilities to confirm 
integrity of equipment; to assure that appropriate safety, 
operating, maintenance and emergency procedures are in 
place; and to verify that a PHA has been performed. Modi¬ 
fied facilities for this purpose are defined as those for 
which the modification required a change in the process 
safety information. 

Usually, changes occur during maintenance and there¬ 
fore, maintenance personnel should be well versed in pre¬ 
startup safety review procedures. Maintenance should 
ensure that all necessary procedures have been completed 
prior to start-up. 

A31.1.8 Mechanical integrity 

This element of the PSM regulation mandates written pro¬ 
cedures, training for process maintenance employees and 
inspection and testing for process equipment including 
pressure vessels and storage tanks; piping systems; relief 
and vent systems and devices; emergency shutdown sys¬ 
tems; pumps; and controls such as monitoring devices, 
sensors, alarms and interlocks. The PSM regulation calls 
for correction of equipment deficiencies and assurance that 
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new equipment and maintenance materials and spare parts 
are suitable for the process and properly installed. 

A31.1.9 Hot work permit 

This element of the PSM regulation mandates a permit 
system for hot work operations conducted on or near a 
covered process. The purpose of this element of the regu¬ 
lation is to assure that the employer is aware of the hot work 
being performed, and that appropriate safety precautions 
have been taken prior to beginning the work. Since welding 
shops authorized by the employer are locations specifically 
designated and suited for hot work operations, the regula¬ 
tion does not require a permit for hot work in these loca¬ 
tions. Additionally, hot work permits are not required in 
cases where the employer or an individual to whom the 
employer has assigned the authority to grant hot work 
permits is present while the hot work is performed. 

A31.1.10 Management of change 

This element of the regulation specifies a written pro¬ 
gramme to manage changes in chemicals, technology, 
equipment and procedures which addresses the technical 
basis for the change, impact of the change on safety and 
health, modification to operating procedures, time period 
necessary for the change, and authorization requirements 
for the change. The regulation requires employers to notify 
and train affected employees and update process safety 
information and operating procedures as necessary. 

A31.1.11 Incident investigation 

This element of the regulation requires employers to 
investigate as soon as possible (but no later than 48 h) 
incidents, which did result or could have resulted in cata¬ 
strophic releases of covered chemicals. The regulation calls 
for an investigation team, including at least one person 
knowledgeable in the process (a contractor employee, if 


appropriate), to develop a written report of the incident. 
Employers must address and document their response to 
report findings and recommendations and review findings 
with affected employees and contractor employees. Reports 
must be retained for 5 years. 

A31.1.12 Emergency planning and response 

This element requires employers to develop and implement 
an emergency action plan according to the requirements of 
29 CFR 1910.38(a) and 29 CFR 1910.120(a), (p), and (q). 

A31.1.13 Compliance audits 

This element of the regulation requires employers to certify 
that they have evaluated compliance with process safety 
requirements every 3 years and specifies retention of the 
audit report findings and the employer’s response. 
Employer must retain the two most recent audits. 

A31.1.14 Trade secrets 

Similar to the trade secret provisions of the hazard commu¬ 
nication regulation, the PSM regulation also requires infor¬ 
mation to be available to employees from the process hazard 
analyses and other documents required by the regulation. 
The regulation permits employers to enter into confiden¬ 
tiality agreements to prevent disclosure of trade secrets. 


A31.2 Summary Comparison of OSHA Elements 
with CCPS Elements 

It is important to point out that the programmes 
required by OSHA’s PSM elements as given in 29 CFR 
1910.119 are similar to the requirements of other 
programme requirements. The comparison matrix in 
Table A31.2 demonstrates the relevance of OSHA PSM 
elements to other programmes. 


Table A31.2 Comparison matrix showing the relevance of OSHA PSM elements to other programs 


Program element 

OSHAPSM m 

element 

CAAA Sec. 304 m 
Par. Cltem(s) 

AIChE CCPS m 
Guidelines 

ACCPSC m 

Practice(s) 

Employee Participation 

c 

[5] 

1 

15] 

Process Safety Information 

d 

1 

2,10 

7,8 

Process Hazards Analysis 


2,3,4 

4,6,7 

9 

Operating Procedures 

f 

6 

6,7,8 

7,18 

Training 

g 

7 

8 

14,17,19,20 

Pre-startup Safety Review 

i 

12 

3,4,8 

13 

Mechanical Integrity 

i 

10,11 

3,6,10 

2,12,14,18 

Management of Change 

l 

14 

5 

10,11 

Incident Investigation 

m 

13 

9 

4,5 

Audits 

o 

5 

11 

3 

Safe Work Practices 

w,k 

[5] 

8 

18 

Emergency Planning/Control/Response 

n 

9 

8 

5,6,11,16 

Contractors 

h 

8 

— 

12,22 

Employee Fitness for Duty 

- 

- 

- 

21 

Multiple Safeguards 

[5] 

[S] 


15 

Number of Chemicals 

140 

100 min. 

- 

- 


[1] OSHA PSM: Occupational Safety and Health Administration Process Safety Management. 

[2] CAAA: Clean Air Act Amendments. 

[3] AIChE CCPS: American Institute of Chemical Engineers Center for Chemical Process Safety. 

[4] ACC PSC: American Chemistry Council Process Safety Code. 

[5] Either stated or inherent in other elements. 
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APPENDIX 32/2 RISK MANAGEMENT PROGRAM REGULATION IN THE US 


Environmental issues affecting the public health and the 
environmentalsoreceivedwidespreadattention.Asaresult, 
the Environmental Protection Agency (EPA) was estab¬ 
lished in 1970 to protect the nation’s public health and envi¬ 
ronment. The EPA is responsible, ‘to find ways to cleanup 
and prevent pollution, ensure compliance and enforcement 
of environmental laws, assisting states in environmental 
protection efforts, and scientific research and education to 
advance the nation’s understanding of environmental 
issues’. In 1970, the EPA promulgated the Clean Air Act, 
followed by amendments to the Act in 1977 and 1990. 

TheToxic Substances Control Act (TSCA), passed in 1976 
gave EPA the ability to track and study the 75,000 industrial 
chemicals produced or imported to the United States. The 
TSCA is a federally enforced law and is not delegated to 
the state. Under this Act, the EPA has the authority to ban 
the manufacture or distribution in commerce, limit the use, 
require labelling, or place other restrictions on chemicals 
that pose unreasonable risk. Asbestos, chlorofluoro- 
carbons, and ploychlorinated biphenyls are some of the 
chemicals regulated by EPA under TSCA. 

In 1977, the International Safe Container Act established 
uniform structural requirements for international cargo 
containers designed to be transported interchangeably 
by sea and land carriers. In 1983, the Surface Transpor¬ 
tation Assistance Act established protection from reprisal 
by employers for truckers and certain other employees in 
the trucking industry involved in activity related to 
interstate commercial motor vehicle safety and health. 

In 1990, EPA analysed chemical incidents in the early to 
mid-1980s and compared them to the Bhopal incident. The 
analysis concluded that 17 incidents released sufficient 
volumes of chemicals that could have been more severe than 
Bhopal if the weather conditions and plant location were 
different. Thus, the Clean Air Act Amendments of 1990 
contained specific mandates requiring OSHA and EPA to 
establish regulations to protect workplace employees and 
the public and the environment respectively. OSH A fulfilled 
its mandate in 1992 by promulgating the process safety 
management regulation. EPA on the other hand promul¬ 
gated the Risk Management Program regulation in 1996. 
The Clean Air Act Amendments of 1990 also established the 
Chemical Safety and Hazard Investigation Board. 

A32.1 The Risk Management Program 

In 1996, EPA promulgated the regulation for Risk Man¬ 
agement Programs for Chemical Accident Release Prevention 
(40 CFR 68). This federal regulation was mandated by sec¬ 
tion 112(r) of the Clean Air Act Amendments of 1990. The 
regulation requires regulated facilities to develop and 
implement appropriate Risk Management Program to 
minimize the frequency and severity of chemical plant 
accidents. In keeping with regulatory trends, EPA required 
a performance-based approach towards compliance with 
the Risk Management Program regulation. The eligibility 
criteria and requirements for the three different program 
levels are given in Table A32.1. 

The EPA regulation also requires regulated facilities 
to develop a Risk Management Plan (RMP). The RMP 
includes a description of the hazard assessment, preven¬ 
tion programme, and the emergency response programme. 
Facilities submit the RMP to the EPA and subsequently 
is made available to governmental agencies, the state 


emergency response commission, the local emergency 
planning committees, and communicated to the public. 

The Risk Management Program regulation defines the 
worst-case release as the release of the largest quantity of a 
regulated substance from a vessel or process line failure, 
including administrative controls and passive mitigation 
that limit the total quantity involved or release rate. For 
gases, the worst-case release scenario assumes the quantity 
is released in 10 min. For liquids, the scenario assumes an 
instantaneous spill and that the release rate to the air is the 
volatilization rate from a pool 1 cm deep unless passive miti¬ 
gation systems contain the substance in a smaller area. For 
flammables, the scenario assumes an instantaneous release 
and a vapour cloud explosion using a 10% yield factor. For 
alternative scenarios (note: EPA used the term alternative 
scenario as compared to the term more-likely scenario used 
earlier in the proposed regulation), facilities may take credit 
for both passive and active mitigation systems. 

Appendix A of the final regulation lists endpoints for 
toxic substances to be used in worst-case and alternative 
scenario assessment. The toxic endpoints are based on 
ERPG-2 (Emergency Response Planning Guidelines - 
Level 2) or level of concern data compiled by EPA. The 
flammable endpoints represent vapour cloud explosion 
distances based on overpressure of 1 psi or radiant heat 
distances based on exposure to 5 kW/nr for 40 seconds. 

Similar to OSHA’s PSM regulation, coverage under the 
the EPA risk management program regulation is deter¬ 
mined by a list of chemicals with associated threshold 
quantities. However, in contrast to the OSHA PSM regula¬ 
tion, the EPA Risk Management Program regulation pre¬ 
scribes a tiered programme based on the risk and incident 
history of the facility. In order to determine coverage and 
compliance requirements, a facility may follow the steps 
described below in chronological order: 

(1) Check the EPA Risk Management Program list of 
chemicals to determine if any of the chemicals are 
present on site above the listed threshold quantity at 
any time. The threshold quantity determination is not 
cumulative, but the maximum that could be present on 
site at any given time. Other considerations that may 
enter into the threshold quantity determination are 
proximity, interconnectivity, concentration, etc. EPA 
also provides rules for mixtures and effect of dilution. 
If threshold quantity is not exceeded, then the facility 
is not subject to the EPA risk management program, 
and steps 2-4 need not be completed. 

(2) If any of the listed chemicals are present at or above the 
listed threshold quantity, the facility must perform a 
worst-case scenario analysis. If the impact zone from 
worst-case scenario does not contain any public 
receptors, the facility has had no incidents in the last 
5 years, and the facility’s emergency response plan is 
coordinated with local emergency response officials; 
then the facility belongs in Program 1. 

(3) If the facility can not claim coverage under Program 1 
and the facility is classified in any of the industrial 
classification codes listed in Table A32.1 or the facility 
is covered by the OSHA PSM regulation, then the 
facility belongs in Program 3 and must comply with 
Program 3 requirements. 

(4) If the facility does not belong in Program 1 or Program 
3, then by default the facility is required to comply 
with Program 2 requirements. 
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Table A32.1 Eligibility criteria and compliance requirements for different program levels - EPA’s Risk Management 
Program regulation 

Program 1 

Program 2 

Program 3 

Program Eligibility Criteria 

No offsite accident history 

No public receptors in 
worst-case circle 

Emergency response coordinated 
with local responders 

Process not eligible 
for program 1 or 3 

Process is subject to OSHA 

PSM (29 CFR 1910.119) 

Process is SIC code 2611, 2812,2819, 
2821, 2865,2869,2873,2879, or 2911 

Program Requirements 

Hazard assessment 

Worst-case analysis 

5-year accident history 

Certify no additional steps needed 

Hazard assessment 

Worst-case analysis 

Alternative releases 

5 -year accident history 

Hazard assessment 

Worst-case analysis 

Alternative releases 

5 -year accident history 


Management program 

Document management system 

Management program 

Document management system 


Prevention Program 

Safety information 

Hazard review 

Operating procedures 

Training 

Maintenance 

Incident investigation 

Compliance audit 

Prevention Program 

Process safety information 

Process hazard analysis 

Operating procedures 

Training 

Mechanical integrity 

Incident investigation 

Compliance audit 

Management of change 

Pre-startup safety review 

Contractors 

Employee participation 

Hot work permits 


Emergency response program 
Develop plan and program 

Emergency response program 

Develop plan and program 


As stated earlier, EPA used a tiered approach based 
on risk and the facility’s incident history. It is a recogni¬ 
tion of the fact that one size does not fit all and the 
risk management program is based on a three-pronged 
approach. First, the hazard assessment provides infor¬ 
mation about potential off-site consequences and the 


incident history of the facility The prevention programme 
and the emergency response programme are then 
developed based on the hazard assessments. It should 
be noted that the prevention programme requirements 
under Program 3 mirror the OSHA PSM programme 
requirements. 
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Accident prevention and mitigation of consequences is the 
focus of a number of industry programmes, regulatory 
initiatives. As part of these programmes and regulations, 
accident history data is often collected. There are two basic 
types of information. One is a database consisting of 
standardized fields of data usually for a large number 
of incidents. The second are more detailed reports of 
individual incidents. 

Analysis of these accident history databases can provide 
insight into accident prevention needs. While the analysis 
and conclusions obtained from the accident database is 
often limited by the shortcomings of the databases them¬ 
selves, the fact remains that accident history databases 
are very useful and can be a powerful tool in focusing 
risk reduction efforts. The conclusions can be used to sys¬ 
tematically identify the greatest risks to allow prioritiza¬ 
tion of efforts to improve process safety. At the plant level 
this might entail identifying certain processes, types of 
equipment, chemicals, operations and other factors most 
commonly associated with incidents. Databases that cover 
a very large number of facilities are likely to reveal trends 
and patterns that no one company or facility could deter¬ 
mine from their own experience. 

Statistical knowledge of the likelihood of the release of 
certain types of chemicals could help emergency respond¬ 
ers, state emergency response commissions, and local 
emergency planning committees determine the most likely 
and most serious chemical releases in their areas and plan 
appropriate chemical accident responses. 

Incident databases may also help identify technologies 
and practices to prevent chemical accidents, or the need 
to develop them. For example, the data could indicate 
that inspection and preventive maintenance of equipment 
and instruments should become more thorough or more 
frequent. 

The Mary Kay O’Connor Process Safety Center 
(MKOPSC) provides an assessment of the usefulness of US 
Federal databases in Feasibility of Using Federal Incident 
Databases to Measure and Improve Chemical Safely. This 
study identifies a number of trends and patterns of chemi¬ 
cal incidents. It also makes a number of recommendations 
for improving these databases. The report defines an inci¬ 
dent as, “An incident is the sudden unintended release of 
or exposure to a hazardous substance, which results in or 
might reasonably have resulted in, deaths, injuries, sig¬ 
nificant property or environmental damage, evacuation or 
sheltering in place.” This definition will be used as a refer¬ 
ence to describe the type of incidents reported in the 
following section. 


A33.1 Incident Databases 

A33.1.1 National Response Center (NRC) Incident 
Reporting Information System (IRIS) 

The NRC is the primary initial notification system for the 
US federal government. It is operated 24 h a day, 7 days a 
week. It receives the notification of a release and forwards 
that information to numerous federal, state and local 
agencies. Approximately 25,000 incidents are reported 
each year. However, the majority of these incidents involve 
very small or unknown quantities. While reporting to the 
NRC is required by a number of statutes, it also receives 
numerous ‘complaints’ from the public. Many of the inci¬ 
dents are spills of fuel from motor vehicles, small spills of 
low hazard materials such as lubricating oil and oil sheens 


on water with unknown sources, quantities and effects. 
Only about 30% of the reported cases constitute an inci¬ 
dent as defined in the MKOPSC report. 

Because this system contains initial reports the informa¬ 
tion is preliminary and many times inaccurate or incom¬ 
plete. There is also duplicate reporting of incidents. The 
completeness and accuracy of chemical names depends on 
the knowledge level of the person reporting the incident. It 
has been found that those reports from chemical manu¬ 
facturing facilities are more accurate and do provide useful 
information. For a limited number of incidents, NRC also 
presents a limited number of detailed incident summaries. 

A33.1.2 EPA Risk Management Plan (RMP) - 5-year 
accident history 

The US EPA as part of its Risk Management Program 
requires certain facilities to report their 5-year accident 
history. This requirement applies to releases of a listed 
substance that is stored above a threshold quantity and 
results in fatalities, injuries, or significant environmental 
or property damage. The initial 5 years covered the period 
from mid-1993 to 1998. 

Only 1900 releases are reported from about 14,500 facil¬ 
ities for the 5-year period. The combination of the three 
main reporting criteria appears to exclude a large number 
of incidents. The reports do address such items as the cau¬ 
ses and consequences of the release and steps taken to 
prevent or mitigate future incidents. Since the reporting is 
from a defined universe of facilities it allows statistical 
treatment of the frequency of releases not available from 
systems that report releases from an undefined universe of 
facilities. 

A33.1.3 Agency for Toxic Substances Disease 
Registry (ATSDR) - Hazardous Substances 
Emergency Events Surveillance (HSEES) 

The ATSDR administers a programme with approximately 
15 states to collect information regarding chemical releases 
and their health effects on workers, emergency responders 
and the public. This database now contains over 50,000 
events and adds more than 5000 per year. This is probably 
the largest high quality dataset in existence. Releases from 
both fixed facilities and transportation systems are inclu¬ 
ded. The reporting excludes releases of petroleum products 
unless they contain other hazardous materials. This system 
focuses on the health effects that are gatheredfrom numer¬ 
ous sources such as public records, hospitals, media and 
interviews. The database is expected to be available to the 
general public by the time this handbook is published. The 
agency issues annual reports summarizing the results. 
These reports generally exclude some details such as the 
quantity released that would be helpful in the analysis of 
incidents. However, such information will he available 
when the database is released. 

A33.1.4 EPA Accidental Release Information 
Program (ARIP) 

This discontinued program contains nearly 5,000 incidents 
collected primarily in a 3-year period in the late 1980s. 
Prior to the establishment of other programmes in the 
1990s this was one of the best sources of data. While there 
was no strict criteria for reporting to this database it is one 
of the larger collections of incidents with details concern¬ 
ing, causes, consequences, operating mode, and corrective 
actions. Facilities reported in response to a request from the 
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EPA. Requests were sent to facilities that reported frequent 
or significant incidents. While no trends can be gathered 
from this system it does provide detailed information 
not available in other systems. The database generally 
excludes releases of simple hydrocarbons. 

A33.1.5 Accident Investigation System (AIS) - 
Occupational Safety and Health Administration, 

US Department of Labor 

This system contains reports from all OSHA-regulated 
facilities with accidents resulting in a fatality or three or 
more injuries. The most useful feature of the system is that 
it includes a brief description of how the incident occurred. 
Most systems lack this feature making it very difficult to 
determine what actually occurred during an incident. Also, 
there are no arbitrary limits on the type of chemical 
involved or its quantity, only on the consequences. This 
database contains many accidents unrelated to chemicals 
but does include a text search. 

A33.1.6 US Department of Transportation (DOT) - 
Hazardous Material Incident Reporting System (HMIRS) 

This reporting system includes all modes of transportation 
except pipelines. Reporting is required from all interstate 
transport companies and results in a total of about 17,000 
reports per year. Like the NRC, many of these cases are of 
little significance and do not meet the definition of an inci¬ 
dent in the MKOPSC report. 

A33.1.7 US DOT Integrated Pipeline Information 
System (IPIS) 

Pipelines are covered in three categories, one for natural 
gas distribution, one for natural gas transmission and one 
for all other hazardous substances. 

A33.1.8 Center for Chemical Process Safety (COPS) 

CCPS maintains a private database. Only members that 
contribute incidents to the database are allowed to view 
the data. 

A33.1.9 Major Accident Hazards Bureau (MAHB), 

Major Accident Reporting System (MARS) 

This system is maintained by the European Union’s 
MAHB. It is a hybrid between a database and a report- 
based system. While the data is structured it contains 
extensive text descriptions of the incidents. The data is 
sanitized to remove identifying references. There are cur¬ 
rently about 400 cases available to the public. 

A33.2 Injury and Fatality Databases 
(Not Tied to Specific Incidents) 

The following are sources of statistical information 
regarding injuries and fatalities due to chemicals. They do 
not reveal the details of specific incidents but do provide 
statistical information about injuries due to chemicals in 
the United States. 

A33.2.1 Occupational Illness and Injury Statistics (OIIS) - 
Occupational Safety and Health Administration, 

US Department of Labor 

These statistics are based on an annual sampling of about 
250,000 companies in the United States. This data has been 
collected and reported on a consistent basis since 1992. 
There is good detail for chemicals and industries involved 
in injuries. There are additional details concerning the type 
of injury and the body parts involved. 


A33.2.2 Census of Fatal Occupational Injuries (CFOI) - 
Occupational Safety and Health Administration, 

US Department of Labor 

Beginning in 1992, OSHA implemented a rigorous system 
of counting all fatal occupational injuries. This is based on 
cross checking at least two sources of information. This 
system also contains the chemical and industry involved. 
The OSHA web site features both a querying system as well 
as formatted tables of data. 

A33.2.3 Mortality Database, Centers for Disease Control, 
United States 

This system is based on an analysis of all death certificates 
in the United States. It therefore includes all commercial, 
transportation and residential settings. The system also 
includes intentional acts such as assaults, suicides and 
substance abuse, which are not normally considered to be 
chemical incidents. 

US death certificates are coded to indicate the cause of 
death. There is also a set of codes that describe the source of 
injury if applicable. Avariety of codes describe hazardous 
substances. 

A33.2.4 US Coast Guard (USCG) 

The USCG maintains a database of oil spills and another 
for chemical spills to navigable waters. The incidents are 
typically those observed by the Coast Guard. The vast 
majority involve small or unknown quantities. The data 
show clear progress in reducing the quantity of oil spilled 
over the last 30 years. 

A33.2.5 National Electronic Injury Surveillance System - 
Consumer Product Safety Commission, USA 

This system is based on data from the emergency rooms of 
approximately 100 US hospitals. These hospitals are cho¬ 
sen to reflect US demographics. Specific events are not 
reported to maintain patient confidentiality. Statistical 
information for chemical related injuries are reported. 

A33.3 Incident Investigation Reports 

A33.3.1 United States 

United States Chemical Hazard and Safety Board (CSB) 
The CSB is the primary investigatory body for fixed faci¬ 
lity chemical accidents. They perform detailed exami¬ 
nations of major accidents. They also perform studies of 
various classes of accidents such as reactive chemicals. 

United States Department of Energy 
The DOE has an on-line database of Red Alerts, Yellow 
Alerts, Lessons and Good Work Practices. These mainly 
involve the contractors that operate various DOE facilities. 

United States Environmental Protection Agency (EPA) 
The EPA performed several investigations before the 
advent of the CSB. 

United States Fire Administration (USFA) 

The USFA investigates major fires of all types. About a 
dozen of these reports cover chemical incidents. 

National Institute for Occupational Safety 
and Health (NIOSH) 

The National Institute for Occupational Safety and Health 
(NIOSH) Fatality Assessment and Control Evaluation 
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(FACE) programme is a research programme designed to 
identify and study fatal occupational injuries. The goal of 
the FACE programme is to prevent occupational fatalities 
across the nation by identifying and investigating work 
situations at high risk for injury and then formulating and 
disseminating prevention strategies to those who can 
intervene in the workplace. 

The FACE programme currently has two components: 

(1) NIOSH in-house FACE began in 1982. Participating 
states voluntarily notify NIOSH of traumatic occupa¬ 
tional fatalities resulting from specific causes of death 
that have included confined spaces, electrocutions, 
machine-related, falls from elevation, and logging. 
The confined space incidents are the ones of interest in 
terms of process safety. In-house FACE is currently not 
targeting confined space incidents. 

(2) NIOSH State-based FACE began in 1989. Currently, 15 
State health or labour departments have cooperative 
agreements with NIOSH for conducting surveillance, 
targeting investigations, and recommending preven¬ 
tion activities at the State level using the FACE model. 

There are approximately 75 NIOSH reports and 70 state 
reports. 

NIOSH has also published a series of ‘Fire Fighter Fatal¬ 
ity Investigation Reports’. Several of these are chemical 
related incidents. 

Occupational Safety and Health Administration (OSHA) 
OSHA, sometimes in collaboration with the EPA, investi¬ 
gated several incidents before the creation of the CSB. 

National Transportation Safety Board (NTSB) 

The NTSB has responsibility for investigating transpor¬ 
tation related hazardous materials spills on highways, air¬ 
lines, railroads and pipelines. NTSB classifies incidents as 
Hazardous Materials Accidents for all modes of transpor¬ 
tation except pipelines. Pipeline Accident reports are listed 
separately. Maritime incidents are excluded, they are han¬ 
dled by the USCG. 

The Pipeline Accident reports include about 17 incidents 
since 1994 which are on-line and 69 reports prior to that 
time which are available on paper. The Hazardous 
Materials Accident reports include 18 since 1998 that are 
on-line and 55 available on paper. 

Minerals Management Service (MMS) 

The MMS investigates incidents related to offshore drilling 
activities. In-depth reports are called Accident Investiga¬ 
tion Panel Reports’. Approximately 25 of these are related 
to pipeline leaks, fires, explosions or blowouts. 

Department of Labour - Mine Safety and Health Admin¬ 
istration (MSHA) 

The MSHA reports include approximately 20 incidents 
involving fatalities that meet the criteria of chemical inci¬ 
dent. The incidents of interest are generally classified as 
‘Ignition or Explosion of Gas or Dust’ or ‘Exploding Vessels 
Under Pressure’. 

National Fire Protection Association (NFPA) 

The NFPA has produced 141 detailed fire investigations. 
These reports are available on-line. They are free of charge 
to NFPA members. Paper copies are available for purchase. 
Approximately 15 of the reports are chemical related 
incidents. 


A33.3.2 Australia 

Australian Transport Safety Bureau (ATSB) 

The ATSB have produced 16 reports of interest. These are 
primarily related to engine room fires on ships. 

Department of Mineral and Petroleum Resources 
(Western Australia) 

The DMPR has produced 10 reports of interest concerning 
a variety of topics. 

Victorian Work Cover Authority 

Various reports and guidance are found in ‘Alerts & 
Guidance Notes’. 

A33.3.3 Canada 

Alberta Energy and Utilities Board 

The AEUB has produced several incident reports as well as 

studies related to the hazards of sour natural gas. 

Workplace Health and Safety, Alberta 
They have produced about 16 reports concerning various 
fires, explosions and exposures. The reports under the 
heading ‘Fatality Reports’ cover the period from 1997 to 
2002. 

Canadian Center for Occupational Health 
and Safety (CCOHS) 

The CCOHS has produced approximately 60 reports mostly 
covering fires and explosions. Fatality Reports contains 
information about the circumstances surrounding occupa¬ 
tionally related fatalities. Information is extracted from 
reports on inquests and inquiries into occupationally rela¬ 
ted fatalities across Canada. These reports may be from 
Coroners, Medical Examiners, Government Ministries, or 
any other body responsible for inquiry into occupational 
fatalities. 

Database highlights are: 

(1) unique safety database identifies unsafe equipment, 
practices, work conditions; 

(2) inquest reports offer practical recommendations to 
prevent recurrences of fatalities. 

Transport Safety Board of Canada (TSB) 

TheTSB is quite similar to the NTSB in the United States. 
Their interest is in identifying causes and recommending 
solutions. They do not have regulatory authority. Approxi¬ 
mately 45 rail incidents, 14 pipeline incidents and 7 marine 
incidents involve hazardous materials are available. The 
reports are under the headings Pipeline, Marine and Rail 
ontheirwebsite. 

A33.3.4 Finland 

Finland Accident Investigation Board (English summary) 
The FAIB has produced 16 reports covering Rail, Maritime 
and Fixed facilities. Their website contains English sum¬ 
maries that are about one page. The actual reports in 
Finnish are much more detailed. 

A33.3.5 United Kingdom 
Health and Safety Executive 

MHIDAS (Major Hazard Incident Data Service) is a data¬ 
base of incidents involving hazardous materials that had 
an off-site impact, or had the potential to have an off-site 
impact. Such impacts include human casualties or damage 
to plant, property or the natural environment. 
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MHIDAS is maintained by, AE ATechnology pic on behalf 

of the UK Health and Safety Executive, and features: 

(1) searchable codified and textual information on more 
than 11,000 incidents, involving the transportation, 
storage and processing of hazardous materials; 

(2) worldwide coverage, with a focus on incidents 
occurring in the United Kingdom and United States; 

(3) comprehensive coverage of incidents that have 
occurred during the last twenty years, plus sig¬ 
nificant earlier incidents; 

(4) new data made available on a quarterly basis. 

Each MHIDAS incident is coded in a standard format to 

include details such as: 

(1) the hazardous material involved in the incident; 

(2) the number of fatalities, injuries and evacuations 
attributable to the incident; 

(3) a brief description of the circumstances of the incident. 


Information from MHIDAS can be accessed: 

(1) through a personalized service, provided on a fee basis 
through AEA Technology, or 

(2) on a subscription basis, via CD-ROM or Internet, or 

(3) via an on-line information Retrieval Service, for which 
charges are made. 


Marine Accident Investigation Branch (MAIB) 

The MAIB has produced seven relevant detailed reports 
and nine articles in their monthly “Safety Digest”. The 
fundamental purpose of investigating an accident under 
these regulations is to determine its circumstances and the 
causes with the aim of improving the safety of life at sea 
and the avoidance of accidents in the future. It is not the 
purpose to apportion liability, nor, except so far as is 
necessary to achieve the fundamental purpose, to 
apportion blame. 
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A34.1 General Information 

Safety Information and the Internet, http://hazard.com/ 
course/ 

The site provides general information on how to use the 
internet as a tool to obtain required information. 

A34.2 Technical Information 

Government Research Center, NTIS search engine, http:// 
grc.ntis.gov/ 

The National Technical Information Service (NTIS) 
database offers unparalleled bibliographic coverage of 
research sponsored by the United States and selected for¬ 
eign governments. 

Risk World - First Internet Chemical Process Safety 
Business Portal, http://www.riskworld.com 
This site has a comprehensive source of risk related 
information on all aspects of life - chemicals, bioterrorism, 
business, safety, etc. 

Risk Analysis Methodologies, http://homel.- 
pacific.net.sg/~thk/risk.html 
The site is maintained by T.H. Keong and provides an 
overview of risk assessment methods. 

Root Cause Analysis, http://www.rootcauselive.com/ 

A website devoted to root cause analysis practitioners. 

A34.2.1 Energetic materials/reactive chemicals 

Chemweb - Brethericks Databases, http://chemweb.com/ 
databases/brethericks 

Bretherick’s database is a comprehensive source of 
information on energetic or reactive materials. 

Explosion Hazards Database - National Institute of 
Materials and Chemical Research (NIMC), http://www. 
aist.go.jp/RIODB/db005/index.html 
This database includes explosion hazard test data for 
energetic materials obtained at laboratories of the NIMC in 
Japan. 

UK Chemical Reaction Hazard Forum, http://www.crhf. 
org.uk/ 

UK Chemical Reaction Hazards Forum is a group of pro¬ 
cess safety professionals from the UK chemical industry 
for mutual exchange of information, expertise and ideas 

A34.2.2 Toxicology 

Environmental Defense Fund - Chemical Scoreboard, 
http://www.scorecard.org/ 

Scorecard is a source for free and easily accessible local 
environmental information. One can learn about environ¬ 
mental issues in your community by typing in zip code. 
Scorecard carries health and environmental related infor¬ 
mation for the chemicals in its database. 

National Toxicology Program, http://ntp-server.mehs.- 
nih.gov/ 

National Toxicology Program (NTP) coordinates tox¬ 
icological testing programmes within the Department of 
Health and Human Services, strengthens the science base 
in toxicology; develops and validates improved testing 
methods; and provides information about potentially toxic 
chemicals to health regulatory and research agencies, the 
scientific and medical communities, and the public. 

NIOSH - Registry of Toxic Effects of Chemical Sub¬ 
stances (RTECS), http://www.cdc.gov/niosh/rtecs.html 
RTECS, maintained by National Institute for Occupa¬ 
tional, Health, and Safety (NIOSH) is a compendium of data 


extracted from the open scientific literature. Six types of 
toxicity data are included for a chemical: (1) primary irri¬ 
tation; (2) mutagenic effects; (3) reproductive effects; 
(4) tumorigenic effects; (5) acute toxicity; and (6) other 
multiple dose toxicity. 

A34.3 University Academic Programmes 

Fire Protection Engineering Program, University of Mary¬ 
land, College Park, http://www.enfp.umd.edu/ 

The programme offers fully accredited undergraduate 
program and one of two graduate degree programs in the 
Unitied states. 

Hazard Lab Group, Michigan Tech University, http:// 
www.chem.mtu.edu/org/hazards/hazards.html 

The research of the group members focuses on generat¬ 
ing data for flammable and reactive compounds. 

Mary Kay O’Connor Process Safety Center (MKOPSC), 
Texas A&M University, http://process-safety.tamu.edu 

The research of the center focuses on process safety in 
the chemical industry 

Safety, Environment and Loss Prevention, Chemical 
Engineering Department, Loughborough University, 
http://www.lboro.ac.uk/departments/cg/research.html 

The research of the group focuses on sustainable process 
development. 

Thermal Hazards Laboratory, Queens University, http:// 
me.queensu.ca/people/birk/research/thermalHazards/ 

The focus of the research at the Thermal Hazards 
Laboratory is the safety of the storage and transportation 
of pressure liquified gases. The laboratory uses large scale 
experiments and thermodynamic modelling to study the 
response of a vessel in an accident situation and the possi¬ 
ble hazards arising from vessel failure. 

A34.4 Government Organizations 

Health and Safety Executive (HSE), http://www.hse. 
gov.uk/ 

The UK Health and Safety Commission (HSC) and the 
Health and Safety Executive (HSE) are responsible for the 
regulation of almost all the risks to health and safety aris¬ 
ing from work activity in Britain. 

Environmental Protection Agency (EPA), http://www. 
epa.gov 

EPA provides leadership in the nation’s environmental 
science, research, education and assessment efforts. The 
Agency also works with industries and all levels of gov¬ 
ernment in a wide variety of voluntary pollution prevention 
programmes and energy conservation efforts. 

Occupational, Safety and Heath Administration, http:// 
www.osha.gov 

OSHA’s mission is to prevent work-related injuries, ill¬ 
nesses, and deaths. 

US Chemical Safety Board (CSB), http://www.chemsa- 
fety.gov/ 

The mission of the US Chemical Safety and Hazard 
Investigation Board is to promote the prevention of major 
chemical accidents at fixed facilities. 

A34.5 Societies, Councils, Institutes 

American Industrial Hygiene Association (AIHA), http:// 
www.aiha.org/ 

AIHA promotes, protects, and enhances industrial 
hygienists and other occupational health, safety and 
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environmental professionals in their efforts to improve the 
health and well being of workers, the community, and the 
environment. 

Center for Chemical Process Safety (CCPS), http:// 
www.aiche.org/ccps/ 

CCPS brings together manufacturers, insurers, govern¬ 
ment, academia, and expert consultants to lead the way in 
improving manufacturing process safety. 

Institute of Chemical Engineers (IChemE), http:// 
www.icheme.org 

IChemE is a leading international body, providing ser¬ 
vices for and representing the interests of those involved 
in chemical, biochemical and process engineering world- 

A34.6 Security and Vulnerability Assessment 

American Chemistry Council (ACC) Site Security Guide¬ 
lines, http://www.responsiblecaretoolkit.com/ 


ACC offers Guidelines for the U.S. Chemical Industry, 
developed by a group of company security professionals 
and designed specifically for the chemical industry, can 
help member companies build upon their existing security 
programmes. 

CCPS Security and Vulnerability Analysis (SVA), http:// 
www.aiche.org/ccps/sva/ 

CCPS recommends a method for industry to analyse 
their chemical security risks. 

Sandia National Laboratory’s, http://www.nlectc.org/ 
ccfp/ 

Center for Civil Force Protection (CCFP) at Sandia 
National Laboratories (SNL) provides physical security 
counter terrorism assistance to state and local agencies. 
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Sample issue 1975 - Reactor thermal stability, p. 2; 
Storage tank collapse, p. 2; Explosion and fire in ethylene 
plant, p. 3; How strong is your storage tank?, p. 3; 
Hammerblow in pipelines, p. 6 

1 1975 - Are your plant modifications safe?, p. 1; More 
cases of water hammer, p. 7; Exothermic reactor, p. 10; Air 
eliminator explosion, p. 15 

2 1975 - Static electricity as a fire hazard, p. 1; Investi¬ 
gation of electrostatic ignition hazards, p. 12; How can we 
tell if the accident record is really better?, p. 15 

3 1975 - Explosive reactions caused by impurities, p. 1; 
Practising what is preached, p. 8; Hydrogen sulphide, 
H 2 S, p. 17 

4 1975 - Total loss control, p. 1; Engineering main¬ 
tenance, p. 9 

5 1975 - Chemical and physical explosions in furnaces 
and boilers, p. 1; Bellows again (see also LPB 6), p. 9; 
Reaction kinetics, p. 16 

6 1975 - Hazards of corrosion, p. 1; Relief valves and 
bursting discs, p. 12; More explosions in plant equipment 
(see also LPB 7), p. 17 

7 1976 - Instrumentation and control, p. 11; Nitrogen, 
p. 11; Human error, p. 15 

8 1976 - Second chance and fail safe design, p. 1; Explo¬ 
sions and fire involving dusts, p. 7; Information for plant 
operators, p. 19 

9 1976 — Vessel overflows, p. 1; Mishap miscellany, p. 5; 
Potential hazards due to seal failures, p. 12; Unexpected 
material properties, p. 26 

10 1976 - Fin fan coolers, p. 1; Ball valves, p. 3; Radios 
(see also LPB 11), p. 4; Pressure relief valve chattering, p. 5; 
The spreading and dispersion of a large release of heavy 
gases, p. 9 

11 1976 - A major incident, p. 2; The risk of hydro¬ 
carbons entering steam and condensate systems, p. 5; 
Mishap miscellany, p. 10; Control room design and location 
- one company’s viewpoint (see also LPB 13), p. 16; Relia¬ 
bility assessment Pt 1, p. 18 

12 1976 - Hazards of pyrophoric iron sulphide, p. 1; Safe 
design and operation of hot oil tanks, p. 7; Neutralisation of 
phosphorous trichloride, p. 11; Inadequate physical and 
chemical data - source of major hazard, p. 12; Reliability 
assessment Pt 2, p. 17 

13 1977 - Chemical reactor hazards, p. 2; Hose and 
coupling incidents, p. 5; Laboratory accidents, p. 14; Coaxial 
pipes, p. 17; Phosphorus chlorides, p. 21 

14 1977 - Operating, maintenance and modification 
procedures (software), p. 2; Excess flow valves — one com¬ 
pany’s view, p. 15; Diagnostic techniques, p. 17 

15 1977 — Hydrogen (see also LPB 18), p. 2; Building 
ventilation, p. 10; Liquid metal embrittlement (see also 
LPB 17), p. 23; Safety systems for tanker loading and 
unloading, p. 30; Road tanker hose and coupling incidents, 
p. 33; Hose and coupling incidents, p. 35 

16 1977 - The hazards of mineral acid and alkali hand¬ 
ling (see also LPB 16), p. 3; Protection for bulk storage of 
corrosive liquids, p. 21; Control room design and 
location - a further viewpoint, p. 24 

17 1977 - Lagging fires (see also LPB 19), p. 2; Relief 
valve and venting systems - more hazards associated 
with maintenance and modification, p. 15 


18 1977 - Plant commissioning hazards (see also LPB 19, 
20), p. 2; Laboratory accidents, p. 17; Co-axial pipes, p. 2; 
Excess flow valve incident, p. 22 

19 1978 - The transport of chemicals by road, p. 1; Safety 
down the drain, p. 10; Compression ignition — a case his¬ 
tory, p. 24 

20 1978 - More software failures, p. 41; Hazards of gas 
cylinders, p. 45; A new approach to the layout of storage 
tanks, p. 55 

21 1978 - Instrumentation, p. 68; Sparks from steam, 
p. 81; Hydrogen, p. 85 

22 1978 - Hazards of improvisation, p. 101; Fire extin¬ 
guishing agents and their uses, p. 107; Reflections on the 
rubbish bin, p. 114; A new approach to the layout of storage 
tanks (letter), p. 114 

23 1978 - Loss prevention in the design and selection of 
bursting discs, p. 125; Material selection - a factor for loss 
prevention, p. 136; Hazards of radio frequency ignition, 
p. 147 

24 1978 - Engineering maintenance, p. 155; Liquid light¬ 
ness of tank dikes, p. 164; Ancillary equipment incidents, 
p. 167; Corrosion/erosion - some more accidents, p. 172 

25 1979 - Fire and explosion hazards in dryers by D. Reay; 
Loss prevention: a one company view by D.J. Kerr; Reactive 
chemicals: cyanuric chloride, p. 19; Dimethyl sulphate 
(letter), p. 24 

26 1979 - Bulk storage of corrosive liquids - catastrophic 
failure of phosphoric acid tanks (see also LPB 33), p. 31; 
Pressure testing, p. 39; Hazards of comminution, p. 48; 
Explosions in seal oil reservoirs of centrifugal gas com¬ 
pressors, p. 51; Liquid tightness of tank dikes (letter), p. 52 

27 1979 - Acoustic emission testing, p. 59; Hazards 
involving the use and storage of drums, p. 68; Report on the 
International Symposium on Grain Elevator Explosions, 
p. 76; Engineering maintenance - further incidents, 
p. 80; Academic use of Hazard Workshop Modules by 
G.S.G. Beveridge 

28 1979 - Thermal properties of reactors and some 
instabilities, p. 91; Flare systems, p. 97; Stress corrosion 
cracking of stainless steel, p. 104; Design recommendations 
for outdoor drum storage, p. 115, Guide Notes on the Safe 
Use of Stainless Steel in Chemical Process Plant (letter), 

p. 118 

29 1979 - Some hazards due to layering of liquids, p. 124; 
Static electricity - further case histories, p. 134; Dead head 
hazards of centrifugal pumps, p. 139; Embrittlement of 
stainless steel by zinc, p. 149; A'nitrogen explosion’ (letter), 
p. 151 

30 1979 - Fire in ducting, p. 155; Thermal decomposition 
tests, p. 159; Aniline toxicology, p. 165; ‘Small is beautiful’, 
p. 171; Embrittlement of stainless steel by zinc, p. 175 

31 1980 - The Second Report of the Advisory Committee 
on Major Hazards — a review by G.S.G. Beveridge; Fire 
resistance and flame retardants, p. 5; Oxygen deficiency in 
nitrogen atmospheres and related problems, p. 11; Valve 
limitations, p. 17; Flare systems - pump out of knockout 
drum (letter), p. 27 

32 1980 - Atmospheric storage tanks for flammable 
liquids, p. 1; Shell/bottom junction failure in a cone roof 
tank, p. 13; HSE Guides: tanker marking - packaging and 
labelling - hot work, p. 15; Legal obligations in relation to 
chemical engineering laboratories by V.C. Marshall; 
Hazards in chemical engineering laboratories by 
D.H. Napier; People in laboratories by MA Buttolph; 
Designing of chemical engineering laboratories by 
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K. Everett; Planning safe chemical engineering experi¬ 
ments by HW Fowler; A case study: designing new chemi¬ 
cal engineering laboratories by G.F. Martin 

33 1980 - An accident investigation procedure by 
P. Robinson (see also LPB 34); Industrial dermatitis by 
R.J.G. Rycroft; A case of valve failure by PR. Perkins 

34 1980 - One company’s approach to the authorisation 
of modifications, p. 1; Some seldom considered aspects of 
pressure relief systems by D.S. Scott (see also LPB 36) 

35 1980 - Static electricity and dust explosions, p. 1; 
Hazards of plant cleaning, p. 7; The Law on safety - some 
questions answered, p. 13; Hazards from ionizing radiation 
by B. Holiday 

36 1980 - To vent or not to vent, p. 1; Operating experi¬ 
ences with incinerators from a loss prevention standpoint 
by D.R. Ready and R.F. Schwab; Another Feyzin (see also 
LPB 40,41), p. 25 

37 1981 - Safety of atmospheric storage tanks, p. 1; How 
strong is a storage tank?, p. 7; Failure of a lime silo (see 
also LPB 39), p. 23; From batswing burner to wind tunnel 
or ‘Is the fume cupboard obsolete’ - one man’s view 
by V.C. Marshall 

38 1981 - Accidental release of ammonia to the 
atmosphere - evidence for the occurrence of denser-than- 
air vapours by G.D. Kaiser; Hazards of unsatisfactory plant 
cleaning, p. 23; BSI quality assurance scheme for industrial 
fasteners, p. 23 

39 1981 - Electrical fire dangers in the chemical industry 
by G. Marshall; Glove boxes - some aspects of their use, 
p. 11; Distribution safety (see also LPB 43), p. 17 

40 1981 - Hazard identification game by D. Lihou; Power 
fluidics - control without movement, p. 7 

41 1981 - Guidance note on the leak hazards of glass 
process plant and pipeline equipment, p. 1; Fire hazards of 
electric cables in trays, p. 5; Rupture of roof of caustic sto¬ 
rage tank, p. 11; Flame arresters and explosion suppres¬ 
sion, p. 13 

42 1981 - Safe transport of radioactive materials by 
PW. Wilson; Glass as a construction material in the 
chemical industry, p. 11; Safety in design of plants handling 
liquefied light hydrocarbons (see also LPB 45), p. 21; An 
overview of disaster control by D. Lihou 

43 1982 - Fire prevention/protection - a company’s 
approach to fire safety (see also LPB 44), p. 1; Case history 
of a liquid propane release at Norsk Hydro’s ethylene plant 
at Rafnes, Norway, 8th July, 1981 (see also LPB 47), p. 21; 
Case histories related to fire, p. 21 

44 1982 - Design and maintenance of trip systems by 
M.R. Gibson and G. Knowles; Mississauga by R.F. Fordham; 
Mexican rail incident 1st August 1981, p. 33; More on 
glassware - incidents and practical hints, p. 35 

45 1982 - Rollover of metal reverse bursting discs: a 
problem, p. 1; Manufacturer’s comments (on bursting 
discs), p. 77; Elfab Hughes (J.D. Falconer), BS&B Safety 
Systems (H.J.R. Beveridge) (see also LPB 46), Johnson 
Mathey Metals Ltd (G.C. Brazier), Crosby Valve and Engi¬ 
neering Ltd (G.R. Newman) and An abbreviated report on a 
test of damaged discs by J.D. Falconer 

46 1982 - Hazard and risk analysis - a foreword by 
VC. Marshall; Completeness and discrimination of hazard 
analyses by J.R. Taylor (see also LPB 48); Hazop - the views 
of the Chemical Industries Association by PC. Merriman 

47 1982 - The probability of coincidence by J.D. Edwards; 
Fire at Browns Ferry Nuclear Power Station, p. 13; Spon¬ 
taneous combustion, p. 15; Fighting rim fires byT. A. Kletz; 


Hazard to pressure vessels storing large quantities of a 
hazardous material, p. 26 

48 1982 - The hazops man comes to call - two case stu¬ 
dies of hazard studies for relief systems by D.S. Scott (see 
also LPB 49); HF acid leak in alkylation unit, p. 13; Accidents 
of the past by T.A. Kletz; Flixborough - the role of the 
emergency services by VC. Marshall; Accidents today, p. 27 

49 1983 - One company’s experience of a hazop study 
(see also LPB 51), p. 1; Safety lockout and electrical isola¬ 
tion, p. 7; Accidents of the past by T.A. Kletz; Ventilation, 
p. 15; Accidents of today, p. 26; How far will heat flow down 
a dead pipeline?, p. 28; MUF (Material Unaccounted 
For), p. 28 

50 1983 — A risky life by Sir F. Warner; Chemical 
hazards - reminiscences and lessons of fifty five years by 
S.R. Tailby, Some historical notes on explosions by J. Bond; 
Health hazards of yesteryear by J.T. Carter 

51 1983 - Inherently safer plant - the concept, its scope 
and benefits by T.A. Kletz; Unusual dust explosion, p. 9; 
Fire and explosion case histories (see also LPB 53), p. 13; 
Computer aided operability study by D.A. Lihou (see also 
LPB 53); Major hazards work in the HSE - a personal view 
hy R.P. Pape 

52 1983 - Conflagration at Cleveland, Ohio, 20th October 
1944 by V.C. Marshall; The runaway train, Montanas, 
Mexico, p. 7; Exxon Chemical’s method for identifying 
potential process hazards by C.H. Solomon; Lessons from 
the past 3 - one of Britain’s worst oil fires by T.A. Kletz; 
Case history - static discharge from plastic surfaces, p. 19; 
Methodologies for hazard analysis and risk assessment in 
the petroleum refining and storage industry (review) by 

B. W. Eddershaw;The Safety and Reliability Directorate by 
J. Clifton 

53 1983 - Hazard studies and hazard analysis 10 years 
on by J. Illidge; Inherent safety of pressure vessels and 
systems by K.M. Wicks; Confined space entry, p. 15; Seveso: 
cause; prevention (see also LPB 54), p. 27 

54 1984 - Have you identified all the hazards of your job? 
by C.H. Solomon, Propane vapour escape from a rail tank 
car (see also LPB 56), p. 7; Fire and explosion in a gas oil 
separation plant, p. 13; Incidents 1981, p. 21; Second Inter¬ 
national Conference on. Cryogenic Concrete - a review by 
J.N. Edmondson; Conference on the Safe Handling of 
Flammable Dusts - a review by K.N. Palmer 

55 1984 - On-stream sealing of leaking flange joints 
using a compound sealing process by H.K. Maushagen; 
One company’s experience of permit-to-work systems, 
p. 11; Dealing with the toxic hazards of disposal in a 
safe manner by J.D. Cook; Summary of the Mond Fire, 
Explosion and Toxicity Index by P. Doran and T.R. Greig; 
Observation of the effects of zinc-rich paint on 7 and 9 
Cr-Mo steels during stress relieving and the development 
of suitable cleaning procedures by SETE Consultants and 
Services Ltd 

56 1984 — Corrosion beneath thermal insulation — a 
cause for concern, p. 1; Accidents of the Past No. 4 - carbon 
dioxide as a cause of explosions by T.A. Kletz; Spread of 
fire, p. 11; Formic acid - a hidden hazard, p. 24; Dow reports 
an accident involving a fatality, p. 26; Accidents of today - 
plastic plugs in pressure containing equipment, p. 26 

57 1984 - A major fire in a floating roof crude oil storage 
tank by CJ. Mumford (see also LPB 63); Report on the 
incident at the Texaco Company’s Newark storages facility, 
7th January 1983, p. 11; Case histories - tank fires, p. 19; 

C. A. La Electricidad de Caracas, December 19,1982, Fire 
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(near) Caracas, Venezuela by W.M. Garrison (see also LPB 
59,60,61) 

58 1984 - One hundred largest losses - a thirty year 
review of property damage losses in the hydrocarbon- 
chemical industries by F.A. Manuele; Storage of liquid 
ammonia (see also LPB 59), p. 13; Accidents of the past 
No.5 - major fire at a marketing terminal by T.A. Kletz; 
The HSE heavy gas dispersion trials project at Thorney 
Island by B. Roebuck; The Human Factors in Reliability 
group by I.A.Watson 

59 1984 - Intelligent fire detection systems by 
M. Finucane; Rapid ranking of hazards by C.J. Mumford 
and D.A. Lihou; Safe disposal of relief discharges by 
M. Kneale; Entry into a confined space - a retrospective 
look by J. Bond; Pressure reducers, p. 28; Lessons from 
the past No. 6 - reluctance to recognise new hazards 
by T.A. Kletz; Nitrogen — a gassing incident and a near 
miss, p. 30 

60 1984 - Incidents 1982, p. 1; odour as an aid to chemical 
safety: odour thresholds compared with threshold limit 
values by P.J. Lynskey (see also LPB 61); Personal 
protection: respiratory protection - the importance of 
facepiece fit by M.J. Evans and P. Leinster; Weak spots in a 
refinery, p. 40 

611985 - Emergency procedures by P.J. Lynskey; Update 
on the Spanish campsite disaster by L. Hymes; The phos¬ 
phorus railcar explosion near Brownson, Nebraska, on 
Sunday, 4 February 1978 by I. Hymes; Major disaster aver¬ 
ted in massive escape of vinyl chloride by J. Kilmartin (see 
also LPB 65); Accidents of today, p. 33 

62 1985 - Toxic gas incidents - some important con¬ 
siderations for emergency planning by G. Purdy and 
P.C. Davies (see also LPB 63); Interactive video, p. 13; A 
matter of some agitation by M. Kneale; Safety aspects of the 
use of microcomputers and programmable controllers for 
chemical process control by S.J. Skinner Guide to reducing 
human error in process operation by PW. Ball; A com¬ 
pressor overspeed, p. 27 

63 1985 — Bhopal - the company’s report, p. l;The toxic 
hazards of hydrogen sulphide by P.J. Lynskey; Some H 2 S 
incidents by HSE; The hazards of nitrogen by J. Bond, 
Improving process safety and loss control software in 
existing process plant by H.M. Tweedale; Preparation for 
entry into a confined space - one company’s view (see also 
LPB 64), p. 31 

64 1985 - Analysis of the LPG disaster at Mexico City by 
C.M. Pietersen; Refinery fire contained, p. 13; The toxic 
effects of chlorine by MHAP; Accidents of today, p. 27 

65 1985 - Loss prevention implications of arson: Pt 1, 
Case histories and prevention by P.A. Carson, C.J. Mumford 
and R.B.Ward; Acetylene cylinder fire, p. 15; Violent poly¬ 
merisation by J. Bond; An ethylene reflux pump fire by 
J. Bond, Spectators and other vulnerable exposes to major 
accident hazards: an emergency services headache by 
I. Hymes 

66 1985 - Dust explosibility testing by P. Field (see also 
LPB 66); Some recent British initiatives on dust explosions 
prevention and protection by G. Butters; Principles for the 
safe transfer of technology by EFCE; Hydrogen cyanide 
release from a failed bonnet gasket, p. 23; The need to be 
blamed (letter) by D.A. Lihou (see also LPB 67) 

66 suppl 1985 - Incidents 1983 

67 1986 - Industrial health hazards: Pt 1, Sources of 
exposure to substances hazardous to health by P.A. Carson 


and C.J. Mumford; Lessons from the past No.7 - flying 
saucers have landed by T.A. Kletz; Ludwigshafen - two 
case histories by VC. Marshall 

68 1986 - Unconfined vapour cloud explosions involving 
hydrogen rich gases - estimating the blast effects by 
J.L. Hawksley;The Spanish campsite disaster - a new sce¬ 
nario by H. Ens; Reactor incident, p. 33; Experience with 
a temperature monitoring system, p. 35; The effects of 
explosions in the process industries by the MHAP 

69 1986 - Some problems with valves by J. Bond; Leak 
sealing using compound injection by J. Bond; Refinery fire, 
p. 17; Fatal accident on a hydrocarbon recovery plant, p. 25; 
The rupture of a tank of benzene, p. 29; Power station 
fire, p. 33 

70 1986 - Handling the vapour cloud after failure of a 
flare line, p. 1; Polymer lined GRP tank failure, p. 7; Loss 
prevention implications of arson Pt 2 - Investigation by 
P.A. Carson and C.J. Mumford; Flashing liquid flow calcu¬ 
lations by D.A. Carter 

71 1986 - One hundred largest losses - a thirty year 
review of property damage losses in the hydrocarbon- 
chemical industries by F.A. Manuele; Maintaining your 
sprinkler system by Factory Mutual Engineering 
Corporation; Explosion in an oxidised bitumen tank, p. 71; 
Ship/shore transfer of liquefied gases by J. Bond; Fire in a 
coker unit, p. 27; Three injured in extruder explosion, p. 31; 
The Spanish campsite disaster (letter) by J. Foxcroft 

72 1986 - Sizing pressure vacuum valves for cone roof 
tanks, p. l;The first tanker explosion by P. Watson; Inad¬ 
vertent pressure-testing of a storage tank to destruction, 
p. 7; The Spanish campsite disaster - a third view by 
VC. Marshall; Comments on ‘The Spanish campsite 
disaster - a third view’ by H. Ens; Causes of accidents 
(the results of a study), p. 21; Some problems with 
valves - another case history, p. 28 

73 1987 - Some essentials of lightning protection (in 
electrical systems) by Factory Mutual Engineering 
Corporation; Explosion in an isopropyl alcohol tank, 
p. 9; Is pipework given the attention it deserves by 
R.F. Towndrow; A tale of woe by C.D. Plummer; Spanish 
campsite disaster (letter) by J. Bond (see also LPB 72); 
Extruder explosion (letter) by L. Carter (see LPB 71) 

74 1987 - An oleum leakage, p. 1; Explosion in a super¬ 
heater, p. 15; Fire protection systems - how to cope with 
impairments, p. 17; A pump explodes, p. 23 

75 1987 - Autoignition temperatures (AITs) - how hot is 
dangerous? by F.S. Ashmore and D. Blumson; The Sandoz 
warehouse fire, p. 11; Overpressuring of a storage tank, 
p. 19; Explosion in a heat exchanger during demolition, 
p. 22; Hydrogen sulphide incident, p. 23;The two safeguard 
approach for minimising human failure injuries by J. Bond 
andJ.W. Bryans 

76 1987 - Industrial health hazards: Pt 2, Development of 
UK legislation by P.A. Carson and C.J. Mumford; The 
Chernobyl accident byA.N. Hall, S.F. Hall and W. Nixon; 
HSE warning on road tanker discharge valves, p. 30; Fail¬ 
ures of glass reinforced plastic tanks by T.E. Maddison 

77 1987 - The Feyzin disaster, p. 1; Major LPG fire at US 
refinery, p. 11; Sabotage causes propane release, p. 17; Fire 
at LPG recovery installation of a refinery, p. 27 

78 1987 - Static electricity hazards in industry by 
F.J. Pay; Electrostatic ignition of volatile liquid vapour, p. 9; 
Hydrogen explosion/detonation in an ammonia plant, 
p. 11; Temporary manhole covers by J. Bond; Three year 
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survey of accidents and dangerous occurrences in the 
UK chemical industry by B.J. Robinson; Molten sulphur 
spillage, p. 23; Heat of dilution causes violent eruption in 
storage tank, p. 26; Computerised chemical engineering 
industry information by S. Pantry 

79 1988 - Flame arresters and the chemical tanker by 
P.B. Watson; The velocity flame stopper by W.B. Howard 
Faulty ducts cause switchroom fires, p. 23; Safety audit of 
refrigerated gas facilities, p. 25; Static electricity hazards 
in industry (letter) by PA. Kalisvaart (see also LPB 78) 

80 1988 - Protective clothing design by L.E. Jones; 
Operator burned whilst using incorrect tanker connection, 
p. 3; Gloves as protective equipment by I.P. Hoyle; Protec¬ 
tion from protective clothing by I.P. Hoyle; Hazards on a 
rubber injection moulding machine, p. 14; Expect the 
unexpected, p. 14; Acetylene cylinders can be dangerous by 
F.S. Ashmore; Shattering rotameter cuts safety glasses in 
half p. 19; Dizzy heights, p. 20; Some problems with 
breathing apparatus, p. 21; The International Safety Rating 
System by J. Bond 

81 1988 - Chernobyl - was it the worst accident? by 
VC. Marshall; Glasnost now applies to the Soviet chemical 
industry, p. 15; Incinerator explosion, p. 17; Cool flames by 
R.D. Coffee; Autoignition, slow combustion and the varia¬ 
tion of minimum ignition temperature with vessel size by 
T.J. Snee; Lessons from the past - entry into vessels, p. 29; 
Qatar tank failure (letter) by T.A. Kletz 

82 1988 - Calculation of the intensity of thermal 
radiation from large fires by MHAP; ‘Pops’ in tanks, p. 12; 
Chemical risk: living up to public expectations by 

H. J. Corbett Tank farm burns for a whole week, p. 19; 
The Boston, Mass., incident of January 15th, 1919 by 
VC. Marshall 

83 1988 - Failure of a flexible pipe in an H 2 installation 
area, p. 1; Seizure of boiler relief valves, p. 3; Failure of 
articulated bellows by A. Smith; Another non-return valve 
failure, p. 9; Damaged flange seal face leads to ammonia 
release, p. 11; Fire on a gasoline treater unit, p. 13; Process 
worker sustains an acid burn to his right eye, p. 15; Release 
of UF 6 in a vaporiser room, p. 17; Some incidents caused 
by failure of screwed joints, p. 19; An explosion involving 

I, 1,1-trichlorethane by I. Wrightson and R.C. Santon; Three 
incidents, three lessons, p. 25; Explosion and fire at a 
phenol plant by R.F. Schwab; ‘Pops’ in tanks (letter) by 
T.A. Kletz (see also LPB 82) 

84 1988 — Protection of warehouses against fire by 

A. Mackintosh; The forgotten hazards: services in ware¬ 
houses by R. Heels; Materials selection for composite fire 
damper by B.D. Baines; Lack of segregation causes rapid 
spread of fire, p. 19; Fire in Auckland, New Zealand by 

B. S. Amstrong; Molten sulphur spillage (letter) by 
P.G. Ayers (see also LPB 78) 

85 1989 - HF burn to fitter’s forearm, p. 1; Serious 
accident during valve replacement caused by incorrect 
procedure, p. 3; Release of UF 6 , vapour, p. 5; If it didn’t quite 
happen ... tell somebody, p. 7; A programme of safety 
assurance of liquid carbon dioxide storage vessels by 
A.R. Coleman; UK and European hazard information 
systems - a personal view by B. Cahill; Caustic potash 
spillage in tank farm, p. 27; Protection of warehouses 
against fire (letter) by B. Johnston (see LPB 84) 

86 1989 - A case history involving the release of chlorine, 
p. 1; Pressure testing and its hazards by R. Dooner and 
V Marshall; Exposure to acetone cyanhydrin, p. 17; 
A reappraisal of safety in chlorine handling, p. 19; Release 


of HF fume due to valve fracture, p. 22; Wrongly labelled 
gasket causes chlorine release, p. 23; Release of chlorine 
from an expansion pot, p. 27; Protection of warehouses 
against fire (letter) by K.N. Palmer (see also LPB 85); 
Nitrous oxide: no laughing matter (letter) by L. Bretherick 

87 1989 - Two men gassed by H 2 S p. 1; Three injured 
in extruder explosion, p. 3; Corrosion under insulation 
causes refinery fire, p. 5; Explosion when refuelling a liquid 
gas-driven stacker, p. 7; Pressure unrestrained, p. 9; 
Engineering for health by J.R. Jackson; Inherently safer 
design, p. 21; Emergency planning - in practice by 

J.M. Mullins; Incident during distillation of nitrobenzalde- 
hyde, p. 27; Release of chlorine from an expansion pot 
(letter) by T.A. Kletz; Reporting and analysis of industrial 
incidents (letter) by D.J. Lewis 

88 1989 - Operator burned during sampling opera¬ 
tions, p. 1; Programmable electronic systems by B.W. 
Eddershaw; Warehousing of chemicals, p. 9; Storage 
tanks - a vendetta, p. 11; Explosion in a dinitrotoluene 
pipeline, p. 13; Raw glycide collecting tank explodes, p. 17; 
Lessons of the past, p. 18; Bitumen tank fire, p. 19; Elec¬ 
trostatic hazards from pouring powdered chemicals into 
vessels from plastic bags by J. Bond; Analysis of a tank fire 
‘classic’ by L. Steinbrecher, Decomposition of nitric oxide 
(letter) by J.L. Currie (see also LPB 86); Explosion of 
2-nitro-benzaldehyde (letter) by P.G. Urben (see also 
LPB 87) 

89 1989 - Loss prevention in pilot plants: Pt 1 - The 
hazards by P.A. Carson and C.J. Mumford; Accident to a 
scaffolder in a plenum chamber, p. 9; Hydrocracker acci¬ 
dent, p. 13; Operator fall from scaffold, p. 18; LPG storage 
cracking experience by J.E. Cantwell; Stress corrosion 
cracking results in hydrofluoric acid spill, p. 27; Sizing the 
relief system for runaway reactions by A.J. Wilday 

90 1989 - Pavadena explosion, p. 0; The hazards of pur¬ 
ging a line, p. 1, Loss control in pilot plants by P.A. Carson 
and C.J. Mumford: Pt 2, Control measures; LPG pipeline 
and Trans-Siberian Railway explosion and fire by 
D.J. Lewis; Investigation into glacial acetic acid spillage, 
p. 13; List of major incidents 1987, p. 15; Severe burns 
resulting in fatality caused by dust explosion during pallet 
shrink-wrapping, p. 27;Two reactor incidents, p. 29; Failure 
of a reverse buckling disc, p. 30; Incident during vacuum 
distillation of nitrobenzaldehyde (letter) by J.L. Cronin 

91 1990 - Which foam? by D. Waters; Industrial health 
hazards Pt 3, Some lessons from experience by P.A. Carson 
and C.J. Mumford; Incompatible materials causes explosion 
in waste container, p. 15; Compressor incident causes pro¬ 
pylene release, p. 16; Disconnecting is sometimes not 
enough, p. 17; Multiple accident due to release of CO gas in 
refinery compressor hall, p. 19; Drum of sodium hydro¬ 
sulphite fire, p. 22; Relief valves on liquid gas tankers 
(letter) by J.L. Hawksley; Loss prevention in the 90s (letter) 
by F.K. Crawley 

92 1990 - Safety valves: taking the pressure off pro¬ 
ductivity and improperly closed valves, p. 1; Fatal accident 
following a toluene leak from a stuffing box, p. 7; Incident 
involving an engineering foreman scalded by hot water, 
p. 9; Contractor began repair to the plant pipework without 
a permit-to-work p. 10; Report relating to a leak of anhy¬ 
drous hydrofluoric acid (AHF) vapour, p. 11; Overflow of 
caustic solution from vent scrubber system to the stock 
tanks, p. 13; Bursting of a cylinder cover on a compressor 
releasing a large quantity of ammonia, p. 15; Gas lea¬ 
kage that taught a valuable lesson by M. Huvinen; Caustic 
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solution splashed into fitter’s eye, p. 18; Is it isolated - or is 
it?, p. 19; Work permit precautions not followed, p. 21; 
Electric shock from damaged light fitting, p. 22; Three 
incidents involving inadvertent S0 2 discharges, p. 23; Near 
miss incident with a tanker, p. 25; Investigation into an 
incident involving a release of hydrogen fluoride (HF) 
fume, p. 26; Operator burned with hot ethylene glycol, p. 27; 
Incinerator explosion, p. 29; What next? byj. Bond 

93 1990 - The Pepcon disaster, 4th May1988, Henderson, 
Nevada by J. Bond; Near miss, p. 3; Loss control in pilot 
plants: Pt 3, Data collection and evaluation by J. Bond, 
PA. Carson and C.J. Mumford; Wrong trip causes low level 
trip malfunction, p. 23; A strategy for plant management 
to prevent loss - 7 ways for managers to cut incidents by 
up to 44% by N. Dunford; Locked pressure that stayed on 
and ... on, p. 32; Reactor sparge weighing approximately 
5000 N fell a distance of 1.5 m, p. 33; Boiler explosion that 
caused three fatalities by J. Bond; Is there anything I’ve 
forgotten? p. 35; Quantified risk assessment (letter) by 
D.W Smith 

94 1990 — A tanker spill incident, p. 1; Five incidents 
involving road tankers, p. 7; Security of vehicle loads 
(packaged products), p. 10; Accidents involving road tan¬ 
kers with flammable loads by J. Bond; Morris plant olefins 
unit, September 12,1989, p. 16; Nightmare on the interstate: 
fireball from propane tanker accident ignites buildings; 
cars, grass, kills nine and injures many by R.M. Adelman 
and B. Adelman; Lessons to be learned from an oil terminal 
fire by B. Browing and A.H. Searson; An explosion in a 
cooling water system by D. Mansfield; Large storage area 
fire, p. 26; Explosion and fire in Houston,Texas, p. 30 

95 1990 - Dust explosion during cleaning operation on 
polymer hopper - case history, p. 1; Chemical company 
broke the rules; p. 4; Static electricity and bottom loading, 
p. 5; Well known hazard highlighted by an accident, p. 6; 
Prevention and protection for combustible dusts; p. 7; An 
incident involving an explosion of magnesium dust, p. 13; 
Five explosions involving people working in direct contact 
with flammable atmospheres; p. 15; Fire in a polymer pow¬ 
der, p. 19; Nightmare on the interstate (letter) by 
V.C. Marshall (see also LPB 94); Safety valves (letter) hy 
S,J. Kast (see also LPB 92) 

96 1990 - Enforcement aspects of COSHH by 

I. Wrightson, p. 1; The legacy of Flixborough by E. Crooks, 
p. 7; Maintenance for loss prevention in process industries 
by I. Hirata, p. 13; Case studies of some fire accidents in 
Yugoslavia’s oil refineries by M. Perunicic and M. Skotovic, 
p. 23 

97 1991 - Safety considerations in using liquid nitrogen 
byJ.W Hempseed, Asphyxiation hazards of inert gases (see 
also LPB 98), p. 5; Dryer package H 2 S fatality, p. 7; A near 
miss when titanium gaskets used in error on chlorine, p. 9; 
Ethylene oxide-hydrate: a commissioning incident by 
M. Kneale; Pipe rupture and fire in a vinyl chloride monomer 
(VCM) plant, p. 12; A human factors approach to the effective 
design of evacuation systems by B.P. Fitzgerald, M.D. Green, 

J. Penington and A.J. Smith; Toluene drum filling explosion 
near miss incident, p. 23; Explosion at the Phillips’ Houston 
chemical complex, Pasadena, 23 October 1989 byj. Bond 

98 1991 - Managing for safety, p. 0; Flammable vapour 
escape from condenser vent, p. 1; Tow away incident, p. 5; 
Case history of a runaway exothermic reaction, p. 7; For¬ 
mation of butane hydrate leads to hydrocracker fire, p. 9; 
Fatal accident involving inaccurate P&IDs, p. 13; Explosion 
at Cooke’s Works, Nobel’s Explosives Company Ltd, p. 18; 


Asphyxiation death of a contract welder, p. 19; Acid burns 
to face, chest and legs during preparation of plant for 
maintenance, p. 20; Blackout - losing electrical power in 
chemical process industries by K.B. Ratcliffe; The 
Peterborough explosion, p. 24; Chlorine release following 
pipe failure caused by iron/chlorine fire initiated by stress 
relieving operation, p. 25 

99 1991 - Catastrophic losses: an insurance broker’s 
perspective by D.F. O’Donovan; Introduction to the large 
property damage losses in the hydrocarbon chemical pro¬ 
cess industries; p. 1; A thirty year review of large property 
damage losses in the hydrocarbon chemical process 
industries by Marsh and McLennan; Large property 
damage losses by K.N. Palmer and VC. Marshall 

100 1991 - Explosion at the BASF Antwerp ethylene 
oxide/glycol plant, p. 1; Ethylene oxide plant explosion - 
3rd July 1987 BP Chemicals, Antwerp, Belgium by 

B. E. Mellin, The 1990 Shell explosion by T.A. Kletz; The 
benefits of flame retardant clothing by D.M. Tooth; Fire 
resistant protective clothing (Nomex suits) by B.E. Mellin; 
Major incidents - catalyst or initiator for legislative 
change by M.F. Pantony; Puebla, Mexico - 19th June 1977 
by D. Lewis 

101 1991 — Houston rail tanker explosion by J. Bond; 
Hydrogen cyanide tank explosion byj. Bond; Major hazard 
aspects of the transport of dangerous substances by 
R.M. Turner Toluene road tanker accident, p. 13; Bangkok 
LPG disaster, p. 19: 24th September 1990; Crescent City, 
Illinois — 21 June 1970 by D. Lewis 

102 1991 - Piper Alpha - cost of the lessons by 
T.C. Redmond; Overpressurisation through chemical reac¬ 
tions evolving gaseous products by P.A. Carson and 

C. J. Mumford; Fire and explosion in process waste water 
tank, p. 7; Batteries, p. 21; Safe use and handling of pri¬ 
mary batteries; p. 23; Electrical safety, p. 25; Two fatali¬ 
ties caused by lack of oxygen in confined spaces; p. 27; 
Failure of pipework from a chemical plant reactor system 
by A.B. Smith; Teaching of safety in British universities 
(letter) by F.K. Crawley; Letter (on bitumen tank fires), p. 35 

103 1992 - European Process Safety Centre, p. 0; 
Refinery losses - waiting for the big one by J. Di Gesso; 
Management styles - the effects on loss prevention by 

D. A. Lihou; The largest explosion in the UK, Fauld, 1944, 
p. 17; Report of an explosive release of graphite scalings 
from a drum, p. 19; The control of catastrophic event and 
the ‘Big 10’ goals in safety management by F.E. Bird; 
Fatal accident caused by faults in procedures; p. 24; Ano¬ 
ther valve accident: one accident leads to another, p. 25; 
Two incidents involving valve actuators, p. 29; Cumene 
hydroperoxide (CHP) drum explosion, p. 31 

104 1992 — Beware the unexpected by F.K. Crawley; Two 
short piping case studies by F.K. Crawley; What is more 
important - the permit to work or the execution of the 
plan?, p. 5; Fire on a gas processing plant, p. 7; Fire in a 
refinery, p. 9; Demolition near miss, p. 10; Loss of instru¬ 
mentation from a lightning strike, p. 11; Safe maintenance 
access on chemical batch reactor plants, p. 12; Frost leads to 
ice plug damage and fire, p. 13; The Seveso disaster - an 
appraisal of its causes and circumstances by VC. Marshall; 
Two very serious near misses; p. 27 

105 1992 — Waverly, Tennessee, 24 February 1978 by 
D. Lewis; Hazop reviews of electronic interlock/control 
systems and electrical distribution systems by F.R. Mitchell; 
Activated charcoal filter fire, p. 15; Learning from accident 
experience - are the old lessons really being applied? by 
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B. Hancock; Chemical warehouse fire in New Zealand, 
21 December 1984 by P.G. Kirk; A demonstration of the 
use of Hazcheck and a systems example by an analysis 
of a recent refinery line accident by G.L. Wells and 

C. M.C. Phang; Notes on the Fauld explosion (letter) by 
VC. Marshall 

106 1992 - Hydrocarbon fires in large storage tanks by 
K.N. Palmer; Overpressurisation of a refrigerated butane 
storage tank, p. 5; The Cochin refineries fire, p. 9; Problems 
with monomer storage, p. 14; Report by the tank collapse 
tank force: Ashland oil tank collapse by B. Mellin; Explo¬ 
sion involving a compressed air breathing apparatus 
cylinder, p. 17; Propane release during sampling, p. 19; 
Coriolis flowmeters byj. Bond 

107 1992 - Rollover, p. 1; Ammonia tank failure in 
Lithuania by B.O. Andersson and J. Lindley; Fluid catalytic 
cracker regenerator incident, p. 17; Damage to an electrical 
cable by a contractor whilst excavating for drainage mod¬ 
ifications, p. 21; Incident where an electrical cable was 
damaged during ground excavation, p. 22; Explosions in 
flare stacks during maintenance (see also LPB 108), p. 23; 
Four incidents involving valves, p. 27; Major hazard 
aspects of the transport of dangerous substances, p. 29 

108 1992 - Safety versus the environment, p. 0; Fires 
without external ignition sources - part 1, spontaneous 
combustion by PA. Carson and C.J. Mumford; Explosions 
in fired heaters, p. 17; Guidance on hazop procedures for 
computer-controlled chemical plant by D.M. Willis; Two 
incidents involving lead/acid batteries, p. 28; Ammonia 
tank failure in Lithuania: an alternative explanation (letter) 
by A.J.Wilday (see also LPB 109) 

109 1993 - Explosion in a sulphonation process by 
K. Bergroth; Runaway cleanout, p. 7; Fires without external 
ignition sources - part 2, the hazards of pyrophoric sub¬ 
stances by P.A. Carson and C.J. Mumford; Incident in a salt 
bath used for heat treatment of uranium slabs, p. 25 

110 1993 - Security of electrical supply systems includ¬ 
ing standby supplies by J.A. McLean; Spillage of ammonia 
at a tanker offloading station, p. 7; Two asphyxiation 
hazards, from maintenance, p. 8; Fires without external 
ignition sources - part 3, precautions for pyrophoric sub¬ 
stances by P.A. Carson and C.J. Mumford (see also LPB 111); 
Polymerisation runaway reaction, p. 25; Quantifying the 
fire hazard of oil-soaked insulation (letter) byT.O. Craig 

111 1993 — European Process Safety Centre, p. 0; Flare 
and drain systems - the twin Achilles’ heels of process 
plants? by F.K. Crawley; The zero accident approach at 
British Steel, Teesside Works by J. Ball and D. Procter; 
Lessons learned from the failure of a computer system 
controlling a nylon polymer plant by I. Nimmo, S.R. Nunns 
and B.W Eddershaw; An accident caused by reverse flow, 
p. 25; The wrong valve and its rough treatment cause an 
explosion, p. 26 

112 1993 — STATAS: development of an HSE audit 
scheme for loss of containment incidents - part 1, a loss 
of containment model by K.B. Ratcliffe; Practical exam¬ 
ples of safety risk assessment in BAPCO by R.K. Goyal; 
Use of ‘Lessons learned’ for in depth analysis by J.R. 
Taylor The challenge of Kozloduy by J.A. Ashurst and 
G. Davidson; Nitrogen near-miss, p. 20; Cumene hydro¬ 
peroxide (CHP) drum explosion, p. 21; Chlorine leak during 
shutdown test; Letter (on Coode Island) by G. Croudace 

113 1993 - Dust explosion hazards, p. 0; Safety in the 
design of chlorine dioxide plant by G. Cowley; Pressure 


vessel failures - 5 incidents, p. 13; STATAS: part 2, 
management and organisational factors: a socio-technical 
model of accident causation by K.B. Ratcliffe; Emulsion 
polymerisation incident, p. 25; A chlorine fatality, p. 26; 
Static electricity causes fire in powder handling (see also 
LPB 114), p. 27 

114 1993 - Electrostatic hazards of foam blanketing 
operations by P. Howells; Hazards involved in the handling 
and use of dimethyl sulphoxide (DMS) by J. Hall; 
Sunderland petrol (gasoline) tanker fire by VC. Marshall; 
Sparks fly during process transfer, p. 19; Only half the 
story by T. A. Kletz; STATAS: part 3, constructing an audit 
scheme by K.B. Ratcliffe; The UK Health and Safety 
Executive Information Service by R. Lewis 

115 1994 - The European Process Safety Centre, p. 0; 
Explosion in a nitration reaction vessel, p. 1; Major refinery 
loss, p. 6; Butyl acrylate splash, p. 7; Coal dust explosion, 
p. 9; Water hammer - and so much more by T.A. Kletz; 
A review of major incidents and their consequences by 
E. Crooks 

116 1994 - The cost of accidents at work, p. 0; The 
Allied Colloids fire and its immediate lessons by 
V.C. Marshall; The Fuji Oil Sodegaura refinery accident by 
the High Pressure Gas Safety Institute of Japan; Safety vs 
environment by T.A. Kletz; Hydrogen peroxide deflagra¬ 
tion in waste water treatment tank p. 17; Two incidents 
with sealless pumps, p. 21; Instrument sprays acid on 
shop wall, p. 22 

117 1994 — Flixborough — the beginning of a cultural 
revolution by V.C. Marshall; Flixborough: 20 years on by 
R.D. Turney; An accident when fitting a new operating 
mechanism to a live valve by J. Bond; Acid line breaks - 
worker burned, p. 17; An accident due to a poor vent system, 
p. 18; Auditing safety procedures by H.M. Tweeddale; 
Diamine release from joint failure, p. 24 

118 1994 — Safety management of multi-product batch 
plants - wider lessons from the Allied Colloids fire by 

V. C. Marshall; Runaway polymerisation leads to release of 
vinyl acetate, p. 8; Fire caused by specification change by 
R. Turney; Human error as a cause of accidents by 

W. Rothweiler, Incident involving static electricity dis¬ 
charge on ethanol road tanker, p. 14; Near-miss - circuit 
breaker falsely indicates lockout, p. 15; Ground fault 
circuit interrupter protects mechanic, p. 16; Environ¬ 
mental audit in major accident assessment by R.WS.M. 
Kingsbury 

119 1994 - The fire at Hickson and Welch by T. Kletz; 
Explosions in a large spray dryer, p. 5; Chemical burn 
injury, p. 8; Ethyl acetate - is it a static accumulator? by 
J. Bond; An accident at a vitrification plant, p. 13; Further 
commentary on the aftermath of the fire at Allied Colloids 
- an individual view, p. 15; Poor management of change - 
two incidents, p. 17; Outline of an integrated approach to 
solve growing safety and environmental conflicts by 

A. Debeil and L. Myron 

120 1994 - Corporate manslaughter: panacea or panic 
measure?, p. 2; The principle of multiple causes hyj. Bond; 
Some accidents of 1995 by T. Kletz; Start-up modifica¬ 
tion causes fatalities in 1859 by R. Turney; Chlorine com¬ 
bustion incident, p. 9; Drumming operations lead to fires, 
p. 10; European Process Safety Centre by B. Hancock; 
One approach to hazard control, p. 13; Static discharge 
(letter) by T.H. Pratt; Which risk definition? (letter) by 

B. C.W. Hotson 
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AAE Additional Accommodation East (Piper 

Alpha) 

A AM accident anatomy method 

AAR Association of American Railroads 

AAW Additional Accommodation West (Piper 

Alpha) 

ABC general purpose dry chemical 

ABCM Association of British Chemical 

Manufacturers 

ABI Association of British Insurers 

ABL atmospheric boundary layer 

ABMA American Boiler Manufacturers 

Association 

ABPI Association of the British Pharmaceutical 

Industry 

ACA Advisory Committee on Asbestos 

ACDS Advisory Committee on Dangerous 

Substances 

ACE Army Corps of Engineers 

ACGIH American Conference of Government 

Industrial Hygienists 

ACH Acetone cyanohydrinbased route 

ACMH Advisory Committee on Major Hazards 

ACOP Approved Code of Practice 

ACR Average circle radius 

ACRS Advisory Committee on Reactor Safety 

ACSNI Advisory Committee on the Safety of 

Nuclear Installations 

ACTS Advisory Committee on Toxic Substances 

ADI acceptable daily intake 

ADN European Agreement for the International 

Transport of Dangerous Goods 
ADNR European Agreement for the International 
Transport of Dangerous Goods (River 
Rhine) 

ADR European Agreement concerning the 

International Carriage of Dangerous 
Goods by Road 

ADT adiabatic storage test 

AE acoustic emission 

AEA action error analysis 

AEC Atomic Energy Commission 

AEL accessible emission level 

AFFF aqueous film forming foam 

AFNOR Association Francaise de Normalisation 

AFPA Australian Fire Protection Association 

AGA American Gas Association 

AGR advanced gas-cooled reactor 

AHM acutely hazardous material 

AHP analytic hierarchy process 

AI artificial intelligence 

AIA American Insurance Association 

AIB Accident Investigation Branch 

AIChE American Institute of Chemical Engineers 

AID Aeronautical Inspection Directorate 

AIHA American Industrial Hygiene Association 

AIR American Institute for Research 

AISI American Iron and Steel Institute 

AIT autoignition temperature 

AL action level 

AIARP as low as reasonably practicable 

Amoco American Oil Company 

AN acrylonitrile 

AN ammonium nitrate 

ANA ammonium nitrate - ammonia 


ANAP action-not-as-planned 

ANC adaptive noise cancellation 

ANL Argonne National Laboratory 

ANN artificial neural network 

ANSI American National Standards Institute 

AOD argon-oxygen decarburization 

APC air pollution control 

APCA Air Pollution Control Association 

APAU Accident Prevention Advisory Unit 

API American Petroleum Institute 

APJ absolute probability judgement 

APS automatic protective system 

AQ air quality 

AQD Aeronautical Quality Assurance Directorate 

AQL acceptable quality level 

AQP average lot quality protection 

AR alcohol resistant 

ARC accelerating rate calorimetry 

ASCE American Society of Civil Engineers 

ASHRAE American Society of Healing Refrigerating 

and Air-conditioning Engineers 
ASM Algebraic stress model 

ASME American Society of Mechanical Engineers 

ASQC American Society of Quality Control 

ASTM American Society for Testing and Materials 

ATMS assumption-based truth maintenance 

system 

ATN augmented transition network 

ALIT Association of University Teachers 

AWS American Welding Society 

BA breathing apparatus 

BACT best available control technology 

BAM Bundesanstalt fiir Materialpriifung 

BASEEFA British Approvals Service for Electrical 
Equipment in Flammable Atmospheres 
BASF Badische Anilin und Soda Fabrik 

BATNEC best available technology not entailing 

excessive cost 

BCC British Cryogenic Council 

BCF bromochlorodifluoromethane 

BCGA British Compressed Gases Association 

BCISC British Chemical Industry Safety Council 

BCME bis(chloromethyl)ether 

BCS Beilby, Cottrell and Swinden (model) 

BD bursting disc 

BFR binomial failure rate 

BG British Gas 

BGC British Gas Corporation 

BG/C&W British Gas/Cremer and Werner (model) 
BHEP basic human error probability 

BI business interruption 

BIA Berufsgenossenschaftlicshes Institut fur 

Arbeitssicherheit 

BITC Bureau International Technique du Chlore 

BLEVE boiling liquid expanding vapour explosion 

BLV biological limit value 

BM Bureau of Mines 

BMCS Bureau of Motor Carrier Safety 

BNF Backus-Naur form 

BNFL British Nuclear Fuels Ltd 

BNL Brookhaven National Laboratory 

BNP back-propagation network 

BOCA Building Official and Code Administration 

BOD biological oxygen demand 

BOHS British Occupational Hygiene Society 
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BOP blowout preventer 

BOR boil-off rate 

BP bulk property 

BPCS basic process control system 

BPEO best practical environmental option 

BPF British Plastics Federation 

BPM best practicable means 

BR British Rail 

BRE Building Research Establishment 

BRL Ballistics Research Laboratory 

BSC bench scale calorimeter 

BSC British Safety Council 

BSC British Steel Corporation 

BSI British Standards Institute 

BTC British Transport Commission 

BTM bromotrifluoromethane 

BUA built-up area 

BWR boiling water reactor 

CA Certifying Authority 

CAA Civil Aviation Authority 

CAA Clean Air Act 

CAA A Clean Air Act Amendments 

CAD computer-aided design 

CADA critical action and decision approach 

CADE computer aided design and engineering 

CADET critical action and decision evaluation 

technique 

CAER Community Awareness and Emergency 

Response 

CAF compressed asbestos fibre 

CAPE computer aided process engineering 

CAPITB Chemical and Allied Products Industry 

Training Board 

CAWR Control of Asbestos at Work Regulations 

1987 

CBI Central Bureau of Investigation (India) 

CBI Confederation of British Industry 

CBL convective boundary layer 

CCA copper-chrome-arsenate 

CCD cause-consequence diagram 

CCF common cause failure 

CCPS Center for Chemical Process Safety 

CCS centralized control system 

CCT cause-consequence tree 

CCW Chester—Chisnall—Whitham 

CD conceptual dependency 

CDE Chemical Defence Establishment 

CDFM conservative deterministic failure margin 

CE critical examination 

CEC Commission of the European Communities 

CEFIC European Federation of Chemical 

Engineering 

CEGB Central Electricity Generating Board 

CEI Chemical Exposure Index (Dow) 

CELD cause-effect logic diagram 

CEN Comite de Normalisation Europeen 

CENELEC Comite de Normalisation Europeen 
Electrotechnique 

CEP Chemical Engineering Progress 

CEP Chemical Exposure Index (DOW) 

CEQ Commission on Environmental 

Quality 

CERCLA Comprehensive Environmental Response, 

Compensation and liability Act (Superfund) 
CF certainty factor 


CF credit factor (Dow) 

CFC Chlorofluorocarbons 

CFC chlorofluorohydrocarbon 

CFD computational fluid dynamics 

CGA Compressed Gas Association 

CH A concept hazard analysis 

chazop computer H AZOP 

CHEMSAFE Chemical Industry Scheme for Assistance 
in Freight Emergencies 

CHEMTREC Chemical Transportation Emergency Centre 
CHEP conditional human error probability 

CHETAH chemical thermodynamics and energy 

hazard 

CHIP Chemicals (Hazard Information and 

Packaging) Regulations 1993 
CHL classification of hazardous locations 

CHP cumene hydroperoxide 

Cl Chlorine Institute 

CIA Chemical Industries Association 

CIB Consell Internationale de Batiment 

CIBS Chartered Institute of Building Services 

CIBSE Chartered Institute of Building Services 

Engineers 

CUT Chemical Industry Institute of 

Toxicology 

CIM computer integrated manufacturing 

CIM Uniform Rules concerning the Contract for 

International Carriage of Goods by Rail 
CIMAH Control of Industrial Major Accident 

Hazards Regulations 1984 
CIP cleaning in place 

CISHC Chemical Industry Safety and Health 

Council 

CJ Chapman-Jouguet 

CLAW Control of Lead at Work Regulations 1980 

CLER Classification and Labelling of Explosives 

Regulations 1983 

CM chemical manufacturing 

CM condition monitoring 

CMA Chemical Manufacturers Association 

CME chloromethyl ether 

CMF common mode failure 

CMI Christian Michelsen Institute 

COD chemical oxygen demand 

COD crack opening displacement 

COER Control of Explosives Regulations 1991 

CONCAWE oil companies organization 
CONDAM Construction (Design and Management) 

Regulations 

COP Code of Practice 

COP coefficient of performance 

COPA Control of Pollution Act 

COPEP Chlorine Out-Plant Emergency Plan 

COSHH Control of Substances Hazardous to Health 

Regulations 1988 

COTIF Convention concerning International 

Carriage by Rail 

COV collision with other vehicle 

CP cathodic protection 

CP conceptual dependency 

CPA Canadian Petroleum Association 

CPD Committee for the Prevention of 


CPL Classification, Packaging and Labelling 

(Regulations) 1984 
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CPLR 

Classification Packaging and Labelling of 
Dangerous Substances Regulations 1984 

DSHA 

Dangerous Substances in Harbour Areas 
(Regulations) 1987 

CPR 

critical pressure ratio 

DSIR 

Department of Scientific and Industrial 

CPS 

control and protection system 


Research 

CPS 

critical path scheduling 

DSM 

Dutch State Mines 

CPSC 

Consumer Product Safety Commission 

DTA 

differential thermal analysis 

CRHC 

Chemical Reactor Hazard Centre 

DTG 

differential thermogravimetry 

CRMR 

complete and rigorous model-based 

DTI 

Department of Trade and Industry 


reconciliation 

DTIC 

Defense Technical Information Center 

CSE 

concept safety evaluation 

DTL 

dangerous toxic load 

CSF 

cancer slope factor 

DTp 

Department of Transport (UK) 

cso 

Central Statistical Office 

DTT 

de-energize-to-trip 

CSR 

concept safety review 

E/E/PES 

Electrical /Electronic/ Programmable 

CSTR 

continuous stirred tank reactor 


Electronic Systems 

CTM 

causal tree method 

EC 

error cause (Whalley) 

CTOD 

crack tip opening displacement 

EC 

European Community 

CTU 

cargo transport unit 

ECCS 

emergency core cooling system 

CV 

control valve 

ECCS 

European Convention for Constructional 

CVCP 

Committee of Vice Chancellors and 


Steelwork 


Principals 

ECETOC 

European Chemical Industry Ecology and 

CVN 

Charpy V-notch (test) 


Toxicology Centre 

cw 

continuous wave 

ECOIN 

European Core Inventory of Existing 

CWA 

dosed world assumption 


Substances 

CWR 

Chemical Works Regulations 1922 

ED 

enumeration district 

CWRT 

Center for Waste Reduction Technology 

EDC 

ethylene dichloride 

DAP 

detergent alkylate plant 

EDF 

Electricite de France 

DAS 

disturbance analysis system 

EDF 

equivalent discrete failure 

DBMS 

database management system 

EDP 

Emergency depressurization 

DCF 

discounted cash flow 

EECS 

Electrical Equipment Certification Service 

DCL 

distributed control logic 

EEGL 

emergency exposure guidance level 

DCS 

digital control systems 

EEI 

Edison Electric Institute 

DCS 

Distributed Control Systems 

EEI 

emergency exposure index 

DDB 

dependency-directed backtracking 

EEL 

emergency exposure limit 

DDC 

direct digital control 

EEMUA 

Engineering Equipment and Materials 

DDP 

defect detection probability 


Users Association 

DDT 

deflagration to detonation transition 

EEPG 

Emergency Exposure Planning Guidelines 

DEA 

diethanolamine 

EER 

evacuation, escape and rescue 

DF 

Damage Factor (Dow) 

EEUA 

Engineering Equipment Users Association 

DF 

dependent failure 

EF 

error factor 

DFA 

2,4 - difluoroaniline 

EF 

Escalation Factor (Dow) 

DFNB 

2,4 - difluoronitrobenzene 

EFS 

emergency feedwater system 

DG 

diesel generator 

EFV 

excess flow valve 

DGL 

Directorate General of Labour 

EHS 

effective stack height 

DHSV 

down-hole safety valve 

EHS 

extraordinarily hazardous substance 

DIERS 

Design Institute for Emergency Relief 

EIA 

environmental impact assessment 


Systems 

EIDAS 

Explosion Incidents Data Service 

DIMP 

Design Institute for Multiphase Processing 

EINECS 

European Inventory of Commercial 

DIN 

Deutsches Institut fur Normung 


Chemical Substances 

DMAC 

A, A- dimethylacetamide 

EIS 

environmental impact statement 

DMV 

diaphragm motor valve (Bhopal) 

EIV 

emergency isolation valve 

DO 

damage only (accident) 

EJMA 

Expansion Joint Manufacturers Association 

DO 

dissolved oxygen 

ELD 

engineering line diagram 

DoE 

Department of the Environment 

ELSA 

European laboratory for Structural 

DoEm 

Department of Employment 


Assessment 

DoEn 

Department of Energy 

EM 

error mechanism (Whalley) 

Dol 

Department of Industry 

EMAS 

Employment Medical Advisory Service 

DoT 

Department of Trade 

EML 

estimated maximum loss 

DOT 

Department of Transportation (USA) 

EMS 

Emergency Medical Services 

DPLU 

Disaster Prevention and Limitation Unit 

EMS 

environmental management system 

DPT 

decomposition pressure test 

EnvIDAs 

Environmental Incidents Data Service 

DPT 

dynamically positioned tanker 

EO 

equation oriented 

DR 

discounted premium rate 

EO 

ethylene oxide 

DRI 

Distribution Ranking Index (Dow) 

EOQ 

economical order quantity 

DRM 

deterministic reference model 

EP 

environmental protection 

DSC 

differential scanning calorimetry 

EPA 

Environmental Protection Act 
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EPA Environmental Protection Agency 

EPC error producing condition 

EPCRA Emergence Planning & Community Right to 

Know Act 1986 

EPRI Electrical Power Research Institute 

EPSC European Process Safety Centre 

EQO environmental quality objective 

EQS environmental quality standard 

ER equivalent radiator 

ER Exposure Radius (Dow) 

ERA Electrical Research Association 

ERC Emergency Response Commission 

ERCO Energy Resources Company 

ERDS European Reliability Data System 

ERG emergency response guidelines 

ERM equilibrium rate model 

ERPG Emergency Response Planning Guidelines 
ERQ East Replacement Quarters (Piper Alpha) 

ERS emergency relief system 

ERT Environmental Research and Technology 

Inc. 

ERV expiratory reserve volume 

ES environmental statement 

ES explosion severity 

ESA European Space Agency 

ESD emergency shut-down 

ESD.ESS Emergency Shutdown System 
ESH electrical surface heating 

ESP equivalent standard plant 

ESTC Explosives Storage and Transport 

Committee 

ESV emergency shut- down valve 

ESV emergency shut-off valve 

ET error type (Whalley) 

ETA expected time of arrival 

ETT energize-to-trip 

FA fragility analysis 

FAD failure analysis diagram 

FAD failure assessment diagram 

FAE fuel-air explosion 

FAFR failure accident frequency rate 

FAR fatal accident rate 

FB fractional bias 

FBL fracture-before-leak 

FCAW fluxed core arc welding 

FCT flux-corrected transport 

FDA Food and Dreg Administration 

FDG flue gas desulphuriration 

FDM finite difference method 

FDT fractional dead time 

FECA Federal Emission Control Act 1974 

FEM A Federal Emergency Management Agency 

FERC Federal Energy Regulatory Commission 

FET Flammability, explosiveness and toxicity 

FFFP film forming fluoroprotein (foam) 

FFP flame front projection 

F&EI Fire and Explosion Index 

F&G fire and gas 

FHA Federal Highways Authority 

FIA Factory Insurance Association 

FIBC flexible intermediate bulk container 

FICA Federal Emission Control Act (Germany) 

FL frequency-loss 

FM Factory Mutual 

FMA Fertilizer Manufacturers Association 


FMD fragment mass distribution 

FMEA failure mode and effect analysis 

FMEC Factory Mutual Engineering 

Corporation 

FMECA failure modes, effects and criticality 
analysis 

FMRC Factory Mutual Research Corporation 

FN frequency—number (curve) 

FOD Field Operations Division 

FoF figure of friction 

Fol figure of insensitiveness 

FOPL first order predicate logic 

FP fluoroprotein 

FPA Fire Precautions Act 1971 

FPA Fire Protection Association 

FPC Federal Power Commission 

FPS floating production system 

FPSO floating production, storage and offloading 

(system) 

FR filling ratio 

FRC fast rescue craft 

FRG Federal Republic of Germany 

FRP fibre reinforced plastic 

FRS Fire Research Station 

FRV functional residual volume 

FSA formal safety assessment 

FSM fault—symptom matrix 

FTA fault tree analysis 

FTE fracture transition elastic (point) 

FTP fracture transition plastic (point) 

FTS fault tree synthesis 

FWPCA Federal Water Pollution Control Act 1972 

GAO General Accounting Office 

GCM Gas Conservation Module (Piper Alpha) 

GD Germeles-Drake 

GDA goal-directed activity 

GdF Gaz de France 

GDO general development order 

GDR German Democratic Republic 

GFM goodness-of-fit measure 

GFRP glass fibre reinforced plastic 

GIS general incident scenario 

GMAW gas-metal arc welding 

GNP Gross National Product 

GOFA goal-oriented failure analysis 

Gol Government of India 

GOM Gulf of Mexico 

GP general purging (nitrogen) 

GPH General Process Hazard (Dow) 

GRP glass reinforced plastic 

GRS Gesselschaft fur Reaktorsicherheit 

GRT Gross registered tonnage 

GS(I&U)R Gas Safety (Installations and Use) 
Regulations 1984 

GSR Gas Safety Regulations 1972 

GT Gaz Transport 

GTAW gas-tungsten arc welding 

GTST goal tree-success tree 

GVW gross vehicle weight 

H AC hazardous area classification 

HALO hazard assessment of landfill 

HANES Health and Nutrition Examination Survey 

H AZ heat affected zone 

HAZAN hazard analysis 

HAZMAT hazardous material 
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HAZOP hazard and operability (study) 

HCFC hydrochlorfluorocarbon 

HCLPF high confidence of low probability of failure 

HCR human cognitive reliability 

HD hazard distance 

HD Hazard Division 

HDPE high density polyethylene 

HDR high discharge rate 

HEART human error assessment and reduction 

technique 

HED Human Error Database 

HEH homogeneous equilibrium model 

HEP human error probability 

HER human error rate 

HF hydrogen fluoride 

HFC hydrofluorocarbon 

HF/E human factors/engineering 

HFLR Highly Flammable Liquids and Liquefied 

Petroleum Gases Regulations 1972 
HFO heavy fuel oil 

HFRG Human Factors in Reliability Group 

HGDT heavy gas dispersion trial 

HGT heavy goods train 

HGV heavy goods vehicle 

HI hazard index 

HIO Hazardous Incident Ordinance (Germany) 

HIPS high integrity protective system 

HIS Health Interview Survey 

HISS high integrity shutdown system 

HIT hazardous installations and transport 

HITI high integrity trip initiator 

HITS high integrity trip system 

HIVE high integrity voting equipment 

HM hazardous material 

HMA Human reliability assessment 

HMAP Hydrogen Fluoride Mitigation and 

Assessment Program 

HMCIF HM Chief Inspector of Factories 

HMFI HM Factory Inspectorate 

HMIP HM Inspectorate of Pollution 

HMIR Hazardous Materials Incident Reporting 

HMV hydraulic master valve 

HND Higher National Diploma 

HORATIO Human Response Analyzer and Timer for 
Infrequent Occurrences 
HP high pressure 

HPI high pressure injection 

HPIM high purity inert medium 

HPIP human performance investigation process 

HQ hazard quotient 

HRA human reliability analysis 

HRC hydrocarbon release (database) 

HRS hazard ranking scheme 

HSB Hartford Steam Boiler 

HSC Health and Safety Commission 

HSE Health and Safety Executive 

HSF hardware, software and fire fighting 

HSWA Health and Safety at Work etc. Act 1974 

HTA hierarchical task analysis 

HTF heat transfer fluid 

HTF high temperature fluid 

HTGR high temperature gas-cooled reactor 

HTHM high toxic hazard materials 

HV high velocity 

IAEA International Atomic Energy Agency 


IAPH International Association of Ports and 

Harbours 

I ARC International Agency for Research on 

Cancer 

IATA International Air Transport Association 

IBC intermediate bulk container 

IC inspiratory capacity 

ICAO International Civil Aviation Organization 

ICBO International Conference of Building 

Officials 

ICD inherently cleaner design 

ICE Institution of Civil Engineers 

ICFTU International Confederation of Free Trade 

Unions 

IChemE Institution of Chemical Engineers 

ICHMAP International Co-operative Hydrogen 

fluoride Mitigation and Assessment 
Program 

ICI Imperial Chemical Industries 

ICRP International Committee on Radiological 

Protection 

ICS International Chamber of Shipping 

ID identification number 

IDA influence diagram analysis 

IDLH Immediately Dangerous to life and Health 

(limit) 

IE index of explosibility 

IEC International Electrotechnical Commission 

IEE Institution of Electrical Engineers 

IET insulated exotherm test 

IFAL instantaneous fractional annual loss 

IFE Institution of Fire Engineers 

IGE Institution of Gas Engineers 

IHVE Institution of Heating and Ventilation 

Engineers 

IISO Institution of Industrial Safety Officers 

IL integrity level 

ILCI International Loss Control Institute 

ILO International Labour Office 

IMechE Institution of Mechanical Engineers 

IMAS influence modelling and assessment system 

IMCO Intergovernmental Maritime Consultative 

Organization 

IMDG International Maritime Dangerous Goods 

(Code) 

IMO International Maritime Organization 

INRS Institute National de Recherche sur la 

Securite 

IOI International Oil Insurers 

IP industrial platform 

IP Institute of Petroleum 

IPC integrated pollution control 

IPIECA International Petroleum Industry 

Environment Conservation Association 
IPL independent layer of protection 

IPSG International Process Safety Group 

IR infrared 

IRI Industrial Risk Insurers 

IRIS incident reporting and investigation system 

IRLG Interagency Regulatory Liaison Group 

IRV inspiratory reserve volume 

IS ignition severity 

ISA Instrument Society of America 

ISA Instrumentation, Systems and Automation 

Society 
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ISGHO 

International Study Group on Hydrocarbon 

LPB 

Loss Prevention Bulletin 


Oxidation 

LPG 

liquefied petroleum gas 

ISGRA 

International Study Group on Risk 

LPGA 

liquefied Petroleum Gas Association 


Assessment 

LPGITA 

Liquefied Petroleum Gas Industry 

ISI 

Inherent Safety Index 


Technical Association 

ISLO 

Installations Subject to Licensing Ordinance 

LPI 

low pressure injection 


(Germany) 

LPR 

linear polarization resistance 

ISO 

International Standards Organisation 

LQW 

Living Quarters West (Piper Alpha) 

ISR 

incoming solar radiation 

LR 

Lloyds Register 

ISRS 

International Safety Rating System 

LRA 

least replaceable assembly 

1ST 

isothermal storage test 

LS 

limit switch 

ITB 

Industry Training Board 

LS 

logical sufficiency 

ITB 

Insurance Technical Bureau 

LTA 

lost time accident 

ITC 

Interagency Testing Committee 

LTI 

lost time injury 

ITOPF 

International Tanker Owners Pollution 

LTMS 

logic-based truth maintenance system 


Federation 

LTPD 

lot tolerance per cent defective 

ITSA 

Independent Tank Storage Association 

LTSR 

long-term safety review 

IUR 

International Union of Railways 

LVHV 

low volume, high velocity 

JFRO 

Joint Fire Research Organization 

LWR 

light water reactor 

JHEP 

joint human error probability 

MAC 

maximum allowable concentration 

JIT 

‘just-in-time’ 

MACT 

maximum achievable control technology 

JRC 

Joint Research Centre 

MAPP 

major accident prevention plan 

JSA 

Job safety analysis 

MAPP 

methyl acetylene/propadiene/propylene 

JT 

Joule—Thomson 

MAPCO 

Mid-America Pipeline Company 

JTMS 

justification-based truth maintenance 

MAPPS 

maintenance personnel performance 


system 


simulator 

KAF 

knowledge acquisition facility 

MARPOL 

International Conference on Revision of the 

KASP 

Kjeller Ammonia Stress Corrosion Project 


International Regulations for Preventing 

KWU 

Kraftwerk Union 


Collisions at Sea 

LA 

Local authority 

MAUD 

multi-attribute utility decomposition 

LAAPC 

local authority air pollution control 

MAWP 

maximum allowable working pressure 

LBB 

leak-before-break 

MB 

measure of belief 

LBF 

leak-before-fracture 

MC 

motor cycle 

LCw 

lethal concentration (w% level) 

MCA 

Manufacturing Chemists Association 

LCC 

life cycle costing 

MCC 

methylcarbamoyl chloride 

LCTw 

lethal toxic concentration (»% level) 

MCL 

maximum credible loss 

LCV 

level control valve 

MCSOII 

multiple-cause, systems-oriented incident 

LD« 

lethal dose («% level) 


investigation 

LDC 

London Dumping Convention 

MCSP 

Model Code of Safe Practice (IP) 

LDG 

List of Dangerous Goods and Conditions of 

MD 

measure of disbelief 


Acceptance 

MDA 

modellers data archive 

LDPE 

low density polyethylene 

MDF 

multiple degree-of-freedom 

LEFM 

linear elastic fracture mechanics 

MDI 

4,4-Diphenylmethane diisocyanate 

LEL 

lower explosive limit 

ME 

multienergy (model) 

LEPC 

Local Emergency Preparedness Committee 

MEA 

monoethanolamine 

LER 

licensee event report 

MEHQ 

methyl ether of hydroquinone 

LEV 

local exhaust ventilation 

MEL 

maximum exposure limit 

LF 

landfill 

MEPC 

Marine Environment Protection Committee 

LFG 

liquefied flammable gas 

MES 

multilinear events sequencing 

LFL 

lower flammability limit 

MESG 

maximum experimental safe gap 

LGC 

liquefied gas carrier 

MF 

management factor 

LGF 

Liquefied Gaseous Fuels (Spill Effects 

MF 

material factor 


Program) 

MFCC 

multiple forced circulation circuit 

LGFSTF 

Liquefied Gaseous Fuels Spill Test Facility 

MGL 

multiple Greek letter 

LGV 

light goods vehicle 

MHAP 

Major Hazards Assessment Panel 

LITTS 

large inventory top tier site 

MHAU 

Major Hazards Assessment Unit 

LLNL 

Lawrence Livermore National Laboratory 

MHIDAS 

Major Hazard Incidents Data Service 

LN 

logical necessity 

MIBE 

methyl-t-butyl ether 

LNG 

liquefied natural gas 

MIBK 

methylisobutyl ketone 

LNH3 

liquefied ammonia 

MIC 

methyl isocyanate 

LOCA 

loss of coolant accident 

MIC 

minimum igniting current 

LOPA 

Layer of protection analysis 

MIE 

minimum ignition energy 

LOV 

locally operated valve 

MIG 

metal inert gas 

LOX 

liquid oxygen 

MILNP 

mixed integer non-linear programming 

LPA 

local planning authority 

MILP 

mixed integer linear programming 
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MITI 

Ministry of International Trade and Industry 

NG 

nitroglycerine 

MLS 

marine LNG system 

NGL 

natural gas liquids 

MM 

methyl methacrylate 

NIG 

National Interest Group 

MM 

modified Mercalli 

NIHHS 

Notification of Installations Handling 

M&M 

Marsh and McLennan 


Hazardous Substances Regulations 1982 

M&M 

monitoring and maintenance 

Nil 

Nuclear Installations Inspectorate 

MMA 

Methyl Methacrylate 

NIOSH 

National Institute of Occupational Safety 

MO 

Marshall-Olkin 


and Health 

MOC 

Management of change 

NIST 

National Institute of Standards and 

MOC 

method of characteristics 


Technology 

MoD 

Ministry of Defence 

NML 

Normal Maximum Loss 

MOL 

main oil line 

NMRS 

near miss reporting system 

MOR 

modification of risk 

NMS 

Dangerous Substances (Notification and 

MORT 

Management Oversight and Risk Tree 


Marking of Sites) Regulations 1990 

MOV 

motor operated valve 

NMSE 

normalized mean square error 

MPA 

mean presented area 

NMMS 

near miss management system 

MPD 

minimum premarketing data 

NMTMS 

Non-monotonic truth maintenance system 

MPDO 

maximum probable days outage 

NNS 

Norwegian North Sea 

MPE 

maximum permissible exposure 

NOAEL 

no observable adverse effect level 

MPI 

magnetic particle inspection 

NPD 

Norwegian Petroleum Directorate 

MPPD 

Maximum Probable Property Damage 

NPDES 

National Pollutant Discharge Elimination 

MPS 

multiple point source 


System 

MPST 

maximum permissible surface temperature 

NPL 

National Physical Laboratory 

MRC 

Medical Research Council 

NPP 

nuclear power plant 

MRS 

MIC refining still (Bhopal) 

NPS 

Naval Postgraduate School 

MRS 

Midlands Research Station 

NPSH 

net positive suction head 

MSA 

Marine Safety Agency 

NPV 

Net Present Value 

MSC 

Maritime Safety Committee 

NRA 

National Rivers Authority 

MSDS 

material safety data sheet 

NRC 

National Research Council 

MSS 

MIC storage system (Bhopal) 

NRC 

Nuclear Regulatory Commission 

MTTF 

mean time to failure 

NRPB 

National Radiological Protection Board 

MTBF 

mean time between failures 

NRTS 

National Reactor Test Station 

MTTFF 

mean time to first failure 

NRV 

non-return valve 

MV 

medium velocity 

NSAC 

Nuclear Safety Analysis Center 

MV 

munitions vehicle 

NSC 

National Safety Council 

MW 

molecular weight 

NSCA 

National Society for Clean Air 

MWA 

Mineral Workings Act 1971 

NSPS 

New Source Performance Standards 

N/A 

not applicable 

NSR 

New Source Reviews 

NAAQS 

National Ambient Air Quality Standards 

NSW 

New South Wales 

NACE 

National Association of Corrosion Engineers 

NTIS 

National Technical Information Service 

NADOR 

Notification of Accidents and Dangerous 

NTP 

National Toxicology Program 


Occurrences Regulations 1980 

NTS 

Nevada Test Site 

NAMAS 

National Measurement Accreditation 

NTSB 

National Transportation Safety Board 


Scheme 

NWC 

Naval Weapons Center 

NAS 

National Academy of Sciences 

OAET 

operator action event tree 

NASA 

National Aeronautical and Space 

OARU 

Occupational Accident Research Unit 


Administration 

OAT 

operator action tree 

NBFU 

National Board of Fire Underwriters 

OB 

oxygen balance 

NBS 

National Bureau of Standards 

OBE 

operating basis earthquake 

NCB 

National Coal Board 

OBO 

ore/bulk/oil 

NCEC 

National Chemical Emergency Centre 

OC 

operating characteristic 

NCSR 

National Centre for Systems Reliability 

OCIMF 

Oil Companies International Marine Forum 

NCTR 

National Center for Toxicological Research 

OCM 

on-condition maintenance 

NDE 

Non-destructive evidence 

OD 

oxygen demand 

NDE 

non-destructive examination 

ODCB 

o-dichlorobenzene 

NDRC 

National Defense Research Committee 

OECD 

Organization for Economic Cooperation and 

NDT 

non-ductility transition 


Development 

NDT 

null ductility transition 

OEL 

Occupational Exposure Limit 

NEA 

Nuclear Energy Agency 

OES 

Occupational Exposure Standard 

NEIC 

National Earthquake Information Center 

OFG 

over-the-top foam generation 

NEL 

National Engineering Laboratory 

OIA 

Oil Industry Association 

NEPA 

National Environmental Policy Act 

OIAC 

Oil Industry Advisory Committee 

NESHAP 

National Exposure Standards for Hazardous 

OHSAS 

Occupational Health and Safety 


Air Pollutants 


Management systems 

NFPA 

National Fire Protection Association 

on 

Oil Industry Insurance 
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OILPOL International Convention on the Prevention 

of Pollution of the Sea by Oil 
OIM offshore installation manager 

ONAN o-nitroaniline 

ONCB o-nitrochlorobenzene 

OOA observable operational attribute 

OOP object oriented programming 

OOS object oriented system 

OPCS Office of Population Census and Surveys 

OPS operating procedure synthesis 

OPSO Office of Pipeline Safety Operations 

OREDA Offshore Reliability Data (bank) 

ORNL Oak Ridge National Laboratory 

ORR overall risk rating 

OSD Offhore Safety Division 

OSHA Occupational Safety and Health Act 1970 

OSHA Occupational Safety and Health 

Administration 

OS&RP Office, Shops and Railway Premises (Act) 

1963 

OSTP Office of Science and Technology Policy 

OSW Office of Solid Waste 

OT overturning 

OTA Office of Technology Assessment 

OTS Office of Toxic Substances 

OV Original Value (Dow) 

P/A peak-to-average 

Paris MOU Paris Memorandum 

PASS process and storage ship 

PAW Petroleum Administration for War 

PAW plasma arc welding 

PB pushbutton 

PBB polybrominated biphenyl 

PBL planetary boundary layer 

PC paired comparison 

PCA preliminary consequence analysis 

P(C)A Petroleum (Consolidation) Act 

PCB polychlorinated biphenyl 

PCM parametric correlation method 

PCV pressure control valve 

PD Property Damage 

PDF probability density function 

PDS potentiodynamic scan 

PE programmable electronic (hardware) 

PEG polyethylene glycol 

PEEL Public Emergency Exposure Limit 

PEL permissible exposure limit 

PERT project evaluation and review technique 

PES Programmable electronic system 

PETN pentaerythritol tetranitrate 

PF potential failure 

PFC perfluorocarbon 

PFD Probability of failure on demand 

PFD process flow diagram 

PG Pasquill-Gifford 

PGA peak ground acceleration 

PGR Road Traffic (Carriage of Dangerous 

Substances in Packages) Regulations 
PH precipitation hardening 

PHA preliminary hazard analysis 

PHA process hazard analysis 

PHE A predictive human error analysis 

PHSA Planning (Hazardous Substances) Act 1990 

PI personal injury (accident) 

PI pressure indicator 


PISC 

PITB 

PIUS 

PL 

PLA 

PLC 

P/M 

PM 

PML 

PMMA 

PMN 

PMN 

PNEUROP 


PPA 

PPE 

PPE 

PRA 

PRP 

PRV 

PS 

PS 

PSA 

PSA 

PSA 

PSAT 

PSD 

PSDI 

PSF 

PSII 

PSM 

PSV 

PT 

PTB 

PTFE 

PTSD 

PTW 

PUF 

PUHF 

PV 

PVC 

PVH 

PVQAB 

PVTC 

PVM 

PWG 

PWHT 

PWR 

QA 

QHRDCS 


piping and instrument (diagram) 
performance influencing factor 
Prototype index of inherent safety 
Protective instrumented Systems 
Plate Inspection Steering Committee 
Petroleum Industry Training Board 
process-inherent ultimate safety 
propositional logic 
Port of London Authority 
programmable logic control 
peak-to-mean 
preventive maintenance 
Probable Maximum Loss 
polymethylmethacrylate 
premanufacture notice 
premarketing notification 
European Committee of Manufacturers of 
Compressors,Vacuum Pumps and 
Pneumatic Tools 

planning, organization implementation and 
control 

power-operated relief valve 

polypropylene 

potential problem analysis 

peak pressure enhancement 

personal protective equipment 

probabilistic risk assessment 

potentially responsible person 

pressure relief valve 

point source 

polystyrene 

process safety management 
pressure swing adsorption 
probabilistic safety assessment 
Pre-start-up acceptance test 
prevention of significant deterioration 
Project Software and Development Inc. 
performance shaping factor 
process safety incident investigation 
process safety management 
pressure safety valve 
passenger train 

PhysikalischeTechnischeBundesanstalt 

polytetrafluoroethene 

post-traumatic stress disorder 

permit-to-work 

polyurethane foam 

Process Unit Hazards Factor (Dow) 

pressure/vacuum 

polyvinyl chloride 

process vent header (Bhopal) 

Pressure Vessel Quality Assurance Board 
Pressure Vessel Technical Committee 
population vulnerability model 
ProvincialeWaterstaat Groeningen 
post-weld heat treatment 
pressurized water reactor 
quality assurance 
quantitative human reliability data 
collection system 

quality assessment assurance of safety 

analysis 

quality control 

quality circle 

quality factor 
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QPT 

qualitative process theory 

SAT 

Site acceptance test 

QRA 

quantitative risk assessment 

SAW 

submerged arc welding 

RAG 

risk appraisal group 

SBC 

Standard Building Code 

RARDE 

Royal Armament Research and Development 

SCA 

small-scale cook-off bomb 


Establishment 

SCA 

sneak circuit analysis 

RAT 

risk assessment tool 

SCAT 

systematic cause analysis technique 

RBE 

relative biological efficiency 

SCBA 

self-contained breathing apparatus 

RBV 

remotely-operated block valve 

see 

stress corrosion cracking 

RC 

resistance-capacitance 

SCCM 

subjective cause-consequence model 

RCAS 

root cause analysis system 

SCI 

Society of Chemical Industry 

RCEP 

Royal Commission on Environmental 

SCM 

short-cut classical method 


Pollution 

SCRA(M) 

Short-cut risk assessment (method) 

RCM 

reliability-centred maintenance 

SCS 

safety critical system 

RCRA 

Resource Conservation and Recovery Act 

SCT 

stress concentration theory 


1976 

SDF 

single degree of freedom 

RCS 

reactor cooling system 

SEAOC 

Structural Engineers Association of 

RF 

radio frequency 


California 

RF 

Rossi—Forelli 

SEDEX 

type of calorimeter 

RfD 

reference dose 

SEDF 

standard equivalent discrete failure 

RH 

relative humidity 

SEER 

Surveillance, Epidemiology and End 

R-H 

Rankin—Hugoniot 


Results Program 

RHI 

Reaction Hazard Index 

SEM 

scanning electron microscopy 

RIA 

Robot Institute of America 

SEM 

slip equilibrium model 

RIC 

Royal Institute of Chemistry 

SF 

solid flame 

RID 

International Regulations Concerning the 

SFG 

signal flow graph 


Carriage of Dangerous Goods by Rail 

SGHWR 

steam generating heavy water reactor 

RIDDOR 

Reporting of Injuries, Diseases and 

SGT 

subgoal template 


Dangerous Occurrences Regulations 1985 

SHE 

safety, health and environment 

RII 

relative incapacitation index 

SHERB 

Sandia Human Error Rate Bank 

RLA 

remanent life assessment 

SHERPA 

systematic human error reduction and 

RME 

reasonable maximum exposure 


prediction approach 

RMEE 

relative mass extinguishing efficiency 

SHH 

substance hazardous to health 

RMP 

risk management planning 

SI 

safety interlock 

RMPP 

Risk Management and Prevention Program 

SI 

Statutory Instrument 


(California) 

SIC 

Standard Industrial Classification 

RoRo 

roll-on/roll-off 

SIGTTO 

Society of International Gas Tanker and 

RoSPA 

Royal Society for the Prevention of 


Terminal Operators 


Accidents 

SIKAREX 

type of calorimeter 

ROV 

remotely-operated valve 

SIL 

Safety integrity level 

RPE 

respiratory protective equipment 

SIPRI 

Stockholm International Peace Research 

RPI 

Retail Price Index 


Institute 

RPT 

rapid phase transition 

SIRA 

Scientific Instrument Research Associatio 

RPV 

reactor pressure vessel 

SIS 

Safety Instrumented System 

RRL 

Road Research Laboratory 

SIS 

safety interlock system 

RSPA 

Research and Special Programs 

SIT 

spontaneous ignition temperature 


Administration 

SITTS 

small inventory top tier site 

RSS 

Reactor Safely Study (Rasmussen Report) 

SKHCR 

standardized skilled and hospitalized 

RSSG 

Royal Society Study Group 


casualty rate 

RSST 

Reactor Systems Screening Tool 

SKR 

skills-rules-knowledge (model) 

RT 

response type (Whalley) 

SL 

Sandia National Laboratory 

RTJ 

ring-type joint 

SL 

support list 

RTR 

Road Traffic (Carriage of Dangerous 

SLI(M) 

success likelihood index (method) 


Substances in Road Tankers and Tank 

SLOT 

Specified Level of Toxicity 


Containers) Regulations 1992 

SLP 

safety and loss prevention 

RV 

Replacement Value (Dow) 

SLT 

superheat limit temperature 

RV 

residual volume 

SM 

sequential modulator 

RVVH 

relief valve vent header (Bhopal) 

SMAW 

shielded metal arc welding 

SA 

sneak analysis 

SMR 

Seismic margin earthquake 

SADT 

self-accelerating decomposition temperature 

SMRB 

Safety in Mines Research Board 

SAI 

Science Applications Inc. 

SMRE 

Safety in Mines Research Establishment 

SARA 

Superfund Amendment and 

SMS 

safety management system 


Reauthorization Act 1986 

SNG 

synthetic natural gas 

SARAH 

systematic approach to the reliability 

SOAP 

spectrometric oil analysis programme 


assessment of humans 

SOLAS 

Safety of life at Sea 

SAS 

small area statistics 

SOP 

Standard Operating Procedure 
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SOT Society of Toxicology 

SPEAR system for predictive error analysis and 

reduction 

SPEGL Short-term Public Emergency Guidance 

Level 

SPH Special Process Hazard (Dow) 

SPI Society of the Plastics Industry 

SPM shock pulse meter 

SPS Safety protection systems 

SPS submerged production station 

SRD Safety and Reliability Directorate 

SRI Stanford Research Institute 

SRS Systems Reliability Service 

SRV safety relief valve 

SSD Safety Shutdown System 

SSE safe shut-down earthquake 

SSEB South of Scotland Electricity Board 

SSI soil-structure interaction 

SSIV subsea isolation valve 

SSMRP Seismic Safety Margins Research Program 

STAR stability array (method) 

STATAS structured audit technique for the 

assessment of safety management systems 
STCW International Convention on Training, 

Certification and Watchkeeping for 
Seafarers 

STEL short-term exposure limit 

STEP sequentially timed events plotting 

procedure 

STEP sequentially timed events plot 

STPL short-term public exposure limit 

SVA single vehicle accident 

SVO collision of vehicle with stationary obj ect 

SWACER shock-wave amplified coherent energy 

release 

SWAN stress wave analyser 

TAFF theoretical adiabatic flash fraction 

TBC p-t-butyl catechol 

TBN total base number 

TCB 1,2,4,5-trichlorobenzene 

TCDD 2,3,7,8-tctrachlorodibenzo-b-dioxin 

TCP 2,4,5-trichlorophenol 

TCPA Town and Country Planning Act 

TCPA Toxic Catastrophe Prevention Act 

TCSP tank centre space potential 

TDI toluene diisocyanate 

TEMA Tubular Exchanger Manufacturers 

Association 

TESEO Tecnica Empirica Stima Errori Operatori 

TFI The Fertilizer Institute 

TGZ Technigaz 

THERP Technique for Human Error Rate Prediction 

TIG tungsten inert gas 

TLC total lung capacity 

TLV threshold limit value 

TMI Three Mile Island 

TMR triple modular redundant 

TMS truth maintenance system 

TNO Toegepast-Natuurwetenschappelijk 

Onderzoek 

TNT trinitrotoluene 

TOA technical options analysis 

TOPS Total Operations Processing System 

TPA third party activity 

TPQ threshold planning quantity 


TQM total quality management 

TRA total risk analysis 

TRC Thornton Research Centre 

TRC time-reliability correlation 

TRI toxic release inventory 

TRRL Transport and Road Research Laboratory 

TS turbulence scheme 

TSCA Toxic Substances Control Act 

TSDF treatment storage and disposal facility 

TSR temporary safe refuge 

TT task type (Whalley) 

TUV Technische berwachungs-Verein 

TV Tidal volume 

TVA Tennessee Valley Authority 

TWA time-weighted average 

UAS user-approved safety 

UBC Uniform Building Code 

UCB uncertainty bound 

UCC Union Carbide Corporation 

UCIL Union Carbide India Ltd 

UCO Use Classes Order 

UCS Union of Concerned Scientists 

UEL upper explosive limit 

UFL upper flammability limit 

UF uniform flux 

UKAEA UK Atomic Energy Authority 

UKCIC UK Chemical Information Centre 

UKCP UK Chlorine Producers 

UKOOA UK Oil Operators Association 

UL Underwriters Laboratories 

UMC underwater manifold centre 

UN United Nations 

UNEP UN Environment Programme 

UNS Unified Numbering System 

UPS Uninterrupted power supplies 

UPS uninterruptible power supply 

UR(L) United Refineries (Ltd) 

USCG US Coast Guard 

USPHS US Public Health Service 

UST underground storage tank 

UV ultraviolet 

UVCE unconfined vapour cloud explosion 

VAE Value of Area Exposed (Dow) 

VC vinyl chloride 

VC vital capacity 

VCE vapour cloud explosion 

VCF vapour cloud fire 

VCM vinyl chloride monomer 

VDI Verein Deutscher Ingenieure 

VDU visual display unit 

VEEB Vapour escape into, and explosion in, a 

building 

VGS vent gas scrubber (Bhopal) 

VIM vacuum induction melting 

VKI Von Karman Institute 

VLCC very large crude carrier 

VM Vulnerability model 

VOC volatile organic compound 

VOD vacuum-oxygen decarburization 

VOD velocity of detonation 

VOF velocity of fragment 

VPM value of production per month 

VS volumetric source 

VSP Vent Sizing Package 

V&V Verification and validation 
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WA water authority 

WAO wet air oxidation 

WATCH Working Group on the Assessment of 

Toxic Chemicals 
WE Western Europe 

WHO World Health Organization 

WI Welding Institute 


WOAD World Offshore Accident 

Database 

WSA work safety analysis 

WSL Warren Spring Laboratory 

WSSN Worldwide Standard Seismographic 

Network 

ZND Zeldovitch-von Neumann-Doring 
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A* algorithm, 30/21 
Abbeystead, UK, Al/54 
Aberdeen, UK, Al/42 
ABPI, Guidelines for Chemical Reaction 
Hazard Evaluation, 33/24-30 
Abqaiq, Saudi Arabia, Al/48-49 
Abrasive wheels, 25/26 
Absentmindedness model, human error 
and, 14/47 

Absolute probability judgment (APJ) 
human error assessment, 14/81 
Accelerating rate calorimeter (ARC), 
33/17, 21 
Acceptable risk 
defined, 4/4-5 
versus tolerable risk, 4/5—6 
Acceptance testing, 7/61-62 
Access 

See also Plant layout 
for fire fighting, 10/26 
Accidental chemical release laws, 

U.S., 3/5 

Accidental Release Information Program 
(ARIP), EPA’s, 2/9-10; A33/2-3 
Accident Investigation System (AIS), 
27/9; A33/3 

Accident models, 2/3-4; 26/3-5 
See also under name of 
ACSNI, 2/4,7 
Bellamy and Geyer, 2/4,8 
comparative studies, 27/5 
fault/logic tree, 2/3,4; 27/4 
Houston, 2/2,3 
Kletz, 2/4,9; 27/4-5 
management oversight and risk tree 
(MORT), 2/4, 5; 9/15; 27/4; 28/9 
Rasmussen, 2/4,6 
reasons for using, 2/3 
STEP, 27/4 

Accident Prevention Advisory Unit 
(APAU), 6/20; 21/5 

See also Fatal accidents; Hazards 
ammonia, 18/62-64; 22/71-72 
boiling liquid expanding vapor 
explosions, 17/167-169,170 
case histories, 2/27; 27/18 
case histories, common findings, 
Al/69-80 

case histories, description of, Al/8, 
25-69 

causes of, 26/3 
chlorine, 18/61-62,63 
classification, 14/87; 26/3 
condensed phase explosions, 
17/122-123; Al/7-8 
costs of, 5/2-4 

databases, 27/19; Al/5; A33/2-5 
defined, 6/12; 26/3 
diagrams, Al/7 
dust explosions, 17/252 
earthquakes, A15/6-8 
energy control strategies to prevent, 
2/3,4 

fight fighting, Al/7 
fireballs, 16/176; 17/170 
human error and, 14/45—46 
hydrogen sulfide, 18/64 
lessons from, 1/9 


liquefied natural gas, 22/71; 23/74 
liquefied petroleum gas, 22/71; 23/74 
list of major, 22/73; Al/9-24 
marine, 23/62,63-66,67,68,73-74, 
76-77,78-79 
missiles, 17/196,197 
nuclear, 33/2-3,4-6,7; A20/8-10 
phosgene, 18/64 
pipeline, 23/75-76 
pollutions, All/25-26 
pressure vessels, 22/72 
preventing, 26/8 
process, 2/2-4 
proneness plan, 26/5—6 
pyramid, 1/10; 6/12 
rail transportation, 23/34-36,73,75 
ratios for different types of, 1/10 
references on, 2/2,27; Al/3-5 
repetition of, 6/13 
reporting, 27/3 

road transportation, 23/19-32,73,74 
self-heating, 16/66,67 
sources, Al/2-3 

Standard Industrial Classification of, 
2/4-5,7-11 

static electricity, 16/84-85 
statistics on, 1/2,4,10-11; 2/4-5,7-11; 
25/5-6 

storage, 22/71-72 
storage tanks, 22/71 
training and preventing, 26/8 
transportation, 23/73-77 
trend of, 2/22-23,27 
vapor cloud explosions, 

17/134-137 
warehouse, 22/72 

Accidents, investigating/researching, 
Al/6 

causes, identifying, 31/18-25 
CCPS guidelines, 27/14-15 
concepts, 31/3—6 
definition of terms, 31/2-3 
description of, 26/2-9; 27/5-15 
disputing findings, 27/11 
errors, 26/6 

evidence, analysis of, 31/13—14 
evidence, categories of, 31/8 
evidence, collecting, 31/9 
evidence, handling, 31/8-14 
evidence, photographing, 31/9—10 
evidence, sources of, 31/9 
examples of, 27/9,11 
experimental work, use of, 27/7,9 
of explosions, 27/12-14 
of fires, 27/11-12 
form of, 27/5—6 
human factors in, 31/6—7 
importance of, 6/14 
interviewing witnesses, 31/10-13 
of major hazards, 26/8-9 
management, role of, 31/6 

near^niss^27/XJ S — 6 24' 
organization of, 27/5 
preparations for, 31/7-8 
public inquiries, 27/9,15-18 
purpose of, 2/3; 27/5,6-7; 31/2 
recommendations and reports based 
on, 27/7; 31/25-28 
references on, 26/2; 27/5 
regulations, 27/9 
risk taking and, 26/6 


social factors, 26/6-8 
team, 31/14-18 
types of, 27/9 

ACDS. See Advisory Committee on 
Dangerous Substances 
Acetylene 

explosion reaction, 17/24 
hazards of, 11/45-47 
references on, 11/41 

Acid purification task, task analysis and, 
14/28,29,31-34 
Acid rain, All/13 

ACMH. See Advisory Committee on Major 
Hazards 

ACOPs (approved codes of practice), 
18/26; 23/9,14-15; 25/13-15 
Acoustic emission (AE) monitoring, 
19/35,44-47 
Acrylonitrile 
hazards of, 11/47; 18/24 
HSE dangerous dose, 18/57 
references on, 11/41; 18/5,6, 37 
storage of, 22/53; A8/4-5,9-10,11-13 
toxicity of, 18/37 

ACSNI. See Advisory Committee on the 
Safety of Nuclear Installations 
Action error analysis (AEA), 8/55,56; 
14/58,59 

Activated carbon adsorbers, 11/32 
AcuSafe, Al/2 

Adaptive noise cancellation (ANC), 19/39 
Adiabatic flame temperature, 16/21-23, 
24 

Adiabatic flow, 15/6,10 
Adiabatic heating test, 33/20 
Adiabatic temperature rise test, 33/21 
ADR. See European Road Carriage 
Agreement, 23/8 

Advisory Committee on Asbestos (ACA), 
18/25 

Advisory Committee on Dangerous 
Substances (ACDS), 9/88-89; 18/2; 
23/2,47 

Advisory Committee on Major Hazards 
(ACMH), 1/2, 5; 6/2; 9/84 
control buildings and, 10/29 
explosions, 17/2 
fire and, 16/2 

hazard control and, 4/15-17 
license conditions, A24/2—10 
models used by, A17/2-6 
TNT equivalent model, 17/154 
Transport Hazards Report, A17/2-22 
Advisory Committee on Reactor Safety 
(ACRS), 12/94; A20/4 
Advisory Committee on the Safety of 
Nuclear Installations (ACSNI), A20/4 
accident model, 2/4,7 


14/88-90 

personnel selection, 14/36 
training and, 14/38-43 
Advisory Committee on Toxic Substances 
(ACTS), 18/2 

Aerojet-General data bank, 14/85 
Aeronautical Inspection Directorate 
(AID), 19/18 
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Aeronautical Quality Assurance 
Directorate (AQD), 19/18 
Aerosols 

explosions, 17/175 
flammability of, 16/53-56 
African Pioneer, 23/76 
AGE, 30/36,40 

Agency for Toxic Substances and Disease 
Registry (ATSDR), Hazardous 
Substances Emergency Events 
Surveillance (HSEES) database, 
2/10-11; A33/2 

Agitation, of liquids and static electricity, 
16/108 
Air 

See also Compressed air 
blast loading, 17/181-182 
bursts, 17/122 
jets, 25/19 

Air-borne contaminants, 18/26; 25/8-11 
Aircraft 

probability rates, A14/38 
ruptures by, A7/12-13 
Air entrainment, 15/53,163 
momentum, 15/73 

water spray barriers for, 15/308-310 
Air Navigation Regulations, 23/69 
Air pollution 
accidents, All/25,26 
laws and reporting requirements, 2/7; 
All/7-8,10 

Air receiver systems, fault tree analysis, 
9/17,18-17 
Air separation plants 
hazards of, 11/53, 56 
references on, 11/53 
AIRTOX model, 15/250, 251 
Air transportation, 23/69 
Alarms 

for ammonia, 22/48,51 
basic, 14/13-15 
for chlorine, 22/43 
computer-based aids for analysis of, 
14/20-21 

disturbance analysis system, 
30/96-98 

features of, 14/15-16 
fire detection, 16/254-255 
human error and, 14/13—16 
for LNG, 22/37 
for LPG, 22/28,35 
management, 14/16 
operation of, studies on, 14/16 
references on, 14/13 
structure and display, 30/95 
trees, 30/95-96 
Albedo, 15/60 

Alcohol resistant foam, 16/270 
Algebraic stress model, 15/165 
Allentown, Pennsylvania, 33/2,12 
Alpha beta method search, 30/21 
American Association of Railroads 
(AAR), 23/6 

American Boiler Manufacturers 
Association (ABMA), 12/94 
American Chemistry Council (ACC), 1/3; 
4/32; A29/5; A31/5 
process safety system, 6/16 


Responsible Care initiative, 1/13; 6/2 
Security Code, 35/2 
website for, 23/6 

American Conference of Government 
Industrial Hygienists (ACGIH), 

18/9 

publications of, A28/2-3 
American Eagle, 23/76 
American Gas Association (AGA), 15/204, 
205 

address/website for, A29/5 
Battelle field trials, 15/208 
publications of, A28/3-5 
American Industrial Hygiene Association 
(AIHA), 8/24; 18/9 
address/website for, A29/5 
emergency exposure limits, 18/27 
publications of, A28/5-7 
American Institute for Research (AIR) 
data bank, 14/85 
American Institute of Chemical 

Engineers (AIChE), 1/3,13; 4/32; 15/ 
14; 17/19-20; 21/2; 35/3; A31/5 
See also Design Institute for Emergency 
Relief Systems (DIERS) 
address/website for, A29/5 
publications of, A28/7-10 
American Iron and Steel Institute (AISI) 
steel standards, 12/13,15 
American National Standards Institute 
(ANSI), 21/2; 24/15 
address/website for, A29/6 
safety instrumented systems 
standards, 34/5-6 

American Petroleum Institute (API), 8/28; 

21/2 

address/website for, A29/6 
bursting discs, 12/65 
catchtanks and knockout drums, 
17/114-116 

containment of toxic materials and, 
12/73-75 

engulfing fires, 16/223-225 
field trials, 15/204,205 
fire relief of pressure vessels with or 
without liquid, 12/52—53 
flame arresters, 22/17-19 
flares, 16/208 

hazardous area classification, 
16/144-146 

non-sparking tools, 21/21-22 
overpressure standards, 12/45 
pressure relief devices, 12/66 
pressure relief valves, 12/63,64; 

15/39 

publications of, A28/10-12 
reaction forces, 12/66 
RP 750,6/16 
security, 35/3 

Sparks from Hand Tools, 16/60 
storage of petroleum products, 22/5 
American Society for Testing and 
Materials (ASTM) 
acoustic emission monitoring, 19/45 
address/website for, A29/6 
CHETAH, 33/9,12-13 
publications of, A28/20-22 
role of, 21/2 

tests for fire insulation, 16/258, 260 
unified numbering system (UNS) for 


steel, 12/13,15 

American Society of Civil Engineers, 
A29/6 

publications of, A28/12-13 
American Society of Heating, 

Refrigerating and Air-Conditioning 
Engineers (ASHRAE) 
address/website for, A29/6 
publications of, A28/13 
refrigerants, 11/40 

American Society of Industrial Security, 
35/4 

American Society of Mechanical 
Engineers (ASME) 
address/website for, A29/6 
containment of toxic materials and, 
12/73-75 

overpressure standards, 12/43 
pressure pipework standards, 
12/23-25 

pressure vessel standards, 12/19,22 
publications of, A28/13-20 
role of, 21/2 

safety instrumented systems, 12/73 
American Trucking Association (ATA), 
23/6; A29/6 

American Welding Society (AWS), 12/18 
address/website for, A29/6 
publications of, A28/22-23 
Ammonia 

accidents, 18/62-64; 22/71-72 
alarms, 22/48, 51 
CIA guidelines, 9/94,102 
containment, secondary, 22/48,49,51 
discharge of liquid, 15/58 
dispersion of, 15/254, 256, 257; 
A7/21-22 

hazards of, 11/47-48; 22/77 
HSE dangerous dose, 18/57-58 
inspections, 22/48, 51 
loading and unloading, 22/65 
MHAP studies, 18/41-42 
pipelines, 23/38-39 
plume rise equation, 15/291 
pressure relief, 22/48, 51 
pressure storage 22/48-49 
references on, 11/42; 18/5,6-7,37 
refrigerated storage, 22/49—51 
rollover, 22/51 
source terms, 15/164 
standards, 22/47 

storage of, 22/46-53,71-72,77; A8/5, 
10,13-14 

storage spheres, maintenance of, 21/37 
stress corrosion cracking, 22/49, 51—53 
toxicity of, 18/27,37; A7/20 
vaporization of liquid, 15/63—64,68 
Wheatley model of liquid, 15/153 
Ammonia nitrate 
explosions, 17/122,123; A7/18-20 
hazards of, 11/57-58 
references on, 11/55 
storage in warehouses, 22/70 
Ammonia plants 
costs and, 5/4 

growth and major concerns for, 1/5—8 
hazards of, 11/56-57 
references on, 11/55 
Ammonium nitrate, FMA/CIMAH 
guidelines, 9/98 
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AMOCO, publications of, A28/10 
Amoco Cadiz, 23/76; All/26 
Annealing, steel, 12/15 
Annunciator sequences, for alarms, 
14/14-15 

Antwerp, Belgium 
1975 accident, Al/43 
1987 accident, Al/55 
1989 accident, Al/57-58 
Apollo method, 31/25 
Aqueous film forming foam (AFFF), 
16/270 

ARCHIE, 29/4 
Arctic Tokyo, 23/77 
Argon arc welding, 12/18 
Argonne National Laboratory (ANL), 
A20/4; A29/6 

Argon-oxygen decarburization (AOD), 
12/13,14 

Arsenic, inorganic, 18/4, 24,25 
Arson, 16/66; 20/22 
ARSST (Advanced Reactive System 
Screening Tool), 33/21 
ART (Automated Reasoning Tool), 30/40 
Artificial intelligence (AI) 

See also Expert systems 
aids, 30/45-48 
applications, 30/44-45 
databases, 30/7-8 
engineering design, 30/43—44 
fuzzy logic, 30/11,12,14 
games, 30/22-23 

graphs, trees, and networks, use of, 
30/7,31-34 
heuristics, 30/13 
inference, 30/10 

knowledge representation, 30/6-7 
learning, 30/28-31 
logic, non-classical, 30/10-11 
matching, 30/22 
modeling, 30/48 
natural language, 30/6, 24 
neural networks, 30/29, 31 
operating procedure synthesis (OPS), 
30/81,85,87-92 
pattern recognition, 30/22, 31 
planning, 30/24-28 
plant design analysis, 30/58 
plant design synthesis, 30/50—58 
predicate logic, 30/9-10 
prepositional logic, 30/7,8—9 
probabilistic theory/reasoning, 30/7, 
11,13-14 

problemsolving, 30/22-23 
process monitoring, 30/92-93 
process synthesis, 30/49-50 
production rules, 30/10 
programming languages, 30/14-17 

search,'30/19-22 
structured knowledge, 30/7,17-19 
truth maintenance systems (TMS), 
30/12-13 

uncertainty, 30/11-13 
vision, 30/23-24 

Artificial neural networks (ANNs), 30/100 
Arzew, Algeria, 22/71 

dust, references on, 25/16-17 


hazards and regulation for, 18/21, 
25-26; 25/16 

Ashton, Manchester, Al/25 
ASPEN, 11/3 
Asphyxiants, 18/20 
Associated Octel Co., A28/23; A29/2 
Association of British Chemical 

Manufacturers (ABCM), 1/2; 6/2; 
A28/23; A29/2 

Asymmetrical slabs, self-heating and, 
16/72-73 

Atmospheric boundary layer (ABL), 
15/75-76 

Atmospheric conditions, plumes and, 
15/269 

Atmospheric storage tanks 
description of, 22/6—11 
fire relief of, 12/53 
Atmospheric transmissivity, 

16/168-171 

Atmospheric turbulence, plumes in, 
15/143-144,145,151 
Atmospheric vents, 12/50; 22/16 
Atomic Energy Commission (AEC), 
A23/2 

Atomic Energy Research Establishment, 
A28/23 

Attenuation, process, 11/14,15,17 
Attleboro, Massachusetts, Al/32 
Audits 

management’s responsibility for, 5/12; 

6/6,13,20;8/5,U 
of permits, 21/21 
plant safety, 8/70,71,72-73 
safety, 8/2,4-5,6-10; 28/9 
software, 13/58 
Augusta, Georgia, Al/67-68 
AUSCOR, 30/59 
Austenitic stainless steel, 12/14 
Austin, Texas, 23/76; Al/40 
Australia 
databases, A33/4 

transportation organizations, 23/6 
Autocatalytic self-heating reactions, 
16/78 

Autocorrelation function, 15/96 
Auto-ignition temperature (AIT), 16/17, 
19,35,66 

Automatic explosion suppression, 17/59 
Automatic isolation, 17/58-59 
Automatic pressure tracking adiabatic 
calorimeter (APTAC), 33/22 
Automation 
human error and, 14/49 
steam boiler plant example, 13/67-68 
Availability 

down time density function, 7/33 
flowsheeting methods, 7/35 
function, 7/32-33 
logic flow diagrams, 7/22,35 
Markov model, 7/28, 34-35 
reliability and, 7/28,32-38 
repair time density function, 7/33 
storage and, 7/35-38 
system analysis and, 7/32 
throughput capability method, 7/35 
throughput density function, 7/33-34 


Avocet field trial, 15/210 
Avonmouth, UK, Al/29 
Awareness of hazards, 6/13 


Babrauskas model, 16/206 
BACFIRE, 30/77 
Backward chaining, 30/22 
Bader-Donaldson-Hardee model, 16/183 
BAGGER, 30/40 

Baker model, 17/128,131-133, 200-201, 
240-241,242 

Bakersfield, California, Al/29-30 
Baker-Strehlow model, 17/159-160 
B&R Hauliers, Salford, 22/72 
Bangkok,Thailand, Al/62 
Bantry Bay, Erie, 23/76; Al/50-51 
Barge modular plants, 10/32 
Barking, Essex, 22/72 
Barricades, 17/213-214 
Barriers 
solid, 15/307 

steam curtains, 15/316-317 
vapor, 15/307—308 
water, 15/308-317 
Bartknecht model, 17/84-85 
Basic process control system (BPCS), 
11/21, 23; 13/62,64; 34/13-14 
Batch reactors, 13/16 
decomposition, 33/40 
hazard evaluation, 33/32-34 
heat loss, 33/41 

interlock system for, 13/45-47,48,49; 
34/37-39 

safe design for, 33/38-41,44,46 
spontaneous ignition, 33/41 
Batch processes 

computer integrated manufacturing 
and, 13/17 
control of, 13/12-14 
models of, 13/13 
representation of sequential 
operations, 13/13 
structure of, 13/13-14 
Bathtub curve, 7/11,44 
Baton Rouge, Louisiana 
1976 accident, Al/47 
1989 accident, Al/58 
Battelle field trials, 15/208; A29/6 
Baum model, 17/201 
Bayes’rule, 30/13 

Bayes’ theorem, 7/10, 23-24,38-39 
BCS model (Bilby, Cottrell and Swinden), 
12/89 

Beam search, 30/21 
Beaufort scale, 15/77,78 
Beaumont, Texas, Al/35 
Beek, Netherlands, Al/43-44 
Bellamy and Geyer accident model, 2/4,8; 
15/200 

Bellows, 12/26 

Bell Telephone Laboratories, 9/12 
Beloyarsk, USSR, A20/10 
Bench-scale equipment, 17/98-99,104-105 
Benson-Burgoyne model, 17/73 
Benzene, 18/4,22-23 



INDEX 5 


Berlin, New York, 23/73; Al/32 
Best-first search, 30/21 
Beta distribution, 7/18 
Beta factor method for measuring 
dependent failures, 9/34, 35,38 
partial, 9/38-39 
Betelgeuse, 23/76; Al/50-51 
Bhopal, India, 1/3,5; 3/5; 4/2; 5/3; 18/61; 
33/2,12 

company and management, A5/2 
description of, A5/2-11 
emergency and aftermath events, A5/7 
events prior to release, A5/4—6 
investigations of, A5/7—8 
lessons learned from A5/8-11 
methyl isocyanate, properties of, A5/4 
plant process, A5/2-4 
plant site, A5/2,3 
references on, A5/2 
Bimodal failure distribution, 7/45 
Binomial distribution, 7/13,50 
Binomial failure rate method, 9/39 
BIOSIS, 29/3 

Bischloromethyl ether (BCME), 18/24 
Black body radiation, 16/160-161 
Blair, Nebraska, 22/71; Al/35-36 
Blast damage, 17/179,181-196 
Blast-resistant structures. See Explosive- 
resistant structures 
Blast scaling, 17/120-121 
arrival and duration time, 17/121 
Blast wave, 17/119-120 
dynamic pressure, 17/121 
overpressure and dynamic pressure 
impulses, 17/121-122 
peak overpressure, 17/121 
BLEVEs. See Boiling liquid expanding 
vapor explosions 
Blocks world, 30/23 
Bloomfield, New Mexico, Al/53 
Blowdown (BLOWDOWN), 12/72 
pipeline, 15/55—56 
tests, 33/22 
vessel 15/42-45 
Blow-off, 16/28-29 
Bodurtha method, 15/292-293 
Bodurtha-Walsh method, 15/291-292 
Boeing Co., 9/12 
BOHS guidelines, 25/7 

hazards of steam, 11/37-38 
waste heat, 12/34 
Boiling liquid collapsing bubble 
explosions (BLCBEs), 17/174 
Boiling liquid expanding vapor 

explosions (BLEVEs), 16/159; 17/130 
See also Fireballs 
accidents, 17/167-169,170 
bursting vessel, 17/173 
CCPS, 17/174 
cloud formation, 17/173 
energy release and overpressure, 
estimating, 17/174 
event, 17/169-170 
features, 17/171-172 
investigating, 27/13 
liquid superheat limit, 17/172-173 
missiles from, 17/171-172, 206-209 


models, 17/172-174 
references on, 17/167,169 
road transportation and, 23/15 
studies, 17/170-171 
time between fire and, 17/172 
vessel burst pressure, 17/172 
Bombay, India, Al/26-28 
Bonding, preventing static electricity 
and, 16/124 

Bonnybridge, Scotland, All/25-26 
Bontang, India, Al/53-54 
Boolean algebra, 7/7-8 
Borger, Texas, Al/51 
Bound Brook, New Jersey, Al/30 
Boussinesq approximation, 15/97,183, 
192,225 

Bow, London, Al/33 
Bowen ratio, 15/83 
Box models, 15/117,164-165,167 
Boyle model, 17/96 
Bradford, UK, Al/63 
Bradley-Mitcheson model, 17/42,73-24 
Braehead whisky warehouse, 22/72 
Braer, 23/48,76 

Branch-and-bound search, 30/21 
Brasie-Simpson, 17/154 
Breadth-first search, 30/19 
Breahead, Renfrew, Scotland, Al/48 
Brest, France, Al/28 
Bretherick Reactive Chemical Hazards 
Database, 29/3 
Briggs models, 15/147-152 
Brindisi, Italy, Al/48 
British Approvals Service for Electrical 
Equipment in Flammable 
Atmospheres (BASEEFA), A28/23; 
A29/2 

British Chemical Industry Safety Council 
(BCISC), 1/2; 6/2; 8/2,70 
publications of, A28/23 
British Compressed Gases Association 
(BCGA), 9/65; A29/2 
liquid oxygen guidelines, 9/92,94, 
96-97,98 

publications of, A28/23-24 
storage of oxygen, 22/54 
British Gas Corp., A7/2 
British Fire Services Association, 16/2; 
A29/2 

British Gas Corp., 23/40,41 
publications of, A28/24-26 
British Museum method search, 30/21 
British Occupational Hygiene Society 
(BOHS), 15/319,320; A29/2 
publications of, A28/26 
British Petroleum fires, 16/66-67 
British Plastics Federation (BPF), 17/97 
British Safety Council, A28/26; A29/2 
British Standards (BS) 
bursting discs, 12/64-65 
classification of fire, 16/13 
classification of pressure vessels, 
12/19-22 

dye penetrant methods, 19/28 
eddy current testing, 19/28 
electrical equipment and protection, 
16/129,130,131-132,133,134,135 


electricity, 11/36; 16/124-127 
environmental, All/10—11 
FEMA and FEMECA, 8/51, 53 
filling ratios, 22/61; 23/16 
fire and construction materials, 16/289 
fire and plant layout, 10/25,26 
fired heaters and furnaces standards, 
12/34 

flame arresters, 17/57 
hazardous area classification, 10/20; 
16/135 

magnetic particle methods, 19/27-28 
1987 Quality Systems, 1/11,12 
pipelines, 23/37 
pressure relief devices, 12/66 
pressure relief valves, 12/60-63 
pressure vessel classification, 

12/19-22 

pressure vessels, 12/18-22 
radio frequency transmissions, as 
ignition source, 16/63-64,65,66 
radiography, 19/26 
reference temperatures, 23/16 
reliability, 7/6 
software, 13/56 
static electricity, 16/124-127 
steel, 12/13,15 

British Standards Institute (BSI) 
address/website for, A29/2 
Pressure Vessels Technical Committee 
(PVTC), 12/22 
Brittle fracture, 12/80 
Brittleness, steel, 12/9 
Bromine 

references on, 18/5, 37 
toxicity of, 18/27,37 

Brookhaven National Laboratory (BNL), 
15/87,90,124,126; A20/4; A23/2; 
A29/6 

Brooklyn, New York, Al/36 
Browns Ferry, Alabama, A20/10; 

A23/9,12 

Brzustowski-Sommer model, 16/208-209 
Bucket elevators, 17/283-284 
Buckling pin device, 12/49-50 
Building Research Establishment, 
A28/26—28; A29/2 
Buildings 

damage from explosions, 17/179, 
181-196 

dispersion and, 15/99-100,118-120, 
200, 234,236,238-249 
explosions in, 17/46-48,87-90 
fire in, 16/283-290 
infiltration into, 15/301-305 

Bundesanstalt fur Materialforschung 
(BAM), 17/256; A29/9 
Bunds, 15/306 
codes, 22/55 
design, 22/55 
high, 22/58 
loading, 22/58 
sizing, 22/55-56 
spills, 22/56,58 
vaporization from, 22/56 
Bunker-Ramo data bank, 14/85 
Buoyancy 
fluid, 15/72,73 

plume, 15/266, 268,283-284 
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plumes with negative, 15/144 
Bureau International Technique du Chlore 
(BITC) model, 15/203 
Bureau of Labor Statistics (BLS), 2/10 
Bureau of Mines (BM), A29/6 
dust explosions, 17/253, 256, 257, 270 
fire and role of, 16/2 
model, 15/167 

publications of, A28/28-30 
trials, 15/204 
Burners 

fired heaters and furnaces standards, 
12/34-36 

ignition period, 12/35 
starting up, 12/35 
Bum-in, 7/46-47,65 
Burning velocity, 16/20-21, 22,45-47 
aerosols and, 16/56 
dusts and, 17/258 
Burns, 16/239-244 
mortality rates, 16/247-248 
Burro trials, 15/200,203,210,212,213,214 
Bursting discs, 12/48-49,50,64-65 
Business interruption (BI) 
insurance, 5/9,16-17 
statistics on, 5/3 
surveys, 5/16-17 
Butt welding, 12/18 
Bzrustowski-Sommer model, 16/217 


Cables, fires, 16/157-158 
CADUCEUS, 30/38 
Cali, Columbia, Al/30 
California Hazardous Materials Planning 
Program, 4/32 
Calor Gas Ltd., A7/6 

databases, A33/4 
Transport Canada, 23/6; A33/4 
Canadian Chemical Producers 
Association, 1/13 

Carney Reports, 4/29; 8/76,78,79; A26/3 
aircraft, crash and rupture of, 

A 7/12 13 

ammonia, dispersion of, A7/21—22 
ammonia, toxicity of, A7/20 
ammonium nitrate explosions, 
A7/18-20 

casualties, factors mitigating, 
A7/22-24 

chlorine, toxicity of, A7/20 
CRUNCH model, 15/179 
DENZ model, 15/179 
domino effects, 9/53 
emission models, A7/31 
evacuation, A7/26 
failure and event data, 9/11; A7/6-7, 
8-9 

fatal numbers, 9/71,73 
fire models, A7/32 
fluid emissions from vessels, 15/15 
gas dispersion models, A7/31 
hazard assessment, 9/9 
hazardous installations and activities 
identified, A7/2-6 
hazard warning, 9/119 
human escape, 9/66 


human evacuation, 9/66 
hydrogen fluoride, dispersion of, 
A7/21-22 

hydrogen fluoride, toxicity of, 
A7/20-21 

ignition models, A7/31-32 
lead additives, toxicity of, A7/21 
LNG dispersion, A7/15-17 
LNG evaporation, A7/15 
LNG tank temperatures, A7/14-15 
methane and LNG combustion, 17/166 
missiles, rupture of, A7/12 
pipeline failures, A7/11-12 
population characteristics, 9/57-58 
pressure piping failure, A7/10-U 
pressure vessel failure, 12/95; A7/10,31 
probability of ignition, 16/147-148 
probit equations, 9/69 
references on, A7/2,7 
responses to, A7/2,30 
risks and actions, assessment of, 
A7/26-30, 31 

road tanker hazards, A7/24, 26 
second report, A7/31-33 
ship collisions/accidents, A7/13—14 
toxic injury relations, A7/33 
vapor cloud fire and explosions, 
A7/17-18, 32-33 
vaporization model, A7/31 
ventilation rates and, 15/304 
Cap la Hague, France, A20/10 
Caracas, Venezuela, 24/14; Al/52-53 
Carbon dioxide, toxicity of, 18/37 
Carbon monoxide 
references on, 18/5 
toxicity of, 18/38 
Carbon steel, 12/12 
Carcinogens, 18/20 
acrylonitrile, 18/24 
benzene, 18/22-23 
cancer risk, 18/21-22 
chemicals that are, 18/22, 24-25 
references on, 18/3-4 
regulatory controls on, 18/22 
vinyl chloride, 18/23-24 
Cargo tankers. See Tankers, ship/cargo 
Cargo transport units (CTUs), 23/9 
Carruthers-Marsh model, 16/104 
Carruthers-Wigley model, 16/108-109 
Carter model, 7/43; 16/220 
Cased explosives, 17/216-221 
Case histories. See Accidents (incidents) 
CASNET, 30/38 
Castleford, UK, Al/63-64 
CAT, 30/77 

Catchtanks, 17/114-116 
Causality, dependence versus, 30/43 
Cause analysis methods, 31/24-25 
Cause-consequence diagrams, 9/31—32 
CAWR. See Control of Asbestos at Work 
CEFIC. See European Chemical Industry 
Council, 23/5 

Census of Fatal Occupational Injuries 
(CFOI), A33/3 

Center for Chemical Process Safety 
(CCPS), 1/3; 4/32; 6/2; 15/203,250; 
Al/2 

accident investigation guidelines, 
27/14-15; 31/24 


address/website for, A29/6 
alarm management and, 14/16 
BLEVE, 17/174 

blowdown systems and, 12/72 
containment of toxic materials and, 
12/73-75 

control buildings and, 10/31 
database, A33/3 
Engineering Design Guidelines, 
11/64-65 

failure distributions, 7/13 
fire and explosion guidelines, 16/159, 
176;17/167,174, 209 
fireballs and, 16/187-188 
flares and, 12/68 
flash fires, 16/176 

Hazard Evaluation Guidelines, 8/29-30, 
51 

high toxic hazard materials, 22/42 
human error assessment and, 14/80,83, 
84,88,90-91 

Human Error Prevention Guidelines, 
14/35,80 

inherently safer design, 32/10,19-21 
layers of protection analysis (LOPA), 
34/2,7-12 

management guidelines, 6/16-19 

missiles, 17/209 

pipework integrity guidelines, 

12/26, 27 

programmable electronic systems (PES), 
13/34 

QRA Guidelines, 9/9 
Safe Automation Guidelines, 13/62-66 
structural damage from explosions, 
17/19-20 

task analysis and, 14/35 
Vapor Cloud Dispersion Model 
Guidelines, 15/266,305-306 
vapor cloud explosions, 17/167 
vaporization rates for liquids, 15/62,68 
Vapor Release Mitigation Guidelines, 
15/317-318 

venting reactors, 17/117—118 
vessel burst explosion, 17/133 
Center for Waste Reduction Technologies 
(CWRT), 32/21; All/17 
Centers for Disease Control and 
Prevention (CDC) 
mortality database, A33/3 
Wide-ranging On-line Data for 
Epidemiological Reporting 
(WONDER), 2/10 

Central Electricity Generating Board 
(CEGB), 4/13-14 

Centralized control system (CCS), 13/14 
Centrifugal compressors, 12/39; 13/14-15 
Centrifugal pumps, 12/40—41 
Centrifuges, 11/30 
Certainty theory, 30/11-12 
Chalk River, Ontario, A20/9 
Challenger shuttle disaster, 1/8 
Chalmette, Louisiana, Al/62 
Chamberlain model, 16/209-210, 
212-213, 220 

Changes, making. See Modifications 
Chapman-Jouguet model, 17/9-10 
CHARM, 15/250 
Checkers, 30/23 
Checklists 
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identifying hazards and use of, 8/11, 

73 

for inherently safer design, 32/19—21 
insurance assessment and use of, 5/12 
for permits, 21/21 

for plant commissioning, 19/2,7,10,12 
Chemical and Allied Products Industry 
Training Board, A28/30; A29/2 
Chemical cleaning, 21/10 
Chemical Defense Establishment (CDE), 
15/204, 205 

Porton Down field trials, 15/208-210, 

211,212 

Chemical Exposure Index (CEI), Dow, 
8/22, 24-26; 18/27 
Chemical Hazard Information and 

Packaging (CHIP) (1993) regulation, 
8/12; 23/9-12,14 

Chemical Industries Association (CIA), 
5/5; 8/26; 20/2 
address/website for; A29/2 
ammonia guidelines, 9/94,102 
chlorine pressure systems and, 
12/75-79 

control buildings and, 10/30 
emergency procedures and, 20/6—8 
hazard assessment and, 9/2 
HAZCHEM, 23/12 
liquefied petroleum gas guidelines, 
9/92 

publications of, A28/30-32 
Responsible Care initiative, 1/13 
Chemical industry 
accident classification in, 2/5,7—11 
fatal and major accident rates in, 2/11, 
12; 25/6 

fires in, 2/16-17, 20,21 
loss prevention development in, 1/4—5 
references on, 11/24-25 
separation distances, 10/18 
tragedies in, 1/2-3 
Chemical Industry Safety and Health 
Council, A28/32; A29/2 
Chemical Manufacturers Association 
(CMA). See American Chemistry 
Council 

Chemical Reactivity Index, 33/12 
Chemical reactors 
batch, 13/16 

batch, interlock system for, 13/45-47, 
48,49 

continuous stirred tank, 13/15—16 
control of, 13/15-17 
designing, 11/4 
plant layout and, 10/12 
Chemicals 

See also Reactive chemicals/hazards; 
Toxic chemicals/materials; under 
name of 

decomposition, 16/56 

Dow guide for selected, 8/17 

explosion energy, 17/21-25 

firefighting foam from, 16/270 

as ignition source, 16/58,60 

marine transport of, 23/61-62 

properties of, 8/11-13 

sensitivity to decomposition, 33/10—12 

substituting, 32/8 

toxic limits for, 11/45 


Chemical Safety and Hazard 

Investigating Board (CSHIB), 33/2; 
Al/2; A29/6; A33/3 
Chemical spills, laws and reporting 
requirements, 2/7 

Chemical tankers, static electricity in, 
16/114-116 

CHEMSAFE, 23/69; 29/3 
CHEM-TEL, 23/6 
CHEMTOX, 29/3 
Chemtrec, 23/6 
Chernobyl, 4/2 
description of, A22/2-10 
emergency and aftermath events, 
A22/4—7,9 

events prior to, A22/3—4 
human factors, 14/44 
investigation of, A22/7-8 
lessons learned from, A22/9-10 
plant and process, A22/2-3 
references on, A22/2 
Chess, 30/23 
CHETAH, 33/9,12-13 
Chevron Hawaii, 23/76 
Chicago, Illinois, Al/42 
China Lake field trials, 15/210,212 
CHIP. See Chemical Hazard Information 
and Packaging 

Chloride stress corrosion cracking, 
12/84-85 

Chlorination reactions, 11/27—28 
Chlorine 

accidents, 18/61-62,63 
compressors, pumps, and padding for, 
12/78 

concentration effects, 18/49 
construction materials for, 12/75 
dispersion of, 15/253-254 
fixed installations of, 18/66-68 
gas attacks, 18/54-55 
hazard assessment, 18/66—75 
hazards of, 11/48 
HSE dangerous dose, 18/58 
HSE guidelines, 9/92-94,95,96, 
97,98 

inhalation rates, effects of, 18/51-52, 
53 

inspecting, 22/45 
lethal loads, 18/53 
loading and unloading, 22/65 
medical treatment, effect of, 18/52, 53 
MHAP studies, 18/41 
models, 18/50-51 
physical activity, effects of, 18/51 
pipelines, 23/39 
pipes and vessels for, 12/75—78 
poisoning, physiology and pathology 
of, 18/45-48 

populations vulnerable to toxicity, 
18/52-53 

pressure relief and gas adsorption, 
12/78-79 

pressure systems for, 12/75-79 
probit equations, 18/49-50,51,54 
references on, 11/42; 18/5,36; 22/42 
spills, 23/72-73 

storage of, 22/42-46; A8/10,14-15 
threshold limit values (TLVs), 18/49 
toxicity of, 18/27, 36,42-55; A7/20 
transporting, 18/68-75; 22/45 


UKCP guidelines, 9/99-100,101 
Chlorine Institute, 12/75; 23/39,72-73 
address/website for, A29/6 
publications of, A28/32-33 
Chlorofluorocarbons (CFCs), 32/8 
CHRIS (Chemical Hazard Response 
Information System), 18/9; 29/3 
Christian Michelsen Institute (CMI), 
17/256 

publications of, A28/33 
Cigna Insurance, 2/16,18-19 
CIMAH. See Control of Industrial Major 
Accident Hazards 
Circumspection, 30/13 
CISDOC, 29/3 
Clancey model, 15/167 
Classification 

See Hazardous area classification 
of accidents, 14/87; 26/3 
regulations, 23/9-12 
Classification, Packaging and Labeling 
(CPL) (1984) regulations, 23/9 
Classification and Labeling of Explosives 
Regulations (CLER) (1983), 23/9 
Claude, 23/77 

CLAW. See Control of Lead at Work 
Clay model, 16/221 

Clean Air Act (CAA) (1970), 2/7; 3/4; A31/5 
on fugitive emissions, 15/319 
references on, 3/2 
Clean Air Act (1993), All/8 
Cleaning 

chemical, 21/10 
line, 21/12 
manual, 21/12 
shot blasting, 21/12 
solvent jetting, 21/11-12 
steaming, 21/10-11 
storage tanks, 21/33-35 
water for, 21/10 
water jetting, 21/11 
Cleveland, Ohio, 22/71; Al/28 
CLICHE model, 17/48-49 
Climax,Texas, Al/42 
Closed world assumption (CWA), 30/13 
Cloud parameters, Pasquill, 15/122,124 
Coastal areas, dispersion and, 15/99,117, 
129-130 

Coastal Zone Management Act (1972), 3/5; 
4/31 

COGSYS, 30/59 
Coherency, fault tree, 9/20-21 
Colenbrander quasi-steady-state model, 
15/186-187 

Colenbrander steady-state model, 
15/185-186 

Columbia shuttle disaster, 1/8 
Combustion and smoke control, flare, 
12/71 

Combustion process, 16/2,12—13 
burning velocity, 16/45—47 
chemical reactions, 16/31 
cool flames, 16/49-50 
diffusion and premixed flames, 16/28, 
29-30 

flame propagation, 16/26, 28 
flame stretch and wrinkling, 16/30—31 
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flammability limits, 16/32—35 
flashback and blow-off, 16/28-29 
gas toxicity and, 18/58-59 
ignition process, 16/35-45 
quenching, 16/47-49 
references on, 16/26,27-28 
tests, 33/22 

thermal explosion theory, 16/31—32 
topics relevant to loss prevention, 
16/28 

in tubes, 16/50-53 
in vapor clouds, 17/142—143 
COMHAZOP, 30/63 
Commission of the European 

Communities (CEC), 9/40; 27/19 
publications of, A28/33-34 
Common cause failure (CCF), 9/32; 
13/41-42,43 

Common mode failure (CMF), 9/16, 32; 
A23/4 

Communication 

emergency planning and, 24/7,10 
human error in, 9/51; 14/51,52,53 
importance of, 6/11 
process design and, 11/4 
risk, 4/8—9 

Company level, costs of accidents at the, 
5/4 

Competence of personnel, 6/11—12 
Complete and rigorous model-based 
reconciliation (CRMR), 13/17 
Complex systems, reliability and, 
7/21-24 

Complex terrain, dispersion and, 15/99, 
117-118,130, 200, 249 
Component-based modeling, 30/42 
Composite materials, pressure vessel 
design and, 12/17 
Composite slotted discs, 12/49 
Comprehensive Environmental 
Response, Compensation, and 
Liability Act (CERCLA) (1980), 2/7; 
22/58 

See also Superfund 
references on, 3/2 
role of, 3/4; All/10 
Compressed air 
for breathing, 11/39 
explosions, 17/175—176 
hazards, 25/28-29 
for instruments, 11/38-39 
for plants, 11/38 
process, 11/39 

Compressed asbestos fiber (CAF) 
gaskets, 12/25 

Compressed Gas Association (CGA), 
A29/7 

fire relief, 12/53 
publications of, A28/34-35 
Compression ignition, 16/43—45 
Compressors 

centrifugal, 12/39; 13/14-15 
for chlorine, 12/78 
control of, 13/14-15 
process, 12/38-39 
reciprocating, 12/39 
screw, 12/39-40 


Computational fluid dynamics (CFD), 
17/164; 29/3 
Computer(s) 
alarms, 14/14 
CHAZOP, 8/27,45, 54-55 
consoles/displays, human error and, 
14/11-13 
failure of, A14/26 
fires and use of, 16/288-289 
maintenance, 21/43—44 
Computer aided design (CAD), 10/5; 11/8; 
29/2 

Computer aided process engineering 
(CAPE), 29/2 
Computer aids 
for alarm analysis, 14/20-21 
databases, 29/3 

for emergency response simulation, 
29/4 

for hazard assessment, 9/119; 29/3, 

4-5 

for pipework and fluid flow, 29/2 
for plant layout, 10/5 
for pressure relief device sizing, 29/3—4 
for process operators, 14/19-21 
for reporting accidents, 27/24 
for transportation, 29/5 
for unit operation and equipment, 
29/2-3 

Computer integrated manufacturing 
(CIM), 13/17 

COMPUTER MAN, 17/244 
Computers, control systems and 
See also Software 

configurations and reliability, 13/9-11 
direct digital control (DDC), 13/4,9-11 
displays and alarms, 13/12 
fault tolerant, 13/12 
functions of, 13/11-12 
power supplies and protection, 13/12 
references on, 13/8,10 
CONCAWE 

guidelines, 9/9,121; 23/40,41,42,73; 
25/7 

publications of, A28/35-36 
Concentrations, dense gas dispersion 
and, 15/269 
causes of, 15/271 

distribution function, 15/272-273 
ensemble, 15/277 
flammable gas clouds, 15/286 
Gifford meandering plume model, 
15/273-274 

intensity parameter, 15/277-278 
in jets, 15/279 
measuring, 15/271-272 
models, 15/272 
peak-to-mean ratio, 15/273 
Ride passive plume model, 15/274 
studies and features of, 15/270-271 
time mean, 15/272 
Wilson passive plume model, 
15/274-276 

workbook model, 15/278-279 
Concept hazard analysis (CHA), 8/57, 
59-60 

Concept safety review (CSR), 8/57 
Conceptual dependency, 30/18-19 
Conceptual/front end stage of process 
design, 11/8-10 


Concrete 

impact of missiles on reinforced, 
17/212-213 
storage tanks, 22/12 
Condensate hammer, 12/31, 32 
Condensed phase explosions 
accidents, 17/122-123; Al/7-8 
effects of, 17/221-223 
hazard assessment, 17/292 
investigating, 27/12 
TNT model, 17/123-128 
Conditional probability, 7/9 
Condition monitoring, 19/34-39 
Confidence Emits and mean life, 7/48- 50 
Confined spaces, maintenance of, 
21/12-14 

CONPHYDE, 30/58-59 
Consequence modeling, 8/27,57 
Considine-Grint model, 16/176,221,293 
Constraint-based modeling, 30/42 
Constraints, 30/19 
Containers 
construction, 23/13 
filling ratios, 23/14 
multi-use, 23/7 
pressure relief, 23/14 
regulations, 23/12 
transportation, 23/12-14 
types of, 23/13 
Containment 

of dispersions, 15/306-317 
dust explosions and, 17/266 
pressure, 12/72-73 
of reactors,17/97 
secondary, 12/74-75; 22/15-16 
secondary, for ammonia, 22/48,49,51 
secondary, for LNG, 22/36 
secondary, for LPG, 22/21-22, 35 
of static electricity, 16/121-122 
of toxic materials, 12/79-75 
of vented materials, 17/111,113 
Contamination hazards, 11/41 
Contractors, 6/15 
process design and, 11/13 
use of, 21/5 
Control 

See also Control systems 
of batch processes, 13/12-14 
of chemical reactors, 13/15-17 
compressor, 13/14-15 
deviations/disturbances in, 11/64; 13/2 
management and, 6/13 
search,30/21 
Control buildings/rooms 
emergency, 10/31 
plant layout and, 10/29-31 
toxic gas release and, 10/30-31 
Control of Asbestos at Work (CAWR) 
(1987) regulations, 18/26; 25/7,30 
Control of Industrial Major Accident 
Hazards (CIMAH) regulations 
(1984), 4/17,19-21, 22-25,28-29; 
6/15; 18/15 

for ammonia, 9/94; 22/47 

for ammonium nitrate, 9/98 

for liquid oxygen, 9/92,94, 96-97,98 

for LNG, 22/35,36 

for LPG, 9/92,94; 22/20 

for marine emergencies, 23/71 
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ports and harbors, regulations, 23/50 
on warehouses, 22/66 
Control of Lead at Work (CLAW) (1980) 
regulations, 25/7,30 
Control of Major Accident Hazards 
(COMAH), 24/15 

Control of Pesticides (1986), 22/66 
Control of Pollution Act (COPA) (1974), 
All/8 

Control of Substances Hazardous to 

Health (COSHH) (1988) Regulations, 
18/15,18,20,21,22; 22/66; 25/7,11-15 
Control systems 
See also Control 

CCPS guidelines, 13/62-66 
characteristics, 13/2-4 
computers, use of, 13/8-12,17 
EEMUA guidelines, 13/60-62 
emergency shut-down systems, 
13/65-67 

high toxic hazard materials example, 
13/68-69 

instrument failure, 13/17-24 
instrument system design, 13/4—8 
interlock, 13/43-47 
for plant commissioning, 19/8,10 
programmable electronic systems 
(PES), 13/34,48-54 
programmable logic controls (PLCs), 
13/14,47-48 
references on, 13/2, 5-6 
software engineering, 13/54-60 
steam boiler plant example, 13/67-68 
trip, 13/25-43 

Convective boundary layer (CBL), 
15/75-76 

Convective conditions, plumes and, 

15/151 

Convective velocity/scale, 15/97 
Convention Concerning International 
Carriage by Rail (COTIF), 23/32 
Conveyor system 
dust in, 17/283 

interlock system for, 13/45,46—47; 
34/36-37 

Coode Island, Australia, Al/63 
Cook-Bahrami-Whitehouse model, 

16/220,221-222 
Cool flames, 16/49-50 
COPs (codes of practice), 23/9,14-15 
Coriolis force, 15/78 
Cornwall, Ontario, 23/73 
Corpus Christi, Texas, Al/36 
Corrosion, 8/12; 21/39 
beneath insulation, 12/42 
chloride stress, 12/84-85 
crevice, 12/83-84 
description of the types of, 12/81,83 
erosion, 12/85-86 
external, 12/42,86 
galvanic, 12/83 
knife-line, 12/83 
monitoring, 19/35,42-44 
nitrate stress, 12/85 
pitting, 12/84 
policy, 12/86-87 
stress-related, 12/84 
testing, 12/86 
at welds, 12/86 


Corrosive materials 
plant layout and, 10/13 
sampling, 20/19 
working with, 25/28 
Costs 

analysis techniques, 5/6-7 
-benefit analysis and risk, 4/12 
company level, 5/4 
environmental, All/13 
of fugitive emissions, 15/323 
insurance, 5/3,7-19 
life cycle costing, 7/67-69 
of losses, 5/2-4 
of loss prevention, 5/4—7 
pipelines and, 23/37-38 
plant layout and, 10/5,10 
plant size and, 1/6,7 
references on, 5/2—3 
storage issues and, 1/7 
transportation methods and, 1/6,7 
C0 2 gas shielded welding, 12/18 
Coulomb’s law, 16/86 
Council for Science and Society, 4/4, 5 
Cox-Carpenter model, 15/173-175 
Cox-Lees-Ang model, 16/148-152 
Cox-Roe model, 15/172-173 
C++, 30/17,36 
Cracks 

See also Fracture mechanics 
two-phase flow in, 15/26 
Cranes, maintenance of mobile, 21/23 
Crankcase explosions 
analysis of, 9/7; 17/175 
gas engines and, 12/40 
Craters, 17/180-181, 211 
Craven model, 16/217-219 
Creep, 21/38 

pressure systems and reasons for, 
12/80-81 

Creep, steel and, 12/9-10 
temperature and, 12/12 
Crescent City, Illinois, 23/73; Al/36-37 
Crete, Nebraska, 23/73 
Crevice corrosion, 12/83-84 
Critical action and decision approach 
(CADA), 14/81; 20/4 
Critical examination (CE), 8/57,60 
plant layout and, 10/5 
process design and, 11/12 
use of, 31/20-23 
Critical flame speed, 17/54-55 
Critical flow 
emissions and, 15/9 
two-phase flow and, 15/15,20, 

22-23 

Critical path scheduling (CPS), 19/5 
Critical pressure ratio (CPR), 15/23 
CRUNCH model, 15/167,177-179, 

313,314 

Cryogenics, 11/34 
vaporization of cryogenic liquids, 
15/63-64 

Crystallization plant systems, fault trees 
and, 9/26-28 

Cubatao, Brazil, 23/75; Al/54 
Cubbage-Marshall model, 17/65 
Cubbage-Simmons model, 17/63-64 
Cullen Report, 6/2,9,15 


Customs-Trade Partnership against 
Terrorism (C-TPAT), 23/5,88-89 
Cut sets, 7/23 

Cyclohexanone oxidation, 11/26 
Cyclones, 17/284 
Cylinders, for storage, 22/66 
Cylinders, self-heating and, 16/72 
hollow, 16/73-74 


Damage. See Explosions, damage from 
Dangerous Cargo Act (1970), 3/5 
Dangerous Substances Directive, 18/14, 
15, 22; 23/50 

Darcy friction factor and fittings loss, 
15/8-9 

accidents involving, A3/4-5 
Data 

See also Event and failure data 
collection, human error, 14/84-87 
reconciliation, 30/92 
Databanks, A14/7 
human reliability, 14/85, 87 
Databases 

See also under name of 
for accidents, 27/19; Al/5; A33/2-5 
data acquisition for, A14/11 
design of, A14/10 
list of, 29/3 
operation of, A14/11 
references on, 30/7; A14/7 
relational, 30/7-8 
types of, A14/7-8 
Davies model, toxic gas clouds, 
15/288-290 
Dead legs, 21/39 
Dead time, control and, 13/3 
Debris analysis, 19/36-38 
DECADE, 30/59 

Decatur, Illinois, 23/73; Al/42-43 
Decay relations, 9/103,105,107-108,109 
Decision analysis methods, 5/6-7 
See also Human information 
processing 
Decision making 
See also Human information 
processing 

risk assessment and, 9/9-11 
Decision theory, 30/28 
Decision tree for fault diagnosis, 
14/37-38,40 
Decker model, 17/64 
Decommissioning pressure storage 
vessels, 22/72 

Decomposition, 7/23-24; 8/12 
chemical, 16/56 

chemical sensitivity to, 33/10-12 
human error and, 14/47—48 
pressure test (DPT), 33/17 
Deepwater Ports Act (1974), 2/7 
Deer Lake, Pennsylvania, 23/73; 24/14; 
Al/32 

Default reasoning, 30/13 
de Faveri model, 16/209 
de Faveri-Hanzevack-Delaney model, 
15/292 
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Deflagration 

to detonation transition (DDT), 17/14-15 

ignition sources, 17/31 

in pipes, 17/32-33 

inside plants, 17/31-33 

plant design and, 17/33 

tests, 33/22 

versus detonation, 17/5,10 

DEGADIS model, 15/167,183,189-191, 
200 

Delayed onset detection test, 33/17 
Delays, costs of, 5/4 
Delft University of Technology, Al/2 
Del Norte, 23/76 
Delphi method, 9/43 
Demand-capacity mismatch model, 
human error and, 14/46 
Dempster/Shafer theory, 30/12 
DENDRAL, 30/38 
De Nevers model, 15/171-172 
Dense gas dispersion. See Dispersion, 

Density difference model, 15/165-166 
Density intrusion models, 15/166-167 
DENS20 model, 15/203 
DENZ model, 15/167,175-177,179 
Department of Employment, A28/37 
Department of the Environment, A28/37 
Department of Trade and Industry (DTI), 
A28/37 

Dependency-directed backtracking 
search, 30/21-22 

Dependency versus causality, 30/43 
Dependent failures 
benchmark study on, 9/40 
beta factor method, 9/34, 35,38 
beta factor method, partial, 9/38-39 
binomial failure rate method, 9/39 
cascade, 9/41 
causes, 9/32-33 
classifications of, 9/33,37 
data on, 9/33-34 
defenses against, 9/41 
diversity and, 9/39 
effects of, 9/33 
fault trees and, 9/16-17,39 
geometric method, 9/38 
Greek letter method, multiple, 9/39 
other terms for, 9/32 
protective systems and, 9/34-35 
redundant systems and, 9/35 
references on, 9/32 
reliability and, 9/39-40 
revealed and unrevealed, 9/39 
Deposition 
dry, 15/296-298 
velocity, 15/298 
wet, 15/298-300 

Depressuring systems, 12/52,72; 21/6 
restarting, 13/36 

Depressurization of vessels, 15/33 
drift flux, 15/35-36 
gas or vapor generation, 15/34—35,37 
liquid swell, 15/34 
two-phase flow, 15/37 
vapor carryunder, 15/37—39 
velocity, open versus closed system, 
15/36-37 


Depth-first search, 30/19-20 
Descartes, 23/77 

Desert Tortoise field trials, 15/211, 
213-214,219, 220 
Design 

See also Process design 
insurance and, 5/18 
reliability in, 7/59-60 
Design Institute for Emergency Relief 
Systems (DIERS); 29/3 
two-phase flow project, 15/23, 34 
venting reactors, 17/97—99,100,101,102 
Design Institute for Multiphase 
Processing (DIMP), 15/14 
two-phase flow project, 15/22, 23, 26 
DESIGN-KIT, 30/48-49 
Det Norske Veritas (DNV), A28/37; A29/10 
Detonations 
See also Explosions 
characteristics, 17/12-13 
confinement and, 17/16—18 
deflagration transition to, 17/14-15 
deflagration versus, 17/5,10 
initiation, 17/13-14 
models, 17/7,9-10 
in pipes, 17/35 
plant design and, 17/35 
protection against, 17/35—36 
Rankin-Hugoniot conditions, 17/7-9 
references on, 17/2-5,6 
run-up distances, 17/15—16 
shockwaves, nonreactive, 17/7—8 
shockwaves, reactive, 17/9 
sympathetic, 17/20-21 
turbulence, effects of, 17/18 
in vessels, 17/34-35 
waves, 17/6,10-12 
Detroit, Michigan, A20/9-10 
Dewar tests, 33/16,21 
Diagrams 
accident, Al/7 

interlock, 13/44,45; 34/34-36 
logic, 31/19-20 

DIERS. See Design Institute for 
Emergency Relief Systems 
Differential scanning calorimetry (DSC), 
33/17,19-20 

Differential thermal analysis (DTA), 
33/17-19 

Diffraction loading, 17/182-183 
Diffusion equation, 15/100,122,123 
Digraphs, 9/21 

Dilation (radial growth), pressure vessel 
design and, 12/16 
DIMP. See Design Institute for 
Multiphase Processing 
Dioxins, All/13 

Directed graphs (digraphs), 30/32,34 
Directorate General of Labor (DGL), 

Netherlands, field trials, 15/205,206, 
209 
Disasters 

insurance and major, 5/11 
list of major, 2/14 
references on, 2/11-12,15 
Discharge. See Emissions 
Discrete-state, continuous-time Markov 
model, 7/24-25 


Discrete-state, discrete-time, Markov 
model, 7/29 
Dispersion(s) 

blowdown, vessel, 15/42-45 
buildings and obstructions and, 
15/99-100,118-120 
classifications, 15/72-73 
coastal areas and, 15/99,117 
complex terrain and, 15/99,117-118 
containment of, 15/306-317 
fluid buoyancy, 15/72,73 
of gas, 15/73-74 
hazard ranges for, 15/293-295 
of jets, 15/134-142 
models, 15/100-102 
momentum, 15/72,73 
of plumes, 15/134,135,142-152 
pressure relief valves, 12/47—48, 
60-64; 15/39-42 
references on, 15/69-72 
ruptures, pipeline, 15/54-56 
ruptures, vessel, 15/45—53 
short distances and, 15/290-293 
sources,15/72,73 
topographic effects on, 15/73 
of two-phase flashing jets, 

15/152-155 

urban areas and, 15/98-99,116-117 
vaporization, 15/56—68 
of vented materials, 17/111 
Dispersion, dense gas, 15/74,155 
ammonia, 15/254 
behavior, 15/160 

buildings and obstructions and, 
15/200,234, 236, 238-249 
Bureau International Technique du 
Chlore (BITC) model, 15/203 
Bureau of Mines model, 15/167 
CCPS, 15/203, 266, 305-306 
chlorine, 15/253-254 
Clancey model, 15/167 
Colenbrander quasi-steady-state 
model, 15/186-187 
Colenbrander steady-state model, 
15/185-186 

comparison of models, 15/249-252 
concentrations, 15/269-279 
Cox-Carpenter model, 15/173-175 
Cox-Roe model, 15/172-173 
criteria for, 15/266 
CRUNCH model, 15/167,177-179 
DEGADIS model, 15/167,183, 

189-191 

De Nevers model, 15/171-172 
DENS20 model, 15/203 
DENZ model, 15/167,175-177,179 
DISP2 model, 15/203 
DRIFT model, 15/74,200-202 
Eidsvik model, 15/202 
factors affecting, 15/159 
Fay and Ranck model, 15/202 
FEM3 model, 15/167,182 
field trials, 15/204-223 
Germeles-Drake model, 15/167-168 
hazard ranges for, 15/293-295 
HEAVYGAS model, 15/165,167,191 
HEGABOX model, 15/183,188,189 
HEGADAS model, 15/165,167,182,183, 

187- 188,189 

HGSYSTEM model, 15/167,183, 

188- 189 

hydrogen fluoride, 15/254-256 
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liquefied natural gas, 15/253 
MARIAH and MARIAH-II models, 
15/203 

MERCURE-GL model, 15/203 
models, 15/164-167 
physical modeling, 15/223-236 
plumes from elevated sources, models 
for, 15/256-258, 261-269 
propane, 15/253 
references on, 15/156-159 
SIGMET model, 15/167,179-181 
SLAB model, 15/167,181-182 
SLUMP model, 15/167,191 
source terms, 15/160-164 
TeRiele model, 15/183-185 
TNO models, 15/202 
TRANSLOC model, 15/202 
van Ulden models, 15/159-160, 
168-172 

von Karman Institute (VKI) models, 
15/203 

Webber generalized box model, 
15/203-204 

workbook model, 15/191-200 
ZEPHYR model, 15/203 
Dispersion, meteorology and effects on, 
15/73,74 

atmospheric boundary layer, 15/75-76 
autocorrelation function, 15/96 
convective velocity/scale, 15/97 
density of air, effects of, 15/97 
eddy dissipation rate, 15/96 
flux-gradient relations, 15/92-94 
force balance equation, 15/78 
geostrophic wind and Ekman spiral, 
15/77-78 

heat flux and Bowen ratio, 15/83 
Lagrangian and Eulerian turbulence, 
15/96 

law of the wall, 15/79 
mixed layer scaling and height, 15/97 
Monin-Obukhov length, 15/86-87 
passive dispersion and, 15/121 
references on, 15/75 
Richardson number, 15/84—86 
stability conditions/criteria, 15/83, 
87-92 

surface roughness, 15/81-82 
Taylor’s theorem, 15/96-97 
temperature profiles, 15/82-83 
turbulence, momentum flux, eddy 
viscosity, and mixing length, 
15/78-79,95-96 

turbulent exchange coefficients, 15/94 
universal functions, 15/94 
wind characteristics, 15/76-77 
wind velocity, 15/79-81,95 
Dispersion, passive 
buildings and obstructions and, 
15/99-100,118-120 
coastal areas and, 15/99,117 
complex terrain and, 15/99,117-118 
dosage, 15/114-115 
features of, 15/102 
of gas, 15/73-74 
hazard ranges for, 15/293 
K-theory models, 15/115—116 
meteorological conditions and, 15/121 
parameters, 15/121—134 
Pasquill-Gifford model, 15/107-111, 
124-134 

Pasquill model, 15/106-107,122,124 


plume model characteristics, 
15/113-114 

puff model characteristics, 15/114 
Roberts model, 15/103-105 
references on, 15/102 
sampling periods, 15/111-112 
sources, 15/115 
studies, 15/102,103 
Sutton model, 15/105-106,122,123 
urban areas and, 15/98-99,116-117 
Dispersion, topography and effects on, 

15/73 

buildings and obstructions, 15/99-100 
coastal seas and water, 15/99 
complex terrain, 15/99 
surface roughness, 15/98 
urban areas, 15/98-99 
Dispersion coefficients, Pasquill-Gifford, 
15/124-126,127-128 
coastal areas, 15/129-130 
complex terrain, 15/130 
NRPB, 15/126-127,131 
puff, 15/132-133 
urban areas, 15/128-129,132,133 
Displays, human error and, 14/11—13 
Disposal systems 
flare stack design, 12/59 
gas/vapor disposed into the 
atmosphere, 12/58 
load on, 12/57-58 
overpressure in, 12/57—60 
relief headers, 12/58-59 
selection of, 12/59-60 
vent stack design, 12/59 
DISP2 model, 15/203 
Distance, scale of hazard and, 2/13 
Distillation columns, 11/32 
trip system for, 13/30—31, 32 
Distillation units, 11/17 
Distributed control logic (DCL) system, 
13/14 

Distributed plants versus large plants, 
11/24 

Distribution function, concentrations 
and, 15/272-273 

Disturbance analysis system (DAS), 
30/96-98 

Diversity, dependent failures and, 9/39 
Documentation 

emergency shut-down systems and, 
13/66; 34/33 
inspection, 19/19-20 
maintenance, 21/4—5 
management’s responsibility for, 6/6, 
7-8 

of modifications, 21/49 
post-plant commissioning, 19/13—14 
pre-plant commissioning, 19/7 
pressure relief systems and, 12/66-67 
process design and, 11/4 
Doe Run, Kentucky, Al/32 
Domino effects, 9/53-54 
Donaldson Report, 23/48 
Donnellson, Iowa, Al/49 
Double counting injuries, 9/71 
Double wall equipment, 12/75 
Dougherty, E. M„ 14/74,76-80, 81,82 
Dow Chemical Exposure Index (CEI), 
8/22,24-26;18/27,24/4 


Dow Fire and Explosion Index (F&EI), 
8/13; 24/4; 32/11 
assessment form, 8/16 
damage factor, 8/25 
degrees of hazard, 8/24 
fire protection, 16/255,256 
loss control credit factor, 8/25 
material factor determination guide, 
8/18 

material factors for selected chemicals, 
8/17 

material factor temperature 
adjustment, 8/18 

penalties for general process hazards, 
8/19 

penalties for special process hazards, 
8/20-22,23-24 
procedure for calculating, 8/14 
separation distances, 10/15 
Dow Index (Guide), 5/12; 8/13-17 
Down time density function, 7/33 
Down-time losses, 2/20-22,23-26 
costs and, 5/4 
DRAFT, 30/77 
Drag, plume, 15/266,268 
Drag loading, 17/182-183 
Dragosavic model, 17/65 
Drain systems, plant layout and, 
10/28-29 

Drenick’s theorem, 7/44-45 
Drift flux, 15/35-36 
DRIFT model, 15/74, 200-202 
Dronka, Egypt, Al/65 
Drums 

static electricity in, 16/120-121 
for storage, 22/65-66 
Dry chemicals, fire protection and use of, 
16/272-273 

Dry deposition, 15/296-298 

fluidized bed, 17/285 
hazards of, 11/31-32; 17/284-285 
operation of, 20/14 
plant layout and, 10/12 
spray, 17/285-286 
Drying powders, tests, 33/22-23 
DSPL (Design Specialists and Plans 
Language), 30/44, 58 
Duane method, 7/61 
Ductility, steel, 12/9 
Ducts 

explosion venting of, 17/81-87 
fires in, 16/157-158 
Dudgeons Wharf, London, Al/35 
Dugdale model of crack tip plasticity, 
12/89 

Duplex stainless steel, 12/14 
Dust 

See also Asbestos; Powders 
filters, 17/284 
fires, 17/286-288 
flammability of, 16/62; 17/250-251 
handling plants, description of, 
17/281-286 
hazards, 25/15-16 
inhalable versus respirable, 18/21 
references on, 18/4 
separators, 17/284 
static electricity and, 16/117-120 
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toxic effects, 18/25 
versus powder, 17/251 
DUSTEXPERT, 30/59 
Dust explosions/explosibility 
accidents, 17/252 
characteristics, 17/252-260 
classification, 17/257,259-260 
containment, 17/266 
factors influencing, 17/253 
gas and, 17/259, 265-266 
hazard assessment, 17/288-293 
ignition sources, 17/260, 262-263,264 
isolation, 17/266-267 
parameters, 17/257-259 
preventing, 17/263, 265-266 
properties of some dusts, 17/261 
protecting against, 17/266-268 
references on, 17/249-251 
sequence of events, 17/251-252 
suppression, 17/267-268 
tests for explosibility, 17/253-257 
Dust explosions, venting 
design issues, 17/280 
of ducts and pipes, 17/280-281 
factors influencing dust, 17/269-270 
models, 17/271-280 
references on, 17/268 
scaling laws, 17/270 
studies, 17/270 
venting ratio and coefficient, 
17/270-271 

Dust handling equipment, plant layout 
and, 10/12 
Dutch FN, 9/88 
Dye penetrant methods, 19/28 
Dynamic analysis of software, 13/58 
Dynamic pressure loading, pressure 
vessel design and, 12/16 
Dynamic time response of trip systems, 
13/37—41 


Eagle field trials, 15/211,213-214 
Eagle Pass,Texas, 23/73; Al/44-45 
Earth pit storage tanks, 22/12,32, 35 
Earthquakes 
accidents, A15/6-8 
characterization, A15/5-6 
damage from, A15/8—9 
designing for, A15/12-14,17 
geophysics, A15/2-4 
ground motion, A15/9—11 
nuclear installations and, A15/17—18 
process plants and, A15/18—21 
references on, A15/2 
seismicity assessment and predicting, 
A15/15—17 

soil structure, A15/11-12 
East St. Louis, Illinois, 23/73; Al/40 
Economic issues. See Costs 
Eddy crosswind diffusivity, 15/184 
Eddy current testing, 19/28 
Eddy dissipation rate, 15/96 
Eddy viscosity, 15/78-79 
Edison Electric Institute-Tennessee 
Valley Authority (EEI-TVA), 12/94 
Education 

for engineers, 27/24-28 


training versus, 14/36 
Edwards Committee on Air Transport, 
4/13 

Edwards-Lawrence index, 32/11—12 
Effluents 

gaseous, 10/28; All/17-18 
liquid, 10/27-28; All/18-20 
plant layout and, 10/9,27-28 
solid wastes, 10/28; All/20-22 
Eidsvik model, 15/202,250 
Eisenberg-Lynch-Breeding model, 
16/174-175, 248, 249 
Ejection of fittings, 17/201-202 
EJETcomputer code, 15/265 
Ekman spiral, 15/77-78 
Elasticity, steel and, 12/8-9 
Electrical equipment 
fire and, 16/128-135 
isolation of, 21/9-10 
Electrical Equipment Certification 

Service (EECS), 16/129,131; A29/2; 
A29/3 

publications of, A28/37 
Electrical fires, 16/278 
Electrical hazards, in laboratories, A9/5 
Electrical Research Association (ERA), 
16/129 

publications of, A28/37 
Electrical resistance welding, 12/18 
Electrical surface heating (ESH), 
16/134-135 
Electricity 

See also Static electricity 
failure of, A14/32-33 
hazards, 25/26 
for heating, 11/37 
offshore, A18/5 
standards and codes, 11/36 
uninterrupted power supplies, 
11/36-37 

Electric Power Research Institute 
(EPRI), A20/4; A29/7 
expert judgment, 9/46 
Elevated flares, 12/68 
El Paso Columbia, 23/77 
El Paso Paul Kayser, 23/77 
EMBASE, 29/3 

Emergency control buildings, 10/31 
Emergency core cooling systems (ECCSs), 
phased mission systems, 9/29 
Emergency depressurization (EDP), 
13/36,66-67 

Emergency exposure limits, 18/26—27 
Emergency isolation valves (EIVs), 10/14; 

12/28-30; 30/50-52; A14/22 
Emergency management computation 
system (EMCS), 24/6-7 
Emergency operation manager (EOM), 
24/10 

Emergency operations center (EOC), 24/6 
Emergency planning, 1/9; 4/28-29; 8/74 
accidents, 24/13-14 
chlorine and, 9/93-94,99-100,101 
communication and, 24/7,10 
components, 24/3 
declaring, 24/10 
developing plans, 24/8—9 


drills, 24/11 

for laboratories, A9/9-10 
marine, 23/69,71 
nuclear, A20/8 
offshore, A18/7 
off-site, 24/11-12 
on-site, 24/3-5 

personnel for and their roles, 24/9—10 
plant layout and, 10/10 
public relations, 24/11 
recovery, 24/14 
references on, 24/2-3 
regulations/organizations/standards, 
24/8,15-20 

resources, 24/5-8,15-20 
spectators, handling, 24/13 
training, 24/9 

in transportation, 23/69,71; 24/12-13 
in warehouses, 22/69 
Emergency Planning and Community 
Right-to-KnowAct (EPCRA) (1986), 
2/7; 4/31; 24/15 

Emergency procedures, plan for, 20/6—8 
Emergency Response Commission (ERC), 
4/31 

Emergency Response Planning 
Guidelines (ERPGs), 8/24-26 
Emergency response simulation, 29/5 
Emergency shut-downs (ESDs), 11/21,23; 
13/17 

See also Safety instrumented systems 
actions taken by, 13/66; 34/32 
design of, 13/65,66; 34/31,32 
display of operation status, 13/66 
documentation of, 13/66; 34/33 
failure of, A14/31-32 
gas terminal application, 13/66; 34/33 
initiation of, 13/66; 34/31-32 
maintenance and testing of, 13/66; 34/33 
offshore, A18/5-6 
operation of, 34/32 
Piper Alpha illustration, 13/67; 34/33 
planning for, 20/10-11 
programmable logic controls (PLCs), 
13/14,47-48 

vessel blowdown, 15/42—45 
Emergency shut-down valves, (ESVs), 
13/66,67 

Emergency stand-by systems, task 
analysis and, 14/30,32, 34 
Emerson model, 15/265 
Emissions 
causes for, 15/2 
controls on, 1/2-3 
critical flow, 15/9 

depressurization of vessels, 15/33-39 
elementary equations, 15/3,5—6 
friction factor and fittings loss, 15/8—9 
fugitive, 15/318-323 
gas and vapor discharge, 15/10—11 
liquid discharge rates, 15/7—8 
liquid or incompressible fluid 
discharge, 15/6-7 
models, 15/14; A7/31 
references on, 15/2 
situations, examples of, 15/3,4, 5 
temperature effects, 15/11 
two-phase flow, 15/14-26 
two-phase flow, Fauske models, 
15/26-30 
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two-phase flow, Leung models, 
15/30-33 

vessel discharge, gas flow through 
pipe, 15/11-12 

vessel discharge, liquid discharge time, 
15/12-14 

Empirical model, Fauske, 15/26-27 
Employee feedback, hazard identification 
from, 8/70,73 

Employment Medical Advisory Service 
Act (1972), 25/7 
EMYCIN, 30/38,40 
Energy 

chemical, 17/21-25 
explosion, 17/21-30 
gas expansion, 17/25 
liquid expansion, 17/25 
plume, 15/266, 268 
vessel burst, 17/25-27 
Energy control strategies to prevent 
accidents, 2/3,4 

Energy factor, scale of hazard and, 
2/12-13 

Energy Resources Co. (ERCO), 15/203 
Engineering design, 30/43-44 
Engineering Equipment and Materials 
Users Association, A28/38; A29/3 
Engineering Equipment Manufacturers 
and Users Association (EEMUA), 
A29/3 

publications of, A28/37-38 
Safety-related Instrument Systems for 
Process Industries guidelines, 
13/60—62 

Engineering line diagrams, 11/4,6—7 
Engines, as ignition source, 16/63 
Engulfing flames 
heat absorbed, 16/223-225 
jet flame attack, 16/233,235 
studies, 16/223, 225-226 
vessels filled with gas, 16/226 
vessels partly filled with liquid, 
16/226-233 
Entrainment 
See also Air entrainment 
plume, 14/268-269 
Environmental issues, 1/2—3,13 
accidents, All/15-26 
chemicals, hazardous, All/13 
chemicals, loading and transporting, 
All/14-15 

conflicts, areas of, AU/6-7 
costs and, All/13 
flares and, 12/72 

fugitive emissions, All/6,10, 22-23 
gaseous effluents, All/17-18 
hazard assessment, All/6,11-12 
impact assessment, All/6,10,12-13 
laws/regulations, 3/4; All/7-10 
liquid effluents, All/18-20 
management, All/10—11 
marine pollution, All/25 
odors, All/23-24 
references on, All/2-6,7 
responsibilities, common, All/2,6 
spills, All/24-25 
U.S. laws on, 3/4 
waste minimization, All/15—17 
wastes, hazardous, All/20-22, 24 
Environmental Incidents Data Service 


(EnvIDAS), 27/19; All/25 
Environmental Pollution Control Act 
(EPCA) (1970), 3/4 

Environmental Protection Act (1990), 
All/8 

Environmental Protection Agency (EPA), 
1/4 

Accidental Release Information 
Program (ARIP), 2/9-10; 
A33/2-3 

accident classification by, 2/5,7—11 
address/website for, A29/7 
emergency planning, 24/15 
formation of, 3/3,4 
fugitive emissions, 15/319 
General Duty Clause, 1/5 
publications of, A28/39 
references on, 3/2 

relief valve screening model, 15/265 
Risk Management Program (RMP), 
2/8-9; 6/15-16; A32/2-3, A33/2 
role of, 21/2; 33/7; Al/2; A33/3 
Technical Options Analysis (TOA), 
32/21 

toxic chemicals, 18/15,17 
Users Guide to Federal Accidental 
Release Databases, 2/5 
Environment impact statements (EISs), 
requirements, 3/4 

Epstein-Swift-Fauske model, 17/77-78 
Equal likelihood, 7/7 
Equilibrium rate model (ERM) 

Fauske, 15/29-30 
venting reactors, 17/100,101 
Equipment 

See also Unit equipment and operation 
checks, 8/73 
deteriorated, 21/38-39 
fire damaged, 21/38-39 
guards on, 25/25 
hazards, 25/24-26,27 
inadvertent starts, 25/25-26 
labeling, 20/20; 21/6 
in laboratories, A9/6 
maintenance of, 21/21-25, 36-37 
minimizing, 32/6—7 
modifications, 21/44-47 
monitoring, 19/32-34 
plant layout and, 10/12-13 
removal of, 21/38 
running nips, 25/25 
static electricity and moving, 16/121 
supports, 21/37-38 
Equipment failures 
analysis of, 9/47 
costs and, 5/4 

Equivalent discrete failures (EDFs), 
104-105 

Erosion, 12/85-86 
Error function (erf), 7/18-19 
Error propagation, process design and, 
11/4 

Error rates, software, 13/56 
Escape, 9/66 
ESCORT, 30/93,98 

Esso, Matagordo Bay,Texas field trials, 
15/204 

Estimated maximum loss (EML), 5/8,11, 
12,15,17 


Ethylene dichloride 
hazards of, 11/48-49 
references on, 11/42 
storage of, 22/54 
Ethylene oxide 
explosion, example of, 27/11 
hazards of, 11/49-50 
protective system for, 1/4; 11/26; 13/31, 
33 

references on, 11/42-43 
storage of, 22/54 

Ethylene plants, growth and major 
concerns for, 1/5—8 
Eulerian turbulence, 15/96 
EURISKO, 30/29 

European Chemical Industry Council 
(CEFIC), 23/5; A29/9 
TREMCARD, 23/12 
European Community (EC) 

classification, packaging, and labeling, 
23/9 

dependent failures and study by, 9/40 
Directive on Control of Industrial Major 
Accident Hazards, 1/5 
environmental issues, All/9 
list of organizations in, A29/9-11 
Plate Inspection Steering Committee 
(PISC), 12/92 

process hazard control and, 4/30—31 
toxic chemicals and, 18/14—15 
European Core Inventory of Existing 
Substances (ECOIN), 18/14 
European Industry Reliability Data Bank 
(EIReDA), A14/13 
European Inventory of Existing 

Commercial Chemical Substances 
(EINECS), 18/14; 29/3 
European Process Safety Centre (EPSC), 
1/13; A29/9 

European Reliability Data System 
(ERDS), A14/12 

European Road Carriage Agreement, 
23/8,9,10,11 
Evacuation, 9/66 
offshore, A18/6 
Evaluation function, 30/20 
Event(s) 

frequency of, in trip systems, 13/37 
modeling and filtering of human, 14/76 
operator action event trees (OAETs), 
9/51; 14/74,76 
rare, 9/47-49; A23/4 
Rasmussen Report and, 9/11; 

A14/9-10; A23/2,4,5,6-7 
rates and uncertainty, 9/79,81 
response and recovery, 14/74 
space method, 7/22-23 
trees, 8/26-27, 29; 9/8,12, 

30-31,51,81; 14/74,76; 31/19-20; 
A23/5,6—7 

Event and failure data, 9/11-12 
for aircraft accidents, A14/38 
collecting, A14/5 
for computers, A14/26 
databases, A14/7-13 
definitions, A14/4 
for emergency shut-down systems, 
A14/31—32 

for explosions, A14/37-38 
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factors influencing, A14/4-5 
for fire, A14/37 

for fire and gas detection systems, 
A14/27—31 

for heat exchangers, A14/16-19 
for ignition, A14/35-37 
for instruments, A14/22-26 
inventories, A14/13-14 
for leaks, A14/33-35 
for LNG plants, A14/23 
offshore, A18/8 
for pipework, A14/15—16 
for pressure vessels and tanks, 
A14/14—15 
processing, A14/6-7 
references on, A14/2—4 
for relief systems, A14/26-27 
sources of, A14/5—6 
status of, A14/6 
for transportation, A14/38 
types of, A14/4 
uncertainty of, A14/7 
for utility systems, A14/32-33 
for valves, A14/19-22 
Excess flow valves (EFVs), 12/28 
Exotherm test, 33/17,23-24 
Expansion Joint Manufacturers 
Association (EJMA), 12/24, 26 
Expansions, plant, 21/50-51 
Expected value, 7/12 
EXPERT, 30/41,98 
Expert Commission for Safety in the 
Swiss Chemical Industry, 
16/127-128 
Expert judgments 
applications, 9/41,46-47, 58-59 
bias and, 9/42 
Delphi method, 9/43 
elicitation methods and planning, 
9/42-43 

failure rates, 9/47 
Hunn’s method, 9/45-46 
interviews, conducting, 9/43 
paired comparisons, 9/44-46 
problem solving and, 9/41-42 
problems with, A26/4-6 
question formulation, 9/42 
ranking and scaling, 9/43-44 
responses, analysis of, 9/43 
Saaty’s method, 9/44-45 
uncertainty, 9/82 
Experts, selection of, 9/42 

See also Artificial intelligence (AI) 
applications, 30/35 
architecture and facilities, 30/35 
blackboard, 30/35 
certainty theory, 30/11-12 
development of, 30/35, 36 
engineering design, 30/44 
evaluation of, 30/37-38 
explanation facility, 30/36 
heuristics, 30/13 
inference engine, 30/35 
knowledge acquisition and elicitation, 
30/36-37 

knowledge representation, 30/6-7 
management and organization, 
30/34-35 

qualitative modeling, 30/41-43 
references on, 30/2-6,34 


tools, 30/38-41 
EXPERTEASE, 30/41,52 
Explosion Incidents Data Service 
(EIDAS), 27/19 
Explosions 

See also Deflagration; Detonation; Dust 
explosions; Static electricity; 
Vapor cloud explosions 
aerosols, 17/175 
barricades, 17/213-214 
blast walls, A18/6 
boiling liquid expanding vapor, 
17/167-174 

in buildings, 17/46-48,87-90 
chemical property and reaction, 8/12 
classification of, 17/6 
compressed air, 17/175-176 
condensed phase, 17/122-128, 

221-223 
energy, 17/21-30 
fire and, 2/16,19,21 
flares and, 12/70 

fragments (cased explosives) from, 
17/216-221 
furnace, A14/37 
ground level, 17/28-29 
investigating, 27/12-14 
in laboratories, A9/9 
in large enclosures, 17/48-49,90-94 
models, 17/88-89 
models, simulation, 17/48-49,94 
molten metal-water, 17/176 
offshore, A18/6 
probability of, 16/148,149,150 
process, 17/5 

quantity-distance relations, 17/20 
references on, 17/2-5 
scaling laws, 17/19,65, 270 
shocks, 17/119-122 
structural damage from, 17/19-20 
studies, 17/87-88,90-92 
superheated liquid, 17/172-173,175, 
176-177 

thermal explosion theory, 16/31-32,78 
thermodynamic availability, 17/29—30 
vessel burst, 17/128-133 
in vessels, closed, 17/36-46 
Explosions, damage from 
blast/structural, 17/179,181-196 
injuries, 17/181 
missiles, 17/179,196-216 
references on, 17/177-179 
shocks, 17/119-122,180 
thermal effects, 17/179—180 
types of, 17/177,179-181 
Explosions, injuries from 
distribution of injuries, 17/231-232 
eardrum rupture, 17/224 
from flying glass, 17/233-243 
lung injuries, 17/224-226 
models, 17/232-233 
from penetrating fragments, 
17/243-249 

to people indoors, 17/230-233 
to people outdoors, 17/223-230 
relationship of structural damage to, 
17/230-231 

whole body displacement, 

17/226-229 
Explosions, preventing 
atmosphere control, 17/49, 51-52 
automatic explosion suppression, 17/59 


automatic isolation, 17/58-59 
flame arresters, 17/52-58 
references on, 17/49-51 
relief and venting, 17/60 
Explosions, venting 
design issues, 17/80-81, 280 
of ducts and pipes, 17/79-87, 280-281 
elongated vessels, 17/78 
factors influencing, 17/60 
HSE, 17/82-84 

models, 17/63-67,73-78,84-85 
NFPA, 17/85-87 
oscillatory behavior, 17/61-62 
outflow equations, 17/67,72 
phases of, 17/60-61 
reaction force due to, 17/79 
references on, 17/60 
storage vessels, 17/107-108,118-119 
studies, 17/60,61,82 
venting ratio and coefficient, 17/62—63, 
65-66, 270-271 
in vessels, 17/60-81,269 
Explosions, venting dust 
design issues, 17/280 
of ducts and pipes, 17/280-281 
factors influencing dust, 17/269-270 
models, 17/271-280 
references on, 17/268 
scaling laws, 17/270 
studies, 17/270 
venting ratio and coefficient, 
17/270-271 

Explosions, venting reactors 
all liquid venting, 17/96,107,108 
all vapor venting, 17/95-96,107,108 
bench-scale equipment, 17/98-99, 
104-105 

catchtanks/knockout drums, 
17/114-116 
CCPS, 17/117-118 
containment, 17/97 

DIERS project, 17/97-99,100,101,102 
disposing of vented materials, 
17/111-117 

Factory Insurance Association method, 
17/94-95 

flow, estimating, 17/108 
gassy systems, 17/101,103-104, 111 
homogeneous, 17/107-108 
Imperial Chemical Industries (ICI), 
17/97,108-111 

instrumentation systems for, 17/97 
Leung model, 17/106-108 
models, 17/96-97 
Monsanto correlation, 17/95 
parameters, 17/97 
quenching, 17/117 
set pressure, 17/108 
sizing methods, 17/108,110, 

112-113 

source terms, 17/97 
two-phase relief flows, 17/114 
type of fluid and method of, 17/95 
vapor pressure systems, 17/100-101, 
102-103,108,110-111 
vent flow, 17/100-101 
vent size, 17/102-106 
Explosive-resistant structures, plant 
layout and, 10/29 
Explosives 

ACDS report on transporting, 

A17/12—14 
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controls on, 17/21 
fireballs from, 16/188-190 
references on, 17/18-19 
Explosive Storage and Transport 

Committee (ESTC), 17/191,193,194 
Explosives Transportation Acts (1908, 
1909,1921), 3/5 

Exponential distribution, 7/10—11,15—16, 
52 

Exposure 

plant layout and limitation to, 10/8 
process design and limitation to, 11/21, 
23 

Exposure factor, scale of hazard and, 
2/13-14 

Exposure modification, 9/64 
escape, 9/66 
evacuation, 9/66 
human response times, 9/65 
incident control, 9/67 
External corrosion, 12/42,86 
EXTRAN, 30/31,41,52 
Extreme value distribution, 7/18 
Exxon Valdez, 5/10; 23/76; All/26 


Factories, plant layout, 10/3—4 
Factories Act (1961), 16/128; 19/18; 21/14, 
25; 25/30 

Factory Insurance Association, 2/16,20, 
21; A29/7 

venting reactors, 17/94-95 
Factory Mutual Chemical Occupancy 
Classification guide, 8/13 
Factory Mutual Engineering Corp. 
(FMEC), 16/2; 22/18 

Factory Mutual Insurance Corp., 5/17-18 
Factory Mutual Research Corp. (FMRC), 
15/286; 17/149; A29/7 
publications of, A28/39 
FACTS. See Failure and Accident 
Technical Information System 
Fail-safe design, 11/21 
Failure 

See also Event and failure data 
assessment diagram (FAD), 12/90-91 
behavior, 7/45-47 
burn-in, 7/46-47 
of bursting discs, 12/65 
catastrophic versus tolerance, 7/45 
corrosion, 12/81,83 
density and distribution functions, 
7/10,45 

dependent, 9/16-17,32-41 
distributions, 7/12-19 
early, 7/46 
faults versus, 9/12 
fractional dead time, 13/25-26 
instrument, 13/17-24 
mechanical, 12/79 
of pipes, 12/95-100 
of pressure relief valves, 12/64 
in pressure systems, 12/79—87 
of pressure vessels, equipment, and 
machinery, 12/92-104 
regimes, 7/63 
software, 13/56 
wearout, 7/45-46 


Failure and Accident Technical 

Information System (FACTS), 27/19; 
29/3; A14/12—13 
Failure data analysis 

See also Event and failure data 
advantages/disadvantages of, 7/59 
censored, 7/55 

confidence limits and mean life, 
7/48-50 

exponential distribution, 7/10-11, 
15-16,52 

fundamentals of, 7/47—48 
generation of distributions, 7/58 
graphing, 7/50—51 
need for, 7/47 

normal distribution, 7/16-17,52,54 
observation window, 7/55 
parameter estimation methods, 
7/55-58 

proportional hazards modeling, 7/58 
ranking, 7/51 
repair times, 7/59 
sources for, 7/47 
time-varying, 7/58-59 
types of failure, 7/47 
Weibull distribution, 7/17,54-55 
Failure models 
bathtub curve, 7/44 
Carter’s rough loading model, 7/43 
deterministic approach, 7/41-42 
Drenick’s theorem, 7/44—45 
interference theory, 7/42-43 
lightbulb curve, 7/44 
probabilistic approach, 7/42 
safety factor and margin, 7/41 
Failure modes, effects analysis (FMEA), 
8/27,51-53; 31/25 

Failure modes, effects and criticality 
analysis (FMECA), 8/27,8/51-53 
Failure rates 

individual modes and, 7/48 
instrument, 13/17-18,19 
unreliability and, 7/11 
Failure-terminated test, 7/48 
Fairweather-Vasey model, 17/43—44 
FALCON, 30/98 

Fanning friction factor and fittings loss, 
15/8-9 

Fans, A14/16,33 
Farmer curve, 9/74,86-87 
Fatal accident frequency rate (FAFR), 9/6 
Fatal accident rates (FAR)/statistics, 1/4; 
2/11,12-13; 5/2 
Canvey Reports, A7/22-24 
by country, 2/13 
by industry, 2/12 
presenting, 9/71—77 
in road transportation, 23/20,21-22, 

use of, 9/6,71 

Fatal Assessment and Control Evaluation 
(FACE), A33/3-4 
Fatigue 

crack growth, 12/90 
mechanical, 12/80 
steel and, 12/10-12 
thermal, 12/80 
Fauld, UK, Al/28 
Fault(s) 


administration, 30/93-100 
correction and shut-down, 14/17-18 
detection, 14/16-17 
diagnosis, 14/17,37-38 
failure versus, 9/12 
human error and fault administration, 
14/16-18 

occurrence versus existence, 9/13 
propagation, 30/41—42,58,59-63 
software, 13/56 

symptom matrix (FSM), 14/37,41-42; 
30/100 

-tolerant instrumentation, 13/24 
FAULTFINDER, 30/79-81,82-86 
Fault trees (logic trees), 27/4 
accident model, 2/3,4 
analysis, 8/26-27, 29; 9/12; 29/3; 
30/76-79 

basic concepts, 9/12-13 
coherency, 9/20-21 
common mode failure, 9/16,32 
computer codes, 30/77,79 
constructing, 9/16 
dependent failures, 9/16-17, 32-41 
digraphs, 9/21 

elements and symbols, 9/13—15 
evaluation, 9/21-22 
events, 9/13-14,22 
FAULTFINDER, 30/79-81,82-86 
gate-by-gate method, 9/22 
human error assessment, 14/57 
logic gates, 9/14-16 
minimum cut sets, 9/17-18, 20, 21-22 
Monte Carlo simulation, 9/22 
phased mission systems, 9/29 
protective systems, 9/29—30 
Rasmussen Report and, A23/4 
references on, 9/12,30 
repairable systems, 9/28 
uncertainty, 9/79-81 
Fault trees, examples 
air receiver systems, 9/17,18-17 
crystallization plant systems, 9/26—28 
pressure tank systems, 9/22—26 
pump set systems, 9/28-29 
Fauske-Epstein model, two-phase jet, 
15/154-155 

Fauske models. See Two-phase flow, 
Fauske models 

Fauske nomograph, 17/102,104 
Fay-Lewis model, 16/184 
Fay-Ranck model, 15/202 
Federal Aviation Act (1958), 3/5 
Federal Aviation Agency (FAA), 23/6 
Federal Emergency Management Agency 
(FEMA), 29/4; A29/7 
Federal Power Commission (FPC), 23/40; 
A29/7 

Federal Railroad Administration (FRA), 
23/6 

Feedforward control, 13/3-4 
FEM3 model, 15/167,182, 200, 241, 250 
Fences, dispersion and, 15/241—243 
FENCE62,15/307-308 
Ferritic stainless steel, 12/14 
Fertilizer Manufacturers Association 
(FMA), ammonium nitrate 
guidelines, 9/92,98 
Feyzin, France, 22/71; Al/33 
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Fiber-reinforced plastic (GRP), pressure 
vessel design and, 12/17,22,27 
Field trials, dense gas dispersion, 
15/204-223 

Filling ratios, 22/61; 23/14,16 
Film forming fluoroprotein foam (FFFP), 
16/270 

Filtering, 8/29,47,62 
Finland Accident Investigation Board 
(FAIB), A33/4 

Fire 

alarms/detection systems, 16/254—255 
in buildings, 16/283-290 
in the chemical and related industries, 
2/16-17,20,21 
classification of, 16/13-14 
combustion process, 16/2,12-13,26-53 
damage from, 16/235-239 
duct and cable, 16/157-158 
dust, 17/286-288 
electrical equipment, 16/128-135 
electricity, static, 16/82-128 
explosion and, 2/16,19 
extinguishers, 16/277 
flammability of gas and vapor, 
16/14-26 

flange, 16/154-155 
growth and spread, 16/13 
hazard assessment of, 16/291-295 
hazardous area classification, 
16/135-146 

ignition sources, 16/56—66,147 
ignition systems, 16/146—154 
injuries from, 16/239-252 
insurance in the U.K., 5/9,17 
investigation of, 27/11-12 
on jetties, 23/51-52 
lagging, 16/156 
load, 16/283 

marine, 16/290-291; 23/52-57 
models, 16/286-289; A7/32 
organizations/institutions for, 16/2 
plant layout and containment and 

protection of, 10/5,8-9, 24-27,29 
point, 16/20,235 
pool, 16/190-207 
probability of, 16/147-148 
in process plants, 16/154-159, 
279-283; A14/37 
projection, 16/288 
pump, 16/154; A14/37 
radiant heat transfer, 16/160-172 
rail transportation and, 23/35 
references on, 16/2,3-12 
road transportation and, 23/22,24-25 
self-heating (spontaneous combustion), 
16/66-82 

spread, limiting, 16/256-257 
spread, methods of, 16/285-286 
spread, models, 16/288 
storage tank, 16/158-159, 278-279; 
A14/37 

time-temperature curves, 16/283-284 
vapor cloud, 16/172-176 
Fire, Explosion and Toxicity Index, Mond. 
See Mond Fire, Explosion and 
Toxicity Index 

Fire and Explosion Index (F&EI). See 
Dow Fire and Explosion Index 
(F&EI), 


Fireballs 

accidents, 16/176; 17/170 
CCPS, 16/187-188 
development and timescales, 
16/178-179 

diameters and duration of, 16/179-180 
explosives and, 16/188-190 
features, 16/177 
hazards of, 16/293 
heat radiated from, 16/180-181 
mass of fuel, 16/178 
models, 16/177-178,182-187 
pipeline, 16/188 
point source model, 16/182 
scenarios for, 16/178,181 
solid flame model, 16/182 
studies, 16/176-177 
temperature, 16/189-190 
view factor, 16/181-182 
Fire fighting accidents, Al/7 
Fired heaters 
hazards of, 12/34-36 
operation of, 20/13 
references on, 12/34,35 
standards for, 12/34 
Firefighters, hazards to, 16/282-283 
Firefighting agents, 16/261-263 
Fire insulation, 12/43, 52; 16/257-260 
Fire losses 

references on, 2/15,16-17 
statistics on, 1/2; 2/15-16; 5/2-3 
Firemaster, 23/73 

Fire Offices Committee, 5/17; A29/3 
Fire Precautions Act (1971), 22/66 
Fire protection 
active, 16/253-254 

alarms/detection systems, 16/254—255 
applications, 16/277-279 
construction materials and, 16/289 
dry chemicals, 16/272-273 
extinguishers, 16/277, 289-290 
failure of, A14/27-31 
fire insulation, 12/43, 52; 16/257-260 
foam, use of, 16/269-272 
inert gas, 16/276 
in laboratories, A9/9 
for LNG, 22/37 

at loading and unloading facilities, 
22/64 

for LPG, 22/30-32,35 
offshore, A18/5 

passive, 16/252-253, 255-261 
pipework and fittings, 22/20 
resistant coatings, 16/260-261 
resistant valves, 16/261 
special methods, 16/276-277 
for steelwork, 16/261 
storage tanks and, 22/19-20 
in transportation industry, 

16/290-291 

vaporizing liquids, 16/273-276 
walls, 22/22-23 
in warehouses, 22/69 
water, use of, 16/263-269, 282 
Fire Protection Association (FPA), 2/15, 
16-17; 5/3,17; 16/2 
address/website for, A29/3 
publications of, A28/39-41 
Fire relief 

atmospheric storage tanks and, 12/53 
heating of unwetted surfaces, 12/53 


inventory reduction, 12/52 
in pressure vessels containing liquid, 
12/52 

in pressure vessels not containing 
liquid, 12/52-53 
protection measures, 12/52 
scenarios for, 12/51—52 
standards, 12/53 

Fire Research Station (FRS), 16/2; 17/254; 
A29/3 

publications of, A28/41-42 
First aid, 25/33-34 

First order predicate logic (FPOL), 30/7, 
9-10 

Fisons Ltd., A7/6 
Fittings loss, 15/8-9 
FLACS model, 17/48,49 
Flame(s) 

behavior of, 16/159-160 
cool, 16/49-50 
diffusion, 16/28, 29-30 
dust ignition and, 17/260 
emissivity, 16/164-167 
engulfing, 16/223-235 
hydrocarbon, 16/167 
as ignition source, 16/58 
jet, 16/214-223 
pool fire, 16/194-199 
premixed, 16/28-29 
propagation, 16/26, 28 
spread of, 16/238-239 
stretch and wrinkling, 16/30-31 
torch and jet ignition, 16/43 
Flame arresters 
applications and requirements, 
17/55-56 

combustion modes, 17/52 
conservation vents, 17/54 
critical flame speed, 17/54—55 
design of, 17/58 

environmental differences, 17/57 
HSE guide, 17/56-57 
hydraulic, 17/54 
instrumentation, 17/58 
maintenance of, 17/58 
minimum effective safe gap, 17/55 
references on, 17/52 
standards, 17/57-58 
storage and, 22/16-19 
testing, 17/57 
types of, 17/52-54 
velocity flame stoppers, 17/54 
Flammability, 8/12 
adiabatic flame temperature, 
16/21-23,24 
of aerosols, 16/53-56 
burning velocity, 16/20-21, 22, 

45-47, 56 
degrees of, 16/23 
flashpoint, 16/20 

of gas and vapor, 16/14-26,60-62 
ignition energy, 16/20, 21, 38, 54,56 
ignition process, 16/35—45 
ignition temperature, 16/17,19,35 
ignition time delay, 16/19-20, 35-36 
limits, 16/14,16-19,32-35, 54 
in oxygen, 16/25 
of powders and dusts, 16/62 
quenching distances, 16/23—25, 

47-49 

references on, 16/14—16 
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le fluids 
sampling, 20/19 
separation distances, 22/14-15 
welding and, 21/29 
Flammable gas clouds 
buoyant plume, 15/283-284 
cloud size comparisons, 15/284-286 
cloud size estimations, 15/286 

continuous source, 15/281 
instantaneous source, 15/279-281 
momentum jet, 15/281-283 
Flammable substances 

: ined spaces, 21/13 
' s, A9/4 
Flamm-Mache model, 17/40 
Flanged joints, 21/25-27 
Flange fires, 16/154-155 
Flare(s) 

collection system, 12/68,70 
combinations of, 12/72 

designing, 30/52-55 
elevated, 12/68 
environmental issues, 12/72 


ground, 12/67-68 
hazards of, 12/68 
heat radiation, 12/71 
liquid carryover in, 12/71-72 
low pressure, 12/68 
models, 16/208-214 
molecular seals, 12/71 
obstructions, 12/70 
references on, 12/67 
seal drums, 12/70 
stack design, 12/59,70 
studies, 16/207-208 
toxics in, 12/72 
Flashback 
arresters, 12/71 

premixed flames and, 16/28-29 
Flashing flow, two-phase, 15/22 
Flashover, 16/286, 287-288 
Flashpoint, 16/20,235 
Flixborough, 1/2, 5; 6/2 
bellows, 12/26 
communication errors, 14/51 
company, A2/2 
control building, 10/29 
costs and insurance issues, 5/3 
description of, 27/9; A2/2-18 
events prior to explosion, A2/3—5 
hazard control issues, 4/15,16,17 
inventory limitations, need for, 
11/13-14 

investigation of, A2/7-12 
investigation of, criticism of, A2/17—18 
laws and, 3/5 

lessons learned from, A2/13-17 
management, A2/3 
nitrogen levels, 11/39 
pipework, 12/22; 14/49 
plant process, A2/3 
references on, A2/2 
trip system, 20/20 
zinc embrittlement, 12/85 
Flock-Marvin model, 17/40 
Floreffe, Pennsylvania, 22/71; Al/57 
Flow deviations, 11/63 


Flow diagrams, use of, 11/4,5 
Flowsheeting methods, 7/35 
Fluid buoyancy, 15/72,73 
Fluidized bed dryers, 17/285 
Fluorochemical foam, 16/270 
Fluoroprotein foam, 16/270 
Flux-gradient relations, 15/92-94; 17/164 
Flying glass. See Glass, injuries from 
flying 

Foam, 15/306-307 
applying, 16/271 
fires and use of, 16/269-272 
fixed systems, 16/271-272 
hazards when using, 16/271 
mobile systems, 16/272 
properties, 16/270-271 
standards, 16/269 
static electricity and, 16/271 
tests for, 16/271 
types of, 16/269-270 
vapor suppression, 16/272 
Fog nozzles, 16/282 

Food, Drug and Cosmetic Act (1958), 18/16 
Food and Drug Administration (FDA), 
3/3; 18/16 

Force balance equation, 15/78 

Formaldehyde, 18/4,24 

Fort McMurray, Avaporerta, Al/54 

Forward chaining, 30/22 

Fouling, heat exchangers and, 12/32-33 

Foulkes planner, 30/90 

Foyoh Maru, 23/73 

Fractional dead time (FDT), 13/25-26; 
34/21-22 

Fracture mechanics 
analysis diagram (FAD), 12/91 
assessment diagram, 12/90-91 
crack behavior, 12/87 
crack growth, 12/90 
crack length models, 12/89 
crack opening displacement (COD), 
12/89-90 

design implications, 12/92 
Dugdale model of crack tip plasticity, 
12/89 

geometric factor, 12/88 
Griffith crack model, 12/87-88 
Irwin model of crack tip plasticity, 
12/89 

leak-before-break behavior, 12/91—92 
linear elastic, 12/89 
loading and, 12/87 
plastic deformation, 12/89 
probabilistic, 12/92 
references on, 12/87 
stored energy, 12/87 
stress intensity factor, 12/88 
toughness, 12/89,91 
Westergaard stress function, 12/88 
Fragments, injuries from penetrating, 
17/243-249 

See also Glass, injuries from flying 
Fragments (cased explosives) from 
explosions, 17/216-221 
Fragola, J. R„ 14/74,76-80,81,82 
Frames, 30/19 
France 

list or organizations in, A29/9 
process hazard control and, 4/30—31 


Frankfurt, Germany, A20/10 
Freon 12 field trials, Directorate General 
of Labor (DGL), Netherlands, 15/205, 
206, 209 

Frequency estimation, event data and, 9/11 
Frequency-loss plot (profile), 5/11-12 
Frequency numbers. See Risk criteria 
Friction factor 

emissions, fittings loss, and, 15/8—9 
two-phase flow and, 15/15, 20-21,22 
Friction ignition, 16/40-43,58,60 
dust ignition and, 17/262 
Friction velocity, 15/79 
Froude number, 15/101, 225, 257 
FTS, 30/77 
Fuel gas or oil, 11/37 
Fugitive emissions, 15/318; All/22-23 
control of, 15/323 
costs of, 15/323 
factors, 15/320-321 
losses from storage tanks, 15/321-323 
measuring, 15/319-320 
monitoring, 15/320 

regulations on, 15/319 
Function analysis system technique 
(FAST), 11/12 
Furnaces 

hazards of, 12/34-36 
plant layout and, 10/12 
references on, 12/34, 35 
standards for, 12/34 
Fusillo-Powers planner, 30/87-89 
Fusion welding, for pressure systems, 
12/17-18 

Fuzzy logic, 30/11,12,14 


Gadila, SS, field trials, 15/205-206, 
207-208 

Galvanic corrosion, 12/83 
Games 

artificial intelligence and, 30/22-23 
search, 30/21 
Gamma distribution, 7/18 
Gas 

See also Dispersion, dense gas; Inert 
gases 

dispersion of, 15/73-74; 17/111; A7/31 
dust and, 17/259, 265-266 
emissions/discharge of, 15/6-7,10-11, 
34-35; 17/111 
engines, 12/40 
expansion energy, 17/25 
explosions in buildings, 17/46—48 
flammability of, 16/14-26,60-62 
flow through pipe in vessels, 15/11—12 
jets and dispersion, 15/136—138 
jets and dispersion, sonic, 15/138-140 
measuring, 33/22 

missiles and fragmentation of vessels 
filled with, 17/199,200 
pipeline ruptures, 15/54 
storage tanks, 22/12 
tests, 21/14 

vessel burst energy and ideal, 17/25—27 
vessel burst energy and non-ideal, 17/27 
Gas clouds, flammable, 15/279-286 
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Gas clouds, toxic 

concentration intermittency, 15/287 
Davies model, 15/288-290 
Ride model, 15/287 
toxic load, 15/287 
Wilson model, 15/287-288 
Gas-cooled reactors, A20/5 
Gas Council, A28/42 
Gas cylinders, hazards of, 20/18 
Gas Employers Reinsurance Corp., 
publications of, A28/43-47 
Gaseous effluents, All/17-18 
plant layout and, 10/28 
Gas Fountain (GayLussac), 23/77 
Gaskets, 12/25 

Gas processing plants, references on, 
11/60 

Gas release, toxic 
control room for, 10/30—31 
detection of, 18/60 
plant layout and, 10/30-31 
Gas terminals, emergency shut-down 
systems for, 13/66-67; 34/33 
Gas toxicity 

animal experimentation, use of, 
18/28-29 

combustion, 18/58-59 
description of major toxic gases and 
effects, 18/27,36-41 
detection of, 18/60 

Green Book, 18/55 
HSE dangerous dose, 18/56-58 
inhalation rates, 18/33 
lethal concentration and load, 18/27-28 
MHAP studies, 18/41-42 
models, 18/32-33 
models, vulnerability, 18/34-36 
probit equations, 18/55-56 
references on, 18/33-34 
respiration process and, 18/29—32 
Gate-by-gate method, 9/22 
Gauss’ law, 16/86 

Gaz de France field trials, in Nantes, 
15/204-205 

Geismar, Louisiana, 22/71-72; Al/47 
General incident scenario (GIS), 8/57, 58 
General Problem Solver (GPS), 30/22, 23, 
26 

Gentile-Rogers-Mannan index, 32/15 
Geometric factor, 12/88 
Geometric method, 9/38 
Geostrophic wind, 15/77-78 
Germany 

fugitive emissions, 15/319 
list of organizations in, A29/9—10 
process hazard control and, 4/30 
Germeles-Drake model, 15/167-168,200, 
250 

Geyer-Bellamy model, 2/4,8 
Geysering, 12/31, 32 
Gibbs free energy, 33/13 
Gibson-Lloyd model, 16/103 
Gifford meandering plume model, 
15/273-274 

Gilbert-Lees-Scilly model, 16/190; 17/195, 
221, 242-243,245-249 
Glass, injuries from flying 
breaking pressure, 17/233, 236 


fragment characteristics, 17/236, 240 
injury effects data, 17/241-243 
models, 17/233 
range of fragments, 17/241 
spatial density of fragments, 17/241 
studies, 17/233 

velocity of fragments, 17/240-241 
Glass-reinforced plastic (GRP) 
pressure vessel design and, 12/17 
storage tanks, 22/12-13, 59-61 
Glendora, Mississippi, 23/73; Al/35 
Goal-directed activities (GDAs), 14/54, 55 
Goal-oriented failure analysis (GOFA), 
8/61 

Goal tree-success tree (GTST) method, 
30/99-100 
Golden Dolphin, 23/76 
Goldfish field trials, 15/214-215,220,221, 
315 

Good Hope, Louisiana, 23/74; Al/51 
GOTRES, 30/99 

Government Industry Data Exchange 
Program (GIDEP), A14/13 
Gradient transfer model, 15/100-101 
Grain elevators, 17/286 
Grandcamp, 23/76; Al/28-29 
Grangemouth, Scotland, Al/55-57 
Graphs, trees, and networks, use of, 30/7, 
31-34 

Gray body radiation, 16/162 
Greek letter method, multiple, 9/39 
Green Book, 16/244, 248; 17/229, 231, 242; 
18/55 

Griffith crack model, 12/87-88 
Grinding mills, 17/283 
Groningen FN, 9/87 
Ground flares, 12/67-68 
Grounding, preventing static electricity 
and, 16/124 

Ground level concentration, 15/151-152 
Ground slope dispersion, 15/231, 234,238 
Gugan model, 17/159 
Guidelines forTechnical Management of 
Chemical Process Safety (CCPS), 
6/16-19 

Gulf of Mexico Offshore Regulatory 
Administration, A18/4 
Gumbel distribution and paper, 9/48-49 
Gupta-Edwards index, 32/15,17 


HACKER, 30/29 
HagonFN, 9/87-88 
Hajeck-Ludwig model, 16/208 
Halifax, Nova Scotia, Al/25 
Halon, 16/273, 275 
Hamburg, Germany, Al/25-26 
Handover systems, 20/8; 21/5 
Hanford, Washington, A20/9 
Hanzevack method, 15/292 
Hardee-Lee model, 15/47-49; 16/183-184 
Hardening, steel, 12/15 
Harris model, 17/42,89 
Harris-Wickens model, 17/154-155 
Hartmann apparatus, 17/253,254, 
255-257 


Hawk field trials, 15/215,307,315 
Hawthorne-Weddell-Hottel model, 16/217 
Hazard(s) 

analysis (HAZAN), 9/2 
classification, 10/20-22, 23 
defined, 32/2 

factors that determine scale of, 

2/12-14 

of firefighting agents, 16/261-262, 271, 
274,276 

impact model, 9/98,100,102-104 
laboratory, A9/4-5 
maintenance, 21/5-6 
models, 9/56,62; 10/5, 22, 24; A7/7,10 
moderating, 32/8-9 
plant commissioning and, 19/13 
plant layout and, 10/11-12 
proportional hazards modeling, 7/58 
ranges for dispersion, 15/293-295 
rate and reliability, 7/10 
rates for nitrator units, 13/55 
rates for single-channel trip systems, 
13/36-37,38 

references on natural and man-made, 
2/11-12,15 

warning symbols/signs, 9/108-119; 
23/12 

Hazard and operability studies (HAZOP), 
8/27; 29/3 

activities studied by, 8/47,48-49 
application, 8/51 
batch plant example, 8/36-37,41 
check words, 8/50 

computer programs for, 8/27,45,54—55 
continuous plant example, 8/35—36 
control systems and, 8/38 
critical examination and, 8/38 
documentation for, 8/43—44 
effectiveness of, 8/45 
electrical systems and, 8/38,42 
filtering in, 8/47 
follow up for, 8/44 

guide words and example, 8/33, 35,42, 
46 

hybrid study, 8/38 
leader for, 8/44 
limitations of, 8/51 
origins of, 8/31 
parametric method, 8/35 
principles of, 8/31 
proprietary equipment example, 
8/37-38 

quality assurance and, 8/47,51 
sneak, 8/54 
stages, 8/35 
timing of, 8/43 
variants of, 8/51 
Hazard assessment 
See also Risk assessment 
cause-consequence diagrams, 9/31—32 
chlorine and, 18/66-75 
classification, 9/7 
computer aids, 9/119; 29/4-5 
condensed phase explosions and, 
17/292 

debate over effectiveness of, 9/120-122 
decay relations, 9/103,105,107-108, 
109 

dependent failures, 9/16-17, 32-41 
domino effects, 9/53-54 
dust explosions and, 17/288-293 
environmental, All/ll—12 
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event data, 9/11-12 
event trees, 9/8,12, 30-31 
examples, 9/6—7 
expert judgments, 9/41—47 
exposure modification, 9/64—67 
fault trees, 9/12-30 
of fires, 16/291-295 
guidelines, 9/92-98 
historical development, 9/5—6 
human error, 9/49-51 
ignition models and, 16/153-154 
injuries, 9/67-71 
in laboratories, A9/8-9 
management, role of, 9/51—52 
models, 9/52-53, 54-56,81-82,98, 
100,102-105 
nuclear, A20/6-7 
plant layout and, 10/5,22,24 
population characteristics, 9/56-59, 
62,64 

rare events and external threats, 
9/47-49 

references on, 9/2—5 
results, presenting, 9/71-77 
toxic chemicals and, 18/75-77 
transportation, 23/79-86 
uncertainty of findings, 9/77-82 
vapor cloud explosions and, 
17/292-293 

ventilation rates and, 15/304 
Hazard control 

See also Process hazard control 
monitoring, 4/4 
nuclear, 4/13-14 
policies, 4/13 
references on, 4/3,15 
risk, perception of, 4/4—9 
risk issues, 4/4 
risk management, 4/9—12 
technological problems, 4/2-4 
Hazard Evaluation Guidelines (CCPS), 
8/29-30, 51 

Hazard identification, 1/9 
aids, 30/58,63-76 
audits, management system, 8/5,11 
audits, plant safety, 8/70,71,72-73 
audits, safety, 8/2,4-5,6-10 
checklists, 8/11,73 
computer CHAZOP, 8/27,54-55 
computer programs for, 29/3 
consequence modeling, 8/27, 57 
employee feedback, 8/70,73 
enhancements, 30/67-76 
event and fault tree analysis, 8/26-27, 
29 

failure modes, effects and criticality 
analysis (FMECA), 8/27, 

8/51-53 

filtering, 8/29,47,62 
HAZID, 30/63,65-67,68,70-71 
HAZOP (hazard and operability 

studies), 8/27,31, 33,35-51; 29/3 
human error analysis, 8/27, 55 
impurities, 8/12—13 
indices, 5/12; 8/13-26 
information needed for, 30/71-76 
Material Safety Data Sheets (MSDS), 
4/32; 8/11-12 

materials properties, 8/11-13 
plants, pilot, 8/13 

preliminary hazard analysis (PHA), 
8/27, 29-30,34,57 


process safety review system, 8/27-28, 
57-62 

quality assurance and, 8/47,51,74-79 
ranking methods, 8/69-70 
references on, 8/2-4,11 
safety review systems, 8/29,62-67 
scenario development, 8/27, 55-57 
screening analysis techniques, 8/27, 
30-31 

selecting method for, 8/28-29,62 
sneak analysis, 8/27,53-54 
studies, list of, 8/26-29 
warning analysis, 8/70 
what if analysis, 8/26, 29,32-33 
Hazard indices 

insurance assessment and use of, 5/12 
separation distances and use of, 10/16,19 
types of, 8/13-26 

Hazardous area classification (HAC), 

10/5,20-22,23 
API, 16/144-146 
electrical equipment, 16/129-131 
ICI code, 16/136-137 
IP standards, 16/137,139-144 
for loading and unloading facilities, 
22/63 

LPG and, 22/23, 26 
standards and fires, 16/135—146 
storage and, 22/13,16 
Hazardous area instrument system 
design and, 13/8 

Hazardous Liquid Pipeline Safety Act, 2/7 
Hazardous Material Incident Reporting 
System (HMIRS), A33/3 
Hazardous Materials Planning Program, 
California, 4/32 

Hazardous Materials Transportation Act 
(1970), 2/7; 3/5 

Hazardous Substances Emergency 
Events Surveillance (HSEES) 
database, 2/10-11; A33/2 
Hazardous wastes, legislation on, 3/4 
HAZARDTEXT, 29/3 
Hazard warning, 9/108 
events, before and after release, 
9/109-110,112 
failure of, 9/116-117 
high versus low, 9/117,119 
post-release analysis, 9/112—113 
pre-release analysis, 9/113-116 
structure, 9/109 

tree, 9/109,110, 111, 114,115,116, 
117-120,121 
HAZCHEM, 23/12 
HAZEXPERT, 30/63 
HAZExpert, 30/63,65 
HAZID, 30/63,65-67,68,70-71 
Hazmat, 23/5,30-32 
HAZOP. See Hazard and operability 
studies 

HAZOPEX, 30/63 

Health and Safety at Work Act (HSWA) 
(1974), 1/5; 4/14; 18/15; 1/14 
Health and Safety Commission (HSC), 
A29/3 

publications of, A28/47-56 
Health and Safety Executive (HSE) 

See also Safety management systems 
(SMS) 


accidents, investigating, 27/9 
address/website for, 23/5; A29/3 
ALARP, 9/85 
benzene, 18/22-23 
Canvey Reports , response to, 

A7/30 

chlorine guidelines, 9/92-94,95,96,97, 
98 

confined spaces, 21/13 
consultations and advice, 4/28 
emergency planning, 24/15 
explosion venting of ducts and pipes, 
17/82-84 

flame arresters, 17/56-57 
gas toxicity and dangerous dose, 
18/56-58 

guidelines on developments near major 
hazards, A25/2-4 
hazard assessment and, 9/2,9—11 
HSELINE, 18/10; 29/3 
Human Factors in Industrial Safety, 14/44 
land-use planning risk criteria, 
9/85-86 

liquefied petroleum gas guidelines, 
9/92,93 

maintenance errors and, 14/49—50 
management and, 6/2,6/19-20 
Material Safety Data Sheets 
(MSDS), 8/12 
metals, hazardous, 18/26 
molten metal-water explosions, 17/176 
nuclear installations risk criteria and, 
9/84-85 

occupational hygiene, 25/7 
plant operation, 20/2 
ports and harbors, regulations, 23/50 
process design and, 11/23 
programmable electronic systems 
(PES), 13/34,48-54 
publications of, 6/2,15, 20; A28/56 
risk and, 4/4 

storage of petroleum products, 22/5 
Structured Audit Technique for the 
Assessment of Safety 
Management Systems (STATAS), 
6/20-21; 8/11 
toxic chemicals and, 18/15 
vinyl chloride, 18/24 
water spray barriers, 15/312-315 
website for, 23/5; A29/3 
welding, 21/29,30-31 
Hearne, Texas, 23/76; Al/40 
HEART. See Human error assessment 
and reduction technique 
Heat exchangers 
failure of, A14/16-19 
fouling, 12/32-33 
maintenance of, 21/37 
plant layout and, 10/12 
pressure systems and, 12/32—34 
tube rupture, 12/33-34 
tube vibration, 12/33 
waste heat boilers, 12/34 
Heat flow calorimetry, 33/20 
Heat flux, vertical, 15/83 

electrical, 11/37 
fueloil/gas, 11/37 
steam, 11/37-38 
Heat radiation 

flame emissivity, 16/164—167 
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flare, 12/71 

fraction radiated, 16/167 
Heat transfer 
fires and, 16/13 
model, 15/166 
radiant, 16/160-172 
vaporization and, 15/58—60 
workbook model and, 15/198-199 
Heat transfer fluids (HTFs), 11/40 
Heat transfer media, 11/17 
hazards of, 11/40 
refrigerants, 11/40 
Heat treatment of steel, 12/14-15 
Heavy gas dispersion trials. SeeThorney 
Island field trials 

HEAVYGAS model, 15/165,167,191, 243, 
249, 315 

Heavy goods vehicles (HGVs), 

23/17-28 

HEGABOX model, 15/183,188,189 
HEGADAS model, 15/165,167,182,183, 
187-188,189, 200, 250 
Heikkila-Hurme index, 32/13 
Heinrich model, 17/277-278 
Hellenic Carrier, 23/76 
Helmholtz free energy, 17/22-23, 29 
Hess-Hoffman-Stoeckel model, 15/49 
Heuristics, 30/13 
Heuristic search, 30/20 
HFSYSTEM model, 15/255 
HGSYSTEM model, 15/167,183,188-189 
Hierarchical task analysis (HTA), 

14/28, 29 

High integrity protective systems (HIPS), 
13/31-34; 34/29-31 

High integrity shut-down systems (HISS), 
13/31 

High integrity trip initiators (HITIs), 
13/31,32 

High integrity voting equipment (HIVE), 
13/31 

Highly Flammable Liquids and Liquefied 
Petroleum Gases Regulations (1972), 
22/66 

High toxic hazard materials (HTHMs) 

See also Hazards; Toxic chemicals/ 


n, 25/11 


containment of, 12/73-75 
control systems for, 13/68-69 
loading and unloading, 22/65 
storage of, 22/40-42 
Hill-climbing search, 30/21 
Hoechst, Germany, 1/65 
Homeland Security Advisory System 
(HSAS), 35/7 
Home Office, 2/15; A29/3 
publications of, A28/56 
Homogeneous equilibrium model (HEM), 
15/17 

Leung, 15/30-33 
venting reactors, 17/100,101 
Homogeneous two-phase flow, 15/17, 
19-20 

equilibrium flow model, 15/22 
frozen flow model, 15/22 
Hoot-Meroney-Peterka (HMP) model, 
15/261-262, 292 


Hot environments, working i 
Hot gas jet ignition, 16/43 
Hot particle ignition, 16/43,60 
Hot spots/materials 
dust ignition and, 17/260 
self-heating and, 16/78-80 
Hot storage tests, 33/17 
Hot surface ignition, 16/38-40,58,59- 60 
Hot tapping, 21/31,32 
Hot work 

dust ignition and, 17/260 
as ignition source, 16/58-59 
maintenance, 21/27-33 
Houghton Main colliery accident, 
communication errors, 14/51,52 
Houses, damage to. See Structural 
damage 

Housing and Planning Act (1986), 4/28 
Houston,Texas, 23/73 
1971 accident, Al/39 
1976 accident, Al/48 
Houston accident model, 2/2,3 
HSDE, 29/3 

HSE. See Health and Safety Executive 

HSELINE, 18/10; 29/3 

Huff model, 17/96-97 

Human body, static electricity and, 16/121 

Human error 

See also Process operators 
accidents and, 14/45—46 
alarms and, 14/13-16 
analysis, 8/27,55 
approaches to, 14/46 
classification, 14/87 
in communication, 9/51; 14/51,52,53 
computer-based aids, use of, 14/19-21 
engineering interest in, 14/45 
fault administration, 14/16—18 
hazard assessment and, 9/49-51 
information display and, 14/11—13 
job design and, 14/35 
maintenance and, 9/51; 14/49-50 
malfunction detection and, 14/18-20 
models and classifications of, 14/46-48 
organizational issues and, 14/51 
personnel selection and, 14/35—36 
pipework failure and, 14/50 
plant design and, 14/50-51 
preventing, 14/51, 53 
probabilities (HEP), 14/55-57,60- 66 
in process operations, 9/49-51; 14/4, 
48-51 

Rasmussen Report and, A23/4 
references on, 14/3-4,44-45 
stress and, 14/69-72 
task analysis and, 14/21,27-35,46,74, 
79 

training and, 14/36-43 
Human cognitive reliability (HCR) 
correlation, 14/81 


ACSNI report, 14/88-90 
benchmark exercise, 14/87-88 
CCPS method, 14/80,83,84,88,90-91 
Dougherty and Fragola method, 14/74, 
76-80,81,82 

human error assessment and reduction 
technique (HEART), 14/54,74 
human error data, 14/84-87 

Human Reliability Analysis (HRA) 


Handbook, 14/59-73 
other methods, description of, 
14/80-82 

performance shaping factors (PSFs), 
14/69,71,79,82-84 
in process industry operations, 14/ 
54-57 

qualitative methods, 14/57—59 
Safety and Reliability Directorate 
(SRD), 14/87 

success likelihood index method 
(SLIM), 9/50-51; 14/54,73-74 
task analysis for, 14/53,74,79 
Human error assessment and reduction 
technique (HEART), 14/54,74,83 
Human error data, 14/84-87 
Human error database (HED), 14/87 
Human Error Prevention Guidelines 
(CCPS), 14/35,80 

Human error probabilities (HEPs), 
14/55-57,60-66 
Human factors 

accident investigation and role of, 
31/6-7 

hazard assessment and, 9/49—51 
in process control, 14/4,7 
references on, 6/14-15; 14/2-4 
Sizewell Band, 14/91-92 
in system design, 14/4—5 
themes in, 14/5-7 

Human Factors in Industrial Safety (HSE), 
14/44 

Human Factors in Reliability Group 
(HFRG), 14/51 

Human information processing 
abstraction levels, 14/21 
cognitive tasks, human behavior in, 
14/23-24 

cognitive tasks, human error in, 
14/25-26 

cognitive tasks, mental models in, 
14/24-25 

control tasks, human behavior in, 14/24 
diagnostic tasks, human behavior in, 
14/22-23 
models, 14/26-27 
task analysis, 14/21, 27-35 
Human Reliability Analysis (Dougherty 
and Fragola) 
applications, 14/79 
computer aids, 14/79 
log-normal distribution, 14/78 
modeling and filtering of human 
events, 14/76 

modeling of mistakes, 14/77 
modeling of slips, 14/76-77 
operator action event trees (OAETk), 
14/74,76 

overall approach, 14/74 
performance shaping factors, 14/79 
probability of mistakes of commission, 
14/79 

response and recovery events, 14/74 
task analysis, 14/74,79 
time-reliability correlation (TRC), 
14/77-79 

Human Reliability Analysis (HRA) 

Handbook (Swain and Guttmann), 
14/59-60 

dependence model, 14/61—63 
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displays, 14/63-64 
human performance estimates, 14/72 
locally operated valves, 14/64-65,66 
log-normal distribution, 14/72—73 
manning model, 14/67—68 
nominal diagnosis model, 14/67,68 
oral and written instructions, 14/64 
performance shaping factors, 14/69,71 
recovery model, 14/68-69 
stress, 14/69-72 
structure of, 14/60,61,62 
time-reliability correlation (TRC), 
14/65,67 

Human Response Analyzer and Timer for 
Infrequent Occurrences 
(HORATIO), 14/54 
Hunn’s method, 9/45—46 
Hustad-Sonju model, 16/219-220 
Hydraulic testing, 19/30-31 
Hydrocarbons 
flames, 16/167 
hazards of, 11/45 
pipelines, 23/38 
references on, 11/43 
toxicity of, 18/38 

Hydrocarbon sweetening plant, trip 
systems for, 13/29-30, 31 
Hydrodesulfurizer storage, A8/10,17 
Hydrofluorocarbons (HFCs), 16/273,275 
Hydrogen 
attack, 12/81 
blistering, 12/81 
cracking, 22/32 
hazards of, 11/50 
references on, 11/43 
storage of, 22/40 
vapor cloud explosions, 17/166 
Hydrogenation reactions, 11/27 
Hydrogen chloride 
references on, 18/5,38 
toxicity of, 18/27,38 
Hydrogen cyanide 
references on, 18/5,7,38 
toxicity of, 18/27,38 
Hydrogen fluoride 

dispersion of, 15/254-256, 258-260; 
A7/21-22 

hazards of, 11/50-51 
HSE dangerous dose, 18/58 
references on, 11/43; 18/5-6,7, 38 
storage of, 22/54 

toxicity of, 18/27,38-39; A7/20-21 
Hydrogen sulfide 
accidents, 18/64 
HSE dangerous dose, 18/58 
references on, 18/6,7,39-40 
toxicity of, 18/27,39-40 
Hygiene standards, 18/16-21 
Hymes model, 16/248, 249 
Hyperexponential distribution, 7/18 


IBC code, 23/47,57,62 
IBC Technical Services Ltd., A28/56-58 
ICI. See Imperial Chemical Industries 
Idaho Falls, Idaho, A20/9 
Identifying substances. See Labeling 
ID3 algorithm, 30/30—31 


IFAL index, 8/22,30,31 
IGC code, 23/57,62 
Ignition 
auto, 16/35 

of clothing, 16/246-247 
compression, 16/43-45 
dust, 17/260, 262-263, 264 
energy, 16/20, 21,38, 54,56 
friction and impact, 16/40-43 
hot gas jet, 16/43 
hot particle, 16/43 
hot surface, 16/38-40 
jet, 16/43 
of liquids, 16/235 
models, 16/146-154; A7/31-32 
probability, A14/36-37 
references on, 16/56—57 
of solids, 16/235 

sources, 16/56-66; 17/31; A14/35 
spark, 16/36-38 
temperature, 16/17,19 
time delay, 16/19-20,35-36 
of wood, 16/235-238 
Ilford, Essex, Al/45-46 
Impact effects, missiles and, 17/211-213, 
214-216 

Impact ignition, 16/40-43,58,60 
dust ignition and, 17/262 
Imperial Chemical Industries (ICI), A29/3 
Electrical Installations Code, 16/129,131, 
134,136-137 
filling ratios, 22/61 
fireproofing, 16/260 
hazardous area classification, 16/135, 
136-137 
LPG, 22/20, 21 

venting reactors, 17/97,108-111 
IMPORTANCE, 30/77 
Impurities, identifying, 8/12-13,11/64 
Incidence calculus, 30/12 
Incident Commander (IC), 24/9-10 
Incident Reporting Information System 
(IRIS), 2/7-8; 29/3; A33/2 
Incidents. See Accidents (incidents) 
Incineration, All/21 
Incinerators, plant layout and, 10/12 
Incoming solar radiation (ISR), 15/83,84 
Incompressible flow, 15/6 
Independent layer of protection (IPL), 
13/62,63 

Independent Tank Storage Association 
(ITSA), 23/50 
Indexing, 30/17 
INDUCE, 30/31 
Induction periods, 16/77-78 
Inductive learning, 30/29—31 
Industrial Risk Insurers (IRI), 2/20,21; 
15/286; 16/2; A29/7 
publications of, A28/58-59 
Inert gases, 11/39 
fire protection and, 16/276; 22/19 
hazards, 25/29 

preventing dust explosions with, 17/ 
265-266 

shielded welding, 12/18 
ships and use of, 23/56-57 
Inference, non-deductive, 30/10 
Infiltration 

into buildings, 15/301-305 


hazard assessment, 15/304-305 
models of, 15/301-303 
ventilation rates, 15/303-304 
Influence diagram approach (IDA), 
human error assessment, 14/81 
Information display, human error and, 
14/11-13 

Information feedback 

See also Accident models; Accidents, 
investigating 
case histories, 27/18 
exchanging information, 27/18-19 
incident reporting, 27/3 
learning process, 27/2-3 
lessons learned, ensuring, 27/18 
monitoring operations, 27/3-4 
references on, 27/2 
Information processing. See Human 
information processing 
Information systems, maintenance, 
21/41-42 

Informed search, 30/20 
Infrared thermography, 19/35 
Inherently safer design 
checklist, 32/19-21 
conflicts, 31/10-11 
definitions, 32/2 
history of, 32/2-3 
implementing, 32/19-23 
indices, 32/11-18 
process life cycle and, 32/18-19 
references on, 32/33-34 
risk management strategies, 32/3—4 
strategies, 32/5-10 
Inheritance, 30/18 
Injuries 

See also Explosions, injuries from 

assessing, 9/67-71,82 

distribution, 9/68 

factors, 9/102 

fire, 16/239-252 

flying glass, 17/233-243 

hazard impact model, 98,100,102-104 

incapacitation defined, 17/243-244 

multiple and double counting, 9/71 

probabilities, 9/102 

reporting, Al/6-7 

in road transportation accidents, 

23/20 

statistics, 25/5-6 
trends in, 2/22, 26 
zone, 2/14 
INSET, 32/15,17 
INSIDE, 32/10, 21 
Inspection(s) 
documentation, 19/19-20 
of leaks, 19/31-32 
material verification, 19/29 
of modifications, 21/49-50 
non-destructive testing, 19/25-29 
organization that conduct, 19/17-18 
personnel for, 19/18 
of pipes/pipework, 19/24-25,47,48 
planning, 19/18-19 
pressure testing, 19/29—31 
of pressure vessels, 19/19, 20-24 
references on, 19/14,15-17 
regulations on, 19/14,17 
of vehicles, 19/47-48 
of welds, 19/19 
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Instantaneous fractional annual loss 
(IFAL), 5/12 

Institute of Electrical and Electronics 
Engineers (IEEE), 21/2; A29/7 
software standards, 13/56 
Institute of Fire Engineers (IFE), 16/2 
Institute of Materials (IOM), A29/3 
publications of, A28/59-60 
Institute of Petroleum (IP), 16/129,135; 
A29/3 

hazardous area classification, 16/137, 
139-144 
isolation, 21/7 

Pressure Piping Systems Examination 
Code, 19/24-25 

Pressure Vessel Examination Code, 
19/20-24 

publications of, A28/60-61 
Refining Safety Code, 22/16 
storage of petroleum products, 22/5 
Institution of Chemical Engineers 
(IChemE), 1/5,13; Al/2 
acoustic emission monitoring, 19/44—47 
address/website for, A29/4 
fire relief, 12/53 
guide on utilities, 11/36 
laboratory codes, A9/4 
Loss Prevention Bulletin, 27/18 
overpressure standards, 12/45 
permits, 21/15,16,17 
publications of, A28/61-63 
thermal relief, 12/55-56 
vacuum relief, 12/55 

Institution of Electrical Engineers (IEE), 
A29/4 

publications of, A28/63 
Institution of Gas Engineers, A29/4 
publications of, A28/63-65 
Institution of Mechanical Engineers 
(IMechE), 12/22; A29/4 
publications of, A28/65-67 
Instrumentation, Systems and 

Automation (ISA) Society, 34/5-6 
address/website for, A29/7 
hierarchy, 30/18 

safety instrumented systems, 12/73 
valve leak tightness, 13/8 
Instrument failure, A14/22-26 
detection of, 13/23,14/19-20 
factors affecting, 13/18-20 
fault-tolerant instrumentation, 13/24 
loop failure rates, 13/22-23 
modes, 13/20-21 
overall failure rates, 13/17-18 
prediction of, 13/22 
self-checking instruments, 13/23-24 
testing of instruments, 13/24 
Instrument system design 
accuracy, 13/7 
distribution, 13/7 
hazardous area compatibility, 13/8 
multi-functional versus dedicated, 13/8 
principles, 13/4,6-7 
references on, 13/5-6 
signal transmission instruments, 13/8 
utilities, 13/8 
valve leak tightness, 13/8 
Insulated exotherm test (IET), 33/17, 
23-24 

Insulation, pressure systems and 


absorption of liquids, 12/41-42 
external corrosion, 12/42 
fire, 12/43 

materials for thermal, 12/41 
personnel protection, 12/43 
safety aspects, 12/41 
self-heating, 12/42-43 
thermal, 12/41,43 
Insurance 
adjusters, 5/18 

business interruption, 5/9,16—17 

capacity, 5/10 

company losses, 5/10 

costs, 5/3,7-19 

credit, 5/17-18 

in design, 5/18 

disasters, major, 5/11 

fire, in the U.K., 5/9 

how premium rates are set, 5/9,12—16 

for large plants, 5/9-10 

market, factors affecting, 5/10 

methods for measuring loss, 5/8,11 

policies, coverage in, 5/8-9 

premium rating plans, 5/12,13-15,16 

for process plants, 5/7—11 

property, 5/11-16 

purpose of, 5/8 

quota-share (co-insurance), 5/8 
re-insurance, 5/8 
restrictions, 5/10-11 
self, 5/11 
statistics, 5/18 
surveyors, 5/9 

vapor cloud explosions and, 5/11 
Insurance Technical Bureau (ITB), 5/12; 
8/22; A29/4 

Integrated Pipeline Information System 
(IPIS), A33/3 

Intensification, process, 11/14,15,16 
Interests groups, role of, 4/13 
Interference theory, 7/42-43 
Interlock control systems 
applications, 13/44; 34/34 
for a batch reactor system, 13/45—47,48, 
49; 34/37-39 

components of, 13/44—45,46 
for a conveyor system, 13/45,46- 47; 
34/36-37 

diagrams/symbols, 13/44,45; 34/34-36 
guidelines, 13/62,63-65 
references on, 13/43 
safety interlock system (SIS), 11/21,23; 

13/62,63-65 
types of, 13/43 

International Agency for Research on 
Cancer (IARC), 18/22 
International Air Transport Association 
(IATA), 23/2,69 

International Association of Ports and 
Harbors (IAPH), 23/50 
International Atomic Energy Agency 
(IAEA), A20/4 

Procedures for Conducting Probabilistic 
Safety Assessment of Nuclear 
Power Plant, 9/9 

International Chamber of Shipping (ICS), 
23/47 

International Civil Aviation Organization 
(ICAO), 23/69 

International Committee on Radiological 


Protection (ICRP), A20/4 
International Convention on the Safety of 
Life at Sea (SOLAS) (1974), 23/47 
International Electrotechnical 
Commission (IEC) 
electrical equipment, 16/129 
hazardous area classification, 10/20 
role of, 21/2 

safety instrumented systems, 12/73; 

34/6-7 

software standards, 13/56, 57 
International Institute of Noise Control 
Engineering (I-INCE), A12/2 
International Labour Organisation, 
A28/67 

International Maritime Dangerous Goods 
(IMDG) code, 23/9 
International Maritime Organization 
(IMO), 17/58; 23/2,46-47, 57,71 
publications of, A28/67-68 
International Nuclear Information System 
(INIS), 29/3 

International Occupational Safety and 
Health Information Centre, 29/3 
publications of, A28/68 
International Oil Insurers (IOI), 5/10 
International Safety Rating System 
(ISRS), 6/13; 9/51; 28/9-10 
International Study Group on Risk 
Assessment (ISGRA), 9/121 
International Union of Railways (IUR), 
23/32 
Inventory 

of equipment, A14/14 
maintaining, 21/42—43 
of plants, A14/13-14 
reduction in fire, 12/52 
Inventory of hazardous material 
limitations, need for, 11/13—14 
scale of hazard and, 2/12 
Inversion conditions, 15/83 
Investigating accidents. See Accidents, 
investigating/researching 
IP. See Institute of Petroleum 
IRIS. See Incident Reporting Information 
System 

Irwin model of crack tip plasticity, 12/89 
ISA. See Instrumentation, Systems and 
Automation (ISA) Society 
Isentropic flow, 15/6,10 
Isolation 

dust explosions and, 17/266-267 
of electrical equipment, 21/9-10 
maintenance and, 21/7—10 
permits, 21/15 
of vessels and pipes, 21/7-8 
welding and temporary, 21/29 
ISONET, A27/2-3 
ISO 9000 standard, 1/11,12; 13/56 
Isoperibolic calorimetry, 33/20 
Isothermal flow, 15/6,10 


Jagger-Edmondson model, 15/262-264 
Jaggers-Roper model, 16/184-185 
Jarrett equation, 17/193-194 
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Jeffreys Amendment, 4/32 
Jet flames 

attack, 16/233, 235 
enclosed, 16/222-223 
features, 16/215-216 
hazards of, 16/293,295 
models, 16/216-222 
studies, 16/214-215, 216 
view factors, 16/222 
Jets, dispersion of, 15/134 
concentrations, 15/279 
disintegration, 15/152-153 
gas, 15/136-138 
liquid, 15/140-142 

momentum, 15/136-137,145, 281-283 
references on, 15/135 
sonic gas, 15/138-140 
transients, 15/152 
two-phase, 15/142 

two-phase flashing, 15/152-155,163 
Jetties, fires and, 23/51-52 
Job design, human error and, 14/35 
Johnson-Brightwell-Carsley model, 
16/213-214, 220 
Joint density functions, 7/29 
Joint probability, 7/8-9 
Jonova, Lithuania, 22/72; Al/58 
Jules Verne, 23/77 


Karlovitz number, 16/30—31 
KAS (Knowledge Acquisition System), 
30/36,40-41 

KEE (Knowledge Engineering 
Environment), 30/41 
Kemeny Report, A21/10-13 
KES, 30/41 
K<j method, 17/66-67 
Khan-Amyotte index, 32/14-15 
Kingman, Arizona, 23/73; 24/14; Al/40 
Kings Lynn, Norfolk, Al/47 
KITT, 30/77 

Kletz accident model, 2/4,9; 27/4-5 
Klinkenberg-van der Minne model, 
16/101,106,108 
Knife-line corrosion, 12/83 
Knockout drums, 17/114-116 
Knowledge 

acquisition facility (KAF), 30/36 
Acquisition System (KAS), 30/36, 
40-41 

Engineering Environment (KEE), 
30/41 

management, 6/13—14 
representation, 30/6-7 
structured, 30/7,17-19 
Koszman-Gavis model, 16/101-103 
Kramer-Schon, 16/110-111,113 
Kst method, 17/271-274 
K-theory models, 15/115-116,165 
Kuhl-Kamel-Oppenheim model, 17/158 


La Barre, Louisiana, 23/73; 24/14; Al/32 
Labeling 
accidents, 23/73 


equipment, 20/20; 21/6 
regulations, 23/9-12 
substances, 22/67 
Laboratories 
codes, A9/3-4 
design of, A9/5-6 
emergency planning, A9/9-10 
equipment for, A9/6 
fire and explosion protection, A9/9 
hazards, A9/4-5 
laws on, A9/2 

management systems, A9/2—3 
operation of, A9/7-9 
references on, A9/2 
services, A9/6-7 
storage and waste disposal, A9/7 
training of personnel, A9/3 
Ladder diagrams/symbols, 13/44,45 
Lagging fires, 16/156 
Lagrangian turbulence, 15/96 
Lake Charles, Louisiana, Al/33—34 
Lakshmanan-Stephanopoulos planner, 
30/89-90 

Landfills, All/21-22 
Language(s) 
modeling, 30/48 
natural, 30/6, 24 
programming, 30/7,14-17 
Large plants 

distributed plants versus, 11/24 
insurance for, 5/9—10,16 
major concerns for, 1/5—8 
references on, 1/6 
LaSalle, Canada, Al/33 
LashAtlantico, 23/76 
La Spezia, Italy, Al/39 
Las Piedras, Venezuela, Al/54 
Lawrence Livermore National Laboratory 
(LLNL), 15/205,210,213; A20/4; 
A29/7 

Laws/regulations 
See also under name of 
on accidental chemical releases, 3/5 
on air pollution, 2/7 
on chemical spills, 2/7 
codes and standards, 3/3—4 
computer programs for, 29/3 
on emergency planning, 24/8,15-20 
on environmental issues, 3/4,11/7-10 
on fugitive emissions, 15/319 
German, 4/30 
on inspections, 19/14,17 
on laboratories, A9/2 
on lead, 18/26 
marine, 23/46-50 
on noise, A12/2 
on offshore safety, A18/3 
on oil spills, 2/7 
on pipelines, 23/37 
on process hazard control, 4/17-21 
reactive chemicals/hazards, 

33/3,6-7 

references on, 3/2-3 
regulatory agencies, 3/3,5 
on toxic substances, 3/4-5 
on transportation issues, 3/5; 23/6-12, 
14-15 
U.S., 3/2-5 
of the wall, 15/79 
on warehouses, 22/66 


on welding, 21/27 

Layers of protection, process design and, 
11/21; 33/41-42 

Layers of protection analysis (LOPA), 
34/2,7-12 
Lead, 18/4, 21,26 
toxicity of additives, A7/21 
Leading indicators, 1/9 
Leak-before-break behavior (LBB), 
12/91-92 

Leaks, 15/323-324 
emergency procedures, 20/7—8 
estimating frequency of, 16/148, 
150-152 

rates, 19/32; A14/34 
sealing, 21/35 
sources, A14/33-34,35 
testing for, 19/31-32 
tightness, valve, 13/8 
Learning, artificial intelligence and 
algorithms, genetic, 30/29 
classification, 30/28, 30 
from data or stored knowledge, 30/28 
experience, 30/29 
exploration, 30/28-29 
from failure, 30/29 
inductive, 30/29-31 
instruction, 30/28 
neural networks, 30/29, 31 
problem solving, 30/29 
supervised and unsupervised, 30/28 
Least squares method, 7/56-57 
Lees model, 16/248-251 
Leung models 

See also Two-phase flow, Leung 
models venting reactors, 
17/106-108 
Level deviations, 11/63 
Lewis-von Elbe model, 17/40-41 
License conditions, ACMH, A24/2-10 
Licensors, process design and, 11/13 
Life, value of, 9/90-91 
Life cycle costing (LCC), 7/67-69 
Lifting and carrying, safety tips, 
25/26-27 

Lifts, maintenance of, 21/23-24 
Lightbulb curve, 7/44 
Lightning, as ignition source, 16/63; 23/79 
Linden, New Jersey, Al/37 
Linear elastic fracture mechanics 
(LEFM), 12/89 

Line diagrams, use of engineering, 11/4, 
6-7 

LINKMan, 30/59 
Liquefied flammable gas (LFG) 
fires, 16/280 

marine transport, 23/57—61 
separation distances, 10/15—20 
Liquefied natural gas (LNG) 
accidents, 23/73,74 
barge modular plants for, 10/32 
composition, 22/36 
dispersion of, 15/160, 253; A7/15-17 
evaporation of, A7/15 
failure of, A14/33 
field trials, 15/204-223 
fires, 16/280-281 
hazards of, 11/45,59 
liquid droplets, 15/163 
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marine transport, 23/57-68 
methane and, 17/166 
pipeline ruptures, 15/54—55 
plants, siting of, 4/31 
probability of ignition, 16/147-148 
references on, 11/43, 59,60-62 
release from pressurized containment, 
15/161 

release from refrigerated containment, 
15/161,163 

release from semi-refrigerated 
containment, 15/163 
SIGMET model, 15/167,179-181 
source terms, 15/164 
spreading of, 15/64-68 
tank wall temperatures, A7/14—15 
two-phase flashing jets, 15/163 
vaporization of, 15/63—68 
workbook model and, 15/200 

Liquefied natural gas, storage of 
accidents, 22/71 
alarms, 22/37 

containment, secondary, 22/36 
earth pits, 22/40 
filling ratios, 22/61 
fire protection, 22/37 
hazards, 22/76-77 
pressure relief valves, 22/37 
refrigerated, 22/36-40 
Rijnmond Report, A8/10,15 
rollover, 22/38-39 
separation distances, 22/36 
standards, 22/35-36 
storage tanks, 22/36 

Liquefied petroleum gas (LPG) 
accidents, 23/73,74 
draining water, 20/18 
hazards of, 11/45, 59 
HSE guidelines, 9/92,93 
loading and unloading, 22/65 
LPGITA/CIMAH guidelines, 9/94 
marine transport, 23/57-68 
pipeline ruptures, 15/54—55 
references on, 11/43, 59,60 
separation distances, 10/15-20; 22/21, 
24-25,33 
standards, 22/20 
use of, 11/37 

Liquefied petroleum gas, storage of 
accidents, 22/71 
air plants, 22/33 
alarms, 22/28,35 

containment, secondary, 22/21—22,35 

earth pits, 22/32, 35 

filling ratios, 22/61 

fire protection, 22/30-32,35 

firewalls, 22/22—23 

hazardous area classification, 22/23,26 

hazards, 22/73-76 

hydrogen related cracking, 22/32 

pipework and fittings, 22/26-27 

pressure, 22/20-33,73-74,75 

pressure relief valves, 22/28-29,35 

refrigerated, 22/33-35,74,76 

separation distances, 22/21,24-25,33 

standards, 22/20 

storage tanks/vessels, 22/20-21, 33 
vacuum protection, 22/29-30 
vaporizers, 22/30, 35 
water drainage facilities, 22/27-28 

Liquefied Petroleum Gas Industry 
Technical Association (LPGITA), 


9/92,94; 11/59; 22/20; A29/4 
publications of, A28/68 
Liquid carryover, in flares, 12/71—72 
Liquid effluents, All/18-20 
plant layout and, 10/27-28 
Liquid jets, 15/140-142 
Liquid oxygen, BCGA/CIMAH 
guidelines, 9/94,96-97,98 
Liquid phase chlorination, 11/27—28 
Liquid phase hydrogenation, 11/27 
Liquid phase oxidation, 11/26-27 
Liquid propellants, fireballs from, 
16/188-189 
Liquids 

agitation, 16/108 
burning rates, 16/196-198 
conductivity, 16/98-99 
discharge rates, 15/7-8 
discharge time in vessels, 15/12-14 
droplet settling, 16/106-107 
emissions of, 15/6—7 
expansion energy, 17/25 
flammable, 16/278, 279-280 
flow in pipes, 16/99-106 
flow through filters and ball valves, 
16/104,106 
ignition of, 16/235 

plant layout and storage of, 10/14-15 
sampling, 20/18-19 
sprays and mists, 15/58; 16/107-108 
spreading of, 15/62-63 
static electricity effects in, 16/95-96, 
98-111 

storage tanks, 16/108-111 
superheated liquid explosions, 
17/172-173,175,176-177 
swell, 15/34 

vaporization of cryogenic, 15/63-64 
vaporization of superheated, 15/57—58 
vaporization of volatile, 15/61-62 
LISP (List Processing language), 30/16,36 
Livingston, Louisiana, 23/73; Al/53 
Lloyds of London, 23/47 
LNG Aquarius, 23/77 
LNG Taurus, 23/77 
Loading and unloading 
ammonia, 22/65 
chlorine, 22/65 

high toxic hazard materials, 22/65 
LPG, 22/65 

petroleum products, 22/65 
transportation issues, 23/7,50-51 
Loading and unloading facilities 
filling arrangements and connections, 
22/63 

fire/explosions, 22/62,64 
hazardous are classification, 22/63 
hazards at, 22/61-62 
plant layout and, 22/62-63 
rail, 22/64-65 
shut-off arrangements, 22/63 
static electricity and, 22/63-64 
switching chemicals/materials, 22/62 
vehicles for, 22/63 
Locally operated valves (LOVs), 14/ 
64-65,66 

Local planning authorities (LPAs), 4/15, 
16, 21, 25, 27, 28, 30 
Lockhart-Martinelli model, 15/21 
Lodi, New Jersey, 33/2,12 


Logarithmic vertical wind velocity, 15/81 
Logic 

diagrams, 31/19—20 
epistemic, 30/11 

first order predicate (FPOL), 30/7,9-10 
flow diagrams/symbols, 7/22,35; 13/44, 
45 

fuzzy, 30/11,12,14 
gates, 9/14-16; 13/44 
many-sorted, 30/10-11 
many-valued, 30/11 
modal, 30/11 

non-classical, 30/7,10-11 
non-monotonic, 30/11 
prepositional (PL), 30/7,8-9 
situational, 30/11 
temporal, 30/11 

Log-normal distribution, 7/17; 9/78-79, 
102; 14/72-73,78 

London and Coastal Wharves Ltd., A7/2 
London Master Energy Line Slip, 5/10 
Longford, Australia, Al/66-67 
Longview,Texas, Al/39 
Los Angeles, California 
1974 accident, Al/43 
1976 accident, Al/47 

See also under type of 

causes of, 2/20-21 

costs and, 5/2-4 

methods for measuring, 5/8,11 

references on, 2/2; 5/2-3 

total, 1/10-11 

trends in, 1/2 

Loss-of-coolant accidents (LOCAs), 
pipework failure and, 12/96,98 
Loss prevention 
characteristics of, 1/8-10 
cost of, 5/4-7 
defined, 1/2 

development in chemical and oil 
industries, 1/4—5 
historical development of, 1/5 
Loss Prevention Bulletin, 1/5,13 
Lost time accidents (LTAs), 6/12 
Lost-time injury rate (LTIR), 2/22,26 
Louisville, Kentucky, Al/33 
Love Canal, New York, All/26 
Lovelace Foundation for Medical 

Education and Research, A28/68 
Low alloy steel, 12/13 
Low density polyethylene (LDPE), barge 
modular plants for, 10/32 
Low pressure flares, 12/68 
Ludwigshafen, Germany, Al/26, 29 
Lusser’s product law of reliabilities, 7/5 
Lyme Bay, chlorine trials, 15/200,204 
Lynchburg, Virginia, 23/73; Al/40 


MACBETH, 30/29 
Mackay-Matsugu model, 15/62 
Magnetic particle methods, 19/27-28 
Maintainability, 7/62-63 
Maintenance 

activities and policies, 7/63-66 
of ammonia storage spheres, 21/37 
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cleaning, 21/10-12 
of computer systems, 21/43-44 
of confined spaces, 21/12—14 
contractors, use of, 21/5 
documentation, 21/4-5 
effectiveness, 7/65 

emergency shut-down systems, 13/66; 
34/33 

of equipment, 21/21-25,38-39 

of equipment supports, 21/37—38 

of flame arresters, 17/58 

of flanged joints, 21/25-27 

handovers, 21/5 

hazards of, 21/5-6 

of heat exchangers, 21/37 

hot work, 21/27-33 

human error and, 9/51; 14/49-50 

indices, 7/65-66 

information, 7/65; 21/41-42 

of inventory stock, 21/41—42 

isolation, 21/7-10 

on-condition, 7/64-65 

on-line repairs, 21/33-34 

opportunity, 7/65 

permits, 21/5,14-21 

personnel, 21/5 

planned, 7/64; 20/9 

for plant commissioning, 19/6-7 

plant layout and, 10/11 

preparation for, 21/6—7 

of pressure relief devices, 21/35-36 

of pressure vessels, 21/35 

problems, 21/39 

procedures, 21/5 

purging, 21/10 

references on, 21/2—4 

reliability-centered, 7/66-67 

scheduled, 7/64 

software, 13/60 

standards/organizations, 21/1,4 
of storage tanks, 21/33-35, 38 
training for, 21/5 
of trip systems, 13/43 
of ventilation systems, 25/20 
Maintenance personnel performance 
simulator (MAPPS), 14/81 
Major Accident Hazards Bureau (MAHB), 
A33/3 

Major Accident Investigation Branch 
(MAIB), A33/5 

Major Accident Reporting System 
(MARS), 27/19; A33/3 
Major Hazard Incidents Data Service 
(MHIDAS), 27/19; A33/4-5 
MAK-Werte limit system, 18/18 
Malfunction detection, 14/18-20; 

30/100-105 

Management 

See also Risk management; Safety 
management systems (SMS) 
accident investigation and role of, 31/6, 
28-31 
alarm, 14/16 
attitude, 6/2-4 
audits, 5/12; 6/6,13; 8/5,11 
Center for Chemical Process Safety 
guidelines for, 6/16-19 
commitment and leadership, 6/4 
environmental, All/10—11 
hazard assessment and role of, 9/51-52 
importance of, 6/2 


knowledge, 6/13-14 
offshore management, A18/4 
organization, 6/4—5 
for plant commissioning, 19/5—6 
process safety, 6/15—16 
qualifications needed by, 6/5 
quality, 6/9 
references on, 6/2,6 
safety, 6/9-13 

safety performance and role of, 1/2 
safety reviews conducted by, 6/5 
software, 13/56 
in warehouses, 22/66 
Management oversight and risk tree 

(MORT) accident model, 2/4,5; 9/51; 
27/4; 28/9; 31/19,23-24 
Management responsibilities 
audits, 5/12; 6/6,13, 20 
checks, independent, 6/6,9 
documentation, 6/6,7-8 
modifications, 6/5-6 
pressure systems, 6/6 
MANAGER, 9/51-52; 28/10 
Man-Made Disasters (Turner), 2/2 
Man-made hazards, analysis of, 9/49 
Manning model, 14/67—68 
Manufacturing Chemists Association, 
A29/8 

publications of, A28/68-69 
Maplin Sands field trials, 15/200, 
210-211, 215, 216, 217,218, 219; 
16/173 

Marginal probability, 7/8-9 
MARIAH and MARIAH-II models, 
15/203, 250 
Marietta, Ohio, Al/32 
Marine pollution, All/25 
Marine/water transportation, 23/37 
accidents, 23/62,63—66,67,68, 
73-74,76-77 
ACDS report, A17/10-12 
chemicals, 23/43,46,61-62 
fires, 16/290-291; 23/52-57 
hazard assessment, 23/83-85 
inert gas systems, 23/56-57 
liquefied flammable gas, 23/57-61 
loading and unloading, 23/50—51 
LPG, 23/62-64 
piracy, 23/68 

ports and harbors, 23/50-52 
regulations/organizations, 23/46—50 
seaworthiness, 23/48 
ship design, 23/43 
ship groundings, 23/66,68 
ship movement, 23/46 
shipping industry, 23/42—46 
ships, cargo, 23/54-56 
static electricity, 23/56 
Markov models, 7/24-29,34—35 
Marshall model, 16/186-187 
Marsh Inc., 5/3,11 
Martinez, California, Al/68—69 
Mary Kay O’Connor Process Safety 
Center, 1/4,13; Al/2;A33/2 
Mass transfer 

pool vaporization and, 15/58—60 
Sutton-Pasquill model, 15/60-61 
Matagordo Bay,Texas field trials, 15/204 
Matching, 30/11 


Material flow, plant layout and, 10/4 
Material Safety Data Sheets (MSDS), 
4/32; 8/11-12; 18/10 
process design and need for, 11/3 
Material segregation, 22/67,68 
Materials properties, 8/11—13 
Maurer model, 15/49-51 
Maximum credible loss (MCL), 5/11 
Maximum experimental safe gaps 
(MESGs), 16/24,25 
Maximum exposure limits (MELs), 
18/18-20 

Maximum likelihood method, 7/57—58 
Maximum Probable Days Outage 
(MPDO), 8/13-17,27 
Maximum Probable Property Damage 
(MPPD), 5/12; 8/13-17 
McPherson, Kansas, 23/76; Al/40-41 
Mean beam length, 16/166-167 
Mean life, 7/11-12, 21 
confidence limits and, 7/48-50 
Markov model, 7/29 
Means-ends analysis, 30/25-26 
Mean time between failures (MTBF), 
7/12,61 

programmable logic controls (PLCs), 
13/48 

Mean time to failure (MTTF), 7/12 
Mean time to first failure (MTTFF), 
7/12 

Mean time to repair (MTTR), 7/12 
Measurement 
conversions, A30/2—6 
methods, 6/12-13 
problems, control and, 13/3 
Mechanical fatigue and shock, 12/80 
Mecklenburgh system, 10/22, 24 
Media, handling, 24/7 
Medical facilities, 24/7 
MEDLINE, 29/3 
Meldrin, Georgia, 24/14; Al/32 
Melting point tube test, 33/16 
MENTOR, 30/59 

Merchant Shipping Acts, 23/47—48 
MERCURE-GL model, 15/203,243 
Mercury, 18/4,26; All/13 
MERITT, 32/21 
Metal fires, 16/278 
Metallic arc welding, 12/17-18 
Metallic spiral wound gaskets, 12/25 
Metals 

hazards of, 18/26; All/13 
references on, 18/4 

Meteorology, effects on dispersion. See 
Dispersion, meteorology and 

Methane and LNG combustion, 17/166 
Methane Princess, 23/77 
Methanol plants 
hazards of, 11/58 
references on, 11/58 
Methyl isocyanate 
references on, 18/6 
toxicity of, 18/40 

Mexico, transportation organizations, 
23/6 
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Mexico City, Mexico, 1/3, 5; 22/71 
description of, A4/2-7 
emergency and aftermath, A4/6—7 
lessons learned from, A4/7 
MHAP studies on gas toxicity, 18/41-42 
MHIDAS, 29/3 
Microinfo, 29/3 
MIDAS, 30/99 
Mild/carbon steel, 12/12 
Milford Haven, UK, 22/71; Al/54 
MIL standards on reliability, 7/6 
Mineral Management Service (MMS), 3/3; 
A33/4 

Mine Safety and Health Administration 
(MSHA), 3/3; A33/4 
Minimata Bay, Japan, All/26 
Minimax method search, 30/21 
Minimum cut sets, 9/17-18, 20, 21-22 
Minimum effective safe gap (MESG), 
17/55 

Minimum explosive concentration (MEC), 
17/257-258 

Minimum ignition energy (MIE), 16/20, 
21,38 

aerosols and, 16/54, 56 
dusts and, 17/258 

Ministry of Defense (MOD), software 
standards, 13/56-57 
Ministry of Home Security, publications 
of, A28/69—70 

Minuteman Launch Control System, 9/12 
Missiles, damage from, 17/179,196-216 
accidents, 17/196,197 
air resistance and shape of, 17/203 
from BLEVEs, 17/171-172, 206-209 
Canvey Reports , A7/12 
categories of, 17/196 
CCPS, 17/209 

craters, debris from, 17/211 
debris from, 17/211 
departure angles, 17/203 
flight of, 17/203-205 
fragments (cased explosives) from, 
17/216-221 

impact effects, 17/211-213, 214-216 
initial velocity of, estimating, 
17/199-203 

number and size of, 17/196,199 
plant design and, 17/214 
range of, 17/205-206 
references on, 17/196 
vessel burst pressure, 17/196 
Mission problem, 9/13 
Mississauga,Toronto, 23/73; 24/14; Al/51 
Mistakes, modeling of, 14/77 
MITI model, 16/220 
MiUi, 23/77 

Mixed integer linear programming 
(MILP), 30/48 

Mixed layer scaling and height, 15/97 
Mixers, 11/30 

Mixing length theory, 15/78-79 
Mizner-Eyre model, 16/206 
Mobil Oil Co., Ltd., A7/6 
MOCARS, 30/77 
MOCUS, 30/77 
Modeling 


consequence, 8/27, 57 
languages, 30/48 
qualitative, 30/41-43 
MODEL.LA, 30/48 
MODEX, 30/99 
Modifications 
chains, 11/20—21, 22 
documenting, 21/50 
equipment, 21/44-47 
hazards of, 21/45-46 
identifying, 21/49 
inspection of, 21/49-50 
management responsibility for, 6/5-6; 

21/47-50 

for plant commissioning, 19/7 
problems, 21/50 

process design and making, 11/4 
safety assessment of, 21/49 
types of, 21/44 
Modular plants 

advantages and disadvantages of, 10/31 
barge, 10/32 

plant layout and, 10/31-33 
Molecular seals, 12/71 
Molten metal-water explosions, 17/176 
Moments method, 7/57 
Momentum, dispersion, 15/72,73 
momentum flux, 15/78-79 
Momentum jets, 15/136-137,145,281-283 
Mond Fire, Explosion and Toxicity Index, 
5/12; 8/17-19,22,26, 28,29; 32/11 
separation distances, 10/16 
Monin-Obukhov length, 15/86-87 
Monitoring 

acoustics emissions, 19/44-47 
condition, 19/34-39 
control and, 13/3 
corrosion, 19/42-44 
equipment, 19/32-34 
hazards, 4/4; 6/12 
operations, 27/3-4 
performance, 19/34; 27/20-23 
pipelines, 19/47,48 
process, 30/92-93 
vibrations, 19/39-42 
Monomers, storage of, 22/54-55 
MONPAC, 19/46 
Montana, Mexico, Al/52 
Monte Carlo simulation, 7/29-32; 9/78 
fault trees and, 9/22 
Montreal, Canada, Al/31-32 
Moore model, 17/199-200 
Moore-Rees model, 15/310-312 
Moorgate Station train crash, 14/55 
Moorhouse model, 16/206 
MORT (management oversight and risk 
tree) accident model, 2/4,5; 9/51; 27/ 
4; 28/9; 31/19, 23-24 
Mortality index, 8/26 
Mortality rates 
burns and, 16/247-248 
dust explosions and, 17/289-290 
Morton-Nettleton model, 17/42-43 
Mossmorran inquiry, 4/29; A26/2 
Move generation and evaluations search, 
30/21 

Multimedia aids, 30/92-93 
Multinomial distribution, 7/13 


Munday model, 17/200 
Munitions 

explosions, 17/122,123 
fireballs, 16/188 
MYCIN, 30/28,36,38 


Nagothane, India, Al/62 
Nagy-Verakis model, 17/41,75-76,280 
Naive physics, 30/41 
NASA, 1/8; 33/12; A29/8 
Natchitoches, Louisiana, 23/75; Al/33 
National Association of Corrosion 
Engineers (NACE), 21/2 
National Board Inspection Code (NBIC), 
21/2 

National Bureau of Standards, A28/70; 
A29/8 

National Centre for Systems Reliability 
(NCSR), 7/6; A14/11—12 
publications of, A28/70 
National Center of Toxicological Research 
(NCTR), 18/24 

National Electronic Injury Surveillance 
System, A33/3 

National Environmental Law Center, 1/4 
National Environmental Policy Act (1969) 
(NEPA), 3/4 

National Fire Protection Association 
(NFPA), 5/2,3; A27/3; A33/4 
address/website for, A29/8 
classification, packaging, and labeling, 
23/12 

classification of fire, 16/13-14 
classification of flammable and 
combustible liquids, 10/14 
classification of reactive chemicals, 
33/10 

electrical equipment, 16/129,130-131 
emergency planning, 24/4,15—20 
explosion relief of buildings, 17/89 
explosion venting of ducts and pipes, 
17/85-87 

filling ratios, 22/61 
fire and role of, 16/2; 21/2 
fire extinguishers, 16/277 
fire heaters and furnaces standards, 
12/34 

fire relief, 12/53 
foam, 16/269 

hazardous area classification, 10/20; 
16/135 

laboratory codes, A9/3—4 
marine transportation, 23/47 
publications, 24/15-20; A28/70 
static electricity, 16/127 
storage of petroleum products, 22/5 
water for fires, 16/265, 266 
National Infrastructure Protection 
Center, 35/4 

National Institute for Chemical Safety, 1/4 
National Institute for Occupational Safety 
and Health (NIOSH), 18/9; 21/2; 25/7; 
A29/8; A31/2 
database, A33/3-4 
emergency exposure limits, 18/27 
NIOSHTIC, 29/3 
publications of, A28/70-71 
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National Institute of Justice, 35/4 
National Institute of Safety and Health, 
24/15 

National Pesticide Information System, 
29/3 

National Radiological Protection Board 
(NRPB), 15/126,129,131 
publications of, A28/71-72 
National Research Council (NRC), A29/8 
emergency exposure limits, 18/27 
National Response Center (NRC), A29/8 
Incident Reporting Information System 
(IRIS), 2/7-8; 29/3; A33/2 
National Safety Council, 5/2,4; A29/8 
publications of, A28/72-73 
National Transportation Safety Board 
(NTSB), 21/26,69; 27/9; A29/8; 
A33/4 

publications of, A28/73-76 
Natural Gas Act (1938), 3/5 
Natural Gas Pipeline Safety Act (1968), 
3/5; 4/31; 23/37 

Natural hazards, analysis of, 9/48-49 
Natural language, 30/6,24 
Near miss reporting, 27/23-24 
NEOMYCIN, 30/36 

Netherlands, process hazard control and, 
4/31 
Networks 

associative, 30/17-18 
neural, 30/29,31,100 
Neunkircken, Germany, Al/26 
Nevada test site (NTS), 15/205 
Burro trials, 15/200, 203, 210,212, 

213,214 

Desert Tortoise trials, 15/211,213-214, 
219,220 

Eagle trials, 15/211, 213-214 
Goldfish trials, 15/214-215,220,221, 
315 

Hawk trials, 15/215,307,315 
New Jersey Toxic Catastrophe Prevention 
Act (TCPA) (1985), 4/32 
New Jersey Turnpike, Al/40 
Niigata, Japan, Al/32-33 
NIOSHTIC, 29/3 
Nitrates, All/13 

Nitrate stress corrosion cracking, 12/85 
Nitration reactions, 11/28 
Nitrator unit 
hazard rates, 13/55 
programmable electronic system 
applications, 13/51-54 
Nitrogen, uses for, 11/39 
Nitrogen oxides, toxicity of, 18/40; 

All/13 

NML (maximum loss), 5/11 

NOAH, 30/26 

Noise 

controlling, A12/4-6 
laws/regulations, A12/2 
in process plants, A12/2-3 
references on, A12/2 
terminology, A12/3—4 
Noise Control Act (1972), 3/4 
Nominal diagnosis model, 14/67,68 
Non-classical logic, 30/7,10-11 


Non-deductive inference, 30/10 
Non-destructive testing (NDT), 19/25-29 
Non-equilibrium models, 15/19 
Fauske, 15/27-28, 29 
Non-homogeneous two-phase flow, 15/20 
NONLIN, 30/27 

Non-return valves (NRVs), 12/27-28 
Norco, Louisiana, Al/57 
Nordic Liaison Committee for Atomic 
Energy, A28/76 

Normal distribution, 7/16-17,52, 54 
Normalizing, steel, 12/15 
North American Electric Reliability 
Council, 35/4 

North Sea Offshore Regulatory 
Administration, A18/2—4 
Notification of Installations Handling 
Hazardous Substances (NIHHS) 
regulations (1982), 4/17,18,27-28; 
22/20,35-36,66; 23/50 
Nuclear energy 
industry, A20/4 
radiation, A20/3-4 
references on, A20/2-3 
Nuclear hazards, references on, 4/14 
Nuclear Installations Act (1959), 19/18 
Nuclear Installations Inspectorate (Nil), 
4/13,14 

Nuclear Installations (Licensing and 
Insurance) Act (1959), 4/14 
Nuclear plants/reactors 
See also Chemical reactors; Explosions, 
venting reactors; Unit processes 
accidents, 33/2-3,4-6,7; A20/8-10 
accidents, reporting, A20/8 
design, A20/5 

earthquakes and, A15/17-18 
emergency planning, A20/8 
hazard assessment, A20/6-7 
licensing of, 4/13-14 
operation of, A20/7-8 
recovery mistakes of commission, 
14/79,82 

references on, 4/14 
reliability, A20/5-6 
safety case, 4/14 
sites for, 4/14, 31 
types of, A20/5 

Nuclear pressure systems, A20/7 
Nuclear Regulatory Commission (NRC) 
address/website for, A29/8 
dispersion models, 15/69 
earthquakes and, A15/18 
expert judgment, 9/46 
PRA Procedures Guide, 9/9 
publications of, A28/87-109 
role of, 21/2 
stability, 15/88 
Three Mile Island, A21/8 
Numerical models, vapor cloud 
explosions and, 17/164—166 
Nusselt number, 15/59 


Oak Ridge National Laboratory (ORNL), 
A20/4; A29/8 

Object oriented programming(OOP), 30/17 


Obstructions, flares and, 12/70 
Occupational exposure limits (OELs), 
18/16-21; 25/10,13-14 
Occupational health, 25/6-7 
Occupational hygiene, 25/7—11 
Occupational Illness and Injury Statistics 
(OIIS), A33/3 

Occupational safety, history of, 3/2-3 
Occupational Safety and Health Act 
(OSHA) (1970), 3/2,3,4; 21/2; 31/2 
Occupational Safety and Health 
Administration (OSHA), 1/4 
accident classification, 2/10 
accidents, investigating, 27/9; A33/3 
address/website for, A29/8 
benzene, 18/23 
carcinogens, 18/22, 23 
confined spaces, 21/12-13 
emergency planning, 24/15 
fire relief, 12/53 
General Duty Clause, 1/5 
hygiene standards, 18/18 
isolation, 21/7 

maintenance of lifts, 21/23, 24 
permits, 21/14 
plant operation, 20/2, 3 
ports and harbors, regulations, 

23/50 

Process Safety Management Rule, 

4/32; 6/15; 24/15; 31/28-31; 
A31/2-5 

publications of, A28/76 
references on, 3/2 
role of, 21/2; 33/6; A31/2; A33/4 
Special Emphasis Program, 4/32 
toxic chemicals, 18/9,15—16 
vinyl chloride, 18/24 
Odors, All/23-24 
Office of Pipeline Safety Operations 
(OPSO), 4/31 

Offshore barge modular plants, 10/33 
Offshore Reliability Data (OREDA), 
A14/13 

Offshore safety 
design, A18/4-7 
emergency planning, A18/7 
event data, A18/8 

Gulf of Mexico Offshore Regulatory 
Administration, A18/4 
laws, A18/3 
management, A18/4 
North Sea Offshore Regulatory 
Administration, A18/2-4 
references on, A18/2-3 
Off-site emergency planning, 24/11—12 
Ohm’s law, 16/85 

OHMTADS (Oil and Hazardous Materials 
Technical Assistance Data System), 
18/9; 29/3 
Oil industry 

See also Petroleum products 
fatal and major accident rates in, 2/11, 
12 

loss prevention development in, 

1/4-5 

separation distances, 10/18 
Oil Insurance Association, A28/76-77; 
A29/8 

Oil Insurance Limited (OIL), 5/10 
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Oil Pollution Act (OPA) (1990), 23/49 
Oil spills 
analysis of, 19/37 
controlling, 23/71-73 
laws and reporting requirements, 2/7 
Oil tankers, static electricity in, 
16/114-116 
Olefins plants 
hazards of, 11/58-60 
references on, 11/58 
OMOLA, 30/48 

ONDEK computer code, 15/261 
On-line repairs, 21/35-36 
On-site emergency planning, 24/3-5 
On-site production of chemicals, 11/19 
Ooms model, 15/257—258, 261 
Operating conditions, extreme 
high pressure, 11/32-33 
high temperature, 11/34 
low pressure/vacuum technology, 11/33 
low temperature/cryogenics, 11/34 
pressure relief and, 12/56 
references on, 11/33 
Operating procedure synthesis (OPS), 
30/81,85,87-92 

Operational deviations, process design 
and, 11/60,62-64 

Operator action event trees (OAETs), 9/51; 
14/74,76 

Operator reliability and assessment 
(ORCA), 14/79 
Oppau, Germany, Al/25 
Opschoor model, 15/68 
OPS5, 30/36,41 
Optimization 
control and, 13/4 
human error and, 14/51 
Organic peroxides, storage in 
warehouses, 22/70 

Organizational model, human error and, 
14/47 

Organizations, list of 
in Europe, A29/9 
in other countries, A29/9-11 
in the UK, A29/2-5 
in the U.S., A29/5—9 
Outer Shelf Lands Act (1978), 2/7 
Overpressure 
damage data, 17/187-191 
sources of, 12/45-46 
standards, 12/43-47 
Overpressure protection 
See also Pressure relief 
bursting discs, 12/64-65 
design basis documentation, 12/66-67 
disposal, 12/57-60 
fire relief, 12/51-53 
pressure relief devices, 12/47—50, 
65-67 

pressure relief valves, 12/60—64 
references and standards, 12/43—47 
relief system design, 12/50-51 
special situations, 12/56-57 
vacuum and thermal relief, 12/53—56 
Oxidation reactions, 11/26-27 
Oxidation resistance, steel and, 12/13 
Oxidative self-heating, 16/75-76 
Oxyacetylene welding, 12/17 


Oxygen 

deficient atmospheres, 21/13 
enriched atmospheres, 21/13—14 
flammability in, 16/25 
hazards of, 11/51; 25/29 
references on, 11/44 
storage of, 22/54 


Pacific Ares, 23/76 
Packaging 
accidents, 23/73 
regulations, 23/9-12 
Padding, for chlorine, 12/78 
Paired comparisons, 9/44-46; 14/81 
Palaniappan-Srinivasan-Tan index, 
32/13-14 

Palmer model, 17/278-279 
Pampa,Texas, Al/57 
PANDORA, 30/25 

Parallel systems, reliability and, 7/19-20, 
21 

joint density functions, 7/29 
Parameter estimation methods, 7/55-58 
Parametric correlation method (PCM), 
9/105 

Pareto distribution, 7/18 
Paris Memorandum of Understanding on 
Port State Control (1982), 23/47 
Pasadena,Texas, 5/3,10,11 
description of, A6/2-5 
emergency and aftermath events, 
A6/2-4 

events prior to explosion, A6/2 
lessons learned from, A6/4-5 
plant process and site, A6/2 
references on, A6/2 
Pascal’s triangle, 7/13, 20 
Pasquill-Gifford model, 15/107-111 
dispersion coefficients, 15/124-126, 
127-128 

dispersion coefficients, coastal areas, 
15/129-130 

dispersion coefficients, complex 
terrain, 15/130 

dispersion coefficients, NRPB, 
15/126-127,131 
dispersion coefficients, puff, 
15/132-133 

dispersion coefficients, urban areas, 
15/128-129,132,133 
sampling periods, 15/130 
turbulent exchange coefficients, 

Pasquill model, 15/106-107 
cloud parameters, 15/122,124 
Pasquill model, Sutton, 15/60-61 
Pasquill stability conditions/criteria, 
dispersion and, 15/87-92 
Passive dispersion. See Dispersion, 

Path breaks, 7/23 
Path tracing, 7/23 
Pattern recognition, 30/22, 31 
Pattern search method, 14/58-59 
Peak-to-mean ratio, 15/273 
Peclet number, 15/101, 225; 16/48 


Pensacola, Florida, Al/39 
Performance 
measuring, 27/19-20 
monitoring, 19/34; 27/20-23 
Performance shaping factors (PSFs), 
14/69,71,79,82-84 
Perlee-Fuller-Saul model, 17/41-42 
Permits/permit systems, 20/8; 21/5 
auditing, 21/21 
checklist, 21/21 
contents of, 21/15-16 
deficiencies of, 21/21 
design of, 21/20-22 
entry, 21/16-20 
forms, 21/16 
isolation and, 21/15 
objectives of, 21/14-15 
regulations, 21/14 
types of, 21/15,20 
Pernis, Netherlands, Al/35 
Personal probability, 7/7 
Personal protective equipment, 25/29-33 
Personal safety 
COSHH regulations, 25/11-15 
electrical hazards, 25/26 
first aid, 25/33-34 
human factors, 25/2,4-6 
injury statistics, 25/5—6 
lifting and carrying, 25/26-27 
machinery hazards, 25/24-26, 27 
occupational health, 25/6-7 
occupational hygiene, 25/7-11 
physico-chemical hazards, 25/20-22 
radiation hazards, 25/22-24 
references on, 25/2-4 
skin diseases, 25/20 
Personnel 

emergency planning, 24/9-10 
laboratory, A9/3 
limiting exposures, 20/20-21 
for plant commissioning, 19/4—5 
safety advisers, 28/6 
safety officer, 28/3 
safety professionals, 28/3 
safety representatives, 28/5-6 
training of, 21/5; A9/3 

Petal City, Mississippi, Al/43 
Peterborough, UK, Al/58-59 
Petroleum Administration for War (PAW), 
16/224 

Petroleum (Consolidation) Act (1928), 
16/129; 22/66 

Petroleum Industry Training Board, 
A29/4 

publications of, A28/77 
Petroleum products 
See also Oil; under type of 
fluids, classification of, 16/137 
loading and unloading, 22/65 
standards on, 22/5 
storage of, 22/71 
Petroleum refineries 
fires, A14/37 
references on, 11/59 
Phased mission systems, 9/29 
Pheasant Wood inquiry, 4/29; A26/3 
Philip equation, 17/193 
PHI-TEC, 33/22 
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Phosgene 
accidents, 18/64 
hazards of, 11/51-52 
MHAP studies, 18/42 
references on, 11/44; 18/6,7,40 
storage of, 22/54 
toxicity of, 18/27,40 
Physical effect decays, 9/103,105, 
107-108,109 

Physical modeling, dense gas dispersion 
and, 15/223-236 

Physical transformations, 15/295-296 
Physico-chemical hazards, 25/20-22 
PICON, 30/59,98 

PIIS (Prototype Index of Inherent Safety), 
32/11-12 
Pilot plants, 8/13 
application, A10/2 
design, A10/4-7 

features and hazards, A10/3—4,7 
operation, A10/7 
programs, A10/7—8 
references on, A10/2 
scale-up, A10/4 
types of, A10/2-3 
Pipelines 
See also Pipes 
ammonia, 23/38-39 
chlorine, 12/76; 23/39 
failure of, 23/40-42; A7/11-12 
gas flow through, in vessels, 15/11—12 
hazard assessment, 23/82-83 
hydrogen, 23/38 
for LPG, 22/26-27 
regulations, 23/37 
Pipelines Act (1962), 23/37 
Pipeline spills 
accidents, 23/75-76 
controlling, 23/73 

laws and reporting requirements, 2/7 
Piper Alpha oil platform 
blowdown, 15/55 
company, A19/2 
description of, 27/9; A19/2-14 
emergency shut-down systems, 13/67; 

34/33 

events prior to explosions, A19/4—7 
explosion and rescue, A19/7-8 
field and platform described, A19/3-4 
gas riser protection, 12/42 
handover system, lack of, 20/8 
insurance issues, 5/3,4,10,11 
investigation of, A19/8-11 
lessons learned from, A19/11-14 
management and, 6/2,4 
public inquiry, 27/16-17 
recommendations, A19/14 
references on, A19/2—3 
total quality management and, 6/9 
Pipes (pipework) 

See also Pipelines 
ammonia, 23/38-39 
bellows, 12/26 
chlorine, 12/76; 23/39 
computer programs for, 29/2 

12/74 

dead legs, 21/39 
deflagration in, 17/32-33 
design, 23/38 


economics of, 23/37-38 
explosion venting of, 17/81-87 
failure of, 12/95-100; 23/40-42; 

A7/10-11; A14/15—16 
failure of, and human error, 14/50 
fireballs on, 16/188 
fire protection, 22/20 
flanged joints, 21/25-27 
fluid transients, 12/31-32 
fractures, analysis of, 9/6-7 
gas flow through, in vessels, 15/11-12 
gaskets, 12/25 
high integrity, 12/26-27 
hydrogen, 23/38 
inspection of, 19/24-25,47,48 
isolation, 15/56; 21/7-8 
liquid flow through, 16/99-111 
for LPG, 22/26-27 
plant layout and, 10/13-14 
powder flow in, 16/119 
pressure systems and, 12/22-32 
references on, 12/22-23 
repairing, 21/35 
ring seals, 12/25-26 
ruptures, 15/54—56 
standards, 12/23-25 
supports, 12/25 
valves, 12/27-31 
welding, 21/27-28 

Piracy, 23/68 

Pitting, 12/84 

Planetary boundary layer, 15/75—76 

Planning 

emergency, 1/9; 4/28-29; 8/74 
local planning authorities (LPAs), 

4/15,16,21, 25, 27, 28, 30 
process hazard control, 4/21-30 
reforms, 4/27-28 

of safety management system, 6/12 
system, 4/21, 24-25 

Planning, artificial intelligence and 
action synergy, 30/27 
blocks, 30/25 

complexity measures, 30/25 
decision theory, 30/28 
domain dependency, 30/28 
events and actions, 30/25 
frame problem, 30/25 
General Problem Solver, 30/26 
goals, 30/25, 26 
hierarchical, 30/26 
linear and non-linear, 30/26 
means-ends analysis, 30/25—26 
monitoring, 30/27 
NOAH, 30/26 
NONLIN, 30/27 
non-subgoaling, 30/26 
operators, 30/25, 26-27 
reactive, 30/27-28 
references on, 30/24 
requirements, 30/24 
search and, 30/25 
state graph, 30/26 
STRIPS, 30/25, 26 
subplan merging, 30/27 
temporal, 30/28 
theorems, 30/26 
TWEAK, 30/26 

Planning and Compensation Act (1991), 
4/28 


expansions, 21/50-51 
pilot, 8/13; A10/2-8 
safety audits, 8/70,71,72-73; 19/11 
siting, 4/14,31; 10/2; 22/62-63,67 
size and costs, 1/6,7 
size and safety, 11/21 
Plant inspection. See Inspection(s) 

Plant layout/design 
access and operation issues, 10/11 
analysis, 30/58 

blast-resistant structures, 10/29 
buildings, location and use of, 10/8 
central services, location of, 10/8 
classification, rating and ranking, 10/5, 
20-22 

computer aides for modeling, 10/5 
construction issues, 10/10-11 
control buildings and, 10/29-30 
correlation and compatibility, 10/4 
costs and, 5/5; 10/5,10 
critical examination, 10/5 
deflagration and, 17/33 
detonation and, 17/35 
drain systems, 10/28-29 
effluents, 10/9,27-28 
emergencies and, 10/10 
equipment and, 10/12—13 
exposure, limitation to, 10/8 
factory, 10/3-4 

fire containment and protection, 
10/8-9, 24-27 
generation, 10/3—4 
groups, 10/4 

hazard assessment and, 10/5, 22 
hazardous area classification, 
10/20-22,23 
hazards, 10/11-12 
human error and, 14/50—51 
for loading and unloading facilities, 
22/62-63 

maintenance issues, 10/11 
material flow and, 10/4 
missiles and, 17/214 
models, 9/56,62; 10/5, 22,24 
modular plants, 10/31-33 
offshore, A18/4-7 
pipes and, 10/13-14 
planning and development, 10/6—7 
plot layouts, features, 10/10-12 
plot layouts, planning, 10/6,7 
process, 10/4 
references on, 10/2-4 
relationships, identifying, 10/4 
security issues, 10/10 
segregation of hazards, 10/4,8 
separation distances, 10/15-20 
site layouts, features, 10/7-10 
site layouts, planning, 10/6—7 
storage, 10/14-15; 22/13-16 
synthesis, 30/50-58 
techniques and aids, 10/5 
three-dimensional model, 10/4 
toxic gas release, 10/30-31 
toxic substances and, 18/59—60 
transportation method and, 10/10 
vapor cloud explosions and, 17/167 
in warehouses, 22/67 
Plant operation 
discipline, 20/2 
for dryers, 20/14 
emergency procedures, 20/6-8 
for fired heaters, 20/13 
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handover and permit systems, 20/8 
hazards, 20/16-18 
instructions/manual, 20/5—6 
labeling and identification of 
equipment, 20/20 
limiting exposure to personnel, 
20/20-21 

procedures, 20/3—4 
references on, 20/3 
regulations, 20/2,3 
sampling, 20/18-20 
security issues, 20/21-22 
simplifying, 32/9-10 
SRDA guide, 20/4-5 
start-up and shut-down, 20/9-13 
for storage tanks, 20/14-16 
training for, 20/8—9 
trip systems, 20/20 
Plant operators, roles of 
maintenance, 20/9 
modifications, making, 20/9 
monitoring, 20/9 
Plaquemine, Louisiana, Al/47 
Plastic deformation, 12/89 
Plate heat exchangers, 11/16 
Plausibility theory, 30/12 
Plot layouts 
features, 10/10-12 
planning, 10/6,7 
PLUME, 15/266-269 
Plume(s) 
airborne, 15/266 
atmospheric conditions, 15/269 
buoyant, 15/266,268,283-284 
development, 15/266 
drag, 15/266,268 
energy, 15/266, 268 
entrainment, 15/268-269 
Gifford meandering, 15/273-274 
model characteristics, 15/113-114 
Ride passive, 15/274 
shear, 15/266, 268 
slumped, 15/268 
touchdown, 15/266, 268 
Wilson passive, 15/274-276 
Plumes, dispersion of, 15/134 
in atmospheric turbulence, 

15/143-144,145,151 
bent-over, 15/149—150 
Briggs models, 15/147—152 
convective conditions, 15/151 
from elevated sources, 15/256—258, 
261-269 

estimating dispersion for passive, 
15/290-291 

ground level concentration, 15/151-152 
momentum, 15/151 
negative buoyancy and, 15/144 
principles of, 15/143 
references on, 15/135,142 
in stable conditions, 15/150 
in still air, 15/144 
vertical, 15/149,150 
in wind, 15/145-147 
Pneumatic conveying, 17/284 
Pneumatic testing, 19/30,31 
Poisson distribution, 7/13,15 
Poisson process, 7/27 
Poisson’s law, 16/86 
Polar Alaska, 23/77 
Pollution. See Environmental issues 


Polychlorinated biphenyls, All/13 

Pool fires 
features, 16/193 

flame characteristics, 16/198-199 
flame geometry, 16/194-198 
hazards of, 16/293 
heat radiated, 16/199-200 
models, 16/193, 203, 206 
references on, 16/190-191 
regimes, 16/193-194 
slot, 16/207 

in storage tanks, 16/206-207 
studies, 16/191-193 
view factors, 16/200-203,204-205 
Pool vaporization, mass and heat transfer, 
15/58-60 
Population 

composition, 9/62 
density, 9/57-58 
outdoor, 9/64 
vulnerable, 9/62,64 
Population characteristics, hazard 
assessment and, 9/56-59,62,64 
Population vulnerability model (PVM), 
9/54,56,57,58, 59,60,61 
Port Chicago, California, Al/28 
Port Herriot, France, Al/57 
Port Hudson, Missouri, 23/76; Al/37-39 
Port Newark, Newjersey, 22/71; Al/29 
Porton Down field trials, 15/208-210,211, 
212,226,228,229,238 
Ports and harbors, regulation of, 
23/50-52 

Ports and Waterways Safety Act (1972), 
3/5 

Positive displacement pumps, 12/41 
Post-weld heat treatment (PWHT), steel, 
12/15,21,22 

Potchefstroom, South Africa, 22/71; 

Al/41 

Powders 

See also Dust; Dust explosions 
discharge, incendive, 16/119—120 
fire protection and, 16/276-277 
flammability of, 16/62 
flow in pipes, 16/119 
static electricity and, 16/117-120 
storage silos, 16/119 
Power compensation calorimetry, 
33/20-21 
Power supply 
emergency, 24/6 
failure of, A14/32-33 
Prandtl number, 15/59,225 
PRA Procedures Guide, 9/9 
Predicate calculus, 30/15-16 
Predicate completion, 30/13 
Predicate logic, first order, 30/7,9-10 
Predictive human error analysis (PHEA), 
14/59 

Preliminary hazard analysis (PHA), 8/27, 
29-30,34,57 

Preliminary safety analysis (PSA), 8/57 
Premium rating plans, 5/12,13-15,16 
PREP, 30/77 

Prepositional logic (PL), 30/7,8—9 


PREPROP, 15/43 
President’s Commission on 

Environmental Quality (CEQ), 3/4 
Pressure containment, 12/72-73 
Pressure drop, emissions and, 15/5-6,19 
Pressure-impulse (P-I) diagrams, 
17/192-193,194,195-196 
Pressure piling, 17/31-32,35 
Pressure Piping Systems Examination 
Code (IP), 19/24-25 
Pressure relief 

See also Overpressure protection 

bursting discs, 12/48-49,50 

for chlorine, 12/78-79 

computer programs for, 29/3—4 

configurations, 12/51 

designing, 30/56,57 

devices, 12/47-50,65-67 

documentation, 12/66-67 

extreme operating conditions and, 12/56 

identification of, 12/46-47 

installation of devices, 12/65—67 

location of devices, 12/50 

problems with, 12/72 

sizing of, 12/51 

in tankers, 23/14 

Pressure relief valves, 12/47-48,60- 64, 
66; 15/39-42; 21/35-36; 22/16 
for ammonia, 22/48,51 
for chlorine, 22/43,45 
failure of, A14/19, 22 
for LNG, 22/37 
for LPG, 22/28-29,35 
Pressure storage 
accidents, 22/72 
of ammonia, 22/48-49 
of LPG, 22/20-33,73-74,75 
tanks, 22/11-12 
Pressure systems 
blowdown systems, 12/72 
for chlorine, 12/75-79 
components, 12/8 
depressuring systems, 12/52,72 
design of vessels, 12/15-17 
deviations, 11/62 
failure in, 12/79-87 
failure of vessels, equipment, and 
machinery, 12/92-104 
fired heaters and furnaces, 12/34—36 
flare and vent systems, 12/67-72 
fracture mechanics, 12/87-92 
heat exchangers, 12/32-34 
insulation, 12/41-43 
joining by fastening, 12/17 
joining by fusion welding, 12/17-18 
maintenance of, 21/36-37 
management’s responsibility for, 6/6 
nuclear, A20/7 

operating conditions and high, 
11/32-33 

operating conditions and low, 11/33 
overpressure protection, bursting 
discs, 12/64-65 

overpressure protection, disposal, 
12/57-60 

overpressure protection, fire relief, 
12/51-53 

overpressure protection, pressure relief 
devices, 12/47-50,65-67 
overpressure protection, pressure relief 
valves, 12/60-64 
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overpressure protection, references and 
standards, 12/43-47 
overpressure protection, relief system 
design, 12/50-51 
overpressure protection, special 
situations, 12/56-57 
overpressure protection, vacuum and 
thermal relief, 12/53-56 
pipework and valves, 12/22-32 
pressure containment, 12/72-73 
process machinery, 12/36-41 
references on, 12/2-5 
references on construction materials 
and corrosion for, 12/5—8 
standards and codes, 12/18-22 
steel properties, 12/8-15 
testing, 19/29-31 
toxic materials containment, 

12/73-75 
valves, 12/27-31 

Pressure tank systems, fault trees and, 
9/22-26 

Pressure Vessel Examination Code (IP), 
19/20-24 

Pressure Vessel Quality Assurance Board 
(PVQAB), 12/22; 19/18 

Pressure vessels 
See also Pressure systems 
accidents, 22/72 
for chlorine, 12/75-76 
classification of, 12/19-22 
decommissioning, 22/72 
design of, 12/15-17 
failure of, 12/92-94; A7/10,31; 
A14/14—15 

inspection of, 19/19,20-24 
maintenance of, 21/36 

Pressure Vessels Technical Committee 
(PVTC), 12/22 

Pressurized water reactors, A20/5 

Priola, Italy, Al/55 

Probabilistic risk analysis (PRA). See 
Risk assessment 

Probabilistic safety analysis (PSA). See 
Risk assessment 

Probabilistic theory/reasoning, 30/7,11, 
13-14 

Probability 
See also Reliability 
Bayes’ theorem, 7/10 
conditional, 7/9 
defined, 111 
event rate and, 7/11 
fracture mechanics, 12/92 
independence and conditional 
independence, 7/9—10 
joint and marginal, 7/8—9 
methods and reliability, 7/6 
of mistakes of commission, 14/79 

relationships, 7/7—10 
set theory and Boolean algebra, 7/7-8 
theory/reasoning and artificial 
intelligence, 30/7,11,13-14 
of unions, 7/8 

Probable maximum loss (PML), 5/8,10,11 

Probit equations, 9/68-70,102 
for chlorine, 18/49-50, 51,54 
for gas toxicity, 18/55—56 

Problem solving, 30/22-23,26 


Procedures for Conducting Probabilistic 
Safety Assessment of Nuclear Power 
Plant (IAEA), 9/9 
Process-based modeling, 30/42 
Process compressors, 12/38—39 
Process design 

See also Unit processes 
assessment, 11/11—13 
communication and documentation for, 
11/4 

computer aided design, 11/8 
conceptual/front end stage, 11/8—10 
for containment, 11/19 
critical examination, 11/12 
data needed for, 11/3 
detailed stage, elements in, 11/10-11 
earthquakes and, A15/18-21 
error propagation, 11/4 
exposure, limitation to, 11/21,23 
fail-safe, 11/21 
flexibility issues, 11/20 
function analysis system technique, 
11/12 

HSE and, 11/23 

inherently safer, elements in, 11/13—24 
lack of progress in safer, reasons for, 
11/23 

layers of protection, 11/21 
licensors, vendors, and contractors, 
11/13 

modification chains, 11/20-21, 22 
modifications, making, 11/4 
operability, 11/21 
operational deviations and, 11/60, 
62-64 

overdesign, 11/4 

overpressure problems and, 11/19 
plant size and, 11/21 
process risk management strategies, 
11/2-3 

references on, 11/3 
second chance, 11/21 
simple, 11/19 
stages,11/3 

standards and codes, 11/4 
storage areas, 11/18-19 
value improving practices, 11/12-13 
value methodology, 11/12 
Process flowcharts/diagrams/symbols, 
13/44,45 

Process hazard control 
See also Hazard control 
Advisory Committee on Major Hazards 
(ACMH), 1/2,5; 4/15-17 
background of, 4/14-15 
European Community and, 4/30-31 
legislation/regulations on, 4/17-21 
planning, 4/21-30 
references on, 4/15 
U.S. and, 4/31-32 
Process industries/plants 
classification of fire, 16/14 
explosions in, 17/174-177 
failure in, 12/100,101-104 
fire in, 16/154-159, 279-283; A14/37 
human error in, 9/49-51; 14/48-51, 
54-57 

plant layout, 10/4 
reliability engineering and, 7/6 
separation distances, 10/19 
Process machinery 


centrifugal compressors, 12/39 
centrifugal pumps, 12/40—41 
gas engines, 12/40 
failure of, 12/100,101-104 
positive displacement pumps, 12/41 
process compressors, 12/38-39 
process pumps, 12/40 
reciprocating compressors, 12/39 
references on, 12/36-38 
screw compressors, 12/39-40 
Process monitoring, 30/92-93 
Process operators 

See also Human error 
allocating functions to, 14/10—11 
computer-based aids for, 14/19—21 
functions of, 14/7 
selecting, 14/35-36 
task analysis, 14/29-30 
training and, 14/36-43; 20/8-9 
studies, 14/7-10 
Process pumps, 12/40 
Process risk management strategies, 
11/2-3 

Process Safety Management 
description of, 24/15; 31/28-31; 
A31/2-5 

Rule, 1/3; 4/32; 6/15 
types of systems, 6/15-16 
Process safety review system, 8/27-28, 
57-62 

PRODES, 30/99 
Production rules, 30/10 
Production systems, 30/19 
Programmable electronic systems (PES), 
13/62 

configuration, 13/48, 50-51 
design issues, 13/51 
HSE guidelines, 13/48 
nitrator unit applications, 13/51—54 
quality of, 13/51 
reliability, 13/51 
software issues, 13/51 
for trip system, 13/34 
Programmable logic controls (PLCs), 
13/14,47-48,53 

Programming languages, 30/7,14—17 
Project evaluation and review technique 
(PERT), 19/5 
Projection welding, 12/18 
Prolog (Programming in Logic), 30/16—17, 
36 

Proof testing of trip systems, 13/28-29 
Propane, dispersion of, 15/253 
Propellants, fireballs from, 16/188-189 
Property damage 
business interruption and, 5/17 
statistics on, 5/3 
Property insurance, 5/11-16 
measuring methods of loss, 5/11 
Proportional hazards modeling, 7/58 
Propylene storage, A8/10,16 
PROSPECTOR, 30/13, 38,58 
PROTECT, 13/37 
Protective systems 
See also type of 

dependent failures and, 9/34-35 
fault trees and, 9/29-30 
layers in, 11/21 
Prugh model, 16/251-252 
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PSAIS (Plant Safety AI System), 30/63 
Public 

information for the, 4/29 
inquiries, 4/29-30; 27/9,15-18; 

A26/2-6 
relations, 24/11 
Puebla, Mexico, Al/48 
Puff dispersion coefficients, 15/132-133 
Puff model characteristics, 15/114 
Pulsed arc welding, 12/18 
Pumps 

cavitation, 12/40,41 
centrifugal, 12/40-41 
for chlorine, 12/78 
deadheading, 12/40-41 
dry running, 12/41 
failure of, A14/16-18 
fires, 16/154 
maintenance of, 21/39 
plant layout and, 10/13 
positive displacement, 12/41 
process, 12/40 
seal-less, 12/40 

Pump set systems, fault trees and, 
9/28-29 
Purge gas, 11/39 
Purging, 21/10 

operating procedure synthesis (OPS), 
30/88-89 
Puzzles, 30/23 

Pyrophoric materials, as ignition source, 
16/63 


Qualitative modeling, 30/41-43 
Quality assurance, 1/11; 6/9 
hazard identification and, 8/47, 51, 
74-79 

HAZOP and, 8/47, 51 
software, 13/56 
Quality control, 1/11 
reliability and, 7/6 

Quantitative risk assessment (QRA), 1/9; 
4/11,12; 33/41 
See also Risk assessment 
decision making and, 9/9-11 
guidelines, 9/9 

Quantum chemistry methods, 33/13-14 
QUEEN, 30/63 

Quenching 

blowdown systems, 12/72 
distances, 16/23-25,47-49 
steel, 12/15 

venting reactors, 17/117 


Radian Corp., 15/319 

Radiant heat transfer, 16/160-172 

Radiation 

angle and view factors, 
16/171-172,173 
atmospheric transmissivity, 
16/168-171 

black body, 16/160-161 
exchange, 16/162-163 
hazards, 25/22-24 
heat, 16/164-167 
infrared, 25/24 


ionizing, 25/22-23 
laser, 25/24 

limits for exposure, 25/23 
measuring, 25/23 

non-black and gray body, 16/161-162 
non-ionizing, 25/23-24 
participating media, 16/162 
target absorptivity, 16/171 
thermal, 16/160, 239 
types of, A20/3 
ultraviolet, 25/24 
units of, A20/3 
Radioactivity, 8/12 
decay, A20/3-4 
health effects, A20/4 
Radio frequency transmissions, as 
ignition source, 16/63-64,65,66 
Radiography, 19/26 
Rail Carriage Regulations (RID), 
23/8-9,10 
Rail tankers 
design, 23/33 

static electricity in, 16/111-114 
Rail transportation 
accidents, 23/34-36,73,75 
ACDS report, A17/8-9 
derailments, 23/35 
fire and, 16/290; 23/35 
hazard assessment, 23/80—81 
hazards, 23/33 

loading and unloading, 22/64—65 
regulations, 23/32-33 
releases, 23/35-36 
tunnels, 23/37,81-82 
Raj-Emmons model, 16/175-176 
Raj model, 15/67-68 
Rankin-Hugoniot conditions, 17/7—9 
Ranking, 7/51 

rapid, of hazards, 8/69-70,71 
Rare events, 9/47-49 
Rasbash model, 17/63,88 
Rasmussen Report, 2/4,6 
Browns Ferry accident, A23/9,12 
common mode failure, A23/4 
contents covered in, A23/3 
criticism of, A23/14-21 
debate over effectiveness of hazard 
assessment, 9/120 
dependent failures 9/33-34 
event data, 9/11; A14/9-10; A23/2,4 
events, rare, A23/4 
event trees, A23/5,6-7 
expert judgment, 9/46,47 
exposure mitigation, A23/7 
external threats, A23/4 
fault trees, A23/4,5 
hazard assessment, 9/9 
human error probabilities, 14/55,56; 
A23/4 

human evacuation, 9/66 
injury relations, A23/7,9 
pipework failure, 12/96,97 
population characteristics, A23/7 
references on, A23/2 
release scenarios, A23/7,8-9,10-12 
results, A23/9 
risk assessment, A23/2 
uncertainty, 9/79; A23/9 
RasTanura, Saudi Arabia, Al/57 
Reactant consumption, 16/76-77 


Reaction forces, pressure relief valves 
and, 12/66 

Reaction Hazard Index (RHI), 33/12 
Reactive chemicals/hazards 
accidents, 33/2-3 
defined, 33/7-8 
identifying methods, 33/7—46 
in laboratories, A9/4 
managing, 33/46-47 
mitigation measures, 33/43-44 
prevention measures, 33/42-43 
regulations, 33/3,6-7 
Reactive system screening tool (RSST), 
17/98-99 

Reactivity types, categorizing, 33/9 
REACTOR, 30/98 
Reactors. See Explosions, venting 
reactors 

Reactor Safety Study (RSS). See 
Rasmussen Report 
REASON, 31/25 

Reciprocating compressors, 12/39 
Reconditioning, 7/63-64 
Recovery mistakes of commission, 
14/79,82 

Recovery model, 14/68-69,74 
Rectangular distribution, 7/17-18 
Recycle, control and, 13/3 
Redundant systems, dependent failures 
and, 9/35 

Rees model, 16/113-114 
Reference temperatures, 23/16 
Refineries 

cost of losses and, 5/3-4 
fires, A14/37 
shut-down, 20/12-13 
start-up, 20/11-12 
Refrigerants, 11/40 
benefits of, 32/8-9 
emissions, 15/23,24,25 
Refrigerated pressure storage 
of ammonia, 22/49,51 
of LNG, 22/36-40 
of LPG, 22/33-35,74,76 
tanks, 22/11-12 

Regulations. See Laws/regulations 
Relational databases, 30/7-8 
Relative frequency, 7/7 
Relaxation length, two-phase flow and, 
15/23,25 
Fauske, 15/27 

Releases, scenario development, 8/27, 
55-57 
Reliability 
See also Probability 
apportionment, 7/60 
assessment and improvement, 7/6 
Bathtub curve, 7/11 
Beta distribution, 7/18 
binomial distribution, 7/13 
centered maintenance, 7/66-67 
defined, 7/6-7 

dependent failures and, 9/39-40 
error function, 7/18-19 
expected value, 7/12 
exponential distribution, 7/10—11, 
15-16 

extreme value distribution, 7/18 
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failure density and distribution 
functions, 7/10 

failure rate and unreliability, 7/11 
Gamma distribution, 7/18 
graphs, 7/21-22 
hazard rate and, 7/10 
hyperexponential distribution, 7/18 
log-normal distribution, 7/17 
Lusser’s product law of, 7/5 
mean life, 7/11-12, 21,29 
multinomial distribution, 7/13 
normal distribution, 7/16—17 
nuclear system, A20/5—6 
Pareto distribution, 7/18 
Poisson distribution, 7/13,15 
probability methods and, 7/6 
of programmable electronic systems, 13/51 
quality control and, 7/6 
rectangular distribution, 7/17-18 
relationships, 7/10-12 
software, 13/57 
standards, 7/6 
testing, 7/61-62 
of trip systems, 13/26-28 
Weibull distribution, 7/17 
Reliability engineering, 1/9 
applications of, 7/5-6 
availability, 7/28,32-38 
Bayes’ theorem, 7/10, 23-24, 38-39 
complex systems and, 7/21-24 
in design, 7/59-60 
development of, 7/5-6 
failure behavior, 7/45-47 
failure data analysis, 7/47—59 
failure definitions, 7/7 
failure distributions, 7/12-19 
failure models, 7/41-45 
failure rate and unreliability, 7/11 
growth, testing and demonstration, 
7/61-62 

joint density functions, 7/29 
life cycle costing, 7/67-69 
maintainability, 7/62-63 
maintenance activities and policies, 
7/63-66 

Markov models, 7/24-29 
Monte Carlo simulation, 7/29-32 
prediction, 7/60-61 
process industries and, 7/6 
references on, 7/2-5 
renewal theory, 7/39-40 
replacement models, 7/41 
standard systems and, 7/19-21 
Relief headers, 12/58-59 
Relief systems 
f ai lure of, A14/26-27 
safety factors for simple, A13/2—3 
Remaining life assessment, 21/38 
Removal processes. See Transformation 
and removal processes 
Renewal theory, 7/39-40 
Repair, 7/63-64 

Repairable systems, fault trees and, 9/28 
Repair rates, Markov model, 7/28-29 
Repair systems, reliability and, 7/20—21 
Repair time, constant, 7/21 
Repair time density function, 7/33 
Replacement models, 7/41,63—64 
Reporting of Injuries, Diseases and 

Dangerous Occurrences Regulations 
(RIDDOR), 2/11,12 


Reporting requirements 
for air pollution, 2/7 
for chemical spills, 2/7 
for oil spills, 2/7 
RESCU, 30/59 
Rescue, 25/33 

Research and Special Programs 
Administration (RSPA), 23/5 
Residual stress, pressure vessel design 
and, 12/16 

Resolution principle, 30/9-10 
Resource Conservation and Recovery Act 
(RCRA) (1976), 2/7 
references on, 3/2 
role of, 3/4; 22/58; All/10 
Respiratory protective equipment, 
25/30-33 

Responsible Care initiative, 1/13; 6/2 
Revealed dependent failures, 9/39 
Reverse buckling discs, 12/49,65 
Reverse flow hammer, 12/31, 32 
Reynolds number, 15/59,101,225 
Richardson number, 15/84-86,225 
Richmond, California, Al/59 
Ride passive plume model, 15/274 
toxic gas clouds, 15/287 
Rijnmond Report, 9/9 
acrylonitrile storage, A8/4—5,9—10, 
11-13 

ammonia storage, A8/5,10,13-14 
chlorine, A8/10,14-15 
description of, A8/2-20 
event data, A8/4,6-7 
fluid emissions from vessels, 15/15 
hazard assessment, 9/104 
hazard models, A8/4,7-8 
hydrodesulfurizer storage, A8/10,17 
injury relations, A8/4,8—9 
LNG storage, A8/10,15 
objectives of, A8/2-4 
population characteristics, 9/57,58 
pressure vessel failure, 12/95 
probit equations, 9/69 
propylene storage, A8/10,16 
recommendations, A8/20 
risks assessed, A8/17, 20 
Sutton-Pasquill model, 15/61 
ventilation rates and, 15/304 
RIKKE, 30/79 
Ring seals, 12/25-26 
Rio de Janeiro, Brazil, Al/40 
Risk 

acceptable, 4/4-6 
ACDS report, A17/14-22 
actual versus perceived, 4/6 
aversion, 9/72-73 
aversion index, 9/87 
communication, 4/8—9 
computing, 9/91 
contours and transects, 9/71 
defined, 32/2 

dread versus unknown, 4/6,7 
institutional players and, 4/9 

perception of, 4/4—9 
psychological issues, 4/6,8 
references on, 4/4 
social science issues, 4/8 
tables, 9/71-72 


taking and accidents, 26/6 
tolerable, 4/5-6 
Risk assessment 

See also Hazard assessment 

Canvey Reports, A7/26-30,31 
consequence, 33/37—38 
debate over effectiveness of, 

9/120-122 

description of, 9/7-11 
guidelines, 9/9-11, 82-92 
methods, 5/12 

mixing and heat transfer, 33/38 
other names for, 9/7 
reaction simulation testing, 33/38 
scale-up issues, 33/36-37 
use of term, 9/2 

Risk Assessment Tool (RAT), 9/92 
RISKAT, 9/92; 18/77; 29/5 
Risk criteria 

Advisory Committee on Dangerous 
Substances FN, 9/88-89 
applications, 9/91—92 
Dutch FN, 9/88 
Farmer curve, 9/86-87 
frequency numbers, 9/86,87 
Groningen FN, 9/87 
guidelines, 9/9-11, 82-92 
HagonFN, 9/87-88 
limitations when selecting, 9/86 
reasons for, 9/89-90 
references on, 9/82-84 
RISKLINE, 29/3 
Risk management, 1/12—13 
cost-benefit analysis, 4/12 
defined, 4/9 
issues, 4/11-12 
public, 4/9—10 
rules, 4/10 

strategies, 11/2-3; 32/2-5 
in the U.S., A32/2—3 
Risk Management Program (RMP), 

EPA’s, 2/8-9; 6/15-16; A32/2-3, 
A33/2 

Riso National Laboratory, publications of, 
A28/77—78 

Rivas-Rudd-Kelly model, 30/85,87 
Rivas-Rudd planner, 30/87 
River and Harbor Act (1899), 3/5; A31/2 
Road tankers 
classification of, 23/17-19 
design, 23/15 
hazards, A7/24, 26 
operation of, 23/15 
spills, 23/72-73 
static electricity in, 16/111-114 
Road Traffic (Carriage of Dangerous 
Substance in Packages) (1992) 
regulations, 23/9,14-15 
Road Traffic (Carriage of Dangerous 

Substance in Road Tankers and Tank 
Containers) (1992) regulations, 23/9, 
14-15 

Road transportation 
accidents, 23/19-32,73,74 
accidents, chemical, 23/25-26 
accidents, fire, 23/22, 24-25 
accidents, impact, 23/20,24 
accidents, injuries, 23/20, 21-22 
accidents, load-threatening, 23/25 
ACDS report, A17/9-10 
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carriage tank fittings, 23/15 
distances traveled, 23/18-19 
filling ratios, 23/16 
hazard assessment, 23/79—80 
hazards, 23/15 
reference temperature, 23/16 
regulations, 23/14-15 
releases, 23/28-29 
spills, controlling, 23/72-73 
substances prohibited from, 23/16—17 
tunnels, 23/37,81-82 
Robens Committee on Health and Safety 
at Work, 1/2,5; 4/13,14; 9/90 
Roberts model, 15/51-52,103-105; 

16/185-186 
Robots, 21/24 

Rochester, New York, A20/10 
Rocky Flats, Colorado, A20/9 
Rollback models, 15/116-117 
Rollover 

LNG,°22/38—39 
Romeoville, Illinois, Al/54-55 
Rossby number, 15/225 
Rotocraft, 23/69 

Roughness, surface, 15/81-82,98 
Royal Commission on Environmental 
Pollution (RCEP), All/9 
publications of, A28/78 
Royal Institute of Chemistry (RIC), A29/4 
laboratory codes, A9/3 
Royal Society for the Prevention of 
Accidents, A29/5 
publications of, A28/78 
Royal Society Study Group (RSSG), risk 
report, 4/4,5-6,8,9,10,11,12; 9/82, 
84 

RTECS (Registry of Toxic Effects of 
Chemical Substances), 18/10; 29/3 
Runes model, 17/64,88-89, 275-276 
Ruptures 

pipeline, 15/54-56 
storage tank, 15/53 
vessel, 15/45-53 
Rust model, 17/74-75,279-280 
RW correlations, 17/191-192,193 


Saaty’s model, 9/44-45 
Sabotage, 16/66 

Safe and Sound (BCISC), 1/2; 6/2; 8/2,70 
Safe Automation Guidelines (CCPS), 
13/62-66 

Safe Drinking Water Act (1974), 3/4 
SAFETI computer code, 9/56; 15/14; 18/77; 
29/4 

Safety, health and environment (SHE). 

See Environmental issues 
Safety, personal. See Personal safety 
Safety and loss prevention (SLP) 
references on, 1/2-3; 27/26-27 
role of, 27/25-26 
teaching aids, 27/26-28 
Safety and Management (ABCM), 1/2; 6/2 
Safety and Reliability Directorate (SRD) 
condensed phase explosions, 17/122 


Environmental Incidents Data Service 
(EnvIDAS), 27/19 
DRIFT model, 15/74, 200-202 
human error guides, 14/87 
MHIDAS, 29/3 

operating procedure codes, 20/4—5 
publications of, A28/81-86 
vaporization, 15/68 

Safety audits, 8/2,4-5,6-10; 19/11; 28/9 

Safety Audits (BCISC), 1/2; 6/2; 8/2,4-5,70 

CIMAH^4/19—21 
nuclear plant, 4/14 

Safety courses at universities, 1/13; 
28/6-7 

Safety critical systems (SCSs), 1/13; 13/54, 
60 

See also Safety instrumented systems 

Safety culture 
analysis of, 1/9; 28/2 
characteristics of, 1/8—9 
management and, 6/3-4 

Safety in Mines Research Board/ 
Establishment, publications of, 
A28/78—79 

Safety instrumented systems (SISs), 
12/73 

applications, 34/29-39 
automation levels, 34/12 
basic process control system (BPCS) 
and, 34/13-14 
bypassing, 34/26 
components and role of, 34/2-3 
configuration of, 34/17-18 
dependability, 34/21 
design, 34/12-21 
diagnostics, 34/20 
examples of, 34/3-5 
field sensors, 34/18-20 
fractional dead time, 34/21-22 
frequency of events, 34/21 
hazard rates of single-channel, 
34/24-25 

integration of, 34/17 
integrity, 34/22-24 
layers of protection analysis (LOPA), 
34/2,7-12 
logic solving, 34/20 
maintenance of, 34/27 
operation of, 34/26-27 
other names for, 34/2 
power supply, 34/17 
references on, 34/2 
reliability, 34/24-25 
response time, 34/14-17 
restarting, 34/26-27 
standards, 34/5-7 
testing, 34/27-29 

Safety interlock system (SIS), 11/21, 23; 
13/62,63-65 

See also Safety instrumented systems 
alarms for, 14/15 

Safety management systems (SMS) 
advisers, 28/6 
audits, 6/13; 28/9 
committees, 28/6 
communication, 28/7-8 
control, 6/13 
culture, 28/2 
elements of, 6/15 
measurement, 6/12—13 


organization, 6/10-12; 28/2-5 
planning, 6/12 
policy, 6/9; 28/5 
ratings, 28/9-10 
references on, 28/2 
representatives, 28/5-6 
training, 28/6-7 

Safety-related Instrument Systems for 
Process Industries (EEMUA), 
13/60-62 

Safety relief valve (SRV), 15/39,41 
Safety reviews 

conducted by management, 6/5 
systems, 8/29,62-67 
Safety Signs Regulations (1980), 22/66 
Safety strategies, 6/14 
SAFIRE (System Analysis for Integrated 
Relief Evaluation) computer code, 
17/99; 29/3 

St. Amand-les-Eaux, France, 23/73; Al/41 
SAMPLE, 30/77 
Sampling, 20/18-20 
Samuel’s checkers program, 30/23 
San Antonio,Texas, Al/8 
San Carlos de la Rapita, Spain, 1/5; 23/73; 
24/14; A16/2-4 

Sandia Human Error Rate Bank 
(SHERB), 14/85 

Sandia Laboratories (SL), A20/4; A29/8 
Sansmena, Al/47 

SARA. See Superfund Amendments and 
Reauthorization Act (1986) 
Savannah, Georgia, Al/65-66 
Scaffolding, 21/24 
Scaling laws, 17/19,65,270 
Scenario development, 8/27,55-57 
Scheduling, control and, 13/4 
Schmidt number, 15/59,101,225 
Schwab-Othmer model, 17/274-275 
Schweizerhalle, Switzerland, Al/55; 
All/26 

Science Applications Inc. (SAI), 15/179 
Scientific Instrument Research 
Association (SIRA), 13/24 
Scilly-Crowther model, 17/209-211 
Screening analysis techniques, 8/27, 
30-31 

Screw compressors, 12/39-40 
Scripts, 30/19 
Scrubbing, 17/111 

Scunthorpe, Lincolnshire, Al/46—47 

Seadrift, Texas, Al/63 

Seal drums, 12/70 

Seam welding, 12/18 

Search, 30/19-22 

Seatiger , 23/76 

Second chance design, 11/21 

Security 

countermeasures, 35/5 
defining risk, 35/4-6 
management system, 35/2-3 
planning, 20/21-22 
plant layout and, 10/10 
strategies, 35/3 
transportation, 23/86-89 
vulnerability assessment (SVA), 35/2, 
3-4,6-8 
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SEDEX, 33/21 

Seismic assessment, A15/15-17 
Self-checking instruments, 13/23—24 
Self-contained breathing apparatus 
(SCBA), 25/32 

Self-heating (spontaneous combustion) 
accidents, 16/66,67 
asymmetrical slab model, 16/72—73 
autocatalytic reactions, 16/78 
critical parameters, 16/74-75 
cylinder model, 16/72 
cylinder model, hollow, 16/73-74 
determining parameters, 16/80—81 
dust ignition and, 17/262 
equations, 16/68-69 
hot spots/materials, 16/78-80 
induction periods, 16/77-78 
in industrial processes, 16/66 
in insulation, 12/42-43 
oxidative, 16/75-76 
precautions against, 16/81—82 
process, 16/67-68 
reactant consumption, 16/76-77 
references on, 16/67 
symmetrical slab model, 16/69-72 
thermal explosions of second kind, 
16/78 

unsteady-state model, 16/76 
water, effects of, 16/76 
Self-insurance, 5/11 
Sellafield radioactive release, 

communications errors, 14/51 
Sensitivity coefficients, 9/104 
Sensors, time response of trip systems, 
13/37-41 

Separation distances, 10/15-20; 22/13-16 
for LNG, 22/36 
for LPG, 22/21,24-25,33 
Series systems, reliability and, 7/19 
Set theory and Boolean algebra, 7/7—8 
Seveso, Italy, 1/3, 5; 3/5; 4/16; 5/3; 33/2, 
3-4 

company and management, A3/2 
contamination and decontamination, 
A3/10-11 

description of, A3/2-13 
emergency and aftermath events, 
A3/6-8 

events prior to release, A3/5 
investigation of, A3/8-10 
lessons learned from, A3/11-13 
plant site and process, A3/2-3 
references on, A3/2 
TCDD, properties of, A3/3-4 
TCDD and TCP, other accidents 
involving, A3/4—5 
Sewers, plant layout and, 10/28-29 
Shaw-Briscoe model, 15/66-67 
Shear, plume, 15/266,268 
Shear stress, 15/184 
Shell Oil UK Ltd., A7/6 
Ships 

See also Marine/water transportation 
Convey Reports, A7/13-14 
fires, 16/290-291 
Shocks, 9/39 

from explosions, 17/119-122,180 
mechanical, 12/80 
pulse monitoring (SPM), 19/42 
thermal, 12/80 


Short-cut classical method (SCM), 
9/104-105,106,107 
Short-cut risk assessment (SCRA), 
8/57-58,60- 61,62 
Shot blasting, 21/12 
Shut-downs 

emergency (ESDs), 11/21, 23; 13/17; 
20/10-11 

fault administration and, 14/17—18 
high integrity (HISS), 13/31 
for loading and unloading facilities, 
22/63 

losses, 2/20-26 
mothballed, 21/40-41 
procedures for, 20/9—11 
in refinery units, 20/12-13 
scheduled, 21/39-40 
SI conversions, A30/2—6 
SIGMET model, 15/167,179-181,250 
Signal Hill, California, Al/32 
SIKAREX, 33/21 
Silos 

dust explosions, 17/286 
storage of powders in, 16/119 
Silvertown, London, Al/25 
Similarity models, 15/101-102,165 
Simple relief systems, A13/2—3 
Singh model, 17/44-46,76—77 
Single-channel trip system, 13/25, 36-37 
Single-equipment systems with repairs, 
Markov model, 7/27-28 
Site layouts 
See also Plant layout 
features, 10/7-10 
planning, 10/6-7 
Sizewell B 

human factors at, 14/91-92 
inquiry, A26/3-4 

Skills-rules-knowledge (SRK) model, 
human error and, 14/23,47 
Skin diseases, 25/20 
SLAB model, 15/167,181-182,200,250, 
251 

SLIM. See Success likelihood index 
method 

Slip equilibrium models, 15/18-19 
Fauske, 15/28-29 
Slips, modeling of, 14/76-77 
Slopes and ramps, dispersion and, 
15/238-241 

SLOT, 18/56—58 
Slot and filler systems, 30/18 
Slot fires, 16/207 
SLUMP model, 15/167,191 
SMALLTALK, 30/36 
Smog, All/25 

Smoke, models of, 16/288,290 
Smoking, as ignition source, 16/64,66 
SNAM LNG terminal, La Spezia, Italy, 
22/71 

Sneak analysis, 8/27 
energy, 8/53-54 
flow, 8/53, 54 
HAZOP, 8/54 

human error and use of, 14/59 
indication, 8/53,54 


label, 8/53,54 
methods, 8/54 
procedure/sequence, 8/54 
reaction, 8/54 
references on, 8/53 
Social science issues, risk and, 4/8 
Society of American Value Engineers 
(SAVE), 11/12 

Society of International Gas Tanker and 
Terminal Operators (SIGTTO), 
23/47,50-51 
publications of, A28/79 
Socio-technical systems analysis, 8/61 
Sodegaura, Japan, Al/64-65 
Sodium chlorate, storage in warehouses, 
22/70 

Software, 13/54 

dependability, 13/56 
design, production, and verification of, 
13/57,59-60 
development, 13/57 
error rates, 13/56 
maintenance, 13/60 
management, 13/56 
modification control, 13/57 
problems with, 13/56 
programmable electronic systems and, 
13/51 

protection, 13/58 
quality assurance, 13/56 
for real-time systems, 13/60 
references on, 13/55 
reliability, 13/57 
specification, 13/57 
standards, 13/56-57 
testing and debugging, 13/57—58 
tools, 13/58 

Solids, ignition of, 16/235, 277-278 
Solid Waste Disposal Act (1965), All/10 
Solid wastes, All/20-22 
plant layout and, 10/28 
SOLOMON, 30/13 
Solomon Associates, 5/3 
Solvent jetting, 21/11—12 
Sonic gas jets, 15/138-140 
Soot, 16/164,166 
Soutter-Chung planner, 30/90 
Spark ignition, 16/36-38 
dust ignition and, 17/262 
Spectators, 24/13,14 
Spectrometric oil analysis program 
(SOAP), 19/37 
Spills, 15/323-324 
bunds and, 22/56,58 
controlling, 23/71-74 
emergency procedures, 20/7—8 
responses to, All/25 
types of, All/24-25 
Spontaneous combustion. See Self¬ 
heating (spontaneous combustion) 
Spontaneous ignition temperature (SIT), 
16/17,19 

Spot welding, 12/18 
Spray, liquid, 15/58; 16/107-108 
Spray dryers, 17/285-286 
SPRAY65,15/316 
Spreading of liquids, 15/62-63 
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See also Dispersions 
of liquefied natural gas, 15/64-68 
Sprinkler systems, 16/265-266,289-290 
Stability array (STAR), 15/90 
Stability conditions/criteria, dispersion 
and, 15/83,87-92 
Stack effects, 17/221 
Stainless steel 
austenitic, 12/14 
classes of, 12/13 
duplex, 12/14 
ferritic, 12/14 
Stalybridge, UK, Al/52 
Standard Industrial Classification (SIC), 
2/4-5 

Standards, 6/6 

See also British Standards (BS); under 
name of organization 
compressors, centrifugal, 12/39 
compressors, reciprocating, 12/39 
compressors, screw, 12/39 
earthquake design and, A15/13-14 
electrical, 11/36; 16/128-135 
on emergency planning, 24/8,15-20 
fired heaters and furnaces and, 12/34 
flame arresters, 17/57-58 
globalization of, A27/2 
for laboratories, A9/3-4 
overpressure and, 12/43-47 
pressure pipework and, 12/23—25 
pressure vessel and, 12/18—22 
process design and, 11/4 
reliability, 7/6 

safety instrumented systems and, 
12/73; 34/5-7 
software, 13/56-57 
sources of information on, A27/2—3 
static electricity and, 16/124-128 
storage of petroleum products, 22/5 
Standard systems, reliability and, 
7/19-21 

Stand by systems, reliability and, 7/20,21 
joint density functions, 7/29 
Stanlow, Cheshire, Al/62 
Stanton number, 15/59 
Start-ups 

in refinery units, 20/11-12 
procedures for, 20/9—11 
Staten Island, New York, 22/71; Al/41-42 
Static analysis of software, 13/58 
Static electricity 
accidents, 16/84-85 
capacitance, 16/87 
in cargo tankers, 23/56 
charges/charging, 16/86-87,89-94 
containing, 16/121-122 
discharge, 16/94-95 
discharge, incendive, 16/116—117, 
119-120 

in drums and small containers, 
16/120-121 

dust ignition and, 17/262-263 
electrolytic relations, 16/96-98 
equations/laws, 16/85-86 
field strength and breakdown, 
16/87-89 
foam and, 16/271 
human body and, 16/121 
in industrial processes, 16/82,84 
in liquids, 16/95-96,98-111 


at loading and unloading facilities, 
22/63-64 

in moving equipment, 16/121 
in oil and chemical tankers, 16/114—116 
in powders and dusts, 16/117-120 
precautions against, 16/122-128 
references on, 16/82-84 
in road and rail tankers, 16/111-114 
in storage tanks, 16/108-111 
Static pressure loading, pressure vessel 
design and, 12/16 
Statistical models, 15/101,117 
Steam, hazards of, 11/37-38 
Steam boiler plant, control and 

automation example, 13/67—68 
Steam cleaning, 21/10-11 
Steam curtains 

dispersion and, 15/243,316-317 
LPG storage and, 22/23 
STEAMER, 30/36 
Steam hammer, 12/31,32 
Steel 

carbon, 12/12 

coding systems, 12/15 

creep, 12/9-10 

creep and temperature, 12/12 

ductility, 12/9 

fatigue and, 12/10-12 

fire protection for, 16/261 

heat treatment of, 12/14-15 

high temperatures, effects of, 12/9 

impact of missiles on, 17/213 

low alloy, 12/13 

low temperature, 12/14 

low temperatures and brittleness, 12/9 

mild, 12/12 

oxidation resistance, 12/13 
references on, 12/8 
stainless, austenitic, 12/14 
stainless,classes of, 12/13 
stainless, duplex, 12/14 
stainless, ferritic, 12/14 
strain and elasticity, 12/8-9 
toughness and impact strength, 12/9 
types of, 12/12 

yield and tensile strengths, 12/9 
STEP (Sequentially Timed Events 
Plotting) model, 27/4 
Stewart, R. M., 1/4 

Stockholm International Peace Research 
Institute (SIPRI), 17/243-244 
Storage 

See also Containment 
accidents, 22/71-72 
of acrylonitrile, 22/53 
of ammonia, 22/46-53,77 
availability and, 7/35-38 
capacity estimations, 22/5 
of chlorine, 22/42-46 
classification, 10/5; 22/13,16 
conditions, 22/4—5 
containment, secondary, 22/15-16 
costs and, 1/7 
cylinder, 22/66 
drum, 22/65-66 
of ethylene dichloride, 22/54 
of ethylene oxide, 22/54 
filling ratios, 22/61 
hazards, 22/5 
of hydrogen, 22/40 


of hydrogen fluoride, 22/54 

of LNP, 22/35-40,76-77 

loading and unloading, 22/61—65 

of LPG, 22/20-35,73-76 

of materials in laboratories, A9/7 

of monomers, 22/54—55 

of oxygen, 22/54 

of phosgene, 22/54 

plant layout and, 10/14-15; 22/13-16 

process design and, 11/18—19 

purpose of, 22/4 

references on, 22/2-4 

risk, 22/72-73 

separation distances, 22/13—15 
standards, 22/5 
of toxic substances, 11/18-19; 
20/40-42 

venting and relief, 22/16-19 
venting vessels, 17/107-108,118-119 
warehouses, 22/66-70 
Storage silos, powder, 16/119 
Storage tank(s) 

See also Tankers 

accidents, 22/71 
atmospheric, 12/53; 22/6-11 
cleaning, 21/33-35 
concrete, 22/12 
earth pit, 22/12 
earthquakes and, A15/21 
emptying liquids from, 21/33 
fire protection, 22/19-20 
fires in, 16/158-159,206-207, 
278-279, 281-282; A14/37 
fugitive emissions, 15/321—322 
gas, 22/12 

gas freeing, 21/33-34 
glass reinforced plastic, 22/12-13, 
59-61 

hazardous and initiating events, 22/6 
liquids in, and static electricity, 
16/108-111 
for LNG, 22/36 

loading and unloading facilities, 22/63 
for LPG, 22/20-21,33 
maintenance of, 21/36 
operation of, 20/14-16 
for petroleum products, 22/5-13 
pressure and refrigerated, 22/11-12 
ruptures, 15/53 

underground cavity, 22/12,58-59; 
All/22 

Storm water systems, plant layout and, 
10/28-29 

Strain, measuring, 19/35-36 
Strain and elasticity, steel and, 12/8-9 
Strain fracture rule, 12/10 
Strawson-Lyle model, 16/112-113 
Strehlow model, 17/157-158 
Strength and load failure models 
bathtub curve, 7/44 
Carter’s rough loading model, 7/43 
deterministic approach, 7/41—42 
Drenick’s theorem, 7/44-45 
interference theory, 7/42-43 
lightbulb curve, 7/44 
probabilistic approach, 7/42 
safety factor and margin, 7/41 
Stress 

concentration theory (SCT), 12/89 
human error and, 14/69-72 
intensity factor, 12/88 



INDEX 37 


pressure vessel design and, 12/16-17 
related corrosion, 12/84-85 
relief heat treatment, steel, 12/15 
Westergaard stress function, 12/88 
Stress corrosion cracking (SCC) 
ammonia, 22/49,51-53 
chloride, 12/84-85 
nitrate, 12/85 
reasons for, 12/84 

Stress wave analyzer (SWAN), 19/42 
STRIPS (Stanford Research Institute 
Problem Solver), 30/25, 26 
Structural damage, 17/179 
air blast loading, 17/181-182 
component failure, 17/187 
diffraction and drag loading, 
17/182-183 

housing damage categories, 17/192,193 
housing damage circles, 17/194-195 
load displacement diagrams/response, 
17/183-185 

overpressure damage data, 17/187-191 
parameters, 17/185-187 
P-I (pressure-impulse) diagrams, 
17/192-193,194,195-196 
R-W correlations, 17/191-192,193 
Structured Audit Technique for the 

Assessment of Safety Management 
Systems (STATAS), 6/20-21; 9/52 
Structured knowledge, 30/7,17-19 
Subcooled liquids, 15/30,32-33,40 
Substitution, process, 11/14,15,16—17 
Success likelihood index method (SLIM), 
9/50-51; 14/54,73-74,82 
Sulfur dioxide 
references on, 18/6,7,40—41 
toxicity of, 18/27,40-41; All/13 
Sulfuric acid mist, HSE dangerous dose, 
18/58 
Superfund 

See also Comprehensive 

Environmental Response, 
Compensation, and Liability 
Act (CERCLA) (1980) 
references on, 3/2 
role of, 3/4 

Superfund Amendments and 

Reauthorization Act (SARA) (1986) 
references on, 3/2 
role of, 3/4; 4/31; 18/16; All/10 
Title III, 3/4, 5; 4/31-32; 18/16 
Superheated liquid explosions, 
17/172-173,175,176-177 
SUPERPOCUS, 30/77 
Suppression, dust explosions and, 
17/267-268 

Surface roughness, 15/81-82,98 
Surge, centrifugal compressors and, 
12/39;13/14 

Sutton model, 15/105-106,122,123 
Sutton-Pasquill model, 15/60-61 
Symmetrical slabs, self-heating and, 
16/69-72 
SYNICS, 30/59 
Synthetic Organic Chemical 
manufacturers Association 
(SOCMA), 35/4; A29/9 
SYSLAG, 30/59 


Systematic human error reduction and 
prediction approach (SHERPA), 
14/81; 20/4 

System design, human factors in, 14/4—5 
System for predictive error analysis and 
reduction (SPEAR), 14/59 
Systems Reliability Service (SRS), 7/6 


Take-up flux, 15/184-185 
Tankers, road 
construction of, 23/13 
filling ratios, 23/14 
forces/pressure design, 23/13,14 
wall thickness, minimum, 23/13 
Tankers, ship/cargo 
design, 23/43,54-5 
operation/movement, 23/43,46 
seaworthiness, 23/48 
substandard, 23/62 
Tankers, static electricity in 
in cargo, 23/56 
oil and chemical, 16/114-116 
road and rail, 16/111-114 
Tank Vessels Act (1936), 3/5 
TapRooT, 31/25 
Task analysis, 8/55; 14/21,46 
applications, 14/29-34 
cognitive tasks, human behavior in, 
14/23-24 

cognitive tasks, human error in, 
14/25-26 

cognitive tasks, mental models in, 
14/24-25 

control tasks, human behavior in, 14/24 
development of, 14/28-29 
diagnostic tasks, human behavior in, 
14/22-23 

guidelines, 14/34-35 
hierarchical, 14/28, 29 
human error assessment and use of, 
14/53,54,55,74,79 

TAXAC human error classification, 14/87 
Taylor expansion wave, 17/10 
Taylor model, 17/156-157 
Taylor’s theorem, 15/96-97 
Technica/Tecnica. SeeTESEO (Tecnica 
Empirica Stima Errori Operatori) 
Technical Research Center of Finland, 
A28/79—80 

Technique for human error rate prediction 
(THERP), 9/50,51; 14/53,54, 59-60, 
82 

Technological problems, hazard control 
and, 4/2-4 

TECJETcomputer code, 15/265 
TEIRESIUS, 30/28 
Temperature(s) 
adiabatic flame, 16/21-23, 24 
auto-ignition (AIT), 16/17,19, 35 
effects and emissions, 15/11 
fireball, 16/189-190 
ignition, 16/17,19 
reference, 23/16 
steel and effects of high, 12/9 
steel and effects of low, 12/9 
steel creep and, 12/12 


steel for low, 12/14 
vertical gradient, 15/82-83 
Temperature, operating conditions 
deviations, 11/62-63 
high, 11/34 
low, 11/34 

Tempering, steel, 12/15 
Tennessee Valley Authority (TVA), 

stability categories, 15/88,90,124, 
126 

Tensile strengths, steel and, 12/9 
TeRiele model, 15/183-185 
Terrorist attacks of September 11, 2001, 
5/10; 35/2 

Customs-Trade Partnership against 
Terrorism (C-TPAT), 23/5,88-89 
transportation security, 23/86-89 
TESEO (Tecnica/Technica Empirica 

Stima Errori Operatori) human error 
assessment, 9/56; 14/80-81,83 
Tessenderloo, Belgium, Al/26 
Testing 

See also under name of test 
for leaks, 19/31-32 
non-destructive, 19/25-29 
pressure, 19/29-31 
reliability, 7/61-62 

Tetrachlorodibenzoparadioxin(TCDD), 
15/59; All/13 

accidents involving, A3/4—5 
properties of, A3/3-4 
Texaco Ltd., A7/2 
Texaco North Dakota, 23/76 
Texas City,Texas, 22/71; 23/76; 24/14 
1947 accident, Al/28-29 
1969 accident, Al/35 
1978 accident, Al/49 
Textbook, 17/243-245 
The Fertilizer Institute (TFI), 15/205,213 
Theoretical adiabatic flash fraction 
(TAFF), 15/57 
Thermal explosion 
second kind, 16/78 
theory, 16/31-32 
Thermal fatigue, 12/80 
Thermal insulation, 12/41,43 
Thermal radiation, 16/160,239; 
17/179-180 

Therm a l relief, 12/55-56 
Thermal shock, 12/80 
Thermal shock parameter, 12/12 
Thermal stress, pressure vessel design 
and, 12/16-17 

Thermodynamic effects, workbook 
model and, 15/198-199 
Thermodynamic properties, of some 
substances, 17/25 

THERP. See Technique for human error 
rate prediction 
Thessalonika, Greece, Al/55 
Thomson Ramo Woolridge (TRW), 

15/204,205 

Thorney Island field trials, 15/191,200, 
203, 211, 215,249,252 
applications, 15/223 
continuous release, 15/220 
Phase 1,15/216-218 
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Phase II, 15/218,220 

Phase III, 15/223 

wind tunnel modeling, 15/222, 

226-227, 230, 231, 232,233,234, 
235,236,237 

Three Mile Island accident 
company/management, A21/2 
description of, A21/1-13 
disturbance analysis system, 

30/96-98 

emergency and aftermath, A21/7 
events prior to, A21/4—7 
investigation of, A21/7-11 
lessons learned from, A21/11—13 
plant/process, A21/2-4 
references, A21/2 
training problems, 14/49 
Threshold limit values (TLVs), 18/16-21 
Throughput capability method, 7/35 
Throughput density function, 7/33-34 
Tie sets, 7/23 

Time, qualitative modeling and, 30/43 
Time availability model, human error 
and, 14/47 

Time constants, control and, 13/3 
Time factor, scale of hazard and, 2/13 
Time mean concentration, 15/272 
Time-reliability correlation (TRC), 14/65, 
67,77-79 

Time response of trip systems, 13/37-41 
Time-terminated test, 7/48 
TNO models, 15/202; 17/160-164; 27/19 
publications of, A28/80 
TNT, 17/23-24 
condensed phase explosions, 
17/122-128 

equivalent models, 17/152-156 
Tolerable risk, acceptable versus, 4/5—6 
Toluene diisocyanate (TDI), toxicity of, 
18/41 

Top hat, box and slab models, 15/102 
Topography, effects on dispersion. See 
Dispersion, topography and effects 

Torrey Canyon, 23/76; All/26 
Total loss control 
areas of, 1/11 
defined, 1/10 
references on, 1/10 
Total quality management (TQM) 
applications, 6/9 
defined, 1/12 
references on, 1/11—12 
standards, 1/12 

Toughness and impact strength, steel 
and,12/9 

Toulouse, France, 33/2; Al/69 
Town and Country Planning Act (TCPA) 
(1971), 4/16,21,24-25, 28 
Toxic Catastrophe Prevention Act (TCPA) 
(1985), New Jersey, 4/32; 33/7 
Toxic chemicals/materials 

See also Reactive chemicals/hazards; 
Toxicity; under name of chemical 

carcinogens, 18/21—25 
in confined spaces, 21/13 
containment of, 12/73-75 


control of, 13/68-69; 18/14-16 
dusts, 18/25-26 
effects of, 18/7-8 

emergency exposure limits, 18/26-27 
exposure modes, 18/7 
factors relevant to, 18/8—9 
in laboratories, A9/4 
metals, 18/26 

plant design and, 18/59-60 
references on, 18/2—7 
release incidents, 18/61-64 
release response, 18/60—61 
release risk, 18/64—66 
skin, effects on, 18/20 
storage of, 11/18-19; 22/40-42; 

34/33-34 
ultra, 18/59 
Toxicity, 8/12 
See also Gas toxicity 
animal experiments, 18/10,13 
assessment of, 18/9-14 
control of, 18/14-16 

epidemiology, 18/10—11 
of flares, 12/72 
hygiene standards, 18/16-21 
models, 18/12 

organizations involved in, 18/14 
statistical interpretation, 18/12-13 
testing, 18/10 
Toxic load, 18/11-12 
Toxic risk assessment, 18/13—14 
Toxic Substances Control Act (TSCA) 
(1976), 2/7; 18/15-16 
role of, 3/4-5; A32/2 
TOXLINE, 18/10; 29/3 
Trailing indicators, 1/9 
Training 

ACSNI guidelines, 14/38-43 
education versus, 14/36 
emergency planning, 24/9 
fault diagnosis and, 14/37-38 
of laboratory personnel, A9/3 
personnel, 21/5 

preventing accidents and, 26/8 
principles, 14/36-37 
process operators, 14/36-43; 20/89 
safety, 28/6-7 
TRANSCAER, 23/6 
Transformation and removal processes 
chemical, 15/295 
deposition, dry, 15/296-298 
deposition, velocity, 15/298 
deposition, wet, 15/298-300 
physical, 15/295-296 
washout ratio and coefficient, 
15/300-301 
Transients 
jet, 15/152 

two-phase flow, 15/23 
workbook model and, 15/198 
Transition state theory (TST), 

33/14-16 

TRANSLOC model, 15/202 
Transportation 
accidents, 23/73-77 
ACDS report, A17/2-22 
air, 23/69 

of chemicals, All/14-15, 24 
of chlorine, 18/68-75; 22/45 
computer programs for, 29/5 


conditions, 23/7 
containers, 23/12-14 
containers, multi-use, 23/7 
costs and methods of, 1/6,7 
emergency planning, 23/69,71; 

24/12-13 
failures, A14/38 
fires, 16/290-291 
hazard assessment, 23/79-86 

labeling’, 23/9-12 
laws/regulations, 3/5; 23/6-12 
loading and unloading issues, 23/7 
marine/water, 23/37,42-69 


methods of, 23/6 
organizations, 23/2,5-6 
pipeline, 23/37-42 
plant layout and, 10/10 
rail, 23/32-37 
references on, 23/2-5 
risk, 23/77-79 
road, 23/14-32 
security issues, 23/86-89 
size of units, 23/7 
spills, 23/71-73 
tunnels, 23/37, 81-82 
TRAUMA, 15/153 
TREDRA, 30/77 
TREE, 30/77 
TREMCARD, 23/12 
Trend analysis, 1/9 
Trip control systems, 20/20 
applications, 13/29-31 
characteristics of, 13/29 
configuration of, 13/41—42 
dependability of, 13/25 
disarming, 13/34 
fractional dead time, 13/25-26 
frequency of events, 13/37 
functional reliability of, 13/26-27 
hazard rates, 13/36-37 
high integrity, 13/31-34 
integration of, 13/42 
maintenance of, 13/43 
operational reliability of, 13/27-28 
programmable electronic systems 
(PES), 13/34,48-54 
proof testing, 13/28-29 
restarting, 13/34,36 
single-channel, 13/25,36-37 
switches, 13/25 
time response, 13/37—41 
Truth maintenance systems (TMS), 
30/12-13 
Tubes 

combustion in, 16/50-53 
rupture, heat exchangers and, 
12/33-34 
tests, 33/16-17 

vibration, heat exchangers and, 
12/33 

Tunc-Venart model, 16/222 
Tunnels, 23/37,81-82 
Turbines, A14/18-19 
Turbulence, 15/78-79,95-96 
Eulerian versus Lagrangian, 15/96 
plumes in atmospheric, 15/143—144, 
145,151 

Turbulent exchange coefficients, 15/94, 
TWEAK, 30/26 
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Two-equipment systems Markov model, 
7/27 

Two-phase flashing jets, dispersion of, 15/ 
152-155,163 

Two-phase flow, 12/31,32,56 
API, 15/39 

for bursting discs, 12/65 
characteristics of, 15/15 
computer codes, 15/42 
in cracks, 15/26 
critical, 15/15, 20,22-23 
critical pressure ratio, 15/23 
depressurization of vessels, 15/33—39 
design issues, 15/26 
DIERS project, 15/23 
DIMP project, 15/22, 23, 26 
elementary equations, 15/19 
flashing, 15/22 

friction factor, 15/15, 20-21,22 
homogeneous, 15/17,19-20,22 
Lockhart-Martinelli model, 15/21 
models, 15/17-19 
non-homogeneous, 15/20 
patterns, 15/15-17,18 
pressure relief valves, 12/64; 15/39-42 
references on, 15/14-15 
relaxation length, 15/23, 25 
slip equilibrium models, 15/18-19 
studies, 15/15,16 
transients, 15/23 
in valves, 15/26 
vessel blowdown, 15/42—45 
Two-phase flow, Fauske models 
empirical model, 15/26—27 
equilibrium rate model, 15/29-30 
flow through a pipe, 15/30 
Jones and Underwood versions, 15/27 
non-equilibrium models, 15/27-28,29 
relaxation length, 15/27 
slip equilibrium model, 15/28—29 
subcooled liquids, 15/30 
Two-phase flow, Leung models, 15/30 
flow through a nozzle, 15/31-32 
flow through a pipe, 15/32 
non-flashing flow, 15/33 
pressure relief valves, 15/39—42 
subcooled liquids, 15/32-33,40 
subcritical flow, 15/33 
Two-phase jets, 15/142 
Two-phase relief flows, 17/114 


Ufa, Soviet Union, 23/76; Al/59,62 
Ukhta, Russia, Al/65 
Ultrasonics, 19/26-27,35 
Umm Said, Qatar, 22/71; Al/48 
Uncertainty 
handling, 30/11-13 
of hazard assessment findings, 
9/77-82 
sources of, 30/11 

Underground storage tanks (USTs), 22/12, 
58-59; All/22 

Underwriters Laboratories (UL), 16/2, 
271; 17/57; A29/9 
Uninformed search, 30/19 
Uninterrupted power supplies, 11/36—37 
Union of Concerned Scientists (UCS), 


A23/17—21; A29/9 
United Kingdom 

accident classification in, 2/4—5,11 
chemical plants, tragedies in, 1/2—3 
development of loss prevention in, 1/4 
electrical standards/codes, 11/36 
fire insurance in, 5/9 
fire losses in, 2/15-16 
fugitive emissions, 15/319 
list of organizations in, A29/2—5 
meteorology in, 15/98 
pressure vessel standards, 12/18—22 
safety audits in, 8/2,4-5 
software standards, 13/56 
statistics/ trends on losses in, 1/2 
toxic chemicals regulations in, 18/156 
transportation in, 23/6,17-30,47-49 
UK Atomic Energy Authority (UKAEA), 
l/5;4/13-14; 7/6; 9/5; 12/93,94; A20/4 
address/website for, A29/5 
instrument failure rates, 13/17-18 
publications of, A28/80-86 
UK Chlorine Producers (UKCP), 9/93-94, 
99-100,101 

UN Economic Commission for Europe 
(UNECE), 23/5 

UN Transport Code, 23/7-8,9,10,13,14 
United States 

accident classification in, 2/4—5,7—11 
chemical plants, tragedies in, 1/3 
electrical standards/codes, 11/36 
fugitive emissions, 15/319 
laws, 3/2-5 

list of organizations in, A29/5-9 
pressure vessel standards/codes, 12/19 
process hazard control and, 4/31—32 
software standards, 13/56 
toxic chemicals regulations in, 
18/15-16 

transportation in, 23/6-7,12, 30-32, 
36-37,49-50 
U.S. Army, 35/4 

U.S. Coast Guard, 23/49; A33/3 
U.S. Department of Energy, 21/2; 35/4; 
A33/3 

U.S. Department of Health and Human 
Services, 2/10-11 

U.S. Department of Labor, Bureau of 
Labor Statistics, 5/2 

U.S. Department of Transportation, 21/2; 

23/5,37,40; 35/4; A29/9; A33/3 
Unit equipment and operation, 33/9 
activated carbon adsorbers, 11/32 
centrifuges, 11/30 
computer programs for, 29/2-3 
distillation columns, 11/32 
dryers, 11/31-32 
mixers, 11/30 
references on, 11/28-29 
Unit processes 
chlorination, 11/27-28 
hydrogenation, 11/27 
nitration, 11/28 
oxidation, 11/26-27 
references on, 11/24, 25 
Universities, safety classes, 1/13 
University of Michigan, Transportation 
Research Institute, 23/6 
Unreliability, failure rate and, 7/11 


Unrevealed dependent failures, 

9/39 

Urban areas, dispersion and, 15/98—99, 
116-117,128-129,132,133 
Users Guide to Federal Accidental Release 
Databases (EPA), 2/5 
Uskmouth, UK, Al/31 
USRoads, 23/6 
Utilities 

compressed air, 11/38-39 
electricity, 11/36-37 
features of, 11/34 
fuel, 11/37 

heat transfer media, 11/40 
IChemE guide on, 11/36 
inert gases, 11/39 
references on, 11/35 
steam, 11/37-38 
types of, 11/34 
water, 11/39-40 


Vacuum induction melting (VIM), 
12/13,14 

Vacuum-oxygen decarburization (VOD), 
12/13,14 

Vacuum relief, 12/53,55; 22/16,29-30 
Vacuum technology, 11/33 
Value improving practices (VIPs), process 
design and, 11/12-13 
Value methodology, process design and, 
11/12 
Valves 

See also Pressure relief valves 
for chlorine, 12/76-77 
emergency isolation, 12/28-30 
emergency shut-down, (ESVs), 13/66, 

67 

excess flow, 12/28 
failure of, 12/64; A14/19-22 
fire resistant, 16/261 
interlocks, 12/30-31 
leak tightness, 13/8 
locally operated, 14/64-65,66 
non-return, 12/27-28 
operating procedure synthesis (OPS), 
30/85-87,89-90 
pipework and, 12/27-31 
sequencing, 30/56 
sizing, 12/60-64 
two-phase flow in, 15/26 
van den Berg model, 17/164 
van Ulden models, 15/159-160, 

168-172 

Vapor 

barriers, 15/307-308 
carryunder, 15/37-39 
emissions/discharge of, 15/6—7,10—11, 
34-35 

external heat generation, 15/37 
flammability of, 16/14-26,61-62 
foam to suppress, 16/272 
Vapor Cloud Dispersion Model Guidelines 
(CCPS), 15/266,305-306 
Vapor cloud explosions (VCEs) 
accidents, 17/134-137 

Convey Reports, A7/17-18 
CCPS, 17/167 
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combustion following vessel burst, 
17/148 

combustion in, 17/142-143 
combustion of dispersed vapor clouds, 
17/143-148,149 
combustion of a pipeline leak, 
17/148-149 

combustion of turbulent jets, 17/148 
data on, A14/38 

empirical features, 17/137,139-142 
energy, 17/28,152 
hazard assessment, 17/292-293 
hydrogen, 17/166 
insurance and, 5/11 
investigating, 27/13 
mass of fuel, 17/150,152 
methane and LNG combustion, 17/166 
models, 17/149-150,152-166; 
A7/32-33 

plant design and, 17/167 
references on, 17/134-135 
studies, 17/138-139,143-149 
Taylor model, 17/156-157 
TNTequivalent models, 17/152-156 
trend of, 2/27 
yield limits, 17/166-167 
Vapor cloud fires (VCFs), 16/172-176,293; 

A7/17-18 
Vaporization 
bunds and, 22/56 
computer codes, 15/68 
cryogenic liquids, 15/63—64 
liquefied natural gas, 15/64-68 
Mackay-Matsugu model, 15/62 
models, A7/31 
Opschoor model, 15/68 
pool, mass and heat transfer, 15/58—60 
Raj model, 15/67-68 
references on, 15/57 
Shaw-Briscoe model, 15/66-67 
situations, 15/56-57 
spreading of liquids, 15/62-63 
superheated liquids, 15/57—58 
Sutton-Pasquill model, 15/60-61 
vessel ruptures and, 15/45—47 
volatile liquid, 15/61-62 
Vaporizers 
for chlorine, 22/45 
for LPG, 22/30 

Vaporizing liquids, fire protection using, 
16/273-276 

Vapor phase chlorination, 11/27—28 
Vapor phase hydrogenation, 11/27 
Vapor phase nitration, 11/28 
Vapor phase oxidation, 11/26—27 
Vapor pressure systems, venting, 

17/100-101,102-103,108,110-111 
Vapor Release Mitigation Guidelines 
(CCPS), 15/317-318 
Variability model, human error and, 
14/46-47 

Variational transition state theory 
(VTST), 33/14-16 
Vehicles 

See also Tankers, road; Tankers, 
ship/cargo 
fires, 16/290 
as ignition source, 16/63 
inspection of, 19/47-48 
loading and unloading, 22/63 


maintenance of lift, 21/23-24 
Vellenga-Klinkenberg model, 16/109 
Vellenga model, 16/108 
Velocity 

deposition, 15/298 
flame stoppers, 17/54 
friction, 15/79 

wind, 15/79-81,95,166,183-184 
Vendors, process design and, 11/13 
Vent(s)/venting 

See also Depressurization of vessels; 
Explosions, venting; Explosions, 
venting dust; Explosions, venting 
reactors 

atmospheric, 12/50; 22/16 
choked, 27/9-11 
conservation, 17/54 

ratio and coefficient, 17/62-63,65-66, 
270-271 

size package (VSP), 17/98-99 
stack design, 12/59 
storage and, 22/16-19 
VENTEX, 17/94 
Ventilation/ventilation systems 
air jets, 25/19 
captor hoods, 25/18-19 
design of, 25/20 

enclosure and receptor hoods, 25/18 
general, 25/19 
local exhaust, 25/17 
low volume, high velocity system, 
25/19 

maintenance of, 25/20 
rates, 15/303-304 
references on, 25/17 
Vent Sizing Package (VSP), 33/22 
Vessel burst explosions 
CCPS, 17/133 

energy distribution, 17/130 
features, 17/129 
models, 17/130-133 
pressure, 17/129-130 
studies, 17/128-129 
Vessel emissions/discharge 
drainage times and flows, 15/13-14 
gas flow through pipe, 15/11—12 
liquid discharge time, 15/12-14 
Vessel ruptures 
air entrainment, 15/53 
Hardee-Lee model, 15/47-49 
Hess-Hoffman-Stoeckel model, 15/49 
Maurer model, 15/49-51 
Roberts model, 15/51-52 
vaporization, 15/45—47 
Vessels 

blowdown, 15/42-45 
deflagration in, 17/31 
depressurization of, 15/33—39 
detonation in, 17/34-35 
engulfing fires and, 16/226-235 
explosions and venting, 17/60—81 
explosions in closed, 17/36-46 
explosive energy, 17/25-27 
fires in storage, 16/279 
isolation of, 21/7-8 
ruptures, 15/45-53 
Vibrations, monitoring, 19/35,39—42 
Vinyl chloride 

hazards of, 11/52-53; 18/23-24 
references on, 11/45; 18/4,7 
storage of, 22/55 


Violations, 14/47 
Vision, 30/23-24 
Vitoria, 23/73 

Volatile liquid vaporization, 15/61—62 
Volumetric source, 15/34—35 
von Karman Institute (VKI) models, 
15/203 

Vulnerability model (VM), 9/54,56,57,58, 
59,60,61; 17/242 


Walsh-HealyAct (1936), A31/2 
Warehouses 
accidents, 22/72 
ammonium nitrate in, 22/70 
emergency planning, 22/69 
fires in, 16/279; 22/69 
handling of materials, 22/67 
hazard assessment, 22/69 
labeling of materials in, 22/67 
layout of, 22/67 
management system, 22/66 
organic peroxides in, 22/70 
regulations, 22/62 
segregating materials in, 22/67,68 
sodium chlorate in, 22/70 
storage in, 22/66-70 
Warning analysis, 8/70; 9/108-119 
Warren Spring Laboratory (WSL), 15/270, 
277,288 

Washout ratio and coefficient, 
15/300-301 
WASH 740, A23/2 
Waste 

from cleaning, 21/12 
disposal in laboratories, A9/7 
hazardous, All/9,10 
heat boilers, 12/34 
minimization, All/15-17 
Wastewater control and treatment, 
All/19-20 
Water 

for cleaning, 21/10 
for cooling, 11/39 
curtains, 16/282 

drainage facilities for LPG, 22/27-28 
draining, 20/18 
emergency, 24/6 

for fighting fires, 10/26-27, 29; 11/40; 

16/263-269,282 
hammer, 11/38; 12/31-32; 20/16 
hot, 11/40 
jetting, 21/11 

molten metal-water explosions, 17/176 
pollution, All/8-9,10 
process, 11/39-40 
self-heating and effects of, 16/76 
sprays,12/52 

Water Act (1973 and 1989), All/9 
Water Pollution Control Act (WPCA) 
(1972), 2/7; 3/4; All/10 
Water Quality Act (1965), 3/4 
Water spray barriers 
air entrainment and, 15/308-310 
for dense gases, 15/312-316 
dispersion and, 15/243 
early work on, 15/308 
for enclosed spaces, 15/316 
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for leak containment, 15/316 
Moore-Rees model, 15/310-312 
steam curtains versus, 15/317 
Water system for fighting fires, plant 
layout and, 10/26-27, 29 
Waverly,Tennessee, 23/73; Al/49-50 
Wealdstone, Middlesex, Al/52 
Wearout failure, 7/45-46 
Webber generalized box model, 
15/203-204 

Webber-Kukkonen model, 15/153-154 
Websites, for organizations, 23/2, 5-6; 
A34/2-3 

Weibull distribution, 7/17,54-55 
Welding 

fusion, 12/17-18 
hazards, 25/27-28 
Welding Institute, A29/5 
publications of, A28/86 
Welds 

corrosion at, 12/86 
flammable fluids and, 21/29 
inspection of, 19/19 
isolation, temporary, 21/29 
maintenance, 21/27-33 
on pipes/pipelines, 21/29-30 
precautions, 21/29,31 
procedures, 21/31-32 
regulations, 21/27 
testing of, 19/30-31 
Westergaard stress function, 12/88 
West Helena, Arkansas, Al/66 
Westwego, Louisiana, Al/48 
WETAFH model, 15/255 
Wet air oxidation (WAO), All/20 
Wet deposition, 15/298-300 
Wetting agents, fire protection and, 
16/277 

Whalley method, human error 

assessment, 14/83-84,85, 86,87 
What if analysis, 8/26,29, 32-33 


WHAZAN computer code, 9/56,62-63; 

15/14; 18/77; 29/5 
Wheatley model, 15/153 
White method, human error assessment, 
14/83 

Whiting, Indiana, Al/30 
Wichita Falls,Texas, Al/26 
Wide-ranging On-line Data for 
Epidemiological Reporting 
(WONDER), 2/10 
Wiekema model, 17/160-163 
Williams model, 17/158-159 
Wilson passive plume model, 15/274-276 
toxic gas clouds, 15/287-288 
Wind, dispersion and 
characteristics, 15/76-77 
direction fluctuations, 15/95 
geostrophic, 15/77-78 
plumes in, 15/145-147 
turbulence, momentum flux, eddy 
viscosity, and mixing length, 
15/78-79,95-96 

velocity, 15/79-81,95,166,183-184 
Windows/flying glass. See Glass, injuries 
from flying 
Windscale, UK, A20/9 
Wind tunnel modeling 
performance envelope, 15/226 
Porton Down field trials, 15/226,228, 
229 

scaling for, 15/224-226 
Thorney Island field trials, 15/222, 
226-227, 230, 231, 232, 233, 234, 
235, 236,237 

universal plume profile, 15/226,227 
Wire drawing, 15/10 
Wood, ignition of, 16/235-238 
Woodward model, 15/265 
Workbook model, 15/191 
applications, 15/200 
basic, 192 


concentrations, 15/199-200, 

278-279 

for continuous release, 15/192—194 
dispersion at buildings and obstacles, 
15/200 

dispersion in complex terrain, 

15/200 

for instantaneous release, 15/194-197 
release criteria, 15/197-198 
thermodynamic and heat transfer 
effects, 15/198-199 
transient release, 15/198 
wind tunnel modeling, 15/224—226 
Work situation model, 14/46 
World Health Organization, publications 
of, A28/87 

World Offshore Accident Database 
(WOAD), 27/19 


XCON, 30/39-40,44 
XPLAIN, 30/36 


Yao model, 17/73 
Yellow book model, 9/56,62 
Yield and tensile strengths, steel 
and, 12/9 

Youngstown, Florida, 23/73; Al/50 
Yoyo Marti , 23/76 


Zabetakis model, 17/40 
Zeldovich-von Neumann-Doring model, 
17/10 

ZEPHYR model, 15/203, 234, 249,250 
Zinc embrittlement, 12/85 
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ABAQUS,29/31 
Achilles,30/62 
ADMIN,29/11 
ADSIM/SU,29/9 
ADSORB,29/9 
ADVENT,29/7,10 
AEROSOL,29/27 
AFTC,30/82 
AGE,30/39,43 
AIRFLOW,29/8 
AIRS,29/19 
AIRTOX, 29/25 
ALLCUTS,29/21 
ALMONA, 29/20 
AM,30/30 
ARCHIE,29/28 
ART,30/43 
ASAPIPE,29/31 
ASAS-NI,29/31 
ASAWELL,29/31 
ASCEND,30/51 
ASME,8,29/10 
ASPEN PLUS,29/7,10 
ASTEC,29/19 
AUDIT-PC, 29/20 
AUSCOR,30/62 
AUTDYN,29/31 
Autocad,29/6 
AutoPLANT,29/6,11 
AutoPLANT Cable Scheduler,29/11 
AutoPLANT Data,29/30 
AutoPLANT Instrumentation 
Index,29/18 

AutoPLANT Isogen,29/8 
AutoPLANT Isometrics,29/8 
AutoPLANT LOOP,29/18 
AutoPLANT P&ID,29/7 

BACFIRE,29/21;30/82 
BACFIRE 11,29/21 
BAGGER,30/43 
Baker,29/19 

Batch Process Advisor,29/18 

BATCHCAD,29/9 

BATCHDIST,29/9 

BATCHFRAC,29/9,10 

BFR,29/21 

BIOSIS, 29/18 

BLAST,17/50,173;29/26,27 

BLOWDOWN,29/24 

BLOWSIM,29/24 

BLP,29/24 

BRAVO,29/6,21,22 

BREEZE,29/6 

BREEZE Air Complex-1,29/24 
BREEZE AIR ISCLT,2,29/24 
BREEZE AIR ISCST,2,29/24 
BREEZE AIR SCREEN,29/24 
BREEZE HAZ,29/24 
BREEZE HAZ DEGADIS,29/24 
BREEZE HAZ INPUFF,29/24 
BREEZE HAZ SPILLS,29/24 
BREEZE HAZ WAKE,29/24 
Bretherick Reactive Chemical 
Hazards Database,29/18 


C++,30/18,38 

CADPIPE,29/6 

CADPIPE ISO,29/8 

CADPIPE INTERACT,29/10 

CADPIPE ORTHO,29/8 

CADPIPE P&ID,29/7 

CADPIPE STRUCTURAL,29/11 

CADPIPE WALKTHRU,29/11 

CADROS, 17/236 

CADUCEUS,30/42 

CAFTA +PC,29/21 

CAFTS, 30/82 

CALINE,29/24 

CAMILE,29/18 

CAMS,29/11 

CANCER,29/19 

CARA,29/21,22 

CARE,29/25 

CARES,29/23 

CAS, 29/18 
CASD, 29/27 
CASNET,30/41,42 
CASSANDRA,29/22 

CAT, 30/82,84 
CATCON,29/11 
CB,29/18 
CDM,2,0,29/24 
CEDA,29/9 
CEP,30/97,98 
CHAOS,29/28,31 
CHARM,29/25,26,30 
CHEM-BANK, 29/18 
CHEMCALC,29/7 
CHEMCALC,1,29/8 
CHEMCALC,2,29/8 
CHEMCALC,3,29/10 
CHEMCALC, 4,29/8 
CHEMCALC,5,29/7 
CHEMCALC,6,29/9,10 
CHEMCALC,8,29/8 
CHEMCALC,10,29/8 
CHEMCALC,12,29/9 
CHEMCALC,15,29/8 
CHEMCALC,17,29/30 
CHEMCALC,18,29/30 
CHEMCO,29/7,18 
ChemEngDB,29/10 
Chemflex Batch Automation 

Software,29/18 

Chemical Compliance Monitor,29/19 

ChemOffice,29/6 

CHEM-PLUS,29/27 

CHEMSAFE,29/7,18 

CHEMTOX,29/18 

CHEMTRAN,29/7 

CHIEF,29/26,30 

CHLORINE,29/25 

CHRIS,29/18 

CIGALE 2,29/25 

CIRRUS,29/28 

CISDOC,29/18 

CLASHER,29/12,15 

CLEAR,29/27 

CLICHE,17/50,98,173;29/27,28,31 
CLOUD,29/26,27 


CMBWAT, 29/27 
COADE,29/21 
COBRA,29/31 
COBRA 111,29/25 
COGSYS,30/63 
Combust,29/19 
Combustion Analysis,29/19 
COMCAN,29/21 
COMCAN 11,29/21 
COMDACE.29/8 
COMHAZOP,30/68,70 
COMMIX,29/31 
Common Lisp,30/43,51 
COMPENDEX-4,29/19 
COMPI,29/19 
COMPIPE,29/8 
COMPRESS,29/9 
COMPROC.29/9 
COMPUMP.29/9 
COMPUTER MAN,17/245 
COMSITE,29/9 
CONFIGURATOR,30/73 
CONFLO,29/8 
CONPHYDE,30/62 
CONSEQ,29/29 
CONSOLIDATOR,30/73 
CONTAIN,29/31 

CONTROL VALVE SIZING FLUID 
CONTROL ANALYSIS,29/8 
Convective Heat Transfer,29/9 
COPTERA, 29/23 
CORRAL,A23/4 
COST,29/22 
CRAC,29/31 
CRASH,17/226;29/31 
CRSTER,29/24 
CRUNCH,9/99;29/25; A17/2 
CSMP,29/17 
CSPACK,29/8 
CST-1,29/9 
CUTSET,29/21,22 

DACE,29/9 
DAMAGE,29/23 
Data Base Manager,29/19 
DATACON,29/12,15 
DATAL,29/12 
DECADE,30/63 
DEERS,29/23 
DEGADIS,29/25,28 
DELOS,29/10 
DEN20,29/25 
DENDRAL,30/40 
DENZ,29/25;A17/2 
DESC2,29/29 
DESCON,29/12 
DESIGN 11,29/7 
DESIGN-KIT,30/51,52 
Design Review,29/11 
DEVISER,30/26,30 
Dimension 111,29/11 
DIPPR,29/7,10,28 
Disc Calc,29/24 
DISCO,29/25 
DISCOVER,29/30 
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DISP2,29/25 
DISPI,29/29 
DISTILSET,29/9 
DISTPACK,29/11 
DOGS,29/6 
DPS,29/17 
DRAFT,30/82 
DRAGON,29/7,11,12 
DRAWCON,29/11,12 
DRIFT,29/24,25 
DSL/77,29/17 
DSNP,29/17 
DSPL,30/47,61,105 
DUSTEXPERT,30/63 
DYFLO,29/17 
DYNA-3D,29/31 
DYNSYS, 29/17 
DYNUT,ll/5 

EAD, 29/23 
EAHAP,29/25 
ECONOMIST,29/7 
EFFECTS,29/27,28 
EIDAS,All/27;29/18,19,A17/13 
EINECS, 29/19 
ELRAFT,29/21 
EMBASE,29/19 
EMYCIN,30/40,43 
Engineers Aid,29/7 
ENGULF,17/26;29/26,27 
ENGULF,17/182-183 
ENGULF 11,29/26,27 
EnvIDAS,All/27;29/18,19 
ENVIROFATE,29/30 
Environmental Fate Database, 

29/30 

EORIKS,29/23 
EQUIP,29/9 

Equipment Selection in Solid-Liquid 
Separation Expert Systems,29/9 
ERECON,29/11 
ERST,29/23 
ESCA, 29/22 
ESCAPE,29/31 
ESCORLT,30/100,105 
ESP,29/11,30 
ESP ADVISER,30/43 
ETA 11,29/22 
EURISKO,30/30 
EURYDYN,17/226 
EVAP,29/9,26 
EVAS,29/27 
EVNTRE,29/22 
EVTGEN,30/90 
EXAMS,11/15 
EXCENTANK,29/23 
EXFRAG,17/234;29/26 
EXMOD,17/234;29/26 
EXPEL,29/26 
EXPERT,30/43,105 
EXPERTEASE,30/43,55 
EXPOSURE-1,29/27 
EXSIM,17/50,173 
EXTRAN,29/ll;30/33,43,55 


FACTS,29/18,19 
FALCON,30/105 
Fast Regs,29/19 
FATRAM,29/21 
FAULT,30/90 

FAULTFINDER,30/82,84-92 
FAULTrease,29/20 
Fault Tree,29/20 
FAULTRAN, 29/20 
FAUNET,29/21 
FAX,30/106,107 
FEM-3,29/25 
FENCE,62,29/26 
FFREQ,29/29 
FH-0,29/9 
FIRE-2,29/27 
Fired Heater,29/9 
FIRENET,29/27 
FIREPLY,29/27 
FIRES-T3,29/23 
FLACS,17/50,98,173;29/27,31 
FLAME,29/19 
FLARE,29/9,27 
FLAREfF 34),29/9 
FLARE HDR,29/9 
FLARENET,29/9 
FLARESIM,29/9 
FLARESTK.29/9 
FLOPACK,29/11 
FLOSHEET 3,29/7 
FLOSYS,29/20 
FLOW 3D,29/20 
FLOW(F 37),29/8 
FLOWPACK 11,29/7 
FLOWTRAN,29/7 
FLUENT,29/20 
FLUSH,29/23 
FMEA,29/20 
FMEA-PC,29/20 
FORTRAN,30/18 
FRACTURE 1,29/29 
FRAGHAZ,29/26 
FRANDOM,29/21,22 
FRANTIC,29/21 
FRANTIC 11,29/21,22 
FRISB,17/217 
FTAP,29/21,23 
FTS,30/82,84,106 
FTSA,30/82 

Gas Combustion,29/19 
Gas Compressor,29/9 
GASEX1,29/26,27 
GASEX2,29/26,27 
GASP,29/26,27 
GASprogram,29/6 
GASTAR, 29/25 

General Problem Solver,30/24—27 

GENESIS,29/7 

GO,29/21 

GOTRES,30/106 

Gravity Drain Flow,29/8 

GROCON,29/12 

GROUT,29/12 


HACKER,30/31 

HANDLING EMERGENCIES,29/30 

HARIS,29/18 

HAZARD,29/23 

Hazard Manager,29/20 

HAZARD TEXT,29/19 

HAZEXPERT,30/68,70 

HAZExpert,30/70 

HAZID,30/68-75,84-86 

HAZOPEX,30/68-70 

HAZOP-PC,29/20 

HAZOPtimiser,29/20 

HazReg,29/19 

HAZSECplus,29/20 

HAZWASTE,29/19 

HDSB, 29/19 

HEATEX,29/9 

HEATNET,29/7 

HEAVYGAS,29/25 

HEAVYPUFF,29/25 

HED5,29/10 

HEGAD, 29/25 

HEGADAS,29/25,26,28 

HEGADAS 11,29/25 

HETEX,29/9 

HEXNET,29/7,9 

HFPLUME,29/26 

HFSPILL,29/26 

HGSYSTEM,29/26,28 

HSDB,29/18 

HSELINE, 29/18 

HSPF, 29/30 

HUBBLE-BUBBLE 1,29/23 
HUBBLE-BUBBLE 11,29/23 
HYDRONET.29/8 
Hyprogram,29/6 
HYPROP,29/7,11 
HYPSMOS,29/8 
HYSIM,29/11 
HYSYS,29/11 

IBIS,29/30 

IDENTIFIER,30/73 

IDLH,29/18 

IMPACT,29/29 

IMPORTANCE,29/21;30/82 

INDECS,29/17 

INDUCE,30/33 

INFOTEXT,29/19 

INIS,29/19 

Inpuff,All/25 

INSTRUCALC, 29/18,24 

Instrument Configurator,29/18 

INTERCON, 29/11 

INTERLISP,30/17 

INTERN,29/9 

INTERNIST,30/42 

IPA,29/18 

IRIS,29/19 

IRR AS-PC,29/21 

ISC,11/15,25;29/24 

ISCLT,All/15;29/28 

ISCST,All/15;29/28 

ISMEC-10,29/19 
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ISOGEN,29/8,11 
ISOSTEEL,29/11 


JANAF,29/18 
JETFIAN,29/26 
JETLEK,29/28 
JINX2,29/29 


KAS,30/39,43 
KEE,30/43,51 
KES,30/43 
KEYDATA,29/7 
KITT,29/21;30/82;A23/4 
KITT-1,30/82 
KITT-2,30/82 
KNOD,30/53 
KRL, 30/63 


LEAKER,29/27,28 
LEKCON,29/27,28 
LISP,30/16-18,38,94 
LISP1.5,30/17 
LINKman,30/63 
LOGAN,29/21 
LPOOL,29/28 


MACBETH,30/31 
MACCS,29/31 
MACLISP,30/17 
MADCAP,29/9 
MADD-1,29/8 
MADD-2,29/9 
MADD-3,29/9 
MADD-4,29/9 
MAJESTIC,29/29 
MANAGE-PC,29/20 
MARIAH,29/25 
MASTER,30/73,90 
MAX,29/10 
MCPS,29/11 
MEDLINE,29/19 
MEDITEXT,29/19 
MELCOR,29/31 
MENTOR,30/63 
MERCURE-GL,29/25 
META-DENDRAL,30/40 
METEOR,29/22 
METSIM,29/7 
MFAULT,29/21 
MHIDAS,All/27;29/18,19 
MICSUP,29/21 
MIDAS,29/25;30/105 
MIXDAT,29/7 
MOCARS,29/22;30/82 
MOOTS,29/21;30/82 
MOD,29/31 
MODELLA,30/51 
Model Manager,29/10 
MOD ESI,29/9 
MODEX,30/105 
MODEX2,30/105 
MODGEN,30/73,90 


MOLGEN, 30/26 
MONITOR,29/11 
MPTER, 29/24 
MSDS ACCESS, 29/19 
MSDS ENGINE, 29/19 
MSDS EXPRESS,29/19 
MSDSFILE,29/19 
MSDS-Rite,29/19 
MULTICOL,29/9 
MULTIFLOW 11,29/8 
Multiphase and General fluid 
Flow,29/8 

MULTIPLEX29/22 
MUSTER,29/31 
MYCIN,30/37,38,40,43 


NEOMYCIN,30/38 
NET-FLOW,29/8 
NEWCOST,29/7 
NILU,29/25 
NIOSHTIC,29/18 

NIST Mixture Property Database, 
29/18 

NISTprogram,29/6 
NIST THERMO,29/18 
NIST Thermophysical Properties of 
Pure Fluids,29/18 

NIST Thermophysical Properties of 
Refrigerant Mixtures,29/18 
NOAH,30/26,28 
NONLIN,30/26,29 


OASYSDYNA- 3D, 29/31 
OCD,29/24 
OHMTADS,29/19 
OHRAT,29/29,31 
OMNI-EQUIP,29/11 
OMNI-FLOW,29/7 
OMNI-ISO,29/8 
OMNI-PIPE,29/8 
OMNIprogram,29/6 
OMOLA,30/51 
Oncologic,29/19 
ONDLEK,29/28 
OPS5,30/39,43 
OSH-ROM,29/18 
ORCHARD,29/20 
OREDA,29/19,31 
ORIFEN.A23/4 


PATREC,29/21,22 
PC CHRIS93,29/18,19 
PC Compliance,29/19 
PC-SELECT,29/8 
PDMS,29/7,11-15,17 
PDP-COMP,29/9 
PDP-DIST.29/9 
PDP-FIASH.29/8 
PDPprogram,29/6 
PDS,29/11 
PEGS,29/7,10 
PEST-BANK,29/18 


PEW,29/8 
PHA-PC,29/20 
PHAST,29/27,28 
PHENICS,29/9 
PHOENICS,29/20 
PHYSPAC,29/7 
PHYSPAK,29/11 
PICON,30/63,105 
P&ID,29/7 
PIG,29/8 
PIP,30/53 
PIPE,29/9,22 
PIPE1,29/23 
PIPE2,29/23 
PIPEBREAK,29/29 
PIPECALC.29/8 
PIPECALC 1,29/8 
PIPE-FLO,29/8 
PIPENET,29/8 
PIPENET Spray-Sprinkler 
Module,29/8 

PIPENET Transient Module, 

29/8 

PIPE-PRO,29/8 
PIPER,29/8,12 
PIPESIM,29/31 
PIPESIZE.29/8 
PLANT,29/20,29 
Plant Manager,29/17 
Plant Safe,29/30 
PLATO,29/22,31 
PL-MOD,29/21 
PLUMEPATH,29/25 
PM Solver,29/17 
POPS,30/94 
PPDS,29/7 

PRAIRIE,All/15;29/30 
PRAM,29/29 
PREP,29/21;30/82;A23/4 
Probability Distribution Plotting, 
29/22 

PROCEDE.29/7 
PROCESS,29/7 
PROCHEM,29/30 
PRODES,30/106 
PRODOBAS,29/10 
PROFIT,29/29 
PRO-FLOW,29/7 
programCALC,29/6 
program-FLO,29/6 
program-PC,29/6 
PRO-ISO,29/8 
PROLOG,30/16-18,38 
PROPERTIES-PLUS,29/7 
PROPHET,29/11 
PROPHT/SELECT,29/7 
PRO-PIPE,29/8 
PRO-PLANT/STEEL, 29/11 
PROprogram,29/6 
PROSPECTOR,30/41 -43,62 
PROTECT,29/20 
PROVUE 2D,29/7,11 
PROVUE 3D,29/7,11 
PROVUE DB,29/7,10 
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PRPACK,29/8 
PSA5,29/8 
PSAIS,30/70 
PSDGEN,29/23 
PUMP,29/9 
PUMF-FLO,29/8,9 
PVES,29/10 

QUEEN,30/68 

Rl,30/40,42,43,46 
RACKO,29/12 
RADFRAC,29/9,11 
RAD3D,29/20 
RAGE,29/30 
RAM,29/24 
RAT,29/29 
RATEFRAC,29/9 
REACTION,29/9 
REACTOR,30/105 
REAGAS,17/50,173;29/28 
RECONFIGURER,29/11 
RECONSET,29/30 
REEF,30/50 
REFRIG,29/18 
REGMAT,29/19 
RELAP,29/31 
RELCODE,29/20 
RELDAT,29/20 
RELIEF,29/24 
REPORTER,29/12 
RESCUE,29/31 
REVIEW,29/11 
RIKKE,30/82,84 
RISKAT,29/26,28,29 
RISKLINE,29/18 
RISKMAN,29/22 
RKH-2,29/9 
RTECS,29/19 
RTF-2,29/9 

SAFE-D, 29/20 
SAFEMODS,29/25 
SAFE-R,29/20 
SAFER,29/26,30 
SAFETI,16/159,219;29/26,29; 

A17/2,3,7,10,12 
SAFETI Classic,29/29 
SAFETI Micro,29/29 
SAFETI Toolkit,29/29 
SAFETI,29/24 
Safety Audit Manager,29/20 
Safety Case Manager,29/30 
SAFIRE,17/104,107;29/24 
SALP-3,29/21 
SAMPLE,29/22;30/82 
SARA,29/19 
SARA TEXT,29/19 
SARVAL,29/24 
SAVOIR,30/43 
SCC,30/62 
SCEH,29/20 
SCON,29/9 
SENS, 29/21,22 
SEPARATE,29/9 


Series 5000,29/6 
SETS,29/21 
SHAKE,29/23 
SHELF,29/29 
SHELTER,29/27 
SIGMET,29/25 
SIGMET-N, 29/25 
SIMBAD,30/53 
Simusolv,29/17 
SLAB,29/25 
SLUMPING,29/25 
SMACS, 29/23 
SMALLTALK,30/18,38,80 
SMOKE,29/27 
SNAP,29/20 
SP-10,29/9 
SPADE,29/10 
SPASM,29/22 
SPECON,29/11 
SPECSHT,29/7 
SPEED UP,29/7,10,17 
SPILL,29/26,27;A17/3 
Spill Release Advisor,29/19 
SPILLS,29/26,27 
SPREAD,A17/3 
SPRAY 65,29/26 
SRD,29/19 
ST-5,29/9 
STADIC,29/22 
STAR,29/20 
STARS,29/22 
STE AMBAC C,29/9 
STEAM (F36),29/9 
Steam Needs Analysis Program, 
29/9 

STEAMPAK,29/7 
Steam Tables,29/7 
STEAMSYS,29/9 
STEAMER,30/38 
STEM,29/10 
STEP,29/9 
STIRRER,29/9 
STRIPS,30/26,27,95,97 
SUPER,29/22 
SUPERCHEMS,29/28 
SUPERFLARE,29/9 
SUPERNET,29/22 
SUPERPOCUS,29/21;30/82 
Supertarget,29/7 
SUPER-TREE,29/22 
SYMBOL,29/7 
SYMGEN,29/7 
SYNICS,30/63 
SYNSET,29/7 
SYSLAG,30/62 

TABLES,29/11 
TANK,29/10 
TANKCAR,29/27 
TANKFREQ, 29/23 
TAPP,29/7 
T-BRUN.29/9 
TECJET,29/26-28 
TEIRESIAS,30/30,40 
THERM,29/18 


Thermodynamic Properties of Water 
and Steam,29/7 
Thermodynamics & Physical 
Property Data,29/7 
Thermosim Equil,29/18 
THORIN,29/29 
TMA,29/9 

TMA-Air Cooler,29/9 
TMA program,29/6 
TME-MECH,29/9 
TME-THERM,29/9 
TNET,29/8 
TORCIA,16/238 
TOWER,29/9 
TOXBIB,29/18 
TOXLINE,29/18 
TOXLINE PLUS,29/18 
TOX-SCREEN, All/15 
TPCMPR,29/9 
Tprogram,29/6 
TPIPE.29/8 
TPUMP,29/9 
TRAC,29/31 
TRACE,29/25 
TraceCalc,29/10 
TrackRite,29/19 
TRANSPIRE,29/28,29 
Transportation Risk Screening 
Program,29/30 
TRANSLOC,29/25 
TRAUMA,29/26,27 
TRC Data Bases for Chemistry and 
Engng Equilibria in Binary 
Systems,29/18 
TRC program,29/6,7 
TRC THERMO,29/18 
TREB.29/9 
TREDRA,29/20;30/82 
TREE,29/20;30/82 
TRIFLANGE,29/8,10 
TRIFLEX,29/8 
TRIFLOW,29/8 
TRI program,29/6 
TRISTEAM,29/9 
TRI*THERM,29/9 
TRI-VESSEL,29/10 
TSTEAM,29/7 
TTKEM, 29/30 
TWEAK,30/26,28 
TWO-PHASE,29/8 
TWOPHASE.29/8 

UAM,29/24 
UMPFIRE,16/238 
UNAMAP,29/24 
UNIOPT,29/7 
USCG CHRIS,29/19 

VAPID,29/25 
VENTEX,17/98;29/27 
VESSEL,29/10 
VESSEL 55,29/10 
VESSEL (F19),29/10 
VESSELPAK,29/9 
VISA 11,29/20 
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VLE,29/7,18 
VLE SET,29/18 
VRJTankheat,29/26 
VT*VESSEL,29/26,27 

WAM-BAM,29/21 
WAMCOM,29/21 


WAMCUT,29/21 
WASPA,29/30 
WBD2,17/258 
WERCO,29/10 
WHAT-IF-PC,29/20 
WHAZAN,29/26,28,29 
WINSR 2,29/29 


XCON,30/42,43,46 
XPLAIN,30/38 

Z ABSORBER,29/9 
ZEPHYR,29/25 



